<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" encoding="UTF-8" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:admin="http://webns.net/mvcb/" xmlns:atom="http://www.w3.org/2005/Atom/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:googleplay="http://www.google.com/schemas/play-podcasts/1.0" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd" xmlns:fireside="http://fireside.fm/modules/rss/fireside">
  <channel>
    <fireside:hostname>web01.fireside.fm</fireside:hostname>
    <fireside:genDate>Sat, 18 Apr 2026 03:32:49 -0500</fireside:genDate>
    <generator>Fireside (https://fireside.fm)</generator>
    <title>BSD Now - Episodes Tagged with “Openbsd”</title>
    <link>https://www.bsdnow.tv/tags/openbsd</link>
    <pubDate>Thu, 16 Apr 2026 09:00:00 -0400</pubDate>
    <description>Created by three guys who love BSD, we cover the latest news and have an extensive series of tutorials, as well as interviews with various people from all areas of the BSD community. It also serves as a platform for support and questions. We love and advocate FreeBSD, OpenBSD, NetBSD, DragonFlyBSD and TrueOS. Our show aims to be helpful and informative for new users that want to learn about them, but still be entertaining for the people who are already pros.
The show airs on Wednesdays at 2:00PM (US Eastern time) and the edited version is usually up the following day. 
</description>
    <language>en-us</language>
    <itunes:type>episodic</itunes:type>
    <itunes:subtitle>A weekly podcast and the place to B...SD</itunes:subtitle>
    <itunes:author>JT Pennington</itunes:author>
    <itunes:summary>Created by three guys who love BSD, we cover the latest news and have an extensive series of tutorials, as well as interviews with various people from all areas of the BSD community. It also serves as a platform for support and questions. We love and advocate FreeBSD, OpenBSD, NetBSD, DragonFlyBSD and TrueOS. Our show aims to be helpful and informative for new users that want to learn about them, but still be entertaining for the people who are already pros.
The show airs on Wednesdays at 2:00PM (US Eastern time) and the edited version is usually up the following day. 
</itunes:summary>
    <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
    <itunes:explicit>no</itunes:explicit>
    <itunes:keywords>berkeley,freebsd,openbsd,netbsd,dragonflybsd,trueos,trident,hardenedbsd,tutorial,howto,guide,bsd,interview</itunes:keywords>
    <itunes:owner>
      <itunes:name>JT Pennington</itunes:name>
      <itunes:email>feedback@bsdnow.tv</itunes:email>
    </itunes:owner>
<itunes:category text="News">
  <itunes:category text="Tech News"/>
</itunes:category>
<itunes:category text="Education">
  <itunes:category text="How To"/>
</itunes:category>
<item>
  <title>659: Full traffic send</title>
  <link>https://www.bsdnow.tv/659</link>
  <guid isPermaLink="false">6e047ed8-f93f-4854-adaa-8e3fd2119e11</guid>
  <pubDate>Thu, 16 Apr 2026 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6e047ed8-f93f-4854-adaa-8e3fd2119e11.mp3" length="65356800" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Wayland setting back Linux, Dr Callahan's semi retirement, holding onto your hardware, PF queues breaking the 4gbps barrier, and mroe...</itunes:subtitle>
  <itunes:duration>1:08:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Wayland setting back Linux, Dr Callahan's semi retirement, holding onto your hardware, PF queues breaking the 4gbps barrier, and mroe...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Wayland set the Linux Desktop back by 10 years (https://omar.yt/posts/wayland-set-the-linux-desktop-back-by-10-years)
Semi-retirement, or, really, changing my relationship with the BSDs (https://briancallahan.net/blog/20260322.html)
Hold on to Your Hardware (https://マリウス.com/hold-on-to-your-hardware/)
News Roundup
PF queues break the 4 Gbps barrier (https://www.undeadly.org/cgi?action=article;sid=20260319125859)
Nobody said there was math on this exam! (https://vulcanridr.mataroa.blog/blog/nobody-said-there-was-math-on-this-exam/)
The web is bearable with RSS (https://pluralistic.net/2026/03/07/reader-mode/#personal-disenshittification)
The Pipe (https://vivianvoss.net/blog/the-pipe)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Wayland setting back Linux, Dr Callahan&#39;s semi retirement, holding onto your hardware, PF queues breaking the 4gbps barrier, and mroe...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://omar.yt/posts/wayland-set-the-linux-desktop-back-by-10-years" rel="nofollow">Wayland set the Linux Desktop back by 10 years</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20260322.html" rel="nofollow">Semi-retirement, or, really, changing my relationship with the BSDs</a></p>

<hr>

<p>[Hold on to Your Hardware](https://マリウス.com/hold-on-to-your-hardware/)</p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20260319125859" rel="nofollow">PF queues break the 4 Gbps barrier</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/nobody-said-there-was-math-on-this-exam/" rel="nofollow">Nobody said there was math on this exam!</a></p>

<hr>

<p><a href="https://pluralistic.net/2026/03/07/reader-mode/#personal-disenshittification" rel="nofollow">The web is bearable with RSS</a></p>

<hr>

<p><a href="https://vivianvoss.net/blog/the-pipe" rel="nofollow">The Pipe</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Wayland setting back Linux, Dr Callahan&#39;s semi retirement, holding onto your hardware, PF queues breaking the 4gbps barrier, and mroe...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://omar.yt/posts/wayland-set-the-linux-desktop-back-by-10-years" rel="nofollow">Wayland set the Linux Desktop back by 10 years</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20260322.html" rel="nofollow">Semi-retirement, or, really, changing my relationship with the BSDs</a></p>

<hr>

<p>[Hold on to Your Hardware](https://マリウス.com/hold-on-to-your-hardware/)</p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20260319125859" rel="nofollow">PF queues break the 4 Gbps barrier</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/nobody-said-there-was-math-on-this-exam/" rel="nofollow">Nobody said there was math on this exam!</a></p>

<hr>

<p><a href="https://pluralistic.net/2026/03/07/reader-mode/#personal-disenshittification" rel="nofollow">The web is bearable with RSS</a></p>

<hr>

<p><a href="https://vivianvoss.net/blog/the-pipe" rel="nofollow">The Pipe</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>658: It’s the vibe of it </title>
  <link>https://www.bsdnow.tv/658</link>
  <guid isPermaLink="false">6de65ecc-523c-42e5-b5f2-016ea5a40b12</guid>
  <pubDate>Thu, 09 Apr 2026 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6de65ecc-523c-42e5-b5f2-016ea5a40b12.mp3" length="57636480" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD and OpenZFS in the Quest for Technical Independence, Reviews make you 10x slower, OpenBSD on a Motorola 88000, Jailrun, and more.</itunes:subtitle>
  <itunes:duration>1:00:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD and OpenZFS in the Quest for Technical Independence, Reviews make you 10x slower, OpenBSD on a Motorola 88000, Jailrun, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD and OpenZFS in the Quest for Technical Independence: A Storage Architect’s View (https://klarasystems.com/articles/freebsd-and-openzfs-in-quest-for-technical-independence/)
Every layer of review makes you 10x slower (https://apenwarr.ca/log/20260316)
News Roundup
The story of OpenBSD on Motorola 88000 series processors (https://www.undeadly.org/cgi?action=article;sid=20260325122415)
Jailrun (https://jail.run)
 + jailrun github (https://github.com/hyphatech/jailrun)
FreeBSD Users: We Need to Talk About Claude Code (https://stevengharms.com/posts/2026-03-04-freebsd-users-we-need-to-talk-about-claude-code/)
Vibe-coded ext4 for OpenBSD (https://lwn.net/SubscriberLink/1064541/1a399d572a046fb9/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD and OpenZFS in the Quest for Technical Independence, Reviews make you 10x slower, OpenBSD on a Motorola 88000, Jailrun, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/freebsd-and-openzfs-in-quest-for-technical-independence/" rel="nofollow">FreeBSD and OpenZFS in the Quest for Technical Independence: A Storage Architect’s View</a></p>

<hr>

<p><a href="https://apenwarr.ca/log/20260316" rel="nofollow">Every layer of review makes you 10x slower</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20260325122415" rel="nofollow">The story of OpenBSD on Motorola 88000 series processors</a></p>

<hr>

<p><a href="https://jail.run" rel="nofollow">Jailrun</a></p>

<h2> + <a href="https://github.com/hyphatech/jailrun" rel="nofollow">jailrun github</a></h2>

<p><a href="https://stevengharms.com/posts/2026-03-04-freebsd-users-we-need-to-talk-about-claude-code/" rel="nofollow">FreeBSD Users: We Need to Talk About Claude Code</a></p>

<hr>

<p><a href="https://lwn.net/SubscriberLink/1064541/1a399d572a046fb9/" rel="nofollow">Vibe-coded ext4 for OpenBSD</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD and OpenZFS in the Quest for Technical Independence, Reviews make you 10x slower, OpenBSD on a Motorola 88000, Jailrun, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/freebsd-and-openzfs-in-quest-for-technical-independence/" rel="nofollow">FreeBSD and OpenZFS in the Quest for Technical Independence: A Storage Architect’s View</a></p>

<hr>

<p><a href="https://apenwarr.ca/log/20260316" rel="nofollow">Every layer of review makes you 10x slower</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20260325122415" rel="nofollow">The story of OpenBSD on Motorola 88000 series processors</a></p>

<hr>

<p><a href="https://jail.run" rel="nofollow">Jailrun</a></p>

<h2> + <a href="https://github.com/hyphatech/jailrun" rel="nofollow">jailrun github</a></h2>

<p><a href="https://stevengharms.com/posts/2026-03-04-freebsd-users-we-need-to-talk-about-claude-code/" rel="nofollow">FreeBSD Users: We Need to Talk About Claude Code</a></p>

<hr>

<p><a href="https://lwn.net/SubscriberLink/1064541/1a399d572a046fb9/" rel="nofollow">Vibe-coded ext4 for OpenBSD</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>657: Hibernation is a long sleep</title>
  <link>https://www.bsdnow.tv/657</link>
  <guid isPermaLink="false">2b668944-7cc4-4ec3-bf02-8627fee2b279</guid>
  <pubDate>Thu, 02 Apr 2026 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2b668944-7cc4-4ec3-bf02-8627fee2b279.mp3" length="48914304" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Real Cost of Technology Dependence, FreeBSD 15 Linuxator with CUDA, Bidirectional OPNsense/pfSense, Netbase, a SYN attack, and more...</itunes:subtitle>
  <itunes:duration>50:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Real Cost of Technology Dependence, FreeBSD 15 Linuxator with CUDA, Bidirectional OPNsense/pfSense, Netbase, a SYN attack, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The Real Cost of Technology Dependence: Building Independence with Open-Source Storage (https://klarasystems.com/articles/the-real-cost-of-technology-dependence-building-independence-with-open-source-storage/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Building Hierarchical Jails (Podman x Native Jail) on FreeBSD 15 (https://github.com/isaponsoft/freebsd-ai-notes/blob/main/FreeBSD_jail_on_jail-en.md)
FreeBSD 15.0 Linuxulator with CUDA Setup (https://github.com/isaponsoft/freebsd-ai-notes/blob/main/CUAD_and_llama-server.md)
Bidirectional OPNsense/pfSense Firewall Configuration Migration/Conversion CLI (https://github.com/sheridans/pfopn-convert)
SYN attack (https://boston.conman.org/2026/01/28.2)
 + Syn attack follow up (https://boston.conman.org/2026/01/29.1)
Netbase is Port of NetBSD Utilities to Another UNIX Like Operating Systems (https://github.com/littlefly365/Netbase)
Beastie Bits
OpenBSD -current moves to 7.9-beta (https://undeadly.org/cgi?action=article;sid=20260311062921)
- Delayed hibernation comes to OpenBSD/amd64 laptops (https://undeadly.org/cgi?action=article;sid=20260312185620)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Real Cost of Technology Dependence, FreeBSD 15 Linuxator with CUDA, Bidirectional OPNsense/pfSense, Netbase, a SYN attack, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/the-real-cost-of-technology-dependence-building-independence-with-open-source-storage/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">The Real Cost of Technology Dependence: Building Independence with Open-Source Storage</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://github.com/isaponsoft/freebsd-ai-notes/blob/main/FreeBSD_jail_on_jail-en.md" rel="nofollow">Building Hierarchical Jails (Podman x Native Jail) on FreeBSD 15</a></p>

<hr>

<p><a href="https://github.com/isaponsoft/freebsd-ai-notes/blob/main/CUAD_and_llama-server.md" rel="nofollow">FreeBSD 15.0 Linuxulator with CUDA Setup</a></p>

<hr>

<p><a href="https://github.com/sheridans/pfopn-convert" rel="nofollow">Bidirectional OPNsense/pfSense Firewall Configuration Migration/Conversion CLI</a></p>

<hr>

<p><a href="https://boston.conman.org/2026/01/28.2" rel="nofollow">SYN attack</a></p>

<ul>
<li><a href="https://boston.conman.org/2026/01/29.1" rel="nofollow">Syn attack follow up</a></li>
</ul>

<hr>

<p><a href="https://github.com/littlefly365/Netbase" rel="nofollow">Netbase is Port of NetBSD Utilities to Another UNIX Like Operating Systems</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20260311062921" rel="nofollow">OpenBSD -current moves to 7.9-beta</a></li>
</ul>

<h2>- <a href="https://undeadly.org/cgi?action=article;sid=20260312185620" rel="nofollow">Delayed hibernation comes to OpenBSD/amd64 laptops</a></h2>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Real Cost of Technology Dependence, FreeBSD 15 Linuxator with CUDA, Bidirectional OPNsense/pfSense, Netbase, a SYN attack, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/the-real-cost-of-technology-dependence-building-independence-with-open-source-storage/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">The Real Cost of Technology Dependence: Building Independence with Open-Source Storage</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://github.com/isaponsoft/freebsd-ai-notes/blob/main/FreeBSD_jail_on_jail-en.md" rel="nofollow">Building Hierarchical Jails (Podman x Native Jail) on FreeBSD 15</a></p>

<hr>

<p><a href="https://github.com/isaponsoft/freebsd-ai-notes/blob/main/CUAD_and_llama-server.md" rel="nofollow">FreeBSD 15.0 Linuxulator with CUDA Setup</a></p>

<hr>

<p><a href="https://github.com/sheridans/pfopn-convert" rel="nofollow">Bidirectional OPNsense/pfSense Firewall Configuration Migration/Conversion CLI</a></p>

<hr>

<p><a href="https://boston.conman.org/2026/01/28.2" rel="nofollow">SYN attack</a></p>

<ul>
<li><a href="https://boston.conman.org/2026/01/29.1" rel="nofollow">Syn attack follow up</a></li>
</ul>

<hr>

<p><a href="https://github.com/littlefly365/Netbase" rel="nofollow">Netbase is Port of NetBSD Utilities to Another UNIX Like Operating Systems</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20260311062921" rel="nofollow">OpenBSD -current moves to 7.9-beta</a></li>
</ul>

<h2>- <a href="https://undeadly.org/cgi?action=article;sid=20260312185620" rel="nofollow">Delayed hibernation comes to OpenBSD/amd64 laptops</a></h2>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>656: Honey, I shrunk the PDP</title>
  <link>https://www.bsdnow.tv/656</link>
  <guid isPermaLink="false">39c35bbe-01b2-4d96-950c-efd863c1b3fe</guid>
  <pubDate>Thu, 26 Mar 2026 17:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/39c35bbe-01b2-4d96-950c-efd863c1b3fe.mp3" length="67911552" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Designing OpenZFS Storage for Independence, The day Telnet died, PiDP 11/70, OpenBSD on SGI and more...</itunes:subtitle>
  <itunes:duration>1:10:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Designing OpenZFS Storage for Independence, The day Telnet died, PiDP 11/70, OpenBSD on SGI and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Designing OpenZFS Storage for Independence: Pool Architecture, Failure Domains, and Migration Paths (https://klarasystems.com/articles/designing-openzfs-storage-for-independence/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
2026-01-14: The Day the telnet Died (https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/)
Reports of Telnet’s Death Have Been Greatly Exaggerated (https://www.terracenetworks.com/blog/2026-02-11-telnet-routing)
News Roundup
PiDP-11/70 Build Workshop (https://icm.museum/blog/?p=446)
OpenBSD on SGI: a rollercoaster story (https://www.undeadly.org/cgi?action=article;sid=20260305143943)
Terminals Should Generate 256 Color Palette (https://gist.github.com/jake-stewart/0a8ea46159a7da2c808e5be2177e1783)
FreeBSD tribal knowledge: Changes to snapshot strategy (https://vulcanridr.mataroa.blog/blog/freebsd-tribal-knowledge-changes-to-snapshot-strategy/)
Beastie Bits
BSDCan reg is now open (https://www.bsdcan.org/2026/registration.html)
An Oral History of Unix (https://github.com/dspinellis/oral-history-of-unix/)
Major update to drm(4) code in OpenBSD-current (to linux 6.18.16) (https://www.undeadly.org/cgi?action=article;sid=20260310102936)
Patched FreeBSD AMIs (https://daemonology.net/blog/2026-01-20-Patched-FreeBSD-AMIs.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Designing OpenZFS Storage for Independence, The day Telnet died, PiDP 11/70, OpenBSD on SGI and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/designing-openzfs-storage-for-independence/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Designing OpenZFS Storage for Independence: Pool Architecture, Failure Domains, and Migration Paths</a></p>

<hr>

<p><a href="https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/" rel="nofollow">2026-01-14: The Day the telnet Died</a><br>
<a href="https://www.terracenetworks.com/blog/2026-02-11-telnet-routing" rel="nofollow">Reports of Telnet’s Death Have Been Greatly Exaggerated</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://icm.museum/blog/?p=446" rel="nofollow">PiDP-11/70 Build Workshop</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20260305143943" rel="nofollow">OpenBSD on SGI: a rollercoaster story</a></p>

<hr>

<p><a href="https://gist.github.com/jake-stewart/0a8ea46159a7da2c808e5be2177e1783" rel="nofollow">Terminals Should Generate 256 Color Palette</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/freebsd-tribal-knowledge-changes-to-snapshot-strategy/" rel="nofollow">FreeBSD tribal knowledge: Changes to snapshot strategy</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.bsdcan.org/2026/registration.html" rel="nofollow">BSDCan reg is now open</a></li>
<li><a href="https://github.com/dspinellis/oral-history-of-unix/" rel="nofollow">An Oral History of Unix</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20260310102936" rel="nofollow">Major update to drm(4) code in OpenBSD-current (to linux 6.18.16)</a></li>
<li><a href="https://daemonology.net/blog/2026-01-20-Patched-FreeBSD-AMIs.html" rel="nofollow">Patched FreeBSD AMIs</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Designing OpenZFS Storage for Independence, The day Telnet died, PiDP 11/70, OpenBSD on SGI and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/designing-openzfs-storage-for-independence/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Designing OpenZFS Storage for Independence: Pool Architecture, Failure Domains, and Migration Paths</a></p>

<hr>

<p><a href="https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/" rel="nofollow">2026-01-14: The Day the telnet Died</a><br>
<a href="https://www.terracenetworks.com/blog/2026-02-11-telnet-routing" rel="nofollow">Reports of Telnet’s Death Have Been Greatly Exaggerated</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://icm.museum/blog/?p=446" rel="nofollow">PiDP-11/70 Build Workshop</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20260305143943" rel="nofollow">OpenBSD on SGI: a rollercoaster story</a></p>

<hr>

<p><a href="https://gist.github.com/jake-stewart/0a8ea46159a7da2c808e5be2177e1783" rel="nofollow">Terminals Should Generate 256 Color Palette</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/freebsd-tribal-knowledge-changes-to-snapshot-strategy/" rel="nofollow">FreeBSD tribal knowledge: Changes to snapshot strategy</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.bsdcan.org/2026/registration.html" rel="nofollow">BSDCan reg is now open</a></li>
<li><a href="https://github.com/dspinellis/oral-history-of-unix/" rel="nofollow">An Oral History of Unix</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20260310102936" rel="nofollow">Major update to drm(4) code in OpenBSD-current (to linux 6.18.16)</a></li>
<li><a href="https://daemonology.net/blog/2026-01-20-Patched-FreeBSD-AMIs.html" rel="nofollow">Patched FreeBSD AMIs</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>655: No Reboot Required</title>
  <link>https://www.bsdnow.tv/655</link>
  <guid isPermaLink="false">0b5efcbe-f6ae-4ace-a306-f00504dd0238</guid>
  <pubDate>Thu, 19 Mar 2026 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0b5efcbe-f6ae-4ace-a306-f00504dd0238.mp3" length="58485120" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Jails for NetBSD, ARC and L2ARC sizing for Proxmox, Anatomy of bsd.rd, Docker Containers on FreeBSD, Running Time Machine inside a FreeBSD Jail, and more...</itunes:subtitle>
  <itunes:duration>1:00:55</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Jails for NetBSD, ARC and L2ARC sizing for Proxmox, Anatomy of bsd.rd, Docker Containers on FreeBSD, Running Time Machine inside a FreeBSD Jail, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Jails for NetBSD (https://netbsd-jails.petermann-digital.de)
ARC and L2ARC Sizing on Proxmox (https://klarasystems.com/articles/arc-and-l2arc-sizing-for-proxmox/)
News Roundup
Lab: Anatomy of bsd.rd — No Reboot Required (https://openbsdjumpstart.org/bsd.rd/)
Exploring Docker containers on FreeBSD (https://www.tumfatig.net/2026/exploring-docker-containers-on-freebsd/)
Time Machine inside a FreeBSD jail (https://it-notes.dragas.net/2026/01/28/time-machine-freebsd-jail/)
After decades on Linux, FreeBSD finally gave me a reason to switch operating systems (https://www.zdnet.com/article/freebsd-linux-review/)
Beastie Bits
-
-
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Emelio - openbsd (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/656/feedback/Emilio%20-%20openbsd.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd,  tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Jails for NetBSD, ARC and L2ARC sizing for Proxmox, Anatomy of bsd.rd, Docker Containers on FreeBSD, Running Time Machine inside a FreeBSD Jail, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://netbsd-jails.petermann-digital.de" rel="nofollow">Jails for NetBSD</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/arc-and-l2arc-sizing-for-proxmox/" rel="nofollow">ARC and L2ARC Sizing on Proxmox</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://openbsdjumpstart.org/bsd.rd/" rel="nofollow">Lab: Anatomy of bsd.rd — No Reboot Required</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2026/exploring-docker-containers-on-freebsd/" rel="nofollow">Exploring Docker containers on FreeBSD</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2026/01/28/time-machine-freebsd-jail/" rel="nofollow">Time Machine inside a FreeBSD jail</a></p>

<hr>

<p><a href="https://www.zdnet.com/article/freebsd-linux-review/" rel="nofollow">After decades on Linux, FreeBSD finally gave me a reason to switch operating systems</a></p>

<hr>

<hr>

<h2>Beastie Bits</h2>

<h2>-</h2>

<p>-</p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/656/feedback/Emilio%20-%20openbsd.md" rel="nofollow">Emelio - openbsd</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Jails for NetBSD, ARC and L2ARC sizing for Proxmox, Anatomy of bsd.rd, Docker Containers on FreeBSD, Running Time Machine inside a FreeBSD Jail, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://netbsd-jails.petermann-digital.de" rel="nofollow">Jails for NetBSD</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/arc-and-l2arc-sizing-for-proxmox/" rel="nofollow">ARC and L2ARC Sizing on Proxmox</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://openbsdjumpstart.org/bsd.rd/" rel="nofollow">Lab: Anatomy of bsd.rd — No Reboot Required</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2026/exploring-docker-containers-on-freebsd/" rel="nofollow">Exploring Docker containers on FreeBSD</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2026/01/28/time-machine-freebsd-jail/" rel="nofollow">Time Machine inside a FreeBSD jail</a></p>

<hr>

<p><a href="https://www.zdnet.com/article/freebsd-linux-review/" rel="nofollow">After decades on Linux, FreeBSD finally gave me a reason to switch operating systems</a></p>

<hr>

<hr>

<h2>Beastie Bits</h2>

<h2>-</h2>

<p>-</p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/656/feedback/Emilio%20-%20openbsd.md" rel="nofollow">Emelio - openbsd</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>654: Plasma Rage</title>
  <link>https://www.bsdnow.tv/654</link>
  <guid isPermaLink="false">857da424-dde2-4a97-b6f0-35bf1f79faf5</guid>
  <pubDate>Thu, 12 Mar 2026 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/857da424-dde2-4a97-b6f0-35bf1f79faf5.mp3" length="43625472" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Pool and Vdev topology for promox, KDE Plasma is not forcing systemd, Running a 2.11 BSD system, Booting NetBSD from a wedge and more...</itunes:subtitle>
  <itunes:duration>45:26</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Pool and Vdev topology for promox, KDE Plasma is not forcing systemd, Running a 2.11 BSD system, Booting NetBSD from a wedge and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Pool and VDEV Topology for Proxmox Workloads (https://klarasystems.com/articles/pool-and-vdev-topology-for-proxmox-workloads/)
News Roundup
KDE Plasma 6.6 is Not Forcing systemd(1) but Arguments Rage On. (https://theregister.com/2026/02/24/kde_plasma_66/)
An old article with covering : Running and administrating a 2.11 BSD system (https://thats-it-for-the-other-one.neocities.org/blog/about/211bsd)
Booting NetBSD from a wedge, the hard way (https://bentsukun.ch/posts/netbsd-wedge-boot/)
Beastie Bits
The NetBSD Foundation will participate in Google Summer of Code 2026! (https://blog.netbsd.org/tnf/entry/gsoc2026_tnf)
Solaris 11.4 SRU90: Preserve Boot Environments (https://c0t0d0s0.org/blog/solaris114preservebootenvironments.html)
zfs-2.4.1 (https://github.com/openzfs/zfs/releases/tag/zfs-2.4.1)
Hardening OPNsense: Using Q-Feeds to Block Malicious Traffic (https://youtube.com/watch?v=RYEizNBE9Y0)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Gary - A nice blog (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/654/feedback/gary%20-%20a%20nice%20blog.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd,  guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Pool and Vdev topology for promox, KDE Plasma is not forcing systemd, Running a 2.11 BSD system, Booting NetBSD from a wedge and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/pool-and-vdev-topology-for-proxmox-workloads/" rel="nofollow">Pool and VDEV Topology for Proxmox Workloads</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://theregister.com/2026/02/24/kde_plasma_66/" rel="nofollow">KDE Plasma 6.6 is Not Forcing systemd(1) but Arguments Rage On.</a></p>

<hr>

<p><a href="https://thats-it-for-the-other-one.neocities.org/blog/about/211bsd" rel="nofollow">An old article with covering : Running and administrating a 2.11 BSD system</a></p>

<hr>

<p><a href="https://bentsukun.ch/posts/netbsd-wedge-boot/" rel="nofollow">Booting NetBSD from a wedge, the hard way</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc2026_tnf" rel="nofollow">The NetBSD Foundation will participate in Google Summer of Code 2026!</a></li>
<li><a href="https://c0t0d0s0.org/blog/solaris114preservebootenvironments.html" rel="nofollow">Solaris 11.4 SRU90: Preserve Boot Environments</a></li>
<li><a href="https://github.com/openzfs/zfs/releases/tag/zfs-2.4.1" rel="nofollow">zfs-2.4.1</a></li>
<li><a href="https://youtube.com/watch?v=RYEizNBE9Y0" rel="nofollow">Hardening OPNsense: Using Q-Feeds to Block Malicious Traffic</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/654/feedback/gary%20-%20a%20nice%20blog.md" rel="nofollow">Gary - A nice blog</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Pool and Vdev topology for promox, KDE Plasma is not forcing systemd, Running a 2.11 BSD system, Booting NetBSD from a wedge and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/pool-and-vdev-topology-for-proxmox-workloads/" rel="nofollow">Pool and VDEV Topology for Proxmox Workloads</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://theregister.com/2026/02/24/kde_plasma_66/" rel="nofollow">KDE Plasma 6.6 is Not Forcing systemd(1) but Arguments Rage On.</a></p>

<hr>

<p><a href="https://thats-it-for-the-other-one.neocities.org/blog/about/211bsd" rel="nofollow">An old article with covering : Running and administrating a 2.11 BSD system</a></p>

<hr>

<p><a href="https://bentsukun.ch/posts/netbsd-wedge-boot/" rel="nofollow">Booting NetBSD from a wedge, the hard way</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc2026_tnf" rel="nofollow">The NetBSD Foundation will participate in Google Summer of Code 2026!</a></li>
<li><a href="https://c0t0d0s0.org/blog/solaris114preservebootenvironments.html" rel="nofollow">Solaris 11.4 SRU90: Preserve Boot Environments</a></li>
<li><a href="https://github.com/openzfs/zfs/releases/tag/zfs-2.4.1" rel="nofollow">zfs-2.4.1</a></li>
<li><a href="https://youtube.com/watch?v=RYEizNBE9Y0" rel="nofollow">Hardening OPNsense: Using Q-Feeds to Block Malicious Traffic</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/654/feedback/gary%20-%20a%20nice%20blog.md" rel="nofollow">Gary - A nice blog</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>653: Butter makes everything better</title>
  <link>https://www.bsdnow.tv/653</link>
  <guid isPermaLink="false">90056b71-1ac0-466c-8ef0-3ba544800a52</guid>
  <pubDate>Thu, 05 Mar 2026 16:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/90056b71-1ac0-466c-8ef0-3ba544800a52.mp3" length="53095680" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>ZFS vs BTRFS, RHEL on ZFS Root, Slackware on Encrypted ZFS root, OpenIndiana Package management, FreeBSD Jail metrics and more...</itunes:subtitle>
  <itunes:duration>55:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
ZFS vs BTRFS Architects features and stability (https://klarasystems.com/articles/zfs-vs-btrfs-architects-features-and-stability-2/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
RHEL on ZFS Root: An Unholy Experiment (https://blog.hofstede.it/rhel-on-zfs-root-an-unholy-experiment/)
News Roundup
Slackware on Encrypted ZFS Root.
https://tumfatig.net/2026/slackware-on-encrypted-zfs-root/
OpenIndiana Is Porting Solaris' IPS Package Management To Rust (https://www.phoronix.com/news/OpenIndiana-Next-Gen-IPS)
FreeBSD Jail Memory Metrics (https://blog.cabroneria.com/bits/0010_freebsd_per_jail_memory_metrics/)
Tcl: The Most Underrated, But The Most Productive Programming Language (https://archive.ph/20260206010415/https://levelup.gitconnected.com/tcl-the-most-underrated-but-the-most-productive-programming-language-1f83c99eaab7)
How to Setup WireGuard on OpenBSD: The Ultimate Self-Hosted VPN Guide (2026) (https://thelonestack.com/openbsd-wireguard-vpn-setup/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/zfs-vs-btrfs-architects-features-and-stability-2/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS vs BTRFS Architects features and stability</a></p>

<hr>

<p><a href="https://blog.hofstede.it/rhel-on-zfs-root-an-unholy-experiment/" rel="nofollow">RHEL on ZFS Root: An Unholy Experiment</a></p>

<hr>

<h2>News Roundup</h2>

<p>Slackware on Encrypted ZFS Root.<br>
<a href="https://tumfatig.net/2026/slackware-on-encrypted-zfs-root/" rel="nofollow">https://tumfatig.net/2026/slackware-on-encrypted-zfs-root/</a></p>

<hr>

<p><a href="https://www.phoronix.com/news/OpenIndiana-Next-Gen-IPS" rel="nofollow">OpenIndiana Is Porting Solaris&#39; IPS Package Management To Rust</a></p>

<hr>

<p><a href="https://blog.cabroneria.com/bits/0010_freebsd_per_jail_memory_metrics/" rel="nofollow">FreeBSD Jail Memory Metrics</a></p>

<hr>

<p><a href="https://archive.ph/20260206010415/https://levelup.gitconnected.com/tcl-the-most-underrated-but-the-most-productive-programming-language-1f83c99eaab7" rel="nofollow">Tcl: The Most Underrated, But The Most Productive Programming Language</a></p>

<hr>

<p><a href="https://thelonestack.com/openbsd-wireguard-vpn-setup/" rel="nofollow">How to Setup WireGuard on OpenBSD: The Ultimate Self-Hosted VPN Guide (2026)</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/zfs-vs-btrfs-architects-features-and-stability-2/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS vs BTRFS Architects features and stability</a></p>

<hr>

<p><a href="https://blog.hofstede.it/rhel-on-zfs-root-an-unholy-experiment/" rel="nofollow">RHEL on ZFS Root: An Unholy Experiment</a></p>

<hr>

<h2>News Roundup</h2>

<p>Slackware on Encrypted ZFS Root.<br>
<a href="https://tumfatig.net/2026/slackware-on-encrypted-zfs-root/" rel="nofollow">https://tumfatig.net/2026/slackware-on-encrypted-zfs-root/</a></p>

<hr>

<p><a href="https://www.phoronix.com/news/OpenIndiana-Next-Gen-IPS" rel="nofollow">OpenIndiana Is Porting Solaris&#39; IPS Package Management To Rust</a></p>

<hr>

<p><a href="https://blog.cabroneria.com/bits/0010_freebsd_per_jail_memory_metrics/" rel="nofollow">FreeBSD Jail Memory Metrics</a></p>

<hr>

<p><a href="https://archive.ph/20260206010415/https://levelup.gitconnected.com/tcl-the-most-underrated-but-the-most-productive-programming-language-1f83c99eaab7" rel="nofollow">Tcl: The Most Underrated, But The Most Productive Programming Language</a></p>

<hr>

<p><a href="https://thelonestack.com/openbsd-wireguard-vpn-setup/" rel="nofollow">How to Setup WireGuard on OpenBSD: The Ultimate Self-Hosted VPN Guide (2026)</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>652: Ghostly Graphics</title>
  <link>https://www.bsdnow.tv/652</link>
  <guid isPermaLink="false">47fafae1-73b4-4e3f-8850-42a5e4c5bc54</guid>
  <pubDate>Thu, 26 Feb 2026 10:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/47fafae1-73b4-4e3f-8850-42a5e4c5bc54.mp3" length="67434240" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS monitoring, hellosystems 0.8, GhostBSD and XLibre, Bhyve Exporters and 30 year old LibC issues.</itunes:subtitle>
  <itunes:duration>1:10:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS monitoring, hellosystems 0.8, GhostBSD and XLibre, Bhyve Exporters and 30 year old LibC issues.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenZFS Monitoring and Observability: What to Track and Why It Matters (https://klarasystems.com/articles/openzfs-monitoring-and-observability-what-to-track-and-why-it-matters/)
helloSystem 0.8 Released FreeBSD Based OS Inspired by macOS.
https://itsfoss.gitlab.io/post/hellosystem-08-released-freebsd-based-os-inspired-by-macos/
News Roundup
[Default GhostBSD to XLibre](https://github.com/ghostbsd/ghostbsd-build/pull/259]
 + Addressing XLibre Change and GhostBSD Future (https://ericbsd.com/addressing-xlibre-change-and-ghostbsd-future.html)
Bhyve Prometheus Exporter for Sylve on FreeBSD. (https://gyptazy.com/blog/bhyve-sylve-freebsd-prometheus-metric-exporter/)
Linux GNU C Library Fixes Security Issue Present Since 1996 (https://phoronix.com/news/Glibc-Security-Fix-For-1996-Bug)
Beastie Bits
NetBSD 11.0 RC1 available! (https://blog.netbsd.org/tnf/entry/netbsd_11_0_rc1_available)
The Book of PF, 4th Edition is now available (https://nostarch.com/book-of-pf-4th-edition)
December 2025 Finance Report (https://www.ghostbsd.org/news/December_2025_Finance_Report)
LLDB improvements on FreeBSD (https://lists.freebsd.org/archives/freebsd-hackers/2026-February/005757.html)
Any desire for OnmiOS/Illumos Support : Now's your chance to convince me (https://github.com/webzfs/webzfs/issues/44)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS monitoring, hellosystems 0.8, GhostBSD and XLibre, Bhyve Exporters and 30 year old LibC issues.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/openzfs-monitoring-and-observability-what-to-track-and-why-it-matters/" rel="nofollow">OpenZFS Monitoring and Observability: What to Track and Why It Matters</a></p>

<hr>

<p>helloSystem 0.8 Released FreeBSD Based OS Inspired by macOS.<br>
<a href="https://itsfoss.gitlab.io/post/hellosystem-08-released-freebsd-based-os-inspired-by-macos/" rel="nofollow">https://itsfoss.gitlab.io/post/hellosystem-08-released-freebsd-based-os-inspired-by-macos/</a></p>

<hr>

<h2>News Roundup</h2>

<p>[Default GhostBSD to XLibre](<a href="https://github.com/ghostbsd/ghostbsd-build/pull/259" rel="nofollow">https://github.com/ghostbsd/ghostbsd-build/pull/259</a>]</p>

<ul>
<li><a href="https://ericbsd.com/addressing-xlibre-change-and-ghostbsd-future.html" rel="nofollow">Addressing XLibre Change and GhostBSD Future</a></li>
</ul>

<hr>

<p><a href="https://gyptazy.com/blog/bhyve-sylve-freebsd-prometheus-metric-exporter/" rel="nofollow">Bhyve Prometheus Exporter for Sylve on FreeBSD.</a></p>

<hr>

<p><a href="https://phoronix.com/news/Glibc-Security-Fix-For-1996-Bug" rel="nofollow">Linux GNU C Library Fixes Security Issue Present Since 1996</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/netbsd_11_0_rc1_available" rel="nofollow">NetBSD 11.0 RC1 available!</a></li>
<li><a href="https://nostarch.com/book-of-pf-4th-edition" rel="nofollow">The Book of PF, 4th Edition is now available</a></li>
<li><a href="https://www.ghostbsd.org/news/December_2025_Finance_Report" rel="nofollow">December 2025 Finance Report</a></li>
<li><a href="https://lists.freebsd.org/archives/freebsd-hackers/2026-February/005757.html" rel="nofollow">LLDB improvements on FreeBSD</a></li>
<li><a href="https://github.com/webzfs/webzfs/issues/44" rel="nofollow">Any desire for OnmiOS/Illumos Support : Now&#39;s your chance to convince me</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS monitoring, hellosystems 0.8, GhostBSD and XLibre, Bhyve Exporters and 30 year old LibC issues.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/openzfs-monitoring-and-observability-what-to-track-and-why-it-matters/" rel="nofollow">OpenZFS Monitoring and Observability: What to Track and Why It Matters</a></p>

<hr>

<p>helloSystem 0.8 Released FreeBSD Based OS Inspired by macOS.<br>
<a href="https://itsfoss.gitlab.io/post/hellosystem-08-released-freebsd-based-os-inspired-by-macos/" rel="nofollow">https://itsfoss.gitlab.io/post/hellosystem-08-released-freebsd-based-os-inspired-by-macos/</a></p>

<hr>

<h2>News Roundup</h2>

<p>[Default GhostBSD to XLibre](<a href="https://github.com/ghostbsd/ghostbsd-build/pull/259" rel="nofollow">https://github.com/ghostbsd/ghostbsd-build/pull/259</a>]</p>

<ul>
<li><a href="https://ericbsd.com/addressing-xlibre-change-and-ghostbsd-future.html" rel="nofollow">Addressing XLibre Change and GhostBSD Future</a></li>
</ul>

<hr>

<p><a href="https://gyptazy.com/blog/bhyve-sylve-freebsd-prometheus-metric-exporter/" rel="nofollow">Bhyve Prometheus Exporter for Sylve on FreeBSD.</a></p>

<hr>

<p><a href="https://phoronix.com/news/Glibc-Security-Fix-For-1996-Bug" rel="nofollow">Linux GNU C Library Fixes Security Issue Present Since 1996</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/netbsd_11_0_rc1_available" rel="nofollow">NetBSD 11.0 RC1 available!</a></li>
<li><a href="https://nostarch.com/book-of-pf-4th-edition" rel="nofollow">The Book of PF, 4th Edition is now available</a></li>
<li><a href="https://www.ghostbsd.org/news/December_2025_Finance_Report" rel="nofollow">December 2025 Finance Report</a></li>
<li><a href="https://lists.freebsd.org/archives/freebsd-hackers/2026-February/005757.html" rel="nofollow">LLDB improvements on FreeBSD</a></li>
<li><a href="https://github.com/webzfs/webzfs/issues/44" rel="nofollow">Any desire for OnmiOS/Illumos Support : Now&#39;s your chance to convince me</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>651: Spatially aware ZFS</title>
  <link>https://www.bsdnow.tv/651</link>
  <guid isPermaLink="false">5819475f-0649-418c-b156-ff5b8b7dcd30</guid>
  <pubDate>Thu, 19 Feb 2026 11:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5819475f-0649-418c-b156-ff5b8b7dcd30.mp3" length="54830208" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>GeoIP PF FreeBSD, ZFs in production, linuxulator feels like magic, XFCE is great, the scariest boot code, and more...</itunes:subtitle>
  <itunes:duration>57:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>GeoIP PF FreeBSD, ZFs in production, linuxulator feels like magic, XFCE is great, the scariest boot code, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
GeoIP-Aware Firewalling with PF on FreeBSD (https://blog.hofstede.it/geoip-aware-firewalling-with-pf-on-freebsd/)
ZFS in Production: Real-World Deployment Patterns and Pitfalls (https://klarasystems.com/articles/zfs-in-production-real-world-deployment-patterns-and-pitfalls/)
News Roundup
Xfce is great (https://rubenerd.com/xfce-is-great/)
Linuxulator on FreeBSD Feels Like Magic (https://hayzam.com/blog/02-linuxulator-is-awesome/)
The scariest boot loader code (http://miod.online.fr/software/openbsd/stories/boot_hppa.html)
OpenBSD-current now runs as guest under Apple Hypervisor (https://www.undeadly.org/cgi?action=article;sid=20260115203619)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Matt - Audio Levels (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/651/feedback/matt%20-%20audio%20levels.md)
Interviews can be troublesome because there's only so much we can do with multiple guests with multiple feeds, and mulitple audio conditions. We can try to normalize but sometimes it's just not easy to do without editing taking an entire day..
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>GeoIP PF FreeBSD, ZFs in production, linuxulator feels like magic, XFCE is great, the scariest boot code, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://blog.hofstede.it/geoip-aware-firewalling-with-pf-on-freebsd/" rel="nofollow">GeoIP-Aware Firewalling with PF on FreeBSD</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-in-production-real-world-deployment-patterns-and-pitfalls/" rel="nofollow">ZFS in Production: Real-World Deployment Patterns and Pitfalls</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://rubenerd.com/xfce-is-great/" rel="nofollow">Xfce is great</a></p>

<hr>

<p><a href="https://hayzam.com/blog/02-linuxulator-is-awesome/" rel="nofollow">Linuxulator on FreeBSD Feels Like Magic</a></p>

<hr>

<p><a href="http://miod.online.fr/software/openbsd/stories/boot_hppa.html" rel="nofollow">The scariest boot loader code</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20260115203619" rel="nofollow">OpenBSD-current now runs as guest under Apple Hypervisor</a></p>

<hr>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/651/feedback/matt%20-%20audio%20levels.md" rel="nofollow">Matt - Audio Levels</a></li>
</ul>

<p>Interviews can be troublesome because there&#39;s only so much we can do with multiple guests with multiple feeds, and mulitple audio conditions. We can try to normalize but sometimes it&#39;s just not easy to do without editing taking an entire day..</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>GeoIP PF FreeBSD, ZFs in production, linuxulator feels like magic, XFCE is great, the scariest boot code, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://blog.hofstede.it/geoip-aware-firewalling-with-pf-on-freebsd/" rel="nofollow">GeoIP-Aware Firewalling with PF on FreeBSD</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-in-production-real-world-deployment-patterns-and-pitfalls/" rel="nofollow">ZFS in Production: Real-World Deployment Patterns and Pitfalls</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://rubenerd.com/xfce-is-great/" rel="nofollow">Xfce is great</a></p>

<hr>

<p><a href="https://hayzam.com/blog/02-linuxulator-is-awesome/" rel="nofollow">Linuxulator on FreeBSD Feels Like Magic</a></p>

<hr>

<p><a href="http://miod.online.fr/software/openbsd/stories/boot_hppa.html" rel="nofollow">The scariest boot loader code</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20260115203619" rel="nofollow">OpenBSD-current now runs as guest under Apple Hypervisor</a></p>

<hr>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/651/feedback/matt%20-%20audio%20levels.md" rel="nofollow">Matt - Audio Levels</a></li>
</ul>

<p>Interviews can be troublesome because there&#39;s only so much we can do with multiple guests with multiple feeds, and mulitple audio conditions. We can try to normalize but sometimes it&#39;s just not easy to do without editing taking an entire day..</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>650: Korn Chips</title>
  <link>https://www.bsdnow.tv/650</link>
  <guid isPermaLink="false">3d3d5283-58d7-4436-a66b-f588ab51eb8c</guid>
  <pubDate>Thu, 12 Feb 2026 09:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3d3d5283-58d7-4436-a66b-f588ab51eb8c.mp3" length="55057536" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>AT&amp;T's $2000 shell, ZFS Scrubs and Data Integrity, FFS Backups, FreeBSD Home Nas, and more.</itunes:subtitle>
  <itunes:duration>57:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>AT&amp;amp;T's $2000 shell, ZFS Scrubs and Data Integrity, FFS Backups, FreeBSD Home Nas, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
One too many words on AT&amp;amp;T's $2,000 Korn shell and other Usenet topics (https://blog.gabornyeki.com/2025-12-usenet/)
Understanding ZFS Scrubs and Data Integrity (https://klarasystems.com/articles/understanding-zfs-scrubs-and-data-integrity/)
News Roundup
FFS Backup (https://eradman.com/posts/ffs-backup.html)
FreeBSD: Home NAS, part 1 – configuring ZFS mirror (RAID1) (https://rtfm.co.ua/en/freebsd-home-nas-part-1-configuring-zfs-mirror-raid1/)
8 more parts!
Beastie Bits
The BSD Proposal (https://archive.org/details/proposal-to-provide-vax-unix-system-support-at-berkeley)
UNIX Magic Poster (https://unixmagic.net)
Haiku OS Pulls In Updated Drivers From FreeBSD 15 (https://www.phoronix.com/news/Haiku-December-2025)
FreeBSD 15.0 VNET Jails (https://github.com/pkgdemon/pkgdemon.github.io/wiki/FreeBSD-15.0-VNET-Jails)
Call for NetBSD testing (https://github.com/webzfs/webzfs/issues/8)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Gary - Links (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/650/feedback/gary%20-%20links.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>AT&amp;T&#39;s $2000 shell, ZFS Scrubs and Data Integrity, FFS Backups, FreeBSD Home Nas, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://blog.gabornyeki.com/2025-12-usenet/" rel="nofollow">One too many words on AT&amp;T&#39;s $2,000 Korn shell and other Usenet topics</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/understanding-zfs-scrubs-and-data-integrity/" rel="nofollow">Understanding ZFS Scrubs and Data Integrity</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://eradman.com/posts/ffs-backup.html" rel="nofollow">FFS Backup</a></p>

<hr>

<p><a href="https://rtfm.co.ua/en/freebsd-home-nas-part-1-configuring-zfs-mirror-raid1/" rel="nofollow">FreeBSD: Home NAS, part 1 – configuring ZFS mirror (RAID1)</a></p>

<ul>
<li>8 more parts!</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://archive.org/details/proposal-to-provide-vax-unix-system-support-at-berkeley" rel="nofollow">The BSD Proposal</a></li>
<li><a href="https://unixmagic.net" rel="nofollow">UNIX Magic Poster</a></li>
<li><a href="https://www.phoronix.com/news/Haiku-December-2025" rel="nofollow">Haiku OS Pulls In Updated Drivers From FreeBSD 15</a></li>
<li><a href="https://github.com/pkgdemon/pkgdemon.github.io/wiki/FreeBSD-15.0-VNET-Jails" rel="nofollow">FreeBSD 15.0 VNET Jails</a></li>
<li><a href="https://github.com/webzfs/webzfs/issues/8" rel="nofollow">Call for NetBSD testing</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/650/feedback/gary%20-%20links.md" rel="nofollow">Gary - Links</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>AT&amp;T&#39;s $2000 shell, ZFS Scrubs and Data Integrity, FFS Backups, FreeBSD Home Nas, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://blog.gabornyeki.com/2025-12-usenet/" rel="nofollow">One too many words on AT&amp;T&#39;s $2,000 Korn shell and other Usenet topics</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/understanding-zfs-scrubs-and-data-integrity/" rel="nofollow">Understanding ZFS Scrubs and Data Integrity</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://eradman.com/posts/ffs-backup.html" rel="nofollow">FFS Backup</a></p>

<hr>

<p><a href="https://rtfm.co.ua/en/freebsd-home-nas-part-1-configuring-zfs-mirror-raid1/" rel="nofollow">FreeBSD: Home NAS, part 1 – configuring ZFS mirror (RAID1)</a></p>

<ul>
<li>8 more parts!</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://archive.org/details/proposal-to-provide-vax-unix-system-support-at-berkeley" rel="nofollow">The BSD Proposal</a></li>
<li><a href="https://unixmagic.net" rel="nofollow">UNIX Magic Poster</a></li>
<li><a href="https://www.phoronix.com/news/Haiku-December-2025" rel="nofollow">Haiku OS Pulls In Updated Drivers From FreeBSD 15</a></li>
<li><a href="https://github.com/pkgdemon/pkgdemon.github.io/wiki/FreeBSD-15.0-VNET-Jails" rel="nofollow">FreeBSD 15.0 VNET Jails</a></li>
<li><a href="https://github.com/webzfs/webzfs/issues/8" rel="nofollow">Call for NetBSD testing</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/650/feedback/gary%20-%20links.md" rel="nofollow">Gary - Links</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>649: The Desk Review</title>
  <link>https://www.bsdnow.tv/649</link>
  <guid isPermaLink="false">9c1b25e9-8dd1-4db3-bbab-cd7bdd1139a1</guid>
  <pubDate>Thu, 05 Feb 2026 10:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9c1b25e9-8dd1-4db3-bbab-cd7bdd1139a1.mp3" length="68752896" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>ZFS Scrubs and Data integrity, Propolice, FreeBSD vs Slackware and more.</itunes:subtitle>
  <itunes:duration>1:11:37</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>ZFS Scrubs and Data integrity, Propolice, FreeBSD vs Slackware and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Understanding ZFS Scrubs and Data Integrity (https://klarasystems.com/articles/understanding-zfs-scrubs-and-data-integrity/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
The story of Propolice (http://miod.online.fr/software/openbsd/stories/propolice.html)
Desk reviews
describe
comment
ask questions
No reponses, no justications.
Tj's Desk media/bsdnow649-tjs-desk.jpg
Ruben's Desk media/bsdnow649-rubens-desk.jpg
News Roundup
FreeBSD vs. Slackware: Which super stable OS is right for you? (https://www.zdnet.com/article/freebsd-vs-slackware/)
Prometheus, Let's Encrypt, and making sure all our TLS certificates are monitored (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/PrometheusLetsEncryptTLSChecking)
Wait, a repairable ThinkPad!? (https://rubenerd.com/a-repairable-thinkpad/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>ZFS Scrubs and Data integrity, Propolice, FreeBSD vs Slackware and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/understanding-zfs-scrubs-and-data-integrity/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Understanding ZFS Scrubs and Data Integrity</a></p>

<hr>

<p><a href="http://miod.online.fr/software/openbsd/stories/propolice.html" rel="nofollow">The story of Propolice</a></p>

<hr>

<h2>Desk reviews</h2>

<ul>
<li>describe</li>
<li>comment</li>
<li>ask questions</li>
</ul>

<p>No reponses, no justications.</p>

<p>[Tj&#39;s Desk](media/bsdnow649-tjs-desk.jpg)<br>
[Ruben&#39;s Desk](media/bsdnow649-rubens-desk.jpg)</p>

<h2>News Roundup</h2>

<p><a href="https://www.zdnet.com/article/freebsd-vs-slackware/" rel="nofollow">FreeBSD vs. Slackware: Which super stable OS is right for you?</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/PrometheusLetsEncryptTLSChecking" rel="nofollow">Prometheus, Let&#39;s Encrypt, and making sure all our TLS certificates are monitored</a></p>

<hr>

<p><a href="https://rubenerd.com/a-repairable-thinkpad/" rel="nofollow">Wait, a repairable ThinkPad!?</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>ZFS Scrubs and Data integrity, Propolice, FreeBSD vs Slackware and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/understanding-zfs-scrubs-and-data-integrity/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Understanding ZFS Scrubs and Data Integrity</a></p>

<hr>

<p><a href="http://miod.online.fr/software/openbsd/stories/propolice.html" rel="nofollow">The story of Propolice</a></p>

<hr>

<h2>Desk reviews</h2>

<ul>
<li>describe</li>
<li>comment</li>
<li>ask questions</li>
</ul>

<p>No reponses, no justications.</p>

<p>[Tj&#39;s Desk](media/bsdnow649-tjs-desk.jpg)<br>
[Ruben&#39;s Desk](media/bsdnow649-rubens-desk.jpg)</p>

<h2>News Roundup</h2>

<p><a href="https://www.zdnet.com/article/freebsd-vs-slackware/" rel="nofollow">FreeBSD vs. Slackware: Which super stable OS is right for you?</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/PrometheusLetsEncryptTLSChecking" rel="nofollow">Prometheus, Let&#39;s Encrypt, and making sure all our TLS certificates are monitored</a></p>

<hr>

<p><a href="https://rubenerd.com/a-repairable-thinkpad/" rel="nofollow">Wait, a repairable ThinkPad!?</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>648: Greytrapping for years</title>
  <link>https://www.bsdnow.tv/648</link>
  <guid isPermaLink="false">5cbb335b-fdbd-4367-82df-7cef085847a3</guid>
  <pubDate>Thu, 29 Jan 2026 09:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5cbb335b-fdbd-4367-82df-7cef085847a3.mp3" length="62057088" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD's Future, 18 years of greytrapping, PF vs Linux firewalls, and more.</itunes:subtitle>
  <itunes:duration>1:04:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD's Future, 18 years of greytrapping, PF vs Linux firewalls, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Powering the Future of FreeBSD (https://freebsdfoundation.org/blog/powering-the-future-of-freebsd/)
Eighteen Years of Greytrapping - Is the Weirdness Finally Paying Off? (https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html)
BSDCan Organisating committee Interview
News Roundup
How I, a non-developer, read the tutorial you, a developer, wrote for me, a beginner (https://anniemueller.com/posts/how-i-a-non-developer-read-the-tutorial-you-a-developer-wrote-for-me-a-beginner)
BSD PF versus Linux nftables for firewalls for us (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/PFvsNftablesForUs)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD&#39;s Future, 18 years of greytrapping, PF vs Linux firewalls, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/powering-the-future-of-freebsd/" rel="nofollow">Powering the Future of FreeBSD</a></p>

<hr>

<p><a href="https://nxdomain.no/%7Epeter/eighteen_years_of_greytrapping.html" rel="nofollow">Eighteen Years of Greytrapping - Is the Weirdness Finally Paying Off?</a></p>

<hr>

<p>BSDCan Organisating committee Interview</p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://anniemueller.com/posts/how-i-a-non-developer-read-the-tutorial-you-a-developer-wrote-for-me-a-beginner" rel="nofollow">How I, a non-developer, read the tutorial you, a developer, wrote for me, a beginner</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/PFvsNftablesForUs" rel="nofollow">BSD PF versus Linux nftables for firewalls for us</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD&#39;s Future, 18 years of greytrapping, PF vs Linux firewalls, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/powering-the-future-of-freebsd/" rel="nofollow">Powering the Future of FreeBSD</a></p>

<hr>

<p><a href="https://nxdomain.no/%7Epeter/eighteen_years_of_greytrapping.html" rel="nofollow">Eighteen Years of Greytrapping - Is the Weirdness Finally Paying Off?</a></p>

<hr>

<p>BSDCan Organisating committee Interview</p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://anniemueller.com/posts/how-i-a-non-developer-read-the-tutorial-you-a-developer-wrote-for-me-a-beginner" rel="nofollow">How I, a non-developer, read the tutorial you, a developer, wrote for me, a beginner</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/PFvsNftablesForUs" rel="nofollow">BSD PF versus Linux nftables for firewalls for us</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>646: Unix v4</title>
  <link>https://www.bsdnow.tv/646</link>
  <guid isPermaLink="false">95223258-e0a7-428f-b41c-b3b7de2f94ec</guid>
  <pubDate>Thu, 15 Jan 2026 09:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/95223258-e0a7-428f-b41c-b3b7de2f94ec.mp3" length="71217024" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Unix v4 recovery, webzfs, openbgpd 9.0, MidnightBSD 4.0, and more...</itunes:subtitle>
  <itunes:duration>1:14:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Unix v4 recovery, webzfs, openbgpd 9.0, MidnightBSD 4.0, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
University of Utah team discovers rare computer relic (https://ksltv.com/science-technology/university-of-utah-discovers-rare-computer-relic/853296/)
The attempt to read the UNIX V4 tape is underway! (https://mastodon.social/redirect/statuses/115747843746305391)
UNIX V4 Tape from University of Utah (https://archive.org/details/utah_unix_v4_raw)
UNIX V4 tape successfully recovered: First ever version of UNIX written in C is running again (https://www.theregister.com/2025/12/23/unix_v4_tape_successfully_recovered/)
An initial analysis of the discovered Unix V4 tape (https://www.spinellis.gr/blog/20251223/)
WebZFS (https://github.com/webzfs/webzfs)
News Roundup
OpenBGPD 9.0 released (https://www.undeadly.org/cgi?action=article;sid=20251231070524)
MidnightBSD 4.0 (https://www.midnightbsd.org/notes/4.0/index.html)
Let's run FreeBSD 15.0-RELEASE on a Raspberry Pi Zero 2 W (https://briancallahan.net/blog/20251216.html)
Figuring out how I want to set up the TVPC (https://vulcanridr.mataroa.blog/blog/figuring-out-how-i-want-to-set-up-the-tvpc/)
TVPC update (https://vulcanridr.mataroa.blog/blog/tvpc-update/)
C&amp;amp;C Red Alert2 in your browser (https://chronodivide.com)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
rick - shout out.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/646/feedback/rick%20-%20shout%20out.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Unix v4 recovery, webzfs, openbgpd 9.0, MidnightBSD 4.0, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://ksltv.com/science-technology/university-of-utah-discovers-rare-computer-relic/853296/" rel="nofollow">University of Utah team discovers rare computer relic</a><br>
<a href="https://mastodon.social/redirect/statuses/115747843746305391" rel="nofollow">The attempt to read the UNIX V4 tape is underway!</a><br>
<a href="https://archive.org/details/utah_unix_v4_raw" rel="nofollow">UNIX V4 Tape from University of Utah</a><br>
<a href="https://www.theregister.com/2025/12/23/unix_v4_tape_successfully_recovered/" rel="nofollow">UNIX V4 tape successfully recovered: First ever version of UNIX written in C is running again</a><br>
<a href="https://www.spinellis.gr/blog/20251223/" rel="nofollow">An initial analysis of the discovered Unix V4 tape</a></p>

<hr>

<p><a href="https://github.com/webzfs/webzfs" rel="nofollow">WebZFS</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20251231070524" rel="nofollow">OpenBGPD 9.0 released</a></p>

<hr>

<p><a href="https://www.midnightbsd.org/notes/4.0/index.html" rel="nofollow">MidnightBSD 4.0</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20251216.html" rel="nofollow">Let&#39;s run FreeBSD 15.0-RELEASE on a Raspberry Pi Zero 2 W</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/figuring-out-how-i-want-to-set-up-the-tvpc/" rel="nofollow">Figuring out how I want to set up the TVPC</a><br>
<a href="https://vulcanridr.mataroa.blog/blog/tvpc-update/" rel="nofollow">TVPC update</a></p>

<hr>

<p><a href="https://chronodivide.com" rel="nofollow">C&amp;C Red Alert2 in your browser</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/646/feedback/rick%20-%20shout%20out.md" rel="nofollow">rick - shout out.md</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Unix v4 recovery, webzfs, openbgpd 9.0, MidnightBSD 4.0, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://ksltv.com/science-technology/university-of-utah-discovers-rare-computer-relic/853296/" rel="nofollow">University of Utah team discovers rare computer relic</a><br>
<a href="https://mastodon.social/redirect/statuses/115747843746305391" rel="nofollow">The attempt to read the UNIX V4 tape is underway!</a><br>
<a href="https://archive.org/details/utah_unix_v4_raw" rel="nofollow">UNIX V4 Tape from University of Utah</a><br>
<a href="https://www.theregister.com/2025/12/23/unix_v4_tape_successfully_recovered/" rel="nofollow">UNIX V4 tape successfully recovered: First ever version of UNIX written in C is running again</a><br>
<a href="https://www.spinellis.gr/blog/20251223/" rel="nofollow">An initial analysis of the discovered Unix V4 tape</a></p>

<hr>

<p><a href="https://github.com/webzfs/webzfs" rel="nofollow">WebZFS</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20251231070524" rel="nofollow">OpenBGPD 9.0 released</a></p>

<hr>

<p><a href="https://www.midnightbsd.org/notes/4.0/index.html" rel="nofollow">MidnightBSD 4.0</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20251216.html" rel="nofollow">Let&#39;s run FreeBSD 15.0-RELEASE on a Raspberry Pi Zero 2 W</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/figuring-out-how-i-want-to-set-up-the-tvpc/" rel="nofollow">Figuring out how I want to set up the TVPC</a><br>
<a href="https://vulcanridr.mataroa.blog/blog/tvpc-update/" rel="nofollow">TVPC update</a></p>

<hr>

<p><a href="https://chronodivide.com" rel="nofollow">C&amp;C Red Alert2 in your browser</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/646/feedback/rick%20-%20shout%20out.md" rel="nofollow">rick - shout out.md</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>644: Holidays 2025 - What you been do'in?</title>
  <link>https://www.bsdnow.tv/644</link>
  <guid isPermaLink="false">6c965a2e-3562-4f72-a27b-7c776d7718e6</guid>
  <pubDate>Thu, 01 Jan 2026 10:30:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6c965a2e-3562-4f72-a27b-7c776d7718e6.mp3" length="93133056" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A holiday episode as the guys sit back and chat.</itunes:subtitle>
  <itunes:duration>1:37:00</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Holidays 2025 - What you been do'in?
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
What tech did we enjoy playing with or found interesting in 2025?
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
- Gary - Storage Is Cheap (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/644/feedback/Gary%20-%20Storage%20Is%20Cheap.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Holidays 2025 - What you been do&#39;in?</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p>What tech did we enjoy playing with or found interesting in 2025?</p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<h2>- <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/644/feedback/Gary%20-%20Storage%20Is%20Cheap.md" rel="nofollow">Gary - Storage Is Cheap</a></h2>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Holidays 2025 - What you been do&#39;in?</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p>What tech did we enjoy playing with or found interesting in 2025?</p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<h2>- <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/644/feedback/Gary%20-%20Storage%20Is%20Cheap.md" rel="nofollow">Gary - Storage Is Cheap</a></h2>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>643: Unwrapping gifts</title>
  <link>https://www.bsdnow.tv/643</link>
  <guid isPermaLink="false">dce512e9-39bb-4de0-b296-98c68f41cece</guid>
  <pubDate>Thu, 25 Dec 2025 10:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/dce512e9-39bb-4de0-b296-98c68f41cece.mp3" length="66225024" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Upwrapping OpenZFS gifs, Propolice the OpenBSD Stack Protector, refreshing zpools, and the FreeBSD 15.0 release.</itunes:subtitle>
  <itunes:duration>1:08:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Upwrapping OpenZFS gifs, Propolice the OpenBSD Stack Protector, refreshing zpools, and the FreeBSD 15.0 release.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Unwrapping ZFS: Gifts from the Open Source Community (https://klarasystems.com/articles/zfs-community-contributions-2025/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
Who wins when we filter the open web through an opaque system? (https://hidde.blog/filtered-open-web/)
News Roundup
We can't fund our way out of the free and open source maintenance problem (https://utcc.utoronto.ca/~cks/space/blog/tech/OpenSourceFundingNotSolution)
The story of Propolice, the OpenBSD stack protector (https://www.undeadly.org/cgi?action=article;sid=20251212094310)
Copying everything off a zpool, destroying it, creating a new one, and copying everything back (https://dan.langille.org/2025/12/11/copying-everything-off-a-zpool-destroying-it-creating-a-new-one-and-copying-everything-back/)
All aboard the 15.0-RELEASE train! (https://vulcanridr.mataroa.blog/blog/all-aboard-the-150-release-train/)
Beastie Bits
Running A PDP-8 From 1965 (https://www.youtube.com/watch?v=S2r_GujSc6w)
The library of time (https://libraryoftime.xyz)
OPNsense 25.7.9 released (https://forum.opnsense.org/index.php?topic=49986.0)
- OPNsense 25.10.1 business edition released (https://forum.opnsense.org/index.php?topic=50052.0)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Martin - recordings (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/643/feedback/Martin%20-%20recording%20of%20bsdnow.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Upwrapping OpenZFS gifs, Propolice the OpenBSD Stack Protector, refreshing zpools, and the FreeBSD 15.0 release.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/zfs-community-contributions-2025/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Unwrapping ZFS: Gifts from the Open Source Community</a></p>

<hr>

<p><a href="https://hidde.blog/filtered-open-web/" rel="nofollow">Who wins when we filter the open web through an opaque system?</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/OpenSourceFundingNotSolution" rel="nofollow">We can&#39;t fund our way out of the free and open source maintenance problem</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20251212094310" rel="nofollow">The story of Propolice, the OpenBSD stack protector</a></p>

<hr>

<p><a href="https://dan.langille.org/2025/12/11/copying-everything-off-a-zpool-destroying-it-creating-a-new-one-and-copying-everything-back/" rel="nofollow">Copying everything off a zpool, destroying it, creating a new one, and copying everything back</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/all-aboard-the-150-release-train/" rel="nofollow">All aboard the 15.0-RELEASE train!</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=S2r_GujSc6w" rel="nofollow">Running A PDP-8 From 1965</a></li>
<li><a href="https://libraryoftime.xyz" rel="nofollow">The library of time</a></li>
<li><a href="https://forum.opnsense.org/index.php?topic=49986.0" rel="nofollow">OPNsense 25.7.9 released</a></li>
</ul>

<h2>- <a href="https://forum.opnsense.org/index.php?topic=50052.0" rel="nofollow">OPNsense 25.10.1 business edition released</a></h2>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/643/feedback/Martin%20-%20recording%20of%20bsdnow.md" rel="nofollow">Martin - recordings</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Upwrapping OpenZFS gifs, Propolice the OpenBSD Stack Protector, refreshing zpools, and the FreeBSD 15.0 release.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/zfs-community-contributions-2025/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Unwrapping ZFS: Gifts from the Open Source Community</a></p>

<hr>

<p><a href="https://hidde.blog/filtered-open-web/" rel="nofollow">Who wins when we filter the open web through an opaque system?</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/OpenSourceFundingNotSolution" rel="nofollow">We can&#39;t fund our way out of the free and open source maintenance problem</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20251212094310" rel="nofollow">The story of Propolice, the OpenBSD stack protector</a></p>

<hr>

<p><a href="https://dan.langille.org/2025/12/11/copying-everything-off-a-zpool-destroying-it-creating-a-new-one-and-copying-everything-back/" rel="nofollow">Copying everything off a zpool, destroying it, creating a new one, and copying everything back</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/all-aboard-the-150-release-train/" rel="nofollow">All aboard the 15.0-RELEASE train!</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=S2r_GujSc6w" rel="nofollow">Running A PDP-8 From 1965</a></li>
<li><a href="https://libraryoftime.xyz" rel="nofollow">The library of time</a></li>
<li><a href="https://forum.opnsense.org/index.php?topic=49986.0" rel="nofollow">OPNsense 25.7.9 released</a></li>
</ul>

<h2>- <a href="https://forum.opnsense.org/index.php?topic=50052.0" rel="nofollow">OPNsense 25.10.1 business edition released</a></h2>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/643/feedback/Martin%20-%20recording%20of%20bsdnow.md" rel="nofollow">Martin - recordings</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>641: Open to Free</title>
  <link>https://www.bsdnow.tv/641</link>
  <guid isPermaLink="false">3bf79b4d-817f-40a1-bcc7-73de9e2ba74c</guid>
  <pubDate>Thu, 11 Dec 2025 11:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3bf79b4d-817f-40a1-bcc7-73de9e2ba74c.mp3" length="53275776" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 15 release, moving from OpenBSD to FreeBSD, ZFS Boot Environments explained, and more...</itunes:subtitle>
  <itunes:duration>55:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 15 release, moving from OpenBSD to FreeBSD, ZFS Boot Environments explained, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Welcome to the world FreeBSD 15.0-RELEASE Announcement (https://www.freebsd.org/releases/15.0R/announce/) and Release Notes (https://www.freebsd.org/releases/15.0R/relnotes/)
We're (now) moving from OpenBSD to FreeBSD for Firewalls (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/OpenBSDToFreeBSDMove) - Submitted by listener Gary
News Roundup
ZFS Boot Environments Explained (https://vermaden.wordpress.com/2025/11/25/zfs-boot-environments-explained/)
Why I (still) love Linux (https://it-notes.dragas.net/2025/11/24/why-i-still-love-linux/)
rocinante - A configuration management tool by the BastilleBSD team (https://github.com/BastilleBSD/rocinante)
A Grown-up ZFS Data Corruption Bug (https://github.com/oxidecomputer/oxide-and-friends/blob/master/2025_11_24.md) and YouTube (https://www.youtube.com/watch?v=srKYxF66A0c)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Claudio - A Silent Reflection (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/641/feedback/Claudio%20-%20Reflection.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 15 release, moving from OpenBSD to FreeBSD, ZFS Boot Environments explained, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p>Welcome to the world FreeBSD 15.0-RELEASE <a href="https://www.freebsd.org/releases/15.0R/announce/" rel="nofollow">Announcement</a> and <a href="https://www.freebsd.org/releases/15.0R/relnotes/" rel="nofollow">Release Notes</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OpenBSDToFreeBSDMove" rel="nofollow">We&#39;re (now) moving from OpenBSD to FreeBSD for Firewalls</a> - Submitted by listener Gary</p>

<h2>News Roundup</h2>

<p><a href="https://vermaden.wordpress.com/2025/11/25/zfs-boot-environments-explained/" rel="nofollow">ZFS Boot Environments Explained</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2025/11/24/why-i-still-love-linux/" rel="nofollow">Why I (still) love Linux</a></p>

<hr>

<p><a href="https://github.com/BastilleBSD/rocinante" rel="nofollow">rocinante - A configuration management tool by the BastilleBSD team</a></p>

<hr>

<p><a href="https://github.com/oxidecomputer/oxide-and-friends/blob/master/2025_11_24.md" rel="nofollow">A Grown-up ZFS Data Corruption Bug</a> and <a href="https://www.youtube.com/watch?v=srKYxF66A0c" rel="nofollow">YouTube</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/641/feedback/Claudio%20-%20Reflection.md" rel="nofollow">Claudio - A Silent Reflection</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 15 release, moving from OpenBSD to FreeBSD, ZFS Boot Environments explained, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p>Welcome to the world FreeBSD 15.0-RELEASE <a href="https://www.freebsd.org/releases/15.0R/announce/" rel="nofollow">Announcement</a> and <a href="https://www.freebsd.org/releases/15.0R/relnotes/" rel="nofollow">Release Notes</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OpenBSDToFreeBSDMove" rel="nofollow">We&#39;re (now) moving from OpenBSD to FreeBSD for Firewalls</a> - Submitted by listener Gary</p>

<h2>News Roundup</h2>

<p><a href="https://vermaden.wordpress.com/2025/11/25/zfs-boot-environments-explained/" rel="nofollow">ZFS Boot Environments Explained</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2025/11/24/why-i-still-love-linux/" rel="nofollow">Why I (still) love Linux</a></p>

<hr>

<p><a href="https://github.com/BastilleBSD/rocinante" rel="nofollow">rocinante - A configuration management tool by the BastilleBSD team</a></p>

<hr>

<p><a href="https://github.com/oxidecomputer/oxide-and-friends/blob/master/2025_11_24.md" rel="nofollow">A Grown-up ZFS Data Corruption Bug</a> and <a href="https://www.youtube.com/watch?v=srKYxF66A0c" rel="nofollow">YouTube</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/641/feedback/Claudio%20-%20Reflection.md" rel="nofollow">Claudio - A Silent Reflection</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>640: Cleaning up Hammer</title>
  <link>https://www.bsdnow.tv/640</link>
  <guid isPermaLink="false">1d2c509f-a511-47cb-ac2b-7ee57373dc6e</guid>
  <pubDate>Thu, 04 Dec 2025 09:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1d2c509f-a511-47cb-ac2b-7ee57373dc6e.mp3" length="34664448" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD is an OCI runtime, ZFS Disaster Recovery, Cleaning up Hammer, and some historical information, and more...</itunes:subtitle>
  <itunes:duration>36:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD is an OCI runtime, ZFS Disaster Recovery, Cleaning up Hammer, and some historical information, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Officially Supported in OCI Runtime Specification v1.3 (https://freebsdfoundation.org/blog/freebsd-officially-supported-in-oci-runtime-specification-v1-3)
ZFS Enabled Disaster Recovery for Virtualization (https://klarasystems.com/articles/zfs-enabled-disaster-recovery-virtualization?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
How I think OpenZFS's 'written' and 'written@' dataset properties work (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSWrittenPropertyHowItWorks)
Make sure your Hammer cleanup cleans up (https://www.dragonflydigest.com/2025/11/13/make-sure-your-hammer-cleanup-cleans-up)
[TUHS] David C Brock of CHM: 2024 oral history with Ken Thompson + Doug McIlroy (https://www.tuhs.org/pipermail/tuhs/2025-November/032751.html)
Special Issue “Celebrating 60 Years of ELIZA? Critical Pasts and Futures of AI” (https://ojs.weizenbaum-institut.de/index.php/wjds/announcement/view/8)
Source and state limiters introduced in pf (https://undeadly.org/cgi?action=article;sid=20251112132639)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Göran - grafana (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/640/feedback/G%C3%B6ran%20-%20grafana.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD is an OCI runtime, ZFS Disaster Recovery, Cleaning up Hammer, and some historical information, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/freebsd-officially-supported-in-oci-runtime-specification-v1-3" rel="nofollow">FreeBSD Officially Supported in OCI Runtime Specification v1.3</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-enabled-disaster-recovery-virtualization?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS Enabled Disaster Recovery for Virtualization</a></p>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSWrittenPropertyHowItWorks" rel="nofollow">How I think OpenZFS&#39;s &#39;written&#39; and &#39;written@<snap>&#39; dataset properties work</a></p>

<hr>

<p><a href="https://www.dragonflydigest.com/2025/11/13/make-sure-your-hammer-cleanup-cleans-up" rel="nofollow">Make sure your Hammer cleanup cleans up</a></p>

<hr>

<p><a href="https://www.tuhs.org/pipermail/tuhs/2025-November/032751.html" rel="nofollow">[TUHS] David C Brock of CHM: 2024 oral history with Ken Thompson + Doug McIlroy</a></p>

<hr>

<p><a href="https://ojs.weizenbaum-institut.de/index.php/wjds/announcement/view/8" rel="nofollow">Special Issue “Celebrating 60 Years of ELIZA? Critical Pasts and Futures of AI”</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20251112132639" rel="nofollow">Source and state limiters introduced in pf</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/640/feedback/G%C3%B6ran%20-%20grafana.md" rel="nofollow">Göran - grafana</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD is an OCI runtime, ZFS Disaster Recovery, Cleaning up Hammer, and some historical information, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/freebsd-officially-supported-in-oci-runtime-specification-v1-3" rel="nofollow">FreeBSD Officially Supported in OCI Runtime Specification v1.3</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-enabled-disaster-recovery-virtualization?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS Enabled Disaster Recovery for Virtualization</a></p>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSWrittenPropertyHowItWorks" rel="nofollow">How I think OpenZFS&#39;s &#39;written&#39; and &#39;written@<snap>&#39; dataset properties work</a></p>

<hr>

<p><a href="https://www.dragonflydigest.com/2025/11/13/make-sure-your-hammer-cleanup-cleans-up" rel="nofollow">Make sure your Hammer cleanup cleans up</a></p>

<hr>

<p><a href="https://www.tuhs.org/pipermail/tuhs/2025-November/032751.html" rel="nofollow">[TUHS] David C Brock of CHM: 2024 oral history with Ken Thompson + Doug McIlroy</a></p>

<hr>

<p><a href="https://ojs.weizenbaum-institut.de/index.php/wjds/announcement/view/8" rel="nofollow">Special Issue “Celebrating 60 Years of ELIZA? Critical Pasts and Futures of AI”</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20251112132639" rel="nofollow">Source and state limiters introduced in pf</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/640/feedback/G%C3%B6ran%20-%20grafana.md" rel="nofollow">Göran - grafana</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>639: Reproducible Builds</title>
  <link>https://www.bsdnow.tv/639</link>
  <guid isPermaLink="false">60c20296-3ef2-4105-ae81-5d6f29044152</guid>
  <pubDate>Thu, 27 Nov 2025 09:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/60c20296-3ef2-4105-ae81-5d6f29044152.mp3" length="57835776" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Reproducible builds, Highly available ZFS Pools, Self Hosting on a Framework Laptop, and more...</itunes:subtitle>
  <itunes:duration>1:00:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Reproducible builds, Highly available ZFS Pools, Self Hosting on a Framework Laptop, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD now builds reproducibly and without root privilege (https://freebsdfoundation.org/blog/freebsd-now-builds-reproducibly-and-without-root-privilege)
How to Set Up a Highly Available ZFS Pool Using Mirroring and iSCSI (https://klarasystems.com/articles/highly-available-zfs-pool-setup-with-iscsi-mirroring?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Self hosting 10TB in S3 on a framework laptop + disks (https://jamesoclaire.com/2025/10/05/self-hosting-10tb-in-s3-on-a-framework-laptop-disks/)
Crucial FreeBSD Toolkit (https://vermaden.wordpress.com/2025/07/08/crucial-freebsd-toolkit/)
Some notes on OpenZFS's 'written' dataset property (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSSnapshotWrittenProperty)
vi improvements on Dragonfly (https://www.dragonflydigest.com/2025/10/28/vi-improvements)
Big news for small /usr partitions (https://undeadly.org/cgi?action=article;sid=20251112121631)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Patrick - Feedback (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/639/feedback/patrick%20-%20notes.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Reproducible builds, Highly available ZFS Pools, Self Hosting on a Framework Laptop, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/freebsd-now-builds-reproducibly-and-without-root-privilege" rel="nofollow">FreeBSD now builds reproducibly and without root privilege</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/highly-available-zfs-pool-setup-with-iscsi-mirroring?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">How to Set Up a Highly Available ZFS Pool Using Mirroring and iSCSI</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://jamesoclaire.com/2025/10/05/self-hosting-10tb-in-s3-on-a-framework-laptop-disks/" rel="nofollow">Self hosting 10TB in S3 on a framework laptop + disks</a></p>

<hr>

<p><a href="https://vermaden.wordpress.com/2025/07/08/crucial-freebsd-toolkit/" rel="nofollow">Crucial FreeBSD Toolkit</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSSnapshotWrittenProperty" rel="nofollow">Some notes on OpenZFS&#39;s &#39;written&#39; dataset property</a></p>

<hr>

<p><a href="https://www.dragonflydigest.com/2025/10/28/vi-improvements" rel="nofollow">vi improvements on Dragonfly</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20251112121631" rel="nofollow">Big news for small /usr partitions</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/639/feedback/patrick%20-%20notes.md" rel="nofollow">Patrick - Feedback</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Reproducible builds, Highly available ZFS Pools, Self Hosting on a Framework Laptop, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/freebsd-now-builds-reproducibly-and-without-root-privilege" rel="nofollow">FreeBSD now builds reproducibly and without root privilege</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/highly-available-zfs-pool-setup-with-iscsi-mirroring?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">How to Set Up a Highly Available ZFS Pool Using Mirroring and iSCSI</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://jamesoclaire.com/2025/10/05/self-hosting-10tb-in-s3-on-a-framework-laptop-disks/" rel="nofollow">Self hosting 10TB in S3 on a framework laptop + disks</a></p>

<hr>

<p><a href="https://vermaden.wordpress.com/2025/07/08/crucial-freebsd-toolkit/" rel="nofollow">Crucial FreeBSD Toolkit</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSSnapshotWrittenProperty" rel="nofollow">Some notes on OpenZFS&#39;s &#39;written&#39; dataset property</a></p>

<hr>

<p><a href="https://www.dragonflydigest.com/2025/10/28/vi-improvements" rel="nofollow">vi improvements on Dragonfly</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20251112121631" rel="nofollow">Big news for small /usr partitions</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/639/feedback/patrick%20-%20notes.md" rel="nofollow">Patrick - Feedback</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>638: Hipsters want their distribution back</title>
  <link>https://www.bsdnow.tv/638</link>
  <guid isPermaLink="false">b4c03ea3-b78b-491f-9d8a-4e8e6688bb69</guid>
  <pubDate>Thu, 20 Nov 2025 09:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b4c03ea3-b78b-491f-9d8a-4e8e6688bb69.mp3" length="65509632" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>New Open Indiana Release, Understanding Storage Performance, a Unix OS for the TI99, FreeBSD Tribal knowledge, and more...</itunes:subtitle>
  <itunes:duration>1:08:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>New Open Indiana Release, Understanding Storage Performance, a Unix OS for the TI99, FreeBSD Tribal knowledge, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Signifier flotation devices (https://davidyat.es/2025/09/27/signifier-flotation-devices)
Open Indiana Hipster Announcement (https://openindiana.org/announcements/openindiana-hipster-2025-10-announcement/)
Understanding Storage Performance Metrics (https://klarasystems.com/articles/understanding-storage-performance-metrics?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
UNIX99, a UNIX-like OS for the TI-99/4A (https://forums.atariage.com/topic/380883-unix99-a-unix-like-os-for-the-ti-994a)
Making the veb(4) virtual Ethernet bridge VLAN aware (https://undeadly.org/cgi?action=article;sid=20251029114507)
FreeBSD tribal knowledge: minor version upgrades (https://vulcanridr.mataroa.blog/blog/freebsd-tribal-knowledge-minor-version-upgrades)
It's been 10 years since ZFS's 10th aniversary its integration into Solaris - A Reflection (https://blogs.oracle.com/oracle-systems/post/happy-10th-birthday-zfs)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>New Open Indiana Release, Understanding Storage Performance, a Unix OS for the TI99, FreeBSD Tribal knowledge, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://davidyat.es/2025/09/27/signifier-flotation-devices" rel="nofollow">Signifier flotation devices</a></p>

<hr>

<p><a href="https://openindiana.org/announcements/openindiana-hipster-2025-10-announcement/" rel="nofollow">Open Indiana Hipster Announcement</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/understanding-storage-performance-metrics?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Understanding Storage Performance Metrics</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://forums.atariage.com/topic/380883-unix99-a-unix-like-os-for-the-ti-994a" rel="nofollow">UNIX99, a UNIX-like OS for the TI-99/4A</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20251029114507" rel="nofollow">Making the veb(4) virtual Ethernet bridge VLAN aware</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/freebsd-tribal-knowledge-minor-version-upgrades" rel="nofollow">FreeBSD tribal knowledge: minor version upgrades</a></p>

<hr>

<p><a href="https://blogs.oracle.com/oracle-systems/post/happy-10th-birthday-zfs" rel="nofollow">It&#39;s been 10 years since ZFS&#39;s 10th aniversary its integration into Solaris - A Reflection</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://www.tarsnap.com/bsdnow">Tarsnap</a> Promo Code: bsdnow</li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>New Open Indiana Release, Understanding Storage Performance, a Unix OS for the TI99, FreeBSD Tribal knowledge, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://davidyat.es/2025/09/27/signifier-flotation-devices" rel="nofollow">Signifier flotation devices</a></p>

<hr>

<p><a href="https://openindiana.org/announcements/openindiana-hipster-2025-10-announcement/" rel="nofollow">Open Indiana Hipster Announcement</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/understanding-storage-performance-metrics?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Understanding Storage Performance Metrics</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://forums.atariage.com/topic/380883-unix99-a-unix-like-os-for-the-ti-994a" rel="nofollow">UNIX99, a UNIX-like OS for the TI-99/4A</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20251029114507" rel="nofollow">Making the veb(4) virtual Ethernet bridge VLAN aware</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/freebsd-tribal-knowledge-minor-version-upgrades" rel="nofollow">FreeBSD tribal knowledge: minor version upgrades</a></p>

<hr>

<p><a href="https://blogs.oracle.com/oracle-systems/post/happy-10th-birthday-zfs" rel="nofollow">It&#39;s been 10 years since ZFS&#39;s 10th aniversary its integration into Solaris - A Reflection</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://www.tarsnap.com/bsdnow">Tarsnap</a> Promo Code: bsdnow</li></ul>]]>
  </itunes:summary>
</item>
<item>
  <title>636: Thunder Bolts</title>
  <link>https://www.bsdnow.tv/636</link>
  <guid isPermaLink="false">298cf02b-9f85-4fe2-bb2f-da047df5149b</guid>
  <pubDate>Thu, 06 Nov 2025 09:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/298cf02b-9f85-4fe2-bb2f-da047df5149b.mp3" length="60890112" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Thunderbolt on FreeBSD, ZFS on Illumos and Linux and FreeBSD, ZFS Compression, Home networking monitoring, LibreSSH and OpenSSH releases and more...</itunes:subtitle>
  <itunes:duration>1:03:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Thunderbolt on FreeBSD, ZFS on Illumos and Linux and FreeBSD, ZFS Compression, Home networking monitoring, LibreSSH and OpenSSH releases and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Thunderbolt on FreeBSD (https://blog.feld.me/posts/2025/10/thunderbolt-on-freebsd)
The broad state of ZFS on Illumos, Linux, and FreeBSD (as I understand it) (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSOnIllumosLinuxAndFreeBSD)
News Roundup
zfs: setting compression and adding new vdevs (https://dan.langille.org/2025/10/18/zfs-setting-compression-and-adding-new-vdevs)
The hunt for a home network monitoring solution (https://vulcanridr.mataroa.blog/blog/the-hunt-for-a-home-network-monitoring-solution)
LibreSSL 4.2.0 Released (https://www.undeadly.org/cgi?action=article;sid=20251015043527)
OpenSSH 10.2 released (https://www.undeadly.org/cgi?action=article;sid=20251010131052)
 - Related to 10.x versions : Post-Quantum Cryptography (https://www.openssh.com/pq.html)
Check your IP infos using nginx (https://www.tumfatig.net/2025/check-your-ip-infos-using-nginx)
Experimenting with Compression
(just given an overview, I dont exepect you to read the all three writeups fully)
Experimenting with compression off (https://dan.langille.org/2025/10/06/experimenting-with-compression-off/)
Experimenting with compression=lz4 (https://dan.langille.org/2025/10/06/experimenting-with-compressionlz4/)
Experimenting with compression=zstd (https://dan.langille.org/2025/10/06/experimenting-with-compressionzstd/)
Compression results (https://dan.langille.org/2025/10/06/compression-results) 
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Anton - Boxybsd (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/636/feedback/anton%20-%20boxybsd.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Thunderbolt on FreeBSD, ZFS on Illumos and Linux and FreeBSD, ZFS Compression, Home networking monitoring, LibreSSH and OpenSSH releases and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://blog.feld.me/posts/2025/10/thunderbolt-on-freebsd" rel="nofollow">Thunderbolt on FreeBSD</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSOnIllumosLinuxAndFreeBSD" rel="nofollow">The broad state of ZFS on Illumos, Linux, and FreeBSD (as I understand it)</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dan.langille.org/2025/10/18/zfs-setting-compression-and-adding-new-vdevs" rel="nofollow">zfs: setting compression and adding new vdevs</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/the-hunt-for-a-home-network-monitoring-solution" rel="nofollow">The hunt for a home network monitoring solution</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20251015043527" rel="nofollow">LibreSSL 4.2.0 Released</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20251010131052" rel="nofollow">OpenSSH 10.2 released</a></p>

<ul>
<li>Related to 10.x versions : <a href="https://www.openssh.com/pq.html" rel="nofollow">Post-Quantum Cryptography</a></li>
</ul>

<hr>

<p><a href="https://www.tumfatig.net/2025/check-your-ip-infos-using-nginx" rel="nofollow">Check your IP infos using nginx</a></p>

<hr>

<h3>Experimenting with Compression</h3>

<p>(just given an overview, I dont exepect you to read the all three writeups fully)</p>

<ul>
<li><a href="https://dan.langille.org/2025/10/06/experimenting-with-compression-off/" rel="nofollow">Experimenting with compression off</a></li>
<li><a href="https://dan.langille.org/2025/10/06/experimenting-with-compressionlz4/" rel="nofollow">Experimenting with compression=lz4</a></li>
<li><a href="https://dan.langille.org/2025/10/06/experimenting-with-compressionzstd/" rel="nofollow">Experimenting with compression=zstd</a></li>
<li><a href="https://dan.langille.org/2025/10/06/compression-results" rel="nofollow">Compression results</a> </li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/636/feedback/anton%20-%20boxybsd.md" rel="nofollow">Anton - Boxybsd</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Thunderbolt on FreeBSD, ZFS on Illumos and Linux and FreeBSD, ZFS Compression, Home networking monitoring, LibreSSH and OpenSSH releases and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://blog.feld.me/posts/2025/10/thunderbolt-on-freebsd" rel="nofollow">Thunderbolt on FreeBSD</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSOnIllumosLinuxAndFreeBSD" rel="nofollow">The broad state of ZFS on Illumos, Linux, and FreeBSD (as I understand it)</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dan.langille.org/2025/10/18/zfs-setting-compression-and-adding-new-vdevs" rel="nofollow">zfs: setting compression and adding new vdevs</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/the-hunt-for-a-home-network-monitoring-solution" rel="nofollow">The hunt for a home network monitoring solution</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20251015043527" rel="nofollow">LibreSSL 4.2.0 Released</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20251010131052" rel="nofollow">OpenSSH 10.2 released</a></p>

<ul>
<li>Related to 10.x versions : <a href="https://www.openssh.com/pq.html" rel="nofollow">Post-Quantum Cryptography</a></li>
</ul>

<hr>

<p><a href="https://www.tumfatig.net/2025/check-your-ip-infos-using-nginx" rel="nofollow">Check your IP infos using nginx</a></p>

<hr>

<h3>Experimenting with Compression</h3>

<p>(just given an overview, I dont exepect you to read the all three writeups fully)</p>

<ul>
<li><a href="https://dan.langille.org/2025/10/06/experimenting-with-compression-off/" rel="nofollow">Experimenting with compression off</a></li>
<li><a href="https://dan.langille.org/2025/10/06/experimenting-with-compressionlz4/" rel="nofollow">Experimenting with compression=lz4</a></li>
<li><a href="https://dan.langille.org/2025/10/06/experimenting-with-compressionzstd/" rel="nofollow">Experimenting with compression=zstd</a></li>
<li><a href="https://dan.langille.org/2025/10/06/compression-results" rel="nofollow">Compression results</a> </li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/636/feedback/anton%20-%20boxybsd.md" rel="nofollow">Anton - Boxybsd</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>635: Guess who's back?</title>
  <link>https://www.bsdnow.tv/635</link>
  <guid isPermaLink="false">8b8ffd0a-14ca-45b0-8d80-b1c9ab198b57</guid>
  <pubDate>Thu, 30 Oct 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8b8ffd0a-14ca-45b0-8d80-b1c9ab198b57.mp3" length="74451456" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 7.8, Building Enterprise Storage with Proxmox, SSD performance, Virtual Machines and more...</itunes:subtitle>
  <itunes:duration>1:17:33</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 7.8, Building Enterprise Storage with Proxmox, SSD performance, Virtual Machines and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenBSD 7.8 Released (https://www.openbsd.org/78.html) also (https://undeadly.org/cgi?action=article;sid=20251022025822) and (https://bsd.network/@brynet/115403567146395679)
Building Enterprise-Grade Storage on Proxmox with ZFS (https://klarasystems.com/articles/building-enterprise-grade-storage-on-proxmox-with-zfs)
News Roundup
[TUHS] Was artifacts, now ethernet (https://www.tuhs.org/pipermail/tuhs/2025-July/032268.html)
I wish SSDs gave you CPU performance style metrics about their activity (https://utcc.utoronto.ca/~cks/space/blog/tech/SSDWritePerfMetricsWish)
Migrate a KVM virtual machine to OmniOS bhyve (https://www.tumfatig.net/2025/migrate-a-kvm-virtual-machine-to-omnios-bhyve)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
brad - bhyve (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/635/feedback/brad%20-%20bhyve.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 7.8, Building Enterprise Storage with Proxmox, SSD performance, Virtual Machines and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.openbsd.org/78.html" rel="nofollow">OpenBSD 7.8 Released</a> also (<a href="https://undeadly.org/cgi?action=article;sid=20251022025822" rel="nofollow">https://undeadly.org/cgi?action=article;sid=20251022025822</a>) and (<a href="https://bsd.network/@brynet/115403567146395679" rel="nofollow">https://bsd.network/@brynet/115403567146395679</a>)</p>

<hr>

<p><a href="https://klarasystems.com/articles/building-enterprise-grade-storage-on-proxmox-with-zfs" rel="nofollow">Building Enterprise-Grade Storage on Proxmox with ZFS</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.tuhs.org/pipermail/tuhs/2025-July/032268.html" rel="nofollow">[TUHS] Was artifacts, now ethernet</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/SSDWritePerfMetricsWish" rel="nofollow">I wish SSDs gave you CPU performance style metrics about their activity</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2025/migrate-a-kvm-virtual-machine-to-omnios-bhyve" rel="nofollow">Migrate a KVM virtual machine to OmniOS bhyve</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/635/feedback/brad%20-%20bhyve.md" rel="nofollow">brad - bhyve</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 7.8, Building Enterprise Storage with Proxmox, SSD performance, Virtual Machines and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.openbsd.org/78.html" rel="nofollow">OpenBSD 7.8 Released</a> also (<a href="https://undeadly.org/cgi?action=article;sid=20251022025822" rel="nofollow">https://undeadly.org/cgi?action=article;sid=20251022025822</a>) and (<a href="https://bsd.network/@brynet/115403567146395679" rel="nofollow">https://bsd.network/@brynet/115403567146395679</a>)</p>

<hr>

<p><a href="https://klarasystems.com/articles/building-enterprise-grade-storage-on-proxmox-with-zfs" rel="nofollow">Building Enterprise-Grade Storage on Proxmox with ZFS</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.tuhs.org/pipermail/tuhs/2025-July/032268.html" rel="nofollow">[TUHS] Was artifacts, now ethernet</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/SSDWritePerfMetricsWish" rel="nofollow">I wish SSDs gave you CPU performance style metrics about their activity</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2025/migrate-a-kvm-virtual-machine-to-omnios-bhyve" rel="nofollow">Migrate a KVM virtual machine to OmniOS bhyve</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/635/feedback/brad%20-%20bhyve.md" rel="nofollow">brad - bhyve</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>634: Why Self-Host?</title>
  <link>https://www.bsdnow.tv/634</link>
  <guid isPermaLink="false">32188a5f-bff5-4a8f-97bd-b1c19705b7a9</guid>
  <pubDate>Thu, 23 Oct 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/32188a5f-bff5-4a8f-97bd-b1c19705b7a9.mp3" length="59177472" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Why Self-host?, Advanced ZFS Dataset Management, Building a Simple Router with OpenBSD, Minimal pkgbase jails / chroots, WSL-For-FreeBSD, Yubico yubikey 5 nfc on FreeBSD, The Q3 2025 Issue of the FreeBSD Journal, and more</itunes:subtitle>
  <itunes:duration>1:01:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Why Self-host?, Advanced ZFS Dataset Management, Building a Simple Router with OpenBSD, Minimal pkgbase jails / chroots, WSL-For-FreeBSD, Yubico yubikey 5 nfc on FreeBSD, The Q3 2025 Issue of the FreeBSD Journal, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Why Self-host? (https://romanzipp.com/blog/why-a-homelab-why-self-host)
Advanced ZFS Dataset Management: Snapshots, Clones, and Bookmarks (https://klarasystems.com/articles/advanced-zfs-dataset-management/)
News Roundup
Building a Simple Router with OpenBSD (https://btxx.org/posts/openbsd-router/)
Minimal pkgbase jails / chroots (https://forums.FreeBSD.org/threads/minimal-pkgbase-jails-chroots-docker-oci-like.99512/)
WSL-For-FreeBSD (https://github.com/BalajeS/WSL-For-FreeBSD)
Yubico yubikey 5 nfc on FreeBSD (https://forums.freebsd.org/threads/yubico-yubikey-5-nfc-on-freebsd.99529)
The Q3 2025 Issue of the FreeBSD Journal is Now Available (https://freebsdfoundation.org/blog/the-q3-2025-issue-of-the-freebsd-journal-is-now-available/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, self hosting, hosting, advanced, dataset management, simple router, router, pkgbase, minimal, chroot, WSL, yubico, yubikey 5, FreeBSD Journal</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Why Self-host?, Advanced ZFS Dataset Management, Building a Simple Router with OpenBSD, Minimal pkgbase jails / chroots, WSL-For-FreeBSD, Yubico yubikey 5 nfc on FreeBSD, The Q3 2025 Issue of the FreeBSD Journal, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://romanzipp.com/blog/why-a-homelab-why-self-host" rel="nofollow">Why Self-host?</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/advanced-zfs-dataset-management/" rel="nofollow">Advanced ZFS Dataset Management: Snapshots, Clones, and Bookmarks</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://btxx.org/posts/openbsd-router/" rel="nofollow">Building a Simple Router with OpenBSD</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/minimal-pkgbase-jails-chroots-docker-oci-like.99512/" rel="nofollow">Minimal pkgbase jails / chroots</a></p>

<hr>

<p><a href="https://github.com/BalajeS/WSL-For-FreeBSD" rel="nofollow">WSL-For-FreeBSD</a></p>

<hr>

<p><a href="https://forums.freebsd.org/threads/yubico-yubikey-5-nfc-on-freebsd.99529" rel="nofollow">Yubico yubikey 5 nfc on FreeBSD</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/the-q3-2025-issue-of-the-freebsd-journal-is-now-available/" rel="nofollow">The Q3 2025 Issue of the FreeBSD Journal is Now Available</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Why Self-host?, Advanced ZFS Dataset Management, Building a Simple Router with OpenBSD, Minimal pkgbase jails / chroots, WSL-For-FreeBSD, Yubico yubikey 5 nfc on FreeBSD, The Q3 2025 Issue of the FreeBSD Journal, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://romanzipp.com/blog/why-a-homelab-why-self-host" rel="nofollow">Why Self-host?</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/advanced-zfs-dataset-management/" rel="nofollow">Advanced ZFS Dataset Management: Snapshots, Clones, and Bookmarks</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://btxx.org/posts/openbsd-router/" rel="nofollow">Building a Simple Router with OpenBSD</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/minimal-pkgbase-jails-chroots-docker-oci-like.99512/" rel="nofollow">Minimal pkgbase jails / chroots</a></p>

<hr>

<p><a href="https://github.com/BalajeS/WSL-For-FreeBSD" rel="nofollow">WSL-For-FreeBSD</a></p>

<hr>

<p><a href="https://forums.freebsd.org/threads/yubico-yubikey-5-nfc-on-freebsd.99529" rel="nofollow">Yubico yubikey 5 nfc on FreeBSD</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/the-q3-2025-issue-of-the-freebsd-journal-is-now-available/" rel="nofollow">The Q3 2025 Issue of the FreeBSD Journal is Now Available</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>633: Magical Systems Thinking</title>
  <link>https://www.bsdnow.tv/633</link>
  <guid isPermaLink="false">4d736424-c75d-48e7-bd89-87f4b4a6fa41</guid>
  <pubDate>Thu, 16 Oct 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4d736424-c75d-48e7-bd89-87f4b4a6fa41.mp3" length="64108416" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>ZFS Features, Roadmap, and Innovations, Magical systems thinking, How VMware’s Debt-Fueled Acquisition Is Killing Open Source, OpenSSH 10.1 Released, KDE Plasma 6 Wayland on FreeBSD, Unix Co-Creator Brian Kernighan on Rust, Distros and NixOS, Balkanization of the Internet, GhostBSD 25.02 adds 'Gershwin' desktop for a Mac-like twist, and more</itunes:subtitle>
  <itunes:duration>1:06:46</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>ZFS Features, Roadmap, and Innovations, Magical systems thinking, How VMware’s Debt-Fueled Acquisition Is Killing Open Source, OpenSSH 10.1 Released, KDE Plasma 6 Wayland on FreeBSD, Unix Co-Creator Brian Kernighan on Rust, Distros and NixOS, Balkanization of the Internet, GhostBSD 25.02 adds 'Gershwin' desktop for a Mac-like twist, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
What the Future Brings – ZFS Features, Roadmap, and Innovations (https://klarasystems.com/articles/zfs-new-features-roadmap-innovations?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
Magical systems thinking (https://worksinprogress.co/issue/magical-systems-thinking)
The $69 Billion Domino Effect: How VMware’s Debt-Fueled Acquisition Is Killing Open Source, One Repository at a Time (https://fastcode.io/2025/08/30/the-69-billion-domino-effect-how-vmwares-debt-fueled-acquisition-is-killing-open-source-one-repository-at-a-time)
News Roundup
OpenSSH 10.1 Released (https://www.openssh.com/txt/release-10.1)
KDE Plasma 6 Wayland on FreeBSD (https://euroquis.nl/kde/2025/09/07/wayland.html)
Unix Co-Creator Brian Kernighan on Rust, Distros and NixOS (https://thenewstack.io/unix-co-creator-brian-kernighan-on-rust-distros-and-nixos)
GhostBSD 25.02 adds 'Gershwin' desktop for a Mac-like twist (https://www.theregister.com/2025/08/27/ghostbsd_2502/)
Beastie Bits
Adventures in porting a Wayland Compositor to NetBSD and OpenBSD by Jeff Frasca (https://www.youtube.com/watch?v=oo_8gnWQ4xo)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Kylen - CVEs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/633/feedback/Kylen%20-%20CVEs.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, features, roadmap, innovations, systems thinking, magical, debt-fueled acquisition, kde plasma 6, wayland, brian Kernighan, rust, distro, nixos, ghostbsd, gershwin, mac-like</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>ZFS Features, Roadmap, and Innovations, Magical systems thinking, How VMware’s Debt-Fueled Acquisition Is Killing Open Source, OpenSSH 10.1 Released, KDE Plasma 6 Wayland on FreeBSD, Unix Co-Creator Brian Kernighan on Rust, Distros and NixOS, Balkanization of the Internet, GhostBSD 25.02 adds &#39;Gershwin&#39; desktop for a Mac-like twist, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/zfs-new-features-roadmap-innovations?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">What the Future Brings – ZFS Features, Roadmap, and Innovations</a></p>

<hr>

<p><a href="https://worksinprogress.co/issue/magical-systems-thinking" rel="nofollow">Magical systems thinking</a></p>

<hr>

<p><a href="https://fastcode.io/2025/08/30/the-69-billion-domino-effect-how-vmwares-debt-fueled-acquisition-is-killing-open-source-one-repository-at-a-time" rel="nofollow">The $69 Billion Domino Effect: How VMware’s Debt-Fueled Acquisition Is Killing Open Source, One Repository at a Time</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.openssh.com/txt/release-10.1" rel="nofollow">OpenSSH 10.1 Released</a></p>

<hr>

<p><a href="https://euroquis.nl/kde/2025/09/07/wayland.html" rel="nofollow">KDE Plasma 6 Wayland on FreeBSD</a></p>

<hr>

<p><a href="https://thenewstack.io/unix-co-creator-brian-kernighan-on-rust-distros-and-nixos" rel="nofollow">Unix Co-Creator Brian Kernighan on Rust, Distros and NixOS</a></p>

<hr>

<p><a href="https://www.theregister.com/2025/08/27/ghostbsd_2502/" rel="nofollow">GhostBSD 25.02 adds &#39;Gershwin&#39; desktop for a Mac-like twist</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=oo_8gnWQ4xo" rel="nofollow">Adventures in porting a Wayland Compositor to NetBSD and OpenBSD by Jeff Frasca</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/633/feedback/Kylen%20-%20CVEs.md" rel="nofollow">Kylen - CVEs</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>ZFS Features, Roadmap, and Innovations, Magical systems thinking, How VMware’s Debt-Fueled Acquisition Is Killing Open Source, OpenSSH 10.1 Released, KDE Plasma 6 Wayland on FreeBSD, Unix Co-Creator Brian Kernighan on Rust, Distros and NixOS, Balkanization of the Internet, GhostBSD 25.02 adds &#39;Gershwin&#39; desktop for a Mac-like twist, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/zfs-new-features-roadmap-innovations?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">What the Future Brings – ZFS Features, Roadmap, and Innovations</a></p>

<hr>

<p><a href="https://worksinprogress.co/issue/magical-systems-thinking" rel="nofollow">Magical systems thinking</a></p>

<hr>

<p><a href="https://fastcode.io/2025/08/30/the-69-billion-domino-effect-how-vmwares-debt-fueled-acquisition-is-killing-open-source-one-repository-at-a-time" rel="nofollow">The $69 Billion Domino Effect: How VMware’s Debt-Fueled Acquisition Is Killing Open Source, One Repository at a Time</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.openssh.com/txt/release-10.1" rel="nofollow">OpenSSH 10.1 Released</a></p>

<hr>

<p><a href="https://euroquis.nl/kde/2025/09/07/wayland.html" rel="nofollow">KDE Plasma 6 Wayland on FreeBSD</a></p>

<hr>

<p><a href="https://thenewstack.io/unix-co-creator-brian-kernighan-on-rust-distros-and-nixos" rel="nofollow">Unix Co-Creator Brian Kernighan on Rust, Distros and NixOS</a></p>

<hr>

<p><a href="https://www.theregister.com/2025/08/27/ghostbsd_2502/" rel="nofollow">GhostBSD 25.02 adds &#39;Gershwin&#39; desktop for a Mac-like twist</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=oo_8gnWQ4xo" rel="nofollow">Adventures in porting a Wayland Compositor to NetBSD and OpenBSD by Jeff Frasca</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/633/feedback/Kylen%20-%20CVEs.md" rel="nofollow">Kylen - CVEs</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>632: Zipbomb defeated</title>
  <link>https://www.bsdnow.tv/632</link>
  <guid isPermaLink="false">4d8e2a9b-ebf7-4dcc-bbda-93121e1ab789</guid>
  <pubDate>Thu, 09 Oct 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4d8e2a9b-ebf7-4dcc-bbda-93121e1ab789.mp3" length="50827776" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>zipbomb defeated, Optimizing ZFS for High-Throughput Storage Workloads, Open Source is one person, Omada SDN Controller on FreeBSD, Building a Simple Router with OpenBSD, Back to the origins, Enhancing Support for NAT64 Protocol Translation in NetBSD, and more</itunes:subtitle>
  <itunes:duration>52:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>zipbomb defeated, Optimizing ZFS for High-Throughput Storage Workloads, Open Source is one person, Omada SDN Controller on FreeBSD, Building a Simple Router with OpenBSD, Back to the origins, Enhancing Support for NAT64 Protocol Translation in NetBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
zipbomb defeated (https://www.reddit.com/r/openzfs/comments/1niu6h7/when_a_decompression_zip_bomb_meets_zfs_19_pb/)
Optimizing ZFS for High-Throughput Storage Workloads (https://klarasystems.com/articles/optimizing-zfs-for-high-throughput-storage-workloads?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Open Source is one person (https://opensourcesecurity.io/2025/08-oss-one-person)
Omada SDN Controller on FreeBSD (https://blog.feld.me/posts/2025/08/omada-on-freebsd)
Back to the origins (https://failsafe.monster/posts/another-world/)
Google Summer of Code 2025 Reports: Enhancing Support for NAT64 Protocol Translation in NetBSD (http://blog.netbsd.org/tnf/entry/gsoc2025_nat64_protocol_translation)
Undeadly Bits
j2k25 - OpenBSD Hackathon Japan 2025 (http://undeadly.org/cgi?action=article;sid=20250601104254)
OpenSSH will now adapt IP QoS to actual sessions and traffic (http://undeadly.org/cgi?action=article;sid=20250818113047)
Preliminary support for Raspberry Pi 5 (https://undeadly.org/cgi?action=article;sid=20250903064251)
OpenBSD enters 7.8-beta (https://undeadly.org/cgi?action=article;sid=20250911045955)
Full BSDCan 2025 video playlist(s) available (https://undeadly.org/cgi?action=article;sid=20250912124932)
OpenBGPD 8.9 released (https://undeadly.org/cgi?action=article;sid=20250926141610)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - a few things (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/632/feedback/Brad%20-%20a%20few%20things.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, zipbomb, optimizing, High-Throughput, Workload, open person, Omada, sdn, software defined network, router, origins, enhancing support, nat64,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>zipbomb defeated, Optimizing ZFS for High-Throughput Storage Workloads, Open Source is one person, Omada SDN Controller on FreeBSD, Building a Simple Router with OpenBSD, Back to the origins, Enhancing Support for NAT64 Protocol Translation in NetBSD, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.reddit.com/r/openzfs/comments/1niu6h7/when_a_decompression_zip_bomb_meets_zfs_19_pb/" rel="nofollow">zipbomb defeated</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/optimizing-zfs-for-high-throughput-storage-workloads?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Optimizing ZFS for High-Throughput Storage Workloads</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://opensourcesecurity.io/2025/08-oss-one-person" rel="nofollow">Open Source is one person</a></p>

<hr>

<p><a href="https://blog.feld.me/posts/2025/08/omada-on-freebsd" rel="nofollow">Omada SDN Controller on FreeBSD</a></p>

<hr>

<p><a href="https://failsafe.monster/posts/another-world/" rel="nofollow">Back to the origins</a></p>

<hr>

<p><a href="http://blog.netbsd.org/tnf/entry/gsoc2025_nat64_protocol_translation" rel="nofollow">Google Summer of Code 2025 Reports: Enhancing Support for NAT64 Protocol Translation in NetBSD</a></p>

<hr>

<h2>Undeadly Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250601104254" rel="nofollow">j2k25 - OpenBSD Hackathon Japan 2025</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250818113047" rel="nofollow">OpenSSH will now adapt IP QoS to actual sessions and traffic</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20250903064251" rel="nofollow">Preliminary support for Raspberry Pi 5</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20250911045955" rel="nofollow">OpenBSD enters 7.8-beta</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20250912124932" rel="nofollow">Full BSDCan 2025 video playlist(s) available</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20250926141610" rel="nofollow">OpenBGPD 8.9 released</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/632/feedback/Brad%20-%20a%20few%20things.md" rel="nofollow">Brad - a few things</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>zipbomb defeated, Optimizing ZFS for High-Throughput Storage Workloads, Open Source is one person, Omada SDN Controller on FreeBSD, Building a Simple Router with OpenBSD, Back to the origins, Enhancing Support for NAT64 Protocol Translation in NetBSD, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.reddit.com/r/openzfs/comments/1niu6h7/when_a_decompression_zip_bomb_meets_zfs_19_pb/" rel="nofollow">zipbomb defeated</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/optimizing-zfs-for-high-throughput-storage-workloads?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Optimizing ZFS for High-Throughput Storage Workloads</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://opensourcesecurity.io/2025/08-oss-one-person" rel="nofollow">Open Source is one person</a></p>

<hr>

<p><a href="https://blog.feld.me/posts/2025/08/omada-on-freebsd" rel="nofollow">Omada SDN Controller on FreeBSD</a></p>

<hr>

<p><a href="https://failsafe.monster/posts/another-world/" rel="nofollow">Back to the origins</a></p>

<hr>

<p><a href="http://blog.netbsd.org/tnf/entry/gsoc2025_nat64_protocol_translation" rel="nofollow">Google Summer of Code 2025 Reports: Enhancing Support for NAT64 Protocol Translation in NetBSD</a></p>

<hr>

<h2>Undeadly Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250601104254" rel="nofollow">j2k25 - OpenBSD Hackathon Japan 2025</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250818113047" rel="nofollow">OpenSSH will now adapt IP QoS to actual sessions and traffic</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20250903064251" rel="nofollow">Preliminary support for Raspberry Pi 5</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20250911045955" rel="nofollow">OpenBSD enters 7.8-beta</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20250912124932" rel="nofollow">Full BSDCan 2025 video playlist(s) available</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20250926141610" rel="nofollow">OpenBGPD 8.9 released</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/632/feedback/Brad%20-%20a%20few%20things.md" rel="nofollow">Brad - a few things</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>630: Bhyve Management UI</title>
  <link>https://www.bsdnow.tv/630</link>
  <guid isPermaLink="false">95129bfb-90c7-481b-a15f-9d2af6dae342</guid>
  <pubDate>Thu, 02 Oct 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/95129bfb-90c7-481b-a15f-9d2af6dae342.mp3" length="34300800" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Foundation Q2 2025 Status Update, Keeping Data Safe with OpenZFS, Ollama on FreeBSD Using GPU Passthrough, ClonOS, Preliminary support for Raspberry Pi 5, Sylve: Manage bhyve VMs and Clusters on FreeBSD, Preventing Systemd DHCP RELEASE Behavior, Call for testing - Samba 4.22, and more</itunes:subtitle>
  <itunes:duration>35:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Foundation Q2 2025 Status Update, Keeping Data Safe with OpenZFS, Ollama on FreeBSD Using GPU Passthrough, ClonOS, Preliminary support for Raspberry Pi 5, Sylve: Manage bhyve VMs and Clusters on FreeBSD, Preventing Systemd DHCP RELEASE Behavior, Call for testing - Samba 4.22, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Foundation Q2 2025 Status Update (https://freebsdfoundation.org/blog/freebsd-foundation-q2-2025-status-update)
Keeping Data Safe with OpenZFS: Security, Encryption, and Delegation (https://klarasystems.com/articles/keeping-data-safe-with-openzfs-security-encryption-delegation?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Ollama on FreeBSD Using GPU Passthrough (https://evolving-architecture.eu/ollama-freebsd-gpu-passthrough/)
ClonOS (https://clonos.convectix.com/)
Preliminary support for Raspberry Pi 5 (http://undeadly.org/cgi?action=article;sid=20250903064251)
Sylve: Manage bhyve VMs and Clusters on FreeBSD
 (https://gyptazy.com/blog/sylve-a-proxmox-alike-webui-for-bhyve-on-freebsd/)
Preventing Systemd DHCP RELEASE Behavior (https://blog.feld.me/posts/2025/09/systemd-networkd-dhcp-release/)
Call for testing - Samba 4.22 in 0mp's ports tree (https://github.com/0mp/freebsd-ports/tree/0mp/samba422)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
-Vincent - Ollama on FreeBSD (https://github.com/BSDNow/bsdnow.tv/blob/master/630/feedback/vincent-ollama.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, status report, data safety, ollama, GPU Passthrough, clonos, Raspberry pi 5, rpi5, sylve, management, cluster, systemd dhcp release, samba 4.22</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Foundation Q2 2025 Status Update, Keeping Data Safe with OpenZFS, Ollama on FreeBSD Using GPU Passthrough, ClonOS, Preliminary support for Raspberry Pi 5, Sylve: Manage bhyve VMs and Clusters on FreeBSD, Preventing Systemd DHCP RELEASE Behavior, Call for testing - Samba 4.22, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/freebsd-foundation-q2-2025-status-update" rel="nofollow">FreeBSD Foundation Q2 2025 Status Update</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/keeping-data-safe-with-openzfs-security-encryption-delegation?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Keeping Data Safe with OpenZFS: Security, Encryption, and Delegation</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://evolving-architecture.eu/ollama-freebsd-gpu-passthrough/" rel="nofollow">Ollama on FreeBSD Using GPU Passthrough</a></p>

<hr>

<p><a href="https://clonos.convectix.com/" rel="nofollow">ClonOS</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250903064251" rel="nofollow">Preliminary support for Raspberry Pi 5</a></p>

<hr>

<p><a href="https://gyptazy.com/blog/sylve-a-proxmox-alike-webui-for-bhyve-on-freebsd/" rel="nofollow">Sylve: Manage bhyve VMs and Clusters on FreeBSD<br>
</a></p>

<hr>

<p><a href="https://blog.feld.me/posts/2025/09/systemd-networkd-dhcp-release/" rel="nofollow">Preventing Systemd DHCP RELEASE Behavior</a></p>

<hr>

<p><a href="https://github.com/0mp/freebsd-ports/tree/0mp/samba422" rel="nofollow">Call for testing - Samba 4.22 in 0mp&#39;s ports tree</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>-<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/630/feedback/vincent-ollama.md" rel="nofollow">Vincent - Ollama on FreeBSD</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Foundation Q2 2025 Status Update, Keeping Data Safe with OpenZFS, Ollama on FreeBSD Using GPU Passthrough, ClonOS, Preliminary support for Raspberry Pi 5, Sylve: Manage bhyve VMs and Clusters on FreeBSD, Preventing Systemd DHCP RELEASE Behavior, Call for testing - Samba 4.22, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/freebsd-foundation-q2-2025-status-update" rel="nofollow">FreeBSD Foundation Q2 2025 Status Update</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/keeping-data-safe-with-openzfs-security-encryption-delegation?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Keeping Data Safe with OpenZFS: Security, Encryption, and Delegation</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://evolving-architecture.eu/ollama-freebsd-gpu-passthrough/" rel="nofollow">Ollama on FreeBSD Using GPU Passthrough</a></p>

<hr>

<p><a href="https://clonos.convectix.com/" rel="nofollow">ClonOS</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250903064251" rel="nofollow">Preliminary support for Raspberry Pi 5</a></p>

<hr>

<p><a href="https://gyptazy.com/blog/sylve-a-proxmox-alike-webui-for-bhyve-on-freebsd/" rel="nofollow">Sylve: Manage bhyve VMs and Clusters on FreeBSD<br>
</a></p>

<hr>

<p><a href="https://blog.feld.me/posts/2025/09/systemd-networkd-dhcp-release/" rel="nofollow">Preventing Systemd DHCP RELEASE Behavior</a></p>

<hr>

<p><a href="https://github.com/0mp/freebsd-ports/tree/0mp/samba422" rel="nofollow">Call for testing - Samba 4.22 in 0mp&#39;s ports tree</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>-<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/630/feedback/vincent-ollama.md" rel="nofollow">Vincent - Ollama on FreeBSD</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>631: Endorphin Rush</title>
  <link>https://www.bsdnow.tv/631</link>
  <guid isPermaLink="false">76f80a10-4420-444a-801e-d3655c962851</guid>
  <pubDate>Thu, 25 Sep 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/76f80a10-4420-444a-801e-d3655c962851.mp3" length="88556160" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Secure Boot for FreeBSD, Systems lie about their proper functioning, Teching the tech and rushing the endorphins, Passing a Device Into A FreeBSD Jail With A Stable Name, ZFS snapshots aren't as immutable as I thought, due to snapshot metadata, Let's write a peephole optimizer for QBE's arm64 backend, Migrate a Peertube instance from Debian to FreeBSD, and more</itunes:subtitle>
  <itunes:duration>36:53</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Secure Boot for FreeBSD, Systems lie about their proper functioning, Teching the tech and rushing the endorphins, Passing a Device Into A FreeBSD Jail With A Stable Name, ZFS snapshots aren't as immutable as I thought, due to snapshot metadata, Let's write a peephole optimizer for QBE's arm64 backend, Migrate a Peertube instance from Debian to FreeBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Secure Boot for FreeBSD (https://forums.FreeBSD.org/threads/how-to-set-up-secure-boot-for-freebsd.99169/)
The Fundamental Failure-Mode Theorem: Systems lie about their proper functioning (https://devblogs.microsoft.com/oldnewthing/20250716-00/?p=111383)
News Roundup
Teching the tech and rushing the endorphins (https://vulcanridr.mataroa.blog/blog/teching-the-tech-and-rushing-the-endorphins)
Passing a Device Into A FreeBSD Jail With A Stable Name (https://blog.feld.me/posts/2025/09/passing-device-freebsd-jail-with-stable-name/)
ZFS snapshots aren't as immutable as I thought, due to snapshot metadata (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSSnapshotsNotFullyImmutable)
Let's write a peephole optimizer for QBE's arm64 backend (https://briancallahan.net/blog/20250901.html)
Migrate a Peertube instance from Debian to FreeBSD (https://www.tumfatig.net/2025/migrate-a-peertube-instance-from-debian-to-freebsd)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
-Steve - Interviews (https://github.com/BSDNow/bsdnow.tv/blob/master/631/feedback/Steve%20-%20Interviews.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, status report, data safety, ollama, GPU Passthrough, clonos, Raspberry pi 5, rpi5, sylve, management, cluster, systemd dhcp release, samba 4.22</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Secure Boot for FreeBSD, Systems lie about their proper functioning, Teching the tech and rushing the endorphins, Passing a Device Into A FreeBSD Jail With A Stable Name, ZFS snapshots aren&#39;t as immutable as I thought, due to snapshot metadata, Let&#39;s write a peephole optimizer for QBE&#39;s arm64 backend, Migrate a Peertube instance from Debian to FreeBSD, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://forums.FreeBSD.org/threads/how-to-set-up-secure-boot-for-freebsd.99169/" rel="nofollow">Secure Boot for FreeBSD</a></p>

<hr>

<p><a href="https://devblogs.microsoft.com/oldnewthing/20250716-00/?p=111383" rel="nofollow">The Fundamental Failure-Mode Theorem: Systems lie about their proper functioning</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://vulcanridr.mataroa.blog/blog/teching-the-tech-and-rushing-the-endorphins" rel="nofollow">Teching the tech and rushing the endorphins</a></p>

<hr>

<p><a href="https://blog.feld.me/posts/2025/09/passing-device-freebsd-jail-with-stable-name/" rel="nofollow">Passing a Device Into A FreeBSD Jail With A Stable Name</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSSnapshotsNotFullyImmutable" rel="nofollow">ZFS snapshots aren&#39;t as immutable as I thought, due to snapshot metadata</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20250901.html" rel="nofollow">Let&#39;s write a peephole optimizer for QBE&#39;s arm64 backend</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2025/migrate-a-peertube-instance-from-debian-to-freebsd" rel="nofollow">Migrate a Peertube instance from Debian to FreeBSD</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>-<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/631/feedback/Steve%20-%20Interviews.md" rel="nofollow">Steve - Interviews</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Secure Boot for FreeBSD, Systems lie about their proper functioning, Teching the tech and rushing the endorphins, Passing a Device Into A FreeBSD Jail With A Stable Name, ZFS snapshots aren&#39;t as immutable as I thought, due to snapshot metadata, Let&#39;s write a peephole optimizer for QBE&#39;s arm64 backend, Migrate a Peertube instance from Debian to FreeBSD, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://forums.FreeBSD.org/threads/how-to-set-up-secure-boot-for-freebsd.99169/" rel="nofollow">Secure Boot for FreeBSD</a></p>

<hr>

<p><a href="https://devblogs.microsoft.com/oldnewthing/20250716-00/?p=111383" rel="nofollow">The Fundamental Failure-Mode Theorem: Systems lie about their proper functioning</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://vulcanridr.mataroa.blog/blog/teching-the-tech-and-rushing-the-endorphins" rel="nofollow">Teching the tech and rushing the endorphins</a></p>

<hr>

<p><a href="https://blog.feld.me/posts/2025/09/passing-device-freebsd-jail-with-stable-name/" rel="nofollow">Passing a Device Into A FreeBSD Jail With A Stable Name</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSSnapshotsNotFullyImmutable" rel="nofollow">ZFS snapshots aren&#39;t as immutable as I thought, due to snapshot metadata</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20250901.html" rel="nofollow">Let&#39;s write a peephole optimizer for QBE&#39;s arm64 backend</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2025/migrate-a-peertube-instance-from-debian-to-freebsd" rel="nofollow">Migrate a Peertube instance from Debian to FreeBSD</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>-<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/631/feedback/Steve%20-%20Interviews.md" rel="nofollow">Steve - Interviews</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>629: Host Naming Conventions</title>
  <link>https://www.bsdnow.tv/629</link>
  <guid isPermaLink="false">95debf62-27d2-44db-9362-3e6c9f6d1fd3</guid>
  <pubDate>Thu, 18 Sep 2025 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/95debf62-27d2-44db-9362-3e6c9f6d1fd3.mp3" length="98209516" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Death of Industrial Design, Host naming Convensions, Symbian reflections, bash timeouts, nvme vs ssds, a system to organize your life, and more.
</itunes:subtitle>
  <itunes:duration>1:08:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Death of Industrial Design, Host naming Convensions, Symbian reflections, bash timeouts, nvme vs ssds, a system to organize your life, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The Death Of Industrial Design And The Era Of Dull Electronics (https://hackaday.com/2025/07/23/the-death-of-industrial-design-and-the-era-of-dull-electronics)
Host Naming Convention (https://vulcanridr.mataroa.blog/blog/host-naming-convention)
News Roundup
Open, free, and completely ignored: The strange afterlife of Symbian (https://www.theregister.com/2025/07/17/symbian_forgotten_foss_phone_os/)
TIL: timeout in Bash scripts (https://heitorpb.github.io/bla/timeout/)
It seems like NVMe SSDs have overtaken SATA SSDs for high capacities (https://utcc.utoronto.ca/~cks/space/blog/tech/NVMeOvertakingSATAForSSDs)
A system to organise your life (https://johnnydecimal.com)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
- Nelson - Books (https://github.com/BSDNow/bsdnow.tv/blob/master/629/feedback/Nelson%20-%20books.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, industrial design, dull electronics, hostname, convention, bash, timeout, symbian, nvme, ssd, performance, capacity, organization</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Death of Industrial Design, Host naming Convensions, Symbian reflections, bash timeouts, nvme vs ssds, a system to organize your life, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://hackaday.com/2025/07/23/the-death-of-industrial-design-and-the-era-of-dull-electronics" rel="nofollow">The Death Of Industrial Design And The Era Of Dull Electronics</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/host-naming-convention" rel="nofollow">Host Naming Convention</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.theregister.com/2025/07/17/symbian_forgotten_foss_phone_os/" rel="nofollow">Open, free, and completely ignored: The strange afterlife of Symbian</a></p>

<hr>

<p><a href="https://heitorpb.github.io/bla/timeout/" rel="nofollow">TIL: timeout in Bash scripts</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/NVMeOvertakingSATAForSSDs" rel="nofollow">It seems like NVMe SSDs have overtaken SATA SSDs for high capacities</a></p>

<hr>

<p><a href="https://johnnydecimal.com" rel="nofollow">A system to organise your life</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<h2>- <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/629/feedback/Nelson%20-%20books.md" rel="nofollow">Nelson - Books</a></h2>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Death of Industrial Design, Host naming Convensions, Symbian reflections, bash timeouts, nvme vs ssds, a system to organize your life, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://hackaday.com/2025/07/23/the-death-of-industrial-design-and-the-era-of-dull-electronics" rel="nofollow">The Death Of Industrial Design And The Era Of Dull Electronics</a></p>

<hr>

<p><a href="https://vulcanridr.mataroa.blog/blog/host-naming-convention" rel="nofollow">Host Naming Convention</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.theregister.com/2025/07/17/symbian_forgotten_foss_phone_os/" rel="nofollow">Open, free, and completely ignored: The strange afterlife of Symbian</a></p>

<hr>

<p><a href="https://heitorpb.github.io/bla/timeout/" rel="nofollow">TIL: timeout in Bash scripts</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/NVMeOvertakingSATAForSSDs" rel="nofollow">It seems like NVMe SSDs have overtaken SATA SSDs for high capacities</a></p>

<hr>

<p><a href="https://johnnydecimal.com" rel="nofollow">A system to organise your life</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<h2>- <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/629/feedback/Nelson%20-%20books.md" rel="nofollow">Nelson - Books</a></h2>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>628: Product Hype</title>
  <link>https://www.bsdnow.tv/628</link>
  <guid isPermaLink="false">f3c4b62d-2f65-49c1-9e51-121e0e549d22</guid>
  <pubDate>Thu, 11 Sep 2025 00:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f3c4b62d-2f65-49c1-9e51-121e0e549d22.mp3" length="118079040" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Hype is the Product, Programmers Aren’t So Humble Anymore—Maybe Because Nobody Codes in Perl, Is OpenBSD 10x faster than Linux?, How to install FreeBSD on providers that don't support it with mfsBSD, SSHX, Zvault Status Update, and more</itunes:subtitle>
  <itunes:duration>49:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Hype is the Product, Programmers Aren’t So Humble Anymore—Maybe Because Nobody Codes in Perl, Is OpenBSD 10x faster than Linux?, How to install FreeBSD on providers that don't support it with mfsBSD, SSHX, Zvault Status Update, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The Hype is the Product (https://rys.io/en/180.html)
Programmers Aren’t So Humble Anymore—Maybe Because Nobody Codes in Perl (https://www.wired.com/story/programmers-arent-humble-anymore-nobody-codes-in-perl)
News Roundup
Is OpenBSD 10x faster than Linux? (https://flak.tedunangst.com/post/is-OpenBSD-10x-faster-than-Linux)
How to install FreeBSD on providers that don't support it with mfsBSD (https://it-notes.dragas.net/2025/07/02/install_freebsd_providers_mfsbsd/)
SSHX (https://github.com/ekzhang/sshx)
Zvault Status Update (https://github.com/zvaultio/Community/blob/main/posts/2025-07-13.md)
Undeadly Bits
4096 colours and flashing text on the console! (http://undeadly.org/cgi?action=article;sid=20250705081315)
Font caching no longer runs as root (http://undeadly.org/cgi?action=article;sid=20250717061920)
OpenSSH will now adapt IP QoS to actual sessions and traffic (http://undeadly.org/cgi?action=article;sid=20250818113047)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, hype, Product, programmers, humble, perl, performance, mfsBSD, SSHX, Zvault</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Hype is the Product, Programmers Aren’t So Humble Anymore—Maybe Because Nobody Codes in Perl, Is OpenBSD 10x faster than Linux?, How to install FreeBSD on providers that don&#39;t support it with mfsBSD, SSHX, Zvault Status Update, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://rys.io/en/180.html" rel="nofollow">The Hype is the Product</a></p>

<hr>

<p><a href="https://www.wired.com/story/programmers-arent-humble-anymore-nobody-codes-in-perl" rel="nofollow">Programmers Aren’t So Humble Anymore—Maybe Because Nobody Codes in Perl</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://flak.tedunangst.com/post/is-OpenBSD-10x-faster-than-Linux" rel="nofollow">Is OpenBSD 10x faster than Linux?</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2025/07/02/install_freebsd_providers_mfsbsd/" rel="nofollow">How to install FreeBSD on providers that don&#39;t support it with mfsBSD</a></p>

<hr>

<p><a href="https://github.com/ekzhang/sshx" rel="nofollow">SSHX</a></p>

<hr>

<p><a href="https://github.com/zvaultio/Community/blob/main/posts/2025-07-13.md" rel="nofollow">Zvault Status Update</a></p>

<hr>

<h2>Undeadly Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250705081315" rel="nofollow">4096 colours and flashing text on the console!</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250717061920" rel="nofollow">Font caching no longer runs as root</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250818113047" rel="nofollow">OpenSSH will now adapt IP QoS to actual sessions and traffic</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Hype is the Product, Programmers Aren’t So Humble Anymore—Maybe Because Nobody Codes in Perl, Is OpenBSD 10x faster than Linux?, How to install FreeBSD on providers that don&#39;t support it with mfsBSD, SSHX, Zvault Status Update, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://rys.io/en/180.html" rel="nofollow">The Hype is the Product</a></p>

<hr>

<p><a href="https://www.wired.com/story/programmers-arent-humble-anymore-nobody-codes-in-perl" rel="nofollow">Programmers Aren’t So Humble Anymore—Maybe Because Nobody Codes in Perl</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://flak.tedunangst.com/post/is-OpenBSD-10x-faster-than-Linux" rel="nofollow">Is OpenBSD 10x faster than Linux?</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2025/07/02/install_freebsd_providers_mfsbsd/" rel="nofollow">How to install FreeBSD on providers that don&#39;t support it with mfsBSD</a></p>

<hr>

<p><a href="https://github.com/ekzhang/sshx" rel="nofollow">SSHX</a></p>

<hr>

<p><a href="https://github.com/zvaultio/Community/blob/main/posts/2025-07-13.md" rel="nofollow">Zvault Status Update</a></p>

<hr>

<h2>Undeadly Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250705081315" rel="nofollow">4096 colours and flashing text on the console!</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250717061920" rel="nofollow">Font caching no longer runs as root</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250818113047" rel="nofollow">OpenSSH will now adapt IP QoS to actual sessions and traffic</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>627: Catastrophic OpenZFS bug</title>
  <link>https://www.bsdnow.tv/627</link>
  <guid isPermaLink="false">cc9023da-d33f-4b3d-8478-1c72c3b02aad</guid>
  <pubDate>Thu, 04 Sep 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cc9023da-d33f-4b3d-8478-1c72c3b02aad.mp3" length="133652160" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>An (almost) catastrophic OpenZFS bug, crawler plague and the fragility of the web, Classic CDE (Common Desktop Environment) coming to OpenBSD, Some notes on DMARC policy inheritance and a gotcha, GNAT (Ada) is in fact fully supported on illumos, Eighteen Years of Greytrapping, and more</itunes:subtitle>
  <itunes:duration>55:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>An (almost) catastrophic OpenZFS bug, crawler plague and the fragility of the web, Classic CDE (Common Desktop Environment) coming to OpenBSD, Some notes on DMARC policy inheritance and a gotcha, GNAT (Ada) is in fact fully supported on illumos, Eighteen Years of Greytrapping, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
An (almost) catastrophic OpenZFS bug and the humans that made it (and Rust is here too) (https://despairlabs.com/blog/posts/2025-07-10-an-openzfs-bug-and-the-humans-that-made-it)
The current (2025) crawler plague and the fragility of the web (https://utcc.utoronto.ca/~cks/space/blog/web/WebIsKindOfFragile)
News Roundup
Classic CDE (Common Desktop Environment) coming to OpenBSD (https://undeadly.org/cgi?action=article;sid=20250730080301)
Some notes on DMARC policy inheritance and a gotcha (https://utcc.utoronto.ca/~cks/space/blog/spam/DMARCPolicyInheritanceNotes)
Despite thoughts to the contrary, GNAT (Ada) is in fact fully supported on illumos (https://briancallahan.net/blog/20250817.html)
Eighteen Years of Greytrapping - Is the Weirdness Finally Paying Off? (https://bsdly.blogspot.com/2025/08/eighteen-years-of-greytrapping-is.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, bug, crawler plague, web, fragility, common desktop environment, cde, DMARC, GNAT, Ada, illumos, Greytrapping</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>An (almost) catastrophic OpenZFS bug, crawler plague and the fragility of the web, Classic CDE (Common Desktop Environment) coming to OpenBSD, Some notes on DMARC policy inheritance and a gotcha, GNAT (Ada) is in fact fully supported on illumos, Eighteen Years of Greytrapping, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://despairlabs.com/blog/posts/2025-07-10-an-openzfs-bug-and-the-humans-that-made-it" rel="nofollow">An (almost) catastrophic OpenZFS bug and the humans that made it (and Rust is here too)</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/web/WebIsKindOfFragile" rel="nofollow">The current (2025) crawler plague and the fragility of the web</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20250730080301" rel="nofollow">Classic CDE (Common Desktop Environment) coming to OpenBSD</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/spam/DMARCPolicyInheritanceNotes" rel="nofollow">Some notes on DMARC policy inheritance and a gotcha</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20250817.html" rel="nofollow">Despite thoughts to the contrary, GNAT (Ada) is in fact fully supported on illumos</a></p>

<hr>

<p><a href="https://bsdly.blogspot.com/2025/08/eighteen-years-of-greytrapping-is.html" rel="nofollow">Eighteen Years of Greytrapping - Is the Weirdness Finally Paying Off?</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>An (almost) catastrophic OpenZFS bug, crawler plague and the fragility of the web, Classic CDE (Common Desktop Environment) coming to OpenBSD, Some notes on DMARC policy inheritance and a gotcha, GNAT (Ada) is in fact fully supported on illumos, Eighteen Years of Greytrapping, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://despairlabs.com/blog/posts/2025-07-10-an-openzfs-bug-and-the-humans-that-made-it" rel="nofollow">An (almost) catastrophic OpenZFS bug and the humans that made it (and Rust is here too)</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/web/WebIsKindOfFragile" rel="nofollow">The current (2025) crawler plague and the fragility of the web</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20250730080301" rel="nofollow">Classic CDE (Common Desktop Environment) coming to OpenBSD</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/spam/DMARCPolicyInheritanceNotes" rel="nofollow">Some notes on DMARC policy inheritance and a gotcha</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20250817.html" rel="nofollow">Despite thoughts to the contrary, GNAT (Ada) is in fact fully supported on illumos</a></p>

<hr>

<p><a href="https://bsdly.blogspot.com/2025/08/eighteen-years-of-greytrapping-is.html" rel="nofollow">Eighteen Years of Greytrapping - Is the Weirdness Finally Paying Off?</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>626: USB webcam testing</title>
  <link>https://www.bsdnow.tv/626</link>
  <guid isPermaLink="false">7aa38aab-5259-4707-991b-6514fd537e38</guid>
  <pubDate>Thu, 28 Aug 2025 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7aa38aab-5259-4707-991b-6514fd537e38.mp3" length="134819520" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Journal Summer 2025 Edition, Java hiding in plain sight, BSDCan 2025 Trip report, Call for testing OpenBSD webcams, recent new features in OpenSSH, Improved 802.11g AP compatibility check, and more</itunes:subtitle>
  <itunes:duration>56:10</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Journal Summer 2025 Edition, Java hiding in plain sight, BSDCan 2025 Trip report, Call for testing OpenBSD webcams, recent new features in OpenSSH, Improved 802.11g AP compatibility check, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Journal April/May/June 2025 Edition (https://freebsdfoundation.org/our-work/journal/browser-based-edition/networking-3/)
BSDCan 2025 Trip Report – Chuck Tuffli (https://freebsdfoundation.org/blog/bsdcan-2025-trip-report-chuck-tuffli/)
News Roundup
Call for testing: USB webcams (http://undeadly.org/cgi?action=article;sid=20250808083341)
From Minecraft to Markets: Java Hiding in Plain Sight (https://freebsdfoundation.org/blog/from-minecraft-to-markets-java-hiding-in-plain-sight/)
Recent new features in OpenSSH (http://undeadly.org/cgi?action=article;sid=20250802084523)
NetBSD 11.0 release process underway (https://blog.netbsd.org/tnf/entry/netbsd_11_0_release_process)
Interview: Nico Cartron
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
 Special Guest: Nico Cartron.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, freebsd journal, java, bsdcan trip report, call for testing, openbsd webcams, openssh features, usb, 802.11g, release process underway</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Journal Summer 2025 Edition, Java hiding in plain sight, BSDCan 2025 Trip report, Call for testing OpenBSD webcams, recent new features in OpenSSH, Improved 802.11g AP compatibility check, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/our-work/journal/browser-based-edition/networking-3/" rel="nofollow">FreeBSD Journal April/May/June 2025 Edition</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/bsdcan-2025-trip-report-chuck-tuffli/" rel="nofollow">BSDCan 2025 Trip Report – Chuck Tuffli</a></p>

<h2>News Roundup</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250808083341" rel="nofollow">Call for testing: USB webcams</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/from-minecraft-to-markets-java-hiding-in-plain-sight/" rel="nofollow">From Minecraft to Markets: Java Hiding in Plain Sight</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250802084523" rel="nofollow">Recent new features in OpenSSH</a></p>

<hr>

<p><a href="https://blog.netbsd.org/tnf/entry/netbsd_11_0_release_process" rel="nofollow">NetBSD 11.0 release process underway</a></p>

<hr>

<h2>Interview: Nico Cartron</h2>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr><p>Special Guest: Nico Cartron.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Journal Summer 2025 Edition, Java hiding in plain sight, BSDCan 2025 Trip report, Call for testing OpenBSD webcams, recent new features in OpenSSH, Improved 802.11g AP compatibility check, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/our-work/journal/browser-based-edition/networking-3/" rel="nofollow">FreeBSD Journal April/May/June 2025 Edition</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/bsdcan-2025-trip-report-chuck-tuffli/" rel="nofollow">BSDCan 2025 Trip Report – Chuck Tuffli</a></p>

<h2>News Roundup</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250808083341" rel="nofollow">Call for testing: USB webcams</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/from-minecraft-to-markets-java-hiding-in-plain-sight/" rel="nofollow">From Minecraft to Markets: Java Hiding in Plain Sight</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250802084523" rel="nofollow">Recent new features in OpenSSH</a></p>

<hr>

<p><a href="https://blog.netbsd.org/tnf/entry/netbsd_11_0_release_process" rel="nofollow">NetBSD 11.0 release process underway</a></p>

<hr>

<h2>Interview: Nico Cartron</h2>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr><p>Special Guest: Nico Cartron.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>625: Build Cluster Speedup</title>
  <link>https://www.bsdnow.tv/625</link>
  <guid isPermaLink="false">79be3516-806f-4077-8f6c-b7434141a851</guid>
  <pubDate>Thu, 21 Aug 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/79be3516-806f-4077-8f6c-b7434141a851.mp3" length="121440960" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Why FreeBSD is the Right Choice for Embedded Devices, The Day GlusterFS Tried to Kill My Career, DragonFly DRM updated, NetBSD on Raspberry Pi, Speed up suspend/resume for FreeBSD, Revisiting ZFS's ZIL, separate log devices, and writes, One of my blog articles featured on the BSD Now podcast episode, New build cluster speeds up daily autobuilds, and more</itunes:subtitle>
  <itunes:duration>50:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Why FreeBSD is the Right Choice for Embedded Devices, The Day GlusterFS Tried to Kill My Career, DragonFly DRM updated, NetBSD on Raspberry Pi, Speed up suspend/resume for FreeBSD, Revisiting ZFS's ZIL, separate log devices, and writes, One of my blog articles featured on the BSD Now podcast episode, New build cluster speeds up daily autobuilds, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Why FreeBSD is the Right Choice for Embedded Devices (https://klarasystems.com/articles/why-freebsd-is-the-right-choice-for-embedded-devices/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
The Day GlusterFS Tried to Kill My Career (https://it-notes.dragas.net/2025/05/21/the_day_glusterfs_tried_to_kill_my_career/)
News Roundup
DragonFly DRM updated (https://www.dragonflydigest.com/2025/07/31/dragonfly-drm-updated/)
NetBSD on Raspberry Pi! (https://www.ncartron.org/netbsd-on-raspberry-pi.html)
Speed up suspend/resume for FreeBSD (https://eugene-andrienko.com/en/it/2025/07/28/speed-up-suspend-resume-freebsd.html)
Revisiting ZFS's ZIL, separate log devices, and writes (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSWritesAndZILIII)
One of my blog articles featured on the BSD Now podcast episode! (https://www.ncartron.org/one-of-my-blog-articles-featured-on-the-bsd-now-podcast-episode.html)
New build cluster speeds up daily autobuilds (http://blog.netbsd.org/tnf/entry/new_build_cluster_speeds_up)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, embedded devices, glusterfs, drm updates, Raspberry pi, speed up, performance, fast, faster, suspend, resume, ZIL, featuring, featured, build cluster, autobuilds,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Why FreeBSD is the Right Choice for Embedded Devices, The Day GlusterFS Tried to Kill My Career, DragonFly DRM updated, NetBSD on Raspberry Pi, Speed up suspend/resume for FreeBSD, Revisiting ZFS&#39;s ZIL, separate log devices, and writes, One of my blog articles featured on the BSD Now podcast episode, New build cluster speeds up daily autobuilds, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/why-freebsd-is-the-right-choice-for-embedded-devices/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Why FreeBSD is the Right Choice for Embedded Devices</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2025/05/21/the_day_glusterfs_tried_to_kill_my_career/" rel="nofollow">The Day GlusterFS Tried to Kill My Career</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.dragonflydigest.com/2025/07/31/dragonfly-drm-updated/" rel="nofollow">DragonFly DRM updated</a></p>

<hr>

<p><a href="https://www.ncartron.org/netbsd-on-raspberry-pi.html" rel="nofollow">NetBSD on Raspberry Pi!</a></p>

<hr>

<p><a href="https://eugene-andrienko.com/en/it/2025/07/28/speed-up-suspend-resume-freebsd.html" rel="nofollow">Speed up suspend/resume for FreeBSD</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSWritesAndZILIII" rel="nofollow">Revisiting ZFS&#39;s ZIL, separate log devices, and writes</a></p>

<hr>

<p><a href="https://www.ncartron.org/one-of-my-blog-articles-featured-on-the-bsd-now-podcast-episode.html" rel="nofollow">One of my blog articles featured on the BSD Now podcast episode!</a></p>

<hr>

<p><a href="http://blog.netbsd.org/tnf/entry/new_build_cluster_speeds_up" rel="nofollow">New build cluster speeds up daily autobuilds</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Why FreeBSD is the Right Choice for Embedded Devices, The Day GlusterFS Tried to Kill My Career, DragonFly DRM updated, NetBSD on Raspberry Pi, Speed up suspend/resume for FreeBSD, Revisiting ZFS&#39;s ZIL, separate log devices, and writes, One of my blog articles featured on the BSD Now podcast episode, New build cluster speeds up daily autobuilds, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/why-freebsd-is-the-right-choice-for-embedded-devices/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Why FreeBSD is the Right Choice for Embedded Devices</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2025/05/21/the_day_glusterfs_tried_to_kill_my_career/" rel="nofollow">The Day GlusterFS Tried to Kill My Career</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.dragonflydigest.com/2025/07/31/dragonfly-drm-updated/" rel="nofollow">DragonFly DRM updated</a></p>

<hr>

<p><a href="https://www.ncartron.org/netbsd-on-raspberry-pi.html" rel="nofollow">NetBSD on Raspberry Pi!</a></p>

<hr>

<p><a href="https://eugene-andrienko.com/en/it/2025/07/28/speed-up-suspend-resume-freebsd.html" rel="nofollow">Speed up suspend/resume for FreeBSD</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSWritesAndZILIII" rel="nofollow">Revisiting ZFS&#39;s ZIL, separate log devices, and writes</a></p>

<hr>

<p><a href="https://www.ncartron.org/one-of-my-blog-articles-featured-on-the-bsd-now-podcast-episode.html" rel="nofollow">One of my blog articles featured on the BSD Now podcast episode!</a></p>

<hr>

<p><a href="http://blog.netbsd.org/tnf/entry/new_build_cluster_speeds_up" rel="nofollow">New build cluster speeds up daily autobuilds</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>624: OpenBSD Innovations</title>
  <link>https://www.bsdnow.tv/624</link>
  <guid isPermaLink="false">befb1e6f-ad13-476b-8755-7602f9061390</guid>
  <pubDate>Thu, 14 Aug 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/befb1e6f-ad13-476b-8755-7602f9061390.mp3" length="147046080" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD chflags vs. Log Tampering, How to Defend Against Aggressive Web Scrapers With Anubis on FreeBSD 14, OpenBSD Innovations, Full Ada programming toolchain NOW on FreeBSD, Compute GPUs can have odd failures under Linux (still), A handy collection of shell aliases from my bash startup, and more</itunes:subtitle>
  <itunes:duration>1:01:16</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD chflags vs. Log Tampering, How to Defend Against Aggressive Web Scrapers With Anubis on FreeBSD 14, OpenBSD Innovations, Full Ada programming toolchain NOW on FreeBSD, Compute GPUs can have odd failures under Linux (still), A handy collection of shell aliases from my bash startup, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
When Root Meets Immutable: OpenBSD chflags vs. Log Tampering (https://rsadowski.de/posts/2025/openbsd-immutable-system-logs/)
How to Defend Against Aggressive Web Scrapers With Anubis on FreeBSD 14 (https://herrbischoff.com/2025/07/how-to-defend-against-aggressive-web-scrapers-with-anubis-on-freebsd-14/)
News Roundup
OpenBSD Innovations (https://www.openbsd.org/innovations.html)
Full Ada programming toolchain NOW on FreeBSD (https://www.reddit.com/r/freebsd/comments/1m21t7o/ann_full_ada_programming_toolchain_now_on_freebsd/)
Compute GPUs can have odd failures under Linux (still) (https://utcc.utoronto.ca/~cks/space/blog/linux/ComputeGPUsStillFinicky)
A handy collection of shell aliases from my bash startup (https://blog.petdance.com/2020/02/03/handy-collection-of-shell-aliases/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Efraim - modernizing (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/624/feedback/Efraim%20-%20modernizing.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, chflags, log tampering, defend, web scrapers, anubis, innovations, ada toolchain, compute GPUs, shell aliases, collection, bash,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD chflags vs. Log Tampering, How to Defend Against Aggressive Web Scrapers With Anubis on FreeBSD 14, OpenBSD Innovations, Full Ada programming toolchain NOW on FreeBSD, Compute GPUs can have odd failures under Linux (still), A handy collection of shell aliases from my bash startup, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://rsadowski.de/posts/2025/openbsd-immutable-system-logs/" rel="nofollow">When Root Meets Immutable: OpenBSD chflags vs. Log Tampering</a></p>

<hr>

<p><a href="https://herrbischoff.com/2025/07/how-to-defend-against-aggressive-web-scrapers-with-anubis-on-freebsd-14/" rel="nofollow">How to Defend Against Aggressive Web Scrapers With Anubis on FreeBSD 14</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.openbsd.org/innovations.html" rel="nofollow">OpenBSD Innovations</a></p>

<hr>

<p><a href="https://www.reddit.com/r/freebsd/comments/1m21t7o/ann_full_ada_programming_toolchain_now_on_freebsd/" rel="nofollow">Full Ada programming toolchain NOW on FreeBSD</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ComputeGPUsStillFinicky" rel="nofollow">Compute GPUs can have odd failures under Linux (still)</a></p>

<hr>

<p><a href="https://blog.petdance.com/2020/02/03/handy-collection-of-shell-aliases/" rel="nofollow">A handy collection of shell aliases from my bash startup</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/624/feedback/Efraim%20-%20modernizing.md" rel="nofollow">Efraim - modernizing</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD chflags vs. Log Tampering, How to Defend Against Aggressive Web Scrapers With Anubis on FreeBSD 14, OpenBSD Innovations, Full Ada programming toolchain NOW on FreeBSD, Compute GPUs can have odd failures under Linux (still), A handy collection of shell aliases from my bash startup, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://rsadowski.de/posts/2025/openbsd-immutable-system-logs/" rel="nofollow">When Root Meets Immutable: OpenBSD chflags vs. Log Tampering</a></p>

<hr>

<p><a href="https://herrbischoff.com/2025/07/how-to-defend-against-aggressive-web-scrapers-with-anubis-on-freebsd-14/" rel="nofollow">How to Defend Against Aggressive Web Scrapers With Anubis on FreeBSD 14</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.openbsd.org/innovations.html" rel="nofollow">OpenBSD Innovations</a></p>

<hr>

<p><a href="https://www.reddit.com/r/freebsd/comments/1m21t7o/ann_full_ada_programming_toolchain_now_on_freebsd/" rel="nofollow">Full Ada programming toolchain NOW on FreeBSD</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ComputeGPUsStillFinicky" rel="nofollow">Compute GPUs can have odd failures under Linux (still)</a></p>

<hr>

<p><a href="https://blog.petdance.com/2020/02/03/handy-collection-of-shell-aliases/" rel="nofollow">A handy collection of shell aliases from my bash startup</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/624/feedback/Efraim%20-%20modernizing.md" rel="nofollow">Efraim - modernizing</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>623: Two's interview</title>
  <link>https://www.bsdnow.tv/623</link>
  <guid isPermaLink="false">3d5f1033-4fa2-473f-9e01-8a11cbf7f147</guid>
  <pubDate>Thu, 07 Aug 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3d5f1033-4fa2-473f-9e01-8a11cbf7f147.mp3" length="145169280" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Software Bill of Materials (SBOM) for FreeBSD Project, Your Guide to Lock-In Free Infrastructure, and we interview David Gwynne from the University of Queensland and developer on the OpenBSD project.</itunes:subtitle>
  <itunes:duration>1:00:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Software Bill of Materials (SBOM) for FreeBSD Project, Your Guide to Lock-In Free Infrastructure, and we interview David Gwynne from the University of Queensland and developer on the OpenBSD project.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Software Bill of Materials (SBOM) for FreeBSD Project (https://freebsdfoundation.org/blog/software-bill-of-materials-sbom-for-freebsd-project/)
FreeBSD Summer 2025 Roundup: Your Guide to Lock-In Free Infrastructure (https://klarasystems.com/articles/freebsd-guide-to-lock-in-free-infrastructure)
Interview
David Gwynne from the University of Queensland and developer on the OpenBSD project.
Interview thoughts from Benedict and Jason
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
 Special Guest: David Gwynne.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Software Bill of Materials (SBOM) for FreeBSD Project, Your Guide to Lock-In Free Infrastructure, and we interview David Gwynne from the University of Queensland and developer on the OpenBSD project.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/software-bill-of-materials-sbom-for-freebsd-project/" rel="nofollow">Software Bill of Materials (SBOM) for FreeBSD Project</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/freebsd-guide-to-lock-in-free-infrastructure" rel="nofollow">FreeBSD Summer 2025 Roundup: Your Guide to Lock-In Free Infrastructure</a></p>

<hr>

<h2>Interview</h2>

<ul>
<li>David Gwynne from the University of Queensland and developer on the OpenBSD project.</li>
</ul>

<h2>Interview thoughts from Benedict and Jason</h2>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr><p>Special Guest: David Gwynne.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Software Bill of Materials (SBOM) for FreeBSD Project, Your Guide to Lock-In Free Infrastructure, and we interview David Gwynne from the University of Queensland and developer on the OpenBSD project.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/software-bill-of-materials-sbom-for-freebsd-project/" rel="nofollow">Software Bill of Materials (SBOM) for FreeBSD Project</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/freebsd-guide-to-lock-in-free-infrastructure" rel="nofollow">FreeBSD Summer 2025 Roundup: Your Guide to Lock-In Free Infrastructure</a></p>

<hr>

<h2>Interview</h2>

<ul>
<li>David Gwynne from the University of Queensland and developer on the OpenBSD project.</li>
</ul>

<h2>Interview thoughts from Benedict and Jason</h2>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr><p>Special Guest: David Gwynne.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>622: Interview with Mark Phillips - Technical Marketing Manager at the FreeBSD Foundation </title>
  <link>https://www.bsdnow.tv/622</link>
  <guid isPermaLink="false">ab7c57fb-4b07-45c4-bbba-ea08fd8724d9</guid>
  <pubDate>Thu, 31 Jul 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ab7c57fb-4b07-45c4-bbba-ea08fd8724d9.mp3" length="132422400" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week Benedict interviews Mark Phillips , the Technical Marketing Manager at the FreeBSD Foundation, while they both are at a Hackathon in Germany. </itunes:subtitle>
  <itunes:duration>55:10</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week Benedict interviews Mark Phillips , the Technical Marketing Manager at the FreeBSD Foundation, while they both are at a Hackathon in Germany. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Interview
Mark Phillips - Technical Marketing Manager at the FreeBSD Foundation (https://freebsdfoundation.org/about-us/our-team)
Personal website (https://probably.co.uk/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
 Special Guest: Mark Phillips.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week Benedict interviews Mark Phillips , the Technical Marketing Manager at the FreeBSD Foundation, while they both are at a Hackathon in Germany. </p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interview</h2>

<p>Mark Phillips - <a href="https://freebsdfoundation.org/about-us/our-team" rel="nofollow">Technical Marketing Manager at the FreeBSD Foundation</a></p>

<ul>
<li><a href="https://probably.co.uk/" rel="nofollow">Personal website</a></li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr><p>Special Guest: Mark Phillips.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week Benedict interviews Mark Phillips , the Technical Marketing Manager at the FreeBSD Foundation, while they both are at a Hackathon in Germany. </p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interview</h2>

<p>Mark Phillips - <a href="https://freebsdfoundation.org/about-us/our-team" rel="nofollow">Technical Marketing Manager at the FreeBSD Foundation</a></p>

<ul>
<li><a href="https://probably.co.uk/" rel="nofollow">Personal website</a></li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr><p>Special Guest: Mark Phillips.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>621: Exaggerated Death Report</title>
  <link>https://www.bsdnow.tv/621</link>
  <guid isPermaLink="false">e45aa34d-ee5d-4999-bbc6-5ce609a2db4c</guid>
  <pubDate>Thu, 24 Jul 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e45aa34d-ee5d-4999-bbc6-5ce609a2db4c.mp3" length="120302400" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Designing a Storage Pool, The Report of My Death Was an Exaggeration, Generic BSD installations on ARM64 UEFI, dm_target_crypt_ng - Add next-generation implementation, The X Window System didn't immediately have X terminals, The Book of PF 4th Edition Is Coming Soon, Periodical 20 Localized Computing, and more</itunes:subtitle>
  <itunes:duration>50:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Designing a Storage Pool, The Report of My Death Was an Exaggeration, Generic BSD installations on ARM64 UEFI, dmtargetcrypt_ng - Add next-generation implementation, The X Window System didn't immediately have X terminals, The Book of PF 4th Edition Is Coming Soon, Periodical 20 Localized Computing, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Designing a Storage Pool: RAIDZ, Mirrors, and Hybrid Configurations (https://klarasystems.com/articles/designing-storage-pool-raidz-mirrors-hybrid-configurations/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
The Report of My Death Was an Exaggeration (https://freebsdfoundation.org/blog/the-report-of-my-death-was-an-exaggeration/)
News Roundup
Generic BSD installations on ARM64 UEFI: results and first impressions (https://mekboy.ru/post/bsd-uefi-arm64/)
dmtargetcrypt_ng - Add next-generation implementation (https://gitweb.dragonflybsd.org/dragonfly.git/commit/14e6c73d4c479e4ab26571490758da27da5cbbad)
The X Window System didn't immediately have X terminals (https://utcc.utoronto.ca/~cks/space/blog/unix/XTerminalsNotImmediate)
Yes, The Book of PF, 4th Edition Is Coming Soon (https://bsdly.blogspot.com/2025/07/yes-book-of-pf-4th-edition-is-coming.html)
Periodical 20 — Localized Computing (https://www.chrbutler.com/2024-10-16)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
-Aleksej - RockPro64 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/621/feedback/Aleksej%20-%20RockPro64.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, design, designing, death, Exaggeration, generic installation, arm64 UEFI, dm_target_crypt_ng, next generation, terminals, X Window System, book of pf, fourth edition, Periodical, Localized Computing</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Designing a Storage Pool, The Report of My Death Was an Exaggeration, Generic BSD installations on ARM64 UEFI, dm_target_crypt_ng - Add next-generation implementation, The X Window System didn&#39;t immediately have X terminals, The Book of PF 4th Edition Is Coming Soon, Periodical 20 Localized Computing, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/designing-storage-pool-raidz-mirrors-hybrid-configurations/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Designing a Storage Pool: RAIDZ, Mirrors, and Hybrid Configurations</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/the-report-of-my-death-was-an-exaggeration/" rel="nofollow">The Report of My Death Was an Exaggeration</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://mekboy.ru/post/bsd-uefi-arm64/" rel="nofollow">Generic BSD installations on ARM64 UEFI: results and first impressions</a></p>

<hr>

<p><a href="https://gitweb.dragonflybsd.org/dragonfly.git/commit/14e6c73d4c479e4ab26571490758da27da5cbbad" rel="nofollow">dm_target_crypt_ng - Add next-generation implementation</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/XTerminalsNotImmediate" rel="nofollow">The X Window System didn&#39;t immediately have X terminals</a></p>

<hr>

<p><a href="https://bsdly.blogspot.com/2025/07/yes-book-of-pf-4th-edition-is-coming.html" rel="nofollow">Yes, The Book of PF, 4th Edition Is Coming Soon</a></p>

<hr>

<p><a href="https://www.chrbutler.com/2024-10-16" rel="nofollow">Periodical 20 — Localized Computing</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>-<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/621/feedback/Aleksej%20-%20RockPro64.md" rel="nofollow">Aleksej - RockPro64</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Designing a Storage Pool, The Report of My Death Was an Exaggeration, Generic BSD installations on ARM64 UEFI, dm_target_crypt_ng - Add next-generation implementation, The X Window System didn&#39;t immediately have X terminals, The Book of PF 4th Edition Is Coming Soon, Periodical 20 Localized Computing, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/designing-storage-pool-raidz-mirrors-hybrid-configurations/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Designing a Storage Pool: RAIDZ, Mirrors, and Hybrid Configurations</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/the-report-of-my-death-was-an-exaggeration/" rel="nofollow">The Report of My Death Was an Exaggeration</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://mekboy.ru/post/bsd-uefi-arm64/" rel="nofollow">Generic BSD installations on ARM64 UEFI: results and first impressions</a></p>

<hr>

<p><a href="https://gitweb.dragonflybsd.org/dragonfly.git/commit/14e6c73d4c479e4ab26571490758da27da5cbbad" rel="nofollow">dm_target_crypt_ng - Add next-generation implementation</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/XTerminalsNotImmediate" rel="nofollow">The X Window System didn&#39;t immediately have X terminals</a></p>

<hr>

<p><a href="https://bsdly.blogspot.com/2025/07/yes-book-of-pf-4th-edition-is-coming.html" rel="nofollow">Yes, The Book of PF, 4th Edition Is Coming Soon</a></p>

<hr>

<p><a href="https://www.chrbutler.com/2024-10-16" rel="nofollow">Periodical 20 — Localized Computing</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>-<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/621/feedback/Aleksej%20-%20RockPro64.md" rel="nofollow">Aleksej - RockPro64</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>620: Postmortem for jemalloc</title>
  <link>https://www.bsdnow.tv/620</link>
  <guid isPermaLink="false">5750c48e-f7ce-4af7-a722-55d35ebd2366</guid>
  <pubDate>Thu, 17 Jul 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5750c48e-f7ce-4af7-a722-55d35ebd2366.mp3" length="129342720" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Server That Wasn't Meant to Exist, ZFS Performance Tuning – Optimizing for your Workload, what would a multi-user web server look like, That Grumpy BSD Guy: A Short Reading List, rsync's defaults are not always enough, jemalloc Postmortem, and more</itunes:subtitle>
  <itunes:duration>53:53</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Server That Wasn't Meant to Exist, ZFS Performance Tuning – Optimizing for your Workload, what would a multi-user web server look like, That Grumpy BSD Guy: A Short Reading List, rsync's defaults are not always enough, jemalloc Postmortem, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The Server That Wasn't Meant to Exist (https://it-notes.dragas.net/2025/05/13/the_server_that_wasnt_meant_to_exist/)
ZFS Performance Tuning – Optimizing for your Workload (https://klarasystems.com/articles/zfs-performance-tuning-optimizing-for-your-workload/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
What would a multi-user web server look like? (A thought experiment) (https://utcc.utoronto.ca/~cks/space/blog/web/MultiUserWebServerWildIdea)
That Grumpy BSD Guy: A Short Reading List (https://bsdly.blogspot.com/2025/05/that-grumpy-bsd-guy-short-reading-list.html)
rsync's defaults are not always enough (https://rachelbythebay.com/w/2025/05/31/sync/)
jemalloc Postmortem (https://jasone.github.io/2025/06/12/jemalloc-postmortem/)
Beastie Bits
IPv6 and proxying on DragonFly (https://www.dragonflydigest.com/2025/06/25/ipv6-and-proxying-on-dragonfly/)
BoxyBSD (https://boxybsd.com)
Sysctltui (https://alfonsosiciliano.gitlab.io/posts/2025-05-29-sysctltui.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, Performance, tuning, optimizing, workload, multi-user web server, reading list, rsync, jemalloc, Postmortem</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Server That Wasn&#39;t Meant to Exist, ZFS Performance Tuning – Optimizing for your Workload, what would a multi-user web server look like, That Grumpy BSD Guy: A Short Reading List, rsync&#39;s defaults are not always enough, jemalloc Postmortem, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<hr>

<p><a href="https://it-notes.dragas.net/2025/05/13/the_server_that_wasnt_meant_to_exist/" rel="nofollow">The Server That Wasn&#39;t Meant to Exist</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-performance-tuning-optimizing-for-your-workload/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS Performance Tuning – Optimizing for your Workload</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/web/MultiUserWebServerWildIdea" rel="nofollow">What would a multi-user web server look like? (A thought experiment)</a></p>

<hr>

<p><a href="https://bsdly.blogspot.com/2025/05/that-grumpy-bsd-guy-short-reading-list.html" rel="nofollow">That Grumpy BSD Guy: A Short Reading List</a></p>

<hr>

<p><a href="https://rachelbythebay.com/w/2025/05/31/sync/" rel="nofollow">rsync&#39;s defaults are not always enough</a></p>

<hr>

<p><a href="https://jasone.github.io/2025/06/12/jemalloc-postmortem/" rel="nofollow">jemalloc Postmortem</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2025/06/25/ipv6-and-proxying-on-dragonfly/" rel="nofollow">IPv6 and proxying on DragonFly</a></li>
<li><a href="https://boxybsd.com" rel="nofollow">BoxyBSD</a></li>
<li><a href="https://alfonsosiciliano.gitlab.io/posts/2025-05-29-sysctltui.html" rel="nofollow">Sysctltui</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Server That Wasn&#39;t Meant to Exist, ZFS Performance Tuning – Optimizing for your Workload, what would a multi-user web server look like, That Grumpy BSD Guy: A Short Reading List, rsync&#39;s defaults are not always enough, jemalloc Postmortem, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<hr>

<p><a href="https://it-notes.dragas.net/2025/05/13/the_server_that_wasnt_meant_to_exist/" rel="nofollow">The Server That Wasn&#39;t Meant to Exist</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-performance-tuning-optimizing-for-your-workload/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS Performance Tuning – Optimizing for your Workload</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/web/MultiUserWebServerWildIdea" rel="nofollow">What would a multi-user web server look like? (A thought experiment)</a></p>

<hr>

<p><a href="https://bsdly.blogspot.com/2025/05/that-grumpy-bsd-guy-short-reading-list.html" rel="nofollow">That Grumpy BSD Guy: A Short Reading List</a></p>

<hr>

<p><a href="https://rachelbythebay.com/w/2025/05/31/sync/" rel="nofollow">rsync&#39;s defaults are not always enough</a></p>

<hr>

<p><a href="https://jasone.github.io/2025/06/12/jemalloc-postmortem/" rel="nofollow">jemalloc Postmortem</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2025/06/25/ipv6-and-proxying-on-dragonfly/" rel="nofollow">IPv6 and proxying on DragonFly</a></li>
<li><a href="https://boxybsd.com" rel="nofollow">BoxyBSD</a></li>
<li><a href="https://alfonsosiciliano.gitlab.io/posts/2025-05-29-sysctltui.html" rel="nofollow">Sysctltui</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>619: Happy Tooling</title>
  <link>https://www.bsdnow.tv/619</link>
  <guid isPermaLink="false">666d7cce-94c7-48bb-97b8-067a21892442</guid>
  <pubDate>Thu, 10 Jul 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/666d7cce-94c7-48bb-97b8-067a21892442.mp3" length="110312640" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Disaster Recovery with ZFS: A Practical Guide, The best interfaces we never built, Choose Tools That Make You Happy, open source has turned into two worlds, TrueNAS CORE is Dead – Long Live zVault, You should start a computer club in the place that you live, and more</itunes:subtitle>
  <itunes:duration>45:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Disaster Recovery with ZFS: A Practical Guide, The best interfaces we never built, Choose Tools That Make You Happy, open source has turned into two worlds, TrueNAS CORE is Dead – Long Live zVault, You should start a computer club in the place that you live, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Disaster Recovery with ZFS: A Practical Guide (https://klarasystems.com/articles/disaster-recovery-with-zfs-practical-guide/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
The best interfaces we never built (https://www.chrbutler.com/the-best-interfaces-we-never-built)
News Roundup
You Can Choose Tools That Make You Happy (https://borretti.me/article/you-can-choose-tools-that-make-you-happy)
I feel open source has turned into two worlds (https://utcc.utoronto.ca/~cks/space/blog/tech/OpenSourceTwoWorlds)
UPDATE 2 – TrueNAS CORE is Dead – Long Live zVault (https://vermaden.wordpress.com/2024/04/20/truenas-core-versus-truenas-scale/#truenas-core-dead-long-live-zvault)
You should start a computer club in the place that you live (https://startacomputer.club)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - syslogng issue (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/618/feedback/Brad%20-%20syslogng%20issue.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, Disaster recovery, interface, tools, happy, two worlds, zvault, computer club</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Disaster Recovery with ZFS: A Practical Guide, The best interfaces we never built, Choose Tools That Make You Happy, open source has turned into two worlds, TrueNAS CORE is Dead – Long Live zVault, You should start a computer club in the place that you live, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/disaster-recovery-with-zfs-practical-guide/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Disaster Recovery with ZFS: A Practical Guide</a></p>

<hr>

<p><a href="https://www.chrbutler.com/the-best-interfaces-we-never-built" rel="nofollow">The best interfaces we never built</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://borretti.me/article/you-can-choose-tools-that-make-you-happy" rel="nofollow">You Can Choose Tools That Make You Happy</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/OpenSourceTwoWorlds" rel="nofollow">I feel open source has turned into two worlds</a></p>

<hr>

<p><a href="https://vermaden.wordpress.com/2024/04/20/truenas-core-versus-truenas-scale/#truenas-core-dead-long-live-zvault" rel="nofollow">UPDATE 2 – TrueNAS CORE is Dead – Long Live zVault</a></p>

<hr>

<p><a href="https://startacomputer.club" rel="nofollow">You should start a computer club in the place that you live</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/618/feedback/Brad%20-%20syslogng%20issue.md" rel="nofollow">Brad - syslogng issue</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Disaster Recovery with ZFS: A Practical Guide, The best interfaces we never built, Choose Tools That Make You Happy, open source has turned into two worlds, TrueNAS CORE is Dead – Long Live zVault, You should start a computer club in the place that you live, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/disaster-recovery-with-zfs-practical-guide/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Disaster Recovery with ZFS: A Practical Guide</a></p>

<hr>

<p><a href="https://www.chrbutler.com/the-best-interfaces-we-never-built" rel="nofollow">The best interfaces we never built</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://borretti.me/article/you-can-choose-tools-that-make-you-happy" rel="nofollow">You Can Choose Tools That Make You Happy</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/OpenSourceTwoWorlds" rel="nofollow">I feel open source has turned into two worlds</a></p>

<hr>

<p><a href="https://vermaden.wordpress.com/2024/04/20/truenas-core-versus-truenas-scale/#truenas-core-dead-long-live-zvault" rel="nofollow">UPDATE 2 – TrueNAS CORE is Dead – Long Live zVault</a></p>

<hr>

<p><a href="https://startacomputer.club" rel="nofollow">You should start a computer club in the place that you live</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/618/feedback/Brad%20-%20syslogng%20issue.md" rel="nofollow">Brad - syslogng issue</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>618: Funding BSD projects</title>
  <link>https://www.bsdnow.tv/618</link>
  <guid isPermaLink="false">4f1ff264-7f3d-4a92-8972-310e7fb9c640</guid>
  <pubDate>Thu, 03 Jul 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4f1ff264-7f3d-4a92-8972-310e7fb9c640.mp3" length="129594240" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A year of funded FreeBSD, ZFS Performance Tuning – Optimizing for your Workload, Three Ways to Try FreeBSD in Under Five Minutes, FFS optimizations with dirhash, j2k25 hackathon report from kn@, NetBSD welcomes Google Summer of Code contributors, and more</itunes:subtitle>
  <itunes:duration>53:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A year of funded FreeBSD, ZFS Performance Tuning – Optimizing for your Workload, Three Ways to Try FreeBSD in Under Five Minutes, FFS optimizations with dirhash, j2k25 hackathon report from kn@, NetBSD welcomes Google Summer of Code contributors, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
A year of funded FreeBSD (https://www.daemonology.net/blog/2025-06-06-A-year-of-funded-FreeBSD.html)
ZFS Performance Tuning – Optimizing for your Workload (https://klarasystems.com/articles/zfs-performance-tuning-optimizing-for-your-workload/)
News Roundup
Three Ways to Try FreeBSD in Under Five Minutes (https://freebsdfoundation.org/blog/three-ways-to-try-freebsd-in-under-five-minutes/)
FFS optimizations with dirhash (https://rsadowski.de/posts/2025/ffs-optimizations-dirhash/)
j2k25 hackathon report from kn@: installer, low battery, and more (https://undeadly.org/cgi?action=article;sid=20250616082212)
NetBSD welcomes Google Summer of Code contributors (https://blog.netbsd.org/tnf/entry/gsoc2025_welcome_contributors)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, funding, performance, tuning, optimizing workload, trying freebsd, ffs optimizations, dirhash, hackathon report, installer, battery, summer of code, contributors, contributions, projects</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A year of funded FreeBSD, ZFS Performance Tuning – Optimizing for your Workload, Three Ways to Try FreeBSD in Under Five Minutes, FFS optimizations with dirhash, j2k25 hackathon report from kn@, NetBSD welcomes Google Summer of Code contributors, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.daemonology.net/blog/2025-06-06-A-year-of-funded-FreeBSD.html" rel="nofollow">A year of funded FreeBSD</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-performance-tuning-optimizing-for-your-workload/" rel="nofollow">ZFS Performance Tuning – Optimizing for your Workload</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://freebsdfoundation.org/blog/three-ways-to-try-freebsd-in-under-five-minutes/" rel="nofollow">Three Ways to Try FreeBSD in Under Five Minutes</a></p>

<hr>

<p><a href="https://rsadowski.de/posts/2025/ffs-optimizations-dirhash/" rel="nofollow">FFS optimizations with dirhash</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20250616082212" rel="nofollow">j2k25 hackathon report from kn@: installer, low battery, and more</a></p>

<hr>

<p><a href="https://blog.netbsd.org/tnf/entry/gsoc2025_welcome_contributors" rel="nofollow">NetBSD welcomes Google Summer of Code contributors</a></p>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A year of funded FreeBSD, ZFS Performance Tuning – Optimizing for your Workload, Three Ways to Try FreeBSD in Under Five Minutes, FFS optimizations with dirhash, j2k25 hackathon report from kn@, NetBSD welcomes Google Summer of Code contributors, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.daemonology.net/blog/2025-06-06-A-year-of-funded-FreeBSD.html" rel="nofollow">A year of funded FreeBSD</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-performance-tuning-optimizing-for-your-workload/" rel="nofollow">ZFS Performance Tuning – Optimizing for your Workload</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://freebsdfoundation.org/blog/three-ways-to-try-freebsd-in-under-five-minutes/" rel="nofollow">Three Ways to Try FreeBSD in Under Five Minutes</a></p>

<hr>

<p><a href="https://rsadowski.de/posts/2025/ffs-optimizations-dirhash/" rel="nofollow">FFS optimizations with dirhash</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20250616082212" rel="nofollow">j2k25 hackathon report from kn@: installer, low battery, and more</a></p>

<hr>

<p><a href="https://blog.netbsd.org/tnf/entry/gsoc2025_welcome_contributors" rel="nofollow">NetBSD welcomes Google Summer of Code contributors</a></p>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>617: FreeBSD 14.3</title>
  <link>https://www.bsdnow.tv/617</link>
  <guid isPermaLink="false">3a420df4-8a63-484a-bb55-180f9cabd36f</guid>
  <pubDate>Thu, 26 Jun 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3a420df4-8a63-484a-bb55-180f9cabd36f.mp3" length="153288960" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD version 14.3 is available, Reliable ZFS Storage on Commodity Hardware, My website is ugly because I made it, Semi distributed filesystems with ZFS and Sanoid, April 2025 Laptop Support and Usability Project Update, UDP sockets instead of BPF in dhcpd(8), and more</itunes:subtitle>
  <itunes:duration>1:03:52</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD version 14.3 is available, Reliable ZFS Storage on Commodity Hardware, My website is ugly because I made it, Semi distributed filesystems with ZFS and Sanoid, April 2025 Laptop Support and Usability Project Update, UDP sockets instead of BPF in dhcpd(8), and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD 14.3 released (https://www.freebsd.org/releases/14.3R/announce/)
Reliable ZFS Storage on Commodity Hardware (https://klarasystems.com/articles/cost-efficient-storage-commodity-hardware/)
News Roundup
My website is ugly because I made it (https://goodinternetmagazine.com/my-website-is-ugly-because-i-made-it/)
Semi distributed filesystems with ZFS and Sanoid (https://anil.recoil.org/notes/syncoid-sanoid-zfs)
April 2025 Laptop Support and Usability Project Update (https://freebsdfoundation.org/blog/april-2025-laptop-support-and-usability-project-update/)
dhcpd(8): use UDP sockets instead of BPF (https://undeadly.org/cgi?action=article;sid=20250613111800)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
No feedback this week. Send more...
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, 14.3, reliable storage, Commodity Hardware, ugly website, semi distributed filesystem, sanoid, laptop support, Usability project, report, udp sockets, bpd, dhcpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD version 14.3 is available, Reliable ZFS Storage on Commodity Hardware, My website is ugly because I made it, Semi distributed filesystems with ZFS and Sanoid, April 2025 Laptop Support and Usability Project Update, UDP sockets instead of BPF in dhcpd(8), and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.freebsd.org/releases/14.3R/announce/" rel="nofollow">FreeBSD 14.3 released</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/cost-efficient-storage-commodity-hardware/" rel="nofollow">Reliable ZFS Storage on Commodity Hardware</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://goodinternetmagazine.com/my-website-is-ugly-because-i-made-it/" rel="nofollow">My website is ugly because I made it</a></p>

<hr>

<p><a href="https://anil.recoil.org/notes/syncoid-sanoid-zfs" rel="nofollow">Semi distributed filesystems with ZFS and Sanoid</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/april-2025-laptop-support-and-usability-project-update/" rel="nofollow">April 2025 Laptop Support and Usability Project Update</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20250613111800" rel="nofollow">dhcpd(8): use UDP sockets instead of BPF</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>No feedback this week. Send more...</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD version 14.3 is available, Reliable ZFS Storage on Commodity Hardware, My website is ugly because I made it, Semi distributed filesystems with ZFS and Sanoid, April 2025 Laptop Support and Usability Project Update, UDP sockets instead of BPF in dhcpd(8), and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.freebsd.org/releases/14.3R/announce/" rel="nofollow">FreeBSD 14.3 released</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/cost-efficient-storage-commodity-hardware/" rel="nofollow">Reliable ZFS Storage on Commodity Hardware</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://goodinternetmagazine.com/my-website-is-ugly-because-i-made-it/" rel="nofollow">My website is ugly because I made it</a></p>

<hr>

<p><a href="https://anil.recoil.org/notes/syncoid-sanoid-zfs" rel="nofollow">Semi distributed filesystems with ZFS and Sanoid</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/april-2025-laptop-support-and-usability-project-update/" rel="nofollow">April 2025 Laptop Support and Usability Project Update</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20250613111800" rel="nofollow">dhcpd(8): use UDP sockets instead of BPF</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>No feedback this week. Send more...</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>615: Wifi Brakes Unlocked</title>
  <link>https://www.bsdnow.tv/615</link>
  <guid isPermaLink="false">ccd118f7-9bad-4c9c-8389-c7a992b81f86</guid>
  <pubDate>Thu, 12 Jun 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ccd118f7-9bad-4c9c-8389-c7a992b81f86.mp3" length="42283008" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>How to unlock high speed Wi-Fi on FreeBSD 14, What We’ve Learned Supporting FreeBSD in Production, rsync replaced with openrsync on macOS Sequoia, Framework 13 AMD Setup with FreeBSD, FreeBSD on Dell Latitude 7280, Backup MX with OpenSMTPD, Notes on caddy as QUIC reverse proxy with mac_portacl, and more</itunes:subtitle>
  <itunes:duration>44:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>How to unlock high speed Wi-Fi on FreeBSD 14, What We’ve Learned Supporting FreeBSD in Production, rsync replaced with openrsync on macOS Sequoia, Framework 13 AMD Setup with FreeBSD, FreeBSD on Dell Latitude 7280, Backup MX with OpenSMTPD, Notes on caddy as QUIC reverse proxy with mac_portacl, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
How to unlock high speed Wi-Fi on FreeBSD
14 (https://freebsdfoundation.org/blog/how-to-unlock-high-speed-wi-fi-on-freebsd-14/)
What We’ve Learned Supporting FreeBSD in Production (https://klarasystems.com/articles/what-weve-learned-supporing-freebsd-production/)
News Roundup
rsync replaced with openrsync on macOS Sequoia (https://derflounder.wordpress.com/2025/04/06/rsync-replaced-with-openrsync-on-macos-sequoia/)
Framework 13 AMD Setup with FreeBSD (https://euroquis.nl/freebsd/2025/03/16/framework.html)
FreeBSD on Dell Latitude 7280 (https://adventurist.me/posts/00352)
Backup MX with OpenSMTPD (https://blog.feld.me/posts/2025/05/backup-mx-with-opensmtpd/)
Notes on caddy as QUIC reverse proxy with mac_portacl (https://mwl.io/archives/24097)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
No feedback this week.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, high speed wifi, wireless, networking, support, supporting, production use, rsync, openrsync, macOS Sequoia, framework 13, Dell Latitude 7280, OpenSMTPD, caddy, quic, reverse proxy, mac_portacl</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>How to unlock high speed Wi-Fi on FreeBSD 14, What We’ve Learned Supporting FreeBSD in Production, rsync replaced with openrsync on macOS Sequoia, Framework 13 AMD Setup with FreeBSD, FreeBSD on Dell Latitude 7280, Backup MX with OpenSMTPD, Notes on caddy as QUIC reverse proxy with mac_portacl, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/how-to-unlock-high-speed-wi-fi-on-freebsd-14/" rel="nofollow">How to unlock high speed Wi-Fi on FreeBSD<br>
14</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/what-weve-learned-supporing-freebsd-production/" rel="nofollow">What We’ve Learned Supporting FreeBSD in Production</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://derflounder.wordpress.com/2025/04/06/rsync-replaced-with-openrsync-on-macos-sequoia/" rel="nofollow">rsync replaced with openrsync on macOS Sequoia</a></p>

<hr>

<p><a href="https://euroquis.nl/freebsd/2025/03/16/framework.html" rel="nofollow">Framework 13 AMD Setup with FreeBSD</a></p>

<hr>

<p><a href="https://adventurist.me/posts/00352" rel="nofollow">FreeBSD on Dell Latitude 7280</a></p>

<hr>

<p><a href="https://blog.feld.me/posts/2025/05/backup-mx-with-opensmtpd/" rel="nofollow">Backup MX with OpenSMTPD</a></p>

<hr>

<p><a href="https://mwl.io/archives/24097" rel="nofollow">Notes on caddy as QUIC reverse proxy with mac_portacl</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>No feedback this week.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>How to unlock high speed Wi-Fi on FreeBSD 14, What We’ve Learned Supporting FreeBSD in Production, rsync replaced with openrsync on macOS Sequoia, Framework 13 AMD Setup with FreeBSD, FreeBSD on Dell Latitude 7280, Backup MX with OpenSMTPD, Notes on caddy as QUIC reverse proxy with mac_portacl, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/how-to-unlock-high-speed-wi-fi-on-freebsd-14/" rel="nofollow">How to unlock high speed Wi-Fi on FreeBSD<br>
14</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/what-weve-learned-supporing-freebsd-production/" rel="nofollow">What We’ve Learned Supporting FreeBSD in Production</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://derflounder.wordpress.com/2025/04/06/rsync-replaced-with-openrsync-on-macos-sequoia/" rel="nofollow">rsync replaced with openrsync on macOS Sequoia</a></p>

<hr>

<p><a href="https://euroquis.nl/freebsd/2025/03/16/framework.html" rel="nofollow">Framework 13 AMD Setup with FreeBSD</a></p>

<hr>

<p><a href="https://adventurist.me/posts/00352" rel="nofollow">FreeBSD on Dell Latitude 7280</a></p>

<hr>

<p><a href="https://blog.feld.me/posts/2025/05/backup-mx-with-opensmtpd/" rel="nofollow">Backup MX with OpenSMTPD</a></p>

<hr>

<p><a href="https://mwl.io/archives/24097" rel="nofollow">Notes on caddy as QUIC reverse proxy with mac_portacl</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>No feedback this week.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>614: Upstream Contributions Matter</title>
  <link>https://www.bsdnow.tv/614</link>
  <guid isPermaLink="false">6d579b5c-33f7-4a12-adcb-0db2f77ea9a3</guid>
  <pubDate>Thu, 05 Jun 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6d579b5c-33f7-4a12-adcb-0db2f77ea9a3.mp3" length="61354368" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Hidden Costs of Stagnation: Why Running EOL Software is a Ticking Time Bomb, Maintaining FreeBSD in a Commercial Product – Why Upstream Contributions Matter, LLMs ('AI') are coming for our jobs whether or not they work, Implement Anubis to give the bots a harder time, erspan(4): ERSPAN Type II collection, Just my memory here is how I've configure OpenBSD and FreeBSD for a IPv6 Wifi, and more</itunes:subtitle>
  <itunes:duration>1:03:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Hidden Costs of Stagnation: Why Running EOL Software is a Ticking Time Bomb, Maintaining FreeBSD in a Commercial Product – Why Upstream Contributions Matter, LLMs ('AI') are coming for our jobs whether or not they work, Implement Anubis to give the bots a harder time, erspan(4): ERSPAN Type II collection, Just my memory here is how I've configure OpenBSD and FreeBSD for a IPv6 Wifi, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The Hidden Costs of Stagnation: Why Running EOL Software is a Ticking Time Bomb (https://freebsdfoundation.org/blog/the-hidden-costs-of-stagnation-why-running-eol-software-is-a-ticking-time-bomb/)
Maintaining FreeBSD in a Commercial Product – Why Upstream Contributions
Matter (https://klarasystems.com/articles/maintaining-freebsd-commercial-product-why-upstream-contributions-matter/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
LLMs ('AI') are coming for our jobs whether or not they work (https://utcc.utoronto.ca/~cks/space/blog/tech/LLMsVersusOurJobs)
Implement Anubis to give the bots a harder time (https://dan.langille.org/2025/05/03/implement-anubis-to-give-the-bots-a-harder-time/)
erspan(4): ERSPAN Type II collection (https://www.undeadly.org/cgi?action=article;sid=20250512100219)
Just my memory here is how I've configure OpenBSD and FreeBSD for a IPv6 Wifi (https://vincentdelft.be/post/post_20250208)
Beastie Bits
Some Interesting pieces of history
Netnews History (https://www.cs.columbia.edu/~smb/papers/netnews-hist.pdf)
History of Solaris (https://cse.unl.edu/~witty/class/csce351/howto/history_of_solaris.pdf)
Nuclear Wall Charts (https://econtent.unm.edu/digital/collection/nuceng/search)
[TUHS] The Case of UNIX vs. The UNIX System (https://www.tuhs.org/pipermail/tuhs/2025-February/031403.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Paul - my setup (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/614/feedback/Paul%20-%20my%20setup.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, hidden costs, stagnation, time bomb, commercial product, contributions matter, upstream, llm, jobs, anubis, bots, bot protection, erspan, collection, configuration, ipv6 wifi</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Hidden Costs of Stagnation: Why Running EOL Software is a Ticking Time Bomb, Maintaining FreeBSD in a Commercial Product – Why Upstream Contributions Matter, LLMs (&#39;AI&#39;) are coming for our jobs whether or not they work, Implement Anubis to give the bots a harder time, erspan(4): ERSPAN Type II collection, Just my memory here is how I&#39;ve configure OpenBSD and FreeBSD for a IPv6 Wifi, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/the-hidden-costs-of-stagnation-why-running-eol-software-is-a-ticking-time-bomb/" rel="nofollow">The Hidden Costs of Stagnation: Why Running EOL Software is a Ticking Time Bomb</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/maintaining-freebsd-commercial-product-why-upstream-contributions-matter/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Maintaining FreeBSD in a Commercial Product – Why Upstream Contributions<br>
Matter</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/LLMsVersusOurJobs" rel="nofollow">LLMs (&#39;AI&#39;) are coming for our jobs whether or not they work</a></p>

<hr>

<p><a href="https://dan.langille.org/2025/05/03/implement-anubis-to-give-the-bots-a-harder-time/" rel="nofollow">Implement Anubis to give the bots a harder time</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20250512100219" rel="nofollow">erspan(4): ERSPAN Type II collection</a></p>

<hr>

<p><a href="https://vincentdelft.be/post/post_20250208" rel="nofollow">Just my memory here is how I&#39;ve configure OpenBSD and FreeBSD for a IPv6 Wifi</a></p>

<hr>

<h2>Beastie Bits</h2>

<p>Some Interesting pieces of history</p>

<ul>
<li><a href="https://www.cs.columbia.edu/%7Esmb/papers/netnews-hist.pdf" rel="nofollow">Netnews History</a></li>
<li><a href="https://cse.unl.edu/%7Ewitty/class/csce351/howto/history_of_solaris.pdf" rel="nofollow">History of Solaris</a></li>
<li><a href="https://econtent.unm.edu/digital/collection/nuceng/search" rel="nofollow">Nuclear Wall Charts</a></li>
<li><a href="https://www.tuhs.org/pipermail/tuhs/2025-February/031403.html" rel="nofollow">[TUHS] The Case of UNIX vs. The UNIX System</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/614/feedback/Paul%20-%20my%20setup.md" rel="nofollow">Paul - my setup</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Hidden Costs of Stagnation: Why Running EOL Software is a Ticking Time Bomb, Maintaining FreeBSD in a Commercial Product – Why Upstream Contributions Matter, LLMs (&#39;AI&#39;) are coming for our jobs whether or not they work, Implement Anubis to give the bots a harder time, erspan(4): ERSPAN Type II collection, Just my memory here is how I&#39;ve configure OpenBSD and FreeBSD for a IPv6 Wifi, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/the-hidden-costs-of-stagnation-why-running-eol-software-is-a-ticking-time-bomb/" rel="nofollow">The Hidden Costs of Stagnation: Why Running EOL Software is a Ticking Time Bomb</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/maintaining-freebsd-commercial-product-why-upstream-contributions-matter/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Maintaining FreeBSD in a Commercial Product – Why Upstream Contributions<br>
Matter</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/LLMsVersusOurJobs" rel="nofollow">LLMs (&#39;AI&#39;) are coming for our jobs whether or not they work</a></p>

<hr>

<p><a href="https://dan.langille.org/2025/05/03/implement-anubis-to-give-the-bots-a-harder-time/" rel="nofollow">Implement Anubis to give the bots a harder time</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20250512100219" rel="nofollow">erspan(4): ERSPAN Type II collection</a></p>

<hr>

<p><a href="https://vincentdelft.be/post/post_20250208" rel="nofollow">Just my memory here is how I&#39;ve configure OpenBSD and FreeBSD for a IPv6 Wifi</a></p>

<hr>

<h2>Beastie Bits</h2>

<p>Some Interesting pieces of history</p>

<ul>
<li><a href="https://www.cs.columbia.edu/%7Esmb/papers/netnews-hist.pdf" rel="nofollow">Netnews History</a></li>
<li><a href="https://cse.unl.edu/%7Ewitty/class/csce351/howto/history_of_solaris.pdf" rel="nofollow">History of Solaris</a></li>
<li><a href="https://econtent.unm.edu/digital/collection/nuceng/search" rel="nofollow">Nuclear Wall Charts</a></li>
<li><a href="https://www.tuhs.org/pipermail/tuhs/2025-February/031403.html" rel="nofollow">[TUHS] The Case of UNIX vs. The UNIX System</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/614/feedback/Paul%20-%20my%20setup.md" rel="nofollow">Paul - my setup</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>613: DragonflyBSD 6.4.2</title>
  <link>https://www.bsdnow.tv/613</link>
  <guid isPermaLink="false">efcbb139-39d9-4ae5-a0ab-8f1166709787</guid>
  <pubDate>Thu, 29 May 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/efcbb139-39d9-4ae5-a0ab-8f1166709787.mp3" length="51264768" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Isolating Containers with ZFS and Linux Namespaces, DragonFly BSD 6.4.2, FreeBSD fans rally round zVault upstart, For Upcoming PF Tutorials, We Welcome Your Questions, Using ~/.ssh/authorized keys to decide what the incoming connection can do, PDF bruteforce tool to recover locked files, How and why typical (SaaS) pricing is too high for university departments, and more</itunes:subtitle>
  <itunes:duration>53:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Isolating Containers with ZFS and Linux Namespaces, DragonFly BSD 6.4.2, FreeBSD fans rally round zVault upstart, For Upcoming PF Tutorials, We Welcome Your Questions, Using ~/.ssh/authorized keys to decide what the incoming connection can do, PDF bruteforce tool to recover locked files, How and why typical (SaaS) pricing is too high for university departments, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Isolating Containers with ZFS and Linux Namespaces (https://klarasystems.com/articles/isolating-containers-with-zfs-and-linux-namespaces/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
DragonFly BSD 6.4.2 (https://www.dragonflybsd.org/release64/)
FreeBSD fans rally round zVault upstart (https://www.theregister.com/2025/05/12/second_preview_zvault/)
News Roundup
For Upcoming PF Tutorials, We Welcome Your Questions (https://bsdly.blogspot.com/2025/05/for-upcoming-pf-tutorials-we-welcome.html)
Using ~/.ssh/authorized keys to decide what the incoming connection can do (https://dan.langille.org/2025/04/17/using-ssh-authorized-keys-to-decide-what-the-incoming-connection-can-do/)
PDF bruteforce tool to recover locked files (https://dataswamp.org/~solene/2025-03-09-test-pdf-passwords.html)
How and why typical (SaaS) pricing is too high for university departments (https://utcc.utoronto.ca/~cks/space/blog/tech/UniversityTypicalPricingTooHigh)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Nils - CFP (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/612/feedback/nils%20-%20CFP.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, isolation, containers, namespaces, 6.4.2, zvault, pf tutorial, authorized_keys, bruteforce, pdf, revocer, recovery, saas, pricing, university</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Isolating Containers with ZFS and Linux Namespaces, DragonFly BSD 6.4.2, FreeBSD fans rally round zVault upstart, For Upcoming PF Tutorials, We Welcome Your Questions, Using ~/.ssh/authorized keys to decide what the incoming connection can do, PDF bruteforce tool to recover locked files, How and why typical (SaaS) pricing is too high for university departments, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/isolating-containers-with-zfs-and-linux-namespaces/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Isolating Containers with ZFS and Linux Namespaces</a></p>

<hr>

<p><a href="https://www.dragonflybsd.org/release64/" rel="nofollow">DragonFly BSD 6.4.2</a></p>

<hr>

<p><a href="https://www.theregister.com/2025/05/12/second_preview_zvault/" rel="nofollow">FreeBSD fans rally round zVault upstart</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://bsdly.blogspot.com/2025/05/for-upcoming-pf-tutorials-we-welcome.html" rel="nofollow">For Upcoming PF Tutorials, We Welcome Your Questions</a></p>

<hr>

<p><a href="https://dan.langille.org/2025/04/17/using-ssh-authorized-keys-to-decide-what-the-incoming-connection-can-do/" rel="nofollow">Using ~/.ssh/authorized keys to decide what the incoming connection can do</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2025-03-09-test-pdf-passwords.html" rel="nofollow">PDF bruteforce tool to recover locked files</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/UniversityTypicalPricingTooHigh" rel="nofollow">How and why typical (SaaS) pricing is too high for university departments</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/612/feedback/nils%20-%20CFP.md" rel="nofollow">Nils - CFP</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Isolating Containers with ZFS and Linux Namespaces, DragonFly BSD 6.4.2, FreeBSD fans rally round zVault upstart, For Upcoming PF Tutorials, We Welcome Your Questions, Using ~/.ssh/authorized keys to decide what the incoming connection can do, PDF bruteforce tool to recover locked files, How and why typical (SaaS) pricing is too high for university departments, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/isolating-containers-with-zfs-and-linux-namespaces/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Isolating Containers with ZFS and Linux Namespaces</a></p>

<hr>

<p><a href="https://www.dragonflybsd.org/release64/" rel="nofollow">DragonFly BSD 6.4.2</a></p>

<hr>

<p><a href="https://www.theregister.com/2025/05/12/second_preview_zvault/" rel="nofollow">FreeBSD fans rally round zVault upstart</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://bsdly.blogspot.com/2025/05/for-upcoming-pf-tutorials-we-welcome.html" rel="nofollow">For Upcoming PF Tutorials, We Welcome Your Questions</a></p>

<hr>

<p><a href="https://dan.langille.org/2025/04/17/using-ssh-authorized-keys-to-decide-what-the-incoming-connection-can-do/" rel="nofollow">Using ~/.ssh/authorized keys to decide what the incoming connection can do</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2025-03-09-test-pdf-passwords.html" rel="nofollow">PDF bruteforce tool to recover locked files</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/UniversityTypicalPricingTooHigh" rel="nofollow">How and why typical (SaaS) pricing is too high for university departments</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/612/feedback/nils%20-%20CFP.md" rel="nofollow">Nils - CFP</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>612: Zip Bomb Protection</title>
  <link>https://www.bsdnow.tv/612</link>
  <guid isPermaLink="false">445e8ddd-cc74-4299-aa42-c8ba5e8d2d93</guid>
  <pubDate>Thu, 22 May 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/445e8ddd-cc74-4299-aa42-c8ba5e8d2d93.mp3" length="36056832" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>I use Zip Bombs to Protect my Server, Owning the Stack: Infrastructure Independence with FreeBSD and ZFS, Optimisation of parallel TCP input, Chosing between "it works for now" and "it works in the long term", Losing one of my evenings after an OpenBSD upgrade, What drive did I just remove from the system?, and more
</itunes:subtitle>
  <itunes:duration>37:33</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>I use Zip Bombs to Protect my Server, Owning the Stack: Infrastructure Independence with FreeBSD and ZFS, Optimisation of parallel TCP input, Chosing between "it works for now" and "it works in the long term", Losing one of my evenings after an OpenBSD upgrade, What drive did I just remove from the system?, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
I use Zip Bombs to Protect my Server (https://idiallo.com/blog/zipbomb-protection)
Owning the Stack: Infrastructure Independence with FreeBSD and ZFS
 (https://klarasystems.com/articles/owning-the-stack-infrastructure-independence-with-freebsd-zfs/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Optimisation of parallel TCP input (https://www.undeadly.org/cgi?action=article;sid=20250508122430)
Chosing between "it works for now" and "it works in the long term" (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/WorksNowVsWorksGenerally)
Losing one of my evenings after an OpenBSD upgrade (https://www.ncartron.org/losing-one-of-my-evenings-after-an-openbsd-upgrade.html)
What drive did I just remove from the system? (https://dan.langille.org/2025/04/21/what-drive-did-i-just-remove-from-the-system/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Benjamin - Street PCs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/613/feedback/Benjamin%20-%20street%20pcs.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, zip bomb, protection, protect, stack ownership, Infrastructure Independence, Optimisation, parallel TCP input, works for now, works long-term, upgrade, drive removal</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>I use Zip Bombs to Protect my Server, Owning the Stack: Infrastructure Independence with FreeBSD and ZFS, Optimisation of parallel TCP input, Chosing between &quot;it works for now&quot; and &quot;it works in the long term&quot;, Losing one of my evenings after an OpenBSD upgrade, What drive did I just remove from the system?, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://idiallo.com/blog/zipbomb-protection" rel="nofollow">I use Zip Bombs to Protect my Server</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/owning-the-stack-infrastructure-independence-with-freebsd-zfs/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Owning the Stack: Infrastructure Independence with FreeBSD and ZFS<br>
</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20250508122430" rel="nofollow">Optimisation of parallel TCP input</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/WorksNowVsWorksGenerally" rel="nofollow">Chosing between &quot;it works for now&quot; and &quot;it works in the long term&quot;</a></p>

<hr>

<p><a href="https://www.ncartron.org/losing-one-of-my-evenings-after-an-openbsd-upgrade.html" rel="nofollow">Losing one of my evenings after an OpenBSD upgrade</a></p>

<hr>

<p><a href="https://dan.langille.org/2025/04/21/what-drive-did-i-just-remove-from-the-system/" rel="nofollow">What drive did I just remove from the system?</a></p>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/613/feedback/Benjamin%20-%20street%20pcs.md" rel="nofollow">Benjamin - Street PCs</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>I use Zip Bombs to Protect my Server, Owning the Stack: Infrastructure Independence with FreeBSD and ZFS, Optimisation of parallel TCP input, Chosing between &quot;it works for now&quot; and &quot;it works in the long term&quot;, Losing one of my evenings after an OpenBSD upgrade, What drive did I just remove from the system?, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://idiallo.com/blog/zipbomb-protection" rel="nofollow">I use Zip Bombs to Protect my Server</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/owning-the-stack-infrastructure-independence-with-freebsd-zfs/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Owning the Stack: Infrastructure Independence with FreeBSD and ZFS<br>
</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20250508122430" rel="nofollow">Optimisation of parallel TCP input</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/WorksNowVsWorksGenerally" rel="nofollow">Chosing between &quot;it works for now&quot; and &quot;it works in the long term&quot;</a></p>

<hr>

<p><a href="https://www.ncartron.org/losing-one-of-my-evenings-after-an-openbsd-upgrade.html" rel="nofollow">Losing one of my evenings after an OpenBSD upgrade</a></p>

<hr>

<p><a href="https://dan.langille.org/2025/04/21/what-drive-did-i-just-remove-from-the-system/" rel="nofollow">What drive did I just remove from the system?</a></p>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/613/feedback/Benjamin%20-%20street%20pcs.md" rel="nofollow">Benjamin - Street PCs</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>611: Ghosty Things</title>
  <link>https://www.bsdnow.tv/611</link>
  <guid isPermaLink="false">3436e540-2590-4a5e-9caa-5762b7c159bd</guid>
  <pubDate>Thu, 15 May 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3436e540-2590-4a5e-9caa-5762b7c159bd.mp3" length="47079552" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>GhostBSD: From Usability to Struggle and Renewal, Why You Can’t Trust AI to Tune ZFS, Introducing bpflogd(8): capture packets via BPF to log files, What I'd do as a College Freshman in 2025, FreeBSD and KDE Plasma generations, Improvements to the FreeBSD CI/CD systems, FreeBSD as a Workstation, and more</itunes:subtitle>
  <itunes:duration>49:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>GhostBSD: From Usability to Struggle and Renewal, Why You Can’t Trust AI to Tune ZFS, Introducing bpflogd(8): capture packets via BPF to log files, What I'd do as a College Freshman in 2025, FreeBSD and KDE Plasma generations, Improvements to the FreeBSD CI/CD systems, FreeBSD as a Workstation, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
GhostBSD: From Usability to Struggle and Renewal (https://freebsdfoundation.org/our-work/journal/browser-based-edition/downstreams/ghostbsd-from-usability-to-struggle-and-renewal/)
Why You Can’t Trust AI to Tune ZFS (https://klarasystems.com/articles/why-you-cant-trust-ai-to-tune-zfs/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Introducing bpflogd(8): capture packets via BPF to log files (http://undeadly.org/cgi?action=article;sid=20250425074505)
What I'd do as a College Freshman in 2025 (https://muratbuffalo.blogspot.com/2025/04/what-id-do-as-college-freshman.html)
FreeBSD and KDE Plasma generations (https://euroquis.nl//freebsd/2025/03/02/kde5.html)
Improvements to the FreeBSD CI/CD systems (https://freebsdfoundation.org/blog/improvements-to-the-freebsd-ci-cd-systems/)
FreeBSD as a Workstation (https://darknet.sytes.net/wordpress/index.php/2025/03/16/freebsd-as-a-workstation/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Effie - FreeBSD as a Workstation (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/611/feedback/effie%20-%20freebsd%20as%20a%20workstation.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, struggle and renewal, ghostbsd, no trust ai, zfs tuning, bpflogd, packet capture, bpf, log files, logging, college Freshman, KDE Plasma generations, Improvements, CI/CD system, workstation</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>GhostBSD: From Usability to Struggle and Renewal, Why You Can’t Trust AI to Tune ZFS, Introducing bpflogd(8): capture packets via BPF to log files, What I&#39;d do as a College Freshman in 2025, FreeBSD and KDE Plasma generations, Improvements to the FreeBSD CI/CD systems, FreeBSD as a Workstation, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/our-work/journal/browser-based-edition/downstreams/ghostbsd-from-usability-to-struggle-and-renewal/" rel="nofollow">GhostBSD: From Usability to Struggle and Renewal</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/why-you-cant-trust-ai-to-tune-zfs/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Why You Can’t Trust AI to Tune ZFS</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250425074505" rel="nofollow">Introducing bpflogd(8): capture packets via BPF to log files</a></p>

<hr>

<p><a href="https://muratbuffalo.blogspot.com/2025/04/what-id-do-as-college-freshman.html" rel="nofollow">What I&#39;d do as a College Freshman in 2025</a></p>

<hr>

<p><a href="https://euroquis.nl//freebsd/2025/03/02/kde5.html" rel="nofollow">FreeBSD and KDE Plasma generations</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/improvements-to-the-freebsd-ci-cd-systems/" rel="nofollow">Improvements to the FreeBSD CI/CD systems</a></p>

<hr>

<p><a href="https://darknet.sytes.net/wordpress/index.php/2025/03/16/freebsd-as-a-workstation/" rel="nofollow">FreeBSD as a Workstation</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/611/feedback/effie%20-%20freebsd%20as%20a%20workstation.md" rel="nofollow">Effie - FreeBSD as a Workstation</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>GhostBSD: From Usability to Struggle and Renewal, Why You Can’t Trust AI to Tune ZFS, Introducing bpflogd(8): capture packets via BPF to log files, What I&#39;d do as a College Freshman in 2025, FreeBSD and KDE Plasma generations, Improvements to the FreeBSD CI/CD systems, FreeBSD as a Workstation, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/our-work/journal/browser-based-edition/downstreams/ghostbsd-from-usability-to-struggle-and-renewal/" rel="nofollow">GhostBSD: From Usability to Struggle and Renewal</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/why-you-cant-trust-ai-to-tune-zfs/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Why You Can’t Trust AI to Tune ZFS</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250425074505" rel="nofollow">Introducing bpflogd(8): capture packets via BPF to log files</a></p>

<hr>

<p><a href="https://muratbuffalo.blogspot.com/2025/04/what-id-do-as-college-freshman.html" rel="nofollow">What I&#39;d do as a College Freshman in 2025</a></p>

<hr>

<p><a href="https://euroquis.nl//freebsd/2025/03/02/kde5.html" rel="nofollow">FreeBSD and KDE Plasma generations</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/improvements-to-the-freebsd-ci-cd-systems/" rel="nofollow">Improvements to the FreeBSD CI/CD systems</a></p>

<hr>

<p><a href="https://darknet.sytes.net/wordpress/index.php/2025/03/16/freebsd-as-a-workstation/" rel="nofollow">FreeBSD as a Workstation</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/611/feedback/effie%20-%20freebsd%20as%20a%20workstation.md" rel="nofollow">Effie - FreeBSD as a Workstation</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>610: OpenBSD 7.7</title>
  <link>https://www.bsdnow.tv/610</link>
  <guid isPermaLink="false">c5685d50-e22b-4162-a0e6-e95482c79364</guid>
  <pubDate>Thu, 08 May 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c5685d50-e22b-4162-a0e6-e95482c79364.mp3" length="59646336" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 7.7, ZFS Orchestration Tools – Part 2: Replication, Switching customers from Linux to BSD because boring is good, Graphed and measured: running TCP input in parallel, Introducing an OpenBSD LLDP daemon, Hardware discovery: ACPI &amp; Device Tree, The 2025 FreeBSD Community Survey is Here, and more</itunes:subtitle>
  <itunes:duration>1:02:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 7.7, ZFS Orchestration Tools – Part 2: Replication, Switching customers from Linux to BSD because boring is good, Graphed and measured: running TCP input in parallel, Introducing an OpenBSD LLDP daemon, Hardware discovery: ACPI &amp;amp; Device Tree, The 2025 FreeBSD Community Survey is Here, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenBSD 7.7 (https://OpenBSD.org/77.html)
ZFS Orchestration Tools – Part 2: Replication (https://klarasystems.com/articles/zfs-orchestration-tools-part-2-replication/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Switching customers from Linux to BSD because boring is good (https://www.theregister.com/2024/10/08/switching_from_linux_to_bsd/)
Graphed and measured: running TCP input in parallel (http://undeadly.org/cgi?action=article;sid=20250418114827)
Introducing an OpenBSD LLDP daemon (http://undeadly.org/cgi?action=article;sid=20250425082010)
Hardware discovery: ACPI &amp;amp; Device Tree (https://blogsystem5.substack.com/p/hardware-autoconfiguration)
The 2025 FreeBSD Community Survey is Here (https://freebsdfoundation.org/blog/the-2025-freebsd-community-survey-is-here/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - new users (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/610/feedback/brad%20-%20new%20users.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, openbsd 7.7, orchestration tools, zfs replication, switching customers, boring is good, graphed, measured, benchmarking, tcp in parallel, lldp daemon, hardware discovery, community survey</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 7.7, ZFS Orchestration Tools – Part 2: Replication, Switching customers from Linux to BSD because boring is good, Graphed and measured: running TCP input in parallel, Introducing an OpenBSD LLDP daemon, Hardware discovery: ACPI &amp; Device Tree, The 2025 FreeBSD Community Survey is Here, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://OpenBSD.org/77.html" rel="nofollow">OpenBSD 7.7</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-orchestration-tools-part-2-replication/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS Orchestration Tools – Part 2: Replication</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.theregister.com/2024/10/08/switching_from_linux_to_bsd/" rel="nofollow">Switching customers from Linux to BSD because boring is good</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250418114827" rel="nofollow">Graphed and measured: running TCP input in parallel</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250425082010" rel="nofollow">Introducing an OpenBSD LLDP daemon</a></p>

<hr>

<p><a href="https://blogsystem5.substack.com/p/hardware-autoconfiguration" rel="nofollow">Hardware discovery: ACPI &amp; Device Tree</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/the-2025-freebsd-community-survey-is-here/" rel="nofollow">The 2025 FreeBSD Community Survey is Here</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/610/feedback/brad%20-%20new%20users.md" rel="nofollow">Brad - new users</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 7.7, ZFS Orchestration Tools – Part 2: Replication, Switching customers from Linux to BSD because boring is good, Graphed and measured: running TCP input in parallel, Introducing an OpenBSD LLDP daemon, Hardware discovery: ACPI &amp; Device Tree, The 2025 FreeBSD Community Survey is Here, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://OpenBSD.org/77.html" rel="nofollow">OpenBSD 7.7</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-orchestration-tools-part-2-replication/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS Orchestration Tools – Part 2: Replication</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.theregister.com/2024/10/08/switching_from_linux_to_bsd/" rel="nofollow">Switching customers from Linux to BSD because boring is good</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250418114827" rel="nofollow">Graphed and measured: running TCP input in parallel</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20250425082010" rel="nofollow">Introducing an OpenBSD LLDP daemon</a></p>

<hr>

<p><a href="https://blogsystem5.substack.com/p/hardware-autoconfiguration" rel="nofollow">Hardware discovery: ACPI &amp; Device Tree</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/the-2025-freebsd-community-survey-is-here/" rel="nofollow">The 2025 FreeBSD Community Survey is Here</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/610/feedback/brad%20-%20new%20users.md" rel="nofollow">Brad - new users</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>609: Toe-Dipping in Amsterdam</title>
  <link>https://www.bsdnow.tv/609</link>
  <guid isPermaLink="false">6ea22d34-c89b-4ee8-9c3a-b85dcf18e5b1</guid>
  <pubDate>Thu, 01 May 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6ea22d34-c89b-4ee8-9c3a-b85dcf18e5b1.mp3" length="52603008" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Inside FreeBSD Netgraph: Behind the Curtain of Advanced Networking, Launching BSSG - My Journey from Dynamic CMS to Bash Static Site Generator, OpenZFS Cheat Sheet, Dipping my toes in OpenBSD in Amsterdam, SSH keys from a command: sshd's AuthorizedKeysCommand directive, How to move bhyve VM and Jail container from one host to another host, and more</itunes:subtitle>
  <itunes:duration>54:47</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Inside FreeBSD Netgraph: Behind the Curtain of Advanced Networking, Launching BSSG - My Journey from Dynamic CMS to Bash Static Site Generator, OpenZFS Cheat Sheet, Dipping my toes in OpenBSD in Amsterdam, SSH keys from a command: sshd's AuthorizedKeysCommand directive, How to move bhyve VM and Jail container from one host to another host, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Inside FreeBSD Netgraph: Behind the Curtain of Advanced Networking (https://klarasystems.com/articles/inside-freebsd-netgraph-advanced-networking/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
Launching BSSG - My Journey from Dynamic CMS to Bash Static Site Generator (https://it-notes.dragas.net/2025/04/07/launching-bssg-my-journey-from-dynamic-cms-to-bash-static-site-generator/)
News Roundup
OpenZFS Cheat Sheet (https://freebsdfoundation.org/blog/openzfs-cheat-sheet/)
Dipping my toes in OpenBSD, in Amsterdam (https://ewintr.nl/posts/2025/dipping-my-toes-in-openbsd-in-amsterdam/)
SSH keys from a command: sshd's AuthorizedKeysCommand directive (https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/)
How to move bhyve VM and Jail container from one host to another host ? (https://vincentdelft.be/post/post_20250215)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Dave - Webstack (https://github.com/BSDNow/bsdnow.tv/tree/master/episodes/609/feedback)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, netgraph, Advanced networking, bssg, dynamic cms, bash static site generator, cheat sheet, AuthorizedKeysCommand, ssh, sshd, secure shell, bhyve migration, vm migration</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Inside FreeBSD Netgraph: Behind the Curtain of Advanced Networking, Launching BSSG - My Journey from Dynamic CMS to Bash Static Site Generator, OpenZFS Cheat Sheet, Dipping my toes in OpenBSD in Amsterdam, SSH keys from a command: sshd&#39;s AuthorizedKeysCommand directive, How to move bhyve VM and Jail container from one host to another host, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/inside-freebsd-netgraph-advanced-networking/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Inside FreeBSD Netgraph: Behind the Curtain of Advanced Networking</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2025/04/07/launching-bssg-my-journey-from-dynamic-cms-to-bash-static-site-generator/" rel="nofollow">Launching BSSG - My Journey from Dynamic CMS to Bash Static Site Generator</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://freebsdfoundation.org/blog/openzfs-cheat-sheet/" rel="nofollow">OpenZFS Cheat Sheet</a></p>

<hr>

<p><a href="https://ewintr.nl/posts/2025/dipping-my-toes-in-openbsd-in-amsterdam/" rel="nofollow">Dipping my toes in OpenBSD, in Amsterdam</a></p>

<hr>

<p><a href="https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/" rel="nofollow">SSH keys from a command: sshd&#39;s AuthorizedKeysCommand directive</a></p>

<hr>

<p><a href="https://vincentdelft.be/post/post_20250215" rel="nofollow">How to move bhyve VM and Jail container from one host to another host ?</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/tree/master/episodes/609/feedback" rel="nofollow">Dave - Webstack</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Inside FreeBSD Netgraph: Behind the Curtain of Advanced Networking, Launching BSSG - My Journey from Dynamic CMS to Bash Static Site Generator, OpenZFS Cheat Sheet, Dipping my toes in OpenBSD in Amsterdam, SSH keys from a command: sshd&#39;s AuthorizedKeysCommand directive, How to move bhyve VM and Jail container from one host to another host, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/inside-freebsd-netgraph-advanced-networking/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Inside FreeBSD Netgraph: Behind the Curtain of Advanced Networking</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2025/04/07/launching-bssg-my-journey-from-dynamic-cms-to-bash-static-site-generator/" rel="nofollow">Launching BSSG - My Journey from Dynamic CMS to Bash Static Site Generator</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://freebsdfoundation.org/blog/openzfs-cheat-sheet/" rel="nofollow">OpenZFS Cheat Sheet</a></p>

<hr>

<p><a href="https://ewintr.nl/posts/2025/dipping-my-toes-in-openbsd-in-amsterdam/" rel="nofollow">Dipping my toes in OpenBSD, in Amsterdam</a></p>

<hr>

<p><a href="https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/" rel="nofollow">SSH keys from a command: sshd&#39;s AuthorizedKeysCommand directive</a></p>

<hr>

<p><a href="https://vincentdelft.be/post/post_20250215" rel="nofollow">How to move bhyve VM and Jail container from one host to another host ?</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/tree/master/episodes/609/feedback" rel="nofollow">Dave - Webstack</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>608: Reboot required</title>
  <link>https://www.bsdnow.tv/608</link>
  <guid isPermaLink="false">2c8bb44d-bc8c-468c-8556-74ec308bbc46</guid>
  <pubDate>Thu, 24 Apr 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2c8bb44d-bc8c-468c-8556-74ec308bbc46.mp3" length="46584192" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Robust &amp; Reliable Backup Solutions with OpenZFS, Why I Maintain a 17 Year Old Thinkpad, Motivations, Tinker Writer Deck, How to tell if FreeBSD needs a Reboot using kernel version check, Techie pulled an all-nighter that one mistake turned into an all-weekender, and more</itunes:subtitle>
  <itunes:duration>48:31</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Robust &amp;amp; Reliable Backup Solutions with OpenZFS, Why I Maintain a 17 Year Old Thinkpad, Motivations, Tinker Writer Deck, How to tell if FreeBSD needs a Reboot using kernel version check, Techie pulled an all-nighter that one mistake turned into an all-weekender, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
World Backup Day 2025: Robust &amp;amp; Reliable Backup Solutions with OpenZFS (https://klarasystems.com/articles/world-backup-day-2025-robust-reliable-backup-solutions-with-openzfs/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
Why I Maintain a 17 Year Old Thinkpad (https://pilledtexts.com/why-i-use-a-17-year-old-thinkpad/)
News Roundup
Motivations (https://stevengharms.com/longform/my-first-freebsd/motivations/)
Tinker Writer Deck (https://tinker.sh/)
How to tell if FreeBSD needs a Reboot using kernel version check (https://www.cyberciti.biz/faq/freebsd-determine-if-a-system-reboot-is-necessary/)
Techie pulled an all-nighter that one mistake turned into an all-weekender (https://www.theregister.com/2025/03/03/who_me/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Ian - Personal Web Stack (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/608/feedback/ian%20-%20personal%20stack.md)
Brendan - Storage Backends (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/608/feedback/brendan%20-%20storage%20backends.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, reliable backup, world backup day, 17 year old thinkpad, tinker writer deck, reboot, kernel version check,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Robust &amp; Reliable Backup Solutions with OpenZFS, Why I Maintain a 17 Year Old Thinkpad, Motivations, Tinker Writer Deck, How to tell if FreeBSD needs a Reboot using kernel version check, Techie pulled an all-nighter that one mistake turned into an all-weekender, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/world-backup-day-2025-robust-reliable-backup-solutions-with-openzfs/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">World Backup Day 2025: Robust &amp; Reliable Backup Solutions with OpenZFS</a></p>

<hr>

<p><a href="https://pilledtexts.com/why-i-use-a-17-year-old-thinkpad/" rel="nofollow">Why I Maintain a 17 Year Old Thinkpad</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://stevengharms.com/longform/my-first-freebsd/motivations/" rel="nofollow">Motivations</a></p>

<hr>

<p><a href="https://tinker.sh/" rel="nofollow">Tinker Writer Deck</a></p>

<hr>

<p><a href="https://www.cyberciti.biz/faq/freebsd-determine-if-a-system-reboot-is-necessary/" rel="nofollow">How to tell if FreeBSD needs a Reboot using kernel version check</a></p>

<hr>

<p><a href="https://www.theregister.com/2025/03/03/who_me/" rel="nofollow">Techie pulled an all-nighter that one mistake turned into an all-weekender</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/608/feedback/ian%20-%20personal%20stack.md" rel="nofollow">Ian - Personal Web Stack</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/608/feedback/brendan%20-%20storage%20backends.md" rel="nofollow">Brendan - Storage Backends</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Robust &amp; Reliable Backup Solutions with OpenZFS, Why I Maintain a 17 Year Old Thinkpad, Motivations, Tinker Writer Deck, How to tell if FreeBSD needs a Reboot using kernel version check, Techie pulled an all-nighter that one mistake turned into an all-weekender, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/world-backup-day-2025-robust-reliable-backup-solutions-with-openzfs/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">World Backup Day 2025: Robust &amp; Reliable Backup Solutions with OpenZFS</a></p>

<hr>

<p><a href="https://pilledtexts.com/why-i-use-a-17-year-old-thinkpad/" rel="nofollow">Why I Maintain a 17 Year Old Thinkpad</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://stevengharms.com/longform/my-first-freebsd/motivations/" rel="nofollow">Motivations</a></p>

<hr>

<p><a href="https://tinker.sh/" rel="nofollow">Tinker Writer Deck</a></p>

<hr>

<p><a href="https://www.cyberciti.biz/faq/freebsd-determine-if-a-system-reboot-is-necessary/" rel="nofollow">How to tell if FreeBSD needs a Reboot using kernel version check</a></p>

<hr>

<p><a href="https://www.theregister.com/2025/03/03/who_me/" rel="nofollow">Techie pulled an all-nighter that one mistake turned into an all-weekender</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/608/feedback/ian%20-%20personal%20stack.md" rel="nofollow">Ian - Personal Web Stack</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/608/feedback/brendan%20-%20storage%20backends.md" rel="nofollow">Brendan - Storage Backends</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>607: Sign those commits</title>
  <link>https://www.bsdnow.tv/607</link>
  <guid isPermaLink="false">8c8a9cb9-441e-40a7-9655-ee7d148ef6eb</guid>
  <pubDate>Thu, 17 Apr 2025 18:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8c8a9cb9-441e-40a7-9655-ee7d148ef6eb.mp3" length="54202368" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We should improve libzfs somewhat, Accurate Effective Storage Performance Benchmark, Debugging aids for pf firewall rules on FreeBSD, OpenBSD and Thunderbolt issue on ThinkPad T480s, Signing Git Commits with an SSH key, Pgrep, LibreOffice downloads on the rise, and more</itunes:subtitle>
  <itunes:duration>56:27</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We should improve libzfs somewhat, Accurate Effective Storage Performance Benchmark, Debugging aids for pf firewall rules on FreeBSD, OpenBSD and Thunderbolt issue on ThinkPad T480s, Signing Git Commits with an SSH key, Pgrep, LibreOffice downloads on the rise, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
We should improve libzfs somewhat (https://despairlabs.com/blog/posts/2025-03-12-we-should-improve-libzfs-somewhat/)
Accurate Effective Storage Performance Benchmark (https://klarasystems.com/articles/accurate-effective-storage-performance-benchmark/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Debugging aids for pf firewall rules on FreeBSD (https://dan.langille.org/2025/02/24/debugging-aids-for-pf-firewall-rules-on-freebsd/)
OpenBSD and Thunderbolt issue on ThinkPad T480s (https://www.tumfatig.net/2025/openbsd-and-thunderbolt-issue-on-thinkpad-t480s/)
Signing Git Commits with an SSH key (https://jpmens.net/2025/02/26/signing-git-commits-with-an-ssh-key/)
Pgrep (https://www.c0t0d0s0.org/blog/pgrep-z-r.html)
LibreOffice downloads on the rise as users look to avoid subscription costs (https://www.computerworld.com/article/3840480/libreoffice-downloads-on-the-rise-as-users-look-to-avoid-subscription-costs.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Felix - Bhyve and NVME (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/607/feedback/Felix%20-%20bhyve%20and%20nvme.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, improve, improvement, libzfs, effective storage performance benchmark, debugging, aid, firewall rules, pf, thunderbolt, thinkpad T480s, git commit, signing, ssh key, pgrep, libreoffice</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We should improve libzfs somewhat, Accurate Effective Storage Performance Benchmark, Debugging aids for pf firewall rules on FreeBSD, OpenBSD and Thunderbolt issue on ThinkPad T480s, Signing Git Commits with an SSH key, Pgrep, LibreOffice downloads on the rise, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://despairlabs.com/blog/posts/2025-03-12-we-should-improve-libzfs-somewhat/" rel="nofollow">We should improve libzfs somewhat</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/accurate-effective-storage-performance-benchmark/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Accurate Effective Storage Performance Benchmark</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dan.langille.org/2025/02/24/debugging-aids-for-pf-firewall-rules-on-freebsd/" rel="nofollow">Debugging aids for pf firewall rules on FreeBSD</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2025/openbsd-and-thunderbolt-issue-on-thinkpad-t480s/" rel="nofollow">OpenBSD and Thunderbolt issue on ThinkPad T480s</a></p>

<hr>

<p><a href="https://jpmens.net/2025/02/26/signing-git-commits-with-an-ssh-key/" rel="nofollow">Signing Git Commits with an SSH key</a></p>

<hr>

<p><a href="https://www.c0t0d0s0.org/blog/pgrep-z-r.html" rel="nofollow">Pgrep</a></p>

<hr>

<p><a href="https://www.computerworld.com/article/3840480/libreoffice-downloads-on-the-rise-as-users-look-to-avoid-subscription-costs.html" rel="nofollow">LibreOffice downloads on the rise as users look to avoid subscription costs</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/607/feedback/Felix%20-%20bhyve%20and%20nvme.md" rel="nofollow">Felix - Bhyve and NVME</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We should improve libzfs somewhat, Accurate Effective Storage Performance Benchmark, Debugging aids for pf firewall rules on FreeBSD, OpenBSD and Thunderbolt issue on ThinkPad T480s, Signing Git Commits with an SSH key, Pgrep, LibreOffice downloads on the rise, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://despairlabs.com/blog/posts/2025-03-12-we-should-improve-libzfs-somewhat/" rel="nofollow">We should improve libzfs somewhat</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/accurate-effective-storage-performance-benchmark/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Accurate Effective Storage Performance Benchmark</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dan.langille.org/2025/02/24/debugging-aids-for-pf-firewall-rules-on-freebsd/" rel="nofollow">Debugging aids for pf firewall rules on FreeBSD</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2025/openbsd-and-thunderbolt-issue-on-thinkpad-t480s/" rel="nofollow">OpenBSD and Thunderbolt issue on ThinkPad T480s</a></p>

<hr>

<p><a href="https://jpmens.net/2025/02/26/signing-git-commits-with-an-ssh-key/" rel="nofollow">Signing Git Commits with an SSH key</a></p>

<hr>

<p><a href="https://www.c0t0d0s0.org/blog/pgrep-z-r.html" rel="nofollow">Pgrep</a></p>

<hr>

<p><a href="https://www.computerworld.com/article/3840480/libreoffice-downloads-on-the-rise-as-users-look-to-avoid-subscription-costs.html" rel="nofollow">LibreOffice downloads on the rise as users look to avoid subscription costs</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/607/feedback/Felix%20-%20bhyve%20and%20nvme.md" rel="nofollow">Felix - Bhyve and NVME</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>606: Tackling 7k bugs</title>
  <link>https://www.bsdnow.tv/606</link>
  <guid isPermaLink="false">36cf0e74-8983-4d33-a8ae-2a44c5c62f5b</guid>
  <pubDate>Thu, 10 Apr 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/36cf0e74-8983-4d33-a8ae-2a44c5c62f5b.mp3" length="68451456" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 13.5-RELEASE Now Available, From Chaos to Clarity: How We Tackled FreeBSD’s 7,000 Bug Backlog, zfs-2.3.1, Complications of funding an open source operating system, Why Choose to Use the BSDs in 2025, First Use on GhostBSD, Better Shell History Search, and more</itunes:subtitle>
  <itunes:duration>1:11:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 13.5-RELEASE Now Available, From Chaos to Clarity: How We Tackled FreeBSD’s 7,000 Bug Backlog, zfs-2.3.1, Complications of funding an open source operating system, Why Choose to Use the BSDs in 2025, First Use on GhostBSD, Better Shell History Search, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD 13.5-RELEASE Now Available (https://lists.freebsd.org/archives/freebsd-announce/2025-March/000181.html)
From Chaos to Clarity: How We Tackled FreeBSD’s 7,000 Bug Backlog (https://freebsdfoundation.org/blog/from-chaos-to-clarity-how-we-tackled-freebsds-7000-bug-backlog/)
News Roundup
zfs-2.3.1 (https://github.com/openzfs/zfs/releases/tag/zfs-2.3.1)
Complications of funding an open source operating system (https://posixcafe.org/blogs/2025/03/11/0/)
Why Choose to Use the BSDs in 2025 (https://it-notes.dragas.net/2025/03/23/osday-2025-why-choose-bsd-in-2025/)
First Use on GhostBSD (https://technophobeconfessions.wordpress.com/2025/03/18/first-use-on-ghostbsd/)
Better Shell History Search (https://tratt.net/laurie/blog/2025/better_shell_history_search.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Russell - Questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/606/feedback/russell%20-%20questions.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, 13.5, choas, clarity, 7000 bugs, backlog, zfs 2.3.1, funding, choice, first use, shell history search</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 13.5-RELEASE Now Available, From Chaos to Clarity: How We Tackled FreeBSD’s 7,000 Bug Backlog, zfs-2.3.1, Complications of funding an open source operating system, Why Choose to Use the BSDs in 2025, First Use on GhostBSD, Better Shell History Search, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://lists.freebsd.org/archives/freebsd-announce/2025-March/000181.html" rel="nofollow">FreeBSD 13.5-RELEASE Now Available</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/from-chaos-to-clarity-how-we-tackled-freebsds-7000-bug-backlog/" rel="nofollow">From Chaos to Clarity: How We Tackled FreeBSD’s 7,000 Bug Backlog</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://github.com/openzfs/zfs/releases/tag/zfs-2.3.1" rel="nofollow">zfs-2.3.1</a></p>

<hr>

<p><a href="https://posixcafe.org/blogs/2025/03/11/0/" rel="nofollow">Complications of funding an open source operating system</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2025/03/23/osday-2025-why-choose-bsd-in-2025/" rel="nofollow">Why Choose to Use the BSDs in 2025</a></p>

<hr>

<p><a href="https://technophobeconfessions.wordpress.com/2025/03/18/first-use-on-ghostbsd/" rel="nofollow">First Use on GhostBSD</a></p>

<hr>

<p><a href="https://tratt.net/laurie/blog/2025/better_shell_history_search.html" rel="nofollow">Better Shell History Search</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/606/feedback/russell%20-%20questions.md" rel="nofollow">Russell - Questions</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 13.5-RELEASE Now Available, From Chaos to Clarity: How We Tackled FreeBSD’s 7,000 Bug Backlog, zfs-2.3.1, Complications of funding an open source operating system, Why Choose to Use the BSDs in 2025, First Use on GhostBSD, Better Shell History Search, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://lists.freebsd.org/archives/freebsd-announce/2025-March/000181.html" rel="nofollow">FreeBSD 13.5-RELEASE Now Available</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/from-chaos-to-clarity-how-we-tackled-freebsds-7000-bug-backlog/" rel="nofollow">From Chaos to Clarity: How We Tackled FreeBSD’s 7,000 Bug Backlog</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://github.com/openzfs/zfs/releases/tag/zfs-2.3.1" rel="nofollow">zfs-2.3.1</a></p>

<hr>

<p><a href="https://posixcafe.org/blogs/2025/03/11/0/" rel="nofollow">Complications of funding an open source operating system</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2025/03/23/osday-2025-why-choose-bsd-in-2025/" rel="nofollow">Why Choose to Use the BSDs in 2025</a></p>

<hr>

<p><a href="https://technophobeconfessions.wordpress.com/2025/03/18/first-use-on-ghostbsd/" rel="nofollow">First Use on GhostBSD</a></p>

<hr>

<p><a href="https://tratt.net/laurie/blog/2025/better_shell_history_search.html" rel="nofollow">Better Shell History Search</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/606/feedback/russell%20-%20questions.md" rel="nofollow">Russell - Questions</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>605: Fediverse Weather Service</title>
  <link>https://www.bsdnow.tv/605</link>
  <guid isPermaLink="false">0d283001-f1dc-4ca1-9d48-f10bf0e58d6e</guid>
  <pubDate>Thu, 03 Apr 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0d283001-f1dc-4ca1-9d48-f10bf0e58d6e.mp3" length="56369664" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FediMeteo: How a Tiny €4 FreeBSD VPS Became a Global Weather Service for Thousands, Core Infrastructure: Why You Need to Control Your NTP, Automatic Display switch for OpenBSD laptop, Using a 2013 Mac Pro as a FreeBSD Desktop, Some terminal frustrations, Copying all files of a directory, including hidden ones, with cp, You Should Use /tmp/ More, and more</itunes:subtitle>
  <itunes:duration>58:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FediMeteo: How a Tiny €4 FreeBSD VPS Became a Global Weather Service for Thousands, Core Infrastructure: Why You Need to Control Your NTP, Automatic Display switch for OpenBSD laptop, Using a 2013 Mac Pro as a FreeBSD Desktop, Some terminal frustrations, Copying all files of a directory, including hidden ones, with cp, You Should Use /tmp/ More, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FediMeteo: How a Tiny €4 FreeBSD VPS Became a Global Weather Service for Thousands (https://it-notes.dragas.net/2025/02/26/fedimeteo-how-a-tiny-freebsd-vps-became-a-global-weather-service-for-thousands/)
Core Infrastructure: Why You Need to Control Your NTP (https://klarasystems.com/articles/core-infrastructure-why-you-need-to-control-your-ntp/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Automatic Display switch for OpenBSD laptop (https://www.tumfatig.net/2024/automatic-display-switch-for-openbsd-laptop/)
Using a 2013 Mac Pro as a FreeBSD Desktop (https://forums.FreeBSD.org/threads/using-a-2013-mac-pro-as-a-freebsd-desktop.96805/)
Some terminal frustrations (https://jvns.ca/blog/2025/02/05/some-terminal-frustrations/)
Copying all files of a directory, including hidden ones, with cp (https://bhoot.dev/2025/cp-dot-copies-everything/)
You Should Use /tmp/ More (https://atthis.link/blog/2025/58671.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Tyler - Toms request (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/605/feedback/Tyler%20-%20Toms%20request.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, fedimeteo, vps, weather service, core Infrastructure, ntp, network time protocol, Automatic Display switch, mac pro freebsd desktop, terminal frustrations, cp, copy, tmp, temp directory</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FediMeteo: How a Tiny €4 FreeBSD VPS Became a Global Weather Service for Thousands, Core Infrastructure: Why You Need to Control Your NTP, Automatic Display switch for OpenBSD laptop, Using a 2013 Mac Pro as a FreeBSD Desktop, Some terminal frustrations, Copying all files of a directory, including hidden ones, with cp, You Should Use /tmp/ More, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://it-notes.dragas.net/2025/02/26/fedimeteo-how-a-tiny-freebsd-vps-became-a-global-weather-service-for-thousands/" rel="nofollow">FediMeteo: How a Tiny €4 FreeBSD VPS Became a Global Weather Service for Thousands</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/core-infrastructure-why-you-need-to-control-your-ntp/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Core Infrastructure: Why You Need to Control Your NTP</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.tumfatig.net/2024/automatic-display-switch-for-openbsd-laptop/" rel="nofollow">Automatic Display switch for OpenBSD laptop</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/using-a-2013-mac-pro-as-a-freebsd-desktop.96805/" rel="nofollow">Using a 2013 Mac Pro as a FreeBSD Desktop</a></p>

<hr>

<p><a href="https://jvns.ca/blog/2025/02/05/some-terminal-frustrations/" rel="nofollow">Some terminal frustrations</a></p>

<hr>

<p><a href="https://bhoot.dev/2025/cp-dot-copies-everything/" rel="nofollow">Copying all files of a directory, including hidden ones, with cp</a></p>

<hr>

<p><a href="https://atthis.link/blog/2025/58671.html" rel="nofollow">You Should Use /tmp/ More</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/605/feedback/Tyler%20-%20Toms%20request.md" rel="nofollow">Tyler - Toms request</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FediMeteo: How a Tiny €4 FreeBSD VPS Became a Global Weather Service for Thousands, Core Infrastructure: Why You Need to Control Your NTP, Automatic Display switch for OpenBSD laptop, Using a 2013 Mac Pro as a FreeBSD Desktop, Some terminal frustrations, Copying all files of a directory, including hidden ones, with cp, You Should Use /tmp/ More, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://it-notes.dragas.net/2025/02/26/fedimeteo-how-a-tiny-freebsd-vps-became-a-global-weather-service-for-thousands/" rel="nofollow">FediMeteo: How a Tiny €4 FreeBSD VPS Became a Global Weather Service for Thousands</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/core-infrastructure-why-you-need-to-control-your-ntp/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Core Infrastructure: Why You Need to Control Your NTP</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.tumfatig.net/2024/automatic-display-switch-for-openbsd-laptop/" rel="nofollow">Automatic Display switch for OpenBSD laptop</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/using-a-2013-mac-pro-as-a-freebsd-desktop.96805/" rel="nofollow">Using a 2013 Mac Pro as a FreeBSD Desktop</a></p>

<hr>

<p><a href="https://jvns.ca/blog/2025/02/05/some-terminal-frustrations/" rel="nofollow">Some terminal frustrations</a></p>

<hr>

<p><a href="https://bhoot.dev/2025/cp-dot-copies-everything/" rel="nofollow">Copying all files of a directory, including hidden ones, with cp</a></p>

<hr>

<p><a href="https://atthis.link/blog/2025/58671.html" rel="nofollow">You Should Use /tmp/ More</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/605/feedback/Tyler%20-%20Toms%20request.md" rel="nofollow">Tyler - Toms request</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>604: Future looks back</title>
  <link>https://www.bsdnow.tv/604</link>
  <guid isPermaLink="false">a942703c-56b7-4c72-a047-bb79bc5d23ff</guid>
  <pubDate>Thu, 27 Mar 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a942703c-56b7-4c72-a047-bb79bc5d23ff.mp3" length="47195136" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Future Looking Back At Us: Joanne McNeil on Cyberpunk, Why ZFS reports less available space, We are destroying software, FreeBSD 13.5 Overcomes UFS Y2038 Problem To Push It Out To Year 2106, 1972 UNIX V2 "Beta" Resurrected, Some thoughts on why 'inetd activation' didn't catch on, If you believe in “Artificial Intelligence”, take five minutes to ask it about stuff you know well, and more</itunes:subtitle>
  <itunes:duration>49:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Future Looking Back At Us: Joanne McNeil on Cyberpunk, Why ZFS reports less available space, We are destroying software, FreeBSD 13.5 Overcomes UFS Y2038 Problem To Push It Out To Year 2106, 1972 UNIX V2 "Beta" Resurrected, Some thoughts on why 'inetd activation' didn't catch on, If you believe in “Artificial Intelligence”, take five minutes to ask it about stuff you know well, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The Future Looking Back At Us: Joanne McNeil on Cyberpunk (https://filmmakermagazine.com/127295-joanne-mcneil-cyberpunk/)
Why ZFS reports less available space space accounting explained/ (https://klarasystems.com/articles/why-zfs-reports-less-available-space-space-accounting-explained/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
We are destroying software (https://antirez.com/news/145)
News Roundup
FreeBSD 13.5 Overcomes UFS Y2038 Problem To Push It Out To Year 2106 (https://www.phoronix.com/news/FreeBSD-13.5-Beta-2)
TUHS: 1972 UNIX V2 "Beta" Resurrected (https://www.tuhs.org/pipermail/tuhs/2025-February/031420.html)
Some thoughts on why 'inetd activation' didn't catch on (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/InetdActivationWhyNot)
If you believe in “Artificial Intelligence”, take five minutes to ask it about stuff you know well (https://svpow.com/2025/02/14/if-you-believe-in-artificial-intelligence-take-five-minutes-to-ask-it-about-stuff-you-know-well/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Nelson - gcc puzzlement (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/604/feedback/Nelson%20-%20gcc%20puzzlement.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, future, cyberpunk, disk space, storage space, pool space, destroying software, UFS, Y2038, year 2106, 172 UNIX beta, resurrection, inetd activation, ai, Artificial Intelligence</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Future Looking Back At Us: Joanne McNeil on Cyberpunk, Why ZFS reports less available space, We are destroying software, FreeBSD 13.5 Overcomes UFS Y2038 Problem To Push It Out To Year 2106, 1972 UNIX V2 &quot;Beta&quot; Resurrected, Some thoughts on why &#39;inetd activation&#39; didn&#39;t catch on, If you believe in “Artificial Intelligence”, take five minutes to ask it about stuff you know well, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://filmmakermagazine.com/127295-joanne-mcneil-cyberpunk/" rel="nofollow">The Future Looking Back At Us: Joanne McNeil on Cyberpunk</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/why-zfs-reports-less-available-space-space-accounting-explained/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Why ZFS reports less available space space accounting explained/</a></p>

<hr>

<p><a href="https://antirez.com/news/145" rel="nofollow">We are destroying software</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.phoronix.com/news/FreeBSD-13.5-Beta-2" rel="nofollow">FreeBSD 13.5 Overcomes UFS Y2038 Problem To Push It Out To Year 2106</a></p>

<hr>

<p><a href="https://www.tuhs.org/pipermail/tuhs/2025-February/031420.html" rel="nofollow">TUHS: 1972 UNIX V2 &quot;Beta&quot; Resurrected</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/InetdActivationWhyNot" rel="nofollow">Some thoughts on why &#39;inetd activation&#39; didn&#39;t catch on</a></p>

<hr>

<p><a href="https://svpow.com/2025/02/14/if-you-believe-in-artificial-intelligence-take-five-minutes-to-ask-it-about-stuff-you-know-well/" rel="nofollow">If you believe in “Artificial Intelligence”, take five minutes to ask it about stuff you know well</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/604/feedback/Nelson%20-%20gcc%20puzzlement.md" rel="nofollow">Nelson - gcc puzzlement</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Future Looking Back At Us: Joanne McNeil on Cyberpunk, Why ZFS reports less available space, We are destroying software, FreeBSD 13.5 Overcomes UFS Y2038 Problem To Push It Out To Year 2106, 1972 UNIX V2 &quot;Beta&quot; Resurrected, Some thoughts on why &#39;inetd activation&#39; didn&#39;t catch on, If you believe in “Artificial Intelligence”, take five minutes to ask it about stuff you know well, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://filmmakermagazine.com/127295-joanne-mcneil-cyberpunk/" rel="nofollow">The Future Looking Back At Us: Joanne McNeil on Cyberpunk</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/why-zfs-reports-less-available-space-space-accounting-explained/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Why ZFS reports less available space space accounting explained/</a></p>

<hr>

<p><a href="https://antirez.com/news/145" rel="nofollow">We are destroying software</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.phoronix.com/news/FreeBSD-13.5-Beta-2" rel="nofollow">FreeBSD 13.5 Overcomes UFS Y2038 Problem To Push It Out To Year 2106</a></p>

<hr>

<p><a href="https://www.tuhs.org/pipermail/tuhs/2025-February/031420.html" rel="nofollow">TUHS: 1972 UNIX V2 &quot;Beta&quot; Resurrected</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/InetdActivationWhyNot" rel="nofollow">Some thoughts on why &#39;inetd activation&#39; didn&#39;t catch on</a></p>

<hr>

<p><a href="https://svpow.com/2025/02/14/if-you-believe-in-artificial-intelligence-take-five-minutes-to-ask-it-about-stuff-you-know-well/" rel="nofollow">If you believe in “Artificial Intelligence”, take five minutes to ask it about stuff you know well</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/604/feedback/Nelson%20-%20gcc%20puzzlement.md" rel="nofollow">Nelson - gcc puzzlement</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>603: Expanding the RAID-Z</title>
  <link>https://www.bsdnow.tv/603</link>
  <guid isPermaLink="false">b363b18d-79bf-4cdb-bb98-d22bb66a99be</guid>
  <pubDate>Thu, 20 Mar 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b363b18d-79bf-4cdb-bb98-d22bb66a99be.mp3" length="34948992" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS RAID-Z Expansion: A New Era in Storage Flexibility, ZFS Orchestration Tools – Part 1: Snapshots, The Case of UNIX vs. The UNIX System, OpenBGPD 8.8 released, OPNsense 25.1, and more</itunes:subtitle>
  <itunes:duration>36:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS RAID-Z Expansion: A New Era in Storage Flexibility, ZFS Orchestration Tools – Part 1: Snapshots, The Case of UNIX vs. The UNIX System, OpenBGPD 8.8 released, OPNsense 25.1, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenZFS RAID-Z Expansion: A New Era in Storage Flexibility (https://freebsdfoundation.org/blog/openzfs-raid-z-expansion-a-new-era-in-storage-flexibility/)
ZFS Orchestration Tools – Part 1: Snapshots (https://klarasystems.com/articles/zfs-orchestration-part-1-zfs-snapshots-tools/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Manage OpenBSD with AWS Systems Manager (https://rsadowski.de/posts/2025-01-23-manage-openbsd-with-ssm/)
TUHS:The Case of UNIX vs. The UNIX System (https://www.tuhs.org/pipermail/tuhs/2025-February/031403.html)
OpenBGPD 8.8 released (https://www.undeadly.org/cgi?action=article;sid=20250207192657)
OPNsense 25.1 (https://forum.opnsense.org/index.php?topic=45460.msg227323)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, raidz expansion, storage Flexibility, Orchestration tools, OpenBGPD 8.8, opnsense 25.1</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS RAID-Z Expansion: A New Era in Storage Flexibility, ZFS Orchestration Tools – Part 1: Snapshots, The Case of UNIX vs. The UNIX System, OpenBGPD 8.8 released, OPNsense 25.1, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/openzfs-raid-z-expansion-a-new-era-in-storage-flexibility/" rel="nofollow">OpenZFS RAID-Z Expansion: A New Era in Storage Flexibility</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-orchestration-part-1-zfs-snapshots-tools/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS Orchestration Tools – Part 1: Snapshots</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://rsadowski.de/posts/2025-01-23-manage-openbsd-with-ssm/" rel="nofollow">Manage OpenBSD with AWS Systems Manager</a></p>

<hr>

<p><a href="https://www.tuhs.org/pipermail/tuhs/2025-February/031403.html" rel="nofollow">TUHS:The Case of UNIX vs. The UNIX System</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20250207192657" rel="nofollow">OpenBGPD 8.8 released</a></p>

<hr>

<p><a href="https://forum.opnsense.org/index.php?topic=45460.msg227323" rel="nofollow">OPNsense 25.1</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS RAID-Z Expansion: A New Era in Storage Flexibility, ZFS Orchestration Tools – Part 1: Snapshots, The Case of UNIX vs. The UNIX System, OpenBGPD 8.8 released, OPNsense 25.1, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/openzfs-raid-z-expansion-a-new-era-in-storage-flexibility/" rel="nofollow">OpenZFS RAID-Z Expansion: A New Era in Storage Flexibility</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zfs-orchestration-part-1-zfs-snapshots-tools/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS Orchestration Tools – Part 1: Snapshots</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://rsadowski.de/posts/2025-01-23-manage-openbsd-with-ssm/" rel="nofollow">Manage OpenBSD with AWS Systems Manager</a></p>

<hr>

<p><a href="https://www.tuhs.org/pipermail/tuhs/2025-February/031403.html" rel="nofollow">TUHS:The Case of UNIX vs. The UNIX System</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20250207192657" rel="nofollow">OpenBGPD 8.8 released</a></p>

<hr>

<p><a href="https://forum.opnsense.org/index.php?topic=45460.msg227323" rel="nofollow">OPNsense 25.1</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>602: Wildcard Gotchas</title>
  <link>https://www.bsdnow.tv/602</link>
  <guid isPermaLink="false">047f1a53-de88-41b8-bff2-c25e006dd164</guid>
  <pubDate>Thu, 13 Mar 2025 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/047f1a53-de88-41b8-bff2-c25e006dd164.mp3" length="54905088" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>I Tried FreeBSD as a Desktop in 2025. Here's How It Went, Cray 1 Supercomputer Performance Comparisons With Home Computers Phones and Tablets, The first perfect computer, Find Name Wildcard Gotcha, and more</itunes:subtitle>
  <itunes:duration>57:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>I Tried FreeBSD as a Desktop in 2025. Here's How It Went, Cray 1 Supercomputer Performance Comparisons With Home Computers Phones and Tablets, The first perfect computer, Find Name Wildcard Gotcha, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
I Tried FreeBSD as a Desktop in 2025. Here's How It Went (https://www.howtogeek.com/i-tried-freebsd-as-a-desktop-heres-how-it-went/)
Cray 1 Supercomputer Performance Comparisons With Home Computers Phones and Tablets (http://www.roylongbottom.org.uk/Cray%201%20Supercomputer%20Performance%20Comparisons%20With%20Home%20Computers%20Phones%20and%20Tablets.htm)
News Roundup
State of virtualizing the BSDs on Apple Silicon (https://briancallahan.net/blog/20250222.html)
The first perfect computer (https://celso.io/posts/2025/01/26/the-first-perfect-computer/)
Find Name Wildcard Gotcha (https://utcc.utoronto.ca/~cks/space/blog/unix/FindNameWildcardGotcha)
New Patreon Levels
Level 1 - user memory (Tip Jar) @ $1 / month
Show your support for the show
Level 2 - virtual memory (Ad-Free Episodes) @ $5 / month
Ad-free episodes
Level 3 - kmem (VIP Patron) @ $10 / month
Everything in higher memory levels &amp;amp;
Your feedback and questions jump the queue and go in the next episode.
Personal shout outs (with your consent) for recommending articles we cover.
Level 4 - physical memory @ $20 / month
What's included:
Everything in higher memory levels &amp;amp;
You can send in audio/video questions and we'll air your audio in the show feedback section (if the quality of your recording is decent)
Behind-the-scenes content - Raw Video from Recording sessions with intro/outro discussion not included in the show
Additional Content when we all make it
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, freebsd desktop, cray, Supercomputer, Performance Comparisons, home computer, perfect computer, wildcard gotcha,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>I Tried FreeBSD as a Desktop in 2025. Here&#39;s How It Went, Cray 1 Supercomputer Performance Comparisons With Home Computers Phones and Tablets, The first perfect computer, Find Name Wildcard Gotcha, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.howtogeek.com/i-tried-freebsd-as-a-desktop-heres-how-it-went/" rel="nofollow">I Tried FreeBSD as a Desktop in 2025. Here&#39;s How It Went</a></p>

<hr>

<p><a href="http://www.roylongbottom.org.uk/Cray%201%20Supercomputer%20Performance%20Comparisons%20With%20Home%20Computers%20Phones%20and%20Tablets.htm" rel="nofollow">Cray 1 Supercomputer Performance Comparisons With Home Computers Phones and Tablets</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://briancallahan.net/blog/20250222.html" rel="nofollow">State of virtualizing the BSDs on Apple Silicon</a></p>

<hr>

<p><a href="https://celso.io/posts/2025/01/26/the-first-perfect-computer/" rel="nofollow">The first perfect computer</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FindNameWildcardGotcha" rel="nofollow">Find Name Wildcard Gotcha</a></p>

<hr>

<h2>New Patreon Levels</h2>

<p>Level 1 - user memory (Tip Jar) @ $1 / month<br>
Show your support for the show</p>

<p>Level 2 - virtual memory (Ad-Free Episodes) @ $5 / month<br>
Ad-free episodes</p>

<p>Level 3 - kmem (VIP Patron) @ $10 / month<br>
Everything in higher memory levels &amp;<br>
Your feedback and questions jump the queue and go in the next episode.<br>
Personal shout outs (with your consent) for recommending articles we cover.</p>

<p>Level 4 - physical memory @ $20 / month<br>
What&#39;s included:<br>
Everything in higher memory levels &amp;<br>
You can send in audio/video questions and we&#39;ll air your audio in the show feedback section (if the quality of your recording is decent)<br>
Behind-the-scenes content - Raw Video from Recording sessions with intro/outro discussion not included in the show<br>
Additional Content when we all make it</p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>I Tried FreeBSD as a Desktop in 2025. Here&#39;s How It Went, Cray 1 Supercomputer Performance Comparisons With Home Computers Phones and Tablets, The first perfect computer, Find Name Wildcard Gotcha, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.howtogeek.com/i-tried-freebsd-as-a-desktop-heres-how-it-went/" rel="nofollow">I Tried FreeBSD as a Desktop in 2025. Here&#39;s How It Went</a></p>

<hr>

<p><a href="http://www.roylongbottom.org.uk/Cray%201%20Supercomputer%20Performance%20Comparisons%20With%20Home%20Computers%20Phones%20and%20Tablets.htm" rel="nofollow">Cray 1 Supercomputer Performance Comparisons With Home Computers Phones and Tablets</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://briancallahan.net/blog/20250222.html" rel="nofollow">State of virtualizing the BSDs on Apple Silicon</a></p>

<hr>

<p><a href="https://celso.io/posts/2025/01/26/the-first-perfect-computer/" rel="nofollow">The first perfect computer</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FindNameWildcardGotcha" rel="nofollow">Find Name Wildcard Gotcha</a></p>

<hr>

<h2>New Patreon Levels</h2>

<p>Level 1 - user memory (Tip Jar) @ $1 / month<br>
Show your support for the show</p>

<p>Level 2 - virtual memory (Ad-Free Episodes) @ $5 / month<br>
Ad-free episodes</p>

<p>Level 3 - kmem (VIP Patron) @ $10 / month<br>
Everything in higher memory levels &amp;<br>
Your feedback and questions jump the queue and go in the next episode.<br>
Personal shout outs (with your consent) for recommending articles we cover.</p>

<p>Level 4 - physical memory @ $20 / month<br>
What&#39;s included:<br>
Everything in higher memory levels &amp;<br>
You can send in audio/video questions and we&#39;ll air your audio in the show feedback section (if the quality of your recording is decent)<br>
Behind-the-scenes content - Raw Video from Recording sessions with intro/outro discussion not included in the show<br>
Additional Content when we all make it</p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>601: The Monospace Web</title>
  <link>https://www.bsdnow.tv/601</link>
  <guid isPermaLink="false">56687453-cb0c-4a65-9235-68a9816b22e2</guid>
  <pubDate>Thu, 06 Mar 2025 09:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/56687453-cb0c-4a65-9235-68a9816b22e2.mp3" length="46028928" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The PC is Dead: It’s Time to Make Computing Personal Again, The Biggest Unix Security Loophole, The monospace Web, What a FreeBSD kernel message about your bridge means, Installing FreeBSD on a HP 250 G9, Networking for System Administrators, and more.</itunes:subtitle>
  <itunes:duration>47:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The PC is Dead: It’s Time to Make Computing Personal Again, The Biggest Unix Security Loophole, The monospace Web, What a FreeBSD kernel message about your bridge means, Installing FreeBSD on a HP 250 G9, Networking for System Administrators, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The PC is Dead: It’s Time to Make Computing Personal Again (https://www.vintagecomputing.com/index.php/archives/3292/the-pc-is-dead-its-time-to-make-computing-personal-again)
The Biggest Unix Security Loophole (https://www.tuhs.org/Archive/Documentation/TechReports/Bell_Labs/ReedsShellHoles.pdf)
News Roundup
The monospace Web (https://owickstrom.github.io/the-monospace-web/)
What a FreeBSD kernel message about your bridge means (https://utcc.utoronto.ca/~cks/space/blog/unix/FreeBSDBridgeMacMovedMessage)
Installing FreeBSD on a HP 250 G9 (https://brunopacheco1.github.io/posts/installing-freebsd-on-hp-250-g9/)
Networking for System Administrators (https://mwl.io/nonfiction/networking#n4sa)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, pc dead, personal computing, securit loophole, monospace, web, kernel message, bridge, HP 250 G9, networking, sysadmins, system administrators</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The PC is Dead: It’s Time to Make Computing Personal Again, The Biggest Unix Security Loophole, The monospace Web, What a FreeBSD kernel message about your bridge means, Installing FreeBSD on a HP 250 G9, Networking for System Administrators, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.vintagecomputing.com/index.php/archives/3292/the-pc-is-dead-its-time-to-make-computing-personal-again" rel="nofollow">The PC is Dead: It’s Time to Make Computing Personal Again</a></p>

<hr>

<p><a href="https://www.tuhs.org/Archive/Documentation/TechReports/Bell_Labs/ReedsShellHoles.pdf" rel="nofollow">The Biggest Unix Security Loophole</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://owickstrom.github.io/the-monospace-web/" rel="nofollow">The monospace Web</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FreeBSDBridgeMacMovedMessage" rel="nofollow">What a FreeBSD kernel message about your bridge means</a></p>

<hr>

<p><a href="https://brunopacheco1.github.io/posts/installing-freebsd-on-hp-250-g9/" rel="nofollow">Installing FreeBSD on a HP 250 G9</a></p>

<hr>

<p><a href="https://mwl.io/nonfiction/networking#n4sa" rel="nofollow">Networking for System Administrators</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The PC is Dead: It’s Time to Make Computing Personal Again, The Biggest Unix Security Loophole, The monospace Web, What a FreeBSD kernel message about your bridge means, Installing FreeBSD on a HP 250 G9, Networking for System Administrators, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.vintagecomputing.com/index.php/archives/3292/the-pc-is-dead-its-time-to-make-computing-personal-again" rel="nofollow">The PC is Dead: It’s Time to Make Computing Personal Again</a></p>

<hr>

<p><a href="https://www.tuhs.org/Archive/Documentation/TechReports/Bell_Labs/ReedsShellHoles.pdf" rel="nofollow">The Biggest Unix Security Loophole</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://owickstrom.github.io/the-monospace-web/" rel="nofollow">The monospace Web</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FreeBSDBridgeMacMovedMessage" rel="nofollow">What a FreeBSD kernel message about your bridge means</a></p>

<hr>

<p><a href="https://brunopacheco1.github.io/posts/installing-freebsd-on-hp-250-g9/" rel="nofollow">Installing FreeBSD on a HP 250 G9</a></p>

<hr>

<p><a href="https://mwl.io/nonfiction/networking#n4sa" rel="nofollow">Networking for System Administrators</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>600: The big 600</title>
  <link>https://www.bsdnow.tv/600</link>
  <guid isPermaLink="false">f0d54c0d-d906-41d5-bd19-01d14030d46c</guid>
  <pubDate>Thu, 27 Feb 2025 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f0d54c0d-d906-41d5-bd19-01d14030d46c.mp3" length="71599488" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Lead Asahi Developer stands down, moderators reminiscing about joining the podcast, Support for the Radxa Orian O6 board in OpenBSD, FreeBSD and hi-fi audio setup: bit-perfect, equalizer, real-time, OpenBGPD 8.8 released, and more</itunes:subtitle>
  <itunes:duration>1:14:34</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Lead Asahi Developer stands down, moderators reminiscing about joining the podcast, Support for the Radxa Orian O6 board in OpenBSD, FreeBSD and hi-fi audio setup: bit-perfect, equalizer, real-time, OpenBGPD 8.8 released, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Topics
Hector Martin stands down as lead developer on Asahi Linux (https://asahilinux.org/2025/02/passing-the-torch/)
No forward progress for Rust to be given first class status in the kernel
Having to maintain a thousand plus patches against a fast moving upstream
project (Linux Kernel)
Dwindling funds
What does this mean for sister projects like OpenBSD?
600th episode flash back
When did you come across BSDNow?
What are some of your highlights?
Where are we going in the future...?
What would we like to do for the show as hosts. Pie in the sky thinking and discussion.
Round Up
Support for the Radxa Orian O6 board in
OpenBSD (https://marc.info/?l=openbsd-arm&amp;amp;m=173823317816570&amp;amp;w=2)
As well, the NetBSD project is trying to bring up this board
Conversation around the state of ARM64 SoC and options
LibreSSL is not affected by the OpenSSL
vulnerabilities (https://www.securityweek.com/high-severity-openssl-vulnerability-found-by-apple-allows-mitm-attacks/)
announced today.
FreeBSD and hi-fi audio setup: bit-perfect, equalizer,
real-time (https://m4c.pl/blog/freebsd-audio-setup-bitperfect-equalizer-realtime/)
OpenBGPD 8.8
released (http://undeadly.org/cgi?action=article;sid=20250207192657)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
The Most Important Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/600/feedback/jt%20-%20the_most_important_question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, asahi linux, developer quit, moderators, good old times, radxa Orian, support, hifi, audio setup, equalizer, real-time, bit-perfect, OpenBGPD</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Lead Asahi Developer stands down, moderators reminiscing about joining the podcast, Support for the Radxa Orian O6 board in OpenBSD, FreeBSD and hi-fi audio setup: bit-perfect, equalizer, real-time, OpenBGPD 8.8 released, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Topics</h2>

<ul>
<li><a href="https://asahilinux.org/2025/02/passing-the-torch/" rel="nofollow">Hector Martin stands down as lead developer on Asahi Linux</a>

<ul>
<li>No forward progress for Rust to be given first class status in the kernel</li>
<li>Having to maintain a thousand plus patches against a fast moving upstream
project (Linux Kernel)</li>
<li>Dwindling funds</li>
<li>What does this mean for sister projects like OpenBSD?</li>
</ul></li>
</ul>

<h2>600th episode flash back</h2>

<ul>
<li>When did you come across BSDNow?</li>
<li>What are some of your highlights?</li>
<li>Where are we going in the future...?</li>
<li>What would we like to do for the show as hosts. Pie in the sky thinking and discussion.</li>
</ul>

<h2>Round Up</h2>

<ul>
<li><a href="https://marc.info/?l=openbsd-arm&m=173823317816570&w=2" rel="nofollow">Support for the Radxa Orian O6 board in
OpenBSD</a>

<ul>
<li>As well, the NetBSD project is trying to bring up this board</li>
<li>Conversation around the state of ARM64 SoC and options</li>
</ul></li>
<li>LibreSSL is not affected by the <a href="https://www.securityweek.com/high-severity-openssl-vulnerability-found-by-apple-allows-mitm-attacks/" rel="nofollow">OpenSSL
vulnerabilities</a>
announced today.</li>
<li><a href="https://m4c.pl/blog/freebsd-audio-setup-bitperfect-equalizer-realtime/" rel="nofollow">FreeBSD and hi-fi audio setup: bit-perfect, equalizer,
real-time</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250207192657" rel="nofollow">OpenBGPD 8.8
released</a></li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/600/feedback/jt%20-%20the_most_important_question.md" rel="nofollow">The Most Important Question</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Lead Asahi Developer stands down, moderators reminiscing about joining the podcast, Support for the Radxa Orian O6 board in OpenBSD, FreeBSD and hi-fi audio setup: bit-perfect, equalizer, real-time, OpenBGPD 8.8 released, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Topics</h2>

<ul>
<li><a href="https://asahilinux.org/2025/02/passing-the-torch/" rel="nofollow">Hector Martin stands down as lead developer on Asahi Linux</a>

<ul>
<li>No forward progress for Rust to be given first class status in the kernel</li>
<li>Having to maintain a thousand plus patches against a fast moving upstream
project (Linux Kernel)</li>
<li>Dwindling funds</li>
<li>What does this mean for sister projects like OpenBSD?</li>
</ul></li>
</ul>

<h2>600th episode flash back</h2>

<ul>
<li>When did you come across BSDNow?</li>
<li>What are some of your highlights?</li>
<li>Where are we going in the future...?</li>
<li>What would we like to do for the show as hosts. Pie in the sky thinking and discussion.</li>
</ul>

<h2>Round Up</h2>

<ul>
<li><a href="https://marc.info/?l=openbsd-arm&m=173823317816570&w=2" rel="nofollow">Support for the Radxa Orian O6 board in
OpenBSD</a>

<ul>
<li>As well, the NetBSD project is trying to bring up this board</li>
<li>Conversation around the state of ARM64 SoC and options</li>
</ul></li>
<li>LibreSSL is not affected by the <a href="https://www.securityweek.com/high-severity-openssl-vulnerability-found-by-apple-allows-mitm-attacks/" rel="nofollow">OpenSSL
vulnerabilities</a>
announced today.</li>
<li><a href="https://m4c.pl/blog/freebsd-audio-setup-bitperfect-equalizer-realtime/" rel="nofollow">FreeBSD and hi-fi audio setup: bit-perfect, equalizer,
real-time</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20250207192657" rel="nofollow">OpenBGPD 8.8
released</a></li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/600/feedback/jt%20-%20the_most_important_question.md" rel="nofollow">The Most Important Question</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>599: Core Infrastructure Control</title>
  <link>https://www.bsdnow.tv/599</link>
  <guid isPermaLink="false">c85482cc-e352-4131-8f1b-3d3bbc73567f</guid>
  <pubDate>Thu, 20 Feb 2025 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c85482cc-e352-4131-8f1b-3d3bbc73567f.mp3" length="58889472" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Controlling Your Core Infrastructure: DNS, Laptop Support and Usability Project Update, FreeBSD at FOSDEM 2025, Uploading a message to an IMAP server using curl, The Death of Email Forwarding, Cruising a VPS at OpenBSD Amsterdam, and more</itunes:subtitle>
  <itunes:duration>1:01:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Controlling Your Core Infrastructure: DNS, Laptop Support and Usability Project Update, FreeBSD at FOSDEM 2025, Uploading a message to an IMAP server using curl, The Death of Email Forwarding, Cruising a VPS at OpenBSD Amsterdam, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Controlling Your Core Infrastructure: DNS (https://klarasystems.com/articles/controlling-core-infrastructure-dns-server-setup/)
Laptop Support and Usability Project Update: First Monthly Report &amp;amp; Community Initiatives (https://freebsdfoundation.org/blog/laptop-support-and-usability-project-update-first-monthly-report-community-initiatives/)
News Roundup
FreeBSD at FOSDEM 2025 (https://freebsdfoundation.org/blog/freebsd-at-fosdem-2025/)
Uploading a message to an IMAP server using curl (https://jpmens.net/2025/01/23/uploading-a-message-to-an-imap-server-using-curl/)
The Death of Email Forwarding (https://www.mythic-beasts.com/blog/2025/01/29/the-death-of-email-forwarding/)
Cruising a VPS at OpenBSD Amsterdam (https://www.tumfatig.net/2025/cruising-a-vps-at-openbsd-amsterdam/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, core Infrastructure, dns, laptop support, usability project, fosdem 2025, bsd devroom, upload, message, imap server, curl, email forwarding, vps, openbsd amsterdam</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Controlling Your Core Infrastructure: DNS, Laptop Support and Usability Project Update, FreeBSD at FOSDEM 2025, Uploading a message to an IMAP server using curl, The Death of Email Forwarding, Cruising a VPS at OpenBSD Amsterdam, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/controlling-core-infrastructure-dns-server-setup/" rel="nofollow">Controlling Your Core Infrastructure: DNS</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/laptop-support-and-usability-project-update-first-monthly-report-community-initiatives/" rel="nofollow">Laptop Support and Usability Project Update: First Monthly Report &amp; Community Initiatives</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://freebsdfoundation.org/blog/freebsd-at-fosdem-2025/" rel="nofollow">FreeBSD at FOSDEM 2025</a></p>

<hr>

<p><a href="https://jpmens.net/2025/01/23/uploading-a-message-to-an-imap-server-using-curl/" rel="nofollow">Uploading a message to an IMAP server using curl</a></p>

<hr>

<p><a href="https://www.mythic-beasts.com/blog/2025/01/29/the-death-of-email-forwarding/" rel="nofollow">The Death of Email Forwarding</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2025/cruising-a-vps-at-openbsd-amsterdam/" rel="nofollow">Cruising a VPS at OpenBSD Amsterdam</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Controlling Your Core Infrastructure: DNS, Laptop Support and Usability Project Update, FreeBSD at FOSDEM 2025, Uploading a message to an IMAP server using curl, The Death of Email Forwarding, Cruising a VPS at OpenBSD Amsterdam, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/controlling-core-infrastructure-dns-server-setup/" rel="nofollow">Controlling Your Core Infrastructure: DNS</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/laptop-support-and-usability-project-update-first-monthly-report-community-initiatives/" rel="nofollow">Laptop Support and Usability Project Update: First Monthly Report &amp; Community Initiatives</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://freebsdfoundation.org/blog/freebsd-at-fosdem-2025/" rel="nofollow">FreeBSD at FOSDEM 2025</a></p>

<hr>

<p><a href="https://jpmens.net/2025/01/23/uploading-a-message-to-an-imap-server-using-curl/" rel="nofollow">Uploading a message to an IMAP server using curl</a></p>

<hr>

<p><a href="https://www.mythic-beasts.com/blog/2025/01/29/the-death-of-email-forwarding/" rel="nofollow">The Death of Email Forwarding</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2025/cruising-a-vps-at-openbsd-amsterdam/" rel="nofollow">Cruising a VPS at OpenBSD Amsterdam</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>598: UFS1 up-to-date</title>
  <link>https://www.bsdnow.tv/598</link>
  <guid isPermaLink="false">19a5739c-2755-4cee-a0e0-8803f3bc9cbc</guid>
  <pubDate>Thu, 13 Feb 2025 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/19a5739c-2755-4cee-a0e0-8803f3bc9cbc.mp3" length="63105024" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Key Considerations for Benchmarking Network Storage Performance, OpenZFS 2.3.0 available, Updates on AsiaBSDcon, GhostBSD Desktop Conference, Recovering from external zroot, Create a new issue in a Github repository with Ansible, Stories I refuse to believe, date limit in UFS1 filesystem extended, and more</itunes:subtitle>
  <itunes:duration>1:05:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Key Considerations for Benchmarking Network Storage Performance, OpenZFS 2.3.0 available, Updates on AsiaBSDcon, GhostBSD Desktop Conference, Recovering from external zroot, Create a new issue in a Github repository with Ansible, Stories I refuse to believe, date limit in UFS1 filesystem extended, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Key Considerations for Benchmarking Network Storage Performance (https://klarasystems.com/articles/considerations-benchmarking-network-storage-performance/)
OpenZFS 2.3.0 available (https://github.com/openzfs/zfs/releases/tag/zfs-2.3.0)
News Roundup
Updates on AsiaBSDCon 2025 - Cancelled -  (https://lists.asiabsdcon.org/pipermail/announce/2025-January/000046.html)
GhostBSD Desktop Conference (https://www.phoronix.com/news/BSD-Desktop-Conference-GhostBSD)
Recovering from external zroot (https://adventurist.me/posts/00350)
Create a new issue in a Github repository with Ansible (https://jpmens.net/2025/01/25/create-a-new-issue-in-a-github-repository/)
Stories I refuse to believe (https://flak.tedunangst.com/post/stories-i-refuse-to-believe)
Defer the January 19, 2038 date limit in UFS1 filesystems to February 7, 2106 (https://cgit.freebsd.org/src/commit/?id=1111a44301da39d7b7459c784230e1405e8980f8)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Feedback - Nelson - Ada/GCC (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/598/feedback/Nelson%20Feedback.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, considerations, benchmarking, network storage performance, openzfs 2.3.0, asiabsdcon, ghostbsd, desktop conference, recovering, external zroot, github issue, ansible, stories, date limit, ufs1</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Key Considerations for Benchmarking Network Storage Performance, OpenZFS 2.3.0 available, Updates on AsiaBSDcon, GhostBSD Desktop Conference, Recovering from external zroot, Create a new issue in a Github repository with Ansible, Stories I refuse to believe, date limit in UFS1 filesystem extended, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/considerations-benchmarking-network-storage-performance/" rel="nofollow">Key Considerations for Benchmarking Network Storage Performance</a></p>

<hr>

<p><a href="https://github.com/openzfs/zfs/releases/tag/zfs-2.3.0" rel="nofollow">OpenZFS 2.3.0 available</a></p>

<h2>News Roundup</h2>

<p><a href="https://lists.asiabsdcon.org/pipermail/announce/2025-January/000046.html" rel="nofollow">Updates on AsiaBSDCon 2025 - Cancelled - </a></p>

<hr>

<p><a href="https://www.phoronix.com/news/BSD-Desktop-Conference-GhostBSD" rel="nofollow">GhostBSD Desktop Conference</a></p>

<hr>

<p><a href="https://adventurist.me/posts/00350" rel="nofollow">Recovering from external zroot</a></p>

<hr>

<p><a href="https://jpmens.net/2025/01/25/create-a-new-issue-in-a-github-repository/" rel="nofollow">Create a new issue in a Github repository with Ansible</a></p>

<hr>

<p><a href="https://flak.tedunangst.com/post/stories-i-refuse-to-believe" rel="nofollow">Stories I refuse to believe</a></p>

<hr>

<p><a href="https://cgit.freebsd.org/src/commit/?id=1111a44301da39d7b7459c784230e1405e8980f8" rel="nofollow">Defer the January 19, 2038 date limit in UFS1 filesystems to February 7, 2106</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/598/feedback/Nelson%20Feedback.md" rel="nofollow">Feedback - Nelson - Ada/GCC</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Key Considerations for Benchmarking Network Storage Performance, OpenZFS 2.3.0 available, Updates on AsiaBSDcon, GhostBSD Desktop Conference, Recovering from external zroot, Create a new issue in a Github repository with Ansible, Stories I refuse to believe, date limit in UFS1 filesystem extended, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/considerations-benchmarking-network-storage-performance/" rel="nofollow">Key Considerations for Benchmarking Network Storage Performance</a></p>

<hr>

<p><a href="https://github.com/openzfs/zfs/releases/tag/zfs-2.3.0" rel="nofollow">OpenZFS 2.3.0 available</a></p>

<h2>News Roundup</h2>

<p><a href="https://lists.asiabsdcon.org/pipermail/announce/2025-January/000046.html" rel="nofollow">Updates on AsiaBSDCon 2025 - Cancelled - </a></p>

<hr>

<p><a href="https://www.phoronix.com/news/BSD-Desktop-Conference-GhostBSD" rel="nofollow">GhostBSD Desktop Conference</a></p>

<hr>

<p><a href="https://adventurist.me/posts/00350" rel="nofollow">Recovering from external zroot</a></p>

<hr>

<p><a href="https://jpmens.net/2025/01/25/create-a-new-issue-in-a-github-repository/" rel="nofollow">Create a new issue in a Github repository with Ansible</a></p>

<hr>

<p><a href="https://flak.tedunangst.com/post/stories-i-refuse-to-believe" rel="nofollow">Stories I refuse to believe</a></p>

<hr>

<p><a href="https://cgit.freebsd.org/src/commit/?id=1111a44301da39d7b7459c784230e1405e8980f8" rel="nofollow">Defer the January 19, 2038 date limit in UFS1 filesystems to February 7, 2106</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/598/feedback/Nelson%20Feedback.md" rel="nofollow">Feedback - Nelson - Ada/GCC</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>597: OpenBSD FRAME sockets</title>
  <link>https://www.bsdnow.tv/597</link>
  <guid isPermaLink="false">d45f0603-f1a4-4fe7-b5c7-f1fac7e618cf</guid>
  <pubDate>Thu, 06 Feb 2025 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d45f0603-f1a4-4fe7-b5c7-f1fac7e618cf.mp3" length="49006464" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Do-Not-Stab flag in the HTTP Header, FreeBSD jail host with multiple local networks, Generative AI is for the idea guys, Static dual stack networking on OmniOS Solaris Zones, FRAME sockets added to OpenBSD, The problem with combining DNS CNAME records and anything else, and more</itunes:subtitle>
  <itunes:duration>51:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Do-Not-Stab flag in the HTTP Header, FreeBSD jail host with multiple local networks, Generative AI is for the idea guys, Static dual stack networking on OmniOS Solaris Zones, FRAME sockets added to OpenBSD, The problem with combining DNS CNAME records and anything else, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
(due to excessive use of the F-bomb, perhaps we should somewhat censor it... You can do so in words... or I can use Tom's favorite Frequency tone to do it in post). You decide and let me know what you think would be funnier.)
Also I'm hoping for some good commentary from you guys on this one. :P
The Do-Not-Stab flag in the HTTP Header (https://www.5snb.club/posts/2023/do-not-stab/)
FreeBSD jail host with multiple local networks (https://savagedlight.me/2014/03/07/freebsd-jail-host-with-multiple-local-networks/)
News Roundup
Generative AI is for the idea guys (https://rachsmith.com/ai-is-for-the-idea-guys/)
Static dual stack networking on OmniOS Solaris Zones (https://www.tumfatig.net/2024/static-dual-stack-networking-on-omnios-solaris-zones/)
FRAME sockets added to OpenBSD (https://www.undeadly.org/cgi?action=article;sid=20241219080430)
The problem with combining DNS CNAME records and anything else (https://utcc.utoronto.ca/~cks/space/blog/tech/DNSCNAMEAndOthersWhyNot)
Conference Bits
BSD-NL (https://bsdnl.nl/)
BSDCan (https://www.bsdcan.org/2025/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, do-not-stab, http header flag, jail host, multiple networks, generative ai, static dual stack network, omnios solaris zones, FRAME sockets, DNS CNAME records</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Do-Not-Stab flag in the HTTP Header, FreeBSD jail host with multiple local networks, Generative AI is for the idea guys, Static dual stack networking on OmniOS Solaris Zones, FRAME sockets added to OpenBSD, The problem with combining DNS CNAME records and anything else, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p>(due to excessive use of the F-bomb, perhaps we should somewhat censor it... You can do so in words... or I can use Tom&#39;s favorite Frequency tone to do it in post). You decide and let me know what you think would be funnier.)<br>
Also I&#39;m hoping for some good commentary from you guys on this one. :P</p>

<p><a href="https://www.5snb.club/posts/2023/do-not-stab/" rel="nofollow">The Do-Not-Stab flag in the HTTP Header</a></p>

<hr>

<p><a href="https://savagedlight.me/2014/03/07/freebsd-jail-host-with-multiple-local-networks/" rel="nofollow">FreeBSD jail host with multiple local networks</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://rachsmith.com/ai-is-for-the-idea-guys/" rel="nofollow">Generative AI is for the idea guys</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/static-dual-stack-networking-on-omnios-solaris-zones/" rel="nofollow">Static dual stack networking on OmniOS Solaris Zones</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20241219080430" rel="nofollow">FRAME sockets added to OpenBSD</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/DNSCNAMEAndOthersWhyNot" rel="nofollow">The problem with combining DNS CNAME records and anything else</a></p>

<hr>

<h2>Conference Bits</h2>

<ul>
<li><a href="https://bsdnl.nl/" rel="nofollow">BSD-NL</a></li>
<li><a href="https://www.bsdcan.org/2025/" rel="nofollow">BSDCan</a></li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Do-Not-Stab flag in the HTTP Header, FreeBSD jail host with multiple local networks, Generative AI is for the idea guys, Static dual stack networking on OmniOS Solaris Zones, FRAME sockets added to OpenBSD, The problem with combining DNS CNAME records and anything else, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p>(due to excessive use of the F-bomb, perhaps we should somewhat censor it... You can do so in words... or I can use Tom&#39;s favorite Frequency tone to do it in post). You decide and let me know what you think would be funnier.)<br>
Also I&#39;m hoping for some good commentary from you guys on this one. :P</p>

<p><a href="https://www.5snb.club/posts/2023/do-not-stab/" rel="nofollow">The Do-Not-Stab flag in the HTTP Header</a></p>

<hr>

<p><a href="https://savagedlight.me/2014/03/07/freebsd-jail-host-with-multiple-local-networks/" rel="nofollow">FreeBSD jail host with multiple local networks</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://rachsmith.com/ai-is-for-the-idea-guys/" rel="nofollow">Generative AI is for the idea guys</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/static-dual-stack-networking-on-omnios-solaris-zones/" rel="nofollow">Static dual stack networking on OmniOS Solaris Zones</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20241219080430" rel="nofollow">FRAME sockets added to OpenBSD</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/DNSCNAMEAndOthersWhyNot" rel="nofollow">The problem with combining DNS CNAME records and anything else</a></p>

<hr>

<h2>Conference Bits</h2>

<ul>
<li><a href="https://bsdnl.nl/" rel="nofollow">BSD-NL</a></li>
<li><a href="https://www.bsdcan.org/2025/" rel="nofollow">BSDCan</a></li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>596: Globbing /etc</title>
  <link>https://www.bsdnow.tv/596</link>
  <guid isPermaLink="false">d8a12e80-5354-4428-9f66-d7d401df7ddd</guid>
  <pubDate>Thu, 30 Jan 2025 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d8a12e80-5354-4428-9f66-d7d401df7ddd.mp3" length="49622784" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Ridding my home network of IP addresses, Tools for Identifying and Resolving Storage Bottlenecks, OpenBGPD 8.7 released, Let's port the GNAT Ada compiler to macOS/aarch64, Modify an OmniOS service parameters, The history and use of /etc/glob in early Unixes, and more</itunes:subtitle>
  <itunes:duration>51:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Ridding my home network of IP addresses, Tools for Identifying and Resolving Storage Bottlenecks, OpenBGPD 8.7 released, Let's port the GNAT Ada compiler to macOS/aarch64, Modify an OmniOS service parameters, The history and use of /etc/glob in early Unixes, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Ridding my home network of IP addresses (https://gist.github.com/jmason/aabd9d3acc86d9098654e8559e93b707)
Tools for Identifying and Resolving Storage Bottlenecks (https://klarasystems.com/articles/managing-tracking-storage-performance-openzfs-bottlenecks/)
News Roundup
OpenBGPD 8.7 released (https://www.undeadly.org/cgi?action=article;sid=20241218195732)
Let's port the GNAT Ada compiler to macOS/aarch64 (https://briancallahan.net/blog/20250112.html)
Modify an OmniOS service parameters (https://www.tumfatig.net/2025/modify-an-omnios-service-parameters/)
The history and use of /etc/glob in early Unixes (https://utcc.utoronto.ca/~cks/space/blog/unix/EtcGlobHistory)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Nelson - TUHS  (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/596/feedback/nelson-tuhs.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, ip addresses, indentify, resolve, storage bottleneck, OpenBGPD, GNAT ADA compiler, macOS/aarch64, omnios service parameters, /etc/glob</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Ridding my home network of IP addresses, Tools for Identifying and Resolving Storage Bottlenecks, OpenBGPD 8.7 released, Let&#39;s port the GNAT Ada compiler to macOS/aarch64, Modify an OmniOS service parameters, The history and use of /etc/glob in early Unixes, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://gist.github.com/jmason/aabd9d3acc86d9098654e8559e93b707" rel="nofollow">Ridding my home network of IP addresses</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/managing-tracking-storage-performance-openzfs-bottlenecks/" rel="nofollow">Tools for Identifying and Resolving Storage Bottlenecks</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20241218195732" rel="nofollow">OpenBGPD 8.7 released</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20250112.html" rel="nofollow">Let&#39;s port the GNAT Ada compiler to macOS/aarch64</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2025/modify-an-omnios-service-parameters/" rel="nofollow">Modify an OmniOS service parameters</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/EtcGlobHistory" rel="nofollow">The history and use of /etc/glob in early Unixes</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/596/feedback/nelson-tuhs.md" rel="nofollow">Nelson - TUHS </a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Ridding my home network of IP addresses, Tools for Identifying and Resolving Storage Bottlenecks, OpenBGPD 8.7 released, Let&#39;s port the GNAT Ada compiler to macOS/aarch64, Modify an OmniOS service parameters, The history and use of /etc/glob in early Unixes, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://gist.github.com/jmason/aabd9d3acc86d9098654e8559e93b707" rel="nofollow">Ridding my home network of IP addresses</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/managing-tracking-storage-performance-openzfs-bottlenecks/" rel="nofollow">Tools for Identifying and Resolving Storage Bottlenecks</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20241218195732" rel="nofollow">OpenBGPD 8.7 released</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20250112.html" rel="nofollow">Let&#39;s port the GNAT Ada compiler to macOS/aarch64</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2025/modify-an-omnios-service-parameters/" rel="nofollow">Modify an OmniOS service parameters</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/EtcGlobHistory" rel="nofollow">The history and use of /etc/glob in early Unixes</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/596/feedback/nelson-tuhs.md" rel="nofollow">Nelson - TUHS </a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>595: Arc: the Triumph</title>
  <link>https://www.bsdnow.tv/595</link>
  <guid isPermaLink="false">2773a8f7-f763-4055-a36b-f722e1b273e6</guid>
  <pubDate>Thu, 23 Jan 2025 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2773a8f7-f763-4055-a36b-f722e1b273e6.mp3" length="104050944" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Applying the ARC Algorithm to the ARC, Advancing Cloud Native Containers on FreeBSD: Podman Testing Highlights, Running Web Browsers in FreeBSD Jail, Fixing pf not allowing IPv6 traffic on FreeBSD, Minitel: The Online World France Built Before the Web, Why Google Stores Billions of Lines of Code in a Single Repository, and more</itunes:subtitle>
  <itunes:duration>1:48:23</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Applying the ARC Algorithm to the ARC, Advancing Cloud Native Containers on FreeBSD: Podman Testing Highlights, Running Web Browsers in FreeBSD Jail, Fixing pf not allowing IPv6 traffic on FreeBSD, Minitel: The Online World France Built Before the Web, Why Google Stores Billions of Lines of Code in a Single Repository, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Applying the ARC Algorithm to the ARC (https://klarasystems.com/articles/applying-the-arc-algorithm-to-the-arc/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
Advancing Cloud Native Containers on FreeBSD: Podman Testing Highlights (https://freebsdfoundation.org/blog/advancing-cloud-native-containers-on-freebsd-podman-testing-highlights/)
News Roundup
Running Web Browsers in FreeBSD Jail (https://tumfatig.net/2024/running-web-browsers-in-freebsd-jail/)
Fixing pf not allowing IPv6 traffic on FreeBSD (https://www.ncartron.org/fixing-pf-not-allowing-ipv6-traffic-on-freebsd.html)
Minitel: The Online World France Built Before the Web (https://spectrum.ieee.org/minitel-the-online-world-france-built-before-the-web)
Why Google Stores Billions of Lines of Code in a Single Repository (https://cacm.acm.org/research/why-google-stores-billions-of-lines-of-code-in-a-single-repository/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Sam - EDR Support (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/595/feedback/Sam%20-%20EDR%20Support.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, arc, adaptive replacement cache, Algorithm, cloud native, Containers, podman, testing, browser, jailed browser, pf, packet filter, firewall, ipv6 traffic, minitel, france, google inc. repository</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Applying the ARC Algorithm to the ARC, Advancing Cloud Native Containers on FreeBSD: Podman Testing Highlights, Running Web Browsers in FreeBSD Jail, Fixing pf not allowing IPv6 traffic on FreeBSD, Minitel: The Online World France Built Before the Web, Why Google Stores Billions of Lines of Code in a Single Repository, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/applying-the-arc-algorithm-to-the-arc/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Applying the ARC Algorithm to the ARC</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/advancing-cloud-native-containers-on-freebsd-podman-testing-highlights/" rel="nofollow">Advancing Cloud Native Containers on FreeBSD: Podman Testing Highlights</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://tumfatig.net/2024/running-web-browsers-in-freebsd-jail/" rel="nofollow">Running Web Browsers in FreeBSD Jail</a></p>

<hr>

<p><a href="https://www.ncartron.org/fixing-pf-not-allowing-ipv6-traffic-on-freebsd.html" rel="nofollow">Fixing pf not allowing IPv6 traffic on FreeBSD</a></p>

<hr>

<p><a href="https://spectrum.ieee.org/minitel-the-online-world-france-built-before-the-web" rel="nofollow">Minitel: The Online World France Built Before the Web</a></p>

<hr>

<p><a href="https://cacm.acm.org/research/why-google-stores-billions-of-lines-of-code-in-a-single-repository/" rel="nofollow">Why Google Stores Billions of Lines of Code in a Single Repository</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/595/feedback/Sam%20-%20EDR%20Support.md" rel="nofollow">Sam - EDR Support</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Applying the ARC Algorithm to the ARC, Advancing Cloud Native Containers on FreeBSD: Podman Testing Highlights, Running Web Browsers in FreeBSD Jail, Fixing pf not allowing IPv6 traffic on FreeBSD, Minitel: The Online World France Built Before the Web, Why Google Stores Billions of Lines of Code in a Single Repository, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/applying-the-arc-algorithm-to-the-arc/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Applying the ARC Algorithm to the ARC</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/advancing-cloud-native-containers-on-freebsd-podman-testing-highlights/" rel="nofollow">Advancing Cloud Native Containers on FreeBSD: Podman Testing Highlights</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://tumfatig.net/2024/running-web-browsers-in-freebsd-jail/" rel="nofollow">Running Web Browsers in FreeBSD Jail</a></p>

<hr>

<p><a href="https://www.ncartron.org/fixing-pf-not-allowing-ipv6-traffic-on-freebsd.html" rel="nofollow">Fixing pf not allowing IPv6 traffic on FreeBSD</a></p>

<hr>

<p><a href="https://spectrum.ieee.org/minitel-the-online-world-france-built-before-the-web" rel="nofollow">Minitel: The Online World France Built Before the Web</a></p>

<hr>

<p><a href="https://cacm.acm.org/research/why-google-stores-billions-of-lines-of-code-in-a-single-repository/" rel="nofollow">Why Google Stores Billions of Lines of Code in a Single Repository</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/595/feedback/Sam%20-%20EDR%20Support.md" rel="nofollow">Sam - EDR Support</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>594: Name that Domain</title>
  <link>https://www.bsdnow.tv/594</link>
  <guid isPermaLink="false">d9d3402b-e9ab-4a53-8865-04a1bb8ae732</guid>
  <pubDate>Thu, 16 Jan 2025 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d9d3402b-e9ab-4a53-8865-04a1bb8ae732.mp3" length="67824384" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Security Audit of the Capsicum and bhyve Subsystems, ZFS on Linux and block IO limits show some limits of being out of the kernel, NetBSD on a ROCK64 Board, Domain Naming, BSDCan 2025 CFP, The Internet Gopher from Minnesota, and more</itunes:subtitle>
  <itunes:duration>1:10:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Security Audit of the Capsicum and bhyve Subsystems, ZFS on Linux and block IO limits show some limits of being out of the kernel, NetBSD on a ROCK64 Board, Domain Naming, BSDCan 2025 CFP, The Internet Gopher from Minnesota, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Roundup Storage and Network Diagnostics (https://klarasystems.com/articles/winter_2024_roundup_storage_and_network_diagnostics/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
Security Audit of the
Capsicum and bhyve
Subsystems (https://freebsdfoundation.org/wp-content/uploads/2024/11/2024_Code_Audit_Capsicum_Bhyve_FreeBSD_Foundation.pdf)
News Roundup
ZFS on Linux and block IO limits show some limits of being out of the kernel (https://utcc.utoronto.ca/~cks/space/blog/linux/ZFSOnLinuxVersusBlockIOLimits)
NetBSD on a ROCK64 Board (https://simonevellei.com/blog/posts/netbsd-on-a-rock64-board/)
Domain Naming (https://ambient.institute/domain-naming/)
BSDCan 2025 CFP (https://www.bsdcan.org/2025/papers.html)
The Internet Gopher from Minnesota (https://www.abortretry.fail/p/the-internet-gopher-from-minnesota)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brendan - MinIO (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/594/feedback/Brendan%20-%20minio.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, security, audit, Capsicum, bhyve, Subsystems, block io limits, rock64 board, domain naming, gopher, Minnesota</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Security Audit of the Capsicum and bhyve Subsystems, ZFS on Linux and block IO limits show some limits of being out of the kernel, NetBSD on a ROCK64 Board, Domain Naming, BSDCan 2025 CFP, The Internet Gopher from Minnesota, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/winter_2024_roundup_storage_and_network_diagnostics/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Roundup Storage and Network Diagnostics</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/wp-content/uploads/2024/11/2024_Code_Audit_Capsicum_Bhyve_FreeBSD_Foundation.pdf" rel="nofollow">Security Audit of the<br>
Capsicum and bhyve<br>
Subsystems</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSOnLinuxVersusBlockIOLimits" rel="nofollow">ZFS on Linux and block IO limits show some limits of being out of the kernel</a></p>

<hr>

<p><a href="https://simonevellei.com/blog/posts/netbsd-on-a-rock64-board/" rel="nofollow">NetBSD on a ROCK64 Board</a></p>

<hr>

<p><a href="https://ambient.institute/domain-naming/" rel="nofollow">Domain Naming</a></p>

<hr>

<p><a href="https://www.bsdcan.org/2025/papers.html" rel="nofollow">BSDCan 2025 CFP</a></p>

<hr>

<p><a href="https://www.abortretry.fail/p/the-internet-gopher-from-minnesota" rel="nofollow">The Internet Gopher from Minnesota</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/594/feedback/Brendan%20-%20minio.md" rel="nofollow">Brendan - MinIO</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Security Audit of the Capsicum and bhyve Subsystems, ZFS on Linux and block IO limits show some limits of being out of the kernel, NetBSD on a ROCK64 Board, Domain Naming, BSDCan 2025 CFP, The Internet Gopher from Minnesota, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/winter_2024_roundup_storage_and_network_diagnostics/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Roundup Storage and Network Diagnostics</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/wp-content/uploads/2024/11/2024_Code_Audit_Capsicum_Bhyve_FreeBSD_Foundation.pdf" rel="nofollow">Security Audit of the<br>
Capsicum and bhyve<br>
Subsystems</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSOnLinuxVersusBlockIOLimits" rel="nofollow">ZFS on Linux and block IO limits show some limits of being out of the kernel</a></p>

<hr>

<p><a href="https://simonevellei.com/blog/posts/netbsd-on-a-rock64-board/" rel="nofollow">NetBSD on a ROCK64 Board</a></p>

<hr>

<p><a href="https://ambient.institute/domain-naming/" rel="nofollow">Domain Naming</a></p>

<hr>

<p><a href="https://www.bsdcan.org/2025/papers.html" rel="nofollow">BSDCan 2025 CFP</a></p>

<hr>

<p><a href="https://www.abortretry.fail/p/the-internet-gopher-from-minnesota" rel="nofollow">The Internet Gopher from Minnesota</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/594/feedback/Brendan%20-%20minio.md" rel="nofollow">Brendan - MinIO</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>593: rc.conf Validator</title>
  <link>https://www.bsdnow.tv/593</link>
  <guid isPermaLink="false">883c889f-8d16-4519-9be7-b863d68902e4</guid>
  <pubDate>Thu, 09 Jan 2025 11:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/883c889f-8d16-4519-9be7-b863d68902e4.mp3" length="55485696" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD replaces sendmail with dma, Why We Use FreeBSD Over Linux: A CTO’s Perspective, How I fell in love with OpenBSD, A GDC package for macOS/aarch64, Validate Your FreeBSD rc.conf, Replacing Proxmox with FreeBSD and Bhyve, OPNsense 24.7.10 released, Printing With FreeBSD, and more</itunes:subtitle>
  <itunes:duration>57:47</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD replaces sendmail with dma, Why We Use FreeBSD Over Linux: A CTO’s Perspective, How I fell in love with OpenBSD, A GDC package for macOS/aarch64, Validate Your FreeBSD rc.conf, Replacing Proxmox with FreeBSD and Bhyve, OPNsense 24.7.10 released, Printing With FreeBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD replaces sendmail with dma (https://klarasystems.com/articles/freebsd14-replaces-sendmail-with-dma/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
Why We Use FreeBSD Over Linux: A CTO’s Perspective (https://dzone.com/articles/why-we-use-freebsd-over-linux-a-ctos-perspective)
News Roundup
How I fell in love with OpenBSD (https://h3artbl33d.nl/blog/how-i-fell-in-love-with-openbsd)
A GDC package for macOS/aarch64 (https://briancallahan.net/blog/)
Validate Your FreeBSD rc.conf (https://dev.to/scovl/validate-your-freebsd-rcconf-e94)
Replacing Proxmox with FreeBSD and Bhyve (https://abnml.com/blog/2024/11/26/replacing-proxmox-with-freebsd-and-bhyve/)
OPNsense 24.7.10 released (https://forum.opnsense.org/index.php?topic=44413.0)
Printing With FreeBSD (https://blog.smithfamily.org.uk/posts/2024/11/freebsd_print/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Christian - Deprecated vs Depreciated (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/593/feedback/Christian%20-%20Deprecated%20vs%20Depreciated.md)
Producer Note
Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there's nothing I can do about that, but I wanted everyone to be aware that.
Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, sendmail, dma, dragonfly mail agent, cto perspective, fell in love, gdc package, macos/aarch64, validate, validation, rc.conf, replace, replacement, replacing, proxmox, bhyve, opnsense 24.7.10, printing</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD replaces sendmail with dma, Why We Use FreeBSD Over Linux: A CTO’s Perspective, How I fell in love with OpenBSD, A GDC package for macOS/aarch64, Validate Your FreeBSD rc.conf, Replacing Proxmox with FreeBSD and Bhyve, OPNsense 24.7.10 released, Printing With FreeBSD, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/freebsd14-replaces-sendmail-with-dma/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">FreeBSD replaces sendmail with dma</a></p>

<hr>

<p><a href="https://dzone.com/articles/why-we-use-freebsd-over-linux-a-ctos-perspective" rel="nofollow">Why We Use FreeBSD Over Linux: A CTO’s Perspective</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://h3artbl33d.nl/blog/how-i-fell-in-love-with-openbsd" rel="nofollow">How I fell in love with OpenBSD</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/" rel="nofollow">A GDC package for macOS/aarch64</a></p>

<hr>

<p><a href="https://dev.to/scovl/validate-your-freebsd-rcconf-e94" rel="nofollow">Validate Your FreeBSD rc.conf</a></p>

<hr>

<p><a href="https://abnml.com/blog/2024/11/26/replacing-proxmox-with-freebsd-and-bhyve/" rel="nofollow">Replacing Proxmox with FreeBSD and Bhyve</a></p>

<hr>

<p><a href="https://forum.opnsense.org/index.php?topic=44413.0" rel="nofollow">OPNsense 24.7.10 released</a></p>

<hr>

<p><a href="https://blog.smithfamily.org.uk/posts/2024/11/freebsd_print/" rel="nofollow">Printing With FreeBSD</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/593/feedback/Christian%20-%20Deprecated%20vs%20Depreciated.md" rel="nofollow">Christian - Deprecated vs Depreciated</a></li>
</ul>

<hr>

<h2>Producer Note</h2>

<ul>
<li>Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there&#39;s nothing I can do about that, but I wanted everyone to be aware that.</li>
<li>Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD replaces sendmail with dma, Why We Use FreeBSD Over Linux: A CTO’s Perspective, How I fell in love with OpenBSD, A GDC package for macOS/aarch64, Validate Your FreeBSD rc.conf, Replacing Proxmox with FreeBSD and Bhyve, OPNsense 24.7.10 released, Printing With FreeBSD, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/freebsd14-replaces-sendmail-with-dma/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">FreeBSD replaces sendmail with dma</a></p>

<hr>

<p><a href="https://dzone.com/articles/why-we-use-freebsd-over-linux-a-ctos-perspective" rel="nofollow">Why We Use FreeBSD Over Linux: A CTO’s Perspective</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://h3artbl33d.nl/blog/how-i-fell-in-love-with-openbsd" rel="nofollow">How I fell in love with OpenBSD</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/" rel="nofollow">A GDC package for macOS/aarch64</a></p>

<hr>

<p><a href="https://dev.to/scovl/validate-your-freebsd-rcconf-e94" rel="nofollow">Validate Your FreeBSD rc.conf</a></p>

<hr>

<p><a href="https://abnml.com/blog/2024/11/26/replacing-proxmox-with-freebsd-and-bhyve/" rel="nofollow">Replacing Proxmox with FreeBSD and Bhyve</a></p>

<hr>

<p><a href="https://forum.opnsense.org/index.php?topic=44413.0" rel="nofollow">OPNsense 24.7.10 released</a></p>

<hr>

<p><a href="https://blog.smithfamily.org.uk/posts/2024/11/freebsd_print/" rel="nofollow">Printing With FreeBSD</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/593/feedback/Christian%20-%20Deprecated%20vs%20Depreciated.md" rel="nofollow">Christian - Deprecated vs Depreciated</a></li>
</ul>

<hr>

<h2>Producer Note</h2>

<ul>
<li>Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there&#39;s nothing I can do about that, but I wanted everyone to be aware that.</li>
<li>Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>592: Wohoo, FreeBSD 14.2</title>
  <link>https://www.bsdnow.tv/592</link>
  <guid isPermaLink="false">2ecb01c8-6c1f-4c02-a29f-0cd773b80736</guid>
  <pubDate>Thu, 02 Jan 2025 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2ecb01c8-6c1f-4c02-a29f-0cd773b80736.mp3" length="59144448" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>ZFS Storage Fault Management, FreeBSD 14.2-RELEASE Announcement, I feel that NAT is inevitable even with IPv6, Spell checking in Vim, OpenBSD Memory Conflict Messages, The Biggest Shell Programs in the World, and more</itunes:subtitle>
  <itunes:duration>1:01:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>ZFS Storage Fault Management, FreeBSD 14.2-RELEASE Announcement, I feel that NAT is inevitable even with IPv6, Spell checking in Vim, OpenBSD Memory Conflict Messages, The Biggest Shell Programs in the World, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
ZFS Storage Fault Management (https://klarasystems.com/articles/zfs-storage-fault-management-linux/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
FreeBSD 14.2-RELEASE Announcement (https://www.freebsd.org/releases/14.2R/announce/)
News Roundup
I feel that NAT is inevitable even with IPv6 (https://utcc.utoronto.ca/~cks/space/blog/tech/IPv6AndStillHavingNAT)
Spell checking in Vim (https://www.tumfatig.net/2024/spell-checking-in-vim/)
OpenBSD Memory Conflict Messages (https://utcc.utoronto.ca/~cks/space/blog/unix/OpenBSDMemoryConflictMessages)
The Biggest Shell Programs in the World (https://github.com/oils-for-unix/oils/wiki/The-Biggest-Shell-Programs-in-the-World)
Beastie Bits
The Connectivity of Things: Network Cultures since 1832 (https://direct.mit.edu/books/oa-monograph/5866/The-Connectivity-of-ThingsNetwork-Cultures-since)
Initial list of 21 EuroBSDcon 2024 videos released (https://www.undeadly.org/cgi?action=article;sid=20241130184249)
-current now has more flexible performance policy (https://www.undeadly.org/cgi?action=article;sid=20241129093132)
OpenBSD 5.1 on Sun Ultra 5 (https://eggflix.foolbazar.eu/w/fa211a4f-6984-4c03-a6d2-b8c329d9459d)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/592/feedback/Phillip%20-%20regressions.md
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, storage fault management, 14.2, announcement, NAT, ipv6, spell checking, memory conflict messages, block i/o, limits, biggest shell programs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>ZFS Storage Fault Management, FreeBSD 14.2-RELEASE Announcement, I feel that NAT is inevitable even with IPv6, Spell checking in Vim, OpenBSD Memory Conflict Messages, The Biggest Shell Programs in the World, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/zfs-storage-fault-management-linux/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS Storage Fault Management</a></p>

<hr>

<p><a href="https://www.freebsd.org/releases/14.2R/announce/" rel="nofollow">FreeBSD 14.2-RELEASE Announcement</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/IPv6AndStillHavingNAT" rel="nofollow">I feel that NAT is inevitable even with IPv6</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/spell-checking-in-vim/" rel="nofollow">Spell checking in Vim</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/OpenBSDMemoryConflictMessages" rel="nofollow">OpenBSD Memory Conflict Messages</a></p>

<hr>

<p><a href="https://github.com/oils-for-unix/oils/wiki/The-Biggest-Shell-Programs-in-the-World" rel="nofollow">The Biggest Shell Programs in the World</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://direct.mit.edu/books/oa-monograph/5866/The-Connectivity-of-ThingsNetwork-Cultures-since" rel="nofollow">The Connectivity of Things: Network Cultures since 1832</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20241130184249" rel="nofollow">Initial list of 21 EuroBSDcon 2024 videos released</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20241129093132" rel="nofollow">-current now has more flexible performance policy</a></li>
<li><a href="https://eggflix.foolbazar.eu/w/fa211a4f-6984-4c03-a6d2-b8c329d9459d" rel="nofollow">OpenBSD 5.1 on Sun Ultra 5</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/592/feedback/Phillip%20-%20regressions.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/592/feedback/Phillip%20-%20regressions.md</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>ZFS Storage Fault Management, FreeBSD 14.2-RELEASE Announcement, I feel that NAT is inevitable even with IPv6, Spell checking in Vim, OpenBSD Memory Conflict Messages, The Biggest Shell Programs in the World, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/zfs-storage-fault-management-linux/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZFS Storage Fault Management</a></p>

<hr>

<p><a href="https://www.freebsd.org/releases/14.2R/announce/" rel="nofollow">FreeBSD 14.2-RELEASE Announcement</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/IPv6AndStillHavingNAT" rel="nofollow">I feel that NAT is inevitable even with IPv6</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/spell-checking-in-vim/" rel="nofollow">Spell checking in Vim</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/OpenBSDMemoryConflictMessages" rel="nofollow">OpenBSD Memory Conflict Messages</a></p>

<hr>

<p><a href="https://github.com/oils-for-unix/oils/wiki/The-Biggest-Shell-Programs-in-the-World" rel="nofollow">The Biggest Shell Programs in the World</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://direct.mit.edu/books/oa-monograph/5866/The-Connectivity-of-ThingsNetwork-Cultures-since" rel="nofollow">The Connectivity of Things: Network Cultures since 1832</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20241130184249" rel="nofollow">Initial list of 21 EuroBSDcon 2024 videos released</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20241129093132" rel="nofollow">-current now has more flexible performance policy</a></li>
<li><a href="https://eggflix.foolbazar.eu/w/fa211a4f-6984-4c03-a6d2-b8c329d9459d" rel="nofollow">OpenBSD 5.1 on Sun Ultra 5</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/592/feedback/Phillip%20-%20regressions.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/592/feedback/Phillip%20-%20regressions.md</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>591: The Three Wise Men (hosts)</title>
  <link>https://www.bsdnow.tv/591</link>
  <guid isPermaLink="false">4e0204d7-a10a-49be-9941-f68ea53c06c1</guid>
  <pubDate>Thu, 26 Dec 2024 00:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4e0204d7-a10a-49be-9941-f68ea53c06c1.mp3" length="68937600" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this special episode, we are interviewing ourselves with the questions that out audience asked us many moons ago. Stay tuned for some insights about hobbies, all things computers, projects, and a whole lot more. Have fun and happy holidays!</itunes:subtitle>
  <itunes:duration>1:11:48</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this special episode, we are interviewing ourselves with the questions that out audience asked us many moons ago. Stay tuned for some insights about hobbies, all things computers, projects, and a whole lot more. Have fun and happy holidays!
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Producer Note
Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there's nothing I can do about that, but I wanted everyone to be aware that.
Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this special episode, we are interviewing ourselves with the questions that out audience asked us many moons ago. Stay tuned for some insights about hobbies, all things computers, projects, and a whole lot more. Have fun and happy holidays!</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Producer Note</h2>

<ul>
<li>Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there&#39;s nothing I can do about that, but I wanted everyone to be aware that.</li>
<li>Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this special episode, we are interviewing ourselves with the questions that out audience asked us many moons ago. Stay tuned for some insights about hobbies, all things computers, projects, and a whole lot more. Have fun and happy holidays!</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Producer Note</h2>

<ul>
<li>Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there&#39;s nothing I can do about that, but I wanted everyone to be aware that.</li>
<li>Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>590: Single, not sorry</title>
  <link>https://www.bsdnow.tv/590</link>
  <guid isPermaLink="false">9d9a5838-ecb8-4f3d-b67e-d31a358ea5e4</guid>
  <pubDate>Thu, 19 Dec 2024 00:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9d9a5838-ecb8-4f3d-b67e-d31a358ea5e4.mp3" length="47339520" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this episode, Benedict shows some of the tools he loves to use including Markdown (producing PDFs and other docs using Pandoc), AWK, and Graphviz. A lot of tutorials and getting-started links in this practical-oriented episode for you.</itunes:subtitle>
  <itunes:duration>49:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this episode, Benedict shows some of the tools he loves to use including Markdown (producing PDFs and other docs using Pandoc), AWK, and Graphviz. A lot of tutorials and getting-started links in this practical-oriented episode for you.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The Markdown Guide (https://www.markdownguide.org/basic-syntax/)
The Pandoc Website (https://pandoc.org)
Using Pandoc and Typst to Produce
PDFs (https://imaginarytext.ca/posts/2024/pandoc-typst-tutorial)
Eisvogel LaTeX Pandoc template (https://github.com/enhuiz/eisvogel)
News Roundup
Awk in 20 Minutes (https://ferd.ca/awk-in-20-minutes.html)
Awk by Example (https://developer.ibm.com/tutorials/l-awk1/)
W3 Schools Tutorials (https://www.w3schools.com)
The dot Guide (https://graphviz.org/pdf/dotguide.pdf)
Introduction to Graphviz (https://ncona.com/2020/06/create-diagrams-with-code-using-graphviz/)
Browser-based Graphviz Editor SketchViz (https://sketchviz.com/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Producer Note
Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there's nothing I can do about that, but I wanted everyone to be aware that.
Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, markdown, md, pdf, pandoc, awk, graphviz, w3schools</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this episode, Benedict shows some of the tools he loves to use including Markdown (producing PDFs and other docs using Pandoc), AWK, and Graphviz. A lot of tutorials and getting-started links in this practical-oriented episode for you.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<hr>

<ul>
<li><p><a href="https://www.markdownguide.org/basic-syntax/" rel="nofollow">The Markdown Guide</a></p></li>
<li><p><a href="https://pandoc.org" rel="nofollow">The Pandoc Website</a></p></li>
<li><p><a href="https://imaginarytext.ca/posts/2024/pandoc-typst-tutorial" rel="nofollow">Using Pandoc and Typst to Produce<br>
PDFs</a></p></li>
<li><p><a href="https://github.com/enhuiz/eisvogel" rel="nofollow">Eisvogel LaTeX Pandoc template</a></p></li>
</ul>

<hr>

<h2>News Roundup</h2>

<ul>
<li><p><a href="https://ferd.ca/awk-in-20-minutes.html" rel="nofollow">Awk in 20 Minutes</a></p></li>
<li><p><a href="https://developer.ibm.com/tutorials/l-awk1/" rel="nofollow">Awk by Example</a></p></li>
</ul>

<hr>

<ul>
<li><a href="https://www.w3schools.com" rel="nofollow">W3 Schools Tutorials</a></li>
</ul>

<hr>

<ul>
<li><p><a href="https://graphviz.org/pdf/dotguide.pdf" rel="nofollow">The dot Guide</a></p></li>
<li><p><a href="https://ncona.com/2020/06/create-diagrams-with-code-using-graphviz/" rel="nofollow">Introduction to Graphviz</a></p></li>
<li><p><a href="https://sketchviz.com/" rel="nofollow">Browser-based Graphviz Editor SketchViz</a></p></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<h2>Producer Note</h2>

<ul>
<li>Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there&#39;s nothing I can do about that, but I wanted everyone to be aware that.</li>
<li>Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this episode, Benedict shows some of the tools he loves to use including Markdown (producing PDFs and other docs using Pandoc), AWK, and Graphviz. A lot of tutorials and getting-started links in this practical-oriented episode for you.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<hr>

<ul>
<li><p><a href="https://www.markdownguide.org/basic-syntax/" rel="nofollow">The Markdown Guide</a></p></li>
<li><p><a href="https://pandoc.org" rel="nofollow">The Pandoc Website</a></p></li>
<li><p><a href="https://imaginarytext.ca/posts/2024/pandoc-typst-tutorial" rel="nofollow">Using Pandoc and Typst to Produce<br>
PDFs</a></p></li>
<li><p><a href="https://github.com/enhuiz/eisvogel" rel="nofollow">Eisvogel LaTeX Pandoc template</a></p></li>
</ul>

<hr>

<h2>News Roundup</h2>

<ul>
<li><p><a href="https://ferd.ca/awk-in-20-minutes.html" rel="nofollow">Awk in 20 Minutes</a></p></li>
<li><p><a href="https://developer.ibm.com/tutorials/l-awk1/" rel="nofollow">Awk by Example</a></p></li>
</ul>

<hr>

<ul>
<li><a href="https://www.w3schools.com" rel="nofollow">W3 Schools Tutorials</a></li>
</ul>

<hr>

<ul>
<li><p><a href="https://graphviz.org/pdf/dotguide.pdf" rel="nofollow">The dot Guide</a></p></li>
<li><p><a href="https://ncona.com/2020/06/create-diagrams-with-code-using-graphviz/" rel="nofollow">Introduction to Graphviz</a></p></li>
<li><p><a href="https://sketchviz.com/" rel="nofollow">Browser-based Graphviz Editor SketchViz</a></p></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<h2>Producer Note</h2>

<ul>
<li>Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there&#39;s nothing I can do about that, but I wanted everyone to be aware that.</li>
<li>Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>589: The buffering pipe</title>
  <link>https://www.bsdnow.tv/589</link>
  <guid isPermaLink="false">e30d8935-1e67-4f45-8ff5-00690f626b49</guid>
  <pubDate>Thu, 12 Dec 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e30d8935-1e67-4f45-8ff5-00690f626b49.mp3" length="56143488" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Open-Source Software Is in Crisis, A Brief History of Cyrix, Userland Disk I/O, OPNsense 24.7.9 released, GhostBSD 24.10.1 Is Now Available, Why pipes sometimes get "stuck": buffering, Keep your OmniOS server time synced, and more</itunes:subtitle>
  <itunes:duration>58:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Open-Source Software Is in Crisis, A Brief History of Cyrix, Userland Disk I/O, OPNsense 24.7.9 released, GhostBSD 24.10.1 Is Now Available, Why pipes sometimes get "stuck": buffering, Keep your OmniOS server time synced, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Open-Source Software Is in Crisis (https://spectrum.ieee.org/open-source-crisis)
A Brief History of Cyrix (https://www.abortretry.fail/p/a-brief-history-of-cyrix)
News Roundup
Userland Disk I/O (https://transactional.blog/how-to-learn/disk-io)
OPNsense 24.7.9 released (https://forum.opnsense.org/index.php?topic=44133.0)
GhostBSD 24.10.1 Is Now Available (https://ghostbsd.org/news/GhostBSD_24.10.1_Is_Now_Available)
Why pipes sometimes get "stuck": buffering (https://jvns.ca/blog/2024/11/29/why-pipes-get-stuck-buffering/)
Keep your OmniOS server time synced (https://tumfatig.net/2024/keep-your-omnios-server-time-synced/)
Beastie Bits
"I'll take 2" - Solidigm introduces a 122TB Drive, the World’s Highest Capacity PCIe SSDs (https://news.solidigm.com/en-WW/243441-solidigm-122tb-drive)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Ian - Thoughts (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/589/feedback/ian%20-%20toughts.md)
Producer Note
Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there's nothing I can do about that, but I wanted everyone to be aware that.
Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, crisis, cyrix, history, userland, disk i/o, opnsense, ghostbsd, pipes, stuck, buffer, buffering, omnios server, time sync, clock</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Open-Source Software Is in Crisis, A Brief History of Cyrix, Userland Disk I/O, OPNsense 24.7.9 released, GhostBSD 24.10.1 Is Now Available, Why pipes sometimes get &quot;stuck&quot;: buffering, Keep your OmniOS server time synced, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://spectrum.ieee.org/open-source-crisis" rel="nofollow">Open-Source Software Is in Crisis</a></p>

<hr>

<p><a href="https://www.abortretry.fail/p/a-brief-history-of-cyrix" rel="nofollow">A Brief History of Cyrix</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://transactional.blog/how-to-learn/disk-io" rel="nofollow">Userland Disk I/O</a></p>

<hr>

<p><a href="https://forum.opnsense.org/index.php?topic=44133.0" rel="nofollow">OPNsense 24.7.9 released</a></p>

<hr>

<p><a href="https://ghostbsd.org/news/GhostBSD_24.10.1_Is_Now_Available" rel="nofollow">GhostBSD 24.10.1 Is Now Available</a></p>

<hr>

<p><a href="https://jvns.ca/blog/2024/11/29/why-pipes-get-stuck-buffering/" rel="nofollow">Why pipes sometimes get &quot;stuck&quot;: buffering</a></p>

<hr>

<p><a href="https://tumfatig.net/2024/keep-your-omnios-server-time-synced/" rel="nofollow">Keep your OmniOS server time synced</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://news.solidigm.com/en-WW/243441-solidigm-122tb-drive" rel="nofollow">&quot;I&#39;ll take 2&quot; - Solidigm introduces a 122TB Drive, the World’s Highest Capacity PCIe SSDs</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/589/feedback/ian%20-%20toughts.md" rel="nofollow">Ian - Thoughts</a></li>
</ul>

<hr>

<h2>Producer Note</h2>

<ul>
<li>Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there&#39;s nothing I can do about that, but I wanted everyone to be aware that.</li>
<li>Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Open-Source Software Is in Crisis, A Brief History of Cyrix, Userland Disk I/O, OPNsense 24.7.9 released, GhostBSD 24.10.1 Is Now Available, Why pipes sometimes get &quot;stuck&quot;: buffering, Keep your OmniOS server time synced, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://spectrum.ieee.org/open-source-crisis" rel="nofollow">Open-Source Software Is in Crisis</a></p>

<hr>

<p><a href="https://www.abortretry.fail/p/a-brief-history-of-cyrix" rel="nofollow">A Brief History of Cyrix</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://transactional.blog/how-to-learn/disk-io" rel="nofollow">Userland Disk I/O</a></p>

<hr>

<p><a href="https://forum.opnsense.org/index.php?topic=44133.0" rel="nofollow">OPNsense 24.7.9 released</a></p>

<hr>

<p><a href="https://ghostbsd.org/news/GhostBSD_24.10.1_Is_Now_Available" rel="nofollow">GhostBSD 24.10.1 Is Now Available</a></p>

<hr>

<p><a href="https://jvns.ca/blog/2024/11/29/why-pipes-get-stuck-buffering/" rel="nofollow">Why pipes sometimes get &quot;stuck&quot;: buffering</a></p>

<hr>

<p><a href="https://tumfatig.net/2024/keep-your-omnios-server-time-synced/" rel="nofollow">Keep your OmniOS server time synced</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://news.solidigm.com/en-WW/243441-solidigm-122tb-drive" rel="nofollow">&quot;I&#39;ll take 2&quot; - Solidigm introduces a 122TB Drive, the World’s Highest Capacity PCIe SSDs</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/589/feedback/ian%20-%20toughts.md" rel="nofollow">Ian - Thoughts</a></li>
</ul>

<hr>

<h2>Producer Note</h2>

<ul>
<li>Once we reach Episode 600, I will be backfilling out fireside website with the older episodes (before 283), depending on how your podcast feed service works, you may get a bunch of new notifications of episodes. Sadly there&#39;s nothing I can do about that, but I wanted everyone to be aware that.</li>
<li>Also once we hit 600, we will be announcing some new Patreon Perks and new ways you can engage and get involved with the show. More to come in the upcoming weeks as we finalize those plans amongst the team.</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>588: PGP Alternatives</title>
  <link>https://www.bsdnow.tv/588</link>
  <guid isPermaLink="false">786b8b40-5218-4ab8-b02c-65265b026e4e</guid>
  <pubDate>Thu, 05 Dec 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/786b8b40-5218-4ab8-b02c-65265b026e4e.mp3" length="61724928" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Deploying pNFS file sharing with FreeBSD, What To Use Instead of PGP, The slow evaporation of the FOSS surplus, I feel that NAT is inevitable even with IPv6, Spell checking in Vim, Iconic consoles of the IBM System/360 mainframes, 55 years old, and more</itunes:subtitle>
  <itunes:duration>1:04:17</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Deploying pNFS file sharing with FreeBSD, What To Use Instead of PGP, The slow evaporation of the FOSS surplus, I feel that NAT is inevitable even with IPv6, Spell checking in Vim, Iconic consoles of the IBM System/360 mainframes, 55 years old, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Deploying pNFS file sharing with FreeBSD (https://klarasystems.com/articles/deploying-pnfs-file-sharing-with-freebsd/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
What To Use Instead of PGP (https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/)
The slow evaporation of the FOSS surplus (https://www.baldurbjarnason.com/2024/the-slow-evaporation-of-the-foss-surplus/)
News Roundup
FreeBSD 14 on the Desktop (https://www.sacredheartsc.com/blog/freebsd-14-on-the-desktop/)
Iconic consoles of the IBM System/360 mainframes, 55 years old (https://www.righto.com/2019/04/iconic-consoles-of-ibm-system360.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, pNFS, pgp alternatives, evaporation, FOSS surplus, nat, ipv6, spell checking, vim, iconic consoles, system/360, ibm, mainframe</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Deploying pNFS file sharing with FreeBSD, What To Use Instead of PGP, The slow evaporation of the FOSS surplus, I feel that NAT is inevitable even with IPv6, Spell checking in Vim, Iconic consoles of the IBM System/360 mainframes, 55 years old, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/deploying-pnfs-file-sharing-with-freebsd/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Deploying pNFS file sharing with FreeBSD</a></p>

<hr>

<p><a href="https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/" rel="nofollow">What To Use Instead of PGP</a></p>

<hr>

<p><a href="https://www.baldurbjarnason.com/2024/the-slow-evaporation-of-the-foss-surplus/" rel="nofollow">The slow evaporation of the FOSS surplus</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.sacredheartsc.com/blog/freebsd-14-on-the-desktop/" rel="nofollow">FreeBSD 14 on the Desktop</a></p>

<hr>

<p><a href="https://www.righto.com/2019/04/iconic-consoles-of-ibm-system360.html" rel="nofollow">Iconic consoles of the IBM System/360 mainframes, 55 years old</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Deploying pNFS file sharing with FreeBSD, What To Use Instead of PGP, The slow evaporation of the FOSS surplus, I feel that NAT is inevitable even with IPv6, Spell checking in Vim, Iconic consoles of the IBM System/360 mainframes, 55 years old, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/deploying-pnfs-file-sharing-with-freebsd/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Deploying pNFS file sharing with FreeBSD</a></p>

<hr>

<p><a href="https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/" rel="nofollow">What To Use Instead of PGP</a></p>

<hr>

<p><a href="https://www.baldurbjarnason.com/2024/the-slow-evaporation-of-the-foss-surplus/" rel="nofollow">The slow evaporation of the FOSS surplus</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.sacredheartsc.com/blog/freebsd-14-on-the-desktop/" rel="nofollow">FreeBSD 14 on the Desktop</a></p>

<hr>

<p><a href="https://www.righto.com/2019/04/iconic-consoles-of-ibm-system360.html" rel="nofollow">Iconic consoles of the IBM System/360 mainframes, 55 years old</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>587: New filesystems category</title>
  <link>https://www.bsdnow.tv/587</link>
  <guid isPermaLink="false">ef2e89d1-2439-428c-a7f3-70121d454af6</guid>
  <pubDate>Thu, 28 Nov 2024 09:30:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ef2e89d1-2439-428c-a7f3-70121d454af6.mp3" length="48872832" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Quarterly Report, Welcome to the new category: filesystems, BSD Misconceptions, Notes on the compatibility of crypted passwords across Unixes in late 2024, Automating ZFS Snapshots for Peace of Mind, A few nice things in OpenZFS 2.3, and more</itunes:subtitle>
  <itunes:duration>50:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Quarterly Report, Welcome to the new category: filesystems, BSD Misconceptions, Notes on the compatibility of crypted passwords across Unixes in late 2024, Automating ZFS Snapshots for Peace of Mind, A few nice things in OpenZFS 2.3, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Quarterly Report (https://www.freebsd.org/status/report-2024-07-2024-09/)
News Roundup
Welcome to the new category: filesystems (https://news.freshports.org/2024/11/06/welcome-to-the-new-category-filesystems/)
BSD Misconceptions (https://izder456.tumblr.com/post/759376596551483392/bsd-misconceptions)
Notes on the compatibility of crypted passwords across Unixes in late 2024 (https://utcc.utoronto.ca/~cks/space/blog/unix/CryptedPasswordCompatibility2024)
Automating ZFS Snapshots for Peace of Mind (https://it-notes.dragas.net/2024/08/21/automating-zfs-snapshots-for-peace-of-mind/)
A few nice things in OpenZFS 2.3 (https://despairlabs.com/blog/posts/2024-10-05-nice-things-in-openzfs-23/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Izzy - Misconceptions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/587/feedback/izzy%20-%20misconceptions.md)
John - UNIX Graphical Desktops (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/587/feedback/John-UNIXGraphicalDesktops.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, Q3 report, introduction, ports category, misconceptions, compatibility, crypted passwords, snapshot automation, automating, peace of mind, openzfs 2.3</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Quarterly Report, Welcome to the new category: filesystems, BSD Misconceptions, Notes on the compatibility of crypted passwords across Unixes in late 2024, Automating ZFS Snapshots for Peace of Mind, A few nice things in OpenZFS 2.3, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.freebsd.org/status/report-2024-07-2024-09/" rel="nofollow">FreeBSD Quarterly Report</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://news.freshports.org/2024/11/06/welcome-to-the-new-category-filesystems/" rel="nofollow">Welcome to the new category: filesystems</a></p>

<hr>

<p><a href="https://izder456.tumblr.com/post/759376596551483392/bsd-misconceptions" rel="nofollow">BSD Misconceptions</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/CryptedPasswordCompatibility2024" rel="nofollow">Notes on the compatibility of crypted passwords across Unixes in late 2024</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/08/21/automating-zfs-snapshots-for-peace-of-mind/" rel="nofollow">Automating ZFS Snapshots for Peace of Mind</a></p>

<hr>

<p><a href="https://despairlabs.com/blog/posts/2024-10-05-nice-things-in-openzfs-23/" rel="nofollow">A few nice things in OpenZFS 2.3</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/587/feedback/izzy%20-%20misconceptions.md" rel="nofollow">Izzy - Misconceptions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/587/feedback/John-UNIXGraphicalDesktops.md" rel="nofollow">John - UNIX Graphical Desktops</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Quarterly Report, Welcome to the new category: filesystems, BSD Misconceptions, Notes on the compatibility of crypted passwords across Unixes in late 2024, Automating ZFS Snapshots for Peace of Mind, A few nice things in OpenZFS 2.3, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.freebsd.org/status/report-2024-07-2024-09/" rel="nofollow">FreeBSD Quarterly Report</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://news.freshports.org/2024/11/06/welcome-to-the-new-category-filesystems/" rel="nofollow">Welcome to the new category: filesystems</a></p>

<hr>

<p><a href="https://izder456.tumblr.com/post/759376596551483392/bsd-misconceptions" rel="nofollow">BSD Misconceptions</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/CryptedPasswordCompatibility2024" rel="nofollow">Notes on the compatibility of crypted passwords across Unixes in late 2024</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/08/21/automating-zfs-snapshots-for-peace-of-mind/" rel="nofollow">Automating ZFS Snapshots for Peace of Mind</a></p>

<hr>

<p><a href="https://despairlabs.com/blog/posts/2024-10-05-nice-things-in-openzfs-23/" rel="nofollow">A few nice things in OpenZFS 2.3</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/587/feedback/izzy%20-%20misconceptions.md" rel="nofollow">Izzy - Misconceptions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/587/feedback/John-UNIXGraphicalDesktops.md" rel="nofollow">John - UNIX Graphical Desktops</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>586: Cloud Exit Savings</title>
  <link>https://www.bsdnow.tv/586</link>
  <guid isPermaLink="false">7d2743e5-551b-40e8-9e97-f75d720b1ce9</guid>
  <pubDate>Thu, 21 Nov 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7d2743e5-551b-40e8-9e97-f75d720b1ce9.mp3" length="62734848" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Our Cloud Exit Savings will not top ten million over five years, 5 Reasons Why Your ZFS Storage Benchmarks Are Wrong, The history of inetd is more interesting than I expected, OpenBSD is Hard to Show Off, bhyve on FreeBSD and VM Live Migration – Quo vadis?, and more</itunes:subtitle>
  <itunes:duration>1:05:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Our Cloud Exit Savings will not top ten million over five years, 5 Reasons Why Your ZFS Storage Benchmarks Are Wrong, The history of inetd is more interesting than I expected, OpenBSD is Hard to Show Off, bhyve on FreeBSD and VM Live Migration – Quo vadis?, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Our Cloud Exit Savings will not top ten million over five years (https://world.hey.com/dhh/our-cloud-exit-savings-will-now-top-ten-million-over-five-years-c7d9b5bd)
5 Reasons Why Your ZFS Storage Benchmarks Are Wrong (https://klarasystems.com/articles/5-reasons-why-your-zfs-storage-benchmarks-are-wrong/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
The history of inetd is more interesting than I expected (https://utcc.utoronto.ca/~cks/space/blog/unix/InetdInterestingHistory)
OpenBSD is Hard to Show Off (https://atthis.link/blog/2024/16379.html)
bhyve on FreeBSD and VM Live Migration – Quo vadis? (https://gyptazy.com/bhyve-on-freebsd-and-vm-live-migration-quo-vadis/)
Beastie Bits
Game of Trees 0.104 (http://undeadly.org/cgi?action=article;sid=20241023071210)
Networking for System Administrators (https://mwl.io/nonfiction/networking#n4sa)
Fall 2024 FreeBSD Summit Day 1 (https://youtu.be/jZ3mjJZEqs0)
Fall 2024 FreeBSD Summit Day 2 (https://www.youtube.com/live/qCNpuK2v248)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Chris - Truenas (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/586/feedback/chris-truenas.md)
Brendan - NextCloud (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/586/feedback/brendan-nextcloud.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, cloud exit, savings, storage benchmarks, history, inetd, show off, vm live migration</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Our Cloud Exit Savings will not top ten million over five years, 5 Reasons Why Your ZFS Storage Benchmarks Are Wrong, The history of inetd is more interesting than I expected, OpenBSD is Hard to Show Off, bhyve on FreeBSD and VM Live Migration – Quo vadis?, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://world.hey.com/dhh/our-cloud-exit-savings-will-now-top-ten-million-over-five-years-c7d9b5bd" rel="nofollow">Our Cloud Exit Savings will not top ten million over five years</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/5-reasons-why-your-zfs-storage-benchmarks-are-wrong/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">5 Reasons Why Your ZFS Storage Benchmarks Are Wrong</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/InetdInterestingHistory" rel="nofollow">The history of inetd is more interesting than I expected</a></p>

<hr>

<p><a href="https://atthis.link/blog/2024/16379.html" rel="nofollow">OpenBSD is Hard to Show Off</a></p>

<hr>

<p><a href="https://gyptazy.com/bhyve-on-freebsd-and-vm-live-migration-quo-vadis/" rel="nofollow">bhyve on FreeBSD and VM Live Migration – Quo vadis?</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article;sid=20241023071210" rel="nofollow">Game of Trees 0.104</a></li>
<li><a href="https://mwl.io/nonfiction/networking#n4sa" rel="nofollow">Networking for System Administrators</a></li>
<li><a href="https://youtu.be/jZ3mjJZEqs0" rel="nofollow">Fall 2024 FreeBSD Summit Day 1</a></li>
<li><a href="https://www.youtube.com/live/qCNpuK2v248" rel="nofollow">Fall 2024 FreeBSD Summit Day 2</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/586/feedback/chris-truenas.md" rel="nofollow">Chris - Truenas</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/586/feedback/brendan-nextcloud.md" rel="nofollow">Brendan - NextCloud</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Our Cloud Exit Savings will not top ten million over five years, 5 Reasons Why Your ZFS Storage Benchmarks Are Wrong, The history of inetd is more interesting than I expected, OpenBSD is Hard to Show Off, bhyve on FreeBSD and VM Live Migration – Quo vadis?, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://world.hey.com/dhh/our-cloud-exit-savings-will-now-top-ten-million-over-five-years-c7d9b5bd" rel="nofollow">Our Cloud Exit Savings will not top ten million over five years</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/5-reasons-why-your-zfs-storage-benchmarks-are-wrong/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">5 Reasons Why Your ZFS Storage Benchmarks Are Wrong</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/InetdInterestingHistory" rel="nofollow">The history of inetd is more interesting than I expected</a></p>

<hr>

<p><a href="https://atthis.link/blog/2024/16379.html" rel="nofollow">OpenBSD is Hard to Show Off</a></p>

<hr>

<p><a href="https://gyptazy.com/bhyve-on-freebsd-and-vm-live-migration-quo-vadis/" rel="nofollow">bhyve on FreeBSD and VM Live Migration – Quo vadis?</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article;sid=20241023071210" rel="nofollow">Game of Trees 0.104</a></li>
<li><a href="https://mwl.io/nonfiction/networking#n4sa" rel="nofollow">Networking for System Administrators</a></li>
<li><a href="https://youtu.be/jZ3mjJZEqs0" rel="nofollow">Fall 2024 FreeBSD Summit Day 1</a></li>
<li><a href="https://www.youtube.com/live/qCNpuK2v248" rel="nofollow">Fall 2024 FreeBSD Summit Day 2</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/586/feedback/chris-truenas.md" rel="nofollow">Chris - Truenas</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/586/feedback/brendan-nextcloud.md" rel="nofollow">Brendan - NextCloud</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>585: Infrastructure Administration Workstation</title>
  <link>https://www.bsdnow.tv/585</link>
  <guid isPermaLink="false">137023c9-3a8f-495e-8b66-8db48e5b1ee7</guid>
  <pubDate>Thu, 14 Nov 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/137023c9-3a8f-495e-8b66-8db48e5b1ee7.mp3" length="47151744" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>From Proxmox to FreeBSD - Story of a Migration, FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS, Using a dedicated administration workstation for my infrastructure, LibreSSL 4.0.0 Released, Plasma6 and FreeBSD 14, Replace gnu diff, diff3, and sdiff with BSD versions, and more</itunes:subtitle>
  <itunes:duration>49:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>From Proxmox to FreeBSD - Story of a Migration, FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS, Using a dedicated administration workstation for my infrastructure, LibreSSL 4.0.0 Released, Plasma6 and FreeBSD 14, Replace gnu diff, diff3, and sdiff with BSD versions, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
From Proxmox to FreeBSD - Story of a Migration (https://it-notes.dragas.net/2024/10/21/from-proxmox-to-freebsd-story-of-a-migration/)
FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS (https://hackaday.com/2024/10/28/freebsd-at-30-the-history-and-future-of-the-most-popular-bsd-based-os/)
News Roundup
Using a dedicated administration workstation for my infrastructure (https://dataswamp.org/~solene/2024-10-19-my-admin-workstation.html)
LibreSSL 4.0.0 Released (https://www.undeadly.org/cgi?action=article;sid=20241015084629)
Plasma6 and FreeBSD 14 (https://euroquis.nl//kde/2024/10/08/freebsd14.html)
git: world - Replace gnu diff, diff3, and sdiff with BSD versions (https://lists.dragonflybsd.org/pipermail/commits/2024-October/923274.html)
Beastie Bits
- How to Upgrade FreeBSD KDE 5 to KDE 6 (https://www.youtube.com/watch?v=2OZtnqK3iMU)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, proxmox, migration, story, freebsd at 30, history, future, admin, administration, workstation, infrastructure, libressl, plasma6, diff, diff3, sdiff</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>From Proxmox to FreeBSD - Story of a Migration, FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS, Using a dedicated administration workstation for my infrastructure, LibreSSL 4.0.0 Released, Plasma6 and FreeBSD 14, Replace gnu diff, diff3, and sdiff with BSD versions, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://it-notes.dragas.net/2024/10/21/from-proxmox-to-freebsd-story-of-a-migration/" rel="nofollow">From Proxmox to FreeBSD - Story of a Migration</a></p>

<hr>

<p><a href="https://hackaday.com/2024/10/28/freebsd-at-30-the-history-and-future-of-the-most-popular-bsd-based-os/" rel="nofollow">FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dataswamp.org/%7Esolene/2024-10-19-my-admin-workstation.html" rel="nofollow">Using a dedicated administration workstation for my infrastructure</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20241015084629" rel="nofollow">LibreSSL 4.0.0 Released</a></p>

<hr>

<p><a href="https://euroquis.nl//kde/2024/10/08/freebsd14.html" rel="nofollow">Plasma6 and FreeBSD 14</a></p>

<hr>

<p><a href="https://lists.dragonflybsd.org/pipermail/commits/2024-October/923274.html" rel="nofollow">git: world - Replace gnu diff, diff3, and sdiff with BSD versions</a></p>

<hr>

<hr>

<h2>Beastie Bits</h2>

<h2>- <a href="https://www.youtube.com/watch?v=2OZtnqK3iMU" rel="nofollow">How to Upgrade FreeBSD KDE 5 to KDE 6</a></h2>

<ul>
<li>***</li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>From Proxmox to FreeBSD - Story of a Migration, FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS, Using a dedicated administration workstation for my infrastructure, LibreSSL 4.0.0 Released, Plasma6 and FreeBSD 14, Replace gnu diff, diff3, and sdiff with BSD versions, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://it-notes.dragas.net/2024/10/21/from-proxmox-to-freebsd-story-of-a-migration/" rel="nofollow">From Proxmox to FreeBSD - Story of a Migration</a></p>

<hr>

<p><a href="https://hackaday.com/2024/10/28/freebsd-at-30-the-history-and-future-of-the-most-popular-bsd-based-os/" rel="nofollow">FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dataswamp.org/%7Esolene/2024-10-19-my-admin-workstation.html" rel="nofollow">Using a dedicated administration workstation for my infrastructure</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20241015084629" rel="nofollow">LibreSSL 4.0.0 Released</a></p>

<hr>

<p><a href="https://euroquis.nl//kde/2024/10/08/freebsd14.html" rel="nofollow">Plasma6 and FreeBSD 14</a></p>

<hr>

<p><a href="https://lists.dragonflybsd.org/pipermail/commits/2024-October/923274.html" rel="nofollow">git: world - Replace gnu diff, diff3, and sdiff with BSD versions</a></p>

<hr>

<hr>

<h2>Beastie Bits</h2>

<h2>- <a href="https://www.youtube.com/watch?v=2OZtnqK3iMU" rel="nofollow">How to Upgrade FreeBSD KDE 5 to KDE 6</a></h2>

<ul>
<li>***</li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>584: ZFS Copy Offloading</title>
  <link>https://www.bsdnow.tv/584</link>
  <guid isPermaLink="false">ba88ee59-1fde-4f54-a013-b0a8b34ae9b3</guid>
  <pubDate>Thu, 07 Nov 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ba88ee59-1fde-4f54-a013-b0a8b34ae9b3.mp3" length="55618176" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices, Accelerating ZFS with Copy Offloading: BRT, The uncertain possible futures of Unix graphical desktops, Jailfox - Firefox in a Freebsd Jail, Make Your Own Read-Only Device With NetBSD, ex/vi/nvi editor: .exrc advanced,</itunes:subtitle>
  <itunes:duration>57:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices, Accelerating ZFS with Copy Offloading: BRT, The uncertain possible futures of Unix graphical desktops, Jailfox - Firefox in a Freebsd Jail, Make Your Own Read-Only Device With NetBSD, ex/vi/nvi editor: .exrc advanced,
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices (https://freebsdfoundation.org/blog/new-cis-freebsd-14-benchmark-secure-your-systems-with-expert-guided-best-practices/)
Accelerating ZFS with Copy Offloading: BRT (https://klarasystems.com/articles/accelerating-zfs-with-copy-offloading-brt/)
News Roundup
The uncertain possible futures of Unix graphical desktops (https://utcc.utoronto.ca/~cks/space/blog/unix/UnixDesktopFutures)
Jailfox - Firefox in a Freebsd Jail (https://forums.FreeBSD.org/threads/jailfox-firefox-ingithub-a-freebsd-jail.94848/)
Make Your Own Read-Only Device With NetBSD (https://it-notes.dragas.net/2024/09/10/make-your-own-readonly-device-with-netbsd/)
ex/vi/nvi editor: .exrc file (config file) advanced topics (undocumented?): Adding comments, escaping the pipe, mapping key combinations (https://forums.FreeBSD.org/threads/ex-vi-nvi-editor-exrc-file-config-file-advanced-topics-undocumented-adding-comments-escaping-the-pipe-mapping-key-combinations.95095/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Matthew - CI CD (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/584/feedback/matthew%20-%20cicd.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, CIS benchmark, expert-guided, best practices, Accelerating, copy Offloading, BRT, graphical desktops, jailfox, read-only device, exrc</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices, Accelerating ZFS with Copy Offloading: BRT, The uncertain possible futures of Unix graphical desktops, Jailfox - Firefox in a Freebsd Jail, Make Your Own Read-Only Device With NetBSD, ex/vi/nvi editor: .exrc advanced,</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/new-cis-freebsd-14-benchmark-secure-your-systems-with-expert-guided-best-practices/" rel="nofollow">New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/accelerating-zfs-with-copy-offloading-brt/" rel="nofollow">Accelerating ZFS with Copy Offloading: BRT</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/UnixDesktopFutures" rel="nofollow">The uncertain possible futures of Unix graphical desktops</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/jailfox-firefox-ingithub-a-freebsd-jail.94848/" rel="nofollow">Jailfox - Firefox in a Freebsd Jail</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/09/10/make-your-own-readonly-device-with-netbsd/" rel="nofollow">Make Your Own Read-Only Device With NetBSD</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/ex-vi-nvi-editor-exrc-file-config-file-advanced-topics-undocumented-adding-comments-escaping-the-pipe-mapping-key-combinations.95095/" rel="nofollow">ex/vi/nvi editor: .exrc file (config file) advanced topics (undocumented?): Adding comments, escaping the pipe, mapping key combinations</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/584/feedback/matthew%20-%20cicd.md" rel="nofollow">Matthew - CI CD</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices, Accelerating ZFS with Copy Offloading: BRT, The uncertain possible futures of Unix graphical desktops, Jailfox - Firefox in a Freebsd Jail, Make Your Own Read-Only Device With NetBSD, ex/vi/nvi editor: .exrc advanced,</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/new-cis-freebsd-14-benchmark-secure-your-systems-with-expert-guided-best-practices/" rel="nofollow">New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/accelerating-zfs-with-copy-offloading-brt/" rel="nofollow">Accelerating ZFS with Copy Offloading: BRT</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/UnixDesktopFutures" rel="nofollow">The uncertain possible futures of Unix graphical desktops</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/jailfox-firefox-ingithub-a-freebsd-jail.94848/" rel="nofollow">Jailfox - Firefox in a Freebsd Jail</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/09/10/make-your-own-readonly-device-with-netbsd/" rel="nofollow">Make Your Own Read-Only Device With NetBSD</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/ex-vi-nvi-editor-exrc-file-config-file-advanced-topics-undocumented-adding-comments-escaping-the-pipe-mapping-key-combinations.95095/" rel="nofollow">ex/vi/nvi editor: .exrc file (config file) advanced topics (undocumented?): Adding comments, escaping the pipe, mapping key combinations</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/584/feedback/matthew%20-%20cicd.md" rel="nofollow">Matthew - CI CD</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>583: A host of self-hosters</title>
  <link>https://www.bsdnow.tv/583</link>
  <guid isPermaLink="false">523b42f8-cd1e-4919-a5ad-d6de0bb137a2</guid>
  <pubDate>Thu, 31 Oct 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/523b42f8-cd1e-4919-a5ad-d6de0bb137a2.mp3" length="66302976" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Run Linux Containers on FreeBSD 14 with Podman, Open Source FreeBSD NAS: Maintenance Best Practices, Self-hosting Bitwarden / VaultWarden on FreeBSD, I most definitely should (self-host)!, My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures, Make Your Own CDN With OpenBSD Base and Just 2 Packages, and more</itunes:subtitle>
  <itunes:duration>1:09:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Run Linux Containers on FreeBSD 14 with Podman, Open Source FreeBSD NAS: Maintenance Best Practices, Self-hosting Bitwarden / VaultWarden on FreeBSD, I most definitely should (self-host)!, My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures, Make Your Own CDN With OpenBSD Base and Just 2 Packages, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenBSD 7.6 Released (https://undeadly.org/cgi?action=article;sid=20241007204213)
Open Source FreeBSD NAS: Maintenance Best Practices (https://klarasystems.com/articles/open-source-freebsd-nas-maintenance-best-practices/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
Self-hosting Bitwarden / VaultWarden on FreeBSD (https://dan.langille.org/2024/09/30/self-hosting-bitwarden-vaultwarden-on-freebsd/)
I most definitely should (self-host)! (https://michal.sapka.me/blog/2024/i-will-self-host-this-site/)
My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures (https://louwrentius.com/my-71-tib-zfs-nas-after-10-years-and-zero-drive-failures.html)
Make Your Own CDN With OpenBSD Base and Just 2 Packages (https://it-notes.dragas.net/2024/08/29/make-your-own-cdn-openbsd/)
Beastie Bits
- BSD History archive (https://m.youtube.com/watch?v=a3f889FXuGw)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Mischa - feedback (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Mischa%20-%20Feedback.md)
lars - feedback (https://github.com/BSDNow/bsdnow.tv/tree/master/episodes/583/feedback)
Message from JT... the problem is spam, sometimes real messages get lost in flood of spam, if we don't cover your email within a few weeks, please email back in.
And now... for some laughs, I shall share with you all, some of the delightful spam we have gotten for your entertainment.
Kim (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/kim%20-%20spam.md)
Alexander (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Alexander%20-%20spam.md)
Lee (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Lee%20-%20spam.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, containers, podman, NAS, maintenance, best practices, Self-hosting, bitwarden, VaultWarden, zero drive failure, cdn</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Run Linux Containers on FreeBSD 14 with Podman, Open Source FreeBSD NAS: Maintenance Best Practices, Self-hosting Bitwarden / VaultWarden on FreeBSD, I most definitely should (self-host)!, My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures, Make Your Own CDN With OpenBSD Base and Just 2 Packages, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20241007204213" rel="nofollow">OpenBSD 7.6 Released</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/open-source-freebsd-nas-maintenance-best-practices/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Open Source FreeBSD NAS: Maintenance Best Practices</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dan.langille.org/2024/09/30/self-hosting-bitwarden-vaultwarden-on-freebsd/" rel="nofollow">Self-hosting Bitwarden / VaultWarden on FreeBSD</a></p>

<hr>

<p><a href="https://michal.sapka.me/blog/2024/i-will-self-host-this-site/" rel="nofollow">I most definitely should (self-host)!</a></p>

<hr>

<p><a href="https://louwrentius.com/my-71-tib-zfs-nas-after-10-years-and-zero-drive-failures.html" rel="nofollow">My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/08/29/make-your-own-cdn-openbsd/" rel="nofollow">Make Your Own CDN With OpenBSD Base and Just 2 Packages</a></p>

<hr>

<h2>Beastie Bits</h2>

<h2>- <a href="https://m.youtube.com/watch?v=a3f889FXuGw" rel="nofollow">BSD History archive</a></h2>

<ul>
<li>***</li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Mischa%20-%20Feedback.md" rel="nofollow">Mischa - feedback</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/tree/master/episodes/583/feedback" rel="nofollow">lars - feedback</a></p></li>
<li><p>Message from JT... the problem is spam, sometimes real messages get lost in flood of spam, if we don&#39;t cover your email within a few weeks, please email back in.</p></li>
</ul>

<p>And now... for some laughs, I shall share with you all, some of the delightful spam we have gotten for your entertainment.</p>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/kim%20-%20spam.md" rel="nofollow">Kim</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Alexander%20-%20spam.md" rel="nofollow">Alexander</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Lee%20-%20spam.md" rel="nofollow">Lee</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Run Linux Containers on FreeBSD 14 with Podman, Open Source FreeBSD NAS: Maintenance Best Practices, Self-hosting Bitwarden / VaultWarden on FreeBSD, I most definitely should (self-host)!, My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures, Make Your Own CDN With OpenBSD Base and Just 2 Packages, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20241007204213" rel="nofollow">OpenBSD 7.6 Released</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/open-source-freebsd-nas-maintenance-best-practices/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Open Source FreeBSD NAS: Maintenance Best Practices</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dan.langille.org/2024/09/30/self-hosting-bitwarden-vaultwarden-on-freebsd/" rel="nofollow">Self-hosting Bitwarden / VaultWarden on FreeBSD</a></p>

<hr>

<p><a href="https://michal.sapka.me/blog/2024/i-will-self-host-this-site/" rel="nofollow">I most definitely should (self-host)!</a></p>

<hr>

<p><a href="https://louwrentius.com/my-71-tib-zfs-nas-after-10-years-and-zero-drive-failures.html" rel="nofollow">My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/08/29/make-your-own-cdn-openbsd/" rel="nofollow">Make Your Own CDN With OpenBSD Base and Just 2 Packages</a></p>

<hr>

<h2>Beastie Bits</h2>

<h2>- <a href="https://m.youtube.com/watch?v=a3f889FXuGw" rel="nofollow">BSD History archive</a></h2>

<ul>
<li>***</li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Mischa%20-%20Feedback.md" rel="nofollow">Mischa - feedback</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/tree/master/episodes/583/feedback" rel="nofollow">lars - feedback</a></p></li>
<li><p>Message from JT... the problem is spam, sometimes real messages get lost in flood of spam, if we don&#39;t cover your email within a few weeks, please email back in.</p></li>
</ul>

<p>And now... for some laughs, I shall share with you all, some of the delightful spam we have gotten for your entertainment.</p>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/kim%20-%20spam.md" rel="nofollow">Kim</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Alexander%20-%20spam.md" rel="nofollow">Alexander</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Lee%20-%20spam.md" rel="nofollow">Lee</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>582: Introducing ZBM</title>
  <link>https://www.bsdnow.tv/582</link>
  <guid isPermaLink="false">e95e7d3d-6bca-4594-a5ee-2155c7bc98ef</guid>
  <pubDate>Thu, 24 Oct 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e95e7d3d-6bca-4594-a5ee-2155c7bc98ef.mp3" length="55983744" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Why laptop support, why now: FreeBSD’s strategic move toward broader adoption, ZBM 101: Introduction to ZFSBootMenu, How I batch apply and save one-liners, Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps, How to install "standard" TTF Microsoft fonts, We need more zero config tools, Reasons I still love the fish shell, You Have Installed OpenBSD. Now For The Daily Tasks, and more</itunes:subtitle>
  <itunes:duration>58:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Why laptop support, why now: FreeBSD’s strategic move toward broader adoption, ZBM 101: Introduction to ZFSBootMenu, How I batch apply and save one-liners, Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps, How to install "standard" TTF Microsoft fonts, We need more zero config tools, Reasons I still love the fish shell, You Have Installed OpenBSD. Now For The Daily Tasks, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Why laptop support, why now: FreeBSD’s strategic move toward broader adoption (https://freebsdfoundation.org/blog/why-laptop-support-why-now-freebsds-strategic-move-toward-broader-adoption/)
ZBM 101: Introduction to ZFSBootMenu (https://klarasystems.com/articles/zbm-101-introduction-to-zfsbootmenu/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
News Roundup
How I batch apply and save one-liners (https://lmno.lol/alvaro/how-i-batch-apply-and-save-one-liners)
Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps (https://it-notes.dragas.net/2024/09/16/moving-freebsd-installation-new-host-vm/)
How to install "standard" TTF Microsoft fonts (https://forums.FreeBSD.org/threads/how-to-install-standard-ttf-microsoft-fonts.95009/)
We need more zero config tools (https://arne.me/blog/we-need-more-zero-config-tools)
Reasons I still love the fish shell (https://jvns.ca/blog/2024/09/12/reasons-i--still--love-fish/)
You Have Installed OpenBSD. Now For The Daily Tasks. (https://bsdly.blogspot.com/2024/09/you-have-installed-openbsd-now-for.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Chris - choosing show items (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/582/feedback/Chris%20-%20choosing%20show%20items.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, laptop support, strategic move, broader adoption, ZBM, ZFSBootMenu, one-liners, mgration, vm, host, font, zero config, tools, fish shell, daily tasks</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Why laptop support, why now: FreeBSD’s strategic move toward broader adoption, ZBM 101: Introduction to ZFSBootMenu, How I batch apply and save one-liners, Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps, How to install &quot;standard&quot; TTF Microsoft fonts, We need more zero config tools, Reasons I still love the fish shell, You Have Installed OpenBSD. Now For The Daily Tasks, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/why-laptop-support-why-now-freebsds-strategic-move-toward-broader-adoption/" rel="nofollow">Why laptop support, why now: FreeBSD’s strategic move toward broader adoption</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zbm-101-introduction-to-zfsbootmenu/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZBM 101: Introduction to ZFSBootMenu</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://lmno.lol/alvaro/how-i-batch-apply-and-save-one-liners" rel="nofollow">How I batch apply and save one-liners</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/09/16/moving-freebsd-installation-new-host-vm/" rel="nofollow">Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/how-to-install-standard-ttf-microsoft-fonts.95009/" rel="nofollow">How to install &quot;standard&quot; TTF Microsoft fonts</a></p>

<hr>

<p><a href="https://arne.me/blog/we-need-more-zero-config-tools" rel="nofollow">We need more zero config tools</a></p>

<hr>

<p><a href="https://jvns.ca/blog/2024/09/12/reasons-i--still--love-fish/" rel="nofollow">Reasons I still love the fish shell</a></p>

<hr>

<p><a href="https://bsdly.blogspot.com/2024/09/you-have-installed-openbsd-now-for.html" rel="nofollow">You Have Installed OpenBSD. Now For The Daily Tasks.</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/582/feedback/Chris%20-%20choosing%20show%20items.md" rel="nofollow">Chris - choosing show items</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Why laptop support, why now: FreeBSD’s strategic move toward broader adoption, ZBM 101: Introduction to ZFSBootMenu, How I batch apply and save one-liners, Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps, How to install &quot;standard&quot; TTF Microsoft fonts, We need more zero config tools, Reasons I still love the fish shell, You Have Installed OpenBSD. Now For The Daily Tasks, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/why-laptop-support-why-now-freebsds-strategic-move-toward-broader-adoption/" rel="nofollow">Why laptop support, why now: FreeBSD’s strategic move toward broader adoption</a></p>

<hr>

<p><a href="https://klarasystems.com/articles/zbm-101-introduction-to-zfsbootmenu/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">ZBM 101: Introduction to ZFSBootMenu</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://lmno.lol/alvaro/how-i-batch-apply-and-save-one-liners" rel="nofollow">How I batch apply and save one-liners</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/09/16/moving-freebsd-installation-new-host-vm/" rel="nofollow">Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/how-to-install-standard-ttf-microsoft-fonts.95009/" rel="nofollow">How to install &quot;standard&quot; TTF Microsoft fonts</a></p>

<hr>

<p><a href="https://arne.me/blog/we-need-more-zero-config-tools" rel="nofollow">We need more zero config tools</a></p>

<hr>

<p><a href="https://jvns.ca/blog/2024/09/12/reasons-i--still--love-fish/" rel="nofollow">Reasons I still love the fish shell</a></p>

<hr>

<p><a href="https://bsdly.blogspot.com/2024/09/you-have-installed-openbsd-now-for.html" rel="nofollow">You Have Installed OpenBSD. Now For The Daily Tasks.</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/582/feedback/Chris%20-%20choosing%20show%20items.md" rel="nofollow">Chris - choosing show items</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>581: Releasing more BSDs</title>
  <link>https://www.bsdnow.tv/581</link>
  <guid isPermaLink="false">c6329e3b-eb96-4db0-9bb0-27d65a4ecddc</guid>
  <pubDate>Thu, 17 Oct 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c6329e3b-eb96-4db0-9bb0-27d65a4ecddc.mp3" length="77142272" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Debunking Common Myths About FreeBSD - Part 2, FreeBSD 13.4-RELEASE Announcement, OpenBSD -current has moved to version 7.6, acpidumping,Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse, Managing dotfiles with chezmoi, Podman testing on FreeBSD, and more</itunes:subtitle>
  <itunes:duration>53:34</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Debunking Common Myths About FreeBSD - Part 2, FreeBSD 13.4-RELEASE Announcement, OpenBSD -current has moved to version 7.6, acpidumping,Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse, Managing dotfiles with chezmoi, Podman testing on FreeBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Debunking Common Myths About FreeBSD - Part 2 (https://klarasystems.com/articles/debunking-common-myths-about-freebsd-2/?utm_source=BSD%20Now&amp;amp;utm_medium=Podcast)
FreeBSD 13.4-RELEASE Announcement (https://www.freebsd.org/releases/13.4R/announce/)
FreeBSD 14.0 end-of-life (https://bsdsec.net/articles/freebsd-14-0-end-of-life) - You should have upgraded to 14.1 by now
OpenBSD -current has moved to version 7.6 (https://www.undeadly.org/cgi?action=article;sid=20240918052239)
News Roundup
acpidumping (https://adventurist.me/posts/00325)
Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse (https://gyptazy.com/install-snac2-on-freebsd-an-activitypub-instance-for-the-fediverse/)
Installing Uptime-Kuma on a FreeBSD Jail (https://it-notes.dragas.net/2024/07/22/install-uptime-kuma-freebsd-jail/)
Managing dotfiles with chezmoi (https://stoddart.github.io/2024/09/08/managing-dotfiles-with-chezmoi.html)
Podman testing on FreeBSD (https://github.com/oci-playground/freebsd-podman-testing)
Undeadly Bits
OpenSSH 9.9 released! (https://undeadly.org/cgi?action=article;sid=20240921181110)
OpenBSD now enforcing no invalid NUL characters in shell scripts (http://undeadly.org/cgi?action=article;sid=20240924105732)
EuroBSDCon 2024 presentations are now up (http://undeadly.org/cgi?action=article;sid=20240924092154)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
rel4x - Secure by default (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/581/feedback/rel4x%20-%20Secure%20by%20default.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, common myths, debunking, acpiduming, snac2, activitypub, fediverse, dotfiles, chezmoi, podman, testing</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Debunking Common Myths About FreeBSD - Part 2, FreeBSD 13.4-RELEASE Announcement, OpenBSD -current has moved to version 7.6, acpidumping,Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse, Managing dotfiles with chezmoi, Podman testing on FreeBSD, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/debunking-common-myths-about-freebsd-2/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Debunking Common Myths About FreeBSD - Part 2</a></p>

<hr>

<p><a href="https://www.freebsd.org/releases/13.4R/announce/" rel="nofollow">FreeBSD 13.4-RELEASE Announcement</a><br>
<a href="https://bsdsec.net/articles/freebsd-14-0-end-of-life" rel="nofollow">FreeBSD 14.0 end-of-life</a> - You should have upgraded to 14.1 by now</p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20240918052239" rel="nofollow">OpenBSD -current has moved to version 7.6</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://adventurist.me/posts/00325" rel="nofollow">acpidumping</a></p>

<hr>

<p><a href="https://gyptazy.com/install-snac2-on-freebsd-an-activitypub-instance-for-the-fediverse/" rel="nofollow">Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/07/22/install-uptime-kuma-freebsd-jail/" rel="nofollow">Installing Uptime-Kuma on a FreeBSD Jail</a></p>

<hr>

<p><a href="https://stoddart.github.io/2024/09/08/managing-dotfiles-with-chezmoi.html" rel="nofollow">Managing dotfiles with chezmoi</a></p>

<hr>

<p><a href="https://github.com/oci-playground/freebsd-podman-testing" rel="nofollow">Podman testing on FreeBSD</a></p>

<hr>

<h2>Undeadly Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20240921181110" rel="nofollow">OpenSSH 9.9 released!</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20240924105732" rel="nofollow">OpenBSD now enforcing no invalid NUL characters in shell scripts</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20240924092154" rel="nofollow">EuroBSDCon 2024 presentations are now up</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/581/feedback/rel4x%20-%20Secure%20by%20default.md" rel="nofollow">rel4x - Secure by default</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Debunking Common Myths About FreeBSD - Part 2, FreeBSD 13.4-RELEASE Announcement, OpenBSD -current has moved to version 7.6, acpidumping,Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse, Managing dotfiles with chezmoi, Podman testing on FreeBSD, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/debunking-common-myths-about-freebsd-2/?utm_source=BSD%20Now&utm_medium=Podcast" rel="nofollow">Debunking Common Myths About FreeBSD - Part 2</a></p>

<hr>

<p><a href="https://www.freebsd.org/releases/13.4R/announce/" rel="nofollow">FreeBSD 13.4-RELEASE Announcement</a><br>
<a href="https://bsdsec.net/articles/freebsd-14-0-end-of-life" rel="nofollow">FreeBSD 14.0 end-of-life</a> - You should have upgraded to 14.1 by now</p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20240918052239" rel="nofollow">OpenBSD -current has moved to version 7.6</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://adventurist.me/posts/00325" rel="nofollow">acpidumping</a></p>

<hr>

<p><a href="https://gyptazy.com/install-snac2-on-freebsd-an-activitypub-instance-for-the-fediverse/" rel="nofollow">Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/07/22/install-uptime-kuma-freebsd-jail/" rel="nofollow">Installing Uptime-Kuma on a FreeBSD Jail</a></p>

<hr>

<p><a href="https://stoddart.github.io/2024/09/08/managing-dotfiles-with-chezmoi.html" rel="nofollow">Managing dotfiles with chezmoi</a></p>

<hr>

<p><a href="https://github.com/oci-playground/freebsd-podman-testing" rel="nofollow">Podman testing on FreeBSD</a></p>

<hr>

<h2>Undeadly Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20240921181110" rel="nofollow">OpenSSH 9.9 released!</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20240924105732" rel="nofollow">OpenBSD now enforcing no invalid NUL characters in shell scripts</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20240924092154" rel="nofollow">EuroBSDCon 2024 presentations are now up</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/581/feedback/rel4x%20-%20Secure%20by%20default.md" rel="nofollow">rel4x - Secure by default</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>580: EuroBSDcon 2024 - Part 2</title>
  <link>https://www.bsdnow.tv/580</link>
  <guid isPermaLink="false">a994539c-8d64-4bca-904d-9e2a5c7e07ae</guid>
  <pubDate>Thu, 10 Oct 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a994539c-8d64-4bca-904d-9e2a5c7e07ae.mp3" length="58487040" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Jason is still on location at EuroBSDcon getting interviews with those in the BSD Community.</itunes:subtitle>
  <itunes:duration>1:00:55</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Jason is still on location at EuroBSDcon getting interviews with those in the BSD Community.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Interviews
Colin Percival
Andrew Hewus
Wolfgang
Liam Proven
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Jason is still on location at EuroBSDcon getting interviews with those in the BSD Community.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interviews</h2>

<h3>Colin Percival</h3>

<h3>Andrew Hewus</h3>

<h3>Wolfgang</h3>

<h3>Liam Proven</h3>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Jason is still on location at EuroBSDcon getting interviews with those in the BSD Community.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interviews</h2>

<h3>Colin Percival</h3>

<h3>Andrew Hewus</h3>

<h3>Wolfgang</h3>

<h3>Liam Proven</h3>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>579: EuroBSDcon 2024</title>
  <link>https://www.bsdnow.tv/579</link>
  <guid isPermaLink="false">22c6b8d0-ef8b-4925-b6a7-ea8a666dec26</guid>
  <pubDate>Thu, 03 Oct 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/22c6b8d0-ef8b-4925-b6a7-ea8a666dec26.mp3" length="54336384" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Jason is on location at EuroBSDcon getting interviews with those in the BSD Community.</itunes:subtitle>
  <itunes:duration>56:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Jason is on location at EuroBSDcon getting interviews with those in the BSD Community.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Interviews
Vanja Cvelbar
Stefano Marinelli
Dave Cottlehuber
Christos Margiolis
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
Jason is on location at EuroBSDcon getting interviews with those in the BSD Community. 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Jason is on location at EuroBSDcon getting interviews with those in the BSD Community.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interviews</h2>

<h3>Vanja Cvelbar</h3>

<h3>Stefano Marinelli</h3>

<h3>Dave Cottlehuber</h3>

<h3>Christos Margiolis</h3>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>

<p>Jason is on location at EuroBSDcon getting interviews with those in the BSD Community.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Jason is on location at EuroBSDcon getting interviews with those in the BSD Community.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interviews</h2>

<h3>Vanja Cvelbar</h3>

<h3>Stefano Marinelli</h3>

<h3>Dave Cottlehuber</h3>

<h3>Christos Margiolis</h3>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>

<p>Jason is on location at EuroBSDcon getting interviews with those in the BSD Community.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>578: KVM, but Smol</title>
  <link>https://www.bsdnow.tv/578</link>
  <guid isPermaLink="false">9ccb83c4-7aca-44f6-85bd-8e3e3487f781</guid>
  <pubDate>Thu, 26 Sep 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9ccb83c4-7aca-44f6-85bd-8e3e3487f781.mp3" length="55824384" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Limiting Process Priority in a FreeBSD Jail, Why You Should Use FreeBSD, The web fun fact that domains can end in dots and canonicalization failures, Replacing postfix with dma + auth, modern unix tool list, Smol KVM, The Computers of Voyager</itunes:subtitle>
  <itunes:duration>58:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Limiting Process Priority in a FreeBSD Jail, Why You Should Use FreeBSD, The web fun fact that domains can end in dots and canonicalization failures, Replacing postfix with dma + auth, modern unix tool list, Smol KVM, The Computers of Voyager
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Tips and Tricks: Limiting Process Priority in a FreeBSD Jail (https://it-notes.dragas.net/2024/07/11/limiting-process-priority-in-freebsd-jail/)
Why You Should Use FreeBSD (https://freebsdfoundation.org/blog/why-you-should-use-freebsd/)
News Roundup
The web fun fact that domains can end in dots and canonicalization failures (https://utcc.utoronto.ca/~cks/space/blog/web/DomainDotsAndCanonicalization)
Replacing postfix with dma + auth (https://dan.langille.org/2024/08/02/replacing-postfix-with-dma-auth/)
modern unix tool list (https://notes.billmill.org/computer_usage/cli_tips_and_tools/modern_unix_tool_list.html)
Smol KVM (https://adventurist.me/posts/00324)
The Computers of Voyager (https://hackaday.com/2024/05/06/the-computers-of-voyager/)
Beastie Bits
No unmodified files remain from original import of OpenBSD (https://www.undeadly.org/cgi?action=article;sid=20240824114631)
The BSDCan 2024 Playlist is now complete (https://www.undeadly.org/cgi?action=article;sid=20240814053159)
UDP parallel input committed to -current (http://undeadly.org/cgi?action=article;sid=20240727110501)
Your browser is your Computer (https://www.exaequos.com)
For the member-berries (https://defrag98.com)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, limiting process priority, fun fact, domain, canonicalization, postfix, dma, unix tool list, kvm, voyager</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Limiting Process Priority in a FreeBSD Jail, Why You Should Use FreeBSD, The web fun fact that domains can end in dots and canonicalization failures, Replacing postfix with dma + auth, modern unix tool list, Smol KVM, The Computers of Voyager</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://it-notes.dragas.net/2024/07/11/limiting-process-priority-in-freebsd-jail/" rel="nofollow">FreeBSD Tips and Tricks: Limiting Process Priority in a FreeBSD Jail</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/why-you-should-use-freebsd/" rel="nofollow">Why You Should Use FreeBSD</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/web/DomainDotsAndCanonicalization" rel="nofollow">The web fun fact that domains can end in dots and canonicalization failures</a></p>

<hr>

<p><a href="https://dan.langille.org/2024/08/02/replacing-postfix-with-dma-auth/" rel="nofollow">Replacing postfix with dma + auth</a></p>

<hr>

<p><a href="https://notes.billmill.org/computer_usage/cli_tips_and_tools/modern_unix_tool_list.html" rel="nofollow">modern unix tool list</a></p>

<hr>

<p><a href="https://adventurist.me/posts/00324" rel="nofollow">Smol KVM</a></p>

<hr>

<p><a href="https://hackaday.com/2024/05/06/the-computers-of-voyager/" rel="nofollow">The Computers of Voyager</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20240824114631" rel="nofollow">No unmodified files remain from original import of OpenBSD</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20240814053159" rel="nofollow">The BSDCan 2024 Playlist is now complete</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20240727110501" rel="nofollow">UDP parallel input committed to -current</a></li>
<li><a href="https://www.exaequos.com" rel="nofollow">Your browser is your Computer</a></li>
<li><a href="https://defrag98.com" rel="nofollow">For the member-berries</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Limiting Process Priority in a FreeBSD Jail, Why You Should Use FreeBSD, The web fun fact that domains can end in dots and canonicalization failures, Replacing postfix with dma + auth, modern unix tool list, Smol KVM, The Computers of Voyager</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://it-notes.dragas.net/2024/07/11/limiting-process-priority-in-freebsd-jail/" rel="nofollow">FreeBSD Tips and Tricks: Limiting Process Priority in a FreeBSD Jail</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/why-you-should-use-freebsd/" rel="nofollow">Why You Should Use FreeBSD</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/web/DomainDotsAndCanonicalization" rel="nofollow">The web fun fact that domains can end in dots and canonicalization failures</a></p>

<hr>

<p><a href="https://dan.langille.org/2024/08/02/replacing-postfix-with-dma-auth/" rel="nofollow">Replacing postfix with dma + auth</a></p>

<hr>

<p><a href="https://notes.billmill.org/computer_usage/cli_tips_and_tools/modern_unix_tool_list.html" rel="nofollow">modern unix tool list</a></p>

<hr>

<p><a href="https://adventurist.me/posts/00324" rel="nofollow">Smol KVM</a></p>

<hr>

<p><a href="https://hackaday.com/2024/05/06/the-computers-of-voyager/" rel="nofollow">The Computers of Voyager</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20240824114631" rel="nofollow">No unmodified files remain from original import of OpenBSD</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20240814053159" rel="nofollow">The BSDCan 2024 Playlist is now complete</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20240727110501" rel="nofollow">UDP parallel input committed to -current</a></li>
<li><a href="https://www.exaequos.com" rel="nofollow">Your browser is your Computer</a></li>
<li><a href="https://defrag98.com" rel="nofollow">For the member-berries</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>577: Multi-Threaded LZ4</title>
  <link>https://www.bsdnow.tv/577</link>
  <guid isPermaLink="false">ceb7dc79-e714-4083-b2c3-51e9e247b8ea</guid>
  <pubDate>Thu, 19 Sep 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ceb7dc79-e714-4083-b2c3-51e9e247b8ea.mp3" length="57201024" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>New Host Introduction 🤭, From Bridging to Routing With FreeBSD, Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization, The Dying Computer Museum, In practice, abstractions hide their underlying details, LZ4 Compression Algorithm Gets Multi-Threaded Update, Using Windows or Linux on FreeBSD's vm-bhyve, and more</itunes:subtitle>
  <itunes:duration>59:35</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>New Host Introduction 🤭, From Bridging to Routing With FreeBSD, Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization, The Dying Computer Museum, In practice, abstractions hide their underlying details, LZ4 Compression Algorithm Gets Multi-Threaded Update, Using Windows or Linux on FreeBSD's vm-bhyve, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
[New Host Introduction]
Evolving the BSD Cafe Network Setup: From Bridging to Routing With FreeBSD (https://it-notes.dragas.net/2024/08/01/evolving-bsd-cafe-from-bridging-to-routing/)
Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization (https://freebsdfoundation.org/blog/sovereign-tech-fund-to-invest-e686400-in-freebsd-infrastructure-modernization/)
News Roundup
The Dying Computer Museum (https://ascii.textfiles.com/archives/5672)
In practice, abstractions hide their underlying details (https://utcc.utoronto.ca/~cks/space/blog/tech/AbstractionsHideUnderlyingDetails)
LZ4 Compression Algorithm Gets Multi-Threaded Update (https://hardware.slashdot.org/story/24/07/28/0057247/lz4-compression-algorithm-gets-multi-threaded-update)
Using Windows or Linux on FreeBSD's vm-bhyve (https://srobb.net/vm-bhyve.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/577/feedback/Derek%20-%20Thanks.md
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, bridging, routing, sovereign tech fund, stf, investment, Infrastructure Modernization, dying computer museum, abstractions, lz4, compression, Algorithm, multi-threaded, vm-bhyve</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>New Host Introduction 🤭, From Bridging to Routing With FreeBSD, Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization, The Dying Computer Museum, In practice, abstractions hide their underlying details, LZ4 Compression Algorithm Gets Multi-Threaded Update, Using Windows or Linux on FreeBSD&#39;s vm-bhyve, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p>[New Host Introduction]</p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/08/01/evolving-bsd-cafe-from-bridging-to-routing/" rel="nofollow">Evolving the BSD Cafe Network Setup: From Bridging to Routing With FreeBSD</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/sovereign-tech-fund-to-invest-e686400-in-freebsd-infrastructure-modernization/" rel="nofollow">Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://ascii.textfiles.com/archives/5672" rel="nofollow">The Dying Computer Museum</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/AbstractionsHideUnderlyingDetails" rel="nofollow">In practice, abstractions hide their underlying details</a></p>

<hr>

<p><a href="https://hardware.slashdot.org/story/24/07/28/0057247/lz4-compression-algorithm-gets-multi-threaded-update" rel="nofollow">LZ4 Compression Algorithm Gets Multi-Threaded Update</a></p>

<hr>

<p><a href="https://srobb.net/vm-bhyve.html" rel="nofollow">Using Windows or Linux on FreeBSD&#39;s vm-bhyve</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/577/feedback/Derek%20-%20Thanks.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/577/feedback/Derek%20-%20Thanks.md</a></p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>New Host Introduction 🤭, From Bridging to Routing With FreeBSD, Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization, The Dying Computer Museum, In practice, abstractions hide their underlying details, LZ4 Compression Algorithm Gets Multi-Threaded Update, Using Windows or Linux on FreeBSD&#39;s vm-bhyve, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p>[New Host Introduction]</p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/08/01/evolving-bsd-cafe-from-bridging-to-routing/" rel="nofollow">Evolving the BSD Cafe Network Setup: From Bridging to Routing With FreeBSD</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/sovereign-tech-fund-to-invest-e686400-in-freebsd-infrastructure-modernization/" rel="nofollow">Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://ascii.textfiles.com/archives/5672" rel="nofollow">The Dying Computer Museum</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/AbstractionsHideUnderlyingDetails" rel="nofollow">In practice, abstractions hide their underlying details</a></p>

<hr>

<p><a href="https://hardware.slashdot.org/story/24/07/28/0057247/lz4-compression-algorithm-gets-multi-threaded-update" rel="nofollow">LZ4 Compression Algorithm Gets Multi-Threaded Update</a></p>

<hr>

<p><a href="https://srobb.net/vm-bhyve.html" rel="nofollow">Using Windows or Linux on FreeBSD&#39;s vm-bhyve</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/577/feedback/Derek%20-%20Thanks.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/577/feedback/Derek%20-%20Thanks.md</a></p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>576: The Forever Workaround</title>
  <link>https://www.bsdnow.tv/576</link>
  <guid isPermaLink="false">d7fcf7cf-acc7-48a6-955f-7eaf8ebe4f52</guid>
  <pubDate>Thu, 12 Sep 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d7fcf7cf-acc7-48a6-955f-7eaf8ebe4f52.mp3" length="59358336" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>From Cloud Chaos to FreeBSD Efficiency, August 2024 Foundation Update, Email encryption at rest on OpenBSD using dovecot and GPG, Workarounds are often forever (unless you work to make them otherwise), Remote Desktop using RDP and VNC, Iconography of the X Window System: The Boot Stipple, Plan 9 is a Uniquely Complete Operating System, and more</itunes:subtitle>
  <itunes:duration>1:01:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>From Cloud Chaos to FreeBSD Efficiency, August 2024 Foundation Update, Email encryption at rest on OpenBSD using dovecot and GPG, Workarounds are often forever (unless you work to make them otherwise), Remote Desktop using RDP and VNC, Iconography of the X Window System: The Boot Stipple, Plan 9 is a Uniquely Complete Operating System, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
From Cloud Chaos to FreeBSD Efficiency (https://it-notes.dragas.net/2024/07/04/from-cloud-chaos-to-freebsd-efficiency/)
August 2024 Foundation Update (https://freebsdfoundation.org/news-and-events/newsletter/august-2024-foundation-update/)
News Roundup
Emails encryption at rest on OpenBSD using dovecot and GPG (https://dataswamp.org/~solene/2024-08-14-automatic-emails-gpg-encryption-at-rest.html)
Workarounds are often forever (unless you work to make them otherwise) (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/WorkaroundsAreForeverByDefault)
Remote Desktop using RDP and VNC (https://www.tumfatig.net/2024/remote-desktop-using-rdp-and-vnc/)
Iconography of the X Window System: The Boot Stipple (https://matttproud.com/blog/posts/x-window-system-boot-stipple.html)
Plan 9 is a Uniquely Complete Operating System (https://posixcafe.org/blogs/2024/07/27/0/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, cloud, chaos, efficiency, encryption at rest, dovecot, GPG, workarounds, remote desktop, rdp, vnc, iconography, boot stipple, plan 9</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>From Cloud Chaos to FreeBSD Efficiency, August 2024 Foundation Update, Email encryption at rest on OpenBSD using dovecot and GPG, Workarounds are often forever (unless you work to make them otherwise), Remote Desktop using RDP and VNC, Iconography of the X Window System: The Boot Stipple, Plan 9 is a Uniquely Complete Operating System, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://it-notes.dragas.net/2024/07/04/from-cloud-chaos-to-freebsd-efficiency/" rel="nofollow">From Cloud Chaos to FreeBSD Efficiency</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/news-and-events/newsletter/august-2024-foundation-update/" rel="nofollow">August 2024 Foundation Update</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dataswamp.org/%7Esolene/2024-08-14-automatic-emails-gpg-encryption-at-rest.html" rel="nofollow">Emails encryption at rest on OpenBSD using dovecot and GPG</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/WorkaroundsAreForeverByDefault" rel="nofollow">Workarounds are often forever (unless you work to make them otherwise)</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/remote-desktop-using-rdp-and-vnc/" rel="nofollow">Remote Desktop using RDP and VNC</a></p>

<hr>

<p><a href="https://matttproud.com/blog/posts/x-window-system-boot-stipple.html" rel="nofollow">Iconography of the X Window System: The Boot Stipple</a></p>

<hr>

<p><a href="https://posixcafe.org/blogs/2024/07/27/0/" rel="nofollow">Plan 9 is a Uniquely Complete Operating System</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>From Cloud Chaos to FreeBSD Efficiency, August 2024 Foundation Update, Email encryption at rest on OpenBSD using dovecot and GPG, Workarounds are often forever (unless you work to make them otherwise), Remote Desktop using RDP and VNC, Iconography of the X Window System: The Boot Stipple, Plan 9 is a Uniquely Complete Operating System, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://it-notes.dragas.net/2024/07/04/from-cloud-chaos-to-freebsd-efficiency/" rel="nofollow">From Cloud Chaos to FreeBSD Efficiency</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/news-and-events/newsletter/august-2024-foundation-update/" rel="nofollow">August 2024 Foundation Update</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dataswamp.org/%7Esolene/2024-08-14-automatic-emails-gpg-encryption-at-rest.html" rel="nofollow">Emails encryption at rest on OpenBSD using dovecot and GPG</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/WorkaroundsAreForeverByDefault" rel="nofollow">Workarounds are often forever (unless you work to make them otherwise)</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/remote-desktop-using-rdp-and-vnc/" rel="nofollow">Remote Desktop using RDP and VNC</a></p>

<hr>

<p><a href="https://matttproud.com/blog/posts/x-window-system-boot-stipple.html" rel="nofollow">Iconography of the X Window System: The Boot Stipple</a></p>

<hr>

<p><a href="https://posixcafe.org/blogs/2024/07/27/0/" rel="nofollow">Plan 9 is a Uniquely Complete Operating System</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>575: Missing BSD/Linux</title>
  <link>https://www.bsdnow.tv/575</link>
  <guid isPermaLink="false">3c950f6d-fcf3-4fdf-a58b-df606f01192c</guid>
  <pubDate>Thu, 05 Sep 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3c950f6d-fcf3-4fdf-a58b-df606f01192c.mp3" length="49908864" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>X Window System At 40, Lessons from Ancient File Systems, HardenedBSD July 2024 Status Report, FreeBSD's 'root on ZFS' is appealing, I Miss BSD/Linux, Simple automated deployments using git</itunes:subtitle>
  <itunes:duration>51:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>X Window System At 40, Lessons from Ancient File Systems, HardenedBSD July 2024 Status Report, FreeBSD's 'root on ZFS' is appealing, I Miss BSD/Linux, Simple automated deployments using git
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
X Window System At 40 (https://blog.dshr.org/2024/07/x-window-system-at-40.html)
Lessons from Ancient File Systems (https://madcompiler.blogspot.com/2024/02/lessons-from-ancient-file-systems.html)
News Roundup
HardenedBSD July 2024 Status Report (https://hardenedbsd.org/article/shawn-webb/2024-08-03/hardenedbsd-july-2024-status-report)
FreeBSD's 'root on ZFS' default appeals to me for an odd reason (https://utcc.utoronto.ca/~cks/space/blog/unix/FreeBSDZFSRootAppeal)
I Miss BSD/Linux (https://brainbaking.com/post/2024/05/i-miss-bsd-linux/)
Simple automated deployments using git push (https://garrido.io/notes/simple-automated-deployments-git-push/)
Beastie Bits
EuroBSDCon 2024 (https://2024.eurobsdcon.org)
Ebook of “Run Your Own Mail Server” off to early backers (https://mwl.io/archives/23731)
Interactive UNIX (https://computeradsfromthepast.substack.com/p/interactive-unix)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, x window system, ancient file systems, status report, root on zfs, automated, deployments, git push</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>X Window System At 40, Lessons from Ancient File Systems, HardenedBSD July 2024 Status Report, FreeBSD&#39;s &#39;root on ZFS&#39; is appealing, I Miss BSD/Linux, Simple automated deployments using git</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://blog.dshr.org/2024/07/x-window-system-at-40.html" rel="nofollow">X Window System At 40</a></p>

<hr>

<p><a href="https://madcompiler.blogspot.com/2024/02/lessons-from-ancient-file-systems.html" rel="nofollow">Lessons from Ancient File Systems</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://hardenedbsd.org/article/shawn-webb/2024-08-03/hardenedbsd-july-2024-status-report" rel="nofollow">HardenedBSD July 2024 Status Report</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FreeBSDZFSRootAppeal" rel="nofollow">FreeBSD&#39;s &#39;root on ZFS&#39; default appeals to me for an odd reason</a></p>

<hr>

<p><a href="https://brainbaking.com/post/2024/05/i-miss-bsd-linux/" rel="nofollow">I Miss BSD/Linux</a></p>

<hr>

<p><a href="https://garrido.io/notes/simple-automated-deployments-git-push/" rel="nofollow">Simple automated deployments using git push</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://2024.eurobsdcon.org" rel="nofollow">EuroBSDCon 2024</a></li>
<li><a href="https://mwl.io/archives/23731" rel="nofollow">Ebook of “Run Your Own Mail Server” off to early backers</a></li>
<li><a href="https://computeradsfromthepast.substack.com/p/interactive-unix" rel="nofollow">Interactive UNIX</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>X Window System At 40, Lessons from Ancient File Systems, HardenedBSD July 2024 Status Report, FreeBSD&#39;s &#39;root on ZFS&#39; is appealing, I Miss BSD/Linux, Simple automated deployments using git</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://blog.dshr.org/2024/07/x-window-system-at-40.html" rel="nofollow">X Window System At 40</a></p>

<hr>

<p><a href="https://madcompiler.blogspot.com/2024/02/lessons-from-ancient-file-systems.html" rel="nofollow">Lessons from Ancient File Systems</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://hardenedbsd.org/article/shawn-webb/2024-08-03/hardenedbsd-july-2024-status-report" rel="nofollow">HardenedBSD July 2024 Status Report</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FreeBSDZFSRootAppeal" rel="nofollow">FreeBSD&#39;s &#39;root on ZFS&#39; default appeals to me for an odd reason</a></p>

<hr>

<p><a href="https://brainbaking.com/post/2024/05/i-miss-bsd-linux/" rel="nofollow">I Miss BSD/Linux</a></p>

<hr>

<p><a href="https://garrido.io/notes/simple-automated-deployments-git-push/" rel="nofollow">Simple automated deployments using git push</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://2024.eurobsdcon.org" rel="nofollow">EuroBSDCon 2024</a></li>
<li><a href="https://mwl.io/archives/23731" rel="nofollow">Ebook of “Run Your Own Mail Server” off to early backers</a></li>
<li><a href="https://computeradsfromthepast.substack.com/p/interactive-unix" rel="nofollow">Interactive UNIX</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>574: Hypervisor Determination</title>
  <link>https://www.bsdnow.tv/574</link>
  <guid isPermaLink="false">915df8c4-be34-4de6-b7ad-7c756f7e835f</guid>
  <pubDate>Thu, 29 Aug 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/915df8c4-be34-4de6-b7ad-7c756f7e835f.mp3" length="58220928" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve, Our slowly growing Unix monoculture, The six dumbest ideas in computer security (2005), Video Edition notes on OpenBSD, Full-featured email server running OpenBSD, ever heard of teaching a case study of Initial Unix?, and more</itunes:subtitle>
  <itunes:duration>1:00:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve, Our slowly growing Unix monoculture, The six dumbest ideas in computer security (2005), Video Edition notes on OpenBSD, Full-featured email server running OpenBSD, ever heard of teaching a case study of Initial Unix?, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve (https://freebsdfoundation.org/antithesis-pioneering-deterministic-hypervisors-with-freebsd-and-bhyve/)
Our slowly growing Unix monoculture (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/OurGrowingUnixMonoculture)
News Roundup
The six dumbest ideas in computer security (2005) (http://ranum.com/security/computer_security/editorials/dumb/index.html) + HN Thread (https://news.ycombinator.com/item?id=34513806)
Video Edition notes on OpenBSD (https://www.tumfatig.net/2024/video-edition-notes-on-openbsd/)
Full-featured email server running OpenBSD (https://dataswamp.org/~solene/2024-07-24-openbsd-email-server-setup.html)
Anyone ever heard of teaching a case study of Initial Unix? (https://www.tuhs.org/pipermail/tuhs/2024-July/030407.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
574 - extrowerk - dumb ideas in computer security (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/574/feedback/extrowerk%20-%20dumb%20ideas%20in%20computer%20security.md)
574 - Ep 569: on deprecation and support (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/574/feedback/Ep%20569%3A%20on%20deprecation%20and%20support)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, antithesis, Deterministic hypervisor, unix monoculture, dumb idea, computer security, video, editing, email server, teaching, case study, initial unix</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve, Our slowly growing Unix monoculture, The six dumbest ideas in computer security (2005), Video Edition notes on OpenBSD, Full-featured email server running OpenBSD, ever heard of teaching a case study of Initial Unix?, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/antithesis-pioneering-deterministic-hypervisors-with-freebsd-and-bhyve/" rel="nofollow">Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OurGrowingUnixMonoculture" rel="nofollow">Our slowly growing Unix monoculture</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="http://ranum.com/security/computer_security/editorials/dumb/index.html" rel="nofollow">The six dumbest ideas in computer security (2005)</a> + <a href="https://news.ycombinator.com/item?id=34513806" rel="nofollow">HN Thread</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/video-edition-notes-on-openbsd/" rel="nofollow">Video Edition notes on OpenBSD</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-07-24-openbsd-email-server-setup.html" rel="nofollow">Full-featured email server running OpenBSD</a></p>

<hr>

<p><a href="https://www.tuhs.org/pipermail/tuhs/2024-July/030407.html" rel="nofollow">Anyone ever heard of teaching a case study of Initial Unix?</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<h2>574 - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/574/feedback/extrowerk%20-%20dumb%20ideas%20in%20computer%20security.md" rel="nofollow">extrowerk - dumb ideas in computer security</a></h2>

<h2>574 - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/574/feedback/Ep%20569%3A%20on%20deprecation%20and%20support" rel="nofollow">Ep 569: on deprecation and support</a></h2>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve, Our slowly growing Unix monoculture, The six dumbest ideas in computer security (2005), Video Edition notes on OpenBSD, Full-featured email server running OpenBSD, ever heard of teaching a case study of Initial Unix?, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/antithesis-pioneering-deterministic-hypervisors-with-freebsd-and-bhyve/" rel="nofollow">Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OurGrowingUnixMonoculture" rel="nofollow">Our slowly growing Unix monoculture</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="http://ranum.com/security/computer_security/editorials/dumb/index.html" rel="nofollow">The six dumbest ideas in computer security (2005)</a> + <a href="https://news.ycombinator.com/item?id=34513806" rel="nofollow">HN Thread</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/video-edition-notes-on-openbsd/" rel="nofollow">Video Edition notes on OpenBSD</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-07-24-openbsd-email-server-setup.html" rel="nofollow">Full-featured email server running OpenBSD</a></p>

<hr>

<p><a href="https://www.tuhs.org/pipermail/tuhs/2024-July/030407.html" rel="nofollow">Anyone ever heard of teaching a case study of Initial Unix?</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<h2>574 - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/574/feedback/extrowerk%20-%20dumb%20ideas%20in%20computer%20security.md" rel="nofollow">extrowerk - dumb ideas in computer security</a></h2>

<h2>574 - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/574/feedback/Ep%20569%3A%20on%20deprecation%20and%20support" rel="nofollow">Ep 569: on deprecation and support</a></h2>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>573: Kyua Graduation</title>
  <link>https://www.bsdnow.tv/573</link>
  <guid isPermaLink="false">aec16048-9802-4728-a4b9-33cacc3e00c3</guid>
  <pubDate>Thu, 22 Aug 2024 08:30:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/aec16048-9802-4728-a4b9-33cacc3e00c3.mp3" length="52131072" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>What Would It Take to Recreate Bell Labs?, Human Scale Software vs Open Source, How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14, Why are some emails from Charlie Root and others are from root?, Backward compatibility has real costs even for settings, Kyua graduates, and more</itunes:subtitle>
  <itunes:duration>54:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>What Would It Take to Recreate Bell Labs?, Human Scale Software vs Open Source, How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14, Why are some emails from Charlie Root and others are from root?, Backward compatibility has real costs even for settings, Kyua graduates, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
What Would It Take to Recreate Bell Labs? (https://www.construction-physics.com/p/what-would-it-take-to-recreate-bell)
Human Scale Software vs Open Source (https://posixcafe.org/blogs/2024/07/31/0/)
News Roundup
How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14 (https://group.miletic.net/en/blog/2024-06-14-how-to-run-visual-studio-vs-code-remote-over-ssh-on-freebsd-13-and-14)
Why are some emails from Charlie Root and others are from root? (https://dan.langille.org/2024/07/27/why-are-some-emails-from-charlie-root-and-others-are-from-root/)
Backward compatibility, even for settings, has real costs (https://utcc.utoronto.ca/~cks/space/blog/programming/BackwardCompatibilityHasCosts)
Kyua graduates (https://jmmv.dev/2024/08/kyua-graduates.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
573 - Vedran - linuxulator (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/573/feedback/Vedran%20-%20linuxulator)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, bell labs, recreate, human scale software, visual studio code, remote, ssh, email, charlie root, backward compatibility, kyua, test framework, testing</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>What Would It Take to Recreate Bell Labs?, Human Scale Software vs Open Source, How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14, Why are some emails from Charlie Root and others are from root?, Backward compatibility has real costs even for settings, Kyua graduates, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.construction-physics.com/p/what-would-it-take-to-recreate-bell" rel="nofollow">What Would It Take to Recreate Bell Labs?</a></p>

<hr>

<p><a href="https://posixcafe.org/blogs/2024/07/31/0/" rel="nofollow">Human Scale Software vs Open Source</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://group.miletic.net/en/blog/2024-06-14-how-to-run-visual-studio-vs-code-remote-over-ssh-on-freebsd-13-and-14" rel="nofollow">How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14</a></p>

<hr>

<p><a href="https://dan.langille.org/2024/07/27/why-are-some-emails-from-charlie-root-and-others-are-from-root/" rel="nofollow">Why are some emails from Charlie Root and others are from root?</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/programming/BackwardCompatibilityHasCosts" rel="nofollow">Backward compatibility, even for settings, has real costs</a></p>

<hr>

<p><a href="https://jmmv.dev/2024/08/kyua-graduates.html" rel="nofollow">Kyua graduates</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>573 - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/573/feedback/Vedran%20-%20linuxulator" rel="nofollow">Vedran - linuxulator</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>What Would It Take to Recreate Bell Labs?, Human Scale Software vs Open Source, How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14, Why are some emails from Charlie Root and others are from root?, Backward compatibility has real costs even for settings, Kyua graduates, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.construction-physics.com/p/what-would-it-take-to-recreate-bell" rel="nofollow">What Would It Take to Recreate Bell Labs?</a></p>

<hr>

<p><a href="https://posixcafe.org/blogs/2024/07/31/0/" rel="nofollow">Human Scale Software vs Open Source</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://group.miletic.net/en/blog/2024-06-14-how-to-run-visual-studio-vs-code-remote-over-ssh-on-freebsd-13-and-14" rel="nofollow">How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14</a></p>

<hr>

<p><a href="https://dan.langille.org/2024/07/27/why-are-some-emails-from-charlie-root-and-others-are-from-root/" rel="nofollow">Why are some emails from Charlie Root and others are from root?</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/programming/BackwardCompatibilityHasCosts" rel="nofollow">Backward compatibility, even for settings, has real costs</a></p>

<hr>

<p><a href="https://jmmv.dev/2024/08/kyua-graduates.html" rel="nofollow">Kyua graduates</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>573 - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/573/feedback/Vedran%20-%20linuxulator" rel="nofollow">Vedran - linuxulator</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>572: Where's my backup?</title>
  <link>https://www.bsdnow.tv/572</link>
  <guid isPermaLink="false">a12099e3-91b5-4c50-bfd6-6c4e80cbbefb</guid>
  <pubDate>Thu, 15 Aug 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a12099e3-91b5-4c50-bfd6-6c4e80cbbefb.mp3" length="57835776" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD Workstation for the People, Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD, Updating FreeBSD the Manual Way, Part of (computer) security is convincing people that it works, Where’s my backup?, Vi and Vim: A Brief Overview, and more</itunes:subtitle>
  <itunes:duration>1:00:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD Workstation for the People, Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD, Updating FreeBSD the Manual Way, Part of (computer) security is convincing people that it works, Where’s my backup?, Vi and Vim: A Brief Overview, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenBSD Workstation for the People (https://www.tumfatig.net/2024/openbsd-workstation-for-the-people/)
Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD (https://it-notes.dragas.net/2024/07/15/bridging-networks-across-vps-wireguard-vxlan-freebsd/?utm_source=bsdweekly)
News Roundup
Updating FreeBSD the Manual Way (https://blog.feld.me/posts/2024/07/updating-freebsd-the-manual-way/)
Part of (computer) security is convincing people that it works (https://utcc.utoronto.ca/~cks/space/blog/tech/SecurityNeedsToConvince)
Where’s my backup? (https://dan.langille.org/2024/07/16/wheres-my-backup/)
Vi and Vim: A Brief Overview (https://machaddr.substack.com/p/vi-and-vim-a-brief-overview)
Hello FreeBSD (https://garrido.io/posts/2024/07/21/hello-freebsd/)
Beastie Bits
DeadBSD #5 EnigmOS (https://www.youtube.com/watch?v=bPkX5UypCAQ)
THE WORKSTATION YOU WANTED IN 1990, IN YOUR POCKET (https://hackaday.com/2024/07/03/the-workstation-you-wanted-in-1990-in-your-pocket/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Johnny - Nyxt (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/572/feedback/Johnny%20-%20Nyxt.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, workstation, for the people, bridging networks, vps, wireguard, vxlan, manual update, updating, computer security, backup, vi, vim, overview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD Workstation for the People, Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD, Updating FreeBSD the Manual Way, Part of (computer) security is convincing people that it works, Where’s my backup?, Vi and Vim: A Brief Overview, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.tumfatig.net/2024/openbsd-workstation-for-the-people/" rel="nofollow">OpenBSD Workstation for the People</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/07/15/bridging-networks-across-vps-wireguard-vxlan-freebsd/?utm_source=bsdweekly" rel="nofollow">Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://blog.feld.me/posts/2024/07/updating-freebsd-the-manual-way/" rel="nofollow">Updating FreeBSD the Manual Way</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/SecurityNeedsToConvince" rel="nofollow">Part of (computer) security is convincing people that it works</a></p>

<hr>

<p><a href="https://dan.langille.org/2024/07/16/wheres-my-backup/" rel="nofollow">Where’s my backup?</a></p>

<hr>

<p><a href="https://machaddr.substack.com/p/vi-and-vim-a-brief-overview" rel="nofollow">Vi and Vim: A Brief Overview</a></p>

<hr>

<p><a href="https://garrido.io/posts/2024/07/21/hello-freebsd/" rel="nofollow">Hello FreeBSD</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=bPkX5UypCAQ" rel="nofollow">DeadBSD #5 EnigmOS</a></li>
<li><a href="https://hackaday.com/2024/07/03/the-workstation-you-wanted-in-1990-in-your-pocket/" rel="nofollow">THE WORKSTATION YOU WANTED IN 1990, IN YOUR POCKET</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/572/feedback/Johnny%20-%20Nyxt.md" rel="nofollow">Johnny - Nyxt</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD Workstation for the People, Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD, Updating FreeBSD the Manual Way, Part of (computer) security is convincing people that it works, Where’s my backup?, Vi and Vim: A Brief Overview, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.tumfatig.net/2024/openbsd-workstation-for-the-people/" rel="nofollow">OpenBSD Workstation for the People</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/07/15/bridging-networks-across-vps-wireguard-vxlan-freebsd/?utm_source=bsdweekly" rel="nofollow">Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://blog.feld.me/posts/2024/07/updating-freebsd-the-manual-way/" rel="nofollow">Updating FreeBSD the Manual Way</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/SecurityNeedsToConvince" rel="nofollow">Part of (computer) security is convincing people that it works</a></p>

<hr>

<p><a href="https://dan.langille.org/2024/07/16/wheres-my-backup/" rel="nofollow">Where’s my backup?</a></p>

<hr>

<p><a href="https://machaddr.substack.com/p/vi-and-vim-a-brief-overview" rel="nofollow">Vi and Vim: A Brief Overview</a></p>

<hr>

<p><a href="https://garrido.io/posts/2024/07/21/hello-freebsd/" rel="nofollow">Hello FreeBSD</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=bPkX5UypCAQ" rel="nofollow">DeadBSD #5 EnigmOS</a></li>
<li><a href="https://hackaday.com/2024/07/03/the-workstation-you-wanted-in-1990-in-your-pocket/" rel="nofollow">THE WORKSTATION YOU WANTED IN 1990, IN YOUR POCKET</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/572/feedback/Johnny%20-%20Nyxt.md" rel="nofollow">Johnny - Nyxt</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>571: Cloud Chaos</title>
  <link>https://www.bsdnow.tv/571</link>
  <guid isPermaLink="false">84f1031b-d3b0-4f29-ab3e-baec15d00f33</guid>
  <pubDate>Thu, 08 Aug 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/84f1031b-d3b0-4f29-ab3e-baec15d00f33.mp3" length="66814464" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Navigating FreeBSD’s New Quarterly and Biennial Release Schedule, EuroBSDCon 2024 Schedule, From Cloud Chaos to FreeBSD Efficiency, Local-to-anchors tables in PF rules, CloudBSD, and more</itunes:subtitle>
  <itunes:duration>1:09:35</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Navigating FreeBSD’s New Quarterly and Biennial Release Schedule, EuroBSDCon 2024 Schedule, From Cloud Chaos to FreeBSD Efficiency, Local-to-anchors tables in PF rules, CloudBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Navigating FreeBSD’s New Quarterly and Biennial Release Schedule (https://freebsdfoundation.org/blog/navigating-freebsds-new-quarterly-and-biennial-release-schedule/)
https://mccd.space/posts/netbsd-review/ (https://mccd.space/posts/netbsd-review/)
EuroBSDCon 2024 Schedule (https://events.eurobsdcon.org/2024/schedule/)
News Roundup
From Cloud Chaos to FreeBSD Efficiency (https://it-notes.dragas.net/2024/07/04/from-cloud-chaos-to-freebsd-efficiency/)
Enable local-to-anchors tables in PF rules (https://undeadly.org/cgi?action=article;sid=20240714154257)
CloudBSD (https://cloudbsd.xyz/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Rick - Feedback about Docs Bugs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/571/feedback/Rick%20-%20Feedback%20about%20Docs%20Bugs.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, navigating, quarterly release, release schedule, eurobsdcon schedule, cloud, chaos, efficiency, X window, 40 years, interactive, local-to-anchors, pf rules</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Navigating FreeBSD’s New Quarterly and Biennial Release Schedule, EuroBSDCon 2024 Schedule, From Cloud Chaos to FreeBSD Efficiency, Local-to-anchors tables in PF rules, CloudBSD, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/navigating-freebsds-new-quarterly-and-biennial-release-schedule/" rel="nofollow">Navigating FreeBSD’s New Quarterly and Biennial Release Schedule</a></p>

<hr>

<p><a href="https://mccd.space/posts/netbsd-review/" rel="nofollow">https://mccd.space/posts/netbsd-review/</a></p>

<hr>

<p><a href="https://events.eurobsdcon.org/2024/schedule/" rel="nofollow">EuroBSDCon 2024 Schedule</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://it-notes.dragas.net/2024/07/04/from-cloud-chaos-to-freebsd-efficiency/" rel="nofollow">From Cloud Chaos to FreeBSD Efficiency</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240714154257" rel="nofollow">Enable local-to-anchors tables in PF rules</a></p>

<hr>

<p><a href="https://cloudbsd.xyz/" rel="nofollow">CloudBSD</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/571/feedback/Rick%20-%20Feedback%20about%20Docs%20Bugs.md" rel="nofollow">Rick - Feedback about Docs Bugs</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Navigating FreeBSD’s New Quarterly and Biennial Release Schedule, EuroBSDCon 2024 Schedule, From Cloud Chaos to FreeBSD Efficiency, Local-to-anchors tables in PF rules, CloudBSD, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/navigating-freebsds-new-quarterly-and-biennial-release-schedule/" rel="nofollow">Navigating FreeBSD’s New Quarterly and Biennial Release Schedule</a></p>

<hr>

<p><a href="https://mccd.space/posts/netbsd-review/" rel="nofollow">https://mccd.space/posts/netbsd-review/</a></p>

<hr>

<p><a href="https://events.eurobsdcon.org/2024/schedule/" rel="nofollow">EuroBSDCon 2024 Schedule</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://it-notes.dragas.net/2024/07/04/from-cloud-chaos-to-freebsd-efficiency/" rel="nofollow">From Cloud Chaos to FreeBSD Efficiency</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240714154257" rel="nofollow">Enable local-to-anchors tables in PF rules</a></p>

<hr>

<p><a href="https://cloudbsd.xyz/" rel="nofollow">CloudBSD</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/571/feedback/Rick%20-%20Feedback%20about%20Docs%20Bugs.md" rel="nofollow">Rick - Feedback about Docs Bugs</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>569: The ZFS Pi</title>
  <link>https://www.bsdnow.tv/569</link>
  <guid isPermaLink="false">766ceaa1-9d99-40fc-8a8c-b640d050e19e</guid>
  <pubDate>Thu, 25 Jul 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/766ceaa1-9d99-40fc-8a8c-b640d050e19e.mp3" length="45727104" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Enhancing FreeBSD Stability With ZFS Pool Checkpoints, Plaintext is not a great format for (system) logs, Initial playlist of 28 BSDCan Videos released, Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root, A practical guide to VPNs, IPv6, routing domains and IPSEC, How to mount ISO or file disk images on OpenBSD, and more</itunes:subtitle>
  <itunes:duration>47:37</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Enhancing FreeBSD Stability With ZFS Pool Checkpoints, Plaintext is not a great format for (system) logs, Initial playlist of 28 BSDCan Videos released, Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root, A practical guide to VPNs, IPv6, routing domains and IPSEC, How to mount ISO or file disk images on OpenBSD, and
more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Enhancing FreeBSD Stability With ZFS Pool Checkpoints (https://it-notes.dragas.net/2024/07/01/enhancing-freebsd-stability-with-zfs-pool-checkpoints/)
Plaintext is not a great format for (system) logs (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/PlaintextNotGreatLogFormat)
News Roundup
Initial playlist of 28 BSDCan Videos released (http://undeadly.org/cgi?action=article;sid=20240630100913)
Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root (https://axcella.com/blog/2024/02/03/installing-freebsd-14-on-raspberry-pi-4b-with-zfs-root/)
The following components make up my setup:
Raspberry Pi 4B, 8 GB RAM (https://www.raspberrypi.com/products/raspberry-pi-4-model-b/)
Official Raspberry Pi 4 Power Supply (https://www.raspberrypi.com/products/power-supply/)
Geekworm Raspberry Pi 4 11mm Embedded Heatsink (P165-B) (https://geekworm.com/products/raspberry-pi-4-11mm-embedded-heatsink-p165-b)
Geekworm for Raspberry Pi 4, X862 V2.0 M.2 NGFF SATA SSD Storage Expansion Board with USB 3.1 Connector Support Key-B 2280 SSD (https://geekworm.com/products/x862)
WD Blue SA510 SATA SSD 2 TB M.2 2280 (https://www.westerndigital.com/products/internal-drives/wd-blue-sa510-sata-m-2-ssd?sku=WDS200T3B0B)
4K 60Hz Micro HDMI to HDMI Adapter (to connect to a monitor, can also run headless with just power and network cable connected)
A practical guide to VPNs, IPv6, routing domains and IPSEC (http://undeadly.org/cgi?action=article;sid=20240706084626)
How to mount ISO or file disk images on OpenBSD (https://dataswamp.org/~solene/2024-06-15-mount-iso-file-openbsd.html)
Beastie Bits
DeadBSD Series - There have been a few FreeBSD derived OS’s over the years, some stay, many others fade away. In this series, DeadBSD’s, we will be revisiting those long gone BSD’s and see what we missed out on.
Fury (https://www.youtube.com/watch?v=3xl2BdlBjg0)
CultBSD (https://www.youtube.com/watch?v=hmT1fXuOyos)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
569 - RobN - A Thanks (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/569/feedback/Rob%20-%20A%20Thanks.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, stability, enhancing, checkpoints, plaintext, system logs, playlist, bsdcan 2024, videos, raspberry pi, zfs root, vpn, practical, ipv6, routing domains, ipsec, iso, file disk images</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Enhancing FreeBSD Stability With ZFS Pool Checkpoints, Plaintext is not a great format for (system) logs, Initial playlist of 28 BSDCan Videos released, Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root, A practical guide to VPNs, IPv6, routing domains and IPSEC, How to mount ISO or file disk images on OpenBSD, and<br>
more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://it-notes.dragas.net/2024/07/01/enhancing-freebsd-stability-with-zfs-pool-checkpoints/" rel="nofollow">Enhancing FreeBSD Stability With ZFS Pool Checkpoints</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/PlaintextNotGreatLogFormat" rel="nofollow">Plaintext is not a great format for (system) logs</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240630100913" rel="nofollow">Initial playlist of 28 BSDCan Videos released</a></p>

<hr>

<p><a href="https://axcella.com/blog/2024/02/03/installing-freebsd-14-on-raspberry-pi-4b-with-zfs-root/" rel="nofollow">Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root</a></p>

<ul>
<li>The following components make up my setup:

<ul>
<li><a href="https://www.raspberrypi.com/products/raspberry-pi-4-model-b/" rel="nofollow">Raspberry Pi 4B, 8 GB RAM</a></li>
<li><a href="https://www.raspberrypi.com/products/power-supply/" rel="nofollow">Official Raspberry Pi 4 Power Supply</a></li>
<li><a href="https://geekworm.com/products/raspberry-pi-4-11mm-embedded-heatsink-p165-b" rel="nofollow">Geekworm Raspberry Pi 4 11mm Embedded Heatsink (P165-B)</a></li>
<li><a href="https://geekworm.com/products/x862" rel="nofollow">Geekworm for Raspberry Pi 4, X862 V2.0 M.2 NGFF SATA SSD Storage Expansion Board with USB 3.1 Connector Support Key-B 2280 SSD</a></li>
<li><a href="https://www.westerndigital.com/products/internal-drives/wd-blue-sa510-sata-m-2-ssd?sku=WDS200T3B0B" rel="nofollow">WD Blue SA510 SATA SSD 2 TB M.2 2280</a></li>
<li>4K 60Hz Micro HDMI to HDMI Adapter (to connect to a monitor, can also run headless with just power and network cable connected)</li>
</ul></li>
</ul>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240706084626" rel="nofollow">A practical guide to VPNs, IPv6, routing domains and IPSEC</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-06-15-mount-iso-file-openbsd.html" rel="nofollow">How to mount ISO or file disk images on OpenBSD</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li>DeadBSD Series - There have been a few FreeBSD derived OS’s over the years, some stay, many others fade away. In this series, DeadBSD’s, we will be revisiting those long gone BSD’s and see what we missed out on.</li>
<li><a href="https://www.youtube.com/watch?v=3xl2BdlBjg0" rel="nofollow">Fury</a></li>
<li><a href="https://www.youtube.com/watch?v=hmT1fXuOyos" rel="nofollow">CultBSD</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>569 - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/569/feedback/Rob%20-%20A%20Thanks.md" rel="nofollow">RobN - A Thanks</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Enhancing FreeBSD Stability With ZFS Pool Checkpoints, Plaintext is not a great format for (system) logs, Initial playlist of 28 BSDCan Videos released, Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root, A practical guide to VPNs, IPv6, routing domains and IPSEC, How to mount ISO or file disk images on OpenBSD, and<br>
more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://it-notes.dragas.net/2024/07/01/enhancing-freebsd-stability-with-zfs-pool-checkpoints/" rel="nofollow">Enhancing FreeBSD Stability With ZFS Pool Checkpoints</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/PlaintextNotGreatLogFormat" rel="nofollow">Plaintext is not a great format for (system) logs</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240630100913" rel="nofollow">Initial playlist of 28 BSDCan Videos released</a></p>

<hr>

<p><a href="https://axcella.com/blog/2024/02/03/installing-freebsd-14-on-raspberry-pi-4b-with-zfs-root/" rel="nofollow">Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root</a></p>

<ul>
<li>The following components make up my setup:

<ul>
<li><a href="https://www.raspberrypi.com/products/raspberry-pi-4-model-b/" rel="nofollow">Raspberry Pi 4B, 8 GB RAM</a></li>
<li><a href="https://www.raspberrypi.com/products/power-supply/" rel="nofollow">Official Raspberry Pi 4 Power Supply</a></li>
<li><a href="https://geekworm.com/products/raspberry-pi-4-11mm-embedded-heatsink-p165-b" rel="nofollow">Geekworm Raspberry Pi 4 11mm Embedded Heatsink (P165-B)</a></li>
<li><a href="https://geekworm.com/products/x862" rel="nofollow">Geekworm for Raspberry Pi 4, X862 V2.0 M.2 NGFF SATA SSD Storage Expansion Board with USB 3.1 Connector Support Key-B 2280 SSD</a></li>
<li><a href="https://www.westerndigital.com/products/internal-drives/wd-blue-sa510-sata-m-2-ssd?sku=WDS200T3B0B" rel="nofollow">WD Blue SA510 SATA SSD 2 TB M.2 2280</a></li>
<li>4K 60Hz Micro HDMI to HDMI Adapter (to connect to a monitor, can also run headless with just power and network cable connected)</li>
</ul></li>
</ul>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240706084626" rel="nofollow">A practical guide to VPNs, IPv6, routing domains and IPSEC</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-06-15-mount-iso-file-openbsd.html" rel="nofollow">How to mount ISO or file disk images on OpenBSD</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li>DeadBSD Series - There have been a few FreeBSD derived OS’s over the years, some stay, many others fade away. In this series, DeadBSD’s, we will be revisiting those long gone BSD’s and see what we missed out on.</li>
<li><a href="https://www.youtube.com/watch?v=3xl2BdlBjg0" rel="nofollow">Fury</a></li>
<li><a href="https://www.youtube.com/watch?v=hmT1fXuOyos" rel="nofollow">CultBSD</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p>569 - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/569/feedback/Rob%20-%20A%20Thanks.md" rel="nofollow">RobN - A Thanks</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>568: regreSSHion</title>
  <link>https://www.bsdnow.tv/568</link>
  <guid isPermaLink="false">a0464306-5fee-4eba-a81c-b26393ebd0f2</guid>
  <pubDate>Thu, 18 Jul 2024 12:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a0464306-5fee-4eba-a81c-b26393ebd0f2.mp3" length="78023565" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>regreSSHion vulnerability, Improving and debugging FreeBSDs Intel wifi support, FreeBSD adds an implementation of the 9P filesystem, FreeBSD Zero to Desktop Speedrun Challenge, Why and how to run your own FreeBSD package cache, Game of Trees Hub, Why Does FreeBSD Default to Csh/Tcsh, and more</itunes:subtitle>
  <itunes:duration>54:10</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>regreSSHion vulnerability, Improving and debugging FreeBSDs Intel wifi support, FreeBSD adds an implementation of the 9P filesystem, FreeBSD Zero to Desktop Speedrun Challenge, Why and how to run your own FreeBSD package cache, Game of Trees Hub, Why Does FreeBSD Default to Csh/Tcsh, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems (https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt) and OpenBSD 9.8 (https://undeadly.org/cgi?action=article;sid=20240701102851)
Improving and debugging FreeBSDs Intel wifi support (https://freebsdfoundation.org/blog/improving-and-debugging-freebsds-intel-wi-fi-support-cheng-cuis-key-role-in-the-iwlwifi-project/)
FreeBSD adds an implementation of the 9P filesystem (https://cgit.freebsd.org/src/commit/?id=e97ad33a89a78f55280b0485b3249ee9b907a718)
News Roundup
FreeBSD Zero to Desktop Speedrun Challenge (https://vermaden.wordpress.com/2024/04/05/freebsd-zero-to-desktop-speedrun-challenge/)
Why and how to run your own FreeBSD package cache (https://blog.rlwinm.de/why-and-how-to-run-your-own-freebsd-package-cache-3wbg)
Game of Trees Hub: A Git Repository Hosting Service Based on OpenBSD (http://undeadly.org/cgi?action=article;sid=20240621074337)
Why Does FreeBSD Default to Csh/Tcsh? Exploring Its Advantages (https://lobste.rs/s/iuzuge/why_does_freebsd_default_csh_tcsh)
AI-assisted computer interfaces of the future (https://whynothugo.nl/journal/2023/03/23/ai-assisted-computer-interfaces-of-the-future/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, regresshion, vulnerability, ssh, intel wifi, support, debugging, improving, 9P filesystem, 9pfs, zero to desktop, challenge, package cache, game of trees hub, csh, tcsh, default</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>regreSSHion vulnerability, Improving and debugging FreeBSDs Intel wifi support, FreeBSD adds an implementation of the 9P filesystem, FreeBSD Zero to Desktop Speedrun Challenge, Why and how to run your own FreeBSD package cache, Game of Trees Hub, Why Does FreeBSD Default to Csh/Tcsh, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt" rel="nofollow">regreSSHion: RCE in OpenSSH&#39;s server, on glibc-based Linux systems</a> and <a href="https://undeadly.org/cgi?action=article;sid=20240701102851" rel="nofollow">OpenBSD 9.8</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/improving-and-debugging-freebsds-intel-wi-fi-support-cheng-cuis-key-role-in-the-iwlwifi-project/" rel="nofollow">Improving and debugging FreeBSDs Intel wifi support</a></p>

<hr>

<p><a href="https://cgit.freebsd.org/src/commit/?id=e97ad33a89a78f55280b0485b3249ee9b907a718" rel="nofollow">FreeBSD adds an implementation of the 9P filesystem</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://vermaden.wordpress.com/2024/04/05/freebsd-zero-to-desktop-speedrun-challenge/" rel="nofollow">FreeBSD Zero to Desktop Speedrun Challenge</a></p>

<hr>

<p><a href="https://blog.rlwinm.de/why-and-how-to-run-your-own-freebsd-package-cache-3wbg" rel="nofollow">Why and how to run your own FreeBSD package cache</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240621074337" rel="nofollow">Game of Trees Hub: A Git Repository Hosting Service Based on OpenBSD</a></p>

<hr>

<p><a href="https://lobste.rs/s/iuzuge/why_does_freebsd_default_csh_tcsh" rel="nofollow">Why Does FreeBSD Default to Csh/Tcsh? Exploring Its Advantages</a></p>

<hr>

<p><a href="https://whynothugo.nl/journal/2023/03/23/ai-assisted-computer-interfaces-of-the-future/" rel="nofollow">AI-assisted computer interfaces of the future</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>regreSSHion vulnerability, Improving and debugging FreeBSDs Intel wifi support, FreeBSD adds an implementation of the 9P filesystem, FreeBSD Zero to Desktop Speedrun Challenge, Why and how to run your own FreeBSD package cache, Game of Trees Hub, Why Does FreeBSD Default to Csh/Tcsh, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt" rel="nofollow">regreSSHion: RCE in OpenSSH&#39;s server, on glibc-based Linux systems</a> and <a href="https://undeadly.org/cgi?action=article;sid=20240701102851" rel="nofollow">OpenBSD 9.8</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/improving-and-debugging-freebsds-intel-wi-fi-support-cheng-cuis-key-role-in-the-iwlwifi-project/" rel="nofollow">Improving and debugging FreeBSDs Intel wifi support</a></p>

<hr>

<p><a href="https://cgit.freebsd.org/src/commit/?id=e97ad33a89a78f55280b0485b3249ee9b907a718" rel="nofollow">FreeBSD adds an implementation of the 9P filesystem</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://vermaden.wordpress.com/2024/04/05/freebsd-zero-to-desktop-speedrun-challenge/" rel="nofollow">FreeBSD Zero to Desktop Speedrun Challenge</a></p>

<hr>

<p><a href="https://blog.rlwinm.de/why-and-how-to-run-your-own-freebsd-package-cache-3wbg" rel="nofollow">Why and how to run your own FreeBSD package cache</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240621074337" rel="nofollow">Game of Trees Hub: A Git Repository Hosting Service Based on OpenBSD</a></p>

<hr>

<p><a href="https://lobste.rs/s/iuzuge/why_does_freebsd_default_csh_tcsh" rel="nofollow">Why Does FreeBSD Default to Csh/Tcsh? Exploring Its Advantages</a></p>

<hr>

<p><a href="https://whynothugo.nl/journal/2023/03/23/ai-assisted-computer-interfaces-of-the-future/" rel="nofollow">AI-assisted computer interfaces of the future</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>567: To the Core</title>
  <link>https://www.bsdnow.tv/567</link>
  <guid isPermaLink="false">d7de607e-7822-486f-8649-0053e89207a6</guid>
  <pubDate>Thu, 11 Jul 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d7de607e-7822-486f-8649-0053e89207a6.mp3" length="60410304" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>SSH as a sudo replacement, Core.13 is Now In Office, Running GoToSocial on NetBSD, A DMD package for OpenIndiana, Adding more swap space to Omnios, OpenBSD adds initial support for Qualcomm Snapdragon Elite X after 1 day, and more</itunes:subtitle>
  <itunes:duration>41:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>SSH as a sudo replacement, Core.13 is Now In Office, Running GoToSocial on NetBSD, A DMD package for OpenIndiana, Adding more swap space to Omnios, OpenBSD adds initial support for Qualcomm Snapdragon Elite X after 1 day, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
SSH as a sudo replacement (https://whynothugo.nl/journal/2024/06/13/ssh-as-a-sudo-replacement/)
Core.13 is Now In Office (https://lists.freebsd.org/archives/freebsd-announce/2024-June/000136.html)
News Roundup
Running GoToSocial on NetBSD (https://www.tumfatig.net/2024/running-gotosocial-on-netbsd/)
A DMD package for OpenIndiana (https://briancallahan.net/blog/20240609.html)
Adding more swap space to Omnios (https://neirac.srht.site/posts/omnios-add-swap.html)
OpenBSD added initial support for Qualcomm Snapdragon Elite X after 1 day (https://undeadly.org/cgi?action=article;sid=20240620105457)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Isa - Pinebook Question.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/567/feedback/Isa%20-%20Pinebook%20Question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, sudo, replacement, ssh, core.13, gotosocial, DMD, openindiana, omnios, qualcomm, snapdragon elite X</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>SSH as a sudo replacement, Core.13 is Now In Office, Running GoToSocial on NetBSD, A DMD package for OpenIndiana, Adding more swap space to Omnios, OpenBSD adds initial support for Qualcomm Snapdragon Elite X after 1 day, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://whynothugo.nl/journal/2024/06/13/ssh-as-a-sudo-replacement/" rel="nofollow">SSH as a sudo replacement</a></p>

<hr>

<p><a href="https://lists.freebsd.org/archives/freebsd-announce/2024-June/000136.html" rel="nofollow">Core.13 is Now In Office</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.tumfatig.net/2024/running-gotosocial-on-netbsd/" rel="nofollow">Running GoToSocial on NetBSD</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20240609.html" rel="nofollow">A DMD package for OpenIndiana</a></p>

<hr>

<p><a href="https://neirac.srht.site/posts/omnios-add-swap.html" rel="nofollow">Adding more swap space to Omnios</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240620105457" rel="nofollow">OpenBSD added initial support for Qualcomm Snapdragon Elite X after 1 day</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/567/feedback/Isa%20-%20Pinebook%20Question.md" rel="nofollow">Isa - Pinebook Question.md</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>SSH as a sudo replacement, Core.13 is Now In Office, Running GoToSocial on NetBSD, A DMD package for OpenIndiana, Adding more swap space to Omnios, OpenBSD adds initial support for Qualcomm Snapdragon Elite X after 1 day, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://whynothugo.nl/journal/2024/06/13/ssh-as-a-sudo-replacement/" rel="nofollow">SSH as a sudo replacement</a></p>

<hr>

<p><a href="https://lists.freebsd.org/archives/freebsd-announce/2024-June/000136.html" rel="nofollow">Core.13 is Now In Office</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.tumfatig.net/2024/running-gotosocial-on-netbsd/" rel="nofollow">Running GoToSocial on NetBSD</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20240609.html" rel="nofollow">A DMD package for OpenIndiana</a></p>

<hr>

<p><a href="https://neirac.srht.site/posts/omnios-add-swap.html" rel="nofollow">Adding more swap space to Omnios</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240620105457" rel="nofollow">OpenBSD added initial support for Qualcomm Snapdragon Elite X after 1 day</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/567/feedback/Isa%20-%20Pinebook%20Question.md" rel="nofollow">Isa - Pinebook Question.md</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>566: Open Source Excellence</title>
  <link>https://www.bsdnow.tv/566</link>
  <guid isPermaLink="false">6d99d221-b4fa-4373-b5df-1a36548bfd9e</guid>
  <pubDate>Thu, 04 Jul 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6d99d221-b4fa-4373-b5df-1a36548bfd9e.mp3" length="80745408" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A Journey Through 31 Years of Open Source Excellence, Proxmox vs FreeBSD: Which Virtualization Host Performs Better?, Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project, FreeBSD Tips and Tricks: Creating Snapshots With UFS, My Concern With Rust, or a Case for the BSD's, and more</itunes:subtitle>
  <itunes:duration>56:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A Journey Through 31 Years of Open Source Excellence, Proxmox vs FreeBSD: Which Virtualization Host Performs Better?, Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project, FreeBSD Tips and Tricks: Creating Snapshots With UFS, My Concern With Rust, or a Case for the BSD's, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Celebrating FreeBSD Day: A Journey Through 31 Years of Open Source Excellence (https://hamradio.my/2024/06/celebrating-freebsd-day-a-journey-through-31-years-of-open-source-excellence/)
Proxmox vs FreeBSD: Which Virtualization Host Performs Better? (https://it-notes.dragas.net/2024/06/10/proxmox-vs-freebsd-which-virtualization-host-performs-better/)
News Roundup
Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project (https://thenewstack.io/upstreaming-the-linux-vector-packet-processor-vpp-to-freebsd/)
FreeBSD Tips and Tricks: Creating Snapshots With UFS (https://it-notes.dragas.net/2024/06/04/freebsd-tips-and-tricks-creating-snapshots-with-ufs/)
My Concern With Rust, or a Case for the BSD's (https://superserverhero.com/reports/my-concern-with-rust)
Beastie Bits
Install FreeBSD 14.1 and KDE Plasma 6 in QEMU VM tutorial - June 2024 - 2da0c933 (https://www.youtube.com/watch?v=mmjYuDjWXto&amp;amp;t=1s)
Let's Try BSD, Part 1 of 7: Introduction (https://lowendbox.com/blog/lets-try-bsd-part-1-of-7-introduction-freebsd-openbsd-netbsd-dragonflybsd/)
OpenBSD, the computer appliance maker's secret weapon (https://hiandrewquinn.github.io/til-site/posts/openbsd-the-computer-appliance-maker-s-secret-weapon/)
FreeBSD Day: Interview with Deb Goodkin (https://youtu.be/xuYBsRAMvA8)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Johnny - Thanks (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/566/feedback/johnny%20-%20thanks.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, Celebrating, freebsd day, open source Excellence, proxmox, Virtualization, upstream, linux vector packet processor, tips and tricks, ufs, snapshots, rust, concern, case for the BSDs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A Journey Through 31 Years of Open Source Excellence, Proxmox vs FreeBSD: Which Virtualization Host Performs Better?, Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project, FreeBSD Tips and Tricks: Creating Snapshots With UFS, My Concern With Rust, or a Case for the BSD&#39;s, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://hamradio.my/2024/06/celebrating-freebsd-day-a-journey-through-31-years-of-open-source-excellence/" rel="nofollow">Celebrating FreeBSD Day: A Journey Through 31 Years of Open Source Excellence</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/06/10/proxmox-vs-freebsd-which-virtualization-host-performs-better/" rel="nofollow">Proxmox vs FreeBSD: Which Virtualization Host Performs Better?</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://thenewstack.io/upstreaming-the-linux-vector-packet-processor-vpp-to-freebsd/" rel="nofollow">Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/06/04/freebsd-tips-and-tricks-creating-snapshots-with-ufs/" rel="nofollow">FreeBSD Tips and Tricks: Creating Snapshots With UFS</a></p>

<hr>

<p><a href="https://superserverhero.com/reports/my-concern-with-rust" rel="nofollow">My Concern With Rust, or a Case for the BSD&#39;s</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.youtube.com/watch?v=mmjYuDjWXto&t=1s" rel="nofollow">Install FreeBSD 14.1 and KDE Plasma 6 in QEMU VM tutorial - June 2024 - 2da0c933</a></p></li>
<li><p><a href="https://lowendbox.com/blog/lets-try-bsd-part-1-of-7-introduction-freebsd-openbsd-netbsd-dragonflybsd/" rel="nofollow">Let&#39;s Try BSD, Part 1 of 7: Introduction</a></p></li>
<li><p><a href="https://hiandrewquinn.github.io/til-site/posts/openbsd-the-computer-appliance-maker-s-secret-weapon/" rel="nofollow">OpenBSD, the computer appliance maker&#39;s secret weapon</a></p></li>
<li><p><a href="https://youtu.be/xuYBsRAMvA8" rel="nofollow">FreeBSD Day: Interview with Deb Goodkin</a></p></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/566/feedback/johnny%20-%20thanks.md" rel="nofollow">Johnny - Thanks</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A Journey Through 31 Years of Open Source Excellence, Proxmox vs FreeBSD: Which Virtualization Host Performs Better?, Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project, FreeBSD Tips and Tricks: Creating Snapshots With UFS, My Concern With Rust, or a Case for the BSD&#39;s, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://hamradio.my/2024/06/celebrating-freebsd-day-a-journey-through-31-years-of-open-source-excellence/" rel="nofollow">Celebrating FreeBSD Day: A Journey Through 31 Years of Open Source Excellence</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/06/10/proxmox-vs-freebsd-which-virtualization-host-performs-better/" rel="nofollow">Proxmox vs FreeBSD: Which Virtualization Host Performs Better?</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://thenewstack.io/upstreaming-the-linux-vector-packet-processor-vpp-to-freebsd/" rel="nofollow">Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/06/04/freebsd-tips-and-tricks-creating-snapshots-with-ufs/" rel="nofollow">FreeBSD Tips and Tricks: Creating Snapshots With UFS</a></p>

<hr>

<p><a href="https://superserverhero.com/reports/my-concern-with-rust" rel="nofollow">My Concern With Rust, or a Case for the BSD&#39;s</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.youtube.com/watch?v=mmjYuDjWXto&t=1s" rel="nofollow">Install FreeBSD 14.1 and KDE Plasma 6 in QEMU VM tutorial - June 2024 - 2da0c933</a></p></li>
<li><p><a href="https://lowendbox.com/blog/lets-try-bsd-part-1-of-7-introduction-freebsd-openbsd-netbsd-dragonflybsd/" rel="nofollow">Let&#39;s Try BSD, Part 1 of 7: Introduction</a></p></li>
<li><p><a href="https://hiandrewquinn.github.io/til-site/posts/openbsd-the-computer-appliance-maker-s-secret-weapon/" rel="nofollow">OpenBSD, the computer appliance maker&#39;s secret weapon</a></p></li>
<li><p><a href="https://youtu.be/xuYBsRAMvA8" rel="nofollow">FreeBSD Day: Interview with Deb Goodkin</a></p></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/566/feedback/johnny%20-%20thanks.md" rel="nofollow">Johnny - Thanks</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>565: Secure by default</title>
  <link>https://www.bsdnow.tv/565</link>
  <guid isPermaLink="false">0e1b5cea-6e44-44e4-ac3a-f6f0fe49814c</guid>
  <pubDate>Thu, 27 Jun 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0e1b5cea-6e44-44e4-ac3a-f6f0fe49814c.mp3" length="74142504" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>NetBSD 10 on a Pinebook Pro, OpenBSD extreme privacy setup, Version 256 of systemd boasts '42% less Unix philosophy', Posix.1 2024 is out, Blocking Access From or to Specific Countries Using FreeBSD and Pf, and more.
Date: 2024.06.17</itunes:subtitle>
  <itunes:duration>51:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>NetBSD 10 on a Pinebook Pro, OpenBSD extreme privacy setup, Version 256 of systemd boasts '42% less Unix philosophy', Posix.1 2024 is out, Blocking Access From or to Specific Countries Using FreeBSD and Pf, and more.
Date: 2024.06.17
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
NetBSD 10 on a Pinebook Pro (https://www.idatum.net/netbsd-10-on-a-pinebook-pro-laptop.html)
OpenBSD extreme privacy setup (https://dataswamp.org/~solene/2024-06-08-openbsd-privacy-setup.html)
News Roundup
Version 256 of systemd boasts '42% less Unix philosophy' (https://www.theregister.com/2024/06/13/version_256_systemd/)
Posix.1 2024 is out (https://ieeexplore.ieee.org/document/10555529)
Blocking Access From or to Specific Countries Using FreeBSD and Pf (https://it-notes.dragas.net/2024/06/16/freebsd-blocking-country-access/)
Beastie Bits
BSD User Group Düsseldorf Juli 2024 (https://www.meetup.com/de-DE/bsd-user-group-dusseldorf-bsd-nrw/events/301557512/)
Another cool UNIX workstation, that was never released (https://www.reddit.com/r/unix/comments/1dd60re/another_cool_unix_workstation_that_was_never/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, pinebook pro, extreme privacy setup, penalize undesirable behavior, systemd, less Unix philosophy, posix, blocking access, pf</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>NetBSD 10 on a Pinebook Pro, OpenBSD extreme privacy setup, Version 256 of systemd boasts &#39;42% less Unix philosophy&#39;, Posix.1 2024 is out, Blocking Access From or to Specific Countries Using FreeBSD and Pf, and more.<br>
Date: 2024.06.17</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.idatum.net/netbsd-10-on-a-pinebook-pro-laptop.html" rel="nofollow">NetBSD 10 on a Pinebook Pro</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-06-08-openbsd-privacy-setup.html" rel="nofollow">OpenBSD extreme privacy setup</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.theregister.com/2024/06/13/version_256_systemd/" rel="nofollow">Version 256 of systemd boasts &#39;42% less Unix philosophy&#39;</a></p>

<hr>

<p><a href="https://ieeexplore.ieee.org/document/10555529" rel="nofollow">Posix.1 2024 is out</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/06/16/freebsd-blocking-country-access/" rel="nofollow">Blocking Access From or to Specific Countries Using FreeBSD and Pf</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.meetup.com/de-DE/bsd-user-group-dusseldorf-bsd-nrw/events/301557512/" rel="nofollow">BSD User Group Düsseldorf Juli 2024</a></li>
<li><a href="https://www.reddit.com/r/unix/comments/1dd60re/another_cool_unix_workstation_that_was_never/" rel="nofollow">Another cool UNIX workstation, that was never released</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>NetBSD 10 on a Pinebook Pro, OpenBSD extreme privacy setup, Version 256 of systemd boasts &#39;42% less Unix philosophy&#39;, Posix.1 2024 is out, Blocking Access From or to Specific Countries Using FreeBSD and Pf, and more.<br>
Date: 2024.06.17</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.idatum.net/netbsd-10-on-a-pinebook-pro-laptop.html" rel="nofollow">NetBSD 10 on a Pinebook Pro</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-06-08-openbsd-privacy-setup.html" rel="nofollow">OpenBSD extreme privacy setup</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.theregister.com/2024/06/13/version_256_systemd/" rel="nofollow">Version 256 of systemd boasts &#39;42% less Unix philosophy&#39;</a></p>

<hr>

<p><a href="https://ieeexplore.ieee.org/document/10555529" rel="nofollow">Posix.1 2024 is out</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/06/16/freebsd-blocking-country-access/" rel="nofollow">Blocking Access From or to Specific Countries Using FreeBSD and Pf</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.meetup.com/de-DE/bsd-user-group-dusseldorf-bsd-nrw/events/301557512/" rel="nofollow">BSD User Group Düsseldorf Juli 2024</a></li>
<li><a href="https://www.reddit.com/r/unix/comments/1dd60re/another_cool_unix_workstation_that_was_never/" rel="nofollow">Another cool UNIX workstation, that was never released</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>564: Computation Poems</title>
  <link>https://www.bsdnow.tv/564</link>
  <guid isPermaLink="false">75f62433-2e69-4de9-ad72-000a03d75e16</guid>
  <pubDate>Thu, 20 Jun 2024 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/75f62433-2e69-4de9-ad72-000a03d75e16.mp3" length="74329664" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Results from the 2024 FreeBSD Community Survey Report, What is Computer Science? ~1967, Computation Poems, Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf, observium-freebsd-install, FreeBSD Tips and Tricks: Native Read-Only Root File System, OpenSSH introduces options to penalize undesirable behavior, and more</itunes:subtitle>
  <itunes:duration>51:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Results from the 2024 FreeBSD Community Survey Report, What is Computer Science? ~1967, Computation Poems, Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf, observium-freebsd-install, FreeBSD Tips and Tricks: Native Read-Only Root File System, OpenSSH introduces options to penalize undesirable behavior, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Results from the 2024 FreeBSD Community Survey Report (https://freebsdfoundation.org/blog/results-from-the-2024-freebsd-community-survey-report/)
What is Computer Science? ~1967 (https://www.cs.cmu.edu/~choset/whatiscs.html)
News Roundup
Computation Poems (https://nickm.com/poems/)
Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf (https://forums.FreeBSD.org/threads/howto-set-up-and-configure-security-sshguard-pf.39196/)
observium-freebsd-install (https://github.com/pmhausen/observium-freebsd-install)
FreeBSD Tips and Tricks: Native Read-Only Root File System (https://it-notes.dragas.net/2024/05/31/freebsd-tips-and-tricks-native-ro-rootfs/)
OpenSSH introduces options to penalize undesirable behavior (http://undeadly.org/cgi?action=article;sid=20240607042157)
Beastie Bits
A Unix* Primer (https://archive.org/details/unixprimer0000lomu/mode/2up)
Running Xvnc through the INETD (https://bugs.dragonflybsd.org/issues/3300#change-14548)
ifconfig (https://man.ifconfig.se/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, result, survey, community, report, Computation, poem, sshguard-pf, observium, native read-only root filesystem, penalize, behavior, openssh</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Results from the 2024 FreeBSD Community Survey Report, What is Computer Science? ~1967, Computation Poems, Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf, observium-freebsd-install, FreeBSD Tips and Tricks: Native Read-Only Root File System, OpenSSH introduces options to penalize undesirable behavior, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/results-from-the-2024-freebsd-community-survey-report/" rel="nofollow">Results from the 2024 FreeBSD Community Survey Report</a></p>

<hr>

<p><a href="https://www.cs.cmu.edu/%7Echoset/whatiscs.html" rel="nofollow">What is Computer Science? ~1967</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://nickm.com/poems/" rel="nofollow">Computation Poems</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/howto-set-up-and-configure-security-sshguard-pf.39196/" rel="nofollow">Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf</a></p>

<hr>

<p><a href="https://github.com/pmhausen/observium-freebsd-install" rel="nofollow">observium-freebsd-install</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/05/31/freebsd-tips-and-tricks-native-ro-rootfs/" rel="nofollow">FreeBSD Tips and Tricks: Native Read-Only Root File System</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240607042157" rel="nofollow">OpenSSH introduces options to penalize undesirable behavior</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://archive.org/details/unixprimer0000lomu/mode/2up" rel="nofollow">A Unix* Primer</a></li>
<li><a href="https://bugs.dragonflybsd.org/issues/3300#change-14548" rel="nofollow">Running Xvnc through the INETD</a></li>
<li><a href="https://man.ifconfig.se/" rel="nofollow">ifconfig</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Results from the 2024 FreeBSD Community Survey Report, What is Computer Science? ~1967, Computation Poems, Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf, observium-freebsd-install, FreeBSD Tips and Tricks: Native Read-Only Root File System, OpenSSH introduces options to penalize undesirable behavior, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/results-from-the-2024-freebsd-community-survey-report/" rel="nofollow">Results from the 2024 FreeBSD Community Survey Report</a></p>

<hr>

<p><a href="https://www.cs.cmu.edu/%7Echoset/whatiscs.html" rel="nofollow">What is Computer Science? ~1967</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://nickm.com/poems/" rel="nofollow">Computation Poems</a></p>

<hr>

<p><a href="https://forums.FreeBSD.org/threads/howto-set-up-and-configure-security-sshguard-pf.39196/" rel="nofollow">Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf</a></p>

<hr>

<p><a href="https://github.com/pmhausen/observium-freebsd-install" rel="nofollow">observium-freebsd-install</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/05/31/freebsd-tips-and-tricks-native-ro-rootfs/" rel="nofollow">FreeBSD Tips and Tricks: Native Read-Only Root File System</a></p>

<hr>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240607042157" rel="nofollow">OpenSSH introduces options to penalize undesirable behavior</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://archive.org/details/unixprimer0000lomu/mode/2up" rel="nofollow">A Unix* Primer</a></li>
<li><a href="https://bugs.dragonflybsd.org/issues/3300#change-14548" rel="nofollow">Running Xvnc through the INETD</a></li>
<li><a href="https://man.ifconfig.se/" rel="nofollow">ifconfig</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>563: 14.1</title>
  <link>https://www.bsdnow.tv/563</link>
  <guid isPermaLink="false">6f802912-a29d-4285-ac35-22bd8efcebeb</guid>
  <pubDate>Thu, 13 Jun 2024 12:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6f802912-a29d-4285-ac35-22bd8efcebeb.mp3" length="47132160" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 14.1-RELEASE Announcement, Automatic dark mode with OpenBSD and dwm, dhcp6leased(8) imported to -current, DHCPv6-PD - First steps by florian@, Replacing my OPNsense gateway hardware by a Protectli appliance, How to alter file owernship and permissions with a feedback information, and more</itunes:subtitle>
  <itunes:duration>49:05</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 14.1-RELEASE Announcement, Automatic dark mode with OpenBSD and dwm, dhcp6leased(8) imported to -current, DHCPv6-PD - First steps by florian@, Replacing my OPNsense gateway hardware by a Protectli appliance, How to alter file owernship and permissions with a feedback information, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD 14.1-RELEASE Announcement (https://www.freebsd.org/releases/14.1R/announce/)
News Roundup
Automatic dark mode with OpenBSD and dwm (https://plexwave.org/blog/auto-dark-mode)
dhcp6leased(8) imported to -current (https://www.undeadly.org/cgi?action=article;sid=20240604085042&amp;amp;utm_source=bsdweekly)
DHCPv6-PD - First steps by florian@ (http://undeadly.org/cgi?action=article;sid=20240606180535)
Replacing my OPNsense gateway hardware by a Protectli appliance (https://www.ncartron.org/replacing-my-opnsense-gateway-hardware-by-a-protectli-appliance.html)
How to alter file owernship and permissions with a feedback information (https://sleeplessbeastie.eu/2024/04/18/how-to-alter-file-ownership-and-permissions-with-a-feedback-information/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Sad News (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/563/feedback/sad_news.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, 14.1, announcement, automatic, dark-mode, dwm, dhcp6leased, DHCPv6-PD, OPNsense, gateway, Protectli, feedback, chown, chmod</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 14.1-RELEASE Announcement, Automatic dark mode with OpenBSD and dwm, dhcp6leased(8) imported to -current, DHCPv6-PD - First steps by florian@, Replacing my OPNsense gateway hardware by a Protectli appliance, How to alter file owernship and permissions with a feedback information, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.freebsd.org/releases/14.1R/announce/" rel="nofollow">FreeBSD 14.1-RELEASE Announcement</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://plexwave.org/blog/auto-dark-mode" rel="nofollow">Automatic dark mode with OpenBSD and dwm</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20240604085042&utm_source=bsdweekly" rel="nofollow">dhcp6leased(8) imported to -current</a></p>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240606180535" rel="nofollow">DHCPv6-PD - First steps by florian@</a></p>

<hr>

<p><a href="https://www.ncartron.org/replacing-my-opnsense-gateway-hardware-by-a-protectli-appliance.html" rel="nofollow">Replacing my OPNsense gateway hardware by a Protectli appliance</a></p>

<hr>

<p><a href="https://sleeplessbeastie.eu/2024/04/18/how-to-alter-file-ownership-and-permissions-with-a-feedback-information/" rel="nofollow">How to alter file owernship and permissions with a feedback information</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/563/feedback/sad_news.md" rel="nofollow">Sad News</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 14.1-RELEASE Announcement, Automatic dark mode with OpenBSD and dwm, dhcp6leased(8) imported to -current, DHCPv6-PD - First steps by florian@, Replacing my OPNsense gateway hardware by a Protectli appliance, How to alter file owernship and permissions with a feedback information, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.freebsd.org/releases/14.1R/announce/" rel="nofollow">FreeBSD 14.1-RELEASE Announcement</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://plexwave.org/blog/auto-dark-mode" rel="nofollow">Automatic dark mode with OpenBSD and dwm</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20240604085042&utm_source=bsdweekly" rel="nofollow">dhcp6leased(8) imported to -current</a></p>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240606180535" rel="nofollow">DHCPv6-PD - First steps by florian@</a></p>

<hr>

<p><a href="https://www.ncartron.org/replacing-my-opnsense-gateway-hardware-by-a-protectli-appliance.html" rel="nofollow">Replacing my OPNsense gateway hardware by a Protectli appliance</a></p>

<hr>

<p><a href="https://sleeplessbeastie.eu/2024/04/18/how-to-alter-file-ownership-and-permissions-with-a-feedback-information/" rel="nofollow">How to alter file owernship and permissions with a feedback information</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/563/feedback/sad_news.md" rel="nofollow">Sad News</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>562: All by myself</title>
  <link>https://www.bsdnow.tv/562</link>
  <guid isPermaLink="false">fc1d93fb-8b7a-40cd-8141-6a2a676e6545</guid>
  <pubDate>Thu, 06 Jun 2024 00:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fc1d93fb-8b7a-40cd-8141-6a2a676e6545.mp3" length="70874112" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>My personal BSDCan Devsummit and Schedule, Syncthing, Paperless-ngx, neovim, Things we always remind ourselves while coding, and more.</itunes:subtitle>
  <itunes:duration>1:13:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>My personal BSDCan Devsummit and Schedule, Syncthing, Paperless-ngx, neovim, Things we always remind ourselves while coding, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Devsummit 2024 Schedule (https://freebsdfoundation.org/news-and-events/event-calendar/may-2024-freebsd-developer-summit/)
BSDCan 2024 Schedule (https://indico.bsdcan.org/event/1/timetable/?#20240531.detailed)
News Roundup
A list of things I was drawn deeper into, got excited about, and wanted to tell you more about.
Syncthing (https://syncthing.net)
Paperless-ngx (https://docs.paperless-ngx.com)
FreeBSD ports man page (https://man.freebsd.org/cgi/man.cgi?query=paperless&amp;amp;apropos=0&amp;amp;sektion=0&amp;amp;manpath=FreeBSD+14.0-RELEASE+and+Ports&amp;amp;arch=default&amp;amp;format=html)
Neovim (https://neovim.io)
List of popular plugins and themes (https://neovimcraft.com)
Neovim for Newbs (by the Typecraft guy) (https://www.youtube.com/playlist?list=PLsz00TDipIffreIaUNk64KxTIkQaGguqn)
Josean Martinez does a step by step tutorial (https://www.youtube.com/watch?v=6pAG3BHurdM&amp;amp;list=PLnu5gT9QrFg36OehOdECFvxFFeMHhb_07&amp;amp;index=11&amp;amp;pp=iAQB)
Blog post about the setup (https://www.josean.com/posts/how-to-setup-neovim-2024)
TJ DeVries (Neovim developer) reads the entire manual in 9:27:42 (https://www.youtube.com/watch?v=rT-fbLFOCy0)
Things we always remind ourselves while coding (https://changelog.com/posts/things-we-always-remind-ourselves-while-coding)
Beastie Bits
Me giving a ZFS intro talk, Sci-fi style (German) (https://media.ccc.de/v/fsck-2024-66-disk-space-the-final-frontier-)
Gulaschprogrammiernacht (GPN) 22 (some English talks, but most in German) (https://cfp.gulas.ch/gpn22/schedule/)
A RAM-disk based workflow (https://people.freebsd.org/~dch/posts/2014-09-05-a-ramdisk-based-workflow/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, bsdcan, devsummit, schedule, syncthing, paperless-ngx, neovim, coding, reminder</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>My personal BSDCan Devsummit and Schedule, Syncthing, Paperless-ngx, neovim, Things we always remind ourselves while coding, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<hr>

<p><a href="https://freebsdfoundation.org/news-and-events/event-calendar/may-2024-freebsd-developer-summit/" rel="nofollow">FreeBSD Devsummit 2024 Schedule</a></p>

<p><a href="https://indico.bsdcan.org/event/1/timetable/?#20240531.detailed" rel="nofollow">BSDCan 2024 Schedule</a></p>

<hr>

<h2>News Roundup</h2>

<p>A list of things I was drawn deeper into, got excited about, and wanted to tell you more about.</p>

<hr>

<p><a href="https://syncthing.net" rel="nofollow">Syncthing</a></p>

<hr>

<p><a href="https://docs.paperless-ngx.com" rel="nofollow">Paperless-ngx</a></p>

<ul>
<li><a href="https://man.freebsd.org/cgi/man.cgi?query=paperless&apropos=0&sektion=0&manpath=FreeBSD+14.0-RELEASE+and+Ports&arch=default&format=html" rel="nofollow">FreeBSD ports man page</a></li>
</ul>

<hr>

<p><a href="https://neovim.io" rel="nofollow">Neovim</a></p>

<ul>
<li><p><a href="https://neovimcraft.com" rel="nofollow">List of popular plugins and themes</a></p></li>
<li><p><a href="https://www.youtube.com/playlist?list=PLsz00TDipIffreIaUNk64KxTIkQaGguqn" rel="nofollow">Neovim for Newbs (by the Typecraft guy)</a></p></li>
<li><p><a href="https://www.youtube.com/watch?v=6pAG3BHurdM&list=PLnu5gT9QrFg36OehOdECFvxFFeMHhb_07&index=11&pp=iAQB" rel="nofollow">Josean Martinez does a step by step tutorial</a></p></li>
<li><p><a href="https://www.josean.com/posts/how-to-setup-neovim-2024" rel="nofollow">Blog post about the setup</a></p></li>
<li><p><a href="https://www.youtube.com/watch?v=rT-fbLFOCy0" rel="nofollow">TJ DeVries (Neovim developer) reads the entire manual in 9:27:42</a></p></li>
</ul>

<hr>

<p><a href="https://changelog.com/posts/things-we-always-remind-ourselves-while-coding" rel="nofollow">Things we always remind ourselves while coding</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://media.ccc.de/v/fsck-2024-66-disk-space-the-final-frontier-" rel="nofollow">Me giving a ZFS intro talk, Sci-fi style (German)</a></li>
<li><a href="https://cfp.gulas.ch/gpn22/schedule/" rel="nofollow">Gulaschprogrammiernacht (GPN) 22 (some English talks, but most in German)</a></li>
<li><a href="https://people.freebsd.org/%7Edch/posts/2014-09-05-a-ramdisk-based-workflow/" rel="nofollow">A RAM-disk based workflow</a></li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>My personal BSDCan Devsummit and Schedule, Syncthing, Paperless-ngx, neovim, Things we always remind ourselves while coding, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<hr>

<p><a href="https://freebsdfoundation.org/news-and-events/event-calendar/may-2024-freebsd-developer-summit/" rel="nofollow">FreeBSD Devsummit 2024 Schedule</a></p>

<p><a href="https://indico.bsdcan.org/event/1/timetable/?#20240531.detailed" rel="nofollow">BSDCan 2024 Schedule</a></p>

<hr>

<h2>News Roundup</h2>

<p>A list of things I was drawn deeper into, got excited about, and wanted to tell you more about.</p>

<hr>

<p><a href="https://syncthing.net" rel="nofollow">Syncthing</a></p>

<hr>

<p><a href="https://docs.paperless-ngx.com" rel="nofollow">Paperless-ngx</a></p>

<ul>
<li><a href="https://man.freebsd.org/cgi/man.cgi?query=paperless&apropos=0&sektion=0&manpath=FreeBSD+14.0-RELEASE+and+Ports&arch=default&format=html" rel="nofollow">FreeBSD ports man page</a></li>
</ul>

<hr>

<p><a href="https://neovim.io" rel="nofollow">Neovim</a></p>

<ul>
<li><p><a href="https://neovimcraft.com" rel="nofollow">List of popular plugins and themes</a></p></li>
<li><p><a href="https://www.youtube.com/playlist?list=PLsz00TDipIffreIaUNk64KxTIkQaGguqn" rel="nofollow">Neovim for Newbs (by the Typecraft guy)</a></p></li>
<li><p><a href="https://www.youtube.com/watch?v=6pAG3BHurdM&list=PLnu5gT9QrFg36OehOdECFvxFFeMHhb_07&index=11&pp=iAQB" rel="nofollow">Josean Martinez does a step by step tutorial</a></p></li>
<li><p><a href="https://www.josean.com/posts/how-to-setup-neovim-2024" rel="nofollow">Blog post about the setup</a></p></li>
<li><p><a href="https://www.youtube.com/watch?v=rT-fbLFOCy0" rel="nofollow">TJ DeVries (Neovim developer) reads the entire manual in 9:27:42</a></p></li>
</ul>

<hr>

<p><a href="https://changelog.com/posts/things-we-always-remind-ourselves-while-coding" rel="nofollow">Things we always remind ourselves while coding</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://media.ccc.de/v/fsck-2024-66-disk-space-the-final-frontier-" rel="nofollow">Me giving a ZFS intro talk, Sci-fi style (German)</a></li>
<li><a href="https://cfp.gulas.ch/gpn22/schedule/" rel="nofollow">Gulaschprogrammiernacht (GPN) 22 (some English talks, but most in German)</a></li>
<li><a href="https://people.freebsd.org/%7Edch/posts/2014-09-05-a-ramdisk-based-workflow/" rel="nofollow">A RAM-disk based workflow</a></li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>561: Kicked off ARPANET</title>
  <link>https://www.bsdnow.tv/561</link>
  <guid isPermaLink="false">499e2b62-bfa6-43ac-95b3-3b9962a113de</guid>
  <pubDate>Thu, 30 May 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/499e2b62-bfa6-43ac-95b3-3b9962a113de.mp3" length="59200128" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Why FreeBSD Continues to Innovate and Thrive, Why BSD, A BSD person tries Alpine Linux, This message does not exist, Demise of Nagle's algorithm, How Jerry Pournelle Got Kicked Off the ARPANET, and more</itunes:subtitle>
  <itunes:duration>1:01:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Why FreeBSD Continues to Innovate and Thrive, Why BSD, A BSD person tries Alpine Linux, This message does not exist, Demise of Nagle's algorithm, How Jerry Pournelle Got Kicked Off the ARPANET, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Why FreeBSD Continues to Innovate and Thrive (https://freebsdfoundation.org/blog/why-freebsd-continues-to-innovate-and-thrive/)
Why BSD (https://michal.sapka.me/bsd/why-bsd/)
News Roundup
A BSD person tries Alpine Linux (https://rubenerd.com/a-bsd-pserson-trying-alpine-linux/)
This message does not exist (https://www.kmjn.org/notes/message_existence.html)
Demise of Nagle's algorithm (RFC 896 - Congestion Control) predicted via sysctl (https://undeadly.org/cgi?action=article;sid=20240514075024)
How Jerry Pournelle Got Kicked Off the ARPANET (https://delong.typepad.com/sdj/2013/07/how-jerry-pournelle-got-kicked-off-the-arpanet.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, innovate, thrive, alpine, cpu, usage, exist, message, nagle, algorithm, jerry Pournelle, ARPANET</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Why FreeBSD Continues to Innovate and Thrive, Why BSD, A BSD person tries Alpine Linux, This message does not exist, Demise of Nagle&#39;s algorithm, How Jerry Pournelle Got Kicked Off the ARPANET, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/why-freebsd-continues-to-innovate-and-thrive/" rel="nofollow">Why FreeBSD Continues to Innovate and Thrive</a></p>

<hr>

<p><a href="https://michal.sapka.me/bsd/why-bsd/" rel="nofollow">Why BSD</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://rubenerd.com/a-bsd-pserson-trying-alpine-linux/" rel="nofollow">A BSD person tries Alpine Linux</a></p>

<hr>

<p><a href="https://www.kmjn.org/notes/message_existence.html" rel="nofollow">This message does not exist</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240514075024" rel="nofollow">Demise of Nagle&#39;s algorithm (RFC 896 - Congestion Control) predicted via sysctl</a></p>

<hr>

<p><a href="https://delong.typepad.com/sdj/2013/07/how-jerry-pournelle-got-kicked-off-the-arpanet.html" rel="nofollow">How Jerry Pournelle Got Kicked Off the ARPANET</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Why FreeBSD Continues to Innovate and Thrive, Why BSD, A BSD person tries Alpine Linux, This message does not exist, Demise of Nagle&#39;s algorithm, How Jerry Pournelle Got Kicked Off the ARPANET, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/why-freebsd-continues-to-innovate-and-thrive/" rel="nofollow">Why FreeBSD Continues to Innovate and Thrive</a></p>

<hr>

<p><a href="https://michal.sapka.me/bsd/why-bsd/" rel="nofollow">Why BSD</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://rubenerd.com/a-bsd-pserson-trying-alpine-linux/" rel="nofollow">A BSD person tries Alpine Linux</a></p>

<hr>

<p><a href="https://www.kmjn.org/notes/message_existence.html" rel="nofollow">This message does not exist</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240514075024" rel="nofollow">Demise of Nagle&#39;s algorithm (RFC 896 - Congestion Control) predicted via sysctl</a></p>

<hr>

<p><a href="https://delong.typepad.com/sdj/2013/07/how-jerry-pournelle-got-kicked-off-the-arpanet.html" rel="nofollow">How Jerry Pournelle Got Kicked Off the ARPANET</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>560: Why not BSD</title>
  <link>https://www.bsdnow.tv/560</link>
  <guid isPermaLink="false">9822ee64-8eaf-48cf-8603-d583f258fc4f</guid>
  <pubDate>Thu, 23 May 2024 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9822ee64-8eaf-48cf-8603-d583f258fc4f.mp3" length="59353728" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Status Report First Quarter 2024, Why not BSD, LibreSSL version 3.9.2 released, Running NetBSD on OmniOS using bhyve, X.Org on NetBSD, Unix version control lore: what, ident, How I search in 2024, sshd split into multiple binaries, and more</itunes:subtitle>
  <itunes:duration>1:01:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Status Report First Quarter 2024, Why not BSD, LibreSSL version 3.9.2 released, Running NetBSD on OmniOS using bhyve, X.Org on NetBSD, Unix version control lore: what, ident, How I search in 2024, sshd split into multiple binaries, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Status Report First Quarter 2024 (https://www.freebsd.org/status/report-2024-01-2024-03/)
Why not BSD (https://michal.sapka.me/bsd/why-not-bsd/) + Sequel next week
News Roundup
LibreSSL version 3.9.2 released (https://undeadly.org/cgi?action=article;sid=20240512115958)
Running NetBSD on OmniOS using bhyve (https://www.tumfatig.net/2024/running-netbsd-on-omnios-using-bhyve/)
X.Org on NetBSD - the state of things (https://blog.netbsd.org/tnf/entry/x_org_on_netbsd_the)
Unix version control lore: what, ident (https://dotat.at/@/2024-05-13-what-ident.html)
How I search in 2024 (https://vickiboykis.com/2024/04/25/how-i-search-in-2024/)
sshd(8) split into multiple binaries (https://undeadly.org/cgi?action=article;sid=20240517092416)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, status report, Q1 2024, libressl, omnios, bhyve, version control, lore, what, ident, search, searching, sshd, binaries,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Status Report First Quarter 2024, Why not BSD, LibreSSL version 3.9.2 released, Running NetBSD on OmniOS using bhyve, X.Org on NetBSD, Unix version control lore: what, ident, How I search in 2024, sshd split into multiple binaries, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.freebsd.org/status/report-2024-01-2024-03/" rel="nofollow">FreeBSD Status Report First Quarter 2024</a></p>

<hr>

<p><a href="https://michal.sapka.me/bsd/why-not-bsd/" rel="nofollow">Why not BSD</a> + Sequel next week</p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240512115958" rel="nofollow">LibreSSL version 3.9.2 released</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/running-netbsd-on-omnios-using-bhyve/" rel="nofollow">Running NetBSD on OmniOS using bhyve</a></p>

<hr>

<p><a href="https://blog.netbsd.org/tnf/entry/x_org_on_netbsd_the" rel="nofollow">X.Org on NetBSD - the state of things</a></p>

<hr>

<p><a href="https://dotat.at/@/2024-05-13-what-ident.html" rel="nofollow">Unix version control lore: what, ident</a></p>

<hr>

<p><a href="https://vickiboykis.com/2024/04/25/how-i-search-in-2024/" rel="nofollow">How I search in 2024</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240517092416" rel="nofollow">sshd(8) split into multiple binaries</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Status Report First Quarter 2024, Why not BSD, LibreSSL version 3.9.2 released, Running NetBSD on OmniOS using bhyve, X.Org on NetBSD, Unix version control lore: what, ident, How I search in 2024, sshd split into multiple binaries, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.freebsd.org/status/report-2024-01-2024-03/" rel="nofollow">FreeBSD Status Report First Quarter 2024</a></p>

<hr>

<p><a href="https://michal.sapka.me/bsd/why-not-bsd/" rel="nofollow">Why not BSD</a> + Sequel next week</p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240512115958" rel="nofollow">LibreSSL version 3.9.2 released</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/running-netbsd-on-omnios-using-bhyve/" rel="nofollow">Running NetBSD on OmniOS using bhyve</a></p>

<hr>

<p><a href="https://blog.netbsd.org/tnf/entry/x_org_on_netbsd_the" rel="nofollow">X.Org on NetBSD - the state of things</a></p>

<hr>

<p><a href="https://dotat.at/@/2024-05-13-what-ident.html" rel="nofollow">Unix version control lore: what, ident</a></p>

<hr>

<p><a href="https://vickiboykis.com/2024/04/25/how-i-search-in-2024/" rel="nofollow">How I search in 2024</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240517092416" rel="nofollow">sshd(8) split into multiple binaries</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>559: Rainy WiFi Days</title>
  <link>https://www.bsdnow.tv/559</link>
  <guid isPermaLink="false">9e7884ae-e36e-4f7f-8c73-96cd70d35b45</guid>
  <pubDate>Thu, 16 May 2024 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9e7884ae-e36e-4f7f-8c73-96cd70d35b45.mp3" length="54996864" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>An RNG that runs in your brain, Going Stateless, SmolBSD, The Wi-Fi only works when it's raining, Wayland, where are we in 2024?, Omnios pxe booting, OpenBSD scripts to convert wg-quick VPN files, and more</itunes:subtitle>
  <itunes:duration>57:17</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>An RNG that runs in your brain, Going Stateless, SmolBSD, The Wi-Fi only works when it's raining, Wayland, where are we in 2024?, Omnios pxe booting, OpenBSD scripts to convert wg-quick VPN files, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
An RNG that runs in your brain (https://www.hillelwayne.com/post/randomness/)
Going Stateless (https://dataswamp.org/~solene/2024-04-20-workstation-going-stateless.html)
News Roundup
SmolBSD (https://smolbsd.org)
The Wi-Fi only works when it's raining (https://predr.ag/blog/wifi-only-works-when-its-raining/)
Wayland, where are we in 2024? Any good for being the default? (https://www.dedoimedo.com/computers/wayland-2024.html)
Omnios pxe booting (https://neirac.srht.site/posts/ipxe_boot.html)
OpenBSD scripts to convert wg-quick VPN files (https://dataswamp.org/~solene/2024-04-27-openbsd-wg-quick-converter.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, RNG, brain, stateless, smolbsd, rain, wifi, wayland, omnios, pxe, booting, wg-quick, VPN, wireguard,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>An RNG that runs in your brain, Going Stateless, SmolBSD, The Wi-Fi only works when it&#39;s raining, Wayland, where are we in 2024?, Omnios pxe booting, OpenBSD scripts to convert wg-quick VPN files, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.hillelwayne.com/post/randomness/" rel="nofollow">An RNG that runs in your brain</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-04-20-workstation-going-stateless.html" rel="nofollow">Going Stateless</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://smolbsd.org" rel="nofollow">SmolBSD</a></p>

<hr>

<p><a href="https://predr.ag/blog/wifi-only-works-when-its-raining/" rel="nofollow">The Wi-Fi only works when it&#39;s raining</a></p>

<hr>

<p><a href="https://www.dedoimedo.com/computers/wayland-2024.html" rel="nofollow">Wayland, where are we in 2024? Any good for being the default?</a></p>

<hr>

<p><a href="https://neirac.srht.site/posts/ipxe_boot.html" rel="nofollow">Omnios pxe booting</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-04-27-openbsd-wg-quick-converter.html" rel="nofollow">OpenBSD scripts to convert wg-quick VPN files</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>An RNG that runs in your brain, Going Stateless, SmolBSD, The Wi-Fi only works when it&#39;s raining, Wayland, where are we in 2024?, Omnios pxe booting, OpenBSD scripts to convert wg-quick VPN files, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.hillelwayne.com/post/randomness/" rel="nofollow">An RNG that runs in your brain</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-04-20-workstation-going-stateless.html" rel="nofollow">Going Stateless</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://smolbsd.org" rel="nofollow">SmolBSD</a></p>

<hr>

<p><a href="https://predr.ag/blog/wifi-only-works-when-its-raining/" rel="nofollow">The Wi-Fi only works when it&#39;s raining</a></p>

<hr>

<p><a href="https://www.dedoimedo.com/computers/wayland-2024.html" rel="nofollow">Wayland, where are we in 2024? Any good for being the default?</a></p>

<hr>

<p><a href="https://neirac.srht.site/posts/ipxe_boot.html" rel="nofollow">Omnios pxe booting</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-04-27-openbsd-wg-quick-converter.html" rel="nofollow">OpenBSD scripts to convert wg-quick VPN files</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>558: Worlds of telnet</title>
  <link>https://www.bsdnow.tv/558</link>
  <guid isPermaLink="false">813adc0b-a4ca-4810-9cac-ef64a1dafccd</guid>
  <pubDate>Thu, 09 May 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/813adc0b-a4ca-4810-9cac-ef64a1dafccd.mp3" length="87563520" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>NetBSD 9.4, FreeBSD SSDF Attestation to Support Cybersecurity Compliance, The Lost Worlds of Telnet, alter file ownership and permissions with a feedback information, parallel raw IP input, OpenBSD routers on AliExpress mini PCs, FreeBSD for Devs.  Plus a special interview with the organizers of BSDCAN 2024.</itunes:subtitle>
  <itunes:duration>1:31:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>NetBSD 9.4, FreeBSD SSDF Attestation to Support Cybersecurity Compliance, The Lost Worlds of Telnet, alter file ownership and permissions with a feedback information, parallel raw IP input, OpenBSD routers on AliExpress mini PCs, FreeBSD for Devs.  Plus a special interview with the organizers of BSDCAN 2024.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
NetBSD 9.4 (https://www.netbsd.org/releases/formal-9/NetBSD-9.4.html)
FreeBSD Foundation Delivers V1 of FreeBSD SSDF Attestation to Support Cybersecurity Compliance (https://freebsdfoundation.org/blog/freebsd-foundation-delivers-v1-of-freebsd-ssdf-attestation-to-support-cybersecurity-compliance/)
News Roundup
The Lost Worlds of Telnet (https://thenewstack.io/the-lost-worlds-of-telnet/)
How to alter file ownership and permissions with a feedback information (https://sleeplessbeastie.eu/2024/04/18/how-to-alter-file-ownership-and-permissions-with-a-feedback-information/)
Coming soon to a -current system near you: parallel raw IP input (https://www.undeadly.org/cgi?action=article;sid=20240418050520)
OpenBSD routers on AliExpress mini PCs (https://www.srcbeat.com/2024/02/aliexpress-openbsd-router/)
FreeBSD for Devs (https://dev.to/scovl/freebsd-for-devs-3n0k)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Daniel - jail issue (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/556/feedback/Daniel%20-%20jail%20issue.md)
Rick - ZFS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/556/feedback/Rick%20-%20ZFS.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, netbsd 9.4, ssdf, Attestation, Cybersecurity compliance, telnet, file ownership, permissions, feedback information, parallel raw IP input, routers, AliExpress, mini PCs, developers, bsdcan</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>NetBSD 9.4, FreeBSD SSDF Attestation to Support Cybersecurity Compliance, The Lost Worlds of Telnet, alter file ownership and permissions with a feedback information, parallel raw IP input, OpenBSD routers on AliExpress mini PCs, FreeBSD for Devs.  Plus a special interview with the organizers of BSDCAN 2024.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.4.html" rel="nofollow">NetBSD 9.4</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/freebsd-foundation-delivers-v1-of-freebsd-ssdf-attestation-to-support-cybersecurity-compliance/" rel="nofollow">FreeBSD Foundation Delivers V1 of FreeBSD SSDF Attestation to Support Cybersecurity Compliance</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://thenewstack.io/the-lost-worlds-of-telnet/" rel="nofollow">The Lost Worlds of Telnet</a></p>

<hr>

<p><a href="https://sleeplessbeastie.eu/2024/04/18/how-to-alter-file-ownership-and-permissions-with-a-feedback-information/" rel="nofollow">How to alter file ownership and permissions with a feedback information</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20240418050520" rel="nofollow">Coming soon to a -current system near you: parallel raw IP input</a></p>

<hr>

<p><a href="https://www.srcbeat.com/2024/02/aliexpress-openbsd-router/" rel="nofollow">OpenBSD routers on AliExpress mini PCs</a></p>

<hr>

<p><a href="https://dev.to/scovl/freebsd-for-devs-3n0k" rel="nofollow">FreeBSD for Devs</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/556/feedback/Daniel%20-%20jail%20issue.md" rel="nofollow">Daniel - jail issue</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/556/feedback/Rick%20-%20ZFS.md" rel="nofollow">Rick - ZFS</a></p></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>NetBSD 9.4, FreeBSD SSDF Attestation to Support Cybersecurity Compliance, The Lost Worlds of Telnet, alter file ownership and permissions with a feedback information, parallel raw IP input, OpenBSD routers on AliExpress mini PCs, FreeBSD for Devs.  Plus a special interview with the organizers of BSDCAN 2024.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.4.html" rel="nofollow">NetBSD 9.4</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/freebsd-foundation-delivers-v1-of-freebsd-ssdf-attestation-to-support-cybersecurity-compliance/" rel="nofollow">FreeBSD Foundation Delivers V1 of FreeBSD SSDF Attestation to Support Cybersecurity Compliance</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://thenewstack.io/the-lost-worlds-of-telnet/" rel="nofollow">The Lost Worlds of Telnet</a></p>

<hr>

<p><a href="https://sleeplessbeastie.eu/2024/04/18/how-to-alter-file-ownership-and-permissions-with-a-feedback-information/" rel="nofollow">How to alter file ownership and permissions with a feedback information</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20240418050520" rel="nofollow">Coming soon to a -current system near you: parallel raw IP input</a></p>

<hr>

<p><a href="https://www.srcbeat.com/2024/02/aliexpress-openbsd-router/" rel="nofollow">OpenBSD routers on AliExpress mini PCs</a></p>

<hr>

<p><a href="https://dev.to/scovl/freebsd-for-devs-3n0k" rel="nofollow">FreeBSD for Devs</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/556/feedback/Daniel%20-%20jail%20issue.md" rel="nofollow">Daniel - jail issue</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/556/feedback/Rick%20-%20ZFS.md" rel="nofollow">Rick - ZFS</a></p></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>557: 17h per frame</title>
  <link>https://www.bsdnow.tv/557</link>
  <guid isPermaLink="false">e7b7b0ae-86ba-4f1e-849b-e46741b63ebd</guid>
  <pubDate>Thu, 02 May 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e7b7b0ae-86ba-4f1e-849b-e46741b63ebd.mp3" length="44994816" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Open Source Software: The $9 Trillion Resource Companies Take for Granted, Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp; review, OpenSMTPD 7.5.0p0 Released, OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations, Book 8088, Custom Prometheus dashboards using Console templates, FreeBSD Foundation March 2024 Partnerships Update, Ray tracing made possible on 42-year-old ZX Spectrum: 'reasonably fast, if you consider 17 hours per frame to be reasonably fast', and more</itunes:subtitle>
  <itunes:duration>46:52</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Open Source Software: The $9 Trillion Resource Companies Take for Granted, Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp;amp; review, OpenSMTPD 7.5.0p0 Released, OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations, Book 8088, Custom Prometheus dashboards using Console templates, FreeBSD Foundation March 2024 Partnerships Update, Ray tracing made possible on 42-year-old ZX Spectrum: 'reasonably fast, if you consider 17 hours per frame to be reasonably fast', and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Open Source Software: The $9 Trillion Resource Companies Take for Granted (https://hbswk.hbs.edu/item/open-source-software-the-nine-trillion-resource-companies-take-for-granted)
Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp;amp; review (https://www.autodidacts.io/pinebook-pro-linux-bsd-laptop-review-tutorial/)
News Roundup
OpenSMTPD 7.5.0p0 Released (https://undeadly.org/cgi?action=article;sid=20240410185045)
OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations (https://www.theregister.com/2024/04/12/openbsd_75_disk_encryption/)
Book 8088 (https://liliputing.com/version-2-0-of-the-book-8088-retro-mini-laptop-adds-vga-graphics-card-and-serial-ports/)
Custom Prometheus dashboards using Console templates (https://tumfatig.net/2024/custom-prometheus-dashboards-using-console-templates/)
FreeBSD Foundation March 2024 Partnerships Update (https://freebsdfoundation.org/blog/march-2024-partnerships-update/)
Ray tracing made possible on 42-year-old ZX Spectrum: 'reasonably fast, if you consider 17 hours per frame to be reasonably fast' (https://www.pcgamer.com/ray-tracing-made-possible-on-42-year-old-zx-spectrum-reasonably-fast-if-you-consider-17-hours-per-frame-to-be-reasonably-fast/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, trillion dollar, resource, tinkering, manjaro, pinebook pro, OpenSMTPD, lock down, disk encryption, syscall limitation, book 8088, prometheus, console, partnerships, ray tracing, zx spectrum</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Open Source Software: The $9 Trillion Resource Companies Take for Granted, Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp; review, OpenSMTPD 7.5.0p0 Released, OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations, Book 8088, Custom Prometheus dashboards using Console templates, FreeBSD Foundation March 2024 Partnerships Update, Ray tracing made possible on 42-year-old ZX Spectrum: &#39;reasonably fast, if you consider 17 hours per frame to be reasonably fast&#39;, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://hbswk.hbs.edu/item/open-source-software-the-nine-trillion-resource-companies-take-for-granted" rel="nofollow">Open Source Software: The $9 Trillion Resource Companies Take for Granted</a></p>

<hr>

<p><a href="https://www.autodidacts.io/pinebook-pro-linux-bsd-laptop-review-tutorial/" rel="nofollow">Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp; review</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240410185045" rel="nofollow">OpenSMTPD 7.5.0p0 Released</a></p>

<hr>

<p><a href="https://www.theregister.com/2024/04/12/openbsd_75_disk_encryption/" rel="nofollow">OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations</a></p>

<hr>

<p><a href="https://liliputing.com/version-2-0-of-the-book-8088-retro-mini-laptop-adds-vga-graphics-card-and-serial-ports/" rel="nofollow">Book 8088</a></p>

<hr>

<p><a href="https://tumfatig.net/2024/custom-prometheus-dashboards-using-console-templates/" rel="nofollow">Custom Prometheus dashboards using Console templates</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/march-2024-partnerships-update/" rel="nofollow">FreeBSD Foundation March 2024 Partnerships Update</a></p>

<hr>

<p><a href="https://www.pcgamer.com/ray-tracing-made-possible-on-42-year-old-zx-spectrum-reasonably-fast-if-you-consider-17-hours-per-frame-to-be-reasonably-fast/" rel="nofollow">Ray tracing made possible on 42-year-old ZX Spectrum: &#39;reasonably fast, if you consider 17 hours per frame to be reasonably fast&#39;</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Open Source Software: The $9 Trillion Resource Companies Take for Granted, Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp; review, OpenSMTPD 7.5.0p0 Released, OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations, Book 8088, Custom Prometheus dashboards using Console templates, FreeBSD Foundation March 2024 Partnerships Update, Ray tracing made possible on 42-year-old ZX Spectrum: &#39;reasonably fast, if you consider 17 hours per frame to be reasonably fast&#39;, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://hbswk.hbs.edu/item/open-source-software-the-nine-trillion-resource-companies-take-for-granted" rel="nofollow">Open Source Software: The $9 Trillion Resource Companies Take for Granted</a></p>

<hr>

<p><a href="https://www.autodidacts.io/pinebook-pro-linux-bsd-laptop-review-tutorial/" rel="nofollow">Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp; review</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240410185045" rel="nofollow">OpenSMTPD 7.5.0p0 Released</a></p>

<hr>

<p><a href="https://www.theregister.com/2024/04/12/openbsd_75_disk_encryption/" rel="nofollow">OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations</a></p>

<hr>

<p><a href="https://liliputing.com/version-2-0-of-the-book-8088-retro-mini-laptop-adds-vga-graphics-card-and-serial-ports/" rel="nofollow">Book 8088</a></p>

<hr>

<p><a href="https://tumfatig.net/2024/custom-prometheus-dashboards-using-console-templates/" rel="nofollow">Custom Prometheus dashboards using Console templates</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/march-2024-partnerships-update/" rel="nofollow">FreeBSD Foundation March 2024 Partnerships Update</a></p>

<hr>

<p><a href="https://www.pcgamer.com/ray-tracing-made-possible-on-42-year-old-zx-spectrum-reasonably-fast-if-you-consider-17-hours-per-frame-to-be-reasonably-fast/" rel="nofollow">Ray tracing made possible on 42-year-old ZX Spectrum: &#39;reasonably fast, if you consider 17 hours per frame to be reasonably fast&#39;</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>556: Cozy OpenBSD</title>
  <link>https://www.bsdnow.tv/556</link>
  <guid isPermaLink="false">92703554-9e85-425e-ac8a-a5d5aa0cc9c4</guid>
  <pubDate>Thu, 25 Apr 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/92703554-9e85-425e-ac8a-a5d5aa0cc9c4.mp3" length="51666816" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD is a Cozy Operating System, Lichee Console 4A - RISC-V mini laptop, Lessons learned with XZ vulnerability, Techies vs spies: the xz backdoor debate, Not Not Porting 9front to Power64, One less Un\*xy option for 32-bit PowerPC, and more</itunes:subtitle>
  <itunes:duration>53:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD is a Cozy Operating System, Lichee Console 4A - RISC-V mini laptop, Lessons learned with XZ vulnerability, Techies vs spies: the xz backdoor debate, Not Not Porting 9front to Power64, One less Un*xy option for 32-bit PowerPC, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenBSD is a Cozy Operating System (https://btxx.org/posts/OpenBSD_is_a_Cozy_Operating_System/)
Lichee Console 4A - RISC-V mini laptop (https://3.14.by/en/read/RISC-V-Sipeed-Lichee-Console-4A-Alibaba-T-Head-TH1520-review)
News Roundup
Lessons learned with XZ vulnerability (https://dataswamp.org/~solene/2024-03-30-lessons-learned-xz-vuln.html)
Techies vs spies: the xz backdoor debate (https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor)
Not Not Porting 9front to Power64 (https://posixcafe.org/blogs/2024/04/03/0/)
One less Un*xy option for 32-bit PowerPC (http://tenfourfox.blogspot.com/2024/02/one-less-unxy-option-for-32-bit-powerpc.html)
Beastie Bits
20 years since... (https://undeadly.org/cgi?action=article;sid=20240409044953)
Jails PDFs (https://cdn.gyptazy.ch/files/docs/freebsd/jails/)
NixOS BSD (https://github.com/nixos-bsd/nixbsd)
rigg - run indie games on OpenBSD (https://www.reddit.com/r/openbsd_gaming/comments/1bb9wle/rigg_10_released_a_new_way_to_run_indie_games_on/)
pkgsrc 2024Q1 (https://mail-index.netbsd.org/netbsd-announce/2024/04/04/msg000370.html)
PackMule (https://badland.io/packmule.md)
AcephalOS - A new FreeBSD image build tool (https://codeberg.org/San_Bernadino_Operation/AcephalOS_image_build_system)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, risc-v mini, xz vulnerability, techies, spies, backdoor, debate, 9front, power64, porting, 32-bit, powerpc</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD is a Cozy Operating System, Lichee Console 4A - RISC-V mini laptop, Lessons learned with XZ vulnerability, Techies vs spies: the xz backdoor debate, Not Not Porting 9front to Power64, One less Un*xy option for 32-bit PowerPC, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://btxx.org/posts/OpenBSD_is_a_Cozy_Operating_System/" rel="nofollow">OpenBSD is a Cozy Operating System</a></p>

<hr>

<p><a href="https://3.14.by/en/read/RISC-V-Sipeed-Lichee-Console-4A-Alibaba-T-Head-TH1520-review" rel="nofollow">Lichee Console 4A - RISC-V mini laptop</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dataswamp.org/%7Esolene/2024-03-30-lessons-learned-xz-vuln.html" rel="nofollow">Lessons learned with XZ vulnerability</a></p>

<hr>

<p><a href="https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor" rel="nofollow">Techies vs spies: the xz backdoor debate</a></p>

<hr>

<p><a href="https://posixcafe.org/blogs/2024/04/03/0/" rel="nofollow">Not Not Porting 9front to Power64</a></p>

<hr>

<p><a href="http://tenfourfox.blogspot.com/2024/02/one-less-unxy-option-for-32-bit-powerpc.html" rel="nofollow">One less Un*xy option for 32-bit PowerPC</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20240409044953" rel="nofollow">20 years since...</a></li>
<li><a href="https://cdn.gyptazy.ch/files/docs/freebsd/jails/" rel="nofollow">Jails PDFs</a></li>
<li><a href="https://github.com/nixos-bsd/nixbsd" rel="nofollow">NixOS BSD</a></li>
<li><a href="https://www.reddit.com/r/openbsd_gaming/comments/1bb9wle/rigg_10_released_a_new_way_to_run_indie_games_on/" rel="nofollow">rigg - run indie games on OpenBSD</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-announce/2024/04/04/msg000370.html" rel="nofollow">pkgsrc 2024Q1</a></li>
<li><a href="https://badland.io/packmule.md" rel="nofollow">PackMule</a></li>
<li><a href="https://codeberg.org/San_Bernadino_Operation/AcephalOS_image_build_system" rel="nofollow">AcephalOS - A new FreeBSD image build tool</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD is a Cozy Operating System, Lichee Console 4A - RISC-V mini laptop, Lessons learned with XZ vulnerability, Techies vs spies: the xz backdoor debate, Not Not Porting 9front to Power64, One less Un*xy option for 32-bit PowerPC, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://btxx.org/posts/OpenBSD_is_a_Cozy_Operating_System/" rel="nofollow">OpenBSD is a Cozy Operating System</a></p>

<hr>

<p><a href="https://3.14.by/en/read/RISC-V-Sipeed-Lichee-Console-4A-Alibaba-T-Head-TH1520-review" rel="nofollow">Lichee Console 4A - RISC-V mini laptop</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dataswamp.org/%7Esolene/2024-03-30-lessons-learned-xz-vuln.html" rel="nofollow">Lessons learned with XZ vulnerability</a></p>

<hr>

<p><a href="https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor" rel="nofollow">Techies vs spies: the xz backdoor debate</a></p>

<hr>

<p><a href="https://posixcafe.org/blogs/2024/04/03/0/" rel="nofollow">Not Not Porting 9front to Power64</a></p>

<hr>

<p><a href="http://tenfourfox.blogspot.com/2024/02/one-less-unxy-option-for-32-bit-powerpc.html" rel="nofollow">One less Un*xy option for 32-bit PowerPC</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20240409044953" rel="nofollow">20 years since...</a></li>
<li><a href="https://cdn.gyptazy.ch/files/docs/freebsd/jails/" rel="nofollow">Jails PDFs</a></li>
<li><a href="https://github.com/nixos-bsd/nixbsd" rel="nofollow">NixOS BSD</a></li>
<li><a href="https://www.reddit.com/r/openbsd_gaming/comments/1bb9wle/rigg_10_released_a_new_way_to_run_indie_games_on/" rel="nofollow">rigg - run indie games on OpenBSD</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-announce/2024/04/04/msg000370.html" rel="nofollow">pkgsrc 2024Q1</a></li>
<li><a href="https://badland.io/packmule.md" rel="nofollow">PackMule</a></li>
<li><a href="https://codeberg.org/San_Bernadino_Operation/AcephalOS_image_build_system" rel="nofollow">AcephalOS - A new FreeBSD image build tool</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>555: Poudriereing Apple Silicon</title>
  <link>https://www.bsdnow.tv/555</link>
  <guid isPermaLink="false">629f2e08-41a4-4551-b8e4-446706cd16a6</guid>
  <pubDate>Thu, 18 Apr 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/629f2e08-41a4-4551-b8e4-446706cd16a6.mp3" length="55516800" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Kubernetes and back - Why I don't run distributed systems, NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts, Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud, Poudriere on Apple Silicon, One less Un\*xy option for 32-bit PowerPC, and more</itunes:subtitle>
  <itunes:duration>57:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Kubernetes and back - Why I don't run distributed systems, NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts, Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud, Poudriere on Apple Silicon, One less Un*xy option for 32-bit PowerPC, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Kubernetes and back - Why I don't run distributed systems (https://www.davd.io/posts/2024-03-20-kubernetes-and-back-why-i-dont-run-distributed-systems/)
NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts (https://freebsdfoundation.org/blog/netapps-strategic-contributions-to-freebsd-a-deep-dive-into-upstreaming-efforts/)
News Roundup
Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud (https://it-notes.dragas.net/2024/03/21/make-your-own-email-server-freebsd-adding-nextcloud-part2/)
Poudriere on Apple Silicon (https://oliver-epper.de/posts/poudriere-on-m1-mac/)
One less Un*xy option for 32-bit PowerPC (http://tenfourfox.blogspot.com/2024/02/one-less-unxy-option-for-32-bit-powerpc.html)
Beastie Bits
Powering up the future: the new FreeBSD cluster in Chicago (https://freebsdfoundation.org/blog/powering-up-the-future-the-new-freebsd-cluster-in-chicago/)
Dragonflybsd 6.5 Snapshot Release on Acer Nitro AN515-51/58-XXX Series Laptops (https://github.com/catfacedck/Dragonflybsd-Acer-Nitro-Laptops-AN515-5158-XXX)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, kubernetes, distributed systems, netapp, strategic contribution, upstreaming, efforts, email server, webmail, nextcloud, Poudriere, apple silicon, powerpc, 32-bit</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Kubernetes and back - Why I don&#39;t run distributed systems, NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts, Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud, Poudriere on Apple Silicon, One less Un*xy option for 32-bit PowerPC, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.davd.io/posts/2024-03-20-kubernetes-and-back-why-i-dont-run-distributed-systems/" rel="nofollow">Kubernetes and back - Why I don&#39;t run distributed systems</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/netapps-strategic-contributions-to-freebsd-a-deep-dive-into-upstreaming-efforts/" rel="nofollow">NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://it-notes.dragas.net/2024/03/21/make-your-own-email-server-freebsd-adding-nextcloud-part2/" rel="nofollow">Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud</a></p>

<hr>

<p><a href="https://oliver-epper.de/posts/poudriere-on-m1-mac/" rel="nofollow">Poudriere on Apple Silicon</a></p>

<hr>

<p><a href="http://tenfourfox.blogspot.com/2024/02/one-less-unxy-option-for-32-bit-powerpc.html" rel="nofollow">One less Un*xy option for 32-bit PowerPC</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://freebsdfoundation.org/blog/powering-up-the-future-the-new-freebsd-cluster-in-chicago/" rel="nofollow">Powering up the future: the new FreeBSD cluster in Chicago</a></li>
<li><a href="https://github.com/catfacedck/Dragonflybsd-Acer-Nitro-Laptops-AN515-5158-XXX" rel="nofollow">Dragonflybsd 6.5 Snapshot Release on Acer Nitro AN515-51/58-XXX Series Laptops</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Kubernetes and back - Why I don&#39;t run distributed systems, NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts, Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud, Poudriere on Apple Silicon, One less Un*xy option for 32-bit PowerPC, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.davd.io/posts/2024-03-20-kubernetes-and-back-why-i-dont-run-distributed-systems/" rel="nofollow">Kubernetes and back - Why I don&#39;t run distributed systems</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/netapps-strategic-contributions-to-freebsd-a-deep-dive-into-upstreaming-efforts/" rel="nofollow">NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://it-notes.dragas.net/2024/03/21/make-your-own-email-server-freebsd-adding-nextcloud-part2/" rel="nofollow">Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud</a></p>

<hr>

<p><a href="https://oliver-epper.de/posts/poudriere-on-m1-mac/" rel="nofollow">Poudriere on Apple Silicon</a></p>

<hr>

<p><a href="http://tenfourfox.blogspot.com/2024/02/one-less-unxy-option-for-32-bit-powerpc.html" rel="nofollow">One less Un*xy option for 32-bit PowerPC</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://freebsdfoundation.org/blog/powering-up-the-future-the-new-freebsd-cluster-in-chicago/" rel="nofollow">Powering up the future: the new FreeBSD cluster in Chicago</a></li>
<li><a href="https://github.com/catfacedck/Dragonflybsd-Acer-Nitro-Laptops-AN515-5158-XXX" rel="nofollow">Dragonflybsd 6.5 Snapshot Release on Acer Nitro AN515-51/58-XXX Series Laptops</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>554: NetBSD Double Digit</title>
  <link>https://www.bsdnow.tv/554</link>
  <guid isPermaLink="false">8c49ca38-53e5-49cb-93f4-dcf4eae69f08</guid>
  <pubDate>Thu, 11 Apr 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8c49ca38-53e5-49cb-93f4-dcf4eae69f08.mp3" length="60370176" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The XZ Backdoor, NetBSD 10.0, iX announces that they will put out a release of TrueNAS 13.3, State of the Terminal, LibreSSL 3.8.4 and 3.9.1 released and more</itunes:subtitle>
  <itunes:duration>1:02:53</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The XZ Backdoor, NetBSD 10.0, iX announces that they will put out a release of TrueNAS 13.3, State of the Terminal, LibreSSL 3.8.4 and 3.9.1 released and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
People have no doubt heard of this by now, but are not aware of the BSD side of
things since its mostly been Linux getting all the news. It'd be nice if we
could give a summary of the issue and then address how it does/doesn't affect
the BSDs.
The XZ Backdoor
 (https://boehs.org/node/everything-i-know-about-the-xz-backdoor)
NetBSD's statement (https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz)
FreeBSD's statement (https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html)
OpenBSD?
NetBSD 10.0 (https://netbsd.org/releases/formal-10/NetBSD-10.0.html)
News Roundup
iX announces that they will put out a release of TrueNAS 13.3 (https://www.truenas.com/blog/truenas-core-13-3-plans/)
A community fork has been announced (https://www.zvault.io)
State of the Terminal (https://gpanders.com/blog/state-of-the-terminal/)
LibreSSL 3.8.4 and 3.9.1 released (https://undeadly.org/cgi?action=article;sid=20240328181819)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Derek via feedback has asked for some discussion around this NetBSD security advisory (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/554/feedback/Derek%20-%20NetBSD%20Security%20Advisory.md)
-- Advisory Link (https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-001.txt.asc)
Ben - Nextcloud Installation (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/554/feedback/Ben%20-%20nexcloud%20installation.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, 10.0, xz, backdoor, ix systems, truenas 13.3, terminal, state, partnership update, libressl</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The XZ Backdoor, NetBSD 10.0, iX announces that they will put out a release of TrueNAS 13.3, State of the Terminal, LibreSSL 3.8.4 and 3.9.1 released and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p>People have no doubt heard of this by now, but are not aware of the BSD side of<br>
things since its mostly been Linux getting all the news. It&#39;d be nice if we<br>
could give a summary of the issue and then address how it does/doesn&#39;t affect<br>
the BSDs.<br>
<a href="https://boehs.org/node/everything-i-know-about-the-xz-backdoor" rel="nofollow">The XZ Backdoor<br>
</a></p>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz" rel="nofollow">NetBSD&#39;s statement</a></li>
<li><a href="https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html" rel="nofollow">FreeBSD&#39;s statement</a></li>
<li>OpenBSD?</li>
</ul>

<hr>

<p><a href="https://netbsd.org/releases/formal-10/NetBSD-10.0.html" rel="nofollow">NetBSD 10.0</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.truenas.com/blog/truenas-core-13-3-plans/" rel="nofollow">iX announces that they will put out a release of TrueNAS 13.3</a></p>

<ul>
<li><a href="https://www.zvault.io" rel="nofollow">A community fork has been announced</a></li>
</ul>

<hr>

<p><a href="https://gpanders.com/blog/state-of-the-terminal/" rel="nofollow">State of the Terminal</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240328181819" rel="nofollow">LibreSSL 3.8.4 and 3.9.1 released</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/554/feedback/Derek%20-%20NetBSD%20Security%20Advisory.md" rel="nofollow">Derek via feedback has asked for some discussion around this NetBSD security advisory</a><br>
-- <a href="https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-001.txt.asc" rel="nofollow">Advisory Link</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/554/feedback/Ben%20-%20nexcloud%20installation.md" rel="nofollow">Ben - Nextcloud Installation</a></p></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The XZ Backdoor, NetBSD 10.0, iX announces that they will put out a release of TrueNAS 13.3, State of the Terminal, LibreSSL 3.8.4 and 3.9.1 released and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p>People have no doubt heard of this by now, but are not aware of the BSD side of<br>
things since its mostly been Linux getting all the news. It&#39;d be nice if we<br>
could give a summary of the issue and then address how it does/doesn&#39;t affect<br>
the BSDs.<br>
<a href="https://boehs.org/node/everything-i-know-about-the-xz-backdoor" rel="nofollow">The XZ Backdoor<br>
</a></p>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz" rel="nofollow">NetBSD&#39;s statement</a></li>
<li><a href="https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html" rel="nofollow">FreeBSD&#39;s statement</a></li>
<li>OpenBSD?</li>
</ul>

<hr>

<p><a href="https://netbsd.org/releases/formal-10/NetBSD-10.0.html" rel="nofollow">NetBSD 10.0</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.truenas.com/blog/truenas-core-13-3-plans/" rel="nofollow">iX announces that they will put out a release of TrueNAS 13.3</a></p>

<ul>
<li><a href="https://www.zvault.io" rel="nofollow">A community fork has been announced</a></li>
</ul>

<hr>

<p><a href="https://gpanders.com/blog/state-of-the-terminal/" rel="nofollow">State of the Terminal</a></p>

<hr>

<p><a href="https://undeadly.org/cgi?action=article;sid=20240328181819" rel="nofollow">LibreSSL 3.8.4 and 3.9.1 released</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/554/feedback/Derek%20-%20NetBSD%20Security%20Advisory.md" rel="nofollow">Derek via feedback has asked for some discussion around this NetBSD security advisory</a><br>
-- <a href="https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-001.txt.asc" rel="nofollow">Advisory Link</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/554/feedback/Ben%20-%20nexcloud%20installation.md" rel="nofollow">Ben - Nextcloud Installation</a></p></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>553: Terminal Latency</title>
  <link>https://www.bsdnow.tv/553</link>
  <guid isPermaLink="false">fb2a50e1-0c95-4f05-844b-9c69c5aa90bf</guid>
  <pubDate>Thu, 04 Apr 2024 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fb2a50e1-0c95-4f05-844b-9c69c5aa90bf.mp3" length="51366912" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Using Git offline, Make your own E-mail server, quiz: a tool for
rapid OpenZFS development, Configuring openzfs for nvme databases, Mirroring
OmniOS: The Complete Guide part 1, Installing OpenBSD 7.4 on a VisionFive 2 rev</itunes:subtitle>
  <itunes:duration>53:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Using Git offline, Make your own E-mail server, quiz: a tool for rapid OpenZFS development, Configuring openzfs for nvme databases, Mirroring OmniOS: The Complete Guide part 1, Installing OpenBSD 7.4 on a VisionFive 2 rev, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Using Git offline (https://www.gibbard.me/using_git_offline/)
Make your own E-Mail server - FreeBSD, OpenSMTPD, Rspamd and Dovecot included - Part 1 (https://it-notes.dragas.net/2024/03/08/make-your-own-email-server-freebsd-opensmptd-rspamd-dovecot-part1/)
News Roundup
quiz: a tool for rapid OpenZFS development (https://despairlabs.com/blog/posts/2024-03-04-quiz-rapid-openzfs-development/)
Configuring openzfs for nvme databases (https://github.com/letsencrypt/openzfs-nvme-databases)
Mirroring OmniOS: The Complete Guide; Part One (https://antranigv.am/posts/2024/02/omnios-mirror-one/)
Installing OpenBSD 7.4 on a VisionFive 2 rev 1.2a (https://quozul.dev/riscv/2023/12/22/installing-openbsd-on-visionfive-2.html)
Terminal Latency (https://beuke.org/terminal-latency/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, git, offline, email, server, quiz, openzfs development, nvme databases, omnios mirroring, VisionFive, terminal, latency</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Using Git offline, Make your own E-mail server, quiz: a tool for rapid OpenZFS development, Configuring openzfs for nvme databases, Mirroring OmniOS: The Complete Guide part 1, Installing OpenBSD 7.4 on a VisionFive 2 rev, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.gibbard.me/using_git_offline/" rel="nofollow">Using Git offline</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/03/08/make-your-own-email-server-freebsd-opensmptd-rspamd-dovecot-part1/" rel="nofollow">Make your own E-Mail server - FreeBSD, OpenSMTPD, Rspamd and Dovecot included - Part 1</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://despairlabs.com/blog/posts/2024-03-04-quiz-rapid-openzfs-development/" rel="nofollow">quiz: a tool for rapid OpenZFS development</a></p>

<hr>

<p><a href="https://github.com/letsencrypt/openzfs-nvme-databases" rel="nofollow">Configuring openzfs for nvme databases</a></p>

<hr>

<p><a href="https://antranigv.am/posts/2024/02/omnios-mirror-one/" rel="nofollow">Mirroring OmniOS: The Complete Guide; Part One</a></p>

<hr>

<p><a href="https://quozul.dev/riscv/2023/12/22/installing-openbsd-on-visionfive-2.html" rel="nofollow">Installing OpenBSD 7.4 on a VisionFive 2 rev 1.2a</a></p>

<hr>

<p><a href="https://beuke.org/terminal-latency/" rel="nofollow">Terminal Latency</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Using Git offline, Make your own E-mail server, quiz: a tool for rapid OpenZFS development, Configuring openzfs for nvme databases, Mirroring OmniOS: The Complete Guide part 1, Installing OpenBSD 7.4 on a VisionFive 2 rev, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.gibbard.me/using_git_offline/" rel="nofollow">Using Git offline</a></p>

<hr>

<p><a href="https://it-notes.dragas.net/2024/03/08/make-your-own-email-server-freebsd-opensmptd-rspamd-dovecot-part1/" rel="nofollow">Make your own E-Mail server - FreeBSD, OpenSMTPD, Rspamd and Dovecot included - Part 1</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://despairlabs.com/blog/posts/2024-03-04-quiz-rapid-openzfs-development/" rel="nofollow">quiz: a tool for rapid OpenZFS development</a></p>

<hr>

<p><a href="https://github.com/letsencrypt/openzfs-nvme-databases" rel="nofollow">Configuring openzfs for nvme databases</a></p>

<hr>

<p><a href="https://antranigv.am/posts/2024/02/omnios-mirror-one/" rel="nofollow">Mirroring OmniOS: The Complete Guide; Part One</a></p>

<hr>

<p><a href="https://quozul.dev/riscv/2023/12/22/installing-openbsd-on-visionfive-2.html" rel="nofollow">Installing OpenBSD 7.4 on a VisionFive 2 rev 1.2a</a></p>

<hr>

<p><a href="https://beuke.org/terminal-latency/" rel="nofollow">Terminal Latency</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>551: SSH Port Story</title>
  <link>https://www.bsdnow.tv/551</link>
  <guid isPermaLink="false">26a0d9ff-b867-40d3-8479-5cd7d63cbeb9</guid>
  <pubDate>Thu, 21 Mar 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/26a0d9ff-b867-40d3-8479-5cd7d63cbeb9.mp3" length="50259072" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, The story of SSH getting port 22, GGC using Clang, AuxRunner, Stabweek, Using a Kensington SlimBladePro on OpenBSD, and more...</itunes:subtitle>
  <itunes:duration>52:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, The story of SSH getting port 22, GGC using Clang, AuxRunner, Stabweek, Using a Kensington SlimBladePro on OpenBSD, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The story of getting SSH port 22 (https://www.ssh.com/academy/ssh/port#the-story-of-getting-ssh-port-22)
Can GCC use Clang as its assembler? (https://briancallahan.net/blog/20240122.html)
News Roundup
AUXrunner: a macOS QEMU-based app for running A/UX (https://mendelson.org/auxrunner.html)
Stabweek (https://lists.freebsd.org/archives/freebsd-current/2024-February/005657.html)
Using the Kensington SlimBlade Pro TrackBall with OpenBSD (https://www.tumfatig.net/2024/using-the-kensington-slimblade-pro-trackball-with-openbsd/)
Running 9front on an emulated SGI Indy via MAME (https://posixcafe.org/blogs/2024/01/01/0/)
Beastie Bits
Huffman Codes – How Do They Work? (https://two-wrongs.com/huffman-codes-how-do-they-work)
NetBSD 10.0_RC5 (https://mail-index.netbsd.org/source-changes/2024/02/27/msg150156.html)
New code for SIGILL faults help identify misbranches (https://www.undeadly.org/cgi?action=article;sid=20240222183703)
New Illumos telegram channel (https://t.me/illumosDistroes)
The Jan Feb issues of the FreeBSD Journal is here (https://freebsdfoundation.org/blog/the-january-february-2024-issue-of-the-freebsd-journal-is-here/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, The story of SSH getting port 22, GGC using Clang, AuxRunner, Stabweek, Using a Kensington SlimBladePro on OpenBSD, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.ssh.com/academy/ssh/port#the-story-of-getting-ssh-port-22" rel="nofollow">The story of getting SSH port 22</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20240122.html" rel="nofollow">Can GCC use Clang as its assembler?</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://mendelson.org/auxrunner.html" rel="nofollow">AUXrunner: a macOS QEMU-based app for running A/UX</a></p>

<hr>

<p><a href="https://lists.freebsd.org/archives/freebsd-current/2024-February/005657.html" rel="nofollow">Stabweek</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/using-the-kensington-slimblade-pro-trackball-with-openbsd/" rel="nofollow">Using the Kensington SlimBlade Pro TrackBall with OpenBSD</a></p>

<hr>

<p><a href="https://posixcafe.org/blogs/2024/01/01/0/" rel="nofollow">Running 9front on an emulated SGI Indy via MAME</a></p>

<hr>

<h3>Beastie Bits</h3>

<p><a href="https://two-wrongs.com/huffman-codes-how-do-they-work" rel="nofollow">Huffman Codes – How Do They Work?</a><br>
<a href="https://mail-index.netbsd.org/source-changes/2024/02/27/msg150156.html" rel="nofollow">NetBSD 10.0_RC5</a><br>
<a href="https://www.undeadly.org/cgi?action=article;sid=20240222183703" rel="nofollow">New code for SIGILL faults help identify misbranches</a><br>
<a href="https://t.me/illumosDistroes" rel="nofollow">New Illumos telegram channel</a><br>
<a href="https://freebsdfoundation.org/blog/the-january-february-2024-issue-of-the-freebsd-journal-is-here/" rel="nofollow">The Jan Feb issues of the FreeBSD Journal is here</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, The story of SSH getting port 22, GGC using Clang, AuxRunner, Stabweek, Using a Kensington SlimBladePro on OpenBSD, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.ssh.com/academy/ssh/port#the-story-of-getting-ssh-port-22" rel="nofollow">The story of getting SSH port 22</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20240122.html" rel="nofollow">Can GCC use Clang as its assembler?</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://mendelson.org/auxrunner.html" rel="nofollow">AUXrunner: a macOS QEMU-based app for running A/UX</a></p>

<hr>

<p><a href="https://lists.freebsd.org/archives/freebsd-current/2024-February/005657.html" rel="nofollow">Stabweek</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/using-the-kensington-slimblade-pro-trackball-with-openbsd/" rel="nofollow">Using the Kensington SlimBlade Pro TrackBall with OpenBSD</a></p>

<hr>

<p><a href="https://posixcafe.org/blogs/2024/01/01/0/" rel="nofollow">Running 9front on an emulated SGI Indy via MAME</a></p>

<hr>

<h3>Beastie Bits</h3>

<p><a href="https://two-wrongs.com/huffman-codes-how-do-they-work" rel="nofollow">Huffman Codes – How Do They Work?</a><br>
<a href="https://mail-index.netbsd.org/source-changes/2024/02/27/msg150156.html" rel="nofollow">NetBSD 10.0_RC5</a><br>
<a href="https://www.undeadly.org/cgi?action=article;sid=20240222183703" rel="nofollow">New code for SIGILL faults help identify misbranches</a><br>
<a href="https://t.me/illumosDistroes" rel="nofollow">New Illumos telegram channel</a><br>
<a href="https://freebsdfoundation.org/blog/the-january-february-2024-issue-of-the-freebsd-journal-is-here/" rel="nofollow">The Jan Feb issues of the FreeBSD Journal is here</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>550: Netware and Netmap</title>
  <link>https://www.bsdnow.tv/550</link>
  <guid isPermaLink="false">16bc5c0c-304f-4b45-bd6e-979f5ce042bc</guid>
  <pubDate>Tue, 12 Mar 2024 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/16bc5c0c-304f-4b45-bd6e-979f5ce042bc.mp3" length="51137664" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, you're not too late to develop the future, netmap on czgbe, OpenZFS 2.2.3, SSH Brute Forcing, some unknown OpenBSD Features, Release notes for the latest Omni OS, and more...</itunes:subtitle>
  <itunes:duration>53:16</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, you're not too late to develop the future, netmap on czgbe, OpenZFS 2.2.3, SSH Brute Forcing, some unknown OpenBSD Features, Release notes for the latest Omni OS, and more...
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
When the Power Macintosh ran NetWare (featuring Wormhole and Cyberpunk) (https://oldvcr.blogspot.com/2023/12/when-power-macintosh-ran-netware.html)
You are not too late (https://kk.org/thetechnium/you-are-not-late/)
News Roundup
netmap on cxgbe interfaces (https://adventurist.me/posts/00318)
OpenZFS 2.2.3 (https://github.com/openzfs/zfs/releases/tag/zfs-2.2.3)
A recent abrupt change in Internet SSH brute force attacks against us (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHBruteForceAttacksAbruptlyDown)
Some OpenBSD features that aren't widely known (https://dataswamp.org/~solene/2024-02-20-rarely-known-openbsd-features.html)
Release Notes for OmniOS v11 r151048 (https://github.com/omniosorg/omnios-build/blob/44731424e67c8aaafe5c4e500fe7c4544a22f0f6/doc/ReleaseNotes.md#r151048o-2024-02-15)
The Making of RP2040 Doom (https://kilograham.github.io/rp2040-doom/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brendan - Log Files (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Brendan%20-%20Log%20Files.md)
Mischa - EuroBSDcon (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Mischa%20-%20EuroBSDcon.md)
Sebastiano - Sed (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Sebastiano%20-%20Sed.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, you&#39;re not too late to develop the future, netmap on czgbe, OpenZFS 2.2.3, SSH Brute Forcing, some unknown OpenBSD Features, Release notes for the latest Omni OS, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://oldvcr.blogspot.com/2023/12/when-power-macintosh-ran-netware.html" rel="nofollow">When the Power Macintosh ran NetWare (featuring Wormhole and Cyberpunk)</a></p>

<hr>

<p><a href="https://kk.org/thetechnium/you-are-not-late/" rel="nofollow">You are not too late</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://adventurist.me/posts/00318" rel="nofollow">netmap on cxgbe interfaces</a></p>

<hr>

<p><a href="https://github.com/openzfs/zfs/releases/tag/zfs-2.2.3" rel="nofollow">OpenZFS 2.2.3</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/SSHBruteForceAttacksAbruptlyDown" rel="nofollow">A recent abrupt change in Internet SSH brute force attacks against us</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-02-20-rarely-known-openbsd-features.html" rel="nofollow">Some OpenBSD features that aren&#39;t widely known</a></p>

<hr>

<p><a href="https://github.com/omniosorg/omnios-build/blob/44731424e67c8aaafe5c4e500fe7c4544a22f0f6/doc/ReleaseNotes.md#r151048o-2024-02-15" rel="nofollow">Release Notes for OmniOS v11 r151048</a></p>

<hr>

<p><a href="https://kilograham.github.io/rp2040-doom/" rel="nofollow">The Making of RP2040 Doom</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Brendan%20-%20Log%20Files.md" rel="nofollow">Brendan - Log Files</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Mischa%20-%20EuroBSDcon.md" rel="nofollow">Mischa - EuroBSDcon</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Sebastiano%20-%20Sed.md" rel="nofollow">Sebastiano - Sed</a></p></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, you&#39;re not too late to develop the future, netmap on czgbe, OpenZFS 2.2.3, SSH Brute Forcing, some unknown OpenBSD Features, Release notes for the latest Omni OS, and more...</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://oldvcr.blogspot.com/2023/12/when-power-macintosh-ran-netware.html" rel="nofollow">When the Power Macintosh ran NetWare (featuring Wormhole and Cyberpunk)</a></p>

<hr>

<p><a href="https://kk.org/thetechnium/you-are-not-late/" rel="nofollow">You are not too late</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://adventurist.me/posts/00318" rel="nofollow">netmap on cxgbe interfaces</a></p>

<hr>

<p><a href="https://github.com/openzfs/zfs/releases/tag/zfs-2.2.3" rel="nofollow">OpenZFS 2.2.3</a></p>

<hr>

<p><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/SSHBruteForceAttacksAbruptlyDown" rel="nofollow">A recent abrupt change in Internet SSH brute force attacks against us</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-02-20-rarely-known-openbsd-features.html" rel="nofollow">Some OpenBSD features that aren&#39;t widely known</a></p>

<hr>

<p><a href="https://github.com/omniosorg/omnios-build/blob/44731424e67c8aaafe5c4e500fe7c4544a22f0f6/doc/ReleaseNotes.md#r151048o-2024-02-15" rel="nofollow">Release Notes for OmniOS v11 r151048</a></p>

<hr>

<p><a href="https://kilograham.github.io/rp2040-doom/" rel="nofollow">The Making of RP2040 Doom</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Brendan%20-%20Log%20Files.md" rel="nofollow">Brendan - Log Files</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Mischa%20-%20EuroBSDcon.md" rel="nofollow">Mischa - EuroBSDcon</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Sebastiano%20-%20Sed.md" rel="nofollow">Sebastiano - Sed</a></p></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>549: htop Tetris</title>
  <link>https://www.bsdnow.tv/549</link>
  <guid isPermaLink="false">09b0aba7-84c8-48f6-8901-4bd391e42348</guid>
  <pubDate>Thu, 07 Mar 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/09b0aba7-84c8-48f6-8901-4bd391e42348.mp3" length="54510336" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Foundation Statement on the European Union Cyber Resiliency Act, DragonFly BSD on a Thinkpad T480s, How FreeBSD 
 Employs Ampere Arm64 Servers in the Data Center, FreeBSD Yubikey authentication, that time I almost added Tetris to htop, and more</itunes:subtitle>
  <itunes:duration>56:46</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Foundation Statement on the European Union Cyber Resiliency Act, DragonFly BSD on a Thinkpad T480s, How FreeBSD 
 Employs Ampere Arm64 Servers in the Data Center, FreeBSD Yubikey authentication, that time I almost added Tetris to htop, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Foundation Statement on the European Union Cyber Resiliency Act (https://freebsdfoundation.org/blog/freebsd-foundation-statement-on-the-european-union-cyber-resiliency-act/?utm_source=bsdweekly)
DragonFly BSD on a Thinkpad T480s (https://git.sr.ht/~tomh/dragonflybsd-on-a-laptop/tree/master/item/README.md)
News Roundup
Ampere in the Wild: How FreeBSD Employs Ampere Arm64 Servers in the Data Center (https://amperecomputing.com/blogs/ampere-in-the-wild)
FreeBSD Yubikey authentication (https://gist.github.com/daemonhorn/bdd77a7bc0ff5842e5a31d999b96e1f1)
That time I almost added Tetris to htop (https://hisham.hm/2024/02/12/that-time-i-almost-added-tetris-to-htop/)
Beastie Bits
Mail Software Projects for You (https://mwl.io/archives/23419)
At long last: the MWL Title Index (https://mwl.io/archives/23401)
FreeBSD on a RPi (https://linux.slashdot.org/story/24/01/07/0327229/how-does-freebsd-compare-to-linux-on-a-raspberry-pi)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, statement, cyber resiliency act, thinkpad t480s, ampere, arm64, data center, yubikey, authentication, tetris, htop</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Foundation Statement on the European Union Cyber Resiliency Act, DragonFly BSD on a Thinkpad T480s, How FreeBSD <br>
 Employs Ampere Arm64 Servers in the Data Center, FreeBSD Yubikey authentication, that time I almost added Tetris to htop, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/freebsd-foundation-statement-on-the-european-union-cyber-resiliency-act/?utm_source=bsdweekly" rel="nofollow">FreeBSD Foundation Statement on the European Union Cyber Resiliency Act</a></p>

<hr>

<p><a href="https://git.sr.ht/%7Etomh/dragonflybsd-on-a-laptop/tree/master/item/README.md" rel="nofollow">DragonFly BSD on a Thinkpad T480s</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://amperecomputing.com/blogs/ampere-in-the-wild" rel="nofollow">Ampere in the Wild: How FreeBSD Employs Ampere Arm64 Servers in the Data Center</a></p>

<hr>

<p><a href="https://gist.github.com/daemonhorn/bdd77a7bc0ff5842e5a31d999b96e1f1" rel="nofollow">FreeBSD Yubikey authentication</a></p>

<hr>

<p><a href="https://hisham.hm/2024/02/12/that-time-i-almost-added-tetris-to-htop/" rel="nofollow">That time I almost added Tetris to htop</a></p>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://mwl.io/archives/23419" rel="nofollow">Mail Software Projects for You</a><br>
<a href="https://mwl.io/archives/23401" rel="nofollow">At long last: the MWL Title Index</a><br>
<a href="https://linux.slashdot.org/story/24/01/07/0327229/how-does-freebsd-compare-to-linux-on-a-raspberry-pi" rel="nofollow">FreeBSD on a RPi</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Foundation Statement on the European Union Cyber Resiliency Act, DragonFly BSD on a Thinkpad T480s, How FreeBSD <br>
 Employs Ampere Arm64 Servers in the Data Center, FreeBSD Yubikey authentication, that time I almost added Tetris to htop, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://freebsdfoundation.org/blog/freebsd-foundation-statement-on-the-european-union-cyber-resiliency-act/?utm_source=bsdweekly" rel="nofollow">FreeBSD Foundation Statement on the European Union Cyber Resiliency Act</a></p>

<hr>

<p><a href="https://git.sr.ht/%7Etomh/dragonflybsd-on-a-laptop/tree/master/item/README.md" rel="nofollow">DragonFly BSD on a Thinkpad T480s</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://amperecomputing.com/blogs/ampere-in-the-wild" rel="nofollow">Ampere in the Wild: How FreeBSD Employs Ampere Arm64 Servers in the Data Center</a></p>

<hr>

<p><a href="https://gist.github.com/daemonhorn/bdd77a7bc0ff5842e5a31d999b96e1f1" rel="nofollow">FreeBSD Yubikey authentication</a></p>

<hr>

<p><a href="https://hisham.hm/2024/02/12/that-time-i-almost-added-tetris-to-htop/" rel="nofollow">That time I almost added Tetris to htop</a></p>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://mwl.io/archives/23419" rel="nofollow">Mail Software Projects for You</a><br>
<a href="https://mwl.io/archives/23401" rel="nofollow">At long last: the MWL Title Index</a><br>
<a href="https://linux.slashdot.org/story/24/01/07/0327229/how-does-freebsd-compare-to-linux-on-a-raspberry-pi" rel="nofollow">FreeBSD on a RPi</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>548: NTP - In Memoriam</title>
  <link>https://www.bsdnow.tv/548</link>
  <guid isPermaLink="false">9fc45182-53da-4b7a-8fa2-a408b12d8a5b</guid>
  <pubDate>Thu, 29 Feb 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9fc45182-53da-4b7a-8fa2-a408b12d8a5b.mp3" length="54708480" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Status Report Q4 2023, In Memorium of the NTP inventor, Migrate a FreeBSD bhyve virtual machine to OmniOS, AI-free blog, Hard disk LEDs and Noisy Machines, SSH based comment system, NetBSD 10 RC.4 is available, and more</itunes:subtitle>
  <itunes:duration>56:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Status Report Q4 2023, In Memorium of the NTP inventor, Migrate a FreeBSD bhyve virtual machine to OmniOS, AI-free blog, Hard disk LEDs and Noisy Machines, SSH based comment system, NetBSD 10 RC.4 is available, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Status Report Fourth Quarter 2023 (https://www.freebsd.org/status/report-2023-10-2023-12/)
In Memoriam : Inventor of NTP protocol that keeps time on billions of devices dies at age 85 (https://arstechnica.com/gadgets/2024/01/inventor-of-ntp-protocol-that-keeps-time-on-billions-of-devices-dies-at-age-85/)
News Roundup
Migrate a FreeBSD bhyve virtual machine to OmniOS (https://www.tumfatig.net/2024/migrate-a-freebsd-bhyve-virtual-machine-to-omnios/?utm_source=bsdweekly)
This blog is AI free (https://dataswamp.org/~solene/2024-01-18-no-ai.html)
Hard disk LEDs and Noisy Machines (https://jmmv.dev/2023/12/hard-disk-leds-and-noisy-machines.html)
SSH based comment system (https://blog.haschek.at/2023/ssh-based-comment-system.html)
NetBSD 10 RC.4 is available (https://blog.netbsd.org/tnf/entry/netbsd_10_0_rc4_available)
Beastie Bits
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, status report, ntp, memorium, inventor, migration, migrate, bhyve, vm, virtual machine, omnios, ai-free, blog, LED, hard disk, machine, ssh-based, ssh, comment system, netbsd 10 rc 4</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Status Report Q4 2023, In Memorium of the NTP inventor, Migrate a FreeBSD bhyve virtual machine to OmniOS, AI-free blog, Hard disk LEDs and Noisy Machines, SSH based comment system, NetBSD 10 RC.4 is available, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.freebsd.org/status/report-2023-10-2023-12/" rel="nofollow">FreeBSD Status Report Fourth Quarter 2023</a></p>

<hr>

<p><a href="https://arstechnica.com/gadgets/2024/01/inventor-of-ntp-protocol-that-keeps-time-on-billions-of-devices-dies-at-age-85/" rel="nofollow">In Memoriam : Inventor of NTP protocol that keeps time on billions of devices dies at age 85</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.tumfatig.net/2024/migrate-a-freebsd-bhyve-virtual-machine-to-omnios/?utm_source=bsdweekly" rel="nofollow">Migrate a FreeBSD bhyve virtual machine to OmniOS</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-01-18-no-ai.html" rel="nofollow">This blog is AI free</a></p>

<hr>

<p><a href="https://jmmv.dev/2023/12/hard-disk-leds-and-noisy-machines.html" rel="nofollow">Hard disk LEDs and Noisy Machines</a></p>

<hr>

<p><a href="https://blog.haschek.at/2023/ssh-based-comment-system.html" rel="nofollow">SSH based comment system</a></p>

<hr>

<p><a href="https://blog.netbsd.org/tnf/entry/netbsd_10_0_rc4_available" rel="nofollow">NetBSD 10 RC.4 is available</a></p>

<hr>

<h2>Beastie Bits</h2>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Status Report Q4 2023, In Memorium of the NTP inventor, Migrate a FreeBSD bhyve virtual machine to OmniOS, AI-free blog, Hard disk LEDs and Noisy Machines, SSH based comment system, NetBSD 10 RC.4 is available, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://www.freebsd.org/status/report-2023-10-2023-12/" rel="nofollow">FreeBSD Status Report Fourth Quarter 2023</a></p>

<hr>

<p><a href="https://arstechnica.com/gadgets/2024/01/inventor-of-ntp-protocol-that-keeps-time-on-billions-of-devices-dies-at-age-85/" rel="nofollow">In Memoriam : Inventor of NTP protocol that keeps time on billions of devices dies at age 85</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.tumfatig.net/2024/migrate-a-freebsd-bhyve-virtual-machine-to-omnios/?utm_source=bsdweekly" rel="nofollow">Migrate a FreeBSD bhyve virtual machine to OmniOS</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-01-18-no-ai.html" rel="nofollow">This blog is AI free</a></p>

<hr>

<p><a href="https://jmmv.dev/2023/12/hard-disk-leds-and-noisy-machines.html" rel="nofollow">Hard disk LEDs and Noisy Machines</a></p>

<hr>

<p><a href="https://blog.haschek.at/2023/ssh-based-comment-system.html" rel="nofollow">SSH based comment system</a></p>

<hr>

<p><a href="https://blog.netbsd.org/tnf/entry/netbsd_10_0_rc4_available" rel="nofollow">NetBSD 10 RC.4 is available</a></p>

<hr>

<h2>Beastie Bits</h2>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>547: IT Impostor Syndrome</title>
  <link>https://www.bsdnow.tv/547</link>
  <guid isPermaLink="false">6800295d-3150-40ed-be3a-5c0aa3f787d3</guid>
  <pubDate>Thu, 22 Feb 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6800295d-3150-40ed-be3a-5c0aa3f787d3.mp3" length="42274944" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Overcoming imposter syndrome in IT, A Practical Guide to GNU sed With Examples, Early computer art by Barbara Nessim, Don't prefill config files, Trapping Spambots Based on Target Domain Only, You cannot cURL under pressure, and more</itunes:subtitle>
  <itunes:duration>44:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Overcoming imposter syndrome in IT, A Practical Guide to GNU sed With Examples, Early computer art by Barbara Nessim, Don't prefill config files, Trapping Spambots Based on Target Domain Only, You cannot cURL under pressure, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Overcoming imposter syndrome in IT (https://dataswamp.org/~solene/2024-01-10-dealing-with-imposter-syndrome.html)
A Practical Guide to GNU sed With Examples (https://thevaluable.dev/sed-cli-practical-guide-examples/)
News Roundup
Early computer art by Barbara Nessim (1984) (https://blog.gingerbeardman.com/2023/11/09/early-computer-art-by-barbara-nessim/)
Don't prefill config files (https://www.makeworld.space/2024/02/no_prefill_config.html)
A Simpler Life: Trapping Spambots Based on Target Domain Only (https://bsdly.blogspot.com/2024/01/a-simpler-life-trapping-spambots-based.html)
You cannot cURL under pressure (https://blog.benjojo.co.uk/post/you-cant-curl-under-pressure)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Marcus - Linux Compat Layer (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/547/feedback/Marcus%20-%20linux%20compat%20layer.md)
Daniel - FreeBSD Nostalgia (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/547/feedback/Daniel%20-%20FreeBSD%20Nostalgia.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, impostor, syndrome, sed, practical, examples, computer, art, barbara nessim, prefill, config lines, trapping, spambots, curl</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Overcoming imposter syndrome in IT, A Practical Guide to GNU sed With Examples, Early computer art by Barbara Nessim, Don&#39;t prefill config files, Trapping Spambots Based on Target Domain Only, You cannot cURL under pressure, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://dataswamp.org/%7Esolene/2024-01-10-dealing-with-imposter-syndrome.html" rel="nofollow">Overcoming imposter syndrome in IT</a></p>

<hr>

<p><a href="https://thevaluable.dev/sed-cli-practical-guide-examples/" rel="nofollow">A Practical Guide to GNU sed With Examples</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://blog.gingerbeardman.com/2023/11/09/early-computer-art-by-barbara-nessim/" rel="nofollow">Early computer art by Barbara Nessim (1984)</a></p>

<hr>

<p><a href="https://www.makeworld.space/2024/02/no_prefill_config.html" rel="nofollow">Don&#39;t prefill config files</a></p>

<hr>

<p><a href="https://bsdly.blogspot.com/2024/01/a-simpler-life-trapping-spambots-based.html" rel="nofollow">A Simpler Life: Trapping Spambots Based on Target Domain Only</a></p>

<hr>

<p><a href="https://blog.benjojo.co.uk/post/you-cant-curl-under-pressure" rel="nofollow">You cannot cURL under pressure</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/547/feedback/Marcus%20-%20linux%20compat%20layer.md" rel="nofollow">Marcus - Linux Compat Layer</a></p>

<h2><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/547/feedback/Daniel%20-%20FreeBSD%20Nostalgia.md" rel="nofollow">Daniel - FreeBSD Nostalgia</a></h2>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Overcoming imposter syndrome in IT, A Practical Guide to GNU sed With Examples, Early computer art by Barbara Nessim, Don&#39;t prefill config files, Trapping Spambots Based on Target Domain Only, You cannot cURL under pressure, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://dataswamp.org/%7Esolene/2024-01-10-dealing-with-imposter-syndrome.html" rel="nofollow">Overcoming imposter syndrome in IT</a></p>

<hr>

<p><a href="https://thevaluable.dev/sed-cli-practical-guide-examples/" rel="nofollow">A Practical Guide to GNU sed With Examples</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://blog.gingerbeardman.com/2023/11/09/early-computer-art-by-barbara-nessim/" rel="nofollow">Early computer art by Barbara Nessim (1984)</a></p>

<hr>

<p><a href="https://www.makeworld.space/2024/02/no_prefill_config.html" rel="nofollow">Don&#39;t prefill config files</a></p>

<hr>

<p><a href="https://bsdly.blogspot.com/2024/01/a-simpler-life-trapping-spambots-based.html" rel="nofollow">A Simpler Life: Trapping Spambots Based on Target Domain Only</a></p>

<hr>

<p><a href="https://blog.benjojo.co.uk/post/you-cant-curl-under-pressure" rel="nofollow">You cannot cURL under pressure</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/547/feedback/Marcus%20-%20linux%20compat%20layer.md" rel="nofollow">Marcus - Linux Compat Layer</a></p>

<h2><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/547/feedback/Daniel%20-%20FreeBSD%20Nostalgia.md" rel="nofollow">Daniel - FreeBSD Nostalgia</a></h2>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>546: Debunking FreeBSD Myths</title>
  <link>https://www.bsdnow.tv/546</link>
  <guid isPermaLink="false">c7cb0c2d-cc60-4bf8-8323-088db1bd3e41</guid>
  <pubDate>Thu, 15 Feb 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c7cb0c2d-cc60-4bf8-8323-088db1bd3e41.mp3" length="51679488" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Debunking Common Myths About FreeBSD, Please, don’t force me to log in, Exploring FreeBSD service(8) basics, Failed Product Designs: A Laptop with Seven Screens, What’s a Permissive License – and Why Should I Care?, Beginning of the year Laugh</itunes:subtitle>
  <itunes:duration>53:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Debunking Common Myths About FreeBSD, Please, don’t force me to log in, Exploring FreeBSD service(8) basics, Failed Product Designs: A Laptop with Seven Screens, What’s a Permissive License – and Why Should I Care?, Beginning of the year Laugh
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Debunking Common Myths About FreeBSD (https://klarasystems.com/articles/debunking-common-myths-about-freebsd/)
Please, don’t force me to log in (https://hamatti.org/posts/please-dont-force-me-to-log-in/)
News Roundup
Exploring FreeBSD service(8) basics (https://rubenerd.com/basics-of-freebsd-services/)
Failed Product Designs: A Laptop with Seven Screens
The Expanscape Aurora 7 (https://www.core77.com/posts/127288/Failed-Product-Designs-A-Laptop-with-Seven-Screens)
“What’s a Permissive License – and Why Should I Care?” (https://freebsdfoundation.org/blog/whats-a-permissive-license-and-why-should-i-care/)
Beginning of the year Laugh (https://saagarjha.com/blog/2020/05/10/why-we-at-famous-company-switched-to-hyped-technology/)
Beastie Bits
NetBSD 10: Thirty Years, Still Going Strong! (https://bentsukun.ch/talks/fosdem2024/)
Dracula theme using bash shell (https://forums.freebsd.org/threads/dracula-theme-using-bash-shell.92052/)
pinsyscalls(2) working in anger (https://www.undeadly.org/cgi?action=article;sid=20240118080752)
First bits of a Haiku compatibility layer for NetBSD (https://www.osnews.com/story/137961/first-bits-of-a-haiku-compatibility-layer-for-netbsd/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, myth, debunking, login, log in, exploring, basics, product, design, failed, laptop, seven screens, permissive license, care, beginning, year, laugh</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Debunking Common Myths About FreeBSD, Please, don’t force me to log in, Exploring FreeBSD service(8) basics, Failed Product Designs: A Laptop with Seven Screens, What’s a Permissive License – and Why Should I Care?, Beginning of the year Laugh</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/debunking-common-myths-about-freebsd/" rel="nofollow">Debunking Common Myths About FreeBSD</a></p>

<hr>

<p><a href="https://hamatti.org/posts/please-dont-force-me-to-log-in/" rel="nofollow">Please, don’t force me to log in</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://rubenerd.com/basics-of-freebsd-services/" rel="nofollow">Exploring FreeBSD service(8) basics</a></p>

<hr>

<p><a href="https://www.core77.com/posts/127288/Failed-Product-Designs-A-Laptop-with-Seven-Screens" rel="nofollow">Failed Product Designs: A Laptop with Seven Screens<br>
The Expanscape Aurora 7</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/whats-a-permissive-license-and-why-should-i-care/" rel="nofollow">“What’s a Permissive License – and Why Should I Care?”</a></p>

<hr>

<p><a href="https://saagarjha.com/blog/2020/05/10/why-we-at-famous-company-switched-to-hyped-technology/" rel="nofollow">Beginning of the year Laugh</a></p>

<hr>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://bentsukun.ch/talks/fosdem2024/" rel="nofollow">NetBSD 10: Thirty Years, Still Going Strong!</a><br>
<a href="https://forums.freebsd.org/threads/dracula-theme-using-bash-shell.92052/" rel="nofollow">Dracula theme using bash shell</a><br>
<a href="https://www.undeadly.org/cgi?action=article;sid=20240118080752" rel="nofollow">pinsyscalls(2) working in anger</a><br>
<a href="https://www.osnews.com/story/137961/first-bits-of-a-haiku-compatibility-layer-for-netbsd/" rel="nofollow">First bits of a Haiku compatibility layer for NetBSD</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Debunking Common Myths About FreeBSD, Please, don’t force me to log in, Exploring FreeBSD service(8) basics, Failed Product Designs: A Laptop with Seven Screens, What’s a Permissive License – and Why Should I Care?, Beginning of the year Laugh</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/debunking-common-myths-about-freebsd/" rel="nofollow">Debunking Common Myths About FreeBSD</a></p>

<hr>

<p><a href="https://hamatti.org/posts/please-dont-force-me-to-log-in/" rel="nofollow">Please, don’t force me to log in</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://rubenerd.com/basics-of-freebsd-services/" rel="nofollow">Exploring FreeBSD service(8) basics</a></p>

<hr>

<p><a href="https://www.core77.com/posts/127288/Failed-Product-Designs-A-Laptop-with-Seven-Screens" rel="nofollow">Failed Product Designs: A Laptop with Seven Screens<br>
The Expanscape Aurora 7</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/whats-a-permissive-license-and-why-should-i-care/" rel="nofollow">“What’s a Permissive License – and Why Should I Care?”</a></p>

<hr>

<p><a href="https://saagarjha.com/blog/2020/05/10/why-we-at-famous-company-switched-to-hyped-technology/" rel="nofollow">Beginning of the year Laugh</a></p>

<hr>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://bentsukun.ch/talks/fosdem2024/" rel="nofollow">NetBSD 10: Thirty Years, Still Going Strong!</a><br>
<a href="https://forums.freebsd.org/threads/dracula-theme-using-bash-shell.92052/" rel="nofollow">Dracula theme using bash shell</a><br>
<a href="https://www.undeadly.org/cgi?action=article;sid=20240118080752" rel="nofollow">pinsyscalls(2) working in anger</a><br>
<a href="https://www.osnews.com/story/137961/first-bits-of-a-haiku-compatibility-layer-for-netbsd/" rel="nofollow">First bits of a Haiku compatibility layer for NetBSD</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>545: BSD Audio Enhancements</title>
  <link>https://www.bsdnow.tv/545</link>
  <guid isPermaLink="false">efbf773e-fa58-4991-87a2-c1dd17e44ddd</guid>
  <pubDate>Thu, 08 Feb 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/efbf773e-fa58-4991-87a2-c1dd17e44ddd.mp3" length="60848256" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>ZFS High Availability with Asynchronous Replication and zrep, Stop
Blogging and start documenting, 2023 in Review: Infrastructure, NovaCustom NV41
laptop review, OpenBSD Video Audio Screen Recording, HDMI Audio sound patches
into GhostBSD source code, DSA removal from OpenSSH, NetBSD/evbppc 10.99.10 on
the Nintendo Wii, NetBSD/amd64 current performance patch</itunes:subtitle>
  <itunes:duration>1:03:23</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>ZFS High Availability with Asynchronous Replication and zrep, Stop
Blogging and start documenting, 2023 in Review: Infrastructure, NovaCustom NV41
laptop review, OpenBSD Video Audio Screen Recording, HDMI Audio sound patches
into GhostBSD source code, DSA removal from OpenSSH, NetBSD/evbppc 10.99.10 on
the Nintendo Wii, NetBSD/amd64 current performance patch
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
ZFS High Availability with
Asynchronous Replication and zrep (https://klarasystems.com/articles/zfs-high-availability-with-asynchronous-replication-and-zrep/)
Stop Blogging and start documenting (https://callfortesting.org/stopblogging/)
News Roundup
2023 in Review: Infrastructure (https://freebsdfoundation.org/blog/2023-in-review-infrastructure/)
NovaCustom NV41 laptop review (https://dataswamp.org/~solene/2024-01-03-laptop-review-novacustom-nv41.html)
OpenBSD Video Audio Screen Recording (https://rsadowski.de/posts/2024-01-14-openbsd-video-audio-screen-recording/)
HDMI Audio sound patches into GhostBSD source code /usr/ghost14/ghostbsd-src SOLVED Jan20 2024 (https://ghostbsd-arm64.blogspot.com/2024/01/hdmi-audio-sound-patches-into-ghostbsd.html)
Beastie Bits
DSA removal from OpenSSH (http://undeadly.org/cgi?action=article;sid=20240111105900)
NetBSD/evbppc 10.99.10 on the Nintendo Wii (https://youtu.be/n-MShCcFm_w?si=-bl2725c1WwT8PBg)
NetBSD/amd64 current performance patch (https://mail-index.netbsd.org/tech-kern/2024/01/23/msg029450.html)
November/December 2023 FreeBSD Journal Issue (https://freebsdfoundation.org/past-issues/freebsd-14-0/)
Feedback
Rick - Questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/545/feedback/rick%20-%20questions.md)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, high availability, asynchronous, replication, zrep, NovaCustom, laptop, screen recording, sound patches, HDMI, dsa removal, Nintendo Wii, performance patch</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>ZFS High Availability with Asynchronous Replication and zrep, Stop<br>
Blogging and start documenting, 2023 in Review: Infrastructure, NovaCustom NV41<br>
laptop review, OpenBSD Video Audio Screen Recording, HDMI Audio sound patches<br>
into GhostBSD source code, DSA removal from OpenSSH, NetBSD/evbppc 10.99.10 on<br>
the Nintendo Wii, NetBSD/amd64 current performance patch</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/zfs-high-availability-with-asynchronous-replication-and-zrep/" rel="nofollow">ZFS High Availability with<br>
Asynchronous Replication and zrep</a></p>

<hr>

<p><a href="https://callfortesting.org/stopblogging/" rel="nofollow">Stop Blogging and start documenting</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://freebsdfoundation.org/blog/2023-in-review-infrastructure/" rel="nofollow">2023 in Review: Infrastructure</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-01-03-laptop-review-novacustom-nv41.html" rel="nofollow">NovaCustom NV41 laptop review</a></p>

<hr>

<p><a href="https://rsadowski.de/posts/2024-01-14-openbsd-video-audio-screen-recording/" rel="nofollow">OpenBSD Video Audio Screen Recording</a></p>

<hr>

<p><a href="https://ghostbsd-arm64.blogspot.com/2024/01/hdmi-audio-sound-patches-into-ghostbsd.html" rel="nofollow">HDMI Audio sound patches into GhostBSD source code /usr/ghost14/ghostbsd-src SOLVED Jan20 2024</a></p>

<hr>

<h2>Beastie Bits</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240111105900" rel="nofollow">DSA removal from OpenSSH</a></p>

<p><a href="https://youtu.be/n-MShCcFm_w?si=-bl2725c1WwT8PBg" rel="nofollow">NetBSD/evbppc 10.99.10 on the Nintendo Wii</a></p>

<p><a href="https://mail-index.netbsd.org/tech-kern/2024/01/23/msg029450.html" rel="nofollow">NetBSD/amd64 current performance patch</a></p>

<p><a href="https://freebsdfoundation.org/past-issues/freebsd-14-0/" rel="nofollow">November/December 2023 FreeBSD Journal Issue</a></p>

<h2>Feedback</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/545/feedback/rick%20-%20questions.md" rel="nofollow">Rick - Questions</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>ZFS High Availability with Asynchronous Replication and zrep, Stop<br>
Blogging and start documenting, 2023 in Review: Infrastructure, NovaCustom NV41<br>
laptop review, OpenBSD Video Audio Screen Recording, HDMI Audio sound patches<br>
into GhostBSD source code, DSA removal from OpenSSH, NetBSD/evbppc 10.99.10 on<br>
the Nintendo Wii, NetBSD/amd64 current performance patch</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/zfs-high-availability-with-asynchronous-replication-and-zrep/" rel="nofollow">ZFS High Availability with<br>
Asynchronous Replication and zrep</a></p>

<hr>

<p><a href="https://callfortesting.org/stopblogging/" rel="nofollow">Stop Blogging and start documenting</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://freebsdfoundation.org/blog/2023-in-review-infrastructure/" rel="nofollow">2023 in Review: Infrastructure</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2024-01-03-laptop-review-novacustom-nv41.html" rel="nofollow">NovaCustom NV41 laptop review</a></p>

<hr>

<p><a href="https://rsadowski.de/posts/2024-01-14-openbsd-video-audio-screen-recording/" rel="nofollow">OpenBSD Video Audio Screen Recording</a></p>

<hr>

<p><a href="https://ghostbsd-arm64.blogspot.com/2024/01/hdmi-audio-sound-patches-into-ghostbsd.html" rel="nofollow">HDMI Audio sound patches into GhostBSD source code /usr/ghost14/ghostbsd-src SOLVED Jan20 2024</a></p>

<hr>

<h2>Beastie Bits</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20240111105900" rel="nofollow">DSA removal from OpenSSH</a></p>

<p><a href="https://youtu.be/n-MShCcFm_w?si=-bl2725c1WwT8PBg" rel="nofollow">NetBSD/evbppc 10.99.10 on the Nintendo Wii</a></p>

<p><a href="https://mail-index.netbsd.org/tech-kern/2024/01/23/msg029450.html" rel="nofollow">NetBSD/amd64 current performance patch</a></p>

<p><a href="https://freebsdfoundation.org/past-issues/freebsd-14-0/" rel="nofollow">November/December 2023 FreeBSD Journal Issue</a></p>

<h2>Feedback</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/545/feedback/rick%20-%20questions.md" rel="nofollow">Rick - Questions</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>544: Geeky weather check</title>
  <link>https://www.bsdnow.tv/544</link>
  <guid isPermaLink="false">2f3344c6-0c9e-459a-9035-970e84c6d131</guid>
  <pubDate>Thu, 01 Feb 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2f3344c6-0c9e-459a-9035-970e84c6d131.mp3" length="64449792" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>GPL 3: The Controversial Licensing Model and Potential Solutions,
The Geeks way of checking what the outside weather is like, Alpine on a
FreeBSD Jail, DragonFly BSD on a Thinkpad T480s, Dealing with USB Storage
devices on OmniOS, Creating a Time Capsule instance using Samba, FreeBSD, and
ZFS</itunes:subtitle>
  <itunes:duration>1:07:08</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>GPL 3: The Controversial Licensing Model and Potential Solutions,
The Geeks way of checking what the outside weather is like, Alpine on a
FreeBSD Jail, DragonFly BSD on a Thinkpad T480s, Dealing with USB Storage
devices on OmniOS, Creating a Time Capsule instance using Samba, FreeBSD, and
ZFS
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
GPL 3: The Controversial Licensing Model and Potential Solutions (https://klarasystems.com/articles/gpl-3-the-controversial-licensing-model-and-potential-solutions/)
The Geeks way of checking what the outside wheather is like (https://blog.netbsd.org/tnf/entry/the_geeks_way_of_checking)
News Roundup
Alpine on a FreeBSD Jail (https://it-notes.dragas.net/2024/01/18/installing-alpine-linux-on-a-freebsd-jail/)
DragonFly BSD on a Thinkpad T480s (https://git.sr.ht/~tomh/dragonflybsd-on-a-laptop/tree/master/item/README.md)
Dealing with USB Storage devices on OmniOS (https://www.tumfatig.net/2024/dealing-with-usb-storage-devices-on-omnios/)
Creating a Time Capsule instance using Samba, FreeBSD, and ZFS (https://dan.langille.org/2024/01/06/creating-a-time-capsule-instance-using-samba-freebsd-and-zfs-2/)
Conferences
FOSDEM (https://fosdem.org/2024/)
AsiaBSDCon (https://2024.asiabsdcon.org/program.html)
BSDCan (https://www.bsdcan.org/2024/papers.php)
EuroBSDcon (https://2024.eurobsdcon.org/)
Southeast Linuxfest (https://southeastlinuxfest.org/2024/01/self-2024-call-for-participation/)
Dont let the name fool you, SELF is BSD friendly and they'd love to have BSD/Unix Talks if you're in the area. JT is staff at SELF, so he can put in a good word for you. ;)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, controversy, gpl3, license model, weather, outside, geek, Alpine, jail, DragonFly, Thinkpad, T480s, OmniOS, storage device, time capsule, samba, zfs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>GPL 3: The Controversial Licensing Model and Potential Solutions,<br>
The Geeks way of checking what the outside weather is like, Alpine on a<br>
FreeBSD Jail, DragonFly BSD on a Thinkpad T480s, Dealing with USB Storage<br>
devices on OmniOS, Creating a Time Capsule instance using Samba, FreeBSD, and<br>
ZFS</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/gpl-3-the-controversial-licensing-model-and-potential-solutions/" rel="nofollow">GPL 3: The Controversial Licensing Model and Potential Solutions</a></p>

<hr>

<p><a href="https://blog.netbsd.org/tnf/entry/the_geeks_way_of_checking" rel="nofollow">The Geeks way of checking what the outside wheather is like</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://it-notes.dragas.net/2024/01/18/installing-alpine-linux-on-a-freebsd-jail/" rel="nofollow">Alpine on a FreeBSD Jail</a></p>

<hr>

<p><a href="https://git.sr.ht/%7Etomh/dragonflybsd-on-a-laptop/tree/master/item/README.md" rel="nofollow">DragonFly BSD on a Thinkpad T480s</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/dealing-with-usb-storage-devices-on-omnios/" rel="nofollow">Dealing with USB Storage devices on OmniOS</a></p>

<hr>

<p><a href="https://dan.langille.org/2024/01/06/creating-a-time-capsule-instance-using-samba-freebsd-and-zfs-2/" rel="nofollow">Creating a Time Capsule instance using Samba, FreeBSD, and ZFS</a></p>

<hr>

<h2>Conferences</h2>

<p><a href="https://fosdem.org/2024/" rel="nofollow">FOSDEM</a></p>

<p><a href="https://2024.asiabsdcon.org/program.html" rel="nofollow">AsiaBSDCon</a></p>

<p><a href="https://www.bsdcan.org/2024/papers.php" rel="nofollow">BSDCan</a></p>

<p><a href="https://2024.eurobsdcon.org/" rel="nofollow">EuroBSDcon</a></p>

<p><a href="https://southeastlinuxfest.org/2024/01/self-2024-call-for-participation/" rel="nofollow">Southeast Linuxfest</a></p>

<ul>
<li>Dont let the name fool you, SELF is BSD friendly and they&#39;d love to have BSD/Unix Talks if you&#39;re in the area. JT is staff at SELF, so he can put in a good word for you. ;)</li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>GPL 3: The Controversial Licensing Model and Potential Solutions,<br>
The Geeks way of checking what the outside weather is like, Alpine on a<br>
FreeBSD Jail, DragonFly BSD on a Thinkpad T480s, Dealing with USB Storage<br>
devices on OmniOS, Creating a Time Capsule instance using Samba, FreeBSD, and<br>
ZFS</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/gpl-3-the-controversial-licensing-model-and-potential-solutions/" rel="nofollow">GPL 3: The Controversial Licensing Model and Potential Solutions</a></p>

<hr>

<p><a href="https://blog.netbsd.org/tnf/entry/the_geeks_way_of_checking" rel="nofollow">The Geeks way of checking what the outside wheather is like</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://it-notes.dragas.net/2024/01/18/installing-alpine-linux-on-a-freebsd-jail/" rel="nofollow">Alpine on a FreeBSD Jail</a></p>

<hr>

<p><a href="https://git.sr.ht/%7Etomh/dragonflybsd-on-a-laptop/tree/master/item/README.md" rel="nofollow">DragonFly BSD on a Thinkpad T480s</a></p>

<hr>

<p><a href="https://www.tumfatig.net/2024/dealing-with-usb-storage-devices-on-omnios/" rel="nofollow">Dealing with USB Storage devices on OmniOS</a></p>

<hr>

<p><a href="https://dan.langille.org/2024/01/06/creating-a-time-capsule-instance-using-samba-freebsd-and-zfs-2/" rel="nofollow">Creating a Time Capsule instance using Samba, FreeBSD, and ZFS</a></p>

<hr>

<h2>Conferences</h2>

<p><a href="https://fosdem.org/2024/" rel="nofollow">FOSDEM</a></p>

<p><a href="https://2024.asiabsdcon.org/program.html" rel="nofollow">AsiaBSDCon</a></p>

<p><a href="https://www.bsdcan.org/2024/papers.php" rel="nofollow">BSDCan</a></p>

<p><a href="https://2024.eurobsdcon.org/" rel="nofollow">EuroBSDcon</a></p>

<p><a href="https://southeastlinuxfest.org/2024/01/self-2024-call-for-participation/" rel="nofollow">Southeast Linuxfest</a></p>

<ul>
<li>Dont let the name fool you, SELF is BSD friendly and they&#39;d love to have BSD/Unix Talks if you&#39;re in the area. JT is staff at SELF, so he can put in a good word for you. ;)</li>
</ul>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>543: OpenBSD Workstation Hardening</title>
  <link>https://www.bsdnow.tv/543</link>
  <guid isPermaLink="false">caf89436-cf84-432e-a1cd-a88fc3385198</guid>
  <pubDate>Thu, 25 Jan 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/caf89436-cf84-432e-a1cd-a88fc3385198.mp3" length="56984832" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs, 2023 in Review: Continuous Integration and Workflow Improvement, Running OpenBSD on OmniOS using bhyve, FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?, OpenBSD workstation hardening, KDE Plasma now linked to packages build on -current, MidnightBSD 3.1.3 release</itunes:subtitle>
  <itunes:duration>59:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs, 2023 in Review: Continuous Integration and Workflow Improvement, Running OpenBSD on OmniOS using bhyve, FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?, OpenBSD workstation hardening, KDE Plasma now linked to packages build on -current, MidnightBSD 3.1.3 release
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs (https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-3-databases-and-vms/)
2023 in Review: Continuous Integration and Workflow Improvement (https://freebsdfoundation.org/blog/continuous-integration-and-workflow-improvement/)
News Roundup
Running OpenBSD on OmniOS using bhyve (https://www.tumfatig.net/2024/running-openbsd-on-omnios-using-bhyve/)
FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory? (https://dan.langille.org/2023/12/25/freebsd-jailed-zfs-datasets-how-do-i-find-the-zfs-snapshot-directory/)
OpenBSD workstation hardening (https://dataswamp.org/~solene/2023-12-31-hardened-openbsd-workstation.html)
KDE Plasma now linked to packages build on -current (https://www.undeadly.org/cgi?action=article;sid=20231227120851&amp;amp;utm_source=bsdweekly)
MidnightBSD 3.1.3 release (https://bsdsec.net/articles/midnightbsd-security-midnightbsd-3-1-3-release)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Kieran - Feedback (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/543/feedback/Kieran%20-%20Feedback.md)
Albin - links inquires questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/543/feedback/Albin%20-%20links%20inquires%20questions.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, best practices, databases, vm, virtual machine, review 2023, continuous integration, workflow improvement, omnios, bhyve, jailed datasets, workstation, hardening, KDE plasma, midnightbsd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs, 2023 in Review: Continuous Integration and Workflow Improvement, Running OpenBSD on OmniOS using bhyve, FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?, OpenBSD workstation hardening, KDE Plasma now linked to packages build on -current, MidnightBSD 3.1.3 release</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-3-databases-and-vms/" rel="nofollow">OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/continuous-integration-and-workflow-improvement/" rel="nofollow">2023 in Review: Continuous Integration and Workflow Improvement</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.tumfatig.net/2024/running-openbsd-on-omnios-using-bhyve/" rel="nofollow">Running OpenBSD on OmniOS using bhyve</a></p>

<hr>

<p><a href="https://dan.langille.org/2023/12/25/freebsd-jailed-zfs-datasets-how-do-i-find-the-zfs-snapshot-directory/" rel="nofollow">FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2023-12-31-hardened-openbsd-workstation.html" rel="nofollow">OpenBSD workstation hardening</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20231227120851&utm_source=bsdweekly" rel="nofollow">KDE Plasma now linked to packages build on -current</a></p>

<hr>

<p><a href="https://bsdsec.net/articles/midnightbsd-security-midnightbsd-3-1-3-release" rel="nofollow">MidnightBSD 3.1.3 release</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/543/feedback/Kieran%20-%20Feedback.md" rel="nofollow">Kieran - Feedback</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/543/feedback/Albin%20-%20links%20inquires%20questions.md" rel="nofollow">Albin - links inquires questions</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs, 2023 in Review: Continuous Integration and Workflow Improvement, Running OpenBSD on OmniOS using bhyve, FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?, OpenBSD workstation hardening, KDE Plasma now linked to packages build on -current, MidnightBSD 3.1.3 release</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-3-databases-and-vms/" rel="nofollow">OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs</a></p>

<hr>

<p><a href="https://freebsdfoundation.org/blog/continuous-integration-and-workflow-improvement/" rel="nofollow">2023 in Review: Continuous Integration and Workflow Improvement</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://www.tumfatig.net/2024/running-openbsd-on-omnios-using-bhyve/" rel="nofollow">Running OpenBSD on OmniOS using bhyve</a></p>

<hr>

<p><a href="https://dan.langille.org/2023/12/25/freebsd-jailed-zfs-datasets-how-do-i-find-the-zfs-snapshot-directory/" rel="nofollow">FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?</a></p>

<hr>

<p><a href="https://dataswamp.org/%7Esolene/2023-12-31-hardened-openbsd-workstation.html" rel="nofollow">OpenBSD workstation hardening</a></p>

<hr>

<p><a href="https://www.undeadly.org/cgi?action=article;sid=20231227120851&utm_source=bsdweekly" rel="nofollow">KDE Plasma now linked to packages build on -current</a></p>

<hr>

<p><a href="https://bsdsec.net/articles/midnightbsd-security-midnightbsd-3-1-3-release" rel="nofollow">MidnightBSD 3.1.3 release</a></p>

<hr>

<h2>Tarsnap</h2>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/543/feedback/Kieran%20-%20Feedback.md" rel="nofollow">Kieran - Feedback</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/543/feedback/Albin%20-%20links%20inquires%20questions.md" rel="nofollow">Albin - links inquires questions</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>542: Retro and Futuro</title>
  <link>https://www.bsdnow.tv/542</link>
  <guid isPermaLink="false">3bd8cfd6-d858-4eb9-951b-64cfe52da80f</guid>
  <pubDate>Thu, 18 Jan 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3bd8cfd6-d858-4eb9-951b-64cfe52da80f.mp3" length="51057024" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>8 Open Source Trends to Keep an Eye Out for in 2024</itunes:subtitle>
  <itunes:duration>53:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>8 Open Source Trends to Keep an Eye Out for in 2024, System Design
for Advanced Beginners, 2024 plans and 2023 retrospective, Upgrading from NetBSD 5.1 to 10*RC1, FreeBSD has a new C compiler: Oracle Developer Studio 12.6, Ctrl+Alt Museum
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
8 Open Source Trends to Keep an Eye Out for in 2024 (https://klarasystems.com/articles/8-open-source-trends-to-keep-an-eye-out-for-in-2024/)
System Design for Advanced Beginners (https://robertheaton.com/2020/04/06/systems-design-for-advanced-beginners/)
News Roundup
2024 plans and 2023 retrospective (https://dataswamp.org/~solene/2024-01-09-plans-for-2024.html)
Upgrading from NetBSD 5.1 to 10_RC1 (https://www.idatum.net/upgrading-from-netbsd-51-to-10_rc1.html)
FreeBSD has a new C compiler: Oracle Developer Studio 12.6 (https://briancallahan.net/blog/20240101.html)
Ctrl+Alt Museum (https://photos.google.com/share/AF1QipMTsm7-LbZ-EiFh4xctppvVbBg_IhOPLTu4ej3fc7gWNgg6nHAUlBEK67-AD_tTsA?pli=1&amp;amp;key=N3dLRWlWVUpUY0RfNU1nb2VxYWUzRDdNek5DU2hn)
Beastie Bits
Taylor's Hackerstation (https://hackerstations.com/setups/taylor_town/)
An Empirical Study of the Reliability of UNIX Utilities (https://sigwait.org/~alex/blog/2022/09/11/fuzz.pdf)
BSD on Windows: Things I wish I knew existed (https://virtuallyfun.com/2023/12/08/bsd-on-windows-things-i-wish-i-knew-existed/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, trends, system design, advanced beginners, retrospective, netBSD 5.1, oracle developer studio, ctrl, alt, museum</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>8 Open Source Trends to Keep an Eye Out for in 2024, System Design<br>
for Advanced Beginners, 2024 plans and 2023 retrospective, Upgrading from NetBSD 5.1 to 10*RC1, FreeBSD has a new C compiler: Oracle Developer Studio 12.6, Ctrl+Alt Museum</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/8-open-source-trends-to-keep-an-eye-out-for-in-2024/" rel="nofollow">8 Open Source Trends to Keep an Eye Out for in 2024</a></p>

<hr>

<p><a href="https://robertheaton.com/2020/04/06/systems-design-for-advanced-beginners/" rel="nofollow">System Design for Advanced Beginners</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dataswamp.org/%7Esolene/2024-01-09-plans-for-2024.html" rel="nofollow">2024 plans and 2023 retrospective</a></p>

<hr>

<p><a href="https://www.idatum.net/upgrading-from-netbsd-51-to-10_rc1.html" rel="nofollow">Upgrading from NetBSD 5.1 to 10_RC1</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20240101.html" rel="nofollow">FreeBSD has a new C compiler: Oracle Developer Studio 12.6</a></p>

<hr>

<p><a href="https://photos.google.com/share/AF1QipMTsm7-LbZ-EiFh4xctppvVbBg_IhOPLTu4ej3fc7gWNgg6nHAUlBEK67-AD_tTsA?pli=1&key=N3dLRWlWVUpUY0RfNU1nb2VxYWUzRDdNek5DU2hn" rel="nofollow">Ctrl+Alt Museum</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://hackerstations.com/setups/taylor_town/" rel="nofollow">Taylor&#39;s Hackerstation</a></li>
<li><a href="https://sigwait.org/%7Ealex/blog/2022/09/11/fuzz.pdf" rel="nofollow">An Empirical Study of the Reliability of UNIX Utilities</a></li>
<li><a href="https://virtuallyfun.com/2023/12/08/bsd-on-windows-things-i-wish-i-knew-existed/" rel="nofollow">BSD on Windows: Things I wish I knew existed</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>8 Open Source Trends to Keep an Eye Out for in 2024, System Design<br>
for Advanced Beginners, 2024 plans and 2023 retrospective, Upgrading from NetBSD 5.1 to 10*RC1, FreeBSD has a new C compiler: Oracle Developer Studio 12.6, Ctrl+Alt Museum</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<p><a href="https://klarasystems.com/articles/8-open-source-trends-to-keep-an-eye-out-for-in-2024/" rel="nofollow">8 Open Source Trends to Keep an Eye Out for in 2024</a></p>

<hr>

<p><a href="https://robertheaton.com/2020/04/06/systems-design-for-advanced-beginners/" rel="nofollow">System Design for Advanced Beginners</a></p>

<hr>

<h2>News Roundup</h2>

<p><a href="https://dataswamp.org/%7Esolene/2024-01-09-plans-for-2024.html" rel="nofollow">2024 plans and 2023 retrospective</a></p>

<hr>

<p><a href="https://www.idatum.net/upgrading-from-netbsd-51-to-10_rc1.html" rel="nofollow">Upgrading from NetBSD 5.1 to 10_RC1</a></p>

<hr>

<p><a href="https://briancallahan.net/blog/20240101.html" rel="nofollow">FreeBSD has a new C compiler: Oracle Developer Studio 12.6</a></p>

<hr>

<p><a href="https://photos.google.com/share/AF1QipMTsm7-LbZ-EiFh4xctppvVbBg_IhOPLTu4ej3fc7gWNgg6nHAUlBEK67-AD_tTsA?pli=1&key=N3dLRWlWVUpUY0RfNU1nb2VxYWUzRDdNek5DU2hn" rel="nofollow">Ctrl+Alt Museum</a></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://hackerstations.com/setups/taylor_town/" rel="nofollow">Taylor&#39;s Hackerstation</a></li>
<li><a href="https://sigwait.org/%7Ealex/blog/2022/09/11/fuzz.pdf" rel="nofollow">An Empirical Study of the Reliability of UNIX Utilities</a></li>
<li><a href="https://virtuallyfun.com/2023/12/08/bsd-on-windows-things-i-wish-i-knew-existed/" rel="nofollow">BSD on Windows: Things I wish I knew existed</a></li>
</ul>

<hr>

<h2>Tarsnap</h2>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>541: Learning and Teaching</title>
  <link>https://www.bsdnow.tv/541</link>
  <guid isPermaLink="false">f5a7d325-6881-48ae-8f15-27943f5b09af</guid>
  <pubDate>Thu, 11 Jan 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f5a7d325-6881-48ae-8f15-27943f5b09af.mp3" length="53020800" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Security, Performance, and Interoperability; Introducing FreeBSD 14, HardenedBSD November 2023 Status Report, How to create a FreeBSD Jail hosting a remote desktop, A sneak Peak, Programming FreeBSD Reading Process Information, Why Unix kernels have grown caches for directory entries 'name caches', Always learning, Always Teaching</itunes:subtitle>
  <itunes:duration>55:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Security, Performance, and Interoperability; Introducing FreeBSD 14, HardenedBSD November 2023 Status Report, How to create a FreeBSD Jail hosting a remote desktop, A sneak Peak, Programming FreeBSD Reading Process Information, Why Unix kernels have grown caches for directory entries 'name caches', Always learning, Always Teaching
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Security, Performance, and Interoperability; Introducing FreeBSD 14 (https://freebsdfoundation.org/blog/security-performance-and-interoperability-introducing-freebsd-14/)
HardenedBSD November 2023 Status Report (https://hardenedbsd.org/article/shawn-webb/2023-12-01/hardenedbsd-november-2023-status-report)
News Roundup
How to create a FreeBSD Jail hosting a remote desktop (https://it-notes.dragas.net/2023/12/13/how-to-create-a-freebsd-jail-hosting-xrdp-and-xfce-remote-access-desktop/)
A sneak Peak (https://freebsdfoundation.org/blog/a-sneak-peek-simd-enhanced-string-functions-for-amd64/)
Programming FreeBSD Reading Process Information (https://patmaddox.com/doc/trunk/www/programming-freebsd-reading-process-information/)
Why Unix kernels have grown caches for directory entries 'name caches' (https://utcc.utoronto.ca/~cks/space/blog/unix/KernelNameCachesWhy)
Always learning, Always Teaching (https://stephango.com/always-learning-always-teaching)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, security, performance, Interoperability, status report, hardenedbsd, remote desktop, jail hosting, sneak peak, process, information, programming, caches, name cache, learning, teaching</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Security, Performance, and Interoperability; Introducing FreeBSD 14, HardenedBSD November 2023 Status Report, How to create a FreeBSD Jail hosting a remote desktop, A sneak Peak, Programming FreeBSD Reading Process Information, Why Unix kernels have grown caches for directory entries &#39;name caches&#39;, Always learning, Always Teaching</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/security-performance-and-interoperability-introducing-freebsd-14/" rel="nofollow">Security, Performance, and Interoperability; Introducing FreeBSD 14</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2023-12-01/hardenedbsd-november-2023-status-report" rel="nofollow">HardenedBSD November 2023 Status Report</a></h3>

<hr>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://it-notes.dragas.net/2023/12/13/how-to-create-a-freebsd-jail-hosting-xrdp-and-xfce-remote-access-desktop/" rel="nofollow">How to create a FreeBSD Jail hosting a remote desktop</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/a-sneak-peek-simd-enhanced-string-functions-for-amd64/" rel="nofollow">A sneak Peak</a></h3>

<hr>

<h3><a href="https://patmaddox.com/doc/trunk/www/programming-freebsd-reading-process-information/" rel="nofollow">Programming FreeBSD Reading Process Information</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/KernelNameCachesWhy" rel="nofollow">Why Unix kernels have grown caches for directory entries &#39;name caches&#39;</a></h3>

<hr>

<h3><a href="https://stephango.com/always-learning-always-teaching" rel="nofollow">Always learning, Always Teaching</a></h3>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Security, Performance, and Interoperability; Introducing FreeBSD 14, HardenedBSD November 2023 Status Report, How to create a FreeBSD Jail hosting a remote desktop, A sneak Peak, Programming FreeBSD Reading Process Information, Why Unix kernels have grown caches for directory entries &#39;name caches&#39;, Always learning, Always Teaching</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/security-performance-and-interoperability-introducing-freebsd-14/" rel="nofollow">Security, Performance, and Interoperability; Introducing FreeBSD 14</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2023-12-01/hardenedbsd-november-2023-status-report" rel="nofollow">HardenedBSD November 2023 Status Report</a></h3>

<hr>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://it-notes.dragas.net/2023/12/13/how-to-create-a-freebsd-jail-hosting-xrdp-and-xfce-remote-access-desktop/" rel="nofollow">How to create a FreeBSD Jail hosting a remote desktop</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/a-sneak-peek-simd-enhanced-string-functions-for-amd64/" rel="nofollow">A sneak Peak</a></h3>

<hr>

<h3><a href="https://patmaddox.com/doc/trunk/www/programming-freebsd-reading-process-information/" rel="nofollow">Programming FreeBSD Reading Process Information</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/KernelNameCachesWhy" rel="nofollow">Why Unix kernels have grown caches for directory entries &#39;name caches&#39;</a></h3>

<hr>

<h3><a href="https://stephango.com/always-learning-always-teaching" rel="nofollow">Always learning, Always Teaching</a></h3>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>540: Terrapin Attacks SSH</title>
  <link>https://www.bsdnow.tv/540</link>
  <guid isPermaLink="false">4f2e9d92-a578-459d-a42d-5d8e1d83db1c</guid>
  <pubDate>Thu, 04 Jan 2024 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4f2e9d92-a578-459d-a42d-5d8e1d83db1c.mp3" length="51090432" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Terrapin Attack, SSH Hardening with ssh-audit, MidnightBSD 3.1.2, syscall(2) removed from -current, 2024 FreeBSD Community Survey is Here</itunes:subtitle>
  <itunes:duration>53:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Terrapin Attack, SSH Hardening with ssh-audit, MidnightBSD 3.1.2, syscall(2) removed from -current, 2024 FreeBSD Community Survey is Here
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Terrapin Attack (https://terrapin-attack.com)
OpenSSH 9.6 is out (https://undeadly.org/cgi?action=article;sid=20231219122431)
OpenBSD Patches (https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/011_ssh.patch.sig)
FreeBSD Patches (https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc)
If anyone is aware of NetBSD Patches, please send them into the show so I can update the show notes
SSH Hardening with ssh-audit (https://thoughts.greyh.at/posts/ssh-audit/)
News Roundup
MidnightBSD 3.1.2 (https://bsdsec.net/articles/midnightbsd-security-midnightbsd-3-1-2)
syscall(2) removed from -current (https://undeadly.org/cgi?action=article;sid=20231213062827)
2024 FreeBSD Community Survey is Here (https://freebsdfoundation.org/blog/2024-freebsd-community-survey-is-here/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
(Markus - how to verify FreeBSD deliverables](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/Markus%20-%20how%20to%20verify%20FreeBSD%20deliverables.md)
(neb - tui](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/neb%20-%20tui.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, terrapin, attack, ssh, crypto, hardening, ssh-audit, midnightbsd 3.1.2, syscall, community survey</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Terrapin Attack, SSH Hardening with ssh-audit, MidnightBSD 3.1.2, syscall(2) removed from -current, 2024 FreeBSD Community Survey is Here</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://terrapin-attack.com" rel="nofollow">Terrapin Attack</a></h3>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20231219122431" rel="nofollow">OpenSSH 9.6 is out</a></li>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/011_ssh.patch.sig" rel="nofollow">OpenBSD Patches</a></li>
<li><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc" rel="nofollow">FreeBSD Patches</a></li>
<li><em>If anyone is aware of NetBSD Patches, please send them into the show so I can update the show notes</em></li>
</ul>

<hr>

<h3><a href="https://thoughts.greyh.at/posts/ssh-audit/" rel="nofollow">SSH Hardening with ssh-audit</a></h3>

<hr>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://bsdsec.net/articles/midnightbsd-security-midnightbsd-3-1-2" rel="nofollow">MidnightBSD 3.1.2</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20231213062827" rel="nofollow">syscall(2) removed from -current</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/2024-freebsd-community-survey-is-here/" rel="nofollow">2024 FreeBSD Community Survey is Here</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>(Markus - how to verify FreeBSD deliverables](<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/Markus%20-%20how%20to%20verify%20FreeBSD%20deliverables.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/Markus%20-%20how%20to%20verify%20FreeBSD%20deliverables.md</a>)</li>
<li>(neb - tui](<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/neb%20-%20tui.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/neb%20-%20tui.md</a>)</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Terrapin Attack, SSH Hardening with ssh-audit, MidnightBSD 3.1.2, syscall(2) removed from -current, 2024 FreeBSD Community Survey is Here</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://terrapin-attack.com" rel="nofollow">Terrapin Attack</a></h3>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20231219122431" rel="nofollow">OpenSSH 9.6 is out</a></li>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/011_ssh.patch.sig" rel="nofollow">OpenBSD Patches</a></li>
<li><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc" rel="nofollow">FreeBSD Patches</a></li>
<li><em>If anyone is aware of NetBSD Patches, please send them into the show so I can update the show notes</em></li>
</ul>

<hr>

<h3><a href="https://thoughts.greyh.at/posts/ssh-audit/" rel="nofollow">SSH Hardening with ssh-audit</a></h3>

<hr>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://bsdsec.net/articles/midnightbsd-security-midnightbsd-3-1-2" rel="nofollow">MidnightBSD 3.1.2</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20231213062827" rel="nofollow">syscall(2) removed from -current</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/2024-freebsd-community-survey-is-here/" rel="nofollow">2024 FreeBSD Community Survey is Here</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>(Markus - how to verify FreeBSD deliverables](<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/Markus%20-%20how%20to%20verify%20FreeBSD%20deliverables.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/Markus%20-%20how%20to%20verify%20FreeBSD%20deliverables.md</a>)</li>
<li>(neb - tui](<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/neb%20-%20tui.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/neb%20-%20tui.md</a>)</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>539: Query all hosts</title>
  <link>https://www.bsdnow.tv/539</link>
  <guid isPermaLink="false">c8786993-f9f3-4b3d-814f-b7396ee2b050</guid>
  <pubDate>Thu, 28 Dec 2023 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c8786993-f9f3-4b3d-814f-b7396ee2b050.mp3" length="57280128" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this special holiday episode, we, the BSDNow hosts, get together to answer questions that listeners have sent us over time. We give you updates on our gear, books we read, favorite places, and a whole lot more. Enjoy!</itunes:subtitle>
  <itunes:duration>59:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this special holiday episode, we, the BSDNow hosts, get together to answer questions that listeners have sent us over time. We give you updates on our gear, books we read, favorite places, and a whole lot more. Enjoy!
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, special</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this special holiday episode, we, the BSDNow hosts, get together to answer questions that listeners have sent us over time. We give you updates on our gear, books we read, favorite places, and a whole lot more. Enjoy!</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this special holiday episode, we, the BSDNow hosts, get together to answer questions that listeners have sent us over time. We give you updates on our gear, books we read, favorite places, and a whole lot more. Enjoy!</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>538: Gadget Catalog Age</title>
  <link>https://www.bsdnow.tv/538</link>
  <guid isPermaLink="false">52d8cc20-79da-4a6e-969c-84b4cc973a56</guid>
  <pubDate>Thu, 21 Dec 2023 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/52d8cc20-79da-4a6e-969c-84b4cc973a56.mp3" length="39395712" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>DAK and the Golden Age of Gadget Catalogs, FreeBSD 13.2 upgrade to 14.0, Running OpenBSD on Raspberry Pi Zero 2 W, Netgate Releases pfSense CE Software Version 2.7.1, SSH agent forwarding and tmux done right, Some explanations about OpenBSD memory usage, and more</itunes:subtitle>
  <itunes:duration>41:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>DAK and the Golden Age of Gadget Catalogs, FreeBSD 13.2 upgrade to 14.0, Running OpenBSD on Raspberry Pi Zero 2 W, Netgate Releases pfSense CE Software Version 2.7.1, SSH agent forwarding and tmux done right, Some explanations about OpenBSD memory usage, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
DAK and the Golden Age of Gadget Catalogs (https://cabel.com/2023/11/06/dak-and-the-golden-age-of-gadget-catalogs/)
FreeBSD 13.2 upgrade to 14.0 – properly detailed and (hopefully) correct way (https://ozgurkazancci.com/freebsd-13-2-upgrade-to-14-0-proper-and-correct-way/)
News Roundup
Running OpenBSD on Raspberry Pi Zero 2 W (https://www.tumfatig.net/2023/running-openbsd-on-raspberry-pi-zero-2-w/)
Netgate Releases pfSense CE Software Version 2.7.1 (https://www.netgate.com/blog/netgate-releases-pfsense-ce-software-version-2.7.1)
SSH agent forwarding and tmux done right (https://jmmv.dev/2023/11/ssh-agent-forwarding-and-tmux-done.html)
Some explanations about OpenBSD memory usage (https://dataswamp.org/~solene/2023-08-11-openbsd-understand-memory-usage.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, DAK, golden age, gadget catalog, system upgrade, raspberry pi zero 2 w, pfsense, agent forwarding, tmux, done right, memory usage</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>DAK and the Golden Age of Gadget Catalogs, FreeBSD 13.2 upgrade to 14.0, Running OpenBSD on Raspberry Pi Zero 2 W, Netgate Releases pfSense CE Software Version 2.7.1, SSH agent forwarding and tmux done right, Some explanations about OpenBSD memory usage, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://cabel.com/2023/11/06/dak-and-the-golden-age-of-gadget-catalogs/" rel="nofollow">DAK and the Golden Age of Gadget Catalogs</a></h3>

<hr>

<h3><a href="https://ozgurkazancci.com/freebsd-13-2-upgrade-to-14-0-proper-and-correct-way/" rel="nofollow">FreeBSD 13.2 upgrade to 14.0 – properly detailed and (hopefully) correct way</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.tumfatig.net/2023/running-openbsd-on-raspberry-pi-zero-2-w/" rel="nofollow">Running OpenBSD on Raspberry Pi Zero 2 W</a></h3>

<hr>

<h3><a href="https://www.netgate.com/blog/netgate-releases-pfsense-ce-software-version-2.7.1" rel="nofollow">Netgate Releases pfSense CE Software Version 2.7.1</a></h3>

<hr>

<h3><a href="https://jmmv.dev/2023/11/ssh-agent-forwarding-and-tmux-done.html" rel="nofollow">SSH agent forwarding and tmux done right</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-08-11-openbsd-understand-memory-usage.html" rel="nofollow">Some explanations about OpenBSD memory usage</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>DAK and the Golden Age of Gadget Catalogs, FreeBSD 13.2 upgrade to 14.0, Running OpenBSD on Raspberry Pi Zero 2 W, Netgate Releases pfSense CE Software Version 2.7.1, SSH agent forwarding and tmux done right, Some explanations about OpenBSD memory usage, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://cabel.com/2023/11/06/dak-and-the-golden-age-of-gadget-catalogs/" rel="nofollow">DAK and the Golden Age of Gadget Catalogs</a></h3>

<hr>

<h3><a href="https://ozgurkazancci.com/freebsd-13-2-upgrade-to-14-0-proper-and-correct-way/" rel="nofollow">FreeBSD 13.2 upgrade to 14.0 – properly detailed and (hopefully) correct way</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.tumfatig.net/2023/running-openbsd-on-raspberry-pi-zero-2-w/" rel="nofollow">Running OpenBSD on Raspberry Pi Zero 2 W</a></h3>

<hr>

<h3><a href="https://www.netgate.com/blog/netgate-releases-pfsense-ce-software-version-2.7.1" rel="nofollow">Netgate Releases pfSense CE Software Version 2.7.1</a></h3>

<hr>

<h3><a href="https://jmmv.dev/2023/11/ssh-agent-forwarding-and-tmux-done.html" rel="nofollow">SSH agent forwarding and tmux done right</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-08-11-openbsd-understand-memory-usage.html" rel="nofollow">Some explanations about OpenBSD memory usage</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>537: Authentic SSH Host</title>
  <link>https://www.bsdnow.tv/537</link>
  <guid isPermaLink="false">e7c69b69-7499-4f5f-bc76-c7c76b266218</guid>
  <pubDate>Thu, 14 Dec 2023 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e7c69b69-7499-4f5f-bc76-c7c76b266218.mp3" length="51144960" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS Storage Best Practices and Use Cases pt 2,  MNT Reform – almost a year on, Why do I know shell, and how can you, Authenticate the SSH servers you are connecting to, dsynth in DragonFly, Navigating around in shell, and more</itunes:subtitle>
  <itunes:duration>53:16</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS Storage Best Practices and Use Cases pt 2,  MNT Reform – almost a year on, Why do I know shell, and how can you, Authenticate the SSH servers you are connecting to, dsynth in DragonFly, Navigating around in shell, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenZFS Storage Best Practices and Use Cases – Part 2: File Serving and SANs (https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-2-file-serving-and-sans/)
My MNT Reform – almost a year on (https://www.geeklan.co.uk/?p=3215)
News Roundup
Why do I know shell, and how can you? (https://jmmv.dev/2023/11/why-do-i-know-shell-and-how-can-you.html)
Authenticate the SSH servers you are connecting to (https://dataswamp.org/~solene/2023-08-05-sshfp-dns-entries.html)
dsynth in DragonFly (https://www.dragonflydigest.com/2023/11/30/dsynth-in-dragonfly/)
Navigating around in shell (https://blog.meain.io/2023/navigating-around-in-shell/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - jail manager questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/537/feedback/Brad%20-%20jail%20manager%20questions.md)
Jail manager comparison: https://appjail.readthedocs.io/en/latest/compare/
nixbytes - sharing a link.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/537/feedback/nixbytes%20-%20sharing%20a%20link.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, best practices, use case, mnt reform, learn, authenticate, ssh, host, synth, navigation</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS Storage Best Practices and Use Cases pt 2,  MNT Reform – almost a year on, Why do I know shell, and how can you, Authenticate the SSH servers you are connecting to, dsynth in DragonFly, Navigating around in shell, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-2-file-serving-and-sans/" rel="nofollow">OpenZFS Storage Best Practices and Use Cases – Part 2: File Serving and SANs</a></h3>

<hr>

<h3><a href="https://www.geeklan.co.uk/?p=3215" rel="nofollow">My MNT Reform – almost a year on</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jmmv.dev/2023/11/why-do-i-know-shell-and-how-can-you.html" rel="nofollow">Why do I know shell, and how can you?</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-08-05-sshfp-dns-entries.html" rel="nofollow">Authenticate the SSH servers you are connecting to</a></h3>

<hr>

<h3><a href="https://www.dragonflydigest.com/2023/11/30/dsynth-in-dragonfly/" rel="nofollow">dsynth in DragonFly</a></h3>

<hr>

<h3><a href="https://blog.meain.io/2023/navigating-around-in-shell/" rel="nofollow">Navigating around in shell</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/537/feedback/Brad%20-%20jail%20manager%20questions.md" rel="nofollow">Brad - jail manager questions</a>
Jail manager comparison: <a href="https://appjail.readthedocs.io/en/latest/compare/" rel="nofollow">https://appjail.readthedocs.io/en/latest/compare/</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/537/feedback/nixbytes%20-%20sharing%20a%20link.md" rel="nofollow">nixbytes - sharing a link.md</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS Storage Best Practices and Use Cases pt 2,  MNT Reform – almost a year on, Why do I know shell, and how can you, Authenticate the SSH servers you are connecting to, dsynth in DragonFly, Navigating around in shell, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-2-file-serving-and-sans/" rel="nofollow">OpenZFS Storage Best Practices and Use Cases – Part 2: File Serving and SANs</a></h3>

<hr>

<h3><a href="https://www.geeklan.co.uk/?p=3215" rel="nofollow">My MNT Reform – almost a year on</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jmmv.dev/2023/11/why-do-i-know-shell-and-how-can-you.html" rel="nofollow">Why do I know shell, and how can you?</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-08-05-sshfp-dns-entries.html" rel="nofollow">Authenticate the SSH servers you are connecting to</a></h3>

<hr>

<h3><a href="https://www.dragonflydigest.com/2023/11/30/dsynth-in-dragonfly/" rel="nofollow">dsynth in DragonFly</a></h3>

<hr>

<h3><a href="https://blog.meain.io/2023/navigating-around-in-shell/" rel="nofollow">Navigating around in shell</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/537/feedback/Brad%20-%20jail%20manager%20questions.md" rel="nofollow">Brad - jail manager questions</a>
Jail manager comparison: <a href="https://appjail.readthedocs.io/en/latest/compare/" rel="nofollow">https://appjail.readthedocs.io/en/latest/compare/</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/537/feedback/nixbytes%20-%20sharing%20a%20link.md" rel="nofollow">nixbytes - sharing a link.md</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>536: Pot-flavored Jails</title>
  <link>https://www.bsdnow.tv/536</link>
  <guid isPermaLink="false">73f0f425-12a1-4b7c-91c4-fa43cb3c7f12</guid>
  <pubDate>Thu, 07 Dec 2023 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/73f0f425-12a1-4b7c-91c4-fa43cb3c7f12.mp3" length="49751808" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS Storage Best Practices and Use Cases, EuroBSDcon trip report, Disks from the Perspective of a File System, Creating Jails using flavours in pot, OpenIKED 7.3 released, OpenSMTPD 7.4.0p1 Released, FreeBSD can now boot in 25 milliseconds, and more</itunes:subtitle>
  <itunes:duration>51:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS Storage Best Practices and Use Cases, EuroBSDcon trip report, Disks from the Perspective of a File System, Creating Jails using flavours in pot, OpenIKED 7.3 released, OpenSMTPD 7.4.0p1 Released, FreeBSD can now boot in 25 milliseconds, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenZFS Storage Best Practices and Use Cases - Part 1: Snapshots and Backups (https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-1-snapshots-and-backups/)
EuroBSDCon 2023 report (1/2) – arrival &amp;amp; tutorial days (https://eerielinux.wordpress.com/2023/09/20/eurobsdcon-2023-report-1-2-arrival-tutorial-days/)
EuroBSDCon 2023 report (2/2) – Main conference, social event &amp;amp; conclusion (https://eerielinux.wordpress.com/2023/10/15/eurobsdcon-2023-report-2-2-main-conference-social-event-conclusion/)
News Roundup
Disks from the Perspective of a File System (https://dl.acm.org/doi/10.1145/2367376.2367378)
OpenIKED 7.3 released (https://marc.info/?l=openbsd-announce&amp;amp;m=170042964022226&amp;amp;w=2)
OpenSMTPD 7.4.0p1 Released (https://marc.info/?l=openbsd-announce&amp;amp;m=170012963318854&amp;amp;w=2)
FreeBSD – Creating Jails using flavours in pot (https://byte-sized.de/linux-unix/freebsd-jails-mithilfe-von-flavours-in-pot-erstellen/#english)
FreeBSD can now boot in 25 milliseconds (https://www.theregister.com/2023/08/29/freebsd_boots_in_25ms/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS Storage Best Practices and Use Cases, EuroBSDcon trip report, Disks from the Perspective of a File System, Creating Jails using flavours in pot, OpenIKED 7.3 released, OpenSMTPD 7.4.0p1 Released, FreeBSD can now boot in 25 milliseconds, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-1-snapshots-and-backups/" rel="nofollow">OpenZFS Storage Best Practices and Use Cases - Part 1: Snapshots and Backups</a></h3>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2023/09/20/eurobsdcon-2023-report-1-2-arrival-tutorial-days/" rel="nofollow">EuroBSDCon 2023 report (1/2) – arrival &amp; tutorial days</a></h3>

<h3><a href="https://eerielinux.wordpress.com/2023/10/15/eurobsdcon-2023-report-2-2-main-conference-social-event-conclusion/" rel="nofollow">EuroBSDCon 2023 report (2/2) – Main conference, social event &amp; conclusion</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dl.acm.org/doi/10.1145/2367376.2367378" rel="nofollow">Disks from the Perspective of a File System</a></h3>

<hr>

<h3><a href="https://marc.info/?l=openbsd-announce&m=170042964022226&w=2" rel="nofollow">OpenIKED 7.3 released</a></h3>

<hr>

<h3><a href="https://marc.info/?l=openbsd-announce&m=170012963318854&w=2" rel="nofollow">OpenSMTPD 7.4.0p1 Released</a></h3>

<hr>

<h3><a href="https://byte-sized.de/linux-unix/freebsd-jails-mithilfe-von-flavours-in-pot-erstellen/#english" rel="nofollow">FreeBSD – Creating Jails using flavours in pot</a></h3>

<hr>

<h3><a href="https://www.theregister.com/2023/08/29/freebsd_boots_in_25ms/" rel="nofollow">FreeBSD can now boot in 25 milliseconds</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS Storage Best Practices and Use Cases, EuroBSDcon trip report, Disks from the Perspective of a File System, Creating Jails using flavours in pot, OpenIKED 7.3 released, OpenSMTPD 7.4.0p1 Released, FreeBSD can now boot in 25 milliseconds, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-1-snapshots-and-backups/" rel="nofollow">OpenZFS Storage Best Practices and Use Cases - Part 1: Snapshots and Backups</a></h3>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2023/09/20/eurobsdcon-2023-report-1-2-arrival-tutorial-days/" rel="nofollow">EuroBSDCon 2023 report (1/2) – arrival &amp; tutorial days</a></h3>

<h3><a href="https://eerielinux.wordpress.com/2023/10/15/eurobsdcon-2023-report-2-2-main-conference-social-event-conclusion/" rel="nofollow">EuroBSDCon 2023 report (2/2) – Main conference, social event &amp; conclusion</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dl.acm.org/doi/10.1145/2367376.2367378" rel="nofollow">Disks from the Perspective of a File System</a></h3>

<hr>

<h3><a href="https://marc.info/?l=openbsd-announce&m=170042964022226&w=2" rel="nofollow">OpenIKED 7.3 released</a></h3>

<hr>

<h3><a href="https://marc.info/?l=openbsd-announce&m=170012963318854&w=2" rel="nofollow">OpenSMTPD 7.4.0p1 Released</a></h3>

<hr>

<h3><a href="https://byte-sized.de/linux-unix/freebsd-jails-mithilfe-von-flavours-in-pot-erstellen/#english" rel="nofollow">FreeBSD – Creating Jails using flavours in pot</a></h3>

<hr>

<h3><a href="https://www.theregister.com/2023/08/29/freebsd_boots_in_25ms/" rel="nofollow">FreeBSD can now boot in 25 milliseconds</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>535: Untitled Episode</title>
  <link>https://www.bsdnow.tv/535</link>
  <guid isPermaLink="false">610bc47e-40b5-420b-bfd1-343fadf60a04</guid>
  <pubDate>Thu, 30 Nov 2023 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/610bc47e-40b5-420b-bfd1-343fadf60a04.mp3" length="54371712" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 14 has been released, Reading your RSS feed on FreeBSD, Manipulate PDF files easily with pdftk, clang(1)/llvm updated to version 16 in OpenBSD, NetBSD Security Advisory: multiple vulnerabilities in ftpd(8), and more</itunes:subtitle>
  <itunes:duration>56:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 14 has been released, Reading your RSS feed on FreeBSD, Manipulate PDF files easily with pdftk, clang(1)/llvm updated to version 16 in OpenBSD, NetBSD Security Advisory: multiple vulnerabilities in ftpd(8), and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD 14 (https://www.freebsd.org/releases/14.0R/relnotes/)
• [Quick update](https://www.daemonology.net/blog/2023-11-21-late-breaking-FreeBSD-14-breakage.html)
• [Vermaden’s FreeBSD 14 valuable news] (https://vermaden.wordpress.com/2023/11/17/valuable-freebsd-14-0-release-updates)
News Roundup
Reading your RSS feed on FreeBSD (https://www.ncartron.org/reading-your-rss-feed-on-freebsd.html)
Manipulate PDF files easily with pdftk (https://dataswamp.org/~solene/2023-08-19-pdftk-guide.html)
clang(1)/llvm updated to version 16 (https://www.undeadly.org/cgi?action=article;sid=20231113160314&amp;amp;utm_source=bsdweekly)
NetBSD Security Advisory 2023-007: multiple vulnerabilities in ftpd(8) (https://bsdsec.net/articles/netbsd-security-advisory-2023-007-multiple-vulnerabilities-in-ftpd-8)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - zpool disk allocation questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/535/feedback/Brad%20-%20zpool%20disk%20allocation%20questions.md)
Kevin - shell question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/535/feedback/Kevin%20-%20shell%20question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, freebsd 14, rss, feed, feed reader, pdftk, clang, llvm, security advisory, ftpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 14 has been released, Reading your RSS feed on FreeBSD, Manipulate PDF files easily with pdftk, clang(1)/llvm updated to version 16 in OpenBSD, NetBSD Security Advisory: multiple vulnerabilities in ftpd(8), and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/14.0R/relnotes/" rel="nofollow">FreeBSD 14</a></h3>

<pre><code>• [Quick update](https://www.daemonology.net/blog/2023-11-21-late-breaking-FreeBSD-14-breakage.html)
• [Vermaden’s FreeBSD 14 valuable news] (https://vermaden.wordpress.com/2023/11/17/valuable-freebsd-14-0-release-updates)
</code></pre>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.ncartron.org/reading-your-rss-feed-on-freebsd.html" rel="nofollow">Reading your RSS feed on FreeBSD</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-08-19-pdftk-guide.html" rel="nofollow">Manipulate PDF files easily with pdftk</a></h3>

<hr>

<h3><a href="https://www.undeadly.org/cgi?action=article;sid=20231113160314&utm_source=bsdweekly" rel="nofollow">clang(1)/llvm updated to version 16</a></h3>

<hr>

<h3><a href="https://bsdsec.net/articles/netbsd-security-advisory-2023-007-multiple-vulnerabilities-in-ftpd-8" rel="nofollow">NetBSD Security Advisory 2023-007: multiple vulnerabilities in ftpd(8)</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/535/feedback/Brad%20-%20zpool%20disk%20allocation%20questions.md" rel="nofollow">Brad - zpool disk allocation questions</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/535/feedback/Kevin%20-%20shell%20question.md" rel="nofollow">Kevin - shell question</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 14 has been released, Reading your RSS feed on FreeBSD, Manipulate PDF files easily with pdftk, clang(1)/llvm updated to version 16 in OpenBSD, NetBSD Security Advisory: multiple vulnerabilities in ftpd(8), and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/14.0R/relnotes/" rel="nofollow">FreeBSD 14</a></h3>

<pre><code>• [Quick update](https://www.daemonology.net/blog/2023-11-21-late-breaking-FreeBSD-14-breakage.html)
• [Vermaden’s FreeBSD 14 valuable news] (https://vermaden.wordpress.com/2023/11/17/valuable-freebsd-14-0-release-updates)
</code></pre>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.ncartron.org/reading-your-rss-feed-on-freebsd.html" rel="nofollow">Reading your RSS feed on FreeBSD</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-08-19-pdftk-guide.html" rel="nofollow">Manipulate PDF files easily with pdftk</a></h3>

<hr>

<h3><a href="https://www.undeadly.org/cgi?action=article;sid=20231113160314&utm_source=bsdweekly" rel="nofollow">clang(1)/llvm updated to version 16</a></h3>

<hr>

<h3><a href="https://bsdsec.net/articles/netbsd-security-advisory-2023-007-multiple-vulnerabilities-in-ftpd-8" rel="nofollow">NetBSD Security Advisory 2023-007: multiple vulnerabilities in ftpd(8)</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/535/feedback/Brad%20-%20zpool%20disk%20allocation%20questions.md" rel="nofollow">Brad - zpool disk allocation questions</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/535/feedback/Kevin%20-%20shell%20question.md" rel="nofollow">Kevin - shell question</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>534: Narrow Waisted Internet</title>
  <link>https://www.bsdnow.tv/534</link>
  <guid isPermaLink="false">fe2b5c7a-0dfd-4dfa-8cfd-3bbac48369f0</guid>
  <pubDate>Thu, 23 Nov 2023 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fe2b5c7a-0dfd-4dfa-8cfd-3bbac48369f0.mp3" length="60482304" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Migrating from an Old Linux Server to a New FreeBSD Machine, The Internet Was Designed With a Narrow Waist, The Worst New Guys In History, FreeBSD Jails vs. Docker: A Comparison, Oracle Developer Studio 12.6 on Illumos</itunes:subtitle>
  <itunes:duration>1:03:00</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Migrating from an Old Linux Server to a New FreeBSD Machine, The Internet Was Designed With a Narrow Waist, The Worst New Guys In History, FreeBSD Jails vs. Docker: A Comparison, Oracle Developer Studio 12.6 on Illumos
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Migrating from an Old Linux Server to a New FreeBSD Machine (https://it-notes.dragas.net/2023/10/25/migrating-from-an-old-linux-server-to-a-new-freebsd-machine/)
The Internet Was Designed With a Narrow Waist (https://www.oilshell.org/blog/2022/02/diagrams.html)
The Worst New Guys In History (https://blog.vito.nyc/posts/on-programming/)
News Roundup
FreeBSD Jails vs. Docker: A Comparison (https://justanerds.site/freebsd-jails-vs-docker/)
Installing Oracle Developer Studio 12.6 on Illumos (https://briancallahan.net/blog/20230703.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - Detective work on zpool history (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Brad%20-%20Detective%20work%20on%20zpool%20history.md)
Extrowerk - End of the world type stuff (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Extrowerk%20-%20End%20of%20the%20world%20type%20stuff.md)
Mike - principle of least astonishment (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Mike%20-%20principle%20of%20least%20astonishment.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, migration, internet, design, narrow waist, news guy, worst, history, docker, comparison, oracle developer studio, illumos, pdftk, PDF</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Migrating from an Old Linux Server to a New FreeBSD Machine, The Internet Was Designed With a Narrow Waist, The Worst New Guys In History, FreeBSD Jails vs. Docker: A Comparison, Oracle Developer Studio 12.6 on Illumos</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://it-notes.dragas.net/2023/10/25/migrating-from-an-old-linux-server-to-a-new-freebsd-machine/" rel="nofollow">Migrating from an Old Linux Server to a New FreeBSD Machine</a></h3>

<hr>

<h3><a href="https://www.oilshell.org/blog/2022/02/diagrams.html" rel="nofollow">The Internet Was Designed With a Narrow Waist</a></h3>

<hr>

<h3><a href="https://blog.vito.nyc/posts/on-programming/" rel="nofollow">The Worst New Guys In History</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://justanerds.site/freebsd-jails-vs-docker/" rel="nofollow">FreeBSD Jails vs. Docker: A Comparison</a></h3>

<hr>

<h3><a href="https://briancallahan.net/blog/20230703.html" rel="nofollow">Installing Oracle Developer Studio 12.6 on Illumos</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Brad%20-%20Detective%20work%20on%20zpool%20history.md" rel="nofollow">Brad - Detective work on zpool history</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Extrowerk%20-%20End%20of%20the%20world%20type%20stuff.md" rel="nofollow">Extrowerk - End of the world type stuff</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Mike%20-%20principle%20of%20least%20astonishment.md" rel="nofollow">Mike - principle of least astonishment</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Migrating from an Old Linux Server to a New FreeBSD Machine, The Internet Was Designed With a Narrow Waist, The Worst New Guys In History, FreeBSD Jails vs. Docker: A Comparison, Oracle Developer Studio 12.6 on Illumos</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://it-notes.dragas.net/2023/10/25/migrating-from-an-old-linux-server-to-a-new-freebsd-machine/" rel="nofollow">Migrating from an Old Linux Server to a New FreeBSD Machine</a></h3>

<hr>

<h3><a href="https://www.oilshell.org/blog/2022/02/diagrams.html" rel="nofollow">The Internet Was Designed With a Narrow Waist</a></h3>

<hr>

<h3><a href="https://blog.vito.nyc/posts/on-programming/" rel="nofollow">The Worst New Guys In History</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://justanerds.site/freebsd-jails-vs-docker/" rel="nofollow">FreeBSD Jails vs. Docker: A Comparison</a></h3>

<hr>

<h3><a href="https://briancallahan.net/blog/20230703.html" rel="nofollow">Installing Oracle Developer Studio 12.6 on Illumos</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Brad%20-%20Detective%20work%20on%20zpool%20history.md" rel="nofollow">Brad - Detective work on zpool history</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Extrowerk%20-%20End%20of%20the%20world%20type%20stuff.md" rel="nofollow">Extrowerk - End of the world type stuff</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Mike%20-%20principle%20of%20least%20astonishment.md" rel="nofollow">Mike - principle of least astonishment</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>533: Package the Base</title>
  <link>https://www.bsdnow.tv/533</link>
  <guid isPermaLink="false">932df15a-6bff-4f3d-b9d8-6c477d8da3a7</guid>
  <pubDate>Thu, 16 Nov 2023 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/932df15a-6bff-4f3d-b9d8-6c477d8da3a7.mp3" length="42418944" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD on the RISC-V Architecture, A bit of XENIX history, pkgbase: Official packages, recover lost text by coredumping firefox, FuguIta 7.4 has been released, LibreSSL 3.8.2 Released, OpenSMTPD 7.4.0p0 Released</itunes:subtitle>
  <itunes:duration>44:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD on the RISC-V Architecture, A bit of XENIX history, pkgbase: Official packages, recover lost text by coredumping firefox, FuguIta 7.4 has been released, LibreSSL 3.8.2 Released, OpenSMTPD 7.4.0p0 Released
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Looking Towards the Future: FreeBSD on the RISC-V Architecture (https://klarasystems.com/articles/looking-towards-the-future-freebsd-on-the-risc-v-architecture/)
A bit of XENIX history (http://seefigure1.com/2014/04/15/xenixtime.html)
News Roundup
Official packages (https://lists.freebsd.org/archives/freebsd-pkgbase/2023-October/000221.html)
recover lost text by coredumping firefox (https://j3s.sh/thought/recover-lost-text-by-coredumping-firefox.html)
FuguIta 7.4 has been released (https://fuguita.org/?FuguIta/7.4&amp;amp;utm_source=bsdweekly)
LibreSSL 3.8.2 Released (https://undeadly.org/cgi?action=article;sid=20231103065952)
OpenSMTPD 7.4.0p0 Released (https://undeadly.org/cgi?action=article;sid=20231026121132)
Conference News
AsiaBSDCon 2024 (https://2024.asiabsdcon.org)
BSDCan 2024 (https://www.bsdcan.org)
EuroBSDCon 2024 (https://2024.eurobsdcon.org)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, riscv, xenix, pkgbase, core dump, recover, firefox, fuguita, libressl, opensmtpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD on the RISC-V Architecture, A bit of XENIX history, pkgbase: Official packages, recover lost text by coredumping firefox, FuguIta 7.4 has been released, LibreSSL 3.8.2 Released, OpenSMTPD 7.4.0p0 Released</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/looking-towards-the-future-freebsd-on-the-risc-v-architecture/" rel="nofollow">Looking Towards the Future: FreeBSD on the RISC-V Architecture</a></h3>

<hr>

<h3><a href="http://seefigure1.com/2014/04/15/xenixtime.html" rel="nofollow">A bit of XENIX history</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/archives/freebsd-pkgbase/2023-October/000221.html" rel="nofollow">Official packages</a></h3>

<hr>

<h3><a href="https://j3s.sh/thought/recover-lost-text-by-coredumping-firefox.html" rel="nofollow">recover lost text by coredumping firefox</a></h3>

<hr>

<h3><a href="https://fuguita.org/?FuguIta/7.4&utm_source=bsdweekly" rel="nofollow">FuguIta 7.4 has been released</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20231103065952" rel="nofollow">LibreSSL 3.8.2 Released</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20231026121132" rel="nofollow">OpenSMTPD 7.4.0p0 Released</a></h3>

<hr>

<h2>Conference News</h2>

<h3><a href="https://2024.asiabsdcon.org" rel="nofollow">AsiaBSDCon 2024</a></h3>

<hr>

<h3><a href="https://www.bsdcan.org" rel="nofollow">BSDCan 2024</a></h3>

<hr>

<h3><a href="https://2024.eurobsdcon.org" rel="nofollow">EuroBSDCon 2024</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD on the RISC-V Architecture, A bit of XENIX history, pkgbase: Official packages, recover lost text by coredumping firefox, FuguIta 7.4 has been released, LibreSSL 3.8.2 Released, OpenSMTPD 7.4.0p0 Released</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/looking-towards-the-future-freebsd-on-the-risc-v-architecture/" rel="nofollow">Looking Towards the Future: FreeBSD on the RISC-V Architecture</a></h3>

<hr>

<h3><a href="http://seefigure1.com/2014/04/15/xenixtime.html" rel="nofollow">A bit of XENIX history</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/archives/freebsd-pkgbase/2023-October/000221.html" rel="nofollow">Official packages</a></h3>

<hr>

<h3><a href="https://j3s.sh/thought/recover-lost-text-by-coredumping-firefox.html" rel="nofollow">recover lost text by coredumping firefox</a></h3>

<hr>

<h3><a href="https://fuguita.org/?FuguIta/7.4&utm_source=bsdweekly" rel="nofollow">FuguIta 7.4 has been released</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20231103065952" rel="nofollow">LibreSSL 3.8.2 Released</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20231026121132" rel="nofollow">OpenSMTPD 7.4.0p0 Released</a></h3>

<hr>

<h2>Conference News</h2>

<h3><a href="https://2024.asiabsdcon.org" rel="nofollow">AsiaBSDCon 2024</a></h3>

<hr>

<h3><a href="https://www.bsdcan.org" rel="nofollow">BSDCan 2024</a></h3>

<hr>

<h3><a href="https://2024.eurobsdcon.org" rel="nofollow">EuroBSDCon 2024</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>532:  2^18 dollars sponsorship</title>
  <link>https://www.bsdnow.tv/532</link>
  <guid isPermaLink="false">fb3e426c-683d-4307-9059-e6770baccf3a</guid>
  <pubDate>Thu, 09 Nov 2023 10:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fb3e426c-683d-4307-9059-e6770baccf3a.mp3" length="52249728" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>2^18 dollars to open source, EuroBSDCon 2023 Trip Report, FreeBSD vs Linux (Debian), Introduction to sysclean8, Run your own Syncthing discovery server on OpenBSD, FreeBSD years: 2000-2005, Using OpenBSD relayd(8) as an Application Layer Gateway, and more</itunes:subtitle>
  <itunes:duration>54:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>2^18 dollars to open source, EuroBSDCon 2023 Trip Report, FreeBSD vs Linux (Debian), Introduction to sysclean8, Run your own Syncthing discovery server on OpenBSD, FreeBSD years: 2000-2005, Using OpenBSD relayd(8) as an Application Layer Gateway, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
2^18 dollars to open source (https://www.daemonology.net/blog/2023-10-25-2%5E18-dollars-to-open-source.html)
Special Thanks to Colin for supporting BSD Now for over 10 years!
***
### EuroBSDCon 2023 Trip Report – Bojan Novković (https://freebsdfoundation.org/blog/eurobsdcon-2023-trip-report-bojan-novkovic/)
***
### FreeBSD vs Linux (Debian) (https://markmcb.com/freebsd/vs_linux/)
***
News Roundup
Introduction to sysclean8 (https://www.osnews.com/story/137266/introduction-to-sysclean8-on-openbsd/)
Run your own Syncthing discovery server on OpenBSD (https://dataswamp.org/~solene/2023-10-18-syncthing-discovery-server.html)
My FreeBSD years: 2000-2005 (https://www.cambus.net/my-freebsd-years-2000-2005/)
Using OpenBSD relayd(8) as an Application Layer Gateway (https://www.tumfatig.net/2023/using-openbsd-relayd8-as-an-application-layer-gateway/)
Beastie Bits
How to send syslog messages using command-line utilities (https://sleeplessbeastie.eu/2023/09/11/how-to-send-syslog-messages-using-command-line-utilities/)
A Practical Guide of GNU grep With Examples (https://thevaluable.dev/grep-cli-guide-examples/)
FreeBSD Container VM for Podman (https://github.com/davidchisnall/container-vm-scripts)
User Certbot to create SSL certificates on FreeBSD (https://www.sharpwriting.net/project/use-certbot-to-create-ssl-certificates-on-freebsd/)
OpenBSD's built-in memory leak detection (https://www.undeadly.org/cgi?action=article;sid=20231024064619)
OpenBSD Webzine Issue #15 (https://webzine.puffy.cafe/issue-15.html)
FreeBSD OpenSSL 3.0 ported (https://github.com/FreeBSD/freebsd-ports/commit/d5ec2e12f399b7813994564b77a0915821a0ac42)
Harden FreeBSD Script (https://github.com/wravoc/harden-freebsd)
Something odd happened... (https://mastodon.bsd.cafe/@stefano/111257154132788711)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, dollars, sponsoring, sponsorship, sponsor, eurobsdcon 2023, sysclean8, syncthing, relayd, application layer gateway</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>2<sup>18</sup> dollars to open source, EuroBSDCon 2023 Trip Report, FreeBSD vs Linux (Debian), Introduction to sysclean8, Run your own Syncthing discovery server on OpenBSD, FreeBSD years: 2000-2005, Using OpenBSD relayd(8) as an Application Layer Gateway, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.daemonology.net/blog/2023-10-25-2%5E18-dollars-to-open-source.html" rel="nofollow">2<sup>18</sup> dollars to open source</a></h3>

<ul>
<li>Special Thanks to Colin for supporting BSD Now for over 10 years!
***
### <a href="https://freebsdfoundation.org/blog/eurobsdcon-2023-trip-report-bojan-novkovic/" rel="nofollow">EuroBSDCon 2023 Trip Report – Bojan Novković</a>
***
### <a href="https://markmcb.com/freebsd/vs_linux/" rel="nofollow">FreeBSD vs Linux (Debian)</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.osnews.com/story/137266/introduction-to-sysclean8-on-openbsd/" rel="nofollow">Introduction to sysclean8</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-10-18-syncthing-discovery-server.html" rel="nofollow">Run your own Syncthing discovery server on OpenBSD</a></h3>

<hr>

<h3><a href="https://www.cambus.net/my-freebsd-years-2000-2005/" rel="nofollow">My FreeBSD years: 2000-2005</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2023/using-openbsd-relayd8-as-an-application-layer-gateway/" rel="nofollow">Using OpenBSD relayd(8) as an Application Layer Gateway</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://sleeplessbeastie.eu/2023/09/11/how-to-send-syslog-messages-using-command-line-utilities/" rel="nofollow">How to send syslog messages using command-line utilities</a></li>
<li><a href="https://thevaluable.dev/grep-cli-guide-examples/" rel="nofollow">A Practical Guide of GNU grep With Examples</a></li>
<li><a href="https://github.com/davidchisnall/container-vm-scripts" rel="nofollow">FreeBSD Container VM for Podman</a></li>
<li><a href="https://www.sharpwriting.net/project/use-certbot-to-create-ssl-certificates-on-freebsd/" rel="nofollow">User Certbot to create SSL certificates on FreeBSD</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20231024064619" rel="nofollow">OpenBSD&#39;s built-in memory leak detection</a></li>
<li><a href="https://webzine.puffy.cafe/issue-15.html" rel="nofollow">OpenBSD Webzine Issue #15</a></li>
<li><a href="https://github.com/FreeBSD/freebsd-ports/commit/d5ec2e12f399b7813994564b77a0915821a0ac42" rel="nofollow">FreeBSD OpenSSL 3.0 ported</a></li>
<li><a href="https://github.com/wravoc/harden-freebsd" rel="nofollow">Harden FreeBSD Script</a></li>
<li><a href="https://mastodon.bsd.cafe/@stefano/111257154132788711" rel="nofollow">Something odd happened...</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>2<sup>18</sup> dollars to open source, EuroBSDCon 2023 Trip Report, FreeBSD vs Linux (Debian), Introduction to sysclean8, Run your own Syncthing discovery server on OpenBSD, FreeBSD years: 2000-2005, Using OpenBSD relayd(8) as an Application Layer Gateway, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.daemonology.net/blog/2023-10-25-2%5E18-dollars-to-open-source.html" rel="nofollow">2<sup>18</sup> dollars to open source</a></h3>

<ul>
<li>Special Thanks to Colin for supporting BSD Now for over 10 years!
***
### <a href="https://freebsdfoundation.org/blog/eurobsdcon-2023-trip-report-bojan-novkovic/" rel="nofollow">EuroBSDCon 2023 Trip Report – Bojan Novković</a>
***
### <a href="https://markmcb.com/freebsd/vs_linux/" rel="nofollow">FreeBSD vs Linux (Debian)</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.osnews.com/story/137266/introduction-to-sysclean8-on-openbsd/" rel="nofollow">Introduction to sysclean8</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-10-18-syncthing-discovery-server.html" rel="nofollow">Run your own Syncthing discovery server on OpenBSD</a></h3>

<hr>

<h3><a href="https://www.cambus.net/my-freebsd-years-2000-2005/" rel="nofollow">My FreeBSD years: 2000-2005</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2023/using-openbsd-relayd8-as-an-application-layer-gateway/" rel="nofollow">Using OpenBSD relayd(8) as an Application Layer Gateway</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://sleeplessbeastie.eu/2023/09/11/how-to-send-syslog-messages-using-command-line-utilities/" rel="nofollow">How to send syslog messages using command-line utilities</a></li>
<li><a href="https://thevaluable.dev/grep-cli-guide-examples/" rel="nofollow">A Practical Guide of GNU grep With Examples</a></li>
<li><a href="https://github.com/davidchisnall/container-vm-scripts" rel="nofollow">FreeBSD Container VM for Podman</a></li>
<li><a href="https://www.sharpwriting.net/project/use-certbot-to-create-ssl-certificates-on-freebsd/" rel="nofollow">User Certbot to create SSL certificates on FreeBSD</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20231024064619" rel="nofollow">OpenBSD&#39;s built-in memory leak detection</a></li>
<li><a href="https://webzine.puffy.cafe/issue-15.html" rel="nofollow">OpenBSD Webzine Issue #15</a></li>
<li><a href="https://github.com/FreeBSD/freebsd-ports/commit/d5ec2e12f399b7813994564b77a0915821a0ac42" rel="nofollow">FreeBSD OpenSSL 3.0 ported</a></li>
<li><a href="https://github.com/wravoc/harden-freebsd" rel="nofollow">Harden FreeBSD Script</a></li>
<li><a href="https://mastodon.bsd.cafe/@stefano/111257154132788711" rel="nofollow">Something odd happened...</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>531: Everlasting Software</title>
  <link>https://www.bsdnow.tv/531</link>
  <guid isPermaLink="false">99479afb-bb6c-4471-9eaf-a76999dd513c</guid>
  <pubDate>Thu, 02 Nov 2023 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/99479afb-bb6c-4471-9eaf-a76999dd513c.mp3" length="60355584" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 7.4, Making Software Last Forever, DragonFlyBSD Per-process capability-based restrictions, HardenedBSD September 2023 Status Report, NetBSD as a Kubernetes Pod, Firefox hardening with Arkenfox, and more</itunes:subtitle>
  <itunes:duration>1:02:52</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 7.4, Making Software Last Forever, DragonFlyBSD Per-process capability-based restrictions, HardenedBSD September 2023 Status Report, NetBSD as a Kubernetes Pod, Firefox hardening with Arkenfox, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenBSD 7.4 (https://www.openbsd.org/74.html)
Making Software Last Forever (https://www.danstroot.com/posts/2023-05-25-making_software_last_forever)
News Roundup
DragonFlyBSD Per-process capability-based restrictions (https://lists.dragonflybsd.org/pipermail/commits/2023-October/922780.html)
HardenedBSD September 2023 Status Report (https://hardenedbsd.org/article/shawn-webb/2023-10-10/hardenedbsd-september-2023-status-report)
NetBSD as a Kubernetes Pod (https://imil.net/blog/posts/2023/netbsd-as-a-k8s-pod/)
Firefox hardening with Arkenfox (https://dataswamp.org/~solene/2023-09-24-harden-firefox-with-arkenfox.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
A Random Listener - Other Podcasts (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/A%20Random%20Listener%20-%20Other%20Podcasts.md)
Dante - Thanks (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/Dante%20-%20Thanks.md)
Lars - WEI DRM (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/Lars%20-%20WEI%20DRM.md)
YKLA - transcripts (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/YKLA%20-%20transcripts.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, last forever, per-process, capabilities, restrictions, status report, kubernetes pod, arkenfox</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 7.4, Making Software Last Forever, DragonFlyBSD Per-process capability-based restrictions, HardenedBSD September 2023 Status Report, NetBSD as a Kubernetes Pod, Firefox hardening with Arkenfox, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/74.html" rel="nofollow">OpenBSD 7.4</a></h3>

<hr>

<h3><a href="https://www.danstroot.com/posts/2023-05-25-making_software_last_forever" rel="nofollow">Making Software Last Forever</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lists.dragonflybsd.org/pipermail/commits/2023-October/922780.html" rel="nofollow">DragonFlyBSD Per-process capability-based restrictions</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2023-10-10/hardenedbsd-september-2023-status-report" rel="nofollow">HardenedBSD September 2023 Status Report</a></h3>

<hr>

<h3><a href="https://imil.net/blog/posts/2023/netbsd-as-a-k8s-pod/" rel="nofollow">NetBSD as a Kubernetes Pod</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-09-24-harden-firefox-with-arkenfox.html" rel="nofollow">Firefox hardening with Arkenfox</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/A%20Random%20Listener%20-%20Other%20Podcasts.md" rel="nofollow">A Random Listener - Other Podcasts</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/Dante%20-%20Thanks.md" rel="nofollow">Dante - Thanks</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/Lars%20-%20WEI%20DRM.md" rel="nofollow">Lars - WEI DRM</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/YKLA%20-%20transcripts.md" rel="nofollow">YKLA - transcripts</a>
***</li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 7.4, Making Software Last Forever, DragonFlyBSD Per-process capability-based restrictions, HardenedBSD September 2023 Status Report, NetBSD as a Kubernetes Pod, Firefox hardening with Arkenfox, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/74.html" rel="nofollow">OpenBSD 7.4</a></h3>

<hr>

<h3><a href="https://www.danstroot.com/posts/2023-05-25-making_software_last_forever" rel="nofollow">Making Software Last Forever</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lists.dragonflybsd.org/pipermail/commits/2023-October/922780.html" rel="nofollow">DragonFlyBSD Per-process capability-based restrictions</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2023-10-10/hardenedbsd-september-2023-status-report" rel="nofollow">HardenedBSD September 2023 Status Report</a></h3>

<hr>

<h3><a href="https://imil.net/blog/posts/2023/netbsd-as-a-k8s-pod/" rel="nofollow">NetBSD as a Kubernetes Pod</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-09-24-harden-firefox-with-arkenfox.html" rel="nofollow">Firefox hardening with Arkenfox</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/A%20Random%20Listener%20-%20Other%20Podcasts.md" rel="nofollow">A Random Listener - Other Podcasts</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/Dante%20-%20Thanks.md" rel="nofollow">Dante - Thanks</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/Lars%20-%20WEI%20DRM.md" rel="nofollow">Lars - WEI DRM</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/YKLA%20-%20transcripts.md" rel="nofollow">YKLA - transcripts</a>
***</li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>530: Old Computer Rescue</title>
  <link>https://www.bsdnow.tv/530</link>
  <guid isPermaLink="false">f52a06e2-8680-4641-9d49-6157118d4556</guid>
  <pubDate>Thu, 26 Oct 2023 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f52a06e2-8680-4641-9d49-6157118d4556.mp3" length="52091136" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Implementing a system call for OpenBSD, Self-Hosted Email services on OpenBSD, First 5 Minutes on a New FreeBSD Server, OLD COMPUTER RESCUE - X201, sec(4) for Route Based IPSec VPNs, send syslog messages using command-line utilities, Keeping email sorted (the hard way), and more</itunes:subtitle>
  <itunes:duration>54:15</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Implementing a system call for OpenBSD, Self-Hosted Email services on OpenBSD, First 5 Minutes on a New FreeBSD Server, OLD COMPUTER RESCUE - X201, sec(4) for Route Based IPSec VPNs, send syslog messages using command-line utilities, Keeping email sorted (the hard way), and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Implementing a system call for OpenBSD (https://poolp.org/posts/2023-07-05/implementing-a-system-call-for-openbsd/)
Self-Hosted Email services on OpenBSD (https://www.tumfatig.net/2023/self-hosted-email-services-on-openbsd/)
The First 5 Minutes on a New FreeBSD Server (https://herrbischoff.com/2022/12/the-first-5-minutes-on-a-new-freebsd-server/)
News Roundup
OLD COMPUTER RESCUE - X201 (https://triapul.cz/automa/old-computer-rescue-x201/)
[CFT] sec(4) for Route Based IPSec VPNs (http://undeadly.org/cgi?action=article;sid=20230704094238)
How to send syslog messages using command-line utilities (https://sleeplessbeastie.eu/2023/09/11/how-to-send-syslog-messages-using-command-line-utilities/)
Keeping my email sorted (the hard way) (https://sebastiano.tronto.net/blog/2022-10-19-email-setup/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Albin - Links (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Albin%20-%20Links.md)
Douglas - Best practices (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Douglas%20-%20Best%20practices.md)
Patrick - Ideas Feedback (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Patrick%20-%20Ideas%20Feedback.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, implementing, implementation, system call, self-hosted, email service, first five minutes, old computer, rescue, x201, route based VPN, ipsec, syslog message, email, sorting, sort</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Implementing a system call for OpenBSD, Self-Hosted Email services on OpenBSD, First 5 Minutes on a New FreeBSD Server, OLD COMPUTER RESCUE - X201, sec(4) for Route Based IPSec VPNs, send syslog messages using command-line utilities, Keeping email sorted (the hard way), and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://poolp.org/posts/2023-07-05/implementing-a-system-call-for-openbsd/" rel="nofollow">Implementing a system call for OpenBSD</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2023/self-hosted-email-services-on-openbsd/" rel="nofollow">Self-Hosted Email services on OpenBSD</a></h3>

<hr>

<h3><a href="https://herrbischoff.com/2022/12/the-first-5-minutes-on-a-new-freebsd-server/" rel="nofollow">The First 5 Minutes on a New FreeBSD Server</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://triapul.cz/automa/old-computer-rescue-x201/" rel="nofollow">OLD COMPUTER RESCUE - X201</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230704094238" rel="nofollow">[CFT] sec(4) for Route Based IPSec VPNs</a></h3>

<hr>

<h3><a href="https://sleeplessbeastie.eu/2023/09/11/how-to-send-syslog-messages-using-command-line-utilities/" rel="nofollow">How to send syslog messages using command-line utilities</a></h3>

<hr>

<h3><a href="https://sebastiano.tronto.net/blog/2022-10-19-email-setup/" rel="nofollow">Keeping my email sorted (the hard way)</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Albin%20-%20Links.md" rel="nofollow">Albin - Links</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Douglas%20-%20Best%20practices.md" rel="nofollow">Douglas - Best practices</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Patrick%20-%20Ideas%20Feedback.md" rel="nofollow">Patrick - Ideas Feedback</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Implementing a system call for OpenBSD, Self-Hosted Email services on OpenBSD, First 5 Minutes on a New FreeBSD Server, OLD COMPUTER RESCUE - X201, sec(4) for Route Based IPSec VPNs, send syslog messages using command-line utilities, Keeping email sorted (the hard way), and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://poolp.org/posts/2023-07-05/implementing-a-system-call-for-openbsd/" rel="nofollow">Implementing a system call for OpenBSD</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2023/self-hosted-email-services-on-openbsd/" rel="nofollow">Self-Hosted Email services on OpenBSD</a></h3>

<hr>

<h3><a href="https://herrbischoff.com/2022/12/the-first-5-minutes-on-a-new-freebsd-server/" rel="nofollow">The First 5 Minutes on a New FreeBSD Server</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://triapul.cz/automa/old-computer-rescue-x201/" rel="nofollow">OLD COMPUTER RESCUE - X201</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230704094238" rel="nofollow">[CFT] sec(4) for Route Based IPSec VPNs</a></h3>

<hr>

<h3><a href="https://sleeplessbeastie.eu/2023/09/11/how-to-send-syslog-messages-using-command-line-utilities/" rel="nofollow">How to send syslog messages using command-line utilities</a></h3>

<hr>

<h3><a href="https://sebastiano.tronto.net/blog/2022-10-19-email-setup/" rel="nofollow">Keeping my email sorted (the hard way)</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Albin%20-%20Links.md" rel="nofollow">Albin - Links</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Douglas%20-%20Best%20practices.md" rel="nofollow">Douglas - Best practices</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Patrick%20-%20Ideas%20Feedback.md" rel="nofollow">Patrick - Ideas Feedback</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>529: Adapt, adopt, diffuse</title>
  <link>https://www.bsdnow.tv/529</link>
  <guid isPermaLink="false">cf9c4493-9570-487d-bd01-4c21bef585cd</guid>
  <pubDate>Thu, 19 Oct 2023 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cf9c4493-9570-487d-bd01-4c21bef585cd.mp3" length="59623680" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Adopting FreeBSD as Your Open Source Operating System, How Hard is it to Adapt a Memory Allocator to CHERI, Running Stable Diffusion on FreeBSD, Self-hosting Pixelfed on OpenBSD, Time Capsule instance using Samba, FreeBSD, and ZFS, and more</itunes:subtitle>
  <itunes:duration>1:02:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Adopting FreeBSD as Your Open Source Operating System, How Hard is it to Adapt a Memory Allocator to CHERI, Running Stable Diffusion on FreeBSD, Self-hosting Pixelfed on OpenBSD, Time Capsule instance using Samba, FreeBSD, and ZFS, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Adopting FreeBSD as Your Open Source Operating System: Benefits &amp;amp; Considerations (https://www.javacodegeeks.com/2023/09/adopting-freebsd-as-your-open-source-operating-system-benefits-considerations.html)
How Hard is it to Adapt a Memory Allocator to CHERI (https://tratt.net/laurie/blog/2023/how_hard_is_it_to_adapt_a_memory_allocator_to_cheri.html)
News Roundup
[Running Stable Diffusion on FreeBSD)[https://github.com/verm/freebsd-stable-diffusion)
Self-hosting Pixelfed on OpenBSD (https://www.tumfatig.net/2023/self-hosting-pixelfed-on-openbsd/)
Creating a Time Capsule instance using Samba, FreeBSD, and ZFS (https://dan.langille.org/2023/09/28/creating-a-time-capsule-instance-using-samba-freebsd-and-zfs/)
Beastie Bits
• [OpenZFS on Twitter](https://x.com/openzfs/status/1704212154558324827?s=12&amp;amp;t=-_bfM_adaiX8Ri_3lN9OYw)
• [EuroBSDcon 2023, Portugal](https://m.youtube.com/playlist?list=PLskKNopggjc7s6nAMxKF0tAO77ZIowZdx&amp;amp;cbrd=1)
• [The lost history if Emoticons](https://x.com/rainmaker1973/status/1704006098909352016?s=12&amp;amp;t=-_bfM_adaiX8Ri_3lN9OYw)
• [Solving the same problem](https://blog.fredrb.com/2023/09/08/same-problem-multiple-times/)
• [http://vihart.com/fifty-fizzbuzzes/](50 Fizz buzzes)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Eric - German Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/Eric%20-%20German%20Question.md)
John Baldwin - Ep 520 question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/John%20Baldwin%20-%20Ep%20520%20question.md)
Pat - 3d Printing (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/Pat%20-%203d%20Printing.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, adoption, memory allocator, cheri, stable diffusion, self-hosting, pixelfed, time capsule, samba, smb, server message block</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Adopting FreeBSD as Your Open Source Operating System, How Hard is it to Adapt a Memory Allocator to CHERI, Running Stable Diffusion on FreeBSD, Self-hosting Pixelfed on OpenBSD, Time Capsule instance using Samba, FreeBSD, and ZFS, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.javacodegeeks.com/2023/09/adopting-freebsd-as-your-open-source-operating-system-benefits-considerations.html" rel="nofollow">Adopting FreeBSD as Your Open Source Operating System: Benefits &amp; Considerations</a></h3>

<hr>

<h3><a href="https://tratt.net/laurie/blog/2023/how_hard_is_it_to_adapt_a_memory_allocator_to_cheri.html" rel="nofollow">How Hard is it to Adapt a Memory Allocator to CHERI</a></h3>

<hr>

<h2>News Roundup</h2>

<h3>[Running Stable Diffusion on FreeBSD)[<a href="https://github.com/verm/freebsd-stable-diffusion" rel="nofollow">https://github.com/verm/freebsd-stable-diffusion</a>)</h3>

<hr>

<h3><a href="https://www.tumfatig.net/2023/self-hosting-pixelfed-on-openbsd/" rel="nofollow">Self-hosting Pixelfed on OpenBSD</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2023/09/28/creating-a-time-capsule-instance-using-samba-freebsd-and-zfs/" rel="nofollow">Creating a Time Capsule instance using Samba, FreeBSD, and ZFS</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [OpenZFS on Twitter](https://x.com/openzfs/status/1704212154558324827?s=12&amp;t=-_bfM_adaiX8Ri_3lN9OYw)
• [EuroBSDcon 2023, Portugal](https://m.youtube.com/playlist?list=PLskKNopggjc7s6nAMxKF0tAO77ZIowZdx&amp;cbrd=1)
• [The lost history if Emoticons](https://x.com/rainmaker1973/status/1704006098909352016?s=12&amp;t=-_bfM_adaiX8Ri_3lN9OYw)
• [Solving the same problem](https://blog.fredrb.com/2023/09/08/same-problem-multiple-times/)
• [http://vihart.com/fifty-fizzbuzzes/](50 Fizz buzzes)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/Eric%20-%20German%20Question.md" rel="nofollow">Eric - German Question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/John%20Baldwin%20-%20Ep%20520%20question.md" rel="nofollow">John Baldwin - Ep 520 question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/Pat%20-%203d%20Printing.md" rel="nofollow">Pat - 3d Printing</a></p></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Adopting FreeBSD as Your Open Source Operating System, How Hard is it to Adapt a Memory Allocator to CHERI, Running Stable Diffusion on FreeBSD, Self-hosting Pixelfed on OpenBSD, Time Capsule instance using Samba, FreeBSD, and ZFS, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.javacodegeeks.com/2023/09/adopting-freebsd-as-your-open-source-operating-system-benefits-considerations.html" rel="nofollow">Adopting FreeBSD as Your Open Source Operating System: Benefits &amp; Considerations</a></h3>

<hr>

<h3><a href="https://tratt.net/laurie/blog/2023/how_hard_is_it_to_adapt_a_memory_allocator_to_cheri.html" rel="nofollow">How Hard is it to Adapt a Memory Allocator to CHERI</a></h3>

<hr>

<h2>News Roundup</h2>

<h3>[Running Stable Diffusion on FreeBSD)[<a href="https://github.com/verm/freebsd-stable-diffusion" rel="nofollow">https://github.com/verm/freebsd-stable-diffusion</a>)</h3>

<hr>

<h3><a href="https://www.tumfatig.net/2023/self-hosting-pixelfed-on-openbsd/" rel="nofollow">Self-hosting Pixelfed on OpenBSD</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2023/09/28/creating-a-time-capsule-instance-using-samba-freebsd-and-zfs/" rel="nofollow">Creating a Time Capsule instance using Samba, FreeBSD, and ZFS</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [OpenZFS on Twitter](https://x.com/openzfs/status/1704212154558324827?s=12&amp;t=-_bfM_adaiX8Ri_3lN9OYw)
• [EuroBSDcon 2023, Portugal](https://m.youtube.com/playlist?list=PLskKNopggjc7s6nAMxKF0tAO77ZIowZdx&amp;cbrd=1)
• [The lost history if Emoticons](https://x.com/rainmaker1973/status/1704006098909352016?s=12&amp;t=-_bfM_adaiX8Ri_3lN9OYw)
• [Solving the same problem](https://blog.fredrb.com/2023/09/08/same-problem-multiple-times/)
• [http://vihart.com/fifty-fizzbuzzes/](50 Fizz buzzes)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/Eric%20-%20German%20Question.md" rel="nofollow">Eric - German Question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/John%20Baldwin%20-%20Ep%20520%20question.md" rel="nofollow">John Baldwin - Ep 520 question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/Pat%20-%203d%20Printing.md" rel="nofollow">Pat - 3d Printing</a></p></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>528: Pledge the Program</title>
  <link>https://www.bsdnow.tv/528</link>
  <guid isPermaLink="false">adf32193-69d6-48d0-bb39-452d36512660</guid>
  <pubDate>Thu, 12 Oct 2023 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/adf32193-69d6-48d0-bb39-452d36512660.mp3" length="51518976" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>If you can use Open Source you can build hardware, Good performance is not just big O, Proof You Should Not Run MWL Code, How to add pledge to a program in OpenBSD, 3D printing on OpenBSD, Getting the right type of certificate, Jenny’s Daily Drivers, and more</itunes:subtitle>
  <itunes:duration>53:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>If you can use Open Source you can build hardware, Good performance is not just big O, Proof You Should Not Run MWL Code, How to add pledge to a program in OpenBSD, 3D printing on OpenBSD, Getting the right type of certificate, Jenny’s Daily Drivers, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
If you can use Open Source you can build hardware (https://redeem-tomorrow.com/if-you-can-use-open-source-you-can-build-hardware)
Good performance is not just big O (https://jmmv.dev/2023/09/performance-is-not-big-o.html)
News Roundup
How to add pledge to a program in OpenBSD (https://dataswamp.org/~solene/2023-09-08-openbsd-how-to-pledge-a-program.html)
Proof You Should Not Run My Code (https://mwl.io/archives/23082)
3D printing on OpenBSD? Yes, that’s a thing! (https://undeadly.org/cgi?action=article;sid=20230914075444)
Getting the right type of certificate (https://dan.langille.org/2023/09/09/getting-the-right-type-of-certificate/)
Jenny’s Daily Drivers (https://hackaday.com/2023/08/01/jennys-daily-drivers-freebsd-13-2/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, performance, big o, run code, execute, pledge, ed printing, certificate, daily driver</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>If you can use Open Source you can build hardware, Good performance is not just big O, Proof You Should Not Run MWL Code, How to add pledge to a program in OpenBSD, 3D printing on OpenBSD, Getting the right type of certificate, Jenny’s Daily Drivers, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://redeem-tomorrow.com/if-you-can-use-open-source-you-can-build-hardware" rel="nofollow">If you can use Open Source you can build hardware</a></h3>

<hr>

<h3><a href="https://jmmv.dev/2023/09/performance-is-not-big-o.html" rel="nofollow">Good performance is not just big O</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-09-08-openbsd-how-to-pledge-a-program.html" rel="nofollow">How to add pledge to a program in OpenBSD</a></h3>

<hr>

<h3><a href="https://mwl.io/archives/23082" rel="nofollow">Proof You Should Not Run My Code</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20230914075444" rel="nofollow">3D printing on OpenBSD? Yes, that’s a thing!</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2023/09/09/getting-the-right-type-of-certificate/" rel="nofollow">Getting the right type of certificate</a></h3>

<hr>

<h3><a href="https://hackaday.com/2023/08/01/jennys-daily-drivers-freebsd-13-2/" rel="nofollow">Jenny’s Daily Drivers</a></h3>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>If you can use Open Source you can build hardware, Good performance is not just big O, Proof You Should Not Run MWL Code, How to add pledge to a program in OpenBSD, 3D printing on OpenBSD, Getting the right type of certificate, Jenny’s Daily Drivers, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://redeem-tomorrow.com/if-you-can-use-open-source-you-can-build-hardware" rel="nofollow">If you can use Open Source you can build hardware</a></h3>

<hr>

<h3><a href="https://jmmv.dev/2023/09/performance-is-not-big-o.html" rel="nofollow">Good performance is not just big O</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-09-08-openbsd-how-to-pledge-a-program.html" rel="nofollow">How to add pledge to a program in OpenBSD</a></h3>

<hr>

<h3><a href="https://mwl.io/archives/23082" rel="nofollow">Proof You Should Not Run My Code</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20230914075444" rel="nofollow">3D printing on OpenBSD? Yes, that’s a thing!</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2023/09/09/getting-the-right-type-of-certificate/" rel="nofollow">Getting the right type of certificate</a></h3>

<hr>

<h3><a href="https://hackaday.com/2023/08/01/jennys-daily-drivers-freebsd-13-2/" rel="nofollow">Jenny’s Daily Drivers</a></h3>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>527: Reports are in</title>
  <link>https://www.bsdnow.tv/527</link>
  <guid isPermaLink="false">0a272a48-0c9a-4f75-a363-5263d9f7a342</guid>
  <pubDate>Thu, 05 Oct 2023 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0a272a48-0c9a-4f75-a363-5263d9f7a342.mp3" length="58297728" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Unlocking Infrastructure Sovereignty, first meeting of the FreeBSD Enterprise Working Group, HardenedBSD August 2023 Status Report, GhostBSD August 2023 donation report, MidnightBSD 3.1 Released, OpenBSD Webzine ISSUE #14, and more</itunes:subtitle>
  <itunes:duration>1:00:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Unlocking Infrastructure Sovereignty, first meeting of the FreeBSD Enterprise Working Group, HardenedBSD August 2023 Status Report, GhostBSD August 2023 donation report, MidnightBSD 3.1 Released, OpenBSD Webzine ISSUE #14, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Unlocking Infrastructure Sovereignty: Harnessing the Power of Open Source Solutions for Business Flexibility and Cost-Effectiveness (https://klarasystems.com/articles/unlocking-infrastructure-sovereignty-harnessing-the-power-of-open-source-solutions/)
Recap of first meeting of the FreeBSD Enterprise Working Group (https://freebsdfoundation.org/blog/recap-of-first-meeting-of-the-freebsd-enterprise-working-group/)
News Roundup
HardenedBSD August 2023 Status Report (https://hardenedbsd.org/article/shawn-webb/2023-09-01/hardenedbsd-august-2023-status-report)
• [HardenedBSD 14-STABLE Now Available](https://hardenedbsd.org/article/shawn-webb/2023-09-11/hardenedbsd-14-stable-now-available)
August 2023 donation report (http://ghostbsd.org/news/August_2023_donation_report)
• [Late on the announcement but... GhostBSD 23.06.01 ISO is now available](http://ghostbsd.org/23.06.01_iso_is_now_available)
MidnightBSD 3.1 Released (https://www.phoronix.com/news/MidnightBSD-3.1)
OpenBSD Webzine ISSUE #14 is out (https://webzine.puffy.cafe/issue-14.html)
Beastie Bits
• [ZFS for Dummies](https://ikrima.dev/dev-notes/homelab/zfs-for-dummies/)
• [The Switch runs FreeBSD](https://www.reddit.com/r/NintendoSwitch/comments/5xbe5a/the_switch_runs_freebsd_making_it_nintendos_first/)
• [KDE on OpenBSD](https://marc.info/?l=openbsd-ports&amp;amp;m=169391479324962)
• [(Kubernetes v1.28.0) for illumos, FreeBSD and OpenBSD](https://medium.com/@norlin.t/by-the-way-planternetes-kubernetes-v1-28-0-for-illumos-freebsd-and-openbsd-5d57026d6a25)
• [Video: C Programming on System 6 - VCF Midwest, Wi-Fi DA](https://jcs.org/2023/09/20/vcfmw)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, open source, foss, shell, cli, unix, tools, utility, berkeley, software, distribution, development, code, programming, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, infrastructure, sovereignty, enterprise working group, status report, donation, donors, midnightbsd 3.1, openbsd webzine</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Unlocking Infrastructure Sovereignty, first meeting of the FreeBSD Enterprise Working Group, HardenedBSD August 2023 Status Report, GhostBSD August 2023 donation report, MidnightBSD 3.1 Released, OpenBSD Webzine ISSUE #14, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/unlocking-infrastructure-sovereignty-harnessing-the-power-of-open-source-solutions/" rel="nofollow">Unlocking Infrastructure Sovereignty: Harnessing the Power of Open Source Solutions for Business Flexibility and Cost-Effectiveness</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/recap-of-first-meeting-of-the-freebsd-enterprise-working-group/" rel="nofollow">Recap of first meeting of the FreeBSD Enterprise Working Group</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2023-09-01/hardenedbsd-august-2023-status-report" rel="nofollow">HardenedBSD August 2023 Status Report</a></h3>

<pre><code>• [HardenedBSD 14-STABLE Now Available](https://hardenedbsd.org/article/shawn-webb/2023-09-11/hardenedbsd-14-stable-now-available)
</code></pre>

<hr>

<h3><a href="http://ghostbsd.org/news/August_2023_donation_report" rel="nofollow">August 2023 donation report</a></h3>

<pre><code>• [Late on the announcement but... GhostBSD 23.06.01 ISO is now available](http://ghostbsd.org/23.06.01_iso_is_now_available)
</code></pre>

<hr>

<h3><a href="https://www.phoronix.com/news/MidnightBSD-3.1" rel="nofollow">MidnightBSD 3.1 Released</a></h3>

<hr>

<h3><a href="https://webzine.puffy.cafe/issue-14.html" rel="nofollow">OpenBSD Webzine ISSUE #14 is out</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [ZFS for Dummies](https://ikrima.dev/dev-notes/homelab/zfs-for-dummies/)
• [The Switch runs FreeBSD](https://www.reddit.com/r/NintendoSwitch/comments/5xbe5a/the_switch_runs_freebsd_making_it_nintendos_first/)
• [KDE on OpenBSD](https://marc.info/?l=openbsd-ports&amp;m=169391479324962)
• [(Kubernetes v1.28.0) for illumos, FreeBSD and OpenBSD](https://medium.com/@norlin.t/by-the-way-planternetes-kubernetes-v1-28-0-for-illumos-freebsd-and-openbsd-5d57026d6a25)
• [Video: C Programming on System 6 - VCF Midwest, Wi-Fi DA](https://jcs.org/2023/09/20/vcfmw)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Unlocking Infrastructure Sovereignty, first meeting of the FreeBSD Enterprise Working Group, HardenedBSD August 2023 Status Report, GhostBSD August 2023 donation report, MidnightBSD 3.1 Released, OpenBSD Webzine ISSUE #14, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/unlocking-infrastructure-sovereignty-harnessing-the-power-of-open-source-solutions/" rel="nofollow">Unlocking Infrastructure Sovereignty: Harnessing the Power of Open Source Solutions for Business Flexibility and Cost-Effectiveness</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/recap-of-first-meeting-of-the-freebsd-enterprise-working-group/" rel="nofollow">Recap of first meeting of the FreeBSD Enterprise Working Group</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2023-09-01/hardenedbsd-august-2023-status-report" rel="nofollow">HardenedBSD August 2023 Status Report</a></h3>

<pre><code>• [HardenedBSD 14-STABLE Now Available](https://hardenedbsd.org/article/shawn-webb/2023-09-11/hardenedbsd-14-stable-now-available)
</code></pre>

<hr>

<h3><a href="http://ghostbsd.org/news/August_2023_donation_report" rel="nofollow">August 2023 donation report</a></h3>

<pre><code>• [Late on the announcement but... GhostBSD 23.06.01 ISO is now available](http://ghostbsd.org/23.06.01_iso_is_now_available)
</code></pre>

<hr>

<h3><a href="https://www.phoronix.com/news/MidnightBSD-3.1" rel="nofollow">MidnightBSD 3.1 Released</a></h3>

<hr>

<h3><a href="https://webzine.puffy.cafe/issue-14.html" rel="nofollow">OpenBSD Webzine ISSUE #14 is out</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [ZFS for Dummies](https://ikrima.dev/dev-notes/homelab/zfs-for-dummies/)
• [The Switch runs FreeBSD](https://www.reddit.com/r/NintendoSwitch/comments/5xbe5a/the_switch_runs_freebsd_making_it_nintendos_first/)
• [KDE on OpenBSD](https://marc.info/?l=openbsd-ports&amp;m=169391479324962)
• [(Kubernetes v1.28.0) for illumos, FreeBSD and OpenBSD](https://medium.com/@norlin.t/by-the-way-planternetes-kubernetes-v1-28-0-for-illumos-freebsd-and-openbsd-5d57026d6a25)
• [Video: C Programming on System 6 - VCF Midwest, Wi-Fi DA](https://jcs.org/2023/09/20/vcfmw)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>526: ZFS Replication Tools</title>
  <link>https://www.bsdnow.tv/526</link>
  <guid isPermaLink="false">d499d953-6d8f-4990-b7af-a8fca573f5c3</guid>
  <pubDate>Thu, 28 Sep 2023 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d499d953-6d8f-4990-b7af-a8fca573f5c3.mp3" length="44952960" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Why DNS is still hard to learn, Unix support 50 years ago, ZFS Replication tools, Between ISA and PCI, PCs had EISA and VLB, Old Computer Challenge v3, and more</itunes:subtitle>
  <itunes:duration>46:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Why DNS is still hard to learn, Unix support 50 years ago, ZFS Replication tools, Between ISA and PCI, PCs had EISA and VLB, Old Computer Challenge v3, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Why DNS is still hard to learn (https://jvns.ca/blog/2023/07/28/why-is-dns-still-hard-to-learn/)
Unix support 50 years ago: “your only source of information is a 2-man operation an ocean away” (https://www.cs.auckland.ac.nz/~brian/LetterFromRitchie.pdf)
News Roundup
ZFS Replication tools (https://evilham.com/en/blog/2023-ZFS-replication-tools/)
Between ISA and PCI, PCs had EISA and VLB (https://rubenerd.com/between-isa-and-pci-we-had-vlb/)
Old Computer Challenge v3: postmortem (https://dataswamp.org/~solene/2023-07-17-old-computer-challenge-v3-part2.html)
Beastie Bits
• [Installing and Using Research Unix Version 7 on the OpenSIMH PDP-11 Emulator](https://decuser.github.io/unix/research-unix/v7/videos/2023/07/14/installing-and-using-research-unix-v7-in-open-simh-video.html)
• [Cheat Sheets](https://github.com/cheat/cheatsheets/tree/master)
• [Introducing BSD Cafe](https://www.reddit.com/r/BSD/comments/15rt7em/introducing_the_bsdcafe/)
• [Keystroke timing obfuscation added to ssh(1)](http://undeadly.org/cgi?action=article;sid=20230829051257)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Daniel - Fav episode (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/526/feedback/Daniel%20-%20Fav%20episode.md)
Sam - Fav episode (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/526/feedback/Sam%20-%20Fav%20episode.md)
Question from JT - to Tom and Benedict, what has your fav episode been?
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, dns, learn, learning, 50 years ago, replication, tools, isa, pci, eisa, vlb, old computer challenge</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Why DNS is still hard to learn, Unix support 50 years ago, ZFS Replication tools, Between ISA and PCI, PCs had EISA and VLB, Old Computer Challenge v3, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://jvns.ca/blog/2023/07/28/why-is-dns-still-hard-to-learn/" rel="nofollow">Why DNS is still hard to learn</a></h3>

<hr>

<h3><a href="https://www.cs.auckland.ac.nz/%7Ebrian/LetterFromRitchie.pdf" rel="nofollow">Unix support 50 years ago: “your only source of information is a 2-man operation an ocean away”</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://evilham.com/en/blog/2023-ZFS-replication-tools/" rel="nofollow">ZFS Replication tools</a></h3>

<hr>

<h3><a href="https://rubenerd.com/between-isa-and-pci-we-had-vlb/" rel="nofollow">Between ISA and PCI, PCs had EISA and VLB</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-07-17-old-computer-challenge-v3-part2.html" rel="nofollow">Old Computer Challenge v3: postmortem</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [Installing and Using Research Unix Version 7 on the OpenSIMH PDP-11 Emulator](https://decuser.github.io/unix/research-unix/v7/videos/2023/07/14/installing-and-using-research-unix-v7-in-open-simh-video.html)
• [Cheat Sheets](https://github.com/cheat/cheatsheets/tree/master)
• [Introducing BSD Cafe](https://www.reddit.com/r/BSD/comments/15rt7em/introducing_the_bsdcafe/)
• [Keystroke timing obfuscation added to ssh(1)](http://undeadly.org/cgi?action=article;sid=20230829051257)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/526/feedback/Daniel%20-%20Fav%20episode.md" rel="nofollow">Daniel - Fav episode</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/526/feedback/Sam%20-%20Fav%20episode.md" rel="nofollow">Sam - Fav episode</a></li>
<li>Question from JT - to Tom and Benedict, what has your fav episode been?
***</li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Why DNS is still hard to learn, Unix support 50 years ago, ZFS Replication tools, Between ISA and PCI, PCs had EISA and VLB, Old Computer Challenge v3, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://jvns.ca/blog/2023/07/28/why-is-dns-still-hard-to-learn/" rel="nofollow">Why DNS is still hard to learn</a></h3>

<hr>

<h3><a href="https://www.cs.auckland.ac.nz/%7Ebrian/LetterFromRitchie.pdf" rel="nofollow">Unix support 50 years ago: “your only source of information is a 2-man operation an ocean away”</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://evilham.com/en/blog/2023-ZFS-replication-tools/" rel="nofollow">ZFS Replication tools</a></h3>

<hr>

<h3><a href="https://rubenerd.com/between-isa-and-pci-we-had-vlb/" rel="nofollow">Between ISA and PCI, PCs had EISA and VLB</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-07-17-old-computer-challenge-v3-part2.html" rel="nofollow">Old Computer Challenge v3: postmortem</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [Installing and Using Research Unix Version 7 on the OpenSIMH PDP-11 Emulator](https://decuser.github.io/unix/research-unix/v7/videos/2023/07/14/installing-and-using-research-unix-v7-in-open-simh-video.html)
• [Cheat Sheets](https://github.com/cheat/cheatsheets/tree/master)
• [Introducing BSD Cafe](https://www.reddit.com/r/BSD/comments/15rt7em/introducing_the_bsdcafe/)
• [Keystroke timing obfuscation added to ssh(1)](http://undeadly.org/cgi?action=article;sid=20230829051257)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/526/feedback/Daniel%20-%20Fav%20episode.md" rel="nofollow">Daniel - Fav episode</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/526/feedback/Sam%20-%20Fav%20episode.md" rel="nofollow">Sam - Fav episode</a></li>
<li>Question from JT - to Tom and Benedict, what has your fav episode been?
***</li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>525: Old NetBSD Server</title>
  <link>https://www.bsdnow.tv/525</link>
  <guid isPermaLink="false">77bb2c15-7149-4511-a582-7ce5ce3096cd</guid>
  <pubDate>Thu, 21 Sep 2023 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/77bb2c15-7149-4511-a582-7ce5ce3096cd.mp3" length="42549120" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Do one thing and do it well, Turning a 15 years old laptop into a children proof retrogaming station, Old Computer Challenge v3: day 1, It Takes 6 Days to Change 1 Line of Code, Rejected GitHub Profile Achievements, that old netbsd server, and more</itunes:subtitle>
  <itunes:duration>44:19</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Do one thing and do it well, Turning a 15 years old laptop into a children proof retrogaming station, Old Computer Challenge v3: day 1, It Takes 6 Days to Change 1 Line of Code, Rejected GitHub Profile Achievements, that old netbsd server, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Do one thing and do it well (https://medium.com/source-and-buggy/do-one-thing-and-do-it-well-886b11a5d21)
Turning a 15 years old laptop into a children proof retrogaming station (https://dataswamp.org/~solene/2023-07-24-childproof-retrogaming-station.html)
and a rereview of (https://dataswamp.org/~solene/2023-06-04-old-computer-challenge-v3.html)
News Roundup
Old Computer Challenge v3: day 1 (https://dataswamp.org/~solene/2023-07-10-old-computer-challenge-v3-part1.html)
It Takes 6 Days to Change 1 Line of Code (https://edw519.posthaven.com/it-takes-6-days-to-change-1-line-of-code)
Rejected GitHub Profile Achievements (https://github.com/Flet/rejected-github-profile-achievements)
That old netbsd server (https://it-notes.dragas.net/2023/08/27/that-old-netbsd-server-running-since-2010/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Felix - questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Felix%20-%20questions.md)
Francis - Episode 511 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Francis%20-%20Episode%20511.md)
Ian - CDN (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Ian%20-%20CDN.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, do one thing, do it well, 15 years old, retro, children proof, retrogaming, station, old computer challenge, 6 days, 1 line, change, coding, rejected, github, profile achievements </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Do one thing and do it well, Turning a 15 years old laptop into a children proof retrogaming station, Old Computer Challenge v3: day 1, It Takes 6 Days to Change 1 Line of Code, Rejected GitHub Profile Achievements, that old netbsd server, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://medium.com/source-and-buggy/do-one-thing-and-do-it-well-886b11a5d21" rel="nofollow">Do one thing and do it well</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-07-24-childproof-retrogaming-station.html" rel="nofollow">Turning a 15 years old laptop into a children proof retrogaming station</a></h3>

<p><a href="https://dataswamp.org/%7Esolene/2023-06-04-old-computer-challenge-v3.html" rel="nofollow">and a rereview of</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-07-10-old-computer-challenge-v3-part1.html" rel="nofollow">Old Computer Challenge v3: day 1</a></h3>

<hr>

<h3><a href="https://edw519.posthaven.com/it-takes-6-days-to-change-1-line-of-code" rel="nofollow">It Takes 6 Days to Change 1 Line of Code</a></h3>

<hr>

<h3><a href="https://github.com/Flet/rejected-github-profile-achievements" rel="nofollow">Rejected GitHub Profile Achievements</a></h3>

<hr>

<h3><a href="https://it-notes.dragas.net/2023/08/27/that-old-netbsd-server-running-since-2010/" rel="nofollow">That old netbsd server</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Felix%20-%20questions.md" rel="nofollow">Felix - questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Francis%20-%20Episode%20511.md" rel="nofollow">Francis - Episode 511</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Ian%20-%20CDN.md" rel="nofollow">Ian - CDN</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Do one thing and do it well, Turning a 15 years old laptop into a children proof retrogaming station, Old Computer Challenge v3: day 1, It Takes 6 Days to Change 1 Line of Code, Rejected GitHub Profile Achievements, that old netbsd server, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://medium.com/source-and-buggy/do-one-thing-and-do-it-well-886b11a5d21" rel="nofollow">Do one thing and do it well</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2023-07-24-childproof-retrogaming-station.html" rel="nofollow">Turning a 15 years old laptop into a children proof retrogaming station</a></h3>

<p><a href="https://dataswamp.org/%7Esolene/2023-06-04-old-computer-challenge-v3.html" rel="nofollow">and a rereview of</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-07-10-old-computer-challenge-v3-part1.html" rel="nofollow">Old Computer Challenge v3: day 1</a></h3>

<hr>

<h3><a href="https://edw519.posthaven.com/it-takes-6-days-to-change-1-line-of-code" rel="nofollow">It Takes 6 Days to Change 1 Line of Code</a></h3>

<hr>

<h3><a href="https://github.com/Flet/rejected-github-profile-achievements" rel="nofollow">Rejected GitHub Profile Achievements</a></h3>

<hr>

<h3><a href="https://it-notes.dragas.net/2023/08/27/that-old-netbsd-server-running-since-2010/" rel="nofollow">That old netbsd server</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Felix%20-%20questions.md" rel="nofollow">Felix - questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Francis%20-%20Episode%20511.md" rel="nofollow">Francis - Episode 511</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Ian%20-%20CDN.md" rel="nofollow">Ian - CDN</a></li>
</ul>

<hr>

<ul>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
<li><p>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>524: Legendary Unix Recovery</title>
  <link>https://www.bsdnow.tv/524</link>
  <guid isPermaLink="false">ce877f80-4e1c-4029-adbe-4b5893efef2d</guid>
  <pubDate>Thu, 14 Sep 2023 06:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ce877f80-4e1c-4029-adbe-4b5893efef2d.mp3" length="55404288" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>On the Loss and Preservation of Knowledge, Unix Recovery Legend, Useful Unix commands for data science, Tarsnap outage post-mortem, OpenBSD 7.3 on a twenty year old IBM ThinkPad R31, and more</itunes:subtitle>
  <itunes:duration>57:42</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>On the Loss and Preservation of Knowledge, Unix Recovery Legend, Useful Unix commands for data science, Tarsnap outage post-mortem, OpenBSD 7.3 on a twenty year old IBM ThinkPad R31, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
On the Loss and Preservation of Knowledge (https://samoburja.com/on-the-loss-and-preservation-of-knowledge/)
Unix Recovery Legend (https://www.ecb.torontomu.ca/~elf/hack/recovery.html)
News Roundup
Useful Unix commands for data science (https://gregreda.com/2013/07/15/unix-commands-for-data-science/)
Why we like Tarsnap = Transparency : Tarsnap outage post-mortem (https://mail.tarsnap.com/tarsnap-announce/msg00050.html)
OpenBSD 7.3 on a twenty year old IBM ThinkPad R31 (https://box.matto.nl/openbsd-73-on-a-twenty-year-old-ibm-thinkpad-r31.html)
Beastie Bits
Quick and dirty IMAP(-UW) server (https://forums.freebsd.org/threads/quick-and-dirty-imap-uw-server.89877/)
JENNY’S DAILY DRIVERS: FREEBSD 13.2 (https://hackaday.com/2023/08/01/jennys-daily-drivers-freebsd-13-2/)
Elvish (https://elv.sh/)
xroach (https://infosec.exchange/@paco/110772422266480371)
Did hell freeze over? (https://soc.feditime.com/notice/AXo6xXlSrfdfjNPdRI)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Nelson - Bell Labs Memoranda (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/Nelson%20-%20Bell%20Labs%20Memoranda.md)
patrick - audio switching (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/patrick%20-%20audio%20switching.md)
tim - appjail (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/tim%20-%20appjail.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, knowledge, preservation, loss, recovery, legend, commands, data science, tarsnap, post-mortem, outage, thinkpad r31</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>On the Loss and Preservation of Knowledge, Unix Recovery Legend, Useful Unix commands for data science, Tarsnap outage post-mortem, OpenBSD 7.3 on a twenty year old IBM ThinkPad R31, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://samoburja.com/on-the-loss-and-preservation-of-knowledge/" rel="nofollow">On the Loss and Preservation of Knowledge</a></h3>

<hr>

<h3><a href="https://www.ecb.torontomu.ca/%7Eelf/hack/recovery.html" rel="nofollow">Unix Recovery Legend</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://gregreda.com/2013/07/15/unix-commands-for-data-science/" rel="nofollow">Useful Unix commands for data science</a></h3>

<hr>

<h3><a href="https://mail.tarsnap.com/tarsnap-announce/msg00050.html" rel="nofollow">Why we like Tarsnap = Transparency : Tarsnap outage post-mortem</a></h3>

<hr>

<h3><a href="https://box.matto.nl/openbsd-73-on-a-twenty-year-old-ibm-thinkpad-r31.html" rel="nofollow">OpenBSD 7.3 on a twenty year old IBM ThinkPad R31</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://forums.freebsd.org/threads/quick-and-dirty-imap-uw-server.89877/" rel="nofollow">Quick and dirty IMAP(-UW) server</a></li>
<li><a href="https://hackaday.com/2023/08/01/jennys-daily-drivers-freebsd-13-2/" rel="nofollow">JENNY’S DAILY DRIVERS: FREEBSD 13.2</a></li>
<li><a href="https://elv.sh/" rel="nofollow">Elvish</a></li>
<li><a href="https://infosec.exchange/@paco/110772422266480371" rel="nofollow">xroach</a></li>
<li><a href="https://soc.feditime.com/notice/AXo6xXlSrfdfjNPdRI" rel="nofollow">Did hell freeze over?</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/Nelson%20-%20Bell%20Labs%20Memoranda.md" rel="nofollow">Nelson - Bell Labs Memoranda</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/patrick%20-%20audio%20switching.md" rel="nofollow">patrick - audio switching</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/tim%20-%20appjail.md" rel="nofollow">tim - appjail</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>On the Loss and Preservation of Knowledge, Unix Recovery Legend, Useful Unix commands for data science, Tarsnap outage post-mortem, OpenBSD 7.3 on a twenty year old IBM ThinkPad R31, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://samoburja.com/on-the-loss-and-preservation-of-knowledge/" rel="nofollow">On the Loss and Preservation of Knowledge</a></h3>

<hr>

<h3><a href="https://www.ecb.torontomu.ca/%7Eelf/hack/recovery.html" rel="nofollow">Unix Recovery Legend</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://gregreda.com/2013/07/15/unix-commands-for-data-science/" rel="nofollow">Useful Unix commands for data science</a></h3>

<hr>

<h3><a href="https://mail.tarsnap.com/tarsnap-announce/msg00050.html" rel="nofollow">Why we like Tarsnap = Transparency : Tarsnap outage post-mortem</a></h3>

<hr>

<h3><a href="https://box.matto.nl/openbsd-73-on-a-twenty-year-old-ibm-thinkpad-r31.html" rel="nofollow">OpenBSD 7.3 on a twenty year old IBM ThinkPad R31</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://forums.freebsd.org/threads/quick-and-dirty-imap-uw-server.89877/" rel="nofollow">Quick and dirty IMAP(-UW) server</a></li>
<li><a href="https://hackaday.com/2023/08/01/jennys-daily-drivers-freebsd-13-2/" rel="nofollow">JENNY’S DAILY DRIVERS: FREEBSD 13.2</a></li>
<li><a href="https://elv.sh/" rel="nofollow">Elvish</a></li>
<li><a href="https://infosec.exchange/@paco/110772422266480371" rel="nofollow">xroach</a></li>
<li><a href="https://soc.feditime.com/notice/AXo6xXlSrfdfjNPdRI" rel="nofollow">Did hell freeze over?</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/Nelson%20-%20Bell%20Labs%20Memoranda.md" rel="nofollow">Nelson - Bell Labs Memoranda</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/patrick%20-%20audio%20switching.md" rel="nofollow">patrick - audio switching</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/tim%20-%20appjail.md" rel="nofollow">tim - appjail</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>523: Literally Unix</title>
  <link>https://www.bsdnow.tv/523</link>
  <guid isPermaLink="false">e03effe5-46f6-4cc7-8c19-4f549f78415c</guid>
  <pubDate>Thu, 07 Sep 2023 06:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e03effe5-46f6-4cc7-8c19-4f549f78415c.mp3" length="38576256" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Elements Of Style: UNIX As Literature, The shell and its crappy handling of whitespace, Theo de Raadt on Zenbleed, OPNsense 23.7 released, illumos gets a new C compiler, fixing Thinkpad X1 WIFI on FreeBSD, and more</itunes:subtitle>
  <itunes:duration>40:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Elements Of Style: UNIX As Literature, The shell and its crappy handling of whitespace, Theo de Raadt on Zenbleed, OPNsense 23.7 released, illumos gets a new C compiler, fixing Thinkpad X1 WIFI on FreeBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The Elements Of Style: UNIX As Literature (https://theody.net/elements.html)
The shell and its crappy handling of whitespace (https://blog.plover.com/Unix/whitespace.html)
News Roundup
Theo de Raadt on Zenbleed (https://www.undeadly.org/cgi?action=article;sid=20230724224011)
OPNsense 23.7 “Restless Roadrunner” Released (https://opnsense.org/opnsense-23-7-released/)
[ILLUMOS GETS A NEW C COMPILER](https://briancallahan.net/blog/20230705.html
)
FIXING THINKPAD X1 WIFI ON FREEBSD (https://michal.sapka.me/2023/fixing-thinkpad-x1-wifi-on-freebsd/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, style, elements, literature, whitespace, zenbleed, theo de raadt, opnsense 23.7, illumos, compiler, thinkpad, wifi</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Elements Of Style: UNIX As Literature, The shell and its crappy handling of whitespace, Theo de Raadt on Zenbleed, OPNsense 23.7 released, illumos gets a new C compiler, fixing Thinkpad X1 WIFI on FreeBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://theody.net/elements.html" rel="nofollow">The Elements Of Style: UNIX As Literature</a></h3>

<hr>

<h3><a href="https://blog.plover.com/Unix/whitespace.html" rel="nofollow">The shell and its crappy handling of whitespace</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.undeadly.org/cgi?action=article;sid=20230724224011" rel="nofollow">Theo de Raadt on Zenbleed</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-23-7-released/" rel="nofollow">OPNsense 23.7 “Restless Roadrunner” Released</a></h3>

<hr>

<h3>[ILLUMOS GETS A NEW C COMPILER](<a href="https://briancallahan.net/blog/20230705.html" rel="nofollow">https://briancallahan.net/blog/20230705.html</a></h3>

<p>)</p>

<hr>

<h3><a href="https://michal.sapka.me/2023/fixing-thinkpad-x1-wifi-on-freebsd/" rel="nofollow">FIXING THINKPAD X1 WIFI ON FREEBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr></li>
<li><ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Elements Of Style: UNIX As Literature, The shell and its crappy handling of whitespace, Theo de Raadt on Zenbleed, OPNsense 23.7 released, illumos gets a new C compiler, fixing Thinkpad X1 WIFI on FreeBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://theody.net/elements.html" rel="nofollow">The Elements Of Style: UNIX As Literature</a></h3>

<hr>

<h3><a href="https://blog.plover.com/Unix/whitespace.html" rel="nofollow">The shell and its crappy handling of whitespace</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.undeadly.org/cgi?action=article;sid=20230724224011" rel="nofollow">Theo de Raadt on Zenbleed</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-23-7-released/" rel="nofollow">OPNsense 23.7 “Restless Roadrunner” Released</a></h3>

<hr>

<h3>[ILLUMOS GETS A NEW C COMPILER](<a href="https://briancallahan.net/blog/20230705.html" rel="nofollow">https://briancallahan.net/blog/20230705.html</a></h3>

<p>)</p>

<hr>

<h3><a href="https://michal.sapka.me/2023/fixing-thinkpad-x1-wifi-on-freebsd/" rel="nofollow">FIXING THINKPAD X1 WIFI ON FREEBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr></li>
<li><ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>522: Zenbleed Foot Shooting</title>
  <link>https://www.bsdnow.tv/522</link>
  <guid isPermaLink="false">eb9e39c2-564c-4286-b1dd-e1d57a331f87</guid>
  <pubDate>Thu, 31 Aug 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/eb9e39c2-564c-4286-b1dd-e1d57a331f87.mp3" length="46507008" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Top Ten Reasons to Upgrade to FreeBSD 13.2, History never repeats but sometimes it rhymes, Wayland on OpenBSD, OpenBGPD 8.1 released, Shoot yourself in the foot, Zenbleed: aka: The new fun for a while, and more</itunes:subtitle>
  <itunes:duration>48:26</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Top Ten Reasons to Upgrade to FreeBSD 13.2, History never repeats but sometimes it rhymes, Wayland on OpenBSD, OpenBGPD 8.1 released, Shoot yourself in the foot, Zenbleed: aka: The new fun for a while, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Top Ten Reasons to Upgrade to FreeBSD 13.2 (https://freebsdfoundation.org/blog/top-ten-reasons-to-upgrade-to-freebsd-13-2/)
History never repeats but sometimes it rhymes (https://ciq.com/blog/history-never-repeats-but-sometimes-it-rhymes/)
News Roundup
Wayland on OpenBSD (https://xenocara.org/Wayland_on_OpenBSD.html)
OpenBGPD 8.1 released (http://undeadly.org/cgi?action=article;sid=20230713110230)
Shoot yourself in the foot (https://g-w1.github.io/blog/observation/2023/07/08/shoot-yourself-in-the-foot.html)
Zenbleed: aka : The new fun for a while (https://undeadly.org/cgi?action=article;sid=20230724224011)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Ian - about dozing off when listening (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Ian%20-%20about%20dozing%20off%20when%20listening.md)
Nixbytes  - news on netbsd (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Nixbytes%20%20-%20news%20on%20netbsd.md)
Phillip - Questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Phillip%20-%20Questions.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
Join us and other BSD Fans in our BSD Now Telegram channel (https://t.me/bsdnow)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, reasons, top 10, upgrade, 13.2, history, rhyme, wayland, openbgpd, foot shooting, zenbleed</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Top Ten Reasons to Upgrade to FreeBSD 13.2, History never repeats but sometimes it rhymes, Wayland on OpenBSD, OpenBGPD 8.1 released, Shoot yourself in the foot, Zenbleed: aka: The new fun for a while, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/top-ten-reasons-to-upgrade-to-freebsd-13-2/" rel="nofollow">Top Ten Reasons to Upgrade to FreeBSD 13.2</a></h3>

<hr>

<h3><a href="https://ciq.com/blog/history-never-repeats-but-sometimes-it-rhymes/" rel="nofollow">History never repeats but sometimes it rhymes</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://xenocara.org/Wayland_on_OpenBSD.html" rel="nofollow">Wayland on OpenBSD</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230713110230" rel="nofollow">OpenBGPD 8.1 released</a></h3>

<hr>

<h3><a href="https://g-w1.github.io/blog/observation/2023/07/08/shoot-yourself-in-the-foot.html" rel="nofollow">Shoot yourself in the foot</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20230724224011" rel="nofollow">Zenbleed: aka : The new fun for a while</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Ian%20-%20about%20dozing%20off%20when%20listening.md" rel="nofollow">Ian - about dozing off when listening</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Nixbytes%20%20-%20news%20on%20netbsd.md" rel="nofollow">Nixbytes  - news on netbsd</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Phillip%20-%20Questions.md" rel="nofollow">Phillip - Questions</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
<li>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Top Ten Reasons to Upgrade to FreeBSD 13.2, History never repeats but sometimes it rhymes, Wayland on OpenBSD, OpenBGPD 8.1 released, Shoot yourself in the foot, Zenbleed: aka: The new fun for a while, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/top-ten-reasons-to-upgrade-to-freebsd-13-2/" rel="nofollow">Top Ten Reasons to Upgrade to FreeBSD 13.2</a></h3>

<hr>

<h3><a href="https://ciq.com/blog/history-never-repeats-but-sometimes-it-rhymes/" rel="nofollow">History never repeats but sometimes it rhymes</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://xenocara.org/Wayland_on_OpenBSD.html" rel="nofollow">Wayland on OpenBSD</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230713110230" rel="nofollow">OpenBGPD 8.1 released</a></h3>

<hr>

<h3><a href="https://g-w1.github.io/blog/observation/2023/07/08/shoot-yourself-in-the-foot.html" rel="nofollow">Shoot yourself in the foot</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20230724224011" rel="nofollow">Zenbleed: aka : The new fun for a while</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Ian%20-%20about%20dozing%20off%20when%20listening.md" rel="nofollow">Ian - about dozing off when listening</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Nixbytes%20%20-%20news%20on%20netbsd.md" rel="nofollow">Nixbytes  - news on netbsd</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Phillip%20-%20Questions.md" rel="nofollow">Phillip - Questions</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
<li>Join us and other BSD Fans in our <a href="https://t.me/bsdnow" rel="nofollow">BSD Now Telegram channel</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>521: BSD Summer Reading</title>
  <link>https://www.bsdnow.tv/521</link>
  <guid isPermaLink="false">533fcb2a-376e-4f26-9d0d-4fa57da1ced4</guid>
  <pubDate>Thu, 24 Aug 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/533fcb2a-376e-4f26-9d0d-4fa57da1ced4.mp3" length="54731520" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Status Report Q2 2023, Klara Systems Recommended Summer Reads 2023, install Kanboard on OpenBSD howto, A bit of Unix history on 'su -', hints for splitting commits, Live from OpenBSD in Amsterdam, and more</itunes:subtitle>
  <itunes:duration>57:00</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Status Report Q2 2023, Klara Systems Recommended Summer Reads 2023, install Kanboard on OpenBSD howto, A bit of Unix history on 'su -', hints for splitting commits, Live from OpenBSD in Amsterdam, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Status Report Second Quarter 2023 (https://www.freebsd.org/status/report-2023-04-2023-06/)
Our 2023 Recommended Summer Reads 2023 (https://klarasystems.com/articles/our-2023-recommended-summer-reads-freebsd-and-linux/)
News Roundup
How to install Kanboard on OpenBSD (https://dataswamp.org/~solene/2023-07-07-kanboard-on-openbsd.html)
A bit of Unix history on 'su -' (https://utcc.utoronto.ca/~cks/space/blog/unix/SuDashHistory)
Some hints for splitting commits (http://bsdimp.blogspot.com/2023/07/some-hints-for-splitting-commits.html)
Live from OpenBSD in Amsterdam (https://michal.sapka.me/2023/moved-to-openbsd/)
In memoriam
In Memoriam: Hans Petter William Sirevåg Selasky (https://forums.freebsd.org/threads/in-memoriam-hans-petter-william-sirevag-selasky.89697/#post-616627)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Agbo - Using BSD for a business (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Agbo%20-%20Using%20BSD%20for%20a%20business.md)
Chris - Desktop BSD systems (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Chris%20-%20Desktop%20BSD%20systems.md)
Dane - Use another OS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Dane%20-%20Use%20another%20OS.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, status report, quarter 2, recommended reading, books, article, kanboard, history, su, commit, git, vcs, openbsd amsterdam, live</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Status Report Q2 2023, Klara Systems Recommended Summer Reads 2023, install Kanboard on OpenBSD howto, A bit of Unix history on &#39;su -&#39;, hints for splitting commits, Live from OpenBSD in Amsterdam, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2023-04-2023-06/" rel="nofollow">FreeBSD Status Report Second Quarter 2023</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/our-2023-recommended-summer-reads-freebsd-and-linux/" rel="nofollow">Our 2023 Recommended Summer Reads 2023</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-07-07-kanboard-on-openbsd.html" rel="nofollow">How to install Kanboard on OpenBSD</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/SuDashHistory" rel="nofollow">A bit of Unix history on &#39;su -&#39;</a></h3>

<hr>

<h3><a href="http://bsdimp.blogspot.com/2023/07/some-hints-for-splitting-commits.html" rel="nofollow">Some hints for splitting commits</a></h3>

<hr>

<h3><a href="https://michal.sapka.me/2023/moved-to-openbsd/" rel="nofollow">Live from OpenBSD in Amsterdam</a></h3>

<hr>

<h2>In memoriam</h2>

<p><a href="https://forums.freebsd.org/threads/in-memoriam-hans-petter-william-sirevag-selasky.89697/#post-616627" rel="nofollow">In Memoriam: Hans Petter William Sirevåg Selasky</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Agbo%20-%20Using%20BSD%20for%20a%20business.md" rel="nofollow">Agbo - Using BSD for a business</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Chris%20-%20Desktop%20BSD%20systems.md" rel="nofollow">Chris - Desktop BSD systems</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Dane%20-%20Use%20another%20OS.md" rel="nofollow">Dane - Use another OS</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Status Report Q2 2023, Klara Systems Recommended Summer Reads 2023, install Kanboard on OpenBSD howto, A bit of Unix history on &#39;su -&#39;, hints for splitting commits, Live from OpenBSD in Amsterdam, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2023-04-2023-06/" rel="nofollow">FreeBSD Status Report Second Quarter 2023</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/our-2023-recommended-summer-reads-freebsd-and-linux/" rel="nofollow">Our 2023 Recommended Summer Reads 2023</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-07-07-kanboard-on-openbsd.html" rel="nofollow">How to install Kanboard on OpenBSD</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/SuDashHistory" rel="nofollow">A bit of Unix history on &#39;su -&#39;</a></h3>

<hr>

<h3><a href="http://bsdimp.blogspot.com/2023/07/some-hints-for-splitting-commits.html" rel="nofollow">Some hints for splitting commits</a></h3>

<hr>

<h3><a href="https://michal.sapka.me/2023/moved-to-openbsd/" rel="nofollow">Live from OpenBSD in Amsterdam</a></h3>

<hr>

<h2>In memoriam</h2>

<p><a href="https://forums.freebsd.org/threads/in-memoriam-hans-petter-william-sirevag-selasky.89697/#post-616627" rel="nofollow">In Memoriam: Hans Petter William Sirevåg Selasky</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Agbo%20-%20Using%20BSD%20for%20a%20business.md" rel="nofollow">Agbo - Using BSD for a business</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Chris%20-%20Desktop%20BSD%20systems.md" rel="nofollow">Chris - Desktop BSD systems</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Dane%20-%20Use%20another%20OS.md" rel="nofollow">Dane - Use another OS</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>520: 4 months BSD</title>
  <link>https://www.bsdnow.tv/520</link>
  <guid isPermaLink="false">c4abf3ee-9d63-4f0a-bc8d-ea10b203a9e0</guid>
  <pubDate>Thu, 17 Aug 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c4abf3ee-9d63-4f0a-bc8d-ea10b203a9e0.mp3" length="41702784" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>4 Months of BSD, Self Hosted Calendar and address Book, Ban scanners IPs from OpenSMTP logs, Self-hosted git page, Bastille template example, Restrict nginx Access by Geographical Location on FreeBSD, and more.</itunes:subtitle>
  <itunes:duration>43:26</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>4 Months of BSD, Self Hosted Calendar and address Book, Ban scanners IPs from OpenSMTP logs, Self-hosted git page, Bastille template example, Restrict nginx Access by Geographical Location on FreeBSD, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
4 Months of BSD (https://danterobinson.dev/BSD/4MonthsofBSD)
Self Hosted Calendar and address Book (https://www.tumfatig.net/2023/self-hosted-calendar-and-addressbook-services-on-openbsd/)
News Roundup
Ban scanners IPs from OpenSMTP logs (https://dataswamp.org/~solene/2023-06-22-opensmtpd-block-attempts.html)
Self-hosted git page with stagit (featuring ed, the standard editor) (https://sebastiano.tronto.net/blog/2022-11-23-git-host/)
Bastille template example (https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/)
Nginx: How to Restrict Access by Geographical Location on FreeBSD (https://herrbischoff.com/2021/05/nginx-how-to-restrict-access-by-geographical-location-on-freebsd/)
Beastie Bits
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Chris - ARM (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/520/feedback/Chris%20-%20arm.md)
Matthew - Groups (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/520/feedback/matthew%20-%20groups.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, server, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, 4 months, four, self-hosted, calendar, address book, ban, banning, opensmtp, log, log analysis, git-page, git, bastille, template, restrict, nginx, location, location-based, blocking, geo-block</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>4 Months of BSD, Self Hosted Calendar and address Book, Ban scanners IPs from OpenSMTP logs, Self-hosted git page, Bastille template example, Restrict nginx Access by Geographical Location on FreeBSD, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://danterobinson.dev/BSD/4MonthsofBSD" rel="nofollow">4 Months of BSD</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2023/self-hosted-calendar-and-addressbook-services-on-openbsd/" rel="nofollow">Self Hosted Calendar and address Book</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-06-22-opensmtpd-block-attempts.html" rel="nofollow">Ban scanners IPs from OpenSMTP logs</a></h3>

<hr>

<h3><a href="https://sebastiano.tronto.net/blog/2022-11-23-git-host/" rel="nofollow">Self-hosted git page with stagit (featuring ed, the standard editor)</a></h3>

<hr>

<h3><a href="https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/" rel="nofollow">Bastille template example</a></h3>

<hr>

<h3><a href="https://herrbischoff.com/2021/05/nginx-how-to-restrict-access-by-geographical-location-on-freebsd/" rel="nofollow">Nginx: How to Restrict Access by Geographical Location on FreeBSD</a></h3>

<hr>

<h2>Beastie Bits</h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/520/feedback/Chris%20-%20arm.md" rel="nofollow">Chris - ARM</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/520/feedback/matthew%20-%20groups.md" rel="nofollow">Matthew - Groups</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>4 Months of BSD, Self Hosted Calendar and address Book, Ban scanners IPs from OpenSMTP logs, Self-hosted git page, Bastille template example, Restrict nginx Access by Geographical Location on FreeBSD, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://danterobinson.dev/BSD/4MonthsofBSD" rel="nofollow">4 Months of BSD</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2023/self-hosted-calendar-and-addressbook-services-on-openbsd/" rel="nofollow">Self Hosted Calendar and address Book</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-06-22-opensmtpd-block-attempts.html" rel="nofollow">Ban scanners IPs from OpenSMTP logs</a></h3>

<hr>

<h3><a href="https://sebastiano.tronto.net/blog/2022-11-23-git-host/" rel="nofollow">Self-hosted git page with stagit (featuring ed, the standard editor)</a></h3>

<hr>

<h3><a href="https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/" rel="nofollow">Bastille template example</a></h3>

<hr>

<h3><a href="https://herrbischoff.com/2021/05/nginx-how-to-restrict-access-by-geographical-location-on-freebsd/" rel="nofollow">Nginx: How to Restrict Access by Geographical Location on FreeBSD</a></h3>

<hr>

<h2>Beastie Bits</h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/520/feedback/Chris%20-%20arm.md" rel="nofollow">Chris - ARM</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/520/feedback/matthew%20-%20groups.md" rel="nofollow">Matthew - Groups</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>519: Telegram from BSDNow</title>
  <link>https://www.bsdnow.tv/519</link>
  <guid isPermaLink="false">5d5025dc-47c7-48f4-9da6-d5fee456b1de</guid>
  <pubDate>Thu, 10 Aug 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5d5025dc-47c7-48f4-9da6-d5fee456b1de.mp3" length="35925120" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>3 Advantages to Running FreeBSD as Your Server OS, FreeBSD 14 Release Schedule, Stream your OpenBSD desktop audio, DOD KSOS Secure UNIX Operating System Manual, How to limit bandwidth usage with SCP transfers, and more.</itunes:subtitle>
  <itunes:duration>37:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>3 Advantages to Running FreeBSD as Your Server OS, FreeBSD 14 Release Schedule, Stream your OpenBSD desktop audio, DOD KSOS Secure UNIX Operating System Manual, How to limit bandwidth usage with SCP transfers, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
3 Advantages to Running FreeBSD as Your Server Operating System (https://klarasystems.com/articles/freebsd-3-advantages-to-running-freebsd-as-your-server-operating-system/)
FreeBSD 14 Release Schedule (https://www.freebsd.org/releases/14.0R/)
News Roundup
Stream your OpenBSD desktop audio to other devices (https://dataswamp.org/~solene/2023-05-05-openbsd-sound-streaming.html)
DOD KSOS Secure UNIX Operating System Manual and Final Report (https://www.tuhs.org/pipermail/tuhs/2023-June/028441.html)
How to limit bandwidth usage with SCP transfers (https://herrbischoff.com/2023/03/how-to-limit-bandwidth-usage-for-scp-transfers/)
Beastie Bits
OpenSolaris 11.4 running in a VM (https://www.reddit.com/r/unix/comments/14m90v2/oracle_solaris_114_running_in_a_virtual_machine/)
Celebrating 30 Years of FreeBSD – FreeBSD Journal Special Edition (https://freebsdfoundation.org/blog/celebrating-30-years-of-freebsd-freebsd-journal-special-edition/)
Some ways you can contribute to open source software without writing code (https://twitter.com/cperciva/status/1673215499365384194?s=52&amp;amp;t=-_bfM_adaiX8Ri_3lN9OYw)
ScreenCapture if you don't have a twitter account (https://i.imgur.com/5AlqBlO.png)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
New BSD Now Telegram Channel
We now have a new BSD Now Telegram channel that anyone can join.  Conversations don’t have to just be about the show, anything BSD, Unix, or *nix in general is fair game. https://t.me/bsdnow
Feedback/Questions
Johnny - 512 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/519/feedback/Johnny%20-%20512.md)
Matthew - 512 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/519/feedback/Matthew%20-%20512.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, advantages, server, release schedule, stream, streaming, desktop audio, DOD, KSOS, secure, bandwidth limit, scp, secure copy</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>3 Advantages to Running FreeBSD as Your Server OS, FreeBSD 14 Release Schedule, Stream your OpenBSD desktop audio, DOD KSOS Secure UNIX Operating System Manual, How to limit bandwidth usage with SCP transfers, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-3-advantages-to-running-freebsd-as-your-server-operating-system/" rel="nofollow">3 Advantages to Running FreeBSD as Your Server Operating System</a></h3>

<hr>

<h3><a href="https://www.freebsd.org/releases/14.0R/" rel="nofollow">FreeBSD 14 Release Schedule</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-05-05-openbsd-sound-streaming.html" rel="nofollow">Stream your OpenBSD desktop audio to other devices</a></h3>

<hr>

<h3><a href="https://www.tuhs.org/pipermail/tuhs/2023-June/028441.html" rel="nofollow">DOD KSOS Secure UNIX Operating System Manual and Final Report</a></h3>

<hr>

<h3><a href="https://herrbischoff.com/2023/03/how-to-limit-bandwidth-usage-for-scp-transfers/" rel="nofollow">How to limit bandwidth usage with SCP transfers</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.reddit.com/r/unix/comments/14m90v2/oracle_solaris_114_running_in_a_virtual_machine/" rel="nofollow">OpenSolaris 11.4 running in a VM</a></li>
<li><a href="https://freebsdfoundation.org/blog/celebrating-30-years-of-freebsd-freebsd-journal-special-edition/" rel="nofollow">Celebrating 30 Years of FreeBSD – FreeBSD Journal Special Edition</a></li>
<li><a href="https://twitter.com/cperciva/status/1673215499365384194?s=52&t=-_bfM_adaiX8Ri_3lN9OYw" rel="nofollow">Some ways you can contribute to open source software without writing code</a>

<ul>
<li><a href="https://i.imgur.com/5AlqBlO.png" rel="nofollow">ScreenCapture if you don&#39;t have a twitter account</a></li>
</ul></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h3>New BSD Now Telegram Channel</h3>

<ul>
<li>We now have a new BSD Now Telegram channel that anyone can join.  Conversations don’t have to just be about the show, anything BSD, Unix, or *nix in general is fair game. <a href="https://t.me/bsdnow" rel="nofollow">https://t.me/bsdnow</a></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/519/feedback/Johnny%20-%20512.md" rel="nofollow">Johnny - 512</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/519/feedback/Matthew%20-%20512.md" rel="nofollow">Matthew - 512</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>3 Advantages to Running FreeBSD as Your Server OS, FreeBSD 14 Release Schedule, Stream your OpenBSD desktop audio, DOD KSOS Secure UNIX Operating System Manual, How to limit bandwidth usage with SCP transfers, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-3-advantages-to-running-freebsd-as-your-server-operating-system/" rel="nofollow">3 Advantages to Running FreeBSD as Your Server Operating System</a></h3>

<hr>

<h3><a href="https://www.freebsd.org/releases/14.0R/" rel="nofollow">FreeBSD 14 Release Schedule</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-05-05-openbsd-sound-streaming.html" rel="nofollow">Stream your OpenBSD desktop audio to other devices</a></h3>

<hr>

<h3><a href="https://www.tuhs.org/pipermail/tuhs/2023-June/028441.html" rel="nofollow">DOD KSOS Secure UNIX Operating System Manual and Final Report</a></h3>

<hr>

<h3><a href="https://herrbischoff.com/2023/03/how-to-limit-bandwidth-usage-for-scp-transfers/" rel="nofollow">How to limit bandwidth usage with SCP transfers</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.reddit.com/r/unix/comments/14m90v2/oracle_solaris_114_running_in_a_virtual_machine/" rel="nofollow">OpenSolaris 11.4 running in a VM</a></li>
<li><a href="https://freebsdfoundation.org/blog/celebrating-30-years-of-freebsd-freebsd-journal-special-edition/" rel="nofollow">Celebrating 30 Years of FreeBSD – FreeBSD Journal Special Edition</a></li>
<li><a href="https://twitter.com/cperciva/status/1673215499365384194?s=52&t=-_bfM_adaiX8Ri_3lN9OYw" rel="nofollow">Some ways you can contribute to open source software without writing code</a>

<ul>
<li><a href="https://i.imgur.com/5AlqBlO.png" rel="nofollow">ScreenCapture if you don&#39;t have a twitter account</a></li>
</ul></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h3>New BSD Now Telegram Channel</h3>

<ul>
<li>We now have a new BSD Now Telegram channel that anyone can join.  Conversations don’t have to just be about the show, anything BSD, Unix, or *nix in general is fair game. <a href="https://t.me/bsdnow" rel="nofollow">https://t.me/bsdnow</a></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/519/feedback/Johnny%20-%20512.md" rel="nofollow">Johnny - 512</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/519/feedback/Matthew%20-%20512.md" rel="nofollow">Matthew - 512</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>518: Unix Edition Zero</title>
  <link>https://www.bsdnow.tv/518</link>
  <guid isPermaLink="false">a8dc2e06-ce32-4c8c-a282-35950bee26fc</guid>
  <pubDate>Thu, 03 Aug 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a8dc2e06-ce32-4c8c-a282-35950bee26fc.mp3" length="54445440" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A Guide to Problem-Solving for Software Developers with Examples, making 20% time work, Long Live Netbooks, OpenBSD Router on Sg105w, Set Up a Simple and Actually Working Wireguard Server, Unix Edition Zero, how to be a -10x engineer, and more</itunes:subtitle>
  <itunes:duration>56:42</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A Guide to Problem-Solving for Software Developers with Examples, making 20% time work, Long Live Netbooks, OpenBSD Router on Sg105w, Set Up a Simple and Actually Working Wireguard Server, Unix Edition Zero, how to be a -10x engineer, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
A Guide to Problem-Solving for Software Developers with Examples (https://thevaluable.dev/problem_solving_guide_software_developer)
Making 20% time work (https://begriffs.com/posts/2016-01-29-making-twenty-percent-time-work.html)
News Roundup
Long live netbooks! (https://sebastiano.tronto.net/blog/2022-09-10-netbooks/)
OpenBSD Router on Sg105w (https://evolving-architecture.eu/openbsd-router-sg105w/)
FreeBSD: How to Set Up a Simple and Actually Working Wireguard Server (https://herrbischoff.com/2023/04/freebsd-how-to-set-up-a-simple-and-actually-working-wireguard-server/)
How to be a -10x Engineer (https://taylor.town/-10x)
Unix Edition Zero (http://doc.cat-v.org/unix/v0/)
Beastie Bits
Game of Trees 0.90 released (https://undeadly.org/cgi?action=article;sid=20230624054334)
ZFSp (https://github.com/alcarithemad/zfsp)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, problem-solving, 20 percent, time, netbooks, long live, OpenBSD Router, sg105w, wireguard, server, edition zero, -10x engineer</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A Guide to Problem-Solving for Software Developers with Examples, making 20% time work, Long Live Netbooks, OpenBSD Router on Sg105w, Set Up a Simple and Actually Working Wireguard Server, Unix Edition Zero, how to be a -10x engineer, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://thevaluable.dev/problem_solving_guide_software_developer" rel="nofollow">A Guide to Problem-Solving for Software Developers with Examples</a></h3>

<hr>

<h3><a href="https://begriffs.com/posts/2016-01-29-making-twenty-percent-time-work.html" rel="nofollow">Making 20% time work</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://sebastiano.tronto.net/blog/2022-09-10-netbooks/" rel="nofollow">Long live netbooks!</a></h3>

<hr>

<h3><a href="https://evolving-architecture.eu/openbsd-router-sg105w/" rel="nofollow">OpenBSD Router on Sg105w</a></h3>

<hr>

<h3><a href="https://herrbischoff.com/2023/04/freebsd-how-to-set-up-a-simple-and-actually-working-wireguard-server/" rel="nofollow">FreeBSD: How to Set Up a Simple and Actually Working Wireguard Server</a></h3>

<hr>

<h3><a href="https://taylor.town/-10x" rel="nofollow">How to be a -10x Engineer</a></h3>

<hr>

<h3><a href="http://doc.cat-v.org/unix/v0/" rel="nofollow">Unix Edition Zero</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://undeadly.org/cgi?action=article;sid=20230624054334" rel="nofollow">Game of Trees 0.90 released</a></p></li>
<li><p><a href="https://github.com/alcarithemad/zfsp" rel="nofollow">ZFSp</a></p>

<hr>

<h3>Tarsnap</h3></li>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A Guide to Problem-Solving for Software Developers with Examples, making 20% time work, Long Live Netbooks, OpenBSD Router on Sg105w, Set Up a Simple and Actually Working Wireguard Server, Unix Edition Zero, how to be a -10x engineer, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://thevaluable.dev/problem_solving_guide_software_developer" rel="nofollow">A Guide to Problem-Solving for Software Developers with Examples</a></h3>

<hr>

<h3><a href="https://begriffs.com/posts/2016-01-29-making-twenty-percent-time-work.html" rel="nofollow">Making 20% time work</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://sebastiano.tronto.net/blog/2022-09-10-netbooks/" rel="nofollow">Long live netbooks!</a></h3>

<hr>

<h3><a href="https://evolving-architecture.eu/openbsd-router-sg105w/" rel="nofollow">OpenBSD Router on Sg105w</a></h3>

<hr>

<h3><a href="https://herrbischoff.com/2023/04/freebsd-how-to-set-up-a-simple-and-actually-working-wireguard-server/" rel="nofollow">FreeBSD: How to Set Up a Simple and Actually Working Wireguard Server</a></h3>

<hr>

<h3><a href="https://taylor.town/-10x" rel="nofollow">How to be a -10x Engineer</a></h3>

<hr>

<h3><a href="http://doc.cat-v.org/unix/v0/" rel="nofollow">Unix Edition Zero</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://undeadly.org/cgi?action=article;sid=20230624054334" rel="nofollow">Game of Trees 0.90 released</a></p></li>
<li><p><a href="https://github.com/alcarithemad/zfsp" rel="nofollow">ZFSp</a></p>

<hr>

<h3>Tarsnap</h3></li>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>517: Huge pfsync rewrite</title>
  <link>https://www.bsdnow.tv/517</link>
  <guid isPermaLink="false">d8d9cac6-5c23-4f07-b6ad-253890b79d72</guid>
  <pubDate>Thu, 27 Jul 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d8d9cac6-5c23-4f07-b6ad-253890b79d72.mp3" length="44959104" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Linux and FreeBSD Firewalls Comparison Part 2, 27 Years with the Perfect OS, Top 20 OpenSSH Server Best Security Practices, Huge pfsync rewrite, OpenSMTPD 7.3.0p1 release, Running OpenBSD 7.3 on your laptop is really hard (not), and more</itunes:subtitle>
  <itunes:duration>46:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Linux and FreeBSD Firewalls Comparison Part 2, 27 Years with the Perfect OS, Top 20 OpenSSH Server Best Security Practices, Huge pfsync rewrite, OpenSMTPD 7.3.0p1 release, Running OpenBSD 7.3 on your laptop is really hard (not), and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Linux and FreeBSD Firewalls – The Ultimate Guide - Part 2 (https://klarasystems.com/articles/freebsd-linux-and-freebsd-firewalls-part-2/)
27 Years with the Perfect OS (https://peter.czanik.hu/posts/freebsd-the-perfect-os/)
News Roundup
Top 20 OpenSSH Server Best Security Practices (https://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html)
Huge pfsync rewrite (https://marc.info/?l=openbsd-tech&amp;amp;m=168732121711177&amp;amp;w=2)
OpenSMTPD 7.3.0p1 released (https://www.mail-archive.com/misc@opensmtpd.org/msg05909.html)
Running OpenBSD 7.3 on your laptop is really hard (not) (https://sohcahtoa.org.uk/openbsd.html)
QuicSSH (https://github.com/moul/quicssh)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, comparison, 27 years, perfect os, security practices, pfsync, opensmtpd, laptop </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Linux and FreeBSD Firewalls Comparison Part 2, 27 Years with the Perfect OS, Top 20 OpenSSH Server Best Security Practices, Huge pfsync rewrite, OpenSMTPD 7.3.0p1 release, Running OpenBSD 7.3 on your laptop is really hard (not), and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-linux-and-freebsd-firewalls-part-2/" rel="nofollow">Linux and FreeBSD Firewalls – The Ultimate Guide - Part 2</a></h3>

<hr>

<h3><a href="https://peter.czanik.hu/posts/freebsd-the-perfect-os/" rel="nofollow">27 Years with the Perfect OS</a></h3>

<hr>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html" rel="nofollow">Top 20 OpenSSH Server Best Security Practices</a></h3>

<hr>

<h3><a href="https://marc.info/?l=openbsd-tech&m=168732121711177&w=2" rel="nofollow">Huge pfsync rewrite</a></h3>

<hr>

<h3><a href="https://www.mail-archive.com/misc@opensmtpd.org/msg05909.html" rel="nofollow">OpenSMTPD 7.3.0p1 released</a></h3>

<hr>

<h3><a href="https://sohcahtoa.org.uk/openbsd.html" rel="nofollow">Running OpenBSD 7.3 on your laptop is really hard (not)</a></h3>

<hr>

<h3><a href="https://github.com/moul/quicssh" rel="nofollow">QuicSSH</a></h3>

<hr>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Linux and FreeBSD Firewalls Comparison Part 2, 27 Years with the Perfect OS, Top 20 OpenSSH Server Best Security Practices, Huge pfsync rewrite, OpenSMTPD 7.3.0p1 release, Running OpenBSD 7.3 on your laptop is really hard (not), and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-linux-and-freebsd-firewalls-part-2/" rel="nofollow">Linux and FreeBSD Firewalls – The Ultimate Guide - Part 2</a></h3>

<hr>

<h3><a href="https://peter.czanik.hu/posts/freebsd-the-perfect-os/" rel="nofollow">27 Years with the Perfect OS</a></h3>

<hr>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html" rel="nofollow">Top 20 OpenSSH Server Best Security Practices</a></h3>

<hr>

<h3><a href="https://marc.info/?l=openbsd-tech&m=168732121711177&w=2" rel="nofollow">Huge pfsync rewrite</a></h3>

<hr>

<h3><a href="https://www.mail-archive.com/misc@opensmtpd.org/msg05909.html" rel="nofollow">OpenSMTPD 7.3.0p1 released</a></h3>

<hr>

<h3><a href="https://sohcahtoa.org.uk/openbsd.html" rel="nofollow">Running OpenBSD 7.3 on your laptop is really hard (not)</a></h3>

<hr>

<h3><a href="https://github.com/moul/quicssh" rel="nofollow">QuicSSH</a></h3>

<hr>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>516: Computer Time Origins</title>
  <link>https://www.bsdnow.tv/516</link>
  <guid isPermaLink="false">c8e97371-fb6b-48dc-97fe-8de45cd0e49c</guid>
  <pubDate>Thu, 20 Jul 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c8e97371-fb6b-48dc-97fe-8de45cd0e49c.mp3" length="44272128" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Linux and FreeBSD Firewalls Part 1, Why Netflix Chose NGINX as the Heart of Its CDN, Protect your web servers against PHP shells and malwares, Installing and running Gitlab howto, and more</itunes:subtitle>
  <itunes:duration>46:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Linux and FreeBSD Firewalls Part 1, Why Netflix Chose NGINX as the Heart of Its CDN, Protect your web servers against PHP shells and malwares, Installing and running Gitlab howto, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Linux vs. FreeBSD : Linux and FreeBSD Firewalls – The Ultimate Guide : Part 1 (https://klarasystems.com/articles/freebsd-linux-and-freebsd-firewalls/)
Why Netflix Chose NGINX as the Heart of Its CDN (https://www.nginx.com/blog/why-netflix-chose-nginx-as-the-heart-of-its-cdn/)
News Roundup
FreeBSD: Protect your web servers against PHP shells and malwares (https://ozgurkazancci.com/freebsd-protect-your-web-server-against-php-shells-and-malwares/)
HowTo: Installing and running Gitlab (https://forums.FreeBSD.org/threads/howto-installing-and-running-gitlab.89436/)
Beastie Bits
• [World built in 36 hours on a Pentium 4!](https://www.reddit.com/r/freebsd/comments/13undl9/world_built_in_36_hours_on_a_pentium_4/)
• [Fart init](https://x61.sh/log/2023/05/23052023153621-fart-init.html](https://x61.sh/log/2023/05/23052023153621-fart-init.html)
• [Organized Freebies](https://mwl.io/archives/22832)
• [OpenSMTPD 7.3.0p0 released](http://undeadly.org/cgi?action=article;sid=20230617111340)
• [shutdown/reboot now require membership of group _shutdown](http://undeadly.org/cgi?action=article;sid=20230620064255)
• [Where does my computer get the time from?](https://dotat.at/@/2023-05-26-whence-time.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***
Feedback/Questions
sam - fav episodes (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/sam%20-%20fav%20episodes.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, firewalls, comparison, time, system clock, web server, php shell, malware, netflix, nginx, cdn, gitlab</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Linux and FreeBSD Firewalls Part 1, Why Netflix Chose NGINX as the Heart of Its CDN, Protect your web servers against PHP shells and malwares, Installing and running Gitlab howto, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-linux-and-freebsd-firewalls/" rel="nofollow">Linux vs. FreeBSD : Linux and FreeBSD Firewalls – The Ultimate Guide : Part 1</a></h3>

<hr>

<h3><a href="https://www.nginx.com/blog/why-netflix-chose-nginx-as-the-heart-of-its-cdn/" rel="nofollow">Why Netflix Chose NGINX as the Heart of Its CDN</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://ozgurkazancci.com/freebsd-protect-your-web-server-against-php-shells-and-malwares/" rel="nofollow">FreeBSD: Protect your web servers against PHP shells and malwares</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/howto-installing-and-running-gitlab.89436/" rel="nofollow">HowTo: Installing and running Gitlab</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [World built in 36 hours on a Pentium 4!](https://www.reddit.com/r/freebsd/comments/13undl9/world_built_in_36_hours_on_a_pentium_4/)
• [Fart init](https://x61.sh/log/2023/05/23052023153621-fart-init.html](https://x61.sh/log/2023/05/23052023153621-fart-init.html)
• [Organized Freebies](https://mwl.io/archives/22832)
• [OpenSMTPD 7.3.0p0 released](http://undeadly.org/cgi?action=article;sid=20230617111340)
• [shutdown/reboot now require membership of group _shutdown](http://undeadly.org/cgi?action=article;sid=20230620064255)
• [Where does my computer get the time from?](https://dotat.at/@/2023-05-26-whence-time.html)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/sam%20-%20fav%20episodes.md" rel="nofollow">sam - fav episodes</a></li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Linux and FreeBSD Firewalls Part 1, Why Netflix Chose NGINX as the Heart of Its CDN, Protect your web servers against PHP shells and malwares, Installing and running Gitlab howto, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-linux-and-freebsd-firewalls/" rel="nofollow">Linux vs. FreeBSD : Linux and FreeBSD Firewalls – The Ultimate Guide : Part 1</a></h3>

<hr>

<h3><a href="https://www.nginx.com/blog/why-netflix-chose-nginx-as-the-heart-of-its-cdn/" rel="nofollow">Why Netflix Chose NGINX as the Heart of Its CDN</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://ozgurkazancci.com/freebsd-protect-your-web-server-against-php-shells-and-malwares/" rel="nofollow">FreeBSD: Protect your web servers against PHP shells and malwares</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/howto-installing-and-running-gitlab.89436/" rel="nofollow">HowTo: Installing and running Gitlab</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [World built in 36 hours on a Pentium 4!](https://www.reddit.com/r/freebsd/comments/13undl9/world_built_in_36_hours_on_a_pentium_4/)
• [Fart init](https://x61.sh/log/2023/05/23052023153621-fart-init.html](https://x61.sh/log/2023/05/23052023153621-fart-init.html)
• [Organized Freebies](https://mwl.io/archives/22832)
• [OpenSMTPD 7.3.0p0 released](http://undeadly.org/cgi?action=article;sid=20230617111340)
• [shutdown/reboot now require membership of group _shutdown](http://undeadly.org/cgi?action=article;sid=20230620064255)
• [Where does my computer get the time from?](https://dotat.at/@/2023-05-26-whence-time.html)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/sam%20-%20fav%20episodes.md" rel="nofollow">sam - fav episodes</a></li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>515: ChatGPT writing pf.conf</title>
  <link>https://www.bsdnow.tv/515</link>
  <guid isPermaLink="false">cfdb4845-82f8-4698-8b0a-0eddc33e66a8</guid>
  <pubDate>Thu, 13 Jul 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cfdb4845-82f8-4698-8b0a-0eddc33e66a8.mp3" length="38652288" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD or Linux – A Choice Without OS Wars, The Computer Scientist Who Can’t Stop Telling Stories, ChatGPT was asked to write a pf.conf to spec, GhostBSD 23.06.1 is now available, OPNsense 23.1.9 released, Running VSCode in Chromium on OpenBSD, and more</itunes:subtitle>
  <itunes:duration>40:15</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD or Linux – A Choice Without OS Wars, The Computer Scientist Who Can’t Stop Telling Stories, ChatGPT was asked to write a pf.conf to spec, GhostBSD 23.06.1 is now available, OPNsense 23.1.9 released, Running VSCode in Chromium on OpenBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Linux vs. FreeBSD : FreeBSD or Linux – A Choice Without OS Wars (https://klarasystems.com/articles/choosing-between-freebsd-and-linux-a-choice-without-os-wars/)
The Computer Scientist Who Can’t Stop Telling Stories (https://www.quantamagazine.org/computer-scientist-donald-knuth-cant-stop-telling-stories-20200416/)
I asked ChatGPT to write a pf.conf to spec, 2023-06-07 version (https://bsdly.blogspot.com/2023/06/i-asked-chatgpt-to-write-pfconf-to-spec.html)
News Roundup
GhostBSD 23.06.1 is now available (https://ghostbsd.org/23.06.01_iso_is_now_available)
OPNsense 23.1.9 released (https://forum.opnsense.org/index.php?topic=34282.0)
Running VSCode in Chromium on OpenBSD (https://bt.ht/vscode/)
COFF: Bell Labs vs "East Coast" Management style of AT&amp;amp;T (https://www.tuhs.org/pipermail/coff/2023-May/001556.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Matt - Wireguard (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/Matt%20-%20Wiregaurd.md)
Oscar - ISC.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/Oscar%20-%20ISC.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, Linux, os wars, story telling, computer scientist, chatgpt, pf.conf, packet filter, ghostbsd 23.06.01, opnsense 23.1.9, vscode, visual studio code, chromium</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD or Linux – A Choice Without OS Wars, The Computer Scientist Who Can’t Stop Telling Stories, ChatGPT was asked to write a pf.conf to spec, GhostBSD 23.06.1 is now available, OPNsense 23.1.9 released, Running VSCode in Chromium on OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/choosing-between-freebsd-and-linux-a-choice-without-os-wars/" rel="nofollow">Linux vs. FreeBSD : FreeBSD or Linux – A Choice Without OS Wars</a></h3>

<hr>

<h3><a href="https://www.quantamagazine.org/computer-scientist-donald-knuth-cant-stop-telling-stories-20200416/" rel="nofollow">The Computer Scientist Who Can’t Stop Telling Stories</a></h3>

<hr>

<h3><a href="https://bsdly.blogspot.com/2023/06/i-asked-chatgpt-to-write-pfconf-to-spec.html" rel="nofollow">I asked ChatGPT to write a pf.conf to spec, 2023-06-07 version</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://ghostbsd.org/23.06.01_iso_is_now_available" rel="nofollow">GhostBSD 23.06.1 is now available</a></h3>

<hr>

<h3><a href="https://forum.opnsense.org/index.php?topic=34282.0" rel="nofollow">OPNsense 23.1.9 released</a></h3>

<hr>

<h3><a href="https://bt.ht/vscode/" rel="nofollow">Running VSCode in Chromium on OpenBSD</a></h3>

<hr>

<h3><a href="https://www.tuhs.org/pipermail/coff/2023-May/001556.html" rel="nofollow">COFF: Bell Labs vs &quot;East Coast&quot; Management style of AT&amp;T</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/Matt%20-%20Wiregaurd.md" rel="nofollow">Matt - Wireguard</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/Oscar%20-%20ISC.md" rel="nofollow">Oscar - ISC.md</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD or Linux – A Choice Without OS Wars, The Computer Scientist Who Can’t Stop Telling Stories, ChatGPT was asked to write a pf.conf to spec, GhostBSD 23.06.1 is now available, OPNsense 23.1.9 released, Running VSCode in Chromium on OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/choosing-between-freebsd-and-linux-a-choice-without-os-wars/" rel="nofollow">Linux vs. FreeBSD : FreeBSD or Linux – A Choice Without OS Wars</a></h3>

<hr>

<h3><a href="https://www.quantamagazine.org/computer-scientist-donald-knuth-cant-stop-telling-stories-20200416/" rel="nofollow">The Computer Scientist Who Can’t Stop Telling Stories</a></h3>

<hr>

<h3><a href="https://bsdly.blogspot.com/2023/06/i-asked-chatgpt-to-write-pfconf-to-spec.html" rel="nofollow">I asked ChatGPT to write a pf.conf to spec, 2023-06-07 version</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://ghostbsd.org/23.06.01_iso_is_now_available" rel="nofollow">GhostBSD 23.06.1 is now available</a></h3>

<hr>

<h3><a href="https://forum.opnsense.org/index.php?topic=34282.0" rel="nofollow">OPNsense 23.1.9 released</a></h3>

<hr>

<h3><a href="https://bt.ht/vscode/" rel="nofollow">Running VSCode in Chromium on OpenBSD</a></h3>

<hr>

<h3><a href="https://www.tuhs.org/pipermail/coff/2023-May/001556.html" rel="nofollow">COFF: Bell Labs vs &quot;East Coast&quot; Management style of AT&amp;T</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/Matt%20-%20Wiregaurd.md" rel="nofollow">Matt - Wireguard</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/Oscar%20-%20ISC.md" rel="nofollow">Oscar - ISC.md</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>514: Infecting Public Keys</title>
  <link>https://www.bsdnow.tv/514</link>
  <guid isPermaLink="false">1ad867e2-c191-48e0-88e0-8c42831d40c7</guid>
  <pubDate>Thu, 06 Jul 2023 06:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1ad867e2-c191-48e0-88e0-8c42831d40c7.mp3" length="46575744" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS, Your Data and the Challenge of Ransomware, I Didn’t Learn Unix By Reading All The Manpages, I try to answer "how to become a systems engineer", Writing shell scripts in Nushell, Sudo and signal propagation, infecting SSH Public Keys with backdoors, OpenBSD Thinkpad, and more</itunes:subtitle>
  <itunes:duration>48:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS, Your Data and the Challenge of Ransomware, I Didn’t Learn Unix By Reading All The Manpages, I try to answer "how to become a systems engineer", Writing shell scripts in Nushell, Sudo and signal propagation, infecting SSH Public Keys with backdoors, OpenBSD Thinkpad, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenZFS, Your Data and the Challenge of Ransomware (https://klarasystems.com/articles/openzfs-openzfs-your-data-and-the-challenge-of-ransomware/)
I Didn’t Learn Unix By Reading All The Manpages (https://www.owlfolio.org/research/i-didnt-learn-unix-by-reading-all-the-manpages/)
News Roundup
Feedback: I try to answer "how to become a systems engineer" (https://rachelbythebay.com/w/2023/05/30/eng/)
Writing shell scripts in Nushell (https://jpospisil.com/2023/05/25/writing-shell-scripts-in-nushell)
Sudo and signal propagation (https://dxuuu.xyz/sudo.html)
Infecting SSH Public Keys with backdoors (https://blog.thc.org/infecting-ssh-public-keys-with-backdoors)
OpenBSD Thinkpad (https://douglasrumbaugh.com/post/openbsd-thinkpad-good/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, ransomware, snapshot, rollback, man pages, systems engineer, nushell, shell script, signal propagation, sudo, public key, backdoor, thinkpad</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS, Your Data and the Challenge of Ransomware, I Didn’t Learn Unix By Reading All The Manpages, I try to answer &quot;how to become a systems engineer&quot;, Writing shell scripts in Nushell, Sudo and signal propagation, infecting SSH Public Keys with backdoors, OpenBSD Thinkpad, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-openzfs-your-data-and-the-challenge-of-ransomware/" rel="nofollow">OpenZFS, Your Data and the Challenge of Ransomware</a></h3>

<hr>

<h3><a href="https://www.owlfolio.org/research/i-didnt-learn-unix-by-reading-all-the-manpages/" rel="nofollow">I Didn’t Learn Unix By Reading All The Manpages</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://rachelbythebay.com/w/2023/05/30/eng/" rel="nofollow">Feedback: I try to answer &quot;how to become a systems engineer&quot;</a></h3>

<hr>

<h3><a href="https://jpospisil.com/2023/05/25/writing-shell-scripts-in-nushell" rel="nofollow">Writing shell scripts in Nushell</a></h3>

<hr>

<h3><a href="https://dxuuu.xyz/sudo.html" rel="nofollow">Sudo and signal propagation</a></h3>

<hr>

<h3><a href="https://blog.thc.org/infecting-ssh-public-keys-with-backdoors" rel="nofollow">Infecting SSH Public Keys with backdoors</a></h3>

<hr>

<h3><a href="https://douglasrumbaugh.com/post/openbsd-thinkpad-good/" rel="nofollow">OpenBSD Thinkpad</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS, Your Data and the Challenge of Ransomware, I Didn’t Learn Unix By Reading All The Manpages, I try to answer &quot;how to become a systems engineer&quot;, Writing shell scripts in Nushell, Sudo and signal propagation, infecting SSH Public Keys with backdoors, OpenBSD Thinkpad, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-openzfs-your-data-and-the-challenge-of-ransomware/" rel="nofollow">OpenZFS, Your Data and the Challenge of Ransomware</a></h3>

<hr>

<h3><a href="https://www.owlfolio.org/research/i-didnt-learn-unix-by-reading-all-the-manpages/" rel="nofollow">I Didn’t Learn Unix By Reading All The Manpages</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://rachelbythebay.com/w/2023/05/30/eng/" rel="nofollow">Feedback: I try to answer &quot;how to become a systems engineer&quot;</a></h3>

<hr>

<h3><a href="https://jpospisil.com/2023/05/25/writing-shell-scripts-in-nushell" rel="nofollow">Writing shell scripts in Nushell</a></h3>

<hr>

<h3><a href="https://dxuuu.xyz/sudo.html" rel="nofollow">Sudo and signal propagation</a></h3>

<hr>

<h3><a href="https://blog.thc.org/infecting-ssh-public-keys-with-backdoors" rel="nofollow">Infecting SSH Public Keys with backdoors</a></h3>

<hr>

<h3><a href="https://douglasrumbaugh.com/post/openbsd-thinkpad-good/" rel="nofollow">OpenBSD Thinkpad</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>513: New Host Interview</title>
  <link>https://www.bsdnow.tv/513</link>
  <guid isPermaLink="false">46ee8a53-e46a-4e48-a99e-bb347c35e8e0</guid>
  <pubDate>Thu, 29 Jun 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/46ee8a53-e46a-4e48-a99e-bb347c35e8e0.mp3" length="51267072" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We have a new show host, Understanding ZFS vdev Types, Don't abuse su for dropping user privileges, Dynamic Tracing on OpenBSD 7.3, new Libressl, Manual Jails on FreeBSD 12, and more</itunes:subtitle>
  <itunes:duration>53:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We have a new show host, Understanding ZFS vdev Types, Don't abuse su for dropping user privileges, Dynamic Tracing on OpenBSD 7.3, new Libressl, Manual Jails on FreeBSD 12, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Host Introductions - Jason Tubnor - https://www.tubsta.com (https://www.tubsta.com) / @tubsta (https://twitter.com/tubsta) / @Tubsta@soc.feditime.com (https://soc.feditime.com)
Headlines
Understanding ZFS vdev Types (https://klarasystems.com/articles/openzfs-understanding-zfs-vdev-types/)
Don't abuse su for dropping user privileges (https://jdebp.uk/FGA/dont-abuse-su-for-dropping-privileges.html)
News Roundup
Dynamic Tracing on OpenBSD 7.3 (https://blog.lambda.cx/posts/openbsd-dynamic-tracing/)
new Libressl (https://undeadly.org/cgi?action=article;sid=20230528115900)
Manual Jails on FreeBSD 12 (https://ogris.de/howtos/freebsd-jails.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Chris - questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Chris%20-%20questions.md)
Dan - zfs questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Dan%20-%20zfs%20questions.md)
Pablo - Jail question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Pablo%20-%20Jail%20question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, vdev types, dropping privileges, dtrace, dynamic tracing, process tracing, libressl</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We have a new show host, Understanding ZFS vdev Types, Don&#39;t abuse su for dropping user privileges, Dynamic Tracing on OpenBSD 7.3, new Libressl, Manual Jails on FreeBSD 12, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Host Introductions - Jason Tubnor - <a href="https://www.tubsta.com" rel="nofollow">https://www.tubsta.com</a> / <a href="https://twitter.com/tubsta" rel="nofollow">@tubsta</a> / <a href="https://soc.feditime.com" rel="nofollow">@Tubsta@soc.feditime.com</a></h2>

<hr>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-understanding-zfs-vdev-types/" rel="nofollow">Understanding ZFS vdev Types</a></h3>

<hr>

<h3><a href="https://jdebp.uk/FGA/dont-abuse-su-for-dropping-privileges.html" rel="nofollow">Don&#39;t abuse su for dropping user privileges</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.lambda.cx/posts/openbsd-dynamic-tracing/" rel="nofollow">Dynamic Tracing on OpenBSD 7.3</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20230528115900" rel="nofollow">new Libressl</a></h3>

<hr>

<h3><a href="https://ogris.de/howtos/freebsd-jails.html" rel="nofollow">Manual Jails on FreeBSD 12</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Chris%20-%20questions.md" rel="nofollow">Chris - questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Dan%20-%20zfs%20questions.md" rel="nofollow">Dan - zfs questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Pablo%20-%20Jail%20question.md" rel="nofollow">Pablo - Jail question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We have a new show host, Understanding ZFS vdev Types, Don&#39;t abuse su for dropping user privileges, Dynamic Tracing on OpenBSD 7.3, new Libressl, Manual Jails on FreeBSD 12, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Host Introductions - Jason Tubnor - <a href="https://www.tubsta.com" rel="nofollow">https://www.tubsta.com</a> / <a href="https://twitter.com/tubsta" rel="nofollow">@tubsta</a> / <a href="https://soc.feditime.com" rel="nofollow">@Tubsta@soc.feditime.com</a></h2>

<hr>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-understanding-zfs-vdev-types/" rel="nofollow">Understanding ZFS vdev Types</a></h3>

<hr>

<h3><a href="https://jdebp.uk/FGA/dont-abuse-su-for-dropping-privileges.html" rel="nofollow">Don&#39;t abuse su for dropping user privileges</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.lambda.cx/posts/openbsd-dynamic-tracing/" rel="nofollow">Dynamic Tracing on OpenBSD 7.3</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20230528115900" rel="nofollow">new Libressl</a></h3>

<hr>

<h3><a href="https://ogris.de/howtos/freebsd-jails.html" rel="nofollow">Manual Jails on FreeBSD 12</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Chris%20-%20questions.md" rel="nofollow">Chris - questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Dan%20-%20zfs%20questions.md" rel="nofollow">Dan - zfs questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Pablo%20-%20Jail%20question.md" rel="nofollow">Pablo - Jail question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>512: BSDNow Live! 9 bits of BSDNow - Just speak into the goat</title>
  <link>https://www.bsdnow.tv/512</link>
  <guid isPermaLink="false">0c162628-7d5f-4c53-9637-be1b27ddafe2</guid>
  <pubDate>Thu, 22 Jun 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0c162628-7d5f-4c53-9637-be1b27ddafe2.mp3" length="38973696" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Recorded at BSDCan 2023</itunes:subtitle>
  <itunes:duration>40:35</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Recorded at BSDCan 2023
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
BSDNow - The early years
BSDNow - Production Process
News Roundup
FreeBSD Devsummit
BSDCan
Beastie Bits
 How you can help the show!
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Corey asks - what is the status of netbsd 10?
How have things changed in the bsds over the history of the show?
Announcement
As a final thing Allan would like to make an announcement:
- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Recorded at BSDCan 2023</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3>BSDNow - The early years</h3>

<hr>

<h2>BSDNow - Production Process</h2>

<hr>

<h2>News Roundup</h2>

<h3>FreeBSD Devsummit</h3>

<hr>

<h3>BSDCan</h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li> How you can help the show!</li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Corey asks - what is the status of netbsd 10?</li>
<li>How have things changed in the bsds over the history of the show?</li>
</ul>

<h2>Announcement</h2>

<p>As a final thing Allan would like to make an announcement:</p>

<hr>

<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></h2>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Recorded at BSDCan 2023</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3>BSDNow - The early years</h3>

<hr>

<h2>BSDNow - Production Process</h2>

<hr>

<h2>News Roundup</h2>

<h3>FreeBSD Devsummit</h3>

<hr>

<h3>BSDCan</h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li> How you can help the show!</li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Corey asks - what is the status of netbsd 10?</li>
<li>How have things changed in the bsds over the history of the show?</li>
</ul>

<h2>Announcement</h2>

<p>As a final thing Allan would like to make an announcement:</p>

<hr>

<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></h2>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>511: Against Innovation</title>
  <link>https://www.bsdnow.tv/511</link>
  <guid isPermaLink="false">6b99d11c-2ee7-450e-8446-d0ceed9be7b1</guid>
  <pubDate>Thu, 15 Jun 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6b99d11c-2ee7-450e-8446-d0ceed9be7b1.mp3" length="48869760" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Sun Ray laptops, MIPS and getting root on them, OpenZFS for HPC Clusters, Self-Hosted Bookmarks using DAV and httpd on OpenBSD, Terraform + Proxmox + OpenBSD = &lt;3, WOL Plex Server, Against innovation, and more</itunes:subtitle>
  <itunes:duration>50:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Sun Ray laptops, MIPS and getting root on them, OpenZFS for HPC Clusters, Self-Hosted Bookmarks using DAV and httpd on OpenBSD, Terraform + Proxmox + OpenBSD = &amp;lt;3, WOL Plex Server, Against innovation, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Of Sun Ray laptops, MIPS and getting root on them (https://oldvcr.blogspot.com/2023/04/of-sun-ray-laptops-mips-and-getting.html)
OpenZFS for HPC Clusters (https://klarasystems.com/articles/openzfs-openzfs-for-hpc-clusters/)
News Roundup
Self-Hosted Bookmarks using DAV and httpd on OpenBSD (https://www.tumfatig.net/2023/self-hosted-bookmarks-using-dav-and-httpd-on-openbsd/)
Terraform + Proxmox + OpenBSD = &amp;lt;3 (https://x61.sh/log/2023/05/19052023172439-terraform_proxmox_openbsd.html)
WOL Plex Server (https://maximiliangolla.com/blog/2022-10-wol-plex-server/)
Against Innovation (https://dadadrummer.substack.com/p/against-innovation)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, Sun ray, laptop, MIPS, root, HPC, high performance computing, clusters, self-hosted, bookmarks, dav, httpd, terraform, proxmox, wol, plex, innovation</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Sun Ray laptops, MIPS and getting root on them, OpenZFS for HPC Clusters, Self-Hosted Bookmarks using DAV and httpd on OpenBSD, Terraform + Proxmox + OpenBSD = &lt;3, WOL Plex Server, Against innovation, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://oldvcr.blogspot.com/2023/04/of-sun-ray-laptops-mips-and-getting.html" rel="nofollow">Of Sun Ray laptops, MIPS and getting root on them</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/openzfs-openzfs-for-hpc-clusters/" rel="nofollow">OpenZFS for HPC Clusters</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.tumfatig.net/2023/self-hosted-bookmarks-using-dav-and-httpd-on-openbsd/" rel="nofollow">Self-Hosted Bookmarks using DAV and httpd on OpenBSD</a></h3>

<hr>

<h3><a href="https://x61.sh/log/2023/05/19052023172439-terraform_proxmox_openbsd.html" rel="nofollow">Terraform + Proxmox + OpenBSD = &lt;3</a></h3>

<hr>

<h3><a href="https://maximiliangolla.com/blog/2022-10-wol-plex-server/" rel="nofollow">WOL Plex Server</a></h3>

<hr>

<h3><a href="https://dadadrummer.substack.com/p/against-innovation" rel="nofollow">Against Innovation</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Sun Ray laptops, MIPS and getting root on them, OpenZFS for HPC Clusters, Self-Hosted Bookmarks using DAV and httpd on OpenBSD, Terraform + Proxmox + OpenBSD = &lt;3, WOL Plex Server, Against innovation, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://oldvcr.blogspot.com/2023/04/of-sun-ray-laptops-mips-and-getting.html" rel="nofollow">Of Sun Ray laptops, MIPS and getting root on them</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/openzfs-openzfs-for-hpc-clusters/" rel="nofollow">OpenZFS for HPC Clusters</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.tumfatig.net/2023/self-hosted-bookmarks-using-dav-and-httpd-on-openbsd/" rel="nofollow">Self-Hosted Bookmarks using DAV and httpd on OpenBSD</a></h3>

<hr>

<h3><a href="https://x61.sh/log/2023/05/19052023172439-terraform_proxmox_openbsd.html" rel="nofollow">Terraform + Proxmox + OpenBSD = &lt;3</a></h3>

<hr>

<h3><a href="https://maximiliangolla.com/blog/2022-10-wol-plex-server/" rel="nofollow">WOL Plex Server</a></h3>

<hr>

<h3><a href="https://dadadrummer.substack.com/p/against-innovation" rel="nofollow">Against Innovation</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>510: The BSD Slabtop</title>
  <link>https://www.bsdnow.tv/510</link>
  <guid isPermaLink="false">41751de6-aa32-4cde-8fde-ea62d98b6a4d</guid>
  <pubDate>Thu, 08 Jun 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/41751de6-aa32-4cde-8fde-ea62d98b6a4d.mp3" length="44800896" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>AsiaBSDCon 2023 Trip Report, Converting My X201 ThinkPad into a Slabtop, Stream your OpenBSD desktop audio to other devices, The Gnome and Its "Secret Place", ttyload, and more</itunes:subtitle>
  <itunes:duration>46:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>AsiaBSDCon 2023 Trip Report, Converting My X201 ThinkPad into a Slabtop, Stream your OpenBSD desktop audio to other devices, The Gnome and Its "Secret Place", ttyload, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
AsiaBSDCon 2023 Trip Report (https://freebsdfoundation.org/blog/asiabsdcon-2023-trip-report/)
Converting My X201 ThinkPad into a Slabtop (https://bt.ht/slabtop/)
News Roundup
Stream your OpenBSD desktop audio to other devices (https://dataswamp.org/~solene/2023-05-05-openbsd-sound-streaming.html)
The Gnome and Its "Secret Place" (https://www.tuhs.org/pipermail/tuhs/2023-May/028363.html)
ttyload - Linux/Unix color-coded graphical tracking tool for load average in a terminal (https://www.cyberciti.biz/open-source/command-line-hacks/ttyload-color-coded-graphical-tracking-tool-for-unixlinux-load-average-in-a-terminal/)
Beastie Bits
• [OpenIndiana with a Sun Microsystems 22" LCD monitor. Running on a 1.8GHz quad core AMD Phenom 9100e processor, 4Gb RAM, nVidia GEForce GT630.](https://www.reddit.com/r/unix/comments/13otjnt/openindiana_with_a_sun_microsystems_22_lcd/)
• [cron(8) now supports random ranges with steps](https://www.undeadly.org/cgi?action=article;sid=20230507122935&amp;amp;utm_source=bsdweekly)
• [BSDCan 2024 Reorganization](https://mwl.io/archives/22799)
• [Depenguin me](https://depenguin.me/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, asiabsdcon, trip report, Thinkpad, X201, slabtop, stream, audio, desktop, gnome, ttyload</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>AsiaBSDCon 2023 Trip Report, Converting My X201 ThinkPad into a Slabtop, Stream your OpenBSD desktop audio to other devices, The Gnome and Its &quot;Secret Place&quot;, ttyload, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/asiabsdcon-2023-trip-report/" rel="nofollow">AsiaBSDCon 2023 Trip Report</a></h3>

<hr>

<h3><a href="https://bt.ht/slabtop/" rel="nofollow">Converting My X201 ThinkPad into a Slabtop</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-05-05-openbsd-sound-streaming.html" rel="nofollow">Stream your OpenBSD desktop audio to other devices</a></h3>

<hr>

<h3><a href="https://www.tuhs.org/pipermail/tuhs/2023-May/028363.html" rel="nofollow">The Gnome and Its &quot;Secret Place&quot;</a></h3>

<hr>

<h3><a href="https://www.cyberciti.biz/open-source/command-line-hacks/ttyload-color-coded-graphical-tracking-tool-for-unixlinux-load-average-in-a-terminal/" rel="nofollow">ttyload - Linux/Unix color-coded graphical tracking tool for load average in a terminal</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [OpenIndiana with a Sun Microsystems 22&quot; LCD monitor. Running on a 1.8GHz quad core AMD Phenom 9100e processor, 4Gb RAM, nVidia GEForce GT630.](https://www.reddit.com/r/unix/comments/13otjnt/openindiana_with_a_sun_microsystems_22_lcd/)
• [cron(8) now supports random ranges with steps](https://www.undeadly.org/cgi?action=article;sid=20230507122935&amp;utm_source=bsdweekly)
• [BSDCan 2024 Reorganization](https://mwl.io/archives/22799)
• [Depenguin me](https://depenguin.me/)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>AsiaBSDCon 2023 Trip Report, Converting My X201 ThinkPad into a Slabtop, Stream your OpenBSD desktop audio to other devices, The Gnome and Its &quot;Secret Place&quot;, ttyload, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/asiabsdcon-2023-trip-report/" rel="nofollow">AsiaBSDCon 2023 Trip Report</a></h3>

<hr>

<h3><a href="https://bt.ht/slabtop/" rel="nofollow">Converting My X201 ThinkPad into a Slabtop</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-05-05-openbsd-sound-streaming.html" rel="nofollow">Stream your OpenBSD desktop audio to other devices</a></h3>

<hr>

<h3><a href="https://www.tuhs.org/pipermail/tuhs/2023-May/028363.html" rel="nofollow">The Gnome and Its &quot;Secret Place&quot;</a></h3>

<hr>

<h3><a href="https://www.cyberciti.biz/open-source/command-line-hacks/ttyload-color-coded-graphical-tracking-tool-for-unixlinux-load-average-in-a-terminal/" rel="nofollow">ttyload - Linux/Unix color-coded graphical tracking tool for load average in a terminal</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [OpenIndiana with a Sun Microsystems 22&quot; LCD monitor. Running on a 1.8GHz quad core AMD Phenom 9100e processor, 4Gb RAM, nVidia GEForce GT630.](https://www.reddit.com/r/unix/comments/13otjnt/openindiana_with_a_sun_microsystems_22_lcd/)
• [cron(8) now supports random ranges with steps](https://www.undeadly.org/cgi?action=article;sid=20230507122935&amp;utm_source=bsdweekly)
• [BSDCan 2024 Reorganization](https://mwl.io/archives/22799)
• [Depenguin me](https://depenguin.me/)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>509: Dot File Naming</title>
  <link>https://www.bsdnow.tv/509</link>
  <guid isPermaLink="false">6676cfbb-7251-455d-846c-94eb3e6e5c32</guid>
  <pubDate>Thu, 01 Jun 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6676cfbb-7251-455d-846c-94eb3e6e5c32.mp3" length="39585792" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Leveraging OpenZFS to Build Your Own Storage Appliance, Install OpenBSD as a VM, Set up your own CalDAV and CardDAV servers on OpenBSD, display basic computer information using DMI table decoder, Gpart CheatSheet, Rob Pike on the Origin of Unix Dot File Names, and more</itunes:subtitle>
  <itunes:duration>41:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Leveraging OpenZFS to Build Your Own Storage Appliance, Install OpenBSD as a VM, Set up your own CalDAV and CardDAV servers on OpenBSD, display basic computer information using DMI table decoder, Gpart CheatSheet, Rob Pike on the Origin of Unix Dot File Names, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenZFS – Leveraging OpenZFS to Build Your Own Storage Appliance (https://klarasystems.com/articles/openzfs-leveraging-openzfs-to-build-your-own-storage-appliance/)
Install OpenBSD as a VM (https://byte-sized.de/linux-unix/openbsd-als-vm-installieren/#english)
News Roundup
Set up your own CalDAV and CardDAV servers on OpenBSD (https://dataswamp.org/~solene/2023-04-23-calendar-and-contacts-with-radicale.html)
How to display basic computer information using DMI table decoder (https://sleeplessbeastie.eu/2023/03/31/how-to-display-basic-computer-information-using-dmi-table-decoder/)
Gpart CheatSheet - wiping drives, partitioning, &amp;amp; formating (https://forums.FreeBSD.org/threads/gpart-cheatsheet-wiping-drives-partitioning-formating.45411)
Rob Pike on the Origin of Unix Dot File Names (http://xahlee.info/UnixResource_dir/writ/unix_origin_of_dot_filename.html)
Beastie Bits
Hackerstations
Mike McQuaid's clean, ergonomic setup in Edinburgh, Scotland (https://hackerstations.com/setups/mike_mcquaid/)
Daniel Stenberg and the home of curl in Stockholm, Sweden (https://hackerstations.com/setups/daniel_stenberg/)
viogpu(4), a VirtIO GPU driver, added to -current (http://undeadly.org/cgi?action=article;sid=20230421124221)
OpenBGPD 8.0 released (http://undeadly.org/cgi?action=article;sid=20230505054214)
cron(8) now supports random ranges with steps (http://undeadly.org/cgi?action=article;sid=20230507122935)
malloc leak detection available in -current (http://undeadly.org/cgi?action=article;sid=20230417074903)
vmd(8) moves to a multi-process model (https://www.undeadly.org/cgi?action=article;sid=20230430051250)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, storage appliance, virtual machine, vm, calDAV, cardDAV, dmi, decoder, gpart, cheatsheet, rob pike, dot file</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Leveraging OpenZFS to Build Your Own Storage Appliance, Install OpenBSD as a VM, Set up your own CalDAV and CardDAV servers on OpenBSD, display basic computer information using DMI table decoder, Gpart CheatSheet, Rob Pike on the Origin of Unix Dot File Names, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-leveraging-openzfs-to-build-your-own-storage-appliance/" rel="nofollow">OpenZFS – Leveraging OpenZFS to Build Your Own Storage Appliance</a></h3>

<hr>

<h3><a href="https://byte-sized.de/linux-unix/openbsd-als-vm-installieren/#english" rel="nofollow">Install OpenBSD as a VM</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-04-23-calendar-and-contacts-with-radicale.html" rel="nofollow">Set up your own CalDAV and CardDAV servers on OpenBSD</a></h3>

<hr>

<h3><a href="https://sleeplessbeastie.eu/2023/03/31/how-to-display-basic-computer-information-using-dmi-table-decoder/" rel="nofollow">How to display basic computer information using DMI table decoder</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/gpart-cheatsheet-wiping-drives-partitioning-formating.45411" rel="nofollow">Gpart CheatSheet - wiping drives, partitioning, &amp; formating</a></h3>

<hr>

<h3><a href="http://xahlee.info/UnixResource_dir/writ/unix_origin_of_dot_filename.html" rel="nofollow">Rob Pike on the Origin of Unix Dot File Names</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li>Hackerstations

<ul>
<li><a href="https://hackerstations.com/setups/mike_mcquaid/" rel="nofollow">Mike McQuaid&#39;s clean, ergonomic setup in Edinburgh, Scotland</a></li>
<li><a href="https://hackerstations.com/setups/daniel_stenberg/" rel="nofollow">Daniel Stenberg and the home of curl in Stockholm, Sweden</a></li>
</ul></li>
<li><p><a href="http://undeadly.org/cgi?action=article;sid=20230421124221" rel="nofollow">viogpu(4), a VirtIO GPU driver, added to -current</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article;sid=20230505054214" rel="nofollow">OpenBGPD 8.0 released</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article;sid=20230507122935" rel="nofollow">cron(8) now supports random ranges with steps</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article;sid=20230417074903" rel="nofollow">malloc leak detection available in -current</a></p></li>
<li><p><a href="https://www.undeadly.org/cgi?action=article;sid=20230430051250" rel="nofollow">vmd(8) moves to a multi-process model</a></p></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Leveraging OpenZFS to Build Your Own Storage Appliance, Install OpenBSD as a VM, Set up your own CalDAV and CardDAV servers on OpenBSD, display basic computer information using DMI table decoder, Gpart CheatSheet, Rob Pike on the Origin of Unix Dot File Names, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-leveraging-openzfs-to-build-your-own-storage-appliance/" rel="nofollow">OpenZFS – Leveraging OpenZFS to Build Your Own Storage Appliance</a></h3>

<hr>

<h3><a href="https://byte-sized.de/linux-unix/openbsd-als-vm-installieren/#english" rel="nofollow">Install OpenBSD as a VM</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2023-04-23-calendar-and-contacts-with-radicale.html" rel="nofollow">Set up your own CalDAV and CardDAV servers on OpenBSD</a></h3>

<hr>

<h3><a href="https://sleeplessbeastie.eu/2023/03/31/how-to-display-basic-computer-information-using-dmi-table-decoder/" rel="nofollow">How to display basic computer information using DMI table decoder</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/gpart-cheatsheet-wiping-drives-partitioning-formating.45411" rel="nofollow">Gpart CheatSheet - wiping drives, partitioning, &amp; formating</a></h3>

<hr>

<h3><a href="http://xahlee.info/UnixResource_dir/writ/unix_origin_of_dot_filename.html" rel="nofollow">Rob Pike on the Origin of Unix Dot File Names</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li>Hackerstations

<ul>
<li><a href="https://hackerstations.com/setups/mike_mcquaid/" rel="nofollow">Mike McQuaid&#39;s clean, ergonomic setup in Edinburgh, Scotland</a></li>
<li><a href="https://hackerstations.com/setups/daniel_stenberg/" rel="nofollow">Daniel Stenberg and the home of curl in Stockholm, Sweden</a></li>
</ul></li>
<li><p><a href="http://undeadly.org/cgi?action=article;sid=20230421124221" rel="nofollow">viogpu(4), a VirtIO GPU driver, added to -current</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article;sid=20230505054214" rel="nofollow">OpenBGPD 8.0 released</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article;sid=20230507122935" rel="nofollow">cron(8) now supports random ranges with steps</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article;sid=20230417074903" rel="nofollow">malloc leak detection available in -current</a></p></li>
<li><p><a href="https://www.undeadly.org/cgi?action=article;sid=20230430051250" rel="nofollow">vmd(8) moves to a multi-process model</a></p></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>508: Foundational Proceedings</title>
  <link>https://www.bsdnow.tv/508</link>
  <guid isPermaLink="false">def7d8d8-31e8-4874-bbe5-dd25729dd001</guid>
  <pubDate>Thu, 25 May 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/def7d8d8-31e8-4874-bbe5-dd25729dd001.mp3" length="39443712" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Foundation Welcomes New Team Members, OpenZFS the Ideal Storage Solution for University Environments, SCaLE20X Conference Report, 916 days of Emacs, XTerm: It's Better Than You Thought, NetBSD Annual General Meeting 2023, and more</itunes:subtitle>
  <itunes:duration>41:05</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Foundation Welcomes New Team Members, OpenZFS the Ideal Storage Solution for University Environments, SCaLE20X Conference Report, 916 days of Emacs, XTerm: It's Better Than You Thought, NetBSD Annual General Meeting 2023, and more
NOTES**
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Foundation Welcomes New Team Members (https://freebsdfoundation.org/blog/freebsd-foundation-welcomes-new-team-members/)
What Makes OpenZFS the Ideal Storage Solution for University Environments (https://klarasystems.com/articles/openzfs-what-makes-openzfs-the-ideal-storage-solution-for-university-environments//)
News Roundup
SCaLE20X Conference Report (https://freebsdfoundation.org/blog/scale20x-conference-report/)
916 days of Emacs (https://sqrtminusone.xyz/posts/2023-04-13-emacs/)
XTerm: It's Better Than You Thought (https://aduros.com/blog/xterm-its-better-than-you-thought/)
NetBSD AGM2023: Annual General Meeting, May 13, 21:00 UTC (https://mail-index.netbsd.org/netbsd-announce/2023/05/05/msg000348.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Adrian - Tilde (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Adrian%20-%20Tilde.md)
Dan - Root Shell (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Dan%20-%20Root%20Shell.md)
Florian - Salt Extension (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Florian%20-%20Salt%20Extension.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, solution, university, environment, ports, packages, jails, interview, team members, foundation, storage solution, scale20x, trip report, emacs, xterm, annual general meeting</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Foundation Welcomes New Team Members, OpenZFS the Ideal Storage Solution for University Environments, SCaLE20X Conference Report, 916 days of Emacs, XTerm: It&#39;s Better Than You Thought, NetBSD Annual General Meeting 2023, and more</p>

<p><em>NOTES</em>**<br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/freebsd-foundation-welcomes-new-team-members/" rel="nofollow">FreeBSD Foundation Welcomes New Team Members</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/openzfs-what-makes-openzfs-the-ideal-storage-solution-for-university-environments//" rel="nofollow">What Makes OpenZFS the Ideal Storage Solution for University Environments</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://freebsdfoundation.org/blog/scale20x-conference-report/" rel="nofollow">SCaLE20X Conference Report</a></h3>

<hr>

<h3><a href="https://sqrtminusone.xyz/posts/2023-04-13-emacs/" rel="nofollow">916 days of Emacs</a></h3>

<hr>

<h3><a href="https://aduros.com/blog/xterm-its-better-than-you-thought/" rel="nofollow">XTerm: It&#39;s Better Than You Thought</a></h3>

<hr>

<h3><a href="https://mail-index.netbsd.org/netbsd-announce/2023/05/05/msg000348.html" rel="nofollow">NetBSD AGM2023: Annual General Meeting, May 13, 21:00 UTC</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Adrian%20-%20Tilde.md" rel="nofollow">Adrian - Tilde</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Dan%20-%20Root%20Shell.md" rel="nofollow">Dan - Root Shell</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Florian%20-%20Salt%20Extension.md" rel="nofollow">Florian - Salt Extension</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Foundation Welcomes New Team Members, OpenZFS the Ideal Storage Solution for University Environments, SCaLE20X Conference Report, 916 days of Emacs, XTerm: It&#39;s Better Than You Thought, NetBSD Annual General Meeting 2023, and more</p>

<p><em>NOTES</em>**<br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/freebsd-foundation-welcomes-new-team-members/" rel="nofollow">FreeBSD Foundation Welcomes New Team Members</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/openzfs-what-makes-openzfs-the-ideal-storage-solution-for-university-environments//" rel="nofollow">What Makes OpenZFS the Ideal Storage Solution for University Environments</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://freebsdfoundation.org/blog/scale20x-conference-report/" rel="nofollow">SCaLE20X Conference Report</a></h3>

<hr>

<h3><a href="https://sqrtminusone.xyz/posts/2023-04-13-emacs/" rel="nofollow">916 days of Emacs</a></h3>

<hr>

<h3><a href="https://aduros.com/blog/xterm-its-better-than-you-thought/" rel="nofollow">XTerm: It&#39;s Better Than You Thought</a></h3>

<hr>

<h3><a href="https://mail-index.netbsd.org/netbsd-announce/2023/05/05/msg000348.html" rel="nofollow">NetBSD AGM2023: Annual General Meeting, May 13, 21:00 UTC</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Adrian%20-%20Tilde.md" rel="nofollow">Adrian - Tilde</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Dan%20-%20Root%20Shell.md" rel="nofollow">Dan - Root Shell</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Florian%20-%20Salt%20Extension.md" rel="nofollow">Florian - Salt Extension</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>507: Michael W. Lucas Interview</title>
  <link>https://www.bsdnow.tv/507</link>
  <guid isPermaLink="false">188e3b3f-dc07-43ba-aa49-de8223858ead</guid>
  <pubDate>Thu, 18 May 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/188e3b3f-dc07-43ba-aa49-de8223858ead.mp3" length="56347776" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Author Michael W. Lucas joins us in this interview to talk about his latest book projects. Find out what he’s up to regarding mail servers, conferences, his views on ChatGPT, and more.</itunes:subtitle>
  <itunes:duration>58:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Author Michael W. Lucas joins us in this interview to talk about his latest book projects. Find out what he’s up to regarding mail servers, conferences, his views on ChatGPT, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Interview - Michael W. Lucas - mwl@mwl.io (mailto:mwl@mwl.io)
OpenBSD Mastery Filesystems
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
 Special Guest: Michael W Lucas.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, Michael W. Lucas, book, author, writing, mail server, chatgpt, events, conferences,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Author Michael W. Lucas joins us in this interview to talk about his latest book projects. Find out what he’s up to regarding mail servers, conferences, his views on ChatGPT, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwl@mwl.io" rel="nofollow">mwl@mwl.io</a></h2>

<p>OpenBSD Mastery Filesystems</p>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
</ul>

<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></h2>

<hr><p>Special Guest: Michael W Lucas.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Author Michael W. Lucas joins us in this interview to talk about his latest book projects. Find out what he’s up to regarding mail servers, conferences, his views on ChatGPT, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwl@mwl.io" rel="nofollow">mwl@mwl.io</a></h2>

<p>OpenBSD Mastery Filesystems</p>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
</ul>

<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></h2>

<hr><p>Special Guest: Michael W Lucas.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>506: A greener BSD</title>
  <link>https://www.bsdnow.tv/506</link>
  <guid isPermaLink="false">a130428b-d80d-45a3-a07b-e7b6ce4b3565</guid>
  <pubDate>Thu, 11 May 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a130428b-d80d-45a3-a07b-e7b6ce4b3565.mp3" length="20222232" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Comparing Modern Open-Source Storage Solutions, FreeBSD Q1 Status Report, Hello Systems 0.8.1 Release, OpenBSD: Managing an inverter/converter with NUT, Tips for Running a Greener FreeBSD, BSDCAN Registration open</itunes:subtitle>
  <itunes:duration>32:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Comparing Modern Open-Source Storage Solutions, FreeBSD Q1 Status Report, Hello Systems 0.8.1 Release, OpenBSD: Managing an inverter/converter with NUT, Tips for Running a Greener FreeBSD, BSDCAN Registration open
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Comparing Modern Open-Source Storage Solutions OpenZFS vs. The Rest (https://klarasystems.com/articles/openzfs-comparing-modern-open-source-storage-solutions/)
FreeBSD Q1 Status Report (https://www.freebsd.org/status/report-2023-01-2023-03/)
News Roundup
Hello Systems 0.8.1 Release (https://github.com/helloSystem/ISO/releases/tag/r0.8.1)
OpenBSD: Managing an inverter/converter with NUT (https://doc.huc.fr.eu.org/en/sys/openbsd/nut/)
Celebrating Earth Day: Tips for Running a Greener FreeBSD (https://freebsdfoundation.org/blog/celebrating-earth-day-tips-for-running-a-greener-freebsd/)
BSDCAN Registration (https://www.bsdcan.org/2023/registration.php)
Beastie Bits
• [SimCity 2000 running on OpenBSD 7.3 via DOSBox 0.74-3](https://www.reddit.com/r/openbsd_gaming/comments/12k9zt2/simcity_2000_running_on_openbsd_73_via_dosbox_0743/)
• [OpenBSD Webzine #13](https://webzine.puffy.cafe/issue-13.html)
• [AWS Gazo bot](https://github.com/csaltos/aws-gazo-bot)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, storage solution, comparison, status report q1 2023, hello systems, inverter, converter, nut, green computing, bsdcan</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Comparing Modern Open-Source Storage Solutions, FreeBSD Q1 Status Report, Hello Systems 0.8.1 Release, OpenBSD: Managing an inverter/converter with NUT, Tips for Running a Greener FreeBSD, BSDCAN Registration open</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-comparing-modern-open-source-storage-solutions/" rel="nofollow">Comparing Modern Open-Source Storage Solutions OpenZFS vs. The Rest</a></h3>

<hr>

<h3><a href="https://www.freebsd.org/status/report-2023-01-2023-03/" rel="nofollow">FreeBSD Q1 Status Report</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/helloSystem/ISO/releases/tag/r0.8.1" rel="nofollow">Hello Systems 0.8.1 Release</a></h3>

<hr>

<h3><a href="https://doc.huc.fr.eu.org/en/sys/openbsd/nut/" rel="nofollow">OpenBSD: Managing an inverter/converter with NUT</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/celebrating-earth-day-tips-for-running-a-greener-freebsd/" rel="nofollow">Celebrating Earth Day: Tips for Running a Greener FreeBSD</a></h3>

<hr>

<h3><a href="https://www.bsdcan.org/2023/registration.php" rel="nofollow">BSDCAN Registration</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [SimCity 2000 running on OpenBSD 7.3 via DOSBox 0.74-3](https://www.reddit.com/r/openbsd_gaming/comments/12k9zt2/simcity_2000_running_on_openbsd_73_via_dosbox_0743/)
• [OpenBSD Webzine #13](https://webzine.puffy.cafe/issue-13.html)
• [AWS Gazo bot](https://github.com/csaltos/aws-gazo-bot)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Comparing Modern Open-Source Storage Solutions, FreeBSD Q1 Status Report, Hello Systems 0.8.1 Release, OpenBSD: Managing an inverter/converter with NUT, Tips for Running a Greener FreeBSD, BSDCAN Registration open</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-comparing-modern-open-source-storage-solutions/" rel="nofollow">Comparing Modern Open-Source Storage Solutions OpenZFS vs. The Rest</a></h3>

<hr>

<h3><a href="https://www.freebsd.org/status/report-2023-01-2023-03/" rel="nofollow">FreeBSD Q1 Status Report</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/helloSystem/ISO/releases/tag/r0.8.1" rel="nofollow">Hello Systems 0.8.1 Release</a></h3>

<hr>

<h3><a href="https://doc.huc.fr.eu.org/en/sys/openbsd/nut/" rel="nofollow">OpenBSD: Managing an inverter/converter with NUT</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/celebrating-earth-day-tips-for-running-a-greener-freebsd/" rel="nofollow">Celebrating Earth Day: Tips for Running a Greener FreeBSD</a></h3>

<hr>

<h3><a href="https://www.bsdcan.org/2023/registration.php" rel="nofollow">BSDCAN Registration</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [SimCity 2000 running on OpenBSD 7.3 via DOSBox 0.74-3](https://www.reddit.com/r/openbsd_gaming/comments/12k9zt2/simcity_2000_running_on_openbsd_73_via_dosbox_0743/)
• [OpenBSD Webzine #13](https://webzine.puffy.cafe/issue-13.html)
• [AWS Gazo bot](https://github.com/csaltos/aws-gazo-bot)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>505:  BSD Desktop Setup</title>
  <link>https://www.bsdnow.tv/505</link>
  <guid isPermaLink="false">8f610dd8-0956-4f99-a9a6-e8c04036ad85</guid>
  <pubDate>Thu, 04 May 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8f610dd8-0956-4f99-a9a6-e8c04036ad85.mp3" length="28271616" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 7.3 released, Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS, install Cinnamon as a Desktop environment, xmonad FreeBSD set up from scratch, Burgr books in your terminal, and more</itunes:subtitle>
  <itunes:duration>29:26</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 7.3 released, Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS, install Cinnamon as a Desktop environment, xmonad FreeBSD set up from scratch, Burgr books in your terminal, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenBSD 7.3 released (http://undeadly.org/cgi?action=article;sid=20230410140049)
BSDCan 2023 Schedule posted (https://www.bsdcan.org/events/bsdcan_2023/schedule/)
Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS (https://klarasystems.com/articles/accelerating-datacenter-energy-efficiency-by-leveraging-freebsd-as-your-server-os/)
News Roundup
FreeBSD – How to install Cinnamon as a Desktop environment (https://byte-sized.de/linux-unix/freebsd-cinnamon-als-gui-installieren/#english)
xmonad FreeBSD set up from scratch (https://forums.FreeBSD.org/threads/xmonad-freebsd-set-up-from-scratch.75911/)
Burgr books in your terminal (https://blubsblog.bearblog.dev/burgr-books-in-your-terminal/)
Pros and Cons of FreeBSD for virtual Servers (https://www.hostzealot.com/blog/about-vps/pros-and-cons-of-freebsd-for-virtual-servers)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Reese - Dans Interview (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/505/feedback/Reese%20-%20Dans%20Interview.md)
jj - looking for help (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/505/feedback/jj%20-%20looking%20for%20help.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, datacenter, energy efficiency, cinnamon desktop, xmonad, from scratch, burger books, booking</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 7.3 released, Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS, install Cinnamon as a Desktop environment, xmonad FreeBSD set up from scratch, Burgr books in your terminal, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230410140049" rel="nofollow">OpenBSD 7.3 released</a></h3>

<hr>

<h3><a href="https://www.bsdcan.org/events/bsdcan_2023/schedule/" rel="nofollow">BSDCan 2023 Schedule posted</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/accelerating-datacenter-energy-efficiency-by-leveraging-freebsd-as-your-server-os/" rel="nofollow">Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://byte-sized.de/linux-unix/freebsd-cinnamon-als-gui-installieren/#english" rel="nofollow">FreeBSD – How to install Cinnamon as a Desktop environment</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/xmonad-freebsd-set-up-from-scratch.75911/" rel="nofollow">xmonad FreeBSD set up from scratch</a></h3>

<hr>

<h3><a href="https://blubsblog.bearblog.dev/burgr-books-in-your-terminal/" rel="nofollow">Burgr books in your terminal</a></h3>

<hr>

<h3><a href="https://www.hostzealot.com/blog/about-vps/pros-and-cons-of-freebsd-for-virtual-servers" rel="nofollow">Pros and Cons of FreeBSD for virtual Servers</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/505/feedback/Reese%20-%20Dans%20Interview.md" rel="nofollow">Reese - Dans Interview</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/505/feedback/jj%20-%20looking%20for%20help.md" rel="nofollow">jj - looking for help</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 7.3 released, Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS, install Cinnamon as a Desktop environment, xmonad FreeBSD set up from scratch, Burgr books in your terminal, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230410140049" rel="nofollow">OpenBSD 7.3 released</a></h3>

<hr>

<h3><a href="https://www.bsdcan.org/events/bsdcan_2023/schedule/" rel="nofollow">BSDCan 2023 Schedule posted</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/accelerating-datacenter-energy-efficiency-by-leveraging-freebsd-as-your-server-os/" rel="nofollow">Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://byte-sized.de/linux-unix/freebsd-cinnamon-als-gui-installieren/#english" rel="nofollow">FreeBSD – How to install Cinnamon as a Desktop environment</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/xmonad-freebsd-set-up-from-scratch.75911/" rel="nofollow">xmonad FreeBSD set up from scratch</a></h3>

<hr>

<h3><a href="https://blubsblog.bearblog.dev/burgr-books-in-your-terminal/" rel="nofollow">Burgr books in your terminal</a></h3>

<hr>

<h3><a href="https://www.hostzealot.com/blog/about-vps/pros-and-cons-of-freebsd-for-virtual-servers" rel="nofollow">Pros and Cons of FreeBSD for virtual Servers</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/505/feedback/Reese%20-%20Dans%20Interview.md" rel="nofollow">Reese - Dans Interview</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/505/feedback/jj%20-%20looking%20for%20help.md" rel="nofollow">jj - looking for help</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>504: Release the BSD</title>
  <link>https://www.bsdnow.tv/504</link>
  <guid isPermaLink="false">2d02bfb1-4e33-4be1-8424-a707ddbeac55</guid>
  <pubDate>Thu, 27 Apr 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2d02bfb1-4e33-4be1-8424-a707ddbeac55.mp3" length="34665600" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 13.2 Release, Using DTrace to find block sizes of ZFS, NFS, and iSCSI, Midnight BSD 3.0.1, Closing a stale SSH connection, How to automatically add identity to the SSH authentication agent, Pros and Cons of FreeBSD for virtual Servers, and more</itunes:subtitle>
  <itunes:duration>36:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 13.2 Release, Using DTrace to find block sizes of ZFS, NFS, and iSCSI, Midnight BSD 3.0.1, Closing a stale SSH connection, How to automatically add identity to the SSH authentication agent, Pros and Cons of FreeBSD for virtual Servers, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD 13.2 Release Announcement (https://www.freebsd.org/releases/13.2R/announce/)
Using DTrace to find block sizes of ZFS, NFS, and iSCSI (https://axcient.com/blog/using-dtrace-to-find-block-sizes-of-zfs-nfs-and-iscsi/)
News Roundup
Midnight BSD 3.0.1 (https://www.phoronix.com/news/MidnightBSD-3.0.1)
Closing a stale SSH connection (https://davidisaksson.dev/posts/closing-stale-ssh-connections/)
How to automatically add identity to the SSH authentication agent (https://sleeplessbeastie.eu/2023/04/10/how-to-automatically-add-identity-to-the-ssh-authentication-agent/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Dan - ZFS question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/504/feedback/Dan%20-%20ZFS%20question.md)
Matt - Thanks (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/504/feedback/Matt%20-%20Thanks.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, dtrace, nfs, iscsi, block size, midnightbsd, ssh, connection, identity, public key, authentication, agent, virtual server</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 13.2 Release, Using DTrace to find block sizes of ZFS, NFS, and iSCSI, Midnight BSD 3.0.1, Closing a stale SSH connection, How to automatically add identity to the SSH authentication agent, Pros and Cons of FreeBSD for virtual Servers, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/13.2R/announce/" rel="nofollow">FreeBSD 13.2 Release Announcement</a></h3>

<hr>

<h3><a href="https://axcient.com/blog/using-dtrace-to-find-block-sizes-of-zfs-nfs-and-iscsi/" rel="nofollow">Using DTrace to find block sizes of ZFS, NFS, and iSCSI</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.phoronix.com/news/MidnightBSD-3.0.1" rel="nofollow">Midnight BSD 3.0.1</a></h3>

<hr>

<h3><a href="https://davidisaksson.dev/posts/closing-stale-ssh-connections/" rel="nofollow">Closing a stale SSH connection</a></h3>

<hr>

<h3><a href="https://sleeplessbeastie.eu/2023/04/10/how-to-automatically-add-identity-to-the-ssh-authentication-agent/" rel="nofollow">How to automatically add identity to the SSH authentication agent</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/504/feedback/Dan%20-%20ZFS%20question.md" rel="nofollow">Dan - ZFS question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/504/feedback/Matt%20-%20Thanks.md" rel="nofollow">Matt - Thanks</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 13.2 Release, Using DTrace to find block sizes of ZFS, NFS, and iSCSI, Midnight BSD 3.0.1, Closing a stale SSH connection, How to automatically add identity to the SSH authentication agent, Pros and Cons of FreeBSD for virtual Servers, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/13.2R/announce/" rel="nofollow">FreeBSD 13.2 Release Announcement</a></h3>

<hr>

<h3><a href="https://axcient.com/blog/using-dtrace-to-find-block-sizes-of-zfs-nfs-and-iscsi/" rel="nofollow">Using DTrace to find block sizes of ZFS, NFS, and iSCSI</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.phoronix.com/news/MidnightBSD-3.0.1" rel="nofollow">Midnight BSD 3.0.1</a></h3>

<hr>

<h3><a href="https://davidisaksson.dev/posts/closing-stale-ssh-connections/" rel="nofollow">Closing a stale SSH connection</a></h3>

<hr>

<h3><a href="https://sleeplessbeastie.eu/2023/04/10/how-to-automatically-add-identity-to-the-ssh-authentication-agent/" rel="nofollow">How to automatically add identity to the SSH authentication agent</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/504/feedback/Dan%20-%20ZFS%20question.md" rel="nofollow">Dan - ZFS question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/504/feedback/Matt%20-%20Thanks.md" rel="nofollow">Matt - Thanks</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>503: Fast Unix Commands</title>
  <link>https://www.bsdnow.tv/503</link>
  <guid isPermaLink="false">4e4d0c93-21ee-44e3-9255-c64e7772ac5e</guid>
  <pubDate>Thu, 20 Apr 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4e4d0c93-21ee-44e3-9255-c64e7772ac5e.mp3" length="35430144" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>ZFS Optimization Success Stories, Linux Namespaces Are a Poor Man's Plan 9 Namespaces, better support for SSH host certificates, Fast Unix Commands, Fascination with AWK, and more</itunes:subtitle>
  <itunes:duration>36:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>ZFS Optimization Success Stories, Linux Namespaces Are a Poor Man's Plan 9 Namespaces, better support for SSH host certificates, Fast Unix Commands, Fascination with AWK, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
ZFS Optimization Success Stories (https://klarasystems.com/articles/zfs-optimization-success-stories/)
Linux Namespaces Are a Poor Man's Plan 9 Namespaces (https://yotam.net/posts/linux-namespaces-are-a-poor-mans-plan9-namespaces/)
News Roundup
We need better support for SSH host certificates (https://mjg59.dreamwidth.org/65874.html)
Fast Unix Commands (https://alexsaveau.dev/blog/projects/performance/files/fuc/fast-unix-commands)
Fascination with AWK (https://maximullaris.com/awk.html)
Beastie Bits
[Development environment updated and working])https://twitter.com/sweordbora/status/1618603990463438851?s=52&amp;amp;t=GHrPlL6qZhIWo6u2Y5ie3g)
[WIP] feat: add basic FreeBSD support on Kubelet](https://github.com/kubernetes/kubernetes/pull/115870)
Jar of Fortunes (http://fortunes.cat-v.org/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, optimization, success story, namespaces, plan 9, ssh host certificates, fast commands, awk, fascination</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>ZFS Optimization Success Stories, Linux Namespaces Are a Poor Man&#39;s Plan 9 Namespaces, better support for SSH host certificates, Fast Unix Commands, Fascination with AWK, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/zfs-optimization-success-stories/" rel="nofollow">ZFS Optimization Success Stories</a></h3>

<hr>

<h3><a href="https://yotam.net/posts/linux-namespaces-are-a-poor-mans-plan9-namespaces/" rel="nofollow">Linux Namespaces Are a Poor Man&#39;s Plan 9 Namespaces</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mjg59.dreamwidth.org/65874.html" rel="nofollow">We need better support for SSH host certificates</a></h3>

<hr>

<h3><a href="https://alexsaveau.dev/blog/projects/performance/files/fuc/fast-unix-commands" rel="nofollow">Fast Unix Commands</a></h3>

<hr>

<h3><a href="https://maximullaris.com/awk.html" rel="nofollow">Fascination with AWK</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li>[Development environment updated and working])<a href="https://twitter.com/sweordbora/status/1618603990463438851?s=52&t=GHrPlL6qZhIWo6u2Y5ie3g" rel="nofollow">https://twitter.com/sweordbora/status/1618603990463438851?s=52&amp;t=GHrPlL6qZhIWo6u2Y5ie3g</a>)</li>
<li>[WIP] feat: add basic FreeBSD support on Kubelet](<a href="https://github.com/kubernetes/kubernetes/pull/115870" rel="nofollow">https://github.com/kubernetes/kubernetes/pull/115870</a>)</li>
<li><a href="http://fortunes.cat-v.org/" rel="nofollow">Jar of Fortunes</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></h2>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>ZFS Optimization Success Stories, Linux Namespaces Are a Poor Man&#39;s Plan 9 Namespaces, better support for SSH host certificates, Fast Unix Commands, Fascination with AWK, and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/zfs-optimization-success-stories/" rel="nofollow">ZFS Optimization Success Stories</a></h3>

<hr>

<h3><a href="https://yotam.net/posts/linux-namespaces-are-a-poor-mans-plan9-namespaces/" rel="nofollow">Linux Namespaces Are a Poor Man&#39;s Plan 9 Namespaces</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mjg59.dreamwidth.org/65874.html" rel="nofollow">We need better support for SSH host certificates</a></h3>

<hr>

<h3><a href="https://alexsaveau.dev/blog/projects/performance/files/fuc/fast-unix-commands" rel="nofollow">Fast Unix Commands</a></h3>

<hr>

<h3><a href="https://maximullaris.com/awk.html" rel="nofollow">Fascination with AWK</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li>[Development environment updated and working])<a href="https://twitter.com/sweordbora/status/1618603990463438851?s=52&t=GHrPlL6qZhIWo6u2Y5ie3g" rel="nofollow">https://twitter.com/sweordbora/status/1618603990463438851?s=52&amp;t=GHrPlL6qZhIWo6u2Y5ie3g</a>)</li>
<li>[WIP] feat: add basic FreeBSD support on Kubelet](<a href="https://github.com/kubernetes/kubernetes/pull/115870" rel="nofollow">https://github.com/kubernetes/kubernetes/pull/115870</a>)</li>
<li><a href="http://fortunes.cat-v.org/" rel="nofollow">Jar of Fortunes</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></h2>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>502: Ping from Hell</title>
  <link>https://www.bsdnow.tv/502</link>
  <guid isPermaLink="false">f36dbdc3-d907-4d0e-8ee2-4b83780799cb</guid>
  <pubDate>Thu, 13 Apr 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f36dbdc3-d907-4d0e-8ee2-4b83780799cb.mp3" length="34267776" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>5 Key reasons for a OpenZFS Performance Audit, The Ping from Hell, OpenBGPD 7.9 released, Setting the clock ahead to see what breaks, and more</itunes:subtitle>
  <itunes:duration>35:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>5 Key reasons for a OpenZFS Performance Audit, The Ping from Hell, OpenBGPD 7.9 released, Setting the clock ahead to see what breaks, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
5 Key reasons why you need a OpenZFS Performance Audit (https://klarasystems.com/articles/5-key-reasons-why-you-need-an-openzfs-performance-audit/)
Musings on Mobility : The Ping from Hell (http://bastian.rieck.me/blog/posts/2023/mobility/)
News Roundup
OpenBGPD 7.9 released (http://undeadly.org/cgi?action=article;sid=20230323152353)
Setting the clock ahead to see what breaks (https://rachelbythebay.com/w/2023/01/19/time/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Esteban - pot (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Esteban%20-%20pot.md)
Tim - BSD Talk at SCALE (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Tim%20-%20BSD%20Talk%20at%20SCALE.md)
Fred - Networking (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Fred%20-%20Networking.md)
- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, reason, performance, audit, ping, hell, openbgpd, clock, time</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>5 Key reasons for a OpenZFS Performance Audit, The Ping from Hell, OpenBGPD 7.9 released, Setting the clock ahead to see what breaks, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/5-key-reasons-why-you-need-an-openzfs-performance-audit/" rel="nofollow">5 Key reasons why you need a OpenZFS Performance Audit</a></h3>

<hr>

<h3><a href="http://bastian.rieck.me/blog/posts/2023/mobility/" rel="nofollow">Musings on Mobility : The Ping from Hell</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230323152353" rel="nofollow">OpenBGPD 7.9 released</a></h3>

<hr>

<h3><a href="https://rachelbythebay.com/w/2023/01/19/time/" rel="nofollow">Setting the clock ahead to see what breaks</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Esteban%20-%20pot.md" rel="nofollow">Esteban - pot</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Tim%20-%20BSD%20Talk%20at%20SCALE.md" rel="nofollow">Tim - BSD Talk at SCALE</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Fred%20-%20Networking.md" rel="nofollow">Fred - Networking</a></p></li>
</ul>

<hr>

<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></h2>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>5 Key reasons for a OpenZFS Performance Audit, The Ping from Hell, OpenBGPD 7.9 released, Setting the clock ahead to see what breaks, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/5-key-reasons-why-you-need-an-openzfs-performance-audit/" rel="nofollow">5 Key reasons why you need a OpenZFS Performance Audit</a></h3>

<hr>

<h3><a href="http://bastian.rieck.me/blog/posts/2023/mobility/" rel="nofollow">Musings on Mobility : The Ping from Hell</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230323152353" rel="nofollow">OpenBGPD 7.9 released</a></h3>

<hr>

<h3><a href="https://rachelbythebay.com/w/2023/01/19/time/" rel="nofollow">Setting the clock ahead to see what breaks</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Esteban%20-%20pot.md" rel="nofollow">Esteban - pot</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Tim%20-%20BSD%20Talk%20at%20SCALE.md" rel="nofollow">Tim - BSD Talk at SCALE</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Fred%20-%20Networking.md" rel="nofollow">Fred - Networking</a></p></li>
</ul>

<hr>

<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></h2>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>501: Boot that Snapshot</title>
  <link>https://www.bsdnow.tv/501</link>
  <guid isPermaLink="false">d498dc0c-a1f0-4c32-b783-7a39bbafa43a</guid>
  <pubDate>Thu, 06 Apr 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d498dc0c-a1f0-4c32-b783-7a39bbafa43a.mp3" length="36514176" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Nextcloud + OpenBSD = &lt;3, Understanding the Origins of DTrace, Bastille Templates for FreeBSD Jails, Initial support for guided disk encryption in the OpenBSD installer, Dynamic host configuration please, OpenBSD Storage Management tutorial at BSDCan 2023, Jan/Feb 2023 Column Out in the FreeBSD Journal, and more</itunes:subtitle>
  <itunes:duration>38:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Nextcloud + OpenBSD = &amp;lt;3, Understanding the Origins of DTrace, Bastille Templates for FreeBSD Jails, Initial support for guided disk encryption in the OpenBSD installer, Dynamic host configuration please, OpenBSD Storage Management tutorial at BSDCan 2023, Jan/Feb 2023 Column Out in the FreeBSD Journal, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Nextcloud + OpenBSD = &amp;lt;3 (https://x61.sh/log/2023/02/20230217T112354-nextcloud_openbsd.html)
FreeBSD History Series - Understanding the Origins of DTrace (https://klarasystems.com/articles/freebsd-history-understanding-the-origins-of-dtrace/)
News Roundup
Bastille Templates for FreeBSD Jails (https://byte--sized-de.translate.goog/linux-unix/bastille-templates-fuer-freebsd-jails/?_x_tr_sl=de&amp;amp;_x_tr_tl=en&amp;amp;_x_tr_hl=en&amp;amp;_x_tr_pto=wapp)
Initial support for guided disk encryption in the installer (http://undeadly.org/cgi?action=article;sid=20230308063109)
Dynamic host configuration, please (http://undeadly.org/cgi?action=article;sid=20230308060219)
BSDCan 2023 Tutorial: OpenBSD Storage Management (https://mwl.io/archives/22621)
Jan/Feb 2023 Column Out in the FreeBSD Journal (https://mwl.io/archives/22619)
loader: Add support for booting from a ZFS snapshot (https://cgit.freebsd.org/src/commit/?id=a849842f510af48717e35ff709623e0dd1b80b20)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, nextcloud, dtrace, bastille, template, disk encryption, dhcp, dhcplease, storage management, bsdcan 2023, freebsd journal</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Nextcloud + OpenBSD = &lt;3, Understanding the Origins of DTrace, Bastille Templates for FreeBSD Jails, Initial support for guided disk encryption in the OpenBSD installer, Dynamic host configuration please, OpenBSD Storage Management tutorial at BSDCan 2023, Jan/Feb 2023 Column Out in the FreeBSD Journal, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://x61.sh/log/2023/02/20230217T112354-nextcloud_openbsd.html" rel="nofollow">Nextcloud + OpenBSD = &lt;3</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/freebsd-history-understanding-the-origins-of-dtrace/" rel="nofollow">FreeBSD History Series - Understanding the Origins of DTrace</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://byte--sized-de.translate.goog/linux-unix/bastille-templates-fuer-freebsd-jails/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" rel="nofollow">Bastille Templates for FreeBSD Jails</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230308063109" rel="nofollow">Initial support for guided disk encryption in the installer</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230308060219" rel="nofollow">Dynamic host configuration, please</a></h3>

<hr>

<h3><a href="https://mwl.io/archives/22621" rel="nofollow">BSDCan 2023 Tutorial: OpenBSD Storage Management</a></h3>

<hr>

<h3><a href="https://mwl.io/archives/22619" rel="nofollow">Jan/Feb 2023 Column Out in the FreeBSD Journal</a></h3>

<hr>

<h3><a href="https://cgit.freebsd.org/src/commit/?id=a849842f510af48717e35ff709623e0dd1b80b20" rel="nofollow">loader: Add support for booting from a ZFS snapshot</a></h3>

<hr>

<h3>Tarsnap</h3>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Nextcloud + OpenBSD = &lt;3, Understanding the Origins of DTrace, Bastille Templates for FreeBSD Jails, Initial support for guided disk encryption in the OpenBSD installer, Dynamic host configuration please, OpenBSD Storage Management tutorial at BSDCan 2023, Jan/Feb 2023 Column Out in the FreeBSD Journal, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://x61.sh/log/2023/02/20230217T112354-nextcloud_openbsd.html" rel="nofollow">Nextcloud + OpenBSD = &lt;3</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/freebsd-history-understanding-the-origins-of-dtrace/" rel="nofollow">FreeBSD History Series - Understanding the Origins of DTrace</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://byte--sized-de.translate.goog/linux-unix/bastille-templates-fuer-freebsd-jails/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" rel="nofollow">Bastille Templates for FreeBSD Jails</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230308063109" rel="nofollow">Initial support for guided disk encryption in the installer</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230308060219" rel="nofollow">Dynamic host configuration, please</a></h3>

<hr>

<h3><a href="https://mwl.io/archives/22621" rel="nofollow">BSDCan 2023 Tutorial: OpenBSD Storage Management</a></h3>

<hr>

<h3><a href="https://mwl.io/archives/22619" rel="nofollow">Jan/Feb 2023 Column Out in the FreeBSD Journal</a></h3>

<hr>

<h3><a href="https://cgit.freebsd.org/src/commit/?id=a849842f510af48717e35ff709623e0dd1b80b20" rel="nofollow">loader: Add support for booting from a ZFS snapshot</a></h3>

<hr>

<h3>Tarsnap</h3>

<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr>

<p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>500: Guarding the Wire</title>
  <link>https://www.bsdnow.tv/500</link>
  <guid isPermaLink="false">f813165b-a60b-4d4c-80fa-910b048b3dba</guid>
  <pubDate>Thu, 30 Mar 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f813165b-a60b-4d4c-80fa-910b048b3dba.mp3" length="34851456" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Wireguard VPN Server with Unbound on OpenBSD, Auditing for OpenZFS Storage Performance, OpenBSD 7.2 on a Thinkpad X201, Practical Guides to fzf, Replacing postfix with dma, and more</itunes:subtitle>
  <itunes:duration>36:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Wireguard VPN Server with Unbound on OpenBSD, Auditing for OpenZFS Storage Performance, OpenBSD 7.2 on a Thinkpad X201, Practical Guides to fzf, Replacing postfix with dma, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
How To Set Up a Wireguard VPN Server with Unbound on OpenBSD (https://marcocetica.com/posts/wireguard_openbsd/)
Auditing for OpenZFS Storage Performance (https://klarasystems.com/articles/openzfs-auditing-for-storage-performance/)
News Roundup
Some notes on OpenBSD 7.2 on a Thinkpad X201 (https://box.matto.nl/some-notes-on-openbsd-72-on-a-thinkpad-x201.html)
fzf
A Practical Guide to fzf: Building a File Explorer (https://thevaluable.dev/practical-guide-fzf-example/)
A Practical Guide to fzf: Shell Integration (https://thevaluable.dev/fzf-shell-integration/)

***
Replacing postfix with dma (https://dan.langille.org/2023/02/28/replacing-postfix-with-dma/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Dennis - Thanks (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Dennis%20-%20Thanks.md)
Luna - Trillian (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Luna%20-%20trillian.md)
Lyubomir - ipfw question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Lyubomir%20-%20ipfw%20question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, wireguard, vpn, unbound, audit, auditing, performance, thinkpad, x201, fzf, guide, postfix, dma, dragonfly mail agent, </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Wireguard VPN Server with Unbound on OpenBSD, Auditing for OpenZFS Storage Performance, OpenBSD 7.2 on a Thinkpad X201, Practical Guides to fzf, Replacing postfix with dma, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://marcocetica.com/posts/wireguard_openbsd/" rel="nofollow">How To Set Up a Wireguard VPN Server with Unbound on OpenBSD</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/openzfs-auditing-for-storage-performance/" rel="nofollow">Auditing for OpenZFS Storage Performance</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://box.matto.nl/some-notes-on-openbsd-72-on-a-thinkpad-x201.html" rel="nofollow">Some notes on OpenBSD 7.2 on a Thinkpad X201</a></h3>

<hr>

<h3>fzf</h3>

<ul>
<li><a href="https://thevaluable.dev/practical-guide-fzf-example/" rel="nofollow">A Practical Guide to fzf: Building a File Explorer</a></li>
<li><a href="https://thevaluable.dev/fzf-shell-integration/" rel="nofollow">A Practical Guide to fzf: Shell Integration</a></li>
<li>
***</li>
</ul>

<h3><a href="https://dan.langille.org/2023/02/28/replacing-postfix-with-dma/" rel="nofollow">Replacing postfix with dma</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Dennis%20-%20Thanks.md" rel="nofollow">Dennis - Thanks</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Luna%20-%20trillian.md" rel="nofollow">Luna - Trillian</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Lyubomir%20-%20ipfw%20question.md" rel="nofollow">Lyubomir - ipfw question</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Wireguard VPN Server with Unbound on OpenBSD, Auditing for OpenZFS Storage Performance, OpenBSD 7.2 on a Thinkpad X201, Practical Guides to fzf, Replacing postfix with dma, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://marcocetica.com/posts/wireguard_openbsd/" rel="nofollow">How To Set Up a Wireguard VPN Server with Unbound on OpenBSD</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/openzfs-auditing-for-storage-performance/" rel="nofollow">Auditing for OpenZFS Storage Performance</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://box.matto.nl/some-notes-on-openbsd-72-on-a-thinkpad-x201.html" rel="nofollow">Some notes on OpenBSD 7.2 on a Thinkpad X201</a></h3>

<hr>

<h3>fzf</h3>

<ul>
<li><a href="https://thevaluable.dev/practical-guide-fzf-example/" rel="nofollow">A Practical Guide to fzf: Building a File Explorer</a></li>
<li><a href="https://thevaluable.dev/fzf-shell-integration/" rel="nofollow">A Practical Guide to fzf: Shell Integration</a></li>
<li>
***</li>
</ul>

<h3><a href="https://dan.langille.org/2023/02/28/replacing-postfix-with-dma/" rel="nofollow">Replacing postfix with dma</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Dennis%20-%20Thanks.md" rel="nofollow">Dennis - Thanks</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Luna%20-%20trillian.md" rel="nofollow">Luna - Trillian</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Lyubomir%20-%20ipfw%20question.md" rel="nofollow">Lyubomir - ipfw question</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>499: Dan Langille Interview</title>
  <link>https://www.bsdnow.tv/499</link>
  <guid isPermaLink="false">b57b3e71-4395-4296-98ea-9eea94bffd1a</guid>
  <pubDate>Thu, 23 Mar 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b57b3e71-4395-4296-98ea-9eea94bffd1a.mp3" length="38735616" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We’re interviewing Dan Langille about his new server project. He’ll talk to us about the things he’s building, some of which are a bit out of the ordinary. We’re also talking about BSDCan 2023 and what to expect after returning to an in-presence conference format. Enjoy!</itunes:subtitle>
  <itunes:duration>40:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We’re interviewing Dan Langille about his new server project. He’ll talk to us about the things he’s building, some of which are a bit out of the ordinary. We’re also talking about BSDCan 2023 and what to expect after returning to an in-presence conference format. Enjoy!
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Interview - Dan Langille - dan@langille.org (mailto:dan@langille.org) / @twitter (https://twitter.com/dlangille)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Special Guest: Dan Langille.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, bsdcan, conference, server, r730, setup</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We’re interviewing Dan Langille about his new server project. He’ll talk to us about the things he’s building, some of which are a bit out of the ordinary. We’re also talking about BSDCan 2023 and what to expect after returning to an in-presence conference format. Enjoy!</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interview - Dan Langille - <a href="mailto:dan@langille.org" rel="nofollow">dan@langille.org</a> / <a href="https://twitter.com/dlangille" rel="nofollow">@twitter</a></h2>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul><p>Special Guest: Dan Langille.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We’re interviewing Dan Langille about his new server project. He’ll talk to us about the things he’s building, some of which are a bit out of the ordinary. We’re also talking about BSDCan 2023 and what to expect after returning to an in-presence conference format. Enjoy!</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interview - Dan Langille - <a href="mailto:dan@langille.org" rel="nofollow">dan@langille.org</a> / <a href="https://twitter.com/dlangille" rel="nofollow">@twitter</a></h2>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul><p>Special Guest: Dan Langille.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>498: Dropping Privileges</title>
  <link>https://www.bsdnow.tv/498</link>
  <guid isPermaLink="false">34def0f7-bb67-4f62-a94c-6ff7ac8576f9</guid>
  <pubDate>Thu, 16 Mar 2023 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/34def0f7-bb67-4f62-a94c-6ff7ac8576f9.mp3" length="41248128" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS auditing for storage Performance, Privilege drop; privilege separation; and restricted-service operating mode in OpenBSD, OPNsense 23.1.1 release, Cloning a System with Ansible, FOSDEM 2023, BSDCan 2023 Travel Grants</itunes:subtitle>
  <itunes:duration>42:58</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS auditing for storage Performance, Privilege drop; privilege separation; and restricted-service operating mode in OpenBSD, OPNsense 23.1.1 release, Cloning a System with Ansible, FOSDEM 2023, BSDCan 2023 Travel Grants
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenZFS auditing for storage Performance (https://klarasystems.com/articles/openzfs-auditing-for-storage-performance/)
Privilege drop, privilege separation, and restricted-service operating mode in OpenBSD (https://sha256.net/privsep.html)
News Roundup
OPNsense 23.1.1 released (https://forum.opnsense.org/index.php?topic=32484.0)
Cloning a System with Ansible (https://kernelpanic.life/software/cloning-a-system-with-ansible.html)
FOSDEM 2023 (http://blog.netbsd.org/tnf/entry/fosdem_2023)
BSDCan 2023 Travel Grant Application Now Open (https://freebsdfoundation.org/blog/bsdcan-2023-travel-grant-application-now-open/)
The Undeadly Bits
Game of Trees milestone (http://undeadly.org/cgi?action=article;sid=20230120073530)
Game of Trees Daemon - video and slides (May make the older game of trees obsolete) (http://undeadly.org/cgi?action=article;sid=20230210065830)
amd64 execute-only committed to -current (http://undeadly.org/cgi?action=article;sid=20230121125423)
Using /bin/eject with USB flash drives (http://undeadly.org/cgi?action=article;sid=20230214061952)
Tunneling vxlan(4) over WireGuard wg(4) (http://undeadly.org/cgi?action=article;sid=20230214061330)
Console screendumps (http://undeadly.org/cgi?action=article;sid=20230128183032)
Execute-only status report (http://undeadly.org/cgi?action=article;sid=20230130061324)
OpenBSD in Canada (http://undeadly.org/cgi?action=article;sid=20230226065006)
Privilege drop, privilege separation, and restricted-service operating mode in OpenBSD (http://undeadly.org/cgi?action=article;sid=20230219234206)
Theo de Raadt on pinsyscall(2) (http://undeadly.org/cgi?action=article;sid=20230222064027)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Kevin - PLUG (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/498/feedback/Kevin%20-%20PLUG.md)
Luna - FOSDEM (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/498/feedback/Luna%20-%20FOSDEM.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, cli, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS auditing for storage Performance, Privilege drop; privilege separation; and restricted-service operating mode in OpenBSD, OPNsense 23.1.1 release, Cloning a System with Ansible, FOSDEM 2023, BSDCan 2023 Travel Grants</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-auditing-for-storage-performance/" rel="nofollow">OpenZFS auditing for storage Performance</a></h3>

<hr>

<h3><a href="https://sha256.net/privsep.html" rel="nofollow">Privilege drop, privilege separation, and restricted-service operating mode in OpenBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://forum.opnsense.org/index.php?topic=32484.0" rel="nofollow">OPNsense 23.1.1 released</a></h3>

<hr>

<h3><a href="https://kernelpanic.life/software/cloning-a-system-with-ansible.html" rel="nofollow">Cloning a System with Ansible</a></h3>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/fosdem_2023" rel="nofollow">FOSDEM 2023</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/bsdcan-2023-travel-grant-application-now-open/" rel="nofollow">BSDCan 2023 Travel Grant Application Now Open</a></h3>

<hr>

<h2>The Undeadly Bits</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20230120073530" rel="nofollow">Game of Trees milestone</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230210065830" rel="nofollow">Game of Trees Daemon - video and slides (May make the older game of trees obsolete)</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230121125423" rel="nofollow">amd64 execute-only committed to -current</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230214061952" rel="nofollow">Using /bin/eject with USB flash drives</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230214061330" rel="nofollow">Tunneling vxlan(4) over WireGuard wg(4)</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230128183032" rel="nofollow">Console screendumps</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230130061324" rel="nofollow">Execute-only status report</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230226065006" rel="nofollow">OpenBSD in Canada</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230219234206" rel="nofollow">Privilege drop, privilege separation, and restricted-service operating mode in OpenBSD</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230222064027" rel="nofollow">Theo de Raadt on pinsyscall(2)</a></p>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/498/feedback/Kevin%20-%20PLUG.md" rel="nofollow">Kevin - PLUG</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/498/feedback/Luna%20-%20FOSDEM.md" rel="nofollow">Luna - FOSDEM</a>
***

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS auditing for storage Performance, Privilege drop; privilege separation; and restricted-service operating mode in OpenBSD, OPNsense 23.1.1 release, Cloning a System with Ansible, FOSDEM 2023, BSDCan 2023 Travel Grants</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/openzfs-auditing-for-storage-performance/" rel="nofollow">OpenZFS auditing for storage Performance</a></h3>

<hr>

<h3><a href="https://sha256.net/privsep.html" rel="nofollow">Privilege drop, privilege separation, and restricted-service operating mode in OpenBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://forum.opnsense.org/index.php?topic=32484.0" rel="nofollow">OPNsense 23.1.1 released</a></h3>

<hr>

<h3><a href="https://kernelpanic.life/software/cloning-a-system-with-ansible.html" rel="nofollow">Cloning a System with Ansible</a></h3>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/fosdem_2023" rel="nofollow">FOSDEM 2023</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/bsdcan-2023-travel-grant-application-now-open/" rel="nofollow">BSDCan 2023 Travel Grant Application Now Open</a></h3>

<hr>

<h2>The Undeadly Bits</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20230120073530" rel="nofollow">Game of Trees milestone</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230210065830" rel="nofollow">Game of Trees Daemon - video and slides (May make the older game of trees obsolete)</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230121125423" rel="nofollow">amd64 execute-only committed to -current</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230214061952" rel="nofollow">Using /bin/eject with USB flash drives</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230214061330" rel="nofollow">Tunneling vxlan(4) over WireGuard wg(4)</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230128183032" rel="nofollow">Console screendumps</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230130061324" rel="nofollow">Execute-only status report</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230226065006" rel="nofollow">OpenBSD in Canada</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230219234206" rel="nofollow">Privilege drop, privilege separation, and restricted-service operating mode in OpenBSD</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20230222064027" rel="nofollow">Theo de Raadt on pinsyscall(2)</a></p>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/498/feedback/Kevin%20-%20PLUG.md" rel="nofollow">Kevin - PLUG</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/498/feedback/Luna%20-%20FOSDEM.md" rel="nofollow">Luna - FOSDEM</a>
***

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>497: Random Relinking SSHD</title>
  <link>https://www.bsdnow.tv/497</link>
  <guid isPermaLink="false">ce12be7b-8931-4d43-be2e-6260b5a41aff</guid>
  <pubDate>Thu, 09 Mar 2023 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ce12be7b-8931-4d43-be2e-6260b5a41aff.mp3" length="40798848" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>How to Catch a Bitcoin Miner, A Call For More Collaboration, zstd updates, hating hackathons, How to monitor multiple log files at once, KeePassXC, sshd random relinking at boot, and more</itunes:subtitle>
  <itunes:duration>42:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>How to Catch a Bitcoin Miner, A Call For More Collaboration, zstd updates, hating hackathons, How to monitor multiple log files at once, KeePassXC, sshd random relinking at boot, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Sysadmin Series - How to Catch a Bitcoin Miner (https://klarasystems.com/articles/sysadmin-series-how-to-catch-a-bitcoin-miner/)
A Call For More Collaboration &amp;amp; Harmony Among BSD Hardware Drivers (https://fosdem.org/2023/schedule/event/bsd_driver_harmony/)
• [Slides](https://fosdem.org/2023/schedule/event/bsd_driver_harmony/attachments/slides/5976/export/events/attachments/bsd_driver_harmony/slides/5976/BSD_Driver_Harmony_FOSDEM.pdf)
• Video is embedded on the schedule event page
Printing on FreeBSD (https://vermaden.wordpress.com/2023/02/07/print-on-freebsd/)
News Roundup
zstd updates (https://github.com/facebook/zstd/releases/tag/v1.5.4)
I hate hackathons (https://pgpt.substack.com/p/i-hate-hackathons)
How to monitor multiple log files at once (https://sleeplessbeastie.eu/2023/02/01/how-to-monitor-multiple-log-files-at-once/)
Notes to self: KeePassXC (https://jpmens.net/2023/01/22/notes-to-self-keepassxc/)
sshd random relinking at boot (http://undeadly.org/cgi?action=article;sid=20230119075627)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Nelson - aix.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/497/feedback/Nelson%20-%20aix.md)
Adrian - vbsdcon (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/497/feedback/Adrian%20-%20vbsdcon.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, bitcoin, miner, collaboration, fosdem, hardware drivers, driver development, zstd, hackathon, monitor, logs, log file, keepassxc, sshd, random relinking </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>How to Catch a Bitcoin Miner, A Call For More Collaboration, zstd updates, hating hackathons, How to monitor multiple log files at once, KeePassXC, sshd random relinking at boot, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/sysadmin-series-how-to-catch-a-bitcoin-miner/" rel="nofollow">Sysadmin Series - How to Catch a Bitcoin Miner</a></h3>

<hr>

<h3><a href="https://fosdem.org/2023/schedule/event/bsd_driver_harmony/" rel="nofollow">A Call For More Collaboration &amp; Harmony Among BSD Hardware Drivers</a></h3>

<pre><code>• [Slides](https://fosdem.org/2023/schedule/event/bsd_driver_harmony/attachments/slides/5976/export/events/attachments/bsd_driver_harmony/slides/5976/BSD_Driver_Harmony_FOSDEM.pdf)
• Video is embedded on the schedule event page
</code></pre>

<hr>

<h3><a href="https://vermaden.wordpress.com/2023/02/07/print-on-freebsd/" rel="nofollow">Printing on FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/facebook/zstd/releases/tag/v1.5.4" rel="nofollow">zstd updates</a></h3>

<hr>

<h3><a href="https://pgpt.substack.com/p/i-hate-hackathons" rel="nofollow">I hate hackathons</a></h3>

<hr>

<h3><a href="https://sleeplessbeastie.eu/2023/02/01/how-to-monitor-multiple-log-files-at-once/" rel="nofollow">How to monitor multiple log files at once</a></h3>

<hr>

<h3><a href="https://jpmens.net/2023/01/22/notes-to-self-keepassxc/" rel="nofollow">Notes to self: KeePassXC</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230119075627" rel="nofollow">sshd random relinking at boot</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/497/feedback/Nelson%20-%20aix.md" rel="nofollow">Nelson - aix.md</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/497/feedback/Adrian%20-%20vbsdcon.md" rel="nofollow">Adrian - vbsdcon</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>How to Catch a Bitcoin Miner, A Call For More Collaboration, zstd updates, hating hackathons, How to monitor multiple log files at once, KeePassXC, sshd random relinking at boot, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/sysadmin-series-how-to-catch-a-bitcoin-miner/" rel="nofollow">Sysadmin Series - How to Catch a Bitcoin Miner</a></h3>

<hr>

<h3><a href="https://fosdem.org/2023/schedule/event/bsd_driver_harmony/" rel="nofollow">A Call For More Collaboration &amp; Harmony Among BSD Hardware Drivers</a></h3>

<pre><code>• [Slides](https://fosdem.org/2023/schedule/event/bsd_driver_harmony/attachments/slides/5976/export/events/attachments/bsd_driver_harmony/slides/5976/BSD_Driver_Harmony_FOSDEM.pdf)
• Video is embedded on the schedule event page
</code></pre>

<hr>

<h3><a href="https://vermaden.wordpress.com/2023/02/07/print-on-freebsd/" rel="nofollow">Printing on FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/facebook/zstd/releases/tag/v1.5.4" rel="nofollow">zstd updates</a></h3>

<hr>

<h3><a href="https://pgpt.substack.com/p/i-hate-hackathons" rel="nofollow">I hate hackathons</a></h3>

<hr>

<h3><a href="https://sleeplessbeastie.eu/2023/02/01/how-to-monitor-multiple-log-files-at-once/" rel="nofollow">How to monitor multiple log files at once</a></h3>

<hr>

<h3><a href="https://jpmens.net/2023/01/22/notes-to-self-keepassxc/" rel="nofollow">Notes to self: KeePassXC</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20230119075627" rel="nofollow">sshd random relinking at boot</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/497/feedback/Nelson%20-%20aix.md" rel="nofollow">Nelson - aix.md</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/497/feedback/Adrian%20-%20vbsdcon.md" rel="nofollow">Adrian - vbsdcon</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>496: Hacking the CLI</title>
  <link>https://www.bsdnow.tv/496</link>
  <guid isPermaLink="false">2c0b464e-375e-42af-b44a-62ca75b4b31a</guid>
  <pubDate>Thu, 02 Mar 2023 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2c0b464e-375e-42af-b44a-62ca75b4b31a.mp3" length="43280256" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Automation and Hacking Your FreeBSD CLI, Run your own instant messaging service on FreeBSD, Watch Netflix on FreeBSD, HardenedBSD January 2023 Status Report, How To Set Up SSH Keys With YubiKey as two-factor authentication, OpenSSH fixes double-free memory bug that’s pokable over the network, A late announcement, but better late than never, Next NYC*BUG and more</itunes:subtitle>
  <itunes:duration>45:05</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Automation and Hacking Your FreeBSD CLI, Run your own instant messaging service on FreeBSD, Watch Netflix on FreeBSD, HardenedBSD January 2023 Status Report, How To Set Up SSH Keys With YubiKey as two-factor authentication, OpenSSH fixes double-free memory bug that’s pokable over the network, A late announcement, but better late than never, Next NYC*BUG and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Automation and Hacking Your FreeBSD CLI (https://klarasystems.com/articles/automation-and-hacking-your-freebsd-cli/)
Run your own instant messaging service on FreeBSD (https://xn--gckvb8fzb.com/run-your-own-instant-messaging-service-on-freebsd/)
News Roundup
Watch Netflix on FreeBSD (https://byte--sized-de.translate.goog/linux-unix/netflix-auf-freebsd-schauen/?_x_tr_sl=de&amp;amp;_x_tr_tl=en&amp;amp;_x_tr_hl=en&amp;amp;_x_tr_pto=wapp)
HardenedBSD January 2023 Status Report (https://hardenedbsd.org/article/shawn-webb/2023-01-31/hardenedbsd-january-2023-status-report)
How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2) (https://www.cyberciti.biz/security/how-to-set-up-ssh-keys-with-yubikey-as-two-factor-authentication-u2f-fido2/)
OpenSSH fixes double-free memory bug that’s pokable over the network (https://nakedsecurity.sophos.com/2023/02/03/openssh-fixes-double-free-memory-bug-thats-pokable-over-the-network/)
A late announcement, but better late than never (https://github.com/chettrick/discobsd/releases/tag/DISCOBSD_2_0)
Next NYC*BUG: March? April? Certainly May! (https://lists.nycbug.org:8443/pipermail/talk/2023-February/018550.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Daniel - Plan 9 lives (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/496/feedback/Daniel%20-%20Plan%209%20lives.md)
Jason - nvd driver (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/496/feedback/Jason%20-%20nvd%20driver.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, automation, hacking, cli, instant message, messaging, netflix, status report, ssh, keys, 2fa, memory, bug, bugfix, fix, discobsd, nycbug</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Automation and Hacking Your FreeBSD CLI, Run your own instant messaging service on FreeBSD, Watch Netflix on FreeBSD, HardenedBSD January 2023 Status Report, How To Set Up SSH Keys With YubiKey as two-factor authentication, OpenSSH fixes double-free memory bug that’s pokable over the network, A late announcement, but better late than never, Next NYC*BUG and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/automation-and-hacking-your-freebsd-cli/" rel="nofollow">Automation and Hacking Your FreeBSD CLI</a></h3>

<hr>

<h3><a href="https://xn--gckvb8fzb.com/run-your-own-instant-messaging-service-on-freebsd/" rel="nofollow">Run your own instant messaging service on FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://byte--sized-de.translate.goog/linux-unix/netflix-auf-freebsd-schauen/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" rel="nofollow">Watch Netflix on FreeBSD</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2023-01-31/hardenedbsd-january-2023-status-report" rel="nofollow">HardenedBSD January 2023 Status Report</a></h3>

<hr>

<h3><a href="https://www.cyberciti.biz/security/how-to-set-up-ssh-keys-with-yubikey-as-two-factor-authentication-u2f-fido2/" rel="nofollow">How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)</a></h3>

<hr>

<h3><a href="https://nakedsecurity.sophos.com/2023/02/03/openssh-fixes-double-free-memory-bug-thats-pokable-over-the-network/" rel="nofollow">OpenSSH fixes double-free memory bug that’s pokable over the network</a></h3>

<hr>

<h3><a href="https://github.com/chettrick/discobsd/releases/tag/DISCOBSD_2_0" rel="nofollow">A late announcement, but better late than never</a></h3>

<hr>

<h3><a href="https://lists.nycbug.org:8443/pipermail/talk/2023-February/018550.html" rel="nofollow">Next NYC*BUG: March? April? Certainly May!</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/496/feedback/Daniel%20-%20Plan%209%20lives.md" rel="nofollow">Daniel - Plan 9 lives</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/496/feedback/Jason%20-%20nvd%20driver.md" rel="nofollow">Jason - nvd driver</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Automation and Hacking Your FreeBSD CLI, Run your own instant messaging service on FreeBSD, Watch Netflix on FreeBSD, HardenedBSD January 2023 Status Report, How To Set Up SSH Keys With YubiKey as two-factor authentication, OpenSSH fixes double-free memory bug that’s pokable over the network, A late announcement, but better late than never, Next NYC*BUG and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/automation-and-hacking-your-freebsd-cli/" rel="nofollow">Automation and Hacking Your FreeBSD CLI</a></h3>

<hr>

<h3><a href="https://xn--gckvb8fzb.com/run-your-own-instant-messaging-service-on-freebsd/" rel="nofollow">Run your own instant messaging service on FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://byte--sized-de.translate.goog/linux-unix/netflix-auf-freebsd-schauen/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" rel="nofollow">Watch Netflix on FreeBSD</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2023-01-31/hardenedbsd-january-2023-status-report" rel="nofollow">HardenedBSD January 2023 Status Report</a></h3>

<hr>

<h3><a href="https://www.cyberciti.biz/security/how-to-set-up-ssh-keys-with-yubikey-as-two-factor-authentication-u2f-fido2/" rel="nofollow">How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)</a></h3>

<hr>

<h3><a href="https://nakedsecurity.sophos.com/2023/02/03/openssh-fixes-double-free-memory-bug-thats-pokable-over-the-network/" rel="nofollow">OpenSSH fixes double-free memory bug that’s pokable over the network</a></h3>

<hr>

<h3><a href="https://github.com/chettrick/discobsd/releases/tag/DISCOBSD_2_0" rel="nofollow">A late announcement, but better late than never</a></h3>

<hr>

<h3><a href="https://lists.nycbug.org:8443/pipermail/talk/2023-February/018550.html" rel="nofollow">Next NYC*BUG: March? April? Certainly May!</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/496/feedback/Daniel%20-%20Plan%209%20lives.md" rel="nofollow">Daniel - Plan 9 lives</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/496/feedback/Jason%20-%20nvd%20driver.md" rel="nofollow">Jason - nvd driver</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>495: Limited Jail Time</title>
  <link>https://www.bsdnow.tv/495</link>
  <guid isPermaLink="false">3a14bc16-5c33-4eb2-970e-fba476718e64</guid>
  <pubDate>Thu, 23 Feb 2023 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3a14bc16-5c33-4eb2-970e-fba476718e64.mp3" length="29095680" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Status Report Fourth Quarter 2022, How to limit a jail, the parallel port, Hello System 0.8, Solbournes in space, and more</itunes:subtitle>
  <itunes:duration>30:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Status Report Fourth Quarter 2022, How to limit a jail, the parallel port, Hello System 0.8, Solbournes in space, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Status Report Fourth Quarter 2022 (https://www.freebsd.org/status/report-2022-10-2022-12/)
How to limit a jail (https://dan.langille.org/2023/01/16/how-to-limit-a-jail/)
News Roundup
The parallel port (https://computer.rip/2023-01-29-the-parallel-port.html)
Hello System 0.8 is out (https://github.com/helloSystem/ISO/releases/tag/r0.8.0)
Solbournes in space (https://oldvcr.blogspot.com/2023/01/solbournes-in-space.html)
Beastie Bits
Collecting notes for future “historians” was: Earliest UNIX Workstations? (https://minnie.tuhs.org/pipermail/tuhs/2023-January/027495.html)
New Open Position: FreeBSD Userland Software Developer (https://freebsdfoundation.org/blog/new-open-position-freebsd-userland-software-developer/)
The One Lone Audiobook now exclusive on my store (https://mwl.io/archives/22539)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, status report, fourth quarter, limit, resource use, resource limits, parallel port, hello system, solbournes, space</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Status Report Fourth Quarter 2022, How to limit a jail, the parallel port, Hello System 0.8, Solbournes in space, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2022-10-2022-12/" rel="nofollow">FreeBSD Status Report Fourth Quarter 2022</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2023/01/16/how-to-limit-a-jail/" rel="nofollow">How to limit a jail</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://computer.rip/2023-01-29-the-parallel-port.html" rel="nofollow">The parallel port</a></h3>

<hr>

<h3><a href="https://github.com/helloSystem/ISO/releases/tag/r0.8.0" rel="nofollow">Hello System 0.8 is out</a></h3>

<hr>

<h3><a href="https://oldvcr.blogspot.com/2023/01/solbournes-in-space.html" rel="nofollow">Solbournes in space</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://minnie.tuhs.org/pipermail/tuhs/2023-January/027495.html" rel="nofollow">Collecting notes for future “historians” was: Earliest UNIX Workstations?</a></li>
<li><a href="https://freebsdfoundation.org/blog/new-open-position-freebsd-userland-software-developer/" rel="nofollow">New Open Position: FreeBSD Userland Software Developer</a></li>
<li><a href="https://mwl.io/archives/22539" rel="nofollow">The One Lone Audiobook now exclusive on my store</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Status Report Fourth Quarter 2022, How to limit a jail, the parallel port, Hello System 0.8, Solbournes in space, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2022-10-2022-12/" rel="nofollow">FreeBSD Status Report Fourth Quarter 2022</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2023/01/16/how-to-limit-a-jail/" rel="nofollow">How to limit a jail</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://computer.rip/2023-01-29-the-parallel-port.html" rel="nofollow">The parallel port</a></h3>

<hr>

<h3><a href="https://github.com/helloSystem/ISO/releases/tag/r0.8.0" rel="nofollow">Hello System 0.8 is out</a></h3>

<hr>

<h3><a href="https://oldvcr.blogspot.com/2023/01/solbournes-in-space.html" rel="nofollow">Solbournes in space</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://minnie.tuhs.org/pipermail/tuhs/2023-January/027495.html" rel="nofollow">Collecting notes for future “historians” was: Earliest UNIX Workstations?</a></li>
<li><a href="https://freebsdfoundation.org/blog/new-open-position-freebsd-userland-software-developer/" rel="nofollow">New Open Position: FreeBSD Userland Software Developer</a></li>
<li><a href="https://mwl.io/archives/22539" rel="nofollow">The One Lone Audiobook now exclusive on my store</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>494: Unix workstation extinction</title>
  <link>https://www.bsdnow.tv/494</link>
  <guid isPermaLink="false">b6bd08a9-8d1d-4bc9-8024-a8153fe7b304</guid>
  <pubDate>Thu, 16 Feb 2023 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b6bd08a9-8d1d-4bc9-8024-a8153fe7b304.mp3" length="44895744" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Mass extinction of UNIX workstations, Determine Who Can Log In to an SSH Server, Factors When Considering FreeBSD vs. Linux Packages, A Visual Guide to SSH Tunnels, Harvesting the Noise While it’s Fresh, Bastille - The Jail Manager on FreeBSD, and more</itunes:subtitle>
  <itunes:duration>46:45</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Mass extinction of UNIX workstations, Determine Who Can Log In to an SSH Server, Factors When Considering FreeBSD vs. Linux Packages, A Visual Guide to SSH Tunnels, Harvesting the Noise While it’s Fresh, Bastille - The Jail Manager on FreeBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The mass extinction of UNIX workstations (https://www.osnews.com/story/135605/the-mass-extinction-of-unix-workstations/)
whoarethey: Determine Who Can Log In to an SSH Server (https://www.agwa.name/blog/post/whoarethey)
News Roundup
FreeBSD vs. Linux 5 Factors When Considering FreeBSD vs. Linux: Packages (https://klarasystems.com/articles/freebsd-vs-linux-5-factors-when-considering-freebsd-vs-linux-package-management/)
A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding (https://iximiuz.com/en/posts/ssh-tunnels/)
Harvesting the Noise While it’s Fresh, Revisited (https://medium.com/@peter.hansteen/harvesting-the-noise-while-its-fresh-revisited-3da1894cc8a7)
Bastille - The Jail Manager on FreeBSD (https://byte--sized-de.translate.goog/linux-unix/bastille-der-jail-manager-unter-freebsd/?_x_tr_sl=de&amp;amp;_x_tr_tl=en&amp;amp;_x_tr_hl=en&amp;amp;_x_tr_pto=wapp)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, workstation, factors, deciding, decision, comparison, ssh, login, visual guide, tunnel, bastille, jail manager</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Mass extinction of UNIX workstations, Determine Who Can Log In to an SSH Server, Factors When Considering FreeBSD vs. Linux Packages, A Visual Guide to SSH Tunnels, Harvesting the Noise While it’s Fresh, Bastille - The Jail Manager on FreeBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.osnews.com/story/135605/the-mass-extinction-of-unix-workstations/" rel="nofollow">The mass extinction of UNIX workstations</a></h3>

<hr>

<h3><a href="https://www.agwa.name/blog/post/whoarethey" rel="nofollow">whoarethey: Determine Who Can Log In to an SSH Server</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-vs-linux-5-factors-when-considering-freebsd-vs-linux-package-management/" rel="nofollow">FreeBSD vs. Linux 5 Factors When Considering FreeBSD vs. Linux: Packages</a></h3>

<hr>

<h3><a href="https://iximiuz.com/en/posts/ssh-tunnels/" rel="nofollow">A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding</a></h3>

<hr>

<h3><a href="https://medium.com/@peter.hansteen/harvesting-the-noise-while-its-fresh-revisited-3da1894cc8a7" rel="nofollow">Harvesting the Noise While it’s Fresh, Revisited</a></h3>

<hr>

<h3><a href="https://byte--sized-de.translate.goog/linux-unix/bastille-der-jail-manager-unter-freebsd/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" rel="nofollow">Bastille - The Jail Manager on FreeBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Mass extinction of UNIX workstations, Determine Who Can Log In to an SSH Server, Factors When Considering FreeBSD vs. Linux Packages, A Visual Guide to SSH Tunnels, Harvesting the Noise While it’s Fresh, Bastille - The Jail Manager on FreeBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.osnews.com/story/135605/the-mass-extinction-of-unix-workstations/" rel="nofollow">The mass extinction of UNIX workstations</a></h3>

<hr>

<h3><a href="https://www.agwa.name/blog/post/whoarethey" rel="nofollow">whoarethey: Determine Who Can Log In to an SSH Server</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-vs-linux-5-factors-when-considering-freebsd-vs-linux-package-management/" rel="nofollow">FreeBSD vs. Linux 5 Factors When Considering FreeBSD vs. Linux: Packages</a></h3>

<hr>

<h3><a href="https://iximiuz.com/en/posts/ssh-tunnels/" rel="nofollow">A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding</a></h3>

<hr>

<h3><a href="https://medium.com/@peter.hansteen/harvesting-the-noise-while-its-fresh-revisited-3da1894cc8a7" rel="nofollow">Harvesting the Noise While it’s Fresh, Revisited</a></h3>

<hr>

<h3><a href="https://byte--sized-de.translate.goog/linux-unix/bastille-der-jail-manager-unter-freebsd/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" rel="nofollow">Bastille - The Jail Manager on FreeBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>493: Dotfile Management</title>
  <link>https://www.bsdnow.tv/493</link>
  <guid isPermaLink="false">ef98d63f-3086-456f-9297-d17503684aec</guid>
  <pubDate>Thu, 09 Feb 2023 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ef98d63f-3086-456f-9297-d17503684aec.mp3" length="40797696" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Write Admin tools from Day One, Differentiating between Data Security and Data Integrity, 45 year-old Unix tool is finally getting an upgrade, OpenBSD 7.2 on an ODROID-HC4, Dotfiles Management, and more</itunes:subtitle>
  <itunes:duration>42:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Write Admin tools from Day One, Differentiating between Data Security and Data Integrity, 45 year-old Unix tool is finally getting an upgrade, OpenBSD 7.2 on an ODROID-HC4, Dotfiles Management, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Write Admin tools from Day One (https://milwaukeemaven.blogspot.com/2022/08/write-admin-tools-from-day-one.html)
Differentiating between Data Security and Data Integrity (https://klarasystems.com/articles/openzfs-data-security-vs-integrity/)
News Roundup
This 45 year-old Unix tool is finally getting an upgrade (https://www.techradar.com/news/45-year-old-unix-tool-finally-gets-an-upgrade)
Installing OpenBSD 7.2 on an ODROID-HC4 (https://www.tumfatig.net/2022/install-openbsd-odroid-hc4/)
Dotfiles Management (https://mitxela.com/projects/dotfiles_management)
Beastie Bits
FreeBSD Journal - November/December 2022 - Observability and Metrics (https://freebsdfoundation.org/past-issues/observability-and-metrics/)
HAMMER2 file system for NetBSD (https://github.com/kusumi/netbsd_hammer2)
Running OpenBSD 7.2 on your laptop is really hard (not) (https://sohcahtoa.org.uk/openbsd.html)
MinIO on OpenBSD 7.2: Install (https://dev.to/nabbisen/minio-on-openbsd-72-install-3b3h)
WireGuard VPN on OpenBSD (https://www.adrianobarbosa.xyz/blog/openbsd-wireguard.html)
A tool for glamorous shell scripts (https://github.com/charmbracelet/gum)
Visualize your git commits with a heat map in the terminal (https://github.com/james-stoup/heatwave)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>reebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, admin, tool, data security, data integrity, odroid hc4, dotfiles, configuration file, management</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Write Admin tools from Day One, Differentiating between Data Security and Data Integrity, 45 year-old Unix tool is finally getting an upgrade, OpenBSD 7.2 on an ODROID-HC4, Dotfiles Management, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://milwaukeemaven.blogspot.com/2022/08/write-admin-tools-from-day-one.html" rel="nofollow">Write Admin tools from Day One</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/openzfs-data-security-vs-integrity/" rel="nofollow">Differentiating between Data Security and Data Integrity</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.techradar.com/news/45-year-old-unix-tool-finally-gets-an-upgrade" rel="nofollow">This 45 year-old Unix tool is finally getting an upgrade</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2022/install-openbsd-odroid-hc4/" rel="nofollow">Installing OpenBSD 7.2 on an ODROID-HC4</a></h3>

<hr>

<h3><a href="https://mitxela.com/projects/dotfiles_management" rel="nofollow">Dotfiles Management</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://freebsdfoundation.org/past-issues/observability-and-metrics/" rel="nofollow">FreeBSD Journal - November/December 2022 - Observability and Metrics</a><br>
<a href="https://github.com/kusumi/netbsd_hammer2" rel="nofollow">HAMMER2 file system for NetBSD</a><br>
<a href="https://sohcahtoa.org.uk/openbsd.html" rel="nofollow">Running OpenBSD 7.2 on your laptop is really hard (not)</a><br>
<a href="https://dev.to/nabbisen/minio-on-openbsd-72-install-3b3h" rel="nofollow">MinIO on OpenBSD 7.2: Install</a><br>
<a href="https://www.adrianobarbosa.xyz/blog/openbsd-wireguard.html" rel="nofollow">WireGuard VPN on OpenBSD</a><br>
<a href="https://github.com/charmbracelet/gum" rel="nofollow">A tool for glamorous shell scripts</a><br>
<a href="https://github.com/james-stoup/heatwave" rel="nofollow">Visualize your git commits with a heat map in the terminal</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Write Admin tools from Day One, Differentiating between Data Security and Data Integrity, 45 year-old Unix tool is finally getting an upgrade, OpenBSD 7.2 on an ODROID-HC4, Dotfiles Management, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://milwaukeemaven.blogspot.com/2022/08/write-admin-tools-from-day-one.html" rel="nofollow">Write Admin tools from Day One</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/openzfs-data-security-vs-integrity/" rel="nofollow">Differentiating between Data Security and Data Integrity</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.techradar.com/news/45-year-old-unix-tool-finally-gets-an-upgrade" rel="nofollow">This 45 year-old Unix tool is finally getting an upgrade</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2022/install-openbsd-odroid-hc4/" rel="nofollow">Installing OpenBSD 7.2 on an ODROID-HC4</a></h3>

<hr>

<h3><a href="https://mitxela.com/projects/dotfiles_management" rel="nofollow">Dotfiles Management</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://freebsdfoundation.org/past-issues/observability-and-metrics/" rel="nofollow">FreeBSD Journal - November/December 2022 - Observability and Metrics</a><br>
<a href="https://github.com/kusumi/netbsd_hammer2" rel="nofollow">HAMMER2 file system for NetBSD</a><br>
<a href="https://sohcahtoa.org.uk/openbsd.html" rel="nofollow">Running OpenBSD 7.2 on your laptop is really hard (not)</a><br>
<a href="https://dev.to/nabbisen/minio-on-openbsd-72-install-3b3h" rel="nofollow">MinIO on OpenBSD 7.2: Install</a><br>
<a href="https://www.adrianobarbosa.xyz/blog/openbsd-wireguard.html" rel="nofollow">WireGuard VPN on OpenBSD</a><br>
<a href="https://github.com/charmbracelet/gum" rel="nofollow">A tool for glamorous shell scripts</a><br>
<a href="https://github.com/james-stoup/heatwave" rel="nofollow">Visualize your git commits with a heat map in the terminal</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>492: Feeling for NetBSD</title>
  <link>https://www.bsdnow.tv/492</link>
  <guid isPermaLink="false">2bb426c2-2403-431d-8816-4a3cd7ce8662</guid>
  <pubDate>Thu, 02 Feb 2023 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2bb426c2-2403-431d-8816-4a3cd7ce8662.mp3" length="37183104" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Writing your own operating system, Continuous Integration and Quality Assurance Update, feeling for the NetBSD community, Testing wanted: execute-only on amd64, GCC uses Modula-2 and Rust, do they work on OpenBSD, Unix is dead; long live Unix, and more</itunes:subtitle>
  <itunes:duration>38:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Writing your own operating system, Continuous Integration and Quality Assurance Update, feeling for the NetBSD community, Testing wanted: execute-only on amd64, GCC uses Modula-2 and Rust, do they work on OpenBSD, Unix is dead; long live Unix, and more
 NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Part 1: Writing your own operating system (https://o-oconnell.github.io/2023/01/12/p1os.html)
2022 in Review: Continuous Integration and Quality Assurance Update (https://freebsdfoundation.org/blog/2022-in-review-continuous-integration-and-quality-assurance-update/)
News Roundup
I feel for the NetBSD community (https://rubenerd.com/i-feel-for-the-netbsd-community/)
Testing wanted: execute-only on amd64 (https://www.undeadly.org/cgi?action=article;sid=20230115095258)
GCC now includes Modula-2 and Rust. Do they work on OpenBSD? (https://briancallahan.net/blog/)
Unix is dead. Long live Unix! (https://www.theregister.com/2023/01/17/unix_is_dead/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
• [Kevin - Advent of Computing podcast covers BSD](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/492/feedback/Kevin%20-%20Advent%20of%20Computing%20podcast%20covers%20BSD.md)
• [ilo - thanks](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/492/feedback/ilo%20-%20thanks.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, development, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, continuous integration, CI, CD, Quality assurance, QA, execute-only, amd64, architecture, gcc, modula-2, rust</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Writing your own operating system, Continuous Integration and Quality Assurance Update, feeling for the NetBSD community, Testing wanted: execute-only on amd64, GCC uses Modula-2 and Rust, do they work on OpenBSD, Unix is dead; long live Unix, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://o-oconnell.github.io/2023/01/12/p1os.html" rel="nofollow">Part 1: Writing your own operating system</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/2022-in-review-continuous-integration-and-quality-assurance-update/" rel="nofollow">2022 in Review: Continuous Integration and Quality Assurance Update</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://rubenerd.com/i-feel-for-the-netbsd-community/" rel="nofollow">I feel for the NetBSD community</a></h3>

<hr>

<h3><a href="https://www.undeadly.org/cgi?action=article;sid=20230115095258" rel="nofollow">Testing wanted: execute-only on amd64</a></h3>

<hr>

<h3><a href="https://briancallahan.net/blog/" rel="nofollow">GCC now includes Modula-2 and Rust. Do they work on OpenBSD?</a></h3>

<hr>

<h3><a href="https://www.theregister.com/2023/01/17/unix_is_dead/" rel="nofollow">Unix is dead. Long live Unix!</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• [Kevin - Advent of Computing podcast covers BSD](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/492/feedback/Kevin%20-%20Advent%20of%20Computing%20podcast%20covers%20BSD.md)
• [ilo - thanks](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/492/feedback/ilo%20-%20thanks.md)
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Writing your own operating system, Continuous Integration and Quality Assurance Update, feeling for the NetBSD community, Testing wanted: execute-only on amd64, GCC uses Modula-2 and Rust, do they work on OpenBSD, Unix is dead; long live Unix, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://o-oconnell.github.io/2023/01/12/p1os.html" rel="nofollow">Part 1: Writing your own operating system</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/2022-in-review-continuous-integration-and-quality-assurance-update/" rel="nofollow">2022 in Review: Continuous Integration and Quality Assurance Update</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://rubenerd.com/i-feel-for-the-netbsd-community/" rel="nofollow">I feel for the NetBSD community</a></h3>

<hr>

<h3><a href="https://www.undeadly.org/cgi?action=article;sid=20230115095258" rel="nofollow">Testing wanted: execute-only on amd64</a></h3>

<hr>

<h3><a href="https://briancallahan.net/blog/" rel="nofollow">GCC now includes Modula-2 and Rust. Do they work on OpenBSD?</a></h3>

<hr>

<h3><a href="https://www.theregister.com/2023/01/17/unix_is_dead/" rel="nofollow">Unix is dead. Long live Unix!</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• [Kevin - Advent of Computing podcast covers BSD](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/492/feedback/Kevin%20-%20Advent%20of%20Computing%20podcast%20covers%20BSD.md)
• [ilo - thanks](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/492/feedback/ilo%20-%20thanks.md)
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>491: Catch the Spammers</title>
  <link>https://www.bsdnow.tv/491</link>
  <guid isPermaLink="false">26dff077-f214-46c7-9ba3-a577e3c443df</guid>
  <pubDate>Thu, 26 Jan 2023 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/26dff077-f214-46c7-9ba3-a577e3c443df.mp3" length="40619520" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Dragonfly BSD 6.4 is out, Running OpenZFS – Choosing Between FreeBSD and Linux, OpenBSD Mastery: Filesystems ebook leaks, catching 71% spam, crazy unix shell prompts, Linux Binary Compatibility: Ubuntu on FreeBSD, Reproducible Builds Summit Venice 2022, and more</itunes:subtitle>
  <itunes:duration>42:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Dragonfly BSD 6.4 is out, Running OpenZFS – Choosing Between FreeBSD and Linux, OpenBSD Mastery: Filesystems ebook leaks, catching 71% spam, crazy unix shell prompts, Linux Binary Compatibility: Ubuntu on FreeBSD, Reproducible Builds Summit Venice 2022, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Dragonfly BSD 6.4 is out (https://www.dragonflybsd.org/release64/)
Running OpenZFS – Choosing Between FreeBSD and Linux (https://klarasystems.com/articles/running-openzfs-choosing-between-freebsd-and-linux/)
News Roundup
“OpenBSD Mastery: Filesystems” ebook leaking out (https://mwl.io/archives/22462)
Can Your Spam-eater Manage to Catch Seventy-one Percent Like This Other Service? (https://bsdly.blogspot.com/2022/12/can-your-spam-eater-manage-to-catch.html)
Crazy unix shell prompts (https://lists.nycbug.org:8443/pipermail/semibug/2022-December/000775.html)
Linux Binary Compatibility: Ubuntu on FreeBSD (https://byte--sized-de.translate.goog/linux-unix/linux-binary-compatibility-ubuntu-unter-freebsd/?_x_tr_sl=auto&amp;amp;_x_tr_tl=en&amp;amp;_x_tr_hl=en&amp;amp;_x_tr_pto=wapp)
Reproducible Builds Summit Venice 2022 (https://blog.netbsd.org/tnf/entry/reproducible_builds_summit_venice_2022)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Felix - Managing Jails with ansible (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/Felix%20-%20Managing%20Jails%20with%20ansible.md)
John Baldwin - bhyve networking setup article (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/John%20Baldwin%20-%20bhyve%20networking%20setup%20article.md)
Welton - bhyve webadmin (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/Welton%20-%20bhyve%20webadmin.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, ebook, leaks, spam, spam trap, unix shell prompt, binary compatibility, reproducible builds, summit, venice</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Dragonfly BSD 6.4 is out, Running OpenZFS – Choosing Between FreeBSD and Linux, OpenBSD Mastery: Filesystems ebook leaks, catching 71% spam, crazy unix shell prompts, Linux Binary Compatibility: Ubuntu on FreeBSD, Reproducible Builds Summit Venice 2022, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.dragonflybsd.org/release64/" rel="nofollow">Dragonfly BSD 6.4 is out</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/running-openzfs-choosing-between-freebsd-and-linux/" rel="nofollow">Running OpenZFS – Choosing Between FreeBSD and Linux</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mwl.io/archives/22462" rel="nofollow">“OpenBSD Mastery: Filesystems” ebook leaking out</a></h3>

<hr>

<h3><a href="https://bsdly.blogspot.com/2022/12/can-your-spam-eater-manage-to-catch.html" rel="nofollow">Can Your Spam-eater Manage to Catch Seventy-one Percent Like This Other Service?</a></h3>

<hr>

<h3><a href="https://lists.nycbug.org:8443/pipermail/semibug/2022-December/000775.html" rel="nofollow">Crazy unix shell prompts</a></h3>

<hr>

<h3><a href="https://byte--sized-de.translate.goog/linux-unix/linux-binary-compatibility-ubuntu-unter-freebsd/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" rel="nofollow">Linux Binary Compatibility: Ubuntu on FreeBSD</a></h3>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/reproducible_builds_summit_venice_2022" rel="nofollow">Reproducible Builds Summit Venice 2022</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/Felix%20-%20Managing%20Jails%20with%20ansible.md" rel="nofollow">Felix - Managing Jails with ansible</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/John%20Baldwin%20-%20bhyve%20networking%20setup%20article.md" rel="nofollow">John Baldwin - bhyve networking setup article</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/Welton%20-%20bhyve%20webadmin.md" rel="nofollow">Welton - bhyve webadmin</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Dragonfly BSD 6.4 is out, Running OpenZFS – Choosing Between FreeBSD and Linux, OpenBSD Mastery: Filesystems ebook leaks, catching 71% spam, crazy unix shell prompts, Linux Binary Compatibility: Ubuntu on FreeBSD, Reproducible Builds Summit Venice 2022, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.dragonflybsd.org/release64/" rel="nofollow">Dragonfly BSD 6.4 is out</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/running-openzfs-choosing-between-freebsd-and-linux/" rel="nofollow">Running OpenZFS – Choosing Between FreeBSD and Linux</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mwl.io/archives/22462" rel="nofollow">“OpenBSD Mastery: Filesystems” ebook leaking out</a></h3>

<hr>

<h3><a href="https://bsdly.blogspot.com/2022/12/can-your-spam-eater-manage-to-catch.html" rel="nofollow">Can Your Spam-eater Manage to Catch Seventy-one Percent Like This Other Service?</a></h3>

<hr>

<h3><a href="https://lists.nycbug.org:8443/pipermail/semibug/2022-December/000775.html" rel="nofollow">Crazy unix shell prompts</a></h3>

<hr>

<h3><a href="https://byte--sized-de.translate.goog/linux-unix/linux-binary-compatibility-ubuntu-unter-freebsd/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" rel="nofollow">Linux Binary Compatibility: Ubuntu on FreeBSD</a></h3>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/reproducible_builds_summit_venice_2022" rel="nofollow">Reproducible Builds Summit Venice 2022</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/Felix%20-%20Managing%20Jails%20with%20ansible.md" rel="nofollow">Felix - Managing Jails with ansible</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/John%20Baldwin%20-%20bhyve%20networking%20setup%20article.md" rel="nofollow">John Baldwin - bhyve networking setup article</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/Welton%20-%20bhyve%20webadmin.md" rel="nofollow">Welton - bhyve webadmin</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>490: New Year’s Plan9’ing</title>
  <link>https://www.bsdnow.tv/490</link>
  <guid isPermaLink="false">ae658daa-12a6-4e03-b688-5970278fb273</guid>
  <pubDate>Thu, 19 Jan 2023 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ae658daa-12a6-4e03-b688-5970278fb273.mp3" length="44370432" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Foundation’s Software Development review of 2022, what can we learn from Vintage Computing, OpenBSD KDE Status Report 2022, a Decade of HardenedBSD, In Praise of Plan9, and more</itunes:subtitle>
  <itunes:duration>46:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Foundation’s Software Development review of 2022, what can we learn from Vintage Computing, OpenBSD KDE Status Report 2022, a Decade of HardenedBSD, In Praise of Plan9, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
2022 in Review: Software Development (https://freebsdfoundation.org/blog/2022-in-review-software-development/)
What can we learn from Vintage Computing (https://github.com/readme/featured/vintage-computing)
News Roundup
OpenBSD KDE Status Report 2022 (https://www.sizeofvoid.org/posts/2022-26-12-openbsd-kde-status-report-2022/)
A Decade of HardenedBSD (https://git.hardenedbsd.org/shawn.webb/articles/-/blob/master/hardenedbsd/2023-01_decade/article.md)
In Praise of Plan9 (https://drewdevault.com/2022/11/12/In-praise-of-Plan-9.html)
Beastie Bits
LibreSSL 3.7.0 Released (https://undeadly.org/cgi?action=article;sid=20221212183516)
OPNsense 22.7.10 released (https://opnsense.org/opnsense-22-7-10-released/)
BSDCan 2023 call for papers (https://lists.bsdcan.org/pipermail/bsdcan-announce/2022-December/000194.html)
How to lock OpenSSH authentication agent (https://sleeplessbeastie.eu/2022/12/28/how-to-lock-openssh-authentication-agent/)
Once upon a time long ago, I was sitting alone in the UCLA ARPANET site... (https://mastodon.laurenweinstein.org/@lauren/109588605178700335)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, development, vintage computing, kde, status report, plan9</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Foundation’s Software Development review of 2022, what can we learn from Vintage Computing, OpenBSD KDE Status Report 2022, a Decade of HardenedBSD, In Praise of Plan9, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/2022-in-review-software-development/" rel="nofollow">2022 in Review: Software Development</a></h3>

<hr>

<h3><a href="https://github.com/readme/featured/vintage-computing" rel="nofollow">What can we learn from Vintage Computing</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.sizeofvoid.org/posts/2022-26-12-openbsd-kde-status-report-2022/" rel="nofollow">OpenBSD KDE Status Report 2022</a></h3>

<hr>

<h3><a href="https://git.hardenedbsd.org/shawn.webb/articles/-/blob/master/hardenedbsd/2023-01_decade/article.md" rel="nofollow">A Decade of HardenedBSD</a></h3>

<hr>

<h3><a href="https://drewdevault.com/2022/11/12/In-praise-of-Plan-9.html" rel="nofollow">In Praise of Plan9</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20221212183516" rel="nofollow">LibreSSL 3.7.0 Released</a><br>
<a href="https://opnsense.org/opnsense-22-7-10-released/" rel="nofollow">OPNsense 22.7.10 released</a><br>
<a href="https://lists.bsdcan.org/pipermail/bsdcan-announce/2022-December/000194.html" rel="nofollow">BSDCan 2023 call for papers</a><br>
<a href="https://sleeplessbeastie.eu/2022/12/28/how-to-lock-openssh-authentication-agent/" rel="nofollow">How to lock OpenSSH authentication agent</a><br>
<a href="https://mastodon.laurenweinstein.org/@lauren/109588605178700335" rel="nofollow">Once upon a time long ago, I was sitting alone in the UCLA ARPANET site...</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Foundation’s Software Development review of 2022, what can we learn from Vintage Computing, OpenBSD KDE Status Report 2022, a Decade of HardenedBSD, In Praise of Plan9, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/2022-in-review-software-development/" rel="nofollow">2022 in Review: Software Development</a></h3>

<hr>

<h3><a href="https://github.com/readme/featured/vintage-computing" rel="nofollow">What can we learn from Vintage Computing</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.sizeofvoid.org/posts/2022-26-12-openbsd-kde-status-report-2022/" rel="nofollow">OpenBSD KDE Status Report 2022</a></h3>

<hr>

<h3><a href="https://git.hardenedbsd.org/shawn.webb/articles/-/blob/master/hardenedbsd/2023-01_decade/article.md" rel="nofollow">A Decade of HardenedBSD</a></h3>

<hr>

<h3><a href="https://drewdevault.com/2022/11/12/In-praise-of-Plan-9.html" rel="nofollow">In Praise of Plan9</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20221212183516" rel="nofollow">LibreSSL 3.7.0 Released</a><br>
<a href="https://opnsense.org/opnsense-22-7-10-released/" rel="nofollow">OPNsense 22.7.10 released</a><br>
<a href="https://lists.bsdcan.org/pipermail/bsdcan-announce/2022-December/000194.html" rel="nofollow">BSDCan 2023 call for papers</a><br>
<a href="https://sleeplessbeastie.eu/2022/12/28/how-to-lock-openssh-authentication-agent/" rel="nofollow">How to lock OpenSSH authentication agent</a><br>
<a href="https://mastodon.laurenweinstein.org/@lauren/109588605178700335" rel="nofollow">Once upon a time long ago, I was sitting alone in the UCLA ARPANET site...</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>489: Refreshing Perspective</title>
  <link>https://www.bsdnow.tv/489</link>
  <guid isPermaLink="false">f53ef4ed-7907-4da2-8402-7154f773f79e</guid>
  <pubDate>Thu, 12 Jan 2023 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f53ef4ed-7907-4da2-8402-7154f773f79e.mp3" length="34737024" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD vs. Linux – Networking, HDMI sound output through TV speakers on FreeBSD 13, Getting started with tmux, Samba Active Directory, OpenIKED 7.2 released, FreeBSD Plasma 5 GUI Install, DHCP server howto in German, and more</itunes:subtitle>
  <itunes:duration>36:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD vs. Linux – Networking, HDMI sound output through TV speakers on FreeBSD 13, Getting started with tmux, Samba Active Directory, OpenIKED 7.2 released, FreeBSD Plasma 5 GUI Install, DHCP server howto in German, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD vs. Linux – Networking (https://klarasystems.com/articles/freebsd-vs-linux-networking/)
(Solved), HDMI sound output through TV speakers Freebsd 13 or @4 plus VCHIQ audio patch - Raspberry Pi Forums (https://forums.raspberrypi.com/viewtopic.php?t=343233)
News Roundup
Getting started with tmux (https://ittavern.com/getting-started-with-tmux/)
Samba Active Directory (https://cromwell-intl.com/open-source/samba-active-directory/freebsd-raspberry-pi.html)
OpenIKED 7.2 released (http://undeadly.org/cgi?action=article;sid=20221202230711)
FreeBSD Plasma 5 GUI Install (https://byte--sized-de.translate.goog/linux-unix/freebsd-kde-plasma-5-als-gui-installieren/?_x_tr_sl=auto&amp;amp;_x_tr_tl=en&amp;amp;_x_tr_hl=en-US&amp;amp;_x_tr_pto=wapp)
Original German Article (https://byte-sized.de/linux-unix/freebsd-kde-plasma-5-als-gui-installieren/)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, networking, hdmi sound output, tv speakers, tmux, samba, active directory, openiked, plasma 5 GUI, dhcp server</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD vs. Linux – Networking, HDMI sound output through TV speakers on FreeBSD 13, Getting started with tmux, Samba Active Directory, OpenIKED 7.2 released, FreeBSD Plasma 5 GUI Install, DHCP server howto in German, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-vs-linux-networking/" rel="nofollow">FreeBSD vs. Linux – Networking</a></h3>

<hr>

<h3><a href="https://forums.raspberrypi.com/viewtopic.php?t=343233" rel="nofollow">(Solved), HDMI sound output through TV speakers Freebsd 13 or @4 plus VCHIQ audio patch - Raspberry Pi Forums</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://ittavern.com/getting-started-with-tmux/" rel="nofollow">Getting started with tmux</a></h3>

<hr>

<h3><a href="https://cromwell-intl.com/open-source/samba-active-directory/freebsd-raspberry-pi.html" rel="nofollow">Samba Active Directory</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20221202230711" rel="nofollow">OpenIKED 7.2 released</a></h3>

<hr>

<h3><a href="https://byte--sized-de.translate.goog/linux-unix/freebsd-kde-plasma-5-als-gui-installieren/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp" rel="nofollow">FreeBSD Plasma 5 GUI Install</a></h3>

<ul>
<li><a href="https://byte-sized.de/linux-unix/freebsd-kde-plasma-5-als-gui-installieren/" rel="nofollow">Original German Article</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD vs. Linux – Networking, HDMI sound output through TV speakers on FreeBSD 13, Getting started with tmux, Samba Active Directory, OpenIKED 7.2 released, FreeBSD Plasma 5 GUI Install, DHCP server howto in German, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-vs-linux-networking/" rel="nofollow">FreeBSD vs. Linux – Networking</a></h3>

<hr>

<h3><a href="https://forums.raspberrypi.com/viewtopic.php?t=343233" rel="nofollow">(Solved), HDMI sound output through TV speakers Freebsd 13 or @4 plus VCHIQ audio patch - Raspberry Pi Forums</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://ittavern.com/getting-started-with-tmux/" rel="nofollow">Getting started with tmux</a></h3>

<hr>

<h3><a href="https://cromwell-intl.com/open-source/samba-active-directory/freebsd-raspberry-pi.html" rel="nofollow">Samba Active Directory</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20221202230711" rel="nofollow">OpenIKED 7.2 released</a></h3>

<hr>

<h3><a href="https://byte--sized-de.translate.goog/linux-unix/freebsd-kde-plasma-5-als-gui-installieren/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp" rel="nofollow">FreeBSD Plasma 5 GUI Install</a></h3>

<ul>
<li><a href="https://byte-sized.de/linux-unix/freebsd-kde-plasma-5-als-gui-installieren/" rel="nofollow">Original German Article</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>488: Old ping(8) bug</title>
  <link>https://www.bsdnow.tv/488</link>
  <guid isPermaLink="false">0ebed5dc-4761-4816-b5e6-9c17f80612b6</guid>
  <pubDate>Thu, 05 Jan 2023 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0ebed5dc-4761-4816-b5e6-9c17f80612b6.mp3" length="34010112" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Finding a 24 year old bug in ping(8), The Role of Operating Systems in IOT, Authentication gateway with SSH on OpenBSD, FreeBSD 12.4 is out, and more</itunes:subtitle>
  <itunes:duration>35:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Finding a 24 year old bug in ping(8), The Role of Operating Systems in IOT, Authentication gateway with SSH on OpenBSD, FreeBSD 12.4 is out, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Fuzzing ping(8) … and finding a 24 year old bug (https://tlakh.xyz/fuzzing-ping.html)
The Role of Operating Systems in IOT (https://klarasystems.com/articles/the-role-of-operating-systems-in-iot/)
News Roundup
Authentication gateway with SSH on OpenBSD (https://dataswamp.org/~solene/2022-12-01-openbsd-authpf.html)
FreeBSD 12.4 is out (https://lists.freebsd.org/archives/freebsd-announce/2022-December/000059.html)
Beastie Bits
Vagrant FreeBSD Boxbuilder (https://github.com/punktDe/vagrant-freebsd-boxbuilder)
LibreSSL 3.7.0 Released (https://undeadly.org/cgi?action=article;sid=20221212183516)
OPNsense 22.7.9 released (https://opnsense.org/opnsense-22-7-9-released)
BIOS Memory Map for vmd(8) Rewrite in Progress (https://undeadly.org/cgi?action=article;sid=20221211164822)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, bug, debugging, ping, iot, internet of things, authentication gateway, ssh, fundraising, foundation</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Finding a 24 year old bug in ping(8), The Role of Operating Systems in IOT, Authentication gateway with SSH on OpenBSD, FreeBSD 12.4 is out, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://tlakh.xyz/fuzzing-ping.html" rel="nofollow">Fuzzing ping(8) … and finding a 24 year old bug</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/the-role-of-operating-systems-in-iot/" rel="nofollow">The Role of Operating Systems in IOT</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2022-12-01-openbsd-authpf.html" rel="nofollow">Authentication gateway with SSH on OpenBSD</a></h3>

<hr>

<h3><a href="https://lists.freebsd.org/archives/freebsd-announce/2022-December/000059.html" rel="nofollow">FreeBSD 12.4 is out</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://github.com/punktDe/vagrant-freebsd-boxbuilder" rel="nofollow">Vagrant FreeBSD Boxbuilder</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20221212183516" rel="nofollow">LibreSSL 3.7.0 Released</a><br>
<a href="https://opnsense.org/opnsense-22-7-9-released" rel="nofollow">OPNsense 22.7.9 released</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20221211164822" rel="nofollow">BIOS Memory Map for vmd(8) Rewrite in Progress</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Finding a 24 year old bug in ping(8), The Role of Operating Systems in IOT, Authentication gateway with SSH on OpenBSD, FreeBSD 12.4 is out, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://tlakh.xyz/fuzzing-ping.html" rel="nofollow">Fuzzing ping(8) … and finding a 24 year old bug</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/the-role-of-operating-systems-in-iot/" rel="nofollow">The Role of Operating Systems in IOT</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2022-12-01-openbsd-authpf.html" rel="nofollow">Authentication gateway with SSH on OpenBSD</a></h3>

<hr>

<h3><a href="https://lists.freebsd.org/archives/freebsd-announce/2022-December/000059.html" rel="nofollow">FreeBSD 12.4 is out</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://github.com/punktDe/vagrant-freebsd-boxbuilder" rel="nofollow">Vagrant FreeBSD Boxbuilder</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20221212183516" rel="nofollow">LibreSSL 3.7.0 Released</a><br>
<a href="https://opnsense.org/opnsense-22-7-9-released" rel="nofollow">OPNsense 22.7.9 released</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20221211164822" rel="nofollow">BIOS Memory Map for vmd(8) Rewrite in Progress</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>487: EuroBSDcon Interviews Pt. 2</title>
  <link>https://www.bsdnow.tv/487</link>
  <guid isPermaLink="false">0aac59a7-37df-4c7b-85fc-68c0d657cd47</guid>
  <pubDate>Thu, 29 Dec 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0aac59a7-37df-4c7b-85fc-68c0d657cd47.mp3" length="32956800" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This year end episode of BSDNow features a trip report to EuroBSDcon by Mr. BSD.tv, as well as an interview with FreeBSD committer John Baldwin. Happy New Year, 2023!</itunes:subtitle>
  <itunes:duration>34:19</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This year end episode of BSDNow features a trip report to EuroBSDcon by Mr. BSD.tv, as well as an interview with FreeBSD committer John Baldwin. Happy New Year, 2023!
NOTES***
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
EuroBSDCon 2022 Trip Report (https://freebsdfoundation.org/blog/eurobsdcon-2022-trip-report-patrick-mcevoy/)
Interview 3 - John Baldwin - email@email (mailto:email@email) / @twitter (https://twitter.com/user)
Interview topic
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, trip report, bsd.tv, john baldwin</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This year end episode of BSDNow features a trip report to EuroBSDcon by Mr. BSD.tv, as well as an interview with FreeBSD committer John Baldwin. Happy New Year, 2023!</p>

<p>NOTES***<br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h3><a href="https://freebsdfoundation.org/blog/eurobsdcon-2022-trip-report-patrick-mcevoy/" rel="nofollow">EuroBSDCon 2022 Trip Report</a></h3>

<hr>

<h2>Interview 3 - John Baldwin - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/user" rel="nofollow">@twitter</a></h2>

<p>Interview topic</p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This year end episode of BSDNow features a trip report to EuroBSDcon by Mr. BSD.tv, as well as an interview with FreeBSD committer John Baldwin. Happy New Year, 2023!</p>

<p>NOTES***<br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h3><a href="https://freebsdfoundation.org/blog/eurobsdcon-2022-trip-report-patrick-mcevoy/" rel="nofollow">EuroBSDCon 2022 Trip Report</a></h3>

<hr>

<h2>Interview 3 - John Baldwin - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/user" rel="nofollow">@twitter</a></h2>

<p>Interview topic</p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>486: EuroBSDcon interviews</title>
  <link>https://www.bsdnow.tv/486</link>
  <guid isPermaLink="false">5876d0bf-0a23-4dc7-b582-fed2ae43bd85</guid>
  <pubDate>Thu, 22 Dec 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5876d0bf-0a23-4dc7-b582-fed2ae43bd85.mp3" length="37461120" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This special episode features two interviews we did at EuroBSDcon in Vienna this year. We talk with FreeBSD developers about how they got started, their current projects and more. Also, consider donating to your favorite BSD Foundation to keep the projects going. </itunes:subtitle>
  <itunes:duration>39:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This special episode features two interviews we did at EuroBSDcon in Vienna this year. We talk with FreeBSD developers about how they got started, their current projects and more. Also, consider donating to your favorite BSD Foundation to keep the projects going. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Help the OpenBSD Foundation Reach Its 2022 Funding Goal (http://undeadly.org/cgi?action=article;sid=20221202062601)
• [FreeBSD Foundation Donation Link](https://freebsdfoundation.org/donate/)
• [NetBSD Foundation Donation Link](http://www.netbsd.org/donations/#how-to-donate)
Interview 1 - Brooks Davis - email@email (mailto:email@email) / @twitter (https://twitter.com/user)
Interview topic
Interview 2 - Olivier Cochard-Labbe - email@email (mailto:email@email) / @twitter (https://twitter.com/user)
Interview topic
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, donate, donation, year-end fundraising, Brooks Davis, Olivier Cochard-Labbe</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This special episode features two interviews we did at EuroBSDcon in Vienna this year. We talk with FreeBSD developers about how they got started, their current projects and more. Also, consider donating to your favorite BSD Foundation to keep the projects going. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20221202062601" rel="nofollow">Help the OpenBSD Foundation Reach Its 2022 Funding Goal</a></h3>

<pre><code>• [FreeBSD Foundation Donation Link](https://freebsdfoundation.org/donate/)
• [NetBSD Foundation Donation Link](http://www.netbsd.org/donations/#how-to-donate)
</code></pre>

<hr>

<h2>Interview 1 - Brooks Davis - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/user" rel="nofollow">@twitter</a></h2>

<p>Interview topic</p>

<hr>

<h2>Interview 2 - Olivier Cochard-Labbe - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/user" rel="nofollow">@twitter</a></h2>

<p>Interview topic</p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This special episode features two interviews we did at EuroBSDcon in Vienna this year. We talk with FreeBSD developers about how they got started, their current projects and more. Also, consider donating to your favorite BSD Foundation to keep the projects going. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20221202062601" rel="nofollow">Help the OpenBSD Foundation Reach Its 2022 Funding Goal</a></h3>

<pre><code>• [FreeBSD Foundation Donation Link](https://freebsdfoundation.org/donate/)
• [NetBSD Foundation Donation Link](http://www.netbsd.org/donations/#how-to-donate)
</code></pre>

<hr>

<h2>Interview 1 - Brooks Davis - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/user" rel="nofollow">@twitter</a></h2>

<p>Interview topic</p>

<hr>

<h2>Interview 2 - Olivier Cochard-Labbe - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/user" rel="nofollow">@twitter</a></h2>

<p>Interview topic</p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>485: FreeBSD Home Assistant</title>
  <link>https://www.bsdnow.tv/485</link>
  <guid isPermaLink="false">b7197ea6-5468-43f4-bd01-fa80aeecc72e</guid>
  <pubDate>Thu, 15 Dec 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b7197ea6-5468-43f4-bd01-fa80aeecc72e.mp3" length="41792256" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Tails of the M1 GPU, Getting Home Assistant running in a FreeBSD 13.1 jail, interview with AWK creator Dr. Brian Kernighan, Next steps toward mimmutable, Unix's (technical) history is mostly old now, and more</itunes:subtitle>
  <itunes:duration>43:32</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Tails of the M1 GPU, Getting Home Assistant running in a FreeBSD 13.1 jail, interview with AWK creator Dr. Brian Kernighan, Next steps toward mimmutable, Unix's (technical) history is mostly old now, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Tails of the M1 GPU (https://asahilinux.org/2022/11/tales-of-the-m1-gpu/)
Getting Home Assistant running in a FreeBSD 13.1 jail (https://dan.langille.org/2022/08/27/getting-home-assistant-running-in-a-freebsd-13-1-jail/)
News Roundup
A brief interview with AWK creator Dr. Brian Kernighan (https://pldb.com/posts/brianKernighan.html)
Next steps toward mimmutable, from deraadt@ (https://undeadly.org/cgi?action=article;sid=20221120115616)
Unix's (technical) history is mostly old now (https://utcc.utoronto.ca/~cks/space/blog/unix/UnixHistoryMostlyOldNow)
MWL Update
Fediverse Servers, plus mac_portacl on FreeBSD (https://mwl.io/archives/22392)
Fifty Books. Thirty Years. What Next? (https://mwl.io/archives/22399)
Mailing List Freebies (https://mwl.io/archives/22423)
Beastie Bits
More #FreeBSD Power Saving Notes (http://blog.ignoranthack.me/?p=686)
Hacker Stations (https://hackerstations.com/)
The Cult of DD (https://eklitzke.org/the-cult-of-dd)
RavynOS (https://airyx.org/)
ravynOS (previously called airyxOS) is an open-source operating system based on FreeBSD, CMU Mach, and Apple open-source code that aims to be compatible with macOS applications and has no hardware restrictions.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, M1 GPU, graphics processing unit, apple, home assistant, jail, awk, Brian Kernighan, mimmutable, history</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Tails of the M1 GPU, Getting Home Assistant running in a FreeBSD 13.1 jail, interview with AWK creator Dr. Brian Kernighan, Next steps toward mimmutable, Unix&#39;s (technical) history is mostly old now, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://asahilinux.org/2022/11/tales-of-the-m1-gpu/" rel="nofollow">Tails of the M1 GPU</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2022/08/27/getting-home-assistant-running-in-a-freebsd-13-1-jail/" rel="nofollow">Getting Home Assistant running in a FreeBSD 13.1 jail</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://pldb.com/posts/brianKernighan.html" rel="nofollow">A brief interview with AWK creator Dr. Brian Kernighan</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20221120115616" rel="nofollow">Next steps toward mimmutable, from deraadt@</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/UnixHistoryMostlyOldNow" rel="nofollow">Unix&#39;s (technical) history is mostly old now</a></h3>

<hr>

<h3>MWL Update</h3>

<ul>
<li><a href="https://mwl.io/archives/22392" rel="nofollow">Fediverse Servers, plus mac_portacl on FreeBSD</a></li>
<li><a href="https://mwl.io/archives/22399" rel="nofollow">Fifty Books. Thirty Years. What Next?</a></li>
<li><a href="https://mwl.io/archives/22423" rel="nofollow">Mailing List Freebies</a></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://blog.ignoranthack.me/?p=686" rel="nofollow">More #FreeBSD Power Saving Notes</a></li>
<li><a href="https://hackerstations.com/" rel="nofollow">Hacker Stations</a></li>
<li><a href="https://eklitzke.org/the-cult-of-dd" rel="nofollow">The Cult of DD</a></li>
<li><a href="https://airyx.org/" rel="nofollow">RavynOS</a>

<ul>
<li>ravynOS (previously called airyxOS) is an open-source operating system based on FreeBSD, CMU Mach, and Apple open-source code that aims to be compatible with macOS applications and has no hardware restrictions.</li>
</ul></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Tails of the M1 GPU, Getting Home Assistant running in a FreeBSD 13.1 jail, interview with AWK creator Dr. Brian Kernighan, Next steps toward mimmutable, Unix&#39;s (technical) history is mostly old now, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://asahilinux.org/2022/11/tales-of-the-m1-gpu/" rel="nofollow">Tails of the M1 GPU</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2022/08/27/getting-home-assistant-running-in-a-freebsd-13-1-jail/" rel="nofollow">Getting Home Assistant running in a FreeBSD 13.1 jail</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://pldb.com/posts/brianKernighan.html" rel="nofollow">A brief interview with AWK creator Dr. Brian Kernighan</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20221120115616" rel="nofollow">Next steps toward mimmutable, from deraadt@</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/UnixHistoryMostlyOldNow" rel="nofollow">Unix&#39;s (technical) history is mostly old now</a></h3>

<hr>

<h3>MWL Update</h3>

<ul>
<li><a href="https://mwl.io/archives/22392" rel="nofollow">Fediverse Servers, plus mac_portacl on FreeBSD</a></li>
<li><a href="https://mwl.io/archives/22399" rel="nofollow">Fifty Books. Thirty Years. What Next?</a></li>
<li><a href="https://mwl.io/archives/22423" rel="nofollow">Mailing List Freebies</a></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://blog.ignoranthack.me/?p=686" rel="nofollow">More #FreeBSD Power Saving Notes</a></li>
<li><a href="https://hackerstations.com/" rel="nofollow">Hacker Stations</a></li>
<li><a href="https://eklitzke.org/the-cult-of-dd" rel="nofollow">The Cult of DD</a></li>
<li><a href="https://airyx.org/" rel="nofollow">RavynOS</a>

<ul>
<li>ravynOS (previously called airyxOS) is an open-source operating system based on FreeBSD, CMU Mach, and Apple open-source code that aims to be compatible with macOS applications and has no hardware restrictions.</li>
</ul></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>484: Birth of stderr</title>
  <link>https://www.bsdnow.tv/484</link>
  <guid isPermaLink="false">4f095d18-aa8c-465b-956d-03ca0f1f16f8</guid>
  <pubDate>Thu, 08 Dec 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4f095d18-aa8c-465b-956d-03ca0f1f16f8.mp3" length="34985472" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Virtualization showdown, The Birth of Standard Error, why Steam started picking a random font, Maintaining Sufficient Free Space with ZFS, updated Apple M1/M2 bootloader, code, FreeBSD on my workstation, and more </itunes:subtitle>
  <itunes:duration>36:26</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Virtualization showdown, The Birth of Standard Error, why Steam started picking a random font, Maintaining Sufficient Free Space with ZFS, updated Apple M1/M2 bootloader, code, FreeBSD on my workstation, and more 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Virtualization showdown – FreeBSD’s bhyve vs. Linux’s KVM (https://klarasystems.com/articles/virtualization-showdown-freebsd-bhyve-linux-kvm/)
The Birth of Standard Error (https://www.spinellis.gr/blog/20131211/)
News Roundup
Investigating why Steam started picking a random font (http://blog.pkh.me/p/35-investigating-why-steam-started-picking-a-random-font.html)
Curious Case of Maintaining Sufficient Free Space with ZFS (https://taras.glek.net/post/curious-case-of-maintaining-sufficient-free-space-with-zfs/)
Call for testing on updated Apple M1/M2 bootloader code (https://undeadly.org/cgi?action=article;sid=20221120113149)
FreeBSD on my workstation (https://camandro.org/blog/2022-09-30-freebsd-on-my-workstation.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - Initial Setup (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/484/feedback/Brad%20-%20Initial%20Setup.md)
Joseph - openbsd and postgresql (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/484/feedback/joseph%20-%20openbsd%20and%20postgresql.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, storage, ports, packages, jails, interview, bhyve, kvm, virtualization, virtual, vm, standard error, stderr, steam, random, font, free space, M1, M2, bootloader, workstation</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Virtualization showdown, The Birth of Standard Error, why Steam started picking a random font, Maintaining Sufficient Free Space with ZFS, updated Apple M1/M2 bootloader, code, FreeBSD on my workstation, and more </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/virtualization-showdown-freebsd-bhyve-linux-kvm/" rel="nofollow">Virtualization showdown – FreeBSD’s bhyve vs. Linux’s KVM</a></h3>

<hr>

<h3><a href="https://www.spinellis.gr/blog/20131211/" rel="nofollow">The Birth of Standard Error</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blog.pkh.me/p/35-investigating-why-steam-started-picking-a-random-font.html" rel="nofollow">Investigating why Steam started picking a random font</a></h3>

<hr>

<h3><a href="https://taras.glek.net/post/curious-case-of-maintaining-sufficient-free-space-with-zfs/" rel="nofollow">Curious Case of Maintaining Sufficient Free Space with ZFS</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20221120113149" rel="nofollow">Call for testing on updated Apple M1/M2 bootloader code</a></h3>

<hr>

<h3><a href="https://camandro.org/blog/2022-09-30-freebsd-on-my-workstation.html" rel="nofollow">FreeBSD on my workstation</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/484/feedback/Brad%20-%20Initial%20Setup.md" rel="nofollow">Brad - Initial Setup</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/484/feedback/joseph%20-%20openbsd%20and%20postgresql.md" rel="nofollow">Joseph - openbsd and postgresql</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Virtualization showdown, The Birth of Standard Error, why Steam started picking a random font, Maintaining Sufficient Free Space with ZFS, updated Apple M1/M2 bootloader, code, FreeBSD on my workstation, and more </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/virtualization-showdown-freebsd-bhyve-linux-kvm/" rel="nofollow">Virtualization showdown – FreeBSD’s bhyve vs. Linux’s KVM</a></h3>

<hr>

<h3><a href="https://www.spinellis.gr/blog/20131211/" rel="nofollow">The Birth of Standard Error</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blog.pkh.me/p/35-investigating-why-steam-started-picking-a-random-font.html" rel="nofollow">Investigating why Steam started picking a random font</a></h3>

<hr>

<h3><a href="https://taras.glek.net/post/curious-case-of-maintaining-sufficient-free-space-with-zfs/" rel="nofollow">Curious Case of Maintaining Sufficient Free Space with ZFS</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20221120113149" rel="nofollow">Call for testing on updated Apple M1/M2 bootloader code</a></h3>

<hr>

<h3><a href="https://camandro.org/blog/2022-09-30-freebsd-on-my-workstation.html" rel="nofollow">FreeBSD on my workstation</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/484/feedback/Brad%20-%20Initial%20Setup.md" rel="nofollow">Brad - Initial Setup</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/484/feedback/joseph%20-%20openbsd%20and%20postgresql.md" rel="nofollow">Joseph - openbsd and postgresql</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>483: ZFS Time Machine</title>
  <link>https://www.bsdnow.tv/483</link>
  <guid isPermaLink="false">a6421b51-580d-42b5-8668-9703082f861b</guid>
  <pubDate>Thu, 01 Dec 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a6421b51-580d-42b5-8668-9703082f861b.mp3" length="48744192" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Research Unix Version 6 in the Open SIMH PDP-11 Emulator, The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method, NFS on NetBSD: server and client side, HardenedBSD October 2022 Status Report, Nushell : Introduction, and more</itunes:subtitle>
  <itunes:duration>50:46</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Research Unix Version 6 in the Open SIMH PDP-11 Emulator, The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method, NFS on NetBSD: server and client side, HardenedBSD October 2022 Status Report, Nushell : Introduction, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Installing and Using Research Unix Version 6 in the Open SIMH PDP-11 Emulator (http://decuser.blogspot.com/2022/10/installing-and-using-research-unix.html)
httm – The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method (https://klarasystems.com/articles/httm-is-a-zfs-based-time-machine/)
News Roundup
NFS on NetBSD: server and client side (https://www.unitedbsd.com/d/959-nfs-on-netbsd-server-and-client-side)
HardenedBSD October 2022 Status Report (https://hardenedbsd.org/article/shawn-webb/2022-10-31/hardenedbsd-october-2022-status-report)
Nushell : Introduction (https://dataswamp.org/~solene/2022-10-31-nushell.html)
Beastie Bits
Unix Pipe Game (https://hackaday.com/2022/10/18/if-only-the-kids-knew-about-pipes/)
Slides - The “other” FreeBSD optimizations used by Netflix to serve video at 800Gb/s from a single server (https://people.freebsd.org/~gallatin/talks/euro2022.pdf)
My FreeBSD Friday Lecture: The Writing Scholar’s Guide to FreeBSD (https://www.coreystephan.com/freebsd-friday/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Dan - Response to Hans (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Dan%20-%20Response%20to%20Hans.md)
Johnny - bhyve question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Johnny%20-%20bhyve%20question.md)
Manuel - EuroBSDcon social event (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Manuel%20-%20EuroBSDcon%20social%20event.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, ports, packages, jails, interview, research unix, version 6, simh pdp-11, emulator, httm, time machine, nfs, server, client, nushell</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Research Unix Version 6 in the Open SIMH PDP-11 Emulator, The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method, NFS on NetBSD: server and client side, HardenedBSD October 2022 Status Report, Nushell : Introduction, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="http://decuser.blogspot.com/2022/10/installing-and-using-research-unix.html" rel="nofollow">Installing and Using Research Unix Version 6 in the Open SIMH PDP-11 Emulator</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/httm-is-a-zfs-based-time-machine/" rel="nofollow">httm – The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.unitedbsd.com/d/959-nfs-on-netbsd-server-and-client-side" rel="nofollow">NFS on NetBSD: server and client side</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2022-10-31/hardenedbsd-october-2022-status-report" rel="nofollow">HardenedBSD October 2022 Status Report</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-10-31-nushell.html" rel="nofollow">Nushell : Introduction</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://hackaday.com/2022/10/18/if-only-the-kids-knew-about-pipes/" rel="nofollow">Unix Pipe Game</a><br>
<a href="https://people.freebsd.org/%7Egallatin/talks/euro2022.pdf" rel="nofollow">Slides - The “other” FreeBSD optimizations used by Netflix to serve video at 800Gb/s from a single server</a><br>
<a href="https://www.coreystephan.com/freebsd-friday/" rel="nofollow">My FreeBSD Friday Lecture: The Writing Scholar’s Guide to FreeBSD</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Dan%20-%20Response%20to%20Hans.md" rel="nofollow">Dan - Response to Hans</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Johnny%20-%20bhyve%20question.md" rel="nofollow">Johnny - bhyve question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Manuel%20-%20EuroBSDcon%20social%20event.md" rel="nofollow">Manuel - EuroBSDcon social event</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Research Unix Version 6 in the Open SIMH PDP-11 Emulator, The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method, NFS on NetBSD: server and client side, HardenedBSD October 2022 Status Report, Nushell : Introduction, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="http://decuser.blogspot.com/2022/10/installing-and-using-research-unix.html" rel="nofollow">Installing and Using Research Unix Version 6 in the Open SIMH PDP-11 Emulator</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/httm-is-a-zfs-based-time-machine/" rel="nofollow">httm – The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.unitedbsd.com/d/959-nfs-on-netbsd-server-and-client-side" rel="nofollow">NFS on NetBSD: server and client side</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2022-10-31/hardenedbsd-october-2022-status-report" rel="nofollow">HardenedBSD October 2022 Status Report</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-10-31-nushell.html" rel="nofollow">Nushell : Introduction</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://hackaday.com/2022/10/18/if-only-the-kids-knew-about-pipes/" rel="nofollow">Unix Pipe Game</a><br>
<a href="https://people.freebsd.org/%7Egallatin/talks/euro2022.pdf" rel="nofollow">Slides - The “other” FreeBSD optimizations used by Netflix to serve video at 800Gb/s from a single server</a><br>
<a href="https://www.coreystephan.com/freebsd-friday/" rel="nofollow">My FreeBSD Friday Lecture: The Writing Scholar’s Guide to FreeBSD</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Dan%20-%20Response%20to%20Hans.md" rel="nofollow">Dan - Response to Hans</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Johnny%20-%20bhyve%20question.md" rel="nofollow">Johnny - bhyve question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Manuel%20-%20EuroBSDcon%20social%20event.md" rel="nofollow">Manuel - EuroBSDcon social event</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>482: BSD XFCE Desktop</title>
  <link>https://www.bsdnow.tv/482</link>
  <guid isPermaLink="false">b4733d68-58d9-429a-b80d-d7a4522e3e33</guid>
  <pubDate>Thu, 24 Nov 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b4733d68-58d9-429a-b80d-d7a4522e3e33.mp3" length="37766784" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>5 Key Reasons to Consider Open Source Storage, OpenBSD Minimalist Desktop, BSD XFCE, Alpine Linux VM on bhyve - with root on ZFS, FreeBSD Jail Quick Setup with Networking, and more.</itunes:subtitle>
  <itunes:duration>39:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>5 Key Reasons to Consider Open Source Storage, OpenBSD Minimalist Desktop, BSD XFCE, Alpine Linux VM on bhyve - with root on ZFS, FreeBSD Jail Quick Setup with Networking, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
5 Key Reasons to Consider Open Source Storage Over Commercial Offerings (https://klarasystems.com/articles/open-source-storage-over-commercial-offerings/)
OpenBSD Minimalist Desktop (https://nechtan.io/articles/openbsd_minimalist_desktop.html)
News Roundup
BSD-XFCE (https://github.com/Wamphyre/BSD-XFCE)
Creating an Alpine Linux VM on bhyve - with root on ZFS (optionally encrypted) (https://it-notes.dragas.net/2022/11/01/creating-an-alpine-vm-on-bhyve-with-root-on-zfs-optionally-encrypted/)
FreeBSD Jail Quick Setup with Networking (2022) (https://www.shaka.today/freebsd-jail-quick-setup-with-networking-2022/)
Beastie Bits
EuroBSDcon videos are now up (https://www.youtube.com/c/EuroBSDcon/videos)
LibreSSL 3.6.1 released (https://undeadly.org/cgi?action=article;sid=20221104064712)
Raspberry Pi 4 with FreeBSD 13-RELEASE: A Perfect Miniature Homelab (https://www.coreystephan.com/pi4-freebsd/)
AsiaBSDcon 2023 CfP (https://2023.asiabsdcon.org/cfp.html.en)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
John - Allan's meetup (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/John%20-%20Allan's%20meetup.md)
Matthew - atime and a question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/Matthew%20-%20atime%20and%20a%20question.md)
Valentin - Becoming a FreeBSD Developer (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/Valentin%20-%20Becoming%20a%20FreeBSD%20Developer.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, ports, packages, jails, interview, storage, reason, considerations, minimalist, desktop, xfce, alpine linux, root on zfs, quick setup</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>5 Key Reasons to Consider Open Source Storage, OpenBSD Minimalist Desktop, BSD XFCE, Alpine Linux VM on bhyve - with root on ZFS, FreeBSD Jail Quick Setup with Networking, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/open-source-storage-over-commercial-offerings/" rel="nofollow">5 Key Reasons to Consider Open Source Storage Over Commercial Offerings</a></h3>

<hr>

<h3><a href="https://nechtan.io/articles/openbsd_minimalist_desktop.html" rel="nofollow">OpenBSD Minimalist Desktop</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/Wamphyre/BSD-XFCE" rel="nofollow">BSD-XFCE</a></h3>

<hr>

<h3><a href="https://it-notes.dragas.net/2022/11/01/creating-an-alpine-vm-on-bhyve-with-root-on-zfs-optionally-encrypted/" rel="nofollow">Creating an Alpine Linux VM on bhyve - with root on ZFS (optionally encrypted)</a></h3>

<hr>

<h3><a href="https://www.shaka.today/freebsd-jail-quick-setup-with-networking-2022/" rel="nofollow">FreeBSD Jail Quick Setup with Networking (2022)</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://www.youtube.com/c/EuroBSDcon/videos" rel="nofollow">EuroBSDcon videos are now up</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20221104064712" rel="nofollow">LibreSSL 3.6.1 released</a><br>
<a href="https://www.coreystephan.com/pi4-freebsd/" rel="nofollow">Raspberry Pi 4 with FreeBSD 13-RELEASE: A Perfect Miniature Homelab</a></p>

<p><a href="https://2023.asiabsdcon.org/cfp.html.en" rel="nofollow">AsiaBSDcon 2023 CfP</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/John%20-%20Allan&#x27;s%20meetup.md" rel="nofollow">John - Allan&#39;s meetup</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/Matthew%20-%20atime%20and%20a%20question.md" rel="nofollow">Matthew - atime and a question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/Valentin%20-%20Becoming%20a%20FreeBSD%20Developer.md" rel="nofollow">Valentin - Becoming a FreeBSD Developer</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>5 Key Reasons to Consider Open Source Storage, OpenBSD Minimalist Desktop, BSD XFCE, Alpine Linux VM on bhyve - with root on ZFS, FreeBSD Jail Quick Setup with Networking, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/open-source-storage-over-commercial-offerings/" rel="nofollow">5 Key Reasons to Consider Open Source Storage Over Commercial Offerings</a></h3>

<hr>

<h3><a href="https://nechtan.io/articles/openbsd_minimalist_desktop.html" rel="nofollow">OpenBSD Minimalist Desktop</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/Wamphyre/BSD-XFCE" rel="nofollow">BSD-XFCE</a></h3>

<hr>

<h3><a href="https://it-notes.dragas.net/2022/11/01/creating-an-alpine-vm-on-bhyve-with-root-on-zfs-optionally-encrypted/" rel="nofollow">Creating an Alpine Linux VM on bhyve - with root on ZFS (optionally encrypted)</a></h3>

<hr>

<h3><a href="https://www.shaka.today/freebsd-jail-quick-setup-with-networking-2022/" rel="nofollow">FreeBSD Jail Quick Setup with Networking (2022)</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://www.youtube.com/c/EuroBSDcon/videos" rel="nofollow">EuroBSDcon videos are now up</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20221104064712" rel="nofollow">LibreSSL 3.6.1 released</a><br>
<a href="https://www.coreystephan.com/pi4-freebsd/" rel="nofollow">Raspberry Pi 4 with FreeBSD 13-RELEASE: A Perfect Miniature Homelab</a></p>

<p><a href="https://2023.asiabsdcon.org/cfp.html.en" rel="nofollow">AsiaBSDcon 2023 CfP</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/John%20-%20Allan&#x27;s%20meetup.md" rel="nofollow">John - Allan&#39;s meetup</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/Matthew%20-%20atime%20and%20a%20question.md" rel="nofollow">Matthew - atime and a question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/Valentin%20-%20Becoming%20a%20FreeBSD%20Developer.md" rel="nofollow">Valentin - Becoming a FreeBSD Developer</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>481: Fiery Crackers</title>
  <link>https://www.bsdnow.tv/481</link>
  <guid isPermaLink="false">f0df0143-84f7-40aa-9802-be21a870c0c1</guid>
  <pubDate>Thu, 17 Nov 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f0df0143-84f7-40aa-9802-be21a870c0c1.mp3" length="50564656" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Q3 2022 status report, Leveraging MinIO and OpenZFS to avoid vendor lock in, FreeBSD on Firecracker platform, How Much Faster Is Making A Tar Archive Without Gzip, Postgres from packages on OpenBSD, Upgrading an NVMe zpool from 222G to 1TB drives, Don't use Reddit for Linux or BSD related questions, and more.</itunes:subtitle>
  <itunes:duration>47:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Q3 2022 status report, Leveraging MinIO and OpenZFS to avoid vendor lock in, FreeBSD on Firecracker platform, How Much Faster Is Making A Tar Archive Without Gzip, Postgres from packages on OpenBSD, Upgrading an NVMe zpool from 222G to 1TB drives, Don't use Reddit for Linux or BSD related questions, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Quarterly Status Report Third Quarter 2022 (https://www.freebsd.org/status/report-2022-07-2022-09/)
Avoid Infrastructure Vendor Lock-in by leveraging MinIO and OpenZFS (https://klarasystems.com/articles/avoid-vendor-lock-in-with-minio-and-openzfs/)
Announcing the FreeBSD/Firecracker platform (https://www.daemonology.net/blog/2022-10-18-FreeBSD-Firecracker.html)
News Roundup
How Much Faster Is Making A Tar Archive Without Gzip? (https://lowendbox.com/blog/how-much-faster-is-making-a-tar-archive-without-gzip/)
PostgreSQL from packages on OpenBSD (https://www.dbi-services.com/blog/postgresql-from-packages-on-openbsd/)
Upgrading an NVMe zpool from 222G to 1TB drives (https://dan.langille.org/2022/10/18/upgrading-an-nvme-zpool-from-222g-to-1tb-drives/)
PSA: Don't use Reddit for Linux or BSD related questions (https://unixsheikh.com/articles/dont-use-reddit-for-linux-or-bsd-related-questions.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Hinnerk - vnet jails (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/Hinnerk%20-%20vnet%20jails.md)
Tom’s response example: https://adventurist.me/posts/00304
Hugo - Apple M2 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/Hugo%20-%20Apple%20M2.md)
kevin - emacs backspace (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/kevin%20-%20emacs%20backspace.md)
)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, ports, packages, jails, interview, q3, third quarter, status report, minio, vendor lock-in, avoid, avoidance, firecracker, aws, tar, gzip, speedup, performance, postgres, nvme, reddit, linux, questions</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Q3 2022 status report, Leveraging MinIO and OpenZFS to avoid vendor lock in, FreeBSD on Firecracker platform, How Much Faster Is Making A Tar Archive Without Gzip, Postgres from packages on OpenBSD, Upgrading an NVMe zpool from 222G to 1TB drives, Don&#39;t use Reddit for Linux or BSD related questions, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2022-07-2022-09/" rel="nofollow">FreeBSD Quarterly Status Report Third Quarter 2022</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/avoid-vendor-lock-in-with-minio-and-openzfs/" rel="nofollow">Avoid Infrastructure Vendor Lock-in by leveraging MinIO and OpenZFS</a></h3>

<hr>

<h3><a href="https://www.daemonology.net/blog/2022-10-18-FreeBSD-Firecracker.html" rel="nofollow">Announcing the FreeBSD/Firecracker platform</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lowendbox.com/blog/how-much-faster-is-making-a-tar-archive-without-gzip/" rel="nofollow">How Much Faster Is Making A Tar Archive Without Gzip?</a></h3>

<hr>

<h3><a href="https://www.dbi-services.com/blog/postgresql-from-packages-on-openbsd/" rel="nofollow">PostgreSQL from packages on OpenBSD</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2022/10/18/upgrading-an-nvme-zpool-from-222g-to-1tb-drives/" rel="nofollow">Upgrading an NVMe zpool from 222G to 1TB drives</a></h3>

<hr>

<h3><a href="https://unixsheikh.com/articles/dont-use-reddit-for-linux-or-bsd-related-questions.html" rel="nofollow">PSA: Don&#39;t use Reddit for Linux or BSD related questions</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/Hinnerk%20-%20vnet%20jails.md" rel="nofollow">Hinnerk - vnet jails</a><br>
Tom’s response example: <a href="https://adventurist.me/posts/00304" rel="nofollow">https://adventurist.me/posts/00304</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/Hugo%20-%20Apple%20M2.md" rel="nofollow">Hugo - Apple M2</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/kevin%20-%20emacs%20backspace.md" rel="nofollow">kevin - emacs backspace</a><br>
)</p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Q3 2022 status report, Leveraging MinIO and OpenZFS to avoid vendor lock in, FreeBSD on Firecracker platform, How Much Faster Is Making A Tar Archive Without Gzip, Postgres from packages on OpenBSD, Upgrading an NVMe zpool from 222G to 1TB drives, Don&#39;t use Reddit for Linux or BSD related questions, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2022-07-2022-09/" rel="nofollow">FreeBSD Quarterly Status Report Third Quarter 2022</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/avoid-vendor-lock-in-with-minio-and-openzfs/" rel="nofollow">Avoid Infrastructure Vendor Lock-in by leveraging MinIO and OpenZFS</a></h3>

<hr>

<h3><a href="https://www.daemonology.net/blog/2022-10-18-FreeBSD-Firecracker.html" rel="nofollow">Announcing the FreeBSD/Firecracker platform</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lowendbox.com/blog/how-much-faster-is-making-a-tar-archive-without-gzip/" rel="nofollow">How Much Faster Is Making A Tar Archive Without Gzip?</a></h3>

<hr>

<h3><a href="https://www.dbi-services.com/blog/postgresql-from-packages-on-openbsd/" rel="nofollow">PostgreSQL from packages on OpenBSD</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2022/10/18/upgrading-an-nvme-zpool-from-222g-to-1tb-drives/" rel="nofollow">Upgrading an NVMe zpool from 222G to 1TB drives</a></h3>

<hr>

<h3><a href="https://unixsheikh.com/articles/dont-use-reddit-for-linux-or-bsd-related-questions.html" rel="nofollow">PSA: Don&#39;t use Reddit for Linux or BSD related questions</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/Hinnerk%20-%20vnet%20jails.md" rel="nofollow">Hinnerk - vnet jails</a><br>
Tom’s response example: <a href="https://adventurist.me/posts/00304" rel="nofollow">https://adventurist.me/posts/00304</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/Hugo%20-%20Apple%20M2.md" rel="nofollow">Hugo - Apple M2</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/kevin%20-%20emacs%20backspace.md" rel="nofollow">kevin - emacs backspace</a><br>
)</p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>480: OpenBSD 7.2</title>
  <link>https://www.bsdnow.tv/480</link>
  <guid isPermaLink="false">304e9711-6a86-42b7-a144-191aa1f900b7</guid>
  <pubDate>Thu, 10 Nov 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/304e9711-6a86-42b7-a144-191aa1f900b7.mp3" length="46963584" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 7.2 and FuguIta have been released, Learn the Whys and Hows with the FreeBSD Sec Team, how to get notified about FreeBSD updates, using unbound for ad blocking on OpenBSD, further memory protections on OpenBSD current, and more. </itunes:subtitle>
  <itunes:duration>48:55</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 7.2 and FuguIta have been released, Learn the Whys and Hows with the FreeBSD Sec Team, how to get notified about FreeBSD updates, using unbound for ad blocking on OpenBSD, further memory protections on OpenBSD current, and more. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenBSD 7.2 has been released (https://www.openbsd.org/72.html)
FuguIta 7.2 is out as well (https://fuguita.org/index.php?FuguIta%2F7.2=)
***
### Keeping FreeBSD Secure: Learn the Whys and Hows with the FreeBSD Sec Team (https://freebsdfoundation.org/blog/keeping-freebsd-secure-learn-the-whys-and-hows-with-the-freebsd-sec-team/)
News Roundup
Howto: be notified of FreeBSD upgrades, security updates and package updates at login (https://forums.freebsd.org/threads/howto-be-notified-of-freebsd-upgrades-security-updates-and-package-updates-at-login.86660/)
Ads blocking with OpenBSD unbound(8) (https://www.tumfatig.net/2022/ads-blocking-with-openbsd-unbound8/)
Further memory protections committed to -current (http://undeadly.org/cgi?action=article;sid=20221008100649)
Beastie Bits
• [“OpenBSD Mastery: Filesystems” Print/Ebook Bundle Preorder](https://mwl.io/archives/22352)
• [Klara is hiring a FreeBSD Kernel Developer](https://klarasystems.com/careers/freebsd-kernel-developer/)
• [FreeBSD 12.4-BETA1 Now Available](https://lists.freebsd.org/archives/freebsd-stable/2022-October/000920.html)
• [Hunting kernel lock and interrupt latency](https://mail-index.netbsd.org/tech-kern/2022/10/30/msg028499.html)
• [EuroBSDcon 2022 videos available](https://undeadly.org/cgi?action=article;sid=20221027232308)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Charles - BSD Now Bingo (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Charles%20-%20BSD%20Now%20Bingo.md)
Jake - FreeBSD Security defaults (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Jake%20-%20FreeBSD%20Security%20defaults.md)
Sam - FreeBSD and SSDs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Sam%20-%20FreeBSD%20and%20SSDs.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, ports, packages, jails, interview, fuguita, secteam, security team, notifications, notify, unbound, ad blocking, ad blocker, memory protections, memory protection </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 7.2 and FuguIta have been released, Learn the Whys and Hows with the FreeBSD Sec Team, how to get notified about FreeBSD updates, using unbound for ad blocking on OpenBSD, further memory protections on OpenBSD current, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/72.html" rel="nofollow">OpenBSD 7.2 has been released</a></h3>

<ul>
<li><a href="https://fuguita.org/index.php?FuguIta%2F7.2=" rel="nofollow">FuguIta 7.2 is out as well</a>
***
### <a href="https://freebsdfoundation.org/blog/keeping-freebsd-secure-learn-the-whys-and-hows-with-the-freebsd-sec-team/" rel="nofollow">Keeping FreeBSD Secure: Learn the Whys and Hows with the FreeBSD Sec Team</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://forums.freebsd.org/threads/howto-be-notified-of-freebsd-upgrades-security-updates-and-package-updates-at-login.86660/" rel="nofollow">Howto: be notified of FreeBSD upgrades, security updates and package updates at login</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2022/ads-blocking-with-openbsd-unbound8/" rel="nofollow">Ads blocking with OpenBSD unbound(8)</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20221008100649" rel="nofollow">Further memory protections committed to -current</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [“OpenBSD Mastery: Filesystems” Print/Ebook Bundle Preorder](https://mwl.io/archives/22352)
• [Klara is hiring a FreeBSD Kernel Developer](https://klarasystems.com/careers/freebsd-kernel-developer/)
• [FreeBSD 12.4-BETA1 Now Available](https://lists.freebsd.org/archives/freebsd-stable/2022-October/000920.html)
• [Hunting kernel lock and interrupt latency](https://mail-index.netbsd.org/tech-kern/2022/10/30/msg028499.html)
• [EuroBSDcon 2022 videos available](https://undeadly.org/cgi?action=article;sid=20221027232308)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Charles%20-%20BSD%20Now%20Bingo.md" rel="nofollow">Charles - BSD Now Bingo</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Jake%20-%20FreeBSD%20Security%20defaults.md" rel="nofollow">Jake - FreeBSD Security defaults</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Sam%20-%20FreeBSD%20and%20SSDs.md" rel="nofollow">Sam - FreeBSD and SSDs</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 7.2 and FuguIta have been released, Learn the Whys and Hows with the FreeBSD Sec Team, how to get notified about FreeBSD updates, using unbound for ad blocking on OpenBSD, further memory protections on OpenBSD current, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/72.html" rel="nofollow">OpenBSD 7.2 has been released</a></h3>

<ul>
<li><a href="https://fuguita.org/index.php?FuguIta%2F7.2=" rel="nofollow">FuguIta 7.2 is out as well</a>
***
### <a href="https://freebsdfoundation.org/blog/keeping-freebsd-secure-learn-the-whys-and-hows-with-the-freebsd-sec-team/" rel="nofollow">Keeping FreeBSD Secure: Learn the Whys and Hows with the FreeBSD Sec Team</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://forums.freebsd.org/threads/howto-be-notified-of-freebsd-upgrades-security-updates-and-package-updates-at-login.86660/" rel="nofollow">Howto: be notified of FreeBSD upgrades, security updates and package updates at login</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2022/ads-blocking-with-openbsd-unbound8/" rel="nofollow">Ads blocking with OpenBSD unbound(8)</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20221008100649" rel="nofollow">Further memory protections committed to -current</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [“OpenBSD Mastery: Filesystems” Print/Ebook Bundle Preorder](https://mwl.io/archives/22352)
• [Klara is hiring a FreeBSD Kernel Developer](https://klarasystems.com/careers/freebsd-kernel-developer/)
• [FreeBSD 12.4-BETA1 Now Available](https://lists.freebsd.org/archives/freebsd-stable/2022-October/000920.html)
• [Hunting kernel lock and interrupt latency](https://mail-index.netbsd.org/tech-kern/2022/10/30/msg028499.html)
• [EuroBSDcon 2022 videos available](https://undeadly.org/cgi?action=article;sid=20221027232308)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Charles%20-%20BSD%20Now%20Bingo.md" rel="nofollow">Charles - BSD Now Bingo</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Jake%20-%20FreeBSD%20Security%20defaults.md" rel="nofollow">Jake - FreeBSD Security defaults</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Sam%20-%20FreeBSD%20and%20SSDs.md" rel="nofollow">Sam - FreeBSD and SSDs</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>479: OpenBSD Docker Host</title>
  <link>https://www.bsdnow.tv/479</link>
  <guid isPermaLink="false">1f8daae0-ec33-4016-b70d-b6a31783eeea</guid>
  <pubDate>Thu, 03 Nov 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1f8daae0-ec33-4016-b70d-b6a31783eeea.mp3" length="40382208" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>EuroBSDcon 2022 as first BSD conference, Red Hat’s OpenShift vs FreeBSD Jails, Running a Docker Host under OpenBSD using vmd(8), history of sending signals to Unix process groups, Toolchains adventures - Q3 2022, and more</itunes:subtitle>
  <itunes:duration>42:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>EuroBSDcon 2022 as first BSD conference, Red Hat’s OpenShift vs FreeBSD Jails, Running a Docker Host under OpenBSD using vmd(8), history of sending signals to Unix process groups, Toolchains adventures - Q3 2022, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
EuroBSDCon 2022, my first BSD conference (and how they are different) (https://eerielinux.wordpress.com/2022/09/25/eurobsdcon-2022-my-first-bsd-conference-and-how-they-are-different/)
Red Hat’s OpenShift vs FreeBSD Jails (https://klarasystems.com/articles/red-hats-openshift-vs-freebsd-jails/)
News Roundup
The history of sending signals to Unix process groups (https://utcc.utoronto.ca/~cks/space/blog/unix/ProcessGroupsAndSignals)
Running a Docker Host under OpenBSD using vmd(8) (https://www.tumfatig.net/2022/running-docker-host-openbsd-vmd/)
Toolchains adventures - Q3 2022 (https://www.cambus.net/toolchains-adventures-q3-2022/)
Beastie Bits
-current has moved to 7.2 (https://undeadly.org/cgi?action=article;sid=20220912055003)
Several /sbin daemons are now dynamically-linked (http://undeadly.org/cgi?action=article;sid=20220830052924)
Announcing the pkgsrc 2022Q3 branch (https://mail-index.netbsd.org/netbsd-announce/2022/09/29/msg000341.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Hans - datacenters and dust (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/Hans%20-%20datacenters%20and%20dust.md)
Tim - Boot issue (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/Tim%20-%20Boot%20issue.md)
aaron- dwm tiling (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/aaron-%20dwm%20tiling%20.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, ports, packages, jails, interview, eurobsdcon, conference, openshift, docker, vmd, history, signal, signals, processes, process groups, toolchain</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>EuroBSDcon 2022 as first BSD conference, Red Hat’s OpenShift vs FreeBSD Jails, Running a Docker Host under OpenBSD using vmd(8), history of sending signals to Unix process groups, Toolchains adventures - Q3 2022, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://eerielinux.wordpress.com/2022/09/25/eurobsdcon-2022-my-first-bsd-conference-and-how-they-are-different/" rel="nofollow">EuroBSDCon 2022, my first BSD conference (and how they are different)</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/red-hats-openshift-vs-freebsd-jails/" rel="nofollow">Red Hat’s OpenShift vs FreeBSD Jails</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ProcessGroupsAndSignals" rel="nofollow">The history of sending signals to Unix process groups</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2022/running-docker-host-openbsd-vmd/" rel="nofollow">Running a Docker Host under OpenBSD using vmd(8)</a></h3>

<hr>

<h3><a href="https://www.cambus.net/toolchains-adventures-q3-2022/" rel="nofollow">Toolchains adventures - Q3 2022</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20220912055003" rel="nofollow">-current has moved to 7.2</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20220830052924" rel="nofollow">Several /sbin daemons are now dynamically-linked</a><br>
<a href="https://mail-index.netbsd.org/netbsd-announce/2022/09/29/msg000341.html" rel="nofollow">Announcing the pkgsrc 2022Q3 branch</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/Hans%20-%20datacenters%20and%20dust.md" rel="nofollow">Hans - datacenters and dust</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/Tim%20-%20Boot%20issue.md" rel="nofollow">Tim - Boot issue</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/aaron-%20dwm%20tiling%20.md" rel="nofollow">aaron- dwm tiling</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>EuroBSDcon 2022 as first BSD conference, Red Hat’s OpenShift vs FreeBSD Jails, Running a Docker Host under OpenBSD using vmd(8), history of sending signals to Unix process groups, Toolchains adventures - Q3 2022, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://eerielinux.wordpress.com/2022/09/25/eurobsdcon-2022-my-first-bsd-conference-and-how-they-are-different/" rel="nofollow">EuroBSDCon 2022, my first BSD conference (and how they are different)</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/red-hats-openshift-vs-freebsd-jails/" rel="nofollow">Red Hat’s OpenShift vs FreeBSD Jails</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ProcessGroupsAndSignals" rel="nofollow">The history of sending signals to Unix process groups</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2022/running-docker-host-openbsd-vmd/" rel="nofollow">Running a Docker Host under OpenBSD using vmd(8)</a></h3>

<hr>

<h3><a href="https://www.cambus.net/toolchains-adventures-q3-2022/" rel="nofollow">Toolchains adventures - Q3 2022</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://undeadly.org/cgi?action=article;sid=20220912055003" rel="nofollow">-current has moved to 7.2</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20220830052924" rel="nofollow">Several /sbin daemons are now dynamically-linked</a><br>
<a href="https://mail-index.netbsd.org/netbsd-announce/2022/09/29/msg000341.html" rel="nofollow">Announcing the pkgsrc 2022Q3 branch</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/Hans%20-%20datacenters%20and%20dust.md" rel="nofollow">Hans - datacenters and dust</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/Tim%20-%20Boot%20issue.md" rel="nofollow">Tim - Boot issue</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/aaron-%20dwm%20tiling%20.md" rel="nofollow">aaron- dwm tiling</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>478: Debunking sudo myths </title>
  <link>https://www.bsdnow.tv/478</link>
  <guid isPermaLink="false">1cacdcc7-e6f6-4193-b76d-f99ab20f08fc</guid>
  <pubDate>Thu, 27 Oct 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1cacdcc7-e6f6-4193-b76d-f99ab20f08fc.mp3" length="66564288" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Open Source in Enterprise Environments, Your Comprehensive Guide to rc(8): FreeBSD Services and Automation, How Rob Pike got hired by Dennis Richie, what FreeBSD machines rubenerd uses, new debugbreak command, 7 sudo myths debunked</itunes:subtitle>
  <itunes:duration>46:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Open Source in Enterprise Environments, Your Comprehensive Guide to rc(8): FreeBSD Services and Automation, How Rob Pike got hired by Dennis Richie, what FreeBSD machines rubenerd uses, new debugbreak command, 7 sudo myths debunked
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Open Source in Enterprise Environments - Where Are We Now and What Is Our Way Forward? (https://bsdly.blogspot.com/2022/09/open-source-in-enterprise-environments.html)
Your Comprehensive Guide to rc(8): FreeBSD Services and Automation (https://klarasystems.com/articles/rc8-freebsd-services-and-automation/)
News Roundup
How Rob Pike got hired by Dennis Richie (https://minnie.tuhs.org/pipermail/tuhs/2022-September/026506.html)
Cartron asks what FreeBSD machines I use (https://rubenerd.com/cartron-asks-what-freebsd-machines-i-use/)
My new debugbreak command (https://nullprogram.com/blog/2022/07/31/)
7 sudo myths debunked (https://opensource.com/article/22/8/debunk-sudo-myths)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Andy - sharing and acls (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/Andy%20-%20sharing%20and%20acls.md)
Reptilicus Rex - boot environments (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/Reptilicus%20Rex%20-%20boot%20environments.md)
i3luefire - byhve issue (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/i3luefire%20-%20byhve%20issue.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, ports, packages, jails, interview, rob pike, dennis richie, machines, debugbreak, command, sudo, myth, buster, debunk </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Open Source in Enterprise Environments, Your Comprehensive Guide to rc(8): FreeBSD Services and Automation, How Rob Pike got hired by Dennis Richie, what FreeBSD machines rubenerd uses, new debugbreak command, 7 sudo myths debunked</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://bsdly.blogspot.com/2022/09/open-source-in-enterprise-environments.html" rel="nofollow">Open Source in Enterprise Environments - Where Are We Now and What Is Our Way Forward?</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/rc8-freebsd-services-and-automation/" rel="nofollow">Your Comprehensive Guide to rc(8): FreeBSD Services and Automation</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://minnie.tuhs.org/pipermail/tuhs/2022-September/026506.html" rel="nofollow">How Rob Pike got hired by Dennis Richie</a></h3>

<hr>

<h3><a href="https://rubenerd.com/cartron-asks-what-freebsd-machines-i-use/" rel="nofollow">Cartron asks what FreeBSD machines I use</a></h3>

<hr>

<h3><a href="https://nullprogram.com/blog/2022/07/31/" rel="nofollow">My new debugbreak command</a></h3>

<hr>

<h3><a href="https://opensource.com/article/22/8/debunk-sudo-myths" rel="nofollow">7 sudo myths debunked</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/Andy%20-%20sharing%20and%20acls.md" rel="nofollow">Andy - sharing and acls</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/Reptilicus%20Rex%20-%20boot%20environments.md" rel="nofollow">Reptilicus Rex - boot environments</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/i3luefire%20-%20byhve%20issue.md" rel="nofollow">i3luefire - byhve issue</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Open Source in Enterprise Environments, Your Comprehensive Guide to rc(8): FreeBSD Services and Automation, How Rob Pike got hired by Dennis Richie, what FreeBSD machines rubenerd uses, new debugbreak command, 7 sudo myths debunked</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://bsdly.blogspot.com/2022/09/open-source-in-enterprise-environments.html" rel="nofollow">Open Source in Enterprise Environments - Where Are We Now and What Is Our Way Forward?</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/rc8-freebsd-services-and-automation/" rel="nofollow">Your Comprehensive Guide to rc(8): FreeBSD Services and Automation</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://minnie.tuhs.org/pipermail/tuhs/2022-September/026506.html" rel="nofollow">How Rob Pike got hired by Dennis Richie</a></h3>

<hr>

<h3><a href="https://rubenerd.com/cartron-asks-what-freebsd-machines-i-use/" rel="nofollow">Cartron asks what FreeBSD machines I use</a></h3>

<hr>

<h3><a href="https://nullprogram.com/blog/2022/07/31/" rel="nofollow">My new debugbreak command</a></h3>

<hr>

<h3><a href="https://opensource.com/article/22/8/debunk-sudo-myths" rel="nofollow">7 sudo myths debunked</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/Andy%20-%20sharing%20and%20acls.md" rel="nofollow">Andy - sharing and acls</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/Reptilicus%20Rex%20-%20boot%20environments.md" rel="nofollow">Reptilicus Rex - boot environments</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/i3luefire%20-%20byhve%20issue.md" rel="nofollow">i3luefire - byhve issue</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>477: Uninitialized Memory Disclosures</title>
  <link>https://www.bsdnow.tv/477</link>
  <guid isPermaLink="false">58511dab-5dc9-4024-9373-30c152784856</guid>
  <pubDate>Thu, 20 Oct 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/58511dab-5dc9-4024-9373-30c152784856.mp3" length="67616640" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Analyzing BSD Kernels for Uninitialized Memory Disclosures Using Binary Ninja, Sharing Dual-Licensed Drivers between Linux and FreeBSD, favorite Things About The OpenBSD Packet Filter Tools, How to trigger services restart after OpenBSD update, Gems from the Man Page Trenches, and more.</itunes:subtitle>
  <itunes:duration>46:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Analyzing BSD Kernels for Uninitialized Memory Disclosures Using Binary Ninja, Sharing Dual-Licensed Drivers between Linux and FreeBSD, favorite Things About The OpenBSD Packet Filter Tools, How to trigger services restart after OpenBSD update, Gems from the Man Page Trenches, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Mindshare: Analyzing Bsd Kernels for Uninitialized Memory Disclosures Using Binary Ninja (https://www.zerodayinitiative.com/blog/2022/9/19/mindshare-analyzing-bsd-kernels-with-binary-ninja)
Sharing Dual-Licensed Drivers between Linux and FreeBSD (https://freebsdfoundation.org/blog/sharing-dual-licensed-drivers-between-linux-and-freebsd/)
News Roundup
A Few of My Favorite Things About The OpenBSD Packet Filter Tools (https://nxdomain.no/~peter/better_off_with_pf.html)
How to trigger services restart after OpenBSD update (https://dataswamp.org/~solene/2022-09-25-openbsd-reboot-syspatch.html)
Gems from the Man Page Trenches (https://www.saminiir.com/gems-from-man-page-trenches/)
Beastie Bits
The MIPS ThinkPad (https://oldvcr.blogspot.com/2022/09/the-mips-thinkpad-kind-of.html)
Nix Gems (https://gitlab.com/DeaDSouL/NixGems)
Running PalmOS without PalmOS (https://pmig96.wordpress.com/2022/09/18/running-palmos-without-palmos/)
"OpenBSD Mastery: Filesystems" draft done! (https://mwl.io/archives/22303)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - zfs and databases (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Brad%20-%20zfs%20and%20databases.md)
Kevin - EMACS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Kevin%20-%20EMACS.md)
Michal - virtual OSS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Michal%20-%20virtual%20OSS.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, ports, packages, jails, interview, analysis, kernel, crash dump, uninitialized memory, disclosure, binary ninja, driver, sharing, dual-license, packet filter, toolset, tools pf </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Analyzing BSD Kernels for Uninitialized Memory Disclosures Using Binary Ninja, Sharing Dual-Licensed Drivers between Linux and FreeBSD, favorite Things About The OpenBSD Packet Filter Tools, How to trigger services restart after OpenBSD update, Gems from the Man Page Trenches, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.zerodayinitiative.com/blog/2022/9/19/mindshare-analyzing-bsd-kernels-with-binary-ninja" rel="nofollow">Mindshare: Analyzing Bsd Kernels for Uninitialized Memory Disclosures Using Binary Ninja</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/sharing-dual-licensed-drivers-between-linux-and-freebsd/" rel="nofollow">Sharing Dual-Licensed Drivers between Linux and FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://nxdomain.no/%7Epeter/better_off_with_pf.html" rel="nofollow">A Few of My Favorite Things About The OpenBSD Packet Filter Tools</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-09-25-openbsd-reboot-syspatch.html" rel="nofollow">How to trigger services restart after OpenBSD update</a></h3>

<hr>

<h3><a href="https://www.saminiir.com/gems-from-man-page-trenches/" rel="nofollow">Gems from the Man Page Trenches</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://oldvcr.blogspot.com/2022/09/the-mips-thinkpad-kind-of.html" rel="nofollow">The MIPS ThinkPad</a><br>
<a href="https://gitlab.com/DeaDSouL/NixGems" rel="nofollow">Nix Gems</a><br>
<a href="https://pmig96.wordpress.com/2022/09/18/running-palmos-without-palmos/" rel="nofollow">Running PalmOS without PalmOS</a><br>
<a href="https://mwl.io/archives/22303" rel="nofollow">&quot;OpenBSD Mastery: Filesystems&quot; draft done!</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Brad%20-%20zfs%20and%20databases.md" rel="nofollow">Brad - zfs and databases</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Kevin%20-%20EMACS.md" rel="nofollow">Kevin - EMACS</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Michal%20-%20virtual%20OSS.md" rel="nofollow">Michal - virtual OSS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Analyzing BSD Kernels for Uninitialized Memory Disclosures Using Binary Ninja, Sharing Dual-Licensed Drivers between Linux and FreeBSD, favorite Things About The OpenBSD Packet Filter Tools, How to trigger services restart after OpenBSD update, Gems from the Man Page Trenches, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.zerodayinitiative.com/blog/2022/9/19/mindshare-analyzing-bsd-kernels-with-binary-ninja" rel="nofollow">Mindshare: Analyzing Bsd Kernels for Uninitialized Memory Disclosures Using Binary Ninja</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/sharing-dual-licensed-drivers-between-linux-and-freebsd/" rel="nofollow">Sharing Dual-Licensed Drivers between Linux and FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://nxdomain.no/%7Epeter/better_off_with_pf.html" rel="nofollow">A Few of My Favorite Things About The OpenBSD Packet Filter Tools</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-09-25-openbsd-reboot-syspatch.html" rel="nofollow">How to trigger services restart after OpenBSD update</a></h3>

<hr>

<h3><a href="https://www.saminiir.com/gems-from-man-page-trenches/" rel="nofollow">Gems from the Man Page Trenches</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://oldvcr.blogspot.com/2022/09/the-mips-thinkpad-kind-of.html" rel="nofollow">The MIPS ThinkPad</a><br>
<a href="https://gitlab.com/DeaDSouL/NixGems" rel="nofollow">Nix Gems</a><br>
<a href="https://pmig96.wordpress.com/2022/09/18/running-palmos-without-palmos/" rel="nofollow">Running PalmOS without PalmOS</a><br>
<a href="https://mwl.io/archives/22303" rel="nofollow">&quot;OpenBSD Mastery: Filesystems&quot; draft done!</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Brad%20-%20zfs%20and%20databases.md" rel="nofollow">Brad - zfs and databases</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Kevin%20-%20EMACS.md" rel="nofollow">Kevin - EMACS</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Michal%20-%20virtual%20OSS.md" rel="nofollow">Michal - virtual OSS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>476: Warren Toomey interview</title>
  <link>https://www.bsdnow.tv/476</link>
  <guid isPermaLink="false">64bc3a0c-43cf-4e97-af97-b31d799c1154</guid>
  <pubDate>Thu, 13 Oct 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/64bc3a0c-43cf-4e97-af97-b31d799c1154.mp3" length="64196352" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this special episode, we interview Warren Toomey from the Unix Historical Society. We chat about his involvement in preserving old Unix systems and why that is important.</itunes:subtitle>
  <itunes:duration>44:34</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this special episode, we interview Warren Toomey from the Unix Historical Society. We chat about his involvement in preserving old Unix systems and why that is important.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Interview - Warren Toomey - wkt@tuhs.org (mailto:wkt@tuhs.org)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
 Special Guest: Warren Toomey.
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem,, ports, packages, jails, interview, warren toomey, tuhs </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this special episode, we interview Warren Toomey from the Unix Historical Society. We chat about his involvement in preserving old Unix systems and why that is important.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<hr>

<h2>Interview - Warren Toomey - <a href="mailto:wkt@tuhs.org" rel="nofollow">wkt@tuhs.org</a></h2>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Warren Toomey.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this special episode, we interview Warren Toomey from the Unix Historical Society. We chat about his involvement in preserving old Unix systems and why that is important.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<hr>

<h2>Interview - Warren Toomey - <a href="mailto:wkt@tuhs.org" rel="nofollow">wkt@tuhs.org</a></h2>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Warren Toomey.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>475: Prompt Injection Attacks</title>
  <link>https://www.bsdnow.tv/475</link>
  <guid isPermaLink="false">8308672c-2f88-4a7b-9619-ed61184f731d</guid>
  <pubDate>Thu, 06 Oct 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8308672c-2f88-4a7b-9619-ed61184f731d.mp3" length="68584320" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Prompt injection attacks against GPT-3, the History of Package Management on FreeBSD, A fresh look at FreeBSD, File Management Tools for Your Favorite Shell, Quick Guide about Video Playback on FreeBSD, and more. </itunes:subtitle>
  <itunes:duration>47:37</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Prompt injection attacks against GPT-3, the History of Package Management on FreeBSD, A fresh look at FreeBSD, File Management Tools for Your Favorite Shell, Quick Guide about Video Playback on FreeBSD, and more. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Prompt injection attacks against GPT-3 (https://simonwillison.net/2022/Sep/12/prompt-injection/)
A Quick Look at the History of Package Management on FreeBSD (https://klarasystems.com/articles/a-quick-look-at-the-history-of-package-management-on-freebsd/)
News Roundup
A fresh look at FreeBSD (https://liam-on-linux.dreamwidth.org/86277.html)
File Management Tools for Your Favorite Shell (https://thevaluable.dev/file-management-tools-linux-shell/)
Video Playback on FreeBSD – Quick Guide (https://freebsdfoundation.org/resource/video-playback-on-freebsd-quick-guide/)
Beastie Bits
ps(1) gains support for tree-like display of processes (http://undeadly.org/cgi?action=article;sid=20220902085038)
... interesting old-timey UNIXes ... (https://minnie.tuhs.org/pipermail/tuhs/2022-September/026393.html)
A retro style online SSH client to play Nethack (https://nethack.glitch.me/?retro=true)
The Good, the Bad, and the Ugly: The Unix! Legacy (http://herpolhode.com/rob/ugly.pdf)
Game of Trees 0.75 released (http://undeadly.org/cgi?action=article;sid=20220910120430)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Ken - HPR (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Ken%20-%20HPR.md)
Kevin - FreeBSD and EMACS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Kevin%20-%20FreeBSD%20and%20EMACS.md)
Nathan - Handbook contribution Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Nathan%20-%20Handbook%20contribution%20Question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, prompt injection, attack, gpt3, package management, history, overview, file management tools, shell, guide, video playback</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Prompt injection attacks against GPT-3, the History of Package Management on FreeBSD, A fresh look at FreeBSD, File Management Tools for Your Favorite Shell, Quick Guide about Video Playback on FreeBSD, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://simonwillison.net/2022/Sep/12/prompt-injection/" rel="nofollow">Prompt injection attacks against GPT-3</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/a-quick-look-at-the-history-of-package-management-on-freebsd/" rel="nofollow">A Quick Look at the History of Package Management on FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://liam-on-linux.dreamwidth.org/86277.html" rel="nofollow">A fresh look at FreeBSD</a></h3>

<hr>

<h3><a href="https://thevaluable.dev/file-management-tools-linux-shell/" rel="nofollow">File Management Tools for Your Favorite Shell</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/resource/video-playback-on-freebsd-quick-guide/" rel="nofollow">Video Playback on FreeBSD – Quick Guide</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20220902085038" rel="nofollow">ps(1) gains support for tree-like display of processes</a><br>
<a href="https://minnie.tuhs.org/pipermail/tuhs/2022-September/026393.html" rel="nofollow">... interesting old-timey UNIXes ...</a><br>
<a href="https://nethack.glitch.me/?retro=true" rel="nofollow">A retro style online SSH client to play Nethack</a><br>
<a href="http://herpolhode.com/rob/ugly.pdf" rel="nofollow">The Good, the Bad, and the Ugly: The Unix! Legacy</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20220910120430" rel="nofollow">Game of Trees 0.75 released</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Ken%20-%20HPR.md" rel="nofollow">Ken - HPR</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Kevin%20-%20FreeBSD%20and%20EMACS.md" rel="nofollow">Kevin - FreeBSD and EMACS</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Nathan%20-%20Handbook%20contribution%20Question.md" rel="nofollow">Nathan - Handbook contribution Question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Prompt injection attacks against GPT-3, the History of Package Management on FreeBSD, A fresh look at FreeBSD, File Management Tools for Your Favorite Shell, Quick Guide about Video Playback on FreeBSD, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://simonwillison.net/2022/Sep/12/prompt-injection/" rel="nofollow">Prompt injection attacks against GPT-3</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/a-quick-look-at-the-history-of-package-management-on-freebsd/" rel="nofollow">A Quick Look at the History of Package Management on FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://liam-on-linux.dreamwidth.org/86277.html" rel="nofollow">A fresh look at FreeBSD</a></h3>

<hr>

<h3><a href="https://thevaluable.dev/file-management-tools-linux-shell/" rel="nofollow">File Management Tools for Your Favorite Shell</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/resource/video-playback-on-freebsd-quick-guide/" rel="nofollow">Video Playback on FreeBSD – Quick Guide</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20220902085038" rel="nofollow">ps(1) gains support for tree-like display of processes</a><br>
<a href="https://minnie.tuhs.org/pipermail/tuhs/2022-September/026393.html" rel="nofollow">... interesting old-timey UNIXes ...</a><br>
<a href="https://nethack.glitch.me/?retro=true" rel="nofollow">A retro style online SSH client to play Nethack</a><br>
<a href="http://herpolhode.com/rob/ugly.pdf" rel="nofollow">The Good, the Bad, and the Ugly: The Unix! Legacy</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20220910120430" rel="nofollow">Game of Trees 0.75 released</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Ken%20-%20HPR.md" rel="nofollow">Ken - HPR</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Kevin%20-%20FreeBSD%20and%20EMACS.md" rel="nofollow">Kevin - FreeBSD and EMACS</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Nathan%20-%20Handbook%20contribution%20Question.md" rel="nofollow">Nathan - Handbook contribution Question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>474: EuroBSDcon 2022</title>
  <link>https://www.bsdnow.tv/474</link>
  <guid isPermaLink="false">7b0f6fc2-b232-4eb6-87e8-d945c7a02f25</guid>
  <pubDate>Thu, 29 Sep 2022 03:15:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7b0f6fc2-b232-4eb6-87e8-d945c7a02f25.mp3" length="66559680" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Deploying FreeBSD on Oracle Cloud, A Tale of 300,000 Imaginary Friends, EuroBSDcon 2022 recap, OpenBSD Mastery: Filesystems” Status Report, OpenBGPD 7.6 Released, immutable userland mappings, Portable OpenSSH commits now SSH-signed, and more.</itunes:subtitle>
  <itunes:duration>46:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Deploying FreeBSD on Oracle Cloud, A Tale of 300,000 Imaginary Friends, EuroBSDcon 2022 recap, OpenBSD Mastery: Filesystems” Status Report, OpenBGPD 7.6 Released, immutable userland mappings, Portable OpenSSH commits now SSH-signed, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Deploying FreeBSD on Oracle Cloud (https://klarasystems.com/articles/deploying-freebsd-on-oracle-cloud/)
The Things Spammers Believe - A Tale of 300,000 Imaginary Friends (https://bsdly.blogspot.com/2022/09/the-things-spammers-believe-tale-of.html)
EuroBSDcon 2022 (https://peter.czanik.hu/posts/eurobsdcon2022/)
News Roundup
“OpenBSD Mastery: Filesystems” Status Report (https://mwl.io/archives/22031)
OpenBGPD 7.6 Released (https://undeadly.org/cgi?action=article;sid=20220916051806)
OpenBSD may soon gain further memory protections: immutable userland mappings (http://undeadly.org/cgi?action=article;sid=20220902100648)
Portable OpenSSH commits now SSH-signed (https://undeadly.org/cgi?action=article;sid=20220902045137)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, oracle cloud, deployment, deploying, spam, antispam, spammer, tale, friends, eurobsdcon, conference, book, openbsd mastery, openbgpd, immutable userland mappings, openssh, portable, ssh-signed commits</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Deploying FreeBSD on Oracle Cloud, A Tale of 300,000 Imaginary Friends, EuroBSDcon 2022 recap, OpenBSD Mastery: Filesystems” Status Report, OpenBGPD 7.6 Released, immutable userland mappings, Portable OpenSSH commits now SSH-signed, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/deploying-freebsd-on-oracle-cloud/" rel="nofollow">Deploying FreeBSD on Oracle Cloud</a></h3>

<hr>

<h3><a href="https://bsdly.blogspot.com/2022/09/the-things-spammers-believe-tale-of.html" rel="nofollow">The Things Spammers Believe - A Tale of 300,000 Imaginary Friends</a></h3>

<hr>

<h3><a href="https://peter.czanik.hu/posts/eurobsdcon2022/" rel="nofollow">EuroBSDcon 2022</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mwl.io/archives/22031" rel="nofollow">“OpenBSD Mastery: Filesystems” Status Report</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20220916051806" rel="nofollow">OpenBGPD 7.6 Released</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20220902100648" rel="nofollow">OpenBSD may soon gain further memory protections: immutable userland mappings</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20220902045137" rel="nofollow">Portable OpenSSH commits now SSH-signed</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Deploying FreeBSD on Oracle Cloud, A Tale of 300,000 Imaginary Friends, EuroBSDcon 2022 recap, OpenBSD Mastery: Filesystems” Status Report, OpenBGPD 7.6 Released, immutable userland mappings, Portable OpenSSH commits now SSH-signed, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/deploying-freebsd-on-oracle-cloud/" rel="nofollow">Deploying FreeBSD on Oracle Cloud</a></h3>

<hr>

<h3><a href="https://bsdly.blogspot.com/2022/09/the-things-spammers-believe-tale-of.html" rel="nofollow">The Things Spammers Believe - A Tale of 300,000 Imaginary Friends</a></h3>

<hr>

<h3><a href="https://peter.czanik.hu/posts/eurobsdcon2022/" rel="nofollow">EuroBSDcon 2022</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mwl.io/archives/22031" rel="nofollow">“OpenBSD Mastery: Filesystems” Status Report</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20220916051806" rel="nofollow">OpenBGPD 7.6 Released</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20220902100648" rel="nofollow">OpenBSD may soon gain further memory protections: immutable userland mappings</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20220902045137" rel="nofollow">Portable OpenSSH commits now SSH-signed</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>473: Rusty Kernel Modules</title>
  <link>https://www.bsdnow.tv/473</link>
  <guid isPermaLink="false">3adcda1d-0fbb-4a3a-a4cb-b63c6268b837</guid>
  <pubDate>Thu, 22 Sep 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3adcda1d-0fbb-4a3a-a4cb-b63c6268b837.mp3" length="66747456" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Writing FreeBSD kernel modules in Rust, Details behind the FreeBSD aio LPE, Linux subsystem for FreeBSD, FreeBSD Journal: Science, Systems, and FreeBSD, NetBSD improves Amiga support, OpenBSD on Scaleway Elastic Metal, and more</itunes:subtitle>
  <itunes:duration>46:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Writing FreeBSD kernel modules in Rust, Details behind the FreeBSD aio LPE, Linux subsystem for FreeBSD, FreeBSD Journal: Science, Systems, and FreeBSD, NetBSD improves Amiga support, OpenBSD on Scaleway Elastic Metal, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Writing FreeBSD Kernel modules in Rust (https://research.nccgroup.com/2022/08/31/writing-freebsd-kernel-modules-in-rust/)
Details behind the FreeBSD aio LPE (https://accessvector.net/2022/freebsd-aio-lpe)
News Roundup
Linux Subsystem for FreeBSD (https://medium.com/nttlabs/linux-subsystem-for-freebsd-500b9a88fda4)
FreeBSD Journal: Science, Systems, and FreeBSD  (https://freebsdfoundation.org/wp-content/uploads/2022/08/03ae2705ab4362602a6bb90c5b9628c595d8b4fa.2.pdf)
NetBSD improves its support for the Commodore Amiga (https://thenewstrace.com/netbsd-an-operating-system-that-is-serious-about-being-cross-platform-now-improves-its-support-for-the-commodore-amiga-1985/243892/)
Installing OpenBSD on Scaleway Elastic Metal (https://www.senzilla.io/blog/2022/08/10/installing-openbsd-scaleway-elastic-metal/)
Beastie Bits
/usr/games removed from the default $PATH (http://undeadly.org/cgi?action=article;sid=20220810120423)
How to install and configure mDNSResponder (https://forums.FreeBSD.org/threads/how-to-install-and-configure-mdnsresponder.70713/)
How to use consistent exit codes in shell scripts (https://sleeplessbeastie.eu/2022/08/12/how-to-use-consistent-exit-codes-in-shell-scripts)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
[TheHolm - zfs question)[https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/TheHolm%20-%20zfs%20question.md]
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, rust, kernel module, aio lpe, subsystem, linux, freebsd journal, issue, science, systems, amiga support, scaleway, elastic metal</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Writing FreeBSD kernel modules in Rust, Details behind the FreeBSD aio LPE, Linux subsystem for FreeBSD, FreeBSD Journal: Science, Systems, and FreeBSD, NetBSD improves Amiga support, OpenBSD on Scaleway Elastic Metal, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://research.nccgroup.com/2022/08/31/writing-freebsd-kernel-modules-in-rust/" rel="nofollow">Writing FreeBSD Kernel modules in Rust</a></h3>

<hr>

<h3><a href="https://accessvector.net/2022/freebsd-aio-lpe" rel="nofollow">Details behind the FreeBSD aio LPE</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://medium.com/nttlabs/linux-subsystem-for-freebsd-500b9a88fda4" rel="nofollow">Linux Subsystem for FreeBSD</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/wp-content/uploads/2022/08/03ae2705ab4362602a6bb90c5b9628c595d8b4fa.2.pdf" rel="nofollow">FreeBSD Journal: Science, Systems, and FreeBSD </a></h3>

<hr>

<h3><a href="https://thenewstrace.com/netbsd-an-operating-system-that-is-serious-about-being-cross-platform-now-improves-its-support-for-the-commodore-amiga-1985/243892/" rel="nofollow">NetBSD improves its support for the Commodore Amiga</a></h3>

<hr>

<h3><a href="https://www.senzilla.io/blog/2022/08/10/installing-openbsd-scaleway-elastic-metal/" rel="nofollow">Installing OpenBSD on Scaleway Elastic Metal</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://undeadly.org/cgi?action=article;sid=20220810120423" rel="nofollow">/usr/games removed from the default $PATH</a></p></li>
<li><p><a href="https://forums.FreeBSD.org/threads/how-to-install-and-configure-mdnsresponder.70713/" rel="nofollow">How to install and configure mDNSResponder</a></p></li>
<li><p><a href="https://sleeplessbeastie.eu/2022/08/12/how-to-use-consistent-exit-codes-in-shell-scripts" rel="nofollow">How to use consistent exit codes in shell scripts</a></p>

<hr></li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>[TheHolm - zfs question)[<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/TheHolm%20-%20zfs%20question.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/TheHolm%20-%20zfs%20question.md</a>]
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Writing FreeBSD kernel modules in Rust, Details behind the FreeBSD aio LPE, Linux subsystem for FreeBSD, FreeBSD Journal: Science, Systems, and FreeBSD, NetBSD improves Amiga support, OpenBSD on Scaleway Elastic Metal, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://research.nccgroup.com/2022/08/31/writing-freebsd-kernel-modules-in-rust/" rel="nofollow">Writing FreeBSD Kernel modules in Rust</a></h3>

<hr>

<h3><a href="https://accessvector.net/2022/freebsd-aio-lpe" rel="nofollow">Details behind the FreeBSD aio LPE</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://medium.com/nttlabs/linux-subsystem-for-freebsd-500b9a88fda4" rel="nofollow">Linux Subsystem for FreeBSD</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/wp-content/uploads/2022/08/03ae2705ab4362602a6bb90c5b9628c595d8b4fa.2.pdf" rel="nofollow">FreeBSD Journal: Science, Systems, and FreeBSD </a></h3>

<hr>

<h3><a href="https://thenewstrace.com/netbsd-an-operating-system-that-is-serious-about-being-cross-platform-now-improves-its-support-for-the-commodore-amiga-1985/243892/" rel="nofollow">NetBSD improves its support for the Commodore Amiga</a></h3>

<hr>

<h3><a href="https://www.senzilla.io/blog/2022/08/10/installing-openbsd-scaleway-elastic-metal/" rel="nofollow">Installing OpenBSD on Scaleway Elastic Metal</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://undeadly.org/cgi?action=article;sid=20220810120423" rel="nofollow">/usr/games removed from the default $PATH</a></p></li>
<li><p><a href="https://forums.FreeBSD.org/threads/how-to-install-and-configure-mdnsresponder.70713/" rel="nofollow">How to install and configure mDNSResponder</a></p></li>
<li><p><a href="https://sleeplessbeastie.eu/2022/08/12/how-to-use-consistent-exit-codes-in-shell-scripts" rel="nofollow">How to use consistent exit codes in shell scripts</a></p>

<hr></li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>[TheHolm - zfs question)[<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/TheHolm%20-%20zfs%20question.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/TheHolm%20-%20zfs%20question.md</a>]
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>472: Consistent Exit Code</title>
  <link>https://www.bsdnow.tv/472</link>
  <guid isPermaLink="false">8d63b5c4-f59c-4142-a030-f0791de6b56a</guid>
  <pubDate>Thu, 15 Sep 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8d63b5c4-f59c-4142-a030-f0791de6b56a.mp3" length="65335680" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD on the Framework Laptop, Win32 is the only stable ABI on Linux, why OpenBSD’s documentation is so good, configure dma for mail delivery in jails on internet hosts, introducing muxfs, RAID1C boot support, and more</itunes:subtitle>
  <itunes:duration>45:22</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD on the Framework Laptop, Win32 is the only stable ABI on Linux, why OpenBSD’s documentation is so good, configure dma for mail delivery in jails on internet hosts, introducing muxfs, RAID1C boot support, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD on the Framework laptop (https://xyinn.org/md/freebsd/framework_laptop)
Win32 is the only stable ABI on Linux (https://blog.hiler.eu/win32-the-only-stable-abi/)
News Roundup
Why is the OpenBSD documentation so good? (https://dataswamp.org/~solene/2022-08-18-why-openbsd-documentation-is-good.html)
How I configure dma for mail delivery in jails on my internet hosts (https://dan.langille.org/2022/08/15/how-i-configure-dma-for-mail-delivery-in-jails-on-my-internet-hosts/)
Introducing muxfs (https://sdadams.org/blog/introducing-muxfs/)
RAID 1C boot support added (http://undeadly.org/cgi?action=article;sid=20220813110021)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
[Oliver - shell tip)[https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/Oliver%20-%20shell%20tip.md]
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, framework, laptop, stable abi, win32, documentation, dma, dragonfly mail agent, mail agent, mail delivery, muxfs, raid 1c, boot support</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD on the Framework Laptop, Win32 is the only stable ABI on Linux, why OpenBSD’s documentation is so good, configure dma for mail delivery in jails on internet hosts, introducing muxfs, RAID1C boot support, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://xyinn.org/md/freebsd/framework_laptop" rel="nofollow">FreeBSD on the Framework laptop</a></h3>

<hr>

<h3><a href="https://blog.hiler.eu/win32-the-only-stable-abi/" rel="nofollow">Win32 is the only stable ABI on Linux</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2022-08-18-why-openbsd-documentation-is-good.html" rel="nofollow">Why is the OpenBSD documentation so good?</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2022/08/15/how-i-configure-dma-for-mail-delivery-in-jails-on-my-internet-hosts/" rel="nofollow">How I configure dma for mail delivery in jails on my internet hosts</a></h3>

<hr>

<h3><a href="https://sdadams.org/blog/introducing-muxfs/" rel="nofollow">Introducing muxfs</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20220813110021" rel="nofollow">RAID 1C boot support added</a></h3>

<hr>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>[Oliver - shell tip)[<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/Oliver%20-%20shell%20tip.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/Oliver%20-%20shell%20tip.md</a>]</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD on the Framework Laptop, Win32 is the only stable ABI on Linux, why OpenBSD’s documentation is so good, configure dma for mail delivery in jails on internet hosts, introducing muxfs, RAID1C boot support, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://xyinn.org/md/freebsd/framework_laptop" rel="nofollow">FreeBSD on the Framework laptop</a></h3>

<hr>

<h3><a href="https://blog.hiler.eu/win32-the-only-stable-abi/" rel="nofollow">Win32 is the only stable ABI on Linux</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2022-08-18-why-openbsd-documentation-is-good.html" rel="nofollow">Why is the OpenBSD documentation so good?</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2022/08/15/how-i-configure-dma-for-mail-delivery-in-jails-on-my-internet-hosts/" rel="nofollow">How I configure dma for mail delivery in jails on my internet hosts</a></h3>

<hr>

<h3><a href="https://sdadams.org/blog/introducing-muxfs/" rel="nofollow">Introducing muxfs</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20220813110021" rel="nofollow">RAID 1C boot support added</a></h3>

<hr>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>[Oliver - shell tip)[<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/Oliver%20-%20shell%20tip.md" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/Oliver%20-%20shell%20tip.md</a>]</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>471: De-Penguinization</title>
  <link>https://www.bsdnow.tv/471</link>
  <guid isPermaLink="false">6550223a-8916-4ffc-ab29-30b5caa18d2c</guid>
  <pubDate>Thu, 08 Sep 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6550223a-8916-4ffc-ab29-30b5caa18d2c.mp3" length="70774272" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Ten Things To Do After Installing FreeBSD, BSD for Linux users, r2k22 Hackathon Report on rpki-client, Configuring OpenIKED, De-Penguin Me, and more </itunes:subtitle>
  <itunes:duration>49:08</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Ten Things To Do After Installing FreeBSD, BSD for Linux users, r2k22 Hackathon Report on rpki-client, Configuring OpenIKED, De-Penguin Me, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Ten Things To Do After Installing FreeBSD (https://bastillebsd.org/blog/2022/07/14/ten-things-to-do-after-installing-freebsd/)
News Roundup
hpr3655 :: BSD for Linux users (http://hackerpublicradio.org/eps.php?id=3655)
r2k22 Hackathon Report: Job Snijders (job@) on rpki-client and more (http://undeadly.org/cgi?action=article;sid=20220701171631)
Configuring OpenIKED (https://wiki.ircnow.org/index.php?n=Iked.Configure)
De-Penguin Me (https://depenguin.me/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, ten things, to do, users, rk2k22, hackathon, rpki-client, openiked, configuring, configuration, de-penguin</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Ten Things To Do After Installing FreeBSD, BSD for Linux users, r2k22 Hackathon Report on rpki-client, Configuring OpenIKED, De-Penguin Me, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://bastillebsd.org/blog/2022/07/14/ten-things-to-do-after-installing-freebsd/" rel="nofollow">Ten Things To Do After Installing FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://hackerpublicradio.org/eps.php?id=3655" rel="nofollow">hpr3655 :: BSD for Linux users</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20220701171631" rel="nofollow">r2k22 Hackathon Report: Job Snijders (job@) on rpki-client and more</a></h3>

<hr>

<h3><a href="https://wiki.ircnow.org/index.php?n=Iked.Configure" rel="nofollow">Configuring OpenIKED</a></h3>

<hr>

<h3><a href="https://depenguin.me/" rel="nofollow">De-Penguin Me</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Ten Things To Do After Installing FreeBSD, BSD for Linux users, r2k22 Hackathon Report on rpki-client, Configuring OpenIKED, De-Penguin Me, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://bastillebsd.org/blog/2022/07/14/ten-things-to-do-after-installing-freebsd/" rel="nofollow">Ten Things To Do After Installing FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://hackerpublicradio.org/eps.php?id=3655" rel="nofollow">hpr3655 :: BSD for Linux users</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20220701171631" rel="nofollow">r2k22 Hackathon Report: Job Snijders (job@) on rpki-client and more</a></h3>

<hr>

<h3><a href="https://wiki.ircnow.org/index.php?n=Iked.Configure" rel="nofollow">Configuring OpenIKED</a></h3>

<hr>

<h3><a href="https://depenguin.me/" rel="nofollow">De-Penguin Me</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>470: 0mp interview</title>
  <link>https://www.bsdnow.tv/470</link>
  <guid isPermaLink="false">3f9451dd-059e-44da-9055-d7e119765d55</guid>
  <pubDate>Thu, 01 Sep 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3f9451dd-059e-44da-9055-d7e119765d55.mp3" length="75793536" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this special episode, we are interviewing Mateusz Piotrowski about his various roles in the FreeBSD project, his ports work, and a few other interesting things he’s involved with. Enjoy this interview episode, we’ll be back with a regular episode next week.  </itunes:subtitle>
  <itunes:duration>52:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this special episode, we are interviewing Mateusz Piotrowski about his various roles in the FreeBSD project, his ports work, and a few other interesting things he’s involved with. Enjoy this interview episode, we’ll be back with a regular episode next week.  
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Interview - Mateusz Piotrowski - 0mp@freebsd.org (mailto:0mp@freebsd.org) / @0mpts (https://twitter.com/0mpts)
Interview
+ BR: Welcome Mateusz. Can you tell our audience a bit about yourself and how you got started with Unix/BSD?
+ TJ: What can we blame you for (prior/current work, planned projects)?
+ BR: You served as the first doceng secretary and joined the FreeBSD core team in this term. What interested you in these roles and what do you want to accomplish in this term?
+ TJ: You are also busy with maintaining some FreeBSD ports. What ports are those?
+ BR: Can you tell us a bit about your thesis work?
+ TJ: What does open source work mean for you?
+ BR: Do you have a cool Unix/BSD tip for us?
+ TJ: Is there anything else that you'd like to mention before we let you go?
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
 Special Guest: Mateusz Piotrowski.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this special episode, we are interviewing Mateusz Piotrowski about his various roles in the FreeBSD project, his ports work, and a few other interesting things he’s involved with. Enjoy this interview episode, we’ll be back with a regular episode next week.  </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h2>Interview - Mateusz Piotrowski - <a href="mailto:0mp@freebsd.org" rel="nofollow">0mp@freebsd.org</a> / <a href="https://twitter.com/0mpts" rel="nofollow">@0mpts</a></h2>

<p>Interview</p>

<ul>
<li>BR: Welcome Mateusz. Can you tell our audience a bit about yourself and how you got started with Unix/BSD?</li>
<li>TJ: What can we blame you for (prior/current work, planned projects)?</li>
<li>BR: You served as the first doceng secretary and joined the FreeBSD core team in this term. What interested you in these roles and what do you want to accomplish in this term?</li>
<li>TJ: You are also busy with maintaining some FreeBSD ports. What ports are those?</li>
<li>BR: Can you tell us a bit about your thesis work?</li>
<li>TJ: What does open source work mean for you?</li>
<li>BR: Do you have a cool Unix/BSD tip for us?</li>
<li>TJ: Is there anything else that you&#39;d like to mention before we let you go?</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Mateusz Piotrowski.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this special episode, we are interviewing Mateusz Piotrowski about his various roles in the FreeBSD project, his ports work, and a few other interesting things he’s involved with. Enjoy this interview episode, we’ll be back with a regular episode next week.  </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h2>Interview - Mateusz Piotrowski - <a href="mailto:0mp@freebsd.org" rel="nofollow">0mp@freebsd.org</a> / <a href="https://twitter.com/0mpts" rel="nofollow">@0mpts</a></h2>

<p>Interview</p>

<ul>
<li>BR: Welcome Mateusz. Can you tell our audience a bit about yourself and how you got started with Unix/BSD?</li>
<li>TJ: What can we blame you for (prior/current work, planned projects)?</li>
<li>BR: You served as the first doceng secretary and joined the FreeBSD core team in this term. What interested you in these roles and what do you want to accomplish in this term?</li>
<li>TJ: You are also busy with maintaining some FreeBSD ports. What ports are those?</li>
<li>BR: Can you tell us a bit about your thesis work?</li>
<li>TJ: What does open source work mean for you?</li>
<li>BR: Do you have a cool Unix/BSD tip for us?</li>
<li>TJ: Is there anything else that you&#39;d like to mention before we let you go?</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Mateusz Piotrowski.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>469: Ctrl-C Reset</title>
  <link>https://www.bsdnow.tv/469</link>
  <guid isPermaLink="false">7c5cb6f6-6eba-4430-9347-89e87c1e230b</guid>
  <pubDate>Thu, 25 Aug 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7c5cb6f6-6eba-4430-9347-89e87c1e230b.mp3" length="61200576" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Q2 2022 Status Report, FreeBSD in Science, fastest yes(1) in the west, Why Programmers Can’t "Reset" Programs With Ctrl-C, Run Slack in FreeBSD’s Linuxulator, and more.</itunes:subtitle>
  <itunes:duration>42:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Q2 2022 Status Report, FreeBSD in Science, fastest yes(1) in the west, Why Programmers Can’t "Reset" Programs With Ctrl-C, Run Slack in FreeBSD’s Linuxulator, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Q2 2022 Status Report (https://www.freebsd.org/status/report-2022-04-2022-06/)
FreeBSD in Science (https://freebsdfoundation.org/blog/guest-post-freebsd-in-science/)
News Roundup
Fastest yes(1) in the west (https://codegolf.stackexchange.com/questions/199528/fastest-yes-in-the-west/199622#199622)
Ctrl-C: Why Programmers Can’t "Reset" Programs With Ctrl-C, but Used to Be Able To, and Why They Should Be Able to Again (https://kevinlawler.com/ctrl-c)
Run Slack in FreeBSD’s Linuxulator (https://meka.rs/blog/2022/07/01/freebsd-linuxulator/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, quarterly status report, q2 2022, science, yes, fast, optimize, optimization, reset, ctrl-c, control-c, slack, linuxulator</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Q2 2022 Status Report, FreeBSD in Science, fastest yes(1) in the west, Why Programmers Can’t &quot;Reset&quot; Programs With Ctrl-C, Run Slack in FreeBSD’s Linuxulator, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2022-04-2022-06/" rel="nofollow">FreeBSD Q2 2022 Status Report</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/guest-post-freebsd-in-science/" rel="nofollow">FreeBSD in Science</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://codegolf.stackexchange.com/questions/199528/fastest-yes-in-the-west/199622#199622" rel="nofollow">Fastest yes(1) in the west</a></h3>

<hr>

<h3><a href="https://kevinlawler.com/ctrl-c" rel="nofollow">Ctrl-C: Why Programmers Can’t &quot;Reset&quot; Programs With Ctrl-C, but Used to Be Able To, and Why They Should Be Able to Again</a></h3>

<hr>

<h3><a href="https://meka.rs/blog/2022/07/01/freebsd-linuxulator/" rel="nofollow">Run Slack in FreeBSD’s Linuxulator</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Q2 2022 Status Report, FreeBSD in Science, fastest yes(1) in the west, Why Programmers Can’t &quot;Reset&quot; Programs With Ctrl-C, Run Slack in FreeBSD’s Linuxulator, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2022-04-2022-06/" rel="nofollow">FreeBSD Q2 2022 Status Report</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/guest-post-freebsd-in-science/" rel="nofollow">FreeBSD in Science</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://codegolf.stackexchange.com/questions/199528/fastest-yes-in-the-west/199622#199622" rel="nofollow">Fastest yes(1) in the west</a></h3>

<hr>

<h3><a href="https://kevinlawler.com/ctrl-c" rel="nofollow">Ctrl-C: Why Programmers Can’t &quot;Reset&quot; Programs With Ctrl-C, but Used to Be Able To, and Why They Should Be Able to Again</a></h3>

<hr>

<h3><a href="https://meka.rs/blog/2022/07/01/freebsd-linuxulator/" rel="nofollow">Run Slack in FreeBSD’s Linuxulator</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>468: Apples and CHERI</title>
  <link>https://www.bsdnow.tv/468</link>
  <guid isPermaLink="false">8142f047-532d-4b74-9f4f-45ee6e5f5e57</guid>
  <pubDate>Thu, 18 Aug 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8142f047-532d-4b74-9f4f-45ee6e5f5e57.mp3" length="22136952" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Advocating for FreeBSD in 2022 and Beyond, NetBSD 9.3 released, OPNsense 22.7 available, CHERI-based computer runs KDE for the first time, Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac, and more</itunes:subtitle>
  <itunes:duration>38:19</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Advocating for FreeBSD in 2022 and Beyond, NetBSD 9.3 released, OPNsense 22.7 available, CHERI-based computer runs KDE for the first time, Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac, and more
Notes
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Advocating for FreeBSD in 2022 and Beyond (https://freebsdfoundation.org/blog/advocating-for-freebsd-in-2022-and-beyond/)
NetBSD 9.3 released (http://blog.netbsd.org/tnf/entry/netbsd_9_3_released)
News Roundup
OPNsense 22.7 released (https://forum.opnsense.org/index.php?topic=29507.0)
CHERI-based computer runs KDE for the first time (https://www.theregister.com/2022/07/26/cheri_computer_runs_kde/)
Guide: Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac (https://gist.github.com/ctsrc/a1f57933a2cde9abc0f07be12889f97f)
Beastie Bits
• [In -current, dhclient(8) now just logs warnings and executes ifconfig(8)](http://undeadly.org/cgi?action=article;sid=20220703114819)
• [Freshly installed #NetBSD 4.0.1 booting on a 80386 DX40 with 8MB of RAM in 2022](https://twitter.com/lefinnois/status/1553246084675375104)
• [nerdctl](https://twitter.com/woodsb02/status/1554481441060560898?s=28&amp;amp;t=8K7_A1RiWnCDU_Mme4_Yqw)
• [Even more Randomness](https://undeadly.org/cgi?action=article;sid=20220731110742)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, advocation, advocacy, opnsense, cheri, kde, k desktop environment, first time, bringup, arm64, apple silicon</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Advocating for FreeBSD in 2022 and Beyond, NetBSD 9.3 released, OPNsense 22.7 available, CHERI-based computer runs KDE for the first time, Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac, and more</p>

<p><strong><em>Notes</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/advocating-for-freebsd-in-2022-and-beyond/" rel="nofollow">Advocating for FreeBSD in 2022 and Beyond</a></h3>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/netbsd_9_3_released" rel="nofollow">NetBSD 9.3 released</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://forum.opnsense.org/index.php?topic=29507.0" rel="nofollow">OPNsense 22.7 released</a></h3>

<hr>

<h3><a href="https://www.theregister.com/2022/07/26/cheri_computer_runs_kde/" rel="nofollow">CHERI-based computer runs KDE for the first time</a></h3>

<hr>

<h3><a href="https://gist.github.com/ctsrc/a1f57933a2cde9abc0f07be12889f97f" rel="nofollow">Guide: Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [In -current, dhclient(8) now just logs warnings and executes ifconfig(8)](http://undeadly.org/cgi?action=article;sid=20220703114819)
• [Freshly installed #NetBSD 4.0.1 booting on a 80386 DX40 with 8MB of RAM in 2022](https://twitter.com/lefinnois/status/1553246084675375104)
• [nerdctl](https://twitter.com/woodsb02/status/1554481441060560898?s=28&amp;t=8K7_A1RiWnCDU_Mme4_Yqw)
• [Even more Randomness](https://undeadly.org/cgi?action=article;sid=20220731110742)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Advocating for FreeBSD in 2022 and Beyond, NetBSD 9.3 released, OPNsense 22.7 available, CHERI-based computer runs KDE for the first time, Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac, and more</p>

<p><strong><em>Notes</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/advocating-for-freebsd-in-2022-and-beyond/" rel="nofollow">Advocating for FreeBSD in 2022 and Beyond</a></h3>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/netbsd_9_3_released" rel="nofollow">NetBSD 9.3 released</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://forum.opnsense.org/index.php?topic=29507.0" rel="nofollow">OPNsense 22.7 released</a></h3>

<hr>

<h3><a href="https://www.theregister.com/2022/07/26/cheri_computer_runs_kde/" rel="nofollow">CHERI-based computer runs KDE for the first time</a></h3>

<hr>

<h3><a href="https://gist.github.com/ctsrc/a1f57933a2cde9abc0f07be12889f97f" rel="nofollow">Guide: Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [In -current, dhclient(8) now just logs warnings and executes ifconfig(8)](http://undeadly.org/cgi?action=article;sid=20220703114819)
• [Freshly installed #NetBSD 4.0.1 booting on a 80386 DX40 with 8MB of RAM in 2022](https://twitter.com/lefinnois/status/1553246084675375104)
• [nerdctl](https://twitter.com/woodsb02/status/1554481441060560898?s=28&amp;t=8K7_A1RiWnCDU_Mme4_Yqw)
• [Even more Randomness](https://undeadly.org/cgi?action=article;sid=20220731110742)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>467: Minecraft on NetBSD</title>
  <link>https://www.bsdnow.tv/467</link>
  <guid isPermaLink="false">9b71b507-e030-4903-b7ea-9abf525548cd</guid>
  <pubDate>Thu, 11 Aug 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9b71b507-e030-4903-b7ea-9abf525548cd.mp3" length="29179728" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Installing BSDs on Cubieboard1, Self-hosting a static site with OpenBSD, httpd, and relayd, NetBSD can also run a Minecraft server, A Little Story About the `yes` Unix Command, Shell History: Unix, OpenBGPD 7.5 released, and more</itunes:subtitle>
  <itunes:duration>48:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Installing BSDs on Cubieboard1, Self-hosting a static site with OpenBSD, httpd, and relayd, NetBSD can also run a Minecraft server, A Little Story About the yes Unix Command, Shell History: Unix, OpenBGPD 7.5 released, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Installing BSDs on Cubieboard1 (https://mekboy.ru/post/bsd-on-cubieboard1.en/)
Self-hosting a static site with OpenBSD, httpd, and relayd (https://citizen428.net/blog/self-hosting-static-site-openbsd-httpd-relayd/)
News Roundup
NetBSD can also run a Minecraft server (https://rubenerd.com/netbsd-can-also-run-a-minecraft-server/)
A Little Story About the yes Unix Command (https://endler.dev/2017/yes/)
Shell History: Unix (https://portal.mozz.us/gemini/auragem.space/~krixano/ShellHistory-Unix.pdf)
OpenBGPD 7.5 released (https://undeadly.org/cgi?action=article;sid=20220716101930)
Beastie Bits
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Ludensen - Feedback (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/467/feedback/Ludensen%20-%20Feedback.md)
Vidar - OpenRGB (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/467/feedback/Vidar%20-%20OpenRGB.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, cubieboard1, self-hosting, static-site, static website, httpd, relayd, minecraft, story, yes, unix command, shell history, openbgpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Installing BSDs on Cubieboard1, Self-hosting a static site with OpenBSD, httpd, and relayd, NetBSD can also run a Minecraft server, A Little Story About the <code>yes</code> Unix Command, Shell History: Unix, OpenBGPD 7.5 released, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://mekboy.ru/post/bsd-on-cubieboard1.en/" rel="nofollow">Installing BSDs on Cubieboard1</a></h3>

<hr>

<h3><a href="https://citizen428.net/blog/self-hosting-static-site-openbsd-httpd-relayd/" rel="nofollow">Self-hosting a static site with OpenBSD, httpd, and relayd</a></h3>

<h2>News Roundup</h2>

<h3><a href="https://rubenerd.com/netbsd-can-also-run-a-minecraft-server/" rel="nofollow">NetBSD can also run a Minecraft server</a></h3>

<hr>

<h3><a href="https://endler.dev/2017/yes/" rel="nofollow">A Little Story About the <code>yes</code> Unix Command</a></h3>

<hr>

<h3><a href="https://portal.mozz.us/gemini/auragem.space/%7Ekrixano/ShellHistory-Unix.pdf" rel="nofollow">Shell History: Unix</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20220716101930" rel="nofollow">OpenBGPD 7.5 released</a></h3>

<hr>

<h2>Beastie Bits</h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/467/feedback/Ludensen%20-%20Feedback.md" rel="nofollow">Ludensen - Feedback</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/467/feedback/Vidar%20-%20OpenRGB.md" rel="nofollow">Vidar - OpenRGB</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Installing BSDs on Cubieboard1, Self-hosting a static site with OpenBSD, httpd, and relayd, NetBSD can also run a Minecraft server, A Little Story About the <code>yes</code> Unix Command, Shell History: Unix, OpenBGPD 7.5 released, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://mekboy.ru/post/bsd-on-cubieboard1.en/" rel="nofollow">Installing BSDs on Cubieboard1</a></h3>

<hr>

<h3><a href="https://citizen428.net/blog/self-hosting-static-site-openbsd-httpd-relayd/" rel="nofollow">Self-hosting a static site with OpenBSD, httpd, and relayd</a></h3>

<h2>News Roundup</h2>

<h3><a href="https://rubenerd.com/netbsd-can-also-run-a-minecraft-server/" rel="nofollow">NetBSD can also run a Minecraft server</a></h3>

<hr>

<h3><a href="https://endler.dev/2017/yes/" rel="nofollow">A Little Story About the <code>yes</code> Unix Command</a></h3>

<hr>

<h3><a href="https://portal.mozz.us/gemini/auragem.space/%7Ekrixano/ShellHistory-Unix.pdf" rel="nofollow">Shell History: Unix</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20220716101930" rel="nofollow">OpenBGPD 7.5 released</a></h3>

<hr>

<h2>Beastie Bits</h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/467/feedback/Ludensen%20-%20Feedback.md" rel="nofollow">Ludensen - Feedback</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/467/feedback/Vidar%20-%20OpenRGB.md" rel="nofollow">Vidar - OpenRGB</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>466: cat(1)’s efficiency</title>
  <link>https://www.bsdnow.tv/466</link>
  <guid isPermaLink="false">507205dc-d2f0-4e96-ba40-fea8171e2125</guid>
  <pubDate>Thu, 04 Aug 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/507205dc-d2f0-4e96-ba40-fea8171e2125.mp3" length="32073600" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Contributing to Open Source Beyond Software Development, bringing TLS 1.3 to the Internet of Old Things, How efficient can cat(1) be, boost the speed of Unix shell programs, Running FreeBSD VNET Jails on AWS EC2 with Bastille, and more</itunes:subtitle>
  <itunes:duration>53:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Contributing to Open Source Beyond Software Development, bringing TLS 1.3 to the Internet of Old Things, How efficient can cat(1) be, boost the speed of Unix shell programs, Running FreeBSD VNET Jails on AWS EC2 with Bastille, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Contributing to Open Source Beyond Software Development (https://klarasystems.com/articles/contributing-to-open-source-beyond-software-development/)
Crypto Ancienne 2.0 now brings TLS 1.3 to the Internet of Old Things (except BeOS) (https://oldvcr.blogspot.com/2022/07/crypto-ancienne-20-now-brings-tls-13-to.html)
News Roundup
How efficient can cat(1) be? (https://ariadne.space/2022/07/17/how-efficient-can-cat1-be/)
Technique significantly boosts the speeds of programs that run in the Unix shell (https://techxplore.com/news/2022-06-technique-significantly-boosts-unix-shell.html)
• [binpa.sh](http://binpa.sh/)
Running FreeBSD VNET Jails on AWS EC2 with Bastille (https://pertho.net/posts/bastille-vnet-jails-ec2/)
Beastie Bits
Game of Trees 0.74 released (http://undeadly.org/cgi?action=article;sid=20220720220958)
OpenBSD -current has moved to 7.2-beta (https://undeadly.org/cgi?action=article;sid=20220721122727)
A Unix Command Line Crash Course (https://itnext.io/unix-command-line-crash-course-453e409d62f5)
BSD.DOG vimrc (https://bsd.dog/project/bsd-dog-vimrc/)
FreeBSD Speedruns (https://wiki.freebsd.org/Speedruns)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, contribution, contributing, software development, tls 1.3, internet of old things, cat, efficiency, speed boost, vnet, aws ec2, bastille</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Contributing to Open Source Beyond Software Development, bringing TLS 1.3 to the Internet of Old Things, How efficient can cat(1) be, boost the speed of Unix shell programs, Running FreeBSD VNET Jails on AWS EC2 with Bastille, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/contributing-to-open-source-beyond-software-development/" rel="nofollow">Contributing to Open Source Beyond Software Development</a></h3>

<hr>

<h3><a href="https://oldvcr.blogspot.com/2022/07/crypto-ancienne-20-now-brings-tls-13-to.html" rel="nofollow">Crypto Ancienne 2.0 now brings TLS 1.3 to the Internet of Old Things (except BeOS)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://ariadne.space/2022/07/17/how-efficient-can-cat1-be/" rel="nofollow">How efficient can cat(1) be?</a></h3>

<hr>

<h3><a href="https://techxplore.com/news/2022-06-technique-significantly-boosts-unix-shell.html" rel="nofollow">Technique significantly boosts the speeds of programs that run in the Unix shell</a></h3>

<pre><code>• [binpa.sh](http://binpa.sh/)
</code></pre>

<hr>

<h3><a href="https://pertho.net/posts/bastille-vnet-jails-ec2/" rel="nofollow">Running FreeBSD VNET Jails on AWS EC2 with Bastille</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20220720220958" rel="nofollow">Game of Trees 0.74 released</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20220721122727" rel="nofollow">OpenBSD -current has moved to 7.2-beta</a><br>
<a href="https://itnext.io/unix-command-line-crash-course-453e409d62f5" rel="nofollow">A Unix Command Line Crash Course</a><br>
<a href="https://bsd.dog/project/bsd-dog-vimrc/" rel="nofollow">BSD.DOG vimrc</a><br>
<a href="https://wiki.freebsd.org/Speedruns" rel="nofollow">FreeBSD Speedruns</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Contributing to Open Source Beyond Software Development, bringing TLS 1.3 to the Internet of Old Things, How efficient can cat(1) be, boost the speed of Unix shell programs, Running FreeBSD VNET Jails on AWS EC2 with Bastille, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/contributing-to-open-source-beyond-software-development/" rel="nofollow">Contributing to Open Source Beyond Software Development</a></h3>

<hr>

<h3><a href="https://oldvcr.blogspot.com/2022/07/crypto-ancienne-20-now-brings-tls-13-to.html" rel="nofollow">Crypto Ancienne 2.0 now brings TLS 1.3 to the Internet of Old Things (except BeOS)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://ariadne.space/2022/07/17/how-efficient-can-cat1-be/" rel="nofollow">How efficient can cat(1) be?</a></h3>

<hr>

<h3><a href="https://techxplore.com/news/2022-06-technique-significantly-boosts-unix-shell.html" rel="nofollow">Technique significantly boosts the speeds of programs that run in the Unix shell</a></h3>

<pre><code>• [binpa.sh](http://binpa.sh/)
</code></pre>

<hr>

<h3><a href="https://pertho.net/posts/bastille-vnet-jails-ec2/" rel="nofollow">Running FreeBSD VNET Jails on AWS EC2 with Bastille</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="http://undeadly.org/cgi?action=article;sid=20220720220958" rel="nofollow">Game of Trees 0.74 released</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20220721122727" rel="nofollow">OpenBSD -current has moved to 7.2-beta</a><br>
<a href="https://itnext.io/unix-command-line-crash-course-453e409d62f5" rel="nofollow">A Unix Command Line Crash Course</a><br>
<a href="https://bsd.dog/project/bsd-dog-vimrc/" rel="nofollow">BSD.DOG vimrc</a><br>
<a href="https://wiki.freebsd.org/Speedruns" rel="nofollow">FreeBSD Speedruns</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>465: Deep Space Debugging</title>
  <link>https://www.bsdnow.tv/465</link>
  <guid isPermaLink="false">f6b15e42-bd5a-47de-9df4-b207d0becb33</guid>
  <pubDate>Thu, 28 Jul 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f6b15e42-bd5a-47de-9df4-b207d0becb33.mp3" length="24400296" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Debugging Lisp in Deep Space, 0 Dependency Websites with OpenBSD &amp; AsciiDoc, Deleting old snapshots on FreeBSD, Full multiprocess support in lldb-server, Basic fix between pf tables and macros, and more</itunes:subtitle>
  <itunes:duration>38:45</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Debugging Lisp in Deep Space, 0 Dependency Websites with OpenBSD &amp;amp; AsciiDoc, Deleting old snapshots on FreeBSD, Full multiprocess support in lldb-server, Basic fix between pf tables and macros, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
NASA Programmer Remembers Debugging Lisp in Deep Space (https://thenewstack.io/nasa-programmer-remembers-debugging-lisp-in-deep-space/)
0 Dependency Websites with OpenBSD &amp;amp; AsciiDoc (https://blog.passwordclass.xyz/blogs/2022/06/0-dependency-websites-with-openbsd-asciidoc.html)
News Roundup
FreeBSD - Deleting old snapshots (https://www.jan0sch.de/post/deleting-old-zfs-snapshots/)
Full multiprocess support in lldb-server (https://www.moritz.systems/blog/full-multiprocess-support-in-lldb-server/)
Basic fix between pf tables and macros on FreeBSD (https://rubenerd.com/basic-fix-between-pf-tables-and-macros-on-freebsd/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Ben - Jail Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/464/feedback/Ben%20-%20Jail%20Question.md)
Malcolm - encryption (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/464/feedback/Malcolm%20-%20encryption.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, debug, debugging, lisp, nasa, deep space, zero dependencies, website, asciidoc, snapshot, multiprocess support, lldb, lldb-server, pf, pf tables, pf macros, firewall </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Debugging Lisp in Deep Space, 0 Dependency Websites with OpenBSD &amp; AsciiDoc, Deleting old snapshots on FreeBSD, Full multiprocess support in lldb-server, Basic fix between pf tables and macros, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://thenewstack.io/nasa-programmer-remembers-debugging-lisp-in-deep-space/" rel="nofollow">NASA Programmer Remembers Debugging Lisp in Deep Space</a></h3>

<hr>

<h3><a href="https://blog.passwordclass.xyz/blogs/2022/06/0-dependency-websites-with-openbsd-asciidoc.html" rel="nofollow">0 Dependency Websites with OpenBSD &amp; AsciiDoc</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.jan0sch.de/post/deleting-old-zfs-snapshots/" rel="nofollow">FreeBSD - Deleting old snapshots</a></h3>

<hr>

<h3><a href="https://www.moritz.systems/blog/full-multiprocess-support-in-lldb-server/" rel="nofollow">Full multiprocess support in lldb-server</a></h3>

<hr>

<h3><a href="https://rubenerd.com/basic-fix-between-pf-tables-and-macros-on-freebsd/" rel="nofollow">Basic fix between pf tables and macros on FreeBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/464/feedback/Ben%20-%20Jail%20Question.md" rel="nofollow">Ben - Jail Question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/464/feedback/Malcolm%20-%20encryption.md" rel="nofollow">Malcolm - encryption</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Debugging Lisp in Deep Space, 0 Dependency Websites with OpenBSD &amp; AsciiDoc, Deleting old snapshots on FreeBSD, Full multiprocess support in lldb-server, Basic fix between pf tables and macros, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://thenewstack.io/nasa-programmer-remembers-debugging-lisp-in-deep-space/" rel="nofollow">NASA Programmer Remembers Debugging Lisp in Deep Space</a></h3>

<hr>

<h3><a href="https://blog.passwordclass.xyz/blogs/2022/06/0-dependency-websites-with-openbsd-asciidoc.html" rel="nofollow">0 Dependency Websites with OpenBSD &amp; AsciiDoc</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.jan0sch.de/post/deleting-old-zfs-snapshots/" rel="nofollow">FreeBSD - Deleting old snapshots</a></h3>

<hr>

<h3><a href="https://www.moritz.systems/blog/full-multiprocess-support-in-lldb-server/" rel="nofollow">Full multiprocess support in lldb-server</a></h3>

<hr>

<h3><a href="https://rubenerd.com/basic-fix-between-pf-tables-and-macros-on-freebsd/" rel="nofollow">Basic fix between pf tables and macros on FreeBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/464/feedback/Ben%20-%20Jail%20Question.md" rel="nofollow">Ben - Jail Question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/464/feedback/Malcolm%20-%20encryption.md" rel="nofollow">Malcolm - encryption</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>464: Compiling with kefir</title>
  <link>https://www.bsdnow.tv/464</link>
  <guid isPermaLink="false">c5e043ce-2ec3-4eef-8d99-0ca38ed1fad5</guid>
  <pubDate>Thu, 21 Jul 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c5e043ce-2ec3-4eef-8d99-0ca38ed1fad5.mp3" length="23780520" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>From 0 to bhyve on FreeBSD, Analyze OpenBSD’s Kernel with Domain-Specific Knowledge, OpenBSD Webzine: ISSUE #10, HardenedBSD June 2022 Status Report, two new C compilers: chibicc and kefir in OpenBSD, SSD TRIM in NetBSD HEAD, and more</itunes:subtitle>
  <itunes:duration>39:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>From 0 to bhyve on FreeBSD, Analyze OpenBSD’s Kernel with Domain-Specific Knowledge, OpenBSD Webzine: ISSUE #10, HardenedBSD June 2022 Status Report, two new C compilers: chibicc and kefir in OpenBSD, SSD TRIM in NetBSD HEAD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
From 0 to Bhyve on FreeBSD 13.1 (https://klarasystems.com/articles/from-0-to-bhyve-on-freebsd-13-1/)
Analyze OpenBSD’s Kernel with Domain-Specific Knowledge (https://medium.com/@chrissicool/analyze-openbsds-kernel-with-domain-specific-knowledge-ca665d92eebb)
News Roundup
OpenBSD Webzine: ISSUE #10 (https://webzine.puffy.cafe/issue-10.html)
HardenedBSD June 2022 Status Report (https://hardenedbsd.org/article/shawn-webb/2022-06-28/hardenedbsd-june-2022-status-report)
OpenBSD has two new C compilers: chibicc and kefir (https://briancallahan.net/blog/20220629.html)
SSD TRIM in NetBSD HEAD (-current) (https://www.unitedbsd.com/d/859-ssd-trim-in-netbsd-head-current)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, bhyve, domain specific knowledge, analysis, analytics, webzine, issue, new edition, status report, chibicc, kefir, compiler, ssd, trim, trim support </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>From 0 to bhyve on FreeBSD, Analyze OpenBSD’s Kernel with Domain-Specific Knowledge, OpenBSD Webzine: ISSUE #10, HardenedBSD June 2022 Status Report, two new C compilers: chibicc and kefir in OpenBSD, SSD TRIM in NetBSD HEAD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/from-0-to-bhyve-on-freebsd-13-1/" rel="nofollow">From 0 to Bhyve on FreeBSD 13.1</a></h3>

<hr>

<h3><a href="https://medium.com/@chrissicool/analyze-openbsds-kernel-with-domain-specific-knowledge-ca665d92eebb" rel="nofollow">Analyze OpenBSD’s Kernel with Domain-Specific Knowledge</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://webzine.puffy.cafe/issue-10.html" rel="nofollow">OpenBSD Webzine: ISSUE #10</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2022-06-28/hardenedbsd-june-2022-status-report" rel="nofollow">HardenedBSD June 2022 Status Report</a></h3>

<hr>

<h3><a href="https://briancallahan.net/blog/20220629.html" rel="nofollow">OpenBSD has two new C compilers: chibicc and kefir</a></h3>

<hr>

<h3><a href="https://www.unitedbsd.com/d/859-ssd-trim-in-netbsd-head-current" rel="nofollow">SSD TRIM in NetBSD HEAD (-current)</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>From 0 to bhyve on FreeBSD, Analyze OpenBSD’s Kernel with Domain-Specific Knowledge, OpenBSD Webzine: ISSUE #10, HardenedBSD June 2022 Status Report, two new C compilers: chibicc and kefir in OpenBSD, SSD TRIM in NetBSD HEAD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/from-0-to-bhyve-on-freebsd-13-1/" rel="nofollow">From 0 to Bhyve on FreeBSD 13.1</a></h3>

<hr>

<h3><a href="https://medium.com/@chrissicool/analyze-openbsds-kernel-with-domain-specific-knowledge-ca665d92eebb" rel="nofollow">Analyze OpenBSD’s Kernel with Domain-Specific Knowledge</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://webzine.puffy.cafe/issue-10.html" rel="nofollow">OpenBSD Webzine: ISSUE #10</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2022-06-28/hardenedbsd-june-2022-status-report" rel="nofollow">HardenedBSD June 2022 Status Report</a></h3>

<hr>

<h3><a href="https://briancallahan.net/blog/20220629.html" rel="nofollow">OpenBSD has two new C compilers: chibicc and kefir</a></h3>

<hr>

<h3><a href="https://www.unitedbsd.com/d/859-ssd-trim-in-netbsd-head-current" rel="nofollow">SSD TRIM in NetBSD HEAD (-current)</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>463: The 1.0 Legend</title>
  <link>https://www.bsdnow.tv/463</link>
  <guid isPermaLink="false">3131f5d6-8a20-474b-94c3-1da8ebac50ce</guid>
  <pubDate>Thu, 14 Jul 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3131f5d6-8a20-474b-94c3-1da8ebac50ce.mp3" length="32116704" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Differences between base and ports LLVM in OpenBSD, Netgraph for FreeBSD’s bhyve Networking, Audio on FreeBSD – Quick Guide, FreeBSD’s Legend starts at 1.0, Hacker News running by FreeBSD, TrueNAS 13, and more</itunes:subtitle>
  <itunes:duration>55:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Differences between base and ports LLVM in OpenBSD, Netgraph for FreeBSD’s bhyve Networking, Audio on FreeBSD – Quick Guide, FreeBSD’s Legend starts at 1.0, Hacker News running by FreeBSD, TrueNAS 13, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Differences between base and ports LLVM in OpenBSD (https://www.cambus.net/differences-between-base-and-ports-llvm-in-openbsd/)
Using Netgraph for FreeBSD’s bhyve Networking (https://klarasystems.com/articles/using-netgraph-for-freebsds-bhyve-networking/?utm_source=bsdweekly)
News Roundup
Audio on FreeBSD – Quick Guide (https://freebsdfoundation.org/freebsd-project/resources/audio-on-freebsd/)
[Legends start at 1.0! – FreeBSD in 1993]
Part 1 (https://eerielinux.wordpress.com/2022/06/18/legends-start-at-1-0-freebsd-in-1993-pt-1/)
Part 2 (https://eerielinux.wordpress.com/2022/06/19/legends-start-at-1-0-freebsd-in-1993-pt-2/)
***
### Hacker News running by FreeBSD. Take that, Linux! (https://news.ycombinator.com/item?id=16076041)
***
### TrueNAS 13 (https://www.theregister.com/2022/05/11/truenas_13_released/)
***
Beastie Bits
Notable OpenBSD news you may have missed, 2022-06-28 edition (http://undeadly.org/cgi?action=article;sid=20220628135253)
rEFInd design for all the BSDs (https://github.com/indgy/refind-bsd-black)
OpenBGPD 7.4 released (https://undeadly.org/cgi?action=article;sid=20220619185920)
Hotfix GhostBSD 22.06.18 ISO is now available (http://ghostbsd.org/22.06.18_iso_is_now_available)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - Jails Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/Brad%20-%20Jails%20Question.md)
Freezr - A few questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/Freezr%20-%20A%20few%20questions.md)
A different Brad - Drive question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/A%20different%20Brad%20-%20Drive%20question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, llvm, base vs. ports, compiler, netgraph, bhyve, audio, guide, legend, 1993, hacker news, truenas 13</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Differences between base and ports LLVM in OpenBSD, Netgraph for FreeBSD’s bhyve Networking, Audio on FreeBSD – Quick Guide, FreeBSD’s Legend starts at 1.0, Hacker News running by FreeBSD, TrueNAS 13, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.cambus.net/differences-between-base-and-ports-llvm-in-openbsd/" rel="nofollow">Differences between base and ports LLVM in OpenBSD</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/using-netgraph-for-freebsds-bhyve-networking/?utm_source=bsdweekly" rel="nofollow">Using Netgraph for FreeBSD’s bhyve Networking</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://freebsdfoundation.org/freebsd-project/resources/audio-on-freebsd/" rel="nofollow">Audio on FreeBSD – Quick Guide</a></h3>

<h3>[Legends start at 1.0! – FreeBSD in 1993]</h3>

<ul>
<li><a href="https://eerielinux.wordpress.com/2022/06/18/legends-start-at-1-0-freebsd-in-1993-pt-1/" rel="nofollow">Part 1</a></li>
<li><a href="https://eerielinux.wordpress.com/2022/06/19/legends-start-at-1-0-freebsd-in-1993-pt-2/" rel="nofollow">Part 2</a>
***
### <a href="https://news.ycombinator.com/item?id=16076041" rel="nofollow">Hacker News running by FreeBSD. Take that, Linux!</a>
***
### <a href="https://www.theregister.com/2022/05/11/truenas_13_released/" rel="nofollow">TrueNAS 13</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article;sid=20220628135253" rel="nofollow">Notable OpenBSD news you may have missed, 2022-06-28 edition</a></li>
<li><a href="https://github.com/indgy/refind-bsd-black" rel="nofollow">rEFInd design for all the BSDs</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20220619185920" rel="nofollow">OpenBGPD 7.4 released</a></li>
<li><a href="http://ghostbsd.org/22.06.18_iso_is_now_available" rel="nofollow">Hotfix GhostBSD 22.06.18 ISO is now available</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/Brad%20-%20Jails%20Question.md" rel="nofollow">Brad - Jails Question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/Freezr%20-%20A%20few%20questions.md" rel="nofollow">Freezr - A few questions</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/A%20different%20Brad%20-%20Drive%20question.md" rel="nofollow">A different Brad - Drive question</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Differences between base and ports LLVM in OpenBSD, Netgraph for FreeBSD’s bhyve Networking, Audio on FreeBSD – Quick Guide, FreeBSD’s Legend starts at 1.0, Hacker News running by FreeBSD, TrueNAS 13, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.cambus.net/differences-between-base-and-ports-llvm-in-openbsd/" rel="nofollow">Differences between base and ports LLVM in OpenBSD</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/using-netgraph-for-freebsds-bhyve-networking/?utm_source=bsdweekly" rel="nofollow">Using Netgraph for FreeBSD’s bhyve Networking</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://freebsdfoundation.org/freebsd-project/resources/audio-on-freebsd/" rel="nofollow">Audio on FreeBSD – Quick Guide</a></h3>

<h3>[Legends start at 1.0! – FreeBSD in 1993]</h3>

<ul>
<li><a href="https://eerielinux.wordpress.com/2022/06/18/legends-start-at-1-0-freebsd-in-1993-pt-1/" rel="nofollow">Part 1</a></li>
<li><a href="https://eerielinux.wordpress.com/2022/06/19/legends-start-at-1-0-freebsd-in-1993-pt-2/" rel="nofollow">Part 2</a>
***
### <a href="https://news.ycombinator.com/item?id=16076041" rel="nofollow">Hacker News running by FreeBSD. Take that, Linux!</a>
***
### <a href="https://www.theregister.com/2022/05/11/truenas_13_released/" rel="nofollow">TrueNAS 13</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article;sid=20220628135253" rel="nofollow">Notable OpenBSD news you may have missed, 2022-06-28 edition</a></li>
<li><a href="https://github.com/indgy/refind-bsd-black" rel="nofollow">rEFInd design for all the BSDs</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20220619185920" rel="nofollow">OpenBGPD 7.4 released</a></li>
<li><a href="http://ghostbsd.org/22.06.18_iso_is_now_available" rel="nofollow">Hotfix GhostBSD 22.06.18 ISO is now available</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/Brad%20-%20Jails%20Question.md" rel="nofollow">Brad - Jails Question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/Freezr%20-%20A%20few%20questions.md" rel="nofollow">Freezr - A few questions</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/A%20different%20Brad%20-%20Drive%20question.md" rel="nofollow">A different Brad - Drive question</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>462: OpenBSD Sales Pitch</title>
  <link>https://www.bsdnow.tv/462</link>
  <guid isPermaLink="false">6db1831f-5ad9-4b9b-a29d-6acb2e5399c6</guid>
  <pubDate>Thu, 07 Jul 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6db1831f-5ad9-4b9b-a29d-6acb2e5399c6.mp3" length="31027704" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Design and Implementation of the NetBSD rc.d system, selling OpenBSD as a salesperson, Speeding up autoconf with caching, Allowing non-root execution of a jailed application, Configure login(1) and sshd(8) for YubiKey on OpenBSD, and more.</itunes:subtitle>
  <itunes:duration>53:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Design and Implementation of the NetBSD rc.d system, selling OpenBSD as a salesperson, Speeding up autoconf with caching, Allowing non-root execution of a jailed application, Configure login(1) and sshd(8) for YubiKey on OpenBSD, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The Design and Implementation of the NetBSD rc.d system (http://www.mewburn.net/luke/papers/rc.d.pdf)
How I would sell OpenBSD as a salesperson (https://dataswamp.org/~solene/2022-06-22-openbsd-selling-arguments.html)
News Roundup
Speeding up autoconf with caching (https://jmmv.dev/2022/06/autoconf-caching.html)
Allowing non-root execution of a jailed application (https://forums.freebsd.org/threads/allowing-non-root-execution-of-a-jailed-application.85532/)
Configure login(1) and sshd(8) for YubiKey on OpenBSD (https://romanzolotarev.com/openbsd/yubikey.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Glen - Thanks Todd (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/Glen%20-%20Thanks%20Todd.md)
Karl - Memory Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/Karl%20-%20Memory%20Question.md)
alejandro - Tom's laptop (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/alejandro%20-%20Tom's%20laptop.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, rc.d,, selling, sales, salesperson, speed, speedup, autoconf, cache, caching, jailed application, yubikey</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Design and Implementation of the NetBSD rc.d system, selling OpenBSD as a salesperson, Speeding up autoconf with caching, Allowing non-root execution of a jailed application, Configure login(1) and sshd(8) for YubiKey on OpenBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="http://www.mewburn.net/luke/papers/rc.d.pdf" rel="nofollow">The Design and Implementation of the NetBSD rc.d system</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-06-22-openbsd-selling-arguments.html" rel="nofollow">How I would sell OpenBSD as a salesperson</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jmmv.dev/2022/06/autoconf-caching.html" rel="nofollow">Speeding up autoconf with caching</a></h3>

<hr>

<h3><a href="https://forums.freebsd.org/threads/allowing-non-root-execution-of-a-jailed-application.85532/" rel="nofollow">Allowing non-root execution of a jailed application</a></h3>

<hr>

<h3><a href="https://romanzolotarev.com/openbsd/yubikey.html" rel="nofollow">Configure login(1) and sshd(8) for YubiKey on OpenBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/Glen%20-%20Thanks%20Todd.md" rel="nofollow">Glen - Thanks Todd</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/Karl%20-%20Memory%20Question.md" rel="nofollow">Karl - Memory Question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/alejandro%20-%20Tom&#x27;s%20laptop.md" rel="nofollow">alejandro - Tom&#39;s laptop</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Design and Implementation of the NetBSD rc.d system, selling OpenBSD as a salesperson, Speeding up autoconf with caching, Allowing non-root execution of a jailed application, Configure login(1) and sshd(8) for YubiKey on OpenBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="http://www.mewburn.net/luke/papers/rc.d.pdf" rel="nofollow">The Design and Implementation of the NetBSD rc.d system</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-06-22-openbsd-selling-arguments.html" rel="nofollow">How I would sell OpenBSD as a salesperson</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jmmv.dev/2022/06/autoconf-caching.html" rel="nofollow">Speeding up autoconf with caching</a></h3>

<hr>

<h3><a href="https://forums.freebsd.org/threads/allowing-non-root-execution-of-a-jailed-application.85532/" rel="nofollow">Allowing non-root execution of a jailed application</a></h3>

<hr>

<h3><a href="https://romanzolotarev.com/openbsd/yubikey.html" rel="nofollow">Configure login(1) and sshd(8) for YubiKey on OpenBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/Glen%20-%20Thanks%20Todd.md" rel="nofollow">Glen - Thanks Todd</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/Karl%20-%20Memory%20Question.md" rel="nofollow">Karl - Memory Question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/alejandro%20-%20Tom&#x27;s%20laptop.md" rel="nofollow">alejandro - Tom&#39;s laptop</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>461: Persistent Memory Allocation</title>
  <link>https://www.bsdnow.tv/461</link>
  <guid isPermaLink="false">8809dc88-c752-4733-9f19-4bcd7e2ca683</guid>
  <pubDate>Thu, 30 Jun 2022 03:45:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8809dc88-c752-4733-9f19-4bcd7e2ca683.mp3" length="28160232" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Q1 FreeBSD Quarterly Status Report 2022, Nginx on OpenBSD 7.1, Persistent Memory Allocation, Colorize your BSD shell, cgit With Gitolite and Nginx on FreeBSD 13, and more</itunes:subtitle>
  <itunes:duration>49:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Q1 FreeBSD Quarterly Status Report 2022, Nginx on OpenBSD 7.1, Persistent Memory Allocation, Colorize your BSD shell, cgit With Gitolite and Nginx on FreeBSD 13, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Quarterly Status Report First Quarter 2022 (https://www.freebsd.org/status/report-2022-01-2022-03/)
Installing Nginx on OpenBSD 7.1 (https://unixcop.com/installing-nginx-on-openbsd-7-1/)
News Roundup
Live Webinar: Open-source Virtualization: Getting started with bhyve  (https://klarasystems.com/webinars/live-sessions-singup/webinar-open-source-virtualization-getting-started-with-bhyve/)
Hosted by Jim Salter and Allan Jude
Live July 12th at 13:00 ET
Available on-demand a few days later
Persistent Memory Allocation (https://queue.acm.org/detail.cfm?id=3534855)
Colorize your BSD shell (https://forums.FreeBSD.org/threads/colorize-your-bsd-shell.85458/)
How to Install cgit With Gitolite and Nginx on FreeBSD 13 (https://herrbischoff.com/2021/10/how-to-install-cgit-with-gitolite-and-nginx-on-freebsd-13)
EuroBSDCon 2022 (Austria) Program announced (https://2022.eurobsdcon.org/program/)
Come to Austria and learn about the latest happenings in the BSDs
2 days of tutorials, and 2 days of 3 concurrent tracks of talks
Registration is open now. See you there!
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - Drive question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Brad%20-%20Drive%20question.md)
Carl - Wiring question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Carl%20-%20Wiring%20question.md)
Jon - Jails question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Jon%20-%20Jails%20question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, status report, quarterly, nginx, persistent memory, memory allocation, colorize, color, cgit, gitolite </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Q1 FreeBSD Quarterly Status Report 2022, Nginx on OpenBSD 7.1, Persistent Memory Allocation, Colorize your BSD shell, cgit With Gitolite and Nginx on FreeBSD 13, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2022-01-2022-03/" rel="nofollow">FreeBSD Quarterly Status Report First Quarter 2022</a></h3>

<hr>

<h3><a href="https://unixcop.com/installing-nginx-on-openbsd-7-1/" rel="nofollow">Installing Nginx on OpenBSD 7.1</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://klarasystems.com/webinars/live-sessions-singup/webinar-open-source-virtualization-getting-started-with-bhyve/" rel="nofollow">Live Webinar: Open-source Virtualization: Getting started with bhyve </a></h3>

<ul>
<li>Hosted by Jim Salter and Allan Jude</li>
<li>Live July 12th at 13:00 ET</li>
<li>Available on-demand a few days later</li>
</ul>

<hr>

<h3><a href="https://queue.acm.org/detail.cfm?id=3534855" rel="nofollow">Persistent Memory Allocation</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/colorize-your-bsd-shell.85458/" rel="nofollow">Colorize your BSD shell</a></h3>

<hr>

<h3><a href="https://herrbischoff.com/2021/10/how-to-install-cgit-with-gitolite-and-nginx-on-freebsd-13" rel="nofollow">How to Install cgit With Gitolite and Nginx on FreeBSD 13</a></h3>

<hr>

<h3><a href="https://2022.eurobsdcon.org/program/" rel="nofollow">EuroBSDCon 2022 (Austria) Program announced</a></h3>

<ul>
<li>Come to Austria and learn about the latest happenings in the BSDs</li>
<li>2 days of tutorials, and 2 days of 3 concurrent tracks of talks</li>
<li>Registration is open now. See you there!
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Brad%20-%20Drive%20question.md" rel="nofollow">Brad - Drive question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Carl%20-%20Wiring%20question.md" rel="nofollow">Carl - Wiring question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Jon%20-%20Jails%20question.md" rel="nofollow">Jon - Jails question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Q1 FreeBSD Quarterly Status Report 2022, Nginx on OpenBSD 7.1, Persistent Memory Allocation, Colorize your BSD shell, cgit With Gitolite and Nginx on FreeBSD 13, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2022-01-2022-03/" rel="nofollow">FreeBSD Quarterly Status Report First Quarter 2022</a></h3>

<hr>

<h3><a href="https://unixcop.com/installing-nginx-on-openbsd-7-1/" rel="nofollow">Installing Nginx on OpenBSD 7.1</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://klarasystems.com/webinars/live-sessions-singup/webinar-open-source-virtualization-getting-started-with-bhyve/" rel="nofollow">Live Webinar: Open-source Virtualization: Getting started with bhyve </a></h3>

<ul>
<li>Hosted by Jim Salter and Allan Jude</li>
<li>Live July 12th at 13:00 ET</li>
<li>Available on-demand a few days later</li>
</ul>

<hr>

<h3><a href="https://queue.acm.org/detail.cfm?id=3534855" rel="nofollow">Persistent Memory Allocation</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/colorize-your-bsd-shell.85458/" rel="nofollow">Colorize your BSD shell</a></h3>

<hr>

<h3><a href="https://herrbischoff.com/2021/10/how-to-install-cgit-with-gitolite-and-nginx-on-freebsd-13" rel="nofollow">How to Install cgit With Gitolite and Nginx on FreeBSD 13</a></h3>

<hr>

<h3><a href="https://2022.eurobsdcon.org/program/" rel="nofollow">EuroBSDCon 2022 (Austria) Program announced</a></h3>

<ul>
<li>Come to Austria and learn about the latest happenings in the BSDs</li>
<li>2 days of tutorials, and 2 days of 3 concurrent tracks of talks</li>
<li>Registration is open now. See you there!
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Brad%20-%20Drive%20question.md" rel="nofollow">Brad - Drive question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Carl%20-%20Wiring%20question.md" rel="nofollow">Carl - Wiring question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Jon%20-%20Jails%20question.md" rel="nofollow">Jon - Jails question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>460: OpenBSD airport folklore</title>
  <link>https://www.bsdnow.tv/460</link>
  <guid isPermaLink="false">9c05a38c-a1d1-467b-aac4-a360bedcb20f</guid>
  <pubDate>Thu, 23 Jun 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9c05a38c-a1d1-467b-aac4-a360bedcb20f.mp3" length="23500632" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Containerd gains support for launching Linux containers on FreeBSD, OpenBSD 7.1 on PINE64 RockPro64, true minimalistic window manager does not exist, OpenBSD folklore, HardenedBSD May 2022 Status Report, DragonFlyBSD 6.2.2 out, and more</itunes:subtitle>
  <itunes:duration>37:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Containerd gains support for launching Linux containers on FreeBSD, OpenBSD 7.1 on PINE64 RockPro64, true minimalistic window manager does not exist, OpenBSD folklore, HardenedBSD May 2022 Status Report, DragonFlyBSD 6.2.2 out, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Containerd gains support for launching Linux containers on FreeBSD (https://github.com/containerd/containerd/pull/7000)
Uses Linux compat and the Linux Jails concept to deploy a full Linux container userland on FreeBSD
OpenBSD 7.1 on PINE64 RockPro64 (https://bsandro.tech/posts/openbsd-7.1-on-pine64-rockpro64/)
News Roundup
Live Webinar: Open-source Virtualization: Getting started with bhyve  (https://klarasystems.com/webinars/live-sessions-singup/webinar-open-source-virtualization-getting-started-with-bhyve/)
Hosted by Jim Salter and Allan Jude
Live July 12th at 13:00 ET
Available on-demand a few days later
The True Minimalistic Window Manager Does Not Exist (https://serhanekici.com/ttmwm.html)
OpenBSD folklore and share/misc/airport (https://www.cambus.net/openbsd-folklore-and-share-misc-airport/)
HardenedBSD May 2022 Status Report (https://hardenedbsd.org/article/shawn-webb/2022-06-01/hardenedbsd-may-2022-status-report)
DragonFlyBSD 6.2.2 out (https://www.dragonflydigest.com/2022/06/10/27047.html)
Changelog (https://lists.dragonflybsd.org/pipermail/commits/2022-June/820953.html)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Norbert - question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/460/feedback/Norbert%20-%20question.md)
Paulo - network question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/460/feedback/Paulo%20-%20network%20question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, containerd, linux containers, linuxulator, implementation, pine64, rockpro64, window manager, minimalistic, folklore, airport, airport codes, iata, status report</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Containerd gains support for launching Linux containers on FreeBSD, OpenBSD 7.1 on PINE64 RockPro64, true minimalistic window manager does not exist, OpenBSD folklore, HardenedBSD May 2022 Status Report, DragonFlyBSD 6.2.2 out, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://github.com/containerd/containerd/pull/7000" rel="nofollow">Containerd gains support for launching Linux containers on FreeBSD</a></h3>

<ul>
<li>Uses Linux compat and the Linux Jails concept to deploy a full Linux container userland on FreeBSD</li>
</ul>

<hr>

<h3><a href="https://bsandro.tech/posts/openbsd-7.1-on-pine64-rockpro64/" rel="nofollow">OpenBSD 7.1 on PINE64 RockPro64</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://klarasystems.com/webinars/live-sessions-singup/webinar-open-source-virtualization-getting-started-with-bhyve/" rel="nofollow">Live Webinar: Open-source Virtualization: Getting started with bhyve </a></h3>

<ul>
<li>Hosted by Jim Salter and Allan Jude</li>
<li>Live July 12th at 13:00 ET</li>
<li>Available on-demand a few days later</li>
</ul>

<hr>

<h3><a href="https://serhanekici.com/ttmwm.html" rel="nofollow">The True Minimalistic Window Manager Does Not Exist</a></h3>

<hr>

<h3><a href="https://www.cambus.net/openbsd-folklore-and-share-misc-airport/" rel="nofollow">OpenBSD folklore and share/misc/airport</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2022-06-01/hardenedbsd-may-2022-status-report" rel="nofollow">HardenedBSD May 2022 Status Report</a></h3>

<hr>

<h3><a href="https://www.dragonflydigest.com/2022/06/10/27047.html" rel="nofollow">DragonFlyBSD 6.2.2 out</a></h3>

<ul>
<li><a href="https://lists.dragonflybsd.org/pipermail/commits/2022-June/820953.html" rel="nofollow">Changelog</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/460/feedback/Norbert%20-%20question.md" rel="nofollow">Norbert - question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/460/feedback/Paulo%20-%20network%20question.md" rel="nofollow">Paulo - network question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Containerd gains support for launching Linux containers on FreeBSD, OpenBSD 7.1 on PINE64 RockPro64, true minimalistic window manager does not exist, OpenBSD folklore, HardenedBSD May 2022 Status Report, DragonFlyBSD 6.2.2 out, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://github.com/containerd/containerd/pull/7000" rel="nofollow">Containerd gains support for launching Linux containers on FreeBSD</a></h3>

<ul>
<li>Uses Linux compat and the Linux Jails concept to deploy a full Linux container userland on FreeBSD</li>
</ul>

<hr>

<h3><a href="https://bsandro.tech/posts/openbsd-7.1-on-pine64-rockpro64/" rel="nofollow">OpenBSD 7.1 on PINE64 RockPro64</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://klarasystems.com/webinars/live-sessions-singup/webinar-open-source-virtualization-getting-started-with-bhyve/" rel="nofollow">Live Webinar: Open-source Virtualization: Getting started with bhyve </a></h3>

<ul>
<li>Hosted by Jim Salter and Allan Jude</li>
<li>Live July 12th at 13:00 ET</li>
<li>Available on-demand a few days later</li>
</ul>

<hr>

<h3><a href="https://serhanekici.com/ttmwm.html" rel="nofollow">The True Minimalistic Window Manager Does Not Exist</a></h3>

<hr>

<h3><a href="https://www.cambus.net/openbsd-folklore-and-share-misc-airport/" rel="nofollow">OpenBSD folklore and share/misc/airport</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2022-06-01/hardenedbsd-may-2022-status-report" rel="nofollow">HardenedBSD May 2022 Status Report</a></h3>

<hr>

<h3><a href="https://www.dragonflydigest.com/2022/06/10/27047.html" rel="nofollow">DragonFlyBSD 6.2.2 out</a></h3>

<ul>
<li><a href="https://lists.dragonflybsd.org/pipermail/commits/2022-June/820953.html" rel="nofollow">Changelog</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/460/feedback/Norbert%20-%20question.md" rel="nofollow">Norbert - question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/460/feedback/Paulo%20-%20network%20question.md" rel="nofollow">Paulo - network question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>459: NetBSD Kernel benchmark</title>
  <link>https://www.bsdnow.tv/459</link>
  <guid isPermaLink="false">111c15bd-3906-4d2b-aaec-9d29bc06672a</guid>
  <pubDate>Thu, 16 Jun 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/111c15bd-3906-4d2b-aaec-9d29bc06672a.mp3" length="32577552" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Evaluating FreeBSD CURRENT for Production Use, Time Machine-like Backups on OpenBSD, FreeBSD on the Graviton 3, Compiling the NetBSD kernel as a benchmark, Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022, Hardware Detection &amp; Diagnostics for New FreeBSD Users, and more</itunes:subtitle>
  <itunes:duration>54:05</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Evaluating FreeBSD CURRENT for Production Use, Time Machine-like Backups on OpenBSD, FreeBSD on the Graviton 3, Compiling the NetBSD kernel as a benchmark, Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022, Hardware Detection &amp;amp; Diagnostics for New FreeBSD Users, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Evaluating FreeBSD CURRENT for Production Use (https://klarasystems.com/articles/evaluating-freebsd-current-for-production-use/)
Time Machine like Backups on OpenBSD (https://xosc.org/timemachine.html)
News Roundup
FreeBSD on the Graviton 3 (https://www.daemonology.net/blog/2022-05-23-FreeBSD-Graviton-3.html)
Compiling the NetBSD kernel as a benchmark (https://blog.anotherhomepage.org/post/2022/05/25/Compiling-the-NetBSD-kernel-as-a-benchmark/)
Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022 (http://undeadly.org/cgi?action=article;sid=20220607112236)
Hardware Detection &amp;amp; Diagnostics for New FreeBSD Users &amp;amp; PCs (https://forums.FreeBSD.org/threads/hardware-detection-diagnostics-for-new-freebsd-users-pcs.84596/)
Beastie Bits
• [NetBSD - Announcing Google Summer of Code 2022 projects](https://blog.netbsd.org/tnf/entry/announcing_google_summer_of_code3)
• [Welcome FreeBSD Google Summer of Code Participants](https://freebsdfoundation.org/blog/welcome-freebsd-google-summer-of-code-participants/)
• [Network from Scratch](https://www.networksfromscratch.com)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, production use, time machine, backups, backup, graviton 3, compiling, compiler benchmark, kernel compile, benchmark, network management, pf, packet filter, hardware detection, diagnostics</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Evaluating FreeBSD CURRENT for Production Use, Time Machine-like Backups on OpenBSD, FreeBSD on the Graviton 3, Compiling the NetBSD kernel as a benchmark, Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022, Hardware Detection &amp; Diagnostics for New FreeBSD Users, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/evaluating-freebsd-current-for-production-use/" rel="nofollow">Evaluating FreeBSD CURRENT for Production Use</a></h3>

<hr>

<h3><a href="https://xosc.org/timemachine.html" rel="nofollow">Time Machine like Backups on OpenBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.daemonology.net/blog/2022-05-23-FreeBSD-Graviton-3.html" rel="nofollow">FreeBSD on the Graviton 3</a></h3>

<hr>

<h3><a href="https://blog.anotherhomepage.org/post/2022/05/25/Compiling-the-NetBSD-kernel-as-a-benchmark/" rel="nofollow">Compiling the NetBSD kernel as a benchmark</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20220607112236" rel="nofollow">Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/hardware-detection-diagnostics-for-new-freebsd-users-pcs.84596/" rel="nofollow">Hardware Detection &amp; Diagnostics for New FreeBSD Users &amp; PCs</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [NetBSD - Announcing Google Summer of Code 2022 projects](https://blog.netbsd.org/tnf/entry/announcing_google_summer_of_code3)
• [Welcome FreeBSD Google Summer of Code Participants](https://freebsdfoundation.org/blog/welcome-freebsd-google-summer-of-code-participants/)
• [Network from Scratch](https://www.networksfromscratch.com)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Evaluating FreeBSD CURRENT for Production Use, Time Machine-like Backups on OpenBSD, FreeBSD on the Graviton 3, Compiling the NetBSD kernel as a benchmark, Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022, Hardware Detection &amp; Diagnostics for New FreeBSD Users, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/evaluating-freebsd-current-for-production-use/" rel="nofollow">Evaluating FreeBSD CURRENT for Production Use</a></h3>

<hr>

<h3><a href="https://xosc.org/timemachine.html" rel="nofollow">Time Machine like Backups on OpenBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.daemonology.net/blog/2022-05-23-FreeBSD-Graviton-3.html" rel="nofollow">FreeBSD on the Graviton 3</a></h3>

<hr>

<h3><a href="https://blog.anotherhomepage.org/post/2022/05/25/Compiling-the-NetBSD-kernel-as-a-benchmark/" rel="nofollow">Compiling the NetBSD kernel as a benchmark</a></h3>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20220607112236" rel="nofollow">Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/hardware-detection-diagnostics-for-new-freebsd-users-pcs.84596/" rel="nofollow">Hardware Detection &amp; Diagnostics for New FreeBSD Users &amp; PCs</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [NetBSD - Announcing Google Summer of Code 2022 projects](https://blog.netbsd.org/tnf/entry/announcing_google_summer_of_code3)
• [Welcome FreeBSD Google Summer of Code Participants](https://freebsdfoundation.org/blog/welcome-freebsd-google-summer-of-code-participants/)
• [Network from Scratch](https://www.networksfromscratch.com)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>458: Traceroute interpretation</title>
  <link>https://www.bsdnow.tv/458</link>
  <guid isPermaLink="false">a8dc34c4-e5aa-4409-bc38-28b891bf97a4</guid>
  <pubDate>Thu, 09 Jun 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a8dc34c4-e5aa-4409-bc38-28b891bf97a4.mp3" length="28773216" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Fundamentals of the FreeBSD Shell, Spammers in the Public Cloud, locking user accounts properly, overgrowth on NetBSD, moreutils, ctwm &amp; spleen, interpreting a traceroute, and more</itunes:subtitle>
  <itunes:duration>48:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Fundamentals of the FreeBSD Shell, Spammers in the Public Cloud, locking user accounts properly, overgrowth on NetBSD, moreutils, ctwm &amp;amp; spleen, interpreting a traceroute, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Fundamentals of the FreeBSD Shell (https://klarasystems.com/articles/interacting-with-freebsd-learning-the-fundamentals-of-the-freebsd-shell-2/)
Spammers in the Public Cloud, Protected by SPF; Intensified Password Groping Still Ongoing; Spamware Hawked to Spamtraps (https://bsdly.blogspot.com/2022/04/spammers-in-public-cloud-protected-by.html)
News Roundup
A cautionary tale about locking Linux &amp;amp; FreeBSD user accounts (https://www.cyberciti.biz/networking/a-cautionary-tale-about-locking-linux-freebsd-user-accounts/)
Overgrowth runs on NetBSD (https://www.reddit.com/r/openbsd_gaming/comments/ucgavg/i_was_able_to_build_overgrowth_on_netbsd/)
moreutils (https://joeyh.name/code/moreutils/)
NetBSD, CTWM, and Spleen (https://www.cambus.net/netbsd-ctwm-and-spleen/)
How to properly interpret a traceroute or mtr (https://phil.lavin.me.uk/2022/03/how-to-properly-interpret-a-traceroute-or-mtr/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Lets talk a bit about some of the events happening this year, BSDCan in virtual this weekend, emfcamp is this weekend too and in person, MCH is this summer and eurobsdcon is in september. How were the postgres conferences benedict?
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, fundamentals, public cloud, cloud, spf, protection, password groping, spamware, spamtraps, cautionary tale, locking, account, user account, account locking, overgrowth, moreutils, ctwm, spleen, traceroute, mtr</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Fundamentals of the FreeBSD Shell, Spammers in the Public Cloud, locking user accounts properly, overgrowth on NetBSD, moreutils, ctwm &amp; spleen, interpreting a traceroute, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/interacting-with-freebsd-learning-the-fundamentals-of-the-freebsd-shell-2/" rel="nofollow">Fundamentals of the FreeBSD Shell</a></h3>

<hr>

<h3><a href="https://bsdly.blogspot.com/2022/04/spammers-in-public-cloud-protected-by.html" rel="nofollow">Spammers in the Public Cloud, Protected by SPF; Intensified Password Groping Still Ongoing; Spamware Hawked to Spamtraps</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.cyberciti.biz/networking/a-cautionary-tale-about-locking-linux-freebsd-user-accounts/" rel="nofollow">A cautionary tale about locking Linux &amp; FreeBSD user accounts</a></h3>

<hr>

<h3><a href="https://www.reddit.com/r/openbsd_gaming/comments/ucgavg/i_was_able_to_build_overgrowth_on_netbsd/" rel="nofollow">Overgrowth runs on NetBSD</a></h3>

<hr>

<h3><a href="https://joeyh.name/code/moreutils/" rel="nofollow">moreutils</a></h3>

<hr>

<h3><a href="https://www.cambus.net/netbsd-ctwm-and-spleen/" rel="nofollow">NetBSD, CTWM, and Spleen</a></h3>

<hr>

<p><a href="https://phil.lavin.me.uk/2022/03/how-to-properly-interpret-a-traceroute-or-mtr/" rel="nofollow">How to properly interpret a traceroute or mtr</a></p>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p>Lets talk a bit about some of the events happening this year, BSDCan in virtual this weekend, emfcamp is this weekend too and in person, MCH is this summer and eurobsdcon is in september. How were the postgres conferences benedict?</p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Fundamentals of the FreeBSD Shell, Spammers in the Public Cloud, locking user accounts properly, overgrowth on NetBSD, moreutils, ctwm &amp; spleen, interpreting a traceroute, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/interacting-with-freebsd-learning-the-fundamentals-of-the-freebsd-shell-2/" rel="nofollow">Fundamentals of the FreeBSD Shell</a></h3>

<hr>

<h3><a href="https://bsdly.blogspot.com/2022/04/spammers-in-public-cloud-protected-by.html" rel="nofollow">Spammers in the Public Cloud, Protected by SPF; Intensified Password Groping Still Ongoing; Spamware Hawked to Spamtraps</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.cyberciti.biz/networking/a-cautionary-tale-about-locking-linux-freebsd-user-accounts/" rel="nofollow">A cautionary tale about locking Linux &amp; FreeBSD user accounts</a></h3>

<hr>

<h3><a href="https://www.reddit.com/r/openbsd_gaming/comments/ucgavg/i_was_able_to_build_overgrowth_on_netbsd/" rel="nofollow">Overgrowth runs on NetBSD</a></h3>

<hr>

<h3><a href="https://joeyh.name/code/moreutils/" rel="nofollow">moreutils</a></h3>

<hr>

<h3><a href="https://www.cambus.net/netbsd-ctwm-and-spleen/" rel="nofollow">NetBSD, CTWM, and Spleen</a></h3>

<hr>

<p><a href="https://phil.lavin.me.uk/2022/03/how-to-properly-interpret-a-traceroute-or-mtr/" rel="nofollow">How to properly interpret a traceroute or mtr</a></p>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p>Lets talk a bit about some of the events happening this year, BSDCan in virtual this weekend, emfcamp is this weekend too and in person, MCH is this summer and eurobsdcon is in september. How were the postgres conferences benedict?</p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>457: The NetBSD Wheelbarrow</title>
  <link>https://www.bsdnow.tv/457</link>
  <guid isPermaLink="false">4cb3f0eb-514d-4a26-9173-15d6eab282c0</guid>
  <pubDate>Thu, 02 Jun 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4cb3f0eb-514d-4a26-9173-15d6eab282c0.mp3" length="27225288" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Journey to ZFS RAIDZ1 on NetBSD, FreeBSD networking basics: WiFi and Bluetooth, smuggling code into the playstation via NetBSD driver hole, KDE FreeBSD CI, remembering buildtool, and more</itunes:subtitle>
  <itunes:duration>47:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Journey to ZFS RAIDZ1 on NetBSD, FreeBSD networking basics: WiFi and Bluetooth, smuggling code into the playstation via NetBSD driver hole, KDE FreeBSD CI, remembering buildtool, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The journey to ZFS raidz1 with different sized disks (On NetBSD) (Wheelbarrow optional) (http://netbsd0.blogspot.com/2022/05/the-journey-to-zfs-raidz1-with.html)
FreeBSD Networking Basics: WiFi and Bluetooth (https://freebsdfoundation.org/freebsd-project/resources/networking-basics-wifi-and-bluetooth/)
News Roundup
Playstation: Hole in NetBSD driver could allow code smuggling (https://www.kiratas.com/playstation-hole-in-netbsd-driver-could-allow-code-smuggling-2/)
Archive link if the page is down (no images) (https://web.archive.org/web/20220519162432/https://www.kiratas.com/playstation-hole-in-netbsd-driver-could-allow-code-smuggling-2/)
Original Announcment (https://hackerone.com/reports/1350653)
German Article (https://www.heise.de/news/Playstation-Luecke-in-NetBSD-Treiber-koennte-Codeschmuggel-ermoeglichen-7091153.html)
KDE-FreeBSD CI (https://euroquis.nl//kde/2022/04/26/freebsd-ci.html)
Remembering Buildtool (https://jmmv.dev/2022/05/remembering-buildtool.html)
Beastie Bits
By the Way... Kubernetes for FreeBSD (https://medium.com/@norlin.t/by-the-way-kubernetes-for-freebsd-d0ba4dab8d8e)
FreeBSD Games Directory (https://github.com/tigersharke/FreeBSD-Games-Directory)
Candlelit Console patch set to the framebuffer console (http://undeadly.org/cgi?action=article;sid=20220516093712)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Dan - A couple things (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Dan%20-%20A%20couple%20things.md)
Paul - BSD Business Justifications (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Paul%20-%20BSD%20Business%20Justifications.md)
Todd - Feedback to prior feedback (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Todd%20-%20Feedback%20to%20prior%20feedback.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, raidz1, network basics, networking, wifi, bluetooth, playstation, kde, driver, continuous integration, buildtool </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Journey to ZFS RAIDZ1 on NetBSD, FreeBSD networking basics: WiFi and Bluetooth, smuggling code into the playstation via NetBSD driver hole, KDE FreeBSD CI, remembering buildtool, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="http://netbsd0.blogspot.com/2022/05/the-journey-to-zfs-raidz1-with.html" rel="nofollow">The journey to ZFS raidz1 with different sized disks (On NetBSD) (Wheelbarrow optional)</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/freebsd-project/resources/networking-basics-wifi-and-bluetooth/" rel="nofollow">FreeBSD Networking Basics: WiFi and Bluetooth</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.kiratas.com/playstation-hole-in-netbsd-driver-could-allow-code-smuggling-2/" rel="nofollow">Playstation: Hole in NetBSD driver could allow code smuggling</a></h3>

<ul>
<li><a href="https://web.archive.org/web/20220519162432/https://www.kiratas.com/playstation-hole-in-netbsd-driver-could-allow-code-smuggling-2/" rel="nofollow">Archive link if the page is down (no images)</a></li>
<li><a href="https://hackerone.com/reports/1350653" rel="nofollow">Original Announcment</a></li>
<li><a href="https://www.heise.de/news/Playstation-Luecke-in-NetBSD-Treiber-koennte-Codeschmuggel-ermoeglichen-7091153.html" rel="nofollow">German Article</a></li>
</ul>

<hr>

<h3><a href="https://euroquis.nl//kde/2022/04/26/freebsd-ci.html" rel="nofollow">KDE-FreeBSD CI</a></h3>

<hr>

<h3><a href="https://jmmv.dev/2022/05/remembering-buildtool.html" rel="nofollow">Remembering Buildtool</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://medium.com/@norlin.t/by-the-way-kubernetes-for-freebsd-d0ba4dab8d8e" rel="nofollow">By the Way... Kubernetes for FreeBSD</a><br>
<a href="https://github.com/tigersharke/FreeBSD-Games-Directory" rel="nofollow">FreeBSD Games Directory</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20220516093712" rel="nofollow">Candlelit Console patch set to the framebuffer console</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Dan%20-%20A%20couple%20things.md" rel="nofollow">Dan - A couple things</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Paul%20-%20BSD%20Business%20Justifications.md" rel="nofollow">Paul - BSD Business Justifications</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Todd%20-%20Feedback%20to%20prior%20feedback.md" rel="nofollow">Todd - Feedback to prior feedback</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Journey to ZFS RAIDZ1 on NetBSD, FreeBSD networking basics: WiFi and Bluetooth, smuggling code into the playstation via NetBSD driver hole, KDE FreeBSD CI, remembering buildtool, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="http://netbsd0.blogspot.com/2022/05/the-journey-to-zfs-raidz1-with.html" rel="nofollow">The journey to ZFS raidz1 with different sized disks (On NetBSD) (Wheelbarrow optional)</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/freebsd-project/resources/networking-basics-wifi-and-bluetooth/" rel="nofollow">FreeBSD Networking Basics: WiFi and Bluetooth</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.kiratas.com/playstation-hole-in-netbsd-driver-could-allow-code-smuggling-2/" rel="nofollow">Playstation: Hole in NetBSD driver could allow code smuggling</a></h3>

<ul>
<li><a href="https://web.archive.org/web/20220519162432/https://www.kiratas.com/playstation-hole-in-netbsd-driver-could-allow-code-smuggling-2/" rel="nofollow">Archive link if the page is down (no images)</a></li>
<li><a href="https://hackerone.com/reports/1350653" rel="nofollow">Original Announcment</a></li>
<li><a href="https://www.heise.de/news/Playstation-Luecke-in-NetBSD-Treiber-koennte-Codeschmuggel-ermoeglichen-7091153.html" rel="nofollow">German Article</a></li>
</ul>

<hr>

<h3><a href="https://euroquis.nl//kde/2022/04/26/freebsd-ci.html" rel="nofollow">KDE-FreeBSD CI</a></h3>

<hr>

<h3><a href="https://jmmv.dev/2022/05/remembering-buildtool.html" rel="nofollow">Remembering Buildtool</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://medium.com/@norlin.t/by-the-way-kubernetes-for-freebsd-d0ba4dab8d8e" rel="nofollow">By the Way... Kubernetes for FreeBSD</a><br>
<a href="https://github.com/tigersharke/FreeBSD-Games-Directory" rel="nofollow">FreeBSD Games Directory</a><br>
<a href="http://undeadly.org/cgi?action=article;sid=20220516093712" rel="nofollow">Candlelit Console patch set to the framebuffer console</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Dan%20-%20A%20couple%20things.md" rel="nofollow">Dan - A couple things</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Paul%20-%20BSD%20Business%20Justifications.md" rel="nofollow">Paul - BSD Business Justifications</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Todd%20-%20Feedback%20to%20prior%20feedback.md" rel="nofollow">Todd - Feedback to prior feedback</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>456: FreeBSD 13.1</title>
  <link>https://www.bsdnow.tv/456</link>
  <guid isPermaLink="false">634c66ea-7d91-4d0d-bb47-5d55f50b7029</guid>
  <pubDate>Thu, 26 May 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/634c66ea-7d91-4d0d-bb47-5d55f50b7029.mp3" length="29382912" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 13.1 is released, Unix command line conventions over time, Branching for NetBSD 10, Microbhyve, Own your Calendar and Contacts with OpenBSD, the PSARC case for ZFS, and more</itunes:subtitle>
  <itunes:duration>51:19</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 13.1 is released, Unix command line conventions over time, Branching for NetBSD 10, Microbhyve, Own your Calendar and Contacts with OpenBSD, the PSARC case for ZFS, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD 13.1 Release is available (https://www.freebsd.org/releases/13.1R/announce/)
Unix command line conventions over time (https://blog.liw.fi/posts/2022/05/07/unix-cli/)
News Roundup
Branching for NetBSD 10 (https://mail-index.netbsd.org/current-users/2022/05/02/msg042278.html)
Microbyhve (https://github.com/cbsd/microbhyve)
Own Your Calendar &amp;amp; Contacts With OpenBSD, Baïkal, and FOSS Android (https://baak6.com/baikal-openbsd-fossdroid/)
Twenty years ago today, Jeff filed the PSARC case for the ZFS filesystem (https://twitter.com/mmusante/status/1518947283626246145?t=tzR6KeMx2mhjJfeoOqrHIw&amp;amp;s=03)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Scott - FreeBSD and supercomputing (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/456/feedback/Scott%20-%20FreeBSD%20and%20supercomputing.md)
Nick - Thanks and some shout outs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/456/feedback/Nick%20-%20Thanks%20and%20some%20shout%20outs.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, 13.1, command line, convention, branching, branch, bhyve, microbhyve, calendar, contacts, sync, baikal, foss, android, psarc case, case filing </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 13.1 is released, Unix command line conventions over time, Branching for NetBSD 10, Microbhyve, Own your Calendar and Contacts with OpenBSD, the PSARC case for ZFS, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/13.1R/announce/" rel="nofollow">FreeBSD 13.1 Release is available</a></h3>

<h3><a href="https://blog.liw.fi/posts/2022/05/07/unix-cli/" rel="nofollow">Unix command line conventions over time</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/current-users/2022/05/02/msg042278.html" rel="nofollow">Branching for NetBSD 10</a></h3>

<hr>

<h3><a href="https://github.com/cbsd/microbhyve" rel="nofollow">Microbyhve</a></h3>

<hr>

<h3><a href="https://baak6.com/baikal-openbsd-fossdroid/" rel="nofollow">Own Your Calendar &amp; Contacts With OpenBSD, Baïkal, and FOSS Android</a></h3>

<hr>

<h3><a href="https://twitter.com/mmusante/status/1518947283626246145?t=tzR6KeMx2mhjJfeoOqrHIw&s=03" rel="nofollow">Twenty years ago today, Jeff filed the PSARC case for the ZFS filesystem</a></h3>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/456/feedback/Scott%20-%20FreeBSD%20and%20supercomputing.md" rel="nofollow">Scott - FreeBSD and supercomputing</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/456/feedback/Nick%20-%20Thanks%20and%20some%20shout%20outs.md" rel="nofollow">Nick - Thanks and some shout outs</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 13.1 is released, Unix command line conventions over time, Branching for NetBSD 10, Microbhyve, Own your Calendar and Contacts with OpenBSD, the PSARC case for ZFS, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/13.1R/announce/" rel="nofollow">FreeBSD 13.1 Release is available</a></h3>

<h3><a href="https://blog.liw.fi/posts/2022/05/07/unix-cli/" rel="nofollow">Unix command line conventions over time</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/current-users/2022/05/02/msg042278.html" rel="nofollow">Branching for NetBSD 10</a></h3>

<hr>

<h3><a href="https://github.com/cbsd/microbhyve" rel="nofollow">Microbyhve</a></h3>

<hr>

<h3><a href="https://baak6.com/baikal-openbsd-fossdroid/" rel="nofollow">Own Your Calendar &amp; Contacts With OpenBSD, Baïkal, and FOSS Android</a></h3>

<hr>

<h3><a href="https://twitter.com/mmusante/status/1518947283626246145?t=tzR6KeMx2mhjJfeoOqrHIw&s=03" rel="nofollow">Twenty years ago today, Jeff filed the PSARC case for the ZFS filesystem</a></h3>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/456/feedback/Scott%20-%20FreeBSD%20and%20supercomputing.md" rel="nofollow">Scott - FreeBSD and supercomputing</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/456/feedback/Nick%20-%20Thanks%20and%20some%20shout%20outs.md" rel="nofollow">Nick - Thanks and some shout outs</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>455: Ken Thompson Singularity</title>
  <link>https://www.bsdnow.tv/455</link>
  <guid isPermaLink="false">9b545f6d-5e83-47f1-93c0-9be7f81b9cee</guid>
  <pubDate>Thu, 19 May 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9b545f6d-5e83-47f1-93c0-9be7f81b9cee.mp3" length="27344184" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD is the Perfect OS post Nuclear Apocalypse, Multiprocess support for LLDB, porting the new Hare compiler to OpenBSD, Writing my first OpenBSD game using Godot, FreeBSD 13 on Thinkpad T460s, and more.</itunes:subtitle>
  <itunes:duration>45:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD is the Perfect OS post Nuclear Apocalypse, Multiprocess support for LLDB, porting the new Hare compiler to OpenBSD, Writing my first OpenBSD game using Godot, FreeBSD 13 on Thinkpad T460s, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenBSD is the Perfect OS post Nuclear Apocalypse (https://confuzeus.com/shorts/openbsd-nuclear-apocalypse/)
Multiprocess support for LLDB (https://www.moritz.systems/blog/multiprocess-support-for-lldb/)
News Roundup
I ported the new Hare compiler to OpenBSD (https://briancallahan.net/blog/20220427.html)
Writing my first OpenBSD game using Godot (https://dataswamp.org/~solene/2022-04-28-writing-a-game-with-godot.html)
FreeBSD 13 on Thinkpad T460s (https://www.tumfatig.net/2022/freebsd-13-on-thinkpad-t460s/)
Beastie Bits
Open Source Voices interview with Deb Goodkin (https://www.opensourcevoices.org/29)
Tachyum Successfully Runs FreeBSD in Prodigy Ecosystem, Expands Open-Source OS Support (https://www.hpcwire.com/off-the-wire/tachyum-successfully-runs-freebsd-in-prodigy-ecosystem-expands-open-source-os-support/)
MidnightBSD Minor Update 2.1.7 (https://midnightbsd.org/security/index.html#a20220404)
LibreSSL 3.5.2 Released (https://bsdsec.net/articles/libressl-3-5-2-released)
OpenBGPD 7.3 is out (https://undeadly.org/cgi?action=article;sid=20220414091532)
Playing the game Bottomless on OpenBSD (https://videos.pair2jeux.tube/w/jheVDTPmBTQzkmSpNSvk8J)
Windows Central: OpenBSD already has a version for Apple Silicon (https://windows11central.com/en/openbsd-already-has-a-version-for-apple-silicon/)
OpenBSD Webzine #9 is out (https://webzine.puffy.cafe/issue-9.html)
In the "Everone makes mistakes catagory" : I forgot to enable compression on ZFS (https://dan.langille.org/2022/04/28/i-forgot-to-enable-compression-on-zfs/)
"Ken Thompson is a singularity" ~Brian Kernighan (https://www.youtube.com/watch?v=fL2QwyxcJ5s)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Ben - Securing FreeBSD (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Ben%20-%20Securing%20FreeBSD.md)
Dave - BSD certifications (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Dave%20-%20BSD%20certifications.md)
Sam - maintaining a port (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Sam%20-%20maintaining%20a%20port.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, nuclear apocalypse, multiprocess support, lldb, debugger, hare compiler, game development, game, gaming, godot, thinkpad t460s</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD is the Perfect OS post Nuclear Apocalypse, Multiprocess support for LLDB, porting the new Hare compiler to OpenBSD, Writing my first OpenBSD game using Godot, FreeBSD 13 on Thinkpad T460s, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://confuzeus.com/shorts/openbsd-nuclear-apocalypse/" rel="nofollow">OpenBSD is the Perfect OS post Nuclear Apocalypse</a></h3>

<hr>

<h3><a href="https://www.moritz.systems/blog/multiprocess-support-for-lldb/" rel="nofollow">Multiprocess support for LLDB</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://briancallahan.net/blog/20220427.html" rel="nofollow">I ported the new Hare compiler to OpenBSD</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-04-28-writing-a-game-with-godot.html" rel="nofollow">Writing my first OpenBSD game using Godot</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2022/freebsd-13-on-thinkpad-t460s/" rel="nofollow">FreeBSD 13 on Thinkpad T460s</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://www.opensourcevoices.org/29" rel="nofollow">Open Source Voices interview with Deb Goodkin</a><br>
<a href="https://www.hpcwire.com/off-the-wire/tachyum-successfully-runs-freebsd-in-prodigy-ecosystem-expands-open-source-os-support/" rel="nofollow">Tachyum Successfully Runs FreeBSD in Prodigy Ecosystem, Expands Open-Source OS Support</a><br>
<a href="https://midnightbsd.org/security/index.html#a20220404" rel="nofollow">MidnightBSD Minor Update 2.1.7</a><br>
<a href="https://bsdsec.net/articles/libressl-3-5-2-released" rel="nofollow">LibreSSL 3.5.2 Released</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20220414091532" rel="nofollow">OpenBGPD 7.3 is out</a><br>
<a href="https://videos.pair2jeux.tube/w/jheVDTPmBTQzkmSpNSvk8J" rel="nofollow">Playing the game Bottomless on OpenBSD</a><br>
<a href="https://windows11central.com/en/openbsd-already-has-a-version-for-apple-silicon/" rel="nofollow">Windows Central: OpenBSD already has a version for Apple Silicon</a><br>
<a href="https://webzine.puffy.cafe/issue-9.html" rel="nofollow">OpenBSD Webzine #9 is out</a><br>
<a href="https://dan.langille.org/2022/04/28/i-forgot-to-enable-compression-on-zfs/" rel="nofollow">In the &quot;Everone makes mistakes catagory&quot; : I forgot to enable compression on ZFS</a><br>
<a href="https://www.youtube.com/watch?v=fL2QwyxcJ5s" rel="nofollow">&quot;Ken Thompson is a singularity&quot; ~Brian Kernighan</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Ben%20-%20Securing%20FreeBSD.md" rel="nofollow">Ben - Securing FreeBSD</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Dave%20-%20BSD%20certifications.md" rel="nofollow">Dave - BSD certifications</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Sam%20-%20maintaining%20a%20port.md" rel="nofollow">Sam - maintaining a port</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD is the Perfect OS post Nuclear Apocalypse, Multiprocess support for LLDB, porting the new Hare compiler to OpenBSD, Writing my first OpenBSD game using Godot, FreeBSD 13 on Thinkpad T460s, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://confuzeus.com/shorts/openbsd-nuclear-apocalypse/" rel="nofollow">OpenBSD is the Perfect OS post Nuclear Apocalypse</a></h3>

<hr>

<h3><a href="https://www.moritz.systems/blog/multiprocess-support-for-lldb/" rel="nofollow">Multiprocess support for LLDB</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://briancallahan.net/blog/20220427.html" rel="nofollow">I ported the new Hare compiler to OpenBSD</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-04-28-writing-a-game-with-godot.html" rel="nofollow">Writing my first OpenBSD game using Godot</a></h3>

<hr>

<h3><a href="https://www.tumfatig.net/2022/freebsd-13-on-thinkpad-t460s/" rel="nofollow">FreeBSD 13 on Thinkpad T460s</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://www.opensourcevoices.org/29" rel="nofollow">Open Source Voices interview with Deb Goodkin</a><br>
<a href="https://www.hpcwire.com/off-the-wire/tachyum-successfully-runs-freebsd-in-prodigy-ecosystem-expands-open-source-os-support/" rel="nofollow">Tachyum Successfully Runs FreeBSD in Prodigy Ecosystem, Expands Open-Source OS Support</a><br>
<a href="https://midnightbsd.org/security/index.html#a20220404" rel="nofollow">MidnightBSD Minor Update 2.1.7</a><br>
<a href="https://bsdsec.net/articles/libressl-3-5-2-released" rel="nofollow">LibreSSL 3.5.2 Released</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20220414091532" rel="nofollow">OpenBGPD 7.3 is out</a><br>
<a href="https://videos.pair2jeux.tube/w/jheVDTPmBTQzkmSpNSvk8J" rel="nofollow">Playing the game Bottomless on OpenBSD</a><br>
<a href="https://windows11central.com/en/openbsd-already-has-a-version-for-apple-silicon/" rel="nofollow">Windows Central: OpenBSD already has a version for Apple Silicon</a><br>
<a href="https://webzine.puffy.cafe/issue-9.html" rel="nofollow">OpenBSD Webzine #9 is out</a><br>
<a href="https://dan.langille.org/2022/04/28/i-forgot-to-enable-compression-on-zfs/" rel="nofollow">In the &quot;Everone makes mistakes catagory&quot; : I forgot to enable compression on ZFS</a><br>
<a href="https://www.youtube.com/watch?v=fL2QwyxcJ5s" rel="nofollow">&quot;Ken Thompson is a singularity&quot; ~Brian Kernighan</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Ben%20-%20Securing%20FreeBSD.md" rel="nofollow">Ben - Securing FreeBSD</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Dave%20-%20BSD%20certifications.md" rel="nofollow">Dave - BSD certifications</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Sam%20-%20maintaining%20a%20port.md" rel="nofollow">Sam - maintaining a port</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>454: Compiling 50% faster</title>
  <link>https://www.bsdnow.tv/454</link>
  <guid isPermaLink="false">4bfd5be2-a833-45ee-b097-a68a8af6b122</guid>
  <pubDate>Thu, 12 May 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4bfd5be2-a833-45ee-b097-a68a8af6b122.mp3" length="28305048" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 7.1 is out, Building Your Own FreeBSD-based NAS with ZFS Part 2, Let's try V on OpenBSD, Waiting for Randot, Compiling an OpenBSD kernel 50% faster, A Salute for 10+ years of service, and more</itunes:subtitle>
  <itunes:duration>48:50</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 7.1 is out, Building Your Own FreeBSD-based NAS with ZFS Part 2, Let's try V on OpenBSD, Waiting for Randot, Compiling an OpenBSD kernel 50% faster, A Salute for 10+ years of service, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
OpenBSD 7.1 is out (https://www.openbsd.org/71.html)
Building Your Own FreeBSD-based NAS with ZFS Part 2 (https://klarasystems.com/articles/part-2-tuning-your-freebsd-configuration-for-your-nas/)
News Roundup
Let's try V on OpenBSD (https://briancallahan.net/blog/20220426.html)
Waiting for Randot (or: nia and maya were right and I was wrong) (http://mail-index.netbsd.org/tech-security/2021/01/11/msg001100.html)
Compiling an openbsd kernel 50% faster (https://flak.tedunangst.com/post/compiling-an-openbsd-kernel-50-faster)
A Salute for 10+ years of service (http://aboutbsd.net/?page_id=26661)  https://archive.ph/JL5hf (if the site is down)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Glenn - Toms Home Lab (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/Glenn%20-%20Toms%20Home%20Lab.md)
Iamchunky_pie - unix tool writing (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/I_am_chunky_pie%20-%20unix%20tool%20writing.md)
Mike - Making Routers (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/Mike%20-%20Making%20Routers.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, openbsd 7.1, nas building, nas, network attached storage, V openbsd, randot, kernel compiling, faster compile, quick compile, years of service</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 7.1 is out, Building Your Own FreeBSD-based NAS with ZFS Part 2, Let&#39;s try V on OpenBSD, Waiting for Randot, Compiling an OpenBSD kernel 50% faster, A Salute for 10+ years of service, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/71.html" rel="nofollow">OpenBSD 7.1 is out</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/part-2-tuning-your-freebsd-configuration-for-your-nas/" rel="nofollow">Building Your Own FreeBSD-based NAS with ZFS Part 2</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://briancallahan.net/blog/20220426.html" rel="nofollow">Let&#39;s try V on OpenBSD</a></h3>

<hr>

<h3><a href="http://mail-index.netbsd.org/tech-security/2021/01/11/msg001100.html" rel="nofollow">Waiting for Randot (or: nia and maya were right and I was wrong)</a></h3>

<hr>

<h3><a href="https://flak.tedunangst.com/post/compiling-an-openbsd-kernel-50-faster" rel="nofollow">Compiling an openbsd kernel 50% faster</a></h3>

<hr>

<h3><a href="http://aboutbsd.net/?page_id=26661" rel="nofollow">A Salute for 10+ years of service</a>  <a href="https://archive.ph/JL5hf" rel="nofollow">https://archive.ph/JL5hf</a> (if the site is down)</h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/Glenn%20-%20Toms%20Home%20Lab.md" rel="nofollow">Glenn - Toms Home Lab</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/I_am_chunky_pie%20-%20unix%20tool%20writing.md" rel="nofollow">I_am_chunky_pie - unix tool writing</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/Mike%20-%20Making%20Routers.md" rel="nofollow">Mike - Making Routers</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 7.1 is out, Building Your Own FreeBSD-based NAS with ZFS Part 2, Let&#39;s try V on OpenBSD, Waiting for Randot, Compiling an OpenBSD kernel 50% faster, A Salute for 10+ years of service, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/71.html" rel="nofollow">OpenBSD 7.1 is out</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/part-2-tuning-your-freebsd-configuration-for-your-nas/" rel="nofollow">Building Your Own FreeBSD-based NAS with ZFS Part 2</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://briancallahan.net/blog/20220426.html" rel="nofollow">Let&#39;s try V on OpenBSD</a></h3>

<hr>

<h3><a href="http://mail-index.netbsd.org/tech-security/2021/01/11/msg001100.html" rel="nofollow">Waiting for Randot (or: nia and maya were right and I was wrong)</a></h3>

<hr>

<h3><a href="https://flak.tedunangst.com/post/compiling-an-openbsd-kernel-50-faster" rel="nofollow">Compiling an openbsd kernel 50% faster</a></h3>

<hr>

<h3><a href="http://aboutbsd.net/?page_id=26661" rel="nofollow">A Salute for 10+ years of service</a>  <a href="https://archive.ph/JL5hf" rel="nofollow">https://archive.ph/JL5hf</a> (if the site is down)</h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/Glenn%20-%20Toms%20Home%20Lab.md" rel="nofollow">Glenn - Toms Home Lab</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/I_am_chunky_pie%20-%20unix%20tool%20writing.md" rel="nofollow">I_am_chunky_pie - unix tool writing</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/Mike%20-%20Making%20Routers.md" rel="nofollow">Mike - Making Routers</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>453: TwinCat/BSD Hypervisor</title>
  <link>https://www.bsdnow.tv/453</link>
  <guid isPermaLink="false">ddb0b2b0-a944-41a5-96c2-63fc5c3b43f1</guid>
  <pubDate>Thu, 05 May 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ddb0b2b0-a944-41a5-96c2-63fc5c3b43f1.mp3" length="26501664" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Building Your Own FreeBSD-based NAS, Writing a device driver for Unix V6, EC2: What Colin Percival’s been up to, Beckhoff releases TwinCAT/BSD Hypervisor, Writing a NetBSD kernel module, and more.</itunes:subtitle>
  <itunes:duration>45:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Building Your Own FreeBSD-based NAS, Writing a device driver for Unix V6, EC2: What Colin Percival’s been up to, Beckhoff releases TwinCAT/BSD Hypervisor, Writing a NetBSD kernel module, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Building Your Own FreeBSD-based NAS (https://klarasystems.com/articles/building-your-own-freebsd-based-nas-with-zfs/)
Writing a device driver for Unix V6 (https://mveg.es/posts/writing-a-device-driver-for-unix-v6/)
News Roundup
FreeBSD/EC2: What I've been up to (https://www.daemonology.net/blog/2022-03-29-FreeBSD-EC2-report.html)
Beckhoff has released its TwinCAT/BSD Hypervisor (https://www.automationworld.com/control/article/22144694/beckhoff-hypervisor-enables-virtual-machines-for-control-applications)
Writing a NetBSD kernel module (https://saurvs.github.io/post/writing-netbsd-kern-mod/)
Benedicts Git Finds
Projects
Run anything (like full blown GTK apps) under Capsicum (https://github.com/unrelentingtech/capsicumizer)
Twitter client for UEFI (https://github.com/arata-nvm/mitnal)
n³ The unorthodox terminal file manager (https://github.com/jarun/nnn)
OpenVi: Portable OpenBSD vi for UNIX systems (https://github.com/johnsonjh/OpenVi)
Gists and Articles
Step-by-step instructions on installing the latest NVIDIA drivers on FreeBSD 13.0 and above (https://gist.github.com/Mostly-BSD/4d3cacc0ee2f045ed8505005fd664c6e)
FreeBSD SSH Hardening (https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11)
GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems (https://gtfobins.github.io)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Ben - Backing Up (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Ben%20-%20Backing%20Up.md)
Ethan - Thanks (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Ethan%20-%20Thanks.md)
Maxi - question about note taking (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Maxi%20%20-%20question%20about%20note%20taking.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, NAS, network attached storage, driver development, write device driver, driver, ec2, aws, amazon, beckhoff, twincat, bsd hypervisor, kernel module</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Building Your Own FreeBSD-based NAS, Writing a device driver for Unix V6, EC2: What Colin Percival’s been up to, Beckhoff releases TwinCAT/BSD Hypervisor, Writing a NetBSD kernel module, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/building-your-own-freebsd-based-nas-with-zfs/" rel="nofollow">Building Your Own FreeBSD-based NAS</a></h3>

<hr>

<h3><a href="https://mveg.es/posts/writing-a-device-driver-for-unix-v6/" rel="nofollow">Writing a device driver for Unix V6</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.daemonology.net/blog/2022-03-29-FreeBSD-EC2-report.html" rel="nofollow">FreeBSD/EC2: What I&#39;ve been up to</a></h3>

<hr>

<h3><a href="https://www.automationworld.com/control/article/22144694/beckhoff-hypervisor-enables-virtual-machines-for-control-applications" rel="nofollow">Beckhoff has released its TwinCAT/BSD Hypervisor</a></h3>

<hr>

<h3><a href="https://saurvs.github.io/post/writing-netbsd-kern-mod/" rel="nofollow">Writing a NetBSD kernel module</a></h3>

<hr>

<h2>Benedicts Git Finds</h2>

<ul>
<li>Projects

<ul>
<li><a href="https://github.com/unrelentingtech/capsicumizer" rel="nofollow">Run anything (like full blown GTK apps) under Capsicum</a></li>
<li><a href="https://github.com/arata-nvm/mitnal" rel="nofollow">Twitter client for UEFI</a></li>
<li><a href="https://github.com/jarun/nnn" rel="nofollow">n³ The unorthodox terminal file manager</a></li>
<li><a href="https://github.com/johnsonjh/OpenVi" rel="nofollow">OpenVi: Portable OpenBSD vi for UNIX systems</a></li>
</ul></li>
<li>Gists and Articles

<ul>
<li><a href="https://gist.github.com/Mostly-BSD/4d3cacc0ee2f045ed8505005fd664c6e" rel="nofollow">Step-by-step instructions on installing the latest NVIDIA drivers on FreeBSD 13.0 and above</a></li>
<li><a href="https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11" rel="nofollow">FreeBSD SSH Hardening</a></li>
<li><a href="https://gtfobins.github.io" rel="nofollow">GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems</a></li>
</ul></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Ben%20-%20Backing%20Up.md" rel="nofollow">Ben - Backing Up</a></p>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Ethan%20-%20Thanks.md" rel="nofollow">Ethan - Thanks</a></p>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Maxi%20%20-%20question%20about%20note%20taking.md" rel="nofollow">Maxi - question about note taking</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Building Your Own FreeBSD-based NAS, Writing a device driver for Unix V6, EC2: What Colin Percival’s been up to, Beckhoff releases TwinCAT/BSD Hypervisor, Writing a NetBSD kernel module, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/building-your-own-freebsd-based-nas-with-zfs/" rel="nofollow">Building Your Own FreeBSD-based NAS</a></h3>

<hr>

<h3><a href="https://mveg.es/posts/writing-a-device-driver-for-unix-v6/" rel="nofollow">Writing a device driver for Unix V6</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.daemonology.net/blog/2022-03-29-FreeBSD-EC2-report.html" rel="nofollow">FreeBSD/EC2: What I&#39;ve been up to</a></h3>

<hr>

<h3><a href="https://www.automationworld.com/control/article/22144694/beckhoff-hypervisor-enables-virtual-machines-for-control-applications" rel="nofollow">Beckhoff has released its TwinCAT/BSD Hypervisor</a></h3>

<hr>

<h3><a href="https://saurvs.github.io/post/writing-netbsd-kern-mod/" rel="nofollow">Writing a NetBSD kernel module</a></h3>

<hr>

<h2>Benedicts Git Finds</h2>

<ul>
<li>Projects

<ul>
<li><a href="https://github.com/unrelentingtech/capsicumizer" rel="nofollow">Run anything (like full blown GTK apps) under Capsicum</a></li>
<li><a href="https://github.com/arata-nvm/mitnal" rel="nofollow">Twitter client for UEFI</a></li>
<li><a href="https://github.com/jarun/nnn" rel="nofollow">n³ The unorthodox terminal file manager</a></li>
<li><a href="https://github.com/johnsonjh/OpenVi" rel="nofollow">OpenVi: Portable OpenBSD vi for UNIX systems</a></li>
</ul></li>
<li>Gists and Articles

<ul>
<li><a href="https://gist.github.com/Mostly-BSD/4d3cacc0ee2f045ed8505005fd664c6e" rel="nofollow">Step-by-step instructions on installing the latest NVIDIA drivers on FreeBSD 13.0 and above</a></li>
<li><a href="https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11" rel="nofollow">FreeBSD SSH Hardening</a></li>
<li><a href="https://gtfobins.github.io" rel="nofollow">GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems</a></li>
</ul></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Ben%20-%20Backing%20Up.md" rel="nofollow">Ben - Backing Up</a></p>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Ethan%20-%20Thanks.md" rel="nofollow">Ethan - Thanks</a></p>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Maxi%20%20-%20question%20about%20note%20taking.md" rel="nofollow">Maxi - question about note taking</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>452: The unknown hackers</title>
  <link>https://www.bsdnow.tv/452</link>
  <guid isPermaLink="false">115f6a28-dc39-4136-bed4-7f3dc1e13aa7</guid>
  <pubDate>Thu, 28 Apr 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/115f6a28-dc39-4136-bed4-7f3dc1e13aa7.mp3" length="27640824" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The unknown hackers, Papers we love to read, Dual Boot Homelab in The Bedroom by the bed testbed, OpenSSH 9.0 released, OS battle: OpenBSD vs. NixOS, and more </itunes:subtitle>
  <itunes:duration>46:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The unknown hackers, Papers we love to read, Dual Boot Homelab in The Bedroom by the bed testbed, OpenSSH 9.0 released, OS battle: OpenBSD vs. NixOS, and more 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The unknown hackers (https://www.salon.com/2000/05/17/386bsd/)
Bill Jolitz passed away in March 2022 (https://minnie.tuhs.org/pipermail/tuhs/2022-April/025643.html)
***
FreeBSD Documentation: Papers We Love To Read (https://klarasystems.com/articles/freebsd-documentation-papers-we-love-to-read/)
News Roundup
FreeBSD/Ubuntu Dual Boot Homelab in The Bedroom by the bed testbed (https://adventurist.me/posts/00307)
OpenSSH 9.0 has been released (https://www.openssh.com/txt/release-9.0)
Operating systems battle: OpenBSD vs NixOS (https://dataswamp.org/~solene/2022-04-18-openbsd-vs-nixos.html)
Beastie Bits
Celebrating 50 years of the Unix Operating System (https://www.reddit.com/r/BSD/comments/u4t25c/celebrating_50_years_of_the_unix_operating_system/)
Kickstarter Campaign Results (https://mwl.io/archives/13627)
FreeBSD Virtualization Series (https://productionwithscissors.run/freebsd-virtualization-series/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Jeff - ZFS checksum repair (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Jeff%20-%20ZFS%20checksum%20repair.md)
Nelson - General Thanks (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Nelson%20-%20General%20Thanks.md)
Sam - FOSS Power Support (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Sam%20-%20FOSS%20Power%20Support.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, hackers, papers, dual boot, homelab, bedroom, testbed, openssh, nixos</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The unknown hackers, Papers we love to read, Dual Boot Homelab in The Bedroom by the bed testbed, OpenSSH 9.0 released, OS battle: OpenBSD vs. NixOS, and more </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.salon.com/2000/05/17/386bsd/" rel="nofollow">The unknown hackers</a></h3>

<ul>
<li><a href="https://minnie.tuhs.org/pipermail/tuhs/2022-April/025643.html" rel="nofollow">Bill Jolitz passed away in March 2022</a>
***</li>
</ul>

<h3><a href="https://klarasystems.com/articles/freebsd-documentation-papers-we-love-to-read/" rel="nofollow">FreeBSD Documentation: Papers We Love To Read</a></h3>

<hr>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://adventurist.me/posts/00307" rel="nofollow">FreeBSD/Ubuntu Dual Boot Homelab in The Bedroom by the bed testbed</a></h3>

<hr>

<h3><a href="https://www.openssh.com/txt/release-9.0" rel="nofollow">OpenSSH 9.0 has been released</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-04-18-openbsd-vs-nixos.html" rel="nofollow">Operating systems battle: OpenBSD vs NixOS</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://www.reddit.com/r/BSD/comments/u4t25c/celebrating_50_years_of_the_unix_operating_system/" rel="nofollow">Celebrating 50 years of the Unix Operating System</a><br>
<a href="https://mwl.io/archives/13627" rel="nofollow">Kickstarter Campaign Results</a><br>
<a href="https://productionwithscissors.run/freebsd-virtualization-series/" rel="nofollow">FreeBSD Virtualization Series</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Jeff%20-%20ZFS%20checksum%20repair.md" rel="nofollow">Jeff - ZFS checksum repair</a></p>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Nelson%20-%20General%20Thanks.md" rel="nofollow">Nelson - General Thanks</a></p>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Sam%20-%20FOSS%20Power%20Support.md" rel="nofollow">Sam - FOSS Power Support</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The unknown hackers, Papers we love to read, Dual Boot Homelab in The Bedroom by the bed testbed, OpenSSH 9.0 released, OS battle: OpenBSD vs. NixOS, and more </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.salon.com/2000/05/17/386bsd/" rel="nofollow">The unknown hackers</a></h3>

<ul>
<li><a href="https://minnie.tuhs.org/pipermail/tuhs/2022-April/025643.html" rel="nofollow">Bill Jolitz passed away in March 2022</a>
***</li>
</ul>

<h3><a href="https://klarasystems.com/articles/freebsd-documentation-papers-we-love-to-read/" rel="nofollow">FreeBSD Documentation: Papers We Love To Read</a></h3>

<hr>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://adventurist.me/posts/00307" rel="nofollow">FreeBSD/Ubuntu Dual Boot Homelab in The Bedroom by the bed testbed</a></h3>

<hr>

<h3><a href="https://www.openssh.com/txt/release-9.0" rel="nofollow">OpenSSH 9.0 has been released</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-04-18-openbsd-vs-nixos.html" rel="nofollow">Operating systems battle: OpenBSD vs NixOS</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://www.reddit.com/r/BSD/comments/u4t25c/celebrating_50_years_of_the_unix_operating_system/" rel="nofollow">Celebrating 50 years of the Unix Operating System</a><br>
<a href="https://mwl.io/archives/13627" rel="nofollow">Kickstarter Campaign Results</a><br>
<a href="https://productionwithscissors.run/freebsd-virtualization-series/" rel="nofollow">FreeBSD Virtualization Series</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Jeff%20-%20ZFS%20checksum%20repair.md" rel="nofollow">Jeff - ZFS checksum repair</a></p>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Nelson%20-%20General%20Thanks.md" rel="nofollow">Nelson - General Thanks</a></p>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Sam%20-%20FOSS%20Power%20Support.md" rel="nofollow">Sam - FOSS Power Support</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>451: Tuning ZFS recordsize</title>
  <link>https://www.bsdnow.tv/451</link>
  <guid isPermaLink="false">e05f4b5e-9285-42ae-87ba-151ec71f80b7</guid>
  <pubDate>Thu, 21 Apr 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e05f4b5e-9285-42ae-87ba-151ec71f80b7.mp3" length="35683176" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Full system backups with FFS snapshots, ZFS and dump(8), tuning recordsize in OpenZFS, Optimizing FreeBSD Power Consumption on Modern Intel Laptops, remember to check for ZFS filesystems being mounted, Use tcpdump to save wireless bridge, and more</itunes:subtitle>
  <itunes:duration>1:00:45</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Full system backups with FFS snapshots, ZFS and dump(8), tuning recordsize in OpenZFS, Optimizing FreeBSD Power Consumption on Modern Intel Laptops, remember to check for ZFS filesystems being mounted, Use tcpdump to save wireless bridge, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Full system backups with FFS snapshots, ZFS and dump(8) (https://www.unitedbsd.com/d/705-full-system-backups-with-ffs-snapshots-zfs-and-dump8)
Tuning Recordsize in OpenZFS (https://klarasystems.com/articles/tuning-recordsize-in-openzfs/)
News Roundup
Optimizing FreeBSD Power Consumption on Modern Intel Laptops (https://www.neelc.org/posts/optimize-freebsd-for-intel-tigerlake/)
I need to remember to check for ZFS filesystems being mounted (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSCheckForMounted)
Use tcpdump to save wireless bridge (https://adventurist.me/posts/0027)
Beastie Bits
• [FreeBSD on the Vortex86DX CPU](https://www.cambus.net/freebsd-on-the-vortex86dx-cpu/)
• [HAMMER2 vs USB stick pulls](https://www.dragonflydigest.com/2022/03/22/26800.html)
• [New US mirror for DragonFly](https://www.dragonflydigest.com/2022/03/09/26742.html)
• [HelloSystem 13.1 RC1](https://github.com/helloSystem/ISO/releases/tag/experimental-13.1-RC1)
• [Video introduction to OpenBSD 7.0](https://www.youtube.com/watch?v=KeUsE-3nSes)
• [Losses in the community](https://minnie.tuhs.org/pipermail/tuhs/2022-April/025643.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Sam - BSD Laptops (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Sam%20-%20BSD%20Laptops.md)
Reese - Electric Groff (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Reese%20-%20Electric%20Groff.md)
Alexandra - New to BSD (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Alexandra%20-%20New%20to%20BSD.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, backups, dump, tuning, recordsize, optimizing, power consumption, intel, laptop, mount, mounting, mounted, tcpdump, wireless bridge</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Full system backups with FFS snapshots, ZFS and dump(8), tuning recordsize in OpenZFS, Optimizing FreeBSD Power Consumption on Modern Intel Laptops, remember to check for ZFS filesystems being mounted, Use tcpdump to save wireless bridge, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.unitedbsd.com/d/705-full-system-backups-with-ffs-snapshots-zfs-and-dump8" rel="nofollow">Full system backups with FFS snapshots, ZFS and dump(8)</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/tuning-recordsize-in-openzfs/" rel="nofollow">Tuning Recordsize in OpenZFS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.neelc.org/posts/optimize-freebsd-for-intel-tigerlake/" rel="nofollow">Optimizing FreeBSD Power Consumption on Modern Intel Laptops</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSCheckForMounted" rel="nofollow">I need to remember to check for ZFS filesystems being mounted</a></h3>

<hr>

<h3><a href="https://adventurist.me/posts/0027" rel="nofollow">Use tcpdump to save wireless bridge</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [FreeBSD on the Vortex86DX CPU](https://www.cambus.net/freebsd-on-the-vortex86dx-cpu/)
• [HAMMER2 vs USB stick pulls](https://www.dragonflydigest.com/2022/03/22/26800.html)
• [New US mirror for DragonFly](https://www.dragonflydigest.com/2022/03/09/26742.html)
• [HelloSystem 13.1 RC1](https://github.com/helloSystem/ISO/releases/tag/experimental-13.1-RC1)
• [Video introduction to OpenBSD 7.0](https://www.youtube.com/watch?v=KeUsE-3nSes)
• [Losses in the community](https://minnie.tuhs.org/pipermail/tuhs/2022-April/025643.html)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Sam%20-%20BSD%20Laptops.md" rel="nofollow">Sam - BSD Laptops</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Reese%20-%20Electric%20Groff.md" rel="nofollow">Reese - Electric Groff</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Alexandra%20-%20New%20to%20BSD.md" rel="nofollow">Alexandra - New to BSD</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Full system backups with FFS snapshots, ZFS and dump(8), tuning recordsize in OpenZFS, Optimizing FreeBSD Power Consumption on Modern Intel Laptops, remember to check for ZFS filesystems being mounted, Use tcpdump to save wireless bridge, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.unitedbsd.com/d/705-full-system-backups-with-ffs-snapshots-zfs-and-dump8" rel="nofollow">Full system backups with FFS snapshots, ZFS and dump(8)</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/tuning-recordsize-in-openzfs/" rel="nofollow">Tuning Recordsize in OpenZFS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.neelc.org/posts/optimize-freebsd-for-intel-tigerlake/" rel="nofollow">Optimizing FreeBSD Power Consumption on Modern Intel Laptops</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSCheckForMounted" rel="nofollow">I need to remember to check for ZFS filesystems being mounted</a></h3>

<hr>

<h3><a href="https://adventurist.me/posts/0027" rel="nofollow">Use tcpdump to save wireless bridge</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [FreeBSD on the Vortex86DX CPU](https://www.cambus.net/freebsd-on-the-vortex86dx-cpu/)
• [HAMMER2 vs USB stick pulls](https://www.dragonflydigest.com/2022/03/22/26800.html)
• [New US mirror for DragonFly](https://www.dragonflydigest.com/2022/03/09/26742.html)
• [HelloSystem 13.1 RC1](https://github.com/helloSystem/ISO/releases/tag/experimental-13.1-RC1)
• [Video introduction to OpenBSD 7.0](https://www.youtube.com/watch?v=KeUsE-3nSes)
• [Losses in the community](https://minnie.tuhs.org/pipermail/tuhs/2022-April/025643.html)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Sam%20-%20BSD%20Laptops.md" rel="nofollow">Sam - BSD Laptops</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Reese%20-%20Electric%20Groff.md" rel="nofollow">Reese - Electric Groff</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Alexandra%20-%20New%20to%20BSD.md" rel="nofollow">Alexandra - New to BSD</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>450: Unix Tool Writing</title>
  <link>https://www.bsdnow.tv/450</link>
  <guid isPermaLink="false">d267be2a-c2ba-4bbc-a520-cfa5153a7683</guid>
  <pubDate>Thu, 14 Apr 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d267be2a-c2ba-4bbc-a520-cfa5153a7683.mp3" length="34318152" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The ideas that made Unix, hints for writing Unix tools, cron best practices, three different sorts of filesystem errors, LibreSSL 3.5.1 released, taskwarrior to manage tasks, and more.</itunes:subtitle>
  <itunes:duration>58:53</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The ideas that made Unix, hints for writing Unix tools, cron best practices, three different sorts of filesystem errors, LibreSSL 3.5.1 released, taskwarrior to manage tasks, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Unix Philosophy: A Quick Look at the Ideas that Made Unix (https://klarasystems.com/articles/unix-philosophy-a-quick-look-at-the-ideas-that-made-unix/)
Hints for writing Unix Tools (https://monkey.org/~marius/unix-tools-hints.html)
News Roundup
Cron best practices (https://blog.sanctum.geek.nz/cron-best-practices/)
Filesystems can experience at least three different sorts of errors (https://utcc.utoronto.ca/~cks/space/blog/tech/FilesystemsThreeErrorTypes)
LibreSSL 3.5.1 development branch as well as 3.4.3 (stable) and 3.3.6 released (https://undeadly.org/cgi?action=article;sid=20220318065203)
Taskwarrior to manage tasks (https://adventurist.me/posts/0165)
Beastie Bits
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Andrew - virtualization (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/450/feedback/Andrew%20-%20virtualization.md)
Brad - jails applications and interoperability (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/450/feedback/brad%20-%20jails%20applications%20and%20interoperability.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, sandboxing, sandbox technique, development process, statement, customizing, ports, packages, nginx, relay, tcp, udp, status report, signal</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The ideas that made Unix, hints for writing Unix tools, cron best practices, three different sorts of filesystem errors, LibreSSL 3.5.1 released, taskwarrior to manage tasks, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/unix-philosophy-a-quick-look-at-the-ideas-that-made-unix/" rel="nofollow">Unix Philosophy: A Quick Look at the Ideas that Made Unix</a></h3>

<hr>

<h3><a href="https://monkey.org/%7Emarius/unix-tools-hints.html" rel="nofollow">Hints for writing Unix Tools</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.sanctum.geek.nz/cron-best-practices/" rel="nofollow">Cron best practices</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/FilesystemsThreeErrorTypes" rel="nofollow">Filesystems can experience at least three different sorts of errors</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20220318065203" rel="nofollow">LibreSSL 3.5.1 development branch as well as 3.4.3 (stable) and 3.3.6 released</a></h3>

<hr>

<h3><a href="https://adventurist.me/posts/0165" rel="nofollow">Taskwarrior to manage tasks</a></h3>

<hr>

<h2>Beastie Bits</h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/450/feedback/Andrew%20-%20virtualization.md" rel="nofollow">Andrew - virtualization</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/450/feedback/brad%20-%20jails%20applications%20and%20interoperability.md" rel="nofollow">Brad - jails applications and interoperability</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The ideas that made Unix, hints for writing Unix tools, cron best practices, three different sorts of filesystem errors, LibreSSL 3.5.1 released, taskwarrior to manage tasks, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/unix-philosophy-a-quick-look-at-the-ideas-that-made-unix/" rel="nofollow">Unix Philosophy: A Quick Look at the Ideas that Made Unix</a></h3>

<hr>

<h3><a href="https://monkey.org/%7Emarius/unix-tools-hints.html" rel="nofollow">Hints for writing Unix Tools</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.sanctum.geek.nz/cron-best-practices/" rel="nofollow">Cron best practices</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/tech/FilesystemsThreeErrorTypes" rel="nofollow">Filesystems can experience at least three different sorts of errors</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20220318065203" rel="nofollow">LibreSSL 3.5.1 development branch as well as 3.4.3 (stable) and 3.3.6 released</a></h3>

<hr>

<h3><a href="https://adventurist.me/posts/0165" rel="nofollow">Taskwarrior to manage tasks</a></h3>

<hr>

<h2>Beastie Bits</h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/450/feedback/Andrew%20-%20virtualization.md" rel="nofollow">Andrew - virtualization</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/450/feedback/brad%20-%20jails%20applications%20and%20interoperability.md" rel="nofollow">Brad - jails applications and interoperability</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>449: Reproducible clean $HOME</title>
  <link>https://www.bsdnow.tv/449</link>
  <guid isPermaLink="false">8b30bba3-3ef0-454a-ad6d-1984c90575a5</guid>
  <pubDate>Thu, 07 Apr 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8b30bba3-3ef0-454a-ad6d-1984c90575a5.mp3" length="29224896" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Status Report 4th Quarter 2021, Reproducible clean $HOME in OpenBSD using impermanence, Making RockPro64 a NetBSD Server, helloSystem 0.7.0 is out,  lazy approach to FreeBSD dual-booting, going to jail, and more.</itunes:subtitle>
  <itunes:duration>50:17</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Status Report 4th Quarter 2021, Reproducible clean $HOME in OpenBSD using impermanence, Making RockPro64 a NetBSD Server, helloSystem 0.7.0 is out,  lazy approach to FreeBSD dual-booting, going to jail, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Quarterly Status Report 4th Quarter 2021 (https://www.freebsd.org/status/report-2021-10-2021-12/)
Reproducible clean $HOME in OpenBSD using impermanence (https://dataswamp.org/~solene/2022-03-15-openbsd-impermanence.html)
News Roundup
Making RockPro64 a NetBSD Server (https://blog.netbsd.org/tnf/entry/making_rockpro64_a_netbsd_server)
helloSystem 0.7.0 is out (https://github.com/helloSystem/ISO/releases/tag/r0.7.0)
My lazy approach to FreeBSD dual-booting (https://rubenerd.com/my-lazy-approach-to-freebsd-dual-booting/)
Going to jail (https://opekkt.tech/docs/vps_migration/going2jail/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
• No Feedback emails this week, so instead we can have “Story Time with Allan” and he can regale us with an entertaining BSD story.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, q4 status report, reproducible, clean home, impermanence, rockpro64, server, hellosystem, dual booting, lazy approach, jail</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Status Report 4th Quarter 2021, Reproducible clean $HOME in OpenBSD using impermanence, Making RockPro64 a NetBSD Server, helloSystem 0.7.0 is out,  lazy approach to FreeBSD dual-booting, going to jail, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2021-10-2021-12/" rel="nofollow">FreeBSD Quarterly Status Report 4th Quarter 2021</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-03-15-openbsd-impermanence.html" rel="nofollow">Reproducible clean $HOME in OpenBSD using impermanence</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/making_rockpro64_a_netbsd_server" rel="nofollow">Making RockPro64 a NetBSD Server</a></h3>

<hr>

<h3><a href="https://github.com/helloSystem/ISO/releases/tag/r0.7.0" rel="nofollow">helloSystem 0.7.0 is out</a></h3>

<hr>

<h3><a href="https://rubenerd.com/my-lazy-approach-to-freebsd-dual-booting/" rel="nofollow">My lazy approach to FreeBSD dual-booting</a></h3>

<hr>

<h3><a href="https://opekkt.tech/docs/vps_migration/going2jail/" rel="nofollow">Going to jail</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• No Feedback emails this week, so instead we can have “Story Time with Allan” and he can regale us with an entertaining BSD story.
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Status Report 4th Quarter 2021, Reproducible clean $HOME in OpenBSD using impermanence, Making RockPro64 a NetBSD Server, helloSystem 0.7.0 is out,  lazy approach to FreeBSD dual-booting, going to jail, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/status/report-2021-10-2021-12/" rel="nofollow">FreeBSD Quarterly Status Report 4th Quarter 2021</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2022-03-15-openbsd-impermanence.html" rel="nofollow">Reproducible clean $HOME in OpenBSD using impermanence</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/making_rockpro64_a_netbsd_server" rel="nofollow">Making RockPro64 a NetBSD Server</a></h3>

<hr>

<h3><a href="https://github.com/helloSystem/ISO/releases/tag/r0.7.0" rel="nofollow">helloSystem 0.7.0 is out</a></h3>

<hr>

<h3><a href="https://rubenerd.com/my-lazy-approach-to-freebsd-dual-booting/" rel="nofollow">My lazy approach to FreeBSD dual-booting</a></h3>

<hr>

<h3><a href="https://opekkt.tech/docs/vps_migration/going2jail/" rel="nofollow">Going to jail</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• No Feedback emails this week, so instead we can have “Story Time with Allan” and he can regale us with an entertaining BSD story.
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>448: Controlling Resource Limits</title>
  <link>https://www.bsdnow.tv/448</link>
  <guid isPermaLink="false">8590bd30-1871-4f8d-a3f8-34cb04d9a17f</guid>
  <pubDate>Thu, 31 Mar 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8590bd30-1871-4f8d-a3f8-34cb04d9a17f.mp3" length="26155080" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Controlling Resource Limits with rctl in FreeBSD, It’s always DNS, Google Summer of Code in BSD Projects, Rsync Technical Notes - Q4 2021, Userland CPU frequency scheduling for OpenBSD, and more.</itunes:subtitle>
  <itunes:duration>45:22</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Controlling Resource Limits with rctl in FreeBSD, It’s always DNS, Google Summer of Code in BSD Projects, Rsync Technical Notes - Q4 2021, Userland CPU frequency scheduling for OpenBSD, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Controlling Resource Limits with rctl in FreeBSD (https://klarasystems.com/articles/controlling-resource-limits-with-rctl-in-freebsd/)
It's DNS. Of course it's DNS, it's always DNS. (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/DNSVariabilityProblems)
News Roundup
GSOC
• [Work with FreeBSD in Google Summer of Code](https://freebsdfoundation.org/blog/work-with-freebsd-in-google-summer-of-code/)
• [The NetBSD Foundation is a mentoring organization at Google Summer of Code 2022](https://blog.netbsd.org/tnf/entry/the_netbsd_foundation_is_a)
Rsync Technical Notes - Q4 2021 (https://www.rsync.net/resources/notes/2021-q4-rsync.net_technotes.html)
Userland CPU frequency scheduling for OpenBSD (https://tildegit.org/solene/obsdfreqd)
Beastie Bits
Unofficial HardenedBSD liveCD (https://groups.google.com/a/hardenedbsd.org/g/users/c/QUTUJfm30Dg/m/0VNKUeVhHgAJ)
The eurobsdcon 2022 CFP is open (https://2022.eurobsdcon.org/the-call-for-talk-and-presentation-proposals-for-eurobsdcon-2022-is-now-open/)
Testing parallel forwarding (http://undeadly.org/cgi?action=article;sid=20220319123157)
OpenBSD iwx(4) gains 11ac 80MHz channel support (https://www.undeadly.org/cgi?action=article;sid=20220315070043)
OpenBSD/arm64 on Apple M1 systems (https://undeadly.org/cgi?action=article;sid=20220320115932)
FreeBSD on the CubieBoard2 (https://www.cambus.net/freebsd-on-the-cubieboard2/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Eric - periodic notifications (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/448/feedback/Eric%20-%20periodic%20notifications.md)
Kevin - no question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/448/feedback/Kevin%20-%20no%20question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, resource limits, rctl, DNS, rsync, technical notes, gsoc, summer of code, userland, cpu frequency scheduling </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Controlling Resource Limits with rctl in FreeBSD, It’s always DNS, Google Summer of Code in BSD Projects, Rsync Technical Notes - Q4 2021, Userland CPU frequency scheduling for OpenBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/controlling-resource-limits-with-rctl-in-freebsd/" rel="nofollow">Controlling Resource Limits with rctl in FreeBSD</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/DNSVariabilityProblems" rel="nofollow">It&#39;s DNS. Of course it&#39;s DNS, it&#39;s always DNS.</a></h3>

<hr>

<h2>News Roundup</h2>

<h3>GSOC</h3>

<pre><code>• [Work with FreeBSD in Google Summer of Code](https://freebsdfoundation.org/blog/work-with-freebsd-in-google-summer-of-code/)
• [The NetBSD Foundation is a mentoring organization at Google Summer of Code 2022](https://blog.netbsd.org/tnf/entry/the_netbsd_foundation_is_a)
</code></pre>

<hr>

<h3><a href="https://www.rsync.net/resources/notes/2021-q4-rsync.net_technotes.html" rel="nofollow">Rsync Technical Notes - Q4 2021</a></h3>

<hr>

<h3><a href="https://tildegit.org/solene/obsdfreqd" rel="nofollow">Userland CPU frequency scheduling for OpenBSD</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://groups.google.com/a/hardenedbsd.org/g/users/c/QUTUJfm30Dg/m/0VNKUeVhHgAJ" rel="nofollow">Unofficial HardenedBSD liveCD</a></li>
<li><a href="https://2022.eurobsdcon.org/the-call-for-talk-and-presentation-proposals-for-eurobsdcon-2022-is-now-open/" rel="nofollow">The eurobsdcon 2022 CFP is open</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20220319123157" rel="nofollow">Testing parallel forwarding</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20220315070043" rel="nofollow">OpenBSD iwx(4) gains 11ac 80MHz channel support</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20220320115932" rel="nofollow">OpenBSD/arm64 on Apple M1 systems</a></li>
<li><a href="https://www.cambus.net/freebsd-on-the-cubieboard2/" rel="nofollow">FreeBSD on the CubieBoard2</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/448/feedback/Eric%20-%20periodic%20notifications.md" rel="nofollow">Eric - periodic notifications</a><br>
<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/448/feedback/Kevin%20-%20no%20question.md" rel="nofollow">Kevin - no question</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Controlling Resource Limits with rctl in FreeBSD, It’s always DNS, Google Summer of Code in BSD Projects, Rsync Technical Notes - Q4 2021, Userland CPU frequency scheduling for OpenBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/controlling-resource-limits-with-rctl-in-freebsd/" rel="nofollow">Controlling Resource Limits with rctl in FreeBSD</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/DNSVariabilityProblems" rel="nofollow">It&#39;s DNS. Of course it&#39;s DNS, it&#39;s always DNS.</a></h3>

<hr>

<h2>News Roundup</h2>

<h3>GSOC</h3>

<pre><code>• [Work with FreeBSD in Google Summer of Code](https://freebsdfoundation.org/blog/work-with-freebsd-in-google-summer-of-code/)
• [The NetBSD Foundation is a mentoring organization at Google Summer of Code 2022](https://blog.netbsd.org/tnf/entry/the_netbsd_foundation_is_a)
</code></pre>

<hr>

<h3><a href="https://www.rsync.net/resources/notes/2021-q4-rsync.net_technotes.html" rel="nofollow">Rsync Technical Notes - Q4 2021</a></h3>

<hr>

<h3><a href="https://tildegit.org/solene/obsdfreqd" rel="nofollow">Userland CPU frequency scheduling for OpenBSD</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://groups.google.com/a/hardenedbsd.org/g/users/c/QUTUJfm30Dg/m/0VNKUeVhHgAJ" rel="nofollow">Unofficial HardenedBSD liveCD</a></li>
<li><a href="https://2022.eurobsdcon.org/the-call-for-talk-and-presentation-proposals-for-eurobsdcon-2022-is-now-open/" rel="nofollow">The eurobsdcon 2022 CFP is open</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20220319123157" rel="nofollow">Testing parallel forwarding</a></li>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20220315070043" rel="nofollow">OpenBSD iwx(4) gains 11ac 80MHz channel support</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20220320115932" rel="nofollow">OpenBSD/arm64 on Apple M1 systems</a></li>
<li><a href="https://www.cambus.net/freebsd-on-the-cubieboard2/" rel="nofollow">FreeBSD on the CubieBoard2</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/448/feedback/Eric%20-%20periodic%20notifications.md" rel="nofollow">Eric - periodic notifications</a><br>
<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/448/feedback/Kevin%20-%20no%20question.md" rel="nofollow">Kevin - no question</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>447: Path to BSD</title>
  <link>https://www.bsdnow.tv/447</link>
  <guid isPermaLink="false">ab14e67f-b3b7-4ce0-8ce4-b2035c16745a</guid>
  <pubDate>Thu, 24 Mar 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ab14e67f-b3b7-4ce0-8ce4-b2035c16745a.mp3" length="33494808" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Foundation Proposals, UNIX: On the Path to BSD, Fujitsu ends its mainframe and Unix services, Install burpsuite on FreeBSD using Linuxulator, new OpenBSD Webzine is out, and more.</itunes:subtitle>
  <itunes:duration>53:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Foundation Proposals, UNIX: On the Path to BSD, Fujitsu ends its mainframe and Unix services, Install burpsuite on FreeBSD using Linuxulator, new OpenBSD Webzine is out, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Project Proposal Overview (https://freebsdfoundation.org/get-involved/project-proposal-overview/)
UNIX: On the Path to BSD (https://klarasystems.com/articles/unix-on-the-path-to-bsd/)
News Roundup
Fujitsu is ending its mainframe and Unix services (https://www.techradar.com/in/news/fujitsu-is-ending-its-mainframe-and-unix-services)
TUTORIAL: Install burpsuite on FreeBSD using Linuxulator (https://forums.FreeBSD.org/threads/tutorial-install-burpsuite-on-freebsd-using-linuxulator.84310/)
OpenBSD Webzine (https://webzine.puffy.cafe/issue-7.html)
Beastie Bits
A Trio if OPNsense releases:
21.7.8 (https://opnsense.org/opnsense-21-7-8-released/)
21.10.3 (https://opnsense.org/opnsense-business-edition-21-10-3-released/)
22.1.1 (https://opnsense.org/opnsense-22-1-1-released-2)
FreeBSD 12.2 end-of-life (https://lists.freebsd.org/archives/freebsd-announce/2022-March/000018.html)
DragonFly as a KVM guest (https://www.dragonflybsd.org/docs/howtos/HowToKvmGuest/)
RIP Lorinda Cherry (https://lwn.net/ml/tuhs/CAKH6PiVi+JoxDG7ACMG5G+qnTkxTMsohGx6Wq3UNVkogO4N0Vg@mail.gmail.com/)
Precursor: From Boot to Root (https://www.bunniestudios.com/blog/?p=6336)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
No Feedback emails this week, so instead Tom can regale us with an entertaining BSD story.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, foundation, project proposal, mainframe, futjitsu, unix service, burpsuite, linuxulator, webzine</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Foundation Proposals, UNIX: On the Path to BSD, Fujitsu ends its mainframe and Unix services, Install burpsuite on FreeBSD using Linuxulator, new OpenBSD Webzine is out, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/get-involved/project-proposal-overview/" rel="nofollow">Project Proposal Overview</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/unix-on-the-path-to-bsd/" rel="nofollow">UNIX: On the Path to BSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.techradar.com/in/news/fujitsu-is-ending-its-mainframe-and-unix-services" rel="nofollow">Fujitsu is ending its mainframe and Unix services</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/tutorial-install-burpsuite-on-freebsd-using-linuxulator.84310/" rel="nofollow">TUTORIAL: Install burpsuite on FreeBSD using Linuxulator</a></h3>

<hr>

<h3><a href="https://webzine.puffy.cafe/issue-7.html" rel="nofollow">OpenBSD Webzine</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li>A Trio if OPNsense releases:

<ul>
<li><a href="https://opnsense.org/opnsense-21-7-8-released/" rel="nofollow">21.7.8</a></li>
<li><a href="https://opnsense.org/opnsense-business-edition-21-10-3-released/" rel="nofollow">21.10.3</a></li>
<li><a href="https://opnsense.org/opnsense-22-1-1-released-2" rel="nofollow">22.1.1</a></li>
</ul></li>
<li><a href="https://lists.freebsd.org/archives/freebsd-announce/2022-March/000018.html" rel="nofollow">FreeBSD 12.2 end-of-life</a></li>
<li><a href="https://www.dragonflybsd.org/docs/howtos/HowToKvmGuest/" rel="nofollow">DragonFly as a KVM guest</a></li>
<li><a href="https://lwn.net/ml/tuhs/CAKH6PiVi+JoxDG7ACMG5G+qnTkxTMsohGx6Wq3UNVkogO4N0Vg@mail.gmail.com/" rel="nofollow">RIP Lorinda Cherry</a></li>
<li><a href="https://www.bunniestudios.com/blog/?p=6336" rel="nofollow">Precursor: From Boot to Root</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p>No Feedback emails this week, so instead Tom can regale us with an entertaining BSD story.</p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Foundation Proposals, UNIX: On the Path to BSD, Fujitsu ends its mainframe and Unix services, Install burpsuite on FreeBSD using Linuxulator, new OpenBSD Webzine is out, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/get-involved/project-proposal-overview/" rel="nofollow">Project Proposal Overview</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/unix-on-the-path-to-bsd/" rel="nofollow">UNIX: On the Path to BSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.techradar.com/in/news/fujitsu-is-ending-its-mainframe-and-unix-services" rel="nofollow">Fujitsu is ending its mainframe and Unix services</a></h3>

<hr>

<h3><a href="https://forums.FreeBSD.org/threads/tutorial-install-burpsuite-on-freebsd-using-linuxulator.84310/" rel="nofollow">TUTORIAL: Install burpsuite on FreeBSD using Linuxulator</a></h3>

<hr>

<h3><a href="https://webzine.puffy.cafe/issue-7.html" rel="nofollow">OpenBSD Webzine</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li>A Trio if OPNsense releases:

<ul>
<li><a href="https://opnsense.org/opnsense-21-7-8-released/" rel="nofollow">21.7.8</a></li>
<li><a href="https://opnsense.org/opnsense-business-edition-21-10-3-released/" rel="nofollow">21.10.3</a></li>
<li><a href="https://opnsense.org/opnsense-22-1-1-released-2" rel="nofollow">22.1.1</a></li>
</ul></li>
<li><a href="https://lists.freebsd.org/archives/freebsd-announce/2022-March/000018.html" rel="nofollow">FreeBSD 12.2 end-of-life</a></li>
<li><a href="https://www.dragonflybsd.org/docs/howtos/HowToKvmGuest/" rel="nofollow">DragonFly as a KVM guest</a></li>
<li><a href="https://lwn.net/ml/tuhs/CAKH6PiVi+JoxDG7ACMG5G+qnTkxTMsohGx6Wq3UNVkogO4N0Vg@mail.gmail.com/" rel="nofollow">RIP Lorinda Cherry</a></li>
<li><a href="https://www.bunniestudios.com/blog/?p=6336" rel="nofollow">Precursor: From Boot to Root</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p>No Feedback emails this week, so instead Tom can regale us with an entertaining BSD story.</p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>446: Debugging ioctl problems </title>
  <link>https://www.bsdnow.tv/446</link>
  <guid isPermaLink="false">b8932853-588e-4ed2-8bd3-b8d3552b820d</guid>
  <pubDate>Thu, 17 Mar 2022 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b8932853-588e-4ed2-8bd3-b8d3552b820d.mp3" length="29044560" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Restoring a Tadpole SPARCbook 3, The FreeBSD Boot Process, Debugging an ioctl Problem on OpenBSD, Why my game PC runs FreeBSD and Kubuntu, DNSSEC, Badgers, and Orcs, Oh My, and more.</itunes:subtitle>
  <itunes:duration>48:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Restoring a Tadpole SPARCbook 3, The FreeBSD Boot Process, Debugging an ioctl Problem on OpenBSD, Why my game PC runs FreeBSD and Kubuntu, DNSSEC, Badgers, and Orcs, Oh My, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Restoring a Tadpole SPARCbook 3 Part 1: Introduction (https://www.rs-online.com/designspark/restoring-a-tadpole-sparcbook-3-part-1-introduction)
The FreeBSD Boot Process (https://klarasystems.com/articles/the-freebsd-boot-process/)
News Roundup
Debugging an ioctl Problem on OpenBSD (https://jcs.org/2022/02/16/ioctl)
Why my game PC runs FreeBSD and Kubuntu (https://rubenerd.com/why-my-game-pc-also-runs-freebsd/)
DNSSEC, Badgers, and Orcs, Oh My! (https://mwl.io/archives/14708)
Beastie Bits
• [LibreSSL 3.5.0 development branch released](https://undeadly.org/cgi?action=article;sid=20220301063844)
• [OpenSSH updated to 8.9](https://undeadly.org/cgi?action=article;sid=20220301063428)
• [Recent developments in OpenBSD, 2022-02-21 summary](https://undeadly.org/cgi?action=article;sid=20220221060700)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Jonathan - X-Wing and Tie Fighter (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/446/Jonathan%20-%20X-Wing%20and%20Tie%20Fighter.md)
Joshontech - pool options (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/446/joshontech%20-%20pool%20options.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, sparcbook, boot process, debugging, debug, ioctl, game setup, game pc, gaming, dnssec book, badger book, mwlauthor, Michael W. Lucas</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Restoring a Tadpole SPARCbook 3, The FreeBSD Boot Process, Debugging an ioctl Problem on OpenBSD, Why my game PC runs FreeBSD and Kubuntu, DNSSEC, Badgers, and Orcs, Oh My, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.rs-online.com/designspark/restoring-a-tadpole-sparcbook-3-part-1-introduction" rel="nofollow">Restoring a Tadpole SPARCbook 3 Part 1: Introduction</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/the-freebsd-boot-process/" rel="nofollow">The FreeBSD Boot Process</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2022/02/16/ioctl" rel="nofollow">Debugging an ioctl Problem on OpenBSD</a></h3>

<hr>

<h3><a href="https://rubenerd.com/why-my-game-pc-also-runs-freebsd/" rel="nofollow">Why my game PC runs FreeBSD and Kubuntu</a></h3>

<hr>

<h3><a href="https://mwl.io/archives/14708" rel="nofollow">DNSSEC, Badgers, and Orcs, Oh My!</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [LibreSSL 3.5.0 development branch released](https://undeadly.org/cgi?action=article;sid=20220301063844)
• [OpenSSH updated to 8.9](https://undeadly.org/cgi?action=article;sid=20220301063428)
• [Recent developments in OpenBSD, 2022-02-21 summary](https://undeadly.org/cgi?action=article;sid=20220221060700)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/446/Jonathan%20-%20X-Wing%20and%20Tie%20Fighter.md" rel="nofollow">Jonathan - X-Wing and Tie Fighter</a><br>
<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/446/joshontech%20-%20pool%20options.md" rel="nofollow">Joshontech - pool options</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Restoring a Tadpole SPARCbook 3, The FreeBSD Boot Process, Debugging an ioctl Problem on OpenBSD, Why my game PC runs FreeBSD and Kubuntu, DNSSEC, Badgers, and Orcs, Oh My, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.rs-online.com/designspark/restoring-a-tadpole-sparcbook-3-part-1-introduction" rel="nofollow">Restoring a Tadpole SPARCbook 3 Part 1: Introduction</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/the-freebsd-boot-process/" rel="nofollow">The FreeBSD Boot Process</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2022/02/16/ioctl" rel="nofollow">Debugging an ioctl Problem on OpenBSD</a></h3>

<hr>

<h3><a href="https://rubenerd.com/why-my-game-pc-also-runs-freebsd/" rel="nofollow">Why my game PC runs FreeBSD and Kubuntu</a></h3>

<hr>

<h3><a href="https://mwl.io/archives/14708" rel="nofollow">DNSSEC, Badgers, and Orcs, Oh My!</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [LibreSSL 3.5.0 development branch released](https://undeadly.org/cgi?action=article;sid=20220301063844)
• [OpenSSH updated to 8.9](https://undeadly.org/cgi?action=article;sid=20220301063428)
• [Recent developments in OpenBSD, 2022-02-21 summary](https://undeadly.org/cgi?action=article;sid=20220221060700)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/446/Jonathan%20-%20X-Wing%20and%20Tie%20Fighter.md" rel="nofollow">Jonathan - X-Wing and Tie Fighter</a><br>
<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/446/joshontech%20-%20pool%20options.md" rel="nofollow">Joshontech - pool options</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>445: Journey to BSD</title>
  <link>https://www.bsdnow.tv/445</link>
  <guid isPermaLink="false">a4bbf2bd-8191-4faa-9dec-2b8a2f9de7fd</guid>
  <pubDate>Thu, 10 Mar 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a4bbf2bd-8191-4faa-9dec-2b8a2f9de7fd.mp3" length="28948800" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Idiot's guide to OpenBSD on the Pinebook Pro, FreeBSD Periodic Scripts, history of service management in Unix, journey from macOS to FreeBSD, Unix processes “infecting” each other, navidrom music server on FreeBSD, and more.</itunes:subtitle>
  <itunes:duration>47:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Idiot's guide to OpenBSD on the Pinebook Pro, FreeBSD Periodic Scripts, history of service management in Unix, journey from macOS to FreeBSD, Unix processes “infecting” each other, navidrom music server on FreeBSD, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The complete idiot's guide to OpenBSD on the Pinebook Pro (https://tomscii.sig7.se/2022/02/Guide-to-OpenBSD-on-the-PinebookPro)
FreeBSD Periodic Scripts (https://klarasystems.com/articles/freebsd-periodic-scripts/)
News Roundup
The history (sort of) of service management in Unix (https://utcc.utoronto.ca/~cks/space/blog/unix/ServiceManagementHistory)
My journey from macOS to FreeBSD (https://www.boucek.me/blog/from-mac-to-freebsd/)
A nice story about Unix processes "infecting" each other (https://rachelbythebay.com/w/2022/02/09/nice/)
Navidrome music server on FreeBSD (https://web.archive.org/web/20220101220446/https://www.danschmid.me/article/install-navidrome-music-server-on-freebsd)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Tyler - Is this enough for VMs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/Tyler%20-%20Is%20this%20enough%20for%20VMs.md)
Kevin - BSD from RAMdisk (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/445/feedback/Kevin%20-%20BSD%20from%20RAMdisk.md)
Malcolm - wired headset in FreeBSD (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/445/feedback/Malcolm%20-%20wired%20headset%20in%20FreeBSD.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, pinebook pro, periodic scripts, service management, history, macOS migration, processes, navidrome, music server</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Idiot&#39;s guide to OpenBSD on the Pinebook Pro, FreeBSD Periodic Scripts, history of service management in Unix, journey from macOS to FreeBSD, Unix processes “infecting” each other, navidrom music server on FreeBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://tomscii.sig7.se/2022/02/Guide-to-OpenBSD-on-the-PinebookPro" rel="nofollow">The complete idiot&#39;s guide to OpenBSD on the Pinebook Pro</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/freebsd-periodic-scripts/" rel="nofollow">FreeBSD Periodic Scripts</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ServiceManagementHistory" rel="nofollow">The history (sort of) of service management in Unix</a></h3>

<hr>

<h3><a href="https://www.boucek.me/blog/from-mac-to-freebsd/" rel="nofollow">My journey from macOS to FreeBSD</a></h3>

<hr>

<h3><a href="https://rachelbythebay.com/w/2022/02/09/nice/" rel="nofollow">A nice story about Unix processes &quot;infecting&quot; each other</a></h3>

<hr>

<h3><a href="https://web.archive.org/web/20220101220446/https://www.danschmid.me/article/install-navidrome-music-server-on-freebsd" rel="nofollow">Navidrome music server on FreeBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/Tyler%20-%20Is%20this%20enough%20for%20VMs.md" rel="nofollow">Tyler - Is this enough for VMs</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/445/feedback/Kevin%20-%20BSD%20from%20RAMdisk.md" rel="nofollow">Kevin - BSD from RAMdisk</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/445/feedback/Malcolm%20-%20wired%20headset%20in%20FreeBSD.md" rel="nofollow">Malcolm - wired headset in FreeBSD</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Idiot&#39;s guide to OpenBSD on the Pinebook Pro, FreeBSD Periodic Scripts, history of service management in Unix, journey from macOS to FreeBSD, Unix processes “infecting” each other, navidrom music server on FreeBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://tomscii.sig7.se/2022/02/Guide-to-OpenBSD-on-the-PinebookPro" rel="nofollow">The complete idiot&#39;s guide to OpenBSD on the Pinebook Pro</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/freebsd-periodic-scripts/" rel="nofollow">FreeBSD Periodic Scripts</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ServiceManagementHistory" rel="nofollow">The history (sort of) of service management in Unix</a></h3>

<hr>

<h3><a href="https://www.boucek.me/blog/from-mac-to-freebsd/" rel="nofollow">My journey from macOS to FreeBSD</a></h3>

<hr>

<h3><a href="https://rachelbythebay.com/w/2022/02/09/nice/" rel="nofollow">A nice story about Unix processes &quot;infecting&quot; each other</a></h3>

<hr>

<h3><a href="https://web.archive.org/web/20220101220446/https://www.danschmid.me/article/install-navidrome-music-server-on-freebsd" rel="nofollow">Navidrome music server on FreeBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/Tyler%20-%20Is%20this%20enough%20for%20VMs.md" rel="nofollow">Tyler - Is this enough for VMs</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/445/feedback/Kevin%20-%20BSD%20from%20RAMdisk.md" rel="nofollow">Kevin - BSD from RAMdisk</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/445/feedback/Malcolm%20-%20wired%20headset%20in%20FreeBSD.md" rel="nofollow">Malcolm - wired headset in FreeBSD</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>444: Historic Developments</title>
  <link>https://www.bsdnow.tv/444</link>
  <guid isPermaLink="false">859e26d8-a3d7-4df6-8ea2-eb22ab8babb5</guid>
  <pubDate>Thu, 03 Mar 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/859e26d8-a3d7-4df6-8ea2-eb22ab8babb5.mp3" length="31350552" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The History of Berkeley DB, modern inetd in FreeBSD, the Unix argv[0] issue, retrocomputing can be more than games, read section 8 of the Unix users manual, and more.</itunes:subtitle>
  <itunes:duration>53:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The History of Berkeley DB, modern inetd in FreeBSD, the Unix argv[0] issue, retrocomputing can be more than games, read section 8 of the Unix users manual, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
A Conversation with Margo Seltzer and Mike Olson: The history of Berkeley DB (https://queue.acm.org/detail.cfm?id=3501713)
Modern inetd in FreeBSD (https://klarasystems.com/articles/modern-inetd-in-freebsd/)
News Roundup
The reason Unix has the argv[0] issue (and API) (https://utcc.utoronto.ca/~cks/space/blog/unix/Argv0IsEasy)
Retrocomputing can be more than games (https://rubenerd.com/retrocomputing-is-more-than-games/)
You should read Section 8 of the Unix User's Manual (https://www.theregister.com/2022/02/09/section_8_unix_user_manual/)
Beastie Bits
New 'Reckless guide to OpenBSD' published (https://undeadly.org/cgi?action=article;sid=20220214061716)
GhostBSD Online Meetup (http://ghostbsd.org/node/243)
HAMBug online meeting, March 8th @ 18:30 ET (http://hambug.ca/)
HardenedBSD 12-STABLE support will be dropped in May 2022 (https://twitter.com/HardenedBSD/status/1492249763193970689)
Option options for getopt (https://www.dragonflydigest.com/2022/02/16/26684.html)
New Tarsnap version is out (https://mail.tarsnap.com/tarsnap-announce/msg00046.html)
 pfSense Plus version 22.01 and pfSense CE version 2.6.0 Software are Now Available (https://www.netgate.com/blog/pfsense-plus-software-version-22.01-and-ce-2.6.0-are-now-available)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Karst - replacing disks (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/Karst%20-%20replacing%20disks.md)
TheHolm - zfs and booting (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/TheHolm%20-%20zfs%20and%20booting.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, berkeleydb, inetd, argv, issue, retrocomputing, games, users manual</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The History of Berkeley DB, modern inetd in FreeBSD, the Unix argv[0] issue, retrocomputing can be more than games, read section 8 of the Unix users manual, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://queue.acm.org/detail.cfm?id=3501713" rel="nofollow">A Conversation with Margo Seltzer and Mike Olson: The history of Berkeley DB</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/modern-inetd-in-freebsd/" rel="nofollow">Modern inetd in FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/Argv0IsEasy" rel="nofollow">The reason Unix has the argv[0] issue (and API)</a></h3>

<hr>

<h3><a href="https://rubenerd.com/retrocomputing-is-more-than-games/" rel="nofollow">Retrocomputing can be more than games</a></h3>

<hr>

<h3><a href="https://www.theregister.com/2022/02/09/section_8_unix_user_manual/" rel="nofollow">You should read Section 8 of the Unix User&#39;s Manual</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20220214061716" rel="nofollow">New &#39;Reckless guide to OpenBSD&#39; published</a></li>
<li><a href="http://ghostbsd.org/node/243" rel="nofollow">GhostBSD Online Meetup</a></li>
<li><a href="http://hambug.ca/" rel="nofollow">HAMBug online meeting, March 8th @ 18:30 ET</a></li>
<li><a href="https://twitter.com/HardenedBSD/status/1492249763193970689" rel="nofollow">HardenedBSD 12-STABLE support will be dropped in May 2022</a></li>
<li><a href="https://www.dragonflydigest.com/2022/02/16/26684.html" rel="nofollow">Option options for getopt</a></li>
<li><a href="https://mail.tarsnap.com/tarsnap-announce/msg00046.html" rel="nofollow">New Tarsnap version is out</a></li>
<li> <a href="https://www.netgate.com/blog/pfsense-plus-software-version-22.01-and-ce-2.6.0-are-now-available" rel="nofollow">pfSense Plus version 22.01 and pfSense CE version 2.6.0 Software are Now Available</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/Karst%20-%20replacing%20disks.md" rel="nofollow">Karst - replacing disks</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/TheHolm%20-%20zfs%20and%20booting.md" rel="nofollow">TheHolm - zfs and booting</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The History of Berkeley DB, modern inetd in FreeBSD, the Unix argv[0] issue, retrocomputing can be more than games, read section 8 of the Unix users manual, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://queue.acm.org/detail.cfm?id=3501713" rel="nofollow">A Conversation with Margo Seltzer and Mike Olson: The history of Berkeley DB</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/modern-inetd-in-freebsd/" rel="nofollow">Modern inetd in FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/Argv0IsEasy" rel="nofollow">The reason Unix has the argv[0] issue (and API)</a></h3>

<hr>

<h3><a href="https://rubenerd.com/retrocomputing-is-more-than-games/" rel="nofollow">Retrocomputing can be more than games</a></h3>

<hr>

<h3><a href="https://www.theregister.com/2022/02/09/section_8_unix_user_manual/" rel="nofollow">You should read Section 8 of the Unix User&#39;s Manual</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20220214061716" rel="nofollow">New &#39;Reckless guide to OpenBSD&#39; published</a></li>
<li><a href="http://ghostbsd.org/node/243" rel="nofollow">GhostBSD Online Meetup</a></li>
<li><a href="http://hambug.ca/" rel="nofollow">HAMBug online meeting, March 8th @ 18:30 ET</a></li>
<li><a href="https://twitter.com/HardenedBSD/status/1492249763193970689" rel="nofollow">HardenedBSD 12-STABLE support will be dropped in May 2022</a></li>
<li><a href="https://www.dragonflydigest.com/2022/02/16/26684.html" rel="nofollow">Option options for getopt</a></li>
<li><a href="https://mail.tarsnap.com/tarsnap-announce/msg00046.html" rel="nofollow">New Tarsnap version is out</a></li>
<li> <a href="https://www.netgate.com/blog/pfsense-plus-software-version-22.01-and-ce-2.6.0-are-now-available" rel="nofollow">pfSense Plus version 22.01 and pfSense CE version 2.6.0 Software are Now Available</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/Karst%20-%20replacing%20disks.md" rel="nofollow">Karst - replacing disks</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/TheHolm%20-%20zfs%20and%20booting.md" rel="nofollow">TheHolm - zfs and booting</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>443: Certified Unix Compliant</title>
  <link>https://www.bsdnow.tv/443</link>
  <guid isPermaLink="false">07a074a7-cfc0-4058-a637-3c58c89a919a</guid>
  <pubDate>Thu, 24 Feb 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/07a074a7-cfc0-4058-a637-3c58c89a919a.mp3" length="30076104" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Certifying an OS Unix compliant, 2021 FreeBSD Foundation Impact Report, Netflix, Disney, and other widevine content on FreeBSD, file hashes updated for NetBSD 8.1, Playing with CD-RWs on FreeBSD, Why "process substitution" is a late feature in Unix shells, and more.</itunes:subtitle>
  <itunes:duration>46:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Certifying an OS Unix compliant, 2021 FreeBSD Foundation Impact Report, Netflix, Disney, and other widevine content on FreeBSD, file hashes updated for NetBSD 8.1, Playing with CD-RWs on FreeBSD, Why "process substitution" is a late feature in Unix shells, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
What goes into making an OS to be Unix compliant certified? (https://www.quora.com/What-goes-into-making-an-OS-to-be-Unix-compliant-certified)
2021 FreeBSD Foundation Impact Report (https://freebsdfoundation.org/blog/2021-freebsd-foundation-impact-report/)
News Roundup
Play Netflix, Disney, and other widevine content on FreeBSD (https://danschmid.de/article/play-netflix-disney-and-other-widevine-content-on-freebsd)
Note: two files changed and hashes/signatures updated for NetBSD 8.1 (https://bsdsec.net/articles/note-two-files-changed-and-hashes-signatures-updated-for-netbsd-8-1)
Playing with CD-RWs on FreeBSD (https://rubenerd.com/playing-with-cd-rws-on-freebsd/)
Why "process substitution" is a late feature in Unix shells (https://utcc.utoronto.ca/~cks/space/blog/unix/ProcessSubstitutionWhyLate)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Marty - shell communities (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Marty%20-%20shell%20communities.md)
Nate - Helping Mike Out (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Nate%20-%20Helping%20Mike%20Out.md)
Tom - convincing others to switch (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Tom%20-%20convincing%20others%20to%20switch.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, certification, Unix compliant, compliance, foundation impact report, netflix, disney, widevine, file hash, cd-rw, process substitution</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Certifying an OS Unix compliant, 2021 FreeBSD Foundation Impact Report, Netflix, Disney, and other widevine content on FreeBSD, file hashes updated for NetBSD 8.1, Playing with CD-RWs on FreeBSD, Why &quot;process substitution&quot; is a late feature in Unix shells, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.quora.com/What-goes-into-making-an-OS-to-be-Unix-compliant-certified" rel="nofollow">What goes into making an OS to be Unix compliant certified?</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/2021-freebsd-foundation-impact-report/" rel="nofollow">2021 FreeBSD Foundation Impact Report</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://danschmid.de/article/play-netflix-disney-and-other-widevine-content-on-freebsd" rel="nofollow">Play Netflix, Disney, and other widevine content on FreeBSD</a></h3>

<hr>

<h3><a href="https://bsdsec.net/articles/note-two-files-changed-and-hashes-signatures-updated-for-netbsd-8-1" rel="nofollow">Note: two files changed and hashes/signatures updated for NetBSD 8.1</a></h3>

<hr>

<h3><a href="https://rubenerd.com/playing-with-cd-rws-on-freebsd/" rel="nofollow">Playing with CD-RWs on FreeBSD</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ProcessSubstitutionWhyLate" rel="nofollow">Why &quot;process substitution&quot; is a late feature in Unix shells</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Marty%20-%20shell%20communities.md" rel="nofollow">Marty - shell communities</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Nate%20-%20Helping%20Mike%20Out.md" rel="nofollow">Nate - Helping Mike Out</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Tom%20-%20convincing%20others%20to%20switch.md" rel="nofollow">Tom - convincing others to switch</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Certifying an OS Unix compliant, 2021 FreeBSD Foundation Impact Report, Netflix, Disney, and other widevine content on FreeBSD, file hashes updated for NetBSD 8.1, Playing with CD-RWs on FreeBSD, Why &quot;process substitution&quot; is a late feature in Unix shells, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.quora.com/What-goes-into-making-an-OS-to-be-Unix-compliant-certified" rel="nofollow">What goes into making an OS to be Unix compliant certified?</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/2021-freebsd-foundation-impact-report/" rel="nofollow">2021 FreeBSD Foundation Impact Report</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://danschmid.de/article/play-netflix-disney-and-other-widevine-content-on-freebsd" rel="nofollow">Play Netflix, Disney, and other widevine content on FreeBSD</a></h3>

<hr>

<h3><a href="https://bsdsec.net/articles/note-two-files-changed-and-hashes-signatures-updated-for-netbsd-8-1" rel="nofollow">Note: two files changed and hashes/signatures updated for NetBSD 8.1</a></h3>

<hr>

<h3><a href="https://rubenerd.com/playing-with-cd-rws-on-freebsd/" rel="nofollow">Playing with CD-RWs on FreeBSD</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ProcessSubstitutionWhyLate" rel="nofollow">Why &quot;process substitution&quot; is a late feature in Unix shells</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Marty%20-%20shell%20communities.md" rel="nofollow">Marty - shell communities</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Nate%20-%20Helping%20Mike%20Out.md" rel="nofollow">Nate - Helping Mike Out</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Tom%20-%20convincing%20others%20to%20switch.md" rel="nofollow">Tom - convincing others to switch</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>442: Birthing Unix</title>
  <link>https://www.bsdnow.tv/442</link>
  <guid isPermaLink="false">6c41b9bf-54fb-42e4-88de-6df0daca6ad1</guid>
  <pubDate>Thu, 17 Feb 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6c41b9bf-54fb-42e4-88de-6df0daca6ad1.mp3" length="28180392" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Birth of Unix, Help request for three big Lumina items, FreeBSD 13 on Thinkpad T460s, HardenedBSD January 2022 Status Report, OPNsense 22.1 "Observant Owl" released, and more.</itunes:subtitle>
  <itunes:duration>46:19</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Birth of Unix, Help request for three big Lumina items, FreeBSD 13 on Thinkpad T460s, HardenedBSD January 2022 Status Report, OPNsense 22.1 "Observant Owl" released, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
The Birth of Unix (https://klarasystems.com/articles/the-birth-of-unix/)
Help requested for three big items for Lumina (https://lumina-desktop.org/post/2022-02-08/)
News Roundup
FreeBSD 13 on Thinkpad T460s (https://www.tumfatig.net/2022/freebsd-13-on-thinkpad-t460s/)
HardenedBSD January 2022 Status Report (https://hardenedbsd.org/article/shawn-webb/2022-01-30/hardenedbsd-january-2022-status-report)
OPNsense 22.1 "Observant Owl" released (https://opnsense.org/opnsense-22-1-released/)
Beastie Bits
The early days of Unix at Bell Labs - Brian Kernighan (LCA 2022 Online) (https://www.youtube.com/watch?v=ECCr_KFl41E)
BastilleBSD User Survey (https://docs.google.com/forms/d/e/1FAIpQLSddMMIFW9mHMnpMjMQZfFVCubVywmCXZHI7lqE2tS4k503uPw/viewform)
Smallest desktop of the day with BSD: Raspberry Pi 400 (https://www.reddit.com/r/BSD/comments/sgk5y0/smallest_desktop_of_the_day_with_bsd_raspberry_pi/)
Reminder BSDCan 2022 - online only (https://lists.bsdcan.org/pipermail/bsdcan-announce/2022-January/000191.html)
Joshua Stein Video: Q&amp;amp;A (https://jcs.org/2022/01/14/q&amp;amp;a)
DNSSEC Mastery, second edition, creeping out (https://mwl.io/archives/14427)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Alec - Playstation FreeBSD-Linux question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Alec%20-%20Playstation%20FreeBSD-Linux%20question.md)
Nelson - Interesting Interview (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Nelson%20-%20Interesting%20Interview.md)
Oscar - Omni OS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Oscar%20-%20Omni%20OS.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, birth, beginnings, help request, Lumina, Thinkpad, T460s, status report, opnsense, observant owl,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Birth of Unix, Help request for three big Lumina items, FreeBSD 13 on Thinkpad T460s, HardenedBSD January 2022 Status Report, OPNsense 22.1 &quot;Observant Owl&quot; released, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/the-birth-of-unix/" rel="nofollow">The Birth of Unix</a></h3>

<hr>

<h3><a href="https://lumina-desktop.org/post/2022-02-08/" rel="nofollow">Help requested for three big items for Lumina</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.tumfatig.net/2022/freebsd-13-on-thinkpad-t460s/" rel="nofollow">FreeBSD 13 on Thinkpad T460s</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2022-01-30/hardenedbsd-january-2022-status-report" rel="nofollow">HardenedBSD January 2022 Status Report</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-22-1-released/" rel="nofollow">OPNsense 22.1 &quot;Observant Owl&quot; released</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=ECCr_KFl41E" rel="nofollow">The early days of Unix at Bell Labs - Brian Kernighan (LCA 2022 Online)</a></li>
<li><a href="https://docs.google.com/forms/d/e/1FAIpQLSddMMIFW9mHMnpMjMQZfFVCubVywmCXZHI7lqE2tS4k503uPw/viewform" rel="nofollow">BastilleBSD User Survey</a>
<a href="https://www.reddit.com/r/BSD/comments/sgk5y0/smallest_desktop_of_the_day_with_bsd_raspberry_pi/" rel="nofollow">Smallest desktop of the day with BSD: Raspberry Pi 400</a></li>
<li><a href="https://lists.bsdcan.org/pipermail/bsdcan-announce/2022-January/000191.html" rel="nofollow">Reminder BSDCan 2022 - online only</a></li>
<li><a href="https://jcs.org/2022/01/14/q&a" rel="nofollow">Joshua Stein Video: Q&amp;A</a></li>
<li><a href="https://mwl.io/archives/14427" rel="nofollow">DNSSEC Mastery, second edition, creeping out</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Alec%20-%20Playstation%20FreeBSD-Linux%20question.md" rel="nofollow">Alec - Playstation FreeBSD-Linux question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Nelson%20-%20Interesting%20Interview.md" rel="nofollow">Nelson - Interesting Interview</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Oscar%20-%20Omni%20OS.md" rel="nofollow">Oscar - Omni OS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Birth of Unix, Help request for three big Lumina items, FreeBSD 13 on Thinkpad T460s, HardenedBSD January 2022 Status Report, OPNsense 22.1 &quot;Observant Owl&quot; released, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/the-birth-of-unix/" rel="nofollow">The Birth of Unix</a></h3>

<hr>

<h3><a href="https://lumina-desktop.org/post/2022-02-08/" rel="nofollow">Help requested for three big items for Lumina</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.tumfatig.net/2022/freebsd-13-on-thinkpad-t460s/" rel="nofollow">FreeBSD 13 on Thinkpad T460s</a></h3>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2022-01-30/hardenedbsd-january-2022-status-report" rel="nofollow">HardenedBSD January 2022 Status Report</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-22-1-released/" rel="nofollow">OPNsense 22.1 &quot;Observant Owl&quot; released</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=ECCr_KFl41E" rel="nofollow">The early days of Unix at Bell Labs - Brian Kernighan (LCA 2022 Online)</a></li>
<li><a href="https://docs.google.com/forms/d/e/1FAIpQLSddMMIFW9mHMnpMjMQZfFVCubVywmCXZHI7lqE2tS4k503uPw/viewform" rel="nofollow">BastilleBSD User Survey</a>
<a href="https://www.reddit.com/r/BSD/comments/sgk5y0/smallest_desktop_of_the_day_with_bsd_raspberry_pi/" rel="nofollow">Smallest desktop of the day with BSD: Raspberry Pi 400</a></li>
<li><a href="https://lists.bsdcan.org/pipermail/bsdcan-announce/2022-January/000191.html" rel="nofollow">Reminder BSDCan 2022 - online only</a></li>
<li><a href="https://jcs.org/2022/01/14/q&a" rel="nofollow">Joshua Stein Video: Q&amp;A</a></li>
<li><a href="https://mwl.io/archives/14427" rel="nofollow">DNSSEC Mastery, second edition, creeping out</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Alec%20-%20Playstation%20FreeBSD-Linux%20question.md" rel="nofollow">Alec - Playstation FreeBSD-Linux question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Nelson%20-%20Interesting%20Interview.md" rel="nofollow">Nelson - Interesting Interview</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Oscar%20-%20Omni%20OS.md" rel="nofollow">Oscar - Omni OS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>441: Migration to BSD</title>
  <link>https://www.bsdnow.tv/441</link>
  <guid isPermaLink="false">9b36f236-73a8-4846-af4e-cd774790c11b</guid>
  <pubDate>Thu, 10 Feb 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9b36f236-73a8-4846-af4e-cd774790c11b.mp3" length="31052040" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Migrating our servers from Linux to FreeBSD, Cluster provisioning with Nomad and Pot on FreeBSD, LibBSDDialog, FreeBSD 13.0 Base Jails with ZFS and VNET, and more.</itunes:subtitle>
  <itunes:duration>50:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Migrating our servers from Linux to FreeBSD, Cluster provisioning with Nomad and Pot on FreeBSD, LibBSDDialog, FreeBSD 13.0 Base Jails with ZFS and VNET, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Why we're migrating (many of) our servers from Linux to FreeBSD (https://it-notes.dragas.net/2022/01/24/why-were-migrating-many-of-our-servers-from-linux-to-freebsd/)
Cluster provisioning with Nomad and Pot on FreeBSD (https://klarasystems.com/articles/cluster-provisioning-with-nomad-and-pot-on-freebsd/)
News Roundup
LibBSDDialog (https://alfonsosiciliano.gitlab.io/posts/2022-01-16-libbsddialog.html)
FreeBSD 13.0 Base Jails with ZFS and VNET (https://randomnixfix.wordpress.com/2022/01/15/freebsd-13-0-base-jails-with-zfs-and-vnet/)
Beastie Bits
OpenBSD on the Pinephone (https://www.exoticsilicon.com/crystal/pinephone_openbsd)
FreeBSD SSH Hardening (https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11)
Making the ZFS file system (https://changelog.com/podcast/475)
A Linux Users Experience Switching To OpenBSD (https://www.youtube.com/watch?v=ukTOfcu1e0w)
Add Nix, a purely functional package manager to FreeBSD (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=550026)
ioztat is a storage load analysis tool for OpenZFS (https://github.com/jimsalterjrs/ioztat)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Scott - esxi (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/441/feedback/Scott%20-%20esxi.md)
The Holm - noob question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/441/feedback/The%20Holm%20-%20noob%20question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, migration, server migration, os migration, cluster, cluster provisioning, nomad, pot, libbsddialog, base jails, vnet</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Migrating our servers from Linux to FreeBSD, Cluster provisioning with Nomad and Pot on FreeBSD, LibBSDDialog, FreeBSD 13.0 Base Jails with ZFS and VNET, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://it-notes.dragas.net/2022/01/24/why-were-migrating-many-of-our-servers-from-linux-to-freebsd/" rel="nofollow">Why we&#39;re migrating (many of) our servers from Linux to FreeBSD</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/cluster-provisioning-with-nomad-and-pot-on-freebsd/" rel="nofollow">Cluster provisioning with Nomad and Pot on FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://alfonsosiciliano.gitlab.io/posts/2022-01-16-libbsddialog.html" rel="nofollow">LibBSDDialog</a></h3>

<hr>

<h3><a href="https://randomnixfix.wordpress.com/2022/01/15/freebsd-13-0-base-jails-with-zfs-and-vnet/" rel="nofollow">FreeBSD 13.0 Base Jails with ZFS and VNET</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.exoticsilicon.com/crystal/pinephone_openbsd" rel="nofollow">OpenBSD on the Pinephone</a></li>
<li><a href="https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11" rel="nofollow">FreeBSD SSH Hardening</a></li>
<li><a href="https://changelog.com/podcast/475" rel="nofollow">Making the ZFS file system</a></li>
<li><a href="https://www.youtube.com/watch?v=ukTOfcu1e0w" rel="nofollow">A Linux Users Experience Switching To OpenBSD</a></li>
<li><a href="https://svnweb.freebsd.org/ports?view=revision&revision=550026" rel="nofollow">Add Nix, a purely functional package manager to FreeBSD</a></li>
<li><a href="https://github.com/jimsalterjrs/ioztat" rel="nofollow">ioztat is a storage load analysis tool for OpenZFS</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/441/feedback/Scott%20-%20esxi.md" rel="nofollow">Scott - esxi</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/441/feedback/The%20Holm%20-%20noob%20question.md" rel="nofollow">The Holm - noob question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Migrating our servers from Linux to FreeBSD, Cluster provisioning with Nomad and Pot on FreeBSD, LibBSDDialog, FreeBSD 13.0 Base Jails with ZFS and VNET, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://it-notes.dragas.net/2022/01/24/why-were-migrating-many-of-our-servers-from-linux-to-freebsd/" rel="nofollow">Why we&#39;re migrating (many of) our servers from Linux to FreeBSD</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/cluster-provisioning-with-nomad-and-pot-on-freebsd/" rel="nofollow">Cluster provisioning with Nomad and Pot on FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://alfonsosiciliano.gitlab.io/posts/2022-01-16-libbsddialog.html" rel="nofollow">LibBSDDialog</a></h3>

<hr>

<h3><a href="https://randomnixfix.wordpress.com/2022/01/15/freebsd-13-0-base-jails-with-zfs-and-vnet/" rel="nofollow">FreeBSD 13.0 Base Jails with ZFS and VNET</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.exoticsilicon.com/crystal/pinephone_openbsd" rel="nofollow">OpenBSD on the Pinephone</a></li>
<li><a href="https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11" rel="nofollow">FreeBSD SSH Hardening</a></li>
<li><a href="https://changelog.com/podcast/475" rel="nofollow">Making the ZFS file system</a></li>
<li><a href="https://www.youtube.com/watch?v=ukTOfcu1e0w" rel="nofollow">A Linux Users Experience Switching To OpenBSD</a></li>
<li><a href="https://svnweb.freebsd.org/ports?view=revision&revision=550026" rel="nofollow">Add Nix, a purely functional package manager to FreeBSD</a></li>
<li><a href="https://github.com/jimsalterjrs/ioztat" rel="nofollow">ioztat is a storage load analysis tool for OpenZFS</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/441/feedback/Scott%20-%20esxi.md" rel="nofollow">Scott - esxi</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/441/feedback/The%20Holm%20-%20noob%20question.md" rel="nofollow">The Holm - noob question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>440: BSD Inside Zone</title>
  <link>https://www.bsdnow.tv/440</link>
  <guid isPermaLink="false">ff88573d-93b8-4efc-bf5c-5acd4ac555af</guid>
  <pubDate>Thu, 03 Feb 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ff88573d-93b8-4efc-bf5c-5acd4ac555af.mp3" length="26393592" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>GhostBSD 22.01 is available, Packet Scheduling with Dummynet and FreeBSD, Inside zone installation, Why the FreeBSD Desktop and my Linux Rant, How to install Gnome on OpenBSD, The important Unix idea of the "virtual filesystem switch", and more.</itunes:subtitle>
  <itunes:duration>44:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>GhostBSD 22.01 is available, Packet Scheduling with Dummynet and FreeBSD, Inside zone installation, Why the FreeBSD Desktop and my Linux Rant, How to install Gnome on OpenBSD, The important Unix idea of the "virtual filesystem switch", and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
GhostBSD 22.01 is available (https://www.ghostbsd.org/ghostbsd_22.01.12_iso_is_now_available)
Packet Scheduling with Dummynet and FreeBSD (https://klarasystems.com/articles/packet-scheduling-with-dummynet-and-freebsd/)
News Roundup
Inside zone installation (https://ptribble.blogspot.com/2022/01/inside-zone-installation.html)
Why the FreeBSD Desktop and my Linux Rant (https://randomnixfix.wordpress.com/2021/10/23/why-the-freebsd-desktop-and-my-linux-rant/)
How to install Gnome on OpenBSD (https://dataswamp.org/~solene/2021-05-07-openbsd-gnome.html)
The important Unix idea of the "virtual filesystem switch" (https://utcc.utoronto.ca/~cks/space/blog/unix/VFSImportance)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Paul - A Plug (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Paul%20-%20A%20Plug.md)
Rollniak - Bhyve Questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Rollniak%20-%20Bhyve%20Questions.md)
Russell - pf pointers (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Russell%20-%20pf%20pointers.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, GhostBSD, packet scheduling, dummynet, inside zone, installation, desktop, linux rant, gnome, virtual filesystem switch, vfs </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>GhostBSD 22.01 is available, Packet Scheduling with Dummynet and FreeBSD, Inside zone installation, Why the FreeBSD Desktop and my Linux Rant, How to install Gnome on OpenBSD, The important Unix idea of the &quot;virtual filesystem switch&quot;, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.ghostbsd.org/ghostbsd_22.01.12_iso_is_now_available" rel="nofollow">GhostBSD 22.01 is available</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/packet-scheduling-with-dummynet-and-freebsd/" rel="nofollow">Packet Scheduling with Dummynet and FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://ptribble.blogspot.com/2022/01/inside-zone-installation.html" rel="nofollow">Inside zone installation</a></h3>

<hr>

<h3><a href="https://randomnixfix.wordpress.com/2021/10/23/why-the-freebsd-desktop-and-my-linux-rant/" rel="nofollow">Why the FreeBSD Desktop and my Linux Rant</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-05-07-openbsd-gnome.html" rel="nofollow">How to install Gnome on OpenBSD</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/VFSImportance" rel="nofollow">The important Unix idea of the &quot;virtual filesystem switch&quot;</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Paul%20-%20A%20Plug.md" rel="nofollow">Paul - A Plug</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Rollniak%20-%20Bhyve%20Questions.md" rel="nofollow">Rollniak - Bhyve Questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Russell%20-%20pf%20pointers.md" rel="nofollow">Russell - pf pointers</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>GhostBSD 22.01 is available, Packet Scheduling with Dummynet and FreeBSD, Inside zone installation, Why the FreeBSD Desktop and my Linux Rant, How to install Gnome on OpenBSD, The important Unix idea of the &quot;virtual filesystem switch&quot;, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.ghostbsd.org/ghostbsd_22.01.12_iso_is_now_available" rel="nofollow">GhostBSD 22.01 is available</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/packet-scheduling-with-dummynet-and-freebsd/" rel="nofollow">Packet Scheduling with Dummynet and FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://ptribble.blogspot.com/2022/01/inside-zone-installation.html" rel="nofollow">Inside zone installation</a></h3>

<hr>

<h3><a href="https://randomnixfix.wordpress.com/2021/10/23/why-the-freebsd-desktop-and-my-linux-rant/" rel="nofollow">Why the FreeBSD Desktop and my Linux Rant</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-05-07-openbsd-gnome.html" rel="nofollow">How to install Gnome on OpenBSD</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/VFSImportance" rel="nofollow">The important Unix idea of the &quot;virtual filesystem switch&quot;</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Paul%20-%20A%20Plug.md" rel="nofollow">Paul - A Plug</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Rollniak%20-%20Bhyve%20Questions.md" rel="nofollow">Rollniak - Bhyve Questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Russell%20-%20pf%20pointers.md" rel="nofollow">Russell - pf pointers</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>439: Browser Tab Unix</title>
  <link>https://www.bsdnow.tv/439</link>
  <guid isPermaLink="false">56286ede-3bd4-47f7-8002-c09a26263c44</guid>
  <pubDate>Thu, 27 Jan 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/56286ede-3bd4-47f7-8002-c09a26263c44.mp3" length="25965648" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>ACM: It takes a community, Don’t use discord for OSS projects, Unix in a browser tab, OpenIndiana Hipster 2021.10 available, Omni OS CE v11 is out, and more.</itunes:subtitle>
  <itunes:duration>39:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>ACM: It takes a community, Don’t use discord for OSS projects, Unix in a browser tab, OpenIndiana Hipster 2021.10 available, Omni OS CE v11 is out, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
It takes a community - ACM (https://queue.acm.org/detail.cfm?id=3501361)
PSA: Dont use Discord for Open Source Projects
Jeffrey Paul - Discord Is Not An Acceptable Choice For Free Software Projects (https://sneak.berlin/20200220/discord-is-not-an-acceptable-choice-for-free-software-projects/)
Drew deVault - Dont use Discord for FOSS (https://drewdevault.com/2021/12/28/Dont-use-Discord-for-FOSS.html)
News Roundup
Unix in your Browser Tab (https://browsix.org/)
OpenIndiana Hipster 2021.10 is here (https://www.openindiana.org/2021/12/05/openindiana-hipster-2021-10-is-here/)
Omni OS CE v11 r151040 is out (https://github.com/omniosorg/omnios-build/blob/r151040/doc/ReleaseNotes.md)
Beastie Bits
Deb from the FreeBSD Foundation on FLOSS Weekly (https://twit.tv/shows/floss-weekly/episodes/662?autostart=false)
Jailfox - BastilleBSD template to bootstrap Firefox. (https://github.com/ddowse/jailfox)
FreeBSD Journal Nov/Dec 2021 (https://freebsdfoundation.org/past-issues/storage-2/)
First call through the 3ESS (https://www.youtube.com/watch?v=WUUsAK21f20)
OpenBSD for minimalists (https://github.com/krzysztofengineer/openbsd)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Dale - two zfs questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Dale%20-%20two%20zfs%20questions.md)
Johnny - home question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Johnny%20-%20home%20question.md)
Mike - GhostBSD in a VM (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Mike%20-%20GhostBSD%20in%20a%20VM.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, ACM, community, discord, browser tab, openindiana hipster, omni OS CE</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>ACM: It takes a community, Don’t use discord for OSS projects, Unix in a browser tab, OpenIndiana Hipster 2021.10 available, Omni OS CE v11 is out, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://queue.acm.org/detail.cfm?id=3501361" rel="nofollow">It takes a community - ACM</a></h3>

<hr>

<h3>PSA: Dont use Discord for Open Source Projects</h3>

<ul>
<li><a href="https://sneak.berlin/20200220/discord-is-not-an-acceptable-choice-for-free-software-projects/" rel="nofollow">Jeffrey Paul - Discord Is Not An Acceptable Choice For Free Software Projects</a></li>
<li><a href="https://drewdevault.com/2021/12/28/Dont-use-Discord-for-FOSS.html" rel="nofollow">Drew deVault - Dont use Discord for FOSS</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<hr>

<h3><a href="https://browsix.org/" rel="nofollow">Unix in your Browser Tab</a></h3>

<hr>

<h3><a href="https://www.openindiana.org/2021/12/05/openindiana-hipster-2021-10-is-here/" rel="nofollow">OpenIndiana Hipster 2021.10 is here</a></h3>

<hr>

<h3><a href="https://github.com/omniosorg/omnios-build/blob/r151040/doc/ReleaseNotes.md" rel="nofollow">Omni OS CE v11 r151040 is out</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twit.tv/shows/floss-weekly/episodes/662?autostart=false" rel="nofollow">Deb from the FreeBSD Foundation on FLOSS Weekly</a></li>
<li><a href="https://github.com/ddowse/jailfox" rel="nofollow">Jailfox - BastilleBSD template to bootstrap Firefox.</a></li>
<li><a href="https://freebsdfoundation.org/past-issues/storage-2/" rel="nofollow">FreeBSD Journal Nov/Dec 2021</a></li>
<li><a href="https://www.youtube.com/watch?v=WUUsAK21f20" rel="nofollow">First call through the 3ESS</a></li>
<li><a href="https://github.com/krzysztofengineer/openbsd" rel="nofollow">OpenBSD for minimalists</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Dale%20-%20two%20zfs%20questions.md" rel="nofollow">Dale - two zfs questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Johnny%20-%20home%20question.md" rel="nofollow">Johnny - home question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Mike%20-%20GhostBSD%20in%20a%20VM.md" rel="nofollow">Mike - GhostBSD in a VM</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>ACM: It takes a community, Don’t use discord for OSS projects, Unix in a browser tab, OpenIndiana Hipster 2021.10 available, Omni OS CE v11 is out, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://queue.acm.org/detail.cfm?id=3501361" rel="nofollow">It takes a community - ACM</a></h3>

<hr>

<h3>PSA: Dont use Discord for Open Source Projects</h3>

<ul>
<li><a href="https://sneak.berlin/20200220/discord-is-not-an-acceptable-choice-for-free-software-projects/" rel="nofollow">Jeffrey Paul - Discord Is Not An Acceptable Choice For Free Software Projects</a></li>
<li><a href="https://drewdevault.com/2021/12/28/Dont-use-Discord-for-FOSS.html" rel="nofollow">Drew deVault - Dont use Discord for FOSS</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<hr>

<h3><a href="https://browsix.org/" rel="nofollow">Unix in your Browser Tab</a></h3>

<hr>

<h3><a href="https://www.openindiana.org/2021/12/05/openindiana-hipster-2021-10-is-here/" rel="nofollow">OpenIndiana Hipster 2021.10 is here</a></h3>

<hr>

<h3><a href="https://github.com/omniosorg/omnios-build/blob/r151040/doc/ReleaseNotes.md" rel="nofollow">Omni OS CE v11 r151040 is out</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twit.tv/shows/floss-weekly/episodes/662?autostart=false" rel="nofollow">Deb from the FreeBSD Foundation on FLOSS Weekly</a></li>
<li><a href="https://github.com/ddowse/jailfox" rel="nofollow">Jailfox - BastilleBSD template to bootstrap Firefox.</a></li>
<li><a href="https://freebsdfoundation.org/past-issues/storage-2/" rel="nofollow">FreeBSD Journal Nov/Dec 2021</a></li>
<li><a href="https://www.youtube.com/watch?v=WUUsAK21f20" rel="nofollow">First call through the 3ESS</a></li>
<li><a href="https://github.com/krzysztofengineer/openbsd" rel="nofollow">OpenBSD for minimalists</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Dale%20-%20two%20zfs%20questions.md" rel="nofollow">Dale - two zfs questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Johnny%20-%20home%20question.md" rel="nofollow">Johnny - home question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Mike%20-%20GhostBSD%20in%20a%20VM.md" rel="nofollow">Mike - GhostBSD in a VM</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>438: Toolchain Adventures</title>
  <link>https://www.bsdnow.tv/438</link>
  <guid isPermaLink="false">7df88bb7-d7e9-4dbf-945e-7c15b4d4d963</guid>
  <pubDate>Thu, 20 Jan 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7df88bb7-d7e9-4dbf-945e-7c15b4d4d963.mp3" length="29848512" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Foundation reviews 2021 activities, DragonflyBSD 6.2.1 is here, Lumina Desktop 1.6.2 available, toolchain adventures, The OpenBSD BASED Challenge Day 7, Bastille Template: AdGuard Home, setting up ZSH on FreeBSD and more.</itunes:subtitle>
  <itunes:duration>46:35</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Foundation reviews 2021 activities, DragonflyBSD 6.2.1 is here, Lumina Desktop 1.6.2 available, toolchain adventures, The OpenBSD BASED Challenge Day 7, Bastille Template: AdGuard Home, setting up ZSH on FreeBSD and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Foundation 2021 in Review
Software Development (https://freebsdfoundation.org/blog/2021-in-review-software-development/)
Year End Fundraising Report (https://freebsdfoundation.org/blog/2021-year-end-fundraising-report/)
Infrastructure Support (https://freebsdfoundation.org/blog/2021-in-review-infrastructure-support/)
Advocacy (https://freebsdfoundation.org/blog/2021-in-review-advocacy/)
FreeBSD 2022 CfP (https://freebsdfoundation.org/blog/freebsd-foundation-2022-call-for-proposals/)
DragonFlyBSD 6.2.1 is out (https://www.dragonflybsd.org/release62/)
News Roundup
Lumina Desktop 1.6.2 is out (https://lumina-desktop.org/post/2021-12-25/)
Toolchain Adventures (https://www.cambus.net/toolchains-adventures-q4-2021/)
The OpenBSD BASED Challenge Day 7 (https://write.as/adventures-in-bsd/)
Bastille Template: AdGuard Home (https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/)
Setting up ZSH on FreeBSD (https://www.danschmid.me/article/setting-up-zsh-on-freebsd)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
• Producers Note:  We did get some Christmas AMA questions in after we recorded that episode (since we recorded it early) but don't worry, I’ve made a note of them and we’ll save them for our next AMA episode. 
Patrick - Volume (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/Patrick%20-%20Volume.md)
Reptilicus Rex - FreeBSD Docs Team (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/Reptilicus%20Rex%20-%20FreeBSD%20Docs%20Team.md)
michael - question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/michael%20-%20question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, foundation, fundraising, end of year, review, lumina desktop, toolchain, adventure, BASED challenge, bastille, template, adguard home, zsh</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Foundation reviews 2021 activities, DragonflyBSD 6.2.1 is here, Lumina Desktop 1.6.2 available, toolchain adventures, The OpenBSD BASED Challenge Day 7, Bastille Template: AdGuard Home, setting up ZSH on FreeBSD and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3>FreeBSD Foundation 2021 in Review</h3>

<ul>
<li><a href="https://freebsdfoundation.org/blog/2021-in-review-software-development/" rel="nofollow">Software Development</a></li>
<li><a href="https://freebsdfoundation.org/blog/2021-year-end-fundraising-report/" rel="nofollow">Year End Fundraising Report</a></li>
<li><a href="https://freebsdfoundation.org/blog/2021-in-review-infrastructure-support/" rel="nofollow">Infrastructure Support</a></li>
<li><a href="https://freebsdfoundation.org/blog/2021-in-review-advocacy/" rel="nofollow">Advocacy</a></li>
<li><a href="https://freebsdfoundation.org/blog/freebsd-foundation-2022-call-for-proposals/" rel="nofollow">FreeBSD 2022 CfP</a></li>
</ul>

<hr>

<h3><a href="https://www.dragonflybsd.org/release62/" rel="nofollow">DragonFlyBSD 6.2.1 is out</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lumina-desktop.org/post/2021-12-25/" rel="nofollow">Lumina Desktop 1.6.2 is out</a></h3>

<hr>

<h3><a href="https://www.cambus.net/toolchains-adventures-q4-2021/" rel="nofollow">Toolchain Adventures</a></h3>

<hr>

<h3><a href="https://write.as/adventures-in-bsd/" rel="nofollow">The OpenBSD BASED Challenge Day 7</a></h3>

<hr>

<h3><a href="https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/" rel="nofollow">Bastille Template: AdGuard Home</a></h3>

<hr>

<h3><a href="https://www.danschmid.me/article/setting-up-zsh-on-freebsd" rel="nofollow">Setting up ZSH on FreeBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• Producers Note:  We did get some Christmas AMA questions in after we recorded that episode (since we recorded it early) but don&#39;t worry, I’ve made a note of them and we’ll save them for our next AMA episode. 
</code></pre>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/Patrick%20-%20Volume.md" rel="nofollow">Patrick - Volume</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/Reptilicus%20Rex%20-%20FreeBSD%20Docs%20Team.md" rel="nofollow">Reptilicus Rex - FreeBSD Docs Team</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/michael%20-%20question.md" rel="nofollow">michael - question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Foundation reviews 2021 activities, DragonflyBSD 6.2.1 is here, Lumina Desktop 1.6.2 available, toolchain adventures, The OpenBSD BASED Challenge Day 7, Bastille Template: AdGuard Home, setting up ZSH on FreeBSD and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3>FreeBSD Foundation 2021 in Review</h3>

<ul>
<li><a href="https://freebsdfoundation.org/blog/2021-in-review-software-development/" rel="nofollow">Software Development</a></li>
<li><a href="https://freebsdfoundation.org/blog/2021-year-end-fundraising-report/" rel="nofollow">Year End Fundraising Report</a></li>
<li><a href="https://freebsdfoundation.org/blog/2021-in-review-infrastructure-support/" rel="nofollow">Infrastructure Support</a></li>
<li><a href="https://freebsdfoundation.org/blog/2021-in-review-advocacy/" rel="nofollow">Advocacy</a></li>
<li><a href="https://freebsdfoundation.org/blog/freebsd-foundation-2022-call-for-proposals/" rel="nofollow">FreeBSD 2022 CfP</a></li>
</ul>

<hr>

<h3><a href="https://www.dragonflybsd.org/release62/" rel="nofollow">DragonFlyBSD 6.2.1 is out</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lumina-desktop.org/post/2021-12-25/" rel="nofollow">Lumina Desktop 1.6.2 is out</a></h3>

<hr>

<h3><a href="https://www.cambus.net/toolchains-adventures-q4-2021/" rel="nofollow">Toolchain Adventures</a></h3>

<hr>

<h3><a href="https://write.as/adventures-in-bsd/" rel="nofollow">The OpenBSD BASED Challenge Day 7</a></h3>

<hr>

<h3><a href="https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/" rel="nofollow">Bastille Template: AdGuard Home</a></h3>

<hr>

<h3><a href="https://www.danschmid.me/article/setting-up-zsh-on-freebsd" rel="nofollow">Setting up ZSH on FreeBSD</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• Producers Note:  We did get some Christmas AMA questions in after we recorded that episode (since we recorded it early) but don&#39;t worry, I’ve made a note of them and we’ll save them for our next AMA episode. 
</code></pre>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/Patrick%20-%20Volume.md" rel="nofollow">Patrick - Volume</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/Reptilicus%20Rex%20-%20FreeBSD%20Docs%20Team.md" rel="nofollow">Reptilicus Rex - FreeBSD Docs Team</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/michael%20-%20question.md" rel="nofollow">michael - question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>437: Audit that package</title>
  <link>https://www.bsdnow.tv/437</link>
  <guid isPermaLink="false">3e7f064f-6f8f-49ee-a2e6-6300007b7a88</guid>
  <pubDate>Thu, 13 Jan 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3e7f064f-6f8f-49ee-a2e6-6300007b7a88.mp3" length="24973752" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Using FreeBSD’s pkg-audit, 20 year old bug that went to Mars, FreeBSD on Slimbook, LLDB FreeBSD kernel core dump support, Steam on OpenBSD, Cool but obscure X11 tools, and more 
</itunes:subtitle>
  <itunes:duration>41:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description> Using FreeBSD’s pkg-audit, 20 year old bug that went to Mars, FreeBSD on Slimbook, LLDB FreeBSD kernel core dump support, Steam on OpenBSD, Cool but obscure X11 tools, and more 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Using FreeBSD’s pkg-audit (https://klarasystems.com/articles/using-freebsds-pkg-audit-to-investigate-known-security-issues/)
The 20 year old bug that went to Mars (http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html)
It's rare that you come across a bug so subtle that it can last for two decades. But, that's exactly what has happened with the Lempel-Ziv-Oberhumer (LZO) algorithm. Initially written in 1994, Markus Oberhumer designed a sophisticated and extremely efficient compression algorithm so elegant and well architected that it outperforms zlib and bzip by four or five times their decompression speed.
I was impressed to find out that his LZO algorithm has gone to the planet Mars on NASA devices multiple times! Most recently, LZO has touched down on the red planet within the Mars Curiosity Rover, which just celebrated its first martian anniversary on Tuesday.
In the past few years, LZO has gained traction in file systems as well. LZO can be used in the Linux kernel within btrfs, squashfs, jffs2, and ubifs. A recent variant of the algorithm, LZ4, is used for compression in ZFS for Solaris, Illumos, and FreeBSD.
With its popularity increasing, Lempel-Ziv-Oberhumer has been rewritten by many engineering firms for both closed and open systems. These rewrites, however, have always been based on Oberhumer's core open source implementation. As a result, they all inherited a subtle integer overflow. Even LZ4 has the same exact bug, but changed very slightly.
Because the LZO algorithm is considered a library function, each specific implementation must be evaluated for risk, regardless of whether the algorithm used has been patched. Why? We are talking about code that has existed in the wild for two decades. The scope of this algorithm touches everything from embedded microcontrollers on the Mars Rover, mainframe operating systems, modern day desktops, and mobile phones. Engineers that have used LZO must evaluate the use case to identify whether or not the implementation is vulnerable, and in what format.
News Roundup
FreeBSD on Slimbook -- 14 months of updates (https://euroquis.nl/freebsd/2021/12/11/slimbook.html)
LLDB FreeBSD kernel core dump support (https://www.moritz.systems/blog/lldb-freebsd-kernel-core-dump-support/)
Steam on OpenBSD (https://dataswamp.org/~solene/2021-12-01-openbsd-steam.html)
Beastie Bits
• [OpenSSH Agent Restriction](http://undeadly.org/cgi?action=article;sid=20211220061017)
• [OpenBSD’s Clang upgraded to version 13](http://undeadly.org/cgi?action=article;sid=20211220060327)
• [Cool, but obscure X11 tools](http://cyber.dabamos.de/unix/x11/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, pkg-audit, security, auditing, bug, mars, slimbook, porting, port, lldb, kernel core dump, dump support, steam, games, gaming, obscure, x11 tools</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Using FreeBSD’s pkg-audit, 20 year old bug that went to Mars, FreeBSD on Slimbook, LLDB FreeBSD kernel core dump support, Steam on OpenBSD, Cool but obscure X11 tools, and more </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/using-freebsds-pkg-audit-to-investigate-known-security-issues/" rel="nofollow">Using FreeBSD’s pkg-audit</a></h3>

<hr>

<h3><a href="http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html" rel="nofollow">The 20 year old bug that went to Mars</a></h3>

<blockquote>
<p>It&#39;s rare that you come across a bug so subtle that it can last for two decades. But, that&#39;s exactly what has happened with the Lempel-Ziv-Oberhumer (LZO) algorithm. Initially written in 1994, Markus Oberhumer designed a sophisticated and extremely efficient compression algorithm so elegant and well architected that it outperforms zlib and bzip by four or five times their decompression speed.</p>

<p>I was impressed to find out that his LZO algorithm has gone to the planet Mars on NASA devices multiple times! Most recently, LZO has touched down on the red planet within the Mars Curiosity Rover, which just celebrated its first martian anniversary on Tuesday.</p>

<p>In the past few years, LZO has gained traction in file systems as well. LZO can be used in the Linux kernel within btrfs, squashfs, jffs2, and ubifs. A recent variant of the algorithm, LZ4, is used for compression in ZFS for Solaris, Illumos, and FreeBSD.</p>

<p>With its popularity increasing, Lempel-Ziv-Oberhumer has been rewritten by many engineering firms for both closed and open systems. These rewrites, however, have always been based on Oberhumer&#39;s core open source implementation. As a result, they all inherited a subtle integer overflow. Even LZ4 has the same exact bug, but changed very slightly.</p>

<p>Because the LZO algorithm is considered a library function, each specific implementation must be evaluated for risk, regardless of whether the algorithm used has been patched. Why? We are talking about code that has existed in the wild for two decades. The scope of this algorithm touches everything from embedded microcontrollers on the Mars Rover, mainframe operating systems, modern day desktops, and mobile phones. Engineers that have used LZO must evaluate the use case to identify whether or not the implementation is vulnerable, and in what format.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://euroquis.nl/freebsd/2021/12/11/slimbook.html" rel="nofollow">FreeBSD on Slimbook -- 14 months of updates</a></h3>

<hr>

<h3><a href="https://www.moritz.systems/blog/lldb-freebsd-kernel-core-dump-support/" rel="nofollow">LLDB FreeBSD kernel core dump support</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-12-01-openbsd-steam.html" rel="nofollow">Steam on OpenBSD</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [OpenSSH Agent Restriction](http://undeadly.org/cgi?action=article;sid=20211220061017)
• [OpenBSD’s Clang upgraded to version 13](http://undeadly.org/cgi?action=article;sid=20211220060327)
• [Cool, but obscure X11 tools](http://cyber.dabamos.de/unix/x11/)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Using FreeBSD’s pkg-audit, 20 year old bug that went to Mars, FreeBSD on Slimbook, LLDB FreeBSD kernel core dump support, Steam on OpenBSD, Cool but obscure X11 tools, and more </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/using-freebsds-pkg-audit-to-investigate-known-security-issues/" rel="nofollow">Using FreeBSD’s pkg-audit</a></h3>

<hr>

<h3><a href="http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html" rel="nofollow">The 20 year old bug that went to Mars</a></h3>

<blockquote>
<p>It&#39;s rare that you come across a bug so subtle that it can last for two decades. But, that&#39;s exactly what has happened with the Lempel-Ziv-Oberhumer (LZO) algorithm. Initially written in 1994, Markus Oberhumer designed a sophisticated and extremely efficient compression algorithm so elegant and well architected that it outperforms zlib and bzip by four or five times their decompression speed.</p>

<p>I was impressed to find out that his LZO algorithm has gone to the planet Mars on NASA devices multiple times! Most recently, LZO has touched down on the red planet within the Mars Curiosity Rover, which just celebrated its first martian anniversary on Tuesday.</p>

<p>In the past few years, LZO has gained traction in file systems as well. LZO can be used in the Linux kernel within btrfs, squashfs, jffs2, and ubifs. A recent variant of the algorithm, LZ4, is used for compression in ZFS for Solaris, Illumos, and FreeBSD.</p>

<p>With its popularity increasing, Lempel-Ziv-Oberhumer has been rewritten by many engineering firms for both closed and open systems. These rewrites, however, have always been based on Oberhumer&#39;s core open source implementation. As a result, they all inherited a subtle integer overflow. Even LZ4 has the same exact bug, but changed very slightly.</p>

<p>Because the LZO algorithm is considered a library function, each specific implementation must be evaluated for risk, regardless of whether the algorithm used has been patched. Why? We are talking about code that has existed in the wild for two decades. The scope of this algorithm touches everything from embedded microcontrollers on the Mars Rover, mainframe operating systems, modern day desktops, and mobile phones. Engineers that have used LZO must evaluate the use case to identify whether or not the implementation is vulnerable, and in what format.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://euroquis.nl/freebsd/2021/12/11/slimbook.html" rel="nofollow">FreeBSD on Slimbook -- 14 months of updates</a></h3>

<hr>

<h3><a href="https://www.moritz.systems/blog/lldb-freebsd-kernel-core-dump-support/" rel="nofollow">LLDB FreeBSD kernel core dump support</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-12-01-openbsd-steam.html" rel="nofollow">Steam on OpenBSD</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [OpenSSH Agent Restriction](http://undeadly.org/cgi?action=article;sid=20211220061017)
• [OpenBSD’s Clang upgraded to version 13](http://undeadly.org/cgi?action=article;sid=20211220060327)
• [Cool, but obscure X11 tools](http://cyber.dabamos.de/unix/x11/)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>436: Unix Standards Battle</title>
  <link>https://www.bsdnow.tv/436</link>
  <guid isPermaLink="false">5603c389-e7e5-4b55-ae6e-9ba425abfb2b</guid>
  <pubDate>Thu, 06 Jan 2022 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5603c389-e7e5-4b55-ae6e-9ba425abfb2b.mp3" length="27911640" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>UNIX Wars, What every IT person needs to know about OpenBSD Part 3, FreeBSD 12.3 is here, TrueNAS 13 begins, what Unix pre-boot envs looked liked, run Unix on Microcontrollers with PDP-11 emulators and more.</itunes:subtitle>
  <itunes:duration>43:32</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>UNIX Wars, What every IT person needs to know about OpenBSD Part 3, FreeBSD 12.3 is here, TrueNAS 13 begins, what Unix pre-boot envs looked liked, run Unix on Microcontrollers with PDP-11 emulators and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
UNIX Wars – The Battle for Standards (https://klarasystems.com/articles/unix-wars-the-battle-for-standards/)
What every IT person needs to know about OpenBSD Part 3: That packet filter (https://blog.apnic.net/2021/11/11/openbsd-part-3-that-packet-filter/)
FreeBSD 12.3-RELEASE Release Notes (https://www.freebsd.org/releases/12.3R/relnotes/)
News Roundup
TrueNAS 12.0-U7 is Released &amp;amp; TrueNAS 13.0 Begins (https://www.ixsystems.com/blog/truenas-12-0-u7-is-released-truenas-13-0-begins/)
A bit on what Unix system pre-boot environments used to look like (https://utcc.utoronto.ca/~cks/space/blog/unix/UnixPreBootEnvironments)
RUN UNIX ON MICROCONTROLLERS WITH PDP-11 EMULATOR (https://hackaday.com/2021/11/19/run-unix-on-microcontrollers-with-pdp-11-emulator/)
Beastie Bits
• [BSDCan 2022 is a go.](https://www.bsdcan.org/2022/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, wars, standards, battle, pf, packet filter, FreeBSD 12.3, truenas 13, pre-boot environment, microcontroller, pdp-11, emulator</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>UNIX Wars, What every IT person needs to know about OpenBSD Part 3, FreeBSD 12.3 is here, TrueNAS 13 begins, what Unix pre-boot envs looked liked, run Unix on Microcontrollers with PDP-11 emulators and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/unix-wars-the-battle-for-standards/" rel="nofollow">UNIX Wars – The Battle for Standards</a></h3>

<hr>

<h3><a href="https://blog.apnic.net/2021/11/11/openbsd-part-3-that-packet-filter/" rel="nofollow">What every IT person needs to know about OpenBSD Part 3: That packet filter</a></h3>

<hr>

<h3><a href="https://www.freebsd.org/releases/12.3R/relnotes/" rel="nofollow">FreeBSD 12.3-RELEASE Release Notes</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.ixsystems.com/blog/truenas-12-0-u7-is-released-truenas-13-0-begins/" rel="nofollow">TrueNAS 12.0-U7 is Released &amp; TrueNAS 13.0 Begins</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/UnixPreBootEnvironments" rel="nofollow">A bit on what Unix system pre-boot environments used to look like</a></h3>

<hr>

<h3><a href="https://hackaday.com/2021/11/19/run-unix-on-microcontrollers-with-pdp-11-emulator/" rel="nofollow">RUN UNIX ON MICROCONTROLLERS WITH PDP-11 EMULATOR</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [BSDCan 2022 is a go.](https://www.bsdcan.org/2022/)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>UNIX Wars, What every IT person needs to know about OpenBSD Part 3, FreeBSD 12.3 is here, TrueNAS 13 begins, what Unix pre-boot envs looked liked, run Unix on Microcontrollers with PDP-11 emulators and more.</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/unix-wars-the-battle-for-standards/" rel="nofollow">UNIX Wars – The Battle for Standards</a></h3>

<hr>

<h3><a href="https://blog.apnic.net/2021/11/11/openbsd-part-3-that-packet-filter/" rel="nofollow">What every IT person needs to know about OpenBSD Part 3: That packet filter</a></h3>

<hr>

<h3><a href="https://www.freebsd.org/releases/12.3R/relnotes/" rel="nofollow">FreeBSD 12.3-RELEASE Release Notes</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.ixsystems.com/blog/truenas-12-0-u7-is-released-truenas-13-0-begins/" rel="nofollow">TrueNAS 12.0-U7 is Released &amp; TrueNAS 13.0 Begins</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/UnixPreBootEnvironments" rel="nofollow">A bit on what Unix system pre-boot environments used to look like</a></h3>

<hr>

<h3><a href="https://hackaday.com/2021/11/19/run-unix-on-microcontrollers-with-pdp-11-emulator/" rel="nofollow">RUN UNIX ON MICROCONTROLLERS WITH PDP-11 EMULATOR</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [BSDCan 2022 is a go.](https://www.bsdcan.org/2022/)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>435: Year End Interview</title>
  <link>https://www.bsdnow.tv/435</link>
  <guid isPermaLink="false">96e38cf0-0975-4dd8-8eb3-c7626c45369a</guid>
  <pubDate>Thu, 30 Dec 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/96e38cf0-0975-4dd8-8eb3-c7626c45369a.mp3" length="20684232" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this last episode of 2021, we interview Solene from OpenBSD. She’s blogging about her experiences with OpenBSD on dataswamp.org, the webzine she created, how she got involved and other topics. Enjoy and best wishes for 2022! </itunes:subtitle>
  <itunes:duration>33:51</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this last episode of 2021, we interview Solene from OpenBSD. She’s blogging about her experiences with OpenBSD on dataswamp.org, the webzine she created, how she got involved and other topics. Enjoy and best wishes for 2022! 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Interview - Solene Rapenne - solene+www@dataswamp.org (mailto:solene+www@dataswamp.org) / @solene@bsd.network (@solene@bsd.network (mastodon))
https://dataswamp.org/~solene/2021-07-26-old-computer-challenge-after.html
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
Special Guest: Solène Rapenne.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, shell community, dataswamp, computer challenge, webzine, gaming, games</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this last episode of 2021, we interview Solene from OpenBSD. She’s blogging about her experiences with OpenBSD on dataswamp.org, the webzine she created, how she got involved and other topics. Enjoy and best wishes for 2022! </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interview - Solene Rapenne - <a href="mailto:solene+www@dataswamp.org" rel="nofollow">solene+www@dataswamp.org</a> / [@<a href="mailto:solene@bsd.network" rel="nofollow">solene@bsd.network</a>](@<a href="mailto:solene@bsd.network" rel="nofollow">solene@bsd.network</a> (mastodon))</h2>

<p><a href="https://dataswamp.org/%7Esolene/2021-07-26-old-computer-challenge-after.html" rel="nofollow">https://dataswamp.org/~solene/2021-07-26-old-computer-challenge-after.html</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Solène Rapenne.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this last episode of 2021, we interview Solene from OpenBSD. She’s blogging about her experiences with OpenBSD on dataswamp.org, the webzine she created, how she got involved and other topics. Enjoy and best wishes for 2022! </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interview - Solene Rapenne - <a href="mailto:solene+www@dataswamp.org" rel="nofollow">solene+www@dataswamp.org</a> / [@<a href="mailto:solene@bsd.network" rel="nofollow">solene@bsd.network</a>](@<a href="mailto:solene@bsd.network" rel="nofollow">solene@bsd.network</a> (mastodon))</h2>

<p><a href="https://dataswamp.org/%7Esolene/2021-07-26-old-computer-challenge-after.html" rel="nofollow">https://dataswamp.org/~solene/2021-07-26-old-computer-challenge-after.html</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Solène Rapenne.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>434: It’s Quiz-mas time</title>
  <link>https://www.bsdnow.tv/434</link>
  <guid isPermaLink="false">40afa2c2-e5e7-4c5c-b505-9c02dcc8953a</guid>
  <pubDate>Thu, 23 Dec 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/40afa2c2-e5e7-4c5c-b505-9c02dcc8953a.mp3" length="35359104" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this special xmas episode we let the audience interview us using questions they sent us and we’ll answer now. Tom, Allan, JT, and I are all here, so stay tuned for some interesting answers to your questions.</itunes:subtitle>
  <itunes:duration>58:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this special xmas episode we let the audience interview us using questions they sent us and we’ll answer now. Tom, Allan, JT, and I are all here, so stay tuned for some interesting answers to your questions.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Interview
Allan - allanjude@freebsd.org (mailto:allanjude@freebsd.org) / Twitter : @allanjude (https://twitter.com/allanjude)
Benedict - bcr@freebsd.org (mailto:bcr@freebsd.org) / Twitter : @bsdbcr (https://twitter.com/bsdbcr)
Tom - thj@freebsd.org (mailto:thj@freebsd.org) / Twitter : @adventureloop (https://twitter.com/adventureloop)
JT - jt@obs-sec.com (mailto:jt@obs-sec.com) / Twitter : @q5sys (https://twitter.com/q5sys)
Tarsnap
This week’s episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, special interview, host interviews, xmas</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this special xmas episode we let the audience interview us using questions they sent us and we’ll answer now. Tom, Allan, JT, and I are all here, so stay tuned for some interesting answers to your questions.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interview</h2>

<h3>Allan - <a href="mailto:allanjude@freebsd.org" rel="nofollow">allanjude@freebsd.org</a> / <a href="https://twitter.com/allanjude" rel="nofollow">Twitter : @allanjude</a></h3>

<h3>Benedict - <a href="mailto:bcr@freebsd.org" rel="nofollow">bcr@freebsd.org</a> / <a href="https://twitter.com/bsdbcr" rel="nofollow">Twitter : @bsdbcr</a></h3>

<h3>Tom - <a href="mailto:thj@freebsd.org" rel="nofollow">thj@freebsd.org</a> / <a href="https://twitter.com/adventureloop" rel="nofollow">Twitter : @adventureloop</a></h3>

<h3>JT - <a href="mailto:jt@obs-sec.com" rel="nofollow">jt@obs-sec.com</a> / <a href="https://twitter.com/q5sys" rel="nofollow">Twitter : @q5sys</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This week’s episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this special xmas episode we let the audience interview us using questions they sent us and we’ll answer now. Tom, Allan, JT, and I are all here, so stay tuned for some interesting answers to your questions.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Interview</h2>

<h3>Allan - <a href="mailto:allanjude@freebsd.org" rel="nofollow">allanjude@freebsd.org</a> / <a href="https://twitter.com/allanjude" rel="nofollow">Twitter : @allanjude</a></h3>

<h3>Benedict - <a href="mailto:bcr@freebsd.org" rel="nofollow">bcr@freebsd.org</a> / <a href="https://twitter.com/bsdbcr" rel="nofollow">Twitter : @bsdbcr</a></h3>

<h3>Tom - <a href="mailto:thj@freebsd.org" rel="nofollow">thj@freebsd.org</a> / <a href="https://twitter.com/adventureloop" rel="nofollow">Twitter : @adventureloop</a></h3>

<h3>JT - <a href="mailto:jt@obs-sec.com" rel="nofollow">jt@obs-sec.com</a> / <a href="https://twitter.com/q5sys" rel="nofollow">Twitter : @q5sys</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This week’s episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>433:  GhostBSD of Christmas</title>
  <link>https://www.bsdnow.tv/433</link>
  <guid isPermaLink="false">a47d75e2-ee2d-4fea-af03-c7e8cab86efc</guid>
  <pubDate>Thu, 16 Dec 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a47d75e2-ee2d-4fea-af03-c7e8cab86efc.mp3" length="17996472" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>GhostBSD 21.11.24 ISO available, why v7 matters so much, OpenBSD on VIA Eden X2 powered HP t510 Thin Client, OctoPkg GUI Package Manager, chdir(2) support in posix_spawn(3), install doas on FreeBSD, Access Modem's Web Interface with OPNsense, and more</itunes:subtitle>
  <itunes:duration>29:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>GhostBSD 21.11.24 ISO available, why v7 matters so much, OpenBSD on VIA Eden X2 powered HP t510 Thin Client, OctoPkg GUI Package Manager, chdir(2) support in posix_spawn(3), install doas on FreeBSD, Access Modem's Web Interface with OPNsense, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
GhostBSD 21.11.24 ISO is now available (https://www.ghostbsd.org/ghostbsd_21.11.24_iso_is_now_available)
Why v7 matters so much (https://utcc.utoronto.ca/~cks/space/blog/unix/V7WhyItMattersSoMuch)
News Roundup
OpenBSD on the VIA Eden X2 powered HP t510 Thin Client (https://www.cambus.net/openbsd-on-the-via-eden-x2-powered-hp-t510-thin-client/)
OctoPkg: A Great GUI Package Manager In FreeBSD (https://nudesystems.com/octopkg-a-great-gui-package-manager-in-freebsd/)
Project Report: Add support for chdir(2) support in posix_spawn(3) (https://blog.netbsd.org/tnf/entry/project_report_add_support_for)
How To Install doas in FreeBSD 13 (https://nudesystems.com/how-to-install-doas-in-freebsd-13/)
How to Access Your Modem's Web Interface with OPNsense (https://homenetworkguy.com/how-to/access-your-modem-web-interface-with-opnsense/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
No feedback for this episode because no one sent any in. :(
I guess we’ve answered every BSD and Unix question that everyone has.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, ghostbsd, v7, VIA, via eden, eden x2, HP, hewlett packard, t510, thin client, octopkg, gui package manager, gui, chdir, posix_spawn, web interface, modem, opnsense </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>GhostBSD 21.11.24 ISO available, why v7 matters so much, OpenBSD on VIA Eden X2 powered HP t510 Thin Client, OctoPkg GUI Package Manager, chdir(2) support in posix_spawn(3), install doas on FreeBSD, Access Modem&#39;s Web Interface with OPNsense, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.ghostbsd.org/ghostbsd_21.11.24_iso_is_now_available" rel="nofollow">GhostBSD 21.11.24 ISO is now available</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/V7WhyItMattersSoMuch" rel="nofollow">Why v7 matters so much</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.cambus.net/openbsd-on-the-via-eden-x2-powered-hp-t510-thin-client/" rel="nofollow">OpenBSD on the VIA Eden X2 powered HP t510 Thin Client</a></h3>

<hr>

<h3><a href="https://nudesystems.com/octopkg-a-great-gui-package-manager-in-freebsd/" rel="nofollow">OctoPkg: A Great GUI Package Manager In FreeBSD</a></h3>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/project_report_add_support_for" rel="nofollow">Project Report: Add support for chdir(2) support in posix_spawn(3)</a></h3>

<hr>

<h3><a href="https://nudesystems.com/how-to-install-doas-in-freebsd-13/" rel="nofollow">How To Install doas in FreeBSD 13</a></h3>

<hr>

<h3><a href="https://homenetworkguy.com/how-to/access-your-modem-web-interface-with-opnsense/" rel="nofollow">How to Access Your Modem&#39;s Web Interface with OPNsense</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p>No feedback for this episode because no one sent any in. :(<br>
I guess we’ve answered every BSD and Unix question that everyone has.</p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>GhostBSD 21.11.24 ISO available, why v7 matters so much, OpenBSD on VIA Eden X2 powered HP t510 Thin Client, OctoPkg GUI Package Manager, chdir(2) support in posix_spawn(3), install doas on FreeBSD, Access Modem&#39;s Web Interface with OPNsense, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.ghostbsd.org/ghostbsd_21.11.24_iso_is_now_available" rel="nofollow">GhostBSD 21.11.24 ISO is now available</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/V7WhyItMattersSoMuch" rel="nofollow">Why v7 matters so much</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.cambus.net/openbsd-on-the-via-eden-x2-powered-hp-t510-thin-client/" rel="nofollow">OpenBSD on the VIA Eden X2 powered HP t510 Thin Client</a></h3>

<hr>

<h3><a href="https://nudesystems.com/octopkg-a-great-gui-package-manager-in-freebsd/" rel="nofollow">OctoPkg: A Great GUI Package Manager In FreeBSD</a></h3>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/project_report_add_support_for" rel="nofollow">Project Report: Add support for chdir(2) support in posix_spawn(3)</a></h3>

<hr>

<h3><a href="https://nudesystems.com/how-to-install-doas-in-freebsd-13/" rel="nofollow">How To Install doas in FreeBSD 13</a></h3>

<hr>

<h3><a href="https://homenetworkguy.com/how-to/access-your-modem-web-interface-with-opnsense/" rel="nofollow">How to Access Your Modem&#39;s Web Interface with OPNsense</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p>No feedback for this episode because no one sent any in. :(<br>
I guess we’ve answered every BSD and Unix question that everyone has.</p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>432: Introducing OpenZFS 3.0 - Yeah</title>
  <link>https://www.bsdnow.tv/432</link>
  <guid isPermaLink="false">754bd5bc-3e7d-4431-8afb-5d1bbed709f8</guid>
  <pubDate>Thu, 09 Dec 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/754bd5bc-3e7d-4431-8afb-5d1bbed709f8.mp3" length="33615312" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>HAMBug hybrid meeting, Demystifying OpenZFS 2.0, OpenZFS 3.0 introduced at Dev Summit, HardenedBSD Home Infrastructure Status, Running Awk in parallel, FreeBSD Announces Wayland 1.19.91, and more</itunes:subtitle>
  <itunes:duration>54:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>HAMBug hybrid meeting, Demystifying OpenZFS 2.0, OpenZFS 3.0 introduced at Dev Summit, HardenedBSD Home Infrastructure Status, Running Awk in parallel, FreeBSD Announces Wayland 1.19.91, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
HAMBug hybrid meeting (http://hambug.ca/)
Hoping to squeeze in an in-person meeting incase the pandemic situation regresses
***
### Demystifying OpenZFS 2.0 (https://klarasystems.com/articles/demystifying-openzfs-2-0/)
Do you like the articles we post? We are looking for authors (or even just your ideas) to keep providing these high quality articles.
Job Posting (https://lists.freebsd.org/archives/freebsd-jobs/2021-November/000003.html)
***
### OpenZFS 3.0 Introduced at Dev Summit (https://www.ixsystems.com/blog/openzfs-3-0-introduced-at-developer-summit/)
***
### OpenZFS vdev properties feature has been merged (https://github.com/openzfs/zfs/pull/11711)
***
News Roundup
October 2021 Home Infrastructure Status (https://git.hardenedbsd.org/shawn.webb/articles/-/blob/master/personal/2021-10-20_home_infra/article.md)
Running Awk in parallel to process 256M records (https://ketancmaheshwari.github.io/posts/2020/05/24/SMC18-Data-Challenge-4.html)
FreeBSD Announce wayland 1.19.91 (https://lists.freedesktop.org/archives/wayland-devel/2021-November/042026.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - running linux binaries under FreeBSD (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Brad%20-%20running%20linux%20binaries%20under%20FreeBSD.md)
Lars - Finding BSD Topics via search engine (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Lars%20-%20Finding%20BSD%20Topics%20via%20search%20engine.md)
Marc - Your views on this question on Reddit (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Marc%20-%20Your%20views%20on%20this%20question%20on%20Reddit.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, habug, bug, bsd user group, user group, openzfs, openzfs 2.0, openzfs 3.0, developer summit, infrastructure, status update, awk, parallel processing, doas, wayland </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>HAMBug hybrid meeting, Demystifying OpenZFS 2.0, OpenZFS 3.0 introduced at Dev Summit, HardenedBSD Home Infrastructure Status, Running Awk in parallel, FreeBSD Announces Wayland 1.19.91, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="http://hambug.ca/" rel="nofollow">HAMBug hybrid meeting</a></h3>

<ul>
<li>Hoping to squeeze in an in-person meeting incase the pandemic situation regresses
***
### <a href="https://klarasystems.com/articles/demystifying-openzfs-2-0/" rel="nofollow">Demystifying OpenZFS 2.0</a></li>
<li>Do you like the articles we post? We are looking for authors (or even just your ideas) to keep providing these high quality articles.</li>
<li><a href="https://lists.freebsd.org/archives/freebsd-jobs/2021-November/000003.html" rel="nofollow">Job Posting</a>
***
### <a href="https://www.ixsystems.com/blog/openzfs-3-0-introduced-at-developer-summit/" rel="nofollow">OpenZFS 3.0 Introduced at Dev Summit</a>
***
### <a href="https://github.com/openzfs/zfs/pull/11711" rel="nofollow">OpenZFS vdev properties feature has been merged</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://git.hardenedbsd.org/shawn.webb/articles/-/blob/master/personal/2021-10-20_home_infra/article.md" rel="nofollow">October 2021 Home Infrastructure Status</a></h3>

<hr>

<h3><a href="https://ketancmaheshwari.github.io/posts/2020/05/24/SMC18-Data-Challenge-4.html" rel="nofollow">Running Awk in parallel to process 256M records</a></h3>

<hr>

<h3><a href="https://lists.freedesktop.org/archives/wayland-devel/2021-November/042026.html" rel="nofollow">FreeBSD Announce wayland 1.19.91</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Brad%20-%20running%20linux%20binaries%20under%20FreeBSD.md" rel="nofollow">Brad - running linux binaries under FreeBSD</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Lars%20-%20Finding%20BSD%20Topics%20via%20search%20engine.md" rel="nofollow">Lars - Finding BSD Topics via search engine</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Marc%20-%20Your%20views%20on%20this%20question%20on%20Reddit.md" rel="nofollow">Marc - Your views on this question on Reddit</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>HAMBug hybrid meeting, Demystifying OpenZFS 2.0, OpenZFS 3.0 introduced at Dev Summit, HardenedBSD Home Infrastructure Status, Running Awk in parallel, FreeBSD Announces Wayland 1.19.91, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="http://hambug.ca/" rel="nofollow">HAMBug hybrid meeting</a></h3>

<ul>
<li>Hoping to squeeze in an in-person meeting incase the pandemic situation regresses
***
### <a href="https://klarasystems.com/articles/demystifying-openzfs-2-0/" rel="nofollow">Demystifying OpenZFS 2.0</a></li>
<li>Do you like the articles we post? We are looking for authors (or even just your ideas) to keep providing these high quality articles.</li>
<li><a href="https://lists.freebsd.org/archives/freebsd-jobs/2021-November/000003.html" rel="nofollow">Job Posting</a>
***
### <a href="https://www.ixsystems.com/blog/openzfs-3-0-introduced-at-developer-summit/" rel="nofollow">OpenZFS 3.0 Introduced at Dev Summit</a>
***
### <a href="https://github.com/openzfs/zfs/pull/11711" rel="nofollow">OpenZFS vdev properties feature has been merged</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://git.hardenedbsd.org/shawn.webb/articles/-/blob/master/personal/2021-10-20_home_infra/article.md" rel="nofollow">October 2021 Home Infrastructure Status</a></h3>

<hr>

<h3><a href="https://ketancmaheshwari.github.io/posts/2020/05/24/SMC18-Data-Challenge-4.html" rel="nofollow">Running Awk in parallel to process 256M records</a></h3>

<hr>

<h3><a href="https://lists.freedesktop.org/archives/wayland-devel/2021-November/042026.html" rel="nofollow">FreeBSD Announce wayland 1.19.91</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Brad%20-%20running%20linux%20binaries%20under%20FreeBSD.md" rel="nofollow">Brad - running linux binaries under FreeBSD</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Lars%20-%20Finding%20BSD%20Topics%20via%20search%20engine.md" rel="nofollow">Lars - Finding BSD Topics via search engine</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Marc%20-%20Your%20views%20on%20this%20question%20on%20Reddit.md" rel="nofollow">Marc - Your views on this question on Reddit</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>431: FreeBSD EC2 Agents</title>
  <link>https://www.bsdnow.tv/431</link>
  <guid isPermaLink="false">3b2d65ab-f8a0-4e12-b6d1-6a257aef7511</guid>
  <pubDate>Thu, 02 Dec 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3b2d65ab-f8a0-4e12-b6d1-6a257aef7511.mp3" length="26124072" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Why use OpenBSD part 2, FreeBSD on the RISC-V Architecture, OpenBSD Webzine Issue 4, Ending up liking GNOME, OPNsense 21.7.5 released, Jenkins with FreeBSD Agents in EC2, and more</itunes:subtitle>
  <itunes:duration>43:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Why use OpenBSD part 2, FreeBSD on the RISC-V Architecture, OpenBSD Webzine Issue 4, Ending up liking GNOME, OPNsense 21.7.5 released, Jenkins with FreeBSD Agents in EC2, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
What every IT person needs to know about OpenBSD Part 2: Why use OpenBSD? (https://blog.apnic.net/2021/11/05/openbsd-part-2-why-use-openbsd/)
Looking Towards the Future: FreeBSD on the RISC-V Architecture (https://klarasystems.com/articles/looking-towards-the-future-freebsd-on-the-risc-v-architecture/)
News Roundup
OpenBSD Webzine Issue 4 (https://webzine.puffy.cafe/issue-4.html)
How I ended up liking GNOME (https://dataswamp.org/~solene/2021-11-10-how-I-ended-liking-gnome.html)
OPNsense 21.7.5 released (https://opnsense.org/opnsense-21-7-5-released/)
Jenkins with FreeBSD Agents in ec2 (https://beerdy.io/2021/10/jenkins-with-freebsd-agents-in-ec2/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Andreas - ZFS and Trim (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Andreas%20-%20ZFS%20and%20Trim.md)
Hamza - swift on the BSDs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Hamza%20-%20swift%20on%20the%20BSDs.md)
Kendall - how many mirror (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Kendall%20-%20how%20many%20mirrors.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, RISC-V architecture, webzine, gnome, opnsense, jenkins, agents, ec2</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Why use OpenBSD part 2, FreeBSD on the RISC-V Architecture, OpenBSD Webzine Issue 4, Ending up liking GNOME, OPNsense 21.7.5 released, Jenkins with FreeBSD Agents in EC2, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://blog.apnic.net/2021/11/05/openbsd-part-2-why-use-openbsd/" rel="nofollow">What every IT person needs to know about OpenBSD Part 2: Why use OpenBSD?</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/looking-towards-the-future-freebsd-on-the-risc-v-architecture/" rel="nofollow">Looking Towards the Future: FreeBSD on the RISC-V Architecture</a></h3>

<hr>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://webzine.puffy.cafe/issue-4.html" rel="nofollow">OpenBSD Webzine Issue 4</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-11-10-how-I-ended-liking-gnome.html" rel="nofollow">How I ended up liking GNOME</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-21-7-5-released/" rel="nofollow">OPNsense 21.7.5 released</a></h3>

<hr>

<h3><a href="https://beerdy.io/2021/10/jenkins-with-freebsd-agents-in-ec2/" rel="nofollow">Jenkins with FreeBSD Agents in ec2</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Andreas%20-%20ZFS%20and%20Trim.md" rel="nofollow">Andreas - ZFS and Trim</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Hamza%20-%20swift%20on%20the%20BSDs.md" rel="nofollow">Hamza - swift on the BSDs</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Kendall%20-%20how%20many%20mirrors.md" rel="nofollow">Kendall - how many mirror</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Why use OpenBSD part 2, FreeBSD on the RISC-V Architecture, OpenBSD Webzine Issue 4, Ending up liking GNOME, OPNsense 21.7.5 released, Jenkins with FreeBSD Agents in EC2, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://blog.apnic.net/2021/11/05/openbsd-part-2-why-use-openbsd/" rel="nofollow">What every IT person needs to know about OpenBSD Part 2: Why use OpenBSD?</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/looking-towards-the-future-freebsd-on-the-risc-v-architecture/" rel="nofollow">Looking Towards the Future: FreeBSD on the RISC-V Architecture</a></h3>

<hr>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://webzine.puffy.cafe/issue-4.html" rel="nofollow">OpenBSD Webzine Issue 4</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-11-10-how-I-ended-liking-gnome.html" rel="nofollow">How I ended up liking GNOME</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-21-7-5-released/" rel="nofollow">OPNsense 21.7.5 released</a></h3>

<hr>

<h3><a href="https://beerdy.io/2021/10/jenkins-with-freebsd-agents-in-ec2/" rel="nofollow">Jenkins with FreeBSD Agents in ec2</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Andreas%20-%20ZFS%20and%20Trim.md" rel="nofollow">Andreas - ZFS and Trim</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Hamza%20-%20swift%20on%20the%20BSDs.md" rel="nofollow">Hamza - swift on the BSDs</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Kendall%20-%20how%20many%20mirrors.md" rel="nofollow">Kendall - how many mirror</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>430: OpenBSD Onwards</title>
  <link>https://www.bsdnow.tv/430</link>
  <guid isPermaLink="false">a211d686-fe47-4d60-9f0d-41d44cb4af80</guid>
  <pubDate>Thu, 25 Nov 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a211d686-fe47-4d60-9f0d-41d44cb4af80.mp3" length="27077856" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Manipulate a ZFS pool from Rescue System, FreeBSD 3rd Quarter Report, Monitoring FreeBSD jails form the host, OpenBSD on RPI4 with Full Disk Encryption, Onwards with OpenBSD, and more</itunes:subtitle>
  <itunes:duration>45:46</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Manipulate a ZFS pool from Rescue System, FreeBSD 3rd Quarter Report, Monitoring FreeBSD jails form the host, OpenBSD on RPI4 with Full Disk Encryption, Onwards with OpenBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
Going From Recovery Mode to Normal Operations with OpenZFS Manipulating a Pool from the Rescue System (https://klarasystems.com/articles/manipulating-a-pool-from-the-rescue-system/)
Monitoring FreeBSD jails from the host (https://dan.langille.org/2021/10/31/monitoring-freebsd-jails-from-the-host/)
News Roundup
FreeBSD Quarterly Status Report 3rd Quarter 2021 (https://www.freebsd.org/status/report-2021-07-2021-09/)
OpenBSD on Raspberry Pi 4 with Full-Disk Encryption (http://matecha.net/posts/openbsd-on-pi-4-with-full-disk-encryption/)
Catchup 2021-11-03 (https://undeadly.org/cgi?action=article;sid=20211103080052)
Beastie Bits
• [Manage Kubernetes cluster from FreeBSD with kubectl](https://www.youtube.com/watch?v=iUxJIXKtK7c)
• [amdgpu support in DragonFly](https://www.dragonflydigest.com/2021/11/08/26343.html)
• [Today is the 50th Anniversary of the 1st Edition of Unix...](https://twitter.com/bsdimp/status/1456019089466421248?s=20)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Efraim - response to IPFS and an overlay filesystem (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/Efraim%20-%20response%20to%20IPFS%20and%20an%20overlay%20filesystem.md)
Paul - FS Send question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/Paul%20-%20FS%20Send%20question.md)
sev - Freebsd &amp;amp; IPA (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/sev%20-%20Freebsd%20%26%20IPA.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, recovery mode, rescue system, pool manipulation, Q3 status report, 2021 Q3 status, monitoring, jails, raspberry pi, full disk encryption, openbsd catchup</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Manipulate a ZFS pool from Rescue System, FreeBSD 3rd Quarter Report, Monitoring FreeBSD jails form the host, OpenBSD on RPI4 with Full Disk Encryption, Onwards with OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/manipulating-a-pool-from-the-rescue-system/" rel="nofollow">Going From Recovery Mode to Normal Operations with OpenZFS Manipulating a Pool from the Rescue System</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2021/10/31/monitoring-freebsd-jails-from-the-host/" rel="nofollow">Monitoring FreeBSD jails from the host</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.freebsd.org/status/report-2021-07-2021-09/" rel="nofollow">FreeBSD Quarterly Status Report 3rd Quarter 2021</a></h3>

<hr>

<h3><a href="http://matecha.net/posts/openbsd-on-pi-4-with-full-disk-encryption/" rel="nofollow">OpenBSD on Raspberry Pi 4 with Full-Disk Encryption</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20211103080052" rel="nofollow">Catchup 2021-11-03</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [Manage Kubernetes cluster from FreeBSD with kubectl](https://www.youtube.com/watch?v=iUxJIXKtK7c)
• [amdgpu support in DragonFly](https://www.dragonflydigest.com/2021/11/08/26343.html)
• [Today is the 50th Anniversary of the 1st Edition of Unix...](https://twitter.com/bsdimp/status/1456019089466421248?s=20)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/Efraim%20-%20response%20to%20IPFS%20and%20an%20overlay%20filesystem.md" rel="nofollow">Efraim - response to IPFS and an overlay filesystem</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/Paul%20-%20FS%20Send%20question.md" rel="nofollow">Paul - FS Send question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/sev%20-%20Freebsd%20%26%20IPA.md" rel="nofollow">sev - Freebsd &amp; IPA</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Manipulate a ZFS pool from Rescue System, FreeBSD 3rd Quarter Report, Monitoring FreeBSD jails form the host, OpenBSD on RPI4 with Full Disk Encryption, Onwards with OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/manipulating-a-pool-from-the-rescue-system/" rel="nofollow">Going From Recovery Mode to Normal Operations with OpenZFS Manipulating a Pool from the Rescue System</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2021/10/31/monitoring-freebsd-jails-from-the-host/" rel="nofollow">Monitoring FreeBSD jails from the host</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.freebsd.org/status/report-2021-07-2021-09/" rel="nofollow">FreeBSD Quarterly Status Report 3rd Quarter 2021</a></h3>

<hr>

<h3><a href="http://matecha.net/posts/openbsd-on-pi-4-with-full-disk-encryption/" rel="nofollow">OpenBSD on Raspberry Pi 4 with Full-Disk Encryption</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20211103080052" rel="nofollow">Catchup 2021-11-03</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [Manage Kubernetes cluster from FreeBSD with kubectl](https://www.youtube.com/watch?v=iUxJIXKtK7c)
• [amdgpu support in DragonFly](https://www.dragonflydigest.com/2021/11/08/26343.html)
• [Today is the 50th Anniversary of the 1st Edition of Unix...](https://twitter.com/bsdimp/status/1456019089466421248?s=20)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/Efraim%20-%20response%20to%20IPFS%20and%20an%20overlay%20filesystem.md" rel="nofollow">Efraim - response to IPFS and an overlay filesystem</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/Paul%20-%20FS%20Send%20question.md" rel="nofollow">Paul - FS Send question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/sev%20-%20Freebsd%20%26%20IPA.md" rel="nofollow">sev - Freebsd &amp; IPA</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>429: Advanced ZFS Snapshots</title>
  <link>https://www.bsdnow.tv/429</link>
  <guid isPermaLink="false">1f4cdc97-493b-4460-a6c0-a334cc96ff50</guid>
  <pubDate>Thu, 18 Nov 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1f4cdc97-493b-4460-a6c0-a334cc96ff50.mp3" length="22911048" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Foundation October Fundraising Update, Advanced ZFS Snapshots, Full WireGuard setup with OpenBSD, MidnightBSD a Linux Alternative, FreeBSD Audio, Tuning Power Consumption on FreeBSD Laptops, Thoughts on Spelling Fixes, and more.</itunes:subtitle>
  <itunes:duration>39:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Foundation October Fundraising Update, Advanced ZFS Snapshots, Full WireGuard setup with OpenBSD, MidnightBSD a Linux Alternative, FreeBSD Audio, Tuning Power Consumption on FreeBSD Laptops, Thoughts on Spelling Fixes, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
FreeBSD Foundation October 2021 Fundraising Update (https://freebsdfoundation.org/blog/freebsd-foundation-october-2021-fundraising-update/)
Advanced ZFS Snapshots (https://klarasystems.com/articles/advanced-zfs-snapshots/)
News Roundup
Full WireGuard setup with OpenBSD (https://dataswamp.org/~solene/2021-10-09-openbsd-wireguard-exit.html)
MidnightBSD a Linux Alternative (https://www.makeuseof.com/midnightbsd-linux-desktop-alternative/)
FreeBSD Audio (https://meka.rs/blog/2021/10/12/freebsd-audio/)
Tuning Power Consumption on FreeBSD Laptops and Intel Speed Shift (6th Gen and Later) (https://www.neelc.org/posts/freebsd-speed-shift-laptop/)
Some Thoughts on Spelling Fixes (http://bsdimp.blogspot.com/2021/10/spelling-fixes-some-advice.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Bens feedback to Benedict's feedback to Bens question about zpoolboy (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/Bens%20feedback%20to%20Benedicts%20feedback%20to%20Bens%20question%20about%20zpoolboy.md)
hcddbz - Old Technical Books (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/hcddbz%20-%20Old%20Technical%20Books.md)
jason - a jails question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/jason%20-%20a%20jails%20question.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, foundation, fundraising, fundraiser, snapshots, zfs snapshots, wireguard setup, midnightbsd, freebsd audio, tuning power, power consumption, laptop power, spelling fixes, typos</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Foundation October Fundraising Update, Advanced ZFS Snapshots, Full WireGuard setup with OpenBSD, MidnightBSD a Linux Alternative, FreeBSD Audio, Tuning Power Consumption on FreeBSD Laptops, Thoughts on Spelling Fixes, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/freebsd-foundation-october-2021-fundraising-update/" rel="nofollow">FreeBSD Foundation October 2021 Fundraising Update</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/advanced-zfs-snapshots/" rel="nofollow">Advanced ZFS Snapshots</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-10-09-openbsd-wireguard-exit.html" rel="nofollow">Full WireGuard setup with OpenBSD</a></h3>

<hr>

<h3><a href="https://www.makeuseof.com/midnightbsd-linux-desktop-alternative/" rel="nofollow">MidnightBSD a Linux Alternative</a></h3>

<hr>

<h3><a href="https://meka.rs/blog/2021/10/12/freebsd-audio/" rel="nofollow">FreeBSD Audio</a></h3>

<hr>

<h3><a href="https://www.neelc.org/posts/freebsd-speed-shift-laptop/" rel="nofollow">Tuning Power Consumption on FreeBSD Laptops and Intel Speed Shift (6th Gen and Later)</a></h3>

<hr>

<h3><a href="http://bsdimp.blogspot.com/2021/10/spelling-fixes-some-advice.html" rel="nofollow">Some Thoughts on Spelling Fixes</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/Bens%20feedback%20to%20Benedicts%20feedback%20to%20Bens%20question%20about%20zpoolboy.md" rel="nofollow">Bens feedback to Benedict&#39;s feedback to Bens question about zpoolboy</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/hcddbz%20-%20Old%20Technical%20Books.md" rel="nofollow">hcddbz - Old Technical Books</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/jason%20-%20a%20jails%20question.md" rel="nofollow">jason - a jails question</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Foundation October Fundraising Update, Advanced ZFS Snapshots, Full WireGuard setup with OpenBSD, MidnightBSD a Linux Alternative, FreeBSD Audio, Tuning Power Consumption on FreeBSD Laptops, Thoughts on Spelling Fixes, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://freebsdfoundation.org/blog/freebsd-foundation-october-2021-fundraising-update/" rel="nofollow">FreeBSD Foundation October 2021 Fundraising Update</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/advanced-zfs-snapshots/" rel="nofollow">Advanced ZFS Snapshots</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-10-09-openbsd-wireguard-exit.html" rel="nofollow">Full WireGuard setup with OpenBSD</a></h3>

<hr>

<h3><a href="https://www.makeuseof.com/midnightbsd-linux-desktop-alternative/" rel="nofollow">MidnightBSD a Linux Alternative</a></h3>

<hr>

<h3><a href="https://meka.rs/blog/2021/10/12/freebsd-audio/" rel="nofollow">FreeBSD Audio</a></h3>

<hr>

<h3><a href="https://www.neelc.org/posts/freebsd-speed-shift-laptop/" rel="nofollow">Tuning Power Consumption on FreeBSD Laptops and Intel Speed Shift (6th Gen and Later)</a></h3>

<hr>

<h3><a href="http://bsdimp.blogspot.com/2021/10/spelling-fixes-some-advice.html" rel="nofollow">Some Thoughts on Spelling Fixes</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/Bens%20feedback%20to%20Benedicts%20feedback%20to%20Bens%20question%20about%20zpoolboy.md" rel="nofollow">Bens feedback to Benedict&#39;s feedback to Bens question about zpoolboy</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/hcddbz%20-%20Old%20Technical%20Books.md" rel="nofollow">hcddbz - Old Technical Books</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/jason%20-%20a%20jails%20question.md" rel="nofollow">jason - a jails question</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>428: Cult of BSD</title>
  <link>https://www.bsdnow.tv/428</link>
  <guid isPermaLink="false">1d7be1ab-6939-4fcf-80da-698e14ce721d</guid>
  <pubDate>Thu, 11 Nov 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1d7be1ab-6939-4fcf-80da-698e14ce721d.mp3" length="30685968" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD Part 1: How it all started, Explaining top(1) on FreeBSD, Measuring power efficiency of a CPU frequency scheduler on OpenBSD, CultBSD, a whole lot of BSD bits, and more. </itunes:subtitle>
  <itunes:duration>54:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD Part 1: How it all started, Explaining top(1) on FreeBSD, Measuring power efficiency of a CPU frequency scheduler on OpenBSD, CultBSD, a whole lot of BSD bits, and more. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow) and the BSDNow Patreon (https://www.patreon.com/bsdnow)
Headlines
What every IT person needs to know about OpenBSD Part 1: How it all started (https://blog.apnic.net/2021/10/28/openbsd-part-1-how-it-all-started/)
Explaining top(1) on FreeBSD (https://klarasystems.com/articles/explaining-top1-on-freebsd/)
News Roundup
Measuring power efficiency of a CPU frequency scheduler on OpenBSD (https://dataswamp.org/~solene/2021-09-26-openbsd-power-usage.html)
CultBSD (https://sourceforge.net/projects/cult-bsd/)
Beastie Bits
• [OpenBSD on the HiFive Unmatched](https://kernelpanic.life/hardware/hifive-unmatched.html)
• [Advanced Documentation Retrieval on FreeBSD](https://adventurist.me/posts/00306)
• [OpenBSD Webzine Issue 3 is out](https://webzine.puffy.cafe/issue-3.html)
• [How to connect and use Bluetooth headphones on FreeBSD](https://forums.freebsd.org/threads/bluetooth-audio-how-to-connect-and-use-bluetooth-headphones-on-freebsd.82671/)
• [How To: Execute Firefox in a jail using iocage and ssh/jailme](https://forums.freebsd.org/threads/how-to-execute-firefox-in-a-jail-using-iocage-and-ssh-jailme.53362/)
• [Understanding AWK](https://earthly.dev/blog/awk-examples/)
• [“Domesticate Your Badgers” Kickstarter Opens](https://mwl.io/archives/13297)
• [Bootstrap an OPNsense development environment in Vagrant](https://github.com/punktDe/vagrant-opnsense)
• [VLANs Bridges and LAG Interface best practice questions](https://www.truenas.com/community/threads/vlans-bridges-and-lag-interface-best-practice-questions.93275/)
• [A Console Desktop](https://pspodcasting.net/dan/blog/2018/console_desktop.html)
• [CharmBUG Casual BSD Meetup and Games (Online)](https://www.meetup.com/CharmBUG/events/281822524)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Dan - ZFS question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/Dan%20-%20ZFS%20question.md)
Lars - Thanks for the interview (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/Lars%20-%20Thanks%20for%20the%20interview.md)
jesse - migrating data from old laptop (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/jesse%20-%20migrating%20data%20from%20old%20laptop.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, IT, top, measure, power, power efficiency, scheduler, cultbsd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD Part 1: How it all started, Explaining top(1) on FreeBSD, Measuring power efficiency of a CPU frequency scheduler on OpenBSD, CultBSD, a whole lot of BSD bits, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://blog.apnic.net/2021/10/28/openbsd-part-1-how-it-all-started/" rel="nofollow">What every IT person needs to know about OpenBSD Part 1: How it all started</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/explaining-top1-on-freebsd/" rel="nofollow">Explaining top(1) on FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-09-26-openbsd-power-usage.html" rel="nofollow">Measuring power efficiency of a CPU frequency scheduler on OpenBSD</a></h3>

<hr>

<h3><a href="https://sourceforge.net/projects/cult-bsd/" rel="nofollow">CultBSD</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [OpenBSD on the HiFive Unmatched](https://kernelpanic.life/hardware/hifive-unmatched.html)
• [Advanced Documentation Retrieval on FreeBSD](https://adventurist.me/posts/00306)
• [OpenBSD Webzine Issue 3 is out](https://webzine.puffy.cafe/issue-3.html)
• [How to connect and use Bluetooth headphones on FreeBSD](https://forums.freebsd.org/threads/bluetooth-audio-how-to-connect-and-use-bluetooth-headphones-on-freebsd.82671/)
• [How To: Execute Firefox in a jail using iocage and ssh/jailme](https://forums.freebsd.org/threads/how-to-execute-firefox-in-a-jail-using-iocage-and-ssh-jailme.53362/)
• [Understanding AWK](https://earthly.dev/blog/awk-examples/)
• [“Domesticate Your Badgers” Kickstarter Opens](https://mwl.io/archives/13297)
• [Bootstrap an OPNsense development environment in Vagrant](https://github.com/punktDe/vagrant-opnsense)
• [VLANs Bridges and LAG Interface best practice questions](https://www.truenas.com/community/threads/vlans-bridges-and-lag-interface-best-practice-questions.93275/)
• [A Console Desktop](https://pspodcasting.net/dan/blog/2018/console_desktop.html)
• [CharmBUG Casual BSD Meetup and Games (Online)](https://www.meetup.com/CharmBUG/events/281822524)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/Dan%20-%20ZFS%20question.md" rel="nofollow">Dan - ZFS question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/Lars%20-%20Thanks%20for%20the%20interview.md" rel="nofollow">Lars - Thanks for the interview</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/jesse%20-%20migrating%20data%20from%20old%20laptop.md" rel="nofollow">jesse - migrating data from old laptop</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD Part 1: How it all started, Explaining top(1) on FreeBSD, Measuring power efficiency of a CPU frequency scheduler on OpenBSD, CultBSD, a whole lot of BSD bits, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow">BSDNow Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://blog.apnic.net/2021/10/28/openbsd-part-1-how-it-all-started/" rel="nofollow">What every IT person needs to know about OpenBSD Part 1: How it all started</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/explaining-top1-on-freebsd/" rel="nofollow">Explaining top(1) on FreeBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-09-26-openbsd-power-usage.html" rel="nofollow">Measuring power efficiency of a CPU frequency scheduler on OpenBSD</a></h3>

<hr>

<h3><a href="https://sourceforge.net/projects/cult-bsd/" rel="nofollow">CultBSD</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [OpenBSD on the HiFive Unmatched](https://kernelpanic.life/hardware/hifive-unmatched.html)
• [Advanced Documentation Retrieval on FreeBSD](https://adventurist.me/posts/00306)
• [OpenBSD Webzine Issue 3 is out](https://webzine.puffy.cafe/issue-3.html)
• [How to connect and use Bluetooth headphones on FreeBSD](https://forums.freebsd.org/threads/bluetooth-audio-how-to-connect-and-use-bluetooth-headphones-on-freebsd.82671/)
• [How To: Execute Firefox in a jail using iocage and ssh/jailme](https://forums.freebsd.org/threads/how-to-execute-firefox-in-a-jail-using-iocage-and-ssh-jailme.53362/)
• [Understanding AWK](https://earthly.dev/blog/awk-examples/)
• [“Domesticate Your Badgers” Kickstarter Opens](https://mwl.io/archives/13297)
• [Bootstrap an OPNsense development environment in Vagrant](https://github.com/punktDe/vagrant-opnsense)
• [VLANs Bridges and LAG Interface best practice questions](https://www.truenas.com/community/threads/vlans-bridges-and-lag-interface-best-practice-questions.93275/)
• [A Console Desktop](https://pspodcasting.net/dan/blog/2018/console_desktop.html)
• [CharmBUG Casual BSD Meetup and Games (Online)](https://www.meetup.com/CharmBUG/events/281822524)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/Dan%20-%20ZFS%20question.md" rel="nofollow">Dan - ZFS question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/Lars%20-%20Thanks%20for%20the%20interview.md" rel="nofollow">Lars - Thanks for the interview</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/jesse%20-%20migrating%20data%20from%20old%20laptop.md" rel="nofollow">jesse - migrating data from old laptop</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>427: Logging is important</title>
  <link>https://www.bsdnow.tv/427</link>
  <guid isPermaLink="false">e0be5e06-7a29-4e22-9828-6a34074a48e5</guid>
  <pubDate>Thu, 04 Nov 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e0be5e06-7a29-4e22-9828-6a34074a48e5.mp3" length="27413712" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Build Your FreeBSD Developer Workstation, logging is important, how BSD authentication works, pfSense turns 15 years old, OPNsense Business Edition 21.10 released,  getting started with pot, and more</itunes:subtitle>
  <itunes:duration>43:45</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Build Your FreeBSD Developer Workstation, logging is important, how BSD authentication works, pfSense turns 15 years old, OPNsense Business Edition 21.10 released,  getting started with pot, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
If you like BSDNow, consider supporting us on Patreon (https://www.patreon.com/bsdnow)
Headlines
Building Your FreeBSD Developer Workstation Setup (https://klarasystems.com/articles/freebsd-developer-workstation-setup/)
What I learned from Russian students: logging is important (https://peter.czanik.hu/posts/russian_students_logging)
News Roundup
How BSD Authentication works (https://blog.lambda.cx/posts/how-bsd-authentication-works/)
pfSense Software is 15 Today! (https://www.netgate.com/blog/pfsense-software-is-15-today)
OPNsense® Business Edition 21.10 released (https://opnsense.org/opnsense-business-edition-21-10-released/)
Getting started with pot (https://pot.pizzamig.dev/Getting/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
## Feedback/Questions
Benjamin - Question for Benedict (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Benjamin%20-%20Question%20for%20Benedict.md)
Nelson - Episode 419 correction (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Nelson%20-%20Episode%20419%20correction.md)
Peter - state machines (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Peter%20-%20state%20machines.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, build, setup, workstation, developer, logging, log, authentication, pfsense, opnsense, pot</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Build Your FreeBSD Developer Workstation, logging is important, how BSD authentication works, pfSense turns 15 years old, OPNsense Business Edition 21.10 released,  getting started with pot, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a><br>
If you like BSDNow, consider supporting us on <a href="https://www.patreon.com/bsdnow" rel="nofollow">Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-developer-workstation-setup/" rel="nofollow">Building Your FreeBSD Developer Workstation Setup</a></h3>

<hr>

<h3><a href="https://peter.czanik.hu/posts/russian_students_logging" rel="nofollow">What I learned from Russian students: logging is important</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.lambda.cx/posts/how-bsd-authentication-works/" rel="nofollow">How BSD Authentication works</a></h3>

<hr>

<h3><a href="https://www.netgate.com/blog/pfsense-software-is-15-today" rel="nofollow">pfSense Software is 15 Today!</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-business-edition-21-10-released/" rel="nofollow">OPNsense® Business Edition 21.10 released</a></h3>

<hr>

<h3><a href="https://pot.pizzamig.dev/Getting/" rel="nofollow">Getting started with pot</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
## Feedback/Questions</li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Benjamin%20-%20Question%20for%20Benedict.md" rel="nofollow">Benjamin - Question for Benedict</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Nelson%20-%20Episode%20419%20correction.md" rel="nofollow">Nelson - Episode 419 correction</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Peter%20-%20state%20machines.md" rel="nofollow">Peter - state machines</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Build Your FreeBSD Developer Workstation, logging is important, how BSD authentication works, pfSense turns 15 years old, OPNsense Business Edition 21.10 released,  getting started with pot, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a><br>
If you like BSDNow, consider supporting us on <a href="https://www.patreon.com/bsdnow" rel="nofollow">Patreon</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-developer-workstation-setup/" rel="nofollow">Building Your FreeBSD Developer Workstation Setup</a></h3>

<hr>

<h3><a href="https://peter.czanik.hu/posts/russian_students_logging" rel="nofollow">What I learned from Russian students: logging is important</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.lambda.cx/posts/how-bsd-authentication-works/" rel="nofollow">How BSD Authentication works</a></h3>

<hr>

<h3><a href="https://www.netgate.com/blog/pfsense-software-is-15-today" rel="nofollow">pfSense Software is 15 Today!</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-business-edition-21-10-released/" rel="nofollow">OPNsense® Business Edition 21.10 released</a></h3>

<hr>

<h3><a href="https://pot.pizzamig.dev/Getting/" rel="nofollow">Getting started with pot</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
## Feedback/Questions</li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Benjamin%20-%20Question%20for%20Benedict.md" rel="nofollow">Benjamin - Question for Benedict</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Nelson%20-%20Episode%20419%20correction.md" rel="nofollow">Nelson - Episode 419 correction</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Peter%20-%20state%20machines.md" rel="nofollow">Peter - state machines</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>426: OpenBSD 7.0 Hero</title>
  <link>https://www.bsdnow.tv/426</link>
  <guid isPermaLink="false">8a560bbe-5ee6-4ac7-96a4-2b2ec958f138</guid>
  <pubDate>Thu, 28 Oct 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8a560bbe-5ee6-4ac7-96a4-2b2ec958f138.mp3" length="35371176" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A Good Time to Use OpenZFS Slog, OpenBSD 7.0 is out, OpenBSD and Wayland, UVM faults yield significant performance boost, and more.</itunes:subtitle>
  <itunes:duration>59:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A Good Time to Use OpenZFS Slog, OpenBSD 7.0 is out, OpenBSD and Wayland, UVM faults yield significant performance boost, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
If you like BSDNow, consider supporting us on Patreon (https://www.patreon.com/bsdnow)
What Makes a Good Time to Use OpenZFS Slog and When Should You Avoid It (https://klarasystems.com/articles/what-makes-a-good-time-to-use-openzfs-slog-and-when-should-you-avoid-it/)
OpenBSD 7.0 is out (https://www.openbsd.org/70.html)
News Roundup
OpenBSD and Wayland (https://www.sizeofvoid.org/posts/2021-09-26-openbsd-wayland-report/)
Unlocking UVM faults yields significant performance boost (https://undeadly.org/cgi?action=article;sid=20210908084117)
Beastie Bits
PLAN 9 DESKTOP GUIDE (https://pspodcasting.net/dan/blog/2019/plan9_desktop.html)
libvirt and DragonFly (https://www.dragonflydigest.com/2021/10/04/26234.html)
EuroBSDCon 2021 videos are available (https://undeadly.org/cgi?action=article;sid=20210928192806)
Issue#1 of OpenBSD Webzine (https://twitter.com/lcheylus/status/1446553240707993600?s=28)
The Beastie has landed. (https://twitter.com/ed_maste/status/1446846780663123968?s=28)
It’s 1998 and you are Sun Microsystems... (https://twitter.com/knaversr/status/1443778072113602562)
+ Reply link that's down (https://web.archive.org/web/20211011003830/https://www.landley.net/history/mirror/unix/srcos.html)
RSA/SHA1 signature type disabled by default in OpenSSH (https://undeadly.org/cgi?action=article;sid=20210830113413)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Dan - IPFS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Dan%20-%20IPFS.md)
Jack - IPFS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Jack%20-%20IPFS.md)
Johnny - AdvanceBSD (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Johnny%20-%20AdvanceBSD.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, slog, wayland, UVM, uvm faults, performance, boost</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A Good Time to Use OpenZFS Slog, OpenBSD 7.0 is out, OpenBSD and Wayland, UVM faults yield significant performance boost, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<p>If you like BSDNow, consider supporting us on <a href="https://www.patreon.com/bsdnow" rel="nofollow">Patreon</a></p>

<h3><a href="https://klarasystems.com/articles/what-makes-a-good-time-to-use-openzfs-slog-and-when-should-you-avoid-it/" rel="nofollow">What Makes a Good Time to Use OpenZFS Slog and When Should You Avoid It</a></h3>

<hr>

<h3><a href="https://www.openbsd.org/70.html" rel="nofollow">OpenBSD 7.0 is out</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.sizeofvoid.org/posts/2021-09-26-openbsd-wayland-report/" rel="nofollow">OpenBSD and Wayland</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210908084117" rel="nofollow">Unlocking UVM faults yields significant performance boost</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://pspodcasting.net/dan/blog/2019/plan9_desktop.html" rel="nofollow">PLAN 9 DESKTOP GUIDE</a><br>
<a href="https://www.dragonflydigest.com/2021/10/04/26234.html" rel="nofollow">libvirt and DragonFly</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20210928192806" rel="nofollow">EuroBSDCon 2021 videos are available</a><br>
<a href="https://twitter.com/lcheylus/status/1446553240707993600?s=28" rel="nofollow">Issue#1 of OpenBSD Webzine</a><br>
<a href="https://twitter.com/ed_maste/status/1446846780663123968?s=28" rel="nofollow">The Beastie has landed.</a><br>
<a href="https://twitter.com/knaversr/status/1443778072113602562" rel="nofollow">It’s 1998 and you are Sun Microsystems...</a></p>

<ul>
<li><a href="https://web.archive.org/web/20211011003830/https://www.landley.net/history/mirror/unix/srcos.html" rel="nofollow">Reply link that&#39;s down</a>
<a href="https://undeadly.org/cgi?action=article;sid=20210830113413" rel="nofollow">RSA/SHA1 signature type disabled by default in OpenSSH</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Dan%20-%20IPFS.md" rel="nofollow">Dan - IPFS</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Jack%20-%20IPFS.md" rel="nofollow">Jack - IPFS</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Johnny%20-%20AdvanceBSD.md" rel="nofollow">Johnny - AdvanceBSD</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A Good Time to Use OpenZFS Slog, OpenBSD 7.0 is out, OpenBSD and Wayland, UVM faults yield significant performance boost, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<p>If you like BSDNow, consider supporting us on <a href="https://www.patreon.com/bsdnow" rel="nofollow">Patreon</a></p>

<h3><a href="https://klarasystems.com/articles/what-makes-a-good-time-to-use-openzfs-slog-and-when-should-you-avoid-it/" rel="nofollow">What Makes a Good Time to Use OpenZFS Slog and When Should You Avoid It</a></h3>

<hr>

<h3><a href="https://www.openbsd.org/70.html" rel="nofollow">OpenBSD 7.0 is out</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.sizeofvoid.org/posts/2021-09-26-openbsd-wayland-report/" rel="nofollow">OpenBSD and Wayland</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210908084117" rel="nofollow">Unlocking UVM faults yields significant performance boost</a></h3>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://pspodcasting.net/dan/blog/2019/plan9_desktop.html" rel="nofollow">PLAN 9 DESKTOP GUIDE</a><br>
<a href="https://www.dragonflydigest.com/2021/10/04/26234.html" rel="nofollow">libvirt and DragonFly</a><br>
<a href="https://undeadly.org/cgi?action=article;sid=20210928192806" rel="nofollow">EuroBSDCon 2021 videos are available</a><br>
<a href="https://twitter.com/lcheylus/status/1446553240707993600?s=28" rel="nofollow">Issue#1 of OpenBSD Webzine</a><br>
<a href="https://twitter.com/ed_maste/status/1446846780663123968?s=28" rel="nofollow">The Beastie has landed.</a><br>
<a href="https://twitter.com/knaversr/status/1443778072113602562" rel="nofollow">It’s 1998 and you are Sun Microsystems...</a></p>

<ul>
<li><a href="https://web.archive.org/web/20211011003830/https://www.landley.net/history/mirror/unix/srcos.html" rel="nofollow">Reply link that&#39;s down</a>
<a href="https://undeadly.org/cgi?action=article;sid=20210830113413" rel="nofollow">RSA/SHA1 signature type disabled by default in OpenSSH</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Dan%20-%20IPFS.md" rel="nofollow">Dan - IPFS</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Jack%20-%20IPFS.md" rel="nofollow">Jack - IPFS</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Johnny%20-%20AdvanceBSD.md" rel="nofollow">Johnny - AdvanceBSD</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>425: Releases galore</title>
  <link>https://www.bsdnow.tv/425</link>
  <guid isPermaLink="false">af8c08aa-71ac-4c87-8145-6a672a9d7e5d</guid>
  <pubDate>Thu, 21 Oct 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/af8c08aa-71ac-4c87-8145-6a672a9d7e5d.mp3" length="25604952" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The New Architecture on the Block, OpenBSD on Vortex86DX CPU, lots of new releases, and more.</itunes:subtitle>
  <itunes:duration>41:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The New Architecture on the Block, OpenBSD on Vortex86DX CPU, lots of new releases, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
RISC-V: The New Architecture on the Block (https://klarasystems.com/articles/risc-v-the-new-architecture-on-the-block/)
If you want more RISC-V, check out JT's interview with Mark Himelstein the CTO of RISC-V International (https://www.opensourcevoices.org/20)
***
### OpenBSD on the Vortex86DX CPU (https://www.cambus.net/openbsd-on-the-vortex86dx-cpu/)
***
## News Roundup aka there’s been lots of releases recently so lets go through them:
### Lumina 1.6.1 (http://lumina-desktop.org/post/2021-10-05/)
### opnsense 21.7.3 (https://opnsense.org/opnsense-21-7-3-released/)
### LibreSSL patches (https://bsdsec.net/articles/openbsd-errata-september-27-2021-libressl)
### OpenBGPD 7.2 (https://marc.info/?l=openbsd-announce&amp;amp;m=163239274430211&amp;amp;w=2)
### Midnight BSD 2.1.0 (https://www.midnightbsd.org/notes/)
### GhostBSD 21.09 ISO (http://ghostbsd.org/ghostbsd_21.09.29_iso_now_available)
### helloSystemv0.6 (https://github.com/helloSystem/ISO/releases/tag/r0.6.0)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brandon - FreeBSD question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Brandon%20-%20FreeBSD%20question.md)
Bruce - Fixing a weird Apache Bug (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Bruce%20-%20Fixing%20a%20weird%20Apache%20Bug.md)
Dan - zfs question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Dan%20-%20zfs%20question.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, riscv, vortex86dx, lumina, opensense, libressl, patches, openbgpd, midnightbsd, ghostbsd, hello system</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The New Architecture on the Block, OpenBSD on Vortex86DX CPU, lots of new releases, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/risc-v-the-new-architecture-on-the-block/" rel="nofollow">RISC-V: The New Architecture on the Block</a></h3>

<ul>
<li>If you want more RISC-V, check out <a href="https://www.opensourcevoices.org/20" rel="nofollow">JT&#39;s interview with Mark Himelstein the CTO of RISC-V International</a>
***
### <a href="https://www.cambus.net/openbsd-on-the-vortex86dx-cpu/" rel="nofollow">OpenBSD on the Vortex86DX CPU</a>
***
## News Roundup aka there’s been lots of releases recently so lets go through them:
### <a href="http://lumina-desktop.org/post/2021-10-05/" rel="nofollow">Lumina 1.6.1</a>
### <a href="https://opnsense.org/opnsense-21-7-3-released/" rel="nofollow">opnsense 21.7.3</a>
### <a href="https://bsdsec.net/articles/openbsd-errata-september-27-2021-libressl" rel="nofollow">LibreSSL patches</a>
### <a href="https://marc.info/?l=openbsd-announce&m=163239274430211&w=2" rel="nofollow">OpenBGPD 7.2</a>
### <a href="https://www.midnightbsd.org/notes/" rel="nofollow">Midnight BSD 2.1.0</a>
### <a href="http://ghostbsd.org/ghostbsd_21.09.29_iso_now_available" rel="nofollow">GhostBSD 21.09 ISO</a>
### <a href="https://github.com/helloSystem/ISO/releases/tag/r0.6.0" rel="nofollow">helloSystemv0.6</a></li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Brandon%20-%20FreeBSD%20question.md" rel="nofollow">Brandon - FreeBSD question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Bruce%20-%20Fixing%20a%20weird%20Apache%20Bug.md" rel="nofollow">Bruce - Fixing a weird Apache Bug</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Dan%20-%20zfs%20question.md" rel="nofollow">Dan - zfs question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The New Architecture on the Block, OpenBSD on Vortex86DX CPU, lots of new releases, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/risc-v-the-new-architecture-on-the-block/" rel="nofollow">RISC-V: The New Architecture on the Block</a></h3>

<ul>
<li>If you want more RISC-V, check out <a href="https://www.opensourcevoices.org/20" rel="nofollow">JT&#39;s interview with Mark Himelstein the CTO of RISC-V International</a>
***
### <a href="https://www.cambus.net/openbsd-on-the-vortex86dx-cpu/" rel="nofollow">OpenBSD on the Vortex86DX CPU</a>
***
## News Roundup aka there’s been lots of releases recently so lets go through them:
### <a href="http://lumina-desktop.org/post/2021-10-05/" rel="nofollow">Lumina 1.6.1</a>
### <a href="https://opnsense.org/opnsense-21-7-3-released/" rel="nofollow">opnsense 21.7.3</a>
### <a href="https://bsdsec.net/articles/openbsd-errata-september-27-2021-libressl" rel="nofollow">LibreSSL patches</a>
### <a href="https://marc.info/?l=openbsd-announce&m=163239274430211&w=2" rel="nofollow">OpenBGPD 7.2</a>
### <a href="https://www.midnightbsd.org/notes/" rel="nofollow">Midnight BSD 2.1.0</a>
### <a href="http://ghostbsd.org/ghostbsd_21.09.29_iso_now_available" rel="nofollow">GhostBSD 21.09 ISO</a>
### <a href="https://github.com/helloSystem/ISO/releases/tag/r0.6.0" rel="nofollow">helloSystemv0.6</a></li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Brandon%20-%20FreeBSD%20question.md" rel="nofollow">Brandon - FreeBSD question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Bruce%20-%20Fixing%20a%20weird%20Apache%20Bug.md" rel="nofollow">Bruce - Fixing a weird Apache Bug</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Dan%20-%20zfs%20question.md" rel="nofollow">Dan - zfs question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>424: Unveiling OpenBSD’s pledge</title>
  <link>https://www.bsdnow.tv/424</link>
  <guid isPermaLink="false">6f778bcb-d4a7-469d-9ec2-8fed7fbe93a1</guid>
  <pubDate>Thu, 14 Oct 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6f778bcb-d4a7-469d-9ec2-8fed7fbe93a1.mp3" length="30778248" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>J language working on OpenBSD, Comparing FreeBSD GELI and OpenZFS encrypted pools, What is FreeBSD, actually?, OpenBSD's pledge and unveil from Python, and more.</itunes:subtitle>
  <itunes:duration>49:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>J language working on OpenBSD, Comparing FreeBSD GELI and OpenZFS encrypted pools, What is FreeBSD, actually?, OpenBSD's pledge and unveil from Python, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
I got the J language working on OpenBSD (https://briancallahan.net/blog/20210911.html)
Rubenerd: Comparing FreeBSD GELI and OpenZFS encrypted pools with keys (https://rubenerd.com/my-first-prod-encrypted-openzfs-pool/)
News Roundup
What is FreeBSD, actually? Think again. (https://medium.com/@probonopd/what-is-freebsd-actually-think-again-200c2752d026)
OpenBSD's pledge and unveil from Python (https://nullprogram.com/blog/2021/09/15/)
Beastie Bits
• [Hibernate time reduced](http://undeadly.org/cgi?action=article;sid=20210831050932)
• [(open)rsync gains include/exclude support](http://undeadly.org/cgi?action=article;sid=20210830081715)
• [Producer JT's latest ancient find that he needs help with](https://twitter.com/q5sys/status/1440105555754848257)
• [Doas comes to MidnightBSD](https://github.com/slicer69/doas)
• [FreeBSD SSH Hardening](https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11)
• [OpenBSD 6.8 and you](https://home.nuug.no/~peter/openbsd_and_you/#1)
• [By default, scp(1) now uses SFTP protocol](https://undeadly.org/cgi?action=article;sid=20210910074941)
• [FreeBSD 11.4 end-of-life](https://lists.freebsd.org/pipermail/freebsd-announce/2021-September/002060.html)
• [sched_ule(4): Improve long-term load balancer](https://cgit.freebsd.org/src/commit/?id=e745d729be60a47b49eb19c02a6864a747fb2744)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, j language, porting, language port, comparing, comparison, geli, full disk encryption, encryption, pledge, unveil, python   </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>J language working on OpenBSD, Comparing FreeBSD GELI and OpenZFS encrypted pools, What is FreeBSD, actually?, OpenBSD&#39;s pledge and unveil from Python, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://briancallahan.net/blog/20210911.html" rel="nofollow">I got the J language working on OpenBSD</a></h3>

<hr>

<h3><a href="https://rubenerd.com/my-first-prod-encrypted-openzfs-pool/" rel="nofollow">Rubenerd: Comparing FreeBSD GELI and OpenZFS encrypted pools with keys</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://medium.com/@probonopd/what-is-freebsd-actually-think-again-200c2752d026" rel="nofollow">What is FreeBSD, actually? Think again.</a></h3>

<hr>

<h3><a href="https://nullprogram.com/blog/2021/09/15/" rel="nofollow">OpenBSD&#39;s pledge and unveil from Python</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [Hibernate time reduced](http://undeadly.org/cgi?action=article;sid=20210831050932)
• [(open)rsync gains include/exclude support](http://undeadly.org/cgi?action=article;sid=20210830081715)
• [Producer JT&#39;s latest ancient find that he needs help with](https://twitter.com/q5sys/status/1440105555754848257)
• [Doas comes to MidnightBSD](https://github.com/slicer69/doas)
• [FreeBSD SSH Hardening](https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11)
• [OpenBSD 6.8 and you](https://home.nuug.no/~peter/openbsd_and_you/#1)
• [By default, scp(1) now uses SFTP protocol](https://undeadly.org/cgi?action=article;sid=20210910074941)
• [FreeBSD 11.4 end-of-life](https://lists.freebsd.org/pipermail/freebsd-announce/2021-September/002060.html)
• [sched_ule(4): Improve long-term load balancer](https://cgit.freebsd.org/src/commit/?id=e745d729be60a47b49eb19c02a6864a747fb2744)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>J language working on OpenBSD, Comparing FreeBSD GELI and OpenZFS encrypted pools, What is FreeBSD, actually?, OpenBSD&#39;s pledge and unveil from Python, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://briancallahan.net/blog/20210911.html" rel="nofollow">I got the J language working on OpenBSD</a></h3>

<hr>

<h3><a href="https://rubenerd.com/my-first-prod-encrypted-openzfs-pool/" rel="nofollow">Rubenerd: Comparing FreeBSD GELI and OpenZFS encrypted pools with keys</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://medium.com/@probonopd/what-is-freebsd-actually-think-again-200c2752d026" rel="nofollow">What is FreeBSD, actually? Think again.</a></h3>

<hr>

<h3><a href="https://nullprogram.com/blog/2021/09/15/" rel="nofollow">OpenBSD&#39;s pledge and unveil from Python</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [Hibernate time reduced](http://undeadly.org/cgi?action=article;sid=20210831050932)
• [(open)rsync gains include/exclude support](http://undeadly.org/cgi?action=article;sid=20210830081715)
• [Producer JT&#39;s latest ancient find that he needs help with](https://twitter.com/q5sys/status/1440105555754848257)
• [Doas comes to MidnightBSD](https://github.com/slicer69/doas)
• [FreeBSD SSH Hardening](https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11)
• [OpenBSD 6.8 and you](https://home.nuug.no/~peter/openbsd_and_you/#1)
• [By default, scp(1) now uses SFTP protocol](https://undeadly.org/cgi?action=article;sid=20210910074941)
• [FreeBSD 11.4 end-of-life](https://lists.freebsd.org/pipermail/freebsd-announce/2021-September/002060.html)
• [sched_ule(4): Improve long-term load balancer](https://cgit.freebsd.org/src/commit/?id=e745d729be60a47b49eb19c02a6864a747fb2744)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>423: RACK the Stack </title>
  <link>https://www.bsdnow.tv/423</link>
  <guid isPermaLink="false">4773f65c-58e5-4661-8a0e-cd636e3a9997</guid>
  <pubDate>Thu, 07 Oct 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4773f65c-58e5-4661-8a0e-cd636e3a9997.mp3" length="32212584" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD serves Netflix Video at 400Gb/s, Using the RACK TCP stack, an OpenBSD script to update packages fast, Plasma System Monitor and FreeBSD, TrueNAS vs FreeNAS (and why you should upgrade!), auto lock screen on OpenBSD using xidle and xlock, and more</itunes:subtitle>
  <itunes:duration>51:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD serves Netflix Video at 400Gb/s, Using the RACK TCP stack, an OpenBSD script to update packages fast, Plasma System Monitor and FreeBSD, TrueNAS vs FreeNAS (and why you should upgrade!), auto lock screen on OpenBSD using xidle and xlock, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Serving Netflix Video at 400Gb/s on FreeBSD (https://people.freebsd.org/~gallatin/talks/euro2021.pdf)
Using the FreeBSD RACK TCP Stack (https://klarasystems.com/articles/using-the-freebsd-rack-tcp-stack/)
News Roundup
pkgupdate, an OpenBSD script to update packages fast (https://dataswamp.org/~solene/2021-08-15-openbsd-pkgupdate.html)
Plasma System Monitor and FreeBSD (https://euroquis.nl//kde/2021/09/15/systemmonitor.html)
TrueNAS vs FreeNAS (and why you should upgrade!) (https://www.ixsystems.com/blog/truenas-vs-freenas-and-why-you-should-upgrade/)
Automatically lock screen on OpenBSD using xidle and xlock (https://dataswamp.org/~solene/2021-07-30-openbsd-xidle-xlock.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Ben - LightDM with Slick-Greeter.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/Ben%20-%20LightDM%20with%20Slick-Greeter.md)
Dave - Cloned Interface.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/Dave%20-%20Cloned%20Interface.md)
MJ Rodriguez - Sony.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/MJ%20Rodriguez%20-%20Sony.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <content:encoded>
    <![CDATA[<p>FreeBSD serves Netflix Video at 400Gb/s, Using the RACK TCP stack, an OpenBSD script to update packages fast, Plasma System Monitor and FreeBSD, TrueNAS vs FreeNAS (and why you should upgrade!), auto lock screen on OpenBSD using xidle and xlock, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://people.freebsd.org/%7Egallatin/talks/euro2021.pdf" rel="nofollow">Serving Netflix Video at 400Gb/s on FreeBSD</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/using-the-freebsd-rack-tcp-stack/" rel="nofollow">Using the FreeBSD RACK TCP Stack</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-08-15-openbsd-pkgupdate.html" rel="nofollow">pkgupdate, an OpenBSD script to update packages fast</a></h3>

<hr>

<h3><a href="https://euroquis.nl//kde/2021/09/15/systemmonitor.html" rel="nofollow">Plasma System Monitor and FreeBSD</a></h3>

<hr>

<h3><a href="https://www.ixsystems.com/blog/truenas-vs-freenas-and-why-you-should-upgrade/" rel="nofollow">TrueNAS vs FreeNAS (and why you should upgrade!)</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-07-30-openbsd-xidle-xlock.html" rel="nofollow">Automatically lock screen on OpenBSD using xidle and xlock</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/Ben%20-%20LightDM%20with%20Slick-Greeter.md" rel="nofollow">Ben - LightDM with Slick-Greeter.md</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/Dave%20-%20Cloned%20Interface.md" rel="nofollow">Dave - Cloned Interface.md</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/MJ%20Rodriguez%20-%20Sony.md" rel="nofollow">MJ Rodriguez - Sony.md</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD serves Netflix Video at 400Gb/s, Using the RACK TCP stack, an OpenBSD script to update packages fast, Plasma System Monitor and FreeBSD, TrueNAS vs FreeNAS (and why you should upgrade!), auto lock screen on OpenBSD using xidle and xlock, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://people.freebsd.org/%7Egallatin/talks/euro2021.pdf" rel="nofollow">Serving Netflix Video at 400Gb/s on FreeBSD</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/using-the-freebsd-rack-tcp-stack/" rel="nofollow">Using the FreeBSD RACK TCP Stack</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-08-15-openbsd-pkgupdate.html" rel="nofollow">pkgupdate, an OpenBSD script to update packages fast</a></h3>

<hr>

<h3><a href="https://euroquis.nl//kde/2021/09/15/systemmonitor.html" rel="nofollow">Plasma System Monitor and FreeBSD</a></h3>

<hr>

<h3><a href="https://www.ixsystems.com/blog/truenas-vs-freenas-and-why-you-should-upgrade/" rel="nofollow">TrueNAS vs FreeNAS (and why you should upgrade!)</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-07-30-openbsd-xidle-xlock.html" rel="nofollow">Automatically lock screen on OpenBSD using xidle and xlock</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/Ben%20-%20LightDM%20with%20Slick-Greeter.md" rel="nofollow">Ben - LightDM with Slick-Greeter.md</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/Dave%20-%20Cloned%20Interface.md" rel="nofollow">Dave - Cloned Interface.md</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/MJ%20Rodriguez%20-%20Sony.md" rel="nofollow">MJ Rodriguez - Sony.md</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>422: The Brian Callahan Interview</title>
  <link>https://www.bsdnow.tv/422</link>
  <guid isPermaLink="false">4ca5efbc-d83b-41a2-981c-42c4dacefb05</guid>
  <pubDate>Thu, 30 Sep 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4ca5efbc-d83b-41a2-981c-42c4dacefb05.mp3" length="30162984" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We interview Dr. Brian Callahan about his language porting work for OpenBSD, teaching with BSDs and recruiting students into projects, research, and his work at NYC*BUG in this week’s episode of BSDnow.</itunes:subtitle>
  <itunes:duration>49:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We interview Dr. Brian Callahan about his language porting work for OpenBSD, teaching with BSDs and recruiting students into projects, research, and his work at NYC*BUG in this week’s episode of BSDnow.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Interview - Dr. Brian Robert Callahan - https://briancallahan.net/ (https://briancallahan.net/) / bcallah@bsdnetwork (https://mastodon.com/bcallah@bsdnetwork)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
*** Special Guest: Brian Callahan.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, interview, callahan, language porting, teaching, research, recruiting, diversity, nycbug, new york, bsd user group,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We interview Dr. Brian Callahan about his language porting work for OpenBSD, teaching with BSDs and recruiting students into projects, research, and his work at NYC*BUG in this week’s episode of BSDnow.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Interview - Dr. Brian Robert Callahan - <a href="https://briancallahan.net/" rel="nofollow">https://briancallahan.net/</a> / <a href="https://mastodon.com/bcallah@bsdnetwork" rel="nofollow">bcallah@bsdnetwork</a></h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Brian Callahan.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We interview Dr. Brian Callahan about his language porting work for OpenBSD, teaching with BSDs and recruiting students into projects, research, and his work at NYC*BUG in this week’s episode of BSDnow.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Interview - Dr. Brian Robert Callahan - <a href="https://briancallahan.net/" rel="nofollow">https://briancallahan.net/</a> / <a href="https://mastodon.com/bcallah@bsdnetwork" rel="nofollow">bcallah@bsdnetwork</a></h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Brian Callahan.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>421: ZFS eats CPU</title>
  <link>https://www.bsdnow.tv/421</link>
  <guid isPermaLink="false">626e101a-a6c2-43ce-ad87-018474d78971</guid>
  <pubDate>Thu, 23 Sep 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/626e101a-a6c2-43ce-ad87-018474d78971.mp3" length="32360040" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Useless use of GNU, Meet the 2021 FreeBSD GSoC Students, historical note on Unix portability, vm86-based venix emulator, ZFS Mysteriously Eating CPU, traceroute gets speed boost, and more </itunes:subtitle>
  <itunes:duration>50:42</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Useless use of GNU, Meet the 2021 FreeBSD GSoC Students, historical note on Unix portability, vm86-based venix emulator, ZFS Mysteriously Eating CPU, traceroute gets speed boost, and more 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Useless use of GNU (https://jmmv.dev/2021/08/useless-use-of-gnu.html)
Meet the 2021 FreeBSD Google Summer of Code Students (https://freebsdfoundation.org/blog/meet-the-2021-freebsd-google-summer-of-code-students/)
News Roundup
Large Unix programs were historically not all that portable between Unixes (https://utcc.utoronto.ca/~cks/space/blog/unix/ProgramsVsPortability)
References this article: I’m not sure that UNIX won (https://rubenerd.com/im-not-sure-that-unix-won/)
***
### A new path: vm86-based venix emulator (http://bsdimp.blogspot.com/2021/08/a-new-path-vm86-based-venix-emulator.html)
***
### ZFS Is Mysteriously Eating My CPU (http://www.brendangregg.com/blog/2021-09-06/zfs-is-mysteriously-eating-my-cpu.html)
***
### traceroute(8) gets speed boost (http://undeadly.org/cgi?action=article;sid=20210903094704)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Al - TransAtlantic Cables (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/Al%20-%20TransAtlantic%20Cables.md)
Christopher - NVMe (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/Christopher%20-%20NVMe.md)
JohnnyK - Vivaldi (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/JohnnyK%2-%20Vivaldi.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, gnu, useless, google summer of code, students, portability, unix history, vm86, venix, emulator, cpu use, cpu usage, traceroute</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Useless use of GNU, Meet the 2021 FreeBSD GSoC Students, historical note on Unix portability, vm86-based venix emulator, ZFS Mysteriously Eating CPU, traceroute gets speed boost, and more </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://jmmv.dev/2021/08/useless-use-of-gnu.html" rel="nofollow">Useless use of GNU</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/meet-the-2021-freebsd-google-summer-of-code-students/" rel="nofollow">Meet the 2021 FreeBSD Google Summer of Code Students</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ProgramsVsPortability" rel="nofollow">Large Unix programs were historically not all that portable between Unixes</a></h3>

<ul>
<li>References this article: <a href="https://rubenerd.com/im-not-sure-that-unix-won/" rel="nofollow">I’m not sure that UNIX won</a>
***
### <a href="http://bsdimp.blogspot.com/2021/08/a-new-path-vm86-based-venix-emulator.html" rel="nofollow">A new path: vm86-based venix emulator</a>
***
### <a href="http://www.brendangregg.com/blog/2021-09-06/zfs-is-mysteriously-eating-my-cpu.html" rel="nofollow">ZFS Is Mysteriously Eating My CPU</a>
***
### <a href="http://undeadly.org/cgi?action=article;sid=20210903094704" rel="nofollow">traceroute(8) gets speed boost</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/Al%20-%20TransAtlantic%20Cables.md" rel="nofollow">Al - TransAtlantic Cables</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/Christopher%20-%20NVMe.md" rel="nofollow">Christopher - NVMe</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/JohnnyK%2-%20Vivaldi.md" rel="nofollow">JohnnyK - Vivaldi</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Useless use of GNU, Meet the 2021 FreeBSD GSoC Students, historical note on Unix portability, vm86-based venix emulator, ZFS Mysteriously Eating CPU, traceroute gets speed boost, and more </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://jmmv.dev/2021/08/useless-use-of-gnu.html" rel="nofollow">Useless use of GNU</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/meet-the-2021-freebsd-google-summer-of-code-students/" rel="nofollow">Meet the 2021 FreeBSD Google Summer of Code Students</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ProgramsVsPortability" rel="nofollow">Large Unix programs were historically not all that portable between Unixes</a></h3>

<ul>
<li>References this article: <a href="https://rubenerd.com/im-not-sure-that-unix-won/" rel="nofollow">I’m not sure that UNIX won</a>
***
### <a href="http://bsdimp.blogspot.com/2021/08/a-new-path-vm86-based-venix-emulator.html" rel="nofollow">A new path: vm86-based venix emulator</a>
***
### <a href="http://www.brendangregg.com/blog/2021-09-06/zfs-is-mysteriously-eating-my-cpu.html" rel="nofollow">ZFS Is Mysteriously Eating My CPU</a>
***
### <a href="http://undeadly.org/cgi?action=article;sid=20210903094704" rel="nofollow">traceroute(8) gets speed boost</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/Al%20-%20TransAtlantic%20Cables.md" rel="nofollow">Al - TransAtlantic Cables</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/Christopher%20-%20NVMe.md" rel="nofollow">Christopher - NVMe</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/JohnnyK%2-%20Vivaldi.md" rel="nofollow">JohnnyK - Vivaldi</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>420: OpenBSD makes life better</title>
  <link>https://www.bsdnow.tv/420</link>
  <guid isPermaLink="false">8b8bd7d2-7ac2-4c6b-a33f-fcc39e355be5</guid>
  <pubDate>Thu, 16 Sep 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8b8bd7d2-7ac2-4c6b-a33f-fcc39e355be5.mp3" length="32538960" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Choosing The Right ZFS Pool Layout, changes in OpenBSD that make life better, GhostBSD 21.09.06 ISO's now available, Fair Internet bandwidth management with OpenBSD, NetBSD wifi router project update, NetBSD on the Apple M1, HardenedBSD August Status Report, FreeBSD Journal on Wireless and Desktop, and more.
</itunes:subtitle>
  <itunes:duration>49:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Choosing The Right ZFS Pool Layout, changes in OpenBSD that make life better, GhostBSD 21.09.06 ISO's now available, Fair Internet bandwidth management with OpenBSD, NetBSD wifi router project update, NetBSD on the Apple M1, HardenedBSD August Status Report, FreeBSD Journal on Wireless and Desktop, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Choosing The Right ZFS Pool Layout (https://klarasystems.com/articles/choosing-the-right-zfs-pool-layout/)
Recent and not so recent changes in OpenBSD that make life better (and may turn up elsewhere too) (https://bsdly.blogspot.com/2021/08/recent-and-not-so-recent-changes-in.html)
News Roundup
GhostBSD 21.09.06 ISO's now available (https://www.ghostbsd.org/ghostbsd_21.09.06_iso_now_available)
Fair Internet bandwidth management on a network using OpenBSD (https://dataswamp.org/~solene/2021-08-30-openbsd-qos-lan.html)
NetBSD wifi router project update (https://blog.netbsd.org/tnf/entry/wifi_project_status_update)
Bonus NetBSD Recent Developments: NetBSD on the Apple M1 (https://mobile.twitter.com/jmcwhatever/status/1431575270436319235)
***
### HardenedBSD August 2021 Status Report (https://hardenedbsd.org/article/shawn-webb/2021-08-31/hardenedbsd-august-2021-status-report)
### FreeBSD Journal July/August 2021: Desktop/Wireless (https://freebsdfoundation.org/past-issues/desktop-wireless/)
***
### Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
James - backup question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/James%20-%20backup%20question.md)
Jonathon - certifications (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/Jonathon%20-%20certifications.md)
Marty - RPG CLI (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/Marty%20-%20RPG%20CLI.md)
*** 
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, pool layout, changes, improvements, ghostbsd, internet, bandwidth management, wifi, router, router project, Apple M1, arm64, wireless, desktop</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Choosing The Right ZFS Pool Layout, changes in OpenBSD that make life better, GhostBSD 21.09.06 ISO&#39;s now available, Fair Internet bandwidth management with OpenBSD, NetBSD wifi router project update, NetBSD on the Apple M1, HardenedBSD August Status Report, FreeBSD Journal on Wireless and Desktop, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/choosing-the-right-zfs-pool-layout/" rel="nofollow">Choosing The Right ZFS Pool Layout</a></h3>

<hr>

<h3><a href="https://bsdly.blogspot.com/2021/08/recent-and-not-so-recent-changes-in.html" rel="nofollow">Recent and not so recent changes in OpenBSD that make life better (and may turn up elsewhere too)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.ghostbsd.org/ghostbsd_21.09.06_iso_now_available" rel="nofollow">GhostBSD 21.09.06 ISO&#39;s now available</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-08-30-openbsd-qos-lan.html" rel="nofollow">Fair Internet bandwidth management on a network using OpenBSD</a></h3>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/wifi_project_status_update" rel="nofollow">NetBSD wifi router project update</a></h3>

<ul>
<li>Bonus NetBSD Recent Developments: <a href="https://mobile.twitter.com/jmcwhatever/status/1431575270436319235" rel="nofollow">NetBSD on the Apple M1</a>
***
### <a href="https://hardenedbsd.org/article/shawn-webb/2021-08-31/hardenedbsd-august-2021-status-report" rel="nofollow">HardenedBSD August 2021 Status Report</a>
### <a href="https://freebsdfoundation.org/past-issues/desktop-wireless/" rel="nofollow">FreeBSD Journal July/August 2021: Desktop/Wireless</a>
***
### Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/James%20-%20backup%20question.md" rel="nofollow">James - backup question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/Jonathon%20-%20certifications.md" rel="nofollow">Jonathon - certifications</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/Marty%20-%20RPG%20CLI.md" rel="nofollow">Marty - RPG CLI</a>
*** </li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Choosing The Right ZFS Pool Layout, changes in OpenBSD that make life better, GhostBSD 21.09.06 ISO&#39;s now available, Fair Internet bandwidth management with OpenBSD, NetBSD wifi router project update, NetBSD on the Apple M1, HardenedBSD August Status Report, FreeBSD Journal on Wireless and Desktop, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/choosing-the-right-zfs-pool-layout/" rel="nofollow">Choosing The Right ZFS Pool Layout</a></h3>

<hr>

<h3><a href="https://bsdly.blogspot.com/2021/08/recent-and-not-so-recent-changes-in.html" rel="nofollow">Recent and not so recent changes in OpenBSD that make life better (and may turn up elsewhere too)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.ghostbsd.org/ghostbsd_21.09.06_iso_now_available" rel="nofollow">GhostBSD 21.09.06 ISO&#39;s now available</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-08-30-openbsd-qos-lan.html" rel="nofollow">Fair Internet bandwidth management on a network using OpenBSD</a></h3>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/wifi_project_status_update" rel="nofollow">NetBSD wifi router project update</a></h3>

<ul>
<li>Bonus NetBSD Recent Developments: <a href="https://mobile.twitter.com/jmcwhatever/status/1431575270436319235" rel="nofollow">NetBSD on the Apple M1</a>
***
### <a href="https://hardenedbsd.org/article/shawn-webb/2021-08-31/hardenedbsd-august-2021-status-report" rel="nofollow">HardenedBSD August 2021 Status Report</a>
### <a href="https://freebsdfoundation.org/past-issues/desktop-wireless/" rel="nofollow">FreeBSD Journal July/August 2021: Desktop/Wireless</a>
***
### Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/James%20-%20backup%20question.md" rel="nofollow">James - backup question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/Jonathon%20-%20certifications.md" rel="nofollow">Jonathon - certifications</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/Marty%20-%20RPG%20CLI.md" rel="nofollow">Marty - RPG CLI</a>
*** </li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>419: Rethinking OS installs</title>
  <link>https://www.bsdnow.tv/419</link>
  <guid isPermaLink="false">4fb1ef2f-3915-403b-9687-47451b3339a9</guid>
  <pubDate>Thu, 09 Sep 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4fb1ef2f-3915-403b-9687-47451b3339a9.mp3" length="33694320" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Reviewing a first OpenBSD port, NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11, FreeBSD Experiment Rethinks the OS Install, GhostBSD switching to FreeBSD rc.d, Irix gets LLVM, and more.</itunes:subtitle>
  <itunes:duration>51:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Reviewing a first OpenBSD port, NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11, FreeBSD Experiment Rethinks the OS Install, GhostBSD switching to FreeBSD rc.d, Irix gets LLVM, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Reviewing my first OpenBSD port, and what I'd do differently 10 years later (https://briancallahan.net/blog/20210802.html)
Install NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11 (https://raymii.org/s/articles/NetBSD_on_QEMU_Alpha.html)
News Roundup
FreeBSD Experiment Rethinks the OS Install (https://hackaday.com/2021/08/10/freebsd-experiment-rethinks-the-os-install/)
The switch to FreeBSD rc.d is coming (https://www.ghostbsd.org/rc_switch)
Irix gets LLVM (https://forums.irixnet.org/thread-3043.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Miceal - a few questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/419/feedback/Miceal%20-%20a%20few%20questions.md)
Nelson - dummynet (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/419/feedback/Nelson%20-%20dummynet.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, port, review, done differently, learning, retrospect, DEC, alpha cpu, qemu, x11, os install, rethink, ghostbsd, rc.d, irix, llvm </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Reviewing a first OpenBSD port, NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11, FreeBSD Experiment Rethinks the OS Install, GhostBSD switching to FreeBSD rc.d, Irix gets LLVM, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://briancallahan.net/blog/20210802.html" rel="nofollow">Reviewing my first OpenBSD port, and what I&#39;d do differently 10 years later</a></h3>

<hr>

<h3><a href="https://raymii.org/s/articles/NetBSD_on_QEMU_Alpha.html" rel="nofollow">Install NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://hackaday.com/2021/08/10/freebsd-experiment-rethinks-the-os-install/" rel="nofollow">FreeBSD Experiment Rethinks the OS Install</a></h3>

<hr>

<h3><a href="https://www.ghostbsd.org/rc_switch" rel="nofollow">The switch to FreeBSD rc.d is coming</a></h3>

<hr>

<h3><a href="https://forums.irixnet.org/thread-3043.html" rel="nofollow">Irix gets LLVM</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/419/feedback/Miceal%20-%20a%20few%20questions.md" rel="nofollow">Miceal - a few questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/419/feedback/Nelson%20-%20dummynet.md" rel="nofollow">Nelson - dummynet</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Reviewing a first OpenBSD port, NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11, FreeBSD Experiment Rethinks the OS Install, GhostBSD switching to FreeBSD rc.d, Irix gets LLVM, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://briancallahan.net/blog/20210802.html" rel="nofollow">Reviewing my first OpenBSD port, and what I&#39;d do differently 10 years later</a></h3>

<hr>

<h3><a href="https://raymii.org/s/articles/NetBSD_on_QEMU_Alpha.html" rel="nofollow">Install NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://hackaday.com/2021/08/10/freebsd-experiment-rethinks-the-os-install/" rel="nofollow">FreeBSD Experiment Rethinks the OS Install</a></h3>

<hr>

<h3><a href="https://www.ghostbsd.org/rc_switch" rel="nofollow">The switch to FreeBSD rc.d is coming</a></h3>

<hr>

<h3><a href="https://forums.irixnet.org/thread-3043.html" rel="nofollow">Irix gets LLVM</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/419/feedback/Miceal%20-%20a%20few%20questions.md" rel="nofollow">Miceal - a few questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/419/feedback/Nelson%20-%20dummynet.md" rel="nofollow">Nelson - dummynet</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>418: The greatest time in history to be a creator</title>
  <link>https://www.bsdnow.tv/418</link>
  <guid isPermaLink="false">5b0aa0e0-4435-47d3-841a-91793cf37806</guid>
  <pubDate>Thu, 02 Sep 2021 03:45:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5b0aa0e0-4435-47d3-841a-91793cf37806.mp3" length="32985120" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this episode, we interview Michael W. Lucas about his latest book projects including Git sync murder, TLS Mastery, getting paid for creative work, writing tools and techniques, and more.</itunes:subtitle>
  <itunes:duration>52:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this episode, we interview Michael W. Lucas about his latest book projects including Git sync murder, TLS Mastery, getting paid for creative work, writing tools and techniques, and more.
NOTES
Interview - Michael W. Lucas - mwl@mwl.io (mailto:mwl@mwl.io) / @mwlauthor (https://twitter.com/mwlauthor)
Cashflow for Creators (https://mwl.io/nonfiction/biz-craft)
Charity Auction Against Human Trafficking (https://mwl.io/archives/12526)
This is the rfc about what to not do. (https://datatracker.ietf.org/doc/html/rfc9049)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
 Special Guest: Michael W Lucas.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, interview, Michael W. Lucas </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this episode, we interview Michael W. Lucas about his latest book projects including Git sync murder, TLS Mastery, getting paid for creative work, writing tools and techniques, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwl@mwl.io" rel="nofollow">mwl@mwl.io</a> / <a href="https://twitter.com/mwlauthor" rel="nofollow">@mwlauthor</a></h2>

<ul>
<li><a href="https://mwl.io/nonfiction/biz-craft" rel="nofollow">Cashflow for Creators</a></li>
<li><a href="https://mwl.io/archives/12526" rel="nofollow">Charity Auction Against Human Trafficking</a></li>
<li><a href="https://datatracker.ietf.org/doc/html/rfc9049" rel="nofollow">This is the rfc about what to not do.</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr><p>Special Guest: Michael W Lucas.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this episode, we interview Michael W. Lucas about his latest book projects including Git sync murder, TLS Mastery, getting paid for creative work, writing tools and techniques, and more.</p>

<p><strong><em>NOTES</em></strong></p>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwl@mwl.io" rel="nofollow">mwl@mwl.io</a> / <a href="https://twitter.com/mwlauthor" rel="nofollow">@mwlauthor</a></h2>

<ul>
<li><a href="https://mwl.io/nonfiction/biz-craft" rel="nofollow">Cashflow for Creators</a></li>
<li><a href="https://mwl.io/archives/12526" rel="nofollow">Charity Auction Against Human Trafficking</a></li>
<li><a href="https://datatracker.ietf.org/doc/html/rfc9049" rel="nofollow">This is the rfc about what to not do.</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr><p>Special Guest: Michael W Lucas.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>417: bhyve private cloud</title>
  <link>https://www.bsdnow.tv/417</link>
  <guid isPermaLink="false">63b2639c-ad67-45db-9581-8053963313c2</guid>
  <pubDate>Thu, 26 Aug 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/63b2639c-ad67-45db-9581-8053963313c2.mp3" length="34928712" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Achieving RPO/RTO Objectives with ZFS pt 1, FreeBSD Foundation Q2 report, OpenBSD full Tor setup, MyBee - bhyve as private cloud, FreeBSD home fileserver expansion, OpenBSD on Framework Laptop, portable GELI, and more.</itunes:subtitle>
  <itunes:duration>57:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Achieving RPO/RTO Objectives with ZFS pt 1, FreeBSD Foundation Q2 report, OpenBSD full Tor setup, MyBee - bhyve as private cloud, FreeBSD home fileserver expansion, OpenBSD on Framework Laptop, portable GELI, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Achieving RPO/RTO Objectives with ZFS - Part 1 (https://klarasystems.com/articles/achieving-rpo-rto-objectives-with-zfs-part-1/)
FreeBSD Foundation Q2 Report (https://freebsdfoundation.org/blog/freebsd-foundation-q2-2021-status-update/)
OpenBSD full Tor setup (https://dataswamp.org/~solene/2021-07-25-openbsd-full-tor.html)
News Roundup
MyBee — FreeBSD OS and hypervisor bhyve as private cloud (https://habr.com/en/post/569226/)
Expanding our FreeBSD home file server (https://rubenerd.com/expanding-our-freebsd-home-file-server/)
OpenBSD on the Framework Laptop (https://jcs.org/2021/08/06/framework)
Portable GELI (http://bijanebrahimi.github.io/blog/portable-geli.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Chunky_pie - zfs question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/Chunky_pie%20-%20zfs%20question.md)
Paul - several questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/Paul%20-%20several%20questions.md)
chris - firewall question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/chris%20-%20firewall%20question.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, rpo, rto, objectives, foundation, second quarter report, tor setup, mybee, private cloud, bhyve, fileserver, home, expansion, framework laptop, portable, geli, encryption, disk</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Achieving RPO/RTO Objectives with ZFS pt 1, FreeBSD Foundation Q2 report, OpenBSD full Tor setup, MyBee - bhyve as private cloud, FreeBSD home fileserver expansion, OpenBSD on Framework Laptop, portable GELI, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/achieving-rpo-rto-objectives-with-zfs-part-1/" rel="nofollow">Achieving RPO/RTO Objectives with ZFS - Part 1</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/freebsd-foundation-q2-2021-status-update/" rel="nofollow">FreeBSD Foundation Q2 Report</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-07-25-openbsd-full-tor.html" rel="nofollow">OpenBSD full Tor setup</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://habr.com/en/post/569226/" rel="nofollow">MyBee — FreeBSD OS and hypervisor bhyve as private cloud</a></h3>

<hr>

<h3><a href="https://rubenerd.com/expanding-our-freebsd-home-file-server/" rel="nofollow">Expanding our FreeBSD home file server</a></h3>

<hr>

<h3><a href="https://jcs.org/2021/08/06/framework" rel="nofollow">OpenBSD on the Framework Laptop</a></h3>

<hr>

<h3><a href="http://bijanebrahimi.github.io/blog/portable-geli.html" rel="nofollow">Portable GELI</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/Chunky_pie%20-%20zfs%20question.md" rel="nofollow">Chunky_pie - zfs question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/Paul%20-%20several%20questions.md" rel="nofollow">Paul - several questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/chris%20-%20firewall%20question.md" rel="nofollow">chris - firewall question</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Achieving RPO/RTO Objectives with ZFS pt 1, FreeBSD Foundation Q2 report, OpenBSD full Tor setup, MyBee - bhyve as private cloud, FreeBSD home fileserver expansion, OpenBSD on Framework Laptop, portable GELI, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/achieving-rpo-rto-objectives-with-zfs-part-1/" rel="nofollow">Achieving RPO/RTO Objectives with ZFS - Part 1</a></h3>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/freebsd-foundation-q2-2021-status-update/" rel="nofollow">FreeBSD Foundation Q2 Report</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-07-25-openbsd-full-tor.html" rel="nofollow">OpenBSD full Tor setup</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://habr.com/en/post/569226/" rel="nofollow">MyBee — FreeBSD OS and hypervisor bhyve as private cloud</a></h3>

<hr>

<h3><a href="https://rubenerd.com/expanding-our-freebsd-home-file-server/" rel="nofollow">Expanding our FreeBSD home file server</a></h3>

<hr>

<h3><a href="https://jcs.org/2021/08/06/framework" rel="nofollow">OpenBSD on the Framework Laptop</a></h3>

<hr>

<h3><a href="http://bijanebrahimi.github.io/blog/portable-geli.html" rel="nofollow">Portable GELI</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/Chunky_pie%20-%20zfs%20question.md" rel="nofollow">Chunky_pie - zfs question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/Paul%20-%20several%20questions.md" rel="nofollow">Paul - several questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/chris%20-%20firewall%20question.md" rel="nofollow">chris - firewall question</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>416: netcat printing</title>
  <link>https://www.bsdnow.tv/416</link>
  <guid isPermaLink="false">c6beac7b-f1bf-40bf-aaeb-a25eed202b81</guid>
  <pubDate>Thu, 19 Aug 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c6beac7b-f1bf-40bf-aaeb-a25eed202b81.mp3" length="33333456" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS snapshots, OpenSUSE on Bastille, printing with netcat, new opnsense 21.1.8 released, new pfsense plus software available, and more.</itunes:subtitle>
  <itunes:duration>53:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS snapshots, OpenSUSE on Bastille, printing with netcat, new opnsense 21.1.8 released, new pfsense plus software available, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Lets talk OpenZFS snapshots (https://klarasystems.com/articles/lets-talk-openzfs-snapshots/)
OpenSUSE in Bastille (https://peter.czanik.hu/posts/opensuse_in_bastille/)
News Roundup
CUPS printing with netcat (https://retrohacker.substack.com/p/bye-cups-printing-with-netcat)
Opnsense-21.1.8 (https://opnsense.org/opnsense-21-1-8-released/)
pfSense® Plus Software Version 21.05.1 is Now Available (https://www.netgate.com/blog/pfsense-plus-software-version-21.05.1-is-now-available-for-upgrades)
Beastie Bits
• [MAC Inspired FreeBSD release](https://github.com/mszoek/airyx)
• [Implement unprivileged chroot](https://cgit.freebsd.org/src/commit/?id=a40cf4175c90142442d0c6515f6c83956336699b)
• [InitWare: A systemd fork that runs on BSD](https://github.com/InitWare/InitWare)
• [multics gets a new release](https://multics-wiki.swenson.org/index.php/Main_Page)
• [Open Source Voices interview with Tom Jones](https://www.opensourcevoices.org/17)
• [PDP 11/03 Engineering Drawings](https://twitter.com/q5sys/status/1423092689084551171)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Oliver - zfs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/Olvier%20-%20zfs.md)
anders - vms (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/anders%20-%20vms.md)
jeff - byhve guests (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/jeff%20-%20byhve%20guests.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, snapshots, bastille, opensuse, printing, netcat, opnsense, pfsense, pfsense plus</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS snapshots, OpenSUSE on Bastille, printing with netcat, new opnsense 21.1.8 released, new pfsense plus software available, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/lets-talk-openzfs-snapshots/" rel="nofollow">Lets talk OpenZFS snapshots</a></h3>

<hr>

<h3><a href="https://peter.czanik.hu/posts/opensuse_in_bastille/" rel="nofollow">OpenSUSE in Bastille</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://retrohacker.substack.com/p/bye-cups-printing-with-netcat" rel="nofollow">CUPS printing with netcat</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-21-1-8-released/" rel="nofollow">Opnsense-21.1.8</a></h3>

<hr>

<h3><a href="https://www.netgate.com/blog/pfsense-plus-software-version-21.05.1-is-now-available-for-upgrades" rel="nofollow">pfSense® Plus Software Version 21.05.1 is Now Available</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [MAC Inspired FreeBSD release](https://github.com/mszoek/airyx)
• [Implement unprivileged chroot](https://cgit.freebsd.org/src/commit/?id=a40cf4175c90142442d0c6515f6c83956336699b)
• [InitWare: A systemd fork that runs on BSD](https://github.com/InitWare/InitWare)
• [multics gets a new release](https://multics-wiki.swenson.org/index.php/Main_Page)
• [Open Source Voices interview with Tom Jones](https://www.opensourcevoices.org/17)
• [PDP 11/03 Engineering Drawings](https://twitter.com/q5sys/status/1423092689084551171)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/Olvier%20-%20zfs.md" rel="nofollow">Oliver - zfs</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/anders%20-%20vms.md" rel="nofollow">anders - vms</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/jeff%20-%20byhve%20guests.md" rel="nofollow">jeff - byhve guests</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS snapshots, OpenSUSE on Bastille, printing with netcat, new opnsense 21.1.8 released, new pfsense plus software available, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/lets-talk-openzfs-snapshots/" rel="nofollow">Lets talk OpenZFS snapshots</a></h3>

<hr>

<h3><a href="https://peter.czanik.hu/posts/opensuse_in_bastille/" rel="nofollow">OpenSUSE in Bastille</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://retrohacker.substack.com/p/bye-cups-printing-with-netcat" rel="nofollow">CUPS printing with netcat</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-21-1-8-released/" rel="nofollow">Opnsense-21.1.8</a></h3>

<hr>

<h3><a href="https://www.netgate.com/blog/pfsense-plus-software-version-21.05.1-is-now-available-for-upgrades" rel="nofollow">pfSense® Plus Software Version 21.05.1 is Now Available</a></h3>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [MAC Inspired FreeBSD release](https://github.com/mszoek/airyx)
• [Implement unprivileged chroot](https://cgit.freebsd.org/src/commit/?id=a40cf4175c90142442d0c6515f6c83956336699b)
• [InitWare: A systemd fork that runs on BSD](https://github.com/InitWare/InitWare)
• [multics gets a new release](https://multics-wiki.swenson.org/index.php/Main_Page)
• [Open Source Voices interview with Tom Jones](https://www.opensourcevoices.org/17)
• [PDP 11/03 Engineering Drawings](https://twitter.com/q5sys/status/1423092689084551171)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/Olvier%20-%20zfs.md" rel="nofollow">Oliver - zfs</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/anders%20-%20vms.md" rel="nofollow">anders - vms</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/jeff%20-%20byhve%20guests.md" rel="nofollow">jeff - byhve guests</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>415: Wrong OS Switch</title>
  <link>https://www.bsdnow.tv/415</link>
  <guid isPermaLink="false">272363c1-3756-4e81-91c6-a373b2104cc6</guid>
  <pubDate>Thu, 12 Aug 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/272363c1-3756-4e81-91c6-a373b2104cc6.mp3" length="33829368" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle></itunes:subtitle>
  <itunes:duration>54:17</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Wrong Way to Switch Server OS, Net/1 and Net/2 – A Path to Freedom, Permissions Two Mistakes, OpenBSD progress in supporting riscv64 platform, I2P intro, git sync murder is out, GhostBSD init system poll, and more  
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
The Wrong Way to Switch Operating Systems on Your Server (https://figbert.com/posts/wrong-way-to-switch-server-os/)
History of FreeBSD Part 5: Net/1 and Net/2 – A Path to Freedom (https://klarasystems.com/articles/history-of-freebsd-net-1-and-net-2-a-path-to-freedom/)
News Roundup
Permissions Two Mistakes (https://utcc.utoronto.ca/~cks/space/blog/unix/PermissionsTwoMistakes)
Progress in support for the riscv64 platform (https://undeadly.org/cgi?action=article;sid=20210619161607)
I2P Intro (https://dataswamp.org/~solene/2021-06-20-i2p-intro.html)
“$ git sync murder” is out, so: how many books have I written? (https://mwl.io/archives/12105)
What init system would you prefer to use under GhostBSD? (https://www.ghostbsd.org/what_init_system_pool)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - Replication (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Brad%20-%20Replication.md)
Benedict writes after the show was over: The tool is called https://github.com/allanjude/zxfer
Tom tweeted right after recording stopped: 
https://twitter.com/adventureloop/status/1420478529238622210
Caleb - Pronunciation of Gemini (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Caleb%20-%20Pronounciation%20of%20Gemini.md)
Dan - Writeup about a DO FreeBSD Droplet (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Dan%20-%20Writeup%20about%20a%20DO%20FreeBSD%20Droplet.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, switch, server os, net/1, net/2, freedom, permissions, mistakes, riscv64, i2p, git sync murder, ghostbsd, init system </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Wrong Way to Switch Server OS, Net/1 and Net/2 – A Path to Freedom, Permissions Two Mistakes, OpenBSD progress in supporting riscv64 platform, I2P intro, git sync murder is out, GhostBSD init system poll, and more  </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://figbert.com/posts/wrong-way-to-switch-server-os/" rel="nofollow">The Wrong Way to Switch Operating Systems on Your Server</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/history-of-freebsd-net-1-and-net-2-a-path-to-freedom/" rel="nofollow">History of FreeBSD Part 5: Net/1 and Net/2 – A Path to Freedom</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/PermissionsTwoMistakes" rel="nofollow">Permissions Two Mistakes</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210619161607" rel="nofollow">Progress in support for the riscv64 platform</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-06-20-i2p-intro.html" rel="nofollow">I2P Intro</a></h3>

<hr>

<h3><a href="https://mwl.io/archives/12105" rel="nofollow">“$ git sync murder” is out, so: how many books have I written?</a></h3>

<hr>

<h3><a href="https://www.ghostbsd.org/what_init_system_pool" rel="nofollow">What init system would you prefer to use under GhostBSD?</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Brad%20-%20Replication.md" rel="nofollow">Brad - Replication</a>
Benedict writes after the show was over: The tool is called <a href="https://github.com/allanjude/zxfer" rel="nofollow">https://github.com/allanjude/zxfer</a>
Tom tweeted right after recording stopped: 
<a href="https://twitter.com/adventureloop/status/1420478529238622210" rel="nofollow">https://twitter.com/adventureloop/status/1420478529238622210</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Caleb%20-%20Pronounciation%20of%20Gemini.md" rel="nofollow">Caleb - Pronunciation of Gemini</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Dan%20-%20Writeup%20about%20a%20DO%20FreeBSD%20Droplet.md" rel="nofollow">Dan - Writeup about a DO FreeBSD Droplet</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Wrong Way to Switch Server OS, Net/1 and Net/2 – A Path to Freedom, Permissions Two Mistakes, OpenBSD progress in supporting riscv64 platform, I2P intro, git sync murder is out, GhostBSD init system poll, and more  </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://figbert.com/posts/wrong-way-to-switch-server-os/" rel="nofollow">The Wrong Way to Switch Operating Systems on Your Server</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/history-of-freebsd-net-1-and-net-2-a-path-to-freedom/" rel="nofollow">History of FreeBSD Part 5: Net/1 and Net/2 – A Path to Freedom</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/PermissionsTwoMistakes" rel="nofollow">Permissions Two Mistakes</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210619161607" rel="nofollow">Progress in support for the riscv64 platform</a></h3>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-06-20-i2p-intro.html" rel="nofollow">I2P Intro</a></h3>

<hr>

<h3><a href="https://mwl.io/archives/12105" rel="nofollow">“$ git sync murder” is out, so: how many books have I written?</a></h3>

<hr>

<h3><a href="https://www.ghostbsd.org/what_init_system_pool" rel="nofollow">What init system would you prefer to use under GhostBSD?</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Brad%20-%20Replication.md" rel="nofollow">Brad - Replication</a>
Benedict writes after the show was over: The tool is called <a href="https://github.com/allanjude/zxfer" rel="nofollow">https://github.com/allanjude/zxfer</a>
Tom tweeted right after recording stopped: 
<a href="https://twitter.com/adventureloop/status/1420478529238622210" rel="nofollow">https://twitter.com/adventureloop/status/1420478529238622210</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Caleb%20-%20Pronounciation%20of%20Gemini.md" rel="nofollow">Caleb - Pronunciation of Gemini</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Dan%20-%20Writeup%20about%20a%20DO%20FreeBSD%20Droplet.md" rel="nofollow">Dan - Writeup about a DO FreeBSD Droplet</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>414: Running online conferences</title>
  <link>https://www.bsdnow.tv/414</link>
  <guid isPermaLink="false">8ff1080d-5b31-430b-91ae-f2d5431bb1cb</guid>
  <pubDate>Thu, 05 Aug 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8ff1080d-5b31-430b-91ae-f2d5431bb1cb.mp3" length="41045544" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS 2.1 is out, FreeBSD TCP Performance System Controls, IPFS OpenBSD, tips for running an online conference, fanless OpenBSD laptop, and more.</itunes:subtitle>
  <itunes:duration>1:03:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS 2.1 is out, FreeBSD TCP Performance System Controls, IPFS OpenBSD, tips for running an online conference, fanless OpenBSD laptop, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
OpenZFS 2.1 is out (https://arstechnica.com/gadgets/2021/07/a-deep-dive-into-openzfs-2-1s-new-distributed-raid-topology/)
FreeBSD TCP Performance System Controls (https://klarasystems.com/articles/freebsd-tcp-performance-system-controls/)
News Roundup
IPFS OpenBSD (https://dataswamp.org/~solene/2021-04-17-ipfs-openbsd.html)
Tips for running an online conference (https://dan.langille.org/2021/07/23/tips-for-running-an-online-conference/)
My Fanless OpenBSD Desktop (https://jcs.org/2021/07/19/desktop)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Bruce - Upgrading (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/Bruce%20-%20Upgrading.md)
Chris - SMB Followup (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/Chris%20-%20SMB%20Followup.md)
dmilith - kTLS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/dmilith%20-%20kTLS.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, openzfs, tcp, performance, system controls, ipfs, conference, online, fanless</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS 2.1 is out, FreeBSD TCP Performance System Controls, IPFS OpenBSD, tips for running an online conference, fanless OpenBSD laptop, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://arstechnica.com/gadgets/2021/07/a-deep-dive-into-openzfs-2-1s-new-distributed-raid-topology/" rel="nofollow">OpenZFS 2.1 is out</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/freebsd-tcp-performance-system-controls/" rel="nofollow">FreeBSD TCP Performance System Controls</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-04-17-ipfs-openbsd.html" rel="nofollow">IPFS OpenBSD</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2021/07/23/tips-for-running-an-online-conference/" rel="nofollow">Tips for running an online conference</a></h3>

<hr>

<h3><a href="https://jcs.org/2021/07/19/desktop" rel="nofollow">My Fanless OpenBSD Desktop</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/Bruce%20-%20Upgrading.md" rel="nofollow">Bruce - Upgrading</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/Chris%20-%20SMB%20Followup.md" rel="nofollow">Chris - SMB Followup</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/dmilith%20-%20kTLS.md" rel="nofollow">dmilith - kTLS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS 2.1 is out, FreeBSD TCP Performance System Controls, IPFS OpenBSD, tips for running an online conference, fanless OpenBSD laptop, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://arstechnica.com/gadgets/2021/07/a-deep-dive-into-openzfs-2-1s-new-distributed-raid-topology/" rel="nofollow">OpenZFS 2.1 is out</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/freebsd-tcp-performance-system-controls/" rel="nofollow">FreeBSD TCP Performance System Controls</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-04-17-ipfs-openbsd.html" rel="nofollow">IPFS OpenBSD</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2021/07/23/tips-for-running-an-online-conference/" rel="nofollow">Tips for running an online conference</a></h3>

<hr>

<h3><a href="https://jcs.org/2021/07/19/desktop" rel="nofollow">My Fanless OpenBSD Desktop</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/Bruce%20-%20Upgrading.md" rel="nofollow">Bruce - Upgrading</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/Chris%20-%20SMB%20Followup.md" rel="nofollow">Chris - SMB Followup</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/dmilith%20-%20kTLS.md" rel="nofollow">dmilith - kTLS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>413: BSD/Linux Chimera</title>
  <link>https://www.bsdnow.tv/413</link>
  <guid isPermaLink="false">e54035b9-3b93-4966-b35f-d6bf7ac2c51c</guid>
  <pubDate>Thu, 29 Jul 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e54035b9-3b93-4966-b35f-d6bf7ac2c51c.mp3" length="29515944" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Updating GCC GNAT (Ada) in pkgsrc/NetBSD, AdvanceBSD thoughts 2/2, FreeBSD from a NetBSD user’s perspective, FPGA programming and DragonFly, Chimera Linux, EuroBSDcon 2021, and more.</itunes:subtitle>
  <itunes:duration>46:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Updating GCC GNAT (Ada) in pkgsrc/NetBSD, AdvanceBSD thoughts 2/2, FreeBSD from a NetBSD user’s perspective, FPGA programming and DragonFly, Chimera Linux, EuroBSDcon 2021, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Updating GCC GNAT (Ada) in pkgsrc/NetBSD (https://www.irvise.xyz/Projects%20&amp;amp;%20Engineering/updating-gcc-ada-pkgsrc.html)
Advance!BSD – thoughts on a not-for-profit project to support *BSD (2/2) (https://eerielinux.wordpress.com/2021/06/20/advancebsd-thoughts-on-a-not-for-profit-project-to-support-bsd-2-2/)
News Roundup
FreeBSD from a NetBSD user’s perspective (https://washbear.neocities.org/freebsd-netbsd-user.html)
FPGA programming and DragonFly (https://mastodon.sdf.org/@yrabbit/106497663837700420)
Chimera Linux - A Linux distribution based on FreeBSD userland and LLVM (https://chimera-linux.org/)
EuroBSDcon 2021 (https://2021.eurobsdcon.org/about/program/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Charlie - several questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/Charlie%20-%20several%20questions.md)
Dan - kernel driver or module question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/Dan%20-%20kernel%20driver%20or%20module%20question.md)
James - Apple M1 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/James%20-%20Apple%20M1.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, gcc gnat, pkgsrc, advancebsd, user perspective, fpga, programming, chimera linux, eurobsdcon 2021 </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Updating GCC GNAT (Ada) in pkgsrc/NetBSD, AdvanceBSD thoughts 2/2, FreeBSD from a NetBSD user’s perspective, FPGA programming and DragonFly, Chimera Linux, EuroBSDcon 2021, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.irvise.xyz/Projects%20&%20Engineering/updating-gcc-ada-pkgsrc.html" rel="nofollow">Updating GCC GNAT (Ada) in pkgsrc/NetBSD</a></h3>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2021/06/20/advancebsd-thoughts-on-a-not-for-profit-project-to-support-bsd-2-2/" rel="nofollow">Advance!BSD – thoughts on a not-for-profit project to support *BSD (2/2)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://washbear.neocities.org/freebsd-netbsd-user.html" rel="nofollow">FreeBSD from a NetBSD user’s perspective</a></h3>

<hr>

<h3><a href="https://mastodon.sdf.org/@yrabbit/106497663837700420" rel="nofollow">FPGA programming and DragonFly</a></h3>

<hr>

<h3><a href="https://chimera-linux.org/" rel="nofollow">Chimera Linux - A Linux distribution based on FreeBSD userland and LLVM</a></h3>

<hr>

<h3><a href="https://2021.eurobsdcon.org/about/program/" rel="nofollow">EuroBSDcon 2021</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/Charlie%20-%20several%20questions.md" rel="nofollow">Charlie - several questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/Dan%20-%20kernel%20driver%20or%20module%20question.md" rel="nofollow">Dan - kernel driver or module question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/James%20-%20Apple%20M1.md" rel="nofollow">James - Apple M1</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Updating GCC GNAT (Ada) in pkgsrc/NetBSD, AdvanceBSD thoughts 2/2, FreeBSD from a NetBSD user’s perspective, FPGA programming and DragonFly, Chimera Linux, EuroBSDcon 2021, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.irvise.xyz/Projects%20&%20Engineering/updating-gcc-ada-pkgsrc.html" rel="nofollow">Updating GCC GNAT (Ada) in pkgsrc/NetBSD</a></h3>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2021/06/20/advancebsd-thoughts-on-a-not-for-profit-project-to-support-bsd-2-2/" rel="nofollow">Advance!BSD – thoughts on a not-for-profit project to support *BSD (2/2)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://washbear.neocities.org/freebsd-netbsd-user.html" rel="nofollow">FreeBSD from a NetBSD user’s perspective</a></h3>

<hr>

<h3><a href="https://mastodon.sdf.org/@yrabbit/106497663837700420" rel="nofollow">FPGA programming and DragonFly</a></h3>

<hr>

<h3><a href="https://chimera-linux.org/" rel="nofollow">Chimera Linux - A Linux distribution based on FreeBSD userland and LLVM</a></h3>

<hr>

<h3><a href="https://2021.eurobsdcon.org/about/program/" rel="nofollow">EuroBSDcon 2021</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/Charlie%20-%20several%20questions.md" rel="nofollow">Charlie - several questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/Dan%20-%20kernel%20driver%20or%20module%20question.md" rel="nofollow">Dan - kernel driver or module question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/James%20-%20Apple%20M1.md" rel="nofollow">James - Apple M1</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>412: Command-line secrets</title>
  <link>https://www.bsdnow.tv/412</link>
  <guid isPermaLink="false">f3fe3f12-5ca4-4339-b8e6-b5ca17f067d9</guid>
  <pubDate>Thu, 22 Jul 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f3fe3f12-5ca4-4339-b8e6-b5ca17f067d9.mp3" length="31518216" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Performance Observability, Advance!BSD thoughts 1/2, Lumina Desktop Maintainership Change, How to Handle Secrets on the Command Line, Like NetBSD DragonFlyBSD Now Has "COVID", and more.</itunes:subtitle>
  <itunes:duration>50:46</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Performance Observability, Advance!BSD thoughts 1/2, Lumina Desktop Maintainership Change, How to Handle Secrets on the Command Line, Like NetBSD DragonFlyBSD Now Has "COVID", and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
FreeBSD Performance Observability (https://klarasystems.com/articles/freebsd-performance-observability/)
Advance!BSD – thoughts on a not-for-profit project to support *BSD (1/2) (https://eerielinux.wordpress.com/2021/06/20/advancebsd-thoughts-on-a-not-for-profit-project-to-support-bsd-1-2/)
News Roundup
Maintainership Change :: Lumina Desktop Environment (https://lumina-desktop.org/post/2021-06-23/)
Study the past if you would define the Future (https://lumina-desktop.org/post/2021-07-01/)
How to Handle Secrets on the Command Line (https://smallstep.com/blog/command-line-secrets/)
Following NetBSD, DragonFlyBSD Now Has "COVID" (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=DragonFlyBSD-COVID)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Jim - freebsd kde (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/Jim%20-%20freebsd%20kde.md)
michal - zfs question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/michal%20-%20zfs%20question.md)
tim - lumina and snapshots (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/tim%20-%20lumina%20and%20snapshots.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, performance, observability, advancebsd, lumina desktop, desktop environment, maintainership, secrets, command line</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Performance Observability, Advance!BSD thoughts 1/2, Lumina Desktop Maintainership Change, How to Handle Secrets on the Command Line, Like NetBSD DragonFlyBSD Now Has &quot;COVID&quot;, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-performance-observability/" rel="nofollow">FreeBSD Performance Observability</a></h3>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2021/06/20/advancebsd-thoughts-on-a-not-for-profit-project-to-support-bsd-1-2/" rel="nofollow">Advance!BSD – thoughts on a not-for-profit project to support *BSD (1/2)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lumina-desktop.org/post/2021-06-23/" rel="nofollow">Maintainership Change :: Lumina Desktop Environment</a></h3>

<h3><a href="https://lumina-desktop.org/post/2021-07-01/" rel="nofollow">Study the past if you would define the Future</a></h3>

<hr>

<h3><a href="https://smallstep.com/blog/command-line-secrets/" rel="nofollow">How to Handle Secrets on the Command Line</a></h3>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-COVID" rel="nofollow">Following NetBSD, DragonFlyBSD Now Has &quot;COVID&quot;</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/Jim%20-%20freebsd%20kde.md" rel="nofollow">Jim - freebsd kde</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/michal%20-%20zfs%20question.md" rel="nofollow">michal - zfs question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/tim%20-%20lumina%20and%20snapshots.md" rel="nofollow">tim - lumina and snapshots</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Performance Observability, Advance!BSD thoughts 1/2, Lumina Desktop Maintainership Change, How to Handle Secrets on the Command Line, Like NetBSD DragonFlyBSD Now Has &quot;COVID&quot;, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-performance-observability/" rel="nofollow">FreeBSD Performance Observability</a></h3>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2021/06/20/advancebsd-thoughts-on-a-not-for-profit-project-to-support-bsd-1-2/" rel="nofollow">Advance!BSD – thoughts on a not-for-profit project to support *BSD (1/2)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lumina-desktop.org/post/2021-06-23/" rel="nofollow">Maintainership Change :: Lumina Desktop Environment</a></h3>

<h3><a href="https://lumina-desktop.org/post/2021-07-01/" rel="nofollow">Study the past if you would define the Future</a></h3>

<hr>

<h3><a href="https://smallstep.com/blog/command-line-secrets/" rel="nofollow">How to Handle Secrets on the Command Line</a></h3>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-COVID" rel="nofollow">Following NetBSD, DragonFlyBSD Now Has &quot;COVID&quot;</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/Jim%20-%20freebsd%20kde.md" rel="nofollow">Jim - freebsd kde</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/michal%20-%20zfs%20question.md" rel="nofollow">michal - zfs question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/tim%20-%20lumina%20and%20snapshots.md" rel="nofollow">tim - lumina and snapshots</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>411: FreeBSD Deep Dive</title>
  <link>https://www.bsdnow.tv/411</link>
  <guid isPermaLink="false">fbef1ff0-004b-4e2f-ba8a-60da4d3d818f</guid>
  <pubDate>Thu, 15 Jul 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fbef1ff0-004b-4e2f-ba8a-60da4d3d818f.mp3" length="29125920" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Unix System Architecture Evolution, Deep Dive into FreeBSD’s Strengths, how developers chose names, OPNsense 21.1.7 released, Support for chdir(2) in posix_spawn(3), vagrant-freebsd-boxbuilder, OpenBSD’s IATA airport code file, and more</itunes:subtitle>
  <itunes:duration>46:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Unix System Architecture Evolution, Deep Dive into FreeBSD’s Strengths, how developers chose names, OPNsense 21.1.7 released, Support for chdir(2) in posix_spawn(3), vagrant-freebsd-boxbuilder, OpenBSD’s IATA airport code file, and more
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
The Evolution of the Unix System Architecture (https://www.spinellis.gr/blog/20210618/index.html)
• Full IEEE article: https://ieeexplore.ieee.org/document/8704965
Deep Diving Into the Strengths of FreeBSD (https://klarasystems.com/articles/deep-diving-into-the-strengths-of-freebsd/)
Interesting read on how Developers choose Names (https://arxiv.org/abs/2103.07487)
News Roundup
OPNsense 21.1.7 released (https://opnsense.org/opnsense-21-1-7-released/)
Support for chdir(2) in posix_spawn(3) (http://blog.netbsd.org/tnf/entry/support_for_chdir_2_in)
vagrant-freebsd-boxbuilder (https://github.com/punktDe/vagrant-freebsd-boxbuilder)
OpenBSD has a file with 3-letter IATA airport codes (https://twitter.com/jpmens/status/1408825989174546434?s=28)
Beastie Bits
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
lyubo - ipfw question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/lyubo%20-%20ipfw%20question.md)
michael - a netbsd story (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/michael%20-%20a%20netbsd%20story.md)
sven - a dogs garage (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/sven%20-%20a%20dogs%20garage.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, system, system architecture, evolution, deep dive, strengths, developers, chose name, opnsense, chdir, posix_spawn, freebsd boxbuilder, iata, airport code</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Unix System Architecture Evolution, Deep Dive into FreeBSD’s Strengths, how developers chose names, OPNsense 21.1.7 released, Support for chdir(2) in posix_spawn(3), vagrant-freebsd-boxbuilder, OpenBSD’s IATA airport code file, and more</p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.spinellis.gr/blog/20210618/index.html" rel="nofollow">The Evolution of the Unix System Architecture</a></h3>

<pre><code>• Full IEEE article: https://ieeexplore.ieee.org/document/8704965
</code></pre>

<hr>

<h3><a href="https://klarasystems.com/articles/deep-diving-into-the-strengths-of-freebsd/" rel="nofollow">Deep Diving Into the Strengths of FreeBSD</a></h3>

<hr>

<hr>

<h3><a href="https://arxiv.org/abs/2103.07487" rel="nofollow">Interesting read on how Developers choose Names</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://opnsense.org/opnsense-21-1-7-released/" rel="nofollow">OPNsense 21.1.7 released</a></h3>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/support_for_chdir_2_in" rel="nofollow">Support for chdir(2) in posix_spawn(3)</a></h3>

<hr>

<h3><a href="https://github.com/punktDe/vagrant-freebsd-boxbuilder" rel="nofollow">vagrant-freebsd-boxbuilder</a></h3>

<hr>

<h3><a href="https://twitter.com/jpmens/status/1408825989174546434?s=28" rel="nofollow">OpenBSD has a file with 3-letter IATA airport codes</a></h3>

<h2>Beastie Bits</h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/lyubo%20-%20ipfw%20question.md" rel="nofollow">lyubo - ipfw question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/michael%20-%20a%20netbsd%20story.md" rel="nofollow">michael - a netbsd story</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/sven%20-%20a%20dogs%20garage.md" rel="nofollow">sven - a dogs garage</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Unix System Architecture Evolution, Deep Dive into FreeBSD’s Strengths, how developers chose names, OPNsense 21.1.7 released, Support for chdir(2) in posix_spawn(3), vagrant-freebsd-boxbuilder, OpenBSD’s IATA airport code file, and more</p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.spinellis.gr/blog/20210618/index.html" rel="nofollow">The Evolution of the Unix System Architecture</a></h3>

<pre><code>• Full IEEE article: https://ieeexplore.ieee.org/document/8704965
</code></pre>

<hr>

<h3><a href="https://klarasystems.com/articles/deep-diving-into-the-strengths-of-freebsd/" rel="nofollow">Deep Diving Into the Strengths of FreeBSD</a></h3>

<hr>

<hr>

<h3><a href="https://arxiv.org/abs/2103.07487" rel="nofollow">Interesting read on how Developers choose Names</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://opnsense.org/opnsense-21-1-7-released/" rel="nofollow">OPNsense 21.1.7 released</a></h3>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/support_for_chdir_2_in" rel="nofollow">Support for chdir(2) in posix_spawn(3)</a></h3>

<hr>

<h3><a href="https://github.com/punktDe/vagrant-freebsd-boxbuilder" rel="nofollow">vagrant-freebsd-boxbuilder</a></h3>

<hr>

<h3><a href="https://twitter.com/jpmens/status/1408825989174546434?s=28" rel="nofollow">OpenBSD has a file with 3-letter IATA airport codes</a></h3>

<h2>Beastie Bits</h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/lyubo%20-%20ipfw%20question.md" rel="nofollow">lyubo - ipfw question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/michael%20-%20a%20netbsd%20story.md" rel="nofollow">michael - a netbsd story</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/sven%20-%20a%20dogs%20garage.md" rel="nofollow">sven - a dogs garage</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>410: OpenBSD Consumer Gateway</title>
  <link>https://www.bsdnow.tv/410</link>
  <guid isPermaLink="false">ca24916c-088c-4704-b7e5-617a89307013</guid>
  <pubDate>Thu, 08 Jul 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ca24916c-088c-4704-b7e5-617a89307013.mp3" length="26231352" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Open Source and Blogging Bubbles, Building Customized FreeBSD Images, Updating Minecraft in FreeBSD, Upgrading FreeBSD jails using mkjail, Dragonfly 6.0 Performance benchmark, OpenBSD Consumer Gateway Launch, and more.</itunes:subtitle>
  <itunes:duration>41:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Open Source and Blogging Bubbles, Building Customized FreeBSD Images, Updating Minecraft in FreeBSD, Upgrading FreeBSD jails using mkjail, Dragonfly 6.0 Performance benchmark, OpenBSD Consumer Gateway Launch, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
The Open-Source Software bubble that is and the blogging bubble that was (https://www.baldurbjarnason.com/2021/the-oss-bubble-and-the-blogging-bubble/)
Building Customized FreeBSD Images (https://klarasystems.com/articles/building-customized-freebsd-images/)
News Roundup
Updating to Minecraft 1.17 in FreeBSD (https://rubenerd.com/updating-to-minecraft-1-17-in-freebsd/)
Upgrading a FreeBSD 12.2 jail to FreeBSD 13 using mkjail (https://dan.langille.org/2021/05/31/upgrading-a-freebsd-12-2-jail-to-freebsd-13-using-mkjail/)
DragonFlyBSD 6.0 Is Performing Very Well Against Ubuntu Linux, FreeBSD 13.0 (https://www.phoronix.com/scan.php?page=article&amp;amp;item=corei9-freebsd13-dfly6&amp;amp;num=1)
An OpenBSD Consumer Gateway Launch (https://www.mail-archive.com/misc@openbsd.org/msg178573.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
CY - bearssl (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/CY%20-%20bearssl.md)
Marc - that tarsnap ad (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/Marc%20-%20that%20tarsnap%20ad.md)
nycbug (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/nycbug.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, blogging, blog, bubble, custom image, building images, minecraft, upgrading, mkjail, performance, consumer, consumer gateway, gateway launch</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Open Source and Blogging Bubbles, Building Customized FreeBSD Images, Updating Minecraft in FreeBSD, Upgrading FreeBSD jails using mkjail, Dragonfly 6.0 Performance benchmark, OpenBSD Consumer Gateway Launch, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.baldurbjarnason.com/2021/the-oss-bubble-and-the-blogging-bubble/" rel="nofollow">The Open-Source Software bubble that is and the blogging bubble that was</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/building-customized-freebsd-images/" rel="nofollow">Building Customized FreeBSD Images</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://rubenerd.com/updating-to-minecraft-1-17-in-freebsd/" rel="nofollow">Updating to Minecraft 1.17 in FreeBSD</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2021/05/31/upgrading-a-freebsd-12-2-jail-to-freebsd-13-using-mkjail/" rel="nofollow">Upgrading a FreeBSD 12.2 jail to FreeBSD 13 using mkjail</a></h3>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=article&item=corei9-freebsd13-dfly6&num=1" rel="nofollow">DragonFlyBSD 6.0 Is Performing Very Well Against Ubuntu Linux, FreeBSD 13.0</a></h3>

<hr>

<h3><a href="https://www.mail-archive.com/misc@openbsd.org/msg178573.html" rel="nofollow">An OpenBSD Consumer Gateway Launch</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/CY%20-%20bearssl.md" rel="nofollow">CY - bearssl</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/Marc%20-%20that%20tarsnap%20ad.md" rel="nofollow">Marc - that tarsnap ad</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/nycbug.md" rel="nofollow">nycbug</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Open Source and Blogging Bubbles, Building Customized FreeBSD Images, Updating Minecraft in FreeBSD, Upgrading FreeBSD jails using mkjail, Dragonfly 6.0 Performance benchmark, OpenBSD Consumer Gateway Launch, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.baldurbjarnason.com/2021/the-oss-bubble-and-the-blogging-bubble/" rel="nofollow">The Open-Source Software bubble that is and the blogging bubble that was</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/building-customized-freebsd-images/" rel="nofollow">Building Customized FreeBSD Images</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://rubenerd.com/updating-to-minecraft-1-17-in-freebsd/" rel="nofollow">Updating to Minecraft 1.17 in FreeBSD</a></h3>

<hr>

<h3><a href="https://dan.langille.org/2021/05/31/upgrading-a-freebsd-12-2-jail-to-freebsd-13-using-mkjail/" rel="nofollow">Upgrading a FreeBSD 12.2 jail to FreeBSD 13 using mkjail</a></h3>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=article&item=corei9-freebsd13-dfly6&num=1" rel="nofollow">DragonFlyBSD 6.0 Is Performing Very Well Against Ubuntu Linux, FreeBSD 13.0</a></h3>

<hr>

<h3><a href="https://www.mail-archive.com/misc@openbsd.org/msg178573.html" rel="nofollow">An OpenBSD Consumer Gateway Launch</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/CY%20-%20bearssl.md" rel="nofollow">CY - bearssl</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/Marc%20-%20that%20tarsnap%20ad.md" rel="nofollow">Marc - that tarsnap ad</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/nycbug.md" rel="nofollow">nycbug</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>409: The Filesystem Dungeon</title>
  <link>https://www.bsdnow.tv/409</link>
  <guid isPermaLink="false">de8a3516-c307-49bf-8afc-4f880bca5739</guid>
  <pubDate>Thu, 01 Jul 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/de8a3516-c307-49bf-8afc-4f880bca5739.mp3" length="32932752" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>DTrace network probes, next 50 years of shell programming, NetBSD on the Vortex86DX CPU, system CPU time in top, your filesystem as a dungeon, diving into toolchains, and more</itunes:subtitle>
  <itunes:duration>52:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>DTrace network probes, next 50 years of shell programming, NetBSD on the Vortex86DX CPU, system CPU time in top, your filesystem as a dungeon, diving into toolchains, and more 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
DTrace Network Probes (https://klarasystems.com/articles/dtrace-network-probes/)
Unix Shell Programming: The Next 50 Years (https://sigops.org/s/conferences/hotos/2021/papers/hotos21-s06-greenberg.pdf)
News Roundup
NetBSD on the Vortex86DX CPU (https://www.cambus.net/netbsd-on-the-vortex86dx-cpu/)
System CPU time – ‘sys’ time in top (https://blog.ycrash.io/2020/11/28/system-cpu-time-sys-time-in-top/)
rpg-cli —your filesystem as a dungeon! (https://github.com/facundoolano/rpg-cli)
Diving into toolchains (https://www.cambus.net/diving-into-toolchains/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
• [Alfred - Advice](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/Alfred%20-%20Advice)
• [CY - Portable Patch Util](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/CY%20-%20Portable%20Patch%20Util)
• [Denis - State of ZFS Ecosystem](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/Denis%20-%20State%20of%20ZFS%20Ecosystem)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, DTrace, network probes, shell, shell programming, vortex86dx, cpu time, top, filesystem, dungeon, diving, toolchain</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>DTrace network probes, next 50 years of shell programming, NetBSD on the Vortex86DX CPU, system CPU time in top, your filesystem as a dungeon, diving into toolchains, and more </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/dtrace-network-probes/" rel="nofollow">DTrace Network Probes</a></h3>

<hr>

<h3><a href="https://sigops.org/s/conferences/hotos/2021/papers/hotos21-s06-greenberg.pdf" rel="nofollow">Unix Shell Programming: The Next 50 Years</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.cambus.net/netbsd-on-the-vortex86dx-cpu/" rel="nofollow">NetBSD on the Vortex86DX CPU</a></h3>

<hr>

<h3><a href="https://blog.ycrash.io/2020/11/28/system-cpu-time-sys-time-in-top/" rel="nofollow">System CPU time – ‘sys’ time in top</a></h3>

<hr>

<h3><a href="https://github.com/facundoolano/rpg-cli" rel="nofollow">rpg-cli —your filesystem as a dungeon!</a></h3>

<hr>

<h3><a href="https://www.cambus.net/diving-into-toolchains/" rel="nofollow">Diving into toolchains</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• [Alfred - Advice](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/Alfred%20-%20Advice)
• [CY - Portable Patch Util](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/CY%20-%20Portable%20Patch%20Util)
• [Denis - State of ZFS Ecosystem](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/Denis%20-%20State%20of%20ZFS%20Ecosystem)
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>DTrace network probes, next 50 years of shell programming, NetBSD on the Vortex86DX CPU, system CPU time in top, your filesystem as a dungeon, diving into toolchains, and more </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/dtrace-network-probes/" rel="nofollow">DTrace Network Probes</a></h3>

<hr>

<h3><a href="https://sigops.org/s/conferences/hotos/2021/papers/hotos21-s06-greenberg.pdf" rel="nofollow">Unix Shell Programming: The Next 50 Years</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.cambus.net/netbsd-on-the-vortex86dx-cpu/" rel="nofollow">NetBSD on the Vortex86DX CPU</a></h3>

<hr>

<h3><a href="https://blog.ycrash.io/2020/11/28/system-cpu-time-sys-time-in-top/" rel="nofollow">System CPU time – ‘sys’ time in top</a></h3>

<hr>

<h3><a href="https://github.com/facundoolano/rpg-cli" rel="nofollow">rpg-cli —your filesystem as a dungeon!</a></h3>

<hr>

<h3><a href="https://www.cambus.net/diving-into-toolchains/" rel="nofollow">Diving into toolchains</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• [Alfred - Advice](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/Alfred%20-%20Advice)
• [CY - Portable Patch Util](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/CY%20-%20Portable%20Patch%20Util)
• [Denis - State of ZFS Ecosystem](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/Denis%20-%20State%20of%20ZFS%20Ecosystem)
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>408: FreeBSD DevSummit 2021</title>
  <link>https://www.bsdnow.tv/408</link>
  <guid isPermaLink="false">62094053-3e0f-4996-ac35-7d3f3a62572d</guid>
  <pubDate>Thu, 24 Jun 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/62094053-3e0f-4996-ac35-7d3f3a62572d.mp3" length="37936488" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Report from virtual FreeBSD DevSummit 2021, another promising release by FreeBSD Based helloSystem, GearBSD, OpenBGPD release, Let’s Encrypt on OpenBSD, FreeBSD 13 on the Panasonic Let’s Note, and more
</itunes:subtitle>
  <itunes:duration>57:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Report from virtual FreeBSD DevSummit 2021, another promising release by FreeBSD Based helloSystem, GearBSD, OpenBGPD release, Let’s Encrypt on OpenBSD, FreeBSD 13 on the Panasonic Let’s Note, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
2021 FreeBSD Developer Summit (https://klarasystems.com/articles/freebsd-developer-summit-2021/)
helloSystem – FreeBSD Based OS Brings another Promising Release 0.5.0 (https://www.debugpoint.com/2021/06/hellosystem-0-5-0-release/)
News Roundup
GearBSD: a project to help automating your OpenBSD (https://dataswamp.org/~solene/2021-06-01-gearbsd.html)
OpenBGPD 7.0 released (https://bsdsec.net/articles/openbgpd-7-0-released)
Simple use of Let's Encrypt on OpenBSD is pleasantly straightforward (as of 6.8) (https://utcc.utoronto.ca/~cks/space/blog/unix/OpenBSDNiceLetsEncrypt)
FreeBSD 13 on the Panasonic Let’s Note CF-RZ6 (https://rubenerd.com/freebsd-13-on-the-panasonic-cf-rz6/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
• [Paul - ZFS Questions](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/Paul%20-%20ZFS%20Questions)
• [Rafael - relic](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/Rafael%20-%20relic)
• [matthew - sendfile and ktls](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/matthew%20-%20sendfile%20and%20ktls)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, devsummit, report, helloSystem, GearBSD, openBGPD, let’s encrypt, encryption, ssl, tls, panasonic, let’s note</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Report from virtual FreeBSD DevSummit 2021, another promising release by FreeBSD Based helloSystem, GearBSD, OpenBGPD release, Let’s Encrypt on OpenBSD, FreeBSD 13 on the Panasonic Let’s Note, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-developer-summit-2021/" rel="nofollow">2021 FreeBSD Developer Summit</a></h3>

<hr>

<h3><a href="https://www.debugpoint.com/2021/06/hellosystem-0-5-0-release/" rel="nofollow">helloSystem – FreeBSD Based OS Brings another Promising Release 0.5.0</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-06-01-gearbsd.html" rel="nofollow">GearBSD: a project to help automating your OpenBSD</a></h3>

<hr>

<h3><a href="https://bsdsec.net/articles/openbgpd-7-0-released" rel="nofollow">OpenBGPD 7.0 released</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/OpenBSDNiceLetsEncrypt" rel="nofollow">Simple use of Let&#39;s Encrypt on OpenBSD is pleasantly straightforward (as of 6.8)</a></h3>

<hr>

<h3><a href="https://rubenerd.com/freebsd-13-on-the-panasonic-cf-rz6/" rel="nofollow">FreeBSD 13 on the Panasonic Let’s Note CF-RZ6</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• [Paul - ZFS Questions](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/Paul%20-%20ZFS%20Questions)
• [Rafael - relic](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/Rafael%20-%20relic)
• [matthew - sendfile and ktls](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/matthew%20-%20sendfile%20and%20ktls)
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Report from virtual FreeBSD DevSummit 2021, another promising release by FreeBSD Based helloSystem, GearBSD, OpenBGPD release, Let’s Encrypt on OpenBSD, FreeBSD 13 on the Panasonic Let’s Note, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-developer-summit-2021/" rel="nofollow">2021 FreeBSD Developer Summit</a></h3>

<hr>

<h3><a href="https://www.debugpoint.com/2021/06/hellosystem-0-5-0-release/" rel="nofollow">helloSystem – FreeBSD Based OS Brings another Promising Release 0.5.0</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-06-01-gearbsd.html" rel="nofollow">GearBSD: a project to help automating your OpenBSD</a></h3>

<hr>

<h3><a href="https://bsdsec.net/articles/openbgpd-7-0-released" rel="nofollow">OpenBGPD 7.0 released</a></h3>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/OpenBSDNiceLetsEncrypt" rel="nofollow">Simple use of Let&#39;s Encrypt on OpenBSD is pleasantly straightforward (as of 6.8)</a></h3>

<hr>

<h3><a href="https://rubenerd.com/freebsd-13-on-the-panasonic-cf-rz6/" rel="nofollow">FreeBSD 13 on the Panasonic Let’s Note CF-RZ6</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• [Paul - ZFS Questions](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/Paul%20-%20ZFS%20Questions)
• [Rafael - relic](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/Rafael%20-%20relic)
• [matthew - sendfile and ktls](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/matthew%20-%20sendfile%20and%20ktls)
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>407: The jail Detail</title>
  <link>https://www.bsdnow.tv/407</link>
  <guid isPermaLink="false">ffb08bc6-ffde-4b63-bd68-9f70872557ef</guid>
  <pubDate>Thu, 17 Jun 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ffb08bc6-ffde-4b63-bd68-9f70872557ef.mp3" length="27481848" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Confining the omnipotent root, Jails with ZFS and PF on DigitalOcean, NomadBSD 130R is out, KDE Plasma Wayland on FreeBSD, Firefox under FreeBSD with Privacy, Using NetBSD’s pkgsrc everywhere, and more.</itunes:subtitle>
  <itunes:duration>45:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Confining the omnipotent root, Jails with ZFS and PF on DigitalOcean, NomadBSD 130R is out, KDE Plasma Wayland on FreeBSD, Firefox under FreeBSD with Privacy, Using NetBSD’s pkgsrc everywhere, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Jails: Confining the omnipotent root (http://phk.freebsd.dk/pubs/sane2000-jail.pdf)
A dramatic reading of portions of the paper: Papers We Love: FreeBSD Jails and Solaris Zones (https://paperswelove.org/2016/video/bryan-cantrill-jails-and-solaris-zones/)
***
### 
Using Jails with ZFS and PF on DigitalOcean (https://medium.com/chris-opperwall/using-jails-with-zfs-and-pf-on-digitalocean-b25b1da82e20)
***
## News Roundup
### NomadBSD 130R is out (https://www.itsfoss.net/nomadbsd-130r-is-now-available-to-download-based-on-freebsd-13-0/)
***
### KDE Plasma Wayland - a week in FreeBSD (https://euroquis.nl//kde/2021/05/09/wayland.html)
***
### Install Firefox under FreeBSD and Set it Up with Privacy (https://danschmid.de/en/blog/install-firefox-under-freebsd-and-set-it-up-with-privacy)
***
Using NetBSD’s pkgsrc everywhere I can (https://rubenerd.com/using-netbsds-pkgsrc-everywhere-i-can/)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Malcolm - restoring a single file (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/Malcolm%20-%20restoring%20a%20single%20file)
Nathan - wireless support (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/Nathan%20-%20wireless%20support)
bluefire - zfs special vdev (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/bluefire%20-%20zfs%20special%20vdev)
Push to next show with Allan
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, jail, root, pf, digitalocean, nomadbsd, kde plasma, wayland, firefox, privacy, pkgsrc </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Confining the omnipotent root, Jails with ZFS and PF on DigitalOcean, NomadBSD 130R is out, KDE Plasma Wayland on FreeBSD, Firefox under FreeBSD with Privacy, Using NetBSD’s pkgsrc everywhere, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="http://phk.freebsd.dk/pubs/sane2000-jail.pdf" rel="nofollow">Jails: Confining the omnipotent root</a></h3>

<ul>
<li>A dramatic reading of portions of the paper: <a href="https://paperswelove.org/2016/video/bryan-cantrill-jails-and-solaris-zones/" rel="nofollow">Papers We Love: FreeBSD Jails and Solaris Zones</a>
***
### 
<a href="https://medium.com/chris-opperwall/using-jails-with-zfs-and-pf-on-digitalocean-b25b1da82e20" rel="nofollow">Using Jails with ZFS and PF on DigitalOcean</a>
***
## News Roundup
### <a href="https://www.itsfoss.net/nomadbsd-130r-is-now-available-to-download-based-on-freebsd-13-0/" rel="nofollow">NomadBSD 130R is out</a>
***
### <a href="https://euroquis.nl//kde/2021/05/09/wayland.html" rel="nofollow">KDE Plasma Wayland - a week in FreeBSD</a>
***
### <a href="https://danschmid.de/en/blog/install-firefox-under-freebsd-and-set-it-up-with-privacy" rel="nofollow">Install Firefox under FreeBSD and Set it Up with Privacy</a>
***
<a href="https://rubenerd.com/using-netbsds-pkgsrc-everywhere-i-can/" rel="nofollow">Using NetBSD’s pkgsrc everywhere I can</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/Malcolm%20-%20restoring%20a%20single%20file" rel="nofollow">Malcolm - restoring a single file</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/Nathan%20-%20wireless%20support" rel="nofollow">Nathan - wireless support</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/bluefire%20-%20zfs%20special%20vdev" rel="nofollow">bluefire - zfs special vdev</a>
Push to next show with Allan</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Confining the omnipotent root, Jails with ZFS and PF on DigitalOcean, NomadBSD 130R is out, KDE Plasma Wayland on FreeBSD, Firefox under FreeBSD with Privacy, Using NetBSD’s pkgsrc everywhere, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="http://phk.freebsd.dk/pubs/sane2000-jail.pdf" rel="nofollow">Jails: Confining the omnipotent root</a></h3>

<ul>
<li>A dramatic reading of portions of the paper: <a href="https://paperswelove.org/2016/video/bryan-cantrill-jails-and-solaris-zones/" rel="nofollow">Papers We Love: FreeBSD Jails and Solaris Zones</a>
***
### 
<a href="https://medium.com/chris-opperwall/using-jails-with-zfs-and-pf-on-digitalocean-b25b1da82e20" rel="nofollow">Using Jails with ZFS and PF on DigitalOcean</a>
***
## News Roundup
### <a href="https://www.itsfoss.net/nomadbsd-130r-is-now-available-to-download-based-on-freebsd-13-0/" rel="nofollow">NomadBSD 130R is out</a>
***
### <a href="https://euroquis.nl//kde/2021/05/09/wayland.html" rel="nofollow">KDE Plasma Wayland - a week in FreeBSD</a>
***
### <a href="https://danschmid.de/en/blog/install-firefox-under-freebsd-and-set-it-up-with-privacy" rel="nofollow">Install Firefox under FreeBSD and Set it Up with Privacy</a>
***
<a href="https://rubenerd.com/using-netbsds-pkgsrc-everywhere-i-can/" rel="nofollow">Using NetBSD’s pkgsrc everywhere I can</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/Malcolm%20-%20restoring%20a%20single%20file" rel="nofollow">Malcolm - restoring a single file</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/Nathan%20-%20wireless%20support" rel="nofollow">Nathan - wireless support</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/bluefire%20-%20zfs%20special%20vdev" rel="nofollow">bluefire - zfs special vdev</a>
Push to next show with Allan</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>406: Jailed Gemini Capsule</title>
  <link>https://www.bsdnow.tv/406</link>
  <guid isPermaLink="false">e3529950-4aa4-49f7-833d-0218a912b866</guid>
  <pubDate>Thu, 10 Jun 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e3529950-4aa4-49f7-833d-0218a912b866.mp3" length="33123216" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Gemini Capsule in a FreeBSD Jail, FreeBSD Quarterly status report 2021Q1, NetBSD VM on bhyve (on TrueNAS), Interview with Michael Lucas, WireGuard Returns as Experimental Package in pfSense, CGI with Awk on OpenBSD httpd, and more.</itunes:subtitle>
  <itunes:duration>54:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Gemini Capsule in a FreeBSD Jail, FreeBSD Quarterly status report 2021Q1, NetBSD VM on bhyve (on TrueNAS), Interview with Michael Lucas, WireGuard Returns as Experimental Package in pfSense, CGI with Awk on OpenBSD httpd, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Gemini Capsule in a FreeBSD Jail (https://www.ecliptik.com/Gemini-Capsule-in-a-FreeBSD-Jail/)
With the recent release of FreeBSD 13, I wanted to test it out on a spare RaspberryPi 3 that was part of my old Kubernetes cluster.
In particular, FreeBSD Jails have always interested me, although I’ve never used them in practice. Over the years I’ve managed operating system virtualization through Solaris Zones and Docker containers, and Jails seem like and good middle ground between the two - easier to manage than zones and closer to the OS than Docker.
I also want to run my own Gemini capsule locally to use some of the features that my other hosted capsules don’t have (like SCGI/CGI) and setting up a capsule in a Jail is a good way to learn both at the same time.
FreeBSD Quarterly status report 2021Q1 (https://lists.freebsd.org/pipermail/freebsd-announce/2021-May/002033.html)
News Roundup
NetBSD VM on bhyve (on TrueNAS) (https://bentsukun.ch/posts/bhyve-netbsd/)
My new NAS at home is running TrueNAS Core. So far, it has been excellent, however I struggled a bit setting up a NetBSD VM on it. Part of the problem is that a lot of the docs and how-tos I found are stale, and the information in it no longer applies.
TrueNAS Core allows running VMs using bhyve, which is FreeBSD’s hypervisor. NetBSD is not an officially supported OS, at least according to the guest OS chooser in the TrueNAS web UI :) But since the release of NetBSD 9 a while ago, things have become far simpler than they used to be – with one caveat (see below).
Interview with Michael Lucas *BSD, Unix, IT and other books author (https://www.cyberciti.biz/interview/michael-lucas-bsd-unix-it-and-other-books-author/)
Michael Lucas is a famous IT book author. Perhaps best know for FreeBSD, OpenBSD, and Unix book series. He worked as a system administrator for many years and has now become a full-time book writer. Lately, I did a quick Q and A with Michael about his journey as a professional book author and his daily workflow for writing books.
+
pfSense – WireGuard Returns as Experimental Package (https://www.netgate.com/blog/pfsense-wireguard-returns-as-an-experimental-package.html)
CGI with Awk on OpenBSD httpd (https://box.matto.nl/cgi-with-awk-on-openbsd-httpd.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questionsing
Adam - system state during upgrade (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/Adam%20-%20system%20state%20during%20upgrade)
paul - BSD grep (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/paul%20-%20BSD%20grep)
sub - feedback (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/sub%20-%20feedback)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, gemini capsule, jail, status report, vm, bhyve, Michael Lucas, wireguard, experimental package, pfsense, cgi, awk, httpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Gemini Capsule in a FreeBSD Jail, FreeBSD Quarterly status report 2021Q1, NetBSD VM on bhyve (on TrueNAS), Interview with Michael Lucas, WireGuard Returns as Experimental Package in pfSense, CGI with Awk on OpenBSD httpd, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.ecliptik.com/Gemini-Capsule-in-a-FreeBSD-Jail/" rel="nofollow">Gemini Capsule in a FreeBSD Jail</a></h3>

<blockquote>
<p>With the recent release of FreeBSD 13, I wanted to test it out on a spare RaspberryPi 3 that was part of my old Kubernetes cluster.<br>
In particular, FreeBSD Jails have always interested me, although I’ve never used them in practice. Over the years I’ve managed operating system virtualization through Solaris Zones and Docker containers, and Jails seem like and good middle ground between the two - easier to manage than zones and closer to the OS than Docker.<br>
I also want to run my own Gemini capsule locally to use some of the features that my other hosted capsules don’t have (like SCGI/CGI) and setting up a capsule in a Jail is a good way to learn both at the same time.</p>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2021-May/002033.html" rel="nofollow">FreeBSD Quarterly status report 2021Q1</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://bentsukun.ch/posts/bhyve-netbsd/" rel="nofollow">NetBSD VM on bhyve (on TrueNAS)</a></h3>

<blockquote>
<p>My new NAS at home is running TrueNAS Core. So far, it has been excellent, however I struggled a bit setting up a NetBSD VM on it. Part of the problem is that a lot of the docs and how-tos I found are stale, and the information in it no longer applies.<br>
TrueNAS Core allows running VMs using bhyve, which is FreeBSD’s hypervisor. NetBSD is not an officially supported OS, at least according to the guest OS chooser in the TrueNAS web UI :) But since the release of NetBSD 9 a while ago, things have become far simpler than they used to be – with one caveat (see below).</p>
</blockquote>

<hr>

<h3><a href="https://www.cyberciti.biz/interview/michael-lucas-bsd-unix-it-and-other-books-author/" rel="nofollow">Interview with Michael Lucas *BSD, Unix, IT and other books author</a></h3>

<blockquote>
<p>Michael Lucas is a famous IT book author. Perhaps best know for FreeBSD, OpenBSD, and Unix book series. He worked as a system administrator for many years and has now become a full-time book writer. Lately, I did a quick Q and A with Michael about his journey as a professional book author and his daily workflow for writing books.<br>
+</p>

<hr>

<h3><a href="https://www.netgate.com/blog/pfsense-wireguard-returns-as-an-experimental-package.html" rel="nofollow">pfSense – WireGuard Returns as Experimental Package</a></h3>

<hr>

<h3><a href="https://box.matto.nl/cgi-with-awk-on-openbsd-httpd.html" rel="nofollow">CGI with Awk on OpenBSD httpd</a></h3>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questionsing</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/Adam%20-%20system%20state%20during%20upgrade" rel="nofollow">Adam - system state during upgrade</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/paul%20-%20BSD%20grep" rel="nofollow">paul - BSD grep</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/sub%20-%20feedback" rel="nofollow">sub - feedback</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Gemini Capsule in a FreeBSD Jail, FreeBSD Quarterly status report 2021Q1, NetBSD VM on bhyve (on TrueNAS), Interview with Michael Lucas, WireGuard Returns as Experimental Package in pfSense, CGI with Awk on OpenBSD httpd, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.ecliptik.com/Gemini-Capsule-in-a-FreeBSD-Jail/" rel="nofollow">Gemini Capsule in a FreeBSD Jail</a></h3>

<blockquote>
<p>With the recent release of FreeBSD 13, I wanted to test it out on a spare RaspberryPi 3 that was part of my old Kubernetes cluster.<br>
In particular, FreeBSD Jails have always interested me, although I’ve never used them in practice. Over the years I’ve managed operating system virtualization through Solaris Zones and Docker containers, and Jails seem like and good middle ground between the two - easier to manage than zones and closer to the OS than Docker.<br>
I also want to run my own Gemini capsule locally to use some of the features that my other hosted capsules don’t have (like SCGI/CGI) and setting up a capsule in a Jail is a good way to learn both at the same time.</p>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2021-May/002033.html" rel="nofollow">FreeBSD Quarterly status report 2021Q1</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://bentsukun.ch/posts/bhyve-netbsd/" rel="nofollow">NetBSD VM on bhyve (on TrueNAS)</a></h3>

<blockquote>
<p>My new NAS at home is running TrueNAS Core. So far, it has been excellent, however I struggled a bit setting up a NetBSD VM on it. Part of the problem is that a lot of the docs and how-tos I found are stale, and the information in it no longer applies.<br>
TrueNAS Core allows running VMs using bhyve, which is FreeBSD’s hypervisor. NetBSD is not an officially supported OS, at least according to the guest OS chooser in the TrueNAS web UI :) But since the release of NetBSD 9 a while ago, things have become far simpler than they used to be – with one caveat (see below).</p>
</blockquote>

<hr>

<h3><a href="https://www.cyberciti.biz/interview/michael-lucas-bsd-unix-it-and-other-books-author/" rel="nofollow">Interview with Michael Lucas *BSD, Unix, IT and other books author</a></h3>

<blockquote>
<p>Michael Lucas is a famous IT book author. Perhaps best know for FreeBSD, OpenBSD, and Unix book series. He worked as a system administrator for many years and has now become a full-time book writer. Lately, I did a quick Q and A with Michael about his journey as a professional book author and his daily workflow for writing books.<br>
+</p>

<hr>

<h3><a href="https://www.netgate.com/blog/pfsense-wireguard-returns-as-an-experimental-package.html" rel="nofollow">pfSense – WireGuard Returns as Experimental Package</a></h3>

<hr>

<h3><a href="https://box.matto.nl/cgi-with-awk-on-openbsd-httpd.html" rel="nofollow">CGI with Awk on OpenBSD httpd</a></h3>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questionsing</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/Adam%20-%20system%20state%20during%20upgrade" rel="nofollow">Adam - system state during upgrade</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/paul%20-%20BSD%20grep" rel="nofollow">paul - BSD grep</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/sub%20-%20feedback" rel="nofollow">sub - feedback</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>405: OOM Killer Feature</title>
  <link>https://www.bsdnow.tv/405</link>
  <guid isPermaLink="false">6773957b-a891-4528-b317-452e8e5d41fc</guid>
  <pubDate>Thu, 03 Jun 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6773957b-a891-4528-b317-452e8e5d41fc.mp3" length="34765416" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>NetBSD 9.2 released, DragonFly 6.0 is out, Home Network Monitoring using Prometheus, Preventing FreeBSD to kill PostgreSQL, Customizing Emacs for Git Commit Messages, Deleting old FreeBSD boot environments, Always be quitting, and more</itunes:subtitle>
  <itunes:duration>57:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>NetBSD 9.2 released, DragonFly 6.0 is out, Home Network Monitoring using Prometheus, Preventing FreeBSD to kill PostgreSQL, Customizing Emacs for Git Commit Messages, Deleting old FreeBSD boot environments, Always be quitting, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
NetBSD 9.2 Released (http://blog.netbsd.org/tnf/entry/netbsd_9_2_released)
DragonFly 6.0 is out! (https://www.dragonflydigest.com/2021/05/10/25731.html)
Release Notes (https://www.dragonflybsd.org/release60/)
***
### EuroBSDCon 2021 will be online (https://2021.eurobsdcon.org/)
***
## News Roundup
### Home Network Monitoring using Prometheus (https://linux-bsd.github.io/post/monitoring/)
&amp;gt; This blog post describes my setup for monitoring various devices on my home network suh as servers, laptops/desktops, networking gear etc. The setup and configuration is squarely geared towards small/medium sized network monitoring. A similar setup might work for large networks, but you will need to plan your compute/storage/bandwidth capacities accordingly. I’m running all the monitoring software on FreeBSD, but you can run it on your choice of OS. Just make sure to install the packages using your OS’s package manager.
***
### Preventing FreeBSD to kill PostgreSQL (aka OOM Killer prevention) (https://fluca1978.github.io/2021/04/02/OOMKillerFreeBSD.html)
&amp;gt; There are a lot of interesting articles on how to prevent the Out of Memory Killer (OOM killer in short) on Linux to ruin your day, or better your night. One particularly well done explanation about how the OOM Killer works, and how to help PostgreSQL to survive, is, in my humble opinion, the one from Percona Blog.
***
### Customizing Emacs for Git Commit Messages (http://bsdimp.blogspot.com/2021/04/customizing-emacs-for-git-commit.html)
&amp;gt;I do a lot of commits to the FreeBSD project and elsewhere. It would be nice if I could setup emacs in a custom way for each commit message that I'm editing.
&amp;gt; Fortunately, GNU Emacs provides a nice way to do just that. While I likely could do some of these things with git commit hooks, I find this to be a little nicer.
***
### Deleting old FreeBSD boot environments (https://dan.langille.org/2021/04/15/deleting-old-freebsd-boot-environments/)
&amp;gt; I like boot environments (BE) on FreeBSD. They were especially handy when building the AWS host for FreshPorts, since I had no serial console. I would create a BE saving the current status, then make some changes. I’d mark the current BE as boot once, so I could boot back in the known good BE. Worst case, I could mount the storage onto a rescue EC2 instance and adjust the bootfs value of the zpool.
***
Always be quitting (https://jmmv.dev/2021/04/always-be-quitting.html)
A good philosophy to live by at work is to “always be quitting”. No, don’t be constantly thinking of leaving your job.  But act as if you might leave on short notice. Counterintuitively, this will make you a better engineer and open up growth opportunities.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Christopher - zfs question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Christopher%20-%20zfs%20question)
Chris - two questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Chris%20-%20two%20questions)
Vas - zpools and moving to FreeBSD 13 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Vas%20-%20zpools%20and%20moving%20to%20FreeBSD%2013)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, home network, automation, network automation, prometheus, oom, out of memory, postgresql, postgres, customizing, emacs, git, commit message, boot environment, quit, quitting </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>NetBSD 9.2 released, DragonFly 6.0 is out, Home Network Monitoring using Prometheus, Preventing FreeBSD to kill PostgreSQL, Customizing Emacs for Git Commit Messages, Deleting old FreeBSD boot environments, Always be quitting, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/netbsd_9_2_released" rel="nofollow">NetBSD 9.2 Released</a></h3>

<hr>

<h3><a href="https://www.dragonflydigest.com/2021/05/10/25731.html" rel="nofollow">DragonFly 6.0 is out!</a></h3>

<ul>
<li><a href="https://www.dragonflybsd.org/release60/" rel="nofollow">Release Notes</a>
***
### <a href="https://2021.eurobsdcon.org/" rel="nofollow">EuroBSDCon 2021 will be online</a>
***
## News Roundup
### <a href="https://linux-bsd.github.io/post/monitoring/" rel="nofollow">Home Network Monitoring using Prometheus</a>
&gt; This blog post describes my setup for monitoring various devices on my home network suh as servers, laptops/desktops, networking gear etc. The setup and configuration is squarely geared towards small/medium sized network monitoring. A similar setup might work for large networks, but you will need to plan your compute/storage/bandwidth capacities accordingly. I’m running all the monitoring software on FreeBSD, but you can run it on your choice of OS. Just make sure to install the packages using your OS’s package manager.
***
### <a href="https://fluca1978.github.io/2021/04/02/OOMKillerFreeBSD.html" rel="nofollow">Preventing FreeBSD to kill PostgreSQL (aka OOM Killer prevention)</a>
&gt; There are a lot of interesting articles on how to prevent the Out of Memory Killer (OOM killer in short) on Linux to ruin your day, or better your night. One particularly well done explanation about how the OOM Killer works, and how to help PostgreSQL to survive, is, in my humble opinion, the one from Percona Blog.
***
### <a href="http://bsdimp.blogspot.com/2021/04/customizing-emacs-for-git-commit.html" rel="nofollow">Customizing Emacs for Git Commit Messages</a>
&gt;I do a lot of commits to the FreeBSD project and elsewhere. It would be nice if I could setup emacs in a custom way for each commit message that I&#39;m editing.
&gt; Fortunately, GNU Emacs provides a nice way to do just that. While I likely could do some of these things with git commit hooks, I find this to be a little nicer.
***
### <a href="https://dan.langille.org/2021/04/15/deleting-old-freebsd-boot-environments/" rel="nofollow">Deleting old FreeBSD boot environments</a>
&gt; I like boot environments (BE) on FreeBSD. They were especially handy when building the AWS host for FreshPorts, since I had no serial console. I would create a BE saving the current status, then make some changes. I’d mark the current BE as boot once, so I could boot back in the known good BE. Worst case, I could mount the storage onto a rescue EC2 instance and adjust the bootfs value of the zpool.
***</li>
</ul>

<h3><a href="https://jmmv.dev/2021/04/always-be-quitting.html" rel="nofollow">Always be quitting</a></h3>

<blockquote>
<p>A good philosophy to live by at work is to “always be quitting”. No, don’t be constantly thinking of leaving your job.  But act as if you might leave on short notice. Counterintuitively, this will make you a better engineer and open up growth opportunities.</p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Christopher%20-%20zfs%20question" rel="nofollow">Christopher - zfs question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Chris%20-%20two%20questions" rel="nofollow">Chris - two questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Vas%20-%20zpools%20and%20moving%20to%20FreeBSD%2013" rel="nofollow">Vas - zpools and moving to FreeBSD 13</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>NetBSD 9.2 released, DragonFly 6.0 is out, Home Network Monitoring using Prometheus, Preventing FreeBSD to kill PostgreSQL, Customizing Emacs for Git Commit Messages, Deleting old FreeBSD boot environments, Always be quitting, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/netbsd_9_2_released" rel="nofollow">NetBSD 9.2 Released</a></h3>

<hr>

<h3><a href="https://www.dragonflydigest.com/2021/05/10/25731.html" rel="nofollow">DragonFly 6.0 is out!</a></h3>

<ul>
<li><a href="https://www.dragonflybsd.org/release60/" rel="nofollow">Release Notes</a>
***
### <a href="https://2021.eurobsdcon.org/" rel="nofollow">EuroBSDCon 2021 will be online</a>
***
## News Roundup
### <a href="https://linux-bsd.github.io/post/monitoring/" rel="nofollow">Home Network Monitoring using Prometheus</a>
&gt; This blog post describes my setup for monitoring various devices on my home network suh as servers, laptops/desktops, networking gear etc. The setup and configuration is squarely geared towards small/medium sized network monitoring. A similar setup might work for large networks, but you will need to plan your compute/storage/bandwidth capacities accordingly. I’m running all the monitoring software on FreeBSD, but you can run it on your choice of OS. Just make sure to install the packages using your OS’s package manager.
***
### <a href="https://fluca1978.github.io/2021/04/02/OOMKillerFreeBSD.html" rel="nofollow">Preventing FreeBSD to kill PostgreSQL (aka OOM Killer prevention)</a>
&gt; There are a lot of interesting articles on how to prevent the Out of Memory Killer (OOM killer in short) on Linux to ruin your day, or better your night. One particularly well done explanation about how the OOM Killer works, and how to help PostgreSQL to survive, is, in my humble opinion, the one from Percona Blog.
***
### <a href="http://bsdimp.blogspot.com/2021/04/customizing-emacs-for-git-commit.html" rel="nofollow">Customizing Emacs for Git Commit Messages</a>
&gt;I do a lot of commits to the FreeBSD project and elsewhere. It would be nice if I could setup emacs in a custom way for each commit message that I&#39;m editing.
&gt; Fortunately, GNU Emacs provides a nice way to do just that. While I likely could do some of these things with git commit hooks, I find this to be a little nicer.
***
### <a href="https://dan.langille.org/2021/04/15/deleting-old-freebsd-boot-environments/" rel="nofollow">Deleting old FreeBSD boot environments</a>
&gt; I like boot environments (BE) on FreeBSD. They were especially handy when building the AWS host for FreshPorts, since I had no serial console. I would create a BE saving the current status, then make some changes. I’d mark the current BE as boot once, so I could boot back in the known good BE. Worst case, I could mount the storage onto a rescue EC2 instance and adjust the bootfs value of the zpool.
***</li>
</ul>

<h3><a href="https://jmmv.dev/2021/04/always-be-quitting.html" rel="nofollow">Always be quitting</a></h3>

<blockquote>
<p>A good philosophy to live by at work is to “always be quitting”. No, don’t be constantly thinking of leaving your job.  But act as if you might leave on short notice. Counterintuitively, this will make you a better engineer and open up growth opportunities.</p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Christopher%20-%20zfs%20question" rel="nofollow">Christopher - zfs question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Chris%20-%20two%20questions" rel="nofollow">Chris - two questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Vas%20-%20zpools%20and%20moving%20to%20FreeBSD%2013" rel="nofollow">Vas - zpools and moving to FreeBSD 13</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>404: 404 BSD Now Hosts Not Found</title>
  <link>https://www.bsdnow.tv/404</link>
  <guid isPermaLink="false">b6436b27-8f23-473c-bd4d-6cbac1cc9eef</guid>
  <pubDate>Thu, 27 May 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b6436b27-8f23-473c-bd4d-6cbac1cc9eef.mp3" length="29400792" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Allan, Benedict and Tom are MIA, so JT fills in with two friends.</itunes:subtitle>
  <itunes:duration>49:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Allan, Benedict and Tom are MIA, so JT fills in with two friends.
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
CoHosts this week:
    • Ash Gokhale: https://twitter.com/xpi
    • Jeff Propes : CoHost of The Opinion Dominion (https://www.theopiniondominion.org)
This weeks format follows the format of one of JT's other shows: The Opinion Dominion (https://www.theopiniondominion.org).
Centralized vs Decentralized Management
Ash’s draid article at Klara (https://klarasystems.com/articles/openzfs-draid-finally/)
openbsd’s 50th release (https://twitter.com/openbsd/status/1388289402934333444) + Release Notes (https://www.openbsd.org/69.html)
Beastie Bits
•  Interesting dtrace papers I found this week.  The first is unfortunately paywalled by an industry journal but hopefully it’ll be publicly available soon.    
    ◦ [Using Dtrace for Machine Learning Solutions in Malware Detection](https://ieeexplore.ieee.org/document/9225633)
    ◦ [Process Monitoring on Sequences of System Call Count Vectors](https://arxiv.org/pdf/1707.03821.pdf)
    ◦ Sounds Similar to:
Optimyze Cloud](https://twitter.com/OptimyzeCloud/status/1386424419418099712)
CADETS that GNN is working on (https://apps.dtic.mil/sti/citations/AD1080643)]
•  Practical IOT Hacking book out by no starch press (https://nostarch.com/practical-iot-hacking)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Open Source Voices episode with Colin Percival (https://www.opensourcevoices.org/12)
RIP Dan kaminski
• https://www.nytimes.com/2021/04/27/technology/daniel-kaminsky-dead.html
• https://www.darkreading.com/vulnerabilities---threats/in-appreciation-dan-kaminsky/d/d-id/1340830
• https://www.securityweek.com/security-researcher-dan-kaminsky-passes-away
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Allan, Benedict and Tom are MIA, so JT fills in with two friends.</p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a><br>
CoHosts this week:<br>
    • Ash Gokhale: <a href="https://twitter.com/xpi" rel="nofollow">https://twitter.com/xpi</a><br>
    • Jeff Propes : CoHost of <a href="https://www.theopiniondominion.org" rel="nofollow">The Opinion Dominion</a></p>

<h2>This weeks format follows the format of one of JT&#39;s other shows: <a href="https://www.theopiniondominion.org" rel="nofollow">The Opinion Dominion</a>.</h2>

<h3>Centralized vs Decentralized Management</h3>

<h3><a href="https://klarasystems.com/articles/openzfs-draid-finally/" rel="nofollow">Ash’s draid article at Klara</a></h3>

<h3><a href="https://twitter.com/openbsd/status/1388289402934333444" rel="nofollow">openbsd’s 50th release</a> + <a href="https://www.openbsd.org/69.html" rel="nofollow">Release Notes</a></h3>

<h3>Beastie Bits</h3>

<pre><code>•  Interesting dtrace papers I found this week.  The first is unfortunately paywalled by an industry journal but hopefully it’ll be publicly available soon.    
    ◦ [Using Dtrace for Machine Learning Solutions in Malware Detection](https://ieeexplore.ieee.org/document/9225633)
    ◦ [Process Monitoring on Sequences of System Call Count Vectors](https://arxiv.org/pdf/1707.03821.pdf)
    ◦ Sounds Similar to:
</code></pre>

<ul>
<li>Optimyze Cloud](<a href="https://twitter.com/OptimyzeCloud/status/1386424419418099712" rel="nofollow">https://twitter.com/OptimyzeCloud/status/1386424419418099712</a>)</li>
<li><p><a href="https://apps.dtic.mil/sti/citations/AD1080643" rel="nofollow">CADETS that GNN is working on</a>]</p>

<p>•  <a href="https://nostarch.com/practical-iot-hacking" rel="nofollow">Practical IOT Hacking book out by no starch press</a></p></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
<a href="https://www.opensourcevoices.org/12" rel="nofollow">Open Source Voices episode with Colin Percival</a></li>
</ul>

<h3>RIP Dan kaminski</h3>

<pre><code>• https://www.nytimes.com/2021/04/27/technology/daniel-kaminsky-dead.html
• https://www.darkreading.com/vulnerabilities---threats/in-appreciation-dan-kaminsky/d/d-id/1340830
• https://www.securityweek.com/security-researcher-dan-kaminsky-passes-away
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Allan, Benedict and Tom are MIA, so JT fills in with two friends.</p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a><br>
CoHosts this week:<br>
    • Ash Gokhale: <a href="https://twitter.com/xpi" rel="nofollow">https://twitter.com/xpi</a><br>
    • Jeff Propes : CoHost of <a href="https://www.theopiniondominion.org" rel="nofollow">The Opinion Dominion</a></p>

<h2>This weeks format follows the format of one of JT&#39;s other shows: <a href="https://www.theopiniondominion.org" rel="nofollow">The Opinion Dominion</a>.</h2>

<h3>Centralized vs Decentralized Management</h3>

<h3><a href="https://klarasystems.com/articles/openzfs-draid-finally/" rel="nofollow">Ash’s draid article at Klara</a></h3>

<h3><a href="https://twitter.com/openbsd/status/1388289402934333444" rel="nofollow">openbsd’s 50th release</a> + <a href="https://www.openbsd.org/69.html" rel="nofollow">Release Notes</a></h3>

<h3>Beastie Bits</h3>

<pre><code>•  Interesting dtrace papers I found this week.  The first is unfortunately paywalled by an industry journal but hopefully it’ll be publicly available soon.    
    ◦ [Using Dtrace for Machine Learning Solutions in Malware Detection](https://ieeexplore.ieee.org/document/9225633)
    ◦ [Process Monitoring on Sequences of System Call Count Vectors](https://arxiv.org/pdf/1707.03821.pdf)
    ◦ Sounds Similar to:
</code></pre>

<ul>
<li>Optimyze Cloud](<a href="https://twitter.com/OptimyzeCloud/status/1386424419418099712" rel="nofollow">https://twitter.com/OptimyzeCloud/status/1386424419418099712</a>)</li>
<li><p><a href="https://apps.dtic.mil/sti/citations/AD1080643" rel="nofollow">CADETS that GNN is working on</a>]</p>

<p>•  <a href="https://nostarch.com/practical-iot-hacking" rel="nofollow">Practical IOT Hacking book out by no starch press</a></p></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
<a href="https://www.opensourcevoices.org/12" rel="nofollow">Open Source Voices episode with Colin Percival</a></li>
</ul>

<h3>RIP Dan kaminski</h3>

<pre><code>• https://www.nytimes.com/2021/04/27/technology/daniel-kaminsky-dead.html
• https://www.darkreading.com/vulnerabilities---threats/in-appreciation-dan-kaminsky/d/d-id/1340830
• https://www.securityweek.com/security-researcher-dan-kaminsky-passes-away
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>403: The Linuxulator Investment</title>
  <link>https://www.bsdnow.tv/403</link>
  <guid isPermaLink="false">7f8330e4-2752-4d4c-b7c6-ca165e78cf57</guid>
  <pubDate>Thu, 20 May 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7f8330e4-2752-4d4c-b7c6-ca165e78cf57.mp3" length="31084416" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Why You Should Use BSD Licensing for Your Next Open Source Project or Product, Update on FreeBSD Foundation Investment in Linuxulator, OPNsense 21.1.5 released, FreeBSD meetings on the Desktop, Running FreeBSD jails with containerd 1.5, Markdown, DocBook, and the quest for semantic documentation on NetBSD.org, and more.</itunes:subtitle>
  <itunes:duration>50:52</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Why You Should Use BSD Licensing for Your Next Open Source Project or Product, Update on FreeBSD Foundation Investment in Linuxulator, OPNsense 21.1.5 released, FreeBSD meetings on the Desktop, Running FreeBSD jails with containerd 1.5, Markdown, DocBook, and the quest for semantic documentation on NetBSD.org, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Why You Should Use BSD Licensing for Your Next Open Source Project or Product (https://klarasystems.com/articles/why-you-should-use-bsd-licensing-for-your-next-open-source-project-or-product/)
The term “open source” has its origins in the context of software development, designating a specific approach to developing computer programs. Nowadays, however, it stands for a broad set of values – open source means open exchange, transparency, collaborative participation and development for the benefit of the entire community.
Update on FreeBSD Foundation Investment in Linuxulator (https://freebsdfoundation.org/blog/update-on-freebsd-foundation-investment-in-linuxulator/)
Dr. Emmett Brown’s similar-sounding Flux Capacitor from the movie Back to the Future bridged the dimension of time, uniting past, present, and future for the McFlys. Similarly, the FreeBSDⓇ Linuxulator project also bridges dimensions – in our case, these are LinuxⓇ and FreeBSD. 
News Roundup
OPNsense 21.1.5 released (https://opnsense.org/opnsense-21-1-5-released/)
This is mainly a security and reliablility update.  There are several FreeBSD
security advisories and updates for third party tools such as curl.
+ OPNsense to rebase on FreeBSD 13 (https://forum.opnsense.org/index.php?topic=22761.msg108313#msg108313)
FreeBSD meetings on the Desktop (https://euroquis.nl//freebsd/2021/04/20/fbsd-bbb.html)
FreeBSD on the desktop is a whole stack - X11, Qt, KDE Frameworks, KDE Plasma and KDE Gear, and Wayland, and Poppler and GTK - o my!
Running FreeBSD jails with containerd 1.5 (https://samuel.karp.dev/blog/2021/05/running-freebsd-jails-with-containerd-1-5/)
containerd 1.5.0 was released today and now works on a new operating system: FreeBSD! This new release includes a series of patches (1, 2, 3, 4, 5, 6, 7, 8, 9, 10) which allow containerd to build, enable the native and zfs snapshotters, and use a compatible runtime like runj.
Markdown, DocBook, and the quest for semantic documentation on NetBSD.org (https://washbear.neocities.org/markdown.html)
Recently, I’ve been doing a lot of maintenance of the NetBSD website. It contains a boatload of documentation, much of which was originally written in the 2000s. It has some special requirements: it has to work in text-based web browsers like lynx, or maybe even without any working browser installed at all, or just ftp(1) for downloading plain text over HTTP. Naturally, the most important parts are static, suitable for serving from the standard NetBSD http server, which runs from inetd by default.
Beastie Bits
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Alrekur - An Interesting FreeBSD Find (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Alrekur%20-%20An%20Interesting%20FreeBSD%20Find)
They presented at the FreeBSD Vendor summit last year too: https://www.youtube.com/watch?v=8LUdZseNrpE
Sven - feedback (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Sven%20-%20feedback)
Robert - firewalling (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Robert%20-%20firewalling)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, license, licensing, product, project, linuxulator, freebsd foundation, investment, desktop, meetings, containerd, markdown, docbook, semantic documentation</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Why You Should Use BSD Licensing for Your Next Open Source Project or Product, Update on FreeBSD Foundation Investment in Linuxulator, OPNsense 21.1.5 released, FreeBSD meetings on the Desktop, Running FreeBSD jails with containerd 1.5, Markdown, DocBook, and the quest for semantic documentation on NetBSD.org, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/why-you-should-use-bsd-licensing-for-your-next-open-source-project-or-product/" rel="nofollow">Why You Should Use BSD Licensing for Your Next Open Source Project or Product</a></h3>

<blockquote>
<p>The term “open source” has its origins in the context of software development, designating a specific approach to developing computer programs. Nowadays, however, it stands for a broad set of values – open source means open exchange, transparency, collaborative participation and development for the benefit of the entire community.</p>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/update-on-freebsd-foundation-investment-in-linuxulator/" rel="nofollow">Update on FreeBSD Foundation Investment in Linuxulator</a></h3>

<p>Dr. Emmett Brown’s similar-sounding Flux Capacitor from the movie Back to the Future bridged the dimension of time, uniting past, present, and future for the McFlys. Similarly, the FreeBSDⓇ Linuxulator project also bridges dimensions – in our case, these are LinuxⓇ and FreeBSD. </p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://opnsense.org/opnsense-21-1-5-released/" rel="nofollow">OPNsense 21.1.5 released</a></h3>

<p>This is mainly a security and reliablility update.  There are several FreeBSD<br>
security advisories and updates for third party tools such as curl.</p>

<ul>
<li><a href="https://forum.opnsense.org/index.php?topic=22761.msg108313#msg108313" rel="nofollow">OPNsense to rebase on FreeBSD 13</a>
***
### <a href="https://euroquis.nl//freebsd/2021/04/20/fbsd-bbb.html" rel="nofollow">FreeBSD meetings on the Desktop</a>
FreeBSD on the desktop is a whole stack - X11, Qt, KDE Frameworks, KDE Plasma and KDE Gear, and Wayland, and Poppler and GTK - o my!
***
### <a href="https://samuel.karp.dev/blog/2021/05/running-freebsd-jails-with-containerd-1-5/" rel="nofollow">Running FreeBSD jails with containerd 1.5</a>
containerd 1.5.0 was released today and now works on a new operating system: FreeBSD! This new release includes a series of patches (1, 2, 3, 4, 5, 6, 7, 8, 9, 10) which allow containerd to build, enable the native and zfs snapshotters, and use a compatible runtime like runj.
***
### <a href="https://washbear.neocities.org/markdown.html" rel="nofollow">Markdown, DocBook, and the quest for semantic documentation on NetBSD.org</a>
Recently, I’ve been doing a lot of maintenance of the NetBSD website. It contains a boatload of documentation, much of which was originally written in the 2000s. It has some special requirements: it has to work in text-based web browsers like lynx, or maybe even without any working browser installed at all, or just ftp(1) for downloading plain text over HTTP. Naturally, the most important parts are static, suitable for serving from the standard NetBSD http server, which runs from inetd by default.
***</li>
</ul>
</blockquote>

<h2>Beastie Bits</h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Alrekur%20-%20An%20Interesting%20FreeBSD%20Find" rel="nofollow">Alrekur - An Interesting FreeBSD Find</a>
They presented at the FreeBSD Vendor summit last year too: <a href="https://www.youtube.com/watch?v=8LUdZseNrpE" rel="nofollow">https://www.youtube.com/watch?v=8LUdZseNrpE</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Sven%20-%20feedback" rel="nofollow">Sven - feedback</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Robert%20-%20firewalling" rel="nofollow">Robert - firewalling</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Why You Should Use BSD Licensing for Your Next Open Source Project or Product, Update on FreeBSD Foundation Investment in Linuxulator, OPNsense 21.1.5 released, FreeBSD meetings on the Desktop, Running FreeBSD jails with containerd 1.5, Markdown, DocBook, and the quest for semantic documentation on NetBSD.org, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/why-you-should-use-bsd-licensing-for-your-next-open-source-project-or-product/" rel="nofollow">Why You Should Use BSD Licensing for Your Next Open Source Project or Product</a></h3>

<blockquote>
<p>The term “open source” has its origins in the context of software development, designating a specific approach to developing computer programs. Nowadays, however, it stands for a broad set of values – open source means open exchange, transparency, collaborative participation and development for the benefit of the entire community.</p>

<hr>

<h3><a href="https://freebsdfoundation.org/blog/update-on-freebsd-foundation-investment-in-linuxulator/" rel="nofollow">Update on FreeBSD Foundation Investment in Linuxulator</a></h3>

<p>Dr. Emmett Brown’s similar-sounding Flux Capacitor from the movie Back to the Future bridged the dimension of time, uniting past, present, and future for the McFlys. Similarly, the FreeBSDⓇ Linuxulator project also bridges dimensions – in our case, these are LinuxⓇ and FreeBSD. </p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://opnsense.org/opnsense-21-1-5-released/" rel="nofollow">OPNsense 21.1.5 released</a></h3>

<p>This is mainly a security and reliablility update.  There are several FreeBSD<br>
security advisories and updates for third party tools such as curl.</p>

<ul>
<li><a href="https://forum.opnsense.org/index.php?topic=22761.msg108313#msg108313" rel="nofollow">OPNsense to rebase on FreeBSD 13</a>
***
### <a href="https://euroquis.nl//freebsd/2021/04/20/fbsd-bbb.html" rel="nofollow">FreeBSD meetings on the Desktop</a>
FreeBSD on the desktop is a whole stack - X11, Qt, KDE Frameworks, KDE Plasma and KDE Gear, and Wayland, and Poppler and GTK - o my!
***
### <a href="https://samuel.karp.dev/blog/2021/05/running-freebsd-jails-with-containerd-1-5/" rel="nofollow">Running FreeBSD jails with containerd 1.5</a>
containerd 1.5.0 was released today and now works on a new operating system: FreeBSD! This new release includes a series of patches (1, 2, 3, 4, 5, 6, 7, 8, 9, 10) which allow containerd to build, enable the native and zfs snapshotters, and use a compatible runtime like runj.
***
### <a href="https://washbear.neocities.org/markdown.html" rel="nofollow">Markdown, DocBook, and the quest for semantic documentation on NetBSD.org</a>
Recently, I’ve been doing a lot of maintenance of the NetBSD website. It contains a boatload of documentation, much of which was originally written in the 2000s. It has some special requirements: it has to work in text-based web browsers like lynx, or maybe even without any working browser installed at all, or just ftp(1) for downloading plain text over HTTP. Naturally, the most important parts are static, suitable for serving from the standard NetBSD http server, which runs from inetd by default.
***</li>
</ul>
</blockquote>

<h2>Beastie Bits</h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Alrekur%20-%20An%20Interesting%20FreeBSD%20Find" rel="nofollow">Alrekur - An Interesting FreeBSD Find</a>
They presented at the FreeBSD Vendor summit last year too: <a href="https://www.youtube.com/watch?v=8LUdZseNrpE" rel="nofollow">https://www.youtube.com/watch?v=8LUdZseNrpE</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Sven%20-%20feedback" rel="nofollow">Sven - feedback</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Robert%20-%20firewalling" rel="nofollow">Robert - firewalling</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>402: Goodbye GPL</title>
  <link>https://www.bsdnow.tv/402</link>
  <guid isPermaLink="false">8fa4abac-1e15-4f91-8893-ca72a65c95c1</guid>
  <pubDate>Thu, 13 May 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8fa4abac-1e15-4f91-8893-ca72a65c95c1.mp3" length="30499968" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>It's time to say goodbye to the GPL, a new OCI Runtime for FreeBSD Jails, A bit of Xenix history, On Updating QEMU's bsd-user fork, FreeBSD 13 on a 12 year old laptop, and more </itunes:subtitle>
  <itunes:duration>49:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>It's time to say goodbye to the GPL, a new OCI Runtime for FreeBSD Jails, A bit of Xenix history, On Updating QEMU's bsd-user fork, FreeBSD 13 on a 12 year old laptop, and more. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
It's time to say goodbye to the GPL (https://martin.kleppmann.com/2021/04/14/goodbye-gpl.html)
The trigger for this post is the reinstating of Richard Stallman, a very problematic character, to the board of the Free Software Foundation (FSF). I am appalled by this move, and join others in the call for his removal.
This occasion has caused me to reevaluate the position of the FSF in computing. It is the steward of the GNU project (a part of Linux distributions, loosely speaking), and of a family of software licenses centred around the GNU General Public License (GPL). These efforts are unfortunately tainted by Stallman’s behaviour. However, this is not what I actually want to talk about today.
runj: a new OCI Runtime for FreeBSD Jails (https://samuel.karp.dev/blog/2021/03/runj-a-new-oci-runtime-for-freebsd-jails/)
Today, I open-sourced runj, a new experimental, proof-of-concept OCI-compatible runtime for FreeBSD jails. For the past 6.5 years I’ve been working on Linux containers, but never really had much experience with FreeBSD jails. runj (pronounced “run jay”) is a vehicle for me to learn more about FreeBSD in general and jails in particular. With my position on the Technical Oversight Board of the Open Containers Initiative, I’m also interested in understanding how the OCI runtime specification can be adapted to other operating systems like FreeBSD.
News Roundup
A Bit of Xenix History (http://seefigure1.com/2014/04/15/xenixtime.html)
From 1986 to 1989, I worked in the Xenix1 group at Microsoft. It was my first job out of school, and I was the most junior person on the team. I was hopelessly naive, inexperienced, generally clueless, and borderline incompetent, but my coworkers were kind, supportive and enormously forgiving – just a lovely bunch of folks.
On Updating QEMU's bsd-user fork (https://bsdimp.blogspot.com/2021/05/on-updating-qemus-bsd-user-fork.html)
FreeBSD 13 on a 12 year old laptop (http://box.matto.nl/freebsd-13-on-a-12-year-old-laptop.html)
My old (2009) HP laptop now runs FreeBSD 13.0-RELEASE.
Beastie Bits
Registration is now open for the June 2021 #FreeBSD Developers Summit (https://twitter.com/i/web/status/1387797859479732227)
6.0RC1 images available (https://www.dragonflydigest.com/2021/04/22/25663.html)
Lexical File Names in Plan 9 or Getting Dot-Dot Right (https://plan9.io/sys/doc/lexnames.pdf)
The history of UTF-8 as told by Rob Pike (http://doc.cat-v.org/bell_labs/utf-8_history)
Initial Support for the riscv64 Architecture (http://undeadly.org/cgi?action=article;sid=20210423090342)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Hamza - Congrats on 400 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Hamza%20-%20Congrats%20on%20400)
Renato - DTS and ContainerD (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Renato%20-%20DTS%20and%20ContainerD)
Rob - Music (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Rob%20-%20Music)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, gpl, goodbye, oci, runtime, jails, xenix, qemu, bsd-user, fork, laptop</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>It&#39;s time to say goodbye to the GPL, a new OCI Runtime for FreeBSD Jails, A bit of Xenix history, On Updating QEMU&#39;s bsd-user fork, FreeBSD 13 on a 12 year old laptop, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://martin.kleppmann.com/2021/04/14/goodbye-gpl.html" rel="nofollow">It&#39;s time to say goodbye to the GPL</a></h3>

<blockquote>
<p>The trigger for this post is the reinstating of Richard Stallman, a very problematic character, to the board of the Free Software Foundation (FSF). I am appalled by this move, and join others in the call for his removal.<br>
This occasion has caused me to reevaluate the position of the FSF in computing. It is the steward of the GNU project (a part of Linux distributions, loosely speaking), and of a family of software licenses centred around the GNU General Public License (GPL). These efforts are unfortunately tainted by Stallman’s behaviour. However, this is not what I actually want to talk about today.</p>

<hr>

<h3><a href="https://samuel.karp.dev/blog/2021/03/runj-a-new-oci-runtime-for-freebsd-jails/" rel="nofollow">runj: a new OCI Runtime for FreeBSD Jails</a></h3>

<p>Today, I open-sourced runj, a new experimental, proof-of-concept OCI-compatible runtime for FreeBSD jails. For the past 6.5 years I’ve been working on Linux containers, but never really had much experience with FreeBSD jails. runj (pronounced “run jay”) is a vehicle for me to learn more about FreeBSD in general and jails in particular. With my position on the Technical Oversight Board of the Open Containers Initiative, I’m also interested in understanding how the OCI runtime specification can be adapted to other operating systems like FreeBSD.</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://seefigure1.com/2014/04/15/xenixtime.html" rel="nofollow">A Bit of Xenix History</a></h3>

<p>From 1986 to 1989, I worked in the Xenix1 group at Microsoft. It was my first job out of school, and I was the most junior person on the team. I was hopelessly naive, inexperienced, generally clueless, and borderline incompetent, but my coworkers were kind, supportive and enormously forgiving – just a lovely bunch of folks.</p>

<hr>

<h3><a href="https://bsdimp.blogspot.com/2021/05/on-updating-qemus-bsd-user-fork.html" rel="nofollow">On Updating QEMU&#39;s bsd-user fork</a></h3>

<hr>
</blockquote>

<h3><a href="http://box.matto.nl/freebsd-13-on-a-12-year-old-laptop.html" rel="nofollow">FreeBSD 13 on a 12 year old laptop</a></h3>

<blockquote>
<p>My old (2009) HP laptop now runs FreeBSD 13.0-RELEASE.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/i/web/status/1387797859479732227" rel="nofollow">Registration is now open for the June 2021 #FreeBSD Developers Summit</a></li>
<li><a href="https://www.dragonflydigest.com/2021/04/22/25663.html" rel="nofollow">6.0RC1 images available</a></li>
<li><a href="https://plan9.io/sys/doc/lexnames.pdf" rel="nofollow">Lexical File Names in Plan 9 or Getting Dot-Dot Right</a></li>
<li><a href="http://doc.cat-v.org/bell_labs/utf-8_history" rel="nofollow">The history of UTF-8 as told by Rob Pike</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20210423090342" rel="nofollow">Initial Support for the riscv64 Architecture</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Hamza%20-%20Congrats%20on%20400" rel="nofollow">Hamza - Congrats on 400</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Renato%20-%20DTS%20and%20ContainerD" rel="nofollow">Renato - DTS and ContainerD</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Rob%20-%20Music" rel="nofollow">Rob - Music</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>It&#39;s time to say goodbye to the GPL, a new OCI Runtime for FreeBSD Jails, A bit of Xenix history, On Updating QEMU&#39;s bsd-user fork, FreeBSD 13 on a 12 year old laptop, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://martin.kleppmann.com/2021/04/14/goodbye-gpl.html" rel="nofollow">It&#39;s time to say goodbye to the GPL</a></h3>

<blockquote>
<p>The trigger for this post is the reinstating of Richard Stallman, a very problematic character, to the board of the Free Software Foundation (FSF). I am appalled by this move, and join others in the call for his removal.<br>
This occasion has caused me to reevaluate the position of the FSF in computing. It is the steward of the GNU project (a part of Linux distributions, loosely speaking), and of a family of software licenses centred around the GNU General Public License (GPL). These efforts are unfortunately tainted by Stallman’s behaviour. However, this is not what I actually want to talk about today.</p>

<hr>

<h3><a href="https://samuel.karp.dev/blog/2021/03/runj-a-new-oci-runtime-for-freebsd-jails/" rel="nofollow">runj: a new OCI Runtime for FreeBSD Jails</a></h3>

<p>Today, I open-sourced runj, a new experimental, proof-of-concept OCI-compatible runtime for FreeBSD jails. For the past 6.5 years I’ve been working on Linux containers, but never really had much experience with FreeBSD jails. runj (pronounced “run jay”) is a vehicle for me to learn more about FreeBSD in general and jails in particular. With my position on the Technical Oversight Board of the Open Containers Initiative, I’m also interested in understanding how the OCI runtime specification can be adapted to other operating systems like FreeBSD.</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://seefigure1.com/2014/04/15/xenixtime.html" rel="nofollow">A Bit of Xenix History</a></h3>

<p>From 1986 to 1989, I worked in the Xenix1 group at Microsoft. It was my first job out of school, and I was the most junior person on the team. I was hopelessly naive, inexperienced, generally clueless, and borderline incompetent, but my coworkers were kind, supportive and enormously forgiving – just a lovely bunch of folks.</p>

<hr>

<h3><a href="https://bsdimp.blogspot.com/2021/05/on-updating-qemus-bsd-user-fork.html" rel="nofollow">On Updating QEMU&#39;s bsd-user fork</a></h3>

<hr>
</blockquote>

<h3><a href="http://box.matto.nl/freebsd-13-on-a-12-year-old-laptop.html" rel="nofollow">FreeBSD 13 on a 12 year old laptop</a></h3>

<blockquote>
<p>My old (2009) HP laptop now runs FreeBSD 13.0-RELEASE.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/i/web/status/1387797859479732227" rel="nofollow">Registration is now open for the June 2021 #FreeBSD Developers Summit</a></li>
<li><a href="https://www.dragonflydigest.com/2021/04/22/25663.html" rel="nofollow">6.0RC1 images available</a></li>
<li><a href="https://plan9.io/sys/doc/lexnames.pdf" rel="nofollow">Lexical File Names in Plan 9 or Getting Dot-Dot Right</a></li>
<li><a href="http://doc.cat-v.org/bell_labs/utf-8_history" rel="nofollow">The history of UTF-8 as told by Rob Pike</a></li>
<li><a href="http://undeadly.org/cgi?action=article;sid=20210423090342" rel="nofollow">Initial Support for the riscv64 Architecture</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Hamza%20-%20Congrats%20on%20400" rel="nofollow">Hamza - Congrats on 400</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Renato%20-%20DTS%20and%20ContainerD" rel="nofollow">Renato - DTS and ContainerD</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Rob%20-%20Music" rel="nofollow">Rob - Music</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>401: OpenBSD Dog Garage</title>
  <link>https://www.bsdnow.tv/401</link>
  <guid isPermaLink="false">65fbc474-0108-451b-a15c-d5d9bd7ca153</guid>
  <pubDate>Thu, 06 May 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/65fbc474-0108-451b-a15c-d5d9bd7ca153.mp3" length="35418744" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Dog's Garage Runs OpenBSD, EuroBSDcon 2021 Call for Papers, FreeBSD’s iostat, The state of toolchains in NetBSD, Bandwidth limiting on OpenBSD 6.8, FreeBSD's ports migration to git and its impact on HardenedBSD, TrueNAS 12.0-U3 has been released, and more.</itunes:subtitle>
  <itunes:duration>58:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Dog's Garage Runs OpenBSD, EuroBSDcon 2021 Call for Papers, FreeBSD’s iostat, The state of toolchains in NetBSD, Bandwidth limiting on OpenBSD 6.8, FreeBSD's ports migration to git and its impact on HardenedBSD, TrueNAS 12.0-U3 has been released, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
My Dog's Garage Runs OpenBSD (https://undeadly.org/cgi?action=article;sid=20210415055717)
I was inspired by the April 2017 article in undeadly.org about getting OpenBSD running on a Raspberry Pi 3B+. My goal was to use a Raspberry Pi running OpenBSD to monitor the temperature in my garage from my home. My dog has his own little "apartment" inside the garage, so I want to keep an eye on the temperature. (I don't rely on this device. He sleeps inside the house whenever he wants.)
EuroBSDcon 2021 Call for Papers (https://2021.eurobsdcon.org/about/cfp/)
FreeBSD iostat (https://klarasystems.com/articles/freebsd-iostat-a-quick-glance/)
The state of toolchains in NetBSD (https://www.cambus.net/the-state-of-toolchains-in-netbsd/)
While FreeBSD and OpenBSD both switched to using LLVM/Clang as their base system compiler, NetBSD picked a different path and remained with GCC and binutils regardless of the license change to GPLv3. However, it doesn't mean that the NetBSD project endorses this license, and the NetBSD Foundation's has issued a statement about its position on the subject.
NetBSD’s statement (http://cvsweb.netbsd.org/bsdweb.cgi/src/external/gpl3/README?rev=1.1)
***
News Roundup
Bandwidth limiting on OpenBSD 6.8 (https://dataswamp.org/~solene/2021-02-07-limit.html)
I will explain how to limit bandwidth on OpenBSD using its firewall PF (Packet Filter) queuing capability. It is a very powerful feature but it may be hard to understand at first. What is very important to understand is that it's technically not possible to limit the bandwidth of the whole system, because once data is getting on your network interface, it's already there and got by your router, what is possible is to limit the upload rate to cap the download rate.
FreeBSD's ports migration to git and its impact on HardenedBSD (https://hardenedbsd.org/article/shawn-webb/2021-04-06/freebsds-ports-migration-git-and-its-impact-hardenedbsd)
FreeBSD completed their ports migration from subversion to git. Prior to the official switch, we used the read-only mirror FreeBSD had at GitHub[1]. The new repo is at [2]. A cursory glance at the new repo will show that the commit hashes changed. This presents an issue with HardenedBSD's ports tree in our merge-based workflow.
TrueNAS 12.0-U3 has been released (https://www.truenas.com/docs/releasenotes/core/12.0u3/)
iXsystems is excited to announce TrueNAS 12.0-U3 was released today and marks an important milestone in the transition from FreeNAS to TrueNAS. TrueNAS 12.0 is now considered by iXsystems to be a higher quality release than FreeNAS 11.3-U5, our previous benchmark. The new TrueNAS documentation site has also reached a point where it has more content and capabilities than FreeNAS. TrueNAS 12.0 is ready for mission-critical enterprise deployments.
Beastie Bits
Joyent provides pkgsrc for MacOS X (https://pkgsrc.joyent.com/install-on-osx/)
Archives of old Irix documentation (https://techpubs.jurassic.nl)
FreeBSD Developer/Vendor Summit 2021 (https://wiki.freebsd.org/DevSummit/202106)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Andre - splitting zfs array (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Andre - splitting zfs array)
Bruce - Command Change (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Bruce - Command Change)
Dan - Annoyances with ZFS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Dan - Annoyances with ZFS)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, dog, garage, toolchain, bandwidth, bandwidth limit, migration, truenas, xenix, history</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Dog&#39;s Garage Runs OpenBSD, EuroBSDcon 2021 Call for Papers, FreeBSD’s iostat, The state of toolchains in NetBSD, Bandwidth limiting on OpenBSD 6.8, FreeBSD&#39;s ports migration to git and its impact on HardenedBSD, TrueNAS 12.0-U3 has been released, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210415055717" rel="nofollow">My Dog&#39;s Garage Runs OpenBSD</a></h3>

<blockquote>
<p>I was inspired by the April 2017 article in undeadly.org about getting OpenBSD running on a Raspberry Pi 3B+. My goal was to use a Raspberry Pi running OpenBSD to monitor the temperature in my garage from my home. My dog has his own little &quot;apartment&quot; inside the garage, so I want to keep an eye on the temperature. (I don&#39;t rely on this device. He sleeps inside the house whenever he wants.)</p>

<hr>
</blockquote>

<h3><a href="https://2021.eurobsdcon.org/about/cfp/" rel="nofollow">EuroBSDcon 2021 Call for Papers</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/freebsd-iostat-a-quick-glance/" rel="nofollow">FreeBSD iostat</a></h3>

<hr>

<h3><a href="https://www.cambus.net/the-state-of-toolchains-in-netbsd/" rel="nofollow">The state of toolchains in NetBSD</a></h3>

<blockquote>
<p>While FreeBSD and OpenBSD both switched to using LLVM/Clang as their base system compiler, NetBSD picked a different path and remained with GCC and binutils regardless of the license change to GPLv3. However, it doesn&#39;t mean that the NetBSD project endorses this license, and the NetBSD Foundation&#39;s has issued a statement about its position on the subject.</p>
</blockquote>

<ul>
<li><a href="http://cvsweb.netbsd.org/bsdweb.cgi/src/external/gpl3/README?rev=1.1" rel="nofollow">NetBSD’s statement</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-02-07-limit.html" rel="nofollow">Bandwidth limiting on OpenBSD 6.8</a></h3>

<blockquote>
<p>I will explain how to limit bandwidth on OpenBSD using its firewall PF (Packet Filter) queuing capability. It is a very powerful feature but it may be hard to understand at first. What is very important to understand is that it&#39;s technically not possible to limit the bandwidth of the whole system, because once data is getting on your network interface, it&#39;s already there and got by your router, what is possible is to limit the upload rate to cap the download rate.</p>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2021-04-06/freebsds-ports-migration-git-and-its-impact-hardenedbsd" rel="nofollow">FreeBSD&#39;s ports migration to git and its impact on HardenedBSD</a></h3>

<p>FreeBSD completed their ports migration from subversion to git. Prior to the official switch, we used the read-only mirror FreeBSD had at GitHub[1]. The new repo is at [2]. A cursory glance at the new repo will show that the commit hashes changed. This presents an issue with HardenedBSD&#39;s ports tree in our merge-based workflow.</p>

<hr>
</blockquote>

<h3><a href="https://www.truenas.com/docs/releasenotes/core/12.0u3/" rel="nofollow">TrueNAS 12.0-U3 has been released</a></h3>

<blockquote>
<p>iXsystems is excited to announce TrueNAS 12.0-U3 was released today and marks an important milestone in the transition from FreeNAS to TrueNAS. TrueNAS 12.0 is now considered by iXsystems to be a higher quality release than FreeNAS 11.3-U5, our previous benchmark. The new TrueNAS documentation site has also reached a point where it has more content and capabilities than FreeNAS. TrueNAS 12.0 is ready for mission-critical enterprise deployments.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://pkgsrc.joyent.com/install-on-osx/" rel="nofollow">Joyent provides pkgsrc for MacOS X</a></li>
<li><a href="https://techpubs.jurassic.nl" rel="nofollow">Archives of old Irix documentation</a></li>
<li><a href="https://wiki.freebsd.org/DevSummit/202106" rel="nofollow">FreeBSD Developer/Vendor Summit 2021</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Andre%20-%20splitting%20zfs%20array" rel="nofollow">Andre - splitting zfs array</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Bruce%20-%20Command%20Change" rel="nofollow">Bruce - Command Change</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Dan%20-%20Annoyances%20with%20ZFS" rel="nofollow">Dan - Annoyances with ZFS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Dog&#39;s Garage Runs OpenBSD, EuroBSDcon 2021 Call for Papers, FreeBSD’s iostat, The state of toolchains in NetBSD, Bandwidth limiting on OpenBSD 6.8, FreeBSD&#39;s ports migration to git and its impact on HardenedBSD, TrueNAS 12.0-U3 has been released, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210415055717" rel="nofollow">My Dog&#39;s Garage Runs OpenBSD</a></h3>

<blockquote>
<p>I was inspired by the April 2017 article in undeadly.org about getting OpenBSD running on a Raspberry Pi 3B+. My goal was to use a Raspberry Pi running OpenBSD to monitor the temperature in my garage from my home. My dog has his own little &quot;apartment&quot; inside the garage, so I want to keep an eye on the temperature. (I don&#39;t rely on this device. He sleeps inside the house whenever he wants.)</p>

<hr>
</blockquote>

<h3><a href="https://2021.eurobsdcon.org/about/cfp/" rel="nofollow">EuroBSDcon 2021 Call for Papers</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/freebsd-iostat-a-quick-glance/" rel="nofollow">FreeBSD iostat</a></h3>

<hr>

<h3><a href="https://www.cambus.net/the-state-of-toolchains-in-netbsd/" rel="nofollow">The state of toolchains in NetBSD</a></h3>

<blockquote>
<p>While FreeBSD and OpenBSD both switched to using LLVM/Clang as their base system compiler, NetBSD picked a different path and remained with GCC and binutils regardless of the license change to GPLv3. However, it doesn&#39;t mean that the NetBSD project endorses this license, and the NetBSD Foundation&#39;s has issued a statement about its position on the subject.</p>
</blockquote>

<ul>
<li><a href="http://cvsweb.netbsd.org/bsdweb.cgi/src/external/gpl3/README?rev=1.1" rel="nofollow">NetBSD’s statement</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2021-02-07-limit.html" rel="nofollow">Bandwidth limiting on OpenBSD 6.8</a></h3>

<blockquote>
<p>I will explain how to limit bandwidth on OpenBSD using its firewall PF (Packet Filter) queuing capability. It is a very powerful feature but it may be hard to understand at first. What is very important to understand is that it&#39;s technically not possible to limit the bandwidth of the whole system, because once data is getting on your network interface, it&#39;s already there and got by your router, what is possible is to limit the upload rate to cap the download rate.</p>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2021-04-06/freebsds-ports-migration-git-and-its-impact-hardenedbsd" rel="nofollow">FreeBSD&#39;s ports migration to git and its impact on HardenedBSD</a></h3>

<p>FreeBSD completed their ports migration from subversion to git. Prior to the official switch, we used the read-only mirror FreeBSD had at GitHub[1]. The new repo is at [2]. A cursory glance at the new repo will show that the commit hashes changed. This presents an issue with HardenedBSD&#39;s ports tree in our merge-based workflow.</p>

<hr>
</blockquote>

<h3><a href="https://www.truenas.com/docs/releasenotes/core/12.0u3/" rel="nofollow">TrueNAS 12.0-U3 has been released</a></h3>

<blockquote>
<p>iXsystems is excited to announce TrueNAS 12.0-U3 was released today and marks an important milestone in the transition from FreeNAS to TrueNAS. TrueNAS 12.0 is now considered by iXsystems to be a higher quality release than FreeNAS 11.3-U5, our previous benchmark. The new TrueNAS documentation site has also reached a point where it has more content and capabilities than FreeNAS. TrueNAS 12.0 is ready for mission-critical enterprise deployments.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://pkgsrc.joyent.com/install-on-osx/" rel="nofollow">Joyent provides pkgsrc for MacOS X</a></li>
<li><a href="https://techpubs.jurassic.nl" rel="nofollow">Archives of old Irix documentation</a></li>
<li><a href="https://wiki.freebsd.org/DevSummit/202106" rel="nofollow">FreeBSD Developer/Vendor Summit 2021</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Andre%20-%20splitting%20zfs%20array" rel="nofollow">Andre - splitting zfs array</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Bruce%20-%20Command%20Change" rel="nofollow">Bruce - Command Change</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Dan%20-%20Annoyances%20with%20ZFS" rel="nofollow">Dan - Annoyances with ZFS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>400: FreeBSD became 13</title>
  <link>https://www.bsdnow.tv/400</link>
  <guid isPermaLink="false">3117fff6-093a-49a0-b8a2-c8628deb83e5</guid>
  <pubDate>Thu, 29 Apr 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3117fff6-093a-49a0-b8a2-c8628deb83e5.mp3" length="40681968" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle> FreeBSD 13 is here, multi-factor authentication on OpenBSD, KDE on FreeBSD 2021o2, NetBSD GSoC report, a working D compiler on OpenBSD, and more</itunes:subtitle>
  <itunes:duration>1:02:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description> FreeBSD 13 is here, multi-factor authentication on OpenBSD, KDE on FreeBSD 2021o2, NetBSD GSoC report, a working D compiler on OpenBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
FreeBSD 13.0 R Annoucement (https://www.freebsd.org/releases/13.0R/announce/)
• OpenZFS 2.0 (almost 2.1) is included in 13.0
• Removed support for previously-deprecated algorithms in geli(8).
• The armv8crypto(4) driver now supports AES-GCM which is used by IPsec and kernel TLS.
Enable multi-factor authentication on OpenBSD (https://dataswamp.org/~solene/2021-02-06-openbsd-2fa.html)
In this article I will explain how to add a bit more security to your OpenBSD system by adding a requirement for user logging into the system, locally or by ssh. I will explain how to setup 2 factor authentication (2FA) using TOTP on OpenBSD
News Roundup
KDE on FreeBSD 2021o2 (https://euroquis.nl/kde/2021/03/26/freebsd2021o2.html)
Gosh, second octant already! Well, let’s take a look at the big things that happened in KDE-on-FreeBSD in these six-and-a-half weeks.
GSoC Reports: Make system(3), popen(3) and popenve(3) use posix_spawn(3) internally (Final report) (http://blog.netbsd.org/tnf/entry/gsoc_reports_make_system_31)
My code can be found at github.com/teknokatze/src in the gsoc2020 branch, at the time of writing some of it is still missing. The test facilities and logs can be found in github.com/teknokatze/gsoc2020. A diff can be found at github which will later be split into several patches before it is sent to QA for merging.
The initial and defined goal of this project was to make system(3) and popen(3) use posixspawn(3) internally, which had been completed in June. For the second part I was given the task to replace fork+exec calls in our standard shell (sh) in one scenario. Similar to the previous goal we determined through implementation if the initial motivation, to get performance improvements, is correct otherwise we collect metrics for why posixspawn() in this case should be avoided. This second part meant in practice that I had to add and change code in the kernel, add a new public libc function, and understand shell internals.
A working D compiler on OpenBSD (https://undeadly.org/cgi?action=article;sid=20210322080633)
Dr. Brian Robert Callahan (bcallah@) blogged about his work in getting D compiler(s) working under OpenBSD.
+ Full Post (https://briancallahan.net/blog/20210320.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Vasilis - upgrade question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/Vasilis%20-%20upgrade%20question)
Dennis - zfs questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/Dennis%20-%20zfs%20questions)
Daniel Dettlaff - KTLS question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/dmilith%20-%20KTLS)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, ports, packages, freebsd 13, kde, report, google summer of code, gsoc, d compiler</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 13 is here, multi-factor authentication on OpenBSD, KDE on FreeBSD 2021o2, NetBSD GSoC report, a working D compiler on OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/13.0R/announce/" rel="nofollow">FreeBSD 13.0 R Annoucement</a></h3>

<pre><code>• OpenZFS 2.0 (almost 2.1) is included in 13.0
• Removed support for previously-deprecated algorithms in geli(8).
• The armv8crypto(4) driver now supports AES-GCM which is used by IPsec and kernel TLS.
</code></pre>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-02-06-openbsd-2fa.html" rel="nofollow">Enable multi-factor authentication on OpenBSD</a></h3>

<blockquote>
<p>In this article I will explain how to add a bit more security to your OpenBSD system by adding a requirement for user logging into the system, locally or by ssh. I will explain how to setup 2 factor authentication (2FA) using TOTP on OpenBSD</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://euroquis.nl/kde/2021/03/26/freebsd2021o2.html" rel="nofollow">KDE on FreeBSD 2021o2</a></h3>

<blockquote>
<p>Gosh, second octant already! Well, let’s take a look at the big things that happened in KDE-on-FreeBSD in these six-and-a-half weeks.</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/gsoc_reports_make_system_31" rel="nofollow">GSoC Reports: Make system(3), popen(3) and popenve(3) use posix_spawn(3) internally (Final report)</a></h3>

<blockquote>
<p>My code can be found at github.com/teknokatze/src in the gsoc2020 branch, at the time of writing some of it is still missing. The test facilities and logs can be found in github.com/teknokatze/gsoc2020. A diff can be found at github which will later be split into several patches before it is sent to QA for merging.<br>
The initial and defined goal of this project was to make system(3) and popen(3) use posix_spawn(3) internally, which had been completed in June. For the second part I was given the task to replace fork+exec calls in our standard shell (sh) in one scenario. Similar to the previous goal we determined through implementation if the initial motivation, to get performance improvements, is correct otherwise we collect metrics for why posix_spawn() in this case should be avoided. This second part meant in practice that I had to add and change code in the kernel, add a new public libc function, and understand shell internals.</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210322080633" rel="nofollow">A working D compiler on OpenBSD</a></h3>

<blockquote>
<p>Dr. Brian Robert Callahan (bcallah@) blogged about his work in getting D compiler(s) working under OpenBSD.</p>

<ul>
<li><a href="https://briancallahan.net/blog/20210320.html" rel="nofollow">Full Post</a>
***</li>
</ul>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/Vasilis%20-%20upgrade%20question" rel="nofollow">Vasilis - upgrade question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/Dennis%20-%20zfs%20questions" rel="nofollow">Dennis - zfs questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/dmilith%20-%20KTLS" rel="nofollow">Daniel Dettlaff - KTLS question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 13 is here, multi-factor authentication on OpenBSD, KDE on FreeBSD 2021o2, NetBSD GSoC report, a working D compiler on OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/13.0R/announce/" rel="nofollow">FreeBSD 13.0 R Annoucement</a></h3>

<pre><code>• OpenZFS 2.0 (almost 2.1) is included in 13.0
• Removed support for previously-deprecated algorithms in geli(8).
• The armv8crypto(4) driver now supports AES-GCM which is used by IPsec and kernel TLS.
</code></pre>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-02-06-openbsd-2fa.html" rel="nofollow">Enable multi-factor authentication on OpenBSD</a></h3>

<blockquote>
<p>In this article I will explain how to add a bit more security to your OpenBSD system by adding a requirement for user logging into the system, locally or by ssh. I will explain how to setup 2 factor authentication (2FA) using TOTP on OpenBSD</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://euroquis.nl/kde/2021/03/26/freebsd2021o2.html" rel="nofollow">KDE on FreeBSD 2021o2</a></h3>

<blockquote>
<p>Gosh, second octant already! Well, let’s take a look at the big things that happened in KDE-on-FreeBSD in these six-and-a-half weeks.</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/gsoc_reports_make_system_31" rel="nofollow">GSoC Reports: Make system(3), popen(3) and popenve(3) use posix_spawn(3) internally (Final report)</a></h3>

<blockquote>
<p>My code can be found at github.com/teknokatze/src in the gsoc2020 branch, at the time of writing some of it is still missing. The test facilities and logs can be found in github.com/teknokatze/gsoc2020. A diff can be found at github which will later be split into several patches before it is sent to QA for merging.<br>
The initial and defined goal of this project was to make system(3) and popen(3) use posix_spawn(3) internally, which had been completed in June. For the second part I was given the task to replace fork+exec calls in our standard shell (sh) in one scenario. Similar to the previous goal we determined through implementation if the initial motivation, to get performance improvements, is correct otherwise we collect metrics for why posix_spawn() in this case should be avoided. This second part meant in practice that I had to add and change code in the kernel, add a new public libc function, and understand shell internals.</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210322080633" rel="nofollow">A working D compiler on OpenBSD</a></h3>

<blockquote>
<p>Dr. Brian Robert Callahan (bcallah@) blogged about his work in getting D compiler(s) working under OpenBSD.</p>

<ul>
<li><a href="https://briancallahan.net/blog/20210320.html" rel="nofollow">Full Post</a>
***</li>
</ul>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/Vasilis%20-%20upgrade%20question" rel="nofollow">Vasilis - upgrade question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/Dennis%20-%20zfs%20questions" rel="nofollow">Dennis - zfs questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/dmilith%20-%20KTLS" rel="nofollow">Daniel Dettlaff - KTLS question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>399: Comparing Sandboxes</title>
  <link>https://www.bsdnow.tv/399</link>
  <guid isPermaLink="false">3de2dd50-eca9-4729-9ef6-464aa4ec5795</guid>
  <pubDate>Thu, 22 Apr 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3de2dd50-eca9-4729-9ef6-464aa4ec5795.mp3" length="36616080" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Comparing sandboxing techniques, Statement on FreeBSD development processes, customizing FreeBSD ports and packages, the quest for a comfortable NetBSD desktop, Nginx as a TCP/UDP relay, HardenedBSD March 2021 Status Report, Detailed Behaviors of Unix Signal, and more
</itunes:subtitle>
  <itunes:duration>57:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Comparing sandboxing techniques, Statement on FreeBSD development processes, customizing FreeBSD ports and packages, the quest for a comfortable NetBSD desktop, Nginx as a TCP/UDP relay, HardenedBSD March 2021 Status Report, Detailed Behaviors of Unix Signal, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Comparing sandboxing techniques (https://www.omarpolo.com/post/gmid-sandbox.html)
I had the opportunity to implement a sandbox and I'd like to write about the differences between the various sandboxing techniques available on three different operating systems: FreeBSD, Linux and OpenBSD.
Statement on FreeBSD development processes (https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057127.html)
In light of the recent commentary on FreeBSD's development practices, members of the Core team would like to issue the following statement.
Customizing FreeBSD Ports and Packages (https://klarasystems.com/articles/customizing-freebsd-ports-and-packages/)
A basic intro to building your own packages
News Roundup
FVWM(3) and the quest for a comfortable NetBSD desktop (https://www.unitedbsd.com/d/442-fvwm3-and-the-quest-for-a-comfortable-netbsd-desktop)
FVWM substantially allows one to build a fully-fledged lightweight desktop environment from scratch, with an almost unparalleled degree of freedom. Although using FVWM does not require any knowledge of programming languages, it is possible to extend it with M4, C, and Perl preprocessing.
Nginx as a TCP/UDP relay (https://dataswamp.org/~solene/2021-02-24-nginx-stream.html)
In this tutorial I will explain how to use Nginx as a TCP or UDP relay as an alternative to Haproxy or Relayd. This mean nginx will be able to accept requests on a port (TCP/UDP) and relay it to another backend without knowing about the content. It also permits to negociates a TLS session with the client and relay to a non-TLS backend. In this example I will explain how to configure Nginx to accept TLS requests to transmit it to my Gemini server Vger, Gemini protocol has TLS as a requirement.
HardenedBSD March 2021 Status Report (https://hardenedbsd.org/article/shawn-webb/2021-03-31/hardenedbsd-march-2021-status-report)
This month, I worked on finding and fixing the regression that caused kernel panics on our package builders. I think I found the issue: I made it so that the HARDENEDBSD amd64 kernel just included GENERIC so that we follow FreeBSD's toggling of features. Doing so added QUEUEMACRODEBUGTRASH to our kernel config. That option is the likely culprit. If the next package build (with the option removed) completes, I will commit the change that removes QUEUEMACRODEBUGTRASH from the HARDENEDBSD amd64 kernel.
Detailed Behaviors of Unix Signal (https://www.dyx.name/posts/essays/signal.html)
When Unix is mentioned in this document it means macOS or Linux as they are the mainly used Unix at this moment. When shell is mentioned it means Bash or Zsh. Most demos are written in C for macOS with Apple libc and Linux with glibc.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
andrew - flatpak (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/andrew%20-%20flatpak)
chris - mac and truenas (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/chris%20-%20mac%20and%20truenas)
robert - some questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/robert%20-%20some%20questions)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, sandboxing, sandbox technique, development process, statement, customizing, ports, packages, nginx, relay, tcp, udp, status report, signal</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Comparing sandboxing techniques, Statement on FreeBSD development processes, customizing FreeBSD ports and packages, the quest for a comfortable NetBSD desktop, Nginx as a TCP/UDP relay, HardenedBSD March 2021 Status Report, Detailed Behaviors of Unix Signal, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.omarpolo.com/post/gmid-sandbox.html" rel="nofollow">Comparing sandboxing techniques</a></h3>

<blockquote>
<p>I had the opportunity to implement a sandbox and I&#39;d like to write about the differences between the various sandboxing techniques available on three different operating systems: FreeBSD, Linux and OpenBSD.</p>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057127.html" rel="nofollow">Statement on FreeBSD development processes</a></h3>

<p>In light of the recent commentary on FreeBSD&#39;s development practices, members of the Core team would like to issue the following statement.</p>

<hr>

<h3><a href="https://klarasystems.com/articles/customizing-freebsd-ports-and-packages/" rel="nofollow">Customizing FreeBSD Ports and Packages</a></h3>

<p>A basic intro to building your own packages</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://www.unitedbsd.com/d/442-fvwm3-and-the-quest-for-a-comfortable-netbsd-desktop" rel="nofollow">FVWM(3) and the quest for a comfortable NetBSD desktop</a></h3>

<blockquote>
<p>FVWM substantially allows one to build a fully-fledged lightweight desktop environment from scratch, with an almost unparalleled degree of freedom. Although using FVWM does not require any knowledge of programming languages, it is possible to extend it with M4, C, and Perl preprocessing.</p>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-02-24-nginx-stream.html" rel="nofollow">Nginx as a TCP/UDP relay</a></h3>

<p>In this tutorial I will explain how to use Nginx as a TCP or UDP relay as an alternative to Haproxy or Relayd. This mean nginx will be able to accept requests on a port (TCP/UDP) and relay it to another backend without knowing about the content. It also permits to negociates a TLS session with the client and relay to a non-TLS backend. In this example I will explain how to configure Nginx to accept TLS requests to transmit it to my Gemini server Vger, Gemini protocol has TLS as a requirement.</p>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2021-03-31/hardenedbsd-march-2021-status-report" rel="nofollow">HardenedBSD March 2021 Status Report</a></h3>

<p>This month, I worked on finding and fixing the regression that caused kernel panics on our package builders. I think I found the issue: I made it so that the HARDENEDBSD amd64 kernel just included GENERIC so that we follow FreeBSD&#39;s toggling of features. Doing so added QUEUE_MACRO_DEBUG_TRASH to our kernel config. That option is the likely culprit. If the next package build (with the option removed) completes, I will commit the change that removes QUEUE_MACRO_DEBUG_TRASH from the HARDENEDBSD amd64 kernel.</p>

<hr>

<h3><a href="https://www.dyx.name/posts/essays/signal.html" rel="nofollow">Detailed Behaviors of Unix Signal</a></h3>

<p>When Unix is mentioned in this document it means macOS or Linux as they are the mainly used Unix at this moment. When shell is mentioned it means Bash or Zsh. Most demos are written in C for macOS with Apple libc and Linux with glibc.</p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>
</blockquote>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/andrew%20-%20flatpak" rel="nofollow">andrew - flatpak</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/chris%20-%20mac%20and%20truenas" rel="nofollow">chris - mac and truenas</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/robert%20-%20some%20questions" rel="nofollow">robert - some questions</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Comparing sandboxing techniques, Statement on FreeBSD development processes, customizing FreeBSD ports and packages, the quest for a comfortable NetBSD desktop, Nginx as a TCP/UDP relay, HardenedBSD March 2021 Status Report, Detailed Behaviors of Unix Signal, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.omarpolo.com/post/gmid-sandbox.html" rel="nofollow">Comparing sandboxing techniques</a></h3>

<blockquote>
<p>I had the opportunity to implement a sandbox and I&#39;d like to write about the differences between the various sandboxing techniques available on three different operating systems: FreeBSD, Linux and OpenBSD.</p>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057127.html" rel="nofollow">Statement on FreeBSD development processes</a></h3>

<p>In light of the recent commentary on FreeBSD&#39;s development practices, members of the Core team would like to issue the following statement.</p>

<hr>

<h3><a href="https://klarasystems.com/articles/customizing-freebsd-ports-and-packages/" rel="nofollow">Customizing FreeBSD Ports and Packages</a></h3>

<p>A basic intro to building your own packages</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://www.unitedbsd.com/d/442-fvwm3-and-the-quest-for-a-comfortable-netbsd-desktop" rel="nofollow">FVWM(3) and the quest for a comfortable NetBSD desktop</a></h3>

<blockquote>
<p>FVWM substantially allows one to build a fully-fledged lightweight desktop environment from scratch, with an almost unparalleled degree of freedom. Although using FVWM does not require any knowledge of programming languages, it is possible to extend it with M4, C, and Perl preprocessing.</p>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2021-02-24-nginx-stream.html" rel="nofollow">Nginx as a TCP/UDP relay</a></h3>

<p>In this tutorial I will explain how to use Nginx as a TCP or UDP relay as an alternative to Haproxy or Relayd. This mean nginx will be able to accept requests on a port (TCP/UDP) and relay it to another backend without knowing about the content. It also permits to negociates a TLS session with the client and relay to a non-TLS backend. In this example I will explain how to configure Nginx to accept TLS requests to transmit it to my Gemini server Vger, Gemini protocol has TLS as a requirement.</p>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2021-03-31/hardenedbsd-march-2021-status-report" rel="nofollow">HardenedBSD March 2021 Status Report</a></h3>

<p>This month, I worked on finding and fixing the regression that caused kernel panics on our package builders. I think I found the issue: I made it so that the HARDENEDBSD amd64 kernel just included GENERIC so that we follow FreeBSD&#39;s toggling of features. Doing so added QUEUE_MACRO_DEBUG_TRASH to our kernel config. That option is the likely culprit. If the next package build (with the option removed) completes, I will commit the change that removes QUEUE_MACRO_DEBUG_TRASH from the HARDENEDBSD amd64 kernel.</p>

<hr>

<h3><a href="https://www.dyx.name/posts/essays/signal.html" rel="nofollow">Detailed Behaviors of Unix Signal</a></h3>

<p>When Unix is mentioned in this document it means macOS or Linux as they are the mainly used Unix at this moment. When shell is mentioned it means Bash or Zsh. Most demos are written in C for macOS with Apple libc and Linux with glibc.</p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>
</blockquote>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/andrew%20-%20flatpak" rel="nofollow">andrew - flatpak</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/chris%20-%20mac%20and%20truenas" rel="nofollow">chris - mac and truenas</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/robert%20-%20some%20questions" rel="nofollow">robert - some questions</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>398: Coordinated Mars Time</title>
  <link>https://www.bsdnow.tv/398</link>
  <guid isPermaLink="false">690f3bec-7d66-4d05-8cee-073e2248cd50</guid>
  <pubDate>Thu, 15 Apr 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/690f3bec-7d66-4d05-8cee-073e2248cd50.mp3" length="30056400" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 13.0 Full Desktop Experience, FreeBSD on ARM64 in the Cloud, Plan 9 from Bell Labs in Cyberspace, Inferno is open source as well, NetBSD hits donation milestone, grep returns (standard input) on FreeBSD, Random Programming Challenge, OpenBSD Adds Support for Coordinated Mars Time (MTC) and more</itunes:subtitle>
  <itunes:duration>50:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 13.0 Full Desktop Experience, FreeBSD on ARM64 in the Cloud, Plan 9 from Bell Labs in Cyberspace, Inferno is open source as well, NetBSD hits donation milestone, grep returns (standard input) on FreeBSD, Random Programming Challenge, OpenBSD Adds Support for Coordinated Mars Time (MTC) and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
FreeBSD 13.0 – Full Desktop Experience (https://www.tubsta.com/2021/03/freebsd-13-0-full-desktop-experience/)
With the release of FreeBSD 13.0 on the horizon, I wanted to see how it shapes up on my Lenovo T450 laptop.  Previous major releases on this laptop, using it as a workstation, felt very rough around the edges but with 13, it feels like the developers got it right.
FreeBSD on ARM64 in the Cloud (https://klarasystems.com/articles/the-next-level-freebsd-on-arm64-in-the-cloud/)
Until the end of June, Amazon AWS is offering free ARM64 Graviton instances, learn how to try out FreeBSD to ARMv8 in the cloud
Plan 9 from Bell Labs in Cyberspace! (https://www.bell-labs.com/institute/blog/plan-9-bell-labs-cyberspace/)
The releases below represent the historical releases of Plan 9. (http://p9f.org/dl/index.html) The two versions of 4th Edition represent the initial release and the final version available from Bell Labs as it was updated and patched. All historical releases of Plan 9 have been re-released under the terms of the MIT license.
+ Inferno is open source as well (https://bitbucket.org/inferno-os/inferno64-os/src/master/)
News Roundup
Hitting donation milestone, financial report for 2020 (http://blog.netbsd.org/tnf/entry/hitting_donation_milestone_financial_report)
We nearly hit our 2020 donation milestone set after the release of 9.0 of $50,000.
grep returns (standard input) on FreeBSD (https://rubenerd.com/grep-returns-standard-input/)
I was dealing with a bizarre error with grep(1) on FreeBSD, and it soon infected my macOS and NetBSD machines too. It was driving me crazy!
Random Programming Challenge (https://projecteuler.net/problem=84)
This better not be an April Fools Joke… I want to see this actually implemented. I’ll donate $100 to the first BSD that actually implements this for real.  Who’s with me?
OpenBSD Adds Support for Coordinated Mars Time (MTC) (https://marc.info/?l=openbsd-cvs&amp;amp;m=161730046519995)
To make sure that OpenBSD can be used elsewhere than just earth, this diff introduces Coordinated Mars Time (MTC), the Mars equivalent of earth’s Universal Time (UTC).
OpenZFS had a good one too (https://github.com/openzfs/zfs/pull/11823)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brandon - router (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/Brandon%20-%20router)
Lawrence - Is BSD for me (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/Lawrence%20-%20Is%20FreeBSD%20for%20me)
miguel - printing (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/miguel%20-%20printing)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, desktop, arm64, armv8, cloud, aws, plan 9, bell labs, cyberspace, inferno, donation, milestone, financial, report, opnsense, grep, stdin, standard input, random, programming, challenge, Mars, Coordinated Mars Time </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 13.0 Full Desktop Experience, FreeBSD on ARM64 in the Cloud, Plan 9 from Bell Labs in Cyberspace, Inferno is open source as well, NetBSD hits donation milestone, grep returns (standard input) on FreeBSD, Random Programming Challenge, OpenBSD Adds Support for Coordinated Mars Time (MTC) and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.tubsta.com/2021/03/freebsd-13-0-full-desktop-experience/" rel="nofollow">FreeBSD 13.0 – Full Desktop Experience</a></h3>

<blockquote>
<p>With the release of FreeBSD 13.0 on the horizon, I wanted to see how it shapes up on my Lenovo T450 laptop.  Previous major releases on this laptop, using it as a workstation, felt very rough around the edges but with 13, it feels like the developers got it right.</p>

<hr>

<h3><a href="https://klarasystems.com/articles/the-next-level-freebsd-on-arm64-in-the-cloud/" rel="nofollow">FreeBSD on ARM64 in the Cloud</a></h3>

<p>Until the end of June, Amazon AWS is offering free ARM64 Graviton instances, learn how to try out FreeBSD to ARMv8 in the cloud</p>

<hr>
</blockquote>

<h3><a href="https://www.bell-labs.com/institute/blog/plan-9-bell-labs-cyberspace/" rel="nofollow">Plan 9 from Bell Labs in Cyberspace!</a></h3>

<blockquote>
<p><a href="http://p9f.org/dl/index.html" rel="nofollow">The releases below represent the historical releases of Plan 9.</a> The two versions of 4th Edition represent the initial release and the final version available from Bell Labs as it was updated and patched. All historical releases of Plan 9 have been re-released under the terms of the MIT license.</p>

<ul>
<li><a href="https://bitbucket.org/inferno-os/inferno64-os/src/master/" rel="nofollow">Inferno is open source as well</a>
***
## News Roundup
### <a href="http://blog.netbsd.org/tnf/entry/hitting_donation_milestone_financial_report" rel="nofollow">Hitting donation milestone, financial report for 2020</a>
We nearly hit our 2020 donation milestone set after the release of 9.0 of $50,000.
***</li>
</ul>
</blockquote>

<h3><a href="https://rubenerd.com/grep-returns-standard-input/" rel="nofollow">grep returns (standard input) on FreeBSD</a></h3>

<blockquote>
<p>I was dealing with a bizarre error with grep(1) on FreeBSD, and it soon infected my macOS and NetBSD machines too. It was driving me crazy!</p>

<hr>

<h3><a href="https://projecteuler.net/problem=84" rel="nofollow">Random Programming Challenge</a></h3>

<hr>

<h3>This better not be an April Fools Joke… I want to see this actually implemented. I’ll donate $100 to the first BSD that actually implements this for real.  Who’s with me?</h3>
</blockquote>

<p><a href="https://marc.info/?l=openbsd-cvs&m=161730046519995" rel="nofollow">OpenBSD Adds Support for Coordinated Mars Time (MTC)</a></p>

<blockquote>
<p>To make sure that OpenBSD can be used elsewhere than just earth, this diff introduces Coordinated Mars Time (MTC), the Mars equivalent of earth’s Universal Time (UTC).<br>
<a href="https://github.com/openzfs/zfs/pull/11823" rel="nofollow">OpenZFS had a good one too</a></p>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/Brandon%20-%20router" rel="nofollow">Brandon - router</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/Lawrence%20-%20Is%20FreeBSD%20for%20me" rel="nofollow">Lawrence - Is BSD for me</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/miguel%20-%20printing" rel="nofollow">miguel - printing</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 13.0 Full Desktop Experience, FreeBSD on ARM64 in the Cloud, Plan 9 from Bell Labs in Cyberspace, Inferno is open source as well, NetBSD hits donation milestone, grep returns (standard input) on FreeBSD, Random Programming Challenge, OpenBSD Adds Support for Coordinated Mars Time (MTC) and more</p>

<p><strong><em>NOTES</em></strong></p>

<p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.tubsta.com/2021/03/freebsd-13-0-full-desktop-experience/" rel="nofollow">FreeBSD 13.0 – Full Desktop Experience</a></h3>

<blockquote>
<p>With the release of FreeBSD 13.0 on the horizon, I wanted to see how it shapes up on my Lenovo T450 laptop.  Previous major releases on this laptop, using it as a workstation, felt very rough around the edges but with 13, it feels like the developers got it right.</p>

<hr>

<h3><a href="https://klarasystems.com/articles/the-next-level-freebsd-on-arm64-in-the-cloud/" rel="nofollow">FreeBSD on ARM64 in the Cloud</a></h3>

<p>Until the end of June, Amazon AWS is offering free ARM64 Graviton instances, learn how to try out FreeBSD to ARMv8 in the cloud</p>

<hr>
</blockquote>

<h3><a href="https://www.bell-labs.com/institute/blog/plan-9-bell-labs-cyberspace/" rel="nofollow">Plan 9 from Bell Labs in Cyberspace!</a></h3>

<blockquote>
<p><a href="http://p9f.org/dl/index.html" rel="nofollow">The releases below represent the historical releases of Plan 9.</a> The two versions of 4th Edition represent the initial release and the final version available from Bell Labs as it was updated and patched. All historical releases of Plan 9 have been re-released under the terms of the MIT license.</p>

<ul>
<li><a href="https://bitbucket.org/inferno-os/inferno64-os/src/master/" rel="nofollow">Inferno is open source as well</a>
***
## News Roundup
### <a href="http://blog.netbsd.org/tnf/entry/hitting_donation_milestone_financial_report" rel="nofollow">Hitting donation milestone, financial report for 2020</a>
We nearly hit our 2020 donation milestone set after the release of 9.0 of $50,000.
***</li>
</ul>
</blockquote>

<h3><a href="https://rubenerd.com/grep-returns-standard-input/" rel="nofollow">grep returns (standard input) on FreeBSD</a></h3>

<blockquote>
<p>I was dealing with a bizarre error with grep(1) on FreeBSD, and it soon infected my macOS and NetBSD machines too. It was driving me crazy!</p>

<hr>

<h3><a href="https://projecteuler.net/problem=84" rel="nofollow">Random Programming Challenge</a></h3>

<hr>

<h3>This better not be an April Fools Joke… I want to see this actually implemented. I’ll donate $100 to the first BSD that actually implements this for real.  Who’s with me?</h3>
</blockquote>

<p><a href="https://marc.info/?l=openbsd-cvs&m=161730046519995" rel="nofollow">OpenBSD Adds Support for Coordinated Mars Time (MTC)</a></p>

<blockquote>
<p>To make sure that OpenBSD can be used elsewhere than just earth, this diff introduces Coordinated Mars Time (MTC), the Mars equivalent of earth’s Universal Time (UTC).<br>
<a href="https://github.com/openzfs/zfs/pull/11823" rel="nofollow">OpenZFS had a good one too</a></p>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/Brandon%20-%20router" rel="nofollow">Brandon - router</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/Lawrence%20-%20Is%20FreeBSD%20for%20me" rel="nofollow">Lawrence - Is BSD for me</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/miguel%20-%20printing" rel="nofollow">miguel - printing</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>397: Fresh BSD 2021</title>
  <link>https://www.bsdnow.tv/397</link>
  <guid isPermaLink="false">c901a741-a25b-4d92-9ce4-03b5f2e18d2f</guid>
  <pubDate>Thu, 08 Apr 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c901a741-a25b-4d92-9ce4-03b5f2e18d2f.mp3" length="34526808" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Customizing the FreeBSD Kernel, OpenBSD/loongson on the Lemote Fuloong, how ZFS on Linux brings up pools and filesystems at boot under systemd, LLDB: FreeBSD Legacy Process Plugin Removed, FreshBSD 2021, gmid, Danschmid’s Poudriere Guide in english, and more</itunes:subtitle>
  <itunes:duration>56:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Customizing the FreeBSD Kernel, OpenBSD/loongson on the Lemote Fuloong, how ZFS on Linux brings up pools and filesystems at boot under systemd, LLDB: FreeBSD Legacy Process Plugin Removed, FreshBSD 2021, gmid, Danschmid’s Poudriere Guide in english, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Customizing the FreeBSD Kernel (https://klarasystems.com/articles/customizing-the-freebsd-kernel/)
Learn more about customizing the build of the FreeBSD kernel and its loadable modules
OpenBSD/loongson on the Lemote Fuloong (https://www.cambus.net/openbsd-loongson-on-the-lemote-fuloong/)
In my article about running OpenBSD/loongson on the Lemote Yeeloong back in 2016, I mentioned looking for a Fuloong. All hope seemed lost until the Summer of 2017, when a fellow OpenBSD developer was contacted by a generous user (Thanks again, Lars!) offering to donate two Lemote Fuloong machines, and I was lucky enough to get one of those units.
News Roundup
How ZFS on Linux brings up pools and filesystems at boot under systemd (https://utcc.utoronto.ca/~cks/space/blog/linux/ZFSBringUpOnBoot)
On Solaris and Illumos, how ZFS pools and filesystems were brought up at boot was always a partial mystery to me (and it seemed to involve the kernel knowing a lot about /etc/zfs/zpool.cache). On Linux, additional software RAID arrays are brought up mostly through udev rules, which has its own complications. For a long time I had the general impression that ZFS on Linux also worked through udev rules to recognize vdev components, much like software RAID. However, this turns out to not be the case and the modern ZFS on Linux boot process is quite straightforward on systemd systems.
LLDB: FreeBSD Legacy Process Plugin Removed (https://www.moritz.systems/blog/freebsd-legacy-process-plugin-removed/)
During the past month we’ve successfully removed the legacy FreeBSD plugin and continued improving the new one. We have prepared an implementation of hardware breakpoint and watchpoint support for FreeBSD/AArch64, and iterated over all tests that currently fail on that platform. Therefore, we have concluded the second milestone.
FreshBSD 2021 (https://freshbsd.org/news/2021/02/28)
6 weeks ago I created a branch for a significant rework of FreshBSD. Nearly 300 commits later, and just a week shy of our 15th anniversary, the result is what you’re looking at now. I hope you like it.
gmid (https://github.com/omar-polo/gmid/) is a gemini (https://gemini.circumlunar.space/) server  for unixes.
Danschmid’s Poudriere Guide now in english (https://danschmid.de/en/blog/poudriere-guide)
The ports system is one of FreeBSD's greatest advantages for users who want flexibility and control over their software. It enables administrators to easily create and manage source-based installations using a system that is robust and predictable.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
 Special Guest: Tom Jones.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, customizing, kernel, loongson, lemote, fuloong, boot, systemd, lldb, legacy, process, plugin, freshbsd, gmid, poudriere, guide</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Customizing the FreeBSD Kernel, OpenBSD/loongson on the Lemote Fuloong, how ZFS on Linux brings up pools and filesystems at boot under systemd, LLDB: FreeBSD Legacy Process Plugin Removed, FreshBSD 2021, gmid, Danschmid’s Poudriere Guide in english, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/customizing-the-freebsd-kernel/" rel="nofollow">Customizing the FreeBSD Kernel</a></h3>

<blockquote>
<p>Learn more about customizing the build of the FreeBSD kernel and its loadable modules</p>

<hr>

<h3><a href="https://www.cambus.net/openbsd-loongson-on-the-lemote-fuloong/" rel="nofollow">OpenBSD/loongson on the Lemote Fuloong</a></h3>

<p>In my article about running OpenBSD/loongson on the Lemote Yeeloong back in 2016, I mentioned looking for a Fuloong. All hope seemed lost until the Summer of 2017, when a fellow OpenBSD developer was contacted by a generous user (Thanks again, Lars!) offering to donate two Lemote Fuloong machines, and I was lucky enough to get one of those units.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSBringUpOnBoot" rel="nofollow">How ZFS on Linux brings up pools and filesystems at boot under systemd</a></h3>

<blockquote>
<p>On Solaris and Illumos, how ZFS pools and filesystems were brought up at boot was always a partial mystery to me (and it seemed to involve the kernel knowing a lot about /etc/zfs/zpool.cache). On Linux, additional software RAID arrays are brought up mostly through udev rules, which has its own complications. For a long time I had the general impression that ZFS on Linux also worked through udev rules to recognize vdev components, much like software RAID. However, this turns out to not be the case and the modern ZFS on Linux boot process is quite straightforward on systemd systems.</p>

<hr>

<h3><a href="https://www.moritz.systems/blog/freebsd-legacy-process-plugin-removed/" rel="nofollow">LLDB: FreeBSD Legacy Process Plugin Removed</a></h3>

<p>During the past month we’ve successfully removed the legacy FreeBSD plugin and continued improving the new one. We have prepared an implementation of hardware breakpoint and watchpoint support for FreeBSD/AArch64, and iterated over all tests that currently fail on that platform. Therefore, we have concluded the second milestone.</p>

<hr>

<h3><a href="https://freshbsd.org/news/2021/02/28" rel="nofollow">FreshBSD 2021</a></h3>

<p>6 weeks ago I created a branch for a significant rework of FreshBSD. Nearly 300 commits later, and just a week shy of our 15th anniversary, the result is what you’re looking at now. I hope you like it.</p>

<hr>

<h3><a href="https://github.com/omar-polo/gmid/" rel="nofollow">gmid</a> is a <a href="https://gemini.circumlunar.space/" rel="nofollow">gemini</a> server  for unixes.</h3>

<hr>

<h3><a href="https://danschmid.de/en/blog/poudriere-guide" rel="nofollow">Danschmid’s Poudriere Guide now in english</a></h3>

<p>The ports system is one of FreeBSD&#39;s greatest advantages for users who want flexibility and control over their software. It enables administrators to easily create and manage source-based installations using a system that is robust and predictable.</p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>
</blockquote>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Tom Jones.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Customizing the FreeBSD Kernel, OpenBSD/loongson on the Lemote Fuloong, how ZFS on Linux brings up pools and filesystems at boot under systemd, LLDB: FreeBSD Legacy Process Plugin Removed, FreshBSD 2021, gmid, Danschmid’s Poudriere Guide in english, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/customizing-the-freebsd-kernel/" rel="nofollow">Customizing the FreeBSD Kernel</a></h3>

<blockquote>
<p>Learn more about customizing the build of the FreeBSD kernel and its loadable modules</p>

<hr>

<h3><a href="https://www.cambus.net/openbsd-loongson-on-the-lemote-fuloong/" rel="nofollow">OpenBSD/loongson on the Lemote Fuloong</a></h3>

<p>In my article about running OpenBSD/loongson on the Lemote Yeeloong back in 2016, I mentioned looking for a Fuloong. All hope seemed lost until the Summer of 2017, when a fellow OpenBSD developer was contacted by a generous user (Thanks again, Lars!) offering to donate two Lemote Fuloong machines, and I was lucky enough to get one of those units.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSBringUpOnBoot" rel="nofollow">How ZFS on Linux brings up pools and filesystems at boot under systemd</a></h3>

<blockquote>
<p>On Solaris and Illumos, how ZFS pools and filesystems were brought up at boot was always a partial mystery to me (and it seemed to involve the kernel knowing a lot about /etc/zfs/zpool.cache). On Linux, additional software RAID arrays are brought up mostly through udev rules, which has its own complications. For a long time I had the general impression that ZFS on Linux also worked through udev rules to recognize vdev components, much like software RAID. However, this turns out to not be the case and the modern ZFS on Linux boot process is quite straightforward on systemd systems.</p>

<hr>

<h3><a href="https://www.moritz.systems/blog/freebsd-legacy-process-plugin-removed/" rel="nofollow">LLDB: FreeBSD Legacy Process Plugin Removed</a></h3>

<p>During the past month we’ve successfully removed the legacy FreeBSD plugin and continued improving the new one. We have prepared an implementation of hardware breakpoint and watchpoint support for FreeBSD/AArch64, and iterated over all tests that currently fail on that platform. Therefore, we have concluded the second milestone.</p>

<hr>

<h3><a href="https://freshbsd.org/news/2021/02/28" rel="nofollow">FreshBSD 2021</a></h3>

<p>6 weeks ago I created a branch for a significant rework of FreshBSD. Nearly 300 commits later, and just a week shy of our 15th anniversary, the result is what you’re looking at now. I hope you like it.</p>

<hr>

<h3><a href="https://github.com/omar-polo/gmid/" rel="nofollow">gmid</a> is a <a href="https://gemini.circumlunar.space/" rel="nofollow">gemini</a> server  for unixes.</h3>

<hr>

<h3><a href="https://danschmid.de/en/blog/poudriere-guide" rel="nofollow">Danschmid’s Poudriere Guide now in english</a></h3>

<p>The ports system is one of FreeBSD&#39;s greatest advantages for users who want flexibility and control over their software. It enables administrators to easily create and manage source-based installations using a system that is robust and predictable.</p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>
</blockquote>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Tom Jones.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>396: License to thrill</title>
  <link>https://www.bsdnow.tv/396</link>
  <guid isPermaLink="false">db1ced31-e2bc-41f2-baca-041c750229f4</guid>
  <pubDate>Thu, 01 Apr 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/db1ced31-e2bc-41f2-baca-041c750229f4.mp3" length="30506976" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Description: FreeBSD Network Troubleshooting, The State of FreeBSD, dhcpleased, bhyve for Calamares Development, EFS automount and ebsnvme-id, Old Usenix pictures, and more.</itunes:subtitle>
  <itunes:duration>53:27</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Network Troubleshooting, The State of FreeBSD, dhcpleased, bhyve for Calamares Development, EFS automount and ebsnvme-id, Old Usenix pictures, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
FreeBSD Network Troubleshooting (https://klarasystems.com/articles/freebsd-network-troubleshooting-understanding-network-performance/)
FreeBSD has a full set of debugging features, and the network stack is able to report a ton of information. So much that it can be hard to figure out what is relevant and what is not.
The State of FreeBSD (https://www.theregister.com/2021/03/10/the_state_of_freebsd/)
License to thrill: Ahead of v13.0, the FreeBSD team talks about Linux and the completed toolchain project that changes everything
News Roundup
dhcpleased(8) - DHCP client daemon (http://undeadly.org/cgi?action=article;sid=20210227232424)
With the following commit, Florian Obser (florian@) imported dhcpleased(8), DHCP daemon to acquire IPv4 address leases from servers, plus dhcpleasectl(8), a utility to control the daemon:
bhyve for Calamares Development (https://euroquis.nl//freebsd/2021/03/05/bhyve.html)
bhyve (pronounced “bee hive”) is a hypervisor for BSD systems (and Illumos / openSolaris). It is geared towards server workloads, but does support desktop-oriented operation as well. I spent some time wayyyy back in November wrestling with it in order to replace VirtualBox for Calamares testing on FreeBSD. The “golden hint” as far as I’m concerned came from Karen Bruner and now I have a functioning Calamares test-ground that is more useful than before.
“Calamares is a free and open-source independent and distro-agnostic system installer for Linux distributions.“
Some new FreeBSD/EC2 features: EFS automount and ebsnvme-id (https://www.daemonology.net/blog/2020-05-31-Some-new-FreeBSD-EC2-features.html)
As my regular readers will be aware, I've been working on and gradually improving FreeBSD/EC2 for many years. Recently I've added two new features, which are available in the weekly HEAD and 12-STABLE snapshots and will appear in releases starting from 12.2-RELEASE.
Old Usenix pictures (http://lists.nycbug.org/pipermail/talk/2021-February/018304.html)
Beastie Bits
https://2021.eurobsdcon.org/ (CFP is open until May 26th, 2021)
EuroBSDcon is the European technical conference for users and developers of BSD-based systems. The conference is scheduled to take place September 16-19 2021 in Vienna, Austria or as an all-online event if COVID-19 developments dictate. The tutorials will be held on Thursday and Friday to registered participants and the talks are presented to conference attendees on Saturday and Sunday.
The Call for Talk and Presentation proposals period will close on May 26th, 2021.  Prospective speakers will be notified of acceptance or otherwise by June 1st, 2021.
https://campgnd.com/ (CFP is open until 2021-04-15)
campgndd will be held May 28th, 29th and 30th 2021, from wherever you happen to be.
We're looking for submissions on anything you're enthusiastic and excited about. If you enjoy it, the odds are we will too! You don't need to be an expert to propose anything.
Some example of things we are looking for are:
    Talks
    Walkthroughs
    Music
From the Desk of Michael Lucas…
```
New Release: Only Footnotes
I’ve lost count of the number of people who have told me that they purchase my books only for the footnotes. That’s okay. I don’t care why people buy my books, only that they do buy them. Nevertheless, I am a businessman living under capitalism and feel compelled to respond to my market.
Allow me to present my latest release: Only Footnotes, a handsome hardcover-only compilation of decades of footnotes. From the back cover:
Only Footnotes. Because that’s why you read his books.
Academics hate footnotes. Michael W Lucas loves them. What he does with them wouldn’t pass academic muster, but that doesn’t mean the reader should skip them. The footnotes are the best part! Why not read only the footnotes, and skip all that other junk?
After literal minutes of effort, Only Footnotes collects every single footnote from all of Lucas’ books to date.* Recycle those cumbersome treatises stuffed with irrelevant facts! No more flipping through pages and pages of actual technical knowledge looking for the offhand movie reference or half-formed joke. This slender, elegant volume contains everything the man ever passed off as his dubious, malformed “wisdom.”
Smart books have footnotes. Smarter books are only footnotes.
*plus additional annotations from the author. Because sometimes even a footnote needs a footnote.
With interior illustrations by OpenBSD’s akoshibe, this distinguished tome would make fine inspirational reading for a system administrator, network engineer, or anyone sentenced to a life in information technology. Available at all fine bookstores, and many mediocre ones!
```
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
 Special Guest: Tom Jones.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, network, troubleshooting, dhcpleased, bhyve, calamares, efs, automount, ebsnvme-id, nvme, usenix, old pictures, book</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Network Troubleshooting, The State of FreeBSD, dhcpleased, bhyve for Calamares Development, EFS automount and ebsnvme-id, Old Usenix pictures, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-network-troubleshooting-understanding-network-performance/" rel="nofollow">FreeBSD Network Troubleshooting</a></h3>

<blockquote>
<p>FreeBSD has a full set of debugging features, and the network stack is able to report a ton of information. So much that it can be hard to figure out what is relevant and what is not.</p>

<hr>

<h3><a href="https://www.theregister.com/2021/03/10/the_state_of_freebsd/" rel="nofollow">The State of FreeBSD</a></h3>

<p>License to thrill: Ahead of v13.0, the FreeBSD team talks about Linux and the completed toolchain project that changes everything</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20210227232424" rel="nofollow">dhcpleased(8) - DHCP client daemon</a></h3>

<blockquote>
<p>With the following commit, Florian Obser (florian@) imported dhcpleased(8), DHCP daemon to acquire IPv4 address leases from servers, plus dhcpleasectl(8), a utility to control the daemon:</p>

<hr>

<h3><a href="https://euroquis.nl//freebsd/2021/03/05/bhyve.html" rel="nofollow">bhyve for Calamares Development</a></h3>

<p>bhyve (pronounced “bee hive”) is a hypervisor for BSD systems (and Illumos / openSolaris). It is geared towards server workloads, but does support desktop-oriented operation as well. I spent some time wayyyy back in November wrestling with it in order to replace VirtualBox for Calamares testing on FreeBSD. The “golden hint” as far as I’m concerned came from Karen Bruner and now I have a functioning Calamares test-ground that is more useful than before.<br>
“Calamares is a free and open-source independent and distro-agnostic system installer for Linux distributions.“</p>

<hr>

<h3><a href="https://www.daemonology.net/blog/2020-05-31-Some-new-FreeBSD-EC2-features.html" rel="nofollow">Some new FreeBSD/EC2 features: EFS automount and ebsnvme-id</a></h3>

<p>As my regular readers will be aware, I&#39;ve been working on and gradually improving FreeBSD/EC2 for many years. Recently I&#39;ve added two new features, which are available in the weekly HEAD and 12-STABLE snapshots and will appear in releases starting from 12.2-RELEASE.</p>

<hr>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2021-February/018304.html" rel="nofollow">Old Usenix pictures</a></h3>

<hr>

<h2>Beastie Bits</h2>

<h3>[<a href="https://2021.eurobsdcon.org/%5D(CFP" rel="nofollow">https://2021.eurobsdcon.org/](CFP</a> is open until May 26th, 2021)</h3>

<p>EuroBSDcon is the European technical conference for users and developers of BSD-based systems. The conference is scheduled to take place September 16-19 2021 in Vienna, Austria or as an all-online event if COVID-19 developments dictate. The tutorials will be held on Thursday and Friday to registered participants and the talks are presented to conference attendees on Saturday and Sunday.<br>
The Call for Talk and Presentation proposals period will close on May 26th, 2021.  Prospective speakers will be notified of acceptance or otherwise by June 1st, 2021.</p>

<hr>

<h3>[<a href="https://campgnd.com/%5D(CFP" rel="nofollow">https://campgnd.com/](CFP</a> is open until 2021-04-15)</h3>

<p>campgndd will be held May 28th, 29th and 30th 2021, from wherever you happen to be.<br>
We&#39;re looking for submissions on anything you&#39;re enthusiastic and excited about. If you enjoy it, the odds are we will too! You don&#39;t need to be an expert to propose anything.<br>
Some example of things we are looking for are:<br>
    Talks<br>
    Walkthroughs<br>
    Music</p>

<h3>From the Desk of Michael Lucas…</h3>

<pre><code>New Release: Only Footnotes
I’ve lost count of the number of people who have told me that they purchase my books only for the footnotes. That’s okay. I don’t care why people buy my books, only that they do buy them. Nevertheless, I am a businessman living under capitalism and feel compelled to respond to my market.
Allow me to present my latest release: Only Footnotes, a handsome hardcover-only compilation of decades of footnotes. From the back cover:
-----
Only Footnotes. Because that’s why you read his books.
Academics hate footnotes. Michael W Lucas loves them. What he does with them wouldn’t pass academic muster, but that doesn’t mean the reader should skip them. The footnotes are the best part! Why not read only the footnotes, and skip all that other junk?
After literal minutes of effort, Only Footnotes collects every single footnote from all of Lucas’ books to date.* Recycle those cumbersome treatises stuffed with irrelevant facts! No more flipping through pages and pages of actual technical knowledge looking for the offhand movie reference or half-formed joke. This slender, elegant volume contains everything the man ever passed off as his dubious, malformed “wisdom.”
Smart books have footnotes. Smarter books are only footnotes.
*plus additional annotations from the author. Because sometimes even a footnote needs a footnote.
----
With interior illustrations by OpenBSD’s akoshibe, this distinguished tome would make fine inspirational reading for a system administrator, network engineer, or anyone sentenced to a life in information technology. Available at all fine bookstores, and many mediocre ones!
</code></pre>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>
</blockquote><p>Special Guest: Tom Jones.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Network Troubleshooting, The State of FreeBSD, dhcpleased, bhyve for Calamares Development, EFS automount and ebsnvme-id, Old Usenix pictures, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/freebsd-network-troubleshooting-understanding-network-performance/" rel="nofollow">FreeBSD Network Troubleshooting</a></h3>

<blockquote>
<p>FreeBSD has a full set of debugging features, and the network stack is able to report a ton of information. So much that it can be hard to figure out what is relevant and what is not.</p>

<hr>

<h3><a href="https://www.theregister.com/2021/03/10/the_state_of_freebsd/" rel="nofollow">The State of FreeBSD</a></h3>

<p>License to thrill: Ahead of v13.0, the FreeBSD team talks about Linux and the completed toolchain project that changes everything</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20210227232424" rel="nofollow">dhcpleased(8) - DHCP client daemon</a></h3>

<blockquote>
<p>With the following commit, Florian Obser (florian@) imported dhcpleased(8), DHCP daemon to acquire IPv4 address leases from servers, plus dhcpleasectl(8), a utility to control the daemon:</p>

<hr>

<h3><a href="https://euroquis.nl//freebsd/2021/03/05/bhyve.html" rel="nofollow">bhyve for Calamares Development</a></h3>

<p>bhyve (pronounced “bee hive”) is a hypervisor for BSD systems (and Illumos / openSolaris). It is geared towards server workloads, but does support desktop-oriented operation as well. I spent some time wayyyy back in November wrestling with it in order to replace VirtualBox for Calamares testing on FreeBSD. The “golden hint” as far as I’m concerned came from Karen Bruner and now I have a functioning Calamares test-ground that is more useful than before.<br>
“Calamares is a free and open-source independent and distro-agnostic system installer for Linux distributions.“</p>

<hr>

<h3><a href="https://www.daemonology.net/blog/2020-05-31-Some-new-FreeBSD-EC2-features.html" rel="nofollow">Some new FreeBSD/EC2 features: EFS automount and ebsnvme-id</a></h3>

<p>As my regular readers will be aware, I&#39;ve been working on and gradually improving FreeBSD/EC2 for many years. Recently I&#39;ve added two new features, which are available in the weekly HEAD and 12-STABLE snapshots and will appear in releases starting from 12.2-RELEASE.</p>

<hr>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2021-February/018304.html" rel="nofollow">Old Usenix pictures</a></h3>

<hr>

<h2>Beastie Bits</h2>

<h3>[<a href="https://2021.eurobsdcon.org/%5D(CFP" rel="nofollow">https://2021.eurobsdcon.org/](CFP</a> is open until May 26th, 2021)</h3>

<p>EuroBSDcon is the European technical conference for users and developers of BSD-based systems. The conference is scheduled to take place September 16-19 2021 in Vienna, Austria or as an all-online event if COVID-19 developments dictate. The tutorials will be held on Thursday and Friday to registered participants and the talks are presented to conference attendees on Saturday and Sunday.<br>
The Call for Talk and Presentation proposals period will close on May 26th, 2021.  Prospective speakers will be notified of acceptance or otherwise by June 1st, 2021.</p>

<hr>

<h3>[<a href="https://campgnd.com/%5D(CFP" rel="nofollow">https://campgnd.com/](CFP</a> is open until 2021-04-15)</h3>

<p>campgndd will be held May 28th, 29th and 30th 2021, from wherever you happen to be.<br>
We&#39;re looking for submissions on anything you&#39;re enthusiastic and excited about. If you enjoy it, the odds are we will too! You don&#39;t need to be an expert to propose anything.<br>
Some example of things we are looking for are:<br>
    Talks<br>
    Walkthroughs<br>
    Music</p>

<h3>From the Desk of Michael Lucas…</h3>

<pre><code>New Release: Only Footnotes
I’ve lost count of the number of people who have told me that they purchase my books only for the footnotes. That’s okay. I don’t care why people buy my books, only that they do buy them. Nevertheless, I am a businessman living under capitalism and feel compelled to respond to my market.
Allow me to present my latest release: Only Footnotes, a handsome hardcover-only compilation of decades of footnotes. From the back cover:
-----
Only Footnotes. Because that’s why you read his books.
Academics hate footnotes. Michael W Lucas loves them. What he does with them wouldn’t pass academic muster, but that doesn’t mean the reader should skip them. The footnotes are the best part! Why not read only the footnotes, and skip all that other junk?
After literal minutes of effort, Only Footnotes collects every single footnote from all of Lucas’ books to date.* Recycle those cumbersome treatises stuffed with irrelevant facts! No more flipping through pages and pages of actual technical knowledge looking for the offhand movie reference or half-formed joke. This slender, elegant volume contains everything the man ever passed off as his dubious, malformed “wisdom.”
Smart books have footnotes. Smarter books are only footnotes.
*plus additional annotations from the author. Because sometimes even a footnote needs a footnote.
----
With interior illustrations by OpenBSD’s akoshibe, this distinguished tome would make fine inspirational reading for a system administrator, network engineer, or anyone sentenced to a life in information technology. Available at all fine bookstores, and many mediocre ones!
</code></pre>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>
</blockquote><p>Special Guest: Tom Jones.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>395: Tracing ARM’s history</title>
  <link>https://www.bsdnow.tv/395</link>
  <guid isPermaLink="false">9e4b924f-7f9c-49b4-81b7-b28ade7904b3</guid>
  <pubDate>Thu, 25 Mar 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9e4b924f-7f9c-49b4-81b7-b28ade7904b3.mp3" length="23944248" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Tracing the History of ARM and FreeBSD, Make ‘less’ more friendly, NomadBSD 1.4 Release, Create an Ubuntu Linux jail on FreeBSD 12.2, OPNsense 21.1.2 released, Midnight BSD and BastilleBSD, and more.</itunes:subtitle>
  <itunes:duration>37:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Tracing the History of ARM and FreeBSD, Make ‘less’ more friendly, NomadBSD 1.4 Release, Create an Ubuntu Linux jail on FreeBSD 12.2, OPNsense 21.1.2 released, Midnight BSD and BastilleBSD, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Tracing the History of ARM and FreeBSD (https://klarasystems.com/articles/tracing-the-history-of-arm-and-freebsd/)
When we think of computers, we generally think of laptops and desktops. Each one of these systems is powered by an Intel or AMD chip based on the x86 architecture. It might feel like you spend all day interacting with these kinds of systems, but you would be wrong.
Unix Tip: Make ‘less’ more friendly (https://ascending.wordpress.com/2011/02/11/unix-tip-make-less-more-friendly/)
You probably know about less: it is a standard tool that allows scrolling up and down in documents that do not fit on a single screen. Less has a very handy feature, which can be turned on by invoking it with the -i flag. This causes less to ignore case when searching. For example, ‘udf’ will find ‘udf’, ‘UDF’, ‘UdF’, and any other combination of upper-case and lower-case. If you’re used to searching in a web browser, this is probably what you want. But less is even more clever than that. If your search pattern contains upper-case letters, the ignore-case feature will be disabled. So if you’re looking for ‘QXml’, you will not be bothered by matches for the lower-case ‘qxml’. (This is equivalent to ignorecase + smartcase in vim.)
News Roundup
NomadBSD 1.4 Release (https://www.itsfoss.net/nomadbsd-1-4-release/)
Version 1.4 of NomadBSD, a persistent live system for USB flash drives based on FreeBSD and featuring a graphical user interface built around Openbox, has been released: “We are pleased to present the release of NomadBSD 1.4.
Create an Ubuntu Linux jail on FreeBSD 12.2 (https://hackacad.net/post/2021-01-23-create-a-ubuntu-linux-jail-on-freebsd/)
OPNsense 21.1.2 released (https://opnsense.org/opnsense-21-1-2-released/)
Work has so far been focused on the firmware update process to ensure its safety around edge cases and recovery methods for the worst case. To that end 21.1.3 will likely receive the full revamp including API and GUI changes for a swift transition after thorough testing of the changes now available in the development package of this release.
Midnight BSD and BastilleBSD (https://www.justjournal.com/users/mbsd/entry/33869)
We recently added a new port, mports/sysutils/bastille that allows you to manage containers. This is a port of a project that originally targetted FreeBSD, but also works on HardenedBSD. 
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Brad - monitoring with Grafana (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Brad%20-%20monitoring%20with%20Grafana)
Dennis - a few questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Dennis%20-%20a%20few%20questions)
Paul - FreeBSD 13 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Paul%20-%20FreeBSD%2013)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, arm, tracing, nomadbsd, Ubuntu jail, Linux jail, opnsense, midnightbsd, bastillebsd </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Tracing the History of ARM and FreeBSD, Make ‘less’ more friendly, NomadBSD 1.4 Release, Create an Ubuntu Linux jail on FreeBSD 12.2, OPNsense 21.1.2 released, Midnight BSD and BastilleBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/tracing-the-history-of-arm-and-freebsd/" rel="nofollow">Tracing the History of ARM and FreeBSD</a></h3>

<blockquote>
<p>When we think of computers, we generally think of laptops and desktops. Each one of these systems is powered by an Intel or AMD chip based on the x86 architecture. It might feel like you spend all day interacting with these kinds of systems, but you would be wrong.</p>

<hr>

<h3><a href="https://ascending.wordpress.com/2011/02/11/unix-tip-make-less-more-friendly/" rel="nofollow">Unix Tip: Make ‘less’ more friendly</a></h3>

<p>You probably know about less: it is a standard tool that allows scrolling up and down in documents that do not fit on a single screen. Less has a very handy feature, which can be turned on by invoking it with the -i flag. This causes less to ignore case when searching. For example, ‘udf’ will find ‘udf’, ‘UDF’, ‘UdF’, and any other combination of upper-case and lower-case. If you’re used to searching in a web browser, this is probably what you want. But less is even more clever than that. If your search pattern contains upper-case letters, the ignore-case feature will be disabled. So if you’re looking for ‘QXml’, you will not be bothered by matches for the lower-case ‘qxml’. (This is equivalent to ignorecase + smartcase in vim.)</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.itsfoss.net/nomadbsd-1-4-release/" rel="nofollow">NomadBSD 1.4 Release</a></h3>

<blockquote>
<p>Version 1.4 of NomadBSD, a persistent live system for USB flash drives based on FreeBSD and featuring a graphical user interface built around Openbox, has been released: “We are pleased to present the release of NomadBSD 1.4.</p>

<hr>

<h3><a href="https://hackacad.net/post/2021-01-23-create-a-ubuntu-linux-jail-on-freebsd/" rel="nofollow">Create an Ubuntu Linux jail on FreeBSD 12.2</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-21-1-2-released/" rel="nofollow">OPNsense 21.1.2 released</a></h3>

<p>Work has so far been focused on the firmware update process to ensure its safety around edge cases and recovery methods for the worst case. To that end 21.1.3 will likely receive the full revamp including API and GUI changes for a swift transition after thorough testing of the changes now available in the development package of this release.</p>

<hr>

<h3><a href="https://www.justjournal.com/users/mbsd/entry/33869" rel="nofollow">Midnight BSD and BastilleBSD</a></h3>

<p>We recently added a new port, mports/sysutils/bastille that allows you to manage containers. This is a port of a project that originally targetted FreeBSD, but also works on HardenedBSD. </p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Brad%20-%20monitoring%20with%20Grafana" rel="nofollow">Brad - monitoring with Grafana</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Dennis%20-%20a%20few%20questions" rel="nofollow">Dennis - a few questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Paul%20-%20FreeBSD%2013" rel="nofollow">Paul - FreeBSD 13</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Tracing the History of ARM and FreeBSD, Make ‘less’ more friendly, NomadBSD 1.4 Release, Create an Ubuntu Linux jail on FreeBSD 12.2, OPNsense 21.1.2 released, Midnight BSD and BastilleBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/tracing-the-history-of-arm-and-freebsd/" rel="nofollow">Tracing the History of ARM and FreeBSD</a></h3>

<blockquote>
<p>When we think of computers, we generally think of laptops and desktops. Each one of these systems is powered by an Intel or AMD chip based on the x86 architecture. It might feel like you spend all day interacting with these kinds of systems, but you would be wrong.</p>

<hr>

<h3><a href="https://ascending.wordpress.com/2011/02/11/unix-tip-make-less-more-friendly/" rel="nofollow">Unix Tip: Make ‘less’ more friendly</a></h3>

<p>You probably know about less: it is a standard tool that allows scrolling up and down in documents that do not fit on a single screen. Less has a very handy feature, which can be turned on by invoking it with the -i flag. This causes less to ignore case when searching. For example, ‘udf’ will find ‘udf’, ‘UDF’, ‘UdF’, and any other combination of upper-case and lower-case. If you’re used to searching in a web browser, this is probably what you want. But less is even more clever than that. If your search pattern contains upper-case letters, the ignore-case feature will be disabled. So if you’re looking for ‘QXml’, you will not be bothered by matches for the lower-case ‘qxml’. (This is equivalent to ignorecase + smartcase in vim.)</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.itsfoss.net/nomadbsd-1-4-release/" rel="nofollow">NomadBSD 1.4 Release</a></h3>

<blockquote>
<p>Version 1.4 of NomadBSD, a persistent live system for USB flash drives based on FreeBSD and featuring a graphical user interface built around Openbox, has been released: “We are pleased to present the release of NomadBSD 1.4.</p>

<hr>

<h3><a href="https://hackacad.net/post/2021-01-23-create-a-ubuntu-linux-jail-on-freebsd/" rel="nofollow">Create an Ubuntu Linux jail on FreeBSD 12.2</a></h3>

<hr>

<h3><a href="https://opnsense.org/opnsense-21-1-2-released/" rel="nofollow">OPNsense 21.1.2 released</a></h3>

<p>Work has so far been focused on the firmware update process to ensure its safety around edge cases and recovery methods for the worst case. To that end 21.1.3 will likely receive the full revamp including API and GUI changes for a swift transition after thorough testing of the changes now available in the development package of this release.</p>

<hr>

<h3><a href="https://www.justjournal.com/users/mbsd/entry/33869" rel="nofollow">Midnight BSD and BastilleBSD</a></h3>

<p>We recently added a new port, mports/sysutils/bastille that allows you to manage containers. This is a port of a project that originally targetted FreeBSD, but also works on HardenedBSD. </p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Brad%20-%20monitoring%20with%20Grafana" rel="nofollow">Brad - monitoring with Grafana</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Dennis%20-%20a%20few%20questions" rel="nofollow">Dennis - a few questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Paul%20-%20FreeBSD%2013" rel="nofollow">Paul - FreeBSD 13</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>394: FreeBSD on Mars</title>
  <link>https://www.bsdnow.tv/394</link>
  <guid isPermaLink="false">65a9a52b-9058-4d08-8c38-8a1bffad6c86</guid>
  <pubDate>Thu, 18 Mar 2021 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/65a9a52b-9058-4d08-8c38-8a1bffad6c86.mp3" length="45911352" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Onboard Scheduler for the Mars 2020 Rover, Practical Guide to Storage of Large Amounts of Microscopy Data, OpenBSD guest with bhyve - OmniOS, NextCloud on OpenBSD, MySQL Transactions - the physical side, TrueNAS 12.0-U2.1 is released, HardenedBSD 2021 State of the Hardened Union, and more</itunes:subtitle>
  <itunes:duration>43:31</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Onboard Scheduler for the Mars 2020 Rover, Practical Guide to Storage of Large Amounts of Microscopy Data, OpenBSD guest with bhyve - OmniOS, NextCloud on OpenBSD, MySQL Transactions - the physical side, TrueNAS 12.0-U2.1 is released, HardenedBSD 2021 State of the Hardened Union, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Prototyping an Onboard Scheduler for the Mars 2020 Rover (https://ai.jpl.nasa.gov/public/documents/papers/rabideau_iwpss2017_prototyping.pdf)
The mars rover runs VxWorks, which is based on BSD, and uses the FreeBSD networking stack. While there has been a lot of type about the little helicopter that was inside the rover running Linux, the rover itself runs BSD.
***
### Practical Guide to Storage of Large Amounts of Microscopy Data (https://www.cambridge.org/core/journals/microscopy-today/article/practical-guide-to-storage-of-large-amounts-of-microscopy-data/D3CE39447BFF5BBF9B3ED8A0C35C6F36)
&amp;gt; Biological imaging tools continue to increase in speed, scale, and resolution, often resulting in the collection of gigabytes or even terabytes of data in a single experiment. In comparison, the ability of research laboratories to store and manage this data is lagging greatly. This leads to limits on the collection of valuable data and slows data analysis and research progress. Here we review common ways researchers store data and outline the drawbacks and benefits of each method. We also offer a blueprint and budget estimation for a currently deployed data server used to store large datasets from zebrafish brain activity experiments using light-sheet microscopy. Data storage strategy should be carefully considered and different options compared when designing imaging experiments.
***
## News Roundup
### OpenBSD guest with bhyve - OmniOS (https://www.pbdigital.org/omniosce/bhyve/openbsd/2020/06/08/bhyve-zones-omnios.html)
&amp;gt; Today I will be creating a OpenBSD guest via bhyve on OmniOS. I will also be adding a Pass Through Ethernet Controller so I can have a multi-homed guest that will serve as a firewall/router.
&amp;gt; This post will cover setting up bhyve on OmniOS, so it will also be a good introduction to bhyve. As well, I look into OpenBSD’s uEFI boot loader so if you have had trouble with this, then you are in the right place.
***
### NextCloud on OpenBSD (https://h3artbl33d.nl/blog/nextcloud-on-openbsd)
&amp;gt; NextCloud and OpenBSD are complimentary to one another. NextCloud is an awesome, secure and private alternative for propietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.
MySQL Transactions - the physical side (https://blog.koehntopp.info/2020/07/27/mysql-transactions.html)
So you talk to a database, doing transactions. What happens actually, behind the scenes? Let’s have a look.
TrueNAS 12.0-U2.1 is released (https://www.truenas.com/docs/hub/intro/release-notes/12.0u2.1/)
HardenedBSD 2021 State of the Hardened Union - NYCBUG - 2021-04-07 (https://www.nycbug.org/index?action=view&amp;amp;id=10682)
Beastie Bits
FreeBSD Journal: Case Studies (https://freebsdfoundation.org/our-work/journal/)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Al - BusyNAS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Al%20-%20BusyNAS)
Jeff - ZFS and NFS on FreeBSD (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Jeff%20-%20ZFS%20and%20NFS%20on%20FreeBSD)
Michael - remote unlock for encrypted systems (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Michael%20-%20remote%20unlock%20for%20encrypted%20systems)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, mars, rover, vxworks, network stack, microscopy, large data, bhyve, guest, nextcloud, mysql, transaction, truenas, state of the union</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Onboard Scheduler for the Mars 2020 Rover, Practical Guide to Storage of Large Amounts of Microscopy Data, OpenBSD guest with bhyve - OmniOS, NextCloud on OpenBSD, MySQL Transactions - the physical side, TrueNAS 12.0-U2.1 is released, HardenedBSD 2021 State of the Hardened Union, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://ai.jpl.nasa.gov/public/documents/papers/rabideau_iwpss2017_prototyping.pdf" rel="nofollow">Prototyping an Onboard Scheduler for the Mars 2020 Rover</a></h3>

<ul>
<li>The mars rover runs VxWorks, which is based on BSD, and uses the FreeBSD networking stack. While there has been a lot of type about the little helicopter that was inside the rover running Linux, the rover itself runs BSD.
***
### <a href="https://www.cambridge.org/core/journals/microscopy-today/article/practical-guide-to-storage-of-large-amounts-of-microscopy-data/D3CE39447BFF5BBF9B3ED8A0C35C6F36" rel="nofollow">Practical Guide to Storage of Large Amounts of Microscopy Data</a>
&gt; Biological imaging tools continue to increase in speed, scale, and resolution, often resulting in the collection of gigabytes or even terabytes of data in a single experiment. In comparison, the ability of research laboratories to store and manage this data is lagging greatly. This leads to limits on the collection of valuable data and slows data analysis and research progress. Here we review common ways researchers store data and outline the drawbacks and benefits of each method. We also offer a blueprint and budget estimation for a currently deployed data server used to store large datasets from zebrafish brain activity experiments using light-sheet microscopy. Data storage strategy should be carefully considered and different options compared when designing imaging experiments.
***
## News Roundup
### <a href="https://www.pbdigital.org/omniosce/bhyve/openbsd/2020/06/08/bhyve-zones-omnios.html" rel="nofollow">OpenBSD guest with bhyve - OmniOS</a>
&gt; Today I will be creating a OpenBSD guest via bhyve on OmniOS. I will also be adding a Pass Through Ethernet Controller so I can have a multi-homed guest that will serve as a firewall/router.
&gt; This post will cover setting up bhyve on OmniOS, so it will also be a good introduction to bhyve. As well, I look into OpenBSD’s uEFI boot loader so if you have had trouble with this, then you are in the right place.
***
### <a href="https://h3artbl33d.nl/blog/nextcloud-on-openbsd" rel="nofollow">NextCloud on OpenBSD</a>
&gt; NextCloud and OpenBSD are complimentary to one another. NextCloud is an awesome, secure and private alternative for propietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.</li>
</ul>

<hr>

<h3><a href="https://blog.koehntopp.info/2020/07/27/mysql-transactions.html" rel="nofollow">MySQL Transactions - the physical side</a></h3>

<blockquote>
<p>So you talk to a database, doing transactions. What happens actually, behind the scenes? Let’s have a look.</p>

<hr>

<h3><a href="https://www.truenas.com/docs/hub/intro/release-notes/12.0u2.1/" rel="nofollow">TrueNAS 12.0-U2.1 is released</a></h3>

<hr>

<h3><a href="https://www.nycbug.org/index?action=view&id=10682" rel="nofollow">HardenedBSD 2021 State of the Hardened Union - NYCBUG - 2021-04-07</a></h3>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://freebsdfoundation.org/our-work/journal/" rel="nofollow">FreeBSD Journal: Case Studies</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Al%20-%20BusyNAS" rel="nofollow">Al - BusyNAS</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Jeff%20-%20ZFS%20and%20NFS%20on%20FreeBSD" rel="nofollow">Jeff - ZFS and NFS on FreeBSD</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Michael%20-%20remote%20unlock%20for%20encrypted%20systems" rel="nofollow">Michael - remote unlock for encrypted systems</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Onboard Scheduler for the Mars 2020 Rover, Practical Guide to Storage of Large Amounts of Microscopy Data, OpenBSD guest with bhyve - OmniOS, NextCloud on OpenBSD, MySQL Transactions - the physical side, TrueNAS 12.0-U2.1 is released, HardenedBSD 2021 State of the Hardened Union, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://ai.jpl.nasa.gov/public/documents/papers/rabideau_iwpss2017_prototyping.pdf" rel="nofollow">Prototyping an Onboard Scheduler for the Mars 2020 Rover</a></h3>

<ul>
<li>The mars rover runs VxWorks, which is based on BSD, and uses the FreeBSD networking stack. While there has been a lot of type about the little helicopter that was inside the rover running Linux, the rover itself runs BSD.
***
### <a href="https://www.cambridge.org/core/journals/microscopy-today/article/practical-guide-to-storage-of-large-amounts-of-microscopy-data/D3CE39447BFF5BBF9B3ED8A0C35C6F36" rel="nofollow">Practical Guide to Storage of Large Amounts of Microscopy Data</a>
&gt; Biological imaging tools continue to increase in speed, scale, and resolution, often resulting in the collection of gigabytes or even terabytes of data in a single experiment. In comparison, the ability of research laboratories to store and manage this data is lagging greatly. This leads to limits on the collection of valuable data and slows data analysis and research progress. Here we review common ways researchers store data and outline the drawbacks and benefits of each method. We also offer a blueprint and budget estimation for a currently deployed data server used to store large datasets from zebrafish brain activity experiments using light-sheet microscopy. Data storage strategy should be carefully considered and different options compared when designing imaging experiments.
***
## News Roundup
### <a href="https://www.pbdigital.org/omniosce/bhyve/openbsd/2020/06/08/bhyve-zones-omnios.html" rel="nofollow">OpenBSD guest with bhyve - OmniOS</a>
&gt; Today I will be creating a OpenBSD guest via bhyve on OmniOS. I will also be adding a Pass Through Ethernet Controller so I can have a multi-homed guest that will serve as a firewall/router.
&gt; This post will cover setting up bhyve on OmniOS, so it will also be a good introduction to bhyve. As well, I look into OpenBSD’s uEFI boot loader so if you have had trouble with this, then you are in the right place.
***
### <a href="https://h3artbl33d.nl/blog/nextcloud-on-openbsd" rel="nofollow">NextCloud on OpenBSD</a>
&gt; NextCloud and OpenBSD are complimentary to one another. NextCloud is an awesome, secure and private alternative for propietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.</li>
</ul>

<hr>

<h3><a href="https://blog.koehntopp.info/2020/07/27/mysql-transactions.html" rel="nofollow">MySQL Transactions - the physical side</a></h3>

<blockquote>
<p>So you talk to a database, doing transactions. What happens actually, behind the scenes? Let’s have a look.</p>

<hr>

<h3><a href="https://www.truenas.com/docs/hub/intro/release-notes/12.0u2.1/" rel="nofollow">TrueNAS 12.0-U2.1 is released</a></h3>

<hr>

<h3><a href="https://www.nycbug.org/index?action=view&id=10682" rel="nofollow">HardenedBSD 2021 State of the Hardened Union - NYCBUG - 2021-04-07</a></h3>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://freebsdfoundation.org/our-work/journal/" rel="nofollow">FreeBSD Journal: Case Studies</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Al%20-%20BusyNAS" rel="nofollow">Al - BusyNAS</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Jeff%20-%20ZFS%20and%20NFS%20on%20FreeBSD" rel="nofollow">Jeff - ZFS and NFS on FreeBSD</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Michael%20-%20remote%20unlock%20for%20encrypted%20systems" rel="nofollow">Michael - remote unlock for encrypted systems</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>393: ZFS dRAID</title>
  <link>https://www.bsdnow.tv/393</link>
  <guid isPermaLink="false">edab60b8-425f-45a4-9547-73ca2ca7e341</guid>
  <pubDate>Thu, 11 Mar 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/edab60b8-425f-45a4-9547-73ca2ca7e341.mp3" length="50412600" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Lessons learned from a 27 years old UNIX book, Finally dRAID, Setting up a Signal Proxy using FreeBSD, Annotate your PDF files on OpenBSD, Things You Should Do Now, Just: More unixy than Make, and more</itunes:subtitle>
  <itunes:duration>50:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Lessons learned from a 27 years old UNIX book, Finally dRAID, Setting up a Signal Proxy using FreeBSD, Annotate your PDF files on OpenBSD, Things You Should Do Now, Just: More unixy than Make, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Lessons learned from a 27 years old UNIX book (https://www.linux.it/~ema/posts/porsche-book/)
One of the Amazon reviewers of "Sun Performance and Tuning: Java and the Internet" gave it 3/5 stars. While still a nice introduction, the book by Adrian Cockcroft has become dated — claimed Roland in 2003, which believe it or not was 18 years ago...
dRAID, Finally! (https://klarasystems.com/articles/openzfs-draid-finally/)
Admins will often use wide RAID stripes to maximize usable storage given a number of spindles. RAID-Z deployments with large stripe widths, ten or larger, are subject to poor resilver performance for a number of reasons. Resilvering a full vdev means reading from every healthy disk and continuously writing to the new spare. This will saturate the replacement disk with writes while scattering seeks over the rest of the vdev. For 14 wide RAID-Z2 vdevs using 12TB spindles, rebuilds can take weeks. Resilver I/O activity is deprioritized when the system has not been idle for a minimum period. Full zpools get fragmented and require additional I/O’s to recalculate data during reslivering. A pool can degenerate into a never ending cycle of rebuilds or loss of the pool Aka: the Death Spiral.
News Roundup
Setting up a Signal Proxy using FreeBSD (https://www.neelc.org/posts/freebsd-signal-proxy/)
With the events that the private messaging app Signal has been blocked in Iran, Signal has come up with an “proxy” solution akin to Tor’s Bridges, and have given instructions on how to do it.
For people who prefer FreeBSD over Linux like myself, we obviously can’t run Docker, which is what Signal’s instructions focus on.
Fortunately, the Docker image is just a fancy wrapper around nginx, and the configs can be ported to any OS. Here, I’ll show you how to set up a Signal Proxy on FreeBSD.
Annotate your PDF files on OpenBSD (https://www.tumfatig.net/20210126/annotate-your-pdf-files-on-openbsd)
On my journey to leave macOS, I regularly look to mimic some of the features I use. Namely, annotating (or signing) PDF files is a really simple task using Preview. I couldn’t do it on OpenBSD using Zathura, Xpdf etc. But there is a software in the ports that can achieve this: Xournal.
Xournal is “an application for notetaking, sketching, keeping a journal using a stylus“. And now that my touchscreen is calibrated, highlighting can even be done with the fingers :)
Things You Should Do Now (https://secure.phabricator.com/book/phabflavor/article/things_you_should_do_now/)
Describes things you should do now when building software, because the cost to do them increases over time and eventually becomes prohibitive or impossible.
Just: A command runner. More unixy than Make because it does even less. (https://github.com/casey/just/)
I think it's in the do-one-thing-well spirit of Unix, because it's just a command runner, no build system at all. Just has a bunch of nice features:
Can be invoked from any subdirectory
Arguments can be passed from the command line
Static error checking that catches syntax errors and typos
Excellent error messages with source context
The ability to list recipes from the command line
Recipes can be written in any language
Works on Linux, macOS, and Windows
And much more!
Just doesn't replace Make, or any other build system, but it does replace reverse-searching your command history, telling colleagues the weird flags they need to pass to do the thing, and forgetting how to run old projects.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Marc - Confused about Snapshots (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Marc%20-%20Confused%20about%20Snapshots)
Dan’s gist: https://gist.github.com/dlangille/3140e60a816226ed75365ba8af185085
Pete - A Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Pete%20-%20A%20Question)
Rick - ZFS Idea (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Rick%20-%20ZFS%20Idea)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
 Special Guest: Dan Langille.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, lessons, 27 years old book, dRAID, signal, proxy, annotate, PDF, Phabricator, just, make</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Lessons learned from a 27 years old UNIX book, Finally dRAID, Setting up a Signal Proxy using FreeBSD, Annotate your PDF files on OpenBSD, Things You Should Do Now, Just: More unixy than Make, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.linux.it/%7Eema/posts/porsche-book/" rel="nofollow">Lessons learned from a 27 years old UNIX book</a></h3>

<blockquote>
<p>One of the Amazon reviewers of &quot;Sun Performance and Tuning: Java and the Internet&quot; gave it 3/5 stars. While still a nice introduction, the book by Adrian Cockcroft has become dated — claimed Roland in 2003, which believe it or not was 18 years ago...</p>

<hr>

<h3><a href="https://klarasystems.com/articles/openzfs-draid-finally/" rel="nofollow">dRAID, Finally!</a></h3>

<p>Admins will often use wide RAID stripes to maximize usable storage given a number of spindles. RAID-Z deployments with large stripe widths, ten or larger, are subject to poor resilver performance for a number of reasons. Resilvering a full vdev means reading from every healthy disk and continuously writing to the new spare. This will saturate the replacement disk with writes while scattering seeks over the rest of the vdev. For 14 wide RAID-Z2 vdevs using 12TB spindles, rebuilds can take weeks. Resilver I/O activity is deprioritized when the system has not been idle for a minimum period. Full zpools get fragmented and require additional I/O’s to recalculate data during reslivering. A pool can degenerate into a never ending cycle of rebuilds or loss of the pool Aka: the Death Spiral.</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.neelc.org/posts/freebsd-signal-proxy/" rel="nofollow">Setting up a Signal Proxy using FreeBSD</a></h3>

<p>With the events that the private messaging app Signal has been blocked in Iran, Signal has come up with an “proxy” solution akin to Tor’s Bridges, and have given instructions on how to do it.<br>
For people who prefer FreeBSD over Linux like myself, we obviously can’t run Docker, which is what Signal’s instructions focus on.<br>
Fortunately, the Docker image is just a fancy wrapper around nginx, and the configs can be ported to any OS. Here, I’ll show you how to set up a Signal Proxy on FreeBSD.</p>

<hr>
</blockquote>

<h3><a href="https://www.tumfatig.net/20210126/annotate-your-pdf-files-on-openbsd" rel="nofollow">Annotate your PDF files on OpenBSD</a></h3>

<blockquote>
<p>On my journey to leave macOS, I regularly look to mimic some of the features I use. Namely, annotating (or signing) PDF files is a really simple task using Preview. I couldn’t do it on OpenBSD using Zathura, Xpdf etc. But there is a software in the ports that can achieve this: Xournal.<br>
Xournal is “an application for notetaking, sketching, keeping a journal using a stylus“. And now that my touchscreen is calibrated, highlighting can even be done with the fingers :)</p>

<hr>
</blockquote>

<h3><a href="https://secure.phabricator.com/book/phabflavor/article/things_you_should_do_now/" rel="nofollow">Things You Should Do Now</a></h3>

<blockquote>
<p>Describes things you should do now when building software, because the cost to do them increases over time and eventually becomes prohibitive or impossible.</p>

<hr>

<h3><a href="https://github.com/casey/just/" rel="nofollow">Just: A command runner. More unixy than Make because it does even less.</a></h3>

<p>I think it&#39;s in the do-one-thing-well spirit of Unix, because it&#39;s just a command runner, no build system at all. Just has a bunch of nice features:</p>
</blockquote>

<ul>
<li>Can be invoked from any subdirectory</li>
<li>Arguments can be passed from the command line</li>
<li>Static error checking that catches syntax errors and typos</li>
<li>Excellent error messages with source context</li>
<li>The ability to list recipes from the command line</li>
<li>Recipes can be written in any language</li>
<li>Works on Linux, macOS, and Windows</li>
<li>And much more!</li>
</ul>

<blockquote>
<p>Just doesn&#39;t replace Make, or any other build system, but it does replace reverse-searching your command history, telling colleagues the weird flags they need to pass to do the thing, and forgetting how to run old projects.</p>
</blockquote>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Marc%20-%20Confused%20about%20Snapshots" rel="nofollow">Marc - Confused about Snapshots</a>
Dan’s gist: <a href="https://gist.github.com/dlangille/3140e60a816226ed75365ba8af185085" rel="nofollow">https://gist.github.com/dlangille/3140e60a816226ed75365ba8af185085</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Pete%20-%20A%20Question" rel="nofollow">Pete - A Question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Rick%20-%20ZFS%20Idea" rel="nofollow">Rick - ZFS Idea</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Dan Langille.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Lessons learned from a 27 years old UNIX book, Finally dRAID, Setting up a Signal Proxy using FreeBSD, Annotate your PDF files on OpenBSD, Things You Should Do Now, Just: More unixy than Make, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.linux.it/%7Eema/posts/porsche-book/" rel="nofollow">Lessons learned from a 27 years old UNIX book</a></h3>

<blockquote>
<p>One of the Amazon reviewers of &quot;Sun Performance and Tuning: Java and the Internet&quot; gave it 3/5 stars. While still a nice introduction, the book by Adrian Cockcroft has become dated — claimed Roland in 2003, which believe it or not was 18 years ago...</p>

<hr>

<h3><a href="https://klarasystems.com/articles/openzfs-draid-finally/" rel="nofollow">dRAID, Finally!</a></h3>

<p>Admins will often use wide RAID stripes to maximize usable storage given a number of spindles. RAID-Z deployments with large stripe widths, ten or larger, are subject to poor resilver performance for a number of reasons. Resilvering a full vdev means reading from every healthy disk and continuously writing to the new spare. This will saturate the replacement disk with writes while scattering seeks over the rest of the vdev. For 14 wide RAID-Z2 vdevs using 12TB spindles, rebuilds can take weeks. Resilver I/O activity is deprioritized when the system has not been idle for a minimum period. Full zpools get fragmented and require additional I/O’s to recalculate data during reslivering. A pool can degenerate into a never ending cycle of rebuilds or loss of the pool Aka: the Death Spiral.</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.neelc.org/posts/freebsd-signal-proxy/" rel="nofollow">Setting up a Signal Proxy using FreeBSD</a></h3>

<p>With the events that the private messaging app Signal has been blocked in Iran, Signal has come up with an “proxy” solution akin to Tor’s Bridges, and have given instructions on how to do it.<br>
For people who prefer FreeBSD over Linux like myself, we obviously can’t run Docker, which is what Signal’s instructions focus on.<br>
Fortunately, the Docker image is just a fancy wrapper around nginx, and the configs can be ported to any OS. Here, I’ll show you how to set up a Signal Proxy on FreeBSD.</p>

<hr>
</blockquote>

<h3><a href="https://www.tumfatig.net/20210126/annotate-your-pdf-files-on-openbsd" rel="nofollow">Annotate your PDF files on OpenBSD</a></h3>

<blockquote>
<p>On my journey to leave macOS, I regularly look to mimic some of the features I use. Namely, annotating (or signing) PDF files is a really simple task using Preview. I couldn’t do it on OpenBSD using Zathura, Xpdf etc. But there is a software in the ports that can achieve this: Xournal.<br>
Xournal is “an application for notetaking, sketching, keeping a journal using a stylus“. And now that my touchscreen is calibrated, highlighting can even be done with the fingers :)</p>

<hr>
</blockquote>

<h3><a href="https://secure.phabricator.com/book/phabflavor/article/things_you_should_do_now/" rel="nofollow">Things You Should Do Now</a></h3>

<blockquote>
<p>Describes things you should do now when building software, because the cost to do them increases over time and eventually becomes prohibitive or impossible.</p>

<hr>

<h3><a href="https://github.com/casey/just/" rel="nofollow">Just: A command runner. More unixy than Make because it does even less.</a></h3>

<p>I think it&#39;s in the do-one-thing-well spirit of Unix, because it&#39;s just a command runner, no build system at all. Just has a bunch of nice features:</p>
</blockquote>

<ul>
<li>Can be invoked from any subdirectory</li>
<li>Arguments can be passed from the command line</li>
<li>Static error checking that catches syntax errors and typos</li>
<li>Excellent error messages with source context</li>
<li>The ability to list recipes from the command line</li>
<li>Recipes can be written in any language</li>
<li>Works on Linux, macOS, and Windows</li>
<li>And much more!</li>
</ul>

<blockquote>
<p>Just doesn&#39;t replace Make, or any other build system, but it does replace reverse-searching your command history, telling colleagues the weird flags they need to pass to do the thing, and forgetting how to run old projects.</p>
</blockquote>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Marc%20-%20Confused%20about%20Snapshots" rel="nofollow">Marc - Confused about Snapshots</a>
Dan’s gist: <a href="https://gist.github.com/dlangille/3140e60a816226ed75365ba8af185085" rel="nofollow">https://gist.github.com/dlangille/3140e60a816226ed75365ba8af185085</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Pete%20-%20A%20Question" rel="nofollow">Pete - A Question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Rick%20-%20ZFS%20Idea" rel="nofollow">Rick - ZFS Idea</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Dan Langille.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>392: macOS inspired Desktop</title>
  <link>https://www.bsdnow.tv/392</link>
  <guid isPermaLink="false">614ca258-a6e1-4c49-ac79-9e37f3e6057c</guid>
  <pubDate>Thu, 04 Mar 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/614ca258-a6e1-4c49-ac79-9e37f3e6057c.mp3" length="46770312" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 13 BETA Benchmarks, FreeBSD Jails Deep Dive by Klara Systems, FreeBSD Foundation looking for a Senior Arm Kernel Engineer &amp; OSS Project Coordinator, macOS-Inspired BSD Desktop OS by helloSystem, A Trip into FreeBSD and more.</itunes:subtitle>
  <itunes:duration>47:26</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 13 BETA Benchmarks, FreeBSD Jails Deep Dive by Klara Systems, FreeBSD Foundation looking for a Senior Arm Kernel Engineer &amp;amp; OSS Project Coordinator, macOS-Inspired BSD Desktop OS by helloSystem, A Trip into FreeBSD and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
FreeBSD 13 BETA Benchmarks - Performance Is Much Better (https://www.phoronix.com/scan.php?page=article&amp;amp;item=freebsd-13-beta1&amp;amp;num=6)
FreeBSD Jails – Deep Dive into the Beginning of FreeBSD Containers (https://klarasystems.com/articles/freebsd-jails-the-beginning-of-freebsd-containers/)
In recent years, containers and virtualization have become a buzzword in the Linux community, especially with the rise of Docker and Kubernetes. What many people probably don’t realize is that these ideas have been around for a very long time. Today, we will be looking at Jails and how they became part of FreeBSD.
News Roundup
FreeBSD Jobs
The FreeBSD Foundation is looking for a Senior Arm Kernel Engineer (https://www.fossjobs.net/job/10369/senior-arm-kernel-engineer-at-the-freebsd-foundation/)
The FreeBSD Foundation is also looking for an Open Source Project Coordinator. (https://www.fossjobs.net/job/10367/freebsd-open-source-project-coordinator-at-freebsd/)
***
### helloSystem Releases New ISOs For This macOS-Inspired BSD Desktop OS (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=helloSystem-New-12.1-Exp-ISOs)
&amp;gt; The helloSystem motto is being a "desktop system for creators with focus on simplicity, elegance, and usability. Based on FreeBSD. Less, but better!" The desktop utilities are written with PyQt5.
***
### A Trip into FreeBSD (https://christine.website/blog/a-trip-into-freebsd-2021-02-13)
&amp;gt; I normally deal with Linux machines. Linux is what I know and it's what I've been using since I was in college. A friend of mine has been coaxing me into trying out FreeBSD, and I decided to try it out and see what it's like. Here's some details about my experience and what I've learned.
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Beastie Bits
Testing Linux Steam Proton on GhostBSD with BSD linuxulator - NO Audio (https://www.youtube.com/watch?v=H8ihW0m3bRQ)
New Build of DragonFlyBSD 5.8 (http://lists.dragonflybsd.org/pipermail/users/2021-February/381550.html)
Install OpenBSD 6.8 on PINE64 ROCK64 Media Board (https://github.com/krjdev/rock64_openbsd)
FOSDEM BSD Track Videos are up (https://fosdem.org/2021/schedule/track/bsd/)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
 Special Guest: Dan Langille.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, benchmarks, jails, ARM, kernel engineer, project coordinator, open source, job, employment, foundation, 501c3, helloSystem, macOS inspired, desktop</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 13 BETA Benchmarks, FreeBSD Jails Deep Dive by Klara Systems, FreeBSD Foundation looking for a Senior Arm Kernel Engineer &amp; OSS Project Coordinator, macOS-Inspired BSD Desktop OS by helloSystem, A Trip into FreeBSD and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=article&item=freebsd-13-beta1&num=6" rel="nofollow">FreeBSD 13 BETA Benchmarks - Performance Is Much Better</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/freebsd-jails-the-beginning-of-freebsd-containers/" rel="nofollow">FreeBSD Jails – Deep Dive into the Beginning of FreeBSD Containers</a></h3>

<blockquote>
<p>In recent years, containers and virtualization have become a buzzword in the Linux community, especially with the rise of Docker and Kubernetes. What many people probably don’t realize is that these ideas have been around for a very long time. Today, we will be looking at Jails and how they became part of FreeBSD.</p>

<hr>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3>FreeBSD Jobs</h3>

<ul>
<li><a href="https://www.fossjobs.net/job/10369/senior-arm-kernel-engineer-at-the-freebsd-foundation/" rel="nofollow">The FreeBSD Foundation is looking for a Senior Arm Kernel Engineer</a></li>
<li><a href="https://www.fossjobs.net/job/10367/freebsd-open-source-project-coordinator-at-freebsd/" rel="nofollow">The FreeBSD Foundation is also looking for an Open Source Project Coordinator.</a>
***
### <a href="https://www.phoronix.com/scan.php?page=news_item&px=helloSystem-New-12.1-Exp-ISOs" rel="nofollow">helloSystem Releases New ISOs For This macOS-Inspired BSD Desktop OS</a>
&gt; The helloSystem motto is being a &quot;desktop system for creators with focus on simplicity, elegance, and usability. Based on FreeBSD. Less, but better!&quot; The desktop utilities are written with PyQt5.
***
### <a href="https://christine.website/blog/a-trip-into-freebsd-2021-02-13" rel="nofollow">A Trip into FreeBSD</a>
&gt; I normally deal with Linux machines. Linux is what I know and it&#39;s what I&#39;ve been using since I was in college. A friend of mine has been coaxing me into trying out FreeBSD, and I decided to try it out and see what it&#39;s like. Here&#39;s some details about my experience and what I&#39;ve learned.
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=H8ihW0m3bRQ" rel="nofollow">Testing Linux Steam Proton on GhostBSD with BSD linuxulator - NO Audio</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2021-February/381550.html" rel="nofollow">New Build of DragonFlyBSD 5.8</a></li>
<li><a href="https://github.com/krjdev/rock64_openbsd" rel="nofollow">Install OpenBSD 6.8 on PINE64 ROCK64 Media Board</a></li>
<li><a href="https://fosdem.org/2021/schedule/track/bsd/" rel="nofollow">FOSDEM BSD Track Videos are up</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Dan Langille.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 13 BETA Benchmarks, FreeBSD Jails Deep Dive by Klara Systems, FreeBSD Foundation looking for a Senior Arm Kernel Engineer &amp; OSS Project Coordinator, macOS-Inspired BSD Desktop OS by helloSystem, A Trip into FreeBSD and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=article&item=freebsd-13-beta1&num=6" rel="nofollow">FreeBSD 13 BETA Benchmarks - Performance Is Much Better</a></h3>

<hr>

<h3><a href="https://klarasystems.com/articles/freebsd-jails-the-beginning-of-freebsd-containers/" rel="nofollow">FreeBSD Jails – Deep Dive into the Beginning of FreeBSD Containers</a></h3>

<blockquote>
<p>In recent years, containers and virtualization have become a buzzword in the Linux community, especially with the rise of Docker and Kubernetes. What many people probably don’t realize is that these ideas have been around for a very long time. Today, we will be looking at Jails and how they became part of FreeBSD.</p>

<hr>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3>FreeBSD Jobs</h3>

<ul>
<li><a href="https://www.fossjobs.net/job/10369/senior-arm-kernel-engineer-at-the-freebsd-foundation/" rel="nofollow">The FreeBSD Foundation is looking for a Senior Arm Kernel Engineer</a></li>
<li><a href="https://www.fossjobs.net/job/10367/freebsd-open-source-project-coordinator-at-freebsd/" rel="nofollow">The FreeBSD Foundation is also looking for an Open Source Project Coordinator.</a>
***
### <a href="https://www.phoronix.com/scan.php?page=news_item&px=helloSystem-New-12.1-Exp-ISOs" rel="nofollow">helloSystem Releases New ISOs For This macOS-Inspired BSD Desktop OS</a>
&gt; The helloSystem motto is being a &quot;desktop system for creators with focus on simplicity, elegance, and usability. Based on FreeBSD. Less, but better!&quot; The desktop utilities are written with PyQt5.
***
### <a href="https://christine.website/blog/a-trip-into-freebsd-2021-02-13" rel="nofollow">A Trip into FreeBSD</a>
&gt; I normally deal with Linux machines. Linux is what I know and it&#39;s what I&#39;ve been using since I was in college. A friend of mine has been coaxing me into trying out FreeBSD, and I decided to try it out and see what it&#39;s like. Here&#39;s some details about my experience and what I&#39;ve learned.
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=H8ihW0m3bRQ" rel="nofollow">Testing Linux Steam Proton on GhostBSD with BSD linuxulator - NO Audio</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2021-February/381550.html" rel="nofollow">New Build of DragonFlyBSD 5.8</a></li>
<li><a href="https://github.com/krjdev/rock64_openbsd" rel="nofollow">Install OpenBSD 6.8 on PINE64 ROCK64 Media Board</a></li>
<li><a href="https://fosdem.org/2021/schedule/track/bsd/" rel="nofollow">FOSDEM BSD Track Videos are up</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Dan Langille.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>391:  i386 tear shedding</title>
  <link>https://www.bsdnow.tv/391</link>
  <guid isPermaLink="false">3105d37c-fc28-49e0-983d-1ac767b72f76</guid>
  <pubDate>Thu, 25 Feb 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3105d37c-fc28-49e0-983d-1ac767b72f76.mp3" length="39165456" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Follow-up about FreeBSD jail advantages, Install Prometheus, Node Exporter and Grafana, Calibrate your touch-screen on OpenBSD, OPNsense 21.1 Marvelous Meerkat Released, NomadBSD 1.4-RC1, Lets all shed a Tear for 386, find mostly doesn't need xargs today on modern Unixes, OpenBSD KDE Status Report, and more.</itunes:subtitle>
  <itunes:duration>38:55</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Follow-up about FreeBSD jail advantages, Install Prometheus, Node Exporter and Grafana, Calibrate your touch-screen on OpenBSD, OPNsense 21.1 Marvelous Meerkat Released, NomadBSD 1.4-RC1, Lets all shed a Tear for 386, find mostly doesn't need xargs today on modern Unixes, OpenBSD KDE Status Report, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Follow-up about FreeBSD jail advantages (https://rubenerd.com/follow-up-about-freebsd-jail-advantages/)
I’ll admit I ran a lot of justifications together into a single paragraph because I wanted to get to configuring the jails themselves. They’re also, by and large, not specific to FreeBSD’s flavour of containerisation, though I still think it’s easily the most elegant implementation. Sometimes the simplest solution really is the best one.
History of FreeBSD part 4: TCP/IP (https://klarasystems.com/articles/history-of-freebsd-part-4-bsd-and-tcp-ip/)
How TCP/IP evolved and BSDs special contribution to the history of the Internet
***
FreeBSD: Install Prometheus, Node Exporter and Grafana (https://blog.andreev.it/?p=5289)
FreeBSD comes out of the box with three great tools for monitoring. If you need more info about how these tools work, please read the official documentation. I’ll explain the installation only and creating a simple dashboard.
News Roundup
Calibrate your touch-screen on OpenBSD (https://www.tumfatig.net/20210122/calibrate-your-touch-screen-on-openbsd/)
I didn’t expected it but my refurbished T460s came with a touch-screen. It is recognized by default on OpenBSD and not well calibrated as-is. But that’s really simple to solve.
Lets all shed a Tear for 386 (https://lists.freebsd.org/pipermail/freebsd-announce/2021-January/002006.html)
FreeBSD is designating i386 as a Tier 2 architecture starting with FreeBSD 13.0.  The Project will continue to provide release images, binary updates, and pre-built packages for the 13.x branch.  However, i386-specific issues (including SAs) may not be addressed in 13.x. The i386 platform will remain Tier 1 on FreeBSD 11.x and 12.x.
OPNsense 21.1 Marvelous Meerkat Released (https://opnsense.org/opnsense-21-1-marvelous-meerkat-released/)
For more than 6 years, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.
NomadBSD 1.4-RC1 (https://nomadbsd.org/index.html#1.4-RC1)
We are pleased to present the first release candidate of NomadBSD 1.4.
find mostly doesn't need xargs today on modern Unixes (https://utcc.utoronto.ca/~cks/space/blog/unix/FindWithoutXargsToday)
I've been using Unix for long enough that 'find | xargs' is a reflex. When I started and for a long time afterward, xargs was your only choice for efficiently executing a command over a bunch of find results.
OpenBSD KDE Status Report (https://undeadly.org/cgi?action=article;sid=20210124113220)
OpenBSD has managed to drop KDE3 and KDE4 in the 6.8 -&amp;gt; 6.9 release cycle. That makes me very happy because it was a big piece of work and long discussions. This of course brings questions: Kde Plasma 5 package missing.
After half a year of work, I managed to successfully update the Qt5 stack to the last LTS version 5.15.2. On the whole, the most work was updating QtWebengine. What a monster! With my CPU power at home, I can build it 1-2 times a day which makes testing a little bit annoying and time intensive.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Karl - Firefox webcam audio solution (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Karl%20-%20Firefox%20webcam%20audio%20solution.md)
Michal - openzfs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Michal%20-%20openzfs.md)
Dave - bufferbloat (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Dave%20-%20bufferbloat.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, jail, advantages, prometheus, grafana, node-exporter, touch screen, opnsense, marvelous meerkat, nomadbsd, i386, xargs, KDE, signal, proxy, pdf, annotation</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Follow-up about FreeBSD jail advantages, Install Prometheus, Node Exporter and Grafana, Calibrate your touch-screen on OpenBSD, OPNsense 21.1 Marvelous Meerkat Released, NomadBSD 1.4-RC1, Lets all shed a Tear for 386, find mostly doesn&#39;t need xargs today on modern Unixes, OpenBSD KDE Status Report, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://rubenerd.com/follow-up-about-freebsd-jail-advantages/" rel="nofollow">Follow-up about FreeBSD jail advantages</a></h3>

<blockquote>
<p>I’ll admit I ran a lot of justifications together into a single paragraph because I wanted to get to configuring the jails themselves. They’re also, by and large, not specific to FreeBSD’s flavour of containerisation, though I still think it’s easily the most elegant implementation. Sometimes the simplest solution really is the best one.</p>

<hr>

<h3><a href="https://klarasystems.com/articles/history-of-freebsd-part-4-bsd-and-tcp-ip/" rel="nofollow">History of FreeBSD part 4: TCP/IP</a></h3>

<ul>
<li>How TCP/IP evolved and BSDs special contribution to the history of the Internet
***</li>
</ul>
</blockquote>

<h3><a href="https://blog.andreev.it/?p=5289" rel="nofollow">FreeBSD: Install Prometheus, Node Exporter and Grafana</a></h3>

<blockquote>
<p>FreeBSD comes out of the box with three great tools for monitoring. If you need more info about how these tools work, please read the official documentation. I’ll explain the installation only and creating a simple dashboard.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://www.tumfatig.net/20210122/calibrate-your-touch-screen-on-openbsd/" rel="nofollow">Calibrate your touch-screen on OpenBSD</a></h3>

<blockquote>
<p>I didn’t expected it but my refurbished T460s came with a touch-screen. It is recognized by default on OpenBSD and not well calibrated as-is. But that’s really simple to solve.</p>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2021-January/002006.html" rel="nofollow">Lets all shed a Tear for 386</a></h3>

<p>FreeBSD is designating i386 as a Tier 2 architecture starting with FreeBSD 13.0.  The Project will continue to provide release images, binary updates, and pre-built packages for the 13.x branch.  However, i386-specific issues (including SAs) may not be addressed in 13.x. The i386 platform will remain Tier 1 on FreeBSD 11.x and 12.x.</p>

<hr>
</blockquote>

<h3><a href="https://opnsense.org/opnsense-21-1-marvelous-meerkat-released/" rel="nofollow">OPNsense 21.1 Marvelous Meerkat Released</a></h3>

<blockquote>
<p>For more than 6 years, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.</p>

<hr>

<h3><a href="https://nomadbsd.org/index.html#1.4-RC1" rel="nofollow">NomadBSD 1.4-RC1</a></h3>

<p>We are pleased to present the first release candidate of NomadBSD 1.4.</p>

<hr>
</blockquote>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FindWithoutXargsToday" rel="nofollow">find mostly doesn&#39;t need xargs today on modern Unixes</a></h3>

<blockquote>
<p>I&#39;ve been using Unix for long enough that &#39;find | xargs&#39; is a reflex. When I started and for a long time afterward, xargs was your only choice for efficiently executing a command over a bunch of find results.</p>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210124113220" rel="nofollow">OpenBSD KDE Status Report</a></h3>

<p>OpenBSD has managed to drop KDE3 and KDE4 in the 6.8 -&gt; 6.9 release cycle. That makes me very happy because it was a big piece of work and long discussions. This of course brings questions: Kde Plasma 5 package missing.<br>
After half a year of work, I managed to successfully update the Qt5 stack to the last LTS version 5.15.2. On the whole, the most work was updating QtWebengine. What a monster! With my CPU power at home, I can build it 1-2 times a day which makes testing a little bit annoying and time intensive.</p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Karl%20-%20Firefox%20webcam%20audio%20solution.md" rel="nofollow">Karl - Firefox webcam audio solution</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Michal%20-%20openzfs.md" rel="nofollow">Michal - openzfs</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Dave%20-%20bufferbloat.md" rel="nofollow">Dave - bufferbloat</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Follow-up about FreeBSD jail advantages, Install Prometheus, Node Exporter and Grafana, Calibrate your touch-screen on OpenBSD, OPNsense 21.1 Marvelous Meerkat Released, NomadBSD 1.4-RC1, Lets all shed a Tear for 386, find mostly doesn&#39;t need xargs today on modern Unixes, OpenBSD KDE Status Report, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://rubenerd.com/follow-up-about-freebsd-jail-advantages/" rel="nofollow">Follow-up about FreeBSD jail advantages</a></h3>

<blockquote>
<p>I’ll admit I ran a lot of justifications together into a single paragraph because I wanted to get to configuring the jails themselves. They’re also, by and large, not specific to FreeBSD’s flavour of containerisation, though I still think it’s easily the most elegant implementation. Sometimes the simplest solution really is the best one.</p>

<hr>

<h3><a href="https://klarasystems.com/articles/history-of-freebsd-part-4-bsd-and-tcp-ip/" rel="nofollow">History of FreeBSD part 4: TCP/IP</a></h3>

<ul>
<li>How TCP/IP evolved and BSDs special contribution to the history of the Internet
***</li>
</ul>
</blockquote>

<h3><a href="https://blog.andreev.it/?p=5289" rel="nofollow">FreeBSD: Install Prometheus, Node Exporter and Grafana</a></h3>

<blockquote>
<p>FreeBSD comes out of the box with three great tools for monitoring. If you need more info about how these tools work, please read the official documentation. I’ll explain the installation only and creating a simple dashboard.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://www.tumfatig.net/20210122/calibrate-your-touch-screen-on-openbsd/" rel="nofollow">Calibrate your touch-screen on OpenBSD</a></h3>

<blockquote>
<p>I didn’t expected it but my refurbished T460s came with a touch-screen. It is recognized by default on OpenBSD and not well calibrated as-is. But that’s really simple to solve.</p>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2021-January/002006.html" rel="nofollow">Lets all shed a Tear for 386</a></h3>

<p>FreeBSD is designating i386 as a Tier 2 architecture starting with FreeBSD 13.0.  The Project will continue to provide release images, binary updates, and pre-built packages for the 13.x branch.  However, i386-specific issues (including SAs) may not be addressed in 13.x. The i386 platform will remain Tier 1 on FreeBSD 11.x and 12.x.</p>

<hr>
</blockquote>

<h3><a href="https://opnsense.org/opnsense-21-1-marvelous-meerkat-released/" rel="nofollow">OPNsense 21.1 Marvelous Meerkat Released</a></h3>

<blockquote>
<p>For more than 6 years, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.</p>

<hr>

<h3><a href="https://nomadbsd.org/index.html#1.4-RC1" rel="nofollow">NomadBSD 1.4-RC1</a></h3>

<p>We are pleased to present the first release candidate of NomadBSD 1.4.</p>

<hr>
</blockquote>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FindWithoutXargsToday" rel="nofollow">find mostly doesn&#39;t need xargs today on modern Unixes</a></h3>

<blockquote>
<p>I&#39;ve been using Unix for long enough that &#39;find | xargs&#39; is a reflex. When I started and for a long time afterward, xargs was your only choice for efficiently executing a command over a bunch of find results.</p>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210124113220" rel="nofollow">OpenBSD KDE Status Report</a></h3>

<p>OpenBSD has managed to drop KDE3 and KDE4 in the 6.8 -&gt; 6.9 release cycle. That makes me very happy because it was a big piece of work and long discussions. This of course brings questions: Kde Plasma 5 package missing.<br>
After half a year of work, I managed to successfully update the Qt5 stack to the last LTS version 5.15.2. On the whole, the most work was updating QtWebengine. What a monster! With my CPU power at home, I can build it 1-2 times a day which makes testing a little bit annoying and time intensive.</p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Karl%20-%20Firefox%20webcam%20audio%20solution.md" rel="nofollow">Karl - Firefox webcam audio solution</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Michal%20-%20openzfs.md" rel="nofollow">Michal - openzfs</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Dave%20-%20bufferbloat.md" rel="nofollow">Dave - bufferbloat</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>390: Commercial Unix Killer</title>
  <link>https://www.bsdnow.tv/390</link>
  <guid isPermaLink="false">a77e0ca4-6c57-4cd9-ad09-1fbf8292e5d8</guid>
  <pubDate>Thu, 18 Feb 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a77e0ca4-6c57-4cd9-ad09-1fbf8292e5d8.mp3" length="55003992" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Did Linux kill Commercial Unix, three node GlusterFS setup on FreeBSD, OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen), NetBSD on EdgeRouter Lite, TLS Mastery first draft done</itunes:subtitle>
  <itunes:duration>55:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Did Linux kill Commercial Unix, three node GlusterFS setup on FreeBSD, OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen), NetBSD on EdgeRouter Lite, TLS Mastery first draft done
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Did Linux Kill Commercial Unix? (https://www.howtogeek.com/440147/did-linux-kill-commercial-unix/)
Sales of commercial Unix have fallen off a cliff. There has to be something behind this dramatic decline. Has Linux killed its ancestor by becoming a perfectly viable replacement, like an operating system version of Invasion of the Body Snatchers?
Wireguard: Simple and Secure VPN in FreeBSD (https://klarasystems.com/articles/simple-and-secure-vpn-in-freebsd/)
A great article by Tom Jones about setting up Wireguard on FreeBSD
***
Setup a Three Node Replicated GlusterFS Cluster on FreeBSD (http://www.unibia.com/unibianet/freebsd/setup-three-node-replicated-glusterfs-cluster-freebsd)
GlusterFS (GFS) is the open source equivalent to Microsoft's Distributed Filesystem (DFS). It's a service that replicates the contents of a filesystem in real time from one server to another. Clients connect to any server and changes made to a file will replicate automatically. It's similar to something like rsync or syncthing, but much more automatic and transparent. A FreeBSD port has been available since v3.4, and (as of this post) is currently at version 8.0 with 9.0 being released soon.
News Roundup
OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen) (https://jcs.org/2021/01/27/x1nano)
Lenovo has finally made a smaller version of its X1 Carbon, something I’ve been looking forward to for years.
NetBSD on the EdgeRouter Lite (https://www.cambus.net/netbsd-on-the-edgerouter-lite/)
NetBSD-current now has pre-built octeon bootable images (which will appear in NetBSD 10.0) for the evbmips port, so I decided to finally give it a try. I've been happily running OpenBSD/octeon on my EdgeRouter Lite for a few years now, and have previously published some notes including more detail about the CPU.
“TLS Mastery” first draft done! (https://mwl.io/archives/9938)
Beastie Bits
A Thread on a FreeBSD Desktop for PineBook Pro (https://forums.freebsd.org/threads/freebsd-desktop-for-pinebook-pro.78269/)
FOSSASIA Conference - March 2021(Virtual) (https://eventyay.com/e/fa96ae2c)
WireGuard for pfSense Software (https://www.netgate.com/blog/wireguard-for-pfsense-software.html)
NetBSD logo to going Moon (https://mail-index.netbsd.org/netbsd-advocacy/2021/02/07/msg000849.html)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
### Producer's Note
&amp;gt; Hey everybody, it’s JT here.  After our AMA episode where I mentioned I was looking for older BSD Retail Copies, I was contacted by Andrew who hooked me up with a bunch of OpenBSD disks from the 4.x era.  So shout out to him, and since that worked so well, I figured I'd give it another shot and ask that if anyone has any old Unixes that will run on an 8088, 8086, or 286 and you're willing to send me copies of the disks. I've recently dug out an old 286 system and I’d love to get a Unix OS on it.  I know of Minix, Xenix and Microport, but I haven’t been able to find many versions of them.  I've found Microport 1.3.3, and SCO Xenix... but that's about it.  Let me know if you happen to have any other versions, or know where I can get them.  
Feedback/Questions
Christian - ZFS replication and verification (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Christian%20-%20ZFS%20replication%20and%20verification)
Iain - progress (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Iain%20-%20progress)
Paul - APU2 device (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Paul%20-%20APU2%20device)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, Linux, commercial unix, glusterfs, cluster, setup, Lenovo, Thinkpad, x1 nano, edgerouter, lite, tls, book</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Did Linux kill Commercial Unix, three node GlusterFS setup on FreeBSD, OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen), NetBSD on EdgeRouter Lite, TLS Mastery first draft done</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.howtogeek.com/440147/did-linux-kill-commercial-unix/" rel="nofollow">Did Linux Kill Commercial Unix?</a></h3>

<blockquote>
<p>Sales of commercial Unix have fallen off a cliff. There has to be something behind this dramatic decline. Has Linux killed its ancestor by becoming a perfectly viable replacement, like an operating system version of Invasion of the Body Snatchers?</p>

<hr>

<h3><a href="https://klarasystems.com/articles/simple-and-secure-vpn-in-freebsd/" rel="nofollow">Wireguard: Simple and Secure VPN in FreeBSD</a></h3>

<ul>
<li>A great article by Tom Jones about setting up Wireguard on FreeBSD
***</li>
</ul>
</blockquote>

<h3><a href="http://www.unibia.com/unibianet/freebsd/setup-three-node-replicated-glusterfs-cluster-freebsd" rel="nofollow">Setup a Three Node Replicated GlusterFS Cluster on FreeBSD</a></h3>

<blockquote>
<p>GlusterFS (GFS) is the open source equivalent to Microsoft&#39;s Distributed Filesystem (DFS). It&#39;s a service that replicates the contents of a filesystem in real time from one server to another. Clients connect to any server and changes made to a file will replicate automatically. It&#39;s similar to something like rsync or syncthing, but much more automatic and transparent. A FreeBSD port has been available since v3.4, and (as of this post) is currently at version 8.0 with 9.0 being released soon.</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2021/01/27/x1nano" rel="nofollow">OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen)</a></h3>

<p>Lenovo has finally made a smaller version of its X1 Carbon, something I’ve been looking forward to for years.</p>

<hr>

<h3><a href="https://www.cambus.net/netbsd-on-the-edgerouter-lite/" rel="nofollow">NetBSD on the EdgeRouter Lite</a></h3>

<p>NetBSD-current now has pre-built octeon bootable images (which will appear in NetBSD 10.0) for the evbmips port, so I decided to finally give it a try. I&#39;ve been happily running OpenBSD/octeon on my EdgeRouter Lite for a few years now, and have previously published some notes including more detail about the CPU.</p>

<hr>

<h3><a href="https://mwl.io/archives/9938" rel="nofollow">“TLS Mastery” first draft done!</a></h3>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://forums.freebsd.org/threads/freebsd-desktop-for-pinebook-pro.78269/" rel="nofollow">A Thread on a FreeBSD Desktop for PineBook Pro</a></li>
<li><a href="https://eventyay.com/e/fa96ae2c" rel="nofollow">FOSSASIA Conference - March 2021(Virtual)</a></li>
<li><a href="https://www.netgate.com/blog/wireguard-for-pfsense-software.html" rel="nofollow">WireGuard for pfSense Software</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2021/02/07/msg000849.html" rel="nofollow">NetBSD logo to going Moon</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
### Producer&#39;s Note
&gt; Hey everybody, it’s JT here.  After our AMA episode where I mentioned I was looking for older BSD Retail Copies, I was contacted by Andrew who hooked me up with a bunch of OpenBSD disks from the 4.x era.  So shout out to him, and since that worked so well, I figured I&#39;d give it another shot and ask that if anyone has any old Unixes that will run on an 8088, 8086, or 286 and you&#39;re willing to send me copies of the disks. I&#39;ve recently dug out an old 286 system and I’d love to get a Unix OS on it.  I know of Minix, Xenix and Microport, but I haven’t been able to find many versions of them.  I&#39;ve found Microport 1.3.3, and SCO Xenix... but that&#39;s about it.  Let me know if you happen to have any other versions, or know where I can get them.<br></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Christian%20-%20ZFS%20replication%20and%20verification" rel="nofollow">Christian - ZFS replication and verification</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Iain%20-%20progress" rel="nofollow">Iain - progress</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Paul%20-%20APU2%20device" rel="nofollow">Paul - APU2 device</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Did Linux kill Commercial Unix, three node GlusterFS setup on FreeBSD, OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen), NetBSD on EdgeRouter Lite, TLS Mastery first draft done</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.howtogeek.com/440147/did-linux-kill-commercial-unix/" rel="nofollow">Did Linux Kill Commercial Unix?</a></h3>

<blockquote>
<p>Sales of commercial Unix have fallen off a cliff. There has to be something behind this dramatic decline. Has Linux killed its ancestor by becoming a perfectly viable replacement, like an operating system version of Invasion of the Body Snatchers?</p>

<hr>

<h3><a href="https://klarasystems.com/articles/simple-and-secure-vpn-in-freebsd/" rel="nofollow">Wireguard: Simple and Secure VPN in FreeBSD</a></h3>

<ul>
<li>A great article by Tom Jones about setting up Wireguard on FreeBSD
***</li>
</ul>
</blockquote>

<h3><a href="http://www.unibia.com/unibianet/freebsd/setup-three-node-replicated-glusterfs-cluster-freebsd" rel="nofollow">Setup a Three Node Replicated GlusterFS Cluster on FreeBSD</a></h3>

<blockquote>
<p>GlusterFS (GFS) is the open source equivalent to Microsoft&#39;s Distributed Filesystem (DFS). It&#39;s a service that replicates the contents of a filesystem in real time from one server to another. Clients connect to any server and changes made to a file will replicate automatically. It&#39;s similar to something like rsync or syncthing, but much more automatic and transparent. A FreeBSD port has been available since v3.4, and (as of this post) is currently at version 8.0 with 9.0 being released soon.</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2021/01/27/x1nano" rel="nofollow">OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen)</a></h3>

<p>Lenovo has finally made a smaller version of its X1 Carbon, something I’ve been looking forward to for years.</p>

<hr>

<h3><a href="https://www.cambus.net/netbsd-on-the-edgerouter-lite/" rel="nofollow">NetBSD on the EdgeRouter Lite</a></h3>

<p>NetBSD-current now has pre-built octeon bootable images (which will appear in NetBSD 10.0) for the evbmips port, so I decided to finally give it a try. I&#39;ve been happily running OpenBSD/octeon on my EdgeRouter Lite for a few years now, and have previously published some notes including more detail about the CPU.</p>

<hr>

<h3><a href="https://mwl.io/archives/9938" rel="nofollow">“TLS Mastery” first draft done!</a></h3>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://forums.freebsd.org/threads/freebsd-desktop-for-pinebook-pro.78269/" rel="nofollow">A Thread on a FreeBSD Desktop for PineBook Pro</a></li>
<li><a href="https://eventyay.com/e/fa96ae2c" rel="nofollow">FOSSASIA Conference - March 2021(Virtual)</a></li>
<li><a href="https://www.netgate.com/blog/wireguard-for-pfsense-software.html" rel="nofollow">WireGuard for pfSense Software</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2021/02/07/msg000849.html" rel="nofollow">NetBSD logo to going Moon</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
### Producer&#39;s Note
&gt; Hey everybody, it’s JT here.  After our AMA episode where I mentioned I was looking for older BSD Retail Copies, I was contacted by Andrew who hooked me up with a bunch of OpenBSD disks from the 4.x era.  So shout out to him, and since that worked so well, I figured I&#39;d give it another shot and ask that if anyone has any old Unixes that will run on an 8088, 8086, or 286 and you&#39;re willing to send me copies of the disks. I&#39;ve recently dug out an old 286 system and I’d love to get a Unix OS on it.  I know of Minix, Xenix and Microport, but I haven’t been able to find many versions of them.  I&#39;ve found Microport 1.3.3, and SCO Xenix... but that&#39;s about it.  Let me know if you happen to have any other versions, or know where I can get them.<br></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Christian%20-%20ZFS%20replication%20and%20verification" rel="nofollow">Christian - ZFS replication and verification</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Iain%20-%20progress" rel="nofollow">Iain - progress</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Paul%20-%20APU2%20device" rel="nofollow">Paul - APU2 device</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>389: Comfy FreeBSD Jails</title>
  <link>https://www.bsdnow.tv/389</link>
  <guid isPermaLink="false">e9e941f3-5d28-4978-9398-058673590033</guid>
  <pubDate>Wed, 10 Feb 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e9e941f3-5d28-4978-9398-058673590033.mp3" length="42044472" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A week with Plan 9, Exploring Swap on FreeBSD, how to create a FreeBSD pkg mirror using bastille and poudriere, How to set up FreeBSD 12 VNET jail with ZFS, Creating Comfy FreeBSD Jails Using Standard Tools, and more.</itunes:subtitle>
  <itunes:duration>41:16</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A week with Plan 9, Exploring Swap on FreeBSD, how to create a FreeBSD pkg mirror using bastille and poudriere, How to set up FreeBSD 12 VNET jail with ZFS, Creating Comfy FreeBSD Jails Using Standard Tools, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
A Week With Plan 9 (https://thedorkweb.substack.com/p/a-week-with-plan-9)
I spent the first week of 2021 learning an OS called Plan 9 from Bell Labs. This is a fringe Operating System, long abandoned by it’s original authors. It's also responsible for a great deal of inspiration elsewhere. If you’ve used the Go language, /proc, UTF-8 or Docker, you’ve used Plan 9-designed features. This issue dives into Operating System internals and some moderately hard computer science topics. If that sort of thing isn’t your bag you might want to skip ahead. Normal service will resume shortly.
Exploring Swap on FreeBSD (https://klarasystems.com/articles/exploring-swap-on-freebsd/)
On modern Unix-like systems such as FreeBSD, “swapping” refers to the activity of paging out the contents of memory to a disk and then paging it back in on demand. The page-out activity occurs in response to a lack of free memory in the system: the kernel tries to identify pages of memory that probably will not be accessed in the near future, and copies their contents to a disk for safekeeping until they are needed again. When an application attempts to access memory that has been swapped out, it blocks while the kernel fetches that saved memory from the swap disk, and then resumes execution as if nothing had happened.
News Roundup
How to create a FreeBSD pkg mirror using bastille and poudriere (https://hackacad.net/post/2021-01-13-build-a-freebsd-pkg-mirror-with-bastille-poudriere/)
This a short how-to for creating a FreeBSD pkg mirror using BastilleBSD and Poudriere.
How to set up FreeBSD 12 VNET jail with ZFS (https://www.cyberciti.biz/faq/configuring-freebsd-12-vnet-jail-using-bridgeepair-zfs/)
How do I install, set up and configure a FreeBSD 12 jail with VNET on ZFS? How can I create FreeBSD 12 VNET jail with /etc/jail.conf to run OpenVPN, Apache, Wireguard and other Internet-facing services securely on my BSD box?
FreeBSD jail is nothing but operating system-level virtualization that allows partitioning a FreeBSD based Unix server. Such systems have their root user and access rights. Jails can use network subsystem virtualization infrastructure or share an existing network. FreeBSD jails are a powerful way to increase security. Usually, you create jail per services such as an Nginx/Apache webserver with PHP/Perl/Python app, WireGuard/OpeNVPN server, MariaDB/PgSQL server, and more. This page shows how to configure a FreeBSD Jail with vnet and ZFZ on FreeBSD 12.x.
Creating Comfy FreeBSD Jails Using Standard Tools (https://kettunen.io/post/standard-freebsd-jails/)
Docker has stormed into software development in recent years. While the concepts behind it are powerful and useful, similar tools have been used in systems for decades. FreeBSD’s jails in one of those tools which build upon even older chroot(2) To put it shortly, with these tools, you can make a safe environment separated from the rest of the system.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Chris - USB BSD variant (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Chris%20-%20USB%20BSD%20variant)
Jacob - host wifi through a jail (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Jacob%20-%20host%20wifi%20through%20a%20jail)
Jordan - new tool vs updating existing tool (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Jordan%20-%20new%20too%20vs%20updating%20existing%20tool)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, Plan 9, swap, exploring, exploration, pkg, mirror, bastille, poudriere, vnet, jail, tools </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A week with Plan 9, Exploring Swap on FreeBSD, how to create a FreeBSD pkg mirror using bastille and poudriere, How to set up FreeBSD 12 VNET jail with ZFS, Creating Comfy FreeBSD Jails Using Standard Tools, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://thedorkweb.substack.com/p/a-week-with-plan-9" rel="nofollow">A Week With Plan 9</a></h3>

<blockquote>
<p>I spent the first week of 2021 learning an OS called Plan 9 from Bell Labs. This is a fringe Operating System, long abandoned by it’s original authors. It&#39;s also responsible for a great deal of inspiration elsewhere. If you’ve used the Go language, /proc, UTF-8 or Docker, you’ve used Plan 9-designed features. This issue dives into Operating System internals and some moderately hard computer science topics. If that sort of thing isn’t your bag you might want to skip ahead. Normal service will resume shortly.</p>

<hr>

<h3><a href="https://klarasystems.com/articles/exploring-swap-on-freebsd/" rel="nofollow">Exploring Swap on FreeBSD</a></h3>

<p>On modern Unix-like systems such as FreeBSD, “swapping” refers to the activity of paging out the contents of memory to a disk and then paging it back in on demand. The page-out activity occurs in response to a lack of free memory in the system: the kernel tries to identify pages of memory that probably will not be accessed in the near future, and copies their contents to a disk for safekeeping until they are needed again. When an application attempts to access memory that has been swapped out, it blocks while the kernel fetches that saved memory from the swap disk, and then resumes execution as if nothing had happened.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://hackacad.net/post/2021-01-13-build-a-freebsd-pkg-mirror-with-bastille-poudriere/" rel="nofollow">How to create a FreeBSD pkg mirror using bastille and poudriere</a></h3>

<blockquote>
<p>This a short how-to for creating a FreeBSD pkg mirror using BastilleBSD and Poudriere.</p>

<hr>

<h3><a href="https://www.cyberciti.biz/faq/configuring-freebsd-12-vnet-jail-using-bridgeepair-zfs/" rel="nofollow">How to set up FreeBSD 12 VNET jail with ZFS</a></h3>

<p>How do I install, set up and configure a FreeBSD 12 jail with VNET on ZFS? How can I create FreeBSD 12 VNET jail with /etc/jail.conf to run OpenVPN, Apache, Wireguard and other Internet-facing services securely on my BSD box?<br>
FreeBSD jail is nothing but operating system-level virtualization that allows partitioning a FreeBSD based Unix server. Such systems have their root user and access rights. Jails can use network subsystem virtualization infrastructure or share an existing network. FreeBSD jails are a powerful way to increase security. Usually, you create jail per services such as an Nginx/Apache webserver with PHP/Perl/Python app, WireGuard/OpeNVPN server, MariaDB/PgSQL server, and more. This page shows how to configure a FreeBSD Jail with vnet and ZFZ on FreeBSD 12.x.</p>

<hr>

<h3><a href="https://kettunen.io/post/standard-freebsd-jails/" rel="nofollow">Creating Comfy FreeBSD Jails Using Standard Tools</a></h3>

<p>Docker has stormed into software development in recent years. While the concepts behind it are powerful and useful, similar tools have been used in systems for decades. FreeBSD’s jails in one of those tools which build upon even older chroot(2) To put it shortly, with these tools, you can make a safe environment separated from the rest of the system.</p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Chris%20-%20USB%20BSD%20variant" rel="nofollow">Chris - USB BSD variant</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Jacob%20-%20host%20wifi%20through%20a%20jail" rel="nofollow">Jacob - host wifi through a jail</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Jordan%20-%20new%20too%20vs%20updating%20existing%20tool" rel="nofollow">Jordan - new tool vs updating existing tool</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A week with Plan 9, Exploring Swap on FreeBSD, how to create a FreeBSD pkg mirror using bastille and poudriere, How to set up FreeBSD 12 VNET jail with ZFS, Creating Comfy FreeBSD Jails Using Standard Tools, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://thedorkweb.substack.com/p/a-week-with-plan-9" rel="nofollow">A Week With Plan 9</a></h3>

<blockquote>
<p>I spent the first week of 2021 learning an OS called Plan 9 from Bell Labs. This is a fringe Operating System, long abandoned by it’s original authors. It&#39;s also responsible for a great deal of inspiration elsewhere. If you’ve used the Go language, /proc, UTF-8 or Docker, you’ve used Plan 9-designed features. This issue dives into Operating System internals and some moderately hard computer science topics. If that sort of thing isn’t your bag you might want to skip ahead. Normal service will resume shortly.</p>

<hr>

<h3><a href="https://klarasystems.com/articles/exploring-swap-on-freebsd/" rel="nofollow">Exploring Swap on FreeBSD</a></h3>

<p>On modern Unix-like systems such as FreeBSD, “swapping” refers to the activity of paging out the contents of memory to a disk and then paging it back in on demand. The page-out activity occurs in response to a lack of free memory in the system: the kernel tries to identify pages of memory that probably will not be accessed in the near future, and copies their contents to a disk for safekeeping until they are needed again. When an application attempts to access memory that has been swapped out, it blocks while the kernel fetches that saved memory from the swap disk, and then resumes execution as if nothing had happened.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://hackacad.net/post/2021-01-13-build-a-freebsd-pkg-mirror-with-bastille-poudriere/" rel="nofollow">How to create a FreeBSD pkg mirror using bastille and poudriere</a></h3>

<blockquote>
<p>This a short how-to for creating a FreeBSD pkg mirror using BastilleBSD and Poudriere.</p>

<hr>

<h3><a href="https://www.cyberciti.biz/faq/configuring-freebsd-12-vnet-jail-using-bridgeepair-zfs/" rel="nofollow">How to set up FreeBSD 12 VNET jail with ZFS</a></h3>

<p>How do I install, set up and configure a FreeBSD 12 jail with VNET on ZFS? How can I create FreeBSD 12 VNET jail with /etc/jail.conf to run OpenVPN, Apache, Wireguard and other Internet-facing services securely on my BSD box?<br>
FreeBSD jail is nothing but operating system-level virtualization that allows partitioning a FreeBSD based Unix server. Such systems have their root user and access rights. Jails can use network subsystem virtualization infrastructure or share an existing network. FreeBSD jails are a powerful way to increase security. Usually, you create jail per services such as an Nginx/Apache webserver with PHP/Perl/Python app, WireGuard/OpeNVPN server, MariaDB/PgSQL server, and more. This page shows how to configure a FreeBSD Jail with vnet and ZFZ on FreeBSD 12.x.</p>

<hr>

<h3><a href="https://kettunen.io/post/standard-freebsd-jails/" rel="nofollow">Creating Comfy FreeBSD Jails Using Standard Tools</a></h3>

<p>Docker has stormed into software development in recent years. While the concepts behind it are powerful and useful, similar tools have been used in systems for decades. FreeBSD’s jails in one of those tools which build upon even older chroot(2) To put it shortly, with these tools, you can make a safe environment separated from the rest of the system.</p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Chris%20-%20USB%20BSD%20variant" rel="nofollow">Chris - USB BSD variant</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Jacob%20-%20host%20wifi%20through%20a%20jail" rel="nofollow">Jacob - host wifi through a jail</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Jordan%20-%20new%20too%20vs%20updating%20existing%20tool" rel="nofollow">Jordan - new tool vs updating existing tool</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>388: Must-have security tool</title>
  <link>https://www.bsdnow.tv/388</link>
  <guid isPermaLink="false">df800c64-9bac-467b-be5c-088a4cd94882</guid>
  <pubDate>Thu, 04 Feb 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/df800c64-9bac-467b-be5c-088a4cd94882.mp3" length="51435504" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Q4 2020 Status report, a must-have security tool from OpenBSD, Bastille Port Redirection and Persistence, FreeBSD Wall Display Computer, etymology of command-line tools, GhostBSD 21.01.15 Release Notes, and more.</itunes:subtitle>
  <itunes:duration>49:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Q4 2020 Status report, a must-have security tool from OpenBSD, Bastille Port Redirection and Persistence, FreeBSD Wall Display Computer, etymology of command-line tools, GhostBSD 21.01.15 Release Notes, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
FreeBSD quarterly status report for Q4 2020 (https://www.freebsd.org/news/status/report-2020-10-2020-12/)
Block spammers/abusive IPs with Pf-badhost in OpenBSD. A 'must have' security tool! (https://undeadly.org/cgi?action=article;sid=20210119113425)
Pf-badhost is a very practical, robust, stable and lightweight security script for network servers.
It's compatible with BSD based operating systems such as {Open,Free,Net,Dragonfly}BSD and MacOS. It prevents potentially-bad IP addresses that could possibly attack your servers (and waste your bandwidth and fill your logfiles), by blocking all those IPs contacting your server, and therefore it makes your server network/resources lighter and the logs of important services running on your server become simpler, more readable and efficient.
News Roundup
Bastille Port Redirection and Persistence (https://bastillebsd.org/blog/2021/01/13/bastille-port-redirection-and-persistence/)
Bastille supports redirecting (rdr) ports from the host system into target containers. This port redirection is commonly used when running Internet services such as web servers, dns servers, email and many others. Any service you want to make public outside of your cluster will likely require port redirection (with some exceptions, see below).
FreeBSD Wall Display Computer (https://blog.tyk.nu/blog/freebsd-wall-display-computer/)
I've recently added a wall mounted 30" monitor for Grafana in my home. I can highly recommend doing the same, especially in a world where more work from home is becoming the norm.
The etymology of command-line tools (https://i.redd.it/sni9gaxfj2d61.png)
GhostBSD 21.01.15 Release Notes (https://ghostbsd.org/21.01.15_release_notes)
I am happy to announce the availability of the new ISO 21.01.15. This new ISO comes with a clean-up of packages that include removing LibreOffice and Telegram from the default selection. We did this to bring the zfs RW live file systems to run without problem on 4GB of ram machine. We also removed the UFS full disk option from the installer. Users can still use custom partitions to setup UFS partition, but we discourage it. We also fixed the Next button's restriction in the custom partition related to some bug that people reported. We also fix the missing default locale setup and added the default setup for Linux Steam, not to forget this ISO includes kernel, userland and numerous application updates.
Beastie Bits
Interview with Brian Kernighan (https://corecursive.com/brian-kernighan-unix-bell-labs1/)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, quarterly, quarter, fourth, 2020, report, status, security, tool, bastille, port, redirection, persistence, wall display, display, etymology. command-line, ghostbsd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Q4 2020 Status report, a must-have security tool from OpenBSD, Bastille Port Redirection and Persistence, FreeBSD Wall Display Computer, etymology of command-line tools, GhostBSD 21.01.15 Release Notes, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2020-10-2020-12/" rel="nofollow">FreeBSD quarterly status report for Q4 2020</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210119113425" rel="nofollow">Block spammers/abusive IPs with Pf-badhost in OpenBSD. A &#39;must have&#39; security tool!</a></h3>

<blockquote>
<p>Pf-badhost is a very practical, robust, stable and lightweight security script for network servers.<br>
It&#39;s compatible with BSD based operating systems such as {Open,Free,Net,Dragonfly}BSD and MacOS. It prevents potentially-bad IP addresses that could possibly attack your servers (and waste your bandwidth and fill your logfiles), by blocking all those IPs contacting your server, and therefore it makes your server network/resources lighter and the logs of important services running on your server become simpler, more readable and efficient.</p>

<hr>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://bastillebsd.org/blog/2021/01/13/bastille-port-redirection-and-persistence/" rel="nofollow">Bastille Port Redirection and Persistence</a></h3>

<blockquote>
<p>Bastille supports redirecting (rdr) ports from the host system into target containers. This port redirection is commonly used when running Internet services such as web servers, dns servers, email and many others. Any service you want to make public outside of your cluster will likely require port redirection (with some exceptions, see below).</p>

<hr>

<h3><a href="https://blog.tyk.nu/blog/freebsd-wall-display-computer/" rel="nofollow">FreeBSD Wall Display Computer</a></h3>

<p>I&#39;ve recently added a wall mounted 30&quot; monitor for Grafana in my home. I can highly recommend doing the same, especially in a world where more work from home is becoming the norm.</p>

<hr>

<h3><a href="https://i.redd.it/sni9gaxfj2d61.png" rel="nofollow">The etymology of command-line tools</a></h3>

<hr>

<h3><a href="https://ghostbsd.org/21.01.15_release_notes" rel="nofollow">GhostBSD 21.01.15 Release Notes</a></h3>

<p>I am happy to announce the availability of the new ISO 21.01.15. This new ISO comes with a clean-up of packages that include removing LibreOffice and Telegram from the default selection. We did this to bring the zfs RW live file systems to run without problem on 4GB of ram machine. We also removed the UFS full disk option from the installer. Users can still use custom partitions to setup UFS partition, but we discourage it. We also fixed the Next button&#39;s restriction in the custom partition related to some bug that people reported. We also fix the missing default locale setup and added the default setup for Linux Steam, not to forget this ISO includes kernel, userland and numerous application updates.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://corecursive.com/brian-kernighan-unix-bell-labs1/" rel="nofollow">Interview with Brian Kernighan</a>
***
###Tarsnap</li>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Q4 2020 Status report, a must-have security tool from OpenBSD, Bastille Port Redirection and Persistence, FreeBSD Wall Display Computer, etymology of command-line tools, GhostBSD 21.01.15 Release Notes, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2020-10-2020-12/" rel="nofollow">FreeBSD quarterly status report for Q4 2020</a></h3>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210119113425" rel="nofollow">Block spammers/abusive IPs with Pf-badhost in OpenBSD. A &#39;must have&#39; security tool!</a></h3>

<blockquote>
<p>Pf-badhost is a very practical, robust, stable and lightweight security script for network servers.<br>
It&#39;s compatible with BSD based operating systems such as {Open,Free,Net,Dragonfly}BSD and MacOS. It prevents potentially-bad IP addresses that could possibly attack your servers (and waste your bandwidth and fill your logfiles), by blocking all those IPs contacting your server, and therefore it makes your server network/resources lighter and the logs of important services running on your server become simpler, more readable and efficient.</p>

<hr>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://bastillebsd.org/blog/2021/01/13/bastille-port-redirection-and-persistence/" rel="nofollow">Bastille Port Redirection and Persistence</a></h3>

<blockquote>
<p>Bastille supports redirecting (rdr) ports from the host system into target containers. This port redirection is commonly used when running Internet services such as web servers, dns servers, email and many others. Any service you want to make public outside of your cluster will likely require port redirection (with some exceptions, see below).</p>

<hr>

<h3><a href="https://blog.tyk.nu/blog/freebsd-wall-display-computer/" rel="nofollow">FreeBSD Wall Display Computer</a></h3>

<p>I&#39;ve recently added a wall mounted 30&quot; monitor for Grafana in my home. I can highly recommend doing the same, especially in a world where more work from home is becoming the norm.</p>

<hr>

<h3><a href="https://i.redd.it/sni9gaxfj2d61.png" rel="nofollow">The etymology of command-line tools</a></h3>

<hr>

<h3><a href="https://ghostbsd.org/21.01.15_release_notes" rel="nofollow">GhostBSD 21.01.15 Release Notes</a></h3>

<p>I am happy to announce the availability of the new ISO 21.01.15. This new ISO comes with a clean-up of packages that include removing LibreOffice and Telegram from the default selection. We did this to bring the zfs RW live file systems to run without problem on 4GB of ram machine. We also removed the UFS full disk option from the installer. Users can still use custom partitions to setup UFS partition, but we discourage it. We also fixed the Next button&#39;s restriction in the custom partition related to some bug that people reported. We also fix the missing default locale setup and added the default setup for Linux Steam, not to forget this ISO includes kernel, userland and numerous application updates.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://corecursive.com/brian-kernighan-unix-bell-labs1/" rel="nofollow">Interview with Brian Kernighan</a>
***
###Tarsnap</li>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>387: OpenBSD Broadcast Studio</title>
  <link>https://www.bsdnow.tv/387</link>
  <guid isPermaLink="false">352cdfe3-fbba-46ef-8982-4b4c37d3da22</guid>
  <pubDate>Thu, 28 Jan 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/352cdfe3-fbba-46ef-8982-4b4c37d3da22.mp3" length="43820232" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>GNN's tips for surviving Cabin Fever and Coding from Home, Self-host a password manager on OpenBSD, Preliminary OpenBSD Support added to OBS, Dan's CURL tip of the Day, List of some Shell goodies for OpenBSD, and more</itunes:subtitle>
  <itunes:duration>43:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>GNN's tips for surviving Cabin Fever and Coding from Home, Self-host a password manager on OpenBSD, Preliminary OpenBSD Support added to OBS, Dan's CURL tip of the Day, List of some Shell goodies for OpenBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
GNN's tips for surviving Cabin Fever and Coding from Home (https://queue.acm.org/detail.cfm?id=3437846)
Forgive me if this seems off topic, but I was wondering if you had any advice for the majority of us who are now KFH (koding from home). I don't know how KV works day to day, but it seems pretty clear that the status quo has changed at most workplaces in the last several months, and it's hard to know if there are things we could be doing to stay productive while we're all at home, ordering delivery, and microwaving our mail. Does KV have any good guidance?
Self-host a password manager on OpenBSD (https://www.tumfatig.net/20210105/self-host-a-password-manager-on-openbsd/)
I’ve been using Rubywarden to store and access my passwords from OpenBSD workstations and iOS toys. But recent redondant failures from the iOS App and rubywarden not being maintained anymore led to the need for a new solution.
I was investing on pass+pgp+git but it was quite complex.
News Roundup
Preliminary OpenBSD Support added to OBS (https://undeadly.org/cgi?action=article;sid=20210113072623)
Dan's CURL tip of the Day (https://mobile.twitter.com/DLangille/status/1323963716153626626)
List of some Shell goodies for OpenBSD (https://www.vincentdelft.be/post/post_20210102)
I'm sharing here some practices I'm following and some small tips/tools which facilitate my usage of OpenBSD in my day to day.
Some are really specific to my usage, others could be re-used.
Beastie Bits
• [Traditional text mode games from BSD](https://github.com/msharov/bsd-games)
• [FreeBSD Easter Eggs](https://twitter.com/freebsdfrau/status/972893680473317377)
• [A prehistory and history of Unix Slide Deck](https://docs.google.com/presentation/d/1BxnFiP_Hv3HJbbYRfSxpTym7GzqxJPQlTE6Ur5h1Al8/edit#slide=id.g951f86c343_0_95)
• [How to use Android USB Tethering to get Internet on FreeBSD](https://www.youtube.com/watch?v=cAEmtrEZlV8)
• [VPN'Othon #2 for CharmBUG](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/charmbug_event.md)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
• [Kev - Ramdisk](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/feedback/kev%20-%20ramdisk.md)
• [John - new to freebsd](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/feedback/John%20-%20new%20to%20freebsd)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, cabin fever, ACM, Association of Computing Machinery, Queue, Code Vicious, coding, self-hosting, password, password manager, open broadcaster studio, obs, broadcasting, curl, shell, tip of the day</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>GNN&#39;s tips for surviving Cabin Fever and Coding from Home, Self-host a password manager on OpenBSD, Preliminary OpenBSD Support added to OBS, Dan&#39;s CURL tip of the Day, List of some Shell goodies for OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://queue.acm.org/detail.cfm?id=3437846" rel="nofollow">GNN&#39;s tips for surviving Cabin Fever and Coding from Home</a></h3>

<blockquote>
<p>Forgive me if this seems off topic, but I was wondering if you had any advice for the majority of us who are now KFH (koding from home). I don&#39;t know how KV works day to day, but it seems pretty clear that the status quo has changed at most workplaces in the last several months, and it&#39;s hard to know if there are things we could be doing to stay productive while we&#39;re all at home, ordering delivery, and microwaving our mail. Does KV have any good guidance?</p>
</blockquote>

<hr>

<h3><a href="https://www.tumfatig.net/20210105/self-host-a-password-manager-on-openbsd/" rel="nofollow">Self-host a password manager on OpenBSD</a></h3>

<blockquote>
<p>I’ve been using Rubywarden to store and access my passwords from OpenBSD workstations and iOS toys. But recent redondant failures from the iOS App and rubywarden not being maintained anymore led to the need for a new solution.<br>
I was investing on pass+pgp+git but it was quite complex.</p>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210113072623" rel="nofollow">Preliminary OpenBSD Support added to OBS</a></h3>

<hr>

<h3><a href="https://mobile.twitter.com/DLangille/status/1323963716153626626" rel="nofollow">Dan&#39;s CURL tip of the Day</a></h3>

<hr>

<h3><a href="https://www.vincentdelft.be/post/post_20210102" rel="nofollow">List of some Shell goodies for OpenBSD</a></h3>

<blockquote>
<p>I&#39;m sharing here some practices I&#39;m following and some small tips/tools which facilitate my usage of OpenBSD in my day to day.<br>
Some are really specific to my usage, others could be re-used.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [Traditional text mode games from BSD](https://github.com/msharov/bsd-games)
• [FreeBSD Easter Eggs](https://twitter.com/freebsdfrau/status/972893680473317377)
• [A prehistory and history of Unix Slide Deck](https://docs.google.com/presentation/d/1BxnFiP_Hv3HJbbYRfSxpTym7GzqxJPQlTE6Ur5h1Al8/edit#slide=id.g951f86c343_0_95)
• [How to use Android USB Tethering to get Internet on FreeBSD](https://www.youtube.com/watch?v=cAEmtrEZlV8)
• [VPN&#39;Othon #2 for CharmBUG](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/charmbug_event.md)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• [Kev - Ramdisk](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/feedback/kev%20-%20ramdisk.md)
• [John - new to freebsd](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/feedback/John%20-%20new%20to%20freebsd)
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>GNN&#39;s tips for surviving Cabin Fever and Coding from Home, Self-host a password manager on OpenBSD, Preliminary OpenBSD Support added to OBS, Dan&#39;s CURL tip of the Day, List of some Shell goodies for OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://queue.acm.org/detail.cfm?id=3437846" rel="nofollow">GNN&#39;s tips for surviving Cabin Fever and Coding from Home</a></h3>

<blockquote>
<p>Forgive me if this seems off topic, but I was wondering if you had any advice for the majority of us who are now KFH (koding from home). I don&#39;t know how KV works day to day, but it seems pretty clear that the status quo has changed at most workplaces in the last several months, and it&#39;s hard to know if there are things we could be doing to stay productive while we&#39;re all at home, ordering delivery, and microwaving our mail. Does KV have any good guidance?</p>
</blockquote>

<hr>

<h3><a href="https://www.tumfatig.net/20210105/self-host-a-password-manager-on-openbsd/" rel="nofollow">Self-host a password manager on OpenBSD</a></h3>

<blockquote>
<p>I’ve been using Rubywarden to store and access my passwords from OpenBSD workstations and iOS toys. But recent redondant failures from the iOS App and rubywarden not being maintained anymore led to the need for a new solution.<br>
I was investing on pass+pgp+git but it was quite complex.</p>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20210113072623" rel="nofollow">Preliminary OpenBSD Support added to OBS</a></h3>

<hr>

<h3><a href="https://mobile.twitter.com/DLangille/status/1323963716153626626" rel="nofollow">Dan&#39;s CURL tip of the Day</a></h3>

<hr>

<h3><a href="https://www.vincentdelft.be/post/post_20210102" rel="nofollow">List of some Shell goodies for OpenBSD</a></h3>

<blockquote>
<p>I&#39;m sharing here some practices I&#39;m following and some small tips/tools which facilitate my usage of OpenBSD in my day to day.<br>
Some are really specific to my usage, others could be re-used.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<pre><code>• [Traditional text mode games from BSD](https://github.com/msharov/bsd-games)
• [FreeBSD Easter Eggs](https://twitter.com/freebsdfrau/status/972893680473317377)
• [A prehistory and history of Unix Slide Deck](https://docs.google.com/presentation/d/1BxnFiP_Hv3HJbbYRfSxpTym7GzqxJPQlTE6Ur5h1Al8/edit#slide=id.g951f86c343_0_95)
• [How to use Android USB Tethering to get Internet on FreeBSD](https://www.youtube.com/watch?v=cAEmtrEZlV8)
• [VPN&#39;Othon #2 for CharmBUG](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/charmbug_event.md)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<pre><code>• [Kev - Ramdisk](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/feedback/kev%20-%20ramdisk.md)
• [John - new to freebsd](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/feedback/John%20-%20new%20to%20freebsd)
</code></pre>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>386: Aye, 386!</title>
  <link>https://www.bsdnow.tv/386</link>
  <guid isPermaLink="false">d5e42030-e15b-444f-b823-a40e34bea5a8</guid>
  <pubDate>Thu, 21 Jan 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d5e42030-e15b-444f-b823-a40e34bea5a8.mp3" length="38533008" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Routing and Firewalling VLANS with FreeBSD, FreeBSD 12 VNET jail with ZFS howto, pkgsrc-2020Q4 released, FreeBSD on Raspberry Pi 4 With 4GB of RAM, HardenedBSD December 2020 Status Report, and more</itunes:subtitle>
  <itunes:duration>37:00</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Routing and Firewalling VLANS with FreeBSD, FreeBSD 12 VNET jail with ZFS howto, pkgsrc-2020Q4 released, FreeBSD on Raspberry Pi 4 With 4GB of RAM, HardenedBSD December 2020 Status Report, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Routing and Firewalling VLANS with FreeBSD (https://klarasystems.com/articles/routing-and-firewalling-vlans-with-freebsd/)
In this article we are going to look at and integrate two network isolation technologies, VLANs and VNET. VLANs are common place, and if you have done some network management or design then you are likely to have interacted with them. The second are FreeBSDs VNET virtual network stacks, a powerful network stack isolation technology that gives FreeBSD jails super powers.
Ethernet VLAN (standardised by IEEE 802.1Q) are an extension to Ethernet and provide an essential method for scaling network deployments. They are used in all environments to enable reuse of common infrastructure by isolating portions of networks from each other. VLANs allow the reuse of common cables, switches and routers to carry completely different networks. It is common to have data that must be separated from different networks carried on common cables until their VLAN tags are finally stripped at a gateway switch or router.
How to set up FreeBSD 12 VNET jail with ZFS (https://www.cyberciti.biz/faq/configuring-freebsd-12-vnet-jail-using-bridgeepair-zfs/)
How do I install, set up and configure a FreeBSD 12 jail with VNET on ZFS? How can I create FreeBSD 12 VNET jail with /etc/jail.conf to run OpenVPN, Apache, Wireguard and other Internet-facing services securely on my BSD box?
FreeBSD jail is nothing but operating system-level virtualization that allows partitioning a FreeBSD based Unix server. Such systems have their root user and access rights. Jails can use network subsystem virtualization infrastructure or share an existing network. FreeBSD jails are a powerful way to increase security. Usually, you create jail per services such as an Nginx/Apache webserver with PHP/Perl/Python app, WireGuard/OpeNVPN server, MariaDB/PgSQL server, and more. This page shows how to configure a FreeBSD Jail with vnet and ZFS on FreeBSD 12.x.
News Roundup
pkgsrc-2020Q4 released (https://mail-index.netbsd.org/netbsd-announce/2021/01/08/msg000322.html)
The pkgsrc developers are proud to announce the 69th quarterly release
of pkgsrc, the cross-platform packaging system.  pkgsrc is available
with more than 24,000 packages, running on 23 separate platforms; more
information on pkgsrc itself is available at https://www.pkgsrc.org/
FreeBSD ON A Raspberry PI 4 With 4GB of RAM (https://lambdaland.org/posts/2020-12-23_freebsd_rpi4/)
This is the story of how I managed to get FreeBSD running on a Raspberry Pi 4 with 4GB of RAM, though I think the setup story is pretty similar for those with 2GB and 8GB.1
HardenedBSD December 2020 Status Report (https://hardenedbsd.org/article/shawn-webb/2020-12-31/hardenedbsd-december-2020-status-report)
Happy New Year! On this the last day of 2020, I submit December's status report.
Beastie Bits
Christmas Cards The Unix Way - with pic and  troff (https://www.youtube.com/watch?v=xMijdTWSUEE&amp;amp;feature=youtu.be)
Fast RPI3 upgrade from source (cross compile) (https://forums.freebsd.org/threads/fast-upgrade-raspberry-pi3-from-source.78169/) 
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Robert - zfs question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/robert%20-%20zfs%20question.md)
Neb - AMA episode.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/neb%20-%20AMA%20episode.md)
Joe - puppet (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/joe%20-%20puppet.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, firewall, firewalling, VLAN, VNET, jail, pkgsrc, package source, raspberry pi, RPI, status report</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Routing and Firewalling VLANS with FreeBSD, FreeBSD 12 VNET jail with ZFS howto, pkgsrc-2020Q4 released, FreeBSD on Raspberry Pi 4 With 4GB of RAM, HardenedBSD December 2020 Status Report, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/routing-and-firewalling-vlans-with-freebsd/" rel="nofollow">Routing and Firewalling VLANS with FreeBSD</a></h3>

<blockquote>
<p>In this article we are going to look at and integrate two network isolation technologies, VLANs and VNET. VLANs are common place, and if you have done some network management or design then you are likely to have interacted with them. The second are FreeBSDs VNET virtual network stacks, a powerful network stack isolation technology that gives FreeBSD jails super powers.<br>
Ethernet VLAN (standardised by IEEE 802.1Q) are an extension to Ethernet and provide an essential method for scaling network deployments. They are used in all environments to enable reuse of common infrastructure by isolating portions of networks from each other. VLANs allow the reuse of common cables, switches and routers to carry completely different networks. It is common to have data that must be separated from different networks carried on common cables until their VLAN tags are finally stripped at a gateway switch or router.</p>
</blockquote>

<hr>

<h3><a href="https://www.cyberciti.biz/faq/configuring-freebsd-12-vnet-jail-using-bridgeepair-zfs/" rel="nofollow">How to set up FreeBSD 12 VNET jail with ZFS</a></h3>

<blockquote>
<p>How do I install, set up and configure a FreeBSD 12 jail with VNET on ZFS? How can I create FreeBSD 12 VNET jail with /etc/jail.conf to run OpenVPN, Apache, Wireguard and other Internet-facing services securely on my BSD box?<br>
FreeBSD jail is nothing but operating system-level virtualization that allows partitioning a FreeBSD based Unix server. Such systems have their root user and access rights. Jails can use network subsystem virtualization infrastructure or share an existing network. FreeBSD jails are a powerful way to increase security. Usually, you create jail per services such as an Nginx/Apache webserver with PHP/Perl/Python app, WireGuard/OpeNVPN server, MariaDB/PgSQL server, and more. This page shows how to configure a FreeBSD Jail with vnet and ZFS on FreeBSD 12.x.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-announce/2021/01/08/msg000322.html" rel="nofollow">pkgsrc-2020Q4 released</a></h3>

<blockquote>
<p>The pkgsrc developers are proud to announce the 69th quarterly release<br>
of pkgsrc, the cross-platform packaging system.  pkgsrc is available<br>
with more than 24,000 packages, running on 23 separate platforms; more<br>
information on pkgsrc itself is available at <a href="https://www.pkgsrc.org/" rel="nofollow">https://www.pkgsrc.org/</a></p>
</blockquote>

<hr>

<h3><a href="https://lambdaland.org/posts/2020-12-23_freebsd_rpi4/" rel="nofollow">FreeBSD ON A Raspberry PI 4 With 4GB of RAM</a></h3>

<blockquote>
<p>This is the story of how I managed to get FreeBSD running on a Raspberry Pi 4 with 4GB of RAM, though I think the setup story is pretty similar for those with 2GB and 8GB.1</p>
</blockquote>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-12-31/hardenedbsd-december-2020-status-report" rel="nofollow">HardenedBSD December 2020 Status Report</a></h3>

<blockquote>
<p>Happy New Year! On this the last day of 2020, I submit December&#39;s status report.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=xMijdTWSUEE&feature=youtu.be" rel="nofollow">Christmas Cards The Unix Way - with pic and  troff</a></li>
<li><a href="https://forums.freebsd.org/threads/fast-upgrade-raspberry-pi3-from-source.78169/" rel="nofollow">Fast RPI3 upgrade from source (cross compile)</a> 
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/robert%20-%20zfs%20question.md" rel="nofollow">Robert - zfs question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/neb%20-%20AMA%20episode.md" rel="nofollow">Neb - AMA episode.md</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/joe%20-%20puppet.md" rel="nofollow">Joe - puppet</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Routing and Firewalling VLANS with FreeBSD, FreeBSD 12 VNET jail with ZFS howto, pkgsrc-2020Q4 released, FreeBSD on Raspberry Pi 4 With 4GB of RAM, HardenedBSD December 2020 Status Report, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/routing-and-firewalling-vlans-with-freebsd/" rel="nofollow">Routing and Firewalling VLANS with FreeBSD</a></h3>

<blockquote>
<p>In this article we are going to look at and integrate two network isolation technologies, VLANs and VNET. VLANs are common place, and if you have done some network management or design then you are likely to have interacted with them. The second are FreeBSDs VNET virtual network stacks, a powerful network stack isolation technology that gives FreeBSD jails super powers.<br>
Ethernet VLAN (standardised by IEEE 802.1Q) are an extension to Ethernet and provide an essential method for scaling network deployments. They are used in all environments to enable reuse of common infrastructure by isolating portions of networks from each other. VLANs allow the reuse of common cables, switches and routers to carry completely different networks. It is common to have data that must be separated from different networks carried on common cables until their VLAN tags are finally stripped at a gateway switch or router.</p>
</blockquote>

<hr>

<h3><a href="https://www.cyberciti.biz/faq/configuring-freebsd-12-vnet-jail-using-bridgeepair-zfs/" rel="nofollow">How to set up FreeBSD 12 VNET jail with ZFS</a></h3>

<blockquote>
<p>How do I install, set up and configure a FreeBSD 12 jail with VNET on ZFS? How can I create FreeBSD 12 VNET jail with /etc/jail.conf to run OpenVPN, Apache, Wireguard and other Internet-facing services securely on my BSD box?<br>
FreeBSD jail is nothing but operating system-level virtualization that allows partitioning a FreeBSD based Unix server. Such systems have their root user and access rights. Jails can use network subsystem virtualization infrastructure or share an existing network. FreeBSD jails are a powerful way to increase security. Usually, you create jail per services such as an Nginx/Apache webserver with PHP/Perl/Python app, WireGuard/OpeNVPN server, MariaDB/PgSQL server, and more. This page shows how to configure a FreeBSD Jail with vnet and ZFS on FreeBSD 12.x.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-announce/2021/01/08/msg000322.html" rel="nofollow">pkgsrc-2020Q4 released</a></h3>

<blockquote>
<p>The pkgsrc developers are proud to announce the 69th quarterly release<br>
of pkgsrc, the cross-platform packaging system.  pkgsrc is available<br>
with more than 24,000 packages, running on 23 separate platforms; more<br>
information on pkgsrc itself is available at <a href="https://www.pkgsrc.org/" rel="nofollow">https://www.pkgsrc.org/</a></p>
</blockquote>

<hr>

<h3><a href="https://lambdaland.org/posts/2020-12-23_freebsd_rpi4/" rel="nofollow">FreeBSD ON A Raspberry PI 4 With 4GB of RAM</a></h3>

<blockquote>
<p>This is the story of how I managed to get FreeBSD running on a Raspberry Pi 4 with 4GB of RAM, though I think the setup story is pretty similar for those with 2GB and 8GB.1</p>
</blockquote>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-12-31/hardenedbsd-december-2020-status-report" rel="nofollow">HardenedBSD December 2020 Status Report</a></h3>

<blockquote>
<p>Happy New Year! On this the last day of 2020, I submit December&#39;s status report.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=xMijdTWSUEE&feature=youtu.be" rel="nofollow">Christmas Cards The Unix Way - with pic and  troff</a></li>
<li><a href="https://forums.freebsd.org/threads/fast-upgrade-raspberry-pi3-from-source.78169/" rel="nofollow">Fast RPI3 upgrade from source (cross compile)</a> 
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/robert%20-%20zfs%20question.md" rel="nofollow">Robert - zfs question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/neb%20-%20AMA%20episode.md" rel="nofollow">Neb - AMA episode.md</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/joe%20-%20puppet.md" rel="nofollow">Joe - puppet</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>385: Wireguard VPN mesh</title>
  <link>https://www.bsdnow.tv/385</link>
  <guid isPermaLink="false">ec8dd4e8-e1f9-41bd-822b-d1a68799470c</guid>
  <pubDate>Thu, 14 Jan 2021 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ec8dd4e8-e1f9-41bd-822b-d1a68799470c.mp3" length="31123128" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Description: History of FreeBSD: Early Days of FreeBSD, mesh VPN using OpenBSD and WireGuard, FreeBSD Foundation Sponsors LLDB Improvements, Host your Cryptpad web office suite with OpenBSD, and more.</itunes:subtitle>
  <itunes:duration>34:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Description: History of FreeBSD: Early Days of FreeBSD, mesh VPN using OpenBSD and WireGuard, FreeBSD Foundation Sponsors LLDB Improvements, Host your Cryptpad web office suite with OpenBSD, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
History of FreeBSD - Part 3: Early Days of FreeBSD (https://klarasystems.com/articles/history-of-freebsd-part-3-early-days-of-freebsd/?utm_source=bsdnow)
In this third part of our series on the history of FreeBSD, we start tracing the early days of FreeBSD and the events that would eventually shape the project and the future of open source software. 
A mesh VPN using OpenBSD and WireGuard (https://www.tumfatig.net/20201202/a-mesh-vpn-using-openbsd-and-wireguard/?utm_source=bsdnow)
WireGuard is a new coming to OpenBSD 6.8 and it looks like a simple and efficient way to connect computers.
I own a few VPS (hello Vultr, hello OpenBSD.amsterdam) that tend to be connected through filtered public services and/or SSH tunnels. And that’s neither efficient nor easy to manage. Here comes the wg(4) era where all those peers will communicate with a bit more privacy and ease of management.
News Roundup
Foundation Sponsors FreeBSD LLDB Improvements (https://freebsdfoundation.org/blog/guest-blog-foundation-sponsors-freebsd-lldb-improvements/?utm_source=bsdnow)
With FreeBSD Foundation grant, Moritz Systems improved LLDB support for FreeBSD
The LLDB project builds on libraries provided by LLVM and Clang to provide a great modern debugger. It uses the Clang ASTs and the expression parser, LLVM JIT, LLVM disassembler, etc so that it provides an experience that “just works”. It is also blazing fast and more permissively licensed than GDB, the GNU Debugger.
LLDB is the default debugger in Xcode on macOS and supports debugging C, Objective-C, and C++ on the desktop and iOS devices and the simulator.
Host your Cryptpad web office suite with OpenBSD (https://dataswamp.org/~solene/2020-12-14-cryptpad-openbsd.html)
In this article I will explain how to deploy your own Cryptpad instance with OpenBSD. Cryptpad is a web office suite featuring easy real time collaboration on documents. Cryptpad is written in JavaScript and the daemon acts as a web server.
Beastie Bits
OPNsense 20.7.7 Released (https://opnsense.org/opnsense-20-7-7-released/?utm_source=bsdnow)
Introducing OpenZFS 2.0 Webinar - Jan 20th @ noon Eastern  / 17:00 UTC.  (https://klarasystems.com/learning/webinars/webinar-introducing-openzfs-2-0/?utm_source=bsdnow)
BSD In Die Hard (https://www.reddit.com/r/BSD/comments/kk3c6y/merry_xmas/)
Managing jails with Ansible: a showcase for building a container infrastructure on FreeBSD (https://papers.freebsd.org/2019/bsdcan/dengg-managing_jails_with_ansible/)
BSD Hardware (https://bsd-hardware.info)
New WINE chapter in FreeBSD handbook (https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/wine.html)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***
Feedback/Questions
scott- zfs question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/scott-%20zfs%20question)
Bruce - copy paste on esxi (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/Bruce%20-%20copy%20paste%20on%20esxi)
Julian - an apology for Allan (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/Julian%20-%20an%20apology%20for%20Allan)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, history, mesh, vpn, wireguard, lldb, foundation, sponsor, sponsoring, development, debugger, llvm, cryptpad, web office, office suite, web, wine</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Description: History of FreeBSD: Early Days of FreeBSD, mesh VPN using OpenBSD and WireGuard, FreeBSD Foundation Sponsors LLDB Improvements, Host your Cryptpad web office suite with OpenBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/history-of-freebsd-part-3-early-days-of-freebsd/?utm_source=bsdnow" rel="nofollow">History of FreeBSD - Part 3: Early Days of FreeBSD</a></h3>

<blockquote>
<p>In this third part of our series on the history of FreeBSD, we start tracing the early days of FreeBSD and the events that would eventually shape the project and the future of open source software. </p>

<hr>
</blockquote>

<h3><a href="https://www.tumfatig.net/20201202/a-mesh-vpn-using-openbsd-and-wireguard/?utm_source=bsdnow" rel="nofollow">A mesh VPN using OpenBSD and WireGuard</a></h3>

<blockquote>
<p>WireGuard is a new coming to OpenBSD 6.8 and it looks like a simple and efficient way to connect computers.<br>
I own a few VPS (hello Vultr, hello OpenBSD.amsterdam) that tend to be connected through filtered public services and/or SSH tunnels. And that’s neither efficient nor easy to manage. Here comes the wg(4) era where all those peers will communicate with a bit more privacy and ease of management.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://freebsdfoundation.org/blog/guest-blog-foundation-sponsors-freebsd-lldb-improvements/?utm_source=bsdnow" rel="nofollow">Foundation Sponsors FreeBSD LLDB Improvements</a></h3>

<blockquote>
<p>With FreeBSD Foundation grant, Moritz Systems improved LLDB support for FreeBSD<br>
The LLDB project builds on libraries provided by LLVM and Clang to provide a great modern debugger. It uses the Clang ASTs and the expression parser, LLVM JIT, LLVM disassembler, etc so that it provides an experience that “just works”. It is also blazing fast and more permissively licensed than GDB, the GNU Debugger.<br>
LLDB is the default debugger in Xcode on macOS and supports debugging C, Objective-C, and C++ on the desktop and iOS devices and the simulator.</p>

<hr>
</blockquote>

<h3><a href="https://dataswamp.org/%7Esolene/2020-12-14-cryptpad-openbsd.html" rel="nofollow">Host your Cryptpad web office suite with OpenBSD</a></h3>

<blockquote>
<p>In this article I will explain how to deploy your own Cryptpad instance with OpenBSD. Cryptpad is a web office suite featuring easy real time collaboration on documents. Cryptpad is written in JavaScript and the daemon acts as a web server.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://opnsense.org/opnsense-20-7-7-released/?utm_source=bsdnow" rel="nofollow">OPNsense 20.7.7 Released</a></li>
<li><a href="https://klarasystems.com/learning/webinars/webinar-introducing-openzfs-2-0/?utm_source=bsdnow" rel="nofollow">Introducing OpenZFS 2.0 Webinar - Jan 20th @ noon Eastern  / 17:00 UTC. </a></li>
<li><a href="https://www.reddit.com/r/BSD/comments/kk3c6y/merry_xmas/" rel="nofollow">BSD In Die Hard</a></li>
<li><a href="https://papers.freebsd.org/2019/bsdcan/dengg-managing_jails_with_ansible/" rel="nofollow">Managing jails with Ansible: a showcase for building a container infrastructure on FreeBSD</a></li>
<li><a href="https://bsd-hardware.info" rel="nofollow">BSD Hardware</a></li>
<li><a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/wine.html" rel="nofollow">New WINE chapter in FreeBSD handbook</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/scott-%20zfs%20question" rel="nofollow">scott- zfs question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/Bruce%20-%20copy%20paste%20on%20esxi" rel="nofollow">Bruce - copy paste on esxi</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/Julian%20-%20an%20apology%20for%20Allan" rel="nofollow">Julian - an apology for Allan</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Description: History of FreeBSD: Early Days of FreeBSD, mesh VPN using OpenBSD and WireGuard, FreeBSD Foundation Sponsors LLDB Improvements, Host your Cryptpad web office suite with OpenBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/history-of-freebsd-part-3-early-days-of-freebsd/?utm_source=bsdnow" rel="nofollow">History of FreeBSD - Part 3: Early Days of FreeBSD</a></h3>

<blockquote>
<p>In this third part of our series on the history of FreeBSD, we start tracing the early days of FreeBSD and the events that would eventually shape the project and the future of open source software. </p>

<hr>
</blockquote>

<h3><a href="https://www.tumfatig.net/20201202/a-mesh-vpn-using-openbsd-and-wireguard/?utm_source=bsdnow" rel="nofollow">A mesh VPN using OpenBSD and WireGuard</a></h3>

<blockquote>
<p>WireGuard is a new coming to OpenBSD 6.8 and it looks like a simple and efficient way to connect computers.<br>
I own a few VPS (hello Vultr, hello OpenBSD.amsterdam) that tend to be connected through filtered public services and/or SSH tunnels. And that’s neither efficient nor easy to manage. Here comes the wg(4) era where all those peers will communicate with a bit more privacy and ease of management.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://freebsdfoundation.org/blog/guest-blog-foundation-sponsors-freebsd-lldb-improvements/?utm_source=bsdnow" rel="nofollow">Foundation Sponsors FreeBSD LLDB Improvements</a></h3>

<blockquote>
<p>With FreeBSD Foundation grant, Moritz Systems improved LLDB support for FreeBSD<br>
The LLDB project builds on libraries provided by LLVM and Clang to provide a great modern debugger. It uses the Clang ASTs and the expression parser, LLVM JIT, LLVM disassembler, etc so that it provides an experience that “just works”. It is also blazing fast and more permissively licensed than GDB, the GNU Debugger.<br>
LLDB is the default debugger in Xcode on macOS and supports debugging C, Objective-C, and C++ on the desktop and iOS devices and the simulator.</p>

<hr>
</blockquote>

<h3><a href="https://dataswamp.org/%7Esolene/2020-12-14-cryptpad-openbsd.html" rel="nofollow">Host your Cryptpad web office suite with OpenBSD</a></h3>

<blockquote>
<p>In this article I will explain how to deploy your own Cryptpad instance with OpenBSD. Cryptpad is a web office suite featuring easy real time collaboration on documents. Cryptpad is written in JavaScript and the daemon acts as a web server.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://opnsense.org/opnsense-20-7-7-released/?utm_source=bsdnow" rel="nofollow">OPNsense 20.7.7 Released</a></li>
<li><a href="https://klarasystems.com/learning/webinars/webinar-introducing-openzfs-2-0/?utm_source=bsdnow" rel="nofollow">Introducing OpenZFS 2.0 Webinar - Jan 20th @ noon Eastern  / 17:00 UTC. </a></li>
<li><a href="https://www.reddit.com/r/BSD/comments/kk3c6y/merry_xmas/" rel="nofollow">BSD In Die Hard</a></li>
<li><a href="https://papers.freebsd.org/2019/bsdcan/dengg-managing_jails_with_ansible/" rel="nofollow">Managing jails with Ansible: a showcase for building a container infrastructure on FreeBSD</a></li>
<li><a href="https://bsd-hardware.info" rel="nofollow">BSD Hardware</a></li>
<li><a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/wine.html" rel="nofollow">New WINE chapter in FreeBSD handbook</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/scott-%20zfs%20question" rel="nofollow">scott- zfs question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/Bruce%20-%20copy%20paste%20on%20esxi" rel="nofollow">Bruce - copy paste on esxi</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/Julian%20-%20an%20apology%20for%20Allan" rel="nofollow">Julian - an apology for Allan</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>384: In memoriam</title>
  <link>https://www.bsdnow.tv/384</link>
  <guid isPermaLink="false">d48d2da1-bf8e-4f78-bfa3-48eaf73fe14a</guid>
  <pubDate>Thu, 07 Jan 2021 03:45:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d48d2da1-bf8e-4f78-bfa3-48eaf73fe14a.mp3" length="32114304" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Allen K. Briggs Memorial Scholarship, Toward an automated tracking of OpenBSD ports contributions, Trying OpenZFS 2 on FreeBSD 12.2-RELEASE, OpenBSD on TECLAST F7 Plus, Multi-volume support in HAMMER2, and more. </itunes:subtitle>
  <itunes:duration>35:00</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Allen K. Briggs Memorial Scholarship, Toward an automated tracking of OpenBSD ports contributions, Trying OpenZFS 2 on FreeBSD 12.2-RELEASE, OpenBSD on TECLAST F7 Plus, Multi-volume support in HAMMER2, and more. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Allen K. Briggs Memorial Scholarship (http://blog.netbsd.org/tnf/entry/allen_k_briggs_memorial_scholarship)
Allen Briggs was one of the earliest members of the NetBSD community, pursuing his interest in macBSD, and moving to become a NetBSD developer when the two projects merged. Allen was known for his quiet and relaxed manner, and always brought a keen wisdom with him; allied with his acute technical expertise, he was one of the most valued members of the NetBSD community.
The Allen K. Briggs Memorial Scholarship is an endowment to provide scholarships in perpetuity for summer programs at the North Carolina School of Science &amp;amp; Math, which Allen considered to be a place that fundamentally shaped him as a person. We would love to invite Allen's friends and colleagues from the BSD community to donate to this cause so that we can provide more scholarships to students with financial need each year. We are approximately halfway to our goal of $50K with aspirations to exceed that target and fund additional scholarships.
Toward an automated tracking of OpenBSD ports contributions (https://dataswamp.org/~solene/2020-11-15-openbsd-ports-ci.html)
A first step for the CI service would be to create a database of diffs sent to ports. This would allow people to track what has been sent and not yet committed and what the state of the contribution is (build/don’t build, apply/don’t apply).
News Roundup
Trying OpenZFS 2 on FreeBSD 12.2-RELEASE (https://rubenerd.com/trying-openzfs-on-freebsd-12-release/?utm_source=bsdnow)
OpenZFS 2 is a huge achievement, and makes me bullish about the long term prospects for the world’s most trustworthy and nicest to use storage system. You can even use try it today on FreeBSD 12.2-RELEASE, though I recommend tracking -CURRENT for these sorts of features.
OpenBSD on TECLAST F7 Plus (https://www.tumfatig.net/20201215/openbsd-on-teclast-f7-plus/?utm_source=bsdnow)
I got myself a TECLAST F7 Plus laptop. It comes preinstalled with Windows 10 but I planned to use it as my daily driver. So I installed OpenBSD 6.8 on it.
Multi-volume support in HAMMER2 (https://www.dragonflydigest.com/2020/12/28/25287.html)
commit (http://lists.dragonflybsd.org/pipermail/commits/2020-December/770072.html)
&amp;gt; This commit adds initial multi-volumes support for HAMMER2. Maximum supported volumes is 64. The feature and implementation is similar to multi-volumes support in HAMMER1.
***
Beastie Bits
FreeBSD Last SVN Commit (https://svnweb.freebsd.org/base/head/README?view=markup&amp;amp;pathrev=368820)
FreeBSD First git Commit (https://cgit.freebsd.org/src/commit/?id=5ef5f51d2bef80b0ede9b10ad5b0e9440b60518c)
Introducing OpenZFS 2.0 Webinar - Jan 20th @ noon Eastern  / 17:00 UTC.  (https://klarasystems.com/learning/webinars/webinar-introducing-openzfs-2-0/?utm_source=bsdnow)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***
Feedback/Questions
jay - feedback for ian (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/jay%20-%20feedback%20for%20ian)
Iebluefire - concerns about freebsd (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/Iebluefire%20-%20concerns%20about%20freebsd)
mike - zfs cluster aware (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/mike%20-%20zfs%20cluster%20aware)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, Allen Briggs, scholarship, memorial, automated, tracking, ports, contributions, openzfs 2, teclast, f7 plus, multi-volume, hammer2, filesystem</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Allen K. Briggs Memorial Scholarship, Toward an automated tracking of OpenBSD ports contributions, Trying OpenZFS 2 on FreeBSD 12.2-RELEASE, OpenBSD on TECLAST F7 Plus, Multi-volume support in HAMMER2, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/allen_k_briggs_memorial_scholarship" rel="nofollow">Allen K. Briggs Memorial Scholarship</a></h3>

<blockquote>
<p>Allen Briggs was one of the earliest members of the NetBSD community, pursuing his interest in macBSD, and moving to become a NetBSD developer when the two projects merged. Allen was known for his quiet and relaxed manner, and always brought a keen wisdom with him; allied with his acute technical expertise, he was one of the most valued members of the NetBSD community.<br>
The Allen K. Briggs Memorial Scholarship is an endowment to provide scholarships in perpetuity for summer programs at the North Carolina School of Science &amp; Math, which Allen considered to be a place that fundamentally shaped him as a person. We would love to invite Allen&#39;s friends and colleagues from the BSD community to donate to this cause so that we can provide more scholarships to students with financial need each year. We are approximately halfway to our goal of $50K with aspirations to exceed that target and fund additional scholarships.</p>
</blockquote>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2020-11-15-openbsd-ports-ci.html" rel="nofollow">Toward an automated tracking of OpenBSD ports contributions</a></h3>

<blockquote>
<p>A first step for the CI service would be to create a database of diffs sent to ports. This would allow people to track what has been sent and not yet committed and what the state of the contribution is (build/don’t build, apply/don’t apply).</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://rubenerd.com/trying-openzfs-on-freebsd-12-release/?utm_source=bsdnow" rel="nofollow">Trying OpenZFS 2 on FreeBSD 12.2-RELEASE</a></h3>

<blockquote>
<p>OpenZFS 2 is a huge achievement, and makes me bullish about the long term prospects for the world’s most trustworthy and nicest to use storage system. You can even use try it today on FreeBSD 12.2-RELEASE, though I recommend tracking -CURRENT for these sorts of features.</p>

<hr>
</blockquote>

<h3><a href="https://www.tumfatig.net/20201215/openbsd-on-teclast-f7-plus/?utm_source=bsdnow" rel="nofollow">OpenBSD on TECLAST F7 Plus</a></h3>

<blockquote>
<p>I got myself a TECLAST F7 Plus laptop. It comes preinstalled with Windows 10 but I planned to use it as my daily driver. So I installed OpenBSD 6.8 on it.</p>

<hr>
</blockquote>

<h3><a href="https://www.dragonflydigest.com/2020/12/28/25287.html" rel="nofollow">Multi-volume support in HAMMER2</a></h3>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-December/770072.html" rel="nofollow">commit</a>
&gt; This commit adds initial multi-volumes support for HAMMER2. Maximum supported volumes is 64. The feature and implementation is similar to multi-volumes support in HAMMER1.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://svnweb.freebsd.org/base/head/README?view=markup&pathrev=368820" rel="nofollow">FreeBSD Last SVN Commit</a></li>
<li><a href="https://cgit.freebsd.org/src/commit/?id=5ef5f51d2bef80b0ede9b10ad5b0e9440b60518c" rel="nofollow">FreeBSD First git Commit</a></li>
<li><a href="https://klarasystems.com/learning/webinars/webinar-introducing-openzfs-2-0/?utm_source=bsdnow" rel="nofollow">Introducing OpenZFS 2.0 Webinar - Jan 20th @ noon Eastern  / 17:00 UTC. </a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/jay%20-%20feedback%20for%20ian" rel="nofollow">jay - feedback for ian</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/Iebluefire%20-%20concerns%20about%20freebsd" rel="nofollow">Iebluefire - concerns about freebsd</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/mike%20-%20zfs%20cluster%20aware" rel="nofollow">mike - zfs cluster aware</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Allen K. Briggs Memorial Scholarship, Toward an automated tracking of OpenBSD ports contributions, Trying OpenZFS 2 on FreeBSD 12.2-RELEASE, OpenBSD on TECLAST F7 Plus, Multi-volume support in HAMMER2, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/allen_k_briggs_memorial_scholarship" rel="nofollow">Allen K. Briggs Memorial Scholarship</a></h3>

<blockquote>
<p>Allen Briggs was one of the earliest members of the NetBSD community, pursuing his interest in macBSD, and moving to become a NetBSD developer when the two projects merged. Allen was known for his quiet and relaxed manner, and always brought a keen wisdom with him; allied with his acute technical expertise, he was one of the most valued members of the NetBSD community.<br>
The Allen K. Briggs Memorial Scholarship is an endowment to provide scholarships in perpetuity for summer programs at the North Carolina School of Science &amp; Math, which Allen considered to be a place that fundamentally shaped him as a person. We would love to invite Allen&#39;s friends and colleagues from the BSD community to donate to this cause so that we can provide more scholarships to students with financial need each year. We are approximately halfway to our goal of $50K with aspirations to exceed that target and fund additional scholarships.</p>
</blockquote>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2020-11-15-openbsd-ports-ci.html" rel="nofollow">Toward an automated tracking of OpenBSD ports contributions</a></h3>

<blockquote>
<p>A first step for the CI service would be to create a database of diffs sent to ports. This would allow people to track what has been sent and not yet committed and what the state of the contribution is (build/don’t build, apply/don’t apply).</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://rubenerd.com/trying-openzfs-on-freebsd-12-release/?utm_source=bsdnow" rel="nofollow">Trying OpenZFS 2 on FreeBSD 12.2-RELEASE</a></h3>

<blockquote>
<p>OpenZFS 2 is a huge achievement, and makes me bullish about the long term prospects for the world’s most trustworthy and nicest to use storage system. You can even use try it today on FreeBSD 12.2-RELEASE, though I recommend tracking -CURRENT for these sorts of features.</p>

<hr>
</blockquote>

<h3><a href="https://www.tumfatig.net/20201215/openbsd-on-teclast-f7-plus/?utm_source=bsdnow" rel="nofollow">OpenBSD on TECLAST F7 Plus</a></h3>

<blockquote>
<p>I got myself a TECLAST F7 Plus laptop. It comes preinstalled with Windows 10 but I planned to use it as my daily driver. So I installed OpenBSD 6.8 on it.</p>

<hr>
</blockquote>

<h3><a href="https://www.dragonflydigest.com/2020/12/28/25287.html" rel="nofollow">Multi-volume support in HAMMER2</a></h3>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-December/770072.html" rel="nofollow">commit</a>
&gt; This commit adds initial multi-volumes support for HAMMER2. Maximum supported volumes is 64. The feature and implementation is similar to multi-volumes support in HAMMER1.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://svnweb.freebsd.org/base/head/README?view=markup&pathrev=368820" rel="nofollow">FreeBSD Last SVN Commit</a></li>
<li><a href="https://cgit.freebsd.org/src/commit/?id=5ef5f51d2bef80b0ede9b10ad5b0e9440b60518c" rel="nofollow">FreeBSD First git Commit</a></li>
<li><a href="https://klarasystems.com/learning/webinars/webinar-introducing-openzfs-2-0/?utm_source=bsdnow" rel="nofollow">Introducing OpenZFS 2.0 Webinar - Jan 20th @ noon Eastern  / 17:00 UTC. </a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/jay%20-%20feedback%20for%20ian" rel="nofollow">jay - feedback for ian</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/Iebluefire%20-%20concerns%20about%20freebsd" rel="nofollow">Iebluefire - concerns about freebsd</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/mike%20-%20zfs%20cluster%20aware" rel="nofollow">mike - zfs cluster aware</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>383: Scale the tail</title>
  <link>https://www.bsdnow.tv/383</link>
  <guid isPermaLink="false">b40c441d-f217-4771-b172-a1ce68803431</guid>
  <pubDate>Thu, 31 Dec 2020 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b40c441d-f217-4771-b172-a1ce68803431.mp3" length="43810032" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Remote Process Plugin Final Milestone achieved, Tailscale for OpenBSD, macOS to FreeBSD migration, monitoring of our OpenBSD machines, OPNsense 20.7.6 released, and more</itunes:subtitle>
  <itunes:duration>43:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Remote Process Plugin Final Milestone achieved, Tailscale for OpenBSD, macOS to FreeBSD migration, monitoring of our OpenBSD machines, OPNsense 20.7.6 released, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
FreeBSD Remote Process Plugin: Final Milestone Achieved (https://www.moritz.systems/blog/freebsd-remote-plugin-final-milestone-achieved/)
Moritz Systems have been contracted by the FreeBSD Foundation to modernize the LLDB debugger’s support for FreeBSD. We are working on a new plugin utilizing the more modern client-server layout that is already used by Darwin, Linux, NetBSD and (unofficially) OpenBSD. The new plugin is going to gradually replace the legacy one.
Tailscale on OpenBSD (https://rakhesh.com/linux-bsd/tailscale-on-openbsd/)
I spent some time setting this up today evening and thought I’d post the steps here. Nothing fancy, just putting together various pieces actually.
I assume you know what Tailscale is; if not check out their website. Basically it is a mesh network built on top of Wireguard. Using it you can have all your devices both within your LAN(s) and outside be on one overlay network as if they are all on the same LAN and can talk to each other. It’s my new favourite thing!
News Roundup
macOS to FreeBSD migration a.k.a why I left macOS (https://antranigv.am/weblog_en/posts/macos_to_freebsd/)
This is not a technical documentation for how I migrated from macOS to FreeBSD. This is a high-level for why I migrated from macOS to FreeBSD.
Not so long ago, I was using macOS as my daily driver. The main reason why I got a macbook was the underlying BSD Unix and the nice graphics it provides. Also, I have an iPhone. But they were also the same reasons for why I left macOS.
Our monitoring of our OpenBSD machines, such as it is (as of November 2020 (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/OurOpenBSDMonitoring)
We have a number of OpenBSD firewalls in service (along with some other OpenBSD servers for things like VPN endpoints), and I was recently asked how we monitor PF and overall network traffic on them. I had to disappoint the person who asked with my answer, because right now we mostly don't (although this is starting to change).
OPNsense 20.7.6 released (https://opnsense.org/opnsense-20-7-6-released/)
This update brings the usual mix of reliability fixes, plugin and third party software updates: FreeBSD, HardenedBSD, PHP, OpenSSH, StrongSwan, Suricata and Syslog-ng amongst others.
Please note that Let's Encrypt users need to reissue their certificates manually after upgrading to this version to fix the embedded certificate chain issue with the current signing CA switch going on.
NYC Bug Jan 2021 with Michael W. Lucas (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/nycbug)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
cy - .so files (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/cy%20-%20.so%20files)
ben - mixer volume (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/ben%20-%20mixer%20volume)
probono - live cds (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/probono%20-%20live%20cds)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, remote process, remote process plugin, tailscale, migration, monitoring, opnsense</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Remote Process Plugin Final Milestone achieved, Tailscale for OpenBSD, macOS to FreeBSD migration, monitoring of our OpenBSD machines, OPNsense 20.7.6 released, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.moritz.systems/blog/freebsd-remote-plugin-final-milestone-achieved/" rel="nofollow">FreeBSD Remote Process Plugin: Final Milestone Achieved</a></h3>

<blockquote>
<p>Moritz Systems have been contracted by the FreeBSD Foundation to modernize the LLDB debugger’s support for FreeBSD. We are working on a new plugin utilizing the more modern client-server layout that is already used by Darwin, Linux, NetBSD and (unofficially) OpenBSD. The new plugin is going to gradually replace the legacy one.</p>

<hr>

<h3><a href="https://rakhesh.com/linux-bsd/tailscale-on-openbsd/" rel="nofollow">Tailscale on OpenBSD</a></h3>

<p>I spent some time setting this up today evening and thought I’d post the steps here. Nothing fancy, just putting together various pieces actually.<br>
I assume you know what Tailscale is; if not check out their website. Basically it is a mesh network built on top of Wireguard. Using it you can have all your devices both within your LAN(s) and outside be on one overlay network as if they are all on the same LAN and can talk to each other. It’s my new favourite thing!</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://antranigv.am/weblog_en/posts/macos_to_freebsd/" rel="nofollow">macOS to FreeBSD migration a.k.a why I left macOS</a></h3>

<blockquote>
<p>This is not a technical documentation for how I migrated from macOS to FreeBSD. This is a high-level for why I migrated from macOS to FreeBSD.<br>
Not so long ago, I was using macOS as my daily driver. The main reason why I got a macbook was the underlying BSD Unix and the nice graphics it provides. Also, I have an iPhone. But they were also the same reasons for why I left macOS.</p>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OurOpenBSDMonitoring" rel="nofollow">Our monitoring of our OpenBSD machines, such as it is (as of November 2020</a></h3>

<p>We have a number of OpenBSD firewalls in service (along with some other OpenBSD servers for things like VPN endpoints), and I was recently asked how we monitor PF and overall network traffic on them. I had to disappoint the person who asked with my answer, because right now we mostly don&#39;t (although this is starting to change).</p>

<hr>

<h3><a href="https://opnsense.org/opnsense-20-7-6-released/" rel="nofollow">OPNsense 20.7.6 released</a></h3>

<p>This update brings the usual mix of reliability fixes, plugin and third party software updates: FreeBSD, HardenedBSD, PHP, OpenSSH, StrongSwan, Suricata and Syslog-ng amongst others.<br>
Please note that Let&#39;s Encrypt users need to reissue their certificates manually after upgrading to this version to fix the embedded certificate chain issue with the current signing CA switch going on.</p>

<hr>

<h3><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/nycbug" rel="nofollow">NYC Bug Jan 2021 with Michael W. Lucas</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>
</blockquote>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/cy%20-%20.so%20files" rel="nofollow">cy - .so files</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/ben%20-%20mixer%20volume" rel="nofollow">ben - mixer volume</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/probono%20-%20live%20cds" rel="nofollow">probono - live cds</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Remote Process Plugin Final Milestone achieved, Tailscale for OpenBSD, macOS to FreeBSD migration, monitoring of our OpenBSD machines, OPNsense 20.7.6 released, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.moritz.systems/blog/freebsd-remote-plugin-final-milestone-achieved/" rel="nofollow">FreeBSD Remote Process Plugin: Final Milestone Achieved</a></h3>

<blockquote>
<p>Moritz Systems have been contracted by the FreeBSD Foundation to modernize the LLDB debugger’s support for FreeBSD. We are working on a new plugin utilizing the more modern client-server layout that is already used by Darwin, Linux, NetBSD and (unofficially) OpenBSD. The new plugin is going to gradually replace the legacy one.</p>

<hr>

<h3><a href="https://rakhesh.com/linux-bsd/tailscale-on-openbsd/" rel="nofollow">Tailscale on OpenBSD</a></h3>

<p>I spent some time setting this up today evening and thought I’d post the steps here. Nothing fancy, just putting together various pieces actually.<br>
I assume you know what Tailscale is; if not check out their website. Basically it is a mesh network built on top of Wireguard. Using it you can have all your devices both within your LAN(s) and outside be on one overlay network as if they are all on the same LAN and can talk to each other. It’s my new favourite thing!</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://antranigv.am/weblog_en/posts/macos_to_freebsd/" rel="nofollow">macOS to FreeBSD migration a.k.a why I left macOS</a></h3>

<blockquote>
<p>This is not a technical documentation for how I migrated from macOS to FreeBSD. This is a high-level for why I migrated from macOS to FreeBSD.<br>
Not so long ago, I was using macOS as my daily driver. The main reason why I got a macbook was the underlying BSD Unix and the nice graphics it provides. Also, I have an iPhone. But they were also the same reasons for why I left macOS.</p>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OurOpenBSDMonitoring" rel="nofollow">Our monitoring of our OpenBSD machines, such as it is (as of November 2020</a></h3>

<p>We have a number of OpenBSD firewalls in service (along with some other OpenBSD servers for things like VPN endpoints), and I was recently asked how we monitor PF and overall network traffic on them. I had to disappoint the person who asked with my answer, because right now we mostly don&#39;t (although this is starting to change).</p>

<hr>

<h3><a href="https://opnsense.org/opnsense-20-7-6-released/" rel="nofollow">OPNsense 20.7.6 released</a></h3>

<p>This update brings the usual mix of reliability fixes, plugin and third party software updates: FreeBSD, HardenedBSD, PHP, OpenSSH, StrongSwan, Suricata and Syslog-ng amongst others.<br>
Please note that Let&#39;s Encrypt users need to reissue their certificates manually after upgrading to this version to fix the embedded certificate chain issue with the current signing CA switch going on.</p>

<hr>

<h3><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/nycbug" rel="nofollow">NYC Bug Jan 2021 with Michael W. Lucas</a></h3>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>
</blockquote>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/cy%20-%20.so%20files" rel="nofollow">cy - .so files</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/ben%20-%20mixer%20volume" rel="nofollow">ben - mixer volume</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/probono%20-%20live%20cds" rel="nofollow">probono - live cds</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>382: BSDNow Q&amp;A 2020</title>
  <link>https://www.bsdnow.tv/382</link>
  <guid isPermaLink="false">34202bd5-f96c-4d8a-9e18-5a8eb3c26e56</guid>
  <pubDate>Thu, 24 Dec 2020 06:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/34202bd5-f96c-4d8a-9e18-5a8eb3c26e56.mp3" length="63242832" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We asked for it, you answered our call. This episode features you interviewing us with questions that you sent in. JT, Allan, and Benedict answer everything that you ever wanted to know in this week’s special episode of BSDNow.</itunes:subtitle>
  <itunes:duration>1:06:51</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We asked for it, you answered our call. This episode features you interviewing us with questions that you sent in. JT, Allan, and Benedict answer everything that you ever wanted to know in this week’s special episode of BSDNow.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Interview - Allan Jude - Allan.jude@gmail.com (Allan.jude@gmail.com) / @allanjude (https://twitter.com/allanjude)
Interview - Benedict Reuschling - bcr@freebsd.org (mailto:bcr@freebsd.org) / @bsdbcr (https://twitter.com/bsdbcr)
Interview - JT Pennington - jt@obs-sec.com (mailto:jt@obs-sec.com) / @q5sys (https://twitter.com/q5sys)
AMA questions
Benedict:  You work at a university right?  Were you already into tech before you started working there?  What do you do there?
Yes, I do work at the University of Applied Sciences, Darmstadt, Germany. I’m a lab engineer there (without a lab, but with a big data cluster). I teach in the winter semester an undergraduate, elective course called “Unix for Developers”. Yes, I was already in tech by that time. Did some previous work at companies before (selling hardware at the call-in hotline and later in the store) and during my CS studies.
Allan:  What’s the next big FreeBSD Project you plan on doing?
JT:  How did you get involved in BSD?  Weren't you a Linux guy?
All: Is there any way you can create an entire episode of BSDnow on hardware that runs OpenBSD and FreeBSD?  We see you audacity, etc on a mac.
Benedict: Not sure about OpenBSD (don’t use it), but FreeBSD should be doable for my part. If we switch from Skype to a different video chat tool, the rest is already there. Production side may be more difficult, but not impossible.
All: if you could finish up one project right now... what would it be?
Benedict: Updated ZFS chapter in the FreeBSD handbook.
All: How did all of you guys meet?
All: My question is, do you guys use FreeBSD as your main desktop OS?  If not, what do you use?
Benedict: No, but Mac OS is close enough. Doing a lot of SSHing into FreeBSD from there.
All: Can you all give us the best shot of outside of their windows?
JT’s answer: https://photos.smugmug.com/photos/i-2LSbspL/0/69437dbb/5K/i-2LSbspL-5K.jpg
    Allan: https://photos.app.goo.gl/UnKXnKMt6cn8FDhNA
    Benedict: No, it’s dark outside anyway. ;-)
All: How old were you when you got your first computer and what was that computer?
Allan: 12 or 13, a 486DX2/66hz with an insane 32mb of RAM, 400 and 500 MB SCSI HDDs, 14400 baud model, and a 1.7x CD rom drive
Benedict: Around 13 or so. 386DX2, 4 MB RAM, IDE disk drive (no idea how big, but it wasn’t much), 3.5” floppy, DOS, and a lot of games.
JT: Technically the first was a Atari 1200XL with a 6502 CPU running at 1.79 MHz 64KB RAM.  It had it's own OS and you could load programs off of either cartridges, floppy disks, or cassette tapes. First PC Clone was a Packard Bell with a 386 and 1mb ram which later was upgraded to 4mb and a Dual speed CD-ROM.  My dad got me a Compaq 286 laptop... this one (show)... a year or so later because he got tired of fighting me for the computer.
All: Can we have a peek at your bookcase and what books are there?
Allan: No picture handy, but my shelf is pretty small, mostly a collection of autographed FreeBSD books. I have D&amp;amp;I with all 3 autographs (took some travel to acquire), and a copy of my first book (FreeBSD Mastery: ZFS) autographed by Jeff Bonwick and Matt Ahrens, the creators of ZFS, plus a bunch of other big names in ZFS like George Wilson.
JT’s answer: So... my library is packed away... but here’s about half of it... the rest is still in storage. https://photos.smugmug.com/photos/i-SBG2KDv/0/0b9856b8/4K/i-SBG2KDv-4K.jpg
Software Collection: https://photos.smugmug.com/photos/i-HfTVPN9/0/ad610dd4/O/i-HfTVPN9.jpg
Benedict: A mix of FreeBSD books (by MWL), the graveyard book, 4 hour work week, the once and future king (took me a long time to finish that one), Total Immersion swimming (still learning to swim) and some books in german language, fiction and tech. Groff lives in there while the pandemic lasts.
All: What desktop/Window Manager/shell do each of you primarily use?
Benedict: Mainly Mac OS, when on FreeBSD it’s i3. Zsh with zsh-autosuggestions currently.
JT: Lumina/zsh
Allan: Lumina and tcsh, want to learn zsh but never gotten time to change
All: What spoken languages do you speak?
    Benedict: German and English (obviously), learning a bit of Spanish via Duolingo at the moment
    JT: English, Bad English, and some French.
All: Do you have Non-Computer hobbies if so what are those?
    Benedict: Tai Chi Chuan (Yang Style)
JT: I'd say photography, but that's a job for me.  I have a lot of varied interests, Krav Maga, working on my VW Corrado, working on the old Victorian house I bought, and camping/backpacking. Ive done the northern half of the AT (Appalachian Trail, I want to finish it up and then do the PCT and CDT. (Pacific Crest Trail and Continental Divide Trail).
All: When COVID passes, when are either of you are coming to BSD pizza night in Portland, OR, USA so I can buy you a beer/wine/whisky or pizza/coffee/tea (or six)
Rapid Fire:
All: What was the first car you ever owned?
All: Do you own a vehicle and if so what is the make/model?
All: Favorite Star franchise? Star Wars, Star Trek, Stargate, Battlestar, etc.
JT:  Will you ever host any more BSDNow episodes?
All: Favorite superhero? Marvel and/or DC.
All: Favorite game(s) of all time?
All: Pants or no pants on virtual meetings/presentations?
All: Do you or have you used alternative operating systems that are not "main stream or is considered retro" if so what are those?
All: Who has more animals at home?
Allan: Does Allan have any batteries for his tetris cubes? Can we see that thing light up?
Allan and Benedict:  Are you guys going to go on JT's new show?
If you’re wondering what show this is, here are the two shows Im a host of:
https://www.opensourcevoices.org &amp;amp; https://www.theopiniondominion.org
Allan and Benedict: Have Allan or Benedict lost anything on the way to and from a conference?
Benedict: Is Benedict going to do his NOEL blocks again?
Benedict: Does Benedict make his bed every Wednesday morning?  It always looks great!
Not just Wednesdays, but pretty much every day. Here, watch this: https://www.youtube.com/watch?v=GKZRFDCbGTA Nuff said. ;-)
JT: Are you batman because the episodes are always awesome sir so thank you
JT’s answer: Can you ever admit to being batman?  If I were batman wouldn't I have to deny it?
All: What's your Daily Driver Hardware?
All: Who has more servers or VMs at home?
Benedict: Allan, easily
JT: Allan definitely beats me with VMs, but I think I might give him a run on servers.  4x 4u HP DL580s, one HP DL980, three HP C3000 8 bay bladecenters, three HP C7000 16 bay Bladecenters, 2x Sun 280R, bunch of Dell and IBM 1Us… but all my stuff is old.  Allan has all the new and shiny stuff.
The Pile in the Kitchen: https://photos.smugmug.com/photos/i-HBScrpk/0/4b058cc5/X2/i-HBScrpk-X2.jpg
The other pile: https://photos.smugmug.com/photos/i-wNxFszV/0/e7a4b2d6/X2/i-wNxFszV-X2.jpg
All: What book(s) are you currently reading?
Benedict: Antifragile by Nassim Taleb
JT: Douglas Hofstader - Gödel, Escher, Bach: An Eternal Golden Braid. Douglas Rushkoff - program or be programmed. Also a 4 part book series on the American civil war written in the 1880s, by people in the civil war.
All: Favorite mechanical keyboard switch? Cherry MX, Kalih, Gateron, etc.
Benedict: Cherry MX brown currently
    Allan: Cherry MX Blue (Coolermaster Master Keys Pro-L)
    JT: I prefer scissor switches, so I use a Logitech K740.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We asked for it, you answered our call. This episode features you interviewing us with questions that you sent in. JT, Allan, and Benedict answer everything that you ever wanted to know in this week’s special episode of BSDNow.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Interview - Allan Jude - [<a href="mailto:Allan.jude@gmail.com" rel="nofollow">Allan.jude@gmail.com</a>](<a href="mailto:Allan.jude@gmail.com" rel="nofollow">Allan.jude@gmail.com</a>) / <a href="https://twitter.com/allanjude" rel="nofollow">@allanjude</a></h2>

<h2>Interview - Benedict Reuschling - <a href="mailto:bcr@freebsd.org" rel="nofollow">bcr@freebsd.org</a> / <a href="https://twitter.com/bsdbcr" rel="nofollow">@bsdbcr</a></h2>

<h2>Interview - JT Pennington - <a href="mailto:jt@obs-sec.com" rel="nofollow">jt@obs-sec.com</a> / <a href="https://twitter.com/q5sys" rel="nofollow">@q5sys</a></h2>

<h3>AMA questions</h3>

<p>Benedict:  You work at a university right?  Were you already into tech before you started working there?  What do you do there?<br>
Yes, I do work at the University of Applied Sciences, Darmstadt, Germany. I’m a lab engineer there (without a lab, but with a big data cluster). I teach in the winter semester an undergraduate, elective course called “Unix for Developers”. Yes, I was already in tech by that time. Did some previous work at companies before (selling hardware at the call-in hotline and later in the store) and during my CS studies.<br>
Allan:  What’s the next big FreeBSD Project you plan on doing?</p>

<p>JT:  How did you get involved in BSD?  Weren&#39;t you a Linux guy?</p>

<p>All: Is there any way you can create an entire episode of BSDnow on hardware that runs OpenBSD and FreeBSD?  We see you audacity, etc on a mac.<br>
Benedict: Not sure about OpenBSD (don’t use it), but FreeBSD should be doable for my part. If we switch from Skype to a different video chat tool, the rest is already there. Production side may be more difficult, but not impossible.</p>

<p>All: if you could finish up one project right now... what would it be?<br>
Benedict: Updated ZFS chapter in the FreeBSD handbook.</p>

<p>All: How did all of you guys meet?</p>

<p>All: My question is, do you guys use FreeBSD as your main <em>desktop</em> OS?  If not, what do you use?<br>
Benedict: No, but Mac OS is close enough. Doing a lot of SSHing into FreeBSD from there.<br>
All: Can you all give us the best shot of outside of their windows?<br>
JT’s answer: <a href="https://photos.smugmug.com/photos/i-2LSbspL/0/69437dbb/5K/i-2LSbspL-5K.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-2LSbspL/0/69437dbb/5K/i-2LSbspL-5K.jpg</a><br>
    Allan: <a href="https://photos.app.goo.gl/UnKXnKMt6cn8FDhNA" rel="nofollow">https://photos.app.goo.gl/UnKXnKMt6cn8FDhNA</a><br>
    Benedict: No, it’s dark outside anyway. ;-)</p>

<p>All: How old were you when you got your first computer and what was that computer?<br>
Allan: 12 or 13, a 486DX2/66hz with an insane 32mb of RAM, 400 and 500 MB SCSI HDDs, 14400 baud model, and a 1.7x CD rom drive<br>
Benedict: Around 13 or so. 386DX2, 4 MB RAM, IDE disk drive (no idea how big, but it wasn’t much), 3.5” floppy, DOS, and a lot of games.<br>
JT: Technically the first was a Atari 1200XL with a 6502 CPU running at 1.79 MHz 64KB RAM.  It had it&#39;s own OS and you could load programs off of either cartridges, floppy disks, or cassette tapes. First PC Clone was a Packard Bell with a 386 and 1mb ram which later was upgraded to 4mb and a Dual speed CD-ROM.  My dad got me a Compaq 286 laptop... this one (show)... a year or so later because he got tired of fighting me for the computer.</p>

<p>All: Can we have a peek at your bookcase and what books are there?<br>
Allan: No picture handy, but my shelf is pretty small, mostly a collection of autographed FreeBSD books. I have D&amp;I with all 3 autographs (took some travel to acquire), and a copy of my first book (FreeBSD Mastery: ZFS) autographed by Jeff Bonwick and Matt Ahrens, the creators of ZFS, plus a bunch of other big names in ZFS like George Wilson.<br>
JT’s answer: So... my library is packed away... but here’s about half of it... the rest is still in storage. <a href="https://photos.smugmug.com/photos/i-SBG2KDv/0/0b9856b8/4K/i-SBG2KDv-4K.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-SBG2KDv/0/0b9856b8/4K/i-SBG2KDv-4K.jpg</a><br>
Software Collection: <a href="https://photos.smugmug.com/photos/i-HfTVPN9/0/ad610dd4/O/i-HfTVPN9.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-HfTVPN9/0/ad610dd4/O/i-HfTVPN9.jpg</a><br>
Benedict: A mix of FreeBSD books (by MWL), the graveyard book, 4 hour work week, the once and future king (took me a long time to finish that one), Total Immersion swimming (still learning to swim) and some books in german language, fiction and tech. Groff lives in there while the pandemic lasts.</p>

<p>All: What desktop/Window Manager/shell do each of you primarily use?<br>
Benedict: Mainly Mac OS, when on FreeBSD it’s i3. Zsh with zsh-autosuggestions currently.<br>
JT: Lumina/zsh<br>
Allan: Lumina and tcsh, want to learn zsh but never gotten time to change</p>

<p>All: What spoken languages do you speak?<br>
    Benedict: German and English (obviously), learning a bit of Spanish via Duolingo at the moment<br>
    JT: English, Bad English, and some French.<br>
All: Do you have Non-Computer hobbies if so what are those?<br>
    Benedict: Tai Chi Chuan (Yang Style)<br>
JT: I&#39;d say photography, but that&#39;s a job for me.  I have a lot of varied interests, Krav Maga, working on my VW Corrado, working on the old Victorian house I bought, and camping/backpacking. Ive done the northern half of the AT (Appalachian Trail, I want to finish it up and then do the PCT and CDT. (Pacific Crest Trail and Continental Divide Trail).</p>

<p>All: When COVID passes, when are either of you are coming to BSD pizza night in Portland, OR, USA so I can buy you a beer/wine/whisky or pizza/coffee/tea (or six)</p>

<h3>Rapid Fire:</h3>

<p>All: What was the first car you ever owned?</p>

<p>All: Do you own a vehicle and if so what is the make/model?</p>

<p>All: Favorite Star franchise? Star Wars, Star Trek, Stargate, Battlestar, etc.</p>

<p>JT:  Will you ever host any more BSDNow episodes?</p>

<p>All: Favorite superhero? Marvel and/or DC.</p>

<p>All: Favorite game(s) of all time?</p>

<p>All: Pants or no pants on virtual meetings/presentations?</p>

<p>All: Do you or have you used alternative operating systems that are not &quot;main stream or is considered retro&quot; if so what are those?</p>

<p>All: Who has more animals at home?</p>

<p>Allan: Does Allan have any batteries for his tetris cubes? Can we see that thing light up?</p>

<p>Allan and Benedict:  Are you guys going to go on JT&#39;s new show?</p>

<p>If you’re wondering what show this is, here are the two shows Im a host of:</p>

<p><a href="https://www.opensourcevoices.org" rel="nofollow">https://www.opensourcevoices.org</a> &amp; <a href="https://www.theopiniondominion.org" rel="nofollow">https://www.theopiniondominion.org</a></p>

<p>Allan and Benedict: Have Allan or Benedict lost anything on the way to and from a conference?</p>

<p>Benedict: Is Benedict going to do his NOEL blocks again?</p>

<p>Benedict: Does Benedict make his bed every Wednesday morning?  It always looks great!<br>
Not just Wednesdays, but pretty much every day. Here, watch this: <a href="https://www.youtube.com/watch?v=GKZRFDCbGTA" rel="nofollow">https://www.youtube.com/watch?v=GKZRFDCbGTA</a> Nuff said. ;-)<br>
JT: Are you batman because the episodes are always awesome sir so thank you<br>
JT’s answer: Can you ever admit to being batman?  If I were batman wouldn&#39;t I have to deny it?</p>

<p>All: What&#39;s your Daily Driver Hardware?</p>

<p>All: Who has more servers or VMs at home?<br>
Benedict: Allan, easily<br>
JT: Allan definitely beats me with VMs, but I think I might give him a run on servers.  4x 4u HP DL580s, one HP DL980, three HP C3000 8 bay bladecenters, three HP C7000 16 bay Bladecenters, 2x Sun 280R, bunch of Dell and IBM 1Us… but all my stuff is old.  Allan has all the new and shiny stuff.<br>
The Pile in the Kitchen: <a href="https://photos.smugmug.com/photos/i-HBScrpk/0/4b058cc5/X2/i-HBScrpk-X2.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-HBScrpk/0/4b058cc5/X2/i-HBScrpk-X2.jpg</a><br>
The other pile: <a href="https://photos.smugmug.com/photos/i-wNxFszV/0/e7a4b2d6/X2/i-wNxFszV-X2.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-wNxFszV/0/e7a4b2d6/X2/i-wNxFszV-X2.jpg</a></p>

<p>All: What book(s) are you currently reading?<br>
Benedict: Antifragile by Nassim Taleb<br>
JT: Douglas Hofstader - Gödel, Escher, Bach: An Eternal Golden Braid. Douglas Rushkoff - program or be programmed. Also a 4 part book series on the American civil war written in the 1880s, by people in the civil war.</p>

<p>All: Favorite mechanical keyboard switch? Cherry MX, Kalih, Gateron, etc.<br>
Benedict: Cherry MX brown currently<br>
    Allan: Cherry MX Blue (Coolermaster Master Keys Pro-L)<br>
    JT: I prefer scissor switches, so I use a Logitech K740.</p>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We asked for it, you answered our call. This episode features you interviewing us with questions that you sent in. JT, Allan, and Benedict answer everything that you ever wanted to know in this week’s special episode of BSDNow.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Interview - Allan Jude - [<a href="mailto:Allan.jude@gmail.com" rel="nofollow">Allan.jude@gmail.com</a>](<a href="mailto:Allan.jude@gmail.com" rel="nofollow">Allan.jude@gmail.com</a>) / <a href="https://twitter.com/allanjude" rel="nofollow">@allanjude</a></h2>

<h2>Interview - Benedict Reuschling - <a href="mailto:bcr@freebsd.org" rel="nofollow">bcr@freebsd.org</a> / <a href="https://twitter.com/bsdbcr" rel="nofollow">@bsdbcr</a></h2>

<h2>Interview - JT Pennington - <a href="mailto:jt@obs-sec.com" rel="nofollow">jt@obs-sec.com</a> / <a href="https://twitter.com/q5sys" rel="nofollow">@q5sys</a></h2>

<h3>AMA questions</h3>

<p>Benedict:  You work at a university right?  Were you already into tech before you started working there?  What do you do there?<br>
Yes, I do work at the University of Applied Sciences, Darmstadt, Germany. I’m a lab engineer there (without a lab, but with a big data cluster). I teach in the winter semester an undergraduate, elective course called “Unix for Developers”. Yes, I was already in tech by that time. Did some previous work at companies before (selling hardware at the call-in hotline and later in the store) and during my CS studies.<br>
Allan:  What’s the next big FreeBSD Project you plan on doing?</p>

<p>JT:  How did you get involved in BSD?  Weren&#39;t you a Linux guy?</p>

<p>All: Is there any way you can create an entire episode of BSDnow on hardware that runs OpenBSD and FreeBSD?  We see you audacity, etc on a mac.<br>
Benedict: Not sure about OpenBSD (don’t use it), but FreeBSD should be doable for my part. If we switch from Skype to a different video chat tool, the rest is already there. Production side may be more difficult, but not impossible.</p>

<p>All: if you could finish up one project right now... what would it be?<br>
Benedict: Updated ZFS chapter in the FreeBSD handbook.</p>

<p>All: How did all of you guys meet?</p>

<p>All: My question is, do you guys use FreeBSD as your main <em>desktop</em> OS?  If not, what do you use?<br>
Benedict: No, but Mac OS is close enough. Doing a lot of SSHing into FreeBSD from there.<br>
All: Can you all give us the best shot of outside of their windows?<br>
JT’s answer: <a href="https://photos.smugmug.com/photos/i-2LSbspL/0/69437dbb/5K/i-2LSbspL-5K.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-2LSbspL/0/69437dbb/5K/i-2LSbspL-5K.jpg</a><br>
    Allan: <a href="https://photos.app.goo.gl/UnKXnKMt6cn8FDhNA" rel="nofollow">https://photos.app.goo.gl/UnKXnKMt6cn8FDhNA</a><br>
    Benedict: No, it’s dark outside anyway. ;-)</p>

<p>All: How old were you when you got your first computer and what was that computer?<br>
Allan: 12 or 13, a 486DX2/66hz with an insane 32mb of RAM, 400 and 500 MB SCSI HDDs, 14400 baud model, and a 1.7x CD rom drive<br>
Benedict: Around 13 or so. 386DX2, 4 MB RAM, IDE disk drive (no idea how big, but it wasn’t much), 3.5” floppy, DOS, and a lot of games.<br>
JT: Technically the first was a Atari 1200XL with a 6502 CPU running at 1.79 MHz 64KB RAM.  It had it&#39;s own OS and you could load programs off of either cartridges, floppy disks, or cassette tapes. First PC Clone was a Packard Bell with a 386 and 1mb ram which later was upgraded to 4mb and a Dual speed CD-ROM.  My dad got me a Compaq 286 laptop... this one (show)... a year or so later because he got tired of fighting me for the computer.</p>

<p>All: Can we have a peek at your bookcase and what books are there?<br>
Allan: No picture handy, but my shelf is pretty small, mostly a collection of autographed FreeBSD books. I have D&amp;I with all 3 autographs (took some travel to acquire), and a copy of my first book (FreeBSD Mastery: ZFS) autographed by Jeff Bonwick and Matt Ahrens, the creators of ZFS, plus a bunch of other big names in ZFS like George Wilson.<br>
JT’s answer: So... my library is packed away... but here’s about half of it... the rest is still in storage. <a href="https://photos.smugmug.com/photos/i-SBG2KDv/0/0b9856b8/4K/i-SBG2KDv-4K.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-SBG2KDv/0/0b9856b8/4K/i-SBG2KDv-4K.jpg</a><br>
Software Collection: <a href="https://photos.smugmug.com/photos/i-HfTVPN9/0/ad610dd4/O/i-HfTVPN9.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-HfTVPN9/0/ad610dd4/O/i-HfTVPN9.jpg</a><br>
Benedict: A mix of FreeBSD books (by MWL), the graveyard book, 4 hour work week, the once and future king (took me a long time to finish that one), Total Immersion swimming (still learning to swim) and some books in german language, fiction and tech. Groff lives in there while the pandemic lasts.</p>

<p>All: What desktop/Window Manager/shell do each of you primarily use?<br>
Benedict: Mainly Mac OS, when on FreeBSD it’s i3. Zsh with zsh-autosuggestions currently.<br>
JT: Lumina/zsh<br>
Allan: Lumina and tcsh, want to learn zsh but never gotten time to change</p>

<p>All: What spoken languages do you speak?<br>
    Benedict: German and English (obviously), learning a bit of Spanish via Duolingo at the moment<br>
    JT: English, Bad English, and some French.<br>
All: Do you have Non-Computer hobbies if so what are those?<br>
    Benedict: Tai Chi Chuan (Yang Style)<br>
JT: I&#39;d say photography, but that&#39;s a job for me.  I have a lot of varied interests, Krav Maga, working on my VW Corrado, working on the old Victorian house I bought, and camping/backpacking. Ive done the northern half of the AT (Appalachian Trail, I want to finish it up and then do the PCT and CDT. (Pacific Crest Trail and Continental Divide Trail).</p>

<p>All: When COVID passes, when are either of you are coming to BSD pizza night in Portland, OR, USA so I can buy you a beer/wine/whisky or pizza/coffee/tea (or six)</p>

<h3>Rapid Fire:</h3>

<p>All: What was the first car you ever owned?</p>

<p>All: Do you own a vehicle and if so what is the make/model?</p>

<p>All: Favorite Star franchise? Star Wars, Star Trek, Stargate, Battlestar, etc.</p>

<p>JT:  Will you ever host any more BSDNow episodes?</p>

<p>All: Favorite superhero? Marvel and/or DC.</p>

<p>All: Favorite game(s) of all time?</p>

<p>All: Pants or no pants on virtual meetings/presentations?</p>

<p>All: Do you or have you used alternative operating systems that are not &quot;main stream or is considered retro&quot; if so what are those?</p>

<p>All: Who has more animals at home?</p>

<p>Allan: Does Allan have any batteries for his tetris cubes? Can we see that thing light up?</p>

<p>Allan and Benedict:  Are you guys going to go on JT&#39;s new show?</p>

<p>If you’re wondering what show this is, here are the two shows Im a host of:</p>

<p><a href="https://www.opensourcevoices.org" rel="nofollow">https://www.opensourcevoices.org</a> &amp; <a href="https://www.theopiniondominion.org" rel="nofollow">https://www.theopiniondominion.org</a></p>

<p>Allan and Benedict: Have Allan or Benedict lost anything on the way to and from a conference?</p>

<p>Benedict: Is Benedict going to do his NOEL blocks again?</p>

<p>Benedict: Does Benedict make his bed every Wednesday morning?  It always looks great!<br>
Not just Wednesdays, but pretty much every day. Here, watch this: <a href="https://www.youtube.com/watch?v=GKZRFDCbGTA" rel="nofollow">https://www.youtube.com/watch?v=GKZRFDCbGTA</a> Nuff said. ;-)<br>
JT: Are you batman because the episodes are always awesome sir so thank you<br>
JT’s answer: Can you ever admit to being batman?  If I were batman wouldn&#39;t I have to deny it?</p>

<p>All: What&#39;s your Daily Driver Hardware?</p>

<p>All: Who has more servers or VMs at home?<br>
Benedict: Allan, easily<br>
JT: Allan definitely beats me with VMs, but I think I might give him a run on servers.  4x 4u HP DL580s, one HP DL980, three HP C3000 8 bay bladecenters, three HP C7000 16 bay Bladecenters, 2x Sun 280R, bunch of Dell and IBM 1Us… but all my stuff is old.  Allan has all the new and shiny stuff.<br>
The Pile in the Kitchen: <a href="https://photos.smugmug.com/photos/i-HBScrpk/0/4b058cc5/X2/i-HBScrpk-X2.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-HBScrpk/0/4b058cc5/X2/i-HBScrpk-X2.jpg</a><br>
The other pile: <a href="https://photos.smugmug.com/photos/i-wNxFszV/0/e7a4b2d6/X2/i-wNxFszV-X2.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-wNxFszV/0/e7a4b2d6/X2/i-wNxFszV-X2.jpg</a></p>

<p>All: What book(s) are you currently reading?<br>
Benedict: Antifragile by Nassim Taleb<br>
JT: Douglas Hofstader - Gödel, Escher, Bach: An Eternal Golden Braid. Douglas Rushkoff - program or be programmed. Also a 4 part book series on the American civil war written in the 1880s, by people in the civil war.</p>

<p>All: Favorite mechanical keyboard switch? Cherry MX, Kalih, Gateron, etc.<br>
Benedict: Cherry MX brown currently<br>
    Allan: Cherry MX Blue (Coolermaster Master Keys Pro-L)<br>
    JT: I prefer scissor switches, so I use a Logitech K740.</p>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>381: Shell origins</title>
  <link>https://www.bsdnow.tv/381</link>
  <guid isPermaLink="false">51b9f9e5-6af6-41d0-9e2a-01b51b1c6399</guid>
  <pubDate>Thu, 17 Dec 2020 06:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/51b9f9e5-6af6-41d0-9e2a-01b51b1c6399.mp3" length="39764064" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Origin of the Shell, Return to Plan 9, ArisbluBSD: Why a new BSD?, OPNsense 20.7.5 released, Midnight BSD 2.0 Release Status, HardenedBSD November 2020 Status Report, and more.</itunes:subtitle>
  <itunes:duration>41:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Origin of the Shell, Return to Plan 9, ArisbluBSD: Why a new BSD?, OPNsense 20.7.5 released, Midnight BSD 2.0 Release Status, HardenedBSD November 2020 Status Report, and more. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
The Origin of the Shell (https://multicians.org/shell.html)
CTSS was developed during 1963 and 64. I was at MIT on the computer center staff at that time. After having written dozens of commands for CTSS, I reached the stage where I felt that commands should be usable as building blocks for writing more commands, just like subroutine libraries. Hence, I wrote "RUNCOM", a sort of shell driving the execution of command scripts, with argument substitution. The tool became instantly most popular, as it became possible to go home in the evening while leaving behind long runcoms executing overnight. It was quite neat for boring and repetitive tasks such as renaming, moving, updating, compiling, etc. whole directories of files for system and application maintenance and monitoring.
Return to Plan 9 (https://boxbase.org/entries/2020/nov/1/return-to-plan9/)
Plan 9 from Bell Labs has held the same charm after my last visit that took a few days. This time I'll keep this operating system in an emulator where I can explore into it when I am distracted.
News Roundup
Why a new BSD? (https://blog.fivnex.co/2020/11/arisblubsd-why-new-bsd.html)
This article is to explain some decisions and plans made by the ArisbluBSD team, why we are making our own thing, and what the plan is for the OS. We mainly want to talk about five things: desktop, package management, software availability, custom software, and the future of the OS. We mostly want to explain what the goal of the OS is, and how we plan to expand in the near future. Without further ado, let's explain ArisbluBSD's plan.
OPNsense 20.7.5 released (https://opnsense.org/opnsense-20-7-5-released/)
We return briefly for a small patch set and plan to pin the 20.1 upgrade path to this particular version to avoid unnecessary stepping stones. We wish you all a healthy Friday. And of course: patch responsibly!
Midnight BSD 2.0 Release Status (https://www.justjournal.com/users/mbsd/entry/33841)
We identified some issues with the 2.0 ISOs slated for release with the ZFS bootloader not working. 
Until this issue is resolved, we are unable to build release ISOs. We've left the old ones up as they work fine for anyone using UFS.
HardenedBSD November 2020 Status Report (https://hardenedbsd.org/article/shawn-webb/2020-11-25/hardenedbsd-november-2020-status-report)
We're getting close to the end of November. My wife and I have plans this weekend, so I thought I'd take the time to write November's status report today.
Beastie Bits
• [rga: ripgrep, but also search in PDFs, E-Books, Office documents, zip, tar.gz, etc.](https://phiresky.github.io/blog/2019/rga--ripgrep-for-zip-targz-docx-odt-epub-jpg/)
• [exa - A modern replacement for ls](https://the.exa.website/)
• [The myriad meanings of pwd in Unix systems](https://qmacro.org/2020/11/08/the-meaning-of-pwd-in-unix-systems/)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Karl - Camera Help (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/Karl%20-%20camera%20help.md)
Alejandro - domain registrar (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/alejandro%20-%20domain%20registrar.md)
Johnny - thoughts on 372 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/Johnny%20-%20thoughts%20on%20372)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, origin, shell, plan 9, arisblubsd, opnsense 20.7.5, midnightbsd 2.0, hardenedbsd, status report, status, report</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Origin of the Shell, Return to Plan 9, ArisbluBSD: Why a new BSD?, OPNsense 20.7.5 released, Midnight BSD 2.0 Release Status, HardenedBSD November 2020 Status Report, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://multicians.org/shell.html" rel="nofollow">The Origin of the Shell</a></h3>

<blockquote>
<p>CTSS was developed during 1963 and 64. I was at MIT on the computer center staff at that time. After having written dozens of commands for CTSS, I reached the stage where I felt that commands should be usable as building blocks for writing more commands, just like subroutine libraries. Hence, I wrote &quot;RUNCOM&quot;, a sort of shell driving the execution of command scripts, with argument substitution. The tool became instantly most popular, as it became possible to go home in the evening while leaving behind long runcoms executing overnight. It was quite neat for boring and repetitive tasks such as renaming, moving, updating, compiling, etc. whole directories of files for system and application maintenance and monitoring.</p>

<hr>
</blockquote>

<h3><a href="https://boxbase.org/entries/2020/nov/1/return-to-plan9/" rel="nofollow">Return to Plan 9</a></h3>

<blockquote>
<p>Plan 9 from Bell Labs has held the same charm after my last visit that took a few days. This time I&#39;ll keep this operating system in an emulator where I can explore into it when I am distracted.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://blog.fivnex.co/2020/11/arisblubsd-why-new-bsd.html" rel="nofollow">Why a new BSD?</a></h3>

<blockquote>
<p>This article is to explain some decisions and plans made by the ArisbluBSD team, why we are making our own thing, and what the plan is for the OS. We mainly want to talk about five things: desktop, package management, software availability, custom software, and the future of the OS. We mostly want to explain what the goal of the OS is, and how we plan to expand in the near future. Without further ado, let&#39;s explain ArisbluBSD&#39;s plan.</p>

<hr>
</blockquote>

<h3><a href="https://opnsense.org/opnsense-20-7-5-released/" rel="nofollow">OPNsense 20.7.5 released</a></h3>

<blockquote>
<p>We return briefly for a small patch set and plan to pin the 20.1 upgrade path to this particular version to avoid unnecessary stepping stones. We wish you all a healthy Friday. And of course: patch responsibly!</p>

<hr>

<h3><a href="https://www.justjournal.com/users/mbsd/entry/33841" rel="nofollow">Midnight BSD 2.0 Release Status</a></h3>

<p>We identified some issues with the 2.0 ISOs slated for release with the ZFS bootloader not working. <br>
Until this issue is resolved, we are unable to build release ISOs. We&#39;ve left the old ones up as they work fine for anyone using UFS.</p>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-11-25/hardenedbsd-november-2020-status-report" rel="nofollow">HardenedBSD November 2020 Status Report</a></h3>

<p>We&#39;re getting close to the end of November. My wife and I have plans this weekend, so I thought I&#39;d take the time to write November&#39;s status report today.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<pre><code>• [rga: ripgrep, but also search in PDFs, E-Books, Office documents, zip, tar.gz, etc.](https://phiresky.github.io/blog/2019/rga--ripgrep-for-zip-targz-docx-odt-epub-jpg/)
• [exa - A modern replacement for ls](https://the.exa.website/)
• [The myriad meanings of pwd in Unix systems](https://qmacro.org/2020/11/08/the-meaning-of-pwd-in-unix-systems/)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/Karl%20-%20camera%20help.md" rel="nofollow">Karl - Camera Help</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/alejandro%20-%20domain%20registrar.md" rel="nofollow">Alejandro - domain registrar</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/Johnny%20-%20thoughts%20on%20372" rel="nofollow">Johnny - thoughts on 372</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Origin of the Shell, Return to Plan 9, ArisbluBSD: Why a new BSD?, OPNsense 20.7.5 released, Midnight BSD 2.0 Release Status, HardenedBSD November 2020 Status Report, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://multicians.org/shell.html" rel="nofollow">The Origin of the Shell</a></h3>

<blockquote>
<p>CTSS was developed during 1963 and 64. I was at MIT on the computer center staff at that time. After having written dozens of commands for CTSS, I reached the stage where I felt that commands should be usable as building blocks for writing more commands, just like subroutine libraries. Hence, I wrote &quot;RUNCOM&quot;, a sort of shell driving the execution of command scripts, with argument substitution. The tool became instantly most popular, as it became possible to go home in the evening while leaving behind long runcoms executing overnight. It was quite neat for boring and repetitive tasks such as renaming, moving, updating, compiling, etc. whole directories of files for system and application maintenance and monitoring.</p>

<hr>
</blockquote>

<h3><a href="https://boxbase.org/entries/2020/nov/1/return-to-plan9/" rel="nofollow">Return to Plan 9</a></h3>

<blockquote>
<p>Plan 9 from Bell Labs has held the same charm after my last visit that took a few days. This time I&#39;ll keep this operating system in an emulator where I can explore into it when I am distracted.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://blog.fivnex.co/2020/11/arisblubsd-why-new-bsd.html" rel="nofollow">Why a new BSD?</a></h3>

<blockquote>
<p>This article is to explain some decisions and plans made by the ArisbluBSD team, why we are making our own thing, and what the plan is for the OS. We mainly want to talk about five things: desktop, package management, software availability, custom software, and the future of the OS. We mostly want to explain what the goal of the OS is, and how we plan to expand in the near future. Without further ado, let&#39;s explain ArisbluBSD&#39;s plan.</p>

<hr>
</blockquote>

<h3><a href="https://opnsense.org/opnsense-20-7-5-released/" rel="nofollow">OPNsense 20.7.5 released</a></h3>

<blockquote>
<p>We return briefly for a small patch set and plan to pin the 20.1 upgrade path to this particular version to avoid unnecessary stepping stones. We wish you all a healthy Friday. And of course: patch responsibly!</p>

<hr>

<h3><a href="https://www.justjournal.com/users/mbsd/entry/33841" rel="nofollow">Midnight BSD 2.0 Release Status</a></h3>

<p>We identified some issues with the 2.0 ISOs slated for release with the ZFS bootloader not working. <br>
Until this issue is resolved, we are unable to build release ISOs. We&#39;ve left the old ones up as they work fine for anyone using UFS.</p>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-11-25/hardenedbsd-november-2020-status-report" rel="nofollow">HardenedBSD November 2020 Status Report</a></h3>

<p>We&#39;re getting close to the end of November. My wife and I have plans this weekend, so I thought I&#39;d take the time to write November&#39;s status report today.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<pre><code>• [rga: ripgrep, but also search in PDFs, E-Books, Office documents, zip, tar.gz, etc.](https://phiresky.github.io/blog/2019/rga--ripgrep-for-zip-targz-docx-odt-epub-jpg/)
• [exa - A modern replacement for ls](https://the.exa.website/)
• [The myriad meanings of pwd in Unix systems](https://qmacro.org/2020/11/08/the-meaning-of-pwd-in-unix-systems/)
</code></pre>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/Karl%20-%20camera%20help.md" rel="nofollow">Karl - Camera Help</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/alejandro%20-%20domain%20registrar.md" rel="nofollow">Alejandro - domain registrar</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/Johnny%20-%20thoughts%20on%20372" rel="nofollow">Johnny - thoughts on 372</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>380: Early ZFS-mas</title>
  <link>https://www.bsdnow.tv/380</link>
  <guid isPermaLink="false">ee24cdc7-bb47-400d-8be0-968efefa4e15</guid>
  <pubDate>Thu, 10 Dec 2020 06:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ee24cdc7-bb47-400d-8be0-968efefa4e15.mp3" length="43761336" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We read FreeBSD’s 3rd quarter status report, OpenZFS 2.0, adding check-hash checks in UFS filesystem, OpenSSL 3.0 /dev/crypto issues on FreeBSD, and more.</itunes:subtitle>
  <itunes:duration>43:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We read FreeBSD’s 3rd quarter status report, OpenZFS 2.0, adding check-hash checks in UFS filesystem, OpenSSL 3.0 /dev/crypto issues on FreeBSD, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
3rd Quarter FreeBSD Report (https://www.freebsd.org/news/status/report-2020-07-2020-09.html)
The call for submissions for the 4th Quarter is out (https://lists.freebsd.org/pipermail/freebsd-quarterly-calls/2020/000007.html)
OpenZFS 2.0 (https://arstechnica.com/gadgets/2020/12/openzfs-2-0-release-unifies-linux-bsd-and-adds-tons-of-new-features/)
This Monday, ZFS on Linux lead developer Brian Behlendorf published the OpenZFS 2.0.0 release to GitHub. Along with quite a lot of new features, the announcement brings an end to the former distinction between "ZFS on Linux" and ZFS elsewhere (for example, on FreeBSD). This move has been a long time coming—the FreeBSD community laid out its side of the roadmap two years ago—but this is the release that makes it official.
News Roundup
Revision 367034 (https://svnweb.freebsd.org/changeset/base/367034)
Various new check-hash checks have been added to the UFS filesystem
over various major releases. Superblock check hashes were added for
the 12 release and cylinder-group and inode check hashes will appear
in the 13 release.
OpenSSL 3.0 /dev/crypto issues on FreeBSD (https://rubenerd.com/openssl-3-written-to-break-on-freebsd/)
So, just learned that the OpenSSL devs decided to break /dev/crypto on FreeBSD.
OS108-9.1 XFCE amd64 released (https://forums.os108.org/d/32-os108-91-xfce-amd64-released)
OS108 is a fast, open and Secure Desktop Operating System built on top of NetBSD.
&amp;gt; Installing OS108 to your hard drive is done by using the sysinst utility, the process is basically the same as installing NetBSD itself.  Please refer to the NetBSD guide for installation details, http://www.netbsd.org/docs/guide/en/part-install.html
Installation Video (https://youtu.be/cgAeY21gXR4)
***
Beastie Bits
OpenBGPD 6.8p1 portable: released Nov 5th, 2020 (http://www.openbgpd.org/ftp.html)
IRC Awk Bot (http://kflu.github.io/2020/08/15/2020-08-15-awk-irc-bot/)
Docker on FreeBSD using bhyve and sshfs (https://www.youtube.com/watch?v=ZVkJZJEdZNY)
The UNIX Command Language (1976) (https://github.com/susam/tucl)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
santi - openrc (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/380/feedback/santi%20-%20openrc.md)
trond - python2 and mailman (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/380/feedback/trond%20-%20python2%20and%20mailmane%20and%20sshfs)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, status, report, third quarter 2020, openzfs 2.0, check hash, ufs, openssl, os108-9.1, xfce</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We read FreeBSD’s 3rd quarter status report, OpenZFS 2.0, adding check-hash checks in UFS filesystem, OpenSSL 3.0 /dev/crypto issues on FreeBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2020-07-2020-09.html" rel="nofollow">3rd Quarter FreeBSD Report</a></h3>

<blockquote>
<p><a href="https://lists.freebsd.org/pipermail/freebsd-quarterly-calls/2020/000007.html" rel="nofollow">The call for submissions for the 4th Quarter is out</a></p>

<hr>
</blockquote>

<h3><a href="https://arstechnica.com/gadgets/2020/12/openzfs-2-0-release-unifies-linux-bsd-and-adds-tons-of-new-features/" rel="nofollow">OpenZFS 2.0</a></h3>

<blockquote>
<p>This Monday, ZFS on Linux lead developer Brian Behlendorf published the OpenZFS 2.0.0 release to GitHub. Along with quite a lot of new features, the announcement brings an end to the former distinction between &quot;ZFS on Linux&quot; and ZFS elsewhere (for example, on FreeBSD). This move has been a long time coming—the FreeBSD community laid out its side of the roadmap two years ago—but this is the release that makes it official.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/changeset/base/367034" rel="nofollow">Revision 367034</a></h3>

<blockquote>
<p>Various new check-hash checks have been added to the UFS filesystem<br>
over various major releases. Superblock check hashes were added for<br>
the 12 release and cylinder-group and inode check hashes will appear<br>
in the 13 release.</p>

<hr>

<h3><a href="https://rubenerd.com/openssl-3-written-to-break-on-freebsd/" rel="nofollow">OpenSSL 3.0 /dev/crypto issues on FreeBSD</a></h3>

<p>So, just learned that the OpenSSL devs decided to break /dev/crypto on FreeBSD.</p>

<hr>
</blockquote>

<h3><a href="https://forums.os108.org/d/32-os108-91-xfce-amd64-released" rel="nofollow">OS108-9.1 XFCE amd64 released</a></h3>

<ul>
<li>OS108 is a fast, open and Secure Desktop Operating System built on top of NetBSD.
&gt; Installing OS108 to your hard drive is done by using the sysinst utility, the process is basically the same as installing NetBSD itself.  Please refer to the NetBSD guide for installation details, <a href="http://www.netbsd.org/docs/guide/en/part-install.html" rel="nofollow">http://www.netbsd.org/docs/guide/en/part-install.html</a></li>
<li><a href="https://youtu.be/cgAeY21gXR4" rel="nofollow">Installation Video</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.openbgpd.org/ftp.html" rel="nofollow">OpenBGPD 6.8p1 portable: released Nov 5th, 2020</a></li>
<li><a href="http://kflu.github.io/2020/08/15/2020-08-15-awk-irc-bot/" rel="nofollow">IRC Awk Bot</a></li>
<li><a href="https://www.youtube.com/watch?v=ZVkJZJEdZNY" rel="nofollow">Docker on FreeBSD using bhyve and sshfs</a></li>
<li><a href="https://github.com/susam/tucl" rel="nofollow">The UNIX Command Language (1976)</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/380/feedback/santi%20-%20openrc.md" rel="nofollow">santi - openrc</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/380/feedback/trond%20-%20python2%20and%20mailmane%20and%20sshfs" rel="nofollow">trond - python2 and mailman</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We read FreeBSD’s 3rd quarter status report, OpenZFS 2.0, adding check-hash checks in UFS filesystem, OpenSSL 3.0 /dev/crypto issues on FreeBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2020-07-2020-09.html" rel="nofollow">3rd Quarter FreeBSD Report</a></h3>

<blockquote>
<p><a href="https://lists.freebsd.org/pipermail/freebsd-quarterly-calls/2020/000007.html" rel="nofollow">The call for submissions for the 4th Quarter is out</a></p>

<hr>
</blockquote>

<h3><a href="https://arstechnica.com/gadgets/2020/12/openzfs-2-0-release-unifies-linux-bsd-and-adds-tons-of-new-features/" rel="nofollow">OpenZFS 2.0</a></h3>

<blockquote>
<p>This Monday, ZFS on Linux lead developer Brian Behlendorf published the OpenZFS 2.0.0 release to GitHub. Along with quite a lot of new features, the announcement brings an end to the former distinction between &quot;ZFS on Linux&quot; and ZFS elsewhere (for example, on FreeBSD). This move has been a long time coming—the FreeBSD community laid out its side of the roadmap two years ago—but this is the release that makes it official.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/changeset/base/367034" rel="nofollow">Revision 367034</a></h3>

<blockquote>
<p>Various new check-hash checks have been added to the UFS filesystem<br>
over various major releases. Superblock check hashes were added for<br>
the 12 release and cylinder-group and inode check hashes will appear<br>
in the 13 release.</p>

<hr>

<h3><a href="https://rubenerd.com/openssl-3-written-to-break-on-freebsd/" rel="nofollow">OpenSSL 3.0 /dev/crypto issues on FreeBSD</a></h3>

<p>So, just learned that the OpenSSL devs decided to break /dev/crypto on FreeBSD.</p>

<hr>
</blockquote>

<h3><a href="https://forums.os108.org/d/32-os108-91-xfce-amd64-released" rel="nofollow">OS108-9.1 XFCE amd64 released</a></h3>

<ul>
<li>OS108 is a fast, open and Secure Desktop Operating System built on top of NetBSD.
&gt; Installing OS108 to your hard drive is done by using the sysinst utility, the process is basically the same as installing NetBSD itself.  Please refer to the NetBSD guide for installation details, <a href="http://www.netbsd.org/docs/guide/en/part-install.html" rel="nofollow">http://www.netbsd.org/docs/guide/en/part-install.html</a></li>
<li><a href="https://youtu.be/cgAeY21gXR4" rel="nofollow">Installation Video</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.openbgpd.org/ftp.html" rel="nofollow">OpenBGPD 6.8p1 portable: released Nov 5th, 2020</a></li>
<li><a href="http://kflu.github.io/2020/08/15/2020-08-15-awk-irc-bot/" rel="nofollow">IRC Awk Bot</a></li>
<li><a href="https://www.youtube.com/watch?v=ZVkJZJEdZNY" rel="nofollow">Docker on FreeBSD using bhyve and sshfs</a></li>
<li><a href="https://github.com/susam/tucl" rel="nofollow">The UNIX Command Language (1976)</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/380/feedback/santi%20-%20openrc.md" rel="nofollow">santi - openrc</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/380/feedback/trond%20-%20python2%20and%20mailmane%20and%20sshfs" rel="nofollow">trond - python2 and mailman</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>379: bhyve my guest</title>
  <link>https://www.bsdnow.tv/379</link>
  <guid isPermaLink="false">4957b8e6-e7da-4f6d-8bbb-3b52c33c959f</guid>
  <pubDate>Thu, 03 Dec 2020 06:45:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4957b8e6-e7da-4f6d-8bbb-3b52c33c959f.mp3" length="37714488" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Adventures in Freebernetes, tracing kernel functions, The better way of building FreeBSD networks, New beginnings: CDBUG virtual meetings, LibreSSL update in DragonFly, Signal-cli with scli on FreeBSD, and more.</itunes:subtitle>
  <itunes:duration>37:19</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Adventures in Freebernetes, tracing kernel functions, The better way of building FreeBSD networks, New beginnings: CDBUG virtual meetings, LibreSSL update in DragonFly, Signal-cli with scli on FreeBSD, and more. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Adventures in Freebernetes: bhyve My Guest (https://productionwithscissors.run/2020/10/29/adventures-in-freebernetes-bhyve-my-guest/)
Part 2 of experiments in FreeBSD and Kubernetes: Creating your first guest
Tracing Kernel Functions: FBT stack() and arg (https://zinascii.com/2020/fbt-args-and-stack.html?s=03)
In my previous post I described how FBT intercepts function calls and vectors them into the DTrace framework. That laid the foundation for what I want to discuss in this post: the implementation of the stack() action and built-in arg variables. These features rely on the precise layout of the stack, the details of which I touched on previously. In this post I hope to illuminate those details a bit more with the help of some visuals, and then guide you through the implementation of these two DTrace features as they relate to the FBT provider.
News Roundup
Dummynet: The Better Way of Building FreeBSD Networks (https://klarasystems.com/articles/dummynet-the-better-way-of-building-freebsd-networks/)
Dummynet is the FreeBSD traffic shaper, packet scheduler, and network emulator. Dummynet allows you to emulate a whole set of network environments in a straight-forward way. It has the ability to model delay, packet loss, and can act as a traffic shaper and policer. Dummynet is roughly equivalent to netem in Linux, but we have found that dummynet is easier to integrate and provides much more consistent results.  
New beginnings: CDBUG virtual meetings (http://lists.nycbug.org/pipermail/cdbug-talk/2020-October/000901.html)
I had overwhelmingly positive responses from the broader *BSD community about restarting CDBUG meetings as virtual, at least for now. Hopefully this works well and even when we're back to in-person meetings we can still find a way to bring in virtual attendees.
LibreSSL update in DragonFly (https://www.dragonflydigest.com/2020/11/10/25143.html)
DragonFly has a new version of libressl,  noting cause it has a newer TLS1.3 implementation – something that may be necessary for you.
Signal-cli with scli on FreeBSD (https://antranigv.am/weblog_en/posts/freebsd-signal-cli-scli/)
So couple of days ago I migrated from macOS on Macbook Pro to FreeBSD on ThinkPad T480s.
Beastie Bits
Firefox is not paxctl safe for NetBSD (https://anonhg.netbsd.org/pkgsrc/rev/9386adbd052e)
FreeBSD 12.2-RELEASE on Microsoft Azure Marketplace (https://azuremarketplace.microsoft.com/en-us/marketplace/apps/thefreebsdfoundation.freebsd-12_2?tab=Overview)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
carlos - BSD Now around the world (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/carlos%20-%20BSD%20Now%20around%20the%20world.md)
paulo - freebsd on a Bananapi (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/paulo%20-%20freebsd%20on%20a%20Bananapi.md)
paulo - followup (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/paulo%20-%20followup.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, quarterly reports, report, status, plan 9, cdbug, virtual meetings, libressl, signal-cli, scli </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Adventures in Freebernetes, tracing kernel functions, The better way of building FreeBSD networks, New beginnings: CDBUG virtual meetings, LibreSSL update in DragonFly, Signal-cli with scli on FreeBSD, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://productionwithscissors.run/2020/10/29/adventures-in-freebernetes-bhyve-my-guest/" rel="nofollow">Adventures in Freebernetes: bhyve My Guest</a></h3>

<blockquote>
<p>Part 2 of experiments in FreeBSD and Kubernetes: Creating your first guest</p>

<hr>
</blockquote>

<h3><a href="https://zinascii.com/2020/fbt-args-and-stack.html?s=03" rel="nofollow">Tracing Kernel Functions: FBT stack() and arg</a></h3>

<blockquote>
<p>In my previous post I described how FBT intercepts function calls and vectors them into the DTrace framework. That laid the foundation for what I want to discuss in this post: the implementation of the stack() action and built-in arg variables. These features rely on the precise layout of the stack, the details of which I touched on previously. In this post I hope to illuminate those details a bit more with the help of some visuals, and then guide you through the implementation of these two DTrace features as they relate to the FBT provider.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://klarasystems.com/articles/dummynet-the-better-way-of-building-freebsd-networks/" rel="nofollow">Dummynet: The Better Way of Building FreeBSD Networks</a></h3>

<blockquote>
<p>Dummynet is the FreeBSD traffic shaper, packet scheduler, and network emulator. Dummynet allows you to emulate a whole set of network environments in a straight-forward way. It has the ability to model delay, packet loss, and can act as a traffic shaper and policer. Dummynet is roughly equivalent to netem in Linux, but we have found that dummynet is easier to integrate and provides much more consistent results.  </p>

<hr>
</blockquote>

<h3><a href="http://lists.nycbug.org/pipermail/cdbug-talk/2020-October/000901.html" rel="nofollow">New beginnings: CDBUG virtual meetings</a></h3>

<blockquote>
<p>I had overwhelmingly positive responses from the broader *BSD community about restarting CDBUG meetings as virtual, at least for now. Hopefully this works well and even when we&#39;re back to in-person meetings we can still find a way to bring in virtual attendees.</p>

<hr>
</blockquote>

<h3><a href="https://www.dragonflydigest.com/2020/11/10/25143.html" rel="nofollow">LibreSSL update in DragonFly</a></h3>

<blockquote>
<p>DragonFly has a new version of libressl,  noting cause it has a newer TLS1.3 implementation – something that may be necessary for you.</p>

<hr>
</blockquote>

<h3><a href="https://antranigv.am/weblog_en/posts/freebsd-signal-cli-scli/" rel="nofollow">Signal-cli with scli on FreeBSD</a></h3>

<blockquote>
<p>So couple of days ago I migrated from macOS on Macbook Pro to FreeBSD on ThinkPad T480s.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://anonhg.netbsd.org/pkgsrc/rev/9386adbd052e" rel="nofollow">Firefox is not paxctl safe for NetBSD</a></li>
<li><a href="https://azuremarketplace.microsoft.com/en-us/marketplace/apps/thefreebsdfoundation.freebsd-12_2?tab=Overview" rel="nofollow">FreeBSD 12.2-RELEASE on Microsoft Azure Marketplace</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/carlos%20-%20BSD%20Now%20around%20the%20world.md" rel="nofollow">carlos - BSD Now around the world</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/paulo%20-%20freebsd%20on%20a%20Bananapi.md" rel="nofollow">paulo - freebsd on a Bananapi</a>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/paulo%20-%20followup.md" rel="nofollow">paulo - followup</a></li>
</ul></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Adventures in Freebernetes, tracing kernel functions, The better way of building FreeBSD networks, New beginnings: CDBUG virtual meetings, LibreSSL update in DragonFly, Signal-cli with scli on FreeBSD, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://productionwithscissors.run/2020/10/29/adventures-in-freebernetes-bhyve-my-guest/" rel="nofollow">Adventures in Freebernetes: bhyve My Guest</a></h3>

<blockquote>
<p>Part 2 of experiments in FreeBSD and Kubernetes: Creating your first guest</p>

<hr>
</blockquote>

<h3><a href="https://zinascii.com/2020/fbt-args-and-stack.html?s=03" rel="nofollow">Tracing Kernel Functions: FBT stack() and arg</a></h3>

<blockquote>
<p>In my previous post I described how FBT intercepts function calls and vectors them into the DTrace framework. That laid the foundation for what I want to discuss in this post: the implementation of the stack() action and built-in arg variables. These features rely on the precise layout of the stack, the details of which I touched on previously. In this post I hope to illuminate those details a bit more with the help of some visuals, and then guide you through the implementation of these two DTrace features as they relate to the FBT provider.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://klarasystems.com/articles/dummynet-the-better-way-of-building-freebsd-networks/" rel="nofollow">Dummynet: The Better Way of Building FreeBSD Networks</a></h3>

<blockquote>
<p>Dummynet is the FreeBSD traffic shaper, packet scheduler, and network emulator. Dummynet allows you to emulate a whole set of network environments in a straight-forward way. It has the ability to model delay, packet loss, and can act as a traffic shaper and policer. Dummynet is roughly equivalent to netem in Linux, but we have found that dummynet is easier to integrate and provides much more consistent results.  </p>

<hr>
</blockquote>

<h3><a href="http://lists.nycbug.org/pipermail/cdbug-talk/2020-October/000901.html" rel="nofollow">New beginnings: CDBUG virtual meetings</a></h3>

<blockquote>
<p>I had overwhelmingly positive responses from the broader *BSD community about restarting CDBUG meetings as virtual, at least for now. Hopefully this works well and even when we&#39;re back to in-person meetings we can still find a way to bring in virtual attendees.</p>

<hr>
</blockquote>

<h3><a href="https://www.dragonflydigest.com/2020/11/10/25143.html" rel="nofollow">LibreSSL update in DragonFly</a></h3>

<blockquote>
<p>DragonFly has a new version of libressl,  noting cause it has a newer TLS1.3 implementation – something that may be necessary for you.</p>

<hr>
</blockquote>

<h3><a href="https://antranigv.am/weblog_en/posts/freebsd-signal-cli-scli/" rel="nofollow">Signal-cli with scli on FreeBSD</a></h3>

<blockquote>
<p>So couple of days ago I migrated from macOS on Macbook Pro to FreeBSD on ThinkPad T480s.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://anonhg.netbsd.org/pkgsrc/rev/9386adbd052e" rel="nofollow">Firefox is not paxctl safe for NetBSD</a></li>
<li><a href="https://azuremarketplace.microsoft.com/en-us/marketplace/apps/thefreebsdfoundation.freebsd-12_2?tab=Overview" rel="nofollow">FreeBSD 12.2-RELEASE on Microsoft Azure Marketplace</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/carlos%20-%20BSD%20Now%20around%20the%20world.md" rel="nofollow">carlos - BSD Now around the world</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/paulo%20-%20freebsd%20on%20a%20Bananapi.md" rel="nofollow">paulo - freebsd on a Bananapi</a>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/paulo%20-%20followup.md" rel="nofollow">paulo - followup</a></li>
</ul></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>378: Networknomicon</title>
  <link>https://www.bsdnow.tv/378</link>
  <guid isPermaLink="false">5d96e357-c800-4037-bc9d-3251ca0b1cd0</guid>
  <pubDate>Thu, 26 Nov 2020 06:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5d96e357-c800-4037-bc9d-3251ca0b1cd0.mp3" length="55682424" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Interview with Michael W. Lucas: SNMP and TLS book, cashflow for creators, book sale and more. </itunes:subtitle>
  <itunes:duration>56:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Interview with Michael W. Lucas: SNMP and TLS book, cashflow for creators, book sale and more. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Interview with Michael W. Lucas
SNMP Book (https://mwl.io/nonfiction/networking#snmp)
The Networknomicon (https://mwl.io/nonfiction/networking#networknomicon)
Sponsor the TLS Book (https://www.tiltedwindmillpress.com/product-category/sponsor/)
Cashflow for creators (https://mwl.io/nonfiction/biz-craft)
Book sale (https://mwl.io/blog/9313)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
 Special Guest: Michael W Lucas.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, interview, michael W. Lucas, books, tls, snmp, cashflow, creators, sale, book sale </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Interview with Michael W. Lucas: SNMP and TLS book, cashflow for creators, book sale and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3>Interview with Michael W. Lucas</h3>

<blockquote>
<p><a href="https://mwl.io/nonfiction/networking#snmp" rel="nofollow">SNMP Book</a><br>
<a href="https://mwl.io/nonfiction/networking#networknomicon" rel="nofollow">The Networknomicon</a><br>
<a href="https://www.tiltedwindmillpress.com/product-category/sponsor/" rel="nofollow">Sponsor the TLS Book</a><br>
<a href="https://mwl.io/nonfiction/biz-craft" rel="nofollow">Cashflow for creators</a><br>
<a href="https://mwl.io/blog/9313" rel="nofollow">Book sale</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>
</blockquote>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Michael W Lucas.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Interview with Michael W. Lucas: SNMP and TLS book, cashflow for creators, book sale and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3>Interview with Michael W. Lucas</h3>

<blockquote>
<p><a href="https://mwl.io/nonfiction/networking#snmp" rel="nofollow">SNMP Book</a><br>
<a href="https://mwl.io/nonfiction/networking#networknomicon" rel="nofollow">The Networknomicon</a><br>
<a href="https://www.tiltedwindmillpress.com/product-category/sponsor/" rel="nofollow">Sponsor the TLS Book</a><br>
<a href="https://mwl.io/nonfiction/biz-craft" rel="nofollow">Cashflow for creators</a><br>
<a href="https://mwl.io/blog/9313" rel="nofollow">Book sale</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>
</blockquote>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Michael W Lucas.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>377: Firewall ban-sharing</title>
  <link>https://www.bsdnow.tv/377</link>
  <guid isPermaLink="false">610cb191-462b-4968-a1ae-01d1aebf93ba</guid>
  <pubDate>Thu, 19 Nov 2020 06:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/610cb191-462b-4968-a1ae-01d1aebf93ba.mp3" length="46483632" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>History of FreeBD: BSDi and USL Lawsuits, Building a Website on Google Compute Engine, Firewall ban-sharing across machines, OpenVPN as default gateway on OpenBSD, Sorting out what the Single Unix Specification is, Switching from Apple to a Thinkpad for development, and more</itunes:subtitle>
  <itunes:duration>48:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>History of FreeBD: BSDi and USL Lawsuits, Building a Website on Google Compute Engine, Firewall ban-sharing across machines, OpenVPN as default gateway on OpenBSD, Sorting out what the Single Unix Specification is, Switching from Apple to a Thinkpad for development, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
History of FreeBSD : Part 2 : BSDi and USL Lawsuits (https://klarasystems.com/articles/history-of-freebsd-part-2-bsdi-and-usl-lawsuits/)
In this second part of our series on the history of FreeBSD, we continue to trace the pre-history of FreeBSD and the events that would eventually shape the project and the future of open source software. 
Building a Web Site on Google Compute Engine (https://cromwell-intl.com/open-source/google-freebsd-tls/)
Here's how I deployed a web site to the Google Cloud Platform. I used FreeBSD for good performance, stability, and minimal complexity. I set up HTTPS with free Let's Encrypt TLS certificates for both RSA and ECC. Then I adjusted the Apache configuration for a good score from the authoritative Qualys server analysis.
News Roundup
Firewall ban-sharing across machines (https://chown.me/blog/acacia)
As described in My infrastructure as of 2019, my machines are located in three different sites and are loosely coupled. Nonetheless, I wanted to set things up so that if an IP address is acting maliciously toward one machine, all my machines block that IP at once so the meanie won't get to try one machine after another.
OpenVPN as default gateway on OpenBSD (https://dataswamp.org/~solene/2020-10-27-openbsd-openvpn.html)
If you plan to use an OpenVPN tunnel to reach your default gateway, which would make the tun interface in the egress group, and use tun0 in your pf.conf which is loaded before OpenVPN starts?
Here are the few tips I use to solve the problems.
Sorting out what the Single Unix Specification is and covers (https://utcc.utoronto.ca/~cks/space/blog/unix/SingleUnixSpecificationWhat)
Sorting out what the Single Unix Specification is and covers
October 8, 2020
I've linked to the Single Unix Specification any number of times, for various versions of it (when I first linked to it, it was at issue 6, in 2006; it's now up to a 2018 edition). But I've never been quite clear what it covered and didn't cover, and how it related to POSIX and similar things. After yesterday's entry got me looking at the SuS site again, I decided to try to sort this out once and for all.
Bye-bye, Apple (http://blog.cretaria.com/posts/bye-bye-apple.html)
The days of Apple products are behind me. I had been developing on a Macbook for over twelve years, but now, I’ve switched to an ever trending setup: OpenBSD on a Thinkpad.
The new platform is a winner. Everything is clean, quick, and configurable. When I ps uaxww, I’m not hogging ‘gigs’ of RAM just to have things up and running. There’s no black magic that derails me at every turn. In short, my sanity has been long restored.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Chris - small projects (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Chris%20-%20small%20projects.md)
Jens - ZFS Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Jens%20-%20ZFS%20Question.md)
One pool to rule them all (https://ftfl.ca/blog/2016-09-17-zfs-fde-one-pool-conversion.html)
Shroyer - Dotnet on FreeBSD for Jellyfin (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Shroyer%20-%20Dotnet%20on%20FreeBSD%20for%20Jellyfin.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, zfs, zpool, dataset, interview, history, BSDi, USL, google compute engine, GCE, website building, firewall, ban-sharing, openvpn, default gateway, unix specification, switching, development</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>History of FreeBD: BSDi and USL Lawsuits, Building a Website on Google Compute Engine, Firewall ban-sharing across machines, OpenVPN as default gateway on OpenBSD, Sorting out what the Single Unix Specification is, Switching from Apple to a Thinkpad for development, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/history-of-freebsd-part-2-bsdi-and-usl-lawsuits/" rel="nofollow">History of FreeBSD : Part 2 : BSDi and USL Lawsuits</a></h3>

<blockquote>
<p>In this second part of our series on the history of FreeBSD, we continue to trace the pre-history of FreeBSD and the events that would eventually shape the project and the future of open source software. </p>

<hr>
</blockquote>

<h3><a href="https://cromwell-intl.com/open-source/google-freebsd-tls/" rel="nofollow">Building a Web Site on Google Compute Engine</a></h3>

<blockquote>
<p>Here&#39;s how I deployed a web site to the Google Cloud Platform. I used FreeBSD for good performance, stability, and minimal complexity. I set up HTTPS with free Let&#39;s Encrypt TLS certificates for both RSA and ECC. Then I adjusted the Apache configuration for a good score from the authoritative Qualys server analysis.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://chown.me/blog/acacia" rel="nofollow">Firewall ban-sharing across machines</a></h3>

<blockquote>
<p>As described in My infrastructure as of 2019, my machines are located in three different sites and are loosely coupled. Nonetheless, I wanted to set things up so that if an IP address is acting maliciously toward one machine, all my machines block that IP at once so the meanie won&#39;t get to try one machine after another.</p>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2020-10-27-openbsd-openvpn.html" rel="nofollow">OpenVPN as default gateway on OpenBSD</a></h3>

<p>If you plan to use an OpenVPN tunnel to reach your default gateway, which would make the tun interface in the egress group, and use tun0 in your pf.conf which is loaded before OpenVPN starts?<br>
Here are the few tips I use to solve the problems.</p>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/SingleUnixSpecificationWhat" rel="nofollow">Sorting out what the Single Unix Specification is and covers</a></h3>

<p>Sorting out what the Single Unix Specification is and covers<br>
October 8, 2020<br>
I&#39;ve linked to the Single Unix Specification any number of times, for various versions of it (when I first linked to it, it was at issue 6, in 2006; it&#39;s now up to a 2018 edition). But I&#39;ve never been quite clear what it covered and didn&#39;t cover, and how it related to POSIX and similar things. After yesterday&#39;s entry got me looking at the SuS site again, I decided to try to sort this out once and for all.</p>

<hr>

<h3><a href="http://blog.cretaria.com/posts/bye-bye-apple.html" rel="nofollow">Bye-bye, Apple</a></h3>

<p>The days of Apple products are behind me. I had been developing on a Macbook for over twelve years, but now, I’ve switched to an ever trending setup: OpenBSD on a Thinkpad.<br>
The new platform is a winner. Everything is clean, quick, and configurable. When I ps uaxww, I’m not hogging ‘gigs’ of RAM just to have things up and running. There’s no black magic that derails me at every turn. In short, my sanity has been long restored.</p>
</blockquote>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Chris%20-%20small%20projects.md" rel="nofollow">Chris - small projects</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Jens%20-%20ZFS%20Question.md" rel="nofollow">Jens - ZFS Question</a>

<ul>
<li><a href="https://ftfl.ca/blog/2016-09-17-zfs-fde-one-pool-conversion.html" rel="nofollow">One pool to rule them all</a></li>
</ul></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Shroyer%20-%20Dotnet%20on%20FreeBSD%20for%20Jellyfin.md" rel="nofollow">Shroyer - Dotnet on FreeBSD for Jellyfin</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>History of FreeBD: BSDi and USL Lawsuits, Building a Website on Google Compute Engine, Firewall ban-sharing across machines, OpenVPN as default gateway on OpenBSD, Sorting out what the Single Unix Specification is, Switching from Apple to a Thinkpad for development, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/history-of-freebsd-part-2-bsdi-and-usl-lawsuits/" rel="nofollow">History of FreeBSD : Part 2 : BSDi and USL Lawsuits</a></h3>

<blockquote>
<p>In this second part of our series on the history of FreeBSD, we continue to trace the pre-history of FreeBSD and the events that would eventually shape the project and the future of open source software. </p>

<hr>
</blockquote>

<h3><a href="https://cromwell-intl.com/open-source/google-freebsd-tls/" rel="nofollow">Building a Web Site on Google Compute Engine</a></h3>

<blockquote>
<p>Here&#39;s how I deployed a web site to the Google Cloud Platform. I used FreeBSD for good performance, stability, and minimal complexity. I set up HTTPS with free Let&#39;s Encrypt TLS certificates for both RSA and ECC. Then I adjusted the Apache configuration for a good score from the authoritative Qualys server analysis.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://chown.me/blog/acacia" rel="nofollow">Firewall ban-sharing across machines</a></h3>

<blockquote>
<p>As described in My infrastructure as of 2019, my machines are located in three different sites and are loosely coupled. Nonetheless, I wanted to set things up so that if an IP address is acting maliciously toward one machine, all my machines block that IP at once so the meanie won&#39;t get to try one machine after another.</p>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2020-10-27-openbsd-openvpn.html" rel="nofollow">OpenVPN as default gateway on OpenBSD</a></h3>

<p>If you plan to use an OpenVPN tunnel to reach your default gateway, which would make the tun interface in the egress group, and use tun0 in your pf.conf which is loaded before OpenVPN starts?<br>
Here are the few tips I use to solve the problems.</p>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/SingleUnixSpecificationWhat" rel="nofollow">Sorting out what the Single Unix Specification is and covers</a></h3>

<p>Sorting out what the Single Unix Specification is and covers<br>
October 8, 2020<br>
I&#39;ve linked to the Single Unix Specification any number of times, for various versions of it (when I first linked to it, it was at issue 6, in 2006; it&#39;s now up to a 2018 edition). But I&#39;ve never been quite clear what it covered and didn&#39;t cover, and how it related to POSIX and similar things. After yesterday&#39;s entry got me looking at the SuS site again, I decided to try to sort this out once and for all.</p>

<hr>

<h3><a href="http://blog.cretaria.com/posts/bye-bye-apple.html" rel="nofollow">Bye-bye, Apple</a></h3>

<p>The days of Apple products are behind me. I had been developing on a Macbook for over twelve years, but now, I’ve switched to an ever trending setup: OpenBSD on a Thinkpad.<br>
The new platform is a winner. Everything is clean, quick, and configurable. When I ps uaxww, I’m not hogging ‘gigs’ of RAM just to have things up and running. There’s no black magic that derails me at every turn. In short, my sanity has been long restored.</p>
</blockquote>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Chris%20-%20small%20projects.md" rel="nofollow">Chris - small projects</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Jens%20-%20ZFS%20Question.md" rel="nofollow">Jens - ZFS Question</a>

<ul>
<li><a href="https://ftfl.ca/blog/2016-09-17-zfs-fde-one-pool-conversion.html" rel="nofollow">One pool to rule them all</a></li>
</ul></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Shroyer%20-%20Dotnet%20on%20FreeBSD%20for%20Jellyfin.md" rel="nofollow">Shroyer - Dotnet on FreeBSD for Jellyfin</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>376: Build stable packages</title>
  <link>https://www.bsdnow.tv/376</link>
  <guid isPermaLink="false">f32e4d71-13e3-4cfa-a98d-c3806ac0c665</guid>
  <pubDate>Thu, 12 Nov 2020 06:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f32e4d71-13e3-4cfa-a98d-c3806ac0c665.mp3" length="45514920" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 12.2 is available, ZFS Webinar, Enhancing Syzkaller support for NetBSD, how the OpenBSD -stable packages are built, OPNsense 20.7.4 released, and more</itunes:subtitle>
  <itunes:duration>46:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 12.2 is available, ZFS Webinar, Enhancing Syzkaller support for NetBSD, how the OpenBSD -stable packages are built, OPNsense 20.7.4 released, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
FreeBSD 12.2 Release (https://www.freebsd.org/releases/12.2R/relnotes.html)
The release notes for FreeBSD 12.2-RELEASE contain a summary of the changes made to the FreeBSD base system on the 12-STABLE development line. This document lists applicable security advisories that were issued since the last release, as well as significant changes to the FreeBSD kernel and userland. Some brief remarks on upgrading are also presented.
ZFS Webinar: November 18th (https://klarasystems.com/learning/best-practices-for-optimizing-zfs1/)
Join us on November 18th for a live discussion with Allan Jude (VP of Engineering at Klara Inc) in this webinar centred on “best practices of ZFS”
Building Your Storage Array – Everything from picking the best hardware to RAID-Z and using mirrors.
Keeping up with Data Growth – Expanding and growing your pool, and of course, shrinking with device evacuation.
Datasets and Properties – Controlling settings with properties and many other tricks!
News Roundup
Google Summer of Code 2020: [Final Report] Enhancing Syzkaller support for NetBSD (https://blog.netbsd.org/tnf/entry/google_summer_of_code_20202)
Sys2syz would give an extra edge to Syzkaller for NetBSD. It has a potential of efficiently automating the conversion of syscall definitions to syzkaller’s grammar. This can aid in increasing the number of syscalls covered by Syzkaller significantly with the minimum possibility of manual errors. Let’s delve into its internals.
How the OpenBSD -stable packages are built (https://dataswamp.org/~solene/2020-10-29-official-openbsd-stable-architecture.html)
In this long blog post, I will write about the technical details of the OpenBSD stable packages building infrastructure. I have setup the infrastructure with the help of Theo De Raadt who provided me the hardware in summer 2019, since then, OpenBSD users can upgrade their packages using pkg_add -u for critical updates that has been backported by the contributors. Many thanks to them, without their work there would be no packages to build. Thanks to pea@ who is my backup for operating this infrastructure in case something happens to me.
OPNsense 20.7.4 released (https://opnsense.org/opnsense-20-7-4-released/)
This release finally wraps up the recent Netmap kernel changes and tests.
The Realtek vendor driver was updated as well as third party software cURL,
libxml2, OpenSSL, PHP, Suricata, Syslog-ng and Unbound just to name a couple
of them.
Beastie Bits
Binutils and linker changes (https://www.dragonflydigest.com/2020/11/03/25120.html)
28 Years of NetBSD contributions (https://github.com/NetBSD/src/graphs/contributors)
Bluetooth Audio on OpenBSD (https://ifconfig.se/bluetooth-audio-openbsd.html)
K8s Bhyve (https://k8s-bhyve.convectix.com)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Sean - C Flags (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/Sean%20-%20C%20Flags.md)
Thierry - RPI ZFS question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/Thierry%20-%20RPI%20ZFS%20question.md)
Thierry's script (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/script.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, zfs, zpool, dataset, interview, 12.2, webinar, syzkaller, stable, packages, package building, opnsense, release</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 12.2 is available, ZFS Webinar, Enhancing Syzkaller support for NetBSD, how the OpenBSD -stable packages are built, OPNsense 20.7.4 released, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/12.2R/relnotes.html" rel="nofollow">FreeBSD 12.2 Release</a></h3>

<blockquote>
<p>The release notes for FreeBSD 12.2-RELEASE contain a summary of the changes made to the FreeBSD base system on the 12-STABLE development line. This document lists applicable security advisories that were issued since the last release, as well as significant changes to the FreeBSD kernel and userland. Some brief remarks on upgrading are also presented.</p>

<hr>

<h3><a href="https://klarasystems.com/learning/best-practices-for-optimizing-zfs1/" rel="nofollow">ZFS Webinar: November 18th</a></h3>

<p>Join us on November 18th for a live discussion with Allan Jude (VP of Engineering at Klara Inc) in this webinar centred on “best practices of ZFS”<br>
Building Your Storage Array – Everything from picking the best hardware to RAID-Z and using mirrors.<br>
Keeping up with Data Growth – Expanding and growing your pool, and of course, shrinking with device evacuation.<br>
Datasets and Properties – Controlling settings with properties and many other tricks!</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/google_summer_of_code_20202" rel="nofollow">Google Summer of Code 2020: [Final Report] Enhancing Syzkaller support for NetBSD</a></h3>

<blockquote>
<p>Sys2syz would give an extra edge to Syzkaller for NetBSD. It has a potential of efficiently automating the conversion of syscall definitions to syzkaller’s grammar. This can aid in increasing the number of syscalls covered by Syzkaller significantly with the minimum possibility of manual errors. Let’s delve into its internals.</p>

<hr>
</blockquote>

<h3><a href="https://dataswamp.org/%7Esolene/2020-10-29-official-openbsd-stable-architecture.html" rel="nofollow">How the OpenBSD -stable packages are built</a></h3>

<blockquote>
<p>In this long blog post, I will write about the technical details of the OpenBSD stable packages building infrastructure. I have setup the infrastructure with the help of Theo De Raadt who provided me the hardware in summer 2019, since then, OpenBSD users can upgrade their packages using pkg_add -u for critical updates that has been backported by the contributors. Many thanks to them, without their work there would be no packages to build. Thanks to pea@ who is my backup for operating this infrastructure in case something happens to me.</p>

<hr>
</blockquote>

<h3><a href="https://opnsense.org/opnsense-20-7-4-released/" rel="nofollow">OPNsense 20.7.4 released</a></h3>

<blockquote>
<p>This release finally wraps up the recent Netmap kernel changes and tests.<br>
The Realtek vendor driver was updated as well as third party software cURL,<br>
libxml2, OpenSSL, PHP, Suricata, Syslog-ng and Unbound just to name a couple<br>
of them.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/11/03/25120.html" rel="nofollow">Binutils and linker changes</a></li>
<li><a href="https://github.com/NetBSD/src/graphs/contributors" rel="nofollow">28 Years of NetBSD contributions</a></li>
<li><a href="https://ifconfig.se/bluetooth-audio-openbsd.html" rel="nofollow">Bluetooth Audio on OpenBSD</a></li>
<li><a href="https://k8s-bhyve.convectix.com" rel="nofollow">K8s Bhyve</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/Sean%20-%20C%20Flags.md" rel="nofollow">Sean - C Flags</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/Thierry%20-%20RPI%20ZFS%20question.md" rel="nofollow">Thierry - RPI ZFS question</a>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/script.md" rel="nofollow">Thierry&#39;s script</a>
***</li>
</ul></li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 12.2 is available, ZFS Webinar, Enhancing Syzkaller support for NetBSD, how the OpenBSD -stable packages are built, OPNsense 20.7.4 released, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/12.2R/relnotes.html" rel="nofollow">FreeBSD 12.2 Release</a></h3>

<blockquote>
<p>The release notes for FreeBSD 12.2-RELEASE contain a summary of the changes made to the FreeBSD base system on the 12-STABLE development line. This document lists applicable security advisories that were issued since the last release, as well as significant changes to the FreeBSD kernel and userland. Some brief remarks on upgrading are also presented.</p>

<hr>

<h3><a href="https://klarasystems.com/learning/best-practices-for-optimizing-zfs1/" rel="nofollow">ZFS Webinar: November 18th</a></h3>

<p>Join us on November 18th for a live discussion with Allan Jude (VP of Engineering at Klara Inc) in this webinar centred on “best practices of ZFS”<br>
Building Your Storage Array – Everything from picking the best hardware to RAID-Z and using mirrors.<br>
Keeping up with Data Growth – Expanding and growing your pool, and of course, shrinking with device evacuation.<br>
Datasets and Properties – Controlling settings with properties and many other tricks!</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/google_summer_of_code_20202" rel="nofollow">Google Summer of Code 2020: [Final Report] Enhancing Syzkaller support for NetBSD</a></h3>

<blockquote>
<p>Sys2syz would give an extra edge to Syzkaller for NetBSD. It has a potential of efficiently automating the conversion of syscall definitions to syzkaller’s grammar. This can aid in increasing the number of syscalls covered by Syzkaller significantly with the minimum possibility of manual errors. Let’s delve into its internals.</p>

<hr>
</blockquote>

<h3><a href="https://dataswamp.org/%7Esolene/2020-10-29-official-openbsd-stable-architecture.html" rel="nofollow">How the OpenBSD -stable packages are built</a></h3>

<blockquote>
<p>In this long blog post, I will write about the technical details of the OpenBSD stable packages building infrastructure. I have setup the infrastructure with the help of Theo De Raadt who provided me the hardware in summer 2019, since then, OpenBSD users can upgrade their packages using pkg_add -u for critical updates that has been backported by the contributors. Many thanks to them, without their work there would be no packages to build. Thanks to pea@ who is my backup for operating this infrastructure in case something happens to me.</p>

<hr>
</blockquote>

<h3><a href="https://opnsense.org/opnsense-20-7-4-released/" rel="nofollow">OPNsense 20.7.4 released</a></h3>

<blockquote>
<p>This release finally wraps up the recent Netmap kernel changes and tests.<br>
The Realtek vendor driver was updated as well as third party software cURL,<br>
libxml2, OpenSSL, PHP, Suricata, Syslog-ng and Unbound just to name a couple<br>
of them.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/11/03/25120.html" rel="nofollow">Binutils and linker changes</a></li>
<li><a href="https://github.com/NetBSD/src/graphs/contributors" rel="nofollow">28 Years of NetBSD contributions</a></li>
<li><a href="https://ifconfig.se/bluetooth-audio-openbsd.html" rel="nofollow">Bluetooth Audio on OpenBSD</a></li>
<li><a href="https://k8s-bhyve.convectix.com" rel="nofollow">K8s Bhyve</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/Sean%20-%20C%20Flags.md" rel="nofollow">Sean - C Flags</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/Thierry%20-%20RPI%20ZFS%20question.md" rel="nofollow">Thierry - RPI ZFS question</a>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/script.md" rel="nofollow">Thierry&#39;s script</a>
***</li>
</ul></li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>375: Virtually everything</title>
  <link>https://www.bsdnow.tv/375</link>
  <guid isPermaLink="false">66a4f529-c2fb-4a8e-83db-9f6cd6ff0809</guid>
  <pubDate>Thu, 05 Nov 2020 06:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/66a4f529-c2fb-4a8e-83db-9f6cd6ff0809.mp3" length="43394088" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle> bhyve - The FreeBSD Hypervisor, udf information leak, being a vim user instead of classic vi, FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware, new FreeBSD Remote Process Plugin in LLDB, OpenBSD Laptop, and more.</itunes:subtitle>
  <itunes:duration>44:48</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description> bhyve - The FreeBSD Hypervisor, udf information leak, being a vim user instead of classic vi, FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware, new FreeBSD Remote Process Plugin in LLDB, OpenBSD Laptop, and more. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
bhyve - The FreeBSD Hypervisor (https://klarasystems.com/articles/bhyve-the-freebsd-hypervisor/)
FreeBSD has had varying degrees of support as a hypervisor host throughout its history. For a time during the mid-2000s, VMWare Workstation 3.x could be made to run under FreeBSD’s Linux Emulation, and Qemu was ported in 2004, and later the kQemu accelerator in 2005. Then in 2009 a port for VirtualBox was introduced. All of these solutions suffered from being a solution designed for a different operating system and then ported to FreeBSD, requiring constant maintenance.
ZFS and FreeBSD Support
Klara offers flexible Support Subscriptions for your ZFS and FreeBSD infrastructure. Get a world class team of experts to back you up. Check it out on our website! (https://klarasystems.com/support/)
udf info leak (https://gist.github.com/CTurt/a00fb4164e13342567830b052aaed94b)
FreeBSD UDF driver info leak
Analysis done on FreeBSD release 11.0 because that's what I had around.
+ Fix committed to FreeBSD (https://svnweb.freebsd.org/changeset/base/366005)
News Roundup
I'm now a user of Vim, not classical Vi (partly because of windows) (https://utcc.utoronto.ca/~cks/space/blog/unix/VimNowAUser)
In the past I've written entries (such as this one) where I said that I was pretty much a Vi user, not really a Vim user, because I almost entirely stuck to Vi features. In a comment on my entry on not using and exploring Vim features, rjc reinforced this, saying that I seemed to be using vi instead of vim (and that there was nothing wrong with this). For a long time I thought this way myself, but these days this is not true any more. These days I really want Vim, not classical Vi.
FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware (https://vincerants.com/freebsd-on-esxi-arm-fling-fixing-virtual-hardware/)
With the current state of FreeBSD on ARM in general, a number of hardware drivers are either set to not auto-load on boot, or are entirely missing altogether. This page is to document my findings with various bits of hardware, and if possible, list fixes.
Introduction of a new FreeBSD Remote Process Plugin in LLDB (https://www.moritz.systems/blog/introduction-of-a-new-freebsd-remote-process-plugin-in-lldb/)
Moritz Systems have been contracted by the FreeBSD Foundation to modernize the LLDB debugger’s support for FreeBSD. We are writing a new plugin utilizing the more modern client-server layout that is already used by Darwin, Linux, NetBSD and (unofficially) OpenBSD. The new plugin is going to gradually replace the legacy one.
OpenBSD Laptop (https://functionallyparanoid.com/2020/10/14/openbsd-laptop/)
Hi, I know it’s been a while. I recently had to nuke and re-pave my personal laptop and I thought it would be a nice thing to share with the community how I set up OpenBSD on it so that I have a useful, modern, secure environment for getting work done. I’m not going to say I’m the expert on this or that this is the BEST way to set up OpenBSD, but I thought it would be worthwhile for folks doing Google searches to at least get my opinion on this. So, given that, let’s go…
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Ethan - Linux user wanting to try out OpenBSD (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/Ethan%20-%20Linux%20user%20wanting%20to%20try%20out%20OpenBSD.md)
iian - Learning IT (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/iian%20-%20Learning%20IT.md)
johnny - bsd swag (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/johnny%20-%20bsd%20swag.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, zfs, zpool, dataset, interview, bhyve, hypervisor, udf, udf driver, information leak, vim, vi, esxi, arm, virtual hardware, remote process plugin, lldb, laptop</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>bhyve - The FreeBSD Hypervisor, udf information leak, being a vim user instead of classic vi, FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware, new FreeBSD Remote Process Plugin in LLDB, OpenBSD Laptop, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/bhyve-the-freebsd-hypervisor/" rel="nofollow">bhyve - The FreeBSD Hypervisor</a></h3>

<blockquote>
<p>FreeBSD has had varying degrees of support as a hypervisor host throughout its history. For a time during the mid-2000s, VMWare Workstation 3.x could be made to run under FreeBSD’s Linux Emulation, and Qemu was ported in 2004, and later the kQemu accelerator in 2005. Then in 2009 a port for VirtualBox was introduced. All of these solutions suffered from being a solution designed for a different operating system and then ported to FreeBSD, requiring constant maintenance.</p>

<hr>

<h3>ZFS and FreeBSD Support</h3>

<p>Klara offers flexible Support Subscriptions for your ZFS and FreeBSD infrastructure. Get a world class team of experts to back you up. <a href="https://klarasystems.com/support/" rel="nofollow">Check it out on our website!</a></p>
</blockquote>

<h3><a href="https://gist.github.com/CTurt/a00fb4164e13342567830b052aaed94b" rel="nofollow">udf info leak</a></h3>

<blockquote>
<p>FreeBSD UDF driver info leak<br>
Analysis done on FreeBSD release 11.0 because that&#39;s what I had around.</p>

<ul>
<li><a href="https://svnweb.freebsd.org/changeset/base/366005" rel="nofollow">Fix committed to FreeBSD</a>
***</li>
</ul>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/VimNowAUser" rel="nofollow">I&#39;m now a user of Vim, not classical Vi (partly because of windows)</a></h3>

<blockquote>
<p>In the past I&#39;ve written entries (such as this one) where I said that I was pretty much a Vi user, not really a Vim user, because I almost entirely stuck to Vi features. In a comment on my entry on not using and exploring Vim features, rjc reinforced this, saying that I seemed to be using vi instead of vim (and that there was nothing wrong with this). For a long time I thought this way myself, but these days this is not true any more. These days I really want Vim, not classical Vi.</p>

<hr>

<h3><a href="https://vincerants.com/freebsd-on-esxi-arm-fling-fixing-virtual-hardware/" rel="nofollow">FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware</a></h3>

<p>With the current state of FreeBSD on ARM in general, a number of hardware drivers are either set to not auto-load on boot, or are entirely missing altogether. This page is to document my findings with various bits of hardware, and if possible, list fixes.</p>

<hr>

<h3><a href="https://www.moritz.systems/blog/introduction-of-a-new-freebsd-remote-process-plugin-in-lldb/" rel="nofollow">Introduction of a new FreeBSD Remote Process Plugin in LLDB</a></h3>

<p>Moritz Systems have been contracted by the FreeBSD Foundation to modernize the LLDB debugger’s support for FreeBSD. We are writing a new plugin utilizing the more modern client-server layout that is already used by Darwin, Linux, NetBSD and (unofficially) OpenBSD. The new plugin is going to gradually replace the legacy one.</p>
</blockquote>

<hr>

<h3><a href="https://functionallyparanoid.com/2020/10/14/openbsd-laptop/" rel="nofollow">OpenBSD Laptop</a></h3>

<blockquote>
<p>Hi, I know it’s been a while. I recently had to nuke and re-pave my personal laptop and I thought it would be a nice thing to share with the community how I set up OpenBSD on it so that I have a useful, modern, secure environment for getting work done. I’m not going to say I’m the expert on this or that this is the BEST way to set up OpenBSD, but I thought it would be worthwhile for folks doing Google searches to at least get my opinion on this. So, given that, let’s go…</p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/Ethan%20-%20Linux%20user%20wanting%20to%20try%20out%20OpenBSD.md" rel="nofollow">Ethan - Linux user wanting to try out OpenBSD</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/iian%20-%20Learning%20IT.md" rel="nofollow">iian - Learning IT</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/johnny%20-%20bsd%20swag.md" rel="nofollow">johnny - bsd swag</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>bhyve - The FreeBSD Hypervisor, udf information leak, being a vim user instead of classic vi, FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware, new FreeBSD Remote Process Plugin in LLDB, OpenBSD Laptop, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://klarasystems.com/articles/bhyve-the-freebsd-hypervisor/" rel="nofollow">bhyve - The FreeBSD Hypervisor</a></h3>

<blockquote>
<p>FreeBSD has had varying degrees of support as a hypervisor host throughout its history. For a time during the mid-2000s, VMWare Workstation 3.x could be made to run under FreeBSD’s Linux Emulation, and Qemu was ported in 2004, and later the kQemu accelerator in 2005. Then in 2009 a port for VirtualBox was introduced. All of these solutions suffered from being a solution designed for a different operating system and then ported to FreeBSD, requiring constant maintenance.</p>

<hr>

<h3>ZFS and FreeBSD Support</h3>

<p>Klara offers flexible Support Subscriptions for your ZFS and FreeBSD infrastructure. Get a world class team of experts to back you up. <a href="https://klarasystems.com/support/" rel="nofollow">Check it out on our website!</a></p>
</blockquote>

<h3><a href="https://gist.github.com/CTurt/a00fb4164e13342567830b052aaed94b" rel="nofollow">udf info leak</a></h3>

<blockquote>
<p>FreeBSD UDF driver info leak<br>
Analysis done on FreeBSD release 11.0 because that&#39;s what I had around.</p>

<ul>
<li><a href="https://svnweb.freebsd.org/changeset/base/366005" rel="nofollow">Fix committed to FreeBSD</a>
***</li>
</ul>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/VimNowAUser" rel="nofollow">I&#39;m now a user of Vim, not classical Vi (partly because of windows)</a></h3>

<blockquote>
<p>In the past I&#39;ve written entries (such as this one) where I said that I was pretty much a Vi user, not really a Vim user, because I almost entirely stuck to Vi features. In a comment on my entry on not using and exploring Vim features, rjc reinforced this, saying that I seemed to be using vi instead of vim (and that there was nothing wrong with this). For a long time I thought this way myself, but these days this is not true any more. These days I really want Vim, not classical Vi.</p>

<hr>

<h3><a href="https://vincerants.com/freebsd-on-esxi-arm-fling-fixing-virtual-hardware/" rel="nofollow">FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware</a></h3>

<p>With the current state of FreeBSD on ARM in general, a number of hardware drivers are either set to not auto-load on boot, or are entirely missing altogether. This page is to document my findings with various bits of hardware, and if possible, list fixes.</p>

<hr>

<h3><a href="https://www.moritz.systems/blog/introduction-of-a-new-freebsd-remote-process-plugin-in-lldb/" rel="nofollow">Introduction of a new FreeBSD Remote Process Plugin in LLDB</a></h3>

<p>Moritz Systems have been contracted by the FreeBSD Foundation to modernize the LLDB debugger’s support for FreeBSD. We are writing a new plugin utilizing the more modern client-server layout that is already used by Darwin, Linux, NetBSD and (unofficially) OpenBSD. The new plugin is going to gradually replace the legacy one.</p>
</blockquote>

<hr>

<h3><a href="https://functionallyparanoid.com/2020/10/14/openbsd-laptop/" rel="nofollow">OpenBSD Laptop</a></h3>

<blockquote>
<p>Hi, I know it’s been a while. I recently had to nuke and re-pave my personal laptop and I thought it would be a nice thing to share with the community how I set up OpenBSD on it so that I have a useful, modern, secure environment for getting work done. I’m not going to say I’m the expert on this or that this is the BEST way to set up OpenBSD, but I thought it would be worthwhile for folks doing Google searches to at least get my opinion on this. So, given that, let’s go…</p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/Ethan%20-%20Linux%20user%20wanting%20to%20try%20out%20OpenBSD.md" rel="nofollow">Ethan - Linux user wanting to try out OpenBSD</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/iian%20-%20Learning%20IT.md" rel="nofollow">iian - Learning IT</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/johnny%20-%20bsd%20swag.md" rel="nofollow">johnny - bsd swag</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>374: OpenBSD’s 25th anniversary</title>
  <link>https://www.bsdnow.tv/374</link>
  <guid isPermaLink="false">4e2796a1-1895-47bd-81ca-fc3c80f043e6</guid>
  <pubDate>Thu, 29 Oct 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4e2796a1-1895-47bd-81ca-fc3c80f043e6.mp3" length="52402776" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 6.8 has been released, NetBSD 9.1 is out, OpenZFS devsummit report, BastilleBSD’s native container management for FreeBSD, cleaning up old tarsnap backups, Michael W. Lucas’ book sale, and more.</itunes:subtitle>
  <itunes:duration>54:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 6.8 has been released, NetBSD 9.1 is out, OpenZFS devsummit report, BastilleBSD’s native container management for FreeBSD, cleaning up old tarsnap backups, Michael W. Lucas’ book sale, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
OpenBSD 6.8 (https://www.openbsd.org/68.html)
Released Oct 18, 2020. (OpenBSD's 25th anniversary)
NetBSD 9.1 Released (https://www.netbsd.org/releases/formal-9/NetBSD-9.1.html)
The NetBSD Project is pleased to announce NetBSD 9.1, the first update of the NetBSD 9 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.
OpenZFS Developer Summit 2020 (https://klarasystems.com/articles/openzfs-developer-summit-part-1/)
As with most other conferences in the last six months, this year’s OpenZFS Developer’s Summit was a bit different than usual. Held via Zoom to accommodate for 2020’s new normal in terms of social engagements, the conference featured a mix of talks delivered live via webinars, and breakout sessions held as regular meetings. This helped recapture some of the “hallway track” that would be lost in an online conference.
    • After attending the conference, I wrote up some of my notes from each of the talks
    • Part 2 (https://klarasystems.com/articles/openzfs-developer-summit-part-2/)
ZFS and FreeBSD Support
Klara offers flexible Support Subscriptions for your ZFS and FreeBSD infrastructure, simply sign up for our monthly subscription! What's even better is that for the month of October we are giving away 3 months for free, for every yearly subscription, and one month free when you sign up for a 6-months subscription! Check it out on our website! (https://klarasystems.com/support/)
News Roundup
BastilleBSD - native container management for FreeBSD (https://fibric.hashnode.dev/bastillebsd-native-container-management-for-freebsd)
Some time ago, I had the requirement to use FreeBSD in a project, and soon the question came up if Docker and Kubernetes can be used.
On FreeBSD, Docker is not very well supported, and even if you can get it running, Linux is used in a Docker container. My experience with Docker on FreeBSD is awful, and so I started looking for alternatives.
A quick search on one of the most significant online search engines led me to Jails and then to BastilleBSD.
Tarsnap – cleaning up old backups (https://dan.langille.org/2020/09/10/tarsnap-cleaning-up-old-backups/)
I use Tarsnap for my critical data. Case in point, I use it to backup my Bacula database dump. I use Bacula to backup my hosts. The database in question keeps track of what was backed up, from what host, the file size, checksum, where that backup is now, and many other items. Losing this data is annoying but not a disaster. It can be recreated from the backup volumes, but that is time consuming. As it is, the file is dumped daily, and rsynced to multiple locations.
MWL - BookSale (https://mwl.io/archives/8009)
For those interested in such things, I recently posted my 60,000th tweet. This prodded me to try an experiment I’ve been pondering for a while.
Over at my ebookstore, two of my books are now on a “Name Your Own Price” sale. You can get git commit murder and PAM Mastery for any price you wish, with a minimum of $1.
Beastie Bits
Brian Kernighan: UNIX, C, AWK, AMPL, and Go Programming | Lex Fridman Podcast #109 (https://www.youtube.com/watch?v=O9upVbGSBFo)
The UNIX Time-Sharing System - Dennis M. Ritchie and Ken Thompson -  July 1974 (https://chsasank.github.io/classic_papers/unix-time-sharing-system.html#)
Using a 1930 Teletype as a Linux Terminal (https://www.youtube.com/watch?v=2XLZ4Z8LpEE)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
lars - infosec handbook (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/lars%20-%20infosec%20handbook.md)
scott - zfs import (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/scott%20-%20zfs%20import.md)
zhong - first episode (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/zhong%20-%20first%20episode.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, shell, unix, os, berkeley, software, distribution, zfs, zpool, dataset, interview, backup, 25th anniversary, release, openzfs, devsummit, report, bastillebsd, container, container management, backup, book, books, book sale, </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 6.8 has been released, NetBSD 9.1 is out, OpenZFS devsummit report, BastilleBSD’s native container management for FreeBSD, cleaning up old tarsnap backups, Michael W. Lucas’ book sale, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/68.html" rel="nofollow">OpenBSD 6.8</a></h3>

<blockquote>
<p>Released Oct 18, 2020. (OpenBSD&#39;s 25th anniversary)</p>

<hr>

<h3><a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.1.html" rel="nofollow">NetBSD 9.1 Released</a></h3>

<p>The NetBSD Project is pleased to announce NetBSD 9.1, the first update of the NetBSD 9 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</p>

<hr>
</blockquote>

<h3><a href="https://klarasystems.com/articles/openzfs-developer-summit-part-1/" rel="nofollow">OpenZFS Developer Summit 2020</a></h3>

<blockquote>
<p>As with most other conferences in the last six months, this year’s OpenZFS Developer’s Summit was a bit different than usual. Held via Zoom to accommodate for 2020’s new normal in terms of social engagements, the conference featured a mix of talks delivered live via webinars, and breakout sessions held as regular meetings. This helped recapture some of the “hallway track” that would be lost in an online conference.<br>
    • After attending the conference, I wrote up some of my notes from each of the talks<br>
    • <a href="https://klarasystems.com/articles/openzfs-developer-summit-part-2/" rel="nofollow">Part 2</a></p>

<hr>
</blockquote>

<h3>ZFS and FreeBSD Support</h3>

<p>Klara offers flexible Support Subscriptions for your ZFS and FreeBSD infrastructure, simply sign up for our monthly subscription! What&#39;s even better is that for the month of October we are giving away 3 months for free, for every yearly subscription, and one month free when you sign up for a 6-months subscription! <a href="https://klarasystems.com/support/" rel="nofollow">Check it out on our website!</a></p>

<h2>News Roundup</h2>

<h3><a href="https://fibric.hashnode.dev/bastillebsd-native-container-management-for-freebsd" rel="nofollow">BastilleBSD - native container management for FreeBSD</a></h3>

<blockquote>
<p>Some time ago, I had the requirement to use FreeBSD in a project, and soon the question came up if Docker and Kubernetes can be used.<br>
On FreeBSD, Docker is not very well supported, and even if you can get it running, Linux is used in a Docker container. My experience with Docker on FreeBSD is awful, and so I started looking for alternatives.<br>
A quick search on one of the most significant online search engines led me to Jails and then to BastilleBSD.</p>
</blockquote>

<hr>

<h3><a href="https://dan.langille.org/2020/09/10/tarsnap-cleaning-up-old-backups/" rel="nofollow">Tarsnap – cleaning up old backups</a></h3>

<blockquote>
<p>I use Tarsnap for my critical data. Case in point, I use it to backup my Bacula database dump. I use Bacula to backup my hosts. The database in question keeps track of what was backed up, from what host, the file size, checksum, where that backup is now, and many other items. Losing this data is annoying but not a disaster. It can be recreated from the backup volumes, but that is time consuming. As it is, the file is dumped daily, and rsynced to multiple locations.</p>
</blockquote>

<hr>

<h3><a href="https://mwl.io/archives/8009" rel="nofollow">MWL - BookSale</a></h3>

<blockquote>
<p>For those interested in such things, I recently posted my 60,000th tweet. This prodded me to try an experiment I’ve been pondering for a while.<br>
Over at my ebookstore, two of my books are now on a “Name Your Own Price” sale. You can get git commit murder and PAM Mastery for any price you wish, with a minimum of $1.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=O9upVbGSBFo" rel="nofollow">Brian Kernighan: UNIX, C, AWK, AMPL, and Go Programming | Lex Fridman Podcast #109</a></li>
<li><a href="https://chsasank.github.io/classic_papers/unix-time-sharing-system.html#" rel="nofollow">The UNIX Time-Sharing System - Dennis M. Ritchie and Ken Thompson -  July 1974</a></li>
<li><a href="https://www.youtube.com/watch?v=2XLZ4Z8LpEE" rel="nofollow">Using a 1930 Teletype as a Linux Terminal</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/lars%20-%20infosec%20handbook.md" rel="nofollow">lars - infosec handbook</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/scott%20-%20zfs%20import.md" rel="nofollow">scott - zfs import</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/zhong%20-%20first%20episode.md" rel="nofollow">zhong - first episode</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 6.8 has been released, NetBSD 9.1 is out, OpenZFS devsummit report, BastilleBSD’s native container management for FreeBSD, cleaning up old tarsnap backups, Michael W. Lucas’ book sale, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/68.html" rel="nofollow">OpenBSD 6.8</a></h3>

<blockquote>
<p>Released Oct 18, 2020. (OpenBSD&#39;s 25th anniversary)</p>

<hr>

<h3><a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.1.html" rel="nofollow">NetBSD 9.1 Released</a></h3>

<p>The NetBSD Project is pleased to announce NetBSD 9.1, the first update of the NetBSD 9 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</p>

<hr>
</blockquote>

<h3><a href="https://klarasystems.com/articles/openzfs-developer-summit-part-1/" rel="nofollow">OpenZFS Developer Summit 2020</a></h3>

<blockquote>
<p>As with most other conferences in the last six months, this year’s OpenZFS Developer’s Summit was a bit different than usual. Held via Zoom to accommodate for 2020’s new normal in terms of social engagements, the conference featured a mix of talks delivered live via webinars, and breakout sessions held as regular meetings. This helped recapture some of the “hallway track” that would be lost in an online conference.<br>
    • After attending the conference, I wrote up some of my notes from each of the talks<br>
    • <a href="https://klarasystems.com/articles/openzfs-developer-summit-part-2/" rel="nofollow">Part 2</a></p>

<hr>
</blockquote>

<h3>ZFS and FreeBSD Support</h3>

<p>Klara offers flexible Support Subscriptions for your ZFS and FreeBSD infrastructure, simply sign up for our monthly subscription! What&#39;s even better is that for the month of October we are giving away 3 months for free, for every yearly subscription, and one month free when you sign up for a 6-months subscription! <a href="https://klarasystems.com/support/" rel="nofollow">Check it out on our website!</a></p>

<h2>News Roundup</h2>

<h3><a href="https://fibric.hashnode.dev/bastillebsd-native-container-management-for-freebsd" rel="nofollow">BastilleBSD - native container management for FreeBSD</a></h3>

<blockquote>
<p>Some time ago, I had the requirement to use FreeBSD in a project, and soon the question came up if Docker and Kubernetes can be used.<br>
On FreeBSD, Docker is not very well supported, and even if you can get it running, Linux is used in a Docker container. My experience with Docker on FreeBSD is awful, and so I started looking for alternatives.<br>
A quick search on one of the most significant online search engines led me to Jails and then to BastilleBSD.</p>
</blockquote>

<hr>

<h3><a href="https://dan.langille.org/2020/09/10/tarsnap-cleaning-up-old-backups/" rel="nofollow">Tarsnap – cleaning up old backups</a></h3>

<blockquote>
<p>I use Tarsnap for my critical data. Case in point, I use it to backup my Bacula database dump. I use Bacula to backup my hosts. The database in question keeps track of what was backed up, from what host, the file size, checksum, where that backup is now, and many other items. Losing this data is annoying but not a disaster. It can be recreated from the backup volumes, but that is time consuming. As it is, the file is dumped daily, and rsynced to multiple locations.</p>
</blockquote>

<hr>

<h3><a href="https://mwl.io/archives/8009" rel="nofollow">MWL - BookSale</a></h3>

<blockquote>
<p>For those interested in such things, I recently posted my 60,000th tweet. This prodded me to try an experiment I’ve been pondering for a while.<br>
Over at my ebookstore, two of my books are now on a “Name Your Own Price” sale. You can get git commit murder and PAM Mastery for any price you wish, with a minimum of $1.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=O9upVbGSBFo" rel="nofollow">Brian Kernighan: UNIX, C, AWK, AMPL, and Go Programming | Lex Fridman Podcast #109</a></li>
<li><a href="https://chsasank.github.io/classic_papers/unix-time-sharing-system.html#" rel="nofollow">The UNIX Time-Sharing System - Dennis M. Ritchie and Ken Thompson -  July 1974</a></li>
<li><a href="https://www.youtube.com/watch?v=2XLZ4Z8LpEE" rel="nofollow">Using a 1930 Teletype as a Linux Terminal</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/lars%20-%20infosec%20handbook.md" rel="nofollow">lars - infosec handbook</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/scott%20-%20zfs%20import.md" rel="nofollow">scott - zfs import</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/zhong%20-%20first%20episode.md" rel="nofollow">zhong - first episode</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>373: Kyle Evans Interview</title>
  <link>https://www.bsdnow.tv/373</link>
  <guid isPermaLink="false">acdecc6a-f7b7-4d64-b64d-f7be713b78e2</guid>
  <pubDate>Thu, 22 Oct 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/acdecc6a-f7b7-4d64-b64d-f7be713b78e2.mp3" length="34011936" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We have an interview with Kyle Evans for you this week. We talk about his grep project, lua and flua in base, as well as bectl, being on the core team and a whole lot of other stuff.</itunes:subtitle>
  <itunes:duration>33:33</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We have an interview with Kyle Evans for you this week. We talk about his grep project, lua and flua in base, as well as bectl, being on the core team and a whole lot of other stuff.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Interview - Kyle Evans - kevans@freebsd.org (mailto:kevans@freebsd.org) / @kaevans91 (https://twitter.com/kaevans91)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, unix, os, berkeley, software, distribution, zfs, zpool, dataset, interview, kyle evans, bsd grep, lua, flua, bectl, core team, certctl, </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We have an interview with Kyle Evans for you this week. We talk about his grep project, lua and flua in base, as well as bectl, being on the core team and a whole lot of other stuff.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Interview - Kyle Evans - <a href="mailto:kevans@freebsd.org" rel="nofollow">kevans@freebsd.org</a> / <a href="https://twitter.com/kaevans91" rel="nofollow">@kaevans91</a></h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We have an interview with Kyle Evans for you this week. We talk about his grep project, lua and flua in base, as well as bectl, being on the core team and a whole lot of other stuff.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Interview - Kyle Evans - <a href="mailto:kevans@freebsd.org" rel="nofollow">kevans@freebsd.org</a> / <a href="https://twitter.com/kaevans91" rel="nofollow">@kaevans91</a></h2>

<hr>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>372: Slow SSD scrubs</title>
  <link>https://www.bsdnow.tv/372</link>
  <guid isPermaLink="false">30f77e86-34d4-4e1a-a1c7-32e62f393980</guid>
  <pubDate>Thu, 15 Oct 2020 06:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/30f77e86-34d4-4e1a-a1c7-32e62f393980.mp3" length="47975808" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Wayland on BSD, My BSD sucks less than yours, Even on SSDs, ongoing activity can slow down ZFS scrubs drastically, OpenBSD on the Desktop, simple shell status bar for OpenBSD and cwm, and more.</itunes:subtitle>
  <itunes:duration>48:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Wayland on BSD, My BSD sucks less than yours, Even on SSDs, ongoing activity can slow down ZFS scrubs drastically, OpenBSD on the Desktop, simple shell status bar for OpenBSD and cwm, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
Wayland on BSD (https://blog.netbsd.org/tnf/entry/wayland_on_netbsd_trials_and)
After I posted about the new default window manager in NetBSD I got a few questions, including "when is NetBSD switching from X11 to Wayland?", Wayland being X11's "new" rival. In this blog post, hopefully I can explain why we aren't yet!
My BSD sucks less than yours (https://www.bsdfrog.org/pub/events/my_bsd_sucks_less_than_yours-full_paper.pdf)
This paper will look at some of the differences between the FreeBSD and OpenBSD operating systems. It is not intended to be solely technical but will also show the different "visions" and design decisions that rule the way things are implemented. It is expected to be a subjective view from two BSD developers and does not pretend to represent these projects in any way.
Video
+ EuroBSDCon 2017 Part 1 (https://www.youtube.com/watch?v=ZhpaKuXKob4)
+ EuroBSDCon 2017 Part 2 (https://www.youtube.com/watch?v=cYp70KWD824)
News Roundup
Even on SSDs, ongoing activity can slow down ZFS scrubs drastically (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSSSDActivitySlowsScrubs)
Back in the days of our OmniOS fileservers, which used HDs (spinning rust) across iSCSI, we wound up changing kernel tunables to speed up ZFS scrubs and saw a significant improvement. When we migrated to our current Linux fileservers with SSDs, I didn't bother including these tunables (or the Linux equivalent), because I expected that SSDs were fast enough that it didn't matter. Indeed, our SSD pools generally scrub like lightning.
OpenBSD on the Desktop (Part I) (https://paedubucher.ch/articles/2020-09-05-openbsd-on-the-desktop-part-i.html)
Let's install OpenBSD on a Lenovo Thinkpad X270. I used this computer for my computer science studies. It has both Arch Linux and Windows 10 installed as dual boot. Now that I'm no longer required to run Windows, I can ditch the dual boot and install an operating system of my choice.
A simple shell status bar for OpenBSD and cwm(1) (https://www.tumfatig.net/20200923/a-simple-shell-status-bar-for-cwm/)
These days, I try to use simple and stock software as much as possible on my OpenBSD laptop. I’ve been playing with cwm(1) for weeks and I was missing a status bar. After trying things like Tint2, Polybar etc, I discovered @gonzalo’s termbar. Thanks a lot!
As I love scripting, I decided to build my own.
Beastie Bits
DragonFly v5.8.3 released to address to issues (http://lists.dragonflybsd.org/pipermail/commits/2020-September/769777.html)
OpenSSH 8.4 released (http://www.openssh.com/txt/release-8.4)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Dane - FreeBSD vs Linux in Microservices and Containters (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Dane%20-%20FreeBSD%20vs%20Linux%20in%20Microservices%20and%20Containters.md)
Mason - questions.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Mason%20-%20questions.md)
Michael - Tmux License.md (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Michael%20-%20Tmux%20License.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, unix, os, berkeley, software, distribution, zfs, zpool, dataset, interview, wayland, ssd, scrub, desktop, shell, status, status bar, cwm</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Wayland on BSD, My BSD sucks less than yours, Even on SSDs, ongoing activity can slow down ZFS scrubs drastically, OpenBSD on the Desktop, simple shell status bar for OpenBSD and cwm, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/wayland_on_netbsd_trials_and" rel="nofollow">Wayland on BSD</a></h3>

<blockquote>
<p>After I posted about the new default window manager in NetBSD I got a few questions, including &quot;when is NetBSD switching from X11 to Wayland?&quot;, Wayland being X11&#39;s &quot;new&quot; rival. In this blog post, hopefully I can explain why we aren&#39;t yet!</p>

<hr>

<h3><a href="https://www.bsdfrog.org/pub/events/my_bsd_sucks_less_than_yours-full_paper.pdf" rel="nofollow">My BSD sucks less than yours</a></h3>

<p>This paper will look at some of the differences between the FreeBSD and OpenBSD operating systems. It is not intended to be solely technical but will also show the different &quot;visions&quot; and design decisions that rule the way things are implemented. It is expected to be a subjective view from two BSD developers and does not pretend to represent these projects in any way.</p>

<p>Video</p>

<ul>
<li><a href="https://www.youtube.com/watch?v=ZhpaKuXKob4" rel="nofollow">EuroBSDCon 2017 Part 1</a></li>
<li><a href="https://www.youtube.com/watch?v=cYp70KWD824" rel="nofollow">EuroBSDCon 2017 Part 2</a></li>
</ul>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSSSDActivitySlowsScrubs" rel="nofollow">Even on SSDs, ongoing activity can slow down ZFS scrubs drastically</a></h3>

<blockquote>
<p>Back in the days of our OmniOS fileservers, which used HDs (spinning rust) across iSCSI, we wound up changing kernel tunables to speed up ZFS scrubs and saw a significant improvement. When we migrated to our current Linux fileservers with SSDs, I didn&#39;t bother including these tunables (or the Linux equivalent), because I expected that SSDs were fast enough that it didn&#39;t matter. Indeed, our SSD pools generally scrub like lightning.</p>

<hr>

<h3><a href="https://paedubucher.ch/articles/2020-09-05-openbsd-on-the-desktop-part-i.html" rel="nofollow">OpenBSD on the Desktop (Part I)</a></h3>

<p>Let&#39;s install OpenBSD on a Lenovo Thinkpad X270. I used this computer for my computer science studies. It has both Arch Linux and Windows 10 installed as dual boot. Now that I&#39;m no longer required to run Windows, I can ditch the dual boot and install an operating system of my choice.</p>

<hr>

<h3><a href="https://www.tumfatig.net/20200923/a-simple-shell-status-bar-for-cwm/" rel="nofollow">A simple shell status bar for OpenBSD and cwm(1)</a></h3>

<p>These days, I try to use simple and stock software as much as possible on my OpenBSD laptop. I’ve been playing with cwm(1) for weeks and I was missing a status bar. After trying things like Tint2, Polybar etc, I discovered @gonzalo’s termbar. Thanks a lot!<br>
As I love scripting, I decided to build my own.</p>

<hr>

<h2>Beastie Bits</h2>

<p><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-September/769777.html" rel="nofollow">DragonFly v5.8.3 released to address to issues</a><br>
<a href="http://www.openssh.com/txt/release-8.4" rel="nofollow">OpenSSH 8.4 released</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>
</blockquote>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Dane%20-%20FreeBSD%20vs%20Linux%20in%20Microservices%20and%20Containters.md" rel="nofollow">Dane - FreeBSD vs Linux in Microservices and Containters</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Mason%20-%20questions.md" rel="nofollow">Mason - questions.md</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Michael%20-%20Tmux%20License.md" rel="nofollow">Michael - Tmux License.md</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Wayland on BSD, My BSD sucks less than yours, Even on SSDs, ongoing activity can slow down ZFS scrubs drastically, OpenBSD on the Desktop, simple shell status bar for OpenBSD and cwm, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/wayland_on_netbsd_trials_and" rel="nofollow">Wayland on BSD</a></h3>

<blockquote>
<p>After I posted about the new default window manager in NetBSD I got a few questions, including &quot;when is NetBSD switching from X11 to Wayland?&quot;, Wayland being X11&#39;s &quot;new&quot; rival. In this blog post, hopefully I can explain why we aren&#39;t yet!</p>

<hr>

<h3><a href="https://www.bsdfrog.org/pub/events/my_bsd_sucks_less_than_yours-full_paper.pdf" rel="nofollow">My BSD sucks less than yours</a></h3>

<p>This paper will look at some of the differences between the FreeBSD and OpenBSD operating systems. It is not intended to be solely technical but will also show the different &quot;visions&quot; and design decisions that rule the way things are implemented. It is expected to be a subjective view from two BSD developers and does not pretend to represent these projects in any way.</p>

<p>Video</p>

<ul>
<li><a href="https://www.youtube.com/watch?v=ZhpaKuXKob4" rel="nofollow">EuroBSDCon 2017 Part 1</a></li>
<li><a href="https://www.youtube.com/watch?v=cYp70KWD824" rel="nofollow">EuroBSDCon 2017 Part 2</a></li>
</ul>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSSSDActivitySlowsScrubs" rel="nofollow">Even on SSDs, ongoing activity can slow down ZFS scrubs drastically</a></h3>

<blockquote>
<p>Back in the days of our OmniOS fileservers, which used HDs (spinning rust) across iSCSI, we wound up changing kernel tunables to speed up ZFS scrubs and saw a significant improvement. When we migrated to our current Linux fileservers with SSDs, I didn&#39;t bother including these tunables (or the Linux equivalent), because I expected that SSDs were fast enough that it didn&#39;t matter. Indeed, our SSD pools generally scrub like lightning.</p>

<hr>

<h3><a href="https://paedubucher.ch/articles/2020-09-05-openbsd-on-the-desktop-part-i.html" rel="nofollow">OpenBSD on the Desktop (Part I)</a></h3>

<p>Let&#39;s install OpenBSD on a Lenovo Thinkpad X270. I used this computer for my computer science studies. It has both Arch Linux and Windows 10 installed as dual boot. Now that I&#39;m no longer required to run Windows, I can ditch the dual boot and install an operating system of my choice.</p>

<hr>

<h3><a href="https://www.tumfatig.net/20200923/a-simple-shell-status-bar-for-cwm/" rel="nofollow">A simple shell status bar for OpenBSD and cwm(1)</a></h3>

<p>These days, I try to use simple and stock software as much as possible on my OpenBSD laptop. I’ve been playing with cwm(1) for weeks and I was missing a status bar. After trying things like Tint2, Polybar etc, I discovered @gonzalo’s termbar. Thanks a lot!<br>
As I love scripting, I decided to build my own.</p>

<hr>

<h2>Beastie Bits</h2>

<p><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-September/769777.html" rel="nofollow">DragonFly v5.8.3 released to address to issues</a><br>
<a href="http://www.openssh.com/txt/release-8.4" rel="nofollow">OpenSSH 8.4 released</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>
</blockquote>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Dane%20-%20FreeBSD%20vs%20Linux%20in%20Microservices%20and%20Containters.md" rel="nofollow">Dane - FreeBSD vs Linux in Microservices and Containters</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Mason%20-%20questions.md" rel="nofollow">Mason - questions.md</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Michael%20-%20Tmux%20License.md" rel="nofollow">Michael - Tmux License.md</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>371: Wildcards running wild</title>
  <link>https://www.bsdnow.tv/371</link>
  <guid isPermaLink="false">8f2644a5-d6f7-49ca-bcd6-1a6336110611</guid>
  <pubDate>Thu, 08 Oct 2020 06:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8f2644a5-d6f7-49ca-bcd6-1a6336110611.mp3" length="40775352" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>New Project: zedfs.com, TrueNAS CORE Ready for Deployment, IPC in FreeBSD 11: Performance Analysis, Unix Wildcards Gone Wild, Unix Wars, and more</itunes:subtitle>
  <itunes:duration>41:17</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>New Project: zedfs.com, TrueNAS CORE Ready for Deployment, IPC in FreeBSD 11: Performance Analysis, Unix Wildcards Gone Wild, Unix Wars, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
My New Project: zedfs.com (https://www.oshogbo.vexillium.org/blog/80/)
Have you ever had an idea that keeps coming back to you over and over again? For a week? For a month? I know that feeling. My new project was born from this feeling.
On this blog, I mix content a lot. I have written personal posts (not many of them, but still), FreeBSD development posts, development posts, security posts, and ZFS posts. This mixed content can be problematic sometimes. I share a lot of stuff here, and readers don’t know what to expect next. I am just excited by so many things, and I want to share that excitement with you!
TrueNAS CORE is Ready for Deployment (https://www.ixsystems.com/blog/truenas-12-rc-1/)
TrueNAS 12.0 RC1 was released yesterday and with it, TrueNAS CORE is ready for deployment. The merger of FreeNAS and TrueNAS into a unified software image can now begin its path into mainstream use. TrueNAS CORE is the new FreeNAS and is on schedule.
The TrueNAS 12.0 BETA process started in June and has been the most successful BETA release ever with more than 3,000 users and only minor issues. Ars Technica provided a detailed technical walkthrough of the original BETA. There is a long list of features and performance improvements. During the BETA process, TrueNAS 12.0 demonstrated over 1.2 Million IOPS and over 23GB/s on a TrueNAS M60.
News Roundup
Interprocess Communication in FreeBSD 11: Performance Analysis (https://arxiv.org/pdf/2008.02145.pdf)
Interprocess communication, IPC, is one of the most fundamental functions of a modern operating system, playing an essential role in the fabric of contemporary applications. This report conducts an investigation in FreeBSD of the real world performance considerations behind two of the most common IPC mechanisms; pipes and sockets. A simple benchmark provides a fair sense of effective bandwidth for each, and analysis using DTrace, hardware performance counters and the operating system’s source code is presented. We note that pipes outperform sockets by 63% on average across all configurations, and further that the size of userspace transmission buffers has a profound effect on performance — larger buffers are beneficial up to a point (∼ 32-64 KiB) after which performance collapses as a result of devastating cache exhaustion. A deep scrutiny of the probe effects at play is also presented, justifying the validity of conclusions drawn from these experiments.
Back To The Future: Unix Wildcards Gone Wild (https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt)
First of all, this article has nothing to do with modern hacking techniques like ASLR bypass, ROP exploits, 0day remote kernel exploits or Chrome's Chain-14-Different-Bugs-To-Get-There...  Nope, nothing of the above. This article will cover one interesting old-school Unix hacking technique, that will still work nowadays in 2013.
Unix Wars (https://www.livinginternet.com/i/iw_unix_war.htm)
Dozens of different operating systems have been developed over the years, but only Unix has grown in so many varieties. There are three main branches. Four factors have facilitated this growth...
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Chris - installing FreeBSD 13-current (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Chris%20-%20installing%20FreeBSD%2013-current.md)
Dane - FreeBSD History Lesson (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Dane%20-%20FreeBSD%20History%20Lesson.md)
Marc - linux compat (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Marc%20-%20linux%20compat.md)
Mason - apropos battery (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Mason%20-%20apropos%20battery.md)
Paul - a topic idea (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Paul%20-%20a%20topic%20idea.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, zpool, dataset, interview, truenas, truenas core, IPC, interprocess, communication, performance, performance analysis, Unix, wildcards, Unix wars</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>New Project: zedfs.com, TrueNAS CORE Ready for Deployment, IPC in FreeBSD 11: Performance Analysis, Unix Wildcards Gone Wild, Unix Wars, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.oshogbo.vexillium.org/blog/80/" rel="nofollow">My New Project: zedfs.com</a></h3>

<blockquote>
<p>Have you ever had an idea that keeps coming back to you over and over again? For a week? For a month? I know that feeling. My new project was born from this feeling.<br>
On this blog, I mix content a lot. I have written personal posts (not many of them, but still), FreeBSD development posts, development posts, security posts, and ZFS posts. This mixed content can be problematic sometimes. I share a lot of stuff here, and readers don’t know what to expect next. I am just excited by so many things, and I want to share that excitement with you!</p>

<hr>
</blockquote>

<h3><a href="https://www.ixsystems.com/blog/truenas-12-rc-1/" rel="nofollow">TrueNAS CORE is Ready for Deployment</a></h3>

<blockquote>
<p>TrueNAS 12.0 RC1 was released yesterday and with it, TrueNAS CORE is ready for deployment. The merger of FreeNAS and TrueNAS into a unified software image can now begin its path into mainstream use. TrueNAS CORE is the new FreeNAS and is on schedule.<br>
The TrueNAS 12.0 BETA process started in June and has been the most successful BETA release ever with more than 3,000 users and only minor issues. Ars Technica provided a detailed technical walkthrough of the original BETA. There is a long list of features and performance improvements. During the BETA process, TrueNAS 12.0 demonstrated over 1.2 Million IOPS and over 23GB/s on a TrueNAS M60.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://arxiv.org/pdf/2008.02145.pdf" rel="nofollow">Interprocess Communication in FreeBSD 11: Performance Analysis</a></h3>

<blockquote>
<p>Interprocess communication, IPC, is one of the most fundamental functions of a modern operating system, playing an essential role in the fabric of contemporary applications. This report conducts an investigation in FreeBSD of the real world performance considerations behind two of the most common IPC mechanisms; pipes and sockets. A simple benchmark provides a fair sense of effective bandwidth for each, and analysis using DTrace, hardware performance counters and the operating system’s source code is presented. We note that pipes outperform sockets by 63% on average across all configurations, and further that the size of userspace transmission buffers has a profound effect on performance — larger buffers are beneficial up to a point (∼ 32-64 KiB) after which performance collapses as a result of devastating cache exhaustion. A deep scrutiny of the probe effects at play is also presented, justifying the validity of conclusions drawn from these experiments.</p>

<hr>
</blockquote>

<h3><a href="https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt" rel="nofollow">Back To The Future: Unix Wildcards Gone Wild</a></h3>

<blockquote>
<p>First of all, this article has nothing to do with modern hacking techniques like ASLR bypass, ROP exploits, 0day remote kernel exploits or Chrome&#39;s Chain-14-Different-Bugs-To-Get-There...  Nope, nothing of the above. This article will cover one interesting old-school Unix hacking technique, that will still work nowadays in 2013.</p>

<hr>
</blockquote>

<h3><a href="https://www.livinginternet.com/i/iw_unix_war.htm" rel="nofollow">Unix Wars</a></h3>

<blockquote>
<p>Dozens of different operating systems have been developed over the years, but only Unix has grown in so many varieties. There are three main branches. Four factors have facilitated this growth...</p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Chris%20-%20installing%20FreeBSD%2013-current.md" rel="nofollow">Chris - installing FreeBSD 13-current</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Dane%20-%20FreeBSD%20History%20Lesson.md" rel="nofollow">Dane - FreeBSD History Lesson</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Marc%20-%20linux%20compat.md" rel="nofollow">Marc - linux compat</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Mason%20-%20apropos%20battery.md" rel="nofollow">Mason - apropos battery</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Paul%20-%20a%20topic%20idea.md" rel="nofollow">Paul - a topic idea</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>New Project: zedfs.com, TrueNAS CORE Ready for Deployment, IPC in FreeBSD 11: Performance Analysis, Unix Wildcards Gone Wild, Unix Wars, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.oshogbo.vexillium.org/blog/80/" rel="nofollow">My New Project: zedfs.com</a></h3>

<blockquote>
<p>Have you ever had an idea that keeps coming back to you over and over again? For a week? For a month? I know that feeling. My new project was born from this feeling.<br>
On this blog, I mix content a lot. I have written personal posts (not many of them, but still), FreeBSD development posts, development posts, security posts, and ZFS posts. This mixed content can be problematic sometimes. I share a lot of stuff here, and readers don’t know what to expect next. I am just excited by so many things, and I want to share that excitement with you!</p>

<hr>
</blockquote>

<h3><a href="https://www.ixsystems.com/blog/truenas-12-rc-1/" rel="nofollow">TrueNAS CORE is Ready for Deployment</a></h3>

<blockquote>
<p>TrueNAS 12.0 RC1 was released yesterday and with it, TrueNAS CORE is ready for deployment. The merger of FreeNAS and TrueNAS into a unified software image can now begin its path into mainstream use. TrueNAS CORE is the new FreeNAS and is on schedule.<br>
The TrueNAS 12.0 BETA process started in June and has been the most successful BETA release ever with more than 3,000 users and only minor issues. Ars Technica provided a detailed technical walkthrough of the original BETA. There is a long list of features and performance improvements. During the BETA process, TrueNAS 12.0 demonstrated over 1.2 Million IOPS and over 23GB/s on a TrueNAS M60.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://arxiv.org/pdf/2008.02145.pdf" rel="nofollow">Interprocess Communication in FreeBSD 11: Performance Analysis</a></h3>

<blockquote>
<p>Interprocess communication, IPC, is one of the most fundamental functions of a modern operating system, playing an essential role in the fabric of contemporary applications. This report conducts an investigation in FreeBSD of the real world performance considerations behind two of the most common IPC mechanisms; pipes and sockets. A simple benchmark provides a fair sense of effective bandwidth for each, and analysis using DTrace, hardware performance counters and the operating system’s source code is presented. We note that pipes outperform sockets by 63% on average across all configurations, and further that the size of userspace transmission buffers has a profound effect on performance — larger buffers are beneficial up to a point (∼ 32-64 KiB) after which performance collapses as a result of devastating cache exhaustion. A deep scrutiny of the probe effects at play is also presented, justifying the validity of conclusions drawn from these experiments.</p>

<hr>
</blockquote>

<h3><a href="https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt" rel="nofollow">Back To The Future: Unix Wildcards Gone Wild</a></h3>

<blockquote>
<p>First of all, this article has nothing to do with modern hacking techniques like ASLR bypass, ROP exploits, 0day remote kernel exploits or Chrome&#39;s Chain-14-Different-Bugs-To-Get-There...  Nope, nothing of the above. This article will cover one interesting old-school Unix hacking technique, that will still work nowadays in 2013.</p>

<hr>
</blockquote>

<h3><a href="https://www.livinginternet.com/i/iw_unix_war.htm" rel="nofollow">Unix Wars</a></h3>

<blockquote>
<p>Dozens of different operating systems have been developed over the years, but only Unix has grown in so many varieties. There are three main branches. Four factors have facilitated this growth...</p>

<hr>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Chris%20-%20installing%20FreeBSD%2013-current.md" rel="nofollow">Chris - installing FreeBSD 13-current</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Dane%20-%20FreeBSD%20History%20Lesson.md" rel="nofollow">Dane - FreeBSD History Lesson</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Marc%20-%20linux%20compat.md" rel="nofollow">Marc - linux compat</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Mason%20-%20apropos%20battery.md" rel="nofollow">Mason - apropos battery</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Paul%20-%20a%20topic%20idea.md" rel="nofollow">Paul - a topic idea</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>370: Testing shutdown</title>
  <link>https://www.bsdnow.tv/370</link>
  <guid isPermaLink="false">4bc93957-8853-4c7a-b016-604d770c5b71</guid>
  <pubDate>Thu, 01 Oct 2020 06:15:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4bc93957-8853-4c7a-b016-604d770c5b71.mp3" length="43353456" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The world’s first OpenZFS based live image, FreeBSD Subversion to Git Migration video, FreeBSD Instant-workstation 2020, testing the shutdown mechanism, login_ldap added to OpenBSD, and more</itunes:subtitle>
  <itunes:duration>45:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The world’s first OpenZFS based live image, FreeBSD Subversion to Git Migration video, FreeBSD Instant-workstation 2020, testing the shutdown mechanism, login_ldap added to OpenBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
FuryBSD 2020-Q3 The world’s first OpenZFS based live image (https://www.furybsd.org/furybsd-2020-q3-the-worlds-first-openzfs-based-live-image/)
FuryBSD is a tool to test drive stock FreeBSD desktop images in read write mode to see if it will work for you before installing.  In order to provide the most reliable experience possible while preserving the integrity of the system the LiveCD now leverages ZFS, compression, replication, a memory file system, and reroot (pivot root).
FreeBSD Subversion to Git Migration: Pt 1 Why? (https://bsdimp.blogspot.com/2020/09/freebsd-subversion-to-git-migration.html)
FreeBSD moving to Git: Why?  With luck, I'll be writing a few blogs on FreeBSD's move to git later this year. Today, we'll start with "why"?
Video from Warner Losh (https://www.youtube.com/watch?v=Lx9lKr_M-DI)
News Roundup
FreeBSD Instant-workstation 2020 (https://euroquis.nl/freebsd/2020/09/17/instant-workstation.html)
A little over a year ago I published an instant-workstation script for FreeBSD. The idea is to have an installed FreeBSD system, then run a shell script that uses only base-system utilities and installs and configures a workstation setup for you.
nut – testing the shutdown mechanism (https://dan.langille.org/2020/09/10/nut-testing-the-shutdown-mechanism/)
Following on from my recent nut setup, this is the second in a series of three posts.
The next post will deal with adjusting startup and shutdown times to be sure everything proceeds as required.
login_ldap added to OpenBSD -current (https://undeadly.org/cgi?action=article;sid=20200913081040)
With this commit, Martijn van Duren (martijn@) added login_ldap(8) to -current
+ https://marc.info/?l=openbsd-cvs&amp;amp;m=159992319027593&amp;amp;w=2
Beastie Bits
NetBSD current now has GCC 9.3.0 for x86/ARM (https://twitter.com/netbsd/status/1305082782457245696)
MidnightBSD 1.2.8 (https://www.justjournal.com/users/mbsd/entry/33802)
MidnightBSD 2.0-Current (https://www.justjournal.com/users/mbsd/entry/33806)
Retro UNIX 8086 v1 operating system has been developed by Erdogan Tan as a special purposed derivation of original UNIX v1 (https://www.singlix.com/runix/)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Rick - rcorder (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/Rick%20-%20rcorder.md)
Dan - machiatto bin (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/dan%20-%20machiatto%20bin.md)
Luis - old episodes (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/luis%20-%20old%20episodes.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, zpool, dataset, interview, live image, migration, git, video, workstation, testing, shutdown, mechanism, login_ldap, ldap, login</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The world’s first OpenZFS based live image, FreeBSD Subversion to Git Migration video, FreeBSD Instant-workstation 2020, testing the shutdown mechanism, login_ldap added to OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.furybsd.org/furybsd-2020-q3-the-worlds-first-openzfs-based-live-image/" rel="nofollow">FuryBSD 2020-Q3 The world’s first OpenZFS based live image</a></h3>

<blockquote>
<p>FuryBSD is a tool to test drive stock FreeBSD desktop images in read write mode to see if it will work for you before installing.  In order to provide the most reliable experience possible while preserving the integrity of the system the LiveCD now leverages ZFS, compression, replication, a memory file system, and reroot (pivot root).</p>

<hr>
</blockquote>

<h3><a href="https://bsdimp.blogspot.com/2020/09/freebsd-subversion-to-git-migration.html" rel="nofollow">FreeBSD Subversion to Git Migration: Pt 1 Why?</a></h3>

<blockquote>
<p>FreeBSD moving to Git: Why?  With luck, I&#39;ll be writing a few blogs on FreeBSD&#39;s move to git later this year. Today, we&#39;ll start with &quot;why&quot;?<br>
<a href="https://www.youtube.com/watch?v=Lx9lKr_M-DI" rel="nofollow">Video from Warner Losh</a></p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://euroquis.nl/freebsd/2020/09/17/instant-workstation.html" rel="nofollow">FreeBSD Instant-workstation 2020</a></h3>

<blockquote>
<p>A little over a year ago I published an instant-workstation script for FreeBSD. The idea is to have an installed FreeBSD system, then run a shell script that uses only base-system utilities and installs and configures a workstation setup for you.</p>

<hr>
</blockquote>

<h3><a href="https://dan.langille.org/2020/09/10/nut-testing-the-shutdown-mechanism/" rel="nofollow">nut – testing the shutdown mechanism</a></h3>

<blockquote>
<p>Following on from my recent nut setup, this is the second in a series of three posts.<br>
The next post will deal with adjusting startup and shutdown times to be sure everything proceeds as required.</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20200913081040" rel="nofollow">login_ldap added to OpenBSD -current</a></h3>

<blockquote>
<p>With this commit, Martijn van Duren (martijn@) added login_ldap(8) to -current</p>

<ul>
<li><a href="https://marc.info/?l=openbsd-cvs&m=159992319027593&w=2" rel="nofollow">https://marc.info/?l=openbsd-cvs&amp;m=159992319027593&amp;w=2</a>
***</li>
</ul>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/netbsd/status/1305082782457245696" rel="nofollow">NetBSD current now has GCC 9.3.0 for x86/ARM</a></li>
<li><a href="https://www.justjournal.com/users/mbsd/entry/33802" rel="nofollow">MidnightBSD 1.2.8</a></li>
<li><a href="https://www.justjournal.com/users/mbsd/entry/33806" rel="nofollow">MidnightBSD 2.0-Current</a></li>
<li><a href="https://www.singlix.com/runix/" rel="nofollow">Retro UNIX 8086 v1 operating system has been developed by Erdogan Tan as a special purposed derivation of original UNIX v1</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/Rick%20-%20rcorder.md" rel="nofollow">Rick - rcorder</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/dan%20-%20machiatto%20bin.md" rel="nofollow">Dan - machiatto bin</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/luis%20-%20old%20episodes.md" rel="nofollow">Luis - old episodes</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The world’s first OpenZFS based live image, FreeBSD Subversion to Git Migration video, FreeBSD Instant-workstation 2020, testing the shutdown mechanism, login_ldap added to OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.furybsd.org/furybsd-2020-q3-the-worlds-first-openzfs-based-live-image/" rel="nofollow">FuryBSD 2020-Q3 The world’s first OpenZFS based live image</a></h3>

<blockquote>
<p>FuryBSD is a tool to test drive stock FreeBSD desktop images in read write mode to see if it will work for you before installing.  In order to provide the most reliable experience possible while preserving the integrity of the system the LiveCD now leverages ZFS, compression, replication, a memory file system, and reroot (pivot root).</p>

<hr>
</blockquote>

<h3><a href="https://bsdimp.blogspot.com/2020/09/freebsd-subversion-to-git-migration.html" rel="nofollow">FreeBSD Subversion to Git Migration: Pt 1 Why?</a></h3>

<blockquote>
<p>FreeBSD moving to Git: Why?  With luck, I&#39;ll be writing a few blogs on FreeBSD&#39;s move to git later this year. Today, we&#39;ll start with &quot;why&quot;?<br>
<a href="https://www.youtube.com/watch?v=Lx9lKr_M-DI" rel="nofollow">Video from Warner Losh</a></p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://euroquis.nl/freebsd/2020/09/17/instant-workstation.html" rel="nofollow">FreeBSD Instant-workstation 2020</a></h3>

<blockquote>
<p>A little over a year ago I published an instant-workstation script for FreeBSD. The idea is to have an installed FreeBSD system, then run a shell script that uses only base-system utilities and installs and configures a workstation setup for you.</p>

<hr>
</blockquote>

<h3><a href="https://dan.langille.org/2020/09/10/nut-testing-the-shutdown-mechanism/" rel="nofollow">nut – testing the shutdown mechanism</a></h3>

<blockquote>
<p>Following on from my recent nut setup, this is the second in a series of three posts.<br>
The next post will deal with adjusting startup and shutdown times to be sure everything proceeds as required.</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20200913081040" rel="nofollow">login_ldap added to OpenBSD -current</a></h3>

<blockquote>
<p>With this commit, Martijn van Duren (martijn@) added login_ldap(8) to -current</p>

<ul>
<li><a href="https://marc.info/?l=openbsd-cvs&m=159992319027593&w=2" rel="nofollow">https://marc.info/?l=openbsd-cvs&amp;m=159992319027593&amp;w=2</a>
***</li>
</ul>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/netbsd/status/1305082782457245696" rel="nofollow">NetBSD current now has GCC 9.3.0 for x86/ARM</a></li>
<li><a href="https://www.justjournal.com/users/mbsd/entry/33802" rel="nofollow">MidnightBSD 1.2.8</a></li>
<li><a href="https://www.justjournal.com/users/mbsd/entry/33806" rel="nofollow">MidnightBSD 2.0-Current</a></li>
<li><a href="https://www.singlix.com/runix/" rel="nofollow">Retro UNIX 8086 v1 operating system has been developed by Erdogan Tan as a special purposed derivation of original UNIX v1</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/Rick%20-%20rcorder.md" rel="nofollow">Rick - rcorder</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/dan%20-%20machiatto%20bin.md" rel="nofollow">Dan - machiatto bin</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/luis%20-%20old%20episodes.md" rel="nofollow">Luis - old episodes</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>369: Where rc.d belongs</title>
  <link>https://www.bsdnow.tv/369</link>
  <guid isPermaLink="false">3594bb2c-b1c8-4f13-bcb9-6ad5094179a5</guid>
  <pubDate>Thu, 24 Sep 2020 12:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3594bb2c-b1c8-4f13-bcb9-6ad5094179a5.mp3" length="43421016" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated, Building the Development Version of Emacs on NetBSD, rc.d belongs in libexec, not etc, FreeBSD 11.3 EOL, OPNsense 20.7.1 Released, MidnightBSD 1.2.7 out, and more.</itunes:subtitle>
  <itunes:duration>44:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated, Building the Development Version of Emacs on NetBSD, rc.d belongs in libexec, not etc, FreeBSD 11.3 EOL, OPNsense 20.7.1 Released, MidnightBSD 1.2.7 out, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/bsdnow)
Headlines
High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated (https://dzone.com/articles/high-availability-routerfirewall-using-openbsd-car)
I have been running OpenBSD on a Soekris net5501 for my router/firewall since early 2012. Because I run a multitude of services on this system (more on that later), the meager 500Mhz AMD Geode + 512MB SDRAM was starting to get a little sluggish while trying to do anything via the terminal. Despite the perceived performance hit during interactive SSH sessions, it still supported a full 100Mbit connection with NAT, so I wasn’t overly eager to change anything. Luckily though, my ISP increased the bandwidth available on my plan tier to 150Mbit+. Unfortunately, the Soekris only contained 4xVIA Rhine Fast Ethernet. So now, I was using a slow system and wasting money by not being able to fully utilize my connection.
Building the Development Version of Emacs on NetBSD (https://lars.ingebrigtsen.no/2020/08/25/building-the-development-version-of-emacs-on-netbsd/)
I hadn’t really planned on installing a NetBSD VM (after doing all the other two BSDs), but then a NetBSD-related Emacs bug report arrived.
News Roundup
rc.d belongs in libexec, not etc (https://jmmv.dev/2020/08/rcd-libexec-etc.html)
Let’s open with the controversy: the scripts that live under /etc/rc.d/ in FreeBSD, NetBSD, and OpenBSD are in the wrong place. They all should live in /libexec/rc.d/ because they are code, not configuration.
This misplacement is something that has bugged me for ages but I never had the energy to open this can of worms back when I was very involved in NetBSD. I suspect it would have been a draining discussion and a very difficult thing to change.
FreeBSD 11.3 EOL (https://lists.freebsd.org/pipermail/freebsd-announce/2020-September/001982.html)
As of September 30, 2020, FreeBSD 11.3 will reach end-of-life and will no longer
be supported by the FreeBSD Security Team.  Users of FreeBSD 11.3 are strongly
encouraged to upgrade to a newer release as soon as possible.
OPNsense 20.7.1 Released (https://opnsense.org/opnsense-20-7-1-released/)
Overall, the jump to HardenedBSD 12.1 is looking promising from our end. From the reported issues we still have more logging quirks to investigate and especially Netmap support (used in IPS and Sensei) is lacking in some areas that were previously working. Patches are being worked on already so we shall get there soon enough.  Stay tuned.
MidnightBSD 1.2.7 out (https://www.justjournal.com/users/mbsd/entry/33801)
MidnightBSD 1.2.7 is available via the FTP/HTTP and mirrors as well as github.  
It includes several bug fixes and security updates over the last ISO release and is recommended for new installations.  
Users who don't want to updatee the whole OS, should consider at least updating libmport as there are many package management fixes
Beastie Bits
Tarsnap podcast (https://blog.firosolutions.com/2020/08/tarsnap-podcast/)
NetBSD Tips and Tricks (http://students.engr.scu.edu/~sschaeck/netbsd/index.html)
FreeBSD mini-git Primer (https://hackmd.io/hJgnfzd5TMK-VHgUzshA2g)
GhostBSD Financial Reports (https://ghostbsd.org/financial_reports_from_January_to_June_2020)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Daniel - Documentation Tooling (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Daniel%20-%20Documentation%20Tooling.md)
Fongaboo - Where did the ZFS tutorial Go? (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Fongaboo%20-%20Where%20did%20the%20ZFS%20Tutorial%20Go.md)
Johnny - Browser Cold Wars (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Johnny%20-%20Browser%20Cold%20Wars.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, zpool, dataset, interview, ha, high availability, carp, pfsync, ifstated, development, emacs, rc.d, libexec, etc, end of life, release, opnsense, midnightbsd </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated, Building the Development Version of Emacs on NetBSD, rc.d belongs in libexec, not etc, FreeBSD 11.3 EOL, OPNsense 20.7.1 Released, MidnightBSD 1.2.7 out, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://dzone.com/articles/high-availability-routerfirewall-using-openbsd-car" rel="nofollow">High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated</a></h3>

<blockquote>
<p>I have been running OpenBSD on a Soekris net5501 for my router/firewall since early 2012. Because I run a multitude of services on this system (more on that later), the meager 500Mhz AMD Geode + 512MB SDRAM was starting to get a little sluggish while trying to do anything via the terminal. Despite the perceived performance hit during interactive SSH sessions, it still supported a full 100Mbit connection with NAT, so I wasn’t overly eager to change anything. Luckily though, my ISP increased the bandwidth available on my plan tier to 150Mbit+. Unfortunately, the Soekris only contained 4xVIA Rhine Fast Ethernet. So now, I was using a slow system and wasting money by not being able to fully utilize my connection.</p>
</blockquote>

<hr>

<h3><a href="https://lars.ingebrigtsen.no/2020/08/25/building-the-development-version-of-emacs-on-netbsd/" rel="nofollow">Building the Development Version of Emacs on NetBSD</a></h3>

<blockquote>
<p>I hadn’t really planned on installing a NetBSD VM (after doing all the other two BSDs), but then a NetBSD-related Emacs bug report arrived.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jmmv.dev/2020/08/rcd-libexec-etc.html" rel="nofollow">rc.d belongs in libexec, not etc</a></h3>

<blockquote>
<p>Let’s open with the controversy: the scripts that live under /etc/rc.d/ in FreeBSD, NetBSD, and OpenBSD are in the wrong place. They all should live in /libexec/rc.d/ because they are code, not configuration.<br>
This misplacement is something that has bugged me for ages but I never had the energy to open this can of worms back when I was very involved in NetBSD. I suspect it would have been a draining discussion and a very difficult thing to change.</p>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-September/001982.html" rel="nofollow">FreeBSD 11.3 EOL</a></h3>

<blockquote>
<p>As of September 30, 2020, FreeBSD 11.3 will reach end-of-life and will no longer<br>
be supported by the FreeBSD Security Team.  Users of FreeBSD 11.3 are strongly<br>
encouraged to upgrade to a newer release as soon as possible.</p>
</blockquote>

<hr>

<h3><a href="https://opnsense.org/opnsense-20-7-1-released/" rel="nofollow">OPNsense 20.7.1 Released</a></h3>

<blockquote>
<p>Overall, the jump to HardenedBSD 12.1 is looking promising from our end. From the reported issues we still have more logging quirks to investigate and especially Netmap support (used in IPS and Sensei) is lacking in some areas that were previously working. Patches are being worked on already so we shall get there soon enough.  Stay tuned.</p>
</blockquote>

<hr>

<h3><a href="https://www.justjournal.com/users/mbsd/entry/33801" rel="nofollow">MidnightBSD 1.2.7 out</a></h3>

<blockquote>
<p>MidnightBSD 1.2.7 is available via the FTP/HTTP and mirrors as well as github.<br><br>
It includes several bug fixes and security updates over the last ISO release and is recommended for new installations.<br><br>
Users who don&#39;t want to updatee the whole OS, should consider at least updating libmport as there are many package management fixes</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.firosolutions.com/2020/08/tarsnap-podcast/" rel="nofollow">Tarsnap podcast</a></li>
<li><a href="http://students.engr.scu.edu/%7Esschaeck/netbsd/index.html" rel="nofollow">NetBSD Tips and Tricks</a></li>
<li><a href="https://hackmd.io/hJgnfzd5TMK-VHgUzshA2g" rel="nofollow">FreeBSD mini-git Primer</a></li>
<li><a href="https://ghostbsd.org/financial_reports_from_January_to_June_2020" rel="nofollow">GhostBSD Financial Reports</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Daniel%20-%20Documentation%20Tooling.md" rel="nofollow">Daniel - Documentation Tooling</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Fongaboo%20-%20Where%20did%20the%20ZFS%20Tutorial%20Go.md" rel="nofollow">Fongaboo - Where did the ZFS tutorial Go?</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Johnny%20-%20Browser%20Cold%20Wars.md" rel="nofollow">Johnny - Browser Cold Wars</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated, Building the Development Version of Emacs on NetBSD, rc.d belongs in libexec, not etc, FreeBSD 11.3 EOL, OPNsense 20.7.1 Released, MidnightBSD 1.2.7 out, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://dzone.com/articles/high-availability-routerfirewall-using-openbsd-car" rel="nofollow">High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated</a></h3>

<blockquote>
<p>I have been running OpenBSD on a Soekris net5501 for my router/firewall since early 2012. Because I run a multitude of services on this system (more on that later), the meager 500Mhz AMD Geode + 512MB SDRAM was starting to get a little sluggish while trying to do anything via the terminal. Despite the perceived performance hit during interactive SSH sessions, it still supported a full 100Mbit connection with NAT, so I wasn’t overly eager to change anything. Luckily though, my ISP increased the bandwidth available on my plan tier to 150Mbit+. Unfortunately, the Soekris only contained 4xVIA Rhine Fast Ethernet. So now, I was using a slow system and wasting money by not being able to fully utilize my connection.</p>
</blockquote>

<hr>

<h3><a href="https://lars.ingebrigtsen.no/2020/08/25/building-the-development-version-of-emacs-on-netbsd/" rel="nofollow">Building the Development Version of Emacs on NetBSD</a></h3>

<blockquote>
<p>I hadn’t really planned on installing a NetBSD VM (after doing all the other two BSDs), but then a NetBSD-related Emacs bug report arrived.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jmmv.dev/2020/08/rcd-libexec-etc.html" rel="nofollow">rc.d belongs in libexec, not etc</a></h3>

<blockquote>
<p>Let’s open with the controversy: the scripts that live under /etc/rc.d/ in FreeBSD, NetBSD, and OpenBSD are in the wrong place. They all should live in /libexec/rc.d/ because they are code, not configuration.<br>
This misplacement is something that has bugged me for ages but I never had the energy to open this can of worms back when I was very involved in NetBSD. I suspect it would have been a draining discussion and a very difficult thing to change.</p>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-September/001982.html" rel="nofollow">FreeBSD 11.3 EOL</a></h3>

<blockquote>
<p>As of September 30, 2020, FreeBSD 11.3 will reach end-of-life and will no longer<br>
be supported by the FreeBSD Security Team.  Users of FreeBSD 11.3 are strongly<br>
encouraged to upgrade to a newer release as soon as possible.</p>
</blockquote>

<hr>

<h3><a href="https://opnsense.org/opnsense-20-7-1-released/" rel="nofollow">OPNsense 20.7.1 Released</a></h3>

<blockquote>
<p>Overall, the jump to HardenedBSD 12.1 is looking promising from our end. From the reported issues we still have more logging quirks to investigate and especially Netmap support (used in IPS and Sensei) is lacking in some areas that were previously working. Patches are being worked on already so we shall get there soon enough.  Stay tuned.</p>
</blockquote>

<hr>

<h3><a href="https://www.justjournal.com/users/mbsd/entry/33801" rel="nofollow">MidnightBSD 1.2.7 out</a></h3>

<blockquote>
<p>MidnightBSD 1.2.7 is available via the FTP/HTTP and mirrors as well as github.<br><br>
It includes several bug fixes and security updates over the last ISO release and is recommended for new installations.<br><br>
Users who don&#39;t want to updatee the whole OS, should consider at least updating libmport as there are many package management fixes</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.firosolutions.com/2020/08/tarsnap-podcast/" rel="nofollow">Tarsnap podcast</a></li>
<li><a href="http://students.engr.scu.edu/%7Esschaeck/netbsd/index.html" rel="nofollow">NetBSD Tips and Tricks</a></li>
<li><a href="https://hackmd.io/hJgnfzd5TMK-VHgUzshA2g" rel="nofollow">FreeBSD mini-git Primer</a></li>
<li><a href="https://ghostbsd.org/financial_reports_from_January_to_June_2020" rel="nofollow">GhostBSD Financial Reports</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Daniel%20-%20Documentation%20Tooling.md" rel="nofollow">Daniel - Documentation Tooling</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Fongaboo%20-%20Where%20did%20the%20ZFS%20Tutorial%20Go.md" rel="nofollow">Fongaboo - Where did the ZFS tutorial Go?</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Johnny%20-%20Browser%20Cold%20Wars.md" rel="nofollow">Johnny - Browser Cold Wars</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>368: Changing OS roles</title>
  <link>https://www.bsdnow.tv/368</link>
  <guid isPermaLink="false">4d186dc4-b8ee-4824-bfcc-3bacf18ba5da</guid>
  <pubDate>Thu, 17 Sep 2020 06:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4d186dc4-b8ee-4824-bfcc-3bacf18ba5da.mp3" length="48070680" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Modernizing the OpenBSD Console, OS roles have changed, FreeBSD Cluster with Pacemaker and Corosync, Wine in a 32-bit sandbox on 64-bit NetBSD, Find package which provides a file in OpenBSD, and more.</itunes:subtitle>
  <itunes:duration>48:32</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description> Modernizing the OpenBSD Console, OS roles have changed, FreeBSD Cluster with Pacemaker and Corosync, Wine in a 32-bit sandbox on 64-bit NetBSD, Find package which provides a file in OpenBSD, and more. 
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
Modernizing the OpenBSD Console (https://www.cambus.net/modernizing-the-openbsd-console/)
At the beginning were text mode consoles. Traditionally, *BSD and Linux on i386 and amd64 used text mode consoles which by default provided 25 rows of 80 columns, the "80x25 mode". This mode uses a 8x16 font stored in the VGA BIOS (which can be slightly different across vendors).
OpenBSD uses the wscons(4) console framework, inherited from NetBSD
OS roles have changed (https://rubenerd.com/the-roles-of-oss-have-changed/)
Though I do wonder sometimes, with just a slight tweak to history, how things might have been different. In another dimension somewhere, I’m using the latest BeOS-powered PowerPC laptop, and a shiny new Palm smartphone. Both of these represented the pinnacle of UI design in the 1990s, and still in the 2020s have yet to be surpassed. People call me an Apple fanboy, but I’d drop all of it in a second for that gear.
News Roundup
FreeBSD Cluster with Pacemaker and Corosync (https://vermaden.wordpress.com/2020/09/03/freebsd-cluster-with-pacemaker-and-corosync/)
I always missed ‘proper’ cluster software for FreeBSD systems. Recently I got to run several Pacemaker/Corosync based clusters on Linux systems. I thought how to make similar high availability solutions on FreeBSD and I was really shocked when I figured out that both Pacemaker and Corosync tools are available in the FreeBSD Ports and packages as net/pacemaker2 and net/corosync2 respectively.
Wine in a 32-bit sandbox on 64-bit NetBSD (https://washbear.neocities.org/wine-sandbox.html)
"Mainline pkgsrc" can't do strange multi-arch Wine builds yet, so a 32-bit sandbox seems like a reasonable way to use 32-bit Wine on amd64 without resorting to running real Windows in NVMM. We'll see if this was a viable alternative to re-reviewing the multi-arch support in pkgsrc-wip...
We're using sandboxctl, which is a neat tool for quickly shelling into a different NetBSD userspace. Maybe you also don't trust the Windows applications you're running too much - sandboxctl creates a chroot based on a fresh system image, and chroot on NetBSD is fairly bombproof.
Find package which provides a file in OpenBSD (https://dataswamp.org/~solene/2020-09-04-pkglocate-openbsd.html)
There is one very handy package on OpenBSD named pkglocatedb which provides the command pkglocate.
If you need to find a file or binary/program and you don’t know which package contains it, use pkglocate.
Beastie Bits
OpenBSD for 1.5 Years: Confessions of a Linux Heretic (https://www.youtube.com/watch?v=oTShQIXSdqM)
OpenBSD 6.8 Beta Tagged (https://undeadly.org/cgi?action=article;sid=20200831192811)
Hammer2 and growth (https://www.dragonflydigest.com/2020/09/08/24933.html)
Understanding a FreeBSD kernel vulnerability (https://www.thezdi.com/blog/2020/9/1/cve-2020-7460-freebsd-kernel-privilege-escalation)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Rob - 7 years (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Bruce%20-%207%20years.md)
Kurt - Microserver (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Kurt%20-%20Microserver.md)
Rob - Interviews (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Rob%20-%20Interviews.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, zpool, dataset, interview, console, modernizing, modern, operating system, role, cluster, pacemaker, corosync, wine, 32-bit, 64-bit, sandbox, package manager</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Modernizing the OpenBSD Console, OS roles have changed, FreeBSD Cluster with Pacemaker and Corosync, Wine in a 32-bit sandbox on 64-bit NetBSD, Find package which provides a file in OpenBSD, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.cambus.net/modernizing-the-openbsd-console/" rel="nofollow">Modernizing the OpenBSD Console</a></h3>

<blockquote>
<p>At the beginning were text mode consoles. Traditionally, *BSD and Linux on i386 and amd64 used text mode consoles which by default provided 25 rows of 80 columns, the &quot;80x25 mode&quot;. This mode uses a 8x16 font stored in the VGA BIOS (which can be slightly different across vendors).<br>
OpenBSD uses the wscons(4) console framework, inherited from NetBSD</p>

<hr>
</blockquote>

<h3><a href="https://rubenerd.com/the-roles-of-oss-have-changed/" rel="nofollow">OS roles have changed</a></h3>

<blockquote>
<p>Though I do wonder sometimes, with just a slight tweak to history, how things might have been different. In another dimension somewhere, I’m using the latest BeOS-powered PowerPC laptop, and a shiny new Palm smartphone. Both of these represented the pinnacle of UI design in the 1990s, and still in the 2020s have yet to be surpassed. People call me an Apple fanboy, but I’d drop all of it in a second for that gear.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://vermaden.wordpress.com/2020/09/03/freebsd-cluster-with-pacemaker-and-corosync/" rel="nofollow">FreeBSD Cluster with Pacemaker and Corosync</a></h3>

<blockquote>
<p>I always missed ‘proper’ cluster software for FreeBSD systems. Recently I got to run several Pacemaker/Corosync based clusters on Linux systems. I thought how to make similar high availability solutions on FreeBSD and I was really shocked when I figured out that both Pacemaker and Corosync tools are available in the FreeBSD Ports and packages as net/pacemaker2 and net/corosync2 respectively.</p>

<hr>
</blockquote>

<h3><a href="https://washbear.neocities.org/wine-sandbox.html" rel="nofollow">Wine in a 32-bit sandbox on 64-bit NetBSD</a></h3>

<blockquote>
<p>&quot;Mainline pkgsrc&quot; can&#39;t do strange multi-arch Wine builds yet, so a 32-bit sandbox seems like a reasonable way to use 32-bit Wine on amd64 without resorting to running real Windows in NVMM. We&#39;ll see if this was a viable alternative to re-reviewing the multi-arch support in pkgsrc-wip...<br>
We&#39;re using sandboxctl, which is a neat tool for quickly shelling into a different NetBSD userspace. Maybe you also don&#39;t trust the Windows applications you&#39;re running too much - sandboxctl creates a chroot based on a fresh system image, and chroot on NetBSD is fairly bombproof.</p>

<hr>
</blockquote>

<h3><a href="https://dataswamp.org/%7Esolene/2020-09-04-pkglocate-openbsd.html" rel="nofollow">Find package which provides a file in OpenBSD</a></h3>

<blockquote>
<p>There is one very handy package on OpenBSD named pkglocatedb which provides the command pkglocate.<br>
If you need to find a file or binary/program and you don’t know which package contains it, use pkglocate.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=oTShQIXSdqM" rel="nofollow">OpenBSD for 1.5 Years: Confessions of a Linux Heretic</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20200831192811" rel="nofollow">OpenBSD 6.8 Beta Tagged</a></li>
<li><a href="https://www.dragonflydigest.com/2020/09/08/24933.html" rel="nofollow">Hammer2 and growth</a></li>
<li><a href="https://www.thezdi.com/blog/2020/9/1/cve-2020-7460-freebsd-kernel-privilege-escalation" rel="nofollow">Understanding a FreeBSD kernel vulnerability</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Bruce%20-%207%20years.md" rel="nofollow">Rob - 7 years</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Kurt%20-%20Microserver.md" rel="nofollow">Kurt - Microserver</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Rob%20-%20Interviews.md" rel="nofollow">Rob - Interviews</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Modernizing the OpenBSD Console, OS roles have changed, FreeBSD Cluster with Pacemaker and Corosync, Wine in a 32-bit sandbox on 64-bit NetBSD, Find package which provides a file in OpenBSD, and more. </p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.cambus.net/modernizing-the-openbsd-console/" rel="nofollow">Modernizing the OpenBSD Console</a></h3>

<blockquote>
<p>At the beginning were text mode consoles. Traditionally, *BSD and Linux on i386 and amd64 used text mode consoles which by default provided 25 rows of 80 columns, the &quot;80x25 mode&quot;. This mode uses a 8x16 font stored in the VGA BIOS (which can be slightly different across vendors).<br>
OpenBSD uses the wscons(4) console framework, inherited from NetBSD</p>

<hr>
</blockquote>

<h3><a href="https://rubenerd.com/the-roles-of-oss-have-changed/" rel="nofollow">OS roles have changed</a></h3>

<blockquote>
<p>Though I do wonder sometimes, with just a slight tweak to history, how things might have been different. In another dimension somewhere, I’m using the latest BeOS-powered PowerPC laptop, and a shiny new Palm smartphone. Both of these represented the pinnacle of UI design in the 1990s, and still in the 2020s have yet to be surpassed. People call me an Apple fanboy, but I’d drop all of it in a second for that gear.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://vermaden.wordpress.com/2020/09/03/freebsd-cluster-with-pacemaker-and-corosync/" rel="nofollow">FreeBSD Cluster with Pacemaker and Corosync</a></h3>

<blockquote>
<p>I always missed ‘proper’ cluster software for FreeBSD systems. Recently I got to run several Pacemaker/Corosync based clusters on Linux systems. I thought how to make similar high availability solutions on FreeBSD and I was really shocked when I figured out that both Pacemaker and Corosync tools are available in the FreeBSD Ports and packages as net/pacemaker2 and net/corosync2 respectively.</p>

<hr>
</blockquote>

<h3><a href="https://washbear.neocities.org/wine-sandbox.html" rel="nofollow">Wine in a 32-bit sandbox on 64-bit NetBSD</a></h3>

<blockquote>
<p>&quot;Mainline pkgsrc&quot; can&#39;t do strange multi-arch Wine builds yet, so a 32-bit sandbox seems like a reasonable way to use 32-bit Wine on amd64 without resorting to running real Windows in NVMM. We&#39;ll see if this was a viable alternative to re-reviewing the multi-arch support in pkgsrc-wip...<br>
We&#39;re using sandboxctl, which is a neat tool for quickly shelling into a different NetBSD userspace. Maybe you also don&#39;t trust the Windows applications you&#39;re running too much - sandboxctl creates a chroot based on a fresh system image, and chroot on NetBSD is fairly bombproof.</p>

<hr>
</blockquote>

<h3><a href="https://dataswamp.org/%7Esolene/2020-09-04-pkglocate-openbsd.html" rel="nofollow">Find package which provides a file in OpenBSD</a></h3>

<blockquote>
<p>There is one very handy package on OpenBSD named pkglocatedb which provides the command pkglocate.<br>
If you need to find a file or binary/program and you don’t know which package contains it, use pkglocate.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=oTShQIXSdqM" rel="nofollow">OpenBSD for 1.5 Years: Confessions of a Linux Heretic</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20200831192811" rel="nofollow">OpenBSD 6.8 Beta Tagged</a></li>
<li><a href="https://www.dragonflydigest.com/2020/09/08/24933.html" rel="nofollow">Hammer2 and growth</a></li>
<li><a href="https://www.thezdi.com/blog/2020/9/1/cve-2020-7460-freebsd-kernel-privilege-escalation" rel="nofollow">Understanding a FreeBSD kernel vulnerability</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Bruce%20-%207%20years.md" rel="nofollow">Rob - 7 years</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Kurt%20-%20Microserver.md" rel="nofollow">Kurt - Microserver</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Rob%20-%20Interviews.md" rel="nofollow">Rob - Interviews</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>367: Changing jail datasets</title>
  <link>https://www.bsdnow.tv/367</link>
  <guid isPermaLink="false">056d15d3-4908-4073-955a-88e7700ba566</guid>
  <pubDate>Thu, 10 Sep 2020 06:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/056d15d3-4908-4073-955a-88e7700ba566.mp3" length="47196984" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A 35 Year Old Bug in Patch, Sandbox for FreeBSD, Changing from one dataset to another within a jail, You don’t need tmux or screen for ZFS, HardenedBSD August 2020 Status Report and Call for Donations, and more.</itunes:subtitle>
  <itunes:duration>45:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A 35 Year Old Bug in Patch, Sandbox for FreeBSD, Changing from one dataset to another within a jail, You don’t need tmux or screen for ZFS, HardenedBSD August 2020 Status Report and Call for Donations, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
A 35 Year Old Bug in Patch (http://bsdimp.blogspot.com/2020/08/a-35-year-old-bug-in-patch-found-in.html)
Larry Wall posted patch 1.3 to mod.sources on May 8, 1985. A number of versions followed over the years. It's been a faithful alley for a long, long time. I've never had a problem with patch until I embarked on the 2.11BSD restoration project. In going over the logs very carefully, I've discovered a bug that bites this effort twice. It's quite interesting to use 27 year old patches to find this bug while restoring a 29 year old OS...
Sandbox for FreeBSD (https://www.relkom.sk/en/fbsd_sandbox.shtml)
A sandbox is a software which artificially limits access to the specific resources on the target according to the assigned policy. The sandbox installs hooks to the kernel syscalls and other sub-systems in order to interrupt the events triggered by the application. From the application point of view, application working as usual, but when it wants to access, for instance, /dev/kmem the sandbox software decides against the assigned sandbox scheme whether to grant or deny access.
In our case, the sandbox is a kernel module which uses MAC (Mandatory Access Control) Framework developed by the TrustedBSD team. All necessary hooks were introduced to the FreeBSD kernel.
Source Code (https://gitlab.com/relkom/sandbox)
Documentation (https://www.relkom.sk/en/fbsd_sandbox_docs.shtml)
News Roundup
Changing from one dataset to another within a jail (https://dan.langille.org/2020/08/16/changing-from-one-dataset-to-another-within-a-freebsd-iocage-jail/)
ZFS has a the ability to share itself within a jail. That gives the jail some autonomy, and I like that.
I’ve written briefly about that, specifically for iocage. More recently, I started using a zfs snapshot for caching clearing.
The purpose of this post is to document the existing configuration of the production FreshPorts webserver and outline the plan on how to modify it for more zfs-snapshot-based cache clearing.
You don’t need tmux or screen for ZFS (https://rubenerd.com/you-dont-need-tmux-or-screen-for-zfs/)
Back in January I mentioned how to add redundancy to a ZFS pool by adding a mirrored drive. Someone with a private account on Twitter asked me why FreeBSD—and NetBSD!—doesn’t ship with a tmux or screen equivilent in base in order to daemonise the process and let them run in the background.
ZFS already does this for its internal commands.
HardenedBSD August 2020 Status Report and Call for Donations (https://hardenedbsd.org/article/shawn-webb/2020-08-15/hardenedbsd-august-2020-status-report-and-call-donations)
This last month has largely been a quiet one. I've restarted work on porting five-year-old work from the Code Pointer Integrity (CPI) project into HardenedBSD. Chiefly, I've started forward-porting the libc and rtld bits from the CPI project and now need to look at llvm compiler/linker enhancements. We need to be able to apply SafeStack to shared objects, not just application binaries. This forward-porting work I'm doing is to support that effort.
The infrastructure has settled and is now churning normally and happily. We're still working out bandwidth issues. We hope to have a new fiber line ran by the end of September.
As part of this status report, I'm issuing a formal call for donations. I'm aiming for $4,000.00 USD for a newer self-hosted Gitea server. I hope to purchase the new server before the end of 2020.
Important parts of Unix's history happened before readline support was common (https://utcc.utoronto.ca/~cks/space/blog/unix/TimeBeforeReadline)
Unix and things that run on Unix have been around for a long time now. In particular, GNU Readline was first released in 1989 (as was Bash), which is long enough ago for it (or lookalikes) to become pretty much pervasive, especially in Unix shells. Today it's easy to think of readline support as something that's always been there. But of course this isn't the case. Unix in its modern form dates from V7 in 1979 and 4.2 BSD in 1983, so a lot of Unix was developed before readline and was to some degree shaped by the lack of it.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Mason - mailserver (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/Mason%20-%20mailserver.md)
casey - freebsd on decline (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/casey%20-%20freebsd%20on%20decline.md)
denis - postgres (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/denis%20-%20postgres.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, interview, patch, bug, bugfix, sandbox, dataset, jail, tmux, screen, status, status report, call for donations, donation</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A 35 Year Old Bug in Patch, Sandbox for FreeBSD, Changing from one dataset to another within a jail, You don’t need tmux or screen for ZFS, HardenedBSD August 2020 Status Report and Call for Donations, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="http://bsdimp.blogspot.com/2020/08/a-35-year-old-bug-in-patch-found-in.html" rel="nofollow">A 35 Year Old Bug in Patch</a></h3>

<blockquote>
<p>Larry Wall posted patch 1.3 to mod.sources on May 8, 1985. A number of versions followed over the years. It&#39;s been a faithful alley for a long, long time. I&#39;ve never had a problem with patch until I embarked on the 2.11BSD restoration project. In going over the logs very carefully, I&#39;ve discovered a bug that bites this effort twice. It&#39;s quite interesting to use 27 year old patches to find this bug while restoring a 29 year old OS...</p>
</blockquote>

<hr>

<h3><a href="https://www.relkom.sk/en/fbsd_sandbox.shtml" rel="nofollow">Sandbox for FreeBSD</a></h3>

<blockquote>
<p>A sandbox is a software which artificially limits access to the specific resources on the target according to the assigned policy. The sandbox installs hooks to the kernel syscalls and other sub-systems in order to interrupt the events triggered by the application. From the application point of view, application working as usual, but when it wants to access, for instance, /dev/kmem the sandbox software decides against the assigned sandbox scheme whether to grant or deny access.<br>
In our case, the sandbox is a kernel module which uses MAC (Mandatory Access Control) Framework developed by the TrustedBSD team. All necessary hooks were introduced to the FreeBSD kernel.</p>
</blockquote>

<ul>
<li><a href="https://gitlab.com/relkom/sandbox" rel="nofollow">Source Code</a></li>
<li><a href="https://www.relkom.sk/en/fbsd_sandbox_docs.shtml" rel="nofollow">Documentation</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dan.langille.org/2020/08/16/changing-from-one-dataset-to-another-within-a-freebsd-iocage-jail/" rel="nofollow">Changing from one dataset to another within a jail</a></h3>

<blockquote>
<p>ZFS has a the ability to share itself within a jail. That gives the jail some autonomy, and I like that.<br>
I’ve written briefly about that, specifically for iocage. More recently, I started using a zfs snapshot for caching clearing.<br>
The purpose of this post is to document the existing configuration of the production FreshPorts webserver and outline the plan on how to modify it for more zfs-snapshot-based cache clearing.</p>
</blockquote>

<hr>

<h3><a href="https://rubenerd.com/you-dont-need-tmux-or-screen-for-zfs/" rel="nofollow">You don’t need tmux or screen for ZFS</a></h3>

<blockquote>
<p>Back in January I mentioned how to add redundancy to a ZFS pool by adding a mirrored drive. Someone with a private account on Twitter asked me why FreeBSD—and NetBSD!—doesn’t ship with a tmux or screen equivilent in base in order to daemonise the process and let them run in the background.<br>
ZFS already does this for its internal commands.</p>
</blockquote>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-08-15/hardenedbsd-august-2020-status-report-and-call-donations" rel="nofollow">HardenedBSD August 2020 Status Report and Call for Donations</a></h3>

<blockquote>
<p>This last month has largely been a quiet one. I&#39;ve restarted work on porting five-year-old work from the Code Pointer Integrity (CPI) project into HardenedBSD. Chiefly, I&#39;ve started forward-porting the libc and rtld bits from the CPI project and now need to look at llvm compiler/linker enhancements. We need to be able to apply SafeStack to shared objects, not just application binaries. This forward-porting work I&#39;m doing is to support that effort.<br>
The infrastructure has settled and is now churning normally and happily. We&#39;re still working out bandwidth issues. We hope to have a new fiber line ran by the end of September.<br>
As part of this status report, I&#39;m issuing a formal call for donations. I&#39;m aiming for $4,000.00 USD for a newer self-hosted Gitea server. I hope to purchase the new server before the end of 2020.</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/TimeBeforeReadline" rel="nofollow">Important parts of Unix&#39;s history happened before readline support was common</a></h3>

<blockquote>
<p>Unix and things that run on Unix have been around for a long time now. In particular, GNU Readline was first released in 1989 (as was Bash), which is long enough ago for it (or lookalikes) to become pretty much pervasive, especially in Unix shells. Today it&#39;s easy to think of readline support as something that&#39;s always been there. But of course this isn&#39;t the case. Unix in its modern form dates from V7 in 1979 and 4.2 BSD in 1983, so a lot of Unix was developed before readline and was to some degree shaped by the lack of it.</p>
</blockquote>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/Mason%20-%20mailserver.md" rel="nofollow">Mason - mailserver</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/casey%20-%20freebsd%20on%20decline.md" rel="nofollow">casey - freebsd on decline</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/denis%20-%20postgres.md" rel="nofollow">denis - postgres</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A 35 Year Old Bug in Patch, Sandbox for FreeBSD, Changing from one dataset to another within a jail, You don’t need tmux or screen for ZFS, HardenedBSD August 2020 Status Report and Call for Donations, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="http://bsdimp.blogspot.com/2020/08/a-35-year-old-bug-in-patch-found-in.html" rel="nofollow">A 35 Year Old Bug in Patch</a></h3>

<blockquote>
<p>Larry Wall posted patch 1.3 to mod.sources on May 8, 1985. A number of versions followed over the years. It&#39;s been a faithful alley for a long, long time. I&#39;ve never had a problem with patch until I embarked on the 2.11BSD restoration project. In going over the logs very carefully, I&#39;ve discovered a bug that bites this effort twice. It&#39;s quite interesting to use 27 year old patches to find this bug while restoring a 29 year old OS...</p>
</blockquote>

<hr>

<h3><a href="https://www.relkom.sk/en/fbsd_sandbox.shtml" rel="nofollow">Sandbox for FreeBSD</a></h3>

<blockquote>
<p>A sandbox is a software which artificially limits access to the specific resources on the target according to the assigned policy. The sandbox installs hooks to the kernel syscalls and other sub-systems in order to interrupt the events triggered by the application. From the application point of view, application working as usual, but when it wants to access, for instance, /dev/kmem the sandbox software decides against the assigned sandbox scheme whether to grant or deny access.<br>
In our case, the sandbox is a kernel module which uses MAC (Mandatory Access Control) Framework developed by the TrustedBSD team. All necessary hooks were introduced to the FreeBSD kernel.</p>
</blockquote>

<ul>
<li><a href="https://gitlab.com/relkom/sandbox" rel="nofollow">Source Code</a></li>
<li><a href="https://www.relkom.sk/en/fbsd_sandbox_docs.shtml" rel="nofollow">Documentation</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dan.langille.org/2020/08/16/changing-from-one-dataset-to-another-within-a-freebsd-iocage-jail/" rel="nofollow">Changing from one dataset to another within a jail</a></h3>

<blockquote>
<p>ZFS has a the ability to share itself within a jail. That gives the jail some autonomy, and I like that.<br>
I’ve written briefly about that, specifically for iocage. More recently, I started using a zfs snapshot for caching clearing.<br>
The purpose of this post is to document the existing configuration of the production FreshPorts webserver and outline the plan on how to modify it for more zfs-snapshot-based cache clearing.</p>
</blockquote>

<hr>

<h3><a href="https://rubenerd.com/you-dont-need-tmux-or-screen-for-zfs/" rel="nofollow">You don’t need tmux or screen for ZFS</a></h3>

<blockquote>
<p>Back in January I mentioned how to add redundancy to a ZFS pool by adding a mirrored drive. Someone with a private account on Twitter asked me why FreeBSD—and NetBSD!—doesn’t ship with a tmux or screen equivilent in base in order to daemonise the process and let them run in the background.<br>
ZFS already does this for its internal commands.</p>
</blockquote>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-08-15/hardenedbsd-august-2020-status-report-and-call-donations" rel="nofollow">HardenedBSD August 2020 Status Report and Call for Donations</a></h3>

<blockquote>
<p>This last month has largely been a quiet one. I&#39;ve restarted work on porting five-year-old work from the Code Pointer Integrity (CPI) project into HardenedBSD. Chiefly, I&#39;ve started forward-porting the libc and rtld bits from the CPI project and now need to look at llvm compiler/linker enhancements. We need to be able to apply SafeStack to shared objects, not just application binaries. This forward-porting work I&#39;m doing is to support that effort.<br>
The infrastructure has settled and is now churning normally and happily. We&#39;re still working out bandwidth issues. We hope to have a new fiber line ran by the end of September.<br>
As part of this status report, I&#39;m issuing a formal call for donations. I&#39;m aiming for $4,000.00 USD for a newer self-hosted Gitea server. I hope to purchase the new server before the end of 2020.</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/TimeBeforeReadline" rel="nofollow">Important parts of Unix&#39;s history happened before readline support was common</a></h3>

<blockquote>
<p>Unix and things that run on Unix have been around for a long time now. In particular, GNU Readline was first released in 1989 (as was Bash), which is long enough ago for it (or lookalikes) to become pretty much pervasive, especially in Unix shells. Today it&#39;s easy to think of readline support as something that&#39;s always been there. But of course this isn&#39;t the case. Unix in its modern form dates from V7 in 1979 and 4.2 BSD in 1983, so a lot of Unix was developed before readline and was to some degree shaped by the lack of it.</p>
</blockquote>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/Mason%20-%20mailserver.md" rel="nofollow">Mason - mailserver</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/casey%20-%20freebsd%20on%20decline.md" rel="nofollow">casey - freebsd on decline</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/denis%20-%20postgres.md" rel="nofollow">denis - postgres</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>366: Bootloader zpool checkpoints</title>
  <link>https://www.bsdnow.tv/366</link>
  <guid isPermaLink="false">ac66cef0-02a8-44b9-b915-813b8e26c643</guid>
  <pubDate>Thu, 03 Sep 2020 06:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ac66cef0-02a8-44b9-b915-813b8e26c643.mp3" length="54891512" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS with ZSTD lands in FreeBSD 13, LibreSSL doc status update, FreeBSD on SPARC64 (is dead), Bringing zpool checkpoints to a FreeBSD bootloader, and more</itunes:subtitle>
  <itunes:duration>53:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS with ZSTD lands in FreeBSD 13, LibreSSL doc status update, FreeBSD on SPARC64 (is dead), Bringing zpool checkpoints to a FreeBSD bootloader, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
OpenZFS with ZSTD land in FreeBSD 13 (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=364746)
ZStandard Compression for OpenZFS (https://github.com/openzfs/zfs/commit/10b3c7f5e424f54b3ba82dbf1600d866e64ec0a0)
&amp;gt; The primary benefit is maintaining a completely shared code base with the community allowing FreeBSD to receive new features sooner and with less effort.
&amp;gt; I would advise against doing 'zpool upgrade' or creating indispensable pools using new features until this change has had a month+ to soak.
Rebasing FreeBSD’s OpenZFS on the new upstream was sponsored by iXsystems
The competition of ZSTD support for OpenZFS was sponsored by the FreeBSD Foundation
***
LibreSSL documentation status update (https://undeadly.org/cgi?action=article;sid=20200817063735)
More than six years ago, LibreSSL was forked from OpenSSL, and almost two years ago, i explained the status of LibreSSL documentation during EuroBSDCon 2018 in Bucuresti. So it seems providing an update might be in order.
Note that this is not an update regarding LibreSSL status in general because i'm not the right person to talk about the big picture of working on the LibreSSL code, my work has been quite focussed on documentation. All the same, it is fair to say that even though the number of developers working on it is somewhat limited, the LibreSSL project is quite alive, typically having a release every few months. Progress continues being made with respect to porting and adding new functionality (for example regarding TLSv1.3, CMS, RSA-PSS, RSA-OAEP, GOST, SM3, SM4, XChaCha20 during the last two years), OpenSSL compatibility improvements (including providing additional OpenSSL-1.1 APIs), and lots of bug fixes and code cleanup.
FreeBSD on SPARC64 (is dead) (https://eerielinux.wordpress.com/2020/02/15/freebsd-on-sparc64-is-dead/)
’m coming pretty late to the party, because SPARC64 support in FreeBSD is apparently doomed: After the POWER platform made the switch to a LLVM/Clang-based toolchain, SPARC64 is one of the last ones that still uses the ancient GCC 4.2-based toolchain that the project wants to finally get rid off (it has already happened as I was writing this – looks like the firm plan was not so firm after all, since they killed it off early). And compared to the other platforms it has seen not too much love in recent times… SPARC64 being a great platform, I’d be quite sad to see it go. But before that happens let’s see what the current status is and what would need to be done if it were to survive, shall we?
News Roundup
Bringing zpool checkpoints to a FreeBSD bootloader (https://www.oshogbo.vexillium.org/blog/79/)
Almost two years ago I wrote a blog post about checkpoints in ZFS. I didn’t hide that I was a big fan of them. That said, after those two years, I still feel that there are underappreciated features in the ZFS world, so I decided to do something about that.
Currently, one of the best practices for upgrading your operating system is to use boot environments. They are a great feature for managing multiple kernels and userlands. They are based on juggling which ZFS datasets are mounted. Each dataset has its own version of the system. Unfortunately, boot environments have their limitations. If we, for example, upgrade our ZFS pool, we may not be able to use older versions of the system anymore. 
The big advantage of boot environments is that they have very good tools. Two main tools are beadm (which was created by vermaden) and bectl (which currently is in the FreeBSD base system). These tools allow us to create and manage boot environments.
Beastie Bits
The First Unix Port (https://documents.uow.edu.au/content/groups/public/@web/@inf/@scsse/documents/doc/uow103747.pdf)
TLS Mastery updates, August 2020 (https://mwl.io/archives/7346)
What is the Oldest BSD Distribution still around today (https://www.youtube.com/watch?v=ww60o940kEk)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
ben - zfs send questions (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/ben%20-%20zfs%20send%20questions.md)
lars - zfs pool question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/lars%20-%20zfs%20pool%20question.md)
neutron - bectl vs beadm (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/neutron%20-%20bectl%20vs%20beadm.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, interview, libressl, ssl, documentation, doc, status, status update, sparc64, zpool, checkpoint, bootloader</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS with ZSTD lands in FreeBSD 13, LibreSSL doc status update, FreeBSD on SPARC64 (is dead), Bringing zpool checkpoints to a FreeBSD bootloader, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=364746" rel="nofollow">OpenZFS with ZSTD land in FreeBSD 13</a></h3>

<ul>
<li><a href="https://github.com/openzfs/zfs/commit/10b3c7f5e424f54b3ba82dbf1600d866e64ec0a0" rel="nofollow">ZStandard Compression for OpenZFS</a>
&gt; The primary benefit is maintaining a completely shared code base with the community allowing FreeBSD to receive new features sooner and with less effort.
&gt; I would advise against doing &#39;zpool upgrade&#39; or creating indispensable pools using new features until this change has had a month+ to soak.</li>
<li>Rebasing FreeBSD’s OpenZFS on the new upstream was sponsored by iXsystems</li>
<li>The competition of ZSTD support for OpenZFS was sponsored by the FreeBSD Foundation
***</li>
</ul>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20200817063735" rel="nofollow">LibreSSL documentation status update</a></h3>

<blockquote>
<p>More than six years ago, LibreSSL was forked from OpenSSL, and almost two years ago, i explained the status of LibreSSL documentation during EuroBSDCon 2018 in Bucuresti. So it seems providing an update might be in order.<br>
Note that this is not an update regarding LibreSSL status in general because i&#39;m not the right person to talk about the big picture of working on the LibreSSL code, my work has been quite focussed on documentation. All the same, it is fair to say that even though the number of developers working on it is somewhat limited, the LibreSSL project is quite alive, typically having a release every few months. Progress continues being made with respect to porting and adding new functionality (for example regarding TLSv1.3, CMS, RSA-PSS, RSA-OAEP, GOST, SM3, SM4, XChaCha20 during the last two years), OpenSSL compatibility improvements (including providing additional OpenSSL-1.1 APIs), and lots of bug fixes and code cleanup.</p>
</blockquote>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2020/02/15/freebsd-on-sparc64-is-dead/" rel="nofollow">FreeBSD on SPARC64 (is dead)</a></h3>

<blockquote>
<p>’m coming pretty late to the party, because SPARC64 support in FreeBSD is apparently doomed: After the POWER platform made the switch to a LLVM/Clang-based toolchain, SPARC64 is one of the last ones that still uses the ancient GCC 4.2-based toolchain that the project wants to finally get rid off (it has already happened as I was writing this – looks like the firm plan was not so firm after all, since they killed it off early). And compared to the other platforms it has seen not too much love in recent times… SPARC64 being a great platform, I’d be quite sad to see it go. But before that happens let’s see what the current status is and what would need to be done if it were to survive, shall we?</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.oshogbo.vexillium.org/blog/79/" rel="nofollow">Bringing zpool checkpoints to a FreeBSD bootloader</a></h3>

<blockquote>
<p>Almost two years ago I wrote a blog post about checkpoints in ZFS. I didn’t hide that I was a big fan of them. That said, after those two years, I still feel that there are underappreciated features in the ZFS world, so I decided to do something about that.<br>
Currently, one of the best practices for upgrading your operating system is to use boot environments. They are a great feature for managing multiple kernels and userlands. They are based on juggling which ZFS datasets are mounted. Each dataset has its own version of the system. Unfortunately, boot environments have their limitations. If we, for example, upgrade our ZFS pool, we may not be able to use older versions of the system anymore. <br>
The big advantage of boot environments is that they have very good tools. Two main tools are beadm (which was created by vermaden) and bectl (which currently is in the FreeBSD base system). These tools allow us to create and manage boot environments.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://documents.uow.edu.au/content/groups/public/@web/@inf/@scsse/documents/doc/uow103747.pdf" rel="nofollow">The First Unix Port</a></li>
<li><a href="https://mwl.io/archives/7346" rel="nofollow">TLS Mastery updates, August 2020</a></li>
<li><a href="https://www.youtube.com/watch?v=ww60o940kEk" rel="nofollow">What is the Oldest BSD Distribution still around today</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/ben%20-%20zfs%20send%20questions.md" rel="nofollow">ben - zfs send questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/lars%20-%20zfs%20pool%20question.md" rel="nofollow">lars - zfs pool question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/neutron%20-%20bectl%20vs%20beadm.md" rel="nofollow">neutron - bectl vs beadm</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS with ZSTD lands in FreeBSD 13, LibreSSL doc status update, FreeBSD on SPARC64 (is dead), Bringing zpool checkpoints to a FreeBSD bootloader, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=364746" rel="nofollow">OpenZFS with ZSTD land in FreeBSD 13</a></h3>

<ul>
<li><a href="https://github.com/openzfs/zfs/commit/10b3c7f5e424f54b3ba82dbf1600d866e64ec0a0" rel="nofollow">ZStandard Compression for OpenZFS</a>
&gt; The primary benefit is maintaining a completely shared code base with the community allowing FreeBSD to receive new features sooner and with less effort.
&gt; I would advise against doing &#39;zpool upgrade&#39; or creating indispensable pools using new features until this change has had a month+ to soak.</li>
<li>Rebasing FreeBSD’s OpenZFS on the new upstream was sponsored by iXsystems</li>
<li>The competition of ZSTD support for OpenZFS was sponsored by the FreeBSD Foundation
***</li>
</ul>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20200817063735" rel="nofollow">LibreSSL documentation status update</a></h3>

<blockquote>
<p>More than six years ago, LibreSSL was forked from OpenSSL, and almost two years ago, i explained the status of LibreSSL documentation during EuroBSDCon 2018 in Bucuresti. So it seems providing an update might be in order.<br>
Note that this is not an update regarding LibreSSL status in general because i&#39;m not the right person to talk about the big picture of working on the LibreSSL code, my work has been quite focussed on documentation. All the same, it is fair to say that even though the number of developers working on it is somewhat limited, the LibreSSL project is quite alive, typically having a release every few months. Progress continues being made with respect to porting and adding new functionality (for example regarding TLSv1.3, CMS, RSA-PSS, RSA-OAEP, GOST, SM3, SM4, XChaCha20 during the last two years), OpenSSL compatibility improvements (including providing additional OpenSSL-1.1 APIs), and lots of bug fixes and code cleanup.</p>
</blockquote>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2020/02/15/freebsd-on-sparc64-is-dead/" rel="nofollow">FreeBSD on SPARC64 (is dead)</a></h3>

<blockquote>
<p>’m coming pretty late to the party, because SPARC64 support in FreeBSD is apparently doomed: After the POWER platform made the switch to a LLVM/Clang-based toolchain, SPARC64 is one of the last ones that still uses the ancient GCC 4.2-based toolchain that the project wants to finally get rid off (it has already happened as I was writing this – looks like the firm plan was not so firm after all, since they killed it off early). And compared to the other platforms it has seen not too much love in recent times… SPARC64 being a great platform, I’d be quite sad to see it go. But before that happens let’s see what the current status is and what would need to be done if it were to survive, shall we?</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.oshogbo.vexillium.org/blog/79/" rel="nofollow">Bringing zpool checkpoints to a FreeBSD bootloader</a></h3>

<blockquote>
<p>Almost two years ago I wrote a blog post about checkpoints in ZFS. I didn’t hide that I was a big fan of them. That said, after those two years, I still feel that there are underappreciated features in the ZFS world, so I decided to do something about that.<br>
Currently, one of the best practices for upgrading your operating system is to use boot environments. They are a great feature for managing multiple kernels and userlands. They are based on juggling which ZFS datasets are mounted. Each dataset has its own version of the system. Unfortunately, boot environments have their limitations. If we, for example, upgrade our ZFS pool, we may not be able to use older versions of the system anymore. <br>
The big advantage of boot environments is that they have very good tools. Two main tools are beadm (which was created by vermaden) and bectl (which currently is in the FreeBSD base system). These tools allow us to create and manage boot environments.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://documents.uow.edu.au/content/groups/public/@web/@inf/@scsse/documents/doc/uow103747.pdf" rel="nofollow">The First Unix Port</a></li>
<li><a href="https://mwl.io/archives/7346" rel="nofollow">TLS Mastery updates, August 2020</a></li>
<li><a href="https://www.youtube.com/watch?v=ww60o940kEk" rel="nofollow">What is the Oldest BSD Distribution still around today</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/ben%20-%20zfs%20send%20questions.md" rel="nofollow">ben - zfs send questions</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/lars%20-%20zfs%20pool%20question.md" rel="nofollow">lars - zfs pool question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/neutron%20-%20bectl%20vs%20beadm.md" rel="nofollow">neutron - bectl vs beadm</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>365: Whole year round</title>
  <link>https://www.bsdnow.tv/365</link>
  <guid isPermaLink="false">818d1dc0-da99-423a-a552-4ac52474c66c</guid>
  <pubDate>Thu, 27 Aug 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/818d1dc0-da99-423a-a552-4ac52474c66c.mp3" length="49050296" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD USB Audio, Kyua: An introduction for NetBSD users, Keeping backup ZFS on Linux kernel modules around, CLI Tools 235x Faster than Hadoop, FreeBSD Laptop Battery Life Status Command, and more.</itunes:subtitle>
  <itunes:duration>46:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD USB Audio, Kyua: An introduction for NetBSD users, Keeping backup ZFS on Linux kernel modules around, CLI Tools 235x Faster than Hadoop, FreeBSD Laptop Battery Life Status Command, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
FreeBSD USB Audio (https://www.davidschlachter.com/misc/freebsd-usb-audio)
I recently got a Behringer UMC22 sound card for video conferencing and DJing. This page documents what I’ve learned about using this sound card, and USB audio in general, on FreeBSD.
tl;dr: Everything works as long as the sound card follows the USB audio device class specification.
Kyua: An introduction for NetBSD users (https://wiki.netbsd.org/kyua/)
Kyua's current goal is to reimplement only the ATF tools while maintaining backwards compatibility with the tests written with the ATF libraries (i.e. with the NetBSD test suite).
Because Kyua is a replacement of some ATF components, the end goal is to integrate Kyua into the NetBSD base system (just as ATF is) and remove the deprecated ATF components. Removing the deprecated components will allow us to make the above-mentioned improvements to Kyua, as well as many others, without having to deal with the obsolete ATF code base. Discussing how and when this transition might happen is out of the scope of this document at the moment.
News Roundup
Keeping backup ZFS on Linux kernel modules around (https://utcc.utoronto.ca/~cks/space/blog/linux/ZFSOnLinuxModuleBackups)
I'm a long term user of ZFS on Linux and over pretty much all of the time I've used it, I've built it from the latest development version. Generally this means I update my ZoL build at the same time as I update my Fedora kernel, since a ZoL update requires a kernel reboot anyway. This is a little bit daring, of course, although the ZoL development version has generally been quite solid (and this way I get the latest features and improvements long before I otherwise would).
Command-line Tools can be 235x Faster than your Hadoop Cluster (https://adamdrake.com/command-line-tools-can-be-235x-faster-than-your-hadoop-cluster.html)
As I was browsing the web and catching up on some sites I visit periodically, I found a cool article from Tom Hayden about using Amazon Elastic Map Reduce (EMR) and mrjob in order to compute some statistics on win/loss ratios for chess games he downloaded from the millionbase archive, and generally have fun with EMR. Since the data volume was only about 1.75GB containing around 2 million chess games, I was skeptical of using Hadoop for the task, but I can understand his goal of learning and having fun with mrjob and EMR. Since the problem is basically just to look at the result lines of each file and aggregate the different results, it seems ideally suited to stream processing with shell commands. I tried this out, and for the same amount of data I was able to use my laptop to get the results in about 12 seconds (processing speed of about 270MB/sec), while the Hadoop processing took about 26 minutes (processing speed of about 1.14MB/sec).
FreeBSD Laptop Find Out Battery Life Status Command (https://www.cyberciti.biz/faq/freebsd-finding-out-battery-life-state-on-laptop/)
I know how to find out battery life status using Linux operating system. How do I monitor battery status on a laptop running FreeBSD version 9.x/10.x/11.x/12.x?
You can use any one of the following commands to get battery status under FreeBSD laptop including remaining battery life and more.
Beastie Bits
BSD Beer (https://i.redd.it/hlh8luidzgg51.jpg)
Awk for JSON (https://github.com/mohd-akram/jawk)
Drawing Pictures The Unix Way - with pic and troff (https://youtu.be/oG2A_1vC6aM)
Refactoring the FreeBSD Kernel with Checked C (https://www.cs.rochester.edu/u/jzhou41/papers/freebsd_checkedc.pdf)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Jason - German Locales (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/jason%20-%20german%20locale.md)
pcwizz - Router Style Device (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/pcwizz%20-%20router%20style%20device.md)
predrag - OpenBSD Router Hardware (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/predrag%20-%20openbsd%20router%20hardware.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, interview, USB, audio, kyua, testing, test framework, backup, ZFS, kernel, kernel module, command line, CLI, hadoop, laptop, battery, battery life, status, status command</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD USB Audio, Kyua: An introduction for NetBSD users, Keeping backup ZFS on Linux kernel modules around, CLI Tools 235x Faster than Hadoop, FreeBSD Laptop Battery Life Status Command, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.davidschlachter.com/misc/freebsd-usb-audio" rel="nofollow">FreeBSD USB Audio</a></h3>

<blockquote>
<p>I recently got a Behringer UMC22 sound card for video conferencing and DJing. This page documents what I’ve learned about using this sound card, and USB audio in general, on FreeBSD.<br>
tl;dr: Everything works as long as the sound card follows the USB audio device class specification.</p>

<hr>

<h3><a href="https://wiki.netbsd.org/kyua/" rel="nofollow">Kyua: An introduction for NetBSD users</a></h3>

<p>Kyua&#39;s current goal is to reimplement only the ATF tools while maintaining backwards compatibility with the tests written with the ATF libraries (i.e. with the NetBSD test suite).<br>
Because Kyua is a replacement of some ATF components, the end goal is to integrate Kyua into the NetBSD base system (just as ATF is) and remove the deprecated ATF components. Removing the deprecated components will allow us to make the above-mentioned improvements to Kyua, as well as many others, without having to deal with the obsolete ATF code base. Discussing how and when this transition might happen is out of the scope of this document at the moment.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSOnLinuxModuleBackups" rel="nofollow">Keeping backup ZFS on Linux kernel modules around</a></h3>

<blockquote>
<p>I&#39;m a long term user of ZFS on Linux and over pretty much all of the time I&#39;ve used it, I&#39;ve built it from the latest development version. Generally this means I update my ZoL build at the same time as I update my Fedora kernel, since a ZoL update requires a kernel reboot anyway. This is a little bit daring, of course, although the ZoL development version has generally been quite solid (and this way I get the latest features and improvements long before I otherwise would).</p>

<hr>
</blockquote>

<h3><a href="https://adamdrake.com/command-line-tools-can-be-235x-faster-than-your-hadoop-cluster.html" rel="nofollow">Command-line Tools can be 235x Faster than your Hadoop Cluster</a></h3>

<blockquote>
<p>As I was browsing the web and catching up on some sites I visit periodically, I found a cool article from Tom Hayden about using Amazon Elastic Map Reduce (EMR) and mrjob in order to compute some statistics on win/loss ratios for chess games he downloaded from the millionbase archive, and generally have fun with EMR. Since the data volume was only about 1.75GB containing around 2 million chess games, I was skeptical of using Hadoop for the task, but I can understand his goal of learning and having fun with mrjob and EMR. Since the problem is basically just to look at the result lines of each file and aggregate the different results, it seems ideally suited to stream processing with shell commands. I tried this out, and for the same amount of data I was able to use my laptop to get the results in about 12 seconds (processing speed of about 270MB/sec), while the Hadoop processing took about 26 minutes (processing speed of about 1.14MB/sec).</p>
</blockquote>

<hr>

<h3><a href="https://www.cyberciti.biz/faq/freebsd-finding-out-battery-life-state-on-laptop/" rel="nofollow">FreeBSD Laptop Find Out Battery Life Status Command</a></h3>

<blockquote>
<p>I know how to find out battery life status using Linux operating system. How do I monitor battery status on a laptop running FreeBSD version 9.x/10.x/11.x/12.x?<br>
You can use any one of the following commands to get battery status under FreeBSD laptop including remaining battery life and more.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<p><a href="https://i.redd.it/hlh8luidzgg51.jpg" rel="nofollow">BSD Beer</a><br>
<a href="https://github.com/mohd-akram/jawk" rel="nofollow">Awk for JSON</a><br>
<a href="https://youtu.be/oG2A_1vC6aM" rel="nofollow">Drawing Pictures The Unix Way - with pic and troff</a><br>
<a href="https://www.cs.rochester.edu/u/jzhou41/papers/freebsd_checkedc.pdf" rel="nofollow">Refactoring the FreeBSD Kernel with Checked C</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/jason%20-%20german%20locale.md" rel="nofollow">Jason - German Locales</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/pcwizz%20-%20router%20style%20device.md" rel="nofollow">pcwizz - Router Style Device</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/predrag%20-%20openbsd%20router%20hardware.md" rel="nofollow">predrag - OpenBSD Router Hardware</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD USB Audio, Kyua: An introduction for NetBSD users, Keeping backup ZFS on Linux kernel modules around, CLI Tools 235x Faster than Hadoop, FreeBSD Laptop Battery Life Status Command, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.davidschlachter.com/misc/freebsd-usb-audio" rel="nofollow">FreeBSD USB Audio</a></h3>

<blockquote>
<p>I recently got a Behringer UMC22 sound card for video conferencing and DJing. This page documents what I’ve learned about using this sound card, and USB audio in general, on FreeBSD.<br>
tl;dr: Everything works as long as the sound card follows the USB audio device class specification.</p>

<hr>

<h3><a href="https://wiki.netbsd.org/kyua/" rel="nofollow">Kyua: An introduction for NetBSD users</a></h3>

<p>Kyua&#39;s current goal is to reimplement only the ATF tools while maintaining backwards compatibility with the tests written with the ATF libraries (i.e. with the NetBSD test suite).<br>
Because Kyua is a replacement of some ATF components, the end goal is to integrate Kyua into the NetBSD base system (just as ATF is) and remove the deprecated ATF components. Removing the deprecated components will allow us to make the above-mentioned improvements to Kyua, as well as many others, without having to deal with the obsolete ATF code base. Discussing how and when this transition might happen is out of the scope of this document at the moment.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSOnLinuxModuleBackups" rel="nofollow">Keeping backup ZFS on Linux kernel modules around</a></h3>

<blockquote>
<p>I&#39;m a long term user of ZFS on Linux and over pretty much all of the time I&#39;ve used it, I&#39;ve built it from the latest development version. Generally this means I update my ZoL build at the same time as I update my Fedora kernel, since a ZoL update requires a kernel reboot anyway. This is a little bit daring, of course, although the ZoL development version has generally been quite solid (and this way I get the latest features and improvements long before I otherwise would).</p>

<hr>
</blockquote>

<h3><a href="https://adamdrake.com/command-line-tools-can-be-235x-faster-than-your-hadoop-cluster.html" rel="nofollow">Command-line Tools can be 235x Faster than your Hadoop Cluster</a></h3>

<blockquote>
<p>As I was browsing the web and catching up on some sites I visit periodically, I found a cool article from Tom Hayden about using Amazon Elastic Map Reduce (EMR) and mrjob in order to compute some statistics on win/loss ratios for chess games he downloaded from the millionbase archive, and generally have fun with EMR. Since the data volume was only about 1.75GB containing around 2 million chess games, I was skeptical of using Hadoop for the task, but I can understand his goal of learning and having fun with mrjob and EMR. Since the problem is basically just to look at the result lines of each file and aggregate the different results, it seems ideally suited to stream processing with shell commands. I tried this out, and for the same amount of data I was able to use my laptop to get the results in about 12 seconds (processing speed of about 270MB/sec), while the Hadoop processing took about 26 minutes (processing speed of about 1.14MB/sec).</p>
</blockquote>

<hr>

<h3><a href="https://www.cyberciti.biz/faq/freebsd-finding-out-battery-life-state-on-laptop/" rel="nofollow">FreeBSD Laptop Find Out Battery Life Status Command</a></h3>

<blockquote>
<p>I know how to find out battery life status using Linux operating system. How do I monitor battery status on a laptop running FreeBSD version 9.x/10.x/11.x/12.x?<br>
You can use any one of the following commands to get battery status under FreeBSD laptop including remaining battery life and more.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<p><a href="https://i.redd.it/hlh8luidzgg51.jpg" rel="nofollow">BSD Beer</a><br>
<a href="https://github.com/mohd-akram/jawk" rel="nofollow">Awk for JSON</a><br>
<a href="https://youtu.be/oG2A_1vC6aM" rel="nofollow">Drawing Pictures The Unix Way - with pic and troff</a><br>
<a href="https://www.cs.rochester.edu/u/jzhou41/papers/freebsd_checkedc.pdf" rel="nofollow">Refactoring the FreeBSD Kernel with Checked C</a></p>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/jason%20-%20german%20locale.md" rel="nofollow">Jason - German Locales</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/pcwizz%20-%20router%20style%20device.md" rel="nofollow">pcwizz - Router Style Device</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/predrag%20-%20openbsd%20router%20hardware.md" rel="nofollow">predrag - OpenBSD Router Hardware</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>364: FreeBSD Wireless Grind</title>
  <link>https://www.bsdnow.tv/364</link>
  <guid isPermaLink="false">7581b101-10df-4469-8e37-0ddb82f82696</guid>
  <pubDate>Thu, 20 Aug 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7581b101-10df-4469-8e37-0ddb82f82696.mp3" length="41078792" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Qt WebEngine GPU Acceleration, the grind of FreeBSD’s wireless stack, thoughts on overlooking Illumos's syseventadm, when Unix learned to reboot, New EXT2/3/4 File-System driver in DragonflyBSD, and more.</itunes:subtitle>
  <itunes:duration>46:58</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Qt WebEngine GPU Acceleration, the grind of FreeBSD’s wireless stack, thoughts on overlooking Illumos's syseventadm, when Unix learned to reboot, New EXT2/3/4 File-System driver in DragonflyBSD, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
FreeBSD Qt WebEngine GPU Acceleration (https://euroquis.nl/freebsd/2020/07/21/webengine.html)
FreeBSD has a handful of Qt WebEngine-based browsers. Falkon, and Otter-Browser, and qutebrowser and probably others, too. All of them can run into issues on FreeBSD with GPU-accelerated rendering not working. Let’s look at some of the workarounds.
NetBSD on the Nanopi Neo2 (https://www.cambus.net/netbsd-on-the-nanopi-neo2/)
The NanoPi NEO2 from FriendlyARM has been serving me well since 2018, being my test machine for OpenBSD/arm64 related things.
As NetBSD/evbarm finally gained support for AArch64 in NetBSD 9.0, released back in February, I decided to give it a try on this device. The board only has 512MB of RAM, and this is where NetBSD really shines. Things have become a lot easier since jmcneill@ now provides bootable ARM images for a variety of devices, including the NanoPi NEO2.
I'm back into the grind of FreeBSD's wireless stack and 802.11ac (https://adrianchadd.blogspot.com/2020/07/im-back-into-grind-of-freebsds-wireless.html)
Yes, it's been a while since I posted here and yes, it's been a while since I was actively working on FreeBSD's wireless stack. Life's been .. well, life. I started the ath10k port in 2015. I wasn't expecting it to take 5 years, but here we are. My life has changed quite a lot since 2015 and a lot of the things I was doing in 2015 just stopped being fun for a while.
But the stars have aligned and it's fun again, so here I am. 
News Roundup
Some thoughts on us overlooking Illumos's syseventadm (https://utcc.utoronto.ca/~cks/space/blog/solaris/OverlookingSyseventadm)
In a comment on my praise of ZFS on Linux's ZFS event daemon, Joshua M. Clulow noted that Illumos (and thus OmniOS) has an equivalent in syseventadm, which dates back to Solaris. I hadn't previously known about syseventadm, despite having run Solaris fileservers and OmniOS fileservers for the better part of a decade, and that gives me some tangled feelings.
When Unix learned to reboot (https://bsdimp.blogspot.com/2020/07/when-unix-learned-to-reboot2.html)
Recently, a friend asked me the history of halt, and when did we have to stop with the sync / sync / sync dance before running halt or reboot. The two are related, it turns out.
DragonFlyBSD Lands New EXT2/3/4 File-System Driver (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=DragonFlyBSD-New-EXT2FS)
While DragonFlyBSD has its own, original HAMMER2 file-system, for those needing to access data from EXT2/EXT3/EXT4 file-systems, there is a brand new "ext2fs" driver implementation for this BSD operating system.
DragonFlyBSD has long offered an EXT2 file-system driver (that also handles EXT3 and EXT4) while hitting their Git tree this week is a new version. The new sys/vfs/ext2fs driver, which will ultimately replace their existing sys/gnu/vfs/ext2fs driver is based on a port from FreeBSD code. As such, this driver is BSD licensed rather than GPL. But besides the more liberal license to jive with the BSD world, this new driver has various feature/functionality improvements over the prior version. However, there are some known bugs so for the time being both file-system drivers will co-exist.
Beastie Bits
LibreOffice 7.0 call for testing (https://lists.freebsd.org/pipermail/freebsd-office/2020-July/005822.html)
More touchpad support (https://www.dragonflydigest.com/2020/07/15/24747.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Casey - openbsd wirewall (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/casey%20-%20openbsd%20wirewall.md)
Daryl - zfs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/daryl%20-%20zfs.md)
Raymond - hpe microserver (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/raymond%20-%20hpe%20microserver.md)
- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, interview, QT, WebEngine, acceleration, GPU, wireless, 802.11ac, syseventadm, reboot, sync, ext2, ext3, ext4, filesystem, driver </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Qt WebEngine GPU Acceleration, the grind of FreeBSD’s wireless stack, thoughts on overlooking Illumos&#39;s syseventadm, when Unix learned to reboot, New EXT2/3/4 File-System driver in DragonflyBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://euroquis.nl/freebsd/2020/07/21/webengine.html" rel="nofollow">FreeBSD Qt WebEngine GPU Acceleration</a></h3>

<blockquote>
<p>FreeBSD has a handful of Qt WebEngine-based browsers. Falkon, and Otter-Browser, and qutebrowser and probably others, too. All of them can run into issues on FreeBSD with GPU-accelerated rendering not working. Let’s look at some of the workarounds.</p>
</blockquote>

<hr>

<h3><a href="https://www.cambus.net/netbsd-on-the-nanopi-neo2/" rel="nofollow">NetBSD on the Nanopi Neo2</a></h3>

<blockquote>
<p>The NanoPi NEO2 from FriendlyARM has been serving me well since 2018, being my test machine for OpenBSD/arm64 related things.<br>
As NetBSD/evbarm finally gained support for AArch64 in NetBSD 9.0, released back in February, I decided to give it a try on this device. The board only has 512MB of RAM, and this is where NetBSD really shines. Things have become a lot easier since jmcneill@ now provides bootable ARM images for a variety of devices, including the NanoPi NEO2.</p>
</blockquote>

<hr>

<h3><a href="https://adrianchadd.blogspot.com/2020/07/im-back-into-grind-of-freebsds-wireless.html" rel="nofollow">I&#39;m back into the grind of FreeBSD&#39;s wireless stack and 802.11ac</a></h3>

<blockquote>
<p>Yes, it&#39;s been a while since I posted here and yes, it&#39;s been a while since I was actively working on FreeBSD&#39;s wireless stack. Life&#39;s been .. well, life. I started the ath10k port in 2015. I wasn&#39;t expecting it to take 5 years, but here we are. My life has changed quite a lot since 2015 and a lot of the things I was doing in 2015 just stopped being fun for a while.<br>
But the stars have aligned and it&#39;s fun again, so here I am. </p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/OverlookingSyseventadm" rel="nofollow">Some thoughts on us overlooking Illumos&#39;s syseventadm</a></h3>

<blockquote>
<p>In a comment on my praise of ZFS on Linux&#39;s ZFS event daemon, Joshua M. Clulow noted that Illumos (and thus OmniOS) has an equivalent in syseventadm, which dates back to Solaris. I hadn&#39;t previously known about syseventadm, despite having run Solaris fileservers and OmniOS fileservers for the better part of a decade, and that gives me some tangled feelings.</p>
</blockquote>

<hr>

<h3><a href="https://bsdimp.blogspot.com/2020/07/when-unix-learned-to-reboot2.html" rel="nofollow">When Unix learned to reboot</a></h3>

<blockquote>
<p>Recently, a friend asked me the history of halt, and when did we have to stop with the sync / sync / sync dance before running halt or reboot. The two are related, it turns out.</p>
</blockquote>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-New-EXT2FS" rel="nofollow">DragonFlyBSD Lands New EXT2/3/4 File-System Driver</a></h3>

<blockquote>
<p>While DragonFlyBSD has its own, original HAMMER2 file-system, for those needing to access data from EXT2/EXT3/EXT4 file-systems, there is a brand new &quot;ext2fs&quot; driver implementation for this BSD operating system.<br>
DragonFlyBSD has long offered an EXT2 file-system driver (that also handles EXT3 and EXT4) while hitting their Git tree this week is a new version. The new sys/vfs/ext2fs driver, which will ultimately replace their existing sys/gnu/vfs/ext2fs driver is based on a port from FreeBSD code. As such, this driver is BSD licensed rather than GPL. But besides the more liberal license to jive with the BSD world, this new driver has various feature/functionality improvements over the prior version. However, there are some known bugs so for the time being both file-system drivers will co-exist.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-office/2020-July/005822.html" rel="nofollow">LibreOffice 7.0 call for testing</a></li>
<li><a href="https://www.dragonflydigest.com/2020/07/15/24747.html" rel="nofollow">More touchpad support</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/casey%20-%20openbsd%20wirewall.md" rel="nofollow">Casey - openbsd wirewall</a><br>
<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/daryl%20-%20zfs.md" rel="nofollow">Daryl - zfs</a><br>
<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/raymond%20-%20hpe%20microserver.md" rel="nofollow">Raymond - hpe microserver</a></p>

<hr>

<ul>
<li>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Qt WebEngine GPU Acceleration, the grind of FreeBSD’s wireless stack, thoughts on overlooking Illumos&#39;s syseventadm, when Unix learned to reboot, New EXT2/3/4 File-System driver in DragonflyBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://euroquis.nl/freebsd/2020/07/21/webengine.html" rel="nofollow">FreeBSD Qt WebEngine GPU Acceleration</a></h3>

<blockquote>
<p>FreeBSD has a handful of Qt WebEngine-based browsers. Falkon, and Otter-Browser, and qutebrowser and probably others, too. All of them can run into issues on FreeBSD with GPU-accelerated rendering not working. Let’s look at some of the workarounds.</p>
</blockquote>

<hr>

<h3><a href="https://www.cambus.net/netbsd-on-the-nanopi-neo2/" rel="nofollow">NetBSD on the Nanopi Neo2</a></h3>

<blockquote>
<p>The NanoPi NEO2 from FriendlyARM has been serving me well since 2018, being my test machine for OpenBSD/arm64 related things.<br>
As NetBSD/evbarm finally gained support for AArch64 in NetBSD 9.0, released back in February, I decided to give it a try on this device. The board only has 512MB of RAM, and this is where NetBSD really shines. Things have become a lot easier since jmcneill@ now provides bootable ARM images for a variety of devices, including the NanoPi NEO2.</p>
</blockquote>

<hr>

<h3><a href="https://adrianchadd.blogspot.com/2020/07/im-back-into-grind-of-freebsds-wireless.html" rel="nofollow">I&#39;m back into the grind of FreeBSD&#39;s wireless stack and 802.11ac</a></h3>

<blockquote>
<p>Yes, it&#39;s been a while since I posted here and yes, it&#39;s been a while since I was actively working on FreeBSD&#39;s wireless stack. Life&#39;s been .. well, life. I started the ath10k port in 2015. I wasn&#39;t expecting it to take 5 years, but here we are. My life has changed quite a lot since 2015 and a lot of the things I was doing in 2015 just stopped being fun for a while.<br>
But the stars have aligned and it&#39;s fun again, so here I am. </p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/OverlookingSyseventadm" rel="nofollow">Some thoughts on us overlooking Illumos&#39;s syseventadm</a></h3>

<blockquote>
<p>In a comment on my praise of ZFS on Linux&#39;s ZFS event daemon, Joshua M. Clulow noted that Illumos (and thus OmniOS) has an equivalent in syseventadm, which dates back to Solaris. I hadn&#39;t previously known about syseventadm, despite having run Solaris fileservers and OmniOS fileservers for the better part of a decade, and that gives me some tangled feelings.</p>
</blockquote>

<hr>

<h3><a href="https://bsdimp.blogspot.com/2020/07/when-unix-learned-to-reboot2.html" rel="nofollow">When Unix learned to reboot</a></h3>

<blockquote>
<p>Recently, a friend asked me the history of halt, and when did we have to stop with the sync / sync / sync dance before running halt or reboot. The two are related, it turns out.</p>
</blockquote>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-New-EXT2FS" rel="nofollow">DragonFlyBSD Lands New EXT2/3/4 File-System Driver</a></h3>

<blockquote>
<p>While DragonFlyBSD has its own, original HAMMER2 file-system, for those needing to access data from EXT2/EXT3/EXT4 file-systems, there is a brand new &quot;ext2fs&quot; driver implementation for this BSD operating system.<br>
DragonFlyBSD has long offered an EXT2 file-system driver (that also handles EXT3 and EXT4) while hitting their Git tree this week is a new version. The new sys/vfs/ext2fs driver, which will ultimately replace their existing sys/gnu/vfs/ext2fs driver is based on a port from FreeBSD code. As such, this driver is BSD licensed rather than GPL. But besides the more liberal license to jive with the BSD world, this new driver has various feature/functionality improvements over the prior version. However, there are some known bugs so for the time being both file-system drivers will co-exist.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-office/2020-July/005822.html" rel="nofollow">LibreOffice 7.0 call for testing</a></li>
<li><a href="https://www.dragonflydigest.com/2020/07/15/24747.html" rel="nofollow">More touchpad support</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/casey%20-%20openbsd%20wirewall.md" rel="nofollow">Casey - openbsd wirewall</a><br>
<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/daryl%20-%20zfs.md" rel="nofollow">Daryl - zfs</a><br>
<a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/raymond%20-%20hpe%20microserver.md" rel="nofollow">Raymond - hpe microserver</a></p>

<hr>

<ul>
<li>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>363: Traditional Unix toolchains</title>
  <link>https://www.bsdnow.tv/363</link>
  <guid isPermaLink="false">5152316f-4859-4e73-8c1c-18f2b9965f5d</guid>
  <pubDate>Thu, 13 Aug 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5152316f-4859-4e73-8c1c-18f2b9965f5d.mp3" length="36468128" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Q2 Quarterly Status report of 2020, Traditional Unix Toolchains, BastilleBSD 0.7 released, Finding meltdown on DragonflyBSD, and more</itunes:subtitle>
  <itunes:duration>34:45</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Q2 Quarterly Status report of 2020, Traditional Unix Toolchains, BastilleBSD 0.7 released, Finding meltdown on DragonflyBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
FreeBSD Quarterly Report (https://www.freebsd.org/news/status/report-2020-04-2020-06.html)
This report will be covering FreeBSD related projects between April and June, and covers a diverse set of topics ranging from kernel updates over userland and ports, as well to third-party work.
Some highlights picked with the roll of a d100 include, but are not limited to, the ability to forcibly unmounting UFS when the underlying media becomes inaccessible, added preliminary support for Bluetooth Low Energy, a introduction to the FreeBSD Office Hours, and a repository of software collections called potluck to be installed with the pot utility, as well as many many more things.
As a little treat, readers can also get a rare report from the quarterly team.
Finally, on behalf of the quarterly team, I would like to extend my deepest appreciation and thank you to salvadore@, who decided to take down his shingle. His contributions not just the quarterly reports themselves, but also the surrounding tooling to many-fold ease the work, are immeasurable.
Traditional Unix Toolchains (https://bsdimp.blogspot.com/2020/07/traditional-unix-toolchains.html?m=1)
Older Unix systems tend to be fairly uniform in how they handle the so-called 'toolchain' for creating binaries. This blog will give a quick overview of the toolchain pipeline for Unix systems that follow the V7 tradition (which evolved along with Unix, a topic for a separate blog maybe).
Unix is a pipeline based system, either physically or logically. One program takes input, process the data and produces output. The input and output have some interface they obey, usually text-based. The Unix toolchain is no different.
News Roundup
Bastille Day 2020 : v0.7 released (https://github.com/BastilleBSD/bastille/releases/tag/0.7.20200714)
This release matures the project from 0.6.x -&amp;gt; 0.7.x. Continued testing and bug fixes are proving Bastille capable for a range of use-cases. New (experimental) features are examples of innovation from community contribution and feedback. Thank you.
Beastie Bits
Finding meltdown on DragonFly (https://www.dragonflydigest.com/2020/07/28/24787.html)
NetBSD Server Outage (https://mobile.twitter.com/netbsd/status/1286898183923277829)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Vincent - Gnome 3 question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/vincent%20-%20gnome3.md)
Malcolm - ZFS question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/malcolm%20-%20zfs.md)
Hassan - Video question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/hassan%20-%20video.md) 
For those that watch on youtube, don’t forget to subscribe to our new YouTube Channel if you want updates when we post them on YT (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/new-bsdnow-youtube-channel.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, quarterly status, status report, traditional, Unix, toolchain, meltdown</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Q2 Quarterly Status report of 2020, Traditional Unix Toolchains, BastilleBSD 0.7 released, Finding meltdown on DragonflyBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2020-04-2020-06.html" rel="nofollow">FreeBSD Quarterly Report</a></h3>

<blockquote>
<p>This report will be covering FreeBSD related projects between April and June, and covers a diverse set of topics ranging from kernel updates over userland and ports, as well to third-party work.<br>
Some highlights picked with the roll of a d100 include, but are not limited to, the ability to forcibly unmounting UFS when the underlying media becomes inaccessible, added preliminary support for Bluetooth Low Energy, a introduction to the FreeBSD Office Hours, and a repository of software collections called potluck to be installed with the pot utility, as well as many many more things.<br>
As a little treat, readers can also get a rare report from the quarterly team.<br>
Finally, on behalf of the quarterly team, I would like to extend my deepest appreciation and thank you to salvadore@, who decided to take down his shingle. His contributions not just the quarterly reports themselves, but also the surrounding tooling to many-fold ease the work, are immeasurable.</p>

<hr>
</blockquote>

<h3><a href="https://bsdimp.blogspot.com/2020/07/traditional-unix-toolchains.html?m=1" rel="nofollow">Traditional Unix Toolchains</a></h3>

<blockquote>
<p>Older Unix systems tend to be fairly uniform in how they handle the so-called &#39;toolchain&#39; for creating binaries. This blog will give a quick overview of the toolchain pipeline for Unix systems that follow the V7 tradition (which evolved along with Unix, a topic for a separate blog maybe).<br>
Unix is a pipeline based system, either physically or logically. One program takes input, process the data and produces output. The input and output have some interface they obey, usually text-based. The Unix toolchain is no different.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://github.com/BastilleBSD/bastille/releases/tag/0.7.20200714" rel="nofollow">Bastille Day 2020 : v0.7 released</a></h3>

<blockquote>
<p>This release matures the project from 0.6.x -&gt; 0.7.x. Continued testing and bug fixes are proving Bastille capable for a range of use-cases. New (experimental) features are examples of innovation from community contribution and feedback. Thank you.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/07/28/24787.html" rel="nofollow">Finding meltdown on DragonFly</a></li>
<li><a href="https://mobile.twitter.com/netbsd/status/1286898183923277829" rel="nofollow">NetBSD Server Outage</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/vincent%20-%20gnome3.md" rel="nofollow">Vincent - Gnome 3 question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/malcolm%20-%20zfs.md" rel="nofollow">Malcolm - ZFS question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/hassan%20-%20video.md" rel="nofollow">Hassan - Video question</a> 

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/new-bsdnow-youtube-channel.md" rel="nofollow">For those that watch on youtube, don’t forget to subscribe to our new YouTube Channel if you want updates when we post them on YT</a></li>
</ul></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Q2 Quarterly Status report of 2020, Traditional Unix Toolchains, BastilleBSD 0.7 released, Finding meltdown on DragonflyBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2020-04-2020-06.html" rel="nofollow">FreeBSD Quarterly Report</a></h3>

<blockquote>
<p>This report will be covering FreeBSD related projects between April and June, and covers a diverse set of topics ranging from kernel updates over userland and ports, as well to third-party work.<br>
Some highlights picked with the roll of a d100 include, but are not limited to, the ability to forcibly unmounting UFS when the underlying media becomes inaccessible, added preliminary support for Bluetooth Low Energy, a introduction to the FreeBSD Office Hours, and a repository of software collections called potluck to be installed with the pot utility, as well as many many more things.<br>
As a little treat, readers can also get a rare report from the quarterly team.<br>
Finally, on behalf of the quarterly team, I would like to extend my deepest appreciation and thank you to salvadore@, who decided to take down his shingle. His contributions not just the quarterly reports themselves, but also the surrounding tooling to many-fold ease the work, are immeasurable.</p>

<hr>
</blockquote>

<h3><a href="https://bsdimp.blogspot.com/2020/07/traditional-unix-toolchains.html?m=1" rel="nofollow">Traditional Unix Toolchains</a></h3>

<blockquote>
<p>Older Unix systems tend to be fairly uniform in how they handle the so-called &#39;toolchain&#39; for creating binaries. This blog will give a quick overview of the toolchain pipeline for Unix systems that follow the V7 tradition (which evolved along with Unix, a topic for a separate blog maybe).<br>
Unix is a pipeline based system, either physically or logically. One program takes input, process the data and produces output. The input and output have some interface they obey, usually text-based. The Unix toolchain is no different.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://github.com/BastilleBSD/bastille/releases/tag/0.7.20200714" rel="nofollow">Bastille Day 2020 : v0.7 released</a></h3>

<blockquote>
<p>This release matures the project from 0.6.x -&gt; 0.7.x. Continued testing and bug fixes are proving Bastille capable for a range of use-cases. New (experimental) features are examples of innovation from community contribution and feedback. Thank you.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/07/28/24787.html" rel="nofollow">Finding meltdown on DragonFly</a></li>
<li><a href="https://mobile.twitter.com/netbsd/status/1286898183923277829" rel="nofollow">NetBSD Server Outage</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/vincent%20-%20gnome3.md" rel="nofollow">Vincent - Gnome 3 question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/malcolm%20-%20zfs.md" rel="nofollow">Malcolm - ZFS question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/hassan%20-%20video.md" rel="nofollow">Hassan - Video question</a> 

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/new-bsdnow-youtube-channel.md" rel="nofollow">For those that watch on youtube, don’t forget to subscribe to our new YouTube Channel if you want updates when we post them on YT</a></li>
</ul></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>362: 2.11-BSD restoration</title>
  <link>https://www.bsdnow.tv/362</link>
  <guid isPermaLink="false">5822b2f7-0440-44f4-8f73-70609c960a3d</guid>
  <pubDate>Thu, 06 Aug 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5822b2f7-0440-44f4-8f73-70609c960a3d.mp3" length="58166072" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Interview with Warner Losh about Unix history, the 2.11-BSD restoration project, the Unix heritage society, proper booting, and what devmatch is.</itunes:subtitle>
  <itunes:duration>1:02:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Interview with Warner Losh about Unix history, the 2.11-BSD restoration project, the Unix heritage society, proper booting, and what devmatch is.
Interview - Warner Losh - imp@freebsd.org (mailto:imp@freebsd.org) / @bsdimp (https://twitter.com/bsdimp)
BSD 2.11 restoration project
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
 Special Guest: Warner Losh.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Interview with Warner Losh about Unix history, the 2.11-BSD restoration project, the Unix heritage society, proper booting, and what devmatch is.</p>

<h4>Interview - Warner Losh - <a href="mailto:imp@freebsd.org" rel="nofollow">imp@freebsd.org</a> / <a href="https://twitter.com/bsdimp" rel="nofollow">@bsdimp</a></h4>

<h2>BSD 2.11 restoration project</h2>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul><p>Special Guest: Warner Losh.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Interview with Warner Losh about Unix history, the 2.11-BSD restoration project, the Unix heritage society, proper booting, and what devmatch is.</p>

<h4>Interview - Warner Losh - <a href="mailto:imp@freebsd.org" rel="nofollow">imp@freebsd.org</a> / <a href="https://twitter.com/bsdimp" rel="nofollow">@bsdimp</a></h4>

<h2>BSD 2.11 restoration project</h2>

<h3>Tarsnap</h3>

<ul>
<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul><p>Special Guest: Warner Losh.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>361: Function-based MicroVM</title>
  <link>https://www.bsdnow.tv/361</link>
  <guid isPermaLink="false">e7930697-b2c2-4603-b015-19d1070a7c69</guid>
  <pubDate>Thu, 30 Jul 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e7930697-b2c2-4603-b015-19d1070a7c69.mp3" length="64248344" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Emulex: The Cheapest 10gbe for Your Homelab, In Search of 2.11BSD, as released, Fakecracker: NetBSD as a Function Based MicroVM, First powerpc64 snapshots available for OpenBSD, OPNsense 20.1.8 released, and more.
</itunes:subtitle>
  <itunes:duration>1:02:10</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Emulex: The Cheapest 10gbe for Your Homelab, In Search of 2.11BSD, as released, Fakecracker: NetBSD as a Function Based MicroVM, First powerpc64 snapshots available for OpenBSD, OPNsense 20.1.8 released, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
Emulex: The Cheapest 10gbe for Your Homelab (https://vincerants.com/emulex-the-cheapest-10gbe/)
Years ago, the hunt for the cheapest 10gbe NICs resulted in buying Mellanox ConnectX-2 single-port 10gbe network cards from eBay for around $10. Nowadays those cards have increased in cost to around $20-30. While still cheap, not quite the cheapest. There are now alternatives!
Before diving into details, let’s get something very clear. If you want the absolute simplest plug-and-play 10gbe LAN for your homelab, pay the extra for Mellanox. If you’re willing to go hands-on, do some simple manual configuration and installation, read on for my experiences with Emulex 10gbe NICs.
Emulex NICs can often be had for around $15 on eBay, sometimes even cheaper. I recently picked up a set of 4 of these cards, which came bundled with 6 SFP+ 10g-SR modules for a grand total of $47.48. Considering I can usually find SFP+ modules for about $5/ea, these alone were worth $30.
+ I have also tried some Solarflare cards that I found cheap, they work ok, but are pickier about optics, and tend to be focused on low-latency, so often don’t manage to saturate the full 10 gbps, topping out around 8 gbps.
+ I have been using fs.com for optics, patch cables, and DACs. I find DACs are usually cheaper if you are just going between a server and a switch in the same rack, or direct between 2 servers.
In Search of 2.11BSD, as released (https://bsdimp.blogspot.com/2020/07/211bsd-original-tapes-recreation.html)
Almost all of the BSD releases have been well preserved. If you want to find 1BSD, or 2BSD or 4.3-TAHOE BSD you can find them online with little fuss. However, if you search for 2.11BSD, you'll find it easily enough, but it won't be the original. You'll find either the latest patched version (2.11BSD pl 469), or one of the earlier popular version (pl 430 is popular). You can even find the RetroBSD project which used 2.11BSD as a starting point to create systems for tiny mips-based PIC controllers. You'll find every single patch that's been issued for the system.
News Roundup
Fakecracker: NetBSD as a Function Based MicroVM (https://imil.net/blog/posts/2020/fakecracker-netbsd-as-a-function-based-microvm/)
In November 2018 AWS published an Open Source tool called Firecracker, mostly a virtual machine monitor relying on KVM, a small sized Linux kernel, and a stripped down version of Qemu. What baffled me was the speed at which the virtual machine would fire up and run the service. The whole process is to be compared to a container, but safer, as it does not share the kernel nor any resource, it is a separate and dedicated virtual machine.
If you want to learn more on Firecracker‘s internals, here’s a very well put article.
First powerpc64 snapshots available for OpenBSD (https://undeadly.org/cgi?action=article;sid=20200707001113)
Since we reported the first bits of powerpc64 support going into the tree on 16 May, work has progressed at a steady pace, resulting in snapshots now being available for this platform.
So, if you have a POWER9 system idling around, go to your nearest mirror and fetch this snapshot. Keep in mind that as this is still very early days, very little handholding is available - you are basically on your own.
OPNsense 20.1.8 released (https://opnsense.org/opnsense-20-1-8-released/)
Sorry about the delay while we chased a race condition in the updates back to an issue with the latest FreeBSD package manager updates. For now we reverted to our current version but all relevant third party packages have been updated as updates became available over the last weeks, e.g. cURL and Python, and hostapd / wpa_supplicant amongst others.
Beastie Bits
Old School Disk Partitioning (https://bsdimp.blogspot.com/2020/07/old-school-disk-partitioning.html)
Nomad BSD 1.3.2 Released (http://nomadbsd.org/index.html#1.3.2)
Chai-Fi (https://github.com/gonzoua/chaifi)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Poojan - ZFS Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/Poojan%20-%20ZFS%20question.md)
graceon - supermicro (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/graceon%20-%20supermicro.md)
zenbum - groff (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/zenbum%20-%20groff.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
 Special Guest: Warner Losh.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, interview, emulex, homelab, 2.11 BSD, function based microvm, microvm, powerpc64, snapshots, opnsense, release</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Emulex: The Cheapest 10gbe for Your Homelab, In Search of 2.11BSD, as released, Fakecracker: NetBSD as a Function Based MicroVM, First powerpc64 snapshots available for OpenBSD, OPNsense 20.1.8 released, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://vincerants.com/emulex-the-cheapest-10gbe/" rel="nofollow">Emulex: The Cheapest 10gbe for Your Homelab</a></h3>

<blockquote>
<p>Years ago, the hunt for the cheapest 10gbe NICs resulted in buying Mellanox ConnectX-2 single-port 10gbe network cards from eBay for around $10. Nowadays those cards have increased in cost to around $20-30. While still cheap, not quite the cheapest. There are now alternatives!<br>
Before diving into details, let’s get something very clear. If you want the absolute simplest plug-and-play 10gbe LAN for your homelab, pay the extra for Mellanox. If you’re willing to go hands-on, do some simple manual configuration and installation, read on for my experiences with Emulex 10gbe NICs.<br>
Emulex NICs can often be had for around $15 on eBay, sometimes even cheaper. I recently picked up a set of 4 of these cards, which came bundled with 6 SFP+ 10g-SR modules for a grand total of $47.48. Considering I can usually find SFP+ modules for about $5/ea, these alone were worth $30.</p>

<ul>
<li>I have also tried some Solarflare cards that I found cheap, they work ok, but are pickier about optics, and tend to be focused on low-latency, so often don’t manage to saturate the full 10 gbps, topping out around 8 gbps.</li>
<li>I have been using fs.com for optics, patch cables, and DACs. I find DACs are usually cheaper if you are just going between a server and a switch in the same rack, or direct between 2 servers.
***</li>
</ul>
</blockquote>

<h3><a href="https://bsdimp.blogspot.com/2020/07/211bsd-original-tapes-recreation.html" rel="nofollow">In Search of 2.11BSD, as released</a></h3>

<blockquote>
<p>Almost all of the BSD releases have been well preserved. If you want to find 1BSD, or 2BSD or 4.3-TAHOE BSD you can find them online with little fuss. However, if you search for 2.11BSD, you&#39;ll find it easily enough, but it won&#39;t be the original. You&#39;ll find either the latest patched version (2.11BSD pl 469), or one of the earlier popular version (pl 430 is popular). You can even find the RetroBSD project which used 2.11BSD as a starting point to create systems for tiny mips-based PIC controllers. You&#39;ll find every single patch that&#39;s been issued for the system.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://imil.net/blog/posts/2020/fakecracker-netbsd-as-a-function-based-microvm/" rel="nofollow">Fakecracker: NetBSD as a Function Based MicroVM</a></h3>

<blockquote>
<p>In November 2018 AWS published an Open Source tool called Firecracker, mostly a virtual machine monitor relying on KVM, a small sized Linux kernel, and a stripped down version of Qemu. What baffled me was the speed at which the virtual machine would fire up and run the service. The whole process is to be compared to a container, but safer, as it does not share the kernel nor any resource, it is a separate and dedicated virtual machine.<br>
If you want to learn more on Firecracker‘s internals, here’s a very well put article.</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20200707001113" rel="nofollow">First powerpc64 snapshots available for OpenBSD</a></h3>

<blockquote>
<p>Since we reported the first bits of powerpc64 support going into the tree on 16 May, work has progressed at a steady pace, resulting in snapshots now being available for this platform.<br>
So, if you have a POWER9 system idling around, go to your nearest mirror and fetch this snapshot. Keep in mind that as this is still very early days, very little handholding is available - you are basically on your own.</p>

<hr>
</blockquote>

<h3><a href="https://opnsense.org/opnsense-20-1-8-released/" rel="nofollow">OPNsense 20.1.8 released</a></h3>

<blockquote>
<p>Sorry about the delay while we chased a race condition in the updates back to an issue with the latest FreeBSD package manager updates. For now we reverted to our current version but all relevant third party packages have been updated as updates became available over the last weeks, e.g. cURL and Python, and hostapd / wpa_supplicant amongst others.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://bsdimp.blogspot.com/2020/07/old-school-disk-partitioning.html" rel="nofollow">Old School Disk Partitioning</a></li>
<li><a href="http://nomadbsd.org/index.html#1.3.2" rel="nofollow">Nomad BSD 1.3.2 Released</a></li>
<li><a href="https://github.com/gonzoua/chaifi" rel="nofollow">Chai-Fi</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/Poojan%20-%20ZFS%20question.md" rel="nofollow">Poojan - ZFS Question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/graceon%20-%20supermicro.md" rel="nofollow">graceon - supermicro</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/zenbum%20-%20groff.md" rel="nofollow">zenbum - groff</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Warner Losh.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Emulex: The Cheapest 10gbe for Your Homelab, In Search of 2.11BSD, as released, Fakecracker: NetBSD as a Function Based MicroVM, First powerpc64 snapshots available for OpenBSD, OPNsense 20.1.8 released, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://vincerants.com/emulex-the-cheapest-10gbe/" rel="nofollow">Emulex: The Cheapest 10gbe for Your Homelab</a></h3>

<blockquote>
<p>Years ago, the hunt for the cheapest 10gbe NICs resulted in buying Mellanox ConnectX-2 single-port 10gbe network cards from eBay for around $10. Nowadays those cards have increased in cost to around $20-30. While still cheap, not quite the cheapest. There are now alternatives!<br>
Before diving into details, let’s get something very clear. If you want the absolute simplest plug-and-play 10gbe LAN for your homelab, pay the extra for Mellanox. If you’re willing to go hands-on, do some simple manual configuration and installation, read on for my experiences with Emulex 10gbe NICs.<br>
Emulex NICs can often be had for around $15 on eBay, sometimes even cheaper. I recently picked up a set of 4 of these cards, which came bundled with 6 SFP+ 10g-SR modules for a grand total of $47.48. Considering I can usually find SFP+ modules for about $5/ea, these alone were worth $30.</p>

<ul>
<li>I have also tried some Solarflare cards that I found cheap, they work ok, but are pickier about optics, and tend to be focused on low-latency, so often don’t manage to saturate the full 10 gbps, topping out around 8 gbps.</li>
<li>I have been using fs.com for optics, patch cables, and DACs. I find DACs are usually cheaper if you are just going between a server and a switch in the same rack, or direct between 2 servers.
***</li>
</ul>
</blockquote>

<h3><a href="https://bsdimp.blogspot.com/2020/07/211bsd-original-tapes-recreation.html" rel="nofollow">In Search of 2.11BSD, as released</a></h3>

<blockquote>
<p>Almost all of the BSD releases have been well preserved. If you want to find 1BSD, or 2BSD or 4.3-TAHOE BSD you can find them online with little fuss. However, if you search for 2.11BSD, you&#39;ll find it easily enough, but it won&#39;t be the original. You&#39;ll find either the latest patched version (2.11BSD pl 469), or one of the earlier popular version (pl 430 is popular). You can even find the RetroBSD project which used 2.11BSD as a starting point to create systems for tiny mips-based PIC controllers. You&#39;ll find every single patch that&#39;s been issued for the system.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://imil.net/blog/posts/2020/fakecracker-netbsd-as-a-function-based-microvm/" rel="nofollow">Fakecracker: NetBSD as a Function Based MicroVM</a></h3>

<blockquote>
<p>In November 2018 AWS published an Open Source tool called Firecracker, mostly a virtual machine monitor relying on KVM, a small sized Linux kernel, and a stripped down version of Qemu. What baffled me was the speed at which the virtual machine would fire up and run the service. The whole process is to be compared to a container, but safer, as it does not share the kernel nor any resource, it is a separate and dedicated virtual machine.<br>
If you want to learn more on Firecracker‘s internals, here’s a very well put article.</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20200707001113" rel="nofollow">First powerpc64 snapshots available for OpenBSD</a></h3>

<blockquote>
<p>Since we reported the first bits of powerpc64 support going into the tree on 16 May, work has progressed at a steady pace, resulting in snapshots now being available for this platform.<br>
So, if you have a POWER9 system idling around, go to your nearest mirror and fetch this snapshot. Keep in mind that as this is still very early days, very little handholding is available - you are basically on your own.</p>

<hr>
</blockquote>

<h3><a href="https://opnsense.org/opnsense-20-1-8-released/" rel="nofollow">OPNsense 20.1.8 released</a></h3>

<blockquote>
<p>Sorry about the delay while we chased a race condition in the updates back to an issue with the latest FreeBSD package manager updates. For now we reverted to our current version but all relevant third party packages have been updated as updates became available over the last weeks, e.g. cURL and Python, and hostapd / wpa_supplicant amongst others.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://bsdimp.blogspot.com/2020/07/old-school-disk-partitioning.html" rel="nofollow">Old School Disk Partitioning</a></li>
<li><a href="http://nomadbsd.org/index.html#1.3.2" rel="nofollow">Nomad BSD 1.3.2 Released</a></li>
<li><a href="https://github.com/gonzoua/chaifi" rel="nofollow">Chai-Fi</a></li>
</ul>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/Poojan%20-%20ZFS%20question.md" rel="nofollow">Poojan - ZFS Question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/graceon%20-%20supermicro.md" rel="nofollow">graceon - supermicro</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/zenbum%20-%20groff.md" rel="nofollow">zenbum - groff</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul><p>Special Guest: Warner Losh.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>360: Full circle</title>
  <link>https://www.bsdnow.tv/360</link>
  <guid isPermaLink="false">69d88af7-54da-4612-9fc2-84ffae001c46</guid>
  <pubDate>Thu, 23 Jul 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/69d88af7-54da-4612-9fc2-84ffae001c46.mp3" length="42925160" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Chasing a bad commit, New FreeBSD Core Team elected, Getting Started with NetBSD on the Pinebook Pro, FreeBSD on the Intel 10th Gen i3 NUC, pf table size check and change, and more.</itunes:subtitle>
  <itunes:duration>42:27</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Chasing a bad commit, New FreeBSD Core Team elected, Getting Started with NetBSD on the Pinebook Pro, FreeBSD on the Intel 10th Gen i3 NUC, pf table size check and change, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
Chasing a bad commit (https://vishaltelangre.com/chasing-a-bad-commit/)
While working on a big project where multiple teams merge their feature branches frequently into a release Git branch, developers often run into situations where they find that some of their work have been either removed, modified or affected by someone else's work accidentally. It can happen in smaller teams as well. Two features could have been working perfectly fine until they got merged together and broke something. That's a highly possible case. There are many other cases which could cause such hard to understand and subtle bugs which even continuous integration (CI) systems running the entire test suite of our projects couldn't catch.
We are not going to discuss how such subtle bugs can get into our release branch because that's just a wild territory out there. Instead, we can definitely discuss about how to find a commit that deviated from an expected outcome of a certain feature. The deviation could be any behaviour of our code that we can measure distinctively — either good or bad in general.
New FreeBSD Core Team Elected (https://www.freebsdnews.com/2020/07/14/new-freebsd-core-team-elected/)
The FreeBSD Project is pleased to announce the completion of the 2020 Core Team election. Active committers to the project have elected your Eleventh FreeBSD Core Team.!
Baptiste Daroussin (bapt)
Ed Maste (emaste)
George V. Neville-Neil (gnn)
Hiroki Sato (hrs)
Kyle Evans (kevans)
Mark Johnston (markj)
Scott Long (scottl)
Sean Chittenden (seanc)
Warner Losh (imp)
***
News Roundup
Getting Started with NetBSD on the Pinebook Pro (https://bentsukun.ch/posts/pinebook-pro-netbsd/)
If you buy a Pinebook Pro now, it comes with Manjaro Linux on the internal eMMC storage. Let’s install NetBSD instead!
The easiest way to get started is to buy a decent micro-SD card (what sort of markings it should have is a science of its own, by the way) and install NetBSD on that. On a warm boot (i.e. when rebooting a running system), the micro-SD card has priority compared to the eMMC, so the system will boot from there.
+ A FreeBSD developer has borrowed some of the NetBSD code to get audio working on RockPro64 and Pinebook Pro: https://twitter.com/kernelnomicon/status/1282790609778905088
FreeBSD on the Intel 10th Gen i3 NUC (https://adventurist.me/posts/00300)
I have ended up with some 10th Gen i3 NUC's (NUC10i3FNH to be specific) to put to work in my testbed. These are quite new devices, the build date on the boxes is 13APR2020. Before I figure out what their true role is (one of them might have to run linux) I need to install FreeBSD -CURRENT and see how performance and hardware support is.
pf table size check and change (https://www.dragonflydigest.com/2020/06/29/24698.html)
Did you know there’s a default size limit to pf’s state table?  I did not, but it makes sense that there is one.  If for some reason you bump into this limit (difficult for home use, I’d think), here’s how you change it (http://lists.dragonflybsd.org/pipermail/users/2020-June/381261.html)
There is a table-entries limit specified, you can see current settings with
'pfctl -s all'.  You can adjust the limits in the /etc/pf.conf file
containing the rules with a line like this near the top:
set limit table-entries 100000
+ In the original mail thread, there is mention of the FreeBSD sysctl net.pf.request_maxcount, which controls the maximum number of entries that can be sent as a single ioctl(). This allows the user to adjust the memory limit for how big of a list the kernel is willing to allocate memory for.
Beastie Bits
tmux and bhyve (https://callfortesting.org/tmux/)
Azure and FreeBSD (https://azuremarketplace.microsoft.com/en-us/marketplace/apps/thefreebsdfoundation.freebsd-12_1)
Groff Tutorial (https://www.youtube.com/watch?v=bvkmnK6-qao&amp;amp;feature=youtu.be)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Tarsnap Mastery (https://mwl.io/nonfiction/tools#tarsnap)
Feedback/Questions
Chris - ZFS Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/Chris%20-%20zfs%20question.md)
Patrick - Tarsnap (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/Patrick%20-%20Tarsnap.md)
Pin - pkgsrc (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/pin%20-%20pkgsrc.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, berkeley, software, distribution, zfs, interview, commit, core team, freebsd core team, election, elected, pinebook, pinebook pro, i3, Intel, Intel i3, i3 NUC, pf, packet filter, table size, table size check</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Chasing a bad commit, New FreeBSD Core Team elected, Getting Started with NetBSD on the Pinebook Pro, FreeBSD on the Intel 10th Gen i3 NUC, pf table size check and change, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://vishaltelangre.com/chasing-a-bad-commit/" rel="nofollow">Chasing a bad commit</a></h3>

<blockquote>
<p>While working on a big project where multiple teams merge their feature branches frequently into a release Git branch, developers often run into situations where they find that some of their work have been either removed, modified or affected by someone else&#39;s work accidentally. It can happen in smaller teams as well. Two features could have been working perfectly fine until they got merged together and broke something. That&#39;s a highly possible case. There are many other cases which could cause such hard to understand and subtle bugs which even continuous integration (CI) systems running the entire test suite of our projects couldn&#39;t catch.<br>
We are not going to discuss how such subtle bugs can get into our release branch because that&#39;s just a wild territory out there. Instead, we can definitely discuss about how to find a commit that deviated from an expected outcome of a certain feature. The deviation could be any behaviour of our code that we can measure distinctively — either good or bad in general.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsdnews.com/2020/07/14/new-freebsd-core-team-elected/" rel="nofollow">New FreeBSD Core Team Elected</a></h3>

<blockquote>
<p>The FreeBSD Project is pleased to announce the completion of the 2020 Core Team election. Active committers to the project have elected your Eleventh FreeBSD Core Team.!</p>
</blockquote>

<ul>
<li>Baptiste Daroussin (bapt)</li>
<li>Ed Maste (emaste)</li>
<li>George V. Neville-Neil (gnn)</li>
<li>Hiroki Sato (hrs)</li>
<li>Kyle Evans (kevans)</li>
<li>Mark Johnston (markj)</li>
<li>Scott Long (scottl)</li>
<li>Sean Chittenden (seanc)</li>
<li>Warner Losh (imp)
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://bentsukun.ch/posts/pinebook-pro-netbsd/" rel="nofollow">Getting Started with NetBSD on the Pinebook Pro</a></h3>

<blockquote>
<p>If you buy a Pinebook Pro now, it comes with Manjaro Linux on the internal eMMC storage. Let’s install NetBSD instead!<br>
The easiest way to get started is to buy a decent micro-SD card (what sort of markings it should have is a science of its own, by the way) and install NetBSD on that. On a warm boot (i.e. when rebooting a running system), the micro-SD card has priority compared to the eMMC, so the system will boot from there.</p>

<ul>
<li>A FreeBSD developer has borrowed some of the NetBSD code to get audio working on RockPro64 and Pinebook Pro: <a href="https://twitter.com/kernelnomicon/status/1282790609778905088" rel="nofollow">https://twitter.com/kernelnomicon/status/1282790609778905088</a>
***</li>
</ul>
</blockquote>

<h3><a href="https://adventurist.me/posts/00300" rel="nofollow">FreeBSD on the Intel 10th Gen i3 NUC</a></h3>

<blockquote>
<p>I have ended up with some 10th Gen i3 NUC&#39;s (NUC10i3FNH to be specific) to put to work in my testbed. These are quite new devices, the build date on the boxes is 13APR2020. Before I figure out what their true role is (one of them might have to run linux) I need to install FreeBSD -CURRENT and see how performance and hardware support is.</p>
</blockquote>

<hr>

<h3><a href="https://www.dragonflydigest.com/2020/06/29/24698.html" rel="nofollow">pf table size check and change</a></h3>

<blockquote>
<p>Did you know there’s a default size limit to pf’s state table?  I did not, but it makes sense that there is one.  If for some reason you bump into this limit (difficult for home use, I’d think), <a href="http://lists.dragonflybsd.org/pipermail/users/2020-June/381261.html" rel="nofollow">here’s how you change it</a><br>
There is a table-entries limit specified, you can see current settings with<br>
&#39;pfctl -s all&#39;.  You can adjust the limits in the /etc/pf.conf file<br>
containing the rules with a line like this near the top:<br>
<code>set limit table-entries 100000</code></p>

<ul>
<li>In the original mail thread, there is mention of the FreeBSD sysctl net.pf.request_maxcount, which controls the maximum number of entries that can be sent as a single ioctl(). This allows the user to adjust the memory limit for how big of a list the kernel is willing to allocate memory for.
***</li>
</ul>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://callfortesting.org/tmux/" rel="nofollow">tmux and bhyve</a></li>
<li><a href="https://azuremarketplace.microsoft.com/en-us/marketplace/apps/thefreebsdfoundation.freebsd-12_1" rel="nofollow">Azure and FreeBSD</a></li>
<li><a href="https://www.youtube.com/watch?v=bvkmnK6-qao&feature=youtu.be" rel="nofollow">Groff Tutorial</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
<a href="https://mwl.io/nonfiction/tools#tarsnap" rel="nofollow">Tarsnap Mastery</a></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/Chris%20-%20zfs%20question.md" rel="nofollow">Chris - ZFS Question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/Patrick%20-%20Tarsnap.md" rel="nofollow">Patrick - Tarsnap</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/pin%20-%20pkgsrc.md" rel="nofollow">Pin - pkgsrc</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Chasing a bad commit, New FreeBSD Core Team elected, Getting Started with NetBSD on the Pinebook Pro, FreeBSD on the Intel 10th Gen i3 NUC, pf table size check and change, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://vishaltelangre.com/chasing-a-bad-commit/" rel="nofollow">Chasing a bad commit</a></h3>

<blockquote>
<p>While working on a big project where multiple teams merge their feature branches frequently into a release Git branch, developers often run into situations where they find that some of their work have been either removed, modified or affected by someone else&#39;s work accidentally. It can happen in smaller teams as well. Two features could have been working perfectly fine until they got merged together and broke something. That&#39;s a highly possible case. There are many other cases which could cause such hard to understand and subtle bugs which even continuous integration (CI) systems running the entire test suite of our projects couldn&#39;t catch.<br>
We are not going to discuss how such subtle bugs can get into our release branch because that&#39;s just a wild territory out there. Instead, we can definitely discuss about how to find a commit that deviated from an expected outcome of a certain feature. The deviation could be any behaviour of our code that we can measure distinctively — either good or bad in general.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsdnews.com/2020/07/14/new-freebsd-core-team-elected/" rel="nofollow">New FreeBSD Core Team Elected</a></h3>

<blockquote>
<p>The FreeBSD Project is pleased to announce the completion of the 2020 Core Team election. Active committers to the project have elected your Eleventh FreeBSD Core Team.!</p>
</blockquote>

<ul>
<li>Baptiste Daroussin (bapt)</li>
<li>Ed Maste (emaste)</li>
<li>George V. Neville-Neil (gnn)</li>
<li>Hiroki Sato (hrs)</li>
<li>Kyle Evans (kevans)</li>
<li>Mark Johnston (markj)</li>
<li>Scott Long (scottl)</li>
<li>Sean Chittenden (seanc)</li>
<li>Warner Losh (imp)
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://bentsukun.ch/posts/pinebook-pro-netbsd/" rel="nofollow">Getting Started with NetBSD on the Pinebook Pro</a></h3>

<blockquote>
<p>If you buy a Pinebook Pro now, it comes with Manjaro Linux on the internal eMMC storage. Let’s install NetBSD instead!<br>
The easiest way to get started is to buy a decent micro-SD card (what sort of markings it should have is a science of its own, by the way) and install NetBSD on that. On a warm boot (i.e. when rebooting a running system), the micro-SD card has priority compared to the eMMC, so the system will boot from there.</p>

<ul>
<li>A FreeBSD developer has borrowed some of the NetBSD code to get audio working on RockPro64 and Pinebook Pro: <a href="https://twitter.com/kernelnomicon/status/1282790609778905088" rel="nofollow">https://twitter.com/kernelnomicon/status/1282790609778905088</a>
***</li>
</ul>
</blockquote>

<h3><a href="https://adventurist.me/posts/00300" rel="nofollow">FreeBSD on the Intel 10th Gen i3 NUC</a></h3>

<blockquote>
<p>I have ended up with some 10th Gen i3 NUC&#39;s (NUC10i3FNH to be specific) to put to work in my testbed. These are quite new devices, the build date on the boxes is 13APR2020. Before I figure out what their true role is (one of them might have to run linux) I need to install FreeBSD -CURRENT and see how performance and hardware support is.</p>
</blockquote>

<hr>

<h3><a href="https://www.dragonflydigest.com/2020/06/29/24698.html" rel="nofollow">pf table size check and change</a></h3>

<blockquote>
<p>Did you know there’s a default size limit to pf’s state table?  I did not, but it makes sense that there is one.  If for some reason you bump into this limit (difficult for home use, I’d think), <a href="http://lists.dragonflybsd.org/pipermail/users/2020-June/381261.html" rel="nofollow">here’s how you change it</a><br>
There is a table-entries limit specified, you can see current settings with<br>
&#39;pfctl -s all&#39;.  You can adjust the limits in the /etc/pf.conf file<br>
containing the rules with a line like this near the top:<br>
<code>set limit table-entries 100000</code></p>

<ul>
<li>In the original mail thread, there is mention of the FreeBSD sysctl net.pf.request_maxcount, which controls the maximum number of entries that can be sent as a single ioctl(). This allows the user to adjust the memory limit for how big of a list the kernel is willing to allocate memory for.
***</li>
</ul>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://callfortesting.org/tmux/" rel="nofollow">tmux and bhyve</a></li>
<li><a href="https://azuremarketplace.microsoft.com/en-us/marketplace/apps/thefreebsdfoundation.freebsd-12_1" rel="nofollow">Azure and FreeBSD</a></li>
<li><a href="https://www.youtube.com/watch?v=bvkmnK6-qao&feature=youtu.be" rel="nofollow">Groff Tutorial</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
<a href="https://mwl.io/nonfiction/tools#tarsnap" rel="nofollow">Tarsnap Mastery</a></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/Chris%20-%20zfs%20question.md" rel="nofollow">Chris - ZFS Question</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/Patrick%20-%20Tarsnap.md" rel="nofollow">Patrick - Tarsnap</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/pin%20-%20pkgsrc.md" rel="nofollow">Pin - pkgsrc</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>359: Throwaway Browser</title>
  <link>https://www.bsdnow.tv/359</link>
  <guid isPermaLink="false">b066740d-03a5-423b-9ab9-8936c3246979</guid>
  <pubDate>Thu, 16 Jul 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b066740d-03a5-423b-9ab9-8936c3246979.mp3" length="44787992" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Throw-Away Browser on FreeBSD With "pot" within 5 minutes, OmniOS as OpenBSD guest with bhyve, BSD vs Linux distro development, My FreeBSD Laptop Build, FreeBSD CURRENT Binary Upgrades, and more.</itunes:subtitle>
  <itunes:duration>43:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Throw-Away Browser on FreeBSD With "pot" within 5 minutes, OmniOS as OpenBSD guest with bhyve, BSD vs Linux distro development, My FreeBSD Laptop Build, FreeBSD CURRENT Binary Upgrades, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
Throw-Away Browser on FreeBSD With "pot" Within 5 Minutes (https://honeyguide.eu/posts/pot-throwaway-firefox/)
pot is a great and relatively new jail management tool. It offers DevOps style provisioning and can even be used to provide Docker-like, scalable cloud services together with nomad and consul (more about this in Orchestrating jails with nomad and pot).
OpenBSD guest with bhyve - OmniOS (https://www.pbdigital.org/omniosce/bhyve/openbsd/2020/06/08/bhyve-zones-omnios.html)
Today I will be creating a OpenBSD guest via bhyve on OmniOS. I will also be adding a Pass Through Ethernet Controller so I can have a multi-homed guest that will serve as a firewall/router.
This post will cover setting up bhyve on OmniOS, so it will also be a good introduction to bhyve. As well, I look into OpenBSD’s uEFI boot loader so if you have had trouble with this, then you are in the right place.
News Roundup
BSD versus Linux distribution development (https://distrowatch.com/weekly.php?issue=20200622#qa)
Q: Comparing-apples-to-BSDs asks: I was reading one of the old articles from the archive. One of the things mentioned was how the BSDs have a distinct approach in terms of packaging the base system relative to userland apps, and that the Linux distros at the time were not following the same practice. Are there Linux distros that have adopted the same approach in modern times? If not, are there technical limitations that are preventing them from doing so, such as some distros supporting multiple kernel versions maybe?
DistroWatch answers: In the article mentioned above, I made the observation that Linux distributions tend to take one of two approaches when it comes to packaging software. Generally a Linux distribution will either offer a rolling release, where virtually all packages are regularly upgraded to their latest stable releases, or a fixed release where almost all packages are kept at a set version number and only receive bug fixes for the life cycle of the distribution. Projects like Arch Linux and Void are popular examples of rolling, always-up-to-date distributions while Fedora and Ubuntu offer fixed platforms.
My FreeBSD Laptop Build (https://corrupted.io/2020/06/21/my-freebsd-laptop-build.html)
I have always liked Thinkpad hardware and when I started to do more commuting I decided I needed something that had a decent sized screen but fit well on a bus. Luckily about this time Lenovo gave me a nice gift in the Thinkpad X390. Its basically the famous X2xx series but with a 13” screen and smaller bezel.
So with this laptop I figured it was time to actually put the docs together on how I got my FreeBSD workstation working on it. I will here in the near future have another post that will cover this for HardenedBSD as well since the steps are similar but have a few extra gotchas due to the extra hardening.
FreeBSD CURRENT Binary Upgrades (http://up.bsd.lv)
Disclaimer
This proof-of-concept is not a publication of FreeBSD.
Description
up.bsd.lv is a proof-of-concept of binary updates for FreeBSD/amd64 CURRENT/HEAD to facilitate the exhaustive testing of FreeBSD and the bhyve hypervisor and OpenZFS 2.0 specifically. Updates are based on the SVN revisions of official FreeBSD Release Engineering bi-monthly snapshots.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Karl - pfsense (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/Karl%20-%20pfsense.md)
Val - esxi question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/Val%20-%20esxi%20question.md)
lars - openbsd router hardware (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/lars%20-%20openbsd%20router%20hardware.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, zfs, interview, browser, throw-away, throw away, pot, omnios, vm, guest, virtualization, bhyve, linux, development, distribution, laptop, binary upgrades</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Throw-Away Browser on FreeBSD With &quot;pot&quot; within 5 minutes, OmniOS as OpenBSD guest with bhyve, BSD vs Linux distro development, My FreeBSD Laptop Build, FreeBSD CURRENT Binary Upgrades, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://honeyguide.eu/posts/pot-throwaway-firefox/" rel="nofollow">Throw-Away Browser on FreeBSD With &quot;pot&quot; Within 5 Minutes</a></h3>

<blockquote>
<p>pot is a great and relatively new jail management tool. It offers DevOps style provisioning and can even be used to provide Docker-like, scalable cloud services together with nomad and consul (more about this in Orchestrating jails with nomad and pot).</p>
</blockquote>

<hr>

<h3><a href="https://www.pbdigital.org/omniosce/bhyve/openbsd/2020/06/08/bhyve-zones-omnios.html" rel="nofollow">OpenBSD guest with bhyve - OmniOS</a></h3>

<blockquote>
<p>Today I will be creating a OpenBSD guest via bhyve on OmniOS. I will also be adding a Pass Through Ethernet Controller so I can have a multi-homed guest that will serve as a firewall/router.<br>
This post will cover setting up bhyve on OmniOS, so it will also be a good introduction to bhyve. As well, I look into OpenBSD’s uEFI boot loader so if you have had trouble with this, then you are in the right place.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20200622#qa" rel="nofollow">BSD versus Linux distribution development</a></h3>

<blockquote>
<p>Q: Comparing-apples-to-BSDs asks: I was reading one of the old articles from the archive. One of the things mentioned was how the BSDs have a distinct approach in terms of packaging the base system relative to userland apps, and that the Linux distros at the time were not following the same practice. Are there Linux distros that have adopted the same approach in modern times? If not, are there technical limitations that are preventing them from doing so, such as some distros supporting multiple kernel versions maybe?<br>
DistroWatch answers: In the article mentioned above, I made the observation that Linux distributions tend to take one of two approaches when it comes to packaging software. Generally a Linux distribution will either offer a rolling release, where virtually all packages are regularly upgraded to their latest stable releases, or a fixed release where almost all packages are kept at a set version number and only receive bug fixes for the life cycle of the distribution. Projects like Arch Linux and Void are popular examples of rolling, always-up-to-date distributions while Fedora and Ubuntu offer fixed platforms.</p>

<hr>

<h3><a href="https://corrupted.io/2020/06/21/my-freebsd-laptop-build.html" rel="nofollow">My FreeBSD Laptop Build</a></h3>

<p>I have always liked Thinkpad hardware and when I started to do more commuting I decided I needed something that had a decent sized screen but fit well on a bus. Luckily about this time Lenovo gave me a nice gift in the Thinkpad X390. Its basically the famous X2xx series but with a 13” screen and smaller bezel.<br>
So with this laptop I figured it was time to actually put the docs together on how I got my FreeBSD workstation working on it. I will here in the near future have another post that will cover this for HardenedBSD as well since the steps are similar but have a few extra gotchas due to the extra hardening.</p>

<hr>

<h3><a href="http://up.bsd.lv" rel="nofollow">FreeBSD CURRENT Binary Upgrades</a></h3>

<ul>
<li>Disclaimer
This proof-of-concept is not a publication of FreeBSD.</li>
<li>Description
up.bsd.lv is a proof-of-concept of binary updates for FreeBSD/amd64 CURRENT/HEAD to facilitate the exhaustive testing of FreeBSD and the bhyve hypervisor and OpenZFS 2.0 specifically. Updates are based on the SVN revisions of official FreeBSD Release Engineering bi-monthly snapshots.</li>
</ul>
</blockquote>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/Karl%20-%20pfsense.md" rel="nofollow">Karl - pfsense</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/Val%20-%20esxi%20question.md" rel="nofollow">Val - esxi question</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/lars%20-%20openbsd%20router%20hardware.md" rel="nofollow">lars - openbsd router hardware</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Throw-Away Browser on FreeBSD With &quot;pot&quot; within 5 minutes, OmniOS as OpenBSD guest with bhyve, BSD vs Linux distro development, My FreeBSD Laptop Build, FreeBSD CURRENT Binary Upgrades, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://honeyguide.eu/posts/pot-throwaway-firefox/" rel="nofollow">Throw-Away Browser on FreeBSD With &quot;pot&quot; Within 5 Minutes</a></h3>

<blockquote>
<p>pot is a great and relatively new jail management tool. It offers DevOps style provisioning and can even be used to provide Docker-like, scalable cloud services together with nomad and consul (more about this in Orchestrating jails with nomad and pot).</p>
</blockquote>

<hr>

<h3><a href="https://www.pbdigital.org/omniosce/bhyve/openbsd/2020/06/08/bhyve-zones-omnios.html" rel="nofollow">OpenBSD guest with bhyve - OmniOS</a></h3>

<blockquote>
<p>Today I will be creating a OpenBSD guest via bhyve on OmniOS. I will also be adding a Pass Through Ethernet Controller so I can have a multi-homed guest that will serve as a firewall/router.<br>
This post will cover setting up bhyve on OmniOS, so it will also be a good introduction to bhyve. As well, I look into OpenBSD’s uEFI boot loader so if you have had trouble with this, then you are in the right place.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20200622#qa" rel="nofollow">BSD versus Linux distribution development</a></h3>

<blockquote>
<p>Q: Comparing-apples-to-BSDs asks: I was reading one of the old articles from the archive. One of the things mentioned was how the BSDs have a distinct approach in terms of packaging the base system relative to userland apps, and that the Linux distros at the time were not following the same practice. Are there Linux distros that have adopted the same approach in modern times? If not, are there technical limitations that are preventing them from doing so, such as some distros supporting multiple kernel versions maybe?<br>
DistroWatch answers: In the article mentioned above, I made the observation that Linux distributions tend to take one of two approaches when it comes to packaging software. Generally a Linux distribution will either offer a rolling release, where virtually all packages are regularly upgraded to their latest stable releases, or a fixed release where almost all packages are kept at a set version number and only receive bug fixes for the life cycle of the distribution. Projects like Arch Linux and Void are popular examples of rolling, always-up-to-date distributions while Fedora and Ubuntu offer fixed platforms.</p>

<hr>

<h3><a href="https://corrupted.io/2020/06/21/my-freebsd-laptop-build.html" rel="nofollow">My FreeBSD Laptop Build</a></h3>

<p>I have always liked Thinkpad hardware and when I started to do more commuting I decided I needed something that had a decent sized screen but fit well on a bus. Luckily about this time Lenovo gave me a nice gift in the Thinkpad X390. Its basically the famous X2xx series but with a 13” screen and smaller bezel.<br>
So with this laptop I figured it was time to actually put the docs together on how I got my FreeBSD workstation working on it. I will here in the near future have another post that will cover this for HardenedBSD as well since the steps are similar but have a few extra gotchas due to the extra hardening.</p>

<hr>

<h3><a href="http://up.bsd.lv" rel="nofollow">FreeBSD CURRENT Binary Upgrades</a></h3>

<ul>
<li>Disclaimer
This proof-of-concept is not a publication of FreeBSD.</li>
<li>Description
up.bsd.lv is a proof-of-concept of binary updates for FreeBSD/amd64 CURRENT/HEAD to facilitate the exhaustive testing of FreeBSD and the bhyve hypervisor and OpenZFS 2.0 specifically. Updates are based on the SVN revisions of official FreeBSD Release Engineering bi-monthly snapshots.</li>
</ul>
</blockquote>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/Karl%20-%20pfsense.md" rel="nofollow">Karl - pfsense</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/Val%20-%20esxi%20question.md" rel="nofollow">Val - esxi question</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/lars%20-%20openbsd%20router%20hardware.md" rel="nofollow">lars - openbsd router hardware</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>358: OpenBSD Kubernetes Clusters</title>
  <link>https://www.bsdnow.tv/358</link>
  <guid isPermaLink="false">dd2d31ad-23bc-492d-b813-caf9f661e315</guid>
  <pubDate>Thu, 09 Jul 2020 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/dd2d31ad-23bc-492d-b813-caf9f661e315.mp3" length="43199240" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Yubikey-agent on FreeBSD, Managing Kubernetes clusters from OpenBSD, History of FreeBSD part 1, Running Jitsi-Meet in a FreeBSD Jail, Command Line Bug Hunting in FreeBSD, Game of Github, Wireguard official merged into OpenBSD, and more</itunes:subtitle>
  <itunes:duration>43:32</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Yubikey-agent on FreeBSD, Managing Kubernetes clusters from OpenBSD, History of FreeBSD part 1, Running Jitsi-Meet in a FreeBSD Jail, Command Line Bug Hunting in FreeBSD, Game of Github, Wireguard official merged into OpenBSD, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
yubikey-agent on FreeBSD (https://kernelnomicon.org/?p=855)
Some time ago Filippo Valsorda wrote yubikey-agent, seamless SSH agent for YubiKeys. I really like YubiKeys and worked on the FreeBSD support for U2F in Chromium and pyu2f, getting yubikey-agent ported looked like an interesting project. It took some hacking to make it work but overall it wasn’t hard. Following is the roadmap on how to get it set up on FreeBSD. The actual details depend on your system (as you will see)
Manage Kubernetes clusters from OpenBSD (https://e1e0.net/manage-k8s-from-openbsd.html)
This should work with OpenBSD 6.7. I write this while the source tree is locked for release, so even if I use -current this is as close as -current gets to -release
Update 2020-06-05: we now have a port for kubectl. So, at least in -current things get a bit easier.
News Roundup
History of FreeBSD Part 1: Unix and BSD (https://klarasystems.com/articles/history-of-freebsd-unix-and-bsd/?utm_source=bsdnow)
FreeBSD, a free and open-source Unix-like operating system has been around since 1993. However, its origins are directly linked to that of BSD, and further back, those of Unix. During this History of FreeBSD series, we will talk about how Unix came to be, and how Berkeley’s Unix developed at Bell Labs.
Running Jitsi-Meet in a FreeBSD Jail (https://honeyguide.eu/posts/jitsi-freebsd/)
Due to the situation with COVID-19 that also lead to people being confined to their homes in South Africa as well, we decided to provide a (freely usable of course) Jitsi Meet instance to the community being hosted in South Africa on our FreeBSD environment.
That way, communities in South Africa and beyond have a free alternative to the commercial conferencing solutions with sometimes dubious security and privacy histories and at the same time improved user experience due to the lower latency of local hosting.
+ Grafana for Jitsi-Meet (https://honeyguide.eu/posts/jitsi-grafana/)
Command Line Bug Hunting in FreeBSD (https://adventurist.me/posts/00301)
FreeBSD uses bugzilla for tracking bugs, taking feature requests, regressions and issues in the Operating System. The web interface for bugzilla is okay, but if you want to do a lot of batch operations it is slow to deal with. We are planning to run a bugsquash on July 11th and that really needs some tooling to help any hackers that show up process the giant bug list we have.
Beastie Bits
Game of Github (https://glebbahmutov.com/game-of-github/)
+ Wireguard official merged into OpenBSD (https://marc.info/?l=openbsd-cvs&amp;amp;m=159274150512676&amp;amp;w=2)
***
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Florian : Lua for $HOME (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Florian%20-%20Lua%20for%20%24HOME)
Kevin : FreeBSD Source Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Kevin%20-%20FreeBSD%20Source%20Question)
Tom : HomeLabs (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Tom%20-%20HomeLabs)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, zfs, interview, yubikey, yubikey-agent, yubikey agent, agent, kubernetes, cluster, kubernetes cluster, history, jitsi, jitsi-meet, conference, video conferencing, conferencing, conferencing software, command line, bug, bug hunting, git, github, wireguard, merge</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Yubikey-agent on FreeBSD, Managing Kubernetes clusters from OpenBSD, History of FreeBSD part 1, Running Jitsi-Meet in a FreeBSD Jail, Command Line Bug Hunting in FreeBSD, Game of Github, Wireguard official merged into OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://kernelnomicon.org/?p=855" rel="nofollow">yubikey-agent on FreeBSD</a></h3>

<blockquote>
<p>Some time ago Filippo Valsorda wrote yubikey-agent, seamless SSH agent for YubiKeys. I really like YubiKeys and worked on the FreeBSD support for U2F in Chromium and pyu2f, getting yubikey-agent ported looked like an interesting project. It took some hacking to make it work but overall it wasn’t hard. Following is the roadmap on how to get it set up on FreeBSD. The actual details depend on your system (as you will see)</p>

<hr>
</blockquote>

<h3><a href="https://e1e0.net/manage-k8s-from-openbsd.html" rel="nofollow">Manage Kubernetes clusters from OpenBSD</a></h3>

<blockquote>
<p>This should work with OpenBSD 6.7. I write this while the source tree is locked for release, so even if I use -current this is as close as -current gets to -release<br>
Update 2020-06-05: we now have a port for kubectl. So, at least in -current things get a bit easier.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://klarasystems.com/articles/history-of-freebsd-unix-and-bsd/?utm_source=bsdnow" rel="nofollow">History of FreeBSD Part 1: Unix and BSD</a></h3>

<blockquote>
<p>FreeBSD, a free and open-source Unix-like operating system has been around since 1993. However, its origins are directly linked to that of BSD, and further back, those of Unix. During this History of FreeBSD series, we will talk about how Unix came to be, and how Berkeley’s Unix developed at Bell Labs.</p>

<hr>
</blockquote>

<h3><a href="https://honeyguide.eu/posts/jitsi-freebsd/" rel="nofollow">Running Jitsi-Meet in a FreeBSD Jail</a></h3>

<blockquote>
<p>Due to the situation with COVID-19 that also lead to people being confined to their homes in South Africa as well, we decided to provide a (freely usable of course) Jitsi Meet instance to the community being hosted in South Africa on our FreeBSD environment.<br>
That way, communities in South Africa and beyond have a free alternative to the commercial conferencing solutions with sometimes dubious security and privacy histories and at the same time improved user experience due to the lower latency of local hosting.</p>

<ul>
<li><a href="https://honeyguide.eu/posts/jitsi-grafana/" rel="nofollow">Grafana for Jitsi-Meet</a>
***</li>
</ul>
</blockquote>

<h3><a href="https://adventurist.me/posts/00301" rel="nofollow">Command Line Bug Hunting in FreeBSD</a></h3>

<blockquote>
<p>FreeBSD uses bugzilla for tracking bugs, taking feature requests, regressions and issues in the Operating System. The web interface for bugzilla is okay, but if you want to do a lot of batch operations it is slow to deal with. We are planning to run a bugsquash on July 11th and that really needs some tooling to help any hackers that show up process the giant bug list we have.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://glebbahmutov.com/game-of-github/" rel="nofollow">Game of Github</a></li>
<li>+ <a href="https://marc.info/?l=openbsd-cvs&m=159274150512676&w=2" rel="nofollow">Wireguard official merged into OpenBSD</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Florian%20-%20Lua%20for%20%24HOME" rel="nofollow">Florian : Lua for $HOME</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Kevin%20-%20FreeBSD%20Source%20Question" rel="nofollow">Kevin : FreeBSD Source Question</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Tom%20-%20HomeLabs" rel="nofollow">Tom : HomeLabs</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Yubikey-agent on FreeBSD, Managing Kubernetes clusters from OpenBSD, History of FreeBSD part 1, Running Jitsi-Meet in a FreeBSD Jail, Command Line Bug Hunting in FreeBSD, Game of Github, Wireguard official merged into OpenBSD, and more</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://kernelnomicon.org/?p=855" rel="nofollow">yubikey-agent on FreeBSD</a></h3>

<blockquote>
<p>Some time ago Filippo Valsorda wrote yubikey-agent, seamless SSH agent for YubiKeys. I really like YubiKeys and worked on the FreeBSD support for U2F in Chromium and pyu2f, getting yubikey-agent ported looked like an interesting project. It took some hacking to make it work but overall it wasn’t hard. Following is the roadmap on how to get it set up on FreeBSD. The actual details depend on your system (as you will see)</p>

<hr>
</blockquote>

<h3><a href="https://e1e0.net/manage-k8s-from-openbsd.html" rel="nofollow">Manage Kubernetes clusters from OpenBSD</a></h3>

<blockquote>
<p>This should work with OpenBSD 6.7. I write this while the source tree is locked for release, so even if I use -current this is as close as -current gets to -release<br>
Update 2020-06-05: we now have a port for kubectl. So, at least in -current things get a bit easier.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://klarasystems.com/articles/history-of-freebsd-unix-and-bsd/?utm_source=bsdnow" rel="nofollow">History of FreeBSD Part 1: Unix and BSD</a></h3>

<blockquote>
<p>FreeBSD, a free and open-source Unix-like operating system has been around since 1993. However, its origins are directly linked to that of BSD, and further back, those of Unix. During this History of FreeBSD series, we will talk about how Unix came to be, and how Berkeley’s Unix developed at Bell Labs.</p>

<hr>
</blockquote>

<h3><a href="https://honeyguide.eu/posts/jitsi-freebsd/" rel="nofollow">Running Jitsi-Meet in a FreeBSD Jail</a></h3>

<blockquote>
<p>Due to the situation with COVID-19 that also lead to people being confined to their homes in South Africa as well, we decided to provide a (freely usable of course) Jitsi Meet instance to the community being hosted in South Africa on our FreeBSD environment.<br>
That way, communities in South Africa and beyond have a free alternative to the commercial conferencing solutions with sometimes dubious security and privacy histories and at the same time improved user experience due to the lower latency of local hosting.</p>

<ul>
<li><a href="https://honeyguide.eu/posts/jitsi-grafana/" rel="nofollow">Grafana for Jitsi-Meet</a>
***</li>
</ul>
</blockquote>

<h3><a href="https://adventurist.me/posts/00301" rel="nofollow">Command Line Bug Hunting in FreeBSD</a></h3>

<blockquote>
<p>FreeBSD uses bugzilla for tracking bugs, taking feature requests, regressions and issues in the Operating System. The web interface for bugzilla is okay, but if you want to do a lot of batch operations it is slow to deal with. We are planning to run a bugsquash on July 11th and that really needs some tooling to help any hackers that show up process the giant bug list we have.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://glebbahmutov.com/game-of-github/" rel="nofollow">Game of Github</a></li>
<li>+ <a href="https://marc.info/?l=openbsd-cvs&m=159274150512676&w=2" rel="nofollow">Wireguard official merged into OpenBSD</a>
***</li>
</ul>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Florian%20-%20Lua%20for%20%24HOME" rel="nofollow">Florian : Lua for $HOME</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Kevin%20-%20FreeBSD%20Source%20Question" rel="nofollow">Kevin : FreeBSD Source Question</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Tom%20-%20HomeLabs" rel="nofollow">Tom : HomeLabs</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>357: Study the Code</title>
  <link>https://www.bsdnow.tv/357</link>
  <guid isPermaLink="false">3155c049-a0b4-4449-9ecb-1f820e68f542</guid>
  <pubDate>Thu, 02 Jul 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3155c049-a0b4-4449-9ecb-1f820e68f542.mp3" length="36249920" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 6.7 on PC Engines, NetBSD code study, DRM Update on OpenBSD, Booting FreeBSD on HPE Microserver SATA port, 3 ways to multiboot, and more.</itunes:subtitle>
  <itunes:duration>37:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 6.7 on PC Engines, NetBSD code study, DRM Update on OpenBSD, Booting FreeBSD on HPE Microserver SATA port, 3 ways to multiboot, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
OpenBSD 6.7 on PC Engines APU4D4 (https://www.tumfatig.net/20200530/openbsd-6-7-on-pc-engines-apu4d4/)
I just got myself a PC Engines APU4D4. I miss an OpenBSD box providing home services. It’s quite simple to install and run OpenBSD on this machine. And you can even update the BIOS from OpenBSD.
NetBSD code study (http://silas.net.br/codereading/netbsd-code.html)
News Roundup
Booting FreeBSD off the HPE MicroServer Gen8 ODD SATA port (https://rubenerd.com/booting-freebsd-off-the-microserver-odd-sata-port/)
My small homelab post generated a ton of questions and comments, most of them specific to running FreeBSD on the HP MicroServer. I’ll try and answer these over the coming week.
Josh Paxton emailed to ask how I got FreeBSD booting on it, given the unconventional booting limitations of the hardware. I thought I wrote about it a few years ago, but maybe it’s on my proverbial draft heap. If you’re impatient, the script is in my lunchbox.
3 ways to multiboot (https://marc.info/?l=openbsd-misc&amp;amp;m=159146428705118&amp;amp;w=2)
multiboot installation of a BSD system with other operating systems
(OSs) on UEFI hardware is not officially supported by any of the
popular
Beastie Bits
pfSense2.4.5-Release-p1 now available (https://www.netgate.com/blog/pfsense-2-4-5-release-p1-now-available.html)
BSDCan 2020 TomSmyth - OpenBSD And OpenBGPD As ISP Controlplane (https://www.youtube.com/watch?v=_eOVlaYWqS8)
OpenBSD DRM Update (https://undeadly.org/cgi?action=article;sid=20200608075708)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
 James - Apple T2 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/James%20-%20Apple%20T2)
Michael - Jordyns ZFS Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Michael%20-%20Jordyns%20ZFS%20Question)
Note from JT (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Note%20from%20JT)
Rob - FreeBSD Freindly Registrar (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Rob%20-%20FreeBSD%20Freindly%20Registrar)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, operating system, os, zfs, interview, pc engines, APU4D4, code study, code, study, drm, update, updates, booting, boot, HPE, MicroServer, SATA, SATA port</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 6.7 on PC Engines, NetBSD code study, DRM Update on OpenBSD, Booting FreeBSD on HPE Microserver SATA port, 3 ways to multiboot, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.tumfatig.net/20200530/openbsd-6-7-on-pc-engines-apu4d4/" rel="nofollow">OpenBSD 6.7 on PC Engines APU4D4</a></h3>

<blockquote>
<p>I just got myself a PC Engines APU4D4. I miss an OpenBSD box providing home services. It’s quite simple to install and run OpenBSD on this machine. And you can even update the BIOS from OpenBSD.</p>

<hr>

<h3><a href="http://silas.net.br/codereading/netbsd-code.html" rel="nofollow">NetBSD code study</a></h3>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://rubenerd.com/booting-freebsd-off-the-microserver-odd-sata-port/" rel="nofollow">Booting FreeBSD off the HPE MicroServer Gen8 ODD SATA port</a></h3>

<blockquote>
<p>My small homelab post generated a ton of questions and comments, most of them specific to running FreeBSD on the HP MicroServer. I’ll try and answer these over the coming week.<br>
Josh Paxton emailed to ask how I got FreeBSD booting on it, given the unconventional booting limitations of the hardware. I thought I wrote about it a few years ago, but maybe it’s on my proverbial draft heap. If you’re impatient, the script is in my lunchbox.</p>

<hr>
</blockquote>

<h3><a href="https://marc.info/?l=openbsd-misc&m=159146428705118&w=2" rel="nofollow">3 ways to multiboot</a></h3>

<blockquote>
<p>multiboot installation of a BSD system with other operating systems<br>
(OSs) on UEFI hardware is not officially supported by any of the<br>
popular</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.netgate.com/blog/pfsense-2-4-5-release-p1-now-available.html" rel="nofollow">pfSense2.4.5-Release-p1 now available</a></li>
<li><a href="https://www.youtube.com/watch?v=_eOVlaYWqS8" rel="nofollow">BSDCan 2020 TomSmyth - OpenBSD And OpenBGPD As ISP Controlplane</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20200608075708" rel="nofollow">OpenBSD DRM Update</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/James%20-%20Apple%20T2" rel="nofollow"> James - Apple T2</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Michael%20-%20Jordyns%20ZFS%20Question" rel="nofollow">Michael - Jordyns ZFS Question</a></p>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Note%20from%20JT" rel="nofollow">Note from JT</a></li>
</ul></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Rob%20-%20FreeBSD%20Freindly%20Registrar" rel="nofollow">Rob - FreeBSD Freindly Registrar</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 6.7 on PC Engines, NetBSD code study, DRM Update on OpenBSD, Booting FreeBSD on HPE Microserver SATA port, 3 ways to multiboot, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.tumfatig.net/20200530/openbsd-6-7-on-pc-engines-apu4d4/" rel="nofollow">OpenBSD 6.7 on PC Engines APU4D4</a></h3>

<blockquote>
<p>I just got myself a PC Engines APU4D4. I miss an OpenBSD box providing home services. It’s quite simple to install and run OpenBSD on this machine. And you can even update the BIOS from OpenBSD.</p>

<hr>

<h3><a href="http://silas.net.br/codereading/netbsd-code.html" rel="nofollow">NetBSD code study</a></h3>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://rubenerd.com/booting-freebsd-off-the-microserver-odd-sata-port/" rel="nofollow">Booting FreeBSD off the HPE MicroServer Gen8 ODD SATA port</a></h3>

<blockquote>
<p>My small homelab post generated a ton of questions and comments, most of them specific to running FreeBSD on the HP MicroServer. I’ll try and answer these over the coming week.<br>
Josh Paxton emailed to ask how I got FreeBSD booting on it, given the unconventional booting limitations of the hardware. I thought I wrote about it a few years ago, but maybe it’s on my proverbial draft heap. If you’re impatient, the script is in my lunchbox.</p>

<hr>
</blockquote>

<h3><a href="https://marc.info/?l=openbsd-misc&m=159146428705118&w=2" rel="nofollow">3 ways to multiboot</a></h3>

<blockquote>
<p>multiboot installation of a BSD system with other operating systems<br>
(OSs) on UEFI hardware is not officially supported by any of the<br>
popular</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.netgate.com/blog/pfsense-2-4-5-release-p1-now-available.html" rel="nofollow">pfSense2.4.5-Release-p1 now available</a></li>
<li><a href="https://www.youtube.com/watch?v=_eOVlaYWqS8" rel="nofollow">BSDCan 2020 TomSmyth - OpenBSD And OpenBGPD As ISP Controlplane</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20200608075708" rel="nofollow">OpenBSD DRM Update</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/James%20-%20Apple%20T2" rel="nofollow"> James - Apple T2</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Michael%20-%20Jordyns%20ZFS%20Question" rel="nofollow">Michael - Jordyns ZFS Question</a></p>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Note%20from%20JT" rel="nofollow">Note from JT</a></li>
</ul></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Rob%20-%20FreeBSD%20Freindly%20Registrar" rel="nofollow">Rob - FreeBSD Freindly Registrar</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>356: Dig in Deeper</title>
  <link>https://www.bsdnow.tv/356</link>
  <guid isPermaLink="false">666c3655-32bf-4341-a986-ab085baa9c10</guid>
  <pubDate>Thu, 25 Jun 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/666c3655-32bf-4341-a986-ab085baa9c10.mp3" length="31946816" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>TrueNAS is Multi-OS, Encrypted ZFS on NetBSD, FreeBSD’s new Code of Conduct, Gaming on OpenBSD, dig a little deeper, Hammer2 and periodic snapshots, and more.</itunes:subtitle>
  <itunes:duration>32:08</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>TrueNAS is Multi-OS, Encrypted ZFS on NetBSD, FreeBSD’s new Code of Conduct, Gaming on OpenBSD, dig a little deeper, Hammer2 and periodic snapshots, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
TrueNAS is Multi-OS (https://www.ixsystems.com/blog/truenas-multi-os/)
There was a time in history where all that mattered was an Operating System (OS) and the hardware it ran on — the “pre-software era”, if you will. Your hardware dictated the OS you used.
Once software applications became prominent, your hardware’s OS determined the applications you could run. Application vendors were forced to juggle the burden of “portability” between OS platforms, choosing carefully the operating systems they’d develop their software to. Then, there were the great OS Wars of the 1990s, replete with the rampant competition, licensing battles, and nasty lawsuits, which more or less gave birth to the “open source OS” era.
The advent of the hypervisor simultaneously gave way to the “virtual era” which set us on a path of agnosticism toward the OS. Instead of choosing from the applications available for your chosen OS, you could simply install another OS on the same hardware for your chosen application. The OS became nothing but a necessary cog in the stack.
TrueNAS open storage enables this “post-OS era” with support for storage clients of all UNIX flavors, Linux, FreeBSD, Windows, MacOS, VMware, Citrix, and many others. Containerization has carried that mentality even further. An operating system, like the hardware that runs it, is now just thought of as part of the “infrastructure”.
Encrypted ZFS on NetBSD 9.0, for a FreeBSD guy (https://rubenerd.com/encrypted-zfs-on-netbsd-9-for-a-freebsd-guy/)
I had one of my other HP Microservers brought back from the office last week to help with this working-from-home world we’re in right now. I was going to wipe an old version of Debian Wheezy/Xen and install FreeBSD to mirror my other machines before thinking: why not NetBSD?
News Roundup
FreeBSD's New Code of Conduct (https://www.freebsd.org/internal/code-of-conduct.html)
FreeBSD Announcement Email (https://raw.githubusercontent.com/BSDNow/bsdnow.tv/master/episodes/356/FBSD-CoC-Email)
Gaming on OpenBSD (https://dataswamp.org/~solene/2020-06-05-openbsd-gaming.html)
While no one would expect this, there are huge efforts from a small team to bring more games into OpenBSD. In fact, now some commercial games works natively now, thanks to Mono or Java. There are no wine or linux emulation layer in OpenBSD.
Here is a small list of most well known games that run on OpenBSD:
'dig' a little deeper (https://vishaltelangre.com/dig-a-little-deeper/)
I knew the existence of the dig command but didn't exactly know when and how to use it. Then, just recently I encountered an issue that allowed me to learn and make use of it.
HAMMER2 and periodic snapshots (https://www.dragonflydigest.com/2020/06/15/24635.html)
The first version of HAMMER took automatic snapshots, set within the config for each filesystem.  HAMMER2 now also takes automatic snapshots, via periodic(8) like most every repeating task on your DragonFly system.
+ git: Implement periodic hammer2 snapshots (http://lists.dragonflybsd.org/pipermail/commits/2020-June/769247.html)
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Cy - OpenSSL relicensing (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Cy%20-%20OPenSSL%20relicensing.md)
Christian - lagg vlans and iocage (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Christian%20-%20lagg%20vlans%20and%20iocage)
Brad - SMR (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Brad%20-%20SMR)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, truenas, multi os, os, operating system, code of conduct, code, conduct, encryption, encrypted, zfs, gaming, dig, hammer2, snapshot, snapshots, periodic, periodic snapshots</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>TrueNAS is Multi-OS, Encrypted ZFS on NetBSD, FreeBSD’s new Code of Conduct, Gaming on OpenBSD, dig a little deeper, Hammer2 and periodic snapshots, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.ixsystems.com/blog/truenas-multi-os/" rel="nofollow">TrueNAS is Multi-OS</a></h3>

<blockquote>
<p>There was a time in history where all that mattered was an Operating System (OS) and the hardware it ran on — the “pre-software era”, if you will. Your hardware dictated the OS you used.<br>
Once software applications became prominent, your hardware’s OS determined the applications you could run. Application vendors were forced to juggle the burden of “portability” between OS platforms, choosing carefully the operating systems they’d develop their software to. Then, there were the great OS Wars of the 1990s, replete with the rampant competition, licensing battles, and nasty lawsuits, which more or less gave birth to the “open source OS” era.<br>
The advent of the hypervisor simultaneously gave way to the “virtual era” which set us on a path of agnosticism toward the OS. Instead of choosing from the applications available for your chosen OS, you could simply install another OS on the same hardware for your chosen application. The OS became nothing but a necessary cog in the stack.<br>
TrueNAS open storage enables this “post-OS era” with support for storage clients of all UNIX flavors, Linux, FreeBSD, Windows, MacOS, VMware, Citrix, and many others. Containerization has carried that mentality even further. An operating system, like the hardware that runs it, is now just thought of as part of the “infrastructure”.</p>

<hr>

<h3><a href="https://rubenerd.com/encrypted-zfs-on-netbsd-9-for-a-freebsd-guy/" rel="nofollow">Encrypted ZFS on NetBSD 9.0, for a FreeBSD guy</a></h3>

<p>I had one of my other HP Microservers brought back from the office last week to help with this working-from-home world we’re in right now. I was going to wipe an old version of Debian Wheezy/Xen and install FreeBSD to mirror my other machines before thinking: why not NetBSD?</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://www.freebsd.org/internal/code-of-conduct.html" rel="nofollow">FreeBSD&#39;s New Code of Conduct</a></h3>

<ul>
<li><a href="https://raw.githubusercontent.com/BSDNow/bsdnow.tv/master/episodes/356/FBSD-CoC-Email" rel="nofollow">FreeBSD Announcement Email</a></li>
</ul>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2020-06-05-openbsd-gaming.html" rel="nofollow">Gaming on OpenBSD</a></h3>

<blockquote>
<p>While no one would expect this, there are huge efforts from a small team to bring more games into OpenBSD. In fact, now some commercial games works natively now, thanks to Mono or Java. There are no wine or linux emulation layer in OpenBSD.<br>
Here is a small list of most well known games that run on OpenBSD:</p>

<hr>

<h3><a href="https://vishaltelangre.com/dig-a-little-deeper/" rel="nofollow">&#39;dig&#39; a little deeper</a></h3>

<p>I knew the existence of the dig command but didn&#39;t exactly know when and how to use it. Then, just recently I encountered an issue that allowed me to learn and make use of it.</p>

<hr>

<h3><a href="https://www.dragonflydigest.com/2020/06/15/24635.html" rel="nofollow">HAMMER2 and periodic snapshots</a></h3>

<p>The first version of HAMMER took automatic snapshots, set within the config for each filesystem.  HAMMER2 now also takes automatic snapshots, via periodic(8) like most every repeating task on your DragonFly system.</p>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-June/769247.html" rel="nofollow">git: Implement periodic hammer2 snapshots</a>
***</li>
</ul>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Cy%20-%20OPenSSL%20relicensing.md" rel="nofollow">Cy - OpenSSL relicensing</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Christian%20-%20lagg%20vlans%20and%20iocage" rel="nofollow">Christian - lagg vlans and iocage</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Brad%20-%20SMR" rel="nofollow">Brad - SMR</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>TrueNAS is Multi-OS, Encrypted ZFS on NetBSD, FreeBSD’s new Code of Conduct, Gaming on OpenBSD, dig a little deeper, Hammer2 and periodic snapshots, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://www.ixsystems.com/blog/truenas-multi-os/" rel="nofollow">TrueNAS is Multi-OS</a></h3>

<blockquote>
<p>There was a time in history where all that mattered was an Operating System (OS) and the hardware it ran on — the “pre-software era”, if you will. Your hardware dictated the OS you used.<br>
Once software applications became prominent, your hardware’s OS determined the applications you could run. Application vendors were forced to juggle the burden of “portability” between OS platforms, choosing carefully the operating systems they’d develop their software to. Then, there were the great OS Wars of the 1990s, replete with the rampant competition, licensing battles, and nasty lawsuits, which more or less gave birth to the “open source OS” era.<br>
The advent of the hypervisor simultaneously gave way to the “virtual era” which set us on a path of agnosticism toward the OS. Instead of choosing from the applications available for your chosen OS, you could simply install another OS on the same hardware for your chosen application. The OS became nothing but a necessary cog in the stack.<br>
TrueNAS open storage enables this “post-OS era” with support for storage clients of all UNIX flavors, Linux, FreeBSD, Windows, MacOS, VMware, Citrix, and many others. Containerization has carried that mentality even further. An operating system, like the hardware that runs it, is now just thought of as part of the “infrastructure”.</p>

<hr>

<h3><a href="https://rubenerd.com/encrypted-zfs-on-netbsd-9-for-a-freebsd-guy/" rel="nofollow">Encrypted ZFS on NetBSD 9.0, for a FreeBSD guy</a></h3>

<p>I had one of my other HP Microservers brought back from the office last week to help with this working-from-home world we’re in right now. I was going to wipe an old version of Debian Wheezy/Xen and install FreeBSD to mirror my other machines before thinking: why not NetBSD?</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://www.freebsd.org/internal/code-of-conduct.html" rel="nofollow">FreeBSD&#39;s New Code of Conduct</a></h3>

<ul>
<li><a href="https://raw.githubusercontent.com/BSDNow/bsdnow.tv/master/episodes/356/FBSD-CoC-Email" rel="nofollow">FreeBSD Announcement Email</a></li>
</ul>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2020-06-05-openbsd-gaming.html" rel="nofollow">Gaming on OpenBSD</a></h3>

<blockquote>
<p>While no one would expect this, there are huge efforts from a small team to bring more games into OpenBSD. In fact, now some commercial games works natively now, thanks to Mono or Java. There are no wine or linux emulation layer in OpenBSD.<br>
Here is a small list of most well known games that run on OpenBSD:</p>

<hr>

<h3><a href="https://vishaltelangre.com/dig-a-little-deeper/" rel="nofollow">&#39;dig&#39; a little deeper</a></h3>

<p>I knew the existence of the dig command but didn&#39;t exactly know when and how to use it. Then, just recently I encountered an issue that allowed me to learn and make use of it.</p>

<hr>

<h3><a href="https://www.dragonflydigest.com/2020/06/15/24635.html" rel="nofollow">HAMMER2 and periodic snapshots</a></h3>

<p>The first version of HAMMER took automatic snapshots, set within the config for each filesystem.  HAMMER2 now also takes automatic snapshots, via periodic(8) like most every repeating task on your DragonFly system.</p>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-June/769247.html" rel="nofollow">git: Implement periodic hammer2 snapshots</a>
***</li>
</ul>
</blockquote>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Cy%20-%20OPenSSL%20relicensing.md" rel="nofollow">Cy - OpenSSL relicensing</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Christian%20-%20lagg%20vlans%20and%20iocage" rel="nofollow">Christian - lagg vlans and iocage</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Brad%20-%20SMR" rel="nofollow">Brad - SMR</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>355: Man Page Origins</title>
  <link>https://www.bsdnow.tv/355</link>
  <guid isPermaLink="false">369decb7-b522-4745-b385-2339d05211d9</guid>
  <pubDate>Thu, 18 Jun 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/369decb7-b522-4745-b385-2339d05211d9.mp3" length="40900704" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Upgrading OpenBSD, Where do Unix man pages come from?, Help for NetBSD’s VAX port, FreeBSD on Dell Latitude 7390, PFS Tool changes in DragonflyBSD, and more.</itunes:subtitle>
  <itunes:duration>40:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Upgrading OpenBSD, Where do Unix man pages come from?, Help for NetBSD’s VAX port, FreeBSD on Dell Latitude 7390, PFS Tool changes in DragonflyBSD, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
How to Upgrade OpenBSD and Build a Kernel (https://cromwell-intl.com/open-source/openbsd-kernel.html)
Let's see how to upgrade your OpenBSD system. Maybe you are doing this because the latest release just came out. If so, this is pretty simple: back up your data, boot from install media, and select "Upgrade" instead of "Install". But maybe the latest release has been out for a few months. Why would we go through the trouble of building and installing a new kernel or other core system components? Maybe some patches have been released to improve system security or stability. It is pretty easy to build and install a kernel on OpenBSD, easier and simpler in many ways than it is on Linux.
The History of man pages (https://manpages.bsd.lv/history.html)
Where do UNIX manpages come from? Who introduced the section-based layout of NAME, SYNOPSIS, and so on? And for manpage authors: where were those economical two- and three-letter instructions developed?
VAX port needs help (http://blog.netbsd.org/tnf/entry/vax_port_needs_help)
The VAX is the oldest machine architecture still supported by NetBSD.
Unfortunately there is another challenge, totally outside of NetBSD, but affecting the VAX port big time: the compiler support for VAX is ... let's say sub-optimal. It is also risking to be dropped completely by gcc upstream.
Now here is where people can help: there is a bounty campaign to finance a gcc hacker to fix the hardest and most immediate issue with gcc for VAX. Without this being resolved, gcc will drop support for VAX in a near future version.
My new FreeBSD Laptop: Dell Latitude 7390 (http://www.daemonology.net/blog/2020-05-22-my-new-FreeBSD-laptop-Dell-7390.html)
As a FreeBSD developer, I make a point of using FreeBSD whenever I can — including on the desktop. I've been running FreeBSD on laptops since 2004; this hasn't always been easy, but over the years I've found that the situation has generally been improving. One of the things we still lack is adequate documentation, however — so I'm writing this to provide an example for users and also Google bait in case anyone runs into some of the problems I had to address.
PFS tool changes in DragonFly (https://www.dragonflydigest.com/2020/06/09/24612.html)
HAMMER2 just became a little more DWIM: the pfs-list and pfs-delete directives will now look across all mounted filesystems, not just the current directory’s mount path.  pfs-delete won’t delete any filesystem name that appears in more than one place, though
+ git: hammer2 - Enhance pfs-list and pfs-delete (http://lists.dragonflybsd.org/pipermail/commits/2020-June/769226.html)
Enhance pfs-list to list PFSs available across all mounted hammer2 filesystems instead of just the current directory's mount.  A specific mount may be specified via -s mountpt.
Enhance pfs-delete to look for the PFS name across all mounted hammer2 filesystems instead of just the current directory's mount.
As a safety, pfs-delete will refuse to delete PFS names which are duplicated across multiple mounts.  A specific mount may be specified via -s mountpt.
Beastie Bits
BastilleBSD Templates (https://gitlab.com/bastillebsd-templates)
Tianocore update (https://www.dragonflydigest.com/2020/06/08/24610.html)
Reminder: FreeBSD Office Hours on June 24, 2020 (https://wiki.freebsd.org/OfficeHours)
***
###Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Niclas - Regarding the Lenovo E595 user from Episode 340 (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Niclas%20-%20Regarding%20the%20Lenovo%20E595%20user%20from%20Episode%20340.md)
Erik - What happened with the video (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Erik%20-%20What%20happened%20with%20the%20video.md)
Igor - Boot Environments (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Igor%20-%20Boot%20Environments.md)
***
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, upgrade, upgrading, manual, manual pages, man pages, manpages, VAX, dell, dell latitude, latitude 7390, dell latitude 7390, pfs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Upgrading OpenBSD, Where do Unix man pages come from?, Help for NetBSD’s VAX port, FreeBSD on Dell Latitude 7390, PFS Tool changes in DragonflyBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://cromwell-intl.com/open-source/openbsd-kernel.html" rel="nofollow">How to Upgrade OpenBSD and Build a Kernel</a></h3>

<blockquote>
<p>Let&#39;s see how to upgrade your OpenBSD system. Maybe you are doing this because the latest release just came out. If so, this is pretty simple: back up your data, boot from install media, and select &quot;Upgrade&quot; instead of &quot;Install&quot;. But maybe the latest release has been out for a few months. Why would we go through the trouble of building and installing a new kernel or other core system components? Maybe some patches have been released to improve system security or stability. It is pretty easy to build and install a kernel on OpenBSD, easier and simpler in many ways than it is on Linux.</p>
</blockquote>

<hr>

<h3><a href="https://manpages.bsd.lv/history.html" rel="nofollow">The History of man pages</a></h3>

<blockquote>
<p>Where do UNIX manpages come from? Who introduced the section-based layout of NAME, SYNOPSIS, and so on? And for manpage authors: where were those economical two- and three-letter instructions developed?</p>

<hr>
</blockquote>

<h3><a href="http://blog.netbsd.org/tnf/entry/vax_port_needs_help" rel="nofollow">VAX port needs help</a></h3>

<blockquote>
<p>The VAX is the oldest machine architecture still supported by NetBSD.<br>
Unfortunately there is another challenge, totally outside of NetBSD, but affecting the VAX port big time: the compiler support for VAX is ... let&#39;s say sub-optimal. It is also risking to be dropped completely by gcc upstream.<br>
Now here is where people can help: there is a bounty campaign to finance a gcc hacker to fix the hardest and most immediate issue with gcc for VAX. Without this being resolved, gcc will drop support for VAX in a near future version.</p>

<hr>
</blockquote>

<h3><a href="http://www.daemonology.net/blog/2020-05-22-my-new-FreeBSD-laptop-Dell-7390.html" rel="nofollow">My new FreeBSD Laptop: Dell Latitude 7390</a></h3>

<blockquote>
<p>As a FreeBSD developer, I make a point of using FreeBSD whenever I can — including on the desktop. I&#39;ve been running FreeBSD on laptops since 2004; this hasn&#39;t always been easy, but over the years I&#39;ve found that the situation has generally been improving. One of the things we still lack is adequate documentation, however — so I&#39;m writing this to provide an example for users and also Google bait in case anyone runs into some of the problems I had to address.</p>

<hr>
</blockquote>

<h3><a href="https://www.dragonflydigest.com/2020/06/09/24612.html" rel="nofollow">PFS tool changes in DragonFly</a></h3>

<blockquote>
<p>HAMMER2 just became a little more DWIM: the pfs-list and pfs-delete directives will now look across all mounted filesystems, not just the current directory’s mount path.  pfs-delete won’t delete any filesystem name that appears in more than one place, though</p>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-June/769226.html" rel="nofollow">git: hammer2 - Enhance pfs-list and pfs-delete</a>
Enhance pfs-list to list PFSs available across all mounted hammer2 filesystems instead of just the current directory&#39;s mount.  A specific mount may be specified via -s mountpt.
Enhance pfs-delete to look for the PFS name across all mounted hammer2 filesystems instead of just the current directory&#39;s mount.
As a safety, pfs-delete will refuse to delete PFS names which are duplicated across multiple mounts.  A specific mount may be specified via -s mountpt.</li>
</ul>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://gitlab.com/bastillebsd-templates" rel="nofollow">BastilleBSD Templates</a></li>
<li><a href="https://www.dragonflydigest.com/2020/06/08/24610.html" rel="nofollow">Tianocore update</a></li>
<li><a href="https://wiki.freebsd.org/OfficeHours" rel="nofollow">Reminder: FreeBSD Office Hours on June 24, 2020</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Niclas%20-%20Regarding%20the%20Lenovo%20E595%20user%20from%20Episode%20340.md" rel="nofollow">Niclas - Regarding the Lenovo E595 user from Episode 340</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Erik%20-%20What%20happened%20with%20the%20video.md" rel="nofollow">Erik - What happened with the video</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Igor%20-%20Boot%20Environments.md" rel="nofollow">Igor - Boot Environments</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Upgrading OpenBSD, Where do Unix man pages come from?, Help for NetBSD’s VAX port, FreeBSD on Dell Latitude 7390, PFS Tool changes in DragonflyBSD, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://cromwell-intl.com/open-source/openbsd-kernel.html" rel="nofollow">How to Upgrade OpenBSD and Build a Kernel</a></h3>

<blockquote>
<p>Let&#39;s see how to upgrade your OpenBSD system. Maybe you are doing this because the latest release just came out. If so, this is pretty simple: back up your data, boot from install media, and select &quot;Upgrade&quot; instead of &quot;Install&quot;. But maybe the latest release has been out for a few months. Why would we go through the trouble of building and installing a new kernel or other core system components? Maybe some patches have been released to improve system security or stability. It is pretty easy to build and install a kernel on OpenBSD, easier and simpler in many ways than it is on Linux.</p>
</blockquote>

<hr>

<h3><a href="https://manpages.bsd.lv/history.html" rel="nofollow">The History of man pages</a></h3>

<blockquote>
<p>Where do UNIX manpages come from? Who introduced the section-based layout of NAME, SYNOPSIS, and so on? And for manpage authors: where were those economical two- and three-letter instructions developed?</p>

<hr>
</blockquote>

<h3><a href="http://blog.netbsd.org/tnf/entry/vax_port_needs_help" rel="nofollow">VAX port needs help</a></h3>

<blockquote>
<p>The VAX is the oldest machine architecture still supported by NetBSD.<br>
Unfortunately there is another challenge, totally outside of NetBSD, but affecting the VAX port big time: the compiler support for VAX is ... let&#39;s say sub-optimal. It is also risking to be dropped completely by gcc upstream.<br>
Now here is where people can help: there is a bounty campaign to finance a gcc hacker to fix the hardest and most immediate issue with gcc for VAX. Without this being resolved, gcc will drop support for VAX in a near future version.</p>

<hr>
</blockquote>

<h3><a href="http://www.daemonology.net/blog/2020-05-22-my-new-FreeBSD-laptop-Dell-7390.html" rel="nofollow">My new FreeBSD Laptop: Dell Latitude 7390</a></h3>

<blockquote>
<p>As a FreeBSD developer, I make a point of using FreeBSD whenever I can — including on the desktop. I&#39;ve been running FreeBSD on laptops since 2004; this hasn&#39;t always been easy, but over the years I&#39;ve found that the situation has generally been improving. One of the things we still lack is adequate documentation, however — so I&#39;m writing this to provide an example for users and also Google bait in case anyone runs into some of the problems I had to address.</p>

<hr>
</blockquote>

<h3><a href="https://www.dragonflydigest.com/2020/06/09/24612.html" rel="nofollow">PFS tool changes in DragonFly</a></h3>

<blockquote>
<p>HAMMER2 just became a little more DWIM: the pfs-list and pfs-delete directives will now look across all mounted filesystems, not just the current directory’s mount path.  pfs-delete won’t delete any filesystem name that appears in more than one place, though</p>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-June/769226.html" rel="nofollow">git: hammer2 - Enhance pfs-list and pfs-delete</a>
Enhance pfs-list to list PFSs available across all mounted hammer2 filesystems instead of just the current directory&#39;s mount.  A specific mount may be specified via -s mountpt.
Enhance pfs-delete to look for the PFS name across all mounted hammer2 filesystems instead of just the current directory&#39;s mount.
As a safety, pfs-delete will refuse to delete PFS names which are duplicated across multiple mounts.  A specific mount may be specified via -s mountpt.</li>
</ul>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://gitlab.com/bastillebsd-templates" rel="nofollow">BastilleBSD Templates</a></li>
<li><a href="https://www.dragonflydigest.com/2020/06/08/24610.html" rel="nofollow">Tianocore update</a></li>
<li><a href="https://wiki.freebsd.org/OfficeHours" rel="nofollow">Reminder: FreeBSD Office Hours on June 24, 2020</a>
***
###Tarsnap</li>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Niclas%20-%20Regarding%20the%20Lenovo%20E595%20user%20from%20Episode%20340.md" rel="nofollow">Niclas - Regarding the Lenovo E595 user from Episode 340</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Erik%20-%20What%20happened%20with%20the%20video.md" rel="nofollow">Erik - What happened with the video</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Igor%20-%20Boot%20Environments.md" rel="nofollow">Igor - Boot Environments</a>
***</li>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>354: ZFS safekeeps data</title>
  <link>https://www.bsdnow.tv/354</link>
  <guid isPermaLink="false">2b93f76f-bbea-49a0-8cf1-80c997d4510e</guid>
  <pubDate>Thu, 11 Jun 2020 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2b93f76f-bbea-49a0-8cf1-80c997d4510e.mp3" length="33544616" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 11.4-RC 2 available, OpenBSD 6.7 on a PineBook Pro 64, How OpenZFS Keeps Your Data Safe, Bringing FreeBSD to EC2, FreeBSD 2020 Community Survey, and more.</itunes:subtitle>
  <itunes:duration>35:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 11.4-RC 2 available, OpenBSD 6.7 on a PineBook Pro 64, How OpenZFS Keeps Your Data Safe, Bringing FreeBSD to EC2, FreeBSD 2020 Community Survey, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
FreeBSD 11.4-RC2 Now Available (https://lists.freebsd.org/pipermail/freebsd-stable/2020-May/092320.html)
The second RC build of the 11.4-RELEASE release cycle is now available.
+ 11.4-RELEASE notes (https://www.freebsd.org/releases/11.4R/relnotes.html) (still in progress at the time of recording)
Install OpenBSD 6.7-current on a PineBook Pro 64 (https://xosc.org/pinebookpro.html)
This document is work in progress and I'll update the date above once I change something. If you have something to add, remarks, etc please contact me. Preferably via Mastodon but other means of communication are also fine.
News Roundup
Understanding How OpenZFS Keeps Your Data Safe (https://www.ixsystems.com/blog/openzfs-keeps-your-data-safe/)
Veteran technology writer Jim Salter wrote an excellent guide on the ZFS file system’s features and performance that we absolutely had to share. There’s plenty of information in the article for ZFS newbies and advanced users alike. Be sure to check out the article over at Ars Technica to learn more about ZFS concepts including pools, vdevs, datasets, snapshots, and replication, just to name a few. 
Bringing FreeBSD to ec2 (https://www.lastweekinaws.com/podcast/screaming-in-the-cloud/bringing-freebsd-to-ec2-with-colin-percival/)
Colin is the founder of Tarsnap, a secure online backup service which combines the flexibility and scriptability of the standard UNIX "tar" utility with strong encryption, deduplication, and the reliability of Amazon S3 storage. Having started work on Tarsnap in 2006, Colin is among the first generation of users of Amazon Web Services, and has written dozens of articles about his experiences with AWS on his blog.
FreeBSD 2020 Community Survey (https://www.research.net/r/freebsd-2020-community-survey)
The FreeBSD Core Team invites you to complete the 2020 FreeBSD Community Survey.  The purpose of this survey is to collect quantitative data from the public in order to help guide the project’s priorities and efforts.  This is only the second time a survey has been conducted by the FreeBSD Project and your input is valued.
The survey will remain open for 14 days and will close on June 16th at 17:00 UTC (Tuesday 10am PDT).
Beastie Bits
FreeBSD Project Proposals (https://www.freebsdfoundation.org/blog/submit-your-freebsd-project-proposal)
TJ Hacking (https://www.youtube.com/channel/UCknj_nW8JWcFJOAbgd5_Zgw)
Scotland Open Source podcast (https://twitter.com/ScotlandOSUM/status/1265987126321188864?s=19)
Next FreeBSD Office Hours on June 24, 2020 (https://wiki.freebsd.org/OfficeHours)
***
Feedback/Questions
Tom - Writing for LPIrstudio (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Tom%20-%20Wriitng%20for%20LPI.md)
Luke - rstudio (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Luke%20-%20rstudio.md)
Matt - Vlans and Jails (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Matt%20-%20Vlans%20and%20Jails.md)
Morgan - Can I get some commentary on this issue (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Morgan%20-%20Can%20I%20get%20some%20commentary%20on%20this%20issue.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, pinebook, pinebook pro, pinebook pro 64, openzfs, data safety, ec2, EC2, Amazon EC2, community survey, freebsd community survey</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 11.4-RC 2 available, OpenBSD 6.7 on a PineBook Pro 64, How OpenZFS Keeps Your Data Safe, Bringing FreeBSD to EC2, FreeBSD 2020 Community Survey, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2020-May/092320.html" rel="nofollow">FreeBSD 11.4-RC2 Now Available</a></h3>

<blockquote>
<p>The second RC build of the 11.4-RELEASE release cycle is now available.</p>

<ul>
<li><a href="https://www.freebsd.org/releases/11.4R/relnotes.html" rel="nofollow">11.4-RELEASE notes</a> (still in progress at the time of recording)
***</li>
</ul>
</blockquote>

<h3><a href="https://xosc.org/pinebookpro.html" rel="nofollow">Install OpenBSD 6.7-current on a PineBook Pro 64</a></h3>

<blockquote>
<p>This document is work in progress and I&#39;ll update the date above once I change something. If you have something to add, remarks, etc please contact me. Preferably via Mastodon but other means of communication are also fine.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://www.ixsystems.com/blog/openzfs-keeps-your-data-safe/" rel="nofollow">Understanding How OpenZFS Keeps Your Data Safe</a></h3>

<blockquote>
<p>Veteran technology writer Jim Salter wrote an excellent guide on the ZFS file system’s features and performance that we absolutely had to share. There’s plenty of information in the article for ZFS newbies and advanced users alike. Be sure to check out the article over at Ars Technica to learn more about ZFS concepts including pools, vdevs, datasets, snapshots, and replication, just to name a few. </p>

<hr>
</blockquote>

<h3><a href="https://www.lastweekinaws.com/podcast/screaming-in-the-cloud/bringing-freebsd-to-ec2-with-colin-percival/" rel="nofollow">Bringing FreeBSD to ec2</a></h3>

<blockquote>
<p>Colin is the founder of Tarsnap, a secure online backup service which combines the flexibility and scriptability of the standard UNIX &quot;tar&quot; utility with strong encryption, deduplication, and the reliability of Amazon S3 storage. Having started work on Tarsnap in 2006, Colin is among the first generation of users of Amazon Web Services, and has written dozens of articles about his experiences with AWS on his blog.</p>

<hr>
</blockquote>

<h3><a href="https://www.research.net/r/freebsd-2020-community-survey" rel="nofollow">FreeBSD 2020 Community Survey</a></h3>

<blockquote>
<p>The FreeBSD Core Team invites you to complete the 2020 FreeBSD Community Survey.  The purpose of this survey is to collect quantitative data from the public in order to help guide the project’s priorities and efforts.  This is only the second time a survey has been conducted by the FreeBSD Project and your input is valued.<br>
The survey will remain open for 14 days and will close on June 16th at 17:00 UTC (Tuesday 10am PDT).</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/submit-your-freebsd-project-proposal" rel="nofollow">FreeBSD Project Proposals</a></li>
<li><a href="https://www.youtube.com/channel/UCknj_nW8JWcFJOAbgd5_Zgw" rel="nofollow">TJ Hacking</a></li>
<li><a href="https://twitter.com/ScotlandOSUM/status/1265987126321188864?s=19" rel="nofollow">Scotland Open Source podcast</a></li>
<li><a href="https://wiki.freebsd.org/OfficeHours" rel="nofollow">Next FreeBSD Office Hours on June 24, 2020</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Tom%20-%20Wriitng%20for%20LPI.md" rel="nofollow">Tom - Writing for LPIrstudio</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Luke%20-%20rstudio.md" rel="nofollow">Luke - rstudio</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Matt%20-%20Vlans%20and%20Jails.md" rel="nofollow">Matt - Vlans and Jails</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Morgan%20-%20Can%20I%20get%20some%20commentary%20on%20this%20issue.md" rel="nofollow">Morgan - Can I get some commentary on this issue</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://www.tarsnap.com/bsdnow">Tarsnap</a> Promo Code: bsdnow</li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 11.4-RC 2 available, OpenBSD 6.7 on a PineBook Pro 64, How OpenZFS Keeps Your Data Safe, Bringing FreeBSD to EC2, FreeBSD 2020 Community Survey, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2020-May/092320.html" rel="nofollow">FreeBSD 11.4-RC2 Now Available</a></h3>

<blockquote>
<p>The second RC build of the 11.4-RELEASE release cycle is now available.</p>

<ul>
<li><a href="https://www.freebsd.org/releases/11.4R/relnotes.html" rel="nofollow">11.4-RELEASE notes</a> (still in progress at the time of recording)
***</li>
</ul>
</blockquote>

<h3><a href="https://xosc.org/pinebookpro.html" rel="nofollow">Install OpenBSD 6.7-current on a PineBook Pro 64</a></h3>

<blockquote>
<p>This document is work in progress and I&#39;ll update the date above once I change something. If you have something to add, remarks, etc please contact me. Preferably via Mastodon but other means of communication are also fine.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://www.ixsystems.com/blog/openzfs-keeps-your-data-safe/" rel="nofollow">Understanding How OpenZFS Keeps Your Data Safe</a></h3>

<blockquote>
<p>Veteran technology writer Jim Salter wrote an excellent guide on the ZFS file system’s features and performance that we absolutely had to share. There’s plenty of information in the article for ZFS newbies and advanced users alike. Be sure to check out the article over at Ars Technica to learn more about ZFS concepts including pools, vdevs, datasets, snapshots, and replication, just to name a few. </p>

<hr>
</blockquote>

<h3><a href="https://www.lastweekinaws.com/podcast/screaming-in-the-cloud/bringing-freebsd-to-ec2-with-colin-percival/" rel="nofollow">Bringing FreeBSD to ec2</a></h3>

<blockquote>
<p>Colin is the founder of Tarsnap, a secure online backup service which combines the flexibility and scriptability of the standard UNIX &quot;tar&quot; utility with strong encryption, deduplication, and the reliability of Amazon S3 storage. Having started work on Tarsnap in 2006, Colin is among the first generation of users of Amazon Web Services, and has written dozens of articles about his experiences with AWS on his blog.</p>

<hr>
</blockquote>

<h3><a href="https://www.research.net/r/freebsd-2020-community-survey" rel="nofollow">FreeBSD 2020 Community Survey</a></h3>

<blockquote>
<p>The FreeBSD Core Team invites you to complete the 2020 FreeBSD Community Survey.  The purpose of this survey is to collect quantitative data from the public in order to help guide the project’s priorities and efforts.  This is only the second time a survey has been conducted by the FreeBSD Project and your input is valued.<br>
The survey will remain open for 14 days and will close on June 16th at 17:00 UTC (Tuesday 10am PDT).</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/submit-your-freebsd-project-proposal" rel="nofollow">FreeBSD Project Proposals</a></li>
<li><a href="https://www.youtube.com/channel/UCknj_nW8JWcFJOAbgd5_Zgw" rel="nofollow">TJ Hacking</a></li>
<li><a href="https://twitter.com/ScotlandOSUM/status/1265987126321188864?s=19" rel="nofollow">Scotland Open Source podcast</a></li>
<li><a href="https://wiki.freebsd.org/OfficeHours" rel="nofollow">Next FreeBSD Office Hours on June 24, 2020</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Tom%20-%20Wriitng%20for%20LPI.md" rel="nofollow">Tom - Writing for LPIrstudio</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Luke%20-%20rstudio.md" rel="nofollow">Luke - rstudio</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Matt%20-%20Vlans%20and%20Jails.md" rel="nofollow">Matt - Vlans and Jails</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Morgan%20-%20Can%20I%20get%20some%20commentary%20on%20this%20issue.md" rel="nofollow">Morgan - Can I get some commentary on this issue</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://www.tarsnap.com/bsdnow">Tarsnap</a> Promo Code: bsdnow</li></ul>]]>
  </itunes:summary>
</item>
<item>
  <title>353: ZFS on Ironwolf</title>
  <link>https://www.bsdnow.tv/353</link>
  <guid isPermaLink="false">fe0e809c-411c-4156-bf80-80c98028f1ae</guid>
  <pubDate>Thu, 04 Jun 2020 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fe0e809c-411c-4156-bf80-80c98028f1ae.mp3" length="36491000" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Scheduling in NetBSD, ZFS vs. RAID on Ironwolf disks, OpenBSD on Microsoft Surface Go 2, FreeBSD for Linux sysadmins, FreeBSD on Lenovo T480, and more</itunes:subtitle>
  <itunes:duration>38:31</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Scheduling in NetBSD, ZFS vs. RAID on Ironwolf disks, OpenBSD on Microsoft Surface Go 2, FreeBSD for Linux sysadmins, FreeBSD on Lenovo T480, and more.
NOTES
This episode of BSDNow is brought to you by Tarsnap (https://www.tarsnap.com/)
Headlines
Scheduling in NetBSD – Part 1 (https://manikishan.wordpress.com/2020/05/10/scheduling-in-netbsd-part-1/)
In this blog, we will discuss about the 4.4BSD Thread scheduler one of the two schedulers in NetBSD and a few OS APIs that can be used to control the schedulers and get information while executing.
ZFS versus RAID: Eight Ironwolf disks, two filesystems, one winner (https://arstechnica.com/gadgets/2020/05/zfs-versus-raid-eight-ironwolf-disks-two-filesystems-one-winner/)
This has been a long while in the making—it's test results time. To truly understand the fundamentals of computer storage, it's important to explore the impact of various conventional RAID (Redundant Array of Inexpensive Disks) topologies on performance. It's also important to understand what ZFS is and how it works. But at some point, people (particularly computer enthusiasts on the Internet) want numbers.
If you want to hear more from Jim, he has a new bi-weekly podcast with Allan and Joe Ressington over at 2.5admins.com (https://2.5admins.com/)
News Roundup
OpenBSD on the Microsoft Surface Go 2 (https://jcs.org/2020/05/15/surface_go2)
I used OpenBSD on the original Surface Go back in 2018 and many things worked with the big exception of the internal Atheros WiFi. This meant I had to keep it tethered to a USB-C dock for Ethernet or use a small USB-A WiFi dongle plugged into a less-than-small USB-A-to-USB-C adapter.
FreeBSD UNIX for Linux sysadmins (https://triosdevelopers.com/jason.eckert/blog/Entries/2020/5/2_FreeBSD_UNIX_for_Linux_sysadmins.html)
If you’ve ever installed and explored another Linux distro (what Linux sysadmin hasn’t?!?), then exploring FreeBSD is going be somewhat similar with a few key differences.
While there is no graphical installation, the installation process is straightforward and similar to installing a server-based Linux distro. Just make sure you choose the local_unbound package when prompted if you want to cache DNS lookups locally, as FreeBSD doesn’t have a built-in local DNS resolver that does this.
Following installation, the directory structure is almost identical to Linux. Of course, you’ll notice some small differences here and there (e.g. regular user home directories are located under /usr/home instead of /home). Standard UNIX commands such as ls, chmod, find, which, ps, nice, ifconfig, netstat, sockstat (the ss command in Linux) are exactly as you’d expect, but with some different options here and there that you’ll see in the man pages. And yes, reboot and poweroff are there too.
FreeBSD on the Lenovo Thinkpad T480 (https://www.davidschlachter.com/misc/t480-freebsd)
Recently I replaced my 2014 MacBook Air with a Lenovo Thinkpad T480, on which I've installed FreeBSD, currently 12.1-RELEASE. This page documents my set-up along with various configuration tweaks and fixes.
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.
Feedback/Questions
Benjamin - ZFS Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Benjamin%20-%20ZFS%20Question.md)
Brad - swappagergetswapspace errors (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Brad%20-%20swap_pager_getswapspace%20errors.md)
Brandon - gaming (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Brandon%20-%20gaming.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>bsd, dragonflybsd, freebsd, guide, hardenedbsd, howto, interview, ironwolf, lenovo t480, microsoft, netbsd, openbsd, raid, scheduler, scheduling, surface go, sysadmin, system administration, system administrator, t480, trident, trueos, tutorial, zfs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Scheduling in NetBSD, ZFS vs. RAID on Ironwolf disks, OpenBSD on Microsoft Surface Go 2, FreeBSD for Linux sysadmins, FreeBSD on Lenovo T480, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://manikishan.wordpress.com/2020/05/10/scheduling-in-netbsd-part-1/" rel="nofollow">Scheduling in NetBSD – Part 1</a></h3>

<blockquote>
<p>In this blog, we will discuss about the 4.4BSD Thread scheduler one of the two schedulers in NetBSD and a few OS APIs that can be used to control the schedulers and get information while executing.</p>
</blockquote>

<hr>

<h3><a href="https://arstechnica.com/gadgets/2020/05/zfs-versus-raid-eight-ironwolf-disks-two-filesystems-one-winner/" rel="nofollow">ZFS versus RAID: Eight Ironwolf disks, two filesystems, one winner</a></h3>

<blockquote>
<p>This has been a long while in the making—it&#39;s test results time. To truly understand the fundamentals of computer storage, it&#39;s important to explore the impact of various conventional RAID (Redundant Array of Inexpensive Disks) topologies on performance. It&#39;s also important to understand what ZFS is and how it works. But at some point, people (particularly computer enthusiasts on the Internet) want numbers.</p>
</blockquote>

<ul>
<li>If you want to hear more from Jim, he has a new bi-weekly podcast with Allan and Joe Ressington over at <a href="https://2.5admins.com/" rel="nofollow">2.5admins.com</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2020/05/15/surface_go2" rel="nofollow">OpenBSD on the Microsoft Surface Go 2</a></h3>

<blockquote>
<p>I used OpenBSD on the original Surface Go back in 2018 and many things worked with the big exception of the internal Atheros WiFi. This meant I had to keep it tethered to a USB-C dock for Ethernet or use a small USB-A WiFi dongle plugged into a less-than-small USB-A-to-USB-C adapter.</p>
</blockquote>

<hr>

<h3><a href="https://triosdevelopers.com/jason.eckert/blog/Entries/2020/5/2_FreeBSD_UNIX_for_Linux_sysadmins.html" rel="nofollow">FreeBSD UNIX for Linux sysadmins</a></h3>

<blockquote>
<p>If you’ve ever installed and explored another Linux distro (what Linux sysadmin hasn’t?!?), then exploring FreeBSD is going be somewhat similar with a few key differences.<br>
While there is no graphical installation, the installation process is straightforward and similar to installing a server-based Linux distro. Just make sure you choose the local_unbound package when prompted if you want to cache DNS lookups locally, as FreeBSD doesn’t have a built-in local DNS resolver that does this.<br>
Following installation, the directory structure is almost identical to Linux. Of course, you’ll notice some small differences here and there (e.g. regular user home directories are located under /usr/home instead of /home). Standard UNIX commands such as ls, chmod, find, which, ps, nice, ifconfig, netstat, sockstat (the ss command in Linux) are exactly as you’d expect, but with some different options here and there that you’ll see in the man pages. And yes, reboot and poweroff are there too.</p>
</blockquote>

<hr>

<h3><a href="https://www.davidschlachter.com/misc/t480-freebsd" rel="nofollow">FreeBSD on the Lenovo Thinkpad T480</a></h3>

<blockquote>
<p>Recently I replaced my 2014 MacBook Air with a Lenovo Thinkpad T480, on which I&#39;ve installed FreeBSD, currently 12.1-RELEASE. This page documents my set-up along with various configuration tweaks and fixes.</p>
</blockquote>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Benjamin%20-%20ZFS%20Question.md" rel="nofollow">Benjamin - ZFS Question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Brad%20-%20swap_pager_getswapspace%20errors.md" rel="nofollow">Brad - swap_pager_getswapspace errors</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Brandon%20-%20gaming.md" rel="nofollow">Brandon - gaming</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://www.tarsnap.com/bsdnow">Tarsnap</a> Promo Code: bsdnow</li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Scheduling in NetBSD, ZFS vs. RAID on Ironwolf disks, OpenBSD on Microsoft Surface Go 2, FreeBSD for Linux sysadmins, FreeBSD on Lenovo T480, and more.</p>

<p><strong><em>NOTES</em></strong><br>
This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a></p>

<h2>Headlines</h2>

<h3><a href="https://manikishan.wordpress.com/2020/05/10/scheduling-in-netbsd-part-1/" rel="nofollow">Scheduling in NetBSD – Part 1</a></h3>

<blockquote>
<p>In this blog, we will discuss about the 4.4BSD Thread scheduler one of the two schedulers in NetBSD and a few OS APIs that can be used to control the schedulers and get information while executing.</p>
</blockquote>

<hr>

<h3><a href="https://arstechnica.com/gadgets/2020/05/zfs-versus-raid-eight-ironwolf-disks-two-filesystems-one-winner/" rel="nofollow">ZFS versus RAID: Eight Ironwolf disks, two filesystems, one winner</a></h3>

<blockquote>
<p>This has been a long while in the making—it&#39;s test results time. To truly understand the fundamentals of computer storage, it&#39;s important to explore the impact of various conventional RAID (Redundant Array of Inexpensive Disks) topologies on performance. It&#39;s also important to understand what ZFS is and how it works. But at some point, people (particularly computer enthusiasts on the Internet) want numbers.</p>
</blockquote>

<ul>
<li>If you want to hear more from Jim, he has a new bi-weekly podcast with Allan and Joe Ressington over at <a href="https://2.5admins.com/" rel="nofollow">2.5admins.com</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2020/05/15/surface_go2" rel="nofollow">OpenBSD on the Microsoft Surface Go 2</a></h3>

<blockquote>
<p>I used OpenBSD on the original Surface Go back in 2018 and many things worked with the big exception of the internal Atheros WiFi. This meant I had to keep it tethered to a USB-C dock for Ethernet or use a small USB-A WiFi dongle plugged into a less-than-small USB-A-to-USB-C adapter.</p>
</blockquote>

<hr>

<h3><a href="https://triosdevelopers.com/jason.eckert/blog/Entries/2020/5/2_FreeBSD_UNIX_for_Linux_sysadmins.html" rel="nofollow">FreeBSD UNIX for Linux sysadmins</a></h3>

<blockquote>
<p>If you’ve ever installed and explored another Linux distro (what Linux sysadmin hasn’t?!?), then exploring FreeBSD is going be somewhat similar with a few key differences.<br>
While there is no graphical installation, the installation process is straightforward and similar to installing a server-based Linux distro. Just make sure you choose the local_unbound package when prompted if you want to cache DNS lookups locally, as FreeBSD doesn’t have a built-in local DNS resolver that does this.<br>
Following installation, the directory structure is almost identical to Linux. Of course, you’ll notice some small differences here and there (e.g. regular user home directories are located under /usr/home instead of /home). Standard UNIX commands such as ls, chmod, find, which, ps, nice, ifconfig, netstat, sockstat (the ss command in Linux) are exactly as you’d expect, but with some different options here and there that you’ll see in the man pages. And yes, reboot and poweroff are there too.</p>
</blockquote>

<hr>

<h3><a href="https://www.davidschlachter.com/misc/t480-freebsd" rel="nofollow">FreeBSD on the Lenovo Thinkpad T480</a></h3>

<blockquote>
<p>Recently I replaced my 2014 MacBook Air with a Lenovo Thinkpad T480, on which I&#39;ve installed FreeBSD, currently 12.1-RELEASE. This page documents my set-up along with various configuration tweaks and fixes.</p>
</blockquote>

<hr>

<h3>Tarsnap</h3>

<ul>
<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Benjamin%20-%20ZFS%20Question.md" rel="nofollow">Benjamin - ZFS Question</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Brad%20-%20swap_pager_getswapspace%20errors.md" rel="nofollow">Brad - swap_pager_getswapspace errors</a></p></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Brandon%20-%20gaming.md" rel="nofollow">Brandon - gaming</a></p></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://www.tarsnap.com/bsdnow">Tarsnap</a> Promo Code: bsdnow</li></ul>]]>
  </itunes:summary>
</item>
<item>
  <title>352: Introducing Randomness</title>
  <link>https://www.bsdnow.tv/352</link>
  <guid isPermaLink="false">a4aba73b-ccc0-41d3-bd39-45783e594bd3</guid>
  <pubDate>Thu, 28 May 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a4aba73b-ccc0-41d3-bd39-45783e594bd3.mp3" length="45132517" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A brief introduction to randomness, logs grinding netatalk to a halt, NetBSD core team changes, Using qemu guest agent on OpenBSD kvm/qemu guests, WireGuard patchset for OpenBSD, FreeBSD 12.1 on a laptop, and more.</itunes:subtitle>
  <itunes:duration>50:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A brief introduction to randomness, logs grinding netatalk to a halt, NetBSD core team changes, Using qemu guest agent on OpenBSD kvm/qemu guests, WireGuard patchset for OpenBSD, FreeBSD 12.1 on a laptop, and more.
Headlines
Entropy (https://washbear.neocities.org/entropy.html)
A brief introduction to randomness
Problem: Computers are very predictable. This is by design.
But what if we want them to act unpredictably? This is very useful if we want to secure our private communications with randomized keys, or not let people cheat at video games, or if we're doing statistical simulations or similar.
Logs grinding Netatalk on FreeBSD to a hault (https://rubenerd.com/logs-grinding-netatalk-on-freebsd-to-a-hault/)
I’ve heard it said the cobbler’s children walk barefoot. While posessing the qualities of a famed financial investment strategy, it speaks to how we generally put more effort into things for others than ourselves; at least in business.
The HP Microserver I share with Clara is a modest affair compared to what we run at work. It has six spinning rust drives and two SSDs which are ZFS-mirrored; not even in a RAID 10 equivalent. This is underlaid with GELI for encryption, and served to our Macs with Netatalk over gigabit Ethernet with jumbo frames.
News Roundup
NetBSD Core Team Changes (https://mail-index.netbsd.org/netbsd-announce/2020/05/07/msg000314.html)
Matt Thomas (matt@) has served on the NetBSD core team for over ten years, and has made many contributions, including ELF functionality, being the long-time VAX maintainer, gcc contributor, the generic pmap, and also networking functionality, and platform bring-up over the years.  Matt has stepped down from the NetBSD core team, and we thank him for his many, extensive contributions.
Robert Elz (kre@), a long time BSD contributor, has kindly accepted the offer to join the core team, and help us out with the benefit of his experience and advice over many years.  Amongst other things, Robert has been maintaining our shell, liaising with the Austin Group, and bringing it up to date with modern functionality.
Using qemu guest agent on OpenBSD kvm/qemu guests (https://undeadly.org/cgi?action=article;sid=20200514073852)
In a post to the ports@ mailing list, Landry Breuil (landry@) shared some of his notes on using qemu guest agent on OpenBSD kvm/qemu guests.
WireGuard patchset for OpenBSD (https://undeadly.org/cgi?action=article;sid=20200512080047)
A while ago I wanted to learn more about OpenBSD development. So I picked a project, in this case WireGuard, to develop a native client for. Over the last two years, with many different iterations, and working closely with the WireGuard's creator (Jason [Jason A. Donenfeld - Ed.], CC'd), it started to become a serious project eventually reaching parity with other official implementations. Finally, we are here and I think it is time for any further development to happen inside the src tree.
FreeBSD 12.1 on a laptop (https://dataswamp.org/~solene/2020-05-11-freebsd-workstation.html)
I’m using FreeBSD again on a laptop for some reasons so expect to read more about FreeBSD here. This tutorial explain how to get a graphical desktop using FreeBSD 12.1.
Beastie Bits
List of useful FreeBSD Commands (https://medium.com/@tdebarbora/list-of-useful-freebsd-commands-92dffb8f8c57)
Master Your Network With Unix Command Line Tools (https://itnext.io/master-your-network-with-unix-command-line-tools-790bdd3b3b87)
Original Unix containers aka FreeBSD jails (https://twitter.com/nixcraft/status/1257674069387993088)
Flashback : 2003 Article : Bill Joy's greatest gift to man – the vi editor (https://www.theregister.co.uk/2003/09/11/bill_joys_greatest_gift/)
FreeBSD Journal March/April 2020 Filesystems: ZFS Encryption, FUSE, and more, plus Network Bridges (https://www.freebsdfoundation.org/past-issues/filesystems/)
HAMBug meeting will be online again in June, so those from all over the world are welcome to join, June 9th (2nd Tuesday of each month) at 18:30 Eastern (https://www.hambug.ca/)
Feedback/Questions
+ Lyubomir - GELI and ZFS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/352/feedback/Lyubomir%20-%20GELI%20and%20ZFS.md)
Patrick - powerd and powerd++ (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/352/feedback/Patrick%20-%20powerd%20and%20powerd%2B%2B.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, random, randomness, entropy, logs, netatalk, core team, changes, qemu, guest agent, kvm, wireguard, patchset, laptop, notebook</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A brief introduction to randomness, logs grinding netatalk to a halt, NetBSD core team changes, Using qemu guest agent on OpenBSD kvm/qemu guests, WireGuard patchset for OpenBSD, FreeBSD 12.1 on a laptop, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://washbear.neocities.org/entropy.html" rel="nofollow">Entropy</a></h3>

<blockquote>
<blockquote>
<p>A brief introduction to randomness</p>
</blockquote>
</blockquote>

<ul>
<li>Problem: Computers are very predictable. This is by design.</li>
</ul>

<blockquote>
<p>But what if we want them to act unpredictably? This is very useful if we want to secure our private communications with randomized keys, or not let people cheat at video games, or if we&#39;re doing statistical simulations or similar.</p>
</blockquote>

<hr>

<h3><a href="https://rubenerd.com/logs-grinding-netatalk-on-freebsd-to-a-hault/" rel="nofollow">Logs grinding Netatalk on FreeBSD to a hault</a></h3>

<blockquote>
<blockquote>
<p>I’ve heard it said the cobbler’s children walk barefoot. While posessing the qualities of a famed financial investment strategy, it speaks to how we generally put more effort into things for others than ourselves; at least in business.<br>
The HP Microserver I share with Clara is a modest affair compared to what we run at work. It has six spinning rust drives and two SSDs which are ZFS-mirrored; not even in a RAID 10 equivalent. This is underlaid with GELI for encryption, and served to our Macs with Netatalk over gigabit Ethernet with jumbo frames.</p>
</blockquote>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-announce/2020/05/07/msg000314.html" rel="nofollow">NetBSD Core Team Changes</a></h3>

<blockquote>
<p>Matt Thomas (matt@) has served on the NetBSD core team for over ten years, and has made many contributions, including ELF functionality, being the long-time VAX maintainer, gcc contributor, the generic pmap, and also networking functionality, and platform bring-up over the years.  Matt has stepped down from the NetBSD core team, and we thank him for his many, extensive contributions.<br>
Robert Elz (kre@), a long time BSD contributor, has kindly accepted the offer to join the core team, and help us out with the benefit of his experience and advice over many years.  Amongst other things, Robert has been maintaining our shell, liaising with the Austin Group, and bringing it up to date with modern functionality.</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20200514073852" rel="nofollow">Using qemu guest agent on OpenBSD kvm/qemu guests</a></h3>

<blockquote>
<p>In a post to the ports@ mailing list, Landry Breuil (landry@) shared some of his notes on using qemu guest agent on OpenBSD kvm/qemu guests.</p>
</blockquote>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20200512080047" rel="nofollow">WireGuard patchset for OpenBSD</a></h3>

<blockquote>
<p>A while ago I wanted to learn more about OpenBSD development. So I picked a project, in this case WireGuard, to develop a native client for. Over the last two years, with many different iterations, and working closely with the WireGuard&#39;s creator (Jason [Jason A. Donenfeld - Ed.], CC&#39;d), it started to become a serious project eventually reaching parity with other official implementations. Finally, we are here and I think it is time for any further development to happen inside the src tree.</p>

<hr>
</blockquote>

<h3><a href="https://dataswamp.org/%7Esolene/2020-05-11-freebsd-workstation.html" rel="nofollow">FreeBSD 12.1 on a laptop</a></h3>

<blockquote>
<p>I’m using FreeBSD again on a laptop for some reasons so expect to read more about FreeBSD here. This tutorial explain how to get a graphical desktop using FreeBSD 12.1.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://medium.com/@tdebarbora/list-of-useful-freebsd-commands-92dffb8f8c57" rel="nofollow">List of useful FreeBSD Commands</a></li>
<li><a href="https://itnext.io/master-your-network-with-unix-command-line-tools-790bdd3b3b87" rel="nofollow">Master Your Network With Unix Command Line Tools</a></li>
<li><a href="https://twitter.com/nixcraft/status/1257674069387993088" rel="nofollow">Original Unix containers aka FreeBSD jails</a></li>
<li><a href="https://www.theregister.co.uk/2003/09/11/bill_joys_greatest_gift/" rel="nofollow">Flashback : 2003 Article : Bill Joy&#39;s greatest gift to man – the vi editor</a></li>
<li><a href="https://www.freebsdfoundation.org/past-issues/filesystems/" rel="nofollow">FreeBSD Journal March/April 2020 Filesystems: ZFS Encryption, FUSE, and more, plus Network Bridges</a></li>
<li><a href="https://www.hambug.ca/" rel="nofollow">HAMBug meeting will be online again in June, so those from all over the world are welcome to join, June 9th (2nd Tuesday of each month) at 18:30 Eastern</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>+ <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/352/feedback/Lyubomir%20-%20GELI%20and%20ZFS.md" rel="nofollow">Lyubomir - GELI and ZFS</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/352/feedback/Patrick%20-%20powerd%20and%20powerd%2B%2B.md" rel="nofollow">Patrick - powerd and powerd++</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A brief introduction to randomness, logs grinding netatalk to a halt, NetBSD core team changes, Using qemu guest agent on OpenBSD kvm/qemu guests, WireGuard patchset for OpenBSD, FreeBSD 12.1 on a laptop, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://washbear.neocities.org/entropy.html" rel="nofollow">Entropy</a></h3>

<blockquote>
<blockquote>
<p>A brief introduction to randomness</p>
</blockquote>
</blockquote>

<ul>
<li>Problem: Computers are very predictable. This is by design.</li>
</ul>

<blockquote>
<p>But what if we want them to act unpredictably? This is very useful if we want to secure our private communications with randomized keys, or not let people cheat at video games, or if we&#39;re doing statistical simulations or similar.</p>
</blockquote>

<hr>

<h3><a href="https://rubenerd.com/logs-grinding-netatalk-on-freebsd-to-a-hault/" rel="nofollow">Logs grinding Netatalk on FreeBSD to a hault</a></h3>

<blockquote>
<blockquote>
<p>I’ve heard it said the cobbler’s children walk barefoot. While posessing the qualities of a famed financial investment strategy, it speaks to how we generally put more effort into things for others than ourselves; at least in business.<br>
The HP Microserver I share with Clara is a modest affair compared to what we run at work. It has six spinning rust drives and two SSDs which are ZFS-mirrored; not even in a RAID 10 equivalent. This is underlaid with GELI for encryption, and served to our Macs with Netatalk over gigabit Ethernet with jumbo frames.</p>
</blockquote>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-announce/2020/05/07/msg000314.html" rel="nofollow">NetBSD Core Team Changes</a></h3>

<blockquote>
<p>Matt Thomas (matt@) has served on the NetBSD core team for over ten years, and has made many contributions, including ELF functionality, being the long-time VAX maintainer, gcc contributor, the generic pmap, and also networking functionality, and platform bring-up over the years.  Matt has stepped down from the NetBSD core team, and we thank him for his many, extensive contributions.<br>
Robert Elz (kre@), a long time BSD contributor, has kindly accepted the offer to join the core team, and help us out with the benefit of his experience and advice over many years.  Amongst other things, Robert has been maintaining our shell, liaising with the Austin Group, and bringing it up to date with modern functionality.</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20200514073852" rel="nofollow">Using qemu guest agent on OpenBSD kvm/qemu guests</a></h3>

<blockquote>
<p>In a post to the ports@ mailing list, Landry Breuil (landry@) shared some of his notes on using qemu guest agent on OpenBSD kvm/qemu guests.</p>
</blockquote>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20200512080047" rel="nofollow">WireGuard patchset for OpenBSD</a></h3>

<blockquote>
<p>A while ago I wanted to learn more about OpenBSD development. So I picked a project, in this case WireGuard, to develop a native client for. Over the last two years, with many different iterations, and working closely with the WireGuard&#39;s creator (Jason [Jason A. Donenfeld - Ed.], CC&#39;d), it started to become a serious project eventually reaching parity with other official implementations. Finally, we are here and I think it is time for any further development to happen inside the src tree.</p>

<hr>
</blockquote>

<h3><a href="https://dataswamp.org/%7Esolene/2020-05-11-freebsd-workstation.html" rel="nofollow">FreeBSD 12.1 on a laptop</a></h3>

<blockquote>
<p>I’m using FreeBSD again on a laptop for some reasons so expect to read more about FreeBSD here. This tutorial explain how to get a graphical desktop using FreeBSD 12.1.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://medium.com/@tdebarbora/list-of-useful-freebsd-commands-92dffb8f8c57" rel="nofollow">List of useful FreeBSD Commands</a></li>
<li><a href="https://itnext.io/master-your-network-with-unix-command-line-tools-790bdd3b3b87" rel="nofollow">Master Your Network With Unix Command Line Tools</a></li>
<li><a href="https://twitter.com/nixcraft/status/1257674069387993088" rel="nofollow">Original Unix containers aka FreeBSD jails</a></li>
<li><a href="https://www.theregister.co.uk/2003/09/11/bill_joys_greatest_gift/" rel="nofollow">Flashback : 2003 Article : Bill Joy&#39;s greatest gift to man – the vi editor</a></li>
<li><a href="https://www.freebsdfoundation.org/past-issues/filesystems/" rel="nofollow">FreeBSD Journal March/April 2020 Filesystems: ZFS Encryption, FUSE, and more, plus Network Bridges</a></li>
<li><a href="https://www.hambug.ca/" rel="nofollow">HAMBug meeting will be online again in June, so those from all over the world are welcome to join, June 9th (2nd Tuesday of each month) at 18:30 Eastern</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>+ <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/352/feedback/Lyubomir%20-%20GELI%20and%20ZFS.md" rel="nofollow">Lyubomir - GELI and ZFS</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/352/feedback/Patrick%20-%20powerd%20and%20powerd%2B%2B.md" rel="nofollow">Patrick - powerd and powerd++</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>351: Heaven: OpenBSD 6.7</title>
  <link>https://www.bsdnow.tv/351</link>
  <guid isPermaLink="false">2a4b866e-d026-416c-9ab7-e0b95bf24043</guid>
  <pubDate>Thu, 21 May 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2a4b866e-d026-416c-9ab7-e0b95bf24043.mp3" length="43675400" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Backup and Restore on NetBSD, OpenBSD 6.7 available, Building a WireGuard Jail with FreeBSD's standard tools, who gets to chown things and quotas, influence TrueNAS CORE roadmap, and more.
Date: 2020-05-20</itunes:subtitle>
  <itunes:duration>49:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Backup and Restore on NetBSD, OpenBSD 6.7 available, Building a WireGuard Jail with FreeBSD's standard tools, who gets to chown things and quotas, influence TrueNAS CORE roadmap, and more.
Headlines
Backup and Restore on NetBSD (https://e17i.github.io/articles-netbsd-backup/)
Putting together the bits and pieces of a backup and restore concept, while not being rocket science, always seems to be a little bit ungrateful. Most Admin Handbooks handle this topic only within few pages. After replacing my old Mac Mini's OS by NetBSD, I tried to implement an automated backup, allowing me to handle it similarly to the time machine backups I've been using before. Suggestions on how to improve are always welcome.
BSD Release: OpenBSD 6.7 (https://distrowatch.com/?newsid=10921)
The OpenBSD project produces and operating system which places focus on portability, standardisation, code correctness, proactive security and integrated cryptography. The project's latest release is OpenBSD 6.7 which introduces several new improvements to the cron scheduling daemon, improvements to the web server daemon, and the top command now offers scrollable output. These and many more changes can be found in the project's release announcement: "This is a partial list of new features and systems included in OpenBSD 6.7. For a comprehensive list, see the changelog leading to 6.7. General improvements and bugfixes: Reduced the minimum allowed number of chunks in a CONCAT volume from 2 to 1, increasing the number of volumes which can be created on a single disk with bioctl(8) from 7 to 15. This can be used to create more partitions than previously. Rewrote the cron(8) flag-parsing code to be getopt-like, allowing tight formations like -ns and flag repetition. Renamed the 'options' field in crontab(5) to 'flags'. Added crontab(5) -s flag to the command field, indicating that only a single instance of the job should run concurrently. Added cron(8) support for random time values using the ~ operator. Allowed cwm(1) configuration of window size based on percentage of the master window during horizontal and vertical tiling actions."
Release Announcement (https://marc.info/?l=openbsd-announce&amp;amp;m=158989783626149&amp;amp;w=2)
Release Notes (https://www.openbsd.org/67.html)
News Roundup
Building a WireGuard Jail with the FreeBSD's Standard Tools (https://genneko.github.io/playing-with-bsd/networking/freebsd-wireguard-jail/)
Recently, I had an opportunity to build a WireGuard jail on a FreeBSD 12.1 host.
As it was really quick and easy to setup and it has been working completely fine for a month, I’d like to share my experience with anyone interested in this topic. 
The Unix divide over who gets to chown things, and (disk space) quotas (https://utcc.utoronto.ca/~cks/space/blog/unix/ChownDivideAndQuotas)
One of the famous big splits between the BSD Unix world and the System V world is whether ordinary users can use chown (the command and the system call) to give away their own files. In System V derived Unixes you were generally allowed to; in BSD derived Unixes you weren't. Until I looked it up now to make sure, I thought that BSD changed this behavior from V7 and that V7 had an unrestricted chown. However, this turns out to be wrong; in V7 Unix, chown(2) was restricted to root only.
You Can Influence the TrueNAS CORE Roadmap! (https://www.ixsystems.com/blog/truenas-bugs-and-suggestions/)
As many of you know, we’ve historically had three ticket types available in our tracker: Bugs, Features, and Improvements, which are all fairly self-explanatory. After some discussion internally, we’ve decided to implement a new type of ticket, a “Suggestion”. These will be replacing Feature and Improvement requests for the TrueNAS Community, simplifying things down to two options: Bugs and Suggestions. This change also introduces a slightly different workflow than before.
Beastie Bits
FreeNAS Spare Parts Build: Testing ZFS With Imbalanced VDEVs and Mismatched Drives (https://www.youtube.com/watch?v=EFrlG3CUKFQ)
TLSv1.3 server code enabled in LibreSSL in -current (https://undeadly.org/cgi?action=article;sid=20200512074150)
Interview with Deb Goodkin (https://itsfoss.com/freebsd-interview-deb-goodkin/)
***
Feedback/Questions
Bostjan - WireGaurd (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Bostjan%20-%20WireGaurd.md)
Chad - ZFS Pool Design (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Chad%20-%20ZFS%20Pool%20Design.md)
Pedreo - Scale FreeBSD Jails (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Pedreo%20-%20Scale%20FreeBSD%20Jails.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, backup, restore, release, wireguard, jail, chown, disk, disk space, quota, quotas, truenas, truenas core, roadmap </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Backup and Restore on NetBSD, OpenBSD 6.7 available, Building a WireGuard Jail with FreeBSD&#39;s standard tools, who gets to chown things and quotas, influence TrueNAS CORE roadmap, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://e17i.github.io/articles-netbsd-backup/" rel="nofollow">Backup and Restore on NetBSD</a></h3>

<blockquote>
<p>Putting together the bits and pieces of a backup and restore concept, while not being rocket science, always seems to be a little bit ungrateful. Most Admin Handbooks handle this topic only within few pages. After replacing my old Mac Mini&#39;s OS by NetBSD, I tried to implement an automated backup, allowing me to handle it similarly to the time machine backups I&#39;ve been using before. Suggestions on how to improve are always welcome.</p>
</blockquote>

<hr>

<h3><a href="https://distrowatch.com/?newsid=10921" rel="nofollow">BSD Release: OpenBSD 6.7</a></h3>

<blockquote>
<p>The OpenBSD project produces and operating system which places focus on portability, standardisation, code correctness, proactive security and integrated cryptography. The project&#39;s latest release is OpenBSD 6.7 which introduces several new improvements to the cron scheduling daemon, improvements to the web server daemon, and the top command now offers scrollable output. These and many more changes can be found in the project&#39;s release announcement: &quot;This is a partial list of new features and systems included in OpenBSD 6.7. For a comprehensive list, see the changelog leading to 6.7. General improvements and bugfixes: Reduced the minimum allowed number of chunks in a CONCAT volume from 2 to 1, increasing the number of volumes which can be created on a single disk with bioctl(8) from 7 to 15. This can be used to create more partitions than previously. Rewrote the cron(8) flag-parsing code to be getopt-like, allowing tight formations like -ns and flag repetition. Renamed the &#39;options&#39; field in crontab(5) to &#39;flags&#39;. Added crontab(5) -s flag to the command field, indicating that only a single instance of the job should run concurrently. Added cron(8) support for random time values using the ~ operator. Allowed cwm(1) configuration of window size based on percentage of the master window during horizontal and vertical tiling actions.&quot;</p>
</blockquote>

<ul>
<li><a href="https://marc.info/?l=openbsd-announce&m=158989783626149&w=2" rel="nofollow">Release Announcement</a></li>
<li><a href="https://www.openbsd.org/67.html" rel="nofollow">Release Notes</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://genneko.github.io/playing-with-bsd/networking/freebsd-wireguard-jail/" rel="nofollow">Building a WireGuard Jail with the FreeBSD&#39;s Standard Tools</a></h3>

<blockquote>
<p>Recently, I had an opportunity to build a WireGuard jail on a FreeBSD 12.1 host.<br>
As it was really quick and easy to setup and it has been working completely fine for a month, I’d like to share my experience with anyone interested in this topic. </p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ChownDivideAndQuotas" rel="nofollow">The Unix divide over who gets to chown things, and (disk space) quotas</a></h3>

<blockquote>
<p>One of the famous big splits between the BSD Unix world and the System V world is whether ordinary users can use chown (the command and the system call) to give away their own files. In System V derived Unixes you were generally allowed to; in BSD derived Unixes you weren&#39;t. Until I looked it up now to make sure, I thought that BSD changed this behavior from V7 and that V7 had an unrestricted chown. However, this turns out to be wrong; in V7 Unix, chown(2) was restricted to root only.</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/truenas-bugs-and-suggestions/" rel="nofollow">You Can Influence the TrueNAS CORE Roadmap!</a></h3>

<blockquote>
<p>As many of you know, we’ve historically had three ticket types available in our tracker: Bugs, Features, and Improvements, which are all fairly self-explanatory. After some discussion internally, we’ve decided to implement a new type of ticket, a “Suggestion”. These will be replacing Feature and Improvement requests for the TrueNAS Community, simplifying things down to two options: Bugs and Suggestions. This change also introduces a slightly different workflow than before.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=EFrlG3CUKFQ" rel="nofollow">FreeNAS Spare Parts Build: Testing ZFS With Imbalanced VDEVs and Mismatched Drives</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20200512074150" rel="nofollow">TLSv1.3 server code enabled in LibreSSL in -current</a></li>
<li><a href="https://itsfoss.com/freebsd-interview-deb-goodkin/" rel="nofollow">Interview with Deb Goodkin</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Bostjan%20-%20WireGaurd.md" rel="nofollow">Bostjan - WireGaurd</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Chad%20-%20ZFS%20Pool%20Design.md" rel="nofollow">Chad - ZFS Pool Design</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Pedreo%20-%20Scale%20FreeBSD%20Jails.md" rel="nofollow">Pedreo - Scale FreeBSD Jails</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Backup and Restore on NetBSD, OpenBSD 6.7 available, Building a WireGuard Jail with FreeBSD&#39;s standard tools, who gets to chown things and quotas, influence TrueNAS CORE roadmap, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://e17i.github.io/articles-netbsd-backup/" rel="nofollow">Backup and Restore on NetBSD</a></h3>

<blockquote>
<p>Putting together the bits and pieces of a backup and restore concept, while not being rocket science, always seems to be a little bit ungrateful. Most Admin Handbooks handle this topic only within few pages. After replacing my old Mac Mini&#39;s OS by NetBSD, I tried to implement an automated backup, allowing me to handle it similarly to the time machine backups I&#39;ve been using before. Suggestions on how to improve are always welcome.</p>
</blockquote>

<hr>

<h3><a href="https://distrowatch.com/?newsid=10921" rel="nofollow">BSD Release: OpenBSD 6.7</a></h3>

<blockquote>
<p>The OpenBSD project produces and operating system which places focus on portability, standardisation, code correctness, proactive security and integrated cryptography. The project&#39;s latest release is OpenBSD 6.7 which introduces several new improvements to the cron scheduling daemon, improvements to the web server daemon, and the top command now offers scrollable output. These and many more changes can be found in the project&#39;s release announcement: &quot;This is a partial list of new features and systems included in OpenBSD 6.7. For a comprehensive list, see the changelog leading to 6.7. General improvements and bugfixes: Reduced the minimum allowed number of chunks in a CONCAT volume from 2 to 1, increasing the number of volumes which can be created on a single disk with bioctl(8) from 7 to 15. This can be used to create more partitions than previously. Rewrote the cron(8) flag-parsing code to be getopt-like, allowing tight formations like -ns and flag repetition. Renamed the &#39;options&#39; field in crontab(5) to &#39;flags&#39;. Added crontab(5) -s flag to the command field, indicating that only a single instance of the job should run concurrently. Added cron(8) support for random time values using the ~ operator. Allowed cwm(1) configuration of window size based on percentage of the master window during horizontal and vertical tiling actions.&quot;</p>
</blockquote>

<ul>
<li><a href="https://marc.info/?l=openbsd-announce&m=158989783626149&w=2" rel="nofollow">Release Announcement</a></li>
<li><a href="https://www.openbsd.org/67.html" rel="nofollow">Release Notes</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://genneko.github.io/playing-with-bsd/networking/freebsd-wireguard-jail/" rel="nofollow">Building a WireGuard Jail with the FreeBSD&#39;s Standard Tools</a></h3>

<blockquote>
<p>Recently, I had an opportunity to build a WireGuard jail on a FreeBSD 12.1 host.<br>
As it was really quick and easy to setup and it has been working completely fine for a month, I’d like to share my experience with anyone interested in this topic. </p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ChownDivideAndQuotas" rel="nofollow">The Unix divide over who gets to chown things, and (disk space) quotas</a></h3>

<blockquote>
<p>One of the famous big splits between the BSD Unix world and the System V world is whether ordinary users can use chown (the command and the system call) to give away their own files. In System V derived Unixes you were generally allowed to; in BSD derived Unixes you weren&#39;t. Until I looked it up now to make sure, I thought that BSD changed this behavior from V7 and that V7 had an unrestricted chown. However, this turns out to be wrong; in V7 Unix, chown(2) was restricted to root only.</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/truenas-bugs-and-suggestions/" rel="nofollow">You Can Influence the TrueNAS CORE Roadmap!</a></h3>

<blockquote>
<p>As many of you know, we’ve historically had three ticket types available in our tracker: Bugs, Features, and Improvements, which are all fairly self-explanatory. After some discussion internally, we’ve decided to implement a new type of ticket, a “Suggestion”. These will be replacing Feature and Improvement requests for the TrueNAS Community, simplifying things down to two options: Bugs and Suggestions. This change also introduces a slightly different workflow than before.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=EFrlG3CUKFQ" rel="nofollow">FreeNAS Spare Parts Build: Testing ZFS With Imbalanced VDEVs and Mismatched Drives</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20200512074150" rel="nofollow">TLSv1.3 server code enabled in LibreSSL in -current</a></li>
<li><a href="https://itsfoss.com/freebsd-interview-deb-goodkin/" rel="nofollow">Interview with Deb Goodkin</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Bostjan%20-%20WireGaurd.md" rel="nofollow">Bostjan - WireGaurd</a></li>
<li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Chad%20-%20ZFS%20Pool%20Design.md" rel="nofollow">Chad - ZFS Pool Design</a></li>
<li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Pedreo%20-%20Scale%20FreeBSD%20Jails.md" rel="nofollow">Pedreo - Scale FreeBSD Jails</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>350: Speedy Bridges</title>
  <link>https://www.bsdnow.tv/350</link>
  <guid isPermaLink="false">49114e72-83f1-43b6-ae71-9e608a059b3e</guid>
  <pubDate>Thu, 14 May 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/49114e72-83f1-43b6-ae71-9e608a059b3e.mp3" length="37173656" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>5x if_bridge Performance Improvement, How Unix Won, Understanding VLAN Configuration on FreeBSD, Using bhyve PCI passthrough on OmniOS, TrueNAS 11.3-U2 Available, and more.</itunes:subtitle>
  <itunes:duration>34:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>5x if_bridge Performance Improvement, How Unix Won, Understanding VLAN Configuration on FreeBSD, Using bhyve PCI passthrough on OmniOS, TrueNAS 11.3-U2 Available, and more.
Headlines
5x if_bridge Performance Improvement (https://www.freebsdfoundation.org/blog/500-if_bridge-performance-improvement/)
With FreeBSD Foundation grant, Kristof Provost harnesses new parallel techniques to uncork performance bottleneck 
+ Kristof also streamed some of his work, providing an interesting insight into how such development work happens
+ &amp;gt; https://www.twitch.tv/provostk/videos
How Unix Won (https://blog.vivekhaldar.com/post/617189040564928512/how-unix-won)
+&amp;gt; Unix has won in every conceivable way. And in true mythic style, it contains the seeds of its own eclipse. This is my subjective historical narrative of how that happened.
I’m using the name “Unix” to include the entire family of operating systems descended from it, or that have been heavily influenced by it. That includes Linux, SunOS, Solaris, BSD, Mac OS X, and many, many others.
Both major mobile OSs, Android and iOS, have Unix roots. Their billions of users dwarf those using clunky things like laptops and desktops, but even there, Windows is only the non-Unix viable OS. Almost everything running server-side in giant datacenters is Linux.
How did Unix win?
News Roundup
Check logs of central syslog-ng log host on FreeBSD (https://blog.socruel.nu/freebsd/check-logs-of-syslog-ng-log-host-on-freebsd.html)
This blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not to difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host. And the solution presented in this blog post works pretty well for me!
Understanding VLAN Configuration on FreeBSD (https://genneko.github.io/playing-with-bsd/networking/freebsd-vlan/)
Until recently, I’ve never had a chance to use VLANs on FreeBSD hosts, though I sometimes configure them on ethernet switches.
But when I was playing with vnet jails, I suddenly got interested in VLAN configuration on FreeBSD and experimented with it for some time.
I wrote this short article to summarize my current understanding of how to configure VLANs on FreeBSD.
Using bhyve PCI passthrough on OmniOS (https://www.cyber-tec.org/2019/05/29/using-bhyve-pci-passthrough-on-omnios/)
Some hardware is not supported in illumos yet, but luckily there is bhyve which supports pci passthrough to any guest operating system. To continue with my OmniOS desktop on "modern" hardware I would love wifi support, so why not using a bhyve guest as router zone which provide the required drivers?
TrueNAS 11.3-U2 is Generally Available (https://www.ixsystems.com/blog/truenas-11-3-u2-is-available/)
TrueNAS 11.3-U2.1 is generally available as of 4/22/2020. This update is based on FreeNAS 11.3-U2 which has had over 50k deployments and received excellent community and third party reviews. The Release Notes are available on the iXsystems.com website.
Beastie Bits
HardenedBSD April 2020 Status Report (https://hardenedbsd.org/article/shawn-webb/2020-04-24/hardenedbsd-april-2020-status-report)
NYC Bug’s Mailing List - Listing of open Dev Jobs (http://lists.nycbug.org/pipermail/jobs/2020-April/000553.html)
Feedback/Questions
Greg - Lenovo (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Greg%20-%20Lenovos.md)
Matt - BSD Packaging (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Matt%20-%20BSD%20Packaging.md)
Morgan - Performance (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Morgan%20-%20Performance.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, unix, bsd, interview, crash, crash dump, encryption, encrypted,  dev environment, kernel development, TrueNAS</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>5x if_bridge Performance Improvement, How Unix Won, Understanding VLAN Configuration on FreeBSD, Using bhyve PCI passthrough on OmniOS, TrueNAS 11.3-U2 Available, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/500-if_bridge-performance-improvement/" rel="nofollow">5x if_bridge Performance Improvement</a></h3>

<blockquote>
<p>With FreeBSD Foundation grant, Kristof Provost harnesses new parallel techniques to uncork performance bottleneck </p>

<ul>
<li>Kristof also streamed some of his work, providing an interesting insight into how such development work happens</li>
<li>&gt; <a href="https://www.twitch.tv/provostk/videos" rel="nofollow">https://www.twitch.tv/provostk/videos</a>
***</li>
</ul>
</blockquote>

<h3><a href="https://blog.vivekhaldar.com/post/617189040564928512/how-unix-won" rel="nofollow">How Unix Won</a></h3>

<p>+&gt; Unix has won in every conceivable way. And in true mythic style, it contains the seeds of its own eclipse. This is my subjective historical narrative of how that happened.</p>

<blockquote>
<p>I’m using the name “Unix” to include the entire family of operating systems descended from it, or that have been heavily influenced by it. That includes Linux, SunOS, Solaris, BSD, Mac OS X, and many, many others.<br>
Both major mobile OSs, Android and iOS, have Unix roots. Their billions of users dwarf those using clunky things like laptops and desktops, but even there, Windows is only the non-Unix viable OS. Almost everything running server-side in giant datacenters is Linux.<br>
How did Unix win?</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://blog.socruel.nu/freebsd/check-logs-of-syslog-ng-log-host-on-freebsd.html" rel="nofollow">Check logs of central syslog-ng log host on FreeBSD</a></h3>

<blockquote>
<p>This blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not to difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host. And the solution presented in this blog post works pretty well for me!</p>

<hr>
</blockquote>

<h3><a href="https://genneko.github.io/playing-with-bsd/networking/freebsd-vlan/" rel="nofollow">Understanding VLAN Configuration on FreeBSD</a></h3>

<blockquote>
<p>Until recently, I’ve never had a chance to use VLANs on FreeBSD hosts, though I sometimes configure them on ethernet switches.<br>
But when I was playing with vnet jails, I suddenly got interested in VLAN configuration on FreeBSD and experimented with it for some time.<br>
I wrote this short article to summarize my current understanding of how to configure VLANs on FreeBSD.</p>

<hr>
</blockquote>

<h3><a href="https://www.cyber-tec.org/2019/05/29/using-bhyve-pci-passthrough-on-omnios/" rel="nofollow">Using bhyve PCI passthrough on OmniOS</a></h3>

<blockquote>
<p>Some hardware is not supported in illumos yet, but luckily there is bhyve which supports pci passthrough to any guest operating system. To continue with my OmniOS desktop on &quot;modern&quot; hardware I would love wifi support, so why not using a bhyve guest as router zone which provide the required drivers?</p>

<hr>
</blockquote>

<h3><a href="https://www.ixsystems.com/blog/truenas-11-3-u2-is-available/" rel="nofollow">TrueNAS 11.3-U2 is Generally Available</a></h3>

<blockquote>
<p>TrueNAS 11.3-U2.1 is generally available as of 4/22/2020. This update is based on FreeNAS 11.3-U2 which has had over 50k deployments and received excellent community and third party reviews. The Release Notes are available on the iXsystems.com website.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<p><a href="https://hardenedbsd.org/article/shawn-webb/2020-04-24/hardenedbsd-april-2020-status-report" rel="nofollow">HardenedBSD April 2020 Status Report</a><br>
<a href="http://lists.nycbug.org/pipermail/jobs/2020-April/000553.html" rel="nofollow">NYC Bug’s Mailing List - Listing of open Dev Jobs</a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Greg - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Greg%20-%20Lenovos.md" rel="nofollow">Lenovo</a></li>
<li>Matt - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Matt%20-%20BSD%20Packaging.md" rel="nofollow">BSD Packaging</a></li>
<li><p>Morgan - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Morgan%20-%20Performance.md" rel="nofollow">Performance</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>5x if_bridge Performance Improvement, How Unix Won, Understanding VLAN Configuration on FreeBSD, Using bhyve PCI passthrough on OmniOS, TrueNAS 11.3-U2 Available, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/500-if_bridge-performance-improvement/" rel="nofollow">5x if_bridge Performance Improvement</a></h3>

<blockquote>
<p>With FreeBSD Foundation grant, Kristof Provost harnesses new parallel techniques to uncork performance bottleneck </p>

<ul>
<li>Kristof also streamed some of his work, providing an interesting insight into how such development work happens</li>
<li>&gt; <a href="https://www.twitch.tv/provostk/videos" rel="nofollow">https://www.twitch.tv/provostk/videos</a>
***</li>
</ul>
</blockquote>

<h3><a href="https://blog.vivekhaldar.com/post/617189040564928512/how-unix-won" rel="nofollow">How Unix Won</a></h3>

<p>+&gt; Unix has won in every conceivable way. And in true mythic style, it contains the seeds of its own eclipse. This is my subjective historical narrative of how that happened.</p>

<blockquote>
<p>I’m using the name “Unix” to include the entire family of operating systems descended from it, or that have been heavily influenced by it. That includes Linux, SunOS, Solaris, BSD, Mac OS X, and many, many others.<br>
Both major mobile OSs, Android and iOS, have Unix roots. Their billions of users dwarf those using clunky things like laptops and desktops, but even there, Windows is only the non-Unix viable OS. Almost everything running server-side in giant datacenters is Linux.<br>
How did Unix win?</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://blog.socruel.nu/freebsd/check-logs-of-syslog-ng-log-host-on-freebsd.html" rel="nofollow">Check logs of central syslog-ng log host on FreeBSD</a></h3>

<blockquote>
<p>This blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not to difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host. And the solution presented in this blog post works pretty well for me!</p>

<hr>
</blockquote>

<h3><a href="https://genneko.github.io/playing-with-bsd/networking/freebsd-vlan/" rel="nofollow">Understanding VLAN Configuration on FreeBSD</a></h3>

<blockquote>
<p>Until recently, I’ve never had a chance to use VLANs on FreeBSD hosts, though I sometimes configure them on ethernet switches.<br>
But when I was playing with vnet jails, I suddenly got interested in VLAN configuration on FreeBSD and experimented with it for some time.<br>
I wrote this short article to summarize my current understanding of how to configure VLANs on FreeBSD.</p>

<hr>
</blockquote>

<h3><a href="https://www.cyber-tec.org/2019/05/29/using-bhyve-pci-passthrough-on-omnios/" rel="nofollow">Using bhyve PCI passthrough on OmniOS</a></h3>

<blockquote>
<p>Some hardware is not supported in illumos yet, but luckily there is bhyve which supports pci passthrough to any guest operating system. To continue with my OmniOS desktop on &quot;modern&quot; hardware I would love wifi support, so why not using a bhyve guest as router zone which provide the required drivers?</p>

<hr>
</blockquote>

<h3><a href="https://www.ixsystems.com/blog/truenas-11-3-u2-is-available/" rel="nofollow">TrueNAS 11.3-U2 is Generally Available</a></h3>

<blockquote>
<p>TrueNAS 11.3-U2.1 is generally available as of 4/22/2020. This update is based on FreeNAS 11.3-U2 which has had over 50k deployments and received excellent community and third party reviews. The Release Notes are available on the iXsystems.com website.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<p><a href="https://hardenedbsd.org/article/shawn-webb/2020-04-24/hardenedbsd-april-2020-status-report" rel="nofollow">HardenedBSD April 2020 Status Report</a><br>
<a href="http://lists.nycbug.org/pipermail/jobs/2020-April/000553.html" rel="nofollow">NYC Bug’s Mailing List - Listing of open Dev Jobs</a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Greg - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Greg%20-%20Lenovos.md" rel="nofollow">Lenovo</a></li>
<li>Matt - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Matt%20-%20BSD%20Packaging.md" rel="nofollow">BSD Packaging</a></li>
<li><p>Morgan - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Morgan%20-%20Performance.md" rel="nofollow">Performance</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>349: Entropy Overhaul</title>
  <link>https://www.bsdnow.tv/349</link>
  <guid isPermaLink="false">468d2fe0-ed8f-4e89-aaae-8aa4a0fbf66f</guid>
  <pubDate>Thu, 07 May 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/468d2fe0-ed8f-4e89-aaae-8aa4a0fbf66f.mp3" length="41444019" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Encrypted Crash Dumps in FreeBSD, Time on Unix, Improve ZVOL sync write performance with a taskq, central log host with syslog-ng, NetBSD Entropy overhaul, Setting Up NetBSD Kernel Dev Environment, and more.</itunes:subtitle>
  <itunes:duration>57:33</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Encrypted Crash Dumps in FreeBSD, Time on Unix, Improve ZVOL sync write performance with a taskq, central log host with syslog-ng, NetBSD Entropy overhaul, Setting Up NetBSD Kernel Dev Environment, and more.
Headlines
EKCD - Encrypted Crash Dumps in FreeBSD (https://oshogbo.vexillium.org/blog/74/)
Some time ago, I was describing how to configure networking crash dumps. In that post, I mentioned that there is also the possibility to encrypt crash dumps. Today we will look into this functionality. Initially, it was implemented during Google Summer of Code 2013 by my friend Konrad Witaszczyk, who made it available in FreeBSD 12. If you can understand Polish, you can also look into his presentation on BSD-PL on which he gave a comprehensive review of all kernel crash dumps features.
The main issue with crash dumps is that they may include sensitive information available in memory during a crash. They will contain all the data from the kernel and the userland, like passwords, private keys, etc. While dumping them, they are written to unencrypted storage, so if somebody took out the hard drive, they could access sensitive data. If you are sending a crash dump through the network, it may be captured by third parties. Locally the data are written directly to a dump device, skipping the GEOM subsystem. The purpose of that is to allow a kernel to write a crash dump even in case a panic occurs in the GEOM subsystem. It means that a crash dump cannot be automatically encrypted with GELI.
Time on Unix (https://venam.nixers.net/blog/unix/2020/05/02/time-on-unix.html)
Time, a word that is entangled in everything in our lives, something we’re intimately familiar with. Keeping track of it is important for many activities we do.
Over millennia we’ve developed different ways to calculate it. Most prominently, we’ve relied on the position the sun appears to be at in the sky, what is called apparent solar time.
We’ve decided to split it as seasons pass, counting one full cycle of the 4 seasons as a year, a full rotation around the sun. We’ve also divided the passing of light to the lack thereof as days, a rotation of the earth on itself. Moving on to more precise clock divisions such as seconds, minutes, and hours, units that meant different things at different points in history. Ultimately, as travel got faster, the different ways of counting time that evolved in multiple places had to converge. People had to agree on what it all meant.
See the article for more
News Roundup
Improve ZVOL sync write performance by using a taskq (https://github.com/openzfs/zfs/commit/0929c4de398606f8305057ca540cf577e6771c30)
A central log host with syslog-ng on FreeBSD - Part 1 (https://blog.socruel.nu/freebsd/a-central-log-host-with-syslog-ng-on-freebsd.html)
syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.
HEADS UP: NetBSD Entropy Overhaul (https://mail-index.netbsd.org/current-users/2020/05/01/msg038495.html)
This week I committed an overhaul of the kernel entropy system.  Please let me know if you observe any snags!  For the technical background, see the thread on tech-kern a few months ago: https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html.
Setting Up NetBSD Kernel Dev Environment (https://adityapadala.com/2020/04/20/Setting-Up-NetBSD-Kernel-Dev-Environment/)
I used T_PAGEFLT’s blog post as a reference for setting my NetBSD kernel development environment since his website is down I’m putting down the steps here so it would be helpful for starters.
Beastie Bits
You can now use ccache to speed up dsynth even more. (https://www.dragonflydigest.com/2020/05/04/24480.html)
Improving libossaudio, and the future of OSS in NetBSD (http://blog.netbsd.org/tnf/entry/improving_libossaudio_and_the_future)
DragonFlyBSD DHCPCD Import dhcpcd-9.0.2 with the following changes (http://lists.dragonflybsd.org/pipermail/commits/2020-April/769021.html)
Reminder: watch this space for upcoming FreeBSD Office Hours, next is May 13th at 2pm Eastern, 18:00 UTC (https://wiki.freebsd.org/OfficeHours)
Feedback/Questions
Ghislain - ZFS Question (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Ghislain%20-%20ZFS%20Question.md)
Jake - Paypal Donations (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Jake%20-%20Paypal%20Donations.md)
Oswin - Hammer tutorial (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Oswin%20-%20Hammer%20tutorial.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, crash, crash dump, encryption, encrypted, unix time, zvol, sync, synchronous, sync write, taskq, syslog, syslog-ng, log host, entropy, entropy overhaul, dev environment, kernel development</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Encrypted Crash Dumps in FreeBSD, Time on Unix, Improve ZVOL sync write performance with a taskq, central log host with syslog-ng, NetBSD Entropy overhaul, Setting Up NetBSD Kernel Dev Environment, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://oshogbo.vexillium.org/blog/74/" rel="nofollow">EKCD - Encrypted Crash Dumps in FreeBSD</a></h3>

<blockquote>
<p>Some time ago, I was describing how to configure networking crash dumps. In that post, I mentioned that there is also the possibility to encrypt crash dumps. Today we will look into this functionality. Initially, it was implemented during Google Summer of Code 2013 by my friend Konrad Witaszczyk, who made it available in FreeBSD 12. If you can understand Polish, you can also look into his presentation on BSD-PL on which he gave a comprehensive review of all kernel crash dumps features.</p>

<p>The main issue with crash dumps is that they may include sensitive information available in memory during a crash. They will contain all the data from the kernel and the userland, like passwords, private keys, etc. While dumping them, they are written to unencrypted storage, so if somebody took out the hard drive, they could access sensitive data. If you are sending a crash dump through the network, it may be captured by third parties. Locally the data are written directly to a dump device, skipping the GEOM subsystem. The purpose of that is to allow a kernel to write a crash dump even in case a panic occurs in the GEOM subsystem. It means that a crash dump cannot be automatically encrypted with GELI.</p>
</blockquote>

<hr>

<h3><a href="https://venam.nixers.net/blog/unix/2020/05/02/time-on-unix.html" rel="nofollow">Time on Unix</a></h3>

<blockquote>
<p>Time, a word that is entangled in everything in our lives, something we’re intimately familiar with. Keeping track of it is important for many activities we do.</p>

<p>Over millennia we’ve developed different ways to calculate it. Most prominently, we’ve relied on the position the sun appears to be at in the sky, what is called apparent solar time.</p>

<p>We’ve decided to split it as seasons pass, counting one full cycle of the 4 seasons as a year, a full rotation around the sun. We’ve also divided the passing of light to the lack thereof as days, a rotation of the earth on itself. Moving on to more precise clock divisions such as seconds, minutes, and hours, units that meant different things at different points in history. Ultimately, as travel got faster, the different ways of counting time that evolved in multiple places had to converge. People had to agree on what it all meant.</p>
</blockquote>

<p>See the article for more</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/openzfs/zfs/commit/0929c4de398606f8305057ca540cf577e6771c30" rel="nofollow">Improve ZVOL sync write performance by using a taskq</a></h3>

<hr>

<h3><a href="https://blog.socruel.nu/freebsd/a-central-log-host-with-syslog-ng-on-freebsd.html" rel="nofollow">A central log host with syslog-ng on FreeBSD - Part 1</a></h3>

<blockquote>
<p>syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.</p>
</blockquote>

<hr>

<h3><a href="https://mail-index.netbsd.org/current-users/2020/05/01/msg038495.html" rel="nofollow">HEADS UP: NetBSD Entropy Overhaul</a></h3>

<blockquote>
<p>This week I committed an overhaul of the kernel entropy system.  Please let me know if you observe any snags!  For the technical background, see the thread on tech-kern a few months ago: <a href="https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html" rel="nofollow">https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html</a>.</p>
</blockquote>

<hr>

<h3><a href="https://adityapadala.com/2020/04/20/Setting-Up-NetBSD-Kernel-Dev-Environment/" rel="nofollow">Setting Up NetBSD Kernel Dev Environment</a></h3>

<blockquote>
<p>I used T_PAGEFLT’s blog post as a reference for setting my NetBSD kernel development environment since his website is down I’m putting down the steps here so it would be helpful for starters.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/05/04/24480.html" rel="nofollow">You can now use ccache to speed up dsynth even more.</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/improving_libossaudio_and_the_future" rel="nofollow">Improving libossaudio, and the future of OSS in NetBSD</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-April/769021.html" rel="nofollow">DragonFlyBSD DHCPCD Import dhcpcd-9.0.2 with the following changes</a></li>
<li><a href="https://wiki.freebsd.org/OfficeHours" rel="nofollow">Reminder: watch this space for upcoming FreeBSD Office Hours, next is May 13th at 2pm Eastern, 18:00 UTC</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Ghislain - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Ghislain%20-%20ZFS%20Question.md" rel="nofollow">ZFS Question</a></li>
<li>Jake - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Jake%20-%20Paypal%20Donations.md" rel="nofollow">Paypal Donations</a></li>
<li>Oswin - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Oswin%20-%20Hammer%20tutorial.md" rel="nofollow">Hammer tutorial</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0348.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Encrypted Crash Dumps in FreeBSD, Time on Unix, Improve ZVOL sync write performance with a taskq, central log host with syslog-ng, NetBSD Entropy overhaul, Setting Up NetBSD Kernel Dev Environment, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://oshogbo.vexillium.org/blog/74/" rel="nofollow">EKCD - Encrypted Crash Dumps in FreeBSD</a></h3>

<blockquote>
<p>Some time ago, I was describing how to configure networking crash dumps. In that post, I mentioned that there is also the possibility to encrypt crash dumps. Today we will look into this functionality. Initially, it was implemented during Google Summer of Code 2013 by my friend Konrad Witaszczyk, who made it available in FreeBSD 12. If you can understand Polish, you can also look into his presentation on BSD-PL on which he gave a comprehensive review of all kernel crash dumps features.</p>

<p>The main issue with crash dumps is that they may include sensitive information available in memory during a crash. They will contain all the data from the kernel and the userland, like passwords, private keys, etc. While dumping them, they are written to unencrypted storage, so if somebody took out the hard drive, they could access sensitive data. If you are sending a crash dump through the network, it may be captured by third parties. Locally the data are written directly to a dump device, skipping the GEOM subsystem. The purpose of that is to allow a kernel to write a crash dump even in case a panic occurs in the GEOM subsystem. It means that a crash dump cannot be automatically encrypted with GELI.</p>
</blockquote>

<hr>

<h3><a href="https://venam.nixers.net/blog/unix/2020/05/02/time-on-unix.html" rel="nofollow">Time on Unix</a></h3>

<blockquote>
<p>Time, a word that is entangled in everything in our lives, something we’re intimately familiar with. Keeping track of it is important for many activities we do.</p>

<p>Over millennia we’ve developed different ways to calculate it. Most prominently, we’ve relied on the position the sun appears to be at in the sky, what is called apparent solar time.</p>

<p>We’ve decided to split it as seasons pass, counting one full cycle of the 4 seasons as a year, a full rotation around the sun. We’ve also divided the passing of light to the lack thereof as days, a rotation of the earth on itself. Moving on to more precise clock divisions such as seconds, minutes, and hours, units that meant different things at different points in history. Ultimately, as travel got faster, the different ways of counting time that evolved in multiple places had to converge. People had to agree on what it all meant.</p>
</blockquote>

<p>See the article for more</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/openzfs/zfs/commit/0929c4de398606f8305057ca540cf577e6771c30" rel="nofollow">Improve ZVOL sync write performance by using a taskq</a></h3>

<hr>

<h3><a href="https://blog.socruel.nu/freebsd/a-central-log-host-with-syslog-ng-on-freebsd.html" rel="nofollow">A central log host with syslog-ng on FreeBSD - Part 1</a></h3>

<blockquote>
<p>syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.</p>
</blockquote>

<hr>

<h3><a href="https://mail-index.netbsd.org/current-users/2020/05/01/msg038495.html" rel="nofollow">HEADS UP: NetBSD Entropy Overhaul</a></h3>

<blockquote>
<p>This week I committed an overhaul of the kernel entropy system.  Please let me know if you observe any snags!  For the technical background, see the thread on tech-kern a few months ago: <a href="https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html" rel="nofollow">https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html</a>.</p>
</blockquote>

<hr>

<h3><a href="https://adityapadala.com/2020/04/20/Setting-Up-NetBSD-Kernel-Dev-Environment/" rel="nofollow">Setting Up NetBSD Kernel Dev Environment</a></h3>

<blockquote>
<p>I used T_PAGEFLT’s blog post as a reference for setting my NetBSD kernel development environment since his website is down I’m putting down the steps here so it would be helpful for starters.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/05/04/24480.html" rel="nofollow">You can now use ccache to speed up dsynth even more.</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/improving_libossaudio_and_the_future" rel="nofollow">Improving libossaudio, and the future of OSS in NetBSD</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-April/769021.html" rel="nofollow">DragonFlyBSD DHCPCD Import dhcpcd-9.0.2 with the following changes</a></li>
<li><a href="https://wiki.freebsd.org/OfficeHours" rel="nofollow">Reminder: watch this space for upcoming FreeBSD Office Hours, next is May 13th at 2pm Eastern, 18:00 UTC</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Ghislain - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Ghislain%20-%20ZFS%20Question.md" rel="nofollow">ZFS Question</a></li>
<li>Jake - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Jake%20-%20Paypal%20Donations.md" rel="nofollow">Paypal Donations</a></li>
<li>Oswin - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Oswin%20-%20Hammer%20tutorial.md" rel="nofollow">Hammer tutorial</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0348.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>348: BSD Community Collections</title>
  <link>https://www.bsdnow.tv/348</link>
  <guid isPermaLink="false">ed288ede-fe94-433f-85a4-6eebb8cb2478</guid>
  <pubDate>Thu, 30 Apr 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ed288ede-fe94-433f-85a4-6eebb8cb2478.mp3" length="43398814" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FuryBSD 2020Q2 Images Available, Technical reasons to choose FreeBSD over GNU/Linux, Ars technica reviews GhostBSD, “TLS Mastery” sponsorships open, BSD community show their various collections, a tale of OpenBSD secure memory allocator internals, learn to stop worrying and love SSDs, and more.</itunes:subtitle>
  <itunes:duration>1:00:16</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FuryBSD 2020Q2 Images Available, Technical reasons to choose FreeBSD over GNU/Linux, Ars technica reviews GhostBSD, “TLS Mastery” sponsorships open, BSD community show their various collections, a tale of OpenBSD secure memory allocator internals, learn to stop worrying and love SSDs, and more.
Headlines
FuryBSD 2020Q2 Images Available for XFCE and KDE (https://www.furybsd.org/furybsd-2020-q2-images-are-available-for-xfce-and-kde/)
The Q2 2020 images are not a visible leap forward but a functional leap forward.  Most effort was spent creating a better out of box experience for automatic Ethernet configuration, working WiFi, webcam, and improved hypervisor support. 
Technical reasons to choose FreeBSD over GNU/Linux (https://unixsheikh.com/articles/technical-reasons-to-choose-freebsd-over-linux.html)
Since I wrote my article "Why you should migrate everything from Linux to BSD" I have been wanting to write something about the technical reasons to choose FreeBSD over GNU/Linux and while I cannot possibly cover every single reason, I can write about some of the things that I consider worth noting.
News Roundup
+ Not actually Linux distro review deux: GhostBSD (https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-deux-ghostbsd/)
When I began work on the FreeBSD 12.1-RELEASE review last week, it didn't take long to figure out that the desktop portion wasn't going very smoothly.
I think it's important for BSD-curious users to know of easier, gentler alternatives, so I did a little looking around and settled on GhostBSD for a follow-up review.
GhostBSD is based on TrueOS, which itself derives from FreeBSD Stable. It was originally a Canadian distro, but—like most successful distributions—it has transcended its country of origin and can now be considered worldwide. Significant GhostBSD development takes place now in Canada, Italy, Germany, and the United States.
“TLS Mastery” sponsorships open (https://mwl.io/archives/6265)
My next book will be TLS Mastery, all about Transport Layer Encryption, Let’s Encrypt, OCSP, and so on.
This should be a shorter book, more like my DNSSEC or Tarsnap titles, or the first edition of Sudo Mastery. I would like a break from writing doorstops like the SNMP and jails books.
JT (our producer) shared his Open Source Retail Box Collection on twitter this past weekend and there was a nice response from a few in the BSD Community showing their collections:
JT's post: https://twitter.com/q5sys/status/1251194823589138432
High Resolution Image to see the bottom shelf better: https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg
Closeup of the BSD Section: https://twitter.com/q5sys/status/1251294290782928897
Others jumped in with their collections:
Deb Goodkin's collection: https://twitter.com/dgoodkin/status/1251294016139743232 &amp;amp; https://twitter.com/dgoodkin/status/1251298125672660992
FreeBSD Frau's FreeBSD Collection: https://twitter.com/freebsdfrau/status/1251290430475350018
Jason Tubnor's OpenBSD Collection: https://twitter.com/Tubsta/status/1251265902214918144
Do you have a nice collection, take a picture and send it in!
Tale of OpenBSD secure memory allocator internals - malloc(3) (https://bsdb0y.github.io/blog/deep-dive-into-the-OpenBSD-malloc-and-friends-internals-part-1.html)
Hi there,
It's been a very long time I haven't written anything after my last OpenBSD blogs, that is, 
OpenBSD Kernel Internals — Creation of process from user-space to kernel space.
OpenBSD: Introduction to execpromises in the pledge(2)
pledge(2): OpenBSD's defensive approach to OS Security
So, again I started reading OpenBSD source codes with debugger after reducing my sleep timings and managing to get some time after professional life. This time I have picked one of my favourite item from my wishlist to learn and share, that is, OpenBSD malloc(3), secure allocator
How I learned to stop worrying and love SSDs (https://www.ixsystems.com/community/threads/how-i-learned-to-stop-worrying-and-love-ssds.82617/)
my home FreeNAS runs two pools for data. One RAIDZ2 with four spinning disk drives and one mirror with two SSDs. Toying with InfluxDB and Grafana in the last couple of days I found that I seem to have a constant write load of 1 Megabyte (!) per second on the SSDs. What the ...?
So I run three VMs on the SSDs in total. One with Windows 10, two with Ubuntu running Confluence, A wiki essentially, with files for attachments and MySQL as the backend database. Clearly the writes had to stop when the wikis were not used at all, just sitting idle, right?
Well even with a full query log and quite some experience in the operation of web applications I could not figure out what Confluence is doing (productively, no doubt) but trust me, it writes a couple of hundred kbytes to the database each second just sitting idle.
My infrastructure as of 2019 (https://chown.me/blog/infrastructure-2019.html)
I've wanted to write about my infrastructure for a while, but I kept thinking, "I'll wait until after I've done $nextthingonmytodo." Of course this cycle never ends, so I decided to write about its state at the end of 2019. Maybe I'll write an update on it in a couple of moons; who knows?
For something different than our usual Beastie Bits… we bring you…
We're all quarantined so lets install BSD on things!  Install BSD on something this week, write it up and let us know about it, and maybe we'll feature you!
Installation of NetBSD on a Mac Mini (https://e17i.github.io/articles-netbsd-install/)
OpenBSD on the HP Envy 13 (https://icyphox.sh/blog/openbsd-hp-envy/)
Install NetBSD on a Vintage Computer (https://www.rs-online.com/designspark/install-netbsd-on-a-vintage-computer)
BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC (https://twitter.com/allanjude/status/1251895348836143104)
Allan started a series of FreeBSD Office Hours (https://wiki.freebsd.org/OfficeHours)
BSDNow is going Independent
After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements.
What does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.
Feedback/Questions
Todd - LinusTechTips Claims about ZFS (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/348/feedback/Todd%20-%20LinusTechTips'%20claims%20on%20ZFS.md)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, furybsd, kde, xfce, GhostBSD, Ars Technica, TLS, tls mastery, tls mastery book, book sponsorship, collections, secure memory allocator, internals, memory allocator, memory allocator internals, ssd, solid state drive</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FuryBSD 2020Q2 Images Available, Technical reasons to choose FreeBSD over GNU/Linux, Ars technica reviews GhostBSD, “TLS Mastery” sponsorships open, BSD community show their various collections, a tale of OpenBSD secure memory allocator internals, learn to stop worrying and love SSDs, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.furybsd.org/furybsd-2020-q2-images-are-available-for-xfce-and-kde/" rel="nofollow">FuryBSD 2020Q2 Images Available for XFCE and KDE</a></h3>

<blockquote>
<p>The Q2 2020 images are not a visible leap forward but a functional leap forward.  Most effort was spent creating a better out of box experience for automatic Ethernet configuration, working WiFi, webcam, and improved hypervisor support. </p>
</blockquote>

<hr>

<h3><a href="https://unixsheikh.com/articles/technical-reasons-to-choose-freebsd-over-linux.html" rel="nofollow">Technical reasons to choose FreeBSD over GNU/Linux</a></h3>

<blockquote>
<p>Since I wrote my article &quot;Why you should migrate everything from Linux to BSD&quot; I have been wanting to write something about the technical reasons to choose FreeBSD over GNU/Linux and while I cannot possibly cover every single reason, I can write about some of the things that I consider worth noting.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3>+ <a href="https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-deux-ghostbsd/" rel="nofollow">Not actually Linux distro review deux: GhostBSD</a></h3>

<blockquote>
<p>When I began work on the FreeBSD 12.1-RELEASE review last week, it didn&#39;t take long to figure out that the desktop portion wasn&#39;t going very smoothly.</p>

<p>I think it&#39;s important for BSD-curious users to know of easier, gentler alternatives, so I did a little looking around and settled on GhostBSD for a follow-up review.</p>

<p>GhostBSD is based on TrueOS, which itself derives from FreeBSD Stable. It was originally a Canadian distro, but—like most successful distributions—it has transcended its country of origin and can now be considered worldwide. Significant GhostBSD development takes place now in Canada, Italy, Germany, and the United States.</p>
</blockquote>

<hr>

<h3><a href="https://mwl.io/archives/6265" rel="nofollow">“TLS Mastery” sponsorships open</a></h3>

<blockquote>
<p>My next book will be TLS Mastery, all about Transport Layer Encryption, Let’s Encrypt, OCSP, and so on.</p>

<p>This should be a shorter book, more like my DNSSEC or Tarsnap titles, or the first edition of Sudo Mastery. I would like a break from writing doorstops like the SNMP and jails books.</p>
</blockquote>

<hr>

<h3>JT (our producer) shared his Open Source Retail Box Collection on twitter this past weekend and there was a nice response from a few in the BSD Community showing their collections:</h3>

<ul>
<li><p>JT&#39;s post: <a href="https://twitter.com/q5sys/status/1251194823589138432" rel="nofollow">https://twitter.com/q5sys/status/1251194823589138432</a></p>

<ul>
<li>High Resolution Image to see the bottom shelf better: <a href="https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg</a></li>
<li>Closeup of the BSD Section: <a href="https://twitter.com/q5sys/status/1251294290782928897" rel="nofollow">https://twitter.com/q5sys/status/1251294290782928897</a></li>
</ul></li>
<li><p>Others jumped in with their collections:</p>

<ul>
<li>Deb Goodkin&#39;s collection: <a href="https://twitter.com/dgoodkin/status/1251294016139743232" rel="nofollow">https://twitter.com/dgoodkin/status/1251294016139743232</a> &amp; <a href="https://twitter.com/dgoodkin/status/1251298125672660992" rel="nofollow">https://twitter.com/dgoodkin/status/1251298125672660992</a></li>
<li>FreeBSD Frau&#39;s FreeBSD Collection: <a href="https://twitter.com/freebsdfrau/status/1251290430475350018" rel="nofollow">https://twitter.com/freebsdfrau/status/1251290430475350018</a></li>
<li>Jason Tubnor&#39;s OpenBSD Collection: <a href="https://twitter.com/Tubsta/status/1251265902214918144" rel="nofollow">https://twitter.com/Tubsta/status/1251265902214918144</a></li>
</ul></li>
</ul>

<p>Do you have a nice collection, take a picture and send it in!</p>

<hr>

<h3><a href="https://bsdb0y.github.io/blog/deep-dive-into-the-OpenBSD-malloc-and-friends-internals-part-1.html" rel="nofollow">Tale of OpenBSD secure memory allocator internals - malloc(3)</a></h3>

<blockquote>
<p>Hi there,</p>

<p>It&#39;s been a very long time I haven&#39;t written anything after my last OpenBSD blogs, that is, </p>

<p>OpenBSD Kernel Internals — Creation of process from user-space to kernel space.</p>

<p>OpenBSD: Introduction to <code>execpromises</code> in the pledge(2)</p>

<p>pledge(2): OpenBSD&#39;s defensive approach to OS Security</p>

<p>So, again I started reading OpenBSD source codes with debugger after reducing my sleep timings and managing to get some time after professional life. This time I have picked one of my favourite item from my wishlist to learn and share, that is, OpenBSD malloc(3), secure allocator</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/community/threads/how-i-learned-to-stop-worrying-and-love-ssds.82617/" rel="nofollow">How I learned to stop worrying and love SSDs</a></h3>

<blockquote>
<p>my home FreeNAS runs two pools for data. One RAIDZ2 with four spinning disk drives and one mirror with two SSDs. Toying with InfluxDB and Grafana in the last couple of days I found that I seem to have a constant write load of 1 Megabyte (!) per second on the SSDs. What the ...?</p>

<p>So I run three VMs on the SSDs in total. One with Windows 10, two with Ubuntu running Confluence, A wiki essentially, with files for attachments and MySQL as the backend database. Clearly the writes had to stop when the wikis were not used at all, just sitting idle, right?</p>

<p>Well even with a full query log and quite some experience in the operation of web applications I could not figure out what Confluence is doing (productively, no doubt) but trust me, it writes a couple of hundred kbytes to the database each second just sitting idle.</p>
</blockquote>

<hr>

<h3><a href="https://chown.me/blog/infrastructure-2019.html" rel="nofollow">My infrastructure as of 2019</a></h3>

<blockquote>
<p>I&#39;ve wanted to write about my infrastructure for a while, but I kept thinking, &quot;I&#39;ll wait until after I&#39;ve done $next_thing_on_my_todo.&quot; Of course this cycle never ends, so I decided to write about its state at the end of 2019. Maybe I&#39;ll write an update on it in a couple of moons; who knows?</p>
</blockquote>

<hr>

<h2>For something different than our usual Beastie Bits… we bring you…</h2>

<h2>We&#39;re all quarantined so lets install BSD on things!  Install BSD on something this week, write it up and let us know about it, and maybe we&#39;ll feature you!</h2>

<ul>
<li><p><a href="https://e17i.github.io/articles-netbsd-install/" rel="nofollow">Installation of NetBSD on a Mac Mini</a></p></li>
<li><p><a href="https://icyphox.sh/blog/openbsd-hp-envy/" rel="nofollow">OpenBSD on the HP Envy 13</a></p></li>
<li><p><a href="https://www.rs-online.com/designspark/install-netbsd-on-a-vintage-computer" rel="nofollow">Install NetBSD on a Vintage Computer</a></p></li>
<li><p><a href="https://twitter.com/allanjude/status/1251895348836143104" rel="nofollow">BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC</a></p></li>
<li><p><a href="https://wiki.freebsd.org/OfficeHours" rel="nofollow">Allan started a series of FreeBSD Office Hours</a></p></li>
</ul>

<hr>

<h2>BSDNow is going Independent</h2>

<ul>
<li>After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements.
What does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Todd - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/348/feedback/Todd%20-%20LinusTechTips&#x27;%20claims%20on%20ZFS.md" rel="nofollow">LinusTechTips Claims about ZFS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0348.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FuryBSD 2020Q2 Images Available, Technical reasons to choose FreeBSD over GNU/Linux, Ars technica reviews GhostBSD, “TLS Mastery” sponsorships open, BSD community show their various collections, a tale of OpenBSD secure memory allocator internals, learn to stop worrying and love SSDs, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.furybsd.org/furybsd-2020-q2-images-are-available-for-xfce-and-kde/" rel="nofollow">FuryBSD 2020Q2 Images Available for XFCE and KDE</a></h3>

<blockquote>
<p>The Q2 2020 images are not a visible leap forward but a functional leap forward.  Most effort was spent creating a better out of box experience for automatic Ethernet configuration, working WiFi, webcam, and improved hypervisor support. </p>
</blockquote>

<hr>

<h3><a href="https://unixsheikh.com/articles/technical-reasons-to-choose-freebsd-over-linux.html" rel="nofollow">Technical reasons to choose FreeBSD over GNU/Linux</a></h3>

<blockquote>
<p>Since I wrote my article &quot;Why you should migrate everything from Linux to BSD&quot; I have been wanting to write something about the technical reasons to choose FreeBSD over GNU/Linux and while I cannot possibly cover every single reason, I can write about some of the things that I consider worth noting.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3>+ <a href="https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-deux-ghostbsd/" rel="nofollow">Not actually Linux distro review deux: GhostBSD</a></h3>

<blockquote>
<p>When I began work on the FreeBSD 12.1-RELEASE review last week, it didn&#39;t take long to figure out that the desktop portion wasn&#39;t going very smoothly.</p>

<p>I think it&#39;s important for BSD-curious users to know of easier, gentler alternatives, so I did a little looking around and settled on GhostBSD for a follow-up review.</p>

<p>GhostBSD is based on TrueOS, which itself derives from FreeBSD Stable. It was originally a Canadian distro, but—like most successful distributions—it has transcended its country of origin and can now be considered worldwide. Significant GhostBSD development takes place now in Canada, Italy, Germany, and the United States.</p>
</blockquote>

<hr>

<h3><a href="https://mwl.io/archives/6265" rel="nofollow">“TLS Mastery” sponsorships open</a></h3>

<blockquote>
<p>My next book will be TLS Mastery, all about Transport Layer Encryption, Let’s Encrypt, OCSP, and so on.</p>

<p>This should be a shorter book, more like my DNSSEC or Tarsnap titles, or the first edition of Sudo Mastery. I would like a break from writing doorstops like the SNMP and jails books.</p>
</blockquote>

<hr>

<h3>JT (our producer) shared his Open Source Retail Box Collection on twitter this past weekend and there was a nice response from a few in the BSD Community showing their collections:</h3>

<ul>
<li><p>JT&#39;s post: <a href="https://twitter.com/q5sys/status/1251194823589138432" rel="nofollow">https://twitter.com/q5sys/status/1251194823589138432</a></p>

<ul>
<li>High Resolution Image to see the bottom shelf better: <a href="https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg" rel="nofollow">https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg</a></li>
<li>Closeup of the BSD Section: <a href="https://twitter.com/q5sys/status/1251294290782928897" rel="nofollow">https://twitter.com/q5sys/status/1251294290782928897</a></li>
</ul></li>
<li><p>Others jumped in with their collections:</p>

<ul>
<li>Deb Goodkin&#39;s collection: <a href="https://twitter.com/dgoodkin/status/1251294016139743232" rel="nofollow">https://twitter.com/dgoodkin/status/1251294016139743232</a> &amp; <a href="https://twitter.com/dgoodkin/status/1251298125672660992" rel="nofollow">https://twitter.com/dgoodkin/status/1251298125672660992</a></li>
<li>FreeBSD Frau&#39;s FreeBSD Collection: <a href="https://twitter.com/freebsdfrau/status/1251290430475350018" rel="nofollow">https://twitter.com/freebsdfrau/status/1251290430475350018</a></li>
<li>Jason Tubnor&#39;s OpenBSD Collection: <a href="https://twitter.com/Tubsta/status/1251265902214918144" rel="nofollow">https://twitter.com/Tubsta/status/1251265902214918144</a></li>
</ul></li>
</ul>

<p>Do you have a nice collection, take a picture and send it in!</p>

<hr>

<h3><a href="https://bsdb0y.github.io/blog/deep-dive-into-the-OpenBSD-malloc-and-friends-internals-part-1.html" rel="nofollow">Tale of OpenBSD secure memory allocator internals - malloc(3)</a></h3>

<blockquote>
<p>Hi there,</p>

<p>It&#39;s been a very long time I haven&#39;t written anything after my last OpenBSD blogs, that is, </p>

<p>OpenBSD Kernel Internals — Creation of process from user-space to kernel space.</p>

<p>OpenBSD: Introduction to <code>execpromises</code> in the pledge(2)</p>

<p>pledge(2): OpenBSD&#39;s defensive approach to OS Security</p>

<p>So, again I started reading OpenBSD source codes with debugger after reducing my sleep timings and managing to get some time after professional life. This time I have picked one of my favourite item from my wishlist to learn and share, that is, OpenBSD malloc(3), secure allocator</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/community/threads/how-i-learned-to-stop-worrying-and-love-ssds.82617/" rel="nofollow">How I learned to stop worrying and love SSDs</a></h3>

<blockquote>
<p>my home FreeNAS runs two pools for data. One RAIDZ2 with four spinning disk drives and one mirror with two SSDs. Toying with InfluxDB and Grafana in the last couple of days I found that I seem to have a constant write load of 1 Megabyte (!) per second on the SSDs. What the ...?</p>

<p>So I run three VMs on the SSDs in total. One with Windows 10, two with Ubuntu running Confluence, A wiki essentially, with files for attachments and MySQL as the backend database. Clearly the writes had to stop when the wikis were not used at all, just sitting idle, right?</p>

<p>Well even with a full query log and quite some experience in the operation of web applications I could not figure out what Confluence is doing (productively, no doubt) but trust me, it writes a couple of hundred kbytes to the database each second just sitting idle.</p>
</blockquote>

<hr>

<h3><a href="https://chown.me/blog/infrastructure-2019.html" rel="nofollow">My infrastructure as of 2019</a></h3>

<blockquote>
<p>I&#39;ve wanted to write about my infrastructure for a while, but I kept thinking, &quot;I&#39;ll wait until after I&#39;ve done $next_thing_on_my_todo.&quot; Of course this cycle never ends, so I decided to write about its state at the end of 2019. Maybe I&#39;ll write an update on it in a couple of moons; who knows?</p>
</blockquote>

<hr>

<h2>For something different than our usual Beastie Bits… we bring you…</h2>

<h2>We&#39;re all quarantined so lets install BSD on things!  Install BSD on something this week, write it up and let us know about it, and maybe we&#39;ll feature you!</h2>

<ul>
<li><p><a href="https://e17i.github.io/articles-netbsd-install/" rel="nofollow">Installation of NetBSD on a Mac Mini</a></p></li>
<li><p><a href="https://icyphox.sh/blog/openbsd-hp-envy/" rel="nofollow">OpenBSD on the HP Envy 13</a></p></li>
<li><p><a href="https://www.rs-online.com/designspark/install-netbsd-on-a-vintage-computer" rel="nofollow">Install NetBSD on a Vintage Computer</a></p></li>
<li><p><a href="https://twitter.com/allanjude/status/1251895348836143104" rel="nofollow">BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC</a></p></li>
<li><p><a href="https://wiki.freebsd.org/OfficeHours" rel="nofollow">Allan started a series of FreeBSD Office Hours</a></p></li>
</ul>

<hr>

<h2>BSDNow is going Independent</h2>

<ul>
<li>After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements.
What does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Todd - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/348/feedback/Todd%20-%20LinusTechTips&#x27;%20claims%20on%20ZFS.md" rel="nofollow">LinusTechTips Claims about ZFS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0348.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>347: New Directions</title>
  <link>https://www.bsdnow.tv/347</link>
  <guid isPermaLink="false">25cb0a70-b178-4702-8e8f-a8e7427a9ae2</guid>
  <pubDate>Thu, 23 Apr 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/25cb0a70-b178-4702-8e8f-a8e7427a9ae2.mp3" length="43806325" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Rethinking OpenBSD security, FreeBSD 2020 Q1 status report, the notion of progress and user interfaces, Comments about Thomas E. Dickey on NetBSD curses, making Unix a little more Plan9-like, Not-actually Linux distro review: FreeBSD, and more.</itunes:subtitle>
  <itunes:duration>1:00:50</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Rethinking OpenBSD security, FreeBSD 2020 Q1 status report, the notion of progress and user interfaces, Comments about Thomas E. Dickey on NetBSD curses, making Unix a little more Plan9-like, Not-actually Linux distro review: FreeBSD, and more.
Headlines
Rethinking OpenBSD Security (https://flak.tedunangst.com/post/rethinking-openbsd-security)
OpenBSD aims to be a secure operating system. In the past few months there were quite a few security errata, however. That’s not too unusual, but some of the recent ones were a bit special. One might even say bad. The OpenBSD approach to security has a few aspects, two of which might be avoiding errors and minimizing the risk of mistakes. Other people have other ideas about how to build secure systems. I think it’s worth examining whether the OpenBSD approach works, or if this is evidence that it’s doomed to failure.
I picked a few errata, not all of them, that were interesting and happened to suit my narrative.
FreeBSD 2020 Q1 Quarterly report (https://www.freebsd.org/news/status/report-2020-01-2020-03.html)
Welcome, to the quarterly reports, of the future! Well, at least the first quarterly report from 2020. The new timeline, mentioned in the last few reports, still holds, which brings us to this report, which covers the period of January 2020 - March 2020.
News Roundup
The Notion of Progress and User Interfaces (https://herebeseaswines.net/essays/2020-04-13-the-notion-of-progress-and-user-interfaces)
One trait of modern Western culture is the notion of progress. A view claiming, at large, everything is getting better and better.
How should we think about progress? Both in general and regarding technology?
Thomas E. Dickey on NetBSD curses (https://implementality.blogspot.com/2020/04/thomas-e-dickey-on-netbsd-curses.html)
I was recently pointed at a web page on Thomas E. Dickeys site talking about NetBSD curses.  It seems initially that the page was intended to be a pointer to some differences between ncurses and NetBSD curses and does appear to start off in this vein but it seems that the author has lost the plot as the document evolved and the tail end of it seems to be devolving into some sort of slanging match.  I don't want to go through Mr. Dickey's document point by point, that would be tedious but I would like to pick out some of the things that I believe to be the most egregious.  Please note that even though I am a NetBSD developer, the opinions below are my own and not the NetBSD projects.
Making Unix a little more Plan9-like (https://woozle.org/papers/plan9.html)
I’m not really interested in defending anything. I tried out plan9port and liked it, but I have to live in Unix land. Here’s how I set that up.
A Warning
The suckless community, and some of the plan9 communities, are dominated by jackasses. I hope that’s strong enough wording to impress the severity. Don’t go into IRC for help. Stay off the suckless email list. The software is great, the people who write it are well-spoken and well-reasoned, but for some reason the fandom is horrible to everyone.
Not-actually Linux distro review: FreeBSD 12.1-RELEASE (https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-freebsd-12-1-release/)
This month's Linux distro review isn't of a Linux distribution at all—instead, we're taking a look at FreeBSD, the original gangster of free Unix-like operating systems.
The first FreeBSD release was in 1993, but the operating system's roots go further back—considerably further back. FreeBSD started out in 1992 as a patch-release of Bill and Lynne Jolitz's 386BSD—but 386BSD itself came from the original Berkeley Software Distribution (BSD). BSD itself goes back to 1977—for reference, Linus Torvalds was only seven years old then.
Before we get started, I'd like to acknowledge something up front—our distro reviews include the desktop experience, and that is very much not FreeBSD's strength. FreeBSD is far, far better suited to running as a headless server than as a desktop! We're going to get a full desktop running on it anyway, because according to Lee Hutchinson, I hate myself—and also because we can't imagine readers wouldn't care about it.
FreeBSD does not provide a good desktop experience, to say the least. But if you're hankering for a BSD-based desktop, don't worry—we're already planning a followup review of GhostBSD, a desktop-focused BSD distribution.
Beastie Bits
Wifi renewal restarted (https://blog.netbsd.org/tnf/entry/wifi_renewal_restarted)
HAMMER2 and a quick start for DragonFly (https://www.dragonflydigest.com/2020/04/21/24421.html)
Engineering NetBSD 9.0 (http://netbsd.org/~kamil/AsiaBSDCon/Kamil_Rytarowski_Engineering_NetBSD_9.0.pdf)
Antivirus Protection using OPNsense Plugins (https://www.youtube.com/watch?v=94vz_-5lAkE)
BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC (https://twitter.com/allanjude/status/1251895348836143104)
BSDNow is going Independent
After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements. LinuxAcademy is now under new leadership, and we understand that cutbacks needed to be made, and that BSD is not their core product. That does not mean your favourite BSD podcast is going away, we will continue and we expect things will not look much different. 
What does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.
Feedback/Questions
Jordyn - ZFS Pool Problem (https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/347/feedback/Jordyn%20zfs%20pool%20problem.md)
debug - https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, security, status report, status, Q1, Q1 2020, progress, UI, user interface, Thomas Dickey, Thomas E. Dickey, curses, plan 9, distro, review, distro review, ars technica</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Rethinking OpenBSD security, FreeBSD 2020 Q1 status report, the notion of progress and user interfaces, Comments about Thomas E. Dickey on NetBSD curses, making Unix a little more Plan9-like, Not-actually Linux distro review: FreeBSD, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://flak.tedunangst.com/post/rethinking-openbsd-security" rel="nofollow">Rethinking OpenBSD Security</a></h3>

<blockquote>
<p>OpenBSD aims to be a secure operating system. In the past few months there were quite a few security errata, however. That’s not too unusual, but some of the recent ones were a bit special. One might even say bad. The OpenBSD approach to security has a few aspects, two of which might be avoiding errors and minimizing the risk of mistakes. Other people have other ideas about how to build secure systems. I think it’s worth examining whether the OpenBSD approach works, or if this is evidence that it’s doomed to failure.<br>
I picked a few errata, not all of them, that were interesting and happened to suit my narrative.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsd.org/news/status/report-2020-01-2020-03.html" rel="nofollow">FreeBSD 2020 Q1 Quarterly report</a></h3>

<blockquote>
<p>Welcome, to the quarterly reports, of the future! Well, at least the first quarterly report from 2020. The new timeline, mentioned in the last few reports, still holds, which brings us to this report, which covers the period of January 2020 - March 2020.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://herebeseaswines.net/essays/2020-04-13-the-notion-of-progress-and-user-interfaces" rel="nofollow">The Notion of Progress and User Interfaces</a></h3>

<blockquote>
<p>One trait of modern Western culture is the notion of progress. A view claiming, at large, everything is getting better and better.</p>

<p>How should we think about progress? Both in general and regarding technology?</p>
</blockquote>

<hr>

<h3><a href="https://implementality.blogspot.com/2020/04/thomas-e-dickey-on-netbsd-curses.html" rel="nofollow">Thomas E. Dickey on NetBSD curses</a></h3>

<blockquote>
<p>I was recently pointed at a web page on Thomas E. Dickeys site talking about NetBSD curses.  It seems initially that the page was intended to be a pointer to some differences between ncurses and NetBSD curses and does appear to start off in this vein but it seems that the author has lost the plot as the document evolved and the tail end of it seems to be devolving into some sort of slanging match.  I don&#39;t want to go through Mr. Dickey&#39;s document point by point, that would be tedious but I would like to pick out some of the things that I believe to be the most egregious.  Please note that even though I am a NetBSD developer, the opinions below are my own and not the NetBSD projects.</p>
</blockquote>

<hr>

<h3><a href="https://woozle.org/papers/plan9.html" rel="nofollow">Making Unix a little more Plan9-like</a></h3>

<blockquote>
<p>I’m not really interested in defending anything. I tried out plan9port and liked it, but I have to live in Unix land. Here’s how I set that up.</p>

<p>A Warning</p>

<p>The suckless community, and some of the plan9 communities, are dominated by jackasses. I hope that’s strong enough wording to impress the severity. Don’t go into IRC for help. Stay off the suckless email list. The software is great, the people who write it are well-spoken and well-reasoned, but for some reason the fandom is horrible to everyone.</p>
</blockquote>

<hr>

<h3><a href="https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-freebsd-12-1-release/" rel="nofollow">Not-actually Linux distro review: FreeBSD 12.1-RELEASE</a></h3>

<blockquote>
<p>This month&#39;s Linux distro review isn&#39;t of a Linux distribution at all—instead, we&#39;re taking a look at FreeBSD, the original gangster of free Unix-like operating systems.</p>

<p>The first FreeBSD release was in 1993, but the operating system&#39;s roots go further back—considerably further back. FreeBSD started out in 1992 as a patch-release of Bill and Lynne Jolitz&#39;s 386BSD—but 386BSD itself came from the original Berkeley Software Distribution (BSD). BSD itself goes back to 1977—for reference, Linus Torvalds was only seven years old then.</p>

<p>Before we get started, I&#39;d like to acknowledge something up front—our distro reviews include the desktop experience, and that is very much not FreeBSD&#39;s strength. FreeBSD is far, far better suited to running as a headless server than as a desktop! We&#39;re going to get a full desktop running on it anyway, because according to Lee Hutchinson, I hate myself—and also because we can&#39;t imagine readers wouldn&#39;t care about it.</p>

<p>FreeBSD does not provide a good desktop experience, to say the least. But if you&#39;re hankering for a BSD-based desktop, don&#39;t worry—we&#39;re already planning a followup review of GhostBSD, a desktop-focused BSD distribution.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/wifi_renewal_restarted" rel="nofollow">Wifi renewal restarted</a></li>
<li><a href="https://www.dragonflydigest.com/2020/04/21/24421.html" rel="nofollow">HAMMER2 and a quick start for DragonFly</a></li>
<li><a href="http://netbsd.org/%7Ekamil/AsiaBSDCon/Kamil_Rytarowski_Engineering_NetBSD_9.0.pdf" rel="nofollow">Engineering NetBSD 9.0</a></li>
<li><a href="https://www.youtube.com/watch?v=94vz_-5lAkE" rel="nofollow">Antivirus Protection using OPNsense Plugins</a></li>
<li><a href="https://twitter.com/allanjude/status/1251895348836143104" rel="nofollow">BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC</a></li>
</ul>

<hr>

<h2>BSDNow is going Independent</h2>

<ul>
<li>After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements. LinuxAcademy is now under new leadership, and we understand that cutbacks needed to be made, and that BSD is not their core product. That does not mean your favourite BSD podcast is going away, we will continue and we expect things will not look much different. 
What does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.</li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><p>Jordyn - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/347/feedback/Jordyn%20zfs%20pool%20problem.md" rel="nofollow">ZFS Pool Problem</a></p>

<ul>
<li>debug - <a href="https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt</a></li>
</ul></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0347.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Rethinking OpenBSD security, FreeBSD 2020 Q1 status report, the notion of progress and user interfaces, Comments about Thomas E. Dickey on NetBSD curses, making Unix a little more Plan9-like, Not-actually Linux distro review: FreeBSD, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://flak.tedunangst.com/post/rethinking-openbsd-security" rel="nofollow">Rethinking OpenBSD Security</a></h3>

<blockquote>
<p>OpenBSD aims to be a secure operating system. In the past few months there were quite a few security errata, however. That’s not too unusual, but some of the recent ones were a bit special. One might even say bad. The OpenBSD approach to security has a few aspects, two of which might be avoiding errors and minimizing the risk of mistakes. Other people have other ideas about how to build secure systems. I think it’s worth examining whether the OpenBSD approach works, or if this is evidence that it’s doomed to failure.<br>
I picked a few errata, not all of them, that were interesting and happened to suit my narrative.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsd.org/news/status/report-2020-01-2020-03.html" rel="nofollow">FreeBSD 2020 Q1 Quarterly report</a></h3>

<blockquote>
<p>Welcome, to the quarterly reports, of the future! Well, at least the first quarterly report from 2020. The new timeline, mentioned in the last few reports, still holds, which brings us to this report, which covers the period of January 2020 - March 2020.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://herebeseaswines.net/essays/2020-04-13-the-notion-of-progress-and-user-interfaces" rel="nofollow">The Notion of Progress and User Interfaces</a></h3>

<blockquote>
<p>One trait of modern Western culture is the notion of progress. A view claiming, at large, everything is getting better and better.</p>

<p>How should we think about progress? Both in general and regarding technology?</p>
</blockquote>

<hr>

<h3><a href="https://implementality.blogspot.com/2020/04/thomas-e-dickey-on-netbsd-curses.html" rel="nofollow">Thomas E. Dickey on NetBSD curses</a></h3>

<blockquote>
<p>I was recently pointed at a web page on Thomas E. Dickeys site talking about NetBSD curses.  It seems initially that the page was intended to be a pointer to some differences between ncurses and NetBSD curses and does appear to start off in this vein but it seems that the author has lost the plot as the document evolved and the tail end of it seems to be devolving into some sort of slanging match.  I don&#39;t want to go through Mr. Dickey&#39;s document point by point, that would be tedious but I would like to pick out some of the things that I believe to be the most egregious.  Please note that even though I am a NetBSD developer, the opinions below are my own and not the NetBSD projects.</p>
</blockquote>

<hr>

<h3><a href="https://woozle.org/papers/plan9.html" rel="nofollow">Making Unix a little more Plan9-like</a></h3>

<blockquote>
<p>I’m not really interested in defending anything. I tried out plan9port and liked it, but I have to live in Unix land. Here’s how I set that up.</p>

<p>A Warning</p>

<p>The suckless community, and some of the plan9 communities, are dominated by jackasses. I hope that’s strong enough wording to impress the severity. Don’t go into IRC for help. Stay off the suckless email list. The software is great, the people who write it are well-spoken and well-reasoned, but for some reason the fandom is horrible to everyone.</p>
</blockquote>

<hr>

<h3><a href="https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-freebsd-12-1-release/" rel="nofollow">Not-actually Linux distro review: FreeBSD 12.1-RELEASE</a></h3>

<blockquote>
<p>This month&#39;s Linux distro review isn&#39;t of a Linux distribution at all—instead, we&#39;re taking a look at FreeBSD, the original gangster of free Unix-like operating systems.</p>

<p>The first FreeBSD release was in 1993, but the operating system&#39;s roots go further back—considerably further back. FreeBSD started out in 1992 as a patch-release of Bill and Lynne Jolitz&#39;s 386BSD—but 386BSD itself came from the original Berkeley Software Distribution (BSD). BSD itself goes back to 1977—for reference, Linus Torvalds was only seven years old then.</p>

<p>Before we get started, I&#39;d like to acknowledge something up front—our distro reviews include the desktop experience, and that is very much not FreeBSD&#39;s strength. FreeBSD is far, far better suited to running as a headless server than as a desktop! We&#39;re going to get a full desktop running on it anyway, because according to Lee Hutchinson, I hate myself—and also because we can&#39;t imagine readers wouldn&#39;t care about it.</p>

<p>FreeBSD does not provide a good desktop experience, to say the least. But if you&#39;re hankering for a BSD-based desktop, don&#39;t worry—we&#39;re already planning a followup review of GhostBSD, a desktop-focused BSD distribution.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/wifi_renewal_restarted" rel="nofollow">Wifi renewal restarted</a></li>
<li><a href="https://www.dragonflydigest.com/2020/04/21/24421.html" rel="nofollow">HAMMER2 and a quick start for DragonFly</a></li>
<li><a href="http://netbsd.org/%7Ekamil/AsiaBSDCon/Kamil_Rytarowski_Engineering_NetBSD_9.0.pdf" rel="nofollow">Engineering NetBSD 9.0</a></li>
<li><a href="https://www.youtube.com/watch?v=94vz_-5lAkE" rel="nofollow">Antivirus Protection using OPNsense Plugins</a></li>
<li><a href="https://twitter.com/allanjude/status/1251895348836143104" rel="nofollow">BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC</a></li>
</ul>

<hr>

<h2>BSDNow is going Independent</h2>

<ul>
<li>After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements. LinuxAcademy is now under new leadership, and we understand that cutbacks needed to be made, and that BSD is not their core product. That does not mean your favourite BSD podcast is going away, we will continue and we expect things will not look much different. 
What does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.</li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><p>Jordyn - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/347/feedback/Jordyn%20zfs%20pool%20problem.md" rel="nofollow">ZFS Pool Problem</a></p>

<ul>
<li>debug - <a href="https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt" rel="nofollow">https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt</a></li>
</ul></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0347.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>346: Core File Tales</title>
  <link>https://www.bsdnow.tv/346</link>
  <guid isPermaLink="false">8f8d0474-abb5-4b90-955c-8d8cfd6dc489</guid>
  <pubDate>Thu, 16 Apr 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8f8d0474-abb5-4b90-955c-8d8cfd6dc489.mp3" length="40304872" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Tales from a core file, Lenovo X260 BIOS Update with OpenBSD, the problem of Unix iowait and multi-CPU machines, Hugo workflow using FreeBSD Jails, Caddy, Restic; extending NetBSD-7 branch support, a tale of two hypervisor bugs, and more.</itunes:subtitle>
  <itunes:duration>55:58</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Tales from a core file, Lenovo X260 BIOS Update with OpenBSD, the problem of Unix iowait and multi-CPU machines, Hugo workflow using FreeBSD Jails, Caddy, Restic; extending NetBSD-7 branch support, a tale of two hypervisor bugs, and more.
Headlines
Tales From a Core File - Lessons from the Unix stdio ABI: 40 Years Later (https://fingolfin.org/blog/20200327/stdio-abi.html)
On the side, I’ve been wrapping up some improvements to the classic Unix stdio libraries in illumos. stdio contains the classic functions like fopen(), printf(), and the security nightmare gets(). While working on support for fmemopen() and friends I got to reacquaint myself with some of the joys of the stdio ABI and its history from 7th Edition Unix. With that in mind, let’s dive into this, history, and some mistakes not to repeat. While this is written from the perspective of the C programming language, aspects of it apply to many other languages.
Update Lenovo X260 BIOS with OpenBSD (https://www.tumfatig.net/20200331/update-lenovo-x260-bios-with-openbsd/)
My X260 only runs OpenBSD and has no CD driver. But I still need to upgrade its BIOS from time to time. And this is possible using the ISO BIOS image.
First off all, you need to download the “BIOS Update (Bootable CD)” from the Lenovo Support Website.
News Roundup
The problem of Unix iowait and multi-CPU machines (https://utcc.utoronto.ca/~cks/space/blog/unix/IowaitAndMultipleCPUs)
Various Unixes have had a 'iowait' statistic for a long time now (although I can't find a source for where it originated; it's not in 4.x BSD, so it may have come through System V and sar). The traditional and standard definition of iowait is that it's the amount of time the system was idle but had at least one process waiting on disk IO. Rather than count this time as 'idle' (as you would if you had a three-way division of CPU time between user, system, and idle), some Unixes evolved to count this as a new category, 'iowait'.
My Latest Self Hosted Hugo Workflow using FreeBSD Jails, Caddy, Restic and More (https://www.jaredwolff.com/my-latest-self-hosted-hugo-workflow/)
After hosting with Netlify for a few years, I decided to head back to self hosting. Theres a few reasons for that but the main reasoning was that I had more control over how things worked.
In this post, i’ll show you my workflow for deploying my Hugo generated site (www.jaredwolff.com). Instead of using what most people would go for, i’ll be doing all of this using a FreeBSD Jails based server. Plus i’ll show you some tricks i’ve learned over the years on bulk image resizing and more.
Let’s get to it.
Extending support for the NetBSD-7 branch (http://blog.netbsd.org/tnf/entry/extending_support_for_the_netbsd)
Typically, some time after releasing a new NetBSD major version (such as NetBSD 9.0), we will announce the end-of-life of the N-2 branch, in this case NetBSD-7.
We've decided to hold off on doing that to ensure our users don't feel rushed to perform a major version update on any remote machines, possibly needing to reach the machine if anything goes wrong.
Security fixes will still be made to the NetBSD-7 branch.
We hope you're all safe. Stay home.
Tale of two hypervisor bugs - Escaping from FreeBSD bhyve (http://phrack.org/papers/escaping_from_freebsd_bhyve.html)
VM escape has become a popular topic of discussion over the last few years. A good amount of research on this topic has been published for various hypervisors like VMware, QEMU, VirtualBox, Xen and Hyper-V. Bhyve is a hypervisor for FreeBSD supporting hardware-assisted virtualization. This paper details the exploitation of two bugs in bhyve - FreeBSD-SA-16:32.bhyve (VGA emulation heap overflow) and CVE-2018-17160 (Firmware Configuration device bss buffer overflow) and some generic techniques which could be used for exploiting other bhyve bugs. Further, the paper also discusses sandbox escapes using PCI device passthrough, and Control-Flow Integrity bypasses in HardenedBSD 12-CURRENT
Beastie Bits
GhostBSD 20.02 Overview (https://www.youtube.com/watch?v=kFG-772WGwg)
FuryBSD 12.1 Overview (https://www.youtube.com/watch?v=5V8680uoXxw)
&amp;gt; Joe Maloney got in touch to say that the issues in the video and other ones found have since been fixed.  Now that's community feedback in action, and an example of a developer who does his best to help the community. A great guy indeed.
OS108-9.0 amd64 MATE released (https://forums.os108.org/d/27-os108-9-0-amd64-mate-released)
FreeBSD hacking: carp panics &amp;amp; test (https://www.twitch.tv/videos/584064729)
Inaugural FreeBSD Office Hours (https://www.youtube.com/watch?v=6qBm5NM3zTQ)
Feedback/Questions
Shody - systemd question (http://dpaste.com/2SAQDJJ#wrap)
Ben - GELI and GPT (http://dpaste.com/1S0DGT3#wrap)
Stig - DIY NAS (http://dpaste.com/2NGNZG5#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, core, core file, core dump, bios, bios update, lenovo, x260, thinkpad, Unix, iowait, self-hosted, hugo, jails, caddy, restic, branch, branch support, hypervisor, bugs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Tales from a core file, Lenovo X260 BIOS Update with OpenBSD, the problem of Unix iowait and multi-CPU machines, Hugo workflow using FreeBSD Jails, Caddy, Restic; extending NetBSD-7 branch support, a tale of two hypervisor bugs, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://fingolfin.org/blog/20200327/stdio-abi.html" rel="nofollow">Tales From a Core File - Lessons from the Unix stdio ABI: 40 Years Later</a></h3>

<blockquote>
<p>On the side, I’ve been wrapping up some improvements to the classic Unix stdio libraries in illumos. stdio contains the classic functions like fopen(), printf(), and the security nightmare gets(). While working on support for fmemopen() and friends I got to reacquaint myself with some of the joys of the stdio ABI and its history from 7th Edition Unix. With that in mind, let’s dive into this, history, and some mistakes not to repeat. While this is written from the perspective of the C programming language, aspects of it apply to many other languages.</p>
</blockquote>

<hr>

<h3><a href="https://www.tumfatig.net/20200331/update-lenovo-x260-bios-with-openbsd/" rel="nofollow">Update Lenovo X260 BIOS with OpenBSD</a></h3>

<blockquote>
<p>My X260 only runs OpenBSD and has no CD driver. But I still need to upgrade its BIOS from time to time. And this is possible using the ISO BIOS image.</p>

<p>First off all, you need to download the “BIOS Update (Bootable CD)” from the Lenovo Support Website.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/IowaitAndMultipleCPUs" rel="nofollow">The problem of Unix iowait and multi-CPU machines</a></h3>

<blockquote>
<p>Various Unixes have had a &#39;iowait&#39; statistic for a long time now (although I can&#39;t find a source for where it originated; it&#39;s not in 4.x BSD, so it may have come through System V and sar). The traditional and standard definition of iowait is that it&#39;s the amount of time the system was idle but had at least one process waiting on disk IO. Rather than count this time as &#39;idle&#39; (as you would if you had a three-way division of CPU time between user, system, and idle), some Unixes evolved to count this as a new category, &#39;iowait&#39;.</p>
</blockquote>

<hr>

<h3><a href="https://www.jaredwolff.com/my-latest-self-hosted-hugo-workflow/" rel="nofollow">My Latest Self Hosted Hugo Workflow using FreeBSD Jails, Caddy, Restic and More</a></h3>

<blockquote>
<p>After hosting with Netlify for a few years, I decided to head back to self hosting. Theres a few reasons for that but the main reasoning was that I had more control over how things worked.</p>

<p>In this post, i’ll show you my workflow for deploying my Hugo generated site (<a href="http://www.jaredwolff.com" rel="nofollow">www.jaredwolff.com</a>). Instead of using what most people would go for, i’ll be doing all of this using a FreeBSD Jails based server. Plus i’ll show you some tricks i’ve learned over the years on bulk image resizing and more.</p>

<p>Let’s get to it.</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/extending_support_for_the_netbsd" rel="nofollow">Extending support for the NetBSD-7 branch</a></h3>

<blockquote>
<p>Typically, some time after releasing a new NetBSD major version (such as NetBSD 9.0), we will announce the end-of-life of the N-2 branch, in this case NetBSD-7.</p>

<p>We&#39;ve decided to hold off on doing that to ensure our users don&#39;t feel rushed to perform a major version update on any remote machines, possibly needing to reach the machine if anything goes wrong.</p>

<p>Security fixes will still be made to the NetBSD-7 branch.</p>

<p>We hope you&#39;re all safe. Stay home.</p>
</blockquote>

<hr>

<h3><a href="http://phrack.org/papers/escaping_from_freebsd_bhyve.html" rel="nofollow">Tale of two hypervisor bugs - Escaping from FreeBSD bhyve</a></h3>

<blockquote>
<p>VM escape has become a popular topic of discussion over the last few years. A good amount of research on this topic has been published for various hypervisors like VMware, QEMU, VirtualBox, Xen and Hyper-V. Bhyve is a hypervisor for FreeBSD supporting hardware-assisted virtualization. This paper details the exploitation of two bugs in bhyve - FreeBSD-SA-16:32.bhyve (VGA emulation heap overflow) and CVE-2018-17160 (Firmware Configuration device bss buffer overflow) and some generic techniques which could be used for exploiting other bhyve bugs. Further, the paper also discusses sandbox escapes using PCI device passthrough, and Control-Flow Integrity bypasses in HardenedBSD 12-CURRENT</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=kFG-772WGwg" rel="nofollow">GhostBSD 20.02 Overview</a></li>
<li><a href="https://www.youtube.com/watch?v=5V8680uoXxw" rel="nofollow">FuryBSD 12.1 Overview</a>
&gt; Joe Maloney got in touch to say that the issues in the video and other ones found have since been fixed.  Now that&#39;s community feedback in action, and an example of a developer who does his best to help the community. A great guy indeed.</li>
<li><a href="https://forums.os108.org/d/27-os108-9-0-amd64-mate-released" rel="nofollow">OS108-9.0 amd64 MATE released</a></li>
<li><a href="https://www.twitch.tv/videos/584064729" rel="nofollow">FreeBSD hacking: carp panics &amp; test</a></li>
<li><a href="https://www.youtube.com/watch?v=6qBm5NM3zTQ" rel="nofollow">Inaugural FreeBSD Office Hours</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Shody - <a href="http://dpaste.com/2SAQDJJ#wrap" rel="nofollow">systemd question</a></li>
<li>Ben - <a href="http://dpaste.com/1S0DGT3#wrap" rel="nofollow">GELI and GPT</a></li>
<li>Stig - <a href="http://dpaste.com/2NGNZG5#wrap" rel="nofollow">DIY NAS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0345.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Tales from a core file, Lenovo X260 BIOS Update with OpenBSD, the problem of Unix iowait and multi-CPU machines, Hugo workflow using FreeBSD Jails, Caddy, Restic; extending NetBSD-7 branch support, a tale of two hypervisor bugs, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://fingolfin.org/blog/20200327/stdio-abi.html" rel="nofollow">Tales From a Core File - Lessons from the Unix stdio ABI: 40 Years Later</a></h3>

<blockquote>
<p>On the side, I’ve been wrapping up some improvements to the classic Unix stdio libraries in illumos. stdio contains the classic functions like fopen(), printf(), and the security nightmare gets(). While working on support for fmemopen() and friends I got to reacquaint myself with some of the joys of the stdio ABI and its history from 7th Edition Unix. With that in mind, let’s dive into this, history, and some mistakes not to repeat. While this is written from the perspective of the C programming language, aspects of it apply to many other languages.</p>
</blockquote>

<hr>

<h3><a href="https://www.tumfatig.net/20200331/update-lenovo-x260-bios-with-openbsd/" rel="nofollow">Update Lenovo X260 BIOS with OpenBSD</a></h3>

<blockquote>
<p>My X260 only runs OpenBSD and has no CD driver. But I still need to upgrade its BIOS from time to time. And this is possible using the ISO BIOS image.</p>

<p>First off all, you need to download the “BIOS Update (Bootable CD)” from the Lenovo Support Website.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/IowaitAndMultipleCPUs" rel="nofollow">The problem of Unix iowait and multi-CPU machines</a></h3>

<blockquote>
<p>Various Unixes have had a &#39;iowait&#39; statistic for a long time now (although I can&#39;t find a source for where it originated; it&#39;s not in 4.x BSD, so it may have come through System V and sar). The traditional and standard definition of iowait is that it&#39;s the amount of time the system was idle but had at least one process waiting on disk IO. Rather than count this time as &#39;idle&#39; (as you would if you had a three-way division of CPU time between user, system, and idle), some Unixes evolved to count this as a new category, &#39;iowait&#39;.</p>
</blockquote>

<hr>

<h3><a href="https://www.jaredwolff.com/my-latest-self-hosted-hugo-workflow/" rel="nofollow">My Latest Self Hosted Hugo Workflow using FreeBSD Jails, Caddy, Restic and More</a></h3>

<blockquote>
<p>After hosting with Netlify for a few years, I decided to head back to self hosting. Theres a few reasons for that but the main reasoning was that I had more control over how things worked.</p>

<p>In this post, i’ll show you my workflow for deploying my Hugo generated site (<a href="http://www.jaredwolff.com" rel="nofollow">www.jaredwolff.com</a>). Instead of using what most people would go for, i’ll be doing all of this using a FreeBSD Jails based server. Plus i’ll show you some tricks i’ve learned over the years on bulk image resizing and more.</p>

<p>Let’s get to it.</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/extending_support_for_the_netbsd" rel="nofollow">Extending support for the NetBSD-7 branch</a></h3>

<blockquote>
<p>Typically, some time after releasing a new NetBSD major version (such as NetBSD 9.0), we will announce the end-of-life of the N-2 branch, in this case NetBSD-7.</p>

<p>We&#39;ve decided to hold off on doing that to ensure our users don&#39;t feel rushed to perform a major version update on any remote machines, possibly needing to reach the machine if anything goes wrong.</p>

<p>Security fixes will still be made to the NetBSD-7 branch.</p>

<p>We hope you&#39;re all safe. Stay home.</p>
</blockquote>

<hr>

<h3><a href="http://phrack.org/papers/escaping_from_freebsd_bhyve.html" rel="nofollow">Tale of two hypervisor bugs - Escaping from FreeBSD bhyve</a></h3>

<blockquote>
<p>VM escape has become a popular topic of discussion over the last few years. A good amount of research on this topic has been published for various hypervisors like VMware, QEMU, VirtualBox, Xen and Hyper-V. Bhyve is a hypervisor for FreeBSD supporting hardware-assisted virtualization. This paper details the exploitation of two bugs in bhyve - FreeBSD-SA-16:32.bhyve (VGA emulation heap overflow) and CVE-2018-17160 (Firmware Configuration device bss buffer overflow) and some generic techniques which could be used for exploiting other bhyve bugs. Further, the paper also discusses sandbox escapes using PCI device passthrough, and Control-Flow Integrity bypasses in HardenedBSD 12-CURRENT</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=kFG-772WGwg" rel="nofollow">GhostBSD 20.02 Overview</a></li>
<li><a href="https://www.youtube.com/watch?v=5V8680uoXxw" rel="nofollow">FuryBSD 12.1 Overview</a>
&gt; Joe Maloney got in touch to say that the issues in the video and other ones found have since been fixed.  Now that&#39;s community feedback in action, and an example of a developer who does his best to help the community. A great guy indeed.</li>
<li><a href="https://forums.os108.org/d/27-os108-9-0-amd64-mate-released" rel="nofollow">OS108-9.0 amd64 MATE released</a></li>
<li><a href="https://www.twitch.tv/videos/584064729" rel="nofollow">FreeBSD hacking: carp panics &amp; test</a></li>
<li><a href="https://www.youtube.com/watch?v=6qBm5NM3zTQ" rel="nofollow">Inaugural FreeBSD Office Hours</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Shody - <a href="http://dpaste.com/2SAQDJJ#wrap" rel="nofollow">systemd question</a></li>
<li>Ben - <a href="http://dpaste.com/1S0DGT3#wrap" rel="nofollow">GELI and GPT</a></li>
<li>Stig - <a href="http://dpaste.com/2NGNZG5#wrap" rel="nofollow">DIY NAS</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0345.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>345: Switchers to BSD</title>
  <link>https://www.bsdnow.tv/345</link>
  <guid isPermaLink="false">c46952e4-8ea3-4506-b4eb-54f2870547ee</guid>
  <pubDate>Thu, 09 Apr 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c46952e4-8ea3-4506-b4eb-54f2870547ee.mp3" length="34426694" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>NetBSD 8.2 is available, NextCloud on OpenBSD, X11 screen locking, NetBSD and RISC OS running parallel, community feedback about switching to BSD, and more.</itunes:subtitle>
  <itunes:duration>47:48</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>NetBSD 8.2 is available, NextCloud on OpenBSD, X11 screen locking, NetBSD and RISC OS running parallel, community feedback about switching to BSD, and more.
Headlines
NetBSD 8.2 is available! (http://blog.netbsd.org/tnf/entry/netbsd_8_2_is_available)
The third release in the NetBSD-8 is now available.
This release includes all the security fixes in NetBSD-8 up until this point, and other fixes deemed important for stability.
Some highlights include:
x86: fixed regression in booting old CPUs
x86: Hyper-V Gen.2 VM framebuffer support
httpd(8): fixed various security issues
ixg(4): various fixes / improvements
x86 efiboot: add tftp support, fix issues on machines with many memory segments, improve graphics mode logic to work on more machines.
Various kernel memory info leaks fixes
Update expat to 2.2.8
Fix ryzen USB issues and support xHCI version 3.10.
Accept root device specification as NAME=label.
Add multiboot 2 support to x86 bootloaders.
Fix for CVE-2019-9506: 'Key Negotiation of Bluetooth' attack.
nouveau: limit the supported devices and fix firmware loading.
radeon: fix loading of the TAHITI VCE firmware.
named(8): stop using obsolete dnssec-lookaside.
NextCloud on OpenBSD (https://h3artbl33d.nl/2020-nextcloud.html)
NextCloud and OpenBSD are complementary to one another. NextCloud is an awesome, secure and private alternative for proprietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.
Preface
Back when this tutorial was initially written, things were different. The OpenBSD port relied on PHP 5.6 and there were no package updates. But the port improved (hats off, Gonzalo!) and package updates were introduced to the -stable branch (hats off, Solene!).
A rewrite of this tutorial was long overdue. Right now, it is written for 6.6 -stable and will be updated once 6.7 is released. If you have any questions or desire some help, feel free to reach out.
News Roundup
X11 screen locking: a secure and modular approach (http://leahneukirchen.org/blog/archive/2020/01/x11-screen-locking-a-secure-and-modular-approach.html)
For years I’ve been using XScreenSaver as a default, but I recently learned about xsecurelock and re-evaluated my screen-saving requirements
NetBSD and RISC OS running parallel (http://www.update.uu.se/~micken/ronetbsd.html)
I have been experimenting with running two systems at the same time on the RK3399 SoC.
It all begun when I figured out how to switch to the A72 cpu for RISC OS. When the switch was done, the A53 cpu just continued to execute code.
OK I thought why not give it something to do!
My first step was to run some small programs.
It worked!
+ Thanks to Tom Jones for the pointer to this article
Several weeks ago we covered a story about switching from Linux to BSD.  Benedict and JT asked for community feedback as to their thoughts on the matter.  Allan was out that week, so this will give him an opportunity to chime in with his thoughts as well.
Jamie - Dumping Linux for BSD (http://dpaste.com/0CH1YXQ#wrap)
Matt - BSD Packaging (http://dpaste.com/2N68YPJ#wrap)
Brad - Linux vs BS (http://dpaste.com/2SF9V38#wrap)
MJ - Linux vs BSD Feedback (http://dpaste.com/0Z2ZT4V#wrap)
Ben - Feedback for JT (http://dpaste.com/0B3M85X)
Henrik - Why you should migrate everything to BSD (http://dpaste.com/3F36EQE#wrap)
Beastie Bits
ssh-copy-id now included (https://www.dragonflydigest.com/2020/04/06/24367.html)
OPNsense 20.1.3 released (https://opnsense.org/opnsense-20-1-3-released/)
A Collection of prebuilt BSD Cloud Images (https://bsd-cloud-image.org/)
Instant terminal sharing (https://tmate.io/)
Feedback/Questions
Ales - Manually verify signature files for pkg package (http://dpaste.com/1EBWTK5#wrap)
Shody - Yubikey (http://dpaste.com/340PM9Q#wrap)
Mike - Site for hashes from old disks (http://dpaste.com/13W9SF0)
Answer: https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, nextcloud, x11, screen locking, risc, risc os, community, feedback</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>NetBSD 8.2 is available, NextCloud on OpenBSD, X11 screen locking, NetBSD and RISC OS running parallel, community feedback about switching to BSD, and more.</p>

<h2>Headlines</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/netbsd_8_2_is_available" rel="nofollow">NetBSD 8.2 is available!</a></h3>

<blockquote>
<p>The third release in the NetBSD-8 is now available.</p>

<p>This release includes all the security fixes in NetBSD-8 up until this point, and other fixes deemed important for stability.</p>
</blockquote>

<ul>
<li>Some highlights include:

<ul>
<li>x86: fixed regression in booting old CPUs</li>
<li>x86: Hyper-V Gen.2 VM framebuffer support</li>
<li>httpd(8): fixed various security issues</li>
<li>ixg(4): various fixes / improvements</li>
<li>x86 efiboot: add tftp support, fix issues on machines with many memory segments, improve graphics mode logic to work on more machines.</li>
<li>Various kernel memory info leaks fixes</li>
<li>Update expat to 2.2.8</li>
<li>Fix ryzen USB issues and support xHCI version 3.10.</li>
<li>Accept root device specification as NAME=label.</li>
<li>Add multiboot 2 support to x86 bootloaders.</li>
<li>Fix for CVE-2019-9506: &#39;Key Negotiation of Bluetooth&#39; attack.</li>
<li>nouveau: limit the supported devices and fix firmware loading.</li>
<li>radeon: fix loading of the TAHITI VCE firmware.</li>
<li>named(8): stop using obsolete dnssec-lookaside.</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://h3artbl33d.nl/2020-nextcloud.html" rel="nofollow">NextCloud on OpenBSD</a></h3>

<blockquote>
<p>NextCloud and OpenBSD are complementary to one another. NextCloud is an awesome, secure and private alternative for proprietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.</p>
</blockquote>

<ul>
<li>Preface</li>
</ul>

<blockquote>
<p>Back when this tutorial was initially written, things were different. The OpenBSD port relied on PHP 5.6 and there were no package updates. But the port improved (hats off, Gonzalo!) and package updates were introduced to the -stable branch (hats off, Solene!).</p>

<p>A rewrite of this tutorial was long overdue. Right now, it is written for 6.6 -stable and will be updated once 6.7 is released. If you have any questions or desire some help, feel free to reach out.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://leahneukirchen.org/blog/archive/2020/01/x11-screen-locking-a-secure-and-modular-approach.html" rel="nofollow">X11 screen locking: a secure and modular approach</a></h3>

<blockquote>
<p>For years I’ve been using XScreenSaver as a default, but I recently learned about xsecurelock and re-evaluated my screen-saving requirements</p>
</blockquote>

<hr>

<h3><a href="http://www.update.uu.se/%7Emicken/ronetbsd.html" rel="nofollow">NetBSD and RISC OS running parallel</a></h3>

<blockquote>
<p>I have been experimenting with running two systems at the same time on the RK3399 SoC.<br>
It all begun when I figured out how to switch to the A72 cpu for RISC OS. When the switch was done, the A53 cpu just continued to execute code.<br>
OK I thought why not give it something to do!<br>
My first step was to run some small programs.<br>
It worked!</p>

<ul>
<li>Thanks to Tom Jones for the pointer to this article</li>
</ul>
</blockquote>

<hr>

<h3>Several weeks ago we covered a story about switching from Linux to BSD.  Benedict and JT asked for community feedback as to their thoughts on the matter.  Allan was out that week, so this will give him an opportunity to chime in with his thoughts as well.</h3>

<ul>
<li>Jamie - <a href="http://dpaste.com/0CH1YXQ#wrap" rel="nofollow">Dumping Linux for BSD</a></li>
<li>Matt - <a href="http://dpaste.com/2N68YPJ#wrap" rel="nofollow">BSD Packaging</a></li>
<li>Brad - <a href="http://dpaste.com/2SF9V38#wrap" rel="nofollow">Linux vs BS</a></li>
<li>MJ - <a href="http://dpaste.com/0Z2ZT4V#wrap" rel="nofollow">Linux vs BSD Feedback</a></li>
<li>Ben - <a href="http://dpaste.com/0B3M85X" rel="nofollow">Feedback for JT</a></li>
<li>Henrik - <a href="http://dpaste.com/3F36EQE#wrap" rel="nofollow">Why you should migrate everything to BSD</a></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/04/06/24367.html" rel="nofollow">ssh-copy-id now included</a></li>
<li><a href="https://opnsense.org/opnsense-20-1-3-released/" rel="nofollow">OPNsense 20.1.3 released</a></li>
<li><a href="https://bsd-cloud-image.org/" rel="nofollow">A Collection of prebuilt BSD Cloud Images</a></li>
<li><a href="https://tmate.io/" rel="nofollow">Instant terminal sharing</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Ales - <a href="http://dpaste.com/1EBWTK5#wrap" rel="nofollow">Manually verify signature files for pkg package</a></li>
<li>Shody - <a href="http://dpaste.com/340PM9Q#wrap" rel="nofollow">Yubikey</a></li>
<li>Mike - <a href="http://dpaste.com/13W9SF0" rel="nofollow">Site for hashes from old disks</a>

<ul>
<li>Answer: <a href="https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing" rel="nofollow">https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing</a></li>
</ul></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0345.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>NetBSD 8.2 is available, NextCloud on OpenBSD, X11 screen locking, NetBSD and RISC OS running parallel, community feedback about switching to BSD, and more.</p>

<h2>Headlines</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/netbsd_8_2_is_available" rel="nofollow">NetBSD 8.2 is available!</a></h3>

<blockquote>
<p>The third release in the NetBSD-8 is now available.</p>

<p>This release includes all the security fixes in NetBSD-8 up until this point, and other fixes deemed important for stability.</p>
</blockquote>

<ul>
<li>Some highlights include:

<ul>
<li>x86: fixed regression in booting old CPUs</li>
<li>x86: Hyper-V Gen.2 VM framebuffer support</li>
<li>httpd(8): fixed various security issues</li>
<li>ixg(4): various fixes / improvements</li>
<li>x86 efiboot: add tftp support, fix issues on machines with many memory segments, improve graphics mode logic to work on more machines.</li>
<li>Various kernel memory info leaks fixes</li>
<li>Update expat to 2.2.8</li>
<li>Fix ryzen USB issues and support xHCI version 3.10.</li>
<li>Accept root device specification as NAME=label.</li>
<li>Add multiboot 2 support to x86 bootloaders.</li>
<li>Fix for CVE-2019-9506: &#39;Key Negotiation of Bluetooth&#39; attack.</li>
<li>nouveau: limit the supported devices and fix firmware loading.</li>
<li>radeon: fix loading of the TAHITI VCE firmware.</li>
<li>named(8): stop using obsolete dnssec-lookaside.</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://h3artbl33d.nl/2020-nextcloud.html" rel="nofollow">NextCloud on OpenBSD</a></h3>

<blockquote>
<p>NextCloud and OpenBSD are complementary to one another. NextCloud is an awesome, secure and private alternative for proprietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.</p>
</blockquote>

<ul>
<li>Preface</li>
</ul>

<blockquote>
<p>Back when this tutorial was initially written, things were different. The OpenBSD port relied on PHP 5.6 and there were no package updates. But the port improved (hats off, Gonzalo!) and package updates were introduced to the -stable branch (hats off, Solene!).</p>

<p>A rewrite of this tutorial was long overdue. Right now, it is written for 6.6 -stable and will be updated once 6.7 is released. If you have any questions or desire some help, feel free to reach out.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://leahneukirchen.org/blog/archive/2020/01/x11-screen-locking-a-secure-and-modular-approach.html" rel="nofollow">X11 screen locking: a secure and modular approach</a></h3>

<blockquote>
<p>For years I’ve been using XScreenSaver as a default, but I recently learned about xsecurelock and re-evaluated my screen-saving requirements</p>
</blockquote>

<hr>

<h3><a href="http://www.update.uu.se/%7Emicken/ronetbsd.html" rel="nofollow">NetBSD and RISC OS running parallel</a></h3>

<blockquote>
<p>I have been experimenting with running two systems at the same time on the RK3399 SoC.<br>
It all begun when I figured out how to switch to the A72 cpu for RISC OS. When the switch was done, the A53 cpu just continued to execute code.<br>
OK I thought why not give it something to do!<br>
My first step was to run some small programs.<br>
It worked!</p>

<ul>
<li>Thanks to Tom Jones for the pointer to this article</li>
</ul>
</blockquote>

<hr>

<h3>Several weeks ago we covered a story about switching from Linux to BSD.  Benedict and JT asked for community feedback as to their thoughts on the matter.  Allan was out that week, so this will give him an opportunity to chime in with his thoughts as well.</h3>

<ul>
<li>Jamie - <a href="http://dpaste.com/0CH1YXQ#wrap" rel="nofollow">Dumping Linux for BSD</a></li>
<li>Matt - <a href="http://dpaste.com/2N68YPJ#wrap" rel="nofollow">BSD Packaging</a></li>
<li>Brad - <a href="http://dpaste.com/2SF9V38#wrap" rel="nofollow">Linux vs BS</a></li>
<li>MJ - <a href="http://dpaste.com/0Z2ZT4V#wrap" rel="nofollow">Linux vs BSD Feedback</a></li>
<li>Ben - <a href="http://dpaste.com/0B3M85X" rel="nofollow">Feedback for JT</a></li>
<li>Henrik - <a href="http://dpaste.com/3F36EQE#wrap" rel="nofollow">Why you should migrate everything to BSD</a></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/04/06/24367.html" rel="nofollow">ssh-copy-id now included</a></li>
<li><a href="https://opnsense.org/opnsense-20-1-3-released/" rel="nofollow">OPNsense 20.1.3 released</a></li>
<li><a href="https://bsd-cloud-image.org/" rel="nofollow">A Collection of prebuilt BSD Cloud Images</a></li>
<li><a href="https://tmate.io/" rel="nofollow">Instant terminal sharing</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Ales - <a href="http://dpaste.com/1EBWTK5#wrap" rel="nofollow">Manually verify signature files for pkg package</a></li>
<li>Shody - <a href="http://dpaste.com/340PM9Q#wrap" rel="nofollow">Yubikey</a></li>
<li>Mike - <a href="http://dpaste.com/13W9SF0" rel="nofollow">Site for hashes from old disks</a>

<ul>
<li>Answer: <a href="https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing" rel="nofollow">https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing</a></li>
</ul></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0345.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>344: Grains of Salt</title>
  <link>https://www.bsdnow.tv/344</link>
  <guid isPermaLink="false">e17510a7-48e1-4fa3-9500-222f5e4904ee</guid>
  <pubDate>Thu, 02 Apr 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e17510a7-48e1-4fa3-9500-222f5e4904ee.mp3" length="40072591" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more.</itunes:subtitle>
  <itunes:duration>55:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more.
Headlines
Text processing in the shell (https://blog.balthazar-rouberol.com/text-processing-in-the-shell)
This article is part of a self-published book project by Balthazar Rouberol and Etienne Brodu, ex-roommates, friends and colleagues, aiming at empowering the up and coming generation of developers. We currently are hard at work on it!
One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc.
When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.
Rebalancing data on ZFS mirrors (https://jrs-s.net/2020/03/10/rebalancing-data-on-zfs-mirrors/)
One of the questions that comes up time and time again about ZFS is “how can I migrate my data to a pool on a few of my disks, then add the rest of the disks afterward?”
If you just want to get the data moved and don’t care about balance, you can just copy the data over, then add the new disks and be done with it. But, it won’t be distributed evenly over the vdevs in your pool.
Don’t fret, though, it’s actually pretty easy to rebalance mirrors. In the following example, we’ll assume you’ve got four disks in a RAID array on an old machine, and two disks available to copy the data to in the short term.
News Roundup
Using OpenBSD relayd to Add Security Headers (https://web.archive.org/web/20191109121500/https://goblackcat.com/posts/using-openbsd-relayd-to-add-security-headers/)
I am a huge fan of OpenBSD’s built-in httpd server as it is simple, secure, and quite performant. With the modern push of the large search providers pushing secure websites, it is now important to add security headers to your website or risk having the search results for your website downgraded. Fortunately, it is very easy to do this when you combine httpd with relayd. While relayd is principally designed for layer 3 redirections and layer 7 relays, it just so happens that it makes a handy tool for adding the recommended security headers. My website automatically redirects users from http to https and this gets achieved using a simple redirection in /etc/httpd.conf So if you have a configuration similar to mine, then you will still want to have httpd listen on the egress interface on port 80. The key thing to change here is to have httpd listen on 127.0.0.1 on port 443.
How we set up our ZFS filesystem hierarchy in our ZFS pools (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSOurContainerFilesystems)
Our long standing practice here, predating even the first generation of our ZFS fileservers, is that we have two main sorts of filesystems, home directories (homedir filesystems) and what we call 'work directory' (workdir) filesystems. Homedir filesystems are called /h/NNN (for some NNN) and workdir filesystems are called /w/NNN; the NNN is unique across all of the different sorts of filesystems. Users are encouraged to put as much stuff as possible in workdirs and can have as many of them as they want, which mattered a lot more in the days when we used Solaris DiskSuite and had fixed-sized filesystems.
Speeding up ZSH (https://blog.jonlu.ca/posts/speeding-up-zsh)
https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh
I was opening multiple shells for an unrelated project today and noticed how abysmal my shell load speed was. After the initial load it was relatively fast, but the actual shell start up was noticeably slow. I timed it with time and these were the results.
In the future I hope to actually recompile zsh with additional profiling techniques and debug information - keeping an internal timer and having a flag output current time for each command in a tree fashion would make building heat maps really easy.
How do Unix Pipes work (https://www.vegardstikbakke.com/how-do-pipes-work-sigpipe/)
Pipes are cool! We saw how handy they are in a previous blog post. Let’s look at a typical way to use the pipe operator. We have some output, and we want to look at the first lines of the output. Let’s download The Brothers Karamazov by Fyodor Dostoevsky, a fairly long novel.
What we do to enable us to grow our ZFS pools over time (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSHowWeGrowPools)
In my entry on why ZFS isn't good at growing and reshaping pools, I mentioned that we go to quite some lengths in our ZFS environment to be able to incrementally expand our pools. Today I want to put together all of the pieces of that in one place to discuss what those lengths are.
Our big constraint is that not only do we need to add space to pools over time, but we have a fairly large number of pools and which pools will have space added to them is unpredictable. We need a solution to pool expansion that leaves us with as much flexibility as possible for as long as possible. This pretty much requires being able to expand pools in relatively small increments of space.
Linux maintains bugs: The real reason ifconfig on Linux is deprecated (https://blog.farhan.codes/2018/06/25/linux-maintains-bugs-the-real-reason-ifconfig-on-linux-is-deprecated/)
In my third installment of FreeBSD vs Linux, I will discuss underlying reasons for why Linux moved away from ifconfig(8) to ip(8).
In the past, when people said, “Linux is a kernel, not an operating system”, I knew that was true but I always thought it was a rather pedantic criticism. Of course no one runs just the Linux kernel, you run a distribution of Linux. But after reviewing userland code, I understand the significant drawbacks to developing “just a kernel” in isolation from the rest of the system.
Clear Your Terminal in Style (https://adammusciano.com/2020/03/04/2020-03-04-clear-your-terminal-in-style/)
if you’re someone like me who habitually clears their terminal, sometimes you want a little excitement in your life. Here is a way to do just that.
This post revolves around the idea of giving a command a percent chance of running. While the topic at hand is not serious, this simple technique has potential in your scripts.
Feedback/Questions
Guy - AMD GPU Help (http://dpaste.com/2NEPDHB)
MLShroyer13 - VLANs and Jails (http://dpaste.com/31KBNP4#wrap)
Master One - ZFS Suspend/resume (http://dpaste.com/0DKM8CF#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, text processing, shell, rebalancing, mirror, mirror rebalancing, zfs, zpool, security, security headers, relayd, hierarchy, speed up, performance, zsh, pipe, pipes, Unix, ifconfig, terminal</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://blog.balthazar-rouberol.com/text-processing-in-the-shell" rel="nofollow">Text processing in the shell</a></h3>

<blockquote>
<p>This article is part of a self-published book project by Balthazar Rouberol and Etienne Brodu, ex-roommates, friends and colleagues, aiming at empowering the up and coming generation of developers. We currently are hard at work on it!</p>

<p>One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc.</p>

<p>When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.</p>
</blockquote>

<hr>

<h3><a href="https://jrs-s.net/2020/03/10/rebalancing-data-on-zfs-mirrors/" rel="nofollow">Rebalancing data on ZFS mirrors</a></h3>

<blockquote>
<p>One of the questions that comes up time and time again about ZFS is “how can I migrate my data to a pool on a few of my disks, then add the rest of the disks afterward?”</p>

<p>If you just want to get the data moved and don’t care about balance, you can just copy the data over, then add the new disks and be done with it. But, it won’t be distributed evenly over the vdevs in your pool.</p>

<p>Don’t fret, though, it’s actually pretty easy to rebalance mirrors. In the following example, we’ll assume you’ve got four disks in a RAID array on an old machine, and two disks available to copy the data to in the short term.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://web.archive.org/web/20191109121500/https://goblackcat.com/posts/using-openbsd-relayd-to-add-security-headers/" rel="nofollow">Using OpenBSD relayd to Add Security Headers</a></h3>

<blockquote>
<p>I am a huge fan of OpenBSD’s built-in httpd server as it is simple, secure, and quite performant. With the modern push of the large search providers pushing secure websites, it is now important to add security headers to your website or risk having the search results for your website downgraded. Fortunately, it is very easy to do this when you combine httpd with relayd. While relayd is principally designed for layer 3 redirections and layer 7 relays, it just so happens that it makes a handy tool for adding the recommended security headers. My website automatically redirects users from http to https and this gets achieved using a simple redirection in /etc/httpd.conf So if you have a configuration similar to mine, then you will still want to have httpd listen on the egress interface on port 80. The key thing to change here is to have httpd listen on 127.0.0.1 on port 443.</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSOurContainerFilesystems" rel="nofollow">How we set up our ZFS filesystem hierarchy in our ZFS pools</a></h3>

<blockquote>
<p>Our long standing practice here, predating even the first generation of our ZFS fileservers, is that we have two main sorts of filesystems, home directories (homedir filesystems) and what we call &#39;work directory&#39; (workdir) filesystems. Homedir filesystems are called /h/NNN (for some NNN) and workdir filesystems are called /w/NNN; the NNN is unique across all of the different sorts of filesystems. Users are encouraged to put as much stuff as possible in workdirs and can have as many of them as they want, which mattered a lot more in the days when we used Solaris DiskSuite and had fixed-sized filesystems.</p>
</blockquote>

<hr>

<h3><a href="https://blog.jonlu.ca/posts/speeding-up-zsh" rel="nofollow">Speeding up ZSH</a></h3>

<p><a href="https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh" rel="nofollow">https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh</a></p>

<blockquote>
<p>I was opening multiple shells for an unrelated project today and noticed how abysmal my shell load speed was. After the initial load it was relatively fast, but the actual shell start up was noticeably slow. I timed it with time and these were the results.</p>

<p>In the future I hope to actually recompile zsh with additional profiling techniques and debug information - keeping an internal timer and having a flag output current time for each command in a tree fashion would make building heat maps really easy.</p>
</blockquote>

<hr>

<h3><a href="https://www.vegardstikbakke.com/how-do-pipes-work-sigpipe/" rel="nofollow">How do Unix Pipes work</a></h3>

<blockquote>
<p>Pipes are cool! We saw how handy they are in a previous blog post. Let’s look at a typical way to use the pipe operator. We have some output, and we want to look at the first lines of the output. Let’s download The Brothers Karamazov by Fyodor Dostoevsky, a fairly long novel.</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSHowWeGrowPools" rel="nofollow">What we do to enable us to grow our ZFS pools over time</a></h3>

<blockquote>
<p>In my entry on why ZFS isn&#39;t good at growing and reshaping pools, I mentioned that we go to quite some lengths in our ZFS environment to be able to incrementally expand our pools. Today I want to put together all of the pieces of that in one place to discuss what those lengths are.<br>
Our big constraint is that not only do we need to add space to pools over time, but we have a fairly large number of pools and which pools will have space added to them is unpredictable. We need a solution to pool expansion that leaves us with as much flexibility as possible for as long as possible. This pretty much requires being able to expand pools in relatively small increments of space.</p>
</blockquote>

<hr>

<h3><a href="https://blog.farhan.codes/2018/06/25/linux-maintains-bugs-the-real-reason-ifconfig-on-linux-is-deprecated/" rel="nofollow">Linux maintains bugs: The real reason ifconfig on Linux is deprecated</a></h3>

<blockquote>
<p>In my third installment of FreeBSD vs Linux, I will discuss underlying reasons for why Linux moved away from ifconfig(8) to ip(8).</p>
</blockquote>

<p>In the past, when people said, “Linux is a kernel, not an operating system”, I knew that was true but I always thought it was a rather pedantic criticism. Of course no one runs just the Linux kernel, you run a distribution of Linux. But after reviewing userland code, I understand the significant drawbacks to developing “just a kernel” in isolation from the rest of the system.</p>

<hr>

<h3><a href="https://adammusciano.com/2020/03/04/2020-03-04-clear-your-terminal-in-style/" rel="nofollow">Clear Your Terminal in Style</a></h3>

<blockquote>
<p>if you’re someone like me who habitually clears their terminal, sometimes you want a little excitement in your life. Here is a way to do just that.</p>

<p>This post revolves around the idea of giving a command a percent chance of running. While the topic at hand is not serious, this simple technique has potential in your scripts.</p>
</blockquote>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Guy - <a href="http://dpaste.com/2NEPDHB" rel="nofollow">AMD GPU Help</a></li>
<li>MLShroyer13 - <a href="http://dpaste.com/31KBNP4#wrap" rel="nofollow">VLANs and Jails</a></li>
<li>Master One - <a href="http://dpaste.com/0DKM8CF#wrap" rel="nofollow">ZFS Suspend/resume</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0344.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://blog.balthazar-rouberol.com/text-processing-in-the-shell" rel="nofollow">Text processing in the shell</a></h3>

<blockquote>
<p>This article is part of a self-published book project by Balthazar Rouberol and Etienne Brodu, ex-roommates, friends and colleagues, aiming at empowering the up and coming generation of developers. We currently are hard at work on it!</p>

<p>One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc.</p>

<p>When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.</p>
</blockquote>

<hr>

<h3><a href="https://jrs-s.net/2020/03/10/rebalancing-data-on-zfs-mirrors/" rel="nofollow">Rebalancing data on ZFS mirrors</a></h3>

<blockquote>
<p>One of the questions that comes up time and time again about ZFS is “how can I migrate my data to a pool on a few of my disks, then add the rest of the disks afterward?”</p>

<p>If you just want to get the data moved and don’t care about balance, you can just copy the data over, then add the new disks and be done with it. But, it won’t be distributed evenly over the vdevs in your pool.</p>

<p>Don’t fret, though, it’s actually pretty easy to rebalance mirrors. In the following example, we’ll assume you’ve got four disks in a RAID array on an old machine, and two disks available to copy the data to in the short term.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://web.archive.org/web/20191109121500/https://goblackcat.com/posts/using-openbsd-relayd-to-add-security-headers/" rel="nofollow">Using OpenBSD relayd to Add Security Headers</a></h3>

<blockquote>
<p>I am a huge fan of OpenBSD’s built-in httpd server as it is simple, secure, and quite performant. With the modern push of the large search providers pushing secure websites, it is now important to add security headers to your website or risk having the search results for your website downgraded. Fortunately, it is very easy to do this when you combine httpd with relayd. While relayd is principally designed for layer 3 redirections and layer 7 relays, it just so happens that it makes a handy tool for adding the recommended security headers. My website automatically redirects users from http to https and this gets achieved using a simple redirection in /etc/httpd.conf So if you have a configuration similar to mine, then you will still want to have httpd listen on the egress interface on port 80. The key thing to change here is to have httpd listen on 127.0.0.1 on port 443.</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSOurContainerFilesystems" rel="nofollow">How we set up our ZFS filesystem hierarchy in our ZFS pools</a></h3>

<blockquote>
<p>Our long standing practice here, predating even the first generation of our ZFS fileservers, is that we have two main sorts of filesystems, home directories (homedir filesystems) and what we call &#39;work directory&#39; (workdir) filesystems. Homedir filesystems are called /h/NNN (for some NNN) and workdir filesystems are called /w/NNN; the NNN is unique across all of the different sorts of filesystems. Users are encouraged to put as much stuff as possible in workdirs and can have as many of them as they want, which mattered a lot more in the days when we used Solaris DiskSuite and had fixed-sized filesystems.</p>
</blockquote>

<hr>

<h3><a href="https://blog.jonlu.ca/posts/speeding-up-zsh" rel="nofollow">Speeding up ZSH</a></h3>

<p><a href="https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh" rel="nofollow">https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh</a></p>

<blockquote>
<p>I was opening multiple shells for an unrelated project today and noticed how abysmal my shell load speed was. After the initial load it was relatively fast, but the actual shell start up was noticeably slow. I timed it with time and these were the results.</p>

<p>In the future I hope to actually recompile zsh with additional profiling techniques and debug information - keeping an internal timer and having a flag output current time for each command in a tree fashion would make building heat maps really easy.</p>
</blockquote>

<hr>

<h3><a href="https://www.vegardstikbakke.com/how-do-pipes-work-sigpipe/" rel="nofollow">How do Unix Pipes work</a></h3>

<blockquote>
<p>Pipes are cool! We saw how handy they are in a previous blog post. Let’s look at a typical way to use the pipe operator. We have some output, and we want to look at the first lines of the output. Let’s download The Brothers Karamazov by Fyodor Dostoevsky, a fairly long novel.</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSHowWeGrowPools" rel="nofollow">What we do to enable us to grow our ZFS pools over time</a></h3>

<blockquote>
<p>In my entry on why ZFS isn&#39;t good at growing and reshaping pools, I mentioned that we go to quite some lengths in our ZFS environment to be able to incrementally expand our pools. Today I want to put together all of the pieces of that in one place to discuss what those lengths are.<br>
Our big constraint is that not only do we need to add space to pools over time, but we have a fairly large number of pools and which pools will have space added to them is unpredictable. We need a solution to pool expansion that leaves us with as much flexibility as possible for as long as possible. This pretty much requires being able to expand pools in relatively small increments of space.</p>
</blockquote>

<hr>

<h3><a href="https://blog.farhan.codes/2018/06/25/linux-maintains-bugs-the-real-reason-ifconfig-on-linux-is-deprecated/" rel="nofollow">Linux maintains bugs: The real reason ifconfig on Linux is deprecated</a></h3>

<blockquote>
<p>In my third installment of FreeBSD vs Linux, I will discuss underlying reasons for why Linux moved away from ifconfig(8) to ip(8).</p>
</blockquote>

<p>In the past, when people said, “Linux is a kernel, not an operating system”, I knew that was true but I always thought it was a rather pedantic criticism. Of course no one runs just the Linux kernel, you run a distribution of Linux. But after reviewing userland code, I understand the significant drawbacks to developing “just a kernel” in isolation from the rest of the system.</p>

<hr>

<h3><a href="https://adammusciano.com/2020/03/04/2020-03-04-clear-your-terminal-in-style/" rel="nofollow">Clear Your Terminal in Style</a></h3>

<blockquote>
<p>if you’re someone like me who habitually clears their terminal, sometimes you want a little excitement in your life. Here is a way to do just that.</p>

<p>This post revolves around the idea of giving a command a percent chance of running. While the topic at hand is not serious, this simple technique has potential in your scripts.</p>
</blockquote>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Guy - <a href="http://dpaste.com/2NEPDHB" rel="nofollow">AMD GPU Help</a></li>
<li>MLShroyer13 - <a href="http://dpaste.com/31KBNP4#wrap" rel="nofollow">VLANs and Jails</a></li>
<li>Master One - <a href="http://dpaste.com/0DKM8CF#wrap" rel="nofollow">ZFS Suspend/resume</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0344.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>343: FreeBSD, Corona: Fight!</title>
  <link>https://www.bsdnow.tv/343</link>
  <guid isPermaLink="false">1752e8c2-3d6e-40dc-8bd9-5c7654660b15</guid>
  <pubDate>Thu, 26 Mar 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1752e8c2-3d6e-40dc-8bd9-5c7654660b15.mp3" length="28131915" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Fighting the Coronavirus with FreeBSD, Wireguard VPN Howto in OPNsense, NomadBSD 1.3.1 available, fresh GhostBSD 20.02, New FuryBSD XFCE and KDE images, pf-badhost 0.3 released, and more.</itunes:subtitle>
  <itunes:duration>39:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Fighting the Coronavirus with FreeBSD, Wireguard VPN Howto in OPNsense, NomadBSD 1.3.1 available, fresh GhostBSD 20.02, New FuryBSD XFCE and KDE images, pf-badhost 0.3 released, and more.
Headlines
Fighting the Coronavirus with FreeBSD (https://www.leidinger.net/blog/2020/03/19/fighting-the-coronavirus-with-freebsd-foldinghome/)
Here is a quick HOWTO for those who want to provide some FreeBSD based compute resources to help finding vaccines.
UPDATE 2020-03-22: 0mp@ made a port out of this, it is in “biology/linux-foldingathome”.
Per default it will now pick up some SARS-CoV‑2 (COVID-19) related folding tasks. There are some more config options (e.g. how much of the system resources are used). Please refer to the official Folding@Home site for more information about that. Be also aware that there is a big rise in compute resources donated to Folding@Home, so the pool of available work units may be empty from time to time, but they are working on adding more work units. Be patient.
How to configure the Wireguard VPN in OPNsense (https://homenetworkguy.com/how-to/configure-wireguard-opnsense/)
WireGuard is a modern designed VPN that uses the latest cryptography for stronger security, is very lightweight, and is relatively easy to set up (mostly). I say ‘mostly’ because I found setting up WireGuard in OPNsense to be more difficult than I anticipated. The basic setup of the WireGuard VPN itself was as easy as the authors claim on their website, but I came across a few gotcha's. The gotcha's occur with functionality that is beyond the scope of the WireGuard protocol so I cannot fault them for that. My greatest struggle was configuring WireGuard to function similarly to my OpenVPN server. I want the ability to connect remotely to my home network from my iPhone or iPad, tunnel all traffic through the VPN, have access to certain devices and services on my network, and have the VPN devices use my home's Internet connection.
WireGuard behaves more like a SSH server than a typical VPN server. With WireGuard, devices which have shared their cryptographic keys with each other are able to connect via an encrypted tunnel (like a SSH server configured to use keys instead of passwords). The devices that are connecting to one another are referred to as “peer” devices. When the peer device is an OPNsense router with WireGuard installed, for instance, it can be configured to allow access to various resources on your network. It becomes a tunnel into your network similar to OpenVPN (with the appropriate firewall rules enabled). I will refer to the WireGuard installation on OPNsense as the server rather than a “peer” to make it more clear which device I am configuring unless I am describing the user interface because that is the terminology used interchangeably by WireGuard.
The documentation I found on WireGuard in OPNsense is straightforward and relatively easy to understand, but I had to wrestle with it for a little while to gain a better understanding on how it should be configured. I believe it was partially due to differing end goals – I was trying to achieve something a little different than the authors of other wiki/blog/forum posts. Piecing together various sources of information, I finally ended up with a configuration that met the goals stated above.
News Roundup
NomadBSD 1.3.1 (https://nomadbsd.org/index.html#1.3.1)
NomadBSD 1.3.1 has recently been made available. NomadBSD is a lightweight and portable FreeBSD distribution, designed to run on live on a USB flash drive, allowing you to plug, test, and play on different hardware. They have also started a forum as of yesterday, where you can ask questions and mingle with the NomadBSD community. Notable changes in 1.3.1 are base system upgraded to FreeBSD 12.1-p2. automatic network interface setup improved, image size increased to over 4GB, Thunderbird, Zeroconf, and some more listed below.
GhostBSD 20.02 (https://ghostbsd.org/20.02_release_announcement)
Eric Turgeon, main developer of GhostBSD, has announced version 20.02 of the FreeBSD based operating system. Notable changes are ZFS partition into the custom partition editor installer, allowing you to install alongside with Windows, Linux, or macOS. Other changes are force upgrade all packages on system upgrade, improved update station, and powerd by default for laptop battery performance.
New FuryBSD XFCE and KDE images (https://www.furybsd.org/new-furybsd-12-1-based-images-are-available-for-xfce-and-kde/)
This new release is now based on FreeBSD 12.1 with the latest FreeBSD quarterly packages. This brings XFCE up to 4.14, and KDE up to 5.17. In addition to updates this new ISO mostly addresses community bugs, community enhancement requests, and community pull requests. Due to the overwhelming amount of reports with GitHub hosting all new releases are now being pushed to SourceForge only for the time being. Previous releases will still be kept for archive purposes.
pf-badhost 0.3 Released (https://www.geoghegan.ca/pfbadhost.html)
pf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet's biggest irritants. Annoyances such as SSH and SMTP bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.
Beastie Bits
DragonFly i915 drm update (https://www.dragonflydigest.com/2020/03/23/24324.html)
CShell is punk rock (http://blog.snailtext.com/posts/cshell-is-punk-rock.html)
The most surprising Unix programs (https://minnie.tuhs.org/pipermail/tuhs/2020-March/020664.html)
Feedback/Questions
Master One - Torn between OpenBSD and FreeBSD (http://dpaste.com/102HKF5#wrap)
Brad - Follow up to Linus ZFS story (http://dpaste.com/1VXQA2Y#wrap)
Filipe Carvalho - Call for Portuguese BSD User Groups (http://dpaste.com/2H7S8YP)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, corona, corona virus, covid-19, foldingathome, folding at home, wireguard, vpn, opnsense, nomadbsd, ghostbsd, furybsd, xfce, kde, pf, pf-badhost </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Fighting the Coronavirus with FreeBSD, Wireguard VPN Howto in OPNsense, NomadBSD 1.3.1 available, fresh GhostBSD 20.02, New FuryBSD XFCE and KDE images, pf-badhost 0.3 released, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.leidinger.net/blog/2020/03/19/fighting-the-coronavirus-with-freebsd-foldinghome/" rel="nofollow">Fighting the Coronavirus with FreeBSD</a></h3>

<blockquote>
<p>Here is a quick HOWTO for those who want to provide some FreeBSD based compute resources to help finding vaccines.</p>

<p>UPDATE 2020-03-22: 0mp@ made a port out of this, it is in “biology/linux-foldingathome”.</p>

<p>Per default it will now pick up some SARS-CoV‑2 (COVID-19) related folding tasks. There are some more config options (e.g. how much of the system resources are used). Please refer to the official Folding@Home site for more information about that. Be also aware that there is a big rise in compute resources donated to Folding@Home, so the pool of available work units may be empty from time to time, but they are working on adding more work units. Be patient.</p>
</blockquote>

<hr>

<h3><a href="https://homenetworkguy.com/how-to/configure-wireguard-opnsense/" rel="nofollow">How to configure the Wireguard VPN in OPNsense</a></h3>

<blockquote>
<p>WireGuard is a modern designed VPN that uses the latest cryptography for stronger security, is very lightweight, and is relatively easy to set up (mostly). I say ‘mostly’ because I found setting up WireGuard in OPNsense to be more difficult than I anticipated. The basic setup of the WireGuard VPN itself was as easy as the authors claim on their website, but I came across a few gotcha&#39;s. The gotcha&#39;s occur with functionality that is beyond the scope of the WireGuard protocol so I cannot fault them for that. My greatest struggle was configuring WireGuard to function similarly to my OpenVPN server. I want the ability to connect remotely to my home network from my iPhone or iPad, tunnel all traffic through the VPN, have access to certain devices and services on my network, and have the VPN devices use my home&#39;s Internet connection.</p>

<p>WireGuard behaves more like a SSH server than a typical VPN server. With WireGuard, devices which have shared their cryptographic keys with each other are able to connect via an encrypted tunnel (like a SSH server configured to use keys instead of passwords). The devices that are connecting to one another are referred to as “peer” devices. When the peer device is an OPNsense router with WireGuard installed, for instance, it can be configured to allow access to various resources on your network. It becomes a tunnel into your network similar to OpenVPN (with the appropriate firewall rules enabled). I will refer to the WireGuard installation on OPNsense as the server rather than a “peer” to make it more clear which device I am configuring unless I am describing the user interface because that is the terminology used interchangeably by WireGuard.</p>

<p>The documentation I found on WireGuard in OPNsense is straightforward and relatively easy to understand, but I had to wrestle with it for a little while to gain a better understanding on how it should be configured. I believe it was partially due to differing end goals – I was trying to achieve something a little different than the authors of other wiki/blog/forum posts. Piecing together various sources of information, I finally ended up with a configuration that met the goals stated above.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://nomadbsd.org/index.html#1.3.1" rel="nofollow">NomadBSD 1.3.1</a></h3>

<blockquote>
<p>NomadBSD 1.3.1 has recently been made available. NomadBSD is a lightweight and portable FreeBSD distribution, designed to run on live on a USB flash drive, allowing you to plug, test, and play on different hardware. They have also started a forum as of yesterday, where you can ask questions and mingle with the NomadBSD community. Notable changes in 1.3.1 are base system upgraded to FreeBSD 12.1-p2. automatic network interface setup improved, image size increased to over 4GB, Thunderbird, Zeroconf, and some more listed below.</p>
</blockquote>

<hr>

<h3><a href="https://ghostbsd.org/20.02_release_announcement" rel="nofollow">GhostBSD 20.02</a></h3>

<blockquote>
<p>Eric Turgeon, main developer of GhostBSD, has announced version 20.02 of the FreeBSD based operating system. Notable changes are ZFS partition into the custom partition editor installer, allowing you to install alongside with Windows, Linux, or macOS. Other changes are force upgrade all packages on system upgrade, improved update station, and powerd by default for laptop battery performance.</p>
</blockquote>

<hr>

<h3><a href="https://www.furybsd.org/new-furybsd-12-1-based-images-are-available-for-xfce-and-kde/" rel="nofollow">New FuryBSD XFCE and KDE images</a></h3>

<blockquote>
<p>This new release is now based on FreeBSD 12.1 with the latest FreeBSD quarterly packages. This brings XFCE up to 4.14, and KDE up to 5.17. In addition to updates this new ISO mostly addresses community bugs, community enhancement requests, and community pull requests. Due to the overwhelming amount of reports with GitHub hosting all new releases are now being pushed to SourceForge only for the time being. Previous releases will still be kept for archive purposes.</p>
</blockquote>

<hr>

<h3><a href="https://www.geoghegan.ca/pfbadhost.html" rel="nofollow">pf-badhost 0.3 Released</a></h3>

<blockquote>
<p>pf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet&#39;s biggest irritants. Annoyances such as SSH and SMTP bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/03/23/24324.html" rel="nofollow">DragonFly i915 drm update</a></li>
<li><a href="http://blog.snailtext.com/posts/cshell-is-punk-rock.html" rel="nofollow">CShell is punk rock</a></li>
<li><a href="https://minnie.tuhs.org/pipermail/tuhs/2020-March/020664.html" rel="nofollow">The most surprising Unix programs</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Master One - <a href="http://dpaste.com/102HKF5#wrap" rel="nofollow">Torn between OpenBSD and FreeBSD</a></li>
<li>Brad - <a href="http://dpaste.com/1VXQA2Y#wrap" rel="nofollow">Follow up to Linus ZFS story</a></li>
<li>Filipe Carvalho - <a href="http://dpaste.com/2H7S8YP" rel="nofollow">Call for Portuguese BSD User Groups</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0343.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Fighting the Coronavirus with FreeBSD, Wireguard VPN Howto in OPNsense, NomadBSD 1.3.1 available, fresh GhostBSD 20.02, New FuryBSD XFCE and KDE images, pf-badhost 0.3 released, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.leidinger.net/blog/2020/03/19/fighting-the-coronavirus-with-freebsd-foldinghome/" rel="nofollow">Fighting the Coronavirus with FreeBSD</a></h3>

<blockquote>
<p>Here is a quick HOWTO for those who want to provide some FreeBSD based compute resources to help finding vaccines.</p>

<p>UPDATE 2020-03-22: 0mp@ made a port out of this, it is in “biology/linux-foldingathome”.</p>

<p>Per default it will now pick up some SARS-CoV‑2 (COVID-19) related folding tasks. There are some more config options (e.g. how much of the system resources are used). Please refer to the official Folding@Home site for more information about that. Be also aware that there is a big rise in compute resources donated to Folding@Home, so the pool of available work units may be empty from time to time, but they are working on adding more work units. Be patient.</p>
</blockquote>

<hr>

<h3><a href="https://homenetworkguy.com/how-to/configure-wireguard-opnsense/" rel="nofollow">How to configure the Wireguard VPN in OPNsense</a></h3>

<blockquote>
<p>WireGuard is a modern designed VPN that uses the latest cryptography for stronger security, is very lightweight, and is relatively easy to set up (mostly). I say ‘mostly’ because I found setting up WireGuard in OPNsense to be more difficult than I anticipated. The basic setup of the WireGuard VPN itself was as easy as the authors claim on their website, but I came across a few gotcha&#39;s. The gotcha&#39;s occur with functionality that is beyond the scope of the WireGuard protocol so I cannot fault them for that. My greatest struggle was configuring WireGuard to function similarly to my OpenVPN server. I want the ability to connect remotely to my home network from my iPhone or iPad, tunnel all traffic through the VPN, have access to certain devices and services on my network, and have the VPN devices use my home&#39;s Internet connection.</p>

<p>WireGuard behaves more like a SSH server than a typical VPN server. With WireGuard, devices which have shared their cryptographic keys with each other are able to connect via an encrypted tunnel (like a SSH server configured to use keys instead of passwords). The devices that are connecting to one another are referred to as “peer” devices. When the peer device is an OPNsense router with WireGuard installed, for instance, it can be configured to allow access to various resources on your network. It becomes a tunnel into your network similar to OpenVPN (with the appropriate firewall rules enabled). I will refer to the WireGuard installation on OPNsense as the server rather than a “peer” to make it more clear which device I am configuring unless I am describing the user interface because that is the terminology used interchangeably by WireGuard.</p>

<p>The documentation I found on WireGuard in OPNsense is straightforward and relatively easy to understand, but I had to wrestle with it for a little while to gain a better understanding on how it should be configured. I believe it was partially due to differing end goals – I was trying to achieve something a little different than the authors of other wiki/blog/forum posts. Piecing together various sources of information, I finally ended up with a configuration that met the goals stated above.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://nomadbsd.org/index.html#1.3.1" rel="nofollow">NomadBSD 1.3.1</a></h3>

<blockquote>
<p>NomadBSD 1.3.1 has recently been made available. NomadBSD is a lightweight and portable FreeBSD distribution, designed to run on live on a USB flash drive, allowing you to plug, test, and play on different hardware. They have also started a forum as of yesterday, where you can ask questions and mingle with the NomadBSD community. Notable changes in 1.3.1 are base system upgraded to FreeBSD 12.1-p2. automatic network interface setup improved, image size increased to over 4GB, Thunderbird, Zeroconf, and some more listed below.</p>
</blockquote>

<hr>

<h3><a href="https://ghostbsd.org/20.02_release_announcement" rel="nofollow">GhostBSD 20.02</a></h3>

<blockquote>
<p>Eric Turgeon, main developer of GhostBSD, has announced version 20.02 of the FreeBSD based operating system. Notable changes are ZFS partition into the custom partition editor installer, allowing you to install alongside with Windows, Linux, or macOS. Other changes are force upgrade all packages on system upgrade, improved update station, and powerd by default for laptop battery performance.</p>
</blockquote>

<hr>

<h3><a href="https://www.furybsd.org/new-furybsd-12-1-based-images-are-available-for-xfce-and-kde/" rel="nofollow">New FuryBSD XFCE and KDE images</a></h3>

<blockquote>
<p>This new release is now based on FreeBSD 12.1 with the latest FreeBSD quarterly packages. This brings XFCE up to 4.14, and KDE up to 5.17. In addition to updates this new ISO mostly addresses community bugs, community enhancement requests, and community pull requests. Due to the overwhelming amount of reports with GitHub hosting all new releases are now being pushed to SourceForge only for the time being. Previous releases will still be kept for archive purposes.</p>
</blockquote>

<hr>

<h3><a href="https://www.geoghegan.ca/pfbadhost.html" rel="nofollow">pf-badhost 0.3 Released</a></h3>

<blockquote>
<p>pf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet&#39;s biggest irritants. Annoyances such as SSH and SMTP bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/03/23/24324.html" rel="nofollow">DragonFly i915 drm update</a></li>
<li><a href="http://blog.snailtext.com/posts/cshell-is-punk-rock.html" rel="nofollow">CShell is punk rock</a></li>
<li><a href="https://minnie.tuhs.org/pipermail/tuhs/2020-March/020664.html" rel="nofollow">The most surprising Unix programs</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Master One - <a href="http://dpaste.com/102HKF5#wrap" rel="nofollow">Torn between OpenBSD and FreeBSD</a></li>
<li>Brad - <a href="http://dpaste.com/1VXQA2Y#wrap" rel="nofollow">Follow up to Linus ZFS story</a></li>
<li>Filipe Carvalho - <a href="http://dpaste.com/2H7S8YP" rel="nofollow">Call for Portuguese BSD User Groups</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0343.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>342: Layout the DVA</title>
  <link>https://www.bsdnow.tv/342</link>
  <guid isPermaLink="false">d6b1fa91-dcee-41e7-9e1c-b0f240d34ea0</guid>
  <pubDate>Thu, 19 Mar 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d6b1fa91-dcee-41e7-9e1c-b0f240d34ea0.mp3" length="34437665" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD Full disk encryption with coreboot and tianocore, FreeBSD 12.0 EOL, ZFS DVA layout, OpenBSD’s Go situation, AD updates requires changes in TrueNAS and FreeNAS, full name of FreeBSD’s root account, and more.</itunes:subtitle>
  <itunes:duration>47:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD Full disk encryption with coreboot and tianocore, FreeBSD 12.0 EOL, ZFS DVA layout, OpenBSD’s Go situation, AD updates requires changes in TrueNAS and FreeNAS, full name of FreeBSD’s root account, and more.
Headlines
OpenBSD Full Disk Encryption with CoreBoot and Tianocore Payload (https://functionallyparanoid.com/2020/03/07/openbsd-full-disk-encryption-with-coreboot-and-tianocore-payload/)
It has been a while since I have posted here so I wanted to share something that was surprisingly difficult for me to figure out.  I have a Thinkpad T440p that I have flashed with Coreboot 4.11 with some special patches that allow the newer machine to work.  When I got the laptop, the default BIOS was UEFI and I installed two operating systems.
Windows 10 with bitlocker full disk encryption on the “normal” drive (I replaced the spinning 2.5″ disk with an SSD)
Ubuntu 19.10 on the m.2 SATA drive that I installed using LUKS full disk encryption
I purchased one of those carriers for the optical bay that allows you to install a third SSD and so I did that with the intent of putting OpenBSD on it.  Since my other two operating systems were running full disk encryption, I wanted to do the same on OpenBSD.
See article for rest of story
FreeBSD 12.0 EOL (https://lists.freebsd.org/pipermail/freebsd-announce/2020-February/001930.html)
Dear FreeBSD community,
As of February 29, 2020, FreeBSD 12.0 will reach end-of-life and will no longer be supported by the FreeBSD Security Team.  Users of FreeBSD 12.0 are strongly encouraged to upgrade to a newer release as soon as possible.
12.1 Active release (https://www.freebsd.org/releases/12.1R/announce.html)
12.2 Release Schedule (https://www.freebsd.org/releases/12.2R/schedule.html)
News Roundup
Some effects of the ZFS DVA format on data layout and growing ZFS pools (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSDVAFormatAndGrowth)
One piece of ZFS terminology is DVA and DVAs, which is short for Data Virtual Address. For ZFS, a DVA is the equivalent of a block number in other filesystems; it tells ZFS where to find whatever data we're talking about. The short summary of what fields DVAs have and what they mean is that DVAs tell us how to find blocks by giving us their vdev (by number) and their byte offset into that particular vdev (and then their size). A typical DVA might say that you find what it's talking about on vdev 0 at byte offset 0x53a40ed000. There are some consequences of this that I hadn't really thought about until the other day.
Right away we can see why ZFS has a problem removing a vdev; the vdev's number is burned into every DVA that refers to data on it. If there's no vdev 0 in the pool, ZFS has no idea where to even start looking for data because all addressing is relative to the vdev. ZFS pool shrinking gets around this by adding a translation layer that says where to find the portions of vdev 0 that you care about after it's been removed.
Warning! Active Directory Security Changes Require TrueNAS and FreeNAS Updates. (https://www.ixsystems.com/blog/active-directory-truenas-and-freenas/)
Critical Information for Current FreeNAS and TrueNAS Users
Microsoft is changing the security defaults for Active Directory to eliminate some security vulnerabilities in its protocols. Unfortunately, these new security defaults may disrupt existing FreeNAS/TrueNAS deployments once Windows systems are updated. The Windows updates may appear sometime in March 2020; no official date has been announced as of yet.
FreeNAS and TrueNAS users that utilize Active Directory should update to version 11.3 (or 11.2-U8) to avoid potential disruption of their networks when updating to the latest versions of Windows software after March 1, 2020. Version 11.3 has been released and version 11.2-U8 will be available in early March.
Full name of the FreeBSD Root Account (https://www.geeklan.co.uk/?p=2457)
NetBSD now has a users(7) and groups(7) manual. Looking into what entries existed in the passwd and group files I wondered about root’s full name who we now know as Charlie Root in the BSDs....
OpenBSD Go Situation (https://utcc.utoronto.ca/~cks/space/blog/programming/GoOpenBSDSituation)
Over in the fediverse, Pete Zaitcev had a reaction to my entry on OpenBSD versus Prometheus for us:
I don't think the situation is usually that bad. Our situation with Prometheus is basically a worst case scenario for Go on OpenBSD, and most people will have much better results, especially if you stick to supported OpenBSD versions.
If you stick to supported OpenBSD versions, upgrading your machines as older OpenBSD releases fall out of support (as the OpenBSD people want you to do), you should not have any problems with your own Go programs. The latest Go release will support the currently supported OpenBSD versions (as long as OpenBSD remains a supported platform for Go), and the Go 1.0 compatibility guarantee means that you can always rebuild your current Go programs with newer versions of Go. You might have problems with compiled binaries that you don't want to rebuild, but my understanding is that this is the case for OpenBSD in general; it doesn't guarantee a stable ABI even for C programs (cf). If you use OpenBSD, you have to be prepared to rebuild your code after OpenBSD upgrades regardless of what language it's written in.
Beastie Bits
Test your TOR (http://lists.nycbug.org/pipermail/talk/2020-February/018174.html)
OPNsense 20.1.1 released (https://opnsense.org/opnsense-20-1-1-released/)
pkg for FreeBSD 1.13 (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=525794)
Feedback/Questions
Bostjan writes in about Wireguard (http://dpaste.com/3WKG09D#wrap)
Charlie has a followup to wpa_supplicant as lower class citizen (http://dpaste.com/0DDN99Q#wrap)
Lars writes about LibreSSL as a positive example (http://dpaste.com/1N12HFB#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, full disk encryption, crypto, coreboot, tianocore, payload, end of life, zfs, openzfs, dva, dva layout, pool, zpool, go, active directory, root account, root</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD Full disk encryption with coreboot and tianocore, FreeBSD 12.0 EOL, ZFS DVA layout, OpenBSD’s Go situation, AD updates requires changes in TrueNAS and FreeNAS, full name of FreeBSD’s root account, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://functionallyparanoid.com/2020/03/07/openbsd-full-disk-encryption-with-coreboot-and-tianocore-payload/" rel="nofollow">OpenBSD Full Disk Encryption with CoreBoot and Tianocore Payload</a></h3>

<blockquote>
<p>It has been a while since I have posted here so I wanted to share something that was surprisingly difficult for me to figure out.  I have a Thinkpad T440p that I have flashed with Coreboot 4.11 with some special patches that allow the newer machine to work.  When I got the laptop, the default BIOS was UEFI and I installed two operating systems.</p>

<p>Windows 10 with bitlocker full disk encryption on the “normal” drive (I replaced the spinning 2.5″ disk with an SSD)</p>

<p>Ubuntu 19.10 on the m.2 SATA drive that I installed using LUKS full disk encryption</p>

<p>I purchased one of those carriers for the optical bay that allows you to install a third SSD and so I did that with the intent of putting OpenBSD on it.  Since my other two operating systems were running full disk encryption, I wanted to do the same on OpenBSD.</p>
</blockquote>

<ul>
<li>See article for rest of story</li>
</ul>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-February/001930.html" rel="nofollow">FreeBSD 12.0 EOL</a></h3>

<blockquote>
<p>Dear FreeBSD community,</p>

<p>As of February 29, 2020, FreeBSD 12.0 will reach end-of-life and will no longer be supported by the FreeBSD Security Team.  Users of FreeBSD 12.0 are strongly encouraged to upgrade to a newer release as soon as possible.</p>
</blockquote>

<ul>
<li><a href="https://www.freebsd.org/releases/12.1R/announce.html" rel="nofollow">12.1 Active release</a></li>
<li><a href="https://www.freebsd.org/releases/12.2R/schedule.html" rel="nofollow">12.2 Release Schedule</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSDVAFormatAndGrowth" rel="nofollow">Some effects of the ZFS DVA format on data layout and growing ZFS pools</a></h3>

<blockquote>
<p>One piece of ZFS terminology is DVA and DVAs, which is short for Data Virtual Address. For ZFS, a DVA is the equivalent of a block number in other filesystems; it tells ZFS where to find whatever data we&#39;re talking about. The short summary of what fields DVAs have and what they mean is that DVAs tell us how to find blocks by giving us their vdev (by number) and their byte offset into that particular vdev (and then their size). A typical DVA might say that you find what it&#39;s talking about on vdev 0 at byte offset 0x53a40ed000. There are some consequences of this that I hadn&#39;t really thought about until the other day.</p>

<p>Right away we can see why ZFS has a problem removing a vdev; the vdev&#39;s number is burned into every DVA that refers to data on it. If there&#39;s no vdev 0 in the pool, ZFS has no idea where to even start looking for data because all addressing is relative to the vdev. ZFS pool shrinking gets around this by adding a translation layer that says where to find the portions of vdev 0 that you care about after it&#39;s been removed.</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/active-directory-truenas-and-freenas/" rel="nofollow">Warning! Active Directory Security Changes Require TrueNAS and FreeNAS Updates.</a></h3>

<ul>
<li>Critical Information for Current FreeNAS and TrueNAS Users</li>
</ul>

<blockquote>
<p>Microsoft is changing the security defaults for Active Directory to eliminate some security vulnerabilities in its protocols. Unfortunately, these new security defaults may disrupt existing FreeNAS/TrueNAS deployments once Windows systems are updated. The Windows updates may appear sometime in March 2020; no official date has been announced as of yet.</p>

<p>FreeNAS and TrueNAS users that utilize Active Directory should update to version 11.3 (or 11.2-U8) to avoid potential disruption of their networks when updating to the latest versions of Windows software after March 1, 2020. Version 11.3 has been released and version 11.2-U8 will be available in early March.</p>
</blockquote>

<hr>

<h3><a href="https://www.geeklan.co.uk/?p=2457" rel="nofollow">Full name of the FreeBSD Root Account</a></h3>

<blockquote>
<p>NetBSD now has a users(7) and groups(7) manual. Looking into what entries existed in the passwd and group files I wondered about root’s full name who we now know as Charlie Root in the BSDs....</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/programming/GoOpenBSDSituation" rel="nofollow">OpenBSD Go Situation</a></h3>

<blockquote>
<p>Over in the fediverse, Pete Zaitcev had a reaction to my entry on OpenBSD versus Prometheus for us:</p>

<p>I don&#39;t think the situation is usually that bad. Our situation with Prometheus is basically a worst case scenario for Go on OpenBSD, and most people will have much better results, especially if you stick to supported OpenBSD versions.</p>

<p>If you stick to supported OpenBSD versions, upgrading your machines as older OpenBSD releases fall out of support (as the OpenBSD people want you to do), you should not have any problems with your own Go programs. The latest Go release will support the currently supported OpenBSD versions (as long as OpenBSD remains a supported platform for Go), and the Go 1.0 compatibility guarantee means that you can always rebuild your current Go programs with newer versions of Go. You might have problems with compiled binaries that you don&#39;t want to rebuild, but my understanding is that this is the case for OpenBSD in general; it doesn&#39;t guarantee a stable ABI even for C programs (cf). If you use OpenBSD, you have to be prepared to rebuild your code after OpenBSD upgrades regardless of what language it&#39;s written in.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.nycbug.org/pipermail/talk/2020-February/018174.html" rel="nofollow">Test your TOR</a></li>
<li><a href="https://opnsense.org/opnsense-20-1-1-released/" rel="nofollow">OPNsense 20.1.1 released</a></li>
<li><a href="https://svnweb.freebsd.org/ports?view=revision&revision=525794" rel="nofollow">pkg for FreeBSD 1.13</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/3WKG09D#wrap" rel="nofollow">Bostjan writes in about Wireguard</a></li>
<li><a href="http://dpaste.com/0DDN99Q#wrap" rel="nofollow">Charlie has a followup to wpa_supplicant as lower class citizen</a></li>
<li><a href="http://dpaste.com/1N12HFB#wrap" rel="nofollow">Lars writes about LibreSSL as a positive example</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0342.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD Full disk encryption with coreboot and tianocore, FreeBSD 12.0 EOL, ZFS DVA layout, OpenBSD’s Go situation, AD updates requires changes in TrueNAS and FreeNAS, full name of FreeBSD’s root account, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://functionallyparanoid.com/2020/03/07/openbsd-full-disk-encryption-with-coreboot-and-tianocore-payload/" rel="nofollow">OpenBSD Full Disk Encryption with CoreBoot and Tianocore Payload</a></h3>

<blockquote>
<p>It has been a while since I have posted here so I wanted to share something that was surprisingly difficult for me to figure out.  I have a Thinkpad T440p that I have flashed with Coreboot 4.11 with some special patches that allow the newer machine to work.  When I got the laptop, the default BIOS was UEFI and I installed two operating systems.</p>

<p>Windows 10 with bitlocker full disk encryption on the “normal” drive (I replaced the spinning 2.5″ disk with an SSD)</p>

<p>Ubuntu 19.10 on the m.2 SATA drive that I installed using LUKS full disk encryption</p>

<p>I purchased one of those carriers for the optical bay that allows you to install a third SSD and so I did that with the intent of putting OpenBSD on it.  Since my other two operating systems were running full disk encryption, I wanted to do the same on OpenBSD.</p>
</blockquote>

<ul>
<li>See article for rest of story</li>
</ul>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-February/001930.html" rel="nofollow">FreeBSD 12.0 EOL</a></h3>

<blockquote>
<p>Dear FreeBSD community,</p>

<p>As of February 29, 2020, FreeBSD 12.0 will reach end-of-life and will no longer be supported by the FreeBSD Security Team.  Users of FreeBSD 12.0 are strongly encouraged to upgrade to a newer release as soon as possible.</p>
</blockquote>

<ul>
<li><a href="https://www.freebsd.org/releases/12.1R/announce.html" rel="nofollow">12.1 Active release</a></li>
<li><a href="https://www.freebsd.org/releases/12.2R/schedule.html" rel="nofollow">12.2 Release Schedule</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSDVAFormatAndGrowth" rel="nofollow">Some effects of the ZFS DVA format on data layout and growing ZFS pools</a></h3>

<blockquote>
<p>One piece of ZFS terminology is DVA and DVAs, which is short for Data Virtual Address. For ZFS, a DVA is the equivalent of a block number in other filesystems; it tells ZFS where to find whatever data we&#39;re talking about. The short summary of what fields DVAs have and what they mean is that DVAs tell us how to find blocks by giving us their vdev (by number) and their byte offset into that particular vdev (and then their size). A typical DVA might say that you find what it&#39;s talking about on vdev 0 at byte offset 0x53a40ed000. There are some consequences of this that I hadn&#39;t really thought about until the other day.</p>

<p>Right away we can see why ZFS has a problem removing a vdev; the vdev&#39;s number is burned into every DVA that refers to data on it. If there&#39;s no vdev 0 in the pool, ZFS has no idea where to even start looking for data because all addressing is relative to the vdev. ZFS pool shrinking gets around this by adding a translation layer that says where to find the portions of vdev 0 that you care about after it&#39;s been removed.</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/active-directory-truenas-and-freenas/" rel="nofollow">Warning! Active Directory Security Changes Require TrueNAS and FreeNAS Updates.</a></h3>

<ul>
<li>Critical Information for Current FreeNAS and TrueNAS Users</li>
</ul>

<blockquote>
<p>Microsoft is changing the security defaults for Active Directory to eliminate some security vulnerabilities in its protocols. Unfortunately, these new security defaults may disrupt existing FreeNAS/TrueNAS deployments once Windows systems are updated. The Windows updates may appear sometime in March 2020; no official date has been announced as of yet.</p>

<p>FreeNAS and TrueNAS users that utilize Active Directory should update to version 11.3 (or 11.2-U8) to avoid potential disruption of their networks when updating to the latest versions of Windows software after March 1, 2020. Version 11.3 has been released and version 11.2-U8 will be available in early March.</p>
</blockquote>

<hr>

<h3><a href="https://www.geeklan.co.uk/?p=2457" rel="nofollow">Full name of the FreeBSD Root Account</a></h3>

<blockquote>
<p>NetBSD now has a users(7) and groups(7) manual. Looking into what entries existed in the passwd and group files I wondered about root’s full name who we now know as Charlie Root in the BSDs....</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/programming/GoOpenBSDSituation" rel="nofollow">OpenBSD Go Situation</a></h3>

<blockquote>
<p>Over in the fediverse, Pete Zaitcev had a reaction to my entry on OpenBSD versus Prometheus for us:</p>

<p>I don&#39;t think the situation is usually that bad. Our situation with Prometheus is basically a worst case scenario for Go on OpenBSD, and most people will have much better results, especially if you stick to supported OpenBSD versions.</p>

<p>If you stick to supported OpenBSD versions, upgrading your machines as older OpenBSD releases fall out of support (as the OpenBSD people want you to do), you should not have any problems with your own Go programs. The latest Go release will support the currently supported OpenBSD versions (as long as OpenBSD remains a supported platform for Go), and the Go 1.0 compatibility guarantee means that you can always rebuild your current Go programs with newer versions of Go. You might have problems with compiled binaries that you don&#39;t want to rebuild, but my understanding is that this is the case for OpenBSD in general; it doesn&#39;t guarantee a stable ABI even for C programs (cf). If you use OpenBSD, you have to be prepared to rebuild your code after OpenBSD upgrades regardless of what language it&#39;s written in.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.nycbug.org/pipermail/talk/2020-February/018174.html" rel="nofollow">Test your TOR</a></li>
<li><a href="https://opnsense.org/opnsense-20-1-1-released/" rel="nofollow">OPNsense 20.1.1 released</a></li>
<li><a href="https://svnweb.freebsd.org/ports?view=revision&revision=525794" rel="nofollow">pkg for FreeBSD 1.13</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/3WKG09D#wrap" rel="nofollow">Bostjan writes in about Wireguard</a></li>
<li><a href="http://dpaste.com/0DDN99Q#wrap" rel="nofollow">Charlie has a followup to wpa_supplicant as lower class citizen</a></li>
<li><a href="http://dpaste.com/1N12HFB#wrap" rel="nofollow">Lars writes about LibreSSL as a positive example</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0342.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>341: U-NAS-ification</title>
  <link>https://www.bsdnow.tv/341</link>
  <guid isPermaLink="false">28217a13-b389-4ab7-bc99-8a6f5d61e5b5</guid>
  <pubDate>Thu, 12 Mar 2020 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/28217a13-b389-4ab7-bc99-8a6f5d61e5b5.mp3" length="36740725" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD on Power, DragonflyBSD 5.8 is here, Unifying FreeNAS/TrueNAS, OpenBSD vs. Prometheus and Go, gcc 4.2.1 removed from FreeBSD base, and more.</itunes:subtitle>
  <itunes:duration>51:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD on Power, DragonflyBSD 5.8 is here, Unifying FreeNAS/TrueNAS, OpenBSD vs. Prometheus and Go, gcc 4.2.1 removed from FreeBSD base, and more.
Headlines
FreeBSD on Power (https://www.freebsdfoundation.org/blog/power-to-the-people-making-freebsd-a-first-class-citizen-on-power/)
The power and promise of all open source software is freedom. Another way to express freedom is choice — choice of platforms, deployment models, stacks, configurations, etc.
The FreeBSD Foundation is dedicated to supporting and promoting the FreeBSD Project and community worldwide. But, what does this mean, exactly, you may wonder. The truth is it means many different things, but in all cases the Foundation acts to expand freedom and choice so that FreeBSD users have the power to serve their varied compute needs.
This blog tells the story of one specific way the Foundation helps a member of the community provide greater hardware choice for all FreeBSD users.
Dragonfly 5.8 (https://www.dragonflybsd.org/release58/)
DragonFly version 5.8 brings a new dsynth utility for building your own binary dports packages, plus significant support work to speed up that build - up to and including the entire collection. Additional progress has been made on GPU and signal support.
The details of all commits between the 5.6 and 5.8 branches are available in the associated commit messages for 5.8.0rc1 and 5.8.0. Also see /usr/src/UPDATING for specific file changes in PAM.
See article for rest of information
2nd HamBUG meeting recap (https://www.hambug.ca/)
The second meeting of the Hamilton BSD Users Group took place last night
The next meeting is scheduled for the 2nd Tuesday of the month, April 14th 2020
News Roundup
FreeNAS/TrueNAS Brand Unification (https://www.ixsystems.com/blog/freenas-truenas-unification/)
FreeNAS and TrueNAS have been separate-but-related members of the #1 Open Source storage software family since 2012. FreeNAS is the free Open Source version with an expert community and has led the pursuit of innovations like Plugins and VMs. TrueNAS is the enterprise version for organizations of all sizes that need additional uptime and performance, as well as the enterprise-grade support necessary for critical data and applications. 
From the beginning at iXsystems, we’ve developed, tested, documented, and released both as separate products, even though the vast majority of code is shared. This was a deliberate technical decision in the beginning but over time became less of a necessity and more of “just how we’ve always done it”. Furthermore, to change it was going to require a serious overhaul to how we build and package both products, among other things, so we continued to kick the can down the road. As we made systematic improvements to development and QA efficiency over the past few years, the redundant release process became almost impossible to ignore as our next major efficiency roadblock to overcome. So, we’ve finally rolled up our sleeves.
With the recent 11.3 release, TrueNAS gained parity with FreeNAS on features like VMs and Plugins, further homogenizing the code. Today, we announce the next phase of evolution for FreeNAS and TrueNAS. 
OpenBSD versus Prometheus (and Go). (https://utcc.utoronto.ca/~cks/space/blog/sysadmin/OpenBSDVsPrometheusAndGo)
We have a decent number of OpenBSD machines that do important things (and that have sometimes experienced problems like running out of disk space), and we have a Prometheus based metrics and monitoring system. The Prometheus host agent has enough support for OpenBSD to be able to report on critical metrics, including things like local disk space. Despite all of this, after some investigation I've determined that it's not really sensible to even try to deploy the host agent on our OpenBSD machines. This is due to a combination of factors that have at their root OpenBSD's lack of ABI stability
FreeBSD removed gcc from base (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=358454)
As described in Warner's email message[1] to the FreeBSD-arch mailing list we have reached GCC 4.2.1's retirement date.  At this time all supported architectures either use in-tree Clang, or rely on external toolchain (i.e., a contemporary GCC version from ports).
GCC 4.2.1 was released July 18, 2007 and was imported into FreeBSD later that year, in r171825.  GCC has served us well, but version 4.2.1 is obsolete and not used by default on any architecture in FreeBSD.  It does not support modern C and does not support arm64 or RISC-V.
Beastie Bits
New Archive location for Dragonfly 4.x (https://www.dragonflydigest.com/2020/03/10/24276.html)
A dead simple git cheat sheet (https://hub.iwebthings.com/a-dead-simple-git-cheatsheet/)
Xorg 1.20.7 on HardenedBSD Comes with IE/RELRO+BIND_NOW/CFI/SafeStack Protections (https://twitter.com/lattera/status/1233412881569415168)
Feedback/Questions
Niclas writes in Regarding the Lenovo E595 user (episode 340) (http://dpaste.com/2YJ6PFW#wrap)
Lyubomir writes about GELI and ZFS (http://dpaste.com/1S0DGT3#wrap)
Peter writes in about scaling FreeBSD jails (http://dpaste.com/2FSZQ8V#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, Power, Power architecture, freenas, truenas, prometheus, go, gcc</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD on Power, DragonflyBSD 5.8 is here, Unifying FreeNAS/TrueNAS, OpenBSD vs. Prometheus and Go, gcc 4.2.1 removed from FreeBSD base, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/power-to-the-people-making-freebsd-a-first-class-citizen-on-power/" rel="nofollow">FreeBSD on Power</a></h3>

<blockquote>
<p>The power and promise of all open source software is freedom. Another way to express freedom is choice — choice of platforms, deployment models, stacks, configurations, etc.</p>

<p>The FreeBSD Foundation is dedicated to supporting and promoting the FreeBSD Project and community worldwide. But, what does this mean, exactly, you may wonder. The truth is it means many different things, but in all cases the Foundation acts to expand freedom and choice so that FreeBSD users have the power to serve their varied compute needs.</p>

<p>This blog tells the story of one specific way the Foundation helps a member of the community provide greater hardware choice for all FreeBSD users.</p>
</blockquote>

<hr>

<h3><a href="https://www.dragonflybsd.org/release58/" rel="nofollow">Dragonfly 5.8</a></h3>

<blockquote>
<p>DragonFly version 5.8 brings a new dsynth utility for building your own binary dports packages, plus significant support work to speed up that build - up to and including the entire collection. Additional progress has been made on GPU and signal support.</p>

<p>The details of all commits between the 5.6 and 5.8 branches are available in the associated commit messages for 5.8.0rc1 and 5.8.0. Also see /usr/src/UPDATING for specific file changes in PAM.</p>
</blockquote>

<ul>
<li>See article for rest of information</li>
</ul>

<hr>

<h3><a href="https://www.hambug.ca/" rel="nofollow">2nd HamBUG meeting recap</a></h3>

<ul>
<li>The second meeting of the Hamilton BSD Users Group took place last night</li>
<li>The next meeting is scheduled for the 2nd Tuesday of the month, April 14th 2020</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.ixsystems.com/blog/freenas-truenas-unification/" rel="nofollow">FreeNAS/TrueNAS Brand Unification</a></h3>

<blockquote>
<p>FreeNAS and TrueNAS have been separate-but-related members of the #1 Open Source storage software family since 2012. FreeNAS is the free Open Source version with an expert community and has led the pursuit of innovations like Plugins and VMs. TrueNAS is the enterprise version for organizations of all sizes that need additional uptime and performance, as well as the enterprise-grade support necessary for critical data and applications. </p>

<p>From the beginning at iXsystems, we’ve developed, tested, documented, and released both as separate products, even though the vast majority of code is shared. This was a deliberate technical decision in the beginning but over time became less of a necessity and more of “just how we’ve always done it”. Furthermore, to change it was going to require a serious overhaul to how we build and package both products, among other things, so we continued to kick the can down the road. As we made systematic improvements to development and QA efficiency over the past few years, the redundant release process became almost impossible to ignore as our next major efficiency roadblock to overcome. So, we’ve finally rolled up our sleeves.</p>

<p>With the recent 11.3 release, TrueNAS gained parity with FreeNAS on features like VMs and Plugins, further homogenizing the code. Today, we announce the next phase of evolution for FreeNAS and TrueNAS. </p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OpenBSDVsPrometheusAndGo" rel="nofollow">OpenBSD versus Prometheus (and Go).</a></h3>

<blockquote>
<p>We have a decent number of OpenBSD machines that do important things (and that have sometimes experienced problems like running out of disk space), and we have a Prometheus based metrics and monitoring system. The Prometheus host agent has enough support for OpenBSD to be able to report on critical metrics, including things like local disk space. Despite all of this, after some investigation I&#39;ve determined that it&#39;s not really sensible to even try to deploy the host agent on our OpenBSD machines. This is due to a combination of factors that have at their root OpenBSD&#39;s lack of ABI stability</p>
</blockquote>

<hr>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=358454" rel="nofollow">FreeBSD removed gcc from base</a></h3>

<blockquote>
<p>As described in Warner&#39;s email message[1] to the FreeBSD-arch mailing list we have reached GCC 4.2.1&#39;s retirement date.  At this time all supported architectures either use in-tree Clang, or rely on external toolchain (i.e., a contemporary GCC version from ports).</p>

<p>GCC 4.2.1 was released July 18, 2007 and was imported into FreeBSD later that year, in r171825.  GCC has served us well, but version 4.2.1 is obsolete and not used by default on any architecture in FreeBSD.  It does not support modern C and does not support arm64 or RISC-V.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/03/10/24276.html" rel="nofollow">New Archive location for Dragonfly 4.x</a></li>
<li><a href="https://hub.iwebthings.com/a-dead-simple-git-cheatsheet/" rel="nofollow">A dead simple git cheat sheet</a></li>
<li><a href="https://twitter.com/lattera/status/1233412881569415168" rel="nofollow">Xorg 1.20.7 on HardenedBSD Comes with IE/RELRO+BIND_NOW/CFI/SafeStack Protections</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2YJ6PFW#wrap" rel="nofollow">Niclas writes in Regarding the Lenovo E595 user (episode 340)</a></li>
<li><a href="http://dpaste.com/1S0DGT3#wrap" rel="nofollow">Lyubomir writes about GELI and ZFS</a></li>
<li><a href="http://dpaste.com/2FSZQ8V#wrap" rel="nofollow">Peter writes in about scaling FreeBSD jails</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0341.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD on Power, DragonflyBSD 5.8 is here, Unifying FreeNAS/TrueNAS, OpenBSD vs. Prometheus and Go, gcc 4.2.1 removed from FreeBSD base, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/power-to-the-people-making-freebsd-a-first-class-citizen-on-power/" rel="nofollow">FreeBSD on Power</a></h3>

<blockquote>
<p>The power and promise of all open source software is freedom. Another way to express freedom is choice — choice of platforms, deployment models, stacks, configurations, etc.</p>

<p>The FreeBSD Foundation is dedicated to supporting and promoting the FreeBSD Project and community worldwide. But, what does this mean, exactly, you may wonder. The truth is it means many different things, but in all cases the Foundation acts to expand freedom and choice so that FreeBSD users have the power to serve their varied compute needs.</p>

<p>This blog tells the story of one specific way the Foundation helps a member of the community provide greater hardware choice for all FreeBSD users.</p>
</blockquote>

<hr>

<h3><a href="https://www.dragonflybsd.org/release58/" rel="nofollow">Dragonfly 5.8</a></h3>

<blockquote>
<p>DragonFly version 5.8 brings a new dsynth utility for building your own binary dports packages, plus significant support work to speed up that build - up to and including the entire collection. Additional progress has been made on GPU and signal support.</p>

<p>The details of all commits between the 5.6 and 5.8 branches are available in the associated commit messages for 5.8.0rc1 and 5.8.0. Also see /usr/src/UPDATING for specific file changes in PAM.</p>
</blockquote>

<ul>
<li>See article for rest of information</li>
</ul>

<hr>

<h3><a href="https://www.hambug.ca/" rel="nofollow">2nd HamBUG meeting recap</a></h3>

<ul>
<li>The second meeting of the Hamilton BSD Users Group took place last night</li>
<li>The next meeting is scheduled for the 2nd Tuesday of the month, April 14th 2020</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.ixsystems.com/blog/freenas-truenas-unification/" rel="nofollow">FreeNAS/TrueNAS Brand Unification</a></h3>

<blockquote>
<p>FreeNAS and TrueNAS have been separate-but-related members of the #1 Open Source storage software family since 2012. FreeNAS is the free Open Source version with an expert community and has led the pursuit of innovations like Plugins and VMs. TrueNAS is the enterprise version for organizations of all sizes that need additional uptime and performance, as well as the enterprise-grade support necessary for critical data and applications. </p>

<p>From the beginning at iXsystems, we’ve developed, tested, documented, and released both as separate products, even though the vast majority of code is shared. This was a deliberate technical decision in the beginning but over time became less of a necessity and more of “just how we’ve always done it”. Furthermore, to change it was going to require a serious overhaul to how we build and package both products, among other things, so we continued to kick the can down the road. As we made systematic improvements to development and QA efficiency over the past few years, the redundant release process became almost impossible to ignore as our next major efficiency roadblock to overcome. So, we’ve finally rolled up our sleeves.</p>

<p>With the recent 11.3 release, TrueNAS gained parity with FreeNAS on features like VMs and Plugins, further homogenizing the code. Today, we announce the next phase of evolution for FreeNAS and TrueNAS. </p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OpenBSDVsPrometheusAndGo" rel="nofollow">OpenBSD versus Prometheus (and Go).</a></h3>

<blockquote>
<p>We have a decent number of OpenBSD machines that do important things (and that have sometimes experienced problems like running out of disk space), and we have a Prometheus based metrics and monitoring system. The Prometheus host agent has enough support for OpenBSD to be able to report on critical metrics, including things like local disk space. Despite all of this, after some investigation I&#39;ve determined that it&#39;s not really sensible to even try to deploy the host agent on our OpenBSD machines. This is due to a combination of factors that have at their root OpenBSD&#39;s lack of ABI stability</p>
</blockquote>

<hr>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=358454" rel="nofollow">FreeBSD removed gcc from base</a></h3>

<blockquote>
<p>As described in Warner&#39;s email message[1] to the FreeBSD-arch mailing list we have reached GCC 4.2.1&#39;s retirement date.  At this time all supported architectures either use in-tree Clang, or rely on external toolchain (i.e., a contemporary GCC version from ports).</p>

<p>GCC 4.2.1 was released July 18, 2007 and was imported into FreeBSD later that year, in r171825.  GCC has served us well, but version 4.2.1 is obsolete and not used by default on any architecture in FreeBSD.  It does not support modern C and does not support arm64 or RISC-V.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2020/03/10/24276.html" rel="nofollow">New Archive location for Dragonfly 4.x</a></li>
<li><a href="https://hub.iwebthings.com/a-dead-simple-git-cheatsheet/" rel="nofollow">A dead simple git cheat sheet</a></li>
<li><a href="https://twitter.com/lattera/status/1233412881569415168" rel="nofollow">Xorg 1.20.7 on HardenedBSD Comes with IE/RELRO+BIND_NOW/CFI/SafeStack Protections</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2YJ6PFW#wrap" rel="nofollow">Niclas writes in Regarding the Lenovo E595 user (episode 340)</a></li>
<li><a href="http://dpaste.com/1S0DGT3#wrap" rel="nofollow">Lyubomir writes about GELI and ZFS</a></li>
<li><a href="http://dpaste.com/2FSZQ8V#wrap" rel="nofollow">Peter writes in about scaling FreeBSD jails</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0341.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>340: Check My Sums</title>
  <link>https://www.bsdnow.tv/340</link>
  <guid isPermaLink="false">7e026ede-d713-4ed5-993a-9a39cab4aab1</guid>
  <pubDate>Thu, 05 Mar 2020 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7e026ede-d713-4ed5-993a-9a39cab4aab1.mp3" length="36478978" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Why ZFS is doing filesystem checksumming right, better TMPFS throughput performance on DragonFlyBSD, reshaping pools with ZFS, PKGSRC on Manjaro aarch64 Pinebook-pro, central log host with syslog-ng on FreeBSD, and more.</itunes:subtitle>
  <itunes:duration>50:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Why ZFS is doing filesystem checksumming right, better TMPFS throughput performance on DragonFlyBSD, reshaping pools with ZFS, PKGSRC on Manjaro aarch64 Pinebook-pro, central log host with syslog-ng on FreeBSD, and more.
Headlines
Checksumming in filesystems, and why ZFS is doing it right (https://oshogbo.vexillium.org/blog/73/)
One of the best aspects of ZFS is its reliability. This can be accomplished using a few features like copy-on-write approach and checksumming. Today we will look at how ZFS does checksumming and why it does it the proper way. Most of the file systems don’t provide any integrity checking and fail in several scenarios:
Data bit flips - when the data that we wanted to store are bit flipped by the hard drives, or cables, and the wrong data is stored on the hard drive.
Misdirected writes - when the CPU/cable/hard drive will bit flip a block to which the data should be written.
Misdirected read - when we miss reading the block when a bit flip occurred.
Phantom writes - when the write operation never made it to the disk. For example, a disk or kernel may have some bug that it will return success even if the hard drive never made the write. This problem can also occur when data is kept only in the hard drive cache.
Checksumming may help us detect errors in a few of those situations.
DragonFlyBSD Improves Its TMPFS Implementation For Better Throughput Performance (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=DragonFlyBSD-TMPFS-Throughput)
It's been a while since last having any new magical optimizations to talk about by DragonFlyBSD lead developer Matthew Dillon, but on Wednesday he landed some significant temporary file-system "TMPFS" optimizations for better throughput including with swap.
Of several interesting commits merged tonight, the improved write clustering is a big one. In particular, "Reduces low-memory tmpfs paging I/O overheads by 4x and generally increases paging throughput to SSD-based swap by 2x-4x. Tmpfs is now able to issue a lot more 64KB I/Os when under memory pressure."
https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860
There's also a new tunable in the VM space as well as part of his commits on Wednesday night. This follows a lot of recent work on dsynth, improved page-out daemon pipelining, and other routine work.
https://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351
This work is building up towards the eventual DragonFlyBSD 5.8 while those wanting to try the latest improvements right away can find their daily snapshots.
News Roundup
Why ZFS is not good at growing and reshaping pools (or shrinking them) (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSWhyNoRealReshaping)
 recently read Mark McBride's Five Years of Btrfs (via), which has a significant discussion of why McBride chose Btrfs over ZFS that boils down to ZFS not being very good at evolving your pool structure. You might doubt this judgment from a Btrfs user, so let me say as both a fan of ZFS and a long term user of it that this is unfortunately quite true; ZFS is not a good choice if you want to modify your pool disk layout significantly over time. ZFS works best if the only change in your pools that you do is replacing drives with bigger drives. In our ZFS environment we go to quite some lengths to be able to expand pools incrementally over time, and while this works it both leaves us with unbalanced pools and means that we're basically forced to use mirroring instead of RAIDZ.
(An unbalanced pool is one where some vdevs and disks have much more data than others. This is less of an issue for us now that we're using SSDs instead of HDs.)
Using PKGSRC on Manjaro Linux aarch64 Pinebook-pro (https://astr0baby.wordpress.com/2020/02/09/using-pkgsrc-on-manjaro-linux-aarch64-pinebook-pro/)
I wanted to see how pkgsrc works on aarch64 Linux Manjaro since it is a very mature framework that is very portable and supported by many architectures – pkgsrc (package source) is a package management system for Unix-like operating systems. It was forked from the FreeBSD ports collection in 1997 as the primary package management system for NetBSD.
One might question why use pkgsrc on Arch based Manjaro, since the pacman package repository is very good on its own. I see alternative pkgsrc as a good automated build framework that offers a way to produce independent build environment /usr/pkg that does not interfere with the current Linux distribution in any way (all libraries are statically built)
I have used the latest Manjaro for Pinebookpro and standard recommended tools as mentioned here https://wiki.netbsd.org/pkgsrc/howtousepkgsrcon_linux/
A Central Log Host with syslog-ng on FreeBSD
Part 1 (https://blog.socruel.nu/freebsd/a-central-log-host-with-syslog-ng-on-freebsd.html)
syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.
Part 2 (https://blog.socruel.nu/freebsd/check-logs-of-syslog-ng-log-host-on-freebsd.html)
This blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not too difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host.
Beastie Bits
FreeBSD at Linux Conf 2020 session videos now online (https://mirror.linux.org.au/pub/linux.conf.au/2020/room_9/Tuesday/)
Unlock your laptop with your phone (https://vermaden.wordpress.com/2020/01/09/freebsd-desktop-part-20-configuration-unlock-your-laptop-with-phone/)
Managing a database of vulnerabilities for a package system: the pkgsrc study (https://www.netbsd.org/gallery/presentations/leot/itasec20/pkgsrc-security.pdf)
Hamilton BSD User group will meet again on March 10th](http://studybsd.com/)
CharmBUG Meeting: March 24th 7pm in Severn, MD (https://www.meetup.com/en-AU/CharmBUG/events/268251508/)
***
Feedback/Questions
Andrew - ZFS feature Flags (http://dpaste.com/2YM23C0#wrap)
Sam - TwinCat BSD (http://dpaste.com/0FCZV6R)
Dacian - Freebsd + amdgpu + Lenovo E595 (http://dpaste.com/1R7F1JN#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, checksumming, filesystem, checksum, zfs, tmpfs, throughput, performance, throughput performance, zpool, pool reshaping, resizing, shrinking, pinebook, pkgsrc, aarch64, log host, central logging, syslog, syslog-ng</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Why ZFS is doing filesystem checksumming right, better TMPFS throughput performance on DragonFlyBSD, reshaping pools with ZFS, PKGSRC on Manjaro aarch64 Pinebook-pro, central log host with syslog-ng on FreeBSD, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://oshogbo.vexillium.org/blog/73/" rel="nofollow">Checksumming in filesystems, and why ZFS is doing it right</a></h3>

<blockquote>
<p>One of the best aspects of ZFS is its reliability. This can be accomplished using a few features like copy-on-write approach and checksumming. Today we will look at how ZFS does checksumming and why it does it the proper way. Most of the file systems don’t provide any integrity checking and fail in several scenarios:</p>
</blockquote>

<ul>
<li>Data bit flips - when the data that we wanted to store are bit flipped by the hard drives, or cables, and the wrong data is stored on the hard drive.</li>
<li>Misdirected writes - when the CPU/cable/hard drive will bit flip a block to which the data should be written.</li>
<li>Misdirected read - when we miss reading the block when a bit flip occurred.</li>
<li>Phantom writes - when the write operation never made it to the disk. For example, a disk or kernel may have some bug that it will return success even if the hard drive never made the write. This problem can also occur when data is kept only in the hard drive cache.</li>
</ul>

<blockquote>
<p>Checksumming may help us detect errors in a few of those situations.</p>
</blockquote>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-TMPFS-Throughput" rel="nofollow">DragonFlyBSD Improves Its TMPFS Implementation For Better Throughput Performance</a></h3>

<blockquote>
<p>It&#39;s been a while since last having any new magical optimizations to talk about by DragonFlyBSD lead developer Matthew Dillon, but on Wednesday he landed some significant temporary file-system &quot;TMPFS&quot; optimizations for better throughput including with swap.</p>

<p>Of several interesting commits merged tonight, the improved write clustering is a big one. In particular, &quot;Reduces low-memory tmpfs paging I/O overheads by 4x and generally increases paging throughput to SSD-based swap by 2x-4x. Tmpfs is now able to issue a lot more 64KB I/Os when under memory pressure.&quot;</p>
</blockquote>

<ul>
<li><a href="https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860" rel="nofollow">https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860</a></li>
</ul>

<blockquote>
<p>There&#39;s also a new tunable in the VM space as well as part of his commits on Wednesday night. This follows a lot of recent work on dsynth, improved page-out daemon pipelining, and other routine work.</p>
</blockquote>

<ul>
<li><a href="https://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351" rel="nofollow">https://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351</a></li>
</ul>

<blockquote>
<p>This work is building up towards the eventual DragonFlyBSD 5.8 while those wanting to try the latest improvements right away can find their daily snapshots.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSWhyNoRealReshaping" rel="nofollow">Why ZFS is not good at growing and reshaping pools (or shrinking them)</a></h3>

<blockquote>
<p>recently read Mark McBride&#39;s Five Years of Btrfs (via), which has a significant discussion of why McBride chose Btrfs over ZFS that boils down to ZFS not being very good at evolving your pool structure. You might doubt this judgment from a Btrfs user, so let me say as both a fan of ZFS and a long term user of it that this is unfortunately quite true; ZFS is not a good choice if you want to modify your pool disk layout significantly over time. ZFS works best if the only change in your pools that you do is replacing drives with bigger drives. In our ZFS environment we go to quite some lengths to be able to expand pools incrementally over time, and while this works it both leaves us with unbalanced pools and means that we&#39;re basically forced to use mirroring instead of RAIDZ.</p>

<p>(An unbalanced pool is one where some vdevs and disks have much more data than others. This is less of an issue for us now that we&#39;re using SSDs instead of HDs.)</p>
</blockquote>

<hr>

<h3><a href="https://astr0baby.wordpress.com/2020/02/09/using-pkgsrc-on-manjaro-linux-aarch64-pinebook-pro/" rel="nofollow">Using PKGSRC on Manjaro Linux aarch64 Pinebook-pro</a></h3>

<blockquote>
<p>I wanted to see how pkgsrc works on aarch64 Linux Manjaro since it is a very mature framework that is very portable and supported by many architectures – pkgsrc (package source) is a package management system for Unix-like operating systems. It was forked from the FreeBSD ports collection in 1997 as the primary package management system for NetBSD.</p>

<p>One might question why use pkgsrc on Arch based Manjaro, since the pacman package repository is very good on its own. I see alternative pkgsrc as a good automated build framework that offers a way to produce independent build environment /usr/pkg that does not interfere with the current Linux distribution in any way (all libraries are statically built)</p>

<p>I have used the latest Manjaro for Pinebookpro and standard recommended tools as mentioned here <a href="https://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_linux/" rel="nofollow">https://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_linux/</a></p>
</blockquote>

<hr>

<h3>A Central Log Host with syslog-ng on FreeBSD</h3>

<ul>
<li><a href="https://blog.socruel.nu/freebsd/a-central-log-host-with-syslog-ng-on-freebsd.html" rel="nofollow">Part 1</a></li>
</ul>

<blockquote>
<p>syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.</p>
</blockquote>

<ul>
<li><a href="https://blog.socruel.nu/freebsd/check-logs-of-syslog-ng-log-host-on-freebsd.html" rel="nofollow">Part 2</a></li>
</ul>

<blockquote>
<p>This blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not too difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://mirror.linux.org.au/pub/linux.conf.au/2020/room_9/Tuesday/" rel="nofollow">FreeBSD at Linux Conf 2020 session videos now online</a></li>
<li><a href="https://vermaden.wordpress.com/2020/01/09/freebsd-desktop-part-20-configuration-unlock-your-laptop-with-phone/" rel="nofollow">Unlock your laptop with your phone</a></li>
<li><a href="https://www.netbsd.org/gallery/presentations/leot/itasec20/pkgsrc-security.pdf" rel="nofollow">Managing a database of vulnerabilities for a package system: the pkgsrc study</a></li>
<li>Hamilton BSD User group will meet again on March 10th](<a href="http://studybsd.com/" rel="nofollow">http://studybsd.com/</a>)</li>
<li><a href="https://www.meetup.com/en-AU/CharmBUG/events/268251508/" rel="nofollow">CharmBUG Meeting: March 24th 7pm in Severn, MD</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Andrew - <a href="http://dpaste.com/2YM23C0#wrap" rel="nofollow">ZFS feature Flags</a></li>
<li>Sam - <a href="http://dpaste.com/0FCZV6R" rel="nofollow">TwinCat BSD</a></li>
<li>Dacian - <a href="http://dpaste.com/1R7F1JN#wrap" rel="nofollow">Freebsd + amdgpu + Lenovo E595</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0340.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Why ZFS is doing filesystem checksumming right, better TMPFS throughput performance on DragonFlyBSD, reshaping pools with ZFS, PKGSRC on Manjaro aarch64 Pinebook-pro, central log host with syslog-ng on FreeBSD, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://oshogbo.vexillium.org/blog/73/" rel="nofollow">Checksumming in filesystems, and why ZFS is doing it right</a></h3>

<blockquote>
<p>One of the best aspects of ZFS is its reliability. This can be accomplished using a few features like copy-on-write approach and checksumming. Today we will look at how ZFS does checksumming and why it does it the proper way. Most of the file systems don’t provide any integrity checking and fail in several scenarios:</p>
</blockquote>

<ul>
<li>Data bit flips - when the data that we wanted to store are bit flipped by the hard drives, or cables, and the wrong data is stored on the hard drive.</li>
<li>Misdirected writes - when the CPU/cable/hard drive will bit flip a block to which the data should be written.</li>
<li>Misdirected read - when we miss reading the block when a bit flip occurred.</li>
<li>Phantom writes - when the write operation never made it to the disk. For example, a disk or kernel may have some bug that it will return success even if the hard drive never made the write. This problem can also occur when data is kept only in the hard drive cache.</li>
</ul>

<blockquote>
<p>Checksumming may help us detect errors in a few of those situations.</p>
</blockquote>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-TMPFS-Throughput" rel="nofollow">DragonFlyBSD Improves Its TMPFS Implementation For Better Throughput Performance</a></h3>

<blockquote>
<p>It&#39;s been a while since last having any new magical optimizations to talk about by DragonFlyBSD lead developer Matthew Dillon, but on Wednesday he landed some significant temporary file-system &quot;TMPFS&quot; optimizations for better throughput including with swap.</p>

<p>Of several interesting commits merged tonight, the improved write clustering is a big one. In particular, &quot;Reduces low-memory tmpfs paging I/O overheads by 4x and generally increases paging throughput to SSD-based swap by 2x-4x. Tmpfs is now able to issue a lot more 64KB I/Os when under memory pressure.&quot;</p>
</blockquote>

<ul>
<li><a href="https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860" rel="nofollow">https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860</a></li>
</ul>

<blockquote>
<p>There&#39;s also a new tunable in the VM space as well as part of his commits on Wednesday night. This follows a lot of recent work on dsynth, improved page-out daemon pipelining, and other routine work.</p>
</blockquote>

<ul>
<li><a href="https://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351" rel="nofollow">https://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351</a></li>
</ul>

<blockquote>
<p>This work is building up towards the eventual DragonFlyBSD 5.8 while those wanting to try the latest improvements right away can find their daily snapshots.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSWhyNoRealReshaping" rel="nofollow">Why ZFS is not good at growing and reshaping pools (or shrinking them)</a></h3>

<blockquote>
<p>recently read Mark McBride&#39;s Five Years of Btrfs (via), which has a significant discussion of why McBride chose Btrfs over ZFS that boils down to ZFS not being very good at evolving your pool structure. You might doubt this judgment from a Btrfs user, so let me say as both a fan of ZFS and a long term user of it that this is unfortunately quite true; ZFS is not a good choice if you want to modify your pool disk layout significantly over time. ZFS works best if the only change in your pools that you do is replacing drives with bigger drives. In our ZFS environment we go to quite some lengths to be able to expand pools incrementally over time, and while this works it both leaves us with unbalanced pools and means that we&#39;re basically forced to use mirroring instead of RAIDZ.</p>

<p>(An unbalanced pool is one where some vdevs and disks have much more data than others. This is less of an issue for us now that we&#39;re using SSDs instead of HDs.)</p>
</blockquote>

<hr>

<h3><a href="https://astr0baby.wordpress.com/2020/02/09/using-pkgsrc-on-manjaro-linux-aarch64-pinebook-pro/" rel="nofollow">Using PKGSRC on Manjaro Linux aarch64 Pinebook-pro</a></h3>

<blockquote>
<p>I wanted to see how pkgsrc works on aarch64 Linux Manjaro since it is a very mature framework that is very portable and supported by many architectures – pkgsrc (package source) is a package management system for Unix-like operating systems. It was forked from the FreeBSD ports collection in 1997 as the primary package management system for NetBSD.</p>

<p>One might question why use pkgsrc on Arch based Manjaro, since the pacman package repository is very good on its own. I see alternative pkgsrc as a good automated build framework that offers a way to produce independent build environment /usr/pkg that does not interfere with the current Linux distribution in any way (all libraries are statically built)</p>

<p>I have used the latest Manjaro for Pinebookpro and standard recommended tools as mentioned here <a href="https://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_linux/" rel="nofollow">https://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_linux/</a></p>
</blockquote>

<hr>

<h3>A Central Log Host with syslog-ng on FreeBSD</h3>

<ul>
<li><a href="https://blog.socruel.nu/freebsd/a-central-log-host-with-syslog-ng-on-freebsd.html" rel="nofollow">Part 1</a></li>
</ul>

<blockquote>
<p>syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.</p>
</blockquote>

<ul>
<li><a href="https://blog.socruel.nu/freebsd/check-logs-of-syslog-ng-log-host-on-freebsd.html" rel="nofollow">Part 2</a></li>
</ul>

<blockquote>
<p>This blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not too difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://mirror.linux.org.au/pub/linux.conf.au/2020/room_9/Tuesday/" rel="nofollow">FreeBSD at Linux Conf 2020 session videos now online</a></li>
<li><a href="https://vermaden.wordpress.com/2020/01/09/freebsd-desktop-part-20-configuration-unlock-your-laptop-with-phone/" rel="nofollow">Unlock your laptop with your phone</a></li>
<li><a href="https://www.netbsd.org/gallery/presentations/leot/itasec20/pkgsrc-security.pdf" rel="nofollow">Managing a database of vulnerabilities for a package system: the pkgsrc study</a></li>
<li>Hamilton BSD User group will meet again on March 10th](<a href="http://studybsd.com/" rel="nofollow">http://studybsd.com/</a>)</li>
<li><a href="https://www.meetup.com/en-AU/CharmBUG/events/268251508/" rel="nofollow">CharmBUG Meeting: March 24th 7pm in Severn, MD</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Andrew - <a href="http://dpaste.com/2YM23C0#wrap" rel="nofollow">ZFS feature Flags</a></li>
<li>Sam - <a href="http://dpaste.com/0FCZV6R" rel="nofollow">TwinCat BSD</a></li>
<li>Dacian - <a href="http://dpaste.com/1R7F1JN#wrap" rel="nofollow">Freebsd + amdgpu + Lenovo E595</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0340.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>339: BSD Fundraising</title>
  <link>https://www.bsdnow.tv/339</link>
  <guid isPermaLink="false">581b71e1-6a98-41d7-b8d8-477eaaaba8db</guid>
  <pubDate>Thu, 27 Feb 2020 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/581b71e1-6a98-41d7-b8d8-477eaaaba8db.mp3" length="38843791" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Meet FuryBSD, NetBSD 9.0 has been released, OpenBSD Foundation 2019 campaign wrapup, a retrospective on OmniOS ZFS-based NFS fileservers, NetBSD Fundraising 2020 goal, OpenSSH 8.2 released, and more.</itunes:subtitle>
  <itunes:duration>53:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Meet FuryBSD, NetBSD 9.0 has been released, OpenBSD Foundation 2019 campaign wrapup, a retrospective on OmniOS ZFS-based NFS fileservers, NetBSD Fundraising 2020 goal, OpenSSH 8.2 released, and more.## Headlines
Meet FuryBSD: A New Desktop BSD Distribution (https://itsfoss.com/furybsd/)
At its heart, FuryBSD is a very simple beast. According to the site, “FuryBSD is a back to basics lightweight desktop distribution based on stock FreeBSD.” It is basically FreeBSD with a desktop environment pre-configured and several apps preinstalled. The goal is to quickly get a FreeBSD-based system running on your computer.
You might be thinking that this sounds a lot like a couple of other BSDs that are available, such as NomadBSD and GhostBSD. The major difference between those BSDs and FuryBSD is that FuryBSD is much closer to stock FreeBSD. For example, FuryBSD uses the FreeBSD installer, while others have created their own installers and utilities.
As it states on the site, “Although FuryBSD may resemble past graphical BSD projects like PC-BSD and TrueOS, FuryBSD is created by a different team and takes a different approach focusing on tight integration with FreeBSD. This keeps overhead low and maintains compatibility with upstream.” The lead dev also told me that “One key focus for FuryBSD is for it to be a small live media with a few assistive tools to test drivers for hardware.”
Currently, you can go to the FuryBSD homepage and download either an XFCE or KDE LiveCD. A GNOME version is in the works.
NetBSD 9.0 (https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html)
The NetBSD Project is pleased to announce NetBSD 9.0, the seventeenth major release of the NetBSD operating system.
This release brings significant improvements in terms of hardware support, quality assurance, security, along with new features and hundreds of bug fixes. Here are some highlights of this new release.
News Roundup
OpenBSD Foundation 2019 campaign wrapup (http://undeadly.org/cgi?action=article;sid=20200217001107)
Our target for 2019 was CDN$300K. Our community's continued generosity combined with our corporate donors exceeded that nicely. In addition we received the largest single donation in our history, CDN$380K from Smartisan. The return of Google was another welcome event. Altogether 2019 was our most successful campaign to date, yielding CDN$692K in total.
We thank all our donors, Iridium (Smartisan), Platinum (Yandex, Google), Gold (Microsoft, Facebook) Silver (2Keys) and Bronze (genua, Thinkst Canary). But especially our community of smaller donors whose contributions are the bedrock of our support. Thank you all!
OpenBSD Foundation 2019 Fundraising Goal Exceeded (https://www.openbsdfoundation.org/campaign2019.html)
A retrospective on our OmniOS ZFS-based NFS fileservers (https://utcc.utoronto.ca/~cks/space/blog/solaris/OmniOSFileserverRetrospective)
Our OmniOS fileservers have now been out of service for about six months, which makes it somewhat past time for a retrospective on them. Our OmniOS fileservers followed on our Solaris fileservers, which I wrote a two part retrospective on (part 1, part 2), and have now been replaced by our Linux fileservers. To be honest, I have been sitting on my hands about writing this retrospective because we have mixed feelings about our OmniOS fileservers.
I will put the summary up front. OmniOS worked reasonably well for us over its lifespan here and looking back I think it was almost certainly the right choice for us at the time we made that choice (which was 2013 and 2014). However it was not without issues that marred our experience with it in practice, although not enough to make me regret that we ran it (and ran it for as long as we did). Part of our issues are likely due to a design mistake in making our fileservers too big, although this design mistake was probably magnified when we were unable to use Intel 10G-T networking in OmniOS.
On the one hand, our OmniOS fileservers worked, almost always reliably. Like our Solaris fileservers before them, they ran quietly for years without needing much attention, delivering NFS fileservice to our Ubuntu servers; specifically, we ran them for about five years (2014 through 2019, although we started migrating away at the end of 2018). Over this time we had only minor hardware issues and not all that many disk failures, and we suffered no data loss (with ZFS checksums likely saving us several times, and certainly providing good reassurances). Our overall environment was easy to manage and was pretty much problem free in the face of things like failed disks. I'm pretty sure that our users saw a NFS environment that was solid, reliable, and performed well pretty much all of the time, which is the important thing. So OmniOS basically delivered the fileserver environment we wanted.
NetBSD Fundraising 2020 goal (http://blog.netbsd.org/tnf/entry/fundraising_2020)
Is it really more than 10 years since we last had an official fundraising drive?
Looking at old TNF financial reports I noticed that we have been doing quite well financially over the last years, with a steady stream of small and medium donations, and most of the time only moderate expenditures. The last fundraising drive back in 2009 was a giant success, and we have lived off it until now.
OpenSSH 8.2 released February 14, 2020 (http://www.openssh.com/txt/release-8.2)
OpenSSH 8.2 was released on 2020-02-14. It is available from the mirrors listed at https://www.openssh.com/.
OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.
Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at:
https://www.openssh.com/donations.html
Beastie Bits
FreeNAS vs. Unraid: GRUDGE MATCH! (https://www.youtube.com/watch?v=aXsRIrC5bjg)
Unix Toolbox (http://cb.vu/unixtoolbox.xhtml)
Rigs of Rods - OpenBSD Physics Game (https://docs.rigsofrods.org/)
NYCBug - Dr Vixie (http://dpaste.com/0V35MAB#wrap)
Hamilton BSD User group will meet again on March 10th](http://studybsd.com/)
BSD Stockholm - Meetup March 3rd 2020 (https://www.meetup.com/BSD-Users-Stockholm/events/267873938/)
Feedback/Questions
Shirkdog - Question (http://dpaste.com/36E2BZ1)
Master One - ZFS + Suspend/resume (http://dpaste.com/3B9M814#wrap)
Micah Roth - ZFS write caching (http://dpaste.com/0D4GDX1#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, furybsd, desktop, desktop bsd, netbsd 9.0, openbsd foundation, campaign wrapup, retrospective, omnios, zfs, nfs, fileserver, netbsd fundraising, fundraising goal, openssh</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Meet FuryBSD, NetBSD 9.0 has been released, OpenBSD Foundation 2019 campaign wrapup, a retrospective on OmniOS ZFS-based NFS fileservers, NetBSD Fundraising 2020 goal, OpenSSH 8.2 released, and more.## Headlines</p>

<h3><a href="https://itsfoss.com/furybsd/" rel="nofollow">Meet FuryBSD: A New Desktop BSD Distribution</a></h3>

<blockquote>
<p>At its heart, FuryBSD is a very simple beast. According to the site, “FuryBSD is a back to basics lightweight desktop distribution based on stock FreeBSD.” It is basically FreeBSD with a desktop environment pre-configured and several apps preinstalled. The goal is to quickly get a FreeBSD-based system running on your computer.</p>

<p>You might be thinking that this sounds a lot like a couple of other BSDs that are available, such as NomadBSD and GhostBSD. The major difference between those BSDs and FuryBSD is that FuryBSD is much closer to stock FreeBSD. For example, FuryBSD uses the FreeBSD installer, while others have created their own installers and utilities.</p>

<p>As it states on the site, “Although FuryBSD may resemble past graphical BSD projects like PC-BSD and TrueOS, FuryBSD is created by a different team and takes a different approach focusing on tight integration with FreeBSD. This keeps overhead low and maintains compatibility with upstream.” The lead dev also told me that “One key focus for FuryBSD is for it to be a small live media with a few assistive tools to test drivers for hardware.”</p>

<p>Currently, you can go to the FuryBSD homepage and download either an XFCE or KDE LiveCD. A GNOME version is in the works.</p>
</blockquote>

<hr>

<h3><a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html" rel="nofollow">NetBSD 9.0</a></h3>

<blockquote>
<p>The NetBSD Project is pleased to announce NetBSD 9.0, the seventeenth major release of the NetBSD operating system.</p>

<p>This release brings significant improvements in terms of hardware support, quality assurance, security, along with new features and hundreds of bug fixes. Here are some highlights of this new release.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20200217001107" rel="nofollow">OpenBSD Foundation 2019 campaign wrapup</a></h3>

<blockquote>
<p>Our target for 2019 was CDN$300K. Our community&#39;s continued generosity combined with our corporate donors exceeded that nicely. In addition we received the largest single donation in our history, CDN$380K from Smartisan. The return of Google was another welcome event. Altogether 2019 was our most successful campaign to date, yielding CDN$692K in total.</p>

<p>We thank all our donors, Iridium (Smartisan), Platinum (Yandex, Google), Gold (Microsoft, Facebook) Silver (2Keys) and Bronze (genua, Thinkst Canary). But especially our community of smaller donors whose contributions are the bedrock of our support. Thank you all!</p>
</blockquote>

<ul>
<li><a href="https://www.openbsdfoundation.org/campaign2019.html" rel="nofollow">OpenBSD Foundation 2019 Fundraising Goal Exceeded</a></li>
</ul>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/OmniOSFileserverRetrospective" rel="nofollow">A retrospective on our OmniOS ZFS-based NFS fileservers</a></h3>

<blockquote>
<p>Our OmniOS fileservers have now been out of service for about six months, which makes it somewhat past time for a retrospective on them. Our OmniOS fileservers followed on our Solaris fileservers, which I wrote a two part retrospective on (part 1, part 2), and have now been replaced by our Linux fileservers. To be honest, I have been sitting on my hands about writing this retrospective because we have mixed feelings about our OmniOS fileservers.</p>

<p>I will put the summary up front. OmniOS worked reasonably well for us over its lifespan here and looking back I think it was almost certainly the right choice for us at the time we made that choice (which was 2013 and 2014). However it was not without issues that marred our experience with it in practice, although not enough to make me regret that we ran it (and ran it for as long as we did). Part of our issues are likely due to a design mistake in making our fileservers too big, although this design mistake was probably magnified when we were unable to use Intel 10G-T networking in OmniOS.</p>

<p>On the one hand, our OmniOS fileservers worked, almost always reliably. Like our Solaris fileservers before them, they ran quietly for years without needing much attention, delivering NFS fileservice to our Ubuntu servers; specifically, we ran them for about five years (2014 through 2019, although we started migrating away at the end of 2018). Over this time we had only minor hardware issues and not all that many disk failures, and we suffered no data loss (with ZFS checksums likely saving us several times, and certainly providing good reassurances). Our overall environment was easy to manage and was pretty much problem free in the face of things like failed disks. I&#39;m pretty sure that our users saw a NFS environment that was solid, reliable, and performed well pretty much all of the time, which is the important thing. So OmniOS basically delivered the fileserver environment we wanted.</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/fundraising_2020" rel="nofollow">NetBSD Fundraising 2020 goal</a></h3>

<blockquote>
<p>Is it really more than 10 years since we last had an official fundraising drive?</p>

<p>Looking at old TNF financial reports I noticed that we have been doing quite well financially over the last years, with a steady stream of small and medium donations, and most of the time only moderate expenditures. The last fundraising drive back in 2009 was a giant success, and we have lived off it until now.</p>
</blockquote>

<hr>

<h3><a href="http://www.openssh.com/txt/release-8.2" rel="nofollow">OpenSSH 8.2 released February 14, 2020</a></h3>

<blockquote>
<p>OpenSSH 8.2 was released on 2020-02-14. It is available from the mirrors listed at <a href="https://www.openssh.com/" rel="nofollow">https://www.openssh.com/</a>.</p>

<p>OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.</p>

<p>Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at:</p>
</blockquote>

<ul>
<li><a href="https://www.openssh.com/donations.html" rel="nofollow">https://www.openssh.com/donations.html</a></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=aXsRIrC5bjg" rel="nofollow">FreeNAS vs. Unraid: GRUDGE MATCH!</a></li>
<li><a href="http://cb.vu/unixtoolbox.xhtml" rel="nofollow">Unix Toolbox</a></li>
<li><a href="https://docs.rigsofrods.org/" rel="nofollow">Rigs of Rods - OpenBSD Physics Game</a></li>
<li><a href="http://dpaste.com/0V35MAB#wrap" rel="nofollow">NYCBug - Dr Vixie</a></li>
<li>Hamilton BSD User group will meet again on March 10th](<a href="http://studybsd.com/" rel="nofollow">http://studybsd.com/</a>)</li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/267873938/" rel="nofollow">BSD Stockholm - Meetup March 3rd 2020</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Shirkdog - <a href="http://dpaste.com/36E2BZ1" rel="nofollow">Question</a></li>
<li>Master One - <a href="http://dpaste.com/3B9M814#wrap" rel="nofollow">ZFS + Suspend/resume</a></li>
<li>Micah Roth - <a href="http://dpaste.com/0D4GDX1#wrap" rel="nofollow">ZFS write caching</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0339.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Meet FuryBSD, NetBSD 9.0 has been released, OpenBSD Foundation 2019 campaign wrapup, a retrospective on OmniOS ZFS-based NFS fileservers, NetBSD Fundraising 2020 goal, OpenSSH 8.2 released, and more.## Headlines</p>

<h3><a href="https://itsfoss.com/furybsd/" rel="nofollow">Meet FuryBSD: A New Desktop BSD Distribution</a></h3>

<blockquote>
<p>At its heart, FuryBSD is a very simple beast. According to the site, “FuryBSD is a back to basics lightweight desktop distribution based on stock FreeBSD.” It is basically FreeBSD with a desktop environment pre-configured and several apps preinstalled. The goal is to quickly get a FreeBSD-based system running on your computer.</p>

<p>You might be thinking that this sounds a lot like a couple of other BSDs that are available, such as NomadBSD and GhostBSD. The major difference between those BSDs and FuryBSD is that FuryBSD is much closer to stock FreeBSD. For example, FuryBSD uses the FreeBSD installer, while others have created their own installers and utilities.</p>

<p>As it states on the site, “Although FuryBSD may resemble past graphical BSD projects like PC-BSD and TrueOS, FuryBSD is created by a different team and takes a different approach focusing on tight integration with FreeBSD. This keeps overhead low and maintains compatibility with upstream.” The lead dev also told me that “One key focus for FuryBSD is for it to be a small live media with a few assistive tools to test drivers for hardware.”</p>

<p>Currently, you can go to the FuryBSD homepage and download either an XFCE or KDE LiveCD. A GNOME version is in the works.</p>
</blockquote>

<hr>

<h3><a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html" rel="nofollow">NetBSD 9.0</a></h3>

<blockquote>
<p>The NetBSD Project is pleased to announce NetBSD 9.0, the seventeenth major release of the NetBSD operating system.</p>

<p>This release brings significant improvements in terms of hardware support, quality assurance, security, along with new features and hundreds of bug fixes. Here are some highlights of this new release.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20200217001107" rel="nofollow">OpenBSD Foundation 2019 campaign wrapup</a></h3>

<blockquote>
<p>Our target for 2019 was CDN$300K. Our community&#39;s continued generosity combined with our corporate donors exceeded that nicely. In addition we received the largest single donation in our history, CDN$380K from Smartisan. The return of Google was another welcome event. Altogether 2019 was our most successful campaign to date, yielding CDN$692K in total.</p>

<p>We thank all our donors, Iridium (Smartisan), Platinum (Yandex, Google), Gold (Microsoft, Facebook) Silver (2Keys) and Bronze (genua, Thinkst Canary). But especially our community of smaller donors whose contributions are the bedrock of our support. Thank you all!</p>
</blockquote>

<ul>
<li><a href="https://www.openbsdfoundation.org/campaign2019.html" rel="nofollow">OpenBSD Foundation 2019 Fundraising Goal Exceeded</a></li>
</ul>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/OmniOSFileserverRetrospective" rel="nofollow">A retrospective on our OmniOS ZFS-based NFS fileservers</a></h3>

<blockquote>
<p>Our OmniOS fileservers have now been out of service for about six months, which makes it somewhat past time for a retrospective on them. Our OmniOS fileservers followed on our Solaris fileservers, which I wrote a two part retrospective on (part 1, part 2), and have now been replaced by our Linux fileservers. To be honest, I have been sitting on my hands about writing this retrospective because we have mixed feelings about our OmniOS fileservers.</p>

<p>I will put the summary up front. OmniOS worked reasonably well for us over its lifespan here and looking back I think it was almost certainly the right choice for us at the time we made that choice (which was 2013 and 2014). However it was not without issues that marred our experience with it in practice, although not enough to make me regret that we ran it (and ran it for as long as we did). Part of our issues are likely due to a design mistake in making our fileservers too big, although this design mistake was probably magnified when we were unable to use Intel 10G-T networking in OmniOS.</p>

<p>On the one hand, our OmniOS fileservers worked, almost always reliably. Like our Solaris fileservers before them, they ran quietly for years without needing much attention, delivering NFS fileservice to our Ubuntu servers; specifically, we ran them for about five years (2014 through 2019, although we started migrating away at the end of 2018). Over this time we had only minor hardware issues and not all that many disk failures, and we suffered no data loss (with ZFS checksums likely saving us several times, and certainly providing good reassurances). Our overall environment was easy to manage and was pretty much problem free in the face of things like failed disks. I&#39;m pretty sure that our users saw a NFS environment that was solid, reliable, and performed well pretty much all of the time, which is the important thing. So OmniOS basically delivered the fileserver environment we wanted.</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/fundraising_2020" rel="nofollow">NetBSD Fundraising 2020 goal</a></h3>

<blockquote>
<p>Is it really more than 10 years since we last had an official fundraising drive?</p>

<p>Looking at old TNF financial reports I noticed that we have been doing quite well financially over the last years, with a steady stream of small and medium donations, and most of the time only moderate expenditures. The last fundraising drive back in 2009 was a giant success, and we have lived off it until now.</p>
</blockquote>

<hr>

<h3><a href="http://www.openssh.com/txt/release-8.2" rel="nofollow">OpenSSH 8.2 released February 14, 2020</a></h3>

<blockquote>
<p>OpenSSH 8.2 was released on 2020-02-14. It is available from the mirrors listed at <a href="https://www.openssh.com/" rel="nofollow">https://www.openssh.com/</a>.</p>

<p>OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.</p>

<p>Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at:</p>
</blockquote>

<ul>
<li><a href="https://www.openssh.com/donations.html" rel="nofollow">https://www.openssh.com/donations.html</a></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=aXsRIrC5bjg" rel="nofollow">FreeNAS vs. Unraid: GRUDGE MATCH!</a></li>
<li><a href="http://cb.vu/unixtoolbox.xhtml" rel="nofollow">Unix Toolbox</a></li>
<li><a href="https://docs.rigsofrods.org/" rel="nofollow">Rigs of Rods - OpenBSD Physics Game</a></li>
<li><a href="http://dpaste.com/0V35MAB#wrap" rel="nofollow">NYCBug - Dr Vixie</a></li>
<li>Hamilton BSD User group will meet again on March 10th](<a href="http://studybsd.com/" rel="nofollow">http://studybsd.com/</a>)</li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/267873938/" rel="nofollow">BSD Stockholm - Meetup March 3rd 2020</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Shirkdog - <a href="http://dpaste.com/36E2BZ1" rel="nofollow">Question</a></li>
<li>Master One - <a href="http://dpaste.com/3B9M814#wrap" rel="nofollow">ZFS + Suspend/resume</a></li>
<li>Micah Roth - <a href="http://dpaste.com/0D4GDX1#wrap" rel="nofollow">ZFS write caching</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0339.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>338: iocage in Jail</title>
  <link>https://www.bsdnow.tv/338</link>
  <guid isPermaLink="false">7e9e4cfc-7a05-4ebe-8d45-a7282fe7ab0f</guid>
  <pubDate>Thu, 20 Feb 2020 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7e9e4cfc-7a05-4ebe-8d45-a7282fe7ab0f.mp3" length="45174932" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Distrowatch reviews FuryBSD, LLDB on i386 for NetBSD, wpa_supplicant as lower-class citizen, KDE on FreeBSD updates, Travel Grant for BSDCan open, ZFS dataset for testing iocage within a jail, and more.</itunes:subtitle>
  <itunes:duration>1:02:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Distrowatch reviews FuryBSD, LLDB on i386 for NetBSD, wpa_supplicant as lower-class citizen, KDE on FreeBSD updates, Travel Grant for BSDCan open, ZFS dataset for testing iocage within a jail, and more.
Headlines
Distrowatch Fury BSD Review (https://distrowatch.com/weekly.php?issue=20200127#furybsd)
FuryBSD is the most recent addition to the DistroWatch database and provides a live desktop operating system based on FreeBSD. FuryBSD is not entirely different in its goals from NomadBSD, which we discussed recently. I wanted to take this FreeBSD-based project for a test drive and see how it compares to NomadBSD and other desktop-oriented projects in the FreeBSD family.
FuryBSD supplies hybrid ISO/USB images which can be used to run a live desktop. There are two desktop editions currently, both for 64-bit (x86_64) machines: Xfce and KDE Plasma. The Xfce edition is 1.4GB in size and is the flavour I downloaded. The KDE Plasma edition is about 3.0GB in size.
My fresh install of FuryBSD booted to a graphical login screen. From there I could sign into my account, which brings up the Xfce desktop. The installed version of Xfce is the same as the live version, with a few minor changes. Most of the desktop icons have been removed with just the file manager launchers remaining. The Getting Started and System Information icons have been removed. Otherwise the experience is virtually identical to the live media.
FuryBSD uses a theme that is mostly grey and white with creamy yellow folder icons. The application menu launchers tend to have neutral icons, neither particularly bright and detailed or minimal.
LLDB now works on i386 (http://blog.netbsd.org/tnf/entry/lldb_now_works_on_i386)
Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.
In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.
The original NetBSD port of LLDB was focused on amd64 only. In January, I have extended it to support i386 executables. This includes both 32-bit builds of LLDB (running natively on i386 kernel or via compat32) and debugging 32-bit programs from 64-bit LLDB.
News Roundup
wpa_supplicant is definitely a lower-class citizen, sorry (https://marc.info/?l=openbsd-misc&amp;amp;m=158068418807352&amp;amp;w=2)
wpa_supplicant is definitely a lower-class citizen, sorry.
I increasingly wonder why this stuff matters; transit costs are so much lower than the period when eduroam was setup, and their reliance on 802.11x is super weird in a world where, for the most part
    + entire cities have open wifi in their downtown core
    + edu vs edu+transit split horizon problems have to be solved anyways
    + many universities have parallel open wifi
    + rate limiting / fare-share approaches for the open-net, on unmetered
    + flat-rate solves the problem
    + LTE hotspot off a phone isn't a rip off anymore
    + other open networks exist
essentially no one else feels compelled to do use 802.11x for a so called "semi-open access network", so I think they've lost the plot on friction vs benefit.
(we've held hackathons at EDU campus that are locked down like that, and in every case we've said no way, gotten a wire with open net, and built our own wifi.  we will not subject our developers to that extra complexity).
KDE FreeBSD Updates Feb 2020 (https://euroquis.nl/freebsd/2020/02/08/freebsd.html)
Some bits and bobs from the KDE FreeBSD team in february 2020. We met at the FreeBSD devsummit before FOSDEM, along with other FreeBSD people. Plans were made, schemes were forged, and Groff the Goat was introduced to some new people. 
The big ticket things:
 Frameworks are at 5.66
Plasma is at 5.17.5 (the beta 5.18 hasn’t been tried)
KDE release service has landed 19.12.2 (same day it was released)
Developer-centric:
KDevelop is at 5.5.0
KUserfeedback landed its 1.0.0 release
CMake is 3.16.3
Applications:
Musescore is at 3.4.2
Elisa now part of the KDE release service updates
Fuure work:
KIO-Fuse probably needs extra real-world testing on FreeBSD. I don’t have that kind of   mounts (just NFS in /etc/fstab) so I’m not the target audience.
KTextEditor is missing .editorconfig support. That can come in with the next frameworks update, when consumers update anyway. Chasing it in an intermediate release is a bit problematic because it does require some rebuilds of consumers.
Travel Grant Application for BSDCan is now open (https://lists.freebsd.org/pipermail/freebsd-announce/2020-February/001929.html)
Hi everyone,
The Travel Grant Application for BSDCan 2020 is now open. The Foundation can help you attend BSDCan through our travel grant program. Travel grants are available to FreeBSD developers and advocates who need assistance with travel expenses for attending conferences related to FreeBSD development. BSDCan 2020 applications are due April 9, 2020. Find out more and apply at: https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/
Did you know the Foundation also provides grants for technical events not specifically focused on BSD? If you feel that your attendance at one of these events will benefit the FreeBSD Project and Community and you need assistance getting there,  please fill out the general travel grant application.  Your application must be received 7 weeks prior to the event. The general application can be found here: https://goo.gl/forms/QzsOMR8Jra0vqFYH2
Creating a ZFS dataset for testing iocage within a jail (https://dan.langille.org/2020/02/01/creating-a-zfs-dataset-for-testing-iocage-within-a-jail/)
Be warned, this failed. I’m stalled and I have not completed this.
 I’m going to do jails within a jail. I already do that with poudriere in a jail but here I want to test an older version of iocage before upgrading my current jail hosts to a newer version.
In this post:
FreeBSD 12.1
py36-iocage-1.2_3
py36-iocage-1.2_4
This post includes my errors and mistakes. Perhaps you should proceed carefully and read it all first.
Beastie Bits
Reminder: the FreeBSD Journal is free! Check out these great articles (https://www.freebsdfoundation.org/journal/browser-based-edition/)
Serenity GUI desktop running on an OpenBSD kernel (https://twitter.com/jcs/status/1224205573656322048)
The Open Source Parts of MacOS (https://github.com/apple-open-source/macos)
FOSDEM videos available (https://www.fosdem.org/2020/schedule/track/bsd/)
Feedback/Questions
Michael - Install with ZFS (http://dpaste.com/3WRC9CQ#wrap)
Mohammad - Server Freeze (http://dpaste.com/3BYZKMS#wrap)
Todd - ZFS Questions (http://dpaste.com/2J50HSJ#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, distrowatch, furybsd, review, lldb, i386, wpa_supplicant, KDE, desktop environment, DE, travel grant, grant, iocage, dataset, zfs, jail</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Distrowatch reviews FuryBSD, LLDB on i386 for NetBSD, wpa_supplicant as lower-class citizen, KDE on FreeBSD updates, Travel Grant for BSDCan open, ZFS dataset for testing iocage within a jail, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20200127#furybsd" rel="nofollow">Distrowatch Fury BSD Review</a></h3>

<blockquote>
<p>FuryBSD is the most recent addition to the DistroWatch database and provides a live desktop operating system based on FreeBSD. FuryBSD is not entirely different in its goals from NomadBSD, which we discussed recently. I wanted to take this FreeBSD-based project for a test drive and see how it compares to NomadBSD and other desktop-oriented projects in the FreeBSD family.</p>

<p>FuryBSD supplies hybrid ISO/USB images which can be used to run a live desktop. There are two desktop editions currently, both for 64-bit (x86_64) machines: Xfce and KDE Plasma. The Xfce edition is 1.4GB in size and is the flavour I downloaded. The KDE Plasma edition is about 3.0GB in size.</p>

<p>My fresh install of FuryBSD booted to a graphical login screen. From there I could sign into my account, which brings up the Xfce desktop. The installed version of Xfce is the same as the live version, with a few minor changes. Most of the desktop icons have been removed with just the file manager launchers remaining. The Getting Started and System Information icons have been removed. Otherwise the experience is virtually identical to the live media.</p>

<p>FuryBSD uses a theme that is mostly grey and white with creamy yellow folder icons. The application menu launchers tend to have neutral icons, neither particularly bright and detailed or minimal.</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/lldb_now_works_on_i386" rel="nofollow">LLDB now works on i386</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>

<p>In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.</p>

<p>The original NetBSD port of LLDB was focused on amd64 only. In January, I have extended it to support i386 executables. This includes both 32-bit builds of LLDB (running natively on i386 kernel or via compat32) and debugging 32-bit programs from 64-bit LLDB.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://marc.info/?l=openbsd-misc&m=158068418807352&w=2" rel="nofollow">wpa_supplicant is definitely a lower-class citizen, sorry</a></h3>

<blockquote>
<p>wpa_supplicant is definitely a lower-class citizen, sorry.</p>

<p>I increasingly wonder why this stuff matters; transit costs are so much lower than the period when eduroam was setup, and their reliance on 802.11x is super weird in a world where, for the most part<br>
    + entire cities have open wifi in their downtown core<br>
    + edu vs edu+transit split horizon problems have to be solved anyways<br>
    + many universities have parallel open wifi<br>
    + rate limiting / fare-share approaches for the open-net, on unmetered<br>
    + flat-rate solves the problem<br>
    + LTE hotspot off a phone isn&#39;t a rip off anymore<br>
    + other open networks exist</p>

<p>essentially no one else feels compelled to do use 802.11x for a so called &quot;semi-open access network&quot;, so I think they&#39;ve lost the plot on friction vs benefit.</p>

<p>(we&#39;ve held hackathons at EDU campus that are locked down like that, and in every case we&#39;ve said no way, gotten a wire with open net, and built our own wifi.  we will not subject our developers to that extra complexity).</p>
</blockquote>

<hr>

<h3><a href="https://euroquis.nl/freebsd/2020/02/08/freebsd.html" rel="nofollow">KDE FreeBSD Updates Feb 2020</a></h3>

<blockquote>
<p>Some bits and bobs from the KDE FreeBSD team in february 2020. We met at the FreeBSD devsummit before FOSDEM, along with other FreeBSD people. Plans were made, schemes were forged, and Groff the Goat was introduced to some new people. </p>
</blockquote>

<ul>
<li>The big ticket things:

<ul>
<li> Frameworks are at 5.66</li>
<li>Plasma is at 5.17.5 (the beta 5.18 hasn’t been tried)</li>
<li>KDE release service has landed 19.12.2 (same day it was released)</li>
</ul></li>
<li>Developer-centric:

<ul>
<li>KDevelop is at 5.5.0</li>
<li>KUserfeedback landed its 1.0.0 release</li>
<li>CMake is 3.16.3</li>
</ul></li>
<li>Applications:

<ul>
<li>Musescore is at 3.4.2</li>
<li>Elisa now part of the KDE release service updates</li>
</ul></li>
<li>Fuure work:

<ul>
<li>KIO-Fuse probably needs extra real-world testing on FreeBSD. I don’t have that kind of   mounts (just NFS in /etc/fstab) so I’m not the target audience.</li>
<li>KTextEditor is missing .editorconfig support. That can come in with the next frameworks update, when consumers update anyway. Chasing it in an intermediate release is a bit problematic because it does require some rebuilds of consumers.</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-February/001929.html" rel="nofollow">Travel Grant Application for BSDCan is now open</a></h3>

<blockquote>
<p>Hi everyone,</p>

<p>The Travel Grant Application for BSDCan 2020 is now open. The Foundation can help you attend BSDCan through our travel grant program. Travel grants are available to FreeBSD developers and advocates who need assistance with travel expenses for attending conferences related to FreeBSD development. BSDCan 2020 applications are due April 9, 2020. Find out more and apply at: <a href="https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/" rel="nofollow">https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/</a></p>

<p>Did you know the Foundation also provides grants for technical events not specifically focused on BSD? If you feel that your attendance at one of these events will benefit the FreeBSD Project and Community and you need assistance getting there,  please fill out the general travel grant application.  Your application must be received 7 weeks prior to the event. The general application can be found here: <a href="https://goo.gl/forms/QzsOMR8Jra0vqFYH2" rel="nofollow">https://goo.gl/forms/QzsOMR8Jra0vqFYH2</a></p>
</blockquote>

<hr>

<h3><a href="https://dan.langille.org/2020/02/01/creating-a-zfs-dataset-for-testing-iocage-within-a-jail/" rel="nofollow">Creating a ZFS dataset for testing iocage within a jail</a></h3>

<ul>
<li>Be warned, this failed. I’m stalled and I have not completed this.</li>
</ul>

<blockquote>
<p>I’m going to do jails within a jail. I already do that with poudriere in a jail but here I want to test an older version of iocage before upgrading my current jail hosts to a newer version.</p>
</blockquote>

<ul>
<li>In this post:

<ul>
<li>FreeBSD 12.1</li>
<li>py36-iocage-1.2_3</li>
<li>py36-iocage-1.2_4</li>
</ul></li>
</ul>

<blockquote>
<p>This post includes my errors and mistakes. Perhaps you should proceed carefully and read it all first.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/journal/browser-based-edition/" rel="nofollow">Reminder: the FreeBSD Journal is free! Check out these great articles</a></li>
<li><a href="https://twitter.com/jcs/status/1224205573656322048" rel="nofollow">Serenity GUI desktop running on an OpenBSD kernel</a></li>
<li><a href="https://github.com/apple-open-source/macos" rel="nofollow">The Open Source Parts of MacOS</a></li>
<li><a href="https://www.fosdem.org/2020/schedule/track/bsd/" rel="nofollow">FOSDEM videos available</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Michael - <a href="http://dpaste.com/3WRC9CQ#wrap" rel="nofollow">Install with ZFS</a></li>
<li>Mohammad - <a href="http://dpaste.com/3BYZKMS#wrap" rel="nofollow">Server Freeze</a></li>
<li>Todd - <a href="http://dpaste.com/2J50HSJ#wrap" rel="nofollow">ZFS Questions</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0338.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Distrowatch reviews FuryBSD, LLDB on i386 for NetBSD, wpa_supplicant as lower-class citizen, KDE on FreeBSD updates, Travel Grant for BSDCan open, ZFS dataset for testing iocage within a jail, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20200127#furybsd" rel="nofollow">Distrowatch Fury BSD Review</a></h3>

<blockquote>
<p>FuryBSD is the most recent addition to the DistroWatch database and provides a live desktop operating system based on FreeBSD. FuryBSD is not entirely different in its goals from NomadBSD, which we discussed recently. I wanted to take this FreeBSD-based project for a test drive and see how it compares to NomadBSD and other desktop-oriented projects in the FreeBSD family.</p>

<p>FuryBSD supplies hybrid ISO/USB images which can be used to run a live desktop. There are two desktop editions currently, both for 64-bit (x86_64) machines: Xfce and KDE Plasma. The Xfce edition is 1.4GB in size and is the flavour I downloaded. The KDE Plasma edition is about 3.0GB in size.</p>

<p>My fresh install of FuryBSD booted to a graphical login screen. From there I could sign into my account, which brings up the Xfce desktop. The installed version of Xfce is the same as the live version, with a few minor changes. Most of the desktop icons have been removed with just the file manager launchers remaining. The Getting Started and System Information icons have been removed. Otherwise the experience is virtually identical to the live media.</p>

<p>FuryBSD uses a theme that is mostly grey and white with creamy yellow folder icons. The application menu launchers tend to have neutral icons, neither particularly bright and detailed or minimal.</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/lldb_now_works_on_i386" rel="nofollow">LLDB now works on i386</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>

<p>In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.</p>

<p>The original NetBSD port of LLDB was focused on amd64 only. In January, I have extended it to support i386 executables. This includes both 32-bit builds of LLDB (running natively on i386 kernel or via compat32) and debugging 32-bit programs from 64-bit LLDB.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://marc.info/?l=openbsd-misc&m=158068418807352&w=2" rel="nofollow">wpa_supplicant is definitely a lower-class citizen, sorry</a></h3>

<blockquote>
<p>wpa_supplicant is definitely a lower-class citizen, sorry.</p>

<p>I increasingly wonder why this stuff matters; transit costs are so much lower than the period when eduroam was setup, and their reliance on 802.11x is super weird in a world where, for the most part<br>
    + entire cities have open wifi in their downtown core<br>
    + edu vs edu+transit split horizon problems have to be solved anyways<br>
    + many universities have parallel open wifi<br>
    + rate limiting / fare-share approaches for the open-net, on unmetered<br>
    + flat-rate solves the problem<br>
    + LTE hotspot off a phone isn&#39;t a rip off anymore<br>
    + other open networks exist</p>

<p>essentially no one else feels compelled to do use 802.11x for a so called &quot;semi-open access network&quot;, so I think they&#39;ve lost the plot on friction vs benefit.</p>

<p>(we&#39;ve held hackathons at EDU campus that are locked down like that, and in every case we&#39;ve said no way, gotten a wire with open net, and built our own wifi.  we will not subject our developers to that extra complexity).</p>
</blockquote>

<hr>

<h3><a href="https://euroquis.nl/freebsd/2020/02/08/freebsd.html" rel="nofollow">KDE FreeBSD Updates Feb 2020</a></h3>

<blockquote>
<p>Some bits and bobs from the KDE FreeBSD team in february 2020. We met at the FreeBSD devsummit before FOSDEM, along with other FreeBSD people. Plans were made, schemes were forged, and Groff the Goat was introduced to some new people. </p>
</blockquote>

<ul>
<li>The big ticket things:

<ul>
<li> Frameworks are at 5.66</li>
<li>Plasma is at 5.17.5 (the beta 5.18 hasn’t been tried)</li>
<li>KDE release service has landed 19.12.2 (same day it was released)</li>
</ul></li>
<li>Developer-centric:

<ul>
<li>KDevelop is at 5.5.0</li>
<li>KUserfeedback landed its 1.0.0 release</li>
<li>CMake is 3.16.3</li>
</ul></li>
<li>Applications:

<ul>
<li>Musescore is at 3.4.2</li>
<li>Elisa now part of the KDE release service updates</li>
</ul></li>
<li>Fuure work:

<ul>
<li>KIO-Fuse probably needs extra real-world testing on FreeBSD. I don’t have that kind of   mounts (just NFS in /etc/fstab) so I’m not the target audience.</li>
<li>KTextEditor is missing .editorconfig support. That can come in with the next frameworks update, when consumers update anyway. Chasing it in an intermediate release is a bit problematic because it does require some rebuilds of consumers.</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-February/001929.html" rel="nofollow">Travel Grant Application for BSDCan is now open</a></h3>

<blockquote>
<p>Hi everyone,</p>

<p>The Travel Grant Application for BSDCan 2020 is now open. The Foundation can help you attend BSDCan through our travel grant program. Travel grants are available to FreeBSD developers and advocates who need assistance with travel expenses for attending conferences related to FreeBSD development. BSDCan 2020 applications are due April 9, 2020. Find out more and apply at: <a href="https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/" rel="nofollow">https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/</a></p>

<p>Did you know the Foundation also provides grants for technical events not specifically focused on BSD? If you feel that your attendance at one of these events will benefit the FreeBSD Project and Community and you need assistance getting there,  please fill out the general travel grant application.  Your application must be received 7 weeks prior to the event. The general application can be found here: <a href="https://goo.gl/forms/QzsOMR8Jra0vqFYH2" rel="nofollow">https://goo.gl/forms/QzsOMR8Jra0vqFYH2</a></p>
</blockquote>

<hr>

<h3><a href="https://dan.langille.org/2020/02/01/creating-a-zfs-dataset-for-testing-iocage-within-a-jail/" rel="nofollow">Creating a ZFS dataset for testing iocage within a jail</a></h3>

<ul>
<li>Be warned, this failed. I’m stalled and I have not completed this.</li>
</ul>

<blockquote>
<p>I’m going to do jails within a jail. I already do that with poudriere in a jail but here I want to test an older version of iocage before upgrading my current jail hosts to a newer version.</p>
</blockquote>

<ul>
<li>In this post:

<ul>
<li>FreeBSD 12.1</li>
<li>py36-iocage-1.2_3</li>
<li>py36-iocage-1.2_4</li>
</ul></li>
</ul>

<blockquote>
<p>This post includes my errors and mistakes. Perhaps you should proceed carefully and read it all first.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/journal/browser-based-edition/" rel="nofollow">Reminder: the FreeBSD Journal is free! Check out these great articles</a></li>
<li><a href="https://twitter.com/jcs/status/1224205573656322048" rel="nofollow">Serenity GUI desktop running on an OpenBSD kernel</a></li>
<li><a href="https://github.com/apple-open-source/macos" rel="nofollow">The Open Source Parts of MacOS</a></li>
<li><a href="https://www.fosdem.org/2020/schedule/track/bsd/" rel="nofollow">FOSDEM videos available</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Michael - <a href="http://dpaste.com/3WRC9CQ#wrap" rel="nofollow">Install with ZFS</a></li>
<li>Mohammad - <a href="http://dpaste.com/3BYZKMS#wrap" rel="nofollow">Server Freeze</a></li>
<li>Todd - <a href="http://dpaste.com/2J50HSJ#wrap" rel="nofollow">ZFS Questions</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0338.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>337: Kubernetes on bhyve</title>
  <link>https://www.bsdnow.tv/337</link>
  <guid isPermaLink="false">4a814adb-1ea5-41e3-baee-5645c60315d2</guid>
  <pubDate>Thu, 13 Feb 2020 11:30:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4a814adb-1ea5-41e3-baee-5645c60315d2.mp3" length="57168584" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more.</itunes:subtitle>
  <itunes:duration>1:19:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more.
Headlines
The happinesses and stresses of full-time FOSS work (https://drewdevault.com//2020/01/21/Stress-and-happiness.html)
In the past few days, several free software maintainers have come out to discuss the stresses of their work. Though the timing was suggestive, my article last week on the philosophy of project governance was, at best, only tangentially related to this topic - I had been working on that article for a while. I do have some thoughts that I’d like to share about what kind of stresses I’ve dealt with as a FOSS maintainer, and how I’ve managed (or often mismanaged) it.
February will mark one year that I’ve been working on self-directed free software projects full-time. I was planning on writing an optimistic retrospective article around this time, but given the current mood of the ecosystem I think it would be better to be realistic. In this stage of my career, I now feel at once happier, busier, more fulfilled, more engaged, more stressed, and more depressed than I have at any other point in my life.
The good parts are numerous. I’m able to work on my life’s passions, and my projects are in the best shape they’ve ever been thanks to the attention I’m able to pour into them. I’ve also been able to do more thoughtful, careful work; with the extra time I’ve been able to make my software more robust and reliable than it’s ever been. The variety of projects I can invest my time into has also increased substantially, with what was once relegated to minor curiosities now receiving a similar amount of attention as my larger projects were receiving in my spare time before. I can work from anywhere in the world, at any time, not worrying about when to take time off and when to put my head down and crank out a lot of code.
The frustrations are numerous, as well. I often feel like I’ve bit off more than I can chew. This has been the default state of affairs for me for a long time; I’m often neglecting half of my projects in order to obtain progress by leaps and bounds in just a few. Working on FOSS full-time has cast this model’s disadvantages into greater relief, as I focus on a greater breadth of projects and spend more time on them.
Building a FreeBSD File Server (https://www.vmwareblog.org/building-freebsd-file-server/)
Recently at my job, I was faced with a task to develop a file server explicitly suited for the requirements of the company. Needless to say, any configuration of a kind depends on what the infrastructure needs. So, drawing from my personal experience and numerous materials on the web, I came up with the combination FreeBSD+SAMBA+AD as the most appropriate. It appears to be a perfect choice for this environment, and harmonic addition to the existing network configuration since FreeBSD + SAMBA + AD enables admins with the broad range of possibilities for access control. However, as nothing is perfect, this configuration isn’t the best choice if your priority is data protection because it won’t be able to reach the necessary levels of reliability and fault tolerance without outside improvements.
Now, since we’ve established that, let’s move on to the next point. This article’s describing the process of building a test environment while concentrating primarily on the details of the configuration. As the author, though, I must say I’m in no way suggesting that this is the only way! The following configuration will be presented in its initial stage, with the minimum requirements necessary to get the job done, and its purpose in one specific situation only. Here, look at this as a useful strategy to solve similar tasks. Well, let’s get started!
Report from the first Hamilton BSD Users Group Meeting (https://twitter.com/hambug_ca/status/1227664949914349569)
February 11th was the first meeting of this new user group, founded by John Young and myself
11 people attended, and a lot of good discussions were had
One of the attendees already owns a domain that fits well for the group, so we will be getting that setup over the next few weeks, as well as the twitter account, and other organization stuff.
Special thanks to the illumos users who drove in from Buffalo to attend, although they may have actually had a shorter drive than a few of the other attendees.
The next meeting is scheduled again for the 2nd Tuesday of the month, March 10th.
We are still discussing if we should meet at a restaurant again, or try to get a space at the local college or innovation hub where we can have a projector etc.
News Roundup
Kubernetes on FreeBSD Bhyve (https://www.bsdstore.ru/en/articles/cbsd_k8s_part1.html)
There are quite a few solutions for container orchestration, but the most popular (or the most famous and highly advertised, is probably, a Kubernetes) Since I plan to conduct many experiments with installing and configuring k8s, I need a laboratory in which I can quickly and easily deploy a cluster in any quantities for myself. In my work and everyday life I use two OS very tightly - Linux and FreeBSD OS. Kubernetes and docker are Linux-centric projects, and at first glance, you should not expect any useful participation and help from FreeBSD here. As the saying goes, an elephant can be made out of a fly, but it will no longer fly. However, two tempting things come to mind - this is very good integration and work in the FreeBSD ZFS file system, from which it would be nice to use the snapshot mechanism, COW and reliability. And the second is the bhyve hypervisor, because we still need the docker and k8s loader in the form of the Linux kernel. Thus, we need to connect a certain number of actions in various ways, most of which are related to starting and pre-configuring virtual machines. This is typical of both a Linux-based server and FreeBSD. What exactly will work under the hood to run virtual machines does not play a big role. And if so - let's take a FreeBSD here!
NetBSD 9 RC1 Available (http://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd)
We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).
Here are a few highlights of the new release:
Support for Arm AArch64 (64-bit Armv8-A) machines, including "Arm ServerReady" compliant machines (SBBR+SBSA)
Enhanced hardware support for Armv7-A
Updated GPU drivers (e.g. support for Intel Kabylake)
Enhanced virtualization support
Support for hardware-accelerated virtualization (NVMM)
Support for Performance Monitoring Counters
Support for Kernel ASLR
Support several kernel sanitizers (KLEAK, KASAN, KUBSAN)
Support for userland sanitizers
Audit of the network stack
Many improvements in NPF
Updated ZFS
Reworked error handling and NCQ support in the SATA subsystem
Support a common framework for USB Ethernet drivers (usbnet)
You can download binaries of NetBSD 9.0RC1 from our Fastly-provided CDN: https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0RC1/
OPNsense 20.1 Keen Kingfisher released (https://opnsense.org/opnsense-20-1-keen-kingfisher-released/)
For over 5 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.
20.1, nicknamed "Keen Kingfisher", is a subtle improvement on sustainable firewall experience. This release adds VXLAN and additional loopback device support, IPsec public key authentication and elliptic curve TLS certificate creation amongst others. Third party software has been updated to their latest versions. The logging frontend was rewritten for MVC with seamless API support. On the far side the documentation increased in quality as well as quantity and now presents itself in a familiar menu layout.
Idealistic Future for HardenedBSD (https://hardenedbsd.org/article/shawn-webb/2020-01-26/idealistic-future-hardenedbsd)
Over the past month, we purchased and deployed the new 13-CURRENT/amd64 package building server. We published our first 13-CURRENT/amd64 production package build using that server. We then rebuilt the old package building server to act as the 12-STABLE/amd64 package building server. This post signifies a very important milestone: we have now fully recovered from last year's death of our infrastructure. Our 12-STABLE/amd64 repo, previously out-of-date by many months, is now fully up-to-date!
HardenedBSD is in a very unique position to provide innovative solutions to at-risk and underprivileged populations. As such, we are making human rights endeavors a defining area of focus. Our infrastructure will integrate various privacy and anonymity enhancing technologies and techniques to protect lives. Our operating system's security posture will increase, especially with our focus on exploit mitigations.
Navigating the intersection between human rights and information security directly impacts lives. HardenedBSD's 2020 mission and focus is to deliver an entire hardened ecosystem that is unfriendly towards those who would oppress or censor their people. This includes a subtle shift in priorities to match this new mission and focus. While we implement exploit mitigations and further harden the ecosystem, we will seek out opportunities to contribute a tangible and unique impact on human rights issues. Providing Tor Onion Services for our core infrastructure is the first step in likely many to come towards securely helping those in need.
Beastie Bits
Warner Losh's FOSDEM talk (https://fosdem.org/2020/interviews/warner-losh/)
Relational Pipes v0.15 (https://relational-pipes.globalcode.info/v_0/release-v0.15.xhtml)
A reminder for where to find NetBSD ARM images (http://www.armbsd.org/arm/)
New Safe Memory Reclamation feature in UMA (https://lists.freebsd.org/pipermail/freebsd-arch/2020-January/019866.html)
BSD Users Stockholm Meetup (https://twitter.com/niclaszeising/status/1216667359831842817)
Feedback/Questions
ZFS - Rosetta Stone Document? (http://dpaste.com/13EK8YH#wrap)
Pat - Question (http://dpaste.com/2DN5RA4#wrap)
Sigflup - Wayland on the BSDs (http://dpaste.com/03Y4FQ7#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, happyness, stress, foss, full time open source, fileserver, file server, kubernetes, k8s, bhyve, netbsd 10, opnsense, keen kingfisher</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://drewdevault.com//2020/01/21/Stress-and-happiness.html" rel="nofollow">The happinesses and stresses of full-time FOSS work</a></h3>

<blockquote>
<p>In the past few days, several free software maintainers have come out to discuss the stresses of their work. Though the timing was suggestive, my article last week on the philosophy of project governance was, at best, only tangentially related to this topic - I had been working on that article for a while. I do have some thoughts that I’d like to share about what kind of stresses I’ve dealt with as a FOSS maintainer, and how I’ve managed (or often mismanaged) it.</p>

<p>February will mark one year that I’ve been working on self-directed free software projects full-time. I was planning on writing an optimistic retrospective article around this time, but given the current mood of the ecosystem I think it would be better to be realistic. In this stage of my career, I now feel at once happier, busier, more fulfilled, more engaged, more stressed, and more depressed than I have at any other point in my life.</p>

<p>The good parts are numerous. I’m able to work on my life’s passions, and my projects are in the best shape they’ve ever been thanks to the attention I’m able to pour into them. I’ve also been able to do more thoughtful, careful work; with the extra time I’ve been able to make my software more robust and reliable than it’s ever been. The variety of projects I can invest my time into has also increased substantially, with what was once relegated to minor curiosities now receiving a similar amount of attention as my larger projects were receiving in my spare time before. I can work from anywhere in the world, at any time, not worrying about when to take time off and when to put my head down and crank out a lot of code.</p>

<p>The frustrations are numerous, as well. I often feel like I’ve bit off more than I can chew. This has been the default state of affairs for me for a long time; I’m often neglecting half of my projects in order to obtain progress by leaps and bounds in just a few. Working on FOSS full-time has cast this model’s disadvantages into greater relief, as I focus on a greater breadth of projects and spend more time on them.</p>
</blockquote>

<hr>

<h3><a href="https://www.vmwareblog.org/building-freebsd-file-server/" rel="nofollow">Building a FreeBSD File Server</a></h3>

<blockquote>
<p>Recently at my job, I was faced with a task to develop a file server explicitly suited for the requirements of the company. Needless to say, any configuration of a kind depends on what the infrastructure needs. So, drawing from my personal experience and numerous materials on the web, I came up with the combination FreeBSD+SAMBA+AD as the most appropriate. It appears to be a perfect choice for this environment, and harmonic addition to the existing network configuration since FreeBSD + SAMBA + AD enables admins with the broad range of possibilities for access control. However, as nothing is perfect, this configuration isn’t the best choice if your priority is data protection because it won’t be able to reach the necessary levels of reliability and fault tolerance without outside improvements.</p>

<p>Now, since we’ve established that, let’s move on to the next point. This article’s describing the process of building a test environment while concentrating primarily on the details of the configuration. As the author, though, I must say I’m in no way suggesting that this is the only way! The following configuration will be presented in its initial stage, with the minimum requirements necessary to get the job done, and its purpose in one specific situation only. Here, look at this as a useful strategy to solve similar tasks. Well, let’s get started!</p>
</blockquote>

<hr>

<h3><a href="https://twitter.com/hambug_ca/status/1227664949914349569" rel="nofollow">Report from the first Hamilton BSD Users Group Meeting</a></h3>

<blockquote>
<p>February 11th was the first meeting of this new user group, founded by John Young and myself</p>

<p>11 people attended, and a lot of good discussions were had</p>

<p>One of the attendees already owns a domain that fits well for the group, so we will be getting that setup over the next few weeks, as well as the twitter account, and other organization stuff.</p>

<p>Special thanks to the illumos users who drove in from Buffalo to attend, although they may have actually had a shorter drive than a few of the other attendees.</p>

<p>The next meeting is scheduled again for the 2nd Tuesday of the month, March 10th.</p>

<p>We are still discussing if we should meet at a restaurant again, or try to get a space at the local college or innovation hub where we can have a projector etc.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.bsdstore.ru/en/articles/cbsd_k8s_part1.html" rel="nofollow">Kubernetes on FreeBSD Bhyve</a></h3>

<blockquote>
<p>There are quite a few solutions for container orchestration, but the most popular (or the most famous and highly advertised, is probably, a Kubernetes) Since I plan to conduct many experiments with installing and configuring k8s, I need a laboratory in which I can quickly and easily deploy a cluster in any quantities for myself. In my work and everyday life I use two OS very tightly - Linux and FreeBSD OS. Kubernetes and docker are Linux-centric projects, and at first glance, you should not expect any useful participation and help from FreeBSD here. As the saying goes, an elephant can be made out of a fly, but it will no longer fly. However, two tempting things come to mind - this is very good integration and work in the FreeBSD ZFS file system, from which it would be nice to use the snapshot mechanism, COW and reliability. And the second is the bhyve hypervisor, because we still need the docker and k8s loader in the form of the Linux kernel. Thus, we need to connect a certain number of actions in various ways, most of which are related to starting and pre-configuring virtual machines. This is typical of both a Linux-based server and FreeBSD. What exactly will work under the hood to run virtual machines does not play a big role. And if so - let&#39;s take a FreeBSD here!</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd" rel="nofollow">NetBSD 9 RC1 Available</a></h3>

<blockquote>
<p>We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).</p>
</blockquote>

<ul>
<li><p>Here are a few highlights of the new release:</p>

<ul>
<li>Support for Arm AArch64 (64-bit Armv8-A) machines, including &quot;Arm ServerReady&quot; compliant machines (SBBR+SBSA)</li>
<li>Enhanced hardware support for Armv7-A</li>
<li>Updated GPU drivers (e.g. support for Intel Kabylake)</li>
<li>Enhanced virtualization support</li>
<li>Support for hardware-accelerated virtualization (NVMM)</li>
<li>Support for Performance Monitoring Counters</li>
<li>Support for Kernel ASLR</li>
<li>Support several kernel sanitizers (KLEAK, KASAN, KUBSAN)</li>
<li>Support for userland sanitizers</li>
<li>Audit of the network stack</li>
<li>Many improvements in NPF</li>
<li>Updated ZFS</li>
<li>Reworked error handling and NCQ support in the SATA subsystem</li>
<li>Support a common framework for USB Ethernet drivers (usbnet)</li>
</ul></li>
<li><p>You can download binaries of NetBSD 9.0_RC1 from our Fastly-provided CDN: <a href="https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/" rel="nofollow">https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/</a></p></li>
</ul>

<hr>

<h3><a href="https://opnsense.org/opnsense-20-1-keen-kingfisher-released/" rel="nofollow">OPNsense 20.1 Keen Kingfisher released</a></h3>

<blockquote>
<p>For over 5 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.</p>

<p>20.1, nicknamed &quot;Keen Kingfisher&quot;, is a subtle improvement on sustainable firewall experience. This release adds VXLAN and additional loopback device support, IPsec public key authentication and elliptic curve TLS certificate creation amongst others. Third party software has been updated to their latest versions. The logging frontend was rewritten for MVC with seamless API support. On the far side the documentation increased in quality as well as quantity and now presents itself in a familiar menu layout.</p>
</blockquote>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-01-26/idealistic-future-hardenedbsd" rel="nofollow">Idealistic Future for HardenedBSD</a></h3>

<blockquote>
<p>Over the past month, we purchased and deployed the new 13-CURRENT/amd64 package building server. We published our first 13-CURRENT/amd64 production package build using that server. We then rebuilt the old package building server to act as the 12-STABLE/amd64 package building server. This post signifies a very important milestone: we have now fully recovered from last year&#39;s death of our infrastructure. Our 12-STABLE/amd64 repo, previously out-of-date by many months, is now fully up-to-date!</p>

<p>HardenedBSD is in a very unique position to provide innovative solutions to at-risk and underprivileged populations. As such, we are making human rights endeavors a defining area of focus. Our infrastructure will integrate various privacy and anonymity enhancing technologies and techniques to protect lives. Our operating system&#39;s security posture will increase, especially with our focus on exploit mitigations.</p>

<p>Navigating the intersection between human rights and information security directly impacts lives. HardenedBSD&#39;s 2020 mission and focus is to deliver an entire hardened ecosystem that is unfriendly towards those who would oppress or censor their people. This includes a subtle shift in priorities to match this new mission and focus. While we implement exploit mitigations and further harden the ecosystem, we will seek out opportunities to contribute a tangible and unique impact on human rights issues. Providing Tor Onion Services for our core infrastructure is the first step in likely many to come towards securely helping those in need.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://fosdem.org/2020/interviews/warner-losh/" rel="nofollow">Warner Losh&#39;s FOSDEM talk</a></li>
<li><a href="https://relational-pipes.globalcode.info/v_0/release-v0.15.xhtml" rel="nofollow">Relational Pipes v0.15</a></li>
<li><a href="http://www.armbsd.org/arm/" rel="nofollow">A reminder for where to find NetBSD ARM images</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-arch/2020-January/019866.html" rel="nofollow">New Safe Memory Reclamation feature in UMA</a></li>
<li><a href="https://twitter.com/niclaszeising/status/1216667359831842817" rel="nofollow">BSD Users Stockholm Meetup</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>ZFS - <a href="http://dpaste.com/13EK8YH#wrap" rel="nofollow">Rosetta Stone Document?</a></li>
<li>Pat - <a href="http://dpaste.com/2DN5RA4#wrap" rel="nofollow">Question</a></li>
<li>Sigflup - <a href="http://dpaste.com/03Y4FQ7#wrap" rel="nofollow">Wayland on the BSDs</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0337.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://drewdevault.com//2020/01/21/Stress-and-happiness.html" rel="nofollow">The happinesses and stresses of full-time FOSS work</a></h3>

<blockquote>
<p>In the past few days, several free software maintainers have come out to discuss the stresses of their work. Though the timing was suggestive, my article last week on the philosophy of project governance was, at best, only tangentially related to this topic - I had been working on that article for a while. I do have some thoughts that I’d like to share about what kind of stresses I’ve dealt with as a FOSS maintainer, and how I’ve managed (or often mismanaged) it.</p>

<p>February will mark one year that I’ve been working on self-directed free software projects full-time. I was planning on writing an optimistic retrospective article around this time, but given the current mood of the ecosystem I think it would be better to be realistic. In this stage of my career, I now feel at once happier, busier, more fulfilled, more engaged, more stressed, and more depressed than I have at any other point in my life.</p>

<p>The good parts are numerous. I’m able to work on my life’s passions, and my projects are in the best shape they’ve ever been thanks to the attention I’m able to pour into them. I’ve also been able to do more thoughtful, careful work; with the extra time I’ve been able to make my software more robust and reliable than it’s ever been. The variety of projects I can invest my time into has also increased substantially, with what was once relegated to minor curiosities now receiving a similar amount of attention as my larger projects were receiving in my spare time before. I can work from anywhere in the world, at any time, not worrying about when to take time off and when to put my head down and crank out a lot of code.</p>

<p>The frustrations are numerous, as well. I often feel like I’ve bit off more than I can chew. This has been the default state of affairs for me for a long time; I’m often neglecting half of my projects in order to obtain progress by leaps and bounds in just a few. Working on FOSS full-time has cast this model’s disadvantages into greater relief, as I focus on a greater breadth of projects and spend more time on them.</p>
</blockquote>

<hr>

<h3><a href="https://www.vmwareblog.org/building-freebsd-file-server/" rel="nofollow">Building a FreeBSD File Server</a></h3>

<blockquote>
<p>Recently at my job, I was faced with a task to develop a file server explicitly suited for the requirements of the company. Needless to say, any configuration of a kind depends on what the infrastructure needs. So, drawing from my personal experience and numerous materials on the web, I came up with the combination FreeBSD+SAMBA+AD as the most appropriate. It appears to be a perfect choice for this environment, and harmonic addition to the existing network configuration since FreeBSD + SAMBA + AD enables admins with the broad range of possibilities for access control. However, as nothing is perfect, this configuration isn’t the best choice if your priority is data protection because it won’t be able to reach the necessary levels of reliability and fault tolerance without outside improvements.</p>

<p>Now, since we’ve established that, let’s move on to the next point. This article’s describing the process of building a test environment while concentrating primarily on the details of the configuration. As the author, though, I must say I’m in no way suggesting that this is the only way! The following configuration will be presented in its initial stage, with the minimum requirements necessary to get the job done, and its purpose in one specific situation only. Here, look at this as a useful strategy to solve similar tasks. Well, let’s get started!</p>
</blockquote>

<hr>

<h3><a href="https://twitter.com/hambug_ca/status/1227664949914349569" rel="nofollow">Report from the first Hamilton BSD Users Group Meeting</a></h3>

<blockquote>
<p>February 11th was the first meeting of this new user group, founded by John Young and myself</p>

<p>11 people attended, and a lot of good discussions were had</p>

<p>One of the attendees already owns a domain that fits well for the group, so we will be getting that setup over the next few weeks, as well as the twitter account, and other organization stuff.</p>

<p>Special thanks to the illumos users who drove in from Buffalo to attend, although they may have actually had a shorter drive than a few of the other attendees.</p>

<p>The next meeting is scheduled again for the 2nd Tuesday of the month, March 10th.</p>

<p>We are still discussing if we should meet at a restaurant again, or try to get a space at the local college or innovation hub where we can have a projector etc.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.bsdstore.ru/en/articles/cbsd_k8s_part1.html" rel="nofollow">Kubernetes on FreeBSD Bhyve</a></h3>

<blockquote>
<p>There are quite a few solutions for container orchestration, but the most popular (or the most famous and highly advertised, is probably, a Kubernetes) Since I plan to conduct many experiments with installing and configuring k8s, I need a laboratory in which I can quickly and easily deploy a cluster in any quantities for myself. In my work and everyday life I use two OS very tightly - Linux and FreeBSD OS. Kubernetes and docker are Linux-centric projects, and at first glance, you should not expect any useful participation and help from FreeBSD here. As the saying goes, an elephant can be made out of a fly, but it will no longer fly. However, two tempting things come to mind - this is very good integration and work in the FreeBSD ZFS file system, from which it would be nice to use the snapshot mechanism, COW and reliability. And the second is the bhyve hypervisor, because we still need the docker and k8s loader in the form of the Linux kernel. Thus, we need to connect a certain number of actions in various ways, most of which are related to starting and pre-configuring virtual machines. This is typical of both a Linux-based server and FreeBSD. What exactly will work under the hood to run virtual machines does not play a big role. And if so - let&#39;s take a FreeBSD here!</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd" rel="nofollow">NetBSD 9 RC1 Available</a></h3>

<blockquote>
<p>We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).</p>
</blockquote>

<ul>
<li><p>Here are a few highlights of the new release:</p>

<ul>
<li>Support for Arm AArch64 (64-bit Armv8-A) machines, including &quot;Arm ServerReady&quot; compliant machines (SBBR+SBSA)</li>
<li>Enhanced hardware support for Armv7-A</li>
<li>Updated GPU drivers (e.g. support for Intel Kabylake)</li>
<li>Enhanced virtualization support</li>
<li>Support for hardware-accelerated virtualization (NVMM)</li>
<li>Support for Performance Monitoring Counters</li>
<li>Support for Kernel ASLR</li>
<li>Support several kernel sanitizers (KLEAK, KASAN, KUBSAN)</li>
<li>Support for userland sanitizers</li>
<li>Audit of the network stack</li>
<li>Many improvements in NPF</li>
<li>Updated ZFS</li>
<li>Reworked error handling and NCQ support in the SATA subsystem</li>
<li>Support a common framework for USB Ethernet drivers (usbnet)</li>
</ul></li>
<li><p>You can download binaries of NetBSD 9.0_RC1 from our Fastly-provided CDN: <a href="https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/" rel="nofollow">https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/</a></p></li>
</ul>

<hr>

<h3><a href="https://opnsense.org/opnsense-20-1-keen-kingfisher-released/" rel="nofollow">OPNsense 20.1 Keen Kingfisher released</a></h3>

<blockquote>
<p>For over 5 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.</p>

<p>20.1, nicknamed &quot;Keen Kingfisher&quot;, is a subtle improvement on sustainable firewall experience. This release adds VXLAN and additional loopback device support, IPsec public key authentication and elliptic curve TLS certificate creation amongst others. Third party software has been updated to their latest versions. The logging frontend was rewritten for MVC with seamless API support. On the far side the documentation increased in quality as well as quantity and now presents itself in a familiar menu layout.</p>
</blockquote>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-01-26/idealistic-future-hardenedbsd" rel="nofollow">Idealistic Future for HardenedBSD</a></h3>

<blockquote>
<p>Over the past month, we purchased and deployed the new 13-CURRENT/amd64 package building server. We published our first 13-CURRENT/amd64 production package build using that server. We then rebuilt the old package building server to act as the 12-STABLE/amd64 package building server. This post signifies a very important milestone: we have now fully recovered from last year&#39;s death of our infrastructure. Our 12-STABLE/amd64 repo, previously out-of-date by many months, is now fully up-to-date!</p>

<p>HardenedBSD is in a very unique position to provide innovative solutions to at-risk and underprivileged populations. As such, we are making human rights endeavors a defining area of focus. Our infrastructure will integrate various privacy and anonymity enhancing technologies and techniques to protect lives. Our operating system&#39;s security posture will increase, especially with our focus on exploit mitigations.</p>

<p>Navigating the intersection between human rights and information security directly impacts lives. HardenedBSD&#39;s 2020 mission and focus is to deliver an entire hardened ecosystem that is unfriendly towards those who would oppress or censor their people. This includes a subtle shift in priorities to match this new mission and focus. While we implement exploit mitigations and further harden the ecosystem, we will seek out opportunities to contribute a tangible and unique impact on human rights issues. Providing Tor Onion Services for our core infrastructure is the first step in likely many to come towards securely helping those in need.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://fosdem.org/2020/interviews/warner-losh/" rel="nofollow">Warner Losh&#39;s FOSDEM talk</a></li>
<li><a href="https://relational-pipes.globalcode.info/v_0/release-v0.15.xhtml" rel="nofollow">Relational Pipes v0.15</a></li>
<li><a href="http://www.armbsd.org/arm/" rel="nofollow">A reminder for where to find NetBSD ARM images</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-arch/2020-January/019866.html" rel="nofollow">New Safe Memory Reclamation feature in UMA</a></li>
<li><a href="https://twitter.com/niclaszeising/status/1216667359831842817" rel="nofollow">BSD Users Stockholm Meetup</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>ZFS - <a href="http://dpaste.com/13EK8YH#wrap" rel="nofollow">Rosetta Stone Document?</a></li>
<li>Pat - <a href="http://dpaste.com/2DN5RA4#wrap" rel="nofollow">Question</a></li>
<li>Sigflup - <a href="http://dpaste.com/03Y4FQ7#wrap" rel="nofollow">Wayland on the BSDs</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0337.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>336: Archived Knowledge</title>
  <link>https://www.bsdnow.tv/336</link>
  <guid isPermaLink="false">3f404c97-d972-4734-9152-420ea4263317</guid>
  <pubDate>Thu, 06 Feb 2020 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3f404c97-d972-4734-9152-420ea4263317.mp3" length="41728650" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Linux couldn’t duplicate OpenBSD, FreeBSD Q4 status report, OPNsense 19.7.9 released, archives retain and pass on knowledge, HardenedBSD Tor Onion Service v3 Nodes, and more.</itunes:subtitle>
  <itunes:duration>57:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Linux couldn’t duplicate OpenBSD, FreeBSD Q4 status report, OPNsense 19.7.9 released, archives retain and pass on knowledge, HardenedBSD Tor Onion Service v3 Nodes, and more.
Headlines
OpenBSD has to be a BSD Unix and you couldn't duplicate it with Linux (https://utcc.utoronto.ca/~cks/space/blog/unix/OpenBSDMustBeABSD?showcomments)
OpenBSD has a well deserved reputation for putting security and a clean system (for code, documentation, and so on) first, and everything else second. OpenBSD is of course based on BSD (it's right there in the name) and descends from FreeBSD NetBSD (you can read the history here). But one of the questions you could ask about it is whether it had to be that way, and in particular if you could build something like OpenBSD on top of Linux. I believe that the answer is no.
Linux and the *BSDs have a significantly different model of what they are. BSDs have a 'base system' that provides an integrated and fully operational core Unix, covering the kernel, C library and compiler, and the normal Unix user level programs, all maintained and distributed by the particular BSD. Linux is not a single unit this way, and instead all of the component parts are maintained separately and assembled in various ways by various Linux distributions. Both approaches have their advantages, but one big one for the BSD approach is that it enables global changes.
Making global changes is an important part of what makes OpenBSD's approach to improving security, code maintenance, and so on work. Because it directly maintains everything as a unit, OpenBSD is in a position to introduce new C library or kernel APIs (or change them) and then immediately update all sorts of things in user level programs to use the new API. This takes a certain amount of work, of course, but it's possible to do it at all. And because OpenBSD can do this sort of ambitious global change, it does.
This goes further than just the ability to make global changes, because in theory you can patch in global changes on top of a bunch of separate upstream projects. Because OpenBSD is in control of its entire base system, it's not forced to try to reconcile different development priorities or integrate clashing changes. OpenBSD can decide (and has) that only certain sorts of changes will be accepted into its system at all, no matter what people want. If there are features or entire programs that don't fit into what OpenBSD will accept, they just lose out.
FreeBSD Quarterly Status Report 2019Q4 (https://lists.freebsd.org/pipermail/freebsd-announce/2020-January/001923.html)
Here is the last quarterly status report for 2019. As you might remember from last report, we changed our timeline: now we collect reports the last month of each quarter and we edit and publish the full document the next month. Thus, we cover here the period October 2019 - December 2019.
If you thought that the FreeBSD community was less active in the Christmas' quarter you will be glad to be proven wrong: a quick glance at the summary will be sufficient to see that much work has been done in the last months.
Have a nice read!
News Roundup
OPNsense 19.7.9 released (https://opnsense.org/opnsense-19-7-9-released/)
As 20.1 nears we will be making adjustments to the scope of the release with an announcement following shortly.
For now, this update brings you a GeoIP database configuration page for aliases which is now required due to upstream database policy changes and a number of prominent third-party software updates we are happy to see included.
Archives are important to retain and pass on knowledge (https://dan.langille.org/2020/01/07/archives-are-important-to-retain-and-pass-on-knowledge/)
Archives are important. When they are public and available for searching, it retains and passes on knowledge. It saves vast amounts of time.
HardenedBSD Tor Onion Service v3 Nodes (https://hardenedbsd.org/article/shawn-webb/2020-01-30/hardenedbsd-tor-onion-service-v3-nodes)
I've been working today on deploying Tor Onion Service v3 nodes across our build infrastructure. I'm happy to announce that the public portion of this is now completed. Below you will find various onion service hostnames and their match to our infrastructure.
hardenedbsd.org: lkiw4tmbudbr43hbyhm636sarn73vuow77czzohdbqdpjuq3vdzvenyd.onion
ci-01.nyi.hardenedbsd.org: qspcqclhifj3tcpojsbwoxgwanlo2wakti2ia4wozxjcldkxmw2yj3yd.onion
ci-03.md.hardenedbsd.org: eqvnohly4tjrkpwatdhgptftabpesofirnhz5kq7jzn4zd6ernpvnpqd.onion
ci-04.md.hardenedbsd.org: rfqabq2w65nhdkukeqwf27r7h5xfh53h3uns6n74feeyl7s5fbjxczqd.onion
git-01.md.hardenedbsd.org: dacxzjk3kq5mmepbdd3ai2ifynlzxsnpl2cnkfhridqfywihrfftapid.onion
Beastie Bits
The Missing Semester of Your CS Education (MIT Course) (https://missing.csail.mit.edu/)
An old Unix Ad (https://i.redd.it/503390rf7md41.png)
OpenBSD syscall call-from verification (https://marc.info/?l=openbsd-tech&amp;amp;m=157488907117170&amp;amp;w=2)
OpenBSD/arm64 on Pinebook (https://twitter.com/bluerise/status/1220963106563579909)
Reminder: First Southern Ontario BSD user group meeting, February 11th (this coming Tuesday!) 18:30 at Boston Pizza on Upper James st, Hamilton. (http://studybsd.com/)
NYCBUG: March meeting will feature Dr. Paul Vixie and his new talk “Operating Systems as Dumb Pipes” (https://www.nycbug.org/)
8th Meetup of the Stockholm BUG: March 3 at 18:00 (https://www.meetup.com/de-DE/BSD-Users-Stockholm/events/267873938/)
Polish BSD User Group meets on Feb 11, 2020 at 18:15 (https://bsd-pl.org/en)
Feedback/Questions
Sean - ZFS and Creation Dates (http://dpaste.com/3W5WBV0#wrap)
Christopher - Help on ZFS Disaster Recovery (http://dpaste.com/3SE43PW)
Mike - Encrypted ZFS Send (http://dpaste.com/00J5JZG#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, status, status report, opnsense, firewall, router, archives, knowledge, tor, tor onion service node</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Linux couldn’t duplicate OpenBSD, FreeBSD Q4 status report, OPNsense 19.7.9 released, archives retain and pass on knowledge, HardenedBSD Tor Onion Service v3 Nodes, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/OpenBSDMustBeABSD?showcomments" rel="nofollow">OpenBSD has to be a BSD Unix and you couldn&#39;t duplicate it with Linux</a></h3>

<blockquote>
<p>OpenBSD has a well deserved reputation for putting security and a clean system (for code, documentation, and so on) first, and everything else second. OpenBSD is of course based on BSD (it&#39;s right there in the name) and descends from FreeBSD NetBSD (you can read the history here). But one of the questions you could ask about it is whether it had to be that way, and in particular if you could build something like OpenBSD on top of Linux. I believe that the answer is no.</p>

<p>Linux and the *BSDs have a significantly different model of what they are. BSDs have a &#39;base system&#39; that provides an integrated and fully operational core Unix, covering the kernel, C library and compiler, and the normal Unix user level programs, all maintained and distributed by the particular BSD. Linux is not a single unit this way, and instead all of the component parts are maintained separately and assembled in various ways by various Linux distributions. Both approaches have their advantages, but one big one for the BSD approach is that it enables global changes.</p>

<p>Making global changes is an important part of what makes OpenBSD&#39;s approach to improving security, code maintenance, and so on work. Because it directly maintains everything as a unit, OpenBSD is in a position to introduce new C library or kernel APIs (or change them) and then immediately update all sorts of things in user level programs to use the new API. This takes a certain amount of work, of course, but it&#39;s possible to do it at all. And because OpenBSD can do this sort of ambitious global change, it does.</p>

<p>This goes further than just the ability to make global changes, because in theory you can patch in global changes on top of a bunch of separate upstream projects. Because OpenBSD is in control of its entire base system, it&#39;s not forced to try to reconcile different development priorities or integrate clashing changes. OpenBSD can decide (and has) that only certain sorts of changes will be accepted into its system at all, no matter what people want. If there are features or entire programs that don&#39;t fit into what OpenBSD will accept, they just lose out.</p>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-January/001923.html" rel="nofollow">FreeBSD Quarterly Status Report 2019Q4</a></h3>

<blockquote>
<p>Here is the last quarterly status report for 2019. As you might remember from last report, we changed our timeline: now we collect reports the last month of each quarter and we edit and publish the full document the next month. Thus, we cover here the period October 2019 - December 2019.</p>

<p>If you thought that the FreeBSD community was less active in the Christmas&#39; quarter you will be glad to be proven wrong: a quick glance at the summary will be sufficient to see that much work has been done in the last months.</p>

<p>Have a nice read!</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://opnsense.org/opnsense-19-7-9-released/" rel="nofollow">OPNsense 19.7.9 released</a></h3>

<blockquote>
<p>As 20.1 nears we will be making adjustments to the scope of the release with an announcement following shortly.</p>

<p>For now, this update brings you a GeoIP database configuration page for aliases which is now required due to upstream database policy changes and a number of prominent third-party software updates we are happy to see included.</p>
</blockquote>

<hr>

<h3><a href="https://dan.langille.org/2020/01/07/archives-are-important-to-retain-and-pass-on-knowledge/" rel="nofollow">Archives are important to retain and pass on knowledge</a></h3>

<blockquote>
<p>Archives are important. When they are public and available for searching, it retains and passes on knowledge. It saves vast amounts of time.</p>
</blockquote>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-01-30/hardenedbsd-tor-onion-service-v3-nodes" rel="nofollow">HardenedBSD Tor Onion Service v3 Nodes</a></h3>

<blockquote>
<p>I&#39;ve been working today on deploying Tor Onion Service v3 nodes across our build infrastructure. I&#39;m happy to announce that the public portion of this is now completed. Below you will find various onion service hostnames and their match to our infrastructure.</p>
</blockquote>

<ul>
<li>hardenedbsd.org: lkiw4tmbudbr43hbyhm636sarn73vuow77czzohdbqdpjuq3vdzvenyd.onion</li>
<li>ci-01.nyi.hardenedbsd.org: qspcqclhifj3tcpojsbwoxgwanlo2wakti2ia4wozxjcldkxmw2yj3yd.onion</li>
<li>ci-03.md.hardenedbsd.org: eqvnohly4tjrkpwatdhgptftabpesofirnhz5kq7jzn4zd6ernpvnpqd.onion</li>
<li>ci-04.md.hardenedbsd.org: rfqabq2w65nhdkukeqwf27r7h5xfh53h3uns6n74feeyl7s5fbjxczqd.onion</li>
<li>git-01.md.hardenedbsd.org: dacxzjk3kq5mmepbdd3ai2ifynlzxsnpl2cnkfhridqfywihrfftapid.onion</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://missing.csail.mit.edu/" rel="nofollow">The Missing Semester of Your CS Education (MIT Course)</a></li>
<li><a href="https://i.redd.it/503390rf7md41.png" rel="nofollow">An old Unix Ad</a></li>
<li><a href="https://marc.info/?l=openbsd-tech&m=157488907117170&w=2" rel="nofollow">OpenBSD syscall call-from verification</a></li>
<li><a href="https://twitter.com/bluerise/status/1220963106563579909" rel="nofollow">OpenBSD/arm64 on Pinebook</a></li>
<li><a href="http://studybsd.com/" rel="nofollow">Reminder: First Southern Ontario BSD user group meeting, February 11th (this coming Tuesday!) 18:30 at Boston Pizza on Upper James st, Hamilton.</a></li>
<li><a href="https://www.nycbug.org/" rel="nofollow">NYCBUG: March meeting will feature Dr. Paul Vixie and his new talk “Operating Systems as Dumb Pipes”</a></li>
<li><a href="https://www.meetup.com/de-DE/BSD-Users-Stockholm/events/267873938/" rel="nofollow">8th Meetup of the Stockholm BUG: March 3 at 18:00</a></li>
<li><a href="https://bsd-pl.org/en" rel="nofollow">Polish BSD User Group meets on Feb 11, 2020 at 18:15</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Sean - <a href="http://dpaste.com/3W5WBV0#wrap" rel="nofollow">ZFS and Creation Dates</a></li>
<li>Christopher - <a href="http://dpaste.com/3SE43PW" rel="nofollow">Help on ZFS Disaster Recovery</a></li>
<li>Mike - <a href="http://dpaste.com/00J5JZG#wrap" rel="nofollow">Encrypted ZFS Send</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0336.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Linux couldn’t duplicate OpenBSD, FreeBSD Q4 status report, OPNsense 19.7.9 released, archives retain and pass on knowledge, HardenedBSD Tor Onion Service v3 Nodes, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/OpenBSDMustBeABSD?showcomments" rel="nofollow">OpenBSD has to be a BSD Unix and you couldn&#39;t duplicate it with Linux</a></h3>

<blockquote>
<p>OpenBSD has a well deserved reputation for putting security and a clean system (for code, documentation, and so on) first, and everything else second. OpenBSD is of course based on BSD (it&#39;s right there in the name) and descends from FreeBSD NetBSD (you can read the history here). But one of the questions you could ask about it is whether it had to be that way, and in particular if you could build something like OpenBSD on top of Linux. I believe that the answer is no.</p>

<p>Linux and the *BSDs have a significantly different model of what they are. BSDs have a &#39;base system&#39; that provides an integrated and fully operational core Unix, covering the kernel, C library and compiler, and the normal Unix user level programs, all maintained and distributed by the particular BSD. Linux is not a single unit this way, and instead all of the component parts are maintained separately and assembled in various ways by various Linux distributions. Both approaches have their advantages, but one big one for the BSD approach is that it enables global changes.</p>

<p>Making global changes is an important part of what makes OpenBSD&#39;s approach to improving security, code maintenance, and so on work. Because it directly maintains everything as a unit, OpenBSD is in a position to introduce new C library or kernel APIs (or change them) and then immediately update all sorts of things in user level programs to use the new API. This takes a certain amount of work, of course, but it&#39;s possible to do it at all. And because OpenBSD can do this sort of ambitious global change, it does.</p>

<p>This goes further than just the ability to make global changes, because in theory you can patch in global changes on top of a bunch of separate upstream projects. Because OpenBSD is in control of its entire base system, it&#39;s not forced to try to reconcile different development priorities or integrate clashing changes. OpenBSD can decide (and has) that only certain sorts of changes will be accepted into its system at all, no matter what people want. If there are features or entire programs that don&#39;t fit into what OpenBSD will accept, they just lose out.</p>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-January/001923.html" rel="nofollow">FreeBSD Quarterly Status Report 2019Q4</a></h3>

<blockquote>
<p>Here is the last quarterly status report for 2019. As you might remember from last report, we changed our timeline: now we collect reports the last month of each quarter and we edit and publish the full document the next month. Thus, we cover here the period October 2019 - December 2019.</p>

<p>If you thought that the FreeBSD community was less active in the Christmas&#39; quarter you will be glad to be proven wrong: a quick glance at the summary will be sufficient to see that much work has been done in the last months.</p>

<p>Have a nice read!</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://opnsense.org/opnsense-19-7-9-released/" rel="nofollow">OPNsense 19.7.9 released</a></h3>

<blockquote>
<p>As 20.1 nears we will be making adjustments to the scope of the release with an announcement following shortly.</p>

<p>For now, this update brings you a GeoIP database configuration page for aliases which is now required due to upstream database policy changes and a number of prominent third-party software updates we are happy to see included.</p>
</blockquote>

<hr>

<h3><a href="https://dan.langille.org/2020/01/07/archives-are-important-to-retain-and-pass-on-knowledge/" rel="nofollow">Archives are important to retain and pass on knowledge</a></h3>

<blockquote>
<p>Archives are important. When they are public and available for searching, it retains and passes on knowledge. It saves vast amounts of time.</p>
</blockquote>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-01-30/hardenedbsd-tor-onion-service-v3-nodes" rel="nofollow">HardenedBSD Tor Onion Service v3 Nodes</a></h3>

<blockquote>
<p>I&#39;ve been working today on deploying Tor Onion Service v3 nodes across our build infrastructure. I&#39;m happy to announce that the public portion of this is now completed. Below you will find various onion service hostnames and their match to our infrastructure.</p>
</blockquote>

<ul>
<li>hardenedbsd.org: lkiw4tmbudbr43hbyhm636sarn73vuow77czzohdbqdpjuq3vdzvenyd.onion</li>
<li>ci-01.nyi.hardenedbsd.org: qspcqclhifj3tcpojsbwoxgwanlo2wakti2ia4wozxjcldkxmw2yj3yd.onion</li>
<li>ci-03.md.hardenedbsd.org: eqvnohly4tjrkpwatdhgptftabpesofirnhz5kq7jzn4zd6ernpvnpqd.onion</li>
<li>ci-04.md.hardenedbsd.org: rfqabq2w65nhdkukeqwf27r7h5xfh53h3uns6n74feeyl7s5fbjxczqd.onion</li>
<li>git-01.md.hardenedbsd.org: dacxzjk3kq5mmepbdd3ai2ifynlzxsnpl2cnkfhridqfywihrfftapid.onion</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://missing.csail.mit.edu/" rel="nofollow">The Missing Semester of Your CS Education (MIT Course)</a></li>
<li><a href="https://i.redd.it/503390rf7md41.png" rel="nofollow">An old Unix Ad</a></li>
<li><a href="https://marc.info/?l=openbsd-tech&m=157488907117170&w=2" rel="nofollow">OpenBSD syscall call-from verification</a></li>
<li><a href="https://twitter.com/bluerise/status/1220963106563579909" rel="nofollow">OpenBSD/arm64 on Pinebook</a></li>
<li><a href="http://studybsd.com/" rel="nofollow">Reminder: First Southern Ontario BSD user group meeting, February 11th (this coming Tuesday!) 18:30 at Boston Pizza on Upper James st, Hamilton.</a></li>
<li><a href="https://www.nycbug.org/" rel="nofollow">NYCBUG: March meeting will feature Dr. Paul Vixie and his new talk “Operating Systems as Dumb Pipes”</a></li>
<li><a href="https://www.meetup.com/de-DE/BSD-Users-Stockholm/events/267873938/" rel="nofollow">8th Meetup of the Stockholm BUG: March 3 at 18:00</a></li>
<li><a href="https://bsd-pl.org/en" rel="nofollow">Polish BSD User Group meets on Feb 11, 2020 at 18:15</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Sean - <a href="http://dpaste.com/3W5WBV0#wrap" rel="nofollow">ZFS and Creation Dates</a></li>
<li>Christopher - <a href="http://dpaste.com/3SE43PW" rel="nofollow">Help on ZFS Disaster Recovery</a></li>
<li>Mike - <a href="http://dpaste.com/00J5JZG#wrap" rel="nofollow">Encrypted ZFS Send</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0336.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>335: FreeBSD Down Under</title>
  <link>https://www.bsdnow.tv/335</link>
  <guid isPermaLink="false">12678787-276e-4471-a8a3-115404afed57</guid>
  <pubDate>Thu, 30 Jan 2020 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/12678787-276e-4471-a8a3-115404afed57.mp3" length="38818086" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Hyperbola Developer interview, why you should migrate from Linux to BSD, FreeBSD is an amazing OS, improving the ptrace(2) API in LLVM 10, First FreeBSD conference in Australia, and a guide to containers on FreeNAS.</itunes:subtitle>
  <itunes:duration>53:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Hyperbola Developer interview, why you should migrate from Linux to BSD, FreeBSD is an amazing OS, improving the ptrace(2) API in LLVM 10, First FreeBSD conference in Australia, and a guide to containers on FreeNAS.
Headlines
FreeBSD is an amazing operating System (https://www.unixsheikh.com/articles/freebsd-is-an-amazing-operating-system.html)
Update 2020-01-21: Since I wrote this article it got posted on Hacker News, Reddit and Lobster, and a few people have emailed me with comments. I have updated the article with comments where I have found it needed. As an important side note I would like to point out that I am not a FreeBSD developer, there may be things going on in the FreeBSD world that I know absolutely nothing about. I am also not glued to the FreeBSD developer mailing lists. I am not a FreeBSD "fanboy". I have been using GNU/Linux a ton more for the past two decades than FreeBSD, mainly due to hardware incompatibility (lacking or buggy drivers), and I love both Debian GNU/Linux and Arch Linux just as much as FreeBSD. However, I am concerned about the development of GNU/Linux as of late. Also this article is not about me trying to make anyone switch from something else to FreeBSD. It's about why I like FreeBSD and that I recommend you try it out if you're into messing with operating systems.
I think the year was late 1999 or mid 2000 when I one day was browsing computer books at my favorite bookshop and I discovered the book The Complete FreeBSD third edition from 1999 by Greg Lehey. With the book came 4 CD Roms with FreeBSD 3.3.
I had already familiarized myself with GNU/Linux in 1998, and I was in the process of migrating every server and desktop operating system away from Microsoft Windows, both at home and at my company, to GNU/Linux, initially Red Hat Linux and then later Debian GNU/Linux, which eventually became my favorite GNU/Linux distribution for many years.
When I first saw The Complete FreeBSD book by Greg Lehey I remember noticing the text on the front page that said, "The Free Version of Berkeley UNIX" and "Rock Solid Stability", and I was immediately intrigued! What was that all about? A free UNIX operating system! And rock solid stability? That sounded amazing.
Hyperbola Dev Interview (https://itsfoss.com/hyperbola-linux-bsd/)
In late December 2019, Hyperbola announced that they would be making major changes to their project. They have decided to drop the Linux kernel in favor of forking the OpenBSD kernel. This announcement only came months after Project Trident announced that they were going in the opposite direction (from BSD to Linux).
Hyperbola also plans to replace all software that is not GPL v3 compliant with new versions that are.
To get more insight into the future of their new project, I interviewed Andre, co-founder of Hyperbola.
News Roundup
Improving the ptrace(2) API and preparing for LLVM-10.0 (https://blog.netbsd.org/tnf/entry/improving_the_ptrace_2_api)
This month I have improved the NetBSD ptrace(2) API, removing one legacy interface with a few flaws and replacing it with two new calls with new features, and removing technical debt.
As LLVM 10.0 is branching now soon (Jan 15th 2020), I worked on proper support of the LLVM features for NetBSD 9.0 (today RC1) and NetBSD HEAD (future 10.0).
The first FreeBSD conference in Australia (https://rubenerd.com/the-first-freebsd-conference-in-australia/)
FreeBSD has existed as an operating system, project, and foundation for more than twenty years, and its earlier incantations have exited for far longer. The old guard have been developing code, porting software, and writing documentation for longer than I’ve existed. I’ve been using it for more than a decade for personal projects, and professionally for half that time.
While there are many prominent Australian FreeBSD contributors, sysadmins, and users, we’ve always had to venture overseas for conferences. We’re always told Australians are among the most ardent travellers, but I always wondered if we could do a domestic event as well.
And on Tuesday, we did! Deb Goodkin and the FreeBSD Foundation graciously organised and chaired a dedicated FreeBSD miniconf at the long-running linux.conf.au event held each year in a different city in Australia and New Zealand.
A practical guide to containers on FreeNAS for a depraved psychopath (https://medium.com/@andoriyu/a-practical-guide-to-containers-on-freenas-for-a-depraved-psychopath-c212203c0394)
This is a simple write-up to setup Docker on FreeNAS 11 or FreeBSD 11.
But muh jails?
You know that jails are dope and you know that jails are dope, yet no one else knows it. So here we are stuck with docker. Two years ago I would be the last person to recommend using docker, but a whole lot of things has changes past years… 
So jails are dead then?
No, jails are still dope, but jails lack tools to manage them. Yes, there are a few tools, but they meant for hard-core FreeBSD users who used to suffering. Docker allows you to run applications without deep knowledge of application you’re running. It will also allow you to run applications that are not ported to FreeBSD.
Why you should migrate everything from Linux to BSD (https://www.unixsheikh.com/articles/why-you-should-migrate-everything-from-linux-to-bsd.html)
As an operating system GNU/Linux has become a real mess because of the fragmented nature of the project, the bloatware in the kernel, and because of the jerking around by commercial interests.
Response Should you migrate from Linux to BSD? It depends. (https://fediverse.blog/~/AllGoodThings/should-you-migrate-from-linux-to-bsd-it-depends)
Beastie Bits
Using the OpenBSD ports tree with dedicated users (https://dataswamp.org/~solene/2020-01-11-privsep.html)
broot on FreeBSD (https://vermaden.wordpress.com/2020/01/10/run-broot-on-freebsd/)
A Trip down Memory Lane (https://svnweb.freebsd.org/base/head/share/misc/bsd-family-tree?view=co)
Running syslog-ng in BastilleBSD (https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-in-bastillebsd)
NASA : Using Software Packages in pkgsrc (https://www.nas.nasa.gov/hecc/support/kb/using-software-packages-in-pkgsrc_493.html)
Feedback/Questions
All of our questions this week were pretty technical in nature so I'm going to save those for the next episode so Allan can weigh in on them, since if we cover them now we're basically going to be deferring to Allan anyway.
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, hyperbola, migrate, migration, ptrace, llvm, conference, australia, containers, freenas</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Hyperbola Developer interview, why you should migrate from Linux to BSD, FreeBSD is an amazing OS, improving the ptrace(2) API in LLVM 10, First FreeBSD conference in Australia, and a guide to containers on FreeNAS.</p>

<h2>Headlines</h2>

<h3><a href="https://www.unixsheikh.com/articles/freebsd-is-an-amazing-operating-system.html" rel="nofollow">FreeBSD is an amazing operating System</a></h3>

<blockquote>
<p>Update 2020-01-21: Since I wrote this article it got posted on Hacker News, Reddit and Lobster, and a few people have emailed me with comments. I have updated the article with comments where I have found it needed. As an important side note I would like to point out that I am not a FreeBSD developer, there may be things going on in the FreeBSD world that I know absolutely nothing about. I am also not glued to the FreeBSD developer mailing lists. I am not a FreeBSD &quot;fanboy&quot;. I have been using GNU/Linux a ton more for the past two decades than FreeBSD, mainly due to hardware incompatibility (lacking or buggy drivers), and I love both Debian GNU/Linux and Arch Linux just as much as FreeBSD. However, I am concerned about the development of GNU/Linux as of late. Also this article is not about me trying to make anyone switch from something else to FreeBSD. It&#39;s about why I like FreeBSD and that I recommend you try it out if you&#39;re into messing with operating systems.</p>

<p>I think the year was late 1999 or mid 2000 when I one day was browsing computer books at my favorite bookshop and I discovered the book The Complete FreeBSD third edition from 1999 by Greg Lehey. With the book came 4 CD Roms with FreeBSD 3.3.</p>

<p>I had already familiarized myself with GNU/Linux in 1998, and I was in the process of migrating every server and desktop operating system away from Microsoft Windows, both at home and at my company, to GNU/Linux, initially Red Hat Linux and then later Debian GNU/Linux, which eventually became my favorite GNU/Linux distribution for many years.</p>

<p>When I first saw The Complete FreeBSD book by Greg Lehey I remember noticing the text on the front page that said, &quot;The Free Version of Berkeley UNIX&quot; and &quot;Rock Solid Stability&quot;, and I was immediately intrigued! What was that all about? A free UNIX operating system! And rock solid stability? That sounded amazing.</p>
</blockquote>

<hr>

<h3><a href="https://itsfoss.com/hyperbola-linux-bsd/" rel="nofollow">Hyperbola Dev Interview</a></h3>

<blockquote>
<p>In late December 2019, Hyperbola announced that they would be making major changes to their project. They have decided to drop the Linux kernel in favor of forking the OpenBSD kernel. This announcement only came months after Project Trident announced that they were going in the opposite direction (from BSD to Linux).</p>

<p>Hyperbola also plans to replace all software that is not GPL v3 compliant with new versions that are.</p>

<p>To get more insight into the future of their new project, I interviewed Andre, co-founder of Hyperbola.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/improving_the_ptrace_2_api" rel="nofollow">Improving the ptrace(2) API and preparing for LLVM-10.0</a></h3>

<blockquote>
<p>This month I have improved the NetBSD ptrace(2) API, removing one legacy interface with a few flaws and replacing it with two new calls with new features, and removing technical debt.</p>

<p>As LLVM 10.0 is branching now soon (Jan 15th 2020), I worked on proper support of the LLVM features for NetBSD 9.0 (today RC1) and NetBSD HEAD (future 10.0).</p>
</blockquote>

<hr>

<h3><a href="https://rubenerd.com/the-first-freebsd-conference-in-australia/" rel="nofollow">The first FreeBSD conference in Australia</a></h3>

<blockquote>
<p>FreeBSD has existed as an operating system, project, and foundation for more than twenty years, and its earlier incantations have exited for far longer. The old guard have been developing code, porting software, and writing documentation for longer than I’ve existed. I’ve been using it for more than a decade for personal projects, and professionally for half that time.</p>

<p>While there are many prominent Australian FreeBSD contributors, sysadmins, and users, we’ve always had to venture overseas for conferences. We’re always told Australians are among the most ardent travellers, but I always wondered if we could do a domestic event as well.</p>

<p>And on Tuesday, we did! Deb Goodkin and the FreeBSD Foundation graciously organised and chaired a dedicated FreeBSD miniconf at the long-running linux.conf.au event held each year in a different city in Australia and New Zealand.</p>
</blockquote>

<hr>

<h3><a href="https://medium.com/@andoriyu/a-practical-guide-to-containers-on-freenas-for-a-depraved-psychopath-c212203c0394" rel="nofollow">A practical guide to containers on FreeNAS for a depraved psychopath</a></h3>

<blockquote>
<p>This is a simple write-up to setup Docker on FreeNAS 11 or FreeBSD 11.</p>
</blockquote>

<p>But muh jails?</p>

<blockquote>
<p>You know that jails are dope and you know that jails are dope, yet no one else knows it. So here we are stuck with docker. Two years ago I would be the last person to recommend using docker, but a whole lot of things has changes past years… </p>
</blockquote>

<p>So jails are dead then?</p>

<blockquote>
<p>No, jails are still dope, but jails lack tools to manage them. Yes, there are a few tools, but they meant for hard-core FreeBSD users who used to suffering. Docker allows you to run applications without deep knowledge of application you’re running. It will also allow you to run applications that are not ported to FreeBSD.</p>
</blockquote>

<hr>

<h3><a href="https://www.unixsheikh.com/articles/why-you-should-migrate-everything-from-linux-to-bsd.html" rel="nofollow">Why you should migrate everything from Linux to BSD</a></h3>

<blockquote>
<p>As an operating system GNU/Linux has become a real mess because of the fragmented nature of the project, the bloatware in the kernel, and because of the jerking around by commercial interests.</p>
</blockquote>

<ul>
<li>Response <a href="https://fediverse.blog/%7E/AllGoodThings/should-you-migrate-from-linux-to-bsd-it-depends" rel="nofollow">Should you migrate from Linux to BSD? It depends.</a></li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://dataswamp.org/%7Esolene/2020-01-11-privsep.html" rel="nofollow">Using the OpenBSD ports tree with dedicated users</a></li>
<li><a href="https://vermaden.wordpress.com/2020/01/10/run-broot-on-freebsd/" rel="nofollow">broot on FreeBSD</a></li>
<li><a href="https://svnweb.freebsd.org/base/head/share/misc/bsd-family-tree?view=co" rel="nofollow">A Trip down Memory Lane</a></li>
<li><a href="https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-in-bastillebsd" rel="nofollow">Running syslog-ng in BastilleBSD</a></li>
<li><a href="https://www.nas.nasa.gov/hecc/support/kb/using-software-packages-in-pkgsrc_493.html" rel="nofollow">NASA : Using Software Packages in pkgsrc</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>All of our questions this week were pretty technical in nature so I&#39;m going to save those for the next episode so Allan can weigh in on them, since if we cover them now we&#39;re basically going to be deferring to Allan anyway.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0335.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Hyperbola Developer interview, why you should migrate from Linux to BSD, FreeBSD is an amazing OS, improving the ptrace(2) API in LLVM 10, First FreeBSD conference in Australia, and a guide to containers on FreeNAS.</p>

<h2>Headlines</h2>

<h3><a href="https://www.unixsheikh.com/articles/freebsd-is-an-amazing-operating-system.html" rel="nofollow">FreeBSD is an amazing operating System</a></h3>

<blockquote>
<p>Update 2020-01-21: Since I wrote this article it got posted on Hacker News, Reddit and Lobster, and a few people have emailed me with comments. I have updated the article with comments where I have found it needed. As an important side note I would like to point out that I am not a FreeBSD developer, there may be things going on in the FreeBSD world that I know absolutely nothing about. I am also not glued to the FreeBSD developer mailing lists. I am not a FreeBSD &quot;fanboy&quot;. I have been using GNU/Linux a ton more for the past two decades than FreeBSD, mainly due to hardware incompatibility (lacking or buggy drivers), and I love both Debian GNU/Linux and Arch Linux just as much as FreeBSD. However, I am concerned about the development of GNU/Linux as of late. Also this article is not about me trying to make anyone switch from something else to FreeBSD. It&#39;s about why I like FreeBSD and that I recommend you try it out if you&#39;re into messing with operating systems.</p>

<p>I think the year was late 1999 or mid 2000 when I one day was browsing computer books at my favorite bookshop and I discovered the book The Complete FreeBSD third edition from 1999 by Greg Lehey. With the book came 4 CD Roms with FreeBSD 3.3.</p>

<p>I had already familiarized myself with GNU/Linux in 1998, and I was in the process of migrating every server and desktop operating system away from Microsoft Windows, both at home and at my company, to GNU/Linux, initially Red Hat Linux and then later Debian GNU/Linux, which eventually became my favorite GNU/Linux distribution for many years.</p>

<p>When I first saw The Complete FreeBSD book by Greg Lehey I remember noticing the text on the front page that said, &quot;The Free Version of Berkeley UNIX&quot; and &quot;Rock Solid Stability&quot;, and I was immediately intrigued! What was that all about? A free UNIX operating system! And rock solid stability? That sounded amazing.</p>
</blockquote>

<hr>

<h3><a href="https://itsfoss.com/hyperbola-linux-bsd/" rel="nofollow">Hyperbola Dev Interview</a></h3>

<blockquote>
<p>In late December 2019, Hyperbola announced that they would be making major changes to their project. They have decided to drop the Linux kernel in favor of forking the OpenBSD kernel. This announcement only came months after Project Trident announced that they were going in the opposite direction (from BSD to Linux).</p>

<p>Hyperbola also plans to replace all software that is not GPL v3 compliant with new versions that are.</p>

<p>To get more insight into the future of their new project, I interviewed Andre, co-founder of Hyperbola.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/improving_the_ptrace_2_api" rel="nofollow">Improving the ptrace(2) API and preparing for LLVM-10.0</a></h3>

<blockquote>
<p>This month I have improved the NetBSD ptrace(2) API, removing one legacy interface with a few flaws and replacing it with two new calls with new features, and removing technical debt.</p>

<p>As LLVM 10.0 is branching now soon (Jan 15th 2020), I worked on proper support of the LLVM features for NetBSD 9.0 (today RC1) and NetBSD HEAD (future 10.0).</p>
</blockquote>

<hr>

<h3><a href="https://rubenerd.com/the-first-freebsd-conference-in-australia/" rel="nofollow">The first FreeBSD conference in Australia</a></h3>

<blockquote>
<p>FreeBSD has existed as an operating system, project, and foundation for more than twenty years, and its earlier incantations have exited for far longer. The old guard have been developing code, porting software, and writing documentation for longer than I’ve existed. I’ve been using it for more than a decade for personal projects, and professionally for half that time.</p>

<p>While there are many prominent Australian FreeBSD contributors, sysadmins, and users, we’ve always had to venture overseas for conferences. We’re always told Australians are among the most ardent travellers, but I always wondered if we could do a domestic event as well.</p>

<p>And on Tuesday, we did! Deb Goodkin and the FreeBSD Foundation graciously organised and chaired a dedicated FreeBSD miniconf at the long-running linux.conf.au event held each year in a different city in Australia and New Zealand.</p>
</blockquote>

<hr>

<h3><a href="https://medium.com/@andoriyu/a-practical-guide-to-containers-on-freenas-for-a-depraved-psychopath-c212203c0394" rel="nofollow">A practical guide to containers on FreeNAS for a depraved psychopath</a></h3>

<blockquote>
<p>This is a simple write-up to setup Docker on FreeNAS 11 or FreeBSD 11.</p>
</blockquote>

<p>But muh jails?</p>

<blockquote>
<p>You know that jails are dope and you know that jails are dope, yet no one else knows it. So here we are stuck with docker. Two years ago I would be the last person to recommend using docker, but a whole lot of things has changes past years… </p>
</blockquote>

<p>So jails are dead then?</p>

<blockquote>
<p>No, jails are still dope, but jails lack tools to manage them. Yes, there are a few tools, but they meant for hard-core FreeBSD users who used to suffering. Docker allows you to run applications without deep knowledge of application you’re running. It will also allow you to run applications that are not ported to FreeBSD.</p>
</blockquote>

<hr>

<h3><a href="https://www.unixsheikh.com/articles/why-you-should-migrate-everything-from-linux-to-bsd.html" rel="nofollow">Why you should migrate everything from Linux to BSD</a></h3>

<blockquote>
<p>As an operating system GNU/Linux has become a real mess because of the fragmented nature of the project, the bloatware in the kernel, and because of the jerking around by commercial interests.</p>
</blockquote>

<ul>
<li>Response <a href="https://fediverse.blog/%7E/AllGoodThings/should-you-migrate-from-linux-to-bsd-it-depends" rel="nofollow">Should you migrate from Linux to BSD? It depends.</a></li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://dataswamp.org/%7Esolene/2020-01-11-privsep.html" rel="nofollow">Using the OpenBSD ports tree with dedicated users</a></li>
<li><a href="https://vermaden.wordpress.com/2020/01/10/run-broot-on-freebsd/" rel="nofollow">broot on FreeBSD</a></li>
<li><a href="https://svnweb.freebsd.org/base/head/share/misc/bsd-family-tree?view=co" rel="nofollow">A Trip down Memory Lane</a></li>
<li><a href="https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-in-bastillebsd" rel="nofollow">Running syslog-ng in BastilleBSD</a></li>
<li><a href="https://www.nas.nasa.gov/hecc/support/kb/using-software-packages-in-pkgsrc_493.html" rel="nofollow">NASA : Using Software Packages in pkgsrc</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>All of our questions this week were pretty technical in nature so I&#39;m going to save those for the next episode so Allan can weigh in on them, since if we cover them now we&#39;re basically going to be deferring to Allan anyway.</li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0335.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>334: Distrowatch Running FreeBSD</title>
  <link>https://www.bsdnow.tv/334</link>
  <guid isPermaLink="false">695d1b03-3bc3-485f-90ba-c6d905189b36</guid>
  <pubDate>Thu, 23 Jan 2020 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/695d1b03-3bc3-485f-90ba-c6d905189b36.mp3" length="34652078" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Upgrading FreeBSD from 11.3 to 12.1, Distrowatch switching to FreeBSD, Torvalds says don’t run ZFS, iked(8) removed automatic IPv6 blocking, working towards LLDB on i386, and memory-hard Argon2 hashing scheme in NetBSD.</itunes:subtitle>
  <itunes:duration>48:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Upgrading FreeBSD from 11.3 to 12.1, Distrowatch switching to FreeBSD, Torvalds says don’t run ZFS, iked(8) removed automatic IPv6 blocking, working towards LLDB on i386, and memory-hard Argon2 hashing scheme in NetBSD.
Headlines
Upgrading FreeBSD from 11.3 to 12.1 (https://blog.bimajority.org/2020/01/13/upgrading-freebsd-from-11-3-to-12-1/)
Now here’s something more like what I was originally expecting the content on this blog to look like. I’m in the process of moving all of our FreeBSD servers (about 30 in total) from 11.3 to 12.1. We have our own local build of the OS, and until “packaged base” gets to a state where it’s reliably usable, we’re stuck doing upgrades the old-fashioned way. I created a set of notes for myself while cranking through these upgrades and I wanted to share them since they are not really work-specific and this process isn’t very well documented for people who haven’t been doing this sort of upgrade process for 25 years.
Our source and object trees are read-only exported from the build server over NFS, which causes things to be slow. /etc/make.conf and /etc/src.conf are symbolic links on all of our servers to the master copies in /usr/src so that make installworld can find the configuration parameters the system was built with.
Switching Distrowatch over to BSD (https://www.reddit.com/r/freebsd/comments/eodhit/switching_distrowatch_over_to_freebsd_ama/)
This may be a little off-topic for this board (forgive me if it is, please). However, I wanted to say that I'm one of the people who works on DistroWatch (distrowatch.com) and this past week we had to deal with a server facing hardware failure. We had a discussion about whether to continue running Debian or switch to something else.
The primary "something else" option turned out to be FreeBSD and it is what we eventually went with. It took a while to convert everything over from working with Debian GNU/Linux to FreeBSD 12 (some script incompatibilities, different paths, some changes to web server configuration, networking IPv6 troubles). But in the end we ended up with a good, FreeBSD-based experience.
Since the transition was successful, though certainly not seamless, I thought people might want to do a Q&amp;amp;A on the migration process. Especially for those thinking of making the same switch.
News Roundup
iked(8) automatic IPv6 blocking removed (https://www.openbsd.org/faq/current.html#r20200114)
iked(8) no longer automatically blocks unencrypted outbound IPv6 packets. This feature was intended to avoid accidental leakage, but in practice was found to mostly be a cause of misconfiguration.
If you previously used iked(8)'s -6 flag to disable this feature, it is no longer needed and should be removed from /etc/rc.conf.local if used.
Linus says dont run ZFS (https://itsfoss.com/linus-torvalds-zfs/)
“Don’t use ZFS. It’s that simple. It was always more of a buzzword than anything else, I feel, and the licensing issues just make it a non-starter for me.”
This is what Linus Torvalds said in a mailing list to once again express his disliking for ZFS filesystem specially over its licensing.
To avoid unnecessary confusion, this is more intended for Linux distributions, kernel developers and maintainers rather than individual Linux users.
GSoC 2019 Final Report: Incorporating the memory-hard Argon2 hashing scheme into NetBSD (https://blog.netbsd.org/tnf/entry/gsoc_2019_final_report_incorporating)
We successfully incorporated the Argon2 reference implementation into NetBSD/amd64 for our 2019 Google Summer of Coding project. We introduced our project here and provided some hints on how to select parameters here. For our final report, we will provide an overview of what changes were made to complete the project.
The Argon2 reference implementation, available here, is available under both the Creative Commons CC0 1.0 and the Apache Public License 2.0. To import the reference implementation into src/external, we chose to use the Apache 2.0 license for this project.
Working towards LLDB on i386 NetBSD (https://blog.netbsd.org/tnf/entry/working_towards_lldb_on_i386)
Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.
In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.
Throughout December I've continued working on our build bot maintenance, in particular enabling compiler-rt tests. I've revived and finished my old patch for extended register state (XState) in core dumps. I've started working on bringing proper i386 support to LLDB.
Beastie Bits
An open source Civilization V (https://github.com/yairm210/UnCiv)
BSD Groups in Italy (https://bsdnotizie.blogspot.com/2020/01/gruppi-bsd-in-italia.html)
Why is Wednesday, November 17, 1858 the base time for OpenVMS? (https://www.slac.stanford.edu/~rkj/crazytime.txt)
Benchmarking shell pipelines and the Unix “tools” philosophy (https://blog.plover.com/Unix/tools.html)
LPI and BSD working together (https://youtu.be/QItb5aoj7Oc)
Feedback/Questions
Pat - March Meeting (http://dpaste.com/2BMGZVV#wrap)
Madhukar - Overheating Laptop (http://dpaste.com/17WNVM8#wrap)
Warren - R vs S (http://dpaste.com/3AZYFB1#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, upgrading, distrowatch, zfs, iked, blocking, lldb, i386, memory, memory-hard, argon2, hashing scheme</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Upgrading FreeBSD from 11.3 to 12.1, Distrowatch switching to FreeBSD, Torvalds says don’t run ZFS, iked(8) removed automatic IPv6 blocking, working towards LLDB on i386, and memory-hard Argon2 hashing scheme in NetBSD.</p>

<h2>Headlines</h2>

<h3><a href="https://blog.bimajority.org/2020/01/13/upgrading-freebsd-from-11-3-to-12-1/" rel="nofollow">Upgrading FreeBSD from 11.3 to 12.1</a></h3>

<blockquote>
<p>Now here’s something more like what I was originally expecting the content on this blog to look like. I’m in the process of moving all of our FreeBSD servers (about 30 in total) from 11.3 to 12.1. We have our own local build of the OS, and until “packaged base” gets to a state where it’s reliably usable, we’re stuck doing upgrades the old-fashioned way. I created a set of notes for myself while cranking through these upgrades and I wanted to share them since they are not really work-specific and this process isn’t very well documented for people who haven’t been doing this sort of upgrade process for 25 years.</p>

<p>Our source and object trees are read-only exported from the build server over NFS, which causes things to be slow. /etc/make.conf and /etc/src.conf are symbolic links on all of our servers to the master copies in /usr/src so that make installworld can find the configuration parameters the system was built with.</p>
</blockquote>

<hr>

<h3><a href="https://www.reddit.com/r/freebsd/comments/eodhit/switching_distrowatch_over_to_freebsd_ama/" rel="nofollow">Switching Distrowatch over to BSD</a></h3>

<blockquote>
<p>This may be a little off-topic for this board (forgive me if it is, please). However, I wanted to say that I&#39;m one of the people who works on DistroWatch (distrowatch.com) and this past week we had to deal with a server facing hardware failure. We had a discussion about whether to continue running Debian or switch to something else.</p>

<p>The primary &quot;something else&quot; option turned out to be FreeBSD and it is what we eventually went with. It took a while to convert everything over from working with Debian GNU/Linux to FreeBSD 12 (some script incompatibilities, different paths, some changes to web server configuration, networking IPv6 troubles). But in the end we ended up with a good, FreeBSD-based experience.</p>

<p>Since the transition was successful, though certainly not seamless, I thought people might want to do a Q&amp;A on the migration process. Especially for those thinking of making the same switch.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.openbsd.org/faq/current.html#r20200114" rel="nofollow">iked(8) automatic IPv6 blocking removed</a></h3>

<blockquote>
<p>iked(8) no longer automatically blocks unencrypted outbound IPv6 packets. This feature was intended to avoid accidental leakage, but in practice was found to mostly be a cause of misconfiguration.</p>

<p>If you previously used iked(8)&#39;s -6 flag to disable this feature, it is no longer needed and should be removed from /etc/rc.conf.local if used.</p>
</blockquote>

<hr>

<h3><a href="https://itsfoss.com/linus-torvalds-zfs/" rel="nofollow">Linus says dont run ZFS</a></h3>

<blockquote>
<p>“Don’t use ZFS. It’s that simple. It was always more of a buzzword than anything else, I feel, and the licensing issues just make it a non-starter for me.”</p>

<p>This is what Linus Torvalds said in a mailing list to once again express his disliking for ZFS filesystem specially over its licensing.</p>

<p>To avoid unnecessary confusion, this is more intended for Linux distributions, kernel developers and maintainers rather than individual Linux users.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/gsoc_2019_final_report_incorporating" rel="nofollow">GSoC 2019 Final Report: Incorporating the memory-hard Argon2 hashing scheme into NetBSD</a></h3>

<blockquote>
<p>We successfully incorporated the Argon2 reference implementation into NetBSD/amd64 for our 2019 Google Summer of Coding project. We introduced our project here and provided some hints on how to select parameters here. For our final report, we will provide an overview of what changes were made to complete the project.</p>

<p>The Argon2 reference implementation, available here, is available under both the Creative Commons CC0 1.0 and the Apache Public License 2.0. To import the reference implementation into src/external, we chose to use the Apache 2.0 license for this project.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/working_towards_lldb_on_i386" rel="nofollow">Working towards LLDB on i386 NetBSD</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>

<p>In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.</p>

<p>Throughout December I&#39;ve continued working on our build bot maintenance, in particular enabling compiler-rt tests. I&#39;ve revived and finished my old patch for extended register state (XState) in core dumps. I&#39;ve started working on bringing proper i386 support to LLDB.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://github.com/yairm210/UnCiv" rel="nofollow">An open source Civilization V</a></li>
<li><a href="https://bsdnotizie.blogspot.com/2020/01/gruppi-bsd-in-italia.html" rel="nofollow">BSD Groups in Italy</a></li>
<li><a href="https://www.slac.stanford.edu/%7Erkj/crazytime.txt" rel="nofollow">Why is Wednesday, November 17, 1858 the base time for OpenVMS?</a></li>
<li><a href="https://blog.plover.com/Unix/tools.html" rel="nofollow">Benchmarking shell pipelines and the Unix “tools” philosophy</a></li>
<li><a href="https://youtu.be/QItb5aoj7Oc" rel="nofollow">LPI and BSD working together</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Pat - <a href="http://dpaste.com/2BMGZVV#wrap" rel="nofollow">March Meeting</a></li>
<li>Madhukar - <a href="http://dpaste.com/17WNVM8#wrap" rel="nofollow">Overheating Laptop</a></li>
<li>Warren - <a href="http://dpaste.com/3AZYFB1#wrap" rel="nofollow">R vs S</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0334.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Upgrading FreeBSD from 11.3 to 12.1, Distrowatch switching to FreeBSD, Torvalds says don’t run ZFS, iked(8) removed automatic IPv6 blocking, working towards LLDB on i386, and memory-hard Argon2 hashing scheme in NetBSD.</p>

<h2>Headlines</h2>

<h3><a href="https://blog.bimajority.org/2020/01/13/upgrading-freebsd-from-11-3-to-12-1/" rel="nofollow">Upgrading FreeBSD from 11.3 to 12.1</a></h3>

<blockquote>
<p>Now here’s something more like what I was originally expecting the content on this blog to look like. I’m in the process of moving all of our FreeBSD servers (about 30 in total) from 11.3 to 12.1. We have our own local build of the OS, and until “packaged base” gets to a state where it’s reliably usable, we’re stuck doing upgrades the old-fashioned way. I created a set of notes for myself while cranking through these upgrades and I wanted to share them since they are not really work-specific and this process isn’t very well documented for people who haven’t been doing this sort of upgrade process for 25 years.</p>

<p>Our source and object trees are read-only exported from the build server over NFS, which causes things to be slow. /etc/make.conf and /etc/src.conf are symbolic links on all of our servers to the master copies in /usr/src so that make installworld can find the configuration parameters the system was built with.</p>
</blockquote>

<hr>

<h3><a href="https://www.reddit.com/r/freebsd/comments/eodhit/switching_distrowatch_over_to_freebsd_ama/" rel="nofollow">Switching Distrowatch over to BSD</a></h3>

<blockquote>
<p>This may be a little off-topic for this board (forgive me if it is, please). However, I wanted to say that I&#39;m one of the people who works on DistroWatch (distrowatch.com) and this past week we had to deal with a server facing hardware failure. We had a discussion about whether to continue running Debian or switch to something else.</p>

<p>The primary &quot;something else&quot; option turned out to be FreeBSD and it is what we eventually went with. It took a while to convert everything over from working with Debian GNU/Linux to FreeBSD 12 (some script incompatibilities, different paths, some changes to web server configuration, networking IPv6 troubles). But in the end we ended up with a good, FreeBSD-based experience.</p>

<p>Since the transition was successful, though certainly not seamless, I thought people might want to do a Q&amp;A on the migration process. Especially for those thinking of making the same switch.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.openbsd.org/faq/current.html#r20200114" rel="nofollow">iked(8) automatic IPv6 blocking removed</a></h3>

<blockquote>
<p>iked(8) no longer automatically blocks unencrypted outbound IPv6 packets. This feature was intended to avoid accidental leakage, but in practice was found to mostly be a cause of misconfiguration.</p>

<p>If you previously used iked(8)&#39;s -6 flag to disable this feature, it is no longer needed and should be removed from /etc/rc.conf.local if used.</p>
</blockquote>

<hr>

<h3><a href="https://itsfoss.com/linus-torvalds-zfs/" rel="nofollow">Linus says dont run ZFS</a></h3>

<blockquote>
<p>“Don’t use ZFS. It’s that simple. It was always more of a buzzword than anything else, I feel, and the licensing issues just make it a non-starter for me.”</p>

<p>This is what Linus Torvalds said in a mailing list to once again express his disliking for ZFS filesystem specially over its licensing.</p>

<p>To avoid unnecessary confusion, this is more intended for Linux distributions, kernel developers and maintainers rather than individual Linux users.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/gsoc_2019_final_report_incorporating" rel="nofollow">GSoC 2019 Final Report: Incorporating the memory-hard Argon2 hashing scheme into NetBSD</a></h3>

<blockquote>
<p>We successfully incorporated the Argon2 reference implementation into NetBSD/amd64 for our 2019 Google Summer of Coding project. We introduced our project here and provided some hints on how to select parameters here. For our final report, we will provide an overview of what changes were made to complete the project.</p>

<p>The Argon2 reference implementation, available here, is available under both the Creative Commons CC0 1.0 and the Apache Public License 2.0. To import the reference implementation into src/external, we chose to use the Apache 2.0 license for this project.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/working_towards_lldb_on_i386" rel="nofollow">Working towards LLDB on i386 NetBSD</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>

<p>In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.</p>

<p>Throughout December I&#39;ve continued working on our build bot maintenance, in particular enabling compiler-rt tests. I&#39;ve revived and finished my old patch for extended register state (XState) in core dumps. I&#39;ve started working on bringing proper i386 support to LLDB.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://github.com/yairm210/UnCiv" rel="nofollow">An open source Civilization V</a></li>
<li><a href="https://bsdnotizie.blogspot.com/2020/01/gruppi-bsd-in-italia.html" rel="nofollow">BSD Groups in Italy</a></li>
<li><a href="https://www.slac.stanford.edu/%7Erkj/crazytime.txt" rel="nofollow">Why is Wednesday, November 17, 1858 the base time for OpenVMS?</a></li>
<li><a href="https://blog.plover.com/Unix/tools.html" rel="nofollow">Benchmarking shell pipelines and the Unix “tools” philosophy</a></li>
<li><a href="https://youtu.be/QItb5aoj7Oc" rel="nofollow">LPI and BSD working together</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Pat - <a href="http://dpaste.com/2BMGZVV#wrap" rel="nofollow">March Meeting</a></li>
<li>Madhukar - <a href="http://dpaste.com/17WNVM8#wrap" rel="nofollow">Overheating Laptop</a></li>
<li>Warren - <a href="http://dpaste.com/3AZYFB1#wrap" rel="nofollow">R vs S</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0334.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>333: Unix Keyboard Joy</title>
  <link>https://www.bsdnow.tv/333</link>
  <guid isPermaLink="false">9f3dffa3-f888-4af3-8a0a-3a236e130b4f</guid>
  <pubDate>Thu, 16 Jan 2020 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9f3dffa3-f888-4af3-8a0a-3a236e130b4f.mp3" length="29159154" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Your Impact on FreeBSD in 2019, Wireguard on OpenBSD Router, Amazon now has FreeBSD/ARM 12, pkgsrc-2019Q4, The Joys of UNIX Keyboards, OpenBSD on Digital Ocean, and more.</itunes:subtitle>
  <itunes:duration>40:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Your Impact on FreeBSD in 2019, Wireguard on OpenBSD Router, Amazon now has FreeBSD/ARM 12, pkgsrc-2019Q4, The Joys of UNIX Keyboards, OpenBSD on Digital Ocean, and more.
Headlines
Your Impact on FreeBSD in 2019 (https://www.freebsdfoundation.org/blog/your-impact-on-freebsd-in-2019/)
It’s hard to believe that 2019 is nearly over. It has been an amazing year for supporting the FreeBSD Project and community! Why do I say that? Because as I reflect over the past 12 months, I realize how many events we’ve attended all over the world, and how many lives we’ve touched in so many ways. From advocating for FreeBSD to implementing FreeBSD features, my team has been there to help make FreeBSD the best open source project and operating system out there.
In 2019, we focused on supporting a few key areas where the Project needed the most help. The first area was software development. Whether it was contracting FreeBSD developers to work on projects like wifi support, to providing internal staff to quickly implement hardware workarounds, we’ve stepped in to help keep FreeBSD innovative, secure, and reliable. Software development includes supporting the tools and infrastructure that make the development process go smoothly, and we’re on it with team members heading up the Continuous Integration efforts, and actively involved in the clusteradmin and security teams.
Our advocacy efforts focused on recruiting new users and contributors to the Project. We attended and participated in 38 conferences and events in 21 countries. From giving FreeBSD presentations and workshops to staffing tables, we were able to have 1:1 conversations with thousands of attendees.
Our travels also provided opportunities to talk directly with FreeBSD commercial and individual users, contributors, and future FreeBSD user/contributors. We’ve seen an increase in use and interest in FreeBSD from all of these organizations and individuals. These meetings give us a chance to learn more about what organizations need and what they and other individuals are working on. The information helps inform the work we should fund.
Wireguard on OpenBSD Router (https://obscurity.xyz/bsd/open/wireguard.html)
wireguard (wg) is a modern vpn protocol, using the latest class of encryption algorithms while at the same time promising speed and a small code base.
modern crypto and lean code are also tenants of openbsd, thus it was a no brainer to migrate my router from openvpn over to wireguard.
my setup : a collection of devices, both wired and wireless, that are nat’d through my router (openbsd 6.6) out via my vpn provider azire* and out to the internet using wg-quick to start wg.
running : doubtless this could be improved on, but currently i start wg manually when my router boots. this, and the nat'ing on the vpn interface mean its impossible for clients to connect to the internet without the vpn being up. as my router is on a ups and only reboots when a kernel patch requires it, it’s a compromise i can live with. run wg-quick (please replace vpn with whatever you named your wg .conf file.) and reload pf rules.
News Roundup
Amazon now has FreeBSD/ARM 12 (https://aws.amazon.com/marketplace/pp/B081NF7BY7)
AWS, the cloud division of Amazon, announced in December the next generation of its ARM processors, the Graviton2. This is a custom chip design with a 7nm architecture. It is based on 64-bit ARM Neoverse cores.
Compared to first-generation Graviton processors (A1), today’s new chips should deliver up to 7x the performance of A1 instances in some cases. Floating point performance is now twice as fast. There are additional memory channels and cache speed memory access should be much faster.
The company is working on three types of Graviton2 EC2 instances that should be available soon. Instances with a “g” suffix are powered by Graviton2 chips. If they have a “d” suffix, it also means that they have NVMe local storage.
General-purpose instances (M6g and M6gd)
Compute-optimized instances (C6g and C6gd)
Memory-optimized instances (R6g and R6gd)
You can choose instances with up to 64 vCPUs, 512 GiB of memory and 25 Gbps networking.
And you can see that ARM-powered servers are not just a fad. AWS already promises a 40% better price/performance ratio with ARM-based instances when you compare them with x86-based instances.
AWS has been working with operating system vendors and independent software vendors to help them release software that runs on ARM. ARM-based EC2 instances support Amazon Linux 2, Ubuntu, Red Hat, SUSE, Fedora, Debian and FreeBSD. It also works with multiple container services (Docker, Amazon ECS, and Amazon Elastic Kubernetes Service).
Coverage of AWS Announcement  (https://techcrunch.com/2019/12/03/aws-announces-new-arm-based-instances-with-graviton2-processors/)
Announcing the pkgsrc-2019Q4 release (https://mail-index.netbsd.org/pkgsrc-users/2020/01/06/msg030130.html)
The pkgsrc developers are proud to announce the 65th quarterly release of pkgsrc, the cross-platform packaging system.  pkgsrc is available with more than 20,000 packages, running on 23 separate platforms; more information on pkgsrc itself is available at https://www.pkgsrc.org/
In total, 190 packages were added, 96 packages were removed, and 1,868 package updates (to 1388 unique packages) were processed since the pkgsrc-2019Q3 release.  As usual, a large number of updates and additions were processed for packages for go (14), guile (11), perl (170), php (10), python (426), and ruby (110).  This continues pkgsrc's tradition of adding useful packages, updating many packages to more current versions, and pruning unmaintained packages that are believed to have essentially no users.
The Joys of UNIX Keyboards (https://donatstudios.com/UNIX-Keyboards)
I fell in love with a dead keyboard layout.
A decade or so ago while helping a friends father clean out an old building, we came across an ancient Sun Microsystems server. We found it curious. Everything about it was different from what we were used to. The command line was black on white, the connectors strange and foreign, and the keyboard layout was bizarre.
We never did much with it; turning it on made all the lights in his home dim, and our joint knowledge of UNIX was nonexistent. It sat in his bedroom for years supporting his television at the foot of his bed.
I never forgot that keyboard though. The thought that there was this alternative layout out there seemed intriguing to me.
OpenBSD on Digital Ocean (https://www.going-flying.com/blog/openbsd-on-digitalocean.html)
Last night I had a need to put together a new OpenBSD machine. Since I already use DigitalOcean for one of my public DNS servers I wanted to use them for this need but sadly like all too many of the cloud providers they don't support OpenBSD. Now they do support FreeBSD and I found a couple writeups that show how to use FreeBSD as a shim to install OpenBSD.
They are both sort of old at this point and with OpenBSD 6.6 out I ran into a bit of a snag. The default these days is to use a GPT partition table to enable EFI booting. This is generally pretty sane but it looks to me like the FreeBSD droplet doesn't support this. After the installer rebooted the VM failed to boot, being unable to find the bootloader.
Thankfully DigitalOcean has a recovery ISO that you can boot by simply switching to it and powering off and then on your Droplet.
Beastie Bits
FreeBSD defaults to LLVM on PPC (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=356111)
Theo De Raadt Interview between Ottawa 2019 Hackathon and BSDCAN 2019 (https://undeadly.org/cgi?action=article;sid=20191231214356)
Bastille Poll about what people would like to see in 2020 (https://twitter.com/BastilleBSD/status/1211475103143251968)
Notes on the classic book : The Design of the UNIX Operating System (https://github.com/suvratapte/Maurice-Bach-Notes)
Multics History (https://www.multicians.org/)
First meeting of the Hamilton BSD user group, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St (http://studybsd.com/)
Feedback/Questions
Bill - 1.1 CDROM (http://dpaste.com/2H9CW6R)
Greg - More 50 Year anniversary information (http://dpaste.com/2SGA3KY)
Dave - Question time for Allan (http://dpaste.com/3ZAEKHD#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, freebsd foundation, foundation, wireguard, amazon, ec2, arm, arm 12, pkgsrc, unix, keyboard, keyboards, digital ocean</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Your Impact on FreeBSD in 2019, Wireguard on OpenBSD Router, Amazon now has FreeBSD/ARM 12, pkgsrc-2019Q4, The Joys of UNIX Keyboards, OpenBSD on Digital Ocean, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/your-impact-on-freebsd-in-2019/" rel="nofollow">Your Impact on FreeBSD in 2019</a></h3>

<blockquote>
<p>It’s hard to believe that 2019 is nearly over. It has been an amazing year for supporting the FreeBSD Project and community! Why do I say that? Because as I reflect over the past 12 months, I realize how many events we’ve attended all over the world, and how many lives we’ve touched in so many ways. From advocating for FreeBSD to implementing FreeBSD features, my team has been there to help make FreeBSD the best open source project and operating system out there.</p>

<p>In 2019, we focused on supporting a few key areas where the Project needed the most help. The first area was software development. Whether it was contracting FreeBSD developers to work on projects like wifi support, to providing internal staff to quickly implement hardware workarounds, we’ve stepped in to help keep FreeBSD innovative, secure, and reliable. Software development includes supporting the tools and infrastructure that make the development process go smoothly, and we’re on it with team members heading up the Continuous Integration efforts, and actively involved in the clusteradmin and security teams.</p>

<p>Our advocacy efforts focused on recruiting new users and contributors to the Project. We attended and participated in 38 conferences and events in 21 countries. From giving FreeBSD presentations and workshops to staffing tables, we were able to have 1:1 conversations with thousands of attendees.</p>

<p>Our travels also provided opportunities to talk directly with FreeBSD commercial and individual users, contributors, and future FreeBSD user/contributors. We’ve seen an increase in use and interest in FreeBSD from all of these organizations and individuals. These meetings give us a chance to learn more about what organizations need and what they and other individuals are working on. The information helps inform the work we should fund.</p>
</blockquote>

<hr>

<h3><a href="https://obscurity.xyz/bsd/open/wireguard.html" rel="nofollow">Wireguard on OpenBSD Router</a></h3>

<blockquote>
<p>wireguard (wg) is a modern vpn protocol, using the latest class of encryption algorithms while at the same time promising speed and a small code base.</p>

<p>modern crypto and lean code are also tenants of openbsd, thus it was a no brainer to migrate my router from openvpn over to wireguard.</p>

<p>my setup : a collection of devices, both wired and wireless, that are nat’d through my router (openbsd 6.6) out via my vpn provider azire* and out to the internet using wg-quick to start wg.</p>

<p>running : doubtless this could be improved on, but currently i start wg manually when my router boots. this, and the nat&#39;ing on the vpn interface mean its impossible for clients to connect to the internet without the vpn being up. as my router is on a ups and only reboots when a kernel patch requires it, it’s a compromise i can live with. run wg-quick (please replace vpn with whatever you named your wg .conf file.) and reload pf rules.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://aws.amazon.com/marketplace/pp/B081NF7BY7" rel="nofollow">Amazon now has FreeBSD/ARM 12</a></h3>

<blockquote>
<p>AWS, the cloud division of Amazon, announced in December the next generation of its ARM processors, the Graviton2. This is a custom chip design with a 7nm architecture. It is based on 64-bit ARM Neoverse cores.</p>

<p>Compared to first-generation Graviton processors (A1), today’s new chips should deliver up to 7x the performance of A1 instances in some cases. Floating point performance is now twice as fast. There are additional memory channels and cache speed memory access should be much faster.</p>

<p>The company is working on three types of Graviton2 EC2 instances that should be available soon. Instances with a “g” suffix are powered by Graviton2 chips. If they have a “d” suffix, it also means that they have NVMe local storage.</p>

<ul>
<li><p>General-purpose instances (M6g and M6gd)</p></li>
<li><p>Compute-optimized instances (C6g and C6gd)</p></li>
<li><p>Memory-optimized instances (R6g and R6gd)</p></li>
</ul>

<p>You can choose instances with up to 64 vCPUs, 512 GiB of memory and 25 Gbps networking.</p>

<p>And you can see that ARM-powered servers are not just a fad. AWS already promises a 40% better price/performance ratio with ARM-based instances when you compare them with x86-based instances.</p>

<p>AWS has been working with operating system vendors and independent software vendors to help them release software that runs on ARM. ARM-based EC2 instances support Amazon Linux 2, Ubuntu, Red Hat, SUSE, Fedora, Debian and FreeBSD. It also works with multiple container services (Docker, Amazon ECS, and Amazon Elastic Kubernetes Service).</p>
</blockquote>

<ul>
<li><a href="https://techcrunch.com/2019/12/03/aws-announces-new-arm-based-instances-with-graviton2-processors/" rel="nofollow">Coverage of AWS Announcement </a></li>
</ul>

<hr>

<h3><a href="https://mail-index.netbsd.org/pkgsrc-users/2020/01/06/msg030130.html" rel="nofollow">Announcing the pkgsrc-2019Q4 release</a></h3>

<blockquote>
<p>The pkgsrc developers are proud to announce the 65th quarterly release of pkgsrc, the cross-platform packaging system.  pkgsrc is available with more than 20,000 packages, running on 23 separate platforms; more information on pkgsrc itself is available at <a href="https://www.pkgsrc.org/" rel="nofollow">https://www.pkgsrc.org/</a></p>

<p>In total, 190 packages were added, 96 packages were removed, and 1,868 package updates (to 1388 unique packages) were processed since the pkgsrc-2019Q3 release.  As usual, a large number of updates and additions were processed for packages for go (14), guile (11), perl (170), php (10), python (426), and ruby (110).  This continues pkgsrc&#39;s tradition of adding useful packages, updating many packages to more current versions, and pruning unmaintained packages that are believed to have essentially no users.</p>
</blockquote>

<hr>

<h3><a href="https://donatstudios.com/UNIX-Keyboards" rel="nofollow">The Joys of UNIX Keyboards</a></h3>

<blockquote>
<p>I fell in love with a dead keyboard layout.</p>

<p>A decade or so ago while helping a friends father clean out an old building, we came across an ancient Sun Microsystems server. We found it curious. Everything about it was different from what we were used to. The command line was black on white, the connectors strange and foreign, and the keyboard layout was bizarre.</p>

<p>We never did much with it; turning it on made all the lights in his home dim, and our joint knowledge of UNIX was nonexistent. It sat in his bedroom for years supporting his television at the foot of his bed.</p>

<p>I never forgot that keyboard though. The thought that there was this alternative layout out there seemed intriguing to me.</p>
</blockquote>

<hr>

<h3><a href="https://www.going-flying.com/blog/openbsd-on-digitalocean.html" rel="nofollow">OpenBSD on Digital Ocean</a></h3>

<blockquote>
<p>Last night I had a need to put together a new OpenBSD machine. Since I already use DigitalOcean for one of my public DNS servers I wanted to use them for this need but sadly like all too many of the cloud providers they don&#39;t support OpenBSD. Now they do support FreeBSD and I found a couple writeups that show how to use FreeBSD as a shim to install OpenBSD.</p>

<p>They are both sort of old at this point and with OpenBSD 6.6 out I ran into a bit of a snag. The default these days is to use a GPT partition table to enable EFI booting. This is generally pretty sane but it looks to me like the FreeBSD droplet doesn&#39;t support this. After the installer rebooted the VM failed to boot, being unable to find the bootloader.</p>

<p>Thankfully DigitalOcean has a recovery ISO that you can boot by simply switching to it and powering off and then on your Droplet.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=356111" rel="nofollow">FreeBSD defaults to LLVM on PPC</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20191231214356" rel="nofollow">Theo De Raadt Interview between Ottawa 2019 Hackathon and BSDCAN 2019</a></li>
<li><a href="https://twitter.com/BastilleBSD/status/1211475103143251968" rel="nofollow">Bastille Poll about what people would like to see in 2020</a></li>
<li><a href="https://github.com/suvratapte/Maurice-Bach-Notes" rel="nofollow">Notes on the classic book : The Design of the UNIX Operating System</a></li>
<li><a href="https://www.multicians.org/" rel="nofollow">Multics History</a></li>
<li><a href="http://studybsd.com/" rel="nofollow">First meeting of the Hamilton BSD user group, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Bill - <a href="http://dpaste.com/2H9CW6R" rel="nofollow">1.1 CDROM</a></li>
<li>Greg - <a href="http://dpaste.com/2SGA3KY" rel="nofollow">More 50 Year anniversary information</a></li>
<li>Dave - <a href="http://dpaste.com/3ZAEKHD#wrap" rel="nofollow">Question time for Allan</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0333.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Your Impact on FreeBSD in 2019, Wireguard on OpenBSD Router, Amazon now has FreeBSD/ARM 12, pkgsrc-2019Q4, The Joys of UNIX Keyboards, OpenBSD on Digital Ocean, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/your-impact-on-freebsd-in-2019/" rel="nofollow">Your Impact on FreeBSD in 2019</a></h3>

<blockquote>
<p>It’s hard to believe that 2019 is nearly over. It has been an amazing year for supporting the FreeBSD Project and community! Why do I say that? Because as I reflect over the past 12 months, I realize how many events we’ve attended all over the world, and how many lives we’ve touched in so many ways. From advocating for FreeBSD to implementing FreeBSD features, my team has been there to help make FreeBSD the best open source project and operating system out there.</p>

<p>In 2019, we focused on supporting a few key areas where the Project needed the most help. The first area was software development. Whether it was contracting FreeBSD developers to work on projects like wifi support, to providing internal staff to quickly implement hardware workarounds, we’ve stepped in to help keep FreeBSD innovative, secure, and reliable. Software development includes supporting the tools and infrastructure that make the development process go smoothly, and we’re on it with team members heading up the Continuous Integration efforts, and actively involved in the clusteradmin and security teams.</p>

<p>Our advocacy efforts focused on recruiting new users and contributors to the Project. We attended and participated in 38 conferences and events in 21 countries. From giving FreeBSD presentations and workshops to staffing tables, we were able to have 1:1 conversations with thousands of attendees.</p>

<p>Our travels also provided opportunities to talk directly with FreeBSD commercial and individual users, contributors, and future FreeBSD user/contributors. We’ve seen an increase in use and interest in FreeBSD from all of these organizations and individuals. These meetings give us a chance to learn more about what organizations need and what they and other individuals are working on. The information helps inform the work we should fund.</p>
</blockquote>

<hr>

<h3><a href="https://obscurity.xyz/bsd/open/wireguard.html" rel="nofollow">Wireguard on OpenBSD Router</a></h3>

<blockquote>
<p>wireguard (wg) is a modern vpn protocol, using the latest class of encryption algorithms while at the same time promising speed and a small code base.</p>

<p>modern crypto and lean code are also tenants of openbsd, thus it was a no brainer to migrate my router from openvpn over to wireguard.</p>

<p>my setup : a collection of devices, both wired and wireless, that are nat’d through my router (openbsd 6.6) out via my vpn provider azire* and out to the internet using wg-quick to start wg.</p>

<p>running : doubtless this could be improved on, but currently i start wg manually when my router boots. this, and the nat&#39;ing on the vpn interface mean its impossible for clients to connect to the internet without the vpn being up. as my router is on a ups and only reboots when a kernel patch requires it, it’s a compromise i can live with. run wg-quick (please replace vpn with whatever you named your wg .conf file.) and reload pf rules.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://aws.amazon.com/marketplace/pp/B081NF7BY7" rel="nofollow">Amazon now has FreeBSD/ARM 12</a></h3>

<blockquote>
<p>AWS, the cloud division of Amazon, announced in December the next generation of its ARM processors, the Graviton2. This is a custom chip design with a 7nm architecture. It is based on 64-bit ARM Neoverse cores.</p>

<p>Compared to first-generation Graviton processors (A1), today’s new chips should deliver up to 7x the performance of A1 instances in some cases. Floating point performance is now twice as fast. There are additional memory channels and cache speed memory access should be much faster.</p>

<p>The company is working on three types of Graviton2 EC2 instances that should be available soon. Instances with a “g” suffix are powered by Graviton2 chips. If they have a “d” suffix, it also means that they have NVMe local storage.</p>

<ul>
<li><p>General-purpose instances (M6g and M6gd)</p></li>
<li><p>Compute-optimized instances (C6g and C6gd)</p></li>
<li><p>Memory-optimized instances (R6g and R6gd)</p></li>
</ul>

<p>You can choose instances with up to 64 vCPUs, 512 GiB of memory and 25 Gbps networking.</p>

<p>And you can see that ARM-powered servers are not just a fad. AWS already promises a 40% better price/performance ratio with ARM-based instances when you compare them with x86-based instances.</p>

<p>AWS has been working with operating system vendors and independent software vendors to help them release software that runs on ARM. ARM-based EC2 instances support Amazon Linux 2, Ubuntu, Red Hat, SUSE, Fedora, Debian and FreeBSD. It also works with multiple container services (Docker, Amazon ECS, and Amazon Elastic Kubernetes Service).</p>
</blockquote>

<ul>
<li><a href="https://techcrunch.com/2019/12/03/aws-announces-new-arm-based-instances-with-graviton2-processors/" rel="nofollow">Coverage of AWS Announcement </a></li>
</ul>

<hr>

<h3><a href="https://mail-index.netbsd.org/pkgsrc-users/2020/01/06/msg030130.html" rel="nofollow">Announcing the pkgsrc-2019Q4 release</a></h3>

<blockquote>
<p>The pkgsrc developers are proud to announce the 65th quarterly release of pkgsrc, the cross-platform packaging system.  pkgsrc is available with more than 20,000 packages, running on 23 separate platforms; more information on pkgsrc itself is available at <a href="https://www.pkgsrc.org/" rel="nofollow">https://www.pkgsrc.org/</a></p>

<p>In total, 190 packages were added, 96 packages were removed, and 1,868 package updates (to 1388 unique packages) were processed since the pkgsrc-2019Q3 release.  As usual, a large number of updates and additions were processed for packages for go (14), guile (11), perl (170), php (10), python (426), and ruby (110).  This continues pkgsrc&#39;s tradition of adding useful packages, updating many packages to more current versions, and pruning unmaintained packages that are believed to have essentially no users.</p>
</blockquote>

<hr>

<h3><a href="https://donatstudios.com/UNIX-Keyboards" rel="nofollow">The Joys of UNIX Keyboards</a></h3>

<blockquote>
<p>I fell in love with a dead keyboard layout.</p>

<p>A decade or so ago while helping a friends father clean out an old building, we came across an ancient Sun Microsystems server. We found it curious. Everything about it was different from what we were used to. The command line was black on white, the connectors strange and foreign, and the keyboard layout was bizarre.</p>

<p>We never did much with it; turning it on made all the lights in his home dim, and our joint knowledge of UNIX was nonexistent. It sat in his bedroom for years supporting his television at the foot of his bed.</p>

<p>I never forgot that keyboard though. The thought that there was this alternative layout out there seemed intriguing to me.</p>
</blockquote>

<hr>

<h3><a href="https://www.going-flying.com/blog/openbsd-on-digitalocean.html" rel="nofollow">OpenBSD on Digital Ocean</a></h3>

<blockquote>
<p>Last night I had a need to put together a new OpenBSD machine. Since I already use DigitalOcean for one of my public DNS servers I wanted to use them for this need but sadly like all too many of the cloud providers they don&#39;t support OpenBSD. Now they do support FreeBSD and I found a couple writeups that show how to use FreeBSD as a shim to install OpenBSD.</p>

<p>They are both sort of old at this point and with OpenBSD 6.6 out I ran into a bit of a snag. The default these days is to use a GPT partition table to enable EFI booting. This is generally pretty sane but it looks to me like the FreeBSD droplet doesn&#39;t support this. After the installer rebooted the VM failed to boot, being unable to find the bootloader.</p>

<p>Thankfully DigitalOcean has a recovery ISO that you can boot by simply switching to it and powering off and then on your Droplet.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=356111" rel="nofollow">FreeBSD defaults to LLVM on PPC</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20191231214356" rel="nofollow">Theo De Raadt Interview between Ottawa 2019 Hackathon and BSDCAN 2019</a></li>
<li><a href="https://twitter.com/BastilleBSD/status/1211475103143251968" rel="nofollow">Bastille Poll about what people would like to see in 2020</a></li>
<li><a href="https://github.com/suvratapte/Maurice-Bach-Notes" rel="nofollow">Notes on the classic book : The Design of the UNIX Operating System</a></li>
<li><a href="https://www.multicians.org/" rel="nofollow">Multics History</a></li>
<li><a href="http://studybsd.com/" rel="nofollow">First meeting of the Hamilton BSD user group, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Bill - <a href="http://dpaste.com/2H9CW6R" rel="nofollow">1.1 CDROM</a></li>
<li>Greg - <a href="http://dpaste.com/2SGA3KY" rel="nofollow">More 50 Year anniversary information</a></li>
<li>Dave - <a href="http://dpaste.com/3ZAEKHD#wrap" rel="nofollow">Question time for Allan</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0333.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>332: The BSD Hyperbole</title>
  <link>https://www.bsdnow.tv/332</link>
  <guid isPermaLink="false">34cc6ce3-e7ed-41bf-880e-e77f6a27fe3c</guid>
  <pubDate>Thu, 09 Jan 2020 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/34cc6ce3-e7ed-41bf-880e-e77f6a27fe3c.mp3" length="32549325" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Announcing HyperbolaBSD, IPFW In-Kernel NAT setup on FreeBSD, Wayland and WebRTC enabled for NetBSD 9/Linux, LLDB Threading support ready for mainline, OpenSSH U2F/FIDO support in base, Dragonfly drm/i915: Update, and more.</itunes:subtitle>
  <itunes:duration>45:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Announcing HyperbolaBSD, IPFW In-Kernel NAT setup on FreeBSD, Wayland and WebRTC enabled for NetBSD 9/Linux, LLDB Threading support ready for mainline, OpenSSH U2F/FIDO support in base, Dragonfly drm/i915: Update, and more.
Headlines
HyperbolaBSD Announcement (https://www.hyperbola.info/news/announcing-hyperbolabsd-roadmap/)
Due to the Linux kernel rapidly proceeding down an unstable path, we are planning on implementing a completely new OS derived from several BSD implementations.
This was not an easy decision to make, but we wish to use our time and resources to create a viable alternative to the current operating system trends which are actively seeking to undermine user choice and freedom.
This will not be a "distro", but a hard fork of the OpenBSD kernel and userspace including new code written under GPLv3 and LGPLv3 to replace GPL-incompatible parts and non-free ones.
Reasons for this include:
Linux kernel forcing adaption of DRM, including HDCP.
Linux kernel proposed usage of Rust (which contains freedom flaws and a centralized code repository that is more prone to cyber attack and generally requires internet access to use.)
Linux kernel being written without security and in mind. (KSPP is basically a dead project and Grsec is no longer free software)
Many GNU userspace and core utils are all forcing adaption of features without build time options to disable them. E.g. (PulseAudio / SystemD / Rust / Java as forced dependencies)
As such, we will continue to support the Milky Way branch until 2022 when our legacy Linux-libre kernel reaches End of Life.
Future versions of Hyperbola will be using HyperbolaBSD which will have the new kernel, userspace and not be ABI compatible with previous versions.
HyperbolaBSD is intended to be modular and minimalist so other projects will be able to re-use the code under free license.
Forum Post (https://forums.hyperbola.info/viewtopic.php?id=315) 
A simple IPFW In-Kernel NAT setup on FreeBSD (https://www.neelc.org/posts/freebsd-ipfw-nat/)
After graduating college, I am moving from Brooklyn, NY to Redmond, WA (guess where I got a job). I always wanted to re-do my OPNsense firewall (currently a HP T730) with stock FreeBSD and IPFW’s in-kernel NAT.
Why IPFW? Benchmarks have shown IPFW to be faster which is especially good for my Tor relay, and because I can! However, one downside of IPFW is less documentation vs PF, even less without natd (which we’re not using), and this took me time to figure this out.
But since my T730 is already packed, I am testing this on a old PC with two NICs, and my laptop [1] as a client with an USB-to-Ethernet adapter.
News Roundup
HEADS UP: Wayland and WebRTC enabled for NetBSD 9/Linux (https://mail-index.netbsd.org/pkgsrc-users/2020/01/05/msg030124.html)
This is just a heads up that the Wayland option is now turned on by
default for NetBSD 9 and Linux in cases where it peacefully coexists
with X11. 
Right now, this effects the following packages: 
graphics/MesaLib
devel/SDL2
www/webkit-gtk
x11/gtk3
The WebRTC option has also been enabled by default on NetBSD 9 for two Firefox versions: www/firefox, www/firefox68
Please keep me informed of any fallout. Hopefully, there will be none.
If you want to try out Wayland-related things on NetBSD 9, wm/velox/MESSAGE may be interesting for you.
LLDB Threading support now ready for mainline (https://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready)
Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.
In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I've started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.
So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I've finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.
OpenSSH U2F/FIDO support in base (https://www.undeadly.org/cgi?action=article;sid=20191115064850)
Hardware backed keys can be generated using "ssh-keygen -t ecdsa-sk" (or "ed25519-sk" if your token supports it). Many tokens require to be touched/tapped to confirm this step.
You'll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a "key handle" that is used by the security key to derive the real private key at signing time.
So, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything.
drm/i915: Update to Linux 4.8.17 (http://lists.dragonflybsd.org/pipermail/commits/2019-December/720257.html)
 drm/i915: Update to Linux 4.8.17
Broxton, Valleyview and Cherryview support improvements
Broadwell and Gen9/Skylake support improvements
Broadwell brightness fixes from OpenBSD
Atomic modesetting improvements
Various bug fixes and performance enhancements
Beastie Bits
Visual Studio Code port for FreeBSD (https://github.com/tagattie/FreeBSD-VSCode)
OpenBSD syscall call-from verification (https://marc.info/?l=openbsd-tech&amp;amp;m=157488907117170&amp;amp;w=2)
Peertube on OpenBSD (https://www.22decembre.eu/en/2019/12/09/peertube-14-openbsd/)
Fuzzing Filesystems on NetBSD via AFL+KCOV by Maciej Grochowski (https://www.youtube.com/watch?v=bbNCqFdQEyk&amp;amp;feature=youtu.be)
Twitter Bot for Prop65 (https://twitter.com/prop65bot/status/1199003319307558912)
Interactive vim tutorial (https://www.openvim.com/)
First BSD user group meeting in Hamilton, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St (http://studybsd.com/)
***
Feedback/Questions
Samir - cgit (http://dpaste.com/2B22M24#wrap)
Russell - R (http://dpaste.com/0J5TYY0#wrap)
Wolfgang - Question (http://dpaste.com/3MQAH27#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, hyperbolabsd, ipfw, in-kernel nat, nat, wayland, webrtc, lldb, threading, u2f, fido, drm, i915</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Announcing HyperbolaBSD, IPFW In-Kernel NAT setup on FreeBSD, Wayland and WebRTC enabled for NetBSD 9/Linux, LLDB Threading support ready for mainline, OpenSSH U2F/FIDO support in base, Dragonfly drm/i915: Update, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.hyperbola.info/news/announcing-hyperbolabsd-roadmap/" rel="nofollow">HyperbolaBSD Announcement</a></h3>

<blockquote>
<p>Due to the Linux kernel rapidly proceeding down an unstable path, we are planning on implementing a completely new OS derived from several BSD implementations.</p>

<p>This was not an easy decision to make, but we wish to use our time and resources to create a viable alternative to the current operating system trends which are actively seeking to undermine user choice and freedom.</p>

<p>This will not be a &quot;distro&quot;, but a hard fork of the OpenBSD kernel and userspace including new code written under GPLv3 and LGPLv3 to replace GPL-incompatible parts and non-free ones.</p>
</blockquote>

<ul>
<li>Reasons for this include:

<ul>
<li>Linux kernel forcing adaption of DRM, including HDCP.</li>
<li>Linux kernel proposed usage of Rust (which contains freedom flaws and a centralized code repository that is more prone to cyber attack and generally requires internet access to use.)</li>
<li>Linux kernel being written without security and in mind. (KSPP is basically a dead project and Grsec is no longer free software)</li>
<li>Many GNU userspace and core utils are all forcing adaption of features without build time options to disable them. E.g. (PulseAudio / SystemD / Rust / Java as forced dependencies)</li>
<li>As such, we will continue to support the Milky Way branch until 2022 when our legacy Linux-libre kernel reaches End of Life.</li>
</ul></li>
</ul>

<blockquote>
<p>Future versions of Hyperbola will be using HyperbolaBSD which will have the new kernel, userspace and not be ABI compatible with previous versions.</p>

<p>HyperbolaBSD is intended to be modular and minimalist so other projects will be able to re-use the code under free license.</p>
</blockquote>

<ul>
<li><a href="https://forums.hyperbola.info/viewtopic.php?id=315" rel="nofollow">Forum Post</a> </li>
</ul>

<hr>

<h3><a href="https://www.neelc.org/posts/freebsd-ipfw-nat/" rel="nofollow">A simple IPFW In-Kernel NAT setup on FreeBSD</a></h3>

<blockquote>
<p>After graduating college, I am moving from Brooklyn, NY to Redmond, WA (guess where I got a job). I always wanted to re-do my OPNsense firewall (currently a HP T730) with stock FreeBSD and IPFW’s in-kernel NAT.</p>

<p>Why IPFW? Benchmarks have shown IPFW to be faster which is especially good for my Tor relay, and because I can! However, one downside of IPFW is less documentation vs PF, even less without natd (which we’re not using), and this took me time to figure this out.</p>

<p>But since my T730 is already packed, I am testing this on a old PC with two NICs, and my laptop [1] as a client with an USB-to-Ethernet adapter.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/pkgsrc-users/2020/01/05/msg030124.html" rel="nofollow">HEADS UP: Wayland and WebRTC enabled for NetBSD 9/Linux</a></h3>

<blockquote>
<p>This is just a heads up that the Wayland option is now turned on by</p>
</blockquote>

<p>default for NetBSD 9 and Linux in cases where it peacefully coexists<br>
with X11. </p>

<ul>
<li>Right now, this effects the following packages: 

<ul>
<li>graphics/MesaLib</li>
<li>devel/SDL2</li>
<li>www/webkit-gtk</li>
<li>x11/gtk3</li>
</ul></li>
</ul>

<blockquote>
<p>The WebRTC option has also been enabled by default on NetBSD 9 for two Firefox versions: www/firefox, www/firefox68</p>

<p>Please keep me informed of any fallout. Hopefully, there will be none.</p>

<p>If you want to try out Wayland-related things on NetBSD 9, wm/velox/MESSAGE may be interesting for you.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready" rel="nofollow">LLDB Threading support now ready for mainline</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>

<p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I&#39;ve started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p>

<p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I&#39;ve finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p>
</blockquote>

<hr>

<h3><a href="https://www.undeadly.org/cgi?action=article;sid=20191115064850" rel="nofollow">OpenSSH U2F/FIDO support in base</a></h3>

<blockquote>
<p>Hardware backed keys can be generated using &quot;ssh-keygen -t ecdsa-sk&quot; (or &quot;ed25519-sk&quot; if your token supports it). Many tokens require to be touched/tapped to confirm this step.</p>

<p>You&#39;ll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a &quot;key handle&quot; that is used by the security key to derive the real private key at signing time.</p>

<p>So, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything.</p>
</blockquote>

<hr>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-December/720257.html" rel="nofollow">drm/i915: Update to Linux 4.8.17</a></h3>

<ul>
<li> drm/i915: Update to Linux 4.8.17

<ul>
<li>Broxton, Valleyview and Cherryview support improvements</li>
<li>Broadwell and Gen9/Skylake support improvements</li>
<li>Broadwell brightness fixes from OpenBSD</li>
<li>Atomic modesetting improvements</li>
<li>Various bug fixes and performance enhancements</li>
</ul></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://github.com/tagattie/FreeBSD-VSCode" rel="nofollow">Visual Studio Code port for FreeBSD</a></li>
<li><a href="https://marc.info/?l=openbsd-tech&m=157488907117170&w=2" rel="nofollow">OpenBSD syscall call-from verification</a></li>
<li><a href="https://www.22decembre.eu/en/2019/12/09/peertube-14-openbsd/" rel="nofollow">Peertube on OpenBSD</a></li>
<li><a href="https://www.youtube.com/watch?v=bbNCqFdQEyk&feature=youtu.be" rel="nofollow">Fuzzing Filesystems on NetBSD via AFL+KCOV by Maciej Grochowski</a></li>
<li><a href="https://twitter.com/prop65bot/status/1199003319307558912" rel="nofollow">Twitter Bot for Prop65</a></li>
<li><a href="https://www.openvim.com/" rel="nofollow">Interactive vim tutorial</a></li>
<li><a href="http://studybsd.com/" rel="nofollow">First BSD user group meeting in Hamilton, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Samir - <a href="http://dpaste.com/2B22M24#wrap" rel="nofollow">cgit</a></li>
<li>Russell - <a href="http://dpaste.com/0J5TYY0#wrap" rel="nofollow">R</a></li>
<li>Wolfgang - <a href="http://dpaste.com/3MQAH27#wrap" rel="nofollow">Question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0332.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Announcing HyperbolaBSD, IPFW In-Kernel NAT setup on FreeBSD, Wayland and WebRTC enabled for NetBSD 9/Linux, LLDB Threading support ready for mainline, OpenSSH U2F/FIDO support in base, Dragonfly drm/i915: Update, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.hyperbola.info/news/announcing-hyperbolabsd-roadmap/" rel="nofollow">HyperbolaBSD Announcement</a></h3>

<blockquote>
<p>Due to the Linux kernel rapidly proceeding down an unstable path, we are planning on implementing a completely new OS derived from several BSD implementations.</p>

<p>This was not an easy decision to make, but we wish to use our time and resources to create a viable alternative to the current operating system trends which are actively seeking to undermine user choice and freedom.</p>

<p>This will not be a &quot;distro&quot;, but a hard fork of the OpenBSD kernel and userspace including new code written under GPLv3 and LGPLv3 to replace GPL-incompatible parts and non-free ones.</p>
</blockquote>

<ul>
<li>Reasons for this include:

<ul>
<li>Linux kernel forcing adaption of DRM, including HDCP.</li>
<li>Linux kernel proposed usage of Rust (which contains freedom flaws and a centralized code repository that is more prone to cyber attack and generally requires internet access to use.)</li>
<li>Linux kernel being written without security and in mind. (KSPP is basically a dead project and Grsec is no longer free software)</li>
<li>Many GNU userspace and core utils are all forcing adaption of features without build time options to disable them. E.g. (PulseAudio / SystemD / Rust / Java as forced dependencies)</li>
<li>As such, we will continue to support the Milky Way branch until 2022 when our legacy Linux-libre kernel reaches End of Life.</li>
</ul></li>
</ul>

<blockquote>
<p>Future versions of Hyperbola will be using HyperbolaBSD which will have the new kernel, userspace and not be ABI compatible with previous versions.</p>

<p>HyperbolaBSD is intended to be modular and minimalist so other projects will be able to re-use the code under free license.</p>
</blockquote>

<ul>
<li><a href="https://forums.hyperbola.info/viewtopic.php?id=315" rel="nofollow">Forum Post</a> </li>
</ul>

<hr>

<h3><a href="https://www.neelc.org/posts/freebsd-ipfw-nat/" rel="nofollow">A simple IPFW In-Kernel NAT setup on FreeBSD</a></h3>

<blockquote>
<p>After graduating college, I am moving from Brooklyn, NY to Redmond, WA (guess where I got a job). I always wanted to re-do my OPNsense firewall (currently a HP T730) with stock FreeBSD and IPFW’s in-kernel NAT.</p>

<p>Why IPFW? Benchmarks have shown IPFW to be faster which is especially good for my Tor relay, and because I can! However, one downside of IPFW is less documentation vs PF, even less without natd (which we’re not using), and this took me time to figure this out.</p>

<p>But since my T730 is already packed, I am testing this on a old PC with two NICs, and my laptop [1] as a client with an USB-to-Ethernet adapter.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/pkgsrc-users/2020/01/05/msg030124.html" rel="nofollow">HEADS UP: Wayland and WebRTC enabled for NetBSD 9/Linux</a></h3>

<blockquote>
<p>This is just a heads up that the Wayland option is now turned on by</p>
</blockquote>

<p>default for NetBSD 9 and Linux in cases where it peacefully coexists<br>
with X11. </p>

<ul>
<li>Right now, this effects the following packages: 

<ul>
<li>graphics/MesaLib</li>
<li>devel/SDL2</li>
<li>www/webkit-gtk</li>
<li>x11/gtk3</li>
</ul></li>
</ul>

<blockquote>
<p>The WebRTC option has also been enabled by default on NetBSD 9 for two Firefox versions: www/firefox, www/firefox68</p>

<p>Please keep me informed of any fallout. Hopefully, there will be none.</p>

<p>If you want to try out Wayland-related things on NetBSD 9, wm/velox/MESSAGE may be interesting for you.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready" rel="nofollow">LLDB Threading support now ready for mainline</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>

<p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I&#39;ve started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p>

<p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I&#39;ve finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p>
</blockquote>

<hr>

<h3><a href="https://www.undeadly.org/cgi?action=article;sid=20191115064850" rel="nofollow">OpenSSH U2F/FIDO support in base</a></h3>

<blockquote>
<p>Hardware backed keys can be generated using &quot;ssh-keygen -t ecdsa-sk&quot; (or &quot;ed25519-sk&quot; if your token supports it). Many tokens require to be touched/tapped to confirm this step.</p>

<p>You&#39;ll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a &quot;key handle&quot; that is used by the security key to derive the real private key at signing time.</p>

<p>So, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything.</p>
</blockquote>

<hr>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-December/720257.html" rel="nofollow">drm/i915: Update to Linux 4.8.17</a></h3>

<ul>
<li> drm/i915: Update to Linux 4.8.17

<ul>
<li>Broxton, Valleyview and Cherryview support improvements</li>
<li>Broadwell and Gen9/Skylake support improvements</li>
<li>Broadwell brightness fixes from OpenBSD</li>
<li>Atomic modesetting improvements</li>
<li>Various bug fixes and performance enhancements</li>
</ul></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://github.com/tagattie/FreeBSD-VSCode" rel="nofollow">Visual Studio Code port for FreeBSD</a></li>
<li><a href="https://marc.info/?l=openbsd-tech&m=157488907117170&w=2" rel="nofollow">OpenBSD syscall call-from verification</a></li>
<li><a href="https://www.22decembre.eu/en/2019/12/09/peertube-14-openbsd/" rel="nofollow">Peertube on OpenBSD</a></li>
<li><a href="https://www.youtube.com/watch?v=bbNCqFdQEyk&feature=youtu.be" rel="nofollow">Fuzzing Filesystems on NetBSD via AFL+KCOV by Maciej Grochowski</a></li>
<li><a href="https://twitter.com/prop65bot/status/1199003319307558912" rel="nofollow">Twitter Bot for Prop65</a></li>
<li><a href="https://www.openvim.com/" rel="nofollow">Interactive vim tutorial</a></li>
<li><a href="http://studybsd.com/" rel="nofollow">First BSD user group meeting in Hamilton, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Samir - <a href="http://dpaste.com/2B22M24#wrap" rel="nofollow">cgit</a></li>
<li>Russell - <a href="http://dpaste.com/0J5TYY0#wrap" rel="nofollow">R</a></li>
<li>Wolfgang - <a href="http://dpaste.com/3MQAH27#wrap" rel="nofollow">Question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0332.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>331: Why Computers Suck</title>
  <link>https://www.bsdnow.tv/331</link>
  <guid isPermaLink="false">aa8d58dd-a2a5-4c8a-9244-755d523fe855</guid>
  <pubDate>Thu, 02 Jan 2020 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/aa8d58dd-a2a5-4c8a-9244-755d523fe855.mp3" length="50254703" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more.</itunes:subtitle>
  <itunes:duration>1:09:47</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more.
Headlines
Why computers suck and how learning from OpenBSD can make them marginally less horrible (https://telegra.ph/Why-OpenBSD-is-marginally-less-horrible-12-05)
How much better could things actually be if we abandoned the enterprise development model? 
Next I will compare this enterprise development approach with non-enterprise development - projects such as OpenBSD, which do not hesitate to introduce ABI breaking changes to improve the codebase.
  One of the most commonly referred to pillars of the project's philosophy has long been its emphasis on clean functional code. Any code which makes it into OpenBSD is subject to ongoing aggressive audits for deprecated, or otherwise unmaintained code in order to reduce cruft and attack surface. Additionally the project creator, Theo de Raadt, and his team of core developers engage in ongoing development for proactive mitigations for various attack classes many of which are directly adopted by various multi-platform userland applications as well as the operating systems themselves (Windows, Linux, and the other BSDs). Frequently it is the case that introducing new features (not just deprecating old ones) introduces new incompatibilities against previously functional binaries compiled for OpenBSD. 
 To prevent the sort of kernel memory bloat that has plagued so many other operating systems for years, the project enforces a hard ceiling on the number of lines of code that can ever be in ring 0 at a given time. Current estimates guess the number of bugs per line of code in the Linux kernel are around 1 bug per every 10,000 lines of code. Think of this in the context of the scope creep seen in the Linux kernel (which if I recall correctly is currently at around 100,000,000 lines of code), as well as the Windows NT kernel (500,000,000 lines of code) and you quickly begin to understand how adding more and more functionality into the most privileged components of the operating system without first removing old components begins to add up in terms of the drastic difference seen between these systems in the number of zero day exploits caught in the wild respectively.
How Unix Works: Become a Better Software Engineer (https://neilkakkar.com/unix.html)
Unix is beautiful. Allow me to paint some happy little trees for you. I’m not going to explain a bunch of commands – that’s boring, and there’s a million tutorials on the web doing that already. I’m going to leave you with the ability to reason about the system.
Every fancy thing you want done is one google search away.
But understanding why the solution does what you want is not the same.
That’s what gives you real power, the power to not be afraid.
And since it rhymes, it must be true.
News Roundup
FreeBSD 12.1 Runs Refreshingly Well With AMD Ryzen Threadripper 3970X (https://www.phoronix.com/scan.php?page=article&amp;amp;item=freebsd-amd-3970x&amp;amp;num=1)
For those of you interested in AMD's new Ryzen Threadripper 3960X/3970X processors with TRX40 motherboards for running FreeBSD, the experience in our initial testing has been surprisingly pleasant. In fact, it works out-of-the-box which one could argue is better than the current Linux support that needs the MCE workaround for booting. Here are some benchmarks of FreeBSD 12.1 on the Threadripper 3970X compared to Linux and Windows for this new HEDT platform.
It was refreshing to see FreeBSD 12.1 booting and running just fine with the Ryzen Threadripper 3970X 32-core/64-thread processor from the ASUS ROG ZENITH II EXTREME motherboard and all core functionality working including the PCIe 4.0 NVMe SSD storage, onboard networking, etc. The system was running with 4 x 16GB DDR4-3600 memory, 1TB Corsair Force MP600 NVMe SSD, and Radeon RX 580 graphics. It was refreshing to see FreeBSD 12.1 running well with this high-end AMD Threadripper system considering Linux even needed a boot workaround.
While the FreeBSD 12.1 experience was trouble-free with the ASUS TRX40 motherboard (ROG Zenith II Extreme) and AMD Ryzen Threadripper 3970X, DragonFlyBSD unfortunately was not. Both DragonFlyBSD 5.6.2 stable and the DragonFlyBSD daily development snapshot from last week were yielding a panic on boot. So with that, DragonFlyBSD wasn't tested for this Threadripper 3970X comparison but just FreeBSD 12.1.
FreeBSD 12.1 on the Threadripper 3970X was benchmarked both with its default LLVM Clang 8.0.1 compiler and again with GCC 9.2 from ports for ruling out compiler differences. The FreeBSD 12.1 performance was compared to last week's Windows 10 vs. Linux benchmarks with the same system.
BSDCan 2020 CFP (https://lists.bsdcan.org/pipermail/bsdcan-announce/2019-December/000180.html)
BSDCan 2020 will be held 5-6 (Fri-Sat) June, 2020 in Ottawa, at the University of Ottawa. It will be preceded by two days of tutorials on 3-4 June (Wed-Thu).
NOTE the change of month in 2020 back to June Also: do not miss out on the Goat BOF on Tuesday 2 June.
We are now accepting proposals for talks.  The talks should be designed with a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.
See http://www.bsdcan.org/2020/
If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal. Possible topics include:
How we manage a giant installation with respect to handling spam.
and/or sysadmin.
and/or networking.
Cool new stuff in BSD
Tell us about your project which runs on BSD
other topics (see next paragraph)
From the BSDCan website, the Archives section will allow you to review the wide variety of past BSDCan presentations as further examples.
Both users and developers are encouraged to share their experiences.
HardenedBSD Infrastructure Goals (https://github.com/lattera/articles/blob/master/hardenedbsd/2019-12-01_infrastructure/article.md)
2019 has been an extremely productive year with regards to HardenedBSD's infrastructure. Several opportunities aligned themselves in such a way as to open a door for a near-complete rebuild with a vast expansion.
The last few months especially have seen a major expansion of our infrastructure. We obtained a number of to-be-retired Dell R410 servers. The crash of our nightly build server provided the opportunity to deploy these R410 servers, doubling our build capacity.
My available time to spend on HardenedBSD has decreased compared to this time last year. As part of rebuilding our infrastructure, I wanted to enable the community to be able to contribute. I'm structuring the work such that help is just a pull request away. Those in the HardenedBSD community who want to contribute to the infrastructure work can simply open a pull request. I'll review the code, and deploy it after a successful review. Users/contributors don't need access to our servers in order to improve them.
My primary goal for the rest of 2019 and into 2020 is to become fully self-hosted, with the sole exception of email. I want to transition the source-of-truth git repos to our own infrastructure. We will still provide a read-only mirror on GitHub.
As I develop this infrastructure, I'm doing so with human rights in mind. HardenedBSD is in a very unique position. In 2020, I plan to provide production Tor Onion Services for the various bits of our infrastructure. HardenedBSD will provide access to its various internal services to its developers and contributors. The entire development lifecycle, going from dev to prod, will be able to happen over Tor.
Transparency will be key moving forward. Logs for the auto-sync script are now published directly to GitHub. Build logs will be, soon, too. Logs of all automated processes, and the code for those processes, will be tracked publicly via git. This will be especially crucial for development over Tor.
Integrating Tor into our infrastructure so deeply increases risk and maintenance burden. However, I believe that through added transparency, we will be able to mitigate risk. Periodic audits will need to be performed and published.
I hope to migrate HardenedBSD's site away from Drupal to a static site generator. We don't really need the dynamic capabilities Drupal gives us. The many security issues Drupal and PHP both bring also leave much to be desired.
So, that's about it. I spent the last few months of 2019 laying the foundation for a successful 2020. I'm excited to see how the project grows.
Beastie Bits
FuryBSD - KDE plasma flavor now available (https://www.furybsd.org/kde-plasma-flavor-now-available/)
DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud (http://lists.dragonflybsd.org/pipermail/commits/2019-November/719945.html)
LPI is looking for BSD Specialist learning material writers (https://wiki.lpi.org/wiki/BSD_Specialist_Objectives_V1.0)
ZFS sync/async + ZIL/SLOG, explained (https://jrs-s.net/2019/05/02/zfs-sync-async-zil-slog/)
BSD-Licensed Combinatorics library/utility (https://lists.freebsd.org/pipermail/freebsd-announce/2019-December/001921.html)
SSL client vs server certificates and bacula-fd (https://dan.langille.org/2019/11/29/ssl-client-vs-server-certificates-and-bacula-fd/)
MaxxDesktop planning to come to FreeBSD (https://www.facebook.com/maxxdesktop/posts/2761326693888282)  Project Page (https://www.facebook.com/maxxdesktop/)
Feedback/Questions
Tom - ZFS Mirror with different speeds (http://dpaste.com/3ZGYNS3#wrap)
Jeff - Knowledge is power (http://dpaste.com/1H9QDCR#wrap)
Johnny - Episode 324 response to Jacob (http://dpaste.com/1A7Q9EV)
Pat - NYC*BUG meeting Jan Meeting Location (http://dpaste.com/0QPZ2GC)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, learning, computers, unix, ryzen, Threadripper, 3970X, bsdcan, infrastructure</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://telegra.ph/Why-OpenBSD-is-marginally-less-horrible-12-05" rel="nofollow">Why computers suck and how learning from OpenBSD can make them marginally less horrible</a></h3>

<blockquote>
<p>How much better could things actually be if we abandoned the enterprise development model? </p>

<p>Next I will compare this enterprise development approach with non-enterprise development - projects such as OpenBSD, which do not hesitate to introduce ABI breaking changes to improve the codebase.</p>

<p>One of the most commonly referred to pillars of the project&#39;s philosophy has long been its emphasis on clean functional code. Any code which makes it into OpenBSD is subject to ongoing aggressive audits for deprecated, or otherwise unmaintained code in order to reduce cruft and attack surface. Additionally the project creator, Theo de Raadt, and his team of core developers engage in ongoing development for proactive mitigations for various attack classes many of which are directly adopted by various multi-platform userland applications as well as the operating systems themselves (Windows, Linux, and the other BSDs). Frequently it is the case that introducing new features (not just deprecating old ones) introduces new incompatibilities against previously functional binaries compiled for OpenBSD. </p>

<p>To prevent the sort of kernel memory bloat that has plagued so many other operating systems for years, the project enforces a hard ceiling on the number of lines of code that can ever be in ring 0 at a given time. Current estimates guess the number of bugs per line of code in the Linux kernel are around 1 bug per every 10,000 lines of code. Think of this in the context of the scope creep seen in the Linux kernel (which if I recall correctly is currently at around 100,000,000 lines of code), as well as the Windows NT kernel (500,000,000 lines of code) and you quickly begin to understand how adding more and more functionality into the most privileged components of the operating system without first removing old components begins to add up in terms of the drastic difference seen between these systems in the number of zero day exploits caught in the wild respectively.</p>
</blockquote>

<hr>

<h3><a href="https://neilkakkar.com/unix.html" rel="nofollow">How Unix Works: Become a Better Software Engineer</a></h3>

<blockquote>
<p>Unix is beautiful. Allow me to paint some happy little trees for you. I’m not going to explain a bunch of commands – that’s boring, and there’s a million tutorials on the web doing that already. I’m going to leave you with the ability to reason about the system.</p>

<p>Every fancy thing you want done is one google search away.</p>

<p>But understanding why the solution does what you want is not the same.</p>

<p>That’s what gives you real power, the power to not be afraid.</p>

<p>And since it rhymes, it must be true.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=article&item=freebsd-amd-3970x&num=1" rel="nofollow">FreeBSD 12.1 Runs Refreshingly Well With AMD Ryzen Threadripper 3970X</a></h3>

<blockquote>
<p>For those of you interested in AMD&#39;s new Ryzen Threadripper 3960X/3970X processors with TRX40 motherboards for running FreeBSD, the experience in our initial testing has been surprisingly pleasant. In fact, it works out-of-the-box which one could argue is better than the current Linux support that needs the MCE workaround for booting. Here are some benchmarks of FreeBSD 12.1 on the Threadripper 3970X compared to Linux and Windows for this new HEDT platform.</p>

<p>It was refreshing to see FreeBSD 12.1 booting and running just fine with the Ryzen Threadripper 3970X 32-core/64-thread processor from the ASUS ROG ZENITH II EXTREME motherboard and all core functionality working including the PCIe 4.0 NVMe SSD storage, onboard networking, etc. The system was running with 4 x 16GB DDR4-3600 memory, 1TB Corsair Force MP600 NVMe SSD, and Radeon RX 580 graphics. It was refreshing to see FreeBSD 12.1 running well with this high-end AMD Threadripper system considering Linux even needed a boot workaround.</p>

<p>While the FreeBSD 12.1 experience was trouble-free with the ASUS TRX40 motherboard (ROG Zenith II Extreme) and AMD Ryzen Threadripper 3970X, DragonFlyBSD unfortunately was not. Both DragonFlyBSD 5.6.2 stable and the DragonFlyBSD daily development snapshot from last week were yielding a panic on boot. So with that, DragonFlyBSD wasn&#39;t tested for this Threadripper 3970X comparison but just FreeBSD 12.1.</p>

<p>FreeBSD 12.1 on the Threadripper 3970X was benchmarked both with its default LLVM Clang 8.0.1 compiler and again with GCC 9.2 from ports for ruling out compiler differences. The FreeBSD 12.1 performance was compared to last week&#39;s Windows 10 vs. Linux benchmarks with the same system.</p>
</blockquote>

<hr>

<h3><a href="https://lists.bsdcan.org/pipermail/bsdcan-announce/2019-December/000180.html" rel="nofollow">BSDCan 2020 CFP</a></h3>

<blockquote>
<p>BSDCan 2020 will be held 5-6 (Fri-Sat) June, 2020 in Ottawa, at the University of Ottawa. It will be preceded by two days of tutorials on 3-4 June (Wed-Thu).</p>

<p>NOTE the change of month in 2020 back to June Also: do not miss out on the Goat BOF on Tuesday 2 June.</p>

<p>We are now accepting proposals for talks.  The talks should be designed with a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.</p>
</blockquote>

<ul>
<li>See <a href="http://www.bsdcan.org/2020/" rel="nofollow">http://www.bsdcan.org/2020/</a></li>
</ul>

<blockquote>
<p>If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal. Possible topics include:</p>
</blockquote>

<ul>
<li>How we manage a giant installation with respect to handling spam.</li>
<li>and/or sysadmin.</li>
<li>and/or networking.</li>
<li>Cool new stuff in BSD</li>
<li>Tell us about your project which runs on BSD</li>
<li>other topics (see next paragraph)</li>
</ul>

<blockquote>
<p>From the BSDCan website, the Archives section will allow you to review the wide variety of past BSDCan presentations as further examples.</p>

<p>Both users and developers are encouraged to share their experiences.</p>
</blockquote>

<hr>

<h3><a href="https://github.com/lattera/articles/blob/master/hardenedbsd/2019-12-01_infrastructure/article.md" rel="nofollow">HardenedBSD Infrastructure Goals</a></h3>

<blockquote>
<p>2019 has been an extremely productive year with regards to HardenedBSD&#39;s infrastructure. Several opportunities aligned themselves in such a way as to open a door for a near-complete rebuild with a vast expansion.</p>

<p>The last few months especially have seen a major expansion of our infrastructure. We obtained a number of to-be-retired Dell R410 servers. The crash of our nightly build server provided the opportunity to deploy these R410 servers, doubling our build capacity.</p>

<p>My available time to spend on HardenedBSD has decreased compared to this time last year. As part of rebuilding our infrastructure, I wanted to enable the community to be able to contribute. I&#39;m structuring the work such that help is just a pull request away. Those in the HardenedBSD community who want to contribute to the infrastructure work can simply open a pull request. I&#39;ll review the code, and deploy it after a successful review. Users/contributors don&#39;t need access to our servers in order to improve them.</p>

<p>My primary goal for the rest of 2019 and into 2020 is to become fully self-hosted, with the sole exception of email. I want to transition the source-of-truth git repos to our own infrastructure. We will still provide a read-only mirror on GitHub.</p>

<p>As I develop this infrastructure, I&#39;m doing so with human rights in mind. HardenedBSD is in a very unique position. In 2020, I plan to provide production Tor Onion Services for the various bits of our infrastructure. HardenedBSD will provide access to its various internal services to its developers and contributors. The entire development lifecycle, going from dev to prod, will be able to happen over Tor.</p>

<p>Transparency will be key moving forward. Logs for the auto-sync script are now published directly to GitHub. Build logs will be, soon, too. Logs of all automated processes, and the code for those processes, will be tracked publicly via git. This will be especially crucial for development over Tor.</p>

<p>Integrating Tor into our infrastructure so deeply increases risk and maintenance burden. However, I believe that through added transparency, we will be able to mitigate risk. Periodic audits will need to be performed and published.</p>

<p>I hope to migrate HardenedBSD&#39;s site away from Drupal to a static site generator. We don&#39;t really need the dynamic capabilities Drupal gives us. The many security issues Drupal and PHP both bring also leave much to be desired.</p>

<p>So, that&#39;s about it. I spent the last few months of 2019 laying the foundation for a successful 2020. I&#39;m excited to see how the project grows.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.furybsd.org/kde-plasma-flavor-now-available/" rel="nofollow">FuryBSD - KDE plasma flavor now available</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-November/719945.html" rel="nofollow">DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud</a></li>
<li><a href="https://wiki.lpi.org/wiki/BSD_Specialist_Objectives_V1.0" rel="nofollow">LPI is looking for BSD Specialist learning material writers</a></li>
<li><a href="https://jrs-s.net/2019/05/02/zfs-sync-async-zil-slog/" rel="nofollow">ZFS sync/async + ZIL/SLOG, explained</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-December/001921.html" rel="nofollow">BSD-Licensed Combinatorics library/utility</a></li>
<li><a href="https://dan.langille.org/2019/11/29/ssl-client-vs-server-certificates-and-bacula-fd/" rel="nofollow">SSL client vs server certificates and bacula-fd</a></li>
<li><a href="https://www.facebook.com/maxxdesktop/posts/2761326693888282" rel="nofollow">MaxxDesktop planning to come to FreeBSD</a>  <a href="https://www.facebook.com/maxxdesktop/" rel="nofollow">Project Page</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Tom - <a href="http://dpaste.com/3ZGYNS3#wrap" rel="nofollow">ZFS Mirror with different speeds</a></li>
<li>Jeff - <a href="http://dpaste.com/1H9QDCR#wrap" rel="nofollow">Knowledge is power</a></li>
<li>Johnny - <a href="http://dpaste.com/1A7Q9EV" rel="nofollow">Episode 324 response to Jacob</a></li>
<li>Pat - <a href="http://dpaste.com/0QPZ2GC" rel="nofollow">NYC*BUG meeting Jan Meeting Location</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0331.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://telegra.ph/Why-OpenBSD-is-marginally-less-horrible-12-05" rel="nofollow">Why computers suck and how learning from OpenBSD can make them marginally less horrible</a></h3>

<blockquote>
<p>How much better could things actually be if we abandoned the enterprise development model? </p>

<p>Next I will compare this enterprise development approach with non-enterprise development - projects such as OpenBSD, which do not hesitate to introduce ABI breaking changes to improve the codebase.</p>

<p>One of the most commonly referred to pillars of the project&#39;s philosophy has long been its emphasis on clean functional code. Any code which makes it into OpenBSD is subject to ongoing aggressive audits for deprecated, or otherwise unmaintained code in order to reduce cruft and attack surface. Additionally the project creator, Theo de Raadt, and his team of core developers engage in ongoing development for proactive mitigations for various attack classes many of which are directly adopted by various multi-platform userland applications as well as the operating systems themselves (Windows, Linux, and the other BSDs). Frequently it is the case that introducing new features (not just deprecating old ones) introduces new incompatibilities against previously functional binaries compiled for OpenBSD. </p>

<p>To prevent the sort of kernel memory bloat that has plagued so many other operating systems for years, the project enforces a hard ceiling on the number of lines of code that can ever be in ring 0 at a given time. Current estimates guess the number of bugs per line of code in the Linux kernel are around 1 bug per every 10,000 lines of code. Think of this in the context of the scope creep seen in the Linux kernel (which if I recall correctly is currently at around 100,000,000 lines of code), as well as the Windows NT kernel (500,000,000 lines of code) and you quickly begin to understand how adding more and more functionality into the most privileged components of the operating system without first removing old components begins to add up in terms of the drastic difference seen between these systems in the number of zero day exploits caught in the wild respectively.</p>
</blockquote>

<hr>

<h3><a href="https://neilkakkar.com/unix.html" rel="nofollow">How Unix Works: Become a Better Software Engineer</a></h3>

<blockquote>
<p>Unix is beautiful. Allow me to paint some happy little trees for you. I’m not going to explain a bunch of commands – that’s boring, and there’s a million tutorials on the web doing that already. I’m going to leave you with the ability to reason about the system.</p>

<p>Every fancy thing you want done is one google search away.</p>

<p>But understanding why the solution does what you want is not the same.</p>

<p>That’s what gives you real power, the power to not be afraid.</p>

<p>And since it rhymes, it must be true.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=article&item=freebsd-amd-3970x&num=1" rel="nofollow">FreeBSD 12.1 Runs Refreshingly Well With AMD Ryzen Threadripper 3970X</a></h3>

<blockquote>
<p>For those of you interested in AMD&#39;s new Ryzen Threadripper 3960X/3970X processors with TRX40 motherboards for running FreeBSD, the experience in our initial testing has been surprisingly pleasant. In fact, it works out-of-the-box which one could argue is better than the current Linux support that needs the MCE workaround for booting. Here are some benchmarks of FreeBSD 12.1 on the Threadripper 3970X compared to Linux and Windows for this new HEDT platform.</p>

<p>It was refreshing to see FreeBSD 12.1 booting and running just fine with the Ryzen Threadripper 3970X 32-core/64-thread processor from the ASUS ROG ZENITH II EXTREME motherboard and all core functionality working including the PCIe 4.0 NVMe SSD storage, onboard networking, etc. The system was running with 4 x 16GB DDR4-3600 memory, 1TB Corsair Force MP600 NVMe SSD, and Radeon RX 580 graphics. It was refreshing to see FreeBSD 12.1 running well with this high-end AMD Threadripper system considering Linux even needed a boot workaround.</p>

<p>While the FreeBSD 12.1 experience was trouble-free with the ASUS TRX40 motherboard (ROG Zenith II Extreme) and AMD Ryzen Threadripper 3970X, DragonFlyBSD unfortunately was not. Both DragonFlyBSD 5.6.2 stable and the DragonFlyBSD daily development snapshot from last week were yielding a panic on boot. So with that, DragonFlyBSD wasn&#39;t tested for this Threadripper 3970X comparison but just FreeBSD 12.1.</p>

<p>FreeBSD 12.1 on the Threadripper 3970X was benchmarked both with its default LLVM Clang 8.0.1 compiler and again with GCC 9.2 from ports for ruling out compiler differences. The FreeBSD 12.1 performance was compared to last week&#39;s Windows 10 vs. Linux benchmarks with the same system.</p>
</blockquote>

<hr>

<h3><a href="https://lists.bsdcan.org/pipermail/bsdcan-announce/2019-December/000180.html" rel="nofollow">BSDCan 2020 CFP</a></h3>

<blockquote>
<p>BSDCan 2020 will be held 5-6 (Fri-Sat) June, 2020 in Ottawa, at the University of Ottawa. It will be preceded by two days of tutorials on 3-4 June (Wed-Thu).</p>

<p>NOTE the change of month in 2020 back to June Also: do not miss out on the Goat BOF on Tuesday 2 June.</p>

<p>We are now accepting proposals for talks.  The talks should be designed with a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.</p>
</blockquote>

<ul>
<li>See <a href="http://www.bsdcan.org/2020/" rel="nofollow">http://www.bsdcan.org/2020/</a></li>
</ul>

<blockquote>
<p>If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal. Possible topics include:</p>
</blockquote>

<ul>
<li>How we manage a giant installation with respect to handling spam.</li>
<li>and/or sysadmin.</li>
<li>and/or networking.</li>
<li>Cool new stuff in BSD</li>
<li>Tell us about your project which runs on BSD</li>
<li>other topics (see next paragraph)</li>
</ul>

<blockquote>
<p>From the BSDCan website, the Archives section will allow you to review the wide variety of past BSDCan presentations as further examples.</p>

<p>Both users and developers are encouraged to share their experiences.</p>
</blockquote>

<hr>

<h3><a href="https://github.com/lattera/articles/blob/master/hardenedbsd/2019-12-01_infrastructure/article.md" rel="nofollow">HardenedBSD Infrastructure Goals</a></h3>

<blockquote>
<p>2019 has been an extremely productive year with regards to HardenedBSD&#39;s infrastructure. Several opportunities aligned themselves in such a way as to open a door for a near-complete rebuild with a vast expansion.</p>

<p>The last few months especially have seen a major expansion of our infrastructure. We obtained a number of to-be-retired Dell R410 servers. The crash of our nightly build server provided the opportunity to deploy these R410 servers, doubling our build capacity.</p>

<p>My available time to spend on HardenedBSD has decreased compared to this time last year. As part of rebuilding our infrastructure, I wanted to enable the community to be able to contribute. I&#39;m structuring the work such that help is just a pull request away. Those in the HardenedBSD community who want to contribute to the infrastructure work can simply open a pull request. I&#39;ll review the code, and deploy it after a successful review. Users/contributors don&#39;t need access to our servers in order to improve them.</p>

<p>My primary goal for the rest of 2019 and into 2020 is to become fully self-hosted, with the sole exception of email. I want to transition the source-of-truth git repos to our own infrastructure. We will still provide a read-only mirror on GitHub.</p>

<p>As I develop this infrastructure, I&#39;m doing so with human rights in mind. HardenedBSD is in a very unique position. In 2020, I plan to provide production Tor Onion Services for the various bits of our infrastructure. HardenedBSD will provide access to its various internal services to its developers and contributors. The entire development lifecycle, going from dev to prod, will be able to happen over Tor.</p>

<p>Transparency will be key moving forward. Logs for the auto-sync script are now published directly to GitHub. Build logs will be, soon, too. Logs of all automated processes, and the code for those processes, will be tracked publicly via git. This will be especially crucial for development over Tor.</p>

<p>Integrating Tor into our infrastructure so deeply increases risk and maintenance burden. However, I believe that through added transparency, we will be able to mitigate risk. Periodic audits will need to be performed and published.</p>

<p>I hope to migrate HardenedBSD&#39;s site away from Drupal to a static site generator. We don&#39;t really need the dynamic capabilities Drupal gives us. The many security issues Drupal and PHP both bring also leave much to be desired.</p>

<p>So, that&#39;s about it. I spent the last few months of 2019 laying the foundation for a successful 2020. I&#39;m excited to see how the project grows.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.furybsd.org/kde-plasma-flavor-now-available/" rel="nofollow">FuryBSD - KDE plasma flavor now available</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-November/719945.html" rel="nofollow">DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud</a></li>
<li><a href="https://wiki.lpi.org/wiki/BSD_Specialist_Objectives_V1.0" rel="nofollow">LPI is looking for BSD Specialist learning material writers</a></li>
<li><a href="https://jrs-s.net/2019/05/02/zfs-sync-async-zil-slog/" rel="nofollow">ZFS sync/async + ZIL/SLOG, explained</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-December/001921.html" rel="nofollow">BSD-Licensed Combinatorics library/utility</a></li>
<li><a href="https://dan.langille.org/2019/11/29/ssl-client-vs-server-certificates-and-bacula-fd/" rel="nofollow">SSL client vs server certificates and bacula-fd</a></li>
<li><a href="https://www.facebook.com/maxxdesktop/posts/2761326693888282" rel="nofollow">MaxxDesktop planning to come to FreeBSD</a>  <a href="https://www.facebook.com/maxxdesktop/" rel="nofollow">Project Page</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Tom - <a href="http://dpaste.com/3ZGYNS3#wrap" rel="nofollow">ZFS Mirror with different speeds</a></li>
<li>Jeff - <a href="http://dpaste.com/1H9QDCR#wrap" rel="nofollow">Knowledge is power</a></li>
<li>Johnny - <a href="http://dpaste.com/1A7Q9EV" rel="nofollow">Episode 324 response to Jacob</a></li>
<li>Pat - <a href="http://dpaste.com/0QPZ2GC" rel="nofollow">NYC*BUG meeting Jan Meeting Location</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0331.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>330: Happy Holidays, All(an)</title>
  <link>https://www.bsdnow.tv/330</link>
  <guid isPermaLink="false">af84425c-c562-4d3b-b28c-cce7a148a3ad</guid>
  <pubDate>Thu, 26 Dec 2019 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/af84425c-c562-4d3b-b28c-cce7a148a3ad.mp3" length="54074955" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more.</itunes:subtitle>
  <itunes:duration>1:15:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more.
Headlines
Authentication vulnerabilities in OpenBSD (https://www.openwall.com/lists/oss-security/2019/12/04/5)
We discovered an authentication-bypass vulnerability in OpenBSD's authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms.
From the manual page of login.conf:
OpenBSD uses BSD Authentication, which is made up of a variety of authentication styles.  The authentication styles currently provided are:
         passwd     Request a password and check it against the password in the master.passwd file.  See loginpasswd(8).
         skey       Send a challenge and request a response, checking it with S/Key (tm) authentication.  See loginskey(8).
         yubikey    Authenticate using a Yubico YubiKey token.  See loginyubikey(8).
         For any given style, the program /usr/libexec/auth/loginstyle is used to
         perform the authentication.  The synopsis of this program is:
         /usr/libexec/auth/login_style [-v name=value] [-s service] username class
This is the first piece of the puzzle: if an attacker specifies a username of the form "-option", they can influence the behavior of the authentication program in unexpected ways.
 login_passwd [-s service] [-v wheel=yes|no] [-v lastchance=yes|no] user [class] The service argument specifies which protocol to use with the invoking program.  The allowed protocols are login, challenge, and response.  (The challenge protocol is silently ignored but will report success as passwd-style authentication is not challenge-response based).
This is the second piece of the puzzle: if an attacker specifies the username "-schallenge" (or "-schallenge:passwd" to force a passwd-style authentication), then the authentication is automatically successful and therefore bypassed.
Case study: smtpd
Case study: ldapd
Case study: radiusd
Case study: sshd
Acknowledgments: We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. We also thank MITRE's CVE Assignment Team.
First release candidate for NetBSD 9.0 available! (https://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd)
Since the start of the release process four months ago a lot of improvements went into the branch - more than 500 pullups were processed!
This includes usbnet (a common framework for usb ethernet drivers), aarch64 stability enhancements and lots of new hardware support, installer/sysinst fixes and changes to the NVMM (hardware virtualization) interface.
We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).
Here are a few highlights of the new release:
Support for Arm AArch64 (64-bit Armv8-A) machines, including "Arm ServerReady"
compliant machines (SBBR+SBSA)
Enhanced hardware support for Armv7-A
Updated GPU drivers (e.g. support for Intel Kabylake)
Enhanced virtualization support
Support for hardware-accelerated virtualization (NVMM)
Support for Performance Monitoring Counters
Support for Kernel ASLR
Support several kernel sanitizers (KLEAK, KASAN, KUBSAN)
Support for userland sanitizers
Audit of the network stack
Many improvements in NPF
Updated ZFS
Reworked error handling and NCQ support in the SATA subsystem
Support a common framework for USB Ethernet drivers (usbnet)
More information on the RC can be found on the NetBSD 9 release page (https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html)
News Roundup
Running FreeNAS on a Digitalocean droplet (https://www.shlomimarco.com/post/running-freenas-on-a-digitalocean-droplet)
ZFS is awesome. FreeBSD even more so. FreeNAS is the battle-tested, enterprise-ready-yet-home-user-friendly software defined storage solution which is cooler then deep space, based on FreeBSD and makes heavy use of ZFS. This is what I (and soooooo many others) use for just about any storage-related task. I can go on and on and on about what makes it great, but if you're here, reading this, you probably know all that already and we can skip ahead.
I've needed an offsite FreeNAS setup to replicate things to, to run some things, to do some stuff, basically, my privately-owned, tightly-controlled NAS appliance in the cloud, one I control from top to bottom and with support for whatever crazy thing I'm trying to do. Since I'm using DigitalOcean as my main VPS provider, it seemed logical to run FreeNAS there, however, you can't. While DO supports many many distos and pre-setup applications (e.g OpenVPN), FreeNAS isn't a supported feature, at least not in the traditional way :)
Before we begin, here's the gist of what we're going to do:
Base of a FreeBSD droplet, we'll re-image our boot block device with FreeNAS iso. We'll then install FreeNAS on the second block device. Once done we're going to do the ol' switcheroo: we're going to re-image our original boot block device using the now FreeNAS-installed second block device. 
Part 1: re-image our boot block device to boot FreeNAS install media.
Part 2: Install FreeNAS on the second block-device
Part 3: Re-image the boot block device using the FreeNAS-installed block device
NomadBSD 1.3 is now available (https://nomadbsd.org/)
From the release notes:
The base system has been changed to FreeBSD 12.1-RELEASE-p1
 Due to a deadlock problem, FreeBSD's unionfs has been replaced by unionfs-fuse
 The GPT layout has been changed to MBR. This prevents problems with Lenovo
 systems that refuse to boot from GPT if "lenovofix" is not set, and systems that
 hang on boot if "lenovofix" is set.
 Support for ZFS installations has been added to the NomadBSD installer.
 The rc-script for setting up the network interfaces has been fixed and improved.
 Support for setting the country code for the wlan device has been added.
 Auto configuration for running in VirtualBox has been added.
 A check for the default display has been added to the graphics configuration scripts. This fixes problems where users with Optimus have their NVIDIA card disabled, and use the integrated graphics chip instead.
 NVIDIA driver version 440 has been added.
 nomadbsd-dmconfig, a Qt tool for selecting the display manager theme, setting the
default user and autologin has been added.
 nomadbsd-adduser, a Qt tool for added preconfigured user accounts to the system has been added.
 Martin Orszulik added Czech translations to the setup and installation wizard.
 The NomadBSD logo, designed by Ian Grindley, has been changed.
 Support for localized error messages has been added.
 Support for localizing the password prompts has been added.
 Some templates for starting other DEs have been added to ~/.xinitrc.
 The interfaces of nomadbsd-setup-gui and nomadbsd-install-gui have been improved.
 A script that helps users to configure a multihead systems has been added.
 The Xorg driver for newer Intel GPUs has been changed from "intel" to "modesetting".
 /proc has been added to /etc/fstab
 A D-Bus session issue has been fixed which prevented thunar from accessing  samba shares.
 DSBBg which allows users to change and manage wallpapers has been added.
 The latest version of update_obmenu now supports auto-updating the Openbox menu. Manually updating the Openbox menu after packet (de)installation is therefore no longer needed.
Support for multiple keyboard layouts has been added.
 www/palemoon has been removed.
 mail/thunderbird has been removed.
 audio/audacity has been added.
 deskutils/orage has been added.
 the password manager fpm2 has been replaced by KeePassXC
 mail/sylpheed has been replaced by mail/claws-mail
 multimedia/simplescreenrecorder has been added.
 DSBMC has been changed to DSBMC-Qt
 Many small improvements and bug fixes.
At e2k19 nobody can hear you scream (https://undeadly.org/cgi?action=article;sid=20191204170908)
After 2 years it was once again time to pack skis and snowshoes, put a satellite dish onto a sledge and hike through the snowy rockies to the Elk Lakes hut.
I did not really have much of a plan what I wanted to work on but there were a few things I wanted to look into. One of them was rpki-client and the fact that it was so incredibly slow. Since Bob beck@ was around I started to ask him innocent X509 questions ... as if there are innocent X509 questions! Mainly about the abuse of the X509STORE in rpki-client. Pretty soon it was clear that rpki-client did it all wrong and most of the X509 verification had to be rewritten. Instead of only storing the root certificates in the store and passing the intermediate certs as a chain to the verification function rpki-client threw everything into it. The X509STORE is just not built for such an abuse and so it was no wonder that this was slow.
Lucky me I pulled benno@ with me into this dark hole of libcrypto code. He managed to build up an initial diff to pass the chains as a STACKOF(X509) and together we managed to get it working. A big thanks goes to ingo@ who documented most of the functions we had to use. Have a look at STACKOF(3) and skpopfree(3) to understand why benno@ and I slowly turned crazy.
Our next challenge was to only load the necessary certificate revocation list into the X509STORECTX. While doing those changes it became obvious that some of the data structures needed better lookup functions. Looking up certificates was done using a linear lookup and so we replaced the internal certificate and CRL tables with RB trees for fast lookups. deraadt@ also joined the rpki-client commit fest and changed the output code to use rename(2) so that files are replaced in an atomic operation. Thanks to this rpki-client can now be safely run from cron (there is an example in the default crontab).
I did not plan to spend most of my week hacking on rpki-client but in the end I'm happy that I did and the result is fairly impressive. Working with libcrypto code and especially X509 was less than pleasant. Our screams of agony died away in the snowy rocky mountains and made Bob deep dive into UVM with a smile since he knew that benno@ and I had it worse.
In case you wonder thanks to all changes at e2k19 rpki-client improved from over 20min run time to validate all VRPS to roughly 1min to do the same job. A factor 20 improvement!
Thanks to Theo, Bob and Howie to make this possible. To all the cooks for the great food and to Xplornet for providing us with Internet at the hut.
Beastie Bits
FOSDEM 2020 BSD Devroom schedule (https://fosdem.org/2020/schedule/track/bsd/)
Easy Minecraft Server on FreeBSD Howto (https://www.freebsdfoundation.org/freebsd/how-to-guides/easy-minecraft-server-on-freebsd/)
stats(3) framework in the TCP stack (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=355304)
4017 days of uptime (https://twitter.com/EdwinKremer/status/1203071684535889921)
sysget - A front-end for every package manager (https://github.com/emilengler/sysget)
PlayOnBSD’s Cross-BSD Shopping Guide (https://www.playonbsd.com/shopping_guide/)
Feedback/Questions
Pat asks about the proper disk drive type for ZFS (http://dpaste.com/2FDN26X#wrap)
Brad asks about a ZFS rosetta stone (http://dpaste.com/2X8PBMC#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 Special Guest: Mariusz Zaborski.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, Authentication, vulnerabilities, release candidate, digitalocean, droplet, freenas, nomadbsd, e2k19, hackathon</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.openwall.com/lists/oss-security/2019/12/04/5" rel="nofollow">Authentication vulnerabilities in OpenBSD</a></h3>

<ul>
<li>We discovered an authentication-bypass vulnerability in OpenBSD&#39;s authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms.</li>
<li>From the manual page of login.conf:</li>
</ul>

<blockquote>
<p>OpenBSD uses BSD Authentication, which is made up of a variety of authentication styles.  The authentication styles currently provided are:<br>
         passwd     Request a password and check it against the password in the master.passwd file.  See login_passwd(8).<br>
         skey       Send a challenge and request a response, checking it with S/Key (tm) authentication.  See login_skey(8).<br>
         yubikey    Authenticate using a Yubico YubiKey token.  See login_yubikey(8).<br>
         For any given style, the program /usr/libexec/auth/login_style is used to<br>
         perform the authentication.  The synopsis of this program is:<br>
         /usr/libexec/auth/login_style [-v name=value] [-s service] username class</p>
</blockquote>

<ul>
<li>This is the first piece of the puzzle: if an attacker specifies a username of the form &quot;-option&quot;, they can influence the behavior of the authentication program in unexpected ways.</li>
</ul>

<blockquote>
<pre><code> login_passwd [-s service] [-v wheel=yes|no] [-v lastchance=yes|no] user [class] The service argument specifies which protocol to use with the invoking program.  The allowed protocols are login, challenge, and response.  (The challenge protocol is silently ignored but will report success as passwd-style authentication is not challenge-response based).
</code></pre>
</blockquote>

<ul>
<li>This is the second piece of the puzzle: if an attacker specifies the username &quot;-schallenge&quot; (or &quot;-schallenge:passwd&quot; to force a passwd-style authentication), then the authentication is automatically successful and therefore bypassed.</li>
<li>Case study: smtpd</li>
<li>Case study: ldapd</li>
<li>Case study: radiusd</li>
<li>Case study: sshd</li>
<li>Acknowledgments: We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. We also thank MITRE&#39;s CVE Assignment Team.</li>
</ul>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd" rel="nofollow">First release candidate for NetBSD 9.0 available!</a></h3>

<ul>
<li>Since the start of the release process four months ago a lot of improvements went into the branch - more than 500 pullups were processed!</li>
<li>This includes usbnet (a common framework for usb ethernet drivers), aarch64 stability enhancements and lots of new hardware support, installer/sysinst fixes and changes to the NVMM (hardware virtualization) interface.</li>
<li>We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).</li>
<li><p>Here are a few highlights of the new release:</p>

<blockquote>
<p>Support for Arm AArch64 (64-bit Armv8-A) machines, including &quot;Arm ServerReady&quot;<br>
compliant machines (SBBR+SBSA)<br>
Enhanced hardware support for Armv7-A<br>
Updated GPU drivers (e.g. support for Intel Kabylake)<br>
Enhanced virtualization support<br>
Support for hardware-accelerated virtualization (NVMM)<br>
Support for Performance Monitoring Counters<br>
Support for Kernel ASLR<br>
Support several kernel sanitizers (KLEAK, KASAN, KUBSAN)<br>
Support for userland sanitizers<br>
Audit of the network stack<br>
Many improvements in NPF<br>
Updated ZFS<br>
Reworked error handling and NCQ support in the SATA subsystem<br>
Support a common framework for USB Ethernet drivers (usbnet)</p>
</blockquote></li>
<li><p>More information on the RC can be found on the <a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html" rel="nofollow">NetBSD 9 release page</a></p></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.shlomimarco.com/post/running-freenas-on-a-digitalocean-droplet" rel="nofollow">Running FreeNAS on a Digitalocean droplet</a></h3>

<ul>
<li>ZFS is awesome. FreeBSD even more so. FreeNAS is the battle-tested, enterprise-ready-yet-home-user-friendly software defined storage solution which is cooler then deep space, based on FreeBSD and makes heavy use of ZFS. This is what I (and soooooo many others) use for just about any storage-related task. I can go on and on and on about what makes it great, but if you&#39;re here, reading this, you probably know all that already and we can skip ahead.</li>
<li>I&#39;ve needed an offsite FreeNAS setup to replicate things to, to run some things, to do some stuff, basically, my privately-owned, tightly-controlled NAS appliance in the cloud, one I control from top to bottom and with support for whatever crazy thing I&#39;m trying to do. Since I&#39;m using DigitalOcean as my main VPS provider, it seemed logical to run FreeNAS there, however, you can&#39;t. While DO supports many many distos and pre-setup applications (e.g OpenVPN), FreeNAS isn&#39;t a supported feature, at least not in the traditional way :)</li>
<li>Before we begin, here&#39;s the gist of what we&#39;re going to do:</li>
</ul>

<blockquote>
<p>Base of a FreeBSD droplet, we&#39;ll re-image our boot block device with FreeNAS iso. We&#39;ll then install FreeNAS on the second block device. Once done we&#39;re going to do the ol&#39; switcheroo: we&#39;re going to re-image our original boot block device using the now FreeNAS-installed second block device. </p>
</blockquote>

<ul>
<li>Part 1: re-image our boot block device to boot FreeNAS install media.</li>
<li>Part 2: Install FreeNAS on the second block-device</li>
<li>Part 3: Re-image the boot block device using the FreeNAS-installed block device</li>
</ul>

<hr>

<h3><a href="https://nomadbsd.org/" rel="nofollow">NomadBSD 1.3 is now available</a></h3>

<ul>
<li>From the release notes:</li>
</ul>

<blockquote>
<p>The base system has been changed to FreeBSD 12.1-RELEASE-p1<br>
 Due to a deadlock problem, FreeBSD&#39;s unionfs has been replaced by unionfs-fuse<br>
 The GPT layout has been changed to MBR. This prevents problems with Lenovo<br>
 systems that refuse to boot from GPT if &quot;lenovofix&quot; is not set, and systems that<br>
 hang on boot if &quot;lenovofix&quot; is set.<br>
 Support for ZFS installations has been added to the NomadBSD installer.<br>
 The rc-script for setting up the network interfaces has been fixed and improved.<br>
 Support for setting the country code for the wlan device has been added.<br>
 Auto configuration for running in VirtualBox has been added.<br>
 A check for the default display has been added to the graphics configuration scripts. This fixes problems where users with Optimus have their NVIDIA card disabled, and use the integrated graphics chip instead.<br>
 NVIDIA driver version 440 has been added.<br>
 nomadbsd-dmconfig, a Qt tool for selecting the display manager theme, setting the<br>
default user and autologin has been added.<br>
 nomadbsd-adduser, a Qt tool for added preconfigured user accounts to the system has been added.<br>
 Martin Orszulik added Czech translations to the setup and installation wizard.<br>
 The NomadBSD logo, designed by Ian Grindley, has been changed.<br>
 Support for localized error messages has been added.<br>
 Support for localizing the password prompts has been added.<br>
 Some templates for starting other DEs have been added to ~/.xinitrc.<br>
 The interfaces of nomadbsd-setup-gui and nomadbsd-install-gui have been improved.<br>
 A script that helps users to configure a multihead systems has been added.<br>
 The Xorg driver for newer Intel GPUs has been changed from &quot;intel&quot; to &quot;modesetting&quot;.<br>
 /proc has been added to /etc/fstab<br>
 A D-Bus session issue has been fixed which prevented thunar from accessing  samba shares.<br>
 DSBBg which allows users to change and manage wallpapers has been added.<br>
 The latest version of update_obmenu now supports auto-updating the Openbox menu. Manually updating the Openbox menu after packet (de)installation is therefore no longer needed.</p>

<p>Support for multiple keyboard layouts has been added.<br>
 www/palemoon has been removed.<br>
 mail/thunderbird has been removed.<br>
 audio/audacity has been added.<br>
 deskutils/orage has been added.<br>
 the password manager fpm2 has been replaced by KeePassXC<br>
 mail/sylpheed has been replaced by mail/claws-mail<br>
 multimedia/simplescreenrecorder has been added.<br>
 DSBMC has been changed to DSBMC-Qt<br>
 Many small improvements and bug fixes.</p>
</blockquote>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20191204170908" rel="nofollow">At e2k19 nobody can hear you scream</a></h3>

<ul>
<li>After 2 years it was once again time to pack skis and snowshoes, put a satellite dish onto a sledge and hike through the snowy rockies to the Elk Lakes hut.</li>
<li>I did not really have much of a plan what I wanted to work on but there were a few things I wanted to look into. One of them was rpki-client and the fact that it was so incredibly slow. Since Bob beck@ was around I started to ask him innocent X509 questions ... as if there are innocent X509 questions! Mainly about the abuse of the X509_STORE in rpki-client. Pretty soon it was clear that rpki-client did it all wrong and most of the X509 verification had to be rewritten. Instead of only storing the root certificates in the store and passing the intermediate certs as a chain to the verification function rpki-client threw everything into it. The X509_STORE is just not built for such an abuse and so it was no wonder that this was slow.</li>
<li>Lucky me I pulled benno@ with me into this dark hole of libcrypto code. He managed to build up an initial diff to pass the chains as a STACK_OF(X509) and together we managed to get it working. A big thanks goes to ingo@ who documented most of the functions we had to use. Have a look at STACK_OF(3) and sk_pop_free(3) to understand why benno@ and I slowly turned crazy.</li>
<li>Our next challenge was to only load the necessary certificate revocation list into the X509_STORE_CTX. While doing those changes it became obvious that some of the data structures needed better lookup functions. Looking up certificates was done using a linear lookup and so we replaced the internal certificate and CRL tables with RB trees for fast lookups. deraadt@ also joined the rpki-client commit fest and changed the output code to use rename(2) so that files are replaced in an atomic operation. Thanks to this rpki-client can now be safely run from cron (there is an example in the default crontab).</li>
<li>I did not plan to spend most of my week hacking on rpki-client but in the end I&#39;m happy that I did and the result is fairly impressive. Working with libcrypto code and especially X509 was less than pleasant. Our screams of agony died away in the snowy rocky mountains and made Bob deep dive into UVM with a smile since he knew that benno@ and I had it worse.</li>
<li>In case you wonder thanks to all changes at e2k19 rpki-client improved from over 20min run time to validate all VRPS to roughly 1min to do the same job. A factor 20 improvement!</li>
<li>Thanks to Theo, Bob and Howie to make this possible. To all the cooks for the great food and to Xplornet for providing us with Internet at the hut.</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://fosdem.org/2020/schedule/track/bsd/" rel="nofollow">FOSDEM 2020 BSD Devroom schedule</a></li>
<li><a href="https://www.freebsdfoundation.org/freebsd/how-to-guides/easy-minecraft-server-on-freebsd/" rel="nofollow">Easy Minecraft Server on FreeBSD Howto</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=355304" rel="nofollow">stats(3) framework in the TCP stack</a></li>
<li><a href="https://twitter.com/EdwinKremer/status/1203071684535889921" rel="nofollow">4017 days of uptime</a></li>
<li><a href="https://github.com/emilengler/sysget" rel="nofollow">sysget - A front-end for every package manager</a></li>
<li><a href="https://www.playonbsd.com/shopping_guide/" rel="nofollow">PlayOnBSD’s Cross-BSD Shopping Guide</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2FDN26X#wrap" rel="nofollow">Pat asks about the proper disk drive type for ZFS</a></li>
<li><a href="http://dpaste.com/2X8PBMC#wrap" rel="nofollow">Brad asks about a ZFS rosetta stone</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0330.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video><p>Special Guest: Mariusz Zaborski.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.openwall.com/lists/oss-security/2019/12/04/5" rel="nofollow">Authentication vulnerabilities in OpenBSD</a></h3>

<ul>
<li>We discovered an authentication-bypass vulnerability in OpenBSD&#39;s authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms.</li>
<li>From the manual page of login.conf:</li>
</ul>

<blockquote>
<p>OpenBSD uses BSD Authentication, which is made up of a variety of authentication styles.  The authentication styles currently provided are:<br>
         passwd     Request a password and check it against the password in the master.passwd file.  See login_passwd(8).<br>
         skey       Send a challenge and request a response, checking it with S/Key (tm) authentication.  See login_skey(8).<br>
         yubikey    Authenticate using a Yubico YubiKey token.  See login_yubikey(8).<br>
         For any given style, the program /usr/libexec/auth/login_style is used to<br>
         perform the authentication.  The synopsis of this program is:<br>
         /usr/libexec/auth/login_style [-v name=value] [-s service] username class</p>
</blockquote>

<ul>
<li>This is the first piece of the puzzle: if an attacker specifies a username of the form &quot;-option&quot;, they can influence the behavior of the authentication program in unexpected ways.</li>
</ul>

<blockquote>
<pre><code> login_passwd [-s service] [-v wheel=yes|no] [-v lastchance=yes|no] user [class] The service argument specifies which protocol to use with the invoking program.  The allowed protocols are login, challenge, and response.  (The challenge protocol is silently ignored but will report success as passwd-style authentication is not challenge-response based).
</code></pre>
</blockquote>

<ul>
<li>This is the second piece of the puzzle: if an attacker specifies the username &quot;-schallenge&quot; (or &quot;-schallenge:passwd&quot; to force a passwd-style authentication), then the authentication is automatically successful and therefore bypassed.</li>
<li>Case study: smtpd</li>
<li>Case study: ldapd</li>
<li>Case study: radiusd</li>
<li>Case study: sshd</li>
<li>Acknowledgments: We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. We also thank MITRE&#39;s CVE Assignment Team.</li>
</ul>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd" rel="nofollow">First release candidate for NetBSD 9.0 available!</a></h3>

<ul>
<li>Since the start of the release process four months ago a lot of improvements went into the branch - more than 500 pullups were processed!</li>
<li>This includes usbnet (a common framework for usb ethernet drivers), aarch64 stability enhancements and lots of new hardware support, installer/sysinst fixes and changes to the NVMM (hardware virtualization) interface.</li>
<li>We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).</li>
<li><p>Here are a few highlights of the new release:</p>

<blockquote>
<p>Support for Arm AArch64 (64-bit Armv8-A) machines, including &quot;Arm ServerReady&quot;<br>
compliant machines (SBBR+SBSA)<br>
Enhanced hardware support for Armv7-A<br>
Updated GPU drivers (e.g. support for Intel Kabylake)<br>
Enhanced virtualization support<br>
Support for hardware-accelerated virtualization (NVMM)<br>
Support for Performance Monitoring Counters<br>
Support for Kernel ASLR<br>
Support several kernel sanitizers (KLEAK, KASAN, KUBSAN)<br>
Support for userland sanitizers<br>
Audit of the network stack<br>
Many improvements in NPF<br>
Updated ZFS<br>
Reworked error handling and NCQ support in the SATA subsystem<br>
Support a common framework for USB Ethernet drivers (usbnet)</p>
</blockquote></li>
<li><p>More information on the RC can be found on the <a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html" rel="nofollow">NetBSD 9 release page</a></p></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.shlomimarco.com/post/running-freenas-on-a-digitalocean-droplet" rel="nofollow">Running FreeNAS on a Digitalocean droplet</a></h3>

<ul>
<li>ZFS is awesome. FreeBSD even more so. FreeNAS is the battle-tested, enterprise-ready-yet-home-user-friendly software defined storage solution which is cooler then deep space, based on FreeBSD and makes heavy use of ZFS. This is what I (and soooooo many others) use for just about any storage-related task. I can go on and on and on about what makes it great, but if you&#39;re here, reading this, you probably know all that already and we can skip ahead.</li>
<li>I&#39;ve needed an offsite FreeNAS setup to replicate things to, to run some things, to do some stuff, basically, my privately-owned, tightly-controlled NAS appliance in the cloud, one I control from top to bottom and with support for whatever crazy thing I&#39;m trying to do. Since I&#39;m using DigitalOcean as my main VPS provider, it seemed logical to run FreeNAS there, however, you can&#39;t. While DO supports many many distos and pre-setup applications (e.g OpenVPN), FreeNAS isn&#39;t a supported feature, at least not in the traditional way :)</li>
<li>Before we begin, here&#39;s the gist of what we&#39;re going to do:</li>
</ul>

<blockquote>
<p>Base of a FreeBSD droplet, we&#39;ll re-image our boot block device with FreeNAS iso. We&#39;ll then install FreeNAS on the second block device. Once done we&#39;re going to do the ol&#39; switcheroo: we&#39;re going to re-image our original boot block device using the now FreeNAS-installed second block device. </p>
</blockquote>

<ul>
<li>Part 1: re-image our boot block device to boot FreeNAS install media.</li>
<li>Part 2: Install FreeNAS on the second block-device</li>
<li>Part 3: Re-image the boot block device using the FreeNAS-installed block device</li>
</ul>

<hr>

<h3><a href="https://nomadbsd.org/" rel="nofollow">NomadBSD 1.3 is now available</a></h3>

<ul>
<li>From the release notes:</li>
</ul>

<blockquote>
<p>The base system has been changed to FreeBSD 12.1-RELEASE-p1<br>
 Due to a deadlock problem, FreeBSD&#39;s unionfs has been replaced by unionfs-fuse<br>
 The GPT layout has been changed to MBR. This prevents problems with Lenovo<br>
 systems that refuse to boot from GPT if &quot;lenovofix&quot; is not set, and systems that<br>
 hang on boot if &quot;lenovofix&quot; is set.<br>
 Support for ZFS installations has been added to the NomadBSD installer.<br>
 The rc-script for setting up the network interfaces has been fixed and improved.<br>
 Support for setting the country code for the wlan device has been added.<br>
 Auto configuration for running in VirtualBox has been added.<br>
 A check for the default display has been added to the graphics configuration scripts. This fixes problems where users with Optimus have their NVIDIA card disabled, and use the integrated graphics chip instead.<br>
 NVIDIA driver version 440 has been added.<br>
 nomadbsd-dmconfig, a Qt tool for selecting the display manager theme, setting the<br>
default user and autologin has been added.<br>
 nomadbsd-adduser, a Qt tool for added preconfigured user accounts to the system has been added.<br>
 Martin Orszulik added Czech translations to the setup and installation wizard.<br>
 The NomadBSD logo, designed by Ian Grindley, has been changed.<br>
 Support for localized error messages has been added.<br>
 Support for localizing the password prompts has been added.<br>
 Some templates for starting other DEs have been added to ~/.xinitrc.<br>
 The interfaces of nomadbsd-setup-gui and nomadbsd-install-gui have been improved.<br>
 A script that helps users to configure a multihead systems has been added.<br>
 The Xorg driver for newer Intel GPUs has been changed from &quot;intel&quot; to &quot;modesetting&quot;.<br>
 /proc has been added to /etc/fstab<br>
 A D-Bus session issue has been fixed which prevented thunar from accessing  samba shares.<br>
 DSBBg which allows users to change and manage wallpapers has been added.<br>
 The latest version of update_obmenu now supports auto-updating the Openbox menu. Manually updating the Openbox menu after packet (de)installation is therefore no longer needed.</p>

<p>Support for multiple keyboard layouts has been added.<br>
 www/palemoon has been removed.<br>
 mail/thunderbird has been removed.<br>
 audio/audacity has been added.<br>
 deskutils/orage has been added.<br>
 the password manager fpm2 has been replaced by KeePassXC<br>
 mail/sylpheed has been replaced by mail/claws-mail<br>
 multimedia/simplescreenrecorder has been added.<br>
 DSBMC has been changed to DSBMC-Qt<br>
 Many small improvements and bug fixes.</p>
</blockquote>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20191204170908" rel="nofollow">At e2k19 nobody can hear you scream</a></h3>

<ul>
<li>After 2 years it was once again time to pack skis and snowshoes, put a satellite dish onto a sledge and hike through the snowy rockies to the Elk Lakes hut.</li>
<li>I did not really have much of a plan what I wanted to work on but there were a few things I wanted to look into. One of them was rpki-client and the fact that it was so incredibly slow. Since Bob beck@ was around I started to ask him innocent X509 questions ... as if there are innocent X509 questions! Mainly about the abuse of the X509_STORE in rpki-client. Pretty soon it was clear that rpki-client did it all wrong and most of the X509 verification had to be rewritten. Instead of only storing the root certificates in the store and passing the intermediate certs as a chain to the verification function rpki-client threw everything into it. The X509_STORE is just not built for such an abuse and so it was no wonder that this was slow.</li>
<li>Lucky me I pulled benno@ with me into this dark hole of libcrypto code. He managed to build up an initial diff to pass the chains as a STACK_OF(X509) and together we managed to get it working. A big thanks goes to ingo@ who documented most of the functions we had to use. Have a look at STACK_OF(3) and sk_pop_free(3) to understand why benno@ and I slowly turned crazy.</li>
<li>Our next challenge was to only load the necessary certificate revocation list into the X509_STORE_CTX. While doing those changes it became obvious that some of the data structures needed better lookup functions. Looking up certificates was done using a linear lookup and so we replaced the internal certificate and CRL tables with RB trees for fast lookups. deraadt@ also joined the rpki-client commit fest and changed the output code to use rename(2) so that files are replaced in an atomic operation. Thanks to this rpki-client can now be safely run from cron (there is an example in the default crontab).</li>
<li>I did not plan to spend most of my week hacking on rpki-client but in the end I&#39;m happy that I did and the result is fairly impressive. Working with libcrypto code and especially X509 was less than pleasant. Our screams of agony died away in the snowy rocky mountains and made Bob deep dive into UVM with a smile since he knew that benno@ and I had it worse.</li>
<li>In case you wonder thanks to all changes at e2k19 rpki-client improved from over 20min run time to validate all VRPS to roughly 1min to do the same job. A factor 20 improvement!</li>
<li>Thanks to Theo, Bob and Howie to make this possible. To all the cooks for the great food and to Xplornet for providing us with Internet at the hut.</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://fosdem.org/2020/schedule/track/bsd/" rel="nofollow">FOSDEM 2020 BSD Devroom schedule</a></li>
<li><a href="https://www.freebsdfoundation.org/freebsd/how-to-guides/easy-minecraft-server-on-freebsd/" rel="nofollow">Easy Minecraft Server on FreeBSD Howto</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=355304" rel="nofollow">stats(3) framework in the TCP stack</a></li>
<li><a href="https://twitter.com/EdwinKremer/status/1203071684535889921" rel="nofollow">4017 days of uptime</a></li>
<li><a href="https://github.com/emilengler/sysget" rel="nofollow">sysget - A front-end for every package manager</a></li>
<li><a href="https://www.playonbsd.com/shopping_guide/" rel="nofollow">PlayOnBSD’s Cross-BSD Shopping Guide</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2FDN26X#wrap" rel="nofollow">Pat asks about the proper disk drive type for ZFS</a></li>
<li><a href="http://dpaste.com/2X8PBMC#wrap" rel="nofollow">Brad asks about a ZFS rosetta stone</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0330.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video><p>Special Guest: Mariusz Zaborski.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>329: Lucas’ Arts</title>
  <link>https://www.bsdnow.tv/329</link>
  <guid isPermaLink="false">ca9f1431-2af7-48ad-98d6-e68c253ec75b</guid>
  <pubDate>Thu, 19 Dec 2019 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ca9f1431-2af7-48ad-98d6-e68c253ec75b.mp3" length="36780535" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this episode, we interview Michael W. Lucas about his latest book projects, including the upcoming SNMP Mastery book.</itunes:subtitle>
  <itunes:duration>51:05</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this episode, we interview Michael W. Lucas about his latest book projects, including the upcoming SNMP Mastery book.
Interview - Michael Lucas
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

  
  Your browser does not support the HTML5 video tag.
 Special Guest: Michael W Lucas.
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, Michael W. Lucas, Lucas, books, writing, self-publishing, publishing,  Sudo, sudo mastery, snmp, snmp mastery, bsdcan, fiction, non-fiction</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this episode, we interview Michael W. Lucas about his latest book projects, including the upcoming SNMP Mastery book.</p>

<h3>Interview - Michael Lucas</h3>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
  <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0329.mp4">
  Your browser does not support the HTML5 video tag.
</video><p>Special Guest: Michael W Lucas.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this episode, we interview Michael W. Lucas about his latest book projects, including the upcoming SNMP Mastery book.</p>

<h3>Interview - Michael Lucas</h3>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
  <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0329.mp4">
  Your browser does not support the HTML5 video tag.
</video><p>Special Guest: Michael W Lucas.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>328: EPYC Netflix Stack</title>
  <link>https://www.bsdnow.tv/328</link>
  <guid isPermaLink="false">be8ded86-58b0-46af-ba11-af5a748bc3d8</guid>
  <pubDate>Thu, 12 Dec 2019 07:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/be8ded86-58b0-46af-ba11-af5a748bc3d8.mp3" length="41556868" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>LLDB Threading support now ready, Multiple IPSec VPN tunnels with FreeBSD, Netflix Optimized FreeBSD's Network Stack More Than Doubled AMD EPYC Performance, happy eyeballs with unwind(8), AWS got FreeBSD ARM 12, OpenSSH U2F/FIDO support, and more.</itunes:subtitle>
  <itunes:duration>57:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>LLDB Threading support now ready, Multiple IPSec VPN tunnels with FreeBSD, Netflix Optimized FreeBSD's Network Stack More Than Doubled AMD EPYC Performance, happy eyeballs with unwind(8), AWS got FreeBSD ARM 12, OpenSSH U2F/FIDO support, and more.
Headlines
LLDB Threading support now ready for mainline (https://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready)
Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.
In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I've started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.
So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I've finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.
Multiple IPSec VPN tunnels with FreeBSD (https://blog.socruel.nu/text-only/how-to-multiple-ipsec-vpn-tunnels-on-freebsd.txt)
The FreeBSD handbook describes an IPSec VPN tunnel between 2 FreeBSD hosts (see https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html)
But it is also possible to have multiple, 2 or more, IPSec VPN tunnels created and running on a FreeBSD host. How to implement and configure this is described below.
The requirements is to have 3 locations (A, B and C) connected with IPSec VPN tunnels using FreeBSD (11.3-RELEASE).
Each location has 1 IPSec VPN host running FreeBSD (VPN host A, B and C).
VPN host A has 2 IPSec VPN tunnels: 1 to location B (VPN host B) and 1 to location C (VPN host C).
News Roundup
Netflix Optimized FreeBSD's Network Stack More Than Doubled AMD EPYC Performance (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=Netflix-NUMA-FreeBSD-Optimized)
Drew Gallatin of Netflix presented at the recent EuroBSDcon 2019 conference in Norway on the company's network stack optimizations to FreeBSD. Netflix was working on being able to deliver 200Gb/s network performance for video streaming out of Intel Xeon and AMD EPYC servers, to which they are now at 190Gb/s+ and in the process that doubled the potential of EPYC Naples/Rome servers and also very hefty upgrades too for Intel.
Netflix has long been known to be using FreeBSD in their data centers particularly where network performance is concerned. But in wanting to deliver 200Gb/s throughput from individual servers led them to making NUMA optimizations to the FreeBSD network stack. Allocating NUMA local memory for kernel TLS crypto buffers and for backing files sent via sentfile were among their optimizations. Changes to network connection handling and dealing with incoming connections to Nginx were also made.
For those just wanting the end result, Netflix's NUMA optimizations to FreeBSD resulted in their Intel Xeon servers going from 105Gb/s to 191Gb/s while the NUMA fabric utilization dropped from 40% to 13%.
unwind(8); "happy eyeballs" (https://marc.info/?l=openbsd-tech&amp;amp;m=157475113130337&amp;amp;w=2)
In case you are wondering why happy eyeballs: It's a variation on this:
https://en.wikipedia.org/wiki/Happy_Eyeballs
unwind has a concept of a best nameserver type. It considers a configured DoT nameserver to be better than doing it's own recursive resolving. Recursive resolving is considered to be better than asking the dhcp provided nameservers.
This diff sorts the nameserver types by quality, as above (validation, resolving, dead...), and as a tie breaker it adds the median of the round trip time of previous queries into the mix. 
One other interesting thing about this is that it gets us past captive portals without a check URL, that's why this diff is so huge, it rips out all the captive portal stuff (please apply with patch -E):
 17 files changed, 385 insertions(+), 1683 deletions(-)
Please test this. I'm particularly interested in reports from people who move between networks and need to get past captive portals.
Amazon now has FreeBSD ARM 12 (https://aws.amazon.com/marketplace/pp/B081NF7BY7)
Product Overview
FreeBSD is an operating system used to power servers, desktops, and embedded systems. Derived from BSD, the version of UNIX developed at the University of California, Berkeley, FreeBSD has been continually developed by a large community for more than 30 years.
FreeBSD's networking, security, storage, and monitoring features, including the pf firewall, the Capsicum and CloudABI capability frameworks, the ZFS filesystem, and the DTrace dynamic tracing framework, make FreeBSD the platform of choice for many of the busiest web sites and most pervasive embedded networking and storage systems.
OpenSSH U2F/FIDO support in base (https://www.undeadly.org/cgi?action=article;sid=20191115064850)
I just committed all the dependencies for OpenSSH security key (U2F) support to base and tweaked OpenSSH to use them directly. This means there will be no additional configuration hoops to jump through to use U2F/FIDO2 security keys.
Hardware backed keys can be generated using "ssh-keygen -t ecdsa-sk" (or "ed25519-sk" if your token supports it). Many tokens require to be touched/tapped to confirm this step.
You'll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a "key handle" that is used by the security key to derive the real private key at signing time.
So, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything. 
Once you have generated a key, you can use it normally - i.e. add it to an agent, copy it to your destination's authorized_keys files (assuming they are running -current too), etc. At authentication time, you will be prompted to tap your security key to confirm the signature operation - this makes theft-of-access attacks against security keys more difficult too.
Please test this thoroughly - it's a big change that we want to have stable before the next release.
Beastie Bits
DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud (http://lists.dragonflybsd.org/pipermail/commits/2019-November/719945.html)
Really fast Markov chains in ~20 lines of sh, grep, cut and awk (https://0x0f0f0f.github.io/posts/2019/11/really-fast-markov-chains-in-~20-lines-of-sh-grep-cut-and-awk/)
FreeBSD Journal Sept/Oct 2019 (https://www.freebsdfoundation.org/past-issues/security-3/)
Michael Dexter is raising money for Bhyve development (https://twitter.com/michaeldexter/status/1201231729228308480)
syscall call-from verification (https://marc.info/?l=openbsd-tech&amp;amp;m=157488907117170)
FreeBSD Forums Howto Section (https://forums.freebsd.org/forums/howtos-and-faqs-moderated.39/)
Feedback/Questions
Jeroen - Feedback (http://dpaste.com/0PK1EG2#wrap)
Savo - pfsense ports (http://dpaste.com/0PZ03B7#wrap)
Tin - I want to learn C (http://dpaste.com/2GVNCYB#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, lldb, threading, ipsec, vpn, tunnel, netflix, optimized, network stack, amd, amd epyc, performance, unwind, eyeballs, aws, arm, arm 12, openssh, u2f, fido</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>LLDB Threading support now ready, Multiple IPSec VPN tunnels with FreeBSD, Netflix Optimized FreeBSD&#39;s Network Stack More Than Doubled AMD EPYC Performance, happy eyeballs with unwind(8), AWS got FreeBSD ARM 12, OpenSSH U2F/FIDO support, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready" rel="nofollow">LLDB Threading support now ready for mainline</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>

<p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I&#39;ve started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p>

<p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I&#39;ve finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p>
</blockquote>

<hr>

<h3><a href="https://blog.socruel.nu/text-only/how-to-multiple-ipsec-vpn-tunnels-on-freebsd.txt" rel="nofollow">Multiple IPSec VPN tunnels with FreeBSD</a></h3>

<blockquote>
<p>The FreeBSD handbook describes an IPSec VPN tunnel between 2 FreeBSD hosts (see <a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html" rel="nofollow">https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html</a>)</p>
</blockquote>

<p>But it is also possible to have multiple, 2 or more, IPSec VPN tunnels created and running on a FreeBSD host. How to implement and configure this is described below.</p>

<blockquote>
<p>The requirements is to have 3 locations (A, B and C) connected with IPSec VPN tunnels using FreeBSD (11.3-RELEASE).</p>

<p>Each location has 1 IPSec VPN host running FreeBSD (VPN host A, B and C).</p>

<p>VPN host A has 2 IPSec VPN tunnels: 1 to location B (VPN host B) and 1 to location C (VPN host C).</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=Netflix-NUMA-FreeBSD-Optimized" rel="nofollow">Netflix Optimized FreeBSD&#39;s Network Stack More Than Doubled AMD EPYC Performance</a></h3>

<blockquote>
<p>Drew Gallatin of Netflix presented at the recent EuroBSDcon 2019 conference in Norway on the company&#39;s network stack optimizations to FreeBSD. Netflix was working on being able to deliver 200Gb/s network performance for video streaming out of Intel Xeon and AMD EPYC servers, to which they are now at 190Gb/s+ and in the process that doubled the potential of EPYC Naples/Rome servers and also very hefty upgrades too for Intel.</p>

<p>Netflix has long been known to be using FreeBSD in their data centers particularly where network performance is concerned. But in wanting to deliver 200Gb/s throughput from individual servers led them to making NUMA optimizations to the FreeBSD network stack. Allocating NUMA local memory for kernel TLS crypto buffers and for backing files sent via sentfile were among their optimizations. Changes to network connection handling and dealing with incoming connections to Nginx were also made.</p>

<p>For those just wanting the end result, Netflix&#39;s NUMA optimizations to FreeBSD resulted in their Intel Xeon servers going from 105Gb/s to 191Gb/s while the NUMA fabric utilization dropped from 40% to 13%.</p>
</blockquote>

<hr>

<h3><a href="https://marc.info/?l=openbsd-tech&m=157475113130337&w=2" rel="nofollow">unwind(8); &quot;happy eyeballs&quot;</a></h3>

<blockquote>
<p>In case you are wondering why happy eyeballs: It&#39;s a variation on this:<br>
<a href="https://en.wikipedia.org/wiki/Happy_Eyeballs" rel="nofollow">https://en.wikipedia.org/wiki/Happy_Eyeballs</a></p>

<p>unwind has a concept of a best nameserver type. It considers a configured DoT nameserver to be better than doing it&#39;s own recursive resolving. Recursive resolving is considered to be better than asking the dhcp provided nameservers.</p>

<p>This diff sorts the nameserver types by quality, as above (validation, resolving, dead...), and as a tie breaker it adds the median of the round trip time of previous queries into the mix. </p>

<p>One other interesting thing about this is that it gets us past captive portals without a check URL, that&#39;s why this diff is so huge, it rips out all the captive portal stuff (please apply with patch -E):<br>
 17 files changed, 385 insertions(+), 1683 deletions(-)</p>

<p>Please test this. I&#39;m particularly interested in reports from people who move between networks and need to get past captive portals.</p>
</blockquote>

<hr>

<h3><a href="https://aws.amazon.com/marketplace/pp/B081NF7BY7" rel="nofollow">Amazon now has FreeBSD ARM 12</a></h3>

<blockquote>
<p>Product Overview</p>

<p>FreeBSD is an operating system used to power servers, desktops, and embedded systems. Derived from BSD, the version of UNIX developed at the University of California, Berkeley, FreeBSD has been continually developed by a large community for more than 30 years.</p>

<p>FreeBSD&#39;s networking, security, storage, and monitoring features, including the pf firewall, the Capsicum and CloudABI capability frameworks, the ZFS filesystem, and the DTrace dynamic tracing framework, make FreeBSD the platform of choice for many of the busiest web sites and most pervasive embedded networking and storage systems.</p>
</blockquote>

<hr>

<h3><a href="https://www.undeadly.org/cgi?action=article;sid=20191115064850" rel="nofollow">OpenSSH U2F/FIDO support in base</a></h3>

<blockquote>
<p>I just committed all the dependencies for OpenSSH security key (U2F) support to base and tweaked OpenSSH to use them directly. This means there will be no additional configuration hoops to jump through to use U2F/FIDO2 security keys.</p>

<p>Hardware backed keys can be generated using &quot;ssh-keygen -t ecdsa-sk&quot; (or &quot;ed25519-sk&quot; if your token supports it). Many tokens require to be touched/tapped to confirm this step.</p>

<p>You&#39;ll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a &quot;key handle&quot; that is used by the security key to derive the real private key at signing time.</p>

<p>So, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything. </p>

<p>Once you have generated a key, you can use it normally - i.e. add it to an agent, copy it to your destination&#39;s authorized_keys files (assuming they are running -current too), etc. At authentication time, you will be prompted to tap your security key to confirm the signature operation - this makes theft-of-access attacks against security keys more difficult too.</p>

<p>Please test this thoroughly - it&#39;s a big change that we want to have stable before the next release.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-November/719945.html" rel="nofollow">DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud</a></li>
<li><a href="https://0x0f0f0f.github.io/posts/2019/11/really-fast-markov-chains-in-%7E20-lines-of-sh-grep-cut-and-awk/" rel="nofollow">Really fast Markov chains in ~20 lines of sh, grep, cut and awk</a></li>
<li><a href="https://www.freebsdfoundation.org/past-issues/security-3/" rel="nofollow">FreeBSD Journal Sept/Oct 2019</a></li>
<li><a href="https://twitter.com/michaeldexter/status/1201231729228308480" rel="nofollow">Michael Dexter is raising money for Bhyve development</a></li>
<li><a href="https://marc.info/?l=openbsd-tech&m=157488907117170" rel="nofollow">syscall call-from verification</a></li>
<li><a href="https://forums.freebsd.org/forums/howtos-and-faqs-moderated.39/" rel="nofollow">FreeBSD Forums Howto Section</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Jeroen - <a href="http://dpaste.com/0PK1EG2#wrap" rel="nofollow">Feedback</a></li>
<li>Savo - <a href="http://dpaste.com/0PZ03B7#wrap" rel="nofollow">pfsense ports</a></li>
<li>Tin - <a href="http://dpaste.com/2GVNCYB#wrap" rel="nofollow">I want to learn C</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0328.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>LLDB Threading support now ready, Multiple IPSec VPN tunnels with FreeBSD, Netflix Optimized FreeBSD&#39;s Network Stack More Than Doubled AMD EPYC Performance, happy eyeballs with unwind(8), AWS got FreeBSD ARM 12, OpenSSH U2F/FIDO support, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready" rel="nofollow">LLDB Threading support now ready for mainline</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>

<p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I&#39;ve started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p>

<p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I&#39;ve finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p>
</blockquote>

<hr>

<h3><a href="https://blog.socruel.nu/text-only/how-to-multiple-ipsec-vpn-tunnels-on-freebsd.txt" rel="nofollow">Multiple IPSec VPN tunnels with FreeBSD</a></h3>

<blockquote>
<p>The FreeBSD handbook describes an IPSec VPN tunnel between 2 FreeBSD hosts (see <a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html" rel="nofollow">https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html</a>)</p>
</blockquote>

<p>But it is also possible to have multiple, 2 or more, IPSec VPN tunnels created and running on a FreeBSD host. How to implement and configure this is described below.</p>

<blockquote>
<p>The requirements is to have 3 locations (A, B and C) connected with IPSec VPN tunnels using FreeBSD (11.3-RELEASE).</p>

<p>Each location has 1 IPSec VPN host running FreeBSD (VPN host A, B and C).</p>

<p>VPN host A has 2 IPSec VPN tunnels: 1 to location B (VPN host B) and 1 to location C (VPN host C).</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=Netflix-NUMA-FreeBSD-Optimized" rel="nofollow">Netflix Optimized FreeBSD&#39;s Network Stack More Than Doubled AMD EPYC Performance</a></h3>

<blockquote>
<p>Drew Gallatin of Netflix presented at the recent EuroBSDcon 2019 conference in Norway on the company&#39;s network stack optimizations to FreeBSD. Netflix was working on being able to deliver 200Gb/s network performance for video streaming out of Intel Xeon and AMD EPYC servers, to which they are now at 190Gb/s+ and in the process that doubled the potential of EPYC Naples/Rome servers and also very hefty upgrades too for Intel.</p>

<p>Netflix has long been known to be using FreeBSD in their data centers particularly where network performance is concerned. But in wanting to deliver 200Gb/s throughput from individual servers led them to making NUMA optimizations to the FreeBSD network stack. Allocating NUMA local memory for kernel TLS crypto buffers and for backing files sent via sentfile were among their optimizations. Changes to network connection handling and dealing with incoming connections to Nginx were also made.</p>

<p>For those just wanting the end result, Netflix&#39;s NUMA optimizations to FreeBSD resulted in their Intel Xeon servers going from 105Gb/s to 191Gb/s while the NUMA fabric utilization dropped from 40% to 13%.</p>
</blockquote>

<hr>

<h3><a href="https://marc.info/?l=openbsd-tech&m=157475113130337&w=2" rel="nofollow">unwind(8); &quot;happy eyeballs&quot;</a></h3>

<blockquote>
<p>In case you are wondering why happy eyeballs: It&#39;s a variation on this:<br>
<a href="https://en.wikipedia.org/wiki/Happy_Eyeballs" rel="nofollow">https://en.wikipedia.org/wiki/Happy_Eyeballs</a></p>

<p>unwind has a concept of a best nameserver type. It considers a configured DoT nameserver to be better than doing it&#39;s own recursive resolving. Recursive resolving is considered to be better than asking the dhcp provided nameservers.</p>

<p>This diff sorts the nameserver types by quality, as above (validation, resolving, dead...), and as a tie breaker it adds the median of the round trip time of previous queries into the mix. </p>

<p>One other interesting thing about this is that it gets us past captive portals without a check URL, that&#39;s why this diff is so huge, it rips out all the captive portal stuff (please apply with patch -E):<br>
 17 files changed, 385 insertions(+), 1683 deletions(-)</p>

<p>Please test this. I&#39;m particularly interested in reports from people who move between networks and need to get past captive portals.</p>
</blockquote>

<hr>

<h3><a href="https://aws.amazon.com/marketplace/pp/B081NF7BY7" rel="nofollow">Amazon now has FreeBSD ARM 12</a></h3>

<blockquote>
<p>Product Overview</p>

<p>FreeBSD is an operating system used to power servers, desktops, and embedded systems. Derived from BSD, the version of UNIX developed at the University of California, Berkeley, FreeBSD has been continually developed by a large community for more than 30 years.</p>

<p>FreeBSD&#39;s networking, security, storage, and monitoring features, including the pf firewall, the Capsicum and CloudABI capability frameworks, the ZFS filesystem, and the DTrace dynamic tracing framework, make FreeBSD the platform of choice for many of the busiest web sites and most pervasive embedded networking and storage systems.</p>
</blockquote>

<hr>

<h3><a href="https://www.undeadly.org/cgi?action=article;sid=20191115064850" rel="nofollow">OpenSSH U2F/FIDO support in base</a></h3>

<blockquote>
<p>I just committed all the dependencies for OpenSSH security key (U2F) support to base and tweaked OpenSSH to use them directly. This means there will be no additional configuration hoops to jump through to use U2F/FIDO2 security keys.</p>

<p>Hardware backed keys can be generated using &quot;ssh-keygen -t ecdsa-sk&quot; (or &quot;ed25519-sk&quot; if your token supports it). Many tokens require to be touched/tapped to confirm this step.</p>

<p>You&#39;ll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a &quot;key handle&quot; that is used by the security key to derive the real private key at signing time.</p>

<p>So, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything. </p>

<p>Once you have generated a key, you can use it normally - i.e. add it to an agent, copy it to your destination&#39;s authorized_keys files (assuming they are running -current too), etc. At authentication time, you will be prompted to tap your security key to confirm the signature operation - this makes theft-of-access attacks against security keys more difficult too.</p>

<p>Please test this thoroughly - it&#39;s a big change that we want to have stable before the next release.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-November/719945.html" rel="nofollow">DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud</a></li>
<li><a href="https://0x0f0f0f.github.io/posts/2019/11/really-fast-markov-chains-in-%7E20-lines-of-sh-grep-cut-and-awk/" rel="nofollow">Really fast Markov chains in ~20 lines of sh, grep, cut and awk</a></li>
<li><a href="https://www.freebsdfoundation.org/past-issues/security-3/" rel="nofollow">FreeBSD Journal Sept/Oct 2019</a></li>
<li><a href="https://twitter.com/michaeldexter/status/1201231729228308480" rel="nofollow">Michael Dexter is raising money for Bhyve development</a></li>
<li><a href="https://marc.info/?l=openbsd-tech&m=157488907117170" rel="nofollow">syscall call-from verification</a></li>
<li><a href="https://forums.freebsd.org/forums/howtos-and-faqs-moderated.39/" rel="nofollow">FreeBSD Forums Howto Section</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Jeroen - <a href="http://dpaste.com/0PK1EG2#wrap" rel="nofollow">Feedback</a></li>
<li>Savo - <a href="http://dpaste.com/0PZ03B7#wrap" rel="nofollow">pfsense ports</a></li>
<li>Tin - <a href="http://dpaste.com/2GVNCYB#wrap" rel="nofollow">I want to learn C</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0328.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>327: ZFS Rename Repo</title>
  <link>https://www.bsdnow.tv/327</link>
  <guid isPermaLink="false">18bee756-2b2e-45ed-bcf1-403549bf6a32</guid>
  <pubDate>Thu, 05 Dec 2019 07:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/18bee756-2b2e-45ed-bcf1-403549bf6a32.mp3" length="60093881" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We read FreeBSD’s third quarterly status report, OpenBSD on Sparc64, ZoL repo move to OpenZFS, GEOM NOP, keeping NetBSD up-to-date, and more.</itunes:subtitle>
  <itunes:duration>1:23:27</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We read FreeBSD’s third quarterly status report, OpenBSD on Sparc64, ZoL repo move to OpenZFS, GEOM NOP, keeping NetBSD up-to-date, and more.
Headlines
FreeBSD third quarterly status report for 2019 (https://www.freebsd.org/news/status/report-2019-07-2019-09.html)
This quarter the reports team has been more active than usual thanks to a better organization: calls for reports and reminders have been sent regularly, reports have been reviewed and merged quickly (I would like to thank debdrup@ in particular for his reviewing work).
Efficiency could still be improved with the help of our community. In particular, the quarterly team has found that many reports have arrived in the last days before the deadline or even after. I would like to invite the community to follow the guidelines below that can help us sending out the reports sooner.
Starting from next quarter, all quarterly status reports will be prepared the last month of the quarter itself, instead of the first month after the quarter's end. This means that deadlines for submitting reports will be the 1st of January, April, July and October.
Next quarter will then be a short one, covering the months of November and December only and the report will probably be out in mid January.
OpenBSD on Sparc64 (https://eerielinux.wordpress.com/2019/10/10/openbsd-on-sparc64-6-0-to-6-5/)
OpenBSD, huh? Yes, I usually write about FreeBSD and that’s in fact what I tried installing on the machine first. But I ran into problems with it very early on (never even reached single user mode) and put it aside for later. Since I powered up the SunFire again last month, I needed an OS now and chose OpenBSD for the simple reason that I have it available.
First I wanted to call this article simply “OpenBSD on SPARC” – but that would have been misleading since OpenBSD used to support 32-bit SPARC processors, too. The platform was just put to rest after the 5.9 release.
Version 6.0 was the last release of OpenBSD that came on CD-ROM. When I bought it, I thought that I’d never use the SPARC CD. But here was the chance! While it is an obsolete release, it comes with the cryptographic signatures to verify the next release. So the plan is to start at 6.0 as I can trust the original CDs and then update to the latest release. This will also be an opportunity to recap on some of the things that changed over the various versions.
News Roundup
ZoL repo move to OpenZFS (https://zfsonlinux.topicbox.com/groups/zfs-discuss/T13eedc32607dab41/zol-repo-move-to-openzfs)
Because it will contain the ZFS source code for both Linux and FreeBSD, we will rename the "ZFSonLinux" code repository to "OpenZFS".  Specifically, the repo at http://github.com/ZFSonLinux/zfs will be moved to the OpenZFS organization, at http://github.com/OpenZFS/zfs.
The next major release of ZFS for Linux and FreeBSD will be "OpenZFS 2.0", and is expected to ship in 2020.
Mcclure111 Sun Thread (https://twitter.com/mcclure111/status/1196557401710837762)
A long time ago— like 15 years ago— I worked at Sun Microsystems. The company was nearly dead at the time (it died a couple years later) because they didn't make anything that anyone wanted to buy anymore. So they had a lot of strange ideas about how they'd make their comeback.
GEOM NOP (https://oshogbo.vexillium.org/blog/71/)
Sometimes while testing file systems or applications you want to simulate some errors on the disk level. The first time I heard about this need was from Baptiste Daroussin during his presentation at AsiaBSDCon 2016. He mentioned how they had built a test lab with it. The same need was recently discussed during the PGCon 2019, to test a PostgreSQL instance. If you are FreeBSD user, I have great news for you: there is a GEOM provider which allows you to simulate a failing device.
GNOP allows us to configure transparent providers from existing ones. The first interesting option of it is that we can slice the device into smaller pieces, thanks to the ‘offset option’ and ‘stripsesize’. This allows us to observe how the data on the disk is changing. Let’s assume that we want to observe the changes in the GPT table when the GPT flags are added or removed (for example the bootme flags which are described here). We can use dd every time and analyze it using absolute values from the disks.
Keeping NetBSD up-to-date with pkg_comp 2.0 (https://jmmv.dev/2017/02/pkg_comp-2.0-tutorial-netbsd.html)
This is a tutorial to guide you through the shiny new pkg_comp 2.0 on NetBSD.
Goals: to use pkg_comp 2.0 to build a binary repository of all the packages you are interested in; to keep the repository fresh on a daily basis; and to use that repository with pkgin to maintain your NetBSD system up-to-date and secure.
This tutorial is specifically targeted at NetBSD but should work on other platforms with some small changes. Expect, at the very least, a macOS-specific tutorial as soon as I create a pkg_comp standalone installer for that platform.
Beastie Bits
DragonFly - Radeon Improvements (http://lists.dragonflybsd.org/pipermail/commits/2019-November/720070.html)
NomadBSD review (https://www.youtube.com/watch?v=7DglP7SbnlA&amp;amp;feature=share)
Spongebob OpenBSD Security Comic (https://files.yukiisbo.red/openbsd_claim.png)
Forth : The Early Years (https://colorforth.github.io/HOPL.html)
LCM+L PDP-7 booting and running UNIX Version 0 (https://www.youtube.com/watch?v=pvaPaWyiuLA)
Feedback/Questions
Chris - Ctrl-T (http://dpaste.com/284E5BV)
Improved Ctrl+t that shows kernel backtrace (https://asciinema.org/a/xfSpvPT61Cnd9iRgbfIjT6kYj)
Brian - Migrating NexentaStore to FreeBSD/FreeNAS (http://dpaste.com/05GDK8H#wrap)
Avery - How to get involved (http://dpaste.com/26KW801#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, quarterly status, status report, report, sparc64, sun, geom, nop, gnop, uo-to-date, pkg_comp</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We read FreeBSD’s third quarterly status report, OpenBSD on Sparc64, ZoL repo move to OpenZFS, GEOM NOP, keeping NetBSD up-to-date, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2019-07-2019-09.html" rel="nofollow">FreeBSD third quarterly status report for 2019</a></h3>

<blockquote>
<p>This quarter the reports team has been more active than usual thanks to a better organization: calls for reports and reminders have been sent regularly, reports have been reviewed and merged quickly (I would like to thank debdrup@ in particular for his reviewing work).</p>

<p>Efficiency could still be improved with the help of our community. In particular, the quarterly team has found that many reports have arrived in the last days before the deadline or even after. I would like to invite the community to follow the guidelines below that can help us sending out the reports sooner.</p>

<p>Starting from next quarter, all quarterly status reports will be prepared the last month of the quarter itself, instead of the first month after the quarter&#39;s end. This means that deadlines for submitting reports will be the 1st of January, April, July and October.</p>

<p>Next quarter will then be a short one, covering the months of November and December only and the report will probably be out in mid January.</p>
</blockquote>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2019/10/10/openbsd-on-sparc64-6-0-to-6-5/" rel="nofollow">OpenBSD on Sparc64</a></h3>

<blockquote>
<p>OpenBSD, huh? Yes, I usually write about FreeBSD and that’s in fact what I tried installing on the machine first. But I ran into problems with it very early on (never even reached single user mode) and put it aside for later. Since I powered up the SunFire again last month, I needed an OS now and chose OpenBSD for the simple reason that I have it available.</p>

<p>First I wanted to call this article simply “OpenBSD on SPARC” – but that would have been misleading since OpenBSD used to support 32-bit SPARC processors, too. The platform was just put to rest after the 5.9 release.</p>

<p>Version 6.0 was the last release of OpenBSD that came on CD-ROM. When I bought it, I thought that I’d never use the SPARC CD. But here was the chance! While it is an obsolete release, it comes with the cryptographic signatures to verify the next release. So the plan is to start at 6.0 as I can trust the original CDs and then update to the latest release. This will also be an opportunity to recap on some of the things that changed over the various versions.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://zfsonlinux.topicbox.com/groups/zfs-discuss/T13eedc32607dab41/zol-repo-move-to-openzfs" rel="nofollow">ZoL repo move to OpenZFS</a></h3>

<blockquote>
<p>Because it will contain the ZFS source code for both Linux and FreeBSD, we will rename the &quot;ZFSonLinux&quot; code repository to &quot;OpenZFS&quot;.  Specifically, the repo at <a href="http://github.com/ZFSonLinux/zfs" rel="nofollow">http://github.com/ZFSonLinux/zfs</a> will be moved to the OpenZFS organization, at <a href="http://github.com/OpenZFS/zfs" rel="nofollow">http://github.com/OpenZFS/zfs</a>.</p>

<p>The next major release of ZFS for Linux and FreeBSD will be &quot;OpenZFS 2.0&quot;, and is expected to ship in 2020.</p>
</blockquote>

<hr>

<h3><a href="https://twitter.com/mcclure111/status/1196557401710837762" rel="nofollow">Mcclure111 Sun Thread</a></h3>

<blockquote>
<p>A long time ago— like 15 years ago— I worked at Sun Microsystems. The company was nearly dead at the time (it died a couple years later) because they didn&#39;t make anything that anyone wanted to buy anymore. So they had a lot of strange ideas about how they&#39;d make their comeback.</p>
</blockquote>

<hr>

<h3><a href="https://oshogbo.vexillium.org/blog/71/" rel="nofollow">GEOM NOP</a></h3>

<blockquote>
<p>Sometimes while testing file systems or applications you want to simulate some errors on the disk level. The first time I heard about this need was from Baptiste Daroussin during his presentation at AsiaBSDCon 2016. He mentioned how they had built a test lab with it. The same need was recently discussed during the PGCon 2019, to test a PostgreSQL instance. If you are FreeBSD user, I have great news for you: there is a GEOM provider which allows you to simulate a failing device.</p>

<p>GNOP allows us to configure transparent providers from existing ones. The first interesting option of it is that we can slice the device into smaller pieces, thanks to the ‘offset option’ and ‘stripsesize’. This allows us to observe how the data on the disk is changing. Let’s assume that we want to observe the changes in the GPT table when the GPT flags are added or removed (for example the bootme flags which are described here). We can use dd every time and analyze it using absolute values from the disks.</p>
</blockquote>

<hr>

<h3><a href="https://jmmv.dev/2017/02/pkg_comp-2.0-tutorial-netbsd.html" rel="nofollow">Keeping NetBSD up-to-date with pkg_comp 2.0</a></h3>

<blockquote>
<p>This is a tutorial to guide you through the shiny new pkg_comp 2.0 on NetBSD.</p>

<p>Goals: to use pkg_comp 2.0 to build a binary repository of all the packages you are interested in; to keep the repository fresh on a daily basis; and to use that repository with pkgin to maintain your NetBSD system up-to-date and secure.</p>

<p>This tutorial is specifically targeted at NetBSD but should work on other platforms with some small changes. Expect, at the very least, a macOS-specific tutorial as soon as I create a pkg_comp standalone installer for that platform.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-November/720070.html" rel="nofollow">DragonFly - Radeon Improvements</a></li>
<li><a href="https://www.youtube.com/watch?v=7DglP7SbnlA&feature=share" rel="nofollow">NomadBSD review</a></li>
<li><a href="https://files.yukiisbo.red/openbsd_claim.png" rel="nofollow">Spongebob OpenBSD Security Comic</a></li>
<li><a href="https://colorforth.github.io/HOPL.html" rel="nofollow">Forth : The Early Years</a></li>
<li><a href="https://www.youtube.com/watch?v=pvaPaWyiuLA" rel="nofollow">LCM+L PDP-7 booting and running UNIX Version 0</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Chris - <a href="http://dpaste.com/284E5BV" rel="nofollow">Ctrl-T</a>

<ul>
<li><a href="https://asciinema.org/a/xfSpvPT61Cnd9iRgbfIjT6kYj" rel="nofollow">Improved Ctrl+t that shows kernel backtrace</a></li>
</ul></li>
<li>Brian - <a href="http://dpaste.com/05GDK8H#wrap" rel="nofollow">Migrating NexentaStore to FreeBSD/FreeNAS</a></li>
<li>Avery - <a href="http://dpaste.com/26KW801#wrap" rel="nofollow">How to get involved</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0327.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We read FreeBSD’s third quarterly status report, OpenBSD on Sparc64, ZoL repo move to OpenZFS, GEOM NOP, keeping NetBSD up-to-date, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2019-07-2019-09.html" rel="nofollow">FreeBSD third quarterly status report for 2019</a></h3>

<blockquote>
<p>This quarter the reports team has been more active than usual thanks to a better organization: calls for reports and reminders have been sent regularly, reports have been reviewed and merged quickly (I would like to thank debdrup@ in particular for his reviewing work).</p>

<p>Efficiency could still be improved with the help of our community. In particular, the quarterly team has found that many reports have arrived in the last days before the deadline or even after. I would like to invite the community to follow the guidelines below that can help us sending out the reports sooner.</p>

<p>Starting from next quarter, all quarterly status reports will be prepared the last month of the quarter itself, instead of the first month after the quarter&#39;s end. This means that deadlines for submitting reports will be the 1st of January, April, July and October.</p>

<p>Next quarter will then be a short one, covering the months of November and December only and the report will probably be out in mid January.</p>
</blockquote>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2019/10/10/openbsd-on-sparc64-6-0-to-6-5/" rel="nofollow">OpenBSD on Sparc64</a></h3>

<blockquote>
<p>OpenBSD, huh? Yes, I usually write about FreeBSD and that’s in fact what I tried installing on the machine first. But I ran into problems with it very early on (never even reached single user mode) and put it aside for later. Since I powered up the SunFire again last month, I needed an OS now and chose OpenBSD for the simple reason that I have it available.</p>

<p>First I wanted to call this article simply “OpenBSD on SPARC” – but that would have been misleading since OpenBSD used to support 32-bit SPARC processors, too. The platform was just put to rest after the 5.9 release.</p>

<p>Version 6.0 was the last release of OpenBSD that came on CD-ROM. When I bought it, I thought that I’d never use the SPARC CD. But here was the chance! While it is an obsolete release, it comes with the cryptographic signatures to verify the next release. So the plan is to start at 6.0 as I can trust the original CDs and then update to the latest release. This will also be an opportunity to recap on some of the things that changed over the various versions.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://zfsonlinux.topicbox.com/groups/zfs-discuss/T13eedc32607dab41/zol-repo-move-to-openzfs" rel="nofollow">ZoL repo move to OpenZFS</a></h3>

<blockquote>
<p>Because it will contain the ZFS source code for both Linux and FreeBSD, we will rename the &quot;ZFSonLinux&quot; code repository to &quot;OpenZFS&quot;.  Specifically, the repo at <a href="http://github.com/ZFSonLinux/zfs" rel="nofollow">http://github.com/ZFSonLinux/zfs</a> will be moved to the OpenZFS organization, at <a href="http://github.com/OpenZFS/zfs" rel="nofollow">http://github.com/OpenZFS/zfs</a>.</p>

<p>The next major release of ZFS for Linux and FreeBSD will be &quot;OpenZFS 2.0&quot;, and is expected to ship in 2020.</p>
</blockquote>

<hr>

<h3><a href="https://twitter.com/mcclure111/status/1196557401710837762" rel="nofollow">Mcclure111 Sun Thread</a></h3>

<blockquote>
<p>A long time ago— like 15 years ago— I worked at Sun Microsystems. The company was nearly dead at the time (it died a couple years later) because they didn&#39;t make anything that anyone wanted to buy anymore. So they had a lot of strange ideas about how they&#39;d make their comeback.</p>
</blockquote>

<hr>

<h3><a href="https://oshogbo.vexillium.org/blog/71/" rel="nofollow">GEOM NOP</a></h3>

<blockquote>
<p>Sometimes while testing file systems or applications you want to simulate some errors on the disk level. The first time I heard about this need was from Baptiste Daroussin during his presentation at AsiaBSDCon 2016. He mentioned how they had built a test lab with it. The same need was recently discussed during the PGCon 2019, to test a PostgreSQL instance. If you are FreeBSD user, I have great news for you: there is a GEOM provider which allows you to simulate a failing device.</p>

<p>GNOP allows us to configure transparent providers from existing ones. The first interesting option of it is that we can slice the device into smaller pieces, thanks to the ‘offset option’ and ‘stripsesize’. This allows us to observe how the data on the disk is changing. Let’s assume that we want to observe the changes in the GPT table when the GPT flags are added or removed (for example the bootme flags which are described here). We can use dd every time and analyze it using absolute values from the disks.</p>
</blockquote>

<hr>

<h3><a href="https://jmmv.dev/2017/02/pkg_comp-2.0-tutorial-netbsd.html" rel="nofollow">Keeping NetBSD up-to-date with pkg_comp 2.0</a></h3>

<blockquote>
<p>This is a tutorial to guide you through the shiny new pkg_comp 2.0 on NetBSD.</p>

<p>Goals: to use pkg_comp 2.0 to build a binary repository of all the packages you are interested in; to keep the repository fresh on a daily basis; and to use that repository with pkgin to maintain your NetBSD system up-to-date and secure.</p>

<p>This tutorial is specifically targeted at NetBSD but should work on other platforms with some small changes. Expect, at the very least, a macOS-specific tutorial as soon as I create a pkg_comp standalone installer for that platform.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-November/720070.html" rel="nofollow">DragonFly - Radeon Improvements</a></li>
<li><a href="https://www.youtube.com/watch?v=7DglP7SbnlA&feature=share" rel="nofollow">NomadBSD review</a></li>
<li><a href="https://files.yukiisbo.red/openbsd_claim.png" rel="nofollow">Spongebob OpenBSD Security Comic</a></li>
<li><a href="https://colorforth.github.io/HOPL.html" rel="nofollow">Forth : The Early Years</a></li>
<li><a href="https://www.youtube.com/watch?v=pvaPaWyiuLA" rel="nofollow">LCM+L PDP-7 booting and running UNIX Version 0</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Chris - <a href="http://dpaste.com/284E5BV" rel="nofollow">Ctrl-T</a>

<ul>
<li><a href="https://asciinema.org/a/xfSpvPT61Cnd9iRgbfIjT6kYj" rel="nofollow">Improved Ctrl+t that shows kernel backtrace</a></li>
</ul></li>
<li>Brian - <a href="http://dpaste.com/05GDK8H#wrap" rel="nofollow">Migrating NexentaStore to FreeBSD/FreeNAS</a></li>
<li>Avery - <a href="http://dpaste.com/26KW801#wrap" rel="nofollow">How to get involved</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0327.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>326: Certified BSD</title>
  <link>https://www.bsdnow.tv/326</link>
  <guid isPermaLink="false">4d6f5084-1255-44ce-a255-5f969e18e44d</guid>
  <pubDate>Thu, 28 Nov 2019 07:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4d6f5084-1255-44ce-a255-5f969e18e44d.mp3" length="43280010" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>LPI releases BSD Certification, openzfs trip report, Using FreeBSD with ports, LLDB threading support ready, Linux versus Open Source Unix, and more.</itunes:subtitle>
  <itunes:duration>1:00:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>LPI releases BSD Certification, openzfs trip report, Using FreeBSD with ports, LLDB threading support ready, Linux versus Open Source Unix, and more.
Headlines
Linux Professional Institute Releases BSD Specialist Certification - re BSD Certification Group (https://www.lpi.org/articles/linux-professional-institute-releases-bsd-specialist-certification)
Linux Professional Institute extends its Open Technology certification track with the BSD Specialist Certification. Starting October 30, 2019, BSD Specialist exams will be globally available. The certification was developed in collaboration with the BSD Certification Group which merged with Linux Professional Institute in 2018.
G. Matthew Rice, the Executive Director of Linux Professional Institute says that "the release of the BSD Specialist certification marks a major milestone for Linux Professional Institute.  With this new credential, we are reaffirming our belief in the value of, and support for, all open source technologies. As much as possible, future credentials and educational programs will include coverage of BSD.”
OpenZFS Trip Report (https://www.ixsystems.com/blog/openzfs-dev-summit-2019/)
The seventh annual OpenZFS Developer Summit took place on November 4th and 5th in San Francisco and brought together a healthy mix of familiar faces and new community participants. Several folks from iXsystems took part in the talks, hacking, and socializing at this amazing annual event. The messages of the event can be summed up as Unification, Refinement, and Ecosystem Tooling.
News Roundup
Using FreeBSD with Ports (2/2): Tool-assisted updating (https://eerielinux.wordpress.com/2019/09/12/using-freebsd-with-ports-2-2-tool-assisted-updating/)
Part 1 here: https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/
In the previous post I explained why sometimes building your software from ports may make sense on FreeBSD. I also introduced the reader to the old-fashioned way of using tools to make working with ports a bit more convenient.
In this follow-up post we’re going to take a closer look at portmaster and see how it especially makes updating from ports much, much easier. For people coming here without having read the previous article: What I describe here is not what every FreeBSD admin today should consider good practice (any more)! It can still be useful in special cases, but my main intention is to discuss this for building up the foundation for what you actually should do today.
LLDB Threading support now ready for mainline (http://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready)
Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.
In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I've started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.
So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I've finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.
Linux VS open source UNIX (https://www.adminbyaccident.com/politics/linux-vs-open-source-unix/)
Beastie Bits
Support for Realtek RTL8125 2.5Gb Ethernet controller (https://marc.info/?l=openbsd-tech&amp;amp;m=157380442230074&amp;amp;w=2)
Computer Files Are Going Extinct (https://onezero.medium.com/the-death-of-the-computer-file-doc-43cb028c0506)
FreeBSD kernel hacking (https://www.youtube.com/watch?v=4FUub_UtF3c)
Modern BSD Computing for Fun on a VAX! Trying to use a VAX in today's world by Jeff Armstrong (https://youtu.be/e7cJ7v2lYdE)
MidnightBSD 1.2 Released (https://www.justjournal.com/users/mbsd/entry/33779)
Feedback/Questions
Paulo - Zfs snapshots (http://dpaste.com/0WQRP43#wrap)
Phillip - GCP (http://dpaste.com/075ZQE1#wrap)
A Listener - Old episodes? (http://dpaste.com/3YJ4119#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, certification, openzfs, trip report, ports, llvm, lldb, threading, open source, open source unix,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>LPI releases BSD Certification, openzfs trip report, Using FreeBSD with ports, LLDB threading support ready, Linux versus Open Source Unix, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.lpi.org/articles/linux-professional-institute-releases-bsd-specialist-certification" rel="nofollow">Linux Professional Institute Releases BSD Specialist Certification - re BSD Certification Group</a></h3>

<blockquote>
<p>Linux Professional Institute extends its Open Technology certification track with the BSD Specialist Certification. Starting October 30, 2019, BSD Specialist exams will be globally available. The certification was developed in collaboration with the BSD Certification Group which merged with Linux Professional Institute in 2018.</p>

<p>G. Matthew Rice, the Executive Director of Linux Professional Institute says that &quot;the release of the BSD Specialist certification marks a major milestone for Linux Professional Institute.  With this new credential, we are reaffirming our belief in the value of, and support for, all open source technologies. As much as possible, future credentials and educational programs will include coverage of BSD.”</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/openzfs-dev-summit-2019/" rel="nofollow">OpenZFS Trip Report</a></h3>

<blockquote>
<p>The seventh annual OpenZFS Developer Summit took place on November 4th and 5th in San Francisco and brought together a healthy mix of familiar faces and new community participants. Several folks from iXsystems took part in the talks, hacking, and socializing at this amazing annual event. The messages of the event can be summed up as Unification, Refinement, and Ecosystem Tooling.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://eerielinux.wordpress.com/2019/09/12/using-freebsd-with-ports-2-2-tool-assisted-updating/" rel="nofollow">Using FreeBSD with Ports (2/2): Tool-assisted updating</a></h3>

<ul>
<li>Part 1 here: <a href="https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/" rel="nofollow">https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/</a></li>
</ul>

<blockquote>
<p>In the previous post I explained why sometimes building your software from ports may make sense on FreeBSD. I also introduced the reader to the old-fashioned way of using tools to make working with ports a bit more convenient.</p>

<p>In this follow-up post we’re going to take a closer look at portmaster and see how it especially makes updating from ports much, much easier. For people coming here without having read the previous article: What I describe here is not what every FreeBSD admin today should consider good practice (any more)! It can still be useful in special cases, but my main intention is to discuss this for building up the foundation for what you actually should do today.</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready" rel="nofollow">LLDB Threading support now ready for mainline</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>

<p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I&#39;ve started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p>

<p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I&#39;ve finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p>
</blockquote>

<hr>

<h3><a href="https://www.adminbyaccident.com/politics/linux-vs-open-source-unix/" rel="nofollow">Linux VS open source UNIX</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://marc.info/?l=openbsd-tech&m=157380442230074&w=2" rel="nofollow">Support for Realtek RTL8125 2.5Gb Ethernet controller</a></li>
<li><a href="https://onezero.medium.com/the-death-of-the-computer-file-doc-43cb028c0506" rel="nofollow">Computer Files Are Going Extinct</a></li>
<li><a href="https://www.youtube.com/watch?v=4FUub_UtF3c" rel="nofollow">FreeBSD kernel hacking</a></li>
<li><a href="https://youtu.be/e7cJ7v2lYdE" rel="nofollow">Modern BSD Computing for Fun on a VAX! Trying to use a VAX in today&#39;s world by Jeff Armstrong</a></li>
<li><a href="https://www.justjournal.com/users/mbsd/entry/33779" rel="nofollow">MidnightBSD 1.2 Released</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Paulo - <a href="http://dpaste.com/0WQRP43#wrap" rel="nofollow">Zfs snapshots</a></li>
<li>Phillip - <a href="http://dpaste.com/075ZQE1#wrap" rel="nofollow">GCP</a></li>
<li>A Listener - <a href="http://dpaste.com/3YJ4119#wrap" rel="nofollow">Old episodes?</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0326.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>LPI releases BSD Certification, openzfs trip report, Using FreeBSD with ports, LLDB threading support ready, Linux versus Open Source Unix, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.lpi.org/articles/linux-professional-institute-releases-bsd-specialist-certification" rel="nofollow">Linux Professional Institute Releases BSD Specialist Certification - re BSD Certification Group</a></h3>

<blockquote>
<p>Linux Professional Institute extends its Open Technology certification track with the BSD Specialist Certification. Starting October 30, 2019, BSD Specialist exams will be globally available. The certification was developed in collaboration with the BSD Certification Group which merged with Linux Professional Institute in 2018.</p>

<p>G. Matthew Rice, the Executive Director of Linux Professional Institute says that &quot;the release of the BSD Specialist certification marks a major milestone for Linux Professional Institute.  With this new credential, we are reaffirming our belief in the value of, and support for, all open source technologies. As much as possible, future credentials and educational programs will include coverage of BSD.”</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/openzfs-dev-summit-2019/" rel="nofollow">OpenZFS Trip Report</a></h3>

<blockquote>
<p>The seventh annual OpenZFS Developer Summit took place on November 4th and 5th in San Francisco and brought together a healthy mix of familiar faces and new community participants. Several folks from iXsystems took part in the talks, hacking, and socializing at this amazing annual event. The messages of the event can be summed up as Unification, Refinement, and Ecosystem Tooling.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://eerielinux.wordpress.com/2019/09/12/using-freebsd-with-ports-2-2-tool-assisted-updating/" rel="nofollow">Using FreeBSD with Ports (2/2): Tool-assisted updating</a></h3>

<ul>
<li>Part 1 here: <a href="https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/" rel="nofollow">https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/</a></li>
</ul>

<blockquote>
<p>In the previous post I explained why sometimes building your software from ports may make sense on FreeBSD. I also introduced the reader to the old-fashioned way of using tools to make working with ports a bit more convenient.</p>

<p>In this follow-up post we’re going to take a closer look at portmaster and see how it especially makes updating from ports much, much easier. For people coming here without having read the previous article: What I describe here is not what every FreeBSD admin today should consider good practice (any more)! It can still be useful in special cases, but my main intention is to discuss this for building up the foundation for what you actually should do today.</p>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready" rel="nofollow">LLDB Threading support now ready for mainline</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>

<p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I&#39;ve started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p>

<p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I&#39;ve finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p>
</blockquote>

<hr>

<h3><a href="https://www.adminbyaccident.com/politics/linux-vs-open-source-unix/" rel="nofollow">Linux VS open source UNIX</a></h3>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://marc.info/?l=openbsd-tech&m=157380442230074&w=2" rel="nofollow">Support for Realtek RTL8125 2.5Gb Ethernet controller</a></li>
<li><a href="https://onezero.medium.com/the-death-of-the-computer-file-doc-43cb028c0506" rel="nofollow">Computer Files Are Going Extinct</a></li>
<li><a href="https://www.youtube.com/watch?v=4FUub_UtF3c" rel="nofollow">FreeBSD kernel hacking</a></li>
<li><a href="https://youtu.be/e7cJ7v2lYdE" rel="nofollow">Modern BSD Computing for Fun on a VAX! Trying to use a VAX in today&#39;s world by Jeff Armstrong</a></li>
<li><a href="https://www.justjournal.com/users/mbsd/entry/33779" rel="nofollow">MidnightBSD 1.2 Released</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Paulo - <a href="http://dpaste.com/0WQRP43#wrap" rel="nofollow">Zfs snapshots</a></li>
<li>Phillip - <a href="http://dpaste.com/075ZQE1#wrap" rel="nofollow">GCP</a></li>
<li>A Listener - <a href="http://dpaste.com/3YJ4119#wrap" rel="nofollow">Old episodes?</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0326.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>325: Cracking Rainbows</title>
  <link>https://www.bsdnow.tv/325</link>
  <guid isPermaLink="false">a971b40e-d33a-44ac-9cf8-dfaf7e4aaff7</guid>
  <pubDate>Thu, 21 Nov 2019 07:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a971b40e-d33a-44ac-9cf8-dfaf7e4aaff7.mp3" length="41526775" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 12.1 is here, A history of Unix before Berkeley, FreeBSD development setup, HardenedBSD 2019 Status Report, DNSSEC, compiling RainbowCrack on OpenBSD, and more.</itunes:subtitle>
  <itunes:duration>57:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 12.1 is here, A history of Unix before Berkeley, FreeBSD development setup, HardenedBSD 2019 Status Report, DNSSEC, compiling RainbowCrack on OpenBSD, and more.
Headlines
FreeBSD 12.1 (https://www.freebsd.org/releases/12.1R/announce.html)
Some of the highlights:
BearSSL has been imported to the base system.
The clang, llvm, lld, lldb, compiler-rt utilities and libc++ have been updated to version 8.0.1.
OpenSSL has been updated to version 1.1.1d.
Several userland utility updates.
For a complete list of new features and known problems, please see the online release notes and errata list, available at: https://www.FreeBSD.org/releases/12.1R/relnotes.html
A History of UNIX before Berkeley: UNIX Evolution: 1975-1984. (http://www.darwinsys.com/history/hist.html)
Nobody needs to be told that UNIX is popular today. In this article we will show you a little of where it was yesterday and over the past decade. And, without meaning in the least to minimise the incredible contributions of Ken Thompson and Dennis Ritchie, we will bring to light many of the others who worked on early versions, and try to show where some of the key ideas came from, and how they got into the UNIX of today.
Our title says we are talking about UNIX evolution. Evolution means different things to different people. We use the term loosely, to describe the change over time among the many different UNIX variants in use both inside and outside Bell Labs. Ideas, code, and useful programs seem to have made their way back and forth - like mutant genes - among all the many UNIXes living in the phone company over the decade in question.
Part One looks at some of the major components of the current UNIX system - the text formatting tools, the compilers and program development tools, and so on. Most of the work described in Part One took place at Research'', a part of Bell Laboratories (now AT&amp;amp;T Bell Laboratories, then as nowthe Labs''), and the ancestral home of UNIX. In planned (but not written) later parts, we would have looked at some of the myriad versions of UNIX - there are far more than one might suspect. This includes a look at Columbus and USG and at Berkeley Unix. You'll begin to get a glimpse inside the history of the major streams of development of the system during that time.
News Roundup
My FreeBSD Development Setup (https://adventurist.me/posts/00296)
I do my FreeBSD development using git, tmux, vim and cscope.
I keep a FreeBSD fork on my github, I have forked https://github.com/freebsd/freebsd to https://github.com/adventureloop/freebsd
OPNsense 19.7.6 released (https://opnsense.org/opnsense-19-7-6-released/)
As we are experiencing the Suricata community first hand in Amsterdam we thought to release this version a bit earlier than planned. Included is the latest Suricata 5.0.0 release in the development version. That means later this November we will releasing version 5 to the production version as we finish up tweaking the integration and maybe pick up 5.0.1 as it becomes available.
LDAP TLS connectivity is now integrated into the system trust store, which ensures that all required root and intermediate certificates will be seen by the connection setup when they have been added to the authorities section. The same is true for trusting self-signed certificates. On top of this, IPsec now supports public key authentication as contributed by Pascal Mathis.
HardenedBSD November 2019 Status Report. (https://hardenedbsd.org/article/shawn-webb/2019-11-09/hardenedbsd-status-report)
We at HardenedBSD have a lot of news to share. On 05 Nov 2019, Oliver Pinter resigned amicably from the project. All of us at HardenedBSD owe Oliver our gratitude and appreciation. This humble project, named by Oliver, was born out of his thesis work and the collaboration with Shawn Webb. Oliver created the HardenedBSD repo on GitHub in April 2013. The HardenedBSD Foundation was formed five years later to carry on this great work. 
DNSSEC enabled in default unbound(8) configuration. (https://undeadly.org/cgi?action=article;sid=20191110123908)
DNSSEC validation has been enabled in the default unbound.conf(5) in -current. The relevant commits were from Job Snijders (job@)
How to Install Shopware with NGINX and Let's Encrypt on FreeBSD 12 (https://www.howtoforge.com/how-to-install-shopware-with-nginx-and-lets-encrypt-on-freebsd-12/)
Shopware is the next generation of open source e-commerce software. Based on bleeding edge technologies like Symfony 3, Doctrine2 and Zend Framework Shopware comes as the perfect platform for your next e-commerce project. This tutorial will walk you through the Shopware Community Edition (CE) installation on FreeBSD 12 system by using NGINX as a web server.
Requirements
Make sure your system meets the following minimum requirements:
 + Linux-based operating system with NGINX or Apache 2.x (with mod_rewrite) web server installed. 
 + PHP 5.6.4 or higher with ctype, gd, curl, dom, hash, iconv, zip, json, mbstring, openssl, session, simplexml, xml, zlib, fileinfo, and pdo/mysql extensions. PHP 7.1 or above is strongly recommended.
 + MySQL 5.5.0 or higher.
 + Possibility to set up cron jobs.
 + Minimum 4 GB available hard disk space.
 + IonCube Loader version 5.0.0 or higher (optional).
How to Compile RainbowCrack on OpenBSD (https://cromwell-intl.com/open-source/compiling-rainbowcrack-on-openbsd.html)
Project RainbowCrack was originally Zhu Shuanglei's implementation, it's not clear to me if the project is still just his or if it's even been maintained for a while. His page seems to have been last updated in August 2007.
The Project RainbowCrack web page now has just binaries for Windows XP and Linux, both 32-bit and 64-bit versions.
Earlier versions were available as source code. The version 1.2 source code does not compile on OpenBSD, and in my experience it doesn't compile on Linux, either. It seems to date from 2004 at the earliest, and I think it makes some version-2.4 assumptions about Linux kernel headers.
You might also look at ophcrack, a more modern tool, although it seems to be focused on cracking Windows XP/Vista/7/8/10 password hashes
Feedback/Questions
Reese - Amature radio info (http://dpaste.com/2RDG9K4#wrap)
Chris - VPN (http://dpaste.com/2K4T2FQ#wrap)
Malcolm - NAT (http://dpaste.com/138NEMA)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, 12.1, Unix, history, berkeley, OPNsense, development, setup, dev, devel, status report, dnssec, unbound, shopware, let’s encrypt, nginx, rainbowcrack, compiling</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 12.1 is here, A history of Unix before Berkeley, FreeBSD development setup, HardenedBSD 2019 Status Report, DNSSEC, compiling RainbowCrack on OpenBSD, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/12.1R/announce.html" rel="nofollow">FreeBSD 12.1</a></h3>

<ul>
<li><p>Some of the highlights:</p>

<ul>
<li>BearSSL has been imported to the base system.</li>
<li>The clang, llvm, lld, lldb, compiler-rt utilities and libc++ have been updated to version 8.0.1.</li>
<li>OpenSSL has been updated to version 1.1.1d.</li>
<li>Several userland utility updates.</li>
</ul></li>
<li><p>For a complete list of new features and known problems, please see the online release notes and errata list, available at: <a href="https://www.FreeBSD.org/releases/12.1R/relnotes.html" rel="nofollow">https://www.FreeBSD.org/releases/12.1R/relnotes.html</a></p></li>
</ul>

<hr>

<h3><a href="http://www.darwinsys.com/history/hist.html" rel="nofollow">A History of UNIX before Berkeley: UNIX Evolution: 1975-1984.</a></h3>

<blockquote>
<p>Nobody needs to be told that UNIX is popular today. In this article we will show you a little of where it was yesterday and over the past decade. And, without meaning in the least to minimise the incredible contributions of Ken Thompson and Dennis Ritchie, we will bring to light many of the others who worked on early versions, and try to show where some of the key ideas came from, and how they got into the UNIX of today.</p>

<p>Our title says we are talking about UNIX evolution. Evolution means different things to different people. We use the term loosely, to describe the change over time among the many different UNIX variants in use both inside and outside Bell Labs. Ideas, code, and useful programs seem to have made their way back and forth - like mutant genes - among all the many UNIXes living in the phone company over the decade in question.</p>

<p>Part One looks at some of the major components of the current UNIX system - the text formatting tools, the compilers and program development tools, and so on. Most of the work described in Part One took place at <code>Research&#39;&#39;, a part of Bell Laboratories (now AT&amp;T Bell Laboratories, then as now</code>the Labs&#39;&#39;), and the ancestral home of UNIX. In planned (but not written) later parts, we would have looked at some of the myriad versions of UNIX - there are far more than one might suspect. This includes a look at Columbus and USG and at Berkeley Unix. You&#39;ll begin to get a glimpse inside the history of the major streams of development of the system during that time.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://adventurist.me/posts/00296" rel="nofollow">My FreeBSD Development Setup</a></h3>

<blockquote>
<p>I do my FreeBSD development using git, tmux, vim and cscope.</p>

<p>I keep a FreeBSD fork on my github, I have forked <a href="https://github.com/freebsd/freebsd" rel="nofollow">https://github.com/freebsd/freebsd</a> to <a href="https://github.com/adventureloop/freebsd" rel="nofollow">https://github.com/adventureloop/freebsd</a></p>
</blockquote>

<hr>

<h3><a href="https://opnsense.org/opnsense-19-7-6-released/" rel="nofollow">OPNsense 19.7.6 released</a></h3>

<blockquote>
<p>As we are experiencing the Suricata community first hand in Amsterdam we thought to release this version a bit earlier than planned. Included is the latest Suricata 5.0.0 release in the development version. That means later this November we will releasing version 5 to the production version as we finish up tweaking the integration and maybe pick up 5.0.1 as it becomes available.</p>

<p>LDAP TLS connectivity is now integrated into the system trust store, which ensures that all required root and intermediate certificates will be seen by the connection setup when they have been added to the authorities section. The same is true for trusting self-signed certificates. On top of this, IPsec now supports public key authentication as contributed by Pascal Mathis.</p>
</blockquote>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2019-11-09/hardenedbsd-status-report" rel="nofollow">HardenedBSD November 2019 Status Report.</a></h3>

<blockquote>
<p>We at HardenedBSD have a lot of news to share. On 05 Nov 2019, Oliver Pinter resigned amicably from the project. All of us at HardenedBSD owe Oliver our gratitude and appreciation. This humble project, named by Oliver, was born out of his thesis work and the collaboration with Shawn Webb. Oliver created the HardenedBSD repo on GitHub in April 2013. The HardenedBSD Foundation was formed five years later to carry on this great work. </p>
</blockquote>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20191110123908" rel="nofollow">DNSSEC enabled in default unbound(8) configuration.</a></h3>

<blockquote>
<p>DNSSEC validation has been enabled in the default unbound.conf(5) in -current. The relevant commits were from Job Snijders (job@)</p>
</blockquote>

<hr>

<h3><a href="https://www.howtoforge.com/how-to-install-shopware-with-nginx-and-lets-encrypt-on-freebsd-12/" rel="nofollow">How to Install Shopware with NGINX and Let&#39;s Encrypt on FreeBSD 12</a></h3>

<blockquote>
<p>Shopware is the next generation of open source e-commerce software. Based on bleeding edge technologies like Symfony 3, Doctrine2 and Zend Framework Shopware comes as the perfect platform for your next e-commerce project. This tutorial will walk you through the Shopware Community Edition (CE) installation on FreeBSD 12 system by using NGINX as a web server.</p>
</blockquote>

<ul>
<li>Requirements</li>
</ul>

<blockquote>
<p>Make sure your system meets the following minimum requirements:</p>

<ul>
<li>Linux-based operating system with NGINX or Apache 2.x (with mod_rewrite) web server installed. </li>
<li>PHP 5.6.4 or higher with ctype, gd, curl, dom, hash, iconv, zip, json, mbstring, openssl, session, simplexml, xml, zlib, fileinfo, and pdo/mysql extensions. PHP 7.1 or above is strongly recommended.</li>
<li>MySQL 5.5.0 or higher.</li>
<li>Possibility to set up cron jobs.</li>
<li>Minimum 4 GB available hard disk space.</li>
<li>IonCube Loader version 5.0.0 or higher (optional).</li>
</ul>
</blockquote>

<hr>

<h3><a href="https://cromwell-intl.com/open-source/compiling-rainbowcrack-on-openbsd.html" rel="nofollow">How to Compile RainbowCrack on OpenBSD</a></h3>

<blockquote>
<p>Project RainbowCrack was originally Zhu Shuanglei&#39;s implementation, it&#39;s not clear to me if the project is still just his or if it&#39;s even been maintained for a while. His page seems to have been last updated in August 2007.</p>

<p>The Project RainbowCrack web page now has just binaries for Windows XP and Linux, both 32-bit and 64-bit versions.</p>

<p>Earlier versions were available as source code. The version 1.2 source code does not compile on OpenBSD, and in my experience it doesn&#39;t compile on Linux, either. It seems to date from 2004 at the earliest, and I think it makes some version-2.4 assumptions about Linux kernel headers.</p>
</blockquote>

<ul>
<li>You might also look at ophcrack, a more modern tool, although it seems to be focused on cracking Windows XP/Vista/7/8/10 password hashes</li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Reese - <a href="http://dpaste.com/2RDG9K4#wrap" rel="nofollow">Amature radio info</a></li>
<li>Chris - <a href="http://dpaste.com/2K4T2FQ#wrap" rel="nofollow">VPN</a></li>
<li>Malcolm - <a href="http://dpaste.com/138NEMA" rel="nofollow">NAT</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0325.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 12.1 is here, A history of Unix before Berkeley, FreeBSD development setup, HardenedBSD 2019 Status Report, DNSSEC, compiling RainbowCrack on OpenBSD, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/12.1R/announce.html" rel="nofollow">FreeBSD 12.1</a></h3>

<ul>
<li><p>Some of the highlights:</p>

<ul>
<li>BearSSL has been imported to the base system.</li>
<li>The clang, llvm, lld, lldb, compiler-rt utilities and libc++ have been updated to version 8.0.1.</li>
<li>OpenSSL has been updated to version 1.1.1d.</li>
<li>Several userland utility updates.</li>
</ul></li>
<li><p>For a complete list of new features and known problems, please see the online release notes and errata list, available at: <a href="https://www.FreeBSD.org/releases/12.1R/relnotes.html" rel="nofollow">https://www.FreeBSD.org/releases/12.1R/relnotes.html</a></p></li>
</ul>

<hr>

<h3><a href="http://www.darwinsys.com/history/hist.html" rel="nofollow">A History of UNIX before Berkeley: UNIX Evolution: 1975-1984.</a></h3>

<blockquote>
<p>Nobody needs to be told that UNIX is popular today. In this article we will show you a little of where it was yesterday and over the past decade. And, without meaning in the least to minimise the incredible contributions of Ken Thompson and Dennis Ritchie, we will bring to light many of the others who worked on early versions, and try to show where some of the key ideas came from, and how they got into the UNIX of today.</p>

<p>Our title says we are talking about UNIX evolution. Evolution means different things to different people. We use the term loosely, to describe the change over time among the many different UNIX variants in use both inside and outside Bell Labs. Ideas, code, and useful programs seem to have made their way back and forth - like mutant genes - among all the many UNIXes living in the phone company over the decade in question.</p>

<p>Part One looks at some of the major components of the current UNIX system - the text formatting tools, the compilers and program development tools, and so on. Most of the work described in Part One took place at <code>Research&#39;&#39;, a part of Bell Laboratories (now AT&amp;T Bell Laboratories, then as now</code>the Labs&#39;&#39;), and the ancestral home of UNIX. In planned (but not written) later parts, we would have looked at some of the myriad versions of UNIX - there are far more than one might suspect. This includes a look at Columbus and USG and at Berkeley Unix. You&#39;ll begin to get a glimpse inside the history of the major streams of development of the system during that time.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://adventurist.me/posts/00296" rel="nofollow">My FreeBSD Development Setup</a></h3>

<blockquote>
<p>I do my FreeBSD development using git, tmux, vim and cscope.</p>

<p>I keep a FreeBSD fork on my github, I have forked <a href="https://github.com/freebsd/freebsd" rel="nofollow">https://github.com/freebsd/freebsd</a> to <a href="https://github.com/adventureloop/freebsd" rel="nofollow">https://github.com/adventureloop/freebsd</a></p>
</blockquote>

<hr>

<h3><a href="https://opnsense.org/opnsense-19-7-6-released/" rel="nofollow">OPNsense 19.7.6 released</a></h3>

<blockquote>
<p>As we are experiencing the Suricata community first hand in Amsterdam we thought to release this version a bit earlier than planned. Included is the latest Suricata 5.0.0 release in the development version. That means later this November we will releasing version 5 to the production version as we finish up tweaking the integration and maybe pick up 5.0.1 as it becomes available.</p>

<p>LDAP TLS connectivity is now integrated into the system trust store, which ensures that all required root and intermediate certificates will be seen by the connection setup when they have been added to the authorities section. The same is true for trusting self-signed certificates. On top of this, IPsec now supports public key authentication as contributed by Pascal Mathis.</p>
</blockquote>

<hr>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2019-11-09/hardenedbsd-status-report" rel="nofollow">HardenedBSD November 2019 Status Report.</a></h3>

<blockquote>
<p>We at HardenedBSD have a lot of news to share. On 05 Nov 2019, Oliver Pinter resigned amicably from the project. All of us at HardenedBSD owe Oliver our gratitude and appreciation. This humble project, named by Oliver, was born out of his thesis work and the collaboration with Shawn Webb. Oliver created the HardenedBSD repo on GitHub in April 2013. The HardenedBSD Foundation was formed five years later to carry on this great work. </p>
</blockquote>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20191110123908" rel="nofollow">DNSSEC enabled in default unbound(8) configuration.</a></h3>

<blockquote>
<p>DNSSEC validation has been enabled in the default unbound.conf(5) in -current. The relevant commits were from Job Snijders (job@)</p>
</blockquote>

<hr>

<h3><a href="https://www.howtoforge.com/how-to-install-shopware-with-nginx-and-lets-encrypt-on-freebsd-12/" rel="nofollow">How to Install Shopware with NGINX and Let&#39;s Encrypt on FreeBSD 12</a></h3>

<blockquote>
<p>Shopware is the next generation of open source e-commerce software. Based on bleeding edge technologies like Symfony 3, Doctrine2 and Zend Framework Shopware comes as the perfect platform for your next e-commerce project. This tutorial will walk you through the Shopware Community Edition (CE) installation on FreeBSD 12 system by using NGINX as a web server.</p>
</blockquote>

<ul>
<li>Requirements</li>
</ul>

<blockquote>
<p>Make sure your system meets the following minimum requirements:</p>

<ul>
<li>Linux-based operating system with NGINX or Apache 2.x (with mod_rewrite) web server installed. </li>
<li>PHP 5.6.4 or higher with ctype, gd, curl, dom, hash, iconv, zip, json, mbstring, openssl, session, simplexml, xml, zlib, fileinfo, and pdo/mysql extensions. PHP 7.1 or above is strongly recommended.</li>
<li>MySQL 5.5.0 or higher.</li>
<li>Possibility to set up cron jobs.</li>
<li>Minimum 4 GB available hard disk space.</li>
<li>IonCube Loader version 5.0.0 or higher (optional).</li>
</ul>
</blockquote>

<hr>

<h3><a href="https://cromwell-intl.com/open-source/compiling-rainbowcrack-on-openbsd.html" rel="nofollow">How to Compile RainbowCrack on OpenBSD</a></h3>

<blockquote>
<p>Project RainbowCrack was originally Zhu Shuanglei&#39;s implementation, it&#39;s not clear to me if the project is still just his or if it&#39;s even been maintained for a while. His page seems to have been last updated in August 2007.</p>

<p>The Project RainbowCrack web page now has just binaries for Windows XP and Linux, both 32-bit and 64-bit versions.</p>

<p>Earlier versions were available as source code. The version 1.2 source code does not compile on OpenBSD, and in my experience it doesn&#39;t compile on Linux, either. It seems to date from 2004 at the earliest, and I think it makes some version-2.4 assumptions about Linux kernel headers.</p>
</blockquote>

<ul>
<li>You might also look at ophcrack, a more modern tool, although it seems to be focused on cracking Windows XP/Vista/7/8/10 password hashes</li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Reese - <a href="http://dpaste.com/2RDG9K4#wrap" rel="nofollow">Amature radio info</a></li>
<li>Chris - <a href="http://dpaste.com/2K4T2FQ#wrap" rel="nofollow">VPN</a></li>
<li>Malcolm - <a href="http://dpaste.com/138NEMA" rel="nofollow">NAT</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0325.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>324: Emergency Space Mode</title>
  <link>https://www.bsdnow.tv/324</link>
  <guid isPermaLink="false">e82a766b-37c4-4d16-896b-6fcfcfdef480</guid>
  <pubDate>Thu, 14 Nov 2019 07:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e82a766b-37c4-4d16-896b-6fcfcfdef480.mp3" length="33490674" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Migrating drives and zpool between hosts, OpenBSD in 2019, Dragonfly’s new zlib and dhcpcd, Batch renaming images and resolution with awk, a rant on the X11 ICCCM selection system, hammer 2 emergency space mode, and more.</itunes:subtitle>
  <itunes:duration>46:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Migrating drives and zpool between hosts, OpenBSD in 2019, Dragonfly’s new zlib and dhcpcd, Batch renaming images and resolution with awk, a rant on the X11 ICCCM selection system, hammer 2 emergency space mode, and more.
Headlines
Migrating drives and the zpool from one host to another. (https://dan.langille.org/2019/10/26/migrating-drives-and-the-zpool-from-one-host-to-another/)
Today is the day.
Today I move a zpool from an R710 into an R720. The goal: all services on that zpool start running on the new host.
Fortunately, that zpool is dedicated to jails, more or less. I have done some planning about this, including moving a poudriere on the R710 into a jail.
Now it is almost noon on Saturday, I am sitting in the basement (just outside the server room), and I’m typing this up.
In this post:
FreeBSD 12.0
Dell R710 (r710-01)
Dell R720 (r720-01)
drive caddies from eBay and now I know the difference between SATA and SATAu
PLEASE READ THIS first: Migrating ZFS Storage Pools (https://docs.oracle.com/cd/E19253-01/819-5461/gbchy/index.html)
OpenBSD in 2019 (https://blog.habets.se/2019/10/OpenBSD-in-2019.html)
I’ve used OpenBSD on and off since 2.1. More back then than in the last 10 years or so though, so I thought I’d try it again.
What triggered this was me finding a silly bug in GNU cpio that has existed with a “FIXME” comment since at least 1994. I checked OpenBSD to see if it had a related bug, but as expected no it was just fine.
I don’t quite remember why I stopped using OpenBSD for servers, but I do remember filesystem corruption on “unexpected power disconnections” (even with softdep turned on), which I’ve never really seen on Linux.
That and that fewer things “just worked” than with Linux, which matters more when I installed more random things than I do now. I’ve become a lot more minimalist. Probably due to less spare time. Life is better when you don’t run things like PHP (not that OpenBSD doesn’t support PHP, just an example) or your own email server with various antispam tooling, and other things.
This is all experience from running OpenBSD on a server. On my next laptop I intend to try running OpenBSD on the dektop, and will see if that more ad-hoc environment works well. E.g. will gnuradio work? Lack of other-OS VM support may be a problem.
Verdict
Ouch, that’s a long list of bad stuff. Still, I like it. I’ll continue to run it, and will make sure my stuff continues working on OpenBSD.
And maybe in a year I’ll have a review of OpenBSD on a laptop.
News Roundup
New zlib, new dhcpcd (https://www.dragonflydigest.com/2019/10/29/23683.html)
zlib and dhcpcd are both updated in DragonFly… but my quick perusal of the commits makes it sound like bugfix only; no usage changes needed.
DHCPCD Commit: http://lists.dragonflybsd.org/pipermail/commits/2019-October/719768.html
ZLIB Commit: http://lists.dragonflybsd.org/pipermail/commits/2019-October/719772.html
Batch renaming images, including image resolution, with awk (https://victoria.dev/verbose/batch-renaming-images-including-image-resolution-with-awk/)
The most recent item on my list of “Geeky things I did that made me feel pretty awesome” is an hour’s adventure that culminated in this code:

$ file IMG* | awk 'BEGIN{a=0} {print substr($1, 1, length($1)-5),a++"_"substr($8,1, length($8)-1)}' | while read fn fr; do echo $(rename -v "s/$fn/img_$fr/g" *); done
IMG_20170808_172653_425.jpg renamed as img_0_4032x3024.jpg
IMG_20170808_173020_267.jpg renamed as img_1_3024x3506.jpg
IMG_20170808_173130_616.jpg renamed as img_2_3024x3779.jpg
IMG_20170808_173221_425.jpg renamed as img_3_3024x3780.jpg
IMG_20170808_173417_059.jpg renamed as img_4_2956x2980.jpg
IMG_20170808_173450_971.jpg renamed as img_5_3024x3024.jpg
IMG_20170808_173536_034.jpg renamed as img_6_4032x3024.jpg
IMG_20170808_173602_732.jpg renamed as img_7_1617x1617.jpg
IMG_20170808_173645_339.jpg renamed as img_8_3024x3780.jpg
IMG_20170909_170146_585.jpg renamed as img_9_3036x3036.jpg
IMG_20170911_211522_543.jpg renamed as img_10_3036x3036.jpg
IMG_20170913_071608_288.jpg renamed as img_11_2760x2760.jpg
IMG_20170913_073205_522.jpg renamed as img_12_2738x2738.jpg
// ... etc etc

The last item on the aforementioned list is “TODO: come up with a shorter title for this list.”
I hate the X11 ICCCM selection system, and you should too - A Rant (http://www.call-with-current-continuation.org/rants/icccm.txt)
d00d, that document is devilspawn. I've recently spent my nights in pain
implementing the selection mechanism. WHY OH WHY OH WHY? why me?  why did I choose to do this? and what sick evil twisted mind wrote this damn spec? I don't know why I'm working with it, I just wanted to make a useful program.
I didn't know what I was getting myself in to. Nobody knows until they try it. And once you start, you're unable to stop. You can't stop, if you stop then you haven't completed it to spec. You can't fail on this, it's just a few pages of text, how can that be so hard? So what if they use Atoms for everything. So what if there's no explicit correlation between the target type of a SelectionNotify event and the type of the property it indicates?
So what if the distinction is ambiguous? So what if the document is littered with such atrocities? It's not the spec's fault, the spec is authoritative. It's obviously YOUR (the implementor's) fault for misunderstanding it. If you didn't misunderstand it, you wouldn't be here complaining about it would you?
HAMMER2 emergency space mode (https://www.dragonflydigest.com/2019/10/22/23652.html)
As anyone who has been running HAMMER1 or HAMMER2 has noticed, snapshots and copy on write and infinite history can eat a lot of disk space, even if the actual file volume isn’t changing much.  There’s now an ‘emergency mode‘ for HAMMER2, where disk operations can happen even if there isn’t space for the normal history activity.  It’s dangerous, in that the normal protections against data loss if power is cut go away, and snapshots created while in this mode will be mangled.  So definitely don’t leave it on!
Beastie Bits
The BastilleBSD community has started work on over 100 automation templates (https://twitter.com/BastilleBSD/status/1186659762458501120)
PAM perturbed (https://www.dragonflydigest.com/2019/10/23/23654.html)
OpenBSD T-Shirts now available (https://teespring.com/stores/openbsd)
FastoCloud (Opensource Media Service) now available on FreeBSD (https://old.reddit.com/r/freebsd/comments/dlyqtq/fastocloud_opensource_media_service_now_available/)
Unix: A History and a Memoir by Brian Kernighan now available (https://www.cs.princeton.edu/~bwk/)
OpenBSD Moonlight game streaming client from a Windows + Nvidia PC (https://www.reddit.com/r/openbsd_gaming/comments/d6xboo/openbsd_moonlight_game_streaming_client_from_a/)
***
Feedback/Questions
Tim - Release Notes for Lumina 1.5 (http://dpaste.com/38DNSXT#wrap)
Answer Here (http://dpaste.com/3QJX8G3#wrap)
Brad - vBSDcon Trip Report (http://dpaste.com/316MGVX#wrap)
Jacob - Using terminfo on FreeBSD (http://dpaste.com/131N05J#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, migrating drive, migrating zpool, zpool, migration, zlib, dhcpcd, awk, batch, renaming, x11, ICCCM, hammer 2, emergency space mode</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Migrating drives and zpool between hosts, OpenBSD in 2019, Dragonfly’s new zlib and dhcpcd, Batch renaming images and resolution with awk, a rant on the X11 ICCCM selection system, hammer 2 emergency space mode, and more.</p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://dan.langille.org/2019/10/26/migrating-drives-and-the-zpool-from-one-host-to-another/" rel="nofollow">Migrating drives and the zpool from one host to another.</a></h3>

<blockquote>
<p>Today is the day.</p>

<p>Today I move a zpool from an R710 into an R720. The goal: all services on that zpool start running on the new host.</p>

<p>Fortunately, that zpool is dedicated to jails, more or less. I have done some planning about this, including moving a poudriere on the R710 into a jail.</p>

<p>Now it is almost noon on Saturday, I am sitting in the basement (just outside the server room), and I’m typing this up.</p>
</blockquote>

<ul>
<li><p>In this post:</p>

<ul>
<li>FreeBSD 12.0</li>
<li>Dell R710 (r710-01)</li>
<li>Dell R720 (r720-01)</li>
<li>drive caddies from eBay and now I know the difference between SATA and SATAu</li>
</ul></li>
<li><p><a href="https://docs.oracle.com/cd/E19253-01/819-5461/gbchy/index.html" rel="nofollow">PLEASE READ THIS first: Migrating ZFS Storage Pools</a></p></li>
</ul>

<hr>

<h3><a href="https://blog.habets.se/2019/10/OpenBSD-in-2019.html" rel="nofollow">OpenBSD in 2019</a></h3>

<blockquote>
<p>I’ve used OpenBSD on and off since 2.1. More back then than in the last 10 years or so though, so I thought I’d try it again.</p>

<p>What triggered this was me finding a silly bug in GNU cpio that has existed with a “FIXME” comment since at least 1994. I checked OpenBSD to see if it had a related bug, but as expected no it was just fine.</p>

<p>I don’t quite remember why I stopped using OpenBSD for servers, but I do remember filesystem corruption on “unexpected power disconnections” (even with softdep turned on), which I’ve never really seen on Linux.</p>

<p>That and that fewer things “just worked” than with Linux, which matters more when I installed more random things than I do now. I’ve become a lot more minimalist. Probably due to less spare time. Life is better when you don’t run things like PHP (not that OpenBSD doesn’t support PHP, just an example) or your own email server with various antispam tooling, and other things.</p>

<p>This is all experience from running OpenBSD on a server. On my next laptop I intend to try running OpenBSD on the dektop, and will see if that more ad-hoc environment works well. E.g. will gnuradio work? Lack of other-OS VM support may be a problem.</p>
</blockquote>

<ul>
<li>Verdict</li>
</ul>

<blockquote>
<p>Ouch, that’s a long list of bad stuff. Still, I like it. I’ll continue to run it, and will make sure my stuff continues working on OpenBSD.</p>

<p>And maybe in a year I’ll have a review of OpenBSD on a laptop.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.dragonflydigest.com/2019/10/29/23683.html" rel="nofollow">New zlib, new dhcpcd</a></h3>

<blockquote>
<p>zlib and dhcpcd are both updated in DragonFly… but my quick perusal of the commits makes it sound like bugfix only; no usage changes needed.</p>
</blockquote>

<ul>
<li>DHCPCD Commit: <a href="http://lists.dragonflybsd.org/pipermail/commits/2019-October/719768.html" rel="nofollow">http://lists.dragonflybsd.org/pipermail/commits/2019-October/719768.html</a></li>
<li>ZLIB Commit: <a href="http://lists.dragonflybsd.org/pipermail/commits/2019-October/719772.html" rel="nofollow">http://lists.dragonflybsd.org/pipermail/commits/2019-October/719772.html</a></li>
</ul>

<hr>

<h3><a href="https://victoria.dev/verbose/batch-renaming-images-including-image-resolution-with-awk/" rel="nofollow">Batch renaming images, including image resolution, with awk</a></h3>

<blockquote>
<p>The most recent item on my list of “Geeky things I did that made me feel pretty awesome” is an hour’s adventure that culminated in this code:</p>
</blockquote>

<pre><code>$ file IMG* | awk &#39;BEGIN{a=0} {print substr($1, 1, length($1)-5),a++&quot;_&quot;substr($8,1, length($8)-1)}&#39; | while read fn fr; do echo $(rename -v &quot;s/$fn/img_$fr/g&quot; *); done
IMG_20170808_172653_425.jpg renamed as img_0_4032x3024.jpg
IMG_20170808_173020_267.jpg renamed as img_1_3024x3506.jpg
IMG_20170808_173130_616.jpg renamed as img_2_3024x3779.jpg
IMG_20170808_173221_425.jpg renamed as img_3_3024x3780.jpg
IMG_20170808_173417_059.jpg renamed as img_4_2956x2980.jpg
IMG_20170808_173450_971.jpg renamed as img_5_3024x3024.jpg
IMG_20170808_173536_034.jpg renamed as img_6_4032x3024.jpg
IMG_20170808_173602_732.jpg renamed as img_7_1617x1617.jpg
IMG_20170808_173645_339.jpg renamed as img_8_3024x3780.jpg
IMG_20170909_170146_585.jpg renamed as img_9_3036x3036.jpg
IMG_20170911_211522_543.jpg renamed as img_10_3036x3036.jpg
IMG_20170913_071608_288.jpg renamed as img_11_2760x2760.jpg
IMG_20170913_073205_522.jpg renamed as img_12_2738x2738.jpg
// ... etc etc
</code></pre>

<blockquote>
<p>The last item on the aforementioned list is “TODO: come up with a shorter title for this list.”</p>
</blockquote>

<hr>

<h3><a href="http://www.call-with-current-continuation.org/rants/icccm.txt" rel="nofollow">I hate the X11 ICCCM selection system, and you should too - A Rant</a></h3>

<blockquote>
<p>d00d, that document is devilspawn. I&#39;ve recently spent my nights in pain<br>
implementing the selection mechanism. WHY OH WHY OH WHY? why me?  why did I choose to do this? and what sick evil twisted mind wrote this damn spec? I don&#39;t know why I&#39;m working with it, I just wanted to make a useful program.</p>

<p>I didn&#39;t know what I was getting myself in to. Nobody knows until they try it. And once you start, you&#39;re unable to stop. You can&#39;t stop, if you stop then you haven&#39;t completed it to spec. You can&#39;t fail on this, it&#39;s just a few pages of text, how can that be so hard? So what if they use Atoms for everything. So what if there&#39;s no explicit correlation between the target type of a SelectionNotify event and the type of the property it indicates?</p>

<p>So what if the distinction is ambiguous? So what if the document is littered with such atrocities? It&#39;s not the spec&#39;s fault, the spec is authoritative. It&#39;s obviously YOUR (the implementor&#39;s) fault for misunderstanding it. If you didn&#39;t misunderstand it, you wouldn&#39;t be here complaining about it would you?</p>
</blockquote>

<hr>

<h3><a href="https://www.dragonflydigest.com/2019/10/22/23652.html" rel="nofollow">HAMMER2 emergency space mode</a></h3>

<blockquote>
<p>As anyone who has been running HAMMER1 or HAMMER2 has noticed, snapshots and copy on write and infinite history can eat a lot of disk space, even if the actual file volume isn’t changing much.  There’s now an ‘emergency mode‘ for HAMMER2, where disk operations can happen even if there isn’t space for the normal history activity.  It’s dangerous, in that the normal protections against data loss if power is cut go away, and snapshots created while in this mode will be mangled.  So definitely don’t leave it on!</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/BastilleBSD/status/1186659762458501120" rel="nofollow">The BastilleBSD community has started work on over 100 automation templates</a></li>
<li><a href="https://www.dragonflydigest.com/2019/10/23/23654.html" rel="nofollow">PAM perturbed</a></li>
<li><a href="https://teespring.com/stores/openbsd" rel="nofollow">OpenBSD T-Shirts now available</a></li>
<li><a href="https://old.reddit.com/r/freebsd/comments/dlyqtq/fastocloud_opensource_media_service_now_available/" rel="nofollow">FastoCloud (Opensource Media Service) now available on FreeBSD</a></li>
<li><a href="https://www.cs.princeton.edu/%7Ebwk/" rel="nofollow">Unix: A History and a Memoir by Brian Kernighan now available</a></li>
<li><a href="https://www.reddit.com/r/openbsd_gaming/comments/d6xboo/openbsd_moonlight_game_streaming_client_from_a/" rel="nofollow">OpenBSD Moonlight game streaming client from a Windows + Nvidia PC</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Tim - <a href="http://dpaste.com/38DNSXT#wrap" rel="nofollow">Release Notes for Lumina 1.5</a>

<ul>
<li><a href="http://dpaste.com/3QJX8G3#wrap" rel="nofollow">Answer Here</a></li>
</ul></li>
<li>Brad - <a href="http://dpaste.com/316MGVX#wrap" rel="nofollow">vBSDcon Trip Report</a></li>
<li>Jacob - <a href="http://dpaste.com/131N05J#wrap" rel="nofollow">Using terminfo on FreeBSD</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0324.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Migrating drives and zpool between hosts, OpenBSD in 2019, Dragonfly’s new zlib and dhcpcd, Batch renaming images and resolution with awk, a rant on the X11 ICCCM selection system, hammer 2 emergency space mode, and more.</p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://dan.langille.org/2019/10/26/migrating-drives-and-the-zpool-from-one-host-to-another/" rel="nofollow">Migrating drives and the zpool from one host to another.</a></h3>

<blockquote>
<p>Today is the day.</p>

<p>Today I move a zpool from an R710 into an R720. The goal: all services on that zpool start running on the new host.</p>

<p>Fortunately, that zpool is dedicated to jails, more or less. I have done some planning about this, including moving a poudriere on the R710 into a jail.</p>

<p>Now it is almost noon on Saturday, I am sitting in the basement (just outside the server room), and I’m typing this up.</p>
</blockquote>

<ul>
<li><p>In this post:</p>

<ul>
<li>FreeBSD 12.0</li>
<li>Dell R710 (r710-01)</li>
<li>Dell R720 (r720-01)</li>
<li>drive caddies from eBay and now I know the difference between SATA and SATAu</li>
</ul></li>
<li><p><a href="https://docs.oracle.com/cd/E19253-01/819-5461/gbchy/index.html" rel="nofollow">PLEASE READ THIS first: Migrating ZFS Storage Pools</a></p></li>
</ul>

<hr>

<h3><a href="https://blog.habets.se/2019/10/OpenBSD-in-2019.html" rel="nofollow">OpenBSD in 2019</a></h3>

<blockquote>
<p>I’ve used OpenBSD on and off since 2.1. More back then than in the last 10 years or so though, so I thought I’d try it again.</p>

<p>What triggered this was me finding a silly bug in GNU cpio that has existed with a “FIXME” comment since at least 1994. I checked OpenBSD to see if it had a related bug, but as expected no it was just fine.</p>

<p>I don’t quite remember why I stopped using OpenBSD for servers, but I do remember filesystem corruption on “unexpected power disconnections” (even with softdep turned on), which I’ve never really seen on Linux.</p>

<p>That and that fewer things “just worked” than with Linux, which matters more when I installed more random things than I do now. I’ve become a lot more minimalist. Probably due to less spare time. Life is better when you don’t run things like PHP (not that OpenBSD doesn’t support PHP, just an example) or your own email server with various antispam tooling, and other things.</p>

<p>This is all experience from running OpenBSD on a server. On my next laptop I intend to try running OpenBSD on the dektop, and will see if that more ad-hoc environment works well. E.g. will gnuradio work? Lack of other-OS VM support may be a problem.</p>
</blockquote>

<ul>
<li>Verdict</li>
</ul>

<blockquote>
<p>Ouch, that’s a long list of bad stuff. Still, I like it. I’ll continue to run it, and will make sure my stuff continues working on OpenBSD.</p>

<p>And maybe in a year I’ll have a review of OpenBSD on a laptop.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.dragonflydigest.com/2019/10/29/23683.html" rel="nofollow">New zlib, new dhcpcd</a></h3>

<blockquote>
<p>zlib and dhcpcd are both updated in DragonFly… but my quick perusal of the commits makes it sound like bugfix only; no usage changes needed.</p>
</blockquote>

<ul>
<li>DHCPCD Commit: <a href="http://lists.dragonflybsd.org/pipermail/commits/2019-October/719768.html" rel="nofollow">http://lists.dragonflybsd.org/pipermail/commits/2019-October/719768.html</a></li>
<li>ZLIB Commit: <a href="http://lists.dragonflybsd.org/pipermail/commits/2019-October/719772.html" rel="nofollow">http://lists.dragonflybsd.org/pipermail/commits/2019-October/719772.html</a></li>
</ul>

<hr>

<h3><a href="https://victoria.dev/verbose/batch-renaming-images-including-image-resolution-with-awk/" rel="nofollow">Batch renaming images, including image resolution, with awk</a></h3>

<blockquote>
<p>The most recent item on my list of “Geeky things I did that made me feel pretty awesome” is an hour’s adventure that culminated in this code:</p>
</blockquote>

<pre><code>$ file IMG* | awk &#39;BEGIN{a=0} {print substr($1, 1, length($1)-5),a++&quot;_&quot;substr($8,1, length($8)-1)}&#39; | while read fn fr; do echo $(rename -v &quot;s/$fn/img_$fr/g&quot; *); done
IMG_20170808_172653_425.jpg renamed as img_0_4032x3024.jpg
IMG_20170808_173020_267.jpg renamed as img_1_3024x3506.jpg
IMG_20170808_173130_616.jpg renamed as img_2_3024x3779.jpg
IMG_20170808_173221_425.jpg renamed as img_3_3024x3780.jpg
IMG_20170808_173417_059.jpg renamed as img_4_2956x2980.jpg
IMG_20170808_173450_971.jpg renamed as img_5_3024x3024.jpg
IMG_20170808_173536_034.jpg renamed as img_6_4032x3024.jpg
IMG_20170808_173602_732.jpg renamed as img_7_1617x1617.jpg
IMG_20170808_173645_339.jpg renamed as img_8_3024x3780.jpg
IMG_20170909_170146_585.jpg renamed as img_9_3036x3036.jpg
IMG_20170911_211522_543.jpg renamed as img_10_3036x3036.jpg
IMG_20170913_071608_288.jpg renamed as img_11_2760x2760.jpg
IMG_20170913_073205_522.jpg renamed as img_12_2738x2738.jpg
// ... etc etc
</code></pre>

<blockquote>
<p>The last item on the aforementioned list is “TODO: come up with a shorter title for this list.”</p>
</blockquote>

<hr>

<h3><a href="http://www.call-with-current-continuation.org/rants/icccm.txt" rel="nofollow">I hate the X11 ICCCM selection system, and you should too - A Rant</a></h3>

<blockquote>
<p>d00d, that document is devilspawn. I&#39;ve recently spent my nights in pain<br>
implementing the selection mechanism. WHY OH WHY OH WHY? why me?  why did I choose to do this? and what sick evil twisted mind wrote this damn spec? I don&#39;t know why I&#39;m working with it, I just wanted to make a useful program.</p>

<p>I didn&#39;t know what I was getting myself in to. Nobody knows until they try it. And once you start, you&#39;re unable to stop. You can&#39;t stop, if you stop then you haven&#39;t completed it to spec. You can&#39;t fail on this, it&#39;s just a few pages of text, how can that be so hard? So what if they use Atoms for everything. So what if there&#39;s no explicit correlation between the target type of a SelectionNotify event and the type of the property it indicates?</p>

<p>So what if the distinction is ambiguous? So what if the document is littered with such atrocities? It&#39;s not the spec&#39;s fault, the spec is authoritative. It&#39;s obviously YOUR (the implementor&#39;s) fault for misunderstanding it. If you didn&#39;t misunderstand it, you wouldn&#39;t be here complaining about it would you?</p>
</blockquote>

<hr>

<h3><a href="https://www.dragonflydigest.com/2019/10/22/23652.html" rel="nofollow">HAMMER2 emergency space mode</a></h3>

<blockquote>
<p>As anyone who has been running HAMMER1 or HAMMER2 has noticed, snapshots and copy on write and infinite history can eat a lot of disk space, even if the actual file volume isn’t changing much.  There’s now an ‘emergency mode‘ for HAMMER2, where disk operations can happen even if there isn’t space for the normal history activity.  It’s dangerous, in that the normal protections against data loss if power is cut go away, and snapshots created while in this mode will be mangled.  So definitely don’t leave it on!</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/BastilleBSD/status/1186659762458501120" rel="nofollow">The BastilleBSD community has started work on over 100 automation templates</a></li>
<li><a href="https://www.dragonflydigest.com/2019/10/23/23654.html" rel="nofollow">PAM perturbed</a></li>
<li><a href="https://teespring.com/stores/openbsd" rel="nofollow">OpenBSD T-Shirts now available</a></li>
<li><a href="https://old.reddit.com/r/freebsd/comments/dlyqtq/fastocloud_opensource_media_service_now_available/" rel="nofollow">FastoCloud (Opensource Media Service) now available on FreeBSD</a></li>
<li><a href="https://www.cs.princeton.edu/%7Ebwk/" rel="nofollow">Unix: A History and a Memoir by Brian Kernighan now available</a></li>
<li><a href="https://www.reddit.com/r/openbsd_gaming/comments/d6xboo/openbsd_moonlight_game_streaming_client_from_a/" rel="nofollow">OpenBSD Moonlight game streaming client from a Windows + Nvidia PC</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Tim - <a href="http://dpaste.com/38DNSXT#wrap" rel="nofollow">Release Notes for Lumina 1.5</a>

<ul>
<li><a href="http://dpaste.com/3QJX8G3#wrap" rel="nofollow">Answer Here</a></li>
</ul></li>
<li>Brad - <a href="http://dpaste.com/316MGVX#wrap" rel="nofollow">vBSDcon Trip Report</a></li>
<li>Jacob - <a href="http://dpaste.com/131N05J#wrap" rel="nofollow">Using terminfo on FreeBSD</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0324.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>323: OSI Burrito Guy</title>
  <link>https://www.bsdnow.tv/323</link>
  <guid isPermaLink="false">cf54c1fe-70ba-49a3-9b13-1ceb64ab896a</guid>
  <pubDate>Thu, 07 Nov 2019 07:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cf54c1fe-70ba-49a3-9b13-1ceb64ab896a.mp3" length="35547347" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The earliest Unix code, how to replace fail2ban with blacklistd, OpenBSD crossed 400k commits, how to install Bolt CMS on FreeBSD, optimized hammer2, appeasing the OSI 7-layer burrito guys, and more.</itunes:subtitle>
  <itunes:duration>49:22</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The earliest Unix code, how to replace fail2ban with blacklistd, OpenBSD crossed 400k commits, how to install Bolt CMS on FreeBSD, optimized hammer2, appeasing the OSI 7-layer burrito guys, and more.
Headlines
The Earliest Unix Code: An Anniversary Source Code Release (https://computerhistory.org/blog/the-earliest-unix-code-an-anniversary-source-code-release/)
What is it that runs the servers that hold our online world, be it the web or the cloud? What enables the mobile apps that are at the center of increasingly on-demand lives in the developed world and of mobile banking and messaging in the developing world? The answer is the operating system Unix and its many descendants: Linux, Android, BSD Unix, MacOS, iOS—the list goes on and on. Want to glimpse the Unix in your Mac? Open a Terminal window and enter “man roff” to view the Unix manual entry for an early text formatting program that lives within your operating system.
2019 marks the 50th anniversary of the start of Unix. In the summer of 1969, that same summer that saw humankind’s first steps on the surface of the Moon, computer scientists at the Bell Telephone Laboratories—most centrally Ken Thompson and Dennis Ritchie—began the construction of a new operating system, using a then-aging DEC PDP-7 computer at the labs.
This man sent the first online message 50 years ago (https://www.cbc.ca/radio/thecurrent/the-current-for-oct-29-2019-1.5339212/this-man-sent-the-first-online-message-50-years-ago-he-s-since-seen-the-web-s-dark-side-emerge-1.5339244)
As many of you have heard in the past, the first online message ever sent between two computers was "lo", just over 50 years ago, on Oct. 29, 1969. 
It was supposed to say "log," but the computer sending the message — based at UCLA — crashed before the letter "g" was typed. A computer at Stanford 560 kilometres away was supposed to fill in the remaining characters "in," as in "log in."
The CBC Radio show, “The Current” has a half-hour interview with the man who sent that message, Leonard Kleinrock, distinguished professor of computer science at UCLA
"The idea of the network was you could sit at one computer, log on through the network to a remote computer and use its services there,"
50 years later, the internet has become so ubiquitous that it has almost been rendered invisible. There's hardly an aspect in our daily lives that hasn't been touched and transformed by it.
Q: Take us back to that day 50 years ago. Did you have the sense that this was going to be something you'd be talking about a half a century later?
A: Well, yes and no. Four months before that message was sent, there was a press release that came out of UCLA in which it quotes me as describing what my vision for this network would become. Basically what it said is that this network would be always on, always available. Anybody with any device could get on at anytime from any location, and it would be invisible.
Well, what I missed ... was that this is going to become a social network. People talking to people. Not computers talking to computers, but [the] human element.
Q: Can you briefly explain what you were working on in that lab? Why were you trying to get computers to actually talk to one another?
A: As an MIT graduate student, years before, I recognized I was surrounded by computers and I realized there was no effective [or efficient] way for them to communicate. I did my dissertation, my research, on establishing a mathematical theory of how these networks would work. But there was no such network existing. AT&amp;amp;T said it won't work and, even if it does, we want nothing to do with it.
So I had to wait around for years until the Advanced Research Projects Agency within the Department of Defence decided they needed a network to connect together the computer scientists they were supervising and supporting.
Q: For all the promise of the internet, it has also developed some dark sides that I'm guessing pioneers like yourselves never anticipated.
A: We did not. I knew everybody on the internet at that time, and they were all well-behaved and they all believed in an open, shared free network. So we did not put in any security controls.
When the first spam email occurred, we began to see the dark side emerge as this network reached nefarious people sitting in basements with a high-speed connection, reaching out to millions of people instantaneously, at no cost in time or money, anonymously until all sorts of unpleasant events occurred, which we called the dark side.
But in those early days, I considered the network to be going through its teenage years. Hacking to spam, annoying kinds of effects. I thought that one day this network would mature and grow up. Well, in fact, it took a turn for the worse when nation states, organized crime and extremists came in and began to abuse the network in severe ways.
Q: Is there any part of you that regrets giving birth to this?
A: Absolutely not. The greater good is much more important.
News Roundup
How to use blacklistd(8) with NPF as a fail2ban replacement (https://www.unitedbsd.com/d/63-how-to-use-blacklistd8-with-npf-as-a-fail2ban-replacement)
blacklistd(8) provides an API that can be used by network daemons to communicate with a packet filter via a daemon to enforce opening and closing ports dynamically based on policy.
The interface to the packet filter is in /libexec/blacklistd-helper (this is currently designed for npf) and the configuration file (inspired from inetd.conf) is in etc/blacklistd.conf
Now, blacklistd(8) will require bpfjit(4) (Just-In-Time compiler for Berkeley Packet Filter) in order to properly work, in addition to, naturally, npf(7) as frontend and syslogd(8), as a backend to print diagnostic messages. Also remember npf shall rely on the npflog* virtual network interface to provide logging for tcpdump() to use.
Unfortunately (dont' ask me why ??) in 8.1 all the required kernel components are still not compiled by default in the GENERIC kernel (though they are in HEAD), and are rather provided as modules. Enabling NPF and blacklistd services would normally result in them being automatically loaded as root, but predictably on securelevel=1 this is not going to happen.
FreeBSD’s handbook chapter on blacklistd (https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-blacklistd.html)
OpenBSD crossed 400,000 commits (https://marc.info/?l=openbsd-tech&amp;amp;m=157059352620659&amp;amp;w=2)
Sometime in the last week OpenBSD crossed 400,000 commits (*) upon all our repositories since starting at 1995/10/18 08:37:01 Canada/Mountain. That's a lot of commits by a lot of amazing people.
(*) by one measure.  Since the repository is so large and old, there are a variety of quirks including ChangeLog missing entries and branches not convertible to other repo forms, so measuring is hard.  If you think you've got a great way of measuring, don't be so sure of yourself -- you may have overcounted or undercounted.
Subject to the notes Theo made about under and over counting, FreeBSD should hit 1 million commits (base + ports + docs) some time in 2020
NetBSD + pkgsrc are approaching 600,000, but of course pkgsrc covers other operating systems too
How to Install Bolt CMS with Nginx and Let's Encrypt on FreeBSD 12 (https://www.howtoforge.com/how-to-install-bolt-cms-nginx-ssl-on-freebsd-12/)
Bolt is a sophisticated, lightweight and simple CMS built with PHP. It is released under the open-source MIT-license and source code is hosted as a public repository on Github. A bolt is a tool for Content Management, which strives to be as simple and straightforward as possible. It is quick to set up, easy to configure, uses elegant templates. Bolt is created using modern open-source libraries and is best suited to build sites in HTML5 with modern markup. In this tutorial, we will go through the Bolt CMS installation on FreeBSD 12 system by using Nginx as a web server, MySQL as a database server, and optionally you can secure the transport layer by using acme.sh client and Let's Encrypt certificate authority to add SSL support.
Requirements
The system requirements for Bolt are modest, and it should run on any fairly modern web server:
PHP version 5.5.9 or higher with the following common PHP extensions: pdo, mysqlnd, pgsql, openssl, curl, gd, intl, json, mbstring, opcache, posix, xml, fileinfo, exif, zip.
Access to SQLite (which comes bundled with PHP), or MySQL or PostgreSQL.
Apache with mod_rewrite enabled (.htaccess files) or Nginx (virtual host configuration covered below).
A minimum of 32MB of memory allocated to PHP.
hammer2 - Optimize hammer2 support threads and dispatch (http://lists.dragonflybsd.org/pipermail/commits/2019-September/719632.html)
Refactor the XOP groups in order to be able to queue strategy calls, whenever possible, to the same CPU as the issuer.  This optimizes several cases and reduces unnecessary IPI traffic between cores.  The next best thing to do would be to not queue certain XOPs to an H2 support thread at all, but I would like to keep the threads intact for later clustering work.  
The best scaling case for this is when one has a large number of user threads doing I/O.  One instance of a single-threaded program on an otherwise idle machine might see a slightly reduction in performance but at the same time we completely avoid unnecessarily spamming all cores in the system on the behalf of a single program, so overhead is also significantly lower.
This will tend to increase the number of H2 support threads since we need a certain degree of multiplication for domain separation.
This should significantly increase I/O performance for multi-threaded workloads.
You know, we might as well just run every network service over HTTPS/2 and build another six layers on top of that to appease the OSI 7-layer burrito guys (http://boston.conman.org/2019/10/17.1)
I've seen the writing on the wall, and while for now you can configure Firefox not to use DoH, I'm not confident enough to think it will remain that way. To that end, I've finally set up my own DoH server for use at Chez Boca. It only involved setting up my own CA to generate the appropriate certificates, install my CA certificate into Firefox, configure Apache to run over HTTP/2 (THANK YOU SO VERY XXXXX­XX MUCH GOOGLE FOR SHOVING THIS HTTP/2 XXXXX­XXX DOWN OUR THROATS!—no, I'm not bitter) and write a 150 line script that just queries my own local DNS, because, you know, it's more XXXXX­XX secure or some XXXXX­XXX reason like that.
Sigh.
Beastie Bits
An Oral History of Unix (https://www.princeton.edu/~hos/Mahoney/unixhistory)
NUMA Siloing in the FreeBSD Network Stack [pdf] (https://people.freebsd.org/~gallatin/talks/euro2019.pdf)
EuroBSDCon 2019 videos available (https://www.youtube.com/playlist?list=PLskKNopggjc6NssLc8GEGSiFYJLYdlTQx)
Barbie knows best (https://twitter.com/eksffa/status/1188638425567682560)
For the #OpenBSD #e2k19 attendees.  I did a pre visit today. (https://twitter.com/bob_beck/status/1188226661684301824)
Drawer Find (https://twitter.com/pasha_sh/status/1187877745499561985)
Slides - Removing ROP Gadgets from OpenBSD - AsiaBSDCon 2019 (https://www.openbsd.org/papers/asiabsdcon2019-rop-slides.pdf)
Feedback/Questions
Bostjan - Open source doesn't mean secure (http://dpaste.com/1M5MVCX#wrap)
Malcolm - Allan is Correct. (http://dpaste.com/2RFNR94)
Michael - FreeNAS inside a Jail (http://dpaste.com/28YW3BB#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, Unix, code, blacklistd, fail2ban, npf, bolt, cms, nginx, lets encrypt, hammer2, OSI, 7 layer, https2 </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The earliest Unix code, how to replace fail2ban with blacklistd, OpenBSD crossed 400k commits, how to install Bolt CMS on FreeBSD, optimized hammer2, appeasing the OSI 7-layer burrito guys, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://computerhistory.org/blog/the-earliest-unix-code-an-anniversary-source-code-release/" rel="nofollow">The Earliest Unix Code: An Anniversary Source Code Release</a></h3>

<blockquote>
<p>What is it that runs the servers that hold our online world, be it the web or the cloud? What enables the mobile apps that are at the center of increasingly on-demand lives in the developed world and of mobile banking and messaging in the developing world? The answer is the operating system Unix and its many descendants: Linux, Android, BSD Unix, MacOS, iOS—the list goes on and on. Want to glimpse the Unix in your Mac? Open a Terminal window and enter “man roff” to view the Unix manual entry for an early text formatting program that lives within your operating system.</p>

<p>2019 marks the 50th anniversary of the start of Unix. In the summer of 1969, that same summer that saw humankind’s first steps on the surface of the Moon, computer scientists at the Bell Telephone Laboratories—most centrally Ken Thompson and Dennis Ritchie—began the construction of a new operating system, using a then-aging DEC PDP-7 computer at the labs.</p>
</blockquote>

<hr>

<h3><a href="https://www.cbc.ca/radio/thecurrent/the-current-for-oct-29-2019-1.5339212/this-man-sent-the-first-online-message-50-years-ago-he-s-since-seen-the-web-s-dark-side-emerge-1.5339244" rel="nofollow">This man sent the first online message 50 years ago</a></h3>

<ul>
<li>As many of you have heard in the past, the first online message ever sent between two computers was &quot;lo&quot;, just over 50 years ago, on Oct. 29, 1969. </li>
</ul>

<blockquote>
<p>It was supposed to say &quot;log,&quot; but the computer sending the message — based at UCLA — crashed before the letter &quot;g&quot; was typed. A computer at Stanford 560 kilometres away was supposed to fill in the remaining characters &quot;in,&quot; as in &quot;log in.&quot;</p>
</blockquote>

<ul>
<li>The CBC Radio show, “The Current” has a half-hour interview with the man who sent that message, Leonard Kleinrock, distinguished professor of computer science at UCLA</li>
</ul>

<blockquote>
<p>&quot;The idea of the network was you could sit at one computer, log on through the network to a remote computer and use its services there,&quot;</p>

<p>50 years later, the internet has become so ubiquitous that it has almost been rendered invisible. There&#39;s hardly an aspect in our daily lives that hasn&#39;t been touched and transformed by it.</p>

<p>Q: Take us back to that day 50 years ago. Did you have the sense that this was going to be something you&#39;d be talking about a half a century later?</p>

<p>A: Well, yes and no. Four months before that message was sent, there was a press release that came out of UCLA in which it quotes me as describing what my vision for this network would become. Basically what it said is that this network would be always on, always available. Anybody with any device could get on at anytime from any location, and it would be invisible.</p>

<p>Well, what I missed ... was that this is going to become a social network. People talking to people. Not computers talking to computers, but [the] human element.</p>

<p>Q: Can you briefly explain what you were working on in that lab? Why were you trying to get computers to actually talk to one another?</p>

<p>A: As an MIT graduate student, years before, I recognized I was surrounded by computers and I realized there was no effective [or efficient] way for them to communicate. I did my dissertation, my research, on establishing a mathematical theory of how these networks would work. But there was no such network existing. AT&amp;T said it won&#39;t work and, even if it does, we want nothing to do with it.</p>

<p>So I had to wait around for years until the Advanced Research Projects Agency within the Department of Defence decided they needed a network to connect together the computer scientists they were supervising and supporting.</p>

<p>Q: For all the promise of the internet, it has also developed some dark sides that I&#39;m guessing pioneers like yourselves never anticipated.</p>

<p>A: We did not. I knew everybody on the internet at that time, and they were all well-behaved and they all believed in an open, shared free network. So we did not put in any security controls.</p>

<p>When the first spam email occurred, we began to see the dark side emerge as this network reached nefarious people sitting in basements with a high-speed connection, reaching out to millions of people instantaneously, at no cost in time or money, anonymously until all sorts of unpleasant events occurred, which we called the dark side.</p>

<p>But in those early days, I considered the network to be going through its teenage years. Hacking to spam, annoying kinds of effects. I thought that one day this network would mature and grow up. Well, in fact, it took a turn for the worse when nation states, organized crime and extremists came in and began to abuse the network in severe ways.</p>

<p>Q: Is there any part of you that regrets giving birth to this?</p>

<p>A: Absolutely not. The greater good is much more important.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.unitedbsd.com/d/63-how-to-use-blacklistd8-with-npf-as-a-fail2ban-replacement" rel="nofollow">How to use blacklistd(8) with NPF as a fail2ban replacement</a></h3>

<blockquote>
<p>blacklistd(8) provides an API that can be used by network daemons to communicate with a packet filter via a daemon to enforce opening and closing ports dynamically based on policy.</p>

<p>The interface to the packet filter is in /libexec/blacklistd-helper (this is currently designed for npf) and the configuration file (inspired from inetd.conf) is in etc/blacklistd.conf</p>

<p>Now, blacklistd(8) will require bpfjit(4) (Just-In-Time compiler for Berkeley Packet Filter) in order to properly work, in addition to, naturally, npf(7) as frontend and syslogd(8), as a backend to print diagnostic messages. Also remember npf shall rely on the npflog* virtual network interface to provide logging for tcpdump() to use.</p>

<p>Unfortunately (dont&#39; ask me why ??) in 8.1 all the required kernel components are still not compiled by default in the GENERIC kernel (though they are in HEAD), and are rather provided as modules. Enabling NPF and blacklistd services would normally result in them being automatically loaded as root, but predictably on securelevel=1 this is not going to happen.</p>
</blockquote>

<ul>
<li><a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-blacklistd.html" rel="nofollow">FreeBSD’s handbook chapter on blacklistd</a></li>
</ul>

<hr>

<h3><a href="https://marc.info/?l=openbsd-tech&m=157059352620659&w=2" rel="nofollow">OpenBSD crossed 400,000 commits</a></h3>

<blockquote>
<p>Sometime in the last week OpenBSD crossed 400,000 commits (*) upon all our repositories since starting at 1995/10/18 08:37:01 Canada/Mountain. That&#39;s a lot of commits by a lot of amazing people.</p>

<p>(*) by one measure.  Since the repository is so large and old, there are a variety of quirks including ChangeLog missing entries and branches not convertible to other repo forms, so measuring is hard.  If you think you&#39;ve got a great way of measuring, don&#39;t be so sure of yourself -- you may have overcounted or undercounted.</p>
</blockquote>

<ul>
<li>Subject to the notes Theo made about under and over counting, FreeBSD should hit 1 million commits (base + ports + docs) some time in 2020</li>
<li>NetBSD + pkgsrc are approaching 600,000, but of course pkgsrc covers other operating systems too</li>
</ul>

<hr>

<h3><a href="https://www.howtoforge.com/how-to-install-bolt-cms-nginx-ssl-on-freebsd-12/" rel="nofollow">How to Install Bolt CMS with Nginx and Let&#39;s Encrypt on FreeBSD 12</a></h3>

<blockquote>
<p>Bolt is a sophisticated, lightweight and simple CMS built with PHP. It is released under the open-source MIT-license and source code is hosted as a public repository on Github. A bolt is a tool for Content Management, which strives to be as simple and straightforward as possible. It is quick to set up, easy to configure, uses elegant templates. Bolt is created using modern open-source libraries and is best suited to build sites in HTML5 with modern markup. In this tutorial, we will go through the Bolt CMS installation on FreeBSD 12 system by using Nginx as a web server, MySQL as a database server, and optionally you can secure the transport layer by using acme.sh client and Let&#39;s Encrypt certificate authority to add SSL support.</p>
</blockquote>

<ul>
<li>Requirements</li>
<li>The system requirements for Bolt are modest, and it should run on any fairly modern web server:

<ul>
<li>PHP version 5.5.9 or higher with the following common PHP extensions: pdo, mysqlnd, pgsql, openssl, curl, gd, intl, json, mbstring, opcache, posix, xml, fileinfo, exif, zip.</li>
<li>Access to SQLite (which comes bundled with PHP), or MySQL or PostgreSQL.</li>
<li>Apache with mod_rewrite enabled (.htaccess files) or Nginx (virtual host configuration covered below).</li>
<li>A minimum of 32MB of memory allocated to PHP.</li>
</ul></li>
</ul>

<hr>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-September/719632.html" rel="nofollow">hammer2 - Optimize hammer2 support threads and dispatch</a></h3>

<blockquote>
<p>Refactor the XOP groups in order to be able to queue strategy calls, whenever possible, to the same CPU as the issuer.  This optimizes several cases and reduces unnecessary IPI traffic between cores.  The next best thing to do would be to not queue certain XOPs to an H2 support thread at all, but I would like to keep the threads intact for later clustering work.<br><br>
The best scaling case for this is when one has a large number of user threads doing I/O.  One instance of a single-threaded program on an otherwise idle machine might see a slightly reduction in performance but at the same time we completely avoid unnecessarily spamming all cores in the system on the behalf of a single program, so overhead is also significantly lower.</p>

<p>This will tend to increase the number of H2 support threads since we need a certain degree of multiplication for domain separation.</p>

<p>This should significantly increase I/O performance for multi-threaded workloads.</p>
</blockquote>

<hr>

<h3><a href="http://boston.conman.org/2019/10/17.1" rel="nofollow">You know, we might as well just run every network service over HTTPS/2 and build another six layers on top of that to appease the OSI 7-layer burrito guys</a></h3>

<blockquote>
<p>I&#39;ve seen the writing on the wall, and while for now you can configure Firefox not to use DoH, I&#39;m not confident enough to think it will remain that way. To that end, I&#39;ve finally set up my own DoH server for use at Chez Boca. It only involved setting up my own CA to generate the appropriate certificates, install my CA certificate into Firefox, configure Apache to run over HTTP/2 (THANK YOU SO VERY XXXXX­XX MUCH GOOGLE FOR SHOVING THIS HTTP/2 XXXXX­XXX DOWN OUR THROATS!—no, I&#39;m not bitter) and write a 150 line script that just queries my own local DNS, because, you know, it&#39;s more XXXXX­XX secure or some XXXXX­XXX reason like that.</p>

<p>Sigh.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.princeton.edu/%7Ehos/Mahoney/unixhistory" rel="nofollow">An Oral History of Unix</a></li>
<li><a href="https://people.freebsd.org/%7Egallatin/talks/euro2019.pdf" rel="nofollow">NUMA Siloing in the FreeBSD Network Stack [pdf]</a></li>
<li><a href="https://www.youtube.com/playlist?list=PLskKNopggjc6NssLc8GEGSiFYJLYdlTQx" rel="nofollow">EuroBSDCon 2019 videos available</a></li>
<li><a href="https://twitter.com/eksffa/status/1188638425567682560" rel="nofollow">Barbie knows best</a></li>
<li><a href="https://twitter.com/bob_beck/status/1188226661684301824" rel="nofollow">For the #OpenBSD #e2k19 attendees.  I did a pre visit today.</a></li>
<li><a href="https://twitter.com/pasha_sh/status/1187877745499561985" rel="nofollow">Drawer Find</a></li>
<li><a href="https://www.openbsd.org/papers/asiabsdcon2019-rop-slides.pdf" rel="nofollow">Slides - Removing ROP Gadgets from OpenBSD - AsiaBSDCon 2019</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Bostjan - <a href="http://dpaste.com/1M5MVCX#wrap" rel="nofollow">Open source doesn&#39;t mean secure</a></li>
<li>Malcolm - <a href="http://dpaste.com/2RFNR94" rel="nofollow">Allan is Correct.</a></li>
<li><p>Michael - <a href="http://dpaste.com/28YW3BB#wrap" rel="nofollow">FreeNAS inside a Jail</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0323.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The earliest Unix code, how to replace fail2ban with blacklistd, OpenBSD crossed 400k commits, how to install Bolt CMS on FreeBSD, optimized hammer2, appeasing the OSI 7-layer burrito guys, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://computerhistory.org/blog/the-earliest-unix-code-an-anniversary-source-code-release/" rel="nofollow">The Earliest Unix Code: An Anniversary Source Code Release</a></h3>

<blockquote>
<p>What is it that runs the servers that hold our online world, be it the web or the cloud? What enables the mobile apps that are at the center of increasingly on-demand lives in the developed world and of mobile banking and messaging in the developing world? The answer is the operating system Unix and its many descendants: Linux, Android, BSD Unix, MacOS, iOS—the list goes on and on. Want to glimpse the Unix in your Mac? Open a Terminal window and enter “man roff” to view the Unix manual entry for an early text formatting program that lives within your operating system.</p>

<p>2019 marks the 50th anniversary of the start of Unix. In the summer of 1969, that same summer that saw humankind’s first steps on the surface of the Moon, computer scientists at the Bell Telephone Laboratories—most centrally Ken Thompson and Dennis Ritchie—began the construction of a new operating system, using a then-aging DEC PDP-7 computer at the labs.</p>
</blockquote>

<hr>

<h3><a href="https://www.cbc.ca/radio/thecurrent/the-current-for-oct-29-2019-1.5339212/this-man-sent-the-first-online-message-50-years-ago-he-s-since-seen-the-web-s-dark-side-emerge-1.5339244" rel="nofollow">This man sent the first online message 50 years ago</a></h3>

<ul>
<li>As many of you have heard in the past, the first online message ever sent between two computers was &quot;lo&quot;, just over 50 years ago, on Oct. 29, 1969. </li>
</ul>

<blockquote>
<p>It was supposed to say &quot;log,&quot; but the computer sending the message — based at UCLA — crashed before the letter &quot;g&quot; was typed. A computer at Stanford 560 kilometres away was supposed to fill in the remaining characters &quot;in,&quot; as in &quot;log in.&quot;</p>
</blockquote>

<ul>
<li>The CBC Radio show, “The Current” has a half-hour interview with the man who sent that message, Leonard Kleinrock, distinguished professor of computer science at UCLA</li>
</ul>

<blockquote>
<p>&quot;The idea of the network was you could sit at one computer, log on through the network to a remote computer and use its services there,&quot;</p>

<p>50 years later, the internet has become so ubiquitous that it has almost been rendered invisible. There&#39;s hardly an aspect in our daily lives that hasn&#39;t been touched and transformed by it.</p>

<p>Q: Take us back to that day 50 years ago. Did you have the sense that this was going to be something you&#39;d be talking about a half a century later?</p>

<p>A: Well, yes and no. Four months before that message was sent, there was a press release that came out of UCLA in which it quotes me as describing what my vision for this network would become. Basically what it said is that this network would be always on, always available. Anybody with any device could get on at anytime from any location, and it would be invisible.</p>

<p>Well, what I missed ... was that this is going to become a social network. People talking to people. Not computers talking to computers, but [the] human element.</p>

<p>Q: Can you briefly explain what you were working on in that lab? Why were you trying to get computers to actually talk to one another?</p>

<p>A: As an MIT graduate student, years before, I recognized I was surrounded by computers and I realized there was no effective [or efficient] way for them to communicate. I did my dissertation, my research, on establishing a mathematical theory of how these networks would work. But there was no such network existing. AT&amp;T said it won&#39;t work and, even if it does, we want nothing to do with it.</p>

<p>So I had to wait around for years until the Advanced Research Projects Agency within the Department of Defence decided they needed a network to connect together the computer scientists they were supervising and supporting.</p>

<p>Q: For all the promise of the internet, it has also developed some dark sides that I&#39;m guessing pioneers like yourselves never anticipated.</p>

<p>A: We did not. I knew everybody on the internet at that time, and they were all well-behaved and they all believed in an open, shared free network. So we did not put in any security controls.</p>

<p>When the first spam email occurred, we began to see the dark side emerge as this network reached nefarious people sitting in basements with a high-speed connection, reaching out to millions of people instantaneously, at no cost in time or money, anonymously until all sorts of unpleasant events occurred, which we called the dark side.</p>

<p>But in those early days, I considered the network to be going through its teenage years. Hacking to spam, annoying kinds of effects. I thought that one day this network would mature and grow up. Well, in fact, it took a turn for the worse when nation states, organized crime and extremists came in and began to abuse the network in severe ways.</p>

<p>Q: Is there any part of you that regrets giving birth to this?</p>

<p>A: Absolutely not. The greater good is much more important.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.unitedbsd.com/d/63-how-to-use-blacklistd8-with-npf-as-a-fail2ban-replacement" rel="nofollow">How to use blacklistd(8) with NPF as a fail2ban replacement</a></h3>

<blockquote>
<p>blacklistd(8) provides an API that can be used by network daemons to communicate with a packet filter via a daemon to enforce opening and closing ports dynamically based on policy.</p>

<p>The interface to the packet filter is in /libexec/blacklistd-helper (this is currently designed for npf) and the configuration file (inspired from inetd.conf) is in etc/blacklistd.conf</p>

<p>Now, blacklistd(8) will require bpfjit(4) (Just-In-Time compiler for Berkeley Packet Filter) in order to properly work, in addition to, naturally, npf(7) as frontend and syslogd(8), as a backend to print diagnostic messages. Also remember npf shall rely on the npflog* virtual network interface to provide logging for tcpdump() to use.</p>

<p>Unfortunately (dont&#39; ask me why ??) in 8.1 all the required kernel components are still not compiled by default in the GENERIC kernel (though they are in HEAD), and are rather provided as modules. Enabling NPF and blacklistd services would normally result in them being automatically loaded as root, but predictably on securelevel=1 this is not going to happen.</p>
</blockquote>

<ul>
<li><a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-blacklistd.html" rel="nofollow">FreeBSD’s handbook chapter on blacklistd</a></li>
</ul>

<hr>

<h3><a href="https://marc.info/?l=openbsd-tech&m=157059352620659&w=2" rel="nofollow">OpenBSD crossed 400,000 commits</a></h3>

<blockquote>
<p>Sometime in the last week OpenBSD crossed 400,000 commits (*) upon all our repositories since starting at 1995/10/18 08:37:01 Canada/Mountain. That&#39;s a lot of commits by a lot of amazing people.</p>

<p>(*) by one measure.  Since the repository is so large and old, there are a variety of quirks including ChangeLog missing entries and branches not convertible to other repo forms, so measuring is hard.  If you think you&#39;ve got a great way of measuring, don&#39;t be so sure of yourself -- you may have overcounted or undercounted.</p>
</blockquote>

<ul>
<li>Subject to the notes Theo made about under and over counting, FreeBSD should hit 1 million commits (base + ports + docs) some time in 2020</li>
<li>NetBSD + pkgsrc are approaching 600,000, but of course pkgsrc covers other operating systems too</li>
</ul>

<hr>

<h3><a href="https://www.howtoforge.com/how-to-install-bolt-cms-nginx-ssl-on-freebsd-12/" rel="nofollow">How to Install Bolt CMS with Nginx and Let&#39;s Encrypt on FreeBSD 12</a></h3>

<blockquote>
<p>Bolt is a sophisticated, lightweight and simple CMS built with PHP. It is released under the open-source MIT-license and source code is hosted as a public repository on Github. A bolt is a tool for Content Management, which strives to be as simple and straightforward as possible. It is quick to set up, easy to configure, uses elegant templates. Bolt is created using modern open-source libraries and is best suited to build sites in HTML5 with modern markup. In this tutorial, we will go through the Bolt CMS installation on FreeBSD 12 system by using Nginx as a web server, MySQL as a database server, and optionally you can secure the transport layer by using acme.sh client and Let&#39;s Encrypt certificate authority to add SSL support.</p>
</blockquote>

<ul>
<li>Requirements</li>
<li>The system requirements for Bolt are modest, and it should run on any fairly modern web server:

<ul>
<li>PHP version 5.5.9 or higher with the following common PHP extensions: pdo, mysqlnd, pgsql, openssl, curl, gd, intl, json, mbstring, opcache, posix, xml, fileinfo, exif, zip.</li>
<li>Access to SQLite (which comes bundled with PHP), or MySQL or PostgreSQL.</li>
<li>Apache with mod_rewrite enabled (.htaccess files) or Nginx (virtual host configuration covered below).</li>
<li>A minimum of 32MB of memory allocated to PHP.</li>
</ul></li>
</ul>

<hr>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-September/719632.html" rel="nofollow">hammer2 - Optimize hammer2 support threads and dispatch</a></h3>

<blockquote>
<p>Refactor the XOP groups in order to be able to queue strategy calls, whenever possible, to the same CPU as the issuer.  This optimizes several cases and reduces unnecessary IPI traffic between cores.  The next best thing to do would be to not queue certain XOPs to an H2 support thread at all, but I would like to keep the threads intact for later clustering work.<br><br>
The best scaling case for this is when one has a large number of user threads doing I/O.  One instance of a single-threaded program on an otherwise idle machine might see a slightly reduction in performance but at the same time we completely avoid unnecessarily spamming all cores in the system on the behalf of a single program, so overhead is also significantly lower.</p>

<p>This will tend to increase the number of H2 support threads since we need a certain degree of multiplication for domain separation.</p>

<p>This should significantly increase I/O performance for multi-threaded workloads.</p>
</blockquote>

<hr>

<h3><a href="http://boston.conman.org/2019/10/17.1" rel="nofollow">You know, we might as well just run every network service over HTTPS/2 and build another six layers on top of that to appease the OSI 7-layer burrito guys</a></h3>

<blockquote>
<p>I&#39;ve seen the writing on the wall, and while for now you can configure Firefox not to use DoH, I&#39;m not confident enough to think it will remain that way. To that end, I&#39;ve finally set up my own DoH server for use at Chez Boca. It only involved setting up my own CA to generate the appropriate certificates, install my CA certificate into Firefox, configure Apache to run over HTTP/2 (THANK YOU SO VERY XXXXX­XX MUCH GOOGLE FOR SHOVING THIS HTTP/2 XXXXX­XXX DOWN OUR THROATS!—no, I&#39;m not bitter) and write a 150 line script that just queries my own local DNS, because, you know, it&#39;s more XXXXX­XX secure or some XXXXX­XXX reason like that.</p>

<p>Sigh.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.princeton.edu/%7Ehos/Mahoney/unixhistory" rel="nofollow">An Oral History of Unix</a></li>
<li><a href="https://people.freebsd.org/%7Egallatin/talks/euro2019.pdf" rel="nofollow">NUMA Siloing in the FreeBSD Network Stack [pdf]</a></li>
<li><a href="https://www.youtube.com/playlist?list=PLskKNopggjc6NssLc8GEGSiFYJLYdlTQx" rel="nofollow">EuroBSDCon 2019 videos available</a></li>
<li><a href="https://twitter.com/eksffa/status/1188638425567682560" rel="nofollow">Barbie knows best</a></li>
<li><a href="https://twitter.com/bob_beck/status/1188226661684301824" rel="nofollow">For the #OpenBSD #e2k19 attendees.  I did a pre visit today.</a></li>
<li><a href="https://twitter.com/pasha_sh/status/1187877745499561985" rel="nofollow">Drawer Find</a></li>
<li><a href="https://www.openbsd.org/papers/asiabsdcon2019-rop-slides.pdf" rel="nofollow">Slides - Removing ROP Gadgets from OpenBSD - AsiaBSDCon 2019</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Bostjan - <a href="http://dpaste.com/1M5MVCX#wrap" rel="nofollow">Open source doesn&#39;t mean secure</a></li>
<li>Malcolm - <a href="http://dpaste.com/2RFNR94" rel="nofollow">Allan is Correct.</a></li>
<li><p>Michael - <a href="http://dpaste.com/28YW3BB#wrap" rel="nofollow">FreeNAS inside a Jail</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0323.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>322: Happy Birthday, Unix</title>
  <link>https://www.bsdnow.tv/322</link>
  <guid isPermaLink="false">9f37f100-02f4-4b71-9eeb-3e9fa09f147c</guid>
  <pubDate>Thu, 31 Oct 2019 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9f37f100-02f4-4b71-9eeb-3e9fa09f147c.mp3" length="49383869" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Unix is 50, Hunting down Ken's PDP-7, OpenBSD and OPNSense have new releases, Clarification on what GhostBSD is, sshuttle  - VPN over SSH, and more.</itunes:subtitle>
  <itunes:duration>1:07:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Unix is 50, Hunting down Ken's PDP-7, OpenBSD and OPNSense have new releases, Clarification on what GhostBSD is, sshuttle  - VPN over SSH, and more.
Headlines
Unix is 50 (https://www.bell-labs.com/unix50/)
In the summer of 1969 computer scientists Ken Thompson and Dennis Ritchie created the first implementation of Unix with the goal of designing an elegant and economical operating system for a little-used PDP-7 minicomputer at Bell Labs. That modest project, however, would have a far-reaching legacy. Unix made large-scale networking of diverse computing systems — and the Internet — practical. The Unix team went on to develop the C language, which brought an unprecedented combination of efficiency and expressiveness to programming. Both made computing more "portable". Today, Linux, the most popular descendent of Unix, powers the vast majority of servers, and elements of Unix and Linux are found in most mobile devices. Meanwhile C++ remains one of the most widely used programming languages today. Unix may be a half-century old but its influence is only growing.
Hunting down Ken's PDP-7: video footage found (https://bsdimp.blogspot.com/2019/10/video-footage-of-first-pdp-7-to-run-unix.html)
In my prior blog post, I traced Ken's scrounged PDP-7 to SN 34. In this post I'll show that we have actual video footage of that PDP-7 due to an old film from Bell Labs. this gives us almost a minute of footage of the PDP-7 Ken later used to create Unix.
News Roundup
OpenBSD 6.6 Released (https://openbsd.org/66.html)
Announce: https://marc.info/?l=openbsd-tech&amp;amp;m=157132024225971&amp;amp;w=2
Upgrade Guide: https://openbsd.org/faq/upgrade66.html
Changelog: https://openbsd.org/plus66.html
OPNsense 19.7.5 released (https://opnsense.org/opnsense-19-7-5-released/)
Hello friends and followers, Lots of plugin and ports updates this time with a few minor improvements in all core areas. Behind the scenes we are starting to migrate the base system to version
12.1 which is supposed to hit the next 20.1 release.  Stay tuned for more infos in the next month or so.
Here are the full patch notes:
 + system: show all swap partitions in system information widget
 + system: flatten services_get() in preparation for removal
 + system: pin Syslog-ng version to specific package name
 + system: fix LDAP/StartTLS with user import page
 + system: fix a PHP warning on authentication server page
 + system: replace most subprocess.call use
 + interfaces: fix devd handling of carp devices (contributed by stumbaumr)
 + firewall: improve firewall rules inline toggles
 + firewall: only allow TCP flags on TCP protocol
 + firewall: simplify help text for direction setting
 + firewall: make protocol log summary case insensitive
 + reporting: ignore malformed flow records
 + captive portal: fix type mismatch for timeout read
 + dhcp: add note for static lease limitation with lease registration (contributed by Northguy)
 + ipsec: add margintime and rekeyfuzz options
 + ipsec: clear $dpdline correctly if not set
 + ui: fix tokenizer reorder on multiple saves
 + plugins: os-acme-client 1.26[1]
 + plugins: os-bind will reload bind on record change (contributed by blablup)
 + plugins: os-etpro-telemetry minor subprocess.call replacement
 + plugins: os-freeradius 1.9.4[2]
 + plugins: os-frr 1.12[3]
 + plugins: os-haproxy 2.19[4]
 + plugins: os-mailtrail 1.2[5]
 + plugins: os-postfix 1.11[6]
 + plugins: os-rspamd 1.8[7]
 + plugins: os-sunnyvalley LibreSSL support (contributed by Sunny Valley Networks)
 + plugins: os-telegraf 1.7.6[8]
 + plugins: os-theme-cicada 1.21 (contributed by Team Rebellion)
 + plugins: os-theme-tukan 1.21 (contributed by Team Rebellion)
 + plugins: os-tinc minor subprocess.call replacement
 + plugins: os-tor 1.8 adds dormant mode disable option (contributed by Fabian Franz)
 + plugins: os-virtualbox 1.0 (contributed by andrewhotlab)
Dealing with the misunderstandings of what is GhostBSD (http://ghostbsd.org/node/194)
Since the release of 19.09, I have seen a lot of misunderstandings on what is GhostBSD and the future of GhostBSD. GhostBSD is based on TrueOS with FreeBSD 12 STABLE with our twist to it. We are still continuing to use TrueOS for OpenRC, and the new package's system for the base system that is built from ports. GhostBSD is becoming a slow-moving rolling release base on the latest TrueOS with FreeBSD 12 STABLE. When FreeBSD 13 STABLE gets released, GhostBSD will be upgraded to TrueOS with FreeBSD 13 STABLE.
Our official desktop is MATE, which means that the leading developer of GhostBSD does not officially support XFCE. Community releases are maintained by the community and for the community. GhostBSD project will provide help to build and to host the community release. If anyone wants to have a particular desktop supported, it is up to the community. Sure I will help where I can, answer questions and guide new community members that contribute to community release.
There is some effort going on for Plasma5 desktop. If anyone is interested in helping with XFCE and Plasma5 or in creating another community release, you are well come to contribute. Also, Contribution to the GhostBSD base system, to ports and new ports, and in house software are welcome. We are mostly active on Telegram https://t.me/ghostbsd, but you can also reach us on the forum.
SHUTTLE – VPN over SSH | VPN Alternative (https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn-alternative/)
Looking for a lightweight VPN client, but are not ready to spend a monthly recurring amount on a VPN? VPNs can be expensive depending upon the quality of service and amount of privacy you want. A good VPN plan can easily set you back by 10$ a month and even that doesn’t guarantee your privacy. There is no way to be sure whether the VPN is storing your confidential information and traffic logs or not. sshuttle is the answer to your problem it provides VPN over ssh and in this article we’re going to explore this cheap yet powerful alternative to the expensive VPNs. By using open source tools you can control your own privacy.
VPN over SSH – sshuttle
sshuttle is an awesome program that allows you to create a VPN connection from your local machine to any remote server that you have ssh access on. The tunnel established over the ssh connection can then be used to route all your traffic from client machine through the remote machine including all the dns traffic. In the bare bones sshuttle is just a proxy server which runs on the client machine and forwards all the traffic to a ssh tunnel. Since its open source it holds quite a lot of major advantages over traditional VPN.
OpenSSH 8.1 Released (http://www.openssh.com/txt/release-8.1)
Security
ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): an exploitable integer overflow bug was found in the private key parsing code for the XMSS key type. This key type is still experimental and support for it is not compiled by default. No user-facing autoconf option exists in portable OpenSSH to enable it. This bug was found by Adam Zabrocki and reported via SecuriTeam's SSD program.
ssh(1), sshd(8), ssh-agent(1): add protection for private keys at rest in RAM against speculation and memory side-channel attacks like Spectre, Meltdown and Rambleed. This release encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large "prekey" consisting of random data (currently 16KB).
This release includes a number of changes that may affect existing configurations:
ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. Certificates signed by RSA keys will therefore be incompatible with OpenSSH versions prior to 7.2 unless the default is overridden (using "ssh-keygen -t ssh-rsa -s ...").
New Features
ssh(1): Allow %n to be expanded in ProxyCommand strings
ssh(1), sshd(8): Allow prepending a list of algorithms to the default set by starting the list with the '^' character, E.g. "HostKeyAlgorithms ^ssh-ed25519"
ssh-keygen(1): add an experimental lightweight signature and verification ability. Signatures may be made using regular ssh keys held on disk or stored in a ssh-agent and verified against an authorized_keys-like list of allowed keys. Signatures embed a namespace that prevents confusion and attacks between different usage domains (e.g. files vs email).
ssh-keygen(1): print key comment when extracting public key from a private key.
ssh-keygen(1): accept the verbose flag when searching for host keys in known hosts (i.e. "ssh-keygen -vF host") to print the matching host's random-art signature too.
All: support PKCS8 as an optional format for storage of private keys to disk.  The OpenSSH native key format remains the default, but PKCS8 is a superior format to PEM if interoperability with non-OpenSSH software is required, as it may use a less insecure key derivation function than PEM's.
Beastie Bits
Say goodbye to the 32 CPU limit in NetBSD/aarch64 (https://twitter.com/jmcwhatever/status/1185584719183962112)
vBSDcon 2019 videos (https://www.youtube.com/channel/UCvcdrOSlYOSzOzLjv_n1_GQ/videos)
Browse the web in the terminal - W3M (https://www.youtube.com/watch?v=3Hfda0Tjqsg&amp;amp;feature=youtu.be)
NetBSD 9 and GSoC (http://netbsd.org/~kamil/GSoC2019.html#slide1)
BSDCan 2019 Videos (https://www.youtube.com/playlist?list=PLeF8ZihVdpFegPoAKppaDSoYmsBvpnSZv)
NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders (https://www.nycbug.org/index?action=view&amp;amp;id=10673)
FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open (https://www.freebsdfoundation.org/blog/freebsd-miniconf-at-linux-conf-au-2020-call-for-sessions-now-open/)
FOSDEM 2020 - BSD Devroom Call for Participation (https://people.freebsd.org/~rodrigo/fosdem20/)
University of Cambridge looking for Research Assistants/Associates (https://twitter.com/ed_maste/status/1184865668317007874)
Feedback/Questions
Trenton - Beeping Thinkpad (http://dpaste.com/0ZEXNM6#wrap)
Alex - Per user ZFS Datasets (http://dpaste.com/1K31A65#wrap)
Allan’s old patch from 2015 (https://reviews.freebsd.org/D2272)
Javier - FBSD 12.0 + ZFS + encryption (http://dpaste.com/1XX4NNA#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, unix, 50 years unix, pdp 7, pdp, release, opnsense, ghostbsd, sshuttle, vpn, ssh, vpn over ssh, openssh</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Unix is 50, Hunting down Ken&#39;s PDP-7, OpenBSD and OPNSense have new releases, Clarification on what GhostBSD is, sshuttle  - VPN over SSH, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.bell-labs.com/unix50/" rel="nofollow">Unix is 50</a></h3>

<blockquote>
<p>In the summer of 1969 computer scientists Ken Thompson and Dennis Ritchie created the first implementation of Unix with the goal of designing an elegant and economical operating system for a little-used PDP-7 minicomputer at Bell Labs. That modest project, however, would have a far-reaching legacy. Unix made large-scale networking of diverse computing systems — and the Internet — practical. The Unix team went on to develop the C language, which brought an unprecedented combination of efficiency and expressiveness to programming. Both made computing more &quot;portable&quot;. Today, Linux, the most popular descendent of Unix, powers the vast majority of servers, and elements of Unix and Linux are found in most mobile devices. Meanwhile C++ remains one of the most widely used programming languages today. Unix may be a half-century old but its influence is only growing.</p>
</blockquote>

<hr>

<h3><a href="https://bsdimp.blogspot.com/2019/10/video-footage-of-first-pdp-7-to-run-unix.html" rel="nofollow">Hunting down Ken&#39;s PDP-7: video footage found</a></h3>

<blockquote>
<p>In my prior blog post, I traced Ken&#39;s scrounged PDP-7 to SN 34. In this post I&#39;ll show that we have actual video footage of that PDP-7 due to an old film from Bell Labs. this gives us almost a minute of footage of the PDP-7 Ken later used to create Unix.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://openbsd.org/66.html" rel="nofollow">OpenBSD 6.6 Released</a></h3>

<ul>
<li>Announce: <a href="https://marc.info/?l=openbsd-tech&m=157132024225971&w=2" rel="nofollow">https://marc.info/?l=openbsd-tech&amp;m=157132024225971&amp;w=2</a></li>
<li>Upgrade Guide: <a href="https://openbsd.org/faq/upgrade66.html" rel="nofollow">https://openbsd.org/faq/upgrade66.html</a></li>
<li>Changelog: <a href="https://openbsd.org/plus66.html" rel="nofollow">https://openbsd.org/plus66.html</a></li>
</ul>

<hr>

<h3><a href="https://opnsense.org/opnsense-19-7-5-released/" rel="nofollow">OPNsense 19.7.5 released</a></h3>

<blockquote>
<p>Hello friends and followers, Lots of plugin and ports updates this time with a few minor improvements in all core areas. Behind the scenes we are starting to migrate the base system to version</p>
</blockquote>

<p>12.1 which is supposed to hit the next 20.1 release.  Stay tuned for more infos in the next month or so.</p>

<p>Here are the full patch notes:</p>

<ul>
<li>system: show all swap partitions in system information widget</li>
<li>system: flatten services_get() in preparation for removal</li>
<li>system: pin Syslog-ng version to specific package name</li>
<li>system: fix LDAP/StartTLS with user import page</li>
<li>system: fix a PHP warning on authentication server page</li>
<li>system: replace most subprocess.call use</li>
<li>interfaces: fix devd handling of carp devices (contributed by stumbaumr)</li>
<li>firewall: improve firewall rules inline toggles</li>
<li>firewall: only allow TCP flags on TCP protocol</li>
<li>firewall: simplify help text for direction setting</li>
<li>firewall: make protocol log summary case insensitive</li>
<li>reporting: ignore malformed flow records</li>
<li>captive portal: fix type mismatch for timeout read</li>
<li>dhcp: add note for static lease limitation with lease registration (contributed by Northguy)</li>
<li>ipsec: add margintime and rekeyfuzz options</li>
<li>ipsec: clear $dpdline correctly if not set</li>
<li>ui: fix tokenizer reorder on multiple saves</li>
<li>plugins: os-acme-client 1.26[1]</li>
<li>plugins: os-bind will reload bind on record change (contributed by blablup)</li>
<li>plugins: os-etpro-telemetry minor subprocess.call replacement</li>
<li>plugins: os-freeradius 1.9.4[2]</li>
<li>plugins: os-frr 1.12[3]</li>
<li>plugins: os-haproxy 2.19[4]</li>
<li>plugins: os-mailtrail 1.2[5]</li>
<li>plugins: os-postfix 1.11[6]</li>
<li>plugins: os-rspamd 1.8[7]</li>
<li>plugins: os-sunnyvalley LibreSSL support (contributed by Sunny Valley Networks)</li>
<li>plugins: os-telegraf 1.7.6[8]</li>
<li>plugins: os-theme-cicada 1.21 (contributed by Team Rebellion)</li>
<li>plugins: os-theme-tukan 1.21 (contributed by Team Rebellion)</li>
<li>plugins: os-tinc minor subprocess.call replacement</li>
<li>plugins: os-tor 1.8 adds dormant mode disable option (contributed by Fabian Franz)</li>
<li>plugins: os-virtualbox 1.0 (contributed by andrewhotlab)</li>
</ul>

<hr>

<h3><a href="http://ghostbsd.org/node/194" rel="nofollow">Dealing with the misunderstandings of what is GhostBSD</a></h3>

<blockquote>
<p>Since the release of 19.09, I have seen a lot of misunderstandings on what is GhostBSD and the future of GhostBSD. GhostBSD is based on TrueOS with FreeBSD 12 STABLE with our twist to it. We are still continuing to use TrueOS for OpenRC, and the new package&#39;s system for the base system that is built from ports. GhostBSD is becoming a slow-moving rolling release base on the latest TrueOS with FreeBSD 12 STABLE. When FreeBSD 13 STABLE gets released, GhostBSD will be upgraded to TrueOS with FreeBSD 13 STABLE.</p>

<p>Our official desktop is MATE, which means that the leading developer of GhostBSD does not officially support XFCE. Community releases are maintained by the community and for the community. GhostBSD project will provide help to build and to host the community release. If anyone wants to have a particular desktop supported, it is up to the community. Sure I will help where I can, answer questions and guide new community members that contribute to community release.</p>

<p>There is some effort going on for Plasma5 desktop. If anyone is interested in helping with XFCE and Plasma5 or in creating another community release, you are well come to contribute. Also, Contribution to the GhostBSD base system, to ports and new ports, and in house software are welcome. We are mostly active on Telegram <a href="https://t.me/ghostbsd" rel="nofollow">https://t.me/ghostbsd</a>, but you can also reach us on the forum.</p>
</blockquote>

<hr>

<h3><a href="https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn-alternative/" rel="nofollow">SHUTTLE – VPN over SSH | VPN Alternative</a></h3>

<blockquote>
<p>Looking for a lightweight VPN client, but are not ready to spend a monthly recurring amount on a VPN? VPNs can be expensive depending upon the quality of service and amount of privacy you want. A good VPN plan can easily set you back by 10$ a month and even that doesn’t guarantee your privacy. There is no way to be sure whether the VPN is storing your confidential information and traffic logs or not. sshuttle is the answer to your problem it provides VPN over ssh and in this article we’re going to explore this cheap yet powerful alternative to the expensive VPNs. By using open source tools you can control your own privacy.</p>
</blockquote>

<ul>
<li>VPN over SSH – sshuttle</li>
</ul>

<blockquote>
<p>sshuttle is an awesome program that allows you to create a VPN connection from your local machine to any remote server that you have ssh access on. The tunnel established over the ssh connection can then be used to route all your traffic from client machine through the remote machine including all the dns traffic. In the bare bones sshuttle is just a proxy server which runs on the client machine and forwards all the traffic to a ssh tunnel. Since its open source it holds quite a lot of major advantages over traditional VPN.</p>
</blockquote>

<hr>

<h3><a href="http://www.openssh.com/txt/release-8.1" rel="nofollow">OpenSSH 8.1 Released</a></h3>

<ul>
<li><p>Security</p>

<ul>
<li>ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): an exploitable integer overflow bug was found in the private key parsing code for the XMSS key type. This key type is still experimental and support for it is not compiled by default. No user-facing autoconf option exists in portable OpenSSH to enable it. This bug was found by Adam Zabrocki and reported via SecuriTeam&#39;s SSD program.</li>
<li>ssh(1), sshd(8), ssh-agent(1): add protection for private keys at rest in RAM against speculation and memory side-channel attacks like Spectre, Meltdown and Rambleed. This release encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large &quot;prekey&quot; consisting of random data (currently 16KB).</li>
</ul></li>
<li><p>This release includes a number of changes that may affect existing configurations:</p>

<ul>
<li>ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. Certificates signed by RSA keys will therefore be incompatible with OpenSSH versions prior to 7.2 unless the default is overridden (using &quot;ssh-keygen -t ssh-rsa -s ...&quot;).</li>
</ul></li>
<li><p>New Features</p>

<ul>
<li>ssh(1): Allow %n to be expanded in ProxyCommand strings</li>
<li>ssh(1), sshd(8): Allow prepending a list of algorithms to the default set by starting the list with the &#39;<sup>&#39;</sup> character, E.g. &quot;HostKeyAlgorithms <sup>ssh-ed25519&quot;</sup></li>
<li>ssh-keygen(1): add an experimental lightweight signature and verification ability. Signatures may be made using regular ssh keys held on disk or stored in a ssh-agent and verified against an authorized_keys-like list of allowed keys. Signatures embed a namespace that prevents confusion and attacks between different usage domains (e.g. files vs email).</li>
<li>ssh-keygen(1): print key comment when extracting public key from a private key.</li>
<li>ssh-keygen(1): accept the verbose flag when searching for host keys in known hosts (i.e. &quot;ssh-keygen -vF host&quot;) to print the matching host&#39;s random-art signature too.</li>
<li>All: support PKCS8 as an optional format for storage of private keys to disk.  The OpenSSH native key format remains the default, but PKCS8 is a superior format to PEM if interoperability with non-OpenSSH software is required, as it may use a less insecure key derivation function than PEM&#39;s.</li>
</ul></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/jmcwhatever/status/1185584719183962112" rel="nofollow">Say goodbye to the 32 CPU limit in NetBSD/aarch64</a></li>
<li><a href="https://www.youtube.com/channel/UCvcdrOSlYOSzOzLjv_n1_GQ/videos" rel="nofollow">vBSDcon 2019 videos</a></li>
<li><a href="https://www.youtube.com/watch?v=3Hfda0Tjqsg&feature=youtu.be" rel="nofollow">Browse the web in the terminal - W3M</a></li>
<li><a href="http://netbsd.org/%7Ekamil/GSoC2019.html#slide1" rel="nofollow">NetBSD 9 and GSoC</a></li>
<li><a href="https://www.youtube.com/playlist?list=PLeF8ZihVdpFegPoAKppaDSoYmsBvpnSZv" rel="nofollow">BSDCan 2019 Videos</a></li>
<li><a href="https://www.nycbug.org/index?action=view&id=10673" rel="nofollow">NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/freebsd-miniconf-at-linux-conf-au-2020-call-for-sessions-now-open/" rel="nofollow">FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open</a></li>
<li><a href="https://people.freebsd.org/%7Erodrigo/fosdem20/" rel="nofollow">FOSDEM 2020 - BSD Devroom Call for Participation</a></li>
<li><a href="https://twitter.com/ed_maste/status/1184865668317007874" rel="nofollow">University of Cambridge looking for Research Assistants/Associates</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Trenton - <a href="http://dpaste.com/0ZEXNM6#wrap" rel="nofollow">Beeping Thinkpad</a></li>
<li>Alex - <a href="http://dpaste.com/1K31A65#wrap" rel="nofollow">Per user ZFS Datasets</a>

<ul>
<li><a href="https://reviews.freebsd.org/D2272" rel="nofollow">Allan’s old patch from 2015</a></li>
</ul></li>
<li>Javier - <a href="http://dpaste.com/1XX4NNA#wrap" rel="nofollow">FBSD 12.0 + ZFS + encryption</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0322.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Unix is 50, Hunting down Ken&#39;s PDP-7, OpenBSD and OPNSense have new releases, Clarification on what GhostBSD is, sshuttle  - VPN over SSH, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.bell-labs.com/unix50/" rel="nofollow">Unix is 50</a></h3>

<blockquote>
<p>In the summer of 1969 computer scientists Ken Thompson and Dennis Ritchie created the first implementation of Unix with the goal of designing an elegant and economical operating system for a little-used PDP-7 minicomputer at Bell Labs. That modest project, however, would have a far-reaching legacy. Unix made large-scale networking of diverse computing systems — and the Internet — practical. The Unix team went on to develop the C language, which brought an unprecedented combination of efficiency and expressiveness to programming. Both made computing more &quot;portable&quot;. Today, Linux, the most popular descendent of Unix, powers the vast majority of servers, and elements of Unix and Linux are found in most mobile devices. Meanwhile C++ remains one of the most widely used programming languages today. Unix may be a half-century old but its influence is only growing.</p>
</blockquote>

<hr>

<h3><a href="https://bsdimp.blogspot.com/2019/10/video-footage-of-first-pdp-7-to-run-unix.html" rel="nofollow">Hunting down Ken&#39;s PDP-7: video footage found</a></h3>

<blockquote>
<p>In my prior blog post, I traced Ken&#39;s scrounged PDP-7 to SN 34. In this post I&#39;ll show that we have actual video footage of that PDP-7 due to an old film from Bell Labs. this gives us almost a minute of footage of the PDP-7 Ken later used to create Unix.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://openbsd.org/66.html" rel="nofollow">OpenBSD 6.6 Released</a></h3>

<ul>
<li>Announce: <a href="https://marc.info/?l=openbsd-tech&m=157132024225971&w=2" rel="nofollow">https://marc.info/?l=openbsd-tech&amp;m=157132024225971&amp;w=2</a></li>
<li>Upgrade Guide: <a href="https://openbsd.org/faq/upgrade66.html" rel="nofollow">https://openbsd.org/faq/upgrade66.html</a></li>
<li>Changelog: <a href="https://openbsd.org/plus66.html" rel="nofollow">https://openbsd.org/plus66.html</a></li>
</ul>

<hr>

<h3><a href="https://opnsense.org/opnsense-19-7-5-released/" rel="nofollow">OPNsense 19.7.5 released</a></h3>

<blockquote>
<p>Hello friends and followers, Lots of plugin and ports updates this time with a few minor improvements in all core areas. Behind the scenes we are starting to migrate the base system to version</p>
</blockquote>

<p>12.1 which is supposed to hit the next 20.1 release.  Stay tuned for more infos in the next month or so.</p>

<p>Here are the full patch notes:</p>

<ul>
<li>system: show all swap partitions in system information widget</li>
<li>system: flatten services_get() in preparation for removal</li>
<li>system: pin Syslog-ng version to specific package name</li>
<li>system: fix LDAP/StartTLS with user import page</li>
<li>system: fix a PHP warning on authentication server page</li>
<li>system: replace most subprocess.call use</li>
<li>interfaces: fix devd handling of carp devices (contributed by stumbaumr)</li>
<li>firewall: improve firewall rules inline toggles</li>
<li>firewall: only allow TCP flags on TCP protocol</li>
<li>firewall: simplify help text for direction setting</li>
<li>firewall: make protocol log summary case insensitive</li>
<li>reporting: ignore malformed flow records</li>
<li>captive portal: fix type mismatch for timeout read</li>
<li>dhcp: add note for static lease limitation with lease registration (contributed by Northguy)</li>
<li>ipsec: add margintime and rekeyfuzz options</li>
<li>ipsec: clear $dpdline correctly if not set</li>
<li>ui: fix tokenizer reorder on multiple saves</li>
<li>plugins: os-acme-client 1.26[1]</li>
<li>plugins: os-bind will reload bind on record change (contributed by blablup)</li>
<li>plugins: os-etpro-telemetry minor subprocess.call replacement</li>
<li>plugins: os-freeradius 1.9.4[2]</li>
<li>plugins: os-frr 1.12[3]</li>
<li>plugins: os-haproxy 2.19[4]</li>
<li>plugins: os-mailtrail 1.2[5]</li>
<li>plugins: os-postfix 1.11[6]</li>
<li>plugins: os-rspamd 1.8[7]</li>
<li>plugins: os-sunnyvalley LibreSSL support (contributed by Sunny Valley Networks)</li>
<li>plugins: os-telegraf 1.7.6[8]</li>
<li>plugins: os-theme-cicada 1.21 (contributed by Team Rebellion)</li>
<li>plugins: os-theme-tukan 1.21 (contributed by Team Rebellion)</li>
<li>plugins: os-tinc minor subprocess.call replacement</li>
<li>plugins: os-tor 1.8 adds dormant mode disable option (contributed by Fabian Franz)</li>
<li>plugins: os-virtualbox 1.0 (contributed by andrewhotlab)</li>
</ul>

<hr>

<h3><a href="http://ghostbsd.org/node/194" rel="nofollow">Dealing with the misunderstandings of what is GhostBSD</a></h3>

<blockquote>
<p>Since the release of 19.09, I have seen a lot of misunderstandings on what is GhostBSD and the future of GhostBSD. GhostBSD is based on TrueOS with FreeBSD 12 STABLE with our twist to it. We are still continuing to use TrueOS for OpenRC, and the new package&#39;s system for the base system that is built from ports. GhostBSD is becoming a slow-moving rolling release base on the latest TrueOS with FreeBSD 12 STABLE. When FreeBSD 13 STABLE gets released, GhostBSD will be upgraded to TrueOS with FreeBSD 13 STABLE.</p>

<p>Our official desktop is MATE, which means that the leading developer of GhostBSD does not officially support XFCE. Community releases are maintained by the community and for the community. GhostBSD project will provide help to build and to host the community release. If anyone wants to have a particular desktop supported, it is up to the community. Sure I will help where I can, answer questions and guide new community members that contribute to community release.</p>

<p>There is some effort going on for Plasma5 desktop. If anyone is interested in helping with XFCE and Plasma5 or in creating another community release, you are well come to contribute. Also, Contribution to the GhostBSD base system, to ports and new ports, and in house software are welcome. We are mostly active on Telegram <a href="https://t.me/ghostbsd" rel="nofollow">https://t.me/ghostbsd</a>, but you can also reach us on the forum.</p>
</blockquote>

<hr>

<h3><a href="https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn-alternative/" rel="nofollow">SHUTTLE – VPN over SSH | VPN Alternative</a></h3>

<blockquote>
<p>Looking for a lightweight VPN client, but are not ready to spend a monthly recurring amount on a VPN? VPNs can be expensive depending upon the quality of service and amount of privacy you want. A good VPN plan can easily set you back by 10$ a month and even that doesn’t guarantee your privacy. There is no way to be sure whether the VPN is storing your confidential information and traffic logs or not. sshuttle is the answer to your problem it provides VPN over ssh and in this article we’re going to explore this cheap yet powerful alternative to the expensive VPNs. By using open source tools you can control your own privacy.</p>
</blockquote>

<ul>
<li>VPN over SSH – sshuttle</li>
</ul>

<blockquote>
<p>sshuttle is an awesome program that allows you to create a VPN connection from your local machine to any remote server that you have ssh access on. The tunnel established over the ssh connection can then be used to route all your traffic from client machine through the remote machine including all the dns traffic. In the bare bones sshuttle is just a proxy server which runs on the client machine and forwards all the traffic to a ssh tunnel. Since its open source it holds quite a lot of major advantages over traditional VPN.</p>
</blockquote>

<hr>

<h3><a href="http://www.openssh.com/txt/release-8.1" rel="nofollow">OpenSSH 8.1 Released</a></h3>

<ul>
<li><p>Security</p>

<ul>
<li>ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): an exploitable integer overflow bug was found in the private key parsing code for the XMSS key type. This key type is still experimental and support for it is not compiled by default. No user-facing autoconf option exists in portable OpenSSH to enable it. This bug was found by Adam Zabrocki and reported via SecuriTeam&#39;s SSD program.</li>
<li>ssh(1), sshd(8), ssh-agent(1): add protection for private keys at rest in RAM against speculation and memory side-channel attacks like Spectre, Meltdown and Rambleed. This release encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large &quot;prekey&quot; consisting of random data (currently 16KB).</li>
</ul></li>
<li><p>This release includes a number of changes that may affect existing configurations:</p>

<ul>
<li>ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. Certificates signed by RSA keys will therefore be incompatible with OpenSSH versions prior to 7.2 unless the default is overridden (using &quot;ssh-keygen -t ssh-rsa -s ...&quot;).</li>
</ul></li>
<li><p>New Features</p>

<ul>
<li>ssh(1): Allow %n to be expanded in ProxyCommand strings</li>
<li>ssh(1), sshd(8): Allow prepending a list of algorithms to the default set by starting the list with the &#39;<sup>&#39;</sup> character, E.g. &quot;HostKeyAlgorithms <sup>ssh-ed25519&quot;</sup></li>
<li>ssh-keygen(1): add an experimental lightweight signature and verification ability. Signatures may be made using regular ssh keys held on disk or stored in a ssh-agent and verified against an authorized_keys-like list of allowed keys. Signatures embed a namespace that prevents confusion and attacks between different usage domains (e.g. files vs email).</li>
<li>ssh-keygen(1): print key comment when extracting public key from a private key.</li>
<li>ssh-keygen(1): accept the verbose flag when searching for host keys in known hosts (i.e. &quot;ssh-keygen -vF host&quot;) to print the matching host&#39;s random-art signature too.</li>
<li>All: support PKCS8 as an optional format for storage of private keys to disk.  The OpenSSH native key format remains the default, but PKCS8 is a superior format to PEM if interoperability with non-OpenSSH software is required, as it may use a less insecure key derivation function than PEM&#39;s.</li>
</ul></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/jmcwhatever/status/1185584719183962112" rel="nofollow">Say goodbye to the 32 CPU limit in NetBSD/aarch64</a></li>
<li><a href="https://www.youtube.com/channel/UCvcdrOSlYOSzOzLjv_n1_GQ/videos" rel="nofollow">vBSDcon 2019 videos</a></li>
<li><a href="https://www.youtube.com/watch?v=3Hfda0Tjqsg&feature=youtu.be" rel="nofollow">Browse the web in the terminal - W3M</a></li>
<li><a href="http://netbsd.org/%7Ekamil/GSoC2019.html#slide1" rel="nofollow">NetBSD 9 and GSoC</a></li>
<li><a href="https://www.youtube.com/playlist?list=PLeF8ZihVdpFegPoAKppaDSoYmsBvpnSZv" rel="nofollow">BSDCan 2019 Videos</a></li>
<li><a href="https://www.nycbug.org/index?action=view&id=10673" rel="nofollow">NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/freebsd-miniconf-at-linux-conf-au-2020-call-for-sessions-now-open/" rel="nofollow">FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open</a></li>
<li><a href="https://people.freebsd.org/%7Erodrigo/fosdem20/" rel="nofollow">FOSDEM 2020 - BSD Devroom Call for Participation</a></li>
<li><a href="https://twitter.com/ed_maste/status/1184865668317007874" rel="nofollow">University of Cambridge looking for Research Assistants/Associates</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Trenton - <a href="http://dpaste.com/0ZEXNM6#wrap" rel="nofollow">Beeping Thinkpad</a></li>
<li>Alex - <a href="http://dpaste.com/1K31A65#wrap" rel="nofollow">Per user ZFS Datasets</a>

<ul>
<li><a href="https://reviews.freebsd.org/D2272" rel="nofollow">Allan’s old patch from 2015</a></li>
</ul></li>
<li>Javier - <a href="http://dpaste.com/1XX4NNA#wrap" rel="nofollow">FBSD 12.0 + ZFS + encryption</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0322.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>321: The Robot OS</title>
  <link>https://www.bsdnow.tv/321</link>
  <guid isPermaLink="false">fca983bf-93c9-460f-8c32-3b32663d463d</guid>
  <pubDate>Wed, 23 Oct 2019 23:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fca983bf-93c9-460f-8c32-3b32663d463d.mp3" length="39796738" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>An interview with Trenton Schulz about his early days with FreeBSD, Robot OS, Qt, and more.</itunes:subtitle>
  <itunes:duration>55:16</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>An interview with Trenton Schulz about his early days with FreeBSD, Robot OS, Qt, and more.
Interview - Trenton Schulz - freenas@norwegianrockcat.com (mailto:freenas@norwegianrockcat.com)
Robot OS on FreeBSD
BR: Welcome to the show. Can you tell us a little bit about yourself and how you got started with BSD?
AJ: You were working for Trolltech (creators of Qt). Was FreeBSD used there and how?
BR: Can you tell us more about the work you are doing with Robot OS on FreeBSD?
AJ: Was EuroBSDcon your first BSD conference? How did you like it?
BR: Do you have some tips or advice on how to get started with the BSDs?
AJ: Is there anything else you’d like to tell us before we let you go?
Beastie Bits
FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open (https://www.freebsdfoundation.org/blog/freebsd-miniconf-at-linux-conf-au-2020-call-for-sessions-now-open/)
Portland BSD Pizza Night: Oct 24th, 19:00 @ Rudy’s Gourmet Pizza (http://calagator.org/events/1250476319)
NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders  (https://www.nycbug.org/index?action=view&amp;amp;id=10673)
FOSDEM 2020 - BSD Devroom Call for Participation (https://people.freebsd.org/~rodrigo/fosdem20/)
University of Cambridge looking for Research Assistants/Associates (https://twitter.com/ed_maste/status/1184865668317007874)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 Special Guest: Trenton Shulz.
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, unix at 50, unix code, source code, release, Ken Thompson, pdp-7, pdp 7</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>An interview with Trenton Schulz about his early days with FreeBSD, Robot OS, Qt, and more.</p>

<h2>Interview - Trenton Schulz - <a href="mailto:freenas@norwegianrockcat.com" rel="nofollow">freenas@norwegianrockcat.com</a></h2>

<p>Robot OS on FreeBSD</p>

<ul>
<li><strong>BR:</strong> Welcome to the show. Can you tell us a little bit about yourself and how you got started with BSD?</li>
<li><strong>AJ:</strong> You were working for Trolltech (creators of Qt). Was FreeBSD used there and how?</li>
<li><strong>BR:</strong> Can you tell us more about the work you are doing with Robot OS on FreeBSD?</li>
<li><strong>AJ:</strong> Was EuroBSDcon your first BSD conference? How did you like it?</li>
<li><strong>BR:</strong> Do you have some tips or advice on how to get started with the BSDs?</li>
<li><strong>AJ:</strong> Is there anything else you’d like to tell us before we let you go?</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/freebsd-miniconf-at-linux-conf-au-2020-call-for-sessions-now-open/" rel="nofollow">FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open</a></li>
<li><a href="http://calagator.org/events/1250476319" rel="nofollow">Portland BSD Pizza Night: Oct 24th, 19:00 @ Rudy’s Gourmet Pizza</a></li>
<li><a href="https://www.nycbug.org/index?action=view&id=10673" rel="nofollow">NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders </a></li>
<li><a href="https://people.freebsd.org/%7Erodrigo/fosdem20/" rel="nofollow">FOSDEM 2020 - BSD Devroom Call for Participation</a></li>
<li><a href="https://twitter.com/ed_maste/status/1184865668317007874" rel="nofollow">University of Cambridge looking for Research Assistants/Associates</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0321.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video><p>Special Guest: Trenton Shulz.</p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>An interview with Trenton Schulz about his early days with FreeBSD, Robot OS, Qt, and more.</p>

<h2>Interview - Trenton Schulz - <a href="mailto:freenas@norwegianrockcat.com" rel="nofollow">freenas@norwegianrockcat.com</a></h2>

<p>Robot OS on FreeBSD</p>

<ul>
<li><strong>BR:</strong> Welcome to the show. Can you tell us a little bit about yourself and how you got started with BSD?</li>
<li><strong>AJ:</strong> You were working for Trolltech (creators of Qt). Was FreeBSD used there and how?</li>
<li><strong>BR:</strong> Can you tell us more about the work you are doing with Robot OS on FreeBSD?</li>
<li><strong>AJ:</strong> Was EuroBSDcon your first BSD conference? How did you like it?</li>
<li><strong>BR:</strong> Do you have some tips or advice on how to get started with the BSDs?</li>
<li><strong>AJ:</strong> Is there anything else you’d like to tell us before we let you go?</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/freebsd-miniconf-at-linux-conf-au-2020-call-for-sessions-now-open/" rel="nofollow">FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open</a></li>
<li><a href="http://calagator.org/events/1250476319" rel="nofollow">Portland BSD Pizza Night: Oct 24th, 19:00 @ Rudy’s Gourmet Pizza</a></li>
<li><a href="https://www.nycbug.org/index?action=view&id=10673" rel="nofollow">NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders </a></li>
<li><a href="https://people.freebsd.org/%7Erodrigo/fosdem20/" rel="nofollow">FOSDEM 2020 - BSD Devroom Call for Participation</a></li>
<li><a href="https://twitter.com/ed_maste/status/1184865668317007874" rel="nofollow">University of Cambridge looking for Research Assistants/Associates</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0321.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video><p>Special Guest: Trenton Shulz.</p>]]>
  </itunes:summary>
</item>
<item>
  <title>320: Codebase: Neck Deep</title>
  <link>https://www.bsdnow.tv/320</link>
  <guid isPermaLink="false">11b9f24e-1789-4328-8396-4b9654aa2dfc</guid>
  <pubDate>Wed, 16 Oct 2019 23:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/11b9f24e-1789-4328-8396-4b9654aa2dfc.mp3" length="40815513" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD on the Google Pixelbook, Porting NetBSD to the AMD x86-64, ZFS performance really does degrade as you approach quota limits, Fixing up KA9Q-unix, HAMMER2 and fsck for review, the return of startx(1) for non-root users, and more.</itunes:subtitle>
  <itunes:duration>56:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Headlines
FreeBSD and custom firmware on the Google Pixelbook (https://unrelenting.technology/articles/FreeBSD-and-custom-firmware-on-the-Google-Pixelbook)
FreeBSD and custom firmware on the Google Pixelbook
Back in 2015, I jumped on the ThinkPad bandwagon by getting an X240 to run FreeBSD on. Unlike most people in the ThinkPad crowd, I actually liked the clickpad and didn\u2019t use the trackpoint much. But this summer I\u2019ve decided that it was time for something newer. I wanted something..
lighter and thinner (ha, turns out this is actually important, I got tired of carrying a T H I C C laptop - Apple was right all along);
with a 3:2 display (why is Lenovo making these Serious Work\u2122 laptops 16:9 in the first place?? 16:9 is awful in below-13-inch sizes especially);
with a HiDPI display (and ideally with a good size for exact 2x scaling instead of fractional);
with USB-C ports;
without a dGPU, especially without an NVIDIA GPU;
assembled with screws and not glue (I don\u2019t necessarily need expansion and stuff in a laptop all that much, but being able to replace the battery without dealing with a glued chassis is good);
supported by FreeBSD of course (\u201csome development required\u201d is okay but I\u2019m not going to write big drivers);
how about something with open source firmware, that would be fun.
I was considering a ThinkPad X1 Carbon from an old generation - the one from the same year as the X230 is corebootable, so that\u2019s fun. But going back in processor generations just doesn\u2019t feel great. I want something more efficient, not less!
And then I discovered the Pixelbook. Other than the big huge large bezels around the screen, I liked everything about it. Thin aluminum design, a 3:2 HiDPI screen, rubber palm rests (why isn\u2019t every laptop ever doing that?!), the \u201cconvertibleness\u201d (flip the screen around to turn it into.. something rather big for a tablet, but it is useful actually), a Wacom touchscreen that supports a pen, mostly reasonable hardware (Intel Wi-Fi), and that famous coreboot support (Chromebooks\u2019 stock firmware is coreboot + depthcharge).
So here it is, my new laptop, a Google Pixelbook.
Conclusion
Pixelbook, FreeBSD, coreboot, EDK2 good.
Seriously, I have no big words to say, other than just recommending this laptop to FOSS enthusiasts :)
Porting NetBSD to the AMD x86-64: a case study in OS portability (https://www.usenix.org/legacy/publications/library/proceedings/bsdcon02/full_papers/linden/linden_html/index.html)
Abstract
NetBSD is known as a very portable operating system, currently running on 44 different architectures (12 different types of CPU). This paper takes a look at what has been done to make it portable, and how this has decreased the amount of effort needed to port NetBSD to a new architecture. The new AMD x86-64 architecture, of which the specifications were published at the end of 2000, with hardware to follow in 2002, is used as an example.
Portability
Supporting multiple platforms was a primary goal of the NetBSD project from the start. As NetBSD was ported to more and more platforms, the NetBSD kernel code was adapted to become more portable along the way.
General
Generally, code is shared between ports as much as possible. In NetBSD, it should always be considered if the code can be assumed to be useful on other architectures, present or future. If so, it is machine-independent and put it in an appropriate place in the source tree. When writing code that is intended to be machine-independent, and it contains conditional preprocessor statements depending on the architecture, then the code is likely wrong, or an extra abstraction layer is needed to get rid of these statements.
Types
Assumptions about the size of any type are not made. Assumptions made about type sizes on 32-bit platforms were a large problem when 64-bit platforms came around. Most of the problems of this kind had to be dealt with when NetBSD was ported to the DEC Alpha in 1994. A variation on this problem had to be dealt with with the UltraSPARC (sparc64) port in 1998, which is 64-bit, but big endian (vs. the little-endianness of the Alpha). When interacting with datastructures of a fixed size, such as on-disk metadata for filesystems, or datastructures directly interpreted by device hardware, explicitly sized types are used, such as uint32t, int8t, etc.
Conclusions and future work
The port of NetBSD to AMD's x86-64 architecture was done in six weeks, which confirms NetBSD's reputation as being a very portable operating system. One week was spent setting up the cross-toolchain and reading the x86-64 specifications, three weeks were spent writing the kernel code, one week was spent writing the userspace code, and one week testing and debugging it all. No problems were observed in any of the machine-independent parts of the kernel during test runs; all (simulated) device drivers, file systems, etc, worked without modification.
News Roundup
ZFS performance really does degrade as you approach quota limits (https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSFullQuotaPerformanceIssue)
Every so often (currently monthly), there is an "OpenZFS leadership meeting". What this really means is 'lead developers from the various ZFS implementations get together to talk about things'. Announcements and meeting notes from these meetings get sent out to various mailing lists, including the ZFS on Linux ones. 
In the September meeting notes, I read a very interesting (to me) agenda item: 
Relax quota semantics for improved performance (Allan Jude)
Problem: As you approach quotas, ZFS performance degrades.
Proposal: Can we have a property like quota-policy=strict or loose, where we can optionally allow ZFS to run over the quota as long as performance is not decreased.
This is very interesting to me because of two reasons. First, in the past we have definitely seen significant problems on our OmniOS machines, both when an entire pool hits a quota limit and when a single filesystem hits a refquota limit. It's nice to know that this wasn't just our imagination and that there is a real issue here. Even better, it might someday be improved (and perhaps in a way that we can use at least some of the time).
Second, any number of people here run very close to and sometimes at the quota limits of both filesystems and pools, fundamentally because people aren't willing to buy more space. We have in the past assumed that this was relatively harmless and would only make people run out of space. If this is a known issue that causes serious performance degradation, well, I don't know if there's anything we can do, but at least we're going to have to think about it and maybe push harder at people. The first step will have to be learning the details of what's going on at the ZFS level to cause the slowdown. (It's apparently similar to what happens when the pool is almost full, but I don't know the specifics of that either.)
With that said, we don't seem to have seen clear adverse effects on our Linux fileservers, and they've definitely run into quota limits (repeatedly). One possible reason for this is that having lots of RAM and SSDs makes the effects mostly go away. Another possible reason is that we haven't been looking closely enough to see that we're experiencing global slowdowns that correlate to filesystems hitting quota limits. We've had issues before with somewhat subtle slowdowns that we didn't understand (cf), so I can't discount that we're having it happen again.
Fixing up KA9Q-unix, or "neck deep in 30 year old codebases.." (http://adrianchadd.blogspot.com/2019/09/fixing-up-ka9q-unix-or-neck-deep-in-30.html)
I'll preface this by saying - yes, I'm still neck deep in FreeBSD's wifi stack and 802.11ac support, but it turns out it's slow work to fix 15 year old locking related issues that worked fine on 11abg cards, kinda worked ok on 11n cards, and are terrible for these 11ac cards. I'll .. get there.
Anyhoo, I've finally been mucking around with AX.25 packet radio. I've been wanting to do this since I was a teenager and found out about its existence, but back in high school and .. well, until a few years ago really .. I didn't have my amateur radio licence. But, now I do, and I've done a bunch of other stuff with a bunch of other radios. The main stumbling block? All my devices are either Apple products or run FreeBSD - and none of them have useful AX.25 stacks. The main stacks of choice these days run on Linux, Windows or are a full hardware TNC.
So yes, I was avoiding hacking on AX.25 stuff because there wasn't a BSD compatible AX.25 stack. I'm 40 now, leave me be.
But! A few weeks ago I found that someone was still running a packet BBS out of San Francisco. And amazingly, his local node ran on FreeBSD! It turns out Jeremy (KK6JJJ) ported both an old copy of KA9Q and N0ARY-BBS to run on FreeBSD! Cool!
I grabbed my 2m radio (which is already cabled up for digital modes), compiled up his KA9Q port, figured out how to get it to speak to Direwolf, and .. ok. Well, it worked. Kinda.
HAMMER2 and fsck for review (https://www.dragonflydigest.com/2019/09/24/23540.html)
HAMMER2 is Copy on Write, meaning changes are made to copies of existing data.  This means operations are generally atomic and can survive a power outage, etc.  (You should read up on it!)  However, there\u2019s now a fsck command, useful if you want a report of data validity rather than any manual repair process.
[The return of startx(1) for non-root users with some caveats (https://undeadly.org/cgi?action=article;sid=20190917091236)
Mark Kettenis (kettenis@) has recently committed changes which restore a certain amount of startx(1)/xinit(1) functionality for non-root users. The commit messages explain the situation:
```
CVSROOT:    /cvs
Module name:    src
Changes by:    kettenis@cvs.openbsd.org    2019/09/15 06:25:41
Modified files:
    etc/etc.amd64  : fbtab 
    etc/etc.arm64  : fbtab 
    etc/etc.hppa   : fbtab 
    etc/etc.i386   : fbtab 
    etc/etc.loongson: fbtab 
    etc/etc.luna88k: fbtab 
    etc/etc.macppc : fbtab 
    etc/etc.octeon : fbtab 
    etc/etc.sgi    : fbtab 
    etc/etc.sparc64: fbtab 
Log message:
Add ttyC4 to lost of devices to change when logging in on ttyC0 (and in some cases also the serial console) such that X can use it as its VT when running without root privileges.
ok jsg@, matthieu@
CVSROOT:    /cvs
Module name:    xenocara
Changes by:    kettenis@cvs.openbsd.org    2019/09/15 06:31:08
Modified files:
    xserver/hw/xfree86/common: xf86AutoConfig.c 
Log message:
Add modesetting driver as a fall-back when appropriate such that we can use it when running without root privileges which prevents us from scanning the PCI bus.
This makes startx(1)/xinit(1) work again on modern systems with inteldrm(4), radeondrm(4) and amdgpu(4).  In some cases this will result in using a different driver than with xenodm(4) which may expose issues (e.g. when we prefer the intel Xorg driver) or loss of acceleration (e.g. older cards supported by radeondrm(4)).
ok jsg@, matthieu@
```
Beastie Bits
ASCII table and history.  Or, why does Ctrl+i insert a Tab in my terminal? (https://bestasciitable.com/)
Sourcehut makes BSD software better (https://sourcehut.org/blog/2019-09-12-sourcehut-makes-bsd-software-better/)
Chaosnet for Unx (https://github.com/LM-3/chaos)
The Vim-Inspired Editor with a Linguistic Twist (https://cosine.blue/2019-09-06-kakoune.html)
bhyvearm64: CPU and Memory Virtualization on Armv8.0-A (https://papers.freebsd.org/2019/bsdcan/elisei-bhyvearm64_cpu_and_memory_virtualization_on_armv8.0_a/)
DefCon25 - Are all BSD created Equally - A Survey of BSD Kernel vulnerabilities (https://www.youtube.com/watch?v=a2m56Yq-EIs)
Feedback/Questions
Tim - GSoC project ideas for pf rule syntax translation (http://dpaste.com/1RCSFK7#wrap)
Brad - Steam on FreeBSD (http://dpaste.com/2SKA9YB#wrap)
Ruslan - FreeBSD Quarterly Status Report - Q2 2019 (http://dpaste.com/0DQM3Q1)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, google pixelbook, pixelbook, case study, portability, porting, zfs, zfs performance, performance, quota, quota limits, zfs quota, ka9q, unix, hammer2, fsck, startx</itunes:keywords>
  <content:encoded>
    <![CDATA[<h2>Headlines</h2>

<h3><a href="https://unrelenting.technology/articles/FreeBSD-and-custom-firmware-on-the-Google-Pixelbook" rel="nofollow">FreeBSD and custom firmware on the Google Pixelbook</a></h3>

<ul>
<li>FreeBSD and custom firmware on the Google Pixelbook</li>
</ul>

<blockquote>
<p>Back in 2015, I jumped on the ThinkPad bandwagon by getting an X240 to run FreeBSD on. Unlike most people in the ThinkPad crowd, I actually liked the clickpad and didn\u2019t use the trackpoint much. But this summer I\u2019ve decided that it was time for something newer. I wanted something..</p>
</blockquote>

<ul>
<li>lighter and thinner (ha, turns out this is actually important, I got tired of carrying a T H I C C laptop - Apple was right all along);</li>
<li>with a 3:2 display (why is Lenovo making these Serious Work\u2122 laptops 16:9 in the first place?? 16:9 is awful in below-13-inch sizes especially);</li>
<li>with a HiDPI display (and ideally with a good size for exact 2x scaling instead of fractional);</li>
<li>with USB-C ports;</li>
<li>without a dGPU, especially without an NVIDIA GPU;</li>
<li>assembled with screws and not glue (I don\u2019t necessarily need expansion and stuff in a laptop all that much, but being able to replace the battery without dealing with a glued chassis is good);</li>
<li>supported by FreeBSD of course (\u201csome development required\u201d is okay but I\u2019m not going to write big drivers);</li>
<li>how about something with open source firmware, that would be fun.</li>
</ul>

<blockquote>
<p>I was considering a ThinkPad X1 Carbon from an old generation - the one from the same year as the X230 is corebootable, so that\u2019s fun. But going back in processor generations just doesn\u2019t feel great. I want something more efficient, not less!</p>

<p>And then I discovered the Pixelbook. Other than the big huge large bezels around the screen, I liked everything about it. Thin aluminum design, a 3:2 HiDPI screen, rubber palm rests (why isn\u2019t every laptop ever doing that?!), the \u201cconvertibleness\u201d (flip the screen around to turn it into.. something rather big for a tablet, but it is useful actually), a Wacom touchscreen that supports a pen, mostly reasonable hardware (Intel Wi-Fi), and that famous coreboot support (Chromebooks\u2019 stock firmware is coreboot + depthcharge).</p>

<p>So here it is, my new laptop, a Google Pixelbook.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>Pixelbook, FreeBSD, coreboot, EDK2 good.</p>

<p>Seriously, I have no big words to say, other than just recommending this laptop to FOSS enthusiasts :)</p>
</blockquote>

<hr>

<h3><a href="https://www.usenix.org/legacy/publications/library/proceedings/bsdcon02/full_papers/linden/linden_html/index.html" rel="nofollow">Porting NetBSD to the AMD x86-64: a case study in OS portability</a></h3>

<ul>
<li>Abstract</li>
</ul>

<blockquote>
<p>NetBSD is known as a very portable operating system, currently running on 44 different architectures (12 different types of CPU). This paper takes a look at what has been done to make it portable, and how this has decreased the amount of effort needed to port NetBSD to a new architecture. The new AMD x86-64 architecture, of which the specifications were published at the end of 2000, with hardware to follow in 2002, is used as an example.</p>
</blockquote>

<ul>
<li>Portability</li>
</ul>

<blockquote>
<p>Supporting multiple platforms was a primary goal of the NetBSD project from the start. As NetBSD was ported to more and more platforms, the NetBSD kernel code was adapted to become more portable along the way.</p>
</blockquote>

<ul>
<li>General</li>
</ul>

<blockquote>
<p>Generally, code is shared between ports as much as possible. In NetBSD, it should always be considered if the code can be assumed to be useful on other architectures, present or future. If so, it is machine-independent and put it in an appropriate place in the source tree. When writing code that is intended to be machine-independent, and it contains conditional preprocessor statements depending on the architecture, then the code is likely wrong, or an extra abstraction layer is needed to get rid of these statements.</p>
</blockquote>

<ul>
<li>Types</li>
</ul>

<blockquote>
<p>Assumptions about the size of any type are not made. Assumptions made about type sizes on 32-bit platforms were a large problem when 64-bit platforms came around. Most of the problems of this kind had to be dealt with when NetBSD was ported to the DEC Alpha in 1994. A variation on this problem had to be dealt with with the UltraSPARC (sparc64) port in 1998, which is 64-bit, but big endian (vs. the little-endianness of the Alpha). When interacting with datastructures of a fixed size, such as on-disk metadata for filesystems, or datastructures directly interpreted by device hardware, explicitly sized types are used, such as uint32_t, int8_t, etc.</p>
</blockquote>

<ul>
<li>Conclusions and future work</li>
</ul>

<blockquote>
<p>The port of NetBSD to AMD&#39;s x86-64 architecture was done in six weeks, which confirms NetBSD&#39;s reputation as being a very portable operating system. One week was spent setting up the cross-toolchain and reading the x86-64 specifications, three weeks were spent writing the kernel code, one week was spent writing the userspace code, and one week testing and debugging it all. No problems were observed in any of the machine-independent parts of the kernel during test runs; all (simulated) device drivers, file systems, etc, worked without modification.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSFullQuotaPerformanceIssue" rel="nofollow">ZFS performance really does degrade as you approach quota limits</a></h3>

<blockquote>
<p>Every so often (currently monthly), there is an &quot;OpenZFS leadership meeting&quot;. What this really means is &#39;lead developers from the various ZFS implementations get together to talk about things&#39;. Announcements and meeting notes from these meetings get sent out to various mailing lists, including the ZFS on Linux ones. </p>
</blockquote>

<ul>
<li>In the September meeting notes, I read a very interesting (to me) agenda item: 

<ul>
<li>Relax quota semantics for improved performance (Allan Jude)</li>
<li>Problem: As you approach quotas, ZFS performance degrades.</li>
<li>Proposal: Can we have a property like quota-policy=strict or loose, where we can optionally allow ZFS to run over the quota as long as performance is not decreased.</li>
</ul></li>
</ul>

<blockquote>
<p>This is very interesting to me because of two reasons. First, in the past we have definitely seen significant problems on our OmniOS machines, both when an entire pool hits a quota limit and when a single filesystem hits a refquota limit. It&#39;s nice to know that this wasn&#39;t just our imagination and that there is a real issue here. Even better, it might someday be improved (and perhaps in a way that we can use at least some of the time).</p>

<p>Second, any number of people here run very close to and sometimes at the quota limits of both filesystems and pools, fundamentally because people aren&#39;t willing to buy more space. We have in the past assumed that this was relatively harmless and would only make people run out of space. If this is a known issue that causes serious performance degradation, well, I don&#39;t know if there&#39;s anything we can do, but at least we&#39;re going to have to think about it and maybe push harder at people. The first step will have to be learning the details of what&#39;s going on at the ZFS level to cause the slowdown. (It&#39;s apparently similar to what happens when the pool is almost full, but I don&#39;t know the specifics of that either.)</p>

<p>With that said, we don&#39;t seem to have seen clear adverse effects on our Linux fileservers, and they&#39;ve definitely run into quota limits (repeatedly). One possible reason for this is that having lots of RAM and SSDs makes the effects mostly go away. Another possible reason is that we haven&#39;t been looking closely enough to see that we&#39;re experiencing global slowdowns that correlate to filesystems hitting quota limits. We&#39;ve had issues before with somewhat subtle slowdowns that we didn&#39;t understand (cf), so I can&#39;t discount that we&#39;re having it happen again.</p>
</blockquote>

<hr>

<h3><a href="http://adrianchadd.blogspot.com/2019/09/fixing-up-ka9q-unix-or-neck-deep-in-30.html" rel="nofollow">Fixing up KA9Q-unix, or &quot;neck deep in 30 year old codebases..&quot;</a></h3>

<blockquote>
<p>I&#39;ll preface this by saying - yes, I&#39;m still neck deep in FreeBSD&#39;s wifi stack and 802.11ac support, but it turns out it&#39;s slow work to fix 15 year old locking related issues that worked fine on 11abg cards, kinda worked ok on 11n cards, and are terrible for these 11ac cards. I&#39;ll .. get there.</p>

<p>Anyhoo, I&#39;ve finally been mucking around with AX.25 packet radio. I&#39;ve been wanting to do this since I was a teenager and found out about its existence, but back in high school and .. well, until a few years ago really .. I didn&#39;t have my amateur radio licence. But, now I do, and I&#39;ve done a bunch of other stuff with a bunch of other radios. The main stumbling block? All my devices are either Apple products or run FreeBSD - and none of them have useful AX.25 stacks. The main stacks of choice these days run on Linux, Windows or are a full hardware TNC.</p>

<p>So yes, I was avoiding hacking on AX.25 stuff because there wasn&#39;t a BSD compatible AX.25 stack. I&#39;m 40 now, leave me be.</p>

<p>But! A few weeks ago I found that someone was still running a packet BBS out of San Francisco. And amazingly, his local node ran on FreeBSD! It turns out Jeremy (KK6JJJ) ported both an old copy of KA9Q and N0ARY-BBS to run on FreeBSD! Cool!</p>

<p>I grabbed my 2m radio (which is already cabled up for digital modes), compiled up his KA9Q port, figured out how to get it to speak to Direwolf, and .. ok. Well, it worked. Kinda.</p>
</blockquote>

<hr>

<h3><a href="https://www.dragonflydigest.com/2019/09/24/23540.html" rel="nofollow">HAMMER2 and fsck for review</a></h3>

<blockquote>
<p>HAMMER2 is Copy on Write, meaning changes are made to copies of existing data.  This means operations are generally atomic and can survive a power outage, etc.  (You should read up on it!)  However, there\u2019s now a fsck command, useful if you want a report of data validity rather than any manual repair process.</p>
</blockquote>

<hr>

<h3>[The return of startx(1) for non-root users <a href="https://undeadly.org/cgi?action=article;sid=20190917091236" rel="nofollow">with some caveats</a></h3>

<p>Mark Kettenis (kettenis@) has recently committed changes which restore a certain amount of startx(1)/xinit(1) functionality for non-root users. The commit messages explain the situation:</p>

<pre><code>CVSROOT:    /cvs
Module name:    src
Changes by:    kettenis@cvs.openbsd.org    2019/09/15 06:25:41

Modified files:
    etc/etc.amd64  : fbtab 
    etc/etc.arm64  : fbtab 
    etc/etc.hppa   : fbtab 
    etc/etc.i386   : fbtab 
    etc/etc.loongson: fbtab 
    etc/etc.luna88k: fbtab 
    etc/etc.macppc : fbtab 
    etc/etc.octeon : fbtab 
    etc/etc.sgi    : fbtab 
    etc/etc.sparc64: fbtab 

Log message:
Add ttyC4 to lost of devices to change when logging in on ttyC0 (and in some cases also the serial console) such that X can use it as its VT when running without root privileges.

ok jsg@, matthieu@
CVSROOT:    /cvs
Module name:    xenocara
Changes by:    kettenis@cvs.openbsd.org    2019/09/15 06:31:08

Modified files:
    xserver/hw/xfree86/common: xf86AutoConfig.c 

Log message:
Add modesetting driver as a fall-back when appropriate such that we can use it when running without root privileges which prevents us from scanning the PCI bus.

This makes startx(1)/xinit(1) work again on modern systems with inteldrm(4), radeondrm(4) and amdgpu(4).  In some cases this will result in using a different driver than with xenodm(4) which may expose issues (e.g. when we prefer the intel Xorg driver) or loss of acceleration (e.g. older cards supported by radeondrm(4)).

ok jsg@, matthieu@
</code></pre>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://bestasciitable.com/" rel="nofollow">ASCII table and history.  Or, why does Ctrl+i insert a Tab in my terminal?</a></li>
<li><a href="https://sourcehut.org/blog/2019-09-12-sourcehut-makes-bsd-software-better/" rel="nofollow">Sourcehut makes BSD software better</a></li>
<li><a href="https://github.com/LM-3/chaos" rel="nofollow">Chaosnet for Unx</a></li>
<li><a href="https://cosine.blue/2019-09-06-kakoune.html" rel="nofollow">The Vim-Inspired Editor with a Linguistic Twist</a></li>
<li><a href="https://papers.freebsd.org/2019/bsdcan/elisei-bhyvearm64_cpu_and_memory_virtualization_on_armv8.0_a/" rel="nofollow">bhyvearm64: CPU and Memory Virtualization on Armv8.0-A</a></li>
<li><a href="https://www.youtube.com/watch?v=a2m56Yq-EIs" rel="nofollow">DefCon25 - Are all BSD created Equally - A Survey of BSD Kernel vulnerabilities</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Tim - <a href="http://dpaste.com/1RCSFK7#wrap" rel="nofollow">GSoC project ideas for pf rule syntax translation</a></li>
<li>Brad - <a href="http://dpaste.com/2SKA9YB#wrap" rel="nofollow">Steam on FreeBSD</a></li>
<li>Ruslan - <a href="http://dpaste.com/0DQM3Q1" rel="nofollow">FreeBSD Quarterly Status Report - Q2 2019</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0320.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<h2>Headlines</h2>

<h3><a href="https://unrelenting.technology/articles/FreeBSD-and-custom-firmware-on-the-Google-Pixelbook" rel="nofollow">FreeBSD and custom firmware on the Google Pixelbook</a></h3>

<ul>
<li>FreeBSD and custom firmware on the Google Pixelbook</li>
</ul>

<blockquote>
<p>Back in 2015, I jumped on the ThinkPad bandwagon by getting an X240 to run FreeBSD on. Unlike most people in the ThinkPad crowd, I actually liked the clickpad and didn\u2019t use the trackpoint much. But this summer I\u2019ve decided that it was time for something newer. I wanted something..</p>
</blockquote>

<ul>
<li>lighter and thinner (ha, turns out this is actually important, I got tired of carrying a T H I C C laptop - Apple was right all along);</li>
<li>with a 3:2 display (why is Lenovo making these Serious Work\u2122 laptops 16:9 in the first place?? 16:9 is awful in below-13-inch sizes especially);</li>
<li>with a HiDPI display (and ideally with a good size for exact 2x scaling instead of fractional);</li>
<li>with USB-C ports;</li>
<li>without a dGPU, especially without an NVIDIA GPU;</li>
<li>assembled with screws and not glue (I don\u2019t necessarily need expansion and stuff in a laptop all that much, but being able to replace the battery without dealing with a glued chassis is good);</li>
<li>supported by FreeBSD of course (\u201csome development required\u201d is okay but I\u2019m not going to write big drivers);</li>
<li>how about something with open source firmware, that would be fun.</li>
</ul>

<blockquote>
<p>I was considering a ThinkPad X1 Carbon from an old generation - the one from the same year as the X230 is corebootable, so that\u2019s fun. But going back in processor generations just doesn\u2019t feel great. I want something more efficient, not less!</p>

<p>And then I discovered the Pixelbook. Other than the big huge large bezels around the screen, I liked everything about it. Thin aluminum design, a 3:2 HiDPI screen, rubber palm rests (why isn\u2019t every laptop ever doing that?!), the \u201cconvertibleness\u201d (flip the screen around to turn it into.. something rather big for a tablet, but it is useful actually), a Wacom touchscreen that supports a pen, mostly reasonable hardware (Intel Wi-Fi), and that famous coreboot support (Chromebooks\u2019 stock firmware is coreboot + depthcharge).</p>

<p>So here it is, my new laptop, a Google Pixelbook.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>Pixelbook, FreeBSD, coreboot, EDK2 good.</p>

<p>Seriously, I have no big words to say, other than just recommending this laptop to FOSS enthusiasts :)</p>
</blockquote>

<hr>

<h3><a href="https://www.usenix.org/legacy/publications/library/proceedings/bsdcon02/full_papers/linden/linden_html/index.html" rel="nofollow">Porting NetBSD to the AMD x86-64: a case study in OS portability</a></h3>

<ul>
<li>Abstract</li>
</ul>

<blockquote>
<p>NetBSD is known as a very portable operating system, currently running on 44 different architectures (12 different types of CPU). This paper takes a look at what has been done to make it portable, and how this has decreased the amount of effort needed to port NetBSD to a new architecture. The new AMD x86-64 architecture, of which the specifications were published at the end of 2000, with hardware to follow in 2002, is used as an example.</p>
</blockquote>

<ul>
<li>Portability</li>
</ul>

<blockquote>
<p>Supporting multiple platforms was a primary goal of the NetBSD project from the start. As NetBSD was ported to more and more platforms, the NetBSD kernel code was adapted to become more portable along the way.</p>
</blockquote>

<ul>
<li>General</li>
</ul>

<blockquote>
<p>Generally, code is shared between ports as much as possible. In NetBSD, it should always be considered if the code can be assumed to be useful on other architectures, present or future. If so, it is machine-independent and put it in an appropriate place in the source tree. When writing code that is intended to be machine-independent, and it contains conditional preprocessor statements depending on the architecture, then the code is likely wrong, or an extra abstraction layer is needed to get rid of these statements.</p>
</blockquote>

<ul>
<li>Types</li>
</ul>

<blockquote>
<p>Assumptions about the size of any type are not made. Assumptions made about type sizes on 32-bit platforms were a large problem when 64-bit platforms came around. Most of the problems of this kind had to be dealt with when NetBSD was ported to the DEC Alpha in 1994. A variation on this problem had to be dealt with with the UltraSPARC (sparc64) port in 1998, which is 64-bit, but big endian (vs. the little-endianness of the Alpha). When interacting with datastructures of a fixed size, such as on-disk metadata for filesystems, or datastructures directly interpreted by device hardware, explicitly sized types are used, such as uint32_t, int8_t, etc.</p>
</blockquote>

<ul>
<li>Conclusions and future work</li>
</ul>

<blockquote>
<p>The port of NetBSD to AMD&#39;s x86-64 architecture was done in six weeks, which confirms NetBSD&#39;s reputation as being a very portable operating system. One week was spent setting up the cross-toolchain and reading the x86-64 specifications, three weeks were spent writing the kernel code, one week was spent writing the userspace code, and one week testing and debugging it all. No problems were observed in any of the machine-independent parts of the kernel during test runs; all (simulated) device drivers, file systems, etc, worked without modification.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSFullQuotaPerformanceIssue" rel="nofollow">ZFS performance really does degrade as you approach quota limits</a></h3>

<blockquote>
<p>Every so often (currently monthly), there is an &quot;OpenZFS leadership meeting&quot;. What this really means is &#39;lead developers from the various ZFS implementations get together to talk about things&#39;. Announcements and meeting notes from these meetings get sent out to various mailing lists, including the ZFS on Linux ones. </p>
</blockquote>

<ul>
<li>In the September meeting notes, I read a very interesting (to me) agenda item: 

<ul>
<li>Relax quota semantics for improved performance (Allan Jude)</li>
<li>Problem: As you approach quotas, ZFS performance degrades.</li>
<li>Proposal: Can we have a property like quota-policy=strict or loose, where we can optionally allow ZFS to run over the quota as long as performance is not decreased.</li>
</ul></li>
</ul>

<blockquote>
<p>This is very interesting to me because of two reasons. First, in the past we have definitely seen significant problems on our OmniOS machines, both when an entire pool hits a quota limit and when a single filesystem hits a refquota limit. It&#39;s nice to know that this wasn&#39;t just our imagination and that there is a real issue here. Even better, it might someday be improved (and perhaps in a way that we can use at least some of the time).</p>

<p>Second, any number of people here run very close to and sometimes at the quota limits of both filesystems and pools, fundamentally because people aren&#39;t willing to buy more space. We have in the past assumed that this was relatively harmless and would only make people run out of space. If this is a known issue that causes serious performance degradation, well, I don&#39;t know if there&#39;s anything we can do, but at least we&#39;re going to have to think about it and maybe push harder at people. The first step will have to be learning the details of what&#39;s going on at the ZFS level to cause the slowdown. (It&#39;s apparently similar to what happens when the pool is almost full, but I don&#39;t know the specifics of that either.)</p>

<p>With that said, we don&#39;t seem to have seen clear adverse effects on our Linux fileservers, and they&#39;ve definitely run into quota limits (repeatedly). One possible reason for this is that having lots of RAM and SSDs makes the effects mostly go away. Another possible reason is that we haven&#39;t been looking closely enough to see that we&#39;re experiencing global slowdowns that correlate to filesystems hitting quota limits. We&#39;ve had issues before with somewhat subtle slowdowns that we didn&#39;t understand (cf), so I can&#39;t discount that we&#39;re having it happen again.</p>
</blockquote>

<hr>

<h3><a href="http://adrianchadd.blogspot.com/2019/09/fixing-up-ka9q-unix-or-neck-deep-in-30.html" rel="nofollow">Fixing up KA9Q-unix, or &quot;neck deep in 30 year old codebases..&quot;</a></h3>

<blockquote>
<p>I&#39;ll preface this by saying - yes, I&#39;m still neck deep in FreeBSD&#39;s wifi stack and 802.11ac support, but it turns out it&#39;s slow work to fix 15 year old locking related issues that worked fine on 11abg cards, kinda worked ok on 11n cards, and are terrible for these 11ac cards. I&#39;ll .. get there.</p>

<p>Anyhoo, I&#39;ve finally been mucking around with AX.25 packet radio. I&#39;ve been wanting to do this since I was a teenager and found out about its existence, but back in high school and .. well, until a few years ago really .. I didn&#39;t have my amateur radio licence. But, now I do, and I&#39;ve done a bunch of other stuff with a bunch of other radios. The main stumbling block? All my devices are either Apple products or run FreeBSD - and none of them have useful AX.25 stacks. The main stacks of choice these days run on Linux, Windows or are a full hardware TNC.</p>

<p>So yes, I was avoiding hacking on AX.25 stuff because there wasn&#39;t a BSD compatible AX.25 stack. I&#39;m 40 now, leave me be.</p>

<p>But! A few weeks ago I found that someone was still running a packet BBS out of San Francisco. And amazingly, his local node ran on FreeBSD! It turns out Jeremy (KK6JJJ) ported both an old copy of KA9Q and N0ARY-BBS to run on FreeBSD! Cool!</p>

<p>I grabbed my 2m radio (which is already cabled up for digital modes), compiled up his KA9Q port, figured out how to get it to speak to Direwolf, and .. ok. Well, it worked. Kinda.</p>
</blockquote>

<hr>

<h3><a href="https://www.dragonflydigest.com/2019/09/24/23540.html" rel="nofollow">HAMMER2 and fsck for review</a></h3>

<blockquote>
<p>HAMMER2 is Copy on Write, meaning changes are made to copies of existing data.  This means operations are generally atomic and can survive a power outage, etc.  (You should read up on it!)  However, there\u2019s now a fsck command, useful if you want a report of data validity rather than any manual repair process.</p>
</blockquote>

<hr>

<h3>[The return of startx(1) for non-root users <a href="https://undeadly.org/cgi?action=article;sid=20190917091236" rel="nofollow">with some caveats</a></h3>

<p>Mark Kettenis (kettenis@) has recently committed changes which restore a certain amount of startx(1)/xinit(1) functionality for non-root users. The commit messages explain the situation:</p>

<pre><code>CVSROOT:    /cvs
Module name:    src
Changes by:    kettenis@cvs.openbsd.org    2019/09/15 06:25:41

Modified files:
    etc/etc.amd64  : fbtab 
    etc/etc.arm64  : fbtab 
    etc/etc.hppa   : fbtab 
    etc/etc.i386   : fbtab 
    etc/etc.loongson: fbtab 
    etc/etc.luna88k: fbtab 
    etc/etc.macppc : fbtab 
    etc/etc.octeon : fbtab 
    etc/etc.sgi    : fbtab 
    etc/etc.sparc64: fbtab 

Log message:
Add ttyC4 to lost of devices to change when logging in on ttyC0 (and in some cases also the serial console) such that X can use it as its VT when running without root privileges.

ok jsg@, matthieu@
CVSROOT:    /cvs
Module name:    xenocara
Changes by:    kettenis@cvs.openbsd.org    2019/09/15 06:31:08

Modified files:
    xserver/hw/xfree86/common: xf86AutoConfig.c 

Log message:
Add modesetting driver as a fall-back when appropriate such that we can use it when running without root privileges which prevents us from scanning the PCI bus.

This makes startx(1)/xinit(1) work again on modern systems with inteldrm(4), radeondrm(4) and amdgpu(4).  In some cases this will result in using a different driver than with xenodm(4) which may expose issues (e.g. when we prefer the intel Xorg driver) or loss of acceleration (e.g. older cards supported by radeondrm(4)).

ok jsg@, matthieu@
</code></pre>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://bestasciitable.com/" rel="nofollow">ASCII table and history.  Or, why does Ctrl+i insert a Tab in my terminal?</a></li>
<li><a href="https://sourcehut.org/blog/2019-09-12-sourcehut-makes-bsd-software-better/" rel="nofollow">Sourcehut makes BSD software better</a></li>
<li><a href="https://github.com/LM-3/chaos" rel="nofollow">Chaosnet for Unx</a></li>
<li><a href="https://cosine.blue/2019-09-06-kakoune.html" rel="nofollow">The Vim-Inspired Editor with a Linguistic Twist</a></li>
<li><a href="https://papers.freebsd.org/2019/bsdcan/elisei-bhyvearm64_cpu_and_memory_virtualization_on_armv8.0_a/" rel="nofollow">bhyvearm64: CPU and Memory Virtualization on Armv8.0-A</a></li>
<li><a href="https://www.youtube.com/watch?v=a2m56Yq-EIs" rel="nofollow">DefCon25 - Are all BSD created Equally - A Survey of BSD Kernel vulnerabilities</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Tim - <a href="http://dpaste.com/1RCSFK7#wrap" rel="nofollow">GSoC project ideas for pf rule syntax translation</a></li>
<li>Brad - <a href="http://dpaste.com/2SKA9YB#wrap" rel="nofollow">Steam on FreeBSD</a></li>
<li>Ruslan - <a href="http://dpaste.com/0DQM3Q1" rel="nofollow">FreeBSD Quarterly Status Report - Q2 2019</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0320.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>319: Lack Rack, Jack</title>
  <link>https://www.bsdnow.tv/319</link>
  <guid isPermaLink="false">19c9942c-0790-4157-af73-31faf1e2b8e4</guid>
  <pubDate>Wed, 09 Oct 2019 23:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/19c9942c-0790-4157-af73-31faf1e2b8e4.mp3" length="48841583" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Causing ZFS corruption for fun, NetBSD Assembly Programming Tutorial, The IKEA Lack Rack for Servers, a new OmniOS Community Edition LTS has been published, List Block Devices on FreeBSD lsblk(8) Style, Project Trident 19.10 available, and more.</itunes:subtitle>
  <itunes:duration>1:07:50</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Causing ZFS corruption for fun, NetBSD Assembly Programming Tutorial, The IKEA Lack Rack for Servers, a new OmniOS Community Edition LTS has been published, List Block Devices on FreeBSD lsblk(8) Style, Project Trident 19.10 available, and more.
Headlines
Causing ZFS corruption for fun and profit (https://datto.engineering/post/causing-zfs-corruption)
Datto backs up data, a lot of it. At the time of writing Datto has over 500 PB of data stored on ZFS. This count includes both backup appliances that are sent to customer sites, as well as cloud storage servers that are used for secondary and tertiary backup of those appliances. At this scale drive swaps are a daily occurrence, and data corruption is inevitable. How we handle this corruption when it happens determines whether we truly lose data, or successfully restore from secondary backup. In this post we'll be showing you how at Datto we intentionally cause corruption in our testing environments, to ensure we're building software that can properly handle these scenarios.
Causing Corruption
Since this is a mirror setup, a naive solution to cause corruption would be to randomly dd the same sectors of both /dev/sdb and /dev/sdc. This works, but is equally likely to just overwrite random unused space, or take down the zpool entirely. What we really want is to corrupt a specific snapshot, or even a specific file in that snapshot, to simulate a more realistic minor corruption event. Luckily we have a tool called zdb that lets us view some low level information about datasets.
Conclusion
At the 500 PB scale, it's not a matter of if data corruption will happen but when. Intentionally causing corruption is one of the strategies we use to ensure we're building software that can handle these rare (but inevitable) events.
To others out there using ZFS: I'm curious to hear how you've solved this problem. We did quite a bit of experimentation with zinject before going with this more brute force method. So I'd be especially interested if you've had luck simply simulating corruption with zinject.
NetBSD Assembly Programming Tutorial (https://polprog.net/blog/netbsdasmprog/)
A sparc64 version is also being prepared and will be added when done
This post describes how to write a simple hello world program in pure assembly on NetBSD/amd64. We will not use (nor link against) libc, nor use gcc to compile it. I will be using GNU as (gas), and therefore the AT&amp;amp;T syntax instead of Intel.
Why assembly?
Why not? Because it's fun to program in assembly directly. Contrary to a popular belief assembly programs aren't always faster than what optimizing compilers produce. Nevertheless it's good to be able to read assembly, especially when debugging C programs
Due to the nature of the guide, visit the site for the complete breakdown
News Roundup
The IKEA Lack Rack for Servers (https://wiki.eth0.nl/index.php/LackRack)
The LackRack
First occurrence on eth0:2010 Winterlan, the LackRack is the ultimate, low-cost, high shininess solution for your modular datacenter-in-the-living-room. Featuring the LACK (side table) from Ikea, the LackRack is an easy-to-implement, exact-fit datacenter building block. It's a little known fact that we have seen Google engineers tinker with Lack tables since way back in 2009.
The LackRack will certainly make its appearance again this summer at eth0:2010 Summer.
Summary
When temporarily not in use, multiple LackRacks can be stacked in a space-efficient way without disassembly, unlike competing 19" server racks.
The LackRack was first seen on eth0:2010 Winterlan in the no-shoe Lounge area. Its low-cost and perfect fit are great for mounting up to 8 U of 19" hardware, such as switches (see below), or perhaps other 19" gear. It's very easy to assemble, and thanks to the design, they are stable enough to hold (for example) 19" switches and you can put your bottle of Club-Mate on top! Multi-shiny LackRack can also be painted to your specific preferences and the airflow is unprecedented!
Howto
You can find a howto on buying a LackRack on this page. This includes the proof that a 19" switch can indeed be placed in the LackRack in its natural habitat!
OmniOS Community Edition r151030 LTS - Published at May 6, 2019 (https://omniosce.org/article/release-030)
The OmniOS Community Edition Association is proud to announce the general availability of OmniOS - r151030.
OmniOS is published according to a 6-month release cycle, r151030 LTS takes over from r151028, published in November 2018; and since it is a LTS release it also takes over from r151022. The r151030 LTS release will be supported for 3 Years. It is the first LTS release published by the OmniOS CE Association since taking over the reins from OmniTI in 2017. The next LTS release is scheduled for May 2021. The old stable r151026 release is now end-of-life. See the release schedule for further details.
This is only a small selection of the new features, and bug fixes in the new release; review the release notes for full details.
If you upgrade from r22 and want to see all new features added since then, make sure to also read the release notes for r24, r26 and r28.
For full relase notes including upgrade instructions;
release notes (https://omniosce.org/releasenotes.html)
upgrade instructions (https://omniosce.org/upgrade.html)
List Block Devices on FreeBSD lsblk(8) Style (https://vermaden.wordpress.com/2019/09/27/list-block-devices-on-freebsd-lsblk8-style/)
When I have to work on Linux systems I usually miss many nice FreeBSD tools such as these for example to name the few: sockstat, gstat, top -b -o res, top -m io -o total, usbconfig, rcorder, beadm/bectl, idprio/rtprio,… but sometimes – which rarely happens – Linux has some very useful tool that is not available on FreeBSD. An example of such tool is lsblk(8) that does one thing and does it quite well – lists block devices and their contents. It has some problems like listing a disk that is entirely used under ZFS pool on which lsblk(8) displays two partitions instead of information about ZFS just being there – but we all know how much in some circles the CDDL licensed ZFS is unloved in that GPL world.
Example lsblk(8) output from Linux system:

$ lsblk
NAME                         MAJ:MIN RM   SIZE RO TYPE   MOUNTPOINT
sr0                           11:0    1  1024M  0 rom
sda                            8:0    0 931.5G  0 disk
|-sda1                         8:1    0   500M  0 part   /boot
`-sda2                         8:2    0   931G  0 part
  |-vg_local-lv_root (dm-0)  253:0    0    50G  0 lvm    /
  |-vg_local-lv_swap (dm-1)  253:1    0  17.7G  0 lvm    [SWAP]
  `-vg_local-lv_home (dm-2)  253:2    0   1.8T  0 lvm    /home
sdc                            8:32   0 232.9G  0 disk
`-sdc1                         8:33   0 232.9G  0 part
  `-md1                        9:1    0 232.9G  0 raid10 /data
sdd                            8:48   0 232.9G  0 disk
`-sdd1                         8:49   0 232.9G  0 part
  `-md1                        9:1    0 232.9G  0 raid10 /data

What FreeBSD offers in this department? The camcontrol(8) and geom(8) commands are available. You can also use gpart(8) command to list partitions. Below you will find output of these commands from my single disk laptop. Please note that because of WordPress limitations I need to change all &amp;gt; &amp;lt; characters to ] [ ones in the commands outputs.
See the article for the rest of the guide
Project Trident 19.10 Now Available (https://project-trident.org/post/2019-10-05_19.10_available/)
This is a general package update to the CURRENT release repository based upon TrueOS 19.10
PACKAGE CHANGES FROM 19.08
New Packages: 601
Deleted Packages: 165
Updated Packages: 3341
Beastie Bits
NetBSD building tools (https://imgur.com/gallery/0sG4b1K)
Sponsorships open for SNMP Mastery (https://mwl.io/archives/4569)
pkgsrc-2019Q3 release announcement (2019-10-03) (http://mail-index.netbsd.org/pkgsrc-users/2019/10/03/msg029485.html)
pfetch - A simple system information tool written in POSIX sh (https://github.com/dylanaraps/pfetch)
Taking NetBSD kernel bug roast to the next level: Kernel Fuzzers (quick A.D. 2019 overview) (https://netbsd.org/~kamil/eurobsdcon2019_fuzzing/presentation.html#slide1)
Cracking Ken Thomson’s password (https://leahneukirchen.org/blog/archive/2019/10/ken-thompson-s-unix-password.html)
Feedback/Questions
Evilham - Couple Questions (http://dpaste.com/2JC85WV)
Rob - APU2 alternatives and GPT partition types (http://dpaste.com/0SDX9ZX)
Tom - FreeBSD journal article by A. Fengler (http://dpaste.com/2B43MY1#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, Untitled 1interview, zfs, assembly, assembly programming, programming, programming tutorial, ikea, rack, server rack, omnios, omnios lts, lsblk, project trident</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Causing ZFS corruption for fun, NetBSD Assembly Programming Tutorial, The IKEA Lack Rack for Servers, a new OmniOS Community Edition LTS has been published, List Block Devices on FreeBSD lsblk(8) Style, Project Trident 19.10 available, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://datto.engineering/post/causing-zfs-corruption" rel="nofollow">Causing ZFS corruption for fun and profit</a></h3>

<blockquote>
<p>Datto backs up data, a lot of it. At the time of writing Datto has over 500 PB of data stored on ZFS. This count includes both backup appliances that are sent to customer sites, as well as cloud storage servers that are used for secondary and tertiary backup of those appliances. At this scale drive swaps are a daily occurrence, and data corruption is inevitable. How we handle this corruption when it happens determines whether we truly lose data, or successfully restore from secondary backup. In this post we&#39;ll be showing you how at Datto we intentionally cause corruption in our testing environments, to ensure we&#39;re building software that can properly handle these scenarios.</p>
</blockquote>

<ul>
<li>Causing Corruption</li>
</ul>

<blockquote>
<p>Since this is a mirror setup, a naive solution to cause corruption would be to randomly dd the same sectors of both /dev/sdb and /dev/sdc. This works, but is equally likely to just overwrite random unused space, or take down the zpool entirely. What we really want is to corrupt a specific snapshot, or even a specific file in that snapshot, to simulate a more realistic minor corruption event. Luckily we have a tool called zdb that lets us view some low level information about datasets.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>At the 500 PB scale, it&#39;s not a matter of if data corruption will happen but when. Intentionally causing corruption is one of the strategies we use to ensure we&#39;re building software that can handle these rare (but inevitable) events.</p>

<p>To others out there using ZFS: I&#39;m curious to hear how you&#39;ve solved this problem. We did quite a bit of experimentation with zinject before going with this more brute force method. So I&#39;d be especially interested if you&#39;ve had luck simply simulating corruption with zinject.</p>
</blockquote>

<hr>

<h3><a href="https://polprog.net/blog/netbsdasmprog/" rel="nofollow">NetBSD Assembly Programming Tutorial</a></h3>

<blockquote>
<p>A sparc64 version is also being prepared and will be added when done</p>

<p>This post describes how to write a simple hello world program in pure assembly on NetBSD/amd64. We will not use (nor link against) libc, nor use gcc to compile it. I will be using GNU as (gas), and therefore the AT&amp;T syntax instead of Intel.</p>
</blockquote>

<ul>
<li>Why assembly?</li>
</ul>

<blockquote>
<p>Why not? Because it&#39;s fun to program in assembly directly. Contrary to a popular belief assembly programs aren&#39;t always faster than what optimizing compilers produce. Nevertheless it&#39;s good to be able to read assembly, especially when debugging C programs</p>
</blockquote>

<ul>
<li>Due to the nature of the guide, visit the site for the complete breakdown</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://wiki.eth0.nl/index.php/LackRack" rel="nofollow">The IKEA Lack Rack for Servers</a></h3>

<ul>
<li>The LackRack</li>
</ul>

<blockquote>
<p>First occurrence on eth0:2010 Winterlan, the LackRack is the ultimate, low-cost, high shininess solution for your modular datacenter-in-the-living-room. Featuring the LACK (side table) from Ikea, the LackRack is an easy-to-implement, exact-fit datacenter building block. It&#39;s a little known fact that we have seen Google engineers tinker with Lack tables since way back in 2009.</p>

<p>The LackRack will certainly make its appearance again this summer at eth0:2010 Summer.</p>
</blockquote>

<ul>
<li>Summary</li>
</ul>

<blockquote>
<p>When temporarily not in use, multiple LackRacks can be stacked in a space-efficient way without disassembly, unlike competing 19&quot; server racks.</p>

<p>The LackRack was first seen on eth0:2010 Winterlan in the no-shoe Lounge area. Its low-cost and perfect fit are great for mounting up to 8 U of 19&quot; hardware, such as switches (see below), or perhaps other 19&quot; gear. It&#39;s very easy to assemble, and thanks to the design, they are stable enough to hold (for example) 19&quot; switches and you can put your bottle of Club-Mate on top! Multi-shiny LackRack can also be painted to your specific preferences and the airflow is unprecedented!</p>
</blockquote>

<ul>
<li>Howto</li>
</ul>

<blockquote>
<p>You can find a howto on buying a LackRack on this page. This includes the proof that a 19&quot; switch can indeed be placed in the LackRack in its natural habitat!</p>
</blockquote>

<hr>

<h3><a href="https://omniosce.org/article/release-030" rel="nofollow">OmniOS Community Edition r151030 LTS - Published at May 6, 2019</a></h3>

<blockquote>
<p>The OmniOS Community Edition Association is proud to announce the general availability of OmniOS - r151030.</p>

<p>OmniOS is published according to a 6-month release cycle, r151030 LTS takes over from r151028, published in November 2018; and since it is a LTS release it also takes over from r151022. The r151030 LTS release will be supported for 3 Years. It is the first LTS release published by the OmniOS CE Association since taking over the reins from OmniTI in 2017. The next LTS release is scheduled for May 2021. The old stable r151026 release is now end-of-life. See the release schedule for further details.</p>

<p>This is only a small selection of the new features, and bug fixes in the new release; review the release notes for full details.</p>

<p>If you upgrade from r22 and want to see all new features added since then, make sure to also read the release notes for r24, r26 and r28.</p>
</blockquote>

<ul>
<li>For full relase notes including upgrade instructions;</li>
<li><a href="https://omniosce.org/releasenotes.html" rel="nofollow">release notes</a></li>
<li><a href="https://omniosce.org/upgrade.html" rel="nofollow">upgrade instructions</a></li>
</ul>

<hr>

<h3><a href="https://vermaden.wordpress.com/2019/09/27/list-block-devices-on-freebsd-lsblk8-style/" rel="nofollow">List Block Devices on FreeBSD lsblk(8) Style</a></h3>

<blockquote>
<p>When I have to work on Linux systems I usually miss many nice FreeBSD tools such as these for example to name the few: sockstat, gstat, top -b -o res, top -m io -o total, usbconfig, rcorder, beadm/bectl, idprio/rtprio,… but sometimes – which rarely happens – Linux has some very useful tool that is not available on FreeBSD. An example of such tool is lsblk(8) that does one thing and does it quite well – lists block devices and their contents. It has some problems like listing a disk that is entirely used under ZFS pool on which lsblk(8) displays two partitions instead of information about ZFS just being there – but we all know how much in some circles the CDDL licensed ZFS is unloved in that GPL world.</p>
</blockquote>

<p>Example lsblk(8) output from Linux system:</p>

<pre><code>$ lsblk
NAME                         MAJ:MIN RM   SIZE RO TYPE   MOUNTPOINT
sr0                           11:0    1  1024M  0 rom
sda                            8:0    0 931.5G  0 disk
|-sda1                         8:1    0   500M  0 part   /boot
`-sda2                         8:2    0   931G  0 part
  |-vg_local-lv_root (dm-0)  253:0    0    50G  0 lvm    /
  |-vg_local-lv_swap (dm-1)  253:1    0  17.7G  0 lvm    [SWAP]
  `-vg_local-lv_home (dm-2)  253:2    0   1.8T  0 lvm    /home
sdc                            8:32   0 232.9G  0 disk
`-sdc1                         8:33   0 232.9G  0 part
  `-md1                        9:1    0 232.9G  0 raid10 /data
sdd                            8:48   0 232.9G  0 disk
`-sdd1                         8:49   0 232.9G  0 part
  `-md1                        9:1    0 232.9G  0 raid10 /data
</code></pre>

<blockquote>
<p>What FreeBSD offers in this department? The camcontrol(8) and geom(8) commands are available. You can also use gpart(8) command to list partitions. Below you will find output of these commands from my single disk laptop. Please note that because of WordPress limitations I need to change all &gt; &lt; characters to ] [ ones in the commands outputs.</p>
</blockquote>

<ul>
<li>See the article for the rest of the guide</li>
</ul>

<hr>

<h3><a href="https://project-trident.org/post/2019-10-05_19.10_available/" rel="nofollow">Project Trident 19.10 Now Available</a></h3>

<blockquote>
<p>This is a general package update to the CURRENT release repository based upon TrueOS 19.10</p>
</blockquote>

<ul>
<li>PACKAGE CHANGES FROM 19.08

<ul>
<li>New Packages: 601</li>
<li>Deleted Packages: 165</li>
<li>Updated Packages: 3341</li>
</ul></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://imgur.com/gallery/0sG4b1K" rel="nofollow">NetBSD building tools</a></li>
<li><a href="https://mwl.io/archives/4569" rel="nofollow">Sponsorships open for SNMP Mastery</a></li>
<li><a href="http://mail-index.netbsd.org/pkgsrc-users/2019/10/03/msg029485.html" rel="nofollow">pkgsrc-2019Q3 release announcement (2019-10-03)</a></li>
<li><a href="https://github.com/dylanaraps/pfetch" rel="nofollow">pfetch - A simple system information tool written in POSIX sh</a></li>
<li><a href="https://netbsd.org/%7Ekamil/eurobsdcon2019_fuzzing/presentation.html#slide1" rel="nofollow">Taking NetBSD kernel bug roast to the next level: Kernel Fuzzers (quick A.D. 2019 overview)</a></li>
<li><a href="https://leahneukirchen.org/blog/archive/2019/10/ken-thompson-s-unix-password.html" rel="nofollow">Cracking Ken Thomson’s password</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Evilham - <a href="http://dpaste.com/2JC85WV" rel="nofollow">Couple Questions</a></li>
<li>Rob - <a href="http://dpaste.com/0SDX9ZX" rel="nofollow">APU2 alternatives and GPT partition types</a></li>
<li>Tom - <a href="http://dpaste.com/2B43MY1#wrap" rel="nofollow">FreeBSD journal article by A. Fengler</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0319.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Causing ZFS corruption for fun, NetBSD Assembly Programming Tutorial, The IKEA Lack Rack for Servers, a new OmniOS Community Edition LTS has been published, List Block Devices on FreeBSD lsblk(8) Style, Project Trident 19.10 available, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://datto.engineering/post/causing-zfs-corruption" rel="nofollow">Causing ZFS corruption for fun and profit</a></h3>

<blockquote>
<p>Datto backs up data, a lot of it. At the time of writing Datto has over 500 PB of data stored on ZFS. This count includes both backup appliances that are sent to customer sites, as well as cloud storage servers that are used for secondary and tertiary backup of those appliances. At this scale drive swaps are a daily occurrence, and data corruption is inevitable. How we handle this corruption when it happens determines whether we truly lose data, or successfully restore from secondary backup. In this post we&#39;ll be showing you how at Datto we intentionally cause corruption in our testing environments, to ensure we&#39;re building software that can properly handle these scenarios.</p>
</blockquote>

<ul>
<li>Causing Corruption</li>
</ul>

<blockquote>
<p>Since this is a mirror setup, a naive solution to cause corruption would be to randomly dd the same sectors of both /dev/sdb and /dev/sdc. This works, but is equally likely to just overwrite random unused space, or take down the zpool entirely. What we really want is to corrupt a specific snapshot, or even a specific file in that snapshot, to simulate a more realistic minor corruption event. Luckily we have a tool called zdb that lets us view some low level information about datasets.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>At the 500 PB scale, it&#39;s not a matter of if data corruption will happen but when. Intentionally causing corruption is one of the strategies we use to ensure we&#39;re building software that can handle these rare (but inevitable) events.</p>

<p>To others out there using ZFS: I&#39;m curious to hear how you&#39;ve solved this problem. We did quite a bit of experimentation with zinject before going with this more brute force method. So I&#39;d be especially interested if you&#39;ve had luck simply simulating corruption with zinject.</p>
</blockquote>

<hr>

<h3><a href="https://polprog.net/blog/netbsdasmprog/" rel="nofollow">NetBSD Assembly Programming Tutorial</a></h3>

<blockquote>
<p>A sparc64 version is also being prepared and will be added when done</p>

<p>This post describes how to write a simple hello world program in pure assembly on NetBSD/amd64. We will not use (nor link against) libc, nor use gcc to compile it. I will be using GNU as (gas), and therefore the AT&amp;T syntax instead of Intel.</p>
</blockquote>

<ul>
<li>Why assembly?</li>
</ul>

<blockquote>
<p>Why not? Because it&#39;s fun to program in assembly directly. Contrary to a popular belief assembly programs aren&#39;t always faster than what optimizing compilers produce. Nevertheless it&#39;s good to be able to read assembly, especially when debugging C programs</p>
</blockquote>

<ul>
<li>Due to the nature of the guide, visit the site for the complete breakdown</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://wiki.eth0.nl/index.php/LackRack" rel="nofollow">The IKEA Lack Rack for Servers</a></h3>

<ul>
<li>The LackRack</li>
</ul>

<blockquote>
<p>First occurrence on eth0:2010 Winterlan, the LackRack is the ultimate, low-cost, high shininess solution for your modular datacenter-in-the-living-room. Featuring the LACK (side table) from Ikea, the LackRack is an easy-to-implement, exact-fit datacenter building block. It&#39;s a little known fact that we have seen Google engineers tinker with Lack tables since way back in 2009.</p>

<p>The LackRack will certainly make its appearance again this summer at eth0:2010 Summer.</p>
</blockquote>

<ul>
<li>Summary</li>
</ul>

<blockquote>
<p>When temporarily not in use, multiple LackRacks can be stacked in a space-efficient way without disassembly, unlike competing 19&quot; server racks.</p>

<p>The LackRack was first seen on eth0:2010 Winterlan in the no-shoe Lounge area. Its low-cost and perfect fit are great for mounting up to 8 U of 19&quot; hardware, such as switches (see below), or perhaps other 19&quot; gear. It&#39;s very easy to assemble, and thanks to the design, they are stable enough to hold (for example) 19&quot; switches and you can put your bottle of Club-Mate on top! Multi-shiny LackRack can also be painted to your specific preferences and the airflow is unprecedented!</p>
</blockquote>

<ul>
<li>Howto</li>
</ul>

<blockquote>
<p>You can find a howto on buying a LackRack on this page. This includes the proof that a 19&quot; switch can indeed be placed in the LackRack in its natural habitat!</p>
</blockquote>

<hr>

<h3><a href="https://omniosce.org/article/release-030" rel="nofollow">OmniOS Community Edition r151030 LTS - Published at May 6, 2019</a></h3>

<blockquote>
<p>The OmniOS Community Edition Association is proud to announce the general availability of OmniOS - r151030.</p>

<p>OmniOS is published according to a 6-month release cycle, r151030 LTS takes over from r151028, published in November 2018; and since it is a LTS release it also takes over from r151022. The r151030 LTS release will be supported for 3 Years. It is the first LTS release published by the OmniOS CE Association since taking over the reins from OmniTI in 2017. The next LTS release is scheduled for May 2021. The old stable r151026 release is now end-of-life. See the release schedule for further details.</p>

<p>This is only a small selection of the new features, and bug fixes in the new release; review the release notes for full details.</p>

<p>If you upgrade from r22 and want to see all new features added since then, make sure to also read the release notes for r24, r26 and r28.</p>
</blockquote>

<ul>
<li>For full relase notes including upgrade instructions;</li>
<li><a href="https://omniosce.org/releasenotes.html" rel="nofollow">release notes</a></li>
<li><a href="https://omniosce.org/upgrade.html" rel="nofollow">upgrade instructions</a></li>
</ul>

<hr>

<h3><a href="https://vermaden.wordpress.com/2019/09/27/list-block-devices-on-freebsd-lsblk8-style/" rel="nofollow">List Block Devices on FreeBSD lsblk(8) Style</a></h3>

<blockquote>
<p>When I have to work on Linux systems I usually miss many nice FreeBSD tools such as these for example to name the few: sockstat, gstat, top -b -o res, top -m io -o total, usbconfig, rcorder, beadm/bectl, idprio/rtprio,… but sometimes – which rarely happens – Linux has some very useful tool that is not available on FreeBSD. An example of such tool is lsblk(8) that does one thing and does it quite well – lists block devices and their contents. It has some problems like listing a disk that is entirely used under ZFS pool on which lsblk(8) displays two partitions instead of information about ZFS just being there – but we all know how much in some circles the CDDL licensed ZFS is unloved in that GPL world.</p>
</blockquote>

<p>Example lsblk(8) output from Linux system:</p>

<pre><code>$ lsblk
NAME                         MAJ:MIN RM   SIZE RO TYPE   MOUNTPOINT
sr0                           11:0    1  1024M  0 rom
sda                            8:0    0 931.5G  0 disk
|-sda1                         8:1    0   500M  0 part   /boot
`-sda2                         8:2    0   931G  0 part
  |-vg_local-lv_root (dm-0)  253:0    0    50G  0 lvm    /
  |-vg_local-lv_swap (dm-1)  253:1    0  17.7G  0 lvm    [SWAP]
  `-vg_local-lv_home (dm-2)  253:2    0   1.8T  0 lvm    /home
sdc                            8:32   0 232.9G  0 disk
`-sdc1                         8:33   0 232.9G  0 part
  `-md1                        9:1    0 232.9G  0 raid10 /data
sdd                            8:48   0 232.9G  0 disk
`-sdd1                         8:49   0 232.9G  0 part
  `-md1                        9:1    0 232.9G  0 raid10 /data
</code></pre>

<blockquote>
<p>What FreeBSD offers in this department? The camcontrol(8) and geom(8) commands are available. You can also use gpart(8) command to list partitions. Below you will find output of these commands from my single disk laptop. Please note that because of WordPress limitations I need to change all &gt; &lt; characters to ] [ ones in the commands outputs.</p>
</blockquote>

<ul>
<li>See the article for the rest of the guide</li>
</ul>

<hr>

<h3><a href="https://project-trident.org/post/2019-10-05_19.10_available/" rel="nofollow">Project Trident 19.10 Now Available</a></h3>

<blockquote>
<p>This is a general package update to the CURRENT release repository based upon TrueOS 19.10</p>
</blockquote>

<ul>
<li>PACKAGE CHANGES FROM 19.08

<ul>
<li>New Packages: 601</li>
<li>Deleted Packages: 165</li>
<li>Updated Packages: 3341</li>
</ul></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://imgur.com/gallery/0sG4b1K" rel="nofollow">NetBSD building tools</a></li>
<li><a href="https://mwl.io/archives/4569" rel="nofollow">Sponsorships open for SNMP Mastery</a></li>
<li><a href="http://mail-index.netbsd.org/pkgsrc-users/2019/10/03/msg029485.html" rel="nofollow">pkgsrc-2019Q3 release announcement (2019-10-03)</a></li>
<li><a href="https://github.com/dylanaraps/pfetch" rel="nofollow">pfetch - A simple system information tool written in POSIX sh</a></li>
<li><a href="https://netbsd.org/%7Ekamil/eurobsdcon2019_fuzzing/presentation.html#slide1" rel="nofollow">Taking NetBSD kernel bug roast to the next level: Kernel Fuzzers (quick A.D. 2019 overview)</a></li>
<li><a href="https://leahneukirchen.org/blog/archive/2019/10/ken-thompson-s-unix-password.html" rel="nofollow">Cracking Ken Thomson’s password</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Evilham - <a href="http://dpaste.com/2JC85WV" rel="nofollow">Couple Questions</a></li>
<li>Rob - <a href="http://dpaste.com/0SDX9ZX" rel="nofollow">APU2 alternatives and GPT partition types</a></li>
<li>Tom - <a href="http://dpaste.com/2B43MY1#wrap" rel="nofollow">FreeBSD journal article by A. Fengler</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0319.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>318: The TrueNAS Library</title>
  <link>https://www.bsdnow.tv/318</link>
  <guid isPermaLink="false">a53fad97-5df2-4cd3-91a8-e75d5a2f38d7</guid>
  <pubDate>Wed, 02 Oct 2019 23:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a53fad97-5df2-4cd3-91a8-e75d5a2f38d7.mp3" length="33605404" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>DragonFlyBSD vs. FreeBSD vs. Linux benchmark on Ryzen 7, JFK Presidential Library chooses TrueNAS for digital archives, FreeBSD 12.1-beta is available, cool but obscure X11 tools, vBSDcon trip report, Project Trident 12-U7 is available, a couple new Unix artifacts, and more.</itunes:subtitle>
  <itunes:duration>46:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>DragonFlyBSD vs. FreeBSD vs. Linux benchmark on Ryzen 7, JFK Presidential Library chooses TrueNAS for digital archives, FreeBSD 12.1-beta is available, cool but obscure X11 tools, vBSDcon trip report, Project Trident 12-U7 is available, a couple new Unix artifacts, and more.
Headlines
DragonFlyBSD 5.6 vs. FreeBSD 12 vs. Linux - Ryzen 7 3700X (https://www.phoronix.com/scan.php?page=article&amp;amp;item=bsd-linux-3700x)
For those wondering how well FreeBSD and DragonFlyBSD are handling AMD's new Ryzen 3000 series desktop processors, here are some benchmarks on a Ryzen 7 3700X with MSI MEG X570 GODLIKE where both of these popular BSD operating systems were working out-of-the-box. For some fun mid-week benchmarking, here are those results of FreeBSD 12.0 and DragonFlyBSD 5.6.2 up against openSUSE Tumbleweed and Ubuntu 19.04.
Back in July I looked at FreeBSD 12 on the Ryzen 9 3900X but at that time at least DragonFlyBSD had troubles booting on that system. When trying out the Ryzen 7 3700X + MSI GODLIKE X570 motherboard on the latest BIOS, everything "just worked" without any compatibility issues for either of these BSDs.
We've been eager to see how well DragonFlyBSD is performing on these new AMD Zen 2 CPUs with DragonFlyBSD lead developer Matthew Dillon having publicly expressed being impressed by the new AMD Ryzen 3000 series CPUs.
For comparison to those BSDs, Ubuntu 19.04 and openSUSE Tumbleweed were tested on the same hardware in their out-of-the-box configurations. While Clear Linux is normally the fastest, on this system Clear's power management defaults had caused issues in being unable to detect the Samsung 970 EVO Plus NVMe SSD used for testing and so we left it out this round.
All of the hardware was the same throughout testing as were the BIOS settings and running the Ryzen 7 3700X at stock speeds. (Any differences in the reported hardware for the system table just come down to differences in what is exposed by each OS for reporting.) All of the BSD/Linux benchmarks on this eight core / sixteen thread processor were run via the Phoronix Test Suite. In the case of FreeBSD 12.0, we benchmarked both with its default LLVM Clang 6.0 compiler as well as with GCC 9.1 so that it would match the GCC compiler being the default on the other operating systems under test.
JFK Presidential Library Chooses iXsystems TrueNAS to Preserve Precious Digital Archives (https://www.ixsystems.com/blog/jfk-presidential-library-pr/)
 iXsystems is honored to have the TrueNAS® M-Series unified storage selected to store, serve, and protect the entire digital archive for the John F. Kennedy Library Foundation. This is in support of the collection at the John F. Kennedy Presidential Library and Museum (JFK Library). Over the next several years, the Foundation hopes to grow the digital collection from hundreds of terabytes today to cover much more of the Archives at the Kennedy Library. Overall there is a total of 25 million documents, audio recordings, photos, and videos once the project is complete.
Having first deployed the TrueNAS M50-HA earlier in 2019, the JFK Library has now completed the migration of its existing digital collection and is now in the process of digitizing much of the rest of its vast collection. 
Not only is the catalog of material vast, it is also diverse, with files being copied to the storage system from a variety of sources in numerous file types. To achieve this ambitious goal, the library required a high-end NAS system capable of sharing with a variety of systems throughout the digitization process.  The digital archive will be served from the TrueNAS M50 and made available to both in-person and online visitors.
With precious material and information comes robust demands. The highly-available TrueNAS M-Series has multiple layers of protection to help keep data safe, including data scrubs, checksums, unlimited snapshots, replication, and more. TrueNAS is also inherently scalable with data shares only limited by the number of drives connected to the pool. Perfect for archival storage, the deployed TrueNAS M50 will grow with the library’s content, easily expanding its storage capacity over time as needed. Supporting a variety of protocols, multi-petabyte scalability in a single share, and anytime, uninterrupted capacity expansion, the TrueNAS M-Series ticked all the right boxes. 
Youtube Video (https://www.youtube.com/watch?v=8rFjH5-0Fiw)
News Roundup
FreeBSD 12.1-beta available (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=FreeBSD-12.1-Beta-Released)
FreeBSD 12.0 is already approaching one year old while FreeBSD 12.1 is now on the way as the next installment with various bug/security fixes and other alterations to this BSD operating system.
FreeBSD 12.1 has many security/bug fixes throughout, no longer enables "-Werror" by default as a compiler flag (Update: This change is just for the GCC 4.2 compiler), has imported BearSSL into the FreeBSD base system as a lightweight TLS/SSL implementation, bzip2recover has been added, and a variety of mostly lower-level changes. More details can be found via the in-progress release notes.
For those with time to test this weekend, FreeBSD 12.1 Beta 1 is available for all prominent architectures.
The FreeBSD release team is planning for at least another beta or two and around three release candidates. If all goes well, FreeBSD 12.1 will be out in early November.
Announcement Link (https://lists.freebsd.org/pipermail/freebsd-stable/2019-September/091533.html)
Cool, but obscure X11 tools.  More suggestions in the source link (https://cyber.dabamos.de/unix/x11/)
ASClock
Free42
FSV2
GLXGears
GMixer
GVIM
Micropolis
Sunclock
Ted
TiEmu
X026
X48
XAbacus
XAntfarm
XArchiver
XASCII
XBiff
XBill
XBoard
XCalc
XCalendar
XCHM
XChomp
XClipboard
XClock
XClock/Cat Clock
XColorSel
XConsole
XDiary
XEarth
XEdit
Xev
XEyes
XFontSel
XGalaga
XInvaders 3D
XKill
XLennart
XLoad
XLock
XLogo
XMahjongg
XMan
XMessage
XmGrace
XMixer
XmMix
XMore
XMosaic
XMOTD
XMountains
XNeko
XOdometer
XOSView
Xplore
XPostIt
XRoach
XScreenSaver
XSnow
XSpread
XTerm
XTide
Xv
Xvkbd
XWPE
XZoom
vBSDCon 2019 trip report from iXSystems (https://www.ixsystems.com/blog/vbsdcon-2019/)
The fourth biennial vBSDCon was held in Reston, VA on September 5th through 7th and attracted attendees and presenters from not only the Washington, DC area, but also Canada, Germany, Kenya, and beyond. While MeetBSD caters to Silicon Valley BSD enthusiasts on even years, vBSDcon caters to East Coast and DC area enthusiasts on odd years. Verisign was again the key sponsor of vBSDcon 2019 but this year made a conscious effort to entrust the organization of the event to a team of community members led by Dan Langille, who you probably know as the lead BSDCan organizer. The result of this shift was a low key but professional event that fostered great conversation and brainstorming at every turn.
Project Trident 12-U7 now available (https://project-trident.org/post/2019-09-21_stable12-u7_available/)
Package Summary
New Packages: 130
Deleted Packages: 72
Updated Packages: 865
Stable ISO - https://pkg.project-trident.org/iso/stable/Trident-x64-TOS-12-U7-20190920.iso
A Couple new Unix Artifacts (https://minnie.tuhs.org//pipermail/tuhs/2019-September/018685.html)
I fear we're drifting a bit here and the S/N ratio is dropping a bit w.r.t the actual history of Unix. Please no more on the relative merits of version control systems or alternative text processing systems.
So I'll try to distract you by saying this. I'm sitting on two artifacts that have recently been given to me:
by two large organisations
of great significance to Unix history
who want me to keep "mum" about them
as they are going to make announcements about them soon*
and I am going slowly crazy as I wait for them to be offically released. Now you have a new topic to talk about :-)
Cheers, Warren
* for some definition of "soon"
Beastie Bits
NetBSD machines at Open Source Conference 2019 Hiroshima (https://mail-index.netbsd.org/netbsd-advocacy/2019/09/16/msg000813.html)
Hyperbola a GNU/Linux OS is using OpenBSD's Xenocara (https://www.hyperbola.info/news/end-of-xorg-support/)
Talos is looking for a FreeBSD Engineer (https://www.talosintelligence.com/careers/freebsd_engineer)
GitHub - dylanaraps/pure-sh-bible: A collection of pure POSIX sh alternatives to external processes. (https://github.com/dylanaraps/pure-sh-bible)
dsynth: you’re building it (https://www.dragonflydigest.com/2019/09/23/23523.html)
Percy Ludgate, the missing link between Babbage’s machine and everything else (http://lists.sigcis.org/pipermail/members-sigcis.org/2019-September/001606.html)
Feedback/Questions
Bruce - Down the expect rabbithole (http://dpaste.com/147HGP3#wrap)
Bruce - Expect (update) (http://dpaste.com/37MNVSW#wrap)
David - Netgraph answer (http://dpaste.com/2SE1YSE)
Mason - Beeps? (http://dpaste.com/00KKXJM)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, ryzen, ryzen 7, ryzen 7 3700X, amd, benchmark, presidential library, digital archives, digital library, presidential archive, truenas, obscure tools, x11, vbsdcon, trip report, project trident, Unix, Unix artifacts</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>DragonFlyBSD vs. FreeBSD vs. Linux benchmark on Ryzen 7, JFK Presidential Library chooses TrueNAS for digital archives, FreeBSD 12.1-beta is available, cool but obscure X11 tools, vBSDcon trip report, Project Trident 12-U7 is available, a couple new Unix artifacts, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=article&item=bsd-linux-3700x" rel="nofollow">DragonFlyBSD 5.6 vs. FreeBSD 12 vs. Linux - Ryzen 7 3700X</a></h3>

<blockquote>
<p>For those wondering how well FreeBSD and DragonFlyBSD are handling AMD&#39;s new Ryzen 3000 series desktop processors, here are some benchmarks on a Ryzen 7 3700X with MSI MEG X570 GODLIKE where both of these popular BSD operating systems were working out-of-the-box. For some fun mid-week benchmarking, here are those results of FreeBSD 12.0 and DragonFlyBSD 5.6.2 up against openSUSE Tumbleweed and Ubuntu 19.04.</p>

<p>Back in July I looked at FreeBSD 12 on the Ryzen 9 3900X but at that time at least DragonFlyBSD had troubles booting on that system. When trying out the Ryzen 7 3700X + MSI GODLIKE X570 motherboard on the latest BIOS, everything &quot;just worked&quot; without any compatibility issues for either of these BSDs.</p>

<p>We&#39;ve been eager to see how well DragonFlyBSD is performing on these new AMD Zen 2 CPUs with DragonFlyBSD lead developer Matthew Dillon having publicly expressed being impressed by the new AMD Ryzen 3000 series CPUs.</p>

<p>For comparison to those BSDs, Ubuntu 19.04 and openSUSE Tumbleweed were tested on the same hardware in their out-of-the-box configurations. While Clear Linux is normally the fastest, on this system Clear&#39;s power management defaults had caused issues in being unable to detect the Samsung 970 EVO Plus NVMe SSD used for testing and so we left it out this round.</p>

<p>All of the hardware was the same throughout testing as were the BIOS settings and running the Ryzen 7 3700X at stock speeds. (Any differences in the reported hardware for the system table just come down to differences in what is exposed by each OS for reporting.) All of the BSD/Linux benchmarks on this eight core / sixteen thread processor were run via the Phoronix Test Suite. In the case of FreeBSD 12.0, we benchmarked both with its default LLVM Clang 6.0 compiler as well as with GCC 9.1 so that it would match the GCC compiler being the default on the other operating systems under test.</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/jfk-presidential-library-pr/" rel="nofollow">JFK Presidential Library Chooses iXsystems TrueNAS to Preserve Precious Digital Archives</a></h3>

<blockquote>
<p>iXsystems is honored to have the TrueNAS® M-Series unified storage selected to store, serve, and protect the entire digital archive for the John F. Kennedy Library Foundation. This is in support of the collection at the John F. Kennedy Presidential Library and Museum (JFK Library). Over the next several years, the Foundation hopes to grow the digital collection from hundreds of terabytes today to cover much more of the Archives at the Kennedy Library. Overall there is a total of 25 million documents, audio recordings, photos, and videos once the project is complete.</p>

<p>Having first deployed the TrueNAS M50-HA earlier in 2019, the JFK Library has now completed the migration of its existing digital collection and is now in the process of digitizing much of the rest of its vast collection. </p>

<p>Not only is the catalog of material vast, it is also diverse, with files being copied to the storage system from a variety of sources in numerous file types. To achieve this ambitious goal, the library required a high-end NAS system capable of sharing with a variety of systems throughout the digitization process.  The digital archive will be served from the TrueNAS M50 and made available to both in-person and online visitors.</p>

<p>With precious material and information comes robust demands. The highly-available TrueNAS M-Series has multiple layers of protection to help keep data safe, including data scrubs, checksums, unlimited snapshots, replication, and more. TrueNAS is also inherently scalable with data shares only limited by the number of drives connected to the pool. Perfect for archival storage, the deployed TrueNAS M50 will grow with the library’s content, easily expanding its storage capacity over time as needed. Supporting a variety of protocols, multi-petabyte scalability in a single share, and anytime, uninterrupted capacity expansion, the TrueNAS M-Series ticked all the right boxes. </p>
</blockquote>

<ul>
<li><a href="https://www.youtube.com/watch?v=8rFjH5-0Fiw" rel="nofollow">Youtube Video</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=FreeBSD-12.1-Beta-Released" rel="nofollow">FreeBSD 12.1-beta available</a></h3>

<blockquote>
<p>FreeBSD 12.0 is already approaching one year old while FreeBSD 12.1 is now on the way as the next installment with various bug/security fixes and other alterations to this BSD operating system.</p>

<p>FreeBSD 12.1 has many security/bug fixes throughout, no longer enables &quot;-Werror&quot; by default as a compiler flag (Update: This change is just for the GCC 4.2 compiler), has imported BearSSL into the FreeBSD base system as a lightweight TLS/SSL implementation, bzip2recover has been added, and a variety of mostly lower-level changes. More details can be found via the in-progress release notes.</p>

<p>For those with time to test this weekend, FreeBSD 12.1 Beta 1 is available for all prominent architectures.</p>

<p>The FreeBSD release team is planning for at least another beta or two and around three release candidates. If all goes well, FreeBSD 12.1 will be out in early November.</p>
</blockquote>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-September/091533.html" rel="nofollow">Announcement Link</a></li>
</ul>

<hr>

<h3><a href="https://cyber.dabamos.de/unix/x11/" rel="nofollow">Cool, but obscure X11 tools.  More suggestions in the source link</a></h3>

<ul>
<li>ASClock</li>
<li>Free42</li>
<li>FSV2</li>
<li>GLXGears</li>
<li>GMixer</li>
<li>GVIM</li>
<li>Micropolis</li>
<li>Sunclock</li>
<li>Ted</li>
<li>TiEmu</li>
<li>X026</li>
<li>X48</li>
<li>XAbacus</li>
<li>XAntfarm</li>
<li>XArchiver</li>
<li>XASCII</li>
<li>XBiff</li>
<li>XBill</li>
<li>XBoard</li>
<li>XCalc</li>
<li>XCalendar</li>
<li>XCHM</li>
<li>XChomp</li>
<li>XClipboard</li>
<li>XClock</li>
<li>XClock/Cat Clock</li>
<li>XColorSel</li>
<li>XConsole</li>
<li>XDiary</li>
<li>XEarth</li>
<li>XEdit</li>
<li>Xev</li>
<li>XEyes</li>
<li>XFontSel</li>
<li>XGalaga</li>
<li>XInvaders 3D</li>
<li>XKill</li>
<li>XLennart</li>
<li>XLoad</li>
<li>XLock</li>
<li>XLogo</li>
<li>XMahjongg</li>
<li>XMan</li>
<li>XMessage</li>
<li>XmGrace</li>
<li>XMixer</li>
<li>XmMix</li>
<li>XMore</li>
<li>XMosaic</li>
<li>XMOTD</li>
<li>XMountains</li>
<li>XNeko</li>
<li>XOdometer</li>
<li>XOSView</li>
<li>Xplore</li>
<li>XPostIt</li>
<li>XRoach</li>
<li>XScreenSaver</li>
<li>XSnow</li>
<li>XSpread</li>
<li>XTerm</li>
<li>XTide</li>
<li>Xv</li>
<li>Xvkbd</li>
<li>XWPE</li>
<li>XZoom</li>
</ul>

<hr>

<h3><a href="https://www.ixsystems.com/blog/vbsdcon-2019/" rel="nofollow">vBSDCon 2019 trip report from iXSystems</a></h3>

<blockquote>
<p>The fourth biennial vBSDCon was held in Reston, VA on September 5th through 7th and attracted attendees and presenters from not only the Washington, DC area, but also Canada, Germany, Kenya, and beyond. While MeetBSD caters to Silicon Valley BSD enthusiasts on even years, vBSDcon caters to East Coast and DC area enthusiasts on odd years. Verisign was again the key sponsor of vBSDcon 2019 but this year made a conscious effort to entrust the organization of the event to a team of community members led by Dan Langille, who you probably know as the lead BSDCan organizer. The result of this shift was a low key but professional event that fostered great conversation and brainstorming at every turn.</p>
</blockquote>

<hr>

<h3><a href="https://project-trident.org/post/2019-09-21_stable12-u7_available/" rel="nofollow">Project Trident 12-U7 now available</a></h3>

<ul>
<li>Package Summary

<ul>
<li>New Packages: 130</li>
<li>Deleted Packages: 72</li>
<li>Updated Packages: 865</li>
</ul></li>
<li>Stable ISO - <a href="https://pkg.project-trident.org/iso/stable/Trident-x64-TOS-12-U7-20190920.iso" rel="nofollow">https://pkg.project-trident.org/iso/stable/Trident-x64-TOS-12-U7-20190920.iso</a></li>
</ul>

<hr>

<h3><a href="https://minnie.tuhs.org//pipermail/tuhs/2019-September/018685.html" rel="nofollow">A Couple new Unix Artifacts</a></h3>

<blockquote>
<p>I fear we&#39;re drifting a bit here and the S/N ratio is dropping a bit w.r.t the actual history of Unix. Please no more on the relative merits of version control systems or alternative text processing systems.</p>

<p>So I&#39;ll try to distract you by saying this. I&#39;m sitting on two artifacts that have recently been given to me:</p>
</blockquote>

<ul>
<li>by two large organisations</li>
<li>of great significance to Unix history</li>
<li>who want me to keep &quot;mum&quot; about them</li>
<li>as they are going to make announcements about them soon*</li>
</ul>

<blockquote>
<p>and I am going slowly crazy as I wait for them to be offically released. Now you have a new topic to talk about :-)</p>

<p>Cheers, Warren</p>
</blockquote>

<p>* <em>for some definition of &quot;soon&quot;</em></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2019/09/16/msg000813.html" rel="nofollow">NetBSD machines at Open Source Conference 2019 Hiroshima</a></li>
<li><a href="https://www.hyperbola.info/news/end-of-xorg-support/" rel="nofollow">Hyperbola a GNU/Linux OS is using OpenBSD&#39;s Xenocara</a></li>
<li><a href="https://www.talosintelligence.com/careers/freebsd_engineer" rel="nofollow">Talos is looking for a FreeBSD Engineer</a></li>
<li><a href="https://github.com/dylanaraps/pure-sh-bible" rel="nofollow">GitHub - dylanaraps/pure-sh-bible: A collection of pure POSIX sh alternatives to external processes.</a></li>
<li><a href="https://www.dragonflydigest.com/2019/09/23/23523.html" rel="nofollow">dsynth: you’re building it</a></li>
<li><a href="http://lists.sigcis.org/pipermail/members-sigcis.org/2019-September/001606.html" rel="nofollow">Percy Ludgate, the missing link between Babbage’s machine and everything else</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Bruce - <a href="http://dpaste.com/147HGP3#wrap" rel="nofollow">Down the expect rabbithole</a></li>
<li>Bruce - <a href="http://dpaste.com/37MNVSW#wrap" rel="nofollow">Expect (update)</a></li>
<li>David - <a href="http://dpaste.com/2SE1YSE" rel="nofollow">Netgraph answer</a></li>
<li>Mason - <a href="http://dpaste.com/00KKXJM" rel="nofollow">Beeps?</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0318.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>DragonFlyBSD vs. FreeBSD vs. Linux benchmark on Ryzen 7, JFK Presidential Library chooses TrueNAS for digital archives, FreeBSD 12.1-beta is available, cool but obscure X11 tools, vBSDcon trip report, Project Trident 12-U7 is available, a couple new Unix artifacts, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=article&item=bsd-linux-3700x" rel="nofollow">DragonFlyBSD 5.6 vs. FreeBSD 12 vs. Linux - Ryzen 7 3700X</a></h3>

<blockquote>
<p>For those wondering how well FreeBSD and DragonFlyBSD are handling AMD&#39;s new Ryzen 3000 series desktop processors, here are some benchmarks on a Ryzen 7 3700X with MSI MEG X570 GODLIKE where both of these popular BSD operating systems were working out-of-the-box. For some fun mid-week benchmarking, here are those results of FreeBSD 12.0 and DragonFlyBSD 5.6.2 up against openSUSE Tumbleweed and Ubuntu 19.04.</p>

<p>Back in July I looked at FreeBSD 12 on the Ryzen 9 3900X but at that time at least DragonFlyBSD had troubles booting on that system. When trying out the Ryzen 7 3700X + MSI GODLIKE X570 motherboard on the latest BIOS, everything &quot;just worked&quot; without any compatibility issues for either of these BSDs.</p>

<p>We&#39;ve been eager to see how well DragonFlyBSD is performing on these new AMD Zen 2 CPUs with DragonFlyBSD lead developer Matthew Dillon having publicly expressed being impressed by the new AMD Ryzen 3000 series CPUs.</p>

<p>For comparison to those BSDs, Ubuntu 19.04 and openSUSE Tumbleweed were tested on the same hardware in their out-of-the-box configurations. While Clear Linux is normally the fastest, on this system Clear&#39;s power management defaults had caused issues in being unable to detect the Samsung 970 EVO Plus NVMe SSD used for testing and so we left it out this round.</p>

<p>All of the hardware was the same throughout testing as were the BIOS settings and running the Ryzen 7 3700X at stock speeds. (Any differences in the reported hardware for the system table just come down to differences in what is exposed by each OS for reporting.) All of the BSD/Linux benchmarks on this eight core / sixteen thread processor were run via the Phoronix Test Suite. In the case of FreeBSD 12.0, we benchmarked both with its default LLVM Clang 6.0 compiler as well as with GCC 9.1 so that it would match the GCC compiler being the default on the other operating systems under test.</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/jfk-presidential-library-pr/" rel="nofollow">JFK Presidential Library Chooses iXsystems TrueNAS to Preserve Precious Digital Archives</a></h3>

<blockquote>
<p>iXsystems is honored to have the TrueNAS® M-Series unified storage selected to store, serve, and protect the entire digital archive for the John F. Kennedy Library Foundation. This is in support of the collection at the John F. Kennedy Presidential Library and Museum (JFK Library). Over the next several years, the Foundation hopes to grow the digital collection from hundreds of terabytes today to cover much more of the Archives at the Kennedy Library. Overall there is a total of 25 million documents, audio recordings, photos, and videos once the project is complete.</p>

<p>Having first deployed the TrueNAS M50-HA earlier in 2019, the JFK Library has now completed the migration of its existing digital collection and is now in the process of digitizing much of the rest of its vast collection. </p>

<p>Not only is the catalog of material vast, it is also diverse, with files being copied to the storage system from a variety of sources in numerous file types. To achieve this ambitious goal, the library required a high-end NAS system capable of sharing with a variety of systems throughout the digitization process.  The digital archive will be served from the TrueNAS M50 and made available to both in-person and online visitors.</p>

<p>With precious material and information comes robust demands. The highly-available TrueNAS M-Series has multiple layers of protection to help keep data safe, including data scrubs, checksums, unlimited snapshots, replication, and more. TrueNAS is also inherently scalable with data shares only limited by the number of drives connected to the pool. Perfect for archival storage, the deployed TrueNAS M50 will grow with the library’s content, easily expanding its storage capacity over time as needed. Supporting a variety of protocols, multi-petabyte scalability in a single share, and anytime, uninterrupted capacity expansion, the TrueNAS M-Series ticked all the right boxes. </p>
</blockquote>

<ul>
<li><a href="https://www.youtube.com/watch?v=8rFjH5-0Fiw" rel="nofollow">Youtube Video</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=FreeBSD-12.1-Beta-Released" rel="nofollow">FreeBSD 12.1-beta available</a></h3>

<blockquote>
<p>FreeBSD 12.0 is already approaching one year old while FreeBSD 12.1 is now on the way as the next installment with various bug/security fixes and other alterations to this BSD operating system.</p>

<p>FreeBSD 12.1 has many security/bug fixes throughout, no longer enables &quot;-Werror&quot; by default as a compiler flag (Update: This change is just for the GCC 4.2 compiler), has imported BearSSL into the FreeBSD base system as a lightweight TLS/SSL implementation, bzip2recover has been added, and a variety of mostly lower-level changes. More details can be found via the in-progress release notes.</p>

<p>For those with time to test this weekend, FreeBSD 12.1 Beta 1 is available for all prominent architectures.</p>

<p>The FreeBSD release team is planning for at least another beta or two and around three release candidates. If all goes well, FreeBSD 12.1 will be out in early November.</p>
</blockquote>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-September/091533.html" rel="nofollow">Announcement Link</a></li>
</ul>

<hr>

<h3><a href="https://cyber.dabamos.de/unix/x11/" rel="nofollow">Cool, but obscure X11 tools.  More suggestions in the source link</a></h3>

<ul>
<li>ASClock</li>
<li>Free42</li>
<li>FSV2</li>
<li>GLXGears</li>
<li>GMixer</li>
<li>GVIM</li>
<li>Micropolis</li>
<li>Sunclock</li>
<li>Ted</li>
<li>TiEmu</li>
<li>X026</li>
<li>X48</li>
<li>XAbacus</li>
<li>XAntfarm</li>
<li>XArchiver</li>
<li>XASCII</li>
<li>XBiff</li>
<li>XBill</li>
<li>XBoard</li>
<li>XCalc</li>
<li>XCalendar</li>
<li>XCHM</li>
<li>XChomp</li>
<li>XClipboard</li>
<li>XClock</li>
<li>XClock/Cat Clock</li>
<li>XColorSel</li>
<li>XConsole</li>
<li>XDiary</li>
<li>XEarth</li>
<li>XEdit</li>
<li>Xev</li>
<li>XEyes</li>
<li>XFontSel</li>
<li>XGalaga</li>
<li>XInvaders 3D</li>
<li>XKill</li>
<li>XLennart</li>
<li>XLoad</li>
<li>XLock</li>
<li>XLogo</li>
<li>XMahjongg</li>
<li>XMan</li>
<li>XMessage</li>
<li>XmGrace</li>
<li>XMixer</li>
<li>XmMix</li>
<li>XMore</li>
<li>XMosaic</li>
<li>XMOTD</li>
<li>XMountains</li>
<li>XNeko</li>
<li>XOdometer</li>
<li>XOSView</li>
<li>Xplore</li>
<li>XPostIt</li>
<li>XRoach</li>
<li>XScreenSaver</li>
<li>XSnow</li>
<li>XSpread</li>
<li>XTerm</li>
<li>XTide</li>
<li>Xv</li>
<li>Xvkbd</li>
<li>XWPE</li>
<li>XZoom</li>
</ul>

<hr>

<h3><a href="https://www.ixsystems.com/blog/vbsdcon-2019/" rel="nofollow">vBSDCon 2019 trip report from iXSystems</a></h3>

<blockquote>
<p>The fourth biennial vBSDCon was held in Reston, VA on September 5th through 7th and attracted attendees and presenters from not only the Washington, DC area, but also Canada, Germany, Kenya, and beyond. While MeetBSD caters to Silicon Valley BSD enthusiasts on even years, vBSDcon caters to East Coast and DC area enthusiasts on odd years. Verisign was again the key sponsor of vBSDcon 2019 but this year made a conscious effort to entrust the organization of the event to a team of community members led by Dan Langille, who you probably know as the lead BSDCan organizer. The result of this shift was a low key but professional event that fostered great conversation and brainstorming at every turn.</p>
</blockquote>

<hr>

<h3><a href="https://project-trident.org/post/2019-09-21_stable12-u7_available/" rel="nofollow">Project Trident 12-U7 now available</a></h3>

<ul>
<li>Package Summary

<ul>
<li>New Packages: 130</li>
<li>Deleted Packages: 72</li>
<li>Updated Packages: 865</li>
</ul></li>
<li>Stable ISO - <a href="https://pkg.project-trident.org/iso/stable/Trident-x64-TOS-12-U7-20190920.iso" rel="nofollow">https://pkg.project-trident.org/iso/stable/Trident-x64-TOS-12-U7-20190920.iso</a></li>
</ul>

<hr>

<h3><a href="https://minnie.tuhs.org//pipermail/tuhs/2019-September/018685.html" rel="nofollow">A Couple new Unix Artifacts</a></h3>

<blockquote>
<p>I fear we&#39;re drifting a bit here and the S/N ratio is dropping a bit w.r.t the actual history of Unix. Please no more on the relative merits of version control systems or alternative text processing systems.</p>

<p>So I&#39;ll try to distract you by saying this. I&#39;m sitting on two artifacts that have recently been given to me:</p>
</blockquote>

<ul>
<li>by two large organisations</li>
<li>of great significance to Unix history</li>
<li>who want me to keep &quot;mum&quot; about them</li>
<li>as they are going to make announcements about them soon*</li>
</ul>

<blockquote>
<p>and I am going slowly crazy as I wait for them to be offically released. Now you have a new topic to talk about :-)</p>

<p>Cheers, Warren</p>
</blockquote>

<p>* <em>for some definition of &quot;soon&quot;</em></p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2019/09/16/msg000813.html" rel="nofollow">NetBSD machines at Open Source Conference 2019 Hiroshima</a></li>
<li><a href="https://www.hyperbola.info/news/end-of-xorg-support/" rel="nofollow">Hyperbola a GNU/Linux OS is using OpenBSD&#39;s Xenocara</a></li>
<li><a href="https://www.talosintelligence.com/careers/freebsd_engineer" rel="nofollow">Talos is looking for a FreeBSD Engineer</a></li>
<li><a href="https://github.com/dylanaraps/pure-sh-bible" rel="nofollow">GitHub - dylanaraps/pure-sh-bible: A collection of pure POSIX sh alternatives to external processes.</a></li>
<li><a href="https://www.dragonflydigest.com/2019/09/23/23523.html" rel="nofollow">dsynth: you’re building it</a></li>
<li><a href="http://lists.sigcis.org/pipermail/members-sigcis.org/2019-September/001606.html" rel="nofollow">Percy Ludgate, the missing link between Babbage’s machine and everything else</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Bruce - <a href="http://dpaste.com/147HGP3#wrap" rel="nofollow">Down the expect rabbithole</a></li>
<li>Bruce - <a href="http://dpaste.com/37MNVSW#wrap" rel="nofollow">Expect (update)</a></li>
<li>David - <a href="http://dpaste.com/2SE1YSE" rel="nofollow">Netgraph answer</a></li>
<li>Mason - <a href="http://dpaste.com/00KKXJM" rel="nofollow">Beeps?</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0318.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>317: Bots Building Jails</title>
  <link>https://www.bsdnow.tv/317</link>
  <guid isPermaLink="false">e26d9711-a9ef-433e-bf8e-90d57030f3e7</guid>
  <pubDate>Thu, 26 Sep 2019 02:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e26d9711-a9ef-433e-bf8e-90d57030f3e7.mp3" length="37879559" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Setting up buildbot in FreeBSD jails, Set up a mail server with OpenSMTPD, Dovecot and Rspamd, OpenBSD amateur packet radio with HamBSD, DragonFlyBSD's HAMMER2 gets fsck, return of startx for users.</itunes:subtitle>
  <itunes:duration>52:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Setting up buildbot in FreeBSD jails, Set up a mail server with OpenSMTPD, Dovecot and Rspamd, OpenBSD amateur packet radio with HamBSD, DragonFlyBSD's HAMMER2 gets fsck, return of startx for users.
Headlines
EuroBSDcon 2019 Recap (https://2019.eurobsdcon.org/)
We’re back from EuroBSDcon in Lillehammer, Norway. It was a great conference with 212 people attending. 2 days of tutorials (https://2019.eurobsdcon.org/tutorial-speakers/), parallel to the FreeBSD Devsummit (https://wiki.freebsd.org/DevSummit/201909), followed by two days of talks (https://2019.eurobsdcon.org/program/). Some speakers uploaded their slides to papers.freebsd.org (https://papers.freebsd.org/2019/eurobsdcon/) already with more to come.
The social event was also interesting. We visited an open air museum with building preserved from different time periods. In the older section they had a collection of farm buildings, a church originally built in the 1200s and relocated to the museum, and a school house. In the more modern area, they had houses from 1915, and each decade from 1930 to 1990, plus a “house of the future” as imagined in 2001. Many had open doors to allow you to tour the inside, and some were even “inhabited”. The latter fact gave a much more interactive experience and we could learn additional things about the history of that particular house. The town at the end included a general store, a post office, and more. Then, we all had a nice dinner together in the museum’s restaurant.
The opening keynote by Patricia Aas was very good. Her talk on embedded ethics, from her perspective as someone trying to defend the sanctity of Norwegian elections, and a former developer for the Opera web browser, provided a great deal of insight into the issues. Her points about how the tech community has unleashed a very complex digital work upon people with barely any technical literacy were well taken. Her stories of trying to explain the problems with involving computers in the election process to journalists and politicians struck a chord with many of us, who have had to deal with legislation written by those who do not truly understand the issues with technology.
Setting up buildbot in FreeBSD jails (https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails)
In this article, I would like to present a tutorial to set up buildbot, a continuous integration (CI) software (like Jenkins, drone, etc.), making use of FreeBSD’s containerization mechanism "jails". We will cover terminology, rationale for using both buildbot and jails together, and installation steps. At the end, you will have a working buildbot instance using its sample build configuration, ready to play around with your own CI plans (or even CD, it’s very flexible!). Some hints for production-grade installations are given, but the tutorial steps are meant for a test environment (namely a virtual machine). Buildbot’s configuration and detailed concepts are not in scope here.
Setting up a mail server with OpenSMTPD, Dovecot and Rspamd (https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/)
Self-hosting and encouraging smaller providers is for the greater good
First of all, I was not clear enough about the political consequences of centralizing mail services at Big Mailer Corps.
It doesn’t make sense for Random Joe, sharing kitten pictures with his family and friends, to build a personal mail infrastructure when multiple Big Mailer Corps offer “for free” an amazing quality of service. They provide him with an e-mail address that is immediately available and which will generally work reliably. It really doesn’t make sense for Random Joe not to go there, and particularly if even techies go there without hesitation, proving it is a sound choice.
There is nothing wrong with Random Joes using a service that works.
What is terribly wrong though is the centralization of a communication protocol in the hands of a few commercial companies, EVERY SINGLE ONE OF THEM coming from the same country (currently led by a lunatic who abuses power and probably suffers from NPD), EVERY SINGLE ONE OF THEM having been in the news and/or in a court for random/assorted “unpleasant” behaviors (privacy abuses, eavesdropping, monopoly abuse, sexual or professional harassment, you just name it…), and EVERY SINGLE ONE OF THEM growing user bases that far exceeds the total population of multiple countries combined.
News Roundup
The HamBSD project aims to bring amateur packet radio to OpenBSD (https://hambsd.org/)
The HamBSD project aims to bring amateur packet radio to OpenBSD, including support for TCP/IP over AX.25 and APRS tracking/digipeating in the base system.
HamBSD will not provide a full AX.25 stack but instead only implement support for UI frames. There will be a focus on simplicity, security and readable code.
The amateur radio community needs a reliable platform for packet radio for use in both leisure and emergency scenarios. It should be expected that the system is stable and resilient (but as yet it is neither).
DragonFlyBSD's HAMMER2 Gets Basic FSCK Support (https://www.dragonflydigest.com/2019/09/24/23540.html)
HAMMER2 is Copy on Write, meaning changes are made to copies of existing data.  This means operations are generally atomic and can survive a power outage, etc.  (You should read up on it!)  However, there’s now a fsck command, useful if you want a report of data validity rather than any manual repair process.
commit (https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/5554cc8b81fbfcfd347f50be3f3b1b9a54b871b)
Add initial fsck support for HAMMER2, although CoW fs doesn't require fsck as a concept. Currently no repairing (no write), just verifying. 
Keep this as a separate command for now.
https://i.redd.it/vkdss0mtdpo31.jpg
The return of startx for users (http://undeadly.org/cgi?action=article;sid=20190917091236)
Add modesetting driver as a fall-back when appropriate such that we can use it when running without root privileges which prevents us from scanning the PCI bus.
This makes startx(1)/xinit(1) work again on modern systems with inteldrm(4), radeondrm(4) and amdgpu(4).  In some cases this will result in using a different driver than with xenodm(4) which may expose issues (e.g. when we prefer the intel Xorg driver) or loss of acceleration (e.g. older cards supported by radeondrm(4)).
Beastie Bits
Ori Bernstein will be giving the October talk at NYCBUG (http://lists.nycbug.org:8080/pipermail/talk/2019-September/018046.html)
BSD Pizza Night: 2019/09/26, 7–9PM, Portland, Oregon, USA (http://calagator.org/events/1250476200)
Nick Wolff : Home Lab Show &amp;amp; Tell (http://knoxbug.org/2019-09-30)
Installing the Lumina Desktop in DragonflyBSD (https://www.youtube.com/watch?v=eWkCjj4_xsk)
dhcpcd 8.0.6 added (https://www.dragonflydigest.com/2019/09/20/23519.html)
Feedback/Questions
Bruce - FOSDEM videos (http://dpaste.com/15ABRRB#wrap)
Lars - Super Cluster of BSD on Rock64Pr (http://dpaste.com/1X9FEJJ)
Madhukar - Question (http://dpaste.com/0TWF1NB#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, buildbot, jails, opensmtp, dovecot, rspamd, mail, mailserver, amateur radio, amateur packet radio, packet radio, hammer2, filesystem, fsck, file system check, startx</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Setting up buildbot in FreeBSD jails, Set up a mail server with OpenSMTPD, Dovecot and Rspamd, OpenBSD amateur packet radio with HamBSD, DragonFlyBSD&#39;s HAMMER2 gets fsck, return of startx for users.</p>

<h2>Headlines</h2>

<h3><a href="https://2019.eurobsdcon.org/" rel="nofollow">EuroBSDcon 2019 Recap</a></h3>

<blockquote>
<p>We’re back from EuroBSDcon in Lillehammer, Norway. It was a great conference with 212 people attending. 2 days of <a href="https://2019.eurobsdcon.org/tutorial-speakers/" rel="nofollow">tutorials</a>, parallel to the <a href="https://wiki.freebsd.org/DevSummit/201909" rel="nofollow">FreeBSD Devsummit</a>, followed by two days of <a href="https://2019.eurobsdcon.org/program/" rel="nofollow">talks</a>. Some speakers uploaded their slides to <a href="https://papers.freebsd.org/2019/eurobsdcon/" rel="nofollow">papers.freebsd.org</a> already with more to come.</p>

<p>The social event was also interesting. We visited an open air museum with building preserved from different time periods. In the older section they had a collection of farm buildings, a church originally built in the 1200s and relocated to the museum, and a school house. In the more modern area, they had houses from 1915, and each decade from 1930 to 1990, plus a “house of the future” as imagined in 2001. Many had open doors to allow you to tour the inside, and some were even “inhabited”. The latter fact gave a much more interactive experience and we could learn additional things about the history of that particular house. The town at the end included a general store, a post office, and more. Then, we all had a nice dinner together in the museum’s restaurant.</p>
</blockquote>

<ul>
<li>The opening keynote by Patricia Aas was very good. Her talk on embedded ethics, from her perspective as someone trying to defend the sanctity of Norwegian elections, and a former developer for the Opera web browser, provided a great deal of insight into the issues. Her points about how the tech community has unleashed a very complex digital work upon people with barely any technical literacy were well taken. Her stories of trying to explain the problems with involving computers in the election process to journalists and politicians struck a chord with many of us, who have had to deal with legislation written by those who do not truly understand the issues with technology.</li>
</ul>

<hr>

<h3><a href="https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails" rel="nofollow">Setting up buildbot in FreeBSD jails</a></h3>

<blockquote>
<p>In this article, I would like to present a tutorial to set up buildbot, a continuous integration (CI) software (like Jenkins, drone, etc.), making use of FreeBSD’s containerization mechanism &quot;jails&quot;. We will cover terminology, rationale for using both buildbot and jails together, and installation steps. At the end, you will have a working buildbot instance using its sample build configuration, ready to play around with your own CI plans (or even CD, it’s very flexible!). Some hints for production-grade installations are given, but the tutorial steps are meant for a test environment (namely a virtual machine). Buildbot’s configuration and detailed concepts are not in scope here.</p>
</blockquote>

<hr>

<h3><a href="https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/" rel="nofollow">Setting up a mail server with OpenSMTPD, Dovecot and Rspamd</a></h3>

<ul>
<li>Self-hosting and encouraging smaller providers is for the greater good</li>
</ul>

<blockquote>
<p>First of all, I was not clear enough about the political consequences of centralizing mail services at Big Mailer Corps.</p>

<p>It doesn’t make sense for Random Joe, sharing kitten pictures with his family and friends, to build a personal mail infrastructure when multiple Big Mailer Corps offer “for free” an amazing quality of service. They provide him with an e-mail address that is immediately available and which will generally work reliably. It really doesn’t make sense for Random Joe not to go there, and particularly if even techies go there without hesitation, proving it is a sound choice.</p>

<p>There is nothing wrong with Random Joes using a service that works.</p>

<p>What is terribly wrong though is the centralization of a communication protocol in the hands of a few commercial companies, EVERY SINGLE ONE OF THEM coming from the same country (currently led by a lunatic who abuses power and probably suffers from NPD), EVERY SINGLE ONE OF THEM having been in the news and/or in a court for random/assorted “unpleasant” behaviors (privacy abuses, eavesdropping, monopoly abuse, sexual or professional harassment, you just name it…), and EVERY SINGLE ONE OF THEM growing user bases that far exceeds the total population of multiple countries combined.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://hambsd.org/" rel="nofollow">The HamBSD project aims to bring amateur packet radio to OpenBSD</a></h3>

<blockquote>
<p>The HamBSD project aims to bring amateur packet radio to OpenBSD, including support for TCP/IP over AX.25 and APRS tracking/digipeating in the base system.</p>

<p>HamBSD will not provide a full AX.25 stack but instead only implement support for UI frames. There will be a focus on simplicity, security and readable code.</p>

<p>The amateur radio community needs a reliable platform for packet radio for use in both leisure and emergency scenarios. It should be expected that the system is stable and resilient (but as yet it is neither).</p>
</blockquote>

<hr>

<h3><a href="https://www.dragonflydigest.com/2019/09/24/23540.html" rel="nofollow">DragonFlyBSD&#39;s HAMMER2 Gets Basic FSCK Support</a></h3>

<blockquote>
<p>HAMMER2 is Copy on Write, meaning changes are made to copies of existing data.  This means operations are generally atomic and can survive a power outage, etc.  (You should read up on it!)  However, there’s now a fsck command, useful if you want a report of data validity rather than any manual repair process.</p>
</blockquote>

<ul>
<li><a href="https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/5554cc8b81fbfcfd347f50be3f3b1b9a54b871b" rel="nofollow">commit</a></li>
</ul>

<blockquote>
<p>Add initial fsck support for HAMMER2, although CoW fs doesn&#39;t require fsck as a concept. Currently no repairing (no write), just verifying. </p>

<p>Keep this as a separate command for now.<br>
<a href="https://i.redd.it/vkdss0mtdpo31.jpg" rel="nofollow">https://i.redd.it/vkdss0mtdpo31.jpg</a></p>

<hr>
</blockquote>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20190917091236" rel="nofollow">The return of startx for users</a></h3>

<blockquote>
<p>Add modesetting driver as a fall-back when appropriate such that we can use it when running without root privileges which prevents us from scanning the PCI bus.</p>

<p>This makes startx(1)/xinit(1) work again on modern systems with inteldrm(4), radeondrm(4) and amdgpu(4).  In some cases this will result in using a different driver than with xenodm(4) which may expose issues (e.g. when we prefer the intel Xorg driver) or loss of acceleration (e.g. older cards supported by radeondrm(4)).</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.nycbug.org:8080/pipermail/talk/2019-September/018046.html" rel="nofollow">Ori Bernstein will be giving the October talk at NYCBUG</a></li>
<li><a href="http://calagator.org/events/1250476200" rel="nofollow">BSD Pizza Night: 2019/09/26, 7–9PM, Portland, Oregon, USA</a></li>
<li><a href="http://knoxbug.org/2019-09-30" rel="nofollow">Nick Wolff : Home Lab Show &amp; Tell</a></li>
<li><a href="https://www.youtube.com/watch?v=eWkCjj4_xsk" rel="nofollow">Installing the Lumina Desktop in DragonflyBSD</a></li>
<li><a href="https://www.dragonflydigest.com/2019/09/20/23519.html" rel="nofollow">dhcpcd 8.0.6 added</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Bruce - <a href="http://dpaste.com/15ABRRB#wrap" rel="nofollow">FOSDEM videos</a></li>
<li>Lars - <a href="http://dpaste.com/1X9FEJJ" rel="nofollow">Super Cluster of BSD on Rock64Pr</a></li>
<li>Madhukar - <a href="http://dpaste.com/0TWF1NB#wrap" rel="nofollow">Question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0317.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Setting up buildbot in FreeBSD jails, Set up a mail server with OpenSMTPD, Dovecot and Rspamd, OpenBSD amateur packet radio with HamBSD, DragonFlyBSD&#39;s HAMMER2 gets fsck, return of startx for users.</p>

<h2>Headlines</h2>

<h3><a href="https://2019.eurobsdcon.org/" rel="nofollow">EuroBSDcon 2019 Recap</a></h3>

<blockquote>
<p>We’re back from EuroBSDcon in Lillehammer, Norway. It was a great conference with 212 people attending. 2 days of <a href="https://2019.eurobsdcon.org/tutorial-speakers/" rel="nofollow">tutorials</a>, parallel to the <a href="https://wiki.freebsd.org/DevSummit/201909" rel="nofollow">FreeBSD Devsummit</a>, followed by two days of <a href="https://2019.eurobsdcon.org/program/" rel="nofollow">talks</a>. Some speakers uploaded their slides to <a href="https://papers.freebsd.org/2019/eurobsdcon/" rel="nofollow">papers.freebsd.org</a> already with more to come.</p>

<p>The social event was also interesting. We visited an open air museum with building preserved from different time periods. In the older section they had a collection of farm buildings, a church originally built in the 1200s and relocated to the museum, and a school house. In the more modern area, they had houses from 1915, and each decade from 1930 to 1990, plus a “house of the future” as imagined in 2001. Many had open doors to allow you to tour the inside, and some were even “inhabited”. The latter fact gave a much more interactive experience and we could learn additional things about the history of that particular house. The town at the end included a general store, a post office, and more. Then, we all had a nice dinner together in the museum’s restaurant.</p>
</blockquote>

<ul>
<li>The opening keynote by Patricia Aas was very good. Her talk on embedded ethics, from her perspective as someone trying to defend the sanctity of Norwegian elections, and a former developer for the Opera web browser, provided a great deal of insight into the issues. Her points about how the tech community has unleashed a very complex digital work upon people with barely any technical literacy were well taken. Her stories of trying to explain the problems with involving computers in the election process to journalists and politicians struck a chord with many of us, who have had to deal with legislation written by those who do not truly understand the issues with technology.</li>
</ul>

<hr>

<h3><a href="https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails" rel="nofollow">Setting up buildbot in FreeBSD jails</a></h3>

<blockquote>
<p>In this article, I would like to present a tutorial to set up buildbot, a continuous integration (CI) software (like Jenkins, drone, etc.), making use of FreeBSD’s containerization mechanism &quot;jails&quot;. We will cover terminology, rationale for using both buildbot and jails together, and installation steps. At the end, you will have a working buildbot instance using its sample build configuration, ready to play around with your own CI plans (or even CD, it’s very flexible!). Some hints for production-grade installations are given, but the tutorial steps are meant for a test environment (namely a virtual machine). Buildbot’s configuration and detailed concepts are not in scope here.</p>
</blockquote>

<hr>

<h3><a href="https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/" rel="nofollow">Setting up a mail server with OpenSMTPD, Dovecot and Rspamd</a></h3>

<ul>
<li>Self-hosting and encouraging smaller providers is for the greater good</li>
</ul>

<blockquote>
<p>First of all, I was not clear enough about the political consequences of centralizing mail services at Big Mailer Corps.</p>

<p>It doesn’t make sense for Random Joe, sharing kitten pictures with his family and friends, to build a personal mail infrastructure when multiple Big Mailer Corps offer “for free” an amazing quality of service. They provide him with an e-mail address that is immediately available and which will generally work reliably. It really doesn’t make sense for Random Joe not to go there, and particularly if even techies go there without hesitation, proving it is a sound choice.</p>

<p>There is nothing wrong with Random Joes using a service that works.</p>

<p>What is terribly wrong though is the centralization of a communication protocol in the hands of a few commercial companies, EVERY SINGLE ONE OF THEM coming from the same country (currently led by a lunatic who abuses power and probably suffers from NPD), EVERY SINGLE ONE OF THEM having been in the news and/or in a court for random/assorted “unpleasant” behaviors (privacy abuses, eavesdropping, monopoly abuse, sexual or professional harassment, you just name it…), and EVERY SINGLE ONE OF THEM growing user bases that far exceeds the total population of multiple countries combined.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://hambsd.org/" rel="nofollow">The HamBSD project aims to bring amateur packet radio to OpenBSD</a></h3>

<blockquote>
<p>The HamBSD project aims to bring amateur packet radio to OpenBSD, including support for TCP/IP over AX.25 and APRS tracking/digipeating in the base system.</p>

<p>HamBSD will not provide a full AX.25 stack but instead only implement support for UI frames. There will be a focus on simplicity, security and readable code.</p>

<p>The amateur radio community needs a reliable platform for packet radio for use in both leisure and emergency scenarios. It should be expected that the system is stable and resilient (but as yet it is neither).</p>
</blockquote>

<hr>

<h3><a href="https://www.dragonflydigest.com/2019/09/24/23540.html" rel="nofollow">DragonFlyBSD&#39;s HAMMER2 Gets Basic FSCK Support</a></h3>

<blockquote>
<p>HAMMER2 is Copy on Write, meaning changes are made to copies of existing data.  This means operations are generally atomic and can survive a power outage, etc.  (You should read up on it!)  However, there’s now a fsck command, useful if you want a report of data validity rather than any manual repair process.</p>
</blockquote>

<ul>
<li><a href="https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/5554cc8b81fbfcfd347f50be3f3b1b9a54b871b" rel="nofollow">commit</a></li>
</ul>

<blockquote>
<p>Add initial fsck support for HAMMER2, although CoW fs doesn&#39;t require fsck as a concept. Currently no repairing (no write), just verifying. </p>

<p>Keep this as a separate command for now.<br>
<a href="https://i.redd.it/vkdss0mtdpo31.jpg" rel="nofollow">https://i.redd.it/vkdss0mtdpo31.jpg</a></p>

<hr>
</blockquote>

<h3><a href="http://undeadly.org/cgi?action=article;sid=20190917091236" rel="nofollow">The return of startx for users</a></h3>

<blockquote>
<p>Add modesetting driver as a fall-back when appropriate such that we can use it when running without root privileges which prevents us from scanning the PCI bus.</p>

<p>This makes startx(1)/xinit(1) work again on modern systems with inteldrm(4), radeondrm(4) and amdgpu(4).  In some cases this will result in using a different driver than with xenodm(4) which may expose issues (e.g. when we prefer the intel Xorg driver) or loss of acceleration (e.g. older cards supported by radeondrm(4)).</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.nycbug.org:8080/pipermail/talk/2019-September/018046.html" rel="nofollow">Ori Bernstein will be giving the October talk at NYCBUG</a></li>
<li><a href="http://calagator.org/events/1250476200" rel="nofollow">BSD Pizza Night: 2019/09/26, 7–9PM, Portland, Oregon, USA</a></li>
<li><a href="http://knoxbug.org/2019-09-30" rel="nofollow">Nick Wolff : Home Lab Show &amp; Tell</a></li>
<li><a href="https://www.youtube.com/watch?v=eWkCjj4_xsk" rel="nofollow">Installing the Lumina Desktop in DragonflyBSD</a></li>
<li><a href="https://www.dragonflydigest.com/2019/09/20/23519.html" rel="nofollow">dhcpcd 8.0.6 added</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Bruce - <a href="http://dpaste.com/15ABRRB#wrap" rel="nofollow">FOSDEM videos</a></li>
<li>Lars - <a href="http://dpaste.com/1X9FEJJ" rel="nofollow">Super Cluster of BSD on Rock64Pr</a></li>
<li>Madhukar - <a href="http://dpaste.com/0TWF1NB#wrap" rel="nofollow">Question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0317.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>316: git commit FreeBSD</title>
  <link>https://www.bsdnow.tv/316</link>
  <guid isPermaLink="false">c6ea44fd-cbae-453a-bd88-a35b2b662859</guid>
  <pubDate>Wed, 18 Sep 2019 23:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c6ea44fd-cbae-453a-bd88-a35b2b662859.mp3" length="46851680" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>NetBSD LLVM sanitizers and GDB regression test suite, Ada—The Language of Cost Savings, Homura - a Windows Games Launcher for FreeBSD, FreeBSD core team appoints a WG to explore transition to Git, OpenBSD 6.6 Beta tagged, Project Trident 12-U5 update now available, and more.</itunes:subtitle>
  <itunes:duration>1:05:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>NetBSD LLVM sanitizers and GDB regression test suite, Ada—The Language of Cost Savings, Homura - a Windows Games Launcher for FreeBSD, FreeBSD core team appoints a WG to explore transition to Git, OpenBSD 6.6 Beta tagged, Project Trident 12-U5 update now available, and more.
Headlines
LLVM santizers and GDB regression test suite. (http://blog.netbsd.org/tnf/entry/llvm_santizers_and_gdb_regression)
As NetBSD-9 is branched, I have been asked to finish the LLVM sanitizer integration. This work is now accomplished and with MKLLVM=yes build option (by default off), the distribution will be populated with LLVM files for ASan, TSan, MSan, UBSan, libFuzzer, SafeStack and XRay.
I have also transplanted basesystem GDB patched to my GDB repository and managed to run the GDB regression test-suite.
NetBSD distribution changes
I have enhanced and imported my local MKSANITIZER code that makes whole distribution sanitization possible. Few real bugs were fixed and a number of patches were newly written to reflect the current NetBSD sources state. I have also merged another chunk of the fruits of the GSoC-2018 project with fuzzing the userland (by plusun@).
The following changes were committed to the sources:
ab7de18d0283 Cherry-pick upstream compiler-rt patches for LLVM sanitizers
966c62a34e30 Add LLVM sanitizers in the MKLLVM=yes build
8367b667adb9 telnetd: Stop defining the same variables concurrently in bss and data
fe72740f64bf fsck: Stop defining the same variable concurrently in bss and data
40e89e890d66 Fix build of tubsan/tubsanxx under MKSANITIZER
b71326fd7b67 Avoid symbol clashes in tests/usr.bin/id under MKSANITIZER
c581f2e39fa5 Avoid symbol clashes in fs/nfs/nfsservice under MKSANITIZER
030a4686a3c6 Avoid symbol clashes in bin/df under MKSANITIZER
fd9679f6e8b1 Avoid symbol clashes in usr.sbin/ypserv/ypserv under MKSANITIZER
5df2d7939ce3 Stop defining _rpcsvcdirty in bss and data
5fafbe8b8f64 Add missing extern declaration of ibmachemips in installboot
d134584be69a Add SANITIZERRENAMECLASSES in bsd.prog.mk
2d00d9b08eae Adapt tests/kernel/tsubrprf for MKSANITIZER
ce54363fe452 Ship with sanitizer/lsan_interface.h for GCC 7
7bd5ee95e9a0 Ship with sanitizer/lsan_interface.h for LLVM 7
d8671fba7a78 Set NODEBUG for LLVM sanitizers
242cd44890a2 Add PAXCTL_FLAG rules for MKSANITIZER
5e80ab99d9ce Avoid symbol clashes in test/rump/modautoload/t_modautoload with sanitizers
e7ce7ecd9c2a sysctl: Add indirection of symbols to remove clash with sanitizers
231aea846aba traceroute: Add indirection of symbol to remove clash with sanitizers
8d85053f487c sockstat: Add indirection of symbols to remove clash with sanitizers
81b333ab151a netstat: Add indirection of symbols to remove clash with sanitizers
a472baefefe8 Correct the memset(3)'s third argument in i386 biosdisk.c
7e4e92115bc3 Add ATF c and c++ tests for TSan, MSan, libFuzzer
921ddc9bc97c Set NOSANITIZER in i386 ramdisk image
64361771c78d Enhance MKSANITIZER support
3b5608f80a2b Define targetnotsupported_body() in TSan, MSan and libFuzzer tests
c27f4619d513 Avoids signedness bit shift in dbgetvalue()
680c5b3cc24f Fix LLVM sanitizer build by GCC (HAVE_LLVM=no)
4ecfbbba2f2a Rework the LLVM compiler_rt build rules
748813da5547 Correct the build rules of LLVM sanitizers
20e223156dee Enhance the support of LLVM sanitizers
0bb38eb2f20d Register syms.extra in LLVM sanitizer .syms files
Almost all of the mentioned commits were backported to NetBSD-9 and will land 9.0.
Homura - a Windows Games Launcher for FreeBSD (https://github.com/Alexander88207/Homura)
Inspired by lutris (a Linux gaming platform), we would like to provide a game launcher to play windows games on FreeBSD.
Makes it easier to run games on FreeBSD, by providing the tweaks and dependencies for you
Dependencies
curl
bash
p7zip
zenity
webfonts
alsa-utils (Optional)
winetricks
vulkan-tools
mesa-demos
i386-wine-devel on amd64 or wine-devel on i386
News Roundup
Ada—The Language of Cost Savings? (https://www.electronicdesign.com/embedded-revolution/ada-language-cost-savings)
Many myths surround the Ada programming language, but it continues to be used and evolve at the same time. And while the increased adoption of Ada and SPARK, its provable subset, is slow, it’s noticeable. Ada already addresses more of the features found in found in heavily used embedded languages like C+ and C#. It also tackles problems addressed by upcoming languages like Rust.
Chris concludes, “Development technologies have a profound impact on one of the largest and most variable costs associated with embedded-system engineering—labor. At a time when on-time system deployment can not only impact customer satisfaction, but access to services revenue streams, engineering team efficiency is at a premium. Our research showed that programming language choices can have significant influence in this area, leading to shorter projects, better schedules and, ultimately, lower development costs. While a variety of factors can influence and dictate language choice, our research showed that Ada’s evolution has made it an increasingly compelling option for engineering organizations, providing both technically and financially sound solution.”
In general, Ada already makes embedded “programming in the large” much easier by handling issues that aren’t even addressed in other languages. Though these features are often provided by third-party software, it results in inconsistent practices among developers. Ada also supports the gamut of embedded platforms from systems like Arm’s Cortex-M through supercomputers. Learning Ada isn’t as hard as one might think and the benefits can be significant.
FreeBSD core team appoints a WG to explore transitioning from Subversion to Git. (https://www.freebsd.org/news/status/report-2019-04-2019-06.html#FreeBSD-Core-Team)
The FreeBSD Core Team is the governing body of FreeBSD.
Core approved source commit bits for Doug Moore (dougm), Chuck Silvers (chs), Brandon Bergren (bdragon), and a vendor commit bit for Scott Phillips (scottph).
The annual developer survey closed on 2019-04-02. Of the 397 developers, 243 took the survey with an average completion time of 12 minutes. The public survey closed on 2019-05-13. It was taken by 3637 users and had a 79% completion rate. A presentation of the survey results took place at BSDCan 2019.
The core team voted to appoint a working group to explore transitioning our source code 'source of truth' from Subversion to Git. Core asked Ed Maste to chair the group as Ed has been researching this topic for some time. For example, Ed gave a MeetBSD 2018 talk on the topic.
There is a variety of viewpoints within core regarding where and how to host a Git repository, however core feels that Git is the prudent path forward.
OpenBSD 6.6 Beta tagged (https://undeadly.org/cgi?action=article;sid=20190810123243)
```
CVSROOT:    /cvs
Module name:    src
Changes by:    deraadt@cvs.openbsd.org    2019/08/09 21:56:02
Modified files:
    etc/root : root.mail
    share/mk : sys.mk
    sys/arch/macppc/stand/tbxidata: bsd.tbxi
    sys/conf : newvers.sh
    sys/sys : param.h
    usr.bin/signify: signify.1
Log message:
move to 6.6-beta
```
Preliminary release notes (https://www.openbsd.org/66.html)
Improved hardware support, including:
clang(1) is now provided on powerpc.
IEEE 802.11 wireless stack improvements:
Generic network stack improvements:
Installer improvements:
Security improvements:
  + Routing daemons and other userland network improvements
  + The ntpd(8) daemon now gets and sets the clock in a secure way when booting even when a battery-backed clock is absent.
  + bgdp(8) improvements
  + Assorted improvements:
  + The filesystem buffer cache now more aggressively uses memory outside the DMA region, to improve cache performance on amd64 machines.
The BER API previously internal to ldap(1), ldapd(8), ypldap(8), and snmpd(8) has been moved into libutil. See berreadelements(3).
Support for specifying boot device in vm.conf(5).
OpenSMTPD 6.6.0
LibreSSL 3.0.X
API and Documentation Enhancements
Completed the port of RSA_METHOD accessors from the OpenSSL 1.1 API.
Documented undescribed options and removed unfunctional options description in openssl(1) manual.
OpenSSH 8.0
Project Trident 12-U5 update now available (https://project-trident.org/post/2019-09-04_stable12-u5_available/)
This is the fifth general package update to the STABLE release repository based upon TrueOS 12-Stable.
Package changes from Stable 12-U4
Package Summary
New Packages: 20
Deleted Packages: 24
Updated Packages: 279
New Packages (20)
artemis (biology/artemis) : 17.0.1.11
catesc (games/catesc) : 0.6
dmlc-core (devel/dmlc-core) : 0.3.105
go-wtf (sysutils/go-wtf) : 0.20.0_1
instead (games/instead) : 3.3.0_1
lidarr (net-p2p/lidarr) : 0.6.2.883
minerbold (games/minerbold) : 1.4
onnx (math/onnx) : 1.5.0
openzwave-devel (comms/openzwave-devel) : 1.6.897
polkit-qt-1 (sysutils/polkit-qt) : 0.113.0_8
py36-traitsui (graphics/py-traitsui) : 6.1.2
rubygem-aws-sigv2 (devel/rubygem-aws-sigv2) : 1.0.1
rubygem-defaultvaluefor32 (devel/rubygem-defaultvaluefor32) : 3.2.0
rubygem-ffi110 (devel/rubygem-ffi110) : 1.10.0
rubygem-zeitwerk (devel/rubygem-zeitwerk) : 2.1.9
sems (net/sems) : 1.7.0.g20190822
skypat (devel/skypat) : 3.1.1
tvm (math/tvm) : 0.4.1440
vavoom (games/vavoom) : 1.33_15
vavoom-extras (games/vavoom-extras) : 1.30_4
Deleted Packages (24)
geeqie (graphics/geeqie) : Unknown reason
iriverter (multimedia/iriverter) : Unknown reason
kde5 (x11/kde5) : Unknown reason
kicad-doc (cad/kicad-doc) : Unknown reason
os-nozfs-buildworld (os/buildworld) : Unknown reason
os-nozfs-userland (os/userland) : Unknown reason
os-nozfs-userland-base (os/userland-base) : Unknown reason
os-nozfs-userland-base-bootstrap (os/userland-base-bootstrap) : Unknown reason
os-nozfs-userland-bin (os/userland-bin) : Unknown reason
os-nozfs-userland-boot (os/userland-boot) : Unknown reason
os-nozfs-userland-conf (os/userland-conf) : Unknown reason
os-nozfs-userland-debug (os/userland-debug) : Unknown reason
os-nozfs-userland-devtools (os/userland-devtools) : Unknown reason
os-nozfs-userland-docs (os/userland-docs) : Unknown reason
os-nozfs-userland-lib (os/userland-lib) : Unknown reason
os-nozfs-userland-lib32 (os/userland-lib32) : Unknown reason
os-nozfs-userland-lib32-development (os/userland-lib32-development) : Unknown reason
os-nozfs-userland-rescue (os/userland-rescue) : Unknown reason
os-nozfs-userland-sbin (os/userland-sbin) : Unknown reason
os-nozfs-userland-tests (os/userland-tests) : Unknown reason
photoprint (print/photoprint) : Unknown reason
plasma5-plasma (x11/plasma5-plasma) : Unknown reason
polkit-qt5 (sysutils/polkit-qt) : Unknown reason
secpanel (security/secpanel) : Unknown reason
Beastie Bits
DragonFlyBSD - msdosfs updates (https://www.dragonflydigest.com/2019/09/10/23472.html)
Stand out as a speaker (https://science.sciencemag.org/content/365/6455/834.full)
Not a review of the 7th Gen X1 Carbon (http://akpoff.com/archive/2019/not_a_review_of_the_lenovo_x1c7.html)
FreeBSD Meets Linux At The Open Source Summit (https://www.tfir.io/2019/08/24/freebsd-meets-linux-at-the-open-source-summit/)
QEMU VM Escape (https://blog.bi0s.in/2019/08/24/Pwn/VM-Escape/2019-07-29-qemu-vm-escape-cve-2019-14378/)
Porting wine to amd64 on NetBSD, third evaluation report. (http://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on1)
OpenBSD disabled DoH by default in Firefox (https://undeadly.org/cgi?action=article;sid=20190911113856)
Feedback/Questions
Reinis - GELI with UEFI (http://dpaste.com/0SG8630#wrap)
Mason - Beeping (http://dpaste.com/1FQN173)
[CHVT feedback]
DJ - Feedback (http://dpaste.com/08M3XNH#wrap)
Ben - chvt (http://dpaste.com/274RVCE#wrap)
Harri - Marc's chvt question (http://dpaste.com/23R1YMK#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, gdb, regression test, llvm, llvm sanitizers, sanitizers, ada, cost savings, homura, windows game, game launcher, core team, git, git transition</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>NetBSD LLVM sanitizers and GDB regression test suite, Ada—The Language of Cost Savings, Homura - a Windows Games Launcher for FreeBSD, FreeBSD core team appoints a WG to explore transition to Git, OpenBSD 6.6 Beta tagged, Project Trident 12-U5 update now available, and more.</p>

<h2>Headlines</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/llvm_santizers_and_gdb_regression" rel="nofollow">LLVM santizers and GDB regression test suite.</a></h3>

<blockquote>
<p>As NetBSD-9 is branched, I have been asked to finish the LLVM sanitizer integration. This work is now accomplished and with MKLLVM=yes build option (by default off), the distribution will be populated with LLVM files for ASan, TSan, MSan, UBSan, libFuzzer, SafeStack and XRay.</p>

<p>I have also transplanted basesystem GDB patched to my GDB repository and managed to run the GDB regression test-suite.</p>
</blockquote>

<ul>
<li>NetBSD distribution changes</li>
</ul>

<blockquote>
<p>I have enhanced and imported my local MKSANITIZER code that makes whole distribution sanitization possible. Few real bugs were fixed and a number of patches were newly written to reflect the current NetBSD sources state. I have also merged another chunk of the fruits of the GSoC-2018 project with fuzzing the userland (by plusun@).</p>
</blockquote>

<ul>
<li>The following changes were committed to the sources:

<ul>
<li>ab7de18d0283 Cherry-pick upstream compiler-rt patches for LLVM sanitizers</li>
<li>966c62a34e30 Add LLVM sanitizers in the MKLLVM=yes build</li>
<li>8367b667adb9 telnetd: Stop defining the same variables concurrently in bss and data</li>
<li>fe72740f64bf fsck: Stop defining the same variable concurrently in bss and data</li>
<li>40e89e890d66 Fix build of t_ubsan/t_ubsanxx under MKSANITIZER</li>
<li>b71326fd7b67 Avoid symbol clashes in tests/usr.bin/id under MKSANITIZER</li>
<li>c581f2e39fa5 Avoid symbol clashes in fs/nfs/nfsservice under MKSANITIZER</li>
<li>030a4686a3c6 Avoid symbol clashes in bin/df under MKSANITIZER</li>
<li>fd9679f6e8b1 Avoid symbol clashes in usr.sbin/ypserv/ypserv under MKSANITIZER</li>
<li>5df2d7939ce3 Stop defining _rpcsvcdirty in bss and data</li>
<li>5fafbe8b8f64 Add missing extern declaration of ib_mach_emips in installboot</li>
<li>d134584be69a Add SANITIZER_RENAME_CLASSES in bsd.prog.mk</li>
<li>2d00d9b08eae Adapt tests/kernel/t_subr_prf for MKSANITIZER</li>
<li>ce54363fe452 Ship with sanitizer/lsan_interface.h for GCC 7</li>
<li>7bd5ee95e9a0 Ship with sanitizer/lsan_interface.h for LLVM 7</li>
<li>d8671fba7a78 Set NODEBUG for LLVM sanitizers</li>
<li>242cd44890a2 Add PAXCTL_FLAG rules for MKSANITIZER</li>
<li>5e80ab99d9ce Avoid symbol clashes in test/rump/modautoload/t_modautoload with sanitizers</li>
<li>e7ce7ecd9c2a sysctl: Add indirection of symbols to remove clash with sanitizers</li>
<li>231aea846aba traceroute: Add indirection of symbol to remove clash with sanitizers</li>
<li>8d85053f487c sockstat: Add indirection of symbols to remove clash with sanitizers</li>
<li>81b333ab151a netstat: Add indirection of symbols to remove clash with sanitizers</li>
<li>a472baefefe8 Correct the memset(3)&#39;s third argument in i386 biosdisk.c</li>
<li>7e4e92115bc3 Add ATF c and c++ tests for TSan, MSan, libFuzzer</li>
<li>921ddc9bc97c Set NOSANITIZER in i386 ramdisk image</li>
<li>64361771c78d Enhance MKSANITIZER support</li>
<li>3b5608f80a2b Define target_not_supported_body() in TSan, MSan and libFuzzer tests</li>
<li>c27f4619d513 Avoids signedness bit shift in db_get_value()</li>
<li>680c5b3cc24f Fix LLVM sanitizer build by GCC (HAVE_LLVM=no)</li>
<li>4ecfbbba2f2a Rework the LLVM compiler_rt build rules</li>
<li>748813da5547 Correct the build rules of LLVM sanitizers</li>
<li>20e223156dee Enhance the support of LLVM sanitizers</li>
<li>0bb38eb2f20d Register syms.extra in LLVM sanitizer .syms files</li>
<li>Almost all of the mentioned commits were backported to NetBSD-9 and will land 9.0.</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://github.com/Alexander88207/Homura" rel="nofollow">Homura - a Windows Games Launcher for FreeBSD</a></h3>

<blockquote>
<p>Inspired by lutris (a Linux gaming platform), we would like to provide a game launcher to play windows games on FreeBSD.</p>
</blockquote>

<ul>
<li>Makes it easier to run games on FreeBSD, by providing the tweaks and dependencies for you</li>
<li>Dependencies

<ul>
<li>curl</li>
<li>bash</li>
<li>p7zip</li>
<li>zenity</li>
<li>webfonts</li>
<li>alsa-utils (Optional)</li>
<li>winetricks</li>
<li>vulkan-tools</li>
<li>mesa-demos</li>
<li>i386-wine-devel on amd64 or wine-devel on i386</li>
</ul></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.electronicdesign.com/embedded-revolution/ada-language-cost-savings" rel="nofollow">Ada—The Language of Cost Savings?</a></h3>

<blockquote>
<p>Many myths surround the Ada programming language, but it continues to be used and evolve at the same time. And while the increased adoption of Ada and SPARK, its provable subset, is slow, it’s noticeable. Ada already addresses more of the features found in found in heavily used embedded languages like C+ and C#. It also tackles problems addressed by upcoming languages like Rust.</p>

<p>Chris concludes, “Development technologies have a profound impact on one of the largest and most variable costs associated with embedded-system engineering—labor. At a time when on-time system deployment can not only impact customer satisfaction, but access to services revenue streams, engineering team efficiency is at a premium. Our research showed that programming language choices can have significant influence in this area, leading to shorter projects, better schedules and, ultimately, lower development costs. While a variety of factors can influence and dictate language choice, our research showed that Ada’s evolution has made it an increasingly compelling option for engineering organizations, providing both technically and financially sound solution.”</p>

<p>In general, Ada already makes embedded “programming in the large” much easier by handling issues that aren’t even addressed in other languages. Though these features are often provided by third-party software, it results in inconsistent practices among developers. Ada also supports the gamut of embedded platforms from systems like Arm’s Cortex-M through supercomputers. Learning Ada isn’t as hard as one might think and the benefits can be significant.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsd.org/news/status/report-2019-04-2019-06.html#FreeBSD-Core-Team" rel="nofollow">FreeBSD core team appoints a WG to explore transitioning from Subversion to Git.</a></h3>

<ul>
<li>The FreeBSD Core Team is the governing body of FreeBSD.</li>
</ul>

<blockquote>
<p>Core approved source commit bits for Doug Moore (dougm), Chuck Silvers (chs), Brandon Bergren (bdragon), and a vendor commit bit for Scott Phillips (scottph).</p>

<p>The annual developer survey closed on 2019-04-02. Of the 397 developers, 243 took the survey with an average completion time of 12 minutes. The public survey closed on 2019-05-13. It was taken by 3637 users and had a 79% completion rate. A presentation of the survey results took place at BSDCan 2019.</p>

<p>The core team voted to appoint a working group to explore transitioning our source code &#39;source of truth&#39; from Subversion to Git. Core asked Ed Maste to chair the group as Ed has been researching this topic for some time. For example, Ed gave a MeetBSD 2018 talk on the topic.</p>

<p>There is a variety of viewpoints within core regarding where and how to host a Git repository, however core feels that Git is the prudent path forward.</p>
</blockquote>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20190810123243" rel="nofollow">OpenBSD 6.6 Beta tagged</a></h3>

<pre><code>CVSROOT:    /cvs
Module name:    src
Changes by:    deraadt@cvs.openbsd.org    2019/08/09 21:56:02

Modified files:
    etc/root : root.mail
    share/mk : sys.mk
    sys/arch/macppc/stand/tbxidata: bsd.tbxi
    sys/conf : newvers.sh
    sys/sys : param.h
    usr.bin/signify: signify.1

Log message:
move to 6.6-beta
</code></pre>

<p><a href="https://www.openbsd.org/66.html" rel="nofollow">Preliminary release notes</a></p>

<p>Improved hardware support, including:</p>

<ul>
<li>clang(1) is now provided on powerpc.</li>
<li>IEEE 802.11 wireless stack improvements:</li>
<li>Generic network stack improvements:</li>
<li>Installer improvements:</li>
<li>Security improvements:</li>
<li>  + Routing daemons and other userland network improvements</li>
<li>  + The ntpd(8) daemon now gets and sets the clock in a secure way when booting even when a battery-backed clock is absent.</li>
<li>  + bgdp(8) improvements</li>
<li>  + Assorted improvements:</li>
<li>  + The filesystem buffer cache now more aggressively uses memory outside the DMA region, to improve cache performance on amd64 machines.</li>
<li>The BER API previously internal to ldap(1), ldapd(8), ypldap(8), and snmpd(8) has been moved into libutil. See ber_read_elements(3).</li>
<li>Support for specifying boot device in vm.conf(5).</li>
<li>OpenSMTPD 6.6.0</li>
<li>LibreSSL 3.0.X</li>
<li>API and Documentation Enhancements</li>
<li>Completed the port of RSA_METHOD accessors from the OpenSSL 1.1 API.</li>
<li>Documented undescribed options and removed unfunctional options description in openssl(1) manual.</li>
<li>OpenSSH 8.0</li>
</ul>

<hr>

<h3><a href="https://project-trident.org/post/2019-09-04_stable12-u5_available/" rel="nofollow">Project Trident 12-U5 update now available</a></h3>

<blockquote>
<p>This is the fifth general package update to the STABLE release repository based upon TrueOS 12-Stable.</p>
</blockquote>

<ul>
<li>Package changes from Stable 12-U4</li>
<li><p>Package Summary</p>

<ul>
<li>New Packages: 20</li>
<li>Deleted Packages: 24</li>
<li>Updated Packages: 279</li>
</ul></li>
<li><p>New Packages (20)</p>

<ul>
<li>artemis (biology/artemis) : 17.0.1.11</li>
<li>catesc (games/catesc) : 0.6</li>
<li>dmlc-core (devel/dmlc-core) : 0.3.105</li>
<li>go-wtf (sysutils/go-wtf) : 0.20.0_1</li>
<li>instead (games/instead) : 3.3.0_1</li>
<li>lidarr (net-p2p/lidarr) : 0.6.2.883</li>
<li>minerbold (games/minerbold) : 1.4</li>
<li>onnx (math/onnx) : 1.5.0</li>
<li>openzwave-devel (comms/openzwave-devel) : 1.6.897</li>
<li>polkit-qt-1 (sysutils/polkit-qt) : 0.113.0_8</li>
<li>py36-traitsui (graphics/py-traitsui) : 6.1.2</li>
<li>rubygem-aws-sigv2 (devel/rubygem-aws-sigv2) : 1.0.1</li>
<li>rubygem-default_value_for32 (devel/rubygem-default_value_for32) : 3.2.0</li>
<li>rubygem-ffi110 (devel/rubygem-ffi110) : 1.10.0</li>
<li>rubygem-zeitwerk (devel/rubygem-zeitwerk) : 2.1.9</li>
<li>sems (net/sems) : 1.7.0.g20190822</li>
<li>skypat (devel/skypat) : 3.1.1</li>
<li>tvm (math/tvm) : 0.4.1440</li>
<li>vavoom (games/vavoom) : 1.33_15</li>
<li>vavoom-extras (games/vavoom-extras) : 1.30_4</li>
</ul></li>
<li><p>Deleted Packages (24)</p>

<ul>
<li>geeqie (graphics/geeqie) : Unknown reason</li>
<li>iriverter (multimedia/iriverter) : Unknown reason</li>
<li>kde5 (x11/kde5) : Unknown reason</li>
<li>kicad-doc (cad/kicad-doc) : Unknown reason</li>
<li>os-nozfs-buildworld (os/buildworld) : Unknown reason</li>
<li>os-nozfs-userland (os/userland) : Unknown reason</li>
<li>os-nozfs-userland-base (os/userland-base) : Unknown reason</li>
<li>os-nozfs-userland-base-bootstrap (os/userland-base-bootstrap) : Unknown reason</li>
<li>os-nozfs-userland-bin (os/userland-bin) : Unknown reason</li>
<li>os-nozfs-userland-boot (os/userland-boot) : Unknown reason</li>
<li>os-nozfs-userland-conf (os/userland-conf) : Unknown reason</li>
<li>os-nozfs-userland-debug (os/userland-debug) : Unknown reason</li>
<li>os-nozfs-userland-devtools (os/userland-devtools) : Unknown reason</li>
<li>os-nozfs-userland-docs (os/userland-docs) : Unknown reason</li>
<li>os-nozfs-userland-lib (os/userland-lib) : Unknown reason</li>
<li>os-nozfs-userland-lib32 (os/userland-lib32) : Unknown reason</li>
<li>os-nozfs-userland-lib32-development (os/userland-lib32-development) : Unknown reason</li>
<li>os-nozfs-userland-rescue (os/userland-rescue) : Unknown reason</li>
<li>os-nozfs-userland-sbin (os/userland-sbin) : Unknown reason</li>
<li>os-nozfs-userland-tests (os/userland-tests) : Unknown reason</li>
<li>photoprint (print/photoprint) : Unknown reason</li>
<li>plasma5-plasma (x11/plasma5-plasma) : Unknown reason</li>
<li>polkit-qt5 (sysutils/polkit-qt) : Unknown reason</li>
<li>secpanel (security/secpanel) : Unknown reason</li>
</ul></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2019/09/10/23472.html" rel="nofollow">DragonFlyBSD - msdosfs updates</a></li>
<li><a href="https://science.sciencemag.org/content/365/6455/834.full" rel="nofollow">Stand out as a speaker</a></li>
<li><a href="http://akpoff.com/archive/2019/not_a_review_of_the_lenovo_x1c7.html" rel="nofollow">Not a review of the 7th Gen X1 Carbon</a></li>
<li><a href="https://www.tfir.io/2019/08/24/freebsd-meets-linux-at-the-open-source-summit/" rel="nofollow">FreeBSD Meets Linux At The Open Source Summit</a></li>
<li><a href="https://blog.bi0s.in/2019/08/24/Pwn/VM-Escape/2019-07-29-qemu-vm-escape-cve-2019-14378/" rel="nofollow">QEMU VM Escape</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on1" rel="nofollow">Porting wine to amd64 on NetBSD, third evaluation report.</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20190911113856" rel="nofollow">OpenBSD disabled DoH by default in Firefox</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Reinis - <a href="http://dpaste.com/0SG8630#wrap" rel="nofollow">GELI with UEFI</a></li>
<li>Mason - <a href="http://dpaste.com/1FQN173" rel="nofollow">Beeping</a></li>
</ul>

<p>[CHVT feedback]<br>
DJ - <a href="http://dpaste.com/08M3XNH#wrap" rel="nofollow">Feedback</a><br>
Ben - <a href="http://dpaste.com/274RVCE#wrap" rel="nofollow">chvt</a><br>
Harri - <a href="http://dpaste.com/23R1YMK#wrap" rel="nofollow">Marc&#39;s chvt question</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0316.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>NetBSD LLVM sanitizers and GDB regression test suite, Ada—The Language of Cost Savings, Homura - a Windows Games Launcher for FreeBSD, FreeBSD core team appoints a WG to explore transition to Git, OpenBSD 6.6 Beta tagged, Project Trident 12-U5 update now available, and more.</p>

<h2>Headlines</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/llvm_santizers_and_gdb_regression" rel="nofollow">LLVM santizers and GDB regression test suite.</a></h3>

<blockquote>
<p>As NetBSD-9 is branched, I have been asked to finish the LLVM sanitizer integration. This work is now accomplished and with MKLLVM=yes build option (by default off), the distribution will be populated with LLVM files for ASan, TSan, MSan, UBSan, libFuzzer, SafeStack and XRay.</p>

<p>I have also transplanted basesystem GDB patched to my GDB repository and managed to run the GDB regression test-suite.</p>
</blockquote>

<ul>
<li>NetBSD distribution changes</li>
</ul>

<blockquote>
<p>I have enhanced and imported my local MKSANITIZER code that makes whole distribution sanitization possible. Few real bugs were fixed and a number of patches were newly written to reflect the current NetBSD sources state. I have also merged another chunk of the fruits of the GSoC-2018 project with fuzzing the userland (by plusun@).</p>
</blockquote>

<ul>
<li>The following changes were committed to the sources:

<ul>
<li>ab7de18d0283 Cherry-pick upstream compiler-rt patches for LLVM sanitizers</li>
<li>966c62a34e30 Add LLVM sanitizers in the MKLLVM=yes build</li>
<li>8367b667adb9 telnetd: Stop defining the same variables concurrently in bss and data</li>
<li>fe72740f64bf fsck: Stop defining the same variable concurrently in bss and data</li>
<li>40e89e890d66 Fix build of t_ubsan/t_ubsanxx under MKSANITIZER</li>
<li>b71326fd7b67 Avoid symbol clashes in tests/usr.bin/id under MKSANITIZER</li>
<li>c581f2e39fa5 Avoid symbol clashes in fs/nfs/nfsservice under MKSANITIZER</li>
<li>030a4686a3c6 Avoid symbol clashes in bin/df under MKSANITIZER</li>
<li>fd9679f6e8b1 Avoid symbol clashes in usr.sbin/ypserv/ypserv under MKSANITIZER</li>
<li>5df2d7939ce3 Stop defining _rpcsvcdirty in bss and data</li>
<li>5fafbe8b8f64 Add missing extern declaration of ib_mach_emips in installboot</li>
<li>d134584be69a Add SANITIZER_RENAME_CLASSES in bsd.prog.mk</li>
<li>2d00d9b08eae Adapt tests/kernel/t_subr_prf for MKSANITIZER</li>
<li>ce54363fe452 Ship with sanitizer/lsan_interface.h for GCC 7</li>
<li>7bd5ee95e9a0 Ship with sanitizer/lsan_interface.h for LLVM 7</li>
<li>d8671fba7a78 Set NODEBUG for LLVM sanitizers</li>
<li>242cd44890a2 Add PAXCTL_FLAG rules for MKSANITIZER</li>
<li>5e80ab99d9ce Avoid symbol clashes in test/rump/modautoload/t_modautoload with sanitizers</li>
<li>e7ce7ecd9c2a sysctl: Add indirection of symbols to remove clash with sanitizers</li>
<li>231aea846aba traceroute: Add indirection of symbol to remove clash with sanitizers</li>
<li>8d85053f487c sockstat: Add indirection of symbols to remove clash with sanitizers</li>
<li>81b333ab151a netstat: Add indirection of symbols to remove clash with sanitizers</li>
<li>a472baefefe8 Correct the memset(3)&#39;s third argument in i386 biosdisk.c</li>
<li>7e4e92115bc3 Add ATF c and c++ tests for TSan, MSan, libFuzzer</li>
<li>921ddc9bc97c Set NOSANITIZER in i386 ramdisk image</li>
<li>64361771c78d Enhance MKSANITIZER support</li>
<li>3b5608f80a2b Define target_not_supported_body() in TSan, MSan and libFuzzer tests</li>
<li>c27f4619d513 Avoids signedness bit shift in db_get_value()</li>
<li>680c5b3cc24f Fix LLVM sanitizer build by GCC (HAVE_LLVM=no)</li>
<li>4ecfbbba2f2a Rework the LLVM compiler_rt build rules</li>
<li>748813da5547 Correct the build rules of LLVM sanitizers</li>
<li>20e223156dee Enhance the support of LLVM sanitizers</li>
<li>0bb38eb2f20d Register syms.extra in LLVM sanitizer .syms files</li>
<li>Almost all of the mentioned commits were backported to NetBSD-9 and will land 9.0.</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://github.com/Alexander88207/Homura" rel="nofollow">Homura - a Windows Games Launcher for FreeBSD</a></h3>

<blockquote>
<p>Inspired by lutris (a Linux gaming platform), we would like to provide a game launcher to play windows games on FreeBSD.</p>
</blockquote>

<ul>
<li>Makes it easier to run games on FreeBSD, by providing the tweaks and dependencies for you</li>
<li>Dependencies

<ul>
<li>curl</li>
<li>bash</li>
<li>p7zip</li>
<li>zenity</li>
<li>webfonts</li>
<li>alsa-utils (Optional)</li>
<li>winetricks</li>
<li>vulkan-tools</li>
<li>mesa-demos</li>
<li>i386-wine-devel on amd64 or wine-devel on i386</li>
</ul></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.electronicdesign.com/embedded-revolution/ada-language-cost-savings" rel="nofollow">Ada—The Language of Cost Savings?</a></h3>

<blockquote>
<p>Many myths surround the Ada programming language, but it continues to be used and evolve at the same time. And while the increased adoption of Ada and SPARK, its provable subset, is slow, it’s noticeable. Ada already addresses more of the features found in found in heavily used embedded languages like C+ and C#. It also tackles problems addressed by upcoming languages like Rust.</p>

<p>Chris concludes, “Development technologies have a profound impact on one of the largest and most variable costs associated with embedded-system engineering—labor. At a time when on-time system deployment can not only impact customer satisfaction, but access to services revenue streams, engineering team efficiency is at a premium. Our research showed that programming language choices can have significant influence in this area, leading to shorter projects, better schedules and, ultimately, lower development costs. While a variety of factors can influence and dictate language choice, our research showed that Ada’s evolution has made it an increasingly compelling option for engineering organizations, providing both technically and financially sound solution.”</p>

<p>In general, Ada already makes embedded “programming in the large” much easier by handling issues that aren’t even addressed in other languages. Though these features are often provided by third-party software, it results in inconsistent practices among developers. Ada also supports the gamut of embedded platforms from systems like Arm’s Cortex-M through supercomputers. Learning Ada isn’t as hard as one might think and the benefits can be significant.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsd.org/news/status/report-2019-04-2019-06.html#FreeBSD-Core-Team" rel="nofollow">FreeBSD core team appoints a WG to explore transitioning from Subversion to Git.</a></h3>

<ul>
<li>The FreeBSD Core Team is the governing body of FreeBSD.</li>
</ul>

<blockquote>
<p>Core approved source commit bits for Doug Moore (dougm), Chuck Silvers (chs), Brandon Bergren (bdragon), and a vendor commit bit for Scott Phillips (scottph).</p>

<p>The annual developer survey closed on 2019-04-02. Of the 397 developers, 243 took the survey with an average completion time of 12 minutes. The public survey closed on 2019-05-13. It was taken by 3637 users and had a 79% completion rate. A presentation of the survey results took place at BSDCan 2019.</p>

<p>The core team voted to appoint a working group to explore transitioning our source code &#39;source of truth&#39; from Subversion to Git. Core asked Ed Maste to chair the group as Ed has been researching this topic for some time. For example, Ed gave a MeetBSD 2018 talk on the topic.</p>

<p>There is a variety of viewpoints within core regarding where and how to host a Git repository, however core feels that Git is the prudent path forward.</p>
</blockquote>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20190810123243" rel="nofollow">OpenBSD 6.6 Beta tagged</a></h3>

<pre><code>CVSROOT:    /cvs
Module name:    src
Changes by:    deraadt@cvs.openbsd.org    2019/08/09 21:56:02

Modified files:
    etc/root : root.mail
    share/mk : sys.mk
    sys/arch/macppc/stand/tbxidata: bsd.tbxi
    sys/conf : newvers.sh
    sys/sys : param.h
    usr.bin/signify: signify.1

Log message:
move to 6.6-beta
</code></pre>

<p><a href="https://www.openbsd.org/66.html" rel="nofollow">Preliminary release notes</a></p>

<p>Improved hardware support, including:</p>

<ul>
<li>clang(1) is now provided on powerpc.</li>
<li>IEEE 802.11 wireless stack improvements:</li>
<li>Generic network stack improvements:</li>
<li>Installer improvements:</li>
<li>Security improvements:</li>
<li>  + Routing daemons and other userland network improvements</li>
<li>  + The ntpd(8) daemon now gets and sets the clock in a secure way when booting even when a battery-backed clock is absent.</li>
<li>  + bgdp(8) improvements</li>
<li>  + Assorted improvements:</li>
<li>  + The filesystem buffer cache now more aggressively uses memory outside the DMA region, to improve cache performance on amd64 machines.</li>
<li>The BER API previously internal to ldap(1), ldapd(8), ypldap(8), and snmpd(8) has been moved into libutil. See ber_read_elements(3).</li>
<li>Support for specifying boot device in vm.conf(5).</li>
<li>OpenSMTPD 6.6.0</li>
<li>LibreSSL 3.0.X</li>
<li>API and Documentation Enhancements</li>
<li>Completed the port of RSA_METHOD accessors from the OpenSSL 1.1 API.</li>
<li>Documented undescribed options and removed unfunctional options description in openssl(1) manual.</li>
<li>OpenSSH 8.0</li>
</ul>

<hr>

<h3><a href="https://project-trident.org/post/2019-09-04_stable12-u5_available/" rel="nofollow">Project Trident 12-U5 update now available</a></h3>

<blockquote>
<p>This is the fifth general package update to the STABLE release repository based upon TrueOS 12-Stable.</p>
</blockquote>

<ul>
<li>Package changes from Stable 12-U4</li>
<li><p>Package Summary</p>

<ul>
<li>New Packages: 20</li>
<li>Deleted Packages: 24</li>
<li>Updated Packages: 279</li>
</ul></li>
<li><p>New Packages (20)</p>

<ul>
<li>artemis (biology/artemis) : 17.0.1.11</li>
<li>catesc (games/catesc) : 0.6</li>
<li>dmlc-core (devel/dmlc-core) : 0.3.105</li>
<li>go-wtf (sysutils/go-wtf) : 0.20.0_1</li>
<li>instead (games/instead) : 3.3.0_1</li>
<li>lidarr (net-p2p/lidarr) : 0.6.2.883</li>
<li>minerbold (games/minerbold) : 1.4</li>
<li>onnx (math/onnx) : 1.5.0</li>
<li>openzwave-devel (comms/openzwave-devel) : 1.6.897</li>
<li>polkit-qt-1 (sysutils/polkit-qt) : 0.113.0_8</li>
<li>py36-traitsui (graphics/py-traitsui) : 6.1.2</li>
<li>rubygem-aws-sigv2 (devel/rubygem-aws-sigv2) : 1.0.1</li>
<li>rubygem-default_value_for32 (devel/rubygem-default_value_for32) : 3.2.0</li>
<li>rubygem-ffi110 (devel/rubygem-ffi110) : 1.10.0</li>
<li>rubygem-zeitwerk (devel/rubygem-zeitwerk) : 2.1.9</li>
<li>sems (net/sems) : 1.7.0.g20190822</li>
<li>skypat (devel/skypat) : 3.1.1</li>
<li>tvm (math/tvm) : 0.4.1440</li>
<li>vavoom (games/vavoom) : 1.33_15</li>
<li>vavoom-extras (games/vavoom-extras) : 1.30_4</li>
</ul></li>
<li><p>Deleted Packages (24)</p>

<ul>
<li>geeqie (graphics/geeqie) : Unknown reason</li>
<li>iriverter (multimedia/iriverter) : Unknown reason</li>
<li>kde5 (x11/kde5) : Unknown reason</li>
<li>kicad-doc (cad/kicad-doc) : Unknown reason</li>
<li>os-nozfs-buildworld (os/buildworld) : Unknown reason</li>
<li>os-nozfs-userland (os/userland) : Unknown reason</li>
<li>os-nozfs-userland-base (os/userland-base) : Unknown reason</li>
<li>os-nozfs-userland-base-bootstrap (os/userland-base-bootstrap) : Unknown reason</li>
<li>os-nozfs-userland-bin (os/userland-bin) : Unknown reason</li>
<li>os-nozfs-userland-boot (os/userland-boot) : Unknown reason</li>
<li>os-nozfs-userland-conf (os/userland-conf) : Unknown reason</li>
<li>os-nozfs-userland-debug (os/userland-debug) : Unknown reason</li>
<li>os-nozfs-userland-devtools (os/userland-devtools) : Unknown reason</li>
<li>os-nozfs-userland-docs (os/userland-docs) : Unknown reason</li>
<li>os-nozfs-userland-lib (os/userland-lib) : Unknown reason</li>
<li>os-nozfs-userland-lib32 (os/userland-lib32) : Unknown reason</li>
<li>os-nozfs-userland-lib32-development (os/userland-lib32-development) : Unknown reason</li>
<li>os-nozfs-userland-rescue (os/userland-rescue) : Unknown reason</li>
<li>os-nozfs-userland-sbin (os/userland-sbin) : Unknown reason</li>
<li>os-nozfs-userland-tests (os/userland-tests) : Unknown reason</li>
<li>photoprint (print/photoprint) : Unknown reason</li>
<li>plasma5-plasma (x11/plasma5-plasma) : Unknown reason</li>
<li>polkit-qt5 (sysutils/polkit-qt) : Unknown reason</li>
<li>secpanel (security/secpanel) : Unknown reason</li>
</ul></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2019/09/10/23472.html" rel="nofollow">DragonFlyBSD - msdosfs updates</a></li>
<li><a href="https://science.sciencemag.org/content/365/6455/834.full" rel="nofollow">Stand out as a speaker</a></li>
<li><a href="http://akpoff.com/archive/2019/not_a_review_of_the_lenovo_x1c7.html" rel="nofollow">Not a review of the 7th Gen X1 Carbon</a></li>
<li><a href="https://www.tfir.io/2019/08/24/freebsd-meets-linux-at-the-open-source-summit/" rel="nofollow">FreeBSD Meets Linux At The Open Source Summit</a></li>
<li><a href="https://blog.bi0s.in/2019/08/24/Pwn/VM-Escape/2019-07-29-qemu-vm-escape-cve-2019-14378/" rel="nofollow">QEMU VM Escape</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on1" rel="nofollow">Porting wine to amd64 on NetBSD, third evaluation report.</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20190911113856" rel="nofollow">OpenBSD disabled DoH by default in Firefox</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Reinis - <a href="http://dpaste.com/0SG8630#wrap" rel="nofollow">GELI with UEFI</a></li>
<li>Mason - <a href="http://dpaste.com/1FQN173" rel="nofollow">Beeping</a></li>
</ul>

<p>[CHVT feedback]<br>
DJ - <a href="http://dpaste.com/08M3XNH#wrap" rel="nofollow">Feedback</a><br>
Ben - <a href="http://dpaste.com/274RVCE#wrap" rel="nofollow">chvt</a><br>
Harri - <a href="http://dpaste.com/23R1YMK#wrap" rel="nofollow">Marc&#39;s chvt question</a></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0316.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>315: Recapping vBSDcon 2019</title>
  <link>https://www.bsdnow.tv/315</link>
  <guid isPermaLink="false">7b9117e9-57d1-48ae-8ceb-d92cabe2a2bd</guid>
  <pubDate>Thu, 12 Sep 2019 01:45:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7b9117e9-57d1-48ae-8ceb-d92cabe2a2bd.mp3" length="55391213" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>vBSDcon 2019 recap, Unix at 50, OpenBSD on fan-less Tuxedo InfinityBook, humungus - an hg server, how to configure a network dump in FreeBSD, and more.</itunes:subtitle>
  <itunes:duration>1:16:55</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>vBSDcon 2019 recap, Unix at 50, OpenBSD on fan-less Tuxedo InfinityBook, humungus - an hg server, how to configure a network dump in FreeBSD, and more.
Headlines
vBSDcon Recap
Allan and Benedict attended vBSDcon 2019, which ended last week.
It was held again at the Hyatt Regency Reston and the main conference was organized by Dan Langille of BSDCan fame.The two day conference was preceded by a one day FreeBSD hackathon, where FreeBSD developers had the chance to work on patches and PRs. In the evening, a reception was held to welcome attendees and give them a chance to chat and get to know each other over food and drinks.
The first day of the conference was opened with a Keynote by Paul Vixie about DNS over HTTPS (DoH). He explained how we got to the current state and what challenges (technical and social) this entails.
If you missed this talk and are dying to see it, it will also be presented at EuroBSDCon next week
John Baldwin followed up by giving an overview of the work on “In-Kernel TLS Framing and Encryption for FreeBSD” abstract (https://www.vbsdcon.com/schedule/2019-09-06.html#talk:132615) and the recent commit we covered in episode 313.
Meanwhile, Brian Callahan was giving a separate session in another room about “Learning to (Open)BSD through its porting system: an attendee-driven educational session” where people had the chance to learn about how to create ports for the BSDs.
David Fullard’s talk about “Transitioning from FreeNAS to FreeBSD” was his first talk at a BSD conference and described how he built his own home NAS setup trying to replicate FreeNAS’ functionality on FreeBSD, and why he transitioned from using an appliance to using vanilla FreeBSD.
Shawn Webb followed with his overview talk about the “State of the Hardened Union”. 
Benedict’s talk about “Replacing an Oracle Server with FreeBSD, OpenZFS, and PostgreSQL” was well received as people are interested in how we liberated ourselves from the clutches of Oracle without compromising functionality.
Entertaining and educational at the same time, Michael W. Lucas talk about “Twenty Years in Jail: FreeBSD Jails, Then and Now” closed the first day. Lucas also had a table in the hallway with his various tech and non-tech books for sale.
People formed small groups and went into town for dinner. Some returned later that night to some work in the hacker lounge or talk amongst fellow BSD enthusiasts. 
Colin Percival was the keynote speaker for the second day and had an in-depth look at “23 years of software side channel attacks”.
Allan reprised his “ELI5: ZFS Caching” talk explaining how the ZFS adaptive replacement cache (ARC) work and how it can be tuned for various workloads.
“By the numbers: ZFS Performance Results from Six Operating Systems and Their Derivatives” by Michael Dexter followed with his approach to benchmarking OpenZFS on various platforms.
Conor Beh was also a new speaker to vBSDcon. His talk was about “FreeBSD at Work: Building Network and Storage Infrastructure with pfSense and FreeNAS”.
Two OpenBSD talks closed the talk session: Kurt Mosiejczuk with “Care and Feeding of OpenBSD Porters” and Aaron Poffenberger with “Road Warrior Disaster Recovery: Secure, Synchronized, and Backed-up”.
A dinner and reception was enjoyed by the attendees and gave more time to discuss the talks given and other things until late at night.
We want to thank the vBSDcon organizers and especially Dan Langille for running such a great conference. We are grateful to Verisign as the main sponsor and The FreeBSD Foundation for sponsoring the tote bags. Thanks to all the speakers and attendees!
humungus - an hg server (https://humungus.tedunangst.com/r/humungus)
Features
View changes, files, changesets, etc. Some syntax highlighting.
Read only.
Serves multiple repositories.
Allows cloning via the obvious URL. Supports go get.
Serves files for downloads.
Online documentation via mandoc.
Terminal based admin interface.
News Roundup
OpenBSD on fan-less Tuxedo InfinityBook 14″ v2. (https://hazardous.org/archive/blog/openbsd/2019/09/02/OpenBSD-on-Infinitybook14)
The InfinityBook 14” v2 is a fanless 14” notebook. It is an excellent choice for running OpenBSD - but order it with the supported wireless card (see below.).
I’ve set it up in a dual-boot configuration so that I can switch between Linux and OpenBSD - mainly to spot differences in the drivers. TUXEDO allows a variety of configurations through their webshop.
The dual boot setup with grub2 and EFI boot will be covered in a separate blogpost. My tests were done with OpenBSD-current - which is as of writing flagged as 6.6-beta.
See Article for breakdown of CPU, Wireless, Video, Webcam, Audio, ACPI, Battery, Touchpad, and MicroSD Card Reader
Unix at 50: How the OS that powered smartphones started from failure (https://arstechnica.com/gadgets/2019/08/unix-at-50-it-starts-with-a-mainframe-a-gator-and-three-dedicated-researchers/)
Maybe its pervasiveness has long obscured its origins. But Unix, the operating system that in one derivative or another powers nearly all smartphones sold worldwide, was born 50 years ago from the failure of an ambitious project that involved titans like Bell Labs, GE, and MIT. Largely the brainchild of a few programmers at Bell Labs, the unlikely story of Unix begins with a meeting on the top floor of an otherwise unremarkable annex at the sprawling Bell Labs complex in Murray Hill, New Jersey.
It was a bright, cold Monday, the last day of March 1969, and the computer sciences department was hosting distinguished guests: Bill Baker, a Bell Labs vice president, and Ed David, the director of research. Baker was about to pull the plug on Multics (a condensed form of MULTiplexed Information and Computing Service), a software project that the computer sciences department had been working on for four years. Multics was two years overdue, way over budget, and functional only in the loosest possible understanding of the term.
Trying to put the best spin possible on what was clearly an abject failure, Baker gave a speech in which he claimed that Bell Labs had accomplished everything it was trying to accomplish in Multics and that they no longer needed to work on the project. As Berk Tague, a staffer present at the meeting, later told Princeton University, “Like Vietnam, he declared victory and got out of Multics.”
Within the department, this announcement was hardly unexpected. The programmers were acutely aware of the various issues with both the scope of the project and the computer they had been asked to build it for.
Still, it was something to work on, and as long as Bell Labs was working on Multics, they would also have a $7 million mainframe computer to play around with in their spare time. Dennis Ritchie, one of the programmers working on Multics, later said they all felt some stake in the success of the project, even though they knew the odds of that success were exceedingly remote.
Cancellation of Multics meant the end of the only project that the programmers in the Computer science department had to work on—and it also meant the loss of the only computer in the Computer science department. After the GE 645 mainframe was taken apart and hauled off, the computer science department’s resources were reduced to little more than office supplies and a few terminals.
Some of Allan’s favourite excerpts:
In the early '60s, Bill Ninke, a researcher in acoustics, had demonstrated a rudimentary graphical user interface with a DEC PDP-7 minicomputer. Acoustics still had that computer, but they weren’t using it and had stuck it somewhere out of the way up on the sixth floor.
And so Thompson, an indefatigable explorer of the labs’ nooks and crannies, finally found that PDP-7 shortly after Davis and Baker cancelled Multics.
With the rest of the team’s help, Thompson bundled up the various pieces of the PDP-7—a machine about the size of a refrigerator, not counting the terminal—moved it into a closet assigned to the acoustics department, and got it up and running. One way or another, they convinced acoustics to provide space for the computer and also to pay for the not infrequent repairs to it out of that department’s budget.
McIlroy’s programmers suddenly had a computer, kind of. So during the summer of 1969, Thompson, Ritchie, and Canaday hashed out the basics of a file manager that would run on the PDP-7. This was no simple task. Batch computing—running programs one after the other—rarely required that a computer be able to permanently store information, and many mainframes did not have any permanent storage device (whether a tape or a hard disk) attached to them. But the time-sharing environment that these programmers had fallen in love with required attached storage. And with multiple users connected to the same computer at the same time, the file manager had to be written well enough to keep one user’s files from being written over another user’s. When a file was read, the output from that file had to be sent to the user that was opening it.
It was a challenge that McIlroy’s team was willing to accept. They had seen the future of computing and wanted to explore it. They knew that Multics was a dead-end, but they had discovered the possibilities opened up by shared development, shared access, and real-time computing. Twenty years later, Ritchie characterized it for Princeton as such: “What we wanted to preserve was not just a good environment in which to do programming, but a system around which a fellowship could form.”
Eventually when they had the file management system more or less fleshed out conceptually, it came time to actually write the code. The trio—all of whom had terrible handwriting—decided to use the Labs’ dictating service. One of them called up a lab extension and dictated the entire code base into a tape recorder. And thus, some unidentified clerical worker or workers soon had the unenviable task of trying to convert that into a typewritten document.
Of course, it was done imperfectly. Among various errors, “inode” came back as “eye node,” but the output was still viewed as a decided improvement over their assorted scribbles.
In August 1969, Thompson’s wife and son went on a three-week vacation to see her family out in Berkeley, and Thompson decided to spend that time writing an assembler, a file editor, and a kernel to manage the PDP-7 processor. This would turn the group’s file manager into a full-fledged operating system. He generously allocated himself one week for each task.
Thompson finished his tasks more or less on schedule. And by September, the computer science department at Bell Labs had an operating system running on a PDP-7—and it wasn’t Multics.
By the summer of 1970, the team had attached a tape drive to the PDP-7, and their blossoming OS also had a growing selection of tools for programmers (several of which persist down to this day). But despite the successes, Thompson, Canaday, and Ritchie were still being rebuffed by labs management in their efforts to get a brand-new computer.
It wasn’t until late 1971 that the computer science department got a truly modern computer. The Unix team had developed several tools designed to automatically format text files for printing over the past year or so. They had done so to simplify the production of documentation for their pet project, but their tools had escaped and were being used by several researchers elsewhere on the top floor. At the same time, the legal department was prepared to spend a fortune on a mainframe program called “AstroText.” Catching wind of this, the Unix crew realized that they could, with only a little effort, upgrade the tools they had written for their own use into something that the legal department could use to prepare patent applications.
The computer science department pitched lab management on the purchase of a DEC PDP-11 for document production purposes, and Max Mathews offered to pay for the machine out of the acoustics department budget. Finally, management gave in and purchased a computer for the Unix team to play with. Eventually, word leaked out about this operating system, and businesses and institutions with PDP-11s began contacting Bell Labs about their new operating system. The Labs made it available for free—requesting only the cost of postage and media from anyone who wanted a copy.
The rest has quite literally made tech history.
See the link for the rest of the article
How to configure a network dump in FreeBSD? (https://www.oshogbo.vexillium.org/blog/68/)
A network dump might be very useful for collecting kernel crash dumps from embedded machines and machines with a larger amount of RAM then available swap partition size. Besides net dumps we can also try to compress the core dump. However, often this may still not be enough swap to keep whole core dump. In such situation using network dump is a convenient and reliable way for collecting kernel dump.
So, first, let’s talk a little bit about history. The first implementation of the network dumps was implemented around 2000 for the FreeBSD 4.x as a kernel module. The code was implemented in 2010 with the intention of being part of FreeBSD 9.0. However, the code never landed in FreeBSD. Finally, in 2018 with the commit r333283 by Mark Johnston the netdump client code landed in the FreeBSD. Subsequently, many other commitments were then implemented to add support for the different drivers (for example r333289). The first official release of FreeBSD, which support netdump is FreeBSD 12.0.
Now, let’s get back to the main topic. How to configure the network dump? Two machines are needed. One machine is to collect core dump, let’s call it server. We will use the second one to send us the core dump - the client. 
See the link for the rest of the article
Beastie Bits
Sudo Mastery 2nd edition is not out (https://mwl.io/archives/4530)
Empirical Notes on the Interaction Between Continuous Kernel Fuzzing and Development (http://users.utu.fi/kakrind/publications/19/vulnfuzz_camera.pdf)
soso (https://github.com/ozkl/soso)
GregKH - OpenBSD was right (https://youtu.be/gUqcMs0svNU?t=254)
Game of Trees (https://gameoftrees.org/faq.html)
Feedback/Questions
BostJan - Another Question (http://dpaste.com/1ZPCCQY#wrap)
Tom - PF (http://dpaste.com/3ZSCB8N#wrap)
JohnnyK - Changing VT without keys (http://dpaste.com/3QZQ7Q5#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, vBSDcon 2019, fan-less, fanless, tuxedo, infinitybook, tuxedo infinitybook, humungus, hg, hg server, network dump, configure, configuration</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>vBSDcon 2019 recap, Unix at 50, OpenBSD on fan-less Tuxedo InfinityBook, humungus - an hg server, how to configure a network dump in FreeBSD, and more.</p>

<h2>Headlines</h2>

<h3>vBSDcon Recap</h3>

<p>Allan and Benedict attended vBSDcon 2019, which ended last week.</p>

<p>It was held again at the Hyatt Regency Reston and the main conference was organized by Dan Langille of BSDCan fame.The two day conference was preceded by a one day FreeBSD hackathon, where FreeBSD developers had the chance to work on patches and PRs. In the evening, a reception was held to welcome attendees and give them a chance to chat and get to know each other over food and drinks.</p>

<p>The first day of the conference was opened with a Keynote by Paul Vixie about DNS over HTTPS (DoH). He explained how we got to the current state and what challenges (technical and social) this entails.</p>

<ul>
<li>If you missed this talk and are dying to see it, it will also be presented at EuroBSDCon next week</li>
</ul>

<p>John Baldwin followed up by giving an overview of the work on “In-Kernel TLS Framing and Encryption for FreeBSD” <a href="https://www.vbsdcon.com/schedule/2019-09-06.html#talk:132615" rel="nofollow">abstract</a> and the recent commit we covered in episode 313.</p>

<p>Meanwhile, Brian Callahan was giving a separate session in another room about “Learning to (Open)BSD through its porting system: an attendee-driven educational session” where people had the chance to learn about how to create ports for the BSDs.</p>

<p>David Fullard’s talk about “Transitioning from FreeNAS to FreeBSD” was his first talk at a BSD conference and described how he built his own home NAS setup trying to replicate FreeNAS’ functionality on FreeBSD, and why he transitioned from using an appliance to using vanilla FreeBSD.</p>

<p>Shawn Webb followed with his overview talk about the “State of the Hardened Union”. </p>

<p>Benedict’s talk about “Replacing an Oracle Server with FreeBSD, OpenZFS, and PostgreSQL” was well received as people are interested in how we liberated ourselves from the clutches of Oracle without compromising functionality.</p>

<p>Entertaining and educational at the same time, Michael W. Lucas talk about “Twenty Years in Jail: FreeBSD Jails, Then and Now” closed the first day. Lucas also had a table in the hallway with his various tech and non-tech books for sale.</p>

<p>People formed small groups and went into town for dinner. Some returned later that night to some work in the hacker lounge or talk amongst fellow BSD enthusiasts. </p>

<p>Colin Percival was the keynote speaker for the second day and had an in-depth look at “23 years of software side channel attacks”.</p>

<p>Allan reprised his “ELI5: ZFS Caching” talk explaining how the ZFS adaptive replacement cache (ARC) work and how it can be tuned for various workloads.</p>

<p>“By the numbers: ZFS Performance Results from Six Operating Systems and Their Derivatives” by Michael Dexter followed with his approach to benchmarking OpenZFS on various platforms.</p>

<p>Conor Beh was also a new speaker to vBSDcon. His talk was about “FreeBSD at Work: Building Network and Storage Infrastructure with pfSense and FreeNAS”.</p>

<p>Two OpenBSD talks closed the talk session: Kurt Mosiejczuk with “Care and Feeding of OpenBSD Porters” and Aaron Poffenberger with “Road Warrior Disaster Recovery: Secure, Synchronized, and Backed-up”.</p>

<p>A dinner and reception was enjoyed by the attendees and gave more time to discuss the talks given and other things until late at night.</p>

<p>We want to thank the vBSDcon organizers and especially Dan Langille for running such a great conference. We are grateful to Verisign as the main sponsor and The FreeBSD Foundation for sponsoring the tote bags. Thanks to all the speakers and attendees!</p>

<h3><a href="https://humungus.tedunangst.com/r/humungus" rel="nofollow">humungus - an hg server</a></h3>

<ul>
<li>Features

<ul>
<li>View changes, files, changesets, etc. Some syntax highlighting.</li>
<li>Read only.</li>
<li>Serves multiple repositories.</li>
<li>Allows cloning via the obvious URL. Supports go get.</li>
<li>Serves files for downloads.</li>
<li>Online documentation via mandoc.</li>
<li>Terminal based admin interface.</li>
</ul></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://hazardous.org/archive/blog/openbsd/2019/09/02/OpenBSD-on-Infinitybook14" rel="nofollow">OpenBSD on fan-less Tuxedo InfinityBook 14″ v2.</a></h3>

<blockquote>
<p>The InfinityBook 14” v2 is a fanless 14” notebook. It is an excellent choice for running OpenBSD - but order it with the supported wireless card (see below.).</p>

<p>I’ve set it up in a dual-boot configuration so that I can switch between Linux and OpenBSD - mainly to spot differences in the drivers. TUXEDO allows a variety of configurations through their webshop.</p>

<p>The dual boot setup with grub2 and EFI boot will be covered in a separate blogpost. My tests were done with OpenBSD-current - which is as of writing flagged as 6.6-beta.</p>
</blockquote>

<ul>
<li>See Article for breakdown of CPU, Wireless, Video, Webcam, Audio, ACPI, Battery, Touchpad, and MicroSD Card Reader</li>
</ul>

<hr>

<h3><a href="https://arstechnica.com/gadgets/2019/08/unix-at-50-it-starts-with-a-mainframe-a-gator-and-three-dedicated-researchers/" rel="nofollow">Unix at 50: How the OS that powered smartphones started from failure</a></h3>

<blockquote>
<p>Maybe its pervasiveness has long obscured its origins. But Unix, the operating system that in one derivative or another powers nearly all smartphones sold worldwide, was born 50 years ago from the failure of an ambitious project that involved titans like Bell Labs, GE, and MIT. Largely the brainchild of a few programmers at Bell Labs, the unlikely story of Unix begins with a meeting on the top floor of an otherwise unremarkable annex at the sprawling Bell Labs complex in Murray Hill, New Jersey.</p>

<p>It was a bright, cold Monday, the last day of March 1969, and the computer sciences department was hosting distinguished guests: Bill Baker, a Bell Labs vice president, and Ed David, the director of research. Baker was about to pull the plug on Multics (a condensed form of MULTiplexed Information and Computing Service), a software project that the computer sciences department had been working on for four years. Multics was two years overdue, way over budget, and functional only in the loosest possible understanding of the term.</p>

<p>Trying to put the best spin possible on what was clearly an abject failure, Baker gave a speech in which he claimed that Bell Labs had accomplished everything it was trying to accomplish in Multics and that they no longer needed to work on the project. As Berk Tague, a staffer present at the meeting, later told Princeton University, “Like Vietnam, he declared victory and got out of Multics.”</p>

<p>Within the department, this announcement was hardly unexpected. The programmers were acutely aware of the various issues with both the scope of the project and the computer they had been asked to build it for.</p>

<p>Still, it was something to work on, and as long as Bell Labs was working on Multics, they would also have a $7 million mainframe computer to play around with in their spare time. Dennis Ritchie, one of the programmers working on Multics, later said they all felt some stake in the success of the project, even though they knew the odds of that success were exceedingly remote.</p>

<p>Cancellation of Multics meant the end of the only project that the programmers in the Computer science department had to work on—and it also meant the loss of the only computer in the Computer science department. After the GE 645 mainframe was taken apart and hauled off, the computer science department’s resources were reduced to little more than office supplies and a few terminals.</p>
</blockquote>

<ul>
<li>Some of Allan’s favourite excerpts:</li>
</ul>

<blockquote>
<p>In the early &#39;60s, Bill Ninke, a researcher in acoustics, had demonstrated a rudimentary graphical user interface with a DEC PDP-7 minicomputer. Acoustics still had that computer, but they weren’t using it and had stuck it somewhere out of the way up on the sixth floor.</p>

<p>And so Thompson, an indefatigable explorer of the labs’ nooks and crannies, finally found that PDP-7 shortly after Davis and Baker cancelled Multics.</p>

<p>With the rest of the team’s help, Thompson bundled up the various pieces of the PDP-7—a machine about the size of a refrigerator, not counting the terminal—moved it into a closet assigned to the acoustics department, and got it up and running. One way or another, they convinced acoustics to provide space for the computer and also to pay for the not infrequent repairs to it out of that department’s budget.</p>

<p>McIlroy’s programmers suddenly had a computer, kind of. So during the summer of 1969, Thompson, Ritchie, and Canaday hashed out the basics of a file manager that would run on the PDP-7. This was no simple task. Batch computing—running programs one after the other—rarely required that a computer be able to permanently store information, and many mainframes did not have any permanent storage device (whether a tape or a hard disk) attached to them. But the time-sharing environment that these programmers had fallen in love with required attached storage. And with multiple users connected to the same computer at the same time, the file manager had to be written well enough to keep one user’s files from being written over another user’s. When a file was read, the output from that file had to be sent to the user that was opening it.</p>

<p>It was a challenge that McIlroy’s team was willing to accept. They had seen the future of computing and wanted to explore it. They knew that Multics was a dead-end, but they had discovered the possibilities opened up by shared development, shared access, and real-time computing. Twenty years later, Ritchie characterized it for Princeton as such: “What we wanted to preserve was not just a good environment in which to do programming, but a system around which a fellowship could form.”</p>

<p>Eventually when they had the file management system more or less fleshed out conceptually, it came time to actually write the code. The trio—all of whom had terrible handwriting—decided to use the Labs’ dictating service. One of them called up a lab extension and dictated the entire code base into a tape recorder. And thus, some unidentified clerical worker or workers soon had the unenviable task of trying to convert that into a typewritten document.</p>

<p>Of course, it was done imperfectly. Among various errors, “inode” came back as “eye node,” but the output was still viewed as a decided improvement over their assorted scribbles.</p>

<p>In August 1969, Thompson’s wife and son went on a three-week vacation to see her family out in Berkeley, and Thompson decided to spend that time writing an assembler, a file editor, and a kernel to manage the PDP-7 processor. This would turn the group’s file manager into a full-fledged operating system. He generously allocated himself one week for each task.</p>

<p>Thompson finished his tasks more or less on schedule. And by September, the computer science department at Bell Labs had an operating system running on a PDP-7—and it wasn’t Multics.</p>

<p>By the summer of 1970, the team had attached a tape drive to the PDP-7, and their blossoming OS also had a growing selection of tools for programmers (several of which persist down to this day). But despite the successes, Thompson, Canaday, and Ritchie were still being rebuffed by labs management in their efforts to get a brand-new computer.</p>

<p>It wasn’t until late 1971 that the computer science department got a truly modern computer. The Unix team had developed several tools designed to automatically format text files for printing over the past year or so. They had done so to simplify the production of documentation for their pet project, but their tools had escaped and were being used by several researchers elsewhere on the top floor. At the same time, the legal department was prepared to spend a fortune on a mainframe program called “AstroText.” Catching wind of this, the Unix crew realized that they could, with only a little effort, upgrade the tools they had written for their own use into something that the legal department could use to prepare patent applications.</p>

<p>The computer science department pitched lab management on the purchase of a DEC PDP-11 for document production purposes, and Max Mathews offered to pay for the machine out of the acoustics department budget. Finally, management gave in and purchased a computer for the Unix team to play with. Eventually, word leaked out about this operating system, and businesses and institutions with PDP-11s began contacting Bell Labs about their new operating system. The Labs made it available for free—requesting only the cost of postage and media from anyone who wanted a copy.</p>

<p>The rest has quite literally made tech history.</p>
</blockquote>

<ul>
<li>See the link for the rest of the article</li>
</ul>

<hr>

<h3><a href="https://www.oshogbo.vexillium.org/blog/68/" rel="nofollow">How to configure a network dump in FreeBSD?</a></h3>

<blockquote>
<p>A network dump might be very useful for collecting kernel crash dumps from embedded machines and machines with a larger amount of RAM then available swap partition size. Besides net dumps we can also try to compress the core dump. However, often this may still not be enough swap to keep whole core dump. In such situation using network dump is a convenient and reliable way for collecting kernel dump.</p>

<p>So, first, let’s talk a little bit about history. The first implementation of the network dumps was implemented around 2000 for the FreeBSD 4.x as a kernel module. The code was implemented in 2010 with the intention of being part of FreeBSD 9.0. However, the code never landed in FreeBSD. Finally, in 2018 with the commit r333283 by Mark Johnston the netdump client code landed in the FreeBSD. Subsequently, many other commitments were then implemented to add support for the different drivers (for example r333289). The first official release of FreeBSD, which support netdump is FreeBSD 12.0.</p>

<p>Now, let’s get back to the main topic. How to configure the network dump? Two machines are needed. One machine is to collect core dump, let’s call it server. We will use the second one to send us the core dump - the client. </p>
</blockquote>

<ul>
<li>See the link for the rest of the article</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://mwl.io/archives/4530" rel="nofollow">Sudo Mastery 2nd edition is not out</a></li>
<li><a href="http://users.utu.fi/kakrind/publications/19/vulnfuzz_camera.pdf" rel="nofollow">Empirical Notes on the Interaction Between Continuous Kernel Fuzzing and Development</a></li>
<li><a href="https://github.com/ozkl/soso" rel="nofollow">soso</a></li>
<li><a href="https://youtu.be/gUqcMs0svNU?t=254" rel="nofollow">GregKH - OpenBSD was right</a></li>
<li><a href="https://gameoftrees.org/faq.html" rel="nofollow">Game of Trees</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>BostJan - <a href="http://dpaste.com/1ZPCCQY#wrap" rel="nofollow">Another Question</a></li>
<li>Tom - <a href="http://dpaste.com/3ZSCB8N#wrap" rel="nofollow">PF</a></li>
<li>JohnnyK - <a href="http://dpaste.com/3QZQ7Q5#wrap" rel="nofollow">Changing VT without keys</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0315.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>vBSDcon 2019 recap, Unix at 50, OpenBSD on fan-less Tuxedo InfinityBook, humungus - an hg server, how to configure a network dump in FreeBSD, and more.</p>

<h2>Headlines</h2>

<h3>vBSDcon Recap</h3>

<p>Allan and Benedict attended vBSDcon 2019, which ended last week.</p>

<p>It was held again at the Hyatt Regency Reston and the main conference was organized by Dan Langille of BSDCan fame.The two day conference was preceded by a one day FreeBSD hackathon, where FreeBSD developers had the chance to work on patches and PRs. In the evening, a reception was held to welcome attendees and give them a chance to chat and get to know each other over food and drinks.</p>

<p>The first day of the conference was opened with a Keynote by Paul Vixie about DNS over HTTPS (DoH). He explained how we got to the current state and what challenges (technical and social) this entails.</p>

<ul>
<li>If you missed this talk and are dying to see it, it will also be presented at EuroBSDCon next week</li>
</ul>

<p>John Baldwin followed up by giving an overview of the work on “In-Kernel TLS Framing and Encryption for FreeBSD” <a href="https://www.vbsdcon.com/schedule/2019-09-06.html#talk:132615" rel="nofollow">abstract</a> and the recent commit we covered in episode 313.</p>

<p>Meanwhile, Brian Callahan was giving a separate session in another room about “Learning to (Open)BSD through its porting system: an attendee-driven educational session” where people had the chance to learn about how to create ports for the BSDs.</p>

<p>David Fullard’s talk about “Transitioning from FreeNAS to FreeBSD” was his first talk at a BSD conference and described how he built his own home NAS setup trying to replicate FreeNAS’ functionality on FreeBSD, and why he transitioned from using an appliance to using vanilla FreeBSD.</p>

<p>Shawn Webb followed with his overview talk about the “State of the Hardened Union”. </p>

<p>Benedict’s talk about “Replacing an Oracle Server with FreeBSD, OpenZFS, and PostgreSQL” was well received as people are interested in how we liberated ourselves from the clutches of Oracle without compromising functionality.</p>

<p>Entertaining and educational at the same time, Michael W. Lucas talk about “Twenty Years in Jail: FreeBSD Jails, Then and Now” closed the first day. Lucas also had a table in the hallway with his various tech and non-tech books for sale.</p>

<p>People formed small groups and went into town for dinner. Some returned later that night to some work in the hacker lounge or talk amongst fellow BSD enthusiasts. </p>

<p>Colin Percival was the keynote speaker for the second day and had an in-depth look at “23 years of software side channel attacks”.</p>

<p>Allan reprised his “ELI5: ZFS Caching” talk explaining how the ZFS adaptive replacement cache (ARC) work and how it can be tuned for various workloads.</p>

<p>“By the numbers: ZFS Performance Results from Six Operating Systems and Their Derivatives” by Michael Dexter followed with his approach to benchmarking OpenZFS on various platforms.</p>

<p>Conor Beh was also a new speaker to vBSDcon. His talk was about “FreeBSD at Work: Building Network and Storage Infrastructure with pfSense and FreeNAS”.</p>

<p>Two OpenBSD talks closed the talk session: Kurt Mosiejczuk with “Care and Feeding of OpenBSD Porters” and Aaron Poffenberger with “Road Warrior Disaster Recovery: Secure, Synchronized, and Backed-up”.</p>

<p>A dinner and reception was enjoyed by the attendees and gave more time to discuss the talks given and other things until late at night.</p>

<p>We want to thank the vBSDcon organizers and especially Dan Langille for running such a great conference. We are grateful to Verisign as the main sponsor and The FreeBSD Foundation for sponsoring the tote bags. Thanks to all the speakers and attendees!</p>

<h3><a href="https://humungus.tedunangst.com/r/humungus" rel="nofollow">humungus - an hg server</a></h3>

<ul>
<li>Features

<ul>
<li>View changes, files, changesets, etc. Some syntax highlighting.</li>
<li>Read only.</li>
<li>Serves multiple repositories.</li>
<li>Allows cloning via the obvious URL. Supports go get.</li>
<li>Serves files for downloads.</li>
<li>Online documentation via mandoc.</li>
<li>Terminal based admin interface.</li>
</ul></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://hazardous.org/archive/blog/openbsd/2019/09/02/OpenBSD-on-Infinitybook14" rel="nofollow">OpenBSD on fan-less Tuxedo InfinityBook 14″ v2.</a></h3>

<blockquote>
<p>The InfinityBook 14” v2 is a fanless 14” notebook. It is an excellent choice for running OpenBSD - but order it with the supported wireless card (see below.).</p>

<p>I’ve set it up in a dual-boot configuration so that I can switch between Linux and OpenBSD - mainly to spot differences in the drivers. TUXEDO allows a variety of configurations through their webshop.</p>

<p>The dual boot setup with grub2 and EFI boot will be covered in a separate blogpost. My tests were done with OpenBSD-current - which is as of writing flagged as 6.6-beta.</p>
</blockquote>

<ul>
<li>See Article for breakdown of CPU, Wireless, Video, Webcam, Audio, ACPI, Battery, Touchpad, and MicroSD Card Reader</li>
</ul>

<hr>

<h3><a href="https://arstechnica.com/gadgets/2019/08/unix-at-50-it-starts-with-a-mainframe-a-gator-and-three-dedicated-researchers/" rel="nofollow">Unix at 50: How the OS that powered smartphones started from failure</a></h3>

<blockquote>
<p>Maybe its pervasiveness has long obscured its origins. But Unix, the operating system that in one derivative or another powers nearly all smartphones sold worldwide, was born 50 years ago from the failure of an ambitious project that involved titans like Bell Labs, GE, and MIT. Largely the brainchild of a few programmers at Bell Labs, the unlikely story of Unix begins with a meeting on the top floor of an otherwise unremarkable annex at the sprawling Bell Labs complex in Murray Hill, New Jersey.</p>

<p>It was a bright, cold Monday, the last day of March 1969, and the computer sciences department was hosting distinguished guests: Bill Baker, a Bell Labs vice president, and Ed David, the director of research. Baker was about to pull the plug on Multics (a condensed form of MULTiplexed Information and Computing Service), a software project that the computer sciences department had been working on for four years. Multics was two years overdue, way over budget, and functional only in the loosest possible understanding of the term.</p>

<p>Trying to put the best spin possible on what was clearly an abject failure, Baker gave a speech in which he claimed that Bell Labs had accomplished everything it was trying to accomplish in Multics and that they no longer needed to work on the project. As Berk Tague, a staffer present at the meeting, later told Princeton University, “Like Vietnam, he declared victory and got out of Multics.”</p>

<p>Within the department, this announcement was hardly unexpected. The programmers were acutely aware of the various issues with both the scope of the project and the computer they had been asked to build it for.</p>

<p>Still, it was something to work on, and as long as Bell Labs was working on Multics, they would also have a $7 million mainframe computer to play around with in their spare time. Dennis Ritchie, one of the programmers working on Multics, later said they all felt some stake in the success of the project, even though they knew the odds of that success were exceedingly remote.</p>

<p>Cancellation of Multics meant the end of the only project that the programmers in the Computer science department had to work on—and it also meant the loss of the only computer in the Computer science department. After the GE 645 mainframe was taken apart and hauled off, the computer science department’s resources were reduced to little more than office supplies and a few terminals.</p>
</blockquote>

<ul>
<li>Some of Allan’s favourite excerpts:</li>
</ul>

<blockquote>
<p>In the early &#39;60s, Bill Ninke, a researcher in acoustics, had demonstrated a rudimentary graphical user interface with a DEC PDP-7 minicomputer. Acoustics still had that computer, but they weren’t using it and had stuck it somewhere out of the way up on the sixth floor.</p>

<p>And so Thompson, an indefatigable explorer of the labs’ nooks and crannies, finally found that PDP-7 shortly after Davis and Baker cancelled Multics.</p>

<p>With the rest of the team’s help, Thompson bundled up the various pieces of the PDP-7—a machine about the size of a refrigerator, not counting the terminal—moved it into a closet assigned to the acoustics department, and got it up and running. One way or another, they convinced acoustics to provide space for the computer and also to pay for the not infrequent repairs to it out of that department’s budget.</p>

<p>McIlroy’s programmers suddenly had a computer, kind of. So during the summer of 1969, Thompson, Ritchie, and Canaday hashed out the basics of a file manager that would run on the PDP-7. This was no simple task. Batch computing—running programs one after the other—rarely required that a computer be able to permanently store information, and many mainframes did not have any permanent storage device (whether a tape or a hard disk) attached to them. But the time-sharing environment that these programmers had fallen in love with required attached storage. And with multiple users connected to the same computer at the same time, the file manager had to be written well enough to keep one user’s files from being written over another user’s. When a file was read, the output from that file had to be sent to the user that was opening it.</p>

<p>It was a challenge that McIlroy’s team was willing to accept. They had seen the future of computing and wanted to explore it. They knew that Multics was a dead-end, but they had discovered the possibilities opened up by shared development, shared access, and real-time computing. Twenty years later, Ritchie characterized it for Princeton as such: “What we wanted to preserve was not just a good environment in which to do programming, but a system around which a fellowship could form.”</p>

<p>Eventually when they had the file management system more or less fleshed out conceptually, it came time to actually write the code. The trio—all of whom had terrible handwriting—decided to use the Labs’ dictating service. One of them called up a lab extension and dictated the entire code base into a tape recorder. And thus, some unidentified clerical worker or workers soon had the unenviable task of trying to convert that into a typewritten document.</p>

<p>Of course, it was done imperfectly. Among various errors, “inode” came back as “eye node,” but the output was still viewed as a decided improvement over their assorted scribbles.</p>

<p>In August 1969, Thompson’s wife and son went on a three-week vacation to see her family out in Berkeley, and Thompson decided to spend that time writing an assembler, a file editor, and a kernel to manage the PDP-7 processor. This would turn the group’s file manager into a full-fledged operating system. He generously allocated himself one week for each task.</p>

<p>Thompson finished his tasks more or less on schedule. And by September, the computer science department at Bell Labs had an operating system running on a PDP-7—and it wasn’t Multics.</p>

<p>By the summer of 1970, the team had attached a tape drive to the PDP-7, and their blossoming OS also had a growing selection of tools for programmers (several of which persist down to this day). But despite the successes, Thompson, Canaday, and Ritchie were still being rebuffed by labs management in their efforts to get a brand-new computer.</p>

<p>It wasn’t until late 1971 that the computer science department got a truly modern computer. The Unix team had developed several tools designed to automatically format text files for printing over the past year or so. They had done so to simplify the production of documentation for their pet project, but their tools had escaped and were being used by several researchers elsewhere on the top floor. At the same time, the legal department was prepared to spend a fortune on a mainframe program called “AstroText.” Catching wind of this, the Unix crew realized that they could, with only a little effort, upgrade the tools they had written for their own use into something that the legal department could use to prepare patent applications.</p>

<p>The computer science department pitched lab management on the purchase of a DEC PDP-11 for document production purposes, and Max Mathews offered to pay for the machine out of the acoustics department budget. Finally, management gave in and purchased a computer for the Unix team to play with. Eventually, word leaked out about this operating system, and businesses and institutions with PDP-11s began contacting Bell Labs about their new operating system. The Labs made it available for free—requesting only the cost of postage and media from anyone who wanted a copy.</p>

<p>The rest has quite literally made tech history.</p>
</blockquote>

<ul>
<li>See the link for the rest of the article</li>
</ul>

<hr>

<h3><a href="https://www.oshogbo.vexillium.org/blog/68/" rel="nofollow">How to configure a network dump in FreeBSD?</a></h3>

<blockquote>
<p>A network dump might be very useful for collecting kernel crash dumps from embedded machines and machines with a larger amount of RAM then available swap partition size. Besides net dumps we can also try to compress the core dump. However, often this may still not be enough swap to keep whole core dump. In such situation using network dump is a convenient and reliable way for collecting kernel dump.</p>

<p>So, first, let’s talk a little bit about history. The first implementation of the network dumps was implemented around 2000 for the FreeBSD 4.x as a kernel module. The code was implemented in 2010 with the intention of being part of FreeBSD 9.0. However, the code never landed in FreeBSD. Finally, in 2018 with the commit r333283 by Mark Johnston the netdump client code landed in the FreeBSD. Subsequently, many other commitments were then implemented to add support for the different drivers (for example r333289). The first official release of FreeBSD, which support netdump is FreeBSD 12.0.</p>

<p>Now, let’s get back to the main topic. How to configure the network dump? Two machines are needed. One machine is to collect core dump, let’s call it server. We will use the second one to send us the core dump - the client. </p>
</blockquote>

<ul>
<li>See the link for the rest of the article</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://mwl.io/archives/4530" rel="nofollow">Sudo Mastery 2nd edition is not out</a></li>
<li><a href="http://users.utu.fi/kakrind/publications/19/vulnfuzz_camera.pdf" rel="nofollow">Empirical Notes on the Interaction Between Continuous Kernel Fuzzing and Development</a></li>
<li><a href="https://github.com/ozkl/soso" rel="nofollow">soso</a></li>
<li><a href="https://youtu.be/gUqcMs0svNU?t=254" rel="nofollow">GregKH - OpenBSD was right</a></li>
<li><a href="https://gameoftrees.org/faq.html" rel="nofollow">Game of Trees</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>BostJan - <a href="http://dpaste.com/1ZPCCQY#wrap" rel="nofollow">Another Question</a></li>
<li>Tom - <a href="http://dpaste.com/3ZSCB8N#wrap" rel="nofollow">PF</a></li>
<li>JohnnyK - <a href="http://dpaste.com/3QZQ7Q5#wrap" rel="nofollow">Changing VT without keys</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0315.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>314: Swap that Space</title>
  <link>https://www.bsdnow.tv/314</link>
  <guid isPermaLink="false">a98d492a-7c4f-4f70-b6cf-388387042427</guid>
  <pubDate>Wed, 04 Sep 2019 20:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a98d492a-7c4f-4f70-b6cf-388387042427.mp3" length="34897838" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Unix virtual memory when you have no swap space, Dsynth details on Dragonfly, Instant Workstation on FreeBSD, new servers new tech, Experimenting with streaming setups on NetBSD, NetBSD’s progress towards Steam support thanks to GSoC, and more.</itunes:subtitle>
  <itunes:duration>48:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Unix virtual memory when you have no swap space, Dsynth details on Dragonfly, Instant Workstation on FreeBSD, new servers new tech, Experimenting with streaming setups on NetBSD, NetBSD’s progress towards Steam support thanks to GSoC, and more.
Headlines
What has to happen with Unix virtual memory when you have no swap space (https://utcc.utoronto.ca/~cks/space/blog/unix/NoSwapConsequence)
Recently, Artem S. Tashkinov wrote on the Linux kernel mailing list about a Linux problem under memory pressure (via, and threaded here). The specific reproduction instructions involved having low RAM, turning off swap space, and then putting the system under load, and when that happened (emphasis mine):
Once you hit a situation when opening a new tab requires more RAM than is currently available, the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly (I'm not entirely sure why). [...]
I'm afraid I have bad news for the people snickering at Linux here; if you're running without swap space, you can probably get any Unix to behave this way under memory pressure. If you can't on your particular Unix, I'd actually say that your Unix is probably not letting you get full use out of your RAM.
To simplify a bit, we can divide pages of user memory up into anonymous pages and file-backed pages. File-backed pages are what they sound like; they come from some specific file on the filesystem that they can be written out to (if they're dirty) or read back in from. Anonymous pages are not backed by a file, so the only place they can be written out to and read back in from is swap space. Anonymous pages mostly come from dynamic memory allocations and from modifying the program's global variables and data; file backed pages come mostly from mapping files into memory with mmap() and also, crucially, from the code and read-only data of the program.
See link for the rest of the article
Dsynth details on Dragonfly (https://www.dragonflydigest.com/2019/08/27/23398.html)
First, history: DragonFly has had binaries of dports available for download for quite some time.  These were originally built using poudriere, and then using the synth tool put together by John Marino.  Synth worked both to build all software in dports, and as a way to test DragonFly’s SMP capability under extreme load.
Matthew Dillon is working on a new version, called dsynth.  It is available now but not yet part of the build.  He’s been working quickly on it and there’s plenty more commits than what I have linked here.  It’s already led to finding more high-load fixes.
dsynth
DSynth is basically synth written in C, from scratch.  It is designed to give us a bulk builder in base and be friendly to porting and jails down the line (for now its uses chroot's).
The original synth was written by John R. Marino and its basic flow was used in writing this program, but as it was written in ada no code was directly copied.
The intent is to make dsynth compatible with synth's configuration files and directory structure.
This is a work in progress and not yet ready for prime-time.  Pushing so we can get some more eyeballs.  Most of the directives do not yet work (everything, and build works, and 'cleanup' can be used to clean up any dangling mounts).
dsynth code (https://gitweb.dragonflybsd.org/dragonfly.git/blob/HEAD:/usr.bin/dsynth/dsynth.1)
News Roundup
Instant Workstation (https://euroquis.nl/freebsd/2019/08/12/instant-workstation.html)
Some considerable time ago I wrote up instructions on how to set up a FreeBSD machine with the latest KDE Plasma Desktop. Those instructions, while fairly short (set up X, install the KDE meta-port, .. and that’s it) are a bit fiddly.
So – prompted slightly by a Twitter exchange recently – I’ve started a mini-sub-project to script the installation of a desktop environment and the bits needed to support it. To give it at least a modicum of UI, dialog(1) is used to ask for an environment to install and a display manager.
The tricky bits – pointed out to me after I started – are hardware support, although a best-effort is better than having nothing, I think.
In any case, in a VBox host it’s now down to running a single script and picking Plasma and SDDM to get a usable system for me. Other combinations have not been tested, nor has system-hardware-setup. I’ll probably maintain it for a while and if I have time and energy it’ll be tried with nVidia (those work quite well on FreeBSD) and AMD (not so much, in my experience) graphics cards when I shuffle some machines around.
Here is the script in my GitHub repository with notes-for-myself. (https://raw.githubusercontent.com/adriaandegroot/FreeBSDTools/master/bin/instant-workstation)
New Servers, new Tech (https://www.dragonflydigest.com/2019/08/26/23396.html)
Following up on an earlier post, the new servers for DragonFly are in place.   The old 40-core machine used for bulk build, monster, is being retired.  The power efficiency of the new machines is startling.  Incidentally, this is where donations go – infrastructure.
New servers in the colo, monster is being retired (http://lists.dragonflybsd.org/pipermail/users/2019-August/358271.html)
We have three new servers in the colo now that will be taking most/all bulk package building duties from monster and the two blades (muscles and pkgbox64) that previously did the work.   Monster will be retired.   The new servers are a dual-socket Xeon (sting) and two 3900X based systems (thor and loki) which all together burn only around half the wattage that monster burned (500W vs 1000W) and 3 times the performance.   That's at least a 6:1 improvement in performance efficiency.
With SSD prices down significantly the new machines have all-SSDs.  These new machines allow us to build dports binary packages for release, master, and staged at the same time and reduces the full-on bulk build times for getting all three done down from 2 weeks to 2 days.  It will allow us to more promptly synchronize updates to ports with dports and get binary packages up sooner.
Monster, our venerable 48-core quad-socket opteron is being retired.  This was a wonderful dev machine for working on DragonFly's SMP algorithms over the last 6+ years precisely because its inter-core and inter-socket latencies were quite high.  If a SMP algorithm wasn't spot-on, you could feel it.  Over the years DragonFly's performance on monster in doing things like bulk builds increased radically as the SMP algorithms got better and the cores became more and more localized.  This kept monster relevant far longer than I thought it would be.
But we are at a point now where improvements in efficiency are just too good to ignore.  Monster's quad-socket opteron (4  x 12 core 6168's) pulls 1000W under full load while a single Ryzen 3900X (12 core / 24 thread) in a server configuration pulls only 150W, and is slightly faster on the same workload to boot.
I would like to thank everyone's generous donations over the last few years!  We burned a few thousand on the new machines (as well as the major SSD upgrades we did to the blades) and made very good use of the money, particularly this year as prices for all major components (RAM, SSDs, CPUs, Mobos, etc) have dropped significantly.
Experimenting with streaming setups on NetBSD (https://dressupgeekout.blogspot.com/2019/08/experimenting-with-streaming-setups-on.html?m=1)
Ever since OBS was successfully ported to NetBSD, I’ve been trying it out, seeing what works and what doesn’t. I’ve only just gotten started, and there’ll definitely be a lot of tweaking going forward.
Capturing a specific application’s windows seems to work okay. Capturing an entire display works, too. I actually haven’t tried streaming to Twitch or YouTube yet, but in a previous experiment a few weeks ago, I was able to run a FFmpeg command line and that could stream to Twitch mostly OK.
My laptop combined with my external monitor allows me to have a dual-monitor setup wherein the smaller laptop screen can be my “broadcasting station” while the bigger screen is where all the action takes place. I can make OBS visible on all Xfce workspaces, but keep it tucked away on that display only. Altogether, the setup should let me use the big screen for the fun stuff but I can still monitor everything in the small screen.
NetBSD Made Progress Thanks To GSoC In Its March Towards Steam Support (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=NetBSD-Linux-DRM-Ioctl-GSoC2019)
Ultimately the goal is to get Valve's Steam client running on NetBSD using their Linux compatibility layer while the focus the past few months with Google Summer of Code 2019 were supporting the necessary DRM ioctls for allowing Linux software running on NetBSD to be able to tap accelerated graphics support.
Student developer Surya P spent the summer working on compat_netbsd32 DRM interfaces to allow Direct Rendering Manager using applications running under their Linux compatibility layer.
These interfaces have been tested and working as well as updating the "suse131" packages in NetBSD to make use of those interfaces. So the necessary interfaces are now in place for Linux software running on NetBSD to be able to use accelerated graphics though Steam itself isn't yet running on NetBSD with this layer.
Those curious about this DRM ioctl GSoC project can learn more from the NetBSD blog (https://blog.netbsd.org/tnf/entry/gsoc_2019_report_implementation_of). NetBSD has also been seeing work this summer on Wayland support and better Wine support to ultimately make this BSD a better desktop operating system and potentially a comparable gaming platform to Linux.
Beastie Bits
FreeBSD in Wellington? (https://twitter.com/MengTangmu/status/1163265206660694016)
FreeBSD on GFE (https://twitter.com/onewilshire/status/1163792878642114560)
Clarification (https://twitter.com/onewilshire/status/1166323112620826624) 
Distrotest.net now with BSDs (https://distrotest.net/)
Lecture: Anykernels meet fuzzing NetBSD (https://fahrplan.events.ccc.de/camp/2019/Fahrplan/events/10334.html)
Sun Microsystems business plan from 1982 [pdf] (https://www.khoslaventures.com/wp-content/uploads/SunMicrosystem_bus_plan.pdf)
Feedback/Questions
Alan - Questions (http://dpaste.com/1Z8EGTW)
Rodriguez - Feedback and a question (http://dpaste.com/2PZFP4X#wrap)
Jeff - OpenZFS follow-up, FreeBSD Adventures (http://dpaste.com/02ZM6YE#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, virtual memory, swap, swap space, VM, dsynth, workstation, servers, streaming, steam, gsoc</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Unix virtual memory when you have no swap space, Dsynth details on Dragonfly, Instant Workstation on FreeBSD, new servers new tech, Experimenting with streaming setups on NetBSD, NetBSD’s progress towards Steam support thanks to GSoC, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/NoSwapConsequence" rel="nofollow">What has to happen with Unix virtual memory when you have no swap space</a></h3>

<blockquote>
<p>Recently, Artem S. Tashkinov wrote on the Linux kernel mailing list about a Linux problem under memory pressure (via, and threaded here). The specific reproduction instructions involved having low RAM, turning off swap space, and then putting the system under load, and when that happened (emphasis mine):</p>

<p>Once you hit a situation when opening a new tab requires more RAM than is currently available, the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly (I&#39;m not entirely sure why). [...]</p>

<p>I&#39;m afraid I have bad news for the people snickering at Linux here; if you&#39;re running without swap space, you can probably get any Unix to behave this way under memory pressure. If you can&#39;t on your particular Unix, I&#39;d actually say that your Unix is probably not letting you get full use out of your RAM.</p>

<p>To simplify a bit, we can divide pages of user memory up into anonymous pages and file-backed pages. File-backed pages are what they sound like; they come from some specific file on the filesystem that they can be written out to (if they&#39;re dirty) or read back in from. Anonymous pages are not backed by a file, so the only place they can be written out to and read back in from is swap space. Anonymous pages mostly come from dynamic memory allocations and from modifying the program&#39;s global variables and data; file backed pages come mostly from mapping files into memory with mmap() and also, crucially, from the code and read-only data of the program.</p>
</blockquote>

<ul>
<li>See link for the rest of the article</li>
</ul>

<hr>

<h3><a href="https://www.dragonflydigest.com/2019/08/27/23398.html" rel="nofollow">Dsynth details on Dragonfly</a></h3>

<blockquote>
<p>First, history: DragonFly has had binaries of dports available for download for quite some time.  These were originally built using poudriere, and then using the synth tool put together by John Marino.  Synth worked both to build all software in dports, and as a way to test DragonFly’s SMP capability under extreme load.</p>

<p>Matthew Dillon is working on a new version, called dsynth.  It is available now but not yet part of the build.  He’s been working quickly on it and there’s plenty more commits than what I have linked here.  It’s already led to finding more high-load fixes.</p>
</blockquote>

<ul>
<li>dsynth</li>
</ul>

<blockquote>
<p>DSynth is basically synth written in C, from scratch.  It is designed to give us a bulk builder in base and be friendly to porting and jails down the line (for now its uses chroot&#39;s).</p>

<p>The original synth was written by John R. Marino and its basic flow was used in writing this program, but as it was written in ada no code was directly copied.</p>

<ul>
<li><p>The intent is to make dsynth compatible with synth&#39;s configuration files and directory structure.</p></li>
<li><p>This is a work in progress and not yet ready for prime-time.  Pushing so we can get some more eyeballs.  Most of the directives do not yet work (everything, and build works, and &#39;cleanup&#39; can be used to clean up any dangling mounts).</p></li>
</ul>
</blockquote>

<ul>
<li><a href="https://gitweb.dragonflybsd.org/dragonfly.git/blob/HEAD:/usr.bin/dsynth/dsynth.1" rel="nofollow">dsynth code</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://euroquis.nl/freebsd/2019/08/12/instant-workstation.html" rel="nofollow">Instant Workstation</a></h3>

<blockquote>
<p>Some considerable time ago I wrote up instructions on how to set up a FreeBSD machine with the latest KDE Plasma Desktop. Those instructions, while fairly short (set up X, install the KDE meta-port, .. and that’s it) are a bit fiddly.</p>

<p>So – prompted slightly by a Twitter exchange recently – I’ve started a mini-sub-project to script the installation of a desktop environment and the bits needed to support it. To give it at least a modicum of UI, dialog(1) is used to ask for an environment to install and a display manager.</p>

<p>The tricky bits – pointed out to me after I started – are hardware support, although a best-effort is better than having nothing, I think.</p>

<p>In any case, in a VBox host it’s now down to running a single script and picking Plasma and SDDM to get a usable system for me. Other combinations have not been tested, nor has system-hardware-setup. I’ll probably maintain it for a while and if I have time and energy it’ll be tried with nVidia (those work quite well on FreeBSD) and AMD (not so much, in my experience) graphics cards when I shuffle some machines around.</p>
</blockquote>

<ul>
<li><a href="https://raw.githubusercontent.com/adriaandegroot/FreeBSDTools/master/bin/instant-workstation" rel="nofollow">Here is the script in my GitHub repository with notes-for-myself.</a></li>
</ul>

<hr>

<h3><a href="https://www.dragonflydigest.com/2019/08/26/23396.html" rel="nofollow">New Servers, new Tech</a></h3>

<blockquote>
<p>Following up on an earlier post, the new servers for DragonFly are in place.   The old 40-core machine used for bulk build, monster, is being retired.  The power efficiency of the new machines is startling.  Incidentally, this is where donations go – infrastructure.</p>
</blockquote>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2019-August/358271.html" rel="nofollow">New servers in the colo, monster is being retired</a></li>
</ul>

<blockquote>
<p>We have three new servers in the colo now that will be taking most/all bulk package building duties from monster and the two blades (muscles and pkgbox64) that previously did the work.   Monster will be retired.   The new servers are a dual-socket Xeon (sting) and two 3900X based systems (thor and loki) which all together burn only around half the wattage that monster burned (500W vs 1000W) and 3 times the performance.   That&#39;s at least a 6:1 improvement in performance efficiency.</p>

<p>With SSD prices down significantly the new machines have all-SSDs.  These new machines allow us to build dports binary packages for release, master, and staged at the same time and reduces the full-on bulk build times for getting all three done down from 2 weeks to 2 days.  It will allow us to more promptly synchronize updates to ports with dports and get binary packages up sooner.</p>

<p>Monster, our venerable 48-core quad-socket opteron is being retired.  This was a wonderful dev machine for working on DragonFly&#39;s SMP algorithms over the last 6+ years precisely because its inter-core and inter-socket latencies were quite high.  If a SMP algorithm wasn&#39;t spot-on, you could feel it.  Over the years DragonFly&#39;s performance on monster in doing things like bulk builds increased radically as the SMP algorithms got better and the cores became more and more localized.  This kept monster relevant far longer than I thought it would be.</p>

<p>But we are at a point now where improvements in efficiency are just too good to ignore.  Monster&#39;s quad-socket opteron (4  x 12 core 6168&#39;s) pulls 1000W under full load while a single Ryzen 3900X (12 core / 24 thread) in a server configuration pulls only 150W, and is slightly faster on the same workload to boot.</p>

<p>I would like to thank everyone&#39;s generous donations over the last few years!  We burned a few thousand on the new machines (as well as the major SSD upgrades we did to the blades) and made very good use of the money, particularly this year as prices for all major components (RAM, SSDs, CPUs, Mobos, etc) have dropped significantly.</p>
</blockquote>

<hr>

<h3><a href="https://dressupgeekout.blogspot.com/2019/08/experimenting-with-streaming-setups-on.html?m=1" rel="nofollow">Experimenting with streaming setups on NetBSD</a></h3>

<blockquote>
<p>Ever since OBS was successfully ported to NetBSD, I’ve been trying it out, seeing what works and what doesn’t. I’ve only just gotten started, and there’ll definitely be a lot of tweaking going forward.</p>

<p>Capturing a specific application’s windows seems to work okay. Capturing an entire display works, too. I actually haven’t tried streaming to Twitch or YouTube yet, but in a previous experiment a few weeks ago, I was able to run a FFmpeg command line and that could stream to Twitch mostly OK.</p>

<p>My laptop combined with my external monitor allows me to have a dual-monitor setup wherein the smaller laptop screen can be my “broadcasting station” while the bigger screen is where all the action takes place. I can make OBS visible on all Xfce workspaces, but keep it tucked away on that display only. Altogether, the setup should let me use the big screen for the fun stuff but I can still monitor everything in the small screen.</p>
</blockquote>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=NetBSD-Linux-DRM-Ioctl-GSoC2019" rel="nofollow">NetBSD Made Progress Thanks To GSoC In Its March Towards Steam Support</a></h3>

<blockquote>
<p>Ultimately the goal is to get Valve&#39;s Steam client running on NetBSD using their Linux compatibility layer while the focus the past few months with Google Summer of Code 2019 were supporting the necessary DRM ioctls for allowing Linux software running on NetBSD to be able to tap accelerated graphics support.</p>

<p>Student developer Surya P spent the summer working on compat_netbsd32 DRM interfaces to allow Direct Rendering Manager using applications running under their Linux compatibility layer.</p>

<p>These interfaces have been tested and working as well as updating the &quot;suse131&quot; packages in NetBSD to make use of those interfaces. So the necessary interfaces are now in place for Linux software running on NetBSD to be able to use accelerated graphics though Steam itself isn&#39;t yet running on NetBSD with this layer.</p>

<p>Those curious about this DRM ioctl GSoC project can learn more from <a href="https://blog.netbsd.org/tnf/entry/gsoc_2019_report_implementation_of" rel="nofollow">the NetBSD blog</a>. NetBSD has also been seeing work this summer on Wayland support and better Wine support to ultimately make this BSD a better desktop operating system and potentially a comparable gaming platform to Linux.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/MengTangmu/status/1163265206660694016" rel="nofollow">FreeBSD in Wellington?</a></li>
<li><a href="https://twitter.com/onewilshire/status/1163792878642114560" rel="nofollow">FreeBSD on GFE</a></li>
<li><a href="https://twitter.com/onewilshire/status/1166323112620826624" rel="nofollow">Clarification</a> </li>
<li><a href="https://distrotest.net/" rel="nofollow">Distrotest.net now with BSDs</a></li>
<li><a href="https://fahrplan.events.ccc.de/camp/2019/Fahrplan/events/10334.html" rel="nofollow">Lecture: Anykernels meet fuzzing NetBSD</a></li>
<li><a href="https://www.khoslaventures.com/wp-content/uploads/SunMicrosystem_bus_plan.pdf" rel="nofollow">Sun Microsystems business plan from 1982 [pdf]</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Alan - <a href="http://dpaste.com/1Z8EGTW" rel="nofollow">Questions</a></li>
<li>Rodriguez - <a href="http://dpaste.com/2PZFP4X#wrap" rel="nofollow">Feedback and a question</a></li>
<li>Jeff - <a href="http://dpaste.com/02ZM6YE#wrap" rel="nofollow">OpenZFS follow-up, FreeBSD Adventures</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0314.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Unix virtual memory when you have no swap space, Dsynth details on Dragonfly, Instant Workstation on FreeBSD, new servers new tech, Experimenting with streaming setups on NetBSD, NetBSD’s progress towards Steam support thanks to GSoC, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/NoSwapConsequence" rel="nofollow">What has to happen with Unix virtual memory when you have no swap space</a></h3>

<blockquote>
<p>Recently, Artem S. Tashkinov wrote on the Linux kernel mailing list about a Linux problem under memory pressure (via, and threaded here). The specific reproduction instructions involved having low RAM, turning off swap space, and then putting the system under load, and when that happened (emphasis mine):</p>

<p>Once you hit a situation when opening a new tab requires more RAM than is currently available, the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly (I&#39;m not entirely sure why). [...]</p>

<p>I&#39;m afraid I have bad news for the people snickering at Linux here; if you&#39;re running without swap space, you can probably get any Unix to behave this way under memory pressure. If you can&#39;t on your particular Unix, I&#39;d actually say that your Unix is probably not letting you get full use out of your RAM.</p>

<p>To simplify a bit, we can divide pages of user memory up into anonymous pages and file-backed pages. File-backed pages are what they sound like; they come from some specific file on the filesystem that they can be written out to (if they&#39;re dirty) or read back in from. Anonymous pages are not backed by a file, so the only place they can be written out to and read back in from is swap space. Anonymous pages mostly come from dynamic memory allocations and from modifying the program&#39;s global variables and data; file backed pages come mostly from mapping files into memory with mmap() and also, crucially, from the code and read-only data of the program.</p>
</blockquote>

<ul>
<li>See link for the rest of the article</li>
</ul>

<hr>

<h3><a href="https://www.dragonflydigest.com/2019/08/27/23398.html" rel="nofollow">Dsynth details on Dragonfly</a></h3>

<blockquote>
<p>First, history: DragonFly has had binaries of dports available for download for quite some time.  These were originally built using poudriere, and then using the synth tool put together by John Marino.  Synth worked both to build all software in dports, and as a way to test DragonFly’s SMP capability under extreme load.</p>

<p>Matthew Dillon is working on a new version, called dsynth.  It is available now but not yet part of the build.  He’s been working quickly on it and there’s plenty more commits than what I have linked here.  It’s already led to finding more high-load fixes.</p>
</blockquote>

<ul>
<li>dsynth</li>
</ul>

<blockquote>
<p>DSynth is basically synth written in C, from scratch.  It is designed to give us a bulk builder in base and be friendly to porting and jails down the line (for now its uses chroot&#39;s).</p>

<p>The original synth was written by John R. Marino and its basic flow was used in writing this program, but as it was written in ada no code was directly copied.</p>

<ul>
<li><p>The intent is to make dsynth compatible with synth&#39;s configuration files and directory structure.</p></li>
<li><p>This is a work in progress and not yet ready for prime-time.  Pushing so we can get some more eyeballs.  Most of the directives do not yet work (everything, and build works, and &#39;cleanup&#39; can be used to clean up any dangling mounts).</p></li>
</ul>
</blockquote>

<ul>
<li><a href="https://gitweb.dragonflybsd.org/dragonfly.git/blob/HEAD:/usr.bin/dsynth/dsynth.1" rel="nofollow">dsynth code</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://euroquis.nl/freebsd/2019/08/12/instant-workstation.html" rel="nofollow">Instant Workstation</a></h3>

<blockquote>
<p>Some considerable time ago I wrote up instructions on how to set up a FreeBSD machine with the latest KDE Plasma Desktop. Those instructions, while fairly short (set up X, install the KDE meta-port, .. and that’s it) are a bit fiddly.</p>

<p>So – prompted slightly by a Twitter exchange recently – I’ve started a mini-sub-project to script the installation of a desktop environment and the bits needed to support it. To give it at least a modicum of UI, dialog(1) is used to ask for an environment to install and a display manager.</p>

<p>The tricky bits – pointed out to me after I started – are hardware support, although a best-effort is better than having nothing, I think.</p>

<p>In any case, in a VBox host it’s now down to running a single script and picking Plasma and SDDM to get a usable system for me. Other combinations have not been tested, nor has system-hardware-setup. I’ll probably maintain it for a while and if I have time and energy it’ll be tried with nVidia (those work quite well on FreeBSD) and AMD (not so much, in my experience) graphics cards when I shuffle some machines around.</p>
</blockquote>

<ul>
<li><a href="https://raw.githubusercontent.com/adriaandegroot/FreeBSDTools/master/bin/instant-workstation" rel="nofollow">Here is the script in my GitHub repository with notes-for-myself.</a></li>
</ul>

<hr>

<h3><a href="https://www.dragonflydigest.com/2019/08/26/23396.html" rel="nofollow">New Servers, new Tech</a></h3>

<blockquote>
<p>Following up on an earlier post, the new servers for DragonFly are in place.   The old 40-core machine used for bulk build, monster, is being retired.  The power efficiency of the new machines is startling.  Incidentally, this is where donations go – infrastructure.</p>
</blockquote>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2019-August/358271.html" rel="nofollow">New servers in the colo, monster is being retired</a></li>
</ul>

<blockquote>
<p>We have three new servers in the colo now that will be taking most/all bulk package building duties from monster and the two blades (muscles and pkgbox64) that previously did the work.   Monster will be retired.   The new servers are a dual-socket Xeon (sting) and two 3900X based systems (thor and loki) which all together burn only around half the wattage that monster burned (500W vs 1000W) and 3 times the performance.   That&#39;s at least a 6:1 improvement in performance efficiency.</p>

<p>With SSD prices down significantly the new machines have all-SSDs.  These new machines allow us to build dports binary packages for release, master, and staged at the same time and reduces the full-on bulk build times for getting all three done down from 2 weeks to 2 days.  It will allow us to more promptly synchronize updates to ports with dports and get binary packages up sooner.</p>

<p>Monster, our venerable 48-core quad-socket opteron is being retired.  This was a wonderful dev machine for working on DragonFly&#39;s SMP algorithms over the last 6+ years precisely because its inter-core and inter-socket latencies were quite high.  If a SMP algorithm wasn&#39;t spot-on, you could feel it.  Over the years DragonFly&#39;s performance on monster in doing things like bulk builds increased radically as the SMP algorithms got better and the cores became more and more localized.  This kept monster relevant far longer than I thought it would be.</p>

<p>But we are at a point now where improvements in efficiency are just too good to ignore.  Monster&#39;s quad-socket opteron (4  x 12 core 6168&#39;s) pulls 1000W under full load while a single Ryzen 3900X (12 core / 24 thread) in a server configuration pulls only 150W, and is slightly faster on the same workload to boot.</p>

<p>I would like to thank everyone&#39;s generous donations over the last few years!  We burned a few thousand on the new machines (as well as the major SSD upgrades we did to the blades) and made very good use of the money, particularly this year as prices for all major components (RAM, SSDs, CPUs, Mobos, etc) have dropped significantly.</p>
</blockquote>

<hr>

<h3><a href="https://dressupgeekout.blogspot.com/2019/08/experimenting-with-streaming-setups-on.html?m=1" rel="nofollow">Experimenting with streaming setups on NetBSD</a></h3>

<blockquote>
<p>Ever since OBS was successfully ported to NetBSD, I’ve been trying it out, seeing what works and what doesn’t. I’ve only just gotten started, and there’ll definitely be a lot of tweaking going forward.</p>

<p>Capturing a specific application’s windows seems to work okay. Capturing an entire display works, too. I actually haven’t tried streaming to Twitch or YouTube yet, but in a previous experiment a few weeks ago, I was able to run a FFmpeg command line and that could stream to Twitch mostly OK.</p>

<p>My laptop combined with my external monitor allows me to have a dual-monitor setup wherein the smaller laptop screen can be my “broadcasting station” while the bigger screen is where all the action takes place. I can make OBS visible on all Xfce workspaces, but keep it tucked away on that display only. Altogether, the setup should let me use the big screen for the fun stuff but I can still monitor everything in the small screen.</p>
</blockquote>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=NetBSD-Linux-DRM-Ioctl-GSoC2019" rel="nofollow">NetBSD Made Progress Thanks To GSoC In Its March Towards Steam Support</a></h3>

<blockquote>
<p>Ultimately the goal is to get Valve&#39;s Steam client running on NetBSD using their Linux compatibility layer while the focus the past few months with Google Summer of Code 2019 were supporting the necessary DRM ioctls for allowing Linux software running on NetBSD to be able to tap accelerated graphics support.</p>

<p>Student developer Surya P spent the summer working on compat_netbsd32 DRM interfaces to allow Direct Rendering Manager using applications running under their Linux compatibility layer.</p>

<p>These interfaces have been tested and working as well as updating the &quot;suse131&quot; packages in NetBSD to make use of those interfaces. So the necessary interfaces are now in place for Linux software running on NetBSD to be able to use accelerated graphics though Steam itself isn&#39;t yet running on NetBSD with this layer.</p>

<p>Those curious about this DRM ioctl GSoC project can learn more from <a href="https://blog.netbsd.org/tnf/entry/gsoc_2019_report_implementation_of" rel="nofollow">the NetBSD blog</a>. NetBSD has also been seeing work this summer on Wayland support and better Wine support to ultimately make this BSD a better desktop operating system and potentially a comparable gaming platform to Linux.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/MengTangmu/status/1163265206660694016" rel="nofollow">FreeBSD in Wellington?</a></li>
<li><a href="https://twitter.com/onewilshire/status/1163792878642114560" rel="nofollow">FreeBSD on GFE</a></li>
<li><a href="https://twitter.com/onewilshire/status/1166323112620826624" rel="nofollow">Clarification</a> </li>
<li><a href="https://distrotest.net/" rel="nofollow">Distrotest.net now with BSDs</a></li>
<li><a href="https://fahrplan.events.ccc.de/camp/2019/Fahrplan/events/10334.html" rel="nofollow">Lecture: Anykernels meet fuzzing NetBSD</a></li>
<li><a href="https://www.khoslaventures.com/wp-content/uploads/SunMicrosystem_bus_plan.pdf" rel="nofollow">Sun Microsystems business plan from 1982 [pdf]</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Alan - <a href="http://dpaste.com/1Z8EGTW" rel="nofollow">Questions</a></li>
<li>Rodriguez - <a href="http://dpaste.com/2PZFP4X#wrap" rel="nofollow">Feedback and a question</a></li>
<li>Jeff - <a href="http://dpaste.com/02ZM6YE#wrap" rel="nofollow">OpenZFS follow-up, FreeBSD Adventures</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0314.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>313: In-Kernel TLS</title>
  <link>https://www.bsdnow.tv/313</link>
  <guid isPermaLink="false">15bbd7ef-a3c7-4996-9751-d37aa7b5a255</guid>
  <pubDate>Thu, 29 Aug 2019 00:30:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/15bbd7ef-a3c7-4996-9751-d37aa7b5a255.mp3" length="39745015" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD on 7th gen Thinkpad X1 Carbon, how to install FreeBSD on a MacBook, Kernel portion of in-kernel TLS (KTLS), Boot Environments on DragonflyBSD, Project Trident Updates, vBSDcon schedule, and more.</itunes:subtitle>
  <itunes:duration>55:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD on 7th gen Thinkpad X1 Carbon, how to install FreeBSD on a MacBook, Kernel portion of in-kernel TLS (KTLS), Boot Environments on DragonflyBSD, Project Trident Updates, vBSDcon schedule, and more.
Headlines
OpenBSD on the Thinkpad X1 Carbon 7th Gen (https://jcs.org/2019/08/14/x1c7)
Another year, another ThinkPad X1 Carbon, this time with a Dolby Atmos sound system and a smaller battery.
The seventh generation X1 Carbon isn't much different than the fifth and sixth generations. I opted for the non-vPro Core i5-8265U, 16Gb of RAM, a 512Gb NVMe SSD, and a matte non-touch WQHD display at ~300 nits. A brighter 500-nit 4k display is available, though early reports indicated it severely impacts battery life.
Gone are the microSD card slot on the back and 1mm of overall thickness (from 15.95mm to 14.95mm), but also 6Whr of battery (down to 51Whr) and a little bit of travel in the keyboard and TrackPoint buttons. I still very much like the feel of both of them, so kudos to Lenovo for not going too far down the Apple route of sacrificing performance and usability just for a thinner profile.
On my fifth generation X1 Carbon, I used a vinyl plotter to cut out stickers to cover the webcam, "X1 Carbon" branding from the bottom of the display, the power button LED, and the "ThinkPad" branding from the lower part of the keyboard deck.
See link for the rest of the article
How To Install FreeBSD On A MacBook 1,1 or 2,1 (http://lexploit.com/freebsdmacbook1-1-2-1/)
 FreeBSD Setup For MacBook 1,1 and 2,1
FreeBSD with some additional setup can be installed on a MacBook 1,1 or 2,1. This article covers how to do so with FreeBSD 10-12.
Installing
FreeBSD can be installed as the only OS on your MacBook if desired. What you should have is:
A Mac OS X 10.4.6-10.7.5 installer. Unofficial versions modified for these MacBooks such as 10.8 also work.
A blank CD or DVD to burn the FreeBSD image to. Discs simply work best with these older MacBooks.
An ISO file of FreeBSD for x86. The AMD64 ISO does not boot due to the 32 bit EFI of these MacBooks.
Burn the ISO file to the blank CD or DVD. Once done, make sure it's in your MacBook and then power off the MacBook. Turn it on, and hold down the c key until the FreeBSD disc boots.
See link for the rest of the guide
News Roundup
Patch for review: Kernel portion of in-kernel TLS (KTLS) (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=351522)
One of the projects I have been working on for the past several months in conjunction with several other folks is upstreaming work from Netflix to handle some aspects of Transport Layer Security (TLS) in the kernel. In particular, this lets a web server use sendfile() to send static content on HTTPS connections.  There is a lot more detail in the review itself, so I will spare pasting a big wall of text here.  However, I have posted the patch to add the kernel-side of KTLS for review at the URL below.  KTLS also requires other patches to OpenSSL and nginx, but this review is only for the kernel bits.  Patches and reviews for the other bits will follow later.
https://reviews.freebsd.org/D21277
DragonFly Boot Enviroments (https://github.com/newnix/dfbeadm)
This is a tool inspired by the beadm utility for FreeBSD/Illumos systems that creates and manages ZFS boot environments. This utility in contrast is written from the ground up in C, this should provide better performance, integration, and extensibility than the POSIX sh and awk script it was inspired by. During the time this project has been worked on, beadm has been superseded by bectl on FreeBSD. After hammering out some of the outstanding internal logic issues, I might look at providing a similar interface to the command as bectl.
See link for the rest of the details
Project Trident Updates
19.08 Available (https://project-trident.org/post/2019-08-15_19.08_available/)
This is a general package update to the CURRENT release repository based upon TrueOS 19.08.
Legacy boot ISO functional again
This update includes the FreeBSD fixes for the “vesa” graphics driver for legacy-boot systems. The system can once again be installed on legacy-boot systems.
PACKAGE CHANGES FROM 19.07-U1
New Packages: 154
Deleted Packages: 394
Updated Packages: 4926
12-U3 Available (https://project-trident.org/post/2019-08-22_stable12-u3_available/)
This is the third general package update to the STABLE release repository based upon TrueOS 12-Stable.
PACKAGE CHANGES FROM STABLE 12-U2
New Packages: 105
Deleted Packages: 386
Updated Packages: 1046
vBSDcon (https://www.vbsdcon.com/schedule/)
vBSDcon 2019 will return to the Hyatt Regency in Reston, VA on September 5-7 2019.
***
Beastie Bits
The next NYCBUG meeting will be Sept 4 @ 18:45 (https://www.nycbug.org/index?action=view&amp;amp;id=10671)
Feedback/Questions
Tom - Questions (http://dpaste.com/1AXXK7G#wrap)
Michael - dfbeadm (http://dpaste.com/0PNEDYT#wrap)
Bostjan - Questions (http://dpaste.com/1N7T7BR#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, thinkpad, x1 carbon, macbook, install, installation, tls, kernel tls, ktls, boot environment, project trident, vbsdcon</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD on 7th gen Thinkpad X1 Carbon, how to install FreeBSD on a MacBook, Kernel portion of in-kernel TLS (KTLS), Boot Environments on DragonflyBSD, Project Trident Updates, vBSDcon schedule, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://jcs.org/2019/08/14/x1c7" rel="nofollow">OpenBSD on the Thinkpad X1 Carbon 7th Gen</a></h3>

<blockquote>
<p>Another year, another ThinkPad X1 Carbon, this time with a Dolby Atmos sound system and a smaller battery.<br>
The seventh generation X1 Carbon isn&#39;t much different than the fifth and sixth generations. I opted for the non-vPro Core i5-8265U, 16Gb of RAM, a 512Gb NVMe SSD, and a matte non-touch WQHD display at ~300 nits. A brighter 500-nit 4k display is available, though early reports indicated it severely impacts battery life.<br>
Gone are the microSD card slot on the back and 1mm of overall thickness (from 15.95mm to 14.95mm), but also 6Whr of battery (down to 51Whr) and a little bit of travel in the keyboard and TrackPoint buttons. I still very much like the feel of both of them, so kudos to Lenovo for not going too far down the Apple route of sacrificing performance and usability just for a thinner profile.<br>
On my fifth generation X1 Carbon, I used a vinyl plotter to cut out stickers to cover the webcam, &quot;X1 Carbon&quot; branding from the bottom of the display, the power button LED, and the &quot;ThinkPad&quot; branding from the lower part of the keyboard deck.</p>
</blockquote>

<ul>
<li>See link for the rest of the article</li>
</ul>

<hr>

<h3><a href="http://lexploit.com/freebsdmacbook1-1-2-1/" rel="nofollow">How To Install FreeBSD On A MacBook 1,1 or 2,1</a></h3>

<ul>
<li> FreeBSD Setup For MacBook 1,1 and 2,1</li>
</ul>

<blockquote>
<p>FreeBSD with some additional setup can be installed on a MacBook 1,1 or 2,1. This article covers how to do so with FreeBSD 10-12.</p>
</blockquote>

<ul>
<li>Installing</li>
</ul>

<blockquote>
<p>FreeBSD can be installed as the only OS on your MacBook if desired. What you should have is:</p>
</blockquote>

<ul>
<li>A Mac OS X 10.4.6-10.7.5 installer. Unofficial versions modified for these MacBooks such as 10.8 also work.</li>
<li>A blank CD or DVD to burn the FreeBSD image to. Discs simply work best with these older MacBooks.</li>
<li>An ISO file of FreeBSD for x86. The AMD64 ISO does not boot due to the 32 bit EFI of these MacBooks.</li>
<li><p>Burn the ISO file to the blank CD or DVD. Once done, make sure it&#39;s in your MacBook and then power off the MacBook. Turn it on, and hold down the c key until the FreeBSD disc boots.</p>

<ul>
<li>See link for the rest of the guide</li>
</ul></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=351522" rel="nofollow">Patch for review: Kernel portion of in-kernel TLS (KTLS)</a></h3>

<blockquote>
<p>One of the projects I have been working on for the past several months in conjunction with several other folks is upstreaming work from Netflix to handle some aspects of Transport Layer Security (TLS) in the kernel. In particular, this lets a web server use sendfile() to send static content on HTTPS connections.  There is a lot more detail in the review itself, so I will spare pasting a big wall of text here.  However, I have posted the patch to add the kernel-side of KTLS for review at the URL below.  KTLS also requires other patches to OpenSSL and nginx, but this review is only for the kernel bits.  Patches and reviews for the other bits will follow later.</p>
</blockquote>

<ul>
<li><a href="https://reviews.freebsd.org/D21277" rel="nofollow">https://reviews.freebsd.org/D21277</a></li>
</ul>

<hr>

<h3><a href="https://github.com/newnix/dfbeadm" rel="nofollow">DragonFly Boot Enviroments</a></h3>

<blockquote>
<p>This is a tool inspired by the beadm utility for FreeBSD/Illumos systems that creates and manages ZFS boot environments. This utility in contrast is written from the ground up in C, this should provide better performance, integration, and extensibility than the POSIX sh and awk script it was inspired by. During the time this project has been worked on, beadm has been superseded by bectl on FreeBSD. After hammering out some of the outstanding internal logic issues, I might look at providing a similar interface to the command as bectl.</p>
</blockquote>

<ul>
<li>See link for the rest of the details</li>
</ul>

<hr>

<h3>Project Trident Updates</h3>

<ul>
<li><a href="https://project-trident.org/post/2019-08-15_19.08_available/" rel="nofollow">19.08 Available</a></li>
</ul>

<blockquote>
<p>This is a general package update to the CURRENT release repository based upon TrueOS 19.08.<br>
Legacy boot ISO functional again<br>
This update includes the FreeBSD fixes for the “vesa” graphics driver for legacy-boot systems. The system can once again be installed on legacy-boot systems.</p>
</blockquote>

<ul>
<li><p>PACKAGE CHANGES FROM 19.07-U1</p>

<ul>
<li>New Packages: 154</li>
<li>Deleted Packages: 394</li>
<li>Updated Packages: 4926</li>
</ul></li>
<li><p><a href="https://project-trident.org/post/2019-08-22_stable12-u3_available/" rel="nofollow">12-U3 Available</a></p></li>
</ul>

<blockquote>
<p>This is the third general package update to the STABLE release repository based upon TrueOS 12-Stable.</p>
</blockquote>

<ul>
<li>PACKAGE CHANGES FROM STABLE 12-U2

<ul>
<li>New Packages: 105</li>
<li>Deleted Packages: 386</li>
<li>Updated Packages: 1046</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://www.vbsdcon.com/schedule/" rel="nofollow">vBSDcon</a></h3>

<ul>
<li>vBSDcon 2019 will return to the Hyatt Regency in Reston, VA on September 5-7 2019.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.nycbug.org/index?action=view&id=10671" rel="nofollow">The next NYCBUG meeting will be Sept 4 @ 18:45</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Tom - <a href="http://dpaste.com/1AXXK7G#wrap" rel="nofollow">Questions</a></li>
<li>Michael - <a href="http://dpaste.com/0PNEDYT#wrap" rel="nofollow">dfbeadm</a></li>
<li>Bostjan - <a href="http://dpaste.com/1N7T7BR#wrap" rel="nofollow">Questions</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0313.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD on 7th gen Thinkpad X1 Carbon, how to install FreeBSD on a MacBook, Kernel portion of in-kernel TLS (KTLS), Boot Environments on DragonflyBSD, Project Trident Updates, vBSDcon schedule, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://jcs.org/2019/08/14/x1c7" rel="nofollow">OpenBSD on the Thinkpad X1 Carbon 7th Gen</a></h3>

<blockquote>
<p>Another year, another ThinkPad X1 Carbon, this time with a Dolby Atmos sound system and a smaller battery.<br>
The seventh generation X1 Carbon isn&#39;t much different than the fifth and sixth generations. I opted for the non-vPro Core i5-8265U, 16Gb of RAM, a 512Gb NVMe SSD, and a matte non-touch WQHD display at ~300 nits. A brighter 500-nit 4k display is available, though early reports indicated it severely impacts battery life.<br>
Gone are the microSD card slot on the back and 1mm of overall thickness (from 15.95mm to 14.95mm), but also 6Whr of battery (down to 51Whr) and a little bit of travel in the keyboard and TrackPoint buttons. I still very much like the feel of both of them, so kudos to Lenovo for not going too far down the Apple route of sacrificing performance and usability just for a thinner profile.<br>
On my fifth generation X1 Carbon, I used a vinyl plotter to cut out stickers to cover the webcam, &quot;X1 Carbon&quot; branding from the bottom of the display, the power button LED, and the &quot;ThinkPad&quot; branding from the lower part of the keyboard deck.</p>
</blockquote>

<ul>
<li>See link for the rest of the article</li>
</ul>

<hr>

<h3><a href="http://lexploit.com/freebsdmacbook1-1-2-1/" rel="nofollow">How To Install FreeBSD On A MacBook 1,1 or 2,1</a></h3>

<ul>
<li> FreeBSD Setup For MacBook 1,1 and 2,1</li>
</ul>

<blockquote>
<p>FreeBSD with some additional setup can be installed on a MacBook 1,1 or 2,1. This article covers how to do so with FreeBSD 10-12.</p>
</blockquote>

<ul>
<li>Installing</li>
</ul>

<blockquote>
<p>FreeBSD can be installed as the only OS on your MacBook if desired. What you should have is:</p>
</blockquote>

<ul>
<li>A Mac OS X 10.4.6-10.7.5 installer. Unofficial versions modified for these MacBooks such as 10.8 also work.</li>
<li>A blank CD or DVD to burn the FreeBSD image to. Discs simply work best with these older MacBooks.</li>
<li>An ISO file of FreeBSD for x86. The AMD64 ISO does not boot due to the 32 bit EFI of these MacBooks.</li>
<li><p>Burn the ISO file to the blank CD or DVD. Once done, make sure it&#39;s in your MacBook and then power off the MacBook. Turn it on, and hold down the c key until the FreeBSD disc boots.</p>

<ul>
<li>See link for the rest of the guide</li>
</ul></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=351522" rel="nofollow">Patch for review: Kernel portion of in-kernel TLS (KTLS)</a></h3>

<blockquote>
<p>One of the projects I have been working on for the past several months in conjunction with several other folks is upstreaming work from Netflix to handle some aspects of Transport Layer Security (TLS) in the kernel. In particular, this lets a web server use sendfile() to send static content on HTTPS connections.  There is a lot more detail in the review itself, so I will spare pasting a big wall of text here.  However, I have posted the patch to add the kernel-side of KTLS for review at the URL below.  KTLS also requires other patches to OpenSSL and nginx, but this review is only for the kernel bits.  Patches and reviews for the other bits will follow later.</p>
</blockquote>

<ul>
<li><a href="https://reviews.freebsd.org/D21277" rel="nofollow">https://reviews.freebsd.org/D21277</a></li>
</ul>

<hr>

<h3><a href="https://github.com/newnix/dfbeadm" rel="nofollow">DragonFly Boot Enviroments</a></h3>

<blockquote>
<p>This is a tool inspired by the beadm utility for FreeBSD/Illumos systems that creates and manages ZFS boot environments. This utility in contrast is written from the ground up in C, this should provide better performance, integration, and extensibility than the POSIX sh and awk script it was inspired by. During the time this project has been worked on, beadm has been superseded by bectl on FreeBSD. After hammering out some of the outstanding internal logic issues, I might look at providing a similar interface to the command as bectl.</p>
</blockquote>

<ul>
<li>See link for the rest of the details</li>
</ul>

<hr>

<h3>Project Trident Updates</h3>

<ul>
<li><a href="https://project-trident.org/post/2019-08-15_19.08_available/" rel="nofollow">19.08 Available</a></li>
</ul>

<blockquote>
<p>This is a general package update to the CURRENT release repository based upon TrueOS 19.08.<br>
Legacy boot ISO functional again<br>
This update includes the FreeBSD fixes for the “vesa” graphics driver for legacy-boot systems. The system can once again be installed on legacy-boot systems.</p>
</blockquote>

<ul>
<li><p>PACKAGE CHANGES FROM 19.07-U1</p>

<ul>
<li>New Packages: 154</li>
<li>Deleted Packages: 394</li>
<li>Updated Packages: 4926</li>
</ul></li>
<li><p><a href="https://project-trident.org/post/2019-08-22_stable12-u3_available/" rel="nofollow">12-U3 Available</a></p></li>
</ul>

<blockquote>
<p>This is the third general package update to the STABLE release repository based upon TrueOS 12-Stable.</p>
</blockquote>

<ul>
<li>PACKAGE CHANGES FROM STABLE 12-U2

<ul>
<li>New Packages: 105</li>
<li>Deleted Packages: 386</li>
<li>Updated Packages: 1046</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://www.vbsdcon.com/schedule/" rel="nofollow">vBSDcon</a></h3>

<ul>
<li>vBSDcon 2019 will return to the Hyatt Regency in Reston, VA on September 5-7 2019.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.nycbug.org/index?action=view&id=10671" rel="nofollow">The next NYCBUG meeting will be Sept 4 @ 18:45</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Tom - <a href="http://dpaste.com/1AXXK7G#wrap" rel="nofollow">Questions</a></li>
<li>Michael - <a href="http://dpaste.com/0PNEDYT#wrap" rel="nofollow">dfbeadm</a></li>
<li>Bostjan - <a href="http://dpaste.com/1N7T7BR#wrap" rel="nofollow">Questions</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0313.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>312: Why Package Managers</title>
  <link>https://www.bsdnow.tv/312</link>
  <guid isPermaLink="false">6dfbd978-c8a2-45c6-a49a-3a4937d83c69</guid>
  <pubDate>Wed, 21 Aug 2019 23:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6dfbd978-c8a2-45c6-a49a-3a4937d83c69.mp3" length="51882863" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The UNIX Philosophy in 2019, why use package managers, touchpad interrupted, Porting wine to amd64 on NetBSD second evaluation report, Enhancing Syzkaller Support for NetBSD, all about the Pinebook Pro, killing a process and all of its descendants, fast software the best software, and more.</itunes:subtitle>
  <itunes:duration>1:12:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The UNIX Philosophy in 2019, why use package managers, touchpad interrupted, Porting wine to amd64 on NetBSD second evaluation report, Enhancing Syzkaller Support for NetBSD, all about the Pinebook Pro, killing a process and all of its descendants, fast software the best software, and more.
Headlines
The UNIX Philosophy in 2019 (https://triosdevelopers.com/jason.eckert/blog/Entries/2019/6/1_Entry_1.html)
Today, Linux and open source rules the world, and the UNIX philosophy is widely considered compulsory. Organizations are striving to build small, focused applications that work collaboratively in a cloud and microservices environment. We rely on the network, as well as HTTP (text) APIs for storing and referencing data. Moreover, nearly all configuration is stored and communicated using text (e.g. YAML, JSON or XML). And while the UNIX philosophy has changed dramatically over the past 5 decades, it hasn’t strayed too far from Ken Thompson’s original definition in 1973:
We write programs that do one thing and do it well
We write programs to work together
And we write programs that handle text streams, because that is a universal interface
Why Use Package Managers? (https://uwm.edu/hpc/software-management/)
Valuable research is often hindered or outright prevented by the inability to install software.  This need not be the case.
Since I began supporting research computing in 1999, I’ve frequently seen researchers struggle for days or weeks trying to install a single open source application.  In most cases, they ultimately failed.
In many cases, they could have easily installed the software in seconds with one simple command, using a package manager such as Debian packages, FreeBSD ports, MacPorts, or Pkgsrc, just to name a few.
Developer websites often contain poorly written instructions for doing “caveman installs”; manually downloading, unpacking, patching, and building the software.  The same laborious process must often be followed for other software packages on which it depends, which can sometimes number in the dozens.  Many researchers are simply unaware that there are easier ways to install the software they need.  Caveman installs are a colossal waste of man-hours.  If 1000 people around the globe spend an average of 20 hours each trying to install the same program that could have been installed with a package manager (this is not uncommon), then 20,000 man-hours have been lost that could have gone toward science.  How many important discoveries are delayed by this?
The elite research institutions have ample funding and dozens of IT staff dedicated to research computing.  They can churn out publications even if their operation is inefficient.  Most institutions, however, have few or no IT staff dedicated to research, and cannot afford to squander precious man-hours on temporary, one-off software installs.  The wise approach for those of us in that situation is to collaborate on making software deployment easier for everyone.  If we do so, then even the smallest research groups can leverage that work to be more productive and make more frequent contributions to science.
Fortunately, the vast majority of open source software installs can be made trivial for anyone to do for themselves.  Modern package managers perform all the same steps as a caveman install, but automatically.  Package managers also install dependencies for us automatically.
News Roundup
Touchpad, Interrupted (https://jcs.org/2019/07/28/ihidev)
For two years I've been driving myself crazy trying to figure out the source of a driver problem on OpenBSD: interrupts never arrived for certain touchpad devices. A couple weeks ago, I put out a public plea asking for help in case any non-OpenBSD developers recognized the problem, but while debugging an unrelated issue over the weekend, I finally solved it.
It's been a long journey and it's a technical tale, but here it is.
Porting wine to amd64 on NetBSD, second evaluation report (https://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on2)
Summary
Presently, Wine on amd64 is in test phase. It seems to work fine with caveats like LDLIBRARYPATH which has to be set as 32-bit Xorg libs don't have ${PREFIX}/emul/netbsd32/lib in its rpath section. The latter is due to us extracting 32-bit libs from tarballs in lieu of building 32-bit Xorg on amd64. As previously stated, pkgsrc doesn't search for pkgconfig files in ${PREFIX}/emul/netbsd32/lib which might have inadvertent effects that I am unaware of as of now. I shall be working on these issues during the final coding period. I would like to thank @leot, @maya and @christos for saving me from shooting myself in the foot many a time. I, admittedly, have had times when multiple approaches, which all seemed right at that time, perplexed me. I believe those are times when having a mentor counts, and I have been lucky enough to have really good ones. Once again, thanks to Google for this wonderful opportunity.
Enhancing Syzkaller Support for NetBSD, Part 2 (https://blog.netbsd.org/tnf/entry/enchancing_syzkaller_support_for_netbsd)
As a part of Google Summer of Code’19, I am working on improving the support for Syzkaller kernel fuzzer. Syzkaller is an unsupervised coverage-guided kernel fuzzer, that supports a variety of operating systems including NetBSD. This report details the work done during the second coding period.
You can also take a look at the first report to learn more about the initial support that we added. : https://blog.netbsd.org/tnf/entry/enhancingsyzkallersupportfornetbsd
July Update: All about the Pinebook Pro (https://www.pine64.org/2019/07/05/july-update-all-about-the-pinebook-pro/)
"So I said I won’t be talking about the BSDs, but I feel like I should at the very least give you a general overview of the RK3399 *BSD functionality. I’ll make it quick. I’ve spoken to *BSD devs whom worked on the RockPro64 and from what I’ve gathered (despite the different *BSDs having varying degree of support for the RK3399 SOC) many of the core features are already supported, which bodes well for *BSD on the Pro. That said, some of the things you’d require on a functional laptop – such as the LCD (using eDP) for instance – will not work on the Pinebook Pro using *BSD as of today. So clearly a degree of work is yet needed for a BSD to run on the device. However, keep in mind that *BSD developers will be receiving their units soon and by the time you receive yours some basic functionality may be available."
Killing a process and all of its descendants (http://morningcoffee.io/killing-a-process-and-all-of-its-descendants.html)
Killing processes in a Unix-like system can be trickier than expected. Last week I was debugging an odd issue related to job stopping on Semaphore. More specifically, an issue related to the killing of a running process in a job. Here are the highlights of what I learned:
Unix-like operating systems have sophisticated process relationships. Parent-child, process groups, sessions, and session leaders. However, the details are not uniform across operating systems like Linux and macOS. POSIX compliant operating systems support sending signals to process groups with a negative PID number.
Sending signals to all processes in a session is not trivial with syscalls.
Child processes started with exec inherit their parent signal configuration. If the parent process is ignoring the SIGHUP signal, for example, this configuration is propagated to the children.
The answer to the “What happens with orphaned process groups” question is not trivial.
Fast Software, the Best Software (https://craigmod.com/essays/fast_software/)
I love fast software. That is, software speedy both in function and interface. Software with minimal to no lag between wanting to activate or manipulate something and the thing happening. Lightness.
Software that’s speedy usually means it’s focused. Like a good tool, it often means that it’s simple, but that’s not necessarily true. Speed in software is probably the most valuable, least valued asset. To me, speedy software is the difference between an application smoothly integrating into your life, and one called upon with great reluctance. Fastness in software is like great margins in a book — makes you smile without necessarily knowing why.
But why is slow bad? Fast software is not always good software, but slow software is rarely able to rise to greatness. Fast software gives the user a chance to “meld” with its toolset. That is, not break flow. When the nerds upon Nerd Hill fight to the death over Vi and Emacs, it’s partly because they have such a strong affinity for the flow of the application and its meldiness. They have invested. The Tool Is Good, so they feel. Not breaking flow is an axiom of great tools.
A typewriter is an excellent tool because, even though it’s slow in a relative sense, every aspect of the machine itself operates as quickly as the user can move. It is focused. There are no delays when making a new line or slamming a key into the paper. Yes, you have to put a new sheet of paper into the machine at the end of a page, but that action becomes part of the flow of using the machine, and the accumulation of paper a visual indication of work completed. It is not wasted work. There are no fundamental mechanical delays in using the machine. The best software inches ever closer to the physical directness of something like a typewriter. (The machine may break down, of course, ribbons need to be changed — but this is maintenance and separate from the use of the tool. I’d be delighted to “maintain” Photoshop if it would lighten it up.)
Beastie Bits
Register for vBSDCon 2019, Sept 5-7 in Reston VA (https://vbsdcon.com/registration)
Register for EuroBSDCon 2019, Sept 19-22 in Lillehammer, Norway (https://2019.eurobsdcon.org/registration/)
Feedback/Questions
Paulo - FreeNAS Question (http://dpaste.com/2GDG7WR#wrap)
Marc - Changing VT without function keys? (http://dpaste.com/1AKC7A1#wrap)
Caleb - Patch, update, and upgrade management (http://dpaste.com/2D6J482#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, philosophy, package manager, touchpad, porting, wine, evaluation, syzkaller, pinebook pro, process</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The UNIX Philosophy in 2019, why use package managers, touchpad interrupted, Porting wine to amd64 on NetBSD second evaluation report, Enhancing Syzkaller Support for NetBSD, all about the Pinebook Pro, killing a process and all of its descendants, fast software the best software, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://triosdevelopers.com/jason.eckert/blog/Entries/2019/6/1_Entry_1.html" rel="nofollow">The UNIX Philosophy in 2019</a></h3>

<blockquote>
<p>Today, Linux and open source rules the world, and the UNIX philosophy is widely considered compulsory. Organizations are striving to build small, focused applications that work collaboratively in a cloud and microservices environment. We rely on the network, as well as HTTP (text) APIs for storing and referencing data. Moreover, nearly all configuration is stored and communicated using text (e.g. YAML, JSON or XML). And while the UNIX philosophy has changed dramatically over the past 5 decades, it hasn’t strayed too far from Ken Thompson’s original definition in 1973:</p>
</blockquote>

<ul>
<li>We write programs that do one thing and do it well</li>
<li>We write programs to work together</li>
<li>And we write programs that handle text streams, because that is a universal interface</li>
</ul>

<hr>

<h3><a href="https://uwm.edu/hpc/software-management/" rel="nofollow">Why Use Package Managers?</a></h3>

<blockquote>
<p>Valuable research is often hindered or outright prevented by the inability to install software.  This need not be the case.</p>

<p>Since I began supporting research computing in 1999, I’ve frequently seen researchers struggle for days or weeks trying to install a single open source application.  In most cases, they ultimately failed.</p>

<p>In many cases, they could have easily installed the software in seconds with one simple command, using a package manager such as Debian packages, FreeBSD ports, MacPorts, or Pkgsrc, just to name a few.</p>

<p>Developer websites often contain poorly written instructions for doing “caveman installs”; manually downloading, unpacking, patching, and building the software.  The same laborious process must often be followed for other software packages on which it depends, which can sometimes number in the dozens.  Many researchers are simply unaware that there are easier ways to install the software they need.  Caveman installs are a colossal waste of man-hours.  If 1000 people around the globe spend an average of 20 hours each trying to install the same program that could have been installed with a package manager (this is not uncommon), then 20,000 man-hours have been lost that could have gone toward science.  How many important discoveries are delayed by this?</p>

<p>The elite research institutions have ample funding and dozens of IT staff dedicated to research computing.  They can churn out publications even if their operation is inefficient.  Most institutions, however, have few or no IT staff dedicated to research, and cannot afford to squander precious man-hours on temporary, one-off software installs.  The wise approach for those of us in that situation is to collaborate on making software deployment easier for everyone.  If we do so, then even the smallest research groups can leverage that work to be more productive and make more frequent contributions to science.</p>

<p>Fortunately, the vast majority of open source software installs can be made trivial for anyone to do for themselves.  Modern package managers perform all the same steps as a caveman install, but automatically.  Package managers also install dependencies for us automatically.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2019/07/28/ihidev" rel="nofollow">Touchpad, Interrupted</a></h3>

<blockquote>
<p>For two years I&#39;ve been driving myself crazy trying to figure out the source of a driver problem on OpenBSD: interrupts never arrived for certain touchpad devices. A couple weeks ago, I put out a public plea asking for help in case any non-OpenBSD developers recognized the problem, but while debugging an unrelated issue over the weekend, I finally solved it.</p>

<p>It&#39;s been a long journey and it&#39;s a technical tale, but here it is.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on2" rel="nofollow">Porting wine to amd64 on NetBSD, second evaluation report</a></h3>

<ul>
<li>Summary</li>
</ul>

<blockquote>
<p>Presently, Wine on amd64 is in test phase. It seems to work fine with caveats like LD_LIBRARY_PATH which has to be set as 32-bit Xorg libs don&#39;t have ${PREFIX}/emul/netbsd32/lib in its rpath section. The latter is due to us extracting 32-bit libs from tarballs in lieu of building 32-bit Xorg on amd64. As previously stated, pkgsrc doesn&#39;t search for pkgconfig files in ${PREFIX}/emul/netbsd32/lib which might have inadvertent effects that I am unaware of as of now. I shall be working on these issues during the final coding period. I would like to thank @leot, @maya and @christos for saving me from shooting myself in the foot many a time. I, admittedly, have had times when multiple approaches, which all seemed right at that time, perplexed me. I believe those are times when having a mentor counts, and I have been lucky enough to have really good ones. Once again, thanks to Google for this wonderful opportunity.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/enchancing_syzkaller_support_for_netbsd" rel="nofollow">Enhancing Syzkaller Support for NetBSD, Part 2</a></h3>

<blockquote>
<p>As a part of Google Summer of Code’19, I am working on improving the support for Syzkaller kernel fuzzer. Syzkaller is an unsupervised coverage-guided kernel fuzzer, that supports a variety of operating systems including NetBSD. This report details the work done during the second coding period.</p>

<p>You can also take a look at the first report to learn more about the initial support that we added. : <a href="https://blog.netbsd.org/tnf/entry/enhancing_syzkaller_support_for_netbsd" rel="nofollow">https://blog.netbsd.org/tnf/entry/enhancing_syzkaller_support_for_netbsd</a></p>
</blockquote>

<hr>

<h3><a href="https://www.pine64.org/2019/07/05/july-update-all-about-the-pinebook-pro/" rel="nofollow">July Update: All about the Pinebook Pro</a></h3>

<blockquote>
<p>&quot;So I said I won’t be talking about the BSDs, but I feel like I should at the very least give you a general overview of the RK3399 *BSD functionality. I’ll make it quick. I’ve spoken to *BSD devs whom worked on the RockPro64 and from what I’ve gathered (despite the different *BSDs having varying degree of support for the RK3399 SOC) many of the core features are already supported, which bodes well for *BSD on the Pro. That said, some of the things you’d require on a functional laptop – such as the LCD (using eDP) for instance – will not work on the Pinebook Pro using *BSD as of today. So clearly a degree of work is yet needed for a BSD to run on the device. However, keep in mind that *BSD developers will be receiving their units soon and by the time you receive yours some basic functionality may be available.&quot;</p>
</blockquote>

<hr>

<h3><a href="http://morningcoffee.io/killing-a-process-and-all-of-its-descendants.html" rel="nofollow">Killing a process and all of its descendants</a></h3>

<blockquote>
<p>Killing processes in a Unix-like system can be trickier than expected. Last week I was debugging an odd issue related to job stopping on Semaphore. More specifically, an issue related to the killing of a running process in a job. Here are the highlights of what I learned:</p>

<p>Unix-like operating systems have sophisticated process relationships. Parent-child, process groups, sessions, and session leaders. However, the details are not uniform across operating systems like Linux and macOS. POSIX compliant operating systems support sending signals to process groups with a negative PID number.</p>

<p>Sending signals to all processes in a session is not trivial with syscalls.</p>

<p>Child processes started with exec inherit their parent signal configuration. If the parent process is ignoring the SIGHUP signal, for example, this configuration is propagated to the children.</p>

<p>The answer to the “What happens with orphaned process groups” question is not trivial.</p>
</blockquote>

<hr>

<h3><a href="https://craigmod.com/essays/fast_software/" rel="nofollow">Fast Software, the Best Software</a></h3>

<blockquote>
<p>I love fast software. That is, software speedy both in function and interface. Software with minimal to no lag between wanting to activate or manipulate something and the thing happening. Lightness.</p>

<p>Software that’s speedy usually means it’s focused. Like a good tool, it often means that it’s simple, but that’s not necessarily true. Speed in software is probably the most valuable, least valued asset. To me, speedy software is the difference between an application smoothly integrating into your life, and one called upon with great reluctance. Fastness in software is like great margins in a book — makes you smile without necessarily knowing why.</p>

<p>But why is slow bad? Fast software is not always good software, but slow software is rarely able to rise to greatness. Fast software gives the user a chance to “meld” with its toolset. That is, not break flow. When the nerds upon Nerd Hill fight to the death over Vi and Emacs, it’s partly because they have such a strong affinity for the flow of the application and its meldiness. They have invested. The Tool Is Good, so they feel. Not breaking flow is an axiom of great tools.</p>

<p>A typewriter is an excellent tool because, even though it’s slow in a relative sense, every aspect of the machine itself operates as quickly as the user can move. It is focused. There are no delays when making a new line or slamming a key into the paper. Yes, you have to put a new sheet of paper into the machine at the end of a page, but that action becomes part of the flow of using the machine, and the accumulation of paper a visual indication of work completed. It is not wasted work. There are no fundamental mechanical delays in using the machine. The best software inches ever closer to the physical directness of something like a typewriter. (The machine may break down, of course, ribbons need to be changed — but this is maintenance and separate from the use of the tool. I’d be delighted to “maintain” Photoshop if it would lighten it up.)</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://vbsdcon.com/registration" rel="nofollow">Register for vBSDCon 2019, Sept 5-7 in Reston VA</a></li>
<li><a href="https://2019.eurobsdcon.org/registration/" rel="nofollow">Register for EuroBSDCon 2019, Sept 19-22 in Lillehammer, Norway</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Paulo - <a href="http://dpaste.com/2GDG7WR#wrap" rel="nofollow">FreeNAS Question</a></li>
<li>Marc - <a href="http://dpaste.com/1AKC7A1#wrap" rel="nofollow">Changing VT without function keys?</a></li>
<li>Caleb - <a href="http://dpaste.com/2D6J482#wrap" rel="nofollow">Patch, update, and upgrade management</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0312.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The UNIX Philosophy in 2019, why use package managers, touchpad interrupted, Porting wine to amd64 on NetBSD second evaluation report, Enhancing Syzkaller Support for NetBSD, all about the Pinebook Pro, killing a process and all of its descendants, fast software the best software, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://triosdevelopers.com/jason.eckert/blog/Entries/2019/6/1_Entry_1.html" rel="nofollow">The UNIX Philosophy in 2019</a></h3>

<blockquote>
<p>Today, Linux and open source rules the world, and the UNIX philosophy is widely considered compulsory. Organizations are striving to build small, focused applications that work collaboratively in a cloud and microservices environment. We rely on the network, as well as HTTP (text) APIs for storing and referencing data. Moreover, nearly all configuration is stored and communicated using text (e.g. YAML, JSON or XML). And while the UNIX philosophy has changed dramatically over the past 5 decades, it hasn’t strayed too far from Ken Thompson’s original definition in 1973:</p>
</blockquote>

<ul>
<li>We write programs that do one thing and do it well</li>
<li>We write programs to work together</li>
<li>And we write programs that handle text streams, because that is a universal interface</li>
</ul>

<hr>

<h3><a href="https://uwm.edu/hpc/software-management/" rel="nofollow">Why Use Package Managers?</a></h3>

<blockquote>
<p>Valuable research is often hindered or outright prevented by the inability to install software.  This need not be the case.</p>

<p>Since I began supporting research computing in 1999, I’ve frequently seen researchers struggle for days or weeks trying to install a single open source application.  In most cases, they ultimately failed.</p>

<p>In many cases, they could have easily installed the software in seconds with one simple command, using a package manager such as Debian packages, FreeBSD ports, MacPorts, or Pkgsrc, just to name a few.</p>

<p>Developer websites often contain poorly written instructions for doing “caveman installs”; manually downloading, unpacking, patching, and building the software.  The same laborious process must often be followed for other software packages on which it depends, which can sometimes number in the dozens.  Many researchers are simply unaware that there are easier ways to install the software they need.  Caveman installs are a colossal waste of man-hours.  If 1000 people around the globe spend an average of 20 hours each trying to install the same program that could have been installed with a package manager (this is not uncommon), then 20,000 man-hours have been lost that could have gone toward science.  How many important discoveries are delayed by this?</p>

<p>The elite research institutions have ample funding and dozens of IT staff dedicated to research computing.  They can churn out publications even if their operation is inefficient.  Most institutions, however, have few or no IT staff dedicated to research, and cannot afford to squander precious man-hours on temporary, one-off software installs.  The wise approach for those of us in that situation is to collaborate on making software deployment easier for everyone.  If we do so, then even the smallest research groups can leverage that work to be more productive and make more frequent contributions to science.</p>

<p>Fortunately, the vast majority of open source software installs can be made trivial for anyone to do for themselves.  Modern package managers perform all the same steps as a caveman install, but automatically.  Package managers also install dependencies for us automatically.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2019/07/28/ihidev" rel="nofollow">Touchpad, Interrupted</a></h3>

<blockquote>
<p>For two years I&#39;ve been driving myself crazy trying to figure out the source of a driver problem on OpenBSD: interrupts never arrived for certain touchpad devices. A couple weeks ago, I put out a public plea asking for help in case any non-OpenBSD developers recognized the problem, but while debugging an unrelated issue over the weekend, I finally solved it.</p>

<p>It&#39;s been a long journey and it&#39;s a technical tale, but here it is.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on2" rel="nofollow">Porting wine to amd64 on NetBSD, second evaluation report</a></h3>

<ul>
<li>Summary</li>
</ul>

<blockquote>
<p>Presently, Wine on amd64 is in test phase. It seems to work fine with caveats like LD_LIBRARY_PATH which has to be set as 32-bit Xorg libs don&#39;t have ${PREFIX}/emul/netbsd32/lib in its rpath section. The latter is due to us extracting 32-bit libs from tarballs in lieu of building 32-bit Xorg on amd64. As previously stated, pkgsrc doesn&#39;t search for pkgconfig files in ${PREFIX}/emul/netbsd32/lib which might have inadvertent effects that I am unaware of as of now. I shall be working on these issues during the final coding period. I would like to thank @leot, @maya and @christos for saving me from shooting myself in the foot many a time. I, admittedly, have had times when multiple approaches, which all seemed right at that time, perplexed me. I believe those are times when having a mentor counts, and I have been lucky enough to have really good ones. Once again, thanks to Google for this wonderful opportunity.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/enchancing_syzkaller_support_for_netbsd" rel="nofollow">Enhancing Syzkaller Support for NetBSD, Part 2</a></h3>

<blockquote>
<p>As a part of Google Summer of Code’19, I am working on improving the support for Syzkaller kernel fuzzer. Syzkaller is an unsupervised coverage-guided kernel fuzzer, that supports a variety of operating systems including NetBSD. This report details the work done during the second coding period.</p>

<p>You can also take a look at the first report to learn more about the initial support that we added. : <a href="https://blog.netbsd.org/tnf/entry/enhancing_syzkaller_support_for_netbsd" rel="nofollow">https://blog.netbsd.org/tnf/entry/enhancing_syzkaller_support_for_netbsd</a></p>
</blockquote>

<hr>

<h3><a href="https://www.pine64.org/2019/07/05/july-update-all-about-the-pinebook-pro/" rel="nofollow">July Update: All about the Pinebook Pro</a></h3>

<blockquote>
<p>&quot;So I said I won’t be talking about the BSDs, but I feel like I should at the very least give you a general overview of the RK3399 *BSD functionality. I’ll make it quick. I’ve spoken to *BSD devs whom worked on the RockPro64 and from what I’ve gathered (despite the different *BSDs having varying degree of support for the RK3399 SOC) many of the core features are already supported, which bodes well for *BSD on the Pro. That said, some of the things you’d require on a functional laptop – such as the LCD (using eDP) for instance – will not work on the Pinebook Pro using *BSD as of today. So clearly a degree of work is yet needed for a BSD to run on the device. However, keep in mind that *BSD developers will be receiving their units soon and by the time you receive yours some basic functionality may be available.&quot;</p>
</blockquote>

<hr>

<h3><a href="http://morningcoffee.io/killing-a-process-and-all-of-its-descendants.html" rel="nofollow">Killing a process and all of its descendants</a></h3>

<blockquote>
<p>Killing processes in a Unix-like system can be trickier than expected. Last week I was debugging an odd issue related to job stopping on Semaphore. More specifically, an issue related to the killing of a running process in a job. Here are the highlights of what I learned:</p>

<p>Unix-like operating systems have sophisticated process relationships. Parent-child, process groups, sessions, and session leaders. However, the details are not uniform across operating systems like Linux and macOS. POSIX compliant operating systems support sending signals to process groups with a negative PID number.</p>

<p>Sending signals to all processes in a session is not trivial with syscalls.</p>

<p>Child processes started with exec inherit their parent signal configuration. If the parent process is ignoring the SIGHUP signal, for example, this configuration is propagated to the children.</p>

<p>The answer to the “What happens with orphaned process groups” question is not trivial.</p>
</blockquote>

<hr>

<h3><a href="https://craigmod.com/essays/fast_software/" rel="nofollow">Fast Software, the Best Software</a></h3>

<blockquote>
<p>I love fast software. That is, software speedy both in function and interface. Software with minimal to no lag between wanting to activate or manipulate something and the thing happening. Lightness.</p>

<p>Software that’s speedy usually means it’s focused. Like a good tool, it often means that it’s simple, but that’s not necessarily true. Speed in software is probably the most valuable, least valued asset. To me, speedy software is the difference between an application smoothly integrating into your life, and one called upon with great reluctance. Fastness in software is like great margins in a book — makes you smile without necessarily knowing why.</p>

<p>But why is slow bad? Fast software is not always good software, but slow software is rarely able to rise to greatness. Fast software gives the user a chance to “meld” with its toolset. That is, not break flow. When the nerds upon Nerd Hill fight to the death over Vi and Emacs, it’s partly because they have such a strong affinity for the flow of the application and its meldiness. They have invested. The Tool Is Good, so they feel. Not breaking flow is an axiom of great tools.</p>

<p>A typewriter is an excellent tool because, even though it’s slow in a relative sense, every aspect of the machine itself operates as quickly as the user can move. It is focused. There are no delays when making a new line or slamming a key into the paper. Yes, you have to put a new sheet of paper into the machine at the end of a page, but that action becomes part of the flow of using the machine, and the accumulation of paper a visual indication of work completed. It is not wasted work. There are no fundamental mechanical delays in using the machine. The best software inches ever closer to the physical directness of something like a typewriter. (The machine may break down, of course, ribbons need to be changed — but this is maintenance and separate from the use of the tool. I’d be delighted to “maintain” Photoshop if it would lighten it up.)</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://vbsdcon.com/registration" rel="nofollow">Register for vBSDCon 2019, Sept 5-7 in Reston VA</a></li>
<li><a href="https://2019.eurobsdcon.org/registration/" rel="nofollow">Register for EuroBSDCon 2019, Sept 19-22 in Lillehammer, Norway</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Paulo - <a href="http://dpaste.com/2GDG7WR#wrap" rel="nofollow">FreeNAS Question</a></li>
<li>Marc - <a href="http://dpaste.com/1AKC7A1#wrap" rel="nofollow">Changing VT without function keys?</a></li>
<li>Caleb - <a href="http://dpaste.com/2D6J482#wrap" rel="nofollow">Patch, update, and upgrade management</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0312.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>311: Conference Gear Breakdown</title>
  <link>https://www.bsdnow.tv/311</link>
  <guid isPermaLink="false">1d57e61a-57d9-4d3b-ac9a-c3a4c061da07</guid>
  <pubDate>Thu, 15 Aug 2019 09:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1d57e61a-57d9-4d3b-ac9a-c3a4c061da07.mp3" length="52868098" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>
NetBSD 9.0 release process has started, xargs, a tale of two spellcheckers, Adapting TriforceAFL for NetBSD, Exploiting a no-name freebsd kernel vulnerability, and more.</itunes:subtitle>
  <itunes:duration>1:13:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>NetBSD 9.0 release process has started, xargs, a tale of two spellcheckers, Adapting TriforceAFL for NetBSD, Exploiting a no-name freebsd kernel vulnerability, and more.
Headlines
NetBSD 9.0 release process has started (https://mail-index.netbsd.org/netbsd-announce/2019/07/31/msg000301.html)
If you have been following source-changes, you may have noticed the creation of the netbsd-9 branch! It has some really exciting items that we worked on:
+ New AArch64 architecture support:
 + Symmetric and asymmetrical multiprocessing support (aka big.LITTLE)
 + Support for running 32-bit binaries
 + UEFI and ACPI support
 + Support for SBSA/SBBR (server-class) hardware.
+ The FDT-ization of many ARM boards:
 + the 32-bit GENERIC kernel lists 129 different DTS configurations
 + the 64-bit GENERIC64 kernel lists 74 different DTS configurations
 + All supported by a single kernel, without requiring per-board configuration.
+ Graphics driver update, matching Linux 4.4, adding support for up to Kaby Lake based Intel graphics devices.
+ ZFS has been updated to a modern version and seen many bugfixes.
+ New hardware-accelerated virtualization via NVMM.
+ NPF performance improvements and bug fixes. A new lookup algorithm, thmap, is now the default.
+ NVMe performance improvements
+ Optional kernel ASLR support, and partial kernel ASLR for the default configuration.
+ Kernel sanitizers:
 + KLEAK, detecting memory leaks
 + KASAN, detecting memory overruns
 + KUBSAN, detecting undefined behaviour
 + These have been used together with continuous fuzzing via the syzkaller project to find many bugs that were fixed.
+ The removal of outdated networking components such as ISDN and all of its drivers
+ The installer is now capable of performing GPT UEFI installations.
+ Dramatically improved support for userland sanitizers, as well as the option to build all of NetBSD's userland using them for bug-finding.
+ Update to graphics userland: Mesa was updated to 18.3.4, and llvmpipe is now available for several architectures, providing 3D graphics even in the absence of a supported GPU.
We try to test NetBSD as best as we can, but your testing can help NetBSD 9.0 a great release. Please test it and let us know of any bugs you find.
+ Binaries are available at https://nycdn.netbsd.org/pub/NetBSD-daily/netbsd-9/latest/
xargs wtf (https://medium.com/@aarontharris/xargs-wtf-34d2618286b7)
 xargs is probably one of the more difficult to understand of the unix command arsenal and of course that just means it’s one of the most useful too.
I discovered a handy trick that I thought was worth a share. Please note there are probably other (better) ways to do this but I did my stackoverflow research and found nothing better.
xargs — at least how I’ve most utilized it — is handy for taking some number of lines as input and doing some work per line. It’s hard to be more specific than that as it does so much else.
It literally took me an hour of piecing together random man pages + tips from 11 year olds on stack overflow, but eventually I produced this gem:
This is an example of how to find files matching a certain pattern and rename each of them. It sounds so trivial (and it is) but it demonstrates some cool tricks in an easy concept.
News Roundup
PkgSrc: A Tale of Two Spellcheckers (https://bentsukun.ch/posts/pkgsrccon-2019/)
This is a transcript of the talk I gave at pkgsrcCon 2019 in Cambridge, UK. It is about spellcheckers, but there are much more general software engineering lessons that we can learn from this case study.
The reason I got into this subject at all was my paternal leave last year, when I finally had some more time to spend working on pkgsrc. It was a tiny item in the enormous TODO file at the top of the source tree (“update enchant to version 2.2”) that made me go into this rabbit hole.
Adapting TriforceAFL for NetBSD, Part 2 (https://blog.netbsd.org/tnf/entry/adapting_triforceafl_for_netbsd_part1)
I have been working on adapting TriforceAFL for NetBSD kernel syscall fuzzing. This blog post summarizes the work done until the second evaluation.
For work done during the first coding period, check out this post.
Summary
&amp;gt; So far, the TriforceNetBSDSyscallFuzzer has been made available in the form of a pkgsrc package with the ability to fuzz most of NetBSD syscalls. In the final coding period of GSoC. I plan to analyse the crashes that were found until now. Integrate sanitizers, try and find more bugs and finally wrap up neatly with detailed documentation.
&amp;gt; Last but not least, I would like to thank my mentor, Kamil Rytarowski for helping me through the process and guiding me. It has been a wonderful learning experience so far!
Exploiting a no-name freebsd kernel vulnerability (https://www.synacktiv.com/posts/exploit/exploiting-a-no-name-freebsd-kernel-vulnerability.html)
A new patch has been recently shipped in FreeBSD kernels to fix a vulnerability (cve-2019-5602) present in the cdrom device. In this post, we will introduce the bug and discuss its exploitation on pre/post-SMEP FreeBSD revisions.
&amp;gt; A closer look at the commit 6bcf6e3 shows that when invoking the CDIOCREADSUBCHANNEL_SYSSPACE ioctl, data are copied with bcopy instead of the copyout primitive. This endows a local attacker belonging to the operator group with an arbitrary write primitive in the kernel memory.
[Allan and Benedicts Conference Gear Breakdown]

Benedict’s Gear:
GlocalMe G3 Mobile Travel HotSpot and Powerbank (https://www.glocalme.com/CA/en-US/cloudsim/g3)
Mogics Power Bagel (http://www.mogics.com/3824-2)
Charby Sense Power Cable (https://charbycharge.com/charby-sense-worlds-smartest-auto-cutoff-cable/)
Allan’s Gear:
Huawei E5770s-320 4G LTE 150 Mbps Mobile WiFi Pro (https://smile.amazon.com/gp/product/B013CEGGKI/)
AOW Global Data SIM Card for On-Demand 4G LTE Mobile Data in Over 90 Countries (https://smile.amazon.com/dp/B071HJFX27/)
All my devices charge from USB-C, so that is great
More USB thumb drives than strictly necessary
My Lenovo X270 laptop running FreeBSD 13-current
My 2016 Macbook Pro (a prize from the raffle at vBSDCon 2017) that I use for email and video conferencing to preserve battery on my FreeBSD machine for work
Beastie Bits
Replacing the Unix tradition (Warning may be rage inducing) (https://www.youtube.com/watch?v=L9v4Mg8wi4U&amp;amp;feature=youtu.be)
Installing OpenBSD over remote serial on the AtomicPI (https://www.thanassis.space/remoteserial.html#remoteserial)
Zen 2 and DragonFly (https://www.dragonflydigest.com/2019/08/05/23294.html)
Improve Docking on FreeBSD (https://blog.yukiisbo.red/posts/2019/05/improve-docking-on-freebsd/)
Register for vBSDCon 2019, Sept 5-7 in Reston VA. Early bird ends August 15th. (https://vbsdcon.com/registration)
Register for EuroBSDCon 2019, Sept 19-22 in Lillehammer, Norway (https://2019.eurobsdcon.org/registration/)
Feedback/Questions
JT - Congrats (http://dpaste.com/0D7Y31E#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, xargs, spellchecker, tale, triforceafl, kernel, vulnerability, conference, gear, tools, gadgets, utilities</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>NetBSD 9.0 release process has started, xargs, a tale of two spellcheckers, Adapting TriforceAFL for NetBSD, Exploiting a no-name freebsd kernel vulnerability, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-announce/2019/07/31/msg000301.html" rel="nofollow">NetBSD 9.0 release process has started</a></h3>

<blockquote>
<p>If you have been following source-changes, you may have noticed the creation of the netbsd-9 branch! It has some really exciting items that we worked on:</p>

<ul>
<li>New AArch64 architecture support:

<ul>
<li>Symmetric and asymmetrical multiprocessing support (aka big.LITTLE)</li>
<li>Support for running 32-bit binaries</li>
<li>UEFI and ACPI support</li>
<li>Support for SBSA/SBBR (server-class) hardware.</li>
</ul></li>
<li>The FDT-ization of many ARM boards:

<ul>
<li>the 32-bit GENERIC kernel lists 129 different DTS configurations</li>
<li>the 64-bit GENERIC64 kernel lists 74 different DTS configurations</li>
<li>All supported by a single kernel, without requiring per-board configuration.</li>
</ul></li>
<li>Graphics driver update, matching Linux 4.4, adding support for up to Kaby Lake based Intel graphics devices.</li>
<li>ZFS has been updated to a modern version and seen many bugfixes.</li>
<li>New hardware-accelerated virtualization via NVMM.</li>
<li>NPF performance improvements and bug fixes. A new lookup algorithm, thmap, is now the default.</li>
<li>NVMe performance improvements</li>
<li>Optional kernel ASLR support, and partial kernel ASLR for the default configuration.</li>
<li>Kernel sanitizers:

<ul>
<li>KLEAK, detecting memory leaks</li>
<li>KASAN, detecting memory overruns</li>
<li>KUBSAN, detecting undefined behaviour</li>
<li>These have been used together with continuous fuzzing via the syzkaller project to find many bugs that were fixed.</li>
</ul></li>
<li>The removal of outdated networking components such as ISDN and all of its drivers</li>
<li>The installer is now capable of performing GPT UEFI installations.</li>
<li>Dramatically improved support for userland sanitizers, as well as the option to build all of NetBSD&#39;s userland using them for bug-finding.</li>
<li>Update to graphics userland: Mesa was updated to 18.3.4, and llvmpipe is now available for several architectures, providing 3D graphics even in the absence of a supported GPU.</li>
</ul>

<p>We try to test NetBSD as best as we can, but your testing can help NetBSD 9.0 a great release. Please test it and let us know of any bugs you find.</p>

<ul>
<li>Binaries are available at <a href="https://nycdn.netbsd.org/pub/NetBSD-daily/netbsd-9/latest/" rel="nofollow">https://nycdn.netbsd.org/pub/NetBSD-daily/netbsd-9/latest/</a></li>
</ul>
</blockquote>

<hr>

<h3><a href="https://medium.com/@aarontharris/xargs-wtf-34d2618286b7" rel="nofollow">xargs wtf</a></h3>

<blockquote>
<p>xargs is probably one of the more difficult to understand of the unix command arsenal and of course that just means it’s one of the most useful too.<br>
I discovered a handy trick that I thought was worth a share. Please note there are probably other (better) ways to do this but I did my stackoverflow research and found nothing better.<br>
xargs — at least how I’ve most utilized it — is handy for taking some number of lines as input and doing some work per line. It’s hard to be more specific than that as it does so much else.<br>
It literally took me an hour of piecing together random man pages + tips from 11 year olds on stack overflow, but eventually I produced this gem:<br>
This is an example of how to find files matching a certain pattern and rename each of them. It sounds so trivial (and it is) but it demonstrates some cool tricks in an easy concept.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://bentsukun.ch/posts/pkgsrccon-2019/" rel="nofollow">PkgSrc: A Tale of Two Spellcheckers</a></h3>

<blockquote>
<p>This is a transcript of the talk I gave at pkgsrcCon 2019 in Cambridge, UK. It is about spellcheckers, but there are much more general software engineering lessons that we can learn from this case study.<br>
The reason I got into this subject at all was my paternal leave last year, when I finally had some more time to spend working on pkgsrc. It was a tiny item in the enormous TODO file at the top of the source tree (“update enchant to version 2.2”) that made me go into this rabbit hole.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/adapting_triforceafl_for_netbsd_part1" rel="nofollow">Adapting TriforceAFL for NetBSD, Part 2</a></h3>

<blockquote>
<p>I have been working on adapting TriforceAFL for NetBSD kernel syscall fuzzing. This blog post summarizes the work done until the second evaluation.<br>
For work done during the first coding period, check out this post.</p>
</blockquote>

<ul>
<li>Summary
&gt; So far, the TriforceNetBSDSyscallFuzzer has been made available in the form of a pkgsrc package with the ability to fuzz most of NetBSD syscalls. In the final coding period of GSoC. I plan to analyse the crashes that were found until now. Integrate sanitizers, try and find more bugs and finally wrap up neatly with detailed documentation.
&gt; Last but not least, I would like to thank my mentor, Kamil Rytarowski for helping me through the process and guiding me. It has been a wonderful learning experience so far!</li>
</ul>

<hr>

<h3><a href="https://www.synacktiv.com/posts/exploit/exploiting-a-no-name-freebsd-kernel-vulnerability.html" rel="nofollow">Exploiting a no-name freebsd kernel vulnerability</a></h3>

<ul>
<li>A new patch has been recently shipped in FreeBSD kernels to fix a vulnerability (cve-2019-5602) present in the cdrom device. In this post, we will introduce the bug and discuss its exploitation on pre/post-SMEP FreeBSD revisions.
&gt; A closer look at the commit 6bcf6e3 shows that when invoking the CDIOCREADSUBCHANNEL_SYSSPACE ioctl, data are copied with bcopy instead of the copyout primitive. This endows a local attacker belonging to the operator group with an arbitrary write primitive in the kernel memory.</li>
</ul>

<hr>

<h3>[Allan and Benedicts Conference Gear Breakdown]</h3>

<ul>
<li></li>
<li><p>Benedict’s Gear:</p>

<blockquote>
<p><a href="https://www.glocalme.com/CA/en-US/cloudsim/g3" rel="nofollow">GlocalMe G3 Mobile Travel HotSpot and Powerbank</a><br>
<a href="http://www.mogics.com/3824-2" rel="nofollow">Mogics Power Bagel</a><br>
<a href="https://charbycharge.com/charby-sense-worlds-smartest-auto-cutoff-cable/" rel="nofollow">Charby Sense Power Cable</a></p>
</blockquote></li>
<li><p>Allan’s Gear:</p>

<blockquote>
<p><a href="https://smile.amazon.com/gp/product/B013CEGGKI/" rel="nofollow">Huawei E5770s-320 4G LTE 150 Mbps Mobile WiFi Pro</a><br>
<a href="https://smile.amazon.com/dp/B071HJFX27/" rel="nofollow">AOW Global Data SIM Card for On-Demand 4G LTE Mobile Data in Over 90 Countries</a><br>
All my devices charge from USB-C, so that is great<br>
More USB thumb drives than strictly necessary<br>
My Lenovo X270 laptop running FreeBSD 13-current<br>
My 2016 Macbook Pro (a prize from the raffle at vBSDCon 2017) that I use for email and video conferencing to preserve battery on my FreeBSD machine for work</p>
</blockquote></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=L9v4Mg8wi4U&feature=youtu.be" rel="nofollow">Replacing the Unix tradition (Warning may be rage inducing)</a></li>
<li><a href="https://www.thanassis.space/remoteserial.html#remoteserial" rel="nofollow">Installing OpenBSD over remote serial on the AtomicPI</a></li>
<li><a href="https://www.dragonflydigest.com/2019/08/05/23294.html" rel="nofollow">Zen 2 and DragonFly</a></li>
<li><a href="https://blog.yukiisbo.red/posts/2019/05/improve-docking-on-freebsd/" rel="nofollow">Improve Docking on FreeBSD</a></li>
<li><a href="https://vbsdcon.com/registration" rel="nofollow">Register for vBSDCon 2019, Sept 5-7 in Reston VA. Early bird ends August 15th.</a></li>
<li><a href="https://2019.eurobsdcon.org/registration/" rel="nofollow">Register for EuroBSDCon 2019, Sept 19-22 in Lillehammer, Norway</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>JT - <a href="http://dpaste.com/0D7Y31E#wrap" rel="nofollow">Congrats</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0311.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>NetBSD 9.0 release process has started, xargs, a tale of two spellcheckers, Adapting TriforceAFL for NetBSD, Exploiting a no-name freebsd kernel vulnerability, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-announce/2019/07/31/msg000301.html" rel="nofollow">NetBSD 9.0 release process has started</a></h3>

<blockquote>
<p>If you have been following source-changes, you may have noticed the creation of the netbsd-9 branch! It has some really exciting items that we worked on:</p>

<ul>
<li>New AArch64 architecture support:

<ul>
<li>Symmetric and asymmetrical multiprocessing support (aka big.LITTLE)</li>
<li>Support for running 32-bit binaries</li>
<li>UEFI and ACPI support</li>
<li>Support for SBSA/SBBR (server-class) hardware.</li>
</ul></li>
<li>The FDT-ization of many ARM boards:

<ul>
<li>the 32-bit GENERIC kernel lists 129 different DTS configurations</li>
<li>the 64-bit GENERIC64 kernel lists 74 different DTS configurations</li>
<li>All supported by a single kernel, without requiring per-board configuration.</li>
</ul></li>
<li>Graphics driver update, matching Linux 4.4, adding support for up to Kaby Lake based Intel graphics devices.</li>
<li>ZFS has been updated to a modern version and seen many bugfixes.</li>
<li>New hardware-accelerated virtualization via NVMM.</li>
<li>NPF performance improvements and bug fixes. A new lookup algorithm, thmap, is now the default.</li>
<li>NVMe performance improvements</li>
<li>Optional kernel ASLR support, and partial kernel ASLR for the default configuration.</li>
<li>Kernel sanitizers:

<ul>
<li>KLEAK, detecting memory leaks</li>
<li>KASAN, detecting memory overruns</li>
<li>KUBSAN, detecting undefined behaviour</li>
<li>These have been used together with continuous fuzzing via the syzkaller project to find many bugs that were fixed.</li>
</ul></li>
<li>The removal of outdated networking components such as ISDN and all of its drivers</li>
<li>The installer is now capable of performing GPT UEFI installations.</li>
<li>Dramatically improved support for userland sanitizers, as well as the option to build all of NetBSD&#39;s userland using them for bug-finding.</li>
<li>Update to graphics userland: Mesa was updated to 18.3.4, and llvmpipe is now available for several architectures, providing 3D graphics even in the absence of a supported GPU.</li>
</ul>

<p>We try to test NetBSD as best as we can, but your testing can help NetBSD 9.0 a great release. Please test it and let us know of any bugs you find.</p>

<ul>
<li>Binaries are available at <a href="https://nycdn.netbsd.org/pub/NetBSD-daily/netbsd-9/latest/" rel="nofollow">https://nycdn.netbsd.org/pub/NetBSD-daily/netbsd-9/latest/</a></li>
</ul>
</blockquote>

<hr>

<h3><a href="https://medium.com/@aarontharris/xargs-wtf-34d2618286b7" rel="nofollow">xargs wtf</a></h3>

<blockquote>
<p>xargs is probably one of the more difficult to understand of the unix command arsenal and of course that just means it’s one of the most useful too.<br>
I discovered a handy trick that I thought was worth a share. Please note there are probably other (better) ways to do this but I did my stackoverflow research and found nothing better.<br>
xargs — at least how I’ve most utilized it — is handy for taking some number of lines as input and doing some work per line. It’s hard to be more specific than that as it does so much else.<br>
It literally took me an hour of piecing together random man pages + tips from 11 year olds on stack overflow, but eventually I produced this gem:<br>
This is an example of how to find files matching a certain pattern and rename each of them. It sounds so trivial (and it is) but it demonstrates some cool tricks in an easy concept.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://bentsukun.ch/posts/pkgsrccon-2019/" rel="nofollow">PkgSrc: A Tale of Two Spellcheckers</a></h3>

<blockquote>
<p>This is a transcript of the talk I gave at pkgsrcCon 2019 in Cambridge, UK. It is about spellcheckers, but there are much more general software engineering lessons that we can learn from this case study.<br>
The reason I got into this subject at all was my paternal leave last year, when I finally had some more time to spend working on pkgsrc. It was a tiny item in the enormous TODO file at the top of the source tree (“update enchant to version 2.2”) that made me go into this rabbit hole.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/adapting_triforceafl_for_netbsd_part1" rel="nofollow">Adapting TriforceAFL for NetBSD, Part 2</a></h3>

<blockquote>
<p>I have been working on adapting TriforceAFL for NetBSD kernel syscall fuzzing. This blog post summarizes the work done until the second evaluation.<br>
For work done during the first coding period, check out this post.</p>
</blockquote>

<ul>
<li>Summary
&gt; So far, the TriforceNetBSDSyscallFuzzer has been made available in the form of a pkgsrc package with the ability to fuzz most of NetBSD syscalls. In the final coding period of GSoC. I plan to analyse the crashes that were found until now. Integrate sanitizers, try and find more bugs and finally wrap up neatly with detailed documentation.
&gt; Last but not least, I would like to thank my mentor, Kamil Rytarowski for helping me through the process and guiding me. It has been a wonderful learning experience so far!</li>
</ul>

<hr>

<h3><a href="https://www.synacktiv.com/posts/exploit/exploiting-a-no-name-freebsd-kernel-vulnerability.html" rel="nofollow">Exploiting a no-name freebsd kernel vulnerability</a></h3>

<ul>
<li>A new patch has been recently shipped in FreeBSD kernels to fix a vulnerability (cve-2019-5602) present in the cdrom device. In this post, we will introduce the bug and discuss its exploitation on pre/post-SMEP FreeBSD revisions.
&gt; A closer look at the commit 6bcf6e3 shows that when invoking the CDIOCREADSUBCHANNEL_SYSSPACE ioctl, data are copied with bcopy instead of the copyout primitive. This endows a local attacker belonging to the operator group with an arbitrary write primitive in the kernel memory.</li>
</ul>

<hr>

<h3>[Allan and Benedicts Conference Gear Breakdown]</h3>

<ul>
<li></li>
<li><p>Benedict’s Gear:</p>

<blockquote>
<p><a href="https://www.glocalme.com/CA/en-US/cloudsim/g3" rel="nofollow">GlocalMe G3 Mobile Travel HotSpot and Powerbank</a><br>
<a href="http://www.mogics.com/3824-2" rel="nofollow">Mogics Power Bagel</a><br>
<a href="https://charbycharge.com/charby-sense-worlds-smartest-auto-cutoff-cable/" rel="nofollow">Charby Sense Power Cable</a></p>
</blockquote></li>
<li><p>Allan’s Gear:</p>

<blockquote>
<p><a href="https://smile.amazon.com/gp/product/B013CEGGKI/" rel="nofollow">Huawei E5770s-320 4G LTE 150 Mbps Mobile WiFi Pro</a><br>
<a href="https://smile.amazon.com/dp/B071HJFX27/" rel="nofollow">AOW Global Data SIM Card for On-Demand 4G LTE Mobile Data in Over 90 Countries</a><br>
All my devices charge from USB-C, so that is great<br>
More USB thumb drives than strictly necessary<br>
My Lenovo X270 laptop running FreeBSD 13-current<br>
My 2016 Macbook Pro (a prize from the raffle at vBSDCon 2017) that I use for email and video conferencing to preserve battery on my FreeBSD machine for work</p>
</blockquote></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=L9v4Mg8wi4U&feature=youtu.be" rel="nofollow">Replacing the Unix tradition (Warning may be rage inducing)</a></li>
<li><a href="https://www.thanassis.space/remoteserial.html#remoteserial" rel="nofollow">Installing OpenBSD over remote serial on the AtomicPI</a></li>
<li><a href="https://www.dragonflydigest.com/2019/08/05/23294.html" rel="nofollow">Zen 2 and DragonFly</a></li>
<li><a href="https://blog.yukiisbo.red/posts/2019/05/improve-docking-on-freebsd/" rel="nofollow">Improve Docking on FreeBSD</a></li>
<li><a href="https://vbsdcon.com/registration" rel="nofollow">Register for vBSDCon 2019, Sept 5-7 in Reston VA. Early bird ends August 15th.</a></li>
<li><a href="https://2019.eurobsdcon.org/registration/" rel="nofollow">Register for EuroBSDCon 2019, Sept 19-22 in Lillehammer, Norway</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>JT - <a href="http://dpaste.com/0D7Y31E#wrap" rel="nofollow">Congrats</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0311.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>310: My New Free NAS</title>
  <link>https://www.bsdnow.tv/310</link>
  <guid isPermaLink="false">11bc3886-8630-42e4-8ce6-a97cfce82f4d</guid>
  <pubDate>Wed, 07 Aug 2019 23:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/11bc3886-8630-42e4-8ce6-a97cfce82f4d.mp3" length="34679977" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>
OPNsense 19.7.1 is out, ZFS on Linux still has annoying issues with ARC size, Hammer2 is now default, NetBSD audio – an application perspective, new FreeNAS Mini, and more. </itunes:subtitle>
  <itunes:duration>48:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OPNsense 19.7.1 is out, ZFS on Linux still has annoying issues with ARC size, Hammer2 is now default, NetBSD audio – an application perspective, new FreeNAS Mini, and more. 
Headlines
OPNsense 19.7.1 (https://opnsense.org/opnsense-19-7-1-released/)
We do not wish to keep you from enjoying your summer time, but this
is a recommended security update enriched with reliability fixes for the
new 19.7 series.  Of special note are performance improvements as well
as a fix for a longstanding NAT before IPsec limitation.
Full patch notes:
system: do not create automatic copies of existing gateways
system: do not translate empty tunables descriptions
system: remove unwanted form action tags
system: do not include Syslog-ng in rc.freebsd handler
system: fix manual system log stop/start/restart
system: scoped IPv6 "%" could confuse mwexecf(), use plain mwexec() instead
system: allow curl-based downloads to use both trusted and local authorities
system: fix group privilege print and correctly redirect after edit
system: use cached address list in referrer check
system: fix Syslog-ng search stats
firewall: HTML-escape dynamic entries to display aliases
firewall: display correct IP version in automatic rules
firewall: fix a warning while reading empty outbound rules configuration
firewall: skip illegal log lines in live log
interfaces: performance improvements for configurations with hundreds of interfaces
reporting: performance improvements for Python 3 NetFlow aggregator rewrite
dhcp: move advanced router advertisement options to correct config section
ipsec: replace global array access with function to ensure side-effect free boot
ipsec: change DPD action on start to "dpdaction = restart"
ipsec: remove already default "dpdaction = none" if not set
ipsec: use interface IP address in local ID when doing NAT before IPsec
web proxy: fix database reset for Squid 4 by replacing use of sslcrtd with securityfile_certgen
plugins: os-acme-client 1.24[1]
plugins: os-bind 1.6[2]
plugins: os-dnscrypt-proxy 1.5[3]
plugins: os-frr now restricts characters BGP prefix-list and route-maps[4]
plugins: os-google-cloud-sdk 1.0[5]
ports: curl 7.65.3[6]
ports: monit 5.26.0[7]
ports: openssh 8.0p1[8]
ports: php 7.2.20[9]
ports: python 3.7.4[10]
ports: sqlite 3.29.0[11]
ports: squid 4.8[12]
Stay safe and hydrated, Your OPNsense team
ZFS on Linux still has annoying issues with ARC size (https://utcc.utoronto.ca/~cks/space/blog/linux/ZFSOnLinuxARCShrinkage)
One of the frustrating things about operating ZFS on Linux is that the ARC size is critical but ZFS's auto-tuning of it is opaque and apparently prone to malfunctions, where your ARC will mysteriously shrink drastically and then stick there.
Linux's regular filesystem disk cache is very predictable; if you do disk IO, the cache will relentlessly grow to use all of your free memory. This sometimes disconcerts people when free reports that there's very little memory actually free, but at least you're getting value from your RAM. This is so reliable and regular that we generally don't think about 'is my system going to use all of my RAM as a disk cache', because the answer is always 'yes'. (The general filesystem cache is also called the page cache.)
This is unfortunately not the case with the ZFS ARC in ZFS on Linux (and it wasn't necessarily the case even on Solaris). ZFS has both a current size and a 'target size' for the ARC (called 'c' in ZFS statistics). When your system boots this target size starts out as the maximum allowed size for the ARC, but various events afterward can cause it to be reduced (which obviously limits the size of your ARC, since that's its purpose). In practice, this reduction in the target size is both pretty sticky and rather mysterious (as ZFS on Linux doesn't currently expose enough statistics to tell why your ARC target size shrunk in any particular case).
The net effect is that the ZFS ARC is not infrequently quite shy and hesitant about using memory, in stark contrast to Linux's normal filesystem cache. The default maximum ARC size starts out as only half of your RAM (unlike the regular filesystem cache, which will use all of it), and then it shrinks from there, sometimes very significantly, and once shrunk it only recovers slowly (if at all).
News Roundup
Hammer2 is now default (http://lists.dragonflybsd.org/pipermail/commits/2019-June/718989.html)
```
commit a49112761c919d42d405ec10252eb0553662c824
Author: Matthew Dillon 
Date:   Mon Jun 10 17:53:46 2019 -0700
installer - Default to HAMMER2

* Change the installer default from HAMMER1 to HAMMER2.

* Adjust the nrelease build to print the location of the image files
  when it finishes.
Summary of changes:
 nrelease/Makefile                          |  2 +-
 usr.sbin/installer/dfuibe_installer/flow.c | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 11 deletions(-)
http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/a49112761c919d42d405ec10252eb0553662c824
```
NetBSD audio – an application perspective (https://netbsd.org/gallery/presentations/nia/netbsd-audio/)
NetBSD audio – an application perspective ... or, "doing it natively, because we can"
audio options for NetBSD in pkgsrc
Use NetBSD native audio (sun audio/audioio.h)
Or OSS emulation layer: Basically a wrapper around sun audio in the kernel. Incomplete and old version, but works for simple stuff
Many many abstraction layers available:
OpenAL-Soft
alsa-lib (config file required)
libao, GStreamer (plugins!)
PortAudio, SDL
PulseAudio, JACK
... lots more!? some obsolete stuff (esd, nas?)
Advantages of using NetBSD audio directly
Low latency, low CPU usage: Abstraction layers differ in latency (SDL2 vs ALSA/OpenAL)
Query device information: Is /dev/audio1 a USB microphone or another sound card?
Avoid bugs from excessive layering
Nice API, well documented: [nia note: I had no idea how to write audio code. I read a man page and now I do.]
Your code might work on illumos too
[nia note: SDL2 seems very sensitive to the blk_ms sysctl being high or low, with other implementations there seems to be a less noticable difference. I don't know why.]
New FreeNAS Mini (https://www.ixsystems.com/blog/new-freenas-mini-models-release-pr/)
Two new FreeNAS Mini systems join the very popular FreeNAS Mini and Mini XL:
FreeNAS Mini XL+: This powerful 10 Bay platform (8x 3.5” and 1x 2.5” hot-swap, 1x 2.5” internal) includes the latest, compact server technology and provides dual 10GbE ports, 8 CPU cores and 32 GB RAM for high performance workgroups. The Mini XL+ scales beyond 100TB and is ideal for very demanding applications, including hosting virtual machines and multimedia editing. Starting at $1499, the Mini XL+ configured with cache SSD and 80 TB capacity is $4299, and consumes about 100 Watts.
FreeNAS Mini E: This cost-effective 4 Bay platform provides the resources required for SOHO use with quad GbE ports and 8 GB of RAM. The Mini E is ideal for file sharing, streaming and transcoding video at 1080p. Starting at $749, the Mini E configured with 8 TB capacity is $999, and consumes about 36 Watts.
Beastie Bits
Welcome to NetBSD 9.99.1! (https://mail-index.netbsd.org/source-changes/2019/07/30/msg107671.html)
Berkeley smorgasbord — part II (http://blog.snailtext.com/posts/berkeley-smorgasbord-part-2.html)
dtracing postgres (https://www.youtube.com/watch?v=Brt41xnMZqo&amp;amp;list=PLuJmmKtsV1dOTmlImlD9U5j1P1rLxS2V8&amp;amp;index=20&amp;amp;t=0s)
Project Trident 19.07-U1 now available (https://project-trident.org/post/2019-07-30_19.07-u1_available/)
Need a Secure Operating System? Take a Look at OpenBSD (https://www.devprojournal.com/technology-trends/operating-systems/need-a-secure-operating-system-take-a-look-at-openbsd/)
Feedback/Questions
Jeff - OpenZFS Port Testing Feedback (http://dpaste.com/2AT7JGP#wrap)
Malcolm - Best Practices for Custom Ports (http://dpaste.com/1R170D7)
Michael - Little Correction (http://dpaste.com/0CERP6R)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, opnsense, zfs, arc, hammer2, audio, freenas, mini</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OPNsense 19.7.1 is out, ZFS on Linux still has annoying issues with ARC size, Hammer2 is now default, NetBSD audio – an application perspective, new FreeNAS Mini, and more. </p>

<h2>Headlines</h2>

<h3><a href="https://opnsense.org/opnsense-19-7-1-released/" rel="nofollow">OPNsense 19.7.1</a></h3>

<blockquote>
<p>We do not wish to keep you from enjoying your summer time, but this<br>
is a recommended security update enriched with reliability fixes for the<br>
new 19.7 series.  Of special note are performance improvements as well<br>
as a fix for a longstanding NAT before IPsec limitation.</p>

<p>Full patch notes:</p>
</blockquote>

<ul>
<li>system: do not create automatic copies of existing gateways</li>
<li>system: do not translate empty tunables descriptions</li>
<li>system: remove unwanted form action tags</li>
<li>system: do not include Syslog-ng in rc.freebsd handler</li>
<li>system: fix manual system log stop/start/restart</li>
<li>system: scoped IPv6 &quot;%&quot; could confuse mwexecf(), use plain mwexec() instead</li>
<li>system: allow curl-based downloads to use both trusted and local authorities</li>
<li>system: fix group privilege print and correctly redirect after edit</li>
<li>system: use cached address list in referrer check</li>
<li>system: fix Syslog-ng search stats</li>
<li>firewall: HTML-escape dynamic entries to display aliases</li>
<li>firewall: display correct IP version in automatic rules</li>
<li>firewall: fix a warning while reading empty outbound rules configuration</li>
<li>firewall: skip illegal log lines in live log</li>
<li>interfaces: performance improvements for configurations with hundreds of interfaces</li>
<li>reporting: performance improvements for Python 3 NetFlow aggregator rewrite</li>
<li>dhcp: move advanced router advertisement options to correct config section</li>
<li>ipsec: replace global array access with function to ensure side-effect free boot</li>
<li>ipsec: change DPD action on start to &quot;dpdaction = restart&quot;</li>
<li>ipsec: remove already default &quot;dpdaction = none&quot; if not set</li>
<li>ipsec: use interface IP address in local ID when doing NAT before IPsec</li>
<li>web proxy: fix database reset for Squid 4 by replacing use of ssl_crtd with security_file_certgen</li>
<li>plugins: os-acme-client 1.24[1]</li>
<li>plugins: os-bind 1.6[2]</li>
<li>plugins: os-dnscrypt-proxy 1.5[3]</li>
<li>plugins: os-frr now restricts characters BGP prefix-list and route-maps[4]</li>
<li>plugins: os-google-cloud-sdk 1.0[5]</li>
<li>ports: curl 7.65.3[6]</li>
<li>ports: monit 5.26.0[7]</li>
<li>ports: openssh 8.0p1[8]</li>
<li>ports: php 7.2.20[9]</li>
<li>ports: python 3.7.4[10]</li>
<li>ports: sqlite 3.29.0[11]</li>
<li>ports: squid 4.8[12]</li>
</ul>

<blockquote>
<p>Stay safe and hydrated, Your OPNsense team</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSOnLinuxARCShrinkage" rel="nofollow">ZFS on Linux still has annoying issues with ARC size</a></h3>

<p><code>One of the frustrating things about operating ZFS on Linux is that the ARC size is critical but ZFS&#39;s auto-tuning of it is opaque and apparently prone to malfunctions, where your ARC will mysteriously shrink drastically and then stick there.</code></p>

<blockquote>
<p>Linux&#39;s regular filesystem disk cache is very predictable; if you do disk IO, the cache will relentlessly grow to use all of your free memory. This sometimes disconcerts people when free reports that there&#39;s very little memory actually free, but at least you&#39;re getting value from your RAM. This is so reliable and regular that we generally don&#39;t think about &#39;is my system going to use all of my RAM as a disk cache&#39;, because the answer is always &#39;yes&#39;. (The general filesystem cache is also called the page cache.)</p>

<p>This is unfortunately not the case with the ZFS ARC in ZFS on Linux (and it wasn&#39;t necessarily the case even on Solaris). ZFS has both a current size and a &#39;target size&#39; for the ARC (called &#39;c&#39; in ZFS statistics). When your system boots this target size starts out as the maximum allowed size for the ARC, but various events afterward can cause it to be reduced (which obviously limits the size of your ARC, since that&#39;s its purpose). In practice, this reduction in the target size is both pretty sticky and rather mysterious (as ZFS on Linux doesn&#39;t currently expose enough statistics to tell why your ARC target size shrunk in any particular case).</p>

<p>The net effect is that the ZFS ARC is not infrequently quite shy and hesitant about using memory, in stark contrast to Linux&#39;s normal filesystem cache. The default maximum ARC size starts out as only half of your RAM (unlike the regular filesystem cache, which will use all of it), and then it shrinks from there, sometimes very significantly, and once shrunk it only recovers slowly (if at all).</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-June/718989.html" rel="nofollow">Hammer2 is now default</a></h3>

<pre><code>commit a49112761c919d42d405ec10252eb0553662c824
Author: Matthew Dillon &lt;dillon at apollo.backplane.com&gt;
Date:   Mon Jun 10 17:53:46 2019 -0700

    installer - Default to HAMMER2

    * Change the installer default from HAMMER1 to HAMMER2.

    * Adjust the nrelease build to print the location of the image files
      when it finishes.

Summary of changes:
 nrelease/Makefile                          |  2 +-
 usr.sbin/installer/dfuibe_installer/flow.c | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 11 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/a49112761c919d42d405ec10252eb0553662c824
</code></pre>

<hr>

<h3><a href="https://netbsd.org/gallery/presentations/nia/netbsd-audio/" rel="nofollow">NetBSD audio – an application perspective</a></h3>

<blockquote>
<p>NetBSD audio – an application perspective ... or, &quot;doing it natively, because we can&quot;</p>
</blockquote>

<ul>
<li><p>audio options for NetBSD in pkgsrc</p>

<ul>
<li>Use NetBSD native audio (sun audio/audioio.h)</li>
<li>Or OSS emulation layer: Basically a wrapper around sun audio in the kernel. Incomplete and old version, but works for simple stuff</li>
</ul></li>
<li><p>Many many abstraction layers available:</p>

<ul>
<li>OpenAL-Soft</li>
<li>alsa-lib (config file required)</li>
<li>libao, GStreamer (plugins!)</li>
<li>PortAudio, SDL</li>
<li>PulseAudio, JACK</li>
<li>... lots more!? some obsolete stuff (esd, nas?)</li>
</ul></li>
<li><p>Advantages of using NetBSD audio directly</p>

<ul>
<li>Low latency, low CPU usage: Abstraction layers differ in latency (SDL2 vs ALSA/OpenAL)</li>
<li>Query device information: Is /dev/audio1 a USB microphone or another sound card?</li>
<li>Avoid bugs from excessive layering</li>
<li>Nice API, well documented: [nia note: I had no idea how to write audio code. I read a man page and now I do.]</li>
<li>Your code might work on illumos too</li>
</ul></li>
<li><p>[nia note: SDL2 seems very sensitive to the blk_ms sysctl being high or low, with other implementations there seems to be a less noticable difference. I don&#39;t know why.]</p></li>
</ul>

<hr>

<h3><a href="https://www.ixsystems.com/blog/new-freenas-mini-models-release-pr/" rel="nofollow">New FreeNAS Mini</a></h3>

<blockquote>
<p>Two new FreeNAS Mini systems join the very popular FreeNAS Mini and Mini XL:</p>

<p>FreeNAS Mini XL+: This powerful 10 Bay platform (8x 3.5” and 1x 2.5” hot-swap, 1x 2.5” internal) includes the latest, compact server technology and provides dual 10GbE ports, 8 CPU cores and 32 GB RAM for high performance workgroups. The Mini XL+ scales beyond 100TB and is ideal for very demanding applications, including hosting virtual machines and multimedia editing. Starting at $1499, the Mini XL+ configured with cache SSD and 80 TB capacity is $4299, and consumes about 100 Watts.</p>

<p>FreeNAS Mini E: This cost-effective 4 Bay platform provides the resources required for SOHO use with quad GbE ports and 8 GB of RAM. The Mini E is ideal for file sharing, streaming and transcoding video at 1080p. Starting at $749, the Mini E configured with 8 TB capacity is $999, and consumes about 36 Watts.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://mail-index.netbsd.org/source-changes/2019/07/30/msg107671.html" rel="nofollow">Welcome to NetBSD 9.99.1!</a></li>
<li><a href="http://blog.snailtext.com/posts/berkeley-smorgasbord-part-2.html" rel="nofollow">Berkeley smorgasbord — part II</a></li>
<li><a href="https://www.youtube.com/watch?v=Brt41xnMZqo&list=PLuJmmKtsV1dOTmlImlD9U5j1P1rLxS2V8&index=20&t=0s" rel="nofollow">dtracing postgres</a></li>
<li><a href="https://project-trident.org/post/2019-07-30_19.07-u1_available/" rel="nofollow">Project Trident 19.07-U1 now available</a></li>
<li><a href="https://www.devprojournal.com/technology-trends/operating-systems/need-a-secure-operating-system-take-a-look-at-openbsd/" rel="nofollow">Need a Secure Operating System? Take a Look at OpenBSD</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Jeff - <a href="http://dpaste.com/2AT7JGP#wrap" rel="nofollow">OpenZFS Port Testing Feedback</a></li>
<li>Malcolm - <a href="http://dpaste.com/1R170D7" rel="nofollow">Best Practices for Custom Ports</a></li>
<li>Michael - <a href="http://dpaste.com/0CERP6R" rel="nofollow">Little Correction</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0310.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OPNsense 19.7.1 is out, ZFS on Linux still has annoying issues with ARC size, Hammer2 is now default, NetBSD audio – an application perspective, new FreeNAS Mini, and more. </p>

<h2>Headlines</h2>

<h3><a href="https://opnsense.org/opnsense-19-7-1-released/" rel="nofollow">OPNsense 19.7.1</a></h3>

<blockquote>
<p>We do not wish to keep you from enjoying your summer time, but this<br>
is a recommended security update enriched with reliability fixes for the<br>
new 19.7 series.  Of special note are performance improvements as well<br>
as a fix for a longstanding NAT before IPsec limitation.</p>

<p>Full patch notes:</p>
</blockquote>

<ul>
<li>system: do not create automatic copies of existing gateways</li>
<li>system: do not translate empty tunables descriptions</li>
<li>system: remove unwanted form action tags</li>
<li>system: do not include Syslog-ng in rc.freebsd handler</li>
<li>system: fix manual system log stop/start/restart</li>
<li>system: scoped IPv6 &quot;%&quot; could confuse mwexecf(), use plain mwexec() instead</li>
<li>system: allow curl-based downloads to use both trusted and local authorities</li>
<li>system: fix group privilege print and correctly redirect after edit</li>
<li>system: use cached address list in referrer check</li>
<li>system: fix Syslog-ng search stats</li>
<li>firewall: HTML-escape dynamic entries to display aliases</li>
<li>firewall: display correct IP version in automatic rules</li>
<li>firewall: fix a warning while reading empty outbound rules configuration</li>
<li>firewall: skip illegal log lines in live log</li>
<li>interfaces: performance improvements for configurations with hundreds of interfaces</li>
<li>reporting: performance improvements for Python 3 NetFlow aggregator rewrite</li>
<li>dhcp: move advanced router advertisement options to correct config section</li>
<li>ipsec: replace global array access with function to ensure side-effect free boot</li>
<li>ipsec: change DPD action on start to &quot;dpdaction = restart&quot;</li>
<li>ipsec: remove already default &quot;dpdaction = none&quot; if not set</li>
<li>ipsec: use interface IP address in local ID when doing NAT before IPsec</li>
<li>web proxy: fix database reset for Squid 4 by replacing use of ssl_crtd with security_file_certgen</li>
<li>plugins: os-acme-client 1.24[1]</li>
<li>plugins: os-bind 1.6[2]</li>
<li>plugins: os-dnscrypt-proxy 1.5[3]</li>
<li>plugins: os-frr now restricts characters BGP prefix-list and route-maps[4]</li>
<li>plugins: os-google-cloud-sdk 1.0[5]</li>
<li>ports: curl 7.65.3[6]</li>
<li>ports: monit 5.26.0[7]</li>
<li>ports: openssh 8.0p1[8]</li>
<li>ports: php 7.2.20[9]</li>
<li>ports: python 3.7.4[10]</li>
<li>ports: sqlite 3.29.0[11]</li>
<li>ports: squid 4.8[12]</li>
</ul>

<blockquote>
<p>Stay safe and hydrated, Your OPNsense team</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSOnLinuxARCShrinkage" rel="nofollow">ZFS on Linux still has annoying issues with ARC size</a></h3>

<p><code>One of the frustrating things about operating ZFS on Linux is that the ARC size is critical but ZFS&#39;s auto-tuning of it is opaque and apparently prone to malfunctions, where your ARC will mysteriously shrink drastically and then stick there.</code></p>

<blockquote>
<p>Linux&#39;s regular filesystem disk cache is very predictable; if you do disk IO, the cache will relentlessly grow to use all of your free memory. This sometimes disconcerts people when free reports that there&#39;s very little memory actually free, but at least you&#39;re getting value from your RAM. This is so reliable and regular that we generally don&#39;t think about &#39;is my system going to use all of my RAM as a disk cache&#39;, because the answer is always &#39;yes&#39;. (The general filesystem cache is also called the page cache.)</p>

<p>This is unfortunately not the case with the ZFS ARC in ZFS on Linux (and it wasn&#39;t necessarily the case even on Solaris). ZFS has both a current size and a &#39;target size&#39; for the ARC (called &#39;c&#39; in ZFS statistics). When your system boots this target size starts out as the maximum allowed size for the ARC, but various events afterward can cause it to be reduced (which obviously limits the size of your ARC, since that&#39;s its purpose). In practice, this reduction in the target size is both pretty sticky and rather mysterious (as ZFS on Linux doesn&#39;t currently expose enough statistics to tell why your ARC target size shrunk in any particular case).</p>

<p>The net effect is that the ZFS ARC is not infrequently quite shy and hesitant about using memory, in stark contrast to Linux&#39;s normal filesystem cache. The default maximum ARC size starts out as only half of your RAM (unlike the regular filesystem cache, which will use all of it), and then it shrinks from there, sometimes very significantly, and once shrunk it only recovers slowly (if at all).</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-June/718989.html" rel="nofollow">Hammer2 is now default</a></h3>

<pre><code>commit a49112761c919d42d405ec10252eb0553662c824
Author: Matthew Dillon &lt;dillon at apollo.backplane.com&gt;
Date:   Mon Jun 10 17:53:46 2019 -0700

    installer - Default to HAMMER2

    * Change the installer default from HAMMER1 to HAMMER2.

    * Adjust the nrelease build to print the location of the image files
      when it finishes.

Summary of changes:
 nrelease/Makefile                          |  2 +-
 usr.sbin/installer/dfuibe_installer/flow.c | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 11 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/a49112761c919d42d405ec10252eb0553662c824
</code></pre>

<hr>

<h3><a href="https://netbsd.org/gallery/presentations/nia/netbsd-audio/" rel="nofollow">NetBSD audio – an application perspective</a></h3>

<blockquote>
<p>NetBSD audio – an application perspective ... or, &quot;doing it natively, because we can&quot;</p>
</blockquote>

<ul>
<li><p>audio options for NetBSD in pkgsrc</p>

<ul>
<li>Use NetBSD native audio (sun audio/audioio.h)</li>
<li>Or OSS emulation layer: Basically a wrapper around sun audio in the kernel. Incomplete and old version, but works for simple stuff</li>
</ul></li>
<li><p>Many many abstraction layers available:</p>

<ul>
<li>OpenAL-Soft</li>
<li>alsa-lib (config file required)</li>
<li>libao, GStreamer (plugins!)</li>
<li>PortAudio, SDL</li>
<li>PulseAudio, JACK</li>
<li>... lots more!? some obsolete stuff (esd, nas?)</li>
</ul></li>
<li><p>Advantages of using NetBSD audio directly</p>

<ul>
<li>Low latency, low CPU usage: Abstraction layers differ in latency (SDL2 vs ALSA/OpenAL)</li>
<li>Query device information: Is /dev/audio1 a USB microphone or another sound card?</li>
<li>Avoid bugs from excessive layering</li>
<li>Nice API, well documented: [nia note: I had no idea how to write audio code. I read a man page and now I do.]</li>
<li>Your code might work on illumos too</li>
</ul></li>
<li><p>[nia note: SDL2 seems very sensitive to the blk_ms sysctl being high or low, with other implementations there seems to be a less noticable difference. I don&#39;t know why.]</p></li>
</ul>

<hr>

<h3><a href="https://www.ixsystems.com/blog/new-freenas-mini-models-release-pr/" rel="nofollow">New FreeNAS Mini</a></h3>

<blockquote>
<p>Two new FreeNAS Mini systems join the very popular FreeNAS Mini and Mini XL:</p>

<p>FreeNAS Mini XL+: This powerful 10 Bay platform (8x 3.5” and 1x 2.5” hot-swap, 1x 2.5” internal) includes the latest, compact server technology and provides dual 10GbE ports, 8 CPU cores and 32 GB RAM for high performance workgroups. The Mini XL+ scales beyond 100TB and is ideal for very demanding applications, including hosting virtual machines and multimedia editing. Starting at $1499, the Mini XL+ configured with cache SSD and 80 TB capacity is $4299, and consumes about 100 Watts.</p>

<p>FreeNAS Mini E: This cost-effective 4 Bay platform provides the resources required for SOHO use with quad GbE ports and 8 GB of RAM. The Mini E is ideal for file sharing, streaming and transcoding video at 1080p. Starting at $749, the Mini E configured with 8 TB capacity is $999, and consumes about 36 Watts.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://mail-index.netbsd.org/source-changes/2019/07/30/msg107671.html" rel="nofollow">Welcome to NetBSD 9.99.1!</a></li>
<li><a href="http://blog.snailtext.com/posts/berkeley-smorgasbord-part-2.html" rel="nofollow">Berkeley smorgasbord — part II</a></li>
<li><a href="https://www.youtube.com/watch?v=Brt41xnMZqo&list=PLuJmmKtsV1dOTmlImlD9U5j1P1rLxS2V8&index=20&t=0s" rel="nofollow">dtracing postgres</a></li>
<li><a href="https://project-trident.org/post/2019-07-30_19.07-u1_available/" rel="nofollow">Project Trident 19.07-U1 now available</a></li>
<li><a href="https://www.devprojournal.com/technology-trends/operating-systems/need-a-secure-operating-system-take-a-look-at-openbsd/" rel="nofollow">Need a Secure Operating System? Take a Look at OpenBSD</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Jeff - <a href="http://dpaste.com/2AT7JGP#wrap" rel="nofollow">OpenZFS Port Testing Feedback</a></li>
<li>Malcolm - <a href="http://dpaste.com/1R170D7" rel="nofollow">Best Practices for Custom Ports</a></li>
<li>Michael - <a href="http://dpaste.com/0CERP6R" rel="nofollow">Little Correction</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0310.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 309: Get Your Telnet Fix</title>
  <link>https://www.bsdnow.tv/309</link>
  <guid isPermaLink="false">630a645e-fe37-4a56-a2fd-8c51abb5dfe5</guid>
  <pubDate>Wed, 31 Jul 2019 23:45:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/630a645e-fe37-4a56-a2fd-8c51abb5dfe5.mp3" length="34856460" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>
DragonFlyBSD Project colo upgrade, future trends, resuming ZFS send, realtime bandwidth terminal graph visualization, fixing telnet fixes, a chapter from the FBI’s history with OpenBSD, an OpenSSH vulnerability, and more.</itunes:subtitle>
  <itunes:duration>48:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>DragonFlyBSD Project Update - colo upgrade, future trends, resuming ZFS send, realtime bandwidth terminal graph visualization, fixing telnet fixes, a chapter from the FBI’s history with OpenBSD and an OpenSSH vuln, and more.
Headlines
DragonFlyBSD Project Update - colo upgrade, future trends (http://lists.dragonflybsd.org/pipermail/users/2019-July/358226.html)
For the last week I've been testing out a replacement for Monster, our 48-core opteron server.  The project will be removing Monster from the colo in a week or two and replacing it with three machines which together will use half the power that Monster did alone.
The goal is to clear out a little power budget in the colo and to really beef-up our package-building capabilities to reduce the turn-around time needed to test ports syncs and updates to the binary package system.
Currently we use two blades to do most of the building, plus monster sometimes.  The blades take almost a week (120 hours+) to do a full synth run and monster takes around 27.5 hours.  But we need to do three bulk builds more or less at the same time... one for the release branch, one for the development branch, and one for staging updates.  It just takes too long and its been gnawing at me for a little while.
Well, Zen 2 to the rescue!  These new CPUs can take ECC, there's actually an IPMI mobo available, and they are fast as hell and cheap for what we get. 
The new machines will be two 3900X based servers, plus a dual-xeon system that I already had at home.   The 3900X's can each do a full synth run in 24.5 hours and the Xeon can do it in around 31 hours.  Monster will be retired.  And the crazy thing about this?  Monster burns 1000W going full bore.  Each of the 3900X servers burns 160W and the Xeon burns 200W.  In otherwords, we are replacing 1000W with only 520W and getting roughly 6x the performance efficiency in the upgrade.  This tell you just how much more power-efficient machines have become in the last 9 years or so. &amp;gt; This upgrade will allow us to do full builds for both release and dev in roughly one day instead of seven days, and do it without interfering with staging work that might be happening at the same time.
Future trends - DragonFlyBSD has reached a bit of a cross-roads.  With most of the SMP work now essentially complete across the entire system the main project focus is now on supplying reliable binary ports for release and developer branches, DRM  (GPU) support and other UI elements to keep DragonFlyBSD relevant on workstations, and continuing Filesystem work on HAMMER2 to get multi-device and clustering going.
Resuming ZFS send (https://www.oshogbo.vexillium.org/blog/66/)
One of the amazing functionalities of ZFS is the possibility of sending a whole dataset from one place to another. This mechanism is amazing to create backups of your ZFS based machines. Although, there were some issues with this functionality for a long time when a user sent a big chunk of data. What if you would do that over the network and your connection has disappeared? What if your machine was rebooted as you are sending a snapshot?
For a very long time, you didn't have any options - you had to send a snapshot from the beginning. Now, this limitation was already bad enough. However, another downside of this approach was that all the data which you already send was thrown away. Therefore, ZFS had to go over all this data and remove them from the dataset. Imagine the terabytes of data which you sent via the network was thrown away because as you were sending the last few bytes, the network went off.
In this short post, I don't want to go over the whole ZFS snapshot infrastructure (if you think that such a post would be useful, please leave a comment). Now, to get back to the point, this infrastructure is used to clone the datasets. Some time ago a new feature called “Resuming ZFS send” was introduced. That means that if there was some problem with transmitting the dataset from one point to another you could resume it or throw them away. But the point is, that yes, you finally have a choice.
News Roundup
Realtime bandwidth terminal graph visualization (https://dataswamp.org/~solene/2019-07-19-ttyplot-netstat-openbsd.html)
If for some reasons you want to visualize your bandwidth traffic on an interface (in or out) in a terminal with a nice graph, here is a small script to do so, involving ttyplot, a nice software making graphics in a terminal.
The following will works on OpenBSD. You can install ttyplot by pkg_add ttyplot as root, ttyplot package appeared since OpenBSD 6.5.
fixing telnet fixes (https://flak.tedunangst.com/post/fixing-telnet-fixes)
There’s a FreeBSD commit to telnet. fix a couple of snprintf() buffer overflows. It’s received a bit of attention for various reasons, telnet in 2019?, etc. I thought I’d take a look. Here’s a few random observations.
The first line is indented with spaces while the others use tabs.
The correct type for string length is size_t not unsigned int.
sizeof(char) is always one. There’s no need to multiply by it.
If you do need to multiply by a size, this is an unsafe pattern.  Use calloc or something similar. (OpenBSD provides reallocarray to avoid zeroing cost of calloc.)
Return value of malloc doesn’t need to be cast. In fact, should not be, lest you disguise a warning.
Return value of malloc is not checked for NULL.
No reason to cast cp to char * when passing to snprintf. It already is that type. And if it weren’t, what are you doing?
The whole operation could be simplified by using asprintf.
Although unlikely (probably impossible here, but more generally), adding the two source lengths together can overflow, resulting in truncation with an unchecked snprintf call. asprintf avoids this failure case.
A Chapter from the FBI’s History with OpenBSD and an OpenSSH Vuln (https://twitter.com/RooneyMcNibNug/status/1152327783055601664)
Earlier this year I FOIAed the FBI for details on allegations of backdoor installed in the IPSEC stack in 2010, originally discussed by OpenBSD devs (https://marc.info/?l=openbsd-tech&amp;amp;m=129236621626462 …) Today, I got an interesting but unexpected responsive record: 
Freedom of Information Act: FBI: OpenBSD (https://www.muckrock.com/foi/united-states-of-america-10/foia-fbi-openbsd-70084/) 
GitHub Repo (https://github.com/RooneyMcNibNug/FOIA/blob/master/Responsive%20Docs/OpenBSD/FBI_OpenBSD_response_OCRd.pdf)
Beastie Bits
“Sudo Mastery, 2nd Edition” open for tech review (https://mwl.io/archives/4378)
FreeBSD Journal: FreeBSD for Makers (https://www.freebsdnews.com/2019/07/12/freebsd-journal-freebsd-for-makers/)
OpenBSD and NetBSD machines at Open Source Conference 2019 Nagoya (http://mail-index.netbsd.org/netbsd-advocacy/2019/07/19/msg000808.html)
FreeBSD 12.0: WINE Gaming (https://www.youtube.com/watch?v=zuj9pRNR2oM)
Introduction to the Structure and Interpretation of TNF (The NetBSD Foundation) (https://www.netbsd.org/gallery/presentations/wiz/pkgsrccon2019/index.html#/)
vBSDcon speakers announced (https://www.vbsdcon.com/)
Feedback/Questions
Pat - NYCBug Aug 7th (http://dpaste.com/21Y1PRM)
Tyler - SSH keys vs password (http://dpaste.com/3JEVVEF#wrap)
Lars - Tor-Talk (http://dpaste.com/0RAFMXZ)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, zfs, send, terminal, bandwidth, graph, realtime, telnet</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>DragonFlyBSD Project Update - colo upgrade, future trends, resuming ZFS send, realtime bandwidth terminal graph visualization, fixing telnet fixes, a chapter from the FBI’s history with OpenBSD and an OpenSSH vuln, and more.</p>

<h2>Headlines</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2019-July/358226.html" rel="nofollow">DragonFlyBSD Project Update - colo upgrade, future trends</a></h3>

<blockquote>
<p>For the last week I&#39;ve been testing out a replacement for Monster, our 48-core opteron server.  The project will be removing Monster from the colo in a week or two and replacing it with three machines which together will use half the power that Monster did alone.</p>

<p>The goal is to clear out a little power budget in the colo and to really beef-up our package-building capabilities to reduce the turn-around time needed to test ports syncs and updates to the binary package system.</p>

<p>Currently we use two blades to do most of the building, plus monster sometimes.  The blades take almost a week (120 hours+) to do a full synth run and monster takes around 27.5 hours.  But we need to do three bulk builds more or less at the same time... one for the release branch, one for the development branch, and one for staging updates.  It just takes too long and its been gnawing at me for a little while.</p>

<p>Well, Zen 2 to the rescue!  These new CPUs can take ECC, there&#39;s actually an IPMI mobo available, and they are fast as hell and cheap for what we get. </p>

<p>The new machines will be two 3900X based servers, plus a dual-xeon system that I already had at home.   The 3900X&#39;s can each do a full synth run in 24.5 hours and the Xeon can do it in around 31 hours.  Monster will be retired.  And the crazy thing about this?  Monster burns 1000W going full bore.  Each of the 3900X servers burns 160W and the Xeon burns 200W.  In otherwords, we are replacing 1000W with only 520W and getting roughly 6x the performance efficiency in the upgrade.  This tell you just how much more power-efficient machines have become in the last 9 years or so. &gt; This upgrade will allow us to do full builds for both release and dev in roughly one day instead of seven days, and do it without interfering with staging work that might be happening at the same time.</p>

<p>Future trends - DragonFlyBSD has reached a bit of a cross-roads.  With most of the SMP work now essentially complete across the entire system the main project focus is now on supplying reliable binary ports for release and developer branches, DRM  (GPU) support and other UI elements to keep DragonFlyBSD relevant on workstations, and continuing Filesystem work on HAMMER2 to get multi-device and clustering going.</p>
</blockquote>

<hr>

<h3><a href="https://www.oshogbo.vexillium.org/blog/66/" rel="nofollow">Resuming ZFS send</a></h3>

<blockquote>
<p>One of the amazing functionalities of ZFS is the possibility of sending a whole dataset from one place to another. This mechanism is amazing to create backups of your ZFS based machines. Although, there were some issues with this functionality for a long time when a user sent a big chunk of data. What if you would do that over the network and your connection has disappeared? What if your machine was rebooted as you are sending a snapshot?</p>

<p>For a very long time, you didn&#39;t have any options - you had to send a snapshot from the beginning. Now, this limitation was already bad enough. However, another downside of this approach was that all the data which you already send was thrown away. Therefore, ZFS had to go over all this data and remove them from the dataset. Imagine the terabytes of data which you sent via the network was thrown away because as you were sending the last few bytes, the network went off.</p>

<p>In this short post, I don&#39;t want to go over the whole ZFS snapshot infrastructure (if you think that such a post would be useful, please leave a comment). Now, to get back to the point, this infrastructure is used to clone the datasets. Some time ago a new feature called “Resuming ZFS send” was introduced. That means that if there was some problem with transmitting the dataset from one point to another you could resume it or throw them away. But the point is, that yes, you finally have a choice.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2019-07-19-ttyplot-netstat-openbsd.html" rel="nofollow">Realtime bandwidth terminal graph visualization</a></h3>

<blockquote>
<p>If for some reasons you want to visualize your bandwidth traffic on an interface (in or out) in a terminal with a nice graph, here is a small script to do so, involving ttyplot, a nice software making graphics in a terminal.</p>

<p>The following will works on OpenBSD. You can install ttyplot by pkg_add ttyplot as root, ttyplot package appeared since OpenBSD 6.5.</p>
</blockquote>

<hr>

<h3><a href="https://flak.tedunangst.com/post/fixing-telnet-fixes" rel="nofollow">fixing telnet fixes</a></h3>

<blockquote>
<p>There’s a FreeBSD commit to telnet. fix a couple of snprintf() buffer overflows. It’s received a bit of attention for various reasons, telnet in 2019?, etc. I thought I’d take a look. Here’s a few random observations.</p>

<ol>
<li><p>The first line is indented with spaces while the others use tabs.</p></li>
<li><p>The correct type for string length is size_t not unsigned int.</p></li>
<li><p>sizeof(char) is always one. There’s no need to multiply by it.</p></li>
<li><p>If you do need to multiply by a size, this is an unsafe pattern.  Use calloc or something similar. (OpenBSD provides reallocarray to avoid zeroing cost of calloc.)</p></li>
<li><p>Return value of malloc doesn’t need to be cast. In fact, should not be, lest you disguise a warning.</p></li>
<li><p>Return value of malloc is not checked for NULL.</p></li>
<li><p>No reason to cast cp to char * when passing to snprintf. It already is that type. And if it weren’t, what are you doing?</p></li>
<li><p>The whole operation could be simplified by using asprintf.</p></li>
<li><p>Although unlikely (probably impossible here, but more generally), adding the two source lengths together can overflow, resulting in truncation with an unchecked snprintf call. asprintf avoids this failure case.</p></li>
</ol>
</blockquote>

<hr>

<h3><a href="https://twitter.com/RooneyMcNibNug/status/1152327783055601664" rel="nofollow">A Chapter from the FBI’s History with OpenBSD and an OpenSSH Vuln</a></h3>

<blockquote>
<p>Earlier this year I FOIAed the FBI for details on allegations of backdoor installed in the IPSEC stack in 2010, originally discussed by OpenBSD devs (<a href="https://marc.info/?l=openbsd-tech&m=129236621626462" rel="nofollow">https://marc.info/?l=openbsd-tech&amp;m=129236621626462</a> …) Today, I got an interesting but unexpected responsive record: </p>
</blockquote>

<ul>
<li><a href="https://www.muckrock.com/foi/united-states-of-america-10/foia-fbi-openbsd-70084/" rel="nofollow">Freedom of Information Act: FBI: OpenBSD</a> </li>
<li><a href="https://github.com/RooneyMcNibNug/FOIA/blob/master/Responsive%20Docs/OpenBSD/FBI_OpenBSD_response_OCRd.pdf" rel="nofollow">GitHub Repo</a></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://mwl.io/archives/4378" rel="nofollow">“Sudo Mastery, 2nd Edition” open for tech review</a></li>
<li><a href="https://www.freebsdnews.com/2019/07/12/freebsd-journal-freebsd-for-makers/" rel="nofollow">FreeBSD Journal: FreeBSD for Makers</a></li>
<li><a href="http://mail-index.netbsd.org/netbsd-advocacy/2019/07/19/msg000808.html" rel="nofollow">OpenBSD and NetBSD machines at Open Source Conference 2019 Nagoya</a></li>
<li><a href="https://www.youtube.com/watch?v=zuj9pRNR2oM" rel="nofollow">FreeBSD 12.0: WINE Gaming</a></li>
<li><a href="https://www.netbsd.org/gallery/presentations/wiz/pkgsrccon2019/index.html#/" rel="nofollow">Introduction to the Structure and Interpretation of TNF (The NetBSD Foundation)</a></li>
<li><a href="https://www.vbsdcon.com/" rel="nofollow">vBSDcon speakers announced</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Pat - <a href="http://dpaste.com/21Y1PRM" rel="nofollow">NYCBug Aug 7th</a></li>
<li>Tyler - <a href="http://dpaste.com/3JEVVEF#wrap" rel="nofollow">SSH keys vs password</a></li>
<li>Lars - <a href="http://dpaste.com/0RAFMXZ" rel="nofollow">Tor-Talk</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0309.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>DragonFlyBSD Project Update - colo upgrade, future trends, resuming ZFS send, realtime bandwidth terminal graph visualization, fixing telnet fixes, a chapter from the FBI’s history with OpenBSD and an OpenSSH vuln, and more.</p>

<h2>Headlines</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2019-July/358226.html" rel="nofollow">DragonFlyBSD Project Update - colo upgrade, future trends</a></h3>

<blockquote>
<p>For the last week I&#39;ve been testing out a replacement for Monster, our 48-core opteron server.  The project will be removing Monster from the colo in a week or two and replacing it with three machines which together will use half the power that Monster did alone.</p>

<p>The goal is to clear out a little power budget in the colo and to really beef-up our package-building capabilities to reduce the turn-around time needed to test ports syncs and updates to the binary package system.</p>

<p>Currently we use two blades to do most of the building, plus monster sometimes.  The blades take almost a week (120 hours+) to do a full synth run and monster takes around 27.5 hours.  But we need to do three bulk builds more or less at the same time... one for the release branch, one for the development branch, and one for staging updates.  It just takes too long and its been gnawing at me for a little while.</p>

<p>Well, Zen 2 to the rescue!  These new CPUs can take ECC, there&#39;s actually an IPMI mobo available, and they are fast as hell and cheap for what we get. </p>

<p>The new machines will be two 3900X based servers, plus a dual-xeon system that I already had at home.   The 3900X&#39;s can each do a full synth run in 24.5 hours and the Xeon can do it in around 31 hours.  Monster will be retired.  And the crazy thing about this?  Monster burns 1000W going full bore.  Each of the 3900X servers burns 160W and the Xeon burns 200W.  In otherwords, we are replacing 1000W with only 520W and getting roughly 6x the performance efficiency in the upgrade.  This tell you just how much more power-efficient machines have become in the last 9 years or so. &gt; This upgrade will allow us to do full builds for both release and dev in roughly one day instead of seven days, and do it without interfering with staging work that might be happening at the same time.</p>

<p>Future trends - DragonFlyBSD has reached a bit of a cross-roads.  With most of the SMP work now essentially complete across the entire system the main project focus is now on supplying reliable binary ports for release and developer branches, DRM  (GPU) support and other UI elements to keep DragonFlyBSD relevant on workstations, and continuing Filesystem work on HAMMER2 to get multi-device and clustering going.</p>
</blockquote>

<hr>

<h3><a href="https://www.oshogbo.vexillium.org/blog/66/" rel="nofollow">Resuming ZFS send</a></h3>

<blockquote>
<p>One of the amazing functionalities of ZFS is the possibility of sending a whole dataset from one place to another. This mechanism is amazing to create backups of your ZFS based machines. Although, there were some issues with this functionality for a long time when a user sent a big chunk of data. What if you would do that over the network and your connection has disappeared? What if your machine was rebooted as you are sending a snapshot?</p>

<p>For a very long time, you didn&#39;t have any options - you had to send a snapshot from the beginning. Now, this limitation was already bad enough. However, another downside of this approach was that all the data which you already send was thrown away. Therefore, ZFS had to go over all this data and remove them from the dataset. Imagine the terabytes of data which you sent via the network was thrown away because as you were sending the last few bytes, the network went off.</p>

<p>In this short post, I don&#39;t want to go over the whole ZFS snapshot infrastructure (if you think that such a post would be useful, please leave a comment). Now, to get back to the point, this infrastructure is used to clone the datasets. Some time ago a new feature called “Resuming ZFS send” was introduced. That means that if there was some problem with transmitting the dataset from one point to another you could resume it or throw them away. But the point is, that yes, you finally have a choice.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://dataswamp.org/%7Esolene/2019-07-19-ttyplot-netstat-openbsd.html" rel="nofollow">Realtime bandwidth terminal graph visualization</a></h3>

<blockquote>
<p>If for some reasons you want to visualize your bandwidth traffic on an interface (in or out) in a terminal with a nice graph, here is a small script to do so, involving ttyplot, a nice software making graphics in a terminal.</p>

<p>The following will works on OpenBSD. You can install ttyplot by pkg_add ttyplot as root, ttyplot package appeared since OpenBSD 6.5.</p>
</blockquote>

<hr>

<h3><a href="https://flak.tedunangst.com/post/fixing-telnet-fixes" rel="nofollow">fixing telnet fixes</a></h3>

<blockquote>
<p>There’s a FreeBSD commit to telnet. fix a couple of snprintf() buffer overflows. It’s received a bit of attention for various reasons, telnet in 2019?, etc. I thought I’d take a look. Here’s a few random observations.</p>

<ol>
<li><p>The first line is indented with spaces while the others use tabs.</p></li>
<li><p>The correct type for string length is size_t not unsigned int.</p></li>
<li><p>sizeof(char) is always one. There’s no need to multiply by it.</p></li>
<li><p>If you do need to multiply by a size, this is an unsafe pattern.  Use calloc or something similar. (OpenBSD provides reallocarray to avoid zeroing cost of calloc.)</p></li>
<li><p>Return value of malloc doesn’t need to be cast. In fact, should not be, lest you disguise a warning.</p></li>
<li><p>Return value of malloc is not checked for NULL.</p></li>
<li><p>No reason to cast cp to char * when passing to snprintf. It already is that type. And if it weren’t, what are you doing?</p></li>
<li><p>The whole operation could be simplified by using asprintf.</p></li>
<li><p>Although unlikely (probably impossible here, but more generally), adding the two source lengths together can overflow, resulting in truncation with an unchecked snprintf call. asprintf avoids this failure case.</p></li>
</ol>
</blockquote>

<hr>

<h3><a href="https://twitter.com/RooneyMcNibNug/status/1152327783055601664" rel="nofollow">A Chapter from the FBI’s History with OpenBSD and an OpenSSH Vuln</a></h3>

<blockquote>
<p>Earlier this year I FOIAed the FBI for details on allegations of backdoor installed in the IPSEC stack in 2010, originally discussed by OpenBSD devs (<a href="https://marc.info/?l=openbsd-tech&m=129236621626462" rel="nofollow">https://marc.info/?l=openbsd-tech&amp;m=129236621626462</a> …) Today, I got an interesting but unexpected responsive record: </p>
</blockquote>

<ul>
<li><a href="https://www.muckrock.com/foi/united-states-of-america-10/foia-fbi-openbsd-70084/" rel="nofollow">Freedom of Information Act: FBI: OpenBSD</a> </li>
<li><a href="https://github.com/RooneyMcNibNug/FOIA/blob/master/Responsive%20Docs/OpenBSD/FBI_OpenBSD_response_OCRd.pdf" rel="nofollow">GitHub Repo</a></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://mwl.io/archives/4378" rel="nofollow">“Sudo Mastery, 2nd Edition” open for tech review</a></li>
<li><a href="https://www.freebsdnews.com/2019/07/12/freebsd-journal-freebsd-for-makers/" rel="nofollow">FreeBSD Journal: FreeBSD for Makers</a></li>
<li><a href="http://mail-index.netbsd.org/netbsd-advocacy/2019/07/19/msg000808.html" rel="nofollow">OpenBSD and NetBSD machines at Open Source Conference 2019 Nagoya</a></li>
<li><a href="https://www.youtube.com/watch?v=zuj9pRNR2oM" rel="nofollow">FreeBSD 12.0: WINE Gaming</a></li>
<li><a href="https://www.netbsd.org/gallery/presentations/wiz/pkgsrccon2019/index.html#/" rel="nofollow">Introduction to the Structure and Interpretation of TNF (The NetBSD Foundation)</a></li>
<li><a href="https://www.vbsdcon.com/" rel="nofollow">vBSDcon speakers announced</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Pat - <a href="http://dpaste.com/21Y1PRM" rel="nofollow">NYCBug Aug 7th</a></li>
<li>Tyler - <a href="http://dpaste.com/3JEVVEF#wrap" rel="nofollow">SSH keys vs password</a></li>
<li>Lars - <a href="http://dpaste.com/0RAFMXZ" rel="nofollow">Tor-Talk</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0309.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>308: Mumbling with OpenBSD</title>
  <link>https://www.bsdnow.tv/308</link>
  <guid isPermaLink="false">583db96b-f838-461b-a366-c6d49825c5be</guid>
  <pubDate>Wed, 24 Jul 2019 23:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/583db96b-f838-461b-a366-c6d49825c5be.mp3" length="31984767" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Replacing a (silently) failing disk in a ZFS pool, OPNsense 19.7 RC1 released, implementing DRM ioctl support for NetBSD, High quality/low latency VOIP server with umurmur/Mumble on OpenBSD, the PDP-7 where Unix began, LLDB watchpoints, and more.</itunes:subtitle>
  <itunes:duration>44:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Replacing a (silently) failing disk in a ZFS pool, OPNsense 19.7 RC1 released, implementing DRM ioctl support for NetBSD, High quality/low latency VOIP server with umurmur/Mumble on OpenBSD, the PDP-7 where Unix began, LLDB watchpoints, and more.
Headlines
Replacing a (silently) failing disk in a ZFS pool (https://imil.net/blog/2019/07/02/Replacing-a-silently-failing-disk-in-a-ZFS-pool/)
Maybe I can’t read, but I have the feeling that official documentations explain every single corner case for a given tool, except the one you will actually need. My today’s struggle: replacing a disk within a FreeBSD ZFS pool.
What? there’s a shitton of docs on this topic! Are you stupid?
I don’t know, maybe. Yet none covered the process in a simple, straight and complete manner.
OPNsense 19.7 RC1 released (https://opnsense.org/opnsense-19-7-rc1-released/)
Hi there,
For four and a half years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.
We thank all of you for helping test, shape and contribute to the project! We know it would not be the same without you.
Download links, an installation guide[1] and the checksums for the images can be found below as well.
News Roundup
Implementation of DRM ioctl Support for NetBSD kernel (https://blog.netbsd.org/tnf/entry/implementation_of_drm_ioctl_support)
What is DRM ioctl ?
Ioctls are input/output control system calls and DRM stands for direct rendering manager The DRM layer provides several services to graphics drivers, many of them driven by the application interfaces it provides through libdrm, the library that wraps most of the DRM ioctls. These include vblank event handling, memory management, output management, framebuffer management, command submission &amp;amp; fencing, suspend/resume support, and DMA services.
Native DRM ioctl calls
NetBSD was able to make native DRM ioctl calls with hardware rendering once xorg and proper mesa packages where installed. We used the glxinfo and glxgears applications to test this out.
High quality / low latency VOIP server with umurmur/Mumble on OpenBSD (https://dataswamp.org/~solene/2019-07-04-umurmur.html)
Discord users keep telling about their so called discord server, which is not dedicated to them at all. And Discord has a very bad quality and a lot of voice distorsion.
Why not run your very own mumble server with high voice quality and low latency and privacy respect? This is very easy to setup on OpenBSD!
Mumble is an open source voip client, it has a client named Mumble (available on various operating system) and at least Android, the server part is murmur but there is a lightweight server named umurmur. People authentication is done through certificate generated locally and automatically accepted on a server, and the certificate get associated with a nickname. Nobody can pick the same nickname as another person if it’s not the same certificate.
TMWL June’19 — JS Fetch API, scheduling in Spring, thoughts on Unix (https://blog.softwaremill.com/tmwl-june19-js-fetch-api-scheduling-in-spring-thoughts-on-unix-fd54f50ecd64)
Unix — going back to the roots
From time to time, I like to review my knowledge in a certain area, even when I feel like I know a lot about it already. I go back to the basics and read tutorials, manuals, books or watch interesting videos.
I’ve been using macOS for a couple of years now, previously being a linux user for some (relatively short) time. Both these operating systems have a common ancestor — Unix. While I’m definitely not an expert, I feel quite comfortable using linux &amp;amp; macOS — I understand the concepts behind the system architecture, know a lot of command line tools &amp;amp; navigate through the shell without a hassle. So-called unix philosophy is also close to my heart. I always feel like there’s more I could squeeze out of it.
Recently, I found that book titled “Unix for dummies, 5th edition” which was published back in… 2004. Feels literally like AGES in the computer-related world. However, it was a great shot — the book starts with the basics, providing some brief history of Unix and how it came to life. It talks a lot about the structure of the system and where certain pieces fit (eg. “standard” set of tools), and how to understand permissions and work with files &amp;amp; directories. There’s even a whole chapter about shell-based text editors like Vi and Emacs! Despite the fact that I am familiar with most of these, I could still find some interesting pieces &amp;amp; tools that I either knew existed (but never had a chance to use), or even haven’t ever heard of. And almost all of these are still valid in the modern “incarnations” of Unix’s descendants: Linux and macOS.
The book also talks about networking, surfing the web &amp;amp; working with email. It’s cute to see pictures of those old browsers rendering “ancient” Internet websites, but hey — this is how it looked like no more than fifteen years ago!
I can really recommend this book to anyone working on modern macOS or Linux — you will certainly find some interesting pieces. Especially if you like to go back to the roots from time to time as I do!
ThePDP-7 Where Unix Began (https://bsdimp.blogspot.com/2019/07/the-pdp-7-where-unix-began.html)
In preparation for a talk on Seventh Edition Unix this fall, I stumbled upon a service list from DEC for all known PDP-7 machines. From that list, and other sources, I believe that PDP-7 serial number 34 was the original Unix machine.
V0 Unix could run on only one of the PDP-7s. Of the 99 PDP-7s produced, only two had disks. Serial number 14 had an RA01 listed, presumably a disk, though of a different type. In addition to the PDP-7 being obsolete in 1970, no other PDP-7 could run Unix, limiting its appeal outside of Bell Labs. By porting Unix to the PDP-11 in 1970, the group ensured Unix would live on into the future. The PDP-9 and PDP-15 were both upgrades of the PDP-7, so to be fair, PDP-7 Unix did have a natural upgrade path (the PDP-11 out sold the 18 bit systems though ~600,000 to ~1000). Ken Thompson reports in a private email that there were 2 PDP-9s and 1 PDP-15 at Bell Labs that could run a version of the PDP-7 Unix, though those machines were viewed as born obsolete.
LLDB: watchpoints, XSTATE in ptrace() and core dumps (https://blog.netbsd.org/tnf/entry/lldb_watchpoints_xstate_in_ptrace)
Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.
In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and lately extending NetBSD's ptrace interface to cover more register types and fix compat32 issues. You can read more about that in my May 2019 report.
In June, I have finally finished the remaining ptrace() work for xstate and got it merged both on NetBSD and LLDB end (meaning it's going to make it into NetBSD 9). I have also worked on debug register support in LLDB, effectively fixing watchpoint support. Once again I had to fight some upstream regressions.
Beastie Bits
Project Trident 19.07 Available (https://project-trident.org/post/2019-07-12_19.07_available/)
A list of names from "Cold Blood" -- Any familiar? (https://www.montanalinux.org/cold-blood-list-of-numbers-201907.html)
fern: a curses-based mastodon client modeled off usenet news readers &amp;amp; pine, with an emphasis on getting to 'timeline zero' (https://github.com/enkiv2/fern)
OpenBSD Community goes Platinum for 2019! (https://undeadly.org/cgi?action=article;sid=20190707065226)
tcp keepalive and dports on DragonFly (https://www.dragonflydigest.com/2019/07/15/23199.html)
Feedback/Questions
Patrick - OpenZFS/ZoL Module from Ports (http://dpaste.com/1W2HJ04)
Brad - Services not starting (http://dpaste.com/345VM9Y#wrap)
Simon - Feedback (http://dpaste.com/1B4ZKC8#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.

 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, zfs, zpool, opnsense, drm, voip, umurmur, mumble, pdp-7, lldp, watchpoints</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Replacing a (silently) failing disk in a ZFS pool, OPNsense 19.7 RC1 released, implementing DRM ioctl support for NetBSD, High quality/low latency VOIP server with umurmur/Mumble on OpenBSD, the PDP-7 where Unix began, LLDB watchpoints, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://imil.net/blog/2019/07/02/Replacing-a-silently-failing-disk-in-a-ZFS-pool/" rel="nofollow">Replacing a (silently) failing disk in a ZFS pool</a></h3>

<blockquote>
<p>Maybe I can’t read, but I have the feeling that official documentations explain every single corner case for a given tool, except the one you will actually need. My today’s struggle: replacing a disk within a FreeBSD ZFS pool.<br>
What? there’s a shitton of docs on this topic! Are you stupid?<br>
I don’t know, maybe. Yet none covered the process in a simple, straight and complete manner.</p>
</blockquote>

<hr>

<h3><a href="https://opnsense.org/opnsense-19-7-rc1-released/" rel="nofollow">OPNsense 19.7 RC1 released</a></h3>

<blockquote>
<p>Hi there,<br>
For four and a half years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.<br>
We thank all of you for helping test, shape and contribute to the project! We know it would not be the same without you.<br>
Download links, an installation guide[1] and the checksums for the images can be found below as well.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/implementation_of_drm_ioctl_support" rel="nofollow">Implementation of DRM ioctl Support for NetBSD kernel</a></h3>

<ul>
<li>What is DRM ioctl ?</li>
</ul>

<blockquote>
<p>Ioctls are input/output control system calls and DRM stands for direct rendering manager The DRM layer provides several services to graphics drivers, many of them driven by the application interfaces it provides through libdrm, the library that wraps most of the DRM ioctls. These include vblank event handling, memory management, output management, framebuffer management, command submission &amp; fencing, suspend/resume support, and DMA services.</p>
</blockquote>

<ul>
<li>Native DRM ioctl calls</li>
</ul>

<blockquote>
<p>NetBSD was able to make native DRM ioctl calls with hardware rendering once xorg and proper mesa packages where installed. We used the glxinfo and glxgears applications to test this out.</p>
</blockquote>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2019-07-04-umurmur.html" rel="nofollow">High quality / low latency VOIP server with umurmur/Mumble on OpenBSD</a></h3>

<blockquote>
<p>Discord users keep telling about their so called discord server, which is not dedicated to them at all. And Discord has a very bad quality and a lot of voice distorsion.<br>
Why not run your very own mumble server with high voice quality and low latency and privacy respect? This is very easy to setup on OpenBSD!<br>
Mumble is an open source voip client, it has a client named Mumble (available on various operating system) and at least Android, the server part is murmur but there is a lightweight server named umurmur. People authentication is done through certificate generated locally and automatically accepted on a server, and the certificate get associated with a nickname. Nobody can pick the same nickname as another person if it’s not the same certificate.</p>
</blockquote>

<hr>

<h3><a href="https://blog.softwaremill.com/tmwl-june19-js-fetch-api-scheduling-in-spring-thoughts-on-unix-fd54f50ecd64" rel="nofollow">TMWL June’19 — JS Fetch API, scheduling in Spring, thoughts on Unix</a></h3>

<ul>
<li>Unix — going back to the roots</li>
</ul>

<blockquote>
<p>From time to time, I like to review my knowledge in a certain area, even when I feel like I know a lot about it already. I go back to the basics and read tutorials, manuals, books or watch interesting videos.<br>
I’ve been using macOS for a couple of years now, previously being a linux user for some (relatively short) time. Both these operating systems have a common ancestor — Unix. While I’m definitely not an expert, I feel quite comfortable using linux &amp; macOS — I understand the concepts behind the system architecture, know a lot of command line tools &amp; navigate through the shell without a hassle. So-called unix philosophy is also close to my heart. I always feel like there’s more I could squeeze out of it.<br>
Recently, I found that book titled “Unix for dummies, 5th edition” which was published back in… 2004. Feels literally like AGES in the computer-related world. However, it was a great shot — the book starts with the basics, providing some brief history of Unix and how it came to life. It talks a lot about the structure of the system and where certain pieces fit (eg. “standard” set of tools), and how to understand permissions and work with files &amp; directories. There’s even a whole chapter about shell-based text editors like Vi and Emacs! Despite the fact that I am familiar with most of these, I could still find some interesting pieces &amp; tools that I either knew existed (but never had a chance to use), or even haven’t ever heard of. And almost all of these are still valid in the modern “incarnations” of Unix’s descendants: Linux and macOS.<br>
The book also talks about networking, surfing the web &amp; working with email. It’s cute to see pictures of those old browsers rendering “ancient” Internet websites, but hey — this is how it looked like no more than fifteen years ago!<br>
I can really recommend this book to anyone working on modern macOS or Linux — you will certainly find some interesting pieces. Especially if you like to go back to the roots from time to time as I do!</p>
</blockquote>

<hr>

<h3><a href="https://bsdimp.blogspot.com/2019/07/the-pdp-7-where-unix-began.html" rel="nofollow">ThePDP-7 Where Unix Began</a></h3>

<blockquote>
<p>In preparation for a talk on Seventh Edition Unix this fall, I stumbled upon a service list from DEC for all known PDP-7 machines. From that list, and other sources, I believe that PDP-7 serial number 34 was the original Unix machine.<br>
V0 Unix could run on only one of the PDP-7s. Of the 99 PDP-7s produced, only two had disks. Serial number 14 had an RA01 listed, presumably a disk, though of a different type. In addition to the PDP-7 being obsolete in 1970, no other PDP-7 could run Unix, limiting its appeal outside of Bell Labs. By porting Unix to the PDP-11 in 1970, the group ensured Unix would live on into the future. The PDP-9 and PDP-15 were both upgrades of the PDP-7, so to be fair, PDP-7 Unix did have a natural upgrade path (the PDP-11 out sold the 18 bit systems though ~600,000 to ~1000). Ken Thompson reports in a private email that there were 2 PDP-9s and 1 PDP-15 at Bell Labs that could run a version of the PDP-7 Unix, though those machines were viewed as born obsolete.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/lldb_watchpoints_xstate_in_ptrace" rel="nofollow">LLDB: watchpoints, XSTATE in ptrace() and core dumps</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.<br>
In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and lately extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues. You can read more about that in my May 2019 report.<br>
In June, I have finally finished the remaining ptrace() work for xstate and got it merged both on NetBSD and LLDB end (meaning it&#39;s going to make it into NetBSD 9). I have also worked on debug register support in LLDB, effectively fixing watchpoint support. Once again I had to fight some upstream regressions.</p>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://project-trident.org/post/2019-07-12_19.07_available/" rel="nofollow">Project Trident 19.07 Available</a></li>
<li><a href="https://www.montanalinux.org/cold-blood-list-of-numbers-201907.html" rel="nofollow">A list of names from &quot;Cold Blood&quot; -- Any familiar?</a></li>
<li><a href="https://github.com/enkiv2/fern" rel="nofollow">fern: a curses-based mastodon client modeled off usenet news readers &amp; pine, with an emphasis on getting to &#39;timeline zero&#39;</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20190707065226" rel="nofollow">OpenBSD Community goes Platinum for 2019!</a></li>
<li><a href="https://www.dragonflydigest.com/2019/07/15/23199.html" rel="nofollow">tcp keepalive and dports on DragonFly</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Patrick - <a href="http://dpaste.com/1W2HJ04" rel="nofollow">OpenZFS/ZoL Module from Ports</a></li>
<li>Brad - <a href="http://dpaste.com/345VM9Y#wrap" rel="nofollow">Services not starting</a></li>
<li>Simon - <a href="http://dpaste.com/1B4ZKC8#wrap" rel="nofollow">Feedback</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0308.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Replacing a (silently) failing disk in a ZFS pool, OPNsense 19.7 RC1 released, implementing DRM ioctl support for NetBSD, High quality/low latency VOIP server with umurmur/Mumble on OpenBSD, the PDP-7 where Unix began, LLDB watchpoints, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://imil.net/blog/2019/07/02/Replacing-a-silently-failing-disk-in-a-ZFS-pool/" rel="nofollow">Replacing a (silently) failing disk in a ZFS pool</a></h3>

<blockquote>
<p>Maybe I can’t read, but I have the feeling that official documentations explain every single corner case for a given tool, except the one you will actually need. My today’s struggle: replacing a disk within a FreeBSD ZFS pool.<br>
What? there’s a shitton of docs on this topic! Are you stupid?<br>
I don’t know, maybe. Yet none covered the process in a simple, straight and complete manner.</p>
</blockquote>

<hr>

<h3><a href="https://opnsense.org/opnsense-19-7-rc1-released/" rel="nofollow">OPNsense 19.7 RC1 released</a></h3>

<blockquote>
<p>Hi there,<br>
For four and a half years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.<br>
We thank all of you for helping test, shape and contribute to the project! We know it would not be the same without you.<br>
Download links, an installation guide[1] and the checksums for the images can be found below as well.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/implementation_of_drm_ioctl_support" rel="nofollow">Implementation of DRM ioctl Support for NetBSD kernel</a></h3>

<ul>
<li>What is DRM ioctl ?</li>
</ul>

<blockquote>
<p>Ioctls are input/output control system calls and DRM stands for direct rendering manager The DRM layer provides several services to graphics drivers, many of them driven by the application interfaces it provides through libdrm, the library that wraps most of the DRM ioctls. These include vblank event handling, memory management, output management, framebuffer management, command submission &amp; fencing, suspend/resume support, and DMA services.</p>
</blockquote>

<ul>
<li>Native DRM ioctl calls</li>
</ul>

<blockquote>
<p>NetBSD was able to make native DRM ioctl calls with hardware rendering once xorg and proper mesa packages where installed. We used the glxinfo and glxgears applications to test this out.</p>
</blockquote>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2019-07-04-umurmur.html" rel="nofollow">High quality / low latency VOIP server with umurmur/Mumble on OpenBSD</a></h3>

<blockquote>
<p>Discord users keep telling about their so called discord server, which is not dedicated to them at all. And Discord has a very bad quality and a lot of voice distorsion.<br>
Why not run your very own mumble server with high voice quality and low latency and privacy respect? This is very easy to setup on OpenBSD!<br>
Mumble is an open source voip client, it has a client named Mumble (available on various operating system) and at least Android, the server part is murmur but there is a lightweight server named umurmur. People authentication is done through certificate generated locally and automatically accepted on a server, and the certificate get associated with a nickname. Nobody can pick the same nickname as another person if it’s not the same certificate.</p>
</blockquote>

<hr>

<h3><a href="https://blog.softwaremill.com/tmwl-june19-js-fetch-api-scheduling-in-spring-thoughts-on-unix-fd54f50ecd64" rel="nofollow">TMWL June’19 — JS Fetch API, scheduling in Spring, thoughts on Unix</a></h3>

<ul>
<li>Unix — going back to the roots</li>
</ul>

<blockquote>
<p>From time to time, I like to review my knowledge in a certain area, even when I feel like I know a lot about it already. I go back to the basics and read tutorials, manuals, books or watch interesting videos.<br>
I’ve been using macOS for a couple of years now, previously being a linux user for some (relatively short) time. Both these operating systems have a common ancestor — Unix. While I’m definitely not an expert, I feel quite comfortable using linux &amp; macOS — I understand the concepts behind the system architecture, know a lot of command line tools &amp; navigate through the shell without a hassle. So-called unix philosophy is also close to my heart. I always feel like there’s more I could squeeze out of it.<br>
Recently, I found that book titled “Unix for dummies, 5th edition” which was published back in… 2004. Feels literally like AGES in the computer-related world. However, it was a great shot — the book starts with the basics, providing some brief history of Unix and how it came to life. It talks a lot about the structure of the system and where certain pieces fit (eg. “standard” set of tools), and how to understand permissions and work with files &amp; directories. There’s even a whole chapter about shell-based text editors like Vi and Emacs! Despite the fact that I am familiar with most of these, I could still find some interesting pieces &amp; tools that I either knew existed (but never had a chance to use), or even haven’t ever heard of. And almost all of these are still valid in the modern “incarnations” of Unix’s descendants: Linux and macOS.<br>
The book also talks about networking, surfing the web &amp; working with email. It’s cute to see pictures of those old browsers rendering “ancient” Internet websites, but hey — this is how it looked like no more than fifteen years ago!<br>
I can really recommend this book to anyone working on modern macOS or Linux — you will certainly find some interesting pieces. Especially if you like to go back to the roots from time to time as I do!</p>
</blockquote>

<hr>

<h3><a href="https://bsdimp.blogspot.com/2019/07/the-pdp-7-where-unix-began.html" rel="nofollow">ThePDP-7 Where Unix Began</a></h3>

<blockquote>
<p>In preparation for a talk on Seventh Edition Unix this fall, I stumbled upon a service list from DEC for all known PDP-7 machines. From that list, and other sources, I believe that PDP-7 serial number 34 was the original Unix machine.<br>
V0 Unix could run on only one of the PDP-7s. Of the 99 PDP-7s produced, only two had disks. Serial number 14 had an RA01 listed, presumably a disk, though of a different type. In addition to the PDP-7 being obsolete in 1970, no other PDP-7 could run Unix, limiting its appeal outside of Bell Labs. By porting Unix to the PDP-11 in 1970, the group ensured Unix would live on into the future. The PDP-9 and PDP-15 were both upgrades of the PDP-7, so to be fair, PDP-7 Unix did have a natural upgrade path (the PDP-11 out sold the 18 bit systems though ~600,000 to ~1000). Ken Thompson reports in a private email that there were 2 PDP-9s and 1 PDP-15 at Bell Labs that could run a version of the PDP-7 Unix, though those machines were viewed as born obsolete.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/lldb_watchpoints_xstate_in_ptrace" rel="nofollow">LLDB: watchpoints, XSTATE in ptrace() and core dumps</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.<br>
In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and lately extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues. You can read more about that in my May 2019 report.<br>
In June, I have finally finished the remaining ptrace() work for xstate and got it merged both on NetBSD and LLDB end (meaning it&#39;s going to make it into NetBSD 9). I have also worked on debug register support in LLDB, effectively fixing watchpoint support. Once again I had to fight some upstream regressions.</p>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://project-trident.org/post/2019-07-12_19.07_available/" rel="nofollow">Project Trident 19.07 Available</a></li>
<li><a href="https://www.montanalinux.org/cold-blood-list-of-numbers-201907.html" rel="nofollow">A list of names from &quot;Cold Blood&quot; -- Any familiar?</a></li>
<li><a href="https://github.com/enkiv2/fern" rel="nofollow">fern: a curses-based mastodon client modeled off usenet news readers &amp; pine, with an emphasis on getting to &#39;timeline zero&#39;</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20190707065226" rel="nofollow">OpenBSD Community goes Platinum for 2019!</a></li>
<li><a href="https://www.dragonflydigest.com/2019/07/15/23199.html" rel="nofollow">tcp keepalive and dports on DragonFly</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Patrick - <a href="http://dpaste.com/1W2HJ04" rel="nofollow">OpenZFS/ZoL Module from Ports</a></li>
<li>Brad - <a href="http://dpaste.com/345VM9Y#wrap" rel="nofollow">Services not starting</a></li>
<li>Simon - <a href="http://dpaste.com/1B4ZKC8#wrap" rel="nofollow">Feedback</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0308.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>307: Twitching with OpenBSD</title>
  <link>https://www.bsdnow.tv/307</link>
  <guid isPermaLink="false">1bd153c0-be65-44ed-8f12-f73d97e93d8b</guid>
  <pubDate>Thu, 18 Jul 2019 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1bd153c0-be65-44ed-8f12-f73d97e93d8b.mp3" length="36709691" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 11.3 has been released, OpenBSD workstation, write your own fuzzer for the NetBSD kernel, Exploiting FreeBSD-SA-19:02.fd, streaming to twitch using OpenBSD, 3 different ways of dumping hex contents of a file, and more.</itunes:subtitle>
  <itunes:duration>50:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 11.3 has been released, OpenBSD workstation, write your own fuzzer for the NetBSD kernel, Exploiting FreeBSD-SA-19:02.fd, streaming to twitch using OpenBSD, 3 different ways of dumping hex contents of a file, and more.
Headlines
FreeBSD 11.3-RELEASE Announcement (https://www.freebsd.org/releases/11.3R/announce.html)
The FreeBSD Release Engineering Team is pleased to announce the availability of FreeBSD 11.3-RELEASE. This is the fourth release of the stable/11 branch.
Some of the highlights:
The clang, llvm, lld, lldb, and compiler-rt utilities as well as libc++ have been updated to upstream version 8.0.0.
The ELF Tool Chain has been updated to version r3614.
OpenSSL has been updated to version 1.0.2s.
The ZFS filesystem has been updated to implement parallel mounting.
The loader(8) has been updated to extend geli(8) support to all architectures.
The pkg(8) utility has been updated to version 1.10.5.
The KDE desktop environment has been updated to version 5.15.3.
The GNOME desktop environment has been updated to version 3.28.
The kernel will now log the jail(8) ID when logging a process exit.
Several feature additions and updates to userland applications.
Several network driver firmware updates.
Warnings for features deprecated in future releases will now be printed on all FreeBSD versions.
Warnings have been added for IPSec algorithms deprecated in RFC 8221.
Deprecation warnings have been added for weaker algorithms when creating geli(8) providers.
And more...
OpenBSD Is Now My Workstation (https://sogubsys.com/openbsd-is-now-my-workstation-operating-system/)
Why OpenBSD? Simply because it is the best tool for the job for me for my new-to-me Lenovo Thinkpad T420. Additionally, I do care about security and non-bloat in my personal operating systems (business needs can have different priorities, to be clear).
I will try to detail what my reasons are for going with OpenBSD (instead of GNU/Linux, NetBSD, or FreeBSD of which I’m comfortable using without issue), challenges and frustrations I’ve encountered, and what my opinions are along the way.
Disclaimer: in this post, I’m speaking about what is my opinion, and I’m not trying to convince you to use OpenBSD or anything else. I don’t truly care, but wanted to share in case it could be useful to you. I do hope you give OpenBSD a shot as your workstation, especially if it has been a while.
A Bit About Me and OpenBSD
I’m not new to OpenBSD, to be clear. I’ve been using it off and on for over 20 years. The biggest time in my life was the early 2000s (I was even the Python port maintainer for a bit), where I not only used it for my workstation, but also for production servers and network devices.
I just haven’t used it as a workstation (outside of a virtual machine) in over 10 years, but have used it for servers. Workstation needs, especially for a primary workstation, are greatly different and the small things end up mattering most.
News Roundup
Write your own fuzzer for NetBSD kernel! [Part 1] (https://blog.netbsd.org/tnf/entry/write_your_own_fuzzer_for)
How Fuzzing works? The dummy Fuzzer.
The easy way to describe fuzzing is to compare it to the process of unit testing a program, but with different input. This input can be random, or it can be generated in some way that makes it unexpected form standard execution perspective.
The simplest 'fuzzer' can be written in few lines of bash, by getting N bytes from /dev/rand, and putting them to the program as a parameter.
Coverage and Fuzzing
What can be done to make fuzzing more effective? If we think about fuzzing as a process, where we place data into the input of the program (which is a black box), and we can only interact via input, not much more can be done.
However, programs usually process different inputs at different speeds, which can give us some insight into the program's behavior. During fuzzing, we are trying to crash the program, thus we need additional probes to observe the program's behaviour.
Additional knowledge about program state can be exploited as a feedback loop for generating new input vectors. Knowledge about the program itself and the structure of input data can also be considered. As an example, if the input data is in the form of HTML, changing characters inside the body will probably cause less problems for the parser than experimenting with headers and HTML tags.
For open source programs, we can read the source code to know what input takes which execution path. Nonetheless, this might be very time consuming, and it would be much more helpful if this can be automated. As it turns out, this process can be improved by tracing coverage of the execution
vBSDcon - CFP - Call for Papers ends July 19th (https://vbsdcon.com/)
You can submit your proposal at https://easychair.org/conferences/?conf=vbsdcon2019
The talks will have a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.
If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal.
Possible topics include: How we manage a giant installation with respect to handling spam, snd/or sysadmin, and/or networking, Cool new stuff in BSD, Tell us about your project which runs on BSD.
Both users and developers are encouraged to share their experiences.
Exploiting FreeBSD-SA-19:02.fd (https://secfault-security.com/blog/FreeBSD-SA-1902.fd.html)
In February 2019 the FreeBSD project issued an advisory about a possible vulnerability in the handling of file descriptors. UNIX-like systems such as FreeBSD allow to send file descriptors to other processes via UNIX-domain sockets. This can for example be used to pass file access privileges to the receiving process.
Inside the kernel, file descriptors are used to indirectly reference a C struct which stores the relevant information about the file object. This could for instance include a reference to a vnode which describes the file for the file system, the file type, or the access privileges.
What really happens if a UNIX-domain socket is used to send a file descriptor to another process is that for the receiving process, inside the kernel a reference to this struct is created. As the new file descriptor is a reference to the same file object, all information is inherited. For instance, this can allow to give another process write access to a file on the drive even if the process owner is normally not able to open the file writable.
The advisory describes that FreeBSD 12.0 introduced a bug in this mechanism. As the file descriptor information is sent via a socket, the sender and the receiver have to allocate buffers for the procedure. If the receiving buffer is not large enough, the FreeBSD kernel attempts to close the received file descriptors to prevent a leak of these to the sender. However, while the responsible function closes the file descriptor, it fails to release the reference from the file descriptor to the file object. This could cause the reference counter to wrap.
The advisory further states that the impact of this bug is possibly a local privilege escalation to gain root privileges or a jail escape. However, no proof-of-concept was provided by the advisory authors.
In the next section, the bug itself is analyzed to make a statement about the bug class and a guess about a possible exploitation primitive.
After that, the bug trigger is addressed.
It follows a discussion of three imaginable exploitation strategies - including a discussion of why two of these approaches failed.
In the section before last, the working exploit primitive is discussed. It introduces a (at least to the author’s knowledge) new exploitation technique for these kind of vulnerabilities in FreeBSD. The stabilization of the exploit is addressed, too.
The last section wraps everything up in a conclusion and points out further steps and challenges.
The privilege escalation is now a piece of cake thanks to a technique used by kingcope, who published a FreeBSD root exploit in 2005, which writes to the file /etc/libmap.conf. This configuration file can be used to hook the loading of dynamic libraries if a program is started. The exploit therefore creates a dynamic library, which copies /bin/sh to another file and sets the suid-bit for the copy. The hooked library is libutil, which is for instance called by su. Therefore, a call to su by the user will afterwards result in a suid copy of /bin/sh.
Streaming to Twitch using OpenBSD (https://dataswamp.org/~solene/2019-07-06-twitch.html)
 Introduction
If you ever wanted to make a twitch stream from your OpenBSD system, this is now possible, thanks to OpenBSD developer thfr@ who made a wrapper named fauxstream using ffmpeg with relevant parameters.
The setup is quite easy, it only requires a few steps and searching on Twitch website two informations, hopefully, to ease the process, I found the links for you.
You will need to make an account on twitch, get your api key (a long string of characters) which should stay secret because it allow anyone having it to stream on your account.
These same techniques should work for Twitch, YouTube Live, Periscope, Facebook, etc, including the live streaming service ScaleEngine provides free to BSD user groups.
There is also an open source application called ‘OBS’ or Open Broadcaster Studio. It is in FreeBSD ports and should work on all of the other BSDs as well. It has a GUI and supports compositing and green screening. We use it heavily at ScaleEngine and it is also used at JupiterBroadcasting in place of WireCast, a $1000-per-copy commercial application.
Beastie Bits
Portland BSD Pizza Night - 2019-07-25 19:00 - Rudy's Gourmet Pizza (http://calagator.org/events/1250475868)
KnoxBUG - Michael W. Lucas : Twenty Years in Jail (http://knoxbug.org/2019-07-29)
Ohio Linuxfest - CFP - Closes August 17th (https://ohiolinux.org/call-for-presentations/)
My college (NYU Tandon) is moving their CS department and I saw this on a shelf being moved (https://old.reddit.com/r/freebsd/comments/cdx8fp/my_college_nyu_tandon_is_moving_their_cs/)
3 different ways of dumping hex contents of a file (https://moopost.blogspot.com/2019/07/3-different-ways-of-dumping-hex.html)
Feedback/Questions
Sebastian - ZFS setup toward ESXi (http://dpaste.com/0DRKFH6#wrap)
Christopher - Questions (http://dpaste.com/2YNN1SH)
Ser - Bhyve and Microsoft SQL (http://dpaste.com/1F5TMT0#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, workstation, streaming, twitch, hex, dump, dumping</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 11.3 has been released, OpenBSD workstation, write your own fuzzer for the NetBSD kernel, Exploiting FreeBSD-SA-19:02.fd, streaming to twitch using OpenBSD, 3 different ways of dumping hex contents of a file, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/11.3R/announce.html" rel="nofollow">FreeBSD 11.3-RELEASE Announcement</a></h3>

<blockquote>
<p>The FreeBSD Release Engineering Team is pleased to announce the availability of FreeBSD 11.3-RELEASE. This is the fourth release of the stable/11 branch.</p>
</blockquote>

<ul>
<li>Some of the highlights:

<ul>
<li>The clang, llvm, lld, lldb, and compiler-rt utilities as well as libc++ have been updated to upstream version 8.0.0.</li>
<li>The ELF Tool Chain has been updated to version r3614.</li>
<li>OpenSSL has been updated to version 1.0.2s.</li>
<li>The ZFS filesystem has been updated to implement parallel mounting.</li>
<li>The loader(8) has been updated to extend geli(8) support to all architectures.</li>
<li>The pkg(8) utility has been updated to version 1.10.5.</li>
<li>The KDE desktop environment has been updated to version 5.15.3.</li>
<li>The GNOME desktop environment has been updated to version 3.28.</li>
<li>The kernel will now log the jail(8) ID when logging a process exit.</li>
<li>Several feature additions and updates to userland applications.</li>
<li>Several network driver firmware updates.</li>
<li>Warnings for features deprecated in future releases will now be printed on all FreeBSD versions.</li>
<li>Warnings have been added for IPSec algorithms deprecated in RFC 8221.</li>
<li>Deprecation warnings have been added for weaker algorithms when creating geli(8) providers.</li>
<li>And more...</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://sogubsys.com/openbsd-is-now-my-workstation-operating-system/" rel="nofollow">OpenBSD Is Now My Workstation</a></h3>

<blockquote>
<p>Why OpenBSD? Simply because it is the best tool for the job for me for my new-to-me Lenovo Thinkpad T420. Additionally, I do care about security and non-bloat in my personal operating systems (business needs can have different priorities, to be clear).</p>

<p>I will try to detail what my reasons are for going with OpenBSD (instead of GNU/Linux, NetBSD, or FreeBSD of which I’m comfortable using without issue), challenges and frustrations I’ve encountered, and what my opinions are along the way.</p>

<p>Disclaimer: in this post, I’m speaking about what is my opinion, and I’m not trying to convince you to use OpenBSD or anything else. I don’t truly care, but wanted to share in case it could be useful to you. I do hope you give OpenBSD a shot as your workstation, especially if it has been a while.</p>
</blockquote>

<ul>
<li>A Bit About Me and OpenBSD</li>
</ul>

<blockquote>
<p>I’m not new to OpenBSD, to be clear. I’ve been using it off and on for over 20 years. The biggest time in my life was the early 2000s (I was even the Python port maintainer for a bit), where I not only used it for my workstation, but also for production servers and network devices.</p>

<p>I just haven’t used it as a workstation (outside of a virtual machine) in over 10 years, but have used it for servers. Workstation needs, especially for a primary workstation, are greatly different and the small things end up mattering most.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/write_your_own_fuzzer_for" rel="nofollow">Write your own fuzzer for NetBSD kernel! [Part 1]</a></h3>

<ul>
<li>How Fuzzing works? The dummy Fuzzer.</li>
</ul>

<blockquote>
<p>The easy way to describe fuzzing is to compare it to the process of unit testing a program, but with different input. This input can be random, or it can be generated in some way that makes it unexpected form standard execution perspective.</p>

<p>The simplest &#39;fuzzer&#39; can be written in few lines of bash, by getting N bytes from /dev/rand, and putting them to the program as a parameter.</p>
</blockquote>

<ul>
<li>Coverage and Fuzzing</li>
</ul>

<blockquote>
<p>What can be done to make fuzzing more effective? If we think about fuzzing as a process, where we place data into the input of the program (which is a black box), and we can only interact via input, not much more can be done.</p>

<p>However, programs usually process different inputs at different speeds, which can give us some insight into the program&#39;s behavior. During fuzzing, we are trying to crash the program, thus we need additional probes to observe the program&#39;s behaviour.</p>

<p>Additional knowledge about program state can be exploited as a feedback loop for generating new input vectors. Knowledge about the program itself and the structure of input data can also be considered. As an example, if the input data is in the form of HTML, changing characters inside the body will probably cause less problems for the parser than experimenting with headers and HTML tags.</p>

<p>For open source programs, we can read the source code to know what input takes which execution path. Nonetheless, this might be very time consuming, and it would be much more helpful if this can be automated. As it turns out, this process can be improved by tracing coverage of the execution</p>
</blockquote>

<hr>

<h3><a href="https://vbsdcon.com/" rel="nofollow">vBSDcon - CFP - Call for Papers ends July 19th</a></h3>

<blockquote>
<p>You can submit your proposal at <a href="https://easychair.org/conferences/?conf=vbsdcon2019" rel="nofollow">https://easychair.org/conferences/?conf=vbsdcon2019</a></p>

<p>The talks will have a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.</p>

<p>If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal.</p>

<p>Possible topics include: How we manage a giant installation with respect to handling spam, snd/or sysadmin, and/or networking, Cool new stuff in BSD, Tell us about your project which runs on BSD.</p>

<p>Both users and developers are encouraged to share their experiences.</p>
</blockquote>

<hr>

<h3><a href="https://secfault-security.com/blog/FreeBSD-SA-1902.fd.html" rel="nofollow">Exploiting FreeBSD-SA-19:02.fd</a></h3>

<blockquote>
<p>In February 2019 the FreeBSD project issued an advisory about a possible vulnerability in the handling of file descriptors. UNIX-like systems such as FreeBSD allow to send file descriptors to other processes via UNIX-domain sockets. This can for example be used to pass file access privileges to the receiving process.</p>

<p>Inside the kernel, file descriptors are used to indirectly reference a C struct which stores the relevant information about the file object. This could for instance include a reference to a vnode which describes the file for the file system, the file type, or the access privileges.</p>

<p>What really happens if a UNIX-domain socket is used to send a file descriptor to another process is that for the receiving process, inside the kernel a reference to this struct is created. As the new file descriptor is a reference to the same file object, all information is inherited. For instance, this can allow to give another process write access to a file on the drive even if the process owner is normally not able to open the file writable.</p>

<p>The advisory describes that FreeBSD 12.0 introduced a bug in this mechanism. As the file descriptor information is sent via a socket, the sender and the receiver have to allocate buffers for the procedure. If the receiving buffer is not large enough, the FreeBSD kernel attempts to close the received file descriptors to prevent a leak of these to the sender. However, while the responsible function closes the file descriptor, it fails to release the reference from the file descriptor to the file object. This could cause the reference counter to wrap.</p>

<p>The advisory further states that the impact of this bug is possibly a local privilege escalation to gain root privileges or a jail escape. However, no proof-of-concept was provided by the advisory authors.</p>
</blockquote>

<ul>
<li>In the next section, the bug itself is analyzed to make a statement about the bug class and a guess about a possible exploitation primitive.</li>
<li>After that, the bug trigger is addressed.</li>
<li>It follows a discussion of three imaginable exploitation strategies - including a discussion of why two of these approaches failed.</li>
<li>In the section before last, the working exploit primitive is discussed. It introduces a (at least to the author’s knowledge) new exploitation technique for these kind of vulnerabilities in FreeBSD. The stabilization of the exploit is addressed, too.</li>
<li>The last section wraps everything up in a conclusion and points out further steps and challenges.</li>
</ul>

<blockquote>
<p>The privilege escalation is now a piece of cake thanks to a technique used by kingcope, who published a FreeBSD root exploit in 2005, which writes to the file /etc/libmap.conf. This configuration file can be used to hook the loading of dynamic libraries if a program is started. The exploit therefore creates a dynamic library, which copies /bin/sh to another file and sets the suid-bit for the copy. The hooked library is libutil, which is for instance called by su. Therefore, a call to su by the user will afterwards result in a suid copy of /bin/sh.</p>
</blockquote>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2019-07-06-twitch.html" rel="nofollow">Streaming to Twitch using OpenBSD</a></h3>

<ul>
<li> Introduction</li>
</ul>

<blockquote>
<p>If you ever wanted to make a twitch stream from your OpenBSD system, this is now possible, thanks to OpenBSD developer thfr@ who made a wrapper named fauxstream using ffmpeg with relevant parameters.</p>

<p>The setup is quite easy, it only requires a few steps and searching on Twitch website two informations, hopefully, to ease the process, I found the links for you.</p>

<p>You will need to make an account on twitch, get your api key (a long string of characters) which should stay secret because it allow anyone having it to stream on your account.</p>
</blockquote>

<ul>
<li>These same techniques should work for Twitch, YouTube Live, Periscope, Facebook, etc, including the live streaming service ScaleEngine provides free to BSD user groups.</li>
<li>There is also an open source application called ‘OBS’ or Open Broadcaster Studio. It is in FreeBSD ports and should work on all of the other BSDs as well. It has a GUI and supports compositing and green screening. We use it heavily at ScaleEngine and it is also used at JupiterBroadcasting in place of WireCast, a $1000-per-copy commercial application.</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://calagator.org/events/1250475868" rel="nofollow">Portland BSD Pizza Night - 2019-07-25 19:00 - Rudy&#39;s Gourmet Pizza</a></li>
<li><a href="http://knoxbug.org/2019-07-29" rel="nofollow">KnoxBUG - Michael W. Lucas : Twenty Years in Jail</a></li>
<li><a href="https://ohiolinux.org/call-for-presentations/" rel="nofollow">Ohio Linuxfest - CFP - Closes August 17th</a></li>
<li><a href="https://old.reddit.com/r/freebsd/comments/cdx8fp/my_college_nyu_tandon_is_moving_their_cs/" rel="nofollow">My college (NYU Tandon) is moving their CS department and I saw this on a shelf being moved</a></li>
<li><a href="https://moopost.blogspot.com/2019/07/3-different-ways-of-dumping-hex.html" rel="nofollow">3 different ways of dumping hex contents of a file</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Sebastian - <a href="http://dpaste.com/0DRKFH6#wrap" rel="nofollow">ZFS setup toward ESXi</a></li>
<li>Christopher - <a href="http://dpaste.com/2YNN1SH" rel="nofollow">Questions</a></li>
<li>Ser - <a href="http://dpaste.com/1F5TMT0#wrap" rel="nofollow">Bhyve and Microsoft SQL</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0307.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 11.3 has been released, OpenBSD workstation, write your own fuzzer for the NetBSD kernel, Exploiting FreeBSD-SA-19:02.fd, streaming to twitch using OpenBSD, 3 different ways of dumping hex contents of a file, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/11.3R/announce.html" rel="nofollow">FreeBSD 11.3-RELEASE Announcement</a></h3>

<blockquote>
<p>The FreeBSD Release Engineering Team is pleased to announce the availability of FreeBSD 11.3-RELEASE. This is the fourth release of the stable/11 branch.</p>
</blockquote>

<ul>
<li>Some of the highlights:

<ul>
<li>The clang, llvm, lld, lldb, and compiler-rt utilities as well as libc++ have been updated to upstream version 8.0.0.</li>
<li>The ELF Tool Chain has been updated to version r3614.</li>
<li>OpenSSL has been updated to version 1.0.2s.</li>
<li>The ZFS filesystem has been updated to implement parallel mounting.</li>
<li>The loader(8) has been updated to extend geli(8) support to all architectures.</li>
<li>The pkg(8) utility has been updated to version 1.10.5.</li>
<li>The KDE desktop environment has been updated to version 5.15.3.</li>
<li>The GNOME desktop environment has been updated to version 3.28.</li>
<li>The kernel will now log the jail(8) ID when logging a process exit.</li>
<li>Several feature additions and updates to userland applications.</li>
<li>Several network driver firmware updates.</li>
<li>Warnings for features deprecated in future releases will now be printed on all FreeBSD versions.</li>
<li>Warnings have been added for IPSec algorithms deprecated in RFC 8221.</li>
<li>Deprecation warnings have been added for weaker algorithms when creating geli(8) providers.</li>
<li>And more...</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://sogubsys.com/openbsd-is-now-my-workstation-operating-system/" rel="nofollow">OpenBSD Is Now My Workstation</a></h3>

<blockquote>
<p>Why OpenBSD? Simply because it is the best tool for the job for me for my new-to-me Lenovo Thinkpad T420. Additionally, I do care about security and non-bloat in my personal operating systems (business needs can have different priorities, to be clear).</p>

<p>I will try to detail what my reasons are for going with OpenBSD (instead of GNU/Linux, NetBSD, or FreeBSD of which I’m comfortable using without issue), challenges and frustrations I’ve encountered, and what my opinions are along the way.</p>

<p>Disclaimer: in this post, I’m speaking about what is my opinion, and I’m not trying to convince you to use OpenBSD or anything else. I don’t truly care, but wanted to share in case it could be useful to you. I do hope you give OpenBSD a shot as your workstation, especially if it has been a while.</p>
</blockquote>

<ul>
<li>A Bit About Me and OpenBSD</li>
</ul>

<blockquote>
<p>I’m not new to OpenBSD, to be clear. I’ve been using it off and on for over 20 years. The biggest time in my life was the early 2000s (I was even the Python port maintainer for a bit), where I not only used it for my workstation, but also for production servers and network devices.</p>

<p>I just haven’t used it as a workstation (outside of a virtual machine) in over 10 years, but have used it for servers. Workstation needs, especially for a primary workstation, are greatly different and the small things end up mattering most.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/write_your_own_fuzzer_for" rel="nofollow">Write your own fuzzer for NetBSD kernel! [Part 1]</a></h3>

<ul>
<li>How Fuzzing works? The dummy Fuzzer.</li>
</ul>

<blockquote>
<p>The easy way to describe fuzzing is to compare it to the process of unit testing a program, but with different input. This input can be random, or it can be generated in some way that makes it unexpected form standard execution perspective.</p>

<p>The simplest &#39;fuzzer&#39; can be written in few lines of bash, by getting N bytes from /dev/rand, and putting them to the program as a parameter.</p>
</blockquote>

<ul>
<li>Coverage and Fuzzing</li>
</ul>

<blockquote>
<p>What can be done to make fuzzing more effective? If we think about fuzzing as a process, where we place data into the input of the program (which is a black box), and we can only interact via input, not much more can be done.</p>

<p>However, programs usually process different inputs at different speeds, which can give us some insight into the program&#39;s behavior. During fuzzing, we are trying to crash the program, thus we need additional probes to observe the program&#39;s behaviour.</p>

<p>Additional knowledge about program state can be exploited as a feedback loop for generating new input vectors. Knowledge about the program itself and the structure of input data can also be considered. As an example, if the input data is in the form of HTML, changing characters inside the body will probably cause less problems for the parser than experimenting with headers and HTML tags.</p>

<p>For open source programs, we can read the source code to know what input takes which execution path. Nonetheless, this might be very time consuming, and it would be much more helpful if this can be automated. As it turns out, this process can be improved by tracing coverage of the execution</p>
</blockquote>

<hr>

<h3><a href="https://vbsdcon.com/" rel="nofollow">vBSDcon - CFP - Call for Papers ends July 19th</a></h3>

<blockquote>
<p>You can submit your proposal at <a href="https://easychair.org/conferences/?conf=vbsdcon2019" rel="nofollow">https://easychair.org/conferences/?conf=vbsdcon2019</a></p>

<p>The talks will have a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.</p>

<p>If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal.</p>

<p>Possible topics include: How we manage a giant installation with respect to handling spam, snd/or sysadmin, and/or networking, Cool new stuff in BSD, Tell us about your project which runs on BSD.</p>

<p>Both users and developers are encouraged to share their experiences.</p>
</blockquote>

<hr>

<h3><a href="https://secfault-security.com/blog/FreeBSD-SA-1902.fd.html" rel="nofollow">Exploiting FreeBSD-SA-19:02.fd</a></h3>

<blockquote>
<p>In February 2019 the FreeBSD project issued an advisory about a possible vulnerability in the handling of file descriptors. UNIX-like systems such as FreeBSD allow to send file descriptors to other processes via UNIX-domain sockets. This can for example be used to pass file access privileges to the receiving process.</p>

<p>Inside the kernel, file descriptors are used to indirectly reference a C struct which stores the relevant information about the file object. This could for instance include a reference to a vnode which describes the file for the file system, the file type, or the access privileges.</p>

<p>What really happens if a UNIX-domain socket is used to send a file descriptor to another process is that for the receiving process, inside the kernel a reference to this struct is created. As the new file descriptor is a reference to the same file object, all information is inherited. For instance, this can allow to give another process write access to a file on the drive even if the process owner is normally not able to open the file writable.</p>

<p>The advisory describes that FreeBSD 12.0 introduced a bug in this mechanism. As the file descriptor information is sent via a socket, the sender and the receiver have to allocate buffers for the procedure. If the receiving buffer is not large enough, the FreeBSD kernel attempts to close the received file descriptors to prevent a leak of these to the sender. However, while the responsible function closes the file descriptor, it fails to release the reference from the file descriptor to the file object. This could cause the reference counter to wrap.</p>

<p>The advisory further states that the impact of this bug is possibly a local privilege escalation to gain root privileges or a jail escape. However, no proof-of-concept was provided by the advisory authors.</p>
</blockquote>

<ul>
<li>In the next section, the bug itself is analyzed to make a statement about the bug class and a guess about a possible exploitation primitive.</li>
<li>After that, the bug trigger is addressed.</li>
<li>It follows a discussion of three imaginable exploitation strategies - including a discussion of why two of these approaches failed.</li>
<li>In the section before last, the working exploit primitive is discussed. It introduces a (at least to the author’s knowledge) new exploitation technique for these kind of vulnerabilities in FreeBSD. The stabilization of the exploit is addressed, too.</li>
<li>The last section wraps everything up in a conclusion and points out further steps and challenges.</li>
</ul>

<blockquote>
<p>The privilege escalation is now a piece of cake thanks to a technique used by kingcope, who published a FreeBSD root exploit in 2005, which writes to the file /etc/libmap.conf. This configuration file can be used to hook the loading of dynamic libraries if a program is started. The exploit therefore creates a dynamic library, which copies /bin/sh to another file and sets the suid-bit for the copy. The hooked library is libutil, which is for instance called by su. Therefore, a call to su by the user will afterwards result in a suid copy of /bin/sh.</p>
</blockquote>

<hr>

<h3><a href="https://dataswamp.org/%7Esolene/2019-07-06-twitch.html" rel="nofollow">Streaming to Twitch using OpenBSD</a></h3>

<ul>
<li> Introduction</li>
</ul>

<blockquote>
<p>If you ever wanted to make a twitch stream from your OpenBSD system, this is now possible, thanks to OpenBSD developer thfr@ who made a wrapper named fauxstream using ffmpeg with relevant parameters.</p>

<p>The setup is quite easy, it only requires a few steps and searching on Twitch website two informations, hopefully, to ease the process, I found the links for you.</p>

<p>You will need to make an account on twitch, get your api key (a long string of characters) which should stay secret because it allow anyone having it to stream on your account.</p>
</blockquote>

<ul>
<li>These same techniques should work for Twitch, YouTube Live, Periscope, Facebook, etc, including the live streaming service ScaleEngine provides free to BSD user groups.</li>
<li>There is also an open source application called ‘OBS’ or Open Broadcaster Studio. It is in FreeBSD ports and should work on all of the other BSDs as well. It has a GUI and supports compositing and green screening. We use it heavily at ScaleEngine and it is also used at JupiterBroadcasting in place of WireCast, a $1000-per-copy commercial application.</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://calagator.org/events/1250475868" rel="nofollow">Portland BSD Pizza Night - 2019-07-25 19:00 - Rudy&#39;s Gourmet Pizza</a></li>
<li><a href="http://knoxbug.org/2019-07-29" rel="nofollow">KnoxBUG - Michael W. Lucas : Twenty Years in Jail</a></li>
<li><a href="https://ohiolinux.org/call-for-presentations/" rel="nofollow">Ohio Linuxfest - CFP - Closes August 17th</a></li>
<li><a href="https://old.reddit.com/r/freebsd/comments/cdx8fp/my_college_nyu_tandon_is_moving_their_cs/" rel="nofollow">My college (NYU Tandon) is moving their CS department and I saw this on a shelf being moved</a></li>
<li><a href="https://moopost.blogspot.com/2019/07/3-different-ways-of-dumping-hex.html" rel="nofollow">3 different ways of dumping hex contents of a file</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Sebastian - <a href="http://dpaste.com/0DRKFH6#wrap" rel="nofollow">ZFS setup toward ESXi</a></li>
<li>Christopher - <a href="http://dpaste.com/2YNN1SH" rel="nofollow">Questions</a></li>
<li>Ser - <a href="http://dpaste.com/1F5TMT0#wrap" rel="nofollow">Bhyve and Microsoft SQL</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0307.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>306: Comparing Hammers</title>
  <link>https://www.bsdnow.tv/306</link>
  <guid isPermaLink="false">2e907009-f426-4bbd-a592-d91329f11f0f</guid>
  <pubDate>Thu, 11 Jul 2019 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2e907009-f426-4bbd-a592-d91329f11f0f.mp3" length="27620333" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Am5x86 based retro UNIX build log, setting up services in a FreeNAS Jail, first taste of DragonflyBSD, streaming Netflix on NetBSD, NetBSD on the last G4 Mac mini, Hammer vs Hammer2, and more.</itunes:subtitle>
  <itunes:duration>38:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Am5x86 based retro UNIX build log, setting up services in a FreeNAS Jail, first taste of DragonflyBSD, streaming Netflix on NetBSD, NetBSD on the last G4 Mac mini, Hammer vs Hammer2, and more.
Headlines
Polprog's Am5x86 based retro UNIX build log (https://polprog.net/blog/486/)
I have recently acquired an Am5x86 computer, in a surprisingly good condition. This is an ongoing project, check this page often for updates!
I began by connecting a front panel. The panel came from a different chassis and is slightly too wide, so I had to attach it with a couple of zip-ties. However, that makes it stick out from the PC front at an angle, allowing easy access when the computer sits at the floor - and thats where it is most of the time. It's not that bad, to be honest, and its way easier to access than it would be, if mounted vertically
There is a mains switch on the front panel because the computer uses an older style power supply. Those power supplies instead of relying on a PSON signal, like modern ATX supplies, run a 4 wire cable to a mains switch. The cable carries live and neutral both ways, and the switch keys in or out the power. The system powers on as soon as the switch is enabled.
Originally there was no graphics card in it. Since a PC will not boot with out a GPU, I had to find one. The mainboard only has PCI and ISA slots, and all the GPUs I had were AGP. Fortunately, I bought a PCI GPU hoping it would solve my issue...
However the GPU turned out to be faulty. It took me some time to repair it. I had to repair a broken trace leading to one of the EEPROM pins, and replace a contact in the EEPROM's socket. Then I replaced all the electrolytic capacitors on it, and that fixed it for good.
Having used up only one of the three PCI slots, I populated the remaining pair with two ethernet cards. I still have a bunch of ISA slots available, but I have nothing to install there. Yet.
See the article for the rest of the writeup
Setting up services in a FreeNAS Jail (https://www.ixsystems.com/blog/services-in-freenas-jail/)
This piece demonstrates the setup of a server service in a FreeNAS jail and how to share files with a jail using Apache 2.4 as an example. Jails are powerful, self-contained FreeBSD environments with separate network settings, package management, and access to thousands of FreeBSD application packages. Popular packages such as Apache, NGINX, LigHTTPD, MySQL, and PHP can be found and installed with the pkg search and pkg install commands. 
This example shows creating a jail, installing an Apache web server, and setting up a simple web page. 
NOTE: Do not directly attach FreeNAS to an external network (WAN). Use port forwarding, proper firewalls and DDoS protections when using FreeNAS for external web sites. This example demonstrates expanding the functionality of FreeNAS in an isolated LAN environment.
News Roundup
First taste of DragonflyBSD (https://nanxiao.me/en/first-taste-of-dragonfly-bsd/)
Last week, I needed to pick a BSD Operating System which supports NUMA to do some testing, so I decided to give Dragonfly BSD a shot. Dragonfly BSDonly can run on X86_64 architecture, which reminds me of Arch Linux, and after some tweaking, I feel Dragonfly BSD may be a “developer-friendly” Operating System, at least for me.
I mainly use Dragonfly BSD as a server, so I don’t care whether GUI is fancy or not. But I have high requirements of developer tools, i.e., compiler and debugger. The default compiler of Dragonfly BSD is gcc 8.3, and I can also install clang 8.0.0 from package. This means I can test state-of-the-art features of compilers, and it is really important for me. gdb‘s version is 7.6.1, a little lag behind, but still OK.
Furthermore, the upgradation of Dragonfly BSD is pretty simple and straightforward. I followed document to upgrade my Operating System to 5.6.0 this morning, just copied and pasted, no single error, booted successfully.
Streaming Netflix on NetBSD (https://www.unitedbsd.com/d/68-streaming-netflix-on-netbsd)
Here's a step-by-step guide that allows streaming Netflix media on NetBSD using a intel-haxm accelerated QEMU vm.
Heads-up! Sound doesn't work, but everything else is fine. Please read the rest of this thread for a solution to this!!
“Sudo Mastery 2nd Edition” cover art reveal (https://mwl.io/archives/4320)
I’m about halfway through the new edition of Sudo Mastery. Assuming nothing terrible happens, should have a complete first draft in four to six weeks. Enough stuff has changed in sudo that I need to carefully double-check every single feature. (I’m also horrified by the painfully obsolete versions of sudo shipped in the latest versions of CentOS and Debian, but people running those operating systems are already accustomed to their creaky obsolescence.)
But the reason for this blog post? I have Eddie Sharam’s glorious cover art. My Patronizers saw it last month, so now the rest of you get a turn.
NetBSD on the last G4 Mac mini (https://tenfourfox.blogspot.com/2019/06/and-now-for-something-completely.html)
I'm a big fan of NetBSD. I've run it since 2000 on a Mac IIci (of course it's still running it) and I ran it for several years on a Power Mac 7300 with a G3 card which was the second incarnation of the Floodgap gopher server. Today I also still run it on a MIPS-based Cobalt RaQ 2 and an HP Jornada 690. I think NetBSD is a better match for smaller or underpowered systems than current-day Linux, and is fairly easy to harden and keep secure even though none of these systems are exposed to the outside world.
Recently I had a need to set up a bridge system that would be fast enough to connect two networks and I happened to have two of the "secret" last-of-the-line 1.5GHz G4 Mac minis sitting on the shelf doing nothing. Yes, they're probably outclassed by later Raspberry Pi models, but I don't have to buy anything and I like putting old hardware to good use.
Hammer vs Hammer2 (https://phoronix.com/scan.php?page=news_item&amp;amp;px=DragonFlyBSD-5.6-HAMMER2-Perf)
With the newly released DragonFlyBSD 5.6 there are improvements to its original HAMMER2 file-system to the extent that it's now selected by its installer as the default file-system choice for new installations. Curious how the performance now compares between HAMMER and HAMMER2, here are some initial benchmarks on an NVMe solid-state drive using DragonFlyBSD 5.6.0. 
With a 120GB Toshiba NVMe SSD on an Intel Core i7 8700K system, I ran some benchmarks of DragonFlyBSD 5.6.0 freshly installed with HAMMER2 and then again when returning to the original HAMMER file-system that remains available via its installer. No other changes were made to the setup during testing. 
And then for the more synthetic workloads it was just a mix. But overall HAMMER2 was performing well during the initial testing and great to see it continuing to offer noticeable leads in real-world workloads compared to the aging HAMMER file-system. HAMMER2 also offers better clustering, online deduplication, snapshots, compression, encryption, and many other modern file-system features.
Beastie Bits
Unix CLI relational database (https://spin.atomicobject.com/2019/06/16/unix-cli-relational-database/)
The TTY demystified (https://www.linusakesson.net/programming/tty/index.php)
Ranger, a console file manager with VI keybindings (https://ranger.github.io/)
Some Unix Humor (https://www.reddit.com/r/unix/comments/c6o5ze/some_unix_humor/)
OpenBSD -import vulkan-loader for Vulkan API support (https://marc.info/?l=openbsd-ports-cvs&amp;amp;m=156121732625604&amp;amp;w=2)
FreeBSD ZFS without drives (https://savagedlight.me/2019/06/09/freebsd-zfs-without-drives/)
Feedback/Questions
Moritz - ARM Builds (http://dpaste.com/175RRAZ)
Dave - Videos (http://dpaste.com/2DYK85B)
Chris - Raspberry Pi4 (http://dpaste.com/1B16QVN)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, Am5x86, freenas, jail, g4, mac, streaming, netflix, hammer</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Am5x86 based retro UNIX build log, setting up services in a FreeNAS Jail, first taste of DragonflyBSD, streaming Netflix on NetBSD, NetBSD on the last G4 Mac mini, Hammer vs Hammer2, and more.</p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://polprog.net/blog/486/" rel="nofollow">Polprog&#39;s Am5x86 based retro UNIX build log</a></h3>

<blockquote>
<p>I have recently acquired an Am5x86 computer, in a surprisingly good condition. This is an ongoing project, check this page often for updates!</p>

<p>I began by connecting a front panel. The panel came from a different chassis and is slightly too wide, so I had to attach it with a couple of zip-ties. However, that makes it stick out from the PC front at an angle, allowing easy access when the computer sits at the floor - and thats where it is most of the time. It&#39;s not that bad, to be honest, and its way easier to access than it would be, if mounted vertically</p>

<p>There is a mains switch on the front panel because the computer uses an older style power supply. Those power supplies instead of relying on a PSON signal, like modern ATX supplies, run a 4 wire cable to a mains switch. The cable carries live and neutral both ways, and the switch keys in or out the power. The system powers on as soon as the switch is enabled.</p>

<p>Originally there was no graphics card in it. Since a PC will not boot with out a GPU, I had to find one. The mainboard only has PCI and ISA slots, and all the GPUs I had were AGP. Fortunately, I bought a PCI GPU hoping it would solve my issue...</p>

<p>However the GPU turned out to be faulty. It took me some time to repair it. I had to repair a broken trace leading to one of the EEPROM pins, and replace a contact in the EEPROM&#39;s socket. Then I replaced all the electrolytic capacitors on it, and that fixed it for good.</p>

<p>Having used up only one of the three PCI slots, I populated the remaining pair with two ethernet cards. I still have a bunch of ISA slots available, but I have nothing to install there. Yet.</p>
</blockquote>

<ul>
<li>See the article for the rest of the writeup</li>
</ul>

<hr>

<h3><a href="https://www.ixsystems.com/blog/services-in-freenas-jail/" rel="nofollow">Setting up services in a FreeNAS Jail</a></h3>

<blockquote>
<p>This piece demonstrates the setup of a server service in a FreeNAS jail and how to share files with a jail using Apache 2.4 as an example. Jails are powerful, self-contained FreeBSD environments with separate network settings, package management, and access to thousands of FreeBSD application packages. Popular packages such as Apache, NGINX, LigHTTPD, MySQL, and PHP can be found and installed with the pkg search and pkg install commands. </p>

<p>This example shows creating a jail, installing an Apache web server, and setting up a simple web page. </p>

<p>NOTE: Do not directly attach FreeNAS to an external network (WAN). Use port forwarding, proper firewalls and DDoS protections when using FreeNAS for external web sites. This example demonstrates expanding the functionality of FreeNAS in an isolated LAN environment.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://nanxiao.me/en/first-taste-of-dragonfly-bsd/" rel="nofollow">First taste of DragonflyBSD</a></h3>

<blockquote>
<p>Last week, I needed to pick a BSD Operating System which supports NUMA to do some testing, so I decided to give Dragonfly BSD a shot. Dragonfly BSDonly can run on X86_64 architecture, which reminds me of Arch Linux, and after some tweaking, I feel Dragonfly BSD may be a “developer-friendly” Operating System, at least for me.</p>

<p>I mainly use Dragonfly BSD as a server, so I don’t care whether GUI is fancy or not. But I have high requirements of developer tools, i.e., compiler and debugger. The default compiler of Dragonfly BSD is gcc 8.3, and I can also install clang 8.0.0 from package. This means I can test state-of-the-art features of compilers, and it is really important for me. gdb‘s version is 7.6.1, a little lag behind, but still OK.</p>

<p>Furthermore, the upgradation of Dragonfly BSD is pretty simple and straightforward. I followed document to upgrade my Operating System to 5.6.0 this morning, just copied and pasted, no single error, booted successfully.</p>
</blockquote>

<hr>

<h3><a href="https://www.unitedbsd.com/d/68-streaming-netflix-on-netbsd" rel="nofollow">Streaming Netflix on NetBSD</a></h3>

<blockquote>
<p>Here&#39;s a step-by-step guide that allows streaming Netflix media on NetBSD using a intel-haxm accelerated QEMU vm.</p>

<p>Heads-up! Sound doesn&#39;t work, but everything else is fine. Please read the rest of this thread for a solution to this!!</p>
</blockquote>

<hr>

<h3><a href="https://mwl.io/archives/4320" rel="nofollow">“Sudo Mastery 2nd Edition” cover art reveal</a></h3>

<blockquote>
<p>I’m about halfway through the new edition of Sudo Mastery. Assuming nothing terrible happens, should have a complete first draft in four to six weeks. Enough stuff has changed in sudo that I need to carefully double-check every single feature. (I’m also horrified by the painfully obsolete versions of sudo shipped in the latest versions of CentOS and Debian, but people running those operating systems are already accustomed to their creaky obsolescence.)</p>

<p>But the reason for this blog post? I have Eddie Sharam’s glorious cover art. My Patronizers saw it last month, so now the rest of you get a turn.</p>
</blockquote>

<hr>

<h3><a href="https://tenfourfox.blogspot.com/2019/06/and-now-for-something-completely.html" rel="nofollow">NetBSD on the last G4 Mac mini</a></h3>

<blockquote>
<p>I&#39;m a big fan of NetBSD. I&#39;ve run it since 2000 on a Mac IIci (of course it&#39;s still running it) and I ran it for several years on a Power Mac 7300 with a G3 card which was the second incarnation of the Floodgap gopher server. Today I also still run it on a MIPS-based Cobalt RaQ 2 and an HP Jornada 690. I think NetBSD is a better match for smaller or underpowered systems than current-day Linux, and is fairly easy to harden and keep secure even though none of these systems are exposed to the outside world.</p>

<p>Recently I had a need to set up a bridge system that would be fast enough to connect two networks and I happened to have two of the &quot;secret&quot; last-of-the-line 1.5GHz G4 Mac minis sitting on the shelf doing nothing. Yes, they&#39;re probably outclassed by later Raspberry Pi models, but I don&#39;t have to buy anything and I like putting old hardware to good use.</p>
</blockquote>

<hr>

<h3><a href="https://phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-5.6-HAMMER2-Perf" rel="nofollow">Hammer vs Hammer2</a></h3>

<blockquote>
<p>With the newly released DragonFlyBSD 5.6 there are improvements to its original HAMMER2 file-system to the extent that it&#39;s now selected by its installer as the default file-system choice for new installations. Curious how the performance now compares between HAMMER and HAMMER2, here are some initial benchmarks on an NVMe solid-state drive using DragonFlyBSD 5.6.0. </p>

<p>With a 120GB Toshiba NVMe SSD on an Intel Core i7 8700K system, I ran some benchmarks of DragonFlyBSD 5.6.0 freshly installed with HAMMER2 and then again when returning to the original HAMMER file-system that remains available via its installer. No other changes were made to the setup during testing. </p>

<p>And then for the more synthetic workloads it was just a mix. But overall HAMMER2 was performing well during the initial testing and great to see it continuing to offer noticeable leads in real-world workloads compared to the aging HAMMER file-system. HAMMER2 also offers better clustering, online deduplication, snapshots, compression, encryption, and many other modern file-system features.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://spin.atomicobject.com/2019/06/16/unix-cli-relational-database/" rel="nofollow">Unix CLI relational database</a></li>
<li><a href="https://www.linusakesson.net/programming/tty/index.php" rel="nofollow">The TTY demystified</a></li>
<li><a href="https://ranger.github.io/" rel="nofollow">Ranger, a console file manager with VI keybindings</a></li>
<li><a href="https://www.reddit.com/r/unix/comments/c6o5ze/some_unix_humor/" rel="nofollow">Some Unix Humor</a></li>
<li><a href="https://marc.info/?l=openbsd-ports-cvs&m=156121732625604&w=2" rel="nofollow">OpenBSD -import vulkan-loader for Vulkan API support</a></li>
<li><a href="https://savagedlight.me/2019/06/09/freebsd-zfs-without-drives/" rel="nofollow">FreeBSD ZFS without drives</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Moritz - <a href="http://dpaste.com/175RRAZ" rel="nofollow">ARM Builds</a></li>
<li>Dave - <a href="http://dpaste.com/2DYK85B" rel="nofollow">Videos</a></li>
<li>Chris - <a href="http://dpaste.com/1B16QVN" rel="nofollow">Raspberry Pi4</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0306.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Am5x86 based retro UNIX build log, setting up services in a FreeNAS Jail, first taste of DragonflyBSD, streaming Netflix on NetBSD, NetBSD on the last G4 Mac mini, Hammer vs Hammer2, and more.</p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://polprog.net/blog/486/" rel="nofollow">Polprog&#39;s Am5x86 based retro UNIX build log</a></h3>

<blockquote>
<p>I have recently acquired an Am5x86 computer, in a surprisingly good condition. This is an ongoing project, check this page often for updates!</p>

<p>I began by connecting a front panel. The panel came from a different chassis and is slightly too wide, so I had to attach it with a couple of zip-ties. However, that makes it stick out from the PC front at an angle, allowing easy access when the computer sits at the floor - and thats where it is most of the time. It&#39;s not that bad, to be honest, and its way easier to access than it would be, if mounted vertically</p>

<p>There is a mains switch on the front panel because the computer uses an older style power supply. Those power supplies instead of relying on a PSON signal, like modern ATX supplies, run a 4 wire cable to a mains switch. The cable carries live and neutral both ways, and the switch keys in or out the power. The system powers on as soon as the switch is enabled.</p>

<p>Originally there was no graphics card in it. Since a PC will not boot with out a GPU, I had to find one. The mainboard only has PCI and ISA slots, and all the GPUs I had were AGP. Fortunately, I bought a PCI GPU hoping it would solve my issue...</p>

<p>However the GPU turned out to be faulty. It took me some time to repair it. I had to repair a broken trace leading to one of the EEPROM pins, and replace a contact in the EEPROM&#39;s socket. Then I replaced all the electrolytic capacitors on it, and that fixed it for good.</p>

<p>Having used up only one of the three PCI slots, I populated the remaining pair with two ethernet cards. I still have a bunch of ISA slots available, but I have nothing to install there. Yet.</p>
</blockquote>

<ul>
<li>See the article for the rest of the writeup</li>
</ul>

<hr>

<h3><a href="https://www.ixsystems.com/blog/services-in-freenas-jail/" rel="nofollow">Setting up services in a FreeNAS Jail</a></h3>

<blockquote>
<p>This piece demonstrates the setup of a server service in a FreeNAS jail and how to share files with a jail using Apache 2.4 as an example. Jails are powerful, self-contained FreeBSD environments with separate network settings, package management, and access to thousands of FreeBSD application packages. Popular packages such as Apache, NGINX, LigHTTPD, MySQL, and PHP can be found and installed with the pkg search and pkg install commands. </p>

<p>This example shows creating a jail, installing an Apache web server, and setting up a simple web page. </p>

<p>NOTE: Do not directly attach FreeNAS to an external network (WAN). Use port forwarding, proper firewalls and DDoS protections when using FreeNAS for external web sites. This example demonstrates expanding the functionality of FreeNAS in an isolated LAN environment.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://nanxiao.me/en/first-taste-of-dragonfly-bsd/" rel="nofollow">First taste of DragonflyBSD</a></h3>

<blockquote>
<p>Last week, I needed to pick a BSD Operating System which supports NUMA to do some testing, so I decided to give Dragonfly BSD a shot. Dragonfly BSDonly can run on X86_64 architecture, which reminds me of Arch Linux, and after some tweaking, I feel Dragonfly BSD may be a “developer-friendly” Operating System, at least for me.</p>

<p>I mainly use Dragonfly BSD as a server, so I don’t care whether GUI is fancy or not. But I have high requirements of developer tools, i.e., compiler and debugger. The default compiler of Dragonfly BSD is gcc 8.3, and I can also install clang 8.0.0 from package. This means I can test state-of-the-art features of compilers, and it is really important for me. gdb‘s version is 7.6.1, a little lag behind, but still OK.</p>

<p>Furthermore, the upgradation of Dragonfly BSD is pretty simple and straightforward. I followed document to upgrade my Operating System to 5.6.0 this morning, just copied and pasted, no single error, booted successfully.</p>
</blockquote>

<hr>

<h3><a href="https://www.unitedbsd.com/d/68-streaming-netflix-on-netbsd" rel="nofollow">Streaming Netflix on NetBSD</a></h3>

<blockquote>
<p>Here&#39;s a step-by-step guide that allows streaming Netflix media on NetBSD using a intel-haxm accelerated QEMU vm.</p>

<p>Heads-up! Sound doesn&#39;t work, but everything else is fine. Please read the rest of this thread for a solution to this!!</p>
</blockquote>

<hr>

<h3><a href="https://mwl.io/archives/4320" rel="nofollow">“Sudo Mastery 2nd Edition” cover art reveal</a></h3>

<blockquote>
<p>I’m about halfway through the new edition of Sudo Mastery. Assuming nothing terrible happens, should have a complete first draft in four to six weeks. Enough stuff has changed in sudo that I need to carefully double-check every single feature. (I’m also horrified by the painfully obsolete versions of sudo shipped in the latest versions of CentOS and Debian, but people running those operating systems are already accustomed to their creaky obsolescence.)</p>

<p>But the reason for this blog post? I have Eddie Sharam’s glorious cover art. My Patronizers saw it last month, so now the rest of you get a turn.</p>
</blockquote>

<hr>

<h3><a href="https://tenfourfox.blogspot.com/2019/06/and-now-for-something-completely.html" rel="nofollow">NetBSD on the last G4 Mac mini</a></h3>

<blockquote>
<p>I&#39;m a big fan of NetBSD. I&#39;ve run it since 2000 on a Mac IIci (of course it&#39;s still running it) and I ran it for several years on a Power Mac 7300 with a G3 card which was the second incarnation of the Floodgap gopher server. Today I also still run it on a MIPS-based Cobalt RaQ 2 and an HP Jornada 690. I think NetBSD is a better match for smaller or underpowered systems than current-day Linux, and is fairly easy to harden and keep secure even though none of these systems are exposed to the outside world.</p>

<p>Recently I had a need to set up a bridge system that would be fast enough to connect two networks and I happened to have two of the &quot;secret&quot; last-of-the-line 1.5GHz G4 Mac minis sitting on the shelf doing nothing. Yes, they&#39;re probably outclassed by later Raspberry Pi models, but I don&#39;t have to buy anything and I like putting old hardware to good use.</p>
</blockquote>

<hr>

<h3><a href="https://phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-5.6-HAMMER2-Perf" rel="nofollow">Hammer vs Hammer2</a></h3>

<blockquote>
<p>With the newly released DragonFlyBSD 5.6 there are improvements to its original HAMMER2 file-system to the extent that it&#39;s now selected by its installer as the default file-system choice for new installations. Curious how the performance now compares between HAMMER and HAMMER2, here are some initial benchmarks on an NVMe solid-state drive using DragonFlyBSD 5.6.0. </p>

<p>With a 120GB Toshiba NVMe SSD on an Intel Core i7 8700K system, I ran some benchmarks of DragonFlyBSD 5.6.0 freshly installed with HAMMER2 and then again when returning to the original HAMMER file-system that remains available via its installer. No other changes were made to the setup during testing. </p>

<p>And then for the more synthetic workloads it was just a mix. But overall HAMMER2 was performing well during the initial testing and great to see it continuing to offer noticeable leads in real-world workloads compared to the aging HAMMER file-system. HAMMER2 also offers better clustering, online deduplication, snapshots, compression, encryption, and many other modern file-system features.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://spin.atomicobject.com/2019/06/16/unix-cli-relational-database/" rel="nofollow">Unix CLI relational database</a></li>
<li><a href="https://www.linusakesson.net/programming/tty/index.php" rel="nofollow">The TTY demystified</a></li>
<li><a href="https://ranger.github.io/" rel="nofollow">Ranger, a console file manager with VI keybindings</a></li>
<li><a href="https://www.reddit.com/r/unix/comments/c6o5ze/some_unix_humor/" rel="nofollow">Some Unix Humor</a></li>
<li><a href="https://marc.info/?l=openbsd-ports-cvs&m=156121732625604&w=2" rel="nofollow">OpenBSD -import vulkan-loader for Vulkan API support</a></li>
<li><a href="https://savagedlight.me/2019/06/09/freebsd-zfs-without-drives/" rel="nofollow">FreeBSD ZFS without drives</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Moritz - <a href="http://dpaste.com/175RRAZ" rel="nofollow">ARM Builds</a></li>
<li>Dave - <a href="http://dpaste.com/2DYK85B" rel="nofollow">Videos</a></li>
<li>Chris - <a href="http://dpaste.com/1B16QVN" rel="nofollow">Raspberry Pi4</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0306.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>305: Changing face of Unix</title>
  <link>https://www.bsdnow.tv/305</link>
  <guid isPermaLink="false">3ad52b9d-03b4-4c00-a16f-cc4be091e6ff</guid>
  <pubDate>Wed, 03 Jul 2019 22:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3ad52b9d-03b4-4c00-a16f-cc4be091e6ff.mp3" length="40433394" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Website protection with OPNsense, FreeBSD Support Pull Request for ZFS-on-Linux, How much has Unix changed, Porting Wine to amd64 on NetBSD, FreeBSD Enterprise 1 PB Storage, the death watch for X11 has started, and more.</itunes:subtitle>
  <itunes:duration>56:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Website protection with OPNsense, FreeBSD Support Pull Request for ZFS-on-Linux, How much has Unix changed, Porting Wine to amd64 on NetBSD, FreeBSD Enterprise 1 PB Storage, the death watch for X11 has started, and more.
Headlines
Website protection with OPNsense (https://medium.com/@jccwbb/website-protection-with-opnsense-3586a529d487)
with nginx plugin OPNsense become a strong full featured Web Application Firewall (WAF)
The OPNsense security platform can help you to protect your network and your webservers with the nginx plugin addition.
In old days, install an open source firewall was a very trick task, but today it can be done with few clicks (or key strokes). In this article I'll not describe the detailed OPNsense installation process, but you can watch this video that was extracted from my OPNsense course available in Udemy. The video is in portuguese language, but with the translation CC Youtube feature you may be able to follow it without problems (if you don't are a portuguese speaker ofcourse) :-)
+ See the article for the rest of the writeup
FreeBSD Support Pull Request against the ZFS-on-Linux repo (https://github.com/zfsonlinux/zfs/pull/8987)
This pull request integrates the sysutils/openzfs port’s sources into the upstream ZoL repo
&amp;gt; Adding FreeBSD support to ZoL will make it easier to move changes back and forth between FreeBSD and Linux
&amp;gt; Refactor tree to separate out Linux and FreeBSD specific code
&amp;gt; import FreeBSD's SPL
&amp;gt; add ifdefs in common code where it made more sense to do so than duplicate the code in separate files
&amp;gt; Adapted ZFS Test Suite to run on FreeBSD and all tests that pass on ZoL passing on ZoF
The plan to officially rename the common repo from ZFSonLinux to OpenZFS was announced at the ZFS Leadership Meeting on June 25th
Video of Leadership Meeting (https://www.youtube.com/watch?v=TJwykiJmH0M)
Meeting Agenda and Notes (https://docs.google.com/document/d/1w2jv2XVYFmBVvG1EGf-9A5HBVsjAYoLIFZAnWHhV-BM/edit)
This will allow improvements made on one OS to be made available more easily (and more quickly) to the other platforms
For example, mav@’s recent work:
Add wakeupany(), cheaper version of wakeupone() for taskqueue(9) (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=349220)
&amp;gt; As result, on 72-core Xeon v4 machine sequential ZFS write to 12 ZVOLs with 16KB block size spend 34% less time in wakeupany() and descendants then it was spending in wakeupone(), and total write throughput increased by ~10% with the same as before CPU usage.
News Roundup
Episode 5 Notes - How much has UNIX changed? (http://adventofcomputing.libsyn.com/episode-5-notes-how-much-has-unix-changed)
UNIX-like systems have dominated computing for decades, and with the rise of the internet and mobile devices their reach has become even larger. True, most systems now use more modern OSs like Linux, but how much has the UNIX-like landscape changed since the early days?
So, my question was this: how close is a modern *NIX userland to some of the earliest UNIX releases? To do this I'm going to compare a few key points of a modern Linux system with the earliest UNIX documentation I can get my hands on. The doc I am going to be covering(https://www.tuhs.org/Archive/Distributions/Research/Dennisv1/UNIXProgrammersManual_Nov71.pdf) is from November 1971, predating v1 of the system.
I think the best place to start this comparison is to look at one of the highest-profile parts of the OS, that being the file system. Under the hood modern EXT file systems are completely different from the early UNIX file systems. However, they are still presented in basically the same way, as a heirerarchicat structure of directories with device files. So paths still look identical, and navigating the file system still functions the same. Often used commands like ls, cp, mv, du, and df function the same. So are mount and umount. But, there are some key differences. For instance, cd didn't exist, yet instead chdir filled its place. Also, chmod is somewhat different. Instead of the usual 3-digit octal codes for permissions, this older version only uses 2 digits. Really, that difference is due to the underlying file system using a different permission set than modern systems. For the most part, all the file handling is actually pretty close to a Linux system from 2019.
See the article for the rest of the writeup
Porting Wine to amd64 on NetBSD (https://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on)
I have been working on porting Wine to amd64 on NetBSD as a GSoC 2019 project. Wine is a compatibility layer which allows running Microsoft Windows applications on POSIX-complaint operating systems. This report provides an overview of the progress of the project during the first coding period.
Initially, when I started working on getting Wine-4.4 to build and run on NetBSD i386 the primary issue that I faced was Wine displaying black windows instead of UI, and this applied to any graphical program I tried running with Wine.
I suspected it , as it is related to graphics, to be an issue with the graphics driver or Xorg. Subsequently, I tried building modular Xorg, and I tried running Wine on it only to realize that Xorg being modular didn't affect it in the least. After having tried a couple of configurations, I realized that trying to hazard out every other probability is going to take an awful lot of time that I didn't have. This motivated me to bisect the repo using git, and find the first version of Wine which failed on NetBSD.
+ See the article for the rest of the writeup
FreeBSD Enterprise 1 PB Storage (https://vermaden.wordpress.com/2019/06/19/freebsd-enterprise-1-pb-storage/?utm_source=discoverbsd)
Today FreeBSD operating system turns 26 years old. 19 June is an International FreeBSD Day. This is why I got something special today :). How about using FreeBSD as an Enterprise Storage solution on real hardware? This where FreeBSD shines with all its storage features ZFS included.
Today I will show you how I have built so called Enterprise Storage based on FreeBSD system along with more then 1 PB (Petabyte) of raw capacity.
This project is different. How much storage space can you squeeze from a single 4U system? It turns out a lot! Definitely more then 1 PB (1024 TB) of raw storage space.
See the article for the rest of the writeup
The death watch for the X Window System (aka X11) has probably started (https://utcc.utoronto.ca/~cks/space/blog/unix/XDeathwatchStarts)
Once we are done with this we expect X.org to go into hard maintenance mode fairly quickly. The reality is that X.org is basically maintained by us and thus once we stop paying attention to it there is unlikely to be any major new releases coming out and there might even be some bitrot setting in over time. We will keep an eye on it as we will want to ensure X.org stays supportable until the end of the RHEL8 lifecycle at a minimum, but let this be a friendly notice for everyone who rely the work we do maintaining the Linux graphics stack, get onto Wayland, that is where the future is.
I have no idea how true this is about X.org X server maintenance, either now or in the future, but I definitely think it's a sign that developers have started saying this. If Gnome developers feel that X.org is going to be in hard maintenance mode almost immediately, they're probably pretty likely to also put the Gnome code that deals with X into hard maintenance mode. And public Gnome statements about this (and public action or lack of it) provide implicit support for KDE and any other desktop to move in this direction if they want to (and probably create some pressure to do so). I've known that Wayland was the future for some time, but I would still like it to not arrive any time soon.
Beastie Bits
Porting NetBSD to Risc-V -- Video (https://www.youtube.com/watch?v=2vQXGomKoxA)
FreeBSD 11.3RC3 Available (https://www.freebsd.org/news/newsflash.html#event20190628:01)
Open Source Could Be a Casualty of the Trade War (https://www.bunniestudios.com/blog/?p=5590)
Celebrate UNIX50 and SDF32 (https://sdf.org/sdf32/)
doas environmental security (https://undeadly.org/cgi?action=article;sid=20190621104048)
Feedback/Questions
Matt - BSD or Older Hardware (http://dpaste.com/1RP09F0#wrap)
MJRodriguez - Some Playstation news (http://dpaste.com/046SPPB#wrap)
Moritz - bhyve VT-x passthrough (http://dpaste.com/1H4PJXW)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, opnsense, wine, storage, x11, x windows, risc-v, unix50, sdf32, doas</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Website protection with OPNsense, FreeBSD Support Pull Request for ZFS-on-Linux, How much has Unix changed, Porting Wine to amd64 on NetBSD, FreeBSD Enterprise 1 PB Storage, the death watch for X11 has started, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://medium.com/@jccwbb/website-protection-with-opnsense-3586a529d487" rel="nofollow">Website protection with OPNsense</a></h3>

<ul>
<li>with nginx plugin OPNsense become a strong full featured Web Application Firewall (WAF)</li>
</ul>

<blockquote>
<p>The OPNsense security platform can help you to protect your network and your webservers with the nginx plugin addition.<br>
In old days, install an open source firewall was a very trick task, but today it can be done with few clicks (or key strokes). In this article I&#39;ll not describe the detailed OPNsense installation process, but you can watch this video that was extracted from my OPNsense course available in Udemy. The video is in portuguese language, but with the translation CC Youtube feature you may be able to follow it without problems (if you don&#39;t are a portuguese speaker ofcourse) :-)</p>

<ul>
<li>See the article for the rest of the writeup</li>
</ul>
</blockquote>

<hr>

<h3><a href="https://github.com/zfsonlinux/zfs/pull/8987" rel="nofollow">FreeBSD Support Pull Request against the ZFS-on-Linux repo</a></h3>

<ul>
<li>This pull request integrates the sysutils/openzfs port’s sources into the upstream ZoL repo
&gt; Adding FreeBSD support to ZoL will make it easier to move changes back and forth between FreeBSD and Linux
&gt; Refactor tree to separate out Linux and FreeBSD specific code
&gt; import FreeBSD&#39;s SPL
&gt; add ifdefs in common code where it made more sense to do so than duplicate the code in separate files
&gt; Adapted ZFS Test Suite to run on FreeBSD and all tests that pass on ZoL passing on ZoF</li>
<li>The plan to officially rename the common repo from ZFSonLinux to OpenZFS was announced at the ZFS Leadership Meeting on June 25th</li>
<li><a href="https://www.youtube.com/watch?v=TJwykiJmH0M" rel="nofollow">Video of Leadership Meeting</a></li>
<li><a href="https://docs.google.com/document/d/1w2jv2XVYFmBVvG1EGf-9A5HBVsjAYoLIFZAnWHhV-BM/edit" rel="nofollow">Meeting Agenda and Notes</a></li>
<li>This will allow improvements made on one OS to be made available more easily (and more quickly) to the other platforms</li>
<li>For example, mav@’s recent work:</li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=349220" rel="nofollow">Add wakeup_any(), cheaper version of wakeup_one() for taskqueue(9)</a>
&gt; As result, on 72-core Xeon v4 machine sequential ZFS write to 12 ZVOLs with 16KB block size spend 34% less time in wakeup_any() and descendants then it was spending in wakeup_one(), and total write throughput increased by ~10% with the same as before CPU usage.</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://adventofcomputing.libsyn.com/episode-5-notes-how-much-has-unix-changed" rel="nofollow">Episode 5 Notes - How much has UNIX changed?</a></h3>

<blockquote>
<p>UNIX-like systems have dominated computing for decades, and with the rise of the internet and mobile devices their reach has become even larger. True, most systems now use more modern OSs like Linux, but how much has the UNIX-like landscape changed since the early days?<br>
So, my question was this: how close is a modern *NIX userland to some of the earliest UNIX releases? To do this I&#39;m going to compare a few key points of a modern Linux system with the earliest UNIX documentation I can get my hands on. The doc I am going to be covering(<a href="https://www.tuhs.org/Archive/Distributions/Research/Dennis_v1/UNIX_ProgrammersManual_Nov71.pdf" rel="nofollow">https://www.tuhs.org/Archive/Distributions/Research/Dennis_v1/UNIX_ProgrammersManual_Nov71.pdf</a>) is from November 1971, predating v1 of the system.<br>
I think the best place to start this comparison is to look at one of the highest-profile parts of the OS, that being the file system. Under the hood modern EXT file systems are completely different from the early UNIX file systems. However, they are still presented in basically the same way, as a heirerarchicat structure of directories with device files. So paths still look identical, and navigating the file system still functions the same. Often used commands like <code>ls</code>, <code>cp</code>, <code>mv</code>, <code>du</code>, and <code>df</code> function the same. So are <code>mount</code> and <code>umount</code>. But, there are some key differences. For instance, <code>cd</code> didn&#39;t exist, yet instead <code>chdir</code> filled its place. Also, <code>chmod</code> is somewhat different. Instead of the usual 3-digit octal codes for permissions, this older version only uses 2 digits. Really, that difference is due to the underlying file system using a different permission set than modern systems. For the most part, all the file handling is actually pretty close to a Linux system from 2019.</p>
</blockquote>

<ul>
<li>See the article for the rest of the writeup</li>
</ul>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on" rel="nofollow">Porting Wine to amd64 on NetBSD</a></h3>

<blockquote>
<p>I have been working on porting Wine to amd64 on NetBSD as a GSoC 2019 project. Wine is a compatibility layer which allows running Microsoft Windows applications on POSIX-complaint operating systems. This report provides an overview of the progress of the project during the first coding period.<br>
Initially, when I started working on getting Wine-4.4 to build and run on NetBSD i386 the primary issue that I faced was Wine displaying black windows instead of UI, and this applied to any graphical program I tried running with Wine.<br>
I suspected it , as it is related to graphics, to be an issue with the graphics driver or Xorg. Subsequently, I tried building modular Xorg, and I tried running Wine on it only to realize that Xorg being modular didn&#39;t affect it in the least. After having tried a couple of configurations, I realized that trying to hazard out every other probability is going to take an awful lot of time that I didn&#39;t have. This motivated me to bisect the repo using git, and find the first version of Wine which failed on NetBSD.</p>

<ul>
<li>See the article for the rest of the writeup</li>
</ul>
</blockquote>

<hr>

<h3><a href="https://vermaden.wordpress.com/2019/06/19/freebsd-enterprise-1-pb-storage/?utm_source=discoverbsd" rel="nofollow">FreeBSD Enterprise 1 PB Storage</a></h3>

<blockquote>
<p>Today FreeBSD operating system turns 26 years old. 19 June is an International FreeBSD Day. This is why I got something special today :). How about using FreeBSD as an Enterprise Storage solution on real hardware? This where FreeBSD shines with all its storage features ZFS included.<br>
Today I will show you how I have built so called Enterprise Storage based on FreeBSD system along with more then 1 PB (Petabyte) of raw capacity.<br>
This project is different. How much storage space can you squeeze from a single 4U system? It turns out a lot! Definitely more then 1 PB (1024 TB) of raw storage space.</p>
</blockquote>

<ul>
<li>See the article for the rest of the writeup</li>
</ul>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/XDeathwatchStarts" rel="nofollow">The death watch for the X Window System (aka X11) has probably started</a></h3>

<blockquote>
<p>Once we are done with this we expect X.org to go into hard maintenance mode fairly quickly. The reality is that X.org is basically maintained by us and thus once we stop paying attention to it there is unlikely to be any major new releases coming out and there might even be some bitrot setting in over time. We will keep an eye on it as we will want to ensure X.org stays supportable until the end of the RHEL8 lifecycle at a minimum, but let this be a friendly notice for everyone who rely the work we do maintaining the Linux graphics stack, get onto Wayland, that is where the future is.<br>
I have no idea how true this is about X.org X server maintenance, either now or in the future, but I definitely think it&#39;s a sign that developers have started saying this. If Gnome developers feel that X.org is going to be in hard maintenance mode almost immediately, they&#39;re probably pretty likely to also put the Gnome code that deals with X into hard maintenance mode. And public Gnome statements about this (and public action or lack of it) provide implicit support for KDE and any other desktop to move in this direction if they want to (and probably create some pressure to do so). I&#39;ve known that Wayland was the future for some time, but I would still like it to not arrive any time soon.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=2vQXGomKoxA" rel="nofollow">Porting NetBSD to Risc-V -- Video</a></li>
<li><a href="https://www.freebsd.org/news/newsflash.html#event20190628:01" rel="nofollow">FreeBSD 11.3RC3 Available</a></li>
<li><a href="https://www.bunniestudios.com/blog/?p=5590" rel="nofollow">Open Source Could Be a Casualty of the Trade War</a></li>
<li><a href="https://sdf.org/sdf32/" rel="nofollow">Celebrate UNIX50 and SDF32</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20190621104048" rel="nofollow">doas environmental security</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Matt - <a href="http://dpaste.com/1RP09F0#wrap" rel="nofollow">BSD or Older Hardware</a></li>
<li>MJRodriguez - <a href="http://dpaste.com/046SPPB#wrap" rel="nofollow">Some Playstation news</a></li>
<li>Moritz - <a href="http://dpaste.com/1H4PJXW" rel="nofollow">bhyve VT-x passthrough</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0305.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Website protection with OPNsense, FreeBSD Support Pull Request for ZFS-on-Linux, How much has Unix changed, Porting Wine to amd64 on NetBSD, FreeBSD Enterprise 1 PB Storage, the death watch for X11 has started, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://medium.com/@jccwbb/website-protection-with-opnsense-3586a529d487" rel="nofollow">Website protection with OPNsense</a></h3>

<ul>
<li>with nginx plugin OPNsense become a strong full featured Web Application Firewall (WAF)</li>
</ul>

<blockquote>
<p>The OPNsense security platform can help you to protect your network and your webservers with the nginx plugin addition.<br>
In old days, install an open source firewall was a very trick task, but today it can be done with few clicks (or key strokes). In this article I&#39;ll not describe the detailed OPNsense installation process, but you can watch this video that was extracted from my OPNsense course available in Udemy. The video is in portuguese language, but with the translation CC Youtube feature you may be able to follow it without problems (if you don&#39;t are a portuguese speaker ofcourse) :-)</p>

<ul>
<li>See the article for the rest of the writeup</li>
</ul>
</blockquote>

<hr>

<h3><a href="https://github.com/zfsonlinux/zfs/pull/8987" rel="nofollow">FreeBSD Support Pull Request against the ZFS-on-Linux repo</a></h3>

<ul>
<li>This pull request integrates the sysutils/openzfs port’s sources into the upstream ZoL repo
&gt; Adding FreeBSD support to ZoL will make it easier to move changes back and forth between FreeBSD and Linux
&gt; Refactor tree to separate out Linux and FreeBSD specific code
&gt; import FreeBSD&#39;s SPL
&gt; add ifdefs in common code where it made more sense to do so than duplicate the code in separate files
&gt; Adapted ZFS Test Suite to run on FreeBSD and all tests that pass on ZoL passing on ZoF</li>
<li>The plan to officially rename the common repo from ZFSonLinux to OpenZFS was announced at the ZFS Leadership Meeting on June 25th</li>
<li><a href="https://www.youtube.com/watch?v=TJwykiJmH0M" rel="nofollow">Video of Leadership Meeting</a></li>
<li><a href="https://docs.google.com/document/d/1w2jv2XVYFmBVvG1EGf-9A5HBVsjAYoLIFZAnWHhV-BM/edit" rel="nofollow">Meeting Agenda and Notes</a></li>
<li>This will allow improvements made on one OS to be made available more easily (and more quickly) to the other platforms</li>
<li>For example, mav@’s recent work:</li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=349220" rel="nofollow">Add wakeup_any(), cheaper version of wakeup_one() for taskqueue(9)</a>
&gt; As result, on 72-core Xeon v4 machine sequential ZFS write to 12 ZVOLs with 16KB block size spend 34% less time in wakeup_any() and descendants then it was spending in wakeup_one(), and total write throughput increased by ~10% with the same as before CPU usage.</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://adventofcomputing.libsyn.com/episode-5-notes-how-much-has-unix-changed" rel="nofollow">Episode 5 Notes - How much has UNIX changed?</a></h3>

<blockquote>
<p>UNIX-like systems have dominated computing for decades, and with the rise of the internet and mobile devices their reach has become even larger. True, most systems now use more modern OSs like Linux, but how much has the UNIX-like landscape changed since the early days?<br>
So, my question was this: how close is a modern *NIX userland to some of the earliest UNIX releases? To do this I&#39;m going to compare a few key points of a modern Linux system with the earliest UNIX documentation I can get my hands on. The doc I am going to be covering(<a href="https://www.tuhs.org/Archive/Distributions/Research/Dennis_v1/UNIX_ProgrammersManual_Nov71.pdf" rel="nofollow">https://www.tuhs.org/Archive/Distributions/Research/Dennis_v1/UNIX_ProgrammersManual_Nov71.pdf</a>) is from November 1971, predating v1 of the system.<br>
I think the best place to start this comparison is to look at one of the highest-profile parts of the OS, that being the file system. Under the hood modern EXT file systems are completely different from the early UNIX file systems. However, they are still presented in basically the same way, as a heirerarchicat structure of directories with device files. So paths still look identical, and navigating the file system still functions the same. Often used commands like <code>ls</code>, <code>cp</code>, <code>mv</code>, <code>du</code>, and <code>df</code> function the same. So are <code>mount</code> and <code>umount</code>. But, there are some key differences. For instance, <code>cd</code> didn&#39;t exist, yet instead <code>chdir</code> filled its place. Also, <code>chmod</code> is somewhat different. Instead of the usual 3-digit octal codes for permissions, this older version only uses 2 digits. Really, that difference is due to the underlying file system using a different permission set than modern systems. For the most part, all the file handling is actually pretty close to a Linux system from 2019.</p>
</blockquote>

<ul>
<li>See the article for the rest of the writeup</li>
</ul>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on" rel="nofollow">Porting Wine to amd64 on NetBSD</a></h3>

<blockquote>
<p>I have been working on porting Wine to amd64 on NetBSD as a GSoC 2019 project. Wine is a compatibility layer which allows running Microsoft Windows applications on POSIX-complaint operating systems. This report provides an overview of the progress of the project during the first coding period.<br>
Initially, when I started working on getting Wine-4.4 to build and run on NetBSD i386 the primary issue that I faced was Wine displaying black windows instead of UI, and this applied to any graphical program I tried running with Wine.<br>
I suspected it , as it is related to graphics, to be an issue with the graphics driver or Xorg. Subsequently, I tried building modular Xorg, and I tried running Wine on it only to realize that Xorg being modular didn&#39;t affect it in the least. After having tried a couple of configurations, I realized that trying to hazard out every other probability is going to take an awful lot of time that I didn&#39;t have. This motivated me to bisect the repo using git, and find the first version of Wine which failed on NetBSD.</p>

<ul>
<li>See the article for the rest of the writeup</li>
</ul>
</blockquote>

<hr>

<h3><a href="https://vermaden.wordpress.com/2019/06/19/freebsd-enterprise-1-pb-storage/?utm_source=discoverbsd" rel="nofollow">FreeBSD Enterprise 1 PB Storage</a></h3>

<blockquote>
<p>Today FreeBSD operating system turns 26 years old. 19 June is an International FreeBSD Day. This is why I got something special today :). How about using FreeBSD as an Enterprise Storage solution on real hardware? This where FreeBSD shines with all its storage features ZFS included.<br>
Today I will show you how I have built so called Enterprise Storage based on FreeBSD system along with more then 1 PB (Petabyte) of raw capacity.<br>
This project is different. How much storage space can you squeeze from a single 4U system? It turns out a lot! Definitely more then 1 PB (1024 TB) of raw storage space.</p>
</blockquote>

<ul>
<li>See the article for the rest of the writeup</li>
</ul>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/XDeathwatchStarts" rel="nofollow">The death watch for the X Window System (aka X11) has probably started</a></h3>

<blockquote>
<p>Once we are done with this we expect X.org to go into hard maintenance mode fairly quickly. The reality is that X.org is basically maintained by us and thus once we stop paying attention to it there is unlikely to be any major new releases coming out and there might even be some bitrot setting in over time. We will keep an eye on it as we will want to ensure X.org stays supportable until the end of the RHEL8 lifecycle at a minimum, but let this be a friendly notice for everyone who rely the work we do maintaining the Linux graphics stack, get onto Wayland, that is where the future is.<br>
I have no idea how true this is about X.org X server maintenance, either now or in the future, but I definitely think it&#39;s a sign that developers have started saying this. If Gnome developers feel that X.org is going to be in hard maintenance mode almost immediately, they&#39;re probably pretty likely to also put the Gnome code that deals with X into hard maintenance mode. And public Gnome statements about this (and public action or lack of it) provide implicit support for KDE and any other desktop to move in this direction if they want to (and probably create some pressure to do so). I&#39;ve known that Wayland was the future for some time, but I would still like it to not arrive any time soon.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=2vQXGomKoxA" rel="nofollow">Porting NetBSD to Risc-V -- Video</a></li>
<li><a href="https://www.freebsd.org/news/newsflash.html#event20190628:01" rel="nofollow">FreeBSD 11.3RC3 Available</a></li>
<li><a href="https://www.bunniestudios.com/blog/?p=5590" rel="nofollow">Open Source Could Be a Casualty of the Trade War</a></li>
<li><a href="https://sdf.org/sdf32/" rel="nofollow">Celebrate UNIX50 and SDF32</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20190621104048" rel="nofollow">doas environmental security</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Matt - <a href="http://dpaste.com/1RP09F0#wrap" rel="nofollow">BSD or Older Hardware</a></li>
<li>MJRodriguez - <a href="http://dpaste.com/046SPPB#wrap" rel="nofollow">Some Playstation news</a></li>
<li>Moritz - <a href="http://dpaste.com/1H4PJXW" rel="nofollow">bhyve VT-x passthrough</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0305.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>304: Prospering with Vulkan</title>
  <link>https://www.bsdnow.tv/304</link>
  <guid isPermaLink="false">6da25674-3858-4ebc-b4a5-257e1eefcbf4</guid>
  <pubDate>Thu, 27 Jun 2019 03:45:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6da25674-3858-4ebc-b4a5-257e1eefcbf4.mp3" length="45762060" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>DragonflyBSD 5.6 is out, OpenBSD Vulkan Support, bad utmp implementations in glibc and FreeBSD, OpenSSH protects itself against Side Channel attacks, ZFS vs OpenZFS, and more.</itunes:subtitle>
  <itunes:duration>1:03:33</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>DragonflyBSD 5.6 is out, OpenBSD Vulkan Support, bad utmp implementations in glibc and FreeBSD, OpenSSH protects itself against Side Channel attacks, ZFS vs OpenZFS, and more.
Headlines
DragonflyBSD 5.6 is out (https://www.dragonflybsd.org/release56)
Version 5.6.0 released 17 June 2019
Version 5.6.1 released 19 June 2019 (https://www.dragonflydigest.com/2019/06/19/23091.html)
Big-ticket items
Improved VM
Informal test results showing the changes from 5.4 to 5.6 are available.
Reduce stalls in the kernel vmpagealloc() code (vmpagelist_find()).
Improve page allocation algorithm to avoid re-iterating the same queues as the search is widened.
Add a vmpagehash*() API that allows the kernel to do heuristical lockless lookups of VM pages.
Change vmhold() and vmunhold() semantics to not require any spin-locks.
Change vmpagewakeup() to not require any spin-locks.
Change wiring vm_page's no longer manipulates the queue the page is on, saving a lot of overhead. Instead, the page will be removed from its queue only if the pageout demon encounters it. This allows pages to enter and leave the buffer cache quickly.
Refactor the handling of fictitious pages.
Remove m-&amp;gt;md.pvlist entirely. VM pages in mappings no longer allocate pventry's, saving an enormous amount of memory when multiple processes utilize large shared memory maps (e.g. postgres database cache).
Refactor vmobject shadowing, disconnecting the backing linkages from the vmobject itself and instead organizing the linkages in a new structure called vmmapbacking which hangs off the vmmapentry.
pmap operations now iterate vmmapbacking structures (rather than spin-locked page lists based on the vmpage and pventry's), and will test/match operations against the PTE found in the pmap at the requisite location. This doubles VM fault performance on shared pages and reduces the locking overhead for fault and pmap operations.
Simplify the collapse code, removing most of the original code and replacing it with simpler per-vmmapentry optimizations to limit the shadow depth.
DRM
Major updates to the radeon and ttm (amd support code) drivers. We have not quite gotten the AMD support up to the more modern cards or Ryzen APUs yet, however.
Improve UEFI framebuffer support.
A major deadlock has been fixed in the radeon/ttm code.
Refactor the startup delay designed to avoid conflicts between the i915 driver initialization and X startup.
Add DRMIOCTLGET_PCIINFO to improve mesa/libdrm support.
Fix excessive wired memory build-ups.
Fix Linux/DragonFly PAGE_MASK confusion in the DRM code.
Fix idr_*() API bugs.
HAMMER2
The filesystem sync code has been rewritten to significantly improve performance.
Sequential write performance also improved.
Add simple dependency tracking to prevent directory/file splits during create/rename/remove operations, for better consistency after a crash.
Refactor the snapshot code to reduce flush latency and to ensure a consistent snapshot.
Attempt to pipeline the flush code against the frontend, improving flush vs frontend write concurrency.
Improve umount operation.
Fix an allocator race that could lead to corruption.
Numerous other bugs fixed.
Improve verbosity of CHECK (CRC error) console messages.
OpenBSD Vulkan Support (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=OpenBSD-Vulkan-Support)
Somewhat surprisingly, OpenBSD has added the Vulkan library and ICD loader support as their newest port. 
This new graphics/vulkan-loader port provides the generic Vulkan library and ICD support that is the common code for Vulkan implementations on the system. This doesn't enable any Vulkan hardware drivers or provide something new not available elsewhere, but is rare seeing Vulkan work among the BSDs. There is also in ports the related components like the SPIR-V headers and tools, glsllang, and the Vulkan tools and validation layers. 
This is of limited usefulness, at least for the time being considering OpenBSD like the other BSDs lag behind in their DRM kernel driver support that is ported over from the mainline Linux kernel tree but generally years behind the kernel upstream. Particularly with Vulkan, newer kernel releases are needed for some Vulkan features as well as achieving decent performance. The Vulkan drivers of relevance are the open-source Intel ANV Vulkan driver and Radeon RADV drivers, both of which are in Mesa though we haven't seen any testing results to know how well they would work if at all currently on OpenBSD, but they're at least in Mesa and obviously open-source. 
+ A note: The BSDs are no longer that far behind.
+ FreeBSD 12.0 uses DRM from Linux 4.16 (April 2018), and the drm-devel port is based on Linux 5.0 (March 2019)
+ OpenBSD -current as of April 2019 uses DRM from Linux 4.19.34
News Roundup
Bad utmp implementations in glibc and freebsd (https://davmac.wordpress.com/2019/05/04/bad-utmp-implementations-in-glibc-and-freebsd/)
I recently released another version – 0.5.0 – of Dinit, the service manager / init system. There were a number of minor improvements, including to the build system (just running “make” or “gmake” should be enough on any of the systems which have a pre-defined configuration, no need to edit mconfig by hand), but the main features of the release were S6-compatible readiness notification, and support for updating the utmp database.
In other words, utmp is a record of who is currently logged in to the system (another file, “wtmp”, records all logins and logouts, as well as, potentially, certain system events such as reboots and time updates). This is a hint at the main motivation for having utmp support in Dinit – I wanted the “who” command to correctly report current logins (and I wanted boot time to be correctly recorded in the wtmp file).
I wondered: If the files consist of fixed-sized records, and are readable by regular users, how is consistency maintained? That is – how can a process ensure that, when it updates the database, it doesn’t conflict with another process also attempting to update the database at the same time? Similarly, how can a process reading an entry from the database be sure that it receives a consistent, full record and not a record which has been partially updated? (after all, POSIX allows that a write(2) call can return without having written all the requested bytes, and I’m not aware of Linux or any of the *BSDs documenting that this cannot happen for regular files). Clearly, some kind of locking is needed; a process that wants to write to or read from the database locks it first, performs its operation, and then unlocks the database. Once again, this happens under the hood, in the implementation of the getutent/pututline functions or their equivalents.
Then I wondered: if a user process is able to lock the utmp file, and this prevents updates, what’s to stop a user process from manually acquiring and then holding such a lock for a long – even practically infinite – duration? This would prevent the database from being updated, and would perhaps even prevent logins/logouts from completing. Unfortunately, the answer is – nothing; and yes, it is possible on different systems to prevent the database from being correctly updated or even to prevent all other users – including root – from logging in to the system.
+ A good find
+ On FreeBSD, even though write(2) can be asynchronous, once the write syscall returns, the data is in the buffer cache (or ARC), and any future read(2) will see that new data even if it has not yet been written to disk.
OpenSSH gets an update to protect against Side Channel attacks (https://securityboulevard.com/2019/06/openssh-code-gets-an-update-to-protect-against-side-channel-attacks/)
Last week, Damien Miller, a Google security researcher, and one of the popular OpenSSH and OpenBSD developers announced an update to the existing OpenSSH code that can help protect against the side-channel attacks that leak sensitive data from computer’s memory. This protection, Miller says, will protect the private keys residing in the RAM against Spectre, Meltdown, Rowhammer, and the latest RAMBleed attack.
SSH private keys can be used by malicious threat actors to connect to remote servers without the need of a password. According to CSO, “The approach used by OpenSSH could be copied by other software projects to protect their own keys and secrets in memory”.
However, if the attacker is successful in extracting the data from a computer or server’s RAM, they will only obtain an encrypted version of an SSH private key, rather than the cleartext version.
In an email to OpenBSD, Miller writes, “this change encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large ‘prekey’ consisting of random data (currently 16KB).”
ZFS vs OpenZFS (https://www.ixsystems.com/blog/zfs-vs-openzfs/)
You’ve probably heard us say a mix of “ZFS” and “OpenZFS” and an explanation is long-overdue. 
From its inception, “ZFS” has referred to the “Zettabyte File System” developed at Sun Microsystems and published under the CDDL Open Source license in 2005 as part of the OpenSolaris operating system. ZFS was revolutionary for completely decoupling the file system from specialized storage hardware and even a specific computer platform. The portable nature and advanced features of ZFS led FreeBSD, Linux, and even Apple developers to start porting ZFS to their operating systems and by 2008, FreeBSD shipped with ZFS in the 7.0 release. For the first time, ZFS empowered users of any budget with enterprise-class scalability and data integrity and management features like checksumming, compression and snapshotting, and those features remain unrivaled at any price to this day. On any ZFS platform, administrators use the zpool and zfs utilities to configure and manage their storage devices and file systems respectively. Both commands employ a user-friendly syntax such as‘zfs create mypool/mydataset’ and I welcome you to watch the appropriately-titled webinar “Why we love ZFS &amp;amp; you should too” or try a completely-graphical ZFS experience with FreeNAS.
Oracle has steadily continued to develop its own proprietary branch of ZFS and Matt Ahrens points out that over 50% of the original OpenSolaris ZFS code has been replaced in OpenZFS with community contributions. This means that there are, sadly, two politically and technologically-incompatible branches of “ZFS” but fortunately, OpenZFS is orders of magnitude more popular thanks to its open nature. The two projects should be referred to as “Oracle ZFS” and “OpenZFS” to distinguish them as development efforts, but the user still types the ‘zfs’ command, which on FreeBSD relies on the ‘zfs.ko’ kernel module. My impression is that the terms of the CDDL license under which the OpenZFS branch of ZFS is published protects its users from any patent and trademark risks. Hopefully, this all helps you distinguish the OpenZFS project from the ZFS technology.
+ There was further discussion of how the ZFSOnLinux repo will become the OpenZFS repo in the future once it also contains the bits to build on FreeBSD as well during the June 25th ZFS Leadership Meeting. The videos for all of the meetings are available here (https://www.youtube.com/channel/UC0IK6Y4Go2KtRueHDiQcxow)
Beastie Bits
How to safely and portably close a file descriptor in a multithreaded process without running into problems with EINTR (https://twitter.com/cperciva/status/1141852451756105729?s=03)
KnoxBug Meetup June 27th at 6pm (http://knoxbug.org/2019-06-27)
BSD Pizza Night, June 27th at 7pm, Flying Pie Pizzeria, 3 Monroe Pkwy, Ste S, Lake Oswego, OR (https://www.flying-pie.com/locations/lake-oswego/)
Difference between $x and ${x} (https://moopost.blogspot.com/2019/06/difference-between-x-and-x.html)
Beware of Software Engineering Media Sites (https://www.nemil.com/on-software-engineering/beware-engineering-media.html)
How Verizon and a BGP optimizer knocked large parts of the internet offline today (https://blog.cloudflare.com/how-verizon-and-a-bgp-optimizer-knocked-large-parts-of-the-internet-offline-today/)
DragonflyBSD - MDS mitigation added a while ago (http://lists.dragonflybsd.org/pipermail/commits/2019-May/718899.html)
Reminder: Register for EuroBSDcon 2019 in Lillehammer, Norway (https://eurobsdcon.org)
Feedback/Questions
Dave - CheriBSD (http://dpaste.com/38233JC)
Neb - Hello from Norway (http://dpaste.com/0B8XKXT#wrap)
Lars - Ansible tutorial? (http://dpaste.com/3N85SHR)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, vm, drm, hammer2, vulkan, openssh, zfs, openzfs,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>DragonflyBSD 5.6 is out, OpenBSD Vulkan Support, bad utmp implementations in glibc and FreeBSD, OpenSSH protects itself against Side Channel attacks, ZFS vs OpenZFS, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.dragonflybsd.org/release56" rel="nofollow">DragonflyBSD 5.6 is out</a></h3>

<ul>
<li>Version 5.6.0 released 17 June 2019</li>
<li><p><a href="https://www.dragonflydigest.com/2019/06/19/23091.html" rel="nofollow">Version 5.6.1 released 19 June 2019</a></p></li>
<li><p>Big-ticket items</p></li>
<li><p>Improved VM</p>

<ul>
<li>Informal test results showing the changes from 5.4 to 5.6 are available.</li>
<li>Reduce stalls in the kernel vm_page_alloc() code (vm_page_list_find()).</li>
<li>Improve page allocation algorithm to avoid re-iterating the same queues as the search is widened.</li>
<li>Add a vm_page_hash*() API that allows the kernel to do heuristical lockless lookups of VM pages.</li>
<li>Change vm_hold() and vm_unhold() semantics to not require any spin-locks.</li>
<li>Change vm_page_wakeup() to not require any spin-locks.</li>
<li>Change wiring vm_page&#39;s no longer manipulates the queue the page is on, saving a lot of overhead. Instead, the page will be removed from its queue only if the pageout demon encounters it. This allows pages to enter and leave the buffer cache quickly.</li>
<li>Refactor the handling of fictitious pages.</li>
<li>Remove m-&gt;md.pv_list entirely. VM pages in mappings no longer allocate pv_entry&#39;s, saving an enormous amount of memory when multiple processes utilize large shared memory maps (e.g. postgres database cache).</li>
<li>Refactor vm_object shadowing, disconnecting the backing linkages from the vm_object itself and instead organizing the linkages in a new structure called vm_map_backing which hangs off the vm_map_entry.</li>
<li>pmap operations now iterate vm_map_backing structures (rather than spin-locked page lists based on the vm_page and pv_entry&#39;s), and will test/match operations against the PTE found in the pmap at the requisite location. This doubles VM fault performance on shared pages and reduces the locking overhead for fault and pmap operations.</li>
<li>Simplify the collapse code, removing most of the original code and replacing it with simpler per-vm_map_entry optimizations to limit the shadow depth.</li>
</ul></li>
<li><p>DRM</p>

<ul>
<li>Major updates to the radeon and ttm (amd support code) drivers. We have not quite gotten the AMD support up to the more modern cards or Ryzen APUs yet, however.</li>
<li>Improve UEFI framebuffer support.</li>
<li>A major deadlock has been fixed in the radeon/ttm code.</li>
<li>Refactor the startup delay designed to avoid conflicts between the i915 driver initialization and X startup.</li>
<li>Add DRM_IOCTL_GET_PCIINFO to improve mesa/libdrm support.</li>
<li>Fix excessive wired memory build-ups.</li>
<li>Fix Linux/DragonFly PAGE_MASK confusion in the DRM code.</li>
<li>Fix idr_*() API bugs.</li>
</ul></li>
<li><p>HAMMER2</p>

<ul>
<li>The filesystem sync code has been rewritten to significantly improve performance.</li>
<li>Sequential write performance also improved.</li>
<li>Add simple dependency tracking to prevent directory/file splits during create/rename/remove operations, for better consistency after a crash.</li>
<li>Refactor the snapshot code to reduce flush latency and to ensure a consistent snapshot.</li>
<li>Attempt to pipeline the flush code against the frontend, improving flush vs frontend write concurrency.</li>
<li>Improve umount operation.</li>
<li>Fix an allocator race that could lead to corruption.</li>
<li>Numerous other bugs fixed.</li>
<li>Improve verbosity of CHECK (CRC error) console messages.</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=OpenBSD-Vulkan-Support" rel="nofollow">OpenBSD Vulkan Support</a></h3>

<blockquote>
<p>Somewhat surprisingly, OpenBSD has added the Vulkan library and ICD loader support as their newest port. <br>
This new graphics/vulkan-loader port provides the generic Vulkan library and ICD support that is the common code for Vulkan implementations on the system. This doesn&#39;t enable any Vulkan hardware drivers or provide something new not available elsewhere, but is rare seeing Vulkan work among the BSDs. There is also in ports the related components like the SPIR-V headers and tools, glsllang, and the Vulkan tools and validation layers. <br>
This is of limited usefulness, at least for the time being considering OpenBSD like the other BSDs lag behind in their DRM kernel driver support that is ported over from the mainline Linux kernel tree but generally years behind the kernel upstream. Particularly with Vulkan, newer kernel releases are needed for some Vulkan features as well as achieving decent performance. The Vulkan drivers of relevance are the open-source Intel ANV Vulkan driver and Radeon RADV drivers, both of which are in Mesa though we haven&#39;t seen any testing results to know how well they would work if at all currently on OpenBSD, but they&#39;re at least in Mesa and obviously open-source. </p>

<ul>
<li>A note: The BSDs are no longer that far behind.</li>
<li>FreeBSD 12.0 uses DRM from Linux 4.16 (April 2018), and the drm-devel port is based on Linux 5.0 (March 2019)</li>
<li>OpenBSD -current as of April 2019 uses DRM from Linux 4.19.34
***</li>
</ul>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://davmac.wordpress.com/2019/05/04/bad-utmp-implementations-in-glibc-and-freebsd/" rel="nofollow">Bad utmp implementations in glibc and freebsd</a></h3>

<blockquote>
<p>I recently released another version – 0.5.0 – of Dinit, the service manager / init system. There were a number of minor improvements, including to the build system (just running “make” or “gmake” should be enough on any of the systems which have a pre-defined configuration, no need to edit mconfig by hand), but the main features of the release were S6-compatible readiness notification, and support for updating the utmp database.<br>
In other words, utmp is a record of who is currently logged in to the system (another file, “wtmp”, records all logins and logouts, as well as, potentially, certain system events such as reboots and time updates). This is a hint at the main motivation for having utmp support in Dinit – I wanted the “who” command to correctly report current logins (and I wanted boot time to be correctly recorded in the wtmp file).<br>
I wondered: If the files consist of fixed-sized records, and are readable by regular users, how is consistency maintained? That is – how can a process ensure that, when it updates the database, it doesn’t conflict with another process also attempting to update the database at the same time? Similarly, how can a process reading an entry from the database be sure that it receives a consistent, full record and not a record which has been partially updated? (after all, POSIX allows that a write(2) call can return without having written all the requested bytes, and I’m not aware of Linux or any of the *BSDs documenting that this cannot happen for regular files). Clearly, some kind of locking is needed; a process that wants to write to or read from the database locks it first, performs its operation, and then unlocks the database. Once again, this happens under the hood, in the implementation of the getutent/pututline functions or their equivalents.<br>
Then I wondered: if a user process is able to lock the utmp file, and this prevents updates, what’s to stop a user process from manually acquiring and then holding such a lock for a long – even practically infinite – duration? This would prevent the database from being updated, and would perhaps even prevent logins/logouts from completing. Unfortunately, the answer is – nothing; and yes, it is possible on different systems to prevent the database from being correctly updated or even to prevent all other users – including root – from logging in to the system.</p>

<ul>
<li>A good find</li>
<li>On FreeBSD, even though write(2) can be asynchronous, once the write syscall returns, the data is in the buffer cache (or ARC), and any future read(2) will see that new data even if it has not yet been written to disk.
***</li>
</ul>
</blockquote>

<h3><a href="https://securityboulevard.com/2019/06/openssh-code-gets-an-update-to-protect-against-side-channel-attacks/" rel="nofollow">OpenSSH gets an update to protect against Side Channel attacks</a></h3>

<blockquote>
<p>Last week, Damien Miller, a Google security researcher, and one of the popular OpenSSH and OpenBSD developers announced an update to the existing OpenSSH code that can help protect against the side-channel attacks that leak sensitive data from computer’s memory. This protection, Miller says, will protect the private keys residing in the RAM against Spectre, Meltdown, Rowhammer, and the latest RAMBleed attack.<br>
SSH private keys can be used by malicious threat actors to connect to remote servers without the need of a password. According to CSO, “The approach used by OpenSSH could be copied by other software projects to protect their own keys and secrets in memory”.<br>
However, if the attacker is successful in extracting the data from a computer or server’s RAM, they will only obtain an encrypted version of an SSH private key, rather than the cleartext version.<br>
In an email to OpenBSD, Miller writes, “this change encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large ‘prekey’ consisting of random data (currently 16KB).”</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/zfs-vs-openzfs/" rel="nofollow">ZFS vs OpenZFS</a></h3>

<blockquote>
<p>You’ve probably heard us say a mix of “ZFS” and “OpenZFS” and an explanation is long-overdue. <br>
From its inception, “ZFS” has referred to the “Zettabyte File System” developed at Sun Microsystems and published under the CDDL Open Source license in 2005 as part of the OpenSolaris operating system. ZFS was revolutionary for completely decoupling the file system from specialized storage hardware and even a specific computer platform. The portable nature and advanced features of ZFS led FreeBSD, Linux, and even Apple developers to start porting ZFS to their operating systems and by 2008, FreeBSD shipped with ZFS in the 7.0 release. For the first time, ZFS empowered users of any budget with enterprise-class scalability and data integrity and management features like checksumming, compression and snapshotting, and those features remain unrivaled at any price to this day. On any ZFS platform, administrators use the zpool and zfs utilities to configure and manage their storage devices and file systems respectively. Both commands employ a user-friendly syntax such as‘zfs create mypool/mydataset’ and I welcome you to watch the appropriately-titled webinar “Why we love ZFS &amp; you should too” or try a completely-graphical ZFS experience with FreeNAS.<br>
Oracle has steadily continued to develop its own proprietary branch of ZFS and Matt Ahrens points out that over 50% of the original OpenSolaris ZFS code has been replaced in OpenZFS with community contributions. This means that there are, sadly, two politically and technologically-incompatible branches of “ZFS” but fortunately, OpenZFS is orders of magnitude more popular thanks to its open nature. The two projects should be referred to as “Oracle ZFS” and “OpenZFS” to distinguish them as development efforts, but the user still types the ‘zfs’ command, which on FreeBSD relies on the ‘zfs.ko’ kernel module. My impression is that the terms of the CDDL license under which the OpenZFS branch of ZFS is published protects its users from any patent and trademark risks. Hopefully, this all helps you distinguish the OpenZFS project from the ZFS technology.</p>

<ul>
<li>There was further discussion of how the ZFSOnLinux repo will become the OpenZFS repo in the future once it also contains the bits to build on FreeBSD as well during the June 25th ZFS Leadership Meeting. The videos for all of the meetings are available <a href="https://www.youtube.com/channel/UC0IK6Y4Go2KtRueHDiQcxow" rel="nofollow">here</a>
***</li>
</ul>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/cperciva/status/1141852451756105729?s=03" rel="nofollow">How to safely and portably close a file descriptor in a multithreaded process without running into problems with EINTR</a></li>
<li><a href="http://knoxbug.org/2019-06-27" rel="nofollow">KnoxBug Meetup June 27th at 6pm</a></li>
<li><a href="https://www.flying-pie.com/locations/lake-oswego/" rel="nofollow">BSD Pizza Night, June 27th at 7pm, Flying Pie Pizzeria, 3 Monroe Pkwy, Ste S, Lake Oswego, OR</a></li>
<li><a href="https://moopost.blogspot.com/2019/06/difference-between-x-and-x.html" rel="nofollow">Difference between $x and ${x}</a></li>
<li><a href="https://www.nemil.com/on-software-engineering/beware-engineering-media.html" rel="nofollow">Beware of Software Engineering Media Sites</a></li>
<li><a href="https://blog.cloudflare.com/how-verizon-and-a-bgp-optimizer-knocked-large-parts-of-the-internet-offline-today/" rel="nofollow">How Verizon and a BGP optimizer knocked large parts of the internet offline today</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-May/718899.html" rel="nofollow">DragonflyBSD - MDS mitigation added a while ago</a></li>
<li><a href="https://eurobsdcon.org" rel="nofollow">Reminder: Register for EuroBSDcon 2019 in Lillehammer, Norway</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Dave - <a href="http://dpaste.com/38233JC" rel="nofollow">CheriBSD</a></li>
<li>Neb - <a href="http://dpaste.com/0B8XKXT#wrap" rel="nofollow">Hello from Norway</a></li>
<li>Lars - <a href="http://dpaste.com/3N85SHR" rel="nofollow">Ansible tutorial?</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0304.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>DragonflyBSD 5.6 is out, OpenBSD Vulkan Support, bad utmp implementations in glibc and FreeBSD, OpenSSH protects itself against Side Channel attacks, ZFS vs OpenZFS, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.dragonflybsd.org/release56" rel="nofollow">DragonflyBSD 5.6 is out</a></h3>

<ul>
<li>Version 5.6.0 released 17 June 2019</li>
<li><p><a href="https://www.dragonflydigest.com/2019/06/19/23091.html" rel="nofollow">Version 5.6.1 released 19 June 2019</a></p></li>
<li><p>Big-ticket items</p></li>
<li><p>Improved VM</p>

<ul>
<li>Informal test results showing the changes from 5.4 to 5.6 are available.</li>
<li>Reduce stalls in the kernel vm_page_alloc() code (vm_page_list_find()).</li>
<li>Improve page allocation algorithm to avoid re-iterating the same queues as the search is widened.</li>
<li>Add a vm_page_hash*() API that allows the kernel to do heuristical lockless lookups of VM pages.</li>
<li>Change vm_hold() and vm_unhold() semantics to not require any spin-locks.</li>
<li>Change vm_page_wakeup() to not require any spin-locks.</li>
<li>Change wiring vm_page&#39;s no longer manipulates the queue the page is on, saving a lot of overhead. Instead, the page will be removed from its queue only if the pageout demon encounters it. This allows pages to enter and leave the buffer cache quickly.</li>
<li>Refactor the handling of fictitious pages.</li>
<li>Remove m-&gt;md.pv_list entirely. VM pages in mappings no longer allocate pv_entry&#39;s, saving an enormous amount of memory when multiple processes utilize large shared memory maps (e.g. postgres database cache).</li>
<li>Refactor vm_object shadowing, disconnecting the backing linkages from the vm_object itself and instead organizing the linkages in a new structure called vm_map_backing which hangs off the vm_map_entry.</li>
<li>pmap operations now iterate vm_map_backing structures (rather than spin-locked page lists based on the vm_page and pv_entry&#39;s), and will test/match operations against the PTE found in the pmap at the requisite location. This doubles VM fault performance on shared pages and reduces the locking overhead for fault and pmap operations.</li>
<li>Simplify the collapse code, removing most of the original code and replacing it with simpler per-vm_map_entry optimizations to limit the shadow depth.</li>
</ul></li>
<li><p>DRM</p>

<ul>
<li>Major updates to the radeon and ttm (amd support code) drivers. We have not quite gotten the AMD support up to the more modern cards or Ryzen APUs yet, however.</li>
<li>Improve UEFI framebuffer support.</li>
<li>A major deadlock has been fixed in the radeon/ttm code.</li>
<li>Refactor the startup delay designed to avoid conflicts between the i915 driver initialization and X startup.</li>
<li>Add DRM_IOCTL_GET_PCIINFO to improve mesa/libdrm support.</li>
<li>Fix excessive wired memory build-ups.</li>
<li>Fix Linux/DragonFly PAGE_MASK confusion in the DRM code.</li>
<li>Fix idr_*() API bugs.</li>
</ul></li>
<li><p>HAMMER2</p>

<ul>
<li>The filesystem sync code has been rewritten to significantly improve performance.</li>
<li>Sequential write performance also improved.</li>
<li>Add simple dependency tracking to prevent directory/file splits during create/rename/remove operations, for better consistency after a crash.</li>
<li>Refactor the snapshot code to reduce flush latency and to ensure a consistent snapshot.</li>
<li>Attempt to pipeline the flush code against the frontend, improving flush vs frontend write concurrency.</li>
<li>Improve umount operation.</li>
<li>Fix an allocator race that could lead to corruption.</li>
<li>Numerous other bugs fixed.</li>
<li>Improve verbosity of CHECK (CRC error) console messages.</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=OpenBSD-Vulkan-Support" rel="nofollow">OpenBSD Vulkan Support</a></h3>

<blockquote>
<p>Somewhat surprisingly, OpenBSD has added the Vulkan library and ICD loader support as their newest port. <br>
This new graphics/vulkan-loader port provides the generic Vulkan library and ICD support that is the common code for Vulkan implementations on the system. This doesn&#39;t enable any Vulkan hardware drivers or provide something new not available elsewhere, but is rare seeing Vulkan work among the BSDs. There is also in ports the related components like the SPIR-V headers and tools, glsllang, and the Vulkan tools and validation layers. <br>
This is of limited usefulness, at least for the time being considering OpenBSD like the other BSDs lag behind in their DRM kernel driver support that is ported over from the mainline Linux kernel tree but generally years behind the kernel upstream. Particularly with Vulkan, newer kernel releases are needed for some Vulkan features as well as achieving decent performance. The Vulkan drivers of relevance are the open-source Intel ANV Vulkan driver and Radeon RADV drivers, both of which are in Mesa though we haven&#39;t seen any testing results to know how well they would work if at all currently on OpenBSD, but they&#39;re at least in Mesa and obviously open-source. </p>

<ul>
<li>A note: The BSDs are no longer that far behind.</li>
<li>FreeBSD 12.0 uses DRM from Linux 4.16 (April 2018), and the drm-devel port is based on Linux 5.0 (March 2019)</li>
<li>OpenBSD -current as of April 2019 uses DRM from Linux 4.19.34
***</li>
</ul>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://davmac.wordpress.com/2019/05/04/bad-utmp-implementations-in-glibc-and-freebsd/" rel="nofollow">Bad utmp implementations in glibc and freebsd</a></h3>

<blockquote>
<p>I recently released another version – 0.5.0 – of Dinit, the service manager / init system. There were a number of minor improvements, including to the build system (just running “make” or “gmake” should be enough on any of the systems which have a pre-defined configuration, no need to edit mconfig by hand), but the main features of the release were S6-compatible readiness notification, and support for updating the utmp database.<br>
In other words, utmp is a record of who is currently logged in to the system (another file, “wtmp”, records all logins and logouts, as well as, potentially, certain system events such as reboots and time updates). This is a hint at the main motivation for having utmp support in Dinit – I wanted the “who” command to correctly report current logins (and I wanted boot time to be correctly recorded in the wtmp file).<br>
I wondered: If the files consist of fixed-sized records, and are readable by regular users, how is consistency maintained? That is – how can a process ensure that, when it updates the database, it doesn’t conflict with another process also attempting to update the database at the same time? Similarly, how can a process reading an entry from the database be sure that it receives a consistent, full record and not a record which has been partially updated? (after all, POSIX allows that a write(2) call can return without having written all the requested bytes, and I’m not aware of Linux or any of the *BSDs documenting that this cannot happen for regular files). Clearly, some kind of locking is needed; a process that wants to write to or read from the database locks it first, performs its operation, and then unlocks the database. Once again, this happens under the hood, in the implementation of the getutent/pututline functions or their equivalents.<br>
Then I wondered: if a user process is able to lock the utmp file, and this prevents updates, what’s to stop a user process from manually acquiring and then holding such a lock for a long – even practically infinite – duration? This would prevent the database from being updated, and would perhaps even prevent logins/logouts from completing. Unfortunately, the answer is – nothing; and yes, it is possible on different systems to prevent the database from being correctly updated or even to prevent all other users – including root – from logging in to the system.</p>

<ul>
<li>A good find</li>
<li>On FreeBSD, even though write(2) can be asynchronous, once the write syscall returns, the data is in the buffer cache (or ARC), and any future read(2) will see that new data even if it has not yet been written to disk.
***</li>
</ul>
</blockquote>

<h3><a href="https://securityboulevard.com/2019/06/openssh-code-gets-an-update-to-protect-against-side-channel-attacks/" rel="nofollow">OpenSSH gets an update to protect against Side Channel attacks</a></h3>

<blockquote>
<p>Last week, Damien Miller, a Google security researcher, and one of the popular OpenSSH and OpenBSD developers announced an update to the existing OpenSSH code that can help protect against the side-channel attacks that leak sensitive data from computer’s memory. This protection, Miller says, will protect the private keys residing in the RAM against Spectre, Meltdown, Rowhammer, and the latest RAMBleed attack.<br>
SSH private keys can be used by malicious threat actors to connect to remote servers without the need of a password. According to CSO, “The approach used by OpenSSH could be copied by other software projects to protect their own keys and secrets in memory”.<br>
However, if the attacker is successful in extracting the data from a computer or server’s RAM, they will only obtain an encrypted version of an SSH private key, rather than the cleartext version.<br>
In an email to OpenBSD, Miller writes, “this change encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large ‘prekey’ consisting of random data (currently 16KB).”</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/zfs-vs-openzfs/" rel="nofollow">ZFS vs OpenZFS</a></h3>

<blockquote>
<p>You’ve probably heard us say a mix of “ZFS” and “OpenZFS” and an explanation is long-overdue. <br>
From its inception, “ZFS” has referred to the “Zettabyte File System” developed at Sun Microsystems and published under the CDDL Open Source license in 2005 as part of the OpenSolaris operating system. ZFS was revolutionary for completely decoupling the file system from specialized storage hardware and even a specific computer platform. The portable nature and advanced features of ZFS led FreeBSD, Linux, and even Apple developers to start porting ZFS to their operating systems and by 2008, FreeBSD shipped with ZFS in the 7.0 release. For the first time, ZFS empowered users of any budget with enterprise-class scalability and data integrity and management features like checksumming, compression and snapshotting, and those features remain unrivaled at any price to this day. On any ZFS platform, administrators use the zpool and zfs utilities to configure and manage their storage devices and file systems respectively. Both commands employ a user-friendly syntax such as‘zfs create mypool/mydataset’ and I welcome you to watch the appropriately-titled webinar “Why we love ZFS &amp; you should too” or try a completely-graphical ZFS experience with FreeNAS.<br>
Oracle has steadily continued to develop its own proprietary branch of ZFS and Matt Ahrens points out that over 50% of the original OpenSolaris ZFS code has been replaced in OpenZFS with community contributions. This means that there are, sadly, two politically and technologically-incompatible branches of “ZFS” but fortunately, OpenZFS is orders of magnitude more popular thanks to its open nature. The two projects should be referred to as “Oracle ZFS” and “OpenZFS” to distinguish them as development efforts, but the user still types the ‘zfs’ command, which on FreeBSD relies on the ‘zfs.ko’ kernel module. My impression is that the terms of the CDDL license under which the OpenZFS branch of ZFS is published protects its users from any patent and trademark risks. Hopefully, this all helps you distinguish the OpenZFS project from the ZFS technology.</p>

<ul>
<li>There was further discussion of how the ZFSOnLinux repo will become the OpenZFS repo in the future once it also contains the bits to build on FreeBSD as well during the June 25th ZFS Leadership Meeting. The videos for all of the meetings are available <a href="https://www.youtube.com/channel/UC0IK6Y4Go2KtRueHDiQcxow" rel="nofollow">here</a>
***</li>
</ul>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/cperciva/status/1141852451756105729?s=03" rel="nofollow">How to safely and portably close a file descriptor in a multithreaded process without running into problems with EINTR</a></li>
<li><a href="http://knoxbug.org/2019-06-27" rel="nofollow">KnoxBug Meetup June 27th at 6pm</a></li>
<li><a href="https://www.flying-pie.com/locations/lake-oswego/" rel="nofollow">BSD Pizza Night, June 27th at 7pm, Flying Pie Pizzeria, 3 Monroe Pkwy, Ste S, Lake Oswego, OR</a></li>
<li><a href="https://moopost.blogspot.com/2019/06/difference-between-x-and-x.html" rel="nofollow">Difference between $x and ${x}</a></li>
<li><a href="https://www.nemil.com/on-software-engineering/beware-engineering-media.html" rel="nofollow">Beware of Software Engineering Media Sites</a></li>
<li><a href="https://blog.cloudflare.com/how-verizon-and-a-bgp-optimizer-knocked-large-parts-of-the-internet-offline-today/" rel="nofollow">How Verizon and a BGP optimizer knocked large parts of the internet offline today</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-May/718899.html" rel="nofollow">DragonflyBSD - MDS mitigation added a while ago</a></li>
<li><a href="https://eurobsdcon.org" rel="nofollow">Reminder: Register for EuroBSDcon 2019 in Lillehammer, Norway</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Dave - <a href="http://dpaste.com/38233JC" rel="nofollow">CheriBSD</a></li>
<li>Neb - <a href="http://dpaste.com/0B8XKXT#wrap" rel="nofollow">Hello from Norway</a></li>
<li>Lars - <a href="http://dpaste.com/3N85SHR" rel="nofollow">Ansible tutorial?</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0304.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>303: OpenZFS in Ports</title>
  <link>https://www.bsdnow.tv/303</link>
  <guid isPermaLink="false">1ed8b630-10c4-44f6-9a48-2ffcb4a8b6fe</guid>
  <pubDate>Wed, 19 Jun 2019 22:30:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1ed8b630-10c4-44f6-9a48-2ffcb4a8b6fe.mp3" length="37840062" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS-kmod port available, using blacklistd with NPF as fail2ban replacement, ZFS raidz expansion alpha preview 1, audio VU-meter increases CO2 footprint rant, XSAVE and compat32 kernel work for LLDB, where icons for modern X applications come from, and more.</itunes:subtitle>
  <itunes:duration>52:33</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS-kmod port available, using blacklistd with NPF as fail2ban replacement, ZFS raidz expansion alpha preview 1, audio VU-meter increases CO2 footprint rant, XSAVE and compat32 kernel work for LLDB, where icons for modern X applications come from, and more.
Headlines
ZFSonFreeBSD ports renamed OpenZFS (https://www.freshports.org/sysutils/openzfs-kmod)
The ZFS on FreeBSD project has renamed the userland and kernel ports from zol and zol-kmod to openzfs and openzfs-kmod
The new versions from this week are IOCTL compatible with the command line tools in FreeBSD 12.0, so you can use the old userland with the new kernel module (although obviously not the new features)
With the renaming it is easier to specify which kernel module you want to load in /boot/loader.conf:
&amp;gt; zfs_load=”YES”
or
&amp;gt; openzfs_load=”YES”
To load traditional or the newer version of ZFS
The kmod still requires FreeBSD 12-stable or 13-current because it depends on the newer crypto support in the kernel for the ZFS native encryption feature. Allan is looking at ways to work around this, but it may not be practical.
We would like to do an unofficial poll on how people would the userland to co-exist. Add a suffix to the new commands in /usr/local (zfs.new zpool.new or whatever). One idea i’ve had is to move the zfs and zpool commands to /libexec and make /sbin/zfs and /sbin/zpool a switcher script, that will call the base or ports version based on a config file (or just based on if the port is installed)
For testing purposes, generally you should be fine as long as you don’t run ‘zpool upgrade’, which will make your pool only importable using the newer ZFS.
For extra safety, you can create a ‘zpool checkpoint’, which will allow you to undo any changes that are made to the pool during your testing with the new openzfs tools. Note: the checkpoint will undo EVERYTHING. So don’t save new data you want to keep.
Note: Checkpoints disable all freeing operations, to prevent any data from being overwritten so that you can re-import at the checkpoint and undo any operation (including zfs destroy-ing a dataset), so also be careful you don’t run out of space during testing.
Please test and provide feedback.
How to use blacklistd(8) with NPF as a fail2ban replacement (https://www.unitedbsd.com/d/63-how-to-use-blacklistd8-with-npf-as-a-fail2ban-replacement)
About blacklistd(8)
blacklistd(8) provides an API that can be used by network daemons to communicate with a packet filter via a daemon to enforce opening and closing ports dynamically based on policy.
The interface to the packet filter is in /libexec/blacklistd-helper (this is currently designed for npf) and the configuration file (inspired from inetd.conf) is in etc/blacklistd.conf
Now, blacklistd(8) will require bpfjit(4) (Just-In-Time compiler for Berkeley Packet Filter) in order to properly work, in addition to, naturally, npf(7) as frontend and syslogd(8), as a backend to print diagnostic messages. Also remember npf shall rely on the npflog* virtual network interface to provide logging for tcpdump() to use. 
Unfortunately (dont' ask me why :P) in 8.1 all the required kernel components are still not compiled by default in the GENERIC kernel (though they are in HEAD), and are rather provided as modules. Enabling NPF and blacklistd services would normally result in them being automatically loaded as root, but predictably on securelevel=1 this is not going to happen
News Roundup
[WIP] raidz expansion, alpha preview 1 (https://github.com/zfsonlinux/zfs/pull/8853)
Motivation and Context
&amp;gt; This is a alpha-quality preview of RAID-Z expansion. This feature allows disks to be added one at a time to a RAID-Z group, expanding its capacity incrementally. This feature is especially useful for small pools (typically with only one RAID-Z group), where there isn't sufficient hardware to add capacity by adding a whole new RAID-Z group (typically doubling the number of disks).
&amp;gt; For additional context as well as a design overview, see my short talk from the 2017 OpenZFS Developer Summit: slides video
Rant: running audio VU-meter increases my CO2 footprint (https://medium.com/@MartinCracauer/bug-rant-running-audio-vu-meter-increases-my-co2-footprint-871d5c1bee5a)
A couple months ago I noticed that the monitor on my workstation never power off anymore. Screensaver would go on, but DPMs (to do the poweroff) never kicked in.
I grovels the output of various tools that display DPMS settings, which as usual in Xorg were useless. Everybody said DPMS is on with a timeout. I even wrote my own C program to use every available Xlib API call and even the xscreensaver library calls. (should make it available) No go, everybody says that DPMs is on, enabled and set on a timeout. Didn’t matter whether I let xscreeensaver do the job or just the X11 server.
After a while I noticed that DPMS actually worked between starting my X11 server and starting all my clients. I have a minimal .xinitrc and start the actual session from a script, that is how I could notice. If I used a regular desktop login I wouldn’t have noticed. A server state bug was much more likely than a client bug.
+ See the article for the rest...
XSAVE and compat32 kernel work for LLDB (http://blog.netbsd.org/tnf/entry/xsave_and_compat32_kernel_work)
Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.
In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and lately extending NetBSD's ptrace interface to cover more register types. You can read more about that in my Apr 2019 report.
In May, I was primarily continuing the work on new ptrace interface. Besides that, I've found and fixed a bug in ptrace() compat32 code, pushed LLVM buildbot to ‘green’ status and found some upstream LLVM regressions. More below.
Some things about where icons for modern X applications come from (https://utcc.utoronto.ca/~cks/space/blog/unix/ModernXAppIcons)
If you have a traditional window manager like fvwm, one of the things it can do is iconify X windows so that they turn into icons on the root window (which would often be called the 'desktop'). Even modern desktop environments that don't iconify programs to the root window (or their desktop) may have per-program icons for running programs in their dock or taskbar. If your window manager or desktop environment can do this, you might reasonably wonder where those icons come from by default.
Although I don't know how it was done in the early days of X, the modern standard for this is part of the Extended Window Manager Hints. In EWMH, applications give the window manager a number of possible icons, generally in different sizes, as ARGB bitmaps (instead of, say, SVG format). The window manager or desktop environment can then pick whichever icon size it likes best, taking into account things like the display resolution and so on, and display it however it wants to (in its original size or scaled up or down).
How this is communicated in specific is through the only good interprocess communication method that X supplies, namely X properties. In the specific case of icons, the NETWMICON property is what is used, and xprop can display the size information and an ASCII art summary of what each icon looks like. It's also possible to use some additional magic to read out the raw data from _NETWM_ICON in a useful format; see, for example, this Stackoverflow question and its answers.
Beastie Bits
Recent Security Innovations (http://undeadly.org/cgi?action=article;sid=20190605110020)
Old Unix books + Solaris (https://imgur.com/a/HbSYtQI)
Pro-Desktop - A Tiling Desktop Environment (https://bitcannon.net/post/pro-desktop/)
The Tar Pipe (https://blog.extracheese.org/2010/05/the-tar-pipe.html)
At least one vim trick you might not know (https://www.hillelwayne.com/post/intermediate-vim/)
Feedback/Questions
Johnny - listener feedback (http://dpaste.com/0ZQCQ8Y#wrap)
Brian - Questions (http://dpaste.com/1843RNX#wrap)
Mark - ZFS Question (http://dpaste.com/3M83X9G#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, zfs, openzfs, blacklistd, raidz, xsave, compat32, awesomewm, vim, npf, </itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS-kmod port available, using blacklistd with NPF as fail2ban replacement, ZFS raidz expansion alpha preview 1, audio VU-meter increases CO2 footprint rant, XSAVE and compat32 kernel work for LLDB, where icons for modern X applications come from, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freshports.org/sysutils/openzfs-kmod" rel="nofollow">ZFSonFreeBSD ports renamed OpenZFS</a></h3>

<ul>
<li>The ZFS on FreeBSD project has renamed the userland and kernel ports from zol and zol-kmod to openzfs and openzfs-kmod</li>
<li>The new versions from this week are IOCTL compatible with the command line tools in FreeBSD 12.0, so you can use the old userland with the new kernel module (although obviously not the new features)</li>
<li>With the renaming it is easier to specify which kernel module you want to load in /boot/loader.conf:
&gt; zfs_load=”YES”</li>
<li>or
&gt; openzfs_load=”YES”</li>
<li>To load traditional or the newer version of ZFS</li>
<li>The kmod still requires FreeBSD 12-stable or 13-current because it depends on the newer crypto support in the kernel for the ZFS native encryption feature. Allan is looking at ways to work around this, but it may not be practical.</li>
<li>We would like to do an unofficial poll on how people would the userland to co-exist. Add a suffix to the new commands in /usr/local (zfs.new zpool.new or whatever). One idea i’ve had is to move the zfs and zpool commands to /libexec and make /sbin/zfs and /sbin/zpool a switcher script, that will call the base or ports version based on a config file (or just based on if the port is installed)</li>
<li>For testing purposes, generally you should be fine as long as you don’t run ‘zpool upgrade’, which will make your pool only importable using the newer ZFS.</li>
<li>For extra safety, you can create a ‘zpool checkpoint’, which will allow you to undo any changes that are made to the pool during your testing with the new openzfs tools. Note: the checkpoint will undo EVERYTHING. So don’t save new data you want to keep.</li>
<li>Note: Checkpoints disable all freeing operations, to prevent any data from being overwritten so that you can re-import at the checkpoint and undo any operation (including zfs destroy-ing a dataset), so also be careful you don’t run out of space during testing.</li>
<li>Please test and provide feedback.</li>
</ul>

<hr>

<h3><a href="https://www.unitedbsd.com/d/63-how-to-use-blacklistd8-with-npf-as-a-fail2ban-replacement" rel="nofollow">How to use blacklistd(8) with NPF as a fail2ban replacement</a></h3>

<ul>
<li>About blacklistd(8)</li>
</ul>

<blockquote>
<p>blacklistd(8) provides an API that can be used by network daemons to communicate with a packet filter via a daemon to enforce opening and closing ports dynamically based on policy.<br>
The interface to the packet filter is in /libexec/blacklistd-helper (this is currently designed for npf) and the configuration file (inspired from inetd.conf) is in etc/blacklistd.conf<br>
Now, blacklistd(8) will require bpfjit(4) (Just-In-Time compiler for Berkeley Packet Filter) in order to properly work, in addition to, naturally, npf(7) as frontend and syslogd(8), as a backend to print diagnostic messages. Also remember npf shall rely on the npflog* virtual network interface to provide logging for tcpdump() to use. <br>
Unfortunately (dont&#39; ask me why :P) in 8.1 all the required kernel components are still not compiled by default in the GENERIC kernel (though they are in HEAD), and are rather provided as modules. Enabling NPF and blacklistd services would normally result in them being automatically loaded as root, but predictably on securelevel=1 this is not going to happen</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/zfsonlinux/zfs/pull/8853" rel="nofollow">[WIP] raidz expansion, alpha preview 1</a></h3>

<ul>
<li>Motivation and Context
&gt; This is a alpha-quality preview of RAID-Z expansion. This feature allows disks to be added one at a time to a RAID-Z group, expanding its capacity incrementally. This feature is especially useful for small pools (typically with only one RAID-Z group), where there isn&#39;t sufficient hardware to add capacity by adding a whole new RAID-Z group (typically doubling the number of disks).
&gt; For additional context as well as a design overview, see my short talk from the 2017 OpenZFS Developer Summit: slides video</li>
</ul>

<hr>

<h3><a href="https://medium.com/@MartinCracauer/bug-rant-running-audio-vu-meter-increases-my-co2-footprint-871d5c1bee5a" rel="nofollow">Rant: running audio VU-meter increases my CO2 footprint</a></h3>

<blockquote>
<p>A couple months ago I noticed that the monitor on my workstation never power off anymore. Screensaver would go on, but DPMs (to do the poweroff) never kicked in.<br>
I grovels the output of various tools that display DPMS settings, which as usual in Xorg were useless. Everybody said DPMS is on with a timeout. I even wrote my own C program to use every available Xlib API call and even the xscreensaver library calls. (should make it available) No go, everybody says that DPMs is on, enabled and set on a timeout. Didn’t matter whether I let xscreeensaver do the job or just the X11 server.<br>
After a while I noticed that DPMS actually worked between starting my X11 server and starting all my clients. I have a minimal .xinitrc and start the actual session from a script, that is how I could notice. If I used a regular desktop login I wouldn’t have noticed. A server state bug was much more likely than a client bug.</p>

<ul>
<li>See the article for the rest...</li>
</ul>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/xsave_and_compat32_kernel_work" rel="nofollow">XSAVE and compat32 kernel work for LLDB</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.<br>
In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and lately extending NetBSD&#39;s ptrace interface to cover more register types. You can read more about that in my Apr 2019 report.<br>
In May, I was primarily continuing the work on new ptrace interface. Besides that, I&#39;ve found and fixed a bug in ptrace() compat32 code, pushed LLVM buildbot to ‘green’ status and found some upstream LLVM regressions. More below.</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ModernXAppIcons" rel="nofollow">Some things about where icons for modern X applications come from</a></h3>

<blockquote>
<p>If you have a traditional window manager like fvwm, one of the things it can do is iconify X windows so that they turn into icons on the root window (which would often be called the &#39;desktop&#39;). Even modern desktop environments that don&#39;t iconify programs to the root window (or their desktop) may have per-program icons for running programs in their dock or taskbar. If your window manager or desktop environment can do this, you might reasonably wonder where those icons come from by default.<br>
Although I don&#39;t know how it was done in the early days of X, the modern standard for this is part of the Extended Window Manager Hints. In EWMH, applications give the window manager a number of possible icons, generally in different sizes, as ARGB bitmaps (instead of, say, SVG format). The window manager or desktop environment can then pick whichever icon size it likes best, taking into account things like the display resolution and so on, and display it however it wants to (in its original size or scaled up or down).<br>
How this is communicated in specific is through the only good interprocess communication method that X supplies, namely X properties. In the specific case of icons, the _NET_WM_ICON property is what is used, and xprop can display the size information and an ASCII art summary of what each icon looks like. It&#39;s also possible to use some additional magic to read out the raw data from _NET_WM_ICON in a useful format; see, for example, this Stackoverflow question and its answers.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article;sid=20190605110020" rel="nofollow">Recent Security Innovations</a></li>
<li><a href="https://imgur.com/a/HbSYtQI" rel="nofollow">Old Unix books + Solaris</a></li>
<li><a href="https://bitcannon.net/post/pro-desktop/" rel="nofollow">Pro-Desktop - A Tiling Desktop Environment</a></li>
<li><a href="https://blog.extracheese.org/2010/05/the-tar-pipe.html" rel="nofollow">The Tar Pipe</a></li>
<li><a href="https://www.hillelwayne.com/post/intermediate-vim/" rel="nofollow">At least one vim trick you might not know</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Johnny - <a href="http://dpaste.com/0ZQCQ8Y#wrap" rel="nofollow">listener feedback</a></li>
<li>Brian - <a href="http://dpaste.com/1843RNX#wrap" rel="nofollow">Questions</a></li>
<li>Mark - <a href="http://dpaste.com/3M83X9G#wrap" rel="nofollow">ZFS Question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0303.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS-kmod port available, using blacklistd with NPF as fail2ban replacement, ZFS raidz expansion alpha preview 1, audio VU-meter increases CO2 footprint rant, XSAVE and compat32 kernel work for LLDB, where icons for modern X applications come from, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freshports.org/sysutils/openzfs-kmod" rel="nofollow">ZFSonFreeBSD ports renamed OpenZFS</a></h3>

<ul>
<li>The ZFS on FreeBSD project has renamed the userland and kernel ports from zol and zol-kmod to openzfs and openzfs-kmod</li>
<li>The new versions from this week are IOCTL compatible with the command line tools in FreeBSD 12.0, so you can use the old userland with the new kernel module (although obviously not the new features)</li>
<li>With the renaming it is easier to specify which kernel module you want to load in /boot/loader.conf:
&gt; zfs_load=”YES”</li>
<li>or
&gt; openzfs_load=”YES”</li>
<li>To load traditional or the newer version of ZFS</li>
<li>The kmod still requires FreeBSD 12-stable or 13-current because it depends on the newer crypto support in the kernel for the ZFS native encryption feature. Allan is looking at ways to work around this, but it may not be practical.</li>
<li>We would like to do an unofficial poll on how people would the userland to co-exist. Add a suffix to the new commands in /usr/local (zfs.new zpool.new or whatever). One idea i’ve had is to move the zfs and zpool commands to /libexec and make /sbin/zfs and /sbin/zpool a switcher script, that will call the base or ports version based on a config file (or just based on if the port is installed)</li>
<li>For testing purposes, generally you should be fine as long as you don’t run ‘zpool upgrade’, which will make your pool only importable using the newer ZFS.</li>
<li>For extra safety, you can create a ‘zpool checkpoint’, which will allow you to undo any changes that are made to the pool during your testing with the new openzfs tools. Note: the checkpoint will undo EVERYTHING. So don’t save new data you want to keep.</li>
<li>Note: Checkpoints disable all freeing operations, to prevent any data from being overwritten so that you can re-import at the checkpoint and undo any operation (including zfs destroy-ing a dataset), so also be careful you don’t run out of space during testing.</li>
<li>Please test and provide feedback.</li>
</ul>

<hr>

<h3><a href="https://www.unitedbsd.com/d/63-how-to-use-blacklistd8-with-npf-as-a-fail2ban-replacement" rel="nofollow">How to use blacklistd(8) with NPF as a fail2ban replacement</a></h3>

<ul>
<li>About blacklistd(8)</li>
</ul>

<blockquote>
<p>blacklistd(8) provides an API that can be used by network daemons to communicate with a packet filter via a daemon to enforce opening and closing ports dynamically based on policy.<br>
The interface to the packet filter is in /libexec/blacklistd-helper (this is currently designed for npf) and the configuration file (inspired from inetd.conf) is in etc/blacklistd.conf<br>
Now, blacklistd(8) will require bpfjit(4) (Just-In-Time compiler for Berkeley Packet Filter) in order to properly work, in addition to, naturally, npf(7) as frontend and syslogd(8), as a backend to print diagnostic messages. Also remember npf shall rely on the npflog* virtual network interface to provide logging for tcpdump() to use. <br>
Unfortunately (dont&#39; ask me why :P) in 8.1 all the required kernel components are still not compiled by default in the GENERIC kernel (though they are in HEAD), and are rather provided as modules. Enabling NPF and blacklistd services would normally result in them being automatically loaded as root, but predictably on securelevel=1 this is not going to happen</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/zfsonlinux/zfs/pull/8853" rel="nofollow">[WIP] raidz expansion, alpha preview 1</a></h3>

<ul>
<li>Motivation and Context
&gt; This is a alpha-quality preview of RAID-Z expansion. This feature allows disks to be added one at a time to a RAID-Z group, expanding its capacity incrementally. This feature is especially useful for small pools (typically with only one RAID-Z group), where there isn&#39;t sufficient hardware to add capacity by adding a whole new RAID-Z group (typically doubling the number of disks).
&gt; For additional context as well as a design overview, see my short talk from the 2017 OpenZFS Developer Summit: slides video</li>
</ul>

<hr>

<h3><a href="https://medium.com/@MartinCracauer/bug-rant-running-audio-vu-meter-increases-my-co2-footprint-871d5c1bee5a" rel="nofollow">Rant: running audio VU-meter increases my CO2 footprint</a></h3>

<blockquote>
<p>A couple months ago I noticed that the monitor on my workstation never power off anymore. Screensaver would go on, but DPMs (to do the poweroff) never kicked in.<br>
I grovels the output of various tools that display DPMS settings, which as usual in Xorg were useless. Everybody said DPMS is on with a timeout. I even wrote my own C program to use every available Xlib API call and even the xscreensaver library calls. (should make it available) No go, everybody says that DPMs is on, enabled and set on a timeout. Didn’t matter whether I let xscreeensaver do the job or just the X11 server.<br>
After a while I noticed that DPMS actually worked between starting my X11 server and starting all my clients. I have a minimal .xinitrc and start the actual session from a script, that is how I could notice. If I used a regular desktop login I wouldn’t have noticed. A server state bug was much more likely than a client bug.</p>

<ul>
<li>See the article for the rest...</li>
</ul>
</blockquote>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/xsave_and_compat32_kernel_work" rel="nofollow">XSAVE and compat32 kernel work for LLDB</a></h3>

<blockquote>
<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.<br>
In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and lately extending NetBSD&#39;s ptrace interface to cover more register types. You can read more about that in my Apr 2019 report.<br>
In May, I was primarily continuing the work on new ptrace interface. Besides that, I&#39;ve found and fixed a bug in ptrace() compat32 code, pushed LLVM buildbot to ‘green’ status and found some upstream LLVM regressions. More below.</p>
</blockquote>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ModernXAppIcons" rel="nofollow">Some things about where icons for modern X applications come from</a></h3>

<blockquote>
<p>If you have a traditional window manager like fvwm, one of the things it can do is iconify X windows so that they turn into icons on the root window (which would often be called the &#39;desktop&#39;). Even modern desktop environments that don&#39;t iconify programs to the root window (or their desktop) may have per-program icons for running programs in their dock or taskbar. If your window manager or desktop environment can do this, you might reasonably wonder where those icons come from by default.<br>
Although I don&#39;t know how it was done in the early days of X, the modern standard for this is part of the Extended Window Manager Hints. In EWMH, applications give the window manager a number of possible icons, generally in different sizes, as ARGB bitmaps (instead of, say, SVG format). The window manager or desktop environment can then pick whichever icon size it likes best, taking into account things like the display resolution and so on, and display it however it wants to (in its original size or scaled up or down).<br>
How this is communicated in specific is through the only good interprocess communication method that X supplies, namely X properties. In the specific case of icons, the _NET_WM_ICON property is what is used, and xprop can display the size information and an ASCII art summary of what each icon looks like. It&#39;s also possible to use some additional magic to read out the raw data from _NET_WM_ICON in a useful format; see, for example, this Stackoverflow question and its answers.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article;sid=20190605110020" rel="nofollow">Recent Security Innovations</a></li>
<li><a href="https://imgur.com/a/HbSYtQI" rel="nofollow">Old Unix books + Solaris</a></li>
<li><a href="https://bitcannon.net/post/pro-desktop/" rel="nofollow">Pro-Desktop - A Tiling Desktop Environment</a></li>
<li><a href="https://blog.extracheese.org/2010/05/the-tar-pipe.html" rel="nofollow">The Tar Pipe</a></li>
<li><a href="https://www.hillelwayne.com/post/intermediate-vim/" rel="nofollow">At least one vim trick you might not know</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Johnny - <a href="http://dpaste.com/0ZQCQ8Y#wrap" rel="nofollow">listener feedback</a></li>
<li>Brian - <a href="http://dpaste.com/1843RNX#wrap" rel="nofollow">Questions</a></li>
<li>Mark - <a href="http://dpaste.com/3M83X9G#wrap" rel="nofollow">ZFS Question</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0303.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>302: Contention Reduction</title>
  <link>https://www.bsdnow.tv/302</link>
  <guid isPermaLink="false">42938801-0d4a-4cf9-a297-c1eeddac85dc</guid>
  <pubDate>Wed, 12 Jun 2019 23:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/42938801-0d4a-4cf9-a297-c1eeddac85dc.mp3" length="50043425" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>DragonFlyBSD's kernel optimizations pay off, differences between OpenBSD and Linux, NetBSD 2019 Google Summer of Code project list, Reducing that contention, fnaify 1.3 released, vmctl(8): CLI syntax changes, and things that Linux distributions should not do when packaging.</itunes:subtitle>
  <itunes:duration>1:09:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>DragonFlyBSD's kernel optimizations pay off, differences between OpenBSD and Linux, NetBSD 2019 Google Summer of Code project list, Reducing that contention, fnaify 1.3 released, vmctl(8): CLI syntax changes, and things that Linux distributions should not do when packaging.
Headlines
DragonFlyBSD's Kernel Optimizations Are Paying Off (https://www.phoronix.com/scan.php?page=article&amp;amp;item=dragonfly-55-threadripper&amp;amp;num=1)
DragonFlyBSD lead developer Matthew Dillon has been working on a big VM rework in the name of performance and other kernel improvements recently. Here is a look at how those DragonFlyBSD 5.5-DEVELOPMENT improvements are paying off compared to DragonFlyBSD 5.4 as well as FreeBSD 12 and five Linux distribution releases. With Dillon using an AMD Ryzen Threadripper system, we used that too for this round of BSD vs. Linux performance benchmarks.
The work by Dillon on the VM overhaul and other changes (including more HAMMER2 file-system work) will ultimately culminate with the DragonFlyBSD 5.6 release (well, unless he opts for DragonFlyBSD 6.0 or so). These are benchmarks of the latest DragonFlyBSD 5.5-DEVELOPMENT daily ISO as of this week benchmarked across DragonFlyBSD 5.4.3 stable, FreeBSD 12.0, Ubuntu 19.04, Red Hat Enterprise Linux 8.0, Debian 9.9, Debian Buster, and CentOS 7 1810 as a wide variety of reference points both from newer and older Linux distributions. (As for no Clear Linux reference point for a speedy reference point, it currently has a regression with AMD + Samsung NVMe SSD support on some hardware, including this box, prohibiting the drive from coming up due to a presumed power management issue that is still being resolved.)
With Matthew Dillon doing much of his development on an AMD Ryzen Threadripper system after he last year proclaimed the greatness of these AMD HEDT CPUs, for this round of testing I also used a Ryzen Threadripper 2990WX with 32 cores / 64 threads. Tests of other AMD/Intel hardware with DragonFlyBSD will come as the next stable release is near and all of the kernel work has settled down. For now it's mostly entertaining our own curiosity how well these DragonFlyBSD optimizations are paying off and how it's increasing the competition against FreeBSD 12 and Linux distributions.
What are the differences between OpenBSD and Linux? (https://cfenollosa.com/blog/what-are-the-differences-between-openbsd-and-linux.html)
Maybe you have been reading recently about the release of OpenBSD 6.5 and wonder, "What are the differences between Linux and OpenBSD?"
I've also been there at some point in the past and these are my conclusions.
They also apply, to some extent, to other BSDs. However, an important disclaimer applies to this article.
This list is aimed at people who are used to Linux and are curious about OpenBSD. It is written to highlight the most important changes from their perspective, not the absolute most important changes from a technical standpoint.
Please bear with me.
A terminal is a terminal is a terminal
Practical differences
Security and system administration
Why philosophical differences matter
So what do I choose?
How to try OpenBSD
***
News Roundup
NetBSD 2019 Google Summer of Code (http://blog.netbsd.org/tnf/entry/announcing_google_summer_of_code1)
We are very happy to announce The NetBSD Foundation Google Summer of Code 2019 projects:
Akul Abhilash Pillai - Adapting TriforceAFL for NetBSD kernel fuzzing
Manikishan Ghantasala - Add KNF (NetBSD style) clang-format configuration
Siddharth Muralee - Enhancing Syzkaller support for NetBSD
Surya P - Implementation of COMPATLINUX and COMPATNETBSD32 DRM ioctls support for NetBSD kernel
Jason High - Incorporation of Argon2 Password Hashing Algorithm into NetBSD
Saurav Prakash - Porting NetBSD to HummingBoard Pulse
Naveen Narayanan - Porting WINE to amd64 architecture on NetBSD
The communiting bonding period - where students get in touch with mentors and community - started yesterday. The coding period will start from May 27 until August 19.
Please welcome all our students and a big good luck to students and mentors! A big thank to Google and The NetBSD Foundation organization mentors and administrators! Looking forward to a great Google Summer of Code!
Reducing that contention (http://www.grenadille.net/post/2019/05/09/Reducing-that-contention)
The opening keynote at EuroBSDCon 2016 predicted the future 10 years of BSDs. Amongst all the funny previsions, gnn@FreeBSD said that by 2026 OpenBSD will have its first implementation of SMP. Almost 3 years after this talk, that sounds like a plausible forecast... Why? Where are we? What can we do? Let's dive into the issue!
State of affairs
Most of OpenBSD's kernel still runs under a single lock, ze KERNEL_LOCK(). That includes most of the syscalls, most of the interrupt handlers and most of the fault handlers. Most of them, not all of them. Meaning we have collected &amp;amp; fixed bugs while setting up infrastructures and examples. Now this lock remains the principal responsible for the spin % you can observe in top(1) and systat(1).
I believe that we opted for a difficult hike when we decided to start removing this lock from the bottom. As a result many SCSI &amp;amp; Network interrupt handlers as well as all Audio &amp;amp; USB ones can be executed without big lock. On the other hand very few syscalls are already or almost ready to be unlocked, as we incorrectly say. This explains why basic primitives like tsleep(9), csignal() and selwakeup() are only receiving attention now that the top of the Network Stack is running (mostly) without big lock.
Next steps
In the past years, most of our efforts have been invested into the Network Stack. As I already mentioned it should be ready to be parallelized. However think we should now concentrate on removing the KERNEL_LOCK(), even if the code paths aren't performance critical. 
See the Article for the rest of the post
fnaify 1.3 released - more games are "fnaify &amp;amp; run" now (https://www.reddit.com/r/openbsd_gaming/comments/btste9/fnaify_13_released_more_games_are_fnaify_run_now/)
This release finally addresses some of the problems that prevent simple running of several games.
This happens for example when an old FNA.dll library comes with the games that doesn't match the API of our native libraries like SDL2, OpenAL, or MojoShader anymore. Some of those cases can be fixed by simply dropping in a newer FNA.dll. fnaify now asks if FNA 17.12 should be automatically added if a known incompatible FNA version is found. You simply answer yes or no. 
Another blocker happens when the game expects to check the SteamAPI - either from a running Steam process, or a bundled steam_api library. OpenBSD 6.5-current now has steamworks-nosteam in ports, a stub library for Steamworks.NET that prevents games from crashing simply because an API function isn't found. The repo is here. fnaify now finds this library in /usr/local/share/steamstubs and uses it instead of the bundled (full) Steamworks.NET.dll.
This may help with any games that use this layer to interact with the SteamAPI, mostly those that can only be obtained via Steam. 
vmctl(8): command line syntax changed (https://www.openbsd.org/faq/current.html#r20190529)
The order of the arguments in the create, start, and stop commands of vmctl(8) has been changed to match a commonly expected style. Manual usage or scripting with vmctl must be adjusted to use the new syntax. 
For example, the old syntax looked like this:
# vmctl create disk.qcow2 -s 50G
The new syntax specifies the command options before the argument:
# vmctl create -s 50G disk.qcow2
Something that Linux distributions should not do when packaging things (https://utcc.utoronto.ca/~cks/space/blog/linux/PackageNameClashProblem)
Right now I am a bit unhappy at Fedora for a specific packaging situation, so let me tell you a little story of what I, as a system administrator, would really like distributions to not do.
For reasons beyond the scope of this blog entry, I run a Prometheus and Grafana setup on both my home and office Fedora Linux machines (among other things, it gives me a place to test out various things involving them). When I set this up, I used the official upstream versions of both, because I needed to match what we are running (or would soon be).
Recently, Fedora decided to package Grafana themselves (as a RPM), and they called this RPM package 'grafana'. Since the two different packages are different versions of the same thing as far as package management tools are concerned, Fedora basically took over the 'grafana' package name from Grafana. This caused my systems to offer to upgrade me from the Grafana.com 'grafana-6.1.5-1' package to the Fedora 'grafana-6.1.6-1.fc29' one, which I actually did after taking reasonable steps to make sure that the Fedora version of 6.1.6 was compatible with the file layouts and so on from the Grafana version of 6.1.5.
Why is this a problem? It's simple. If you're going to take over a package name from the upstream, you should keep up with the upstream releases. If you take over a package name and don't keep up to date or keep up to date only sporadically, you cause all sorts of heartburn for system administrators who use the package. The least annoying future of this situation is that Fedora has abandoned Grafana at 6.1.6 and I am going to 'upgrade' it with the upstream 6.2.1, which will hopefully be a transparent replacement and not blow up in my face. The most annoying future is that Fedora and Grafana keep ping-ponging versions back and forth, which will make 'dnf upgrade' into a minefield (because it will frequently try to give me a 'grafana' upgrade that I don't want and that would be dangerous to accept). And of course this situation turns Fedora version upgrades into their own minefield, since now I risk an upgrade to Fedora 30 actually reverting the 'grafana' package version on me.
Beastie Bits
[talk] ZFS v UFS on APU2 msata SSD with FreeBSD (http://lists.nycbug.org:8080/pipermail/talk/2019-May/017885.html)
NetBSD 8.1 is out (http://www.netbsd.org/releases/formal-8/NetBSD-8.1.html)
lazyboi – the laziest possible way to send raw HTTP POST data (https://github.com/ctsrc/lazyboi)
A Keyboard layout that changes by markov frequency (https://github.com/shapr/markovkeyboard)
Open Source Game Clones (https://osgameclones.com/)
EuroBSDcon program &amp;amp; registration open (https://eurobsdcon.org)
***
Feedback/Questions
John - A segment idea (http://dpaste.com/3YTBQTX#wrap)
Johnny - Audio only format please don't (http://dpaste.com/3WD0A25#wrap)
Alex - Thanks and some Linux Snaps vs PBI feedback (http://dpaste.com/1RQF4QM#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <content:encoded>
    <![CDATA[<p>DragonFlyBSD&#39;s kernel optimizations pay off, differences between OpenBSD and Linux, NetBSD 2019 Google Summer of Code project list, Reducing that contention, fnaify 1.3 released, vmctl(8): CLI syntax changes, and things that Linux distributions should not do when packaging.</p>

<h2>Headlines</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=article&item=dragonfly-55-threadripper&num=1" rel="nofollow">DragonFlyBSD&#39;s Kernel Optimizations Are Paying Off</a></h3>

<blockquote>
<p>DragonFlyBSD lead developer Matthew Dillon has been working on a big VM rework in the name of performance and other kernel improvements recently. Here is a look at how those DragonFlyBSD 5.5-DEVELOPMENT improvements are paying off compared to DragonFlyBSD 5.4 as well as FreeBSD 12 and five Linux distribution releases. With Dillon using an AMD Ryzen Threadripper system, we used that too for this round of BSD vs. Linux performance benchmarks.<br>
The work by Dillon on the VM overhaul and other changes (including more HAMMER2 file-system work) will ultimately culminate with the DragonFlyBSD 5.6 release (well, unless he opts for DragonFlyBSD 6.0 or so). These are benchmarks of the latest DragonFlyBSD 5.5-DEVELOPMENT daily ISO as of this week benchmarked across DragonFlyBSD 5.4.3 stable, FreeBSD 12.0, Ubuntu 19.04, Red Hat Enterprise Linux 8.0, Debian 9.9, Debian Buster, and CentOS 7 1810 as a wide variety of reference points both from newer and older Linux distributions. (As for no Clear Linux reference point for a speedy reference point, it currently has a regression with AMD + Samsung NVMe SSD support on some hardware, including this box, prohibiting the drive from coming up due to a presumed power management issue that is still being resolved.)<br>
With Matthew Dillon doing much of his development on an AMD Ryzen Threadripper system after he last year proclaimed the greatness of these AMD HEDT CPUs, for this round of testing I also used a Ryzen Threadripper 2990WX with 32 cores / 64 threads. Tests of other AMD/Intel hardware with DragonFlyBSD will come as the next stable release is near and all of the kernel work has settled down. For now it&#39;s mostly entertaining our own curiosity how well these DragonFlyBSD optimizations are paying off and how it&#39;s increasing the competition against FreeBSD 12 and Linux distributions.</p>

<hr>
</blockquote>

<h3><a href="https://cfenollosa.com/blog/what-are-the-differences-between-openbsd-and-linux.html" rel="nofollow">What are the differences between OpenBSD and Linux?</a></h3>

<blockquote>
<p>Maybe you have been reading recently about the release of OpenBSD 6.5 and wonder, &quot;What are the differences between Linux and OpenBSD?&quot;<br>
I&#39;ve also been there at some point in the past and these are my conclusions.<br>
They also apply, to some extent, to other BSDs. However, an important disclaimer applies to this article.<br>
This list is aimed at people who are used to Linux and are curious about OpenBSD. It is written to highlight the most important changes from their perspective, not the absolute most important changes from a technical standpoint.<br>
Please bear with me.</p>
</blockquote>

<ul>
<li>A terminal is a terminal is a terminal</li>
<li>Practical differences</li>
<li>Security and system administration</li>
<li>Why philosophical differences matter</li>
<li>So what do I choose?</li>
<li>How to try OpenBSD
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/announcing_google_summer_of_code1" rel="nofollow">NetBSD 2019 Google Summer of Code</a></h3>

<blockquote>
<p>We are very happy to announce The NetBSD Foundation Google Summer of Code 2019 projects:</p>
</blockquote>

<ul>
<li>Akul Abhilash Pillai - Adapting TriforceAFL for NetBSD kernel fuzzing</li>
<li>Manikishan Ghantasala - Add KNF (NetBSD style) clang-format configuration</li>
<li>Siddharth Muralee - Enhancing Syzkaller support for NetBSD</li>
<li>Surya P - Implementation of COMPAT_LINUX and COMPAT_NETBSD32 DRM ioctls support for NetBSD kernel</li>
<li>Jason High - Incorporation of Argon2 Password Hashing Algorithm into NetBSD</li>
<li>Saurav Prakash - Porting NetBSD to HummingBoard Pulse</li>
<li>Naveen Narayanan - Porting WINE to amd64 architecture on NetBSD</li>
</ul>

<blockquote>
<p>The communiting bonding period - where students get in touch with mentors and community - started yesterday. The coding period will start from May 27 until August 19.<br>
Please welcome all our students and a big good luck to students and mentors! A big thank to Google and The NetBSD Foundation organization mentors and administrators! Looking forward to a great Google Summer of Code!</p>
</blockquote>

<hr>

<h3><a href="http://www.grenadille.net/post/2019/05/09/Reducing-that-contention" rel="nofollow">Reducing that contention</a></h3>

<blockquote>
<p>The opening keynote at EuroBSDCon 2016 predicted the future 10 years of BSDs. Amongst all the funny previsions, gnn@FreeBSD said that by 2026 OpenBSD will have its first implementation of SMP. Almost 3 years after this talk, that sounds like a plausible forecast... Why? Where are we? What can we do? Let&#39;s dive into the issue!</p>
</blockquote>

<ul>
<li>State of affairs</li>
</ul>

<blockquote>
<p>Most of OpenBSD&#39;s kernel still runs under a single lock, ze KERNEL_LOCK(). That includes most of the syscalls, most of the interrupt handlers and most of the fault handlers. Most of them, not all of them. Meaning we have collected &amp; fixed bugs while setting up infrastructures and examples. Now this lock remains the principal responsible for the spin % you can observe in top(1) and systat(1).<br>
I believe that we opted for a difficult hike when we decided to start removing this lock from the bottom. As a result many SCSI &amp; Network interrupt handlers as well as all Audio &amp; USB ones can be executed without big lock. On the other hand very few syscalls are already or almost ready to be unlocked, as we incorrectly say. This explains why basic primitives like tsleep(9), csignal() and selwakeup() are only receiving attention now that the top of the Network Stack is running (mostly) without big lock.</p>
</blockquote>

<ul>
<li>Next steps</li>
</ul>

<blockquote>
<p>In the past years, most of our efforts have been invested into the Network Stack. As I already mentioned it should be ready to be parallelized. However think we should now concentrate on removing the KERNEL_LOCK(), even if the code paths aren&#39;t performance critical. </p>
</blockquote>

<ul>
<li>See the Article for the rest of the post</li>
</ul>

<hr>

<h3><a href="https://www.reddit.com/r/openbsd_gaming/comments/btste9/fnaify_13_released_more_games_are_fnaify_run_now/" rel="nofollow">fnaify 1.3 released - more games are &quot;fnaify &amp; run&quot; now</a></h3>

<blockquote>
<p>This release finally addresses some of the problems that prevent simple running of several games.<br>
This happens for example when an old FNA.dll library comes with the games that doesn&#39;t match the API of our native libraries like SDL2, OpenAL, or MojoShader anymore. Some of those cases can be fixed by simply dropping in a newer FNA.dll. fnaify now asks if FNA 17.12 should be automatically added if a known incompatible FNA version is found. You simply answer yes or no. </p>

<p>Another blocker happens when the game expects to check the SteamAPI - either from a running Steam process, or a bundled steam_api library. OpenBSD 6.5-current now has steamworks-nosteam in ports, a stub library for Steamworks.NET that prevents games from crashing simply because an API function isn&#39;t found. The repo is here. fnaify now finds this library in /usr/local/share/steamstubs and uses it instead of the bundled (full) Steamworks.NET.dll.<br>
This may help with any games that use this layer to interact with the SteamAPI, mostly those that can only be obtained via Steam. </p>
</blockquote>

<h3><a href="https://www.openbsd.org/faq/current.html#r20190529" rel="nofollow">vmctl(8): command line syntax changed</a></h3>

<blockquote>
<p>The order of the arguments in the create, start, and stop commands of vmctl(8) has been changed to match a commonly expected style. Manual usage or scripting with vmctl must be adjusted to use the new syntax. <br>
For example, the old syntax looked like this:</p>
</blockquote>

<p><code># vmctl create disk.qcow2 -s 50G</code></p>

<blockquote>
<p>The new syntax specifies the command options before the argument:</p>
</blockquote>

<p><code># vmctl create -s 50G disk.qcow2</code></p>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/PackageNameClashProblem" rel="nofollow">Something that Linux distributions should not do when packaging things</a></h3>

<blockquote>
<p>Right now I am a bit unhappy at Fedora for a specific packaging situation, so let me tell you a little story of what I, as a system administrator, would really like distributions to not do.<br>
For reasons beyond the scope of this blog entry, I run a Prometheus and Grafana setup on both my home and office Fedora Linux machines (among other things, it gives me a place to test out various things involving them). When I set this up, I used the official upstream versions of both, because I needed to match what we are running (or would soon be).<br>
Recently, Fedora decided to package Grafana themselves (as a RPM), and they called this RPM package &#39;grafana&#39;. Since the two different packages are different versions of the same thing as far as package management tools are concerned, Fedora basically took over the &#39;grafana&#39; package name from Grafana. This caused my systems to offer to upgrade me from the Grafana.com &#39;grafana-6.1.5-1&#39; package to the Fedora &#39;grafana-6.1.6-1.fc29&#39; one, which I actually did after taking reasonable steps to make sure that the Fedora version of 6.1.6 was compatible with the file layouts and so on from the Grafana version of 6.1.5.<br>
Why is this a problem? It&#39;s simple. If you&#39;re going to take over a package name from the upstream, you should keep up with the upstream releases. If you take over a package name and don&#39;t keep up to date or keep up to date only sporadically, you cause all sorts of heartburn for system administrators who use the package. The least annoying future of this situation is that Fedora has abandoned Grafana at 6.1.6 and I am going to &#39;upgrade&#39; it with the upstream 6.2.1, which will hopefully be a transparent replacement and not blow up in my face. The most annoying future is that Fedora and Grafana keep ping-ponging versions back and forth, which will make &#39;dnf upgrade&#39; into a minefield (because it will frequently try to give me a &#39;grafana&#39; upgrade that I don&#39;t want and that would be dangerous to accept). And of course this situation turns Fedora version upgrades into their own minefield, since now I risk an upgrade to Fedora 30 actually reverting the &#39;grafana&#39; package version on me.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.nycbug.org:8080/pipermail/talk/2019-May/017885.html" rel="nofollow">[talk] ZFS v UFS on APU2 msata SSD with FreeBSD</a></li>
<li><a href="http://www.netbsd.org/releases/formal-8/NetBSD-8.1.html" rel="nofollow">NetBSD 8.1 is out</a></li>
<li><a href="https://github.com/ctsrc/lazyboi" rel="nofollow">lazyboi – the laziest possible way to send raw HTTP POST data</a></li>
<li><a href="https://github.com/shapr/markovkeyboard" rel="nofollow">A Keyboard layout that changes by markov frequency</a></li>
<li><a href="https://osgameclones.com/" rel="nofollow">Open Source Game Clones</a></li>
<li><a href="https://eurobsdcon.org" rel="nofollow">EuroBSDcon program &amp; registration open</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>John - <a href="http://dpaste.com/3YTBQTX#wrap" rel="nofollow">A segment idea</a></li>
<li>Johnny - <a href="http://dpaste.com/3WD0A25#wrap" rel="nofollow">Audio only format please don&#39;t</a></li>
<li>Alex - <a href="http://dpaste.com/1RQF4QM#wrap" rel="nofollow">Thanks and some Linux Snaps vs PBI feedback</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0302.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>DragonFlyBSD&#39;s kernel optimizations pay off, differences between OpenBSD and Linux, NetBSD 2019 Google Summer of Code project list, Reducing that contention, fnaify 1.3 released, vmctl(8): CLI syntax changes, and things that Linux distributions should not do when packaging.</p>

<h2>Headlines</h2>

<h3><a href="https://www.phoronix.com/scan.php?page=article&item=dragonfly-55-threadripper&num=1" rel="nofollow">DragonFlyBSD&#39;s Kernel Optimizations Are Paying Off</a></h3>

<blockquote>
<p>DragonFlyBSD lead developer Matthew Dillon has been working on a big VM rework in the name of performance and other kernel improvements recently. Here is a look at how those DragonFlyBSD 5.5-DEVELOPMENT improvements are paying off compared to DragonFlyBSD 5.4 as well as FreeBSD 12 and five Linux distribution releases. With Dillon using an AMD Ryzen Threadripper system, we used that too for this round of BSD vs. Linux performance benchmarks.<br>
The work by Dillon on the VM overhaul and other changes (including more HAMMER2 file-system work) will ultimately culminate with the DragonFlyBSD 5.6 release (well, unless he opts for DragonFlyBSD 6.0 or so). These are benchmarks of the latest DragonFlyBSD 5.5-DEVELOPMENT daily ISO as of this week benchmarked across DragonFlyBSD 5.4.3 stable, FreeBSD 12.0, Ubuntu 19.04, Red Hat Enterprise Linux 8.0, Debian 9.9, Debian Buster, and CentOS 7 1810 as a wide variety of reference points both from newer and older Linux distributions. (As for no Clear Linux reference point for a speedy reference point, it currently has a regression with AMD + Samsung NVMe SSD support on some hardware, including this box, prohibiting the drive from coming up due to a presumed power management issue that is still being resolved.)<br>
With Matthew Dillon doing much of his development on an AMD Ryzen Threadripper system after he last year proclaimed the greatness of these AMD HEDT CPUs, for this round of testing I also used a Ryzen Threadripper 2990WX with 32 cores / 64 threads. Tests of other AMD/Intel hardware with DragonFlyBSD will come as the next stable release is near and all of the kernel work has settled down. For now it&#39;s mostly entertaining our own curiosity how well these DragonFlyBSD optimizations are paying off and how it&#39;s increasing the competition against FreeBSD 12 and Linux distributions.</p>

<hr>
</blockquote>

<h3><a href="https://cfenollosa.com/blog/what-are-the-differences-between-openbsd-and-linux.html" rel="nofollow">What are the differences between OpenBSD and Linux?</a></h3>

<blockquote>
<p>Maybe you have been reading recently about the release of OpenBSD 6.5 and wonder, &quot;What are the differences between Linux and OpenBSD?&quot;<br>
I&#39;ve also been there at some point in the past and these are my conclusions.<br>
They also apply, to some extent, to other BSDs. However, an important disclaimer applies to this article.<br>
This list is aimed at people who are used to Linux and are curious about OpenBSD. It is written to highlight the most important changes from their perspective, not the absolute most important changes from a technical standpoint.<br>
Please bear with me.</p>
</blockquote>

<ul>
<li>A terminal is a terminal is a terminal</li>
<li>Practical differences</li>
<li>Security and system administration</li>
<li>Why philosophical differences matter</li>
<li>So what do I choose?</li>
<li>How to try OpenBSD
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/announcing_google_summer_of_code1" rel="nofollow">NetBSD 2019 Google Summer of Code</a></h3>

<blockquote>
<p>We are very happy to announce The NetBSD Foundation Google Summer of Code 2019 projects:</p>
</blockquote>

<ul>
<li>Akul Abhilash Pillai - Adapting TriforceAFL for NetBSD kernel fuzzing</li>
<li>Manikishan Ghantasala - Add KNF (NetBSD style) clang-format configuration</li>
<li>Siddharth Muralee - Enhancing Syzkaller support for NetBSD</li>
<li>Surya P - Implementation of COMPAT_LINUX and COMPAT_NETBSD32 DRM ioctls support for NetBSD kernel</li>
<li>Jason High - Incorporation of Argon2 Password Hashing Algorithm into NetBSD</li>
<li>Saurav Prakash - Porting NetBSD to HummingBoard Pulse</li>
<li>Naveen Narayanan - Porting WINE to amd64 architecture on NetBSD</li>
</ul>

<blockquote>
<p>The communiting bonding period - where students get in touch with mentors and community - started yesterday. The coding period will start from May 27 until August 19.<br>
Please welcome all our students and a big good luck to students and mentors! A big thank to Google and The NetBSD Foundation organization mentors and administrators! Looking forward to a great Google Summer of Code!</p>
</blockquote>

<hr>

<h3><a href="http://www.grenadille.net/post/2019/05/09/Reducing-that-contention" rel="nofollow">Reducing that contention</a></h3>

<blockquote>
<p>The opening keynote at EuroBSDCon 2016 predicted the future 10 years of BSDs. Amongst all the funny previsions, gnn@FreeBSD said that by 2026 OpenBSD will have its first implementation of SMP. Almost 3 years after this talk, that sounds like a plausible forecast... Why? Where are we? What can we do? Let&#39;s dive into the issue!</p>
</blockquote>

<ul>
<li>State of affairs</li>
</ul>

<blockquote>
<p>Most of OpenBSD&#39;s kernel still runs under a single lock, ze KERNEL_LOCK(). That includes most of the syscalls, most of the interrupt handlers and most of the fault handlers. Most of them, not all of them. Meaning we have collected &amp; fixed bugs while setting up infrastructures and examples. Now this lock remains the principal responsible for the spin % you can observe in top(1) and systat(1).<br>
I believe that we opted for a difficult hike when we decided to start removing this lock from the bottom. As a result many SCSI &amp; Network interrupt handlers as well as all Audio &amp; USB ones can be executed without big lock. On the other hand very few syscalls are already or almost ready to be unlocked, as we incorrectly say. This explains why basic primitives like tsleep(9), csignal() and selwakeup() are only receiving attention now that the top of the Network Stack is running (mostly) without big lock.</p>
</blockquote>

<ul>
<li>Next steps</li>
</ul>

<blockquote>
<p>In the past years, most of our efforts have been invested into the Network Stack. As I already mentioned it should be ready to be parallelized. However think we should now concentrate on removing the KERNEL_LOCK(), even if the code paths aren&#39;t performance critical. </p>
</blockquote>

<ul>
<li>See the Article for the rest of the post</li>
</ul>

<hr>

<h3><a href="https://www.reddit.com/r/openbsd_gaming/comments/btste9/fnaify_13_released_more_games_are_fnaify_run_now/" rel="nofollow">fnaify 1.3 released - more games are &quot;fnaify &amp; run&quot; now</a></h3>

<blockquote>
<p>This release finally addresses some of the problems that prevent simple running of several games.<br>
This happens for example when an old FNA.dll library comes with the games that doesn&#39;t match the API of our native libraries like SDL2, OpenAL, or MojoShader anymore. Some of those cases can be fixed by simply dropping in a newer FNA.dll. fnaify now asks if FNA 17.12 should be automatically added if a known incompatible FNA version is found. You simply answer yes or no. </p>

<p>Another blocker happens when the game expects to check the SteamAPI - either from a running Steam process, or a bundled steam_api library. OpenBSD 6.5-current now has steamworks-nosteam in ports, a stub library for Steamworks.NET that prevents games from crashing simply because an API function isn&#39;t found. The repo is here. fnaify now finds this library in /usr/local/share/steamstubs and uses it instead of the bundled (full) Steamworks.NET.dll.<br>
This may help with any games that use this layer to interact with the SteamAPI, mostly those that can only be obtained via Steam. </p>
</blockquote>

<h3><a href="https://www.openbsd.org/faq/current.html#r20190529" rel="nofollow">vmctl(8): command line syntax changed</a></h3>

<blockquote>
<p>The order of the arguments in the create, start, and stop commands of vmctl(8) has been changed to match a commonly expected style. Manual usage or scripting with vmctl must be adjusted to use the new syntax. <br>
For example, the old syntax looked like this:</p>
</blockquote>

<p><code># vmctl create disk.qcow2 -s 50G</code></p>

<blockquote>
<p>The new syntax specifies the command options before the argument:</p>
</blockquote>

<p><code># vmctl create -s 50G disk.qcow2</code></p>

<hr>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/PackageNameClashProblem" rel="nofollow">Something that Linux distributions should not do when packaging things</a></h3>

<blockquote>
<p>Right now I am a bit unhappy at Fedora for a specific packaging situation, so let me tell you a little story of what I, as a system administrator, would really like distributions to not do.<br>
For reasons beyond the scope of this blog entry, I run a Prometheus and Grafana setup on both my home and office Fedora Linux machines (among other things, it gives me a place to test out various things involving them). When I set this up, I used the official upstream versions of both, because I needed to match what we are running (or would soon be).<br>
Recently, Fedora decided to package Grafana themselves (as a RPM), and they called this RPM package &#39;grafana&#39;. Since the two different packages are different versions of the same thing as far as package management tools are concerned, Fedora basically took over the &#39;grafana&#39; package name from Grafana. This caused my systems to offer to upgrade me from the Grafana.com &#39;grafana-6.1.5-1&#39; package to the Fedora &#39;grafana-6.1.6-1.fc29&#39; one, which I actually did after taking reasonable steps to make sure that the Fedora version of 6.1.6 was compatible with the file layouts and so on from the Grafana version of 6.1.5.<br>
Why is this a problem? It&#39;s simple. If you&#39;re going to take over a package name from the upstream, you should keep up with the upstream releases. If you take over a package name and don&#39;t keep up to date or keep up to date only sporadically, you cause all sorts of heartburn for system administrators who use the package. The least annoying future of this situation is that Fedora has abandoned Grafana at 6.1.6 and I am going to &#39;upgrade&#39; it with the upstream 6.2.1, which will hopefully be a transparent replacement and not blow up in my face. The most annoying future is that Fedora and Grafana keep ping-ponging versions back and forth, which will make &#39;dnf upgrade&#39; into a minefield (because it will frequently try to give me a &#39;grafana&#39; upgrade that I don&#39;t want and that would be dangerous to accept). And of course this situation turns Fedora version upgrades into their own minefield, since now I risk an upgrade to Fedora 30 actually reverting the &#39;grafana&#39; package version on me.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.nycbug.org:8080/pipermail/talk/2019-May/017885.html" rel="nofollow">[talk] ZFS v UFS on APU2 msata SSD with FreeBSD</a></li>
<li><a href="http://www.netbsd.org/releases/formal-8/NetBSD-8.1.html" rel="nofollow">NetBSD 8.1 is out</a></li>
<li><a href="https://github.com/ctsrc/lazyboi" rel="nofollow">lazyboi – the laziest possible way to send raw HTTP POST data</a></li>
<li><a href="https://github.com/shapr/markovkeyboard" rel="nofollow">A Keyboard layout that changes by markov frequency</a></li>
<li><a href="https://osgameclones.com/" rel="nofollow">Open Source Game Clones</a></li>
<li><a href="https://eurobsdcon.org" rel="nofollow">EuroBSDcon program &amp; registration open</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>John - <a href="http://dpaste.com/3YTBQTX#wrap" rel="nofollow">A segment idea</a></li>
<li>Johnny - <a href="http://dpaste.com/3WD0A25#wrap" rel="nofollow">Audio only format please don&#39;t</a></li>
<li>Alex - <a href="http://dpaste.com/1RQF4QM#wrap" rel="nofollow">Thanks and some Linux Snaps vs PBI feedback</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0302.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>301: GPU Passthrough</title>
  <link>https://www.bsdnow.tv/301</link>
  <guid isPermaLink="false">d11a1228-2ac2-4e13-9d11-7a4c5a2dc0c1</guid>
  <pubDate>Wed, 05 Jun 2019 23:15:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d11a1228-2ac2-4e13-9d11-7a4c5a2dc0c1.mp3" length="32812013" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>GPU passthrough on bhyve, confusion with used/free disk space on ZFS, OmniOS Community Edition, pfSense 2.4.4 Release p3, NetBSD 8.1 RC1, FreeNAS as your Server OS, and more.</itunes:subtitle>
  <itunes:duration>45:34</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>GPU passthrough on bhyve, confusion with used/free disk space on ZFS, OmniOS Community Edition, pfSense 2.4.4 Release p3, NetBSD 8.1 RC1, FreeNAS as your Server OS, and more.
&lt;h2&gt;Headlines&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://passthroughpo.st/gpu-passthrough-reported-working-on-bhyve/"&gt;GPU Passthrough Reported Working on Bhyve&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Normally we cover news focused on KVM and sometimes Xen, but something very special has happened with their younger cousin in the BSD world, Bhyve.
  For those that don’t know, Bhyve (pronounced bee-hive) is the native hypervisor in FreeBSD. It has many powerful features, but one that’s been a pain point for some years now is VGA passthrough. Consumer GPUs have not been useable until very recently despite limited success with enterprise cards.
  However, Twitter user Michael Yuji found a workaround that enables passing through a consumer card to any *nix system configured to use X11:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;https://twitter.com/michael_yuji/status/1127136891365658625&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;All you have to do is add a line pointing the X server to the Bus ID of the passed card and the VM will boot, with acceleration and everything. He theorizes that this may not be possible on windows because of the way it looks for display devices, but it’s a solid start.
  As soon as development surrounding VGA passthrough matures on Bhyve, it will become a very attractive alternative to more common tools like Hyper-V and Qemu, because it makes many powerful features available in the host system like jails, boot environments, BSD networking, and tight ZFS integration. For example, you could potentially run your Router, NAS, preferred workstation OS and any number of other things in one box, and only have to spin up a single VM because of the flexibility afforded by jails over Linux-based containers.
  The user who found this workaround also announced they’d be writing it up at some point, so stay tuned for details on the process.
  It’s been slow going on Bhyve passthrough development for a while, but this new revelation is encouraging. We’ll be closely monitoring the situation and report on any other happenings.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://oshogbo.vexillium.org/blog/65/"&gt;Confusion with used/free disk space in ZFS&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I use ZFS extensively. ZFS is my favorite file system. I write articles and give lectures about it. I work with it every day. In traditional file systems we use df(1) to determine free space on partitions. We can also use du(1) to count the size of the files in the directory. But it’s different on ZFS and this is the most confusing thing EVER. I always forget which tool reports what disk space usage! Every time somebody asks me, I need to google it. For this reason I decided to document it here - for myself - because if I can’t remember it at least I will not need to google it, as it will be on my blog, but maybe you will also benefit from this blog post if you have the same problem or you are starting your journey with ZFS.&lt;/p&gt;
  
  &lt;p&gt;The understanding of how ZFS is uses space and how to determine which value means what is a crucial thing. I hope thanks to this article I will finally remember it!&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://omniosce.org/article/release-030.html"&gt;OmniOS Community Edition&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;The OmniOS Community Edition Association is proud to announce the general availability of OmniOS - r151030.
  OmniOS is published according to a 6-month release cycle, r151030 LTS takes over from r151028, published in November 2018; and since it is a LTS release it also takes over from r151022. The r151030 LTS release will be supported for 3 Years. It is the first LTS release published by the OmniOS CE Association since taking over the reins from OmniTI in 2017. The next LTS release is scheduled for May 2021. The old stable r151026 release is now end-of-life. See the release schedule for further details.
  This is only a small selection of the new features, and bug fixes in the new release; review the release notes for full details.
  If you upgrade from r22 and want to see all new features added since then, make sure to also read the release notes for r24, r26 and r28.
  The OmniOS team and the illumos community have been very active in creating new features and improving existing ones over the last 6 months.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html"&gt;pfSense 2.4.4 Release p3 is available&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;We are pleased to announce the release of pfSense® software version 2.4.4-p3, now available for new installations and upgrades!
  pfSense software version 2.4.4-p3 is a maintenance release, bringing a number of security enhancements as well as a handful of fixes for issues present in the 2.4.4-p2 release.
  pfSense 2.4.4-RELEASE-p3 updates and installation images are available now!
  To see a complete list of changes and find more detail, see the Release Notes.
  We had hoped to bring you this release a few days earlier, but given the announcement last Tuesday of the Intel Microarchitectural Data Sampling (MDS) issue, we did not have sufficient time to fully incorporate those corrections and properly test for release on Thursday. We felt that it was worth delaying for a few days, rather than making multiple releases within a week.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Upgrade Notes&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Due to the significant nature of the changes in 2.4.4 and later, 
  warnings and error messages, particularly from PHP and package updates, are likely to occur during the upgrade process. In nearly all cases these errors are a harmless side effect of the changes between FreeBSD 11.1 and 11.2 and between PHP 5.6 and PHP 7.2.
  Always take a backup of the firewall configuration prior to any major change to the firewall, such as an upgrade.
  Do not update packages before upgrading pfSense! Either remove all packages or do not update packages before running the upgrade.
  The upgrade will take several minutes to complete. The exact time varies based on download speed, hardware speed, and other factors such installed packages. Be patient during the upgrade and allow the firewall enough time to complete the entire process. After the update packages finish downloading it could take 10-20 minutes or more until the upgrade process ends. The firewall may reboot several times during the upgrade process. Monitor the upgrade from the firewall console for the most accurate view.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.netbsd.org/releases/formal-8/NetBSD-8.1.html"&gt;NetBSD 8.1 RC1 is out&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;The NetBSD Project is pleased to announce NetBSD 8.1, the first update of the NetBSD 8 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.&lt;/p&gt;
  
  &lt;p&gt;Some highlights of the 8.1 release are:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;x86: Mitigation for INTEL-SA-00233 (MDS)&lt;/li&gt;

&lt;li&gt;Various local user kernel data leaks fixed.&lt;/li&gt;

&lt;li&gt;x86: new rc.conf(5) setting smtoff to disable Simultaneous Multi-Threading&lt;/li&gt;

&lt;li&gt;Various network driver fixes and improvements.&lt;/li&gt;

&lt;li&gt;Fixes for thread local storage (TLS) in position independent executables (PIE).&lt;/li&gt;

&lt;li&gt;Fixes to reproducible builds.&lt;/li&gt;

&lt;li&gt;Fixed a performance regression in tmpfs.&lt;/li&gt;

&lt;li&gt;DRM/KMS improvements.&lt;/li&gt;

&lt;li&gt;bwfm(4) wireless driver for Broadcom FullMAC PCI and USB devices added.&lt;/li&gt;

&lt;li&gt;Various sh(1) fixes.&lt;/li&gt;

&lt;li&gt;mfii(4) SAS driver added.&lt;/li&gt;

&lt;li&gt;hcpcd(8) updated to 7.2.2&lt;/li&gt;

&lt;li&gt;httpd(8) updated.&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.ixsystems.com/blog/freenas-as-your-server-os/"&gt;FreeNAS as your Server OS&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;What if you could have a server OS that had built in RAID, NAS and SAN functionality, and could manage packages, containers and VMs in a GUI? What if that server OS was also free to download and install? Wouldn’t that be kind of awesome? Wouldn’t that be FreeNAS?
  FreeNAS is the world’s number one, open source storage OS, but it also comes equipped with all the jails, plugins, and VMs you need to run additional server-level services for things like email and web site hosting. File, Block, and even Object storage is all built-in and can be enabled with a few clicks. The ZFS file system scales to more drives than you could ever buy, with no limits for dataset sizes, snapshots, and restores.
  FreeNAS is also 100% FreeBSD. This is the OS used in the Netflix CDN, your PS4, and the basis for iOS. Set up a jail and get started downloading packages like Apache or NGINX for web hosting or Postfix for email service.
  Just released, our new TrueCommand management platform also streamlines alerts and enables multi-system monitoring.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.babaei.net/blog/keep-crashing-daemons-running-on-freebsd/"&gt;Keep Crashing Daemons Running on FreeBSD&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://old.reddit.com/r/freebsd/comments/btksgf/look_what_i_found_today_my_first_set_of_bsd_cds/"&gt;Look what I found today... my first set of BSD CDs...&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://wiki.netbsd.org/security/intel_mds/"&gt;NetBSD - Intel MDS&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-May/091227.html"&gt;FreeBSD 11.3-BETA2 -- Please test!&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Anthony - &lt;a href="http://dpaste.com/33S61HH#wrap"&gt;Question&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Guntbert - &lt;a href="http://dpaste.com/0NDACM2"&gt;Podcast&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Guillaume - &lt;a href="http://dpaste.com/0N3Q9TN"&gt;Another suggestion for Ales from Serbia&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, omniOS, pfsense, p3</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>GPU passthrough on bhyve, confusion with used/free disk space on ZFS, OmniOS Community Edition, pfSense 2.4.4 Release p3, NetBSD 8.1 RC1, FreeNAS as your Server OS, and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="gpupassthroughreportedworkingonbhyvehttpspassthroughpostgpupassthroughreportedworkingonbhyve"><a href="https://passthroughpo.st/gpu-passthrough-reported-working-on-bhyve/">GPU Passthrough Reported Working on Bhyve</a></h3>

<blockquote>
  <p>Normally we cover news focused on KVM and sometimes Xen, but something very special has happened with their younger cousin in the BSD world, Bhyve.
  For those that don’t know, Bhyve (pronounced bee-hive) is the native hypervisor in FreeBSD. It has many powerful features, but one that’s been a pain point for some years now is VGA passthrough. Consumer GPUs have not been useable until very recently despite limited success with enterprise cards.
  However, Twitter user Michael Yuji found a workaround that enables passing through a consumer card to any *nix system configured to use X11:</p>
</blockquote>

<ul>
<li>https://twitter.com/michael_yuji/status/1127136891365658625</li>
</ul>

<blockquote>
  <p>All you have to do is add a line pointing the X server to the Bus ID of the passed card and the VM will boot, with acceleration and everything. He theorizes that this may not be possible on windows because of the way it looks for display devices, but it’s a solid start.
  As soon as development surrounding VGA passthrough matures on Bhyve, it will become a very attractive alternative to more common tools like Hyper-V and Qemu, because it makes many powerful features available in the host system like jails, boot environments, BSD networking, and tight ZFS integration. For example, you could potentially run your Router, NAS, preferred workstation OS and any number of other things in one box, and only have to spin up a single VM because of the flexibility afforded by jails over Linux-based containers.
  The user who found this workaround also announced they’d be writing it up at some point, so stay tuned for details on the process.
  It’s been slow going on Bhyve passthrough development for a while, but this new revelation is encouraging. We’ll be closely monitoring the situation and report on any other happenings.</p>
  
  <hr />
</blockquote>

<h3 id="confusionwithusedfreediskspaceinzfshttpsoshogbovexilliumorgblog65"><a href="https://oshogbo.vexillium.org/blog/65/">Confusion with used/free disk space in ZFS</a></h3>

<blockquote>
  <p>I use ZFS extensively. ZFS is my favorite file system. I write articles and give lectures about it. I work with it every day. In traditional file systems we use df(1) to determine free space on partitions. We can also use du(1) to count the size of the files in the directory. But it’s different on ZFS and this is the most confusing thing EVER. I always forget which tool reports what disk space usage! Every time somebody asks me, I need to google it. For this reason I decided to document it here - for myself - because if I can’t remember it at least I will not need to google it, as it will be on my blog, but maybe you will also benefit from this blog post if you have the same problem or you are starting your journey with ZFS.</p>
  
  <p>The understanding of how ZFS is uses space and how to determine which value means what is a crucial thing. I hope thanks to this article I will finally remember it!</p>
</blockquote>

<p><hr /></p>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="omnioscommunityeditionhttpsomniosceorgarticlerelease030html"><a href="https://omniosce.org/article/release-030.html">OmniOS Community Edition</a></h3>

<blockquote>
  <p>The OmniOS Community Edition Association is proud to announce the general availability of OmniOS - r151030.
  OmniOS is published according to a 6-month release cycle, r151030 LTS takes over from r151028, published in November 2018; and since it is a LTS release it also takes over from r151022. The r151030 LTS release will be supported for 3 Years. It is the first LTS release published by the OmniOS CE Association since taking over the reins from OmniTI in 2017. The next LTS release is scheduled for May 2021. The old stable r151026 release is now end-of-life. See the release schedule for further details.
  This is only a small selection of the new features, and bug fixes in the new release; review the release notes for full details.
  If you upgrade from r22 and want to see all new features added since then, make sure to also read the release notes for r24, r26 and r28.
  The OmniOS team and the illumos community have been very active in creating new features and improving existing ones over the last 6 months.</p>
</blockquote>

<p><hr /></p>

<h3 id="pfsense244releasep3isavailablehttpswwwnetgatecomblogpfsense244releasep3nowavailablehtml"><a href="https://www.netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html">pfSense 2.4.4 Release p3 is available</a></h3>

<blockquote>
  <p>We are pleased to announce the release of pfSense® software version 2.4.4-p3, now available for new installations and upgrades!
  pfSense software version 2.4.4-p3 is a maintenance release, bringing a number of security enhancements as well as a handful of fixes for issues present in the 2.4.4-p2 release.
  pfSense 2.4.4-RELEASE-p3 updates and installation images are available now!
  To see a complete list of changes and find more detail, see the Release Notes.
  We had hoped to bring you this release a few days earlier, but given the announcement last Tuesday of the Intel Microarchitectural Data Sampling (MDS) issue, we did not have sufficient time to fully incorporate those corrections and properly test for release on Thursday. We felt that it was worth delaying for a few days, rather than making multiple releases within a week.</p>
</blockquote>

<ul>
<li>Upgrade Notes</li>
</ul>

<blockquote>
  <p>Due to the significant nature of the changes in 2.4.4 and later, 
  warnings and error messages, particularly from PHP and package updates, are likely to occur during the upgrade process. In nearly all cases these errors are a harmless side effect of the changes between FreeBSD 11.1 and 11.2 and between PHP 5.6 and PHP 7.2.
  Always take a backup of the firewall configuration prior to any major change to the firewall, such as an upgrade.
  Do not update packages before upgrading pfSense! Either remove all packages or do not update packages before running the upgrade.
  The upgrade will take several minutes to complete. The exact time varies based on download speed, hardware speed, and other factors such installed packages. Be patient during the upgrade and allow the firewall enough time to complete the entire process. After the update packages finish downloading it could take 10-20 minutes or more until the upgrade process ends. The firewall may reboot several times during the upgrade process. Monitor the upgrade from the firewall console for the most accurate view.</p>
</blockquote>

<p><hr /></p>

<h3 id="netbsd81rc1isouthttpswwwnetbsdorgreleasesformal8netbsd81html"><a href="https://www.netbsd.org/releases/formal-8/NetBSD-8.1.html">NetBSD 8.1 RC1 is out</a></h3>

<blockquote>
  <p>The NetBSD Project is pleased to announce NetBSD 8.1, the first update of the NetBSD 8 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</p>
  
  <p>Some highlights of the 8.1 release are:</p>
</blockquote>

<ul>
<li>x86: Mitigation for INTEL-SA-00233 (MDS)</li>

<li>Various local user kernel data leaks fixed.</li>

<li>x86: new rc.conf(5) setting smtoff to disable Simultaneous Multi-Threading</li>

<li>Various network driver fixes and improvements.</li>

<li>Fixes for thread local storage (TLS) in position independent executables (PIE).</li>

<li>Fixes to reproducible builds.</li>

<li>Fixed a performance regression in tmpfs.</li>

<li>DRM/KMS improvements.</li>

<li>bwfm(4) wireless driver for Broadcom FullMAC PCI and USB devices added.</li>

<li>Various sh(1) fixes.</li>

<li>mfii(4) SAS driver added.</li>

<li>hcpcd(8) updated to 7.2.2</li>

<li>httpd(8) updated.</li>
</ul>

<p><hr /></p>

<h3 id="freenasasyourserveroshttpswwwixsystemscomblogfreenasasyourserveros"><a href="https://www.ixsystems.com/blog/freenas-as-your-server-os/">FreeNAS as your Server OS</a></h3>

<blockquote>
  <p>What if you could have a server OS that had built in RAID, NAS and SAN functionality, and could manage packages, containers and VMs in a GUI? What if that server OS was also free to download and install? Wouldn’t that be kind of awesome? Wouldn’t that be FreeNAS?
  FreeNAS is the world’s number one, open source storage OS, but it also comes equipped with all the jails, plugins, and VMs you need to run additional server-level services for things like email and web site hosting. File, Block, and even Object storage is all built-in and can be enabled with a few clicks. The ZFS file system scales to more drives than you could ever buy, with no limits for dataset sizes, snapshots, and restores.
  FreeNAS is also 100% FreeBSD. This is the OS used in the Netflix CDN, your PS4, and the basis for iOS. Set up a jail and get started downloading packages like Apache or NGINX for web hosting or Postfix for email service.
  Just released, our new TrueCommand management platform also streamlines alerts and enables multi-system monitoring.</p>
</blockquote>

<p><hr /></p>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://www.babaei.net/blog/keep-crashing-daemons-running-on-freebsd/">Keep Crashing Daemons Running on FreeBSD</a></li>

<li><a href="https://old.reddit.com/r/freebsd/comments/btksgf/look_what_i_found_today_my_first_set_of_bsd_cds/">Look what I found today... my first set of BSD CDs...</a></li>

<li><a href="https://wiki.netbsd.org/security/intel_mds/">NetBSD - Intel MDS</a></li>

<li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-May/091227.html">FreeBSD 11.3-BETA2 -- Please test!</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Anthony - <a href="http://dpaste.com/33S61HH#wrap">Question</a></li>

<li>Guntbert - <a href="http://dpaste.com/0NDACM2">Podcast</a></li>

<li>Guillaume - <a href="http://dpaste.com/0N3Q9TN">Another suggestion for Ales from Serbia</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0301.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>GPU passthrough on bhyve, confusion with used/free disk space on ZFS, OmniOS Community Edition, pfSense 2.4.4 Release p3, NetBSD 8.1 RC1, FreeNAS as your Server OS, and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="gpupassthroughreportedworkingonbhyvehttpspassthroughpostgpupassthroughreportedworkingonbhyve"><a href="https://passthroughpo.st/gpu-passthrough-reported-working-on-bhyve/">GPU Passthrough Reported Working on Bhyve</a></h3>

<blockquote>
  <p>Normally we cover news focused on KVM and sometimes Xen, but something very special has happened with their younger cousin in the BSD world, Bhyve.
  For those that don’t know, Bhyve (pronounced bee-hive) is the native hypervisor in FreeBSD. It has many powerful features, but one that’s been a pain point for some years now is VGA passthrough. Consumer GPUs have not been useable until very recently despite limited success with enterprise cards.
  However, Twitter user Michael Yuji found a workaround that enables passing through a consumer card to any *nix system configured to use X11:</p>
</blockquote>

<ul>
<li>https://twitter.com/michael_yuji/status/1127136891365658625</li>
</ul>

<blockquote>
  <p>All you have to do is add a line pointing the X server to the Bus ID of the passed card and the VM will boot, with acceleration and everything. He theorizes that this may not be possible on windows because of the way it looks for display devices, but it’s a solid start.
  As soon as development surrounding VGA passthrough matures on Bhyve, it will become a very attractive alternative to more common tools like Hyper-V and Qemu, because it makes many powerful features available in the host system like jails, boot environments, BSD networking, and tight ZFS integration. For example, you could potentially run your Router, NAS, preferred workstation OS and any number of other things in one box, and only have to spin up a single VM because of the flexibility afforded by jails over Linux-based containers.
  The user who found this workaround also announced they’d be writing it up at some point, so stay tuned for details on the process.
  It’s been slow going on Bhyve passthrough development for a while, but this new revelation is encouraging. We’ll be closely monitoring the situation and report on any other happenings.</p>
  
  <hr />
</blockquote>

<h3 id="confusionwithusedfreediskspaceinzfshttpsoshogbovexilliumorgblog65"><a href="https://oshogbo.vexillium.org/blog/65/">Confusion with used/free disk space in ZFS</a></h3>

<blockquote>
  <p>I use ZFS extensively. ZFS is my favorite file system. I write articles and give lectures about it. I work with it every day. In traditional file systems we use df(1) to determine free space on partitions. We can also use du(1) to count the size of the files in the directory. But it’s different on ZFS and this is the most confusing thing EVER. I always forget which tool reports what disk space usage! Every time somebody asks me, I need to google it. For this reason I decided to document it here - for myself - because if I can’t remember it at least I will not need to google it, as it will be on my blog, but maybe you will also benefit from this blog post if you have the same problem or you are starting your journey with ZFS.</p>
  
  <p>The understanding of how ZFS is uses space and how to determine which value means what is a crucial thing. I hope thanks to this article I will finally remember it!</p>
</blockquote>

<p><hr /></p>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="omnioscommunityeditionhttpsomniosceorgarticlerelease030html"><a href="https://omniosce.org/article/release-030.html">OmniOS Community Edition</a></h3>

<blockquote>
  <p>The OmniOS Community Edition Association is proud to announce the general availability of OmniOS - r151030.
  OmniOS is published according to a 6-month release cycle, r151030 LTS takes over from r151028, published in November 2018; and since it is a LTS release it also takes over from r151022. The r151030 LTS release will be supported for 3 Years. It is the first LTS release published by the OmniOS CE Association since taking over the reins from OmniTI in 2017. The next LTS release is scheduled for May 2021. The old stable r151026 release is now end-of-life. See the release schedule for further details.
  This is only a small selection of the new features, and bug fixes in the new release; review the release notes for full details.
  If you upgrade from r22 and want to see all new features added since then, make sure to also read the release notes for r24, r26 and r28.
  The OmniOS team and the illumos community have been very active in creating new features and improving existing ones over the last 6 months.</p>
</blockquote>

<p><hr /></p>

<h3 id="pfsense244releasep3isavailablehttpswwwnetgatecomblogpfsense244releasep3nowavailablehtml"><a href="https://www.netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html">pfSense 2.4.4 Release p3 is available</a></h3>

<blockquote>
  <p>We are pleased to announce the release of pfSense® software version 2.4.4-p3, now available for new installations and upgrades!
  pfSense software version 2.4.4-p3 is a maintenance release, bringing a number of security enhancements as well as a handful of fixes for issues present in the 2.4.4-p2 release.
  pfSense 2.4.4-RELEASE-p3 updates and installation images are available now!
  To see a complete list of changes and find more detail, see the Release Notes.
  We had hoped to bring you this release a few days earlier, but given the announcement last Tuesday of the Intel Microarchitectural Data Sampling (MDS) issue, we did not have sufficient time to fully incorporate those corrections and properly test for release on Thursday. We felt that it was worth delaying for a few days, rather than making multiple releases within a week.</p>
</blockquote>

<ul>
<li>Upgrade Notes</li>
</ul>

<blockquote>
  <p>Due to the significant nature of the changes in 2.4.4 and later, 
  warnings and error messages, particularly from PHP and package updates, are likely to occur during the upgrade process. In nearly all cases these errors are a harmless side effect of the changes between FreeBSD 11.1 and 11.2 and between PHP 5.6 and PHP 7.2.
  Always take a backup of the firewall configuration prior to any major change to the firewall, such as an upgrade.
  Do not update packages before upgrading pfSense! Either remove all packages or do not update packages before running the upgrade.
  The upgrade will take several minutes to complete. The exact time varies based on download speed, hardware speed, and other factors such installed packages. Be patient during the upgrade and allow the firewall enough time to complete the entire process. After the update packages finish downloading it could take 10-20 minutes or more until the upgrade process ends. The firewall may reboot several times during the upgrade process. Monitor the upgrade from the firewall console for the most accurate view.</p>
</blockquote>

<p><hr /></p>

<h3 id="netbsd81rc1isouthttpswwwnetbsdorgreleasesformal8netbsd81html"><a href="https://www.netbsd.org/releases/formal-8/NetBSD-8.1.html">NetBSD 8.1 RC1 is out</a></h3>

<blockquote>
  <p>The NetBSD Project is pleased to announce NetBSD 8.1, the first update of the NetBSD 8 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</p>
  
  <p>Some highlights of the 8.1 release are:</p>
</blockquote>

<ul>
<li>x86: Mitigation for INTEL-SA-00233 (MDS)</li>

<li>Various local user kernel data leaks fixed.</li>

<li>x86: new rc.conf(5) setting smtoff to disable Simultaneous Multi-Threading</li>

<li>Various network driver fixes and improvements.</li>

<li>Fixes for thread local storage (TLS) in position independent executables (PIE).</li>

<li>Fixes to reproducible builds.</li>

<li>Fixed a performance regression in tmpfs.</li>

<li>DRM/KMS improvements.</li>

<li>bwfm(4) wireless driver for Broadcom FullMAC PCI and USB devices added.</li>

<li>Various sh(1) fixes.</li>

<li>mfii(4) SAS driver added.</li>

<li>hcpcd(8) updated to 7.2.2</li>

<li>httpd(8) updated.</li>
</ul>

<p><hr /></p>

<h3 id="freenasasyourserveroshttpswwwixsystemscomblogfreenasasyourserveros"><a href="https://www.ixsystems.com/blog/freenas-as-your-server-os/">FreeNAS as your Server OS</a></h3>

<blockquote>
  <p>What if you could have a server OS that had built in RAID, NAS and SAN functionality, and could manage packages, containers and VMs in a GUI? What if that server OS was also free to download and install? Wouldn’t that be kind of awesome? Wouldn’t that be FreeNAS?
  FreeNAS is the world’s number one, open source storage OS, but it also comes equipped with all the jails, plugins, and VMs you need to run additional server-level services for things like email and web site hosting. File, Block, and even Object storage is all built-in and can be enabled with a few clicks. The ZFS file system scales to more drives than you could ever buy, with no limits for dataset sizes, snapshots, and restores.
  FreeNAS is also 100% FreeBSD. This is the OS used in the Netflix CDN, your PS4, and the basis for iOS. Set up a jail and get started downloading packages like Apache or NGINX for web hosting or Postfix for email service.
  Just released, our new TrueCommand management platform also streamlines alerts and enables multi-system monitoring.</p>
</blockquote>

<p><hr /></p>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://www.babaei.net/blog/keep-crashing-daemons-running-on-freebsd/">Keep Crashing Daemons Running on FreeBSD</a></li>

<li><a href="https://old.reddit.com/r/freebsd/comments/btksgf/look_what_i_found_today_my_first_set_of_bsd_cds/">Look what I found today... my first set of BSD CDs...</a></li>

<li><a href="https://wiki.netbsd.org/security/intel_mds/">NetBSD - Intel MDS</a></li>

<li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-May/091227.html">FreeBSD 11.3-BETA2 -- Please test!</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Anthony - <a href="http://dpaste.com/33S61HH#wrap">Question</a></li>

<li>Guntbert - <a href="http://dpaste.com/0NDACM2">Podcast</a></li>

<li>Guillaume - <a href="http://dpaste.com/0N3Q9TN">Another suggestion for Ales from Serbia</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0301.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>300: The Big Three</title>
  <link>https://www.bsdnow.tv/300</link>
  <guid isPermaLink="false">f4d00ce6-8060-4be0-9049-570b73a6adbd</guid>
  <pubDate>Thu, 30 May 2019 12:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f4d00ce6-8060-4be0-9049-570b73a6adbd.mp3" length="44983170" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 11.3-beta 1 is out, BSDCan 2019 recap, OpenIndiana 2019.04 is out, Overview of ZFS Pools in FreeNAS, why open source firmware is important for security, a new Opnsense release, wireguard on OpenBSD, and more. </itunes:subtitle>
  <itunes:duration>1:14:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 11.3-beta 1 is out, BSDCan 2019 recap, OpenIndiana 2019.04 is out, Overview of ZFS Pools in FreeNAS, why open source firmware is important for security, a new Opnsense release, wireguard on OpenBSD, and more. 
&lt;h2&gt;Headlines&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-May/091210.html"&gt;FreeBSD 11.3-b1 is out&lt;/a&gt;&lt;/h3&gt;

&lt;h3&gt;&lt;a href="https://www.bsdcan.org/2019/"&gt;BSDCan 2019 Recap&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;We’re back from BSDCan and it was a packed week as always.&lt;/li&gt;

&lt;li&gt;It started with &lt;a href="http://bhyvecon.org/"&gt;bhyvecon&lt;/a&gt; on Tuesday. Meanwhile, Benedict spent the whole day in productive meetings: annual FreeBSD Foundation board meeting and FreeBSD Journal editorial board meeting.&lt;/li&gt;

&lt;li&gt;On Wednesday, tutorials for BSDCan started as well as the &lt;a href="https://wiki.freebsd.org/DevSummit/201905"&gt;FreeBSD Developer Summit&lt;/a&gt;. In the mornings, there were presentations in the big auditorium, while working groups about networking, failsafe bootcode, development web services, swap space management, and testing/CI were held. Friday had a similar format with an update from the FreeBSD core team and the “have, need, want” session for FreeBSD 13. In the afternoon, there were working groups about translation tools, package base, GSoC/Outreachy, or general hacking. Benedict held his Icinga tutorial in the afternoon with about 15 people attending.
Devsummit presentation slides can be found on the wiki page and video recordings done by &lt;a href="https://www.scaleengine.com/"&gt;ScaleEngine&lt;/a&gt; are available on &lt;a href="https://www.youtube.com/channel/UCxLxR_oW-NAmChIcSkAyZGQ"&gt;FreeBSD’s youtube channel&lt;/a&gt;.&lt;/li&gt;

&lt;li&gt;The conference program was a good mixture of sysadmin and tech talks across the major BSDs. Benedict saw the following talks: How ZFS snapshots really work by Matt Ahrens, 20 years in Jail by Michael W. Lucas, OpenZFS BOF session, the future of OpenZFS and FreeBSD, MQTT for system administrators by Jan-Piet Mens, and spent the rest of the time in between in the hallway track. &lt;/li&gt;

&lt;li&gt;Photos from the event are available on &lt;a href="https://www.talegraph.com/tales/Qg446T5bKT"&gt;Ollivier Robert’s talegraph
&lt;/a&gt; and Diane Bruce’s website for &lt;a href="http://www.db.net/gallery/BSDCan/2019_BSDCan_day_1_web/"&gt;day 1&lt;/a&gt;, &lt;a href="http://www.db.net/gallery/BSDCan/2019_FreeBSD_Dev_Summit_day_2_web"&gt;day 2&lt;/a&gt;, &lt;a href="http://www.db.net/gallery/BSDCan/2019_BSDCan_day_1_web"&gt;conference day 1&lt;/a&gt;, and &lt;a href="http://www.db.net/gallery/BSDCan/2019_BSDCan_day_2_web"&gt;conference day 2&lt;/a&gt;.&lt;/li&gt;

&lt;li&gt;Thanks to all the sponsors, supporters, organizers, speakers, and attendees for making this yet another great BSDCan. Next year’s BSDCan will be from June 2 - 6, 2020.&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.openindiana.org/2019/05/12/openindiana-hipster-2019-04-is-here/"&gt;OpenIndiana 2019.04 is out&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;We have released a new OpenIndiana Hipster snapshot 2019.04. The noticeable changes:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;Firefox was updated to 60.6.3 ESR&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;Virtualbox packages were added (including guest additions)&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;Mate was updated to 1.22&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;IPS has received updates from OmniOS CE and Oracle IPS repos, including automatic boot environment naming&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;Some OI-specific applications have been ported from Python 2.7/GTK 2 to Python 3.5/GTK 3&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;Quick Demo Video: https://www.youtube.com/watch?v=tQ0-fo3XNrg&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://www.ixsystems.com/blog/zfs-pools-in-freenas/"&gt;Overview of ZFS Pools in FreeNAS&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;FreeNAS uses the OpenZFS (ZFS) file system, which handles both disk and volume management. ZFS offers RAID options mirror, stripe, and its own parity distribution called RAIDZ that functions like RAID5 on hardware RAID. The file system is extremely flexible and secure, with various drive combinations, checksums, snapshots, and replication all possible. For a deeper dive on ZFS technology, read the ZFS Primer section of the FreeNAS documentation.&lt;/p&gt;
  
  &lt;p&gt;SUGGEST LAYOUT attempts to balance usable capacity and redundancy by automatically choosing an ideal vdev layout for the number of available disks.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;The following vdev layout options are available when creating a pool:


&lt;ul&gt;
&lt;li&gt;Stripe data is shared on two drives, similar to RAID0)&lt;/li&gt;

&lt;li&gt;Mirror copies data on two drives, similar to RAID1 but not limited to 2 disks)&lt;/li&gt;

&lt;li&gt;RAIDZ1 single parity similar to RAID5&lt;/li&gt;

&lt;li&gt;RAIDZ2 double parity similar to RAID6&lt;/li&gt;

&lt;li&gt;RAIDZ3 which uses triple parity and has no RAID equivalent&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-security/"&gt;Why OpenSource Firmware is Important for Security&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;Roots of Trust&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;The goal of the root of trust should be to verify that the software installed in every component of the hardware is the software that was intended. This way you can know without a doubt and verify if hardware has been hacked. Since we have very little to no visibility into the code running in a lot of places in our hardware it is hard to do this. How do we really know that the firmware in a component is not vulnerable or that is doesn’t have any backdoors? Well we can’t. Not unless it was all open source.
  Every cloud and vendor seems to have their own way of doing a root of trust. Microsoft has Cerberus, Google has Titan, and Amazon has Nitro. These seem to assume an explicit amount of trust in the proprietary code (the code we cannot see). This leaves me with not a great feeling. Wouldn’t it be better to be able to use all open source code? Then we could verify without a doubt that the code you can read and build yourself is the same code running on hardware for all the various places we have firmware. We could then verify that a machine was in a correct state without a doubt of it being vulnerable or with a backdoor.
  It makes me wonder what the smaller cloud providers like DigitalOcean or Packet have for a root of trust. Often times we only hear of these projects from the big three or five. &lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://opnsense.org/opnsense-19-1-8-released/"&gt;OPNsense&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;This update addresses several privilege escalation issues in the access control implementation and new memory disclosure issues in Intel CPUs. We would like to thank Arnaud Cordier and Bill Marquette for the top-notch reports and coordination.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;Here are the full patch notes:&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;system: address CVE-2019-11816 privilege escalation bugs[1] (reported by Arnaud Cordier)&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;system: /etc/hosts generation without interface&lt;em&gt;has&lt;/em&gt;gateway()&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;system: show correct timestamp in config restore save message (contributed by nhirokinet)&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;system: list the commands for the pluginctl utility when n+ argument is given&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;system: introduce and use userIsAdmin() helper function instead of checking for 'page-all' privilege directly&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;system: use absolute path in widget ACLs (reported by Netgate)&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;system: RRD-related cleanups for less code exposure&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;interfaces: add EN DUID Generation using OPNsense PEN (contributed by Team Rebellion)&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;interfaces: replace legacy&lt;em&gt;getall&lt;/em&gt;interface_addresses() usage&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;firewall: fix port validation in aliases with leading / trailing spaces&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;firewall: fix outbound NAT translation display in overview page&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;firewall: prevent CARP outgoing packets from using the configured gateway&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;firewall: use CARP net.inet.carp.demotion to control current demotion in status page&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;firewall: stop live log poller on error result&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;dhcpd: change rule priority to 1 to avoid bogon clash&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;dnsmasq: only admins may edit custom options field&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;firmware: use insecure mode for base and kernel sets when package fingerprints are disabled&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;firmware: add optional device support for base and kernel sets&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;firmware: add Hostcentral mirror (HTTP, Melbourne, Australia)&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;ipsec: always reset rightallowany to default when writing configuration&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;lang: say "hola" to Spanish as the newest available GUI language&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;lang: updates for Chinese, Czech, Japanese, German, French, Russian and Portuguese&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;network time: only admins may edit custom options field&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;openvpn: call openvpn&lt;em&gt;refresh&lt;/em&gt;crls() indirectly via plugin_configure() for less code exposure&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;openvpn: only admins may edit custom options field to prevent privilege escalation (reported by Bill Marquette)&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;openvpn: remove custom options field from wizard&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;unbound: only admins may edit custom options field&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;wizard: translate typehint as well&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;plugins: os-freeradius 1.9.3 fixes string interpolation in LDAP filters (contributed by theq86)&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;plugins: os-nginx 1.12[2]&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;plugins: os-theme-cicada 1.17 (contributed by Team Rebellion)&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;plugins: os-theme-tukan 1.17 (contributed by Team Rebellion)&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;src: timezone database information update[3]&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;src: install(1) broken with partially matching relative paths[4]&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;src: microarchitectural Data Sampling (MDS) mitigation[5]&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;ports: ca&lt;em&gt;root&lt;/em&gt;nss 3.44&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;ports: php 7.2.18[6]&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;ports: sqlite 3.28.0[7]&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;ports: strongswan custom XAuth generic patch removed&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://blog.jasper.la/wireguard-on-openbsd.html"&gt;wiregaurd on OpenBSD&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Earlier this week I imported a port for WireGuard into the OpenBSD ports tree. At the moment we have the userland daemon and the tools available. The in-kernel implementation is only available for Linux. At the time of writing there are packages available for -current.
  Jason A. Donenfeld (WireGuard author) has worked to support OpenBSD in WireGuard and as such his post on ports@ last year got me interested in WireGuard, since then others have toyed with WireGuard on OpenBSD before and as such I've used Ted's article as a reference. Note however that some of the options mentioned there are no longer valid. Also, I'll be using two OpenBSD peers here.
  The setup will be as follows: two OpenBSD peers, of which we'll dub wg1 the server and wg2 the client. The WireGuard service on wg1 is listening on 100.64.4.3:51820.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Conclusion&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;WireGuard (cl)aims to be easier to setup and faster than OpenVPN and while I haven't been able to verify the latter, the first is certainly true...once you've figured it out. Most documentation out there is for Linux so I had to figure out the wireguard&lt;em&gt;go service and the tun parameters. But all in all, sure, it's easier. Especially the client configuration on iOS which I didn't cover here because it's essentially pkg&lt;/em&gt;add libqrencode ; cat client.conf | qrencode -t ansiutf8, scan the code with the WireGuard app and you're good to go. What is particularly neat is that WireGuard on iOS supports Always-on.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://github.com/SerenityOS/serenity"&gt;Serenity OS&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://www.dragonflydigest.com/2019/05/27/22985.html"&gt;vkernels vs pmap&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=EY6q5dv_B-o"&gt;Brian Kernighan interviews Ken Thompson&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="http://blog.netbsd.org/tnf/entry/improvements_in_forking_threading_and"&gt;Improvements in forking, threading, and signal code&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://www.dragonflydigest.com/2019/05/21/22946.html"&gt;DragonFly 5.4.3&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://magazine.odroid.com/article/netbsd-for-the-the-odroid-c2/"&gt;NetBSD on the Odroid C2&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Paulo - &lt;a href="http://dpaste.com/3VXMGX8"&gt;Laptops&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;A Listener - &lt;a href="http://dpaste.com/0SWJNRX#wrap"&gt;Thanks&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Bostjan - &lt;a href="http://dpaste.com/35NRF40#wrap"&gt;Extend a pool and lower RAM footprint&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, bsdcan, zfs, openindiana, freenas, firmware, wireguard</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 11.3-beta 1 is out, BSDCan 2019 recap, OpenIndiana 2019.04 is out, Overview of ZFS Pools in FreeNAS, why open source firmware is important for security, a new Opnsense release, wireguard on OpenBSD, and more. </p>

<h2 id="headlines">Headlines</h2>

<h3 id="freebsd113b1isouthttpslistsfreebsdorgpipermailfreebsdstable2019may091210html"><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-May/091210.html">FreeBSD 11.3-b1 is out</a></h3>

<h3 id="bsdcan2019recaphttpswwwbsdcanorg2019"><a href="https://www.bsdcan.org/2019/">BSDCan 2019 Recap</a></h3>

<ul>
<li>We’re back from BSDCan and it was a packed week as always.</li>

<li>It started with <a href="http://bhyvecon.org/">bhyvecon</a> on Tuesday. Meanwhile, Benedict spent the whole day in productive meetings: annual FreeBSD Foundation board meeting and FreeBSD Journal editorial board meeting.</li>

<li>On Wednesday, tutorials for BSDCan started as well as the <a href="https://wiki.freebsd.org/DevSummit/201905">FreeBSD Developer Summit</a>. In the mornings, there were presentations in the big auditorium, while working groups about networking, failsafe bootcode, development web services, swap space management, and testing/CI were held. Friday had a similar format with an update from the FreeBSD core team and the “have, need, want” session for FreeBSD 13. In the afternoon, there were working groups about translation tools, package base, GSoC/Outreachy, or general hacking. Benedict held his Icinga tutorial in the afternoon with about 15 people attending.
Devsummit presentation slides can be found on the wiki page and video recordings done by <a href="https://www.scaleengine.com/">ScaleEngine</a> are available on <a href="https://www.youtube.com/channel/UCxLxR_oW-NAmChIcSkAyZGQ">FreeBSD’s youtube channel</a>.</li>

<li>The conference program was a good mixture of sysadmin and tech talks across the major BSDs. Benedict saw the following talks: How ZFS snapshots really work by Matt Ahrens, 20 years in Jail by Michael W. Lucas, OpenZFS BOF session, the future of OpenZFS and FreeBSD, MQTT for system administrators by Jan-Piet Mens, and spent the rest of the time in between in the hallway track. </li>

<li>Photos from the event are available on <a href="https://www.talegraph.com/tales/Qg446T5bKT">Ollivier Robert’s talegraph
</a> and Diane Bruce’s website for <a href="http://www.db.net/gallery/BSDCan/2019_BSDCan_day_1_web/">day 1</a>, <a href="http://www.db.net/gallery/BSDCan/2019_FreeBSD_Dev_Summit_day_2_web">day 2</a>, <a href="http://www.db.net/gallery/BSDCan/2019_BSDCan_day_1_web">conference day 1</a>, and <a href="http://www.db.net/gallery/BSDCan/2019_BSDCan_day_2_web">conference day 2</a>.</li>

<li>Thanks to all the sponsors, supporters, organizers, speakers, and attendees for making this yet another great BSDCan. Next year’s BSDCan will be from June 2 - 6, 2020.</li>
</ul>

<p><hr /></p>

<h3 id="openindiana201904isouthttpswwwopenindianaorg20190512openindianahipster201904ishere"><a href="https://www.openindiana.org/2019/05/12/openindiana-hipster-2019-04-is-here/">OpenIndiana 2019.04 is out</a></h3>

<blockquote>
  <p>We have released a new OpenIndiana Hipster snapshot 2019.04. The noticeable changes:</p>
</blockquote>

<ul>
<li><p>Firefox was updated to 60.6.3 ESR</p></li>

<li><p>Virtualbox packages were added (including guest additions)</p></li>

<li><p>Mate was updated to 1.22</p></li>

<li><p>IPS has received updates from OmniOS CE and Oracle IPS repos, including automatic boot environment naming</p></li>

<li><p>Some OI-specific applications have been ported from Python 2.7/GTK 2 to Python 3.5/GTK 3</p></li>

<li><p>Quick Demo Video: https://www.youtube.com/watch?v=tQ0-fo3XNrg</p></li>
</ul>

<p><hr /></p>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="overviewofzfspoolsinfreenashttpswwwixsystemscomblogzfspoolsinfreenas"><a href="https://www.ixsystems.com/blog/zfs-pools-in-freenas/">Overview of ZFS Pools in FreeNAS</a></h3>

<blockquote>
  <p>FreeNAS uses the OpenZFS (ZFS) file system, which handles both disk and volume management. ZFS offers RAID options mirror, stripe, and its own parity distribution called RAIDZ that functions like RAID5 on hardware RAID. The file system is extremely flexible and secure, with various drive combinations, checksums, snapshots, and replication all possible. For a deeper dive on ZFS technology, read the ZFS Primer section of the FreeNAS documentation.</p>
  
  <p>SUGGEST LAYOUT attempts to balance usable capacity and redundancy by automatically choosing an ideal vdev layout for the number of available disks.</p>
</blockquote>

<ul>
<li>The following vdev layout options are available when creating a pool:


<ul>
<li>Stripe data is shared on two drives, similar to RAID0)</li>

<li>Mirror copies data on two drives, similar to RAID1 but not limited to 2 disks)</li>

<li>RAIDZ1 single parity similar to RAID5</li>

<li>RAIDZ2 double parity similar to RAID6</li>

<li>RAIDZ3 which uses triple parity and has no RAID equivalent</li></ul>
</li>
</ul>

<p><hr /></p>

<h3 id="whyopensourcefirmwareisimportantforsecurityhttpsblogjessfrazcompostwhyopensourcefirmwareisimportantforsecurity"><a href="https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-security/">Why OpenSource Firmware is Important for Security</a></h3>

<ul>
<li>Roots of Trust</li>
</ul>

<blockquote>
  <p>The goal of the root of trust should be to verify that the software installed in every component of the hardware is the software that was intended. This way you can know without a doubt and verify if hardware has been hacked. Since we have very little to no visibility into the code running in a lot of places in our hardware it is hard to do this. How do we really know that the firmware in a component is not vulnerable or that is doesn’t have any backdoors? Well we can’t. Not unless it was all open source.
  Every cloud and vendor seems to have their own way of doing a root of trust. Microsoft has Cerberus, Google has Titan, and Amazon has Nitro. These seem to assume an explicit amount of trust in the proprietary code (the code we cannot see). This leaves me with not a great feeling. Wouldn’t it be better to be able to use all open source code? Then we could verify without a doubt that the code you can read and build yourself is the same code running on hardware for all the various places we have firmware. We could then verify that a machine was in a correct state without a doubt of it being vulnerable or with a backdoor.
  It makes me wonder what the smaller cloud providers like DigitalOcean or Packet have for a root of trust. Often times we only hear of these projects from the big three or five. </p>
</blockquote>

<p><hr /></p>

<h3 id="opnsensehttpsopnsenseorgopnsense1918released"><a href="https://opnsense.org/opnsense-19-1-8-released/">OPNsense</a></h3>

<blockquote>
  <p>This update addresses several privilege escalation issues in the access control implementation and new memory disclosure issues in Intel CPUs. We would like to thank Arnaud Cordier and Bill Marquette for the top-notch reports and coordination.</p>
</blockquote>

<ul>
<li><p>Here are the full patch notes:</p></li>

<li><p>system: address CVE-2019-11816 privilege escalation bugs[1] (reported by Arnaud Cordier)</p></li>

<li><p>system: /etc/hosts generation without interface<em>has</em>gateway()</p></li>

<li><p>system: show correct timestamp in config restore save message (contributed by nhirokinet)</p></li>

<li><p>system: list the commands for the pluginctl utility when n+ argument is given</p></li>

<li><p>system: introduce and use userIsAdmin() helper function instead of checking for 'page-all' privilege directly</p></li>

<li><p>system: use absolute path in widget ACLs (reported by Netgate)</p></li>

<li><p>system: RRD-related cleanups for less code exposure</p></li>

<li><p>interfaces: add EN DUID Generation using OPNsense PEN (contributed by Team Rebellion)</p></li>

<li><p>interfaces: replace legacy<em>getall</em>interface_addresses() usage</p></li>

<li><p>firewall: fix port validation in aliases with leading / trailing spaces</p></li>

<li><p>firewall: fix outbound NAT translation display in overview page</p></li>

<li><p>firewall: prevent CARP outgoing packets from using the configured gateway</p></li>

<li><p>firewall: use CARP net.inet.carp.demotion to control current demotion in status page</p></li>

<li><p>firewall: stop live log poller on error result</p></li>

<li><p>dhcpd: change rule priority to 1 to avoid bogon clash</p></li>

<li><p>dnsmasq: only admins may edit custom options field</p></li>

<li><p>firmware: use insecure mode for base and kernel sets when package fingerprints are disabled</p></li>

<li><p>firmware: add optional device support for base and kernel sets</p></li>

<li><p>firmware: add Hostcentral mirror (HTTP, Melbourne, Australia)</p></li>

<li><p>ipsec: always reset rightallowany to default when writing configuration</p></li>

<li><p>lang: say "hola" to Spanish as the newest available GUI language</p></li>

<li><p>lang: updates for Chinese, Czech, Japanese, German, French, Russian and Portuguese</p></li>

<li><p>network time: only admins may edit custom options field</p></li>

<li><p>openvpn: call openvpn<em>refresh</em>crls() indirectly via plugin_configure() for less code exposure</p></li>

<li><p>openvpn: only admins may edit custom options field to prevent privilege escalation (reported by Bill Marquette)</p></li>

<li><p>openvpn: remove custom options field from wizard</p></li>

<li><p>unbound: only admins may edit custom options field</p></li>

<li><p>wizard: translate typehint as well</p></li>

<li><p>plugins: os-freeradius 1.9.3 fixes string interpolation in LDAP filters (contributed by theq86)</p></li>

<li><p>plugins: os-nginx 1.12[2]</p></li>

<li><p>plugins: os-theme-cicada 1.17 (contributed by Team Rebellion)</p></li>

<li><p>plugins: os-theme-tukan 1.17 (contributed by Team Rebellion)</p></li>

<li><p>src: timezone database information update[3]</p></li>

<li><p>src: install(1) broken with partially matching relative paths[4]</p></li>

<li><p>src: microarchitectural Data Sampling (MDS) mitigation[5]</p></li>

<li><p>ports: ca<em>root</em>nss 3.44</p></li>

<li><p>ports: php 7.2.18[6]</p></li>

<li><p>ports: sqlite 3.28.0[7]</p></li>

<li><p>ports: strongswan custom XAuth generic patch removed</p></li>
</ul>

<p><hr /></p>

<h3 id="wiregaurdonopenbsdhttpsblogjasperlawireguardonopenbsdhtml"><a href="https://blog.jasper.la/wireguard-on-openbsd.html">wiregaurd on OpenBSD</a></h3>

<blockquote>
  <p>Earlier this week I imported a port for WireGuard into the OpenBSD ports tree. At the moment we have the userland daemon and the tools available. The in-kernel implementation is only available for Linux. At the time of writing there are packages available for -current.
  Jason A. Donenfeld (WireGuard author) has worked to support OpenBSD in WireGuard and as such his post on ports@ last year got me interested in WireGuard, since then others have toyed with WireGuard on OpenBSD before and as such I've used Ted's article as a reference. Note however that some of the options mentioned there are no longer valid. Also, I'll be using two OpenBSD peers here.
  The setup will be as follows: two OpenBSD peers, of which we'll dub wg1 the server and wg2 the client. The WireGuard service on wg1 is listening on 100.64.4.3:51820.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
  <p>WireGuard (cl)aims to be easier to setup and faster than OpenVPN and while I haven't been able to verify the latter, the first is certainly true...once you've figured it out. Most documentation out there is for Linux so I had to figure out the wireguard<em>go service and the tun parameters. But all in all, sure, it's easier. Especially the client configuration on iOS which I didn't cover here because it's essentially pkg</em>add libqrencode ; cat client.conf | qrencode -t ansiutf8, scan the code with the WireGuard app and you're good to go. What is particularly neat is that WireGuard on iOS supports Always-on.</p>
</blockquote>

<p><hr /></p>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://github.com/SerenityOS/serenity">Serenity OS</a></li>

<li><a href="https://www.dragonflydigest.com/2019/05/27/22985.html">vkernels vs pmap</a></li>

<li><a href="https://www.youtube.com/watch?v=EY6q5dv_B-o">Brian Kernighan interviews Ken Thompson</a></li>

<li><a href="http://blog.netbsd.org/tnf/entry/improvements_in_forking_threading_and">Improvements in forking, threading, and signal code</a></li>

<li><a href="https://www.dragonflydigest.com/2019/05/21/22946.html">DragonFly 5.4.3</a></li>

<li><a href="https://magazine.odroid.com/article/netbsd-for-the-the-odroid-c2/">NetBSD on the Odroid C2</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Paulo - <a href="http://dpaste.com/3VXMGX8">Laptops</a></li>

<li>A Listener - <a href="http://dpaste.com/0SWJNRX#wrap">Thanks</a></li>

<li>Bostjan - <a href="http://dpaste.com/35NRF40#wrap">Extend a pool and lower RAM footprint</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0300.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 11.3-beta 1 is out, BSDCan 2019 recap, OpenIndiana 2019.04 is out, Overview of ZFS Pools in FreeNAS, why open source firmware is important for security, a new Opnsense release, wireguard on OpenBSD, and more. </p>

<h2 id="headlines">Headlines</h2>

<h3 id="freebsd113b1isouthttpslistsfreebsdorgpipermailfreebsdstable2019may091210html"><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-May/091210.html">FreeBSD 11.3-b1 is out</a></h3>

<h3 id="bsdcan2019recaphttpswwwbsdcanorg2019"><a href="https://www.bsdcan.org/2019/">BSDCan 2019 Recap</a></h3>

<ul>
<li>We’re back from BSDCan and it was a packed week as always.</li>

<li>It started with <a href="http://bhyvecon.org/">bhyvecon</a> on Tuesday. Meanwhile, Benedict spent the whole day in productive meetings: annual FreeBSD Foundation board meeting and FreeBSD Journal editorial board meeting.</li>

<li>On Wednesday, tutorials for BSDCan started as well as the <a href="https://wiki.freebsd.org/DevSummit/201905">FreeBSD Developer Summit</a>. In the mornings, there were presentations in the big auditorium, while working groups about networking, failsafe bootcode, development web services, swap space management, and testing/CI were held. Friday had a similar format with an update from the FreeBSD core team and the “have, need, want” session for FreeBSD 13. In the afternoon, there were working groups about translation tools, package base, GSoC/Outreachy, or general hacking. Benedict held his Icinga tutorial in the afternoon with about 15 people attending.
Devsummit presentation slides can be found on the wiki page and video recordings done by <a href="https://www.scaleengine.com/">ScaleEngine</a> are available on <a href="https://www.youtube.com/channel/UCxLxR_oW-NAmChIcSkAyZGQ">FreeBSD’s youtube channel</a>.</li>

<li>The conference program was a good mixture of sysadmin and tech talks across the major BSDs. Benedict saw the following talks: How ZFS snapshots really work by Matt Ahrens, 20 years in Jail by Michael W. Lucas, OpenZFS BOF session, the future of OpenZFS and FreeBSD, MQTT for system administrators by Jan-Piet Mens, and spent the rest of the time in between in the hallway track. </li>

<li>Photos from the event are available on <a href="https://www.talegraph.com/tales/Qg446T5bKT">Ollivier Robert’s talegraph
</a> and Diane Bruce’s website for <a href="http://www.db.net/gallery/BSDCan/2019_BSDCan_day_1_web/">day 1</a>, <a href="http://www.db.net/gallery/BSDCan/2019_FreeBSD_Dev_Summit_day_2_web">day 2</a>, <a href="http://www.db.net/gallery/BSDCan/2019_BSDCan_day_1_web">conference day 1</a>, and <a href="http://www.db.net/gallery/BSDCan/2019_BSDCan_day_2_web">conference day 2</a>.</li>

<li>Thanks to all the sponsors, supporters, organizers, speakers, and attendees for making this yet another great BSDCan. Next year’s BSDCan will be from June 2 - 6, 2020.</li>
</ul>

<p><hr /></p>

<h3 id="openindiana201904isouthttpswwwopenindianaorg20190512openindianahipster201904ishere"><a href="https://www.openindiana.org/2019/05/12/openindiana-hipster-2019-04-is-here/">OpenIndiana 2019.04 is out</a></h3>

<blockquote>
  <p>We have released a new OpenIndiana Hipster snapshot 2019.04. The noticeable changes:</p>
</blockquote>

<ul>
<li><p>Firefox was updated to 60.6.3 ESR</p></li>

<li><p>Virtualbox packages were added (including guest additions)</p></li>

<li><p>Mate was updated to 1.22</p></li>

<li><p>IPS has received updates from OmniOS CE and Oracle IPS repos, including automatic boot environment naming</p></li>

<li><p>Some OI-specific applications have been ported from Python 2.7/GTK 2 to Python 3.5/GTK 3</p></li>

<li><p>Quick Demo Video: https://www.youtube.com/watch?v=tQ0-fo3XNrg</p></li>
</ul>

<p><hr /></p>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="overviewofzfspoolsinfreenashttpswwwixsystemscomblogzfspoolsinfreenas"><a href="https://www.ixsystems.com/blog/zfs-pools-in-freenas/">Overview of ZFS Pools in FreeNAS</a></h3>

<blockquote>
  <p>FreeNAS uses the OpenZFS (ZFS) file system, which handles both disk and volume management. ZFS offers RAID options mirror, stripe, and its own parity distribution called RAIDZ that functions like RAID5 on hardware RAID. The file system is extremely flexible and secure, with various drive combinations, checksums, snapshots, and replication all possible. For a deeper dive on ZFS technology, read the ZFS Primer section of the FreeNAS documentation.</p>
  
  <p>SUGGEST LAYOUT attempts to balance usable capacity and redundancy by automatically choosing an ideal vdev layout for the number of available disks.</p>
</blockquote>

<ul>
<li>The following vdev layout options are available when creating a pool:


<ul>
<li>Stripe data is shared on two drives, similar to RAID0)</li>

<li>Mirror copies data on two drives, similar to RAID1 but not limited to 2 disks)</li>

<li>RAIDZ1 single parity similar to RAID5</li>

<li>RAIDZ2 double parity similar to RAID6</li>

<li>RAIDZ3 which uses triple parity and has no RAID equivalent</li></ul>
</li>
</ul>

<p><hr /></p>

<h3 id="whyopensourcefirmwareisimportantforsecurityhttpsblogjessfrazcompostwhyopensourcefirmwareisimportantforsecurity"><a href="https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-security/">Why OpenSource Firmware is Important for Security</a></h3>

<ul>
<li>Roots of Trust</li>
</ul>

<blockquote>
  <p>The goal of the root of trust should be to verify that the software installed in every component of the hardware is the software that was intended. This way you can know without a doubt and verify if hardware has been hacked. Since we have very little to no visibility into the code running in a lot of places in our hardware it is hard to do this. How do we really know that the firmware in a component is not vulnerable or that is doesn’t have any backdoors? Well we can’t. Not unless it was all open source.
  Every cloud and vendor seems to have their own way of doing a root of trust. Microsoft has Cerberus, Google has Titan, and Amazon has Nitro. These seem to assume an explicit amount of trust in the proprietary code (the code we cannot see). This leaves me with not a great feeling. Wouldn’t it be better to be able to use all open source code? Then we could verify without a doubt that the code you can read and build yourself is the same code running on hardware for all the various places we have firmware. We could then verify that a machine was in a correct state without a doubt of it being vulnerable or with a backdoor.
  It makes me wonder what the smaller cloud providers like DigitalOcean or Packet have for a root of trust. Often times we only hear of these projects from the big three or five. </p>
</blockquote>

<p><hr /></p>

<h3 id="opnsensehttpsopnsenseorgopnsense1918released"><a href="https://opnsense.org/opnsense-19-1-8-released/">OPNsense</a></h3>

<blockquote>
  <p>This update addresses several privilege escalation issues in the access control implementation and new memory disclosure issues in Intel CPUs. We would like to thank Arnaud Cordier and Bill Marquette for the top-notch reports and coordination.</p>
</blockquote>

<ul>
<li><p>Here are the full patch notes:</p></li>

<li><p>system: address CVE-2019-11816 privilege escalation bugs[1] (reported by Arnaud Cordier)</p></li>

<li><p>system: /etc/hosts generation without interface<em>has</em>gateway()</p></li>

<li><p>system: show correct timestamp in config restore save message (contributed by nhirokinet)</p></li>

<li><p>system: list the commands for the pluginctl utility when n+ argument is given</p></li>

<li><p>system: introduce and use userIsAdmin() helper function instead of checking for 'page-all' privilege directly</p></li>

<li><p>system: use absolute path in widget ACLs (reported by Netgate)</p></li>

<li><p>system: RRD-related cleanups for less code exposure</p></li>

<li><p>interfaces: add EN DUID Generation using OPNsense PEN (contributed by Team Rebellion)</p></li>

<li><p>interfaces: replace legacy<em>getall</em>interface_addresses() usage</p></li>

<li><p>firewall: fix port validation in aliases with leading / trailing spaces</p></li>

<li><p>firewall: fix outbound NAT translation display in overview page</p></li>

<li><p>firewall: prevent CARP outgoing packets from using the configured gateway</p></li>

<li><p>firewall: use CARP net.inet.carp.demotion to control current demotion in status page</p></li>

<li><p>firewall: stop live log poller on error result</p></li>

<li><p>dhcpd: change rule priority to 1 to avoid bogon clash</p></li>

<li><p>dnsmasq: only admins may edit custom options field</p></li>

<li><p>firmware: use insecure mode for base and kernel sets when package fingerprints are disabled</p></li>

<li><p>firmware: add optional device support for base and kernel sets</p></li>

<li><p>firmware: add Hostcentral mirror (HTTP, Melbourne, Australia)</p></li>

<li><p>ipsec: always reset rightallowany to default when writing configuration</p></li>

<li><p>lang: say "hola" to Spanish as the newest available GUI language</p></li>

<li><p>lang: updates for Chinese, Czech, Japanese, German, French, Russian and Portuguese</p></li>

<li><p>network time: only admins may edit custom options field</p></li>

<li><p>openvpn: call openvpn<em>refresh</em>crls() indirectly via plugin_configure() for less code exposure</p></li>

<li><p>openvpn: only admins may edit custom options field to prevent privilege escalation (reported by Bill Marquette)</p></li>

<li><p>openvpn: remove custom options field from wizard</p></li>

<li><p>unbound: only admins may edit custom options field</p></li>

<li><p>wizard: translate typehint as well</p></li>

<li><p>plugins: os-freeradius 1.9.3 fixes string interpolation in LDAP filters (contributed by theq86)</p></li>

<li><p>plugins: os-nginx 1.12[2]</p></li>

<li><p>plugins: os-theme-cicada 1.17 (contributed by Team Rebellion)</p></li>

<li><p>plugins: os-theme-tukan 1.17 (contributed by Team Rebellion)</p></li>

<li><p>src: timezone database information update[3]</p></li>

<li><p>src: install(1) broken with partially matching relative paths[4]</p></li>

<li><p>src: microarchitectural Data Sampling (MDS) mitigation[5]</p></li>

<li><p>ports: ca<em>root</em>nss 3.44</p></li>

<li><p>ports: php 7.2.18[6]</p></li>

<li><p>ports: sqlite 3.28.0[7]</p></li>

<li><p>ports: strongswan custom XAuth generic patch removed</p></li>
</ul>

<p><hr /></p>

<h3 id="wiregaurdonopenbsdhttpsblogjasperlawireguardonopenbsdhtml"><a href="https://blog.jasper.la/wireguard-on-openbsd.html">wiregaurd on OpenBSD</a></h3>

<blockquote>
  <p>Earlier this week I imported a port for WireGuard into the OpenBSD ports tree. At the moment we have the userland daemon and the tools available. The in-kernel implementation is only available for Linux. At the time of writing there are packages available for -current.
  Jason A. Donenfeld (WireGuard author) has worked to support OpenBSD in WireGuard and as such his post on ports@ last year got me interested in WireGuard, since then others have toyed with WireGuard on OpenBSD before and as such I've used Ted's article as a reference. Note however that some of the options mentioned there are no longer valid. Also, I'll be using two OpenBSD peers here.
  The setup will be as follows: two OpenBSD peers, of which we'll dub wg1 the server and wg2 the client. The WireGuard service on wg1 is listening on 100.64.4.3:51820.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
  <p>WireGuard (cl)aims to be easier to setup and faster than OpenVPN and while I haven't been able to verify the latter, the first is certainly true...once you've figured it out. Most documentation out there is for Linux so I had to figure out the wireguard<em>go service and the tun parameters. But all in all, sure, it's easier. Especially the client configuration on iOS which I didn't cover here because it's essentially pkg</em>add libqrencode ; cat client.conf | qrencode -t ansiutf8, scan the code with the WireGuard app and you're good to go. What is particularly neat is that WireGuard on iOS supports Always-on.</p>
</blockquote>

<p><hr /></p>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://github.com/SerenityOS/serenity">Serenity OS</a></li>

<li><a href="https://www.dragonflydigest.com/2019/05/27/22985.html">vkernels vs pmap</a></li>

<li><a href="https://www.youtube.com/watch?v=EY6q5dv_B-o">Brian Kernighan interviews Ken Thompson</a></li>

<li><a href="http://blog.netbsd.org/tnf/entry/improvements_in_forking_threading_and">Improvements in forking, threading, and signal code</a></li>

<li><a href="https://www.dragonflydigest.com/2019/05/21/22946.html">DragonFly 5.4.3</a></li>

<li><a href="https://magazine.odroid.com/article/netbsd-for-the-the-odroid-c2/">NetBSD on the Odroid C2</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Paulo - <a href="http://dpaste.com/3VXMGX8">Laptops</a></li>

<li>A Listener - <a href="http://dpaste.com/0SWJNRX#wrap">Thanks</a></li>

<li>Bostjan - <a href="http://dpaste.com/35NRF40#wrap">Extend a pool and lower RAM footprint</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0300.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>299: The NAS Fleet</title>
  <link>https://www.bsdnow.tv/299</link>
  <guid isPermaLink="false">22eb77a0-e162-4fce-bb37-987c1d34c477</guid>
  <pubDate>Wed, 22 May 2019 14:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/22eb77a0-e162-4fce-bb37-987c1d34c477.mp3" length="32188343" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Running AIX on QEMU on Linux on Windows, your NAS fleet with TrueCommand, Unleashed 1.3 is available, LLDB: CPU register inspection support extension, V7 Unix programs often not written as expected, and more.</itunes:subtitle>
  <itunes:duration>52:47</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Running AIX on QEMU on Linux on Windows, your NAS fleet with TrueCommand, Unleashed 1.3 is available, LLDB: CPU register inspection support extension, V7 Unix programs often not written as expected, and more.
&lt;h2&gt;Headlines&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://virtuallyfun.com/wordpress/2019/04/22/installing-aix-on-qemu/"&gt;Running AiX on QEMU on Linux on Windows&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;YES it’s real!
  I’m using the Linux subsystem on Windows, as it’s easier to build this Qemu tree from source. I’m using Debian, but these steps will work on other systems that use Debian as a base.
  first thing first, you need to get your system with the needed pre-requisites to compile
  Great with those in place, now clone Artyom Tarasenko’s source repository
  Since the frame buffer apparently isn’t quite working just yet, I configure for something more like a text mode build.
  Now for me, GCC 7 didn’t build the source cleanly. I had to make a change to the file config-host.mak and remove all references to -Werror. Also I removed the sound hooks, as we won’t need them.
  Now you can build Qemu.
  Okay, all being well you now have a Qemu. Now following the steps from Artyom Tarasenko’s blog post, we can get started on the install!&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;See article for rest of walkthrough.&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.ixsystems.com/blog/truecommand/"&gt;Take Command of Your NAS Fleet with TrueCommand&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Hundreds of thousands of FreeNAS and TrueNAS systems are deployed around the world, with many sites having dozens of systems.  Managing multiple systems individually can be time-consuming. iXsystems has responded to the challenge by creating a “single pane of glass” application to simplify the scaling of data, drive management, and administration of iXsystems NAS platforms. We are proud to introduce TrueCommand.
  TrueCommand is a ZFS-aware management application that manages TrueNAS and FreeNAS systems. 
  The public Beta of TrueCommand is available for download now. TrueCommand can be used with small iXsystems NAS fleets for free. Licenses can be purchased for large-scale deployments and enterprise support.
  TrueCommand expands on the ease of use and power of TrueNAS and FreeNAS systems with multi-system management and reporting.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="http://lists.31bits.net/archives/devel/2019-April/000052.html"&gt;Unleashed 1.3 Released&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;This is the fourth release of Unleashed - an operating system fork of illumos.  For more information about Unleashed itself and the download links, see our website.
  As one might expect, this release removes a few things.
  The most notable being the removal of ksh93 along with all its libs.
  As far as libc interfaces are concerned, a number of non-standard functions were removed.  In general, they have been replaced by the standards-compliant versions.  (getgrent&lt;em&gt;r, fgetgrent&lt;/em&gt;r, getgrgid&lt;em&gt;r, getgrnam&lt;/em&gt;r, ttyname&lt;em&gt;r, getlogin&lt;/em&gt;r, shmdt, sigwait, gethostname, putmsg, putpmsg, and getaddrinfo)
  Additionally, wordexp and wordfree have been removed from libc.  Even though they are technically required by POSIX, software doesn't seem to use them. Because of the fragile implementation (shelling out), we took the OpenBSD approach and just removed them.
  The default compilation environment now includes &lt;em&gt;XOPEN&lt;/em&gt;SOURCE=700 and &lt;strong&gt;EXTENSIONS&lt;/strong&gt;.  Additionally, all applications now use 64-bit file offsets, making use of &lt;em&gt;LARGEFILE&lt;/em&gt;SOURCE, &lt;em&gt;LARGEFILE64&lt;/em&gt;SOURCE, and &lt;em&gt;FILE&lt;/em&gt;OFFSET_BITS unnecessary.
  Last but not least, nightly.sh is no more.  In short, to build one simply runs 'make'.  (See README for detailed build instructions.)&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.unleashed-os.org/why.html"&gt;Why Unleashed&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Why did we decide to fork illumos? After all, there are already many illumos distributions available to choose from. We felt we could do better than any of them by taking a more aggressive stance toward compatibility and reducing cruft from code and community interactions alike.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="http://blog.netbsd.org/tnf/entry/lldb_extending_cpu_register_inspection"&gt;LLDB: extending CPU register inspection support&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.
  In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and updating NetBSD distribution to LLVM 8 (which is still stalled by unresolved regressions in inline assembly syntax). You can read more about that in my Mar 2019 report.
  In April, my main focus was on fixing and enhancing the support for reading and writing CPU registers. In this report, I'd like to shortly summarize what I have done, what I have learned in the process and what I still need to do.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Future plans&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;My work continues with the two milestones from last month, plus a third that's closely related:
  Add support for FPU registers support for NetBSD/i386 and NetBSD/amd64.
  Support XSAVE, XSAVEOPT, ... registers in core(5) files on NetBSD/amd64.
  Add support for Debug Registers support for NetBSD/i386 and NetBSD/amd64.
  The most important point right now is deciding on the format for passing the remaining registers, and implementing the missing ptrace interface kernel-side. The support for core files should follow using the same format then.
  Userland-side, I will work on adding matching ATF tests for ptrace features and implement LLDB side of support for the new ptrace interface and core file notes. Afterwards, I will start working on improving support for the same things on 32-bit (i386) executables.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/unix/EdV7CodedUnusually"&gt;V7 Unix programs are often not written the way you would expect&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Yesterday I wrote that V7 ed read its terminal input in cooked mode a line at a time, which was an efficient, low-CPU design that was important on V7's small and low-power hardware. Then in comments, frankg pointed out that I was wrong about part of that, namely about how ed read its input.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Sidebar: An interesting undocumented ed feature&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Reading this section of the source code for ed taught me that it has an interesting, undocumented, and entirely characteristic little behavior. Officially, ed commands that have you enter new text have that new text terminate by a . on a line by itself:&lt;/p&gt;
  
  &lt;p&gt;In other words, it turns a single line with '.' into an EOF. The consequence of this is that if you type a real EOF at the start of a line, you get the same result, thus saving you one character (you use Control-D instead of '.' plus newline). This is very V7 Unix behavior, including the lack of documentation.&lt;/p&gt;
  
  &lt;p&gt;This is also a natural behavior in one sense. A proper program has to react to EOF here in some way, and it might as well do so by ending the input mode. It's also natural to go on to try reading from the terminal again for subsequent commands; if this was a real and persistent EOF, for example because the pty closed, you'll just get EOF again and eventually quit. V7 ed is slightly unusual here in that it deliberately converts '.' by itself to EOF, instead of signaling this in a different way, but in a way that's also the simplest approach; if you have to have some signal for each case and you're going to treat them the same, you might as well have the same signal for both cases.&lt;/p&gt;
  
  &lt;p&gt;Modern versions of ed appear to faithfully reimplement this convenient behavior, although they don't appear to document it. I haven't checked OpenBSD, but both FreeBSD ed and GNU ed work like this in a quick test. I haven't checked their source code to see if they implement it the same way.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://lteo.net/blog/2019/04/27/carolinacon-15-writing-exploit-resistant-code-with-openbsd/"&gt;CarolinaCon 15: Writing Exploit-Resistant Code With OpenBSD&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-pkgbase/2019-April/000396.html"&gt;CFT: FreeBSD Package Base&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://www.dragonflydigest.com/2019/05/02/22862.html"&gt;Initial FUSE support in DragonFly&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://www.dragonflydigest.com/2019/05/03/22869.html"&gt;Two significant bugfixes for 5.4&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://www.reddit.com/r/openbsd/comments/bkb2zk/surprised_this_can_still_run_current/"&gt;Libretto 100ct: 166mhz Pentium, 16gb compactflash, 32mb ram running OpenBSD&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;DJ - &lt;a href="http://dpaste.com/0DSYJAH#wrap"&gt;Feedback&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Fabian - &lt;a href="http://dpaste.com/2EC7S10#wrap"&gt;ZFS ARC&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Caleb - &lt;a href="http://dpaste.com/3ZX177B#wrap"&gt;Question&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;A small programming note: After BSDNow episode 300, the podcast will switch to audio-only, using a new higher quality recording and production system. The live stream will likely still include video.&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, aix, qemu, true command, nas, unleashed, lldb, v7</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Running AIX on QEMU on Linux on Windows, your NAS fleet with TrueCommand, Unleashed 1.3 is available, LLDB: CPU register inspection support extension, V7 Unix programs often not written as expected, and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="runningaixonqemuonlinuxonwindowshttpsvirtuallyfuncomwordpress20190422installingaixonqemu"><a href="https://virtuallyfun.com/wordpress/2019/04/22/installing-aix-on-qemu/">Running AiX on QEMU on Linux on Windows</a></h3>

<blockquote>
  <p>YES it’s real!
  I’m using the Linux subsystem on Windows, as it’s easier to build this Qemu tree from source. I’m using Debian, but these steps will work on other systems that use Debian as a base.
  first thing first, you need to get your system with the needed pre-requisites to compile
  Great with those in place, now clone Artyom Tarasenko’s source repository
  Since the frame buffer apparently isn’t quite working just yet, I configure for something more like a text mode build.
  Now for me, GCC 7 didn’t build the source cleanly. I had to make a change to the file config-host.mak and remove all references to -Werror. Also I removed the sound hooks, as we won’t need them.
  Now you can build Qemu.
  Okay, all being well you now have a Qemu. Now following the steps from Artyom Tarasenko’s blog post, we can get started on the install!</p>
</blockquote>

<ul>
<li>See article for rest of walkthrough.</li>
</ul>

<p><hr /></p>

<h3 id="takecommandofyournasfleetwithtruecommandhttpswwwixsystemscomblogtruecommand"><a href="https://www.ixsystems.com/blog/truecommand/">Take Command of Your NAS Fleet with TrueCommand</a></h3>

<blockquote>
  <p>Hundreds of thousands of FreeNAS and TrueNAS systems are deployed around the world, with many sites having dozens of systems.  Managing multiple systems individually can be time-consuming. iXsystems has responded to the challenge by creating a “single pane of glass” application to simplify the scaling of data, drive management, and administration of iXsystems NAS platforms. We are proud to introduce TrueCommand.
  TrueCommand is a ZFS-aware management application that manages TrueNAS and FreeNAS systems. 
  The public Beta of TrueCommand is available for download now. TrueCommand can be used with small iXsystems NAS fleets for free. Licenses can be purchased for large-scale deployments and enterprise support.
  TrueCommand expands on the ease of use and power of TrueNAS and FreeNAS systems with multi-system management and reporting.</p>
</blockquote>

<p><hr /></p>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="unleashed13releasedhttplists31bitsnetarchivesdevel2019april000052html"><a href="http://lists.31bits.net/archives/devel/2019-April/000052.html">Unleashed 1.3 Released</a></h3>

<blockquote>
  <p>This is the fourth release of Unleashed - an operating system fork of illumos.  For more information about Unleashed itself and the download links, see our website.
  As one might expect, this release removes a few things.
  The most notable being the removal of ksh93 along with all its libs.
  As far as libc interfaces are concerned, a number of non-standard functions were removed.  In general, they have been replaced by the standards-compliant versions.  (getgrent<em>r, fgetgrent</em>r, getgrgid<em>r, getgrnam</em>r, ttyname<em>r, getlogin</em>r, shmdt, sigwait, gethostname, putmsg, putpmsg, and getaddrinfo)
  Additionally, wordexp and wordfree have been removed from libc.  Even though they are technically required by POSIX, software doesn't seem to use them. Because of the fragile implementation (shelling out), we took the OpenBSD approach and just removed them.
  The default compilation environment now includes <em>XOPEN</em>SOURCE=700 and <strong>EXTENSIONS</strong>.  Additionally, all applications now use 64-bit file offsets, making use of <em>LARGEFILE</em>SOURCE, <em>LARGEFILE64</em>SOURCE, and <em>FILE</em>OFFSET_BITS unnecessary.
  Last but not least, nightly.sh is no more.  In short, to build one simply runs 'make'.  (See README for detailed build instructions.)</p>
</blockquote>

<ul>
<li><a href="https://www.unleashed-os.org/why.html">Why Unleashed</a></li>
</ul>

<blockquote>
  <p>Why did we decide to fork illumos? After all, there are already many illumos distributions available to choose from. We felt we could do better than any of them by taking a more aggressive stance toward compatibility and reducing cruft from code and community interactions alike.</p>
</blockquote>

<p><hr /></p>

<h3 id="lldbextendingcpuregisterinspectionsupporthttpblognetbsdorgtnfentrylldb_extending_cpu_register_inspection"><a href="http://blog.netbsd.org/tnf/entry/lldb_extending_cpu_register_inspection">LLDB: extending CPU register inspection support</a></h3>

<blockquote>
  <p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.
  In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and updating NetBSD distribution to LLVM 8 (which is still stalled by unresolved regressions in inline assembly syntax). You can read more about that in my Mar 2019 report.
  In April, my main focus was on fixing and enhancing the support for reading and writing CPU registers. In this report, I'd like to shortly summarize what I have done, what I have learned in the process and what I still need to do.</p>
</blockquote>

<ul>
<li>Future plans</li>
</ul>

<blockquote>
  <p>My work continues with the two milestones from last month, plus a third that's closely related:
  Add support for FPU registers support for NetBSD/i386 and NetBSD/amd64.
  Support XSAVE, XSAVEOPT, ... registers in core(5) files on NetBSD/amd64.
  Add support for Debug Registers support for NetBSD/i386 and NetBSD/amd64.
  The most important point right now is deciding on the format for passing the remaining registers, and implementing the missing ptrace interface kernel-side. The support for core files should follow using the same format then.
  Userland-side, I will work on adding matching ATF tests for ptrace features and implement LLDB side of support for the new ptrace interface and core file notes. Afterwards, I will start working on improving support for the same things on 32-bit (i386) executables.</p>
</blockquote>

<p><hr /></p>

<h3 id="v7unixprogramsareoftennotwrittenthewayyouwouldexpecthttpsutccutorontocatcksspaceblogunixedv7codedunusually"><a href="https://utcc.utoronto.ca/~cks/space/blog/unix/EdV7CodedUnusually">V7 Unix programs are often not written the way you would expect</a></h3>

<blockquote>
  <p>Yesterday I wrote that V7 ed read its terminal input in cooked mode a line at a time, which was an efficient, low-CPU design that was important on V7's small and low-power hardware. Then in comments, frankg pointed out that I was wrong about part of that, namely about how ed read its input.</p>
</blockquote>

<ul>
<li>Sidebar: An interesting undocumented ed feature</li>
</ul>

<blockquote>
  <p>Reading this section of the source code for ed taught me that it has an interesting, undocumented, and entirely characteristic little behavior. Officially, ed commands that have you enter new text have that new text terminate by a . on a line by itself:</p>
  
  <p>In other words, it turns a single line with '.' into an EOF. The consequence of this is that if you type a real EOF at the start of a line, you get the same result, thus saving you one character (you use Control-D instead of '.' plus newline). This is very V7 Unix behavior, including the lack of documentation.</p>
  
  <p>This is also a natural behavior in one sense. A proper program has to react to EOF here in some way, and it might as well do so by ending the input mode. It's also natural to go on to try reading from the terminal again for subsequent commands; if this was a real and persistent EOF, for example because the pty closed, you'll just get EOF again and eventually quit. V7 ed is slightly unusual here in that it deliberately converts '.' by itself to EOF, instead of signaling this in a different way, but in a way that's also the simplest approach; if you have to have some signal for each case and you're going to treat them the same, you might as well have the same signal for both cases.</p>
  
  <p>Modern versions of ed appear to faithfully reimplement this convenient behavior, although they don't appear to document it. I haven't checked OpenBSD, but both FreeBSD ed and GNU ed work like this in a quick test. I haven't checked their source code to see if they implement it the same way.</p>
  
  <hr />
</blockquote>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://lteo.net/blog/2019/04/27/carolinacon-15-writing-exploit-resistant-code-with-openbsd/">CarolinaCon 15: Writing Exploit-Resistant Code With OpenBSD</a></li>

<li><a href="https://lists.freebsd.org/pipermail/freebsd-pkgbase/2019-April/000396.html">CFT: FreeBSD Package Base</a></li>

<li><a href="https://www.dragonflydigest.com/2019/05/02/22862.html">Initial FUSE support in DragonFly</a></li>

<li><a href="https://www.dragonflydigest.com/2019/05/03/22869.html">Two significant bugfixes for 5.4</a></li>

<li><a href="https://www.reddit.com/r/openbsd/comments/bkb2zk/surprised_this_can_still_run_current/">Libretto 100ct: 166mhz Pentium, 16gb compactflash, 32mb ram running OpenBSD</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>DJ - <a href="http://dpaste.com/0DSYJAH#wrap">Feedback</a></li>

<li>Fabian - <a href="http://dpaste.com/2EC7S10#wrap">ZFS ARC</a></li>

<li>Caleb - <a href="http://dpaste.com/3ZX177B#wrap">Question</a></li>

<li>A small programming note: After BSDNow episode 300, the podcast will switch to audio-only, using a new higher quality recording and production system. The live stream will likely still include video.</li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0299.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Running AIX on QEMU on Linux on Windows, your NAS fleet with TrueCommand, Unleashed 1.3 is available, LLDB: CPU register inspection support extension, V7 Unix programs often not written as expected, and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="runningaixonqemuonlinuxonwindowshttpsvirtuallyfuncomwordpress20190422installingaixonqemu"><a href="https://virtuallyfun.com/wordpress/2019/04/22/installing-aix-on-qemu/">Running AiX on QEMU on Linux on Windows</a></h3>

<blockquote>
  <p>YES it’s real!
  I’m using the Linux subsystem on Windows, as it’s easier to build this Qemu tree from source. I’m using Debian, but these steps will work on other systems that use Debian as a base.
  first thing first, you need to get your system with the needed pre-requisites to compile
  Great with those in place, now clone Artyom Tarasenko’s source repository
  Since the frame buffer apparently isn’t quite working just yet, I configure for something more like a text mode build.
  Now for me, GCC 7 didn’t build the source cleanly. I had to make a change to the file config-host.mak and remove all references to -Werror. Also I removed the sound hooks, as we won’t need them.
  Now you can build Qemu.
  Okay, all being well you now have a Qemu. Now following the steps from Artyom Tarasenko’s blog post, we can get started on the install!</p>
</blockquote>

<ul>
<li>See article for rest of walkthrough.</li>
</ul>

<p><hr /></p>

<h3 id="takecommandofyournasfleetwithtruecommandhttpswwwixsystemscomblogtruecommand"><a href="https://www.ixsystems.com/blog/truecommand/">Take Command of Your NAS Fleet with TrueCommand</a></h3>

<blockquote>
  <p>Hundreds of thousands of FreeNAS and TrueNAS systems are deployed around the world, with many sites having dozens of systems.  Managing multiple systems individually can be time-consuming. iXsystems has responded to the challenge by creating a “single pane of glass” application to simplify the scaling of data, drive management, and administration of iXsystems NAS platforms. We are proud to introduce TrueCommand.
  TrueCommand is a ZFS-aware management application that manages TrueNAS and FreeNAS systems. 
  The public Beta of TrueCommand is available for download now. TrueCommand can be used with small iXsystems NAS fleets for free. Licenses can be purchased for large-scale deployments and enterprise support.
  TrueCommand expands on the ease of use and power of TrueNAS and FreeNAS systems with multi-system management and reporting.</p>
</blockquote>

<p><hr /></p>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="unleashed13releasedhttplists31bitsnetarchivesdevel2019april000052html"><a href="http://lists.31bits.net/archives/devel/2019-April/000052.html">Unleashed 1.3 Released</a></h3>

<blockquote>
  <p>This is the fourth release of Unleashed - an operating system fork of illumos.  For more information about Unleashed itself and the download links, see our website.
  As one might expect, this release removes a few things.
  The most notable being the removal of ksh93 along with all its libs.
  As far as libc interfaces are concerned, a number of non-standard functions were removed.  In general, they have been replaced by the standards-compliant versions.  (getgrent<em>r, fgetgrent</em>r, getgrgid<em>r, getgrnam</em>r, ttyname<em>r, getlogin</em>r, shmdt, sigwait, gethostname, putmsg, putpmsg, and getaddrinfo)
  Additionally, wordexp and wordfree have been removed from libc.  Even though they are technically required by POSIX, software doesn't seem to use them. Because of the fragile implementation (shelling out), we took the OpenBSD approach and just removed them.
  The default compilation environment now includes <em>XOPEN</em>SOURCE=700 and <strong>EXTENSIONS</strong>.  Additionally, all applications now use 64-bit file offsets, making use of <em>LARGEFILE</em>SOURCE, <em>LARGEFILE64</em>SOURCE, and <em>FILE</em>OFFSET_BITS unnecessary.
  Last but not least, nightly.sh is no more.  In short, to build one simply runs 'make'.  (See README for detailed build instructions.)</p>
</blockquote>

<ul>
<li><a href="https://www.unleashed-os.org/why.html">Why Unleashed</a></li>
</ul>

<blockquote>
  <p>Why did we decide to fork illumos? After all, there are already many illumos distributions available to choose from. We felt we could do better than any of them by taking a more aggressive stance toward compatibility and reducing cruft from code and community interactions alike.</p>
</blockquote>

<p><hr /></p>

<h3 id="lldbextendingcpuregisterinspectionsupporthttpblognetbsdorgtnfentrylldb_extending_cpu_register_inspection"><a href="http://blog.netbsd.org/tnf/entry/lldb_extending_cpu_register_inspection">LLDB: extending CPU register inspection support</a></h3>

<blockquote>
  <p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.
  In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and updating NetBSD distribution to LLVM 8 (which is still stalled by unresolved regressions in inline assembly syntax). You can read more about that in my Mar 2019 report.
  In April, my main focus was on fixing and enhancing the support for reading and writing CPU registers. In this report, I'd like to shortly summarize what I have done, what I have learned in the process and what I still need to do.</p>
</blockquote>

<ul>
<li>Future plans</li>
</ul>

<blockquote>
  <p>My work continues with the two milestones from last month, plus a third that's closely related:
  Add support for FPU registers support for NetBSD/i386 and NetBSD/amd64.
  Support XSAVE, XSAVEOPT, ... registers in core(5) files on NetBSD/amd64.
  Add support for Debug Registers support for NetBSD/i386 and NetBSD/amd64.
  The most important point right now is deciding on the format for passing the remaining registers, and implementing the missing ptrace interface kernel-side. The support for core files should follow using the same format then.
  Userland-side, I will work on adding matching ATF tests for ptrace features and implement LLDB side of support for the new ptrace interface and core file notes. Afterwards, I will start working on improving support for the same things on 32-bit (i386) executables.</p>
</blockquote>

<p><hr /></p>

<h3 id="v7unixprogramsareoftennotwrittenthewayyouwouldexpecthttpsutccutorontocatcksspaceblogunixedv7codedunusually"><a href="https://utcc.utoronto.ca/~cks/space/blog/unix/EdV7CodedUnusually">V7 Unix programs are often not written the way you would expect</a></h3>

<blockquote>
  <p>Yesterday I wrote that V7 ed read its terminal input in cooked mode a line at a time, which was an efficient, low-CPU design that was important on V7's small and low-power hardware. Then in comments, frankg pointed out that I was wrong about part of that, namely about how ed read its input.</p>
</blockquote>

<ul>
<li>Sidebar: An interesting undocumented ed feature</li>
</ul>

<blockquote>
  <p>Reading this section of the source code for ed taught me that it has an interesting, undocumented, and entirely characteristic little behavior. Officially, ed commands that have you enter new text have that new text terminate by a . on a line by itself:</p>
  
  <p>In other words, it turns a single line with '.' into an EOF. The consequence of this is that if you type a real EOF at the start of a line, you get the same result, thus saving you one character (you use Control-D instead of '.' plus newline). This is very V7 Unix behavior, including the lack of documentation.</p>
  
  <p>This is also a natural behavior in one sense. A proper program has to react to EOF here in some way, and it might as well do so by ending the input mode. It's also natural to go on to try reading from the terminal again for subsequent commands; if this was a real and persistent EOF, for example because the pty closed, you'll just get EOF again and eventually quit. V7 ed is slightly unusual here in that it deliberately converts '.' by itself to EOF, instead of signaling this in a different way, but in a way that's also the simplest approach; if you have to have some signal for each case and you're going to treat them the same, you might as well have the same signal for both cases.</p>
  
  <p>Modern versions of ed appear to faithfully reimplement this convenient behavior, although they don't appear to document it. I haven't checked OpenBSD, but both FreeBSD ed and GNU ed work like this in a quick test. I haven't checked their source code to see if they implement it the same way.</p>
  
  <hr />
</blockquote>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://lteo.net/blog/2019/04/27/carolinacon-15-writing-exploit-resistant-code-with-openbsd/">CarolinaCon 15: Writing Exploit-Resistant Code With OpenBSD</a></li>

<li><a href="https://lists.freebsd.org/pipermail/freebsd-pkgbase/2019-April/000396.html">CFT: FreeBSD Package Base</a></li>

<li><a href="https://www.dragonflydigest.com/2019/05/02/22862.html">Initial FUSE support in DragonFly</a></li>

<li><a href="https://www.dragonflydigest.com/2019/05/03/22869.html">Two significant bugfixes for 5.4</a></li>

<li><a href="https://www.reddit.com/r/openbsd/comments/bkb2zk/surprised_this_can_still_run_current/">Libretto 100ct: 166mhz Pentium, 16gb compactflash, 32mb ram running OpenBSD</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>DJ - <a href="http://dpaste.com/0DSYJAH#wrap">Feedback</a></li>

<li>Fabian - <a href="http://dpaste.com/2EC7S10#wrap">ZFS ARC</a></li>

<li>Caleb - <a href="http://dpaste.com/3ZX177B#wrap">Question</a></li>

<li>A small programming note: After BSDNow episode 300, the podcast will switch to audio-only, using a new higher quality recording and production system. The live stream will likely still include video.</li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0299.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>298: BSD On The Road</title>
  <link>https://www.bsdnow.tv/298</link>
  <guid isPermaLink="false">85a43874-a080-4a57-9fb0-2a0210e9718e</guid>
  <pubDate>Wed, 15 May 2019 23:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/85a43874-a080-4a57-9fb0-2a0210e9718e.mp3" length="31937689" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>36 year old UFS bug fixed, a BSD for the road, automatic upgrades with OpenBSD, DTrace ext2fs support in FreeBSD, Dedicated SSH tunnel user, upgrading VMM VMs to OpenBSD 6.5, and more.</itunes:subtitle>
  <itunes:duration>52:22</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>36 year old UFS bug fixed, a BSD for the road, automatic upgrades with OpenBSD, DTrace ext2fs support in FreeBSD, Dedicated SSH tunnel user, upgrading VMM VMs to OpenBSD 6.5, and more.
&lt;h2&gt;Headlines&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=347066"&gt;36+ year old bug in FFS/UFS discovered and patched &lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;This update eliminates a kernel stack disclosure bug in UFS/FFS directory entries that is caused by uninitialized directory entry padding written to the disk.&lt;/p&gt;
  
  &lt;ul&gt;
  &lt;li&gt;When the directory entry is written to disk, it is written as a full 32bit entry, and the unused bytes were not initialized, so could possibly contain sensitive data from the kernel stack
  It can be viewed by any user with read access to that directory. Up to 3 bytes of kernel stack are disclosed per file entry, depending on the the amount of padding the kernel needs to pad out the entry to a 32 bit boundary. The offset in the kernel stack that is disclosed is a function of the filename size. Furthermore, if the user can create files in a directory, this 3 byte window can be expanded 3 bytes at a time to a 254 byte window with 75% of the data in that window exposed. The additional exposure is done by removing the entry, creating a new entry with a 4-byte longer name, extracting 3 more bytes by reading the directory, and repeating until a 252 byte name is created.
  This exploit works in part because the area of the kernel stack that is being disclosed is in an area that typically doesn't change that often (perhaps a few times a second on a lightly loaded system), and these file creates and unlinks themselves don't overwrite the area of kernel stack being disclosed.
  It appears that this bug originated with the creation of the Fast File System in 4.1b-BSD (Circa 1982, more than 36 years ago!), and is likely present in every Unix or Unix-like system that uses UFS/FFS. Amazingly, nobody noticed until now.
  This update also adds the -z flag to fsck_ffs to have it scrub the leaked information in the name padding of existing directories. It only needs to be run once on each UFS/FFS filesystem after a patched kernel is installed and running.
  Submitted by: David G. Lawrence &lt;a href="mailto:dg@dglawrence.com"&gt;dg@dglawrence.com&lt;/a&gt;
&lt;/li&gt;
  
  &lt;li&gt;So a patched kernel will no longer leak this data, and running the &lt;code&gt;fsck_ffs -z&lt;/code&gt; command will erase any leaked data that may exist on your system&lt;/li&gt;
  
  &lt;li&gt;
&lt;a href="https://marc.info/?l=openbsd-cvs&amp;amp;m=155699268122858&amp;amp;w=2"&gt;OpenBSD commit with additional detail on mitigations&lt;/a&gt;
  The impact on OpenBSD is very limited:
  1 - such stack bytes can be found in raw-device reads, from group operator. If you can read the raw disks you can undertake other more powerful actions.
  2 - read(2) upon directory fd was disabled July 1997 because I didn't like how grep * would display garbage and mess up the tty, and applying vis(3) for just directory reads seemed silly.  read(2) was changed to return 0 (EOF).  Sep 2016 this was further changed to EISDIR, so you still cannot see the bad bytes.
  3 - In 2013 when guenther adapted the getdents(2) directory-reading system call to 64-bit ino_t, the userland data format changed to 8-byte-alignment, making it incompatible with the 4-byte-alignment UFS on-disk format.  As a result of code refactoring the bad bytes were not copied to userland. Bad bytes will remain in old directories on old filesystems, but nothing makes those bytes user visible.
  There will be no errata or syspatch issued.  I urge other systems which do expose the information to userland to issue errata quickly, since this is a 254 byte infoleak of the stack which is great for ROP-chain building to attack some other bug. Especially if the kernel has no layout/link-order randomization ...&lt;/li&gt;
  &lt;/ul&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://itsfoss.com/nomadbsd/"&gt;NomadBSD, a BSD for the Road&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;As regular It’s FOSS readers should know, I like diving into the world of BSDs. Recently, I came across an interesting BSD that is designed to live on a thumb drive. Let’s take a look at NomadBSD.
  NomadBSD is different than most available BSDs. NomadBSD is a live system based on FreeBSD. It comes with automatic hardware detection and an initial config tool. NomadBSD is designed to “be used as a desktop system that works out of the box, but can also be used for data recovery, for educational purposes, or to test FreeBSD’s hardware compatibility.”
  This German BSD comes with an OpenBox-based desktop with the Plank application dock. NomadBSD makes use of the DSB project. DSB stands for “Desktop Suite (for) (Free)BSD” and consists of a collection of programs designed to create a simple and working environment without needing a ton of dependencies to use one tool. DSB is created by Marcel Kaiser one of the lead devs of NomadBSD.
  Just like the original BSD projects, you can contact the NomadBSD developers via a mailing list.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Version 1.2 Released&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;NomadBSD recently released version 1.2 on April 21, 2019. This means that NomadBSD is now based on FreeBSD 12.0-p3. TRIM is now enabled by default. One of the biggest changes is that the initial command-line setup was replaced with a Qt graphical interface. They also added a Qt5 tool to install NomadBSD to your hard drive. A number of fixes were included to improve graphics support. They also added support for creating 32-bit images.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Thoughts on NomadBSD&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;I first discovered NomadBSD back in January when they released 1.2-RC1. At the time, I had been unable to install Project Trident on my laptop and was very frustrated with BSDs. I downloaded NomadBSD and tried it out. I initially ran into issues reaching the desktop, but RC2 fixed that issue. However, I was unable to get on the internet, even though I had an Ethernet cable plugged in. Luckily, I found the wifi manager in the menu and was able to connect to my wifi.
  Overall, my experience with NomadBSD was pleasant. Once I figured out a few things, I was good to go. I hope that NomadBSD is the first of a new generation of BSDs that focus on mobility and ease of use. BSD has conquered the server world, it’s about time they figured out how to be more user-friendly.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;[OpenBSD automatic&lt;/h3&gt;

&lt;p&gt;upgrade](https://www.tumfatig.net/20190426/openbsd-automatic-upgrade/)&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;OpenBSD 6.5 advertises for an installer improvement: rdsetroot(8) (a build-time tool) is now available for general use. Used in combination with autoinstall.8, it is now really easy to do automatic upgrades of your OpenBSD instances.
  I first manually upgraded my OpenBSD sandbox to 6.5. Once that was done, I could use the stock rdsetroot(8) tool. The plan is quite simple: write an unattended installation response file, insert it to a bsd.rd 6.5 installation image and reboot my other OpenBSD instances using that image.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Extra notes&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;There must be a way to run onetime commands (in the manner of fw_update) to automatically run sysmerge and packages upgrades. As for now, I’d rather do it manually.
  This worked like a charm on two Synology KVM instances using a single sd0 disk, on my Thinkpad X260 using Encrypted root with Keydisk and on a Vultr instance using Encrypted root with passphrase. And BTW, the upgrade on the X260 used the (iwn0) wireless connection.
  I just read that florian@ has released the sysupgrade(8) utility which should be released with OpenBSD 6.6. That will make upgrades even easier! Until then, happy upgrading.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://reviews.freebsd.org/D19848"&gt;FreeBSD Dtrace ext2fs Support&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Which logs were replaced by dtrace-probes:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Misc printf's under DEBUG macro in the blocks allocation path.&lt;/li&gt;

&lt;li&gt;Different on-disk structures validation errors, now the filesystem will silently return EIO's.&lt;/li&gt;

&lt;li&gt;Misc checksum errors, same as above.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;

&lt;li&gt;&lt;p&gt;The only debug macro, which was leaved is EXT2FS&lt;em&gt;PRINT&lt;/em&gt;EXTENTS.&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;&lt;p&gt;It is impossible to replace it by dtrace-probes, because the additional logic is required to walk thru file extents.&lt;/p&gt;&lt;/li&gt;

&lt;li&gt;
&lt;p&gt;The user still be able to see mount errors in the dmesg in case of:&lt;/p&gt;

&lt;p&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Filesystem features incompatibility.&lt;/li&gt;

&lt;p&gt;&lt;/p&gt;
&lt;li&gt;Superblock checksum error.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;

&lt;h3&gt;&lt;a href="https://dataswamp.org/~solene/2019-04-17-ssh-tunneling.html"&gt;Create a dedicated user for ssh tunneling only&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I use ssh tunneling A LOT, for everything. Yesterday, I removed the public access of my IMAP server, it’s now only available through ssh tunneling to access the daemon listening on localhost. I have plenty of daemons listening only on localhost that I can only reach through a ssh tunnel. If you don’t want to bother with ssh and redirect ports you need, you can also make a VPN (using ssh, openvpn, iked, tinc…) between your system and your server. I tend to avoid setting up VPN for the current use case as it requires more work and more maintenance than running ssh server and a ssh client.
  The last change, for my IMAP server, added an issue. I want my phone to access the IMAP server but I don’t want to connect to my main account from my phone for security reasons. So, I need a dedicated user that will only be allowed to forward ports.
  This is done very easily on OpenBSD.
  The steps are: 1. generate ssh keys for the new user 2. add an user with no password 3. allow public key for port forwarding
  Obviously, you must allow users (or only this one) to make port forwarding in your sshd_config.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://openbsd.amsterdam/upgrade.html"&gt;That was easy. Some info on upgrading VMM VMs to 6.5&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;We're running dedicated vmm(4)/vmd(8) servers to host opinionated VMs.
  OpenBSD 6.5 is released! There are two ways you can upgrade your VM.
  Either do a manual upgrade or leverage autoinstall(8). You can take care of it via the console with vmctl(8).&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Upgrade yourself&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;To get connected to the console you need to have access to the host your VM is running on. The same username and public SSH key, as provided for the VM, are used to create a local user on the host.
  When this is done you can use vmctl(8) to manage your VM. The options you have are:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;pre&gt;&lt;code class="$ vmctl console id``` language-$ vmctl console id```"&gt;```$ vmctl start id [-c]```
&lt;/code&gt;&lt;/pre&gt;

&lt;p&gt;$ vmctl stop id [-fw]```&lt;/p&gt;

&lt;pre&gt;&lt;code class="-f Forcefully stop the VM without attempting a graceful shutdown.``` language--f Forcefully stop the VM without attempting a graceful shutdown.```"&gt;```-w Wait until the VM has been terminated.```
&lt;/code&gt;&lt;/pre&gt;

&lt;p&gt;-c Automatically connect to the VM console.```&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;See the Article for the rest of the guide&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://inks.tedunangst.com/l/3791"&gt;powerpc64 architecture support in FreeBSD ports&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://twitter.com/ribalinux/status/1117856218251517956"&gt;GhostBSD 19.04 overview&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://twitter.com/lattera/status/1119018409575026688"&gt;HardenedBSD will have two user selectable ASLR implementations&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=S_aTzXVRRlM&amp;amp;feature=youtu.be"&gt;NYCBUG 2016 Talk Shell-Fu Uploaded&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="http://blog.zarfhome.com/2019/04/what-is-zil-anyway.html"&gt;What is ZIL anyway?&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Quentin - &lt;a href="http://dpaste.com/0K9PQW9#wrap"&gt;Organize an Ada/BSD interview&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;DJ - &lt;a href="http://dpaste.com/3KTQ45G#wrap"&gt;Update&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Patrick - &lt;a href="http://dpaste.com/07V6ZJN"&gt;Bhyve frontends&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;A small programming note: After BSDNow episode 300, the podcast will switch to audio-only, using a new higher quality recording and production system. The live stream will likely still include video.&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, ssh, nomadbsd, dtrace, ext2, unleashed, vmm</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>36 year old UFS bug fixed, a BSD for the road, automatic upgrades with OpenBSD, DTrace ext2fs support in FreeBSD, Dedicated SSH tunnel user, upgrading VMM VMs to OpenBSD 6.5, and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="36yearoldbuginffsufsdiscoveredandpatchedhttpssvnwebfreebsdorgbaseviewrevisionrevision347066"><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=347066">36+ year old bug in FFS/UFS discovered and patched </a></h3>

<blockquote>
  <p>This update eliminates a kernel stack disclosure bug in UFS/FFS directory entries that is caused by uninitialized directory entry padding written to the disk.</p>
  
  <ul>
  <li>When the directory entry is written to disk, it is written as a full 32bit entry, and the unused bytes were not initialized, so could possibly contain sensitive data from the kernel stack
  It can be viewed by any user with read access to that directory. Up to 3 bytes of kernel stack are disclosed per file entry, depending on the the amount of padding the kernel needs to pad out the entry to a 32 bit boundary. The offset in the kernel stack that is disclosed is a function of the filename size. Furthermore, if the user can create files in a directory, this 3 byte window can be expanded 3 bytes at a time to a 254 byte window with 75% of the data in that window exposed. The additional exposure is done by removing the entry, creating a new entry with a 4-byte longer name, extracting 3 more bytes by reading the directory, and repeating until a 252 byte name is created.
  This exploit works in part because the area of the kernel stack that is being disclosed is in an area that typically doesn't change that often (perhaps a few times a second on a lightly loaded system), and these file creates and unlinks themselves don't overwrite the area of kernel stack being disclosed.
  It appears that this bug originated with the creation of the Fast File System in 4.1b-BSD (Circa 1982, more than 36 years ago!), and is likely present in every Unix or Unix-like system that uses UFS/FFS. Amazingly, nobody noticed until now.
  This update also adds the -z flag to fsck_ffs to have it scrub the leaked information in the name padding of existing directories. It only needs to be run once on each UFS/FFS filesystem after a patched kernel is installed and running.
  Submitted by: David G. Lawrence <a href="&#109;a&#105;&#108;&#116;&#111;:&#x64;&#x67;&#64;&#100;&#103;&#x6c;&#97;&#x77;&#x72;&#101;n&#x63;&#101;&#x2e;&#x63;&#x6f;&#109;">&#x64;&#x67;&#64;&#100;&#103;&#x6c;&#97;&#x77;&#x72;&#101;n&#x63;&#101;&#x2e;&#x63;&#x6f;&#109;</a></li>
  
  <li>So a patched kernel will no longer leak this data, and running the <code>fsck_ffs -z</code> command will erase any leaked data that may exist on your system</li>
  
  <li><a href="https://marc.info/?l=openbsd-cvs&amp;m=155699268122858&amp;w=2">OpenBSD commit with additional detail on mitigations</a>
  The impact on OpenBSD is very limited:
  1 - such stack bytes can be found in raw-device reads, from group operator. If you can read the raw disks you can undertake other more powerful actions.
  2 - read(2) upon directory fd was disabled July 1997 because I didn't like how grep * would display garbage and mess up the tty, and applying vis(3) for just directory reads seemed silly.  read(2) was changed to return 0 (EOF).  Sep 2016 this was further changed to EISDIR, so you still cannot see the bad bytes.
  3 - In 2013 when guenther adapted the getdents(2) directory-reading system call to 64-bit ino_t, the userland data format changed to 8-byte-alignment, making it incompatible with the 4-byte-alignment UFS on-disk format.  As a result of code refactoring the bad bytes were not copied to userland. Bad bytes will remain in old directories on old filesystems, but nothing makes those bytes user visible.
  There will be no errata or syspatch issued.  I urge other systems which do expose the information to userland to issue errata quickly, since this is a 254 byte infoleak of the stack which is great for ROP-chain building to attack some other bug. Especially if the kernel has no layout/link-order randomization ...</li>
  </ul>
  
  <hr />
</blockquote>

<h3 id="nomadbsdabsdfortheroadhttpsitsfosscomnomadbsd"><a href="https://itsfoss.com/nomadbsd/">NomadBSD, a BSD for the Road</a></h3>

<blockquote>
  <p>As regular It’s FOSS readers should know, I like diving into the world of BSDs. Recently, I came across an interesting BSD that is designed to live on a thumb drive. Let’s take a look at NomadBSD.
  NomadBSD is different than most available BSDs. NomadBSD is a live system based on FreeBSD. It comes with automatic hardware detection and an initial config tool. NomadBSD is designed to “be used as a desktop system that works out of the box, but can also be used for data recovery, for educational purposes, or to test FreeBSD’s hardware compatibility.”
  This German BSD comes with an OpenBox-based desktop with the Plank application dock. NomadBSD makes use of the DSB project. DSB stands for “Desktop Suite (for) (Free)BSD” and consists of a collection of programs designed to create a simple and working environment without needing a ton of dependencies to use one tool. DSB is created by Marcel Kaiser one of the lead devs of NomadBSD.
  Just like the original BSD projects, you can contact the NomadBSD developers via a mailing list.</p>
</blockquote>

<ul>
<li>Version 1.2 Released</li>
</ul>

<blockquote>
  <p>NomadBSD recently released version 1.2 on April 21, 2019. This means that NomadBSD is now based on FreeBSD 12.0-p3. TRIM is now enabled by default. One of the biggest changes is that the initial command-line setup was replaced with a Qt graphical interface. They also added a Qt5 tool to install NomadBSD to your hard drive. A number of fixes were included to improve graphics support. They also added support for creating 32-bit images.</p>
</blockquote>

<ul>
<li>Thoughts on NomadBSD</li>
</ul>

<blockquote>
  <p>I first discovered NomadBSD back in January when they released 1.2-RC1. At the time, I had been unable to install Project Trident on my laptop and was very frustrated with BSDs. I downloaded NomadBSD and tried it out. I initially ran into issues reaching the desktop, but RC2 fixed that issue. However, I was unable to get on the internet, even though I had an Ethernet cable plugged in. Luckily, I found the wifi manager in the menu and was able to connect to my wifi.
  Overall, my experience with NomadBSD was pleasant. Once I figured out a few things, I was good to go. I hope that NomadBSD is the first of a new generation of BSDs that focus on mobility and ease of use. BSD has conquered the server world, it’s about time they figured out how to be more user-friendly.</p>
  
  <hr />
</blockquote>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="openbsdautomatic">[OpenBSD automatic</h3>

<p>upgrade](https://www.tumfatig.net/20190426/openbsd-automatic-upgrade/)</p>

<blockquote>
  <p>OpenBSD 6.5 advertises for an installer improvement: rdsetroot(8) (a build-time tool) is now available for general use. Used in combination with autoinstall.8, it is now really easy to do automatic upgrades of your OpenBSD instances.
  I first manually upgraded my OpenBSD sandbox to 6.5. Once that was done, I could use the stock rdsetroot(8) tool. The plan is quite simple: write an unattended installation response file, insert it to a bsd.rd 6.5 installation image and reboot my other OpenBSD instances using that image.</p>
</blockquote>

<ul>
<li>Extra notes</li>
</ul>

<blockquote>
  <p>There must be a way to run onetime commands (in the manner of fw_update) to automatically run sysmerge and packages upgrades. As for now, I’d rather do it manually.
  This worked like a charm on two Synology KVM instances using a single sd0 disk, on my Thinkpad X260 using Encrypted root with Keydisk and on a Vultr instance using Encrypted root with passphrase. And BTW, the upgrade on the X260 used the (iwn0) wireless connection.
  I just read that florian@ has released the sysupgrade(8) utility which should be released with OpenBSD 6.6. That will make upgrades even easier! Until then, happy upgrading.</p>
</blockquote>

<p><hr /></p>

<h3 id="freebsddtraceext2fssupporthttpsreviewsfreebsdorgd19848"><a href="https://reviews.freebsd.org/D19848">FreeBSD Dtrace ext2fs Support</a></h3>

<ul>
<li><p>Which logs were replaced by dtrace-probes:</p>

<ul>
<li>Misc printf's under DEBUG macro in the blocks allocation path.</li>

<li>Different on-disk structures validation errors, now the filesystem will silently return EIO's.</li>

<li>Misc checksum errors, same as above.</li></ul></li>

<li><p>The only debug macro, which was leaved is EXT2FS<em>PRINT</em>EXTENTS.</p></li>

<li><p>It is impossible to replace it by dtrace-probes, because the additional logic is required to walk thru file extents.</p></li>

<li><p>The user still be able to see mount errors in the dmesg in case of:</p>

<p><ul>
<li>Filesystem features incompatibility.</li></p>

<p><li>Superblock checksum error.</li></ul>

<p></p></li>
</ul></p>

<hr />

<h3 id="createadedicateduserforsshtunnelingonlyhttpsdataswamporgtsolene20190417sshtunnelinghtml"><a href="https://dataswamp.org/~solene/2019-04-17-ssh-tunneling.html">Create a dedicated user for ssh tunneling only</a></h3>

<blockquote>
  <p>I use ssh tunneling A LOT, for everything. Yesterday, I removed the public access of my IMAP server, it’s now only available through ssh tunneling to access the daemon listening on localhost. I have plenty of daemons listening only on localhost that I can only reach through a ssh tunnel. If you don’t want to bother with ssh and redirect ports you need, you can also make a VPN (using ssh, openvpn, iked, tinc…) between your system and your server. I tend to avoid setting up VPN for the current use case as it requires more work and more maintenance than running ssh server and a ssh client.
  The last change, for my IMAP server, added an issue. I want my phone to access the IMAP server but I don’t want to connect to my main account from my phone for security reasons. So, I need a dedicated user that will only be allowed to forward ports.
  This is done very easily on OpenBSD.
  The steps are: 1. generate ssh keys for the new user 2. add an user with no password 3. allow public key for port forwarding
  Obviously, you must allow users (or only this one) to make port forwarding in your sshd_config.</p>
  
  <hr />
</blockquote>

<h3 id="thatwaseasysomeinfoonupgradingvmmvmsto65httpsopenbsdamsterdamupgradehtml"><a href="https://openbsd.amsterdam/upgrade.html">That was easy. Some info on upgrading VMM VMs to 6.5</a></h3>

<blockquote>
  <p>We're running dedicated vmm(4)/vmd(8) servers to host opinionated VMs.
  OpenBSD 6.5 is released! There are two ways you can upgrade your VM.
  Either do a manual upgrade or leverage autoinstall(8). You can take care of it via the console with vmctl(8).</p>
</blockquote>

<ul>
<li>Upgrade yourself</li>
</ul>

<blockquote>
  <p>To get connected to the console you need to have access to the host your VM is running on. The same username and public SSH key, as provided for the VM, are used to create a local user on the host.
  When this is done you can use vmctl(8) to manage your VM. The options you have are:</p>
</blockquote>

<pre><code class="$ vmctl console id``` language-$ vmctl console id```">```$ vmctl start id [-c]```
</code></pre>

<p>$ vmctl stop id [-fw]```</p>

<pre><code class="-f Forcefully stop the VM without attempting a graceful shutdown.``` language--f Forcefully stop the VM without attempting a graceful shutdown.```">```-w Wait until the VM has been terminated.```
</code></pre>

<p>-c Automatically connect to the VM console.```</p>

<ul>
<li>See the Article for the rest of the guide</li>
</ul>

<p><hr /></p>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://inks.tedunangst.com/l/3791">powerpc64 architecture support in FreeBSD ports</a></li>

<li><a href="https://twitter.com/ribalinux/status/1117856218251517956">GhostBSD 19.04 overview</a></li>

<li><a href="https://twitter.com/lattera/status/1119018409575026688">HardenedBSD will have two user selectable ASLR implementations</a></li>

<li><a href="https://www.youtube.com/watch?v=S_aTzXVRRlM&amp;feature=youtu.be">NYCBUG 2016 Talk Shell-Fu Uploaded</a></li>

<li><a href="http://blog.zarfhome.com/2019/04/what-is-zil-anyway.html">What is ZIL anyway?</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Quentin - <a href="http://dpaste.com/0K9PQW9#wrap">Organize an Ada/BSD interview</a></li>

<li>DJ - <a href="http://dpaste.com/3KTQ45G#wrap">Update</a></li>

<li>Patrick - <a href="http://dpaste.com/07V6ZJN">Bhyve frontends</a></li>

<li>A small programming note: After BSDNow episode 300, the podcast will switch to audio-only, using a new higher quality recording and production system. The live stream will likely still include video.</li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0298.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>36 year old UFS bug fixed, a BSD for the road, automatic upgrades with OpenBSD, DTrace ext2fs support in FreeBSD, Dedicated SSH tunnel user, upgrading VMM VMs to OpenBSD 6.5, and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="36yearoldbuginffsufsdiscoveredandpatchedhttpssvnwebfreebsdorgbaseviewrevisionrevision347066"><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=347066">36+ year old bug in FFS/UFS discovered and patched </a></h3>

<blockquote>
  <p>This update eliminates a kernel stack disclosure bug in UFS/FFS directory entries that is caused by uninitialized directory entry padding written to the disk.</p>
  
  <ul>
  <li>When the directory entry is written to disk, it is written as a full 32bit entry, and the unused bytes were not initialized, so could possibly contain sensitive data from the kernel stack
  It can be viewed by any user with read access to that directory. Up to 3 bytes of kernel stack are disclosed per file entry, depending on the the amount of padding the kernel needs to pad out the entry to a 32 bit boundary. The offset in the kernel stack that is disclosed is a function of the filename size. Furthermore, if the user can create files in a directory, this 3 byte window can be expanded 3 bytes at a time to a 254 byte window with 75% of the data in that window exposed. The additional exposure is done by removing the entry, creating a new entry with a 4-byte longer name, extracting 3 more bytes by reading the directory, and repeating until a 252 byte name is created.
  This exploit works in part because the area of the kernel stack that is being disclosed is in an area that typically doesn't change that often (perhaps a few times a second on a lightly loaded system), and these file creates and unlinks themselves don't overwrite the area of kernel stack being disclosed.
  It appears that this bug originated with the creation of the Fast File System in 4.1b-BSD (Circa 1982, more than 36 years ago!), and is likely present in every Unix or Unix-like system that uses UFS/FFS. Amazingly, nobody noticed until now.
  This update also adds the -z flag to fsck_ffs to have it scrub the leaked information in the name padding of existing directories. It only needs to be run once on each UFS/FFS filesystem after a patched kernel is installed and running.
  Submitted by: David G. Lawrence <a href="&#109;a&#105;&#108;&#116;&#111;:&#x64;&#x67;&#64;&#100;&#103;&#x6c;&#97;&#x77;&#x72;&#101;n&#x63;&#101;&#x2e;&#x63;&#x6f;&#109;">&#x64;&#x67;&#64;&#100;&#103;&#x6c;&#97;&#x77;&#x72;&#101;n&#x63;&#101;&#x2e;&#x63;&#x6f;&#109;</a></li>
  
  <li>So a patched kernel will no longer leak this data, and running the <code>fsck_ffs -z</code> command will erase any leaked data that may exist on your system</li>
  
  <li><a href="https://marc.info/?l=openbsd-cvs&amp;m=155699268122858&amp;w=2">OpenBSD commit with additional detail on mitigations</a>
  The impact on OpenBSD is very limited:
  1 - such stack bytes can be found in raw-device reads, from group operator. If you can read the raw disks you can undertake other more powerful actions.
  2 - read(2) upon directory fd was disabled July 1997 because I didn't like how grep * would display garbage and mess up the tty, and applying vis(3) for just directory reads seemed silly.  read(2) was changed to return 0 (EOF).  Sep 2016 this was further changed to EISDIR, so you still cannot see the bad bytes.
  3 - In 2013 when guenther adapted the getdents(2) directory-reading system call to 64-bit ino_t, the userland data format changed to 8-byte-alignment, making it incompatible with the 4-byte-alignment UFS on-disk format.  As a result of code refactoring the bad bytes were not copied to userland. Bad bytes will remain in old directories on old filesystems, but nothing makes those bytes user visible.
  There will be no errata or syspatch issued.  I urge other systems which do expose the information to userland to issue errata quickly, since this is a 254 byte infoleak of the stack which is great for ROP-chain building to attack some other bug. Especially if the kernel has no layout/link-order randomization ...</li>
  </ul>
  
  <hr />
</blockquote>

<h3 id="nomadbsdabsdfortheroadhttpsitsfosscomnomadbsd"><a href="https://itsfoss.com/nomadbsd/">NomadBSD, a BSD for the Road</a></h3>

<blockquote>
  <p>As regular It’s FOSS readers should know, I like diving into the world of BSDs. Recently, I came across an interesting BSD that is designed to live on a thumb drive. Let’s take a look at NomadBSD.
  NomadBSD is different than most available BSDs. NomadBSD is a live system based on FreeBSD. It comes with automatic hardware detection and an initial config tool. NomadBSD is designed to “be used as a desktop system that works out of the box, but can also be used for data recovery, for educational purposes, or to test FreeBSD’s hardware compatibility.”
  This German BSD comes with an OpenBox-based desktop with the Plank application dock. NomadBSD makes use of the DSB project. DSB stands for “Desktop Suite (for) (Free)BSD” and consists of a collection of programs designed to create a simple and working environment without needing a ton of dependencies to use one tool. DSB is created by Marcel Kaiser one of the lead devs of NomadBSD.
  Just like the original BSD projects, you can contact the NomadBSD developers via a mailing list.</p>
</blockquote>

<ul>
<li>Version 1.2 Released</li>
</ul>

<blockquote>
  <p>NomadBSD recently released version 1.2 on April 21, 2019. This means that NomadBSD is now based on FreeBSD 12.0-p3. TRIM is now enabled by default. One of the biggest changes is that the initial command-line setup was replaced with a Qt graphical interface. They also added a Qt5 tool to install NomadBSD to your hard drive. A number of fixes were included to improve graphics support. They also added support for creating 32-bit images.</p>
</blockquote>

<ul>
<li>Thoughts on NomadBSD</li>
</ul>

<blockquote>
  <p>I first discovered NomadBSD back in January when they released 1.2-RC1. At the time, I had been unable to install Project Trident on my laptop and was very frustrated with BSDs. I downloaded NomadBSD and tried it out. I initially ran into issues reaching the desktop, but RC2 fixed that issue. However, I was unable to get on the internet, even though I had an Ethernet cable plugged in. Luckily, I found the wifi manager in the menu and was able to connect to my wifi.
  Overall, my experience with NomadBSD was pleasant. Once I figured out a few things, I was good to go. I hope that NomadBSD is the first of a new generation of BSDs that focus on mobility and ease of use. BSD has conquered the server world, it’s about time they figured out how to be more user-friendly.</p>
  
  <hr />
</blockquote>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="openbsdautomatic">[OpenBSD automatic</h3>

<p>upgrade](https://www.tumfatig.net/20190426/openbsd-automatic-upgrade/)</p>

<blockquote>
  <p>OpenBSD 6.5 advertises for an installer improvement: rdsetroot(8) (a build-time tool) is now available for general use. Used in combination with autoinstall.8, it is now really easy to do automatic upgrades of your OpenBSD instances.
  I first manually upgraded my OpenBSD sandbox to 6.5. Once that was done, I could use the stock rdsetroot(8) tool. The plan is quite simple: write an unattended installation response file, insert it to a bsd.rd 6.5 installation image and reboot my other OpenBSD instances using that image.</p>
</blockquote>

<ul>
<li>Extra notes</li>
</ul>

<blockquote>
  <p>There must be a way to run onetime commands (in the manner of fw_update) to automatically run sysmerge and packages upgrades. As for now, I’d rather do it manually.
  This worked like a charm on two Synology KVM instances using a single sd0 disk, on my Thinkpad X260 using Encrypted root with Keydisk and on a Vultr instance using Encrypted root with passphrase. And BTW, the upgrade on the X260 used the (iwn0) wireless connection.
  I just read that florian@ has released the sysupgrade(8) utility which should be released with OpenBSD 6.6. That will make upgrades even easier! Until then, happy upgrading.</p>
</blockquote>

<p><hr /></p>

<h3 id="freebsddtraceext2fssupporthttpsreviewsfreebsdorgd19848"><a href="https://reviews.freebsd.org/D19848">FreeBSD Dtrace ext2fs Support</a></h3>

<ul>
<li><p>Which logs were replaced by dtrace-probes:</p>

<ul>
<li>Misc printf's under DEBUG macro in the blocks allocation path.</li>

<li>Different on-disk structures validation errors, now the filesystem will silently return EIO's.</li>

<li>Misc checksum errors, same as above.</li></ul></li>

<li><p>The only debug macro, which was leaved is EXT2FS<em>PRINT</em>EXTENTS.</p></li>

<li><p>It is impossible to replace it by dtrace-probes, because the additional logic is required to walk thru file extents.</p></li>

<li><p>The user still be able to see mount errors in the dmesg in case of:</p>

<p><ul>
<li>Filesystem features incompatibility.</li></p>

<p><li>Superblock checksum error.</li></ul>

<p></p></li>
</ul></p>

<hr />

<h3 id="createadedicateduserforsshtunnelingonlyhttpsdataswamporgtsolene20190417sshtunnelinghtml"><a href="https://dataswamp.org/~solene/2019-04-17-ssh-tunneling.html">Create a dedicated user for ssh tunneling only</a></h3>

<blockquote>
  <p>I use ssh tunneling A LOT, for everything. Yesterday, I removed the public access of my IMAP server, it’s now only available through ssh tunneling to access the daemon listening on localhost. I have plenty of daemons listening only on localhost that I can only reach through a ssh tunnel. If you don’t want to bother with ssh and redirect ports you need, you can also make a VPN (using ssh, openvpn, iked, tinc…) between your system and your server. I tend to avoid setting up VPN for the current use case as it requires more work and more maintenance than running ssh server and a ssh client.
  The last change, for my IMAP server, added an issue. I want my phone to access the IMAP server but I don’t want to connect to my main account from my phone for security reasons. So, I need a dedicated user that will only be allowed to forward ports.
  This is done very easily on OpenBSD.
  The steps are: 1. generate ssh keys for the new user 2. add an user with no password 3. allow public key for port forwarding
  Obviously, you must allow users (or only this one) to make port forwarding in your sshd_config.</p>
  
  <hr />
</blockquote>

<h3 id="thatwaseasysomeinfoonupgradingvmmvmsto65httpsopenbsdamsterdamupgradehtml"><a href="https://openbsd.amsterdam/upgrade.html">That was easy. Some info on upgrading VMM VMs to 6.5</a></h3>

<blockquote>
  <p>We're running dedicated vmm(4)/vmd(8) servers to host opinionated VMs.
  OpenBSD 6.5 is released! There are two ways you can upgrade your VM.
  Either do a manual upgrade or leverage autoinstall(8). You can take care of it via the console with vmctl(8).</p>
</blockquote>

<ul>
<li>Upgrade yourself</li>
</ul>

<blockquote>
  <p>To get connected to the console you need to have access to the host your VM is running on. The same username and public SSH key, as provided for the VM, are used to create a local user on the host.
  When this is done you can use vmctl(8) to manage your VM. The options you have are:</p>
</blockquote>

<pre><code class="$ vmctl console id``` language-$ vmctl console id```">```$ vmctl start id [-c]```
</code></pre>

<p>$ vmctl stop id [-fw]```</p>

<pre><code class="-f Forcefully stop the VM without attempting a graceful shutdown.``` language--f Forcefully stop the VM without attempting a graceful shutdown.```">```-w Wait until the VM has been terminated.```
</code></pre>

<p>-c Automatically connect to the VM console.```</p>

<ul>
<li>See the Article for the rest of the guide</li>
</ul>

<p><hr /></p>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://inks.tedunangst.com/l/3791">powerpc64 architecture support in FreeBSD ports</a></li>

<li><a href="https://twitter.com/ribalinux/status/1117856218251517956">GhostBSD 19.04 overview</a></li>

<li><a href="https://twitter.com/lattera/status/1119018409575026688">HardenedBSD will have two user selectable ASLR implementations</a></li>

<li><a href="https://www.youtube.com/watch?v=S_aTzXVRRlM&amp;feature=youtu.be">NYCBUG 2016 Talk Shell-Fu Uploaded</a></li>

<li><a href="http://blog.zarfhome.com/2019/04/what-is-zil-anyway.html">What is ZIL anyway?</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Quentin - <a href="http://dpaste.com/0K9PQW9#wrap">Organize an Ada/BSD interview</a></li>

<li>DJ - <a href="http://dpaste.com/3KTQ45G#wrap">Update</a></li>

<li>Patrick - <a href="http://dpaste.com/07V6ZJN">Bhyve frontends</a></li>

<li>A small programming note: After BSDNow episode 300, the podcast will switch to audio-only, using a new higher quality recording and production system. The live stream will likely still include video.</li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0298.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>297: Dragonfly In The Wild</title>
  <link>https://www.bsdnow.tv/297</link>
  <guid isPermaLink="false">b83c5930-57a8-4c27-855a-97b6d88f5f00</guid>
  <pubDate>Thu, 09 May 2019 00:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b83c5930-57a8-4c27-855a-97b6d88f5f00.mp3" length="24677382" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD ZFS vs. ZoL performance, Dragonfly 5.4.2 has been release, containing web services with iocell, Solaris 11.4 SRU8, Problem with SSH Agent forwarding, OpenBSD 6.4 to 6.5 upgrade guide, and more.</itunes:subtitle>
  <itunes:duration>40:16</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD ZFS vs. ZoL performance, Dragonfly 5.4.2 has been release, containing web services with iocell, Solaris 11.4 SRU8, Problem with SSH Agent forwarding, OpenBSD 6.4 to 6.5 upgrade guide, and more.
&lt;h2&gt;Headlines&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://www.phoronix.com/scan.php?page=article&amp;amp;item=freebsd-zol-april&amp;amp;num=1"&gt;FreeBSD ZFS vs. ZoL Performance, Ubuntu ZFS On Linux Reference&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;With iX Systems having released new images of FreeBSD reworked with their ZFS On Linux code that is in development to ultimately replace their existing FreeBSD ZFS support derived from the code originally found in the Illumos source tree, here are some fresh benchmarks looking at the FreeBSD 12 performance of ZFS vs. ZoL vs. UFS and compared to Ubuntu Linux on the same system with EXT4 and ZFS.
  Using an Intel Xeon E3-1275 v6 with ASUS P10S-M WS motherboard, 2 x 8GB DDR4-2400 ECC UDIMMs, and Samsung 970 EVO Plus 500GB NVMe solid-state drive was used for all of this round of testing. Just a single modern NVMe SSD was used for this round of ZFS testing while as the FreeBSD ZoL code matures I'll test on multiple systems using a more diverse range of storage devices.
  FreeBSD 12 ZoL was tested using the iX Systems image and then fresh installs done of FreeBSD 12.0-RELEASE when defaulting to the existing ZFS root file-system support and again when using the aging UFS file-system. Ubuntu 18.04.2 LTS with the Linux 4.18 kernel was used when testing its default EXT4 file-system and then again when using the Ubuntu-ZFS ZoL support. Via the Phoronix Test Suite various BSD/Linux I/O benchmarks were carried out.
  Overall, the FreeBSD ZFS On Linux port is looking good so far and we are looking forward to it hopefully maturing in time for FreeBSD 13.0. Nice job to iX Systems and all of those involved, especially the ZFS On Linux project. Those wanting to help in testing can try the FreeBSD ZoL spins. Stay tuned for more benchmarks and on more diverse hardware as time allows and the FreeBSD ZoL support further matures, but so far at least the performance numbers are in good shape.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.dragonflybsd.org/release54/"&gt;DragonFlyBSD 5.4.2 is out&lt;/a&gt;&lt;/h3&gt;

&lt;p&gt;&lt;a href="http://lists.dragonflybsd.org/pipermail/users/2019-April/358160.html"&gt;Upgrading guide&lt;/a&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;Here's the tag commit, for what has changed from &lt;a href="http://lists.dragonflybsd.org/pipermail/commits/2019-April/718697.html"&gt;5.4.1 to 5.4.2&lt;/a&gt;
  The normal ISO and IMG files are available for download and install, plus an uncompressed ISO image for those installing remotely.  I uploaded them to mirror-master.dragonflybsd.org last night so they should be at your local mirror or will be soon.  This version includes Matt's fix for the HAMMER2 corruption bug he identified recently.
  If you have an existing 5.4 system and are running a generic kernel, the normal upgrade process will work.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;pre&gt;&lt;code&gt;&amp;gt; cd /usr/src
&amp;gt; git pull
&amp;gt; make buildworld.
&amp;gt; make buildkernel.
&amp;gt; make installkernel.
&amp;gt; make installworld
&amp;gt; make upgrade
&lt;/code&gt;&lt;/pre&gt;

&lt;blockquote&gt;
  &lt;p&gt;After your next reboot, you can optionally update your rescue system:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;pre&gt;&lt;code&gt;&amp;gt; cd /usr/src
&amp;gt; make initrd
&lt;/code&gt;&lt;/pre&gt;

&lt;blockquote&gt;
  &lt;p&gt;As always, make sure your packages are up to date:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;pre&gt;&lt;code&gt;&amp;gt; pkg update
&amp;gt; pkg upgrade
&lt;/code&gt;&lt;/pre&gt;

&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://gioarc.me/2017/03/05/containing-web-services-with-iocell/"&gt;Containing web services with iocell&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I'm a huge fan of the FreeBSD jails feature. It is a great system for splitting services into logical units with all the performance of the bare metal system. In fact, this very site runs in its own jail! If this is starting to sound like LXC or Docker, it might surprise you to learn that OS-level virtualization has existed for quite some time. Kudos to the Linux folks for finally getting around to it. 😛 
  If you're interested in the history behind Jails, there is an excellent talk from Papers We Love on the subject: https://www.youtube.com/watch?v=hgN8pCMLI2U&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Getting started&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;There are plenty of options when it comes to setting up the jail system. Ezjail and Iocage seem popular, or you could do things manually. Iocage was recently rewritten in python, but was originally a set of shell scripts. That version has since been forked under the name Iocell, and I think it's pretty neat, so this tutorial will be using Iocell.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;To start, you'll need the following:


&lt;ul&gt;
&lt;li&gt;A FreeBSD install (we'll be using 11.0)&lt;/li&gt;

&lt;li&gt;The iocell package (available as a package, also in the ports tree)&lt;/li&gt;

&lt;li&gt;A ZFS pool for hosting the jails&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Once you have installed iocell and configured your ZFS pool, you'll need to run a few commands before creating your first jail. First, tell iocell which ZFS pool to use by issuing  iocell activate $POOLNAME. Iocell will create a few datasets.&lt;/p&gt;
  
  &lt;p&gt;As you can imagine, your jails are contained within the /iocell/jails dataset. The  /iocell/releases dataset is used for storing the next command we need to run,  iocell fetch. Iocell will ask you which release you'd like to pull down. Since we're running 11.0 on the host, pick 11.0-RELEASE. Iocell will download the necessary txz files and unpack them in /iocell/releases.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;See Article for the rest of the walkthrough.&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://blogs.oracle.com/solaris/announcing-oracle-solaris-114-sru8"&gt;Oracle Solaris 11.4 SRU8&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Today we are releasing the SRU 8 for Oracle Solaris 11.4. It is available via 'pkg update' from the support repository or by downloading the SRU from My Oracle Support Doc ID 2433412.1.&lt;/p&gt;
  
  &lt;ul&gt;
  &lt;li&gt;This SRU introduces the following enhancements:
  
  
  &lt;ul&gt;
  &lt;li&gt;Integration of 28060039 introduced an issue where any firmware update/query commands will log eereports and repeated execution of such commands led to faulty/degraded NIC. The issue has been addressed in this SRU.&lt;/li&gt;
  
  &lt;li&gt;UCB (libucb, librpcsoc, libdbm, libtermcap, and libcurses) libraries have been reinstated for Oracle Solaris 11.4&lt;/li&gt;
  
  &lt;li&gt;Re-introduction of the service fc-fabric.&lt;/li&gt;
  
  &lt;li&gt;ibus has been updated to 1.5.19&lt;/li&gt;
&lt;/ul&gt;
  &lt;/li&gt;
  &lt;/ul&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;The following components have also been updated to address security issues:


&lt;ul&gt;
&lt;li&gt;NTP has been updated to 4.2.8p12&lt;/li&gt;

&lt;li&gt;Firefox has been updated to 60.6.0esr&lt;/li&gt;

&lt;li&gt;BIND has been updated to 9.11.6&lt;/li&gt;

&lt;li&gt;OpenSSL has been updated to 1.0.2r&lt;/li&gt;

&lt;li&gt;MySQL has been updated to 5.6.43 &amp;amp; 5.7.25&lt;/li&gt;

&lt;li&gt;libxml2 has been updated to 2.9.9&lt;/li&gt;

&lt;li&gt;libxslt has been updated to 1.1.33&lt;/li&gt;

&lt;li&gt;Wireshark has been updated to 2.6.7&lt;/li&gt;

&lt;li&gt;ncurses has been updated to 6.1.0.20190105&lt;/li&gt;

&lt;li&gt;Apache Web Server has been updated to 2.4.38&lt;/li&gt;

&lt;li&gt;perl 5.22&lt;/li&gt;

&lt;li&gt;pkg.depot&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://defn.io/2019/04/12/ssh-forwarding/"&gt;The Problem with SSH Agent Forwarding&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;After hacking the matrix.org website today, the attacker opened a series of GitHub issues mentioning the flaws he discovered. In one of those issues, he mentions that “complete compromise could have been avoided if developers were prohibited from using [SSH agent forwarding].”
  Here’s what man ssh_config has to say about ForwardAgent:  "Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent’s Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.""
  Simply put: if your jump box is compromised and you use SSH agent forwarding to connect to another machine through it, then you risk also compromising the target machine!
  Instead, you should use either ProxyCommand or ProxyJump (added in OpenSSH 7.3). That way, ssh will forward the TCP connection to the target host via the jump box and the actual connection will be made on your workstation. If someone on the jump box tries to MITM your connection, then you will be warned by ssh.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;[&lt;a href="https://www.openbsd.org/faq/upgrade65.html"&gt;OpenBSD Upgrade Guide: 6.4 to 6.5&lt;/a&gt;
&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Start by performing the pre-upgrade steps. Next, boot from the install kernel, bsd.rd: use bootable install media, or place the 6.5 version of bsd.rd in the root of your filesystem and instruct the boot loader to boot this kernel. Once this kernel is booted, choose the (U)pgrade option and follow the prompts. Apply the configuration changes and remove the old files. Finish up by upgrading the packages: pkg_add -u.
  Alternatively, you can use the manual upgrade process.
  You may wish to check the errata page or upgrade to the stable branch to get any post-release fixes.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Before rebooting into the install kernel&lt;/li&gt;

&lt;li&gt;Configuration and syntax changes&lt;/li&gt;

&lt;li&gt;Files to remove&lt;/li&gt;

&lt;li&gt;Special packages&lt;/li&gt;

&lt;li&gt;Upgrade without the install kernel&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-April/001873.html"&gt;2019 FreeBSD Community Survey&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://blog.seagate.com/craftsman-ship/seagate-shows-dual-actuator-speed-gains-in-real-world-setup/"&gt;Seagate runs Mach.2 demo on FreeBSD&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=2KoD-jXjHok&amp;amp;t=7s"&gt;FreeBSD: Resizing and Growing Disks&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://old.reddit.com/r/freebsd/comments/bh1abv/loading_49_on_an_old_tandy_4025lx_386_16mb_1gb_hd/"&gt;Loading 4.9 on an old Tandy 4025LX - 386, 16MB, 1GB HD. Good old external SCSI CD&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://forums.os108.org/d/6-os108-mate-20190422-released"&gt;OS108 MATE 20190422 released&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Casey - &lt;a href="http://dpaste.com/39VJ7NH#wrap"&gt;Oklahoma City &amp;amp; James&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Michael - &lt;a href="http://dpaste.com/2VSKEGW#wrap"&gt;Question on SAS backplane (camcontrol?)&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Ales - &lt;a href="http://dpaste.com/0AD0HBY#wrap"&gt;OpenBSD, FreeNAS, OpenZFS questions&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, ZoL, iocell, Solaris, SSH, forwarding</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD ZFS vs. ZoL performance, Dragonfly 5.4.2 has been release, containing web services with iocell, Solaris 11.4 SRU8, Problem with SSH Agent forwarding, OpenBSD 6.4 to 6.5 upgrade guide, and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="freebsdzfsvszolperformanceubuntuzfsonlinuxreferencehttpswwwphoronixcomscanphppagearticleitemfreebsdzolaprilnum1"><a href="https://www.phoronix.com/scan.php?page=article&amp;item=freebsd-zol-april&amp;num=1">FreeBSD ZFS vs. ZoL Performance, Ubuntu ZFS On Linux Reference</a></h3>

<blockquote>
  <p>With iX Systems having released new images of FreeBSD reworked with their ZFS On Linux code that is in development to ultimately replace their existing FreeBSD ZFS support derived from the code originally found in the Illumos source tree, here are some fresh benchmarks looking at the FreeBSD 12 performance of ZFS vs. ZoL vs. UFS and compared to Ubuntu Linux on the same system with EXT4 and ZFS.
  Using an Intel Xeon E3-1275 v6 with ASUS P10S-M WS motherboard, 2 x 8GB DDR4-2400 ECC UDIMMs, and Samsung 970 EVO Plus 500GB NVMe solid-state drive was used for all of this round of testing. Just a single modern NVMe SSD was used for this round of ZFS testing while as the FreeBSD ZoL code matures I'll test on multiple systems using a more diverse range of storage devices.
  FreeBSD 12 ZoL was tested using the iX Systems image and then fresh installs done of FreeBSD 12.0-RELEASE when defaulting to the existing ZFS root file-system support and again when using the aging UFS file-system. Ubuntu 18.04.2 LTS with the Linux 4.18 kernel was used when testing its default EXT4 file-system and then again when using the Ubuntu-ZFS ZoL support. Via the Phoronix Test Suite various BSD/Linux I/O benchmarks were carried out.
  Overall, the FreeBSD ZFS On Linux port is looking good so far and we are looking forward to it hopefully maturing in time for FreeBSD 13.0. Nice job to iX Systems and all of those involved, especially the ZFS On Linux project. Those wanting to help in testing can try the FreeBSD ZoL spins. Stay tuned for more benchmarks and on more diverse hardware as time allows and the FreeBSD ZoL support further matures, but so far at least the performance numbers are in good shape.</p>
</blockquote>

<p><hr /></p>

<h3 id="dragonflybsd542isouthttpswwwdragonflybsdorgrelease54"><a href="https://www.dragonflybsd.org/release54/">DragonFlyBSD 5.4.2 is out</a></h3>

<p><a href="http://lists.dragonflybsd.org/pipermail/users/2019-April/358160.html">Upgrading guide</a></p>

<blockquote>
  <p>Here's the tag commit, for what has changed from <a href="http://lists.dragonflybsd.org/pipermail/commits/2019-April/718697.html">5.4.1 to 5.4.2</a>
  The normal ISO and IMG files are available for download and install, plus an uncompressed ISO image for those installing remotely.  I uploaded them to mirror-master.dragonflybsd.org last night so they should be at your local mirror or will be soon.  This version includes Matt's fix for the HAMMER2 corruption bug he identified recently.
  If you have an existing 5.4 system and are running a generic kernel, the normal upgrade process will work.</p>
</blockquote>

<pre><code>&gt; cd /usr/src
&gt; git pull
&gt; make buildworld.
&gt; make buildkernel.
&gt; make installkernel.
&gt; make installworld
&gt; make upgrade
</code></pre>

<blockquote>
  <p>After your next reboot, you can optionally update your rescue system:</p>
</blockquote>

<pre><code>&gt; cd /usr/src
&gt; make initrd
</code></pre>

<blockquote>
  <p>As always, make sure your packages are up to date:</p>
</blockquote>

<pre><code>&gt; pkg update
&gt; pkg upgrade
</code></pre>

<p><hr /></p>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="containingwebserviceswithiocellhttpsgioarcme20170305containingwebserviceswithiocell"><a href="https://gioarc.me/2017/03/05/containing-web-services-with-iocell/">Containing web services with iocell</a></h3>

<blockquote>
  <p>I'm a huge fan of the FreeBSD jails feature. It is a great system for splitting services into logical units with all the performance of the bare metal system. In fact, this very site runs in its own jail! If this is starting to sound like LXC or Docker, it might surprise you to learn that OS-level virtualization has existed for quite some time. Kudos to the Linux folks for finally getting around to it. 😛 
  If you're interested in the history behind Jails, there is an excellent talk from Papers We Love on the subject: https://www.youtube.com/watch?v=hgN8pCMLI2U</p>
</blockquote>

<ul>
<li>Getting started</li>
</ul>

<blockquote>
  <p>There are plenty of options when it comes to setting up the jail system. Ezjail and Iocage seem popular, or you could do things manually. Iocage was recently rewritten in python, but was originally a set of shell scripts. That version has since been forked under the name Iocell, and I think it's pretty neat, so this tutorial will be using Iocell.</p>
</blockquote>

<ul>
<li>To start, you'll need the following:


<ul>
<li>A FreeBSD install (we'll be using 11.0)</li>

<li>The iocell package (available as a package, also in the ports tree)</li>

<li>A ZFS pool for hosting the jails</li></ul>
</li>
</ul>

<blockquote>
  <p>Once you have installed iocell and configured your ZFS pool, you'll need to run a few commands before creating your first jail. First, tell iocell which ZFS pool to use by issuing  iocell activate $POOLNAME. Iocell will create a few datasets.</p>
  
  <p>As you can imagine, your jails are contained within the /iocell/jails dataset. The  /iocell/releases dataset is used for storing the next command we need to run,  iocell fetch. Iocell will ask you which release you'd like to pull down. Since we're running 11.0 on the host, pick 11.0-RELEASE. Iocell will download the necessary txz files and unpack them in /iocell/releases.</p>
</blockquote>

<ul>
<li>See Article for the rest of the walkthrough.</li>
</ul>

<p><hr /></p>

<h3 id="oraclesolaris114sru8httpsblogsoraclecomsolarisannouncingoraclesolaris114sru8"><a href="https://blogs.oracle.com/solaris/announcing-oracle-solaris-114-sru8">Oracle Solaris 11.4 SRU8</a></h3>

<blockquote>
  <p>Today we are releasing the SRU 8 for Oracle Solaris 11.4. It is available via 'pkg update' from the support repository or by downloading the SRU from My Oracle Support Doc ID 2433412.1.</p>
  
  <ul>
  <li>This SRU introduces the following enhancements:
  
  
  <ul>
  <li>Integration of 28060039 introduced an issue where any firmware update/query commands will log eereports and repeated execution of such commands led to faulty/degraded NIC. The issue has been addressed in this SRU.</li>
  
  <li>UCB (libucb, librpcsoc, libdbm, libtermcap, and libcurses) libraries have been reinstated for Oracle Solaris 11.4</li>
  
  <li>Re-introduction of the service fc-fabric.</li>
  
  <li>ibus has been updated to 1.5.19</li></ul>
  </li>
  </ul>
</blockquote>

<ul>
<li>The following components have also been updated to address security issues:


<ul>
<li>NTP has been updated to 4.2.8p12</li>

<li>Firefox has been updated to 60.6.0esr</li>

<li>BIND has been updated to 9.11.6</li>

<li>OpenSSL has been updated to 1.0.2r</li>

<li>MySQL has been updated to 5.6.43 &amp; 5.7.25</li>

<li>libxml2 has been updated to 2.9.9</li>

<li>libxslt has been updated to 1.1.33</li>

<li>Wireshark has been updated to 2.6.7</li>

<li>ncurses has been updated to 6.1.0.20190105</li>

<li>Apache Web Server has been updated to 2.4.38</li>

<li>perl 5.22</li>

<li>pkg.depot</li></ul>
</li>
</ul>

<p><hr /></p>

<h3 id="theproblemwithsshagentforwardinghttpsdefnio20190412sshforwarding"><a href="https://defn.io/2019/04/12/ssh-forwarding/">The Problem with SSH Agent Forwarding</a></h3>

<blockquote>
  <p>After hacking the matrix.org website today, the attacker opened a series of GitHub issues mentioning the flaws he discovered. In one of those issues, he mentions that “complete compromise could have been avoided if developers were prohibited from using [SSH agent forwarding].”
  Here’s what man ssh_config has to say about ForwardAgent:  "Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent’s Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.""
  Simply put: if your jump box is compromised and you use SSH agent forwarding to connect to another machine through it, then you risk also compromising the target machine!
  Instead, you should use either ProxyCommand or ProxyJump (added in OpenSSH 7.3). That way, ssh will forward the TCP connection to the target host via the jump box and the actual connection will be made on your workstation. If someone on the jump box tries to MITM your connection, then you will be warned by ssh.</p>
</blockquote>

<p><hr /></p>

<h3 id="openbsdupgradeguide64to65httpswwwopenbsdorgfaqupgrade65html">[<a href="https://www.openbsd.org/faq/upgrade65.html">OpenBSD Upgrade Guide: 6.4 to 6.5</a></h3>

<blockquote>
  <p>Start by performing the pre-upgrade steps. Next, boot from the install kernel, bsd.rd: use bootable install media, or place the 6.5 version of bsd.rd in the root of your filesystem and instruct the boot loader to boot this kernel. Once this kernel is booted, choose the (U)pgrade option and follow the prompts. Apply the configuration changes and remove the old files. Finish up by upgrading the packages: pkg_add -u.
  Alternatively, you can use the manual upgrade process.
  You may wish to check the errata page or upgrade to the stable branch to get any post-release fixes.</p>
</blockquote>

<ul>
<li>Before rebooting into the install kernel</li>

<li>Configuration and syntax changes</li>

<li>Files to remove</li>

<li>Special packages</li>

<li>Upgrade without the install kernel</li>
</ul>

<p><hr /></p>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-April/001873.html">2019 FreeBSD Community Survey</a></li>

<li><a href="https://blog.seagate.com/craftsman-ship/seagate-shows-dual-actuator-speed-gains-in-real-world-setup/">Seagate runs Mach.2 demo on FreeBSD</a></li>

<li><a href="https://www.youtube.com/watch?v=2KoD-jXjHok&amp;t=7s">FreeBSD: Resizing and Growing Disks</a></li>

<li><a href="https://old.reddit.com/r/freebsd/comments/bh1abv/loading_49_on_an_old_tandy_4025lx_386_16mb_1gb_hd/">Loading 4.9 on an old Tandy 4025LX - 386, 16MB, 1GB HD. Good old external SCSI CD</a></li>

<li><a href="https://forums.os108.org/d/6-os108-mate-20190422-released">OS108 MATE 20190422 released</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Casey - <a href="http://dpaste.com/39VJ7NH#wrap">Oklahoma City &amp; James</a></li>

<li>Michael - <a href="http://dpaste.com/2VSKEGW#wrap">Question on SAS backplane (camcontrol?)</a></li>

<li>Ales - <a href="http://dpaste.com/0AD0HBY#wrap">OpenBSD, FreeNAS, OpenZFS questions</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0297.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD ZFS vs. ZoL performance, Dragonfly 5.4.2 has been release, containing web services with iocell, Solaris 11.4 SRU8, Problem with SSH Agent forwarding, OpenBSD 6.4 to 6.5 upgrade guide, and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="freebsdzfsvszolperformanceubuntuzfsonlinuxreferencehttpswwwphoronixcomscanphppagearticleitemfreebsdzolaprilnum1"><a href="https://www.phoronix.com/scan.php?page=article&amp;item=freebsd-zol-april&amp;num=1">FreeBSD ZFS vs. ZoL Performance, Ubuntu ZFS On Linux Reference</a></h3>

<blockquote>
  <p>With iX Systems having released new images of FreeBSD reworked with their ZFS On Linux code that is in development to ultimately replace their existing FreeBSD ZFS support derived from the code originally found in the Illumos source tree, here are some fresh benchmarks looking at the FreeBSD 12 performance of ZFS vs. ZoL vs. UFS and compared to Ubuntu Linux on the same system with EXT4 and ZFS.
  Using an Intel Xeon E3-1275 v6 with ASUS P10S-M WS motherboard, 2 x 8GB DDR4-2400 ECC UDIMMs, and Samsung 970 EVO Plus 500GB NVMe solid-state drive was used for all of this round of testing. Just a single modern NVMe SSD was used for this round of ZFS testing while as the FreeBSD ZoL code matures I'll test on multiple systems using a more diverse range of storage devices.
  FreeBSD 12 ZoL was tested using the iX Systems image and then fresh installs done of FreeBSD 12.0-RELEASE when defaulting to the existing ZFS root file-system support and again when using the aging UFS file-system. Ubuntu 18.04.2 LTS with the Linux 4.18 kernel was used when testing its default EXT4 file-system and then again when using the Ubuntu-ZFS ZoL support. Via the Phoronix Test Suite various BSD/Linux I/O benchmarks were carried out.
  Overall, the FreeBSD ZFS On Linux port is looking good so far and we are looking forward to it hopefully maturing in time for FreeBSD 13.0. Nice job to iX Systems and all of those involved, especially the ZFS On Linux project. Those wanting to help in testing can try the FreeBSD ZoL spins. Stay tuned for more benchmarks and on more diverse hardware as time allows and the FreeBSD ZoL support further matures, but so far at least the performance numbers are in good shape.</p>
</blockquote>

<p><hr /></p>

<h3 id="dragonflybsd542isouthttpswwwdragonflybsdorgrelease54"><a href="https://www.dragonflybsd.org/release54/">DragonFlyBSD 5.4.2 is out</a></h3>

<p><a href="http://lists.dragonflybsd.org/pipermail/users/2019-April/358160.html">Upgrading guide</a></p>

<blockquote>
  <p>Here's the tag commit, for what has changed from <a href="http://lists.dragonflybsd.org/pipermail/commits/2019-April/718697.html">5.4.1 to 5.4.2</a>
  The normal ISO and IMG files are available for download and install, plus an uncompressed ISO image for those installing remotely.  I uploaded them to mirror-master.dragonflybsd.org last night so they should be at your local mirror or will be soon.  This version includes Matt's fix for the HAMMER2 corruption bug he identified recently.
  If you have an existing 5.4 system and are running a generic kernel, the normal upgrade process will work.</p>
</blockquote>

<pre><code>&gt; cd /usr/src
&gt; git pull
&gt; make buildworld.
&gt; make buildkernel.
&gt; make installkernel.
&gt; make installworld
&gt; make upgrade
</code></pre>

<blockquote>
  <p>After your next reboot, you can optionally update your rescue system:</p>
</blockquote>

<pre><code>&gt; cd /usr/src
&gt; make initrd
</code></pre>

<blockquote>
  <p>As always, make sure your packages are up to date:</p>
</blockquote>

<pre><code>&gt; pkg update
&gt; pkg upgrade
</code></pre>

<p><hr /></p>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="containingwebserviceswithiocellhttpsgioarcme20170305containingwebserviceswithiocell"><a href="https://gioarc.me/2017/03/05/containing-web-services-with-iocell/">Containing web services with iocell</a></h3>

<blockquote>
  <p>I'm a huge fan of the FreeBSD jails feature. It is a great system for splitting services into logical units with all the performance of the bare metal system. In fact, this very site runs in its own jail! If this is starting to sound like LXC or Docker, it might surprise you to learn that OS-level virtualization has existed for quite some time. Kudos to the Linux folks for finally getting around to it. 😛 
  If you're interested in the history behind Jails, there is an excellent talk from Papers We Love on the subject: https://www.youtube.com/watch?v=hgN8pCMLI2U</p>
</blockquote>

<ul>
<li>Getting started</li>
</ul>

<blockquote>
  <p>There are plenty of options when it comes to setting up the jail system. Ezjail and Iocage seem popular, or you could do things manually. Iocage was recently rewritten in python, but was originally a set of shell scripts. That version has since been forked under the name Iocell, and I think it's pretty neat, so this tutorial will be using Iocell.</p>
</blockquote>

<ul>
<li>To start, you'll need the following:


<ul>
<li>A FreeBSD install (we'll be using 11.0)</li>

<li>The iocell package (available as a package, also in the ports tree)</li>

<li>A ZFS pool for hosting the jails</li></ul>
</li>
</ul>

<blockquote>
  <p>Once you have installed iocell and configured your ZFS pool, you'll need to run a few commands before creating your first jail. First, tell iocell which ZFS pool to use by issuing  iocell activate $POOLNAME. Iocell will create a few datasets.</p>
  
  <p>As you can imagine, your jails are contained within the /iocell/jails dataset. The  /iocell/releases dataset is used for storing the next command we need to run,  iocell fetch. Iocell will ask you which release you'd like to pull down. Since we're running 11.0 on the host, pick 11.0-RELEASE. Iocell will download the necessary txz files and unpack them in /iocell/releases.</p>
</blockquote>

<ul>
<li>See Article for the rest of the walkthrough.</li>
</ul>

<p><hr /></p>

<h3 id="oraclesolaris114sru8httpsblogsoraclecomsolarisannouncingoraclesolaris114sru8"><a href="https://blogs.oracle.com/solaris/announcing-oracle-solaris-114-sru8">Oracle Solaris 11.4 SRU8</a></h3>

<blockquote>
  <p>Today we are releasing the SRU 8 for Oracle Solaris 11.4. It is available via 'pkg update' from the support repository or by downloading the SRU from My Oracle Support Doc ID 2433412.1.</p>
  
  <ul>
  <li>This SRU introduces the following enhancements:
  
  
  <ul>
  <li>Integration of 28060039 introduced an issue where any firmware update/query commands will log eereports and repeated execution of such commands led to faulty/degraded NIC. The issue has been addressed in this SRU.</li>
  
  <li>UCB (libucb, librpcsoc, libdbm, libtermcap, and libcurses) libraries have been reinstated for Oracle Solaris 11.4</li>
  
  <li>Re-introduction of the service fc-fabric.</li>
  
  <li>ibus has been updated to 1.5.19</li></ul>
  </li>
  </ul>
</blockquote>

<ul>
<li>The following components have also been updated to address security issues:


<ul>
<li>NTP has been updated to 4.2.8p12</li>

<li>Firefox has been updated to 60.6.0esr</li>

<li>BIND has been updated to 9.11.6</li>

<li>OpenSSL has been updated to 1.0.2r</li>

<li>MySQL has been updated to 5.6.43 &amp; 5.7.25</li>

<li>libxml2 has been updated to 2.9.9</li>

<li>libxslt has been updated to 1.1.33</li>

<li>Wireshark has been updated to 2.6.7</li>

<li>ncurses has been updated to 6.1.0.20190105</li>

<li>Apache Web Server has been updated to 2.4.38</li>

<li>perl 5.22</li>

<li>pkg.depot</li></ul>
</li>
</ul>

<p><hr /></p>

<h3 id="theproblemwithsshagentforwardinghttpsdefnio20190412sshforwarding"><a href="https://defn.io/2019/04/12/ssh-forwarding/">The Problem with SSH Agent Forwarding</a></h3>

<blockquote>
  <p>After hacking the matrix.org website today, the attacker opened a series of GitHub issues mentioning the flaws he discovered. In one of those issues, he mentions that “complete compromise could have been avoided if developers were prohibited from using [SSH agent forwarding].”
  Here’s what man ssh_config has to say about ForwardAgent:  "Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent’s Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.""
  Simply put: if your jump box is compromised and you use SSH agent forwarding to connect to another machine through it, then you risk also compromising the target machine!
  Instead, you should use either ProxyCommand or ProxyJump (added in OpenSSH 7.3). That way, ssh will forward the TCP connection to the target host via the jump box and the actual connection will be made on your workstation. If someone on the jump box tries to MITM your connection, then you will be warned by ssh.</p>
</blockquote>

<p><hr /></p>

<h3 id="openbsdupgradeguide64to65httpswwwopenbsdorgfaqupgrade65html">[<a href="https://www.openbsd.org/faq/upgrade65.html">OpenBSD Upgrade Guide: 6.4 to 6.5</a></h3>

<blockquote>
  <p>Start by performing the pre-upgrade steps. Next, boot from the install kernel, bsd.rd: use bootable install media, or place the 6.5 version of bsd.rd in the root of your filesystem and instruct the boot loader to boot this kernel. Once this kernel is booted, choose the (U)pgrade option and follow the prompts. Apply the configuration changes and remove the old files. Finish up by upgrading the packages: pkg_add -u.
  Alternatively, you can use the manual upgrade process.
  You may wish to check the errata page or upgrade to the stable branch to get any post-release fixes.</p>
</blockquote>

<ul>
<li>Before rebooting into the install kernel</li>

<li>Configuration and syntax changes</li>

<li>Files to remove</li>

<li>Special packages</li>

<li>Upgrade without the install kernel</li>
</ul>

<p><hr /></p>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-April/001873.html">2019 FreeBSD Community Survey</a></li>

<li><a href="https://blog.seagate.com/craftsman-ship/seagate-shows-dual-actuator-speed-gains-in-real-world-setup/">Seagate runs Mach.2 demo on FreeBSD</a></li>

<li><a href="https://www.youtube.com/watch?v=2KoD-jXjHok&amp;t=7s">FreeBSD: Resizing and Growing Disks</a></li>

<li><a href="https://old.reddit.com/r/freebsd/comments/bh1abv/loading_49_on_an_old_tandy_4025lx_386_16mb_1gb_hd/">Loading 4.9 on an old Tandy 4025LX - 386, 16MB, 1GB HD. Good old external SCSI CD</a></li>

<li><a href="https://forums.os108.org/d/6-os108-mate-20190422-released">OS108 MATE 20190422 released</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Casey - <a href="http://dpaste.com/39VJ7NH#wrap">Oklahoma City &amp; James</a></li>

<li>Michael - <a href="http://dpaste.com/2VSKEGW#wrap">Question on SAS backplane (camcontrol?)</a></li>

<li>Ales - <a href="http://dpaste.com/0AD0HBY#wrap">OpenBSD, FreeNAS, OpenZFS questions</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0297.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>296: It’s Alive: OpenBSD 6.5</title>
  <link>https://www.bsdnow.tv/296</link>
  <guid isPermaLink="false">81313d3c-40f8-49f3-bc58-f34f5dfcf51d</guid>
  <pubDate>Fri, 03 May 2019 13:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/81313d3c-40f8-49f3-bc58-f34f5dfcf51d.mp3" length="37476669" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 6.5 has been released, mount ZFS datasets anywhere, help test upcoming NetBSD 9 branch, LibreSSL 2.9.1 is available, Bail Bond Denied Edition of FreeBSD Mastery: Jails, and one reason ed(1) was a good editor back in the days in this week’s episode.</itunes:subtitle>
  <itunes:duration>1:01:35</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 6.5 has been released, mount ZFS datasets anywhere, help test upcoming NetBSD 9 branch, LibreSSL 2.9.1 is available, Bail Bond Denied Edition of FreeBSD Mastery: Jails, and one reason ed(1) was a good editor back in the days in this week’s episode.
&lt;h2&gt;Headlines&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://www.openbsd.org/65.html"&gt;OpenBSD 6.5 Released&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.openbsd.org/plus65.html"&gt;Changelog&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://www.openbsd.org/ftp.html"&gt;Mirrors&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;6.5 Includes


&lt;ul&gt;
&lt;li&gt;OpenSMTPD 6.5.0&lt;/li&gt;

&lt;li&gt;LibreSSL 2.9.1&lt;/li&gt;

&lt;li&gt;OpenSSH 8.0&lt;/li&gt;

&lt;li&gt;Mandoc 1.14.5&lt;/li&gt;

&lt;li&gt;Xenocara&lt;/li&gt;

&lt;li&gt;LLVM/Clang 7.0.1 (+ patches)&lt;/li&gt;

&lt;li&gt;GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;

&lt;li&gt;Many pre-built packages for each architecture:


&lt;ul&gt;
&lt;li&gt;aarch64: 9654&lt;/li&gt;

&lt;li&gt;amd64: 10602&lt;/li&gt;

&lt;li&gt;i386: 10535&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://dan.langille.org/2019/04/22/mount-your-zfs-datasets-anywhere-you-want/"&gt;Mount your ZFS datasets anywhere you want&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;ZFS is very flexible about mountpoints, and there are many features available to provide great flexibility.
  When you create zpool main&lt;em&gt;tank, the default mountpoint is /main&lt;/em&gt;tank.
  You might be happy with that, but you don’t have to be content. You can do magical things.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Some highlights are:


&lt;ul&gt;
&lt;li&gt;mount point can be inherited&lt;/li&gt;

&lt;li&gt;not all filesystems in a zpool need to be mounted&lt;/li&gt;

&lt;li&gt;each filesystem (directory) can have different ZFS characteristics&lt;/li&gt;

&lt;li&gt;In my case, let’s look at this new zpool I created earlier today and I will show you some very simple alternatives. This zpool use NVMe devices which should be faster than SSDs especially when used with multiple concurrent writes. This is my plan: run all the Bacula regression tests concurrently.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://mail-index.netbsd.org/current-users/2019/04/24/msg035645.html"&gt;Branch for netbsd 9 upcoming, please help and test -current&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Folks,
  once again we are quite late for branching the next NetBSD release (NetBSD 9).
  Initially planned to happen early in February 2019, we are now approaching May and it is unlikely that the branch will happen before that.
  On the positive side, lots of good things landed in -current in between, like new Mesa, new jemalloc, lots of ZFS improvements - and some of those would be hard to pull up to the branch later.
  On the bad side we saw lots of churn in -current recently, and there is quite  some fallout where we not even have a good overview right now. And this is where  you can help:&lt;/p&gt;
  
  &lt;ul&gt;
  &lt;li&gt;please test -current, on all the various machines you have&lt;/li&gt;
  
  &lt;li&gt;especially interesting would be test results from uncommon architectures
  or strange combinations (like the sparc userland on sparc64 kernel issue
  I ran in yesterday)
  Please test, report success, and file PRs for failures!
  We will likely announce the real branch date on quite short notice, the likely next candidates would be mid may or end of may.
  We may need to do extra steps after the branch (like switch some architectures back to old jemalloc on the branch). However, the less difference between -current and the branch, the easier will the release cycle go.
  Our goal is to have an unprecedented short release cycle this time. But..
  we always say that upfront.&lt;/li&gt;
  &lt;/ul&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://marc.info/?l=openbsd-announce&amp;amp;m=155590112606279&amp;amp;w=2"&gt;LibreSSL 2.9.1 Released&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;We have released LibreSSL 2.9.1, which will be arriving in the LibreSSL
  directory of your local OpenBSD mirror soon. This is the first stable release
  from the 2.9 series, which is also included with OpenBSD 6.5&lt;/p&gt;
  
  &lt;p&gt;It includes the following changes and improvements from LibreSSL 2.8.x:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;API and Documentation Enhancements&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;CRYPTO_LOCK is now automatically initialized, with the legacy
callbacks stubbed for compatibility.&lt;/li&gt;

&lt;li&gt;Added the SM3 hash function from the Chinese standard GB/T 32905-2016.&lt;/li&gt;

&lt;li&gt;Added the SM4 block cipher from the Chinese standard GB/T 32907-2016.&lt;/li&gt;

&lt;li&gt;Added more OPENSSL&lt;em&gt;NO&lt;/em&gt;* macros for compatibility with OpenSSL.&lt;/li&gt;

&lt;li&gt;Partial port of the OpenSSL EC&lt;em&gt;KEY&lt;/em&gt;METHOD API for use by OpenSSH.&lt;/li&gt;

&lt;li&gt;Implemented further missing OpenSSL 1.1 API.&lt;/li&gt;

&lt;li&gt;Added support for XChaCha20 and XChaCha20-Poly1305.&lt;/li&gt;

&lt;li&gt;Added support for AES key wrap constructions via the EVP interface.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;

&lt;li&gt;
&lt;p&gt;Compatibility Changes&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Added pbkdf2 key derivation support to openssl(1) enc.&lt;/li&gt;

&lt;li&gt;Changed the default digest type of openssl(1) enc to sha256.&lt;/li&gt;

&lt;li&gt;Changed the default digest type of openssl(1) dgst to sha256.&lt;/li&gt;

&lt;li&gt;Changed the default digest type of openssl(1) x509 -fingerprint to sha256.&lt;/li&gt;

&lt;li&gt;Changed the default digest type of openssl(1) crl -fingerprint to sha256.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;

&lt;li&gt;
&lt;p&gt;Testing and Proactive Security&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Added extensive interoperability tests between LibreSSL and OpenSSL
1.0 and 1.1.&lt;/li&gt;

&lt;li&gt;Added additional Wycheproof tests and related bug fixes.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;

&lt;li&gt;
&lt;p&gt;Internal Improvements&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Simplified sigalgs option processing and handshake signing
algorithm selection.&lt;/li&gt;

&lt;li&gt;Added the ability to use the RSA PSS algorithm for handshake signatures.&lt;/li&gt;

&lt;li&gt;Added bn&lt;em&gt;rand&lt;/em&gt;interval() and use it in code needing ranges of
random bn values.&lt;/li&gt;

&lt;li&gt;Added functionality to derive early, handshake, and application
secrets as per RFC8446.&lt;/li&gt;

&lt;li&gt;Added handshake state machine from RFC8446.&lt;/li&gt;

&lt;li&gt;Removed some ASN.1 related code from libcrypto that had not been
used since around 2000.&lt;/li&gt;

&lt;li&gt;Unexported internal symbols and internalized more record layer structs.&lt;/li&gt;

&lt;li&gt;Removed SHA224 based handshake signatures from consideration for
use in a TLS 1.2 handshake.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;

&lt;li&gt;
&lt;p&gt;Portable Improvements&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Added support for assembly optimizations on 32-bit ARM ELF targets.&lt;/li&gt;

&lt;li&gt;Added support for assembly optimizations on Mingw-w64 targets.&lt;/li&gt;

&lt;li&gt;Improved Android compatibility&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;

&lt;li&gt;
&lt;p&gt;Bug Fixes&lt;/p&gt;

&lt;p&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Improved protection against timing side channels in ECDSA signature
generation.&lt;/li&gt;

&lt;p&gt;&lt;/p&gt;
&lt;li&gt;Coordinate blinding was added to some elliptic curves. This is the
last bit of the work by Brumley et al. to protect against the Portsmash
vulnerability.&lt;/li&gt;

&lt;p&gt;&lt;/p&gt;
&lt;li&gt;Ensure transcript handshake is always freed with TLS 1.2.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;The LibreSSL project continues improvement of the codebase to reflect modern,
  safe programming practices. We welcome feedback and improvements from the
  broader community. Thanks to all of the contributors who helped make this
  release possible.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://mwl.io/archives/4227"&gt;FreeBSD Mastery: Jails – Bail Bond Denied Edition&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I had a brilliant, hideous idea: to produce a charity edition of FreeBSD Mastery: Jails featuring the cover art I would use if I was imprisoned and did not have access to a real cover artist. (Never mind that I wouldn’t be permitted to release books while in jail: we creative sorts scoff at mere legal and cultural details.)
  I originally wanted to produce my own take on the book’s cover art. My first attempt failed spectacularly.
  I downgraded my expectations and tried again. And again. And again.
  I’m pleased to reveal the final cover for FreeBSD Mastery: Jails–Bail Bond Edition!
  This cover represents the very pinnacle of my artistic talents, and is the result of literally hours of effort.
  But, as this book is available only to the winner of charity fund-raisers, purchase of this tome represents moral supremacy. I recommend flaunting it to your family, coworkers, and all those of lesser character.
  Get your copy by winning the BSDCan 2019 charity auction… or any other other auction-type event I deem worthwhile.
  As far as my moral fiber goes: I have learned that art is hard, and that artists are not paid enough.
  And if I am ever imprisoned, I do hope that you’ll contribute to my bail fund. Otherwise, you’ll get more covers like this one.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;

&lt;h3&gt;&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/unix/EdDesignedForCookedInput"&gt;One reason ed(1) was a good editor back in the days of V7 Unix&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;It is common to describe ed(1) as being line oriented, as opposed to screen oriented editors like vi. This is completely accurate but it is perhaps not a complete enough description for today, because ed is line oriented in a way that is now uncommon. After all, you could say that your shell is line oriented too, and very few people use shells that work and feel the same way ed does.
  The surface difference between most people's shells and ed is that most people's shells have some version of cursor based interactive editing. The deeper difference is that this requires the shell to run in character by character TTY input mode, also called raw mode. By contrast, ed runs in what Unix usually calls cooked mode, where it reads whole lines from the kernel and the kernel handles things like backspace. All of ed's commands are designed so that they work in this line focused way (including being terminated by the end of the line), and as a whole ed's interface makes this whole line input approach natural. In fact I think ed makes it so natural that it's hard to think of things as being any other way. Ed was designed for line at a time input, not just to not be screen oriented.
  This input mode difference is not very important today, but in the days of V7 and serial terminals it made a real difference. In cooked mode, V7 ran very little code when you entered each character; almost everything was deferred until it could be processed in bulk by the kernel, and then handed to ed all in a single line which ed could also process all at once. A version of ed that tried to work in raw mode would have been much more resource intensive, even if it still operated on single lines at a time.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;

&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-fs/2019-April/027603.html"&gt;CFT for FreeBSD ZoL&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://github.com/wilyarti/simple-dns-adblock"&gt;Simple DNS Adblock&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://twitter.com/unix_byte/status/1119904828182781958"&gt;AT&amp;amp;T Unix PC in 1985&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://marc.info/?l=openbsd-cvs&amp;amp;m=155523690813457&amp;amp;w=2"&gt;OpenBSD-current drm at 4.19, includes new support for Intel GPUs like Coffee Lake&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://twitter.com/cfenollosa/status/1122069042083323904"&gt;"What are the differences between Linux and OpenBSD?" - Twitter thread&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="http://mail-index.netbsd.org/pkgsrc-users/2019/04/10/msg028308.html"&gt;Announcing the pkgsrc-2019Q1 release (2019-04-10)&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Brad - &lt;a href="http://dpaste.com/0K2QFTM#wrap"&gt;iocage&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Frank - &lt;a href="http://dpaste.com/3110R96#wrap"&gt;Video from Level1Tech and a question&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Niall - &lt;a href="http://dpaste.com/0A32XDK#wrap"&gt;Revision Control&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, zfs, libressl, ed, michael lucas, dns, pkgsrc</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 6.5 has been released, mount ZFS datasets anywhere, help test upcoming NetBSD 9 branch, LibreSSL 2.9.1 is available, Bail Bond Denied Edition of FreeBSD Mastery: Jails, and one reason ed(1) was a good editor back in the days in this week’s episode.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="openbsd65releasedhttpswwwopenbsdorg65html"><a href="https://www.openbsd.org/65.html">OpenBSD 6.5 Released</a></h3>

<ul>
<li><a href="https://www.openbsd.org/plus65.html">Changelog</a></li>

<li><a href="https://www.openbsd.org/ftp.html">Mirrors</a></li>

<li>6.5 Includes


<ul>
<li>OpenSMTPD 6.5.0</li>

<li>LibreSSL 2.9.1</li>

<li>OpenSSH 8.0</li>

<li>Mandoc 1.14.5</li>

<li>Xenocara</li>

<li>LLVM/Clang 7.0.1 (+ patches)</li>

<li>GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)</li></ul>
</li>

<li>Many pre-built packages for each architecture:


<ul>
<li>aarch64: 9654</li>

<li>amd64: 10602</li>

<li>i386: 10535</li></ul>
</li>
</ul>

<p><hr /></p>

<h3 id="mountyourzfsdatasetsanywhereyouwanthttpsdanlangilleorg20190422mountyourzfsdatasetsanywhereyouwant"><a href="https://dan.langille.org/2019/04/22/mount-your-zfs-datasets-anywhere-you-want/">Mount your ZFS datasets anywhere you want</a></h3>

<blockquote>
  <p>ZFS is very flexible about mountpoints, and there are many features available to provide great flexibility.
  When you create zpool main<em>tank, the default mountpoint is /main</em>tank.
  You might be happy with that, but you don’t have to be content. You can do magical things.</p>
</blockquote>

<ul>
<li>Some highlights are:


<ul>
<li>mount point can be inherited</li>

<li>not all filesystems in a zpool need to be mounted</li>

<li>each filesystem (directory) can have different ZFS characteristics</li>

<li>In my case, let’s look at this new zpool I created earlier today and I will show you some very simple alternatives. This zpool use NVMe devices which should be faster than SSDs especially when used with multiple concurrent writes. This is my plan: run all the Bacula regression tests concurrently.</li></ul>
</li>
</ul>

<p><hr /></p>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="branchfornetbsd9upcomingpleasehelpandtestcurrenthttpsmailindexnetbsdorgcurrentusers20190424msg035645html"><a href="https://mail-index.netbsd.org/current-users/2019/04/24/msg035645.html">Branch for netbsd 9 upcoming, please help and test -current</a></h3>

<blockquote>
  <p>Folks,
  once again we are quite late for branching the next NetBSD release (NetBSD 9).
  Initially planned to happen early in February 2019, we are now approaching May and it is unlikely that the branch will happen before that.
  On the positive side, lots of good things landed in -current in between, like new Mesa, new jemalloc, lots of ZFS improvements - and some of those would be hard to pull up to the branch later.
  On the bad side we saw lots of churn in -current recently, and there is quite  some fallout where we not even have a good overview right now. And this is where  you can help:</p>
  
  <ul>
  <li>please test -current, on all the various machines you have</li>
  
  <li>especially interesting would be test results from uncommon architectures
  or strange combinations (like the sparc userland on sparc64 kernel issue
  I ran in yesterday)
  Please test, report success, and file PRs for failures!
  We will likely announce the real branch date on quite short notice, the likely next candidates would be mid may or end of may.
  We may need to do extra steps after the branch (like switch some architectures back to old jemalloc on the branch). However, the less difference between -current and the branch, the easier will the release cycle go.
  Our goal is to have an unprecedented short release cycle this time. But..
  we always say that upfront.</li>
  </ul>
  
  <hr />
</blockquote>

<h3 id="libressl291releasedhttpsmarcinfolopenbsdannouncem155590112606279w2"><a href="https://marc.info/?l=openbsd-announce&amp;m=155590112606279&amp;w=2">LibreSSL 2.9.1 Released</a></h3>

<blockquote>
  <p>We have released LibreSSL 2.9.1, which will be arriving in the LibreSSL
  directory of your local OpenBSD mirror soon. This is the first stable release
  from the 2.9 series, which is also included with OpenBSD 6.5</p>
  
  <p>It includes the following changes and improvements from LibreSSL 2.8.x:</p>
</blockquote>

<ul>
<li><p>API and Documentation Enhancements</p>

<ul>
<li>CRYPTO_LOCK is now automatically initialized, with the legacy
callbacks stubbed for compatibility.</li>

<li>Added the SM3 hash function from the Chinese standard GB/T 32905-2016.</li>

<li>Added the SM4 block cipher from the Chinese standard GB/T 32907-2016.</li>

<li>Added more OPENSSL<em>NO</em>* macros for compatibility with OpenSSL.</li>

<li>Partial port of the OpenSSL EC<em>KEY</em>METHOD API for use by OpenSSH.</li>

<li>Implemented further missing OpenSSL 1.1 API.</li>

<li>Added support for XChaCha20 and XChaCha20-Poly1305.</li>

<li>Added support for AES key wrap constructions via the EVP interface.</li></ul></li>

<li><p>Compatibility Changes</p>

<ul>
<li>Added pbkdf2 key derivation support to openssl(1) enc.</li>

<li>Changed the default digest type of openssl(1) enc to sha256.</li>

<li>Changed the default digest type of openssl(1) dgst to sha256.</li>

<li>Changed the default digest type of openssl(1) x509 -fingerprint to sha256.</li>

<li>Changed the default digest type of openssl(1) crl -fingerprint to sha256.</li></ul></li>

<li><p>Testing and Proactive Security</p>

<ul>
<li>Added extensive interoperability tests between LibreSSL and OpenSSL
1.0 and 1.1.</li>

<li>Added additional Wycheproof tests and related bug fixes.</li></ul></li>

<li><p>Internal Improvements</p>

<ul>
<li>Simplified sigalgs option processing and handshake signing
algorithm selection.</li>

<li>Added the ability to use the RSA PSS algorithm for handshake signatures.</li>

<li>Added bn<em>rand</em>interval() and use it in code needing ranges of
random bn values.</li>

<li>Added functionality to derive early, handshake, and application
secrets as per RFC8446.</li>

<li>Added handshake state machine from RFC8446.</li>

<li>Removed some ASN.1 related code from libcrypto that had not been
used since around 2000.</li>

<li>Unexported internal symbols and internalized more record layer structs.</li>

<li>Removed SHA224 based handshake signatures from consideration for
use in a TLS 1.2 handshake.</li></ul></li>

<li><p>Portable Improvements</p>

<ul>
<li>Added support for assembly optimizations on 32-bit ARM ELF targets.</li>

<li>Added support for assembly optimizations on Mingw-w64 targets.</li>

<li>Improved Android compatibility</li></ul></li>

<li><p>Bug Fixes</p>

<p><ul>
<li>Improved protection against timing side channels in ECDSA signature
generation.</li></p>

<p><li>Coordinate blinding was added to some elliptic curves. This is the
last bit of the work by Brumley et al. to protect against the Portsmash
vulnerability.</li></p>

<p><li>Ensure transcript handshake is always freed with TLS 1.2.</li></ul>

<p></p></li>
</ul></p>

<blockquote>
  <p>The LibreSSL project continues improvement of the codebase to reflect modern,
  safe programming practices. We welcome feedback and improvements from the
  broader community. Thanks to all of the contributors who helped make this
  release possible.</p>
  
  <hr />
</blockquote>

<h3 id="freebsdmasteryjailsbailbonddeniededitionhttpsmwlioarchives4227"><a href="https://mwl.io/archives/4227">FreeBSD Mastery: Jails – Bail Bond Denied Edition</a></h3>

<blockquote>
  <p>I had a brilliant, hideous idea: to produce a charity edition of FreeBSD Mastery: Jails featuring the cover art I would use if I was imprisoned and did not have access to a real cover artist. (Never mind that I wouldn’t be permitted to release books while in jail: we creative sorts scoff at mere legal and cultural details.)
  I originally wanted to produce my own take on the book’s cover art. My first attempt failed spectacularly.
  I downgraded my expectations and tried again. And again. And again.
  I’m pleased to reveal the final cover for FreeBSD Mastery: Jails–Bail Bond Edition!
  This cover represents the very pinnacle of my artistic talents, and is the result of literally hours of effort.
  But, as this book is available only to the winner of charity fund-raisers, purchase of this tome represents moral supremacy. I recommend flaunting it to your family, coworkers, and all those of lesser character.
  Get your copy by winning the BSDCan 2019 charity auction… or any other other auction-type event I deem worthwhile.
  As far as my moral fiber goes: I have learned that art is hard, and that artists are not paid enough.
  And if I am ever imprisoned, I do hope that you’ll contribute to my bail fund. Otherwise, you’ll get more covers like this one.</p>
</blockquote>

<hr />

<h3 id="onereasoned1wasagoodeditorbackinthedaysofv7unixhttpsutccutorontocatcksspaceblogunixeddesignedforcookedinput"><a href="https://utcc.utoronto.ca/~cks/space/blog/unix/EdDesignedForCookedInput">One reason ed(1) was a good editor back in the days of V7 Unix</a></h3>

<blockquote>
  <p>It is common to describe ed(1) as being line oriented, as opposed to screen oriented editors like vi. This is completely accurate but it is perhaps not a complete enough description for today, because ed is line oriented in a way that is now uncommon. After all, you could say that your shell is line oriented too, and very few people use shells that work and feel the same way ed does.
  The surface difference between most people's shells and ed is that most people's shells have some version of cursor based interactive editing. The deeper difference is that this requires the shell to run in character by character TTY input mode, also called raw mode. By contrast, ed runs in what Unix usually calls cooked mode, where it reads whole lines from the kernel and the kernel handles things like backspace. All of ed's commands are designed so that they work in this line focused way (including being terminated by the end of the line), and as a whole ed's interface makes this whole line input approach natural. In fact I think ed makes it so natural that it's hard to think of things as being any other way. Ed was designed for line at a time input, not just to not be screen oriented.
  This input mode difference is not very important today, but in the days of V7 and serial terminals it made a real difference. In cooked mode, V7 ran very little code when you entered each character; almost everything was deferred until it could be processed in bulk by the kernel, and then handed to ed all in a single line which ed could also process all at once. A version of ed that tried to work in raw mode would have been much more resource intensive, even if it still operated on single lines at a time.</p>
</blockquote>

<hr />

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-fs/2019-April/027603.html">CFT for FreeBSD ZoL</a></li>

<li><a href="https://github.com/wilyarti/simple-dns-adblock">Simple DNS Adblock</a></li>

<li><a href="https://twitter.com/unix_byte/status/1119904828182781958">AT&amp;T Unix PC in 1985</a></li>

<li><a href="https://marc.info/?l=openbsd-cvs&amp;m=155523690813457&amp;w=2">OpenBSD-current drm at 4.19, includes new support for Intel GPUs like Coffee Lake</a></li>

<li><a href="https://twitter.com/cfenollosa/status/1122069042083323904">"What are the differences between Linux and OpenBSD?" - Twitter thread</a></li>

<li><a href="http://mail-index.netbsd.org/pkgsrc-users/2019/04/10/msg028308.html">Announcing the pkgsrc-2019Q1 release (2019-04-10)</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Brad - <a href="http://dpaste.com/0K2QFTM#wrap">iocage</a></li>

<li>Frank - <a href="http://dpaste.com/3110R96#wrap">Video from Level1Tech and a question</a></li>

<li>Niall - <a href="http://dpaste.com/0A32XDK#wrap">Revision Control</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0296.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 6.5 has been released, mount ZFS datasets anywhere, help test upcoming NetBSD 9 branch, LibreSSL 2.9.1 is available, Bail Bond Denied Edition of FreeBSD Mastery: Jails, and one reason ed(1) was a good editor back in the days in this week’s episode.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="openbsd65releasedhttpswwwopenbsdorg65html"><a href="https://www.openbsd.org/65.html">OpenBSD 6.5 Released</a></h3>

<ul>
<li><a href="https://www.openbsd.org/plus65.html">Changelog</a></li>

<li><a href="https://www.openbsd.org/ftp.html">Mirrors</a></li>

<li>6.5 Includes


<ul>
<li>OpenSMTPD 6.5.0</li>

<li>LibreSSL 2.9.1</li>

<li>OpenSSH 8.0</li>

<li>Mandoc 1.14.5</li>

<li>Xenocara</li>

<li>LLVM/Clang 7.0.1 (+ patches)</li>

<li>GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)</li></ul>
</li>

<li>Many pre-built packages for each architecture:


<ul>
<li>aarch64: 9654</li>

<li>amd64: 10602</li>

<li>i386: 10535</li></ul>
</li>
</ul>

<p><hr /></p>

<h3 id="mountyourzfsdatasetsanywhereyouwanthttpsdanlangilleorg20190422mountyourzfsdatasetsanywhereyouwant"><a href="https://dan.langille.org/2019/04/22/mount-your-zfs-datasets-anywhere-you-want/">Mount your ZFS datasets anywhere you want</a></h3>

<blockquote>
  <p>ZFS is very flexible about mountpoints, and there are many features available to provide great flexibility.
  When you create zpool main<em>tank, the default mountpoint is /main</em>tank.
  You might be happy with that, but you don’t have to be content. You can do magical things.</p>
</blockquote>

<ul>
<li>Some highlights are:


<ul>
<li>mount point can be inherited</li>

<li>not all filesystems in a zpool need to be mounted</li>

<li>each filesystem (directory) can have different ZFS characteristics</li>

<li>In my case, let’s look at this new zpool I created earlier today and I will show you some very simple alternatives. This zpool use NVMe devices which should be faster than SSDs especially when used with multiple concurrent writes. This is my plan: run all the Bacula regression tests concurrently.</li></ul>
</li>
</ul>

<p><hr /></p>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="branchfornetbsd9upcomingpleasehelpandtestcurrenthttpsmailindexnetbsdorgcurrentusers20190424msg035645html"><a href="https://mail-index.netbsd.org/current-users/2019/04/24/msg035645.html">Branch for netbsd 9 upcoming, please help and test -current</a></h3>

<blockquote>
  <p>Folks,
  once again we are quite late for branching the next NetBSD release (NetBSD 9).
  Initially planned to happen early in February 2019, we are now approaching May and it is unlikely that the branch will happen before that.
  On the positive side, lots of good things landed in -current in between, like new Mesa, new jemalloc, lots of ZFS improvements - and some of those would be hard to pull up to the branch later.
  On the bad side we saw lots of churn in -current recently, and there is quite  some fallout where we not even have a good overview right now. And this is where  you can help:</p>
  
  <ul>
  <li>please test -current, on all the various machines you have</li>
  
  <li>especially interesting would be test results from uncommon architectures
  or strange combinations (like the sparc userland on sparc64 kernel issue
  I ran in yesterday)
  Please test, report success, and file PRs for failures!
  We will likely announce the real branch date on quite short notice, the likely next candidates would be mid may or end of may.
  We may need to do extra steps after the branch (like switch some architectures back to old jemalloc on the branch). However, the less difference between -current and the branch, the easier will the release cycle go.
  Our goal is to have an unprecedented short release cycle this time. But..
  we always say that upfront.</li>
  </ul>
  
  <hr />
</blockquote>

<h3 id="libressl291releasedhttpsmarcinfolopenbsdannouncem155590112606279w2"><a href="https://marc.info/?l=openbsd-announce&amp;m=155590112606279&amp;w=2">LibreSSL 2.9.1 Released</a></h3>

<blockquote>
  <p>We have released LibreSSL 2.9.1, which will be arriving in the LibreSSL
  directory of your local OpenBSD mirror soon. This is the first stable release
  from the 2.9 series, which is also included with OpenBSD 6.5</p>
  
  <p>It includes the following changes and improvements from LibreSSL 2.8.x:</p>
</blockquote>

<ul>
<li><p>API and Documentation Enhancements</p>

<ul>
<li>CRYPTO_LOCK is now automatically initialized, with the legacy
callbacks stubbed for compatibility.</li>

<li>Added the SM3 hash function from the Chinese standard GB/T 32905-2016.</li>

<li>Added the SM4 block cipher from the Chinese standard GB/T 32907-2016.</li>

<li>Added more OPENSSL<em>NO</em>* macros for compatibility with OpenSSL.</li>

<li>Partial port of the OpenSSL EC<em>KEY</em>METHOD API for use by OpenSSH.</li>

<li>Implemented further missing OpenSSL 1.1 API.</li>

<li>Added support for XChaCha20 and XChaCha20-Poly1305.</li>

<li>Added support for AES key wrap constructions via the EVP interface.</li></ul></li>

<li><p>Compatibility Changes</p>

<ul>
<li>Added pbkdf2 key derivation support to openssl(1) enc.</li>

<li>Changed the default digest type of openssl(1) enc to sha256.</li>

<li>Changed the default digest type of openssl(1) dgst to sha256.</li>

<li>Changed the default digest type of openssl(1) x509 -fingerprint to sha256.</li>

<li>Changed the default digest type of openssl(1) crl -fingerprint to sha256.</li></ul></li>

<li><p>Testing and Proactive Security</p>

<ul>
<li>Added extensive interoperability tests between LibreSSL and OpenSSL
1.0 and 1.1.</li>

<li>Added additional Wycheproof tests and related bug fixes.</li></ul></li>

<li><p>Internal Improvements</p>

<ul>
<li>Simplified sigalgs option processing and handshake signing
algorithm selection.</li>

<li>Added the ability to use the RSA PSS algorithm for handshake signatures.</li>

<li>Added bn<em>rand</em>interval() and use it in code needing ranges of
random bn values.</li>

<li>Added functionality to derive early, handshake, and application
secrets as per RFC8446.</li>

<li>Added handshake state machine from RFC8446.</li>

<li>Removed some ASN.1 related code from libcrypto that had not been
used since around 2000.</li>

<li>Unexported internal symbols and internalized more record layer structs.</li>

<li>Removed SHA224 based handshake signatures from consideration for
use in a TLS 1.2 handshake.</li></ul></li>

<li><p>Portable Improvements</p>

<ul>
<li>Added support for assembly optimizations on 32-bit ARM ELF targets.</li>

<li>Added support for assembly optimizations on Mingw-w64 targets.</li>

<li>Improved Android compatibility</li></ul></li>

<li><p>Bug Fixes</p>

<p><ul>
<li>Improved protection against timing side channels in ECDSA signature
generation.</li></p>

<p><li>Coordinate blinding was added to some elliptic curves. This is the
last bit of the work by Brumley et al. to protect against the Portsmash
vulnerability.</li></p>

<p><li>Ensure transcript handshake is always freed with TLS 1.2.</li></ul>

<p></p></li>
</ul></p>

<blockquote>
  <p>The LibreSSL project continues improvement of the codebase to reflect modern,
  safe programming practices. We welcome feedback and improvements from the
  broader community. Thanks to all of the contributors who helped make this
  release possible.</p>
  
  <hr />
</blockquote>

<h3 id="freebsdmasteryjailsbailbonddeniededitionhttpsmwlioarchives4227"><a href="https://mwl.io/archives/4227">FreeBSD Mastery: Jails – Bail Bond Denied Edition</a></h3>

<blockquote>
  <p>I had a brilliant, hideous idea: to produce a charity edition of FreeBSD Mastery: Jails featuring the cover art I would use if I was imprisoned and did not have access to a real cover artist. (Never mind that I wouldn’t be permitted to release books while in jail: we creative sorts scoff at mere legal and cultural details.)
  I originally wanted to produce my own take on the book’s cover art. My first attempt failed spectacularly.
  I downgraded my expectations and tried again. And again. And again.
  I’m pleased to reveal the final cover for FreeBSD Mastery: Jails–Bail Bond Edition!
  This cover represents the very pinnacle of my artistic talents, and is the result of literally hours of effort.
  But, as this book is available only to the winner of charity fund-raisers, purchase of this tome represents moral supremacy. I recommend flaunting it to your family, coworkers, and all those of lesser character.
  Get your copy by winning the BSDCan 2019 charity auction… or any other other auction-type event I deem worthwhile.
  As far as my moral fiber goes: I have learned that art is hard, and that artists are not paid enough.
  And if I am ever imprisoned, I do hope that you’ll contribute to my bail fund. Otherwise, you’ll get more covers like this one.</p>
</blockquote>

<hr />

<h3 id="onereasoned1wasagoodeditorbackinthedaysofv7unixhttpsutccutorontocatcksspaceblogunixeddesignedforcookedinput"><a href="https://utcc.utoronto.ca/~cks/space/blog/unix/EdDesignedForCookedInput">One reason ed(1) was a good editor back in the days of V7 Unix</a></h3>

<blockquote>
  <p>It is common to describe ed(1) as being line oriented, as opposed to screen oriented editors like vi. This is completely accurate but it is perhaps not a complete enough description for today, because ed is line oriented in a way that is now uncommon. After all, you could say that your shell is line oriented too, and very few people use shells that work and feel the same way ed does.
  The surface difference between most people's shells and ed is that most people's shells have some version of cursor based interactive editing. The deeper difference is that this requires the shell to run in character by character TTY input mode, also called raw mode. By contrast, ed runs in what Unix usually calls cooked mode, where it reads whole lines from the kernel and the kernel handles things like backspace. All of ed's commands are designed so that they work in this line focused way (including being terminated by the end of the line), and as a whole ed's interface makes this whole line input approach natural. In fact I think ed makes it so natural that it's hard to think of things as being any other way. Ed was designed for line at a time input, not just to not be screen oriented.
  This input mode difference is not very important today, but in the days of V7 and serial terminals it made a real difference. In cooked mode, V7 ran very little code when you entered each character; almost everything was deferred until it could be processed in bulk by the kernel, and then handed to ed all in a single line which ed could also process all at once. A version of ed that tried to work in raw mode would have been much more resource intensive, even if it still operated on single lines at a time.</p>
</blockquote>

<hr />

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-fs/2019-April/027603.html">CFT for FreeBSD ZoL</a></li>

<li><a href="https://github.com/wilyarti/simple-dns-adblock">Simple DNS Adblock</a></li>

<li><a href="https://twitter.com/unix_byte/status/1119904828182781958">AT&amp;T Unix PC in 1985</a></li>

<li><a href="https://marc.info/?l=openbsd-cvs&amp;m=155523690813457&amp;w=2">OpenBSD-current drm at 4.19, includes new support for Intel GPUs like Coffee Lake</a></li>

<li><a href="https://twitter.com/cfenollosa/status/1122069042083323904">"What are the differences between Linux and OpenBSD?" - Twitter thread</a></li>

<li><a href="http://mail-index.netbsd.org/pkgsrc-users/2019/04/10/msg028308.html">Announcing the pkgsrc-2019Q1 release (2019-04-10)</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Brad - <a href="http://dpaste.com/0K2QFTM#wrap">iocage</a></li>

<li>Frank - <a href="http://dpaste.com/3110R96#wrap">Video from Level1Tech and a question</a></li>

<li>Niall - <a href="http://dpaste.com/0A32XDK#wrap">Revision Control</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0296.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>295: Fun with funlinkat()</title>
  <link>https://www.bsdnow.tv/295</link>
  <guid isPermaLink="false">f856e52d-1f51-46e1-9dd9-658045523279</guid>
  <pubDate>Thu, 25 Apr 2019 16:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f856e52d-1f51-46e1-9dd9-658045523279.mp3" length="37143014" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Introducing funlinkat(), an OpenBSD Router with AT&amp;T U-Verse, using NetBSD on a raspberry pi, ZFS encryption is still under development, Rump kernel servers and clients tutorial, Snort on OpenBSD 6.4, and more.</itunes:subtitle>
  <itunes:duration>1:01:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Introducing funlinkat(), an OpenBSD Router with AT&amp;amp;T U-Verse, using NetBSD on a raspberry pi, ZFS encryption is still under development, Rump kernel servers and clients tutorial, Snort on OpenBSD 6.4, and more.
&lt;h2&gt;Headlines&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://oshogbo.vexillium.org/blog/63/"&gt;Introducing funlinkat&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;It turns out, every file you have ever deleted on a unix machine was probably susceptible to a race condition&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;One of the first syscalls which was created in Unix-like systems is unlink. In FreeBSD this syscall is number 10 (source) and in Linux, the number is dependent on the architecture but for most of them is also the tenth syscall (source). This indicated that this is one of the primary syscalls. The unlink syscall is very simple and we provide one single path to the file that we want to remove.
  The “removing file” process itself is very interesting so let’s spend a moment to understand the it. First, by removing the file we are removing a link from the directory to it. In Unix-like systems we can have many links to a single file (hard links). When we remove all links to the file, the file system will mark the blocks used by the file as free (a different file system will behave differently but let’s not jump into a second digression). This is why the process is called unlinking and not “removing file”. While we unlink the file two or three things will happen:&lt;/p&gt;
  
  &lt;ul&gt;
  &lt;li&gt;We will remove an entry in the directory with the filename.&lt;/li&gt;
  
  &lt;li&gt;We will decrease a file reference count (in inode).&lt;/li&gt;
  
  &lt;li&gt;If links go to zero - the file will be removed from the disk (again this doesn't mean that the blocks from the disk will be filled with zeros, though this may happen depending on the file system and configuration. However, in most cases this means that the file system will mark those blocks to as free and use them to write new data later
  This mostly means that “removing file” from a directory is an operation on the directory and not on the file (inode) itself.
  Another interesting subject is what happens if our system will perform only first or second step from the list. This depends on the file system and this is also something we will leave for another time.
  The problem with the unlink and even unlinkat function is that we don’t have any guarantee of which file we really are unlinking.
  
  
  &lt;ul&gt;
  &lt;li&gt;When you delete a file using its name, you have no guarantee that someone has not already deleted the file, or renamed it, and created a new file with the name you are about to delete.
  We have some stats about the file that we want to unlink. We performed some tests. In the same time another process removed our file and recreated it. When we finally try to remove our file it is no longer the same file. It’s a classic race condition.&lt;/li&gt;
  
  &lt;li&gt;Many programs will perform checks before trying to remove a file, to make sure it is the correct file, that you have the correct permissions etc. However this exposes the ‘Time-of-Check / Time-of-Use’ class of bugs. I check if the file I am about to remove is the one I created yesterday, it is, so I call unlink() on it. However, between when I checked the date on the file, and when I call unlink, I, some program I am running, might have updated the file. Or a malicious user might have put some other file at that name, so I would be the one who deleted it.
  In Unix-like operating systems we can get a handle for our file called file - a descriptor. File descriptors guarantee us that all the operations that we will be performing on it are done on the same file (inode). Even if someone was to unlink a number of directories entries, the operating system will not free the structures behind the file descriptor, and we can detect the file that was removed by someone and recreated (or just unlinked). So, for example, we have an alternative functions fstat which allows us to get file status of the given descriptor
  We already know that the file may have many links on the disk which point to the single inode. What happens when we open the file? Simplifying: kernel creates a memory representation of the inode (the inode itself is stored on the disk) called vnode. This single representation is used by all processes to refer the inode to the disk. If in a process we open the same file (inode) using different names (for example through hard links) all those files will be linked to the single vnode. That means that the pathname is not stored in the kernel.
  This is basically the reason why we don’t have a funlink function so that instead of the path we are providing just the file descriptor to the file. If we performed the fdunlink syscall, the kernel wouldn’t know which directory entry you would like to remove. Another problem is more architectural: as we discussed earlier unlinking is really an operation on the directory not on the file (inode) itself, so using funlink(fd) may create some confusion because we are not removing the inode corresponding to the file descriptor, we are performing action on the directory which points to the file.
  After some discussion we decided that the only sensible option for FreeBSD would be to create a funlinkat() function. This syscall would only performs additional sanitary checks if we are removing a directory entry which corresponds to the inode stored which refers to the file descriptor.
  int funlinkat(int dfd, const char *path, int fd, int flags);
  The API above will check if the path opened relative to the dfd points to the same vnode. Thanks to that we removed a race condition because all those sanitary checks are performed in the kernel mode while the file system is locked and there is no possibility to change it.
  The fd parameter may be set to the FD_NONE value which will mean that the sanitary check should not be performed and funlinkat will behave just like unlinkat.
  As you can notice I often refer to the unlink syscall but at the end the APIs looks like unlinkat syscall. It is true that the unlink syscall is very old and kind of deprecated. That said I referred to unlink because it’s just simpler. These days unlink simply uses the same code as unlinkat.&lt;/li&gt;
&lt;/ul&gt;
  &lt;/li&gt;
  &lt;/ul&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://jcs.org/2019/03/21/uverse"&gt;Using an OpenBSD Router with AT&amp;amp;T U-Verse&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I upgraded to AT&amp;amp;T's U-verse Gigabit internet service in 2017 and it came with an Arris BGW-210 as the WiFi AP and router. The BGW-210 is not a terrible device, but I already had my own Airport Extreme APs wired throughout my house and an OpenBSD router configured with various things, so I had no use for this device. It's also a potentially-insecure device that I can't upgrade or fully disable remote control over.
  Fully removing the BGW-210 is not possible as we'll see later, but it is possible to remove it from the routing path. This is how I did it with OpenBSD.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://opensource.com/article/19/3/netbsd-raspberry-pi"&gt;How to use NetBSD on a Raspberry Pi&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Do you have an old Raspberry Pi lying around gathering dust, maybe after a recent Pi upgrade? Are you curious about BSD Unix? If you answered "yes" to both of these questions, you'll be pleased to know that the first is the solution to the second, because you can run NetBSD, as far back as the very first release, on a Raspberry Pi.
  BSD is the Berkley Software Distribution of Unix. In fact, it's the only open source Unix with direct lineage back to the original source code written by Dennis Ritchie and Ken Thompson at Bell Labs. Other modern versions are either proprietary (such as AIX and Solaris) or clever re-implementations (such as Minix and GNU/Linux). If you're used to Linux, you'll feel mostly right at home with BSD, but there are plenty of new commands and conventions to discover. If you're still relatively new to open source, trying BSD is a good way to experience a traditional Unix.
  Admittedly, NetBSD isn't an operating system that's perfectly suited for the Pi. It's a minimal install compared to many Linux distributions designed specifically for the Pi, and not all components of recent Pi models are functional under NetBSD yet. However, it's arguably an ideal OS for the older Pi models, since it's lightweight and lovingly maintained. And if nothing else, it's a lot of fun for any die-hard Unix geek to experience another side of the POSIX world.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/linux/ZFSEncryptionNotReady"&gt;ZFS Encryption is still under development (as of March 2019)&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;One of the big upcoming features that a bunch of people are looking forward to in ZFS is natively encrypted filesystems. This is already in the main development tree of ZFS On Linux, will likely propagate to FreeBSD (since FreeBSD ZFS will be based on ZoL), and will make it to Illumos if the Illumos people want to pull it in. People are looking forward to native encryption so much, in fact, that some of them have started using it in ZFS On Linux already, using either the development tip or one of the 0.8.0 release candidate pre-releases (ZoL is up to 0.8.0-rc3 as of now). People either doing this or planning to do this show up on the ZoL mailing list every so often.&lt;/p&gt;
  
  &lt;ul&gt;
  &lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-April/090915.html"&gt;CFT for FreeBSD + ZoL&lt;/a&gt;&lt;/li&gt;
  &lt;/ul&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://www.netbsd.org/docs/rump/sptut.html"&gt;Tutorial On Rump Kernel Servers and Clients&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;The rump anykernel architecture allows to run highly componentized kernel code configurations in userspace processes. Coupled with the rump sysproxy facility it is possible to run loosely distributed client-server "mini-operating systems". Since there is minimum configuration and the bootstrap time is measured in milliseconds, these environments are very cheap to set up, use, and tear down on-demand.
  This document acts as a tutorial on how to configure and use unmodified NetBSD kernel drivers as userspace services with utilities available from the NetBSD base system. As part of this, it presents various use cases. One uses the kernel cryptographic disk driver (cgd) to encrypt a partition. Another one demonstrates how to operate an FFS server for editing the contents of a file system even though your user account does not have privileges to use the host's mount() system call. Additionally, using a userspace TCP/IP server with an unmodified web browser is detailed.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://functionallyparanoid.com/2019/03/18/installing-snort-on-openbsd-6-4/"&gt;Installing Snort on OpenBSD 6.4&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;As you may recall from previous posts, I am running an OpenBSD server on an APU2 air-cooled 3 Intel NIC box as my router/firewall for my secure home network.  Given that all of my Internet traffic flows through this box, I thought it would be a cool idea to run an Intrusion Detection System (IDS) on it.  Snort is the big hog of the open source world so I took a peek in the packages directory on one of the mirrors and lo and behold we have the latest &amp;amp; greatest version of Snort available!  Thanks devs!!!
  I did some quick Googling and didn’t find much “modern” howto help out there so, after some trial and error, I have it up and running.  I thought I’d give back in a small way and share a quickie howto for other Googlers out there who are looking for guidance.  Here’s hoping that my title is good enough “SEO” to get you here! &lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://os108.org/"&gt;os108&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=tc4ROCJYbm0&amp;amp;feature=youtu.be"&gt;AT&amp;amp;T Archives: The UNIX Operating System&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://marc.info/?l=openbsd-tech&amp;amp;m=155407864604288&amp;amp;w=2"&gt;httpd(8): Adapt to industry wide current best security practices&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://codesmithdev.com/quotes-from-a-book-that-bashes-unix/"&gt;Quotes From A Book That Bashes Unix&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://github.com/ligurio/openbsd-tests/wiki"&gt;OpenBSD QA wiki&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Malcolm - &lt;a href="http://dpaste.com/1AFFTNJ"&gt;Laptop Experience : Dell XPS 13&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;DJ - &lt;a href="http://dpaste.com/0V74SZC#wrap"&gt;Feedback&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Alex - &lt;a href="http://dpaste.com/1WVV1W7"&gt;GhostBSD and Wifi : FIXED&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Introducing funlinkat(), an OpenBSD Router with AT&amp;T U-Verse, using NetBSD on a raspberry pi, ZFS encryption is still under development, Rump kernel servers and clients tutorial, Snort on OpenBSD 6.4, and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="introducingfunlinkathttpsoshogbovexilliumorgblog63"><a href="https://oshogbo.vexillium.org/blog/63/">Introducing funlinkat</a></h3>

<ul>
<li>It turns out, every file you have ever deleted on a unix machine was probably susceptible to a race condition</li>
</ul>

<blockquote>
  <p>One of the first syscalls which was created in Unix-like systems is unlink. In FreeBSD this syscall is number 10 (source) and in Linux, the number is dependent on the architecture but for most of them is also the tenth syscall (source). This indicated that this is one of the primary syscalls. The unlink syscall is very simple and we provide one single path to the file that we want to remove.
  The “removing file” process itself is very interesting so let’s spend a moment to understand the it. First, by removing the file we are removing a link from the directory to it. In Unix-like systems we can have many links to a single file (hard links). When we remove all links to the file, the file system will mark the blocks used by the file as free (a different file system will behave differently but let’s not jump into a second digression). This is why the process is called unlinking and not “removing file”. While we unlink the file two or three things will happen:</p>
  
  <ul>
  <li>We will remove an entry in the directory with the filename.</li>
  
  <li>We will decrease a file reference count (in inode).</li>
  
  <li>If links go to zero - the file will be removed from the disk (again this doesn't mean that the blocks from the disk will be filled with zeros, though this may happen depending on the file system and configuration. However, in most cases this means that the file system will mark those blocks to as free and use them to write new data later
  This mostly means that “removing file” from a directory is an operation on the directory and not on the file (inode) itself.
  Another interesting subject is what happens if our system will perform only first or second step from the list. This depends on the file system and this is also something we will leave for another time.
  The problem with the unlink and even unlinkat function is that we don’t have any guarantee of which file we really are unlinking.
  
  
  <ul>
  <li>When you delete a file using its name, you have no guarantee that someone has not already deleted the file, or renamed it, and created a new file with the name you are about to delete.
  We have some stats about the file that we want to unlink. We performed some tests. In the same time another process removed our file and recreated it. When we finally try to remove our file it is no longer the same file. It’s a classic race condition.</li>
  
  <li>Many programs will perform checks before trying to remove a file, to make sure it is the correct file, that you have the correct permissions etc. However this exposes the ‘Time-of-Check / Time-of-Use’ class of bugs. I check if the file I am about to remove is the one I created yesterday, it is, so I call unlink() on it. However, between when I checked the date on the file, and when I call unlink, I, some program I am running, might have updated the file. Or a malicious user might have put some other file at that name, so I would be the one who deleted it.
  In Unix-like operating systems we can get a handle for our file called file - a descriptor. File descriptors guarantee us that all the operations that we will be performing on it are done on the same file (inode). Even if someone was to unlink a number of directories entries, the operating system will not free the structures behind the file descriptor, and we can detect the file that was removed by someone and recreated (or just unlinked). So, for example, we have an alternative functions fstat which allows us to get file status of the given descriptor
  We already know that the file may have many links on the disk which point to the single inode. What happens when we open the file? Simplifying: kernel creates a memory representation of the inode (the inode itself is stored on the disk) called vnode. This single representation is used by all processes to refer the inode to the disk. If in a process we open the same file (inode) using different names (for example through hard links) all those files will be linked to the single vnode. That means that the pathname is not stored in the kernel.
  This is basically the reason why we don’t have a funlink function so that instead of the path we are providing just the file descriptor to the file. If we performed the fdunlink syscall, the kernel wouldn’t know which directory entry you would like to remove. Another problem is more architectural: as we discussed earlier unlinking is really an operation on the directory not on the file (inode) itself, so using funlink(fd) may create some confusion because we are not removing the inode corresponding to the file descriptor, we are performing action on the directory which points to the file.
  After some discussion we decided that the only sensible option for FreeBSD would be to create a funlinkat() function. This syscall would only performs additional sanitary checks if we are removing a directory entry which corresponds to the inode stored which refers to the file descriptor.
  int funlinkat(int dfd, const char *path, int fd, int flags);
  The API above will check if the path opened relative to the dfd points to the same vnode. Thanks to that we removed a race condition because all those sanitary checks are performed in the kernel mode while the file system is locked and there is no possibility to change it.
  The fd parameter may be set to the FD_NONE value which will mean that the sanitary check should not be performed and funlinkat will behave just like unlinkat.
  As you can notice I often refer to the unlink syscall but at the end the APIs looks like unlinkat syscall. It is true that the unlink syscall is very old and kind of deprecated. That said I referred to unlink because it’s just simpler. These days unlink simply uses the same code as unlinkat.</li></ul>
  </li>
  </ul>
  
  <hr />
</blockquote>

<h3 id="usinganopenbsdrouterwithattuversehttpsjcsorg20190321uverse"><a href="https://jcs.org/2019/03/21/uverse">Using an OpenBSD Router with AT&amp;T U-Verse</a></h3>

<blockquote>
  <p>I upgraded to AT&amp;T's U-verse Gigabit internet service in 2017 and it came with an Arris BGW-210 as the WiFi AP and router. The BGW-210 is not a terrible device, but I already had my own Airport Extreme APs wired throughout my house and an OpenBSD router configured with various things, so I had no use for this device. It's also a potentially-insecure device that I can't upgrade or fully disable remote control over.
  Fully removing the BGW-210 is not possible as we'll see later, but it is possible to remove it from the routing path. This is how I did it with OpenBSD.</p>
  
  <hr />
</blockquote>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="howtousenetbsdonaraspberrypihttpsopensourcecomarticle193netbsdraspberrypi"><a href="https://opensource.com/article/19/3/netbsd-raspberry-pi">How to use NetBSD on a Raspberry Pi</a></h3>

<blockquote>
  <p>Do you have an old Raspberry Pi lying around gathering dust, maybe after a recent Pi upgrade? Are you curious about BSD Unix? If you answered "yes" to both of these questions, you'll be pleased to know that the first is the solution to the second, because you can run NetBSD, as far back as the very first release, on a Raspberry Pi.
  BSD is the Berkley Software Distribution of Unix. In fact, it's the only open source Unix with direct lineage back to the original source code written by Dennis Ritchie and Ken Thompson at Bell Labs. Other modern versions are either proprietary (such as AIX and Solaris) or clever re-implementations (such as Minix and GNU/Linux). If you're used to Linux, you'll feel mostly right at home with BSD, but there are plenty of new commands and conventions to discover. If you're still relatively new to open source, trying BSD is a good way to experience a traditional Unix.
  Admittedly, NetBSD isn't an operating system that's perfectly suited for the Pi. It's a minimal install compared to many Linux distributions designed specifically for the Pi, and not all components of recent Pi models are functional under NetBSD yet. However, it's arguably an ideal OS for the older Pi models, since it's lightweight and lovingly maintained. And if nothing else, it's a lot of fun for any die-hard Unix geek to experience another side of the POSIX world.</p>
  
  <hr />
</blockquote>

<h3 id="zfsencryptionisstillunderdevelopmentasofmarch2019httpsutccutorontocatcksspacebloglinuxzfsencryptionnotready"><a href="https://utcc.utoronto.ca/~cks/space/blog/linux/ZFSEncryptionNotReady">ZFS Encryption is still under development (as of March 2019)</a></h3>

<blockquote>
  <p>One of the big upcoming features that a bunch of people are looking forward to in ZFS is natively encrypted filesystems. This is already in the main development tree of ZFS On Linux, will likely propagate to FreeBSD (since FreeBSD ZFS will be based on ZoL), and will make it to Illumos if the Illumos people want to pull it in. People are looking forward to native encryption so much, in fact, that some of them have started using it in ZFS On Linux already, using either the development tip or one of the 0.8.0 release candidate pre-releases (ZoL is up to 0.8.0-rc3 as of now). People either doing this or planning to do this show up on the ZoL mailing list every so often.</p>
  
  <ul>
  <li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-April/090915.html">CFT for FreeBSD + ZoL</a></li>
  </ul>
  
  <hr />
</blockquote>

<h3 id="tutorialonrumpkernelserversandclientshttpswwwnetbsdorgdocsrumpsptuthtml"><a href="https://www.netbsd.org/docs/rump/sptut.html">Tutorial On Rump Kernel Servers and Clients</a></h3>

<blockquote>
  <p>The rump anykernel architecture allows to run highly componentized kernel code configurations in userspace processes. Coupled with the rump sysproxy facility it is possible to run loosely distributed client-server "mini-operating systems". Since there is minimum configuration and the bootstrap time is measured in milliseconds, these environments are very cheap to set up, use, and tear down on-demand.
  This document acts as a tutorial on how to configure and use unmodified NetBSD kernel drivers as userspace services with utilities available from the NetBSD base system. As part of this, it presents various use cases. One uses the kernel cryptographic disk driver (cgd) to encrypt a partition. Another one demonstrates how to operate an FFS server for editing the contents of a file system even though your user account does not have privileges to use the host's mount() system call. Additionally, using a userspace TCP/IP server with an unmodified web browser is detailed.</p>
  
  <hr />
</blockquote>

<h3 id="installingsnortonopenbsd64httpsfunctionallyparanoidcom20190318installingsnortonopenbsd64"><a href="https://functionallyparanoid.com/2019/03/18/installing-snort-on-openbsd-6-4/">Installing Snort on OpenBSD 6.4</a></h3>

<blockquote>
  <p>As you may recall from previous posts, I am running an OpenBSD server on an APU2 air-cooled 3 Intel NIC box as my router/firewall for my secure home network.  Given that all of my Internet traffic flows through this box, I thought it would be a cool idea to run an Intrusion Detection System (IDS) on it.  Snort is the big hog of the open source world so I took a peek in the packages directory on one of the mirrors and lo and behold we have the latest &amp; greatest version of Snort available!  Thanks devs!!!
  I did some quick Googling and didn’t find much “modern” howto help out there so, after some trial and error, I have it up and running.  I thought I’d give back in a small way and share a quickie howto for other Googlers out there who are looking for guidance.  Here’s hoping that my title is good enough “SEO” to get you here! </p>
  
  <hr />
</blockquote>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://os108.org/">os108</a></li>

<li><a href="https://www.youtube.com/watch?v=tc4ROCJYbm0&amp;feature=youtu.be">AT&amp;T Archives: The UNIX Operating System</a></li>

<li><a href="https://marc.info/?l=openbsd-tech&amp;m=155407864604288&amp;w=2">httpd(8): Adapt to industry wide current best security practices</a></li>

<li><a href="https://codesmithdev.com/quotes-from-a-book-that-bashes-unix/">Quotes From A Book That Bashes Unix</a></li>

<li><a href="https://github.com/ligurio/openbsd-tests/wiki">OpenBSD QA wiki</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Malcolm - <a href="http://dpaste.com/1AFFTNJ">Laptop Experience : Dell XPS 13</a></li>

<li>DJ - <a href="http://dpaste.com/0V74SZC#wrap">Feedback</a></li>

<li>Alex - <a href="http://dpaste.com/1WVV1W7">GhostBSD and Wifi : FIXED</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0295.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Introducing funlinkat(), an OpenBSD Router with AT&amp;T U-Verse, using NetBSD on a raspberry pi, ZFS encryption is still under development, Rump kernel servers and clients tutorial, Snort on OpenBSD 6.4, and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="introducingfunlinkathttpsoshogbovexilliumorgblog63"><a href="https://oshogbo.vexillium.org/blog/63/">Introducing funlinkat</a></h3>

<ul>
<li>It turns out, every file you have ever deleted on a unix machine was probably susceptible to a race condition</li>
</ul>

<blockquote>
  <p>One of the first syscalls which was created in Unix-like systems is unlink. In FreeBSD this syscall is number 10 (source) and in Linux, the number is dependent on the architecture but for most of them is also the tenth syscall (source). This indicated that this is one of the primary syscalls. The unlink syscall is very simple and we provide one single path to the file that we want to remove.
  The “removing file” process itself is very interesting so let’s spend a moment to understand the it. First, by removing the file we are removing a link from the directory to it. In Unix-like systems we can have many links to a single file (hard links). When we remove all links to the file, the file system will mark the blocks used by the file as free (a different file system will behave differently but let’s not jump into a second digression). This is why the process is called unlinking and not “removing file”. While we unlink the file two or three things will happen:</p>
  
  <ul>
  <li>We will remove an entry in the directory with the filename.</li>
  
  <li>We will decrease a file reference count (in inode).</li>
  
  <li>If links go to zero - the file will be removed from the disk (again this doesn't mean that the blocks from the disk will be filled with zeros, though this may happen depending on the file system and configuration. However, in most cases this means that the file system will mark those blocks to as free and use them to write new data later
  This mostly means that “removing file” from a directory is an operation on the directory and not on the file (inode) itself.
  Another interesting subject is what happens if our system will perform only first or second step from the list. This depends on the file system and this is also something we will leave for another time.
  The problem with the unlink and even unlinkat function is that we don’t have any guarantee of which file we really are unlinking.
  
  
  <ul>
  <li>When you delete a file using its name, you have no guarantee that someone has not already deleted the file, or renamed it, and created a new file with the name you are about to delete.
  We have some stats about the file that we want to unlink. We performed some tests. In the same time another process removed our file and recreated it. When we finally try to remove our file it is no longer the same file. It’s a classic race condition.</li>
  
  <li>Many programs will perform checks before trying to remove a file, to make sure it is the correct file, that you have the correct permissions etc. However this exposes the ‘Time-of-Check / Time-of-Use’ class of bugs. I check if the file I am about to remove is the one I created yesterday, it is, so I call unlink() on it. However, between when I checked the date on the file, and when I call unlink, I, some program I am running, might have updated the file. Or a malicious user might have put some other file at that name, so I would be the one who deleted it.
  In Unix-like operating systems we can get a handle for our file called file - a descriptor. File descriptors guarantee us that all the operations that we will be performing on it are done on the same file (inode). Even if someone was to unlink a number of directories entries, the operating system will not free the structures behind the file descriptor, and we can detect the file that was removed by someone and recreated (or just unlinked). So, for example, we have an alternative functions fstat which allows us to get file status of the given descriptor
  We already know that the file may have many links on the disk which point to the single inode. What happens when we open the file? Simplifying: kernel creates a memory representation of the inode (the inode itself is stored on the disk) called vnode. This single representation is used by all processes to refer the inode to the disk. If in a process we open the same file (inode) using different names (for example through hard links) all those files will be linked to the single vnode. That means that the pathname is not stored in the kernel.
  This is basically the reason why we don’t have a funlink function so that instead of the path we are providing just the file descriptor to the file. If we performed the fdunlink syscall, the kernel wouldn’t know which directory entry you would like to remove. Another problem is more architectural: as we discussed earlier unlinking is really an operation on the directory not on the file (inode) itself, so using funlink(fd) may create some confusion because we are not removing the inode corresponding to the file descriptor, we are performing action on the directory which points to the file.
  After some discussion we decided that the only sensible option for FreeBSD would be to create a funlinkat() function. This syscall would only performs additional sanitary checks if we are removing a directory entry which corresponds to the inode stored which refers to the file descriptor.
  int funlinkat(int dfd, const char *path, int fd, int flags);
  The API above will check if the path opened relative to the dfd points to the same vnode. Thanks to that we removed a race condition because all those sanitary checks are performed in the kernel mode while the file system is locked and there is no possibility to change it.
  The fd parameter may be set to the FD_NONE value which will mean that the sanitary check should not be performed and funlinkat will behave just like unlinkat.
  As you can notice I often refer to the unlink syscall but at the end the APIs looks like unlinkat syscall. It is true that the unlink syscall is very old and kind of deprecated. That said I referred to unlink because it’s just simpler. These days unlink simply uses the same code as unlinkat.</li></ul>
  </li>
  </ul>
  
  <hr />
</blockquote>

<h3 id="usinganopenbsdrouterwithattuversehttpsjcsorg20190321uverse"><a href="https://jcs.org/2019/03/21/uverse">Using an OpenBSD Router with AT&amp;T U-Verse</a></h3>

<blockquote>
  <p>I upgraded to AT&amp;T's U-verse Gigabit internet service in 2017 and it came with an Arris BGW-210 as the WiFi AP and router. The BGW-210 is not a terrible device, but I already had my own Airport Extreme APs wired throughout my house and an OpenBSD router configured with various things, so I had no use for this device. It's also a potentially-insecure device that I can't upgrade or fully disable remote control over.
  Fully removing the BGW-210 is not possible as we'll see later, but it is possible to remove it from the routing path. This is how I did it with OpenBSD.</p>
  
  <hr />
</blockquote>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="howtousenetbsdonaraspberrypihttpsopensourcecomarticle193netbsdraspberrypi"><a href="https://opensource.com/article/19/3/netbsd-raspberry-pi">How to use NetBSD on a Raspberry Pi</a></h3>

<blockquote>
  <p>Do you have an old Raspberry Pi lying around gathering dust, maybe after a recent Pi upgrade? Are you curious about BSD Unix? If you answered "yes" to both of these questions, you'll be pleased to know that the first is the solution to the second, because you can run NetBSD, as far back as the very first release, on a Raspberry Pi.
  BSD is the Berkley Software Distribution of Unix. In fact, it's the only open source Unix with direct lineage back to the original source code written by Dennis Ritchie and Ken Thompson at Bell Labs. Other modern versions are either proprietary (such as AIX and Solaris) or clever re-implementations (such as Minix and GNU/Linux). If you're used to Linux, you'll feel mostly right at home with BSD, but there are plenty of new commands and conventions to discover. If you're still relatively new to open source, trying BSD is a good way to experience a traditional Unix.
  Admittedly, NetBSD isn't an operating system that's perfectly suited for the Pi. It's a minimal install compared to many Linux distributions designed specifically for the Pi, and not all components of recent Pi models are functional under NetBSD yet. However, it's arguably an ideal OS for the older Pi models, since it's lightweight and lovingly maintained. And if nothing else, it's a lot of fun for any die-hard Unix geek to experience another side of the POSIX world.</p>
  
  <hr />
</blockquote>

<h3 id="zfsencryptionisstillunderdevelopmentasofmarch2019httpsutccutorontocatcksspacebloglinuxzfsencryptionnotready"><a href="https://utcc.utoronto.ca/~cks/space/blog/linux/ZFSEncryptionNotReady">ZFS Encryption is still under development (as of March 2019)</a></h3>

<blockquote>
  <p>One of the big upcoming features that a bunch of people are looking forward to in ZFS is natively encrypted filesystems. This is already in the main development tree of ZFS On Linux, will likely propagate to FreeBSD (since FreeBSD ZFS will be based on ZoL), and will make it to Illumos if the Illumos people want to pull it in. People are looking forward to native encryption so much, in fact, that some of them have started using it in ZFS On Linux already, using either the development tip or one of the 0.8.0 release candidate pre-releases (ZoL is up to 0.8.0-rc3 as of now). People either doing this or planning to do this show up on the ZoL mailing list every so often.</p>
  
  <ul>
  <li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-April/090915.html">CFT for FreeBSD + ZoL</a></li>
  </ul>
  
  <hr />
</blockquote>

<h3 id="tutorialonrumpkernelserversandclientshttpswwwnetbsdorgdocsrumpsptuthtml"><a href="https://www.netbsd.org/docs/rump/sptut.html">Tutorial On Rump Kernel Servers and Clients</a></h3>

<blockquote>
  <p>The rump anykernel architecture allows to run highly componentized kernel code configurations in userspace processes. Coupled with the rump sysproxy facility it is possible to run loosely distributed client-server "mini-operating systems". Since there is minimum configuration and the bootstrap time is measured in milliseconds, these environments are very cheap to set up, use, and tear down on-demand.
  This document acts as a tutorial on how to configure and use unmodified NetBSD kernel drivers as userspace services with utilities available from the NetBSD base system. As part of this, it presents various use cases. One uses the kernel cryptographic disk driver (cgd) to encrypt a partition. Another one demonstrates how to operate an FFS server for editing the contents of a file system even though your user account does not have privileges to use the host's mount() system call. Additionally, using a userspace TCP/IP server with an unmodified web browser is detailed.</p>
  
  <hr />
</blockquote>

<h3 id="installingsnortonopenbsd64httpsfunctionallyparanoidcom20190318installingsnortonopenbsd64"><a href="https://functionallyparanoid.com/2019/03/18/installing-snort-on-openbsd-6-4/">Installing Snort on OpenBSD 6.4</a></h3>

<blockquote>
  <p>As you may recall from previous posts, I am running an OpenBSD server on an APU2 air-cooled 3 Intel NIC box as my router/firewall for my secure home network.  Given that all of my Internet traffic flows through this box, I thought it would be a cool idea to run an Intrusion Detection System (IDS) on it.  Snort is the big hog of the open source world so I took a peek in the packages directory on one of the mirrors and lo and behold we have the latest &amp; greatest version of Snort available!  Thanks devs!!!
  I did some quick Googling and didn’t find much “modern” howto help out there so, after some trial and error, I have it up and running.  I thought I’d give back in a small way and share a quickie howto for other Googlers out there who are looking for guidance.  Here’s hoping that my title is good enough “SEO” to get you here! </p>
  
  <hr />
</blockquote>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://os108.org/">os108</a></li>

<li><a href="https://www.youtube.com/watch?v=tc4ROCJYbm0&amp;feature=youtu.be">AT&amp;T Archives: The UNIX Operating System</a></li>

<li><a href="https://marc.info/?l=openbsd-tech&amp;m=155407864604288&amp;w=2">httpd(8): Adapt to industry wide current best security practices</a></li>

<li><a href="https://codesmithdev.com/quotes-from-a-book-that-bashes-unix/">Quotes From A Book That Bashes Unix</a></li>

<li><a href="https://github.com/ligurio/openbsd-tests/wiki">OpenBSD QA wiki</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Malcolm - <a href="http://dpaste.com/1AFFTNJ">Laptop Experience : Dell XPS 13</a></li>

<li>DJ - <a href="http://dpaste.com/0V74SZC#wrap">Feedback</a></li>

<li>Alex - <a href="http://dpaste.com/1WVV1W7">GhostBSD and Wifi : FIXED</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0295.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>294: The SSH Tarpit</title>
  <link>https://www.bsdnow.tv/294</link>
  <guid isPermaLink="false">b1d75436-414e-48d2-bc93-a09aae8e7d82</guid>
  <pubDate>Thu, 18 Apr 2019 12:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b1d75436-414e-48d2-bc93-a09aae8e7d82.mp3" length="34751503" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A PI-powered Plan 9 cluster, an SSH tarpit, rdist for when Ansible is too much, falling in love with OpenBSD again, how I created my first FreeBSD port, the Tilde Institute of OpenBSD education and more.</itunes:subtitle>
  <itunes:duration>57:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A PI-powered Plan 9 cluster, an SSH tarpit, rdist for when Ansible is too much, falling in love with OpenBSD again, how I created my first FreeBSD port, the Tilde Institute of OpenBSD education and more.
&lt;h2&gt;Headlines&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://www.rs-online.com/designspark/a-pi-powered-plan-9-cluster"&gt;A Pi-Powered Plan 9 Cluster&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Plan 9 from Bell Labs comes from the same stable as the UNIX operating system, which of course Linux was designed after, and Apple’s OS X runs on top of a certified UNIX operating system. Just like UNIX, Plan 9 was developed as a research O/S — a vehicle for trying out new concepts — with it building on key UNIX principles and taking the idea of devices are just files even further.
  In this post, we take a quick look at the Plan 9 O/S and some of the notable features, before moving on to the construction of a self-contained 4-node Raspberry Pi cluster that will provide a compact platform for experimentation.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://nullprogram.com/blog/2019/03/22/"&gt;Endlessh: an SSH Tarpit&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I’m a big fan of tarpits: a network service that intentionally inserts delays in its protocol, slowing down clients by forcing them to wait. This arrests the speed at which a bad actor can attack or probe the host system, and it ties up some of the attacker’s resources that might otherwise be spent attacking another host. When done well, a tarpit imposes more cost on the attacker than the defender.
  The Internet is a very hostile place, and anyone who’s ever stood up an Internet-facing IPv4 host has witnessed the immediate and continuous attacks against their server. I’ve maintained such a server for nearly six years now, and more than 99% of my incoming traffic has ill intent. One part of my defenses has been tarpits in various forms.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://chargen.one/obsdams/rdist-1-when-ansible-is-too-much"&gt;rdist(1) – when Ansible is too much&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;The post written about rdist(1) on johan.huldtgren.com sparked
  us to write one as well. It's a great, underappreciated, tool. And we wanted to show how we wrapped doas(1) around it.
  There are two services in our infrastructure for which we were looking to keep the configuration in sync and to reload the process when the configuration had indeed changed. There is a pair of nsd(8)/unbound(8) hosts and a pair of hosts running relayd(8)/httpd(8) with carp(4) between them.
  We didn't have a requirement to go full configuration management with tools like Ansible or Salt Stack. And there wasn't any interest in building additional logic on top of rsync or repositories. &amp;gt; Enter rdist(1), rdist is a program to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode, and mtime of files if possible and can update programs that are executing.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://functionallyparanoid.com/2019/03/13/well-its-been-a-while-falling-in-love-with-openbsd-again/"&gt;Falling in love with OpenBSD again&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I was checking the other day and was appalled at how long it has been since I posted here.  I had been working a job during 2018 that had me traveling 3,600 miles by air every week so that is at least a viable excuse.
  So what is my latest project?  I wanted to get something better than the clunky old T500 “freedom laptop” that I could use as my daily driver.  Some background here.  My first paid gig as a programmer was on SunOS 4 (predecessor to Solaris) and Ultrix (on a DEC MicroVAX).  I went from there to a Commodore Amiga (preemptive multitasking in 1985!).  I went from there to OS/2 (I know, patron saint of lost causes) and then finally decided to “sell out” and move to Windows as the path of least resistance in the mid 90’s.
  My wife bought me an iPod literally just as they started working with computers other than Macs and I watched with fascination as Apple made the big gamble and moved away from PowerPC chips to Intel.  That was the beginning of the Apple Fan Boi years for me.  My gateway drug was a G4 MacMini and I managed somehow to get in on the pre-production, developer build of an Intel-based Mac.  I was quite happy on the platform until about three years ago.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://aikchar.dev/blog/how-i-created-my-first-freebsd-port.html"&gt;How I Created My First FreeBSD Port&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I created my first FreeBSD port recently. I found that FreeBSD didn't have a port for GoCD, which is a continuous integration and continuous deployment (CI/CD) system. This was a great opportunity to learn how to build a FreeBSD port while also contributing back to the community&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h3&gt;&lt;a href="https://tilde.institute/"&gt;The Tilde Institute of OpenBSD Education&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Welcome to tilde.institute! This is an OpenBSD machine whose purpose is to provide a space in the tildeverse for experimentation with and education of the OpenBSD operating system. A variety of editors, shells, and compilers are installed to allow for development in a native OpenBSD environment. OpenBSD's httpd(8) is configured with slowcgi(8) as the fastcgi provider and sqlite3 available. This allows users to experiment with web development using compiled CGI in C, aka the BCHS Stack. In addition to php7.0 and mysql (mariadb) by request, this provides an environment where the development of complex web apps is possible.&lt;/p&gt;
  
  &lt;hr&gt;
&lt;/blockquote&gt;

&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.solobsd.org/index.php/2019/03/26/solobsd-19-03-stable/"&gt;SoloBSD 19.03-STABLE&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://docs.google.com/presentation/d/1BbveYtY9IhuPCOLsEafwXMefkiY3REJBYl-opMAKQC0/edit#slide=id.p"&gt;WireGuard for NetBSD&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;[NetBSD - Removing PF](https://mail-index.netbsd.org/tech-kern/2019/03/29/msg024883.html
)&lt;/li&gt;

&lt;li&gt;&lt;a href="https://devblogs.microsoft.com/oldnewthing/20190325-00/?p=102359"&gt;What does the N in nmake stand for?&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://kottke.org/19/03/a-map-of-the-internet-from-may-1973"&gt;A Map of the Internet from May 1973&lt;/a&gt;&lt;/li&gt;

&lt;li&gt;&lt;a href="https://hackaday.io/project/164343-nsa-b-gone"&gt;NSA-B-Gone : A sketchy hardware security device for your x220&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Jake - &lt;a href="http://dpaste.com/1Y22ZJM"&gt;A single jail as a VPN client&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;Matt - &lt;a href="http://dpaste.com/2FAFC3A#wrap"&gt;Surprising BSD Features&lt;/a&gt;
&lt;/li&gt;

&lt;li&gt;cia - &lt;a href="http://dpaste.com/2T4J7G3"&gt;Routing and ZFS&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, plan9, ssh, ansible, rdist, wireguard, solobsd, nmake</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A PI-powered Plan 9 cluster, an SSH tarpit, rdist for when Ansible is too much, falling in love with OpenBSD again, how I created my first FreeBSD port, the Tilde Institute of OpenBSD education and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="apipoweredplan9clusterhttpswwwrsonlinecomdesignsparkapipoweredplan9cluster"><a href="https://www.rs-online.com/designspark/a-pi-powered-plan-9-cluster">A Pi-Powered Plan 9 Cluster</a></h3>

<blockquote>
  <p>Plan 9 from Bell Labs comes from the same stable as the UNIX operating system, which of course Linux was designed after, and Apple’s OS X runs on top of a certified UNIX operating system. Just like UNIX, Plan 9 was developed as a research O/S — a vehicle for trying out new concepts — with it building on key UNIX principles and taking the idea of devices are just files even further.
  In this post, we take a quick look at the Plan 9 O/S and some of the notable features, before moving on to the construction of a self-contained 4-node Raspberry Pi cluster that will provide a compact platform for experimentation.</p>
  
  <hr />
</blockquote>

<h3 id="endlesshansshtarpithttpsnullprogramcomblog20190322"><a href="https://nullprogram.com/blog/2019/03/22/">Endlessh: an SSH Tarpit</a></h3>

<blockquote>
  <p>I’m a big fan of tarpits: a network service that intentionally inserts delays in its protocol, slowing down clients by forcing them to wait. This arrests the speed at which a bad actor can attack or probe the host system, and it ties up some of the attacker’s resources that might otherwise be spent attacking another host. When done well, a tarpit imposes more cost on the attacker than the defender.
  The Internet is a very hostile place, and anyone who’s ever stood up an Internet-facing IPv4 host has witnessed the immediate and continuous attacks against their server. I’ve maintained such a server for nearly six years now, and more than 99% of my incoming traffic has ill intent. One part of my defenses has been tarpits in various forms.</p>
  
  <hr />
</blockquote>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="rdist1whenansibleistoomuchhttpschargenoneobsdamsrdist1whenansibleistoomuch"><a href="https://chargen.one/obsdams/rdist-1-when-ansible-is-too-much">rdist(1) – when Ansible is too much</a></h3>

<blockquote>
  <p>The post written about rdist(1) on johan.huldtgren.com sparked
  us to write one as well. It's a great, underappreciated, tool. And we wanted to show how we wrapped doas(1) around it.
  There are two services in our infrastructure for which we were looking to keep the configuration in sync and to reload the process when the configuration had indeed changed. There is a pair of nsd(8)/unbound(8) hosts and a pair of hosts running relayd(8)/httpd(8) with carp(4) between them.
  We didn't have a requirement to go full configuration management with tools like Ansible or Salt Stack. And there wasn't any interest in building additional logic on top of rsync or repositories. > Enter rdist(1), rdist is a program to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode, and mtime of files if possible and can update programs that are executing.</p>
  
  <hr />
</blockquote>

<h3 id="fallinginlovewithopenbsdagainhttpsfunctionallyparanoidcom20190313wellitsbeenawhilefallinginlovewithopenbsdagain"><a href="https://functionallyparanoid.com/2019/03/13/well-its-been-a-while-falling-in-love-with-openbsd-again/">Falling in love with OpenBSD again</a></h3>

<blockquote>
  <p>I was checking the other day and was appalled at how long it has been since I posted here.  I had been working a job during 2018 that had me traveling 3,600 miles by air every week so that is at least a viable excuse.
  So what is my latest project?  I wanted to get something better than the clunky old T500 “freedom laptop” that I could use as my daily driver.  Some background here.  My first paid gig as a programmer was on SunOS 4 (predecessor to Solaris) and Ultrix (on a DEC MicroVAX).  I went from there to a Commodore Amiga (preemptive multitasking in 1985!).  I went from there to OS/2 (I know, patron saint of lost causes) and then finally decided to “sell out” and move to Windows as the path of least resistance in the mid 90’s.
  My wife bought me an iPod literally just as they started working with computers other than Macs and I watched with fascination as Apple made the big gamble and moved away from PowerPC chips to Intel.  That was the beginning of the Apple Fan Boi years for me.  My gateway drug was a G4 MacMini and I managed somehow to get in on the pre-production, developer build of an Intel-based Mac.  I was quite happy on the platform until about three years ago.</p>
  
  <hr />
</blockquote>

<h3 id="howicreatedmyfirstfreebsdporthttpsaikchardevbloghowicreatedmyfirstfreebsdporthtml"><a href="https://aikchar.dev/blog/how-i-created-my-first-freebsd-port.html">How I Created My First FreeBSD Port</a></h3>

<blockquote>
  <p>I created my first FreeBSD port recently. I found that FreeBSD didn't have a port for GoCD, which is a continuous integration and continuous deployment (CI/CD) system. This was a great opportunity to learn how to build a FreeBSD port while also contributing back to the community</p>
  
  <hr />
</blockquote>

<h3 id="thetildeinstituteofopenbsdeducationhttpstildeinstitute"><a href="https://tilde.institute/">The Tilde Institute of OpenBSD Education</a></h3>

<blockquote>
  <p>Welcome to tilde.institute! This is an OpenBSD machine whose purpose is to provide a space in the tildeverse for experimentation with and education of the OpenBSD operating system. A variety of editors, shells, and compilers are installed to allow for development in a native OpenBSD environment. OpenBSD's httpd(8) is configured with slowcgi(8) as the fastcgi provider and sqlite3 available. This allows users to experiment with web development using compiled CGI in C, aka the BCHS Stack. In addition to php7.0 and mysql (mariadb) by request, this provides an environment where the development of complex web apps is possible.</p>
  
  <hr />
</blockquote>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://www.solobsd.org/index.php/2019/03/26/solobsd-19-03-stable/">SoloBSD 19.03-STABLE</a></li>

<li><a href="https://docs.google.com/presentation/d/1BbveYtY9IhuPCOLsEafwXMefkiY3REJBYl-opMAKQC0/edit#slide=id.p">WireGuard for NetBSD</a></li>

<li>[NetBSD - Removing PF](https://mail-index.netbsd.org/tech-kern/2019/03/29/msg024883.html
)</li>

<li><a href="https://devblogs.microsoft.com/oldnewthing/20190325-00/?p=102359">What does the N in nmake stand for?</a></li>

<li><a href="https://kottke.org/19/03/a-map-of-the-internet-from-may-1973">A Map of the Internet from May 1973</a></li>

<li><a href="https://hackaday.io/project/164343-nsa-b-gone">NSA-B-Gone : A sketchy hardware security device for your x220</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Jake - <a href="http://dpaste.com/1Y22ZJM">A single jail as a VPN client</a></li>

<li>Matt - <a href="http://dpaste.com/2FAFC3A#wrap">Surprising BSD Features</a></li>

<li>cia - <a href="http://dpaste.com/2T4J7G3">Routing and ZFS</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0294.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A PI-powered Plan 9 cluster, an SSH tarpit, rdist for when Ansible is too much, falling in love with OpenBSD again, how I created my first FreeBSD port, the Tilde Institute of OpenBSD education and more.</p>

<h2 id="headlines">Headlines</h2>

<h3 id="apipoweredplan9clusterhttpswwwrsonlinecomdesignsparkapipoweredplan9cluster"><a href="https://www.rs-online.com/designspark/a-pi-powered-plan-9-cluster">A Pi-Powered Plan 9 Cluster</a></h3>

<blockquote>
  <p>Plan 9 from Bell Labs comes from the same stable as the UNIX operating system, which of course Linux was designed after, and Apple’s OS X runs on top of a certified UNIX operating system. Just like UNIX, Plan 9 was developed as a research O/S — a vehicle for trying out new concepts — with it building on key UNIX principles and taking the idea of devices are just files even further.
  In this post, we take a quick look at the Plan 9 O/S and some of the notable features, before moving on to the construction of a self-contained 4-node Raspberry Pi cluster that will provide a compact platform for experimentation.</p>
  
  <hr />
</blockquote>

<h3 id="endlesshansshtarpithttpsnullprogramcomblog20190322"><a href="https://nullprogram.com/blog/2019/03/22/">Endlessh: an SSH Tarpit</a></h3>

<blockquote>
  <p>I’m a big fan of tarpits: a network service that intentionally inserts delays in its protocol, slowing down clients by forcing them to wait. This arrests the speed at which a bad actor can attack or probe the host system, and it ties up some of the attacker’s resources that might otherwise be spent attacking another host. When done well, a tarpit imposes more cost on the attacker than the defender.
  The Internet is a very hostile place, and anyone who’s ever stood up an Internet-facing IPv4 host has witnessed the immediate and continuous attacks against their server. I’ve maintained such a server for nearly six years now, and more than 99% of my incoming traffic has ill intent. One part of my defenses has been tarpits in various forms.</p>
  
  <hr />
</blockquote>

<h2 id="newsroundup">News Roundup</h2>

<h3 id="rdist1whenansibleistoomuchhttpschargenoneobsdamsrdist1whenansibleistoomuch"><a href="https://chargen.one/obsdams/rdist-1-when-ansible-is-too-much">rdist(1) – when Ansible is too much</a></h3>

<blockquote>
  <p>The post written about rdist(1) on johan.huldtgren.com sparked
  us to write one as well. It's a great, underappreciated, tool. And we wanted to show how we wrapped doas(1) around it.
  There are two services in our infrastructure for which we were looking to keep the configuration in sync and to reload the process when the configuration had indeed changed. There is a pair of nsd(8)/unbound(8) hosts and a pair of hosts running relayd(8)/httpd(8) with carp(4) between them.
  We didn't have a requirement to go full configuration management with tools like Ansible or Salt Stack. And there wasn't any interest in building additional logic on top of rsync or repositories. > Enter rdist(1), rdist is a program to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode, and mtime of files if possible and can update programs that are executing.</p>
  
  <hr />
</blockquote>

<h3 id="fallinginlovewithopenbsdagainhttpsfunctionallyparanoidcom20190313wellitsbeenawhilefallinginlovewithopenbsdagain"><a href="https://functionallyparanoid.com/2019/03/13/well-its-been-a-while-falling-in-love-with-openbsd-again/">Falling in love with OpenBSD again</a></h3>

<blockquote>
  <p>I was checking the other day and was appalled at how long it has been since I posted here.  I had been working a job during 2018 that had me traveling 3,600 miles by air every week so that is at least a viable excuse.
  So what is my latest project?  I wanted to get something better than the clunky old T500 “freedom laptop” that I could use as my daily driver.  Some background here.  My first paid gig as a programmer was on SunOS 4 (predecessor to Solaris) and Ultrix (on a DEC MicroVAX).  I went from there to a Commodore Amiga (preemptive multitasking in 1985!).  I went from there to OS/2 (I know, patron saint of lost causes) and then finally decided to “sell out” and move to Windows as the path of least resistance in the mid 90’s.
  My wife bought me an iPod literally just as they started working with computers other than Macs and I watched with fascination as Apple made the big gamble and moved away from PowerPC chips to Intel.  That was the beginning of the Apple Fan Boi years for me.  My gateway drug was a G4 MacMini and I managed somehow to get in on the pre-production, developer build of an Intel-based Mac.  I was quite happy on the platform until about three years ago.</p>
  
  <hr />
</blockquote>

<h3 id="howicreatedmyfirstfreebsdporthttpsaikchardevbloghowicreatedmyfirstfreebsdporthtml"><a href="https://aikchar.dev/blog/how-i-created-my-first-freebsd-port.html">How I Created My First FreeBSD Port</a></h3>

<blockquote>
  <p>I created my first FreeBSD port recently. I found that FreeBSD didn't have a port for GoCD, which is a continuous integration and continuous deployment (CI/CD) system. This was a great opportunity to learn how to build a FreeBSD port while also contributing back to the community</p>
  
  <hr />
</blockquote>

<h3 id="thetildeinstituteofopenbsdeducationhttpstildeinstitute"><a href="https://tilde.institute/">The Tilde Institute of OpenBSD Education</a></h3>

<blockquote>
  <p>Welcome to tilde.institute! This is an OpenBSD machine whose purpose is to provide a space in the tildeverse for experimentation with and education of the OpenBSD operating system. A variety of editors, shells, and compilers are installed to allow for development in a native OpenBSD environment. OpenBSD's httpd(8) is configured with slowcgi(8) as the fastcgi provider and sqlite3 available. This allows users to experiment with web development using compiled CGI in C, aka the BCHS Stack. In addition to php7.0 and mysql (mariadb) by request, this provides an environment where the development of complex web apps is possible.</p>
  
  <hr />
</blockquote>

<h2 id="beastiebits">Beastie Bits</h2>

<ul>
<li><a href="https://www.solobsd.org/index.php/2019/03/26/solobsd-19-03-stable/">SoloBSD 19.03-STABLE</a></li>

<li><a href="https://docs.google.com/presentation/d/1BbveYtY9IhuPCOLsEafwXMefkiY3REJBYl-opMAKQC0/edit#slide=id.p">WireGuard for NetBSD</a></li>

<li>[NetBSD - Removing PF](https://mail-index.netbsd.org/tech-kern/2019/03/29/msg024883.html
)</li>

<li><a href="https://devblogs.microsoft.com/oldnewthing/20190325-00/?p=102359">What does the N in nmake stand for?</a></li>

<li><a href="https://kottke.org/19/03/a-map-of-the-internet-from-may-1973">A Map of the Internet from May 1973</a></li>

<li><a href="https://hackaday.io/project/164343-nsa-b-gone">NSA-B-Gone : A sketchy hardware security device for your x220</a></li>
</ul>

<p><hr /></p>

<h2 id="feedbackquestions">Feedback/Questions</h2>

<ul>
<li>Jake - <a href="http://dpaste.com/1Y22ZJM">A single jail as a VPN client</a></li>

<li>Matt - <a href="http://dpaste.com/2FAFC3A#wrap">Surprising BSD Features</a></li>

<li>cia - <a href="http://dpaste.com/2T4J7G3">Routing and ZFS</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0294.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>293: Booking Jails</title>
  <link>https://www.bsdnow.tv/293</link>
  <guid isPermaLink="false">ca87df46-31a6-4c71-883e-e34d10e4fd2d</guid>
  <pubDate>Thu, 11 Apr 2019 12:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ca87df46-31a6-4c71-883e-e34d10e4fd2d.mp3" length="46528143" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week we have a special episode with a Michael W. Lucas interview about his latest jail book that’s been released. We’re talking all things jails, writing, book sponsoring, the upcoming BSDCan 2019 conference, and more.</itunes:subtitle>
  <itunes:duration>1:16:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week we have a special episode with a Michael W. Lucas interview about his latest jail book that’s been released. We’re talking all things jails, writing, book sponsoring, the upcoming BSDCan 2019 conference, and more.
&lt;p&gt;###Interview - Michael W. Lucas  - &lt;a href="mailto:mwl@mwl.io"&gt;mwl@mwl.io&lt;/a&gt; / &lt;a href="https://twitter.com/mwlauthor"&gt;@mwlauthor&lt;/a&gt;&lt;br&gt;
FreeBSD Mastery: Jails&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;BR: Welcome back to the show and congratulations on your latest book. How many books did you have to write before you could start on FreeBSD Mastery: Jails?&lt;/li&gt;
&lt;li&gt;AJ: How much research did you have to do about jails?&lt;/li&gt;
&lt;li&gt;BR: The book talks about something called ‘incomplete’ jails. What do you mean by that?&lt;/li&gt;
&lt;li&gt;AJ: There are a lot of jail management frameworks out there. Why did you chose to write about iocage in the book?&lt;/li&gt;
&lt;li&gt;BR: How many jails do you run yourself?&lt;/li&gt;
&lt;li&gt;AJ: Can you tell us a bit about how you handle book sponsorship these days?&lt;/li&gt;
&lt;li&gt;BR: What other books (fiction and non-fiction) are you currently working on?&lt;/li&gt;
&lt;li&gt;AJ: Which talks are you looking forward to attend at the upcoming BSDCan conference?&lt;/li&gt;
&lt;li&gt;BR: How is the BSD user group going?&lt;/li&gt;
&lt;li&gt;AJ: Anything else you’d like to mention before we release you from our interview jail cell?&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.

</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, jails, iocage, ezjail, books, sudo, bsdcan, gelato, writing, sponsoring, user group</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week we have a special episode with a Michael W. Lucas interview about his latest jail book that’s been released. We’re talking all things jails, writing, book sponsoring, the upcoming BSDCan 2019 conference, and more.</p>

<p>###Interview - Michael W. Lucas  - <a href="mailto:mwl@mwl.io">mwl@mwl.io</a> / <a href="https://twitter.com/mwlauthor">@mwlauthor</a><br>
FreeBSD Mastery: Jails</p>

<ul>
<li>BR: Welcome back to the show and congratulations on your latest book. How many books did you have to write before you could start on FreeBSD Mastery: Jails?</li>
<li>AJ: How much research did you have to do about jails?</li>
<li>BR: The book talks about something called ‘incomplete’ jails. What do you mean by that?</li>
<li>AJ: There are a lot of jail management frameworks out there. Why did you chose to write about iocage in the book?</li>
<li>BR: How many jails do you run yourself?</li>
<li>AJ: Can you tell us a bit about how you handle book sponsorship these days?</li>
<li>BR: What other books (fiction and non-fiction) are you currently working on?</li>
<li>AJ: Which talks are you looking forward to attend at the upcoming BSDCan conference?</li>
<li>BR: How is the BSD user group going?</li>
<li>AJ: Anything else you’d like to mention before we release you from our interview jail cell?</li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0293.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week we have a special episode with a Michael W. Lucas interview about his latest jail book that’s been released. We’re talking all things jails, writing, book sponsoring, the upcoming BSDCan 2019 conference, and more.</p>

<p>###Interview - Michael W. Lucas  - <a href="mailto:mwl@mwl.io">mwl@mwl.io</a> / <a href="https://twitter.com/mwlauthor">@mwlauthor</a><br>
FreeBSD Mastery: Jails</p>

<ul>
<li>BR: Welcome back to the show and congratulations on your latest book. How many books did you have to write before you could start on FreeBSD Mastery: Jails?</li>
<li>AJ: How much research did you have to do about jails?</li>
<li>BR: The book talks about something called ‘incomplete’ jails. What do you mean by that?</li>
<li>AJ: There are a lot of jail management frameworks out there. Why did you chose to write about iocage in the book?</li>
<li>BR: How many jails do you run yourself?</li>
<li>AJ: Can you tell us a bit about how you handle book sponsorship these days?</li>
<li>BR: What other books (fiction and non-fiction) are you currently working on?</li>
<li>AJ: Which talks are you looking forward to attend at the upcoming BSDCan conference?</li>
<li>BR: How is the BSD user group going?</li>
<li>AJ: Anything else you’d like to mention before we release you from our interview jail cell?</li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0293.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>292: AsiaBSDcon 2019 Recap</title>
  <link>https://www.bsdnow.tv/292</link>
  <guid isPermaLink="false">6f743ea3-0e96-445c-a46e-944f1a62450b</guid>
  <pubDate>Thu, 04 Apr 2019 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6f743ea3-0e96-445c-a46e-944f1a62450b.mp3" length="54434181" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Q4 2018 status report, the GhostBSD alternative, the coolest 90s laptop, OpenSSH 8.0 with quantum computing resistant keys exchange, project trident: 18.12-U8 is here, and more.</itunes:subtitle>
  <itunes:duration>1:30:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Q4 2018 status report, the GhostBSD alternative, the coolest 90s laptop, OpenSSH 8.0 with quantum computing resistant keys exchange, project trident: 18.12-U8 is here, and more.
&lt;p&gt;##Headlines&lt;br&gt;
###&lt;a href="https://2019.asiabsdcon.org"&gt;AsiaBSDcon 2019 recap&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Both Allan and I attended AsiaBSDcon 2019 in Tokyo in mid march. After a couple of days of Tokyo sightseeing and tasting the local food, the conference started with tutorials.&lt;/li&gt;
&lt;li&gt;Benedict gave his tutorial about “BSD-based Systems Monitoring with Icinga2 and OpenSSH”, while Allan ran the FreeBSD developer summit.&lt;/li&gt;
&lt;li&gt;On the next day, Benedict attended the tutorial “writing (network) tests for FreeBSD” held by Kristof Provost. I learned a lot about Kyua, where tests live and how they are executed. I took some notes, which will likely become an article or chapter in the developers handbook about writing tests.&lt;/li&gt;
&lt;li&gt;On the third day, Hiroki Sato officially opened the paper session and then people went into individual talks.&lt;/li&gt;
&lt;li&gt;Benedict attended
&lt;blockquote&gt;
&lt;p&gt;Adventure in DRMland - Or how to write a FreeBSD ARM64 DRM driver by Emmanuel&lt;br&gt;
Vadot&lt;/p&gt;
&lt;/blockquote&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;powerpc64 architecture support in FreeBSD ports by Piotr Kubaj&lt;br&gt;
Managing System Images with ZFS by Allan Jude&lt;br&gt;
FreeBSD - Improving block I/O compatibility in bhyve by Sergiu Weisz&lt;br&gt;
&lt;a href="https://www.youtube.com/watch?v=7kShjboN6ek"&gt;Security Fantasies and Realities for the BSDs by George V.&lt;br&gt;
Neville-Neil&lt;/a&gt;&lt;br&gt;
ZRouter: Remote update of firmware by Hiroki Mori&lt;br&gt;
Improving security of the FreeBSD boot process by Marcin Wojtas&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Allan attended
&lt;blockquote&gt;
&lt;p&gt;Adventures in DRMland by Emmanuel Vadot&lt;br&gt;
Intel HAXM by Kamil Rytarowski&lt;br&gt;
BSD Solutions in Australian NGOs&lt;br&gt;
Container Migration on FreeBSD by Yuhei Takagawa&lt;br&gt;
Security Fantasies and Realities for the BSDs by George Neville-Neil&lt;/p&gt;
&lt;/blockquote&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;ZRouter: Remote update of firmware by Hiroki Mori&lt;br&gt;
Improving security of the FreeBSD boot process by Marcin Wojtas&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;When not in talks, time was spent in the hallway track and conversations would often continue over dinner.&lt;/li&gt;
&lt;li&gt;Stay tuned for announcements about where AsiaBSDcon 2020 will be, as the Tokyo Olympics will likely force some changes for next year. Overall, it was nice to see people at the conference again, listen to talks, and enjoy the hospitality of Japan.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;###&lt;a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-March/001871.html"&gt;FreeBSD Quarterly Status Report - Fourth Quarter 2018&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Since we are still on this island among many in this vast ocean of the Internet, we write this message in a bottle to inform you of the work we have finished and what lies ahead of us. These deeds that we have wrought with our minds and hands, they are for all to partake of - in the hopes that anyone of their free will, will join us in making improvements. In todays message the following by no means complete or ordered set of improvements and additions will be covered:&lt;br&gt;
i386 PAE Pagetables for up to 24GB memory support, Continuous Integration efforts, driver updates to ENA and graphics, ARM enhancements such as RochChip, Marvell 8K, and Broadcom support as well as more DTS files, more Capsicum possibilities, as well as pfsync improvements, and many more things that you can read about for yourselves.&lt;br&gt;
Additionally, we bring news from some islands further down stream, namely the nosh project, HardenedBSD, ClonOS, and the Polish BSD User-Group.&lt;br&gt;
We would, selfishly, encourage those of you who give us the good word to please send in your submissions sooner than just before the deadline, and also encourage anyone willing to share the good word to please read the section on which submissions we’re also interested in having.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.linuxinsider.com/story/GhostBSD-A-Solid-Linux-Like-Open-Source-Alternative-85859.html"&gt;GhostBSD: A Solid Linux-Like Open Source Alternative&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The subject of this week’s Linux Picks and Pans is a representative of a less well-known computing platform that coexists with Linux as an open source operating system. If you thought that the Linux kernel was the only open source engine for a free OS, think again. BSD (Berkeley Software Distribution) shares many of the same features that make Linux OSes viable alternatives to proprietary computing platforms.&lt;br&gt;
GhostBSD is a user-friendly Linux-like desktop operating system based on TrueOS. TrueOS is, in turn, based on FreeBSD’s development branch. TrueOS’ goal is to combine the stability and security of FreeBSD with a preinstalled GNOME, MATE, Xfce, LXDE or Openbox graphical user interface.&lt;br&gt;
I stumbled on TrueOS while checking out new desktop environments and features in recent new releases of a few obscure Linux distros. Along the way, I discovered that today’s BSD computing family is not the closed source Unix platform the “BSD” name might suggest.&lt;br&gt;
In last week’s Redcore Linux review, I mentioned that the Lumina desktop environment was under development for an upcoming Redcore Linux release. Lumina is being developed primarily for BSD OSes. That led me to circle back to a review I wrote two years ago on Lumina being developed for Linux.&lt;br&gt;
GhostBSD is a pleasant discovery. It has nothing to do with being spooky, either. That goes for both the distro and the open source computing family it exposes.&lt;br&gt;
Keep reading to find out what piqued my excitement about Linux-like GhostBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="http://triosdevelopers.com/jason.eckert/blog/Entries/2019/3/14_SPARCbook_3000ST_-_The_coolest_90s_laptop.html"&gt;SPARCbook 3000ST - The coolest 90s laptop&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;A few weeks back I managed to pick up an incredibly rare laptop in immaculate condition for $50 on Kijiji: a Tadpole Technologies SPARCbook 3000ST from 1997 (it also came with two other working Pentium laptops from the 1990s).&lt;br&gt;
Sun computers were an expensive desire for many computer geeks in the 1990s, and running UNIX on a SPARC-based laptop was, well, just as cool as it gets. SPARC was an open hardware platform that anyone could make, and Tadpole licensed the Solaris UNIX operating system from Sun for their SPARCbooks. Tadpole essentially made high-end UNIX/VAX workstations on costly, unusual platforms (PowerPC, DEC Alpha, SPARC) but only their SPARCbooks were popular in the high-end UNIX market of the 1990s.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://codesmithdev.com/openssh-8-0-releasing-with-quantum-computing-resistant-keys/"&gt;OpenSSH 8.0 Releasing With Quantum Computing Resistant Keys&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;OpenSSH 7.9 came out with a host of bug fixes  last year with few new features, as is to be expected in minor releases. However, recently, Damien Miller has announced that OpenSSH 8.0 is nearly ready to be released. Currently, it’s undergoing testing to ensure compatibility across supported systems.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://twitter.com/damienmiller/status/1111416334737244160"&gt;https://twitter.com/damienmiller/status/1111416334737244160&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Better Security&lt;br&gt;
Copying filenames with scp will be more secure in OpenSSH 8.0 due to the fact that copying filenames from a remote to local directory will prompt scp to check if the files sent from the server match your request. Otherwise, an attack server would theoretically be able to intercept the request by serving malicious files in place of the ones originally requested. Knowing this, you’re probably better off never using scp anyway.  OpenSSH advises against it:&lt;br&gt;
“The scp protocol is outdated, inflexible and not readily fixed. We recommend the use of more modern protocols like sftp and rsync for file transfer instead.”&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Interesting new features&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for “yes”. This allows the user to paste a fingerprint obtained out of band at the prompt and have the client do the comparison for you.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://project-trident.org/post/2019-03-29_18.12-u8_available/"&gt;Project Trident : 18.12-U8 Available&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Thank you all for your patience! Project Trident has finally finished some significant infrastructure updates over the last 2 weeks, and we are pleased to announce that package update 8 for 18.12-RELEASE is now available.&lt;br&gt;
To switch to the new update, you will need to open the “Configuration” tab in the update manager and switch to the new “Trident-release” package repository. You can also perform this transition via the command line by running: sudo sysup --change-train Trident-release&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.92/"&gt;BSD Router Project - Release 1.92&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://registration.eurobsdcon.org/conferences/2019/program/proposals/new"&gt;EuroBSDcon - New Proposals&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.reddit.com/r/unix/comments/b1wyde/funny_unix_shirt_ren%C3%A9_magritte_art_parody/"&gt;Funny UNIX shirt (René Magritte art parody)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://geoff.greer.fm/2019/03/04/thinkpad-x210/"&gt;51NB’s Thinkpad X210&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.dragonflydigest.com/2019/03/26/22703.html"&gt;DragonFly: No more gcc50&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mwl.io/archives/4139"&gt;“FreeBSD Mastery: Jails” ebook escaping!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://frab.luga.de/en/LIT2019/public/events/68"&gt;FreeBSD talk at the Augsburger Linux Info Days (german)&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;DJ - &lt;a href="http://dpaste.com/3ZRJ5DA#wrap"&gt;FuguIta Feedback&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Mike - &lt;a href="http://dpaste.com/32TSCH4#wrap"&gt;Another Good Show&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Alex - &lt;a href="http://dpaste.com/34ND6BC#wrap"&gt;GhostBSD and wifi&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Q4 2018 status report, the GhostBSD alternative, the coolest 90s laptop, OpenSSH 8.0 with quantum computing resistant keys exchange, project trident: 18.12-U8 is here, and more.</p>

<p>##Headlines<br>
###<a href="https://2019.asiabsdcon.org">AsiaBSDcon 2019 recap</a></p>

<ul>
<li>Both Allan and I attended AsiaBSDcon 2019 in Tokyo in mid march. After a couple of days of Tokyo sightseeing and tasting the local food, the conference started with tutorials.</li>
<li>Benedict gave his tutorial about “BSD-based Systems Monitoring with Icinga2 and OpenSSH”, while Allan ran the FreeBSD developer summit.</li>
<li>On the next day, Benedict attended the tutorial “writing (network) tests for FreeBSD” held by Kristof Provost. I learned a lot about Kyua, where tests live and how they are executed. I took some notes, which will likely become an article or chapter in the developers handbook about writing tests.</li>
<li>On the third day, Hiroki Sato officially opened the paper session and then people went into individual talks.</li>
<li>Benedict attended
<blockquote>
<p>Adventure in DRMland - Or how to write a FreeBSD ARM64 DRM driver by Emmanuel<br>
Vadot</p>
</blockquote>
</li>
</ul>

<blockquote>
<p>powerpc64 architecture support in FreeBSD ports by Piotr Kubaj<br>
Managing System Images with ZFS by Allan Jude<br>
FreeBSD - Improving block I/O compatibility in bhyve by Sergiu Weisz<br>
<a href="https://www.youtube.com/watch?v=7kShjboN6ek">Security Fantasies and Realities for the BSDs by George V.<br>
Neville-Neil</a><br>
ZRouter: Remote update of firmware by Hiroki Mori<br>
Improving security of the FreeBSD boot process by Marcin Wojtas</p>
</blockquote>

<ul>
<li>Allan attended
<blockquote>
<p>Adventures in DRMland by Emmanuel Vadot<br>
Intel HAXM by Kamil Rytarowski<br>
BSD Solutions in Australian NGOs<br>
Container Migration on FreeBSD by Yuhei Takagawa<br>
Security Fantasies and Realities for the BSDs by George Neville-Neil</p>
</blockquote>
</li>
</ul>

<blockquote>
<p>ZRouter: Remote update of firmware by Hiroki Mori<br>
Improving security of the FreeBSD boot process by Marcin Wojtas</p>
</blockquote>

<ul>
<li>When not in talks, time was spent in the hallway track and conversations would often continue over dinner.</li>
<li>Stay tuned for announcements about where AsiaBSDcon 2020 will be, as the Tokyo Olympics will likely force some changes for next year. Overall, it was nice to see people at the conference again, listen to talks, and enjoy the hospitality of Japan.</li>
</ul>

<p>###<a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-March/001871.html">FreeBSD Quarterly Status Report - Fourth Quarter 2018</a></p>

<blockquote>
<p>Since we are still on this island among many in this vast ocean of the Internet, we write this message in a bottle to inform you of the work we have finished and what lies ahead of us. These deeds that we have wrought with our minds and hands, they are for all to partake of - in the hopes that anyone of their free will, will join us in making improvements. In todays message the following by no means complete or ordered set of improvements and additions will be covered:<br>
i386 PAE Pagetables for up to 24GB memory support, Continuous Integration efforts, driver updates to ENA and graphics, ARM enhancements such as RochChip, Marvell 8K, and Broadcom support as well as more DTS files, more Capsicum possibilities, as well as pfsync improvements, and many more things that you can read about for yourselves.<br>
Additionally, we bring news from some islands further down stream, namely the nosh project, HardenedBSD, ClonOS, and the Polish BSD User-Group.<br>
We would, selfishly, encourage those of you who give us the good word to please send in your submissions sooner than just before the deadline, and also encourage anyone willing to share the good word to please read the section on which submissions we’re also interested in having.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.linuxinsider.com/story/GhostBSD-A-Solid-Linux-Like-Open-Source-Alternative-85859.html">GhostBSD: A Solid Linux-Like Open Source Alternative</a></p>

<blockquote>
<p>The subject of this week’s Linux Picks and Pans is a representative of a less well-known computing platform that coexists with Linux as an open source operating system. If you thought that the Linux kernel was the only open source engine for a free OS, think again. BSD (Berkeley Software Distribution) shares many of the same features that make Linux OSes viable alternatives to proprietary computing platforms.<br>
GhostBSD is a user-friendly Linux-like desktop operating system based on TrueOS. TrueOS is, in turn, based on FreeBSD’s development branch. TrueOS’ goal is to combine the stability and security of FreeBSD with a preinstalled GNOME, MATE, Xfce, LXDE or Openbox graphical user interface.<br>
I stumbled on TrueOS while checking out new desktop environments and features in recent new releases of a few obscure Linux distros. Along the way, I discovered that today’s BSD computing family is not the closed source Unix platform the “BSD” name might suggest.<br>
In last week’s Redcore Linux review, I mentioned that the Lumina desktop environment was under development for an upcoming Redcore Linux release. Lumina is being developed primarily for BSD OSes. That led me to circle back to a review I wrote two years ago on Lumina being developed for Linux.<br>
GhostBSD is a pleasant discovery. It has nothing to do with being spooky, either. That goes for both the distro and the open source computing family it exposes.<br>
Keep reading to find out what piqued my excitement about Linux-like GhostBSD.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="http://triosdevelopers.com/jason.eckert/blog/Entries/2019/3/14_SPARCbook_3000ST_-_The_coolest_90s_laptop.html">SPARCbook 3000ST - The coolest 90s laptop</a></p>

<blockquote>
<p>A few weeks back I managed to pick up an incredibly rare laptop in immaculate condition for $50 on Kijiji: a Tadpole Technologies SPARCbook 3000ST from 1997 (it also came with two other working Pentium laptops from the 1990s).<br>
Sun computers were an expensive desire for many computer geeks in the 1990s, and running UNIX on a SPARC-based laptop was, well, just as cool as it gets. SPARC was an open hardware platform that anyone could make, and Tadpole licensed the Solaris UNIX operating system from Sun for their SPARCbooks. Tadpole essentially made high-end UNIX/VAX workstations on costly, unusual platforms (PowerPC, DEC Alpha, SPARC) but only their SPARCbooks were popular in the high-end UNIX market of the 1990s.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://codesmithdev.com/openssh-8-0-releasing-with-quantum-computing-resistant-keys/">OpenSSH 8.0 Releasing With Quantum Computing Resistant Keys</a></p>

<blockquote>
<p>OpenSSH 7.9 came out with a host of bug fixes  last year with few new features, as is to be expected in minor releases. However, recently, Damien Miller has announced that OpenSSH 8.0 is nearly ready to be released. Currently, it’s undergoing testing to ensure compatibility across supported systems.</p>
</blockquote>

<ul>
<li><a href="https://twitter.com/damienmiller/status/1111416334737244160">https://twitter.com/damienmiller/status/1111416334737244160</a></li>
</ul>

<blockquote>
<p>Better Security<br>
Copying filenames with scp will be more secure in OpenSSH 8.0 due to the fact that copying filenames from a remote to local directory will prompt scp to check if the files sent from the server match your request. Otherwise, an attack server would theoretically be able to intercept the request by serving malicious files in place of the ones originally requested. Knowing this, you’re probably better off never using scp anyway.  OpenSSH advises against it:<br>
“The scp protocol is outdated, inflexible and not readily fixed. We recommend the use of more modern protocols like sftp and rsync for file transfer instead.”</p>
</blockquote>

<ul>
<li>Interesting new features</li>
</ul>

<blockquote>
<p>ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for “yes”. This allows the user to paste a fingerprint obtained out of band at the prompt and have the client do the comparison for you.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://project-trident.org/post/2019-03-29_18.12-u8_available/">Project Trident : 18.12-U8 Available</a></p>

<blockquote>
<p>Thank you all for your patience! Project Trident has finally finished some significant infrastructure updates over the last 2 weeks, and we are pleased to announce that package update 8 for 18.12-RELEASE is now available.<br>
To switch to the new update, you will need to open the “Configuration” tab in the update manager and switch to the new “Trident-release” package repository. You can also perform this transition via the command line by running: sudo sysup --change-train Trident-release</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.92/">BSD Router Project - Release 1.92</a></li>
<li><a href="https://registration.eurobsdcon.org/conferences/2019/program/proposals/new">EuroBSDcon - New Proposals</a></li>
<li><a href="https://www.reddit.com/r/unix/comments/b1wyde/funny_unix_shirt_ren%C3%A9_magritte_art_parody/">Funny UNIX shirt (René Magritte art parody)</a></li>
<li><a href="https://geoff.greer.fm/2019/03/04/thinkpad-x210/">51NB’s Thinkpad X210</a></li>
<li><a href="https://www.dragonflydigest.com/2019/03/26/22703.html">DragonFly: No more gcc50</a></li>
<li><a href="https://mwl.io/archives/4139">“FreeBSD Mastery: Jails” ebook escaping!</a></li>
<li><a href="https://frab.luga.de/en/LIT2019/public/events/68">FreeBSD talk at the Augsburger Linux Info Days (german)</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>DJ - <a href="http://dpaste.com/3ZRJ5DA#wrap">FuguIta Feedback</a></li>
<li>Mike - <a href="http://dpaste.com/32TSCH4#wrap">Another Good Show</a></li>
<li>Alex - <a href="http://dpaste.com/34ND6BC#wrap">GhostBSD and wifi</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0292.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Q4 2018 status report, the GhostBSD alternative, the coolest 90s laptop, OpenSSH 8.0 with quantum computing resistant keys exchange, project trident: 18.12-U8 is here, and more.</p>

<p>##Headlines<br>
###<a href="https://2019.asiabsdcon.org">AsiaBSDcon 2019 recap</a></p>

<ul>
<li>Both Allan and I attended AsiaBSDcon 2019 in Tokyo in mid march. After a couple of days of Tokyo sightseeing and tasting the local food, the conference started with tutorials.</li>
<li>Benedict gave his tutorial about “BSD-based Systems Monitoring with Icinga2 and OpenSSH”, while Allan ran the FreeBSD developer summit.</li>
<li>On the next day, Benedict attended the tutorial “writing (network) tests for FreeBSD” held by Kristof Provost. I learned a lot about Kyua, where tests live and how they are executed. I took some notes, which will likely become an article or chapter in the developers handbook about writing tests.</li>
<li>On the third day, Hiroki Sato officially opened the paper session and then people went into individual talks.</li>
<li>Benedict attended
<blockquote>
<p>Adventure in DRMland - Or how to write a FreeBSD ARM64 DRM driver by Emmanuel<br>
Vadot</p>
</blockquote>
</li>
</ul>

<blockquote>
<p>powerpc64 architecture support in FreeBSD ports by Piotr Kubaj<br>
Managing System Images with ZFS by Allan Jude<br>
FreeBSD - Improving block I/O compatibility in bhyve by Sergiu Weisz<br>
<a href="https://www.youtube.com/watch?v=7kShjboN6ek">Security Fantasies and Realities for the BSDs by George V.<br>
Neville-Neil</a><br>
ZRouter: Remote update of firmware by Hiroki Mori<br>
Improving security of the FreeBSD boot process by Marcin Wojtas</p>
</blockquote>

<ul>
<li>Allan attended
<blockquote>
<p>Adventures in DRMland by Emmanuel Vadot<br>
Intel HAXM by Kamil Rytarowski<br>
BSD Solutions in Australian NGOs<br>
Container Migration on FreeBSD by Yuhei Takagawa<br>
Security Fantasies and Realities for the BSDs by George Neville-Neil</p>
</blockquote>
</li>
</ul>

<blockquote>
<p>ZRouter: Remote update of firmware by Hiroki Mori<br>
Improving security of the FreeBSD boot process by Marcin Wojtas</p>
</blockquote>

<ul>
<li>When not in talks, time was spent in the hallway track and conversations would often continue over dinner.</li>
<li>Stay tuned for announcements about where AsiaBSDcon 2020 will be, as the Tokyo Olympics will likely force some changes for next year. Overall, it was nice to see people at the conference again, listen to talks, and enjoy the hospitality of Japan.</li>
</ul>

<p>###<a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-March/001871.html">FreeBSD Quarterly Status Report - Fourth Quarter 2018</a></p>

<blockquote>
<p>Since we are still on this island among many in this vast ocean of the Internet, we write this message in a bottle to inform you of the work we have finished and what lies ahead of us. These deeds that we have wrought with our minds and hands, they are for all to partake of - in the hopes that anyone of their free will, will join us in making improvements. In todays message the following by no means complete or ordered set of improvements and additions will be covered:<br>
i386 PAE Pagetables for up to 24GB memory support, Continuous Integration efforts, driver updates to ENA and graphics, ARM enhancements such as RochChip, Marvell 8K, and Broadcom support as well as more DTS files, more Capsicum possibilities, as well as pfsync improvements, and many more things that you can read about for yourselves.<br>
Additionally, we bring news from some islands further down stream, namely the nosh project, HardenedBSD, ClonOS, and the Polish BSD User-Group.<br>
We would, selfishly, encourage those of you who give us the good word to please send in your submissions sooner than just before the deadline, and also encourage anyone willing to share the good word to please read the section on which submissions we’re also interested in having.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.linuxinsider.com/story/GhostBSD-A-Solid-Linux-Like-Open-Source-Alternative-85859.html">GhostBSD: A Solid Linux-Like Open Source Alternative</a></p>

<blockquote>
<p>The subject of this week’s Linux Picks and Pans is a representative of a less well-known computing platform that coexists with Linux as an open source operating system. If you thought that the Linux kernel was the only open source engine for a free OS, think again. BSD (Berkeley Software Distribution) shares many of the same features that make Linux OSes viable alternatives to proprietary computing platforms.<br>
GhostBSD is a user-friendly Linux-like desktop operating system based on TrueOS. TrueOS is, in turn, based on FreeBSD’s development branch. TrueOS’ goal is to combine the stability and security of FreeBSD with a preinstalled GNOME, MATE, Xfce, LXDE or Openbox graphical user interface.<br>
I stumbled on TrueOS while checking out new desktop environments and features in recent new releases of a few obscure Linux distros. Along the way, I discovered that today’s BSD computing family is not the closed source Unix platform the “BSD” name might suggest.<br>
In last week’s Redcore Linux review, I mentioned that the Lumina desktop environment was under development for an upcoming Redcore Linux release. Lumina is being developed primarily for BSD OSes. That led me to circle back to a review I wrote two years ago on Lumina being developed for Linux.<br>
GhostBSD is a pleasant discovery. It has nothing to do with being spooky, either. That goes for both the distro and the open source computing family it exposes.<br>
Keep reading to find out what piqued my excitement about Linux-like GhostBSD.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="http://triosdevelopers.com/jason.eckert/blog/Entries/2019/3/14_SPARCbook_3000ST_-_The_coolest_90s_laptop.html">SPARCbook 3000ST - The coolest 90s laptop</a></p>

<blockquote>
<p>A few weeks back I managed to pick up an incredibly rare laptop in immaculate condition for $50 on Kijiji: a Tadpole Technologies SPARCbook 3000ST from 1997 (it also came with two other working Pentium laptops from the 1990s).<br>
Sun computers were an expensive desire for many computer geeks in the 1990s, and running UNIX on a SPARC-based laptop was, well, just as cool as it gets. SPARC was an open hardware platform that anyone could make, and Tadpole licensed the Solaris UNIX operating system from Sun for their SPARCbooks. Tadpole essentially made high-end UNIX/VAX workstations on costly, unusual platforms (PowerPC, DEC Alpha, SPARC) but only their SPARCbooks were popular in the high-end UNIX market of the 1990s.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://codesmithdev.com/openssh-8-0-releasing-with-quantum-computing-resistant-keys/">OpenSSH 8.0 Releasing With Quantum Computing Resistant Keys</a></p>

<blockquote>
<p>OpenSSH 7.9 came out with a host of bug fixes  last year with few new features, as is to be expected in minor releases. However, recently, Damien Miller has announced that OpenSSH 8.0 is nearly ready to be released. Currently, it’s undergoing testing to ensure compatibility across supported systems.</p>
</blockquote>

<ul>
<li><a href="https://twitter.com/damienmiller/status/1111416334737244160">https://twitter.com/damienmiller/status/1111416334737244160</a></li>
</ul>

<blockquote>
<p>Better Security<br>
Copying filenames with scp will be more secure in OpenSSH 8.0 due to the fact that copying filenames from a remote to local directory will prompt scp to check if the files sent from the server match your request. Otherwise, an attack server would theoretically be able to intercept the request by serving malicious files in place of the ones originally requested. Knowing this, you’re probably better off never using scp anyway.  OpenSSH advises against it:<br>
“The scp protocol is outdated, inflexible and not readily fixed. We recommend the use of more modern protocols like sftp and rsync for file transfer instead.”</p>
</blockquote>

<ul>
<li>Interesting new features</li>
</ul>

<blockquote>
<p>ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for “yes”. This allows the user to paste a fingerprint obtained out of band at the prompt and have the client do the comparison for you.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://project-trident.org/post/2019-03-29_18.12-u8_available/">Project Trident : 18.12-U8 Available</a></p>

<blockquote>
<p>Thank you all for your patience! Project Trident has finally finished some significant infrastructure updates over the last 2 weeks, and we are pleased to announce that package update 8 for 18.12-RELEASE is now available.<br>
To switch to the new update, you will need to open the “Configuration” tab in the update manager and switch to the new “Trident-release” package repository. You can also perform this transition via the command line by running: sudo sysup --change-train Trident-release</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.92/">BSD Router Project - Release 1.92</a></li>
<li><a href="https://registration.eurobsdcon.org/conferences/2019/program/proposals/new">EuroBSDcon - New Proposals</a></li>
<li><a href="https://www.reddit.com/r/unix/comments/b1wyde/funny_unix_shirt_ren%C3%A9_magritte_art_parody/">Funny UNIX shirt (René Magritte art parody)</a></li>
<li><a href="https://geoff.greer.fm/2019/03/04/thinkpad-x210/">51NB’s Thinkpad X210</a></li>
<li><a href="https://www.dragonflydigest.com/2019/03/26/22703.html">DragonFly: No more gcc50</a></li>
<li><a href="https://mwl.io/archives/4139">“FreeBSD Mastery: Jails” ebook escaping!</a></li>
<li><a href="https://frab.luga.de/en/LIT2019/public/events/68">FreeBSD talk at the Augsburger Linux Info Days (german)</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>DJ - <a href="http://dpaste.com/3ZRJ5DA#wrap">FuguIta Feedback</a></li>
<li>Mike - <a href="http://dpaste.com/32TSCH4#wrap">Another Good Show</a></li>
<li>Alex - <a href="http://dpaste.com/34ND6BC#wrap">GhostBSD and wifi</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0292.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>291: Storage Changes Software</title>
  <link>https://www.bsdnow.tv/291</link>
  <guid isPermaLink="false">54559ca9-f84f-4e9e-8323-3a5a0919937f</guid>
  <pubDate>Thu, 28 Mar 2019 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/54559ca9-f84f-4e9e-8323-3a5a0919937f.mp3" length="43826319" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Storage changing software, what makes Unix special, what you need may be “pipeline +Unix commands”, running a bakery on Emacs and PostgreSQL, the ultimate guide to memorable tech talks, light-weight contexts, and more.</itunes:subtitle>
  <itunes:duration>1:12:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Storage changing software, what makes Unix special, what you need may be “pipeline +Unix commands”, running a bakery on Emacs and PostgreSQL, the ultimate guide to memorable tech talks, light-weight contexts, and more.
&lt;p&gt;##Headlines&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://news.gandi.net/en/2019/03/tracking-a-storage-issue-led-to-software-change/"&gt;Tracking a storage issue led to software change&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Early last year we completed a massive migration that moved our customers’ hosting data off of a legacy datacenter (that we called FR-SD2) onto several new datacenters (that we call FR-SD3, FR-SD5, and FR-SD6) with much more modern, up-to-date infrastructure.&lt;br&gt;
This migration required several changes in both the software and hardware we use, including switching the operating system on our storage units to FreeBSD.&lt;br&gt;
Currently, we use the NFS protocol to provide storage and export the filesystems on Simple Hosting, our web hosting service, and the FreeBSD kernel includes an NFS server for just this purpose.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Problem&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;While migrating virtual disks of Simple Hosting instances from FR-SD2, we noticed high CPU load spikes on the new storage units.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.softwaredevelopment.site/2019/02/what-makes-unix-special.html"&gt;What Makes Unix Special&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Ever since Unix burst onto the scene within the early '70s, observers within the pc world have been fast to put in writing it off as a unusual working system designed by and for knowledgeable programmers. Regardless of their proclamations, Unix refuses to die. Means again in 1985, Stewart Cheifet puzzled if Unix would turn out to be the usual working system of the longer term on the PBS present “The Laptop Chronicles,” though MS-DOS was effectively in its heyday. In 2018, it is clear that Unix actually is the usual working system, not on desktop PCs, however on smartphones and tablets.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;What Makes Unix Special?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;It is also the usual system for net servers. The actual fact is, hundreds of thousands of individuals all over the world have interacted with Linux and Unix programs daily, most of whom have by no means written a line of code of their lives.&lt;br&gt;
So what makes Unix so beloved by programmers and different techie sorts? Let’s check out a few of issues this working system has going for it. (For some background on Unix, try The Historical past of Unix: From Bell Labs to the iPhone.)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://nanxiao.me/en/what-you-need-may-be-pipeline-unix-commands-only/"&gt;What you need may be “pipeline +Unix commands” only&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I came across Taco Bell Programming recently, and think this article is worthy to read for every software engineer. The post mentions a scenario which you may consider to use Hadoop to solve but actually xargs may be a simpler and better choice. This reminds me a similar experience: last year a client wanted me to process a data file which has 5 million records. After some investigations, no novel technologies, a concise awk script (less than 10 lines) worked like a charm! What surprised me more is that awk is just a single-thread program, no nifty concurrency involved.&lt;br&gt;
The IT field never lacks “new” technologies: cloud computing, big data, high concurrency, etc. However, the thinkings behind these “fancy” words may date back to the era when Unix arose. Unix command line tools are invaluable treasure. In many cases, picking the right components and using pipeline to glue them can satisfy your requirement perfectly. So spending some time in reviewing Unixcommand line manual instead of chasing state-of-the-art techniques exhaustedly, you may gain more.&lt;br&gt;
BTW, if your data set can be disposed by an awk script, it should not be called “big data”.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="http://widgetsandshit.com/teddziuba/2010/10/taco-bell-programming.html"&gt;Taco Bell Programming&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://bofh.org.uk/2019/02/25/baking-with-emacs/"&gt;Running a bakery on Emacs and PostgreSQL&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Just over a year ago now, I finally opened the bakery I’d been dreaming of for years. It’s been a big change in my life, from spending all my time sat in front of a computer, to spending most of it making actual stuff. And stuff that makes people happy, at that. It’s been a huge change, but I can’t think of a single job change that’s ever made me as happy as this one.&lt;br&gt;
One of the big changes that came with going pro was that suddenly I was having to work out how much stuff I needed to mix to fill the orders I needed. On the face of it, this is really simple, just work out how much dough you need, then work out what quantities to mix to make that much dough. Easy. You can do it with a pencil and paper. Or, in traditional bakers’ fashion, by scrawling with your finger on a floured work bench.&lt;br&gt;
And that’s how I coped for a few weeks early on. But I kept making mistakes, which makes for an inconsistent product (bread is very forgiving, you have to work quite hard to make something that isn’t bread, but consistency matters). I needed to automate.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://medium.com/@nnja/the-ultimate-guide-to-memorable-tech-talks-e7c350778d4b"&gt;The Ultimate Guide To Memorable Tech Talks&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Imagine this. You’re a woman in a male-dominated field. English is not your first language. Even though you’re confident in your engineering work, the thought of public speaking and being recorded for the world to see absolutely terrifies you.&lt;br&gt;
That was me, five years ago. Since then, I’ve moved into a successful career in Developer Advocacy and spoken at dozens of technical events in the U.S. and worldwide.&lt;br&gt;
I think everyone has the ability to deliver stellar conference talks, which is why I took the time to write this post.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The Ultimate Guide&lt;/li&gt;
&lt;li&gt;1: Introduction&lt;/li&gt;
&lt;li&gt;2: Choosing a Topic&lt;/li&gt;
&lt;li&gt;3: Writing a Conference Proposal (or CFP)&lt;/li&gt;
&lt;li&gt;4: Tools of the Trade&lt;/li&gt;
&lt;li&gt;5: Planning and Time Estimation&lt;/li&gt;
&lt;li&gt;6: Writing a Talk&lt;/li&gt;
&lt;li&gt;7: Practice and Delivery&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://people.mpi-sws.org/~druschel/publications/osdi16.pdf"&gt;Light-weight Contexts: An OS Abstraction for Safety and Performance (2016)&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Abstract: “We introduce a new OS abstraction—light-weight con-texts (lwCs)—that provides independent units of protection, privilege, and execution state within a process. A process may include several lwCs, each with possibly different views of memory, file descriptors, and access capabilities. lwCs can be used to efficiently implement roll-back (process can return to a prior recorded state),isolated address spaces (lwCs within the process may have different views of memory, e.g., isolating sensitive data from network-facing components or isolating different user sessions), and privilege separation (in-process reference monitors can arbitrate and control access).&lt;br&gt;
lwCs can be implemented efficiently: the overhead of a lwC is proportional to the amount of memory exclusive to the lwC; switching lwCs is quicker than switching kernel threads within the same process. We describe the lwC abstraction and API, and an implementation of lwCs within the FreeBSD 11.0 kernel. Finally, we present an evaluation of common usage patterns, including fast roll-back, session isolation, sensitive data isolation, and in-process reference monitoring, using Apache, nginx, PHP,and OpenSSL.”&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/BSD-Users-Stockholm/events/259528492/"&gt;May 7th - BSD Users Stockholm Meetup #6 &lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2019-February/007218.html"&gt;sysutils/docker-freebsd: Searching for people to help&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/midnightbsd/status/1104018684748677122"&gt;Cat Tax - Ever wonder what Midnight the cat was like?&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://dwheeler.com/essays/fixing-unix-linux-filenames.html"&gt;Fixing Unix/Linux/POSIX Filenames&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://chargen.one/h3artbl33d/metasploit-on-openbsd"&gt;Metasploit on OpenBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://schmonz.com/2019/01/25/devopsdays-nyc-run-your-own-email-server/slides/#1"&gt;Run Your @wn Email Server! with NetBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://johan.huldtgren.com/posts/2019/rdist"&gt;rdist(1)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://joecmarshall.com/posts/book-writing-environment/"&gt;Writing a Book with Unix&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://neowaylabs.github.io/programming/unix-shell-for-data-scientists/"&gt;7 Unix Commands Every Data Scientist Should Know&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blog.regehr.org/archives/1653"&gt;Explaining Code using ASCII Art&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://wiki.freebsd.org/Hackathon/201904"&gt;FreeBSD Aberdeen Hackathon&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://wiki.freebsd.org/Hackathon/201906"&gt;FreeBSD Vienna Hackathon&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Mike - &lt;a href="http://dpaste.com/2405MF1#wrap"&gt;FreeBSD Update and Erased EFI files&lt;/a&gt;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Charles - &lt;a href="http://dpaste.com/2WFTXR2#wrap"&gt;Volunteer work&lt;/a&gt;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Jake - &lt;a href="http://dpaste.com/1AA6C55"&gt;Bhyve Front Ends&lt;/a&gt;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;We’ve hit that point where we are running low on your questions, so if you have any questions rolling around in your head that you’ve not thought of to ask yet… send them in!&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords> freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Storage changing software, what makes Unix special, what you need may be “pipeline +Unix commands”, running a bakery on Emacs and PostgreSQL, the ultimate guide to memorable tech talks, light-weight contexts, and more.</p>

<p>##Headlines</p>

<p>###<a href="https://news.gandi.net/en/2019/03/tracking-a-storage-issue-led-to-software-change/">Tracking a storage issue led to software change</a></p>

<blockquote>
<p>Early last year we completed a massive migration that moved our customers’ hosting data off of a legacy datacenter (that we called FR-SD2) onto several new datacenters (that we call FR-SD3, FR-SD5, and FR-SD6) with much more modern, up-to-date infrastructure.<br>
This migration required several changes in both the software and hardware we use, including switching the operating system on our storage units to FreeBSD.<br>
Currently, we use the NFS protocol to provide storage and export the filesystems on Simple Hosting, our web hosting service, and the FreeBSD kernel includes an NFS server for just this purpose.</p>
</blockquote>

<ul>
<li>Problem</li>
</ul>

<blockquote>
<p>While migrating virtual disks of Simple Hosting instances from FR-SD2, we noticed high CPU load spikes on the new storage units.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.softwaredevelopment.site/2019/02/what-makes-unix-special.html">What Makes Unix Special</a></p>

<blockquote>
<p>Ever since Unix burst onto the scene within the early '70s, observers within the pc world have been fast to put in writing it off as a unusual working system designed by and for knowledgeable programmers. Regardless of their proclamations, Unix refuses to die. Means again in 1985, Stewart Cheifet puzzled if Unix would turn out to be the usual working system of the longer term on the PBS present “The Laptop Chronicles,” though MS-DOS was effectively in its heyday. In 2018, it is clear that Unix actually is the usual working system, not on desktop PCs, however on smartphones and tablets.</p>
</blockquote>

<ul>
<li>What Makes Unix Special?</li>
</ul>

<blockquote>
<p>It is also the usual system for net servers. The actual fact is, hundreds of thousands of individuals all over the world have interacted with Linux and Unix programs daily, most of whom have by no means written a line of code of their lives.<br>
So what makes Unix so beloved by programmers and different techie sorts? Let’s check out a few of issues this working system has going for it. (For some background on Unix, try The Historical past of Unix: From Bell Labs to the iPhone.)</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://nanxiao.me/en/what-you-need-may-be-pipeline-unix-commands-only/">What you need may be “pipeline +Unix commands” only</a></p>

<blockquote>
<p>I came across Taco Bell Programming recently, and think this article is worthy to read for every software engineer. The post mentions a scenario which you may consider to use Hadoop to solve but actually xargs may be a simpler and better choice. This reminds me a similar experience: last year a client wanted me to process a data file which has 5 million records. After some investigations, no novel technologies, a concise awk script (less than 10 lines) worked like a charm! What surprised me more is that awk is just a single-thread program, no nifty concurrency involved.<br>
The IT field never lacks “new” technologies: cloud computing, big data, high concurrency, etc. However, the thinkings behind these “fancy” words may date back to the era when Unix arose. Unix command line tools are invaluable treasure. In many cases, picking the right components and using pipeline to glue them can satisfy your requirement perfectly. So spending some time in reviewing Unixcommand line manual instead of chasing state-of-the-art techniques exhaustedly, you may gain more.<br>
BTW, if your data set can be disposed by an awk script, it should not be called “big data”.</p>
</blockquote>

<ul>
<li><a href="http://widgetsandshit.com/teddziuba/2010/10/taco-bell-programming.html">Taco Bell Programming</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://bofh.org.uk/2019/02/25/baking-with-emacs/">Running a bakery on Emacs and PostgreSQL</a></p>

<blockquote>
<p>Just over a year ago now, I finally opened the bakery I’d been dreaming of for years. It’s been a big change in my life, from spending all my time sat in front of a computer, to spending most of it making actual stuff. And stuff that makes people happy, at that. It’s been a huge change, but I can’t think of a single job change that’s ever made me as happy as this one.<br>
One of the big changes that came with going pro was that suddenly I was having to work out how much stuff I needed to mix to fill the orders I needed. On the face of it, this is really simple, just work out how much dough you need, then work out what quantities to mix to make that much dough. Easy. You can do it with a pencil and paper. Or, in traditional bakers’ fashion, by scrawling with your finger on a floured work bench.<br>
And that’s how I coped for a few weeks early on. But I kept making mistakes, which makes for an inconsistent product (bread is very forgiving, you have to work quite hard to make something that isn’t bread, but consistency matters). I needed to automate.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://medium.com/@nnja/the-ultimate-guide-to-memorable-tech-talks-e7c350778d4b">The Ultimate Guide To Memorable Tech Talks</a></p>

<blockquote>
<p>Imagine this. You’re a woman in a male-dominated field. English is not your first language. Even though you’re confident in your engineering work, the thought of public speaking and being recorded for the world to see absolutely terrifies you.<br>
That was me, five years ago. Since then, I’ve moved into a successful career in Developer Advocacy and spoken at dozens of technical events in the U.S. and worldwide.<br>
I think everyone has the ability to deliver stellar conference talks, which is why I took the time to write this post.</p>
</blockquote>

<ul>
<li>The Ultimate Guide</li>
<li>1: Introduction</li>
<li>2: Choosing a Topic</li>
<li>3: Writing a Conference Proposal (or CFP)</li>
<li>4: Tools of the Trade</li>
<li>5: Planning and Time Estimation</li>
<li>6: Writing a Talk</li>
<li>7: Practice and Delivery</li>
</ul>

<p><hr></p>

<p>###<a href="https://people.mpi-sws.org/~druschel/publications/osdi16.pdf">Light-weight Contexts: An OS Abstraction for Safety and Performance (2016)</a></p>

<blockquote>
<p>Abstract: “We introduce a new OS abstraction—light-weight con-texts (lwCs)—that provides independent units of protection, privilege, and execution state within a process. A process may include several lwCs, each with possibly different views of memory, file descriptors, and access capabilities. lwCs can be used to efficiently implement roll-back (process can return to a prior recorded state),isolated address spaces (lwCs within the process may have different views of memory, e.g., isolating sensitive data from network-facing components or isolating different user sessions), and privilege separation (in-process reference monitors can arbitrate and control access).<br>
lwCs can be implemented efficiently: the overhead of a lwC is proportional to the amount of memory exclusive to the lwC; switching lwCs is quicker than switching kernel threads within the same process. We describe the lwC abstraction and API, and an implementation of lwCs within the FreeBSD 11.0 kernel. Finally, we present an evaluation of common usage patterns, including fast roll-back, session isolation, sensitive data isolation, and in-process reference monitoring, using Apache, nginx, PHP,and OpenSSL.”</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/259528492/">May 7th - BSD Users Stockholm Meetup #6 </a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2019-February/007218.html">sysutils/docker-freebsd: Searching for people to help</a></li>
<li><a href="https://twitter.com/midnightbsd/status/1104018684748677122">Cat Tax - Ever wonder what Midnight the cat was like?</a></li>
<li><a href="https://dwheeler.com/essays/fixing-unix-linux-filenames.html">Fixing Unix/Linux/POSIX Filenames</a></li>
<li><a href="https://chargen.one/h3artbl33d/metasploit-on-openbsd">Metasploit on OpenBSD</a></li>
<li><a href="https://schmonz.com/2019/01/25/devopsdays-nyc-run-your-own-email-server/slides/#1">Run Your @wn Email Server! with NetBSD</a></li>
<li><a href="http://johan.huldtgren.com/posts/2019/rdist">rdist(1)</a></li>
<li><a href="https://joecmarshall.com/posts/book-writing-environment/">Writing a Book with Unix</a></li>
<li><a href="https://neowaylabs.github.io/programming/unix-shell-for-data-scientists/">7 Unix Commands Every Data Scientist Should Know</a></li>
<li><a href="https://blog.regehr.org/archives/1653">Explaining Code using ASCII Art</a></li>
<li><a href="https://wiki.freebsd.org/Hackathon/201904">FreeBSD Aberdeen Hackathon</a></li>
<li><a href="https://wiki.freebsd.org/Hackathon/201906">FreeBSD Vienna Hackathon</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>
<p>Mike - <a href="http://dpaste.com/2405MF1#wrap">FreeBSD Update and Erased EFI files</a></p>
</li>
<li>
<p>Charles - <a href="http://dpaste.com/2WFTXR2#wrap">Volunteer work</a></p>
</li>
<li>
<p>Jake - <a href="http://dpaste.com/1AA6C55">Bhyve Front Ends</a></p>
</li>
<li>
<p>We’ve hit that point where we are running low on your questions, so if you have any questions rolling around in your head that you’ve not thought of to ask yet… send them in!</p>
</li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0291.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Storage changing software, what makes Unix special, what you need may be “pipeline +Unix commands”, running a bakery on Emacs and PostgreSQL, the ultimate guide to memorable tech talks, light-weight contexts, and more.</p>

<p>##Headlines</p>

<p>###<a href="https://news.gandi.net/en/2019/03/tracking-a-storage-issue-led-to-software-change/">Tracking a storage issue led to software change</a></p>

<blockquote>
<p>Early last year we completed a massive migration that moved our customers’ hosting data off of a legacy datacenter (that we called FR-SD2) onto several new datacenters (that we call FR-SD3, FR-SD5, and FR-SD6) with much more modern, up-to-date infrastructure.<br>
This migration required several changes in both the software and hardware we use, including switching the operating system on our storage units to FreeBSD.<br>
Currently, we use the NFS protocol to provide storage and export the filesystems on Simple Hosting, our web hosting service, and the FreeBSD kernel includes an NFS server for just this purpose.</p>
</blockquote>

<ul>
<li>Problem</li>
</ul>

<blockquote>
<p>While migrating virtual disks of Simple Hosting instances from FR-SD2, we noticed high CPU load spikes on the new storage units.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.softwaredevelopment.site/2019/02/what-makes-unix-special.html">What Makes Unix Special</a></p>

<blockquote>
<p>Ever since Unix burst onto the scene within the early '70s, observers within the pc world have been fast to put in writing it off as a unusual working system designed by and for knowledgeable programmers. Regardless of their proclamations, Unix refuses to die. Means again in 1985, Stewart Cheifet puzzled if Unix would turn out to be the usual working system of the longer term on the PBS present “The Laptop Chronicles,” though MS-DOS was effectively in its heyday. In 2018, it is clear that Unix actually is the usual working system, not on desktop PCs, however on smartphones and tablets.</p>
</blockquote>

<ul>
<li>What Makes Unix Special?</li>
</ul>

<blockquote>
<p>It is also the usual system for net servers. The actual fact is, hundreds of thousands of individuals all over the world have interacted with Linux and Unix programs daily, most of whom have by no means written a line of code of their lives.<br>
So what makes Unix so beloved by programmers and different techie sorts? Let’s check out a few of issues this working system has going for it. (For some background on Unix, try The Historical past of Unix: From Bell Labs to the iPhone.)</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://nanxiao.me/en/what-you-need-may-be-pipeline-unix-commands-only/">What you need may be “pipeline +Unix commands” only</a></p>

<blockquote>
<p>I came across Taco Bell Programming recently, and think this article is worthy to read for every software engineer. The post mentions a scenario which you may consider to use Hadoop to solve but actually xargs may be a simpler and better choice. This reminds me a similar experience: last year a client wanted me to process a data file which has 5 million records. After some investigations, no novel technologies, a concise awk script (less than 10 lines) worked like a charm! What surprised me more is that awk is just a single-thread program, no nifty concurrency involved.<br>
The IT field never lacks “new” technologies: cloud computing, big data, high concurrency, etc. However, the thinkings behind these “fancy” words may date back to the era when Unix arose. Unix command line tools are invaluable treasure. In many cases, picking the right components and using pipeline to glue them can satisfy your requirement perfectly. So spending some time in reviewing Unixcommand line manual instead of chasing state-of-the-art techniques exhaustedly, you may gain more.<br>
BTW, if your data set can be disposed by an awk script, it should not be called “big data”.</p>
</blockquote>

<ul>
<li><a href="http://widgetsandshit.com/teddziuba/2010/10/taco-bell-programming.html">Taco Bell Programming</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://bofh.org.uk/2019/02/25/baking-with-emacs/">Running a bakery on Emacs and PostgreSQL</a></p>

<blockquote>
<p>Just over a year ago now, I finally opened the bakery I’d been dreaming of for years. It’s been a big change in my life, from spending all my time sat in front of a computer, to spending most of it making actual stuff. And stuff that makes people happy, at that. It’s been a huge change, but I can’t think of a single job change that’s ever made me as happy as this one.<br>
One of the big changes that came with going pro was that suddenly I was having to work out how much stuff I needed to mix to fill the orders I needed. On the face of it, this is really simple, just work out how much dough you need, then work out what quantities to mix to make that much dough. Easy. You can do it with a pencil and paper. Or, in traditional bakers’ fashion, by scrawling with your finger on a floured work bench.<br>
And that’s how I coped for a few weeks early on. But I kept making mistakes, which makes for an inconsistent product (bread is very forgiving, you have to work quite hard to make something that isn’t bread, but consistency matters). I needed to automate.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://medium.com/@nnja/the-ultimate-guide-to-memorable-tech-talks-e7c350778d4b">The Ultimate Guide To Memorable Tech Talks</a></p>

<blockquote>
<p>Imagine this. You’re a woman in a male-dominated field. English is not your first language. Even though you’re confident in your engineering work, the thought of public speaking and being recorded for the world to see absolutely terrifies you.<br>
That was me, five years ago. Since then, I’ve moved into a successful career in Developer Advocacy and spoken at dozens of technical events in the U.S. and worldwide.<br>
I think everyone has the ability to deliver stellar conference talks, which is why I took the time to write this post.</p>
</blockquote>

<ul>
<li>The Ultimate Guide</li>
<li>1: Introduction</li>
<li>2: Choosing a Topic</li>
<li>3: Writing a Conference Proposal (or CFP)</li>
<li>4: Tools of the Trade</li>
<li>5: Planning and Time Estimation</li>
<li>6: Writing a Talk</li>
<li>7: Practice and Delivery</li>
</ul>

<p><hr></p>

<p>###<a href="https://people.mpi-sws.org/~druschel/publications/osdi16.pdf">Light-weight Contexts: An OS Abstraction for Safety and Performance (2016)</a></p>

<blockquote>
<p>Abstract: “We introduce a new OS abstraction—light-weight con-texts (lwCs)—that provides independent units of protection, privilege, and execution state within a process. A process may include several lwCs, each with possibly different views of memory, file descriptors, and access capabilities. lwCs can be used to efficiently implement roll-back (process can return to a prior recorded state),isolated address spaces (lwCs within the process may have different views of memory, e.g., isolating sensitive data from network-facing components or isolating different user sessions), and privilege separation (in-process reference monitors can arbitrate and control access).<br>
lwCs can be implemented efficiently: the overhead of a lwC is proportional to the amount of memory exclusive to the lwC; switching lwCs is quicker than switching kernel threads within the same process. We describe the lwC abstraction and API, and an implementation of lwCs within the FreeBSD 11.0 kernel. Finally, we present an evaluation of common usage patterns, including fast roll-back, session isolation, sensitive data isolation, and in-process reference monitoring, using Apache, nginx, PHP,and OpenSSL.”</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/259528492/">May 7th - BSD Users Stockholm Meetup #6 </a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2019-February/007218.html">sysutils/docker-freebsd: Searching for people to help</a></li>
<li><a href="https://twitter.com/midnightbsd/status/1104018684748677122">Cat Tax - Ever wonder what Midnight the cat was like?</a></li>
<li><a href="https://dwheeler.com/essays/fixing-unix-linux-filenames.html">Fixing Unix/Linux/POSIX Filenames</a></li>
<li><a href="https://chargen.one/h3artbl33d/metasploit-on-openbsd">Metasploit on OpenBSD</a></li>
<li><a href="https://schmonz.com/2019/01/25/devopsdays-nyc-run-your-own-email-server/slides/#1">Run Your @wn Email Server! with NetBSD</a></li>
<li><a href="http://johan.huldtgren.com/posts/2019/rdist">rdist(1)</a></li>
<li><a href="https://joecmarshall.com/posts/book-writing-environment/">Writing a Book with Unix</a></li>
<li><a href="https://neowaylabs.github.io/programming/unix-shell-for-data-scientists/">7 Unix Commands Every Data Scientist Should Know</a></li>
<li><a href="https://blog.regehr.org/archives/1653">Explaining Code using ASCII Art</a></li>
<li><a href="https://wiki.freebsd.org/Hackathon/201904">FreeBSD Aberdeen Hackathon</a></li>
<li><a href="https://wiki.freebsd.org/Hackathon/201906">FreeBSD Vienna Hackathon</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>
<p>Mike - <a href="http://dpaste.com/2405MF1#wrap">FreeBSD Update and Erased EFI files</a></p>
</li>
<li>
<p>Charles - <a href="http://dpaste.com/2WFTXR2#wrap">Volunteer work</a></p>
</li>
<li>
<p>Jake - <a href="http://dpaste.com/1AA6C55">Bhyve Front Ends</a></p>
</li>
<li>
<p>We’ve hit that point where we are running low on your questions, so if you have any questions rolling around in your head that you’ve not thought of to ask yet… send them in!</p>
</li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0291.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>290: Timestamped Notes</title>
  <link>https://www.bsdnow.tv/290</link>
  <guid isPermaLink="false">75bc6dda-ec5d-45fe-adf3-2afde9a7f099</guid>
  <pubDate>Thu, 21 Mar 2019 10:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/75bc6dda-ec5d-45fe-adf3-2afde9a7f099.mp3" length="30199731" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD on Cavium ThunderX, looking at NetBSD as an OpenBSD user, taking time-stamped notes in vim, OpenBSD 6.5 has been tagged, FreeBSD and NetBSD in GSoC 2019, SecBSD: an UNIX-like OS for Hackers, and more.</itunes:subtitle>
  <itunes:duration>50:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD on Cavium ThunderX, looking at NetBSD as an OpenBSD user, taking time-stamped notes in vim, OpenBSD 6.5 has been tagged, FreeBSD and NetBSD in GSoC 2019, SecBSD: an UNIX-like OS for Hackers, and more.
&lt;p&gt;##Headlines&lt;br&gt;
###&lt;a href="https://eerielinux.wordpress.com/2019/02/25/armd-and-dangerous-freebsd-on-cavium-thunderx-aarch64/"&gt;ARM’d and dangerous: FreeBSD on Cavium ThunderX (aarch64)&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;While I don’t remember for how many years I’ve had an interest in CPU architectures that could be an alternative to AMD64, I know pretty well when I started proposing to test 64-bit ARM at work. It was shortly after the disaster named Spectre / Meltdown that I first dug out server-class ARM hardware and asked whether we should get one such server and run some tests with it.&lt;br&gt;
While the answer wasn’t a clear “no” it also wasn’t exactly “yes”. I tried again a few times over the course of 2018 and each time I presented some more points why I thought it might be a good thing to test this. But still I wasn’t able to get a positive answer. Finally in January 2019 year I got a definitive answer – and it was “yes, go ahead”! The fact that Amazon had just presented their Graviton ARM Processor may have helped the decision.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.tumfatig.net/20190301/looking-at-netbsd-from-an-openbsd-user-perspective/"&gt;Looking at NetBSD from an OpenBSD user perspective&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I use to use NetBSD quite a lot. From 2.0 to 6.99. But for some reasons, I stopped using it about 2012, in favor of OpenBSD. Reading on the new 8 release, I wanted to see if all the things I didn’t like on NetBSD were gone. Here is a personal Pros / Cons list. No Troll, hopefully. Just trying to be objective.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;What I liked (pros)&lt;/li&gt;
&lt;li&gt;Things I didn’t like (cons)&lt;/li&gt;
&lt;li&gt;Conclusion&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;So that was it. I didn’t spend more than 30 minutes of it. But I didn’t want to spend more time on it. I did stop using NetBSD because of the need to compile each and every packages ; it was in the early days of pkgin. I also didn’t like the way system maintenance was to be done. OpenBSD’s 6-months release seemed far more easy to manage. I still think NetBSD is a great OS. But I believe you have to spent more time on it than you would have to do with OpenBSD.&lt;br&gt;
That said, I’ll keep using my Puffy OS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://www.codesections.com/blog/vim-timestamped/"&gt;Using Vim to take time-stamped notes&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I frequently find myself needing to take time-stamped notes. Specifically, I’ll be in a call, meeting, or interview and need to take notes that show how long it’s been since the meeting started.&lt;br&gt;
My first thought was that there’s be a plugin to add time stamps, but a quick search didn’t turn anything up. However, I little digging did turn up the fact that vim has the built-in ability to tell time.&lt;br&gt;
This means that writing a bit of vimscript to insert a time stamp is pretty easy. After a bit of fiddling, I came up with something that serves my needs, and I decided it might be useful enough to others to be worth sharing.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://github.com/bsdjhb/meetings"&gt;John Baldwin’s notes on bhyve meetings&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.undeadly.org/cgi?action=article;sid=20190228062751"&gt;OpenBSD 6.5-beta has been tagged&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;It’s that time of year again; Theo (deraadt@) has just tagged 6.5-beta. A good reminder for us all run an extra test install and see if your favorite port still works as you expect.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;CVSROOT: /cvs&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Module name: src&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Changes by: deraadt@cvs.openbsd.org 2019/02/26 15:24:41&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Modified files:&lt;/code&gt;&lt;br&gt;
&lt;code&gt;etc/root : root.mail&lt;/code&gt;&lt;br&gt;
&lt;code&gt;share/mk : sys.mk&lt;/code&gt;&lt;br&gt;
&lt;code&gt;sys/conf : newvers.sh&lt;/code&gt;&lt;br&gt;
&lt;code&gt;sys/sys : ktrace.h param.h&lt;/code&gt;&lt;br&gt;
&lt;code&gt;usr.bin/signify: signify.1&lt;/code&gt;&lt;br&gt;
&lt;code&gt;sys/arch/macppc/stand/tbxidata: bsd.tbxi&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Log message:&lt;/code&gt;&lt;br&gt;
&lt;code&gt;crank to 6.5-beta&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;/p&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blog.netbsd.org/tnf/entry/the_netbsd_foundation_participating_in"&gt;The NetBSD Foundation participating in Google Summer of Code 2019&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;For the 4th year in a row and for the 13th time The NetBSD Foundation will participate in Google Summer of Code 2019!&lt;br&gt;
If you are a student and would like to learn more about Google Summer of Code please go to the Google Summer of Code homepage.&lt;br&gt;
You can find a list of projects in Google Summer of Code project proposals in the wiki.&lt;br&gt;
Do not hesitate to get in touch with us via #netbsd-code IRC channel on Freenode and via NetBSD mailing lists!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://discoverbsd.com/p/d83c2c66dc"&gt;SecBSD: an UNIX-like OS for Hackers&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;SecBSD is an UNIX-like operating system focused on computer security based on OpenBSD. Designed for security testing, hacking and vulnerability assessment, it uses full disk encryption and ProtonVPN + OpenVPN by default.&lt;br&gt;
A security BSD enviroment for security researchers, penetration testers, bug hunters and cybersecurity experts. Developed by Dark Intelligence Team for private use and will be public release coming soon.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://why-openbsd.rocks/fact/"&gt;Why OpenBSD Rocks&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.etalabs.net/sh_tricks.html"&gt;Rich’s sh (POSIX shell) tricks&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://opensource.com/article/19/2/drinking-coffee-awk"&gt;Drinking coffee with AWK&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/AMEE/8XX-rfc"&gt;Civilisational HTTP Error Codes&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.midnightbsd.org/news/"&gt;MidnightBSD Roadmap&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://gist.github.com/murachue/531ed3ca201ab4155d22442272d92ed2#file-201902140007-txt"&gt;NetBSD on Nintendo64&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://nullprogram.com/blog/2018/09/20/"&gt;From Vimperator to Tridactyl&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Russell - &lt;a href="http://dpaste.com/3QRYM70#wrap"&gt;BSD Now Question :: ZFS &amp;amp; FreeNAS&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Alan - &lt;a href="http://dpaste.com/1KQZPN6"&gt;Tutorial, install ARM *BSD with no other BSD box pls&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Johnny - &lt;a href="http://dpaste.com/2ZKRC2A"&gt;New section to add to the show&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD on Cavium ThunderX, looking at NetBSD as an OpenBSD user, taking time-stamped notes in vim, OpenBSD 6.5 has been tagged, FreeBSD and NetBSD in GSoC 2019, SecBSD: an UNIX-like OS for Hackers, and more.</p>

<p>##Headlines<br>
###<a href="https://eerielinux.wordpress.com/2019/02/25/armd-and-dangerous-freebsd-on-cavium-thunderx-aarch64/">ARM’d and dangerous: FreeBSD on Cavium ThunderX (aarch64)</a></p>

<blockquote>
<p>While I don’t remember for how many years I’ve had an interest in CPU architectures that could be an alternative to AMD64, I know pretty well when I started proposing to test 64-bit ARM at work. It was shortly after the disaster named Spectre / Meltdown that I first dug out server-class ARM hardware and asked whether we should get one such server and run some tests with it.<br>
While the answer wasn’t a clear “no” it also wasn’t exactly “yes”. I tried again a few times over the course of 2018 and each time I presented some more points why I thought it might be a good thing to test this. But still I wasn’t able to get a positive answer. Finally in January 2019 year I got a definitive answer – and it was “yes, go ahead”! The fact that Amazon had just presented their Graviton ARM Processor may have helped the decision.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.tumfatig.net/20190301/looking-at-netbsd-from-an-openbsd-user-perspective/">Looking at NetBSD from an OpenBSD user perspective</a></p>

<blockquote>
<p>I use to use NetBSD quite a lot. From 2.0 to 6.99. But for some reasons, I stopped using it about 2012, in favor of OpenBSD. Reading on the new 8 release, I wanted to see if all the things I didn’t like on NetBSD were gone. Here is a personal Pros / Cons list. No Troll, hopefully. Just trying to be objective.</p>
</blockquote>

<ul>
<li>What I liked (pros)</li>
<li>Things I didn’t like (cons)</li>
<li>Conclusion</li>
</ul>

<blockquote>
<p>So that was it. I didn’t spend more than 30 minutes of it. But I didn’t want to spend more time on it. I did stop using NetBSD because of the need to compile each and every packages ; it was in the early days of pkgin. I also didn’t like the way system maintenance was to be done. OpenBSD’s 6-months release seemed far more easy to manage. I still think NetBSD is a great OS. But I believe you have to spent more time on it than you would have to do with OpenBSD.<br>
That said, I’ll keep using my Puffy OS.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://www.codesections.com/blog/vim-timestamped/">Using Vim to take time-stamped notes</a></p>

<blockquote>
<p>I frequently find myself needing to take time-stamped notes. Specifically, I’ll be in a call, meeting, or interview and need to take notes that show how long it’s been since the meeting started.<br>
My first thought was that there’s be a plugin to add time stamps, but a quick search didn’t turn anything up. However, I little digging did turn up the fact that vim has the built-in ability to tell time.<br>
This means that writing a bit of vimscript to insert a time stamp is pretty easy. After a bit of fiddling, I came up with something that serves my needs, and I decided it might be useful enough to others to be worth sharing.</p>
</blockquote>

<ul>
<li><a href="https://github.com/bsdjhb/meetings">John Baldwin’s notes on bhyve meetings</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://www.undeadly.org/cgi?action=article;sid=20190228062751">OpenBSD 6.5-beta has been tagged</a></p>

<blockquote>
<p>It’s that time of year again; Theo (deraadt@) has just tagged 6.5-beta. A good reminder for us all run an extra test install and see if your favorite port still works as you expect.</p>
</blockquote>

<p><code>CVSROOT: /cvs</code><br>
<code>Module name: src</code><br>
<code>Changes by: deraadt@cvs.openbsd.org 2019/02/26 15:24:41</code><br>
<code></code><br>
<code>Modified files:</code><br>
<code>etc/root : root.mail</code><br>
<code>share/mk : sys.mk</code><br>
<code>sys/conf : newvers.sh</code><br>
<code>sys/sys : ktrace.h param.h</code><br>
<code>usr.bin/signify: signify.1</code><br>
<code>sys/arch/macppc/stand/tbxidata: bsd.tbxi</code><br>
<code></code><br>
<code>Log message:</code><br>
<code>crank to 6.5-beta</code><br>
<code></code></p>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/the_netbsd_foundation_participating_in">The NetBSD Foundation participating in Google Summer of Code 2019</a></p>

<blockquote>
<p>For the 4th year in a row and for the 13th time The NetBSD Foundation will participate in Google Summer of Code 2019!<br>
If you are a student and would like to learn more about Google Summer of Code please go to the Google Summer of Code homepage.<br>
You can find a list of projects in Google Summer of Code project proposals in the wiki.<br>
Do not hesitate to get in touch with us via #netbsd-code IRC channel on Freenode and via NetBSD mailing lists!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://discoverbsd.com/p/d83c2c66dc">SecBSD: an UNIX-like OS for Hackers</a></p>

<blockquote>
<p>SecBSD is an UNIX-like operating system focused on computer security based on OpenBSD. Designed for security testing, hacking and vulnerability assessment, it uses full disk encryption and ProtonVPN + OpenVPN by default.<br>
A security BSD enviroment for security researchers, penetration testers, bug hunters and cybersecurity experts. Developed by Dark Intelligence Team for private use and will be public release coming soon.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://why-openbsd.rocks/fact/">Why OpenBSD Rocks</a></li>
<li><a href="http://www.etalabs.net/sh_tricks.html">Rich’s sh (POSIX shell) tricks</a></li>
<li><a href="https://opensource.com/article/19/2/drinking-coffee-awk">Drinking coffee with AWK</a></li>
<li><a href="https://github.com/AMEE/8XX-rfc">Civilisational HTTP Error Codes</a></li>
<li><a href="https://www.midnightbsd.org/news/">MidnightBSD Roadmap</a></li>
<li><a href="https://gist.github.com/murachue/531ed3ca201ab4155d22442272d92ed2#file-201902140007-txt">NetBSD on Nintendo64</a></li>
<li><a href="https://nullprogram.com/blog/2018/09/20/">From Vimperator to Tridactyl</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Russell - <a href="http://dpaste.com/3QRYM70#wrap">BSD Now Question :: ZFS &amp; FreeNAS</a></li>
<li>Alan - <a href="http://dpaste.com/1KQZPN6">Tutorial, install ARM *BSD with no other BSD box pls</a></li>
<li>Johnny - <a href="http://dpaste.com/2ZKRC2A">New section to add to the show</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0290.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD on Cavium ThunderX, looking at NetBSD as an OpenBSD user, taking time-stamped notes in vim, OpenBSD 6.5 has been tagged, FreeBSD and NetBSD in GSoC 2019, SecBSD: an UNIX-like OS for Hackers, and more.</p>

<p>##Headlines<br>
###<a href="https://eerielinux.wordpress.com/2019/02/25/armd-and-dangerous-freebsd-on-cavium-thunderx-aarch64/">ARM’d and dangerous: FreeBSD on Cavium ThunderX (aarch64)</a></p>

<blockquote>
<p>While I don’t remember for how many years I’ve had an interest in CPU architectures that could be an alternative to AMD64, I know pretty well when I started proposing to test 64-bit ARM at work. It was shortly after the disaster named Spectre / Meltdown that I first dug out server-class ARM hardware and asked whether we should get one such server and run some tests with it.<br>
While the answer wasn’t a clear “no” it also wasn’t exactly “yes”. I tried again a few times over the course of 2018 and each time I presented some more points why I thought it might be a good thing to test this. But still I wasn’t able to get a positive answer. Finally in January 2019 year I got a definitive answer – and it was “yes, go ahead”! The fact that Amazon had just presented their Graviton ARM Processor may have helped the decision.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.tumfatig.net/20190301/looking-at-netbsd-from-an-openbsd-user-perspective/">Looking at NetBSD from an OpenBSD user perspective</a></p>

<blockquote>
<p>I use to use NetBSD quite a lot. From 2.0 to 6.99. But for some reasons, I stopped using it about 2012, in favor of OpenBSD. Reading on the new 8 release, I wanted to see if all the things I didn’t like on NetBSD were gone. Here is a personal Pros / Cons list. No Troll, hopefully. Just trying to be objective.</p>
</blockquote>

<ul>
<li>What I liked (pros)</li>
<li>Things I didn’t like (cons)</li>
<li>Conclusion</li>
</ul>

<blockquote>
<p>So that was it. I didn’t spend more than 30 minutes of it. But I didn’t want to spend more time on it. I did stop using NetBSD because of the need to compile each and every packages ; it was in the early days of pkgin. I also didn’t like the way system maintenance was to be done. OpenBSD’s 6-months release seemed far more easy to manage. I still think NetBSD is a great OS. But I believe you have to spent more time on it than you would have to do with OpenBSD.<br>
That said, I’ll keep using my Puffy OS.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://www.codesections.com/blog/vim-timestamped/">Using Vim to take time-stamped notes</a></p>

<blockquote>
<p>I frequently find myself needing to take time-stamped notes. Specifically, I’ll be in a call, meeting, or interview and need to take notes that show how long it’s been since the meeting started.<br>
My first thought was that there’s be a plugin to add time stamps, but a quick search didn’t turn anything up. However, I little digging did turn up the fact that vim has the built-in ability to tell time.<br>
This means that writing a bit of vimscript to insert a time stamp is pretty easy. After a bit of fiddling, I came up with something that serves my needs, and I decided it might be useful enough to others to be worth sharing.</p>
</blockquote>

<ul>
<li><a href="https://github.com/bsdjhb/meetings">John Baldwin’s notes on bhyve meetings</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://www.undeadly.org/cgi?action=article;sid=20190228062751">OpenBSD 6.5-beta has been tagged</a></p>

<blockquote>
<p>It’s that time of year again; Theo (deraadt@) has just tagged 6.5-beta. A good reminder for us all run an extra test install and see if your favorite port still works as you expect.</p>
</blockquote>

<p><code>CVSROOT: /cvs</code><br>
<code>Module name: src</code><br>
<code>Changes by: deraadt@cvs.openbsd.org 2019/02/26 15:24:41</code><br>
<code></code><br>
<code>Modified files:</code><br>
<code>etc/root : root.mail</code><br>
<code>share/mk : sys.mk</code><br>
<code>sys/conf : newvers.sh</code><br>
<code>sys/sys : ktrace.h param.h</code><br>
<code>usr.bin/signify: signify.1</code><br>
<code>sys/arch/macppc/stand/tbxidata: bsd.tbxi</code><br>
<code></code><br>
<code>Log message:</code><br>
<code>crank to 6.5-beta</code><br>
<code></code></p>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/the_netbsd_foundation_participating_in">The NetBSD Foundation participating in Google Summer of Code 2019</a></p>

<blockquote>
<p>For the 4th year in a row and for the 13th time The NetBSD Foundation will participate in Google Summer of Code 2019!<br>
If you are a student and would like to learn more about Google Summer of Code please go to the Google Summer of Code homepage.<br>
You can find a list of projects in Google Summer of Code project proposals in the wiki.<br>
Do not hesitate to get in touch with us via #netbsd-code IRC channel on Freenode and via NetBSD mailing lists!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://discoverbsd.com/p/d83c2c66dc">SecBSD: an UNIX-like OS for Hackers</a></p>

<blockquote>
<p>SecBSD is an UNIX-like operating system focused on computer security based on OpenBSD. Designed for security testing, hacking and vulnerability assessment, it uses full disk encryption and ProtonVPN + OpenVPN by default.<br>
A security BSD enviroment for security researchers, penetration testers, bug hunters and cybersecurity experts. Developed by Dark Intelligence Team for private use and will be public release coming soon.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://why-openbsd.rocks/fact/">Why OpenBSD Rocks</a></li>
<li><a href="http://www.etalabs.net/sh_tricks.html">Rich’s sh (POSIX shell) tricks</a></li>
<li><a href="https://opensource.com/article/19/2/drinking-coffee-awk">Drinking coffee with AWK</a></li>
<li><a href="https://github.com/AMEE/8XX-rfc">Civilisational HTTP Error Codes</a></li>
<li><a href="https://www.midnightbsd.org/news/">MidnightBSD Roadmap</a></li>
<li><a href="https://gist.github.com/murachue/531ed3ca201ab4155d22442272d92ed2#file-201902140007-txt">NetBSD on Nintendo64</a></li>
<li><a href="https://nullprogram.com/blog/2018/09/20/">From Vimperator to Tridactyl</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Russell - <a href="http://dpaste.com/3QRYM70#wrap">BSD Now Question :: ZFS &amp; FreeNAS</a></li>
<li>Alan - <a href="http://dpaste.com/1KQZPN6">Tutorial, install ARM *BSD with no other BSD box pls</a></li>
<li>Johnny - <a href="http://dpaste.com/2ZKRC2A">New section to add to the show</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0290.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>289: Microkernel Failure</title>
  <link>https://www.bsdnow.tv/289</link>
  <guid isPermaLink="false">eb6d59df-4b39-453b-93ca-18a6934e4e16</guid>
  <pubDate>Thu, 14 Mar 2019 19:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/eb6d59df-4b39-453b-93ca-18a6934e4e16.mp3" length="36815600" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A kernel of failure, IPv6 fragmentation vulnerability in OpenBSD’s pf, a guide to the terminal, using a Yubikey for SSH public key authentication, FreeBSD desktop series, and more. </itunes:subtitle>
  <itunes:duration>1:01:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A kernel of failure, IPv6 fragmentation vulnerability in OpenBSD’s pf, a guide to the terminal, using a Yubikey for SSH public key authentication, FreeBSD desktop series, and more. 
&lt;p&gt;##Headlines&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://tedium.co/2019/02/28/ibm-workplace-os-taligent-history/"&gt;A Kernel Of Failure -&lt;br&gt;
How IBM bet big on the microkernel being the next big thing in operating systems back in the ’90s—and spent billions with little to show for it.&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Today in Tedium: In the early 1990s, we had no idea where the computer industry was going, what the next generation would look like, or even what the driving factor would be. All the developers back then knew is that the operating systems available in server rooms or on desktop computers simply weren’t good enough, and that the next generation needed to be better—a lot better. This was easier said than done, but this problem for some reason seemed to rack the brains of one company more than any other: IBM. Throughout the decade, the company was associated with more overwrought thinking about operating systems than any other, with little to show for it in the end. The problem? It might have gotten caught up in kernel madness. Today’s Tedium explains IBM’s odd operating system fixation, and the belly flops it created.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.synacktiv.com/ressources/Synacktiv_OpenBSD_PacketFilter_CVE-2019-5597_ipv6_frag.pdf"&gt;CVE-2019-5597IPv6 fragmentation vulnerability in OpenBSD Packet Filter&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Packet Filter is OpenBSD’s  service for filtering network traffic and performing Network Address Translation. Packet Filter is also capable of normalizing and conditioning TCP/IP traffic, as well as providing bandwidth control and packet prioritization.&lt;br&gt;
Packet Filter has been a part of the GENERIC kernel since OpenBSD 5.0.Because other BSD variants import part of OpenBSD code, Packet Filter is also shipped with at least the following distributions that are affected in a lesser extent:  FreeBSD, pfSense, OPNSense, Solaris.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Note that other distributions may also contain Packet Filter but due to the imported version they might not be vulnerable. This advisory covers the latest OpenBSD’s Packet Filter. For specific details about other distributions, please refer to the advisory of the affected product.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Kristof Provost, who maintains the port of pf in FreeBSD added a &lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=344793"&gt;test for the vulnerability in FreeBSD head&lt;/a&gt;.&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://www.lucasfcosta.com/2019/02/10/terminal-guide-2019.html"&gt;How I’m still not using GUIs in 2019: A guide to the terminal&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;TL;DR: Here are my dotfiles. Use them and have fun.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;GUIs are bloatware. I’ve said it before. However, rather than just complaining about IDEs I’d like to provide an understandable guide to a much better alternative: the terminal.&lt;br&gt;
IDE stands for Integrated Development Environment. This might be an accurate term, but when it comes to a real integrated development environment, the terminal is a lot better.&lt;br&gt;
In this post, I’ll walk you through everything you need to start making your terminal a complete development environment: how to edit text efficiently, configure its appearance, run and combine a myriad of programs, and dynamically create, resize and close tabs and windows.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Don’t forget rule number one.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Whenever in doubt, read the manual.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://undeadly.org/cgi?action=article;sid=20190302235509"&gt;Using a Yubikey as smartcard for SSH public key authentication&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;SSH is an awesome tool. Logging into other machines securely is so pervasive to us sysadmins nowadays that few of us think about what’s going on underneath. Even more so once you start using the more advanced features such as the ssh-agent, agent-forwarding and ProxyJump. When doing so, care must be taken in order to not compromise one’s logins or ssh keys.&lt;br&gt;
You might have heard of Yubikeys.&lt;br&gt;
These are USB authentication devices that support several different modes: they can be used for OTP (One Time Password) authentication, they can store OpenPGP keys, be a 2-factor authentication token and they can act as a SmartCard.&lt;br&gt;
In OpenBSD, you can use them for Login (with loginyubikey(8)) with OTP since 2012, and there are many descriptions available(1) how to set this up.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###The 18 Part FreeBSD Desktop Series by Vermaden&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/03/29/freebsd-desktop-part-1-simplified-boot/"&gt;FreeBSD Desktop – Part 1 – Simplified Boot&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/04/11/freebsd-desktop-part-2-install/"&gt;FreeBSD Desktop – Part 2 – Install (FreeBSD 11)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/11/20/freebsd-desktop-part-2-1-install-freebsd-12/"&gt;FreeBSD Desktop – Part 2.1 – Install FreeBSD 12&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/05/22/freebsd-desktop-part-3-x11-window-system/"&gt;FreeBSD Desktop – Part 3 – X11 Window System&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/06/15/freebsd-desktop-part-4-key-components-window-manager/"&gt;FreeBSD Desktop – Part 4 – Key Components – Window Manager&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/06/16/freebsd-desktop-part-5-key-components-status-bar/"&gt;FreeBSD Desktop – Part 5 – Key Components – Status Bar&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-6-key-components-task-bar/"&gt;FreeBSD Desktop – Part 6 – Key Components – Task Bar&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-7-key-components-wallpaper-handling/"&gt;FreeBSD Desktop – Part 7 – Key Components – Wallpaper Handling&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-8-key-components-application-launcher/"&gt;FreeBSD Desktop – Part 8 – Key Components – Application Launcher&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/06/22/freebsd-desktop-part-9-key-components-keyboard-mouse-shortcuts/"&gt;FreeBSD Desktop – Part 9 – Key Components – Keyboard/Mouse Shortcuts&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/06/23/freebsd-desktop-part-10-key-components-locking-solution/"&gt;FreeBSD Desktop – Part 10 – Key Components – Locking Solution&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/06/28/freebsd-desktop-part-11-key-components-blue-light-spectrum-suppress/"&gt;FreeBSD Desktop – Part 11 – Key Components – Blue Light Spectrum Suppress&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/07/01/freebsd-desktop-part-12-configuration-openbox/"&gt;FreeBSD Desktop – Part 12 – Configuration – Openbox&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/07/05/freebsd-desktop-part-13-configuration-dzen2/"&gt;FreeBSD Desktop – Part 13 – Configuration – Dzen2&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/07/11/freebsd-desktop-part-14-configuration-tint2/"&gt;FreeBSD Desktop – Part 14 – Configuration – Tint2&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/08/18/freebsd-desktop-part-15-configuration-fonts-frameworks/"&gt;FreeBSD Desktop – Part 15 – Configuration – Fonts &amp;amp; Frameworks&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/09/19/freebsd-desktop-part-16-configuration-pause-any-application/"&gt;FreeBSD Desktop – Part 16 – Configuration – Pause Any Application&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/10/11/freebsd-desktop-part-17-automount-removable-media/"&gt;FreeBSD Desktop – Part 17 – Automount Removable Media&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://dataswamp.org/~solene/2019-02-18-drist-1.04.html"&gt;Drist with persistent SSH&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://meetings.aaas.org/arpanet-livestream/"&gt;ARPANET: Celebrating 50 Years Since “LO”&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://nuclear.mutantstargoat.com/sw/termtris/"&gt;Termtris - a tetris game for ANSI/VT220 terminals&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/billziss-gh/pmci"&gt;Poor Man’s CI - Hosted CI for BSD with shell scripting and duct tape&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://yeokhengmeng.com/2018/07/why-i-use-the-ibm-model-m-keyboard-that-is-older-than-me/"&gt;Why I use the IBM Model M keyboard that is older than me?&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.openbsd.org/papers/florianslaacd_bsdcan2018.pdf"&gt;A privilege separated and sandboxed IPv6 Stateless Address AutoConfiguration Daemon&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://niftylettuce.com/posts/google-free-android-setup/#google-free-android-setup"&gt;Google-free Android Setup&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/BSD-Users-Stockholm/events/259528492/"&gt;BSD Users Stockholm Meetup #6&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Sijmen - &lt;a href="http://dpaste.com/1K3ZXB2#wrap"&gt;Hi, and a Sunday afternoon toy project&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Clint - &lt;a href="http://dpaste.com/24QF6J1"&gt;Tuning ZFS for NVME&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;James - &lt;a href="http://dpaste.com/04SDXH9"&gt;Show question&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A kernel of failure, IPv6 fragmentation vulnerability in OpenBSD’s pf, a guide to the terminal, using a Yubikey for SSH public key authentication, FreeBSD desktop series, and more. </p>

<p>##Headlines</p>

<p>###<a href="https://tedium.co/2019/02/28/ibm-workplace-os-taligent-history/">A Kernel Of Failure -<br>
How IBM bet big on the microkernel being the next big thing in operating systems back in the ’90s—and spent billions with little to show for it.</a></p>

<blockquote>
<p>Today in Tedium: In the early 1990s, we had no idea where the computer industry was going, what the next generation would look like, or even what the driving factor would be. All the developers back then knew is that the operating systems available in server rooms or on desktop computers simply weren’t good enough, and that the next generation needed to be better—a lot better. This was easier said than done, but this problem for some reason seemed to rack the brains of one company more than any other: IBM. Throughout the decade, the company was associated with more overwrought thinking about operating systems than any other, with little to show for it in the end. The problem? It might have gotten caught up in kernel madness. Today’s Tedium explains IBM’s odd operating system fixation, and the belly flops it created.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.synacktiv.com/ressources/Synacktiv_OpenBSD_PacketFilter_CVE-2019-5597_ipv6_frag.pdf">CVE-2019-5597IPv6 fragmentation vulnerability in OpenBSD Packet Filter</a></p>

<blockquote>
<p>Packet Filter is OpenBSD’s  service for filtering network traffic and performing Network Address Translation. Packet Filter is also capable of normalizing and conditioning TCP/IP traffic, as well as providing bandwidth control and packet prioritization.<br>
Packet Filter has been a part of the GENERIC kernel since OpenBSD 5.0.Because other BSD variants import part of OpenBSD code, Packet Filter is also shipped with at least the following distributions that are affected in a lesser extent:  FreeBSD, pfSense, OPNSense, Solaris.</p>
</blockquote>

<blockquote>
<p>Note that other distributions may also contain Packet Filter but due to the imported version they might not be vulnerable. This advisory covers the latest OpenBSD’s Packet Filter. For specific details about other distributions, please refer to the advisory of the affected product.</p>
</blockquote>

<ul>
<li>Kristof Provost, who maintains the port of pf in FreeBSD added a <a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=344793">test for the vulnerability in FreeBSD head</a>.</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://www.lucasfcosta.com/2019/02/10/terminal-guide-2019.html">How I’m still not using GUIs in 2019: A guide to the terminal</a></p>

<blockquote>
<p>TL;DR: Here are my dotfiles. Use them and have fun.</p>
</blockquote>

<blockquote>
<p>GUIs are bloatware. I’ve said it before. However, rather than just complaining about IDEs I’d like to provide an understandable guide to a much better alternative: the terminal.<br>
IDE stands for Integrated Development Environment. This might be an accurate term, but when it comes to a real integrated development environment, the terminal is a lot better.<br>
In this post, I’ll walk you through everything you need to start making your terminal a complete development environment: how to edit text efficiently, configure its appearance, run and combine a myriad of programs, and dynamically create, resize and close tabs and windows.</p>
</blockquote>

<ul>
<li>Don’t forget rule number one.</li>
</ul>

<blockquote>
<p>Whenever in doubt, read the manual.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://undeadly.org/cgi?action=article;sid=20190302235509">Using a Yubikey as smartcard for SSH public key authentication</a></p>

<blockquote>
<p>SSH is an awesome tool. Logging into other machines securely is so pervasive to us sysadmins nowadays that few of us think about what’s going on underneath. Even more so once you start using the more advanced features such as the ssh-agent, agent-forwarding and ProxyJump. When doing so, care must be taken in order to not compromise one’s logins or ssh keys.<br>
You might have heard of Yubikeys.<br>
These are USB authentication devices that support several different modes: they can be used for OTP (One Time Password) authentication, they can store OpenPGP keys, be a 2-factor authentication token and they can act as a SmartCard.<br>
In OpenBSD, you can use them for Login (with login_yubikey(8)) with OTP since 2012, and there are many descriptions available(1) how to set this up.</p>
</blockquote>

<p><hr></p>

<p>###The 18 Part FreeBSD Desktop Series by Vermaden</p>

<ul>
<li><a href="https://vermaden.wordpress.com/2018/03/29/freebsd-desktop-part-1-simplified-boot/">FreeBSD Desktop – Part 1 – Simplified Boot</a></li>
<li><a href="https://vermaden.wordpress.com/2018/04/11/freebsd-desktop-part-2-install/">FreeBSD Desktop – Part 2 – Install (FreeBSD 11)</a></li>
<li><a href="https://vermaden.wordpress.com/2018/11/20/freebsd-desktop-part-2-1-install-freebsd-12/">FreeBSD Desktop – Part 2.1 – Install FreeBSD 12</a></li>
<li><a href="https://vermaden.wordpress.com/2018/05/22/freebsd-desktop-part-3-x11-window-system/">FreeBSD Desktop – Part 3 – X11 Window System</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/15/freebsd-desktop-part-4-key-components-window-manager/">FreeBSD Desktop – Part 4 – Key Components – Window Manager</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/16/freebsd-desktop-part-5-key-components-status-bar/">FreeBSD Desktop – Part 5 – Key Components – Status Bar</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-6-key-components-task-bar/">FreeBSD Desktop – Part 6 – Key Components – Task Bar</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-7-key-components-wallpaper-handling/">FreeBSD Desktop – Part 7 – Key Components – Wallpaper Handling</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-8-key-components-application-launcher/">FreeBSD Desktop – Part 8 – Key Components – Application Launcher</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/22/freebsd-desktop-part-9-key-components-keyboard-mouse-shortcuts/">FreeBSD Desktop – Part 9 – Key Components – Keyboard/Mouse Shortcuts</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/23/freebsd-desktop-part-10-key-components-locking-solution/">FreeBSD Desktop – Part 10 – Key Components – Locking Solution</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/28/freebsd-desktop-part-11-key-components-blue-light-spectrum-suppress/">FreeBSD Desktop – Part 11 – Key Components – Blue Light Spectrum Suppress</a></li>
<li><a href="https://vermaden.wordpress.com/2018/07/01/freebsd-desktop-part-12-configuration-openbox/">FreeBSD Desktop – Part 12 – Configuration – Openbox</a></li>
<li><a href="https://vermaden.wordpress.com/2018/07/05/freebsd-desktop-part-13-configuration-dzen2/">FreeBSD Desktop – Part 13 – Configuration – Dzen2</a></li>
<li><a href="https://vermaden.wordpress.com/2018/07/11/freebsd-desktop-part-14-configuration-tint2/">FreeBSD Desktop – Part 14 – Configuration – Tint2</a></li>
<li><a href="https://vermaden.wordpress.com/2018/08/18/freebsd-desktop-part-15-configuration-fonts-frameworks/">FreeBSD Desktop – Part 15 – Configuration – Fonts &amp; Frameworks</a></li>
<li><a href="https://vermaden.wordpress.com/2018/09/19/freebsd-desktop-part-16-configuration-pause-any-application/">FreeBSD Desktop – Part 16 – Configuration – Pause Any Application</a></li>
<li><a href="https://vermaden.wordpress.com/2018/10/11/freebsd-desktop-part-17-automount-removable-media/">FreeBSD Desktop – Part 17 – Automount Removable Media</a></li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://dataswamp.org/~solene/2019-02-18-drist-1.04.html">Drist with persistent SSH</a></li>
<li><a href="https://meetings.aaas.org/arpanet-livestream/">ARPANET: Celebrating 50 Years Since “LO”</a></li>
<li><a href="http://nuclear.mutantstargoat.com/sw/termtris/">Termtris - a tetris game for ANSI/VT220 terminals</a></li>
<li><a href="https://github.com/billziss-gh/pmci">Poor Man’s CI - Hosted CI for BSD with shell scripting and duct tape</a></li>
<li><a href="http://yeokhengmeng.com/2018/07/why-i-use-the-ibm-model-m-keyboard-that-is-older-than-me/">Why I use the IBM Model M keyboard that is older than me?</a></li>
<li><a href="https://www.openbsd.org/papers/florian_slaacd_bsdcan2018.pdf">A privilege separated and sandboxed IPv6 Stateless Address AutoConfiguration Daemon</a></li>
<li><a href="https://niftylettuce.com/posts/google-free-android-setup/#google-free-android-setup">Google-free Android Setup</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/259528492/">BSD Users Stockholm Meetup #6</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Sijmen - <a href="http://dpaste.com/1K3ZXB2#wrap">Hi, and a Sunday afternoon toy project</a></li>
<li>Clint - <a href="http://dpaste.com/24QF6J1">Tuning ZFS for NVME</a></li>
<li>James - <a href="http://dpaste.com/04SDXH9">Show question</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0289.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A kernel of failure, IPv6 fragmentation vulnerability in OpenBSD’s pf, a guide to the terminal, using a Yubikey for SSH public key authentication, FreeBSD desktop series, and more. </p>

<p>##Headlines</p>

<p>###<a href="https://tedium.co/2019/02/28/ibm-workplace-os-taligent-history/">A Kernel Of Failure -<br>
How IBM bet big on the microkernel being the next big thing in operating systems back in the ’90s—and spent billions with little to show for it.</a></p>

<blockquote>
<p>Today in Tedium: In the early 1990s, we had no idea where the computer industry was going, what the next generation would look like, or even what the driving factor would be. All the developers back then knew is that the operating systems available in server rooms or on desktop computers simply weren’t good enough, and that the next generation needed to be better—a lot better. This was easier said than done, but this problem for some reason seemed to rack the brains of one company more than any other: IBM. Throughout the decade, the company was associated with more overwrought thinking about operating systems than any other, with little to show for it in the end. The problem? It might have gotten caught up in kernel madness. Today’s Tedium explains IBM’s odd operating system fixation, and the belly flops it created.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.synacktiv.com/ressources/Synacktiv_OpenBSD_PacketFilter_CVE-2019-5597_ipv6_frag.pdf">CVE-2019-5597IPv6 fragmentation vulnerability in OpenBSD Packet Filter</a></p>

<blockquote>
<p>Packet Filter is OpenBSD’s  service for filtering network traffic and performing Network Address Translation. Packet Filter is also capable of normalizing and conditioning TCP/IP traffic, as well as providing bandwidth control and packet prioritization.<br>
Packet Filter has been a part of the GENERIC kernel since OpenBSD 5.0.Because other BSD variants import part of OpenBSD code, Packet Filter is also shipped with at least the following distributions that are affected in a lesser extent:  FreeBSD, pfSense, OPNSense, Solaris.</p>
</blockquote>

<blockquote>
<p>Note that other distributions may also contain Packet Filter but due to the imported version they might not be vulnerable. This advisory covers the latest OpenBSD’s Packet Filter. For specific details about other distributions, please refer to the advisory of the affected product.</p>
</blockquote>

<ul>
<li>Kristof Provost, who maintains the port of pf in FreeBSD added a <a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=344793">test for the vulnerability in FreeBSD head</a>.</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://www.lucasfcosta.com/2019/02/10/terminal-guide-2019.html">How I’m still not using GUIs in 2019: A guide to the terminal</a></p>

<blockquote>
<p>TL;DR: Here are my dotfiles. Use them and have fun.</p>
</blockquote>

<blockquote>
<p>GUIs are bloatware. I’ve said it before. However, rather than just complaining about IDEs I’d like to provide an understandable guide to a much better alternative: the terminal.<br>
IDE stands for Integrated Development Environment. This might be an accurate term, but when it comes to a real integrated development environment, the terminal is a lot better.<br>
In this post, I’ll walk you through everything you need to start making your terminal a complete development environment: how to edit text efficiently, configure its appearance, run and combine a myriad of programs, and dynamically create, resize and close tabs and windows.</p>
</blockquote>

<ul>
<li>Don’t forget rule number one.</li>
</ul>

<blockquote>
<p>Whenever in doubt, read the manual.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://undeadly.org/cgi?action=article;sid=20190302235509">Using a Yubikey as smartcard for SSH public key authentication</a></p>

<blockquote>
<p>SSH is an awesome tool. Logging into other machines securely is so pervasive to us sysadmins nowadays that few of us think about what’s going on underneath. Even more so once you start using the more advanced features such as the ssh-agent, agent-forwarding and ProxyJump. When doing so, care must be taken in order to not compromise one’s logins or ssh keys.<br>
You might have heard of Yubikeys.<br>
These are USB authentication devices that support several different modes: they can be used for OTP (One Time Password) authentication, they can store OpenPGP keys, be a 2-factor authentication token and they can act as a SmartCard.<br>
In OpenBSD, you can use them for Login (with login_yubikey(8)) with OTP since 2012, and there are many descriptions available(1) how to set this up.</p>
</blockquote>

<p><hr></p>

<p>###The 18 Part FreeBSD Desktop Series by Vermaden</p>

<ul>
<li><a href="https://vermaden.wordpress.com/2018/03/29/freebsd-desktop-part-1-simplified-boot/">FreeBSD Desktop – Part 1 – Simplified Boot</a></li>
<li><a href="https://vermaden.wordpress.com/2018/04/11/freebsd-desktop-part-2-install/">FreeBSD Desktop – Part 2 – Install (FreeBSD 11)</a></li>
<li><a href="https://vermaden.wordpress.com/2018/11/20/freebsd-desktop-part-2-1-install-freebsd-12/">FreeBSD Desktop – Part 2.1 – Install FreeBSD 12</a></li>
<li><a href="https://vermaden.wordpress.com/2018/05/22/freebsd-desktop-part-3-x11-window-system/">FreeBSD Desktop – Part 3 – X11 Window System</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/15/freebsd-desktop-part-4-key-components-window-manager/">FreeBSD Desktop – Part 4 – Key Components – Window Manager</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/16/freebsd-desktop-part-5-key-components-status-bar/">FreeBSD Desktop – Part 5 – Key Components – Status Bar</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-6-key-components-task-bar/">FreeBSD Desktop – Part 6 – Key Components – Task Bar</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-7-key-components-wallpaper-handling/">FreeBSD Desktop – Part 7 – Key Components – Wallpaper Handling</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-8-key-components-application-launcher/">FreeBSD Desktop – Part 8 – Key Components – Application Launcher</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/22/freebsd-desktop-part-9-key-components-keyboard-mouse-shortcuts/">FreeBSD Desktop – Part 9 – Key Components – Keyboard/Mouse Shortcuts</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/23/freebsd-desktop-part-10-key-components-locking-solution/">FreeBSD Desktop – Part 10 – Key Components – Locking Solution</a></li>
<li><a href="https://vermaden.wordpress.com/2018/06/28/freebsd-desktop-part-11-key-components-blue-light-spectrum-suppress/">FreeBSD Desktop – Part 11 – Key Components – Blue Light Spectrum Suppress</a></li>
<li><a href="https://vermaden.wordpress.com/2018/07/01/freebsd-desktop-part-12-configuration-openbox/">FreeBSD Desktop – Part 12 – Configuration – Openbox</a></li>
<li><a href="https://vermaden.wordpress.com/2018/07/05/freebsd-desktop-part-13-configuration-dzen2/">FreeBSD Desktop – Part 13 – Configuration – Dzen2</a></li>
<li><a href="https://vermaden.wordpress.com/2018/07/11/freebsd-desktop-part-14-configuration-tint2/">FreeBSD Desktop – Part 14 – Configuration – Tint2</a></li>
<li><a href="https://vermaden.wordpress.com/2018/08/18/freebsd-desktop-part-15-configuration-fonts-frameworks/">FreeBSD Desktop – Part 15 – Configuration – Fonts &amp; Frameworks</a></li>
<li><a href="https://vermaden.wordpress.com/2018/09/19/freebsd-desktop-part-16-configuration-pause-any-application/">FreeBSD Desktop – Part 16 – Configuration – Pause Any Application</a></li>
<li><a href="https://vermaden.wordpress.com/2018/10/11/freebsd-desktop-part-17-automount-removable-media/">FreeBSD Desktop – Part 17 – Automount Removable Media</a></li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://dataswamp.org/~solene/2019-02-18-drist-1.04.html">Drist with persistent SSH</a></li>
<li><a href="https://meetings.aaas.org/arpanet-livestream/">ARPANET: Celebrating 50 Years Since “LO”</a></li>
<li><a href="http://nuclear.mutantstargoat.com/sw/termtris/">Termtris - a tetris game for ANSI/VT220 terminals</a></li>
<li><a href="https://github.com/billziss-gh/pmci">Poor Man’s CI - Hosted CI for BSD with shell scripting and duct tape</a></li>
<li><a href="http://yeokhengmeng.com/2018/07/why-i-use-the-ibm-model-m-keyboard-that-is-older-than-me/">Why I use the IBM Model M keyboard that is older than me?</a></li>
<li><a href="https://www.openbsd.org/papers/florian_slaacd_bsdcan2018.pdf">A privilege separated and sandboxed IPv6 Stateless Address AutoConfiguration Daemon</a></li>
<li><a href="https://niftylettuce.com/posts/google-free-android-setup/#google-free-android-setup">Google-free Android Setup</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/259528492/">BSD Users Stockholm Meetup #6</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Sijmen - <a href="http://dpaste.com/1K3ZXB2#wrap">Hi, and a Sunday afternoon toy project</a></li>
<li>Clint - <a href="http://dpaste.com/24QF6J1">Tuning ZFS for NVME</a></li>
<li>James - <a href="http://dpaste.com/04SDXH9">Show question</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0289.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>288: Turing Complete Sed</title>
  <link>https://www.bsdnow.tv/288</link>
  <guid isPermaLink="false">be2ff33e-e797-4fb6-9448-c715d7068e66</guid>
  <pubDate>Thu, 07 Mar 2019 10:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/be2ff33e-e797-4fb6-9448-c715d7068e66.mp3" length="35693457" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Software will never fix Spectre-type bugs, a proof that sed is Turing complete, managed jails using Bastille, new version of netdata, using grep with /dev/null, using GMail with mutt, and more.</itunes:subtitle>
  <itunes:duration>59:10</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Software will never fix Spectre-type bugs, a proof that sed is Turing complete, managed jails using Bastille, new version of netdata, using grep with /dev/null, using GMail with mutt, and more.
&lt;p&gt;##Headlines&lt;br&gt;
###&lt;a href="https://arstechnica.com/gadgets/2019/02/google-software-is-never-going-to-be-able-to-fix-spectre-type-bugs/"&gt;Google: Software is never going to be able to fix Spectre-type bugs&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://arxiv.org/pdf/1902.05178.pdf"&gt;Spectre is here to stay: An analysis of side-channels and speculative execution&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Researchers from Google investigating the scope and impact of the Spectre attack have published a paper asserting that Spectre-like vulnerabilities are likely to be a continued feature of processors and, further, that software-based techniques for protecting against them will impose a high performance cost. And whatever the cost, the researchers continue, the software will be inadequate—some Spectre flaws don’t appear to have any effective software-based defense. As such, Spectre is going to be a continued feature of the computing landscape, with no straightforward resolution.&lt;br&gt;
The discovery and development of the Meltdown and Spectre attacks was undoubtedly the big security story of 2018. First revealed last January, new variants and related discoveries were made throughout the rest of the year. Both attacks rely on discrepancies between the theoretical architectural behavior of a processor—the documented behavior that programmers depend on and write their programs against—and the real behavior of implementations.&lt;br&gt;
Specifically, modern processors all perform speculative execution; they make assumptions about, for example, a value being read from memory or whether an if condition is true or false, and they allow their execution to run ahead based on these assumptions. If the assumptions are correct, the speculated results are kept; if it isn’t, the speculated results are discarded and the processor redoes the calculation. Speculative execution is not an architectural feature of the processor; it’s a feature of implementations, and so it’s supposed to be entirely invisible to running programs. When the processor discards the bad speculation, it should be as if the speculation never even happened.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://catonmat.net/proof-that-sed-is-turing-complete"&gt;A proof that Unix utility sed is Turing complete&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Many people are surprised when they hear that sed is Turing complete. How come a text filtering program is Turing complete, they wonder. Turns out sed is a tiny assembly language that has a comparison operation, a branching operation and a temporary buffer. These operations make sed Turing complete.&lt;br&gt;
I first learned about this from Christophe Blaess. His proof is by construction – he wrote a Turing machine in sed (download turing.sed). As any programming language that can implement a Turing machine is Turing complete we must conclude that sed is also Turing complete.&lt;br&gt;
Christophe offers his own introduction to Turing machines and a description of how his sed implementation works in his article Implementation of a Turing Machine as a sed Script.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Christophe isn’t the first person to realize that sed is almost a general purpose programming language. People have written tetris, sokoban and many other programs in sed. Take a look at these:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://catonmat.net/ftp/sed/sedtris.sed"&gt;Tetris&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://catonmat.net/ftp/sed/sokoban.sed"&gt;Sokoban (game)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://catonmat.net/ftp/sed/dc.sed"&gt;Calculator&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://bastillebsd.org/"&gt;Bastille helps you quickly create and manage FreeBSD Jails.&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Bastille helps you quickly create and manage FreeBSD Jails.&lt;br&gt;
Jails are extremely lightweight containers that provide a full-featured UNIX-like operating system inside. These containers can be used for software development, rapid testing, and secure production Internet services.&lt;br&gt;
Bastille provides an interface to create, manage and destroy these secure virtualized environments.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Current version: 0.3.20190204-beta.&lt;/li&gt;
&lt;li&gt;Shell Script Source here: &lt;a href="https://github.com/BastilleBSD/bastille/blob/master/usr/local/bin/bastille"&gt;https://github.com/BastilleBSD/bastille/blob/master/usr/local/bin/bastille&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://github.com/netdata/netdata/releases"&gt;netdata v1.12 released&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Netdata is distributed, real-time, performance and health monitoring for systems and applications. It is a highly optimized monitoring agent you install on all your systems and containers.&lt;br&gt;
Netdata provides unparalleled insights, in real-time, of everything happening on the systems it runs (including web servers, databases, applications), using highly interactive web dashboards. It can run autonomously, without any third party components, or it can be integrated to existing monitoring tool chains (Prometheus, Graphite, OpenTSDB, Kafka, Grafana, etc).&lt;br&gt;
Netdata is fast and efficient, designed to permanently run on all systems (physical &amp;amp; virtual servers, containers, IoT devices), without disrupting their core function.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Patch release 1.12.1 contains 22 bug fixes and 8 improvements.&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/unix/GrepDevNull"&gt;Using grep with /dev/null, an old Unix trick&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Every so often I will find myself writing a grep invocation like this:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;find .... -exec grep &amp;lt;something&amp;gt; /dev/null '{}' '+'&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The peculiar presence of /dev/null here is an old Unix trick that is designed to force grep to always print out file names, even if your find only matches one file, by always insuring that grep has at least two files as arguments. You can wind up wanting to do the same thing with a direct use of grep if you’re not certain how many files your wildcard may match.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://smalldata.tech/blog/2016/09/10/gmail-with-mutt"&gt;USING GMAIL WITH MUTT&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I recently switched to using mutt for email and while setting up mutt to use imap is pretty straightforward, this tutorial will also document some advanced concepts such as encrypting your account password and sending emails from a different From address.&lt;br&gt;
This tutorial assumes that you have some familiarity with using mutt and have installed it with sidebar support (sudo apt-get install mutt-patched for the ubuntu folks) and are comfortable with editing your muttrc.&lt;br&gt;
If you would just like to skip to the end, my mutt configuration file can be found &lt;a href="https://github.com/wheresvic/vic-config/blob/master/mutt/muttrc"&gt;here&lt;/a&gt;.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.levenez.com/unix/"&gt;An Extensive UNIX Timeline&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://garbage.fm/episodes/47"&gt;Garbage.fm - OEF&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.dragonflydigest.com/2019/02/22/22586.html"&gt;brk() to sbrk()&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.dragonflydigest.com/2019/02/20/22566.html"&gt;Fred models, found again&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://ieeexplore.ieee.org/document/8541105"&gt;Kafe: Can OS Kernels Forward Packets Fast Enough for Software Routers?&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://meetings.aaas.org/arpanet-livestream/"&gt;ARPANET: Celebrating 50 Years Since “LO”&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Pablo - &lt;a href="http://dpaste.com/2BXMP7M"&gt;Topic suggestion: FreeBSD on a Laptop as daily driver&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Ron - &lt;a href="http://dpaste.com/16Y2HSR#wrap"&gt;ZFS on the fly compression and seek&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Dave - &lt;a href="http://dpaste.com/123AANV#wrap"&gt;two zpool, or not two zpool, that is the question&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.

</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Software will never fix Spectre-type bugs, a proof that sed is Turing complete, managed jails using Bastille, new version of netdata, using grep with /dev/null, using GMail with mutt, and more.</p>

<p>##Headlines<br>
###<a href="https://arstechnica.com/gadgets/2019/02/google-software-is-never-going-to-be-able-to-fix-spectre-type-bugs/">Google: Software is never going to be able to fix Spectre-type bugs</a></p>

<ul>
<li><a href="https://arxiv.org/pdf/1902.05178.pdf">Spectre is here to stay: An analysis of side-channels and speculative execution</a></li>
</ul>

<blockquote>
<p>Researchers from Google investigating the scope and impact of the Spectre attack have published a paper asserting that Spectre-like vulnerabilities are likely to be a continued feature of processors and, further, that software-based techniques for protecting against them will impose a high performance cost. And whatever the cost, the researchers continue, the software will be inadequate—some Spectre flaws don’t appear to have any effective software-based defense. As such, Spectre is going to be a continued feature of the computing landscape, with no straightforward resolution.<br>
The discovery and development of the Meltdown and Spectre attacks was undoubtedly the big security story of 2018. First revealed last January, new variants and related discoveries were made throughout the rest of the year. Both attacks rely on discrepancies between the theoretical architectural behavior of a processor—the documented behavior that programmers depend on and write their programs against—and the real behavior of implementations.<br>
Specifically, modern processors all perform speculative execution; they make assumptions about, for example, a value being read from memory or whether an if condition is true or false, and they allow their execution to run ahead based on these assumptions. If the assumptions are correct, the speculated results are kept; if it isn’t, the speculated results are discarded and the processor redoes the calculation. Speculative execution is not an architectural feature of the processor; it’s a feature of implementations, and so it’s supposed to be entirely invisible to running programs. When the processor discards the bad speculation, it should be as if the speculation never even happened.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://catonmat.net/proof-that-sed-is-turing-complete">A proof that Unix utility sed is Turing complete</a></p>

<blockquote>
<p>Many people are surprised when they hear that sed is Turing complete. How come a text filtering program is Turing complete, they wonder. Turns out sed is a tiny assembly language that has a comparison operation, a branching operation and a temporary buffer. These operations make sed Turing complete.<br>
I first learned about this from Christophe Blaess. His proof is by construction – he wrote a Turing machine in sed (download turing.sed). As any programming language that can implement a Turing machine is Turing complete we must conclude that sed is also Turing complete.<br>
Christophe offers his own introduction to Turing machines and a description of how his sed implementation works in his article Implementation of a Turing Machine as a sed Script.</p>
</blockquote>

<blockquote>
<p>Christophe isn’t the first person to realize that sed is almost a general purpose programming language. People have written tetris, sokoban and many other programs in sed. Take a look at these:</p>
</blockquote>

<ul>
<li><a href="https://catonmat.net/ftp/sed/sedtris.sed">Tetris</a></li>
<li><a href="https://catonmat.net/ftp/sed/sokoban.sed">Sokoban (game)</a></li>
<li><a href="https://catonmat.net/ftp/sed/dc.sed">Calculator</a></li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://bastillebsd.org/">Bastille helps you quickly create and manage FreeBSD Jails.</a></p>

<blockquote>
<p>Bastille helps you quickly create and manage FreeBSD Jails.<br>
Jails are extremely lightweight containers that provide a full-featured UNIX-like operating system inside. These containers can be used for software development, rapid testing, and secure production Internet services.<br>
Bastille provides an interface to create, manage and destroy these secure virtualized environments.</p>
</blockquote>

<ul>
<li>Current version: 0.3.20190204-beta.</li>
<li>Shell Script Source here: <a href="https://github.com/BastilleBSD/bastille/blob/master/usr/local/bin/bastille">https://github.com/BastilleBSD/bastille/blob/master/usr/local/bin/bastille</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://github.com/netdata/netdata/releases">netdata v1.12 released</a></p>

<blockquote>
<p>Netdata is distributed, real-time, performance and health monitoring for systems and applications. It is a highly optimized monitoring agent you install on all your systems and containers.<br>
Netdata provides unparalleled insights, in real-time, of everything happening on the systems it runs (including web servers, databases, applications), using highly interactive web dashboards. It can run autonomously, without any third party components, or it can be integrated to existing monitoring tool chains (Prometheus, Graphite, OpenTSDB, Kafka, Grafana, etc).<br>
Netdata is fast and efficient, designed to permanently run on all systems (physical &amp; virtual servers, containers, IoT devices), without disrupting their core function.</p>
</blockquote>

<ul>
<li>Patch release 1.12.1 contains 22 bug fixes and 8 improvements.</li>
</ul>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/unix/GrepDevNull">Using grep with /dev/null, an old Unix trick</a></p>

<blockquote>
<p>Every so often I will find myself writing a grep invocation like this:</p>
</blockquote>

<p><code>find .... -exec grep &lt;something&gt; /dev/null '{}' '+'</code></p>

<blockquote>
<p>The peculiar presence of /dev/null here is an old Unix trick that is designed to force grep to always print out file names, even if your find only matches one file, by always insuring that grep has at least two files as arguments. You can wind up wanting to do the same thing with a direct use of grep if you’re not certain how many files your wildcard may match.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://smalldata.tech/blog/2016/09/10/gmail-with-mutt">USING GMAIL WITH MUTT</a></p>

<blockquote>
<p>I recently switched to using mutt for email and while setting up mutt to use imap is pretty straightforward, this tutorial will also document some advanced concepts such as encrypting your account password and sending emails from a different From address.<br>
This tutorial assumes that you have some familiarity with using mutt and have installed it with sidebar support (sudo apt-get install mutt-patched for the ubuntu folks) and are comfortable with editing your muttrc.<br>
If you would just like to skip to the end, my mutt configuration file can be found <a href="https://github.com/wheresvic/vic-config/blob/master/mutt/muttrc">here</a>.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.levenez.com/unix/">An Extensive UNIX Timeline</a></li>
<li><a href="https://garbage.fm/episodes/47">Garbage.fm - OEF</a></li>
<li><a href="https://www.dragonflydigest.com/2019/02/22/22586.html">brk() to sbrk()</a></li>
<li><a href="https://www.dragonflydigest.com/2019/02/20/22566.html">Fred models, found again</a></li>
<li><a href="https://ieeexplore.ieee.org/document/8541105">Kafe: Can OS Kernels Forward Packets Fast Enough for Software Routers?</a></li>
<li><a href="https://meetings.aaas.org/arpanet-livestream/">ARPANET: Celebrating 50 Years Since “LO”</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Pablo - <a href="http://dpaste.com/2BXMP7M">Topic suggestion: FreeBSD on a Laptop as daily driver</a></li>
<li>Ron - <a href="http://dpaste.com/16Y2HSR#wrap">ZFS on the fly compression and seek</a></li>
<li>Dave - <a href="http://dpaste.com/123AANV#wrap">two zpool, or not two zpool, that is the question</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0288.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Software will never fix Spectre-type bugs, a proof that sed is Turing complete, managed jails using Bastille, new version of netdata, using grep with /dev/null, using GMail with mutt, and more.</p>

<p>##Headlines<br>
###<a href="https://arstechnica.com/gadgets/2019/02/google-software-is-never-going-to-be-able-to-fix-spectre-type-bugs/">Google: Software is never going to be able to fix Spectre-type bugs</a></p>

<ul>
<li><a href="https://arxiv.org/pdf/1902.05178.pdf">Spectre is here to stay: An analysis of side-channels and speculative execution</a></li>
</ul>

<blockquote>
<p>Researchers from Google investigating the scope and impact of the Spectre attack have published a paper asserting that Spectre-like vulnerabilities are likely to be a continued feature of processors and, further, that software-based techniques for protecting against them will impose a high performance cost. And whatever the cost, the researchers continue, the software will be inadequate—some Spectre flaws don’t appear to have any effective software-based defense. As such, Spectre is going to be a continued feature of the computing landscape, with no straightforward resolution.<br>
The discovery and development of the Meltdown and Spectre attacks was undoubtedly the big security story of 2018. First revealed last January, new variants and related discoveries were made throughout the rest of the year. Both attacks rely on discrepancies between the theoretical architectural behavior of a processor—the documented behavior that programmers depend on and write their programs against—and the real behavior of implementations.<br>
Specifically, modern processors all perform speculative execution; they make assumptions about, for example, a value being read from memory or whether an if condition is true or false, and they allow their execution to run ahead based on these assumptions. If the assumptions are correct, the speculated results are kept; if it isn’t, the speculated results are discarded and the processor redoes the calculation. Speculative execution is not an architectural feature of the processor; it’s a feature of implementations, and so it’s supposed to be entirely invisible to running programs. When the processor discards the bad speculation, it should be as if the speculation never even happened.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://catonmat.net/proof-that-sed-is-turing-complete">A proof that Unix utility sed is Turing complete</a></p>

<blockquote>
<p>Many people are surprised when they hear that sed is Turing complete. How come a text filtering program is Turing complete, they wonder. Turns out sed is a tiny assembly language that has a comparison operation, a branching operation and a temporary buffer. These operations make sed Turing complete.<br>
I first learned about this from Christophe Blaess. His proof is by construction – he wrote a Turing machine in sed (download turing.sed). As any programming language that can implement a Turing machine is Turing complete we must conclude that sed is also Turing complete.<br>
Christophe offers his own introduction to Turing machines and a description of how his sed implementation works in his article Implementation of a Turing Machine as a sed Script.</p>
</blockquote>

<blockquote>
<p>Christophe isn’t the first person to realize that sed is almost a general purpose programming language. People have written tetris, sokoban and many other programs in sed. Take a look at these:</p>
</blockquote>

<ul>
<li><a href="https://catonmat.net/ftp/sed/sedtris.sed">Tetris</a></li>
<li><a href="https://catonmat.net/ftp/sed/sokoban.sed">Sokoban (game)</a></li>
<li><a href="https://catonmat.net/ftp/sed/dc.sed">Calculator</a></li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://bastillebsd.org/">Bastille helps you quickly create and manage FreeBSD Jails.</a></p>

<blockquote>
<p>Bastille helps you quickly create and manage FreeBSD Jails.<br>
Jails are extremely lightweight containers that provide a full-featured UNIX-like operating system inside. These containers can be used for software development, rapid testing, and secure production Internet services.<br>
Bastille provides an interface to create, manage and destroy these secure virtualized environments.</p>
</blockquote>

<ul>
<li>Current version: 0.3.20190204-beta.</li>
<li>Shell Script Source here: <a href="https://github.com/BastilleBSD/bastille/blob/master/usr/local/bin/bastille">https://github.com/BastilleBSD/bastille/blob/master/usr/local/bin/bastille</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://github.com/netdata/netdata/releases">netdata v1.12 released</a></p>

<blockquote>
<p>Netdata is distributed, real-time, performance and health monitoring for systems and applications. It is a highly optimized monitoring agent you install on all your systems and containers.<br>
Netdata provides unparalleled insights, in real-time, of everything happening on the systems it runs (including web servers, databases, applications), using highly interactive web dashboards. It can run autonomously, without any third party components, or it can be integrated to existing monitoring tool chains (Prometheus, Graphite, OpenTSDB, Kafka, Grafana, etc).<br>
Netdata is fast and efficient, designed to permanently run on all systems (physical &amp; virtual servers, containers, IoT devices), without disrupting their core function.</p>
</blockquote>

<ul>
<li>Patch release 1.12.1 contains 22 bug fixes and 8 improvements.</li>
</ul>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/unix/GrepDevNull">Using grep with /dev/null, an old Unix trick</a></p>

<blockquote>
<p>Every so often I will find myself writing a grep invocation like this:</p>
</blockquote>

<p><code>find .... -exec grep &lt;something&gt; /dev/null '{}' '+'</code></p>

<blockquote>
<p>The peculiar presence of /dev/null here is an old Unix trick that is designed to force grep to always print out file names, even if your find only matches one file, by always insuring that grep has at least two files as arguments. You can wind up wanting to do the same thing with a direct use of grep if you’re not certain how many files your wildcard may match.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://smalldata.tech/blog/2016/09/10/gmail-with-mutt">USING GMAIL WITH MUTT</a></p>

<blockquote>
<p>I recently switched to using mutt for email and while setting up mutt to use imap is pretty straightforward, this tutorial will also document some advanced concepts such as encrypting your account password and sending emails from a different From address.<br>
This tutorial assumes that you have some familiarity with using mutt and have installed it with sidebar support (sudo apt-get install mutt-patched for the ubuntu folks) and are comfortable with editing your muttrc.<br>
If you would just like to skip to the end, my mutt configuration file can be found <a href="https://github.com/wheresvic/vic-config/blob/master/mutt/muttrc">here</a>.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.levenez.com/unix/">An Extensive UNIX Timeline</a></li>
<li><a href="https://garbage.fm/episodes/47">Garbage.fm - OEF</a></li>
<li><a href="https://www.dragonflydigest.com/2019/02/22/22586.html">brk() to sbrk()</a></li>
<li><a href="https://www.dragonflydigest.com/2019/02/20/22566.html">Fred models, found again</a></li>
<li><a href="https://ieeexplore.ieee.org/document/8541105">Kafe: Can OS Kernels Forward Packets Fast Enough for Software Routers?</a></li>
<li><a href="https://meetings.aaas.org/arpanet-livestream/">ARPANET: Celebrating 50 Years Since “LO”</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Pablo - <a href="http://dpaste.com/2BXMP7M">Topic suggestion: FreeBSD on a Laptop as daily driver</a></li>
<li>Ron - <a href="http://dpaste.com/16Y2HSR#wrap">ZFS on the fly compression and seek</a></li>
<li>Dave - <a href="http://dpaste.com/123AANV#wrap">two zpool, or not two zpool, that is the question</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0288.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>287: rc.d in NetBSD</title>
  <link>https://www.bsdnow.tv/287</link>
  <guid isPermaLink="false">e66ab35a-1745-4485-a2c3-142c6c471df0</guid>
  <pubDate>Thu, 28 Feb 2019 12:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e66ab35a-1745-4485-a2c3-142c6c471df0.mp3" length="36387926" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Design and Implementation of NetBSD’s rc.d system, first impressions of Project Trident 18.12, PXE booting a FreeBSD disk image, middle mouse button pasting, NetBSD gains hardware accelerated virtualization, and more.</itunes:subtitle>
  <itunes:duration>1:00:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Design and Implementation of NetBSD’s rc.d system, first impressions of Project Trident 18.12, PXE booting a FreeBSD disk image, middle mouse button pasting, NetBSD gains hardware accelerated virtualization, and more.
&lt;p&gt;##Headlines&lt;br&gt;
###&lt;a href="https://www.usenix.org/legacy/events/usenix01/freenix01/full_papers/mewburn/mewburn_html/index.html"&gt;The Design and Implementation of the NetBSD rc.d system&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Abstract&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;In this paper I cover the design and implementation of the rc.d system start-up mechanism in NetBSD 1.5, which replaced the monolithic /etc/rc start-up file inherited from 4.4BSD. Topics covered include a history of various UNIX start-up mechanisms (including NetBSD prior to 1.5), design considerations that evolved over six years of discussions, implementation details, an examination of the human issues that occurred during the design and implementation, as well as future directions for the system.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Introduction&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;NetBSD recently converted from the traditional 4.4BSD monolithic /etc/rc start-up script to an /etc/rc.d mechanism, where there is a separate script to manage each service or daemon, and these scripts are executed in a specific order at system boot.&lt;br&gt;
This paper covers the motivation, design and implementation of the rc.d system; from the history of what NetBSD had before to the system that NetBSD 1.5 shipped with in December 2000, as well as future directions.&lt;br&gt;
The changes were contentious and generated some of the liveliest discussions about any feature change ever made in NetBSD. Parts of those discussions will be covered to provide insight into some of the design and implementation decisions.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;History&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;There is great diversity in the system start-up mechanisms used by various UNIX variants. A few of the more pertinent schemes are detailed below. As NetBSD is derived from 4.4BSD, it follows that a description of the latter’s method is relevant. Solaris’ start-up method is also detailed, as it is the most common System V UNIX variant.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://distrowatch.com/weekly.php?issue=20190211#trident"&gt;First impressions of Project Trident 18.12&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident (hereafter referred to as Trident) is a desktop operating system based on TrueOS. Trident takes the rolling base platform of TrueOS, which is in turn based on FreeBSD’s development branch, and combines it with the Lumina desktop environment.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;+Installing&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The debut release of Trident is available as a 4.1GB download that can be burned to a disc or transferred to a USB thumb drive. Booting from the Trident media brings up a graphical interface and automatically launches the project’s system installer. Down the left side of the display there are buttons we can click to show hardware information and configuration options. These buttons let us know if our wireless card and video card are compatible with Trident and give us a chance to change our preferred language and keyboard layout. At the bottom of the screen we find buttons that will open a terminal or shutdown the computer.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Early impressions&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Trident boots to a graphical login screen where we can sign into the Lumina desktop or a minimal Fluxbox session. Lumina, by default, uses Fluxbox as its window manager. The Lumina desktop places its panel along the bottom of the screen and an application menu sits in the bottom-left corner. On the desktop we find icons for opening the software manager, launching the Falkon web browser, running the VLC media player, opening the Control Panel and adjusting the Lumina theme.&lt;br&gt;
The application menu has an unusual and compact layout. The menu shows just a search box and buttons for browsing applications, opening a file manager, accessing desktop settings and signing out. To see what applications are available we can click the Browse Applications entry, which opens a window in the menu where we can scroll through installed programs. This is a bit awkward since the display window is small and only shows a few items at a time.&lt;br&gt;
Early on I found it is possible to swap out the default “Start menu” with an alternative “Application menu” through the Panels configuration tool. This alternative menu offers a classic tree-style application menu. I found the latter menu easier to navigate as it expands to show all the applications in a selected category.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Conclusions&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I have a lot of mixed feelings and impressions when it comes to Trident. On the one hand, the operating system has some great technology under the hook. It has cutting edge packages from the FreeBSD ecosystem, we have easy access to ZFS, boot environments, and lots of open source packages. Hardware support, at least on my physical workstation, was solid and the Lumina desktop is flexible.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://blog.cochard.me/2019/02/pxe-booting-of-freebsd-disk-image.html"&gt;PXE booting of a FreeBSD disk image&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I had to set up a regression and network performance lab. This lab will be managed by a Jenkins, but the first step is to understand how to boot a FreeBSD disk by PXE. This article explains a simple way of doing it.&lt;br&gt;
For information, all these steps were done using 2 PC Engines APU2 (upgraded with latest BIOS for iPXE support), so it’s a headless (serial port only, this can be IPMI SoL with different hardware) .&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;THE BIG PICTURE&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Before explaining all steps and command line, here is the &lt;a href="https://1.bp.blogspot.com/-SCUJAjowhYw/XG-b-qWGuXI/AAAAAAAAmXw/SVXHDC9hsMwZNB2P5glsZx0iFoCE9SAXQCLcBGAs/s1600/PXE%2Band%2BFreeBSD%2Bmfs%2Bimage.png"&gt;full big picture&lt;/a&gt; of the final process.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/unix/MouseMovementAndPaste"&gt;Why I like middle mouse button paste in xterm so much&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;In my entry about how touchpads are not mice, I mused that one of the things I should do on my laptop was insure that I had a keyboard binding for paste, since middle mouse button is one of the harder multi-finger gestures to land on a touchpad. Kurt Mosiejczuk recently left a comment there where they said:&lt;br&gt;
Shift-Insert is a keyboard equivalent for paste that is in default xterm (at least OpenBSD xterm, and putty on Windows too). I use that most of the time now as it seems less… trigger-happy than right click paste.&lt;br&gt;
This sparked some thoughts, because I can’t imagine giving up middle mouse paste if I have a real choice. I had earlier seen shift-insert mentioned in other commentary on my entry and so have tried a bit to use it on my laptop, and it hasn’t really felt great even there; on my desktops, it’s even less appealing (I tried shift-insert out there to confirm that it did work in my set of wacky X resources).&lt;br&gt;
In thinking about why this is, I came to the obvious realization about why all of this is so. I like middle mouse button paste in normal usage because it’s so convenient, because almost all of the time my hand is already on the mouse. And the reason my hand is already on the mouse is because I’ve just used the mouse to shift focus to the window I want to paste into. Even on my laptop, my right hand is usually away from the keyboard as I move the mouse pointer on the touchpad, making shift-Insert at least somewhat awkward.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="http://m00nbsd.net/4e0798b7f2620c965d0dd9d6a7a2f296.html"&gt;NetBSD Gains Hardware Accelerated Virtualization&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;NetBSD Virtual Machine Monitor&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;NVMM provides hardware-accelerated virtualization support for NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is shipped via libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.solobsd.org/index.php/2019/02/11/solobsd-19-02-stable/"&gt;SoloBSD 19.02-STABLE&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://project-trident.org/post/2019-02-20_18.12-u5_available/"&gt;Project Trident 18.12-U5 available&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mwl.io/archives/4076"&gt;“Sudo Mastery, Second Edition” and Cover Art&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/mksanitizer_bug_detector_software_integration"&gt;MKSANITIZER - bug detector software integration with the NetBSD userland&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;
&lt;a href="https://old.reddit.com/r/unix/comments/aplxjf/darn_kids_nowadays_back_in_my_day_we_drew_rude/"&gt;Darn kids nowadays… back in my day we drew rude symbols like normal people.&lt;/a&gt;  {{top two comments}}&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.shellcheck.net/"&gt;ShellCheck&lt;br&gt;
finds bugs in your shell scripts.&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=JuHpABL46a8"&gt;Old School Sean - A history of UNIX&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Ales - &lt;a href="http://dpaste.com/3T8VTDJ"&gt;OpenBSD, FreeNAS, OpenZFS questions&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Malcolm - &lt;a href="http://dpaste.com/2X63H8Q"&gt;Thoughts on Pgsql + ZFS thread?&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Brad - &lt;a href="http://dpaste.com/02DCADV#wrap"&gt;Boot Environments in FreeBSD&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Design and Implementation of NetBSD’s rc.d system, first impressions of Project Trident 18.12, PXE booting a FreeBSD disk image, middle mouse button pasting, NetBSD gains hardware accelerated virtualization, and more.</p>

<p>##Headlines<br>
###<a href="https://www.usenix.org/legacy/events/usenix01/freenix01/full_papers/mewburn/mewburn_html/index.html">The Design and Implementation of the NetBSD rc.d system</a></p>

<ul>
<li>Abstract</li>
</ul>

<blockquote>
<p>In this paper I cover the design and implementation of the rc.d system start-up mechanism in NetBSD 1.5, which replaced the monolithic /etc/rc start-up file inherited from 4.4BSD. Topics covered include a history of various UNIX start-up mechanisms (including NetBSD prior to 1.5), design considerations that evolved over six years of discussions, implementation details, an examination of the human issues that occurred during the design and implementation, as well as future directions for the system.</p>
</blockquote>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
<p>NetBSD recently converted from the traditional 4.4BSD monolithic /etc/rc start-up script to an /etc/rc.d mechanism, where there is a separate script to manage each service or daemon, and these scripts are executed in a specific order at system boot.<br>
This paper covers the motivation, design and implementation of the rc.d system; from the history of what NetBSD had before to the system that NetBSD 1.5 shipped with in December 2000, as well as future directions.<br>
The changes were contentious and generated some of the liveliest discussions about any feature change ever made in NetBSD. Parts of those discussions will be covered to provide insight into some of the design and implementation decisions.</p>
</blockquote>

<ul>
<li>History</li>
</ul>

<blockquote>
<p>There is great diversity in the system start-up mechanisms used by various UNIX variants. A few of the more pertinent schemes are detailed below. As NetBSD is derived from 4.4BSD, it follows that a description of the latter’s method is relevant. Solaris’ start-up method is also detailed, as it is the most common System V UNIX variant.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://distrowatch.com/weekly.php?issue=20190211#trident">First impressions of Project Trident 18.12</a></p>

<blockquote>
<p>Project Trident (hereafter referred to as Trident) is a desktop operating system based on TrueOS. Trident takes the rolling base platform of TrueOS, which is in turn based on FreeBSD’s development branch, and combines it with the Lumina desktop environment.</p>
</blockquote>

<p>+Installing</p>

<blockquote>
<p>The debut release of Trident is available as a 4.1GB download that can be burned to a disc or transferred to a USB thumb drive. Booting from the Trident media brings up a graphical interface and automatically launches the project’s system installer. Down the left side of the display there are buttons we can click to show hardware information and configuration options. These buttons let us know if our wireless card and video card are compatible with Trident and give us a chance to change our preferred language and keyboard layout. At the bottom of the screen we find buttons that will open a terminal or shutdown the computer.</p>
</blockquote>

<ul>
<li>Early impressions</li>
</ul>

<blockquote>
<p>Trident boots to a graphical login screen where we can sign into the Lumina desktop or a minimal Fluxbox session. Lumina, by default, uses Fluxbox as its window manager. The Lumina desktop places its panel along the bottom of the screen and an application menu sits in the bottom-left corner. On the desktop we find icons for opening the software manager, launching the Falkon web browser, running the VLC media player, opening the Control Panel and adjusting the Lumina theme.<br>
The application menu has an unusual and compact layout. The menu shows just a search box and buttons for browsing applications, opening a file manager, accessing desktop settings and signing out. To see what applications are available we can click the Browse Applications entry, which opens a window in the menu where we can scroll through installed programs. This is a bit awkward since the display window is small and only shows a few items at a time.<br>
Early on I found it is possible to swap out the default “Start menu” with an alternative “Application menu” through the Panels configuration tool. This alternative menu offers a classic tree-style application menu. I found the latter menu easier to navigate as it expands to show all the applications in a selected category.</p>
</blockquote>

<ul>
<li>Conclusions</li>
</ul>

<blockquote>
<p>I have a lot of mixed feelings and impressions when it comes to Trident. On the one hand, the operating system has some great technology under the hook. It has cutting edge packages from the FreeBSD ecosystem, we have easy access to ZFS, boot environments, and lots of open source packages. Hardware support, at least on my physical workstation, was solid and the Lumina desktop is flexible.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://blog.cochard.me/2019/02/pxe-booting-of-freebsd-disk-image.html">PXE booting of a FreeBSD disk image</a></p>

<blockquote>
<p>I had to set up a regression and network performance lab. This lab will be managed by a Jenkins, but the first step is to understand how to boot a FreeBSD disk by PXE. This article explains a simple way of doing it.<br>
For information, all these steps were done using 2 PC Engines APU2 (upgraded with latest BIOS for iPXE support), so it’s a headless (serial port only, this can be IPMI SoL with different hardware) .</p>
</blockquote>

<ul>
<li>THE BIG PICTURE</li>
</ul>

<blockquote>
<p>Before explaining all steps and command line, here is the <a href="https://1.bp.blogspot.com/-SCUJAjowhYw/XG-b-qWGuXI/AAAAAAAAmXw/SVXHDC9hsMwZNB2P5glsZx0iFoCE9SAXQCLcBGAs/s1600/PXE%2Band%2BFreeBSD%2Bmfs%2Bimage.png">full big picture</a> of the final process.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/unix/MouseMovementAndPaste">Why I like middle mouse button paste in xterm so much</a></p>

<blockquote>
<p>In my entry about how touchpads are not mice, I mused that one of the things I should do on my laptop was insure that I had a keyboard binding for paste, since middle mouse button is one of the harder multi-finger gestures to land on a touchpad. Kurt Mosiejczuk recently left a comment there where they said:<br>
Shift-Insert is a keyboard equivalent for paste that is in default xterm (at least OpenBSD xterm, and putty on Windows too). I use that most of the time now as it seems less… trigger-happy than right click paste.<br>
This sparked some thoughts, because I can’t imagine giving up middle mouse paste if I have a real choice. I had earlier seen shift-insert mentioned in other commentary on my entry and so have tried a bit to use it on my laptop, and it hasn’t really felt great even there; on my desktops, it’s even less appealing (I tried shift-insert out there to confirm that it did work in my set of wacky X resources).<br>
In thinking about why this is, I came to the obvious realization about why all of this is so. I like middle mouse button paste in normal usage because it’s so convenient, because almost all of the time my hand is already on the mouse. And the reason my hand is already on the mouse is because I’ve just used the mouse to shift focus to the window I want to paste into. Even on my laptop, my right hand is usually away from the keyboard as I move the mouse pointer on the touchpad, making shift-Insert at least somewhat awkward.</p>
</blockquote>

<p><hr></p>

<p>###<a href="http://m00nbsd.net/4e0798b7f2620c965d0dd9d6a7a2f296.html">NetBSD Gains Hardware Accelerated Virtualization</a></p>

<ul>
<li>NetBSD Virtual Machine Monitor</li>
</ul>

<blockquote>
<p>NVMM provides hardware-accelerated virtualization support for NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is shipped via libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.solobsd.org/index.php/2019/02/11/solobsd-19-02-stable/">SoloBSD 19.02-STABLE</a></li>
<li><a href="https://project-trident.org/post/2019-02-20_18.12-u5_available/">Project Trident 18.12-U5 available</a></li>
<li><a href="https://mwl.io/archives/4076">“Sudo Mastery, Second Edition” and Cover Art</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/mksanitizer_bug_detector_software_integration">MKSANITIZER - bug detector software integration with the NetBSD userland</a></li>
<li><a href="https://old.reddit.com/r/unix/comments/aplxjf/darn_kids_nowadays_back_in_my_day_we_drew_rude/">Darn kids nowadays… back in my day we drew rude symbols like normal people.</a>  {{top two comments}}</li>
<li><a href="https://www.shellcheck.net/">ShellCheck<br>
finds bugs in your shell scripts.</a></li>
<li><a href="https://www.youtube.com/watch?v=JuHpABL46a8">Old School Sean - A history of UNIX</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Ales - <a href="http://dpaste.com/3T8VTDJ">OpenBSD, FreeNAS, OpenZFS questions</a></li>
<li>Malcolm - <a href="http://dpaste.com/2X63H8Q">Thoughts on Pgsql + ZFS thread?</a></li>
<li>Brad - <a href="http://dpaste.com/02DCADV#wrap">Boot Environments in FreeBSD</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0287.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Design and Implementation of NetBSD’s rc.d system, first impressions of Project Trident 18.12, PXE booting a FreeBSD disk image, middle mouse button pasting, NetBSD gains hardware accelerated virtualization, and more.</p>

<p>##Headlines<br>
###<a href="https://www.usenix.org/legacy/events/usenix01/freenix01/full_papers/mewburn/mewburn_html/index.html">The Design and Implementation of the NetBSD rc.d system</a></p>

<ul>
<li>Abstract</li>
</ul>

<blockquote>
<p>In this paper I cover the design and implementation of the rc.d system start-up mechanism in NetBSD 1.5, which replaced the monolithic /etc/rc start-up file inherited from 4.4BSD. Topics covered include a history of various UNIX start-up mechanisms (including NetBSD prior to 1.5), design considerations that evolved over six years of discussions, implementation details, an examination of the human issues that occurred during the design and implementation, as well as future directions for the system.</p>
</blockquote>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
<p>NetBSD recently converted from the traditional 4.4BSD monolithic /etc/rc start-up script to an /etc/rc.d mechanism, where there is a separate script to manage each service or daemon, and these scripts are executed in a specific order at system boot.<br>
This paper covers the motivation, design and implementation of the rc.d system; from the history of what NetBSD had before to the system that NetBSD 1.5 shipped with in December 2000, as well as future directions.<br>
The changes were contentious and generated some of the liveliest discussions about any feature change ever made in NetBSD. Parts of those discussions will be covered to provide insight into some of the design and implementation decisions.</p>
</blockquote>

<ul>
<li>History</li>
</ul>

<blockquote>
<p>There is great diversity in the system start-up mechanisms used by various UNIX variants. A few of the more pertinent schemes are detailed below. As NetBSD is derived from 4.4BSD, it follows that a description of the latter’s method is relevant. Solaris’ start-up method is also detailed, as it is the most common System V UNIX variant.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://distrowatch.com/weekly.php?issue=20190211#trident">First impressions of Project Trident 18.12</a></p>

<blockquote>
<p>Project Trident (hereafter referred to as Trident) is a desktop operating system based on TrueOS. Trident takes the rolling base platform of TrueOS, which is in turn based on FreeBSD’s development branch, and combines it with the Lumina desktop environment.</p>
</blockquote>

<p>+Installing</p>

<blockquote>
<p>The debut release of Trident is available as a 4.1GB download that can be burned to a disc or transferred to a USB thumb drive. Booting from the Trident media brings up a graphical interface and automatically launches the project’s system installer. Down the left side of the display there are buttons we can click to show hardware information and configuration options. These buttons let us know if our wireless card and video card are compatible with Trident and give us a chance to change our preferred language and keyboard layout. At the bottom of the screen we find buttons that will open a terminal or shutdown the computer.</p>
</blockquote>

<ul>
<li>Early impressions</li>
</ul>

<blockquote>
<p>Trident boots to a graphical login screen where we can sign into the Lumina desktop or a minimal Fluxbox session. Lumina, by default, uses Fluxbox as its window manager. The Lumina desktop places its panel along the bottom of the screen and an application menu sits in the bottom-left corner. On the desktop we find icons for opening the software manager, launching the Falkon web browser, running the VLC media player, opening the Control Panel and adjusting the Lumina theme.<br>
The application menu has an unusual and compact layout. The menu shows just a search box and buttons for browsing applications, opening a file manager, accessing desktop settings and signing out. To see what applications are available we can click the Browse Applications entry, which opens a window in the menu where we can scroll through installed programs. This is a bit awkward since the display window is small and only shows a few items at a time.<br>
Early on I found it is possible to swap out the default “Start menu” with an alternative “Application menu” through the Panels configuration tool. This alternative menu offers a classic tree-style application menu. I found the latter menu easier to navigate as it expands to show all the applications in a selected category.</p>
</blockquote>

<ul>
<li>Conclusions</li>
</ul>

<blockquote>
<p>I have a lot of mixed feelings and impressions when it comes to Trident. On the one hand, the operating system has some great technology under the hook. It has cutting edge packages from the FreeBSD ecosystem, we have easy access to ZFS, boot environments, and lots of open source packages. Hardware support, at least on my physical workstation, was solid and the Lumina desktop is flexible.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://blog.cochard.me/2019/02/pxe-booting-of-freebsd-disk-image.html">PXE booting of a FreeBSD disk image</a></p>

<blockquote>
<p>I had to set up a regression and network performance lab. This lab will be managed by a Jenkins, but the first step is to understand how to boot a FreeBSD disk by PXE. This article explains a simple way of doing it.<br>
For information, all these steps were done using 2 PC Engines APU2 (upgraded with latest BIOS for iPXE support), so it’s a headless (serial port only, this can be IPMI SoL with different hardware) .</p>
</blockquote>

<ul>
<li>THE BIG PICTURE</li>
</ul>

<blockquote>
<p>Before explaining all steps and command line, here is the <a href="https://1.bp.blogspot.com/-SCUJAjowhYw/XG-b-qWGuXI/AAAAAAAAmXw/SVXHDC9hsMwZNB2P5glsZx0iFoCE9SAXQCLcBGAs/s1600/PXE%2Band%2BFreeBSD%2Bmfs%2Bimage.png">full big picture</a> of the final process.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/unix/MouseMovementAndPaste">Why I like middle mouse button paste in xterm so much</a></p>

<blockquote>
<p>In my entry about how touchpads are not mice, I mused that one of the things I should do on my laptop was insure that I had a keyboard binding for paste, since middle mouse button is one of the harder multi-finger gestures to land on a touchpad. Kurt Mosiejczuk recently left a comment there where they said:<br>
Shift-Insert is a keyboard equivalent for paste that is in default xterm (at least OpenBSD xterm, and putty on Windows too). I use that most of the time now as it seems less… trigger-happy than right click paste.<br>
This sparked some thoughts, because I can’t imagine giving up middle mouse paste if I have a real choice. I had earlier seen shift-insert mentioned in other commentary on my entry and so have tried a bit to use it on my laptop, and it hasn’t really felt great even there; on my desktops, it’s even less appealing (I tried shift-insert out there to confirm that it did work in my set of wacky X resources).<br>
In thinking about why this is, I came to the obvious realization about why all of this is so. I like middle mouse button paste in normal usage because it’s so convenient, because almost all of the time my hand is already on the mouse. And the reason my hand is already on the mouse is because I’ve just used the mouse to shift focus to the window I want to paste into. Even on my laptop, my right hand is usually away from the keyboard as I move the mouse pointer on the touchpad, making shift-Insert at least somewhat awkward.</p>
</blockquote>

<p><hr></p>

<p>###<a href="http://m00nbsd.net/4e0798b7f2620c965d0dd9d6a7a2f296.html">NetBSD Gains Hardware Accelerated Virtualization</a></p>

<ul>
<li>NetBSD Virtual Machine Monitor</li>
</ul>

<blockquote>
<p>NVMM provides hardware-accelerated virtualization support for NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is shipped via libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.solobsd.org/index.php/2019/02/11/solobsd-19-02-stable/">SoloBSD 19.02-STABLE</a></li>
<li><a href="https://project-trident.org/post/2019-02-20_18.12-u5_available/">Project Trident 18.12-U5 available</a></li>
<li><a href="https://mwl.io/archives/4076">“Sudo Mastery, Second Edition” and Cover Art</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/mksanitizer_bug_detector_software_integration">MKSANITIZER - bug detector software integration with the NetBSD userland</a></li>
<li><a href="https://old.reddit.com/r/unix/comments/aplxjf/darn_kids_nowadays_back_in_my_day_we_drew_rude/">Darn kids nowadays… back in my day we drew rude symbols like normal people.</a>  {{top two comments}}</li>
<li><a href="https://www.shellcheck.net/">ShellCheck<br>
finds bugs in your shell scripts.</a></li>
<li><a href="https://www.youtube.com/watch?v=JuHpABL46a8">Old School Sean - A history of UNIX</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Ales - <a href="http://dpaste.com/3T8VTDJ">OpenBSD, FreeNAS, OpenZFS questions</a></li>
<li>Malcolm - <a href="http://dpaste.com/2X63H8Q">Thoughts on Pgsql + ZFS thread?</a></li>
<li>Brad - <a href="http://dpaste.com/02DCADV#wrap">Boot Environments in FreeBSD</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0287.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>286: Old Machine Revival</title>
  <link>https://www.bsdnow.tv/286</link>
  <guid isPermaLink="false">d6eb1003-7d6d-447e-bd77-68ae1e60c19d</guid>
  <pubDate>Thu, 21 Feb 2019 16:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d6eb1003-7d6d-447e-bd77-68ae1e60c19d.mp3" length="47545588" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Adding glue to a desktop environment, flashing the BIOS on a PC Engine, revive a Cisco IDS into a capable OpenBSD computer, An OpenBSD WindowMaker desktop, RealTime data compression, the love for pipes, and more. </itunes:subtitle>
  <itunes:duration>1:18:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Adding glue to a desktop environment, flashing the BIOS on a PC Engine, revive a Cisco IDS into a capable OpenBSD computer, An OpenBSD WindowMaker desktop, RealTime data compression, the love for pipes, and more. 
&lt;p&gt;##Headlines&lt;br&gt;
###&lt;a href="https://venam.nixers.net/blog/unix/2019/01/07/win-automation.html"&gt;Adding Glue To a Desktop Environment&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;In this article we will put some light on a lot of tools used in the world of Unix desktop environment customization, particularly regarding wmctrl, wmutils, xev, xtruss, xwininfo, xprop, xdotools, xdo, sxhkd, xbindkeys, speckeysd, xchainkeys, alttab, triggerhappy, gTile, gidmgr, keynav, and more. If those don’t make sense then this article will help. Let’s hope this can open your mind to new possibilities.&lt;br&gt;
With that in mind we can wonder if what’s actually needed from a window manager, presentation and operation, can be split up and complemented with other tools. We can also start thinking laterally, the communication and interaction between the different components of the environment. We have the freedom to do so because the X protocol is transparent and components usually implement many standards for interfacing between windows. It’s like gluing parts together to create a desktop environment.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The tools we’ll talk about fall into one of those categories:&lt;/li&gt;
&lt;li&gt;Debugging&lt;/li&gt;
&lt;li&gt;Window manipulation&lt;/li&gt;
&lt;li&gt;Simulation of interaction&lt;/li&gt;
&lt;li&gt;Extended manipulation&lt;/li&gt;
&lt;li&gt;Hotkey daemon&lt;/li&gt;
&lt;li&gt;Layout manager&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://github.com/lattera/articles/blob/master/hardware/apu/2019-02-05_flashing_bios/article.md"&gt;Flashing the BIOS on the PC Engines APU4c4&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I absolutely love the PC Engines APU devices. I use them for testing HardenedBSD experimental features in more constrained 64-bit environments and firewalls.  Their USB and mSATA ports have a few quirks, and I bumped up against a major quirk that required flashing a different BIOS as a workaround. This article details the hacky way in which I went about doing that.&lt;br&gt;
What prompted this article is that something in either the CAM or GEOM layer in FreeBSD 11.2 caused the mSATA to hang, preventing file writes. OPNsense 18.7 uses FreeBSD 11.1 whereas the recently-released OPNsense 19.1 uses HardenedBSD 11.2 (based on FreeBSD 11.2). I reached out to PC Engines directly, and they let me know that the issue is a known BIOS issue. Flashing the “legacy” BIOS series would provide me with a working system.&lt;br&gt;
It also just so happens that a new “legacy” BIOS version was just released which turns on ECC mode for the RAM. So, I get a working OPNsense install AND ECC RAM! I’ll have one bird for dinner, the other for dessert.&lt;br&gt;
Though I’m using an APU4, these instructions should work for the other APU devices. The BIOS ROM download URLs should be changed to reflect the device you’re targeting along with the BIOS version you wish to deploy.&lt;br&gt;
SPECIAL NOTE: There be dragons! I’m primarily writing this article to document the procedure for my own purposes. My memory tends to be pretty faulty these days. So, if something goes wrong, please do not hold me responsible. You’re the one at the keyboard. ;)&lt;br&gt;
VERY SPECIAL NOTE: We’ll use the mSATA drive for swap space, just in case. Should the swap space be used, it will destroy whatever is on the disk.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://komlositech.wordpress.com/2018/12/30/revive-a-cisco-ids-into-a-capable-openbsd-firewall/"&gt;Revive a Cisco IDS into a capable OpenBSD computer!&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Even though Cisco equipment is very capable, it tends to become End-of-Life before you can say “planned obsolescence”. Websites become bigger, bandwidths increase, and as a side effect of those “improvements”, routers, firewalls, and in this case, intrusion prevention systems get old quicker and quicker.&lt;br&gt;
Apparently, this was also the case for the Cisco IDS-4215 Intrusion Detection Sensor that I was given a few months ago.&lt;br&gt;
I’m not too proud to admit that at first, I didn’t care about the machine itself, but rather about the add-on PCI network card with 4 Fast Ethernet interfaces. The sensor has obviously seen better days, as it had a broken front panel and needed some cleaning, but upon a closer inspection under the hood  (which is held closed by the 4 screws on top), this IDS consists of an embedded Celeron PC with two onboard Ethernet cards, a 2.5″ IDE hard disk, a CF card, and 2 PCI expansion slots (more on them later). Oh, and don’t forget the nasty server-grade fan, which pushed very little air for the noise it was making.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.tumfatig.net/20190215/an-openbsd-desktop-using-windowmaker/?utm_source=discoverbsd"&gt;An OpenBSD desktop using WindowMaker&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Since I started using N?X, I’ve regularly used WindowMaker. I’ve always liked the look and feel, the dock system and the dockapps. It may look a bit oldish nowadays. And that’s enough to try to change this. So here it is, a 2019 flavored WindowMaker Desktop, running on OpenBSD 6.4/amd64.&lt;br&gt;
This configuration uses the Nord color-scheme, the Adapta-Nokto-Eta GTK theme and the Moblin Unofficial Icons icon set. I did remove applications icons. I just don’t need them on the bottom of the screen as I heavily use “F11” to pop-up the windows list. To be able to do that and keep the dockapps, I tweaked my ~/GNUstep/Defaults/WMWindowAttributes and created a ~/GNUstep/Library/WindowMaker/Themes/Nord.themed/style.&lt;br&gt;
And here it is, the NeXT OpenBSD Desktop!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://fastcompression.blogspot.com/2019/01/opaque-types-and-static-allocation.html"&gt;RealTime Data Compression&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;In a previous episode, we’ve seen that it is possible to create opaque types. However, creation and destruction of such type must be delegated to some dedicated functions, which themselves rely on dynamic allocation mechanisms.&lt;br&gt;
Sometimes, it can be convenient to bypass the heap, and all its malloc() / free() shenanigans. Pushing a structure onto the stack, or within thread-local storage, are natural capabilities offered by a normal struct. It can be desirable at times.&lt;br&gt;
The previously described opaque type is so secret that it has no size, hence is not suitable for such scenario.&lt;br&gt;
Fortunately, static opaque types are possible.&lt;br&gt;
The main idea is to create a “shell type”, with a known size and an alignment, able to host the target (private) structure.&lt;br&gt;
For safer maintenance, the shell type and the target structure must be kept in sync, by using typically a static assert. It will ensure that the shell type is always large enough to host the target structure. This check is important to automatically detect future evolution of the target structure.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blog.jessfraz.com/post/for-the-love-of-pipes/"&gt;For the Love of Pipes&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;My top used shell command is |. This is called a pipe.&lt;br&gt;
In brief, the | allows for the output of one program (on the left) to become the input of another program (on the right). It is a way of connecting two commands together.&lt;br&gt;
According to &lt;a href="http://doc.cat-v.org/unix/pipes/"&gt;doc.cat-v.org/unix/pipes/&lt;/a&gt;, the origin of pipes came long before Unix. Pipes can be traced back to this note from Doug McIlroy in 1964&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://scontent-iad3-1.xx.fbcdn.net/v/t1.0-9/52532824_10216880223150142_5567720793346932736_n.jpg?_nc_cat=100&amp;amp;_nc_ht=scontent-iad3-1.xx&amp;amp;oh=f4de0999bd268725b39969435c1e2d82&amp;amp;oe=5D23255E"&gt;Installation Notes for NetBSD/i386 0.9&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://coypu.sdf.org/porting-zig.html"&gt;Porting Zig to NetBSD - a fun, speedy port&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/jarun/nnn/blob/master/README.md"&gt;NNN - Tiny, lightning fast, feature-packed file manager Release v2.3&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/aioobe/eta"&gt;eta - A tool for monitoring progress and ETA of an arbitrary process&lt;br&gt;
&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=OxB70pg5Tsg&amp;amp;feature=share"&gt;A FreeBSD User Tries Out…NetBSD 8.0&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.grenadille.net/post/2019/02/18/Faster-vlan%284%29-forwarding"&gt;Faster vlan(4) forwarding?&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://fuguita.org/"&gt;FuguIta - OpenBSD 6.4 Live System&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://chargen.one/steve/adding-name-based-hosting-to-nginx-on-openbsd-with-acme-client"&gt;Adding Name-based hosting To Nginx on OpenBSD with Acme-Client&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://polprog.net/blog/netbsd-hax/"&gt;HOWTO set up QEMU with HAXM acceleration on NetBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mail-index.netbsd.org/current-users/2019/02/07/msg035054.html"&gt;README: gcc 7 switch coming to a port near you!&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##BUG Calendar&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;ChiBUG, Chicago, USA: &lt;a href="https://chibug.org/"&gt;Tuesday, February 26th 18:00 at the Oak Park Library&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;CharmBUG, Baltimore, USA: &lt;a href="https://www.meetup.com/CharmBUG/"&gt;Wednesday, February 27, 2019&lt;br&gt;
19:30 at Columbia Ale House&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;NYCBUG, New York, USA: &lt;a href="https://www.nycbug.org/index"&gt;Wednesday, March 6, 2019 18:45 at Suspenders&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;KnoxBUG, Knoxville, USA: &lt;a href="http://knoxbug.org"&gt;Monday, February 25, 2019 - 18:00 at iX Systems offices &lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;BSDPL, Warsaw,  Poland: &lt;a href="https://bsd-pl.org/en"&gt;February 28, 2019 18:15 - 21:00 at Wheel Systems Office&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Sam - &lt;a href="http://dpaste.com/2NP4VGE#wrap"&gt;Customizing OpenBSD ports source code&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Frank - &lt;a href="http://dpaste.com/1EHYHQ1#wrap"&gt;Rivalry Linux &amp;amp; BSD&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Zach - &lt;a href="http://dpaste.com/13GGAED"&gt;mysql/mariadb tuning&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;

    
    Your browser does not support the HTML5 video tag.
 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Adding glue to a desktop environment, flashing the BIOS on a PC Engine, revive a Cisco IDS into a capable OpenBSD computer, An OpenBSD WindowMaker desktop, RealTime data compression, the love for pipes, and more. </p>

<p>##Headlines<br>
###<a href="https://venam.nixers.net/blog/unix/2019/01/07/win-automation.html">Adding Glue To a Desktop Environment</a></p>

<blockquote>
<p>In this article we will put some light on a lot of tools used in the world of Unix desktop environment customization, particularly regarding wmctrl, wmutils, xev, xtruss, xwininfo, xprop, xdotools, xdo, sxhkd, xbindkeys, speckeysd, xchainkeys, alttab, triggerhappy, gTile, gidmgr, keynav, and more. If those don’t make sense then this article will help. Let’s hope this can open your mind to new possibilities.<br>
With that in mind we can wonder if what’s actually needed from a window manager, presentation and operation, can be split up and complemented with other tools. We can also start thinking laterally, the communication and interaction between the different components of the environment. We have the freedom to do so because the X protocol is transparent and components usually implement many standards for interfacing between windows. It’s like gluing parts together to create a desktop environment.</p>
</blockquote>

<ul>
<li>The tools we’ll talk about fall into one of those categories:</li>
<li>Debugging</li>
<li>Window manipulation</li>
<li>Simulation of interaction</li>
<li>Extended manipulation</li>
<li>Hotkey daemon</li>
<li>Layout manager</li>
</ul>

<p><hr></p>

<p>###<a href="https://github.com/lattera/articles/blob/master/hardware/apu/2019-02-05_flashing_bios/article.md">Flashing the BIOS on the PC Engines APU4c4</a></p>

<blockquote>
<p>I absolutely love the PC Engines APU devices. I use them for testing HardenedBSD experimental features in more constrained 64-bit environments and firewalls.  Their USB and mSATA ports have a few quirks, and I bumped up against a major quirk that required flashing a different BIOS as a workaround. This article details the hacky way in which I went about doing that.<br>
What prompted this article is that something in either the CAM or GEOM layer in FreeBSD 11.2 caused the mSATA to hang, preventing file writes. OPNsense 18.7 uses FreeBSD 11.1 whereas the recently-released OPNsense 19.1 uses HardenedBSD 11.2 (based on FreeBSD 11.2). I reached out to PC Engines directly, and they let me know that the issue is a known BIOS issue. Flashing the “legacy” BIOS series would provide me with a working system.<br>
It also just so happens that a new “legacy” BIOS version was just released which turns on ECC mode for the RAM. So, I get a working OPNsense install AND ECC RAM! I’ll have one bird for dinner, the other for dessert.<br>
Though I’m using an APU4, these instructions should work for the other APU devices. The BIOS ROM download URLs should be changed to reflect the device you’re targeting along with the BIOS version you wish to deploy.<br>
SPECIAL NOTE: There be dragons! I’m primarily writing this article to document the procedure for my own purposes. My memory tends to be pretty faulty these days. So, if something goes wrong, please do not hold me responsible. You’re the one at the keyboard. ;)<br>
VERY SPECIAL NOTE: We’ll use the mSATA drive for swap space, just in case. Should the swap space be used, it will destroy whatever is on the disk.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://komlositech.wordpress.com/2018/12/30/revive-a-cisco-ids-into-a-capable-openbsd-firewall/">Revive a Cisco IDS into a capable OpenBSD computer!</a></p>

<blockquote>
<p>Even though Cisco equipment is very capable, it tends to become End-of-Life before you can say “planned obsolescence”. Websites become bigger, bandwidths increase, and as a side effect of those “improvements”, routers, firewalls, and in this case, intrusion prevention systems get old quicker and quicker.<br>
Apparently, this was also the case for the Cisco IDS-4215 Intrusion Detection Sensor that I was given a few months ago.<br>
I’m not too proud to admit that at first, I didn’t care about the machine itself, but rather about the add-on PCI network card with 4 Fast Ethernet interfaces. The sensor has obviously seen better days, as it had a broken front panel and needed some cleaning, but upon a closer inspection under the hood  (which is held closed by the 4 screws on top), this IDS consists of an embedded Celeron PC with two onboard Ethernet cards, a 2.5″ IDE hard disk, a CF card, and 2 PCI expansion slots (more on them later). Oh, and don’t forget the nasty server-grade fan, which pushed very little air for the noise it was making.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.tumfatig.net/20190215/an-openbsd-desktop-using-windowmaker/?utm_source=discoverbsd">An OpenBSD desktop using WindowMaker</a></p>

<blockquote>
<p>Since I started using *N?X, I’ve regularly used WindowMaker. I’ve always liked the look and feel, the dock system and the dockapps. It may look a bit oldish nowadays. And that’s enough to try to change this. So here it is, a 2019 flavored WindowMaker Desktop, running on OpenBSD 6.4/amd64.<br>
This configuration uses the Nord color-scheme, the Adapta-Nokto-Eta GTK theme and the Moblin Unofficial Icons icon set. I did remove applications icons. I just don’t need them on the bottom of the screen as I heavily use “F11” to pop-up the windows list. To be able to do that and keep the dockapps, I tweaked my ~/GNUstep/Defaults/WMWindowAttributes and created a ~/GNUstep/Library/WindowMaker/Themes/Nord.themed/style.<br>
And here it is, the NeXT OpenBSD Desktop!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://fastcompression.blogspot.com/2019/01/opaque-types-and-static-allocation.html">RealTime Data Compression</a></p>

<blockquote>
<p>In a previous episode, we’ve seen that it is possible to create opaque types. However, creation and destruction of such type must be delegated to some dedicated functions, which themselves rely on dynamic allocation mechanisms.<br>
Sometimes, it can be convenient to bypass the heap, and all its malloc() / free() shenanigans. Pushing a structure onto the stack, or within thread-local storage, are natural capabilities offered by a normal struct. It can be desirable at times.<br>
The previously described opaque type is so secret that it has no size, hence is not suitable for such scenario.<br>
Fortunately, static opaque types are possible.<br>
The main idea is to create a “shell type”, with a known size and an alignment, able to host the target (private) structure.<br>
For safer maintenance, the shell type and the target structure must be kept in sync, by using typically a static assert. It will ensure that the shell type is always large enough to host the target structure. This check is important to automatically detect future evolution of the target structure.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.jessfraz.com/post/for-the-love-of-pipes/">For the Love of Pipes</a></p>

<blockquote>
<p>My top used shell command is |. This is called a pipe.<br>
In brief, the | allows for the output of one program (on the left) to become the input of another program (on the right). It is a way of connecting two commands together.<br>
According to <a href="http://doc.cat-v.org/unix/pipes/">doc.cat-v.org/unix/pipes/</a>, the origin of pipes came long before Unix. Pipes can be traced back to this note from Doug McIlroy in 1964</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://scontent-iad3-1.xx.fbcdn.net/v/t1.0-9/52532824_10216880223150142_5567720793346932736_n.jpg?_nc_cat=100&amp;_nc_ht=scontent-iad3-1.xx&amp;oh=f4de0999bd268725b39969435c1e2d82&amp;oe=5D23255E">Installation Notes for NetBSD/i386 0.9</a></li>
<li><a href="http://coypu.sdf.org/porting-zig.html">Porting Zig to NetBSD - a fun, speedy port</a></li>
<li><a href="https://github.com/jarun/nnn/blob/master/README.md">NNN - Tiny, lightning fast, feature-packed file manager Release v2.3</a></li>
<li><a href="https://github.com/aioobe/eta">eta - A tool for monitoring progress and ETA of an arbitrary process<br>
</a></li>
<li><a href="https://www.youtube.com/watch?v=OxB70pg5Tsg&amp;feature=share">A FreeBSD User Tries Out…NetBSD 8.0</a></li>
<li><a href="http://www.grenadille.net/post/2019/02/18/Faster-vlan%284%29-forwarding">Faster vlan(4) forwarding?</a></li>
<li><a href="http://fuguita.org/">FuguIta - OpenBSD 6.4 Live System</a></li>
<li><a href="https://chargen.one/steve/adding-name-based-hosting-to-nginx-on-openbsd-with-acme-client">Adding Name-based hosting To Nginx on OpenBSD with Acme-Client</a></li>
<li><a href="http://polprog.net/blog/netbsd-hax/">HOWTO set up QEMU with HAXM acceleration on NetBSD</a></li>
<li><a href="https://mail-index.netbsd.org/current-users/2019/02/07/msg035054.html">README: gcc 7 switch coming to a port near you!</a></li>
</ul>

<p><hr></p>

<p>##BUG Calendar</p>

<ul>
<li>ChiBUG, Chicago, USA: <a href="https://chibug.org/">Tuesday, February 26th 18:00 at the Oak Park Library</a></li>
<li>CharmBUG, Baltimore, USA: <a href="https://www.meetup.com/CharmBUG/">Wednesday, February 27, 2019<br>
19:30 at Columbia Ale House</a></li>
<li>NYC*BUG, New York, USA: <a href="https://www.nycbug.org/index">Wednesday, March 6, 2019 18:45 at Suspenders</a></li>
<li>KnoxBUG, Knoxville, USA: <a href="http://knoxbug.org">Monday, February 25, 2019 - 18:00 at iX Systems offices </a></li>
<li>BSDPL, Warsaw,  Poland: <a href="https://bsd-pl.org/en">February 28, 2019 18:15 - 21:00 at Wheel Systems Office</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Sam - <a href="http://dpaste.com/2NP4VGE#wrap">Customizing OpenBSD ports source code</a></li>
<li>Frank - <a href="http://dpaste.com/1EHYHQ1#wrap">Rivalry Linux &amp; BSD</a></li>
<li>Zach - <a href="http://dpaste.com/13GGAED">mysql/mariadb tuning</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0286.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Adding glue to a desktop environment, flashing the BIOS on a PC Engine, revive a Cisco IDS into a capable OpenBSD computer, An OpenBSD WindowMaker desktop, RealTime data compression, the love for pipes, and more. </p>

<p>##Headlines<br>
###<a href="https://venam.nixers.net/blog/unix/2019/01/07/win-automation.html">Adding Glue To a Desktop Environment</a></p>

<blockquote>
<p>In this article we will put some light on a lot of tools used in the world of Unix desktop environment customization, particularly regarding wmctrl, wmutils, xev, xtruss, xwininfo, xprop, xdotools, xdo, sxhkd, xbindkeys, speckeysd, xchainkeys, alttab, triggerhappy, gTile, gidmgr, keynav, and more. If those don’t make sense then this article will help. Let’s hope this can open your mind to new possibilities.<br>
With that in mind we can wonder if what’s actually needed from a window manager, presentation and operation, can be split up and complemented with other tools. We can also start thinking laterally, the communication and interaction between the different components of the environment. We have the freedom to do so because the X protocol is transparent and components usually implement many standards for interfacing between windows. It’s like gluing parts together to create a desktop environment.</p>
</blockquote>

<ul>
<li>The tools we’ll talk about fall into one of those categories:</li>
<li>Debugging</li>
<li>Window manipulation</li>
<li>Simulation of interaction</li>
<li>Extended manipulation</li>
<li>Hotkey daemon</li>
<li>Layout manager</li>
</ul>

<p><hr></p>

<p>###<a href="https://github.com/lattera/articles/blob/master/hardware/apu/2019-02-05_flashing_bios/article.md">Flashing the BIOS on the PC Engines APU4c4</a></p>

<blockquote>
<p>I absolutely love the PC Engines APU devices. I use them for testing HardenedBSD experimental features in more constrained 64-bit environments and firewalls.  Their USB and mSATA ports have a few quirks, and I bumped up against a major quirk that required flashing a different BIOS as a workaround. This article details the hacky way in which I went about doing that.<br>
What prompted this article is that something in either the CAM or GEOM layer in FreeBSD 11.2 caused the mSATA to hang, preventing file writes. OPNsense 18.7 uses FreeBSD 11.1 whereas the recently-released OPNsense 19.1 uses HardenedBSD 11.2 (based on FreeBSD 11.2). I reached out to PC Engines directly, and they let me know that the issue is a known BIOS issue. Flashing the “legacy” BIOS series would provide me with a working system.<br>
It also just so happens that a new “legacy” BIOS version was just released which turns on ECC mode for the RAM. So, I get a working OPNsense install AND ECC RAM! I’ll have one bird for dinner, the other for dessert.<br>
Though I’m using an APU4, these instructions should work for the other APU devices. The BIOS ROM download URLs should be changed to reflect the device you’re targeting along with the BIOS version you wish to deploy.<br>
SPECIAL NOTE: There be dragons! I’m primarily writing this article to document the procedure for my own purposes. My memory tends to be pretty faulty these days. So, if something goes wrong, please do not hold me responsible. You’re the one at the keyboard. ;)<br>
VERY SPECIAL NOTE: We’ll use the mSATA drive for swap space, just in case. Should the swap space be used, it will destroy whatever is on the disk.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://komlositech.wordpress.com/2018/12/30/revive-a-cisco-ids-into-a-capable-openbsd-firewall/">Revive a Cisco IDS into a capable OpenBSD computer!</a></p>

<blockquote>
<p>Even though Cisco equipment is very capable, it tends to become End-of-Life before you can say “planned obsolescence”. Websites become bigger, bandwidths increase, and as a side effect of those “improvements”, routers, firewalls, and in this case, intrusion prevention systems get old quicker and quicker.<br>
Apparently, this was also the case for the Cisco IDS-4215 Intrusion Detection Sensor that I was given a few months ago.<br>
I’m not too proud to admit that at first, I didn’t care about the machine itself, but rather about the add-on PCI network card with 4 Fast Ethernet interfaces. The sensor has obviously seen better days, as it had a broken front panel and needed some cleaning, but upon a closer inspection under the hood  (which is held closed by the 4 screws on top), this IDS consists of an embedded Celeron PC with two onboard Ethernet cards, a 2.5″ IDE hard disk, a CF card, and 2 PCI expansion slots (more on them later). Oh, and don’t forget the nasty server-grade fan, which pushed very little air for the noise it was making.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.tumfatig.net/20190215/an-openbsd-desktop-using-windowmaker/?utm_source=discoverbsd">An OpenBSD desktop using WindowMaker</a></p>

<blockquote>
<p>Since I started using *N?X, I’ve regularly used WindowMaker. I’ve always liked the look and feel, the dock system and the dockapps. It may look a bit oldish nowadays. And that’s enough to try to change this. So here it is, a 2019 flavored WindowMaker Desktop, running on OpenBSD 6.4/amd64.<br>
This configuration uses the Nord color-scheme, the Adapta-Nokto-Eta GTK theme and the Moblin Unofficial Icons icon set. I did remove applications icons. I just don’t need them on the bottom of the screen as I heavily use “F11” to pop-up the windows list. To be able to do that and keep the dockapps, I tweaked my ~/GNUstep/Defaults/WMWindowAttributes and created a ~/GNUstep/Library/WindowMaker/Themes/Nord.themed/style.<br>
And here it is, the NeXT OpenBSD Desktop!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://fastcompression.blogspot.com/2019/01/opaque-types-and-static-allocation.html">RealTime Data Compression</a></p>

<blockquote>
<p>In a previous episode, we’ve seen that it is possible to create opaque types. However, creation and destruction of such type must be delegated to some dedicated functions, which themselves rely on dynamic allocation mechanisms.<br>
Sometimes, it can be convenient to bypass the heap, and all its malloc() / free() shenanigans. Pushing a structure onto the stack, or within thread-local storage, are natural capabilities offered by a normal struct. It can be desirable at times.<br>
The previously described opaque type is so secret that it has no size, hence is not suitable for such scenario.<br>
Fortunately, static opaque types are possible.<br>
The main idea is to create a “shell type”, with a known size and an alignment, able to host the target (private) structure.<br>
For safer maintenance, the shell type and the target structure must be kept in sync, by using typically a static assert. It will ensure that the shell type is always large enough to host the target structure. This check is important to automatically detect future evolution of the target structure.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.jessfraz.com/post/for-the-love-of-pipes/">For the Love of Pipes</a></p>

<blockquote>
<p>My top used shell command is |. This is called a pipe.<br>
In brief, the | allows for the output of one program (on the left) to become the input of another program (on the right). It is a way of connecting two commands together.<br>
According to <a href="http://doc.cat-v.org/unix/pipes/">doc.cat-v.org/unix/pipes/</a>, the origin of pipes came long before Unix. Pipes can be traced back to this note from Doug McIlroy in 1964</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://scontent-iad3-1.xx.fbcdn.net/v/t1.0-9/52532824_10216880223150142_5567720793346932736_n.jpg?_nc_cat=100&amp;_nc_ht=scontent-iad3-1.xx&amp;oh=f4de0999bd268725b39969435c1e2d82&amp;oe=5D23255E">Installation Notes for NetBSD/i386 0.9</a></li>
<li><a href="http://coypu.sdf.org/porting-zig.html">Porting Zig to NetBSD - a fun, speedy port</a></li>
<li><a href="https://github.com/jarun/nnn/blob/master/README.md">NNN - Tiny, lightning fast, feature-packed file manager Release v2.3</a></li>
<li><a href="https://github.com/aioobe/eta">eta - A tool for monitoring progress and ETA of an arbitrary process<br>
</a></li>
<li><a href="https://www.youtube.com/watch?v=OxB70pg5Tsg&amp;feature=share">A FreeBSD User Tries Out…NetBSD 8.0</a></li>
<li><a href="http://www.grenadille.net/post/2019/02/18/Faster-vlan%284%29-forwarding">Faster vlan(4) forwarding?</a></li>
<li><a href="http://fuguita.org/">FuguIta - OpenBSD 6.4 Live System</a></li>
<li><a href="https://chargen.one/steve/adding-name-based-hosting-to-nginx-on-openbsd-with-acme-client">Adding Name-based hosting To Nginx on OpenBSD with Acme-Client</a></li>
<li><a href="http://polprog.net/blog/netbsd-hax/">HOWTO set up QEMU with HAXM acceleration on NetBSD</a></li>
<li><a href="https://mail-index.netbsd.org/current-users/2019/02/07/msg035054.html">README: gcc 7 switch coming to a port near you!</a></li>
</ul>

<p><hr></p>

<p>##BUG Calendar</p>

<ul>
<li>ChiBUG, Chicago, USA: <a href="https://chibug.org/">Tuesday, February 26th 18:00 at the Oak Park Library</a></li>
<li>CharmBUG, Baltimore, USA: <a href="https://www.meetup.com/CharmBUG/">Wednesday, February 27, 2019<br>
19:30 at Columbia Ale House</a></li>
<li>NYC*BUG, New York, USA: <a href="https://www.nycbug.org/index">Wednesday, March 6, 2019 18:45 at Suspenders</a></li>
<li>KnoxBUG, Knoxville, USA: <a href="http://knoxbug.org">Monday, February 25, 2019 - 18:00 at iX Systems offices </a></li>
<li>BSDPL, Warsaw,  Poland: <a href="https://bsd-pl.org/en">February 28, 2019 18:15 - 21:00 at Wheel Systems Office</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Sam - <a href="http://dpaste.com/2NP4VGE#wrap">Customizing OpenBSD ports source code</a></li>
<li>Frank - <a href="http://dpaste.com/1EHYHQ1#wrap">Rivalry Linux &amp; BSD</a></li>
<li>Zach - <a href="http://dpaste.com/13GGAED">mysql/mariadb tuning</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>

<video controls preload="metadata" style=" width:426px;  height:240px;">
    <source src="http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0286.mp4" type="video/mp4">
    Your browser does not support the HTML5 video tag.
</video>]]>
  </itunes:summary>
</item>
<item>
  <title>285: BSD Strategy</title>
  <link>https://www.bsdnow.tv/285</link>
  <guid isPermaLink="false">b54701c7-6556-42b3-804d-79a1bf9c6bbe</guid>
  <pubDate>Thu, 14 Feb 2019 10:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b54701c7-6556-42b3-804d-79a1bf9c6bbe.mp3" length="41912862" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Strategic thinking to keep FreeBSD relevant, reflecting on the soul of a new machine, 10GbE Benchmarks On Nine Linux Distros and FreeBSD, NetBSD integrating LLVM sanitizers in base, FreeNAS 11.2 distrowatch review, and more.</itunes:subtitle>
  <itunes:duration>1:09:32</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Strategic thinking to keep FreeBSD relevant, reflecting on the soul of a new machine, 10GbE Benchmarks On Nine Linux Distros and FreeBSD, NetBSD integrating LLVM sanitizers in base, FreeNAS 11.2 distrowatch review, and more.
&lt;p&gt;##Headlines&lt;br&gt;
###&lt;a href="http://www.leidinger.net/blog/2019/01/27/strategic-thinking-or-what-i-think-what-we-need-to-do-to-keep-freebsd-relevant/"&gt;Strategic thinking, or what I think what we need to do to keep FreeBSD relevant&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Since I participate in the FreeBSD project there are from time to time some voices which say FreeBSD is dead, Linux is the way to go. Most of the time those voices are trolls, or people which do not really know what FreeBSD has to offer. Sometimes those voices wear blinders, they only see their own little world (were Linux just works fine) and do not see the big picture (like e.g. competition stimulates business, …) or even dare to look what FreeBSD has to offer.&lt;br&gt;
Sometimes those voices raise a valid concern, and it is up to the FreeBSD project to filter out what would be beneficial. Recently there were some mails on the FreeBSD lists in the sense of “What about going into direction X?”. Some people just had the opinion that we should stay where we are. In my opinion this is similarly bad to blindly saying FreeBSD is dead and following the masses. It would mean stagnation. We should not hold people back in exploring new / different directions. Someone wants to write a kernel module in (a subset of) C++ or in Rust… well, go ahead, give it a try, we can put it into the Ports Collection and let people get experience with it.&lt;br&gt;
This discussion on the mailinglists also triggered some kind of “where do we see us in the next years” / strategic thinking reflection. What I present here, is my very own opinion about things we in the FreeBSD project should look at, to stay relevant in the long term. To be able to put that into scope, I need to clarify what “relevant” means in this case.&lt;br&gt;
FreeBSD is currently used by companies like Netflix, NetApp, Cisco, Juniper, and many others as a base for products or services. It is also used by end‐users as a work‐horse (e.g. mailservers, webservers, …). Staying relevant means in this context, to provide something which the user base is interested in to use and which makes it more easy / fast for the user base to deliver whatever they want or need to deliver than with another kind of system. And this in terms of time to market of a solution (time to deliver a service like a web‐/mail‐/whatever‐server or product), and in terms of performance (which not only means speed, but also security and reliability and …) of the solution.&lt;br&gt;
I have categorized the list of items I think are important into (new) code/features, docs, polishing and project infrastructure. Links in the following usually point to documentation/HOWTOs/experiences for/with FreeBSD, and not to the canonical entry points of the projects or technologies. In a few cases the links point to an explanation in the wikipedia or to the website of the topic in question.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="http://dtrace.org/blogs/bmc/2019/02/10/reflecting-on-the-soul-of-a-new-machine/"&gt;Reflecting on The Soul of a New Machine&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Long ago as an undergraduate, I found myself back home on a break from school, bored and with eyes wandering idly across a family bookshelf. At school, I had started to find a calling in computing systems, and now in the den, an old book suddenly caught my eye: Tracy Kidder’s The Soul of a New Machine. Taking it off the shelf, the book grabbed me from its first descriptions of Tom West, captivating me with the epic tale of the development of the Eagle at Data General. I — like so many before and after me — found the book to be life changing: by telling the stories of the people behind the machine, the book showed the creative passion among engineers that might otherwise appear anodyne, inspiring me to chart a course that might one day allow me to make a similar mark.&lt;br&gt;
Since reading it over two decades ago, I have recommended The Soul of a Machine at essentially every opportunity, believing that it is a part of computing’s literary foundation — that it should be considered our Odyssey. Recently, I suggested it as beach reading to Jess Frazelle, and apparently with perfect timing: when I saw the book at the top of her vacation pile, I knew a fuse had been lit. I was delighted (though not at all surprised) to see Jess livetweet her admiration of the book, starting with the compelling prose, the lucid technical explanations and the visceral anecdotes — but then moving on to the deeper technical inspiration she found in the book. And as she reached the book’s crescendo, Jess felt its full power, causing her to reflect on the nature of engineering motivation.&lt;br&gt;
Excited to see the effect of the book on Jess, I experienced a kind of reflected recommendation: I was inspired to (re-)read my own recommendation! Shortly after I started reading, I began to realize that (contrary to what I had been telling myself over the years!) I had not re-read the book in full since that first reading so many years ago. Rather, over the years I had merely revisited those sections that I remembered fondly. On the one hand, these sections are singular: the saga of engineers debugging a nasty I-cache data corruption issue; the young engineer who implements the simulator in an impossibly short amount of time because no one wanted to tell him that he was being impossibly ambitious; the engineer who, frustrated with a nanosecond-scale timing problem in the ALU that he designed, moved to a commune in Vermont, claiming a desire to deal with “no unit of time shorter than a season”. But by limiting myself to these passages, I was succumbing to the selection bias of my much younger self; re-reading the book now from start to finish has given new parts depth and meaning. Aspects that were more abstract to me as an undergraduate — from the organizational rivalries and absurdities of the industry to the complexities of West’s character and the tribulations of the team down the stretch — are now deeply evocative of concrete episodes of my own career.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;See Article for rest…&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://www.phoronix.com/scan.php?page=article&amp;amp;item=10gbe-linux-freebsd12&amp;amp;num=1"&gt;Out-Of-The-Box 10GbE Network Benchmarks On Nine Linux Distributions Plus FreeBSD 12&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Last week I started running some fresh 10GbE Linux networking performance benchmarks across a few different Linux distributions. That testing has now been extended to cover nine Linux distributions plus FreeBSD 12.0 to compare the out-of-the-box networking performance.&lt;br&gt;
Tested this round alongside FreeBSD 12.0 was Antergos 19.1, CentOS 7, Clear Linux, Debian 9.6, Fedora Server 29, openSUSE Leap 15.0, openSUSE Tumbleweed, Ubuntu 18.04.1 LTS, and Ubuntu 18.10.&lt;br&gt;
All of the tests were done with a Tyan S7106 1U server featuring two Intel Xeon Gold 6138 CPUs, 96GB of DDR4 system memory, and Samsung 970 EVO SSD. For the 10GbE connectivity on this server was an add-in HP NC523SFP PCIe adapter providing two 10Gb SPF+ ports using a QLogic 8214 controller.&lt;br&gt;
Originally the plan as well was to include Windows Server 2016/2019. Unfortunately the QLogic driver download site was malfunctioning since Cavium’s acquisition of the company and the other Windows Server 2016 driver options not panning out and there not being a Windows Server 2019 option. So sadly that Windows testing was thwarted so I since started testing over with a Mellanox Connectx-2 10GbE NIC, which is well supported on Windows Server and so that testing is ongoing for the next article of Windows vs. Linux 10 Gigabit network performance plus some “tuned” Linux networking results too.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blog.netbsd.org/tnf/entry/integration_of_the_llvm_sanitziers"&gt;Integration of the LLVM sanitizers with the NetBSD base system&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Over the past month I’ve merged the LLVM compiler-rt sanitizers (LLVM svn r350590) with the base system. I’ve also managed to get a functional set of Makefile rules to build all of them, namely:&lt;br&gt;
ASan, UBSan, TSan, MSan, libFuzzer, SafeStack, XRay.&lt;br&gt;
In all supported variations and modes that are supported by the original LLVM compiler-rt package.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://distrowatch.com/weekly.php?issue=20190204#freenas"&gt;Distrowatch FreeNAS 11.2 review&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The project’s latest release is FreeNAS 11.2 and, at first, I nearly overlooked the new version because it appeared to be a minor point release. However, a lot of work went into the new version and 11.2 offers a lot of changes when compared next to 11.1, “including a major revamp of the web interface, support for self-encrypting drives, and new, backwards-compatible REST and WebSocket APIs. This update also introduces iocage for improved plugins and jails management and simplified plugin development.”&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://gist.github.com/zeising/5d2402d92b4cf421c7402d663b2d9e41"&gt;Instructions for installing rEFInd to dual boot a computer with FreeBSD and windows (and possibly other OSes as well).&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.unitedbsd.com/d/12-netbsd-desktop-pt-6-vi1-editor-tmux-and-unicode-term"&gt;NetBSD desktop pt.6: “vi(1) editor, tmux and unicode $TERM”&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.geekrant.org/2005/04/01/unix-flowers/"&gt;Unix flowers&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://oshogbo.vexillium.org/blog/62/"&gt;FreeBSD upgrade procedure using GPT&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://chargen.one/steve/backups-on-chargen-one"&gt;Pull-based Backups using OpenBSD base*&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/ozaki-r/netbsd-src/tree/wireguard"&gt;Developing WireGuard for NetBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://zfs.datto.com/"&gt;OpenZFS User Conference, April 18-19, Norwalk CT&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://knoxbug.org/2019-02-25"&gt;KnoxBug Feb 25th&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Jake - &lt;a href="http://dpaste.com/3X7KVVX#wrap"&gt;C Programming&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Farhan - &lt;a href="http://dpaste.com/067WW0P"&gt;Explanation of rtadvd&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Nelson - &lt;a href="http://dpaste.com/2BYGFSV"&gt;Bug Bounties on Open-Source Software&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Strategic thinking to keep FreeBSD relevant, reflecting on the soul of a new machine, 10GbE Benchmarks On Nine Linux Distros and FreeBSD, NetBSD integrating LLVM sanitizers in base, FreeNAS 11.2 distrowatch review, and more.</p>

<p>##Headlines<br>
###<a href="http://www.leidinger.net/blog/2019/01/27/strategic-thinking-or-what-i-think-what-we-need-to-do-to-keep-freebsd-relevant/">Strategic thinking, or what I think what we need to do to keep FreeBSD relevant</a></p>

<blockquote>
<p>Since I participate in the FreeBSD project there are from time to time some voices which say FreeBSD is dead, Linux is the way to go. Most of the time those voices are trolls, or people which do not really know what FreeBSD has to offer. Sometimes those voices wear blinders, they only see their own little world (were Linux just works fine) and do not see the big picture (like e.g. competition stimulates business, …) or even dare to look what FreeBSD has to offer.<br>
Sometimes those voices raise a valid concern, and it is up to the FreeBSD project to filter out what would be beneficial. Recently there were some mails on the FreeBSD lists in the sense of “What about going into direction X?”. Some people just had the opinion that we should stay where we are. In my opinion this is similarly bad to blindly saying FreeBSD is dead and following the masses. It would mean stagnation. We should not hold people back in exploring new / different directions. Someone wants to write a kernel module in (a subset of) C++ or in Rust… well, go ahead, give it a try, we can put it into the Ports Collection and let people get experience with it.<br>
This discussion on the mailinglists also triggered some kind of “where do we see us in the next years” / strategic thinking reflection. What I present here, is my very own opinion about things we in the FreeBSD project should look at, to stay relevant in the long term. To be able to put that into scope, I need to clarify what “relevant” means in this case.<br>
FreeBSD is currently used by companies like Netflix, NetApp, Cisco, Juniper, and many others as a base for products or services. It is also used by end‐users as a work‐horse (e.g. mailservers, webservers, …). Staying relevant means in this context, to provide something which the user base is interested in to use and which makes it more easy / fast for the user base to deliver whatever they want or need to deliver than with another kind of system. And this in terms of time to market of a solution (time to deliver a service like a web‐/mail‐/whatever‐server or product), and in terms of performance (which not only means speed, but also security and reliability and …) of the solution.<br>
I have categorized the list of items I think are important into (new) code/features, docs, polishing and project infrastructure. Links in the following usually point to documentation/HOWTOs/experiences for/with FreeBSD, and not to the canonical entry points of the projects or technologies. In a few cases the links point to an explanation in the wikipedia or to the website of the topic in question.</p>
</blockquote>

<p><hr></p>

<p>###<a href="http://dtrace.org/blogs/bmc/2019/02/10/reflecting-on-the-soul-of-a-new-machine/">Reflecting on The Soul of a New Machine</a></p>

<blockquote>
<p>Long ago as an undergraduate, I found myself back home on a break from school, bored and with eyes wandering idly across a family bookshelf. At school, I had started to find a calling in computing systems, and now in the den, an old book suddenly caught my eye: Tracy Kidder’s The Soul of a New Machine. Taking it off the shelf, the book grabbed me from its first descriptions of Tom West, captivating me with the epic tale of the development of the Eagle at Data General. I — like so many before and after me — found the book to be life changing: by telling the stories of the people behind the machine, the book showed the creative passion among engineers that might otherwise appear anodyne, inspiring me to chart a course that might one day allow me to make a similar mark.<br>
Since reading it over two decades ago, I have recommended The Soul of a Machine at essentially every opportunity, believing that it is a part of computing’s literary foundation — that it should be considered our Odyssey. Recently, I suggested it as beach reading to Jess Frazelle, and apparently with perfect timing: when I saw the book at the top of her vacation pile, I knew a fuse had been lit. I was delighted (though not at all surprised) to see Jess livetweet her admiration of the book, starting with the compelling prose, the lucid technical explanations and the visceral anecdotes — but then moving on to the deeper technical inspiration she found in the book. And as she reached the book’s crescendo, Jess felt its full power, causing her to reflect on the nature of engineering motivation.<br>
Excited to see the effect of the book on Jess, I experienced a kind of reflected recommendation: I was inspired to (re-)read my own recommendation! Shortly after I started reading, I began to realize that (contrary to what I had been telling myself over the years!) I had not re-read the book in full since that first reading so many years ago. Rather, over the years I had merely revisited those sections that I remembered fondly. On the one hand, these sections are singular: the saga of engineers debugging a nasty I-cache data corruption issue; the young engineer who implements the simulator in an impossibly short amount of time because no one wanted to tell him that he was being impossibly ambitious; the engineer who, frustrated with a nanosecond-scale timing problem in the ALU that he designed, moved to a commune in Vermont, claiming a desire to deal with “no unit of time shorter than a season”. But by limiting myself to these passages, I was succumbing to the selection bias of my much younger self; re-reading the book now from start to finish has given new parts depth and meaning. Aspects that were more abstract to me as an undergraduate — from the organizational rivalries and absurdities of the industry to the complexities of West’s character and the tribulations of the team down the stretch — are now deeply evocative of concrete episodes of my own career.</p>
</blockquote>

<ul>
<li>See Article for rest…</li>
</ul>

<p><hr></p>

<p>##News Roundup</p>

<p>###<a href="https://www.phoronix.com/scan.php?page=article&amp;item=10gbe-linux-freebsd12&amp;num=1">Out-Of-The-Box 10GbE Network Benchmarks On Nine Linux Distributions Plus FreeBSD 12</a></p>

<blockquote>
<p>Last week I started running some fresh 10GbE Linux networking performance benchmarks across a few different Linux distributions. That testing has now been extended to cover nine Linux distributions plus FreeBSD 12.0 to compare the out-of-the-box networking performance.<br>
Tested this round alongside FreeBSD 12.0 was Antergos 19.1, CentOS 7, Clear Linux, Debian 9.6, Fedora Server 29, openSUSE Leap 15.0, openSUSE Tumbleweed, Ubuntu 18.04.1 LTS, and Ubuntu 18.10.<br>
All of the tests were done with a Tyan S7106 1U server featuring two Intel Xeon Gold 6138 CPUs, 96GB of DDR4 system memory, and Samsung 970 EVO SSD. For the 10GbE connectivity on this server was an add-in HP NC523SFP PCIe adapter providing two 10Gb SPF+ ports using a QLogic 8214 controller.<br>
Originally the plan as well was to include Windows Server 2016/2019. Unfortunately the QLogic driver download site was malfunctioning since Cavium’s acquisition of the company and the other Windows Server 2016 driver options not panning out and there not being a Windows Server 2019 option. So sadly that Windows testing was thwarted so I since started testing over with a Mellanox Connectx-2 10GbE NIC, which is well supported on Windows Server and so that testing is ongoing for the next article of Windows vs. Linux 10 Gigabit network performance plus some “tuned” Linux networking results too.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/integration_of_the_llvm_sanitziers">Integration of the LLVM sanitizers with the NetBSD base system</a></p>

<blockquote>
<p>Over the past month I’ve merged the LLVM compiler-rt sanitizers (LLVM svn r350590) with the base system. I’ve also managed to get a functional set of Makefile rules to build all of them, namely:<br>
ASan, UBSan, TSan, MSan, libFuzzer, SafeStack, XRay.<br>
In all supported variations and modes that are supported by the original LLVM compiler-rt package.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://distrowatch.com/weekly.php?issue=20190204#freenas">Distrowatch FreeNAS 11.2 review</a></p>

<blockquote>
<p>The project’s latest release is FreeNAS 11.2 and, at first, I nearly overlooked the new version because it appeared to be a minor point release. However, a lot of work went into the new version and 11.2 offers a lot of changes when compared next to 11.1, “including a major revamp of the web interface, support for self-encrypting drives, and new, backwards-compatible REST and WebSocket APIs. This update also introduces iocage for improved plugins and jails management and simplified plugin development.”</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://gist.github.com/zeising/5d2402d92b4cf421c7402d663b2d9e41">Instructions for installing rEFInd to dual boot a computer with FreeBSD and windows (and possibly other OSes as well).</a></li>
<li><a href="https://www.unitedbsd.com/d/12-netbsd-desktop-pt-6-vi1-editor-tmux-and-unicode-term">NetBSD desktop pt.6: “vi(1) editor, tmux and unicode $TERM”</a></li>
<li><a href="https://www.geekrant.org/2005/04/01/unix-flowers/">Unix flowers</a></li>
<li><a href="https://oshogbo.vexillium.org/blog/62/">FreeBSD upgrade procedure using GPT</a></li>
<li><a href="https://chargen.one/steve/backups-on-chargen-one">Pull-based Backups using OpenBSD base*</a></li>
<li><a href="https://github.com/ozaki-r/netbsd-src/tree/wireguard">Developing WireGuard for NetBSD</a></li>
<li><a href="https://zfs.datto.com/">OpenZFS User Conference, April 18-19, Norwalk CT</a></li>
<li><a href="http://knoxbug.org/2019-02-25">KnoxBug Feb 25th</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Jake - <a href="http://dpaste.com/3X7KVVX#wrap">C Programming</a></li>
<li>Farhan - <a href="http://dpaste.com/067WW0P">Explanation of rtadvd</a></li>
<li>Nelson - <a href="http://dpaste.com/2BYGFSV">Bug Bounties on Open-Source Software</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Strategic thinking to keep FreeBSD relevant, reflecting on the soul of a new machine, 10GbE Benchmarks On Nine Linux Distros and FreeBSD, NetBSD integrating LLVM sanitizers in base, FreeNAS 11.2 distrowatch review, and more.</p>

<p>##Headlines<br>
###<a href="http://www.leidinger.net/blog/2019/01/27/strategic-thinking-or-what-i-think-what-we-need-to-do-to-keep-freebsd-relevant/">Strategic thinking, or what I think what we need to do to keep FreeBSD relevant</a></p>

<blockquote>
<p>Since I participate in the FreeBSD project there are from time to time some voices which say FreeBSD is dead, Linux is the way to go. Most of the time those voices are trolls, or people which do not really know what FreeBSD has to offer. Sometimes those voices wear blinders, they only see their own little world (were Linux just works fine) and do not see the big picture (like e.g. competition stimulates business, …) or even dare to look what FreeBSD has to offer.<br>
Sometimes those voices raise a valid concern, and it is up to the FreeBSD project to filter out what would be beneficial. Recently there were some mails on the FreeBSD lists in the sense of “What about going into direction X?”. Some people just had the opinion that we should stay where we are. In my opinion this is similarly bad to blindly saying FreeBSD is dead and following the masses. It would mean stagnation. We should not hold people back in exploring new / different directions. Someone wants to write a kernel module in (a subset of) C++ or in Rust… well, go ahead, give it a try, we can put it into the Ports Collection and let people get experience with it.<br>
This discussion on the mailinglists also triggered some kind of “where do we see us in the next years” / strategic thinking reflection. What I present here, is my very own opinion about things we in the FreeBSD project should look at, to stay relevant in the long term. To be able to put that into scope, I need to clarify what “relevant” means in this case.<br>
FreeBSD is currently used by companies like Netflix, NetApp, Cisco, Juniper, and many others as a base for products or services. It is also used by end‐users as a work‐horse (e.g. mailservers, webservers, …). Staying relevant means in this context, to provide something which the user base is interested in to use and which makes it more easy / fast for the user base to deliver whatever they want or need to deliver than with another kind of system. And this in terms of time to market of a solution (time to deliver a service like a web‐/mail‐/whatever‐server or product), and in terms of performance (which not only means speed, but also security and reliability and …) of the solution.<br>
I have categorized the list of items I think are important into (new) code/features, docs, polishing and project infrastructure. Links in the following usually point to documentation/HOWTOs/experiences for/with FreeBSD, and not to the canonical entry points of the projects or technologies. In a few cases the links point to an explanation in the wikipedia or to the website of the topic in question.</p>
</blockquote>

<p><hr></p>

<p>###<a href="http://dtrace.org/blogs/bmc/2019/02/10/reflecting-on-the-soul-of-a-new-machine/">Reflecting on The Soul of a New Machine</a></p>

<blockquote>
<p>Long ago as an undergraduate, I found myself back home on a break from school, bored and with eyes wandering idly across a family bookshelf. At school, I had started to find a calling in computing systems, and now in the den, an old book suddenly caught my eye: Tracy Kidder’s The Soul of a New Machine. Taking it off the shelf, the book grabbed me from its first descriptions of Tom West, captivating me with the epic tale of the development of the Eagle at Data General. I — like so many before and after me — found the book to be life changing: by telling the stories of the people behind the machine, the book showed the creative passion among engineers that might otherwise appear anodyne, inspiring me to chart a course that might one day allow me to make a similar mark.<br>
Since reading it over two decades ago, I have recommended The Soul of a Machine at essentially every opportunity, believing that it is a part of computing’s literary foundation — that it should be considered our Odyssey. Recently, I suggested it as beach reading to Jess Frazelle, and apparently with perfect timing: when I saw the book at the top of her vacation pile, I knew a fuse had been lit. I was delighted (though not at all surprised) to see Jess livetweet her admiration of the book, starting with the compelling prose, the lucid technical explanations and the visceral anecdotes — but then moving on to the deeper technical inspiration she found in the book. And as she reached the book’s crescendo, Jess felt its full power, causing her to reflect on the nature of engineering motivation.<br>
Excited to see the effect of the book on Jess, I experienced a kind of reflected recommendation: I was inspired to (re-)read my own recommendation! Shortly after I started reading, I began to realize that (contrary to what I had been telling myself over the years!) I had not re-read the book in full since that first reading so many years ago. Rather, over the years I had merely revisited those sections that I remembered fondly. On the one hand, these sections are singular: the saga of engineers debugging a nasty I-cache data corruption issue; the young engineer who implements the simulator in an impossibly short amount of time because no one wanted to tell him that he was being impossibly ambitious; the engineer who, frustrated with a nanosecond-scale timing problem in the ALU that he designed, moved to a commune in Vermont, claiming a desire to deal with “no unit of time shorter than a season”. But by limiting myself to these passages, I was succumbing to the selection bias of my much younger self; re-reading the book now from start to finish has given new parts depth and meaning. Aspects that were more abstract to me as an undergraduate — from the organizational rivalries and absurdities of the industry to the complexities of West’s character and the tribulations of the team down the stretch — are now deeply evocative of concrete episodes of my own career.</p>
</blockquote>

<ul>
<li>See Article for rest…</li>
</ul>

<p><hr></p>

<p>##News Roundup</p>

<p>###<a href="https://www.phoronix.com/scan.php?page=article&amp;item=10gbe-linux-freebsd12&amp;num=1">Out-Of-The-Box 10GbE Network Benchmarks On Nine Linux Distributions Plus FreeBSD 12</a></p>

<blockquote>
<p>Last week I started running some fresh 10GbE Linux networking performance benchmarks across a few different Linux distributions. That testing has now been extended to cover nine Linux distributions plus FreeBSD 12.0 to compare the out-of-the-box networking performance.<br>
Tested this round alongside FreeBSD 12.0 was Antergos 19.1, CentOS 7, Clear Linux, Debian 9.6, Fedora Server 29, openSUSE Leap 15.0, openSUSE Tumbleweed, Ubuntu 18.04.1 LTS, and Ubuntu 18.10.<br>
All of the tests were done with a Tyan S7106 1U server featuring two Intel Xeon Gold 6138 CPUs, 96GB of DDR4 system memory, and Samsung 970 EVO SSD. For the 10GbE connectivity on this server was an add-in HP NC523SFP PCIe adapter providing two 10Gb SPF+ ports using a QLogic 8214 controller.<br>
Originally the plan as well was to include Windows Server 2016/2019. Unfortunately the QLogic driver download site was malfunctioning since Cavium’s acquisition of the company and the other Windows Server 2016 driver options not panning out and there not being a Windows Server 2019 option. So sadly that Windows testing was thwarted so I since started testing over with a Mellanox Connectx-2 10GbE NIC, which is well supported on Windows Server and so that testing is ongoing for the next article of Windows vs. Linux 10 Gigabit network performance plus some “tuned” Linux networking results too.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/integration_of_the_llvm_sanitziers">Integration of the LLVM sanitizers with the NetBSD base system</a></p>

<blockquote>
<p>Over the past month I’ve merged the LLVM compiler-rt sanitizers (LLVM svn r350590) with the base system. I’ve also managed to get a functional set of Makefile rules to build all of them, namely:<br>
ASan, UBSan, TSan, MSan, libFuzzer, SafeStack, XRay.<br>
In all supported variations and modes that are supported by the original LLVM compiler-rt package.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://distrowatch.com/weekly.php?issue=20190204#freenas">Distrowatch FreeNAS 11.2 review</a></p>

<blockquote>
<p>The project’s latest release is FreeNAS 11.2 and, at first, I nearly overlooked the new version because it appeared to be a minor point release. However, a lot of work went into the new version and 11.2 offers a lot of changes when compared next to 11.1, “including a major revamp of the web interface, support for self-encrypting drives, and new, backwards-compatible REST and WebSocket APIs. This update also introduces iocage for improved plugins and jails management and simplified plugin development.”</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://gist.github.com/zeising/5d2402d92b4cf421c7402d663b2d9e41">Instructions for installing rEFInd to dual boot a computer with FreeBSD and windows (and possibly other OSes as well).</a></li>
<li><a href="https://www.unitedbsd.com/d/12-netbsd-desktop-pt-6-vi1-editor-tmux-and-unicode-term">NetBSD desktop pt.6: “vi(1) editor, tmux and unicode $TERM”</a></li>
<li><a href="https://www.geekrant.org/2005/04/01/unix-flowers/">Unix flowers</a></li>
<li><a href="https://oshogbo.vexillium.org/blog/62/">FreeBSD upgrade procedure using GPT</a></li>
<li><a href="https://chargen.one/steve/backups-on-chargen-one">Pull-based Backups using OpenBSD base*</a></li>
<li><a href="https://github.com/ozaki-r/netbsd-src/tree/wireguard">Developing WireGuard for NetBSD</a></li>
<li><a href="https://zfs.datto.com/">OpenZFS User Conference, April 18-19, Norwalk CT</a></li>
<li><a href="http://knoxbug.org/2019-02-25">KnoxBug Feb 25th</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Jake - <a href="http://dpaste.com/3X7KVVX#wrap">C Programming</a></li>
<li>Farhan - <a href="http://dpaste.com/067WW0P">Explanation of rtadvd</a></li>
<li>Nelson - <a href="http://dpaste.com/2BYGFSV">Bug Bounties on Open-Source Software</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>284: FOSDEM 2019</title>
  <link>https://www.bsdnow.tv/284</link>
  <guid isPermaLink="false">9e51096d-3e53-490c-8603-827a76d73758</guid>
  <pubDate>Thu, 07 Feb 2019 11:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9e51096d-3e53-490c-8603-827a76d73758.mp3" length="35850359" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We recap FOSDEM 2019, FreeBSD Foundation January update, OPNsense 19.1 released, the hardware-assisted virtualization challenge, ZFS and GPL terror, ClonOS 19.01-RELEASE, and more.</itunes:subtitle>
  <itunes:duration>59:26</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We recap FOSDEM 2019, FreeBSD Foundation January update, OPNsense 19.1 released, the hardware-assisted virtualization challenge, ZFS and GPL terror, ClonOS 19.01-RELEASE, and more.
&lt;h1&gt;Headlines&lt;/h1&gt;
&lt;h3&gt;&lt;a href="https://fosdem.org/2019/schedule/"&gt;FOSDEM 2019 Recap&lt;/a&gt;&lt;/h3&gt;
&lt;ul&gt;
&lt;li&gt;Allan and I were at FOSDEM 2019 in Brussels, Belgium over the weekend.&lt;/li&gt;
&lt;li&gt;On the Friday before, we held a FreeBSD Devsummit in a hotel conference room, with 25 people attending. We talked about various topics of interest to the project. You can find the &lt;a href="https://wiki.freebsd.org/Devsummit/201902"&gt;notes on the wiki page&lt;/a&gt;.&lt;/li&gt;
&lt;li&gt;Saturday was the first day of FOSDEM. The FreeBSD Project had a table next to the Illumos Project again. A lot of people visited our table, asked questions, or just said “Hi, I watch &lt;a href="http://BSDNow.tv"&gt;BSDNow.tv&lt;/a&gt; every week”. We handed out a lot of stickers, pens, swag, and flyers. There was also a full day &lt;a href="https://twitter.com/fosdembsd"&gt;BSD devroom&lt;/a&gt;, with a &lt;a href="https://fosdem.org/2019/schedule/track/bsd/"&gt;variety of talks&lt;/a&gt; that were well attended.&lt;/li&gt;
&lt;li&gt;In the main conference track, Allan held a &lt;a href="https://fosdem.org/2019/schedule/event/zfs_caching/"&gt;talk explaining how the ZFS ARC works&lt;/a&gt;. A lot of people attended the talk and had more questions afterwards. Another well attended talk was by Jonathan Looney about &lt;a href="https://fosdem.org/2019/schedule/event/netflix_freebsd/"&gt;Netflix and FreeBSD&lt;/a&gt;.&lt;/li&gt;
&lt;li&gt;Sunday was another day in the same format, but no bsd devroom. A lot of people visited our table, developers and users alike. A lot of meeting and greeting went on.&lt;/li&gt;
&lt;li&gt;Overall, FOSDEM was a great success with FreeBSD showing a lot of presence. Thanks to all the people who attended and talked to us. Special thanks to the people who helped out at the FreeBSD table and Rodrigo Osorio for running the BSD devroom again.&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;&lt;a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-january-2019/"&gt;FreeBSD Foundation Update, January 2019&lt;/a&gt;&lt;/h3&gt;
&lt;blockquote&gt;
&lt;p&gt;Dear FreeBSD Community Member,&lt;br&gt;
Happy New Year! It’s always exciting starting the new year with ambitious plans to support FreeBSD in new and existing areas. We achieved our fundraising goal for 2018, so we plan on funding a lot of work this year! Though it’s the new year, this newsletter highlights some of the work we accomplished in December. We also put together a list of technologies and features we are considering supporting, and are looking for feedback on what users want to help inform our 2019 development plans.  Our advocacy and education efforts are in full swing as we prepare for upcoming conferences including FOSDEM, SANOG33, and SCaLE.&lt;br&gt;
Finally, we created a year-end video to talk about the work we did in 2018. That in itself was an endeavor, so please take a few minutes to watch it! We’re working on improving the methods we use to inform the community on the work we are doing to support the Project, and are always open to feedback. Now, sit back, grab a refreshing beverage, and enjoy our newsletter!&lt;br&gt;
Happy reading!!&lt;br&gt;
Deb&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://forum.opnsense.org/index.php?topic=11398.0"&gt;OPNsense 19.1 released&lt;/a&gt;&lt;/h3&gt;
&lt;blockquote&gt;
&lt;p&gt;For more than four years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.&lt;br&gt;
The 19.1 release, nicknamed “Inspiring Iguana”, consists of a total of 620 individual changes since 18.7 came out 6 months ago, spread out over 12 intermediate releases including the recent release candidates. That is the average of 2 stable releases per month, security updates and important bug fixes included! If we had to pick a few highlights it would be: The firewall alias API is finally in place. The migration to HardenedBSD 11.2 has been completed. 2FA now works with a remote LDAP / local TOTP combination. And the OpenVPN client export was rewritten for full API support as well.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;These are the most prominent changes since version 18.7:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;fully functional firewall alias API&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;PIE firewall shaper support&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;firewall NAT rule logging support&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;2FA via LDAP-TOTP combination&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;WPAD / PAC and parent proxy support in the web proxy&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;P12 certificate export with custom passwords&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Dpinger is now the default gateway monitor&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ET Pro Telemetry edition plugin[2]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;extended IPv6 DUID support&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Dnsmasq DNSSEC support&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;OpenVPN client export API&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Realtek NIC driver version 1.95&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;HardenedBSD 11.2, LibreSSL 2.7&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Unbound 1.8, Suricata 4.1&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Phalcon 3.4, Perl 5.28&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;firmware health check extended to cover all OS files, HTTPS mirror default&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;updates are browser cache-safe regarding CSS and JavaScript assets&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;collapsible side bar menu in the default theme&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;language updates for Chinese, Czech, French, German, Japanese, Portuguese and Russian&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;API backup export, Bind, Hardware widget, Nginx, Ntopng, VnStat and Dnscrypt-proxy plugins&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Here are the full changes against version 19.1-RC2:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ipsec: add firewall interface as soon as phase 1 is enabled&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ipsec: phase 1 selection GUI JavaScript compatibility fix&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;monit: widget improvements and bug fix (contributed by Frank Brendel)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ui: fix regression in single host or network subnet select in static pages&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;plugins: os-frr 1.7 updates OSFP outbound rules (contributed by Fabian Franz)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;plugins: os-telegraf 1.7.4 fixes packet filter input&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;plugins: os-theme-rebellion 1.8.2 adds image colour invert&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;plugins: os-vnstat 1.1[3]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;plugins: os-zabbix-agent now uses Zabbix version 4.0&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;src: revert mmccalculateclock() as HS200/HS400 support breaks legacy support&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;src: update sqlite3-3.20.0 to sqlite3-3.26.0[4]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;src: import tzdata 2018h, 2018i[5]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;src: avoid unsynchronized updates to knstatus[6]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ports: carootnss 3.42&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ports: dhcp6c 20190128 prevent rawops double-free (contributed by Team Rebellion)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ports: sudo patch to fix listpw=never[7]&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;
&lt;h3&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/thehardwareassistedvirtualizationchallenge"&gt;The hardware-assisted virtualization challenge&lt;/a&gt;&lt;/h3&gt;
&lt;blockquote&gt;
&lt;p&gt;Over two years ago, I made a pledge to use NetBSD as my sole OS and only operating system, and to resist booting into any other OS until I had implemented hardware-accelerated virtualization in the NetBSD kernel (the equivalent of Linux’ KVM, or Hyper-V).&lt;br&gt;
Today, I am here to report: Mission Accomplished!&lt;br&gt;
It’s been a long road, but we now have hardware-accelerated virtualization in the kernel! And while I had only initially planned to get Oracle VirtualBox working, I have with the help of the Intel HAXM engine (the same backend used for virtualization in Android Studio) and a qemu frontend, successfully managed to boot a range of mainstream operating systems.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://eerielinux.wordpress.com/2019/01/28/zfs-and-gpl-terror-how-much-freedom-is-there-in-linux/"&gt;ZFS and GPL terror: How much freedom is there in Linux?&lt;/a&gt;&lt;/h3&gt;
&lt;ul&gt;
&lt;li&gt;ZFS – the undesirable guest&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;ZFS is todays most advanced filesystem. It originated on the Solaris operating system and thanks to Sun’s decision to open it up, we have it available on quite a number of Unix-like operating systems. That’s just great! Great for everyone.&lt;br&gt;
For everyone? Nope. There are people out there who don’t like ZFS. Which is totally fine, they don’t need to use it after all. But worse: There are people who actively hate ZFS and think that others should not use it. Ok, it’s nothing new that some random guys on the net are acting like assholes, trying to tell you what you must not do, right? Whoever has been online for more than a couple of days probably already got used to it. Unfortunately its still worse: One such spoilsport is Greg Kroah-Hartman, Linux guru and informal second-in-command after Linus Torvalds.&lt;br&gt;
There have been some attempts to defend the stance of this kernel developer. One was to point at the fact that the “ZFS on Linux” (ZoL) port uses two kernel functions, _kernelfpubegin() and _kernelfpuend(), which have been deprecated for a very long time and that it makes sense to finally get rid of them since nothing in-kernel uses it anymore. Nobody is going to argue against that. The problem becomes clear by looking at the bigger picture, though:&lt;br&gt;
The need for functions doing just what the old ones did has of course not vanished. The functions have been replaced with other ones. And those ones are deliberately made GPL-only. Yes, that’s right: There’s no technical reason whatsoever! It’s purely ideology – and it’s a terrible one.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://clonos.tekroutine.com/"&gt;ClonOS 19.01-RELEASE&lt;/a&gt;&lt;/h3&gt;
&lt;blockquote&gt;
&lt;p&gt;ClonOS is a turnkey Open Source platform based on FreeBSD and the CBSD framework. ClonOS offers a complete web UI for easily controlling, deploying and managing FreeBSD jails containers and Bhyve/Xen hyperviser virtual environments.&lt;br&gt;
ClonOS is currently the only platform available which allow both Xen and Bhyve hypervisor to coexist on the same host. Being a FreeBSD base platform, ClonOS ability to create and manage jails allows you to run FreeBSD applications without losing performance.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Features:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;easy management via web UI interface&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;live Bhyve migration [coming soon, roadmap]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Bhyve management (create, delete VM)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Xen management (create, delete VM) [coming soon, roadmap]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;connection to the “physical” guest console via VNC from the browser or directly&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Real time system monitoring&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;access to load statistics through SQLite3 and beanstalkd&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;support for ZFS features (cloning, snapshots)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;import/export of virtual environments&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;public repository with virtual machine templates&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;puppet-based helpers for configuring popular services&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ClonOS is a free open-source FreeBSD-based platform for virtual environments creation and management. In the core:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;FreeBSD OS as hoster platform&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;bhyve(8) as hypervisor engine&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Xen as hypervisor engine&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;vale(4) as Virtual Ethernet Switch&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;jail(8) as container engine&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;CBSD Project as management tools&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Puppet as configuration management&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.undeadly.org/cgi?action=article;sid=20190128061321"&gt;Florian Obser on unwind(8)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.reddit.com/r/commandline/comments/amq947/alowtechsmsgatewayforfunandnoprofit/"&gt;A low tech SMS gateway for fun and no profit&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://fosdem.org/2019/schedule/event/netflix_freebsd/attachments/slides/3103/export/events/attachments/netflix_freebsd/slides/3103/FOSDEM_2019_Netflix_and_FreeBSD.pdf"&gt;Netflix and FreeBSD : Using Open Source to Deliver Streaming Video&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/lonkamikaze/powerdxx/releases/tag/0.4.0"&gt;powerd++ 0.4.0 release&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.infoq.com/presentations/os-rust"&gt;Is it time to rewrite the operating system in Rust?&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/changeset/base/343673"&gt;Small change, big effect&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/BSD-Users-Stockholm/events/257281738/"&gt;Swedish BSD Meetup, Feb 19, 2019&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/en-US/Polish-BSD-User-Group/events/zkhlnqyzdbsb/"&gt;Polish BSD User Group Meetup, Feb 21, 2019&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;
&lt;ul&gt;
&lt;li&gt;Casey - &lt;a href="http://dpaste.com/2MA7HRV#wrap"&gt;Cool new Digital Ocean Feature&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Morgan - &lt;a href="http://dpaste.com/1QDAMYJ#wrap"&gt;Jail w/differnet version of FreeBSD&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Brad - &lt;a href="http://dpaste.com/2XG5KXN#wrap"&gt;FreeBSD Installer&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We recap FOSDEM 2019, FreeBSD Foundation January update, OPNsense 19.1 released, the hardware-assisted virtualization challenge, ZFS and GPL terror, ClonOS 19.01-RELEASE, and more.</p>

<h1>Headlines</h1>

<h3><a href="https://fosdem.org/2019/schedule/">FOSDEM 2019 Recap</a></h3>

<ul>
<li>Allan and I were at FOSDEM 2019 in Brussels, Belgium over the weekend.</li>
<li>On the Friday before, we held a FreeBSD Devsummit in a hotel conference room, with 25 people attending. We talked about various topics of interest to the project. You can find the <a href="https://wiki.freebsd.org/Devsummit/201902">notes on the wiki page</a>.</li>
<li>Saturday was the first day of FOSDEM. The FreeBSD Project had a table next to the Illumos Project again. A lot of people visited our table, asked questions, or just said “Hi, I watch <a href="http://BSDNow.tv">BSDNow.tv</a> every week”. We handed out a lot of stickers, pens, swag, and flyers. There was also a full day <a href="https://twitter.com/fosdembsd">BSD devroom</a>, with a <a href="https://fosdem.org/2019/schedule/track/bsd/">variety of talks</a> that were well attended.</li>
<li>In the main conference track, Allan held a <a href="https://fosdem.org/2019/schedule/event/zfs_caching/">talk explaining how the ZFS ARC works</a>. A lot of people attended the talk and had more questions afterwards. Another well attended talk was by Jonathan Looney about <a href="https://fosdem.org/2019/schedule/event/netflix_freebsd/">Netflix and FreeBSD</a>.</li>
<li>Sunday was another day in the same format, but no bsd devroom. A lot of people visited our table, developers and users alike. A lot of meeting and greeting went on.</li>
<li>Overall, FOSDEM was a great success with FreeBSD showing a lot of presence. Thanks to all the people who attended and talked to us. Special thanks to the people who helped out at the FreeBSD table and Rodrigo Osorio for running the BSD devroom again.</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-january-2019/">FreeBSD Foundation Update, January 2019</a></h3>

<blockquote>
<p>Dear FreeBSD Community Member,<br>
Happy New Year! It’s always exciting starting the new year with ambitious plans to support FreeBSD in new and existing areas. We achieved our fundraising goal for 2018, so we plan on funding a lot of work this year! Though it’s the new year, this newsletter highlights some of the work we accomplished in December. We also put together a list of technologies and features we are considering supporting, and are looking for feedback on what users want to help inform our 2019 development plans.  Our advocacy and education efforts are in full swing as we prepare for upcoming conferences including FOSDEM, SANOG33, and SCaLE.<br>
Finally, we created a year-end video to talk about the work we did in 2018. That in itself was an endeavor, so please take a few minutes to watch it! We’re working on improving the methods we use to inform the community on the work we are doing to support the Project, and are always open to feedback. Now, sit back, grab a refreshing beverage, and enjoy our newsletter!<br>
Happy reading!!<br>
Deb</p>
</blockquote>

<p><hr></p>

<h3><a href="https://forum.opnsense.org/index.php?topic=11398.0">OPNsense 19.1 released</a></h3>

<blockquote>
<p>For more than four years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.<br>
The 19.1 release, nicknamed “Inspiring Iguana”, consists of a total of 620 individual changes since 18.7 came out 6 months ago, spread out over 12 intermediate releases including the recent release candidates. That is the average of 2 stable releases per month, security updates and important bug fixes included! If we had to pick a few highlights it would be: The firewall alias API is finally in place. The migration to HardenedBSD 11.2 has been completed. 2FA now works with a remote LDAP / local TOTP combination. And the OpenVPN client export was rewritten for full API support as well.</p>
</blockquote>

<ul>
<li>
<p>These are the most prominent changes since version 18.7:</p>
</li>
<li>
<p>fully functional firewall alias API</p>
</li>
<li>
<p>PIE firewall shaper support</p>
</li>
<li>
<p>firewall NAT rule logging support</p>
</li>
<li>
<p>2FA via LDAP-TOTP combination</p>
</li>
<li>
<p>WPAD / PAC and parent proxy support in the web proxy</p>
</li>
<li>
<p>P12 certificate export with custom passwords</p>
</li>
<li>
<p>Dpinger is now the default gateway monitor</p>
</li>
<li>
<p>ET Pro Telemetry edition plugin[2]</p>
</li>
<li>
<p>extended IPv6 DUID support</p>
</li>
<li>
<p>Dnsmasq DNSSEC support</p>
</li>
<li>
<p>OpenVPN client export API</p>
</li>
<li>
<p>Realtek NIC driver version 1.95</p>
</li>
<li>
<p>HardenedBSD 11.2, LibreSSL 2.7</p>
</li>
<li>
<p>Unbound 1.8, Suricata 4.1</p>
</li>
<li>
<p>Phalcon 3.4, Perl 5.28</p>
</li>
<li>
<p>firmware health check extended to cover all OS files, HTTPS mirror default</p>
</li>
<li>
<p>updates are browser cache-safe regarding CSS and JavaScript assets</p>
</li>
<li>
<p>collapsible side bar menu in the default theme</p>
</li>
<li>
<p>language updates for Chinese, Czech, French, German, Japanese, Portuguese and Russian</p>
</li>
<li>
<p>API backup export, Bind, Hardware widget, Nginx, Ntopng, VnStat and Dnscrypt-proxy plugins</p>
</li>
<li>
<p>Here are the full changes against version 19.1-RC2:</p>
</li>
<li>
<p>ipsec: add firewall interface as soon as phase 1 is enabled</p>
</li>
<li>
<p>ipsec: phase 1 selection GUI JavaScript compatibility fix</p>
</li>
<li>
<p>monit: widget improvements and bug fix (contributed by Frank Brendel)</p>
</li>
<li>
<p>ui: fix regression in single host or network subnet select in static pages</p>
</li>
<li>
<p>plugins: os-frr 1.7 updates OSFP outbound rules (contributed by Fabian Franz)</p>
</li>
<li>
<p>plugins: os-telegraf 1.7.4 fixes packet filter input</p>
</li>
<li>
<p>plugins: os-theme-rebellion 1.8.2 adds image colour invert</p>
</li>
<li>
<p>plugins: os-vnstat 1.1[3]</p>
</li>
<li>
<p>plugins: os-zabbix-agent now uses Zabbix version 4.0</p>
</li>
<li>
<p>src: revert mmc_calculate_clock() as HS200/HS400 support breaks legacy support</p>
</li>
<li>
<p>src: update sqlite3-3.20.0 to sqlite3-3.26.0[4]</p>
</li>
<li>
<p>src: import tzdata 2018h, 2018i[5]</p>
</li>
<li>
<p>src: avoid unsynchronized updates to kn_status[6]</p>
</li>
<li>
<p>ports: ca_root_nss 3.42</p>
</li>
<li>
<p>ports: dhcp6c 20190128 prevent rawops double-free (contributed by Team Rebellion)</p>
</li>
<li>
<p>ports: sudo patch to fix listpw=never[7]</p>
</li>
</ul>

<p><hr></p>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/the_hardware_assisted_virtualization_challenge">The hardware-assisted virtualization challenge</a></h3>

<blockquote>
<p>Over two years ago, I made a pledge to use NetBSD as my sole OS and only operating system, and to resist booting into any other OS until I had implemented hardware-accelerated virtualization in the NetBSD kernel (the equivalent of Linux’ KVM, or Hyper-V).<br>
Today, I am here to report: Mission Accomplished!<br>
It’s been a long road, but we now have hardware-accelerated virtualization in the kernel! And while I had only initially planned to get Oracle VirtualBox working, I have with the help of the Intel HAXM engine (the same backend used for virtualization in Android Studio) and a qemu frontend, successfully managed to boot a range of mainstream operating systems.</p>
</blockquote>

<p><hr></p>

<h3><a href="https://eerielinux.wordpress.com/2019/01/28/zfs-and-gpl-terror-how-much-freedom-is-there-in-linux/">ZFS and GPL terror: How much freedom is there in Linux?</a></h3>

<ul>
<li>ZFS – the undesirable guest</li>
</ul>

<blockquote>
<p>ZFS is todays most advanced filesystem. It originated on the Solaris operating system and thanks to Sun’s decision to open it up, we have it available on quite a number of Unix-like operating systems. That’s just great! Great for everyone.<br>
For everyone? Nope. There are people out there who don’t like ZFS. Which is totally fine, they don’t need to use it after all. But worse: There are people who actively hate ZFS and think that others should not use it. Ok, it’s nothing new that some random guys on the net are acting like assholes, trying to tell you what you must not do, right? Whoever has been online for more than a couple of days probably already got used to it. Unfortunately its still worse: One such spoilsport is Greg Kroah-Hartman, Linux guru and informal second-in-command after Linus Torvalds.<br>
There have been some attempts to defend the stance of this kernel developer. One was to point at the fact that the “ZFS on Linux” (ZoL) port uses two kernel functions, __kernel_fpu_begin() and __kernel_fpu_end(), which have been deprecated for a very long time and that it makes sense to finally get rid of them since nothing in-kernel uses it anymore. Nobody is going to argue against that. The problem becomes clear by looking at the bigger picture, though:<br>
The need for functions doing just what the old ones did has of course not vanished. The functions have been replaced with other ones. And those ones are deliberately made GPL-only. Yes, that’s right: There’s no technical reason whatsoever! It’s purely ideology – and it’s a terrible one.</p>
</blockquote>

<p><hr></p>

<h3><a href="https://clonos.tekroutine.com/">ClonOS 19.01-RELEASE</a></h3>

<blockquote>
<p>ClonOS is a turnkey Open Source platform based on FreeBSD and the CBSD framework. ClonOS offers a complete web UI for easily controlling, deploying and managing FreeBSD jails containers and Bhyve/Xen hyperviser virtual environments.<br>
ClonOS is currently the only platform available which allow both Xen and Bhyve hypervisor to coexist on the same host. Being a FreeBSD base platform, ClonOS ability to create and manage jails allows you to run FreeBSD applications without losing performance.</p>
</blockquote>

<ul>
<li>
<p>Features:</p>
</li>
<li>
<p>easy management via web UI interface</p>
</li>
<li>
<p>live Bhyve migration [coming soon, roadmap]</p>
</li>
<li>
<p>Bhyve management (create, delete VM)</p>
</li>
<li>
<p>Xen management (create, delete VM) [coming soon, roadmap]</p>
</li>
<li>
<p>connection to the “physical” guest console via VNC from the browser or directly</p>
</li>
<li>
<p>Real time system monitoring</p>
</li>
<li>
<p>access to load statistics through SQLite3 and beanstalkd</p>
</li>
<li>
<p>support for ZFS features (cloning, snapshots)</p>
</li>
<li>
<p>import/export of virtual environments</p>
</li>
<li>
<p>public repository with virtual machine templates</p>
</li>
<li>
<p>puppet-based helpers for configuring popular services</p>
</li>
<li>
<p>ClonOS is a free open-source FreeBSD-based platform for virtual environments creation and management. In the core:</p>
</li>
<li>
<p>FreeBSD OS as hoster platform</p>
</li>
<li>
<p>bhyve(8) as hypervisor engine</p>
</li>
<li>
<p>Xen as hypervisor engine</p>
</li>
<li>
<p>vale(4) as Virtual Ethernet Switch</p>
</li>
<li>
<p>jail(8) as container engine</p>
</li>
<li>
<p>CBSD Project as management tools</p>
</li>
<li>
<p>Puppet as configuration management</p>
</li>
</ul>

<p><hr></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20190128061321">Florian Obser on unwind(8)</a></li>
<li><a href="https://www.reddit.com/r/commandline/comments/amq947/a_low_tech_sms_gateway_for_fun_and_no_profit/">A low tech SMS gateway for fun and no profit</a></li>
<li><a href="https://fosdem.org/2019/schedule/event/netflix_freebsd/attachments/slides/3103/export/events/attachments/netflix_freebsd/slides/3103/FOSDEM_2019_Netflix_and_FreeBSD.pdf">Netflix and FreeBSD : Using Open Source to Deliver Streaming Video</a></li>
<li><a href="https://github.com/lonkamikaze/powerdxx/releases/tag/0.4.0">powerd++ 0.4.0 release</a></li>
<li><a href="https://www.infoq.com/presentations/os-rust">Is it time to rewrite the operating system in Rust?</a></li>
<li><a href="https://svnweb.freebsd.org/changeset/base/343673">Small change, big effect</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/257281738/">Swedish BSD Meetup, Feb 19, 2019</a></li>
<li><a href="https://www.meetup.com/en-US/Polish-BSD-User-Group/events/zkhlnqyzdbsb/">Polish BSD User Group Meetup, Feb 21, 2019</a></li>
</ul>

<p><hr></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Casey - <a href="http://dpaste.com/2MA7HRV#wrap">Cool new Digital Ocean Feature</a></li>
<li>Morgan - <a href="http://dpaste.com/1QDAMYJ#wrap">Jail w/differnet version of FreeBSD</a></li>
<li>Brad - <a href="http://dpaste.com/2XG5KXN#wrap">FreeBSD Installer</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We recap FOSDEM 2019, FreeBSD Foundation January update, OPNsense 19.1 released, the hardware-assisted virtualization challenge, ZFS and GPL terror, ClonOS 19.01-RELEASE, and more.</p>

<h1>Headlines</h1>

<h3><a href="https://fosdem.org/2019/schedule/">FOSDEM 2019 Recap</a></h3>

<ul>
<li>Allan and I were at FOSDEM 2019 in Brussels, Belgium over the weekend.</li>
<li>On the Friday before, we held a FreeBSD Devsummit in a hotel conference room, with 25 people attending. We talked about various topics of interest to the project. You can find the <a href="https://wiki.freebsd.org/Devsummit/201902">notes on the wiki page</a>.</li>
<li>Saturday was the first day of FOSDEM. The FreeBSD Project had a table next to the Illumos Project again. A lot of people visited our table, asked questions, or just said “Hi, I watch <a href="http://BSDNow.tv">BSDNow.tv</a> every week”. We handed out a lot of stickers, pens, swag, and flyers. There was also a full day <a href="https://twitter.com/fosdembsd">BSD devroom</a>, with a <a href="https://fosdem.org/2019/schedule/track/bsd/">variety of talks</a> that were well attended.</li>
<li>In the main conference track, Allan held a <a href="https://fosdem.org/2019/schedule/event/zfs_caching/">talk explaining how the ZFS ARC works</a>. A lot of people attended the talk and had more questions afterwards. Another well attended talk was by Jonathan Looney about <a href="https://fosdem.org/2019/schedule/event/netflix_freebsd/">Netflix and FreeBSD</a>.</li>
<li>Sunday was another day in the same format, but no bsd devroom. A lot of people visited our table, developers and users alike. A lot of meeting and greeting went on.</li>
<li>Overall, FOSDEM was a great success with FreeBSD showing a lot of presence. Thanks to all the people who attended and talked to us. Special thanks to the people who helped out at the FreeBSD table and Rodrigo Osorio for running the BSD devroom again.</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-january-2019/">FreeBSD Foundation Update, January 2019</a></h3>

<blockquote>
<p>Dear FreeBSD Community Member,<br>
Happy New Year! It’s always exciting starting the new year with ambitious plans to support FreeBSD in new and existing areas. We achieved our fundraising goal for 2018, so we plan on funding a lot of work this year! Though it’s the new year, this newsletter highlights some of the work we accomplished in December. We also put together a list of technologies and features we are considering supporting, and are looking for feedback on what users want to help inform our 2019 development plans.  Our advocacy and education efforts are in full swing as we prepare for upcoming conferences including FOSDEM, SANOG33, and SCaLE.<br>
Finally, we created a year-end video to talk about the work we did in 2018. That in itself was an endeavor, so please take a few minutes to watch it! We’re working on improving the methods we use to inform the community on the work we are doing to support the Project, and are always open to feedback. Now, sit back, grab a refreshing beverage, and enjoy our newsletter!<br>
Happy reading!!<br>
Deb</p>
</blockquote>

<p><hr></p>

<h3><a href="https://forum.opnsense.org/index.php?topic=11398.0">OPNsense 19.1 released</a></h3>

<blockquote>
<p>For more than four years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.<br>
The 19.1 release, nicknamed “Inspiring Iguana”, consists of a total of 620 individual changes since 18.7 came out 6 months ago, spread out over 12 intermediate releases including the recent release candidates. That is the average of 2 stable releases per month, security updates and important bug fixes included! If we had to pick a few highlights it would be: The firewall alias API is finally in place. The migration to HardenedBSD 11.2 has been completed. 2FA now works with a remote LDAP / local TOTP combination. And the OpenVPN client export was rewritten for full API support as well.</p>
</blockquote>

<ul>
<li>
<p>These are the most prominent changes since version 18.7:</p>
</li>
<li>
<p>fully functional firewall alias API</p>
</li>
<li>
<p>PIE firewall shaper support</p>
</li>
<li>
<p>firewall NAT rule logging support</p>
</li>
<li>
<p>2FA via LDAP-TOTP combination</p>
</li>
<li>
<p>WPAD / PAC and parent proxy support in the web proxy</p>
</li>
<li>
<p>P12 certificate export with custom passwords</p>
</li>
<li>
<p>Dpinger is now the default gateway monitor</p>
</li>
<li>
<p>ET Pro Telemetry edition plugin[2]</p>
</li>
<li>
<p>extended IPv6 DUID support</p>
</li>
<li>
<p>Dnsmasq DNSSEC support</p>
</li>
<li>
<p>OpenVPN client export API</p>
</li>
<li>
<p>Realtek NIC driver version 1.95</p>
</li>
<li>
<p>HardenedBSD 11.2, LibreSSL 2.7</p>
</li>
<li>
<p>Unbound 1.8, Suricata 4.1</p>
</li>
<li>
<p>Phalcon 3.4, Perl 5.28</p>
</li>
<li>
<p>firmware health check extended to cover all OS files, HTTPS mirror default</p>
</li>
<li>
<p>updates are browser cache-safe regarding CSS and JavaScript assets</p>
</li>
<li>
<p>collapsible side bar menu in the default theme</p>
</li>
<li>
<p>language updates for Chinese, Czech, French, German, Japanese, Portuguese and Russian</p>
</li>
<li>
<p>API backup export, Bind, Hardware widget, Nginx, Ntopng, VnStat and Dnscrypt-proxy plugins</p>
</li>
<li>
<p>Here are the full changes against version 19.1-RC2:</p>
</li>
<li>
<p>ipsec: add firewall interface as soon as phase 1 is enabled</p>
</li>
<li>
<p>ipsec: phase 1 selection GUI JavaScript compatibility fix</p>
</li>
<li>
<p>monit: widget improvements and bug fix (contributed by Frank Brendel)</p>
</li>
<li>
<p>ui: fix regression in single host or network subnet select in static pages</p>
</li>
<li>
<p>plugins: os-frr 1.7 updates OSFP outbound rules (contributed by Fabian Franz)</p>
</li>
<li>
<p>plugins: os-telegraf 1.7.4 fixes packet filter input</p>
</li>
<li>
<p>plugins: os-theme-rebellion 1.8.2 adds image colour invert</p>
</li>
<li>
<p>plugins: os-vnstat 1.1[3]</p>
</li>
<li>
<p>plugins: os-zabbix-agent now uses Zabbix version 4.0</p>
</li>
<li>
<p>src: revert mmc_calculate_clock() as HS200/HS400 support breaks legacy support</p>
</li>
<li>
<p>src: update sqlite3-3.20.0 to sqlite3-3.26.0[4]</p>
</li>
<li>
<p>src: import tzdata 2018h, 2018i[5]</p>
</li>
<li>
<p>src: avoid unsynchronized updates to kn_status[6]</p>
</li>
<li>
<p>ports: ca_root_nss 3.42</p>
</li>
<li>
<p>ports: dhcp6c 20190128 prevent rawops double-free (contributed by Team Rebellion)</p>
</li>
<li>
<p>ports: sudo patch to fix listpw=never[7]</p>
</li>
</ul>

<p><hr></p>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/the_hardware_assisted_virtualization_challenge">The hardware-assisted virtualization challenge</a></h3>

<blockquote>
<p>Over two years ago, I made a pledge to use NetBSD as my sole OS and only operating system, and to resist booting into any other OS until I had implemented hardware-accelerated virtualization in the NetBSD kernel (the equivalent of Linux’ KVM, or Hyper-V).<br>
Today, I am here to report: Mission Accomplished!<br>
It’s been a long road, but we now have hardware-accelerated virtualization in the kernel! And while I had only initially planned to get Oracle VirtualBox working, I have with the help of the Intel HAXM engine (the same backend used for virtualization in Android Studio) and a qemu frontend, successfully managed to boot a range of mainstream operating systems.</p>
</blockquote>

<p><hr></p>

<h3><a href="https://eerielinux.wordpress.com/2019/01/28/zfs-and-gpl-terror-how-much-freedom-is-there-in-linux/">ZFS and GPL terror: How much freedom is there in Linux?</a></h3>

<ul>
<li>ZFS – the undesirable guest</li>
</ul>

<blockquote>
<p>ZFS is todays most advanced filesystem. It originated on the Solaris operating system and thanks to Sun’s decision to open it up, we have it available on quite a number of Unix-like operating systems. That’s just great! Great for everyone.<br>
For everyone? Nope. There are people out there who don’t like ZFS. Which is totally fine, they don’t need to use it after all. But worse: There are people who actively hate ZFS and think that others should not use it. Ok, it’s nothing new that some random guys on the net are acting like assholes, trying to tell you what you must not do, right? Whoever has been online for more than a couple of days probably already got used to it. Unfortunately its still worse: One such spoilsport is Greg Kroah-Hartman, Linux guru and informal second-in-command after Linus Torvalds.<br>
There have been some attempts to defend the stance of this kernel developer. One was to point at the fact that the “ZFS on Linux” (ZoL) port uses two kernel functions, __kernel_fpu_begin() and __kernel_fpu_end(), which have been deprecated for a very long time and that it makes sense to finally get rid of them since nothing in-kernel uses it anymore. Nobody is going to argue against that. The problem becomes clear by looking at the bigger picture, though:<br>
The need for functions doing just what the old ones did has of course not vanished. The functions have been replaced with other ones. And those ones are deliberately made GPL-only. Yes, that’s right: There’s no technical reason whatsoever! It’s purely ideology – and it’s a terrible one.</p>
</blockquote>

<p><hr></p>

<h3><a href="https://clonos.tekroutine.com/">ClonOS 19.01-RELEASE</a></h3>

<blockquote>
<p>ClonOS is a turnkey Open Source platform based on FreeBSD and the CBSD framework. ClonOS offers a complete web UI for easily controlling, deploying and managing FreeBSD jails containers and Bhyve/Xen hyperviser virtual environments.<br>
ClonOS is currently the only platform available which allow both Xen and Bhyve hypervisor to coexist on the same host. Being a FreeBSD base platform, ClonOS ability to create and manage jails allows you to run FreeBSD applications without losing performance.</p>
</blockquote>

<ul>
<li>
<p>Features:</p>
</li>
<li>
<p>easy management via web UI interface</p>
</li>
<li>
<p>live Bhyve migration [coming soon, roadmap]</p>
</li>
<li>
<p>Bhyve management (create, delete VM)</p>
</li>
<li>
<p>Xen management (create, delete VM) [coming soon, roadmap]</p>
</li>
<li>
<p>connection to the “physical” guest console via VNC from the browser or directly</p>
</li>
<li>
<p>Real time system monitoring</p>
</li>
<li>
<p>access to load statistics through SQLite3 and beanstalkd</p>
</li>
<li>
<p>support for ZFS features (cloning, snapshots)</p>
</li>
<li>
<p>import/export of virtual environments</p>
</li>
<li>
<p>public repository with virtual machine templates</p>
</li>
<li>
<p>puppet-based helpers for configuring popular services</p>
</li>
<li>
<p>ClonOS is a free open-source FreeBSD-based platform for virtual environments creation and management. In the core:</p>
</li>
<li>
<p>FreeBSD OS as hoster platform</p>
</li>
<li>
<p>bhyve(8) as hypervisor engine</p>
</li>
<li>
<p>Xen as hypervisor engine</p>
</li>
<li>
<p>vale(4) as Virtual Ethernet Switch</p>
</li>
<li>
<p>jail(8) as container engine</p>
</li>
<li>
<p>CBSD Project as management tools</p>
</li>
<li>
<p>Puppet as configuration management</p>
</li>
</ul>

<p><hr></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.undeadly.org/cgi?action=article;sid=20190128061321">Florian Obser on unwind(8)</a></li>
<li><a href="https://www.reddit.com/r/commandline/comments/amq947/a_low_tech_sms_gateway_for_fun_and_no_profit/">A low tech SMS gateway for fun and no profit</a></li>
<li><a href="https://fosdem.org/2019/schedule/event/netflix_freebsd/attachments/slides/3103/export/events/attachments/netflix_freebsd/slides/3103/FOSDEM_2019_Netflix_and_FreeBSD.pdf">Netflix and FreeBSD : Using Open Source to Deliver Streaming Video</a></li>
<li><a href="https://github.com/lonkamikaze/powerdxx/releases/tag/0.4.0">powerd++ 0.4.0 release</a></li>
<li><a href="https://www.infoq.com/presentations/os-rust">Is it time to rewrite the operating system in Rust?</a></li>
<li><a href="https://svnweb.freebsd.org/changeset/base/343673">Small change, big effect</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/257281738/">Swedish BSD Meetup, Feb 19, 2019</a></li>
<li><a href="https://www.meetup.com/en-US/Polish-BSD-User-Group/events/zkhlnqyzdbsb/">Polish BSD User Group Meetup, Feb 21, 2019</a></li>
</ul>

<p><hr></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Casey - <a href="http://dpaste.com/2MA7HRV#wrap">Cool new Digital Ocean Feature</a></li>
<li>Morgan - <a href="http://dpaste.com/1QDAMYJ#wrap">Jail w/differnet version of FreeBSD</a></li>
<li>Brad - <a href="http://dpaste.com/2XG5KXN#wrap">FreeBSD Installer</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>283: Graphical Interface-View</title>
  <link>https://www.bsdnow.tv/283</link>
  <guid isPermaLink="false">e11d6e25-000c-4424-b4fa-cda93c336f73</guid>
  <pubDate>Thu, 31 Jan 2019 11:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e11d6e25-000c-4424-b4fa-cda93c336f73.mp3" length="28233037" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We’re at FOSDEM 2019 this week having fun. We’d never leave you in a lurch, so we have recorded an interview with Niclas Zeising of the FreeBSD graphics team for you. Enjoy. </itunes:subtitle>
  <itunes:duration>46:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We’re at FOSDEM 2019 this week having fun. We’d never leave you in a lurch, so we have recorded an interview with Niclas Zeising of the FreeBSD graphics team for you. Enjoy. 
&lt;p&gt;##Interview - Niclas Zeising - &lt;a href="mailto:zeising@FreeBSD.org"&gt;zeising@FreeBSD.org&lt;/a&gt; / &lt;a href="https://twitter.com/niclaszeising"&gt;@niclaszeising&lt;/a&gt;&lt;br&gt;
Interview topic: FreeBSD Graphics Stack&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;BR: Welcome Niclas. Since this is your first time on BSDNow, can you tell us a bit about yourself and how you started with Unix/BSD?&lt;/li&gt;
&lt;li&gt;AJ: What made you start working in the FreeBSD graphics stack?&lt;/li&gt;
&lt;li&gt;BR: What is the current status with the FreeBSD graphics stack?&lt;/li&gt;
&lt;li&gt;AJ: What challenges do you face in the FreeBSD graphics stack?&lt;/li&gt;
&lt;li&gt;BR: How many people are working in the graphics team and what kind of help do you need there?&lt;/li&gt;
&lt;li&gt;AJ: You’re also involved in FreeBSD ports and held a poudriere tutorial at last years EuroBSDcon. What kind of feedback did you get and will you give that tutorial again?&lt;/li&gt;
&lt;li&gt;BR: You’ve been organizing the Stockholm BSD user group meeting. Can you tell us a bit about that, what’s involved, how is it structured?&lt;/li&gt;
&lt;li&gt;AJ: What conferences do you go to where people could talk to you?&lt;/li&gt;
&lt;li&gt;BR: Is there anything else you’d like to mention before we let you go?&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Casey - &lt;a href="http://dpaste.com/33XCN5X#wrap"&gt;TrueOS&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Troels - &lt;a href="http://dpaste.com/31M2SN6"&gt;zfs send vs zfs send -R&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;matclarke - &lt;a href="http://dpaste.com/16WDCW0"&gt;Orphaned packages&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We’re at FOSDEM 2019 this week having fun. We’d never leave you in a lurch, so we have recorded an interview with Niclas Zeising of the FreeBSD graphics team for you. Enjoy. </p>

<p>##Interview - Niclas Zeising - <a href="mailto:zeising@FreeBSD.org">zeising@FreeBSD.org</a> / <a href="https://twitter.com/niclaszeising">@niclaszeising</a><br>
Interview topic: FreeBSD Graphics Stack</p>

<ul>
<li>BR: Welcome Niclas. Since this is your first time on BSDNow, can you tell us a bit about yourself and how you started with Unix/BSD?</li>
<li>AJ: What made you start working in the FreeBSD graphics stack?</li>
<li>BR: What is the current status with the FreeBSD graphics stack?</li>
<li>AJ: What challenges do you face in the FreeBSD graphics stack?</li>
<li>BR: How many people are working in the graphics team and what kind of help do you need there?</li>
<li>AJ: You’re also involved in FreeBSD ports and held a poudriere tutorial at last years EuroBSDcon. What kind of feedback did you get and will you give that tutorial again?</li>
<li>BR: You’ve been organizing the Stockholm BSD user group meeting. Can you tell us a bit about that, what’s involved, how is it structured?</li>
<li>AJ: What conferences do you go to where people could talk to you?</li>
<li>BR: Is there anything else you’d like to mention before we let you go?</li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Casey - <a href="http://dpaste.com/33XCN5X#wrap">TrueOS</a></li>
<li>Troels - <a href="http://dpaste.com/31M2SN6">zfs send vs zfs send -R</a></li>
<li>matclarke - <a href="http://dpaste.com/16WDCW0">Orphaned packages</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We’re at FOSDEM 2019 this week having fun. We’d never leave you in a lurch, so we have recorded an interview with Niclas Zeising of the FreeBSD graphics team for you. Enjoy. </p>

<p>##Interview - Niclas Zeising - <a href="mailto:zeising@FreeBSD.org">zeising@FreeBSD.org</a> / <a href="https://twitter.com/niclaszeising">@niclaszeising</a><br>
Interview topic: FreeBSD Graphics Stack</p>

<ul>
<li>BR: Welcome Niclas. Since this is your first time on BSDNow, can you tell us a bit about yourself and how you started with Unix/BSD?</li>
<li>AJ: What made you start working in the FreeBSD graphics stack?</li>
<li>BR: What is the current status with the FreeBSD graphics stack?</li>
<li>AJ: What challenges do you face in the FreeBSD graphics stack?</li>
<li>BR: How many people are working in the graphics team and what kind of help do you need there?</li>
<li>AJ: You’re also involved in FreeBSD ports and held a poudriere tutorial at last years EuroBSDcon. What kind of feedback did you get and will you give that tutorial again?</li>
<li>BR: You’ve been organizing the Stockholm BSD user group meeting. Can you tell us a bit about that, what’s involved, how is it structured?</li>
<li>AJ: What conferences do you go to where people could talk to you?</li>
<li>BR: Is there anything else you’d like to mention before we let you go?</li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Casey - <a href="http://dpaste.com/33XCN5X#wrap">TrueOS</a></li>
<li>Troels - <a href="http://dpaste.com/31M2SN6">zfs send vs zfs send -R</a></li>
<li>matclarke - <a href="http://dpaste.com/16WDCW0">Orphaned packages</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>282: Open the Rsync</title>
  <link>https://www.bsdnow.tv/282</link>
  <guid isPermaLink="false">081a14d7-ba00-43d2-9be7-ea1a189ed2e2</guid>
  <pubDate>Thu, 24 Jan 2019 11:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/081a14d7-ba00-43d2-9be7-ea1a189ed2e2.mp3" length="36986923" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Project Trident 18.12 released, Spotifyd on NetBSD, OPNsense 18.7.10 is available, Ultra EPYC AMD Powered Sun Ultra 24 Workstation, OpenRsync, LLD porting to NetBSD, and more.</itunes:subtitle>
  <itunes:duration>1:01:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Project Trident 18.12 released, Spotifyd on NetBSD, OPNsense 18.7.10 is available, Ultra EPYC AMD Powered Sun Ultra 24 Workstation, OpenRsync, LLD porting to NetBSD, and more.
&lt;p&gt;##Headlines&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://2019.asiabsdcon.org/cfp.html.en"&gt;AsiaBSDCon 2019 Call for Papers&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;You have until Jan 30th to submit&lt;/li&gt;
&lt;li&gt;Full paper requirement is relaxed a bit this year (this year ONLY!) due to the short submission window. You don’t need all 10-12 pages, but it is still preferred.&lt;/li&gt;
&lt;li&gt;Send a message to &lt;a href="mailto:secretary@asiabsdcon.org"&gt;secretary@asiabsdcon.org&lt;/a&gt; with your proposal. Could be either for a talk or a tutorial.&lt;/li&gt;
&lt;li&gt;Two days of tutorials/devsummit and two days of conference during Sakura season in Tokyo, Japan&lt;/li&gt;
&lt;li&gt;The conference is also looking for sponsors&lt;/li&gt;
&lt;li&gt;If accepted, flight and hotel is paid for by the conference&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="http://project-trident.org/post/2019-01-15_18.12-release_available/"&gt;Project Trident 18.12 Released&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://twitter.com/tridentproject"&gt;Twitter account if you want to keep up on project news&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/TridentProject/status/1086010032662237185"&gt;Screenshots&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://t.me/ProjectTrident"&gt;Project Trident Community Telegram Channel&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://distrowatch.com/?newsid=10442"&gt;DistroWatch Page&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://linuxactionnews.com/89?t=395"&gt;LinuxActionNews Review&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=QjiR1KiacrQ"&gt;RoboNuggie’s in depth review&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://atomicules.co.uk/2019/01/17/Building-Spotifyd-on-NetBSD.html"&gt;Building Spotifyd on NetBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;These are the steps I went through to build and run Spotifyd (this commit at the time of writing) on NetBSD AMD64. It’s a Spotify Connect client so it means I still need to control Spotify from another device (typically my phone), but the audio is played through my desktop… which is where my speakers and headphones are plugged in - it means I don’t have to unplug stuff and re-plug into my phone, work laptop, etc. This is 100% a “good enough for now solution” for me; I have had a quick play with the Go based microcontroller from spotcontrol and that allows a completely NetBSD only experience (although it is just an example application so doesn’t provide many features - great as a basis to build on though).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://opnsense.org/opnsense-18-7-10-released/"&gt;OPNsense 18.7.10 released&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;2019 means 19.1 is almost here. In the meantime accept this small&lt;br&gt;
incremental update with goodies such as Suricata 4.1, custom passwords&lt;br&gt;
for P12 certificate export as well as fresh fixes in the FreeBSD base.&lt;br&gt;
A lot of cleanups went into this update to make sure there will be a&lt;br&gt;
smooth transition to 19.1-RC for you early birds. We expect RC1 in 1-2&lt;br&gt;
weeks and the final 19.1 on January 29.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.servethehome.com/introducing-the-ultra-epyc-amd-powered-sun-ultra-24-workstation/"&gt;Introducing the Ultra EPYC AMD Powered Sun Ultra 24 Workstation&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;A few weeks ago, I got an itch to build a workstation with AMD EPYC. There are a few constraints. First, I needed a higher-clock part. Second, I knew the whole build would be focused more on being an ultra high-end workstation rather than simply utilizing gaming components. With that, I decided it was time to hit on a bit of nostalgia for our readers. Mainly, I wanted to do an homage to Sun Microsystems. Sun made the server gear that the industry ran on for years, and as a fun fact, if you go behind the 1 Hacker Way sign at Facebook’s campus, they left the Sun Microsystems logo. Seeing that made me wonder if we could do an ultimate AMD EPYC build in a Sun Microsystems workstation.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://github.com/kristapsdz/openrsync"&gt;OpenRsync&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;This is a clean-room implementation of rsync with a BSD (ISC) license. It is designed to be compatible with a modern rsync (3.1.3 is used for testing). It currently compiles and runs only on OpenBSD.&lt;br&gt;
This project is still very new and very fast-moving.&lt;br&gt;
It’s not ready for wide-spread testing. Or even narrow-spread beyond getting all of the bits to work. It’s not ready for strong attention. Or really any attention but by careful programming.&lt;br&gt;
Many have asked about portability. We’re just not there yet, folks. But don’t worry, the system is easily portable. The hard part for porters is matching OpenBSD’s pledge and unveil.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blog.netbsd.org/tnf/entry/the_first_report_on_lld"&gt;The first report on LLD porting&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;LLD is the link editor (linker) component of Clang toolchain. Its main advantage over GNU ld is much lower memory footprint, and linking speed. It is of specific interest to me since currently 8 GiB of memory are insufficient to link LLVM statically (which is the upstream default).&lt;br&gt;
The first goal of LLD porting is to ensure that LLD can produce working NetBSD executables, and be used to build LLVM itself. Then, it is desirable to look into trying to build additional NetBSD components, and eventually into replacing /usr/bin/ld entirely with lld.&lt;br&gt;
In this report, I would like to shortly summarize the issues I have found so far trying to use LLD on NetBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://euroquis.nl/bobulate/?p=2044"&gt;Ring in the new&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;It’s the second week of 2019 already, which means I’m curious what Nate is going to do with his series This week in usability … reset the numbering from week 1? That series is a great read, to keep up with all the little things that change in KDE source each week — aside from the release notes.&lt;br&gt;
For the big ticket items of KDE on FreeBSD, you should read this blog instead.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;In ports this week (mostly KDE, some unrelated):&lt;/li&gt;
&lt;li&gt;KDE Plasma has been updated to the latest release, 5.14.5.&lt;/li&gt;
&lt;li&gt;KDE Applications 18.12.1 were released today, so we’re right on top of them.&lt;/li&gt;
&lt;li&gt;Marble was fixed for FreeBSD-running-on-Power9.&lt;/li&gt;
&lt;li&gt;Musescore caught up on 18 months of releases.&lt;/li&gt;
&lt;li&gt;Phonon updated to 4.10.1, along with its backends.&lt;/li&gt;
&lt;li&gt;And in development, Qt WebEngine 5.12 has been prepared in the incongruously-named plasma-5.13 branch in Area51; that does contain all the latest bits described above, as well.&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="http://nomadbsd.org/index.html"&gt;NomadBSD 1.2-RC1 Released&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/q5sys/status/1086443533681209350"&gt;ZFS - The First Enterprise Blockchain&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.dragonflybsd.org/docs/user/Powersave/?updated"&gt;Powersaving with DragonFly laptop&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://tests.reproducible-builds.org/netbsd/netbsd.html"&gt;NetBSD reaches 100% reproducable builds&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://old.reddit.com/r/freebsd/comments/ahs53y/bhyve_web_interface/"&gt;Potential Bhyve Web Interface?&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;
&lt;a href="https://www.reddit.com/r/openbsd_gaming/comments/adi9sm/libgdx_proof_of_concept_on_openbsd_slay_the_spire/"&gt;LibGDX proof of concept on OpenBSD&lt;/a&gt; - &lt;a href="https://youtu.be/F1loBeHKJt4"&gt;Video&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.pgcli.com/launching-litecli.html"&gt;LiteCLI is a user-friendly CommandLine client for SQLite database&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/playlist?list=PL94E35692EB9D36F3"&gt;In honor of Donald Knuth’s 81 birthday Stanford uploaded 111 lectures on Youtube&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://dpaste.com/3Q4F6C2"&gt;Portland BSD Pizza Night - 2018-01-31 19:00 - Sweet Heart Pizza&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/BSD-Users-Stockholm/events/257281738/"&gt;Stockholm BSD February meetup&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://bsd-pl.org/en"&gt;Polish BSD User Group: Jan 25 18:15 - 21:00&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://2019.asiabsdcon.org/cfp.html.en"&gt;AsiaBSDcon 2019 CfP&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Greg - &lt;a href="http://dpaste.com/3A6T4HN"&gt;VLANs and jails&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Tara - &lt;a href="http://dpaste.com/1X1E3XS#wrap"&gt;ZFS on removable disks&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Casey - &lt;a href="http://dpaste.com/08HZ6FP#wrap"&gt;Interview with Kirk McKusick&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, spotifyd, opnsense, kde, openrsync</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Project Trident 18.12 released, Spotifyd on NetBSD, OPNsense 18.7.10 is available, Ultra EPYC AMD Powered Sun Ultra 24 Workstation, OpenRsync, LLD porting to NetBSD, and more.</p>

<p>##Headlines</p>

<p>###<a href="https://2019.asiabsdcon.org/cfp.html.en">AsiaBSDCon 2019 Call for Papers</a></p>

<ul>
<li>You have until Jan 30th to submit</li>
<li>Full paper requirement is relaxed a bit this year (this year ONLY!) due to the short submission window. You don’t need all 10-12 pages, but it is still preferred.</li>
<li>Send a message to <a href="mailto:secretary@asiabsdcon.org">secretary@asiabsdcon.org</a> with your proposal. Could be either for a talk or a tutorial.</li>
<li>Two days of tutorials/devsummit and two days of conference during Sakura season in Tokyo, Japan</li>
<li>The conference is also looking for sponsors</li>
<li>If accepted, flight and hotel is paid for by the conference</li>
</ul>

<p><hr></p>

<p>###<a href="http://project-trident.org/post/2019-01-15_18.12-release_available/">Project Trident 18.12 Released</a></p>

<ul>
<li><a href="https://twitter.com/tridentproject">Twitter account if you want to keep up on project news</a></li>
<li><a href="https://twitter.com/TridentProject/status/1086010032662237185">Screenshots</a></li>
<li><a href="https://t.me/ProjectTrident">Project Trident Community Telegram Channel</a></li>
<li><a href="https://distrowatch.com/?newsid=10442">DistroWatch Page</a></li>
<li><a href="https://linuxactionnews.com/89?t=395">LinuxActionNews Review</a></li>
<li><a href="https://www.youtube.com/watch?v=QjiR1KiacrQ">RoboNuggie’s in depth review</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://atomicules.co.uk/2019/01/17/Building-Spotifyd-on-NetBSD.html">Building Spotifyd on NetBSD</a></p>

<blockquote>
<p>These are the steps I went through to build and run Spotifyd (this commit at the time of writing) on NetBSD AMD64. It’s a Spotify Connect client so it means I still need to control Spotify from another device (typically my phone), but the audio is played through my desktop… which is where my speakers and headphones are plugged in - it means I don’t have to unplug stuff and re-plug into my phone, work laptop, etc. This is 100% a “good enough for now solution” for me; I have had a quick play with the Go based microcontroller from spotcontrol and that allows a completely NetBSD only experience (although it is just an example application so doesn’t provide many features - great as a basis to build on though).</p>
</blockquote>

<p><hr></p>

<p>##News Roundup</p>

<p>###<a href="https://opnsense.org/opnsense-18-7-10-released/">OPNsense 18.7.10 released</a></p>

<blockquote>
<p>2019 means 19.1 is almost here. In the meantime accept this small<br>
incremental update with goodies such as Suricata 4.1, custom passwords<br>
for P12 certificate export as well as fresh fixes in the FreeBSD base.<br>
A lot of cleanups went into this update to make sure there will be a<br>
smooth transition to 19.1-RC for you early birds. We expect RC1 in 1-2<br>
weeks and the final 19.1 on January 29.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.servethehome.com/introducing-the-ultra-epyc-amd-powered-sun-ultra-24-workstation/">Introducing the Ultra EPYC AMD Powered Sun Ultra 24 Workstation</a></p>

<blockquote>
<p>A few weeks ago, I got an itch to build a workstation with AMD EPYC. There are a few constraints. First, I needed a higher-clock part. Second, I knew the whole build would be focused more on being an ultra high-end workstation rather than simply utilizing gaming components. With that, I decided it was time to hit on a bit of nostalgia for our readers. Mainly, I wanted to do an homage to Sun Microsystems. Sun made the server gear that the industry ran on for years, and as a fun fact, if you go behind the 1 Hacker Way sign at Facebook’s campus, they left the Sun Microsystems logo. Seeing that made me wonder if we could do an ultimate AMD EPYC build in a Sun Microsystems workstation.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://github.com/kristapsdz/openrsync">OpenRsync</a></p>

<blockquote>
<p>This is a clean-room implementation of rsync with a BSD (ISC) license. It is designed to be compatible with a modern rsync (3.1.3 is used for testing). It currently compiles and runs only on OpenBSD.<br>
This project is still very new and very fast-moving.<br>
It’s not ready for wide-spread testing. Or even narrow-spread beyond getting all of the bits to work. It’s not ready for strong attention. Or really any attention but by careful programming.<br>
Many have asked about portability. We’re just not there yet, folks. But don’t worry, the system is easily portable. The hard part for porters is matching OpenBSD’s pledge and unveil.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/the_first_report_on_lld">The first report on LLD porting</a></p>

<blockquote>
<p>LLD is the link editor (linker) component of Clang toolchain. Its main advantage over GNU ld is much lower memory footprint, and linking speed. It is of specific interest to me since currently 8 GiB of memory are insufficient to link LLVM statically (which is the upstream default).<br>
The first goal of LLD porting is to ensure that LLD can produce working NetBSD executables, and be used to build LLVM itself. Then, it is desirable to look into trying to build additional NetBSD components, and eventually into replacing /usr/bin/ld entirely with lld.<br>
In this report, I would like to shortly summarize the issues I have found so far trying to use LLD on NetBSD.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://euroquis.nl/bobulate/?p=2044">Ring in the new</a></p>

<blockquote>
<p>It’s the second week of 2019 already, which means I’m curious what Nate is going to do with his series This week in usability … reset the numbering from week 1? That series is a great read, to keep up with all the little things that change in KDE source each week — aside from the release notes.<br>
For the big ticket items of KDE on FreeBSD, you should read this blog instead.</p>
</blockquote>

<ul>
<li>In ports this week (mostly KDE, some unrelated):</li>
<li>KDE Plasma has been updated to the latest release, 5.14.5.</li>
<li>KDE Applications 18.12.1 were released today, so we’re right on top of them.</li>
<li>Marble was fixed for FreeBSD-running-on-Power9.</li>
<li>Musescore caught up on 18 months of releases.</li>
<li>Phonon updated to 4.10.1, along with its backends.</li>
<li>And in development, Qt WebEngine 5.12 has been prepared in the incongruously-named plasma-5.13 branch in Area51; that does contain all the latest bits described above, as well.</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="http://nomadbsd.org/index.html">NomadBSD 1.2-RC1 Released</a></li>
<li><a href="https://twitter.com/q5sys/status/1086443533681209350">ZFS - The First Enterprise Blockchain</a></li>
<li><a href="https://www.dragonflybsd.org/docs/user/Powersave/?updated">Powersaving with DragonFly laptop</a></li>
<li><a href="https://tests.reproducible-builds.org/netbsd/netbsd.html">NetBSD reaches 100% reproducable builds</a></li>
<li><a href="https://old.reddit.com/r/freebsd/comments/ahs53y/bhyve_web_interface/">Potential Bhyve Web Interface?</a></li>
<li><a href="https://www.reddit.com/r/openbsd_gaming/comments/adi9sm/libgdx_proof_of_concept_on_openbsd_slay_the_spire/">LibGDX proof of concept on OpenBSD</a> - <a href="https://youtu.be/F1loBeHKJt4">Video</a></li>
<li><a href="https://www.pgcli.com/launching-litecli.html">LiteCLI is a user-friendly CommandLine client for SQLite database</a></li>
<li><a href="https://www.youtube.com/playlist?list=PL94E35692EB9D36F3">In honor of Donald Knuth’s 81 birthday Stanford uploaded 111 lectures on Youtube</a></li>
<li><a href="http://dpaste.com/3Q4F6C2">Portland BSD Pizza Night - 2018-01-31 19:00 - Sweet Heart Pizza</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/257281738/">Stockholm BSD February meetup</a></li>
<li><a href="https://bsd-pl.org/en">Polish BSD User Group: Jan 25 18:15 - 21:00</a></li>
<li><a href="https://2019.asiabsdcon.org/cfp.html.en">AsiaBSDcon 2019 CfP</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Greg - <a href="http://dpaste.com/3A6T4HN">VLANs and jails</a></li>
<li>Tara - <a href="http://dpaste.com/1X1E3XS#wrap">ZFS on removable disks</a></li>
<li>Casey - <a href="http://dpaste.com/08HZ6FP#wrap">Interview with Kirk McKusick</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Project Trident 18.12 released, Spotifyd on NetBSD, OPNsense 18.7.10 is available, Ultra EPYC AMD Powered Sun Ultra 24 Workstation, OpenRsync, LLD porting to NetBSD, and more.</p>

<p>##Headlines</p>

<p>###<a href="https://2019.asiabsdcon.org/cfp.html.en">AsiaBSDCon 2019 Call for Papers</a></p>

<ul>
<li>You have until Jan 30th to submit</li>
<li>Full paper requirement is relaxed a bit this year (this year ONLY!) due to the short submission window. You don’t need all 10-12 pages, but it is still preferred.</li>
<li>Send a message to <a href="mailto:secretary@asiabsdcon.org">secretary@asiabsdcon.org</a> with your proposal. Could be either for a talk or a tutorial.</li>
<li>Two days of tutorials/devsummit and two days of conference during Sakura season in Tokyo, Japan</li>
<li>The conference is also looking for sponsors</li>
<li>If accepted, flight and hotel is paid for by the conference</li>
</ul>

<p><hr></p>

<p>###<a href="http://project-trident.org/post/2019-01-15_18.12-release_available/">Project Trident 18.12 Released</a></p>

<ul>
<li><a href="https://twitter.com/tridentproject">Twitter account if you want to keep up on project news</a></li>
<li><a href="https://twitter.com/TridentProject/status/1086010032662237185">Screenshots</a></li>
<li><a href="https://t.me/ProjectTrident">Project Trident Community Telegram Channel</a></li>
<li><a href="https://distrowatch.com/?newsid=10442">DistroWatch Page</a></li>
<li><a href="https://linuxactionnews.com/89?t=395">LinuxActionNews Review</a></li>
<li><a href="https://www.youtube.com/watch?v=QjiR1KiacrQ">RoboNuggie’s in depth review</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://atomicules.co.uk/2019/01/17/Building-Spotifyd-on-NetBSD.html">Building Spotifyd on NetBSD</a></p>

<blockquote>
<p>These are the steps I went through to build and run Spotifyd (this commit at the time of writing) on NetBSD AMD64. It’s a Spotify Connect client so it means I still need to control Spotify from another device (typically my phone), but the audio is played through my desktop… which is where my speakers and headphones are plugged in - it means I don’t have to unplug stuff and re-plug into my phone, work laptop, etc. This is 100% a “good enough for now solution” for me; I have had a quick play with the Go based microcontroller from spotcontrol and that allows a completely NetBSD only experience (although it is just an example application so doesn’t provide many features - great as a basis to build on though).</p>
</blockquote>

<p><hr></p>

<p>##News Roundup</p>

<p>###<a href="https://opnsense.org/opnsense-18-7-10-released/">OPNsense 18.7.10 released</a></p>

<blockquote>
<p>2019 means 19.1 is almost here. In the meantime accept this small<br>
incremental update with goodies such as Suricata 4.1, custom passwords<br>
for P12 certificate export as well as fresh fixes in the FreeBSD base.<br>
A lot of cleanups went into this update to make sure there will be a<br>
smooth transition to 19.1-RC for you early birds. We expect RC1 in 1-2<br>
weeks and the final 19.1 on January 29.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.servethehome.com/introducing-the-ultra-epyc-amd-powered-sun-ultra-24-workstation/">Introducing the Ultra EPYC AMD Powered Sun Ultra 24 Workstation</a></p>

<blockquote>
<p>A few weeks ago, I got an itch to build a workstation with AMD EPYC. There are a few constraints. First, I needed a higher-clock part. Second, I knew the whole build would be focused more on being an ultra high-end workstation rather than simply utilizing gaming components. With that, I decided it was time to hit on a bit of nostalgia for our readers. Mainly, I wanted to do an homage to Sun Microsystems. Sun made the server gear that the industry ran on for years, and as a fun fact, if you go behind the 1 Hacker Way sign at Facebook’s campus, they left the Sun Microsystems logo. Seeing that made me wonder if we could do an ultimate AMD EPYC build in a Sun Microsystems workstation.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://github.com/kristapsdz/openrsync">OpenRsync</a></p>

<blockquote>
<p>This is a clean-room implementation of rsync with a BSD (ISC) license. It is designed to be compatible with a modern rsync (3.1.3 is used for testing). It currently compiles and runs only on OpenBSD.<br>
This project is still very new and very fast-moving.<br>
It’s not ready for wide-spread testing. Or even narrow-spread beyond getting all of the bits to work. It’s not ready for strong attention. Or really any attention but by careful programming.<br>
Many have asked about portability. We’re just not there yet, folks. But don’t worry, the system is easily portable. The hard part for porters is matching OpenBSD’s pledge and unveil.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/the_first_report_on_lld">The first report on LLD porting</a></p>

<blockquote>
<p>LLD is the link editor (linker) component of Clang toolchain. Its main advantage over GNU ld is much lower memory footprint, and linking speed. It is of specific interest to me since currently 8 GiB of memory are insufficient to link LLVM statically (which is the upstream default).<br>
The first goal of LLD porting is to ensure that LLD can produce working NetBSD executables, and be used to build LLVM itself. Then, it is desirable to look into trying to build additional NetBSD components, and eventually into replacing /usr/bin/ld entirely with lld.<br>
In this report, I would like to shortly summarize the issues I have found so far trying to use LLD on NetBSD.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://euroquis.nl/bobulate/?p=2044">Ring in the new</a></p>

<blockquote>
<p>It’s the second week of 2019 already, which means I’m curious what Nate is going to do with his series This week in usability … reset the numbering from week 1? That series is a great read, to keep up with all the little things that change in KDE source each week — aside from the release notes.<br>
For the big ticket items of KDE on FreeBSD, you should read this blog instead.</p>
</blockquote>

<ul>
<li>In ports this week (mostly KDE, some unrelated):</li>
<li>KDE Plasma has been updated to the latest release, 5.14.5.</li>
<li>KDE Applications 18.12.1 were released today, so we’re right on top of them.</li>
<li>Marble was fixed for FreeBSD-running-on-Power9.</li>
<li>Musescore caught up on 18 months of releases.</li>
<li>Phonon updated to 4.10.1, along with its backends.</li>
<li>And in development, Qt WebEngine 5.12 has been prepared in the incongruously-named plasma-5.13 branch in Area51; that does contain all the latest bits described above, as well.</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="http://nomadbsd.org/index.html">NomadBSD 1.2-RC1 Released</a></li>
<li><a href="https://twitter.com/q5sys/status/1086443533681209350">ZFS - The First Enterprise Blockchain</a></li>
<li><a href="https://www.dragonflybsd.org/docs/user/Powersave/?updated">Powersaving with DragonFly laptop</a></li>
<li><a href="https://tests.reproducible-builds.org/netbsd/netbsd.html">NetBSD reaches 100% reproducable builds</a></li>
<li><a href="https://old.reddit.com/r/freebsd/comments/ahs53y/bhyve_web_interface/">Potential Bhyve Web Interface?</a></li>
<li><a href="https://www.reddit.com/r/openbsd_gaming/comments/adi9sm/libgdx_proof_of_concept_on_openbsd_slay_the_spire/">LibGDX proof of concept on OpenBSD</a> - <a href="https://youtu.be/F1loBeHKJt4">Video</a></li>
<li><a href="https://www.pgcli.com/launching-litecli.html">LiteCLI is a user-friendly CommandLine client for SQLite database</a></li>
<li><a href="https://www.youtube.com/playlist?list=PL94E35692EB9D36F3">In honor of Donald Knuth’s 81 birthday Stanford uploaded 111 lectures on Youtube</a></li>
<li><a href="http://dpaste.com/3Q4F6C2">Portland BSD Pizza Night - 2018-01-31 19:00 - Sweet Heart Pizza</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/257281738/">Stockholm BSD February meetup</a></li>
<li><a href="https://bsd-pl.org/en">Polish BSD User Group: Jan 25 18:15 - 21:00</a></li>
<li><a href="https://2019.asiabsdcon.org/cfp.html.en">AsiaBSDcon 2019 CfP</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Greg - <a href="http://dpaste.com/3A6T4HN">VLANs and jails</a></li>
<li>Tara - <a href="http://dpaste.com/1X1E3XS#wrap">ZFS on removable disks</a></li>
<li>Casey - <a href="http://dpaste.com/08HZ6FP#wrap">Interview with Kirk McKusick</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>281: EPYC Server Battle</title>
  <link>https://www.bsdnow.tv/281</link>
  <guid isPermaLink="false">62f301ee-57b8-4f10-8736-3660f78074a8</guid>
  <pubDate>Thu, 17 Jan 2019 10:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/62f301ee-57b8-4f10-8736-3660f78074a8.mp3" length="50507863" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>SCP client vulnerabilities, BSDs vs Linux benchmarks on a Tyan EPYC Server, fame for the Unix inventors, Die IPv4, GhostBSD 18.12 released, Unix in pictures, and more.</itunes:subtitle>
  <itunes:duration>1:23:52</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>SCP client vulnerabilities, BSDs vs Linux benchmarks on a Tyan EPYC Server, fame for the Unix inventors, Die IPv4, GhostBSD 18.12 released, Unix in pictures, and more.
&lt;p&gt;##Headlines&lt;br&gt;
###&lt;a href="https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt"&gt;scp client multiple vulnerabilities&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Overview&lt;/li&gt;
&lt;li&gt;SCP clients from multiple vendors are susceptible to a malicious scp server performing&lt;br&gt;
unauthorized changes to target directory and/or client output manipulation.&lt;/li&gt;
&lt;li&gt;Description&lt;/li&gt;
&lt;li&gt;Many scp clients fail to verify if the objects returned by the scp server match those&lt;br&gt;
it asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate&lt;br&gt;
flaw in the client allows the target directory attributes to be changed arbitrarily.&lt;br&gt;
Finally, two vulnerabilities in clients may allow server to spoof the client output.&lt;/li&gt;
&lt;li&gt;Impact&lt;/li&gt;
&lt;li&gt;Malicious scp server can write arbitrary files to scp target directory, change the&lt;br&gt;
target directory permissions and to spoof the client output.&lt;/li&gt;
&lt;li&gt;Details&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The discovered vulnerabilities, described in more detail below, enables the attack&lt;br&gt;
described here in brief.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;The attacker controlled server or Man-in-the-Middle(*) attack drops .bash_aliases file to victim’s home directory when the victim performs scp operation from the server. The transfer of extra files is hidden by sending ANSI control sequences via stderr. For example:&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;user@local:~$ scp user@remote:readme.txt .&lt;/code&gt;&lt;br&gt;
&lt;code&gt;readme.txt 100% 494 1.6KB/s 00:00&lt;/code&gt;&lt;br&gt;
&lt;code&gt;user@local:~$&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Once the victim launches a new shell, the malicious commands in .bash_aliases get executed.&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;*) Man-in-the-Middle attack does require the victim to accept the wrong host fingerprint.&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.phoronix.com/scan.php?page=article&amp;amp;item=dfly-freebsd-tyanamd&amp;amp;num=1"&gt;FreeBSD 12.0 vs. DragonFlyBSD 5.4 vs. TrueOS 18.12 vs. Linux On A Tyan EPYC Server&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Last month when running FreeBSD 12.0 benchmarks on a 2P EPYC server I wasn’t able to run any side-by-side benchmarks with the new DragonFlyBSD 5.4 as this BSD was crashing during the boot process on that board. But fortunately on another AMD EPYC server available, the EPYC 1P TYAN Transport SX TN70A-B8026, DragonFlyBSD 5.4.1 runs fine. So for this first round of BSD benchmarking in 2019 are tests of FreeBSD 11.2, FreeBSD 12.0, DragonFlyBSD 5.4.1, the new TrueOS 18.12, and a few Linux distributions (CentOS 7, Ubuntu 18.04.1 LTS, and Clear Linux) on this EPYC 7601 server in a variety of workloads.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;DragonFlyBSD 5.4.1 ran fine on this Tyan server and could boot fine unlike the issue encountered on the Dell PowerEdge R7425 for this particular BSD. But on the Tyan server, DragonFlyBSD 5.2.2 wouldn’t boot so only this latest DragonFlyBSD release series was used as part of the comparison.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;A summary of the operating systems tested for this EPYC 7601 OS benchmark comparison included:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;DragonFlyBSD 5.4.1 - The latest release of Matthew Dillon’s operating system while using the HAMMER2 file-system and GCC 8.1 compiler that is now the default system compiler for this BSD.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;FreeBSD 11.2 - The previous stable release of FreeBSD. Installed with a ZFS file-system.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;FreeBSD 12.0 - The latest stable release of FreeBSD and installed with its ZFS option.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;TrueOS 18.12 - The latest release of the iX systems’ FreeBSD derivative. TrueOS 18.12 is based on FreeBSD 13.0-CURRENT and uses ZFS by default and was using the Clang 7.0.1 compiler compared to Clang 6.0.1 on FreeBSD 12.0.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;CentOS Linux 7 - The latest EL7 operating system performance.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Ubuntu 18.04.1 LTS - The latest Ubuntu Long Term Support release.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Clear Linux 27120 - The latest rolling release as of testing out of Intel’s Open-Source Technology Center. Clear Linux often reflects as close to the gold standard for performance as possible with its insanely tuned software stack for offering optimal performance on x86_64 performance for generally showing best what the hardware is capable of.&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Throughout all of this testing, the Tyan 2U server was kept to its same configuration of an AMD EPYC 7601 (32 cores / 64 threads) at stock speeds, 8 x 16GB DDR4-2666 ECC memory, and 280GB Intel Optane 900p SSD benchmarks.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://www.engadget.com/2019/01/08/national-inventors-hall-of-fame-class-of-2019/"&gt;National Inventors Hall of Fame honors creators of Unix&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Dennis Ritchie (Posthumous) and Ken Thompson: UNIX Operating System&lt;br&gt;
Thompson and Ritchie’s creation of the UNIX operating system and the C programming language were pivotal developments in the progress of computer science. Today, 50 years after its beginnings, UNIX and UNIX-like systems continue to run machinery from supercomputers to smartphones. The UNIX operating system remains the basis of much of the world’s computing infrastructure, and C language – written to simplify the development of UNIX – is one of the most widely used languages today.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://ungleich.ch/en-us/cms/blog/2019/01/09/die-ipv4-die/"&gt;Die IPV4, Die&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Imagine, it is 2019. Easy, ha? Imagine, it is 2019 and you want to turn off IPv4. Like, off off. Really off. Not disabling IPv6, but disabling IPv4.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Two steps back&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;You might be coming here wondering, why would anybody want to do what we are asking to be done. Well, it is dead simple: We are running data centers (like Data Center Light) with a lot of IPv6 only equipment. There simply is no need for IPv4. So why would we want to have it enabled?&lt;br&gt;
Also, here at ungleich, we defined 2019 as the year to move away from IPv4.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The challenge&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Do you like puzzles? Competitions? Challenges? Hacking? Well. If ANY of this is of your interest, here is a real challenge for you:&lt;br&gt;
We offer a 100 CHF (roughly 100 USD) for anyone who can give us a detailed description of how to turn IPv4 completely off in an operating system and allowing it to communicate with IPv6 only. This should obviously include a tiny proof that your operating system is really unable to use IPv4 at all. Just flushing IPv4 addresses and keeping the IPv4 stack loaded, does not count.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="http://www.ghostbsd.org/18.12_release_announcement"&gt;GhostBSD 18.12 released&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;GhostBSD 18.12 is an updated iso of GhostBSD 18.10 with some little changes to the live DVD/USB and with updated packages.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;What has changed since 18.10&lt;/li&gt;
&lt;li&gt;removed default call of kernel modules for AMD and Intel&lt;/li&gt;
&lt;li&gt;replaced octopkg by software-station&lt;/li&gt;
&lt;li&gt;added back gop hacks to the live system&lt;/li&gt;
&lt;li&gt;added ghostbsd-drivers and ghostbsd-utils&lt;/li&gt;
&lt;li&gt;we updated the packages to the latest build&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://threader.app/thread/1083054050315243521"&gt;And Now for a laugh : #unixinpictures&lt;/a&gt;&lt;/p&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.jwz.org/blog/2019/01/we-are-now-closer-to-the-y2038-bug-than-the-y2k-bug/"&gt;We are now closer to the Y2038 bug than the Y2K bug&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://old.reddit.com/r/openbsd/comments/ae6b77/openbsd_enterprise_use/"&gt;OpenBSD Enterprise use&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://old.reddit.com/r/unix/comments/af0kij/note_the_whole_book_series_in_the_background/"&gt;AT&amp;amp;T Unix Books&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://oshogbo.vexillium.org/blog/54/"&gt;Process title and missing memory space&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.os2museum.com/wp/the-history-of-a-security-hole/"&gt;The History of a Security Hole&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.geoghegan.ca/unbound-adblock.html"&gt;unbound-adblock: The ultimate network adblocker!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/wheelsystems/nvlist"&gt;FreeBSD’s name/value pairs library&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/unix/PidRollover"&gt;Pid Rollover&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.cambus.net/booting-openbsd-kernels-in-efi-mode-with-qemu/"&gt;Booting OpenBSD kernels in EFI mode with QEMU&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://marc.info/?l=openbsd-cvs&amp;amp;m=154715734504845&amp;amp;w=2"&gt;OpenBSD CVS commit: Make mincore lie&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.bsdcan.org/2019/papers.php"&gt;BSDCan 2019 CfP ending January 19 - Submit!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.eventbrite.com/e/zfs-user-conference-2019-tickets-54530403906"&gt;OpenZFS User Conference - April 18-19&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/journal/"&gt;FreeBSD Journal is a free publication now&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Chris - &lt;a href="http://dpaste.com/101P5HA"&gt;Boot environments and SSDs&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Jonathan - &lt;a href="http://dpaste.com/0YTPYV4"&gt;Bytes issued during a zpool scrub&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Bostjan - &lt;a href="http://dpaste.com/0Q97J7H#wrap"&gt;ZFS Record Size and my mistakes&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <content:encoded>
    <![CDATA[<p>SCP client vulnerabilities, BSDs vs Linux benchmarks on a Tyan EPYC Server, fame for the Unix inventors, Die IPv4, GhostBSD 18.12 released, Unix in pictures, and more.</p>

<p>##Headlines<br>
###<a href="https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt">scp client multiple vulnerabilities</a></p>

<ul>
<li>Overview</li>
<li>SCP clients from multiple vendors are susceptible to a malicious scp server performing<br>
unauthorized changes to target directory and/or client output manipulation.</li>
<li>Description</li>
<li>Many scp clients fail to verify if the objects returned by the scp server match those<br>
it asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate<br>
flaw in the client allows the target directory attributes to be changed arbitrarily.<br>
Finally, two vulnerabilities in clients may allow server to spoof the client output.</li>
<li>Impact</li>
<li>Malicious scp server can write arbitrary files to scp target directory, change the<br>
target directory permissions and to spoof the client output.</li>
<li>Details</li>
</ul>

<blockquote>
<p>The discovered vulnerabilities, described in more detail below, enables the attack<br>
described here in brief.</p>
</blockquote>

<ul>
<li>
<ol>
<li>The attacker controlled server or Man-in-the-Middle(*) attack drops .bash_aliases file to victim’s home directory when the victim performs scp operation from the server. The transfer of extra files is hidden by sending ANSI control sequences via stderr. For example:</li>
</ol>
</li>
</ul>

<p><code>user@local:~$ scp user@remote:readme.txt .</code><br>
<code>readme.txt 100% 494 1.6KB/s 00:00</code><br>
<code>user@local:~$</code></p>

<ul>
<li>
<ol start="2">
<li>Once the victim launches a new shell, the malicious commands in .bash_aliases get executed.</li>
</ol>
</li>
<li>*) Man-in-the-Middle attack does require the victim to accept the wrong host fingerprint.</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.phoronix.com/scan.php?page=article&amp;item=dfly-freebsd-tyanamd&amp;num=1">FreeBSD 12.0 vs. DragonFlyBSD 5.4 vs. TrueOS 18.12 vs. Linux On A Tyan EPYC Server</a></p>

<blockquote>
<p>Last month when running FreeBSD 12.0 benchmarks on a 2P EPYC server I wasn’t able to run any side-by-side benchmarks with the new DragonFlyBSD 5.4 as this BSD was crashing during the boot process on that board. But fortunately on another AMD EPYC server available, the EPYC 1P TYAN Transport SX TN70A-B8026, DragonFlyBSD 5.4.1 runs fine. So for this first round of BSD benchmarking in 2019 are tests of FreeBSD 11.2, FreeBSD 12.0, DragonFlyBSD 5.4.1, the new TrueOS 18.12, and a few Linux distributions (CentOS 7, Ubuntu 18.04.1 LTS, and Clear Linux) on this EPYC 7601 server in a variety of workloads.</p>
</blockquote>

<blockquote>
<p>DragonFlyBSD 5.4.1 ran fine on this Tyan server and could boot fine unlike the issue encountered on the Dell PowerEdge R7425 for this particular BSD. But on the Tyan server, DragonFlyBSD 5.2.2 wouldn’t boot so only this latest DragonFlyBSD release series was used as part of the comparison.</p>
</blockquote>

<ul>
<li>
<p>A summary of the operating systems tested for this EPYC 7601 OS benchmark comparison included:</p>
</li>
<li>
<p>DragonFlyBSD 5.4.1 - The latest release of Matthew Dillon’s operating system while using the HAMMER2 file-system and GCC 8.1 compiler that is now the default system compiler for this BSD.</p>
</li>
<li>
<p>FreeBSD 11.2 - The previous stable release of FreeBSD. Installed with a ZFS file-system.</p>
</li>
<li>
<p>FreeBSD 12.0 - The latest stable release of FreeBSD and installed with its ZFS option.</p>
</li>
<li>
<p>TrueOS 18.12 - The latest release of the iX systems’ FreeBSD derivative. TrueOS 18.12 is based on FreeBSD 13.0-CURRENT and uses ZFS by default and was using the Clang 7.0.1 compiler compared to Clang 6.0.1 on FreeBSD 12.0.</p>
</li>
<li>
<p>CentOS Linux 7 - The latest EL7 operating system performance.</p>
</li>
<li>
<p>Ubuntu 18.04.1 LTS - The latest Ubuntu Long Term Support release.</p>
</li>
<li>
<p>Clear Linux 27120 - The latest rolling release as of testing out of Intel’s Open-Source Technology Center. Clear Linux often reflects as close to the gold standard for performance as possible with its insanely tuned software stack for offering optimal performance on x86_64 performance for generally showing best what the hardware is capable of.</p>
</li>
</ul>

<blockquote>
<p>Throughout all of this testing, the Tyan 2U server was kept to its same configuration of an AMD EPYC 7601 (32 cores / 64 threads) at stock speeds, 8 x 16GB DDR4-2666 ECC memory, and 280GB Intel Optane 900p SSD benchmarks.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://www.engadget.com/2019/01/08/national-inventors-hall-of-fame-class-of-2019/">National Inventors Hall of Fame honors creators of Unix</a></p>

<blockquote>
<p>Dennis Ritchie (Posthumous) and Ken Thompson: UNIX Operating System<br>
Thompson and Ritchie’s creation of the UNIX operating system and the C programming language were pivotal developments in the progress of computer science. Today, 50 years after its beginnings, UNIX and UNIX-like systems continue to run machinery from supercomputers to smartphones. The UNIX operating system remains the basis of much of the world’s computing infrastructure, and C language – written to simplify the development of UNIX – is one of the most widely used languages today.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://ungleich.ch/en-us/cms/blog/2019/01/09/die-ipv4-die/">Die IPV4, Die</a></p>

<blockquote>
<p>Imagine, it is 2019. Easy, ha? Imagine, it is 2019 and you want to turn off IPv4. Like, off off. Really off. Not disabling IPv6, but disabling IPv4.</p>
</blockquote>

<ul>
<li>Two steps back</li>
</ul>

<blockquote>
<p>You might be coming here wondering, why would anybody want to do what we are asking to be done. Well, it is dead simple: We are running data centers (like Data Center Light) with a lot of IPv6 only equipment. There simply is no need for IPv4. So why would we want to have it enabled?<br>
Also, here at ungleich, we defined 2019 as the year to move away from IPv4.</p>
</blockquote>

<ul>
<li>The challenge</li>
</ul>

<blockquote>
<p>Do you like puzzles? Competitions? Challenges? Hacking? Well. If ANY of this is of your interest, here is a real challenge for you:<br>
We offer a 100 CHF (roughly 100 USD) for anyone who can give us a detailed description of how to turn IPv4 completely off in an operating system and allowing it to communicate with IPv6 only. This should obviously include a tiny proof that your operating system is really unable to use IPv4 at all. Just flushing IPv4 addresses and keeping the IPv4 stack loaded, does not count.</p>
</blockquote>

<p><hr></p>

<p>###<a href="http://www.ghostbsd.org/18.12_release_announcement">GhostBSD 18.12 released</a></p>

<blockquote>
<p>GhostBSD 18.12 is an updated iso of GhostBSD 18.10 with some little changes to the live DVD/USB and with updated packages.</p>
</blockquote>

<ul>
<li>What has changed since 18.10</li>
<li>removed default call of kernel modules for AMD and Intel</li>
<li>replaced octopkg by software-station</li>
<li>added back gop hacks to the live system</li>
<li>added ghostbsd-drivers and ghostbsd-utils</li>
<li>we updated the packages to the latest build</li>
</ul>

<p><hr></p>

<p>###<a href="https://threader.app/thread/1083054050315243521">And Now for a laugh : #unixinpictures</a></p>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.jwz.org/blog/2019/01/we-are-now-closer-to-the-y2038-bug-than-the-y2k-bug/">We are now closer to the Y2038 bug than the Y2K bug</a></li>
<li><a href="https://old.reddit.com/r/openbsd/comments/ae6b77/openbsd_enterprise_use/">OpenBSD Enterprise use</a></li>
<li><a href="https://old.reddit.com/r/unix/comments/af0kij/note_the_whole_book_series_in_the_background/">AT&amp;T Unix Books</a></li>
<li><a href="https://oshogbo.vexillium.org/blog/54/">Process title and missing memory space</a></li>
<li><a href="http://www.os2museum.com/wp/the-history-of-a-security-hole/">The History of a Security Hole</a></li>
<li><a href="https://www.geoghegan.ca/unbound-adblock.html">unbound-adblock: The ultimate network adblocker!</a></li>
<li><a href="https://github.com/wheelsystems/nvlist">FreeBSD’s name/value pairs library</a></li>
<li><a href="https://utcc.utoronto.ca/~cks/space/blog/unix/PidRollover">Pid Rollover</a></li>
<li><a href="https://www.cambus.net/booting-openbsd-kernels-in-efi-mode-with-qemu/">Booting OpenBSD kernels in EFI mode with QEMU</a></li>
<li><a href="https://marc.info/?l=openbsd-cvs&amp;m=154715734504845&amp;w=2">OpenBSD CVS commit: Make mincore lie</a></li>
<li><a href="http://www.bsdcan.org/2019/papers.php">BSDCan 2019 CfP ending January 19 - Submit!</a></li>
<li><a href="https://www.eventbrite.com/e/zfs-user-conference-2019-tickets-54530403906">OpenZFS User Conference - April 18-19</a></li>
<li><a href="https://www.freebsdfoundation.org/journal/">FreeBSD Journal is a free publication now</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Chris - <a href="http://dpaste.com/101P5HA">Boot environments and SSDs</a></li>
<li>Jonathan - <a href="http://dpaste.com/0YTPYV4">Bytes issued during a zpool scrub</a></li>
<li>Bostjan - <a href="http://dpaste.com/0Q97J7H#wrap">ZFS Record Size and my mistakes</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>SCP client vulnerabilities, BSDs vs Linux benchmarks on a Tyan EPYC Server, fame for the Unix inventors, Die IPv4, GhostBSD 18.12 released, Unix in pictures, and more.</p>

<p>##Headlines<br>
###<a href="https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt">scp client multiple vulnerabilities</a></p>

<ul>
<li>Overview</li>
<li>SCP clients from multiple vendors are susceptible to a malicious scp server performing<br>
unauthorized changes to target directory and/or client output manipulation.</li>
<li>Description</li>
<li>Many scp clients fail to verify if the objects returned by the scp server match those<br>
it asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate<br>
flaw in the client allows the target directory attributes to be changed arbitrarily.<br>
Finally, two vulnerabilities in clients may allow server to spoof the client output.</li>
<li>Impact</li>
<li>Malicious scp server can write arbitrary files to scp target directory, change the<br>
target directory permissions and to spoof the client output.</li>
<li>Details</li>
</ul>

<blockquote>
<p>The discovered vulnerabilities, described in more detail below, enables the attack<br>
described here in brief.</p>
</blockquote>

<ul>
<li>
<ol>
<li>The attacker controlled server or Man-in-the-Middle(*) attack drops .bash_aliases file to victim’s home directory when the victim performs scp operation from the server. The transfer of extra files is hidden by sending ANSI control sequences via stderr. For example:</li>
</ol>
</li>
</ul>

<p><code>user@local:~$ scp user@remote:readme.txt .</code><br>
<code>readme.txt 100% 494 1.6KB/s 00:00</code><br>
<code>user@local:~$</code></p>

<ul>
<li>
<ol start="2">
<li>Once the victim launches a new shell, the malicious commands in .bash_aliases get executed.</li>
</ol>
</li>
<li>*) Man-in-the-Middle attack does require the victim to accept the wrong host fingerprint.</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.phoronix.com/scan.php?page=article&amp;item=dfly-freebsd-tyanamd&amp;num=1">FreeBSD 12.0 vs. DragonFlyBSD 5.4 vs. TrueOS 18.12 vs. Linux On A Tyan EPYC Server</a></p>

<blockquote>
<p>Last month when running FreeBSD 12.0 benchmarks on a 2P EPYC server I wasn’t able to run any side-by-side benchmarks with the new DragonFlyBSD 5.4 as this BSD was crashing during the boot process on that board. But fortunately on another AMD EPYC server available, the EPYC 1P TYAN Transport SX TN70A-B8026, DragonFlyBSD 5.4.1 runs fine. So for this first round of BSD benchmarking in 2019 are tests of FreeBSD 11.2, FreeBSD 12.0, DragonFlyBSD 5.4.1, the new TrueOS 18.12, and a few Linux distributions (CentOS 7, Ubuntu 18.04.1 LTS, and Clear Linux) on this EPYC 7601 server in a variety of workloads.</p>
</blockquote>

<blockquote>
<p>DragonFlyBSD 5.4.1 ran fine on this Tyan server and could boot fine unlike the issue encountered on the Dell PowerEdge R7425 for this particular BSD. But on the Tyan server, DragonFlyBSD 5.2.2 wouldn’t boot so only this latest DragonFlyBSD release series was used as part of the comparison.</p>
</blockquote>

<ul>
<li>
<p>A summary of the operating systems tested for this EPYC 7601 OS benchmark comparison included:</p>
</li>
<li>
<p>DragonFlyBSD 5.4.1 - The latest release of Matthew Dillon’s operating system while using the HAMMER2 file-system and GCC 8.1 compiler that is now the default system compiler for this BSD.</p>
</li>
<li>
<p>FreeBSD 11.2 - The previous stable release of FreeBSD. Installed with a ZFS file-system.</p>
</li>
<li>
<p>FreeBSD 12.0 - The latest stable release of FreeBSD and installed with its ZFS option.</p>
</li>
<li>
<p>TrueOS 18.12 - The latest release of the iX systems’ FreeBSD derivative. TrueOS 18.12 is based on FreeBSD 13.0-CURRENT and uses ZFS by default and was using the Clang 7.0.1 compiler compared to Clang 6.0.1 on FreeBSD 12.0.</p>
</li>
<li>
<p>CentOS Linux 7 - The latest EL7 operating system performance.</p>
</li>
<li>
<p>Ubuntu 18.04.1 LTS - The latest Ubuntu Long Term Support release.</p>
</li>
<li>
<p>Clear Linux 27120 - The latest rolling release as of testing out of Intel’s Open-Source Technology Center. Clear Linux often reflects as close to the gold standard for performance as possible with its insanely tuned software stack for offering optimal performance on x86_64 performance for generally showing best what the hardware is capable of.</p>
</li>
</ul>

<blockquote>
<p>Throughout all of this testing, the Tyan 2U server was kept to its same configuration of an AMD EPYC 7601 (32 cores / 64 threads) at stock speeds, 8 x 16GB DDR4-2666 ECC memory, and 280GB Intel Optane 900p SSD benchmarks.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://www.engadget.com/2019/01/08/national-inventors-hall-of-fame-class-of-2019/">National Inventors Hall of Fame honors creators of Unix</a></p>

<blockquote>
<p>Dennis Ritchie (Posthumous) and Ken Thompson: UNIX Operating System<br>
Thompson and Ritchie’s creation of the UNIX operating system and the C programming language were pivotal developments in the progress of computer science. Today, 50 years after its beginnings, UNIX and UNIX-like systems continue to run machinery from supercomputers to smartphones. The UNIX operating system remains the basis of much of the world’s computing infrastructure, and C language – written to simplify the development of UNIX – is one of the most widely used languages today.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://ungleich.ch/en-us/cms/blog/2019/01/09/die-ipv4-die/">Die IPV4, Die</a></p>

<blockquote>
<p>Imagine, it is 2019. Easy, ha? Imagine, it is 2019 and you want to turn off IPv4. Like, off off. Really off. Not disabling IPv6, but disabling IPv4.</p>
</blockquote>

<ul>
<li>Two steps back</li>
</ul>

<blockquote>
<p>You might be coming here wondering, why would anybody want to do what we are asking to be done. Well, it is dead simple: We are running data centers (like Data Center Light) with a lot of IPv6 only equipment. There simply is no need for IPv4. So why would we want to have it enabled?<br>
Also, here at ungleich, we defined 2019 as the year to move away from IPv4.</p>
</blockquote>

<ul>
<li>The challenge</li>
</ul>

<blockquote>
<p>Do you like puzzles? Competitions? Challenges? Hacking? Well. If ANY of this is of your interest, here is a real challenge for you:<br>
We offer a 100 CHF (roughly 100 USD) for anyone who can give us a detailed description of how to turn IPv4 completely off in an operating system and allowing it to communicate with IPv6 only. This should obviously include a tiny proof that your operating system is really unable to use IPv4 at all. Just flushing IPv4 addresses and keeping the IPv4 stack loaded, does not count.</p>
</blockquote>

<p><hr></p>

<p>###<a href="http://www.ghostbsd.org/18.12_release_announcement">GhostBSD 18.12 released</a></p>

<blockquote>
<p>GhostBSD 18.12 is an updated iso of GhostBSD 18.10 with some little changes to the live DVD/USB and with updated packages.</p>
</blockquote>

<ul>
<li>What has changed since 18.10</li>
<li>removed default call of kernel modules for AMD and Intel</li>
<li>replaced octopkg by software-station</li>
<li>added back gop hacks to the live system</li>
<li>added ghostbsd-drivers and ghostbsd-utils</li>
<li>we updated the packages to the latest build</li>
</ul>

<p><hr></p>

<p>###<a href="https://threader.app/thread/1083054050315243521">And Now for a laugh : #unixinpictures</a></p>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.jwz.org/blog/2019/01/we-are-now-closer-to-the-y2038-bug-than-the-y2k-bug/">We are now closer to the Y2038 bug than the Y2K bug</a></li>
<li><a href="https://old.reddit.com/r/openbsd/comments/ae6b77/openbsd_enterprise_use/">OpenBSD Enterprise use</a></li>
<li><a href="https://old.reddit.com/r/unix/comments/af0kij/note_the_whole_book_series_in_the_background/">AT&amp;T Unix Books</a></li>
<li><a href="https://oshogbo.vexillium.org/blog/54/">Process title and missing memory space</a></li>
<li><a href="http://www.os2museum.com/wp/the-history-of-a-security-hole/">The History of a Security Hole</a></li>
<li><a href="https://www.geoghegan.ca/unbound-adblock.html">unbound-adblock: The ultimate network adblocker!</a></li>
<li><a href="https://github.com/wheelsystems/nvlist">FreeBSD’s name/value pairs library</a></li>
<li><a href="https://utcc.utoronto.ca/~cks/space/blog/unix/PidRollover">Pid Rollover</a></li>
<li><a href="https://www.cambus.net/booting-openbsd-kernels-in-efi-mode-with-qemu/">Booting OpenBSD kernels in EFI mode with QEMU</a></li>
<li><a href="https://marc.info/?l=openbsd-cvs&amp;m=154715734504845&amp;w=2">OpenBSD CVS commit: Make mincore lie</a></li>
<li><a href="http://www.bsdcan.org/2019/papers.php">BSDCan 2019 CfP ending January 19 - Submit!</a></li>
<li><a href="https://www.eventbrite.com/e/zfs-user-conference-2019-tickets-54530403906">OpenZFS User Conference - April 18-19</a></li>
<li><a href="https://www.freebsdfoundation.org/journal/">FreeBSD Journal is a free publication now</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Chris - <a href="http://dpaste.com/101P5HA">Boot environments and SSDs</a></li>
<li>Jonathan - <a href="http://dpaste.com/0YTPYV4">Bytes issued during a zpool scrub</a></li>
<li>Bostjan - <a href="http://dpaste.com/0Q97J7H#wrap">ZFS Record Size and my mistakes</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 280: FOSS Clothing | BSD Now 280</title>
  <link>https://www.bsdnow.tv/280</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-3132</guid>
  <pubDate>Thu, 10 Jan 2019 03:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/bad2a854-7f51-4ff6-84a9-7c324c5cf277.mp3" length="31619268" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A EULA in FOSS clothing, NetBSD with more LLVM support, Thoughts on FreeBSD 12.0, FreeBSD Performance against Windows and Linux on Xeon, Microsoft shipping NetBSD, and more.</itunes:subtitle>
  <itunes:duration>52:23</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A EULA in FOSS clothing, NetBSD with more LLVM support, Thoughts on FreeBSD 12.0, FreeBSD Performance against Windows and Linux on Xeon, Microsoft shipping NetBSD, and more.
Headlines
&lt;a href="http://dtrace.org/blogs/bmc/2018/12/16/a-eula-in-foss-clothing/"&gt;A EULA in FOSS clothing?&lt;/a&gt;
&lt;blockquote&gt;There was a tremendous amount of reaction to and discussion about &lt;a href="http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts-its-midlife-crisis/"&gt;my blog entry on the midlife crisis in open source&lt;/a&gt;. As part of this discussion on HN, Jay Kreps of Confluent took the time to write a &lt;a href="https://news.ycombinator.com/item?id=18687498#18689179"&gt;detailed response&lt;/a&gt; — which he shortly thereafter elevated into a &lt;a href="https://medium.com/@jaykreps/a-quick-comment-on-bryan-cantrills-blog-on-licensing-8dccee41d9e6"&gt;blog entry&lt;/a&gt;.&lt;/blockquote&gt;
&lt;blockquote&gt;Let me be clear that I hold Jay in high regard, as both a software engineer and an entrepreneur — and I appreciate the time he took to write a thoughtful response. That said, there are aspects of his response that I found troubling enough to closely re-read the Confluent Community License — and that in turn has led me to a deeply disturbing realization about what is potentially going on here.&lt;/blockquote&gt;
&lt;blockquote&gt;To GitHub: Assuming that this is in fact a EULA, I think it is perilous to allow EULAs to sit in public repositories. It’s one thing to have one click through to accept a license (though again, that itself is dubious), but to say that a git clone is an implicit acceptance of a contract that happens to be sitting somewhere in the repository beggars belief. With efforts like &lt;a href="http://choosealicense.com"&gt;choosealicense.com&lt;/a&gt;, GitHub has been a model in guiding projects with respect to licensing; it would be helpful for GitHub’s counsel to weigh in on their view of this new strain of source-available proprietary software and the degree to which it comes into conflict with GitHub’s own terms of service.&lt;/blockquote&gt;
&lt;blockquote&gt;To foundations concerned with software liberties, including the Apache Foundation, the Linux Foundation, the Free Software Foundation, the Electronic Frontier Foundation, the Open Source Initiative, and the Software Freedom Conservancy: the open source community needs your legal review on this! I don’t think I’m being too alarmist when I say that this is potentially a dangerous new precedent being set; it would be very helpful to have your lawyers offer their perspectives on this, even if they disagree with one another. We seem to be in some terrible new era of frankenlicenses, where the worst of proprietary licenses are bolted on to the goodwill created by open source licenses; we need your legal voices before these creatures destroy the village!&lt;/blockquote&gt;

&lt;hr&gt;
NetBSD and LLVM
&lt;a href="https://blog.netbsd.org/tnf/entry/netbsd_entering_2019_with_more"&gt;NetBSD entering 2019 with more complete LLVM support&lt;/a&gt;
&lt;blockquote&gt;I’m recently helping the NetBSD developers to improve the support for this operating system in various LLVM components. As you can read in my previous report, I’ve been focusing on fixing build and test failures for the purpose of improving the buildbot coverage.
Previously, I’ve resolved test failures in LLVM, Clang, LLD, libunwind, openmp and partially libc++. During the remainder of the month, I’ve been working on the remaining libc++ test failures, improving the NetBSD clang driver and helping Kamil Rytarowski with compiler-rt.&lt;/blockquote&gt;
&lt;a href="https://blog.netbsd.org/tnf/entry/the_process_of_upstreaming_support"&gt;The process of upstreaming support to LLVM sanitizers has been finalized&lt;/a&gt;
&lt;blockquote&gt;I’ve finished the process of upstreaming patches to LLVM sanitizers (almost 2000LOC of local code) and submitted to upstream new improvements for the NetBSD support. Today out of the box (in unpatched version) we have support for a variety of compiler-rt LLVM features: ASan (finds unauthorized memory access), UBSan (finds unspecified code semantics), TSan (finds threading bugs), MSan (finds uninitialized memory use), SafeStack (double stack hardening), Profile (code coverage), XRay (dynamic code tracing); while other ones such as Scudo (hardened allocator) or DFSan (generic data flow sanitizer) are not far away from completeness.
The NetBSD support is no longer visibly lacking behind Linux in sanitizers, although there are still failing tests on NetBSD that are not observed on Linux. On the other hand there are features working on NetBSD that are not functional on Linux, like sanitizing programs during early initialization process of OS (this is caused by /proc dependency on Linux that is mounted by startup programs, while NetBSD relies on sysctl(3) interfaces that is always available).&lt;/blockquote&gt;
&lt;hr&gt;
News Roundup
&lt;a href="https://distrowatch.com/weekly.php?issue=20190107#freebsd"&gt;Thoughts on FreeBSD 12.0&lt;/a&gt;
&lt;blockquote&gt;Playing with FreeBSD with past week I don’t feel as though there were any big surprises or changes in this release compared to FreeBSD 11. In typical FreeBSD fashion, progress tends to be evolutionary rather than revolutionary, and this release feels like a polished and improved incremental step forward. I like that the installer handles both UFS and ZFS guided partitioning now and in a friendly manner. In the past I had trouble getting FreeBSD’s boot menu to work with boot environments, but that has been fixed for this release.
I like the security options in the installer too. These are not new, but I think worth mentioning. FreeBSD, unlike most Linux distributions, offers several low-level security options (like hiding other users’ processes and randomizing PIDs) and I like having these presented at install time. It’s harder for people to attack what they cannot see, or predict, and FreeBSD optionally makes these little adjustment for us.
Something which stands out about FreeBSD, compared to most Linux distributions I run, is that FreeBSD rarely holds the user’s hand, but also rarely surprises the user. This means there is more reading to do up front and new users may struggle to get used to editing configuration files in a text editor. But FreeBSD rarely does anything unless told to do it. Updates rarely change the system’s behaviour, working technology rarely gets swapped out for something new, the system and its applications never crashed during my trial. Everything was rock solid. The operating system may seem like a minimal, blank slate to new users, but it’s wonderfully dependable and predictable in my experience.
I probably wouldn’t recommend FreeBSD for desktop use. It’s close relative, GhostBSD, ships with a friendly desktop and does special work to make end user applications run smoothly. But for people who want to run servers, possible for years without change or issues, FreeBSD is a great option. It’s also an attractive choice, in my opinion, for people who like to build their system from the ground up, like you would with Debian’s server install or Arch Linux. Apart from the base tools and documentation, there is nothing on a FreeBSD system apart from what we put on it.&lt;/blockquote&gt;

&lt;hr&gt;
&lt;a href="https://www.phoronix.com/scan.php?page=article&amp;amp;item=freebsd-12-windows&amp;amp;num=1"&gt;FreeBSD 12.0 Performance Against Windows &amp;amp; Linux On An Intel Xeon Server&lt;/a&gt;
&lt;blockquote&gt;Last week I posted benchmarks of Windows Server 2019 against various Linux distributions using a Tyan dual socket Intel Xeon server. In this article are some complementary results when adding in the performance of FreeBSD 11.2 against the new FreeBSD 12.0 stable release for this leading BSD operating system. As some fun benchmarks to end out 2018, here are the results of FreeBSD 11.2/12.0 (including an additional run when using GCC rather than Clang) up against Windows Server and several enterprise-ready Linux distributions.
While FreeBSD 12.0 had picked up just one win of the Windows/Linux comparisons run, the FreeBSD performance is moving in the right direction. FreeBSD 12.0 was certainly faster than FreeBSD 11.2 on this dual Intel Xeon Scalable server based on a Tyan 1U platform. Meanwhile, to no surprise given the data last week, Clear Linux was by far the fastest out-of-the-box operating system tested.
I did run some extra benchmarks on FreeBSD 11.2/12.0 with this hardware: in total I ran 120 benchmarks for these BSD tests. Of the 120 tests, there were just 15 cases where FreeBSD 11.2 was faster than 12.0. Seeing FreeBSD 12.0 faster than 11.2 nearly 90% of the time is an accomplishment and usually with other operating systems we see more of a mixed bag on new releases with not such solidly better performance. It was also great seeing the competitive performance out of FreeBSD when using the Clang compiler for the source-based tests compared to the GCC8 performance. Additional data available via this &lt;a href="http://OpenBenchmarking.org"&gt;OpenBenchmarking.org&lt;/a&gt; result file.&lt;/blockquote&gt;

&lt;hr&gt;
&lt;a href="http://fogey.com/contemplating/?p=1023"&gt;How NetBSD came to be shipped by Microsoft&lt;/a&gt;
&lt;a href="https://webcache.googleusercontent.com/search?q=cache:5XwAm5tvJ4AJ:fogey.com/contemplating/%3Fp%3D1023+&amp;amp;cd=1&amp;amp;hl=en&amp;amp;ct=clnk&amp;amp;gl=us"&gt;Google cache in case the site is down&lt;/a&gt;
&lt;blockquote&gt;In 2000, Joe Britt, Matt Hershenson and Andy Rubin formed Danger Incorporated. Danger developed the world’s first recognizable smartphone, the Danger HipTop. T-Mobile sold the first HipTop under the brand name Sidekick in October of 2002.
Danger had a well developed kernel that had been designed and built in house. The kernel came to be viewed as not a core intellectual property and Danger started a search for a replacement. For business reasons, mostly to do with legal concerns over the Gnu Public License, Danger rejected Linux and began to consider BSD Unix as a replacement for the kernel.
In 2006 I was hired by Mike Chen, the manager of the kernel development group to investigate the feasibility of replacing the Danger kernel with a BSD kernel, to select the version of BSD to use, to develop a prototype and to develop the plan for adapting BSD to Danger’s requirements.
NetBSD was easily the best choice among the BSD variations at the time because it had well developed cross development tools. It was easy to use a NetBSD desktop running an Intel release to cross compile a NetBSD kernel and runtime for a device running an ARM processor. (Those interested in mailing list archaeology might be amused to investigate NetBSD technical mailing list for mail from picovex, particularly from Bucky Katz at picovex.)
We began product development on the specific prototype of the phone that would become the Sidekick LX2009 in 2007 and contracts for the phone were written with T-Mobile. We were about half way through the two year development cycle when Microsoft purchased Danger in 2008.
Microsoft would have preferred to ship the Sidekick running Windows/CE rather than NetBSD, but a schedule analysis performed by me, and another by an independent outside contractor, indicated that doing so would result in unacceptable delay.&lt;/blockquote&gt;
&lt;hr&gt;
Beastie Bits
&lt;ul&gt;
    &lt;li&gt;&lt;a href="http://lists.31bits.net/archives/devel/2018-December/000033.html"&gt;Unleashed 1.2 Released&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://media.ccc.de/v/35c3-9647-taming_the_chaos_can_we_build_systems_that_actually_work"&gt;35th CCC - Taming the Chaos: Can we build systems that actually work? &lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://rachelbythebay.com/w/2018/12/30/v6/"&gt;Potholes to avoid when migrating to IPv6&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://www.jwz.org/blog/2018/12/xscreensaver-5-41/"&gt;XScreenSaver 5.42&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://hackertarget.com/ssh-examples-tunnels/"&gt;SSH Examples and Tunnels&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://old.reddit.com/r/freebsd/comments/abevqa/mbuf9_request_for_comment/"&gt;Help request - mbuf(9) - request for comment&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://www.zdnet.com/article/nsa-to-release-a-free-reverse-engineering-tool/"&gt;NSA to release free Reverse Engineering Tool&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html"&gt;Running FreeBSD on a Raspberry Pi3 using a custom image created with crochet and poudriere&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
Feedback/Questions
&lt;ul&gt;
    &lt;li&gt;Dries - &lt;a href="http://dpaste.com/2DCEJD6#wrap"&gt;Lets talk a bit about VIMAGE jails&lt;/a&gt;
&lt;/li&gt;
    &lt;li&gt;ohb - &lt;a href="http://dpaste.com/1EGDSKQ#wrap"&gt;Question About ZFS Root Dataset&lt;/a&gt;
&lt;/li&gt;
    &lt;li&gt;Micah - &lt;a href="http://dpaste.com/3TK2JWF#wrap"&gt;Active-Active NAS Sync recommendations&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
    &lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, EULA, github, llvm, microsoft, sidekick, danger, CCC, xscreensaver, ssh, nsa</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A EULA in FOSS clothing, NetBSD with more LLVM support, Thoughts on FreeBSD 12.0, FreeBSD Performance against Windows and Linux on Xeon, Microsoft shipping NetBSD, and more.</p>

<h2>Headlines</h2>

<h3><a href="http://dtrace.org/blogs/bmc/2018/12/16/a-eula-in-foss-clothing/">A EULA in FOSS clothing?</a></h3>

<blockquote>There was a tremendous amount of reaction to and discussion about <a href="http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts-its-midlife-crisis/">my blog entry on the midlife crisis in open source</a>. As part of this discussion on HN, Jay Kreps of Confluent took the time to write a <a href="https://news.ycombinator.com/item?id=18687498#18689179">detailed response</a> — which he shortly thereafter elevated into a <a href="https://medium.com/@jaykreps/a-quick-comment-on-bryan-cantrills-blog-on-licensing-8dccee41d9e6">blog entry</a>.</blockquote>

<blockquote>Let me be clear that I hold Jay in high regard, as both a software engineer and an entrepreneur — and I appreciate the time he took to write a thoughtful response. That said, there are aspects of his response that I found troubling enough to closely re-read the Confluent Community License — and that in turn has led me to a deeply disturbing realization about what is potentially going on here.</blockquote>

<blockquote>To GitHub: Assuming that this is in fact a EULA, I think it is perilous to allow EULAs to sit in public repositories. It’s one thing to have one click through to accept a license (though again, that itself is dubious), but to say that a git clone is an implicit acceptance of a contract that happens to be sitting somewhere in the repository beggars belief. With efforts like <a href="http://choosealicense.com">choosealicense.com</a>, GitHub has been a model in guiding projects with respect to licensing; it would be helpful for GitHub’s counsel to weigh in on their view of this new strain of source-available proprietary software and the degree to which it comes into conflict with GitHub’s own terms of service.</blockquote>

<blockquote>To foundations concerned with software liberties, including the Apache Foundation, the Linux Foundation, the Free Software Foundation, the Electronic Frontier Foundation, the Open Source Initiative, and the Software Freedom Conservancy: the open source community needs your legal review on this! I don’t think I’m being too alarmist when I say that this is potentially a dangerous new precedent being set; it would be very helpful to have your lawyers offer their perspectives on this, even if they disagree with one another. We seem to be in some terrible new era of frankenlicenses, where the worst of proprietary licenses are bolted on to the goodwill created by open source licenses; we need your legal voices before these creatures destroy the village!</blockquote>

<p><hr /></p>

<h3>NetBSD and LLVM</h3>

<p><a href="https://blog.netbsd.org/tnf/entry/netbsd_entering_2019_with_more">NetBSD entering 2019 with more complete LLVM support</a></p>

<blockquote>I’m recently helping the NetBSD developers to improve the support for this operating system in various LLVM components. As you can read in my previous report, I’ve been focusing on fixing build and test failures for the purpose of improving the buildbot coverage.
Previously, I’ve resolved test failures in LLVM, Clang, LLD, libunwind, openmp and partially libc++. During the remainder of the month, I’ve been working on the remaining libc++ test failures, improving the NetBSD clang driver and helping Kamil Rytarowski with compiler-rt.</blockquote>

<p><a href="https://blog.netbsd.org/tnf/entry/the_process_of_upstreaming_support">The process of upstreaming support to LLVM sanitizers has been finalized</a></p>

<blockquote>I’ve finished the process of upstreaming patches to LLVM sanitizers (almost 2000LOC of local code) and submitted to upstream new improvements for the NetBSD support. Today out of the box (in unpatched version) we have support for a variety of compiler-rt LLVM features: ASan (finds unauthorized memory access), UBSan (finds unspecified code semantics), TSan (finds threading bugs), MSan (finds uninitialized memory use), SafeStack (double stack hardening), Profile (code coverage), XRay (dynamic code tracing); while other ones such as Scudo (hardened allocator) or DFSan (generic data flow sanitizer) are not far away from completeness.
The NetBSD support is no longer visibly lacking behind Linux in sanitizers, although there are still failing tests on NetBSD that are not observed on Linux. On the other hand there are features working on NetBSD that are not functional on Linux, like sanitizing programs during early initialization process of OS (this is caused by /proc dependency on Linux that is mounted by startup programs, while NetBSD relies on sysctl(3) interfaces that is always available).</blockquote>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20190107#freebsd">Thoughts on FreeBSD 12.0</a></h3>

<blockquote>Playing with FreeBSD with past week I don’t feel as though there were any big surprises or changes in this release compared to FreeBSD 11. In typical FreeBSD fashion, progress tends to be evolutionary rather than revolutionary, and this release feels like a polished and improved incremental step forward. I like that the installer handles both UFS and ZFS guided partitioning now and in a friendly manner. In the past I had trouble getting FreeBSD’s boot menu to work with boot environments, but that has been fixed for this release.
I like the security options in the installer too. These are not new, but I think worth mentioning. FreeBSD, unlike most Linux distributions, offers several low-level security options (like hiding other users’ processes and randomizing PIDs) and I like having these presented at install time. It’s harder for people to attack what they cannot see, or predict, and FreeBSD optionally makes these little adjustment for us.
Something which stands out about FreeBSD, compared to most Linux distributions I run, is that FreeBSD rarely holds the user’s hand, but also rarely surprises the user. This means there is more reading to do up front and new users may struggle to get used to editing configuration files in a text editor. But FreeBSD rarely does anything unless told to do it. Updates rarely change the system’s behaviour, working technology rarely gets swapped out for something new, the system and its applications never crashed during my trial. Everything was rock solid. The operating system may seem like a minimal, blank slate to new users, but it’s wonderfully dependable and predictable in my experience.
I probably wouldn’t recommend FreeBSD for desktop use. It’s close relative, GhostBSD, ships with a friendly desktop and does special work to make end user applications run smoothly. But for people who want to run servers, possible for years without change or issues, FreeBSD is a great option. It’s also an attractive choice, in my opinion, for people who like to build their system from the ground up, like you would with Debian’s server install or Arch Linux. Apart from the base tools and documentation, there is nothing on a FreeBSD system apart from what we put on it.</blockquote>

<p><hr /></p>

<h3><a href="https://www.phoronix.com/scan.php?page=article&amp;item=freebsd-12-windows&amp;num=1">FreeBSD 12.0 Performance Against Windows &amp; Linux On An Intel Xeon Server</a></h3>

<blockquote>Last week I posted benchmarks of Windows Server 2019 against various Linux distributions using a Tyan dual socket Intel Xeon server. In this article are some complementary results when adding in the performance of FreeBSD 11.2 against the new FreeBSD 12.0 stable release for this leading BSD operating system. As some fun benchmarks to end out 2018, here are the results of FreeBSD 11.2/12.0 (including an additional run when using GCC rather than Clang) up against Windows Server and several enterprise-ready Linux distributions.
While FreeBSD 12.0 had picked up just one win of the Windows/Linux comparisons run, the FreeBSD performance is moving in the right direction. FreeBSD 12.0 was certainly faster than FreeBSD 11.2 on this dual Intel Xeon Scalable server based on a Tyan 1U platform. Meanwhile, to no surprise given the data last week, Clear Linux was by far the fastest out-of-the-box operating system tested.
I did run some extra benchmarks on FreeBSD 11.2/12.0 with this hardware: in total I ran 120 benchmarks for these BSD tests. Of the 120 tests, there were just 15 cases where FreeBSD 11.2 was faster than 12.0. Seeing FreeBSD 12.0 faster than 11.2 nearly 90% of the time is an accomplishment and usually with other operating systems we see more of a mixed bag on new releases with not such solidly better performance. It was also great seeing the competitive performance out of FreeBSD when using the Clang compiler for the source-based tests compared to the GCC8 performance. Additional data available via this <a href="http://OpenBenchmarking.org">OpenBenchmarking.org</a> result file.</blockquote>

<p><hr /></p>

<h3><a href="http://fogey.com/contemplating/?p=1023">How NetBSD came to be shipped by Microsoft</a></h3>

<p><a href="https://webcache.googleusercontent.com/search?q=cache:5XwAm5tvJ4AJ:fogey.com/contemplating/%3Fp%3D1023+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us">Google cache in case the site is down</a></p>

<blockquote>In 2000, Joe Britt, Matt Hershenson and Andy Rubin formed Danger Incorporated. Danger developed the world’s first recognizable smartphone, the Danger HipTop. T-Mobile sold the first HipTop under the brand name Sidekick in October of 2002.
Danger had a well developed kernel that had been designed and built in house. The kernel came to be viewed as not a core intellectual property and Danger started a search for a replacement. For business reasons, mostly to do with legal concerns over the Gnu Public License, Danger rejected Linux and began to consider BSD Unix as a replacement for the kernel.
In 2006 I was hired by Mike Chen, the manager of the kernel development group to investigate the feasibility of replacing the Danger kernel with a BSD kernel, to select the version of BSD to use, to develop a prototype and to develop the plan for adapting BSD to Danger’s requirements.
NetBSD was easily the best choice among the BSD variations at the time because it had well developed cross development tools. It was easy to use a NetBSD desktop running an Intel release to cross compile a NetBSD kernel and runtime for a device running an ARM processor. (Those interested in mailing list archaeology might be amused to investigate NetBSD technical mailing list for mail from picovex, particularly from Bucky Katz at picovex.)
We began product development on the specific prototype of the phone that would become the Sidekick LX2009 in 2007 and contracts for the phone were written with T-Mobile. We were about half way through the two year development cycle when Microsoft purchased Danger in 2008.
Microsoft would have preferred to ship the Sidekick running Windows/CE rather than NetBSD, but a schedule analysis performed by me, and another by an independent outside contractor, indicated that doing so would result in unacceptable delay.</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
    <li><a href="http://lists.31bits.net/archives/devel/2018-December/000033.html">Unleashed 1.2 Released</a></li>
    <li><a href="https://media.ccc.de/v/35c3-9647-taming_the_chaos_can_we_build_systems_that_actually_work">35th CCC - Taming the Chaos: Can we build systems that actually work? </a></li>
    <li><a href="https://rachelbythebay.com/w/2018/12/30/v6/">Potholes to avoid when migrating to IPv6</a></li>
    <li><a href="https://www.jwz.org/blog/2018/12/xscreensaver-5-41/">XScreenSaver 5.42</a></li>
    <li><a href="https://hackertarget.com/ssh-examples-tunnels/">SSH Examples and Tunnels</a></li>
    <li><a href="https://old.reddit.com/r/freebsd/comments/abevqa/mbuf9_request_for_comment/">Help request - mbuf(9) - request for comment</a></li>
    <li><a href="https://www.zdnet.com/article/nsa-to-release-a-free-reverse-engineering-tool/">NSA to release free Reverse Engineering Tool</a></li>
    <li><a href="https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html">Running FreeBSD on a Raspberry Pi3 using a custom image created with crochet and poudriere</a></li>
</ul>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
    <li>Dries - <a href="http://dpaste.com/2DCEJD6#wrap">Lets talk a bit about VIMAGE jails</a></li>
    <li>ohb - <a href="http://dpaste.com/1EGDSKQ#wrap">Question About ZFS Root Dataset</a></li>
    <li>Micah - <a href="http://dpaste.com/3TK2JWF#wrap">Active-Active NAS Sync recommendations</a></li>
</ul>

<p><hr /></p>

<ul>
    <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A EULA in FOSS clothing, NetBSD with more LLVM support, Thoughts on FreeBSD 12.0, FreeBSD Performance against Windows and Linux on Xeon, Microsoft shipping NetBSD, and more.</p>

<h2>Headlines</h2>

<h3><a href="http://dtrace.org/blogs/bmc/2018/12/16/a-eula-in-foss-clothing/">A EULA in FOSS clothing?</a></h3>

<blockquote>There was a tremendous amount of reaction to and discussion about <a href="http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts-its-midlife-crisis/">my blog entry on the midlife crisis in open source</a>. As part of this discussion on HN, Jay Kreps of Confluent took the time to write a <a href="https://news.ycombinator.com/item?id=18687498#18689179">detailed response</a> — which he shortly thereafter elevated into a <a href="https://medium.com/@jaykreps/a-quick-comment-on-bryan-cantrills-blog-on-licensing-8dccee41d9e6">blog entry</a>.</blockquote>

<blockquote>Let me be clear that I hold Jay in high regard, as both a software engineer and an entrepreneur — and I appreciate the time he took to write a thoughtful response. That said, there are aspects of his response that I found troubling enough to closely re-read the Confluent Community License — and that in turn has led me to a deeply disturbing realization about what is potentially going on here.</blockquote>

<blockquote>To GitHub: Assuming that this is in fact a EULA, I think it is perilous to allow EULAs to sit in public repositories. It’s one thing to have one click through to accept a license (though again, that itself is dubious), but to say that a git clone is an implicit acceptance of a contract that happens to be sitting somewhere in the repository beggars belief. With efforts like <a href="http://choosealicense.com">choosealicense.com</a>, GitHub has been a model in guiding projects with respect to licensing; it would be helpful for GitHub’s counsel to weigh in on their view of this new strain of source-available proprietary software and the degree to which it comes into conflict with GitHub’s own terms of service.</blockquote>

<blockquote>To foundations concerned with software liberties, including the Apache Foundation, the Linux Foundation, the Free Software Foundation, the Electronic Frontier Foundation, the Open Source Initiative, and the Software Freedom Conservancy: the open source community needs your legal review on this! I don’t think I’m being too alarmist when I say that this is potentially a dangerous new precedent being set; it would be very helpful to have your lawyers offer their perspectives on this, even if they disagree with one another. We seem to be in some terrible new era of frankenlicenses, where the worst of proprietary licenses are bolted on to the goodwill created by open source licenses; we need your legal voices before these creatures destroy the village!</blockquote>

<p><hr /></p>

<h3>NetBSD and LLVM</h3>

<p><a href="https://blog.netbsd.org/tnf/entry/netbsd_entering_2019_with_more">NetBSD entering 2019 with more complete LLVM support</a></p>

<blockquote>I’m recently helping the NetBSD developers to improve the support for this operating system in various LLVM components. As you can read in my previous report, I’ve been focusing on fixing build and test failures for the purpose of improving the buildbot coverage.
Previously, I’ve resolved test failures in LLVM, Clang, LLD, libunwind, openmp and partially libc++. During the remainder of the month, I’ve been working on the remaining libc++ test failures, improving the NetBSD clang driver and helping Kamil Rytarowski with compiler-rt.</blockquote>

<p><a href="https://blog.netbsd.org/tnf/entry/the_process_of_upstreaming_support">The process of upstreaming support to LLVM sanitizers has been finalized</a></p>

<blockquote>I’ve finished the process of upstreaming patches to LLVM sanitizers (almost 2000LOC of local code) and submitted to upstream new improvements for the NetBSD support. Today out of the box (in unpatched version) we have support for a variety of compiler-rt LLVM features: ASan (finds unauthorized memory access), UBSan (finds unspecified code semantics), TSan (finds threading bugs), MSan (finds uninitialized memory use), SafeStack (double stack hardening), Profile (code coverage), XRay (dynamic code tracing); while other ones such as Scudo (hardened allocator) or DFSan (generic data flow sanitizer) are not far away from completeness.
The NetBSD support is no longer visibly lacking behind Linux in sanitizers, although there are still failing tests on NetBSD that are not observed on Linux. On the other hand there are features working on NetBSD that are not functional on Linux, like sanitizing programs during early initialization process of OS (this is caused by /proc dependency on Linux that is mounted by startup programs, while NetBSD relies on sysctl(3) interfaces that is always available).</blockquote>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20190107#freebsd">Thoughts on FreeBSD 12.0</a></h3>

<blockquote>Playing with FreeBSD with past week I don’t feel as though there were any big surprises or changes in this release compared to FreeBSD 11. In typical FreeBSD fashion, progress tends to be evolutionary rather than revolutionary, and this release feels like a polished and improved incremental step forward. I like that the installer handles both UFS and ZFS guided partitioning now and in a friendly manner. In the past I had trouble getting FreeBSD’s boot menu to work with boot environments, but that has been fixed for this release.
I like the security options in the installer too. These are not new, but I think worth mentioning. FreeBSD, unlike most Linux distributions, offers several low-level security options (like hiding other users’ processes and randomizing PIDs) and I like having these presented at install time. It’s harder for people to attack what they cannot see, or predict, and FreeBSD optionally makes these little adjustment for us.
Something which stands out about FreeBSD, compared to most Linux distributions I run, is that FreeBSD rarely holds the user’s hand, but also rarely surprises the user. This means there is more reading to do up front and new users may struggle to get used to editing configuration files in a text editor. But FreeBSD rarely does anything unless told to do it. Updates rarely change the system’s behaviour, working technology rarely gets swapped out for something new, the system and its applications never crashed during my trial. Everything was rock solid. The operating system may seem like a minimal, blank slate to new users, but it’s wonderfully dependable and predictable in my experience.
I probably wouldn’t recommend FreeBSD for desktop use. It’s close relative, GhostBSD, ships with a friendly desktop and does special work to make end user applications run smoothly. But for people who want to run servers, possible for years without change or issues, FreeBSD is a great option. It’s also an attractive choice, in my opinion, for people who like to build their system from the ground up, like you would with Debian’s server install or Arch Linux. Apart from the base tools and documentation, there is nothing on a FreeBSD system apart from what we put on it.</blockquote>

<p><hr /></p>

<h3><a href="https://www.phoronix.com/scan.php?page=article&amp;item=freebsd-12-windows&amp;num=1">FreeBSD 12.0 Performance Against Windows &amp; Linux On An Intel Xeon Server</a></h3>

<blockquote>Last week I posted benchmarks of Windows Server 2019 against various Linux distributions using a Tyan dual socket Intel Xeon server. In this article are some complementary results when adding in the performance of FreeBSD 11.2 against the new FreeBSD 12.0 stable release for this leading BSD operating system. As some fun benchmarks to end out 2018, here are the results of FreeBSD 11.2/12.0 (including an additional run when using GCC rather than Clang) up against Windows Server and several enterprise-ready Linux distributions.
While FreeBSD 12.0 had picked up just one win of the Windows/Linux comparisons run, the FreeBSD performance is moving in the right direction. FreeBSD 12.0 was certainly faster than FreeBSD 11.2 on this dual Intel Xeon Scalable server based on a Tyan 1U platform. Meanwhile, to no surprise given the data last week, Clear Linux was by far the fastest out-of-the-box operating system tested.
I did run some extra benchmarks on FreeBSD 11.2/12.0 with this hardware: in total I ran 120 benchmarks for these BSD tests. Of the 120 tests, there were just 15 cases where FreeBSD 11.2 was faster than 12.0. Seeing FreeBSD 12.0 faster than 11.2 nearly 90% of the time is an accomplishment and usually with other operating systems we see more of a mixed bag on new releases with not such solidly better performance. It was also great seeing the competitive performance out of FreeBSD when using the Clang compiler for the source-based tests compared to the GCC8 performance. Additional data available via this <a href="http://OpenBenchmarking.org">OpenBenchmarking.org</a> result file.</blockquote>

<p><hr /></p>

<h3><a href="http://fogey.com/contemplating/?p=1023">How NetBSD came to be shipped by Microsoft</a></h3>

<p><a href="https://webcache.googleusercontent.com/search?q=cache:5XwAm5tvJ4AJ:fogey.com/contemplating/%3Fp%3D1023+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us">Google cache in case the site is down</a></p>

<blockquote>In 2000, Joe Britt, Matt Hershenson and Andy Rubin formed Danger Incorporated. Danger developed the world’s first recognizable smartphone, the Danger HipTop. T-Mobile sold the first HipTop under the brand name Sidekick in October of 2002.
Danger had a well developed kernel that had been designed and built in house. The kernel came to be viewed as not a core intellectual property and Danger started a search for a replacement. For business reasons, mostly to do with legal concerns over the Gnu Public License, Danger rejected Linux and began to consider BSD Unix as a replacement for the kernel.
In 2006 I was hired by Mike Chen, the manager of the kernel development group to investigate the feasibility of replacing the Danger kernel with a BSD kernel, to select the version of BSD to use, to develop a prototype and to develop the plan for adapting BSD to Danger’s requirements.
NetBSD was easily the best choice among the BSD variations at the time because it had well developed cross development tools. It was easy to use a NetBSD desktop running an Intel release to cross compile a NetBSD kernel and runtime for a device running an ARM processor. (Those interested in mailing list archaeology might be amused to investigate NetBSD technical mailing list for mail from picovex, particularly from Bucky Katz at picovex.)
We began product development on the specific prototype of the phone that would become the Sidekick LX2009 in 2007 and contracts for the phone were written with T-Mobile. We were about half way through the two year development cycle when Microsoft purchased Danger in 2008.
Microsoft would have preferred to ship the Sidekick running Windows/CE rather than NetBSD, but a schedule analysis performed by me, and another by an independent outside contractor, indicated that doing so would result in unacceptable delay.</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
    <li><a href="http://lists.31bits.net/archives/devel/2018-December/000033.html">Unleashed 1.2 Released</a></li>
    <li><a href="https://media.ccc.de/v/35c3-9647-taming_the_chaos_can_we_build_systems_that_actually_work">35th CCC - Taming the Chaos: Can we build systems that actually work? </a></li>
    <li><a href="https://rachelbythebay.com/w/2018/12/30/v6/">Potholes to avoid when migrating to IPv6</a></li>
    <li><a href="https://www.jwz.org/blog/2018/12/xscreensaver-5-41/">XScreenSaver 5.42</a></li>
    <li><a href="https://hackertarget.com/ssh-examples-tunnels/">SSH Examples and Tunnels</a></li>
    <li><a href="https://old.reddit.com/r/freebsd/comments/abevqa/mbuf9_request_for_comment/">Help request - mbuf(9) - request for comment</a></li>
    <li><a href="https://www.zdnet.com/article/nsa-to-release-a-free-reverse-engineering-tool/">NSA to release free Reverse Engineering Tool</a></li>
    <li><a href="https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html">Running FreeBSD on a Raspberry Pi3 using a custom image created with crochet and poudriere</a></li>
</ul>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
    <li>Dries - <a href="http://dpaste.com/2DCEJD6#wrap">Lets talk a bit about VIMAGE jails</a></li>
    <li>ohb - <a href="http://dpaste.com/1EGDSKQ#wrap">Question About ZFS Root Dataset</a></li>
    <li>Micah - <a href="http://dpaste.com/3TK2JWF#wrap">Active-Active NAS Sync recommendations</a></li>
</ul>

<p><hr /></p>

<ul>
    <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 279: Future of ZFS | BSD Now 279</title>
  <link>https://www.bsdnow.tv/279</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-3093</guid>
  <pubDate>Thu, 03 Jan 2019 11:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c90e3b38-be68-44fd-97cf-211579e33682.mp3" length="56197307" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>&lt;span style="font-weight: 400;"&gt;The future of ZFS in FreeBSD, we pick highlights from the FreeBSD quarterly status report, flying with the raven, modern KDE on FreeBSD, many ways to launch FreeBSD in EC2, GOG installers on NetBSD, and more.&lt;/span&gt;</itunes:subtitle>
  <itunes:duration>1:33:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>&lt;span&gt;The future of ZFS in FreeBSD, we pick highlights from the FreeBSD quarterly status report, flying with the raven, modern KDE on FreeBSD, many ways to launch FreeBSD in EC2, GOG installers on NetBSD, and more.&lt;/span&gt;
Headlines
&lt;a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-December/072422.html"&gt;The future of ZFS in FreeBSD&lt;/a&gt;
&lt;blockquote&gt;The sources for FreeBSD’s ZFS support are currently taken directly from Illumos with local ifdefs to support the peculiarities of FreeBSD where the Solaris Portability Layer (SPL) shims fall short. FreeBSD has regularly pulled changes from Illumos and tried to push back any bug fixes and new features done in the context of FreeBSD. In the past few years the vast majority of new development in ZFS has taken place in DelphixOS and zfsonlinux (ZoL). Earlier this year Delphix announced that they will be moving to ZoL: &lt;a href="https://www.delphix.com/blog/kickoff-future-eko-2018"&gt;https://www.delphix.com/blog/kickoff-future-eko-2018&lt;/a&gt; This shift means that there will be little to no net new development of Illumos. While working through the git history of ZoL I have also discovered that many races and locking bugs have been fixed in ZoL and never made it back to Illumos and thus FreeBSD. This state of affairs has led to a general agreement among the stakeholders that I have spoken to that it makes sense to rebase FreeBSD’s ZFS on ZoL. Brian Behlendorf has graciously encouraged me to add FreeBSD support directly to ZoL &lt;a href="https://github.com/zfsonfreebsd/ZoF"&gt;https://github.com/zfsonfreebsd/ZoF&lt;/a&gt; so that we might all have a single shared code base.
A port for ZoF can be found at &lt;a href="https://github.com/miwi-fbsd/zof-port"&gt;https://github.com/miwi-fbsd/zof-port&lt;/a&gt; Before it can be committed some additional functionality needs to be added to the FreeBSD opencrypto framework. These can be found at &lt;a href="https://reviews.freebsd.org/D18520"&gt;https://reviews.freebsd.org/D18520&lt;/a&gt;
This port will provide FreeBSD users with multi modifier protection, project quotas, encrypted datasets, allocation classes, vectorized raidz, vectorized checksums, and various command line improvements.&lt;/blockquote&gt;

&lt;hr&gt;
&lt;a href="https://www.freebsd.org/news/status/report-2018-01-2018-09.html"&gt;FreeBSD Quarterly Status Update&lt;/a&gt;
&lt;blockquote&gt;With FreeBSD having gone all the way to 12, it is perhaps useful to take a look back at all the things that have been accomplished, in terms of many visible changes, as well as all the things that happen behind the scenes to ensure that FreeBSD continues to offer an alternative in both design, implementation, and execution.
The things you can look forward to reading about are too numerous to summarize, but cover just about everything from finalizing releases, administrative work, optimizations and depessimizations, features added and fixed, and many areas of improvement that might just surprise you a little.
Please have a cup of coffee, tea, hot cocoa, or other beverage of choice, and enjoy this culmulative set of reports covering everything that’s been done since October, 2017.
—Daniel Ebdrup&lt;/blockquote&gt;

&lt;hr&gt;
News Roundup
&lt;a href="https://eerielinux.wordpress.com/2018/11/30/one-year-of-flying-with-the-raven-ready-for-the-desktop/"&gt;One year of flying with the Raven: Ready for the Desktop?&lt;/a&gt;
&lt;blockquote&gt;It has been a little over one year now that I’m with the Ravenports project. Time to reflect my involvement, my expectations and hopes.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Ravenports&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;Ravenports is a universal packaging framework for *nix operating systems. For the user it provides easy access to binary packages of common software for multiple platforms. It has been the long-lasting champion on Repology’s top 10 repositories regarding package freshness (rarely dropping below 96 percent while all other projects keep below 90!).&lt;/blockquote&gt;
&lt;blockquote&gt;For the porter it offers a well-designed and elegant means of writing cross-platform buildsheets that allow building the same version of the software with (completely or mostly) the same compile-time configuration on different operating systems or distributions.&lt;/blockquote&gt;
&lt;blockquote&gt;And for the developer it means a real-world project that’s written in modern Ada (ravenadm) and C (pkg) – as well as some Perl for support scripts and make. Things feel very optimized and fast. Not being a programmer though, I cannot really say anything about the actual code and thus leave it to the interested reader’s judgement.&lt;/blockquote&gt;

&lt;hr&gt;
&lt;a href="https://euroquis.nl/bobulate/?p=2040"&gt;Modern KDE on FreeBSD&lt;/a&gt;
&lt;blockquote&gt;New stuff in the official FreeBSD repositories! The X11 team has landed a newer version of libinput, opening up the way for KDE Plasma 5.14 in ports. That’s a pretty big update and it may frighten people with a new wallpaper.
What this means is that the graphical stack is once again on-par with what Plasma upstream expects, and we can get back to chasing releases as soon as they happen, rather than gnashing our teeth at missing dependencies. The KDE-FreeBSD CI servers are in the process of being upgraded to 12-STABLE, and we’re integrating with the new experimental CI systems as well. This means we are chasing sensibly-modern systems (13-CURRENT is out of scope).&lt;/blockquote&gt;

&lt;hr&gt;
&lt;a href="http://www.daemonology.net/blog/2018-12-26-the-many-ways-to-launch-FreeBSD-in-EC2.html"&gt;The many ways to launch FreeBSD in EC2&lt;/a&gt;
&lt;blockquote&gt;Talking to FreeBSD users recently, I became aware that while I’ve created a lot of tools, I haven’t done a very good job of explaining how, and more importantly when to use them. So for all of the EC2-curious FreeBSD users out there: Here are the many ways to launch and configure FreeBSD in EC2 — ranging from the simplest to the most complicated (but most powerful):&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Launch FreeBSD and SSH in&lt;/li&gt;
    &lt;li&gt;Launch FreeBSD and provide user-data&lt;/li&gt;
    &lt;li&gt;Use the AMI Builder to create a customized FreeBSD AMI&lt;/li&gt;
    &lt;li&gt;Build a FreeBSD AMI from a modified FreeBSD source tree&lt;/li&gt;
    &lt;li&gt;Build your own disk image&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;I hope I’ve provided tools which help you to run FreeBSD in EC2, no matter how common or unusual your needs are. If you find my work useful, please consider supporting my work in this area; while this is both something I enjoy working on and something which is useful for my day job (Tarsnap, my online backup service), having support would make it easier for me to prioritize FreeBSD/EC2 issues over other projects.&lt;/blockquote&gt;

&lt;hr&gt;
&lt;a href="https://dressupgeekout.blogspot.com/2018/12/using-gogcom-installers-for-linux-on.html"&gt;Using the GOG.com installers for Linux, on NetBSD&lt;/a&gt;
&lt;blockquote&gt;
&lt;a href="http://GOG.com"&gt;GOG.com&lt;/a&gt; prefers that you use their GOG Galaxy desktop app to download, install and manage all of your GOG games. But customers always have the option to install the game on their own terms, with a platform-specific installer.
GOG offers these installers for Mac, Windows and/or Linux, depending on which platforms the game is available for.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;The installers truly are platform-specific:&lt;/li&gt;
    &lt;li&gt;macOS games are distributed in a standard .pkg&lt;/li&gt;
    &lt;li&gt;Windows games are distributed in a setup wizard .exe&lt;/li&gt;
    &lt;li&gt;Linux games are distributed in a goofy shell archive&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;Of course, none of those are NetBSD. So, if I wanted to even attempt to play a game distributed by &lt;a href="http://GOG.com"&gt;GOG.com&lt;/a&gt; on NetBSD, which one should I pick? The obvious choice is the Linux installer, since Linux is the most similar to NetBSD, right? Au contraire! In practice, I found that it is easier to download the Windows installer.&lt;/blockquote&gt;
&lt;blockquote&gt;Here’s what I mean. For example, I ported the open source version of Aquaria to pkgsrc, but that package is only the game’s engine, not the multimedia data. The multimedia data is still copyrighted. Therefore, you need to get it from somewhere else. GOG is usually a good choice, because they distribute their games without DRM. And as mentioned earlier, picking the Linux installer seemed like a natural choice.&lt;/blockquote&gt;
&lt;blockquote&gt;Now, actually PLAYING the games on NetBSD is a separate matter entirely. The game I’ve got here, though, my current obsession Pyre, is built with MonoGame and therefore could theoretically work on NetBSD, too, with the help of a library called FNA and a script for OpenBSD called fnaify. I do hope to create a pkgsrc package for FNA and port the fnaify script to NetBSD at some point.&lt;/blockquote&gt;

&lt;hr&gt;
Beastie Bits
&lt;ul&gt;
    &lt;li&gt;&lt;a href="https://corecursive.com/024-software-as-a-reflection-of-values-with-bryan-cantrill/"&gt;Software as a Reflection of Values With Bryan Cantrill&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="http://dtrace.org/blogs/bmc/2018/02/03/talks/"&gt;Collection of bmc talks, updated 2018&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://marc.info/?l=openbsd-bugs&amp;amp;m=154529364730319&amp;amp;w=2"&gt;wump: incorrect wumpus movement probability&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://venshare.com/debugging-rust-with-vscode-on-freebsd/"&gt;Debugging Rust with VSCode on FreeBSD&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/12/27/smb-cifs-on-freebsd/"&gt;SMB/CIFS on FreeBSD&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://old.reddit.com/r/freebsd/comments/aaihdk/bsd_tattoo/"&gt;BSD Tattoo&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://mail-index.netbsd.org/pkgsrc-users/2018/12/30/msg027871.html"&gt;pkgsrc-2018Q4 branch announcement&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://https.www.google.com.tedunangst.com/flak/post/toying-with-wireguard-on-openbsd"&gt;toying with wireguard on openbsd&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://marc.info/?l=openbsd-tech&amp;amp;m=154627230907954&amp;amp;w=2"&gt;new USB audio class v2.0 driver&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=ZvSSHtRv5Mg"&gt;Todd Mortimer Removing ROP Gadgets from OpenBSD EuroBSDCon 2018&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://www.openbsd.org/65.html"&gt;OpenBSD 6.5 release page is online&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://twitter.com/jschauma/status/1071069217968013313?s=03"&gt;shell access to historical Unix versions in your browser&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
Feedback/Questions
&lt;ul&gt;
    &lt;li&gt;Brad - &lt;a href="http://dpaste.com/2CVAF1E#wrap"&gt;ZFS Features and Upgrades&lt;/a&gt;
&lt;/li&gt;
    &lt;li&gt;Andre - &lt;a href="http://dpaste.com/1XXFPHN#wrap"&gt;Splitting ZFS array&lt;/a&gt;
&lt;/li&gt;
    &lt;li&gt;Michael - &lt;a href="http://dpaste.com/2S8GFD0#wrap"&gt;Priority/nice value for Jails?&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
    &lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt; 
</description>
  <itunes:keywords>Bryan Cantrill,BSD,DragonflyBSD,EC2,freebsd,GOG,guide,hardenedbsd,howto,Interview,kde,NetBSD,OpenBSD,raven,ravenports,ROP Gadgets,Trident,trueos,tutorial</itunes:keywords>
  <content:encoded>
    <![CDATA[<p><span style="font-weight: 400;">The future of ZFS in FreeBSD, we pick highlights from the FreeBSD quarterly status report, flying with the raven, modern KDE on FreeBSD, many ways to launch FreeBSD in EC2, GOG installers on NetBSD, and more.</span></p>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-December/072422.html">The future of ZFS in FreeBSD</a></h3>

<blockquote>The sources for FreeBSD’s ZFS support are currently taken directly from Illumos with local ifdefs to support the peculiarities of FreeBSD where the Solaris Portability Layer (SPL) shims fall short. FreeBSD has regularly pulled changes from Illumos and tried to push back any bug fixes and new features done in the context of FreeBSD. In the past few years the vast majority of new development in ZFS has taken place in DelphixOS and zfsonlinux (ZoL). Earlier this year Delphix announced that they will be moving to ZoL: <a href="https://www.delphix.com/blog/kickoff-future-eko-2018">https://www.delphix.com/blog/kickoff-future-eko-2018</a> This shift means that there will be little to no net new development of Illumos. While working through the git history of ZoL I have also discovered that many races and locking bugs have been fixed in ZoL and never made it back to Illumos and thus FreeBSD. This state of affairs has led to a general agreement among the stakeholders that I have spoken to that it makes sense to rebase FreeBSD’s ZFS on ZoL. Brian Behlendorf has graciously encouraged me to add FreeBSD support directly to ZoL <a href="https://github.com/zfsonfreebsd/ZoF">https://github.com/zfsonfreebsd/ZoF</a> so that we might all have a single shared code base.
A port for ZoF can be found at <a href="https://github.com/miwi-fbsd/zof-port">https://github.com/miwi-fbsd/zof-port</a> Before it can be committed some additional functionality needs to be added to the FreeBSD opencrypto framework. These can be found at <a href="https://reviews.freebsd.org/D18520">https://reviews.freebsd.org/D18520</a>
This port will provide FreeBSD users with multi modifier protection, project quotas, encrypted datasets, allocation classes, vectorized raidz, vectorized checksums, and various command line improvements.</blockquote>

<p><hr /></p>

<h3><a href="https://www.freebsd.org/news/status/report-2018-01-2018-09.html">FreeBSD Quarterly Status Update</a></h3>

<blockquote>With FreeBSD having gone all the way to 12, it is perhaps useful to take a look back at all the things that have been accomplished, in terms of many visible changes, as well as all the things that happen behind the scenes to ensure that FreeBSD continues to offer an alternative in both design, implementation, and execution.
The things you can look forward to reading about are too numerous to summarize, but cover just about everything from finalizing releases, administrative work, optimizations and depessimizations, features added and fixed, and many areas of improvement that might just surprise you a little.
Please have a cup of coffee, tea, hot cocoa, or other beverage of choice, and enjoy this culmulative set of reports covering everything that’s been done since October, 2017.
—Daniel Ebdrup</blockquote>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://eerielinux.wordpress.com/2018/11/30/one-year-of-flying-with-the-raven-ready-for-the-desktop/">One year of flying with the Raven: Ready for the Desktop?</a></h3>

<blockquote>It has been a little over one year now that I’m with the Ravenports project. Time to reflect my involvement, my expectations and hopes.</blockquote>

<ul>
    <li>Ravenports</li>
</ul>

<blockquote>Ravenports is a universal packaging framework for *nix operating systems. For the user it provides easy access to binary packages of common software for multiple platforms. It has been the long-lasting champion on Repology’s top 10 repositories regarding package freshness (rarely dropping below 96 percent while all other projects keep below 90!).</blockquote>

<blockquote>For the porter it offers a well-designed and elegant means of writing cross-platform buildsheets that allow building the same version of the software with (completely or mostly) the same compile-time configuration on different operating systems or distributions.</blockquote>

<blockquote>And for the developer it means a real-world project that’s written in modern Ada (ravenadm) and C (pkg) – as well as some Perl for support scripts and make. Things feel very optimized and fast. Not being a programmer though, I cannot really say anything about the actual code and thus leave it to the interested reader’s judgement.</blockquote>

<p><hr /></p>

<h3><a href="https://euroquis.nl/bobulate/?p=2040">Modern KDE on FreeBSD</a></h3>

<blockquote>New stuff in the official FreeBSD repositories! The X11 team has landed a newer version of libinput, opening up the way for KDE Plasma 5.14 in ports. That’s a pretty big update and it may frighten people with a new wallpaper.
What this means is that the graphical stack is once again on-par with what Plasma upstream expects, and we can get back to chasing releases as soon as they happen, rather than gnashing our teeth at missing dependencies. The KDE-FreeBSD CI servers are in the process of being upgraded to 12-STABLE, and we’re integrating with the new experimental CI systems as well. This means we are chasing sensibly-modern systems (13-CURRENT is out of scope).</blockquote>

<p><hr /></p>

<h3><a href="http://www.daemonology.net/blog/2018-12-26-the-many-ways-to-launch-FreeBSD-in-EC2.html">The many ways to launch FreeBSD in EC2</a></h3>

<blockquote>Talking to FreeBSD users recently, I became aware that while I’ve created a lot of tools, I haven’t done a very good job of explaining how, and more importantly when to use them. So for all of the EC2-curious FreeBSD users out there: Here are the many ways to launch and configure FreeBSD in EC2 — ranging from the simplest to the most complicated (but most powerful):</blockquote>

<ul>
    <li>Launch FreeBSD and SSH in</li>
    <li>Launch FreeBSD and provide user-data</li>
    <li>Use the AMI Builder to create a customized FreeBSD AMI</li>
    <li>Build a FreeBSD AMI from a modified FreeBSD source tree</li>
    <li>Build your own disk image</li>
</ul>

<blockquote>I hope I’ve provided tools which help you to run FreeBSD in EC2, no matter how common or unusual your needs are. If you find my work useful, please consider supporting my work in this area; while this is both something I enjoy working on and something which is useful for my day job (Tarsnap, my online backup service), having support would make it easier for me to prioritize FreeBSD/EC2 issues over other projects.</blockquote>

<p><hr /></p>

<h3><a href="https://dressupgeekout.blogspot.com/2018/12/using-gogcom-installers-for-linux-on.html">Using the GOG.com installers for Linux, on NetBSD</a></h3>

<blockquote><a href="http://GOG.com">GOG.com</a> prefers that you use their GOG Galaxy desktop app to download, install and manage all of your GOG games. But customers always have the option to install the game on their own terms, with a platform-specific installer.
GOG offers these installers for Mac, Windows and/or Linux, depending on which platforms the game is available for.</blockquote>

<ul>
    <li>The installers truly are platform-specific:</li>
    <li>macOS games are distributed in a standard .pkg</li>
    <li>Windows games are distributed in a setup wizard .exe</li>
    <li>Linux games are distributed in a goofy shell archive</li>
</ul>

<blockquote>Of course, none of those are NetBSD. So, if I wanted to even attempt to play a game distributed by <a href="http://GOG.com">GOG.com</a> on NetBSD, which one should I pick? The obvious choice is the Linux installer, since Linux is the most similar to NetBSD, right? Au contraire! In practice, I found that it is easier to download the Windows installer.</blockquote>

<blockquote>Here’s what I mean. For example, I ported the open source version of Aquaria to pkgsrc, but that package is only the game’s engine, not the multimedia data. The multimedia data is still copyrighted. Therefore, you need to get it from somewhere else. GOG is usually a good choice, because they distribute their games without DRM. And as mentioned earlier, picking the Linux installer seemed like a natural choice.</blockquote>

<blockquote>Now, actually PLAYING the games on NetBSD is a separate matter entirely. The game I’ve got here, though, my current obsession Pyre, is built with MonoGame and therefore could theoretically work on NetBSD, too, with the help of a library called FNA and a script for OpenBSD called fnaify. I do hope to create a pkgsrc package for FNA and port the fnaify script to NetBSD at some point.</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
    <li><a href="https://corecursive.com/024-software-as-a-reflection-of-values-with-bryan-cantrill/">Software as a Reflection of Values With Bryan Cantrill</a></li>
    <li><a href="http://dtrace.org/blogs/bmc/2018/02/03/talks/">Collection of bmc talks, updated 2018</a></li>
    <li><a href="https://marc.info/?l=openbsd-bugs&amp;m=154529364730319&amp;w=2">wump: incorrect wumpus movement probability</a></li>
    <li><a href="https://venshare.com/debugging-rust-with-vscode-on-freebsd/">Debugging Rust with VSCode on FreeBSD</a></li>
    <li><a href="https://vermaden.wordpress.com/2018/12/27/smb-cifs-on-freebsd/">SMB/CIFS on FreeBSD</a></li>
    <li><a href="https://old.reddit.com/r/freebsd/comments/aaihdk/bsd_tattoo/">BSD Tattoo</a></li>
    <li><a href="https://mail-index.netbsd.org/pkgsrc-users/2018/12/30/msg027871.html">pkgsrc-2018Q4 branch announcement</a></li>
    <li><a href="https://https.www.google.com.tedunangst.com/flak/post/toying-with-wireguard-on-openbsd">toying with wireguard on openbsd</a></li>
    <li><a href="https://marc.info/?l=openbsd-tech&amp;m=154627230907954&amp;w=2">new USB audio class v2.0 driver</a></li>
    <li><a href="https://www.youtube.com/watch?v=ZvSSHtRv5Mg">Todd Mortimer Removing ROP Gadgets from OpenBSD EuroBSDCon 2018</a></li>
    <li><a href="https://www.openbsd.org/65.html">OpenBSD 6.5 release page is online</a></li>
    <li><a href="https://twitter.com/jschauma/status/1071069217968013313?s=03">shell access to historical Unix versions in your browser</a></li>
</ul>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
    <li>Brad - <a href="http://dpaste.com/2CVAF1E#wrap">ZFS Features and Upgrades</a></li>
    <li>Andre - <a href="http://dpaste.com/1XXFPHN#wrap">Splitting ZFS array</a></li>
    <li>Michael - <a href="http://dpaste.com/2S8GFD0#wrap">Priority/nice value for Jails?</a></li>
</ul>

<p><hr /></p>

<ul>
    <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p><span style="font-weight: 400;">The future of ZFS in FreeBSD, we pick highlights from the FreeBSD quarterly status report, flying with the raven, modern KDE on FreeBSD, many ways to launch FreeBSD in EC2, GOG installers on NetBSD, and more.</span></p>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-December/072422.html">The future of ZFS in FreeBSD</a></h3>

<blockquote>The sources for FreeBSD’s ZFS support are currently taken directly from Illumos with local ifdefs to support the peculiarities of FreeBSD where the Solaris Portability Layer (SPL) shims fall short. FreeBSD has regularly pulled changes from Illumos and tried to push back any bug fixes and new features done in the context of FreeBSD. In the past few years the vast majority of new development in ZFS has taken place in DelphixOS and zfsonlinux (ZoL). Earlier this year Delphix announced that they will be moving to ZoL: <a href="https://www.delphix.com/blog/kickoff-future-eko-2018">https://www.delphix.com/blog/kickoff-future-eko-2018</a> This shift means that there will be little to no net new development of Illumos. While working through the git history of ZoL I have also discovered that many races and locking bugs have been fixed in ZoL and never made it back to Illumos and thus FreeBSD. This state of affairs has led to a general agreement among the stakeholders that I have spoken to that it makes sense to rebase FreeBSD’s ZFS on ZoL. Brian Behlendorf has graciously encouraged me to add FreeBSD support directly to ZoL <a href="https://github.com/zfsonfreebsd/ZoF">https://github.com/zfsonfreebsd/ZoF</a> so that we might all have a single shared code base.
A port for ZoF can be found at <a href="https://github.com/miwi-fbsd/zof-port">https://github.com/miwi-fbsd/zof-port</a> Before it can be committed some additional functionality needs to be added to the FreeBSD opencrypto framework. These can be found at <a href="https://reviews.freebsd.org/D18520">https://reviews.freebsd.org/D18520</a>
This port will provide FreeBSD users with multi modifier protection, project quotas, encrypted datasets, allocation classes, vectorized raidz, vectorized checksums, and various command line improvements.</blockquote>

<p><hr /></p>

<h3><a href="https://www.freebsd.org/news/status/report-2018-01-2018-09.html">FreeBSD Quarterly Status Update</a></h3>

<blockquote>With FreeBSD having gone all the way to 12, it is perhaps useful to take a look back at all the things that have been accomplished, in terms of many visible changes, as well as all the things that happen behind the scenes to ensure that FreeBSD continues to offer an alternative in both design, implementation, and execution.
The things you can look forward to reading about are too numerous to summarize, but cover just about everything from finalizing releases, administrative work, optimizations and depessimizations, features added and fixed, and many areas of improvement that might just surprise you a little.
Please have a cup of coffee, tea, hot cocoa, or other beverage of choice, and enjoy this culmulative set of reports covering everything that’s been done since October, 2017.
—Daniel Ebdrup</blockquote>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://eerielinux.wordpress.com/2018/11/30/one-year-of-flying-with-the-raven-ready-for-the-desktop/">One year of flying with the Raven: Ready for the Desktop?</a></h3>

<blockquote>It has been a little over one year now that I’m with the Ravenports project. Time to reflect my involvement, my expectations and hopes.</blockquote>

<ul>
    <li>Ravenports</li>
</ul>

<blockquote>Ravenports is a universal packaging framework for *nix operating systems. For the user it provides easy access to binary packages of common software for multiple platforms. It has been the long-lasting champion on Repology’s top 10 repositories regarding package freshness (rarely dropping below 96 percent while all other projects keep below 90!).</blockquote>

<blockquote>For the porter it offers a well-designed and elegant means of writing cross-platform buildsheets that allow building the same version of the software with (completely or mostly) the same compile-time configuration on different operating systems or distributions.</blockquote>

<blockquote>And for the developer it means a real-world project that’s written in modern Ada (ravenadm) and C (pkg) – as well as some Perl for support scripts and make. Things feel very optimized and fast. Not being a programmer though, I cannot really say anything about the actual code and thus leave it to the interested reader’s judgement.</blockquote>

<p><hr /></p>

<h3><a href="https://euroquis.nl/bobulate/?p=2040">Modern KDE on FreeBSD</a></h3>

<blockquote>New stuff in the official FreeBSD repositories! The X11 team has landed a newer version of libinput, opening up the way for KDE Plasma 5.14 in ports. That’s a pretty big update and it may frighten people with a new wallpaper.
What this means is that the graphical stack is once again on-par with what Plasma upstream expects, and we can get back to chasing releases as soon as they happen, rather than gnashing our teeth at missing dependencies. The KDE-FreeBSD CI servers are in the process of being upgraded to 12-STABLE, and we’re integrating with the new experimental CI systems as well. This means we are chasing sensibly-modern systems (13-CURRENT is out of scope).</blockquote>

<p><hr /></p>

<h3><a href="http://www.daemonology.net/blog/2018-12-26-the-many-ways-to-launch-FreeBSD-in-EC2.html">The many ways to launch FreeBSD in EC2</a></h3>

<blockquote>Talking to FreeBSD users recently, I became aware that while I’ve created a lot of tools, I haven’t done a very good job of explaining how, and more importantly when to use them. So for all of the EC2-curious FreeBSD users out there: Here are the many ways to launch and configure FreeBSD in EC2 — ranging from the simplest to the most complicated (but most powerful):</blockquote>

<ul>
    <li>Launch FreeBSD and SSH in</li>
    <li>Launch FreeBSD and provide user-data</li>
    <li>Use the AMI Builder to create a customized FreeBSD AMI</li>
    <li>Build a FreeBSD AMI from a modified FreeBSD source tree</li>
    <li>Build your own disk image</li>
</ul>

<blockquote>I hope I’ve provided tools which help you to run FreeBSD in EC2, no matter how common or unusual your needs are. If you find my work useful, please consider supporting my work in this area; while this is both something I enjoy working on and something which is useful for my day job (Tarsnap, my online backup service), having support would make it easier for me to prioritize FreeBSD/EC2 issues over other projects.</blockquote>

<p><hr /></p>

<h3><a href="https://dressupgeekout.blogspot.com/2018/12/using-gogcom-installers-for-linux-on.html">Using the GOG.com installers for Linux, on NetBSD</a></h3>

<blockquote><a href="http://GOG.com">GOG.com</a> prefers that you use their GOG Galaxy desktop app to download, install and manage all of your GOG games. But customers always have the option to install the game on their own terms, with a platform-specific installer.
GOG offers these installers for Mac, Windows and/or Linux, depending on which platforms the game is available for.</blockquote>

<ul>
    <li>The installers truly are platform-specific:</li>
    <li>macOS games are distributed in a standard .pkg</li>
    <li>Windows games are distributed in a setup wizard .exe</li>
    <li>Linux games are distributed in a goofy shell archive</li>
</ul>

<blockquote>Of course, none of those are NetBSD. So, if I wanted to even attempt to play a game distributed by <a href="http://GOG.com">GOG.com</a> on NetBSD, which one should I pick? The obvious choice is the Linux installer, since Linux is the most similar to NetBSD, right? Au contraire! In practice, I found that it is easier to download the Windows installer.</blockquote>

<blockquote>Here’s what I mean. For example, I ported the open source version of Aquaria to pkgsrc, but that package is only the game’s engine, not the multimedia data. The multimedia data is still copyrighted. Therefore, you need to get it from somewhere else. GOG is usually a good choice, because they distribute their games without DRM. And as mentioned earlier, picking the Linux installer seemed like a natural choice.</blockquote>

<blockquote>Now, actually PLAYING the games on NetBSD is a separate matter entirely. The game I’ve got here, though, my current obsession Pyre, is built with MonoGame and therefore could theoretically work on NetBSD, too, with the help of a library called FNA and a script for OpenBSD called fnaify. I do hope to create a pkgsrc package for FNA and port the fnaify script to NetBSD at some point.</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
    <li><a href="https://corecursive.com/024-software-as-a-reflection-of-values-with-bryan-cantrill/">Software as a Reflection of Values With Bryan Cantrill</a></li>
    <li><a href="http://dtrace.org/blogs/bmc/2018/02/03/talks/">Collection of bmc talks, updated 2018</a></li>
    <li><a href="https://marc.info/?l=openbsd-bugs&amp;m=154529364730319&amp;w=2">wump: incorrect wumpus movement probability</a></li>
    <li><a href="https://venshare.com/debugging-rust-with-vscode-on-freebsd/">Debugging Rust with VSCode on FreeBSD</a></li>
    <li><a href="https://vermaden.wordpress.com/2018/12/27/smb-cifs-on-freebsd/">SMB/CIFS on FreeBSD</a></li>
    <li><a href="https://old.reddit.com/r/freebsd/comments/aaihdk/bsd_tattoo/">BSD Tattoo</a></li>
    <li><a href="https://mail-index.netbsd.org/pkgsrc-users/2018/12/30/msg027871.html">pkgsrc-2018Q4 branch announcement</a></li>
    <li><a href="https://https.www.google.com.tedunangst.com/flak/post/toying-with-wireguard-on-openbsd">toying with wireguard on openbsd</a></li>
    <li><a href="https://marc.info/?l=openbsd-tech&amp;m=154627230907954&amp;w=2">new USB audio class v2.0 driver</a></li>
    <li><a href="https://www.youtube.com/watch?v=ZvSSHtRv5Mg">Todd Mortimer Removing ROP Gadgets from OpenBSD EuroBSDCon 2018</a></li>
    <li><a href="https://www.openbsd.org/65.html">OpenBSD 6.5 release page is online</a></li>
    <li><a href="https://twitter.com/jschauma/status/1071069217968013313?s=03">shell access to historical Unix versions in your browser</a></li>
</ul>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
    <li>Brad - <a href="http://dpaste.com/2CVAF1E#wrap">ZFS Features and Upgrades</a></li>
    <li>Andre - <a href="http://dpaste.com/1XXFPHN#wrap">Splitting ZFS array</a></li>
    <li>Michael - <a href="http://dpaste.com/2S8GFD0#wrap">Priority/nice value for Jails?</a></li>
</ul>

<p><hr /></p>

<ul>
    <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 278: The Real McCoy | BSD Now 278</title>
  <link>https://www.bsdnow.tv/278</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-3070</guid>
  <pubDate>Thu, 27 Dec 2018 04:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/20a1a3d9-9553-4eb3-a462-eb6f41b4fa5c.mp3" length="29982521" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We sat down at BSDCan 2018 to interview Kirk McKusick about various topics ranging about the early years of Berkeley Unix, his continuing work on UFS, the governance of FreeBSD, and more.</itunes:subtitle>
  <itunes:duration>49:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We sat down at BSDCan 2018 to interview Kirk McKusick about various topics ranging about the early years of Berkeley Unix, his continuing work on UFS, the governance of FreeBSD, and more.
&lt;p&gt;##Interview - Kirk McKusick - &lt;a href="mailto:mckusick@mckusick.com"&gt;mckusick@mckusick.com&lt;/a&gt;&lt;br&gt;
25 years of FreeBSD&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;How Kirk got started in BSD, at the very beginning&lt;/li&gt;
&lt;li&gt;Predicting the Future&lt;/li&gt;
&lt;li&gt;How the code and community grew&lt;/li&gt;
&lt;li&gt;The leadership of the project, and how it changed over time&lt;/li&gt;
&lt;li&gt;UFS over the years (reading disks from 1982 in 2018)&lt;/li&gt;
&lt;li&gt;Conferences&lt;/li&gt;
&lt;li&gt;The rise and fall of Linux&lt;/li&gt;
&lt;li&gt;The resurgence of FreeBSD&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;We want to extend a big thank you to the entire BSD community for making this show possible, and to all of our viewers for watching and providing the feedback that makes this show successful. We wish you all a happy and prosperous new year, and we’ll see you next week.&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We sat down at BSDCan 2018 to interview Kirk McKusick about various topics ranging about the early years of Berkeley Unix, his continuing work on UFS, the governance of FreeBSD, and more.</p>

<p>##Interview - Kirk McKusick - <a href="mailto:mckusick@mckusick.com">mckusick@mckusick.com</a><br>
25 years of FreeBSD</p>

<ul>
<li>How Kirk got started in BSD, at the very beginning</li>
<li>Predicting the Future</li>
<li>How the code and community grew</li>
<li>The leadership of the project, and how it changed over time</li>
<li>UFS over the years (reading disks from 1982 in 2018)</li>
<li>Conferences</li>
<li>The rise and fall of Linux</li>
<li>The resurgence of FreeBSD</li>
</ul>

<p><hr></p>

<p>We want to extend a big thank you to the entire BSD community for making this show possible, and to all of our viewers for watching and providing the feedback that makes this show successful. We wish you all a happy and prosperous new year, and we’ll see you next week.</p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We sat down at BSDCan 2018 to interview Kirk McKusick about various topics ranging about the early years of Berkeley Unix, his continuing work on UFS, the governance of FreeBSD, and more.</p>

<p>##Interview - Kirk McKusick - <a href="mailto:mckusick@mckusick.com">mckusick@mckusick.com</a><br>
25 years of FreeBSD</p>

<ul>
<li>How Kirk got started in BSD, at the very beginning</li>
<li>Predicting the Future</li>
<li>How the code and community grew</li>
<li>The leadership of the project, and how it changed over time</li>
<li>UFS over the years (reading disks from 1982 in 2018)</li>
<li>Conferences</li>
<li>The rise and fall of Linux</li>
<li>The resurgence of FreeBSD</li>
</ul>

<p><hr></p>

<p>We want to extend a big thank you to the entire BSD community for making this show possible, and to all of our viewers for watching and providing the feedback that makes this show successful. We wish you all a happy and prosperous new year, and we’ll see you next week.</p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 277: Nmap Level Up | BSD Now 277</title>
  <link>https://www.bsdnow.tv/277</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-3058</guid>
  <pubDate>Mon, 24 Dec 2018 11:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d08b7671-6fa3-4a12-864e-9a65603b79ee.mp3" length="46042591" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The Open Source midlife crisis, Donald Knuth The Yoda of Silicon Valley, Certbot For OpenBSD's httpd, how to upgrade FreeBSD from 11 to 12, level up your nmap game, NetBSD desktop, and more.</itunes:subtitle>
  <itunes:duration>1:16:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The Open Source midlife crisis, Donald Knuth The Yoda of Silicon Valley, Certbot For OpenBSD's httpd, how to upgrade FreeBSD from 11 to 12, level up your nmap game, NetBSD desktop, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts-its-midlife-crisis/"&gt;Open Source Confronts its midlife crisis&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Midlife is tough: the idealism of youth has faded, as has inevitably some of its fitness and vigor. At the same time, the responsibilities of adulthood have grown. Making things more challenging, while you are navigating the turbulence of teenagers, your own parents are likely entering life’s twilight, needing help in new ways from their adult children. By midlife, in addition to the singular joys of life, you have also likely experienced its terrible sorrows: death, heartbreak, betrayal. Taken together, the fading of youth, the growth in responsibility and the endurance of misfortune can lead to cynicism or (worse) drastic and poorly thought-out choices. Add in a little fear of mortality and some existential dread, and you have the stuff of which midlife crises are made…&lt;br&gt;
I raise this not because of my own adventures at midlife, but because it is clear to me that open source — now several decades old and fully adult — is going through its own midlife crisis. This has long been in the making: for years, I (and others) have been critical of service providers’ parasitic relationship with open source, as cloud service providers turn open source software into a service offering without giving back to the communities upon which they implicitly depend. At the same time, open source has been (rightfully) entirely unsympathetic to the proprietary software models that have been burned to the ground — but also seemingly oblivious as to the larger economic waves that have buoyed them.&lt;br&gt;
So it seemed like only a matter of time before the companies built around open source software would have to confront their own crisis of confidence: open source business models are really tough, selling software-as-a-service is one of the most natural of them, the cloud service providers are really good at it — and their commercial appetites seem boundless. And, like a new cherry red two-seater sports car next to a minivan in a suburban driveway, some open source companies are dealing with this crisis exceptionally poorly: they are trying to restrict the way that their open source software can be used. These companies want it both ways: they want the advantages of open source — the community, the positivity, the energy, the adoption, the downloads — but they also want to enjoy the fruits of proprietary software companies in software lock-in and its monopolistic rents. If this were entirely transparent (that is, if some bits were merely being made explicitly proprietary), it would be fine: we could accept these companies as essentially proprietary software companies, albeit with an open source loss-leader. But instead, these companies are trying to license their way into this self-contradictory world: continuing to claim to be entirely open source, but perverting the license under which portions of that source are available. Most gallingly, they are doing this by hijacking open source nomenclature. Of these, the laughably named commons clause is the worst offender (it is plainly designed to be confused with the purely virtuous creative commons), but others (including CockroachDB’s Community License, MongoDB’s Server Side Public License, and Confluent’s Community License) are little better. And in particular, as it apparently needs to be said: no, “community” is not the opposite of “open source” — please stop sullying its good name by attaching it to licenses that are deliberately not open source! But even if they were more aptly named (e.g. “the restricted clause” or “the controlled use license” or — perhaps most honest of all — “the please-don’t-put-me-out-of-business-during-the-next-reInvent-keynote clause”), these licenses suffer from a serious problem: they are almost certainly asserting rights that the copyright holder doesn’t in fact have.&lt;br&gt;
If I sell you a book that I wrote, I can restrict your right to read it aloud for an audience, or sell a translation, or write a sequel; these restrictions are rights afforded the copyright holder. I cannot, however, tell you that you can’t put the book on the same bookshelf as that of my rival, or that you can’t read the book while flying a particular airline I dislike, or that you aren’t allowed to read the book and also work for a company that competes with mine. (Lest you think that last example absurd, that’s almost verbatim the language in the new Confluent Community (sic) License.) I personally think that none of these licenses would withstand a court challenge, but I also don’t think it will come to that: because the vendors behind these licenses will surely fear that they wouldn’t survive litigation, they will deliberately avoid inviting such challenges. In some ways, this netherworld is even worse, as the license becomes a vessel for unverifiable fear of arbitrary liability.&lt;br&gt;
let me put this to you as directly as possible: cloud services providers are emphatically not going to license your proprietary software. I mean, you knew that, right? The whole premise with your proprietary license is that you are finding that there is no way to compete with the operational dominance of the cloud services providers; did you really believe that those same dominant cloud services providers can’t simply reimplement your LDAP integration or whatever? The cloud services providers are currently reproprietarizing all of computing — they are making their own CPUs for crying out loud! — reimplementing the bits of your software that they need in the name of the service that their customers want (and will pay for!) won’t even move the needle in terms of their effort.&lt;br&gt;
Worse than all of this (and the reason why this madness needs to stop): licenses that are vague with respect to permitted use are corporate toxin. Any company that has been through an acquisition can speak of the peril of the due diligence license audit: the acquiring entity is almost always deep pocketed and (not unrelatedly) risk averse; the last thing that any company wants is for a deal to go sideways because of concern over unbounded liability to some third-party knuckle-head. So companies that engage in license tomfoolery are doing worse than merely not solving their own problem: they are potentially poisoning the wellspring of their own community.&lt;br&gt;
in the end, open source will survive its midlife questioning just as people in midlife get through theirs: by returning to its core values and by finding rejuvenation in its communities. Indeed, we can all find solace in the fact that while life is finite, our values and our communities survive us — and that our engagement with them is our most important legacy.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;See the article for the rest&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.nytimes.com/2018/12/17/science/donald-knuth-computers-algorithms-programming.html"&gt;Donald Knuth - The Yoda of Silicon Valley&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;For half a century, the Stanford computer scientist Donald Knuth, who bears a slight resemblance to Yoda — albeit standing 6-foot-4 and wearing glasses — has reigned as the spirit-guide of the algorithmic realm.&lt;br&gt;
He is the author of “The Art of Computer Programming,” a continuing four-volume opus that is his life’s work. The first volume debuted in 1968, and the collected volumes (sold as a boxed set for about $250) were included by American Scientist in 2013 on its list of books that shaped the last century of science — alongside a special edition of “The Autobiography of Charles Darwin,” Tom Wolfe’s “The Right Stuff,” Rachel Carson’s “Silent Spring” and monographs by Albert Einstein, John von Neumann and Richard Feynman.&lt;br&gt;
With more than one million copies in print, “The Art of Computer Programming” is the Bible of its field. “Like an actual bible, it is long and comprehensive; no other book is as comprehensive,” said Peter Norvig, a director of research at Google. After 652 pages, volume one closes with a blurb on the back cover from Bill Gates: “You should definitely send me a résumé if you can read the whole thing.”&lt;br&gt;
The volume opens with an excerpt from “McCall’s Cookbook”:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;Here is your book, the one your thousands of letters have asked us to publish. It has taken us years to do, checking and rechecking countless recipes to bring you only the best, only the interesting, only the perfect.&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Inside are algorithms, the recipes that feed the digital age — although, as Dr. Knuth likes to point out, algorithms can also be found on Babylonian tablets from 3,800 years ago. He is an esteemed algorithmist; his name is attached to some of the field’s most important specimens, such as the Knuth-Morris-Pratt string-searching algorithm. Devised in 1970, it finds all occurrences of a given word or pattern of letters in a text — for instance, when you hit Command+F to search for a keyword in a document.&lt;br&gt;
Now 80, Dr. Knuth usually dresses like the youthful geek he was when he embarked on this odyssey: long-sleeved T-shirt under a short-sleeved T-shirt, with jeans, at least at this time of year. In those early days, he worked close to the machine, writing “in the raw,” tinkering with the zeros and ones.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;See the article for the rest&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://dev.to/nabbisen/lets-encrypt-certbot-for-openbsds-httpd-3ofd"&gt;Let’s Encrypt: Certbot For OpenBSD’s httpd&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Intro&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Let’s Encrypt is “a free, automated, and open Certificate Authority”.&lt;br&gt;
Certbot is “an easy-to-use automatic client that fetches and deploys SSL/TLS certificates for your web server”, well known as “the official Let’s Encrypt client”.&lt;br&gt;
I remember well how excited I felt when I read Let’s Encrypt’s “Our First Certificate Is Now Live” in 2015.&lt;br&gt;
How wonderful the goal of them is; it’s to “give people the digital certificates they need in order to enable HTTPS (SSL/TLS) for websites, for free” “to create a more secure and privacy-respecting Web”!&lt;br&gt;
Since this year, they have begun to support even ACME v2 and Wildcard Certificate!&lt;br&gt;
Well, in OpenBSD as well as other operating systems, it’s easy and comfortable to have their big help 😊&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Environment&lt;/li&gt;
&lt;li&gt;OS: OpenBSD 6.4 amd64&lt;/li&gt;
&lt;li&gt;Web Server: OpenBSD’s httpd&lt;/li&gt;
&lt;li&gt;Certification: Let’s Encrypt with Certbot 0.27&lt;/li&gt;
&lt;li&gt;Reference: OpenBSD’s httpd&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.cyberciti.biz/open-source/freebsd-12-released-here-is-how-to-upgrade-freebsd/"&gt;FreeBSD 12 released: Here is how to upgrade FreeBSD 11 to 12&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The FreeBSD project announces the availability of FreeBSD 12.0-RELEASE. It is the first release of the stable/12 branch. The new version comes with updated software and features for a wild variety of architectures. The latest release provides performance improvements and better support for FreeBSD jails and more. One can benefit greatly using an upgraded version of FreeBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;FreeBSD 12.0 supports amd64, i386, powerpc, powerpc64, powerpcspe, sparc64, armv6, armv7, and aarch64 architectures. One can run it on a standalone server or desktop system. Another option is to run it on Raspberry PI computer. FreeBSD 12 also runs on popular cloud service providers such as AWS EC2/Lightsail or Google compute VM.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;New features and highlights:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;OpenSSL version 1.1.1a (LTS)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;OpenSSH server 7.8p1&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Unbound server 1.8.1&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Clang and co 6.0.1&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;The FreeBSD installer supports EFI+GELI as an installation option&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;VIMAGE FreeBSD kernel configuration option has been enabled by default. VIMAGE was the main reason I custom compiled FreeBSD for the last few years. No more custom compile for me.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Graphics drivers for modern ATI/AMD and Intel graphics cards are now available in the FreeBSD ports collection&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ZFS has been updated to include new sysctl(s), vfs.zfs.arcminprefetchms and vfs.zfs.arcminprescientprefetchms, which improve performance of the zpool scrub subcommand&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;The pf packet filter is now usable within a jail using vnet&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;KDE updated to version 5.12.5&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;The NFS version 4.1 includes pNFS server support&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Perl 5.26.2&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;The default PAGER now defaults to less for most commands&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;The dd utility has been updated to add the status=progress option to match GNU/Linux dd command to show progress bar while running dd&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;FreeBSD now supports ext4 for read/write operation&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Python 2.7&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;much more&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://zwischenzugs.com/2018/11/25/six-ways-to-level-up-your-nmap-game/"&gt;Six Ways to Level Up Your nmap Game&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;nmap is a network exploration tool and security / port scanner.&lt;br&gt;
If you’ve heard of it, and you’re like me, you’ve most likely used it like this:&lt;br&gt;
ie, you’ve pointed it at an IP address and observed the output which tells you the open ports on a host.&lt;br&gt;
I used nmap like this for years, but only recently grokked the manual to see what else it could do. Here’s a quick look and some of the more useful things I found out.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Scan a Network&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Scan All Ports&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Get service versions&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Use -A for more data&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Find out what nmap is up to&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Script your own scans with NSE&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###[NetBSD Desktop]&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://unitedbsd.com/t/netbsd-desktop-part-1-manual-netbsd-installation-on-gpt-uefi/284"&gt;Part 1: Manual NetBSD installation on GPT/UEFI&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://unitedbsd.com/t/netbsd-desktop-pt-2-set-up-wireless-networking-on-netbsd-with-wpa-supplicant-and-dhcpcd/281"&gt;NetBSD desktop pt.2: Set up wireless networking on NetBSD with wpasupplicant and dhcpcd&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://unitedbsd.com/t/netbsd-desktop-pt-3-simple-stateful-firewall-with-npf/286"&gt;Part 3: Simple stateful firewall with NPF&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://unitedbsd.com/t/netbsd-desktop-pt-4-the-x-display-manager-xdm/292"&gt;Part 4: 4: The X Display Manager (XDM)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://unitedbsd.com/t/netbsd-desktop-pt-5-automounting-with-berkeley-am-utils/294/3"&gt;Part 5: automounting with Berkeley am-utils&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-December/072422.html"&gt;Call For Testing: ZFS on FreeBSD Project&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.dragonflydigest.com/2018/12/18/22223.html"&gt;DragonFlyBSD 5.4.1 release within a week&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.bunniestudios.com/blog/?p=5421"&gt;You Can’t Opt Out of the Patent System. That’s Why Patent Pandas Was Created!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://yggdrasil-network.github.io/2018/12/12/announcing-v0-3.html"&gt;Announcing Yggdrasil Network v0.3&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.ziprecruiter.com/c/The-Good-Seed/Job/OpenBSD-Network-Engineer/-in-Los-Angeles,CA?jobid=35a52212-57d4d705"&gt;OpenBSD Network Engineer Job listing&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://itsfoss.com/freebsd-12-release/"&gt;FreeBSD 12.0 Stable Version Released!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://bsdsec.net/articles/libressl-2-9-0-released"&gt;LibreSSL 2.9.0 released&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=Nq8sLqtzCEQ"&gt;Live stream test: Sgi Octane light bar repair / soldering!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.sophimail.com/configure-freebsd-email-server-using-postfix-dovecot-mysql-spamassassin/"&gt;Configure a FreeBSD Email Server Using Postfix, Dovecot, MySQL, DAVICAL and SpamAssassin&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://blog.obligd.com/posts/berkeley-smorgasbord.html"&gt;Berkeley smorgasbord&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://fosdem.org/2019/schedule/track/bsd/"&gt;FOSDEM BSD Devroom schedule&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Warren - &lt;a href="http://dpaste.com/1V1XS01#wrap"&gt;Ep.273: OpenZFS on OS X&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;cogoman - &lt;a href="http://dpaste.com/0P0MWFC#wrap"&gt;tarsnap security and using SSDs in raid&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Andrew - &lt;a href="http://dpaste.com/3H9M5M0"&gt;Portland BSD Pizza Night&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, Donald Knuth, LetsEncrypt, Certbot, nmap, patent, yggdrasil, libressl</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The Open Source midlife crisis, Donald Knuth The Yoda of Silicon Valley, Certbot For OpenBSD&#39;s httpd, how to upgrade FreeBSD from 11 to 12, level up your nmap game, NetBSD desktop, and more.</p>

<p>##Headlines<br>
###<a href="http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts-its-midlife-crisis/">Open Source Confronts its midlife crisis</a></p>

<blockquote>
<p>Midlife is tough: the idealism of youth has faded, as has inevitably some of its fitness and vigor. At the same time, the responsibilities of adulthood have grown. Making things more challenging, while you are navigating the turbulence of teenagers, your own parents are likely entering life’s twilight, needing help in new ways from their adult children. By midlife, in addition to the singular joys of life, you have also likely experienced its terrible sorrows: death, heartbreak, betrayal. Taken together, the fading of youth, the growth in responsibility and the endurance of misfortune can lead to cynicism or (worse) drastic and poorly thought-out choices. Add in a little fear of mortality and some existential dread, and you have the stuff of which midlife crises are made…<br>
I raise this not because of my own adventures at midlife, but because it is clear to me that open source — now several decades old and fully adult — is going through its own midlife crisis. This has long been in the making: for years, I (and others) have been critical of service providers’ parasitic relationship with open source, as cloud service providers turn open source software into a service offering without giving back to the communities upon which they implicitly depend. At the same time, open source has been (rightfully) entirely unsympathetic to the proprietary software models that have been burned to the ground — but also seemingly oblivious as to the larger economic waves that have buoyed them.<br>
So it seemed like only a matter of time before the companies built around open source software would have to confront their own crisis of confidence: open source business models are really tough, selling software-as-a-service is one of the most natural of them, the cloud service providers are really good at it — and their commercial appetites seem boundless. And, like a new cherry red two-seater sports car next to a minivan in a suburban driveway, some open source companies are dealing with this crisis exceptionally poorly: they are trying to restrict the way that their open source software can be used. These companies want it both ways: they want the advantages of open source — the community, the positivity, the energy, the adoption, the downloads — but they also want to enjoy the fruits of proprietary software companies in software lock-in and its monopolistic rents. If this were entirely transparent (that is, if some bits were merely being made explicitly proprietary), it would be fine: we could accept these companies as essentially proprietary software companies, albeit with an open source loss-leader. But instead, these companies are trying to license their way into this self-contradictory world: continuing to claim to be entirely open source, but perverting the license under which portions of that source are available. Most gallingly, they are doing this by hijacking open source nomenclature. Of these, the laughably named commons clause is the worst offender (it is plainly designed to be confused with the purely virtuous creative commons), but others (including CockroachDB’s Community License, MongoDB’s Server Side Public License, and Confluent’s Community License) are little better. And in particular, as it apparently needs to be said: no, “community” is not the opposite of “open source” — please stop sullying its good name by attaching it to licenses that are deliberately not open source! But even if they were more aptly named (e.g. “the restricted clause” or “the controlled use license” or — perhaps most honest of all — “the please-don’t-put-me-out-of-business-during-the-next-reInvent-keynote clause”), these licenses suffer from a serious problem: they are almost certainly asserting rights that the copyright holder doesn’t in fact have.<br>
If I sell you a book that I wrote, I can restrict your right to read it aloud for an audience, or sell a translation, or write a sequel; these restrictions are rights afforded the copyright holder. I cannot, however, tell you that you can’t put the book on the same bookshelf as that of my rival, or that you can’t read the book while flying a particular airline I dislike, or that you aren’t allowed to read the book and also work for a company that competes with mine. (Lest you think that last example absurd, that’s almost verbatim the language in the new Confluent Community (sic) License.) I personally think that none of these licenses would withstand a court challenge, but I also don’t think it will come to that: because the vendors behind these licenses will surely fear that they wouldn’t survive litigation, they will deliberately avoid inviting such challenges. In some ways, this netherworld is even worse, as the license becomes a vessel for unverifiable fear of arbitrary liability.<br>
let me put this to you as directly as possible: cloud services providers are emphatically not going to license your proprietary software. I mean, you knew that, right? The whole premise with your proprietary license is that you are finding that there is no way to compete with the operational dominance of the cloud services providers; did you really believe that those same dominant cloud services providers can’t simply reimplement your LDAP integration or whatever? The cloud services providers are currently reproprietarizing all of computing — they are making their own CPUs for crying out loud! — reimplementing the bits of your software that they need in the name of the service that their customers want (and will pay for!) won’t even move the needle in terms of their effort.<br>
Worse than all of this (and the reason why this madness needs to stop): licenses that are vague with respect to permitted use are corporate toxin. Any company that has been through an acquisition can speak of the peril of the due diligence license audit: the acquiring entity is almost always deep pocketed and (not unrelatedly) risk averse; the last thing that any company wants is for a deal to go sideways because of concern over unbounded liability to some third-party knuckle-head. So companies that engage in license tomfoolery are doing worse than merely not solving their own problem: they are potentially poisoning the wellspring of their own community.<br>
in the end, open source will survive its midlife questioning just as people in midlife get through theirs: by returning to its core values and by finding rejuvenation in its communities. Indeed, we can all find solace in the fact that while life is finite, our values and our communities survive us — and that our engagement with them is our most important legacy.</p>
</blockquote>

<ul>
<li>See the article for the rest</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.nytimes.com/2018/12/17/science/donald-knuth-computers-algorithms-programming.html">Donald Knuth - The Yoda of Silicon Valley</a></p>

<blockquote>
<p>For half a century, the Stanford computer scientist Donald Knuth, who bears a slight resemblance to Yoda — albeit standing 6-foot-4 and wearing glasses — has reigned as the spirit-guide of the algorithmic realm.<br>
He is the author of “The Art of Computer Programming,” a continuing four-volume opus that is his life’s work. The first volume debuted in 1968, and the collected volumes (sold as a boxed set for about $250) were included by American Scientist in 2013 on its list of books that shaped the last century of science — alongside a special edition of “The Autobiography of Charles Darwin,” Tom Wolfe’s “The Right Stuff,” Rachel Carson’s “Silent Spring” and monographs by Albert Einstein, John von Neumann and Richard Feynman.<br>
With more than one million copies in print, “The Art of Computer Programming” is the Bible of its field. “Like an actual bible, it is long and comprehensive; no other book is as comprehensive,” said Peter Norvig, a director of research at Google. After 652 pages, volume one closes with a blurb on the back cover from Bill Gates: “You should definitely send me a résumé if you can read the whole thing.”<br>
The volume opens with an excerpt from “McCall’s Cookbook”:</p>
</blockquote>

<p><code>Here is your book, the one your thousands of letters have asked us to publish. It has taken us years to do, checking and rechecking countless recipes to bring you only the best, only the interesting, only the perfect.</code></p>

<blockquote>
<p>Inside are algorithms, the recipes that feed the digital age — although, as Dr. Knuth likes to point out, algorithms can also be found on Babylonian tablets from 3,800 years ago. He is an esteemed algorithmist; his name is attached to some of the field’s most important specimens, such as the Knuth-Morris-Pratt string-searching algorithm. Devised in 1970, it finds all occurrences of a given word or pattern of letters in a text — for instance, when you hit Command+F to search for a keyword in a document.<br>
Now 80, Dr. Knuth usually dresses like the youthful geek he was when he embarked on this odyssey: long-sleeved T-shirt under a short-sleeved T-shirt, with jeans, at least at this time of year. In those early days, he worked close to the machine, writing “in the raw,” tinkering with the zeros and ones.</p>
</blockquote>

<ul>
<li>See the article for the rest</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://dev.to/nabbisen/lets-encrypt-certbot-for-openbsds-httpd-3ofd">Let’s Encrypt: Certbot For OpenBSD’s httpd</a></p>

<ul>
<li>Intro</li>
</ul>

<blockquote>
<p>Let’s Encrypt is “a free, automated, and open Certificate Authority”.<br>
Certbot is “an easy-to-use automatic client that fetches and deploys SSL/TLS certificates for your web server”, well known as “the official Let’s Encrypt client”.<br>
I remember well how excited I felt when I read Let’s Encrypt’s “Our First Certificate Is Now Live” in 2015.<br>
How wonderful the goal of them is; it’s to “give people the digital certificates they need in order to enable HTTPS (SSL/TLS) for websites, for free” “to create a more secure and privacy-respecting Web”!<br>
Since this year, they have begun to support even ACME v2 and Wildcard Certificate!<br>
Well, in OpenBSD as well as other operating systems, it’s easy and comfortable to have their big help &#x1f60a;</p>
</blockquote>

<ul>
<li>Environment</li>
<li>OS: OpenBSD 6.4 amd64</li>
<li>Web Server: OpenBSD’s httpd</li>
<li>Certification: Let’s Encrypt with Certbot 0.27</li>
<li>Reference: OpenBSD’s httpd</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.cyberciti.biz/open-source/freebsd-12-released-here-is-how-to-upgrade-freebsd/">FreeBSD 12 released: Here is how to upgrade FreeBSD 11 to 12</a></p>

<blockquote>
<p>The FreeBSD project announces the availability of FreeBSD 12.0-RELEASE. It is the first release of the stable/12 branch. The new version comes with updated software and features for a wild variety of architectures. The latest release provides performance improvements and better support for FreeBSD jails and more. One can benefit greatly using an upgraded version of FreeBSD.</p>
</blockquote>

<blockquote>
<p>FreeBSD 12.0 supports amd64, i386, powerpc, powerpc64, powerpcspe, sparc64, armv6, armv7, and aarch64 architectures. One can run it on a standalone server or desktop system. Another option is to run it on Raspberry PI computer. FreeBSD 12 also runs on popular cloud service providers such as AWS EC2/Lightsail or Google compute VM.</p>
</blockquote>

<ul>
<li>
<p>New features and highlights:</p>
</li>
<li>
<p>OpenSSL version 1.1.1a (LTS)</p>
</li>
<li>
<p>OpenSSH server 7.8p1</p>
</li>
<li>
<p>Unbound server 1.8.1</p>
</li>
<li>
<p>Clang and co 6.0.1</p>
</li>
<li>
<p>The FreeBSD installer supports EFI+GELI as an installation option</p>
</li>
<li>
<p>VIMAGE FreeBSD kernel configuration option has been enabled by default. VIMAGE was the main reason I custom compiled FreeBSD for the last few years. No more custom compile for me.</p>
</li>
<li>
<p>Graphics drivers for modern ATI/AMD and Intel graphics cards are now available in the FreeBSD ports collection</p>
</li>
<li>
<p>ZFS has been updated to include new sysctl(s), vfs.zfs.arc_min_prefetch_ms and vfs.zfs.arc_min_prescient_prefetch_ms, which improve performance of the zpool scrub subcommand</p>
</li>
<li>
<p>The pf packet filter is now usable within a jail using vnet</p>
</li>
<li>
<p>KDE updated to version 5.12.5</p>
</li>
<li>
<p>The NFS version 4.1 includes pNFS server support</p>
</li>
<li>
<p>Perl 5.26.2</p>
</li>
<li>
<p>The default PAGER now defaults to less for most commands</p>
</li>
<li>
<p>The dd utility has been updated to add the status=progress option to match GNU/Linux dd command to show progress bar while running dd</p>
</li>
<li>
<p>FreeBSD now supports ext4 for read/write operation</p>
</li>
<li>
<p>Python 2.7</p>
</li>
<li>
<p>much more</p>
</li>
</ul>

<p><hr></p>

<p>###<a href="https://zwischenzugs.com/2018/11/25/six-ways-to-level-up-your-nmap-game/">Six Ways to Level Up Your nmap Game</a></p>

<blockquote>
<p>nmap is a network exploration tool and security / port scanner.<br>
If you’ve heard of it, and you’re like me, you’ve most likely used it like this:<br>
ie, you’ve pointed it at an IP address and observed the output which tells you the open ports on a host.<br>
I used nmap like this for years, but only recently grokked the manual to see what else it could do. Here’s a quick look and some of the more useful things I found out.</p>
</blockquote>

<ul>
<li>
<ol>
<li>Scan a Network</li>
</ol>
</li>
<li>
<ol start="2">
<li>Scan All Ports</li>
</ol>
</li>
<li>
<ol start="3">
<li>Get service versions</li>
</ol>
</li>
<li>
<ol start="4">
<li>Use -A for more data</li>
</ol>
</li>
<li>
<ol start="5">
<li>Find out what nmap is up to</li>
</ol>
</li>
<li>
<ol start="6">
<li>Script your own scans with NSE</li>
</ol>
</li>
</ul>

<p><hr></p>

<p>###[NetBSD Desktop]</p>

<ul>
<li><a href="https://unitedbsd.com/t/netbsd-desktop-part-1-manual-netbsd-installation-on-gpt-uefi/284">Part 1: Manual NetBSD installation on GPT/UEFI</a></li>
<li><a href="https://unitedbsd.com/t/netbsd-desktop-pt-2-set-up-wireless-networking-on-netbsd-with-wpa-supplicant-and-dhcpcd/281">NetBSD desktop pt.2: Set up wireless networking on NetBSD with wpa_supplicant and dhcpcd</a></li>
<li><a href="https://unitedbsd.com/t/netbsd-desktop-pt-3-simple-stateful-firewall-with-npf/286">Part 3: Simple stateful firewall with NPF</a></li>
<li><a href="https://unitedbsd.com/t/netbsd-desktop-pt-4-the-x-display-manager-xdm/292">Part 4: 4: The X Display Manager (XDM)</a></li>
<li><a href="https://unitedbsd.com/t/netbsd-desktop-pt-5-automounting-with-berkeley-am-utils/294/3">Part 5: automounting with Berkeley am-utils</a></li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-December/072422.html">Call For Testing: ZFS on FreeBSD Project</a></li>
<li><a href="https://www.dragonflydigest.com/2018/12/18/22223.html">DragonFlyBSD 5.4.1 release within a week</a></li>
<li><a href="https://www.bunniestudios.com/blog/?p=5421">You Can’t Opt Out of the Patent System. That’s Why Patent Pandas Was Created!</a></li>
<li><a href="https://yggdrasil-network.github.io/2018/12/12/announcing-v0-3.html">Announcing Yggdrasil Network v0.3</a></li>
<li><a href="https://www.ziprecruiter.com/c/The-Good-Seed/Job/OpenBSD-Network-Engineer/-in-Los-Angeles,CA?jobid=35a52212-57d4d705">OpenBSD Network Engineer Job listing</a></li>
<li><a href="https://itsfoss.com/freebsd-12-release/">FreeBSD 12.0 Stable Version Released!</a></li>
<li><a href="http://bsdsec.net/articles/libressl-2-9-0-released">LibreSSL 2.9.0 released</a></li>
<li><a href="https://www.youtube.com/watch?v=Nq8sLqtzCEQ">Live stream test: Sgi Octane light bar repair / soldering!</a></li>
<li><a href="https://www.sophimail.com/configure-freebsd-email-server-using-postfix-dovecot-mysql-spamassassin/">Configure a FreeBSD Email Server Using Postfix, Dovecot, MySQL, DAVICAL and SpamAssassin</a></li>
<li><a href="http://blog.obligd.com/posts/berkeley-smorgasbord.html">Berkeley smorgasbord</a></li>
<li><a href="https://fosdem.org/2019/schedule/track/bsd/">FOSDEM BSD Devroom schedule</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Warren - <a href="http://dpaste.com/1V1XS01#wrap">Ep.273: OpenZFS on OS X</a></li>
<li>cogoman - <a href="http://dpaste.com/0P0MWFC#wrap">tarsnap security and using SSDs in raid</a></li>
<li>Andrew - <a href="http://dpaste.com/3H9M5M0">Portland BSD Pizza Night</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The Open Source midlife crisis, Donald Knuth The Yoda of Silicon Valley, Certbot For OpenBSD&#39;s httpd, how to upgrade FreeBSD from 11 to 12, level up your nmap game, NetBSD desktop, and more.</p>

<p>##Headlines<br>
###<a href="http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts-its-midlife-crisis/">Open Source Confronts its midlife crisis</a></p>

<blockquote>
<p>Midlife is tough: the idealism of youth has faded, as has inevitably some of its fitness and vigor. At the same time, the responsibilities of adulthood have grown. Making things more challenging, while you are navigating the turbulence of teenagers, your own parents are likely entering life’s twilight, needing help in new ways from their adult children. By midlife, in addition to the singular joys of life, you have also likely experienced its terrible sorrows: death, heartbreak, betrayal. Taken together, the fading of youth, the growth in responsibility and the endurance of misfortune can lead to cynicism or (worse) drastic and poorly thought-out choices. Add in a little fear of mortality and some existential dread, and you have the stuff of which midlife crises are made…<br>
I raise this not because of my own adventures at midlife, but because it is clear to me that open source — now several decades old and fully adult — is going through its own midlife crisis. This has long been in the making: for years, I (and others) have been critical of service providers’ parasitic relationship with open source, as cloud service providers turn open source software into a service offering without giving back to the communities upon which they implicitly depend. At the same time, open source has been (rightfully) entirely unsympathetic to the proprietary software models that have been burned to the ground — but also seemingly oblivious as to the larger economic waves that have buoyed them.<br>
So it seemed like only a matter of time before the companies built around open source software would have to confront their own crisis of confidence: open source business models are really tough, selling software-as-a-service is one of the most natural of them, the cloud service providers are really good at it — and their commercial appetites seem boundless. And, like a new cherry red two-seater sports car next to a minivan in a suburban driveway, some open source companies are dealing with this crisis exceptionally poorly: they are trying to restrict the way that their open source software can be used. These companies want it both ways: they want the advantages of open source — the community, the positivity, the energy, the adoption, the downloads — but they also want to enjoy the fruits of proprietary software companies in software lock-in and its monopolistic rents. If this were entirely transparent (that is, if some bits were merely being made explicitly proprietary), it would be fine: we could accept these companies as essentially proprietary software companies, albeit with an open source loss-leader. But instead, these companies are trying to license their way into this self-contradictory world: continuing to claim to be entirely open source, but perverting the license under which portions of that source are available. Most gallingly, they are doing this by hijacking open source nomenclature. Of these, the laughably named commons clause is the worst offender (it is plainly designed to be confused with the purely virtuous creative commons), but others (including CockroachDB’s Community License, MongoDB’s Server Side Public License, and Confluent’s Community License) are little better. And in particular, as it apparently needs to be said: no, “community” is not the opposite of “open source” — please stop sullying its good name by attaching it to licenses that are deliberately not open source! But even if they were more aptly named (e.g. “the restricted clause” or “the controlled use license” or — perhaps most honest of all — “the please-don’t-put-me-out-of-business-during-the-next-reInvent-keynote clause”), these licenses suffer from a serious problem: they are almost certainly asserting rights that the copyright holder doesn’t in fact have.<br>
If I sell you a book that I wrote, I can restrict your right to read it aloud for an audience, or sell a translation, or write a sequel; these restrictions are rights afforded the copyright holder. I cannot, however, tell you that you can’t put the book on the same bookshelf as that of my rival, or that you can’t read the book while flying a particular airline I dislike, or that you aren’t allowed to read the book and also work for a company that competes with mine. (Lest you think that last example absurd, that’s almost verbatim the language in the new Confluent Community (sic) License.) I personally think that none of these licenses would withstand a court challenge, but I also don’t think it will come to that: because the vendors behind these licenses will surely fear that they wouldn’t survive litigation, they will deliberately avoid inviting such challenges. In some ways, this netherworld is even worse, as the license becomes a vessel for unverifiable fear of arbitrary liability.<br>
let me put this to you as directly as possible: cloud services providers are emphatically not going to license your proprietary software. I mean, you knew that, right? The whole premise with your proprietary license is that you are finding that there is no way to compete with the operational dominance of the cloud services providers; did you really believe that those same dominant cloud services providers can’t simply reimplement your LDAP integration or whatever? The cloud services providers are currently reproprietarizing all of computing — they are making their own CPUs for crying out loud! — reimplementing the bits of your software that they need in the name of the service that their customers want (and will pay for!) won’t even move the needle in terms of their effort.<br>
Worse than all of this (and the reason why this madness needs to stop): licenses that are vague with respect to permitted use are corporate toxin. Any company that has been through an acquisition can speak of the peril of the due diligence license audit: the acquiring entity is almost always deep pocketed and (not unrelatedly) risk averse; the last thing that any company wants is for a deal to go sideways because of concern over unbounded liability to some third-party knuckle-head. So companies that engage in license tomfoolery are doing worse than merely not solving their own problem: they are potentially poisoning the wellspring of their own community.<br>
in the end, open source will survive its midlife questioning just as people in midlife get through theirs: by returning to its core values and by finding rejuvenation in its communities. Indeed, we can all find solace in the fact that while life is finite, our values and our communities survive us — and that our engagement with them is our most important legacy.</p>
</blockquote>

<ul>
<li>See the article for the rest</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.nytimes.com/2018/12/17/science/donald-knuth-computers-algorithms-programming.html">Donald Knuth - The Yoda of Silicon Valley</a></p>

<blockquote>
<p>For half a century, the Stanford computer scientist Donald Knuth, who bears a slight resemblance to Yoda — albeit standing 6-foot-4 and wearing glasses — has reigned as the spirit-guide of the algorithmic realm.<br>
He is the author of “The Art of Computer Programming,” a continuing four-volume opus that is his life’s work. The first volume debuted in 1968, and the collected volumes (sold as a boxed set for about $250) were included by American Scientist in 2013 on its list of books that shaped the last century of science — alongside a special edition of “The Autobiography of Charles Darwin,” Tom Wolfe’s “The Right Stuff,” Rachel Carson’s “Silent Spring” and monographs by Albert Einstein, John von Neumann and Richard Feynman.<br>
With more than one million copies in print, “The Art of Computer Programming” is the Bible of its field. “Like an actual bible, it is long and comprehensive; no other book is as comprehensive,” said Peter Norvig, a director of research at Google. After 652 pages, volume one closes with a blurb on the back cover from Bill Gates: “You should definitely send me a résumé if you can read the whole thing.”<br>
The volume opens with an excerpt from “McCall’s Cookbook”:</p>
</blockquote>

<p><code>Here is your book, the one your thousands of letters have asked us to publish. It has taken us years to do, checking and rechecking countless recipes to bring you only the best, only the interesting, only the perfect.</code></p>

<blockquote>
<p>Inside are algorithms, the recipes that feed the digital age — although, as Dr. Knuth likes to point out, algorithms can also be found on Babylonian tablets from 3,800 years ago. He is an esteemed algorithmist; his name is attached to some of the field’s most important specimens, such as the Knuth-Morris-Pratt string-searching algorithm. Devised in 1970, it finds all occurrences of a given word or pattern of letters in a text — for instance, when you hit Command+F to search for a keyword in a document.<br>
Now 80, Dr. Knuth usually dresses like the youthful geek he was when he embarked on this odyssey: long-sleeved T-shirt under a short-sleeved T-shirt, with jeans, at least at this time of year. In those early days, he worked close to the machine, writing “in the raw,” tinkering with the zeros and ones.</p>
</blockquote>

<ul>
<li>See the article for the rest</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://dev.to/nabbisen/lets-encrypt-certbot-for-openbsds-httpd-3ofd">Let’s Encrypt: Certbot For OpenBSD’s httpd</a></p>

<ul>
<li>Intro</li>
</ul>

<blockquote>
<p>Let’s Encrypt is “a free, automated, and open Certificate Authority”.<br>
Certbot is “an easy-to-use automatic client that fetches and deploys SSL/TLS certificates for your web server”, well known as “the official Let’s Encrypt client”.<br>
I remember well how excited I felt when I read Let’s Encrypt’s “Our First Certificate Is Now Live” in 2015.<br>
How wonderful the goal of them is; it’s to “give people the digital certificates they need in order to enable HTTPS (SSL/TLS) for websites, for free” “to create a more secure and privacy-respecting Web”!<br>
Since this year, they have begun to support even ACME v2 and Wildcard Certificate!<br>
Well, in OpenBSD as well as other operating systems, it’s easy and comfortable to have their big help &#x1f60a;</p>
</blockquote>

<ul>
<li>Environment</li>
<li>OS: OpenBSD 6.4 amd64</li>
<li>Web Server: OpenBSD’s httpd</li>
<li>Certification: Let’s Encrypt with Certbot 0.27</li>
<li>Reference: OpenBSD’s httpd</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.cyberciti.biz/open-source/freebsd-12-released-here-is-how-to-upgrade-freebsd/">FreeBSD 12 released: Here is how to upgrade FreeBSD 11 to 12</a></p>

<blockquote>
<p>The FreeBSD project announces the availability of FreeBSD 12.0-RELEASE. It is the first release of the stable/12 branch. The new version comes with updated software and features for a wild variety of architectures. The latest release provides performance improvements and better support for FreeBSD jails and more. One can benefit greatly using an upgraded version of FreeBSD.</p>
</blockquote>

<blockquote>
<p>FreeBSD 12.0 supports amd64, i386, powerpc, powerpc64, powerpcspe, sparc64, armv6, armv7, and aarch64 architectures. One can run it on a standalone server or desktop system. Another option is to run it on Raspberry PI computer. FreeBSD 12 also runs on popular cloud service providers such as AWS EC2/Lightsail or Google compute VM.</p>
</blockquote>

<ul>
<li>
<p>New features and highlights:</p>
</li>
<li>
<p>OpenSSL version 1.1.1a (LTS)</p>
</li>
<li>
<p>OpenSSH server 7.8p1</p>
</li>
<li>
<p>Unbound server 1.8.1</p>
</li>
<li>
<p>Clang and co 6.0.1</p>
</li>
<li>
<p>The FreeBSD installer supports EFI+GELI as an installation option</p>
</li>
<li>
<p>VIMAGE FreeBSD kernel configuration option has been enabled by default. VIMAGE was the main reason I custom compiled FreeBSD for the last few years. No more custom compile for me.</p>
</li>
<li>
<p>Graphics drivers for modern ATI/AMD and Intel graphics cards are now available in the FreeBSD ports collection</p>
</li>
<li>
<p>ZFS has been updated to include new sysctl(s), vfs.zfs.arc_min_prefetch_ms and vfs.zfs.arc_min_prescient_prefetch_ms, which improve performance of the zpool scrub subcommand</p>
</li>
<li>
<p>The pf packet filter is now usable within a jail using vnet</p>
</li>
<li>
<p>KDE updated to version 5.12.5</p>
</li>
<li>
<p>The NFS version 4.1 includes pNFS server support</p>
</li>
<li>
<p>Perl 5.26.2</p>
</li>
<li>
<p>The default PAGER now defaults to less for most commands</p>
</li>
<li>
<p>The dd utility has been updated to add the status=progress option to match GNU/Linux dd command to show progress bar while running dd</p>
</li>
<li>
<p>FreeBSD now supports ext4 for read/write operation</p>
</li>
<li>
<p>Python 2.7</p>
</li>
<li>
<p>much more</p>
</li>
</ul>

<p><hr></p>

<p>###<a href="https://zwischenzugs.com/2018/11/25/six-ways-to-level-up-your-nmap-game/">Six Ways to Level Up Your nmap Game</a></p>

<blockquote>
<p>nmap is a network exploration tool and security / port scanner.<br>
If you’ve heard of it, and you’re like me, you’ve most likely used it like this:<br>
ie, you’ve pointed it at an IP address and observed the output which tells you the open ports on a host.<br>
I used nmap like this for years, but only recently grokked the manual to see what else it could do. Here’s a quick look and some of the more useful things I found out.</p>
</blockquote>

<ul>
<li>
<ol>
<li>Scan a Network</li>
</ol>
</li>
<li>
<ol start="2">
<li>Scan All Ports</li>
</ol>
</li>
<li>
<ol start="3">
<li>Get service versions</li>
</ol>
</li>
<li>
<ol start="4">
<li>Use -A for more data</li>
</ol>
</li>
<li>
<ol start="5">
<li>Find out what nmap is up to</li>
</ol>
</li>
<li>
<ol start="6">
<li>Script your own scans with NSE</li>
</ol>
</li>
</ul>

<p><hr></p>

<p>###[NetBSD Desktop]</p>

<ul>
<li><a href="https://unitedbsd.com/t/netbsd-desktop-part-1-manual-netbsd-installation-on-gpt-uefi/284">Part 1: Manual NetBSD installation on GPT/UEFI</a></li>
<li><a href="https://unitedbsd.com/t/netbsd-desktop-pt-2-set-up-wireless-networking-on-netbsd-with-wpa-supplicant-and-dhcpcd/281">NetBSD desktop pt.2: Set up wireless networking on NetBSD with wpa_supplicant and dhcpcd</a></li>
<li><a href="https://unitedbsd.com/t/netbsd-desktop-pt-3-simple-stateful-firewall-with-npf/286">Part 3: Simple stateful firewall with NPF</a></li>
<li><a href="https://unitedbsd.com/t/netbsd-desktop-pt-4-the-x-display-manager-xdm/292">Part 4: 4: The X Display Manager (XDM)</a></li>
<li><a href="https://unitedbsd.com/t/netbsd-desktop-pt-5-automounting-with-berkeley-am-utils/294/3">Part 5: automounting with Berkeley am-utils</a></li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-December/072422.html">Call For Testing: ZFS on FreeBSD Project</a></li>
<li><a href="https://www.dragonflydigest.com/2018/12/18/22223.html">DragonFlyBSD 5.4.1 release within a week</a></li>
<li><a href="https://www.bunniestudios.com/blog/?p=5421">You Can’t Opt Out of the Patent System. That’s Why Patent Pandas Was Created!</a></li>
<li><a href="https://yggdrasil-network.github.io/2018/12/12/announcing-v0-3.html">Announcing Yggdrasil Network v0.3</a></li>
<li><a href="https://www.ziprecruiter.com/c/The-Good-Seed/Job/OpenBSD-Network-Engineer/-in-Los-Angeles,CA?jobid=35a52212-57d4d705">OpenBSD Network Engineer Job listing</a></li>
<li><a href="https://itsfoss.com/freebsd-12-release/">FreeBSD 12.0 Stable Version Released!</a></li>
<li><a href="http://bsdsec.net/articles/libressl-2-9-0-released">LibreSSL 2.9.0 released</a></li>
<li><a href="https://www.youtube.com/watch?v=Nq8sLqtzCEQ">Live stream test: Sgi Octane light bar repair / soldering!</a></li>
<li><a href="https://www.sophimail.com/configure-freebsd-email-server-using-postfix-dovecot-mysql-spamassassin/">Configure a FreeBSD Email Server Using Postfix, Dovecot, MySQL, DAVICAL and SpamAssassin</a></li>
<li><a href="http://blog.obligd.com/posts/berkeley-smorgasbord.html">Berkeley smorgasbord</a></li>
<li><a href="https://fosdem.org/2019/schedule/track/bsd/">FOSDEM BSD Devroom schedule</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Warren - <a href="http://dpaste.com/1V1XS01#wrap">Ep.273: OpenZFS on OS X</a></li>
<li>cogoman - <a href="http://dpaste.com/0P0MWFC#wrap">tarsnap security and using SSDs in raid</a></li>
<li>Andrew - <a href="http://dpaste.com/3H9M5M0">Portland BSD Pizza Night</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 276: Ho, Ho, Ho - 12.0 | BSD Now 276</title>
  <link>https://www.bsdnow.tv/276</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-3028</guid>
  <pubDate>Thu, 13 Dec 2018 04:15:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9e174552-285e-4d49-9120-830715479ac5.mp3" length="42596758" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 12.0 is finally here, partly-cloudy IPsec VPN, KLEAK with NetBSD, How to create synth repos, GhostBSD author interview, and more.</itunes:subtitle>
  <itunes:duration>1:10:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 12.0 is finally here, partly-cloudy IPsec VPN, KLEAK with NetBSD, How to create synth repos, GhostBSD author interview, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.freebsd.org/releases/12.0R/relnotes.html"&gt;FreeBSD 12.0 is available&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;After a long release cycle, the wait is over: FreeBSD 12.0 is now officially available.&lt;/li&gt;
&lt;li&gt;We’ve picked a few interesting things to cover in the show, make sure to read the full &lt;a href="https://www.freebsd.org/releases/12.0R/relnotes.html"&gt;Release Notes&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Userland:&lt;br&gt;
Group permissions on /dev/acpi have been changed to allow users in the operator GID to invoke acpiconf(8) to suspend the system.&lt;br&gt;
The default devfs.rules(5) configuration has been updated to allow mount_fusefs(8) with jail(8).&lt;br&gt;
The default PAGER now defaults to less(1) for most commands.&lt;br&gt;
The newsyslog(8) utility has been updated to reject configuration entries that specify setuid(2) or executable log files.&lt;br&gt;
The WITH_REPRODUCIBLE_BUILD src.conf(5) knob has been enabled by default.&lt;br&gt;
A new src.conf(5) knob, WITH_RETPOLINE, has been added to enable the retpoline mitigation for userland builds.&lt;br&gt;
Userland applications:&lt;br&gt;
The dtrace(1) utility has been updated to support if and else statements.&lt;br&gt;
The legacy gdb(1) utility included in the base system is now installed to /usr/libexec for use with crashinfo(8). The gdbserver and gdbtui utilities are no longer installed. For interactive debugging, lldb(1) or a modern version of gdb(1) from devel/gdb should be used. A new src.conf(5) knob, WITHOUT_GDB_LIBEXEC has been added to disable building gdb(1). The gdb(1) utility is still installed in /usr/bin on sparc64.&lt;br&gt;
The setfacl(1) utility has been updated to include a new flag, -R, used to operate recursively on directories.&lt;br&gt;
The geli(8) utility has been updated to provide support for initializing multiple providers at once when they use the same passphrase and/or key.&lt;br&gt;
The dd(1) utility has been updated to add the status=progress option, which prints the status of its operation on a single line once per second, similar to GNU dd(1).&lt;br&gt;
The date(1) utility has been updated to include a new flag, -I, which prints its output in ISO 8601 formatting.&lt;br&gt;
The bectl(8) utility has been added, providing an administrative interface for managing ZFS boot environments, similar to sysutils/beadm.&lt;br&gt;
The bhyve(8) utility has been updated to add a new subcommand to the -l and -s flags, help, which when used, prints a list of supported LPC and PCI devices, respectively.&lt;br&gt;
The tftp(1) utility has been updated to change the default transfer mode from ASCII to binary.&lt;br&gt;
The chown(8) utility has been updated to prevent overflow of UID or GID arguments where the argument exceeded UID_MAX or GID_MAX, respectively.&lt;br&gt;
Kernel:&lt;br&gt;
The ACPI subsystem has been updated to implement Device object types for ACPI 6.0 support, required for some Dell, Inc. Poweredge™ AMD® Epyc™ systems.&lt;br&gt;
The amdsmn(4) and amdtemp(4) drivers have been updated to attach to AMD® Ryzen 2™ host bridges.&lt;br&gt;
The amdtemp(4) driver has been updated to fix temperature reporting for AMD® 2990WX CPUs.&lt;br&gt;
Kernel Configuration:&lt;br&gt;
The VIMAGE kernel configuration option has been enabled by default.&lt;br&gt;
The dumpon(8) utility has been updated to add support for compressed kernel crash dumps when the kernel configuration file includes the GZIO option. See rc.conf(5) and dumpon(8) for additional information.&lt;br&gt;
The NUMA option has been enabled by default in the amd64 GENERIC and MINIMAL kernel configurations.&lt;br&gt;
Device Drivers:&lt;br&gt;
The random(4) driver has been updated to remove the Yarrow algorithm. The Fortuna algorithm remains the default, and now only, available algorithm.&lt;br&gt;
The vt(4) driver has been updated with performance improvements, drawing text at rates ranging from 2- to 6-times faster.&lt;br&gt;
Deprecated Drivers:&lt;br&gt;
The lmc(4) driver has been removed.&lt;br&gt;
The ixgb(4) driver has been removed.&lt;br&gt;
The nxge(4) driver has been removed.&lt;br&gt;
The vxge(4) driver has been removed.&lt;br&gt;
The jedec_ts(4) driver has been removed in 12.0-RELEASE, and its functionality replaced by jedec_dimm(4).&lt;br&gt;
The DRM driver for modern graphics chipsets has been marked deprecated and marked for removal in FreeBSD 13. The DRM kernel modules are available from graphics/drm-stable-kmod or graphics/drm-legacy-kmod in the Ports Collection as well as via pkg(8). Additionally, the kernel modules have been added to the lua loader.conf(5) module_blacklist, as installation from the Ports Collection or pkg(8) is strongly recommended.&lt;br&gt;
The following drivers have been deprecated in FreeBSD 12.0, and not present in FreeBSD 13.0: ae(4), de(4), ed(4), ep(4), ex(4), fe(4), pcn(4), sf(4), sn(4), tl(4), tx(4), txp(4), vx(4), wb(4), xe(4)&lt;br&gt;
Storage:&lt;br&gt;
The UFS/FFS filesystem has been updated to support check hashes to cylinder-group maps. Support for check hashes is available only for UFS2.&lt;br&gt;
The UFS/FFS filesystem has been updated to consolidate TRIM/BIO_DELETE commands, reducing read/write requests due to fewer TRIM messages being sent simultaneously.&lt;br&gt;
TRIM consolidation support has been enabled by default in the UFS/FFS filesystem. TRIM consolidation can be disabled by setting the vfs.ffs.dotrimcons sysctl(8) to 0, or adding vfs.ffs.dotrimcons=0 to sysctl.conf(5).&lt;br&gt;
NFS:&lt;br&gt;
The NFS version 4.1 server has been updated to include pNFS server support.&lt;br&gt;
ZFS:&lt;br&gt;
ZFS has been updated to include new sysctl(8)s, vfs.zfs.arc_min_prefetch_ms and vfs.zfs.arc_min_prescient_prefetch_ms, which improve performance of the zpool(8) scrub subcommand.&lt;br&gt;
The new spacemap_v2 zpool feature has been added. This provides more efficient encoding of spacemaps, especially for full vdev spacemaps.&lt;br&gt;
The large_dnode zpool feature been imported, allowing better compatibility with pools created under ZFS-on-Linux 0.7.x&lt;br&gt;
Many bug fixes have been applied to the device removal feature. This feature allows you to remove a non-redundant or mirror vdev from a pool by relocating its data to other vdevs.&lt;br&gt;
Includes the fix for PR 229614 that could cause processes to hang in zil_commit()&lt;br&gt;
Boot Loader Changes:&lt;br&gt;
The lua loader(8) has been updated to detect a list of installed kernels to boot.&lt;br&gt;
The loader(8) has been updated to support geli(8) for all architectures and all disk-like devices.&lt;br&gt;
The loader(8) has been updated to add support for loading Intel® microcode updates early during the boot process.&lt;/p&gt;
&lt;p&gt;Networking:&lt;br&gt;
The pf(4) packet filter is now usable within a jail(8) using vnet(9).&lt;br&gt;
The pf(4) packet filter has been updated to use rmlock(9) instead of rwlock(9), resulting in significant performance improvements.&lt;br&gt;
The SO_REUSEPORT_LB option has been added to the network stack, allowing multiple programs or threads to bind to the same port, and incoming connections load balanced using a hash function.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Again, read the release notes for a full list, check out the &lt;a href="https://www.freebsd.org/releases/12.0R/errata.html"&gt;errata notices&lt;/a&gt;. A big THANKS to the entire release engineering team and all developers involved in the release, much appreciated!&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.adminbyaccident.com/politics/abandon-linux-move-freebsd-illumos/"&gt;Abandon Linux. Move to FreeBSD or Illumos&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;If you use GNU/Linux and you are only on opensource, you may be doing it wrong. Here’s why.&lt;br&gt;
Is your company based on opensource based software only? Do you have a bunch of developers hitting some kind of server you have installed for them to “do their thing”? Being it for economical reasons (remember to donate), being it for philosophycal ones, you may have skipped good alternatives. The BSD’s and Illumos.&lt;br&gt;
I bet you are running some sort of Debian, openSuSE or CentOS. It’s very discouraging having entered into the IT field recently and discover many of the people you meet do not even recognise the name BSD. Naming Solaris seems like naming the evil itself. The problem being many do not know why. They can’t point anything specific other than it’s fading out. This has recently shown strong when Oracle officials have stated development for new features has ceased and almost 90 % of developers for Solaris have been layed off. AIX seems alien to almost everybody unless you have a white beard. And all this is silly.&lt;br&gt;
And here’s why. You are certainly missing two important features that FreeBSD and Illumos derivatives are enjoying. A full virtualization technology, much better and fully developed compared to the LXC containers in the Linux world, such as Jails on BSD, Zones in Solaris/Illumos, and the great ZFS file system which both share.&lt;br&gt;
You have probably heard of a new Linux filesystem named Btrfs, which by the way, development has been dropped from the Red Hat side. Trying to emulate ZFS, Oracle started developing Btrfs file system before they acquired Sun (the original developer of ZFS), and SuSE joined the effort as well as Red Hat. It is not as well developed as ZFS and it hasn’t been tested in production environments as extensively as the former has. That leaves some uncertainty on using it or not. Red Hat leaving it aside does add some more. Although some organizations have used it with various grades of success.&lt;br&gt;
But why is this anyhow interesting for a sysadmin or any organization? Well… FreeBSD (descendant of Berkeley UNIX) and SmartOS (based on Illumos) aglutinate some features that make administration easier, safer, faster and more reliable. The dream of any systems administrator.&lt;br&gt;
To start, the ZFS filesystem combines the typical filesystem with a volume manager. It includes protection against corruption, snapshots and copy-on-write clones, as well as volume manager.&lt;br&gt;
Jails is another interesting piece of technology. Linux folks usually associate this as a sort of chroot. It isn’t. It is somehow inspired by it but as you may know you can escape from a chroot environment with a blink of an eye. Jails are not called jails casually. The name has a purpose. Contain processes and programs within a defined and totally controlled environment. Jails appeared first in FreeBSD in the year 2000. Solaris Zones debuted on 2005 (now called containers) are the now proprietary version of those.&lt;br&gt;
There are some other technologies on Linux such as Btrfs or Docker. But they have some caveats. Btrfs hasn’t been fully developed yet and it’s hasn’t been proved as much in production environments as ZFS has. And some problems have arisen recently although the developers are pushing the envelope. At some time they will match ZFS capabilities for sure. Docker is growing exponentially and it’s one of the cool technologies of modern times. The caveat is, as before, the development of this technology hasn’t been fully developed. Unlike other virtualization technologies this is not a kernel playing on top of another kernel. This is virtualization at the OS level, meaning differentiated environments can coexist on a single host, “hitting” the same unique kernel which controls and shares the resources. The problem comes when you put Docker on top of any other virtualization technology such as KVM or Xen. It breaks the purpose of it and has a performance penalty.&lt;br&gt;
I have arrived into the IT field with very little knowledge, that is true. But what I see strikes me. Working in a bank has allowed me to see a big production environment that needs the highest of the availability and reliability. This is, sometimes, achieved by bruteforce. And it’s legitime and adequate. Redundancy has a reason and a purpose for example. But some other times it looks, it feels, like killing flies with cannons. More hardware, more virtual machines, more people, more of this, more of that. They can afford it, so they try to maintain the cost low but at the end of the day there is a chunky budget to back operations.&lt;br&gt;
But here comes reality. You’re not a bank and you need to squeeze your investment as much as possible. By using FreeBSD jails you can avoid the performance penalty of KVM or Xen virtualization. Do you use VMWare or Hyper-V? You can avoid both and gain in performance. Not only that, control and manageability are equal as before, and sometimes easier to administer. There are four ways to operate them which can be divided in two categories. Hardcore and Human Being. For the Hardcore use the FreeBSD handbook and investigate as much as you can. For the Human Being way there are three options to use. Ezjail, Iocage and CBSD which are frameworks or programs as you may call to manage jails. I personally use Iocage but I have also used Ezjail.&lt;br&gt;
How can you use jails on your benefit? Ever tried to configure some new software and failed miserably? You can have three different jails running at the same time with different configurations. Want to try a new configuration in a production piece of hardware without applying it on the final users? You can do that with a small jail while the production environment is on in another bigger, chunkier jail.&lt;br&gt;
Want to divide the hardware as a replica of the division of the team/s you are working with? Want to sell virtual machines with bare metal performance? Do you want to isolate some piece of critical software or even data in a more controlled environment? Do you have different clients and you want to use the same hardware but you want to avoid them seeing each other at the same time you maintain performance and reliability?&lt;br&gt;
Are you a developer and you have to have reliable and portable snapshots of your work? Do you want to try new options-designs without breaking your previous work, in a timeless fashion? You can work on something, clone the jail and apply the new ideas on the project in a matter of seconds. You can stop there, export the filesystem snapshot containing all the environment and all your work and place it on a thumbdrive to later import it on a big production system. Want to change that image properties such as the network stack interface and ip? This is just one command away from you.&lt;br&gt;
But what properties can you assign to a jail and how can I manage them you may be wondering. Hostname, disk quota, i/o, memory, cpu limits, network isolation, network virtualization, snapshots and the manage of those, migration and root privilege isolation to name a few. You can also clone them and import and export them between different systems. Some of these things because of ZFS. Iocage is a python program to manage jails and it takes profit from ZFS advantages.&lt;br&gt;
But FreeBSD is not Linux you may say. No it is not. There are no run levels. The systemd factor is out of this equation. This is so since the begginning. Ever wondered where did vi come from? The TCP/IP stack? Your beloved macOS from Apple? All this is coming from the FreeBSD project. If you are used to Linux your adaptation period with any BSD will be short, very short. You will almost feel at home. Used to packaged software using yum or apt-get? No worries. With pkgng, the package management tool used in FreeBSD has almost 27.000 compiled packages for you to use. Almost all software found on any of the important GNU/Linux distros can be found here. Java, Python, C, C++, Clang, GCC, Javascript frameworks, Ruby, PHP, MySQL and the major forks, etc. All this opensource software, and much more, is available at your fingertips.&lt;br&gt;
I am a developer and… frankly my time is money and I appreciate both much more than dealing with systems configuration, etc. You can set a VM using VMWare or VirtualBox and play with barebones FreeBSD or you can use TrueOS (a derivative) which comes in a server version and a desktop oriented one. The latter will be easier for you to play with. You may be doing this already with Linux. There is a third and very sensible option. FreeNAS, developed by iXSystems. It is FreeBSD based and offers all these technologies with a GUI. VMWare, Hyper-V? Nowadays you can get your hands off the CLI and get a decent, usable, nice GUI.&lt;br&gt;
You say you play on the cloud. The major players already include FreeBSD in their offerings. You can find it in Amazon AWS or Azure (with official Microsoft support contracts too!). You can also find it in DigitalOcean and other hosting providers. There is no excuse. You can use it at home, at the office, with old or new hardware and in the cloud as well. You can even pay for a support contract to use it. Joyent, the developers of SmartOS have their own cloud with different locations around the globe. Have a look on them too.&lt;br&gt;
If you want the original of ZFS and zones you may think of Solaris. But it’s fading away. But it really isn’t. When Oracle bouth Sun many people ran away in an stampide fashion. Some of the good folks working at Sun founded new projects. One of these is Illumos. Joyent is a company formed by people who developed these technologies. They are a cloud operator, have been recently bought by Samsung and have a very competent team of people providing great tech solutions. They have developed an OS, called SmartOS (based on Illumos) with all these features. The source from this goes back to the early days of UNIX. Do you remember the days of OpenSolaris when Sun opensourced the crown jewels? There you have it. A modern opensource UNIX operating system with the roots in their original place and the head planted on today’s needs.&lt;br&gt;
In conclusion. If you are on GNU/Linux and you only use opensource software you may be doing it wrong. And missing goodies you may need and like. Once you put your hands on them, trust me, you won’t look back. And if you have some “old fashioned” admins who know Solaris, you can bring them to a new profitable and exciting life with both systems.&lt;br&gt;
Still not convinced? Would you have ever imagined Microsoft supporting Linux? Even loving it? They do love now FreeBSD. And not only that, they provide their own image in the Azure Cloud and you can get Microsoft support, payed support if you want to use the platform on Azure. Ain’t it… surprising? Convincing at all?&lt;br&gt;
PS: I haven’t mentioned both softwares, FreeBSD and SmartOS do have a Linux translation layer. This means you can run Linux binaries on them and the program won’t cough at all. Since the ABI stays stable the only thing you need to run a Linux binary is a translation between the different system calls and the libraries. Remember POSIX? Choose your poison and enjoy it.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://bradackerman.com/posts/2018-12-05-bsd-cloudy-vpn/"&gt;A partly-cloudy IPsec VPN&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Audience&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I’m assuming that readers have at least a basic knowledge of TCP/IP networking and some UNIX or UNIX-like systems, but not necessarily OpenBSD or FreeBSD. This post will therefore be light on details that aren’t OS specific and are likely to be encountered in normal use (e.g., how to use vi or another text editor.) For more information on these topics, read Absolute FreeBSD (3ed.) by Michael W. Lucas.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Overview&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I’m redoing my DigitalOcean virtual machines (which they call droplets). My requirements are:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;VPN&lt;/li&gt;
&lt;li&gt;Road-warrior access, so I can use private network resources from anywhere.&lt;/li&gt;
&lt;li&gt;A site-to-site VPN, extending my home network to my VPSes.&lt;/li&gt;
&lt;li&gt;Hosting for public and private network services.&lt;/li&gt;
&lt;li&gt;A proxy service to provide a public IP address to services hosted at home.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The last item is on the list because I don’t actually have a public IP address at home; my firewall’s external address is in the RFC 1918 space, and the entire apartment building shares a single public IPv4 address.1 (IPv6? Don’t I wish.) The end-state network will include one OpenBSD droplet providing firewall, router, and VPN services; and one FreeBSD droplet hosting multiple jailed services.&lt;br&gt;
I’ll be providing access via these droplets to a NextCloud instance at home. A simple NAT on the DO router droplet isn’t going to work, because packets going from home to the internet would exit through the apartment building’s connection and not through the VPN. It’s possible that I could do work around this issue with packet tagging using the pf firewall, but HAProxy is simple to configure and unlikely to result in hard-to-debug problems. relayd is also an option, but doesn’t have the TLS parsing abilities of HAProxy, which I’ll be using later on.&lt;br&gt;
Since this system includes jails running on a VPS, and they’ve got RFC 1918 addresses, I want them reachable from my home network. Once that’s done, I can access the private address space from anywhere through a VPN connection to the cloudy router.&lt;br&gt;
The VPN itself will be of the IPsec variety. IPsec is the traditional enterprise VPN standard, and is even used for classified applications, but has a (somewhat-deserved) reputation for complexity, but recent versions of OpenBSD turn down the difficulty by quite a bit.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The end-state network should look like: &lt;a href="https://d33wubrfki0l68.cloudfront.net/0ccf46fb057e0d50923209bb2e2af0122637e72d/e714e/201812-cloudy/endstate.svg"&gt;https://d33wubrfki0l68.cloudfront.net/0ccf46fb057e0d50923209bb2e2af0122637e72d/e714e/201812-cloudy/endstate.svg&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;This VPN both separates internal network traffic from public traffic and uses encryption to prevent interception or tampering.&lt;br&gt;
Once traffic has been encrypted, decrypting it without the key would, as Bruce Schneier once put it, require a computer built from something other than matter that occupies something other than space. Dyson spheres and a frakton of causality violation would possibly work, as would mathemagical technology that alters the local calendar such that P=NP.2 Black-bag jobs and/or suborning cloud provider employees doesn’t quite have that guarantee of impossibility, however. If you have serious security requirements, you’ll need to do better than a random blog entry.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://netbsd.org/gallery/presentations/maxv/kleak.pdf"&gt;KLEAK: Practical Kernel Memory Disclosure Detection&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Modern operating systems such as NetBSD, macOS, and Windows isolate their kernel from userspace programs to increase fault tolerance and to protect against malicious manipulations [10]. User space programs have to call into the kernel to request resources, via system calls or ioctls. This communication between user space and kernel space crosses a security boundary. Kernel memory disclosures - also known as kernel information leaks - denote the inadvertent copying of uninitialized bytes from kernel space to user space.  Such disclosed memory may contain cryptographic keys, information about the kernel memory layout, or other forms of secret data. Even though kernel memory disclosures do not allow direct exploitation of a system, they lay the ground for it.&lt;br&gt;
We introduce KLEAK, a simple approach to dynamically detect kernel information leaks. Simply said, KLEAK utilizes a rudimentary form of taint tracking: it taints kernel memory with marker values, lets the data travel through the kernel and scans the buffers exchanged between the kernel and the user space for these marker values. By using compiler instrumentation and rotating the markers at regular intervals, KLEAK significantly reduces the number of false positives, and is able to yield relevant results with little effort.&lt;br&gt;
Our  approach is practically feasible as we prove with an implementation for the NetBSD kernel. A small performance penalty is introduced, but the system remains usable. In addition to implementing KLEAK in the NetBSD kernel, we applied our approach to FreeBSD 11.2. In total,  we detected 21 previously unknown kernel memory disclosures in NetBSD-current and FreeBSD 11.2, which were fixed subsequently. As a follow-up, the projects’ developers manually audited related kernel areas and identified dozens of other kernel memory disclosures.&lt;br&gt;
The remainder of this paper is structured as follows. Section II discusses the bug class of kernel memory disclosures. Section III presents KLEAK to dynamically detect instances of this bug class. Section IV discusses the results of applying KLEAK to NetBSD-current and FreeBSD 11.2. Section V reviews prior research. Finally, Section VI concludes this paper.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.dragonflybsd.org/docs/howtos/How_To_Create_Official_Synth_Repo/"&gt;How To Create Official Synth Repo&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;System Environment&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Make sure /usr/dports is updated and that it contains no cruft (git pull; git status). Remove any cruft.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Make sure your ‘synth’ is up-to-date ‘pkg upgrade synth’. If you already updated your system you may have to build synth from scratch, from /usr/dports/ports-mgmt/synth.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Make sure /etc/make.conf is clean.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Update /usr/src to the current master, make sure there is no cruft in it&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Do a full buildworld, buildkernel, installkernel and installworld&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Reboot&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;After the reboot, before proceeding, run ‘uname -a’ and make sure you are now on the desired release or development kernel.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Synth Environment&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;/usr/local/etc/synth/ contains the synth configuration. It should contain a synth.ini file (you may have to rename the template), and you will have to create or edit a LiveSystem-make.conf file.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;System requirements are hefty. Just linking chromium alone eats at least 30GB, for example. Concurrent c++ compiles can eat up to 2GB per process. We recommend at least 100GB of SSD based swap space and 300GB of free space on the filesystem.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;synth.ini should contain this. Plus modify the builders and jobs to suit your system. With 128G of ram, 30/30 or 40/25 works well. If you have 32G of ram, maybe 8/8 or less.&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;; Take care when hand editing!&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;[Global Configuration]&lt;/code&gt;&lt;br&gt;
&lt;code&gt;profileselected= LiveSystem&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;[LiveSystem]&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Operatingsystem= DragonFly&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Directorypackages= /build/synth/livepackages&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Directoryrepository= /build/synth/livepackages/All&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Directoryportsdir= /build/synth/dports&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Directoryoptions= /build/synth/options&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Directorydistfiles= /usr/distfiles&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Directorybuildbase= /build/synth/build&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Directorylogs= /build/synth/logs&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Directoryccache= disabled&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Directorysystem= /&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Numberofbuilders= 30&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Maxjobsperbuilder= 30&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Tmpfsworkdir= true&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Tmpfslocalbase= true&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Displaywithncurses= true&lt;/code&gt;&lt;br&gt;
&lt;code&gt;leverageprebuilt= false&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;LiveSystem-make.conf should contain one line to restrict licensing to only what is allowed to be built as a binary package:&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;LICENSESACCEPTED= NONE&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Make sure there is no other cruft in /usr/local/etc/synth/&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;In the example above, the synth working dirs are in “/build/synth”. Make sure the base directories exist. Clean out any cruft for a fresh build from-scratch:&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;rm -rf /build/synth/livepackages/*&lt;/code&gt;&lt;br&gt;
&lt;code&gt;rm -rf /build/synth/logs&lt;/code&gt;&lt;br&gt;
&lt;code&gt;mkdir /build/synth/logs&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Run synth everything. I recommend doing this in a ‘screen’ session in case you lose your ssh session (assuming you are ssh’d into the build machine).&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;(optionally start a screen session)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;synth everything&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;A full synth build takes over 24 hours to run on a 48-core box, around 12 hours to run on a 64-core box. On a 4-core/8-thread box it will take at least 3 days. There will be times when swap space is heavily used. If you have not run synth before, monitor your memory and swap loads to make sure you have configured the jobs properly. If you are overloading the system, you may have to ^C the synth run, reduce the jobs, and start it again. It will pick up where it left off.&lt;/li&gt;
&lt;li&gt;When synth finishes, let it rebuild the database. You then have a working binary repo.&lt;/li&gt;
&lt;li&gt;It is usually a good idea to run synth several times to pick up any stuff it couldn’t build the first time. Each of these incremental runs may take a few hours, depending on what it tries to build.&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.freebsdbytes.com/2018/11/interview-eric-turgeon-founder-maintainer-ghostbsd/"&gt;Interview with founder and maintainer of GhostBSD, Eric Turgeon&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Thanks you Eric for taking part. To start off, could you  tell us a little about yourself, just a bit of background?&lt;/li&gt;
&lt;li&gt;How did you become interested in open source?&lt;/li&gt;
&lt;li&gt;When and how did you get interested in the BSD operating systems?&lt;/li&gt;
&lt;li&gt;On your Twitter profile, you state that you are an automation engineer at iXsystems. Can you share what you do in your day-to-day job?&lt;/li&gt;
&lt;li&gt;You are the founder and project lead of GhostBSD. Could you describe GhostBSD to those who have never used it or never heard of it?&lt;/li&gt;
&lt;li&gt;Developing an operating system is not a small thing. What made you decide to start the GhostBSD project and not join another “desktop FreeBSD” related project, such as PC-BSD and DesktopBSD at the time?&lt;/li&gt;
&lt;li&gt;How did you get to the name GhostBSD? Did you consider any other names?&lt;/li&gt;
&lt;li&gt;You recently released GhostBSD 18.10? What’s new in that version and what are the key features? What has changed since GhostBSD 11.1?&lt;/li&gt;
&lt;li&gt;The current version is 18.10. Will the next version be 19.04 (like Ubuntu’s version numbering), or is a new version released after the next stable TrueOS release&lt;/li&gt;
&lt;li&gt;Can you tell us something about the development team? Is it yourself, or are there other core team members? I think I saw two other developers on your Github project page.&lt;/li&gt;
&lt;li&gt;How about the relationship with the community? Is it possible for a community member to contribute, and how are those contributions handled?&lt;/li&gt;
&lt;li&gt;What was the biggest challenge during development?&lt;/li&gt;
&lt;li&gt;If you had to pick one feature readers should check out in GhostBSD, what is it and why?&lt;/li&gt;
&lt;li&gt;What is the relationship between iXsystems and the GhostBSD project? Or is GhostBSD a hobby project that you run separately from your work at iXsystems?&lt;/li&gt;
&lt;li&gt;What is the relationship between GhostBSD and TrueOS? Is GhostBSD TrueOS with the MATE desktop on top, or are there other modifications, additions, and differences?&lt;/li&gt;
&lt;li&gt;Where does GhostBSD go from here? What are your plans for 2019?&lt;/li&gt;
&lt;li&gt;Is there anything else that wasn’t asked or that you want to share?&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://twitter.com/gonzoua/status/1071252700023508993"&gt;dialog(1) script to select audio output on FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://blog.obligd.com/posts/erlang-otp-on-openbsd.html"&gt;Erlang otp on OpenBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://oshogbo.vexillium.org/blog/57/"&gt;Capsicum&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html"&gt;https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/introductionto%C2%B5ubsana_clean"&gt;Introduction to µUBSan - a clean-room reimplementation of the Undefined Behavior Sanitizer runtime&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://pkgsrc.org/pkgsrcCon/2018/talks.html"&gt;pkgsrcCon 2018 in Berlin - Videos&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://freebsddesktop.github.io/2018/12/08/drm-kmod-primer.html"&gt;Getting started with drm-kmod&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Malcolm - &lt;a href="http://dpaste.com/28PYSGK"&gt;Show segment idea&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Fraser - &lt;a href="http://dpaste.com/38W3PRB"&gt;Question: FreeBSD official binary package options&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Harri - &lt;a href="http://dpaste.com/3SENZ7H#wrap"&gt;BSD Magazine&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, Illumos, IPSec, VPN, OpenBGPD, KLEAK, Synth</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 12.0 is finally here, partly-cloudy IPsec VPN, KLEAK with NetBSD, How to create synth repos, GhostBSD author interview, and more.</p>

<p>##Headlines<br>
###<a href="https://www.freebsd.org/releases/12.0R/relnotes.html">FreeBSD 12.0 is available</a></p>

<ul>
<li>After a long release cycle, the wait is over: FreeBSD 12.0 is now officially available.</li>
<li>We’ve picked a few interesting things to cover in the show, make sure to read the full <a href="https://www.freebsd.org/releases/12.0R/relnotes.html">Release Notes</a></li>
</ul>

<blockquote>
<p>Userland:<br>
Group permissions on /dev/acpi have been changed to allow users in the operator GID to invoke acpiconf(8) to suspend the system.<br>
The default devfs.rules(5) configuration has been updated to allow mount_fusefs(8) with jail(8).<br>
The default PAGER now defaults to less(1) for most commands.<br>
The newsyslog(8) utility has been updated to reject configuration entries that specify setuid(2) or executable log files.<br>
The WITH_REPRODUCIBLE_BUILD src.conf(5) knob has been enabled by default.<br>
A new src.conf(5) knob, WITH_RETPOLINE, has been added to enable the retpoline mitigation for userland builds.<br>
Userland applications:<br>
The dtrace(1) utility has been updated to support if and else statements.<br>
The legacy gdb(1) utility included in the base system is now installed to /usr/libexec for use with crashinfo(8). The gdbserver and gdbtui utilities are no longer installed. For interactive debugging, lldb(1) or a modern version of gdb(1) from devel/gdb should be used. A new src.conf(5) knob, WITHOUT_GDB_LIBEXEC has been added to disable building gdb(1). The gdb(1) utility is still installed in /usr/bin on sparc64.<br>
The setfacl(1) utility has been updated to include a new flag, -R, used to operate recursively on directories.<br>
The geli(8) utility has been updated to provide support for initializing multiple providers at once when they use the same passphrase and/or key.<br>
The dd(1) utility has been updated to add the status=progress option, which prints the status of its operation on a single line once per second, similar to GNU dd(1).<br>
The date(1) utility has been updated to include a new flag, -I, which prints its output in ISO 8601 formatting.<br>
The bectl(8) utility has been added, providing an administrative interface for managing ZFS boot environments, similar to sysutils/beadm.<br>
The bhyve(8) utility has been updated to add a new subcommand to the -l and -s flags, help, which when used, prints a list of supported LPC and PCI devices, respectively.<br>
The tftp(1) utility has been updated to change the default transfer mode from ASCII to binary.<br>
The chown(8) utility has been updated to prevent overflow of UID or GID arguments where the argument exceeded UID_MAX or GID_MAX, respectively.<br>
Kernel:<br>
The ACPI subsystem has been updated to implement Device object types for ACPI 6.0 support, required for some Dell, Inc. Poweredge™ AMD® Epyc™ systems.<br>
The amdsmn(4) and amdtemp(4) drivers have been updated to attach to AMD® Ryzen 2™ host bridges.<br>
The amdtemp(4) driver has been updated to fix temperature reporting for AMD® 2990WX CPUs.<br>
Kernel Configuration:<br>
The VIMAGE kernel configuration option has been enabled by default.<br>
The dumpon(8) utility has been updated to add support for compressed kernel crash dumps when the kernel configuration file includes the GZIO option. See rc.conf(5) and dumpon(8) for additional information.<br>
The NUMA option has been enabled by default in the amd64 GENERIC and MINIMAL kernel configurations.<br>
Device Drivers:<br>
The random(4) driver has been updated to remove the Yarrow algorithm. The Fortuna algorithm remains the default, and now only, available algorithm.<br>
The vt(4) driver has been updated with performance improvements, drawing text at rates ranging from 2- to 6-times faster.<br>
Deprecated Drivers:<br>
The lmc(4) driver has been removed.<br>
The ixgb(4) driver has been removed.<br>
The nxge(4) driver has been removed.<br>
The vxge(4) driver has been removed.<br>
The jedec_ts(4) driver has been removed in 12.0-RELEASE, and its functionality replaced by jedec_dimm(4).<br>
The DRM driver for modern graphics chipsets has been marked deprecated and marked for removal in FreeBSD 13. The DRM kernel modules are available from graphics/drm-stable-kmod or graphics/drm-legacy-kmod in the Ports Collection as well as via pkg(8). Additionally, the kernel modules have been added to the lua loader.conf(5) module_blacklist, as installation from the Ports Collection or pkg(8) is strongly recommended.<br>
The following drivers have been deprecated in FreeBSD 12.0, and not present in FreeBSD 13.0: ae(4), de(4), ed(4), ep(4), ex(4), fe(4), pcn(4), sf(4), sn(4), tl(4), tx(4), txp(4), vx(4), wb(4), xe(4)<br>
Storage:<br>
The UFS/FFS filesystem has been updated to support check hashes to cylinder-group maps. Support for check hashes is available only for UFS2.<br>
The UFS/FFS filesystem has been updated to consolidate TRIM/BIO_DELETE commands, reducing read/write requests due to fewer TRIM messages being sent simultaneously.<br>
TRIM consolidation support has been enabled by default in the UFS/FFS filesystem. TRIM consolidation can be disabled by setting the vfs.ffs.dotrimcons sysctl(8) to 0, or adding vfs.ffs.dotrimcons=0 to sysctl.conf(5).<br>
NFS:<br>
The NFS version 4.1 server has been updated to include pNFS server support.<br>
ZFS:<br>
ZFS has been updated to include new sysctl(8)s, vfs.zfs.arc_min_prefetch_ms and vfs.zfs.arc_min_prescient_prefetch_ms, which improve performance of the zpool(8) scrub subcommand.<br>
The new spacemap_v2 zpool feature has been added. This provides more efficient encoding of spacemaps, especially for full vdev spacemaps.<br>
The large_dnode zpool feature been imported, allowing better compatibility with pools created under ZFS-on-Linux 0.7.x<br>
Many bug fixes have been applied to the device removal feature. This feature allows you to remove a non-redundant or mirror vdev from a pool by relocating its data to other vdevs.<br>
Includes the fix for PR 229614 that could cause processes to hang in zil_commit()<br>
Boot Loader Changes:<br>
The lua loader(8) has been updated to detect a list of installed kernels to boot.<br>
The loader(8) has been updated to support geli(8) for all architectures and all disk-like devices.<br>
The loader(8) has been updated to add support for loading Intel® microcode updates early during the boot process.</p>
<p>Networking:<br>
The pf(4) packet filter is now usable within a jail(8) using vnet(9).<br>
The pf(4) packet filter has been updated to use rmlock(9) instead of rwlock(9), resulting in significant performance improvements.<br>
The SO_REUSEPORT_LB option has been added to the network stack, allowing multiple programs or threads to bind to the same port, and incoming connections load balanced using a hash function.</p>
</blockquote>

<ul>
<li>Again, read the release notes for a full list, check out the <a href="https://www.freebsd.org/releases/12.0R/errata.html">errata notices</a>. A big THANKS to the entire release engineering team and all developers involved in the release, much appreciated!</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.adminbyaccident.com/politics/abandon-linux-move-freebsd-illumos/">Abandon Linux. Move to FreeBSD or Illumos</a></p>

<blockquote>
<p>If you use GNU/Linux and you are only on opensource, you may be doing it wrong. Here’s why.<br>
Is your company based on opensource based software only? Do you have a bunch of developers hitting some kind of server you have installed for them to “do their thing”? Being it for economical reasons (remember to donate), being it for philosophycal ones, you may have skipped good alternatives. The BSD’s and Illumos.<br>
I bet you are running some sort of Debian, openSuSE or CentOS. It’s very discouraging having entered into the IT field recently and discover many of the people you meet do not even recognise the name BSD. Naming Solaris seems like naming the evil itself. The problem being many do not know why. They can’t point anything specific other than it’s fading out. This has recently shown strong when Oracle officials have stated development for new features has ceased and almost 90 % of developers for Solaris have been layed off. AIX seems alien to almost everybody unless you have a white beard. And all this is silly.<br>
And here’s why. You are certainly missing two important features that FreeBSD and Illumos derivatives are enjoying. A full virtualization technology, much better and fully developed compared to the LXC containers in the Linux world, such as Jails on BSD, Zones in Solaris/Illumos, and the great ZFS file system which both share.<br>
You have probably heard of a new Linux filesystem named Btrfs, which by the way, development has been dropped from the Red Hat side. Trying to emulate ZFS, Oracle started developing Btrfs file system before they acquired Sun (the original developer of ZFS), and SuSE joined the effort as well as Red Hat. It is not as well developed as ZFS and it hasn’t been tested in production environments as extensively as the former has. That leaves some uncertainty on using it or not. Red Hat leaving it aside does add some more. Although some organizations have used it with various grades of success.<br>
But why is this anyhow interesting for a sysadmin or any organization? Well… FreeBSD (descendant of Berkeley UNIX) and SmartOS (based on Illumos) aglutinate some features that make administration easier, safer, faster and more reliable. The dream of any systems administrator.<br>
To start, the ZFS filesystem combines the typical filesystem with a volume manager. It includes protection against corruption, snapshots and copy-on-write clones, as well as volume manager.<br>
Jails is another interesting piece of technology. Linux folks usually associate this as a sort of chroot. It isn’t. It is somehow inspired by it but as you may know you can escape from a chroot environment with a blink of an eye. Jails are not called jails casually. The name has a purpose. Contain processes and programs within a defined and totally controlled environment. Jails appeared first in FreeBSD in the year 2000. Solaris Zones debuted on 2005 (now called containers) are the now proprietary version of those.<br>
There are some other technologies on Linux such as Btrfs or Docker. But they have some caveats. Btrfs hasn’t been fully developed yet and it’s hasn’t been proved as much in production environments as ZFS has. And some problems have arisen recently although the developers are pushing the envelope. At some time they will match ZFS capabilities for sure. Docker is growing exponentially and it’s one of the cool technologies of modern times. The caveat is, as before, the development of this technology hasn’t been fully developed. Unlike other virtualization technologies this is not a kernel playing on top of another kernel. This is virtualization at the OS level, meaning differentiated environments can coexist on a single host, “hitting” the same unique kernel which controls and shares the resources. The problem comes when you put Docker on top of any other virtualization technology such as KVM or Xen. It breaks the purpose of it and has a performance penalty.<br>
I have arrived into the IT field with very little knowledge, that is true. But what I see strikes me. Working in a bank has allowed me to see a big production environment that needs the highest of the availability and reliability. This is, sometimes, achieved by bruteforce. And it’s legitime and adequate. Redundancy has a reason and a purpose for example. But some other times it looks, it feels, like killing flies with cannons. More hardware, more virtual machines, more people, more of this, more of that. They can afford it, so they try to maintain the cost low but at the end of the day there is a chunky budget to back operations.<br>
But here comes reality. You’re not a bank and you need to squeeze your investment as much as possible. By using FreeBSD jails you can avoid the performance penalty of KVM or Xen virtualization. Do you use VMWare or Hyper-V? You can avoid both and gain in performance. Not only that, control and manageability are equal as before, and sometimes easier to administer. There are four ways to operate them which can be divided in two categories. Hardcore and Human Being. For the Hardcore use the FreeBSD handbook and investigate as much as you can. For the Human Being way there are three options to use. Ezjail, Iocage and CBSD which are frameworks or programs as you may call to manage jails. I personally use Iocage but I have also used Ezjail.<br>
How can you use jails on your benefit? Ever tried to configure some new software and failed miserably? You can have three different jails running at the same time with different configurations. Want to try a new configuration in a production piece of hardware without applying it on the final users? You can do that with a small jail while the production environment is on in another bigger, chunkier jail.<br>
Want to divide the hardware as a replica of the division of the team/s you are working with? Want to sell virtual machines with bare metal performance? Do you want to isolate some piece of critical software or even data in a more controlled environment? Do you have different clients and you want to use the same hardware but you want to avoid them seeing each other at the same time you maintain performance and reliability?<br>
Are you a developer and you have to have reliable and portable snapshots of your work? Do you want to try new options-designs without breaking your previous work, in a timeless fashion? You can work on something, clone the jail and apply the new ideas on the project in a matter of seconds. You can stop there, export the filesystem snapshot containing all the environment and all your work and place it on a thumbdrive to later import it on a big production system. Want to change that image properties such as the network stack interface and ip? This is just one command away from you.<br>
But what properties can you assign to a jail and how can I manage them you may be wondering. Hostname, disk quota, i/o, memory, cpu limits, network isolation, network virtualization, snapshots and the manage of those, migration and root privilege isolation to name a few. You can also clone them and import and export them between different systems. Some of these things because of ZFS. Iocage is a python program to manage jails and it takes profit from ZFS advantages.<br>
But FreeBSD is not Linux you may say. No it is not. There are no run levels. The systemd factor is out of this equation. This is so since the begginning. Ever wondered where did vi come from? The TCP/IP stack? Your beloved macOS from Apple? All this is coming from the FreeBSD project. If you are used to Linux your adaptation period with any BSD will be short, very short. You will almost feel at home. Used to packaged software using yum or apt-get? No worries. With pkgng, the package management tool used in FreeBSD has almost 27.000 compiled packages for you to use. Almost all software found on any of the important GNU/Linux distros can be found here. Java, Python, C, C++, Clang, GCC, Javascript frameworks, Ruby, PHP, MySQL and the major forks, etc. All this opensource software, and much more, is available at your fingertips.<br>
I am a developer and… frankly my time is money and I appreciate both much more than dealing with systems configuration, etc. You can set a VM using VMWare or VirtualBox and play with barebones FreeBSD or you can use TrueOS (a derivative) which comes in a server version and a desktop oriented one. The latter will be easier for you to play with. You may be doing this already with Linux. There is a third and very sensible option. FreeNAS, developed by iXSystems. It is FreeBSD based and offers all these technologies with a GUI. VMWare, Hyper-V? Nowadays you can get your hands off the CLI and get a decent, usable, nice GUI.<br>
You say you play on the cloud. The major players already include FreeBSD in their offerings. You can find it in Amazon AWS or Azure (with official Microsoft support contracts too!). You can also find it in DigitalOcean and other hosting providers. There is no excuse. You can use it at home, at the office, with old or new hardware and in the cloud as well. You can even pay for a support contract to use it. Joyent, the developers of SmartOS have their own cloud with different locations around the globe. Have a look on them too.<br>
If you want the original of ZFS and zones you may think of Solaris. But it’s fading away. But it really isn’t. When Oracle bouth Sun many people ran away in an stampide fashion. Some of the good folks working at Sun founded new projects. One of these is Illumos. Joyent is a company formed by people who developed these technologies. They are a cloud operator, have been recently bought by Samsung and have a very competent team of people providing great tech solutions. They have developed an OS, called SmartOS (based on Illumos) with all these features. The source from this goes back to the early days of UNIX. Do you remember the days of OpenSolaris when Sun opensourced the crown jewels? There you have it. A modern opensource UNIX operating system with the roots in their original place and the head planted on today’s needs.<br>
In conclusion. If you are on GNU/Linux and you only use opensource software you may be doing it wrong. And missing goodies you may need and like. Once you put your hands on them, trust me, you won’t look back. And if you have some “old fashioned” admins who know Solaris, you can bring them to a new profitable and exciting life with both systems.<br>
Still not convinced? Would you have ever imagined Microsoft supporting Linux? Even loving it? They do love now FreeBSD. And not only that, they provide their own image in the Azure Cloud and you can get Microsoft support, payed support if you want to use the platform on Azure. Ain’t it… surprising? Convincing at all?<br>
PS: I haven’t mentioned both softwares, FreeBSD and SmartOS do have a Linux translation layer. This means you can run Linux binaries on them and the program won’t cough at all. Since the ABI stays stable the only thing you need to run a Linux binary is a translation between the different system calls and the libraries. Remember POSIX? Choose your poison and enjoy it.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://bradackerman.com/posts/2018-12-05-bsd-cloudy-vpn/">A partly-cloudy IPsec VPN</a></p>

<ul>
<li>Audience</li>
</ul>

<blockquote>
<p>I’m assuming that readers have at least a basic knowledge of TCP/IP networking and some UNIX or UNIX-like systems, but not necessarily OpenBSD or FreeBSD. This post will therefore be light on details that aren’t OS specific and are likely to be encountered in normal use (e.g., how to use vi or another text editor.) For more information on these topics, read Absolute FreeBSD (3ed.) by Michael W. Lucas.</p>
</blockquote>

<ul>
<li>Overview</li>
</ul>

<blockquote>
<p>I’m redoing my DigitalOcean virtual machines (which they call droplets). My requirements are:</p>
</blockquote>

<ul>
<li>VPN</li>
<li>Road-warrior access, so I can use private network resources from anywhere.</li>
<li>A site-to-site VPN, extending my home network to my VPSes.</li>
<li>Hosting for public and private network services.</li>
<li>A proxy service to provide a public IP address to services hosted at home.</li>
</ul>

<blockquote>
<p>The last item is on the list because I don’t actually have a public IP address at home; my firewall’s external address is in the RFC 1918 space, and the entire apartment building shares a single public IPv4 address.1 (IPv6? Don’t I wish.) The end-state network will include one OpenBSD droplet providing firewall, router, and VPN services; and one FreeBSD droplet hosting multiple jailed services.<br>
I’ll be providing access via these droplets to a NextCloud instance at home. A simple NAT on the DO router droplet isn’t going to work, because packets going from home to the internet would exit through the apartment building’s connection and not through the VPN. It’s possible that I could do work around this issue with packet tagging using the pf firewall, but HAProxy is simple to configure and unlikely to result in hard-to-debug problems. relayd is also an option, but doesn’t have the TLS parsing abilities of HAProxy, which I’ll be using later on.<br>
Since this system includes jails running on a VPS, and they’ve got RFC 1918 addresses, I want them reachable from my home network. Once that’s done, I can access the private address space from anywhere through a VPN connection to the cloudy router.<br>
The VPN itself will be of the IPsec variety. IPsec is the traditional enterprise VPN standard, and is even used for classified applications, but has a (somewhat-deserved) reputation for complexity, but recent versions of OpenBSD turn down the difficulty by quite a bit.</p>
</blockquote>

<ul>
<li>The end-state network should look like: <a href="https://d33wubrfki0l68.cloudfront.net/0ccf46fb057e0d50923209bb2e2af0122637e72d/e714e/201812-cloudy/endstate.svg">https://d33wubrfki0l68.cloudfront.net/0ccf46fb057e0d50923209bb2e2af0122637e72d/e714e/201812-cloudy/endstate.svg</a></li>
</ul>

<blockquote>
<p>This VPN both separates internal network traffic from public traffic and uses encryption to prevent interception or tampering.<br>
Once traffic has been encrypted, decrypting it without the key would, as Bruce Schneier once put it, require a computer built from something other than matter that occupies something other than space. Dyson spheres and a frakton of causality violation would possibly work, as would mathemagical technology that alters the local calendar such that P=NP.2 Black-bag jobs and/or suborning cloud provider employees doesn’t quite have that guarantee of impossibility, however. If you have serious security requirements, you’ll need to do better than a random blog entry.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://netbsd.org/gallery/presentations/maxv/kleak.pdf">KLEAK: Practical Kernel Memory Disclosure Detection</a></p>

<blockquote>
<p>Modern operating systems such as NetBSD, macOS, and Windows isolate their kernel from userspace programs to increase fault tolerance and to protect against malicious manipulations [10]. User space programs have to call into the kernel to request resources, via system calls or ioctls. This communication between user space and kernel space crosses a security boundary. Kernel memory disclosures - also known as kernel information leaks - denote the inadvertent copying of uninitialized bytes from kernel space to user space.  Such disclosed memory may contain cryptographic keys, information about the kernel memory layout, or other forms of secret data. Even though kernel memory disclosures do not allow direct exploitation of a system, they lay the ground for it.<br>
We introduce KLEAK, a simple approach to dynamically detect kernel information leaks. Simply said, KLEAK utilizes a rudimentary form of taint tracking: it taints kernel memory with marker values, lets the data travel through the kernel and scans the buffers exchanged between the kernel and the user space for these marker values. By using compiler instrumentation and rotating the markers at regular intervals, KLEAK significantly reduces the number of false positives, and is able to yield relevant results with little effort.<br>
Our  approach is practically feasible as we prove with an implementation for the NetBSD kernel. A small performance penalty is introduced, but the system remains usable. In addition to implementing KLEAK in the NetBSD kernel, we applied our approach to FreeBSD 11.2. In total,  we detected 21 previously unknown kernel memory disclosures in NetBSD-current and FreeBSD 11.2, which were fixed subsequently. As a follow-up, the projects’ developers manually audited related kernel areas and identified dozens of other kernel memory disclosures.<br>
The remainder of this paper is structured as follows. Section II discusses the bug class of kernel memory disclosures. Section III presents KLEAK to dynamically detect instances of this bug class. Section IV discusses the results of applying KLEAK to NetBSD-current and FreeBSD 11.2. Section V reviews prior research. Finally, Section VI concludes this paper.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.dragonflybsd.org/docs/howtos/How_To_Create_Official_Synth_Repo/">How To Create Official Synth Repo</a></p>

<ul>
<li>
<p>System Environment</p>
</li>
<li>
<p>Make sure /usr/dports is updated and that it contains no cruft (git pull; git status). Remove any cruft.</p>
</li>
<li>
<p>Make sure your ‘synth’ is up-to-date ‘pkg upgrade synth’. If you already updated your system you may have to build synth from scratch, from /usr/dports/ports-mgmt/synth.</p>
</li>
<li>
<p>Make sure /etc/make.conf is clean.</p>
</li>
<li>
<p>Update /usr/src to the current master, make sure there is no cruft in it</p>
</li>
<li>
<p>Do a full buildworld, buildkernel, installkernel and installworld</p>
</li>
<li>
<p>Reboot</p>
</li>
<li>
<p>After the reboot, before proceeding, run ‘uname -a’ and make sure you are now on the desired release or development kernel.</p>
</li>
<li>
<p>Synth Environment</p>
</li>
<li>
<p>/usr/local/etc/synth/ contains the synth configuration. It should contain a synth.ini file (you may have to rename the template), and you will have to create or edit a LiveSystem-make.conf file.</p>
</li>
<li>
<p>System requirements are hefty. Just linking chromium alone eats at least 30GB, for example. Concurrent c++ compiles can eat up to 2GB per process. We recommend at least 100GB of SSD based swap space and 300GB of free space on the filesystem.</p>
</li>
<li>
<p>synth.ini should contain this. Plus modify the builders and jobs to suit your system. With 128G of ram, 30/30 or 40/25 works well. If you have 32G of ram, maybe 8/8 or less.</p>
</li>
</ul>

<p><code>; Take care when hand editing!</code><br>
<code></code><br>
<code>[Global Configuration]</code><br>
<code>profile_selected= LiveSystem</code><br>
<code></code><br>
<code>[LiveSystem]</code><br>
<code>Operating_system= DragonFly</code><br>
<code>Directory_packages= /build/synth/live_packages</code><br>
<code>Directory_repository= /build/synth/live_packages/All</code><br>
<code>Directory_portsdir= /build/synth/dports</code><br>
<code>Directory_options= /build/synth/options</code><br>
<code>Directory_distfiles= /usr/distfiles</code><br>
<code>Directory_buildbase= /build/synth/build</code><br>
<code>Directory_logs= /build/synth/logs</code><br>
<code>Directory_ccache= disabled</code><br>
<code>Directory_system= /</code><br>
<code>Number_of_builders= 30</code><br>
<code>Max_jobs_per_builder= 30</code><br>
<code>Tmpfs_workdir= true</code><br>
<code>Tmpfs_localbase= true</code><br>
<code>Display_with_ncurses= true</code><br>
<code>leverage_prebuilt= false</code></p>

<ul>
<li>LiveSystem-make.conf should contain one line to restrict licensing to only what is allowed to be built as a binary package:</li>
</ul>

<p><code>LICENSES_ACCEPTED= NONE</code></p>

<ul>
<li>
<p>Make sure there is no other cruft in /usr/local/etc/synth/</p>
</li>
<li>
<p>In the example above, the synth working dirs are in “/build/synth”. Make sure the base directories exist. Clean out any cruft for a fresh build from-scratch:</p>
</li>
</ul>

<p><code>rm -rf /build/synth/live_packages/*</code><br>
<code>rm -rf /build/synth/logs</code><br>
<code>mkdir /build/synth/logs</code></p>

<ul>
<li>Run synth everything. I recommend doing this in a ‘screen’ session in case you lose your ssh session (assuming you are ssh’d into the build machine).</li>
</ul>

<p><code>(optionally start a screen session)</code><br>
<code>synth everything</code></p>

<ul>
<li>A full synth build takes over 24 hours to run on a 48-core box, around 12 hours to run on a 64-core box. On a 4-core/8-thread box it will take at least 3 days. There will be times when swap space is heavily used. If you have not run synth before, monitor your memory and swap loads to make sure you have configured the jobs properly. If you are overloading the system, you may have to ^C the synth run, reduce the jobs, and start it again. It will pick up where it left off.</li>
<li>When synth finishes, let it rebuild the database. You then have a working binary repo.</li>
<li>It is usually a good idea to run synth several times to pick up any stuff it couldn’t build the first time. Each of these incremental runs may take a few hours, depending on what it tries to build.</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.freebsdbytes.com/2018/11/interview-eric-turgeon-founder-maintainer-ghostbsd/">Interview with founder and maintainer of GhostBSD, Eric Turgeon</a></p>

<ul>
<li>Thanks you Eric for taking part. To start off, could you  tell us a little about yourself, just a bit of background?</li>
<li>How did you become interested in open source?</li>
<li>When and how did you get interested in the BSD operating systems?</li>
<li>On your Twitter profile, you state that you are an automation engineer at iXsystems. Can you share what you do in your day-to-day job?</li>
<li>You are the founder and project lead of GhostBSD. Could you describe GhostBSD to those who have never used it or never heard of it?</li>
<li>Developing an operating system is not a small thing. What made you decide to start the GhostBSD project and not join another “desktop FreeBSD” related project, such as PC-BSD and DesktopBSD at the time?</li>
<li>How did you get to the name GhostBSD? Did you consider any other names?</li>
<li>You recently released GhostBSD 18.10? What’s new in that version and what are the key features? What has changed since GhostBSD 11.1?</li>
<li>The current version is 18.10. Will the next version be 19.04 (like Ubuntu’s version numbering), or is a new version released after the next stable TrueOS release</li>
<li>Can you tell us something about the development team? Is it yourself, or are there other core team members? I think I saw two other developers on your Github project page.</li>
<li>How about the relationship with the community? Is it possible for a community member to contribute, and how are those contributions handled?</li>
<li>What was the biggest challenge during development?</li>
<li>If you had to pick one feature readers should check out in GhostBSD, what is it and why?</li>
<li>What is the relationship between iXsystems and the GhostBSD project? Or is GhostBSD a hobby project that you run separately from your work at iXsystems?</li>
<li>What is the relationship between GhostBSD and TrueOS? Is GhostBSD TrueOS with the MATE desktop on top, or are there other modifications, additions, and differences?</li>
<li>Where does GhostBSD go from here? What are your plans for 2019?</li>
<li>Is there anything else that wasn’t asked or that you want to share?</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://twitter.com/gonzoua/status/1071252700023508993">dialog(1) script to select audio output on FreeBSD</a></li>
<li><a href="http://blog.obligd.com/posts/erlang-otp-on-openbsd.html">Erlang otp on OpenBSD</a></li>
<li><a href="https://oshogbo.vexillium.org/blog/57/">Capsicum</a></li>
<li><a href="https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html">https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/introduction_to_%C2%B5ubsan_a_clean">Introduction to µUBSan - a clean-room reimplementation of the Undefined Behavior Sanitizer runtime</a></li>
<li><a href="https://pkgsrc.org/pkgsrcCon/2018/talks.html">pkgsrcCon 2018 in Berlin - Videos</a></li>
<li><a href="https://freebsddesktop.github.io/2018/12/08/drm-kmod-primer.html">Getting started with drm-kmod</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Malcolm - <a href="http://dpaste.com/28PYSGK">Show segment idea</a></li>
<li>Fraser - <a href="http://dpaste.com/38W3PRB">Question: FreeBSD official binary package options</a></li>
<li>Harri - <a href="http://dpaste.com/3SENZ7H#wrap">BSD Magazine</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 12.0 is finally here, partly-cloudy IPsec VPN, KLEAK with NetBSD, How to create synth repos, GhostBSD author interview, and more.</p>

<p>##Headlines<br>
###<a href="https://www.freebsd.org/releases/12.0R/relnotes.html">FreeBSD 12.0 is available</a></p>

<ul>
<li>After a long release cycle, the wait is over: FreeBSD 12.0 is now officially available.</li>
<li>We’ve picked a few interesting things to cover in the show, make sure to read the full <a href="https://www.freebsd.org/releases/12.0R/relnotes.html">Release Notes</a></li>
</ul>

<blockquote>
<p>Userland:<br>
Group permissions on /dev/acpi have been changed to allow users in the operator GID to invoke acpiconf(8) to suspend the system.<br>
The default devfs.rules(5) configuration has been updated to allow mount_fusefs(8) with jail(8).<br>
The default PAGER now defaults to less(1) for most commands.<br>
The newsyslog(8) utility has been updated to reject configuration entries that specify setuid(2) or executable log files.<br>
The WITH_REPRODUCIBLE_BUILD src.conf(5) knob has been enabled by default.<br>
A new src.conf(5) knob, WITH_RETPOLINE, has been added to enable the retpoline mitigation for userland builds.<br>
Userland applications:<br>
The dtrace(1) utility has been updated to support if and else statements.<br>
The legacy gdb(1) utility included in the base system is now installed to /usr/libexec for use with crashinfo(8). The gdbserver and gdbtui utilities are no longer installed. For interactive debugging, lldb(1) or a modern version of gdb(1) from devel/gdb should be used. A new src.conf(5) knob, WITHOUT_GDB_LIBEXEC has been added to disable building gdb(1). The gdb(1) utility is still installed in /usr/bin on sparc64.<br>
The setfacl(1) utility has been updated to include a new flag, -R, used to operate recursively on directories.<br>
The geli(8) utility has been updated to provide support for initializing multiple providers at once when they use the same passphrase and/or key.<br>
The dd(1) utility has been updated to add the status=progress option, which prints the status of its operation on a single line once per second, similar to GNU dd(1).<br>
The date(1) utility has been updated to include a new flag, -I, which prints its output in ISO 8601 formatting.<br>
The bectl(8) utility has been added, providing an administrative interface for managing ZFS boot environments, similar to sysutils/beadm.<br>
The bhyve(8) utility has been updated to add a new subcommand to the -l and -s flags, help, which when used, prints a list of supported LPC and PCI devices, respectively.<br>
The tftp(1) utility has been updated to change the default transfer mode from ASCII to binary.<br>
The chown(8) utility has been updated to prevent overflow of UID or GID arguments where the argument exceeded UID_MAX or GID_MAX, respectively.<br>
Kernel:<br>
The ACPI subsystem has been updated to implement Device object types for ACPI 6.0 support, required for some Dell, Inc. Poweredge™ AMD® Epyc™ systems.<br>
The amdsmn(4) and amdtemp(4) drivers have been updated to attach to AMD® Ryzen 2™ host bridges.<br>
The amdtemp(4) driver has been updated to fix temperature reporting for AMD® 2990WX CPUs.<br>
Kernel Configuration:<br>
The VIMAGE kernel configuration option has been enabled by default.<br>
The dumpon(8) utility has been updated to add support for compressed kernel crash dumps when the kernel configuration file includes the GZIO option. See rc.conf(5) and dumpon(8) for additional information.<br>
The NUMA option has been enabled by default in the amd64 GENERIC and MINIMAL kernel configurations.<br>
Device Drivers:<br>
The random(4) driver has been updated to remove the Yarrow algorithm. The Fortuna algorithm remains the default, and now only, available algorithm.<br>
The vt(4) driver has been updated with performance improvements, drawing text at rates ranging from 2- to 6-times faster.<br>
Deprecated Drivers:<br>
The lmc(4) driver has been removed.<br>
The ixgb(4) driver has been removed.<br>
The nxge(4) driver has been removed.<br>
The vxge(4) driver has been removed.<br>
The jedec_ts(4) driver has been removed in 12.0-RELEASE, and its functionality replaced by jedec_dimm(4).<br>
The DRM driver for modern graphics chipsets has been marked deprecated and marked for removal in FreeBSD 13. The DRM kernel modules are available from graphics/drm-stable-kmod or graphics/drm-legacy-kmod in the Ports Collection as well as via pkg(8). Additionally, the kernel modules have been added to the lua loader.conf(5) module_blacklist, as installation from the Ports Collection or pkg(8) is strongly recommended.<br>
The following drivers have been deprecated in FreeBSD 12.0, and not present in FreeBSD 13.0: ae(4), de(4), ed(4), ep(4), ex(4), fe(4), pcn(4), sf(4), sn(4), tl(4), tx(4), txp(4), vx(4), wb(4), xe(4)<br>
Storage:<br>
The UFS/FFS filesystem has been updated to support check hashes to cylinder-group maps. Support for check hashes is available only for UFS2.<br>
The UFS/FFS filesystem has been updated to consolidate TRIM/BIO_DELETE commands, reducing read/write requests due to fewer TRIM messages being sent simultaneously.<br>
TRIM consolidation support has been enabled by default in the UFS/FFS filesystem. TRIM consolidation can be disabled by setting the vfs.ffs.dotrimcons sysctl(8) to 0, or adding vfs.ffs.dotrimcons=0 to sysctl.conf(5).<br>
NFS:<br>
The NFS version 4.1 server has been updated to include pNFS server support.<br>
ZFS:<br>
ZFS has been updated to include new sysctl(8)s, vfs.zfs.arc_min_prefetch_ms and vfs.zfs.arc_min_prescient_prefetch_ms, which improve performance of the zpool(8) scrub subcommand.<br>
The new spacemap_v2 zpool feature has been added. This provides more efficient encoding of spacemaps, especially for full vdev spacemaps.<br>
The large_dnode zpool feature been imported, allowing better compatibility with pools created under ZFS-on-Linux 0.7.x<br>
Many bug fixes have been applied to the device removal feature. This feature allows you to remove a non-redundant or mirror vdev from a pool by relocating its data to other vdevs.<br>
Includes the fix for PR 229614 that could cause processes to hang in zil_commit()<br>
Boot Loader Changes:<br>
The lua loader(8) has been updated to detect a list of installed kernels to boot.<br>
The loader(8) has been updated to support geli(8) for all architectures and all disk-like devices.<br>
The loader(8) has been updated to add support for loading Intel® microcode updates early during the boot process.</p>
<p>Networking:<br>
The pf(4) packet filter is now usable within a jail(8) using vnet(9).<br>
The pf(4) packet filter has been updated to use rmlock(9) instead of rwlock(9), resulting in significant performance improvements.<br>
The SO_REUSEPORT_LB option has been added to the network stack, allowing multiple programs or threads to bind to the same port, and incoming connections load balanced using a hash function.</p>
</blockquote>

<ul>
<li>Again, read the release notes for a full list, check out the <a href="https://www.freebsd.org/releases/12.0R/errata.html">errata notices</a>. A big THANKS to the entire release engineering team and all developers involved in the release, much appreciated!</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.adminbyaccident.com/politics/abandon-linux-move-freebsd-illumos/">Abandon Linux. Move to FreeBSD or Illumos</a></p>

<blockquote>
<p>If you use GNU/Linux and you are only on opensource, you may be doing it wrong. Here’s why.<br>
Is your company based on opensource based software only? Do you have a bunch of developers hitting some kind of server you have installed for them to “do their thing”? Being it for economical reasons (remember to donate), being it for philosophycal ones, you may have skipped good alternatives. The BSD’s and Illumos.<br>
I bet you are running some sort of Debian, openSuSE or CentOS. It’s very discouraging having entered into the IT field recently and discover many of the people you meet do not even recognise the name BSD. Naming Solaris seems like naming the evil itself. The problem being many do not know why. They can’t point anything specific other than it’s fading out. This has recently shown strong when Oracle officials have stated development for new features has ceased and almost 90 % of developers for Solaris have been layed off. AIX seems alien to almost everybody unless you have a white beard. And all this is silly.<br>
And here’s why. You are certainly missing two important features that FreeBSD and Illumos derivatives are enjoying. A full virtualization technology, much better and fully developed compared to the LXC containers in the Linux world, such as Jails on BSD, Zones in Solaris/Illumos, and the great ZFS file system which both share.<br>
You have probably heard of a new Linux filesystem named Btrfs, which by the way, development has been dropped from the Red Hat side. Trying to emulate ZFS, Oracle started developing Btrfs file system before they acquired Sun (the original developer of ZFS), and SuSE joined the effort as well as Red Hat. It is not as well developed as ZFS and it hasn’t been tested in production environments as extensively as the former has. That leaves some uncertainty on using it or not. Red Hat leaving it aside does add some more. Although some organizations have used it with various grades of success.<br>
But why is this anyhow interesting for a sysadmin or any organization? Well… FreeBSD (descendant of Berkeley UNIX) and SmartOS (based on Illumos) aglutinate some features that make administration easier, safer, faster and more reliable. The dream of any systems administrator.<br>
To start, the ZFS filesystem combines the typical filesystem with a volume manager. It includes protection against corruption, snapshots and copy-on-write clones, as well as volume manager.<br>
Jails is another interesting piece of technology. Linux folks usually associate this as a sort of chroot. It isn’t. It is somehow inspired by it but as you may know you can escape from a chroot environment with a blink of an eye. Jails are not called jails casually. The name has a purpose. Contain processes and programs within a defined and totally controlled environment. Jails appeared first in FreeBSD in the year 2000. Solaris Zones debuted on 2005 (now called containers) are the now proprietary version of those.<br>
There are some other technologies on Linux such as Btrfs or Docker. But they have some caveats. Btrfs hasn’t been fully developed yet and it’s hasn’t been proved as much in production environments as ZFS has. And some problems have arisen recently although the developers are pushing the envelope. At some time they will match ZFS capabilities for sure. Docker is growing exponentially and it’s one of the cool technologies of modern times. The caveat is, as before, the development of this technology hasn’t been fully developed. Unlike other virtualization technologies this is not a kernel playing on top of another kernel. This is virtualization at the OS level, meaning differentiated environments can coexist on a single host, “hitting” the same unique kernel which controls and shares the resources. The problem comes when you put Docker on top of any other virtualization technology such as KVM or Xen. It breaks the purpose of it and has a performance penalty.<br>
I have arrived into the IT field with very little knowledge, that is true. But what I see strikes me. Working in a bank has allowed me to see a big production environment that needs the highest of the availability and reliability. This is, sometimes, achieved by bruteforce. And it’s legitime and adequate. Redundancy has a reason and a purpose for example. But some other times it looks, it feels, like killing flies with cannons. More hardware, more virtual machines, more people, more of this, more of that. They can afford it, so they try to maintain the cost low but at the end of the day there is a chunky budget to back operations.<br>
But here comes reality. You’re not a bank and you need to squeeze your investment as much as possible. By using FreeBSD jails you can avoid the performance penalty of KVM or Xen virtualization. Do you use VMWare or Hyper-V? You can avoid both and gain in performance. Not only that, control and manageability are equal as before, and sometimes easier to administer. There are four ways to operate them which can be divided in two categories. Hardcore and Human Being. For the Hardcore use the FreeBSD handbook and investigate as much as you can. For the Human Being way there are three options to use. Ezjail, Iocage and CBSD which are frameworks or programs as you may call to manage jails. I personally use Iocage but I have also used Ezjail.<br>
How can you use jails on your benefit? Ever tried to configure some new software and failed miserably? You can have three different jails running at the same time with different configurations. Want to try a new configuration in a production piece of hardware without applying it on the final users? You can do that with a small jail while the production environment is on in another bigger, chunkier jail.<br>
Want to divide the hardware as a replica of the division of the team/s you are working with? Want to sell virtual machines with bare metal performance? Do you want to isolate some piece of critical software or even data in a more controlled environment? Do you have different clients and you want to use the same hardware but you want to avoid them seeing each other at the same time you maintain performance and reliability?<br>
Are you a developer and you have to have reliable and portable snapshots of your work? Do you want to try new options-designs without breaking your previous work, in a timeless fashion? You can work on something, clone the jail and apply the new ideas on the project in a matter of seconds. You can stop there, export the filesystem snapshot containing all the environment and all your work and place it on a thumbdrive to later import it on a big production system. Want to change that image properties such as the network stack interface and ip? This is just one command away from you.<br>
But what properties can you assign to a jail and how can I manage them you may be wondering. Hostname, disk quota, i/o, memory, cpu limits, network isolation, network virtualization, snapshots and the manage of those, migration and root privilege isolation to name a few. You can also clone them and import and export them between different systems. Some of these things because of ZFS. Iocage is a python program to manage jails and it takes profit from ZFS advantages.<br>
But FreeBSD is not Linux you may say. No it is not. There are no run levels. The systemd factor is out of this equation. This is so since the begginning. Ever wondered where did vi come from? The TCP/IP stack? Your beloved macOS from Apple? All this is coming from the FreeBSD project. If you are used to Linux your adaptation period with any BSD will be short, very short. You will almost feel at home. Used to packaged software using yum or apt-get? No worries. With pkgng, the package management tool used in FreeBSD has almost 27.000 compiled packages for you to use. Almost all software found on any of the important GNU/Linux distros can be found here. Java, Python, C, C++, Clang, GCC, Javascript frameworks, Ruby, PHP, MySQL and the major forks, etc. All this opensource software, and much more, is available at your fingertips.<br>
I am a developer and… frankly my time is money and I appreciate both much more than dealing with systems configuration, etc. You can set a VM using VMWare or VirtualBox and play with barebones FreeBSD or you can use TrueOS (a derivative) which comes in a server version and a desktop oriented one. The latter will be easier for you to play with. You may be doing this already with Linux. There is a third and very sensible option. FreeNAS, developed by iXSystems. It is FreeBSD based and offers all these technologies with a GUI. VMWare, Hyper-V? Nowadays you can get your hands off the CLI and get a decent, usable, nice GUI.<br>
You say you play on the cloud. The major players already include FreeBSD in their offerings. You can find it in Amazon AWS or Azure (with official Microsoft support contracts too!). You can also find it in DigitalOcean and other hosting providers. There is no excuse. You can use it at home, at the office, with old or new hardware and in the cloud as well. You can even pay for a support contract to use it. Joyent, the developers of SmartOS have their own cloud with different locations around the globe. Have a look on them too.<br>
If you want the original of ZFS and zones you may think of Solaris. But it’s fading away. But it really isn’t. When Oracle bouth Sun many people ran away in an stampide fashion. Some of the good folks working at Sun founded new projects. One of these is Illumos. Joyent is a company formed by people who developed these technologies. They are a cloud operator, have been recently bought by Samsung and have a very competent team of people providing great tech solutions. They have developed an OS, called SmartOS (based on Illumos) with all these features. The source from this goes back to the early days of UNIX. Do you remember the days of OpenSolaris when Sun opensourced the crown jewels? There you have it. A modern opensource UNIX operating system with the roots in their original place and the head planted on today’s needs.<br>
In conclusion. If you are on GNU/Linux and you only use opensource software you may be doing it wrong. And missing goodies you may need and like. Once you put your hands on them, trust me, you won’t look back. And if you have some “old fashioned” admins who know Solaris, you can bring them to a new profitable and exciting life with both systems.<br>
Still not convinced? Would you have ever imagined Microsoft supporting Linux? Even loving it? They do love now FreeBSD. And not only that, they provide their own image in the Azure Cloud and you can get Microsoft support, payed support if you want to use the platform on Azure. Ain’t it… surprising? Convincing at all?<br>
PS: I haven’t mentioned both softwares, FreeBSD and SmartOS do have a Linux translation layer. This means you can run Linux binaries on them and the program won’t cough at all. Since the ABI stays stable the only thing you need to run a Linux binary is a translation between the different system calls and the libraries. Remember POSIX? Choose your poison and enjoy it.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://bradackerman.com/posts/2018-12-05-bsd-cloudy-vpn/">A partly-cloudy IPsec VPN</a></p>

<ul>
<li>Audience</li>
</ul>

<blockquote>
<p>I’m assuming that readers have at least a basic knowledge of TCP/IP networking and some UNIX or UNIX-like systems, but not necessarily OpenBSD or FreeBSD. This post will therefore be light on details that aren’t OS specific and are likely to be encountered in normal use (e.g., how to use vi or another text editor.) For more information on these topics, read Absolute FreeBSD (3ed.) by Michael W. Lucas.</p>
</blockquote>

<ul>
<li>Overview</li>
</ul>

<blockquote>
<p>I’m redoing my DigitalOcean virtual machines (which they call droplets). My requirements are:</p>
</blockquote>

<ul>
<li>VPN</li>
<li>Road-warrior access, so I can use private network resources from anywhere.</li>
<li>A site-to-site VPN, extending my home network to my VPSes.</li>
<li>Hosting for public and private network services.</li>
<li>A proxy service to provide a public IP address to services hosted at home.</li>
</ul>

<blockquote>
<p>The last item is on the list because I don’t actually have a public IP address at home; my firewall’s external address is in the RFC 1918 space, and the entire apartment building shares a single public IPv4 address.1 (IPv6? Don’t I wish.) The end-state network will include one OpenBSD droplet providing firewall, router, and VPN services; and one FreeBSD droplet hosting multiple jailed services.<br>
I’ll be providing access via these droplets to a NextCloud instance at home. A simple NAT on the DO router droplet isn’t going to work, because packets going from home to the internet would exit through the apartment building’s connection and not through the VPN. It’s possible that I could do work around this issue with packet tagging using the pf firewall, but HAProxy is simple to configure and unlikely to result in hard-to-debug problems. relayd is also an option, but doesn’t have the TLS parsing abilities of HAProxy, which I’ll be using later on.<br>
Since this system includes jails running on a VPS, and they’ve got RFC 1918 addresses, I want them reachable from my home network. Once that’s done, I can access the private address space from anywhere through a VPN connection to the cloudy router.<br>
The VPN itself will be of the IPsec variety. IPsec is the traditional enterprise VPN standard, and is even used for classified applications, but has a (somewhat-deserved) reputation for complexity, but recent versions of OpenBSD turn down the difficulty by quite a bit.</p>
</blockquote>

<ul>
<li>The end-state network should look like: <a href="https://d33wubrfki0l68.cloudfront.net/0ccf46fb057e0d50923209bb2e2af0122637e72d/e714e/201812-cloudy/endstate.svg">https://d33wubrfki0l68.cloudfront.net/0ccf46fb057e0d50923209bb2e2af0122637e72d/e714e/201812-cloudy/endstate.svg</a></li>
</ul>

<blockquote>
<p>This VPN both separates internal network traffic from public traffic and uses encryption to prevent interception or tampering.<br>
Once traffic has been encrypted, decrypting it without the key would, as Bruce Schneier once put it, require a computer built from something other than matter that occupies something other than space. Dyson spheres and a frakton of causality violation would possibly work, as would mathemagical technology that alters the local calendar such that P=NP.2 Black-bag jobs and/or suborning cloud provider employees doesn’t quite have that guarantee of impossibility, however. If you have serious security requirements, you’ll need to do better than a random blog entry.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://netbsd.org/gallery/presentations/maxv/kleak.pdf">KLEAK: Practical Kernel Memory Disclosure Detection</a></p>

<blockquote>
<p>Modern operating systems such as NetBSD, macOS, and Windows isolate their kernel from userspace programs to increase fault tolerance and to protect against malicious manipulations [10]. User space programs have to call into the kernel to request resources, via system calls or ioctls. This communication between user space and kernel space crosses a security boundary. Kernel memory disclosures - also known as kernel information leaks - denote the inadvertent copying of uninitialized bytes from kernel space to user space.  Such disclosed memory may contain cryptographic keys, information about the kernel memory layout, or other forms of secret data. Even though kernel memory disclosures do not allow direct exploitation of a system, they lay the ground for it.<br>
We introduce KLEAK, a simple approach to dynamically detect kernel information leaks. Simply said, KLEAK utilizes a rudimentary form of taint tracking: it taints kernel memory with marker values, lets the data travel through the kernel and scans the buffers exchanged between the kernel and the user space for these marker values. By using compiler instrumentation and rotating the markers at regular intervals, KLEAK significantly reduces the number of false positives, and is able to yield relevant results with little effort.<br>
Our  approach is practically feasible as we prove with an implementation for the NetBSD kernel. A small performance penalty is introduced, but the system remains usable. In addition to implementing KLEAK in the NetBSD kernel, we applied our approach to FreeBSD 11.2. In total,  we detected 21 previously unknown kernel memory disclosures in NetBSD-current and FreeBSD 11.2, which were fixed subsequently. As a follow-up, the projects’ developers manually audited related kernel areas and identified dozens of other kernel memory disclosures.<br>
The remainder of this paper is structured as follows. Section II discusses the bug class of kernel memory disclosures. Section III presents KLEAK to dynamically detect instances of this bug class. Section IV discusses the results of applying KLEAK to NetBSD-current and FreeBSD 11.2. Section V reviews prior research. Finally, Section VI concludes this paper.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.dragonflybsd.org/docs/howtos/How_To_Create_Official_Synth_Repo/">How To Create Official Synth Repo</a></p>

<ul>
<li>
<p>System Environment</p>
</li>
<li>
<p>Make sure /usr/dports is updated and that it contains no cruft (git pull; git status). Remove any cruft.</p>
</li>
<li>
<p>Make sure your ‘synth’ is up-to-date ‘pkg upgrade synth’. If you already updated your system you may have to build synth from scratch, from /usr/dports/ports-mgmt/synth.</p>
</li>
<li>
<p>Make sure /etc/make.conf is clean.</p>
</li>
<li>
<p>Update /usr/src to the current master, make sure there is no cruft in it</p>
</li>
<li>
<p>Do a full buildworld, buildkernel, installkernel and installworld</p>
</li>
<li>
<p>Reboot</p>
</li>
<li>
<p>After the reboot, before proceeding, run ‘uname -a’ and make sure you are now on the desired release or development kernel.</p>
</li>
<li>
<p>Synth Environment</p>
</li>
<li>
<p>/usr/local/etc/synth/ contains the synth configuration. It should contain a synth.ini file (you may have to rename the template), and you will have to create or edit a LiveSystem-make.conf file.</p>
</li>
<li>
<p>System requirements are hefty. Just linking chromium alone eats at least 30GB, for example. Concurrent c++ compiles can eat up to 2GB per process. We recommend at least 100GB of SSD based swap space and 300GB of free space on the filesystem.</p>
</li>
<li>
<p>synth.ini should contain this. Plus modify the builders and jobs to suit your system. With 128G of ram, 30/30 or 40/25 works well. If you have 32G of ram, maybe 8/8 or less.</p>
</li>
</ul>

<p><code>; Take care when hand editing!</code><br>
<code></code><br>
<code>[Global Configuration]</code><br>
<code>profile_selected= LiveSystem</code><br>
<code></code><br>
<code>[LiveSystem]</code><br>
<code>Operating_system= DragonFly</code><br>
<code>Directory_packages= /build/synth/live_packages</code><br>
<code>Directory_repository= /build/synth/live_packages/All</code><br>
<code>Directory_portsdir= /build/synth/dports</code><br>
<code>Directory_options= /build/synth/options</code><br>
<code>Directory_distfiles= /usr/distfiles</code><br>
<code>Directory_buildbase= /build/synth/build</code><br>
<code>Directory_logs= /build/synth/logs</code><br>
<code>Directory_ccache= disabled</code><br>
<code>Directory_system= /</code><br>
<code>Number_of_builders= 30</code><br>
<code>Max_jobs_per_builder= 30</code><br>
<code>Tmpfs_workdir= true</code><br>
<code>Tmpfs_localbase= true</code><br>
<code>Display_with_ncurses= true</code><br>
<code>leverage_prebuilt= false</code></p>

<ul>
<li>LiveSystem-make.conf should contain one line to restrict licensing to only what is allowed to be built as a binary package:</li>
</ul>

<p><code>LICENSES_ACCEPTED= NONE</code></p>

<ul>
<li>
<p>Make sure there is no other cruft in /usr/local/etc/synth/</p>
</li>
<li>
<p>In the example above, the synth working dirs are in “/build/synth”. Make sure the base directories exist. Clean out any cruft for a fresh build from-scratch:</p>
</li>
</ul>

<p><code>rm -rf /build/synth/live_packages/*</code><br>
<code>rm -rf /build/synth/logs</code><br>
<code>mkdir /build/synth/logs</code></p>

<ul>
<li>Run synth everything. I recommend doing this in a ‘screen’ session in case you lose your ssh session (assuming you are ssh’d into the build machine).</li>
</ul>

<p><code>(optionally start a screen session)</code><br>
<code>synth everything</code></p>

<ul>
<li>A full synth build takes over 24 hours to run on a 48-core box, around 12 hours to run on a 64-core box. On a 4-core/8-thread box it will take at least 3 days. There will be times when swap space is heavily used. If you have not run synth before, monitor your memory and swap loads to make sure you have configured the jobs properly. If you are overloading the system, you may have to ^C the synth run, reduce the jobs, and start it again. It will pick up where it left off.</li>
<li>When synth finishes, let it rebuild the database. You then have a working binary repo.</li>
<li>It is usually a good idea to run synth several times to pick up any stuff it couldn’t build the first time. Each of these incremental runs may take a few hours, depending on what it tries to build.</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.freebsdbytes.com/2018/11/interview-eric-turgeon-founder-maintainer-ghostbsd/">Interview with founder and maintainer of GhostBSD, Eric Turgeon</a></p>

<ul>
<li>Thanks you Eric for taking part. To start off, could you  tell us a little about yourself, just a bit of background?</li>
<li>How did you become interested in open source?</li>
<li>When and how did you get interested in the BSD operating systems?</li>
<li>On your Twitter profile, you state that you are an automation engineer at iXsystems. Can you share what you do in your day-to-day job?</li>
<li>You are the founder and project lead of GhostBSD. Could you describe GhostBSD to those who have never used it or never heard of it?</li>
<li>Developing an operating system is not a small thing. What made you decide to start the GhostBSD project and not join another “desktop FreeBSD” related project, such as PC-BSD and DesktopBSD at the time?</li>
<li>How did you get to the name GhostBSD? Did you consider any other names?</li>
<li>You recently released GhostBSD 18.10? What’s new in that version and what are the key features? What has changed since GhostBSD 11.1?</li>
<li>The current version is 18.10. Will the next version be 19.04 (like Ubuntu’s version numbering), or is a new version released after the next stable TrueOS release</li>
<li>Can you tell us something about the development team? Is it yourself, or are there other core team members? I think I saw two other developers on your Github project page.</li>
<li>How about the relationship with the community? Is it possible for a community member to contribute, and how are those contributions handled?</li>
<li>What was the biggest challenge during development?</li>
<li>If you had to pick one feature readers should check out in GhostBSD, what is it and why?</li>
<li>What is the relationship between iXsystems and the GhostBSD project? Or is GhostBSD a hobby project that you run separately from your work at iXsystems?</li>
<li>What is the relationship between GhostBSD and TrueOS? Is GhostBSD TrueOS with the MATE desktop on top, or are there other modifications, additions, and differences?</li>
<li>Where does GhostBSD go from here? What are your plans for 2019?</li>
<li>Is there anything else that wasn’t asked or that you want to share?</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://twitter.com/gonzoua/status/1071252700023508993">dialog(1) script to select audio output on FreeBSD</a></li>
<li><a href="http://blog.obligd.com/posts/erlang-otp-on-openbsd.html">Erlang otp on OpenBSD</a></li>
<li><a href="https://oshogbo.vexillium.org/blog/57/">Capsicum</a></li>
<li><a href="https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html">https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/introduction_to_%C2%B5ubsan_a_clean">Introduction to µUBSan - a clean-room reimplementation of the Undefined Behavior Sanitizer runtime</a></li>
<li><a href="https://pkgsrc.org/pkgsrcCon/2018/talks.html">pkgsrcCon 2018 in Berlin - Videos</a></li>
<li><a href="https://freebsddesktop.github.io/2018/12/08/drm-kmod-primer.html">Getting started with drm-kmod</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Malcolm - <a href="http://dpaste.com/28PYSGK">Show segment idea</a></li>
<li>Fraser - <a href="http://dpaste.com/38W3PRB">Question: FreeBSD official binary package options</a></li>
<li>Harri - <a href="http://dpaste.com/3SENZ7H#wrap">BSD Magazine</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 275: OpenBSD in Stereo | BSD Now 275</title>
  <link>https://www.bsdnow.tv/275</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2997</guid>
  <pubDate>Sun, 09 Dec 2018 04:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/233f4bf5-4bc3-453e-9e99-c78b18a453e0.mp3" length="51110355" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>DragonflyBSD 5.4 has been released, down the Gopher hole with OpenBSD, OpenBSD in stereo with VFIO, BSD/OS the best candidate for legally tested open source Unix, OpenBGPD adds diversity to the routing server landscape, and more.</itunes:subtitle>
  <itunes:duration>1:24:52</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>DragonflyBSD 5.4 has been released, down the Gopher hole with OpenBSD, OpenBSD in stereo with VFIO, BSD/OS the best candidate for legally tested open source Unix, OpenBGPD adds diversity to the routing server landscape, and more.
Headlines
&lt;a href="https://www.dragonflybsd.org/release54/"&gt;DragonflyBSD 5.4 released&lt;/a&gt;
&lt;blockquote&gt;DragonFly version 5.4 brings a new system compiler in GCC 8, improved NUMA support, a large of number network and virtual machine driver updates, and updates to video support. This release is 64-bit only, as with previous releases.
The details of all commits between the 5.2 and 5.4 branches are available in the associated commit messages for 5.4.0rc and 5.4.0.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Big-ticket items&lt;/li&gt;
    &lt;li&gt;Much better support for asymmetric NUMA (Non-Uniform Memory Access) configurations. In particular, both the memory subsystem and the scheduler now understand the Threadripper 2990WX’s architecture. The scheduler will prioritize CPU nodes with direct-attached memory and the memory subsystem will normalize memory queues for CPU nodes without direct-attached memory (which improves cache locality on those CPUs).&lt;/li&gt;
    &lt;li&gt;Incremental performance work. DragonFly as a whole is very SMP friendly. The type of performance work we are doing now mostly revolves around improving fairness for shared-vs-exclusive lock clashes, reducing cache ping-ponging due to non-contending SMP locks (i.e. massive use of shared locks on shared resources), and so forth.&lt;/li&gt;
    &lt;li&gt;Major updates to dports brings us to within a week or two of FreeBSD’s ports as of this writing, in particular major updates to chromium, and making the whole mess work with gcc-8.&lt;/li&gt;
    &lt;li&gt;Major rewriting of the tty clist code and the tty locking code, significantly improving concurrency across multiple ttys and ptys.&lt;/li&gt;
    &lt;li&gt;GCC 8&lt;/li&gt;
    &lt;li&gt;DragonFly now ships with GCC 8.0, and runs as the default compiler. It is also now used for building dports.&lt;/li&gt;
    &lt;li&gt;GCC 4.7.4 and GCC 5.4.1 are still installed. 4.7.4 is our backup compiler, and 5.4.1 is still there to ensure a smooth transition, but should generally not be used. buildworld builds all three by default to ensure maximum compatibility.&lt;/li&gt;
    &lt;li&gt;Many passes through world sources were made to address various warnings and errors the new GCC brought with it.&lt;/li&gt;
    &lt;li&gt;HAMMER2&lt;/li&gt;
    &lt;li&gt;HAMMER2 is recommended as the default root filesystem in non-clustered mode.&lt;/li&gt;
    &lt;li&gt;Clustered support is not yet available.&lt;/li&gt;
    &lt;li&gt;Increased bulkfree cache to reduce the number of iterations required.&lt;/li&gt;
    &lt;li&gt;Fixed numerous bugs.&lt;/li&gt;
    &lt;li&gt;Improved support on low-memory machines.&lt;/li&gt;
    &lt;li&gt;Significant pre-work on the XOP API to help support future networked operations.&lt;/li&gt;
    &lt;li&gt;Details&lt;/li&gt;
    &lt;li&gt;Checksums
&lt;code&gt;MD5 (dfly-x86_64-5.4.0_REL.img) = 7277d7cffc92837c7d1c5dd11a11b98f&lt;/code&gt;
&lt;code&gt;MD5 (dfly-x86_64-5.4.0_REL.iso) = 6da7abf036fe9267479837b3c3078408&lt;/code&gt;
&lt;code&gt;MD5 (dfly-x86_64-5.4.0_REL.img.bz2) = a77a072c864f4b72fd56b4250c983ff1&lt;/code&gt;
&lt;code&gt;MD5 (dfly-x86_64-5.4.0_REL.iso.bz2) = 4dbfec6ccfc1d59c5049455db914d499&lt;/code&gt;
&lt;/li&gt;
    &lt;li&gt;Downloads Links&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;DragonFly BSD is 64-bit only, as announced during the 3.8 release.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;USB: dfly-x86_64-5.4.0_REL.img as bzip2 file&lt;/li&gt;
    &lt;li&gt;ISO: dfly-x86_64-5.4.0_REL.iso as bzip2 file&lt;/li&gt;
    &lt;li&gt;Uncompressed ISO: dfly-x86_64-5.4.0_REL.iso (For use with VPS providers as an install image.)&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;a href="https://cryogenix.net/gophernicus.html"&gt;Down the Gopher hole with OpenBSD, Gophernicus, and TLS&lt;/a&gt;
&lt;blockquote&gt;In the early 2000s I thought I had seen the worst of the web - Java applets, Macromedia (&amp;gt;Adobe) Flash, animated GIFs, javascript snow that kept you warm in the winter by burning out your CPU, and so on. For a time we learned from these mistakes, and started putting the burden on the server-side - then with improvements in javascript engines we started abusing it again with JSON/AJAX and it all went down hill from there.&lt;/blockquote&gt;
&lt;blockquote&gt;Like cloud computing, blockchains, machine learning and a tonne of other a la mode technologies around today - most users and service providers don’t need websites that consume 1GB of memory processing JS and downloading 50MB of compressed data just to read Alice’s one-page travel blog or Bob’s notes on porting NetBSD to his blood-pressure monitor.&lt;/blockquote&gt;
&lt;blockquote&gt;Before the HTTP web we relied on Prestel/Minitel style systems, BBS systems, and arguably the most accessible of all - Gopher! Gopher was similar to the locally accessed AmigaGuide format, in that it allowed users to search and retrieve documents interactively, with links and cross-references. Its efficiency and distraction-free nature make it attractive to those who are tired of the invasive, clickbait, ad-filled, javascript-laden web2/3.x. But enough complaining and evangelism - here’s how to get your own Gopher Hole!&lt;/blockquote&gt;
&lt;blockquote&gt;Gophernicus is a modern gopher daemon which aims to be secure (although it still uses inetd -_-); it’s even in OpenBSD ports so at least we can rely on it to be reasonably audited.&lt;/blockquote&gt;
&lt;blockquote&gt;If you need a starting point with Gopher, SDF-EU’s wiki has a good article here.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;&lt;a href="https://sdfeu.org/w/tutorials:gopher"&gt;https://sdfeu.org/w/tutorials:gopher&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;Finally, if you don’t like gopher(1) - there’s always lynx(1) or NCSA Mosaic!&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;&lt;a href="https://cryogenix.net/NCSA_Mosaic_OpenBSD.html"&gt;https://cryogenix.net/NCSA_Mosaic_OpenBSD.html&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;I’ve added TLS support to Gophernicus so you don’t need to use stunnel anymore. The code is ugly and unpolished though so I wouldn’t recommend for production use.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;&lt;a href="https://github.com/0x16h/gophernicus"&gt;https://github.com/0x16h/gophernicus&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://github.com/0x16h/gophernicus/blob/master/INSTALL.openbsd"&gt;https://github.com/0x16h/gophernicus/blob/master/INSTALL.openbsd&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
News Roundup
&lt;a href="https://jcs.org/2018/11/12/vfio"&gt;OpenBSD in Stereo with Linux VFIO&lt;/a&gt;
&lt;blockquote&gt;I use a Huawei Matebook X as my primary OpenBSD laptop and one aspect of its hardware support has always been lacking: audio never played out of the right-side speaker. The speaker did actually work, but only in Windows and only after the Realtek Dolby Atmos audio driver from Huawei was installed. Under OpenBSD and Linux, and even Windows with the default Intel sound driver, audio only ever played out of the left speaker.
Now, after some extensive reverse engineering and debugging with the help of VFIO on Linux, I finally have audio playing out of both speakers on OpenBSD.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;VFIO&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;The Linux kernel has functionality called VFIO which enables direct access to a physical device (like a PCI card) from userspace, usually passing it to an emulator like QEMU.
To my surprise, these days, it seems to be primarily by gamers who boot Linux, then use QEMU to run a game in Windows and use VFIO to pass the computer’s GPU device through to Windows.
By using Linux and VFIO, I was able to boot Windows 10 inside of QEMU and pass my laptop’s PCI audio device through to Windows, allowing the Realtek audio drivers to natively control the audio device. Combined with QEMU’s tracing functionality, I was able to get a log of all PCI I/O between Windows and the PCI audio device.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Using VFIO&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;To use VFIO to pass-through a PCI device, it first needs to be stubbed out so the Linux kernel’s default drivers don’t attach to it. GRUB can be configured to instruct the kernel to ignore the PCI audio device (8086:9d71) and explicitly enable the Intel IOMMU driver by adding the following to /etc/default/grub and running update-grub
With the audio device stubbed out, a new VFIO device can be created from it
Then the VFIO device (00:1f.3) can be passed to QEMU
I was using my own build of QEMU for this, due to some custom logging I needed (more on that later), but the default QEMU package should work fine. The events.txt was a file of all VFIO events I wanted logged (which was all of them).
Since I was frequently killing QEMU and restarting it, Windows 10 wanted to go through its unexpected shutdown routine each time (and would sometimes just fail to boot again). To avoid this and to get a consistent set of logs each time, I used qemu-img to take a snapshot of a base image first, then boot QEMU with that snapshot. The snapshot just gets thrown away the next time qemu-img is run and Windows always starts from a consistent state.
QEMU will now log each VFIO event which gets saved to a debug-output file.
With a full log of all PCI I/O activity from Windows, I compared it to the output from OpenBSD and tried to find the magic register writes that enabled the second speaker. After days of combing through the logs and annotating them by looking up hex values in the documentation, diffing runtime register values, and even brute-forcing it by mechanically duplicating all PCI I/O activity in the OpenBSD driver, nothing would activate the right speaker.
One strange thing that I noticed was if I booted Windows 10 in QEMU and it activated the speaker, then booted OpenBSD in QEMU without resetting the PCI device’s power in-between (as a normal system reboot would do), both speakers worked in OpenBSD and the configuration that the HDA controller presented was different, even without any changes in OpenBSD.&lt;/blockquote&gt;
&lt;blockquote&gt;A Primer on Intel HDA
Most modern computers with integrated sound chips use an Intel High Definition Audio (HDA) Controller device, with one or more codecs (like the Realtek ALC269) hanging off of it. These codecs do the actual audio processing and communicate with DACs and ADCs to send digital audio to the connected speakers, or read analog audio from a microphone and convert it to a digital input stream. In my Huawei Matebook X, this is done through a Realtek ALC298 codec.
On OpenBSD, these HDA controllers are supported by the azalia(4) driver, with all of the per-codec details in the lengthy azalia_codec.c file. This file has grown quite large with lots of codec- and machine-specific quirks to route things properly, toggle various GPIO pins, and unmute speakers that are for some reason muted by default.
The azalia driver talks to the HDA controller and sets up various buffers and then walks the list of codecs. Each codec supports a number of widget nodes which can be interconnected in various ways. Some of these nodes can be reconfigured on the fly to do things like turning a microphone port into a headphone port.
The newer Huawei Matebook X Pro released a few months ago is also plagued with this speaker problem, although it has four speakers and only two work by default. A fix is being proposed for the Linux kernel which just reconfigures those widget pins in the Intel HDA driver. Unfortunately no pin reconfiguration is enough to fix my Matebook X with its two speakers.
While reading more documentation on the HDA, I realized there was a lot more activity going on than I was able to see through the PCI tracing.
For speed and efficiency, HDA controllers use a DMA engine to transfer audio streams as well as the commands from the OS driver to the codecs. In the output above, the CORBWP=0; size=256 and RIRBRP=0, size=256 indicate the setup of the CORB (Command Output Ring Buffer) and RIRB (Response Input Ring Buffer) each with 256 entries. The HDA driver allocates a DMA address and then writes it to the two CORBLBASE and CORBUBASE registers, and again for the RIRB.
When the driver wants to send a command to a codec, such as CORB_GET_PARAMETER with a parameter of COP_VOLUME_KNOB_CAPABILITIES, it encodes the codec address, the node index, the command verb, and the parameter, and then writes that value to the CORB ring at the address it set up with the controller at initialization time (CORBLBASE/CORBUBASE) plus the offset of the ring index. Once the command is on the ring, it does a PCI write to the CORBWP register, advancing it by one. This lets the controller know a new command is queued, which it then acts on and writes the response value on the RIRB ring at the same position as the command (but at the RIRB’s DMA address). It then generates an interrupt, telling the driver to read the new RIRBWP value and process the new results.
Since the actual command contents and responses are handled through DMA writes and reads, these important values weren’t showing up in the VFIO PCI trace output that I had gathered. Time to hack QEMU.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Logging DMA Memory Values in QEMU&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;Since DMA activity wouldn’t show up through QEMU’s VFIO tracing and I obviously couldn’t get Windows to dump these values like I could in OpenBSD, I could make QEMU recognize the PCI write to the CORBWP register as an indication that a command has just been written to the CORB ring.
My custom hack in QEMU adds some HDA awareness to remember the CORB and RIRB DMA addresses as they get programmed in the controller. Then any time a PCI write to the CORBWP register is done, QEMU fetches the new CORB command from DMA memory, decodes it into the codec address, node address, command, and parameter, and prints it out. When a PCI read of the RIRBWP register is requested, QEMU reads the response and prints the corresponding CORB command that it stored earlier.
With this hack in place, I now had a full log of all CORB commands and RIRB responses sent to and read from the codec:
An early version of this patch left me stumped for a few days because, even after submitting all of the same CORB commands in OpenBSD, the second speaker still didn’t work. It wasn’t until re-reading the HDA spec that I realized the Windows driver was submitting more than one command at a time, writing multiple CORB entries and writing a CORBWP value that was advanced by two. This required turning my CORB/RIRB reading into a for loop, reading each new command and response between the new CORBWP/RIRBWP value and the one previously seen.
Sure enough, the magic commands to enable the second speaker were sent in these periods where it submitted more than one command at a time.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Minimizing the Magic&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;The full log of VFIO PCI activity from the Windows driver was over 65,000 lines and contained 3,150 CORB commands, which is a lot to sort through. It took me a couple more days to reduce that down to a small subset that was actually required to activate the second speaker, and that could only be done through trial and error:&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Boot OpenBSD with the full list of CORB commands in the azalia driver&lt;/li&gt;
    &lt;li&gt;Comment out a group of them&lt;/li&gt;
    &lt;li&gt;Compile kernel and install it, halt the QEMU guest&lt;/li&gt;
    &lt;li&gt;Suspend and wake the laptop, resetting PCI power to the audio device to reset the speaker/Dolby initialization and ensure the previous run isn’t influencing the current test (I’m guessing there is an easier to way to reset PCI power than suspending the laptop, but oh well)&lt;/li&gt;
    &lt;li&gt;Start QEMU, boot OpenBSD with the new kernel&lt;/li&gt;
    &lt;li&gt;Play an MP3 with mpg123 which has alternating left- and right-channel audio and listen for both channels to play&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;This required a dozen or so iterations because sometimes I’d comment out too many commands and the right speaker would stop working. Other times the combination of commands would hang the controller and it wouldn’t process any further commands. At one point the combination of commands actually flipped the channels around so the right channel audio was playing through the left speaker.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;The Result&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;After about a week of this routine, I ended up with a list of 662 CORB commands that are needed to get the second speaker working. Based on the number of repeated-but-slightly-different values written with the 0x500 and 0x400 commands, I’m guessing this is some kind of training data and that this is doing the full Dolby/Atmos system initialization, not just turning on the second speaker, but I could be completely wrong.
In any case, the stereo sound from OpenBSD is wonderful now and I can finally stop downmixing everything to mono to play from the left speaker. In case you ever need to do this, sndiod can be run with -c 0:0 to reduce the channels to one.
Due to the massive size of the code needed for this quirk, I’m not sure if I’ll be committing it upstream in OpenBSD or just saving it for my own tree. But at least now the hardware support chart for my Matebook is all yeses for the things I care about.
I’ve also updated the Linux bug report that I opened before venturing down this path, hoping one of the maintainers of that HDA code that works at Intel or Realtek knew of a solution I could just port to OpenBSD. I’m curious to see what they’ll do with it.&lt;/blockquote&gt;

&lt;hr&gt;
&lt;a href="https://virtuallyfun.com/wordpress/2018/11/26/why-bsd-os-is-the-best-candidate-for-being-the-only-tested-legally-open-unix/"&gt;Why BSD/OS is the best candidate for being the only tested legally open UNIX&lt;/a&gt;
&lt;ul&gt;
    &lt;li&gt;Introduction&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;The UNIX® system is an old operating system, possibly older than many of the readers of this post. However, despite its age, it still has not been open sourced completely. In this post, I will try to detail which parts of which UNIX systems have not yet been open sourced. I will focus on the legal situation in Germany in particular, taking it representative of European law in general – albeit that is a stretch, knowing the diversity of European jurisdictions. Please note that familiarity with basic terms of copyright law is assumed.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Ancient UNIX&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;The term “Ancient UNIX” refers to the versions of UNIX up to and including Seventh Edition UNIX (1979) including the 32V port to the VAX. Ancient UNIX was created at Bell Laboratories, a subsidiary of AT&amp;amp;T at the time. It was later transferred of the AT&amp;amp;T UNIX Support Group, then AT&amp;amp;T Information Systems and finally the AT&amp;amp;T subsidiary UNIX System Laboratories, Inc. (USL). The legal situation differs between the United States of America and Germany.
In a ruling as part of the UNIX System Laboratories, Inc. v. Berkeley Software Design, Inc. (USL v. BSDi) case, a U.S. court found that USL had no copyright to the Seventh Edition UNIX system and 32V – arguably, by extension, all earlier versions of Ancient UNIX as well – because USL/AT&amp;amp;T had failed to affix copyright notices and could not demonstrate a trade secret. Due to the obsessive tendency of U.S. courts to consider themselves bound to precedents (cf. the infamous Pierson v. Post case), it can be reasonably expected that this ruling would be honored and applied in subsequent cases. Thus under U.S. law, Ancient UNIX can be safely assumed to belong in the public domain.
The situation differs in Germany. Unlike the U.S., copyright never needed registration in order to exist. Computer programs are works in the sense of the German 1965 Act on Copyright and Related Rights (Copyright Act, henceforth CopyA) as per CopyA § 2(1) no. 1. Even prior to the amendment of CopyA § 2(1) to include computer programs, computer programs have been recognized as copyrightable works by the German Supreme Court (BGHZ 112, 264 Betriebssystem, no. 19); CopyA § 137d(1) rightly clarifies that. The copyright holder at 1979 would still have been USL via Bell Labs and AT&amp;amp;T. Copyright of computer programs is transferred to the employer upon creation under CopyA § 69(1).
Note that this does not affect expiry (Daniel Kaboth/Benjamin Spies, commentary on CopyA §§ 69a‒69g, in: Hartwig Ahlberg/Horst-Peter Götting (eds.), Urheberrecht: UrhG, KUG, VerlG, VGG, Kommentar, 4th ed., C. H. Beck, 2018, no. 16 ad CopyA § 69b; cf. Bundestag-Drucksache [BT-Drs.] 12/4022, p. 10). Expiry occurs 70 years after the death of the (co-)author that died most recently as per CopyA § 65(1) and 64; this has been the case since at least the 1960s, meaning there is no way for copyright to have expired already (old version, as per Bundesgesetzblatt Part I No. 51 of September 16, 1965, pp. 1273‒1294).
In Germany, private international law applies the so-called “Territorialitätsprinzip” for intellectual property rights. This means that the effect of an intellectual property right is limited to the territory of a state (Anne Lauber-Rönsberg, KollisionsR, in: Hartwig Ahlberg/Horst-Peter Götting (eds.), ibid., pp. 2241 et seqq., no. 4). Additionally, the “Schutzlandprinzip” applies; this means that protection of intellectual property follows the lex loci protectionis, i.e. the law of the country for which protection is sought (BGH GRUR 2015, 264 HiHotel II, no. 25; BGH GRUR 2003, 328 Sender Felsberg, no. 24), albeit this is criticized in parts of doctrine (Lauber-Rönsberg, ibid., no. 10). The “Schutzlandprinzip” requires that the existence of an intellectual property right be verified as well (BGH ZUM 2016, 522 Wagenfeld-Leuchte II, no. 19).
Thus, in Germany, copyright on Ancient UNIX is still alive and well. Who has it, though? A ruling by the U.S. Court of Appeals, Tenth Circuit, in the case of The SCO Group, Inc. v. Novell, Inc. (SCO v. Novell) in the U.S. made clear that Novell owns the rights to System V – thus presumably UNIX System III as well – and Ancient UNIX, though SCO acquired enough rights to develop UnixWare/OpenServer (Ruling 10-4122 [D.C. No. 2:04-CV-00139-TS], pp. 19 et seq.). Novell itself was purchased by the Attachmate Group, which was in turn acquired by the COBOL vendor Micro Focus. Therefore, the rights to SVRX and – outside the U.S. – are with Micro Focus right now. If all you care about is the U.S., you can stop reading about Ancient UNIX here.
So how does the Caldera license factor into all of this? For some context, the license was issued January 23, 2002 and covers Ancient UNIX (V1 through V7 including 32V), specifically excluding System III and System V. Caldera, Inc. was founded in 1994. The Santa Cruz Operation, Inc. sold its rights to UNIX to Caldera in 2001, renamed itself to Tarantella Inc. and Caldera renamed itself The SCO Group. Nemo plus iuris ad alium transferre potest quam ipse habet; no one can transfer more rights than he has. The question now becomes whether Caldera had the rights to issue the Caldera license.
I’ve noted it above but it needs restating: Foreign decisions are not necessarily accepted in Germany due to the “Territorialitätsprinzip” and “Schutzlandprinzip” – however, I will be citing a U.S. ruling for its assessment of the facts for the sake of simplicity. As per ruling 10-4122, “The district court found the parties intended for SCO to serve as Novell’s agent with respect to the old SVRX licenses and the only portion of the UNIX business transferred outright under the APA [asset purchase agreement] was the ability to exploit and further develop the newer UnixWare system. SCO was able to protect that business because it was able to copyright its own improvements to the system. The only reason to protect the earlier UNIX code would be to protect the existing SVRX licenses, and the court concluded Novell retained ultimate control over that portion of the business under the APA.” The relevant agreements consist of multiple pieces:
the base Asset Purchase Agreement “APA” (Part I)
the base Asset Purchase Agreement “APA” (Part II)
the Operating Agremeent and Amendment 1 to the APA
the Amendment 2 to the APA
The APA dates September 19, 1995, from before the Caldera license. Caldera cannot possibly have acquired rights that The Santa Cruz Operation, Inc. itself never had. Furthermore, I’ve failed to find any mention of Ancient UNIX; all that is transferred is rights to SVRX. Overall, I believe that the U.S. courts’ assesment of the facts represents the situation accurately. Thus for all intents and purposes, UNIX up to and including System V remained with Novell/Attachmate/Micro Focus. Caldera therefore never had any rights to Ancient UNIX, which means it never had the rights to issue the Caldera license. The Caldera license is null and void – in the U.S. because the copyright has been lost due to formalities, everywhere else because Caldera never had the rights to issue it.
The first step to truly freeing UNIX would this be to get Micro Focus to re-issue the Caldera license for Ancient UNIX, ideally it would now also include System III and System V.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;BSD/OS&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;Another operating system near UNIX is of interest. The USL v. BSDi lawsuit includes two parties: USL, which we have seen above, and Berkeley Software Design, Inc. BSDi sold BSD/386 (later BSD/OS), which was a derivative of 4.4BSD. The software parts of the BSDi company were acquired by Wind River Systems, whereas the hardware parts went to iXsystems. Copyright is not disputed there, though Wind River Systems ceased selling BSD/OS products 15 years ago, in 2003. In addition, Wind River System let their trademark on BSD expire, though this is without consequence for copyright.
BSD/OS is notable in the sense that it powered much of early internet infrastructure. Traces of its legacy can still be found on Richard Stevens’ FAQ.
To truly make UNIX history free, BSD/OS would arguably also need to see a source code release. BSD/OS at least in its earliest releases under BSDi would ship with source code, though under a non-free license, far from BSD or even GPL licensing.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;System V&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;The fate of System V as a whole is difficult to determine. Various licenses have been granted to a number of vendors (Dell UNIX comes to mind; HP for HP-UX, IBM for AIX, SGI UNIX, etc.). Sun released OpenSolaris – notoriously, Oracle closed the source to Solaris again after its release –, which is a System V Release 4 descendant. However, this means nothing for the copyright or licensing status of System V itself. Presumably, the rights with System V still remain with Novell (now Micro Focus): SCO managed to sublicense rights to develop and sell UnixWare/OpenServer, themselves System V/III descendants, to unXis, Inc. (now known as Xinuos, Inc.), which implies that Xinuos is not the copyright holder of System V.
Obviously, to free UNIX, System V and its entire family of descendants would also need to be open sourced. However, I expect tremendous resistance on part of all the companies mentioned. As noted in the “Ancient UNIX” section, Micro Focus alone would probably be sufficient to release System V, though this would mean nothing for the other commercial System V derivatives.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Newer Research UNIX&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;The fate of Bell Labs would be a different one; it would go on to be purchased by Lucent, now part of Nokia. After commercial UNIX got separated out to USL, Research UNIX would continue to exist inside of Bell Labs. Research UNIX V8, V9 and V10 were not quite released by Alcatel-Lucent USA Inc. and Nokia in 2017.
However, this is merely a notice that the companies involved will not assert their copyrights only with respect to any non-commercial usage of the code. It is still not possible, over 30 years later, to freely use the V8 code.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Conclusion
In the U.S., Ancient UNIX is freely available. People located everywhere else, however, are unable to legally obtain UNIX code for any of the systems mentioned above. The exception being BSD/OS, assuming a purchase of a legitimate copy of the source code CD. This is deeply unsatisfying and I implore all involved companies to consider open sourcing (preferably under a BSD-style license) their code older than a decade, if nothing else, then at least for the sake of historical purposes. I would like to encourage everybody reading this to consider reaching out to Micro Focus and Wind River Systems about System V and BSD/OS, respectively. Perhaps the masses can change their minds.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;A small note about patents: Some technologies used in newer iterations of the UNIX system (in particular the System V derivatives) may be encumbered with software patents. An open source license will not help against patent infringement claims. However, the patents on anything used in the historical operating systems will certainly have expired by now. In addition, European readers can ignore this entirely – software patents just aren’t a thing.&lt;/blockquote&gt;

&lt;hr&gt;
&lt;a href="https://labs.ripe.net/Members/claudio_jeker/openbgpd-adding-diversity-to-route-server-landscape"&gt;OpenBGPD - Adding Diversity to the Route Server Landscape&lt;/a&gt;
&lt;ul&gt;
    &lt;li&gt;Introduction&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;As of last year, there was effectively only a single solution in the Route Server vendor market: the BIRD Internet routing daemon. &lt;a href="http://NIC.CZ"&gt;NIC.CZ&lt;/a&gt; (the organisation developing BIRD) has done fantastic work on maintaining their BGP-4 implementation, however, it’s not healthy to have virtually every Internet Exchange Point (IXP) in the RIPE NCC service region depend on a single open source project. The current situation can be compared to the state of the DNS root nameservers back in 2002 - their dependence on the BIND nameserver daemon and the resulting development of NSD as an alternative by NLnet, in cooperation with the RIPE NCC.
OpenBGPD used to be one of the most popular Route Server implementations until the early 2010s. OpenBGPD’s main problem was that its performance couldn’t keep up with the Internet’s growth, so it lost market share. An analysis by Job Snijders suggested that a modernised OpenBGPD distribution would be a most viable option to regain diversity on the Route Server level.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Missing features in OpenBGPD&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;The following main missing features were identified in OpenBGPD:&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Performance&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;In previous versions of OpenBGPD, the filtering performance didn’t allow proper filtering of all EBGP sessions. Current best practice at IXP Route Servers is to carefully evaluate and validate of all routes learned from EBGP peers. The OpenBGPD ruleset required to do correct filtering (in many deployment scenarios) was simply too lengthy - and negatively impacted service performance during configuration reloads. While filtering performance is the biggest bottleneck, general improvements to the Routing Information Base were also made to improve scalability. IXP Route Servers with a few hundred peering sessions are commonplace and adding new sessions shouldn’t impact the Route Servers’ service to other peers. We found that performance was the most pressing issue that needed to be tackled.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Lack of RPKI Origin Validation&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;As we’ve seen, Internet operators are moving to adopt RPKI based BGP Origin Validation. While it was theoretically possible to emulate RFC 6811-style Origin Validation in previous versions of OpenBGPD, the required configuration wasn’t optimised for performance and wasn’t user friendly. We believe that BGP Origin Validation should be as easy as possible - this requires BGP-4 vendors to implement native, optimised routines for Origin Validation. Of course, enabling Origin Validation shouldn’t have an impact on performance either when processing BGP updates or when updating the Route Origin Authorisation (ROA) table itself.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Portability&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;OpenBGPD is an integral part of OpenBSD, but IXPs may prefer to run their services infrastructure on an operating system of their choice. Making sure that there’s a portable OpenBGPD version which follows the OpenBSD project release cycle will give IXPs this option.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Development steps&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;By addressing the issues mentioned above, we could bring back OpenBGPD as a viable Route Server implementation.
Since I was one of the core OpenBGPD developers, I was asked if I wanted to pick up this project again. Thanks to the funding from the RIPE NCC Project Fund, this was possible. Starting in June 2018, I worked full time on this important community project. Over the last few months, many of the problems are already addressed and are now part of the OpenBSD 6.4 release. So far, 154 commits were made to OpenBGPD during the 6.4 development cycle - around 8% of all commits ever to OpenBGPD! This shows that due to funding and dedicated resources, a lot of work could be pushed into the latest release of OpenBGPD.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;OpenBGPD 6.4&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;The OpenBGPD version, as part of OpenBSD 6.4 release, demonstrates great progress. Even though there have been many changes to the core of OpenBGPD, the released version is as solid and reliable as previous releases and the many bug fixes and improvements make this the best OpenBGPD release so far. The changes in the filter language allow users to write more efficient rulesets while the introduction of RPKI origination validation fixes an important missing feature. For IXPs, OpenBGPD now is an alternative again. There are still open issues, but the gap is closing!&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Feature highlights&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;The following changes should be highlighted:&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Introduction of background soft-reconfiguration on config reload. Running the soft-reconfiguration task in the background allows for new updates and withdraws to be processed at the same time. This improves convergence time - one of the key metrics for Route Servers.&lt;/li&gt;
    &lt;li&gt;BGP Origin Validation when a roa-set is configured Every EBGP route announcement is validated against the locally configured VRP table entries. Depending on the validation process’s outcome, the validation state is set to valid, invalid or not found. The filter language has been extended to allow checking for the origin validation state, and thanks to this, it is possible to deny invalid prefixes or regard valid prefixes different to the ones that aren’t found. The roa-set table is read from the configuration file and updated during configuration reloads. On production systems reloading the roa-set and applying it to all prefixes is done in a couple of seconds.&lt;/li&gt;
    &lt;li&gt;Fast prefix-set lookups In OpenBSD 6.3 prefix-sets got introduced in OpenBGPD. A prefix-set combines many prefix lookups into a single filter rule. The original implementation wasn’t optimised but now a fast trie lookup is used. Thanks to this, large IRR DB prefix tables can now be implemented efficiently.&lt;/li&gt;
    &lt;li&gt;Introduction of as-sets Similar to prefix-sets, as-sets help group many AS numbers into a single lookup. Thanks to this, large IRR DB origin AS tables can be implemented efficiently.
Introduction of origin-sets&lt;/li&gt;
    &lt;li&gt;Looking at the configurations of Route Servers doing full filtering, it was noticed that a common lookup was binding a prefix to an origin AS - similar to how a roa-set is used for RPKI. These origin-set tables are used to extend the IRR prefix lookup and generated from alternative sources.&lt;/li&gt;
    &lt;li&gt;Improving third party tools&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;Users can only benefit from the changes introduced in OpenBGPD 6.4 when the surrounding 3rd party tools are adjusted accordingly. Two opensource projects such as bgpq3 and arouteserver are frequently used by network operators and IXPs to generate BGP configurations. Thanks to our contributions to those projects, we were able to get them ready for all the new features in OpenBGPD.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;bgpq3 was extended to create as-set and prefix-set tables based on IRR DB entries. This is replacing the old way of doing the same with a large amount of filter rules. Thanks to the quick response from the bgpq3 maintainer, it was possible to ship OpenBSD 6.4 with a bgpq3 package that includes all the new features.&lt;/li&gt;
    &lt;li&gt;arouteserver was adjusted to implement RPKI roa-set, as-set, prefix-set, and origin-set to generate a much better-performing configurations for the 6.4 version. With the v0.20.0 release of arouteserver, IXPs are able to generate an OpenBGPD configuration which is a ton faster but also implements the new functionalities. Looking at YYCIX (the resident IXP in Calgary, Canada) the ruleset generated by arouteserver was reduced from 370,000 rules to well under 6,000 rules. This resulted in the initial convergence time dropping from over 1 hour to less than 2 minutes, and subsequent configuration reloads are hitless and no longer noticeable.&lt;/li&gt;
    &lt;li&gt;What still needs to be done&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;A sizeable chunk of work still left on the table is the rework of the RIB data structures in OpenBGPD - these haven’t been changed since the initial design of OpenBGPD in 2003. There’s currently ongoing work (in small steps, to avoid jeopardising the stability of OpenBGPD) to modernise these data-structures. The goal is to provide better decoupling of the filter step from storing RIB database changes, to pave the way to multi-threaded operations at a later point.&lt;/blockquote&gt;
&lt;ul&gt;
    &lt;li&gt;Looking forward&lt;/li&gt;
    &lt;li&gt;Job Snijders oversaw this year’s fundraising and project management, he adds:&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;It’s been incredibly productive to create an environment where a core developer is allowed to work full time on the OpenBGPD code base. However, it’s important to note there still is room for a number of new features to help improve its operational capabilities (such as BMP, RFC 7313, ADD_PATH, etc). It’d be beneficial to the Internet community at large if we can extend Claudio Jeker’s involvement for another year. Open source software doesn’t grow on trees! Strategic investments are the only way to keep OpenBGPD’s roadmap aligned with Internet growth and operator requirements.&lt;/blockquote&gt;

&lt;hr&gt;
Beastie Bits
&lt;ul&gt;
    &lt;li&gt;&lt;a href="http://lists.dragonflybsd.org/pipermail/commits/2018-November/718130.html"&gt;DragonFly - git: annotated tag v5.5.0 created&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=Qvj7Mkr13d8"&gt;Torchlight 2 on NetBSD&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://www.usenix.org/system/files/login/articles/login_dec14_03_dawidek.pdf"&gt;Older, but still good USENIX Login Article on Capsicum&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://github.com/myfreeweb/capsicumizer"&gt;The Super Capsicumizer 9000&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://www.noc-ps.com/"&gt;Dedicated and Virtual Server PXE provisioning tool&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://cirrus-ci.org/guide/FreeBSD/"&gt;Cirrus CI have announced FreeBSD support&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="https://twitter.com/astr0baby/status/1065353771952336897"&gt;NetBSD PineBook Gameplay&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;&lt;a href="http://www.bsdcan.org/2019/papers.php"&gt;BSDCan 2019 CfP is out&lt;/a&gt;&lt;/li&gt;
    &lt;li&gt;Allan’s first ZFS array, Zulu, turned 7 years old on Nov 29th&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
Feedback/Questions
&lt;ul&gt;
    &lt;li&gt;Malcom - &lt;a href="http://dpaste.com/35TNNX4"&gt;Installing Drivers in Development&lt;/a&gt;
&lt;/li&gt;
    &lt;li&gt;Samir - &lt;a href="http://dpaste.com/2RCB37Y#wrap"&gt;Introduction to ZFS&lt;/a&gt;
&lt;/li&gt;
    &lt;li&gt;Newnix - &lt;a href="http://dpaste.com/01YJ4EB#wrap"&gt;Drive Failures&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
    &lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, Gopher, Linux VFIO, OpenBGPD, Capsicum, Pinebook</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>DragonflyBSD 5.4 has been released, down the Gopher hole with OpenBSD, OpenBSD in stereo with VFIO, BSD/OS the best candidate for legally tested open source Unix, OpenBGPD adds diversity to the routing server landscape, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.dragonflybsd.org/release54/">DragonflyBSD 5.4 released</a></h3>

<blockquote>DragonFly version 5.4 brings a new system compiler in GCC 8, improved NUMA support, a large of number network and virtual machine driver updates, and updates to video support. This release is 64-bit only, as with previous releases.
The details of all commits between the 5.2 and 5.4 branches are available in the associated commit messages for 5.4.0rc and 5.4.0.</blockquote>

<ul>
    <li>Big-ticket items</li>
    <li>Much better support for asymmetric NUMA (Non-Uniform Memory Access) configurations. In particular, both the memory subsystem and the scheduler now understand the Threadripper 2990WX’s architecture. The scheduler will prioritize CPU nodes with direct-attached memory and the memory subsystem will normalize memory queues for CPU nodes without direct-attached memory (which improves cache locality on those CPUs).</li>
    <li>Incremental performance work. DragonFly as a whole is very SMP friendly. The type of performance work we are doing now mostly revolves around improving fairness for shared-vs-exclusive lock clashes, reducing cache ping-ponging due to non-contending SMP locks (i.e. massive use of shared locks on shared resources), and so forth.</li>
    <li>Major updates to dports brings us to within a week or two of FreeBSD’s ports as of this writing, in particular major updates to chromium, and making the whole mess work with gcc-8.</li>
    <li>Major rewriting of the tty clist code and the tty locking code, significantly improving concurrency across multiple ttys and ptys.</li>
    <li>GCC 8</li>
    <li>DragonFly now ships with GCC 8.0, and runs as the default compiler. It is also now used for building dports.</li>
    <li>GCC 4.7.4 and GCC 5.4.1 are still installed. 4.7.4 is our backup compiler, and 5.4.1 is still there to ensure a smooth transition, but should generally not be used. buildworld builds all three by default to ensure maximum compatibility.</li>
    <li>Many passes through world sources were made to address various warnings and errors the new GCC brought with it.</li>
    <li>HAMMER2</li>
    <li>HAMMER2 is recommended as the default root filesystem in non-clustered mode.</li>
    <li>Clustered support is not yet available.</li>
    <li>Increased bulkfree cache to reduce the number of iterations required.</li>
    <li>Fixed numerous bugs.</li>
    <li>Improved support on low-memory machines.</li>
    <li>Significant pre-work on the XOP API to help support future networked operations.</li>
    <li>Details</li>
    <li>Checksums
<code>MD5 (dfly-x86_64-5.4.0_REL.img) = 7277d7cffc92837c7d1c5dd11a11b98f</code>
<code>MD5 (dfly-x86_64-5.4.0_REL.iso) = 6da7abf036fe9267479837b3c3078408</code>
<code>MD5 (dfly-x86_64-5.4.0_REL.img.bz2) = a77a072c864f4b72fd56b4250c983ff1</code>
<code>MD5 (dfly-x86_64-5.4.0_REL.iso.bz2) = 4dbfec6ccfc1d59c5049455db914d499</code></li>
    <li>Downloads Links</li>
</ul>

<blockquote>DragonFly BSD is 64-bit only, as announced during the 3.8 release.</blockquote>

<ul>
    <li>USB: dfly-x86_64-5.4.0_REL.img as bzip2 file</li>
    <li>ISO: dfly-x86_64-5.4.0_REL.iso as bzip2 file</li>
    <li>Uncompressed ISO: dfly-x86_64-5.4.0_REL.iso (For use with VPS providers as an install image.)</li>
</ul>

<p><hr /></p>

<h3><a href="https://cryogenix.net/gophernicus.html">Down the Gopher hole with OpenBSD, Gophernicus, and TLS</a></h3>

<blockquote>In the early 2000s I thought I had seen the worst of the web - Java applets, Macromedia (&gt;Adobe) Flash, animated GIFs, javascript snow that kept you warm in the winter by burning out your CPU, and so on. For a time we learned from these mistakes, and started putting the burden on the server-side - then with improvements in javascript engines we started abusing it again with JSON/AJAX and it all went down hill from there.</blockquote>

<blockquote>Like cloud computing, blockchains, machine learning and a tonne of other a la mode technologies around today - most users and service providers don’t need websites that consume 1GB of memory processing JS and downloading 50MB of compressed data just to read Alice’s one-page travel blog or Bob’s notes on porting NetBSD to his blood-pressure monitor.</blockquote>

<blockquote>Before the HTTP web we relied on Prestel/Minitel style systems, BBS systems, and arguably the most accessible of all - Gopher! Gopher was similar to the locally accessed AmigaGuide format, in that it allowed users to search and retrieve documents interactively, with links and cross-references. Its efficiency and distraction-free nature make it attractive to those who are tired of the invasive, clickbait, ad-filled, javascript-laden web2/3.x. But enough complaining and evangelism - here’s how to get your own Gopher Hole!</blockquote>

<blockquote>Gophernicus is a modern gopher daemon which aims to be secure (although it still uses inetd -_-); it’s even in OpenBSD ports so at least we can rely on it to be reasonably audited.</blockquote>

<blockquote>If you need a starting point with Gopher, SDF-EU’s wiki has a good article here.</blockquote>

<ul>
    <li><a href="https://sdfeu.org/w/tutorials:gopher">https://sdfeu.org/w/tutorials:gopher</a></li>
</ul>

<blockquote>Finally, if you don’t like gopher(1) - there’s always lynx(1) or NCSA Mosaic!</blockquote>

<ul>
    <li><a href="https://cryogenix.net/NCSA_Mosaic_OpenBSD.html">https://cryogenix.net/NCSA_Mosaic_OpenBSD.html</a></li>
</ul>

<blockquote>I’ve added TLS support to Gophernicus so you don’t need to use stunnel anymore. The code is ugly and unpolished though so I wouldn’t recommend for production use.</blockquote>

<ul>
    <li><a href="https://github.com/0x16h/gophernicus">https://github.com/0x16h/gophernicus</a></li>
    <li><a href="https://github.com/0x16h/gophernicus/blob/master/INSTALL.openbsd">https://github.com/0x16h/gophernicus/blob/master/INSTALL.openbsd</a></li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2018/11/12/vfio">OpenBSD in Stereo with Linux VFIO</a></h3>

<blockquote>I use a Huawei Matebook X as my primary OpenBSD laptop and one aspect of its hardware support has always been lacking: audio never played out of the right-side speaker. The speaker did actually work, but only in Windows and only after the Realtek Dolby Atmos audio driver from Huawei was installed. Under OpenBSD and Linux, and even Windows with the default Intel sound driver, audio only ever played out of the left speaker.
Now, after some extensive reverse engineering and debugging with the help of VFIO on Linux, I finally have audio playing out of both speakers on OpenBSD.</blockquote>

<ul>
    <li>VFIO</li>
</ul>

<blockquote>The Linux kernel has functionality called VFIO which enables direct access to a physical device (like a PCI card) from userspace, usually passing it to an emulator like QEMU.
To my surprise, these days, it seems to be primarily by gamers who boot Linux, then use QEMU to run a game in Windows and use VFIO to pass the computer’s GPU device through to Windows.
By using Linux and VFIO, I was able to boot Windows 10 inside of QEMU and pass my laptop’s PCI audio device through to Windows, allowing the Realtek audio drivers to natively control the audio device. Combined with QEMU’s tracing functionality, I was able to get a log of all PCI I/O between Windows and the PCI audio device.</blockquote>

<ul>
    <li>Using VFIO</li>
</ul>

<blockquote>To use VFIO to pass-through a PCI device, it first needs to be stubbed out so the Linux kernel’s default drivers don’t attach to it. GRUB can be configured to instruct the kernel to ignore the PCI audio device (8086:9d71) and explicitly enable the Intel IOMMU driver by adding the following to /etc/default/grub and running update-grub
With the audio device stubbed out, a new VFIO device can be created from it
Then the VFIO device (00:1f.3) can be passed to QEMU
I was using my own build of QEMU for this, due to some custom logging I needed (more on that later), but the default QEMU package should work fine. The events.txt was a file of all VFIO events I wanted logged (which was all of them).
Since I was frequently killing QEMU and restarting it, Windows 10 wanted to go through its unexpected shutdown routine each time (and would sometimes just fail to boot again). To avoid this and to get a consistent set of logs each time, I used qemu-img to take a snapshot of a base image first, then boot QEMU with that snapshot. The snapshot just gets thrown away the next time qemu-img is run and Windows always starts from a consistent state.
QEMU will now log each VFIO event which gets saved to a debug-output file.
With a full log of all PCI I/O activity from Windows, I compared it to the output from OpenBSD and tried to find the magic register writes that enabled the second speaker. After days of combing through the logs and annotating them by looking up hex values in the documentation, diffing runtime register values, and even brute-forcing it by mechanically duplicating all PCI I/O activity in the OpenBSD driver, nothing would activate the right speaker.
One strange thing that I noticed was if I booted Windows 10 in QEMU and it activated the speaker, then booted OpenBSD in QEMU without resetting the PCI device’s power in-between (as a normal system reboot would do), both speakers worked in OpenBSD and the configuration that the HDA controller presented was different, even without any changes in OpenBSD.</blockquote>

<blockquote>A Primer on Intel HDA
Most modern computers with integrated sound chips use an Intel High Definition Audio (HDA) Controller device, with one or more codecs (like the Realtek ALC269) hanging off of it. These codecs do the actual audio processing and communicate with DACs and ADCs to send digital audio to the connected speakers, or read analog audio from a microphone and convert it to a digital input stream. In my Huawei Matebook X, this is done through a Realtek ALC298 codec.
On OpenBSD, these HDA controllers are supported by the azalia(4) driver, with all of the per-codec details in the lengthy azalia_codec.c file. This file has grown quite large with lots of codec- and machine-specific quirks to route things properly, toggle various GPIO pins, and unmute speakers that are for some reason muted by default.
The azalia driver talks to the HDA controller and sets up various buffers and then walks the list of codecs. Each codec supports a number of widget nodes which can be interconnected in various ways. Some of these nodes can be reconfigured on the fly to do things like turning a microphone port into a headphone port.
The newer Huawei Matebook X Pro released a few months ago is also plagued with this speaker problem, although it has four speakers and only two work by default. A fix is being proposed for the Linux kernel which just reconfigures those widget pins in the Intel HDA driver. Unfortunately no pin reconfiguration is enough to fix my Matebook X with its two speakers.
While reading more documentation on the HDA, I realized there was a lot more activity going on than I was able to see through the PCI tracing.
For speed and efficiency, HDA controllers use a DMA engine to transfer audio streams as well as the commands from the OS driver to the codecs. In the output above, the CORBWP=0; size=256 and RIRBRP=0, size=256 indicate the setup of the CORB (Command Output Ring Buffer) and RIRB (Response Input Ring Buffer) each with 256 entries. The HDA driver allocates a DMA address and then writes it to the two CORBLBASE and CORBUBASE registers, and again for the RIRB.
When the driver wants to send a command to a codec, such as CORB_GET_PARAMETER with a parameter of COP_VOLUME_KNOB_CAPABILITIES, it encodes the codec address, the node index, the command verb, and the parameter, and then writes that value to the CORB ring at the address it set up with the controller at initialization time (CORBLBASE/CORBUBASE) plus the offset of the ring index. Once the command is on the ring, it does a PCI write to the CORBWP register, advancing it by one. This lets the controller know a new command is queued, which it then acts on and writes the response value on the RIRB ring at the same position as the command (but at the RIRB’s DMA address). It then generates an interrupt, telling the driver to read the new RIRBWP value and process the new results.
Since the actual command contents and responses are handled through DMA writes and reads, these important values weren’t showing up in the VFIO PCI trace output that I had gathered. Time to hack QEMU.</blockquote>

<ul>
    <li>Logging DMA Memory Values in QEMU</li>
</ul>

<blockquote>Since DMA activity wouldn’t show up through QEMU’s VFIO tracing and I obviously couldn’t get Windows to dump these values like I could in OpenBSD, I could make QEMU recognize the PCI write to the CORBWP register as an indication that a command has just been written to the CORB ring.
My custom hack in QEMU adds some HDA awareness to remember the CORB and RIRB DMA addresses as they get programmed in the controller. Then any time a PCI write to the CORBWP register is done, QEMU fetches the new CORB command from DMA memory, decodes it into the codec address, node address, command, and parameter, and prints it out. When a PCI read of the RIRBWP register is requested, QEMU reads the response and prints the corresponding CORB command that it stored earlier.
With this hack in place, I now had a full log of all CORB commands and RIRB responses sent to and read from the codec:
An early version of this patch left me stumped for a few days because, even after submitting all of the same CORB commands in OpenBSD, the second speaker still didn’t work. It wasn’t until re-reading the HDA spec that I realized the Windows driver was submitting more than one command at a time, writing multiple CORB entries and writing a CORBWP value that was advanced by two. This required turning my CORB/RIRB reading into a for loop, reading each new command and response between the new CORBWP/RIRBWP value and the one previously seen.
Sure enough, the magic commands to enable the second speaker were sent in these periods where it submitted more than one command at a time.</blockquote>

<ul>
    <li>Minimizing the Magic</li>
</ul>

<blockquote>The full log of VFIO PCI activity from the Windows driver was over 65,000 lines and contained 3,150 CORB commands, which is a lot to sort through. It took me a couple more days to reduce that down to a small subset that was actually required to activate the second speaker, and that could only be done through trial and error:</blockquote>

<ul>
    <li>Boot OpenBSD with the full list of CORB commands in the azalia driver</li>
    <li>Comment out a group of them</li>
    <li>Compile kernel and install it, halt the QEMU guest</li>
    <li>Suspend and wake the laptop, resetting PCI power to the audio device to reset the speaker/Dolby initialization and ensure the previous run isn’t influencing the current test (I’m guessing there is an easier to way to reset PCI power than suspending the laptop, but oh well)</li>
    <li>Start QEMU, boot OpenBSD with the new kernel</li>
    <li>Play an MP3 with mpg123 which has alternating left- and right-channel audio and listen for both channels to play</li>
</ul>

<blockquote>This required a dozen or so iterations because sometimes I’d comment out too many commands and the right speaker would stop working. Other times the combination of commands would hang the controller and it wouldn’t process any further commands. At one point the combination of commands actually flipped the channels around so the right channel audio was playing through the left speaker.</blockquote>

<ul>
    <li>The Result</li>
</ul>

<blockquote>After about a week of this routine, I ended up with a list of 662 CORB commands that are needed to get the second speaker working. Based on the number of repeated-but-slightly-different values written with the 0x500 and 0x400 commands, I’m guessing this is some kind of training data and that this is doing the full Dolby/Atmos system initialization, not just turning on the second speaker, but I could be completely wrong.
In any case, the stereo sound from OpenBSD is wonderful now and I can finally stop downmixing everything to mono to play from the left speaker. In case you ever need to do this, sndiod can be run with -c 0:0 to reduce the channels to one.
Due to the massive size of the code needed for this quirk, I’m not sure if I’ll be committing it upstream in OpenBSD or just saving it for my own tree. But at least now the hardware support chart for my Matebook is all yeses for the things I care about.
I’ve also updated the Linux bug report that I opened before venturing down this path, hoping one of the maintainers of that HDA code that works at Intel or Realtek knew of a solution I could just port to OpenBSD. I’m curious to see what they’ll do with it.</blockquote>

<p><hr /></p>

<h3><a href="https://virtuallyfun.com/wordpress/2018/11/26/why-bsd-os-is-the-best-candidate-for-being-the-only-tested-legally-open-unix/">Why BSD/OS is the best candidate for being the only tested legally open UNIX</a></h3>

<ul>
    <li>Introduction</li>
</ul>

<blockquote>The UNIX® system is an old operating system, possibly older than many of the readers of this post. However, despite its age, it still has not been open sourced completely. In this post, I will try to detail which parts of which UNIX systems have not yet been open sourced. I will focus on the legal situation in Germany in particular, taking it representative of European law in general – albeit that is a stretch, knowing the diversity of European jurisdictions. Please note that familiarity with basic terms of copyright law is assumed.</blockquote>

<ul>
    <li>Ancient UNIX</li>
</ul>

<blockquote>The term “Ancient UNIX” refers to the versions of UNIX up to and including Seventh Edition UNIX (1979) including the 32V port to the VAX. Ancient UNIX was created at Bell Laboratories, a subsidiary of AT&amp;T at the time. It was later transferred of the AT&amp;T UNIX Support Group, then AT&amp;T Information Systems and finally the AT&amp;T subsidiary UNIX System Laboratories, Inc. (USL). The legal situation differs between the United States of America and Germany.
In a ruling as part of the UNIX System Laboratories, Inc. v. Berkeley Software Design, Inc. (USL v. BSDi) case, a U.S. court found that USL had no copyright to the Seventh Edition UNIX system and 32V – arguably, by extension, all earlier versions of Ancient UNIX as well – because USL/AT&amp;T had failed to affix copyright notices and could not demonstrate a trade secret. Due to the obsessive tendency of U.S. courts to consider themselves bound to precedents (cf. the infamous Pierson v. Post case), it can be reasonably expected that this ruling would be honored and applied in subsequent cases. Thus under U.S. law, Ancient UNIX can be safely assumed to belong in the public domain.
The situation differs in Germany. Unlike the U.S., copyright never needed registration in order to exist. Computer programs are works in the sense of the German 1965 Act on Copyright and Related Rights (Copyright Act, henceforth CopyA) as per CopyA § 2(1) no. 1. Even prior to the amendment of CopyA § 2(1) to include computer programs, computer programs have been recognized as copyrightable works by the German Supreme Court (BGHZ 112, 264 Betriebssystem, no. 19); CopyA § 137d(1) rightly clarifies that. The copyright holder at 1979 would still have been USL via Bell Labs and AT&amp;T. Copyright of computer programs is transferred to the employer upon creation under CopyA § 69(1).
Note that this does not affect expiry (Daniel Kaboth/Benjamin Spies, commentary on CopyA §§ 69a‒69g, in: Hartwig Ahlberg/Horst-Peter Götting (eds.), Urheberrecht: UrhG, KUG, VerlG, VGG, Kommentar, 4th ed., C. H. Beck, 2018, no. 16 ad CopyA § 69b; cf. Bundestag-Drucksache [BT-Drs.] 12/4022, p. 10). Expiry occurs 70 years after the death of the (co-)author that died most recently as per CopyA § 65(1) and 64; this has been the case since at least the 1960s, meaning there is no way for copyright to have expired already (old version, as per Bundesgesetzblatt Part I No. 51 of September 16, 1965, pp. 1273‒1294).
In Germany, private international law applies the so-called “Territorialitätsprinzip” for intellectual property rights. This means that the effect of an intellectual property right is limited to the territory of a state (Anne Lauber-Rönsberg, KollisionsR, in: Hartwig Ahlberg/Horst-Peter Götting (eds.), ibid., pp. 2241 et seqq., no. 4). Additionally, the “Schutzlandprinzip” applies; this means that protection of intellectual property follows the lex loci protectionis, i.e. the law of the country for which protection is sought (BGH GRUR 2015, 264 HiHotel II, no. 25; BGH GRUR 2003, 328 Sender Felsberg, no. 24), albeit this is criticized in parts of doctrine (Lauber-Rönsberg, ibid., no. 10). The “Schutzlandprinzip” requires that the existence of an intellectual property right be verified as well (BGH ZUM 2016, 522 Wagenfeld-Leuchte II, no. 19).
Thus, in Germany, copyright on Ancient UNIX is still alive and well. Who has it, though? A ruling by the U.S. Court of Appeals, Tenth Circuit, in the case of The SCO Group, Inc. v. Novell, Inc. (SCO v. Novell) in the U.S. made clear that Novell owns the rights to System V – thus presumably UNIX System III as well – and Ancient UNIX, though SCO acquired enough rights to develop UnixWare/OpenServer (Ruling 10-4122 [D.C. No. 2:04-CV-00139-TS], pp. 19 et seq.). Novell itself was purchased by the Attachmate Group, which was in turn acquired by the COBOL vendor Micro Focus. Therefore, the rights to SVRX and – outside the U.S. – are with Micro Focus right now. If all you care about is the U.S., you can stop reading about Ancient UNIX here.
So how does the Caldera license factor into all of this? For some context, the license was issued January 23, 2002 and covers Ancient UNIX (V1 through V7 including 32V), specifically excluding System III and System V. Caldera, Inc. was founded in 1994. The Santa Cruz Operation, Inc. sold its rights to UNIX to Caldera in 2001, renamed itself to Tarantella Inc. and Caldera renamed itself The SCO Group. Nemo plus iuris ad alium transferre potest quam ipse habet; no one can transfer more rights than he has. The question now becomes whether Caldera had the rights to issue the Caldera license.
I’ve noted it above but it needs restating: Foreign decisions are not necessarily accepted in Germany due to the “Territorialitätsprinzip” and “Schutzlandprinzip” – however, I will be citing a U.S. ruling for its assessment of the facts for the sake of simplicity. As per ruling 10-4122, “The district court found the parties intended for SCO to serve as Novell’s agent with respect to the old SVRX licenses and the only portion of the UNIX business transferred outright under the APA [asset purchase agreement] was the ability to exploit and further develop the newer UnixWare system. SCO was able to protect that business because it was able to copyright its own improvements to the system. The only reason to protect the earlier UNIX code would be to protect the existing SVRX licenses, and the court concluded Novell retained ultimate control over that portion of the business under the APA.” The relevant agreements consist of multiple pieces:
the base Asset Purchase Agreement “APA” (Part I)
the base Asset Purchase Agreement “APA” (Part II)
the Operating Agremeent and Amendment 1 to the APA
the Amendment 2 to the APA
The APA dates September 19, 1995, from before the Caldera license. Caldera cannot possibly have acquired rights that The Santa Cruz Operation, Inc. itself never had. Furthermore, I’ve failed to find any mention of Ancient UNIX; all that is transferred is rights to SVRX. Overall, I believe that the U.S. courts’ assesment of the facts represents the situation accurately. Thus for all intents and purposes, UNIX up to and including System V remained with Novell/Attachmate/Micro Focus. Caldera therefore never had any rights to Ancient UNIX, which means it never had the rights to issue the Caldera license. The Caldera license is null and void – in the U.S. because the copyright has been lost due to formalities, everywhere else because Caldera never had the rights to issue it.
The first step to truly freeing UNIX would this be to get Micro Focus to re-issue the Caldera license for Ancient UNIX, ideally it would now also include System III and System V.</blockquote>

<ul>
    <li>BSD/OS</li>
</ul>

<blockquote>Another operating system near UNIX is of interest. The USL v. BSDi lawsuit includes two parties: USL, which we have seen above, and Berkeley Software Design, Inc. BSDi sold BSD/386 (later BSD/OS), which was a derivative of 4.4BSD. The software parts of the BSDi company were acquired by Wind River Systems, whereas the hardware parts went to iXsystems. Copyright is not disputed there, though Wind River Systems ceased selling BSD/OS products 15 years ago, in 2003. In addition, Wind River System let their trademark on BSD expire, though this is without consequence for copyright.
BSD/OS is notable in the sense that it powered much of early internet infrastructure. Traces of its legacy can still be found on Richard Stevens’ FAQ.
To truly make UNIX history free, BSD/OS would arguably also need to see a source code release. BSD/OS at least in its earliest releases under BSDi would ship with source code, though under a non-free license, far from BSD or even GPL licensing.</blockquote>

<ul>
    <li>System V</li>
</ul>

<blockquote>The fate of System V as a whole is difficult to determine. Various licenses have been granted to a number of vendors (Dell UNIX comes to mind; HP for HP-UX, IBM for AIX, SGI UNIX, etc.). Sun released OpenSolaris – notoriously, Oracle closed the source to Solaris again after its release –, which is a System V Release 4 descendant. However, this means nothing for the copyright or licensing status of System V itself. Presumably, the rights with System V still remain with Novell (now Micro Focus): SCO managed to sublicense rights to develop and sell UnixWare/OpenServer, themselves System V/III descendants, to unXis, Inc. (now known as Xinuos, Inc.), which implies that Xinuos is not the copyright holder of System V.
Obviously, to free UNIX, System V and its entire family of descendants would also need to be open sourced. However, I expect tremendous resistance on part of all the companies mentioned. As noted in the “Ancient UNIX” section, Micro Focus alone would probably be sufficient to release System V, though this would mean nothing for the other commercial System V derivatives.</blockquote>

<ul>
    <li>Newer Research UNIX</li>
</ul>

<blockquote>The fate of Bell Labs would be a different one; it would go on to be purchased by Lucent, now part of Nokia. After commercial UNIX got separated out to USL, Research UNIX would continue to exist inside of Bell Labs. Research UNIX V8, V9 and V10 were not quite released by Alcatel-Lucent USA Inc. and Nokia in 2017.
However, this is merely a notice that the companies involved will not assert their copyrights only with respect to any non-commercial usage of the code. It is still not possible, over 30 years later, to freely use the V8 code.</blockquote>

<ul>
    <li>Conclusion
In the U.S., Ancient UNIX is freely available. People located everywhere else, however, are unable to legally obtain UNIX code for any of the systems mentioned above. The exception being BSD/OS, assuming a purchase of a legitimate copy of the source code CD. This is deeply unsatisfying and I implore all involved companies to consider open sourcing (preferably under a BSD-style license) their code older than a decade, if nothing else, then at least for the sake of historical purposes. I would like to encourage everybody reading this to consider reaching out to Micro Focus and Wind River Systems about System V and BSD/OS, respectively. Perhaps the masses can change their minds.</li>
</ul>

<blockquote>A small note about patents: Some technologies used in newer iterations of the UNIX system (in particular the System V derivatives) may be encumbered with software patents. An open source license will not help against patent infringement claims. However, the patents on anything used in the historical operating systems will certainly have expired by now. In addition, European readers can ignore this entirely – software patents just aren’t a thing.</blockquote>

<p><hr /></p>

<h3><a href="https://labs.ripe.net/Members/claudio_jeker/openbgpd-adding-diversity-to-route-server-landscape">OpenBGPD - Adding Diversity to the Route Server Landscape</a></h3>

<ul>
    <li>Introduction</li>
</ul>

<blockquote>As of last year, there was effectively only a single solution in the Route Server vendor market: the BIRD Internet routing daemon. <a href="http://NIC.CZ">NIC.CZ</a> (the organisation developing BIRD) has done fantastic work on maintaining their BGP-4 implementation, however, it’s not healthy to have virtually every Internet Exchange Point (IXP) in the RIPE NCC service region depend on a single open source project. The current situation can be compared to the state of the DNS root nameservers back in 2002 - their dependence on the BIND nameserver daemon and the resulting development of NSD as an alternative by NLnet, in cooperation with the RIPE NCC.
OpenBGPD used to be one of the most popular Route Server implementations until the early 2010s. OpenBGPD’s main problem was that its performance couldn’t keep up with the Internet’s growth, so it lost market share. An analysis by Job Snijders suggested that a modernised OpenBGPD distribution would be a most viable option to regain diversity on the Route Server level.</blockquote>

<ul>
    <li>Missing features in OpenBGPD</li>
</ul>

<blockquote>The following main missing features were identified in OpenBGPD:</blockquote>

<ul>
    <li>Performance</li>
</ul>

<blockquote>In previous versions of OpenBGPD, the filtering performance didn’t allow proper filtering of all EBGP sessions. Current best practice at IXP Route Servers is to carefully evaluate and validate of all routes learned from EBGP peers. The OpenBGPD ruleset required to do correct filtering (in many deployment scenarios) was simply too lengthy - and negatively impacted service performance during configuration reloads. While filtering performance is the biggest bottleneck, general improvements to the Routing Information Base were also made to improve scalability. IXP Route Servers with a few hundred peering sessions are commonplace and adding new sessions shouldn’t impact the Route Servers’ service to other peers. We found that performance was the most pressing issue that needed to be tackled.</blockquote>

<ul>
    <li>Lack of RPKI Origin Validation</li>
</ul>

<blockquote>As we’ve seen, Internet operators are moving to adopt RPKI based BGP Origin Validation. While it was theoretically possible to emulate RFC 6811-style Origin Validation in previous versions of OpenBGPD, the required configuration wasn’t optimised for performance and wasn’t user friendly. We believe that BGP Origin Validation should be as easy as possible - this requires BGP-4 vendors to implement native, optimised routines for Origin Validation. Of course, enabling Origin Validation shouldn’t have an impact on performance either when processing BGP updates or when updating the Route Origin Authorisation (ROA) table itself.</blockquote>

<ul>
    <li>Portability</li>
</ul>

<blockquote>OpenBGPD is an integral part of OpenBSD, but IXPs may prefer to run their services infrastructure on an operating system of their choice. Making sure that there’s a portable OpenBGPD version which follows the OpenBSD project release cycle will give IXPs this option.</blockquote>

<ul>
    <li>Development steps</li>
</ul>

<blockquote>By addressing the issues mentioned above, we could bring back OpenBGPD as a viable Route Server implementation.
Since I was one of the core OpenBGPD developers, I was asked if I wanted to pick up this project again. Thanks to the funding from the RIPE NCC Project Fund, this was possible. Starting in June 2018, I worked full time on this important community project. Over the last few months, many of the problems are already addressed and are now part of the OpenBSD 6.4 release. So far, 154 commits were made to OpenBGPD during the 6.4 development cycle - around 8% of all commits ever to OpenBGPD! This shows that due to funding and dedicated resources, a lot of work could be pushed into the latest release of OpenBGPD.</blockquote>

<ul>
    <li>OpenBGPD 6.4</li>
</ul>

<blockquote>The OpenBGPD version, as part of OpenBSD 6.4 release, demonstrates great progress. Even though there have been many changes to the core of OpenBGPD, the released version is as solid and reliable as previous releases and the many bug fixes and improvements make this the best OpenBGPD release so far. The changes in the filter language allow users to write more efficient rulesets while the introduction of RPKI origination validation fixes an important missing feature. For IXPs, OpenBGPD now is an alternative again. There are still open issues, but the gap is closing!</blockquote>

<ul>
    <li>Feature highlights</li>
</ul>

<blockquote>The following changes should be highlighted:</blockquote>

<ul>
    <li>Introduction of background soft-reconfiguration on config reload. Running the soft-reconfiguration task in the background allows for new updates and withdraws to be processed at the same time. This improves convergence time - one of the key metrics for Route Servers.</li>
    <li>BGP Origin Validation when a roa-set is configured Every EBGP route announcement is validated against the locally configured VRP table entries. Depending on the validation process’s outcome, the validation state is set to valid, invalid or not found. The filter language has been extended to allow checking for the origin validation state, and thanks to this, it is possible to deny invalid prefixes or regard valid prefixes different to the ones that aren’t found. The roa-set table is read from the configuration file and updated during configuration reloads. On production systems reloading the roa-set and applying it to all prefixes is done in a couple of seconds.</li>
    <li>Fast prefix-set lookups In OpenBSD 6.3 prefix-sets got introduced in OpenBGPD. A prefix-set combines many prefix lookups into a single filter rule. The original implementation wasn’t optimised but now a fast trie lookup is used. Thanks to this, large IRR DB prefix tables can now be implemented efficiently.</li>
    <li>Introduction of as-sets Similar to prefix-sets, as-sets help group many AS numbers into a single lookup. Thanks to this, large IRR DB origin AS tables can be implemented efficiently.
Introduction of origin-sets</li>
    <li>Looking at the configurations of Route Servers doing full filtering, it was noticed that a common lookup was binding a prefix to an origin AS - similar to how a roa-set is used for RPKI. These origin-set tables are used to extend the IRR prefix lookup and generated from alternative sources.</li>
    <li>Improving third party tools</li>
</ul>

<blockquote>Users can only benefit from the changes introduced in OpenBGPD 6.4 when the surrounding 3rd party tools are adjusted accordingly. Two opensource projects such as bgpq3 and arouteserver are frequently used by network operators and IXPs to generate BGP configurations. Thanks to our contributions to those projects, we were able to get them ready for all the new features in OpenBGPD.</blockquote>

<ul>
    <li>bgpq3 was extended to create as-set and prefix-set tables based on IRR DB entries. This is replacing the old way of doing the same with a large amount of filter rules. Thanks to the quick response from the bgpq3 maintainer, it was possible to ship OpenBSD 6.4 with a bgpq3 package that includes all the new features.</li>
    <li>arouteserver was adjusted to implement RPKI roa-set, as-set, prefix-set, and origin-set to generate a much better-performing configurations for the 6.4 version. With the v0.20.0 release of arouteserver, IXPs are able to generate an OpenBGPD configuration which is a ton faster but also implements the new functionalities. Looking at YYCIX (the resident IXP in Calgary, Canada) the ruleset generated by arouteserver was reduced from 370,000 rules to well under 6,000 rules. This resulted in the initial convergence time dropping from over 1 hour to less than 2 minutes, and subsequent configuration reloads are hitless and no longer noticeable.</li>
    <li>What still needs to be done</li>
</ul>

<blockquote>A sizeable chunk of work still left on the table is the rework of the RIB data structures in OpenBGPD - these haven’t been changed since the initial design of OpenBGPD in 2003. There’s currently ongoing work (in small steps, to avoid jeopardising the stability of OpenBGPD) to modernise these data-structures. The goal is to provide better decoupling of the filter step from storing RIB database changes, to pave the way to multi-threaded operations at a later point.</blockquote>

<ul>
    <li>Looking forward</li>
    <li>Job Snijders oversaw this year’s fundraising and project management, he adds:</li>
</ul>

<blockquote>It’s been incredibly productive to create an environment where a core developer is allowed to work full time on the OpenBGPD code base. However, it’s important to note there still is room for a number of new features to help improve its operational capabilities (such as BMP, RFC 7313, ADD_PATH, etc). It’d be beneficial to the Internet community at large if we can extend Claudio Jeker’s involvement for another year. Open source software doesn’t grow on trees! Strategic investments are the only way to keep OpenBGPD’s roadmap aligned with Internet growth and operator requirements.</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
    <li><a href="http://lists.dragonflybsd.org/pipermail/commits/2018-November/718130.html">DragonFly - git: annotated tag v5.5.0 created</a></li>
    <li><a href="https://www.youtube.com/watch?v=Qvj7Mkr13d8">Torchlight 2 on NetBSD</a></li>
    <li><a href="https://www.usenix.org/system/files/login/articles/login_dec14_03_dawidek.pdf">Older, but still good USENIX Login Article on Capsicum</a></li>
    <li><a href="https://github.com/myfreeweb/capsicumizer">The Super Capsicumizer 9000</a></li>
    <li><a href="https://www.noc-ps.com/">Dedicated and Virtual Server PXE provisioning tool</a></li>
    <li><a href="https://cirrus-ci.org/guide/FreeBSD/">Cirrus CI have announced FreeBSD support</a></li>
    <li><a href="https://twitter.com/astr0baby/status/1065353771952336897">NetBSD PineBook Gameplay</a></li>
    <li><a href="http://www.bsdcan.org/2019/papers.php">BSDCan 2019 CfP is out</a></li>
    <li>Allan’s first ZFS array, Zulu, turned 7 years old on Nov 29th</li>
</ul>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
    <li>Malcom - <a href="http://dpaste.com/35TNNX4">Installing Drivers in Development</a></li>
    <li>Samir - <a href="http://dpaste.com/2RCB37Y#wrap">Introduction to ZFS</a></li>
    <li>Newnix - <a href="http://dpaste.com/01YJ4EB#wrap">Drive Failures</a></li>
</ul>

<p><hr /></p>

<ul>
    <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>DragonflyBSD 5.4 has been released, down the Gopher hole with OpenBSD, OpenBSD in stereo with VFIO, BSD/OS the best candidate for legally tested open source Unix, OpenBGPD adds diversity to the routing server landscape, and more.</p>

<h2>Headlines</h2>

<h3><a href="https://www.dragonflybsd.org/release54/">DragonflyBSD 5.4 released</a></h3>

<blockquote>DragonFly version 5.4 brings a new system compiler in GCC 8, improved NUMA support, a large of number network and virtual machine driver updates, and updates to video support. This release is 64-bit only, as with previous releases.
The details of all commits between the 5.2 and 5.4 branches are available in the associated commit messages for 5.4.0rc and 5.4.0.</blockquote>

<ul>
    <li>Big-ticket items</li>
    <li>Much better support for asymmetric NUMA (Non-Uniform Memory Access) configurations. In particular, both the memory subsystem and the scheduler now understand the Threadripper 2990WX’s architecture. The scheduler will prioritize CPU nodes with direct-attached memory and the memory subsystem will normalize memory queues for CPU nodes without direct-attached memory (which improves cache locality on those CPUs).</li>
    <li>Incremental performance work. DragonFly as a whole is very SMP friendly. The type of performance work we are doing now mostly revolves around improving fairness for shared-vs-exclusive lock clashes, reducing cache ping-ponging due to non-contending SMP locks (i.e. massive use of shared locks on shared resources), and so forth.</li>
    <li>Major updates to dports brings us to within a week or two of FreeBSD’s ports as of this writing, in particular major updates to chromium, and making the whole mess work with gcc-8.</li>
    <li>Major rewriting of the tty clist code and the tty locking code, significantly improving concurrency across multiple ttys and ptys.</li>
    <li>GCC 8</li>
    <li>DragonFly now ships with GCC 8.0, and runs as the default compiler. It is also now used for building dports.</li>
    <li>GCC 4.7.4 and GCC 5.4.1 are still installed. 4.7.4 is our backup compiler, and 5.4.1 is still there to ensure a smooth transition, but should generally not be used. buildworld builds all three by default to ensure maximum compatibility.</li>
    <li>Many passes through world sources were made to address various warnings and errors the new GCC brought with it.</li>
    <li>HAMMER2</li>
    <li>HAMMER2 is recommended as the default root filesystem in non-clustered mode.</li>
    <li>Clustered support is not yet available.</li>
    <li>Increased bulkfree cache to reduce the number of iterations required.</li>
    <li>Fixed numerous bugs.</li>
    <li>Improved support on low-memory machines.</li>
    <li>Significant pre-work on the XOP API to help support future networked operations.</li>
    <li>Details</li>
    <li>Checksums
<code>MD5 (dfly-x86_64-5.4.0_REL.img) = 7277d7cffc92837c7d1c5dd11a11b98f</code>
<code>MD5 (dfly-x86_64-5.4.0_REL.iso) = 6da7abf036fe9267479837b3c3078408</code>
<code>MD5 (dfly-x86_64-5.4.0_REL.img.bz2) = a77a072c864f4b72fd56b4250c983ff1</code>
<code>MD5 (dfly-x86_64-5.4.0_REL.iso.bz2) = 4dbfec6ccfc1d59c5049455db914d499</code></li>
    <li>Downloads Links</li>
</ul>

<blockquote>DragonFly BSD is 64-bit only, as announced during the 3.8 release.</blockquote>

<ul>
    <li>USB: dfly-x86_64-5.4.0_REL.img as bzip2 file</li>
    <li>ISO: dfly-x86_64-5.4.0_REL.iso as bzip2 file</li>
    <li>Uncompressed ISO: dfly-x86_64-5.4.0_REL.iso (For use with VPS providers as an install image.)</li>
</ul>

<p><hr /></p>

<h3><a href="https://cryogenix.net/gophernicus.html">Down the Gopher hole with OpenBSD, Gophernicus, and TLS</a></h3>

<blockquote>In the early 2000s I thought I had seen the worst of the web - Java applets, Macromedia (&gt;Adobe) Flash, animated GIFs, javascript snow that kept you warm in the winter by burning out your CPU, and so on. For a time we learned from these mistakes, and started putting the burden on the server-side - then with improvements in javascript engines we started abusing it again with JSON/AJAX and it all went down hill from there.</blockquote>

<blockquote>Like cloud computing, blockchains, machine learning and a tonne of other a la mode technologies around today - most users and service providers don’t need websites that consume 1GB of memory processing JS and downloading 50MB of compressed data just to read Alice’s one-page travel blog or Bob’s notes on porting NetBSD to his blood-pressure monitor.</blockquote>

<blockquote>Before the HTTP web we relied on Prestel/Minitel style systems, BBS systems, and arguably the most accessible of all - Gopher! Gopher was similar to the locally accessed AmigaGuide format, in that it allowed users to search and retrieve documents interactively, with links and cross-references. Its efficiency and distraction-free nature make it attractive to those who are tired of the invasive, clickbait, ad-filled, javascript-laden web2/3.x. But enough complaining and evangelism - here’s how to get your own Gopher Hole!</blockquote>

<blockquote>Gophernicus is a modern gopher daemon which aims to be secure (although it still uses inetd -_-); it’s even in OpenBSD ports so at least we can rely on it to be reasonably audited.</blockquote>

<blockquote>If you need a starting point with Gopher, SDF-EU’s wiki has a good article here.</blockquote>

<ul>
    <li><a href="https://sdfeu.org/w/tutorials:gopher">https://sdfeu.org/w/tutorials:gopher</a></li>
</ul>

<blockquote>Finally, if you don’t like gopher(1) - there’s always lynx(1) or NCSA Mosaic!</blockquote>

<ul>
    <li><a href="https://cryogenix.net/NCSA_Mosaic_OpenBSD.html">https://cryogenix.net/NCSA_Mosaic_OpenBSD.html</a></li>
</ul>

<blockquote>I’ve added TLS support to Gophernicus so you don’t need to use stunnel anymore. The code is ugly and unpolished though so I wouldn’t recommend for production use.</blockquote>

<ul>
    <li><a href="https://github.com/0x16h/gophernicus">https://github.com/0x16h/gophernicus</a></li>
    <li><a href="https://github.com/0x16h/gophernicus/blob/master/INSTALL.openbsd">https://github.com/0x16h/gophernicus/blob/master/INSTALL.openbsd</a></li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2018/11/12/vfio">OpenBSD in Stereo with Linux VFIO</a></h3>

<blockquote>I use a Huawei Matebook X as my primary OpenBSD laptop and one aspect of its hardware support has always been lacking: audio never played out of the right-side speaker. The speaker did actually work, but only in Windows and only after the Realtek Dolby Atmos audio driver from Huawei was installed. Under OpenBSD and Linux, and even Windows with the default Intel sound driver, audio only ever played out of the left speaker.
Now, after some extensive reverse engineering and debugging with the help of VFIO on Linux, I finally have audio playing out of both speakers on OpenBSD.</blockquote>

<ul>
    <li>VFIO</li>
</ul>

<blockquote>The Linux kernel has functionality called VFIO which enables direct access to a physical device (like a PCI card) from userspace, usually passing it to an emulator like QEMU.
To my surprise, these days, it seems to be primarily by gamers who boot Linux, then use QEMU to run a game in Windows and use VFIO to pass the computer’s GPU device through to Windows.
By using Linux and VFIO, I was able to boot Windows 10 inside of QEMU and pass my laptop’s PCI audio device through to Windows, allowing the Realtek audio drivers to natively control the audio device. Combined with QEMU’s tracing functionality, I was able to get a log of all PCI I/O between Windows and the PCI audio device.</blockquote>

<ul>
    <li>Using VFIO</li>
</ul>

<blockquote>To use VFIO to pass-through a PCI device, it first needs to be stubbed out so the Linux kernel’s default drivers don’t attach to it. GRUB can be configured to instruct the kernel to ignore the PCI audio device (8086:9d71) and explicitly enable the Intel IOMMU driver by adding the following to /etc/default/grub and running update-grub
With the audio device stubbed out, a new VFIO device can be created from it
Then the VFIO device (00:1f.3) can be passed to QEMU
I was using my own build of QEMU for this, due to some custom logging I needed (more on that later), but the default QEMU package should work fine. The events.txt was a file of all VFIO events I wanted logged (which was all of them).
Since I was frequently killing QEMU and restarting it, Windows 10 wanted to go through its unexpected shutdown routine each time (and would sometimes just fail to boot again). To avoid this and to get a consistent set of logs each time, I used qemu-img to take a snapshot of a base image first, then boot QEMU with that snapshot. The snapshot just gets thrown away the next time qemu-img is run and Windows always starts from a consistent state.
QEMU will now log each VFIO event which gets saved to a debug-output file.
With a full log of all PCI I/O activity from Windows, I compared it to the output from OpenBSD and tried to find the magic register writes that enabled the second speaker. After days of combing through the logs and annotating them by looking up hex values in the documentation, diffing runtime register values, and even brute-forcing it by mechanically duplicating all PCI I/O activity in the OpenBSD driver, nothing would activate the right speaker.
One strange thing that I noticed was if I booted Windows 10 in QEMU and it activated the speaker, then booted OpenBSD in QEMU without resetting the PCI device’s power in-between (as a normal system reboot would do), both speakers worked in OpenBSD and the configuration that the HDA controller presented was different, even without any changes in OpenBSD.</blockquote>

<blockquote>A Primer on Intel HDA
Most modern computers with integrated sound chips use an Intel High Definition Audio (HDA) Controller device, with one or more codecs (like the Realtek ALC269) hanging off of it. These codecs do the actual audio processing and communicate with DACs and ADCs to send digital audio to the connected speakers, or read analog audio from a microphone and convert it to a digital input stream. In my Huawei Matebook X, this is done through a Realtek ALC298 codec.
On OpenBSD, these HDA controllers are supported by the azalia(4) driver, with all of the per-codec details in the lengthy azalia_codec.c file. This file has grown quite large with lots of codec- and machine-specific quirks to route things properly, toggle various GPIO pins, and unmute speakers that are for some reason muted by default.
The azalia driver talks to the HDA controller and sets up various buffers and then walks the list of codecs. Each codec supports a number of widget nodes which can be interconnected in various ways. Some of these nodes can be reconfigured on the fly to do things like turning a microphone port into a headphone port.
The newer Huawei Matebook X Pro released a few months ago is also plagued with this speaker problem, although it has four speakers and only two work by default. A fix is being proposed for the Linux kernel which just reconfigures those widget pins in the Intel HDA driver. Unfortunately no pin reconfiguration is enough to fix my Matebook X with its two speakers.
While reading more documentation on the HDA, I realized there was a lot more activity going on than I was able to see through the PCI tracing.
For speed and efficiency, HDA controllers use a DMA engine to transfer audio streams as well as the commands from the OS driver to the codecs. In the output above, the CORBWP=0; size=256 and RIRBRP=0, size=256 indicate the setup of the CORB (Command Output Ring Buffer) and RIRB (Response Input Ring Buffer) each with 256 entries. The HDA driver allocates a DMA address and then writes it to the two CORBLBASE and CORBUBASE registers, and again for the RIRB.
When the driver wants to send a command to a codec, such as CORB_GET_PARAMETER with a parameter of COP_VOLUME_KNOB_CAPABILITIES, it encodes the codec address, the node index, the command verb, and the parameter, and then writes that value to the CORB ring at the address it set up with the controller at initialization time (CORBLBASE/CORBUBASE) plus the offset of the ring index. Once the command is on the ring, it does a PCI write to the CORBWP register, advancing it by one. This lets the controller know a new command is queued, which it then acts on and writes the response value on the RIRB ring at the same position as the command (but at the RIRB’s DMA address). It then generates an interrupt, telling the driver to read the new RIRBWP value and process the new results.
Since the actual command contents and responses are handled through DMA writes and reads, these important values weren’t showing up in the VFIO PCI trace output that I had gathered. Time to hack QEMU.</blockquote>

<ul>
    <li>Logging DMA Memory Values in QEMU</li>
</ul>

<blockquote>Since DMA activity wouldn’t show up through QEMU’s VFIO tracing and I obviously couldn’t get Windows to dump these values like I could in OpenBSD, I could make QEMU recognize the PCI write to the CORBWP register as an indication that a command has just been written to the CORB ring.
My custom hack in QEMU adds some HDA awareness to remember the CORB and RIRB DMA addresses as they get programmed in the controller. Then any time a PCI write to the CORBWP register is done, QEMU fetches the new CORB command from DMA memory, decodes it into the codec address, node address, command, and parameter, and prints it out. When a PCI read of the RIRBWP register is requested, QEMU reads the response and prints the corresponding CORB command that it stored earlier.
With this hack in place, I now had a full log of all CORB commands and RIRB responses sent to and read from the codec:
An early version of this patch left me stumped for a few days because, even after submitting all of the same CORB commands in OpenBSD, the second speaker still didn’t work. It wasn’t until re-reading the HDA spec that I realized the Windows driver was submitting more than one command at a time, writing multiple CORB entries and writing a CORBWP value that was advanced by two. This required turning my CORB/RIRB reading into a for loop, reading each new command and response between the new CORBWP/RIRBWP value and the one previously seen.
Sure enough, the magic commands to enable the second speaker were sent in these periods where it submitted more than one command at a time.</blockquote>

<ul>
    <li>Minimizing the Magic</li>
</ul>

<blockquote>The full log of VFIO PCI activity from the Windows driver was over 65,000 lines and contained 3,150 CORB commands, which is a lot to sort through. It took me a couple more days to reduce that down to a small subset that was actually required to activate the second speaker, and that could only be done through trial and error:</blockquote>

<ul>
    <li>Boot OpenBSD with the full list of CORB commands in the azalia driver</li>
    <li>Comment out a group of them</li>
    <li>Compile kernel and install it, halt the QEMU guest</li>
    <li>Suspend and wake the laptop, resetting PCI power to the audio device to reset the speaker/Dolby initialization and ensure the previous run isn’t influencing the current test (I’m guessing there is an easier to way to reset PCI power than suspending the laptop, but oh well)</li>
    <li>Start QEMU, boot OpenBSD with the new kernel</li>
    <li>Play an MP3 with mpg123 which has alternating left- and right-channel audio and listen for both channels to play</li>
</ul>

<blockquote>This required a dozen or so iterations because sometimes I’d comment out too many commands and the right speaker would stop working. Other times the combination of commands would hang the controller and it wouldn’t process any further commands. At one point the combination of commands actually flipped the channels around so the right channel audio was playing through the left speaker.</blockquote>

<ul>
    <li>The Result</li>
</ul>

<blockquote>After about a week of this routine, I ended up with a list of 662 CORB commands that are needed to get the second speaker working. Based on the number of repeated-but-slightly-different values written with the 0x500 and 0x400 commands, I’m guessing this is some kind of training data and that this is doing the full Dolby/Atmos system initialization, not just turning on the second speaker, but I could be completely wrong.
In any case, the stereo sound from OpenBSD is wonderful now and I can finally stop downmixing everything to mono to play from the left speaker. In case you ever need to do this, sndiod can be run with -c 0:0 to reduce the channels to one.
Due to the massive size of the code needed for this quirk, I’m not sure if I’ll be committing it upstream in OpenBSD or just saving it for my own tree. But at least now the hardware support chart for my Matebook is all yeses for the things I care about.
I’ve also updated the Linux bug report that I opened before venturing down this path, hoping one of the maintainers of that HDA code that works at Intel or Realtek knew of a solution I could just port to OpenBSD. I’m curious to see what they’ll do with it.</blockquote>

<p><hr /></p>

<h3><a href="https://virtuallyfun.com/wordpress/2018/11/26/why-bsd-os-is-the-best-candidate-for-being-the-only-tested-legally-open-unix/">Why BSD/OS is the best candidate for being the only tested legally open UNIX</a></h3>

<ul>
    <li>Introduction</li>
</ul>

<blockquote>The UNIX® system is an old operating system, possibly older than many of the readers of this post. However, despite its age, it still has not been open sourced completely. In this post, I will try to detail which parts of which UNIX systems have not yet been open sourced. I will focus on the legal situation in Germany in particular, taking it representative of European law in general – albeit that is a stretch, knowing the diversity of European jurisdictions. Please note that familiarity with basic terms of copyright law is assumed.</blockquote>

<ul>
    <li>Ancient UNIX</li>
</ul>

<blockquote>The term “Ancient UNIX” refers to the versions of UNIX up to and including Seventh Edition UNIX (1979) including the 32V port to the VAX. Ancient UNIX was created at Bell Laboratories, a subsidiary of AT&amp;T at the time. It was later transferred of the AT&amp;T UNIX Support Group, then AT&amp;T Information Systems and finally the AT&amp;T subsidiary UNIX System Laboratories, Inc. (USL). The legal situation differs between the United States of America and Germany.
In a ruling as part of the UNIX System Laboratories, Inc. v. Berkeley Software Design, Inc. (USL v. BSDi) case, a U.S. court found that USL had no copyright to the Seventh Edition UNIX system and 32V – arguably, by extension, all earlier versions of Ancient UNIX as well – because USL/AT&amp;T had failed to affix copyright notices and could not demonstrate a trade secret. Due to the obsessive tendency of U.S. courts to consider themselves bound to precedents (cf. the infamous Pierson v. Post case), it can be reasonably expected that this ruling would be honored and applied in subsequent cases. Thus under U.S. law, Ancient UNIX can be safely assumed to belong in the public domain.
The situation differs in Germany. Unlike the U.S., copyright never needed registration in order to exist. Computer programs are works in the sense of the German 1965 Act on Copyright and Related Rights (Copyright Act, henceforth CopyA) as per CopyA § 2(1) no. 1. Even prior to the amendment of CopyA § 2(1) to include computer programs, computer programs have been recognized as copyrightable works by the German Supreme Court (BGHZ 112, 264 Betriebssystem, no. 19); CopyA § 137d(1) rightly clarifies that. The copyright holder at 1979 would still have been USL via Bell Labs and AT&amp;T. Copyright of computer programs is transferred to the employer upon creation under CopyA § 69(1).
Note that this does not affect expiry (Daniel Kaboth/Benjamin Spies, commentary on CopyA §§ 69a‒69g, in: Hartwig Ahlberg/Horst-Peter Götting (eds.), Urheberrecht: UrhG, KUG, VerlG, VGG, Kommentar, 4th ed., C. H. Beck, 2018, no. 16 ad CopyA § 69b; cf. Bundestag-Drucksache [BT-Drs.] 12/4022, p. 10). Expiry occurs 70 years after the death of the (co-)author that died most recently as per CopyA § 65(1) and 64; this has been the case since at least the 1960s, meaning there is no way for copyright to have expired already (old version, as per Bundesgesetzblatt Part I No. 51 of September 16, 1965, pp. 1273‒1294).
In Germany, private international law applies the so-called “Territorialitätsprinzip” for intellectual property rights. This means that the effect of an intellectual property right is limited to the territory of a state (Anne Lauber-Rönsberg, KollisionsR, in: Hartwig Ahlberg/Horst-Peter Götting (eds.), ibid., pp. 2241 et seqq., no. 4). Additionally, the “Schutzlandprinzip” applies; this means that protection of intellectual property follows the lex loci protectionis, i.e. the law of the country for which protection is sought (BGH GRUR 2015, 264 HiHotel II, no. 25; BGH GRUR 2003, 328 Sender Felsberg, no. 24), albeit this is criticized in parts of doctrine (Lauber-Rönsberg, ibid., no. 10). The “Schutzlandprinzip” requires that the existence of an intellectual property right be verified as well (BGH ZUM 2016, 522 Wagenfeld-Leuchte II, no. 19).
Thus, in Germany, copyright on Ancient UNIX is still alive and well. Who has it, though? A ruling by the U.S. Court of Appeals, Tenth Circuit, in the case of The SCO Group, Inc. v. Novell, Inc. (SCO v. Novell) in the U.S. made clear that Novell owns the rights to System V – thus presumably UNIX System III as well – and Ancient UNIX, though SCO acquired enough rights to develop UnixWare/OpenServer (Ruling 10-4122 [D.C. No. 2:04-CV-00139-TS], pp. 19 et seq.). Novell itself was purchased by the Attachmate Group, which was in turn acquired by the COBOL vendor Micro Focus. Therefore, the rights to SVRX and – outside the U.S. – are with Micro Focus right now. If all you care about is the U.S., you can stop reading about Ancient UNIX here.
So how does the Caldera license factor into all of this? For some context, the license was issued January 23, 2002 and covers Ancient UNIX (V1 through V7 including 32V), specifically excluding System III and System V. Caldera, Inc. was founded in 1994. The Santa Cruz Operation, Inc. sold its rights to UNIX to Caldera in 2001, renamed itself to Tarantella Inc. and Caldera renamed itself The SCO Group. Nemo plus iuris ad alium transferre potest quam ipse habet; no one can transfer more rights than he has. The question now becomes whether Caldera had the rights to issue the Caldera license.
I’ve noted it above but it needs restating: Foreign decisions are not necessarily accepted in Germany due to the “Territorialitätsprinzip” and “Schutzlandprinzip” – however, I will be citing a U.S. ruling for its assessment of the facts for the sake of simplicity. As per ruling 10-4122, “The district court found the parties intended for SCO to serve as Novell’s agent with respect to the old SVRX licenses and the only portion of the UNIX business transferred outright under the APA [asset purchase agreement] was the ability to exploit and further develop the newer UnixWare system. SCO was able to protect that business because it was able to copyright its own improvements to the system. The only reason to protect the earlier UNIX code would be to protect the existing SVRX licenses, and the court concluded Novell retained ultimate control over that portion of the business under the APA.” The relevant agreements consist of multiple pieces:
the base Asset Purchase Agreement “APA” (Part I)
the base Asset Purchase Agreement “APA” (Part II)
the Operating Agremeent and Amendment 1 to the APA
the Amendment 2 to the APA
The APA dates September 19, 1995, from before the Caldera license. Caldera cannot possibly have acquired rights that The Santa Cruz Operation, Inc. itself never had. Furthermore, I’ve failed to find any mention of Ancient UNIX; all that is transferred is rights to SVRX. Overall, I believe that the U.S. courts’ assesment of the facts represents the situation accurately. Thus for all intents and purposes, UNIX up to and including System V remained with Novell/Attachmate/Micro Focus. Caldera therefore never had any rights to Ancient UNIX, which means it never had the rights to issue the Caldera license. The Caldera license is null and void – in the U.S. because the copyright has been lost due to formalities, everywhere else because Caldera never had the rights to issue it.
The first step to truly freeing UNIX would this be to get Micro Focus to re-issue the Caldera license for Ancient UNIX, ideally it would now also include System III and System V.</blockquote>

<ul>
    <li>BSD/OS</li>
</ul>

<blockquote>Another operating system near UNIX is of interest. The USL v. BSDi lawsuit includes two parties: USL, which we have seen above, and Berkeley Software Design, Inc. BSDi sold BSD/386 (later BSD/OS), which was a derivative of 4.4BSD. The software parts of the BSDi company were acquired by Wind River Systems, whereas the hardware parts went to iXsystems. Copyright is not disputed there, though Wind River Systems ceased selling BSD/OS products 15 years ago, in 2003. In addition, Wind River System let their trademark on BSD expire, though this is without consequence for copyright.
BSD/OS is notable in the sense that it powered much of early internet infrastructure. Traces of its legacy can still be found on Richard Stevens’ FAQ.
To truly make UNIX history free, BSD/OS would arguably also need to see a source code release. BSD/OS at least in its earliest releases under BSDi would ship with source code, though under a non-free license, far from BSD or even GPL licensing.</blockquote>

<ul>
    <li>System V</li>
</ul>

<blockquote>The fate of System V as a whole is difficult to determine. Various licenses have been granted to a number of vendors (Dell UNIX comes to mind; HP for HP-UX, IBM for AIX, SGI UNIX, etc.). Sun released OpenSolaris – notoriously, Oracle closed the source to Solaris again after its release –, which is a System V Release 4 descendant. However, this means nothing for the copyright or licensing status of System V itself. Presumably, the rights with System V still remain with Novell (now Micro Focus): SCO managed to sublicense rights to develop and sell UnixWare/OpenServer, themselves System V/III descendants, to unXis, Inc. (now known as Xinuos, Inc.), which implies that Xinuos is not the copyright holder of System V.
Obviously, to free UNIX, System V and its entire family of descendants would also need to be open sourced. However, I expect tremendous resistance on part of all the companies mentioned. As noted in the “Ancient UNIX” section, Micro Focus alone would probably be sufficient to release System V, though this would mean nothing for the other commercial System V derivatives.</blockquote>

<ul>
    <li>Newer Research UNIX</li>
</ul>

<blockquote>The fate of Bell Labs would be a different one; it would go on to be purchased by Lucent, now part of Nokia. After commercial UNIX got separated out to USL, Research UNIX would continue to exist inside of Bell Labs. Research UNIX V8, V9 and V10 were not quite released by Alcatel-Lucent USA Inc. and Nokia in 2017.
However, this is merely a notice that the companies involved will not assert their copyrights only with respect to any non-commercial usage of the code. It is still not possible, over 30 years later, to freely use the V8 code.</blockquote>

<ul>
    <li>Conclusion
In the U.S., Ancient UNIX is freely available. People located everywhere else, however, are unable to legally obtain UNIX code for any of the systems mentioned above. The exception being BSD/OS, assuming a purchase of a legitimate copy of the source code CD. This is deeply unsatisfying and I implore all involved companies to consider open sourcing (preferably under a BSD-style license) their code older than a decade, if nothing else, then at least for the sake of historical purposes. I would like to encourage everybody reading this to consider reaching out to Micro Focus and Wind River Systems about System V and BSD/OS, respectively. Perhaps the masses can change their minds.</li>
</ul>

<blockquote>A small note about patents: Some technologies used in newer iterations of the UNIX system (in particular the System V derivatives) may be encumbered with software patents. An open source license will not help against patent infringement claims. However, the patents on anything used in the historical operating systems will certainly have expired by now. In addition, European readers can ignore this entirely – software patents just aren’t a thing.</blockquote>

<p><hr /></p>

<h3><a href="https://labs.ripe.net/Members/claudio_jeker/openbgpd-adding-diversity-to-route-server-landscape">OpenBGPD - Adding Diversity to the Route Server Landscape</a></h3>

<ul>
    <li>Introduction</li>
</ul>

<blockquote>As of last year, there was effectively only a single solution in the Route Server vendor market: the BIRD Internet routing daemon. <a href="http://NIC.CZ">NIC.CZ</a> (the organisation developing BIRD) has done fantastic work on maintaining their BGP-4 implementation, however, it’s not healthy to have virtually every Internet Exchange Point (IXP) in the RIPE NCC service region depend on a single open source project. The current situation can be compared to the state of the DNS root nameservers back in 2002 - their dependence on the BIND nameserver daemon and the resulting development of NSD as an alternative by NLnet, in cooperation with the RIPE NCC.
OpenBGPD used to be one of the most popular Route Server implementations until the early 2010s. OpenBGPD’s main problem was that its performance couldn’t keep up with the Internet’s growth, so it lost market share. An analysis by Job Snijders suggested that a modernised OpenBGPD distribution would be a most viable option to regain diversity on the Route Server level.</blockquote>

<ul>
    <li>Missing features in OpenBGPD</li>
</ul>

<blockquote>The following main missing features were identified in OpenBGPD:</blockquote>

<ul>
    <li>Performance</li>
</ul>

<blockquote>In previous versions of OpenBGPD, the filtering performance didn’t allow proper filtering of all EBGP sessions. Current best practice at IXP Route Servers is to carefully evaluate and validate of all routes learned from EBGP peers. The OpenBGPD ruleset required to do correct filtering (in many deployment scenarios) was simply too lengthy - and negatively impacted service performance during configuration reloads. While filtering performance is the biggest bottleneck, general improvements to the Routing Information Base were also made to improve scalability. IXP Route Servers with a few hundred peering sessions are commonplace and adding new sessions shouldn’t impact the Route Servers’ service to other peers. We found that performance was the most pressing issue that needed to be tackled.</blockquote>

<ul>
    <li>Lack of RPKI Origin Validation</li>
</ul>

<blockquote>As we’ve seen, Internet operators are moving to adopt RPKI based BGP Origin Validation. While it was theoretically possible to emulate RFC 6811-style Origin Validation in previous versions of OpenBGPD, the required configuration wasn’t optimised for performance and wasn’t user friendly. We believe that BGP Origin Validation should be as easy as possible - this requires BGP-4 vendors to implement native, optimised routines for Origin Validation. Of course, enabling Origin Validation shouldn’t have an impact on performance either when processing BGP updates or when updating the Route Origin Authorisation (ROA) table itself.</blockquote>

<ul>
    <li>Portability</li>
</ul>

<blockquote>OpenBGPD is an integral part of OpenBSD, but IXPs may prefer to run their services infrastructure on an operating system of their choice. Making sure that there’s a portable OpenBGPD version which follows the OpenBSD project release cycle will give IXPs this option.</blockquote>

<ul>
    <li>Development steps</li>
</ul>

<blockquote>By addressing the issues mentioned above, we could bring back OpenBGPD as a viable Route Server implementation.
Since I was one of the core OpenBGPD developers, I was asked if I wanted to pick up this project again. Thanks to the funding from the RIPE NCC Project Fund, this was possible. Starting in June 2018, I worked full time on this important community project. Over the last few months, many of the problems are already addressed and are now part of the OpenBSD 6.4 release. So far, 154 commits were made to OpenBGPD during the 6.4 development cycle - around 8% of all commits ever to OpenBGPD! This shows that due to funding and dedicated resources, a lot of work could be pushed into the latest release of OpenBGPD.</blockquote>

<ul>
    <li>OpenBGPD 6.4</li>
</ul>

<blockquote>The OpenBGPD version, as part of OpenBSD 6.4 release, demonstrates great progress. Even though there have been many changes to the core of OpenBGPD, the released version is as solid and reliable as previous releases and the many bug fixes and improvements make this the best OpenBGPD release so far. The changes in the filter language allow users to write more efficient rulesets while the introduction of RPKI origination validation fixes an important missing feature. For IXPs, OpenBGPD now is an alternative again. There are still open issues, but the gap is closing!</blockquote>

<ul>
    <li>Feature highlights</li>
</ul>

<blockquote>The following changes should be highlighted:</blockquote>

<ul>
    <li>Introduction of background soft-reconfiguration on config reload. Running the soft-reconfiguration task in the background allows for new updates and withdraws to be processed at the same time. This improves convergence time - one of the key metrics for Route Servers.</li>
    <li>BGP Origin Validation when a roa-set is configured Every EBGP route announcement is validated against the locally configured VRP table entries. Depending on the validation process’s outcome, the validation state is set to valid, invalid or not found. The filter language has been extended to allow checking for the origin validation state, and thanks to this, it is possible to deny invalid prefixes or regard valid prefixes different to the ones that aren’t found. The roa-set table is read from the configuration file and updated during configuration reloads. On production systems reloading the roa-set and applying it to all prefixes is done in a couple of seconds.</li>
    <li>Fast prefix-set lookups In OpenBSD 6.3 prefix-sets got introduced in OpenBGPD. A prefix-set combines many prefix lookups into a single filter rule. The original implementation wasn’t optimised but now a fast trie lookup is used. Thanks to this, large IRR DB prefix tables can now be implemented efficiently.</li>
    <li>Introduction of as-sets Similar to prefix-sets, as-sets help group many AS numbers into a single lookup. Thanks to this, large IRR DB origin AS tables can be implemented efficiently.
Introduction of origin-sets</li>
    <li>Looking at the configurations of Route Servers doing full filtering, it was noticed that a common lookup was binding a prefix to an origin AS - similar to how a roa-set is used for RPKI. These origin-set tables are used to extend the IRR prefix lookup and generated from alternative sources.</li>
    <li>Improving third party tools</li>
</ul>

<blockquote>Users can only benefit from the changes introduced in OpenBGPD 6.4 when the surrounding 3rd party tools are adjusted accordingly. Two opensource projects such as bgpq3 and arouteserver are frequently used by network operators and IXPs to generate BGP configurations. Thanks to our contributions to those projects, we were able to get them ready for all the new features in OpenBGPD.</blockquote>

<ul>
    <li>bgpq3 was extended to create as-set and prefix-set tables based on IRR DB entries. This is replacing the old way of doing the same with a large amount of filter rules. Thanks to the quick response from the bgpq3 maintainer, it was possible to ship OpenBSD 6.4 with a bgpq3 package that includes all the new features.</li>
    <li>arouteserver was adjusted to implement RPKI roa-set, as-set, prefix-set, and origin-set to generate a much better-performing configurations for the 6.4 version. With the v0.20.0 release of arouteserver, IXPs are able to generate an OpenBGPD configuration which is a ton faster but also implements the new functionalities. Looking at YYCIX (the resident IXP in Calgary, Canada) the ruleset generated by arouteserver was reduced from 370,000 rules to well under 6,000 rules. This resulted in the initial convergence time dropping from over 1 hour to less than 2 minutes, and subsequent configuration reloads are hitless and no longer noticeable.</li>
    <li>What still needs to be done</li>
</ul>

<blockquote>A sizeable chunk of work still left on the table is the rework of the RIB data structures in OpenBGPD - these haven’t been changed since the initial design of OpenBGPD in 2003. There’s currently ongoing work (in small steps, to avoid jeopardising the stability of OpenBGPD) to modernise these data-structures. The goal is to provide better decoupling of the filter step from storing RIB database changes, to pave the way to multi-threaded operations at a later point.</blockquote>

<ul>
    <li>Looking forward</li>
    <li>Job Snijders oversaw this year’s fundraising and project management, he adds:</li>
</ul>

<blockquote>It’s been incredibly productive to create an environment where a core developer is allowed to work full time on the OpenBGPD code base. However, it’s important to note there still is room for a number of new features to help improve its operational capabilities (such as BMP, RFC 7313, ADD_PATH, etc). It’d be beneficial to the Internet community at large if we can extend Claudio Jeker’s involvement for another year. Open source software doesn’t grow on trees! Strategic investments are the only way to keep OpenBGPD’s roadmap aligned with Internet growth and operator requirements.</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
    <li><a href="http://lists.dragonflybsd.org/pipermail/commits/2018-November/718130.html">DragonFly - git: annotated tag v5.5.0 created</a></li>
    <li><a href="https://www.youtube.com/watch?v=Qvj7Mkr13d8">Torchlight 2 on NetBSD</a></li>
    <li><a href="https://www.usenix.org/system/files/login/articles/login_dec14_03_dawidek.pdf">Older, but still good USENIX Login Article on Capsicum</a></li>
    <li><a href="https://github.com/myfreeweb/capsicumizer">The Super Capsicumizer 9000</a></li>
    <li><a href="https://www.noc-ps.com/">Dedicated and Virtual Server PXE provisioning tool</a></li>
    <li><a href="https://cirrus-ci.org/guide/FreeBSD/">Cirrus CI have announced FreeBSD support</a></li>
    <li><a href="https://twitter.com/astr0baby/status/1065353771952336897">NetBSD PineBook Gameplay</a></li>
    <li><a href="http://www.bsdcan.org/2019/papers.php">BSDCan 2019 CfP is out</a></li>
    <li>Allan’s first ZFS array, Zulu, turned 7 years old on Nov 29th</li>
</ul>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
    <li>Malcom - <a href="http://dpaste.com/35TNNX4">Installing Drivers in Development</a></li>
    <li>Samir - <a href="http://dpaste.com/2RCB37Y#wrap">Introduction to ZFS</a></li>
    <li>Newnix - <a href="http://dpaste.com/01YJ4EB#wrap">Drive Failures</a></li>
</ul>

<p><hr /></p>

<ul>
    <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 274: Language: Assembly | BSD Now 274</title>
  <link>https://www.bsdnow.tv/274</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2962</guid>
  <pubDate>Thu, 29 Nov 2018 02:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/64460b53-258b-484d-be91-f4b60eac299f.mp3" length="38828711" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Assembly language on OpenBSD, using bhyve for FreeBSD development, FreeBSD Gaming, FreeBSD for Thanksgiving, no space left on Dragonfly’s hammer2, and more.</itunes:subtitle>
  <itunes:duration>1:04:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Assembly language on OpenBSD, using bhyve for FreeBSD development, FreeBSD Gaming, FreeBSD for Thanksgiving, no space left on Dragonfly’s hammer2, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://cryogenix.net/OpenBSD_assembly.html"&gt;Assembly language on OpenBSD amd64+arm64&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;This is a short introduction to assembly language programming on OpenBSD/amd64+arm64. Because of security features in the kernel, I have had to rethink a series of tutorials covering Aarch64 assembly language on OpenBSD, and therefore this will serve as a placeholder-cum-reminder.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;OpenBSD, like many UNIX and unix-like operating systems, now uses the Executable and Linkable Format (ELF) for its binary libraries and executables. Although the structure of this format is beyond the scope of this short introduction, it is necessary for me to explain part of one of the headers.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Within the program header there are sections known as PT_NOTE that OpenBSD and other systems use to distinguish their ELF executables - OpenBSD looks for this section to check if it should attempt to execute the program or not.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Our first program: in C!&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;It’s often a good idea to prototype your assembly programs in a high level language such as C - it can then double up as both a set of notes and a working program that you can debug and compile into assembly language to compare with your own asm code.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;See the article for the rest on:&lt;/li&gt;
&lt;li&gt;Our first program: in x86-64 Asm (AT&amp;amp;T/GAS syntax)&lt;/li&gt;
&lt;li&gt;Our first program: in inline x86-64 assembly&lt;/li&gt;
&lt;li&gt;Our first program: in x86-64 asm (NASM syntax)&lt;/li&gt;
&lt;li&gt;Our first program: in ARMv8 AArch64 assembly&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://bsdjhb.blogspot.com/2018/10/using-bhyve-for-freebsd-development.html"&gt;Using bhyve for FreeBSD Development&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;The Hypervisor&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The bhyve hypervisor requires a 64-bit x86 processor with hardware support for virtualization.  This requirement allows for a simple, clean hypervisor implementation, but it does require a fairly recent&lt;br&gt;
processor.  The current hypervisor requires an Intel processor, but there is an active development branch with support for AMD processors.&lt;br&gt;
The hypervisor itself contains both user and kernel components.  The kernel driver is contained in the vmm.ko module and can be loaded either at boot from the boot loader or at runtime.  It must&lt;br&gt;
be loaded before any guests can be created.  When a guest is created, the kernel driver creates a device file in /dev/vmm which is used by the user programs to interact with the guest.&lt;br&gt;
The primary user component is the bhyve(8) program.  It constructs the emulated device tree in the guest and provides the implementation for most of the emulated devices.  It also calls the kernel driver to execute the guest.  Note that the guest always executes inside the driver itself, so guest execution time in the host is counted as system time in the bhyve process.&lt;br&gt;
Currently, bhyve does not provide a system firmware interface to the guest (neither BIOS nor UEFI).  Instead, a user program running on the host is used to perform boot time operations including loading the guest operating system kernel into the guest’s memory and setting the initial guest state so that the guest begins execution at the kernel’s entry point.  For FreeBSD guests, the bhyveload(8) program can be used to load the kernel and prepare the guest for execution.  Support for some other operating systems is available via the grub2-bhyve program which is available via the sysutils/grub2-bhyve port or as a prebuilt package.&lt;br&gt;
The bhyveload(8) program in FreeBSD 10.0 only supports 64-bit guests.  Support for 32-bit guests will be included in FreeBSD 10.1.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;See the article for the very technical breakdown of the following:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Network Setup&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Bridged Configuration&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Private Network with NAT&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Using dnsmasq with a Private Network&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Running Guests via &lt;a href="http://vmrun.sh"&gt;vmrun.sh&lt;/a&gt;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Configuring Guests&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Using a bhyve Guest as a Target&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Conclusion&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The bhyve hypervisor is a nice addition to a FreeBSD developer’s toolbox.  Guests can be used both to develop new features and to test merges to stable branches.  The hypervisor has a wide variety of uses beyond developing FreeBSD as well.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://oshogbo.vexillium.org/blog/58/"&gt;Games on FreeBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;What do all programmers like to do after work? Ok, what do most programers like to do after work? The answer is simple: play a good game! Recently at the Polish BSD User Group meetup mulander was telling us how you can play games on OpenBSD. Today let’s discuss how this looks in the FreeBSD world using the “server only” operating system.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;XNA based games&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;One of the ways of playing natively is to play indie games which use XNA. XNA is a framework from Microsoft which uses .NET, for creating games. Fortunately, in the BSD world we have Mono, an open source implementation of Microsoft’s .NET Framework which you can use to run games. There is also FNA framework which is a reimplementation of XNA which allows you to run the games under Linux. Thomas Frohwein, from OpenBSD, prepared a script, fnaify. Fnaify translate all dependencies used by an FNA game to OpenBSD dependencies.&lt;br&gt;
I decided to port the script to FreeBSD. The script is using /bin/sh which in the case of OpenBSD is a Korn Shell.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I didn’t test it with many games, but I don’t see any reason why it shouldn’t work with all the games tested by the OpenBSD guys. For example, with:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Cryptark&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Rouge Legacy&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Apotheon&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Escape Goat&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Bastion&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;CrossCode&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Atom Zombie Smasher&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Open-Source games&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;In FreeBSD and OpenBSD we also will find popular games which were open sourced. For example, I spend a lot of time playing in Quake 3 Arena on my FreeBSD machine. You can very simply install it using pkg: &lt;code&gt;# pkg install ioquake3&lt;/code&gt;&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Then move the files for the skins and maps to the .ioquake3 directory from your copy of Quake. In the past I also played UrbanTerror which is a fully open source shooter based on the Quake 3 Arena engine. It’s is also very easy to install it from ports: &lt;code&gt;# pkg install iourbanterror&lt;/code&gt;&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;In the ports tree in the games directory you can find over 1000 directories, many of them with fully implemented games. I didn’t test many games in this category, but you can find some interesting titles like:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;openxcom (Open-source re-implementation of the original X-Com)&lt;/li&gt;
&lt;li&gt;openjazz (Free re-implementation of the Jazz Jackrabbit™ game engine)&lt;/li&gt;
&lt;li&gt;corsixth (Open source re-implementation of Theme Hospital)&lt;/li&gt;
&lt;li&gt;quake2&lt;/li&gt;
&lt;li&gt;openra (Red Alert)&lt;/li&gt;
&lt;li&gt;openrct2 (Open source re-implementation of RollerCoaster Tycoon 2)&lt;/li&gt;
&lt;li&gt;openmw (Open source engine reimplementation of the game Morrowind)&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;All those titles are simply installed through the packages. In that case I don’t think FreeBSD has any difference from OpenBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Wine&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;One of the big advantages of FreeBSD over OpenBSD is that FreeBSD supports wine. Wine allows you to run Windows applications under other operating systems (including mac). If you are a FreeBSD 11 user, you can simply fetch wine from packages: &lt;code&gt;# pkg install i386-wine&lt;/code&gt;&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;To run Windows games, you need to have a 32-bit wine because most of the games on Windows are built on 32-bits (maybe this has changed – I don’t play so much these days). In my case, because I run FreeBSD-CURRENT I needed to build wine from ports. It wasn’t nice, but it also wasn’t unpleasant. The whole step-by-step building process of a wine from ports can be found here.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Summary&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;As you can see there are many titles available for *BSDs. Thanks to the FNA and fnaify, OpenBSD and FreeBSD can work with indie games which use the XNA framework. There are many interesting games implemented using this framework. Open source is not only for big server machines, and there are many re-implementations of popular games like Theme Hospital or RollerCoaster Tycoon 2. The biggest market is still enabled through wine, although its creates a lot of problems to run the games. Also, if you are an OpenBSD user only this option is not available for you. Please also note that we didn’t discuss any other emulators besides wine. In OpenBSD and FreeBSD there are many of them for GameBoy, SNES, NeoGeo and other games consoles.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://bwidawsk.net/blog/index.php/2018/11/freebsd-for-thanksgiving/"&gt;FreeBSD For Thanksgiving&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I’ve been working on FreeBSD for Intel for almost 6 months now. In the world of programmers, I am considered an old dog, and these 6 months have been all about learning new tricks. Luckily, I’ve found myself in a remarkably inclusive and receptive community whose patience seems plentiful. As I get ready to take some time off for the holidays, and move into that retrospective time of year, I thought I’d beat the rush a bit and update on the progress&lt;br&gt;
Earlier this year, I decided to move from architect of the Linux graphics driver into a more nebulous role of FreeBSD enabling. I was excited, but also uncertain if I was making the right decision.&lt;br&gt;
Earlier this half, I decided some general work in power management was highly important and began working there. I attended BSDCam (handsome guy on the right), and led a session on Power Management. I was honored to be able to lead this kind of effort.&lt;br&gt;
Earlier this quarter, I put the first round of my patches up for review, implementing suspend-to-idle. I have some rougher patches to handle s0ix support when suspending-to-idle. I gave a talk MeetBSD about our team’s work.&lt;br&gt;
Earlier this month, I noticed that FreeBSD doesn’t have an implementation for Intel Speed Shift (HWPstates), and I started working on that.&lt;br&gt;
Earlier this week, I was promoted from a lowly mentee committer to a full src committer.&lt;br&gt;
Earlier today, I decided to relegate my Linux laptop to the role of my backup machine, and I am writing this from my Dell XPS13 running FreeBSD&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;vandamme 13.0-CURRENT FreeBSD 13.0-CURRENT #45 881fee072ff(hwp)-dirty: Mon Nov 19 16:19:32 PST 2018 bwidawsk@vandamme:/usr/home/bwidawsk/usr/obj/usr/home/bwidawsk/usr/src/amd64.amd64/sys/DEVMACHINE amd64&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;6 months later, I feel a lot less uncertain about making the right decision. In fact, I think both opportunities would be great, and I’m thankful this Thanksgiving that this is my life and career. I have more plans and things I want to get done. I’m looking forward to being thankful again next year.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.garyshood.com/hammer2-space/"&gt;hammer2: no space left on device on Dragonfly BSD&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;The Issue&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;hammer2 does not actually delete a file when you rm or unlink it. Since recovery of the file is possible (this is the design of hammer2), there will still be an entry taking up data. It’s similar to how git works.&lt;br&gt;
Even with 75% usage listed here, the filesystem could still have filled up. If you are using it as your root filesystem, then attempts to clean up data may fail. If the kernel panics over this, you will see something like this.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The Fix&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;If you have a recent enough version of the rescue ramdisk installed, on bootup you can press ‘r’ and access the rescue ramdisk. Your provider will have to offer some sort of remote interface for interacting with the operating system before it boots, like VNC or IPMI. You can then mount your filesystem using:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;[root@ ~]# mkdir /tmp/fs&lt;/code&gt;&lt;br&gt;
&lt;code&gt;[root@ ~]# mount_hammer2 -o local /dev/vbd0s1a /tmp/fs&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;If you receive an error that /sbin/hammer2 is not found, then your rescue ramdisk is not up to date enough. In that scenario, download the latest 5.2 iso from &lt;a href="http://dragonflybsd.org"&gt;dragonflybsd.org&lt;/a&gt; and boot from the cd-rom on your virtual machine or physical device. Just login as root instead of installer.&lt;br&gt;
If the mount does succeed, then all you have to do is run the following twice:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;[root@ ~]# /sbin/hammer2 bulkfree /tmp/fs&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;If you do not have enough memory on your machine, you may need to mount swap. Add your swap partition to the /etc/fstab and then do:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;[root@ ~]# swapon -a&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Once you have ran the bulkfree command twice, the usage reported by df -h will be correct. However, there is a chance on reboot that a core dump will be placed in /var/crash/ so be prepared to have plenty of space free in case that happens. You should also delete any files you can and run the bulkfree operation twice afterwards to clear up additional space.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="http://dpaste.com/1S9NMZA"&gt;BSD Pizza Night - Portland&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://dpaste.com/3T0AB7M"&gt;bsd@35c3: …the place for you…*NIX!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://project-trident.org/download/"&gt;Project Trident PreRelease Image now available&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://dataswamp.org/~solene/2018-11-09-stardew-valley.html"&gt;Play Stardew Valley on OpenBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/charlesdaniels/gmixerctl"&gt;GUI Wrapper for OpenBSD mixerctl&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/q5sys/qtv/"&gt;qtv - QuickTextViewer&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Ron - &lt;a href="http://dpaste.com/16XT6PQ#wrap"&gt;Ideas for feedback section&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Paulo - &lt;a href="http://dpaste.com/0BEE730"&gt;SDIO Firmware&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Dan - &lt;a href="http://dpaste.com/3Q7DERN#wrap"&gt;Some fun ZFS questions about labels&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, gaming, assembly language, hammer2</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Assembly language on OpenBSD, using bhyve for FreeBSD development, FreeBSD Gaming, FreeBSD for Thanksgiving, no space left on Dragonfly’s hammer2, and more.</p>

<p>##Headlines<br>
###<a href="https://cryogenix.net/OpenBSD_assembly.html">Assembly language on OpenBSD amd64+arm64</a></p>

<blockquote>
<p>This is a short introduction to assembly language programming on OpenBSD/amd64+arm64. Because of security features in the kernel, I have had to rethink a series of tutorials covering Aarch64 assembly language on OpenBSD, and therefore this will serve as a placeholder-cum-reminder.</p>
</blockquote>

<blockquote>
<p>OpenBSD, like many UNIX and unix-like operating systems, now uses the Executable and Linkable Format (ELF) for its binary libraries and executables. Although the structure of this format is beyond the scope of this short introduction, it is necessary for me to explain part of one of the headers.</p>
</blockquote>

<blockquote>
<p>Within the program header there are sections known as PT_NOTE that OpenBSD and other systems use to distinguish their ELF executables - OpenBSD looks for this section to check if it should attempt to execute the program or not.</p>
</blockquote>

<ul>
<li>Our first program: in C!</li>
</ul>

<blockquote>
<p>It’s often a good idea to prototype your assembly programs in a high level language such as C - it can then double up as both a set of notes and a working program that you can debug and compile into assembly language to compare with your own asm code.</p>
</blockquote>

<ul>
<li>See the article for the rest on:</li>
<li>Our first program: in x86-64 Asm (AT&amp;T/GAS syntax)</li>
<li>Our first program: in inline x86-64 assembly</li>
<li>Our first program: in x86-64 asm (NASM syntax)</li>
<li>Our first program: in ARMv8 AArch64 assembly</li>
</ul>

<p><hr></p>

<p>###<a href="https://bsdjhb.blogspot.com/2018/10/using-bhyve-for-freebsd-development.html">Using bhyve for FreeBSD Development</a></p>

<ul>
<li>The Hypervisor</li>
</ul>

<blockquote>
<p>The bhyve hypervisor requires a 64-bit x86 processor with hardware support for virtualization.  This requirement allows for a simple, clean hypervisor implementation, but it does require a fairly recent<br>
processor.  The current hypervisor requires an Intel processor, but there is an active development branch with support for AMD processors.<br>
The hypervisor itself contains both user and kernel components.  The kernel driver is contained in the vmm.ko module and can be loaded either at boot from the boot loader or at runtime.  It must<br>
be loaded before any guests can be created.  When a guest is created, the kernel driver creates a device file in /dev/vmm which is used by the user programs to interact with the guest.<br>
The primary user component is the bhyve(8) program.  It constructs the emulated device tree in the guest and provides the implementation for most of the emulated devices.  It also calls the kernel driver to execute the guest.  Note that the guest always executes inside the driver itself, so guest execution time in the host is counted as system time in the bhyve process.<br>
Currently, bhyve does not provide a system firmware interface to the guest (neither BIOS nor UEFI).  Instead, a user program running on the host is used to perform boot time operations including loading the guest operating system kernel into the guest’s memory and setting the initial guest state so that the guest begins execution at the kernel’s entry point.  For FreeBSD guests, the bhyveload(8) program can be used to load the kernel and prepare the guest for execution.  Support for some other operating systems is available via the grub2-bhyve program which is available via the sysutils/grub2-bhyve port or as a prebuilt package.<br>
The bhyveload(8) program in FreeBSD 10.0 only supports 64-bit guests.  Support for 32-bit guests will be included in FreeBSD 10.1.</p>
</blockquote>

<ul>
<li>
<p>See the article for the very technical breakdown of the following:</p>
</li>
<li>
<p>Network Setup</p>
</li>
<li>
<p>Bridged Configuration</p>
</li>
<li>
<p>Private Network with NAT</p>
</li>
<li>
<p>Using dnsmasq with a Private Network</p>
</li>
<li>
<p>Running Guests via <a href="http://vmrun.sh">vmrun.sh</a></p>
</li>
<li>
<p>Configuring Guests</p>
</li>
<li>
<p>Using a bhyve Guest as a Target</p>
</li>
<li>
<p>Conclusion</p>
</li>
</ul>

<blockquote>
<p>The bhyve hypervisor is a nice addition to a FreeBSD developer’s toolbox.  Guests can be used both to develop new features and to test merges to stable branches.  The hypervisor has a wide variety of uses beyond developing FreeBSD as well.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://oshogbo.vexillium.org/blog/58/">Games on FreeBSD</a></p>

<blockquote>
<p>What do all programmers like to do after work? Ok, what do most programers like to do after work? The answer is simple: play a good game! Recently at the Polish BSD User Group meetup mulander was telling us how you can play games on OpenBSD. Today let’s discuss how this looks in the FreeBSD world using the “server only” operating system.</p>
</blockquote>

<ul>
<li>XNA based games</li>
</ul>

<blockquote>
<p>One of the ways of playing natively is to play indie games which use XNA. XNA is a framework from Microsoft which uses .NET, for creating games. Fortunately, in the BSD world we have Mono, an open source implementation of Microsoft’s .NET Framework which you can use to run games. There is also FNA framework which is a reimplementation of XNA which allows you to run the games under Linux. Thomas Frohwein, from OpenBSD, prepared a script, fnaify. Fnaify translate all dependencies used by an FNA game to OpenBSD dependencies.<br>
I decided to port the script to FreeBSD. The script is using /bin/sh which in the case of OpenBSD is a Korn Shell.</p>
</blockquote>

<blockquote>
<p>I didn’t test it with many games, but I don’t see any reason why it shouldn’t work with all the games tested by the OpenBSD guys. For example, with:</p>
</blockquote>

<ul>
<li>
<p>Cryptark</p>
</li>
<li>
<p>Rouge Legacy</p>
</li>
<li>
<p>Apotheon</p>
</li>
<li>
<p>Escape Goat</p>
</li>
<li>
<p>Bastion</p>
</li>
<li>
<p>CrossCode</p>
</li>
<li>
<p>Atom Zombie Smasher</p>
</li>
<li>
<p>Open-Source games</p>
</li>
</ul>

<blockquote>
<p>In FreeBSD and OpenBSD we also will find popular games which were open sourced. For example, I spend a lot of time playing in Quake 3 Arena on my FreeBSD machine. You can very simply install it using pkg: <code># pkg install ioquake3</code></p>
</blockquote>

<blockquote>
<p>Then move the files for the skins and maps to the .ioquake3 directory from your copy of Quake. In the past I also played UrbanTerror which is a fully open source shooter based on the Quake 3 Arena engine. It’s is also very easy to install it from ports: <code># pkg install iourbanterror</code></p>
</blockquote>

<blockquote>
<p>In the ports tree in the games directory you can find over 1000 directories, many of them with fully implemented games. I didn’t test many games in this category, but you can find some interesting titles like:</p>
</blockquote>

<ul>
<li>openxcom (Open-source re-implementation of the original X-Com)</li>
<li>openjazz (Free re-implementation of the Jazz Jackrabbit™ game engine)</li>
<li>corsixth (Open source re-implementation of Theme Hospital)</li>
<li>quake2</li>
<li>openra (Red Alert)</li>
<li>openrct2 (Open source re-implementation of RollerCoaster Tycoon 2)</li>
<li>openmw (Open source engine reimplementation of the game Morrowind)</li>
</ul>

<blockquote>
<p>All those titles are simply installed through the packages. In that case I don’t think FreeBSD has any difference from OpenBSD.</p>
</blockquote>

<ul>
<li>Wine</li>
</ul>

<blockquote>
<p>One of the big advantages of FreeBSD over OpenBSD is that FreeBSD supports wine. Wine allows you to run Windows applications under other operating systems (including mac). If you are a FreeBSD 11 user, you can simply fetch wine from packages: <code># pkg install i386-wine</code></p>
</blockquote>

<blockquote>
<p>To run Windows games, you need to have a 32-bit wine because most of the games on Windows are built on 32-bits (maybe this has changed – I don’t play so much these days). In my case, because I run FreeBSD-CURRENT I needed to build wine from ports. It wasn’t nice, but it also wasn’t unpleasant. The whole step-by-step building process of a wine from ports can be found here.</p>
</blockquote>

<ul>
<li>Summary</li>
</ul>

<blockquote>
<p>As you can see there are many titles available for *BSDs. Thanks to the FNA and fnaify, OpenBSD and FreeBSD can work with indie games which use the XNA framework. There are many interesting games implemented using this framework. Open source is not only for big server machines, and there are many re-implementations of popular games like Theme Hospital or RollerCoaster Tycoon 2. The biggest market is still enabled through wine, although its creates a lot of problems to run the games. Also, if you are an OpenBSD user only this option is not available for you. Please also note that we didn’t discuss any other emulators besides wine. In OpenBSD and FreeBSD there are many of them for GameBoy, SNES, NeoGeo and other games consoles.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://bwidawsk.net/blog/index.php/2018/11/freebsd-for-thanksgiving/">FreeBSD For Thanksgiving</a></p>

<blockquote>
<p>I’ve been working on FreeBSD for Intel for almost 6 months now. In the world of programmers, I am considered an old dog, and these 6 months have been all about learning new tricks. Luckily, I’ve found myself in a remarkably inclusive and receptive community whose patience seems plentiful. As I get ready to take some time off for the holidays, and move into that retrospective time of year, I thought I’d beat the rush a bit and update on the progress<br>
Earlier this year, I decided to move from architect of the Linux graphics driver into a more nebulous role of FreeBSD enabling. I was excited, but also uncertain if I was making the right decision.<br>
Earlier this half, I decided some general work in power management was highly important and began working there. I attended BSDCam (handsome guy on the right), and led a session on Power Management. I was honored to be able to lead this kind of effort.<br>
Earlier this quarter, I put the first round of my patches up for review, implementing suspend-to-idle. I have some rougher patches to handle s0ix support when suspending-to-idle. I gave a talk MeetBSD about our team’s work.<br>
Earlier this month, I noticed that FreeBSD doesn’t have an implementation for Intel Speed Shift (HWPstates), and I started working on that.<br>
Earlier this week, I was promoted from a lowly mentee committer to a full src committer.<br>
Earlier today, I decided to relegate my Linux laptop to the role of my backup machine, and I am writing this from my Dell XPS13 running FreeBSD</p>
</blockquote>

<p><code>vandamme 13.0-CURRENT FreeBSD 13.0-CURRENT #45 881fee072ff(hwp)-dirty: Mon Nov 19 16:19:32 PST 2018 bwidawsk@vandamme:/usr/home/bwidawsk/usr/obj/usr/home/bwidawsk/usr/src/amd64.amd64/sys/DEVMACHINE amd64</code></p>

<blockquote>
<p>6 months later, I feel a lot less uncertain about making the right decision. In fact, I think both opportunities would be great, and I’m thankful this Thanksgiving that this is my life and career. I have more plans and things I want to get done. I’m looking forward to being thankful again next year.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.garyshood.com/hammer2-space/">hammer2: no space left on device on Dragonfly BSD</a></p>

<ul>
<li>The Issue</li>
</ul>

<blockquote>
<p>hammer2 does not actually delete a file when you rm or unlink it. Since recovery of the file is possible (this is the design of hammer2), there will still be an entry taking up data. It’s similar to how git works.<br>
Even with 75% usage listed here, the filesystem could still have filled up. If you are using it as your root filesystem, then attempts to clean up data may fail. If the kernel panics over this, you will see something like this.</p>
</blockquote>

<ul>
<li>The Fix</li>
</ul>

<blockquote>
<p>If you have a recent enough version of the rescue ramdisk installed, on bootup you can press ‘r’ and access the rescue ramdisk. Your provider will have to offer some sort of remote interface for interacting with the operating system before it boots, like VNC or IPMI. You can then mount your filesystem using:</p>
</blockquote>

<p><code>[root@ ~]# mkdir /tmp/fs</code><br>
<code>[root@ ~]# mount_hammer2 -o local /dev/vbd0s1a /tmp/fs</code></p>

<blockquote>
<p>If you receive an error that /sbin/hammer2 is not found, then your rescue ramdisk is not up to date enough. In that scenario, download the latest 5.2 iso from <a href="http://dragonflybsd.org">dragonflybsd.org</a> and boot from the cd-rom on your virtual machine or physical device. Just login as root instead of installer.<br>
If the mount does succeed, then all you have to do is run the following twice:</p>
</blockquote>

<p><code>[root@ ~]# /sbin/hammer2 bulkfree /tmp/fs</code></p>

<blockquote>
<p>If you do not have enough memory on your machine, you may need to mount swap. Add your swap partition to the /etc/fstab and then do:</p>
</blockquote>

<p><code>[root@ ~]# swapon -a</code></p>

<blockquote>
<p>Once you have ran the bulkfree command twice, the usage reported by df -h will be correct. However, there is a chance on reboot that a core dump will be placed in /var/crash/ so be prepared to have plenty of space free in case that happens. You should also delete any files you can and run the bulkfree operation twice afterwards to clear up additional space.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="http://dpaste.com/1S9NMZA">BSD Pizza Night - Portland</a></li>
<li><a href="http://dpaste.com/3T0AB7M">bsd@35c3: …the place for you…*NIX!</a></li>
<li><a href="http://project-trident.org/download/">Project Trident PreRelease Image now available</a></li>
<li><a href="https://dataswamp.org/~solene/2018-11-09-stardew-valley.html">Play Stardew Valley on OpenBSD</a></li>
<li><a href="https://github.com/charlesdaniels/gmixerctl">GUI Wrapper for OpenBSD mixerctl</a></li>
<li><a href="https://github.com/q5sys/qtv/">qtv - QuickTextViewer</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Ron - <a href="http://dpaste.com/16XT6PQ#wrap">Ideas for feedback section</a></li>
<li>Paulo - <a href="http://dpaste.com/0BEE730">SDIO Firmware</a></li>
<li>Dan - <a href="http://dpaste.com/3Q7DERN#wrap">Some fun ZFS questions about labels</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Assembly language on OpenBSD, using bhyve for FreeBSD development, FreeBSD Gaming, FreeBSD for Thanksgiving, no space left on Dragonfly’s hammer2, and more.</p>

<p>##Headlines<br>
###<a href="https://cryogenix.net/OpenBSD_assembly.html">Assembly language on OpenBSD amd64+arm64</a></p>

<blockquote>
<p>This is a short introduction to assembly language programming on OpenBSD/amd64+arm64. Because of security features in the kernel, I have had to rethink a series of tutorials covering Aarch64 assembly language on OpenBSD, and therefore this will serve as a placeholder-cum-reminder.</p>
</blockquote>

<blockquote>
<p>OpenBSD, like many UNIX and unix-like operating systems, now uses the Executable and Linkable Format (ELF) for its binary libraries and executables. Although the structure of this format is beyond the scope of this short introduction, it is necessary for me to explain part of one of the headers.</p>
</blockquote>

<blockquote>
<p>Within the program header there are sections known as PT_NOTE that OpenBSD and other systems use to distinguish their ELF executables - OpenBSD looks for this section to check if it should attempt to execute the program or not.</p>
</blockquote>

<ul>
<li>Our first program: in C!</li>
</ul>

<blockquote>
<p>It’s often a good idea to prototype your assembly programs in a high level language such as C - it can then double up as both a set of notes and a working program that you can debug and compile into assembly language to compare with your own asm code.</p>
</blockquote>

<ul>
<li>See the article for the rest on:</li>
<li>Our first program: in x86-64 Asm (AT&amp;T/GAS syntax)</li>
<li>Our first program: in inline x86-64 assembly</li>
<li>Our first program: in x86-64 asm (NASM syntax)</li>
<li>Our first program: in ARMv8 AArch64 assembly</li>
</ul>

<p><hr></p>

<p>###<a href="https://bsdjhb.blogspot.com/2018/10/using-bhyve-for-freebsd-development.html">Using bhyve for FreeBSD Development</a></p>

<ul>
<li>The Hypervisor</li>
</ul>

<blockquote>
<p>The bhyve hypervisor requires a 64-bit x86 processor with hardware support for virtualization.  This requirement allows for a simple, clean hypervisor implementation, but it does require a fairly recent<br>
processor.  The current hypervisor requires an Intel processor, but there is an active development branch with support for AMD processors.<br>
The hypervisor itself contains both user and kernel components.  The kernel driver is contained in the vmm.ko module and can be loaded either at boot from the boot loader or at runtime.  It must<br>
be loaded before any guests can be created.  When a guest is created, the kernel driver creates a device file in /dev/vmm which is used by the user programs to interact with the guest.<br>
The primary user component is the bhyve(8) program.  It constructs the emulated device tree in the guest and provides the implementation for most of the emulated devices.  It also calls the kernel driver to execute the guest.  Note that the guest always executes inside the driver itself, so guest execution time in the host is counted as system time in the bhyve process.<br>
Currently, bhyve does not provide a system firmware interface to the guest (neither BIOS nor UEFI).  Instead, a user program running on the host is used to perform boot time operations including loading the guest operating system kernel into the guest’s memory and setting the initial guest state so that the guest begins execution at the kernel’s entry point.  For FreeBSD guests, the bhyveload(8) program can be used to load the kernel and prepare the guest for execution.  Support for some other operating systems is available via the grub2-bhyve program which is available via the sysutils/grub2-bhyve port or as a prebuilt package.<br>
The bhyveload(8) program in FreeBSD 10.0 only supports 64-bit guests.  Support for 32-bit guests will be included in FreeBSD 10.1.</p>
</blockquote>

<ul>
<li>
<p>See the article for the very technical breakdown of the following:</p>
</li>
<li>
<p>Network Setup</p>
</li>
<li>
<p>Bridged Configuration</p>
</li>
<li>
<p>Private Network with NAT</p>
</li>
<li>
<p>Using dnsmasq with a Private Network</p>
</li>
<li>
<p>Running Guests via <a href="http://vmrun.sh">vmrun.sh</a></p>
</li>
<li>
<p>Configuring Guests</p>
</li>
<li>
<p>Using a bhyve Guest as a Target</p>
</li>
<li>
<p>Conclusion</p>
</li>
</ul>

<blockquote>
<p>The bhyve hypervisor is a nice addition to a FreeBSD developer’s toolbox.  Guests can be used both to develop new features and to test merges to stable branches.  The hypervisor has a wide variety of uses beyond developing FreeBSD as well.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://oshogbo.vexillium.org/blog/58/">Games on FreeBSD</a></p>

<blockquote>
<p>What do all programmers like to do after work? Ok, what do most programers like to do after work? The answer is simple: play a good game! Recently at the Polish BSD User Group meetup mulander was telling us how you can play games on OpenBSD. Today let’s discuss how this looks in the FreeBSD world using the “server only” operating system.</p>
</blockquote>

<ul>
<li>XNA based games</li>
</ul>

<blockquote>
<p>One of the ways of playing natively is to play indie games which use XNA. XNA is a framework from Microsoft which uses .NET, for creating games. Fortunately, in the BSD world we have Mono, an open source implementation of Microsoft’s .NET Framework which you can use to run games. There is also FNA framework which is a reimplementation of XNA which allows you to run the games under Linux. Thomas Frohwein, from OpenBSD, prepared a script, fnaify. Fnaify translate all dependencies used by an FNA game to OpenBSD dependencies.<br>
I decided to port the script to FreeBSD. The script is using /bin/sh which in the case of OpenBSD is a Korn Shell.</p>
</blockquote>

<blockquote>
<p>I didn’t test it with many games, but I don’t see any reason why it shouldn’t work with all the games tested by the OpenBSD guys. For example, with:</p>
</blockquote>

<ul>
<li>
<p>Cryptark</p>
</li>
<li>
<p>Rouge Legacy</p>
</li>
<li>
<p>Apotheon</p>
</li>
<li>
<p>Escape Goat</p>
</li>
<li>
<p>Bastion</p>
</li>
<li>
<p>CrossCode</p>
</li>
<li>
<p>Atom Zombie Smasher</p>
</li>
<li>
<p>Open-Source games</p>
</li>
</ul>

<blockquote>
<p>In FreeBSD and OpenBSD we also will find popular games which were open sourced. For example, I spend a lot of time playing in Quake 3 Arena on my FreeBSD machine. You can very simply install it using pkg: <code># pkg install ioquake3</code></p>
</blockquote>

<blockquote>
<p>Then move the files for the skins and maps to the .ioquake3 directory from your copy of Quake. In the past I also played UrbanTerror which is a fully open source shooter based on the Quake 3 Arena engine. It’s is also very easy to install it from ports: <code># pkg install iourbanterror</code></p>
</blockquote>

<blockquote>
<p>In the ports tree in the games directory you can find over 1000 directories, many of them with fully implemented games. I didn’t test many games in this category, but you can find some interesting titles like:</p>
</blockquote>

<ul>
<li>openxcom (Open-source re-implementation of the original X-Com)</li>
<li>openjazz (Free re-implementation of the Jazz Jackrabbit™ game engine)</li>
<li>corsixth (Open source re-implementation of Theme Hospital)</li>
<li>quake2</li>
<li>openra (Red Alert)</li>
<li>openrct2 (Open source re-implementation of RollerCoaster Tycoon 2)</li>
<li>openmw (Open source engine reimplementation of the game Morrowind)</li>
</ul>

<blockquote>
<p>All those titles are simply installed through the packages. In that case I don’t think FreeBSD has any difference from OpenBSD.</p>
</blockquote>

<ul>
<li>Wine</li>
</ul>

<blockquote>
<p>One of the big advantages of FreeBSD over OpenBSD is that FreeBSD supports wine. Wine allows you to run Windows applications under other operating systems (including mac). If you are a FreeBSD 11 user, you can simply fetch wine from packages: <code># pkg install i386-wine</code></p>
</blockquote>

<blockquote>
<p>To run Windows games, you need to have a 32-bit wine because most of the games on Windows are built on 32-bits (maybe this has changed – I don’t play so much these days). In my case, because I run FreeBSD-CURRENT I needed to build wine from ports. It wasn’t nice, but it also wasn’t unpleasant. The whole step-by-step building process of a wine from ports can be found here.</p>
</blockquote>

<ul>
<li>Summary</li>
</ul>

<blockquote>
<p>As you can see there are many titles available for *BSDs. Thanks to the FNA and fnaify, OpenBSD and FreeBSD can work with indie games which use the XNA framework. There are many interesting games implemented using this framework. Open source is not only for big server machines, and there are many re-implementations of popular games like Theme Hospital or RollerCoaster Tycoon 2. The biggest market is still enabled through wine, although its creates a lot of problems to run the games. Also, if you are an OpenBSD user only this option is not available for you. Please also note that we didn’t discuss any other emulators besides wine. In OpenBSD and FreeBSD there are many of them for GameBoy, SNES, NeoGeo and other games consoles.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://bwidawsk.net/blog/index.php/2018/11/freebsd-for-thanksgiving/">FreeBSD For Thanksgiving</a></p>

<blockquote>
<p>I’ve been working on FreeBSD for Intel for almost 6 months now. In the world of programmers, I am considered an old dog, and these 6 months have been all about learning new tricks. Luckily, I’ve found myself in a remarkably inclusive and receptive community whose patience seems plentiful. As I get ready to take some time off for the holidays, and move into that retrospective time of year, I thought I’d beat the rush a bit and update on the progress<br>
Earlier this year, I decided to move from architect of the Linux graphics driver into a more nebulous role of FreeBSD enabling. I was excited, but also uncertain if I was making the right decision.<br>
Earlier this half, I decided some general work in power management was highly important and began working there. I attended BSDCam (handsome guy on the right), and led a session on Power Management. I was honored to be able to lead this kind of effort.<br>
Earlier this quarter, I put the first round of my patches up for review, implementing suspend-to-idle. I have some rougher patches to handle s0ix support when suspending-to-idle. I gave a talk MeetBSD about our team’s work.<br>
Earlier this month, I noticed that FreeBSD doesn’t have an implementation for Intel Speed Shift (HWPstates), and I started working on that.<br>
Earlier this week, I was promoted from a lowly mentee committer to a full src committer.<br>
Earlier today, I decided to relegate my Linux laptop to the role of my backup machine, and I am writing this from my Dell XPS13 running FreeBSD</p>
</blockquote>

<p><code>vandamme 13.0-CURRENT FreeBSD 13.0-CURRENT #45 881fee072ff(hwp)-dirty: Mon Nov 19 16:19:32 PST 2018 bwidawsk@vandamme:/usr/home/bwidawsk/usr/obj/usr/home/bwidawsk/usr/src/amd64.amd64/sys/DEVMACHINE amd64</code></p>

<blockquote>
<p>6 months later, I feel a lot less uncertain about making the right decision. In fact, I think both opportunities would be great, and I’m thankful this Thanksgiving that this is my life and career. I have more plans and things I want to get done. I’m looking forward to being thankful again next year.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.garyshood.com/hammer2-space/">hammer2: no space left on device on Dragonfly BSD</a></p>

<ul>
<li>The Issue</li>
</ul>

<blockquote>
<p>hammer2 does not actually delete a file when you rm or unlink it. Since recovery of the file is possible (this is the design of hammer2), there will still be an entry taking up data. It’s similar to how git works.<br>
Even with 75% usage listed here, the filesystem could still have filled up. If you are using it as your root filesystem, then attempts to clean up data may fail. If the kernel panics over this, you will see something like this.</p>
</blockquote>

<ul>
<li>The Fix</li>
</ul>

<blockquote>
<p>If you have a recent enough version of the rescue ramdisk installed, on bootup you can press ‘r’ and access the rescue ramdisk. Your provider will have to offer some sort of remote interface for interacting with the operating system before it boots, like VNC or IPMI. You can then mount your filesystem using:</p>
</blockquote>

<p><code>[root@ ~]# mkdir /tmp/fs</code><br>
<code>[root@ ~]# mount_hammer2 -o local /dev/vbd0s1a /tmp/fs</code></p>

<blockquote>
<p>If you receive an error that /sbin/hammer2 is not found, then your rescue ramdisk is not up to date enough. In that scenario, download the latest 5.2 iso from <a href="http://dragonflybsd.org">dragonflybsd.org</a> and boot from the cd-rom on your virtual machine or physical device. Just login as root instead of installer.<br>
If the mount does succeed, then all you have to do is run the following twice:</p>
</blockquote>

<p><code>[root@ ~]# /sbin/hammer2 bulkfree /tmp/fs</code></p>

<blockquote>
<p>If you do not have enough memory on your machine, you may need to mount swap. Add your swap partition to the /etc/fstab and then do:</p>
</blockquote>

<p><code>[root@ ~]# swapon -a</code></p>

<blockquote>
<p>Once you have ran the bulkfree command twice, the usage reported by df -h will be correct. However, there is a chance on reboot that a core dump will be placed in /var/crash/ so be prepared to have plenty of space free in case that happens. You should also delete any files you can and run the bulkfree operation twice afterwards to clear up additional space.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="http://dpaste.com/1S9NMZA">BSD Pizza Night - Portland</a></li>
<li><a href="http://dpaste.com/3T0AB7M">bsd@35c3: …the place for you…*NIX!</a></li>
<li><a href="http://project-trident.org/download/">Project Trident PreRelease Image now available</a></li>
<li><a href="https://dataswamp.org/~solene/2018-11-09-stardew-valley.html">Play Stardew Valley on OpenBSD</a></li>
<li><a href="https://github.com/charlesdaniels/gmixerctl">GUI Wrapper for OpenBSD mixerctl</a></li>
<li><a href="https://github.com/q5sys/qtv/">qtv - QuickTextViewer</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Ron - <a href="http://dpaste.com/16XT6PQ#wrap">Ideas for feedback section</a></li>
<li>Paulo - <a href="http://dpaste.com/0BEE730">SDIO Firmware</a></li>
<li>Dan - <a href="http://dpaste.com/3Q7DERN#wrap">Some fun ZFS questions about labels</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 273: A Thoughtful Episode | BSD Now 273</title>
  <link>https://www.bsdnow.tv/273</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2927</guid>
  <pubDate>Fri, 23 Nov 2018 02:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/19a116b3-098d-40a2-bf74-28c99f8023e1.mp3" length="44912747" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Thoughts on NetBSD 8.0, Monitoring love for a GigaBit OpenBSD firewall, cat’s source history, X.org root permission bug, thoughts on OpenBSD as a desktop, and NomadBSD review.</itunes:subtitle>
  <itunes:duration>1:14:32</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Thoughts on NetBSD 8.0, Monitoring love for a GigaBit OpenBSD firewall, cat’s source history, X.org root permission bug, thoughts on OpenBSD as a desktop, and NomadBSD review.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://distrowatch.com/weekly.php?issue=20181119#netbsd"&gt;Some thoughts on NetBSD 8.0&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;NetBSD is a highly portable operating system which can be run on dozens of different hardware architectures. The operating system’s clean and minimal design allow it to be run in all sorts of environments, ranging from embedded devices, to servers, to workstations. While the base operating system is minimal, NetBSD users have access to a large repository of binary packages and a ports tree which I will touch upon later.&lt;br&gt;
I last tried NetBSD 7.0 about three years ago and decided it was time to test drive the operating system again. In the past three years NetBSD has introduced a few new features, many of them security enhancements. For example, NetBSD now supports write exclusive-or execute (W^X) protection and address space layout randomization (ASLR) to protect programs against common attacks. NetBSD 8.0 also includes USB3 support and the ability to work with ZFS storage volumes.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Early impressions&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Since I had set up NetBSD with a Full install and enabled xdm during the setup process, the operating system booted to a graphical login screen. From here we can sign into our account. The login screen does not provide options to shut down or restart the computer. Logging into our account brings up the twm window manager and provides a virtual terminal, courtesy of xterm. There is a panel that provides a method for logging out of the window manager. The twm environment is sparse, fast and devoid of distractions.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Software management&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;NetBSD ships with a fairly standard collection of command line tools and manual pages, but otherwise it is a fairly minimal platform. If we want to run network services, have access to a web browser, or use a word processor we are going to need to install more software. There are two main approaches to installing new packages. The first, and easier approach, is to use the pkgin package manager. The pkgin utility works much the same way APT or DNF work in the Linux world, or as pkg works on FreeBSD. We can search for software by name, install or remove items. I found pkgin worked well, though its output can be terse. My only complaint with pkgin is that it does not handle “close enough” package names. For example, if I tried to run “pkgin install vlc” or “pkgin install firefox” I would quickly be told these items did not exist. But a more forgiving package manager will realize items like vlc2 or firefox45 are available and offer to install those.&lt;br&gt;
The pkgin tool installs new programs in the /usr/pkg/bin directory. Depending on your configuration and shell, this location may not be in your user’s path, and it will be helpful to adjust your PATH variable accordingly.&lt;br&gt;
The other common approach to acquiring new software is to use the pkgsrc framework. I have talked about using pkgsrc before and I will skip the details. Basically, we can download a collection of recipes for building popular open source software and run a command to download and install these items from their source code. Using pkgsrc basically gives us the same software as using pkgin would, but with some added flexibility on the options we use.&lt;br&gt;
Once new software has been installed, it may need to be enabled and activated, particularly if it uses (or is) a background service. New items can be enabled in the /etc/rc.conf file and started or stopped using the service command. This works about the same as the service command on FreeBSD and most non-systemd Linux distributions.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Hardware&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I found that, when logged into the twm environment, NetBSD used about 130MB of RAM. This included kernel memory and all active memory. A fresh, Full install used up 1.5GB of disk space. I generally found NetBSD ran well in both VirtualBox and on my desktop computer. The system was quick and stable. I did have trouble getting a higher screen resolution in both environments. NetBSD does not offer VirtualBox add-on modules. There are NetBSD patches for VirtualBox out there, but there is some manual work involved in getting them working. When running on my desktop computer I think the resolution issue was one of finding and dealing with the correct video driver. Screen resolution aside, NetBSD performed well and detected all my hardware.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Personal projects&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Since NetBSD provides users with a small, core operating system without many utilities if we want to use NetBSD for something we need to have a project in mind. I had four mini projects in mind I wanted to try this week: install a desktop environment, enable file sharing for computers on the local network, test multimedia (video, audio and YouTube capabilities), and set up a ZFS volume for storage.&lt;br&gt;
I began with the desktop. Specifically, I followed the same tutorial I used three years ago to try to set up the Xfce desktop. While Xfce and its supporting services installed, I was unable to get a working desktop out of the experience. I could get the Xfce window manager working, but not the entire session. This tutorial worked beautifully with NetBSD 7.0, but not with version 8.0. Undeterred, I switched gears and installed Fluxbox instead. This gave me a slightly more powerful graphical environment than what I had before with twm while maintaining performance. Fluxbox ran without any problems, though its application menu was automatically populated with many programs which were not actually installed.&lt;br&gt;
Next, I tried installing a few multimedia applications to play audio and video files. Here I ran into a couple of interesting problems. I found the music players I installed would play audio files, but the audio was quite slow. It always sounded like a cassette tape dragging. When I tried to play a video, the entire graphical session would crash, taking me back to the login screen. When I installed Firefox, I found I could play YouTube videos, and the video played smoothly, but again the audio was unusually slow.&lt;br&gt;
I set up two methods of sharing files on the local network: OpenSSH and FTP. NetBSD basically gives us OpenSSH for free at install time and I added an FTP server through the pkgin package manager which worked beautifully with its default configuration.&lt;br&gt;
I experimented with ZFS support a little, just enough to confirm I could create and access ZFS volumes. ZFS seems to work on NetBSD just as well, and with the same basic features, as it does on FreeBSD and mainstream Linux distributions. I think this is a good feature for the portable operating system to have since it means we can stick NetBSD on nearly any networked computer and use it as a NAS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Conclusions&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;NetBSD, like its close cousins (FreeBSD and OpenBSD) does not do a lot of hand holding or automation. It offers a foundation that will run on most CPUs and we can choose to build on that foundation. I mention this because, on its own, NetBSD does not do much. If we want to get something out of it, we need to be willing to build on its foundation - we need a project. This is important to keep in mind as I think going into NetBSD and thinking, “Oh I’ll just explore around and expand on this as I go,” will likely lead to disappointment. I recommend figuring out what you want to do before installing NetBSD and making sure the required tools are available in the operating system’s repositories.&lt;br&gt;
Some of the projects I embarked on this week (using ZFS and setting up file sharing) worked well. Others, like getting multimedia support and a full-featured desktop, did not. Given more time, I’m sure I could find a suitable desktop to install (along with the required documentation to get it and its services running), or customize one based on one of the available window managers. However, any full featured desktop is going to require some manual work. Media support was not great. The right players and codecs were there, but I was not able to get audio to play smoothly.&lt;br&gt;
My main complaint with NetBSD relates to my struggle to get some features working to my satisfaction: the documentation is scattered. There are four different sections of the project’s website for documentation (FAQs, The Guide, manual pages and the wiki). Whatever we are looking for is likely to be in one of those, but which one? Or, just as likely, the tutorial we want is not there, but is on a forum or blog somewhere. I found that the documentation provided was often thin, more of a quick reference to remind people how something works rather than a full explanation.&lt;br&gt;
As an example, I found a couple of documents relating to setting up a firewall. One dealt with networking NetBSD on a LAN, another explored IPv6 support, but neither gave an overview on syntax or a basic guide to blocking all but one or two ports. It seemed like that information should already be known, or picked up elsewhere.&lt;br&gt;
Newcomers are likely to be a bit confused by software management guides for the same reason. Some pages refer to using a tool called pkg_add, others use pkgsrc and its make utility, others mention pkgin. Ultimately, these tools each give approximately the same result, but work differently and yet are mentioned almost interchangeably. I have used NetBSD before a few times and could stumble through these guides, but new users are likely to come away confused.&lt;br&gt;
One quirk of NetBSD, which may be a security feature or an inconvenience, depending on one’s point of view, is super user programs are not included in regular users’ paths. This means we need to change our path if we want to be able to run programs typically used by root. For example, shutdown and mount are not in regular users’ paths by default. This made checking some things tricky for me.&lt;br&gt;
Ultimately though, NetBSD is not famous for its convenience or features so much as its flexibility. The operating system will run on virtually any processor and should work almost identically across multiple platforms. That gives NetBSD users a good deal of consistency across a range of hardware and the chance to experiment with a member of the Unix family on hardware that might not be compatible with Linux or the other BSDs.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://tech.mangot.com/blog/2018/11/08/showing-a-gigabit-openbsd-firewall-some-monitoring-love/"&gt;Showing a Gigabit OpenBSD Firewall Some Monitoring Love&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I have a pretty long history of running my home servers or firewalls on “exotic” hardware. At first, it was Sun Microsystem hardware, then it moved to the excellent Soekris line, with some cool single board computers thrown in the mix. Recently I’ve been running OpenBSD Octeon on the Ubiquiti Edge Router Lite, an amazing little piece of kit at an amazing price point.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Upgrade Time!&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;This setup has served me for some time and I’ve been extremely happy with it. But, in the #firstworldproblems category, I recently upgraded the household to the amazing Gigabit fibre offering from Sonic. A great problem to have, but also too much of a problem for the little Edge Router Lite (ERL).&lt;br&gt;
The way the OpenBSD PF firewall works, it’s only able to process packets on a single core. Not a problem for the dual-core 500 MHz ERL when you’re pushing under ~200 Mbps, but more of a problem when you’re trying to push 1000 Mbps.&lt;br&gt;
I needed something that was faster on a per core basis but still satisfied my usual firewall requirements. Loosely:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;small form factor&lt;/li&gt;
&lt;li&gt;fan-less&lt;/li&gt;
&lt;li&gt;multiple Intel Ethernet ports (good driver support)&lt;/li&gt;
&lt;li&gt;low power consumption&lt;/li&gt;
&lt;li&gt;not your regular off-the-shelf kit&lt;/li&gt;
&lt;li&gt;relatively inexpensive&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;After evaluating a LOT of different options I settled on the Protectli Vault FW2B. With the specs required for the firewall (2 GB RAM and 8 GB drive) it comes in at a mere $239 USD! Installation of OpenBSD 6.4 was pretty straight forward, with the only problem I had was Etcher did not want to recognize the ‘.fs’ extension on the install image as bootable image. I quickly fixed this with good old Unix dd(1) on the Mac. Everything else was incredibly smooth.&lt;br&gt;
After loading the same rulesets on my new install, the results were fantastic!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Monitoring&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Now that the machine was up and running (and fast!), I wanted to know what it was doing. Over the years, I’ve always relied on the venerable pfstat software to give me an overview of my traffic, blocked packets, etc. It looks like this:&lt;br&gt;
As you can see it’s based on RRDtool, which was simply incredible in its time. Having worked on monitoring almost continuously for almost the past decade, I wanted to see if we could re-implement the same functionality using more modern tools as RRDtool and pfstat definitely have their limitations. This might be an opportunity to learn some new things as well.&lt;br&gt;
I came across pf-graphite which seemed to be a great start! He had everything I needed and I added a few more stats from the detailed interface statistics and the ability for the code to exit for running from cron(8), which is a bit more OpenBSD style. I added code for sending to some SaaS metrics platforms but ultimately stuck with straight Graphite. One important thing to note was to use the Graphite pickle port (2004) instead of the default plaintext port for submission. Also you will need to set a loginterface in your ‘pf.conf’.&lt;br&gt;
A bit of tweaking with Graphite and Grafana, and I had a pretty darn good recreation of my original PF stats dashboard!&lt;br&gt;
As you can see it’s based on RRDtool, which was simply incredible in its time. Having worked on monitoring almost continuously for almost the past decade, I wanted to see if we could re-implement the same functionality using more modern tools as RRDtool and pfstat definitely have their limitations. This might be an opportunity to learn some new things as well.&lt;br&gt;
I came across pf-graphite which seemed to be a great start! He had everything I needed and I added a few more stats from the detailed interface statistics and the ability for the code to exit for running from cron(8), which is a bit more OpenBSD style. I added code for sending to some SaaS metrics platforms but ultimately stuck with straight Graphite. One important thing to note was to use the Graphite pickle port (2004) instead of the default plaintext port for submission. Also you will need to set a loginterface in your ‘pf.conf’.&lt;br&gt;
A bit of tweaking with Graphite and Grafana, and I had a pretty darn good recreation of my original PF stats dashboard!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;###&lt;a href="https://twobithistory.org/2018/11/12/cat.html"&gt;The Source History of Cat&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I once had a debate with members of my extended family about whether a computer science degree is a degree worth pursuing. I was in college at the time and trying to decide whether I should major in computer science. My aunt and a cousin of mine believed that I shouldn’t. They conceded that knowing how to program is of course a useful and lucrative thing, but they argued that the field of computer science advances so quickly that everything I learned would almost immediately be outdated. Better to pick up programming on the side and instead major in a field like economics or physics where the basic principles would be applicable throughout my lifetime.&lt;br&gt;
I knew that my aunt and cousin were wrong and decided to major in computer science. (Sorry, aunt and cousin!) It is easy to see why the average person might believe that a field like computer science, or a profession like software engineering, completely reinvents itself every few years. We had personal computers, then the web, then phones, then machine learning… technology is always changing, so surely all the underlying principles and techniques change too. Of course, the amazing thing is how little actually changes. Most people, I’m sure, would be stunned to know just how old some of the important software on their computer really is. I’m not talking about flashy application software, admittedly—my copy of Firefox, the program I probably use the most on my computer, is not even two weeks old. But, if you pull up the manual page for something like grep, you will see that it has not been updated since 2010 (at least on MacOS). And the original version of grep was written in 1974, which in the computing world was back when dinosaurs roamed Silicon Valley. People (and programs) still depend on grep every day.&lt;br&gt;
My aunt and cousin thought of computer technology as a series of increasingly elaborate sand castles supplanting one another after each high tide clears the beach. The reality, at least in many areas, is that we steadily accumulate programs that have solved problems. We might have to occasionally modify these programs to avoid software rot, but otherwise they can be left alone.  grep is a simple program that solves a still-relevant problem, so it survives. Most application programming is done at a very high level, atop a pyramid of much older code solving much older problems. The ideas and concepts of 30 or 40 years ago, far from being obsolete today, have in many cases been embodied in software that you can still find installed on your laptop.&lt;br&gt;
I thought it would be interesting to take a look at one such old program and see how much it had changed since it was first written. cat is maybe the simplest of all the Unix utilities, so I’m going to use it as my example. Ken Thompson wrote the original implementation of cat in 1969. If I were to tell somebody that I have a program on my computer from 1969, would that be accurate? How much has cat really evolved over the decades? How old is the software on our computers?&lt;br&gt;
Thanks to repositories like this one, we can see exactly how cat has evolved since 1969. I’m going to focus on implementations of cat that are ancestors of the implementation I have on my Macbook. You will see, as we trace cat from the first versions of Unix down to the cat in MacOS today, that the program has been rewritten more times than you might expect—but it ultimately works more or less the same way it did fifty years ago.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Research Unix&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Ken Thompson and Dennis Ritchie began writing Unix on a PDP 7. This was in 1969, before C, so all of the early Unix software was written in PDP 7 assembly. The exact flavor of assembly they used was unique to Unix, since Ken Thompson wrote his own assembler that added some features on top of the assembler provided by DEC, the PDP 7’s manufacturer. Thompson’s changes are all documented in the original Unix Programmer’s Manual under the entry for as, the assembler.&lt;br&gt;
The first implementation of cat is thus in PDP 7 assembly. I’ve added comments that try to explain what each instruction is doing, but the program is still difficult to follow unless you understand some of the extensions Thompson made while writing his assembler. There are two important ones. First, the ; character can be used to separate multiple statements on the same line. It appears that this was used most often to put system call arguments on the same line as the sys instruction. Second, Thompson added support for “temporary labels” using the digits 0 through 9. These are labels that can be reused throughout a program, thus being, according to the Unix Programmer’s Manual, “less taxing both on the imagination of the programmer and on the symbol space of the assembler.” From any given instruction, you can refer to the next or most recent temporary label n using nf and nb respectively. For example, if you have some code in a block labeled 1:, you can jump back to that block from further down by using the instruction jmp 1b. (But you cannot jump forward to that block from above without using jmp 1f instead.)&lt;br&gt;
The most interesting thing about this first version of cat is that it contains two names we should recognize. There is a block of instructions labeled getc and a block of instructions labeled putc, demonstrating that these names are older than the C standard library. The first version of cat actually contained implementations of both functions. The implementations buffered input so that reads and writes were not done a character at a time.&lt;br&gt;
The first version of cat did not last long. Ken Thompson and Dennis Ritchie were able to persuade Bell Labs to buy them a PDP 11 so that they could continue to expand and improve Unix. The PDP 11 had a different instruction set, so cat had to be rewritten. I’ve marked up this second version of cat with comments as well. It uses new assembler mnemonics for the new instruction set and takes advantage of the PDP 11’s various addressing modes. (If you are confused by the parentheses and dollar signs in the source code, those are used to indicate different addressing modes.) But it also leverages the  ; character and temporary labels just like the first version of cat, meaning that these features must have been retained when as was adapted for the PDP 11.&lt;br&gt;
The second version of cat is significantly simpler than the first. It is also more “Unix-y” in that it doesn’t just expect a list of filename arguments—it will, when given no arguments, read from stdin, which is what cat still does today. You can also give this version of cat an argument of - to indicate that it should read from stdin.&lt;br&gt;
In 1973, in preparation for the release of the Fourth Edition of Unix, much of Unix was rewritten in C. But cat does not seem to have been rewritten in C until a while after that. The first C implementation of cat only shows up in the Seventh Edition of Unix. This implementation is really fun to look through because it is so simple. Of all the implementations to follow, this one most resembles the idealized cat used as a pedagogic demonstration in K&amp;amp;R C. The heart of the program is the classic two-liner:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;while ((c = getc(fi)) != EOF)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;putchar(c);&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;There is of course quite a bit more code than that, but the extra code is mostly there to ensure that you aren’t reading and writing to the same file. The other interesting thing to note is that this implementation of cat only recognized one flag, -u. The -u flag could be used to avoid buffering input and output, which cat would otherwise do in blocks of 512 bytes.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;BSD&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;After the Seventh Edition, Unix spawned all sorts of derivatives and offshoots. MacOS is built on top of Darwin, which in turn is derived from the Berkeley Software Distribution (BSD), so BSD is the Unix offshoot we are most interested in. BSD was originally just a collection of useful programs and add-ons for Unix, but it eventually became a complete operating system. BSD seems to have relied on the original cat implementation up until the fourth BSD release, known as 4BSD, when support was added for a whole slew of new flags. The 4BSD implementation of cat is clearly derived from the original implementation, though it adds a new function to implement the behavior triggered by the new flags. The naming conventions already used in the file were adhered to—the fflg variable, used to mark whether input was being read from stdin or a file, was joined by nflg, bflg, vflg, sflg, eflg, and  tflg, all there to record whether or not each new flag was supplied in the invocation of the program. These were the last command-line flags added to  cat; the man page for cat today lists these flags and no others, at least on Mac OS. 4BSD was released in 1980, so this set of flags is 38 years old.&lt;br&gt;
cat would be entirely rewritten a final time for BSD Net/2, which was, among other things, an attempt to avoid licensing issues by replacing all AT&amp;amp;T Unix-derived code with new code. BSD Net/2 was released in 1991. This final rewrite of cat was done by Kevin Fall, who graduated from Berkeley in 1988 and spent the next year working as a staff member at the Computer Systems Research Group (CSRG). Fall told me that a list of Unix utilities still implemented using AT&amp;amp;T code was put up on a wall at CSRG and staff were told to pick the utilities they wanted to reimplement. Fall picked cat and  mknod. The cat implementation bundled with MacOS today is built from a source file that still bears his name at the very top. His version of cat, even though it is a relatively trivial program, is today used by millions.&lt;br&gt;
Fall’s original implementation of cat is much longer than anything we have seen so far. Other than support for a -? help flag, it adds nothing in the way of new functionality. Conceptually, it is very similar to the 4BSD implementation. It is only longer because Fall separates the implementation into a “raw” mode and a “cooked” mode. The “raw” mode is cat classic; it prints a file character for character. The “cooked” mode is cat with all the 4BSD command-line options. The distinction makes sense but it also pads out the implementation so that it seems more complex at first glance than it actually is. There is also a fancy error handling function at the end of the file that further adds to its length.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;MacOS&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The very first release of Mac OS X thus includes an implementation of cat pulled from the NetBSD project. So the first Mac OS X implementation of cat is Kevin Fall’s cat. The only thing that had changed over the intervening decade was that Fall’s error-handling function err() was removed and the err() function made available by err.h was used in its place. err.h is a BSD extension to the C standard library.&lt;br&gt;
The NetBSD implementation of cat was later swapped out for FreeBSD’s implementation of cat. According to Wikipedia, Apple began using FreeBSD instead of NetBSD in Mac OS X 10.3 (Panther). But the Mac OS X implementation of cat, according to Apple’s own open source releases, was not replaced until Mac OS X 10.5 (Leopard) was released in 2007. The FreeBSD implementation that Apple swapped in for the Leopard release is the same implementation on Apple computers today. As of 2018, the implementation has not been updated or changed at all since 2007.&lt;br&gt;
So the Mac OS cat is old. As it happens, it is actually two years older than its 2007 appearance in MacOS X would suggest. This 2005 change, which is visible in FreeBSD’s Github mirror, was the last change made to FreeBSD’s cat before Apple pulled it into Mac OS X. So the Mac OS X cat implementation, which has not been kept in sync with FreeBSD’s cat implementation, is officially 13 years old. There’s a larger debate to be had about how much software can change before it really counts as the same software; in this case, the source file has not changed at all since 2005.&lt;br&gt;
The cat implementation used by Mac OS today is not that different from the implementation that Fall wrote for the 1991 BSD Net/2 release. The biggest difference is that a whole new function was added to provide Unix domain socket support. At some point, a FreeBSD developer also seems to have decided that Fall’s rawargs() function and cookargs() should be combined into a single function called scanfiles(). Otherwise, the heart of the program is still Fall’s code.&lt;br&gt;
I asked Fall how he felt about having written the cat implementation now used by millions of Apple users, either directly or indirectly through some program that relies on cat being present. Fall, who is now a consultant and a co-author of the most recent editions of TCP/IP Illustrated, says that he is surprised when people get such a thrill out of learning about his work on cat. Fall has had a long career in computing and has worked on many high-profile projects, but it seems that many people still get most excited about the six months of work he put into rewriting cat in 1989.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The Hundred-Year-Old Program&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;In the grand scheme of things, computers are not an old invention. We’re used to hundred-year-old photographs or even hundred-year-old camera footage. But computer programs are in a different category—they’re high-tech and new. At least, they are now. As the computing industry matures, will we someday find ourselves using programs that approach the hundred-year-old mark?&lt;br&gt;
Computer hardware will presumably change enough that we won’t be able to take an executable compiled today and run it on hardware a century from now. Perhaps advances in programming language design will also mean that nobody will understand C in the future and cat will have long since been rewritten in another language. (Though C has already been around for fifty years, and it doesn’t look like it is about to be replaced any time soon.) But barring all that, why not just keep using the cat we have forever?&lt;br&gt;
I think the history of cat shows that some ideas in computer science are in fact very durable. Indeed, with cat, both the idea and the program itself are old. It may not be accurate to say that the cat on my computer is from 1969. But I could make a case for saying that the cat on my computer is from 1989, when Fall wrote his implementation of cat. Lots of other software is just as ancient. So maybe we shouldn’t think of computer science and software development primarily as fields that disrupt the status quo and invent new things. Our computer systems are built out of historical artifacts. At some point, we may all spend more time trying to understand and maintain those historical artifacts than we spend writing new code.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://www.bleepingcomputer.com/news/security/trivial-bug-in-xorg-gives-root-permission-on-linux-and-bsd-systems/"&gt;Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;A vulnerability that is trivial to exploit allows privilege escalation to root level on Linux and BSD distributions using &lt;a href="http://X.Org"&gt;X.Org&lt;/a&gt; server, the open source implementation of the X Window System that offers the graphical environment.&lt;br&gt;
The flaw is now identified as CVE-2018-14665 (credited to security researcher Narendra Shinde). It has been present in xorg-server for two years, since version 1.19.0 and is exploitable by a limited user as long as the X server runs with elevated permissions.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Privilege escalation and arbitrary file overwrite&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;An advisory on Thursday describes the problem as an “incorrect command-line parameter validation” that also allows an attacker to overwrite arbitrary files.&lt;br&gt;
Privilege escalation can be accomplished via the -modulepath argument by setting an insecure path to modules loaded by the &lt;a href="http://X.org"&gt;X.org&lt;/a&gt; server. Arbitrary file overwrite is possible through the -logfile argument, because of improper verification when parsing the option.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Bug could have been avoided in OpenBSD 6.4&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;OpenBSD, the free and open-source operating system with a strong focus on security, uses xorg. On October 18, the project released version 6.4 of the OS, affected by CVE-2018-14665. This could have been avoided, though.&lt;br&gt;
Theo de Raadt, founder and leader of the OpenBSD project, says that X maintainer knew about the problem since at least October 11. For some reason, the OpenBSD developers received the message one hour before the public announcement this Thursday, a week after their new OS release.&lt;br&gt;
“As yet we don’t have answers about why our X maintainer (on the X security team) and his team provided information to other projects (some who don’t even ship with this new X server) but chose to not give us a heads-up which could have saved all the new 6.4 users a lot of grief,” Raadt says.&lt;br&gt;
Had OpenBSD developers known about the bug before the release, they could have taken steps to mitigate the problem or delay the launch for a week or two.&lt;br&gt;
To remedy the problem, the OpenBSD project provides a source code patch, which requires compiling and rebuilding the X server.&lt;br&gt;
As a temporary solution, users can disable the Xorg binary by running the following command:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;chmod u-s /usr/X11R6/bin/Xorg&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Trivial exploitation&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;CVE-2018-14665 does not help compromise systems, but it is useful in the following stages of an attack.&lt;br&gt;
Leveraging it after gaining access to a vulnerable machine is fairly easy. Matthew Hickey, co-founder, and head of Hacker House security outfit created and published an exploit, saying that it can be triggered from a remote SSH session.&lt;br&gt;
Three hours after the public announcement of the security gap, Daemon Security CEO Michael Shirk replied with one line that overwrote shadow files on the system. Hickey did one better and fit the entire local privilege escalation exploit in one line.&lt;br&gt;
Apart from OpenBSD, other operating systems affected by the bug include Debian and Ubuntu, Fedora and its downstream distro  Red Hat Enterprise Linux along with its community-supported counterpart CentOS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blog.gsora.xyz/openbsd-on-the-desktop-some-thoughts/"&gt;OpenBSD on the Desktop: some thoughts&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I’ve been using OpenBSD on my ThinkPad X230 for some weeks now, and the experience has been peculiar in some ways.&lt;br&gt;
The OS itself in my opinion is not ready for widespread desktop usage, and the development team is not trying to push it in the throat of anybody who wants a Windows or macOS alternative.&lt;br&gt;
You need to understand a little bit of how *NIX systems work, because you’ll use CLI more than UI.&lt;br&gt;
That’s not necessarily bad, and I’m sure I learned a trick or two that could translate easily to Linux or macOS.&lt;br&gt;
Their development process is purely based on developers that love to contribute and hack around, just because it’s fun.&lt;br&gt;
Even the mailing list is a cool place to hang on!&lt;br&gt;
Code correctness and security are a must, nothing gets committed if it doesn’t get reviewed thoroughly first - nowadays the first two properties should be enforced in every major operating system.&lt;br&gt;
I like the idea of a platform that continually evolves.&lt;br&gt;
pledge(2) and unveil(2) are the proof that with a little effort, you can secure existing software better than ever.&lt;br&gt;
I like the “sensible defaults” approach, having an OS ready to be used - UI included if you selected it during the setup process - is great.&lt;br&gt;
Just install a browser and you’re ready to go.&lt;br&gt;
Manual pages on OpenBSD are real manuals, not an extension of the “–help” command found in most CLI softwares.&lt;br&gt;
They help you understand inner workings of the operating system, no internet connection needed.&lt;br&gt;
There are some trade-offs, too.&lt;br&gt;
Performance is not first-class, mostly because of all the security mitigations and checks done at runtime3.&lt;br&gt;
I write Go code in neovim, and sometimes you can feel a slight slowdown when you’re compiling and editing multiple files at the same time, but usually I can’t notice any meaningful difference.&lt;br&gt;
Browsers are a different matter though, you can definitely feel something differs from the experience you can have on mainstream operating systems.&lt;br&gt;
But again, trade-offs.&lt;br&gt;
To use OpenBSD on the desktop you must be ready to sacrifice some of the goodies of mainstream OSes, but if you’re searching for a zen place to do your computing stuff, it’s the best you can get right now.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://distrowatch.com/weekly.php?issue=20180813#nomadbsd"&gt;Review: NomadBSD 1.1&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;One of the most recent additions to the DistroWatch database is NomadBSD. According to the NomadBSD website: “NomadBSD is a 64-bit live system for USB flash drives, based on FreeBSD. Together with automatic hardware detection and setup, it is configured to be used as a desktop system that works out of the box, but can also be used for data recovery.”&lt;br&gt;
The latest release of NomadBSD (or simply “Nomad”, as I will refer to the project in this review) is version 1.1. It is based on FreeBSD 11.2 and is offered in two builds, one for generic personal computers and one for Macbooks. The release announcement mentions version 1.1 offers improved video driver support for Intel and AMD cards. The operating system ships with Octopkg for graphical package management and the system should automatically detect, and work with, VirtualBox environments.&lt;br&gt;
Nomad 1.1 is available as a 2GB download, which we then decompress to produce a 4GB file which can be written to a USB thumb drive. There is no optical media build of Nomad as it is designed to be run entirely from the USB drive, and write data persistently to the drive, rather than simply being installed from the USB media.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Initial setup&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Booting from the USB drive brings up a series of text-based menus which ask us to configure key parts of the operating system. We are asked to select our time zone, keyboard layout, keyboard model, keyboard mapping and our preferred language. While we can select options from a list, the options tend to be short and cryptic. Rather than “English (US)”, for example, we might be given “enUS”. We are also asked to create a password for the root user account and another one for a regular user which is called “nomad”. We can then select which shell nomad will use. The default is zsh, but there are plenty of other options, including csh and bash. We have the option of encrypting our user’s home directory.&lt;br&gt;
I feel it is important to point out that these settings, and nomad’s home directory, are stored on the USB drive. The options and settings we select will not be saved to our local hard drive and our configuration choices will not affect other operating systems already installed on our computer. At the end, the configuration wizard asks if we want to run the BSDstats service. This option is not explained at all, but it contacts BSDstats to provide some basic statistics on BSD users.&lt;br&gt;
The system then takes a few minutes to apply its changes to the USB drive and automatically reboots the computer. While running the initial setup wizard, I had nearly identical experiences when running Nomad on a physical computer and running the operating system in a VirtualBox virtual machine. However, after the initial setup process was over, I had quite different experiences depending on the environment so I want to divide my experiences into two different sections.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Physical desktop computer&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;At first, Nomad failed to boot on my desktop computer. From the operating system’s boot loader, I enabled Safe Mode which allowed Nomad to boot. At that point, Nomad was able to start up, but would only display a text console. The desktop environment failed to start when running in Safe Mode.&lt;br&gt;
Networking was also disabled by default and I had to enable a network interface and DHCP address assignment to connect to the Internet. Instructions for enabling networking can be found in FreeBSD’s Handbook. Once we are on-line we can use the pkg command line package manager to install and update software. Had the desktop environment worked then the Octopkg graphical package manager would also be available to make browsing and installing software a point-n-click experience.&lt;br&gt;
Had I been able to run the desktop for prolonged amounts of time I could have made use of such pre-installed items as the Firefox web browser, the VLC media player, LibreOffice and Thunderbird. Nomad offers a fairly small collection of desktop applications, but what is there is mostly popular, capable software.&lt;br&gt;
When running the operating system I noted that, with one user logged in, Nomad only runs 15 processes with the default configuration. These processes require less than 100MB of RAM, and the whole system fits comfortably on a 4GB USB drive.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Conclusions&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Ultimately using Nomad was not a practical option for me. The operating system did not work well with my hardware, or the virtual environment. In the virtual machine, Nomad crashed consistently after just a few minutes of uptime. On the desktop computer, I could not get a desktop environment to run. The command line tools worked well, and the system performed tasks very quickly, but a command line only environment is not well suited to my workflow.&lt;br&gt;
I like the idea of what NomadBSD is offering. There are not many live desktop flavours of FreeBSD, apart from GhostBSD. It was nice to see developers trying to make a FreeBSD-based, plug-and-go operating system that would offer a desktop and persistent storage. I suspect the system would work and perform its stated functions on different hardware, but in my case my experiment was necessarily short lived.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://oshogbo.vexillium.org/blog/50/"&gt;FreeBSD lockless algorithm - seq&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/bob-beck/libtls/blob/master/TUTORIAL.md"&gt;Happy Bob’s Libtls tutorial&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://chown.me/blog/locking-openbsd-when-sleeping.html"&gt;Locking OpenBSD when it’s sleeping&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.geoghegan.ca/serviio.html"&gt;iio - The OpenBSD Way&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://bsdboy.ml/blog/installing-hugo-and-hosting-on-openbsd.html"&gt;Installing Hugo and Hosting Website on OpenBSD Server&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://blog.osorio.me/post.php?idpost=1"&gt;Fosdem 2019 reminder: BSD devroom CfP&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=4gOoPxGKKjA&amp;amp;feature=youtu.be"&gt;OpenBGPD, gotta go fast! - Claudio Jeker&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://project-trident.org/post/2018-11-10rc3-available/"&gt;Project Trident RC3 available&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-announce/2018-November/001849.html"&gt;FreeBSD 10.4 EOL&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://bsd.network/@ephemeris/101073578346815313"&gt;Play “Crazy Train” through your APU2 speaker&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Tobias - &lt;a href="http://dpaste.com/174WGEY#wrap"&gt;Satisfying my storage hunger and wallet pains&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Lasse - &lt;a href="http://dpaste.com/1QBMH73"&gt;Question regarding FreeBSD backups&lt;/a&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://twitter.com/dlangille"&gt;https://twitter.com/dlangille&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://dan.langille.org/"&gt;https://dan.langille.org/&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, cat, Firewall, x.org, vulnerability, nomadbsd, OpenBGPD, Hugo, Fosdem, iio</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Thoughts on NetBSD 8.0, Monitoring love for a GigaBit OpenBSD firewall, cat’s source history, X.org root permission bug, thoughts on OpenBSD as a desktop, and NomadBSD review.</p>

<p>##Headlines<br>
###<a href="https://distrowatch.com/weekly.php?issue=20181119#netbsd">Some thoughts on NetBSD 8.0</a></p>

<blockquote>
<p>NetBSD is a highly portable operating system which can be run on dozens of different hardware architectures. The operating system’s clean and minimal design allow it to be run in all sorts of environments, ranging from embedded devices, to servers, to workstations. While the base operating system is minimal, NetBSD users have access to a large repository of binary packages and a ports tree which I will touch upon later.<br>
I last tried NetBSD 7.0 about three years ago and decided it was time to test drive the operating system again. In the past three years NetBSD has introduced a few new features, many of them security enhancements. For example, NetBSD now supports write exclusive-or execute (W^X) protection and address space layout randomization (ASLR) to protect programs against common attacks. NetBSD 8.0 also includes USB3 support and the ability to work with ZFS storage volumes.</p>
</blockquote>

<ul>
<li>Early impressions</li>
</ul>

<blockquote>
<p>Since I had set up NetBSD with a Full install and enabled xdm during the setup process, the operating system booted to a graphical login screen. From here we can sign into our account. The login screen does not provide options to shut down or restart the computer. Logging into our account brings up the twm window manager and provides a virtual terminal, courtesy of xterm. There is a panel that provides a method for logging out of the window manager. The twm environment is sparse, fast and devoid of distractions.</p>
</blockquote>

<ul>
<li>Software management</li>
</ul>

<blockquote>
<p>NetBSD ships with a fairly standard collection of command line tools and manual pages, but otherwise it is a fairly minimal platform. If we want to run network services, have access to a web browser, or use a word processor we are going to need to install more software. There are two main approaches to installing new packages. The first, and easier approach, is to use the pkgin package manager. The pkgin utility works much the same way APT or DNF work in the Linux world, or as pkg works on FreeBSD. We can search for software by name, install or remove items. I found pkgin worked well, though its output can be terse. My only complaint with pkgin is that it does not handle “close enough” package names. For example, if I tried to run “pkgin install vlc” or “pkgin install firefox” I would quickly be told these items did not exist. But a more forgiving package manager will realize items like vlc2 or firefox45 are available and offer to install those.<br>
The pkgin tool installs new programs in the /usr/pkg/bin directory. Depending on your configuration and shell, this location may not be in your user’s path, and it will be helpful to adjust your PATH variable accordingly.<br>
The other common approach to acquiring new software is to use the pkgsrc framework. I have talked about using pkgsrc before and I will skip the details. Basically, we can download a collection of recipes for building popular open source software and run a command to download and install these items from their source code. Using pkgsrc basically gives us the same software as using pkgin would, but with some added flexibility on the options we use.<br>
Once new software has been installed, it may need to be enabled and activated, particularly if it uses (or is) a background service. New items can be enabled in the /etc/rc.conf file and started or stopped using the service command. This works about the same as the service command on FreeBSD and most non-systemd Linux distributions.</p>
</blockquote>

<ul>
<li>Hardware</li>
</ul>

<blockquote>
<p>I found that, when logged into the twm environment, NetBSD used about 130MB of RAM. This included kernel memory and all active memory. A fresh, Full install used up 1.5GB of disk space. I generally found NetBSD ran well in both VirtualBox and on my desktop computer. The system was quick and stable. I did have trouble getting a higher screen resolution in both environments. NetBSD does not offer VirtualBox add-on modules. There are NetBSD patches for VirtualBox out there, but there is some manual work involved in getting them working. When running on my desktop computer I think the resolution issue was one of finding and dealing with the correct video driver. Screen resolution aside, NetBSD performed well and detected all my hardware.</p>
</blockquote>

<ul>
<li>Personal projects</li>
</ul>

<blockquote>
<p>Since NetBSD provides users with a small, core operating system without many utilities if we want to use NetBSD for something we need to have a project in mind. I had four mini projects in mind I wanted to try this week: install a desktop environment, enable file sharing for computers on the local network, test multimedia (video, audio and YouTube capabilities), and set up a ZFS volume for storage.<br>
I began with the desktop. Specifically, I followed the same tutorial I used three years ago to try to set up the Xfce desktop. While Xfce and its supporting services installed, I was unable to get a working desktop out of the experience. I could get the Xfce window manager working, but not the entire session. This tutorial worked beautifully with NetBSD 7.0, but not with version 8.0. Undeterred, I switched gears and installed Fluxbox instead. This gave me a slightly more powerful graphical environment than what I had before with twm while maintaining performance. Fluxbox ran without any problems, though its application menu was automatically populated with many programs which were not actually installed.<br>
Next, I tried installing a few multimedia applications to play audio and video files. Here I ran into a couple of interesting problems. I found the music players I installed would play audio files, but the audio was quite slow. It always sounded like a cassette tape dragging. When I tried to play a video, the entire graphical session would crash, taking me back to the login screen. When I installed Firefox, I found I could play YouTube videos, and the video played smoothly, but again the audio was unusually slow.<br>
I set up two methods of sharing files on the local network: OpenSSH and FTP. NetBSD basically gives us OpenSSH for free at install time and I added an FTP server through the pkgin package manager which worked beautifully with its default configuration.<br>
I experimented with ZFS support a little, just enough to confirm I could create and access ZFS volumes. ZFS seems to work on NetBSD just as well, and with the same basic features, as it does on FreeBSD and mainstream Linux distributions. I think this is a good feature for the portable operating system to have since it means we can stick NetBSD on nearly any networked computer and use it as a NAS.</p>
</blockquote>

<ul>
<li>Conclusions</li>
</ul>

<blockquote>
<p>NetBSD, like its close cousins (FreeBSD and OpenBSD) does not do a lot of hand holding or automation. It offers a foundation that will run on most CPUs and we can choose to build on that foundation. I mention this because, on its own, NetBSD does not do much. If we want to get something out of it, we need to be willing to build on its foundation - we need a project. This is important to keep in mind as I think going into NetBSD and thinking, “Oh I’ll just explore around and expand on this as I go,” will likely lead to disappointment. I recommend figuring out what you want to do before installing NetBSD and making sure the required tools are available in the operating system’s repositories.<br>
Some of the projects I embarked on this week (using ZFS and setting up file sharing) worked well. Others, like getting multimedia support and a full-featured desktop, did not. Given more time, I’m sure I could find a suitable desktop to install (along with the required documentation to get it and its services running), or customize one based on one of the available window managers. However, any full featured desktop is going to require some manual work. Media support was not great. The right players and codecs were there, but I was not able to get audio to play smoothly.<br>
My main complaint with NetBSD relates to my struggle to get some features working to my satisfaction: the documentation is scattered. There are four different sections of the project’s website for documentation (FAQs, The Guide, manual pages and the wiki). Whatever we are looking for is likely to be in one of those, but which one? Or, just as likely, the tutorial we want is not there, but is on a forum or blog somewhere. I found that the documentation provided was often thin, more of a quick reference to remind people how something works rather than a full explanation.<br>
As an example, I found a couple of documents relating to setting up a firewall. One dealt with networking NetBSD on a LAN, another explored IPv6 support, but neither gave an overview on syntax or a basic guide to blocking all but one or two ports. It seemed like that information should already be known, or picked up elsewhere.<br>
Newcomers are likely to be a bit confused by software management guides for the same reason. Some pages refer to using a tool called pkg_add, others use pkgsrc and its make utility, others mention pkgin. Ultimately, these tools each give approximately the same result, but work differently and yet are mentioned almost interchangeably. I have used NetBSD before a few times and could stumble through these guides, but new users are likely to come away confused.<br>
One quirk of NetBSD, which may be a security feature or an inconvenience, depending on one’s point of view, is super user programs are not included in regular users’ paths. This means we need to change our path if we want to be able to run programs typically used by root. For example, shutdown and mount are not in regular users’ paths by default. This made checking some things tricky for me.<br>
Ultimately though, NetBSD is not famous for its convenience or features so much as its flexibility. The operating system will run on virtually any processor and should work almost identically across multiple platforms. That gives NetBSD users a good deal of consistency across a range of hardware and the chance to experiment with a member of the Unix family on hardware that might not be compatible with Linux or the other BSDs.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://tech.mangot.com/blog/2018/11/08/showing-a-gigabit-openbsd-firewall-some-monitoring-love/">Showing a Gigabit OpenBSD Firewall Some Monitoring Love</a></p>

<blockquote>
<p>I have a pretty long history of running my home servers or firewalls on “exotic” hardware. At first, it was Sun Microsystem hardware, then it moved to the excellent Soekris line, with some cool single board computers thrown in the mix. Recently I’ve been running OpenBSD Octeon on the Ubiquiti Edge Router Lite, an amazing little piece of kit at an amazing price point.</p>
</blockquote>

<ul>
<li>Upgrade Time!</li>
</ul>

<blockquote>
<p>This setup has served me for some time and I’ve been extremely happy with it. But, in the #firstworldproblems category, I recently upgraded the household to the amazing Gigabit fibre offering from Sonic. A great problem to have, but also too much of a problem for the little Edge Router Lite (ERL).<br>
The way the OpenBSD PF firewall works, it’s only able to process packets on a single core. Not a problem for the dual-core 500 MHz ERL when you’re pushing under ~200 Mbps, but more of a problem when you’re trying to push 1000 Mbps.<br>
I needed something that was faster on a per core basis but still satisfied my usual firewall requirements. Loosely:</p>
</blockquote>

<ul>
<li>small form factor</li>
<li>fan-less</li>
<li>multiple Intel Ethernet ports (good driver support)</li>
<li>low power consumption</li>
<li>not your regular off-the-shelf kit</li>
<li>relatively inexpensive</li>
</ul>

<blockquote>
<p>After evaluating a LOT of different options I settled on the Protectli Vault FW2B. With the specs required for the firewall (2 GB RAM and 8 GB drive) it comes in at a mere $239 USD! Installation of OpenBSD 6.4 was pretty straight forward, with the only problem I had was Etcher did not want to recognize the ‘.fs’ extension on the install image as bootable image. I quickly fixed this with good old Unix dd(1) on the Mac. Everything else was incredibly smooth.<br>
After loading the same rulesets on my new install, the results were fantastic!</p>
</blockquote>

<ul>
<li>Monitoring</li>
</ul>

<blockquote>
<p>Now that the machine was up and running (and fast!), I wanted to know what it was doing. Over the years, I’ve always relied on the venerable pfstat software to give me an overview of my traffic, blocked packets, etc. It looks like this:<br>
As you can see it’s based on RRDtool, which was simply incredible in its time. Having worked on monitoring almost continuously for almost the past decade, I wanted to see if we could re-implement the same functionality using more modern tools as RRDtool and pfstat definitely have their limitations. This might be an opportunity to learn some new things as well.<br>
I came across pf-graphite which seemed to be a great start! He had everything I needed and I added a few more stats from the detailed interface statistics and the ability for the code to exit for running from cron(8), which is a bit more OpenBSD style. I added code for sending to some SaaS metrics platforms but ultimately stuck with straight Graphite. One important thing to note was to use the Graphite pickle port (2004) instead of the default plaintext port for submission. Also you will need to set a loginterface in your ‘pf.conf’.<br>
A bit of tweaking with Graphite and Grafana, and I had a pretty darn good recreation of my original PF stats dashboard!<br>
As you can see it’s based on RRDtool, which was simply incredible in its time. Having worked on monitoring almost continuously for almost the past decade, I wanted to see if we could re-implement the same functionality using more modern tools as RRDtool and pfstat definitely have their limitations. This might be an opportunity to learn some new things as well.<br>
I came across pf-graphite which seemed to be a great start! He had everything I needed and I added a few more stats from the detailed interface statistics and the ability for the code to exit for running from cron(8), which is a bit more OpenBSD style. I added code for sending to some SaaS metrics platforms but ultimately stuck with straight Graphite. One important thing to note was to use the Graphite pickle port (2004) instead of the default plaintext port for submission. Also you will need to set a loginterface in your ‘pf.conf’.<br>
A bit of tweaking with Graphite and Grafana, and I had a pretty darn good recreation of my original PF stats dashboard!</p>
</blockquote>

<p>###<a href="https://twobithistory.org/2018/11/12/cat.html">The Source History of Cat</a></p>

<blockquote>
<p>I once had a debate with members of my extended family about whether a computer science degree is a degree worth pursuing. I was in college at the time and trying to decide whether I should major in computer science. My aunt and a cousin of mine believed that I shouldn’t. They conceded that knowing how to program is of course a useful and lucrative thing, but they argued that the field of computer science advances so quickly that everything I learned would almost immediately be outdated. Better to pick up programming on the side and instead major in a field like economics or physics where the basic principles would be applicable throughout my lifetime.<br>
I knew that my aunt and cousin were wrong and decided to major in computer science. (Sorry, aunt and cousin!) It is easy to see why the average person might believe that a field like computer science, or a profession like software engineering, completely reinvents itself every few years. We had personal computers, then the web, then phones, then machine learning… technology is always changing, so surely all the underlying principles and techniques change too. Of course, the amazing thing is how little actually changes. Most people, I’m sure, would be stunned to know just how old some of the important software on their computer really is. I’m not talking about flashy application software, admittedly—my copy of Firefox, the program I probably use the most on my computer, is not even two weeks old. But, if you pull up the manual page for something like grep, you will see that it has not been updated since 2010 (at least on MacOS). And the original version of grep was written in 1974, which in the computing world was back when dinosaurs roamed Silicon Valley. People (and programs) still depend on grep every day.<br>
My aunt and cousin thought of computer technology as a series of increasingly elaborate sand castles supplanting one another after each high tide clears the beach. The reality, at least in many areas, is that we steadily accumulate programs that have solved problems. We might have to occasionally modify these programs to avoid software rot, but otherwise they can be left alone.  grep is a simple program that solves a still-relevant problem, so it survives. Most application programming is done at a very high level, atop a pyramid of much older code solving much older problems. The ideas and concepts of 30 or 40 years ago, far from being obsolete today, have in many cases been embodied in software that you can still find installed on your laptop.<br>
I thought it would be interesting to take a look at one such old program and see how much it had changed since it was first written. cat is maybe the simplest of all the Unix utilities, so I’m going to use it as my example. Ken Thompson wrote the original implementation of cat in 1969. If I were to tell somebody that I have a program on my computer from 1969, would that be accurate? How much has cat really evolved over the decades? How old is the software on our computers?<br>
Thanks to repositories like this one, we can see exactly how cat has evolved since 1969. I’m going to focus on implementations of cat that are ancestors of the implementation I have on my Macbook. You will see, as we trace cat from the first versions of Unix down to the cat in MacOS today, that the program has been rewritten more times than you might expect—but it ultimately works more or less the same way it did fifty years ago.</p>
</blockquote>

<ul>
<li>Research Unix</li>
</ul>

<blockquote>
<p>Ken Thompson and Dennis Ritchie began writing Unix on a PDP 7. This was in 1969, before C, so all of the early Unix software was written in PDP 7 assembly. The exact flavor of assembly they used was unique to Unix, since Ken Thompson wrote his own assembler that added some features on top of the assembler provided by DEC, the PDP 7’s manufacturer. Thompson’s changes are all documented in the original Unix Programmer’s Manual under the entry for as, the assembler.<br>
The first implementation of cat is thus in PDP 7 assembly. I’ve added comments that try to explain what each instruction is doing, but the program is still difficult to follow unless you understand some of the extensions Thompson made while writing his assembler. There are two important ones. First, the ; character can be used to separate multiple statements on the same line. It appears that this was used most often to put system call arguments on the same line as the sys instruction. Second, Thompson added support for “temporary labels” using the digits 0 through 9. These are labels that can be reused throughout a program, thus being, according to the Unix Programmer’s Manual, “less taxing both on the imagination of the programmer and on the symbol space of the assembler.” From any given instruction, you can refer to the next or most recent temporary label n using nf and nb respectively. For example, if you have some code in a block labeled 1:, you can jump back to that block from further down by using the instruction jmp 1b. (But you cannot jump forward to that block from above without using jmp 1f instead.)<br>
The most interesting thing about this first version of cat is that it contains two names we should recognize. There is a block of instructions labeled getc and a block of instructions labeled putc, demonstrating that these names are older than the C standard library. The first version of cat actually contained implementations of both functions. The implementations buffered input so that reads and writes were not done a character at a time.<br>
The first version of cat did not last long. Ken Thompson and Dennis Ritchie were able to persuade Bell Labs to buy them a PDP 11 so that they could continue to expand and improve Unix. The PDP 11 had a different instruction set, so cat had to be rewritten. I’ve marked up this second version of cat with comments as well. It uses new assembler mnemonics for the new instruction set and takes advantage of the PDP 11’s various addressing modes. (If you are confused by the parentheses and dollar signs in the source code, those are used to indicate different addressing modes.) But it also leverages the  ; character and temporary labels just like the first version of cat, meaning that these features must have been retained when as was adapted for the PDP 11.<br>
The second version of cat is significantly simpler than the first. It is also more “Unix-y” in that it doesn’t just expect a list of filename arguments—it will, when given no arguments, read from stdin, which is what cat still does today. You can also give this version of cat an argument of - to indicate that it should read from stdin.<br>
In 1973, in preparation for the release of the Fourth Edition of Unix, much of Unix was rewritten in C. But cat does not seem to have been rewritten in C until a while after that. The first C implementation of cat only shows up in the Seventh Edition of Unix. This implementation is really fun to look through because it is so simple. Of all the implementations to follow, this one most resembles the idealized cat used as a pedagogic demonstration in K&amp;R C. The heart of the program is the classic two-liner:</p>
</blockquote>

<p><code>while ((c = getc(fi)) != EOF)</code><br>
<code>putchar(c);</code></p>

<blockquote>
<p>There is of course quite a bit more code than that, but the extra code is mostly there to ensure that you aren’t reading and writing to the same file. The other interesting thing to note is that this implementation of cat only recognized one flag, -u. The -u flag could be used to avoid buffering input and output, which cat would otherwise do in blocks of 512 bytes.</p>
</blockquote>

<ul>
<li>BSD</li>
</ul>

<blockquote>
<p>After the Seventh Edition, Unix spawned all sorts of derivatives and offshoots. MacOS is built on top of Darwin, which in turn is derived from the Berkeley Software Distribution (BSD), so BSD is the Unix offshoot we are most interested in. BSD was originally just a collection of useful programs and add-ons for Unix, but it eventually became a complete operating system. BSD seems to have relied on the original cat implementation up until the fourth BSD release, known as 4BSD, when support was added for a whole slew of new flags. The 4BSD implementation of cat is clearly derived from the original implementation, though it adds a new function to implement the behavior triggered by the new flags. The naming conventions already used in the file were adhered to—the fflg variable, used to mark whether input was being read from stdin or a file, was joined by nflg, bflg, vflg, sflg, eflg, and  tflg, all there to record whether or not each new flag was supplied in the invocation of the program. These were the last command-line flags added to  cat; the man page for cat today lists these flags and no others, at least on Mac OS. 4BSD was released in 1980, so this set of flags is 38 years old.<br>
cat would be entirely rewritten a final time for BSD Net/2, which was, among other things, an attempt to avoid licensing issues by replacing all AT&amp;T Unix-derived code with new code. BSD Net/2 was released in 1991. This final rewrite of cat was done by Kevin Fall, who graduated from Berkeley in 1988 and spent the next year working as a staff member at the Computer Systems Research Group (CSRG). Fall told me that a list of Unix utilities still implemented using AT&amp;T code was put up on a wall at CSRG and staff were told to pick the utilities they wanted to reimplement. Fall picked cat and  mknod. The cat implementation bundled with MacOS today is built from a source file that still bears his name at the very top. His version of cat, even though it is a relatively trivial program, is today used by millions.<br>
Fall’s original implementation of cat is much longer than anything we have seen so far. Other than support for a -? help flag, it adds nothing in the way of new functionality. Conceptually, it is very similar to the 4BSD implementation. It is only longer because Fall separates the implementation into a “raw” mode and a “cooked” mode. The “raw” mode is cat classic; it prints a file character for character. The “cooked” mode is cat with all the 4BSD command-line options. The distinction makes sense but it also pads out the implementation so that it seems more complex at first glance than it actually is. There is also a fancy error handling function at the end of the file that further adds to its length.</p>
</blockquote>

<ul>
<li>MacOS</li>
</ul>

<blockquote>
<p>The very first release of Mac OS X thus includes an implementation of cat pulled from the NetBSD project. So the first Mac OS X implementation of cat is Kevin Fall’s cat. The only thing that had changed over the intervening decade was that Fall’s error-handling function err() was removed and the err() function made available by err.h was used in its place. err.h is a BSD extension to the C standard library.<br>
The NetBSD implementation of cat was later swapped out for FreeBSD’s implementation of cat. According to Wikipedia, Apple began using FreeBSD instead of NetBSD in Mac OS X 10.3 (Panther). But the Mac OS X implementation of cat, according to Apple’s own open source releases, was not replaced until Mac OS X 10.5 (Leopard) was released in 2007. The FreeBSD implementation that Apple swapped in for the Leopard release is the same implementation on Apple computers today. As of 2018, the implementation has not been updated or changed at all since 2007.<br>
So the Mac OS cat is old. As it happens, it is actually two years older than its 2007 appearance in MacOS X would suggest. This 2005 change, which is visible in FreeBSD’s Github mirror, was the last change made to FreeBSD’s cat before Apple pulled it into Mac OS X. So the Mac OS X cat implementation, which has not been kept in sync with FreeBSD’s cat implementation, is officially 13 years old. There’s a larger debate to be had about how much software can change before it really counts as the same software; in this case, the source file has not changed at all since 2005.<br>
The cat implementation used by Mac OS today is not that different from the implementation that Fall wrote for the 1991 BSD Net/2 release. The biggest difference is that a whole new function was added to provide Unix domain socket support. At some point, a FreeBSD developer also seems to have decided that Fall’s raw_args() function and cook_args() should be combined into a single function called scanfiles(). Otherwise, the heart of the program is still Fall’s code.<br>
I asked Fall how he felt about having written the cat implementation now used by millions of Apple users, either directly or indirectly through some program that relies on cat being present. Fall, who is now a consultant and a co-author of the most recent editions of TCP/IP Illustrated, says that he is surprised when people get such a thrill out of learning about his work on cat. Fall has had a long career in computing and has worked on many high-profile projects, but it seems that many people still get most excited about the six months of work he put into rewriting cat in 1989.</p>
</blockquote>

<ul>
<li>The Hundred-Year-Old Program</li>
</ul>

<blockquote>
<p>In the grand scheme of things, computers are not an old invention. We’re used to hundred-year-old photographs or even hundred-year-old camera footage. But computer programs are in a different category—they’re high-tech and new. At least, they are now. As the computing industry matures, will we someday find ourselves using programs that approach the hundred-year-old mark?<br>
Computer hardware will presumably change enough that we won’t be able to take an executable compiled today and run it on hardware a century from now. Perhaps advances in programming language design will also mean that nobody will understand C in the future and cat will have long since been rewritten in another language. (Though C has already been around for fifty years, and it doesn’t look like it is about to be replaced any time soon.) But barring all that, why not just keep using the cat we have forever?<br>
I think the history of cat shows that some ideas in computer science are in fact very durable. Indeed, with cat, both the idea and the program itself are old. It may not be accurate to say that the cat on my computer is from 1969. But I could make a case for saying that the cat on my computer is from 1989, when Fall wrote his implementation of cat. Lots of other software is just as ancient. So maybe we shouldn’t think of computer science and software development primarily as fields that disrupt the status quo and invent new things. Our computer systems are built out of historical artifacts. At some point, we may all spend more time trying to understand and maintain those historical artifacts than we spend writing new code.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://www.bleepingcomputer.com/news/security/trivial-bug-in-xorg-gives-root-permission-on-linux-and-bsd-systems/">Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems</a></p>

<blockquote>
<p>A vulnerability that is trivial to exploit allows privilege escalation to root level on Linux and BSD distributions using <a href="http://X.Org">X.Org</a> server, the open source implementation of the X Window System that offers the graphical environment.<br>
The flaw is now identified as CVE-2018-14665 (credited to security researcher Narendra Shinde). It has been present in xorg-server for two years, since version 1.19.0 and is exploitable by a limited user as long as the X server runs with elevated permissions.</p>
</blockquote>

<ul>
<li>Privilege escalation and arbitrary file overwrite</li>
</ul>

<blockquote>
<p>An advisory on Thursday describes the problem as an “incorrect command-line parameter validation” that also allows an attacker to overwrite arbitrary files.<br>
Privilege escalation can be accomplished via the -modulepath argument by setting an insecure path to modules loaded by the <a href="http://X.org">X.org</a> server. Arbitrary file overwrite is possible through the -logfile argument, because of improper verification when parsing the option.</p>
</blockquote>

<ul>
<li>Bug could have been avoided in OpenBSD 6.4</li>
</ul>

<blockquote>
<p>OpenBSD, the free and open-source operating system with a strong focus on security, uses xorg. On October 18, the project released version 6.4 of the OS, affected by CVE-2018-14665. This could have been avoided, though.<br>
Theo de Raadt, founder and leader of the OpenBSD project, says that X maintainer knew about the problem since at least October 11. For some reason, the OpenBSD developers received the message one hour before the public announcement this Thursday, a week after their new OS release.<br>
“As yet we don’t have answers about why our X maintainer (on the X security team) and his team provided information to other projects (some who don’t even ship with this new X server) but chose to not give us a heads-up which could have saved all the new 6.4 users a lot of grief,” Raadt says.<br>
Had OpenBSD developers known about the bug before the release, they could have taken steps to mitigate the problem or delay the launch for a week or two.<br>
To remedy the problem, the OpenBSD project provides a source code patch, which requires compiling and rebuilding the X server.<br>
As a temporary solution, users can disable the Xorg binary by running the following command:</p>
</blockquote>

<p><code>chmod u-s /usr/X11R6/bin/Xorg</code></p>

<ul>
<li>Trivial exploitation</li>
</ul>

<blockquote>
<p>CVE-2018-14665 does not help compromise systems, but it is useful in the following stages of an attack.<br>
Leveraging it after gaining access to a vulnerable machine is fairly easy. Matthew Hickey, co-founder, and head of Hacker House security outfit created and published an exploit, saying that it can be triggered from a remote SSH session.<br>
Three hours after the public announcement of the security gap, Daemon Security CEO Michael Shirk replied with one line that overwrote shadow files on the system. Hickey did one better and fit the entire local privilege escalation exploit in one line.<br>
Apart from OpenBSD, other operating systems affected by the bug include Debian and Ubuntu, Fedora and its downstream distro  Red Hat Enterprise Linux along with its community-supported counterpart CentOS.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.gsora.xyz/openbsd-on-the-desktop-some-thoughts/">OpenBSD on the Desktop: some thoughts</a></p>

<blockquote>
<p>I’ve been using OpenBSD on my ThinkPad X230 for some weeks now, and the experience has been peculiar in some ways.<br>
The OS itself in my opinion is not ready for widespread desktop usage, and the development team is not trying to push it in the throat of anybody who wants a Windows or macOS alternative.<br>
You need to understand a little bit of how *NIX systems work, because you’ll use CLI more than UI.<br>
That’s not necessarily bad, and I’m sure I learned a trick or two that could translate easily to Linux or macOS.<br>
Their development process is purely based on developers that love to contribute and hack around, just because it’s fun.<br>
Even the mailing list is a cool place to hang on!<br>
Code correctness and security are a must, nothing gets committed if it doesn’t get reviewed thoroughly first - nowadays the first two properties should be enforced in every major operating system.<br>
I like the idea of a platform that continually evolves.<br>
pledge(2) and unveil(2) are the proof that with a little effort, you can secure existing software better than ever.<br>
I like the “sensible defaults” approach, having an OS ready to be used - UI included if you selected it during the setup process - is great.<br>
Just install a browser and you’re ready to go.<br>
Manual pages on OpenBSD are real manuals, not an extension of the “–help” command found in most CLI softwares.<br>
They help you understand inner workings of the operating system, no internet connection needed.<br>
There are some trade-offs, too.<br>
Performance is not first-class, mostly because of all the security mitigations and checks done at runtime3.<br>
I write Go code in neovim, and sometimes you can feel a slight slowdown when you’re compiling and editing multiple files at the same time, but usually I can’t notice any meaningful difference.<br>
Browsers are a different matter though, you can definitely feel something differs from the experience you can have on mainstream operating systems.<br>
But again, trade-offs.<br>
To use OpenBSD on the desktop you must be ready to sacrifice some of the goodies of mainstream OSes, but if you’re searching for a zen place to do your computing stuff, it’s the best you can get right now.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://distrowatch.com/weekly.php?issue=20180813#nomadbsd">Review: NomadBSD 1.1</a></p>

<blockquote>
<p>One of the most recent additions to the DistroWatch database is NomadBSD. According to the NomadBSD website: “NomadBSD is a 64-bit live system for USB flash drives, based on FreeBSD. Together with automatic hardware detection and setup, it is configured to be used as a desktop system that works out of the box, but can also be used for data recovery.”<br>
The latest release of NomadBSD (or simply “Nomad”, as I will refer to the project in this review) is version 1.1. It is based on FreeBSD 11.2 and is offered in two builds, one for generic personal computers and one for Macbooks. The release announcement mentions version 1.1 offers improved video driver support for Intel and AMD cards. The operating system ships with Octopkg for graphical package management and the system should automatically detect, and work with, VirtualBox environments.<br>
Nomad 1.1 is available as a 2GB download, which we then decompress to produce a 4GB file which can be written to a USB thumb drive. There is no optical media build of Nomad as it is designed to be run entirely from the USB drive, and write data persistently to the drive, rather than simply being installed from the USB media.</p>
</blockquote>

<ul>
<li>Initial setup</li>
</ul>

<blockquote>
<p>Booting from the USB drive brings up a series of text-based menus which ask us to configure key parts of the operating system. We are asked to select our time zone, keyboard layout, keyboard model, keyboard mapping and our preferred language. While we can select options from a list, the options tend to be short and cryptic. Rather than “English (US)”, for example, we might be given “en_US”. We are also asked to create a password for the root user account and another one for a regular user which is called “nomad”. We can then select which shell nomad will use. The default is zsh, but there are plenty of other options, including csh and bash. We have the option of encrypting our user’s home directory.<br>
I feel it is important to point out that these settings, and nomad’s home directory, are stored on the USB drive. The options and settings we select will not be saved to our local hard drive and our configuration choices will not affect other operating systems already installed on our computer. At the end, the configuration wizard asks if we want to run the BSDstats service. This option is not explained at all, but it contacts BSDstats to provide some basic statistics on BSD users.<br>
The system then takes a few minutes to apply its changes to the USB drive and automatically reboots the computer. While running the initial setup wizard, I had nearly identical experiences when running Nomad on a physical computer and running the operating system in a VirtualBox virtual machine. However, after the initial setup process was over, I had quite different experiences depending on the environment so I want to divide my experiences into two different sections.</p>
</blockquote>

<ul>
<li>Physical desktop computer</li>
</ul>

<blockquote>
<p>At first, Nomad failed to boot on my desktop computer. From the operating system’s boot loader, I enabled Safe Mode which allowed Nomad to boot. At that point, Nomad was able to start up, but would only display a text console. The desktop environment failed to start when running in Safe Mode.<br>
Networking was also disabled by default and I had to enable a network interface and DHCP address assignment to connect to the Internet. Instructions for enabling networking can be found in FreeBSD’s Handbook. Once we are on-line we can use the pkg command line package manager to install and update software. Had the desktop environment worked then the Octopkg graphical package manager would also be available to make browsing and installing software a point-n-click experience.<br>
Had I been able to run the desktop for prolonged amounts of time I could have made use of such pre-installed items as the Firefox web browser, the VLC media player, LibreOffice and Thunderbird. Nomad offers a fairly small collection of desktop applications, but what is there is mostly popular, capable software.<br>
When running the operating system I noted that, with one user logged in, Nomad only runs 15 processes with the default configuration. These processes require less than 100MB of RAM, and the whole system fits comfortably on a 4GB USB drive.</p>
</blockquote>

<ul>
<li>Conclusions</li>
</ul>

<blockquote>
<p>Ultimately using Nomad was not a practical option for me. The operating system did not work well with my hardware, or the virtual environment. In the virtual machine, Nomad crashed consistently after just a few minutes of uptime. On the desktop computer, I could not get a desktop environment to run. The command line tools worked well, and the system performed tasks very quickly, but a command line only environment is not well suited to my workflow.<br>
I like the idea of what NomadBSD is offering. There are not many live desktop flavours of FreeBSD, apart from GhostBSD. It was nice to see developers trying to make a FreeBSD-based, plug-and-go operating system that would offer a desktop and persistent storage. I suspect the system would work and perform its stated functions on different hardware, but in my case my experiment was necessarily short lived.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://oshogbo.vexillium.org/blog/50/">FreeBSD lockless algorithm - seq</a></li>
<li><a href="https://github.com/bob-beck/libtls/blob/master/TUTORIAL.md">Happy Bob’s Libtls tutorial</a></li>
<li><a href="https://chown.me/blog/locking-openbsd-when-sleeping.html">Locking OpenBSD when it’s sleeping</a></li>
<li><a href="https://www.geoghegan.ca/serviio.html">iio - The OpenBSD Way</a></li>
<li><a href="https://bsdboy.ml/blog/installing-hugo-and-hosting-on-openbsd.html">Installing Hugo and Hosting Website on OpenBSD Server</a></li>
<li><a href="http://blog.osorio.me/post.php?idpost=1">Fosdem 2019 reminder: BSD devroom CfP</a></li>
<li><a href="https://www.youtube.com/watch?v=4gOoPxGKKjA&amp;feature=youtu.be">OpenBGPD, gotta go fast! - Claudio Jeker</a></li>
<li><a href="http://project-trident.org/post/2018-11-10_rc3-available/">Project Trident RC3 available</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2018-November/001849.html">FreeBSD 10.4 EOL</a></li>
<li><a href="https://bsd.network/@ephemeris/101073578346815313">Play “Crazy Train” through your APU2 speaker</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Tobias - <a href="http://dpaste.com/174WGEY#wrap">Satisfying my storage hunger and wallet pains</a></li>
<li>Lasse - <a href="http://dpaste.com/1QBMH73">Question regarding FreeBSD backups</a>
<ul>
<li><a href="https://twitter.com/dlangille">https://twitter.com/dlangille</a></li>
<li><a href="https://dan.langille.org/">https://dan.langille.org/</a></li>
</ul>

<p></li><br>
</ul><br>
<hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Thoughts on NetBSD 8.0, Monitoring love for a GigaBit OpenBSD firewall, cat’s source history, X.org root permission bug, thoughts on OpenBSD as a desktop, and NomadBSD review.</p>

<p>##Headlines<br>
###<a href="https://distrowatch.com/weekly.php?issue=20181119#netbsd">Some thoughts on NetBSD 8.0</a></p>

<blockquote>
<p>NetBSD is a highly portable operating system which can be run on dozens of different hardware architectures. The operating system’s clean and minimal design allow it to be run in all sorts of environments, ranging from embedded devices, to servers, to workstations. While the base operating system is minimal, NetBSD users have access to a large repository of binary packages and a ports tree which I will touch upon later.<br>
I last tried NetBSD 7.0 about three years ago and decided it was time to test drive the operating system again. In the past three years NetBSD has introduced a few new features, many of them security enhancements. For example, NetBSD now supports write exclusive-or execute (W^X) protection and address space layout randomization (ASLR) to protect programs against common attacks. NetBSD 8.0 also includes USB3 support and the ability to work with ZFS storage volumes.</p>
</blockquote>

<ul>
<li>Early impressions</li>
</ul>

<blockquote>
<p>Since I had set up NetBSD with a Full install and enabled xdm during the setup process, the operating system booted to a graphical login screen. From here we can sign into our account. The login screen does not provide options to shut down or restart the computer. Logging into our account brings up the twm window manager and provides a virtual terminal, courtesy of xterm. There is a panel that provides a method for logging out of the window manager. The twm environment is sparse, fast and devoid of distractions.</p>
</blockquote>

<ul>
<li>Software management</li>
</ul>

<blockquote>
<p>NetBSD ships with a fairly standard collection of command line tools and manual pages, but otherwise it is a fairly minimal platform. If we want to run network services, have access to a web browser, or use a word processor we are going to need to install more software. There are two main approaches to installing new packages. The first, and easier approach, is to use the pkgin package manager. The pkgin utility works much the same way APT or DNF work in the Linux world, or as pkg works on FreeBSD. We can search for software by name, install or remove items. I found pkgin worked well, though its output can be terse. My only complaint with pkgin is that it does not handle “close enough” package names. For example, if I tried to run “pkgin install vlc” or “pkgin install firefox” I would quickly be told these items did not exist. But a more forgiving package manager will realize items like vlc2 or firefox45 are available and offer to install those.<br>
The pkgin tool installs new programs in the /usr/pkg/bin directory. Depending on your configuration and shell, this location may not be in your user’s path, and it will be helpful to adjust your PATH variable accordingly.<br>
The other common approach to acquiring new software is to use the pkgsrc framework. I have talked about using pkgsrc before and I will skip the details. Basically, we can download a collection of recipes for building popular open source software and run a command to download and install these items from their source code. Using pkgsrc basically gives us the same software as using pkgin would, but with some added flexibility on the options we use.<br>
Once new software has been installed, it may need to be enabled and activated, particularly if it uses (or is) a background service. New items can be enabled in the /etc/rc.conf file and started or stopped using the service command. This works about the same as the service command on FreeBSD and most non-systemd Linux distributions.</p>
</blockquote>

<ul>
<li>Hardware</li>
</ul>

<blockquote>
<p>I found that, when logged into the twm environment, NetBSD used about 130MB of RAM. This included kernel memory and all active memory. A fresh, Full install used up 1.5GB of disk space. I generally found NetBSD ran well in both VirtualBox and on my desktop computer. The system was quick and stable. I did have trouble getting a higher screen resolution in both environments. NetBSD does not offer VirtualBox add-on modules. There are NetBSD patches for VirtualBox out there, but there is some manual work involved in getting them working. When running on my desktop computer I think the resolution issue was one of finding and dealing with the correct video driver. Screen resolution aside, NetBSD performed well and detected all my hardware.</p>
</blockquote>

<ul>
<li>Personal projects</li>
</ul>

<blockquote>
<p>Since NetBSD provides users with a small, core operating system without many utilities if we want to use NetBSD for something we need to have a project in mind. I had four mini projects in mind I wanted to try this week: install a desktop environment, enable file sharing for computers on the local network, test multimedia (video, audio and YouTube capabilities), and set up a ZFS volume for storage.<br>
I began with the desktop. Specifically, I followed the same tutorial I used three years ago to try to set up the Xfce desktop. While Xfce and its supporting services installed, I was unable to get a working desktop out of the experience. I could get the Xfce window manager working, but not the entire session. This tutorial worked beautifully with NetBSD 7.0, but not with version 8.0. Undeterred, I switched gears and installed Fluxbox instead. This gave me a slightly more powerful graphical environment than what I had before with twm while maintaining performance. Fluxbox ran without any problems, though its application menu was automatically populated with many programs which were not actually installed.<br>
Next, I tried installing a few multimedia applications to play audio and video files. Here I ran into a couple of interesting problems. I found the music players I installed would play audio files, but the audio was quite slow. It always sounded like a cassette tape dragging. When I tried to play a video, the entire graphical session would crash, taking me back to the login screen. When I installed Firefox, I found I could play YouTube videos, and the video played smoothly, but again the audio was unusually slow.<br>
I set up two methods of sharing files on the local network: OpenSSH and FTP. NetBSD basically gives us OpenSSH for free at install time and I added an FTP server through the pkgin package manager which worked beautifully with its default configuration.<br>
I experimented with ZFS support a little, just enough to confirm I could create and access ZFS volumes. ZFS seems to work on NetBSD just as well, and with the same basic features, as it does on FreeBSD and mainstream Linux distributions. I think this is a good feature for the portable operating system to have since it means we can stick NetBSD on nearly any networked computer and use it as a NAS.</p>
</blockquote>

<ul>
<li>Conclusions</li>
</ul>

<blockquote>
<p>NetBSD, like its close cousins (FreeBSD and OpenBSD) does not do a lot of hand holding or automation. It offers a foundation that will run on most CPUs and we can choose to build on that foundation. I mention this because, on its own, NetBSD does not do much. If we want to get something out of it, we need to be willing to build on its foundation - we need a project. This is important to keep in mind as I think going into NetBSD and thinking, “Oh I’ll just explore around and expand on this as I go,” will likely lead to disappointment. I recommend figuring out what you want to do before installing NetBSD and making sure the required tools are available in the operating system’s repositories.<br>
Some of the projects I embarked on this week (using ZFS and setting up file sharing) worked well. Others, like getting multimedia support and a full-featured desktop, did not. Given more time, I’m sure I could find a suitable desktop to install (along with the required documentation to get it and its services running), or customize one based on one of the available window managers. However, any full featured desktop is going to require some manual work. Media support was not great. The right players and codecs were there, but I was not able to get audio to play smoothly.<br>
My main complaint with NetBSD relates to my struggle to get some features working to my satisfaction: the documentation is scattered. There are four different sections of the project’s website for documentation (FAQs, The Guide, manual pages and the wiki). Whatever we are looking for is likely to be in one of those, but which one? Or, just as likely, the tutorial we want is not there, but is on a forum or blog somewhere. I found that the documentation provided was often thin, more of a quick reference to remind people how something works rather than a full explanation.<br>
As an example, I found a couple of documents relating to setting up a firewall. One dealt with networking NetBSD on a LAN, another explored IPv6 support, but neither gave an overview on syntax or a basic guide to blocking all but one or two ports. It seemed like that information should already be known, or picked up elsewhere.<br>
Newcomers are likely to be a bit confused by software management guides for the same reason. Some pages refer to using a tool called pkg_add, others use pkgsrc and its make utility, others mention pkgin. Ultimately, these tools each give approximately the same result, but work differently and yet are mentioned almost interchangeably. I have used NetBSD before a few times and could stumble through these guides, but new users are likely to come away confused.<br>
One quirk of NetBSD, which may be a security feature or an inconvenience, depending on one’s point of view, is super user programs are not included in regular users’ paths. This means we need to change our path if we want to be able to run programs typically used by root. For example, shutdown and mount are not in regular users’ paths by default. This made checking some things tricky for me.<br>
Ultimately though, NetBSD is not famous for its convenience or features so much as its flexibility. The operating system will run on virtually any processor and should work almost identically across multiple platforms. That gives NetBSD users a good deal of consistency across a range of hardware and the chance to experiment with a member of the Unix family on hardware that might not be compatible with Linux or the other BSDs.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://tech.mangot.com/blog/2018/11/08/showing-a-gigabit-openbsd-firewall-some-monitoring-love/">Showing a Gigabit OpenBSD Firewall Some Monitoring Love</a></p>

<blockquote>
<p>I have a pretty long history of running my home servers or firewalls on “exotic” hardware. At first, it was Sun Microsystem hardware, then it moved to the excellent Soekris line, with some cool single board computers thrown in the mix. Recently I’ve been running OpenBSD Octeon on the Ubiquiti Edge Router Lite, an amazing little piece of kit at an amazing price point.</p>
</blockquote>

<ul>
<li>Upgrade Time!</li>
</ul>

<blockquote>
<p>This setup has served me for some time and I’ve been extremely happy with it. But, in the #firstworldproblems category, I recently upgraded the household to the amazing Gigabit fibre offering from Sonic. A great problem to have, but also too much of a problem for the little Edge Router Lite (ERL).<br>
The way the OpenBSD PF firewall works, it’s only able to process packets on a single core. Not a problem for the dual-core 500 MHz ERL when you’re pushing under ~200 Mbps, but more of a problem when you’re trying to push 1000 Mbps.<br>
I needed something that was faster on a per core basis but still satisfied my usual firewall requirements. Loosely:</p>
</blockquote>

<ul>
<li>small form factor</li>
<li>fan-less</li>
<li>multiple Intel Ethernet ports (good driver support)</li>
<li>low power consumption</li>
<li>not your regular off-the-shelf kit</li>
<li>relatively inexpensive</li>
</ul>

<blockquote>
<p>After evaluating a LOT of different options I settled on the Protectli Vault FW2B. With the specs required for the firewall (2 GB RAM and 8 GB drive) it comes in at a mere $239 USD! Installation of OpenBSD 6.4 was pretty straight forward, with the only problem I had was Etcher did not want to recognize the ‘.fs’ extension on the install image as bootable image. I quickly fixed this with good old Unix dd(1) on the Mac. Everything else was incredibly smooth.<br>
After loading the same rulesets on my new install, the results were fantastic!</p>
</blockquote>

<ul>
<li>Monitoring</li>
</ul>

<blockquote>
<p>Now that the machine was up and running (and fast!), I wanted to know what it was doing. Over the years, I’ve always relied on the venerable pfstat software to give me an overview of my traffic, blocked packets, etc. It looks like this:<br>
As you can see it’s based on RRDtool, which was simply incredible in its time. Having worked on monitoring almost continuously for almost the past decade, I wanted to see if we could re-implement the same functionality using more modern tools as RRDtool and pfstat definitely have their limitations. This might be an opportunity to learn some new things as well.<br>
I came across pf-graphite which seemed to be a great start! He had everything I needed and I added a few more stats from the detailed interface statistics and the ability for the code to exit for running from cron(8), which is a bit more OpenBSD style. I added code for sending to some SaaS metrics platforms but ultimately stuck with straight Graphite. One important thing to note was to use the Graphite pickle port (2004) instead of the default plaintext port for submission. Also you will need to set a loginterface in your ‘pf.conf’.<br>
A bit of tweaking with Graphite and Grafana, and I had a pretty darn good recreation of my original PF stats dashboard!<br>
As you can see it’s based on RRDtool, which was simply incredible in its time. Having worked on monitoring almost continuously for almost the past decade, I wanted to see if we could re-implement the same functionality using more modern tools as RRDtool and pfstat definitely have their limitations. This might be an opportunity to learn some new things as well.<br>
I came across pf-graphite which seemed to be a great start! He had everything I needed and I added a few more stats from the detailed interface statistics and the ability for the code to exit for running from cron(8), which is a bit more OpenBSD style. I added code for sending to some SaaS metrics platforms but ultimately stuck with straight Graphite. One important thing to note was to use the Graphite pickle port (2004) instead of the default plaintext port for submission. Also you will need to set a loginterface in your ‘pf.conf’.<br>
A bit of tweaking with Graphite and Grafana, and I had a pretty darn good recreation of my original PF stats dashboard!</p>
</blockquote>

<p>###<a href="https://twobithistory.org/2018/11/12/cat.html">The Source History of Cat</a></p>

<blockquote>
<p>I once had a debate with members of my extended family about whether a computer science degree is a degree worth pursuing. I was in college at the time and trying to decide whether I should major in computer science. My aunt and a cousin of mine believed that I shouldn’t. They conceded that knowing how to program is of course a useful and lucrative thing, but they argued that the field of computer science advances so quickly that everything I learned would almost immediately be outdated. Better to pick up programming on the side and instead major in a field like economics or physics where the basic principles would be applicable throughout my lifetime.<br>
I knew that my aunt and cousin were wrong and decided to major in computer science. (Sorry, aunt and cousin!) It is easy to see why the average person might believe that a field like computer science, or a profession like software engineering, completely reinvents itself every few years. We had personal computers, then the web, then phones, then machine learning… technology is always changing, so surely all the underlying principles and techniques change too. Of course, the amazing thing is how little actually changes. Most people, I’m sure, would be stunned to know just how old some of the important software on their computer really is. I’m not talking about flashy application software, admittedly—my copy of Firefox, the program I probably use the most on my computer, is not even two weeks old. But, if you pull up the manual page for something like grep, you will see that it has not been updated since 2010 (at least on MacOS). And the original version of grep was written in 1974, which in the computing world was back when dinosaurs roamed Silicon Valley. People (and programs) still depend on grep every day.<br>
My aunt and cousin thought of computer technology as a series of increasingly elaborate sand castles supplanting one another after each high tide clears the beach. The reality, at least in many areas, is that we steadily accumulate programs that have solved problems. We might have to occasionally modify these programs to avoid software rot, but otherwise they can be left alone.  grep is a simple program that solves a still-relevant problem, so it survives. Most application programming is done at a very high level, atop a pyramid of much older code solving much older problems. The ideas and concepts of 30 or 40 years ago, far from being obsolete today, have in many cases been embodied in software that you can still find installed on your laptop.<br>
I thought it would be interesting to take a look at one such old program and see how much it had changed since it was first written. cat is maybe the simplest of all the Unix utilities, so I’m going to use it as my example. Ken Thompson wrote the original implementation of cat in 1969. If I were to tell somebody that I have a program on my computer from 1969, would that be accurate? How much has cat really evolved over the decades? How old is the software on our computers?<br>
Thanks to repositories like this one, we can see exactly how cat has evolved since 1969. I’m going to focus on implementations of cat that are ancestors of the implementation I have on my Macbook. You will see, as we trace cat from the first versions of Unix down to the cat in MacOS today, that the program has been rewritten more times than you might expect—but it ultimately works more or less the same way it did fifty years ago.</p>
</blockquote>

<ul>
<li>Research Unix</li>
</ul>

<blockquote>
<p>Ken Thompson and Dennis Ritchie began writing Unix on a PDP 7. This was in 1969, before C, so all of the early Unix software was written in PDP 7 assembly. The exact flavor of assembly they used was unique to Unix, since Ken Thompson wrote his own assembler that added some features on top of the assembler provided by DEC, the PDP 7’s manufacturer. Thompson’s changes are all documented in the original Unix Programmer’s Manual under the entry for as, the assembler.<br>
The first implementation of cat is thus in PDP 7 assembly. I’ve added comments that try to explain what each instruction is doing, but the program is still difficult to follow unless you understand some of the extensions Thompson made while writing his assembler. There are two important ones. First, the ; character can be used to separate multiple statements on the same line. It appears that this was used most often to put system call arguments on the same line as the sys instruction. Second, Thompson added support for “temporary labels” using the digits 0 through 9. These are labels that can be reused throughout a program, thus being, according to the Unix Programmer’s Manual, “less taxing both on the imagination of the programmer and on the symbol space of the assembler.” From any given instruction, you can refer to the next or most recent temporary label n using nf and nb respectively. For example, if you have some code in a block labeled 1:, you can jump back to that block from further down by using the instruction jmp 1b. (But you cannot jump forward to that block from above without using jmp 1f instead.)<br>
The most interesting thing about this first version of cat is that it contains two names we should recognize. There is a block of instructions labeled getc and a block of instructions labeled putc, demonstrating that these names are older than the C standard library. The first version of cat actually contained implementations of both functions. The implementations buffered input so that reads and writes were not done a character at a time.<br>
The first version of cat did not last long. Ken Thompson and Dennis Ritchie were able to persuade Bell Labs to buy them a PDP 11 so that they could continue to expand and improve Unix. The PDP 11 had a different instruction set, so cat had to be rewritten. I’ve marked up this second version of cat with comments as well. It uses new assembler mnemonics for the new instruction set and takes advantage of the PDP 11’s various addressing modes. (If you are confused by the parentheses and dollar signs in the source code, those are used to indicate different addressing modes.) But it also leverages the  ; character and temporary labels just like the first version of cat, meaning that these features must have been retained when as was adapted for the PDP 11.<br>
The second version of cat is significantly simpler than the first. It is also more “Unix-y” in that it doesn’t just expect a list of filename arguments—it will, when given no arguments, read from stdin, which is what cat still does today. You can also give this version of cat an argument of - to indicate that it should read from stdin.<br>
In 1973, in preparation for the release of the Fourth Edition of Unix, much of Unix was rewritten in C. But cat does not seem to have been rewritten in C until a while after that. The first C implementation of cat only shows up in the Seventh Edition of Unix. This implementation is really fun to look through because it is so simple. Of all the implementations to follow, this one most resembles the idealized cat used as a pedagogic demonstration in K&amp;R C. The heart of the program is the classic two-liner:</p>
</blockquote>

<p><code>while ((c = getc(fi)) != EOF)</code><br>
<code>putchar(c);</code></p>

<blockquote>
<p>There is of course quite a bit more code than that, but the extra code is mostly there to ensure that you aren’t reading and writing to the same file. The other interesting thing to note is that this implementation of cat only recognized one flag, -u. The -u flag could be used to avoid buffering input and output, which cat would otherwise do in blocks of 512 bytes.</p>
</blockquote>

<ul>
<li>BSD</li>
</ul>

<blockquote>
<p>After the Seventh Edition, Unix spawned all sorts of derivatives and offshoots. MacOS is built on top of Darwin, which in turn is derived from the Berkeley Software Distribution (BSD), so BSD is the Unix offshoot we are most interested in. BSD was originally just a collection of useful programs and add-ons for Unix, but it eventually became a complete operating system. BSD seems to have relied on the original cat implementation up until the fourth BSD release, known as 4BSD, when support was added for a whole slew of new flags. The 4BSD implementation of cat is clearly derived from the original implementation, though it adds a new function to implement the behavior triggered by the new flags. The naming conventions already used in the file were adhered to—the fflg variable, used to mark whether input was being read from stdin or a file, was joined by nflg, bflg, vflg, sflg, eflg, and  tflg, all there to record whether or not each new flag was supplied in the invocation of the program. These were the last command-line flags added to  cat; the man page for cat today lists these flags and no others, at least on Mac OS. 4BSD was released in 1980, so this set of flags is 38 years old.<br>
cat would be entirely rewritten a final time for BSD Net/2, which was, among other things, an attempt to avoid licensing issues by replacing all AT&amp;T Unix-derived code with new code. BSD Net/2 was released in 1991. This final rewrite of cat was done by Kevin Fall, who graduated from Berkeley in 1988 and spent the next year working as a staff member at the Computer Systems Research Group (CSRG). Fall told me that a list of Unix utilities still implemented using AT&amp;T code was put up on a wall at CSRG and staff were told to pick the utilities they wanted to reimplement. Fall picked cat and  mknod. The cat implementation bundled with MacOS today is built from a source file that still bears his name at the very top. His version of cat, even though it is a relatively trivial program, is today used by millions.<br>
Fall’s original implementation of cat is much longer than anything we have seen so far. Other than support for a -? help flag, it adds nothing in the way of new functionality. Conceptually, it is very similar to the 4BSD implementation. It is only longer because Fall separates the implementation into a “raw” mode and a “cooked” mode. The “raw” mode is cat classic; it prints a file character for character. The “cooked” mode is cat with all the 4BSD command-line options. The distinction makes sense but it also pads out the implementation so that it seems more complex at first glance than it actually is. There is also a fancy error handling function at the end of the file that further adds to its length.</p>
</blockquote>

<ul>
<li>MacOS</li>
</ul>

<blockquote>
<p>The very first release of Mac OS X thus includes an implementation of cat pulled from the NetBSD project. So the first Mac OS X implementation of cat is Kevin Fall’s cat. The only thing that had changed over the intervening decade was that Fall’s error-handling function err() was removed and the err() function made available by err.h was used in its place. err.h is a BSD extension to the C standard library.<br>
The NetBSD implementation of cat was later swapped out for FreeBSD’s implementation of cat. According to Wikipedia, Apple began using FreeBSD instead of NetBSD in Mac OS X 10.3 (Panther). But the Mac OS X implementation of cat, according to Apple’s own open source releases, was not replaced until Mac OS X 10.5 (Leopard) was released in 2007. The FreeBSD implementation that Apple swapped in for the Leopard release is the same implementation on Apple computers today. As of 2018, the implementation has not been updated or changed at all since 2007.<br>
So the Mac OS cat is old. As it happens, it is actually two years older than its 2007 appearance in MacOS X would suggest. This 2005 change, which is visible in FreeBSD’s Github mirror, was the last change made to FreeBSD’s cat before Apple pulled it into Mac OS X. So the Mac OS X cat implementation, which has not been kept in sync with FreeBSD’s cat implementation, is officially 13 years old. There’s a larger debate to be had about how much software can change before it really counts as the same software; in this case, the source file has not changed at all since 2005.<br>
The cat implementation used by Mac OS today is not that different from the implementation that Fall wrote for the 1991 BSD Net/2 release. The biggest difference is that a whole new function was added to provide Unix domain socket support. At some point, a FreeBSD developer also seems to have decided that Fall’s raw_args() function and cook_args() should be combined into a single function called scanfiles(). Otherwise, the heart of the program is still Fall’s code.<br>
I asked Fall how he felt about having written the cat implementation now used by millions of Apple users, either directly or indirectly through some program that relies on cat being present. Fall, who is now a consultant and a co-author of the most recent editions of TCP/IP Illustrated, says that he is surprised when people get such a thrill out of learning about his work on cat. Fall has had a long career in computing and has worked on many high-profile projects, but it seems that many people still get most excited about the six months of work he put into rewriting cat in 1989.</p>
</blockquote>

<ul>
<li>The Hundred-Year-Old Program</li>
</ul>

<blockquote>
<p>In the grand scheme of things, computers are not an old invention. We’re used to hundred-year-old photographs or even hundred-year-old camera footage. But computer programs are in a different category—they’re high-tech and new. At least, they are now. As the computing industry matures, will we someday find ourselves using programs that approach the hundred-year-old mark?<br>
Computer hardware will presumably change enough that we won’t be able to take an executable compiled today and run it on hardware a century from now. Perhaps advances in programming language design will also mean that nobody will understand C in the future and cat will have long since been rewritten in another language. (Though C has already been around for fifty years, and it doesn’t look like it is about to be replaced any time soon.) But barring all that, why not just keep using the cat we have forever?<br>
I think the history of cat shows that some ideas in computer science are in fact very durable. Indeed, with cat, both the idea and the program itself are old. It may not be accurate to say that the cat on my computer is from 1969. But I could make a case for saying that the cat on my computer is from 1989, when Fall wrote his implementation of cat. Lots of other software is just as ancient. So maybe we shouldn’t think of computer science and software development primarily as fields that disrupt the status quo and invent new things. Our computer systems are built out of historical artifacts. At some point, we may all spend more time trying to understand and maintain those historical artifacts than we spend writing new code.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://www.bleepingcomputer.com/news/security/trivial-bug-in-xorg-gives-root-permission-on-linux-and-bsd-systems/">Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems</a></p>

<blockquote>
<p>A vulnerability that is trivial to exploit allows privilege escalation to root level on Linux and BSD distributions using <a href="http://X.Org">X.Org</a> server, the open source implementation of the X Window System that offers the graphical environment.<br>
The flaw is now identified as CVE-2018-14665 (credited to security researcher Narendra Shinde). It has been present in xorg-server for two years, since version 1.19.0 and is exploitable by a limited user as long as the X server runs with elevated permissions.</p>
</blockquote>

<ul>
<li>Privilege escalation and arbitrary file overwrite</li>
</ul>

<blockquote>
<p>An advisory on Thursday describes the problem as an “incorrect command-line parameter validation” that also allows an attacker to overwrite arbitrary files.<br>
Privilege escalation can be accomplished via the -modulepath argument by setting an insecure path to modules loaded by the <a href="http://X.org">X.org</a> server. Arbitrary file overwrite is possible through the -logfile argument, because of improper verification when parsing the option.</p>
</blockquote>

<ul>
<li>Bug could have been avoided in OpenBSD 6.4</li>
</ul>

<blockquote>
<p>OpenBSD, the free and open-source operating system with a strong focus on security, uses xorg. On October 18, the project released version 6.4 of the OS, affected by CVE-2018-14665. This could have been avoided, though.<br>
Theo de Raadt, founder and leader of the OpenBSD project, says that X maintainer knew about the problem since at least October 11. For some reason, the OpenBSD developers received the message one hour before the public announcement this Thursday, a week after their new OS release.<br>
“As yet we don’t have answers about why our X maintainer (on the X security team) and his team provided information to other projects (some who don’t even ship with this new X server) but chose to not give us a heads-up which could have saved all the new 6.4 users a lot of grief,” Raadt says.<br>
Had OpenBSD developers known about the bug before the release, they could have taken steps to mitigate the problem or delay the launch for a week or two.<br>
To remedy the problem, the OpenBSD project provides a source code patch, which requires compiling and rebuilding the X server.<br>
As a temporary solution, users can disable the Xorg binary by running the following command:</p>
</blockquote>

<p><code>chmod u-s /usr/X11R6/bin/Xorg</code></p>

<ul>
<li>Trivial exploitation</li>
</ul>

<blockquote>
<p>CVE-2018-14665 does not help compromise systems, but it is useful in the following stages of an attack.<br>
Leveraging it after gaining access to a vulnerable machine is fairly easy. Matthew Hickey, co-founder, and head of Hacker House security outfit created and published an exploit, saying that it can be triggered from a remote SSH session.<br>
Three hours after the public announcement of the security gap, Daemon Security CEO Michael Shirk replied with one line that overwrote shadow files on the system. Hickey did one better and fit the entire local privilege escalation exploit in one line.<br>
Apart from OpenBSD, other operating systems affected by the bug include Debian and Ubuntu, Fedora and its downstream distro  Red Hat Enterprise Linux along with its community-supported counterpart CentOS.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.gsora.xyz/openbsd-on-the-desktop-some-thoughts/">OpenBSD on the Desktop: some thoughts</a></p>

<blockquote>
<p>I’ve been using OpenBSD on my ThinkPad X230 for some weeks now, and the experience has been peculiar in some ways.<br>
The OS itself in my opinion is not ready for widespread desktop usage, and the development team is not trying to push it in the throat of anybody who wants a Windows or macOS alternative.<br>
You need to understand a little bit of how *NIX systems work, because you’ll use CLI more than UI.<br>
That’s not necessarily bad, and I’m sure I learned a trick or two that could translate easily to Linux or macOS.<br>
Their development process is purely based on developers that love to contribute and hack around, just because it’s fun.<br>
Even the mailing list is a cool place to hang on!<br>
Code correctness and security are a must, nothing gets committed if it doesn’t get reviewed thoroughly first - nowadays the first two properties should be enforced in every major operating system.<br>
I like the idea of a platform that continually evolves.<br>
pledge(2) and unveil(2) are the proof that with a little effort, you can secure existing software better than ever.<br>
I like the “sensible defaults” approach, having an OS ready to be used - UI included if you selected it during the setup process - is great.<br>
Just install a browser and you’re ready to go.<br>
Manual pages on OpenBSD are real manuals, not an extension of the “–help” command found in most CLI softwares.<br>
They help you understand inner workings of the operating system, no internet connection needed.<br>
There are some trade-offs, too.<br>
Performance is not first-class, mostly because of all the security mitigations and checks done at runtime3.<br>
I write Go code in neovim, and sometimes you can feel a slight slowdown when you’re compiling and editing multiple files at the same time, but usually I can’t notice any meaningful difference.<br>
Browsers are a different matter though, you can definitely feel something differs from the experience you can have on mainstream operating systems.<br>
But again, trade-offs.<br>
To use OpenBSD on the desktop you must be ready to sacrifice some of the goodies of mainstream OSes, but if you’re searching for a zen place to do your computing stuff, it’s the best you can get right now.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://distrowatch.com/weekly.php?issue=20180813#nomadbsd">Review: NomadBSD 1.1</a></p>

<blockquote>
<p>One of the most recent additions to the DistroWatch database is NomadBSD. According to the NomadBSD website: “NomadBSD is a 64-bit live system for USB flash drives, based on FreeBSD. Together with automatic hardware detection and setup, it is configured to be used as a desktop system that works out of the box, but can also be used for data recovery.”<br>
The latest release of NomadBSD (or simply “Nomad”, as I will refer to the project in this review) is version 1.1. It is based on FreeBSD 11.2 and is offered in two builds, one for generic personal computers and one for Macbooks. The release announcement mentions version 1.1 offers improved video driver support for Intel and AMD cards. The operating system ships with Octopkg for graphical package management and the system should automatically detect, and work with, VirtualBox environments.<br>
Nomad 1.1 is available as a 2GB download, which we then decompress to produce a 4GB file which can be written to a USB thumb drive. There is no optical media build of Nomad as it is designed to be run entirely from the USB drive, and write data persistently to the drive, rather than simply being installed from the USB media.</p>
</blockquote>

<ul>
<li>Initial setup</li>
</ul>

<blockquote>
<p>Booting from the USB drive brings up a series of text-based menus which ask us to configure key parts of the operating system. We are asked to select our time zone, keyboard layout, keyboard model, keyboard mapping and our preferred language. While we can select options from a list, the options tend to be short and cryptic. Rather than “English (US)”, for example, we might be given “en_US”. We are also asked to create a password for the root user account and another one for a regular user which is called “nomad”. We can then select which shell nomad will use. The default is zsh, but there are plenty of other options, including csh and bash. We have the option of encrypting our user’s home directory.<br>
I feel it is important to point out that these settings, and nomad’s home directory, are stored on the USB drive. The options and settings we select will not be saved to our local hard drive and our configuration choices will not affect other operating systems already installed on our computer. At the end, the configuration wizard asks if we want to run the BSDstats service. This option is not explained at all, but it contacts BSDstats to provide some basic statistics on BSD users.<br>
The system then takes a few minutes to apply its changes to the USB drive and automatically reboots the computer. While running the initial setup wizard, I had nearly identical experiences when running Nomad on a physical computer and running the operating system in a VirtualBox virtual machine. However, after the initial setup process was over, I had quite different experiences depending on the environment so I want to divide my experiences into two different sections.</p>
</blockquote>

<ul>
<li>Physical desktop computer</li>
</ul>

<blockquote>
<p>At first, Nomad failed to boot on my desktop computer. From the operating system’s boot loader, I enabled Safe Mode which allowed Nomad to boot. At that point, Nomad was able to start up, but would only display a text console. The desktop environment failed to start when running in Safe Mode.<br>
Networking was also disabled by default and I had to enable a network interface and DHCP address assignment to connect to the Internet. Instructions for enabling networking can be found in FreeBSD’s Handbook. Once we are on-line we can use the pkg command line package manager to install and update software. Had the desktop environment worked then the Octopkg graphical package manager would also be available to make browsing and installing software a point-n-click experience.<br>
Had I been able to run the desktop for prolonged amounts of time I could have made use of such pre-installed items as the Firefox web browser, the VLC media player, LibreOffice and Thunderbird. Nomad offers a fairly small collection of desktop applications, but what is there is mostly popular, capable software.<br>
When running the operating system I noted that, with one user logged in, Nomad only runs 15 processes with the default configuration. These processes require less than 100MB of RAM, and the whole system fits comfortably on a 4GB USB drive.</p>
</blockquote>

<ul>
<li>Conclusions</li>
</ul>

<blockquote>
<p>Ultimately using Nomad was not a practical option for me. The operating system did not work well with my hardware, or the virtual environment. In the virtual machine, Nomad crashed consistently after just a few minutes of uptime. On the desktop computer, I could not get a desktop environment to run. The command line tools worked well, and the system performed tasks very quickly, but a command line only environment is not well suited to my workflow.<br>
I like the idea of what NomadBSD is offering. There are not many live desktop flavours of FreeBSD, apart from GhostBSD. It was nice to see developers trying to make a FreeBSD-based, plug-and-go operating system that would offer a desktop and persistent storage. I suspect the system would work and perform its stated functions on different hardware, but in my case my experiment was necessarily short lived.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://oshogbo.vexillium.org/blog/50/">FreeBSD lockless algorithm - seq</a></li>
<li><a href="https://github.com/bob-beck/libtls/blob/master/TUTORIAL.md">Happy Bob’s Libtls tutorial</a></li>
<li><a href="https://chown.me/blog/locking-openbsd-when-sleeping.html">Locking OpenBSD when it’s sleeping</a></li>
<li><a href="https://www.geoghegan.ca/serviio.html">iio - The OpenBSD Way</a></li>
<li><a href="https://bsdboy.ml/blog/installing-hugo-and-hosting-on-openbsd.html">Installing Hugo and Hosting Website on OpenBSD Server</a></li>
<li><a href="http://blog.osorio.me/post.php?idpost=1">Fosdem 2019 reminder: BSD devroom CfP</a></li>
<li><a href="https://www.youtube.com/watch?v=4gOoPxGKKjA&amp;feature=youtu.be">OpenBGPD, gotta go fast! - Claudio Jeker</a></li>
<li><a href="http://project-trident.org/post/2018-11-10_rc3-available/">Project Trident RC3 available</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2018-November/001849.html">FreeBSD 10.4 EOL</a></li>
<li><a href="https://bsd.network/@ephemeris/101073578346815313">Play “Crazy Train” through your APU2 speaker</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Tobias - <a href="http://dpaste.com/174WGEY#wrap">Satisfying my storage hunger and wallet pains</a></li>
<li>Lasse - <a href="http://dpaste.com/1QBMH73">Question regarding FreeBSD backups</a>
<ul>
<li><a href="https://twitter.com/dlangille">https://twitter.com/dlangille</a></li>
<li><a href="https://dan.langille.org/">https://dan.langille.org/</a></li>
</ul>

<p></li><br>
</ul><br>
<hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 272: Detain the bhyve | BSD Now 272</title>
  <link>https://www.bsdnow.tv/272</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2899</guid>
  <pubDate>Thu, 15 Nov 2018 13:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/23422ca9-e188-4755-aaf1-295422643d21.mp3" length="41375491" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Byproducts of reading OpenBSD’s netcat code, learnings from porting your own projects to FreeBSD, OpenBSD’s unveil(), NetBSD’s Virtual Machine Monitor, what 'dependency' means in Unix init systems, jailing bhyve, and more.</itunes:subtitle>
  <itunes:duration>1:08:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Byproducts of reading OpenBSD’s netcat code, learnings from porting your own projects to FreeBSD, OpenBSD’s unveil(), NetBSD’s Virtual Machine Monitor, what 'dependency' means in Unix init systems, jailing bhyve, and more.
&lt;p&gt;##Headlines&lt;br&gt; ###&lt;a href="https://nanxiao.me/en/the-byproducts-of-reading-openbsd-netcat-code/"&gt;The byproducts of reading OpenBSD netcat code&lt;/a&gt;&lt;/p&gt; &lt;blockquote&gt; &lt;p&gt;When I took part in a training last year, I heard about netcat for the first time. During that class, the tutor showed some hacks and tricks of using netcat which appealed to me and motivated me to learn the guts of it. Fortunately, in the past 2 months, I was not so busy that I can spend my spare time to dive into OpenBSD‘s netcat source code, and got abundant byproducts during this process.&lt;br&gt; (1) Brush up socket programming. I wrote my first network application more than 10 years ago, and always think the socket APIs are marvelous. Just ~10 functions (socket, bind, listen, accept…) with some IO multiplexing buddies (select, poll, epoll…) connect the whole world, wonderful! From that time, I developed a habit that is when touching a new programming language, network programming is an essential exercise. Even though I don’t write socket related code now, reading netcat socket code indeed refresh my knowledge and teach me new stuff.&lt;br&gt; (2) Write a tutorial about netcat. I am mediocre programmer and will forget things when I don’t use it for a long time. So I just take notes of what I think is useful. IMHO, this “tutorial” doesn’t really mean teach others something, but just a journal which I can refer when I need in the future.&lt;br&gt; (3) Submit patches to netcat. During reading code, I also found bugs and some enhancements. Though trivial contributions to OpenBSD, I am still happy and enjoy it.&lt;br&gt; (4) Implement a C++ encapsulation of libtls. OpenBSD‘s netcat supports tls/ssl connection, but it needs you take full care of resource management (memory, socket, etc), otherwise a small mistake can lead to resource leak which is fatal for long-live applications (In fact, the two bugs I reported to OpenBSD are all related resource leak). Therefore I develop a simple C++ library which wraps the libtls and hope it can free developer from this troublesome problem and put more energy in application logic part.&lt;br&gt; Long story to short, reading classical source code is a rewarding process, and you can consider to try it yourself.&lt;/p&gt; &lt;/blockquote&gt; &lt;hr&gt; &lt;p&gt;###&lt;a href="https://github.com/shlomif/what-i-learned-from-porting-to-freebsd#what-i-learned-from-porting-my-projects-to-freebsd"&gt;What I learned from porting my projects to FreeBSD&lt;/a&gt;&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Introduction&lt;/li&gt; &lt;/ul&gt; &lt;blockquote&gt; &lt;p&gt;I set up a local FreeBSD VirtualBox VM to test something, and it seems to work very well. Due to the novelty factor, I decided to get my software projects to build and pass the tests there.&lt;/p&gt; &lt;/blockquote&gt; &lt;ul&gt; &lt;li&gt; &lt;p&gt;The Projects&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;&lt;a href="https://github.com/shlomif/shlomif-computer-settings/"&gt;https://github.com/shlomif/shlomif-computer-settings/&lt;/a&gt; (my dotfiles).&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;&lt;a href="https://web-cpan.shlomifish.org/latemp/"&gt;https://web-cpan.shlomifish.org/latemp/&lt;/a&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;&lt;a href="https://fc-solve.shlomifish.org/"&gt;https://fc-solve.shlomifish.org/&lt;/a&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;&lt;a href="https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/"&gt;https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/&lt;/a&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;&lt;a href="https://better-scm.shlomifish.org/source/"&gt;https://better-scm.shlomifish.org/source/&lt;/a&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;&lt;a href="http://perl-begin.org/source/"&gt;http://perl-begin.org/source/&lt;/a&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;&lt;a href="https://www.shlomifish.org/meta/site-source/"&gt;https://www.shlomifish.org/meta/site-source/&lt;/a&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;Written using a mix of C, Perl 5, Python, Ruby, GNU Bash, XML, CMake, XSLT, XHTML5, XHTML1.1, Website META Language, JavaScript and more.&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;Work fine on several Linux distributions and have &lt;a href="https://en.wikipedia.org/wiki/Travis_CI"&gt;https://en.wikipedia.org/wiki/TravisCI&lt;/a&gt; using Ubuntu 14.04 hosts&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;Some pass builds and tests on AppVeyor/Win64&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;What I Learned:&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;FreeBSD on VBox has become very reliable&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;Some executables on FreeBSD are in /usr/local/bin instead of /usr/bin&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;make on FreeBSD is not GNU make&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;m4 on FreeBSD is not compatible with GNU m4&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;Some CPAN Modules fail to install using local-lib there&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;DocBook/XSL Does Not Live Under /usr/share/sgml&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;FreeBSD’s grep does not have a “-P” flag by default&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;FreeBSD has no “nproc” command&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;Conclusion:&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;It is easier to port a shell than a shell script. — Larry Wall&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;I ran into some cases where my scriptology was lacking and suboptimal, even for my own personal use, and fixed them.&lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;hr&gt; &lt;p&gt;##News Roundup&lt;br&gt; ###&lt;a href="https://lwn.net/Articles/767137/"&gt;OpenBSD’s unveil()&lt;/a&gt;&lt;/p&gt; &lt;blockquote&gt; &lt;p&gt;One of the key aspects of hardening the user-space side of an operating system is to provide mechanisms for restricting which parts of the filesystem hierarchy a given process can access. Linux has a number of mechanisms of varying capability and complexity for this purpose, but other kernels have taken a different approach. Over the last few months, OpenBSD has inaugurated a new system call named unveil() for this type of hardening that differs significantly from the mechanisms found in Linux.&lt;br&gt; The value of restricting access to the filesystem, from a security point of view, is fairly obvious. A compromised process cannot exfiltrate data that it cannot read, and it cannot corrupt files that it cannot write. Preventing unwanted access is, of course, the purpose of the permissions bits attached to every file, but permissions fall short in an important way: just because a particular user has access to a given file does not necessarily imply that every program run by that user should also have access to that file. There is no reason why your PDF viewer should be able to read your SSH keys, for example. Relying on just the permission bits makes it easy for a compromised process to access files that have nothing to do with that process’s actual job.&lt;br&gt; In a Linux system, there are many ways of trying to restrict that access; that is one of the purposes behind the Linux security module (LSM) architecture, for example. The SELinux LSM uses a complex matrix of labels and roles to make access-control decisions. The AppArmor LSM, instead, uses a relatively simple table of permissible pathnames associated with each application; that approach was highly controversial when AppArmor was first merged, and is still looked down upon by some security developers. Mount namespaces can be used to create a special view of the filesystem hierarchy for a set of processes, rendering much of that hierarchy invisible and, thus, inaccessible. The seccomp mechanism can be used to make decisions on attempts by a process to access files, but that approach is complex and error-prone. Yet another approach can be seen in the Qubes OS distribution, which runs applications in virtual machines to strictly control what they can access.&lt;br&gt; Compared to many of the options found in Linux, unveil() is an exercise in simplicity. This system call, introduced in July, has this prototype:&lt;/p&gt; &lt;/blockquote&gt; &lt;p&gt;&lt;code&gt;int unveil(const char *path, const char *permissions);&lt;/code&gt;&lt;/p&gt; &lt;blockquote&gt; &lt;p&gt;A process that has never called unveil() has full access to the filesystem hierarchy, modulo the usual file permissions and any restrictions that may have been applied by calling pledge(). Calling unveil() for the first time will “drop a veil” across the entire filesystem, rendering the whole thing invisible to the process, with one exception: the file or directory hierarchy starting at path will be accessible with the given permissions. The permissions string can contain any of “r” for read access, “w” for write, “x” for execute, and “c” for the ability to create or remove the path.&lt;br&gt; Subsequent calls to unveil() will make other parts of the filesystem hierarchy accessible; the unveil() system call itself still has access to the entire hierarchy, so there is no problem with unveiling distinct subtrees that are, until the call is made, invisible to the process. If one unveil() call applies to a subtree of a hierarchy unveiled by another call, the permissions associated with the more specific call apply.&lt;br&gt; Calling unveil() with both arguments as null will block any further calls, setting the current view of the filesystem in stone. Calls to unveil() can also be blocked using pledge(). Either way, once the view of the filesystem has been set up appropriately, it is possible to lock it so that the process cannot expand its access in the future should it be taken over and turn hostile.&lt;br&gt; unveil() thus looks a bit like AppArmor, in that it is a path-based mechanism for restricting access to files. In either case, one must first study the program in question to gain a solid understanding of which files it needs to access before closing things down, or the program is likely to break. One significant difference (beyond the other sorts of behavior that AppArmor can control) is that AppArmor’s permissions are stored in an external policy file, while unveil() calls are made by the application itself. That approach keeps the access rules tightly tied to the application and easy for the developers to modify, but it also makes it harder for system administrators to change them without having to rebuild the application from source.&lt;br&gt; One can certainly aim a number of criticisms at unveil() — all of the complaints that have been leveled at path-based access control and more. But the simplicity of unveil() brings a certain kind of utility, as can be seen in the large number of OpenBSD applications that are being modified to use it. OpenBSD is gaining a base level of protection against unintended program behavior; while it is arguably possible to protect a Linux system to a much greater extent, the complexity of the mechanisms involved keeps that from happening in a lot of real-world deployments. There is a certain kind of virtue to simplicity in security mechanisms.&lt;/p&gt; &lt;/blockquote&gt; &lt;hr&gt; &lt;p&gt;###&lt;a href="http://m00nbsd.net/4e0798b7f2620c965d0dd9d6a7a2f296.html"&gt;NetBSD Virtual Machine Monitor (NVVM)&lt;/a&gt;&lt;/p&gt; &lt;ul&gt; &lt;li&gt;NetBSD Virtual Machine Monitor&lt;/li&gt; &lt;/ul&gt; &lt;blockquote&gt; &lt;p&gt;The NVMM driver provides hardware-accelerated virtualization support on NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is provided in libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary.&lt;/p&gt; &lt;/blockquote&gt; &lt;ul&gt; &lt;li&gt;Download&lt;/li&gt; &lt;/ul&gt; &lt;blockquote&gt; &lt;p&gt;The source code of NVMM, plus the associated tools, can be downloaded here.&lt;/p&gt; &lt;/blockquote&gt; &lt;ul&gt; &lt;li&gt;Technical details&lt;/li&gt; &lt;/ul&gt; &lt;blockquote&gt; &lt;p&gt;NVMM can support up to 128 virtual machines, each having a maximum of 256 VCPUs and 4GB of RAM.&lt;br&gt; Each virtual machine is granted access to most of the CPU registers: the GPRs (obviously), the Segment Registers, the Control Registers, the Debug Registers, the FPU (x87 and SSE), and several MSRs.&lt;br&gt; Events can be injected in the virtual machines, to emulate device interrupts. A delay mechanism is used, and allows VMM software to schedule the interrupt right when the VCPU can receive it. NMIs can be injected as well, and use a similar mechanism.&lt;br&gt; The host must always be x8664, but the guest has no constraint on the mode, so it can be x8632, PAE, real mode, and so on.&lt;br&gt; The TSC of each VCPU is always re-based on the host CPU it is executing on, and is therefore guaranteed to increase regardless of the host CPU. However, it may not increase monotonically, because it is not possible to fully hide the host effects on the guest during #VMEXITs.&lt;br&gt; When there are more VCPUs than the host TLB can deal with, NVMM uses a shared ASID, and flushes the shared-ASID VCPUs on each VM switch.&lt;br&gt; The different intercepts are configured in such a way that they cover everything that needs to be emulated. In particular, the LAPIC can be emulated by VMM software, by intercepting reads/writes to the LAPIC page in memory, and monitoring changes to CR8 in the exit state.&lt;/p&gt; &lt;/blockquote&gt; &lt;hr&gt; &lt;p&gt;###&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/sysadmin/InitDependencyUnclear"&gt;What ‘dependency’ means in Unix init systems is underspecified (utoronto.ca)&lt;/a&gt;&lt;/p&gt; &lt;blockquote&gt; &lt;p&gt;I was reading Davin McCall’s On the vagaries of init systems (via) when I ran across the following, about the relationship between various daemons (services, etc):&lt;br&gt; I do not see any compelling reason for having ordering relationships without actual dependency, as both Nosh and Systemd provide for. In comparison, Dinit’s dependencies also imply an ordering, which obviates the need to list a dependency twice in the service description.&lt;br&gt; Well, this may be an easy one but it depends on what an init system means by ‘dependency’. Let’s consider ®syslog and the SSH daemon. I want the syslog daemon to be started before the SSH daemon is started, so that the SSH daemon can log things to it from the beginning. However, I very much do not want the SSH daemon to not be started (or to be shut down) if the syslog daemon fails to start or later fails. If syslog fails, I still want the SSH daemon to be there so that I can perhaps SSH in to the machine and fix the problem.&lt;br&gt; This is generally true of almost all daemons; I want them to start after syslog, so that they can syslog things, but I almost never want them to not be running if syslog failed. (And if for some reason syslog is not configured to start, I want enabling and starting, say, SSH, to also enable and start the syslog daemon.)&lt;br&gt; In general, there are three different relationships between services that I tend to encounter:&lt;/p&gt; &lt;/blockquote&gt; &lt;ul&gt; &lt;li&gt; &lt;p&gt;a hard requirement, where service B is useless or dangerous without service A. For instance, many NFS v2 and NFS v3 daemons basically don’t function without the RPC portmapper alive and active. On any number of systems, firewall rules being in place are a hard requirement to start most network services; you would rather your network services not start at all than that they start without your defenses in place.&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;a want, where service B wants service A to be running before B starts up, and service A should be started even if it wouldn’t otherwise be, but the failure of A still leaves B functional. Many daemons want the syslog daemon to be started before they start but will run without it, and often you want them to do so so that at least some of the system works even if there is, say, a corrupt syslog configuration file that causes the daemon to error out on start. (But some environments want to hard-fail if they can’t collect security related logging information, so they might make rsyslogd a requirement instead of a want.)&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;an ordering, where if service A is going to be started, B wants to start after it (or before it), but B isn’t otherwise calling for A to be started. We have some of these in our systems, where we need NFS mounts done before cron starts and runs people’s @reboot jobs but neither cron nor NFS mounts exactly or explicitly want each other. (The system as a whole wants both, but that’s a different thing.)&lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;blockquote&gt; &lt;p&gt;Given these different relationships and the implications for what the init system should do in different situations, talking about ‘dependency’ in it systems is kind of underspecified. What sort of dependency? What happens if one service doesn’t start or fails later?&lt;br&gt; My impression is that generally people pick a want relationship as the default meaning for init system ‘dependency’. Usually this is fine; most services aren’t actively dangerous if one of their declared dependencies fails to start, and it’s generally harmless on any particular system to force a want instead of an ordering relationship because you’re going to be starting everything anyway.&lt;/p&gt; &lt;/blockquote&gt; &lt;ul&gt; &lt;li&gt;(In my example, you might as well say that cron on the systems in question wants NFS mounts. There is no difference in practice; we already always want to do NFS mounts and start cron.)&lt;/li&gt; &lt;/ul&gt; &lt;hr&gt; &lt;p&gt;###&lt;a href="https://github.com/lattera/articles/blob/master/freebsd/2018-10-27jailedbhyve/article.md"&gt;Jailing The bhyve Hypervisor&lt;/a&gt;&lt;/p&gt; &lt;blockquote&gt; &lt;p&gt;As FreeBSD nears the final 12.0-RELEASE release engineering cycles, I’d like to take a moment to document a cool new feature coming in 12: jailed bhyve.&lt;br&gt; You may notice that I use HardenedBSD instead of FreeBSD in this article. There is no functional difference in bhyve on HardenedBSD versus bhyve on FreeBSD. The only difference between HardenedBSD and FreeBSD is the aditional security offered by HardenedBSD.&lt;br&gt; The steps I outline here work for both FreeBSD and HardenedBSD. These are the bare minimum steps, no extra work needed for either FreeBSD or HardenedBSD.&lt;/p&gt; &lt;/blockquote&gt; &lt;ul&gt; &lt;li&gt;A Gentle History Lesson&lt;/li&gt; &lt;/ul&gt; &lt;blockquote&gt; &lt;p&gt;At work in my spare time, I’m helping develop a malware lab. Due to the nature of the beast, we would like to use bhyve on HardenedBSD. Starting with HardenedBSD 12, non-Cross-DSO CFI, SafeStack, Capsicum, ASLR, and strict W^X are all applied to bhyve, making it an extremely hardened hypervisor.&lt;br&gt; So, the work to support jailed bhyve is sponsored by both HardenedBSD and my employer. We’ve also jointly worked on other bhyve hardening features, like protecting the VM’s address space using guard pages (mmap(…, MAPGUARD, …)). Further work is being done in a project called “malhyve.” Only those modifications to bhyve/malhyve that make sense to upstream will be upstreamed.&lt;/p&gt; &lt;/blockquote&gt; &lt;ul&gt; &lt;li&gt;Initial Setup&lt;/li&gt; &lt;/ul&gt; &lt;blockquote&gt; &lt;p&gt;We will not go through the process of creating the jail’s filesystem. That process is documented in the FreeBSD Handbook. For UEFI guests, you will need to install the uefi-edk2-bhyve package inside the jail.&lt;br&gt; I network these jails with traditional jail networking. I have tested vnet jails with this setup, and that works fine, too. However, there is no real need to hook the jail up to any network so long as bhyve can access the tap device. In some cases, the VM might not need networking, in which case you can use a network-less VM in a network-less jail.&lt;br&gt; By default, access to the kernel side of bhyve is disabled within jails. We need to set allow.vmm in our jail.conf entry for the bhyve jail.&lt;/p&gt; &lt;/blockquote&gt; &lt;ul&gt; &lt;li&gt; &lt;p&gt;We will use the following in our jail, so we will need to set up devfs(8) rules for them:&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;A ZFS volume&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;A null-modem device (nmdm(4))&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;UEFI GOP (no devfs rule, but IP assigned to the jail)&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;A tap device&lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p&gt;Conclusion&lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;blockquote&gt; &lt;p&gt;The bhyve hypervisor works great within a jail. When combined with HardenedBSD, bhyve is extremely hardened:&lt;/p&gt; &lt;/blockquote&gt; &lt;ul&gt; &lt;li&gt;PaX ASLR is fully applied due to compilation as a Position-Independent Executable (HardenedBSD enhancement)&lt;/li&gt; &lt;li&gt;PaX NOEXEC is fully applied (strict W^X) (HardenedBSD enhancement)&lt;/li&gt; &lt;li&gt;Non-Cross-DSO CFI is fully applied (HardenedBSD enhancement)&lt;/li&gt; &lt;li&gt;Full RELRO (RELRO + BINDNOW) is fully applied (HardenedBSD enhancement)&lt;/li&gt; &lt;li&gt;SafeStack is applied to the application (HardenedBSD enhancement)&lt;/li&gt; &lt;li&gt;Jailed (FreeBSD feature written by HardenedBSD)&lt;/li&gt; &lt;li&gt;Virtual memory protected with guard pages (FreeBSD feature written by HardenedBSD)&lt;/li&gt; &lt;li&gt;Capsicum is fully applied (FreeBSD feature)&lt;/li&gt; &lt;/ul&gt; &lt;blockquote&gt; &lt;p&gt;Bad guys are going to have a hard time breaking out of the userland components of bhyve on HardenedBSD. :)&lt;/p&gt; &lt;/blockquote&gt; &lt;hr&gt; &lt;p&gt;##Beastie Bits&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href="https://www.ghostbsd.org/18.10releaseannouncement"&gt;GhostBSD 18.10 has been released&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href="http://project-trident.org/post/2018-11-10rc3-available/"&gt;Project Trident RC3 has been released&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20181022130631"&gt;The OpenBSD Foundation receives the first Silver contribution from a single individual&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href="http://www.echothrust.com/blogs/monitoring-pf-logs-gource"&gt;Monitoring pf logs gource&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href="https://twitter.com/zmcgrew/status/1055682596812730368"&gt;NetBSD on the RISC-V is alive&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href="https://marc.info/?l=openbsd-tech&amp;amp;m=154050351216908&amp;amp;w=2"&gt;The X hole&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href="http://mail-index.netbsd.org/pkgsrc-users/2018/10/05/msg027525.html"&gt;Announcing the pkgsrc-2018Q3 release (2018-10-05)&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href="https://an.undulating.space/post/180927-er_alternate_firmware_benchmarks/"&gt;NAT performance on EdgeRouter X and Lite with EdgeOS, OpenBSD, and OpenWRT&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href="https://www.princeton.edu/~hos/mike/transcripts/thompson.htm"&gt;UNIX (as we know it) might not have existed without Mrs. Thompson&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href="https://www.freepizza.io/"&gt;Free Pizza for your dev events&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href="https://calagator.org/events/1250474530"&gt;Portland BSD Pizza Night: Nov 29th 7pm&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;hr&gt; &lt;p&gt;##Feedback/Questions&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Dennis - &lt;a href="http://dpaste.com/36JB7EC#wrap"&gt;Core developers leaving illumOS?&lt;/a&gt;
&lt;/li&gt; &lt;li&gt;Ben - &lt;a href="http://dpaste.com/1R36Z32#wrap"&gt;Jumping from snapshot to snapshot&lt;/a&gt;
&lt;/li&gt; &lt;li&gt;Ias - &lt;a href="http://dpaste.com/1CC86MX"&gt;Question about ZFS snapshots&lt;/a&gt;
&lt;/li&gt; &lt;/ul&gt; &lt;hr&gt; &lt;ul&gt; &lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt; &lt;/ul&gt; &lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, bhyve, jail, netcat, unveil, NVVM, 18.10, rc3</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Byproducts of reading OpenBSD’s netcat code, learnings from porting your own projects to FreeBSD, OpenBSD’s unveil(), NetBSD’s Virtual Machine Monitor, what &#39;dependency&#39; means in Unix init systems, jailing bhyve, and more.<br>
<p>##Headlines<br> ###<a href="https://nanxiao.me/en/the-byproducts-of-reading-openbsd-netcat-code/">The byproducts of reading OpenBSD netcat code</a></p> <blockquote> <p>When I took part in a training last year, I heard about netcat for the first time. During that class, the tutor showed some hacks and tricks of using netcat which appealed to me and motivated me to learn the guts of it. Fortunately, in the past 2 months, I was not so busy that I can spend my spare time to dive into OpenBSD‘s netcat source code, and got abundant byproducts during this process.<br> (1) Brush up socket programming. I wrote my first network application more than 10 years ago, and always think the socket APIs are marvelous. Just ~10 functions (socket, bind, listen, accept…) with some IO multiplexing buddies (select, poll, epoll…) connect the whole world, wonderful! From that time, I developed a habit that is when touching a new programming language, network programming is an essential exercise. Even though I don’t write socket related code now, reading netcat socket code indeed refresh my knowledge and teach me new stuff.<br> (2) Write a tutorial about netcat. I am mediocre programmer and will forget things when I don’t use it for a long time. So I just take notes of what I think is useful. IMHO, this “tutorial” doesn’t really mean teach others something, but just a journal which I can refer when I need in the future.<br> (3) Submit patches to netcat. During reading code, I also found bugs and some enhancements. Though trivial contributions to OpenBSD, I am still happy and enjoy it.<br> (4) Implement a C++ encapsulation of libtls. OpenBSD‘s netcat supports tls/ssl connection, but it needs you take full care of resource management (memory, socket, etc), otherwise a small mistake can lead to resource leak which is fatal for long-live applications (In fact, the two bugs I reported to OpenBSD are all related resource leak). Therefore I develop a simple C++ library which wraps the libtls and hope it can free developer from this troublesome problem and put more energy in application logic part.<br> Long story to short, reading classical source code is a rewarding process, and you can consider to try it yourself.</p> </blockquote> <hr> <p>###<a href="https://github.com/shlomif/what-i-learned-from-porting-to-freebsd#what-i-learned-from-porting-my-projects-to-freebsd">What I learned from porting my projects to FreeBSD</a></p> <ul> <li>Introduction</li> </ul> <blockquote> <p>I set up a local FreeBSD VirtualBox VM to test something, and it seems to work very well. Due to the novelty factor, I decided to get my software projects to build and pass the tests there.</p> </blockquote> <ul> <li> <p>The Projects</p> </li> <li> <p><a href="https://github.com/shlomif/shlomif-computer-settings/"><a href="https://github.com/shlomif/shlomif-computer-settings/" rel="nofollow">https://github.com/shlomif/shlomif-computer-settings/</a></a> (my dotfiles).</p> </li> <li> <p><a href="https://web-cpan.shlomifish.org/latemp/"><a href="https://web-cpan.shlomifish.org/latemp/" rel="nofollow">https://web-cpan.shlomifish.org/latemp/</a></a></p> </li> <li> <p><a href="https://fc-solve.shlomifish.org/"><a href="https://fc-solve.shlomifish.org/" rel="nofollow">https://fc-solve.shlomifish.org/</a></a></p> </li> <li> <p><a href="https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/"><a href="https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/" rel="nofollow">https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/</a></a></p> </li> <li> <p><a href="https://better-scm.shlomifish.org/source/"><a href="https://better-scm.shlomifish.org/source/" rel="nofollow">https://better-scm.shlomifish.org/source/</a></a></p> </li> <li> <p><a href="http://perl-begin.org/source/"><a href="http://perl-begin.org/source/" rel="nofollow">http://perl-begin.org/source/</a></a></p> </li> <li> <p><a href="https://www.shlomifish.org/meta/site-source/"><a href="https://www.shlomifish.org/meta/site-source/" rel="nofollow">https://www.shlomifish.org/meta/site-source/</a></a></p> </li> <li> <p>Written using a mix of C, Perl 5, Python, Ruby, GNU Bash, XML, CMake, XSLT, XHTML5, XHTML1.1, Website META Language, JavaScript and more.</p> </li> <li> <p>Work fine on several Linux distributions and have <a href="https://en.wikipedia.org/wiki/Travis_CI"><a href="https://en.wikipedia.org/wiki/Travis_CI" rel="nofollow">https://en.wikipedia.org/wiki/Travis_CI</a></a> using Ubuntu 14.04 hosts</p> </li> <li> <p>Some pass builds and tests on AppVeyor/Win64</p> </li> <li> <p>What I Learned:</p> </li> <li> <p>FreeBSD on VBox has become very reliable</p> </li> <li> <p>Some executables on FreeBSD are in /usr/local/bin instead of /usr/bin</p> </li> <li> <p>make on FreeBSD is not GNU make</p> </li> <li> <p>m4 on FreeBSD is not compatible with GNU m4</p> </li> <li> <p>Some CPAN Modules fail to install using local-lib there</p> </li> <li> <p>DocBook/XSL Does Not Live Under /usr/share/sgml</p> </li> <li> <p>FreeBSD’s grep does not have a “-P” flag by default</p> </li> <li> <p>FreeBSD has no “nproc” command</p> </li> <li> <p>Conclusion:</p> </li> <li> <p>It is easier to port a shell than a shell script. — Larry Wall</p> </li> <li> <p>I ran into some cases where my scriptology was lacking and suboptimal, even for my own personal use, and fixed them.</p> </li> </ul> <hr> <p>##News Roundup<br> ###<a href="https://lwn.net/Articles/767137/">OpenBSD’s unveil()</a></p> <blockquote> <p>One of the key aspects of hardening the user-space side of an operating system is to provide mechanisms for restricting which parts of the filesystem hierarchy a given process can access. Linux has a number of mechanisms of varying capability and complexity for this purpose, but other kernels have taken a different approach. Over the last few months, OpenBSD has inaugurated a new system call named unveil() for this type of hardening that differs significantly from the mechanisms found in Linux.<br> The value of restricting access to the filesystem, from a security point of view, is fairly obvious. A compromised process cannot exfiltrate data that it cannot read, and it cannot corrupt files that it cannot write. Preventing unwanted access is, of course, the purpose of the permissions bits attached to every file, but permissions fall short in an important way: just because a particular user has access to a given file does not necessarily imply that every program run by that user should also have access to that file. There is no reason why your PDF viewer should be able to read your SSH keys, for example. Relying on just the permission bits makes it easy for a compromised process to access files that have nothing to do with that process’s actual job.<br> In a Linux system, there are many ways of trying to restrict that access; that is one of the purposes behind the Linux security module (LSM) architecture, for example. The SELinux LSM uses a complex matrix of labels and roles to make access-control decisions. The AppArmor LSM, instead, uses a relatively simple table of permissible pathnames associated with each application; that approach was highly controversial when AppArmor was first merged, and is still looked down upon by some security developers. Mount namespaces can be used to create a special view of the filesystem hierarchy for a set of processes, rendering much of that hierarchy invisible and, thus, inaccessible. The seccomp mechanism can be used to make decisions on attempts by a process to access files, but that approach is complex and error-prone. Yet another approach can be seen in the Qubes OS distribution, which runs applications in virtual machines to strictly control what they can access.<br> Compared to many of the options found in Linux, unveil() is an exercise in simplicity. This system call, introduced in July, has this prototype:</p> </blockquote> <p><code>int unveil(const char *path, const char *permissions);</code></p> <blockquote> <p>A process that has never called unveil() has full access to the filesystem hierarchy, modulo the usual file permissions and any restrictions that may have been applied by calling pledge(). Calling unveil() for the first time will “drop a veil” across the entire filesystem, rendering the whole thing invisible to the process, with one exception: the file or directory hierarchy starting at path will be accessible with the given permissions. The permissions string can contain any of “r” for read access, “w” for write, “x” for execute, and “c” for the ability to create or remove the path.<br> Subsequent calls to unveil() will make other parts of the filesystem hierarchy accessible; the unveil() system call itself still has access to the entire hierarchy, so there is no problem with unveiling distinct subtrees that are, until the call is made, invisible to the process. If one unveil() call applies to a subtree of a hierarchy unveiled by another call, the permissions associated with the more specific call apply.<br> Calling unveil() with both arguments as null will block any further calls, setting the current view of the filesystem in stone. Calls to unveil() can also be blocked using pledge(). Either way, once the view of the filesystem has been set up appropriately, it is possible to lock it so that the process cannot expand its access in the future should it be taken over and turn hostile.<br> unveil() thus looks a bit like AppArmor, in that it is a path-based mechanism for restricting access to files. In either case, one must first study the program in question to gain a solid understanding of which files it needs to access before closing things down, or the program is likely to break. One significant difference (beyond the other sorts of behavior that AppArmor can control) is that AppArmor’s permissions are stored in an external policy file, while unveil() calls are made by the application itself. That approach keeps the access rules tightly tied to the application and easy for the developers to modify, but it also makes it harder for system administrators to change them without having to rebuild the application from source.<br> One can certainly aim a number of criticisms at unveil() — all of the complaints that have been leveled at path-based access control and more. But the simplicity of unveil() brings a certain kind of utility, as can be seen in the large number of OpenBSD applications that are being modified to use it. OpenBSD is gaining a base level of protection against unintended program behavior; while it is arguably possible to protect a Linux system to a much greater extent, the complexity of the mechanisms involved keeps that from happening in a lot of real-world deployments. There is a certain kind of virtue to simplicity in security mechanisms.</p> </blockquote> <hr> <p>###<a href="http://m00nbsd.net/4e0798b7f2620c965d0dd9d6a7a2f296.html">NetBSD Virtual Machine Monitor (NVVM)</a></p> <ul> <li>NetBSD Virtual Machine Monitor</li> </ul> <blockquote> <p>The NVMM driver provides hardware-accelerated virtualization support on NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is provided in libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary.</p> </blockquote> <ul> <li>Download</li> </ul> <blockquote> <p>The source code of NVMM, plus the associated tools, can be downloaded here.</p> </blockquote> <ul> <li>Technical details</li> </ul> <blockquote> <p>NVMM can support up to 128 virtual machines, each having a maximum of 256 VCPUs and 4GB of RAM.<br> Each virtual machine is granted access to most of the CPU registers: the GPRs (obviously), the Segment Registers, the Control Registers, the Debug Registers, the FPU (x87 and SSE), and several MSRs.<br> Events can be injected in the virtual machines, to emulate device interrupts. A delay mechanism is used, and allows VMM software to schedule the interrupt right when the VCPU can receive it. NMIs can be injected as well, and use a similar mechanism.<br> The host must always be x86_64, but the guest has no constraint on the mode, so it can be x86_32, PAE, real mode, and so on.<br> The TSC of each VCPU is always re-based on the host CPU it is executing on, and is therefore guaranteed to increase regardless of the host CPU. However, it may not increase monotonically, because it is not possible to fully hide the host effects on the guest during #VMEXITs.<br> When there are more VCPUs than the host TLB can deal with, NVMM uses a shared ASID, and flushes the shared-ASID VCPUs on each VM switch.<br> The different intercepts are configured in such a way that they cover everything that needs to be emulated. In particular, the LAPIC can be emulated by VMM software, by intercepting reads/writes to the LAPIC page in memory, and monitoring changes to CR8 in the exit state.</p> </blockquote> <hr> <p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/sysadmin/InitDependencyUnclear">What ‘dependency’ means in Unix init systems is underspecified (utoronto.ca)</a></p> <blockquote> <p>I was reading Davin McCall’s On the vagaries of init systems (via) when I ran across the following, about the relationship between various daemons (services, etc):<br> I do not see any compelling reason for having ordering relationships without actual dependency, as both Nosh and Systemd provide for. In comparison, Dinit’s dependencies also imply an ordering, which obviates the need to list a dependency twice in the service description.<br> Well, this may be an easy one but it depends on what an init system means by ‘dependency’. Let’s consider ®syslog and the SSH daemon. I want the syslog daemon to be started before the SSH daemon is started, so that the SSH daemon can log things to it from the beginning. However, I very much do not want the SSH daemon to not be started (or to be shut down) if the syslog daemon fails to start or later fails. If syslog fails, I still want the SSH daemon to be there so that I can perhaps SSH in to the machine and fix the problem.<br> This is generally true of almost all daemons; I want them to start after syslog, so that they can syslog things, but I almost never want them to not be running if syslog failed. (And if for some reason syslog is not configured to start, I want enabling and starting, say, SSH, to also enable and start the syslog daemon.)<br> In general, there are three different relationships between services that I tend to encounter:</p> </blockquote> <ul> <li> <p>a hard requirement, where service B is useless or dangerous without service A. For instance, many NFS v2 and NFS v3 daemons basically don’t function without the RPC portmapper alive and active. On any number of systems, firewall rules being in place are a hard requirement to start most network services; you would rather your network services not start at all than that they start without your defenses in place.</p> </li> <li> <p>a want, where service B wants service A to be running before B starts up, and service A should be started even if it wouldn’t otherwise be, but the failure of A still leaves B functional. Many daemons want the syslog daemon to be started before they start but will run without it, and often you want them to do so so that at least some of the system works even if there is, say, a corrupt syslog configuration file that causes the daemon to error out on start. (But some environments want to hard-fail if they can’t collect security related logging information, so they might make rsyslogd a requirement instead of a want.)</p> </li> <li> <p>an ordering, where if service A is going to be started, B wants to start after it (or before it), but B isn’t otherwise calling for A to be started. We have some of these in our systems, where we need NFS mounts done before cron starts and runs people’s @reboot jobs but neither cron nor NFS mounts exactly or explicitly want each other. (The system as a whole wants both, but that’s a different thing.)</p> </li> </ul> <blockquote> <p>Given these different relationships and the implications for what the init system should do in different situations, talking about ‘dependency’ in it systems is kind of underspecified. What sort of dependency? What happens if one service doesn’t start or fails later?<br> My impression is that generally people pick a want relationship as the default meaning for init system ‘dependency’. Usually this is fine; most services aren’t actively dangerous if one of their declared dependencies fails to start, and it’s generally harmless on any particular system to force a want instead of an ordering relationship because you’re going to be starting everything anyway.</p> </blockquote> <ul> <li>(In my example, you might as well say that cron on the systems in question wants NFS mounts. There is no difference in practice; we already always want to do NFS mounts and start cron.)</li> </ul> <hr> <p>###<a href="https://github.com/lattera/articles/blob/master/freebsd/2018-10-27_jailed_bhyve/article.md">Jailing The bhyve Hypervisor</a></p> <blockquote> <p>As FreeBSD nears the final 12.0-RELEASE release engineering cycles, I’d like to take a moment to document a cool new feature coming in 12: jailed bhyve.<br> You may notice that I use HardenedBSD instead of FreeBSD in this article. There is no functional difference in bhyve on HardenedBSD versus bhyve on FreeBSD. The only difference between HardenedBSD and FreeBSD is the aditional security offered by HardenedBSD.<br> The steps I outline here work for both FreeBSD and HardenedBSD. These are the bare minimum steps, no extra work needed for either FreeBSD or HardenedBSD.</p> </blockquote> <ul> <li>A Gentle History Lesson</li> </ul> <blockquote> <p>At work in my spare time, I’m helping develop a malware lab. Due to the nature of the beast, we would like to use bhyve on HardenedBSD. Starting with HardenedBSD 12, non-Cross-DSO CFI, SafeStack, Capsicum, ASLR, and strict W<sup>X</sup> are all applied to bhyve, making it an extremely hardened hypervisor.<br> So, the work to support jailed bhyve is sponsored by both HardenedBSD and my employer. We’ve also jointly worked on other bhyve hardening features, like protecting the VM’s address space using guard pages (mmap(…, MAP_GUARD, …)). Further work is being done in a project called “malhyve.” Only those modifications to bhyve/malhyve that make sense to upstream will be upstreamed.</p> </blockquote> <ul> <li>Initial Setup</li> </ul> <blockquote> <p>We will not go through the process of creating the jail’s filesystem. That process is documented in the FreeBSD Handbook. For UEFI guests, you will need to install the uefi-edk2-bhyve package inside the jail.<br> I network these jails with traditional jail networking. I have tested vnet jails with this setup, and that works fine, too. However, there is no real need to hook the jail up to any network so long as bhyve can access the tap device. In some cases, the VM might not need networking, in which case you can use a network-less VM in a network-less jail.<br> By default, access to the kernel side of bhyve is disabled within jails. We need to set allow.vmm in our jail.conf entry for the bhyve jail.</p> </blockquote> <ul> <li> <p>We will use the following in our jail, so we will need to set up devfs(8) rules for them:</p> </li> <li> <p>A ZFS volume</p> </li> <li> <p>A null-modem device (nmdm(4))</p> </li> <li> <p>UEFI GOP (no devfs rule, but IP assigned to the jail)</p> </li> <li> <p>A tap device</p> </li> <li> <p>Conclusion</p> </li> </ul> <blockquote> <p>The bhyve hypervisor works great within a jail. When combined with HardenedBSD, bhyve is extremely hardened:</p> </blockquote> <ul> <li>PaX ASLR is fully applied due to compilation as a Position-Independent Executable (HardenedBSD enhancement)</li> <li>PaX NOEXEC is fully applied (strict W<sup>X)</sup> (HardenedBSD enhancement)</li> <li>Non-Cross-DSO CFI is fully applied (HardenedBSD enhancement)</li> <li>Full RELRO (RELRO + BIND_NOW) is fully applied (HardenedBSD enhancement)</li> <li>SafeStack is applied to the application (HardenedBSD enhancement)</li> <li>Jailed (FreeBSD feature written by HardenedBSD)</li> <li>Virtual memory protected with guard pages (FreeBSD feature written by HardenedBSD)</li> <li>Capsicum is fully applied (FreeBSD feature)</li> </ul> <blockquote> <p>Bad guys are going to have a hard time breaking out of the userland components of bhyve on HardenedBSD. :)</p> </blockquote> <hr> <p>##Beastie Bits</p> <ul> <li><a href="https://www.ghostbsd.org/18.10_release_announcement">GhostBSD 18.10 has been released</a></li> <li><a href="http://project-trident.org/post/2018-11-10_rc3-available/">Project Trident RC3 has been released</a></li> <li><a href="https://undeadly.org/cgi?action=article;sid=20181022130631">The OpenBSD Foundation receives the first Silver contribution from a single individual</a></li> <li><a href="http://www.echothrust.com/blogs/monitoring-pf-logs-gource">Monitoring pf logs gource</a></li> <li><a href="https://twitter.com/zmcgrew/status/1055682596812730368">NetBSD on the RISC-V is alive</a></li> <li><a href="https://marc.info/?l=openbsd-tech&amp;m=154050351216908&amp;w=2">The X hole</a></li> <li><a href="http://mail-index.netbsd.org/pkgsrc-users/2018/10/05/msg027525.html">Announcing the pkgsrc-2018Q3 release (2018-10-05)</a></li> <li><a href="https://an.undulating.space/post/180927-er_alternate_firmware_benchmarks/">NAT performance on EdgeRouter X and Lite with EdgeOS, OpenBSD, and OpenWRT</a></li> <li><a href="https://www.princeton.edu/~hos/mike/transcripts/thompson.htm">UNIX (as we know it) might not have existed without Mrs. Thompson</a></li> <li><a href="https://www.freepizza.io/">Free Pizza for your dev events</a></li> <li><a href="https://calagator.org/events/1250474530">Portland BSD Pizza Night: Nov 29th 7pm</a></li> </ul> <hr> <p>##Feedback/Questions</p> <ul> <li>Dennis - <a href="http://dpaste.com/36JB7EC#wrap">Core developers leaving illumOS?</a></li> <li>Ben - <a href="http://dpaste.com/1R36Z32#wrap">Jumping from snapshot to snapshot</a></li> <li>Ias - <a href="http://dpaste.com/1CC86MX">Question about ZFS snapshots</a></li> </ul> <hr> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv"><a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></a></li> </ul> <hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Byproducts of reading OpenBSD’s netcat code, learnings from porting your own projects to FreeBSD, OpenBSD’s unveil(), NetBSD’s Virtual Machine Monitor, what &#39;dependency&#39; means in Unix init systems, jailing bhyve, and more.<br>
<p>##Headlines<br> ###<a href="https://nanxiao.me/en/the-byproducts-of-reading-openbsd-netcat-code/">The byproducts of reading OpenBSD netcat code</a></p> <blockquote> <p>When I took part in a training last year, I heard about netcat for the first time. During that class, the tutor showed some hacks and tricks of using netcat which appealed to me and motivated me to learn the guts of it. Fortunately, in the past 2 months, I was not so busy that I can spend my spare time to dive into OpenBSD‘s netcat source code, and got abundant byproducts during this process.<br> (1) Brush up socket programming. I wrote my first network application more than 10 years ago, and always think the socket APIs are marvelous. Just ~10 functions (socket, bind, listen, accept…) with some IO multiplexing buddies (select, poll, epoll…) connect the whole world, wonderful! From that time, I developed a habit that is when touching a new programming language, network programming is an essential exercise. Even though I don’t write socket related code now, reading netcat socket code indeed refresh my knowledge and teach me new stuff.<br> (2) Write a tutorial about netcat. I am mediocre programmer and will forget things when I don’t use it for a long time. So I just take notes of what I think is useful. IMHO, this “tutorial” doesn’t really mean teach others something, but just a journal which I can refer when I need in the future.<br> (3) Submit patches to netcat. During reading code, I also found bugs and some enhancements. Though trivial contributions to OpenBSD, I am still happy and enjoy it.<br> (4) Implement a C++ encapsulation of libtls. OpenBSD‘s netcat supports tls/ssl connection, but it needs you take full care of resource management (memory, socket, etc), otherwise a small mistake can lead to resource leak which is fatal for long-live applications (In fact, the two bugs I reported to OpenBSD are all related resource leak). Therefore I develop a simple C++ library which wraps the libtls and hope it can free developer from this troublesome problem and put more energy in application logic part.<br> Long story to short, reading classical source code is a rewarding process, and you can consider to try it yourself.</p> </blockquote> <hr> <p>###<a href="https://github.com/shlomif/what-i-learned-from-porting-to-freebsd#what-i-learned-from-porting-my-projects-to-freebsd">What I learned from porting my projects to FreeBSD</a></p> <ul> <li>Introduction</li> </ul> <blockquote> <p>I set up a local FreeBSD VirtualBox VM to test something, and it seems to work very well. Due to the novelty factor, I decided to get my software projects to build and pass the tests there.</p> </blockquote> <ul> <li> <p>The Projects</p> </li> <li> <p><a href="https://github.com/shlomif/shlomif-computer-settings/"><a href="https://github.com/shlomif/shlomif-computer-settings/" rel="nofollow">https://github.com/shlomif/shlomif-computer-settings/</a></a> (my dotfiles).</p> </li> <li> <p><a href="https://web-cpan.shlomifish.org/latemp/"><a href="https://web-cpan.shlomifish.org/latemp/" rel="nofollow">https://web-cpan.shlomifish.org/latemp/</a></a></p> </li> <li> <p><a href="https://fc-solve.shlomifish.org/"><a href="https://fc-solve.shlomifish.org/" rel="nofollow">https://fc-solve.shlomifish.org/</a></a></p> </li> <li> <p><a href="https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/"><a href="https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/" rel="nofollow">https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/</a></a></p> </li> <li> <p><a href="https://better-scm.shlomifish.org/source/"><a href="https://better-scm.shlomifish.org/source/" rel="nofollow">https://better-scm.shlomifish.org/source/</a></a></p> </li> <li> <p><a href="http://perl-begin.org/source/"><a href="http://perl-begin.org/source/" rel="nofollow">http://perl-begin.org/source/</a></a></p> </li> <li> <p><a href="https://www.shlomifish.org/meta/site-source/"><a href="https://www.shlomifish.org/meta/site-source/" rel="nofollow">https://www.shlomifish.org/meta/site-source/</a></a></p> </li> <li> <p>Written using a mix of C, Perl 5, Python, Ruby, GNU Bash, XML, CMake, XSLT, XHTML5, XHTML1.1, Website META Language, JavaScript and more.</p> </li> <li> <p>Work fine on several Linux distributions and have <a href="https://en.wikipedia.org/wiki/Travis_CI"><a href="https://en.wikipedia.org/wiki/Travis_CI" rel="nofollow">https://en.wikipedia.org/wiki/Travis_CI</a></a> using Ubuntu 14.04 hosts</p> </li> <li> <p>Some pass builds and tests on AppVeyor/Win64</p> </li> <li> <p>What I Learned:</p> </li> <li> <p>FreeBSD on VBox has become very reliable</p> </li> <li> <p>Some executables on FreeBSD are in /usr/local/bin instead of /usr/bin</p> </li> <li> <p>make on FreeBSD is not GNU make</p> </li> <li> <p>m4 on FreeBSD is not compatible with GNU m4</p> </li> <li> <p>Some CPAN Modules fail to install using local-lib there</p> </li> <li> <p>DocBook/XSL Does Not Live Under /usr/share/sgml</p> </li> <li> <p>FreeBSD’s grep does not have a “-P” flag by default</p> </li> <li> <p>FreeBSD has no “nproc” command</p> </li> <li> <p>Conclusion:</p> </li> <li> <p>It is easier to port a shell than a shell script. — Larry Wall</p> </li> <li> <p>I ran into some cases where my scriptology was lacking and suboptimal, even for my own personal use, and fixed them.</p> </li> </ul> <hr> <p>##News Roundup<br> ###<a href="https://lwn.net/Articles/767137/">OpenBSD’s unveil()</a></p> <blockquote> <p>One of the key aspects of hardening the user-space side of an operating system is to provide mechanisms for restricting which parts of the filesystem hierarchy a given process can access. Linux has a number of mechanisms of varying capability and complexity for this purpose, but other kernels have taken a different approach. Over the last few months, OpenBSD has inaugurated a new system call named unveil() for this type of hardening that differs significantly from the mechanisms found in Linux.<br> The value of restricting access to the filesystem, from a security point of view, is fairly obvious. A compromised process cannot exfiltrate data that it cannot read, and it cannot corrupt files that it cannot write. Preventing unwanted access is, of course, the purpose of the permissions bits attached to every file, but permissions fall short in an important way: just because a particular user has access to a given file does not necessarily imply that every program run by that user should also have access to that file. There is no reason why your PDF viewer should be able to read your SSH keys, for example. Relying on just the permission bits makes it easy for a compromised process to access files that have nothing to do with that process’s actual job.<br> In a Linux system, there are many ways of trying to restrict that access; that is one of the purposes behind the Linux security module (LSM) architecture, for example. The SELinux LSM uses a complex matrix of labels and roles to make access-control decisions. The AppArmor LSM, instead, uses a relatively simple table of permissible pathnames associated with each application; that approach was highly controversial when AppArmor was first merged, and is still looked down upon by some security developers. Mount namespaces can be used to create a special view of the filesystem hierarchy for a set of processes, rendering much of that hierarchy invisible and, thus, inaccessible. The seccomp mechanism can be used to make decisions on attempts by a process to access files, but that approach is complex and error-prone. Yet another approach can be seen in the Qubes OS distribution, which runs applications in virtual machines to strictly control what they can access.<br> Compared to many of the options found in Linux, unveil() is an exercise in simplicity. This system call, introduced in July, has this prototype:</p> </blockquote> <p><code>int unveil(const char *path, const char *permissions);</code></p> <blockquote> <p>A process that has never called unveil() has full access to the filesystem hierarchy, modulo the usual file permissions and any restrictions that may have been applied by calling pledge(). Calling unveil() for the first time will “drop a veil” across the entire filesystem, rendering the whole thing invisible to the process, with one exception: the file or directory hierarchy starting at path will be accessible with the given permissions. The permissions string can contain any of “r” for read access, “w” for write, “x” for execute, and “c” for the ability to create or remove the path.<br> Subsequent calls to unveil() will make other parts of the filesystem hierarchy accessible; the unveil() system call itself still has access to the entire hierarchy, so there is no problem with unveiling distinct subtrees that are, until the call is made, invisible to the process. If one unveil() call applies to a subtree of a hierarchy unveiled by another call, the permissions associated with the more specific call apply.<br> Calling unveil() with both arguments as null will block any further calls, setting the current view of the filesystem in stone. Calls to unveil() can also be blocked using pledge(). Either way, once the view of the filesystem has been set up appropriately, it is possible to lock it so that the process cannot expand its access in the future should it be taken over and turn hostile.<br> unveil() thus looks a bit like AppArmor, in that it is a path-based mechanism for restricting access to files. In either case, one must first study the program in question to gain a solid understanding of which files it needs to access before closing things down, or the program is likely to break. One significant difference (beyond the other sorts of behavior that AppArmor can control) is that AppArmor’s permissions are stored in an external policy file, while unveil() calls are made by the application itself. That approach keeps the access rules tightly tied to the application and easy for the developers to modify, but it also makes it harder for system administrators to change them without having to rebuild the application from source.<br> One can certainly aim a number of criticisms at unveil() — all of the complaints that have been leveled at path-based access control and more. But the simplicity of unveil() brings a certain kind of utility, as can be seen in the large number of OpenBSD applications that are being modified to use it. OpenBSD is gaining a base level of protection against unintended program behavior; while it is arguably possible to protect a Linux system to a much greater extent, the complexity of the mechanisms involved keeps that from happening in a lot of real-world deployments. There is a certain kind of virtue to simplicity in security mechanisms.</p> </blockquote> <hr> <p>###<a href="http://m00nbsd.net/4e0798b7f2620c965d0dd9d6a7a2f296.html">NetBSD Virtual Machine Monitor (NVVM)</a></p> <ul> <li>NetBSD Virtual Machine Monitor</li> </ul> <blockquote> <p>The NVMM driver provides hardware-accelerated virtualization support on NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is provided in libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary.</p> </blockquote> <ul> <li>Download</li> </ul> <blockquote> <p>The source code of NVMM, plus the associated tools, can be downloaded here.</p> </blockquote> <ul> <li>Technical details</li> </ul> <blockquote> <p>NVMM can support up to 128 virtual machines, each having a maximum of 256 VCPUs and 4GB of RAM.<br> Each virtual machine is granted access to most of the CPU registers: the GPRs (obviously), the Segment Registers, the Control Registers, the Debug Registers, the FPU (x87 and SSE), and several MSRs.<br> Events can be injected in the virtual machines, to emulate device interrupts. A delay mechanism is used, and allows VMM software to schedule the interrupt right when the VCPU can receive it. NMIs can be injected as well, and use a similar mechanism.<br> The host must always be x86_64, but the guest has no constraint on the mode, so it can be x86_32, PAE, real mode, and so on.<br> The TSC of each VCPU is always re-based on the host CPU it is executing on, and is therefore guaranteed to increase regardless of the host CPU. However, it may not increase monotonically, because it is not possible to fully hide the host effects on the guest during #VMEXITs.<br> When there are more VCPUs than the host TLB can deal with, NVMM uses a shared ASID, and flushes the shared-ASID VCPUs on each VM switch.<br> The different intercepts are configured in such a way that they cover everything that needs to be emulated. In particular, the LAPIC can be emulated by VMM software, by intercepting reads/writes to the LAPIC page in memory, and monitoring changes to CR8 in the exit state.</p> </blockquote> <hr> <p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/sysadmin/InitDependencyUnclear">What ‘dependency’ means in Unix init systems is underspecified (utoronto.ca)</a></p> <blockquote> <p>I was reading Davin McCall’s On the vagaries of init systems (via) when I ran across the following, about the relationship between various daemons (services, etc):<br> I do not see any compelling reason for having ordering relationships without actual dependency, as both Nosh and Systemd provide for. In comparison, Dinit’s dependencies also imply an ordering, which obviates the need to list a dependency twice in the service description.<br> Well, this may be an easy one but it depends on what an init system means by ‘dependency’. Let’s consider ®syslog and the SSH daemon. I want the syslog daemon to be started before the SSH daemon is started, so that the SSH daemon can log things to it from the beginning. However, I very much do not want the SSH daemon to not be started (or to be shut down) if the syslog daemon fails to start or later fails. If syslog fails, I still want the SSH daemon to be there so that I can perhaps SSH in to the machine and fix the problem.<br> This is generally true of almost all daemons; I want them to start after syslog, so that they can syslog things, but I almost never want them to not be running if syslog failed. (And if for some reason syslog is not configured to start, I want enabling and starting, say, SSH, to also enable and start the syslog daemon.)<br> In general, there are three different relationships between services that I tend to encounter:</p> </blockquote> <ul> <li> <p>a hard requirement, where service B is useless or dangerous without service A. For instance, many NFS v2 and NFS v3 daemons basically don’t function without the RPC portmapper alive and active. On any number of systems, firewall rules being in place are a hard requirement to start most network services; you would rather your network services not start at all than that they start without your defenses in place.</p> </li> <li> <p>a want, where service B wants service A to be running before B starts up, and service A should be started even if it wouldn’t otherwise be, but the failure of A still leaves B functional. Many daemons want the syslog daemon to be started before they start but will run without it, and often you want them to do so so that at least some of the system works even if there is, say, a corrupt syslog configuration file that causes the daemon to error out on start. (But some environments want to hard-fail if they can’t collect security related logging information, so they might make rsyslogd a requirement instead of a want.)</p> </li> <li> <p>an ordering, where if service A is going to be started, B wants to start after it (or before it), but B isn’t otherwise calling for A to be started. We have some of these in our systems, where we need NFS mounts done before cron starts and runs people’s @reboot jobs but neither cron nor NFS mounts exactly or explicitly want each other. (The system as a whole wants both, but that’s a different thing.)</p> </li> </ul> <blockquote> <p>Given these different relationships and the implications for what the init system should do in different situations, talking about ‘dependency’ in it systems is kind of underspecified. What sort of dependency? What happens if one service doesn’t start or fails later?<br> My impression is that generally people pick a want relationship as the default meaning for init system ‘dependency’. Usually this is fine; most services aren’t actively dangerous if one of their declared dependencies fails to start, and it’s generally harmless on any particular system to force a want instead of an ordering relationship because you’re going to be starting everything anyway.</p> </blockquote> <ul> <li>(In my example, you might as well say that cron on the systems in question wants NFS mounts. There is no difference in practice; we already always want to do NFS mounts and start cron.)</li> </ul> <hr> <p>###<a href="https://github.com/lattera/articles/blob/master/freebsd/2018-10-27_jailed_bhyve/article.md">Jailing The bhyve Hypervisor</a></p> <blockquote> <p>As FreeBSD nears the final 12.0-RELEASE release engineering cycles, I’d like to take a moment to document a cool new feature coming in 12: jailed bhyve.<br> You may notice that I use HardenedBSD instead of FreeBSD in this article. There is no functional difference in bhyve on HardenedBSD versus bhyve on FreeBSD. The only difference between HardenedBSD and FreeBSD is the aditional security offered by HardenedBSD.<br> The steps I outline here work for both FreeBSD and HardenedBSD. These are the bare minimum steps, no extra work needed for either FreeBSD or HardenedBSD.</p> </blockquote> <ul> <li>A Gentle History Lesson</li> </ul> <blockquote> <p>At work in my spare time, I’m helping develop a malware lab. Due to the nature of the beast, we would like to use bhyve on HardenedBSD. Starting with HardenedBSD 12, non-Cross-DSO CFI, SafeStack, Capsicum, ASLR, and strict W<sup>X</sup> are all applied to bhyve, making it an extremely hardened hypervisor.<br> So, the work to support jailed bhyve is sponsored by both HardenedBSD and my employer. We’ve also jointly worked on other bhyve hardening features, like protecting the VM’s address space using guard pages (mmap(…, MAP_GUARD, …)). Further work is being done in a project called “malhyve.” Only those modifications to bhyve/malhyve that make sense to upstream will be upstreamed.</p> </blockquote> <ul> <li>Initial Setup</li> </ul> <blockquote> <p>We will not go through the process of creating the jail’s filesystem. That process is documented in the FreeBSD Handbook. For UEFI guests, you will need to install the uefi-edk2-bhyve package inside the jail.<br> I network these jails with traditional jail networking. I have tested vnet jails with this setup, and that works fine, too. However, there is no real need to hook the jail up to any network so long as bhyve can access the tap device. In some cases, the VM might not need networking, in which case you can use a network-less VM in a network-less jail.<br> By default, access to the kernel side of bhyve is disabled within jails. We need to set allow.vmm in our jail.conf entry for the bhyve jail.</p> </blockquote> <ul> <li> <p>We will use the following in our jail, so we will need to set up devfs(8) rules for them:</p> </li> <li> <p>A ZFS volume</p> </li> <li> <p>A null-modem device (nmdm(4))</p> </li> <li> <p>UEFI GOP (no devfs rule, but IP assigned to the jail)</p> </li> <li> <p>A tap device</p> </li> <li> <p>Conclusion</p> </li> </ul> <blockquote> <p>The bhyve hypervisor works great within a jail. When combined with HardenedBSD, bhyve is extremely hardened:</p> </blockquote> <ul> <li>PaX ASLR is fully applied due to compilation as a Position-Independent Executable (HardenedBSD enhancement)</li> <li>PaX NOEXEC is fully applied (strict W<sup>X)</sup> (HardenedBSD enhancement)</li> <li>Non-Cross-DSO CFI is fully applied (HardenedBSD enhancement)</li> <li>Full RELRO (RELRO + BIND_NOW) is fully applied (HardenedBSD enhancement)</li> <li>SafeStack is applied to the application (HardenedBSD enhancement)</li> <li>Jailed (FreeBSD feature written by HardenedBSD)</li> <li>Virtual memory protected with guard pages (FreeBSD feature written by HardenedBSD)</li> <li>Capsicum is fully applied (FreeBSD feature)</li> </ul> <blockquote> <p>Bad guys are going to have a hard time breaking out of the userland components of bhyve on HardenedBSD. :)</p> </blockquote> <hr> <p>##Beastie Bits</p> <ul> <li><a href="https://www.ghostbsd.org/18.10_release_announcement">GhostBSD 18.10 has been released</a></li> <li><a href="http://project-trident.org/post/2018-11-10_rc3-available/">Project Trident RC3 has been released</a></li> <li><a href="https://undeadly.org/cgi?action=article;sid=20181022130631">The OpenBSD Foundation receives the first Silver contribution from a single individual</a></li> <li><a href="http://www.echothrust.com/blogs/monitoring-pf-logs-gource">Monitoring pf logs gource</a></li> <li><a href="https://twitter.com/zmcgrew/status/1055682596812730368">NetBSD on the RISC-V is alive</a></li> <li><a href="https://marc.info/?l=openbsd-tech&amp;m=154050351216908&amp;w=2">The X hole</a></li> <li><a href="http://mail-index.netbsd.org/pkgsrc-users/2018/10/05/msg027525.html">Announcing the pkgsrc-2018Q3 release (2018-10-05)</a></li> <li><a href="https://an.undulating.space/post/180927-er_alternate_firmware_benchmarks/">NAT performance on EdgeRouter X and Lite with EdgeOS, OpenBSD, and OpenWRT</a></li> <li><a href="https://www.princeton.edu/~hos/mike/transcripts/thompson.htm">UNIX (as we know it) might not have existed without Mrs. Thompson</a></li> <li><a href="https://www.freepizza.io/">Free Pizza for your dev events</a></li> <li><a href="https://calagator.org/events/1250474530">Portland BSD Pizza Night: Nov 29th 7pm</a></li> </ul> <hr> <p>##Feedback/Questions</p> <ul> <li>Dennis - <a href="http://dpaste.com/36JB7EC#wrap">Core developers leaving illumOS?</a></li> <li>Ben - <a href="http://dpaste.com/1R36Z32#wrap">Jumping from snapshot to snapshot</a></li> <li>Ias - <a href="http://dpaste.com/1CC86MX">Question about ZFS snapshots</a></li> </ul> <hr> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv"><a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></a></li> </ul> <hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 271: Automatic Drive Tests | BSD Now 271</title>
  <link>https://www.bsdnow.tv/271</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2867</guid>
  <pubDate>Thu, 08 Nov 2018 04:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/79038ba2-cb6e-4b71-8bcb-83141df434c3.mp3" length="40996081" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>MidnightBSD 1.0 released, MeetBSD review, EuroBSDcon trip reports, DNS over TLS in FreeBSD 12, Upgrading OpenBSD with Ansible, how to use smartd to run tests on your drives automatically, and more.</itunes:subtitle>
  <itunes:duration>1:08:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>MidnightBSD 1.0 released, MeetBSD review, EuroBSDcon trip reports, DNS over TLS in FreeBSD 12, Upgrading OpenBSD with Ansible, how to use smartd to run tests on your drives automatically, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.midnightbsd.org/news/"&gt;MidnightBSD 1.0 now available&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I’m happy to announce the availability of MidnightBSD 1.0 for amd64 and i386. Over the years, many ambitious goals were set for our 1.0 release. As it approached, it was clear we wouldn’t be able to accomplish all of them. This release is more of a natural progression rather than a groundbreaking event. It includes many updates to the base system, improvements to the package manager, an updated compiler, and tools.&lt;br&gt;
Of particular note, you can now boot off of ZFS and use NVME SSDs and some AMD Radeon graphics cards support acceleration. AMD Ryzen support has greatly improved in this release. We also have added bhyve from FreeBSD.&lt;br&gt;
The 1.0 release is finally available. Still building packages for i386 and plan to do an amd64 package build later in the week. The single largest issue with the release process has been the web server performance. The CPU is overloaded and has been at solid 100% for several days. The server has a core i7 7700 in it. I’m trying to figure out what to buy as an upgrade so that we don’t continue to have this issue going forward. As it’s actually blocked in multiple processes, a 6 or 8 core chip might be an improvement for the workload…&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Download links: &lt;a href="https://www.midnightbsd.org/download/"&gt;https://www.midnightbsd.org/download/&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/watch?time_continue=33&amp;amp;v=-rlk2wFsjJ4"&gt;https://www.youtube.com/watch?time_continue=33&amp;amp;v=-rlk2wFsjJ4&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://linuxunplugged.com/articles/meetbsd2018"&gt;MeetBSD Review&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;MeetBSD 2018 took place at the sprawling Intel Santa Clara campus. The venue itself felt more like an olive branch than a simple friendly gesture by Intel. In truth it felt like a bit of an apology. You get the subtle sense they feel bad about how the BSD’s were treated with the Meltdown and Specter flaws. In fact, you may be right to think they felt a bit sorry towards the entire open source community.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;MeetBSD 2018&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;At most massive venues the parking is the first concern, not so here - in fact that was rather straightforward. No, the real challenge is navigating the buildings. Luckily I had help from navigator extraordinaire, Hadea, who located the correct building, SC12 quickly. Finding the entrance took a moment or two though. The lobby itself was converted by iXsystems efficiently into the MeetBSD expo hall, clean, efficient and roomy with registration, some seating, and an extra conference room for on-on-one sessions. On day two sponsor booths were also setup. All who showed up on day one were warmly greeted with badges, lanyards and goodies by Denise and her friendly team.&lt;br&gt;
Like every great BSD event, plenty of food was made available. And as always they make it look effortless. These events showcase iXsystem’s inherent generosity toward its community; with breakfast items in the back of the main auditorium room in the morning, boxed lunches, fruit and cookies at lunch time, and snacks for the rest of the day. But just in case your still hungry, there is a pizza meetup in another Intel room after day one and two.&lt;br&gt;
MeetBSD leverages it’s realistically small crowd size on day one. The morning starts off with introductions of the entire group, the mic is passed around the room.&lt;br&gt;
The group is a good mix of pros in the industry (such as Juniper, Intel, Ebay, Groupon, Cisco, etc), iX staff, and a few enthusiast. Lots of people with a focus or passion for networking. And, of course, some friendly Linux bashing went down for good measure, always followed by a good natured chuckle.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;MeetBSD Gives me The Feels&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I find that I am subtly unnerved at this venue, and at lunch I saw it clearly. I have always had a strong geek radar, allowing me to navigate a new area (like Berkeley for MeetBSD of 2016, or even SCALE earlier this year in Pasadena), and in a glance I can see who is from my conference and who isn’t. This means it is easy, nearly effortless to know who to greet with a smile and a wave. These are MY people. Here at the Intel campus though it is different. The drive in alone reveals behemoth complexes all with well known tech names prominently displayed. This is Silicon Valley, and all of these people look like MY people. So much for knowing who’s from my conference. Thank goodness for those infamous BSD horns. None-the-less I am struck by how massive these tech giants are. And Intel is one of the largest of those giants, and see the physical reminders of this fact brought home the significance that they had opened their doors, wifi, and bathrooms to the BSD community.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###[EuroBSDcon 2018 Trip Reports]&lt;br&gt;
&lt;a href="https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-joseph-mingrone/"&gt;https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-joseph-mingrone/&lt;/a&gt;&lt;br&gt;
&lt;a href="https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-vinicius-zavam/"&gt;https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-vinicius-zavam/&lt;/a&gt;&lt;br&gt;
&lt;a href="https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-emmanuel-vadot/"&gt;https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-emmanuel-vadot/&lt;/a&gt;&lt;/p&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://blog.des.no/2018/10/dns-over-tls-in-freebsd-12/"&gt;DNS over TLS in FreeBSD 12&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;With the arrival of OpenSSL 1.1.1, an upgraded Unbound, and some changes to the setup and init scripts, FreeBSD 12.0, currently in beta, now supports DNS over TLS out of the box.&lt;br&gt;
DNS over TLS is just what it sounds like: DNS over TCP, but wrapped in a TLS session. It encrypts your requests and the server’s replies, and optionally allows you to verify the identity of the server. The advantages are protection against eavesdropping and manipulation of your DNS traffic; the drawbacks are a slight performance degradation and potential firewall traversal issues, as it runs over a non-standard port (TCP port 853) which may be blocked on some networks. Let’s take a look at how to set it up.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Conclusion&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;We’ve seen how to set up Unbound—specifically, the local_unbound service in FreeBSD 12.0—to use DNS over TLS instead of plain UDP or TCP, using Cloudflare’s public DNS service as an example. We’ve looked at the performance impact, and at how to ensure (and verify) that Unbound validates the server certificate to prevent man-in-the-middle attacks.&lt;br&gt;
The question that remains is whether it is all worth it. There is undeniably a performance hit, though this may improve with TLS 1.3. More importantly, there are currently very few DNS-over-TLS providers—only one, really, since Quad9 filter their responses—and you have to weigh the advantage of encrypting your DNS traffic against the disadvantage of sending it all to a single organization. I can’t answer that question for you, but I can tell you that the parameters are evolving quickly, and if your answer is negative today, it may not remain so for long. More providers will appear. Performance will improve with TLS 1.3 and QUIC. Within a year or two, running DNS over TLS may very well become the rule rather than the experimental exception.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://chown.me/blog/upgrading-openbsd-with-ansible.html"&gt;Upgrading OpenBSD with Ansible&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;My router runs OpenBSD -current&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A few months ago, I needed software that had just hit the ports tree. I didn’t want to wait for the next release, so I upgraded my router to use -current. Since then, I’ve continued running -current, which means upgrading to a newer snapshot every so often. Running -current is great, but the process of updating to a newer snapshot was cumbersome. Initially, I had to plug in a serial cable and then reboot into bsd.rd, hit enter ten times, then reboot, run sysmerge and update packages.&lt;br&gt;
I eventually switched to upobsd to be able to upgrade without the need for a serial connection. The process was better, but still tiresome. Usually, I would prepare the special version of bsd.rd, boot on bsd.rd, and do something like wash the dishes in the meantime. After about ten minutes, I would dry my hands and then go back to my workstation to see whether the bsd.rd part had finished so I could run sysmerge and pkgadd, and then return to the dishes while it upgraded packages.&lt;br&gt;
Out of laziness, I thought: “I should automate this,” but what happened instead is that I simply didn’t upgrade that machine very often. (Yes, laziness). With my router out of commission, life is very dull, because it is my gateway to the Internet. Even services hosted at my place (like my Mastodon instance) are not reachable when the router is down because I use multiple VLANs (so I need the router to jump across VLANs).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Ansible Reboot Module&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I recently got a new job, and one of my first tasks was auditing the Ansible roles written by my predecessors. In one role, the machine rebooted and they used the waitforconnection module to wait for it to come back up. That sounded quite hackish to me, so out of curiosity, I tried to determine whether there was a better way. I also thought I might be able to use something similar to further automate my OpenBSD upgrades, and wanted to assess the cleanliness of this method. ;-)&lt;br&gt;
I learned that with the then-upcoming 2.7 Ansible release, a proper reboot module would be included. I went to the docs, which stated that for a certain parameter:&lt;br&gt;
I took this to mean that there was no support for OpenBSD. I looked at the code and, indeed, there was not. However, I believed that it wouldn’t be too hard to add it. I added the missing pieces for OpenBSD, tested it on my poor Pine64 and then submitted it upstream. After a quick back and forth, the module’s author merged it into devel (having a friend working at Red Hat helped the process, merci Cyril !) A couple days later, the release engineer merged it into stable-2.7.&lt;br&gt;
I proceeded to actually write the playbook, and then I hit a bug. The parameter reboottimeout was not recognized by Ansible. This feature would definitely be useful on a slow machine (such as the Pine64 and its dying SD card). Again, my fix was merged into master by the module’s author and then merged into stable-2.7. 2.7.1 will be the first release to feature these fixes, but if you use OpenBSD -current, you already have access to them. I backported the patches when I updated ansible.&lt;br&gt;
Fun fact about Ansible and reboots: “The winreboot module was […] included with Ansible 2.1,” while for unix systems it wasn’t added until 2.7. :D For more details, you can read the module’s author blog article.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The explanations&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Ansible runs my script on the remote host to fetch the sets. It creates an answer file from the template and then gives it to upobsd. Once upobsd has created the kernel, Ansible copies it in place of /bsd on the host. The router reboots and boots on /bsd, which is upobsd’s bsd.rd. The installer runs in autoupdate mode. Once it comes back from bsd.rd land, it archives the kernel and finishes by upgrading all the packages.&lt;br&gt;
It also supports upgrading without fetching the sets ahead of time. For instance, I upgrade this way on my Pine64 because if I cared about speed, I wouldn’t use this weak computer with its dying SD card. For this case, I just comment out the pathsets variable and Ansible instead creates an answer file that will instruct the installer to fetch the sets from the designated mirror.&lt;br&gt;
I’ve been archiving my kernels for a few years. It’s a nice way to fill up / keep a history of my upgrades. If I spot a regression, I can try a previous kernel … which may not work with the then-desynchronized userland, but that’s another story.&lt;br&gt;
sysmerge already runs with rc.sysmerge in batch mode and sends the result by email. I don’t think there’s merit to running it again in the playbook. The only perk would be discovering in the terminal whether any files need to be manually merged, rather than reading exactly the same output in the email.&lt;br&gt;
Initially, I used the openbsdpkg module, but it doesn’t work on -current just before a release because pkgadd automatically looks for pub/OpenBSD/${release}/packages/${arch} (which is empty). I wrote and tested this playbook while 6.4 was around the corner, so I switched to command to be able to pass the -Dsnap parameter.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The result&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I’m very happy with the playbook! It performs the upgrade with as little intervention as possible and minimal downtime. \o/&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://dan.langille.org/2018/11/04/using-smartd-to-automatically-run-tests-on-your-drives/"&gt;Using smartd to automatically run tests on your drives&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Those programs can “control and monitor storage systems using the Self-Monitoring, Analysis and Reporting Technology System (SMART) built into most modern ATA/SATA, SCSI/SAS and NVMe disks. In many cases, these utilities will provide advanced warning of disk degradation and failure.” See the smartmontools website for more information.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;NOTE: “Due to OS-specific issues and also depending on the different state of smartmontools development on the platforms, device support is not the same for all OS platforms.” – use the documentation for your OS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I first started using smartd in March 2010 (according to that blog post, that’s when I still writing on both The FreeBSD Diary and this blog). Back then, and until recently, all I did was start smartd. As far as I can tell, all it did was send daily status messages via the FreeBSD periodic tools. I would set my drive devices via dailystatussmartdevices in /etc/periodic.conf and the daily status reports would include drive health information.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Two types of tests&lt;/li&gt;
&lt;li&gt;My original abandoned attempt&lt;/li&gt;
&lt;li&gt;How do you prove it works?&lt;/li&gt;
&lt;li&gt;Looking at the test results&lt;/li&gt;
&lt;li&gt;Failed drive to the rescue&lt;/li&gt;
&lt;li&gt;smartd.conf I am using&lt;/li&gt;
&lt;li&gt;supernews&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://mwl.io/archives/3833"&gt;Decent Pics of “Relayd &amp;amp; Httpd Mastery” signature&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/0xUID/status/1051208357850345472?s=20"&gt;A Unix Shell poster from 1983&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/UNIX-historians/"&gt;Cambridge UNIX historians (Cambridge, United Kingdom)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://hackmd.io/Yv46aOjTS0eYk0m4YLXOTw#"&gt;Goals for FreeBSD 13&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/blog/september-october-2018-issue-of-the-freebsd-journal-now-available/"&gt;September/October 2018 Issue of the FreeBSD Journal Now Available&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/using_acme_sh_for_let"&gt;Using acme.sh for Let’s Encrypt certificates on pkgsrc.org servers&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://jonwillia.ms/2018/09/23/anycast-dns-openbsd"&gt;Deploying Anycast DNS Using OpenBSD and BGP&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://dataswamp.org/~solene/2017-03-17-integrity.html"&gt;How to check your data integrity?&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Raymond - &lt;a href="http://dpaste.com/0KNXTJF"&gt;MeetBSD California&lt;/a&gt;
&lt;ul&gt;
&lt;li&gt;Dev Summit Videos: &lt;a href="https://www.youtube.com/playlist?list=PLb87fdKUIo8TNG6f94xo9_W-XXrEbqgWI"&gt;https://www.youtube.com/playlist?list=PLb87fdKUIo8TNG6f94xo9_W-XXrEbqgWI&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Conference Videos: &lt;a href="https://www.youtube.com/playlist?list=PLb87fdKUIo8Q41aoPE6vssP-uF4dxk86b"&gt;https://www.youtube.com/playlist?list=PLb87fdKUIo8Q41aoPE6vssP-uF4dxk86b&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Conference videos are still being processed, the rest should appear over the next few weeks.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;Greg - &lt;a href="http://dpaste.com/1W29RSK"&gt;Stable vs Release&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Mjrodriguez - &lt;a href="http://dpaste.com/2XKMR6B#wrap"&gt;Open/FreeBSD support for Single Board computers&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, midnightbsd, eurobsdcon, ansible, dns</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>MidnightBSD 1.0 released, MeetBSD review, EuroBSDcon trip reports, DNS over TLS in FreeBSD 12, Upgrading OpenBSD with Ansible, how to use smartd to run tests on your drives automatically, and more.</p>

<p>##Headlines<br>
###<a href="https://www.midnightbsd.org/news/">MidnightBSD 1.0 now available</a></p>

<blockquote>
<p>I’m happy to announce the availability of MidnightBSD 1.0 for amd64 and i386. Over the years, many ambitious goals were set for our 1.0 release. As it approached, it was clear we wouldn’t be able to accomplish all of them. This release is more of a natural progression rather than a groundbreaking event. It includes many updates to the base system, improvements to the package manager, an updated compiler, and tools.<br>
Of particular note, you can now boot off of ZFS and use NVME SSDs and some AMD Radeon graphics cards support acceleration. AMD Ryzen support has greatly improved in this release. We also have added bhyve from FreeBSD.<br>
The 1.0 release is finally available. Still building packages for i386 and plan to do an amd64 package build later in the week. The single largest issue with the release process has been the web server performance. The CPU is overloaded and has been at solid 100% for several days. The server has a core i7 7700 in it. I’m trying to figure out what to buy as an upgrade so that we don’t continue to have this issue going forward. As it’s actually blocked in multiple processes, a 6 or 8 core chip might be an improvement for the workload…</p>
</blockquote>

<ul>
<li>Download links: <a href="https://www.midnightbsd.org/download/">https://www.midnightbsd.org/download/</a></li>
<li><a href="https://www.youtube.com/watch?time_continue=33&amp;v=-rlk2wFsjJ4">https://www.youtube.com/watch?time_continue=33&amp;v=-rlk2wFsjJ4</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://linuxunplugged.com/articles/meetbsd2018">MeetBSD Review</a></p>

<blockquote>
<p>MeetBSD 2018 took place at the sprawling Intel Santa Clara campus. The venue itself felt more like an olive branch than a simple friendly gesture by Intel. In truth it felt like a bit of an apology. You get the subtle sense they feel bad about how the BSD’s were treated with the Meltdown and Specter flaws. In fact, you may be right to think they felt a bit sorry towards the entire open source community.</p>
</blockquote>

<ul>
<li>MeetBSD 2018</li>
</ul>

<blockquote>
<p>At most massive venues the parking is the first concern, not so here - in fact that was rather straightforward. No, the real challenge is navigating the buildings. Luckily I had help from navigator extraordinaire, Hadea, who located the correct building, SC12 quickly. Finding the entrance took a moment or two though. The lobby itself was converted by iXsystems efficiently into the MeetBSD expo hall, clean, efficient and roomy with registration, some seating, and an extra conference room for on-on-one sessions. On day two sponsor booths were also setup. All who showed up on day one were warmly greeted with badges, lanyards and goodies by Denise and her friendly team.<br>
Like every great BSD event, plenty of food was made available. And as always they make it look effortless. These events showcase iXsystem’s inherent generosity toward its community; with breakfast items in the back of the main auditorium room in the morning, boxed lunches, fruit and cookies at lunch time, and snacks for the rest of the day. But just in case your still hungry, there is a pizza meetup in another Intel room after day one and two.<br>
MeetBSD leverages it’s realistically small crowd size on day one. The morning starts off with introductions of the entire group, the mic is passed around the room.<br>
The group is a good mix of pros in the industry (such as Juniper, Intel, Ebay, Groupon, Cisco, etc), iX staff, and a few enthusiast. Lots of people with a focus or passion for networking. And, of course, some friendly Linux bashing went down for good measure, always followed by a good natured chuckle.</p>
</blockquote>

<ul>
<li>MeetBSD Gives me The Feels</li>
</ul>

<blockquote>
<p>I find that I am subtly unnerved at this venue, and at lunch I saw it clearly. I have always had a strong geek radar, allowing me to navigate a new area (like Berkeley for MeetBSD of 2016, or even SCALE earlier this year in Pasadena), and in a glance I can see who is from my conference and who isn’t. This means it is easy, nearly effortless to know who to greet with a smile and a wave. These are MY people. Here at the Intel campus though it is different. The drive in alone reveals behemoth complexes all with well known tech names prominently displayed. This is Silicon Valley, and all of these people look like MY people. So much for knowing who’s from my conference. Thank goodness for those infamous BSD horns. None-the-less I am struck by how massive these tech giants are. And Intel is one of the largest of those giants, and see the physical reminders of this fact brought home the significance that they had opened their doors, wifi, and bathrooms to the BSD community.</p>
</blockquote>

<p><hr></p>

<p>###[EuroBSDcon 2018 Trip Reports]<br>
<a href="https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-joseph-mingrone/">https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-joseph-mingrone/</a><br>
<a href="https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-vinicius-zavam/">https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-vinicius-zavam/</a><br>
<a href="https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-emmanuel-vadot/">https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-emmanuel-vadot/</a></p>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://blog.des.no/2018/10/dns-over-tls-in-freebsd-12/">DNS over TLS in FreeBSD 12</a></p>

<blockquote>
<p>With the arrival of OpenSSL 1.1.1, an upgraded Unbound, and some changes to the setup and init scripts, FreeBSD 12.0, currently in beta, now supports DNS over TLS out of the box.<br>
DNS over TLS is just what it sounds like: DNS over TCP, but wrapped in a TLS session. It encrypts your requests and the server’s replies, and optionally allows you to verify the identity of the server. The advantages are protection against eavesdropping and manipulation of your DNS traffic; the drawbacks are a slight performance degradation and potential firewall traversal issues, as it runs over a non-standard port (TCP port 853) which may be blocked on some networks. Let’s take a look at how to set it up.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>We’ve seen how to set up Unbound—specifically, the local_unbound service in FreeBSD 12.0—to use DNS over TLS instead of plain UDP or TCP, using Cloudflare’s public DNS service as an example. We’ve looked at the performance impact, and at how to ensure (and verify) that Unbound validates the server certificate to prevent man-in-the-middle attacks.<br>
The question that remains is whether it is all worth it. There is undeniably a performance hit, though this may improve with TLS 1.3. More importantly, there are currently very few DNS-over-TLS providers—only one, really, since Quad9 filter their responses—and you have to weigh the advantage of encrypting your DNS traffic against the disadvantage of sending it all to a single organization. I can’t answer that question for you, but I can tell you that the parameters are evolving quickly, and if your answer is negative today, it may not remain so for long. More providers will appear. Performance will improve with TLS 1.3 and QUIC. Within a year or two, running DNS over TLS may very well become the rule rather than the experimental exception.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://chown.me/blog/upgrading-openbsd-with-ansible.html">Upgrading OpenBSD with Ansible</a></p>

<ul>
<li>My router runs OpenBSD -current</li>
</ul>

<blockquote>
<p>A few months ago, I needed software that had just hit the ports tree. I didn’t want to wait for the next release, so I upgraded my router to use -current. Since then, I’ve continued running -current, which means upgrading to a newer snapshot every so often. Running -current is great, but the process of updating to a newer snapshot was cumbersome. Initially, I had to plug in a serial cable and then reboot into bsd.rd, hit enter ten times, then reboot, run sysmerge and update packages.<br>
I eventually switched to upobsd to be able to upgrade without the need for a serial connection. The process was better, but still tiresome. Usually, I would prepare the special version of bsd.rd, boot on bsd.rd, and do something like wash the dishes in the meantime. After about ten minutes, I would dry my hands and then go back to my workstation to see whether the bsd.rd part had finished so I could run sysmerge and pkg_add, and then return to the dishes while it upgraded packages.<br>
Out of laziness, I thought: “I should automate this,” but what happened instead is that I simply didn’t upgrade that machine very often. (Yes, laziness). With my router out of commission, life is very dull, because it is my gateway to the Internet. Even services hosted at my place (like my Mastodon instance) are not reachable when the router is down because I use multiple VLANs (so I need the router to jump across VLANs).</p>
</blockquote>

<ul>
<li>Ansible Reboot Module</li>
</ul>

<blockquote>
<p>I recently got a new job, and one of my first tasks was auditing the Ansible roles written by my predecessors. In one role, the machine rebooted and they used the wait_for_connection module to wait for it to come back up. That sounded quite hackish to me, so out of curiosity, I tried to determine whether there was a better way. I also thought I might be able to use something similar to further automate my OpenBSD upgrades, and wanted to assess the cleanliness of this method. ;-)<br>
I learned that with the then-upcoming 2.7 Ansible release, a proper reboot module would be included. I went to the docs, which stated that for a certain parameter:<br>
I took this to mean that there was no support for OpenBSD. I looked at the code and, indeed, there was not. However, I believed that it wouldn’t be too hard to add it. I added the missing pieces for OpenBSD, tested it on my poor Pine64 and then submitted it upstream. After a quick back and forth, the module’s author merged it into devel (having a friend working at Red Hat helped the process, merci Cyril !) A couple days later, the release engineer merged it into stable-2.7.<br>
I proceeded to actually write the playbook, and then I hit a bug. The parameter reboot_timeout was not recognized by Ansible. This feature would definitely be useful on a slow machine (such as the Pine64 and its dying SD card). Again, my fix was merged into master by the module’s author and then merged into stable-2.7. 2.7.1 will be the first release to feature these fixes, but if you use OpenBSD -current, you already have access to them. I backported the patches when I updated ansible.<br>
Fun fact about Ansible and reboots: “The win_reboot module was […] included with Ansible 2.1,” while for unix systems it wasn’t added until 2.7. :D For more details, you can read the module’s author blog article.</p>
</blockquote>

<ul>
<li>The explanations</li>
</ul>

<blockquote>
<p>Ansible runs my script on the remote host to fetch the sets. It creates an answer file from the template and then gives it to upobsd. Once upobsd has created the kernel, Ansible copies it in place of /bsd on the host. The router reboots and boots on /bsd, which is upobsd’s bsd.rd. The installer runs in auto_update mode. Once it comes back from bsd.rd land, it archives the kernel and finishes by upgrading all the packages.<br>
It also supports upgrading without fetching the sets ahead of time. For instance, I upgrade this way on my Pine64 because if I cared about speed, I wouldn’t use this weak computer with its dying SD card. For this case, I just comment out the path_sets variable and Ansible instead creates an answer file that will instruct the installer to fetch the sets from the designated mirror.<br>
I’ve been archiving my kernels for a few years. It’s a nice way to fill up / keep a history of my upgrades. If I spot a regression, I can try a previous kernel … which may not work with the then-desynchronized userland, but that’s another story.<br>
sysmerge already runs with rc.sysmerge in batch mode and sends the result by email. I don’t think there’s merit to running it again in the playbook. The only perk would be discovering in the terminal whether any files need to be manually merged, rather than reading exactly the same output in the email.<br>
Initially, I used the openbsd_pkg module, but it doesn’t work on -current just before a release because pkg_add automatically looks for pub/OpenBSD/${release}/packages/${arch} (which is empty). I wrote and tested this playbook while 6.4 was around the corner, so I switched to command to be able to pass the -Dsnap parameter.</p>
</blockquote>

<ul>
<li>The result</li>
</ul>

<blockquote>
<p>I’m very happy with the playbook! It performs the upgrade with as little intervention as possible and minimal downtime. \o/</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://dan.langille.org/2018/11/04/using-smartd-to-automatically-run-tests-on-your-drives/">Using smartd to automatically run tests on your drives</a></p>

<blockquote>
<p>Those programs can “control and monitor storage systems using the Self-Monitoring, Analysis and Reporting Technology System (SMART) built into most modern ATA/SATA, SCSI/SAS and NVMe disks. In many cases, these utilities will provide advanced warning of disk degradation and failure.” See the smartmontools website for more information.</p>
</blockquote>

<blockquote>
<p>NOTE: “Due to OS-specific issues and also depending on the different state of smartmontools development on the platforms, device support is not the same for all OS platforms.” – use the documentation for your OS.</p>
</blockquote>

<blockquote>
<p>I first started using smartd in March 2010 (according to that blog post, that’s when I still writing on both The FreeBSD Diary and this blog). Back then, and until recently, all I did was start smartd. As far as I can tell, all it did was send daily status messages via the FreeBSD periodic tools. I would set my drive devices via daily_status_smart_devices in /etc/periodic.conf and the daily status reports would include drive health information.</p>
</blockquote>

<ul>
<li>Two types of tests</li>
<li>My original abandoned attempt</li>
<li>How do you prove it works?</li>
<li>Looking at the test results</li>
<li>Failed drive to the rescue</li>
<li>smartd.conf I am using</li>
<li>supernews</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://mwl.io/archives/3833">Decent Pics of “Relayd &amp; Httpd Mastery” signature</a></li>
<li><a href="https://twitter.com/0xUID/status/1051208357850345472?s=20">A Unix Shell poster from 1983</a></li>
<li><a href="https://www.meetup.com/UNIX-historians/">Cambridge UNIX historians (Cambridge, United Kingdom)</a></li>
<li><a href="https://hackmd.io/Yv46aOjTS0eYk0m4YLXOTw#">Goals for FreeBSD 13</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/september-october-2018-issue-of-the-freebsd-journal-now-available/">September/October 2018 Issue of the FreeBSD Journal Now Available</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/using_acme_sh_for_let">Using acme.sh for Let’s Encrypt certificates on pkgsrc.org servers</a></li>
<li><a href="https://jonwillia.ms/2018/09/23/anycast-dns-openbsd">Deploying Anycast DNS Using OpenBSD and BGP</a></li>
<li><a href="https://dataswamp.org/~solene/2017-03-17-integrity.html">How to check your data integrity?</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Raymond - <a href="http://dpaste.com/0KNXTJF">MeetBSD California</a>
<ul>
<li>Dev Summit Videos: <a href="https://www.youtube.com/playlist?list=PLb87fdKUIo8TNG6f94xo9_W-XXrEbqgWI">https://www.youtube.com/playlist?list=PLb87fdKUIo8TNG6f94xo9_W-XXrEbqgWI</a></li>
<li>Conference Videos: <a href="https://www.youtube.com/playlist?list=PLb87fdKUIo8Q41aoPE6vssP-uF4dxk86b">https://www.youtube.com/playlist?list=PLb87fdKUIo8Q41aoPE6vssP-uF4dxk86b</a></li>
<li>Conference videos are still being processed, the rest should appear over the next few weeks.</li>
</ul>

<p></li><br>
<li>Greg - <a href="http://dpaste.com/1W29RSK">Stable vs Release</a></li><br>
<li>Mjrodriguez - <a href="http://dpaste.com/2XKMR6B#wrap">Open/FreeBSD support for Single Board computers</a></li><br>
</ul><br>
<hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>MidnightBSD 1.0 released, MeetBSD review, EuroBSDcon trip reports, DNS over TLS in FreeBSD 12, Upgrading OpenBSD with Ansible, how to use smartd to run tests on your drives automatically, and more.</p>

<p>##Headlines<br>
###<a href="https://www.midnightbsd.org/news/">MidnightBSD 1.0 now available</a></p>

<blockquote>
<p>I’m happy to announce the availability of MidnightBSD 1.0 for amd64 and i386. Over the years, many ambitious goals were set for our 1.0 release. As it approached, it was clear we wouldn’t be able to accomplish all of them. This release is more of a natural progression rather than a groundbreaking event. It includes many updates to the base system, improvements to the package manager, an updated compiler, and tools.<br>
Of particular note, you can now boot off of ZFS and use NVME SSDs and some AMD Radeon graphics cards support acceleration. AMD Ryzen support has greatly improved in this release. We also have added bhyve from FreeBSD.<br>
The 1.0 release is finally available. Still building packages for i386 and plan to do an amd64 package build later in the week. The single largest issue with the release process has been the web server performance. The CPU is overloaded and has been at solid 100% for several days. The server has a core i7 7700 in it. I’m trying to figure out what to buy as an upgrade so that we don’t continue to have this issue going forward. As it’s actually blocked in multiple processes, a 6 or 8 core chip might be an improvement for the workload…</p>
</blockquote>

<ul>
<li>Download links: <a href="https://www.midnightbsd.org/download/">https://www.midnightbsd.org/download/</a></li>
<li><a href="https://www.youtube.com/watch?time_continue=33&amp;v=-rlk2wFsjJ4">https://www.youtube.com/watch?time_continue=33&amp;v=-rlk2wFsjJ4</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://linuxunplugged.com/articles/meetbsd2018">MeetBSD Review</a></p>

<blockquote>
<p>MeetBSD 2018 took place at the sprawling Intel Santa Clara campus. The venue itself felt more like an olive branch than a simple friendly gesture by Intel. In truth it felt like a bit of an apology. You get the subtle sense they feel bad about how the BSD’s were treated with the Meltdown and Specter flaws. In fact, you may be right to think they felt a bit sorry towards the entire open source community.</p>
</blockquote>

<ul>
<li>MeetBSD 2018</li>
</ul>

<blockquote>
<p>At most massive venues the parking is the first concern, not so here - in fact that was rather straightforward. No, the real challenge is navigating the buildings. Luckily I had help from navigator extraordinaire, Hadea, who located the correct building, SC12 quickly. Finding the entrance took a moment or two though. The lobby itself was converted by iXsystems efficiently into the MeetBSD expo hall, clean, efficient and roomy with registration, some seating, and an extra conference room for on-on-one sessions. On day two sponsor booths were also setup. All who showed up on day one were warmly greeted with badges, lanyards and goodies by Denise and her friendly team.<br>
Like every great BSD event, plenty of food was made available. And as always they make it look effortless. These events showcase iXsystem’s inherent generosity toward its community; with breakfast items in the back of the main auditorium room in the morning, boxed lunches, fruit and cookies at lunch time, and snacks for the rest of the day. But just in case your still hungry, there is a pizza meetup in another Intel room after day one and two.<br>
MeetBSD leverages it’s realistically small crowd size on day one. The morning starts off with introductions of the entire group, the mic is passed around the room.<br>
The group is a good mix of pros in the industry (such as Juniper, Intel, Ebay, Groupon, Cisco, etc), iX staff, and a few enthusiast. Lots of people with a focus or passion for networking. And, of course, some friendly Linux bashing went down for good measure, always followed by a good natured chuckle.</p>
</blockquote>

<ul>
<li>MeetBSD Gives me The Feels</li>
</ul>

<blockquote>
<p>I find that I am subtly unnerved at this venue, and at lunch I saw it clearly. I have always had a strong geek radar, allowing me to navigate a new area (like Berkeley for MeetBSD of 2016, or even SCALE earlier this year in Pasadena), and in a glance I can see who is from my conference and who isn’t. This means it is easy, nearly effortless to know who to greet with a smile and a wave. These are MY people. Here at the Intel campus though it is different. The drive in alone reveals behemoth complexes all with well known tech names prominently displayed. This is Silicon Valley, and all of these people look like MY people. So much for knowing who’s from my conference. Thank goodness for those infamous BSD horns. None-the-less I am struck by how massive these tech giants are. And Intel is one of the largest of those giants, and see the physical reminders of this fact brought home the significance that they had opened their doors, wifi, and bathrooms to the BSD community.</p>
</blockquote>

<p><hr></p>

<p>###[EuroBSDcon 2018 Trip Reports]<br>
<a href="https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-joseph-mingrone/">https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-joseph-mingrone/</a><br>
<a href="https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-vinicius-zavam/">https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-vinicius-zavam/</a><br>
<a href="https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-emmanuel-vadot/">https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-emmanuel-vadot/</a></p>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://blog.des.no/2018/10/dns-over-tls-in-freebsd-12/">DNS over TLS in FreeBSD 12</a></p>

<blockquote>
<p>With the arrival of OpenSSL 1.1.1, an upgraded Unbound, and some changes to the setup and init scripts, FreeBSD 12.0, currently in beta, now supports DNS over TLS out of the box.<br>
DNS over TLS is just what it sounds like: DNS over TCP, but wrapped in a TLS session. It encrypts your requests and the server’s replies, and optionally allows you to verify the identity of the server. The advantages are protection against eavesdropping and manipulation of your DNS traffic; the drawbacks are a slight performance degradation and potential firewall traversal issues, as it runs over a non-standard port (TCP port 853) which may be blocked on some networks. Let’s take a look at how to set it up.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>We’ve seen how to set up Unbound—specifically, the local_unbound service in FreeBSD 12.0—to use DNS over TLS instead of plain UDP or TCP, using Cloudflare’s public DNS service as an example. We’ve looked at the performance impact, and at how to ensure (and verify) that Unbound validates the server certificate to prevent man-in-the-middle attacks.<br>
The question that remains is whether it is all worth it. There is undeniably a performance hit, though this may improve with TLS 1.3. More importantly, there are currently very few DNS-over-TLS providers—only one, really, since Quad9 filter their responses—and you have to weigh the advantage of encrypting your DNS traffic against the disadvantage of sending it all to a single organization. I can’t answer that question for you, but I can tell you that the parameters are evolving quickly, and if your answer is negative today, it may not remain so for long. More providers will appear. Performance will improve with TLS 1.3 and QUIC. Within a year or two, running DNS over TLS may very well become the rule rather than the experimental exception.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://chown.me/blog/upgrading-openbsd-with-ansible.html">Upgrading OpenBSD with Ansible</a></p>

<ul>
<li>My router runs OpenBSD -current</li>
</ul>

<blockquote>
<p>A few months ago, I needed software that had just hit the ports tree. I didn’t want to wait for the next release, so I upgraded my router to use -current. Since then, I’ve continued running -current, which means upgrading to a newer snapshot every so often. Running -current is great, but the process of updating to a newer snapshot was cumbersome. Initially, I had to plug in a serial cable and then reboot into bsd.rd, hit enter ten times, then reboot, run sysmerge and update packages.<br>
I eventually switched to upobsd to be able to upgrade without the need for a serial connection. The process was better, but still tiresome. Usually, I would prepare the special version of bsd.rd, boot on bsd.rd, and do something like wash the dishes in the meantime. After about ten minutes, I would dry my hands and then go back to my workstation to see whether the bsd.rd part had finished so I could run sysmerge and pkg_add, and then return to the dishes while it upgraded packages.<br>
Out of laziness, I thought: “I should automate this,” but what happened instead is that I simply didn’t upgrade that machine very often. (Yes, laziness). With my router out of commission, life is very dull, because it is my gateway to the Internet. Even services hosted at my place (like my Mastodon instance) are not reachable when the router is down because I use multiple VLANs (so I need the router to jump across VLANs).</p>
</blockquote>

<ul>
<li>Ansible Reboot Module</li>
</ul>

<blockquote>
<p>I recently got a new job, and one of my first tasks was auditing the Ansible roles written by my predecessors. In one role, the machine rebooted and they used the wait_for_connection module to wait for it to come back up. That sounded quite hackish to me, so out of curiosity, I tried to determine whether there was a better way. I also thought I might be able to use something similar to further automate my OpenBSD upgrades, and wanted to assess the cleanliness of this method. ;-)<br>
I learned that with the then-upcoming 2.7 Ansible release, a proper reboot module would be included. I went to the docs, which stated that for a certain parameter:<br>
I took this to mean that there was no support for OpenBSD. I looked at the code and, indeed, there was not. However, I believed that it wouldn’t be too hard to add it. I added the missing pieces for OpenBSD, tested it on my poor Pine64 and then submitted it upstream. After a quick back and forth, the module’s author merged it into devel (having a friend working at Red Hat helped the process, merci Cyril !) A couple days later, the release engineer merged it into stable-2.7.<br>
I proceeded to actually write the playbook, and then I hit a bug. The parameter reboot_timeout was not recognized by Ansible. This feature would definitely be useful on a slow machine (such as the Pine64 and its dying SD card). Again, my fix was merged into master by the module’s author and then merged into stable-2.7. 2.7.1 will be the first release to feature these fixes, but if you use OpenBSD -current, you already have access to them. I backported the patches when I updated ansible.<br>
Fun fact about Ansible and reboots: “The win_reboot module was […] included with Ansible 2.1,” while for unix systems it wasn’t added until 2.7. :D For more details, you can read the module’s author blog article.</p>
</blockquote>

<ul>
<li>The explanations</li>
</ul>

<blockquote>
<p>Ansible runs my script on the remote host to fetch the sets. It creates an answer file from the template and then gives it to upobsd. Once upobsd has created the kernel, Ansible copies it in place of /bsd on the host. The router reboots and boots on /bsd, which is upobsd’s bsd.rd. The installer runs in auto_update mode. Once it comes back from bsd.rd land, it archives the kernel and finishes by upgrading all the packages.<br>
It also supports upgrading without fetching the sets ahead of time. For instance, I upgrade this way on my Pine64 because if I cared about speed, I wouldn’t use this weak computer with its dying SD card. For this case, I just comment out the path_sets variable and Ansible instead creates an answer file that will instruct the installer to fetch the sets from the designated mirror.<br>
I’ve been archiving my kernels for a few years. It’s a nice way to fill up / keep a history of my upgrades. If I spot a regression, I can try a previous kernel … which may not work with the then-desynchronized userland, but that’s another story.<br>
sysmerge already runs with rc.sysmerge in batch mode and sends the result by email. I don’t think there’s merit to running it again in the playbook. The only perk would be discovering in the terminal whether any files need to be manually merged, rather than reading exactly the same output in the email.<br>
Initially, I used the openbsd_pkg module, but it doesn’t work on -current just before a release because pkg_add automatically looks for pub/OpenBSD/${release}/packages/${arch} (which is empty). I wrote and tested this playbook while 6.4 was around the corner, so I switched to command to be able to pass the -Dsnap parameter.</p>
</blockquote>

<ul>
<li>The result</li>
</ul>

<blockquote>
<p>I’m very happy with the playbook! It performs the upgrade with as little intervention as possible and minimal downtime. \o/</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://dan.langille.org/2018/11/04/using-smartd-to-automatically-run-tests-on-your-drives/">Using smartd to automatically run tests on your drives</a></p>

<blockquote>
<p>Those programs can “control and monitor storage systems using the Self-Monitoring, Analysis and Reporting Technology System (SMART) built into most modern ATA/SATA, SCSI/SAS and NVMe disks. In many cases, these utilities will provide advanced warning of disk degradation and failure.” See the smartmontools website for more information.</p>
</blockquote>

<blockquote>
<p>NOTE: “Due to OS-specific issues and also depending on the different state of smartmontools development on the platforms, device support is not the same for all OS platforms.” – use the documentation for your OS.</p>
</blockquote>

<blockquote>
<p>I first started using smartd in March 2010 (according to that blog post, that’s when I still writing on both The FreeBSD Diary and this blog). Back then, and until recently, all I did was start smartd. As far as I can tell, all it did was send daily status messages via the FreeBSD periodic tools. I would set my drive devices via daily_status_smart_devices in /etc/periodic.conf and the daily status reports would include drive health information.</p>
</blockquote>

<ul>
<li>Two types of tests</li>
<li>My original abandoned attempt</li>
<li>How do you prove it works?</li>
<li>Looking at the test results</li>
<li>Failed drive to the rescue</li>
<li>smartd.conf I am using</li>
<li>supernews</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://mwl.io/archives/3833">Decent Pics of “Relayd &amp; Httpd Mastery” signature</a></li>
<li><a href="https://twitter.com/0xUID/status/1051208357850345472?s=20">A Unix Shell poster from 1983</a></li>
<li><a href="https://www.meetup.com/UNIX-historians/">Cambridge UNIX historians (Cambridge, United Kingdom)</a></li>
<li><a href="https://hackmd.io/Yv46aOjTS0eYk0m4YLXOTw#">Goals for FreeBSD 13</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/september-october-2018-issue-of-the-freebsd-journal-now-available/">September/October 2018 Issue of the FreeBSD Journal Now Available</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/using_acme_sh_for_let">Using acme.sh for Let’s Encrypt certificates on pkgsrc.org servers</a></li>
<li><a href="https://jonwillia.ms/2018/09/23/anycast-dns-openbsd">Deploying Anycast DNS Using OpenBSD and BGP</a></li>
<li><a href="https://dataswamp.org/~solene/2017-03-17-integrity.html">How to check your data integrity?</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Raymond - <a href="http://dpaste.com/0KNXTJF">MeetBSD California</a>
<ul>
<li>Dev Summit Videos: <a href="https://www.youtube.com/playlist?list=PLb87fdKUIo8TNG6f94xo9_W-XXrEbqgWI">https://www.youtube.com/playlist?list=PLb87fdKUIo8TNG6f94xo9_W-XXrEbqgWI</a></li>
<li>Conference Videos: <a href="https://www.youtube.com/playlist?list=PLb87fdKUIo8Q41aoPE6vssP-uF4dxk86b">https://www.youtube.com/playlist?list=PLb87fdKUIo8Q41aoPE6vssP-uF4dxk86b</a></li>
<li>Conference videos are still being processed, the rest should appear over the next few weeks.</li>
</ul>

<p></li><br>
<li>Greg - <a href="http://dpaste.com/1W29RSK">Stable vs Release</a></li><br>
<li>Mjrodriguez - <a href="http://dpaste.com/2XKMR6B#wrap">Open/FreeBSD support for Single Board computers</a></li><br>
</ul><br>
<hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 270: Ghostly Releases | BSD Now 270</title>
  <link>https://www.bsdnow.tv/270</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2822</guid>
  <pubDate>Thu, 01 Nov 2018 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/83e21562-2f8c-4810-b4c6-0e8f3e36f95b.mp3" length="41653876" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 6.4 released, GhostBSD RC2 released, MeetBSD - the ultimate hallway track, DragonflyBSD desktop on a Thinkpad, Porting keybase to NetBSD, OpenSSH 7.9, and draft-ietf-6man-ipv6only-flag in FreeBSD.</itunes:subtitle>
  <itunes:duration>1:09:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 6.4 released, GhostBSD RC2 released, MeetBSD - the ultimate hallway track, DragonflyBSD desktop on a Thinkpad, Porting keybase to NetBSD, OpenSSH 7.9, and draft-ietf-6man-ipv6only-flag in FreeBSD.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.openbsd.org/64.html"&gt;OpenBSD 6.4 released&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.openbsd.org/plus64.html"&gt;See a detailed log of changes between the 6.3 and 6.4 releases.&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.openbsd.org/ftp.html"&gt;See the information on the FTP page for a list of mirror machines.&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.openbsd.org/errata64.html"&gt;Have a look at the 6.4 errata page for a list of bugs and workarounds.&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;signify(1) pubkeys for this release:&lt;/li&gt;
&lt;li&gt;base: RWQq6XmS4eDAcQW4KsT5Ka0KwTQp2JMOP9V/DR4HTVOL5Bc0D7LeuPwA&lt;/li&gt;
&lt;li&gt;fw:   RWRoBbjnosJ/39llpve1XaNIrrQND4knG+jSBeIUYU8x4WNkxz6a2K97&lt;/li&gt;
&lt;li&gt;pkg:  RWRF5TTY+LoN/51QD5kM2hKDtMTzycQBBPmPYhyQEb1+4pff/H6fh/kA&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.ghostbsd.org/18.10_RC2_release_announcement"&gt;GhostBSD 18.10 RC2 Announced&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;This second release candidate of GhostBSD 18.10 is the second official release of GhostBSD with TrueOS under the hood. The official desktop of GhostBSD is MATE. However, in the future, there might be an XFCE community release, but for now, there is no community release yet.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;What has changed since RC1&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Removed drm-stable-kmod and we will let users installed the propper drm-*-kmod&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Douglas Joachin added libva-intel-driver libva-vdpau-driver  to supports accelerated some video driver for Intel&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Issues that got fixed&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Bug #70 Cannot run Octopi, missing libgksu error.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Bug #71 LibreOffice doesn’t start because of missing libcurl.so.4&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Bug #72 libarchive is a missing dependency&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Again thanks to iXsystems, TrueOS, Joe Maloney, Kris Moore, Ken Moore, Martin Wilke, Neville Goddard, Vester “Vic” Thacker, Douglas Joachim, Alex Lyakhov, Yetkin Degirmenci and many more who helped to make the transition from FreeBSD to TrueOS smoother.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Updating from RC1 to RC2:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;sudo pkg update -f&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;sudo pkg install -f libarchive curl libgksu&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;sudo pkg upgrade&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Where to download:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;All images checksum, hybrid ISO(DVD, USB) and torrent are available here: &lt;a href="https://www.ghostbsd.org/download"&gt;https://www.ghostbsd.org/download&lt;/a&gt;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;[ScreenShots]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;&lt;a href="https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-22-41.png"&gt;https://www.ghostbsd.org/sites/default/files/Screenshotat2018-10-2013-22-41.png&lt;/a&gt;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;&lt;a href="https://www.ghostbsd.org/sites/default/files/Screenshotat2018-10-2013-27-26.png"&gt;https://www.ghostbsd.org/sites/default/files/Screenshotat2018-10-20_13-27-26.png&lt;/a&gt;&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.openssh.com/txt/release-7.9"&gt;OpenSSH 7.9 has been released and it has support for OpenSSL 1.1&lt;/a&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;Changes since OpenSSH 7.8
This is primarily a bugfix release.
New Features
ssh(1), sshd(8): allow most port numbers to be specified using
service names from getservbyname(3) (typically /etc/services).
ssh(1): allow the IdentityAgent configuration directive to accept
environment variable names. This supports the use of multiple
agent sockets without needing to use fixed paths.
sshd(8): support signalling sessions via the SSH protocol.
A limited subset of signals is supported and only for login or
command sessions (i.e. not subsystems) that were not subject to
a forced command via authorizedkeys or sshdconfig. bz#1424
ssh(1): support "ssh -Q sig" to list supported signature options.
Also "ssh -Q help" to show the full set of supported queries.
ssh(1), sshd(8): add a CASignatureAlgorithms option for the
client and server configs to allow control over which signature
formats are allowed for CAs to sign certificates. For example,
this allows banning CAs that sign certificates using the RSA-SHA1
signature algorithm.
sshd(8), ssh-keygen(1): allow key revocation lists (KRLs) to
revoke keys specified by SHA256 hash.
ssh-keygen(1): allow creation of key revocation lists directly
from base64-encoded SHA256 fingerprints. This supports revoking
keys using only the information contained in sshd(8)
authentication log messages.
Bugfixes
ssh(1), ssh-keygen(1): avoid spurious "invalid format" errors when
attempting to load PEM private keys while using an incorrect
passphrase. bz#2901
sshd(8): when a channel closed message is received from a client,
close the stderr file descriptor at the same time stdout is
closed. This avoids stuck processes if they were waiting for
stderr to close and were insensitive to stdin/out closing. bz#2863
ssh(1): allow ForwardX11Timeout=0 to disable the untrusted X11
forwarding timeout and support X11 forwarding indefinitely.
Previously the behaviour of ForwardX11Timeout=0 was undefined.
sshd(8): when compiled with GSSAPI support, cache supported method
OIDs regardless of whether GSSAPI authentication is enabled in the
main section of sshd_config. This avoids sandbox violations if
GSSAPI authentication was later enabled in a Match block. bz#2107
sshd(8): do not fail closed when configured with a text key
revocation list that contains a too-short key. bz#2897
ssh(1): treat connections with ProxyJump specified the same as
ones with a ProxyCommand set with regards to hostname
canonicalisation (i.e. don't try to canonicalise the hostname
unless CanonicalizeHostname is set to 'always'). bz#2896
ssh(1): fix regression in OpenSSH 7.8 that could prevent public-
key authentication using certificates hosted in a ssh-agent(1)
or against sshd(8) from OpenSSH &amp;lt;7.8.
Portability
All: support building against the openssl-1.1 API (releases 1.1.0g
and later). The openssl-1.0 API will remain supported at least
until OpenSSL terminates security patch support for that API version.
sshd(8): allow the futex(2) syscall in the Linux seccomp sandbox;
apparently required by some glibc/OpenSSL combinations.
sshd(8): handle getgrouplist(3) returning more than
SCNGROUPSMAX groups. Some platforms consider this limit more
as a guideline.
&lt;/code&gt;&lt;/pre&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://www.ixsystems.com/blog/meetbsd-2018/"&gt;MeetBSD 2018: The Ultimate Hallway Track&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Founded in Poland in 2007 and first hosted in California in 2008, MeetBSD combines formal talks with UnConference activities to provide a level of interactivity not found at any other BSD conference. The character of each MeetBSD is determined largely by its venue, ranging from Hacker Dojo in 2010 to Intel’s Santa Clara headquarters this year. The Intel SC12 building provided a beautiful auditorium and sponsors’ room, plus a cafeteria for the Friday night social event and the Saturday night FreeBSD 25th Anniversary Celebration. The formal nature of the auditorium motivated the formation of MeetBSD’s first independent Program Committee and public Call for Participation. Together these resulted in a backbone of talks presented by speakers from the USA, Canada, and Poland, combined with UnConference activities tailored to the space.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;MeetBSD Day 0&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Day Zero of MeetBSD was a FreeBSD Developer/Vendor Summit hosted in the same auditorium where the talks would take place. Like the conference itself, this event featured a mix of scheduled talks and interactive sessions. The scheduled talks were LWPMFS: LightWeight Persistent Memory Filesystem by Ravi Pokala, Evaluating GIT for FreeBSD by Ed Maste, and NUMA by Mark Johnston. Ed’s overview of the advantages and disadvantages of using Git for FreeBSD development was of the most interest to users and developers, and the discussion continued into the following two days.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;MeetBSD Day 1&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The first official day of MeetBSD 2018 was kicked off with introductions led by emcee JT Pennington and a keynote, “Using TrueOS to boot-strap your FreeBSD-based project” by Kris Moore. Kris described a new JSON-based release infrastructure that he has exercised with FreeBSD, TrueOS, and FreeNAS. Kris’ talk was followed by “Intel &amp;amp; FreeBSD: Better Together” by Ben Widawsky, the FreeBSD program lead at Intel, who gave an overview of Intel’s past and current efforts supporting FreeBSD. Next came lunch, followed by Kamil Rytarowski’s “Bug detecting software in the NetBSD userland: MKSANITIZER”. This was followed by 5-Minute Lightning Talks, Andrew Fengler’s “FreeBSD: What to (Not) Monitor”, and an OpenZFS Panel Discussion featuring OpenZFS experts Michael W. Lucas, Allan Jude, Alexander Motin, Pawel Dawidek, and Dan Langille. Day one concluded with a social event at the Intel cafeteria where the discussions continued into the night.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;MeetBSD Day 2&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Day Two of MeetBSD 2018 kicked off with a keynote by Michael W. Lucas entitled “Why BSD?”, where Michael detailed what makes the BSD community different and why it attracts us all. This was followed by Dr. Kirk McKusick’s “The Early Days of BSD” talk, which was followed by “DTrace/dwatch in Production” by Devin Teske. After lunch, we enjoyed “A Curmudgeon’s Language Selection Criteria: Why I Don’t Write Everything in Go, Rust, Elixir, etc” by G. Clifford Williams and, “Best practices of sandboxing applications with Capsicum” by Mariusz Zaborski. I then hosted a Virtualization Panel Discussion that featured eight developers from FreeBSD, OpenBSD, and NetBSD. We then split up for Breakout Sessions and the one on Bloomberg’s controversial article on backdoored Supermicro systems was fascinating given the experts present, all of whom were skeptical of the feasibility of the attack. The day wrapped up with a final talk, “Tales of a Daemontown Performance Peddler: Why ‘it depends’ and what you can do about it” by Nick Principe, followed by the FreeBSD 25th Anniversary Celebration.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Putting the “meet” in MeetBSD&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I confess the other organizers and I were nervous about how well one large auditorium would suit a BSD event but the flexible personal space it gave everyone allowed for countless meetings and heated hacking that often brought about immediate results. I watched people take ideas through several iterations with the help and input of obvious and unexpected experts, all of whom were within reach. Not having to pick up and leave for a talk in another room organically resulted in essentially a series of mini hackathons that none of us anticipated but were delighted to witness, taking the “hallway track” to a whole new level. The mix of formal and UnConference activities at MeetBSD is certain to evolve. Thank you to everyone who participated with questions, Lightning Talks, and Panel participation. A huge thanks to our sponsors, including Intel for both hosting and sponsoring MeetBSD California 2018, Western Digital, Supermicro, Verisign, Jupiter Broadcasting, the FreeBSD Foundation, Bank of America Merrill Lynch, the NetBSD Foundation, and the team at iXsystems.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;See you at MeetBSD 2020!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://panoramacircle.com/2018/10/07/setup-dragonflybsd-with-a-desktop-on-real-hardware-thinkpad-t410/"&gt;Setup DragonflyBSD with a desktop on real hardware ThinkPad T410&lt;/a&gt;&lt;br&gt;
+&lt;a href="https://youtu.be/p4KwssNY82Q"&gt;Video Demo&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Linux has become too mainstream and standard BSD is a common thing now? How about DragonflyBSD which was created as a fork of FreeBSD 4.8 in conflict over system internals. This tutorial will show how to install it and set up a user-oriented desktop. It should work with DragonflyBSD, FreeBSD and probably all BSDs.&lt;br&gt;
Some background: BSD was is ultimately derived from UNIX back in the days. It is not Linux even though it is similar in many ways because Linux was designed to follow UNIX principles. Seeing is believing, so check out the video of the install!&lt;br&gt;
I did try two BSD distros before called GhostBSD and TrueOS and you can check out my short reviews. DragonflyBSD comes like FreeBSD bare bones and requires some work to get a desktop running.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Download image file and burn to USB drive or DVD&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;First installation&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Setting up the system and installing a desktop&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Inside the desktop&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Install some more programs&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;How to enable sound?&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Let’s play some free games&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Setup WiFi&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Power mode settings&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;More to do?&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;You can check out this blog post if you want a much more detailed tutorial. If you don’t mind standard BSD, get the GhostBSD distro instead which comes with a ready-made desktop xcfe or mate and many functional presets.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;A small summary of what we got on the upside:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Free and open source operating system with a long history&lt;/li&gt;
&lt;li&gt;Drivers worked fine including Ethernet, WiFi, video 2D &amp;amp; 3D, audio, etc&lt;/li&gt;
&lt;li&gt;Hammer2 advanced file system&lt;/li&gt;
&lt;li&gt;You are very unique if you use this OS fork&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Some downsides:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Less driver and direct app support than Linux&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Installer and desktop have some traps and quirks and require work&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://dressupgeekout.blogspot.com/2018/10/porting-keybase-to-netbsd.html"&gt;Porting Keybase to NetBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Keybase significantly simplifies the whole keypair/PGP thing and makes what is usually a confusing, difficult experience actually rather pleasant. At its heart is an open-source command line utility that does all of the heavy cryptographic lifting. But it’s also hooked up to the network of all other Keybase users, so you don’t have to work very hard to maintain big keychains. Pretty cool!&lt;br&gt;
So, this evening, I tried to get it to all work on NetBSD.&lt;br&gt;
The Keybase client code base is, in my opinion, not very well architected… there exist many different Keybase clients (command line apps, desktop apps, mobile apps) and for some reason the code for all of them are seemingly in this single repository, without even using Git submodules. Not sure what that’s about.&lt;br&gt;
Anyway, “go build”-ing the command line program (it’s written in Go) failed immediately because there’s some platform-specific code that just does not seem to recognize that NetBSD exists (but they do for FreeBSD and OpenBSD). Looks like the Keybase developers maintain a Golang wrapper around struct proc, which of course is different from OS to OS. So I literally just copypasted the OpenBSD wrapper, renamed it to “NetBSD”, and the build basically succeeded from there! This is of course super janky and untrustworthy, but it seems to Mostly Just Work…&lt;br&gt;
I forked the GitHub repo, you can see the diff on top of keybase 2.7.3 here: bccaaf3096a&lt;br&gt;
Eventually I ended up with a ~/go/bin/keybase which launches just fine. Meaning, I can main() okay. But the moment you try to do anything interesting, it looks super scary:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;charlotte@sakuracity:~/go/bin ./keybase login
▶ WARNING Running in devel mode
▶ INFO Forking background server with pid=12932
▶ ERROR unexpected error in Login: API network error: doRetry failed,
attempts: 1, timeout 5s, last err: Get
http://localhost:3000//api/1.0/merkle/path.json?last=3784314&amp;amp;loaddeleted=1&amp;amp;loadresetchain=1&amp;amp;poll=10&amp;amp;sighints_low=3&amp;amp;uid=38ae1dfa49cd6831ea2fdade5c5d0519:
dial tcp [::1]:3000: connect: connection refused
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;There’s a few things about this error message that stuck out to me:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Forking a background server? What?&lt;/li&gt;
&lt;li&gt;It’s trying to connect to localhost? That must be the server that doesn’t work …&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Unfortunately, this nonfunctional “background server” sticks around even when a command as simple as ‘login’ command just failed:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;charlotte@sakuracity:~/go/bin ps 12932
PID TTY STAT    TIME COMMAND
12932 ?   Ssl  0:00.21 ./keybase --debug --log-file
/home/charlotte/.cache/keybase.devel/keybase.service.log service --chdir
/home/charlotte/.config/keybase.devel --auto-forked 
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;I’m not exactly sure what the intended purpose of the “background server” even is, but fortunately we can kill it and even tell the keybase command to not even spawn one:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;charlotte@sakuracity:~/go/bin ./keybase help advanced | grep -- --standalone
--standalone                         Use the client without any daemon support.
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;And then we can fix wanting to connect to localhost by specifying an expected Keybase API server – how about the one hosted at &lt;a href="https://keybase.io"&gt;https://keybase.io&lt;/a&gt;?&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;charlotte@sakuracity:~/go/bin ./keybase help advanced | grep -- --server
--server, -s                         Specify server API.
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;Basically, what I’m trying to say is that if you specify both of these options, the keybase command does what I expect on NetBSD:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;charlotte@sakuracity:~/go/bin ./keybase --standalone -s https://keybase.io login
▶ WARNING Running in devel mode
Please enter the Keybase passphrase for dressupgeekout (6+ characters): 
charlotte@sakuracity:~/go/bin ./keybase --standalone -s https://keybase.io id dressupgeekout
▶ WARNING Running in devel mode
▶ INFO Identifying dressupgeekout
✔ public key fingerprint: 7873 DA50 A786 9A3F 1662 3A17 20BD 8739 E82C 7F2F
✔ "dressupgeekout" on github:
https://gist.github.com/0471c7918d254425835bf5e1b4bcda00 [cached 2018-10-11
20:55:21 PDT]
✔ "dressupgeekout" on reddit:
https://www.reddit.com/r/KeybaseProofs/comments/9ng5qm/mykeybaseproof_redditdressupgeekout/
[cached 2018-10-11 20:55:21 PDT]
&lt;/code&gt;&lt;/pre&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=339929"&gt;Initial implementation of draft-ietf-6man-ipv6only-flag&lt;/a&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;This change defines the RA "6" (IPv6-Only) flag which routers
may advertise, kernel logic to check if all routers on a link
have the flag set and accordingly update a per-interface flag.
If all routers agree that it is an IPv6-only link, etheroutputframe(),
based on the interface flag, will filter out all ETHERTYPE_IP/ARP
frames, drop them, and return EAFNOSUPPORT to upper layers.
The change also updates ndp to show the "6" flag, ifconfig to
display the IPV6_ONLY nd6 flag if set, and rtadvd to allow
announcing the flag.
Further changes to tcpdump (contrib code) are availble and will
be upstreamed.
Tested the code (slightly earlier version) with 2 FreeBSD
IPv6 routers, a FreeBSD laptop on ethernet as well as wifi,
and with Win10 and OSX clients (which did not fall over with
the "6" flag set but not understood).
We may also want to (a) implement and RX filter, and (b) over
time enahnce user space to, say, stop dhclient from running
when the interface flag is set.  Also we might want to start
IPv6 before IPv4 in the future.
All the code is hidden under the EXPERIMENTAL option and not
compiled by default as the draft is a work-in-progress and
we cannot rely on the fact that IANA will assign the bits
as requested by the draft and hence they may change.
Dear 6man, you have running code.
Discussed with: Bob Hinden, Brian E Carpenter
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://dan.langille.org/2018/10/02/running-freebsd-on-osx-using-xhyve-a-port-of-bhyve/"&gt;Running FreeBSD on macOS via xhyve&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mwl.io/archives/3841"&gt;Auction Winners&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/vedetta-com/vedetta/blob/master/src/usr/local/share/doc/vedetta/OpenSSH_Principals.md"&gt;OpenSSH Principals&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20181018160645"&gt;OpenBSD Foundation gets a second Iridium donation from Handshake&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mail-index.netbsd.org/netbsd-advocacy/2018/10/10/msg000786.html"&gt;NetBSD machines at Open Source Conference 2018 Kagawa&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mwl.io/archives/3818"&gt;Absolute FreeBSD now shipping!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://h3artbl33d.nl/blog/nextcloud-on-openbsd"&gt;NextCloud on OpenBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/newsflash.html#event20181027:01"&gt;FreeBSD 12.0-BETA2 Available&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/gvnn3/status/1049347862541344771"&gt;DTrace on Windows ported from FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://dpaste.com/36DFQ1S"&gt;HELBUG fall 2018 meeting scheduled - Thursday the 15th of November&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://translate.google.com/translate?hl=de&amp;amp;sl=de&amp;amp;tl=en&amp;amp;u=https%3A%2F%2Ftickets.events.ccc.de%2F35c3%2Fintro%2F"&gt;35C3 pre-sale has started&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/BSD-Users-Stockholm/events/254235663/"&gt;Stockholm BSD User Meeting: Tuesday Nov 13, 18:00 - 21:30  &lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://bsd-pl.org/en"&gt;Polish BSD User Group: Thursday Nov 15, 18:30 - 21:00 &lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Greg - &lt;a href="http://dpaste.com/1WA54CC"&gt;Interview suggestion for the show&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Nelson - &lt;a href="http://dpaste.com/21KKF7Q#wrap"&gt;Ghostscript vulnerabilities&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Allison - &lt;a href="http://dpaste.com/3K6D7ST"&gt;Ports and GCC&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd,openbsd,netbsd,dragonflybsd,trueos,trident,hardenedbsd,tutorial,howto,guide,bsd,interview,ghostbsd,keybase,openssh,openssl</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 6.4 released, GhostBSD RC2 released, MeetBSD - the ultimate hallway track, DragonflyBSD desktop on a Thinkpad, Porting keybase to NetBSD, OpenSSH 7.9, and draft-ietf-6man-ipv6only-flag in FreeBSD.</p>

<p>##Headlines<br>
###<a href="https://www.openbsd.org/64.html">OpenBSD 6.4 released</a></p>

<ul>
<li><a href="https://www.openbsd.org/plus64.html">See a detailed log of changes between the 6.3 and 6.4 releases.</a></li>
<li><a href="https://www.openbsd.org/ftp.html">See the information on the FTP page for a list of mirror machines.</a></li>
<li><a href="https://www.openbsd.org/errata64.html">Have a look at the 6.4 errata page for a list of bugs and workarounds.</a></li>
<li>signify(1) pubkeys for this release:</li>
<li>base: RWQq6XmS4eDAcQW4KsT5Ka0KwTQp2JMOP9V/DR4HTVOL5Bc0D7LeuPwA</li>
<li>fw:   RWRoBbjnosJ/39llpve1XaNIrrQND4knG+jSBeIUYU8x4WNkxz6a2K97</li>
<li>pkg:  RWRF5TTY+LoN/51QD5kM2hKDtMTzycQBBPmPYhyQEb1+4pff/H6fh/kA</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.ghostbsd.org/18.10_RC2_release_announcement">GhostBSD 18.10 RC2 Announced</a></p>

<blockquote>
<p>This second release candidate of GhostBSD 18.10 is the second official release of GhostBSD with TrueOS under the hood. The official desktop of GhostBSD is MATE. However, in the future, there might be an XFCE community release, but for now, there is no community release yet.</p>
</blockquote>

<ul>
<li>
<p>What has changed since RC1</p>
</li>
<li>
<p>Removed drm-stable-kmod and we will let users installed the propper drm-*-kmod</p>
</li>
<li>
<p>Douglas Joachin added libva-intel-driver libva-vdpau-driver  to supports accelerated some video driver for Intel</p>
</li>
<li>
<p>Issues that got fixed</p>
</li>
<li>
<p>Bug #70 Cannot run Octopi, missing libgksu error.</p>
</li>
<li>
<p>Bug #71 LibreOffice doesn’t start because of missing libcurl.so.4</p>
</li>
<li>
<p>Bug #72 libarchive is a missing dependency</p>
</li>
</ul>

<blockquote>
<p>Again thanks to iXsystems, TrueOS, Joe Maloney, Kris Moore, Ken Moore, Martin Wilke, Neville Goddard, Vester “Vic” Thacker, Douglas Joachim, Alex Lyakhov, Yetkin Degirmenci and many more who helped to make the transition from FreeBSD to TrueOS smoother.</p>
</blockquote>

<ul>
<li>
<p>Updating from RC1 to RC2:</p>
</li>
<li>
<p>sudo pkg update -f</p>
</li>
<li>
<p>sudo pkg install -f libarchive curl libgksu</p>
</li>
<li>
<p>sudo pkg upgrade</p>
</li>
<li>
<p>Where to download:</p>
</li>
<li>
<p>All images checksum, hybrid ISO(DVD, USB) and torrent are available here: <a href="https://www.ghostbsd.org/download">https://www.ghostbsd.org/download</a></p>
</li>
<li>
<p>[ScreenShots]</p>
</li>
<li>
<p><a href="https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-22-41.png">https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-22-41.png</a></p>
</li>
<li>
<p><a href="https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-27-26.png">https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-27-26.png</a></p>
</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.openssh.com/txt/release-7.9">OpenSSH 7.9 has been released and it has support for OpenSSL 1.1</a></p>

<pre><code>Changes since OpenSSH 7.8
=========================

This is primarily a bugfix release.

New Features
------------
 * ssh(1), sshd(8): allow most port numbers to be specified using
   service names from getservbyname(3) (typically /etc/services).
 * ssh(1): allow the IdentityAgent configuration directive to accept
   environment variable names. This supports the use of multiple
   agent sockets without needing to use fixed paths.
 * sshd(8): support signalling sessions via the SSH protocol.
   A limited subset of signals is supported and only for login or
   command sessions (i.e. not subsystems) that were not subject to
   a forced command via authorized_keys or sshd_config. bz#1424
 * ssh(1): support &quot;ssh -Q sig&quot; to list supported signature options.
   Also &quot;ssh -Q help&quot; to show the full set of supported queries.
 * ssh(1), sshd(8): add a CASignatureAlgorithms option for the
   client and server configs to allow control over which signature
   formats are allowed for CAs to sign certificates. For example,
   this allows banning CAs that sign certificates using the RSA-SHA1
   signature algorithm.
 * sshd(8), ssh-keygen(1): allow key revocation lists (KRLs) to
   revoke keys specified by SHA256 hash.
 * ssh-keygen(1): allow creation of key revocation lists directly
   from base64-encoded SHA256 fingerprints. This supports revoking
   keys using only the information contained in sshd(8)
   authentication log messages.

Bugfixes
--------

 * ssh(1), ssh-keygen(1): avoid spurious &quot;invalid format&quot; errors when
   attempting to load PEM private keys while using an incorrect
   passphrase. bz#2901
 * sshd(8): when a channel closed message is received from a client,
   close the stderr file descriptor at the same time stdout is
   closed. This avoids stuck processes if they were waiting for
   stderr to close and were insensitive to stdin/out closing. bz#2863
 * ssh(1): allow ForwardX11Timeout=0 to disable the untrusted X11
   forwarding timeout and support X11 forwarding indefinitely.
   Previously the behaviour of ForwardX11Timeout=0 was undefined.
 * sshd(8): when compiled with GSSAPI support, cache supported method
   OIDs regardless of whether GSSAPI authentication is enabled in the
   main section of sshd_config. This avoids sandbox violations if
   GSSAPI authentication was later enabled in a Match block. bz#2107
 * sshd(8): do not fail closed when configured with a text key
   revocation list that contains a too-short key. bz#2897
 * ssh(1): treat connections with ProxyJump specified the same as
   ones with a ProxyCommand set with regards to hostname
   canonicalisation (i.e. don't try to canonicalise the hostname
   unless CanonicalizeHostname is set to 'always'). bz#2896
 * ssh(1): fix regression in OpenSSH 7.8 that could prevent public-
   key authentication using certificates hosted in a ssh-agent(1)
   or against sshd(8) from OpenSSH &lt;7.8.

Portability
-----------

 * All: support building against the openssl-1.1 API (releases 1.1.0g
   and later). The openssl-1.0 API will remain supported at least
   until OpenSSL terminates security patch support for that API version.
 * sshd(8): allow the futex(2) syscall in the Linux seccomp sandbox;
   apparently required by some glibc/OpenSSL combinations.
 * sshd(8): handle getgrouplist(3) returning more than
   _SC_NGROUPS_MAX groups. Some platforms consider this limit more
   as a guideline.
</code></pre>

<p><hr></p>

<p>##News Roundup</p>

<p>###<a href="https://www.ixsystems.com/blog/meetbsd-2018/">MeetBSD 2018: The Ultimate Hallway Track</a></p>

<blockquote>
<p>Founded in Poland in 2007 and first hosted in California in 2008, MeetBSD combines formal talks with UnConference activities to provide a level of interactivity not found at any other BSD conference. The character of each MeetBSD is determined largely by its venue, ranging from Hacker Dojo in 2010 to Intel’s Santa Clara headquarters this year. The Intel SC12 building provided a beautiful auditorium and sponsors’ room, plus a cafeteria for the Friday night social event and the Saturday night FreeBSD 25th Anniversary Celebration. The formal nature of the auditorium motivated the formation of MeetBSD’s first independent Program Committee and public Call for Participation. Together these resulted in a backbone of talks presented by speakers from the USA, Canada, and Poland, combined with UnConference activities tailored to the space.</p>
</blockquote>

<ul>
<li>MeetBSD Day 0</li>
</ul>

<blockquote>
<p>Day Zero of MeetBSD was a FreeBSD Developer/Vendor Summit hosted in the same auditorium where the talks would take place. Like the conference itself, this event featured a mix of scheduled talks and interactive sessions. The scheduled talks were LWPMFS: LightWeight Persistent Memory Filesystem by Ravi Pokala, Evaluating GIT for FreeBSD by Ed Maste, and NUMA by Mark Johnston. Ed’s overview of the advantages and disadvantages of using Git for FreeBSD development was of the most interest to users and developers, and the discussion continued into the following two days.</p>
</blockquote>

<ul>
<li>MeetBSD Day 1</li>
</ul>

<blockquote>
<p>The first official day of MeetBSD 2018 was kicked off with introductions led by emcee JT Pennington and a keynote, “Using TrueOS to boot-strap your FreeBSD-based project” by Kris Moore. Kris described a new JSON-based release infrastructure that he has exercised with FreeBSD, TrueOS, and FreeNAS. Kris’ talk was followed by “Intel &amp; FreeBSD: Better Together” by Ben Widawsky, the FreeBSD program lead at Intel, who gave an overview of Intel’s past and current efforts supporting FreeBSD. Next came lunch, followed by Kamil Rytarowski’s “Bug detecting software in the NetBSD userland: MKSANITIZER”. This was followed by 5-Minute Lightning Talks, Andrew Fengler’s “FreeBSD: What to (Not) Monitor”, and an OpenZFS Panel Discussion featuring OpenZFS experts Michael W. Lucas, Allan Jude, Alexander Motin, Pawel Dawidek, and Dan Langille. Day one concluded with a social event at the Intel cafeteria where the discussions continued into the night.</p>
</blockquote>

<ul>
<li>MeetBSD Day 2</li>
</ul>

<blockquote>
<p>Day Two of MeetBSD 2018 kicked off with a keynote by Michael W. Lucas entitled “Why BSD?”, where Michael detailed what makes the BSD community different and why it attracts us all. This was followed by Dr. Kirk McKusick’s “The Early Days of BSD” talk, which was followed by “DTrace/dwatch in Production” by Devin Teske. After lunch, we enjoyed “A Curmudgeon’s Language Selection Criteria: Why I Don’t Write Everything in Go, Rust, Elixir, etc” by G. Clifford Williams and, “Best practices of sandboxing applications with Capsicum” by Mariusz Zaborski. I then hosted a Virtualization Panel Discussion that featured eight developers from FreeBSD, OpenBSD, and NetBSD. We then split up for Breakout Sessions and the one on Bloomberg’s controversial article on backdoored Supermicro systems was fascinating given the experts present, all of whom were skeptical of the feasibility of the attack. The day wrapped up with a final talk, “Tales of a Daemontown Performance Peddler: Why ‘it depends’ and what you can do about it” by Nick Principe, followed by the FreeBSD 25th Anniversary Celebration.</p>
</blockquote>

<ul>
<li>Putting the “meet” in MeetBSD</li>
</ul>

<blockquote>
<p>I confess the other organizers and I were nervous about how well one large auditorium would suit a BSD event but the flexible personal space it gave everyone allowed for countless meetings and heated hacking that often brought about immediate results. I watched people take ideas through several iterations with the help and input of obvious and unexpected experts, all of whom were within reach. Not having to pick up and leave for a talk in another room organically resulted in essentially a series of mini hackathons that none of us anticipated but were delighted to witness, taking the “hallway track” to a whole new level. The mix of formal and UnConference activities at MeetBSD is certain to evolve. Thank you to everyone who participated with questions, Lightning Talks, and Panel participation. A huge thanks to our sponsors, including Intel for both hosting and sponsoring MeetBSD California 2018, Western Digital, Supermicro, Verisign, Jupiter Broadcasting, the FreeBSD Foundation, Bank of America Merrill Lynch, the NetBSD Foundation, and the team at iXsystems.</p>
</blockquote>

<blockquote>
<p>See you at MeetBSD 2020!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://panoramacircle.com/2018/10/07/setup-dragonflybsd-with-a-desktop-on-real-hardware-thinkpad-t410/">Setup DragonflyBSD with a desktop on real hardware ThinkPad T410</a><br>
+<a href="https://youtu.be/p4KwssNY82Q">Video Demo</a></p>

<blockquote>
<p>Linux has become too mainstream and standard BSD is a common thing now? How about DragonflyBSD which was created as a fork of FreeBSD 4.8 in conflict over system internals. This tutorial will show how to install it and set up a user-oriented desktop. It should work with DragonflyBSD, FreeBSD and probably all BSDs.<br>
Some background: BSD was is ultimately derived from UNIX back in the days. It is not Linux even though it is similar in many ways because Linux was designed to follow UNIX principles. Seeing is believing, so check out the video of the install!<br>
I did try two BSD distros before called GhostBSD and TrueOS and you can check out my short reviews. DragonflyBSD comes like FreeBSD bare bones and requires some work to get a desktop running.</p>
</blockquote>

<ul>
<li>
<p>Download image file and burn to USB drive or DVD</p>
</li>
<li>
<p>First installation</p>
</li>
<li>
<p>Setting up the system and installing a desktop</p>
</li>
<li>
<p>Inside the desktop</p>
</li>
<li>
<p>Install some more programs</p>
</li>
<li>
<p>How to enable sound?</p>
</li>
<li>
<p>Let’s play some free games</p>
</li>
<li>
<p>Setup WiFi</p>
</li>
<li>
<p>Power mode settings</p>
</li>
<li>
<p>More to do?</p>
</li>
</ul>

<blockquote>
<p>You can check out this blog post if you want a much more detailed tutorial. If you don’t mind standard BSD, get the GhostBSD distro instead which comes with a ready-made desktop xcfe or mate and many functional presets.</p>
</blockquote>

<ul>
<li>
<p>A small summary of what we got on the upside:</p>
<ul>
<li>Free and open source operating system with a long history</li>
<li>Drivers worked fine including Ethernet, WiFi, video 2D &amp; 3D, audio, etc</li>
<li>Hammer2 advanced file system</li>
<li>You are very unique if you use this OS fork</li>
</ul>

<p></li><br>
<li></p>

<p>Some downsides:</p>

<p></li><br>
<li></p>

<p>Less driver and direct app support than Linux</p>

<p></li><br>
<li></p>

<p>Installer and desktop have some traps and quirks and require work</p>

<p></li><br>
</ul><br>
<hr></p>

<p>###<a href="https://dressupgeekout.blogspot.com/2018/10/porting-keybase-to-netbsd.html">Porting Keybase to NetBSD</a></p>

<blockquote>
<p>Keybase significantly simplifies the whole keypair/PGP thing and makes what is usually a confusing, difficult experience actually rather pleasant. At its heart is an open-source command line utility that does all of the heavy cryptographic lifting. But it’s also hooked up to the network of all other Keybase users, so you don’t have to work very hard to maintain big keychains. Pretty cool!<br>
So, this evening, I tried to get it to all work on NetBSD.<br>
The Keybase client code base is, in my opinion, not very well architected… there exist many different Keybase clients (command line apps, desktop apps, mobile apps) and for some reason the code for all of them are seemingly in this single repository, without even using Git submodules. Not sure what that’s about.<br>
Anyway, “go build”-ing the command line program (it’s written in Go) failed immediately because there’s some platform-specific code that just does not seem to recognize that NetBSD exists (but they do for FreeBSD and OpenBSD). Looks like the Keybase developers maintain a Golang wrapper around struct proc, which of course is different from OS to OS. So I literally just copypasted the OpenBSD wrapper, renamed it to “NetBSD”, and the build basically succeeded from there! This is of course super janky and untrustworthy, but it seems to Mostly Just Work…<br>
I forked the GitHub repo, you can see the diff on top of keybase 2.7.3 here: bccaaf3096a<br>
Eventually I ended up with a ~/go/bin/keybase which launches just fine. Meaning, I can main() okay. But the moment you try to do anything interesting, it looks super scary:</p>
</blockquote>

<pre><code>charlotte@sakuracity:~/go/bin ./keybase login
▶ WARNING Running in devel mode
▶ INFO Forking background server with pid=12932
▶ ERROR unexpected error in Login: API network error: doRetry failed,
attempts: 1, timeout 5s, last err: Get
http://localhost:3000/_/api/1.0/merkle/path.json?last=3784314&amp;load_deleted=1&amp;load_reset_chain=1&amp;poll=10&amp;sig_hints_low=3&amp;uid=38ae1dfa49cd6831ea2fdade5c5d0519:
dial tcp [::1]:3000: connect: connection refused
</code></pre>

<blockquote>
<p>There’s a few things about this error message that stuck out to me:</p>
</blockquote>

<ul>
<li>Forking a background server? What?</li>
<li>It’s trying to connect to localhost? That must be the server that doesn’t work …</li>
</ul>

<blockquote>
<p>Unfortunately, this nonfunctional “background server” sticks around even when a command as simple as ‘login’ command just failed:</p>
</blockquote>

<pre><code>charlotte@sakuracity:~/go/bin ps 12932
  PID TTY STAT    TIME COMMAND
  12932 ?   Ssl  0:00.21 ./keybase --debug --log-file
  /home/charlotte/.cache/keybase.devel/keybase.service.log service --chdir
  /home/charlotte/.config/keybase.devel --auto-forked 
</code></pre>

<blockquote>
<p>I’m not exactly sure what the intended purpose of the “background server” even is, but fortunately we can kill it and even tell the keybase command to not even spawn one:</p>
</blockquote>

<pre><code>charlotte@sakuracity:~/go/bin ./keybase help advanced | grep -- --standalone
   --standalone                         Use the client without any daemon support.
</code></pre>

<blockquote>
<p>And then we can fix wanting to connect to localhost by specifying an expected Keybase API server – how about the one hosted at <a href="https://keybase.io">https://keybase.io</a>?</p>
</blockquote>

<pre><code>charlotte@sakuracity:~/go/bin ./keybase help advanced | grep -- --server
   --server, -s                         Specify server API.
</code></pre>

<blockquote>
<p>Basically, what I’m trying to say is that if you specify both of these options, the keybase command does what I expect on NetBSD:</p>
</blockquote>

<pre><code>charlotte@sakuracity:~/go/bin ./keybase --standalone -s https://keybase.io login
▶ WARNING Running in devel mode
Please enter the Keybase passphrase for dressupgeekout (6+ characters): 

charlotte@sakuracity:~/go/bin ./keybase --standalone -s https://keybase.io id dressupgeekout
▶ WARNING Running in devel mode
▶ INFO Identifying dressupgeekout
✔ public key fingerprint: 7873 DA50 A786 9A3F 1662 3A17 20BD 8739 E82C 7F2F
✔ &quot;dressupgeekout&quot; on github:
https://gist.github.com/0471c7918d254425835bf5e1b4bcda00 [cached 2018-10-11
20:55:21 PDT]
✔ &quot;dressupgeekout&quot; on reddit:
https://www.reddit.com/r/KeybaseProofs/comments/9ng5qm/my_keybase_proof_redditdressupgeekout/
[cached 2018-10-11 20:55:21 PDT]
</code></pre>

<p><hr></p>

<p>###<a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=339929">Initial implementation of draft-ietf-6man-ipv6only-flag</a></p>

<pre><code>This change defines the RA &quot;6&quot; (IPv6-Only) flag which routers
may advertise, kernel logic to check if all routers on a link
have the flag set and accordingly update a per-interface flag.

If all routers agree that it is an IPv6-only link, ether_output_frame(),
based on the interface flag, will filter out all ETHERTYPE_IP/ARP
frames, drop them, and return EAFNOSUPPORT to upper layers.

The change also updates ndp to show the &quot;6&quot; flag, ifconfig to
display the IPV6_ONLY nd6 flag if set, and rtadvd to allow
announcing the flag.

Further changes to tcpdump (contrib code) are availble and will
be upstreamed.

Tested the code (slightly earlier version) with 2 FreeBSD
IPv6 routers, a FreeBSD laptop on ethernet as well as wifi,
and with Win10 and OSX clients (which did not fall over with
the &quot;6&quot; flag set but not understood).

We may also want to (a) implement and RX filter, and (b) over
time enahnce user space to, say, stop dhclient from running
when the interface flag is set.  Also we might want to start
IPv6 before IPv4 in the future.

All the code is hidden under the EXPERIMENTAL option and not
compiled by default as the draft is a work-in-progress and
we cannot rely on the fact that IANA will assign the bits
as requested by the draft and hence they may change.

Dear 6man, you have running code.

Discussed with: Bob Hinden, Brian E Carpenter
</code></pre>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://dan.langille.org/2018/10/02/running-freebsd-on-osx-using-xhyve-a-port-of-bhyve/">Running FreeBSD on macOS via xhyve</a></li>
<li><a href="https://mwl.io/archives/3841">Auction Winners</a></li>
<li><a href="https://github.com/vedetta-com/vedetta/blob/master/src/usr/local/share/doc/vedetta/OpenSSH_Principals.md">OpenSSH Principals</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20181018160645">OpenBSD Foundation gets a second Iridium donation from Handshake</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2018/10/10/msg000786.html">NetBSD machines at Open Source Conference 2018 Kagawa</a></li>
<li><a href="https://mwl.io/archives/3818">Absolute FreeBSD now shipping!</a></li>
<li><a href="https://h3artbl33d.nl/blog/nextcloud-on-openbsd">NextCloud on OpenBSD</a></li>
<li><a href="https://www.freebsd.org/news/newsflash.html#event20181027:01">FreeBSD 12.0-BETA2 Available</a></li>
<li><a href="https://twitter.com/gvnn3/status/1049347862541344771">DTrace on Windows ported from FreeBSD</a></li>
<li><a href="http://dpaste.com/36DFQ1S">HELBUG fall 2018 meeting scheduled - Thursday the 15th of November</a></li>
<li><a href="https://translate.google.com/translate?hl=de&amp;sl=de&amp;tl=en&amp;u=https%3A%2F%2Ftickets.events.ccc.de%2F35c3%2Fintro%2F">35C3 pre-sale has started</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/254235663/">Stockholm BSD User Meeting: Tuesday Nov 13, 18:00 - 21:30  </a></li>
<li><a href="https://bsd-pl.org/en">Polish BSD User Group: Thursday Nov 15, 18:30 - 21:00 </a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Greg - <a href="http://dpaste.com/1WA54CC">Interview suggestion for the show</a></li>
<li>Nelson - <a href="http://dpaste.com/21KKF7Q#wrap">Ghostscript vulnerabilities</a></li>
<li>Allison - <a href="http://dpaste.com/3K6D7ST">Ports and GCC</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 6.4 released, GhostBSD RC2 released, MeetBSD - the ultimate hallway track, DragonflyBSD desktop on a Thinkpad, Porting keybase to NetBSD, OpenSSH 7.9, and draft-ietf-6man-ipv6only-flag in FreeBSD.</p>

<p>##Headlines<br>
###<a href="https://www.openbsd.org/64.html">OpenBSD 6.4 released</a></p>

<ul>
<li><a href="https://www.openbsd.org/plus64.html">See a detailed log of changes between the 6.3 and 6.4 releases.</a></li>
<li><a href="https://www.openbsd.org/ftp.html">See the information on the FTP page for a list of mirror machines.</a></li>
<li><a href="https://www.openbsd.org/errata64.html">Have a look at the 6.4 errata page for a list of bugs and workarounds.</a></li>
<li>signify(1) pubkeys for this release:</li>
<li>base: RWQq6XmS4eDAcQW4KsT5Ka0KwTQp2JMOP9V/DR4HTVOL5Bc0D7LeuPwA</li>
<li>fw:   RWRoBbjnosJ/39llpve1XaNIrrQND4knG+jSBeIUYU8x4WNkxz6a2K97</li>
<li>pkg:  RWRF5TTY+LoN/51QD5kM2hKDtMTzycQBBPmPYhyQEb1+4pff/H6fh/kA</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.ghostbsd.org/18.10_RC2_release_announcement">GhostBSD 18.10 RC2 Announced</a></p>

<blockquote>
<p>This second release candidate of GhostBSD 18.10 is the second official release of GhostBSD with TrueOS under the hood. The official desktop of GhostBSD is MATE. However, in the future, there might be an XFCE community release, but for now, there is no community release yet.</p>
</blockquote>

<ul>
<li>
<p>What has changed since RC1</p>
</li>
<li>
<p>Removed drm-stable-kmod and we will let users installed the propper drm-*-kmod</p>
</li>
<li>
<p>Douglas Joachin added libva-intel-driver libva-vdpau-driver  to supports accelerated some video driver for Intel</p>
</li>
<li>
<p>Issues that got fixed</p>
</li>
<li>
<p>Bug #70 Cannot run Octopi, missing libgksu error.</p>
</li>
<li>
<p>Bug #71 LibreOffice doesn’t start because of missing libcurl.so.4</p>
</li>
<li>
<p>Bug #72 libarchive is a missing dependency</p>
</li>
</ul>

<blockquote>
<p>Again thanks to iXsystems, TrueOS, Joe Maloney, Kris Moore, Ken Moore, Martin Wilke, Neville Goddard, Vester “Vic” Thacker, Douglas Joachim, Alex Lyakhov, Yetkin Degirmenci and many more who helped to make the transition from FreeBSD to TrueOS smoother.</p>
</blockquote>

<ul>
<li>
<p>Updating from RC1 to RC2:</p>
</li>
<li>
<p>sudo pkg update -f</p>
</li>
<li>
<p>sudo pkg install -f libarchive curl libgksu</p>
</li>
<li>
<p>sudo pkg upgrade</p>
</li>
<li>
<p>Where to download:</p>
</li>
<li>
<p>All images checksum, hybrid ISO(DVD, USB) and torrent are available here: <a href="https://www.ghostbsd.org/download">https://www.ghostbsd.org/download</a></p>
</li>
<li>
<p>[ScreenShots]</p>
</li>
<li>
<p><a href="https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-22-41.png">https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-22-41.png</a></p>
</li>
<li>
<p><a href="https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-27-26.png">https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-27-26.png</a></p>
</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.openssh.com/txt/release-7.9">OpenSSH 7.9 has been released and it has support for OpenSSL 1.1</a></p>

<pre><code>Changes since OpenSSH 7.8
=========================

This is primarily a bugfix release.

New Features
------------
 * ssh(1), sshd(8): allow most port numbers to be specified using
   service names from getservbyname(3) (typically /etc/services).
 * ssh(1): allow the IdentityAgent configuration directive to accept
   environment variable names. This supports the use of multiple
   agent sockets without needing to use fixed paths.
 * sshd(8): support signalling sessions via the SSH protocol.
   A limited subset of signals is supported and only for login or
   command sessions (i.e. not subsystems) that were not subject to
   a forced command via authorized_keys or sshd_config. bz#1424
 * ssh(1): support &quot;ssh -Q sig&quot; to list supported signature options.
   Also &quot;ssh -Q help&quot; to show the full set of supported queries.
 * ssh(1), sshd(8): add a CASignatureAlgorithms option for the
   client and server configs to allow control over which signature
   formats are allowed for CAs to sign certificates. For example,
   this allows banning CAs that sign certificates using the RSA-SHA1
   signature algorithm.
 * sshd(8), ssh-keygen(1): allow key revocation lists (KRLs) to
   revoke keys specified by SHA256 hash.
 * ssh-keygen(1): allow creation of key revocation lists directly
   from base64-encoded SHA256 fingerprints. This supports revoking
   keys using only the information contained in sshd(8)
   authentication log messages.

Bugfixes
--------

 * ssh(1), ssh-keygen(1): avoid spurious &quot;invalid format&quot; errors when
   attempting to load PEM private keys while using an incorrect
   passphrase. bz#2901
 * sshd(8): when a channel closed message is received from a client,
   close the stderr file descriptor at the same time stdout is
   closed. This avoids stuck processes if they were waiting for
   stderr to close and were insensitive to stdin/out closing. bz#2863
 * ssh(1): allow ForwardX11Timeout=0 to disable the untrusted X11
   forwarding timeout and support X11 forwarding indefinitely.
   Previously the behaviour of ForwardX11Timeout=0 was undefined.
 * sshd(8): when compiled with GSSAPI support, cache supported method
   OIDs regardless of whether GSSAPI authentication is enabled in the
   main section of sshd_config. This avoids sandbox violations if
   GSSAPI authentication was later enabled in a Match block. bz#2107
 * sshd(8): do not fail closed when configured with a text key
   revocation list that contains a too-short key. bz#2897
 * ssh(1): treat connections with ProxyJump specified the same as
   ones with a ProxyCommand set with regards to hostname
   canonicalisation (i.e. don't try to canonicalise the hostname
   unless CanonicalizeHostname is set to 'always'). bz#2896
 * ssh(1): fix regression in OpenSSH 7.8 that could prevent public-
   key authentication using certificates hosted in a ssh-agent(1)
   or against sshd(8) from OpenSSH &lt;7.8.

Portability
-----------

 * All: support building against the openssl-1.1 API (releases 1.1.0g
   and later). The openssl-1.0 API will remain supported at least
   until OpenSSL terminates security patch support for that API version.
 * sshd(8): allow the futex(2) syscall in the Linux seccomp sandbox;
   apparently required by some glibc/OpenSSL combinations.
 * sshd(8): handle getgrouplist(3) returning more than
   _SC_NGROUPS_MAX groups. Some platforms consider this limit more
   as a guideline.
</code></pre>

<p><hr></p>

<p>##News Roundup</p>

<p>###<a href="https://www.ixsystems.com/blog/meetbsd-2018/">MeetBSD 2018: The Ultimate Hallway Track</a></p>

<blockquote>
<p>Founded in Poland in 2007 and first hosted in California in 2008, MeetBSD combines formal talks with UnConference activities to provide a level of interactivity not found at any other BSD conference. The character of each MeetBSD is determined largely by its venue, ranging from Hacker Dojo in 2010 to Intel’s Santa Clara headquarters this year. The Intel SC12 building provided a beautiful auditorium and sponsors’ room, plus a cafeteria for the Friday night social event and the Saturday night FreeBSD 25th Anniversary Celebration. The formal nature of the auditorium motivated the formation of MeetBSD’s first independent Program Committee and public Call for Participation. Together these resulted in a backbone of talks presented by speakers from the USA, Canada, and Poland, combined with UnConference activities tailored to the space.</p>
</blockquote>

<ul>
<li>MeetBSD Day 0</li>
</ul>

<blockquote>
<p>Day Zero of MeetBSD was a FreeBSD Developer/Vendor Summit hosted in the same auditorium where the talks would take place. Like the conference itself, this event featured a mix of scheduled talks and interactive sessions. The scheduled talks were LWPMFS: LightWeight Persistent Memory Filesystem by Ravi Pokala, Evaluating GIT for FreeBSD by Ed Maste, and NUMA by Mark Johnston. Ed’s overview of the advantages and disadvantages of using Git for FreeBSD development was of the most interest to users and developers, and the discussion continued into the following two days.</p>
</blockquote>

<ul>
<li>MeetBSD Day 1</li>
</ul>

<blockquote>
<p>The first official day of MeetBSD 2018 was kicked off with introductions led by emcee JT Pennington and a keynote, “Using TrueOS to boot-strap your FreeBSD-based project” by Kris Moore. Kris described a new JSON-based release infrastructure that he has exercised with FreeBSD, TrueOS, and FreeNAS. Kris’ talk was followed by “Intel &amp; FreeBSD: Better Together” by Ben Widawsky, the FreeBSD program lead at Intel, who gave an overview of Intel’s past and current efforts supporting FreeBSD. Next came lunch, followed by Kamil Rytarowski’s “Bug detecting software in the NetBSD userland: MKSANITIZER”. This was followed by 5-Minute Lightning Talks, Andrew Fengler’s “FreeBSD: What to (Not) Monitor”, and an OpenZFS Panel Discussion featuring OpenZFS experts Michael W. Lucas, Allan Jude, Alexander Motin, Pawel Dawidek, and Dan Langille. Day one concluded with a social event at the Intel cafeteria where the discussions continued into the night.</p>
</blockquote>

<ul>
<li>MeetBSD Day 2</li>
</ul>

<blockquote>
<p>Day Two of MeetBSD 2018 kicked off with a keynote by Michael W. Lucas entitled “Why BSD?”, where Michael detailed what makes the BSD community different and why it attracts us all. This was followed by Dr. Kirk McKusick’s “The Early Days of BSD” talk, which was followed by “DTrace/dwatch in Production” by Devin Teske. After lunch, we enjoyed “A Curmudgeon’s Language Selection Criteria: Why I Don’t Write Everything in Go, Rust, Elixir, etc” by G. Clifford Williams and, “Best practices of sandboxing applications with Capsicum” by Mariusz Zaborski. I then hosted a Virtualization Panel Discussion that featured eight developers from FreeBSD, OpenBSD, and NetBSD. We then split up for Breakout Sessions and the one on Bloomberg’s controversial article on backdoored Supermicro systems was fascinating given the experts present, all of whom were skeptical of the feasibility of the attack. The day wrapped up with a final talk, “Tales of a Daemontown Performance Peddler: Why ‘it depends’ and what you can do about it” by Nick Principe, followed by the FreeBSD 25th Anniversary Celebration.</p>
</blockquote>

<ul>
<li>Putting the “meet” in MeetBSD</li>
</ul>

<blockquote>
<p>I confess the other organizers and I were nervous about how well one large auditorium would suit a BSD event but the flexible personal space it gave everyone allowed for countless meetings and heated hacking that often brought about immediate results. I watched people take ideas through several iterations with the help and input of obvious and unexpected experts, all of whom were within reach. Not having to pick up and leave for a talk in another room organically resulted in essentially a series of mini hackathons that none of us anticipated but were delighted to witness, taking the “hallway track” to a whole new level. The mix of formal and UnConference activities at MeetBSD is certain to evolve. Thank you to everyone who participated with questions, Lightning Talks, and Panel participation. A huge thanks to our sponsors, including Intel for both hosting and sponsoring MeetBSD California 2018, Western Digital, Supermicro, Verisign, Jupiter Broadcasting, the FreeBSD Foundation, Bank of America Merrill Lynch, the NetBSD Foundation, and the team at iXsystems.</p>
</blockquote>

<blockquote>
<p>See you at MeetBSD 2020!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://panoramacircle.com/2018/10/07/setup-dragonflybsd-with-a-desktop-on-real-hardware-thinkpad-t410/">Setup DragonflyBSD with a desktop on real hardware ThinkPad T410</a><br>
+<a href="https://youtu.be/p4KwssNY82Q">Video Demo</a></p>

<blockquote>
<p>Linux has become too mainstream and standard BSD is a common thing now? How about DragonflyBSD which was created as a fork of FreeBSD 4.8 in conflict over system internals. This tutorial will show how to install it and set up a user-oriented desktop. It should work with DragonflyBSD, FreeBSD and probably all BSDs.<br>
Some background: BSD was is ultimately derived from UNIX back in the days. It is not Linux even though it is similar in many ways because Linux was designed to follow UNIX principles. Seeing is believing, so check out the video of the install!<br>
I did try two BSD distros before called GhostBSD and TrueOS and you can check out my short reviews. DragonflyBSD comes like FreeBSD bare bones and requires some work to get a desktop running.</p>
</blockquote>

<ul>
<li>
<p>Download image file and burn to USB drive or DVD</p>
</li>
<li>
<p>First installation</p>
</li>
<li>
<p>Setting up the system and installing a desktop</p>
</li>
<li>
<p>Inside the desktop</p>
</li>
<li>
<p>Install some more programs</p>
</li>
<li>
<p>How to enable sound?</p>
</li>
<li>
<p>Let’s play some free games</p>
</li>
<li>
<p>Setup WiFi</p>
</li>
<li>
<p>Power mode settings</p>
</li>
<li>
<p>More to do?</p>
</li>
</ul>

<blockquote>
<p>You can check out this blog post if you want a much more detailed tutorial. If you don’t mind standard BSD, get the GhostBSD distro instead which comes with a ready-made desktop xcfe or mate and many functional presets.</p>
</blockquote>

<ul>
<li>
<p>A small summary of what we got on the upside:</p>
<ul>
<li>Free and open source operating system with a long history</li>
<li>Drivers worked fine including Ethernet, WiFi, video 2D &amp; 3D, audio, etc</li>
<li>Hammer2 advanced file system</li>
<li>You are very unique if you use this OS fork</li>
</ul>

<p></li><br>
<li></p>

<p>Some downsides:</p>

<p></li><br>
<li></p>

<p>Less driver and direct app support than Linux</p>

<p></li><br>
<li></p>

<p>Installer and desktop have some traps and quirks and require work</p>

<p></li><br>
</ul><br>
<hr></p>

<p>###<a href="https://dressupgeekout.blogspot.com/2018/10/porting-keybase-to-netbsd.html">Porting Keybase to NetBSD</a></p>

<blockquote>
<p>Keybase significantly simplifies the whole keypair/PGP thing and makes what is usually a confusing, difficult experience actually rather pleasant. At its heart is an open-source command line utility that does all of the heavy cryptographic lifting. But it’s also hooked up to the network of all other Keybase users, so you don’t have to work very hard to maintain big keychains. Pretty cool!<br>
So, this evening, I tried to get it to all work on NetBSD.<br>
The Keybase client code base is, in my opinion, not very well architected… there exist many different Keybase clients (command line apps, desktop apps, mobile apps) and for some reason the code for all of them are seemingly in this single repository, without even using Git submodules. Not sure what that’s about.<br>
Anyway, “go build”-ing the command line program (it’s written in Go) failed immediately because there’s some platform-specific code that just does not seem to recognize that NetBSD exists (but they do for FreeBSD and OpenBSD). Looks like the Keybase developers maintain a Golang wrapper around struct proc, which of course is different from OS to OS. So I literally just copypasted the OpenBSD wrapper, renamed it to “NetBSD”, and the build basically succeeded from there! This is of course super janky and untrustworthy, but it seems to Mostly Just Work…<br>
I forked the GitHub repo, you can see the diff on top of keybase 2.7.3 here: bccaaf3096a<br>
Eventually I ended up with a ~/go/bin/keybase which launches just fine. Meaning, I can main() okay. But the moment you try to do anything interesting, it looks super scary:</p>
</blockquote>

<pre><code>charlotte@sakuracity:~/go/bin ./keybase login
▶ WARNING Running in devel mode
▶ INFO Forking background server with pid=12932
▶ ERROR unexpected error in Login: API network error: doRetry failed,
attempts: 1, timeout 5s, last err: Get
http://localhost:3000/_/api/1.0/merkle/path.json?last=3784314&amp;load_deleted=1&amp;load_reset_chain=1&amp;poll=10&amp;sig_hints_low=3&amp;uid=38ae1dfa49cd6831ea2fdade5c5d0519:
dial tcp [::1]:3000: connect: connection refused
</code></pre>

<blockquote>
<p>There’s a few things about this error message that stuck out to me:</p>
</blockquote>

<ul>
<li>Forking a background server? What?</li>
<li>It’s trying to connect to localhost? That must be the server that doesn’t work …</li>
</ul>

<blockquote>
<p>Unfortunately, this nonfunctional “background server” sticks around even when a command as simple as ‘login’ command just failed:</p>
</blockquote>

<pre><code>charlotte@sakuracity:~/go/bin ps 12932
  PID TTY STAT    TIME COMMAND
  12932 ?   Ssl  0:00.21 ./keybase --debug --log-file
  /home/charlotte/.cache/keybase.devel/keybase.service.log service --chdir
  /home/charlotte/.config/keybase.devel --auto-forked 
</code></pre>

<blockquote>
<p>I’m not exactly sure what the intended purpose of the “background server” even is, but fortunately we can kill it and even tell the keybase command to not even spawn one:</p>
</blockquote>

<pre><code>charlotte@sakuracity:~/go/bin ./keybase help advanced | grep -- --standalone
   --standalone                         Use the client without any daemon support.
</code></pre>

<blockquote>
<p>And then we can fix wanting to connect to localhost by specifying an expected Keybase API server – how about the one hosted at <a href="https://keybase.io">https://keybase.io</a>?</p>
</blockquote>

<pre><code>charlotte@sakuracity:~/go/bin ./keybase help advanced | grep -- --server
   --server, -s                         Specify server API.
</code></pre>

<blockquote>
<p>Basically, what I’m trying to say is that if you specify both of these options, the keybase command does what I expect on NetBSD:</p>
</blockquote>

<pre><code>charlotte@sakuracity:~/go/bin ./keybase --standalone -s https://keybase.io login
▶ WARNING Running in devel mode
Please enter the Keybase passphrase for dressupgeekout (6+ characters): 

charlotte@sakuracity:~/go/bin ./keybase --standalone -s https://keybase.io id dressupgeekout
▶ WARNING Running in devel mode
▶ INFO Identifying dressupgeekout
✔ public key fingerprint: 7873 DA50 A786 9A3F 1662 3A17 20BD 8739 E82C 7F2F
✔ &quot;dressupgeekout&quot; on github:
https://gist.github.com/0471c7918d254425835bf5e1b4bcda00 [cached 2018-10-11
20:55:21 PDT]
✔ &quot;dressupgeekout&quot; on reddit:
https://www.reddit.com/r/KeybaseProofs/comments/9ng5qm/my_keybase_proof_redditdressupgeekout/
[cached 2018-10-11 20:55:21 PDT]
</code></pre>

<p><hr></p>

<p>###<a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=339929">Initial implementation of draft-ietf-6man-ipv6only-flag</a></p>

<pre><code>This change defines the RA &quot;6&quot; (IPv6-Only) flag which routers
may advertise, kernel logic to check if all routers on a link
have the flag set and accordingly update a per-interface flag.

If all routers agree that it is an IPv6-only link, ether_output_frame(),
based on the interface flag, will filter out all ETHERTYPE_IP/ARP
frames, drop them, and return EAFNOSUPPORT to upper layers.

The change also updates ndp to show the &quot;6&quot; flag, ifconfig to
display the IPV6_ONLY nd6 flag if set, and rtadvd to allow
announcing the flag.

Further changes to tcpdump (contrib code) are availble and will
be upstreamed.

Tested the code (slightly earlier version) with 2 FreeBSD
IPv6 routers, a FreeBSD laptop on ethernet as well as wifi,
and with Win10 and OSX clients (which did not fall over with
the &quot;6&quot; flag set but not understood).

We may also want to (a) implement and RX filter, and (b) over
time enahnce user space to, say, stop dhclient from running
when the interface flag is set.  Also we might want to start
IPv6 before IPv4 in the future.

All the code is hidden under the EXPERIMENTAL option and not
compiled by default as the draft is a work-in-progress and
we cannot rely on the fact that IANA will assign the bits
as requested by the draft and hence they may change.

Dear 6man, you have running code.

Discussed with: Bob Hinden, Brian E Carpenter
</code></pre>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://dan.langille.org/2018/10/02/running-freebsd-on-osx-using-xhyve-a-port-of-bhyve/">Running FreeBSD on macOS via xhyve</a></li>
<li><a href="https://mwl.io/archives/3841">Auction Winners</a></li>
<li><a href="https://github.com/vedetta-com/vedetta/blob/master/src/usr/local/share/doc/vedetta/OpenSSH_Principals.md">OpenSSH Principals</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20181018160645">OpenBSD Foundation gets a second Iridium donation from Handshake</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2018/10/10/msg000786.html">NetBSD machines at Open Source Conference 2018 Kagawa</a></li>
<li><a href="https://mwl.io/archives/3818">Absolute FreeBSD now shipping!</a></li>
<li><a href="https://h3artbl33d.nl/blog/nextcloud-on-openbsd">NextCloud on OpenBSD</a></li>
<li><a href="https://www.freebsd.org/news/newsflash.html#event20181027:01">FreeBSD 12.0-BETA2 Available</a></li>
<li><a href="https://twitter.com/gvnn3/status/1049347862541344771">DTrace on Windows ported from FreeBSD</a></li>
<li><a href="http://dpaste.com/36DFQ1S">HELBUG fall 2018 meeting scheduled - Thursday the 15th of November</a></li>
<li><a href="https://translate.google.com/translate?hl=de&amp;sl=de&amp;tl=en&amp;u=https%3A%2F%2Ftickets.events.ccc.de%2F35c3%2Fintro%2F">35C3 pre-sale has started</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/254235663/">Stockholm BSD User Meeting: Tuesday Nov 13, 18:00 - 21:30  </a></li>
<li><a href="https://bsd-pl.org/en">Polish BSD User Group: Thursday Nov 15, 18:30 - 21:00 </a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Greg - <a href="http://dpaste.com/1WA54CC">Interview suggestion for the show</a></li>
<li>Nelson - <a href="http://dpaste.com/21KKF7Q#wrap">Ghostscript vulnerabilities</a></li>
<li>Allison - <a href="http://dpaste.com/3K6D7ST">Ports and GCC</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 269: Tiny Daemon Lib | BSD Now 269</title>
  <link>https://www.bsdnow.tv/269</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2747</guid>
  <pubDate>Wed, 24 Oct 2018 05:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5cd889a3-fdea-4394-a3e4-69aaa37d9ee0.mp3" length="53176544" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Foundation September Update, tiny C lib for programming Unix daemons, EuroBSDcon trip reports, GhostBSD tested on real hardware, and a BSD auth module for duress.</itunes:subtitle>
  <itunes:duration>1:28:19</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Foundation September Update, tiny C lib for programming Unix daemons, EuroBSDcon trip reports, GhostBSD tested on real hardware, and a BSD auth module for duress.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-september-2018/"&gt;FreeBSD Foundation Update, September 2018&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;MESSAGE FROM THE EXECUTIVE DIRECTOR&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Dear FreeBSD Community Member, It is hard to believe that September is over. The Foundation team had a busy month promoting FreeBSD all over the globe, bug fixing in preparation for 12.0, and setting plans in motion to kick off our 4th quarter fundraising and advocacy efforts. Take a minute to see what we’ve been up to and please consider making a donation to help us continue our efforts supporting FreeBSD!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;September 2018 Development Projects Update&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;In preparation for the release of FreeBSD 12.0, I have been working on investigating and fixing a backlog of kernel bug reports.  Of course, this kind of work is never finished, and we will continue to make progress after the release.  In the past couple of months I have fixed a combination of long-standing issues and recent regressions.  Of note are a pair of UNIX domain socket bugs which had been affecting various applications for years.  In particular, Chromium tabs would frequently hang unless a workaround was manually applied to the system, and the bug had started affecting recent versions of Firefox as well.  Fixing these issues gave me an opportunity to revisit and extend our regression testing for UNIX sockets, which, in turn, resulted in some related bugs being identified and fixed.&lt;br&gt;
Of late I have also been investigating reports of issues with ZFS, particularly, those reported on FreeBSD 11.2.  A number of regressions, including a kernel memory leak and issues with ARC reclamation, have already been fixed for 12.0; investigation of other reports is ongoing. Those who closely follow FreeBSD-CURRENT know that some exciting work to improve memory usage on NUMA systems is now enabled by default.  As is usually the case when new code is deployed in a diverse array of systems and workloads, a number of problems since have been identified. We are working on resolving them as soon as possible to ensure the quality of the release.&lt;br&gt;
I’m passionate about maintaining FreeBSD’s stability and dependability as it continues to expand and grow new features, and I’m grateful to the FreeBSD Foundation for sponsoring this work.  We depend on users to report problems to the mailing lists and via the bug tracker, so please try running the 12.0 candidate builds and help us make 12.0 a great release.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Fundraising Update: Supporting the Project&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;It’s officially Fall here at Foundation headquarters and we’re heading full-steam into our final fundraising campaign of the year. We couldn’t even have begun to reach our funding goal of $1.25 million dollars without the support from the companies who have partnered with us this year. Thank you to Verisign for becoming a Silver Partner. They now join a growing list of companies like Xiplink, NetApp, Microsoft, Tarsnap, VMware, and NeoSmart Technologies that are stepping up and showing their commitment to FreeBSD!&lt;br&gt;
Funding from commercial users like these and individual users like yourself, help us continue our efforts of supporting critical areas of FreeBSD such as:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Operating System Improvements: Providing staff to immediately respond to urgent problems and implement new features and functionality allowing for the innovation and stability you’ve come to rely on.&lt;/li&gt;
&lt;li&gt;Security: Providing engineering resources to bolster the capacity and responsiveness of the Security team providing your users with piece of mind when security issues arise.&lt;/li&gt;
&lt;li&gt;Release Engineering: Continue providing a full-time release engineer, resulting in timely and reliable releases you can plan around.&lt;/li&gt;
&lt;li&gt;Quality Assurance: Improving and increasing test coverage, continuous integration, and automated testing with a full-time software engineer to ensure you receive the highest quality, secure, and reliable operating system.&lt;/li&gt;
&lt;li&gt;New User Experience: Improving the process and documentation for getting new people involved with FreeBSD, and supporting those people as they become integrated into the FreeBSD Community providing the resources you may need to get new folks up to speed.&lt;/li&gt;
&lt;li&gt;Training: Supporting more FreeBSD training for undergraduates, graduates, and postgraduates. Growing the community means reaching people and catching their interest in systems software as early as possible and providing you with a bigger pool of candidates with the FreeBSD skills you’re looking for.&lt;/li&gt;
&lt;li&gt;Face-to-Face Opportunities: Facilitating collaboration among members of the community, and building connections throughout the industry to support a healthy and growing ecosystem and make it easier for you to find resources when questions emerge .&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;We can continue the above work, if we meet our goal this year!&lt;br&gt;
If your company uses FreeBSD, please consider joining our growing list of 2018 partners. If you haven’t made your donation yet, please consider donating today. We are indebted to the individual donors, and companies listed above who have already shown their commitment to open source.&lt;br&gt;
Thank you for supporting FreeBSD and the Foundation!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;September 2018 Release Engineering Update&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The FreeBSD Release Engineering team continued working on the upcoming 12.0 RELEASE.  At present, the 12.0 schedule had been adjusted by one week to allow for necessary works-in-progress to be completed.&lt;br&gt;
Of note, one of the works-in-progress includes updating OpenSSL from 1.0.2 to 1.1.1, in order to avoid breaking the application binary interface (ABI) on an established stable branch.&lt;br&gt;
Due to the level of non-trivial intrusiveness that had already been discovered and addressed in a project branch of the repository, it is possible (but not yet definite) that the schedule will need to be adjusted by another week to allow more time for larger and related updates for this particular update.&lt;br&gt;
Should the 12.0-RELEASE schedule need to be adjusted at any time during the release cycle, the schedule on the FreeBSD project website will be updated accordingly.  The current schedule is available at:&lt;br&gt;
&lt;a href="https://www.freebsd.org/releases/12.0R/schedule.html"&gt;https://www.freebsd.org/releases/12.0R/schedule.html&lt;/a&gt;&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;BSDCam 2018 Trip Report: Marie Helene Kvello-Aune&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I’d like to start by thanking the FreeBSD Foundation for sponsoring my trip to BSDCam(bridge) 2018. I wouldn’t have managed to attend otherwise. I’ve used FreeBSD in both personal and professional deployments since the year 2000, and over the last few years I have become more involved with development and documentation.&lt;br&gt;
I arrived in Gatwick, London at midnight. On Monday, August 13,  I took the train to Cambridge, and decided to do some touristy activities as I walked from the train station to Churchill College. I ran into Allan outside the hotel right before the sky decided it was time for a heavy rainfall. Monday was mostly spent settling in, recouping after travel, and hanging out with Allan, Brad, Will and Andy later in the afternoon/evening. Read more…&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Continuous Integration Update&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The FreeBSD Foundation has sponsored the development of the Project’s continuous integration system, available at &lt;a href="https://ci.FreeBSD.org"&gt;https://ci.FreeBSD.org&lt;/a&gt;, since June. Over the summer, we improved both the software and hardware infrastructure, and also added some new jobs for extending test coverage of the -CURRENT and -STABLE branches. Following are some highlights.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;New Hardware&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The Foundation purchased 4 new build machines for scaling up the computation power for the various test jobs. These newer, faster machines substantially speed up the time it takes to test amd64 builds, so that failing changes can be identified more quickly. Also, in August, we received a donation of 2 PINE A64-LTS boards from &lt;a href="http://PINE64.org"&gt;PINE64.org&lt;/a&gt;, which will be put in the hardware test lab as one part of the continuous tests.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;CI Staging Environment&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;We used hardware from a previous generation CI system to build a staging environment for the CI infrastructure, which is available at&lt;br&gt;
&lt;a href="https://ci-dev.freebsd.org"&gt;https://ci-dev.freebsd.org&lt;/a&gt;. It executes the configurations and scripts from the “staging” branch of the FreeBSD-CI repository, and the development feature branches. We also use it to experiment with the new version of the jenkins server and plugins. Having a staging environment avoids affecting the production CI environment, reducing downtime.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Mail Notification&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;In July, we turned on failure notification for all the kernel and world build jobs. Committers will receive email containing the build information and failure log to inform them of possible problems with their modification on certain architectures. For amd64 of the -CURRENT branch, we also enabled the notification on failing regression test cases. Currently mail is sent only to the individual committers, but with help from postmaster team, we have created a dev-ci mailing list and will soon be also sending notifications there.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;New Test Job&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;In August, we updated the embedded script of the virtual machine image. Originally it only executed pre-defined tests, but now this behavior can be modified by the data on the attached disk. This mechanism is used for adding new ZFS tests jobs. We are also working on analyzing and fixing the failing and skipped test cases.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Work in Progress&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;In August and September, we had two developer summits, one in Cambridge, UK and one in Bucharest, Romania. In these meetings, we discussed running special tests, such as ztest,  which need a longer run time. We also planned the network testing for TCP/IP stack&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://chaoticlab.io/c/c++/unix/2018/10/01/daemonize.html"&gt;Daemonize - a Tiny C Library for Programming the UNIX Daemons&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Whatever they say, writing System-V style UNIX daemons is hard. One has to follow many rules to make a daemon process behave correctly on diverse UNIX flavours. Moreover, debugging such a code might be somewhat tricky. On the other hand, the process of daemon initialisation is rigid and well defined so the corresponding code has to be written and debugged once and later can be reused countless number of times.&lt;br&gt;
Developers of BSD UNIX were very aware of this, as there a C library function daemon() was available starting from version 4.4. The function, although non-standard, is present on many UNIXes. Unfortunately, it does not follow all the required steps to reliably run a process in the background on systems which follow System-V semantics (e.g. Linux). The details are available at the corresponding Linux man page. The main problem here, as I understand it, is that daemon() does not use the double-forking technique to avoid the situation when zombie processes appear.&lt;br&gt;
Whenever I encounter a problem like this one, I know it is time to write a tiny C library which solves it. This is exactly how ‘daemonize’ was born (GitHub mirror). The library consists of only two files which are meant to be integrated into the source tree of your project. Recently I have updated the library and realised that it would be good to describe how to use it on this site.&lt;br&gt;
If for some reason you want to make a Windows service, I have a battle tested template code for you as well.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;System-V Daemon Initialisation Procedure&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;To make discussion clear we shall quote the steps which have to be performed during a daemon initialisation (according to daemon(7) manual page on Linux). I do it to demonstrate that this task is more tricky than one might expect.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;So, here we go:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Close all open file descriptors except standard input, output, and error (i.e. the first three file descriptors 0, 1, 2). This ensures that no accidentally passed file descriptor stays around in the daemon process. On Linux, this is best implemented by iterating through /proc/self/fd, with a fallback of iterating from file descriptor 3 to the value returned by getrlimit() for RLIMITNOFILE.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Reset all signal handlers to their default. This is best done by iterating through the available signals up to the limit of _NSIG and resetting them to SIGDFL.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Reset the signal mask using sigprocmask().&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Sanitize the environment block, removing or resetting environment variables that might negatively impact daemon runtime.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Call fork(), to create a background process.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;In the child, call setsid() to detach from any terminal and create an independent session.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;In the child, call fork() again, to ensure that the daemon can never re-acquire a terminal again.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Call exit() in the first child, so that only the second child (the actual daemon process) stays around. This ensures that the daemon process is re-parented to init/PID 1, as all daemons should be.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;In the daemon process, connect /dev/null to standard input, output, and error.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;In the daemon process, reset the umask to 0, so that the file modes passed to open(), mkdir() and suchlike directly control the access mode of the created files and directories.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;In the daemon process, change the current directory to the root directory (/), in order to avoid that the daemon involuntarily blocks mount points from being unmounted.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;In the daemon process, write the daemon PID (as returned by getpid()) to a PID file, for example /run/foobar.pid (for a hypothetical daemon “foobar”) to ensure that the daemon cannot be started more than once. This must be implemented in race-free fashion so that the PID file is only updated when it is verified at the same time that the PID previously stored in the PID file no longer exists or belongs to a foreign process.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;In the daemon process, drop privileges, if possible and applicable.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;From the daemon process, notify the original process started that initialization is complete. This can be implemented via an unnamed pipe or similar communication channel that is created before the first fork() and hence available in both the original and the daemon process.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Call exit() in the original process. The process that invoked the daemon must be able to rely on that this exit() happens after initialization is complete and all external communication channels are established and accessible.&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The discussed library does most of the above-mentioned initialisation steps as it becomes immediately evident that implementation details for some of them heavily dependent on the internal logic of an application itself, so it is not possible to implement them in a universal library. I believe it is not a flaw, though, as the missed parts are safe to implement in an application code.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The Library’s Application Programming Interface&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The generic programming interface was loosely modelled after above-mentioned BSD’s daemon() function. The library provides two user available functions (one is, in fact, implemented on top of the other) as well as a set of flags to control a daemon creation behaviour.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Conclusion&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The objective of the library is to hide all the trickery of programming a daemon so you could concentrate on the more creative parts of your application. I hope it does this well.&lt;br&gt;
If you are not only interested in writing a daemon, but also want to make yourself familiar with the techniques which are used to accomplish that, the source code is available. Moreover, I would advise anyone, who starts developing for a UNIX environment to do that, as it shows many intricacies of programming for these platforms.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://blog.netbsd.org/tnf/entry/eurobsdcon_2018"&gt;EuroBSDCon 2018 travel report and obligatory pics&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;This was my first big BSD conference. We also planned - planned might be a big word - thought about doing a devsummit on Friday. Since the people who were in charge of that had a change of plans, I was sure it’d go horribly wrong.&lt;br&gt;
The day before the devsummit and still in the wrong country, I mentioned the hours and venue on the wiki, and booked a reservation for a restaurant.&lt;br&gt;
It turns out that everything was totally fine, and since the devsummit was at the conference venue (that was having tutorials that day), they even had signs pointing at the room we were given. Thanks EuroBSDCon conference organizers!&lt;br&gt;
At the devsummit, we spent some time hacking. A few people came with “travel laptops” without access to anything, like Riastradh, so I gave him access to my own laptop. This didn’t hold very long and I kinda forgot about it, but for a few moments he had access to a NetBSD source tree and an 8 thread, 16GB RAM machine with which to build things.&lt;br&gt;
We had a short introduction and I suggested we take some pictures, so here’s the ones we got. A few people were concerned about privacy, so they’re not pictured. We had small team to hold the camera :-)&lt;br&gt;
At the actual conference days, I stayed at the speaker hotel with the other speakers. I’ve attempted to make conversation with some visibly FreeBSD/OpenBSD people, but didn’t have plans to talk about anything, so there was a lot of just following people silently.&lt;br&gt;
Perhaps for the next conference I’ll prepare a list of questions to random BSD people and then very obviously grab a piece of paper and ask, “what was…”, read a bit from it, and say, “your latest kernel panic?”, I’m sure it’ll be a great conversation starter.&lt;br&gt;
At the conference itself, was pretty cool to have folks like Kirk McKusick give first person accounts of some past events (Kirk gave a talk about governance at FreeBSD), or the second keynote by Ron Broersma.&lt;br&gt;
My own talk was hastily prepared, it was difficult to bring the topic together into a coherent talk. Nevertheless, I managed to talk about stuff for a while 40 minutes, though usually I skip over so many details that I have trouble putting together a sufficiently long talk.&lt;br&gt;
I mentioned some of my coolest bugs to solve (I should probably make a separate article about some!). A few people asked for the slides after the talk, so I guess it wasn’t totally incoherent.&lt;br&gt;
It was really fun to meet some of my favourite NetBSD people. I got to show off my now fairly well working laptop (it took a lot of work by all of us!).&lt;br&gt;
After the conference I came back with a conference cold, and it took a few days to recover from it. Hopefully I didn’t infect too many people on the way back.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://panoramacircle.com/2018/09/23/ghostbsd-tested-on-real-hardware-t410-better-than-trueos/"&gt;GhostBSD tested on real hardware T410 – better than TrueOS?&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;You might have heard about FreeBSD which is ultimately derived from UNIX back in the days. It is not Linux even though it is similar in many ways because Linux was designed to follow UNIX principles. Seeing is believing, so check out the video of the install and some apps as well!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Nowadays if you want some of that BSD on your personal desktop how to go about? Well there is a full package or distro called GhostBSD which is based on FreeBSD current with a Mate or XFCE desktop preconfigured. I did try another package called TrueOS before and you can check out my blog post as well.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Let’s give it a try on my Lenovo ThinkPad T410. You can download the latest version from &lt;a href="http://ghostbsd.org"&gt;ghostbsd.org&lt;/a&gt;. Creating a bootable USB drive was surprisingly difficult as rufus did not work and created a corrupted drive. You have to follow this procedure under Windows: download the 2.5GB .iso file and rename the extension to .img. Download Win32 Disk imager and burn the img file to an USB drive and boot from it. You will be able to start a live session and use the onboard setup to install GhostBSD unto a disk.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I did encounter some bugs or quirks along the way. The installer failed the first time for some unknown reason but worked on the second attempt. The first boot stopped upon initialization of the USB3 ports (the T410 does not have USB3) but I could use some ‘exit’ command line magic to continue. The second boot worked fine. Audio was only available through headphones, not speakers but that could partially be fixed using the command line again. Lot’s of installed apps did not show up in the start menu and on goes the quirks list.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Overall it is still better than TrueOS for me because drivers did work very well and I could address most of the existing bugs.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;On the upside:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Free and open source FreeBSD package ready to go&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Mate or XFCE desktop (Mate is the only option for daily builds)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Drivers work fine including LAN, WiFi, video 2D &amp;amp; 3D, audio, etc&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;UFS or ZFS advanced file systems available&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Some downsides:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Less driver and direct app support than Linux&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Installer and desktop have some quirks and bugs&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;App-store is cumbersome, inferior to TrueOS&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/eurobsdcon_2018_and_netbsd_sanitizers"&gt;EuroBSDCon 2018 and NetBSD sanitizers&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20181002175838"&gt;New mandoc feature: -T html -O toc&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.geeklan.co.uk/?p=2307"&gt;EuroBSDcon 2018&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://oshogbo.vexillium.org/blog/55/"&gt;Polish BSD User Group&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://garbage.fm/episodes/43"&gt;garbage[43]: What year is it?&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://thedemoat50.org/"&gt;The Demo @ 50&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://youtu.be/tG8R5SQGPck?t=660"&gt;Microsoft ports DTrace from FreeBSD to Windows 10&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/openbsd"&gt;OpenBSD joins Twitter&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://roy.marples.name/blog/netbsd-curses-ripoffline-improvements"&gt;NetBSD curses ripoffline improvements&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-stable/2018-October/089717.html"&gt;FCP-0101: Deprecating most 10/100 Ethernet drivers&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mail-index.netbsd.org/tech-pkg/2018/10/05/msg020326.html"&gt;Announcing the pkgsrc-2018Q3 release&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.netzbasis.de/openbsd/vmd-debian/index.html"&gt;Debian on OpenBSD vmd (without qemu or another debian system)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/jcs/login_duress"&gt;A BSD authentication module for duress passwords (Joshua Stein)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/oshogbovx/status/1019334534935007232?s=03"&gt;Disk Price/Performance Analysis&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;DJ - &lt;a href="http://dpaste.com/0YV8WC6#wrap"&gt;Zombie ZFS&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Josua - &lt;a href="http://dpaste.com/25B1EA8"&gt;arm tier 1? how to approach it&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;-Gamah - &lt;a href="http://dpaste.com/2SMSGPB"&gt;5ghz&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, ghostbsd, eurobsdcon, daemon</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Foundation September Update, tiny C lib for programming Unix daemons, EuroBSDcon trip reports, GhostBSD tested on real hardware, and a BSD auth module for duress.</p>

<p>##Headlines<br>
###<a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-september-2018/">FreeBSD Foundation Update, September 2018</a></p>

<ul>
<li>MESSAGE FROM THE EXECUTIVE DIRECTOR</li>
</ul>

<blockquote>
<p>Dear FreeBSD Community Member, It is hard to believe that September is over. The Foundation team had a busy month promoting FreeBSD all over the globe, bug fixing in preparation for 12.0, and setting plans in motion to kick off our 4th quarter fundraising and advocacy efforts. Take a minute to see what we’ve been up to and please consider making a donation to help us continue our efforts supporting FreeBSD!</p>
</blockquote>

<ul>
<li>September 2018 Development Projects Update</li>
</ul>

<blockquote>
<p>In preparation for the release of FreeBSD 12.0, I have been working on investigating and fixing a backlog of kernel bug reports.  Of course, this kind of work is never finished, and we will continue to make progress after the release.  In the past couple of months I have fixed a combination of long-standing issues and recent regressions.  Of note are a pair of UNIX domain socket bugs which had been affecting various applications for years.  In particular, Chromium tabs would frequently hang unless a workaround was manually applied to the system, and the bug had started affecting recent versions of Firefox as well.  Fixing these issues gave me an opportunity to revisit and extend our regression testing for UNIX sockets, which, in turn, resulted in some related bugs being identified and fixed.<br>
Of late I have also been investigating reports of issues with ZFS, particularly, those reported on FreeBSD 11.2.  A number of regressions, including a kernel memory leak and issues with ARC reclamation, have already been fixed for 12.0; investigation of other reports is ongoing. Those who closely follow FreeBSD-CURRENT know that some exciting work to improve memory usage on NUMA systems is now enabled by default.  As is usually the case when new code is deployed in a diverse array of systems and workloads, a number of problems since have been identified. We are working on resolving them as soon as possible to ensure the quality of the release.<br>
I’m passionate about maintaining FreeBSD’s stability and dependability as it continues to expand and grow new features, and I’m grateful to the FreeBSD Foundation for sponsoring this work.  We depend on users to report problems to the mailing lists and via the bug tracker, so please try running the 12.0 candidate builds and help us make 12.0 a great release.</p>
</blockquote>

<ul>
<li>Fundraising Update: Supporting the Project</li>
</ul>

<blockquote>
<p>It’s officially Fall here at Foundation headquarters and we’re heading full-steam into our final fundraising campaign of the year. We couldn’t even have begun to reach our funding goal of $1.25 million dollars without the support from the companies who have partnered with us this year. Thank you to Verisign for becoming a Silver Partner. They now join a growing list of companies like Xiplink, NetApp, Microsoft, Tarsnap, VMware, and NeoSmart Technologies that are stepping up and showing their commitment to FreeBSD!<br>
Funding from commercial users like these and individual users like yourself, help us continue our efforts of supporting critical areas of FreeBSD such as:</p>
</blockquote>

<ul>
<li>Operating System Improvements: Providing staff to immediately respond to urgent problems and implement new features and functionality allowing for the innovation and stability you’ve come to rely on.</li>
<li>Security: Providing engineering resources to bolster the capacity and responsiveness of the Security team providing your users with piece of mind when security issues arise.</li>
<li>Release Engineering: Continue providing a full-time release engineer, resulting in timely and reliable releases you can plan around.</li>
<li>Quality Assurance: Improving and increasing test coverage, continuous integration, and automated testing with a full-time software engineer to ensure you receive the highest quality, secure, and reliable operating system.</li>
<li>New User Experience: Improving the process and documentation for getting new people involved with FreeBSD, and supporting those people as they become integrated into the FreeBSD Community providing the resources you may need to get new folks up to speed.</li>
<li>Training: Supporting more FreeBSD training for undergraduates, graduates, and postgraduates. Growing the community means reaching people and catching their interest in systems software as early as possible and providing you with a bigger pool of candidates with the FreeBSD skills you’re looking for.</li>
<li>Face-to-Face Opportunities: Facilitating collaboration among members of the community, and building connections throughout the industry to support a healthy and growing ecosystem and make it easier for you to find resources when questions emerge .</li>
</ul>

<blockquote>
<p>We can continue the above work, if we meet our goal this year!<br>
If your company uses FreeBSD, please consider joining our growing list of 2018 partners. If you haven’t made your donation yet, please consider donating today. We are indebted to the individual donors, and companies listed above who have already shown their commitment to open source.<br>
Thank you for supporting FreeBSD and the Foundation!</p>
</blockquote>

<ul>
<li>September 2018 Release Engineering Update</li>
</ul>

<blockquote>
<p>The FreeBSD Release Engineering team continued working on the upcoming 12.0 RELEASE.  At present, the 12.0 schedule had been adjusted by one week to allow for necessary works-in-progress to be completed.<br>
Of note, one of the works-in-progress includes updating OpenSSL from 1.0.2 to 1.1.1, in order to avoid breaking the application binary interface (ABI) on an established stable branch.<br>
Due to the level of non-trivial intrusiveness that had already been discovered and addressed in a project branch of the repository, it is possible (but not yet definite) that the schedule will need to be adjusted by another week to allow more time for larger and related updates for this particular update.<br>
Should the 12.0-RELEASE schedule need to be adjusted at any time during the release cycle, the schedule on the FreeBSD project website will be updated accordingly.  The current schedule is available at:<br>
<a href="https://www.freebsd.org/releases/12.0R/schedule.html">https://www.freebsd.org/releases/12.0R/schedule.html</a></p>
</blockquote>

<ul>
<li>BSDCam 2018 Trip Report: Marie Helene Kvello-Aune</li>
</ul>

<blockquote>
<p>I’d like to start by thanking the FreeBSD Foundation for sponsoring my trip to BSDCam(bridge) 2018. I wouldn’t have managed to attend otherwise. I’ve used FreeBSD in both personal and professional deployments since the year 2000, and over the last few years I have become more involved with development and documentation.<br>
I arrived in Gatwick, London at midnight. On Monday, August 13,  I took the train to Cambridge, and decided to do some touristy activities as I walked from the train station to Churchill College. I ran into Allan outside the hotel right before the sky decided it was time for a heavy rainfall. Monday was mostly spent settling in, recouping after travel, and hanging out with Allan, Brad, Will and Andy later in the afternoon/evening. Read more…</p>
</blockquote>

<ul>
<li>Continuous Integration Update</li>
</ul>

<blockquote>
<p>The FreeBSD Foundation has sponsored the development of the Project’s continuous integration system, available at <a href="https://ci.FreeBSD.org">https://ci.FreeBSD.org</a>, since June. Over the summer, we improved both the software and hardware infrastructure, and also added some new jobs for extending test coverage of the -CURRENT and -STABLE branches. Following are some highlights.</p>
</blockquote>

<ul>
<li>New Hardware</li>
</ul>

<blockquote>
<p>The Foundation purchased 4 new build machines for scaling up the computation power for the various test jobs. These newer, faster machines substantially speed up the time it takes to test amd64 builds, so that failing changes can be identified more quickly. Also, in August, we received a donation of 2 PINE A64-LTS boards from <a href="http://PINE64.org">PINE64.org</a>, which will be put in the hardware test lab as one part of the continuous tests.</p>
</blockquote>

<ul>
<li>CI Staging Environment</li>
</ul>

<blockquote>
<p>We used hardware from a previous generation CI system to build a staging environment for the CI infrastructure, which is available at<br>
<a href="https://ci-dev.freebsd.org">https://ci-dev.freebsd.org</a>. It executes the configurations and scripts from the “staging” branch of the FreeBSD-CI repository, and the development feature branches. We also use it to experiment with the new version of the jenkins server and plugins. Having a staging environment avoids affecting the production CI environment, reducing downtime.</p>
</blockquote>

<ul>
<li>Mail Notification</li>
</ul>

<blockquote>
<p>In July, we turned on failure notification for all the kernel and world build jobs. Committers will receive email containing the build information and failure log to inform them of possible problems with their modification on certain architectures. For amd64 of the -CURRENT branch, we also enabled the notification on failing regression test cases. Currently mail is sent only to the individual committers, but with help from postmaster team, we have created a dev-ci mailing list and will soon be also sending notifications there.</p>
</blockquote>

<ul>
<li>New Test Job</li>
</ul>

<blockquote>
<p>In August, we updated the embedded script of the virtual machine image. Originally it only executed pre-defined tests, but now this behavior can be modified by the data on the attached disk. This mechanism is used for adding new ZFS tests jobs. We are also working on analyzing and fixing the failing and skipped test cases.</p>
</blockquote>

<ul>
<li>Work in Progress</li>
</ul>

<blockquote>
<p>In August and September, we had two developer summits, one in Cambridge, UK and one in Bucharest, Romania. In these meetings, we discussed running special tests, such as ztest,  which need a longer run time. We also planned the network testing for TCP/IP stack</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://chaoticlab.io/c/c++/unix/2018/10/01/daemonize.html">Daemonize - a Tiny C Library for Programming the UNIX Daemons</a></p>

<blockquote>
<p>Whatever they say, writing System-V style UNIX daemons is hard. One has to follow many rules to make a daemon process behave correctly on diverse UNIX flavours. Moreover, debugging such a code might be somewhat tricky. On the other hand, the process of daemon initialisation is rigid and well defined so the corresponding code has to be written and debugged once and later can be reused countless number of times.<br>
Developers of BSD UNIX were very aware of this, as there a C library function daemon() was available starting from version 4.4. The function, although non-standard, is present on many UNIXes. Unfortunately, it does not follow all the required steps to reliably run a process in the background on systems which follow System-V semantics (e.g. Linux). The details are available at the corresponding Linux man page. The main problem here, as I understand it, is that daemon() does not use the double-forking technique to avoid the situation when zombie processes appear.<br>
Whenever I encounter a problem like this one, I know it is time to write a tiny C library which solves it. This is exactly how ‘daemonize’ was born (GitHub mirror). The library consists of only two files which are meant to be integrated into the source tree of your project. Recently I have updated the library and realised that it would be good to describe how to use it on this site.<br>
If for some reason you want to make a Windows service, I have a battle tested template code for you as well.</p>
</blockquote>

<ul>
<li>System-V Daemon Initialisation Procedure</li>
</ul>

<blockquote>
<p>To make discussion clear we shall quote the steps which have to be performed during a daemon initialisation (according to daemon(7) manual page on Linux). I do it to demonstrate that this task is more tricky than one might expect.</p>
</blockquote>

<ul>
<li>
<p>So, here we go:</p>
</li>
<li>
<p>Close all open file descriptors except standard input, output, and error (i.e. the first three file descriptors 0, 1, 2). This ensures that no accidentally passed file descriptor stays around in the daemon process. On Linux, this is best implemented by iterating through /proc/self/fd, with a fallback of iterating from file descriptor 3 to the value returned by getrlimit() for RLIMIT_NOFILE.</p>
</li>
<li>
<p>Reset all signal handlers to their default. This is best done by iterating through the available signals up to the limit of _NSIG and resetting them to SIG_DFL.</p>
</li>
<li>
<p>Reset the signal mask using sigprocmask().</p>
</li>
<li>
<p>Sanitize the environment block, removing or resetting environment variables that might negatively impact daemon runtime.</p>
</li>
<li>
<p>Call fork(), to create a background process.</p>
</li>
<li>
<p>In the child, call setsid() to detach from any terminal and create an independent session.</p>
</li>
<li>
<p>In the child, call fork() again, to ensure that the daemon can never re-acquire a terminal again.</p>
</li>
<li>
<p>Call exit() in the first child, so that only the second child (the actual daemon process) stays around. This ensures that the daemon process is re-parented to init/PID 1, as all daemons should be.</p>
</li>
<li>
<p>In the daemon process, connect /dev/null to standard input, output, and error.</p>
</li>
<li>
<p>In the daemon process, reset the umask to 0, so that the file modes passed to open(), mkdir() and suchlike directly control the access mode of the created files and directories.</p>
</li>
<li>
<p>In the daemon process, change the current directory to the root directory (/), in order to avoid that the daemon involuntarily blocks mount points from being unmounted.</p>
</li>
<li>
<p>In the daemon process, write the daemon PID (as returned by getpid()) to a PID file, for example /run/foobar.pid (for a hypothetical daemon “foobar”) to ensure that the daemon cannot be started more than once. This must be implemented in race-free fashion so that the PID file is only updated when it is verified at the same time that the PID previously stored in the PID file no longer exists or belongs to a foreign process.</p>
</li>
<li>
<p>In the daemon process, drop privileges, if possible and applicable.</p>
</li>
<li>
<p>From the daemon process, notify the original process started that initialization is complete. This can be implemented via an unnamed pipe or similar communication channel that is created before the first fork() and hence available in both the original and the daemon process.</p>
</li>
<li>
<p>Call exit() in the original process. The process that invoked the daemon must be able to rely on that this exit() happens after initialization is complete and all external communication channels are established and accessible.</p>
</li>
</ul>

<blockquote>
<p>The discussed library does most of the above-mentioned initialisation steps as it becomes immediately evident that implementation details for some of them heavily dependent on the internal logic of an application itself, so it is not possible to implement them in a universal library. I believe it is not a flaw, though, as the missed parts are safe to implement in an application code.</p>
</blockquote>

<ul>
<li>The Library’s Application Programming Interface</li>
</ul>

<blockquote>
<p>The generic programming interface was loosely modelled after above-mentioned BSD’s daemon() function. The library provides two user available functions (one is, in fact, implemented on top of the other) as well as a set of flags to control a daemon creation behaviour.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>The objective of the library is to hide all the trickery of programming a daemon so you could concentrate on the more creative parts of your application. I hope it does this well.<br>
If you are not only interested in writing a daemon, but also want to make yourself familiar with the techniques which are used to accomplish that, the source code is available. Moreover, I would advise anyone, who starts developing for a UNIX environment to do that, as it shows many intricacies of programming for these platforms.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://blog.netbsd.org/tnf/entry/eurobsdcon_2018">EuroBSDCon 2018 travel report and obligatory pics</a></p>

<blockquote>
<p>This was my first big BSD conference. We also planned - planned might be a big word - thought about doing a devsummit on Friday. Since the people who were in charge of that had a change of plans, I was sure it’d go horribly wrong.<br>
The day before the devsummit and still in the wrong country, I mentioned the hours and venue on the wiki, and booked a reservation for a restaurant.<br>
It turns out that everything was totally fine, and since the devsummit was at the conference venue (that was having tutorials that day), they even had signs pointing at the room we were given. Thanks EuroBSDCon conference organizers!<br>
At the devsummit, we spent some time hacking. A few people came with “travel laptops” without access to anything, like Riastradh, so I gave him access to my own laptop. This didn’t hold very long and I kinda forgot about it, but for a few moments he had access to a NetBSD source tree and an 8 thread, 16GB RAM machine with which to build things.<br>
We had a short introduction and I suggested we take some pictures, so here’s the ones we got. A few people were concerned about privacy, so they’re not pictured. We had small team to hold the camera :-)<br>
At the actual conference days, I stayed at the speaker hotel with the other speakers. I’ve attempted to make conversation with some visibly FreeBSD/OpenBSD people, but didn’t have plans to talk about anything, so there was a lot of just following people silently.<br>
Perhaps for the next conference I’ll prepare a list of questions to random BSD people and then very obviously grab a piece of paper and ask, “what was…”, read a bit from it, and say, “your latest kernel panic?”, I’m sure it’ll be a great conversation starter.<br>
At the conference itself, was pretty cool to have folks like Kirk McKusick give first person accounts of some past events (Kirk gave a talk about governance at FreeBSD), or the second keynote by Ron Broersma.<br>
My own talk was hastily prepared, it was difficult to bring the topic together into a coherent talk. Nevertheless, I managed to talk about stuff for a while 40 minutes, though usually I skip over so many details that I have trouble putting together a sufficiently long talk.<br>
I mentioned some of my coolest bugs to solve (I should probably make a separate article about some!). A few people asked for the slides after the talk, so I guess it wasn’t totally incoherent.<br>
It was really fun to meet some of my favourite NetBSD people. I got to show off my now fairly well working laptop (it took a lot of work by all of us!).<br>
After the conference I came back with a conference cold, and it took a few days to recover from it. Hopefully I didn’t infect too many people on the way back.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://panoramacircle.com/2018/09/23/ghostbsd-tested-on-real-hardware-t410-better-than-trueos/">GhostBSD tested on real hardware T410 – better than TrueOS?</a></p>

<blockquote>
<p>You might have heard about FreeBSD which is ultimately derived from UNIX back in the days. It is not Linux even though it is similar in many ways because Linux was designed to follow UNIX principles. Seeing is believing, so check out the video of the install and some apps as well!</p>
</blockquote>

<blockquote>
<p>Nowadays if you want some of that BSD on your personal desktop how to go about? Well there is a full package or distro called GhostBSD which is based on FreeBSD current with a Mate or XFCE desktop preconfigured. I did try another package called TrueOS before and you can check out my blog post as well.</p>
</blockquote>

<blockquote>
<p>Let’s give it a try on my Lenovo ThinkPad T410. You can download the latest version from <a href="http://ghostbsd.org">ghostbsd.org</a>. Creating a bootable USB drive was surprisingly difficult as rufus did not work and created a corrupted drive. You have to follow this procedure under Windows: download the 2.5GB .iso file and rename the extension to .img. Download Win32 Disk imager and burn the img file to an USB drive and boot from it. You will be able to start a live session and use the onboard setup to install GhostBSD unto a disk.</p>
</blockquote>

<blockquote>
<p>I did encounter some bugs or quirks along the way. The installer failed the first time for some unknown reason but worked on the second attempt. The first boot stopped upon initialization of the USB3 ports (the T410 does not have USB3) but I could use some ‘exit’ command line magic to continue. The second boot worked fine. Audio was only available through headphones, not speakers but that could partially be fixed using the command line again. Lot’s of installed apps did not show up in the start menu and on goes the quirks list.</p>
</blockquote>

<blockquote>
<p>Overall it is still better than TrueOS for me because drivers did work very well and I could address most of the existing bugs.</p>
</blockquote>

<ul>
<li>
<p>On the upside:</p>
</li>
<li>
<p>Free and open source FreeBSD package ready to go</p>
</li>
<li>
<p>Mate or XFCE desktop (Mate is the only option for daily builds)</p>
</li>
<li>
<p>Drivers work fine including LAN, WiFi, video 2D &amp; 3D, audio, etc</p>
</li>
<li>
<p>UFS or ZFS advanced file systems available</p>
</li>
<li>
<p>Some downsides:</p>
</li>
<li>
<p>Less driver and direct app support than Linux</p>
</li>
<li>
<p>Installer and desktop have some quirks and bugs</p>
</li>
<li>
<p>App-store is cumbersome, inferior to TrueOS</p>
</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/eurobsdcon_2018_and_netbsd_sanitizers">EuroBSDCon 2018 and NetBSD sanitizers</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20181002175838">New mandoc feature: -T html -O toc</a></li>
<li><a href="https://www.geeklan.co.uk/?p=2307">EuroBSDcon 2018</a></li>
<li><a href="https://oshogbo.vexillium.org/blog/55/">Polish BSD User Group</a></li>
<li><a href="https://garbage.fm/episodes/43">garbage[43]: What year is it?</a></li>
<li><a href="https://thedemoat50.org/">The Demo @ 50</a></li>
<li><a href="https://youtu.be/tG8R5SQGPck?t=660">Microsoft ports DTrace from FreeBSD to Windows 10</a></li>
<li><a href="https://twitter.com/openbsd">OpenBSD joins Twitter</a></li>
<li><a href="https://roy.marples.name/blog/netbsd-curses-ripoffline-improvements">NetBSD curses ripoffline improvements</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2018-October/089717.html">FCP-0101: Deprecating most 10/100 Ethernet drivers</a></li>
<li><a href="https://mail-index.netbsd.org/tech-pkg/2018/10/05/msg020326.html">Announcing the pkgsrc-2018Q3 release</a></li>
<li><a href="http://www.netzbasis.de/openbsd/vmd-debian/index.html">Debian on OpenBSD vmd (without qemu or another debian system)</a></li>
<li><a href="https://github.com/jcs/login_duress">A BSD authentication module for duress passwords (Joshua Stein)</a></li>
<li><a href="https://twitter.com/oshogbovx/status/1019334534935007232?s=03">Disk Price/Performance Analysis</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>DJ - <a href="http://dpaste.com/0YV8WC6#wrap">Zombie ZFS</a></li>
<li>Josua - <a href="http://dpaste.com/25B1EA8">arm tier 1? how to approach it</a></li>
<li>-Gamah - <a href="http://dpaste.com/2SMSGPB">5ghz</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Foundation September Update, tiny C lib for programming Unix daemons, EuroBSDcon trip reports, GhostBSD tested on real hardware, and a BSD auth module for duress.</p>

<p>##Headlines<br>
###<a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-september-2018/">FreeBSD Foundation Update, September 2018</a></p>

<ul>
<li>MESSAGE FROM THE EXECUTIVE DIRECTOR</li>
</ul>

<blockquote>
<p>Dear FreeBSD Community Member, It is hard to believe that September is over. The Foundation team had a busy month promoting FreeBSD all over the globe, bug fixing in preparation for 12.0, and setting plans in motion to kick off our 4th quarter fundraising and advocacy efforts. Take a minute to see what we’ve been up to and please consider making a donation to help us continue our efforts supporting FreeBSD!</p>
</blockquote>

<ul>
<li>September 2018 Development Projects Update</li>
</ul>

<blockquote>
<p>In preparation for the release of FreeBSD 12.0, I have been working on investigating and fixing a backlog of kernel bug reports.  Of course, this kind of work is never finished, and we will continue to make progress after the release.  In the past couple of months I have fixed a combination of long-standing issues and recent regressions.  Of note are a pair of UNIX domain socket bugs which had been affecting various applications for years.  In particular, Chromium tabs would frequently hang unless a workaround was manually applied to the system, and the bug had started affecting recent versions of Firefox as well.  Fixing these issues gave me an opportunity to revisit and extend our regression testing for UNIX sockets, which, in turn, resulted in some related bugs being identified and fixed.<br>
Of late I have also been investigating reports of issues with ZFS, particularly, those reported on FreeBSD 11.2.  A number of regressions, including a kernel memory leak and issues with ARC reclamation, have already been fixed for 12.0; investigation of other reports is ongoing. Those who closely follow FreeBSD-CURRENT know that some exciting work to improve memory usage on NUMA systems is now enabled by default.  As is usually the case when new code is deployed in a diverse array of systems and workloads, a number of problems since have been identified. We are working on resolving them as soon as possible to ensure the quality of the release.<br>
I’m passionate about maintaining FreeBSD’s stability and dependability as it continues to expand and grow new features, and I’m grateful to the FreeBSD Foundation for sponsoring this work.  We depend on users to report problems to the mailing lists and via the bug tracker, so please try running the 12.0 candidate builds and help us make 12.0 a great release.</p>
</blockquote>

<ul>
<li>Fundraising Update: Supporting the Project</li>
</ul>

<blockquote>
<p>It’s officially Fall here at Foundation headquarters and we’re heading full-steam into our final fundraising campaign of the year. We couldn’t even have begun to reach our funding goal of $1.25 million dollars without the support from the companies who have partnered with us this year. Thank you to Verisign for becoming a Silver Partner. They now join a growing list of companies like Xiplink, NetApp, Microsoft, Tarsnap, VMware, and NeoSmart Technologies that are stepping up and showing their commitment to FreeBSD!<br>
Funding from commercial users like these and individual users like yourself, help us continue our efforts of supporting critical areas of FreeBSD such as:</p>
</blockquote>

<ul>
<li>Operating System Improvements: Providing staff to immediately respond to urgent problems and implement new features and functionality allowing for the innovation and stability you’ve come to rely on.</li>
<li>Security: Providing engineering resources to bolster the capacity and responsiveness of the Security team providing your users with piece of mind when security issues arise.</li>
<li>Release Engineering: Continue providing a full-time release engineer, resulting in timely and reliable releases you can plan around.</li>
<li>Quality Assurance: Improving and increasing test coverage, continuous integration, and automated testing with a full-time software engineer to ensure you receive the highest quality, secure, and reliable operating system.</li>
<li>New User Experience: Improving the process and documentation for getting new people involved with FreeBSD, and supporting those people as they become integrated into the FreeBSD Community providing the resources you may need to get new folks up to speed.</li>
<li>Training: Supporting more FreeBSD training for undergraduates, graduates, and postgraduates. Growing the community means reaching people and catching their interest in systems software as early as possible and providing you with a bigger pool of candidates with the FreeBSD skills you’re looking for.</li>
<li>Face-to-Face Opportunities: Facilitating collaboration among members of the community, and building connections throughout the industry to support a healthy and growing ecosystem and make it easier for you to find resources when questions emerge .</li>
</ul>

<blockquote>
<p>We can continue the above work, if we meet our goal this year!<br>
If your company uses FreeBSD, please consider joining our growing list of 2018 partners. If you haven’t made your donation yet, please consider donating today. We are indebted to the individual donors, and companies listed above who have already shown their commitment to open source.<br>
Thank you for supporting FreeBSD and the Foundation!</p>
</blockquote>

<ul>
<li>September 2018 Release Engineering Update</li>
</ul>

<blockquote>
<p>The FreeBSD Release Engineering team continued working on the upcoming 12.0 RELEASE.  At present, the 12.0 schedule had been adjusted by one week to allow for necessary works-in-progress to be completed.<br>
Of note, one of the works-in-progress includes updating OpenSSL from 1.0.2 to 1.1.1, in order to avoid breaking the application binary interface (ABI) on an established stable branch.<br>
Due to the level of non-trivial intrusiveness that had already been discovered and addressed in a project branch of the repository, it is possible (but not yet definite) that the schedule will need to be adjusted by another week to allow more time for larger and related updates for this particular update.<br>
Should the 12.0-RELEASE schedule need to be adjusted at any time during the release cycle, the schedule on the FreeBSD project website will be updated accordingly.  The current schedule is available at:<br>
<a href="https://www.freebsd.org/releases/12.0R/schedule.html">https://www.freebsd.org/releases/12.0R/schedule.html</a></p>
</blockquote>

<ul>
<li>BSDCam 2018 Trip Report: Marie Helene Kvello-Aune</li>
</ul>

<blockquote>
<p>I’d like to start by thanking the FreeBSD Foundation for sponsoring my trip to BSDCam(bridge) 2018. I wouldn’t have managed to attend otherwise. I’ve used FreeBSD in both personal and professional deployments since the year 2000, and over the last few years I have become more involved with development and documentation.<br>
I arrived in Gatwick, London at midnight. On Monday, August 13,  I took the train to Cambridge, and decided to do some touristy activities as I walked from the train station to Churchill College. I ran into Allan outside the hotel right before the sky decided it was time for a heavy rainfall. Monday was mostly spent settling in, recouping after travel, and hanging out with Allan, Brad, Will and Andy later in the afternoon/evening. Read more…</p>
</blockquote>

<ul>
<li>Continuous Integration Update</li>
</ul>

<blockquote>
<p>The FreeBSD Foundation has sponsored the development of the Project’s continuous integration system, available at <a href="https://ci.FreeBSD.org">https://ci.FreeBSD.org</a>, since June. Over the summer, we improved both the software and hardware infrastructure, and also added some new jobs for extending test coverage of the -CURRENT and -STABLE branches. Following are some highlights.</p>
</blockquote>

<ul>
<li>New Hardware</li>
</ul>

<blockquote>
<p>The Foundation purchased 4 new build machines for scaling up the computation power for the various test jobs. These newer, faster machines substantially speed up the time it takes to test amd64 builds, so that failing changes can be identified more quickly. Also, in August, we received a donation of 2 PINE A64-LTS boards from <a href="http://PINE64.org">PINE64.org</a>, which will be put in the hardware test lab as one part of the continuous tests.</p>
</blockquote>

<ul>
<li>CI Staging Environment</li>
</ul>

<blockquote>
<p>We used hardware from a previous generation CI system to build a staging environment for the CI infrastructure, which is available at<br>
<a href="https://ci-dev.freebsd.org">https://ci-dev.freebsd.org</a>. It executes the configurations and scripts from the “staging” branch of the FreeBSD-CI repository, and the development feature branches. We also use it to experiment with the new version of the jenkins server and plugins. Having a staging environment avoids affecting the production CI environment, reducing downtime.</p>
</blockquote>

<ul>
<li>Mail Notification</li>
</ul>

<blockquote>
<p>In July, we turned on failure notification for all the kernel and world build jobs. Committers will receive email containing the build information and failure log to inform them of possible problems with their modification on certain architectures. For amd64 of the -CURRENT branch, we also enabled the notification on failing regression test cases. Currently mail is sent only to the individual committers, but with help from postmaster team, we have created a dev-ci mailing list and will soon be also sending notifications there.</p>
</blockquote>

<ul>
<li>New Test Job</li>
</ul>

<blockquote>
<p>In August, we updated the embedded script of the virtual machine image. Originally it only executed pre-defined tests, but now this behavior can be modified by the data on the attached disk. This mechanism is used for adding new ZFS tests jobs. We are also working on analyzing and fixing the failing and skipped test cases.</p>
</blockquote>

<ul>
<li>Work in Progress</li>
</ul>

<blockquote>
<p>In August and September, we had two developer summits, one in Cambridge, UK and one in Bucharest, Romania. In these meetings, we discussed running special tests, such as ztest,  which need a longer run time. We also planned the network testing for TCP/IP stack</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://chaoticlab.io/c/c++/unix/2018/10/01/daemonize.html">Daemonize - a Tiny C Library for Programming the UNIX Daemons</a></p>

<blockquote>
<p>Whatever they say, writing System-V style UNIX daemons is hard. One has to follow many rules to make a daemon process behave correctly on diverse UNIX flavours. Moreover, debugging such a code might be somewhat tricky. On the other hand, the process of daemon initialisation is rigid and well defined so the corresponding code has to be written and debugged once and later can be reused countless number of times.<br>
Developers of BSD UNIX were very aware of this, as there a C library function daemon() was available starting from version 4.4. The function, although non-standard, is present on many UNIXes. Unfortunately, it does not follow all the required steps to reliably run a process in the background on systems which follow System-V semantics (e.g. Linux). The details are available at the corresponding Linux man page. The main problem here, as I understand it, is that daemon() does not use the double-forking technique to avoid the situation when zombie processes appear.<br>
Whenever I encounter a problem like this one, I know it is time to write a tiny C library which solves it. This is exactly how ‘daemonize’ was born (GitHub mirror). The library consists of only two files which are meant to be integrated into the source tree of your project. Recently I have updated the library and realised that it would be good to describe how to use it on this site.<br>
If for some reason you want to make a Windows service, I have a battle tested template code for you as well.</p>
</blockquote>

<ul>
<li>System-V Daemon Initialisation Procedure</li>
</ul>

<blockquote>
<p>To make discussion clear we shall quote the steps which have to be performed during a daemon initialisation (according to daemon(7) manual page on Linux). I do it to demonstrate that this task is more tricky than one might expect.</p>
</blockquote>

<ul>
<li>
<p>So, here we go:</p>
</li>
<li>
<p>Close all open file descriptors except standard input, output, and error (i.e. the first three file descriptors 0, 1, 2). This ensures that no accidentally passed file descriptor stays around in the daemon process. On Linux, this is best implemented by iterating through /proc/self/fd, with a fallback of iterating from file descriptor 3 to the value returned by getrlimit() for RLIMIT_NOFILE.</p>
</li>
<li>
<p>Reset all signal handlers to their default. This is best done by iterating through the available signals up to the limit of _NSIG and resetting them to SIG_DFL.</p>
</li>
<li>
<p>Reset the signal mask using sigprocmask().</p>
</li>
<li>
<p>Sanitize the environment block, removing or resetting environment variables that might negatively impact daemon runtime.</p>
</li>
<li>
<p>Call fork(), to create a background process.</p>
</li>
<li>
<p>In the child, call setsid() to detach from any terminal and create an independent session.</p>
</li>
<li>
<p>In the child, call fork() again, to ensure that the daemon can never re-acquire a terminal again.</p>
</li>
<li>
<p>Call exit() in the first child, so that only the second child (the actual daemon process) stays around. This ensures that the daemon process is re-parented to init/PID 1, as all daemons should be.</p>
</li>
<li>
<p>In the daemon process, connect /dev/null to standard input, output, and error.</p>
</li>
<li>
<p>In the daemon process, reset the umask to 0, so that the file modes passed to open(), mkdir() and suchlike directly control the access mode of the created files and directories.</p>
</li>
<li>
<p>In the daemon process, change the current directory to the root directory (/), in order to avoid that the daemon involuntarily blocks mount points from being unmounted.</p>
</li>
<li>
<p>In the daemon process, write the daemon PID (as returned by getpid()) to a PID file, for example /run/foobar.pid (for a hypothetical daemon “foobar”) to ensure that the daemon cannot be started more than once. This must be implemented in race-free fashion so that the PID file is only updated when it is verified at the same time that the PID previously stored in the PID file no longer exists or belongs to a foreign process.</p>
</li>
<li>
<p>In the daemon process, drop privileges, if possible and applicable.</p>
</li>
<li>
<p>From the daemon process, notify the original process started that initialization is complete. This can be implemented via an unnamed pipe or similar communication channel that is created before the first fork() and hence available in both the original and the daemon process.</p>
</li>
<li>
<p>Call exit() in the original process. The process that invoked the daemon must be able to rely on that this exit() happens after initialization is complete and all external communication channels are established and accessible.</p>
</li>
</ul>

<blockquote>
<p>The discussed library does most of the above-mentioned initialisation steps as it becomes immediately evident that implementation details for some of them heavily dependent on the internal logic of an application itself, so it is not possible to implement them in a universal library. I believe it is not a flaw, though, as the missed parts are safe to implement in an application code.</p>
</blockquote>

<ul>
<li>The Library’s Application Programming Interface</li>
</ul>

<blockquote>
<p>The generic programming interface was loosely modelled after above-mentioned BSD’s daemon() function. The library provides two user available functions (one is, in fact, implemented on top of the other) as well as a set of flags to control a daemon creation behaviour.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>The objective of the library is to hide all the trickery of programming a daemon so you could concentrate on the more creative parts of your application. I hope it does this well.<br>
If you are not only interested in writing a daemon, but also want to make yourself familiar with the techniques which are used to accomplish that, the source code is available. Moreover, I would advise anyone, who starts developing for a UNIX environment to do that, as it shows many intricacies of programming for these platforms.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://blog.netbsd.org/tnf/entry/eurobsdcon_2018">EuroBSDCon 2018 travel report and obligatory pics</a></p>

<blockquote>
<p>This was my first big BSD conference. We also planned - planned might be a big word - thought about doing a devsummit on Friday. Since the people who were in charge of that had a change of plans, I was sure it’d go horribly wrong.<br>
The day before the devsummit and still in the wrong country, I mentioned the hours and venue on the wiki, and booked a reservation for a restaurant.<br>
It turns out that everything was totally fine, and since the devsummit was at the conference venue (that was having tutorials that day), they even had signs pointing at the room we were given. Thanks EuroBSDCon conference organizers!<br>
At the devsummit, we spent some time hacking. A few people came with “travel laptops” without access to anything, like Riastradh, so I gave him access to my own laptop. This didn’t hold very long and I kinda forgot about it, but for a few moments he had access to a NetBSD source tree and an 8 thread, 16GB RAM machine with which to build things.<br>
We had a short introduction and I suggested we take some pictures, so here’s the ones we got. A few people were concerned about privacy, so they’re not pictured. We had small team to hold the camera :-)<br>
At the actual conference days, I stayed at the speaker hotel with the other speakers. I’ve attempted to make conversation with some visibly FreeBSD/OpenBSD people, but didn’t have plans to talk about anything, so there was a lot of just following people silently.<br>
Perhaps for the next conference I’ll prepare a list of questions to random BSD people and then very obviously grab a piece of paper and ask, “what was…”, read a bit from it, and say, “your latest kernel panic?”, I’m sure it’ll be a great conversation starter.<br>
At the conference itself, was pretty cool to have folks like Kirk McKusick give first person accounts of some past events (Kirk gave a talk about governance at FreeBSD), or the second keynote by Ron Broersma.<br>
My own talk was hastily prepared, it was difficult to bring the topic together into a coherent talk. Nevertheless, I managed to talk about stuff for a while 40 minutes, though usually I skip over so many details that I have trouble putting together a sufficiently long talk.<br>
I mentioned some of my coolest bugs to solve (I should probably make a separate article about some!). A few people asked for the slides after the talk, so I guess it wasn’t totally incoherent.<br>
It was really fun to meet some of my favourite NetBSD people. I got to show off my now fairly well working laptop (it took a lot of work by all of us!).<br>
After the conference I came back with a conference cold, and it took a few days to recover from it. Hopefully I didn’t infect too many people on the way back.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://panoramacircle.com/2018/09/23/ghostbsd-tested-on-real-hardware-t410-better-than-trueos/">GhostBSD tested on real hardware T410 – better than TrueOS?</a></p>

<blockquote>
<p>You might have heard about FreeBSD which is ultimately derived from UNIX back in the days. It is not Linux even though it is similar in many ways because Linux was designed to follow UNIX principles. Seeing is believing, so check out the video of the install and some apps as well!</p>
</blockquote>

<blockquote>
<p>Nowadays if you want some of that BSD on your personal desktop how to go about? Well there is a full package or distro called GhostBSD which is based on FreeBSD current with a Mate or XFCE desktop preconfigured. I did try another package called TrueOS before and you can check out my blog post as well.</p>
</blockquote>

<blockquote>
<p>Let’s give it a try on my Lenovo ThinkPad T410. You can download the latest version from <a href="http://ghostbsd.org">ghostbsd.org</a>. Creating a bootable USB drive was surprisingly difficult as rufus did not work and created a corrupted drive. You have to follow this procedure under Windows: download the 2.5GB .iso file and rename the extension to .img. Download Win32 Disk imager and burn the img file to an USB drive and boot from it. You will be able to start a live session and use the onboard setup to install GhostBSD unto a disk.</p>
</blockquote>

<blockquote>
<p>I did encounter some bugs or quirks along the way. The installer failed the first time for some unknown reason but worked on the second attempt. The first boot stopped upon initialization of the USB3 ports (the T410 does not have USB3) but I could use some ‘exit’ command line magic to continue. The second boot worked fine. Audio was only available through headphones, not speakers but that could partially be fixed using the command line again. Lot’s of installed apps did not show up in the start menu and on goes the quirks list.</p>
</blockquote>

<blockquote>
<p>Overall it is still better than TrueOS for me because drivers did work very well and I could address most of the existing bugs.</p>
</blockquote>

<ul>
<li>
<p>On the upside:</p>
</li>
<li>
<p>Free and open source FreeBSD package ready to go</p>
</li>
<li>
<p>Mate or XFCE desktop (Mate is the only option for daily builds)</p>
</li>
<li>
<p>Drivers work fine including LAN, WiFi, video 2D &amp; 3D, audio, etc</p>
</li>
<li>
<p>UFS or ZFS advanced file systems available</p>
</li>
<li>
<p>Some downsides:</p>
</li>
<li>
<p>Less driver and direct app support than Linux</p>
</li>
<li>
<p>Installer and desktop have some quirks and bugs</p>
</li>
<li>
<p>App-store is cumbersome, inferior to TrueOS</p>
</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/eurobsdcon_2018_and_netbsd_sanitizers">EuroBSDCon 2018 and NetBSD sanitizers</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20181002175838">New mandoc feature: -T html -O toc</a></li>
<li><a href="https://www.geeklan.co.uk/?p=2307">EuroBSDcon 2018</a></li>
<li><a href="https://oshogbo.vexillium.org/blog/55/">Polish BSD User Group</a></li>
<li><a href="https://garbage.fm/episodes/43">garbage[43]: What year is it?</a></li>
<li><a href="https://thedemoat50.org/">The Demo @ 50</a></li>
<li><a href="https://youtu.be/tG8R5SQGPck?t=660">Microsoft ports DTrace from FreeBSD to Windows 10</a></li>
<li><a href="https://twitter.com/openbsd">OpenBSD joins Twitter</a></li>
<li><a href="https://roy.marples.name/blog/netbsd-curses-ripoffline-improvements">NetBSD curses ripoffline improvements</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2018-October/089717.html">FCP-0101: Deprecating most 10/100 Ethernet drivers</a></li>
<li><a href="https://mail-index.netbsd.org/tech-pkg/2018/10/05/msg020326.html">Announcing the pkgsrc-2018Q3 release</a></li>
<li><a href="http://www.netzbasis.de/openbsd/vmd-debian/index.html">Debian on OpenBSD vmd (without qemu or another debian system)</a></li>
<li><a href="https://github.com/jcs/login_duress">A BSD authentication module for duress passwords (Joshua Stein)</a></li>
<li><a href="https://twitter.com/oshogbovx/status/1019334534935007232?s=03">Disk Price/Performance Analysis</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>DJ - <a href="http://dpaste.com/0YV8WC6#wrap">Zombie ZFS</a></li>
<li>Josua - <a href="http://dpaste.com/25B1EA8">arm tier 1? how to approach it</a></li>
<li>-Gamah - <a href="http://dpaste.com/2SMSGPB">5ghz</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 268: Netcat Demystified | BSD Now 268</title>
  <link>https://www.bsdnow.tv/268</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2721</guid>
  <pubDate>Wed, 17 Oct 2018 01:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/78b4306b-b0ac-4221-b4f4-60d2bde9628e.mp3" length="40587288" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>6 metrics for zpool performance, 2FA with ssh on OpenBSD, ZFS maintaining file type information in dirs, everything old is new again, netcat demystified, and more.</itunes:subtitle>
  <itunes:duration>1:07:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>6 metrics for zpool performance, 2FA with ssh on OpenBSD, ZFS maintaining file type information in dirs, everything old is new again, netcat demystified, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.ixsystems.com/blog/zfs-pool-performance-1/"&gt;Six Metrics for Measuring ZFS Pool Performance Part 1&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The layout of a ZFS storage pool has a significant impact on system performance under various workloads. Given the importance of picking the right configuration for your workload and the fact that making changes to an in-use ZFS pool is far from trivial, it is important for an administrator to understand the mechanics of pool performance when designing a storage system.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;To quantify pool performance, we will consider six primary metrics:&lt;/li&gt;
&lt;li&gt;Read I/O operations per second (IOPS)&lt;/li&gt;
&lt;li&gt;Write IOPS&lt;/li&gt;
&lt;li&gt;Streaming read speed&lt;/li&gt;
&lt;li&gt;Streaming write speed&lt;/li&gt;
&lt;li&gt;Storage space efficiency (usable capacity after parity versus total raw capacity)&lt;/li&gt;
&lt;li&gt;Fault tolerance (maximum number of drives that can fail before data loss)&lt;/li&gt;
&lt;li&gt;For the sake of comparison, we’ll use an example system with 12 drives, each one sized at 6TB, and say that each drive does 100MB/s streaming reads and writes and can do 250 read and write IOPS. We will visualize how the data is spread across the drives by writing 12 multi-colored blocks, shown below. The blocks are written to the pool starting with the brown block on the left (number one), and working our way to the pink block on the right (number 12).&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Note that when we calculate data rates and IOPS values for the example system, they are only approximations. Many other factors can impact pool access speeds for better (compression, caching) or worse (poor CPU performance, not enough memory).&lt;br&gt;
There is no single configuration that maximizes all six metrics. Like so many things in life, our objective is to find an appropriate balance of the metrics to match a target workload. For example, a cold-storage backup system will likely want a pool configuration that emphasizes usable storage space and fault tolerance over the other data-rate focused metrics.&lt;br&gt;
Let’s start with a quick review of ZFS storage pools before diving into specific configuration options. ZFS storage pools are comprised of one or more virtual devices, or vdevs. Each vdev is comprised of one or more storage providers, typically physical hard disks. All disk-level redundancy is configured at the vdev level. That is, the RAID layout is set on each vdev as opposed to on the storage pool. Data written to the storage pool is then striped across all the vdevs. Because pool data is striped across the vdevs, the loss of any one vdev means total pool failure. This is perhaps the single most important fact to keep in mind when designing a ZFS storage system. We will circle back to this point in the next post, but keep it in mind as we go through the vdev configuration options.&lt;br&gt;
Because storage pools are made up of one or more vdevs with the pool data striped over the top, we’ll take a look at pool configuration in terms of various vdev configurations. There are three basic vdev configurations: striping, mirroring, and RAIDZ (which itself has three different varieties). The first section will cover striped and mirrored vdevs in this post; the second post will cover RAIDZ and some example scenarios.&lt;br&gt;
A striped vdev is the simplest configuration. Each vdev consists of a single disk with no redundancy. When several of these single-disk, striped vdevs are combined into a single storage pool, the total usable storage space would be the sum of all the drives. When you write data to a pool made of striped vdevs, the data is broken into small chunks called “blocks” and distributed across all the disks in the pool. The blocks are written in “round-robin” sequence, meaning after all the disks receive one row of blocks, called a stripe, it loops back around and writes another stripe under the first. A striped pool has excellent performance and storage space efficiency, but absolutely zero fault tolerance. If even a single drive in the pool fails, the entire pool will fail and all data stored on that pool will be lost.&lt;br&gt;
The excellent performance of a striped pool comes from the fact that all of the disks can work independently for all read and write operations. If you have a bunch of small read or write operations (IOPS), each disk can work independently to fetch the next block. For streaming reads and writes, each disk can fetch the next block in line synchronized with its neighbors. For example, if a given disk is fetching block n, its neighbor to the left can be fetching block n-1, and its neighbor to the right can be fetching block n+1. Therefore, the speed of all read and write operations as well as the quantity of read and write operations (IOPS) on a striped pool will scale with the number of vdevs. Note here that I said the speeds and IOPS scale with the number of vdevs rather than the number of drives; there’s a reason for this and we’ll cover it in the next post when we discuss RAID-Z.&lt;br&gt;
Here’s a summary of the total pool performance (where N is the number of disks in the pool):&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;N-wide striped:&lt;/li&gt;
&lt;li&gt;Read IOPS: N * Read IOPS of a single drive&lt;/li&gt;
&lt;li&gt;Write IOPS: N * Write IOPS of a single drive&lt;/li&gt;
&lt;li&gt;Streaming read speed: N * Streaming read speed of a single drive&lt;/li&gt;
&lt;li&gt;Streaming write speed: N * Streaming write speed of a single drive&lt;/li&gt;
&lt;li&gt;Storage space efficiency: 100%&lt;/li&gt;
&lt;li&gt;Fault tolerance: None!&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Let’s apply this to our example system, configured with a 12-wide striped pool:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;12-wide striped:&lt;/li&gt;
&lt;li&gt;Read IOPS: 3000&lt;/li&gt;
&lt;li&gt;Write IOPS: 3000&lt;/li&gt;
&lt;li&gt;Streaming read speed: 1200 MB/s&lt;/li&gt;
&lt;li&gt;Streaming write speed: 1200 MB/s&lt;/li&gt;
&lt;li&gt;Storage space efficiency: 72 TB&lt;/li&gt;
&lt;li&gt;Fault tolerance: None!&lt;/li&gt;
&lt;li&gt;Below is a visual depiction of our 12 rainbow blocks written to this pool configuration:&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The blocks are simply striped across the 12 disks in the pool. The LBA column on the left stands for “Logical Block Address”. If we treat each disk as a column in an array, each LBA would be a row. It’s also easy to see that if any single disk fails, we would be missing a color in the rainbow and our data would be incomplete. While this configuration has fantastic read and write speeds and can handle a ton of IOPS, the data stored on the pool is very vulnerable. This configuration is not recommended unless you’re comfortable losing all of your pool’s data whenever any single drive fails.&lt;br&gt;
A mirrored vdev consists of two or more disks. A mirrored vdev stores an exact copy of all the data written to it on each one of its drives. Traditional RAID-1 mirrors usually only support two drive mirrors, but ZFS allows for more drives per mirror to increase redundancy and fault tolerance. All disks in a mirrored vdev have to fail for the vdev, and thus the whole pool, to fail. Total storage space will be equal to the size of a single drive in the vdev. If you’re using mismatched drive sizes in your mirrors, the total size will be that of the smallest drive in the mirror.&lt;br&gt;
Streaming read speeds and read IOPS on a mirrored vdev will be faster than write speeds and IOPS. When reading from a mirrored vdev, the drives can “divide and conquer” the operations, similar to what we saw above in the striped pool. This is because each drive in the mirror has an identical copy of the data. For write operations, all of the drives need to write a copy of the data, so the mirrored vdev will be limited to the streaming write speed and IOPS of a single disk.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Here’s a summary:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;N-way mirror:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Read IOPS: N * Read IOPS of a single drive&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Write IOPS: Write IOPS of a single drive&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Streaming read speed: N * Streaming read speed of a single drive&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Streaming write speed: Streaming write speed of a single drive&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Storage space efficiency: 50% for 2-way, 33% for 3-way, 25% for 4-way, etc. [(N-1)/N]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Fault tolerance: 1 disk per vdev for 2-way, 2 for 3-way, 3 for 4-way, etc. [N-1]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;For our first example configuration, let’s do something ridiculous and create a 12-way mirror. ZFS supports this kind of thing, but your management probably will not.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;1x 12-way mirror:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Read IOPS: 3000&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Write IOPS: 250&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Streaming read speed: 1200 MB/s&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Streaming write speed: 100 MB/s&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Storage space efficiency: 8.3% (6 TB)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Fault tolerance: 11&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;As we can clearly see from the diagram, every single disk in the vdev gets a full copy of our rainbow data. The chainlink icons between the disk labels in the column headers indicate the disks are part of a single vdev. We can lose up to 11 disks in this vdev and still have a complete rainbow. Of course, the data takes up far too much room on the pool, occupying a full 12 LBAs in the data array.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Obviously, this is far from the best use of 12 drives. Let’s do something a little more practical and configure the pool with the ZFS equivalent of RAID-10. We’ll configure six 2-way mirror vdevs. ZFS will stripe the data across all 6 of the vdevs. We can use the work we did in the striped vdev section to determine how the pool as a whole will behave. Let’s first calculate the performance per vdev, then we can work on the full pool:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;1x 2-way mirror:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Read IOPS: 500&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Write IOPS: 250&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Streaming read speed: 200 MB/s&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Streaming write speed: 100 MB/s&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Storage space efficiency: 50% (6 TB)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Fault tolerance: 1&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Now we can pretend we have 6 drives with the performance statistics listed above and run them through our striped vdev performance calculator to get the total pool’s performance:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;6x 2-way mirror:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Read IOPS: 3000&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Write IOPS: 1500&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Streaming read speed: 3000 MB/s&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Streaming write speed: 1500 MB/s&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Storage space efficiency: 50% (36 TB)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Fault tolerance: 1 per vdev, 6 total&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Again, we will examine the configuration from a visual perspective:&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Each vdev gets a block of data and ZFS writes that data to all of (or in this case, both of) the disks in the mirror. As long as we have at least one functional disk in each vdev, we can retrieve our rainbow. As before, the chain link icons denote the disks are part of a single vdev. This configuration emphasizes performance over raw capacity but doesn’t totally disregard fault tolerance as our striped pool did. It’s a very popular configuration for systems that need a lot of fast I/O. Let’s look at one more example configuration using four 3-way mirrors. We’ll skip the individual vdev performance calculation and go straight to the full pool:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;4x 3-way mirror:&lt;/li&gt;
&lt;li&gt;Read IOPS: 3000&lt;/li&gt;
&lt;li&gt;Write IOPS: 1000&lt;/li&gt;
&lt;li&gt;Streaming read speed: 3000 MB/s&lt;/li&gt;
&lt;li&gt;Streaming write speed: 400 MB/s&lt;/li&gt;
&lt;li&gt;Storage space efficiency: 33% (24 TB)&lt;/li&gt;
&lt;li&gt;Fault tolerance: 2 per vdev, 8 total&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;While we have sacrificed some write performance and capacity, the pool is now extremely fault tolerant. This configuration is probably not practical for most applications and it would make more sense to use lower fault tolerance and set up an offsite backup system.&lt;br&gt;
Striped and mirrored vdevs are fantastic for access speed performance, but they either leave you with no redundancy whatsoever or impose at least a 50% penalty on the total usable space of your pool. In the next post, we will cover RAIDZ, which lets you keep data redundancy without sacrificing as much storage space efficiency. We’ll also look at some example workload scenarios and decide which layout would be the best fit for each.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://chown.me/blog/2FA-with-ssh-on-OpenBSD.html"&gt;2FA with ssh on OpenBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Five years ago I wrote about using a yubikey on OpenBSD. The only problem with doing this is that there’s no validation server available on OpenBSD, so you need to use a different OTP slot for each machine. (You don’t want to risk a replay attack if someone succeeds in capturing an OTP on one machine, right?) Yubikey has two OTP slots per device, so you would need a yubikey for every two machines with which you’d like to use it. You could use a bastion—and use only one yubikey—but I don’t like the SPOF aspect of a bastion. YMMV.&lt;br&gt;
After I played with TOTP, I wanted to use them as a 2FA for ssh. At the time of writing, we can’t do that using only the tools in base. This article focuses on OpenBSD; if you use another operating system, here are two handy links.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;SEED CONFIGURATION&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The first thing we need to do is to install the software which will be used to verify the OTPs we submit.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;# pkgadd loginoath&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;We need to create a secret - aka, the seed - that will be used to calculate the Time-based One-Time Passwords. We should make sure no one can read or change it.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;$ openssl rand -hex 20 &amp;gt; ~/.totp-key&lt;/code&gt;&lt;br&gt;
&lt;code&gt;$ chmod 400 ~/.totp-key&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Now we have a hexadecimal key, but apps usually want a base32 secret. I initially wrote a small script to do the conversion.&lt;br&gt;
While writing this article, I took the opportunity to improve it. When I initially wrote this utility for my use, python-qrcode hadn’t yet been imported to the OpenBSD ports/packages system. It’s easy to install now, so let’s use it.&lt;br&gt;
Here’s the improved version. It will ask for the hex key and output the secret as a base32-encoded string, both with and without spacing so you can copy-paste it into your password manager or easily retype it. It will then ask for the information needed to generate a QR code. Adding our new OTP secret to any mobile app using the QR code will be super easy!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;SYSTEM CONFIGURATION&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;We can now move to the configuration of the system to put our new TOTP to use. As you might guess, it’s going to be quite close to what we did with the yubikey.&lt;br&gt;
We need to tweak login.conf. Be careful and keep a root shell open at all times. The few times I broke my OpenBSD were because I messed with login.conf without showing enough care.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;SSHD CONFIGURATION&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Again, keeping a root shell around decreases the risk of losing access to the system and being locked outside.&lt;br&gt;
A good standard is to use PasswordAuthentication no and to use public key only. Except… have a guess what the P stands for in TOTP. Yes, congrats, you guessed it!&lt;br&gt;
We need to switch to PasswordAuthentication yes. However, if we made this change alone, sshd would then accept a public key OR a password (which are TOTP because of our login.conf). 2FA uses both at the same time.&lt;br&gt;
To inform sshd we intend to use both, we need to set AuthenticationMethods publickey,password. This way, the user trying to login will first need to perform the traditional publickey authentication. Once that’s done, ssh will prompt for a password and the user will need to submit a valid TOTP for the system.&lt;br&gt;
We could do this the other way around, but I think bots could try passwords, wasting resources. Evaluated in this order, failing to provide a public key leads to sshd immediately declining your attempt.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;IMPROVING SECURITY WITHOUT IMPACTING UX&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;My phone has a long enough password that most of the time, I fail to type it correctly on the first try. Of course, if I had to unlock my phone, launch my TOTP app and use my keyboard to enter what I see on my phone’s screen, I would quickly disable 2FA.&lt;br&gt;
To find a balance, I have whitelisted certain IP addresses and users. If I connect from a particular IP address or as a specific user, I don’t want to go through 2FA. For some users, I might not even enable 2FA.&lt;br&gt;
To sum up, we covered how to create a seed, how to perform a hexadecimal to base32 conversion and how to create a QR code for mobile applications. We configured the login system with login.conf so that ssh authentication uses the TOTP login system, and we told sshd to ask for both the public key and the Time-based One-Time Password. Now you should be all set to use two-factor ssh authentication on OpenBSD!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSAndDirectoryDType"&gt;How ZFS maintains file type information in directories&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;As an aside in yesterday’s history of file type information being available in Unix directories, I mentioned that it was possible for a filesystem to support this even though its Unix didn’t. By supporting it, I mean that the filesystem maintains this information in its on disk format for directories, even though the rest of the kernel will never ask for it. This is what ZFS does.&lt;br&gt;
The easiest way to see that ZFS does this is to use zdb to dump a directory. I’m going to do this on an OmniOS machine, to make it more convincing, and it turns out that this has some interesting results. Since this is OmniOS, we don’t have the convenience of just naming a directory in zdb, so let’s find the root directory of a filesystem, starting from dnode 1 (as seen before).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;# zdb -dddd fs3-corestaff-01/h/281 1&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Dataset [....]&lt;/code&gt;&lt;br&gt;
&lt;code&gt;[...]&lt;/code&gt;&lt;br&gt;
&lt;code&gt;microzap: 512 bytes, 4 entries&lt;/code&gt;&lt;br&gt;
&lt;code&gt;[...]&lt;/code&gt;&lt;br&gt;
&lt;code&gt;ROOT = 3&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;# zdb -dddd fs3-corestaff-01/h/281 3&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Object lvl iblk dblk dsize lsize %full type&lt;/code&gt;&lt;br&gt;
&lt;code&gt;3 1 16K 1K 8K 1K 100.00 ZFS directory&lt;/code&gt;&lt;br&gt;
&lt;code&gt;[...]&lt;/code&gt;&lt;br&gt;
&lt;code&gt;microzap: 1024 bytes, 8 entries&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;RESTORED = 4396504 (type: Directory)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;ckstst = 12017 (type: not specified)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;ckstst3 = 25069 (type: Directory)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;.demo-file = 5832188 (type: Regular File)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;.peergroup = 12590 (type: not specified)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;cks = 5 (type: not specified)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;cksimap1 = 5247832 (type: Directory)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;.diskuse = 12016 (type: not specified)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;ckstst2 = 12535 (type: not specified)&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;This is actually an old filesystem (it dates from Solaris 10 and has been transferred around with ‘zfs send | zfs recv’ since then), but various home directories for real and test users have been created in it over time (you can probably guess which one is the oldest one). Sufficiently old directories and files have no file type information, but more recent ones have this information, including .demo-file, which I made just now so this would have an entry that was a regular file with type information.&lt;br&gt;
Once I dug into it, this turned out to be a change introduced (or activated) in ZFS filesystem version 2, which is described in ‘zfs upgrade -v’ as ‘enhanced directory entries’. As an actual change in (Open)Solaris, it dates from mid 2007, although I’m not sure what Solaris release it made it into. The upshot is that if you made your ZFS filesystem any time in the last decade, you’ll have this file type information in your directories.&lt;br&gt;
How ZFS stores this file type information is interesting and clever, especially when it comes to backwards compatibility. I’ll start by quoting the comment from zfs_znode.h:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;/*&lt;/code&gt;&lt;br&gt;
&lt;code&gt;* The directory entry has the type (currently unused on&lt;/code&gt;&lt;br&gt;
&lt;code&gt;* Solaris) in the top 4 bits, and the object number in&lt;/code&gt;&lt;br&gt;
&lt;code&gt;* the low 48 bits. The "middle" 12 bits are unused.&lt;/code&gt;&lt;br&gt;
&lt;code&gt;*/&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;In yesterday’s entry I said that Unix directory entries need to store at least the filename and the inode number of the file. What ZFS is doing here is reusing the 64 bit field used for the ‘inode’ (the ZFS dnode number) to also store the file type, because it knows that object numbers have only a limited range. This also makes old directory entries compatible, by making type 0 (all 4 bits 0) mean ‘not specified’. Since old directory entries only stored the object number and the object number is 48 bits or less, the higher bits are guaranteed to be all zero.&lt;br&gt;
The reason this needed a new ZFS filesystem version is now clear. If you tried to read directory entries with file type information on a version of ZFS that didn’t know about them, the old version would likely see crazy (and non-existent) object numbers and nothing would work. In order to even read a ‘file type in directory entries’ filesystem, you need to know to only look at the low 48 bits of the object number field in directory entries.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://euroquis.nl/bobulate/?p=1976"&gt;Everything old is new again&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Just because KDE4-era software has been deprecated by the KDE-FreeBSD team in the official ports-repository, doesn’t mean we don’t care for it while we still need to. KDE4 was released on January 11th, 2008 — I still have the T-shirt — which was a very different C++ world than what we now live in. Much of the code pre-dates the availability of C&lt;ins&gt;11 — certainly the availability of compilers with C&lt;/ins&gt;11 support. The language has changed a great deal in those ten years since the original release.&lt;br&gt;
The platforms we run KDE code on have, too — FreeBSD 12 is a long way from the FreeBSD 6 or 7 that were current at release (although at the time, I was more into OpenSolaris). In particular, since then the FreeBSD world has switched over to Clang, and FreeBSD current is experimenting with Clang 7. So we’re seeing KDE4-era code being built, and running, on FreeBSD 12 with Clang 7. That’s a platform with a very different idea of what constitutes correct code, than what the code was originally written for. (Not quite as big a difference as Helio’s KDE1 efforts, though)&lt;br&gt;
So, while we’re counting down to removing KDE4 from the FreeBSD ports tree, we’re also going through and fixing it to work with Clang 7, which defaults to a newer C++ standard and which is quite picky about some things. Some time in the distant past, when pointers were integers and NULL was zero, there was some confusion about booleans. So there’s lots of code that does list.contains(element) &amp;gt; 0 … this must have been a trick before booleans were a supported type in all our compilers. In any case it breaks with Clang 7, since contains() returns a QBool which converts to a nullptr (when false) which isn’t comparable to the integer 0. Suffice to say I’ve spent more time reading KDE4-era code this month, than in the past two years.&lt;br&gt;
However, work is proceeding apace, so if you really really want to, you can still get your old-school kicks on a new platform. Because we care about packaging things right, even when we want to get rid of it.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://nanxiao.gitbooks.io/openbsd-netcat-demystified/"&gt;OpenBSD netcat demystified&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Owing to its versatile functionalities, netcat earns the reputation as “TCP/IP Swiss army knife”. For example, you can create a simple chat app using netcat:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;(1) Open a terminal and input following command:&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;# nc -l 3003&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;This means a netcat process will listen on 3003 port in this machine (the IP address of current machine is 192.168.35.176).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;(2) Connect aforemontioned netcat process in another machine, and send a greeting:&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;# nc 192.168.35.176 3003&lt;/code&gt;&lt;br&gt;
&lt;code&gt;hello&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Then in the first machine’s terminal, you will see the “hello” text:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;# nc -l 3003&lt;/code&gt;&lt;br&gt;
&lt;code&gt;hello&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;A primitive chatroom is built successfully. Very cool! Isn’t it? I think many people can’t wait to explore more features of netcatnow. If you are among them, congratulations! This tutorial may be the correct place for you.&lt;br&gt;
In the following parts, I will delve into OpenBSD’s netcatcode to give a detailed anatomy of it. The reason of picking OpenBSD’s netcat rather than others’ is because its code repository is small (~2000 lines of code) and neat. Furthermore, I also hope this little book can assist you learn more socket programming knowledge not just grasping usage of netcat.&lt;br&gt;
We’re all set. Let’s go!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.geeklan.co.uk/files/eurobsdcon2018.pdf"&gt;What’s in store for NetBSD 9.0&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mail-index.netbsd.org/netbsd-advocacy/2018/09/25/msg000783.html"&gt;NetBSD machines at Open Source Conference 2018 Hiroshima&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://vincentdelft.be/post/post_20180922"&gt;nmctl adapted with limited privileges: nmctl-0.6.0&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/blog/submit-your-work-check-out-scale-17x-and-fosdem-19-cfps/"&gt;Submit Your Work: Check out SCALE 17x and FOSDEM ’19 CFPs&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.openbsd.org/64.html"&gt;OpenBSD 6.4 site is up! (with a partial list of new features)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.blackcatenterprises.us/using-alpine-to-read-your-email/"&gt;Using Alpine to Read Your Email on OpenBSD&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Morgan - &lt;a href="http://dpaste.com/0EXPWQK#wrap"&gt;Send/Receive to Manage Fragmentation?&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Ryan - &lt;a href="http://dpaste.com/0B6C0Y0"&gt;ZFS and mmap&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Marcus - &lt;a href="http://dpaste.com/1DT26S8#wrap"&gt;Linux Compat&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Ben - &lt;a href="http://dpaste.com/20GTHZE#wrap"&gt;Multiple Pools&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, netcat, kde yubikey, 2fa, ssh, zfs, performance</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>6 metrics for zpool performance, 2FA with ssh on OpenBSD, ZFS maintaining file type information in dirs, everything old is new again, netcat demystified, and more.</p>

<p>##Headlines<br>
###<a href="https://www.ixsystems.com/blog/zfs-pool-performance-1/">Six Metrics for Measuring ZFS Pool Performance Part 1</a></p>

<blockquote>
<p>The layout of a ZFS storage pool has a significant impact on system performance under various workloads. Given the importance of picking the right configuration for your workload and the fact that making changes to an in-use ZFS pool is far from trivial, it is important for an administrator to understand the mechanics of pool performance when designing a storage system.</p>
</blockquote>

<ul>
<li>To quantify pool performance, we will consider six primary metrics:</li>
<li>Read I/O operations per second (IOPS)</li>
<li>Write IOPS</li>
<li>Streaming read speed</li>
<li>Streaming write speed</li>
<li>Storage space efficiency (usable capacity after parity versus total raw capacity)</li>
<li>Fault tolerance (maximum number of drives that can fail before data loss)</li>
<li>For the sake of comparison, we’ll use an example system with 12 drives, each one sized at 6TB, and say that each drive does 100MB/s streaming reads and writes and can do 250 read and write IOPS. We will visualize how the data is spread across the drives by writing 12 multi-colored blocks, shown below. The blocks are written to the pool starting with the brown block on the left (number one), and working our way to the pink block on the right (number 12).</li>
</ul>

<blockquote>
<p>Note that when we calculate data rates and IOPS values for the example system, they are only approximations. Many other factors can impact pool access speeds for better (compression, caching) or worse (poor CPU performance, not enough memory).<br>
There is no single configuration that maximizes all six metrics. Like so many things in life, our objective is to find an appropriate balance of the metrics to match a target workload. For example, a cold-storage backup system will likely want a pool configuration that emphasizes usable storage space and fault tolerance over the other data-rate focused metrics.<br>
Let’s start with a quick review of ZFS storage pools before diving into specific configuration options. ZFS storage pools are comprised of one or more virtual devices, or vdevs. Each vdev is comprised of one or more storage providers, typically physical hard disks. All disk-level redundancy is configured at the vdev level. That is, the RAID layout is set on each vdev as opposed to on the storage pool. Data written to the storage pool is then striped across all the vdevs. Because pool data is striped across the vdevs, the loss of any one vdev means total pool failure. This is perhaps the single most important fact to keep in mind when designing a ZFS storage system. We will circle back to this point in the next post, but keep it in mind as we go through the vdev configuration options.<br>
Because storage pools are made up of one or more vdevs with the pool data striped over the top, we’ll take a look at pool configuration in terms of various vdev configurations. There are three basic vdev configurations: striping, mirroring, and RAIDZ (which itself has three different varieties). The first section will cover striped and mirrored vdevs in this post; the second post will cover RAIDZ and some example scenarios.<br>
A striped vdev is the simplest configuration. Each vdev consists of a single disk with no redundancy. When several of these single-disk, striped vdevs are combined into a single storage pool, the total usable storage space would be the sum of all the drives. When you write data to a pool made of striped vdevs, the data is broken into small chunks called “blocks” and distributed across all the disks in the pool. The blocks are written in “round-robin” sequence, meaning after all the disks receive one row of blocks, called a stripe, it loops back around and writes another stripe under the first. A striped pool has excellent performance and storage space efficiency, but absolutely zero fault tolerance. If even a single drive in the pool fails, the entire pool will fail and all data stored on that pool will be lost.<br>
The excellent performance of a striped pool comes from the fact that all of the disks can work independently for all read and write operations. If you have a bunch of small read or write operations (IOPS), each disk can work independently to fetch the next block. For streaming reads and writes, each disk can fetch the next block in line synchronized with its neighbors. For example, if a given disk is fetching block n, its neighbor to the left can be fetching block n-1, and its neighbor to the right can be fetching block n+1. Therefore, the speed of all read and write operations as well as the quantity of read and write operations (IOPS) on a striped pool will scale with the number of vdevs. Note here that I said the speeds and IOPS scale with the number of vdevs rather than the number of drives; there’s a reason for this and we’ll cover it in the next post when we discuss RAID-Z.<br>
Here’s a summary of the total pool performance (where N is the number of disks in the pool):</p>
</blockquote>

<ul>
<li>N-wide striped:</li>
<li>Read IOPS: N * Read IOPS of a single drive</li>
<li>Write IOPS: N * Write IOPS of a single drive</li>
<li>Streaming read speed: N * Streaming read speed of a single drive</li>
<li>Streaming write speed: N * Streaming write speed of a single drive</li>
<li>Storage space efficiency: 100%</li>
<li>Fault tolerance: None!</li>
</ul>

<blockquote>
<p>Let’s apply this to our example system, configured with a 12-wide striped pool:</p>
</blockquote>

<ul>
<li>12-wide striped:</li>
<li>Read IOPS: 3000</li>
<li>Write IOPS: 3000</li>
<li>Streaming read speed: 1200 MB/s</li>
<li>Streaming write speed: 1200 MB/s</li>
<li>Storage space efficiency: 72 TB</li>
<li>Fault tolerance: None!</li>
<li>Below is a visual depiction of our 12 rainbow blocks written to this pool configuration:</li>
</ul>

<blockquote>
<p>The blocks are simply striped across the 12 disks in the pool. The LBA column on the left stands for “Logical Block Address”. If we treat each disk as a column in an array, each LBA would be a row. It’s also easy to see that if any single disk fails, we would be missing a color in the rainbow and our data would be incomplete. While this configuration has fantastic read and write speeds and can handle a ton of IOPS, the data stored on the pool is very vulnerable. This configuration is not recommended unless you’re comfortable losing all of your pool’s data whenever any single drive fails.<br>
A mirrored vdev consists of two or more disks. A mirrored vdev stores an exact copy of all the data written to it on each one of its drives. Traditional RAID-1 mirrors usually only support two drive mirrors, but ZFS allows for more drives per mirror to increase redundancy and fault tolerance. All disks in a mirrored vdev have to fail for the vdev, and thus the whole pool, to fail. Total storage space will be equal to the size of a single drive in the vdev. If you’re using mismatched drive sizes in your mirrors, the total size will be that of the smallest drive in the mirror.<br>
Streaming read speeds and read IOPS on a mirrored vdev will be faster than write speeds and IOPS. When reading from a mirrored vdev, the drives can “divide and conquer” the operations, similar to what we saw above in the striped pool. This is because each drive in the mirror has an identical copy of the data. For write operations, all of the drives need to write a copy of the data, so the mirrored vdev will be limited to the streaming write speed and IOPS of a single disk.</p>
</blockquote>

<blockquote>
<p>Here’s a summary:</p>
</blockquote>

<ul>
<li>
<p>N-way mirror:</p>
</li>
<li>
<p>Read IOPS: N * Read IOPS of a single drive</p>
</li>
<li>
<p>Write IOPS: Write IOPS of a single drive</p>
</li>
<li>
<p>Streaming read speed: N * Streaming read speed of a single drive</p>
</li>
<li>
<p>Streaming write speed: Streaming write speed of a single drive</p>
</li>
<li>
<p>Storage space efficiency: 50% for 2-way, 33% for 3-way, 25% for 4-way, etc. [(N-1)/N]</p>
</li>
<li>
<p>Fault tolerance: 1 disk per vdev for 2-way, 2 for 3-way, 3 for 4-way, etc. [N-1]</p>
</li>
<li>
<p>For our first example configuration, let’s do something ridiculous and create a 12-way mirror. ZFS supports this kind of thing, but your management probably will not.</p>
</li>
<li>
<p>1x 12-way mirror:</p>
</li>
<li>
<p>Read IOPS: 3000</p>
</li>
<li>
<p>Write IOPS: 250</p>
</li>
<li>
<p>Streaming read speed: 1200 MB/s</p>
</li>
<li>
<p>Streaming write speed: 100 MB/s</p>
</li>
<li>
<p>Storage space efficiency: 8.3% (6 TB)</p>
</li>
<li>
<p>Fault tolerance: 11</p>
</li>
</ul>

<blockquote>
<p>As we can clearly see from the diagram, every single disk in the vdev gets a full copy of our rainbow data. The chainlink icons between the disk labels in the column headers indicate the disks are part of a single vdev. We can lose up to 11 disks in this vdev and still have a complete rainbow. Of course, the data takes up far too much room on the pool, occupying a full 12 LBAs in the data array.</p>
</blockquote>

<blockquote>
<p>Obviously, this is far from the best use of 12 drives. Let’s do something a little more practical and configure the pool with the ZFS equivalent of RAID-10. We’ll configure six 2-way mirror vdevs. ZFS will stripe the data across all 6 of the vdevs. We can use the work we did in the striped vdev section to determine how the pool as a whole will behave. Let’s first calculate the performance per vdev, then we can work on the full pool:</p>
</blockquote>

<ul>
<li>
<p>1x 2-way mirror:</p>
</li>
<li>
<p>Read IOPS: 500</p>
</li>
<li>
<p>Write IOPS: 250</p>
</li>
<li>
<p>Streaming read speed: 200 MB/s</p>
</li>
<li>
<p>Streaming write speed: 100 MB/s</p>
</li>
<li>
<p>Storage space efficiency: 50% (6 TB)</p>
</li>
<li>
<p>Fault tolerance: 1</p>
</li>
<li>
<p>Now we can pretend we have 6 drives with the performance statistics listed above and run them through our striped vdev performance calculator to get the total pool’s performance:</p>
</li>
<li>
<p>6x 2-way mirror:</p>
</li>
<li>
<p>Read IOPS: 3000</p>
</li>
<li>
<p>Write IOPS: 1500</p>
</li>
<li>
<p>Streaming read speed: 3000 MB/s</p>
</li>
<li>
<p>Streaming write speed: 1500 MB/s</p>
</li>
<li>
<p>Storage space efficiency: 50% (36 TB)</p>
</li>
<li>
<p>Fault tolerance: 1 per vdev, 6 total</p>
</li>
<li>
<p>Again, we will examine the configuration from a visual perspective:</p>
</li>
</ul>

<blockquote>
<p>Each vdev gets a block of data and ZFS writes that data to all of (or in this case, both of) the disks in the mirror. As long as we have at least one functional disk in each vdev, we can retrieve our rainbow. As before, the chain link icons denote the disks are part of a single vdev. This configuration emphasizes performance over raw capacity but doesn’t totally disregard fault tolerance as our striped pool did. It’s a very popular configuration for systems that need a lot of fast I/O. Let’s look at one more example configuration using four 3-way mirrors. We’ll skip the individual vdev performance calculation and go straight to the full pool:</p>
</blockquote>

<ul>
<li>4x 3-way mirror:</li>
<li>Read IOPS: 3000</li>
<li>Write IOPS: 1000</li>
<li>Streaming read speed: 3000 MB/s</li>
<li>Streaming write speed: 400 MB/s</li>
<li>Storage space efficiency: 33% (24 TB)</li>
<li>Fault tolerance: 2 per vdev, 8 total</li>
</ul>

<blockquote>
<p>While we have sacrificed some write performance and capacity, the pool is now extremely fault tolerant. This configuration is probably not practical for most applications and it would make more sense to use lower fault tolerance and set up an offsite backup system.<br>
Striped and mirrored vdevs are fantastic for access speed performance, but they either leave you with no redundancy whatsoever or impose at least a 50% penalty on the total usable space of your pool. In the next post, we will cover RAIDZ, which lets you keep data redundancy without sacrificing as much storage space efficiency. We’ll also look at some example workload scenarios and decide which layout would be the best fit for each.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://chown.me/blog/2FA-with-ssh-on-OpenBSD.html">2FA with ssh on OpenBSD</a></p>

<blockquote>
<p>Five years ago I wrote about using a yubikey on OpenBSD. The only problem with doing this is that there’s no validation server available on OpenBSD, so you need to use a different OTP slot for each machine. (You don’t want to risk a replay attack if someone succeeds in capturing an OTP on one machine, right?) Yubikey has two OTP slots per device, so you would need a yubikey for every two machines with which you’d like to use it. You could use a bastion—and use only one yubikey—but I don’t like the SPOF aspect of a bastion. YMMV.<br>
After I played with TOTP, I wanted to use them as a 2FA for ssh. At the time of writing, we can’t do that using only the tools in base. This article focuses on OpenBSD; if you use another operating system, here are two handy links.</p>
</blockquote>

<ul>
<li>SEED CONFIGURATION</li>
</ul>

<blockquote>
<p>The first thing we need to do is to install the software which will be used to verify the OTPs we submit.</p>
</blockquote>

<p><code># pkg_add login_oath</code></p>

<blockquote>
<p>We need to create a secret - aka, the seed - that will be used to calculate the Time-based One-Time Passwords. We should make sure no one can read or change it.</p>
</blockquote>

<p><code>$ openssl rand -hex 20 &gt; ~/.totp-key</code><br>
<code>$ chmod 400 ~/.totp-key</code></p>

<blockquote>
<p>Now we have a hexadecimal key, but apps usually want a base32 secret. I initially wrote a small script to do the conversion.<br>
While writing this article, I took the opportunity to improve it. When I initially wrote this utility for my use, python-qrcode hadn’t yet been imported to the OpenBSD ports/packages system. It’s easy to install now, so let’s use it.<br>
Here’s the improved version. It will ask for the hex key and output the secret as a base32-encoded string, both with and without spacing so you can copy-paste it into your password manager or easily retype it. It will then ask for the information needed to generate a QR code. Adding our new OTP secret to any mobile app using the QR code will be super easy!</p>
</blockquote>

<ul>
<li>SYSTEM CONFIGURATION</li>
</ul>

<blockquote>
<p>We can now move to the configuration of the system to put our new TOTP to use. As you might guess, it’s going to be quite close to what we did with the yubikey.<br>
We need to tweak login.conf. Be careful and keep a root shell open at all times. The few times I broke my OpenBSD were because I messed with login.conf without showing enough care.</p>
</blockquote>

<ul>
<li>SSHD CONFIGURATION</li>
</ul>

<blockquote>
<p>Again, keeping a root shell around decreases the risk of losing access to the system and being locked outside.<br>
A good standard is to use PasswordAuthentication no and to use public key only. Except… have a guess what the P stands for in TOTP. Yes, congrats, you guessed it!<br>
We need to switch to PasswordAuthentication yes. However, if we made this change alone, sshd would then accept a public key OR a password (which are TOTP because of our login.conf). 2FA uses both at the same time.<br>
To inform sshd we intend to use both, we need to set AuthenticationMethods publickey,password. This way, the user trying to login will first need to perform the traditional publickey authentication. Once that’s done, ssh will prompt for a password and the user will need to submit a valid TOTP for the system.<br>
We could do this the other way around, but I think bots could try passwords, wasting resources. Evaluated in this order, failing to provide a public key leads to sshd immediately declining your attempt.</p>
</blockquote>

<ul>
<li>IMPROVING SECURITY WITHOUT IMPACTING UX</li>
</ul>

<blockquote>
<p>My phone has a long enough password that most of the time, I fail to type it correctly on the first try. Of course, if I had to unlock my phone, launch my TOTP app and use my keyboard to enter what I see on my phone’s screen, I would quickly disable 2FA.<br>
To find a balance, I have whitelisted certain IP addresses and users. If I connect from a particular IP address or as a specific user, I don’t want to go through 2FA. For some users, I might not even enable 2FA.<br>
To sum up, we covered how to create a seed, how to perform a hexadecimal to base32 conversion and how to create a QR code for mobile applications. We configured the login system with login.conf so that ssh authentication uses the TOTP login system, and we told sshd to ask for both the public key and the Time-based One-Time Password. Now you should be all set to use two-factor ssh authentication on OpenBSD!</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSAndDirectoryDType">How ZFS maintains file type information in directories</a></p>

<blockquote>
<p>As an aside in yesterday’s history of file type information being available in Unix directories, I mentioned that it was possible for a filesystem to support this even though its Unix didn’t. By supporting it, I mean that the filesystem maintains this information in its on disk format for directories, even though the rest of the kernel will never ask for it. This is what ZFS does.<br>
The easiest way to see that ZFS does this is to use zdb to dump a directory. I’m going to do this on an OmniOS machine, to make it more convincing, and it turns out that this has some interesting results. Since this is OmniOS, we don’t have the convenience of just naming a directory in zdb, so let’s find the root directory of a filesystem, starting from dnode 1 (as seen before).</p>
</blockquote>

<p><code># zdb -dddd fs3-corestaff-01/h/281 1</code><br>
<code>Dataset [....]</code><br>
<code>[...]</code><br>
<code>microzap: 512 bytes, 4 entries</code><br>
<code>[...]</code><br>
<code>ROOT = 3</code><br>
<code></code><br>
<code># zdb -dddd fs3-corestaff-01/h/281 3</code><br>
<code>Object lvl iblk dblk dsize lsize %full type</code><br>
<code>3 1 16K 1K 8K 1K 100.00 ZFS directory</code><br>
<code>[...]</code><br>
<code>microzap: 1024 bytes, 8 entries</code><br>
<code></code><br>
<code>RESTORED = 4396504 (type: Directory)</code><br>
<code>ckstst = 12017 (type: not specified)</code><br>
<code>ckstst3 = 25069 (type: Directory)</code><br>
<code>.demo-file = 5832188 (type: Regular File)</code><br>
<code>.peergroup = 12590 (type: not specified)</code><br>
<code>cks = 5 (type: not specified)</code><br>
<code>cksimap1 = 5247832 (type: Directory)</code><br>
<code>.diskuse = 12016 (type: not specified)</code><br>
<code>ckstst2 = 12535 (type: not specified)</code></p>

<blockquote>
<p>This is actually an old filesystem (it dates from Solaris 10 and has been transferred around with ‘zfs send | zfs recv’ since then), but various home directories for real and test users have been created in it over time (you can probably guess which one is the oldest one). Sufficiently old directories and files have no file type information, but more recent ones have this information, including .demo-file, which I made just now so this would have an entry that was a regular file with type information.<br>
Once I dug into it, this turned out to be a change introduced (or activated) in ZFS filesystem version 2, which is described in ‘zfs upgrade -v’ as ‘enhanced directory entries’. As an actual change in (Open)Solaris, it dates from mid 2007, although I’m not sure what Solaris release it made it into. The upshot is that if you made your ZFS filesystem any time in the last decade, you’ll have this file type information in your directories.<br>
How ZFS stores this file type information is interesting and clever, especially when it comes to backwards compatibility. I’ll start by quoting the comment from zfs_znode.h:</p>
</blockquote>

<p><code>/*</code><br>
<code>* The directory entry has the type (currently unused on</code><br>
<code>* Solaris) in the top 4 bits, and the object number in</code><br>
<code>* the low 48 bits. The &quot;middle&quot; 12 bits are unused.</code><br>
<code>*/</code></p>

<blockquote>
<p>In yesterday’s entry I said that Unix directory entries need to store at least the filename and the inode number of the file. What ZFS is doing here is reusing the 64 bit field used for the ‘inode’ (the ZFS dnode number) to also store the file type, because it knows that object numbers have only a limited range. This also makes old directory entries compatible, by making type 0 (all 4 bits 0) mean ‘not specified’. Since old directory entries only stored the object number and the object number is 48 bits or less, the higher bits are guaranteed to be all zero.<br>
The reason this needed a new ZFS filesystem version is now clear. If you tried to read directory entries with file type information on a version of ZFS that didn’t know about them, the old version would likely see crazy (and non-existent) object numbers and nothing would work. In order to even read a ‘file type in directory entries’ filesystem, you need to know to only look at the low 48 bits of the object number field in directory entries.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://euroquis.nl/bobulate/?p=1976">Everything old is new again</a></p>

<blockquote>
<p>Just because KDE4-era software has been deprecated by the KDE-FreeBSD team in the official ports-repository, doesn’t mean we don’t care for it while we still need to. KDE4 was released on January 11th, 2008 — I still have the T-shirt — which was a very different C++ world than what we now live in. Much of the code pre-dates the availability of C<ins>11 — certainly the availability of compilers with C</ins>11 support. The language has changed a great deal in those ten years since the original release.<br>
The platforms we run KDE code on have, too — FreeBSD 12 is a long way from the FreeBSD 6 or 7 that were current at release (although at the time, I was more into OpenSolaris). In particular, since then the FreeBSD world has switched over to Clang, and FreeBSD current is experimenting with Clang 7. So we’re seeing KDE4-era code being built, and running, on FreeBSD 12 with Clang 7. That’s a platform with a very different idea of what constitutes correct code, than what the code was originally written for. (Not quite as big a difference as Helio’s KDE1 efforts, though)<br>
So, while we’re counting down to removing KDE4 from the FreeBSD ports tree, we’re also going through and fixing it to work with Clang 7, which defaults to a newer C++ standard and which is quite picky about some things. Some time in the distant past, when pointers were integers and NULL was zero, there was some confusion about booleans. So there’s lots of code that does list.contains(element) &gt; 0 … this must have been a trick before booleans were a supported type in all our compilers. In any case it breaks with Clang 7, since contains() returns a QBool which converts to a nullptr (when false) which isn’t comparable to the integer 0. Suffice to say I’ve spent more time reading KDE4-era code this month, than in the past two years.<br>
However, work is proceeding apace, so if you really really want to, you can still get your old-school kicks on a new platform. Because we care about packaging things right, even when we want to get rid of it.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://nanxiao.gitbooks.io/openbsd-netcat-demystified/">OpenBSD netcat demystified</a></p>

<blockquote>
<p>Owing to its versatile functionalities, netcat earns the reputation as “TCP/IP Swiss army knife”. For example, you can create a simple chat app using netcat:</p>
</blockquote>

<ul>
<li>(1) Open a terminal and input following command:</li>
</ul>

<p><code># nc -l 3003</code></p>

<blockquote>
<p>This means a netcat process will listen on 3003 port in this machine (the IP address of current machine is 192.168.35.176).</p>
</blockquote>

<ul>
<li>(2) Connect aforemontioned netcat process in another machine, and send a greeting:</li>
</ul>

<p><code># nc 192.168.35.176 3003</code><br>
<code>hello</code></p>

<blockquote>
<p>Then in the first machine’s terminal, you will see the “hello” text:</p>
</blockquote>

<p><code># nc -l 3003</code><br>
<code>hello</code></p>

<blockquote>
<p>A primitive chatroom is built successfully. Very cool! Isn’t it? I think many people can’t wait to explore more features of netcatnow. If you are among them, congratulations! This tutorial may be the correct place for you.<br>
In the following parts, I will delve into OpenBSD’s netcatcode to give a detailed anatomy of it. The reason of picking OpenBSD’s netcat rather than others’ is because its code repository is small (~2000 lines of code) and neat. Furthermore, I also hope this little book can assist you learn more socket programming knowledge not just grasping usage of netcat.<br>
We’re all set. Let’s go!</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.geeklan.co.uk/files/eurobsdcon2018.pdf">What’s in store for NetBSD 9.0</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2018/09/25/msg000783.html">NetBSD machines at Open Source Conference 2018 Hiroshima</a></li>
<li><a href="http://vincentdelft.be/post/post_20180922">nmctl adapted with limited privileges: nmctl-0.6.0</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/submit-your-work-check-out-scale-17x-and-fosdem-19-cfps/">Submit Your Work: Check out SCALE 17x and FOSDEM ’19 CFPs</a></li>
<li><a href="https://www.openbsd.org/64.html">OpenBSD 6.4 site is up! (with a partial list of new features)</a></li>
<li><a href="https://www.blackcatenterprises.us/using-alpine-to-read-your-email/">Using Alpine to Read Your Email on OpenBSD</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Morgan - <a href="http://dpaste.com/0EXPWQK#wrap">Send/Receive to Manage Fragmentation?</a></li>
<li>Ryan - <a href="http://dpaste.com/0B6C0Y0">ZFS and mmap</a></li>
<li>Marcus - <a href="http://dpaste.com/1DT26S8#wrap">Linux Compat</a></li>
<li>Ben - <a href="http://dpaste.com/20GTHZE#wrap">Multiple Pools</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>6 metrics for zpool performance, 2FA with ssh on OpenBSD, ZFS maintaining file type information in dirs, everything old is new again, netcat demystified, and more.</p>

<p>##Headlines<br>
###<a href="https://www.ixsystems.com/blog/zfs-pool-performance-1/">Six Metrics for Measuring ZFS Pool Performance Part 1</a></p>

<blockquote>
<p>The layout of a ZFS storage pool has a significant impact on system performance under various workloads. Given the importance of picking the right configuration for your workload and the fact that making changes to an in-use ZFS pool is far from trivial, it is important for an administrator to understand the mechanics of pool performance when designing a storage system.</p>
</blockquote>

<ul>
<li>To quantify pool performance, we will consider six primary metrics:</li>
<li>Read I/O operations per second (IOPS)</li>
<li>Write IOPS</li>
<li>Streaming read speed</li>
<li>Streaming write speed</li>
<li>Storage space efficiency (usable capacity after parity versus total raw capacity)</li>
<li>Fault tolerance (maximum number of drives that can fail before data loss)</li>
<li>For the sake of comparison, we’ll use an example system with 12 drives, each one sized at 6TB, and say that each drive does 100MB/s streaming reads and writes and can do 250 read and write IOPS. We will visualize how the data is spread across the drives by writing 12 multi-colored blocks, shown below. The blocks are written to the pool starting with the brown block on the left (number one), and working our way to the pink block on the right (number 12).</li>
</ul>

<blockquote>
<p>Note that when we calculate data rates and IOPS values for the example system, they are only approximations. Many other factors can impact pool access speeds for better (compression, caching) or worse (poor CPU performance, not enough memory).<br>
There is no single configuration that maximizes all six metrics. Like so many things in life, our objective is to find an appropriate balance of the metrics to match a target workload. For example, a cold-storage backup system will likely want a pool configuration that emphasizes usable storage space and fault tolerance over the other data-rate focused metrics.<br>
Let’s start with a quick review of ZFS storage pools before diving into specific configuration options. ZFS storage pools are comprised of one or more virtual devices, or vdevs. Each vdev is comprised of one or more storage providers, typically physical hard disks. All disk-level redundancy is configured at the vdev level. That is, the RAID layout is set on each vdev as opposed to on the storage pool. Data written to the storage pool is then striped across all the vdevs. Because pool data is striped across the vdevs, the loss of any one vdev means total pool failure. This is perhaps the single most important fact to keep in mind when designing a ZFS storage system. We will circle back to this point in the next post, but keep it in mind as we go through the vdev configuration options.<br>
Because storage pools are made up of one or more vdevs with the pool data striped over the top, we’ll take a look at pool configuration in terms of various vdev configurations. There are three basic vdev configurations: striping, mirroring, and RAIDZ (which itself has three different varieties). The first section will cover striped and mirrored vdevs in this post; the second post will cover RAIDZ and some example scenarios.<br>
A striped vdev is the simplest configuration. Each vdev consists of a single disk with no redundancy. When several of these single-disk, striped vdevs are combined into a single storage pool, the total usable storage space would be the sum of all the drives. When you write data to a pool made of striped vdevs, the data is broken into small chunks called “blocks” and distributed across all the disks in the pool. The blocks are written in “round-robin” sequence, meaning after all the disks receive one row of blocks, called a stripe, it loops back around and writes another stripe under the first. A striped pool has excellent performance and storage space efficiency, but absolutely zero fault tolerance. If even a single drive in the pool fails, the entire pool will fail and all data stored on that pool will be lost.<br>
The excellent performance of a striped pool comes from the fact that all of the disks can work independently for all read and write operations. If you have a bunch of small read or write operations (IOPS), each disk can work independently to fetch the next block. For streaming reads and writes, each disk can fetch the next block in line synchronized with its neighbors. For example, if a given disk is fetching block n, its neighbor to the left can be fetching block n-1, and its neighbor to the right can be fetching block n+1. Therefore, the speed of all read and write operations as well as the quantity of read and write operations (IOPS) on a striped pool will scale with the number of vdevs. Note here that I said the speeds and IOPS scale with the number of vdevs rather than the number of drives; there’s a reason for this and we’ll cover it in the next post when we discuss RAID-Z.<br>
Here’s a summary of the total pool performance (where N is the number of disks in the pool):</p>
</blockquote>

<ul>
<li>N-wide striped:</li>
<li>Read IOPS: N * Read IOPS of a single drive</li>
<li>Write IOPS: N * Write IOPS of a single drive</li>
<li>Streaming read speed: N * Streaming read speed of a single drive</li>
<li>Streaming write speed: N * Streaming write speed of a single drive</li>
<li>Storage space efficiency: 100%</li>
<li>Fault tolerance: None!</li>
</ul>

<blockquote>
<p>Let’s apply this to our example system, configured with a 12-wide striped pool:</p>
</blockquote>

<ul>
<li>12-wide striped:</li>
<li>Read IOPS: 3000</li>
<li>Write IOPS: 3000</li>
<li>Streaming read speed: 1200 MB/s</li>
<li>Streaming write speed: 1200 MB/s</li>
<li>Storage space efficiency: 72 TB</li>
<li>Fault tolerance: None!</li>
<li>Below is a visual depiction of our 12 rainbow blocks written to this pool configuration:</li>
</ul>

<blockquote>
<p>The blocks are simply striped across the 12 disks in the pool. The LBA column on the left stands for “Logical Block Address”. If we treat each disk as a column in an array, each LBA would be a row. It’s also easy to see that if any single disk fails, we would be missing a color in the rainbow and our data would be incomplete. While this configuration has fantastic read and write speeds and can handle a ton of IOPS, the data stored on the pool is very vulnerable. This configuration is not recommended unless you’re comfortable losing all of your pool’s data whenever any single drive fails.<br>
A mirrored vdev consists of two or more disks. A mirrored vdev stores an exact copy of all the data written to it on each one of its drives. Traditional RAID-1 mirrors usually only support two drive mirrors, but ZFS allows for more drives per mirror to increase redundancy and fault tolerance. All disks in a mirrored vdev have to fail for the vdev, and thus the whole pool, to fail. Total storage space will be equal to the size of a single drive in the vdev. If you’re using mismatched drive sizes in your mirrors, the total size will be that of the smallest drive in the mirror.<br>
Streaming read speeds and read IOPS on a mirrored vdev will be faster than write speeds and IOPS. When reading from a mirrored vdev, the drives can “divide and conquer” the operations, similar to what we saw above in the striped pool. This is because each drive in the mirror has an identical copy of the data. For write operations, all of the drives need to write a copy of the data, so the mirrored vdev will be limited to the streaming write speed and IOPS of a single disk.</p>
</blockquote>

<blockquote>
<p>Here’s a summary:</p>
</blockquote>

<ul>
<li>
<p>N-way mirror:</p>
</li>
<li>
<p>Read IOPS: N * Read IOPS of a single drive</p>
</li>
<li>
<p>Write IOPS: Write IOPS of a single drive</p>
</li>
<li>
<p>Streaming read speed: N * Streaming read speed of a single drive</p>
</li>
<li>
<p>Streaming write speed: Streaming write speed of a single drive</p>
</li>
<li>
<p>Storage space efficiency: 50% for 2-way, 33% for 3-way, 25% for 4-way, etc. [(N-1)/N]</p>
</li>
<li>
<p>Fault tolerance: 1 disk per vdev for 2-way, 2 for 3-way, 3 for 4-way, etc. [N-1]</p>
</li>
<li>
<p>For our first example configuration, let’s do something ridiculous and create a 12-way mirror. ZFS supports this kind of thing, but your management probably will not.</p>
</li>
<li>
<p>1x 12-way mirror:</p>
</li>
<li>
<p>Read IOPS: 3000</p>
</li>
<li>
<p>Write IOPS: 250</p>
</li>
<li>
<p>Streaming read speed: 1200 MB/s</p>
</li>
<li>
<p>Streaming write speed: 100 MB/s</p>
</li>
<li>
<p>Storage space efficiency: 8.3% (6 TB)</p>
</li>
<li>
<p>Fault tolerance: 11</p>
</li>
</ul>

<blockquote>
<p>As we can clearly see from the diagram, every single disk in the vdev gets a full copy of our rainbow data. The chainlink icons between the disk labels in the column headers indicate the disks are part of a single vdev. We can lose up to 11 disks in this vdev and still have a complete rainbow. Of course, the data takes up far too much room on the pool, occupying a full 12 LBAs in the data array.</p>
</blockquote>

<blockquote>
<p>Obviously, this is far from the best use of 12 drives. Let’s do something a little more practical and configure the pool with the ZFS equivalent of RAID-10. We’ll configure six 2-way mirror vdevs. ZFS will stripe the data across all 6 of the vdevs. We can use the work we did in the striped vdev section to determine how the pool as a whole will behave. Let’s first calculate the performance per vdev, then we can work on the full pool:</p>
</blockquote>

<ul>
<li>
<p>1x 2-way mirror:</p>
</li>
<li>
<p>Read IOPS: 500</p>
</li>
<li>
<p>Write IOPS: 250</p>
</li>
<li>
<p>Streaming read speed: 200 MB/s</p>
</li>
<li>
<p>Streaming write speed: 100 MB/s</p>
</li>
<li>
<p>Storage space efficiency: 50% (6 TB)</p>
</li>
<li>
<p>Fault tolerance: 1</p>
</li>
<li>
<p>Now we can pretend we have 6 drives with the performance statistics listed above and run them through our striped vdev performance calculator to get the total pool’s performance:</p>
</li>
<li>
<p>6x 2-way mirror:</p>
</li>
<li>
<p>Read IOPS: 3000</p>
</li>
<li>
<p>Write IOPS: 1500</p>
</li>
<li>
<p>Streaming read speed: 3000 MB/s</p>
</li>
<li>
<p>Streaming write speed: 1500 MB/s</p>
</li>
<li>
<p>Storage space efficiency: 50% (36 TB)</p>
</li>
<li>
<p>Fault tolerance: 1 per vdev, 6 total</p>
</li>
<li>
<p>Again, we will examine the configuration from a visual perspective:</p>
</li>
</ul>

<blockquote>
<p>Each vdev gets a block of data and ZFS writes that data to all of (or in this case, both of) the disks in the mirror. As long as we have at least one functional disk in each vdev, we can retrieve our rainbow. As before, the chain link icons denote the disks are part of a single vdev. This configuration emphasizes performance over raw capacity but doesn’t totally disregard fault tolerance as our striped pool did. It’s a very popular configuration for systems that need a lot of fast I/O. Let’s look at one more example configuration using four 3-way mirrors. We’ll skip the individual vdev performance calculation and go straight to the full pool:</p>
</blockquote>

<ul>
<li>4x 3-way mirror:</li>
<li>Read IOPS: 3000</li>
<li>Write IOPS: 1000</li>
<li>Streaming read speed: 3000 MB/s</li>
<li>Streaming write speed: 400 MB/s</li>
<li>Storage space efficiency: 33% (24 TB)</li>
<li>Fault tolerance: 2 per vdev, 8 total</li>
</ul>

<blockquote>
<p>While we have sacrificed some write performance and capacity, the pool is now extremely fault tolerant. This configuration is probably not practical for most applications and it would make more sense to use lower fault tolerance and set up an offsite backup system.<br>
Striped and mirrored vdevs are fantastic for access speed performance, but they either leave you with no redundancy whatsoever or impose at least a 50% penalty on the total usable space of your pool. In the next post, we will cover RAIDZ, which lets you keep data redundancy without sacrificing as much storage space efficiency. We’ll also look at some example workload scenarios and decide which layout would be the best fit for each.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://chown.me/blog/2FA-with-ssh-on-OpenBSD.html">2FA with ssh on OpenBSD</a></p>

<blockquote>
<p>Five years ago I wrote about using a yubikey on OpenBSD. The only problem with doing this is that there’s no validation server available on OpenBSD, so you need to use a different OTP slot for each machine. (You don’t want to risk a replay attack if someone succeeds in capturing an OTP on one machine, right?) Yubikey has two OTP slots per device, so you would need a yubikey for every two machines with which you’d like to use it. You could use a bastion—and use only one yubikey—but I don’t like the SPOF aspect of a bastion. YMMV.<br>
After I played with TOTP, I wanted to use them as a 2FA for ssh. At the time of writing, we can’t do that using only the tools in base. This article focuses on OpenBSD; if you use another operating system, here are two handy links.</p>
</blockquote>

<ul>
<li>SEED CONFIGURATION</li>
</ul>

<blockquote>
<p>The first thing we need to do is to install the software which will be used to verify the OTPs we submit.</p>
</blockquote>

<p><code># pkg_add login_oath</code></p>

<blockquote>
<p>We need to create a secret - aka, the seed - that will be used to calculate the Time-based One-Time Passwords. We should make sure no one can read or change it.</p>
</blockquote>

<p><code>$ openssl rand -hex 20 &gt; ~/.totp-key</code><br>
<code>$ chmod 400 ~/.totp-key</code></p>

<blockquote>
<p>Now we have a hexadecimal key, but apps usually want a base32 secret. I initially wrote a small script to do the conversion.<br>
While writing this article, I took the opportunity to improve it. When I initially wrote this utility for my use, python-qrcode hadn’t yet been imported to the OpenBSD ports/packages system. It’s easy to install now, so let’s use it.<br>
Here’s the improved version. It will ask for the hex key and output the secret as a base32-encoded string, both with and without spacing so you can copy-paste it into your password manager or easily retype it. It will then ask for the information needed to generate a QR code. Adding our new OTP secret to any mobile app using the QR code will be super easy!</p>
</blockquote>

<ul>
<li>SYSTEM CONFIGURATION</li>
</ul>

<blockquote>
<p>We can now move to the configuration of the system to put our new TOTP to use. As you might guess, it’s going to be quite close to what we did with the yubikey.<br>
We need to tweak login.conf. Be careful and keep a root shell open at all times. The few times I broke my OpenBSD were because I messed with login.conf without showing enough care.</p>
</blockquote>

<ul>
<li>SSHD CONFIGURATION</li>
</ul>

<blockquote>
<p>Again, keeping a root shell around decreases the risk of losing access to the system and being locked outside.<br>
A good standard is to use PasswordAuthentication no and to use public key only. Except… have a guess what the P stands for in TOTP. Yes, congrats, you guessed it!<br>
We need to switch to PasswordAuthentication yes. However, if we made this change alone, sshd would then accept a public key OR a password (which are TOTP because of our login.conf). 2FA uses both at the same time.<br>
To inform sshd we intend to use both, we need to set AuthenticationMethods publickey,password. This way, the user trying to login will first need to perform the traditional publickey authentication. Once that’s done, ssh will prompt for a password and the user will need to submit a valid TOTP for the system.<br>
We could do this the other way around, but I think bots could try passwords, wasting resources. Evaluated in this order, failing to provide a public key leads to sshd immediately declining your attempt.</p>
</blockquote>

<ul>
<li>IMPROVING SECURITY WITHOUT IMPACTING UX</li>
</ul>

<blockquote>
<p>My phone has a long enough password that most of the time, I fail to type it correctly on the first try. Of course, if I had to unlock my phone, launch my TOTP app and use my keyboard to enter what I see on my phone’s screen, I would quickly disable 2FA.<br>
To find a balance, I have whitelisted certain IP addresses and users. If I connect from a particular IP address or as a specific user, I don’t want to go through 2FA. For some users, I might not even enable 2FA.<br>
To sum up, we covered how to create a seed, how to perform a hexadecimal to base32 conversion and how to create a QR code for mobile applications. We configured the login system with login.conf so that ssh authentication uses the TOTP login system, and we told sshd to ask for both the public key and the Time-based One-Time Password. Now you should be all set to use two-factor ssh authentication on OpenBSD!</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSAndDirectoryDType">How ZFS maintains file type information in directories</a></p>

<blockquote>
<p>As an aside in yesterday’s history of file type information being available in Unix directories, I mentioned that it was possible for a filesystem to support this even though its Unix didn’t. By supporting it, I mean that the filesystem maintains this information in its on disk format for directories, even though the rest of the kernel will never ask for it. This is what ZFS does.<br>
The easiest way to see that ZFS does this is to use zdb to dump a directory. I’m going to do this on an OmniOS machine, to make it more convincing, and it turns out that this has some interesting results. Since this is OmniOS, we don’t have the convenience of just naming a directory in zdb, so let’s find the root directory of a filesystem, starting from dnode 1 (as seen before).</p>
</blockquote>

<p><code># zdb -dddd fs3-corestaff-01/h/281 1</code><br>
<code>Dataset [....]</code><br>
<code>[...]</code><br>
<code>microzap: 512 bytes, 4 entries</code><br>
<code>[...]</code><br>
<code>ROOT = 3</code><br>
<code></code><br>
<code># zdb -dddd fs3-corestaff-01/h/281 3</code><br>
<code>Object lvl iblk dblk dsize lsize %full type</code><br>
<code>3 1 16K 1K 8K 1K 100.00 ZFS directory</code><br>
<code>[...]</code><br>
<code>microzap: 1024 bytes, 8 entries</code><br>
<code></code><br>
<code>RESTORED = 4396504 (type: Directory)</code><br>
<code>ckstst = 12017 (type: not specified)</code><br>
<code>ckstst3 = 25069 (type: Directory)</code><br>
<code>.demo-file = 5832188 (type: Regular File)</code><br>
<code>.peergroup = 12590 (type: not specified)</code><br>
<code>cks = 5 (type: not specified)</code><br>
<code>cksimap1 = 5247832 (type: Directory)</code><br>
<code>.diskuse = 12016 (type: not specified)</code><br>
<code>ckstst2 = 12535 (type: not specified)</code></p>

<blockquote>
<p>This is actually an old filesystem (it dates from Solaris 10 and has been transferred around with ‘zfs send | zfs recv’ since then), but various home directories for real and test users have been created in it over time (you can probably guess which one is the oldest one). Sufficiently old directories and files have no file type information, but more recent ones have this information, including .demo-file, which I made just now so this would have an entry that was a regular file with type information.<br>
Once I dug into it, this turned out to be a change introduced (or activated) in ZFS filesystem version 2, which is described in ‘zfs upgrade -v’ as ‘enhanced directory entries’. As an actual change in (Open)Solaris, it dates from mid 2007, although I’m not sure what Solaris release it made it into. The upshot is that if you made your ZFS filesystem any time in the last decade, you’ll have this file type information in your directories.<br>
How ZFS stores this file type information is interesting and clever, especially when it comes to backwards compatibility. I’ll start by quoting the comment from zfs_znode.h:</p>
</blockquote>

<p><code>/*</code><br>
<code>* The directory entry has the type (currently unused on</code><br>
<code>* Solaris) in the top 4 bits, and the object number in</code><br>
<code>* the low 48 bits. The &quot;middle&quot; 12 bits are unused.</code><br>
<code>*/</code></p>

<blockquote>
<p>In yesterday’s entry I said that Unix directory entries need to store at least the filename and the inode number of the file. What ZFS is doing here is reusing the 64 bit field used for the ‘inode’ (the ZFS dnode number) to also store the file type, because it knows that object numbers have only a limited range. This also makes old directory entries compatible, by making type 0 (all 4 bits 0) mean ‘not specified’. Since old directory entries only stored the object number and the object number is 48 bits or less, the higher bits are guaranteed to be all zero.<br>
The reason this needed a new ZFS filesystem version is now clear. If you tried to read directory entries with file type information on a version of ZFS that didn’t know about them, the old version would likely see crazy (and non-existent) object numbers and nothing would work. In order to even read a ‘file type in directory entries’ filesystem, you need to know to only look at the low 48 bits of the object number field in directory entries.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://euroquis.nl/bobulate/?p=1976">Everything old is new again</a></p>

<blockquote>
<p>Just because KDE4-era software has been deprecated by the KDE-FreeBSD team in the official ports-repository, doesn’t mean we don’t care for it while we still need to. KDE4 was released on January 11th, 2008 — I still have the T-shirt — which was a very different C++ world than what we now live in. Much of the code pre-dates the availability of C<ins>11 — certainly the availability of compilers with C</ins>11 support. The language has changed a great deal in those ten years since the original release.<br>
The platforms we run KDE code on have, too — FreeBSD 12 is a long way from the FreeBSD 6 or 7 that were current at release (although at the time, I was more into OpenSolaris). In particular, since then the FreeBSD world has switched over to Clang, and FreeBSD current is experimenting with Clang 7. So we’re seeing KDE4-era code being built, and running, on FreeBSD 12 with Clang 7. That’s a platform with a very different idea of what constitutes correct code, than what the code was originally written for. (Not quite as big a difference as Helio’s KDE1 efforts, though)<br>
So, while we’re counting down to removing KDE4 from the FreeBSD ports tree, we’re also going through and fixing it to work with Clang 7, which defaults to a newer C++ standard and which is quite picky about some things. Some time in the distant past, when pointers were integers and NULL was zero, there was some confusion about booleans. So there’s lots of code that does list.contains(element) &gt; 0 … this must have been a trick before booleans were a supported type in all our compilers. In any case it breaks with Clang 7, since contains() returns a QBool which converts to a nullptr (when false) which isn’t comparable to the integer 0. Suffice to say I’ve spent more time reading KDE4-era code this month, than in the past two years.<br>
However, work is proceeding apace, so if you really really want to, you can still get your old-school kicks on a new platform. Because we care about packaging things right, even when we want to get rid of it.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://nanxiao.gitbooks.io/openbsd-netcat-demystified/">OpenBSD netcat demystified</a></p>

<blockquote>
<p>Owing to its versatile functionalities, netcat earns the reputation as “TCP/IP Swiss army knife”. For example, you can create a simple chat app using netcat:</p>
</blockquote>

<ul>
<li>(1) Open a terminal and input following command:</li>
</ul>

<p><code># nc -l 3003</code></p>

<blockquote>
<p>This means a netcat process will listen on 3003 port in this machine (the IP address of current machine is 192.168.35.176).</p>
</blockquote>

<ul>
<li>(2) Connect aforemontioned netcat process in another machine, and send a greeting:</li>
</ul>

<p><code># nc 192.168.35.176 3003</code><br>
<code>hello</code></p>

<blockquote>
<p>Then in the first machine’s terminal, you will see the “hello” text:</p>
</blockquote>

<p><code># nc -l 3003</code><br>
<code>hello</code></p>

<blockquote>
<p>A primitive chatroom is built successfully. Very cool! Isn’t it? I think many people can’t wait to explore more features of netcatnow. If you are among them, congratulations! This tutorial may be the correct place for you.<br>
In the following parts, I will delve into OpenBSD’s netcatcode to give a detailed anatomy of it. The reason of picking OpenBSD’s netcat rather than others’ is because its code repository is small (~2000 lines of code) and neat. Furthermore, I also hope this little book can assist you learn more socket programming knowledge not just grasping usage of netcat.<br>
We’re all set. Let’s go!</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.geeklan.co.uk/files/eurobsdcon2018.pdf">What’s in store for NetBSD 9.0</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2018/09/25/msg000783.html">NetBSD machines at Open Source Conference 2018 Hiroshima</a></li>
<li><a href="http://vincentdelft.be/post/post_20180922">nmctl adapted with limited privileges: nmctl-0.6.0</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/submit-your-work-check-out-scale-17x-and-fosdem-19-cfps/">Submit Your Work: Check out SCALE 17x and FOSDEM ’19 CFPs</a></li>
<li><a href="https://www.openbsd.org/64.html">OpenBSD 6.4 site is up! (with a partial list of new features)</a></li>
<li><a href="https://www.blackcatenterprises.us/using-alpine-to-read-your-email/">Using Alpine to Read Your Email on OpenBSD</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Morgan - <a href="http://dpaste.com/0EXPWQK#wrap">Send/Receive to Manage Fragmentation?</a></li>
<li>Ryan - <a href="http://dpaste.com/0B6C0Y0">ZFS and mmap</a></li>
<li>Marcus - <a href="http://dpaste.com/1DT26S8#wrap">Linux Compat</a></li>
<li>Ben - <a href="http://dpaste.com/20GTHZE#wrap">Multiple Pools</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 267: Absolute FreeBSD | BSD Now 267</title>
  <link>https://www.bsdnow.tv/267</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2689</guid>
  <pubDate>Wed, 10 Oct 2018 06:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/065b608e-9204-46f2-a689-63ccf08c58a2.mp3" length="40763471" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We have a long interview with fiction and non-fiction author Michael W. Lucas for you this week as well as questions from the audience.</itunes:subtitle>
  <itunes:duration>1:07:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We have a long interview with fiction and non-fiction author Michael W. Lucas for you this week as well as questions from the audience.
&lt;p&gt;##Headlines&lt;br&gt;
Interview - Michael W. Lucas - &lt;a href="mailto:mwlucas@michaelwlucas.com"&gt;mwlucas@michaelwlucas.com&lt;/a&gt; / &lt;a href="https://twitter.com/mwlauthor"&gt;@mwlauthor&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;BR: [Welcome Back]&lt;/li&gt;
&lt;li&gt;AJ: What have you been doing since last we talked to you [ed, ssh, and af3e]&lt;/li&gt;
&lt;li&gt;BR: Tell us more about AF3e&lt;/li&gt;
&lt;li&gt;AJ: How did the first Absolute FreeBSD come about?&lt;/li&gt;
&lt;li&gt;BR: Do you have anything special planned for MeetBSD?&lt;/li&gt;
&lt;li&gt;AJ: What are you working on now? [FM:Jails, Git sync Murder]&lt;/li&gt;
&lt;li&gt;BR: What are your plans for next year?&lt;/li&gt;
&lt;li&gt;AJ: How has SEMIBug been going?&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Auction at &lt;a href="https://mwl.io"&gt;https://mwl.io&lt;/a&gt;&lt;br&gt;
Patreon Link:&lt;/p&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Paul - &lt;a href="http://dpaste.com/0Q6C25T#wrap"&gt;Recent bhyve related videos (daemon)&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Michael - &lt;a href="http://dpaste.com/1YTR9FZ"&gt;freebsd-update question&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Sigflup - &lt;a href="http://dpaste.com/3799BBX#wrap"&gt;pkg file search&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd,openbsd,netbsd,dragonflybsd,trueos,trident,hardenedbsd,tutorial,howto,guide,bsd,interview,netcat,kde yubikey,2fa,ssh,zfs,performance</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We have a long interview with fiction and non-fiction author Michael W. Lucas for you this week as well as questions from the audience.</p>

<p>##Headlines<br>
##Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com">mwlucas@michaelwlucas.com</a> / <a href="https://twitter.com/mwlauthor">@mwlauthor</a></p>

<ul>
<li>BR: [Welcome Back]</li>
<li>AJ: What have you been doing since last we talked to you [ed, ssh, and af3e]</li>
<li>BR: Tell us more about AF3e</li>
<li>AJ: How did the first Absolute FreeBSD come about?</li>
<li>BR: Do you have anything special planned for MeetBSD?</li>
<li>AJ: What are you working on now? [FM:Jails, Git sync Murder]</li>
<li>BR: What are your plans for next year?</li>
<li>AJ: How has SEMIBug been going?</li>
</ul>

<p>Auction at <a href="https://mwl.io">https://mwl.io</a><br>
Patreon Link:</p>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Paul - <a href="http://dpaste.com/0Q6C25T#wrap">Recent bhyve related videos (daemon)</a></li>
<li>Michael - <a href="http://dpaste.com/1YTR9FZ">freebsd-update question</a></li>
<li>Sigflup - <a href="http://dpaste.com/3799BBX#wrap">pkg file search</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We have a long interview with fiction and non-fiction author Michael W. Lucas for you this week as well as questions from the audience.</p>

<p>##Headlines<br>
##Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com">mwlucas@michaelwlucas.com</a> / <a href="https://twitter.com/mwlauthor">@mwlauthor</a></p>

<ul>
<li>BR: [Welcome Back]</li>
<li>AJ: What have you been doing since last we talked to you [ed, ssh, and af3e]</li>
<li>BR: Tell us more about AF3e</li>
<li>AJ: How did the first Absolute FreeBSD come about?</li>
<li>BR: Do you have anything special planned for MeetBSD?</li>
<li>AJ: What are you working on now? [FM:Jails, Git sync Murder]</li>
<li>BR: What are your plans for next year?</li>
<li>AJ: How has SEMIBug been going?</li>
</ul>

<p>Auction at <a href="https://mwl.io">https://mwl.io</a><br>
Patreon Link:</p>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Paul - <a href="http://dpaste.com/0Q6C25T#wrap">Recent bhyve related videos (daemon)</a></li>
<li>Michael - <a href="http://dpaste.com/1YTR9FZ">freebsd-update question</a></li>
<li>Sigflup - <a href="http://dpaste.com/3799BBX#wrap">pkg file search</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 266: File Type History | BSD Now 266</title>
  <link>https://www.bsdnow.tv/266</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2661</guid>
  <pubDate>Wed, 03 Oct 2018 13:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/04e29e6e-69af-4d6a-9e57-2caa87aaeb48.mp3" length="45192669" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Running OpenBSD/NetBSD on FreeBSD using grub2-bhyve, vermaden’s FreeBSD story, thoughts on OpenBSD on the desktop, history of file type info in Unix dirs, Multiboot a Pinebook KDE neon image, and more.</itunes:subtitle>
  <itunes:duration>1:15:00</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Running OpenBSD/NetBSD on FreeBSD using grub2-bhyve, vermaden’s FreeBSD story, thoughts on OpenBSD on the desktop, history of file type info in Unix dirs, Multiboot a Pinebook KDE neon image, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://oshogbo.vexillium.org/blog/53/"&gt;OpenBSD/NetBSD on FreeBSD using grub2-bhyve&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;When I was writing a blog post about the process title, I needed a couple of virtual machines with OpenBSD, NetBSD, and Ubuntu. Before that day I mainly used FreeBSD and Windows with bhyve. I spent some time trying to set up an OpenBSD using bhyve and UEFI as described here. I had numerous problems trying to use it, and this was the day I discovered the grub2-bhyve tool, and I love it!&lt;br&gt;
The grub2-bhyve allows you to load a kernel using GRUB bootloader. GRUB supports most of the operating systems with a standard configuration, so exactly the same method can be used to install NetBSD or Ubuntu. First, let’s install grub2-bhyve on our FreeBSD box:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;# pkg install grub2-bhyve&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;To run grub2-bhyve we need to provide at least the name of the VM. In bhyve, if the memsize is not specified the default VM is created with 256MB of the memory.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;# grub-bhyve test&lt;/code&gt;&lt;br&gt;
&lt;code&gt;GNU GRUB version 2.00&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Minimal BASH-like line editing is supported. For the first word, TAB lists possible command&lt;/code&gt;&lt;br&gt;
&lt;code&gt;completions. Anywhere else TAB lists possible device or file completions.&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;grub&amp;gt;&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;After running grub-bhyve command we will enter the GRUB loader. If we type the ls command, we will see all the available devices. In the case of the grub2-bhyve there is one additional device called “(host)” that is always available and allows the host filesystem to be accessed. We can list files under that device.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;grub&amp;gt; ls&lt;/code&gt;&lt;br&gt;
&lt;code&gt;(host)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;grub&amp;gt; ls (host)/&lt;/code&gt;&lt;br&gt;
&lt;code&gt;libexec/ bin/ usr/ bhyve/ compat/ tank/ etc/ boot/ net/ entropy proc/ lib/ root/ sys/ mnt/ rescue/ tmp/ home/ sbin/ media/ jail/ COPYRIGHT var/ dev/&lt;/code&gt;&lt;br&gt;
&lt;code&gt;grub&amp;gt;&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;To exit console simply type ‘reboot’. I would like to install my new operating system under a ZVOL &lt;code&gt;ztank/bhyve/post&lt;/code&gt;. On another terminal, we create:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;# zfs create -V 10G ztank/bhyve/post&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;If you don’t use ZFS for some crazy reason you can also create a raw blob using the truncate(1) command.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;# truncate -s 10G post.img&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I recommend installing an operating system from the disk image (installXX.fs for OpenBSD and NetBSD-X.X-amd64-install.img for NetBSD). Now we need to create a device map for a GRUB.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;cat &amp;gt; /tmp/post.map &amp;lt;&amp;lt; EOF&lt;/code&gt;&lt;br&gt;
&lt;code&gt;(hd0) /directory/to/disk/image&lt;/code&gt;&lt;br&gt;
&lt;code&gt;(hd1) /dev/zvol/ztank/bhyve/post&lt;/code&gt;&lt;br&gt;
&lt;code&gt;EOF&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The mapping files describe the names for files in the GRUB. In our case under hd0 we will have an installation image and in hd1 we will have our ZVOL/blob. You can also try to use an ISO image then instead of using hd0 device name use a cd0. When we will run the grub-bhyve command we will see two additional devices.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;# grub-bhyve -m /tmp/post.map post&lt;/code&gt;&lt;br&gt;
&lt;code&gt;grub&amp;gt; ls&lt;/code&gt;&lt;br&gt;
&lt;code&gt;(hd0) (hd0,msdos4) (hd0,msdos1) (hd0,openbsd9) (hd0,openbsd1) (hd1) (host)&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The hd0 (in this example OpenBSD image) contains multiple partitions. We can check what is on it.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;grub&amp;gt; ls (hd0,msdos4)/&lt;/code&gt;&lt;br&gt;
&lt;code&gt;boot bsd 6.4/ etc/&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;And this is the partition that contains a kernel. Now we can set a root device, load an OpenBSD kernel and boot:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;grub&amp;gt; set root=(hd0,msdos4)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;grub&amp;gt; kopenbsd -h com0 -r sd0a /bsd&lt;/code&gt;&lt;br&gt;
&lt;code&gt;grub&amp;gt; boot&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;After that, we can run bhyve virtual machine. In my case it is:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;# bhyve -c 1 -w -u -H \&lt;/code&gt;&lt;br&gt;
&lt;code&gt;-s 0,amd_hostbridge \&lt;/code&gt;&lt;br&gt;
&lt;code&gt;-s 3,ahci-hd,/directory/to/disk/image \&lt;/code&gt;&lt;br&gt;
&lt;code&gt;-s 4,ahci-hd,/dev/zvol/ztank/bhyve/post \&lt;/code&gt;&lt;br&gt;
&lt;code&gt;-s 31,lpc -l com1,stdio \&lt;/code&gt;&lt;br&gt;
&lt;code&gt;post&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Unfortunately explaining the whole bhyve(8)  command line is beyond this article. After installing the operating system remove hd0 from the mapping file and the image from the bhyve(8) command. If you don’t want to type all those GRUB commands, you can simply redirect them to the standard input.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;cat &amp;lt;&amp;lt; EOF | grub-bhyve -m /tmp/post.map -M 512 post&lt;/code&gt;&lt;br&gt;
&lt;code&gt;set root=(hd0,4)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;kopenbsd -h com0 -r sd0a /bsd&lt;/code&gt;&lt;br&gt;
&lt;code&gt;boot&lt;/code&gt;&lt;br&gt;
&lt;code&gt;EOF&lt;/code&gt;&lt;/p&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://vermaden.wordpress.com/2018/09/07/my-freebsd-story/"&gt;My FreeBSD Story&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;My first devices/computers/consoles (not at the same time) that I remember were Atari 2600 and Pegasus console which was hardware clone of the Nintendo NES.&lt;br&gt;
Back then I did not even knew that it was Atari 2600 as I referred to it as Video Computer System … and I did not even knew any english by then. It took me about two decades to get to know (by accident) that this Video Computer System was Atari 2600&lt;br&gt;
Then I got AMIGA 600 computer (or should I say my parents bought it for me) which served both for playing computer games and also other activities for the first time. AMIGA is the computer that had the greatest influence on me, as it was the first time I studied the books about Amiga Workbench operating system and learned commands from Amiga Shell terminal. I loved the idea of Ram Disk icon/directory on the desktop that allowed me to transparently put any things in system memory. I still miss that concept on today’s desktop systems … and I still remember how dismal I was when I watched Amiga Deathbed Vigil movie.&lt;br&gt;
At the end of 1998 I got my first PC that of course came with Windows and that computer served both as gaming machine and as well as typical tool. One time I dig into the internals with Windows Registry (which left me disgusted by its concepts and implementation) and its limited command line interface provided by CMD.EXE executable. I remember that the heart of this box was not the CPU or the motherboard but the graphics accelerator – the legendary 3Dfx Voodoo card. This company (3Dfx) – their attitude and philosophy – also left solid fingerprint on my way. Like AMIGA did.&lt;br&gt;
After ‘migration’ from AMIGA to PC it never again ‘felt right’. The games were cool but the Windows system was horrible. Time has passed and different Windows versions and hardware modifications took place. Windows XP felt really heavy at that time, not to mention Windows 2000 for example with even bigger hardware requirements. I also do not understand all the hate about Windows ME. It crashed with the same frequency as Windows 98 or later Windows 98 Second Edition but maybe my hardware was different ??&lt;br&gt;
I do not have any ‘mine’ screenshots from that period as I lost all my 40 GB (huge then) drive of data when I moved/resized the partition with Partition Magic to get some more space from the less filled C: drive. That day I learned hard that “there are people who do backups and people who will do backups”. I never lost data again as I had multiple copies of my data, but the same as Netheril fall the lost data was was gone forever.&lt;br&gt;
I always followed various alternatives which led me to try Linux in 2003, after reading about various distributions philosophies I decided to run Slackware Linux with KDE 3. My buddy used Aurox Linux by then (one of the few Linux distributions from Poland) and encouraged me to do the same – especially in the context of fixing possible problems as he already knew it and also as he recently dumped Windows system. But Slackware sounded like a better idea so I took that path instead. At first I dual booted between Windows XP and Slackware Linux cause I had everything worked out on the Windows world while I often felt helpless in the Linux world, so I would reboot into Windows to play some games or find a solution for Linux problem if that was required. I remember how strange the concept of dual clipboards (PRIMARY and SECONDARY) was for me by then. I was amazed why ‘so much better’ system as Linux (at least marketed that way) needs a system tray program to literally manage the clipboard. On Windows it was obvious, you do [CTRL]+[C] to copy and [CTRL]+[V] to paste things, but on Linux there (no I know its X11 feature) there were two clipboards that were synchronized by this little system tray program from KDE 3. It was also unthinkable for me that I will ‘lost’ contents of last/recent [CTRL]+[C] operation if I close the application from which the copy was made. I settled down a little on Slackware but not for long. I really did not liked manual dependency management for packages for example. Also KDE 3 was really ugly and despite trying all possible options I was not able to tweak it into something nice looking.&lt;br&gt;
After half a year on Slackware I checked the Linux distributions again and decided to try Gentoo Linux. I definitely agree with the image below which visualizes Gentoo Linux experience, especially when You install it for he first time ??&lt;br&gt;
Of course I went with the most hardcore version with self building Stage 1 (compiler and toolchain) which was horrible idea at that time because compilation on slow single core machine took forever … but after many hours I got Gentoo installed. I now have to decide which desktop environment to use. I have read a lot of good news about Fluxbox at that time so this is what I tried. It was very weird experience (to create everything in GUI from scratch) but very pleasant one. That recalled me the times of AMIGA … but Linux came in the way too much often. The more I dig into Gentoo Linux the more I read that lots of Gentoo features are based on FreeBSD solutions. Gentoo Portage is a clone of FreeBSD Ports. That ‘central’ /etc/rc.conf system configuration file concept was taken from FreeBSD as well. So I started to gather information about FreeBSD. The (then) FreeBSD website or FreeBSD Ports site (still) felt little outdated to say the least but that did not discouraged me.&lt;br&gt;
Somewhere in 2005 I installed FreeBSD 5.4 on my computer. The beginnings were hard, like the earlier step with Gentoo but similarly like Gentoo the FreeBSD project came with a lot of great documentation. While Gentoo documentation is concentrated within various Gentoo Wiki sites the FreeBSD project comes with ‘official’ documentation in the form of Handbook and FAQ. I remember my first questions at the now nonexistent &lt;a href="http://BSDForums.org"&gt;BSDForums.org&lt;/a&gt; site – for example one of the first ones – how to scroll the terminal output in the plain console. I now know that I had to push Scroll Lock button but it was something totally new for me.&lt;br&gt;
Why FreeBSD and not OpenBSD or NetBSD? Probably because Gentoo based most their concepts on the FreeBSD solutions, so that led me to FreeBSD instead of the other BSD operating systems. Currently I still use FreeBSD but I keep an steady eye on the OpenBSD, HardenedBSD and DragonFly BSD solutions and improvements.&lt;br&gt;
As the migration path from Linux to FreeBSD is a lot easier – all configuration files from /home can be just copied – the migration was quite fast easy. I again had the Fluxbox configuration which I used on the Gentoo. Now – on FreeBSD – it started to fell even more like AMIGA times. Everything is/has been well thought and had its place and reason. The documentation was good and the FreeBSD Community was second to none.&lt;br&gt;
After 15 years of using various Windows, UNIX (macOS/AIX/HP-UX/Solaris/OpenSolaris/Illumos/FreeBSD/OpenBSD/NetBSD) and UNIX-like (Linux) systems I always come to conclusion that FreeBSD is the system that sucks least. And sucks least with each release and one day I will write why FreeBSD is such great operating system … if I already haven’t&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://blog.gsora.xyz/openbsd-on-the-desktop-some-thoughts/"&gt;OpenBSD on the Desktop: some thoughts&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I’ve been using OpenBSD on my ThinkPad X230 for some weeks now, and the experience has been peculiar in some ways.&lt;br&gt;
The OS itself in my opinion is not ready for widespread desktop usage, and the development team is not trying to push it in the throat of anybody who wants a Windows or macOS alternative. You need to understand a little bit of how *NIX systems work, because you’ll use CLI more than UI. That’s not necessarily bad, and I’m sure I learned a trick or two that could translate easily to Linux or macOS. Their development process is purely based on developers that love to contribute and hack around, just because it’s fun. Even the mailing list is a cool place to hang on! Code correctness and security are a must, nothing gets committed if it doesn’t get reviewed thoroughly first - nowadays the first two properties should be enforced in every major operating system.&lt;br&gt;
I like the idea of a platform that continually evolves. pledge(2) and unveil(2) are the proof that with a little effort, you can secure existing software better than ever.&lt;br&gt;
I like the “sensible defaults” approach, having an OS ready to be used - UI included if you selected it during the setup process - is great.&lt;br&gt;
Just install a browser and you’re ready to go.&lt;br&gt;
Manual pages on OpenBSD are real manuals, not an extension of the “–help” command found in most CLI softwares. They help you understand inner workings of the operating system, no internet connection needed. There are some trade-offs, too.&lt;br&gt;
Performance is not first-class, mostly because of all the security mitigations and checks done at runtime.&lt;br&gt;
I write Go code in neovim, and sometimes you can feel a slight slowdown when you’re compiling and editing multiple files at the same time, but usually I can’t notice any meaningful difference. Browsers are a different matter though, you can definitely feel something differs from the experience you can have on mainstream operating systems. But again, trade-offs.&lt;br&gt;
To use OpenBSD on the desktop you must be ready to sacrifice some of the goodies of mainstream OSes, but if you’re searching for a zen place to do your computing stuff, it’s the best you can get right now.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/unix/DirectoryDTypeHistory"&gt;The history of file type information being available in Unix directories&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The two things that Unix directory entries absolutely have to have are the name of the directory entry and its ‘inode’, by which we generically mean some stable kernel identifier for the file that will persist if it gets renamed, linked to other directories, and so on. Unsurprisingly, directory entries have had these since the days when you read the raw bytes of directories with read(), and for a long time that was all they had; if you wanted more than the name and the inode number, you had to stat() the file, not just read the directory. Then, well, I’ll quote myself from an old entry on a find optimization:&lt;br&gt;
[…], Unix filesystem developers realized that it was very common for programs reading directories to need to know a bit more about directory entries than just their names, especially their file types (find is the obvious case, but also consider things like ‘ls -F’). Given that the type of an active inode never changes, it’s possible to embed this information straight in the directory entry and then return this to user level, and that’s what developers did; on some systems, readdir(3) will now return directory entries with an additional dtype field that has the directory entry’s type.&lt;br&gt;
On Twitter, I recently grumbled about Illumos not having this dtype field. The ensuing conversation wound up with me curious about exactly where dtype came from and how far back it went. The answer turns out to be a bit surprising due to there being two sides of dtype.&lt;br&gt;
On the kernel side, dtype appears to have shown up in 4.4 BSD. The 4.4 BSD /usr/src/sys/dirent.h has a struct dirent that has a dtype field, but the field isn’t documented in either the comments in the file or in the getdirentries(2) manpage; both of those admit only to the traditional BSD dirent fields. This 4.4 BSD dtype was carried through to things that inherited from 4.4 BSD (Lite), specifically FreeBSD, but it continued to be undocumented for at least a while.&lt;br&gt;
(In FreeBSD, the most convenient history I can find is here, and the dtype field is present in sys/dirent.h as far back as FreeBSD 2.0, which seems to be as far as the repo goes for releases.)&lt;br&gt;
Documentation for dtype appeared in the getdirentries(2) manpage in FreeBSD 2.2.0, where the manpage itself claims to have been updated on May 3rd 1995 (cf). In FreeBSD, this appears to have been part of merging 4.4 BSD ‘Lite2’, which seems to have been done in 1997. I stumbled over a repo of UCB BSD commit history, and in it the documentation appears in this May 3rd 1995 change, which at least has the same date. It appears that FreeBSD 2.2.0 was released some time in 1997, which is when this would have appeared in an official release.&lt;br&gt;
In Linux, it seems that a dirent structure with a dtype member appeared only just before 2.4.0, which was released at the start of 2001. Linux took this long because the dtype field only appeared in the 64-bit ‘large file support’ version of the dirent structure, and so was only return by the new 64-bit getdents64() system call. This would have been a few years after FreeBSD officially documented dtype, and probably many years after it was actually available if you peeked at the structure definition.&lt;br&gt;
As far as I can tell, dtype is present on Linux, FreeBSD, OpenBSD, NetBSD, Dragonfly BSD, and Darwin (aka MacOS or OS X). It’s not present on Solaris and thus Illumos. As far as other commercial Unixes go, you’re on your own; all the links to manpages for things like AIX from my old entry on the remaining Unixes appear to have rotted away.&lt;br&gt;
Sidebar: The filesystem also matters on modern Unixes&lt;br&gt;
Even if your Unix supports dtype in directory entries, it doesn’t mean that it’s supported by the filesystem of any specific directory. As far as I know, every Unix with dtype support has support for it in their normal local filesystems, but it’s not guaranteed to be in all filesystems, especially non-Unix ones like FAT32. Your code should always be prepared to deal with a file type of DTUNKNOWN.&lt;br&gt;
It’s also possible to have things the other way around, where you have a filesystem with support for file type information in directories that’s on a Unix that doesn’t support it. There are a number of plausible reasons for this to happen, but they’re either obvious or beyond the scope of this entry.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://euroquis.nl/bobulate/?p=1979"&gt;Multiboot Pinebook KDE neon&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Recently a KDE neon image for the Pinebook was announced. There is a new image, with a handful of fixes, which the KDE Plasma team has been working on over the past week and a half.&lt;br&gt;
Here’s a picture of my Pinebook running KDE neon — watching Panic! At the Disco’s High Hopes — sitting in front of my monitor that’s hooked up to one of my openSUSE systems. There are still some errata, and watching video sucks up battery, but for hacking on documentation from my hammock in the garden, or doing IRC meetings it’s a really nice machine.&lt;br&gt;
But one of the neat things about running KDE neon off of an SD card on the Pinebook is that it’s portable — that SD card can move around. So let’s talk about multiboot in the sense of “booting the same OS storage medium in different hardware units” rather than “booting different OS from a medium in a single hardware unit”. On these little ARM boards, u-boot does all the heavy lifting early in the boot process. So to re-use the KDE neon Pinebook image on another ARM board, the u-boot blocks need to be replaced.&lt;br&gt;
I have the u-boot from a Pine64 image (I forget what) lying around, 1015 blocks of 1024 bytes, which I can dd over the u-boot blocks on the SD card, dd bs=1k conv=notrunc,sync if=uboot.img of=/dev/da0 seek=8, and then the same SD card, with the filesystem and data from the Pinebook, will boot on the Pine64 board. Of course, to move the SD card back again, I need to restore the Pinebook u-boot blocks.&lt;br&gt;
Here’s a picture of my Pineboard (the base is a piece of the garden fence, it’s Douglas pine, with 4mm threaded rods acting as the corner posts for my Pine64 mini-rack), with power and network and a serial console attached, along with the serial console output of the same.&lt;br&gt;
The nice thing here is that the same software stack runs on the Pine64 but then has a wired network — which in turn means that if I switch on the other boards in that mini-rack, I’ve got a distcc-capable cluster for fast development, and vast NFS storage (served from ZFS on my FreeBSD machines) for source. I can develop in a high(er) powered environment, and then swap the card around into the Pinebook for testing-on-the-go.&lt;br&gt;
So to sum up: you can multiboot the KDE neon Pinebook image on other Pine64 hardware (i.e. the Pine64 board). To do so, you need to swap around u-boot blocks. The blocks can be picked out of an image built for each board, and then a particular image (e.g. the latest KDE neon Pinebook) can be run on either board.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="http://lists.dragonflybsd.org/pipermail/users/2018-September/357883.html"&gt;Unexpected benefit with Ryzen – reducing power for build server&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mwl.io/archives/3758"&gt;Happy #CIDRDay!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mwl.io/archives/3771"&gt;Absolute FreeBSD 3e ship date&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.mug.org/"&gt;MWL FreeBSD talk @ October 9th 2018 - MUG Meeting&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.ixsystems.com/blog/meetbsd-2018-countdown/"&gt;MeetBSD Oct 19-20&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-September/014218.html"&gt;October’s London *BSD meetup - 9th Oct 2018&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.bsd.nrw/"&gt;NRW BUG Meeting at Trivago Oct. 9&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blog.socruel.nu/misc/eurobsdcon-2018.html"&gt;Lars Wittebrood blogs about his visit to EuroBSDCon 2018&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180925075334"&gt;EuroBSDcon 2018 OpenBSD slides available&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://2018.eurobsdcon.org/talks-speakers/"&gt;EuroBSDCon conference site has most slides as well&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Brad - &lt;a href="http://dpaste.com/3T9M2QC#wrap"&gt;Unmounted ZFS sends&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Niclas - &lt;a href="http://dpaste.com/11TKDK2"&gt;Report from a Meetup&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Ghislain - &lt;a href="http://dpaste.com/2790GC6"&gt;Bhyve not used?&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Shane - &lt;a href="http://dpaste.com/1P055SQ"&gt;zpool history and snapshots&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, Ryzen, Pinebook, KDE Neon, bhyve, desktop</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Running OpenBSD/NetBSD on FreeBSD using grub2-bhyve, vermaden’s FreeBSD story, thoughts on OpenBSD on the desktop, history of file type info in Unix dirs, Multiboot a Pinebook KDE neon image, and more.</p>

<p>##Headlines<br>
###<a href="https://oshogbo.vexillium.org/blog/53/">OpenBSD/NetBSD on FreeBSD using grub2-bhyve</a></p>

<blockquote>
<p>When I was writing a blog post about the process title, I needed a couple of virtual machines with OpenBSD, NetBSD, and Ubuntu. Before that day I mainly used FreeBSD and Windows with bhyve. I spent some time trying to set up an OpenBSD using bhyve and UEFI as described here. I had numerous problems trying to use it, and this was the day I discovered the grub2-bhyve tool, and I love it!<br>
The grub2-bhyve allows you to load a kernel using GRUB bootloader. GRUB supports most of the operating systems with a standard configuration, so exactly the same method can be used to install NetBSD or Ubuntu. First, let’s install grub2-bhyve on our FreeBSD box:</p>
</blockquote>

<p><code># pkg install grub2-bhyve</code></p>

<blockquote>
<p>To run grub2-bhyve we need to provide at least the name of the VM. In bhyve, if the memsize is not specified the default VM is created with 256MB of the memory.</p>
</blockquote>

<p><code># grub-bhyve test</code><br>
<code>GNU GRUB version 2.00</code><br>
<code>Minimal BASH-like line editing is supported. For the first word, TAB lists possible command</code><br>
<code>completions. Anywhere else TAB lists possible device or file completions.</code><br>
<code></code><br>
<code></code><br>
<code>grub&gt;</code></p>

<blockquote>
<p>After running grub-bhyve command we will enter the GRUB loader. If we type the ls command, we will see all the available devices. In the case of the grub2-bhyve there is one additional device called “(host)” that is always available and allows the host filesystem to be accessed. We can list files under that device.</p>
</blockquote>

<p><code>grub&gt; ls</code><br>
<code>(host)</code><br>
<code>grub&gt; ls (host)/</code><br>
<code>libexec/ bin/ usr/ bhyve/ compat/ tank/ etc/ boot/ net/ entropy proc/ lib/ root/ sys/ mnt/ rescue/ tmp/ home/ sbin/ media/ jail/ COPYRIGHT var/ dev/</code><br>
<code>grub&gt;</code></p>

<blockquote>
<p>To exit console simply type ‘reboot’. I would like to install my new operating system under a ZVOL <code>ztank/bhyve/post</code>. On another terminal, we create:</p>
</blockquote>

<p><code># zfs create -V 10G ztank/bhyve/post</code></p>

<blockquote>
<p>If you don’t use ZFS for some crazy reason you can also create a raw blob using the truncate(1) command.</p>
</blockquote>

<p><code># truncate -s 10G post.img</code></p>

<blockquote>
<p>I recommend installing an operating system from the disk image (installXX.fs for OpenBSD and NetBSD-X.X-amd64-install.img for NetBSD). Now we need to create a device map for a GRUB.</p>
</blockquote>

<p><code>cat &gt; /tmp/post.map &lt;&lt; EOF</code><br>
<code>(hd0) /directory/to/disk/image</code><br>
<code>(hd1) /dev/zvol/ztank/bhyve/post</code><br>
<code>EOF</code></p>

<blockquote>
<p>The mapping files describe the names for files in the GRUB. In our case under hd0 we will have an installation image and in hd1 we will have our ZVOL/blob. You can also try to use an ISO image then instead of using hd0 device name use a cd0. When we will run the grub-bhyve command we will see two additional devices.</p>
</blockquote>

<p><code># grub-bhyve -m /tmp/post.map post</code><br>
<code>grub&gt; ls</code><br>
<code>(hd0) (hd0,msdos4) (hd0,msdos1) (hd0,openbsd9) (hd0,openbsd1) (hd1) (host)</code></p>

<blockquote>
<p>The hd0 (in this example OpenBSD image) contains multiple partitions. We can check what is on it.</p>
</blockquote>

<p><code>grub&gt; ls (hd0,msdos4)/</code><br>
<code>boot bsd 6.4/ etc/</code></p>

<blockquote>
<p>And this is the partition that contains a kernel. Now we can set a root device, load an OpenBSD kernel and boot:</p>
</blockquote>

<p><code>grub&gt; set root=(hd0,msdos4)</code><br>
<code>grub&gt; kopenbsd -h com0 -r sd0a /bsd</code><br>
<code>grub&gt; boot</code></p>

<blockquote>
<p>After that, we can run bhyve virtual machine. In my case it is:</p>
</blockquote>

<p><code># bhyve -c 1 -w -u -H \</code><br>
<code>-s 0,amd_hostbridge \</code><br>
<code>-s 3,ahci-hd,/directory/to/disk/image \</code><br>
<code>-s 4,ahci-hd,/dev/zvol/ztank/bhyve/post \</code><br>
<code>-s 31,lpc -l com1,stdio \</code><br>
<code>post</code></p>

<blockquote>
<p>Unfortunately explaining the whole bhyve(8)  command line is beyond this article. After installing the operating system remove hd0 from the mapping file and the image from the bhyve(8) command. If you don’t want to type all those GRUB commands, you can simply redirect them to the standard input.</p>
</blockquote>

<p><code>cat &lt;&lt; EOF | grub-bhyve -m /tmp/post.map -M 512 post</code><br>
<code>set root=(hd0,4)</code><br>
<code>kopenbsd -h com0 -r sd0a /bsd</code><br>
<code>boot</code><br>
<code>EOF</code></p>

<p><hr></p>

<p>###<a href="https://vermaden.wordpress.com/2018/09/07/my-freebsd-story/">My FreeBSD Story</a></p>

<blockquote>
<p>My first devices/computers/consoles (not at the same time) that I remember were Atari 2600 and Pegasus console which was hardware clone of the Nintendo NES.<br>
Back then I did not even knew that it was Atari 2600 as I referred to it as Video Computer System … and I did not even knew any english by then. It took me about two decades to get to know (by accident) that this Video Computer System was Atari 2600<br>
Then I got AMIGA 600 computer (or should I say my parents bought it for me) which served both for playing computer games and also other activities for the first time. AMIGA is the computer that had the greatest influence on me, as it was the first time I studied the books about Amiga Workbench operating system and learned commands from Amiga Shell terminal. I loved the idea of Ram Disk icon/directory on the desktop that allowed me to transparently put any things in system memory. I still miss that concept on today’s desktop systems … and I still remember how dismal I was when I watched Amiga Deathbed Vigil movie.<br>
At the end of 1998 I got my first PC that of course came with Windows and that computer served both as gaming machine and as well as typical tool. One time I dig into the internals with Windows Registry (which left me disgusted by its concepts and implementation) and its limited command line interface provided by CMD.EXE executable. I remember that the heart of this box was not the CPU or the motherboard but the graphics accelerator – the legendary 3Dfx Voodoo card. This company (3Dfx) – their attitude and philosophy – also left solid fingerprint on my way. Like AMIGA did.<br>
After ‘migration’ from AMIGA to PC it never again ‘felt right’. The games were cool but the Windows system was horrible. Time has passed and different Windows versions and hardware modifications took place. Windows XP felt really heavy at that time, not to mention Windows 2000 for example with even bigger hardware requirements. I also do not understand all the hate about Windows ME. It crashed with the same frequency as Windows 98 or later Windows 98 Second Edition but maybe my hardware was different ??<br>
I do not have any ‘mine’ screenshots from that period as I lost all my 40 GB (huge then) drive of data when I moved/resized the partition with Partition Magic to get some more space from the less filled C: drive. That day I learned hard that “there are people who do backups and people who will do backups”. I never lost data again as I had multiple copies of my data, but the same as Netheril fall the lost data was was gone forever.<br>
I always followed various alternatives which led me to try Linux in 2003, after reading about various distributions philosophies I decided to run Slackware Linux with KDE 3. My buddy used Aurox Linux by then (one of the few Linux distributions from Poland) and encouraged me to do the same – especially in the context of fixing possible problems as he already knew it and also as he recently dumped Windows system. But Slackware sounded like a better idea so I took that path instead. At first I dual booted between Windows XP and Slackware Linux cause I had everything worked out on the Windows world while I often felt helpless in the Linux world, so I would reboot into Windows to play some games or find a solution for Linux problem if that was required. I remember how strange the concept of dual clipboards (PRIMARY and SECONDARY) was for me by then. I was amazed why ‘so much better’ system as Linux (at least marketed that way) needs a system tray program to literally manage the clipboard. On Windows it was obvious, you do [CTRL]+[C] to copy and [CTRL]+[V] to paste things, but on Linux there (no I know its X11 feature) there were two clipboards that were synchronized by this little system tray program from KDE 3. It was also unthinkable for me that I will ‘lost’ contents of last/recent [CTRL]+[C] operation if I close the application from which the copy was made. I settled down a little on Slackware but not for long. I really did not liked manual dependency management for packages for example. Also KDE 3 was really ugly and despite trying all possible options I was not able to tweak it into something nice looking.<br>
After half a year on Slackware I checked the Linux distributions again and decided to try Gentoo Linux. I definitely agree with the image below which visualizes Gentoo Linux experience, especially when You install it for he first time ??<br>
Of course I went with the most hardcore version with self building Stage 1 (compiler and toolchain) which was horrible idea at that time because compilation on slow single core machine took forever … but after many hours I got Gentoo installed. I now have to decide which desktop environment to use. I have read a lot of good news about Fluxbox at that time so this is what I tried. It was very weird experience (to create everything in GUI from scratch) but very pleasant one. That recalled me the times of AMIGA … but Linux came in the way too much often. The more I dig into Gentoo Linux the more I read that lots of Gentoo features are based on FreeBSD solutions. Gentoo Portage is a clone of FreeBSD Ports. That ‘central’ /etc/rc.conf system configuration file concept was taken from FreeBSD as well. So I started to gather information about FreeBSD. The (then) FreeBSD website or FreeBSD Ports site (still) felt little outdated to say the least but that did not discouraged me.<br>
Somewhere in 2005 I installed FreeBSD 5.4 on my computer. The beginnings were hard, like the earlier step with Gentoo but similarly like Gentoo the FreeBSD project came with a lot of great documentation. While Gentoo documentation is concentrated within various Gentoo Wiki sites the FreeBSD project comes with ‘official’ documentation in the form of Handbook and FAQ. I remember my first questions at the now nonexistent <a href="http://BSDForums.org">BSDForums.org</a> site – for example one of the first ones – how to scroll the terminal output in the plain console. I now know that I had to push Scroll Lock button but it was something totally new for me.<br>
Why FreeBSD and not OpenBSD or NetBSD? Probably because Gentoo based most their concepts on the FreeBSD solutions, so that led me to FreeBSD instead of the other BSD operating systems. Currently I still use FreeBSD but I keep an steady eye on the OpenBSD, HardenedBSD and DragonFly BSD solutions and improvements.<br>
As the migration path from Linux to FreeBSD is a lot easier – all configuration files from /home can be just copied – the migration was quite fast easy. I again had the Fluxbox configuration which I used on the Gentoo. Now – on FreeBSD – it started to fell even more like AMIGA times. Everything is/has been well thought and had its place and reason. The documentation was good and the FreeBSD Community was second to none.<br>
After 15 years of using various Windows, UNIX (macOS/AIX/HP-UX/Solaris/OpenSolaris/Illumos/FreeBSD/OpenBSD/NetBSD) and UNIX-like (Linux) systems I always come to conclusion that FreeBSD is the system that sucks least. And sucks least with each release and one day I will write why FreeBSD is such great operating system … if I already haven’t</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://blog.gsora.xyz/openbsd-on-the-desktop-some-thoughts/">OpenBSD on the Desktop: some thoughts</a></p>

<blockquote>
<p>I’ve been using OpenBSD on my ThinkPad X230 for some weeks now, and the experience has been peculiar in some ways.<br>
The OS itself in my opinion is not ready for widespread desktop usage, and the development team is not trying to push it in the throat of anybody who wants a Windows or macOS alternative. You need to understand a little bit of how *NIX systems work, because you’ll use CLI more than UI. That’s not necessarily bad, and I’m sure I learned a trick or two that could translate easily to Linux or macOS. Their development process is purely based on developers that love to contribute and hack around, just because it’s fun. Even the mailing list is a cool place to hang on! Code correctness and security are a must, nothing gets committed if it doesn’t get reviewed thoroughly first - nowadays the first two properties should be enforced in every major operating system.<br>
I like the idea of a platform that continually evolves. pledge(2) and unveil(2) are the proof that with a little effort, you can secure existing software better than ever.<br>
I like the “sensible defaults” approach, having an OS ready to be used - UI included if you selected it during the setup process - is great.<br>
Just install a browser and you’re ready to go.<br>
Manual pages on OpenBSD are real manuals, not an extension of the “–help” command found in most CLI softwares. They help you understand inner workings of the operating system, no internet connection needed. There are some trade-offs, too.<br>
Performance is not first-class, mostly because of all the security mitigations and checks done at runtime.<br>
I write Go code in neovim, and sometimes you can feel a slight slowdown when you’re compiling and editing multiple files at the same time, but usually I can’t notice any meaningful difference. Browsers are a different matter though, you can definitely feel something differs from the experience you can have on mainstream operating systems. But again, trade-offs.<br>
To use OpenBSD on the desktop you must be ready to sacrifice some of the goodies of mainstream OSes, but if you’re searching for a zen place to do your computing stuff, it’s the best you can get right now.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/unix/DirectoryDTypeHistory">The history of file type information being available in Unix directories</a></p>

<blockquote>
<p>The two things that Unix directory entries absolutely have to have are the name of the directory entry and its ‘inode’, by which we generically mean some stable kernel identifier for the file that will persist if it gets renamed, linked to other directories, and so on. Unsurprisingly, directory entries have had these since the days when you read the raw bytes of directories with read(), and for a long time that was all they had; if you wanted more than the name and the inode number, you had to stat() the file, not just read the directory. Then, well, I’ll quote myself from an old entry on a find optimization:<br>
[…], Unix filesystem developers realized that it was very common for programs reading directories to need to know a bit more about directory entries than just their names, especially their file types (find is the obvious case, but also consider things like ‘ls -F’). Given that the type of an active inode never changes, it’s possible to embed this information straight in the directory entry and then return this to user level, and that’s what developers did; on some systems, readdir(3) will now return directory entries with an additional d_type field that has the directory entry’s type.<br>
On Twitter, I recently grumbled about Illumos not having this d_type field. The ensuing conversation wound up with me curious about exactly where d_type came from and how far back it went. The answer turns out to be a bit surprising due to there being two sides of d_type.<br>
On the kernel side, d_type appears to have shown up in 4.4 BSD. The 4.4 BSD /usr/src/sys/dirent.h has a struct dirent that has a d_type field, but the field isn’t documented in either the comments in the file or in the getdirentries(2) manpage; both of those admit only to the traditional BSD dirent fields. This 4.4 BSD d_type was carried through to things that inherited from 4.4 BSD (Lite), specifically FreeBSD, but it continued to be undocumented for at least a while.<br>
(In FreeBSD, the most convenient history I can find is here, and the d_type field is present in sys/dirent.h as far back as FreeBSD 2.0, which seems to be as far as the repo goes for releases.)<br>
Documentation for d_type appeared in the getdirentries(2) manpage in FreeBSD 2.2.0, where the manpage itself claims to have been updated on May 3rd 1995 (cf). In FreeBSD, this appears to have been part of merging 4.4 BSD ‘Lite2’, which seems to have been done in 1997. I stumbled over a repo of UCB BSD commit history, and in it the documentation appears in this May 3rd 1995 change, which at least has the same date. It appears that FreeBSD 2.2.0 was released some time in 1997, which is when this would have appeared in an official release.<br>
In Linux, it seems that a dirent structure with a d_type member appeared only just before 2.4.0, which was released at the start of 2001. Linux took this long because the d_type field only appeared in the 64-bit ‘large file support’ version of the dirent structure, and so was only return by the new 64-bit getdents64() system call. This would have been a few years after FreeBSD officially documented d_type, and probably many years after it was actually available if you peeked at the structure definition.<br>
As far as I can tell, d_type is present on Linux, FreeBSD, OpenBSD, NetBSD, Dragonfly BSD, and Darwin (aka MacOS or OS X). It’s not present on Solaris and thus Illumos. As far as other commercial Unixes go, you’re on your own; all the links to manpages for things like AIX from my old entry on the remaining Unixes appear to have rotted away.<br>
Sidebar: The filesystem also matters on modern Unixes<br>
Even if your Unix supports d_type in directory entries, it doesn’t mean that it’s supported by the filesystem of any specific directory. As far as I know, every Unix with d_type support has support for it in their normal local filesystems, but it’s not guaranteed to be in all filesystems, especially non-Unix ones like FAT32. Your code should always be prepared to deal with a file type of DT_UNKNOWN.<br>
It’s also possible to have things the other way around, where you have a filesystem with support for file type information in directories that’s on a Unix that doesn’t support it. There are a number of plausible reasons for this to happen, but they’re either obvious or beyond the scope of this entry.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://euroquis.nl/bobulate/?p=1979">Multiboot Pinebook KDE neon</a></p>

<blockquote>
<p>Recently a KDE neon image for the Pinebook was announced. There is a new image, with a handful of fixes, which the KDE Plasma team has been working on over the past week and a half.<br>
Here’s a picture of my Pinebook running KDE neon — watching Panic! At the Disco’s High Hopes — sitting in front of my monitor that’s hooked up to one of my openSUSE systems. There are still some errata, and watching video sucks up battery, but for hacking on documentation from my hammock in the garden, or doing IRC meetings it’s a really nice machine.<br>
But one of the neat things about running KDE neon off of an SD card on the Pinebook is that it’s portable — that SD card can move around. So let’s talk about multiboot in the sense of “booting the same OS storage medium in different hardware units” rather than “booting different OS from a medium in a single hardware unit”. On these little ARM boards, u-boot does all the heavy lifting early in the boot process. So to re-use the KDE neon Pinebook image on another ARM board, the u-boot blocks need to be replaced.<br>
I have the u-boot from a Pine64 image (I forget what) lying around, 1015 blocks of 1024 bytes, which I can dd over the u-boot blocks on the SD card, dd bs=1k conv=notrunc,sync if=uboot.img of=/dev/da0 seek=8, and then the same SD card, with the filesystem and data from the Pinebook, will boot on the Pine64 board. Of course, to move the SD card back again, I need to restore the Pinebook u-boot blocks.<br>
Here’s a picture of my Pineboard (the base is a piece of the garden fence, it’s Douglas pine, with 4mm threaded rods acting as the corner posts for my Pine64 mini-rack), with power and network and a serial console attached, along with the serial console output of the same.<br>
The nice thing here is that the same software stack runs on the Pine64 but then has a wired network — which in turn means that if I switch on the other boards in that mini-rack, I’ve got a distcc-capable cluster for fast development, and vast NFS storage (served from ZFS on my FreeBSD machines) for source. I can develop in a high(er) powered environment, and then swap the card around into the Pinebook for testing-on-the-go.<br>
So to sum up: you can multiboot the KDE neon Pinebook image on other Pine64 hardware (i.e. the Pine64 board). To do so, you need to swap around u-boot blocks. The blocks can be picked out of an image built for each board, and then a particular image (e.g. the latest KDE neon Pinebook) can be run on either board.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2018-September/357883.html">Unexpected benefit with Ryzen – reducing power for build server</a></li>
<li><a href="https://mwl.io/archives/3758">Happy #CIDRDay!</a></li>
<li><a href="https://mwl.io/archives/3771">Absolute FreeBSD 3e ship date</a></li>
<li><a href="http://www.mug.org/">MWL FreeBSD talk @ October 9th 2018 - MUG Meeting</a></li>
<li><a href="https://www.ixsystems.com/blog/meetbsd-2018-countdown/">MeetBSD Oct 19-20</a></li>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-September/014218.html">October’s London *BSD meetup - 9th Oct 2018</a></li>
<li><a href="https://www.bsd.nrw/">NRW BUG Meeting at Trivago Oct. 9</a></li>
<li><a href="https://blog.socruel.nu/misc/eurobsdcon-2018.html">Lars Wittebrood blogs about his visit to EuroBSDCon 2018</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180925075334">EuroBSDcon 2018 OpenBSD slides available</a></li>
<li><a href="https://2018.eurobsdcon.org/talks-speakers/">EuroBSDCon conference site has most slides as well</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Brad - <a href="http://dpaste.com/3T9M2QC#wrap">Unmounted ZFS sends</a></li>
<li>Niclas - <a href="http://dpaste.com/11TKDK2">Report from a Meetup</a></li>
<li>Ghislain - <a href="http://dpaste.com/2790GC6">Bhyve not used?</a></li>
<li>Shane - <a href="http://dpaste.com/1P055SQ">zpool history and snapshots</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Running OpenBSD/NetBSD on FreeBSD using grub2-bhyve, vermaden’s FreeBSD story, thoughts on OpenBSD on the desktop, history of file type info in Unix dirs, Multiboot a Pinebook KDE neon image, and more.</p>

<p>##Headlines<br>
###<a href="https://oshogbo.vexillium.org/blog/53/">OpenBSD/NetBSD on FreeBSD using grub2-bhyve</a></p>

<blockquote>
<p>When I was writing a blog post about the process title, I needed a couple of virtual machines with OpenBSD, NetBSD, and Ubuntu. Before that day I mainly used FreeBSD and Windows with bhyve. I spent some time trying to set up an OpenBSD using bhyve and UEFI as described here. I had numerous problems trying to use it, and this was the day I discovered the grub2-bhyve tool, and I love it!<br>
The grub2-bhyve allows you to load a kernel using GRUB bootloader. GRUB supports most of the operating systems with a standard configuration, so exactly the same method can be used to install NetBSD or Ubuntu. First, let’s install grub2-bhyve on our FreeBSD box:</p>
</blockquote>

<p><code># pkg install grub2-bhyve</code></p>

<blockquote>
<p>To run grub2-bhyve we need to provide at least the name of the VM. In bhyve, if the memsize is not specified the default VM is created with 256MB of the memory.</p>
</blockquote>

<p><code># grub-bhyve test</code><br>
<code>GNU GRUB version 2.00</code><br>
<code>Minimal BASH-like line editing is supported. For the first word, TAB lists possible command</code><br>
<code>completions. Anywhere else TAB lists possible device or file completions.</code><br>
<code></code><br>
<code></code><br>
<code>grub&gt;</code></p>

<blockquote>
<p>After running grub-bhyve command we will enter the GRUB loader. If we type the ls command, we will see all the available devices. In the case of the grub2-bhyve there is one additional device called “(host)” that is always available and allows the host filesystem to be accessed. We can list files under that device.</p>
</blockquote>

<p><code>grub&gt; ls</code><br>
<code>(host)</code><br>
<code>grub&gt; ls (host)/</code><br>
<code>libexec/ bin/ usr/ bhyve/ compat/ tank/ etc/ boot/ net/ entropy proc/ lib/ root/ sys/ mnt/ rescue/ tmp/ home/ sbin/ media/ jail/ COPYRIGHT var/ dev/</code><br>
<code>grub&gt;</code></p>

<blockquote>
<p>To exit console simply type ‘reboot’. I would like to install my new operating system under a ZVOL <code>ztank/bhyve/post</code>. On another terminal, we create:</p>
</blockquote>

<p><code># zfs create -V 10G ztank/bhyve/post</code></p>

<blockquote>
<p>If you don’t use ZFS for some crazy reason you can also create a raw blob using the truncate(1) command.</p>
</blockquote>

<p><code># truncate -s 10G post.img</code></p>

<blockquote>
<p>I recommend installing an operating system from the disk image (installXX.fs for OpenBSD and NetBSD-X.X-amd64-install.img for NetBSD). Now we need to create a device map for a GRUB.</p>
</blockquote>

<p><code>cat &gt; /tmp/post.map &lt;&lt; EOF</code><br>
<code>(hd0) /directory/to/disk/image</code><br>
<code>(hd1) /dev/zvol/ztank/bhyve/post</code><br>
<code>EOF</code></p>

<blockquote>
<p>The mapping files describe the names for files in the GRUB. In our case under hd0 we will have an installation image and in hd1 we will have our ZVOL/blob. You can also try to use an ISO image then instead of using hd0 device name use a cd0. When we will run the grub-bhyve command we will see two additional devices.</p>
</blockquote>

<p><code># grub-bhyve -m /tmp/post.map post</code><br>
<code>grub&gt; ls</code><br>
<code>(hd0) (hd0,msdos4) (hd0,msdos1) (hd0,openbsd9) (hd0,openbsd1) (hd1) (host)</code></p>

<blockquote>
<p>The hd0 (in this example OpenBSD image) contains multiple partitions. We can check what is on it.</p>
</blockquote>

<p><code>grub&gt; ls (hd0,msdos4)/</code><br>
<code>boot bsd 6.4/ etc/</code></p>

<blockquote>
<p>And this is the partition that contains a kernel. Now we can set a root device, load an OpenBSD kernel and boot:</p>
</blockquote>

<p><code>grub&gt; set root=(hd0,msdos4)</code><br>
<code>grub&gt; kopenbsd -h com0 -r sd0a /bsd</code><br>
<code>grub&gt; boot</code></p>

<blockquote>
<p>After that, we can run bhyve virtual machine. In my case it is:</p>
</blockquote>

<p><code># bhyve -c 1 -w -u -H \</code><br>
<code>-s 0,amd_hostbridge \</code><br>
<code>-s 3,ahci-hd,/directory/to/disk/image \</code><br>
<code>-s 4,ahci-hd,/dev/zvol/ztank/bhyve/post \</code><br>
<code>-s 31,lpc -l com1,stdio \</code><br>
<code>post</code></p>

<blockquote>
<p>Unfortunately explaining the whole bhyve(8)  command line is beyond this article. After installing the operating system remove hd0 from the mapping file and the image from the bhyve(8) command. If you don’t want to type all those GRUB commands, you can simply redirect them to the standard input.</p>
</blockquote>

<p><code>cat &lt;&lt; EOF | grub-bhyve -m /tmp/post.map -M 512 post</code><br>
<code>set root=(hd0,4)</code><br>
<code>kopenbsd -h com0 -r sd0a /bsd</code><br>
<code>boot</code><br>
<code>EOF</code></p>

<p><hr></p>

<p>###<a href="https://vermaden.wordpress.com/2018/09/07/my-freebsd-story/">My FreeBSD Story</a></p>

<blockquote>
<p>My first devices/computers/consoles (not at the same time) that I remember were Atari 2600 and Pegasus console which was hardware clone of the Nintendo NES.<br>
Back then I did not even knew that it was Atari 2600 as I referred to it as Video Computer System … and I did not even knew any english by then. It took me about two decades to get to know (by accident) that this Video Computer System was Atari 2600<br>
Then I got AMIGA 600 computer (or should I say my parents bought it for me) which served both for playing computer games and also other activities for the first time. AMIGA is the computer that had the greatest influence on me, as it was the first time I studied the books about Amiga Workbench operating system and learned commands from Amiga Shell terminal. I loved the idea of Ram Disk icon/directory on the desktop that allowed me to transparently put any things in system memory. I still miss that concept on today’s desktop systems … and I still remember how dismal I was when I watched Amiga Deathbed Vigil movie.<br>
At the end of 1998 I got my first PC that of course came with Windows and that computer served both as gaming machine and as well as typical tool. One time I dig into the internals with Windows Registry (which left me disgusted by its concepts and implementation) and its limited command line interface provided by CMD.EXE executable. I remember that the heart of this box was not the CPU or the motherboard but the graphics accelerator – the legendary 3Dfx Voodoo card. This company (3Dfx) – their attitude and philosophy – also left solid fingerprint on my way. Like AMIGA did.<br>
After ‘migration’ from AMIGA to PC it never again ‘felt right’. The games were cool but the Windows system was horrible. Time has passed and different Windows versions and hardware modifications took place. Windows XP felt really heavy at that time, not to mention Windows 2000 for example with even bigger hardware requirements. I also do not understand all the hate about Windows ME. It crashed with the same frequency as Windows 98 or later Windows 98 Second Edition but maybe my hardware was different ??<br>
I do not have any ‘mine’ screenshots from that period as I lost all my 40 GB (huge then) drive of data when I moved/resized the partition with Partition Magic to get some more space from the less filled C: drive. That day I learned hard that “there are people who do backups and people who will do backups”. I never lost data again as I had multiple copies of my data, but the same as Netheril fall the lost data was was gone forever.<br>
I always followed various alternatives which led me to try Linux in 2003, after reading about various distributions philosophies I decided to run Slackware Linux with KDE 3. My buddy used Aurox Linux by then (one of the few Linux distributions from Poland) and encouraged me to do the same – especially in the context of fixing possible problems as he already knew it and also as he recently dumped Windows system. But Slackware sounded like a better idea so I took that path instead. At first I dual booted between Windows XP and Slackware Linux cause I had everything worked out on the Windows world while I often felt helpless in the Linux world, so I would reboot into Windows to play some games or find a solution for Linux problem if that was required. I remember how strange the concept of dual clipboards (PRIMARY and SECONDARY) was for me by then. I was amazed why ‘so much better’ system as Linux (at least marketed that way) needs a system tray program to literally manage the clipboard. On Windows it was obvious, you do [CTRL]+[C] to copy and [CTRL]+[V] to paste things, but on Linux there (no I know its X11 feature) there were two clipboards that were synchronized by this little system tray program from KDE 3. It was also unthinkable for me that I will ‘lost’ contents of last/recent [CTRL]+[C] operation if I close the application from which the copy was made. I settled down a little on Slackware but not for long. I really did not liked manual dependency management for packages for example. Also KDE 3 was really ugly and despite trying all possible options I was not able to tweak it into something nice looking.<br>
After half a year on Slackware I checked the Linux distributions again and decided to try Gentoo Linux. I definitely agree with the image below which visualizes Gentoo Linux experience, especially when You install it for he first time ??<br>
Of course I went with the most hardcore version with self building Stage 1 (compiler and toolchain) which was horrible idea at that time because compilation on slow single core machine took forever … but after many hours I got Gentoo installed. I now have to decide which desktop environment to use. I have read a lot of good news about Fluxbox at that time so this is what I tried. It was very weird experience (to create everything in GUI from scratch) but very pleasant one. That recalled me the times of AMIGA … but Linux came in the way too much often. The more I dig into Gentoo Linux the more I read that lots of Gentoo features are based on FreeBSD solutions. Gentoo Portage is a clone of FreeBSD Ports. That ‘central’ /etc/rc.conf system configuration file concept was taken from FreeBSD as well. So I started to gather information about FreeBSD. The (then) FreeBSD website or FreeBSD Ports site (still) felt little outdated to say the least but that did not discouraged me.<br>
Somewhere in 2005 I installed FreeBSD 5.4 on my computer. The beginnings were hard, like the earlier step with Gentoo but similarly like Gentoo the FreeBSD project came with a lot of great documentation. While Gentoo documentation is concentrated within various Gentoo Wiki sites the FreeBSD project comes with ‘official’ documentation in the form of Handbook and FAQ. I remember my first questions at the now nonexistent <a href="http://BSDForums.org">BSDForums.org</a> site – for example one of the first ones – how to scroll the terminal output in the plain console. I now know that I had to push Scroll Lock button but it was something totally new for me.<br>
Why FreeBSD and not OpenBSD or NetBSD? Probably because Gentoo based most their concepts on the FreeBSD solutions, so that led me to FreeBSD instead of the other BSD operating systems. Currently I still use FreeBSD but I keep an steady eye on the OpenBSD, HardenedBSD and DragonFly BSD solutions and improvements.<br>
As the migration path from Linux to FreeBSD is a lot easier – all configuration files from /home can be just copied – the migration was quite fast easy. I again had the Fluxbox configuration which I used on the Gentoo. Now – on FreeBSD – it started to fell even more like AMIGA times. Everything is/has been well thought and had its place and reason. The documentation was good and the FreeBSD Community was second to none.<br>
After 15 years of using various Windows, UNIX (macOS/AIX/HP-UX/Solaris/OpenSolaris/Illumos/FreeBSD/OpenBSD/NetBSD) and UNIX-like (Linux) systems I always come to conclusion that FreeBSD is the system that sucks least. And sucks least with each release and one day I will write why FreeBSD is such great operating system … if I already haven’t</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://blog.gsora.xyz/openbsd-on-the-desktop-some-thoughts/">OpenBSD on the Desktop: some thoughts</a></p>

<blockquote>
<p>I’ve been using OpenBSD on my ThinkPad X230 for some weeks now, and the experience has been peculiar in some ways.<br>
The OS itself in my opinion is not ready for widespread desktop usage, and the development team is not trying to push it in the throat of anybody who wants a Windows or macOS alternative. You need to understand a little bit of how *NIX systems work, because you’ll use CLI more than UI. That’s not necessarily bad, and I’m sure I learned a trick or two that could translate easily to Linux or macOS. Their development process is purely based on developers that love to contribute and hack around, just because it’s fun. Even the mailing list is a cool place to hang on! Code correctness and security are a must, nothing gets committed if it doesn’t get reviewed thoroughly first - nowadays the first two properties should be enforced in every major operating system.<br>
I like the idea of a platform that continually evolves. pledge(2) and unveil(2) are the proof that with a little effort, you can secure existing software better than ever.<br>
I like the “sensible defaults” approach, having an OS ready to be used - UI included if you selected it during the setup process - is great.<br>
Just install a browser and you’re ready to go.<br>
Manual pages on OpenBSD are real manuals, not an extension of the “–help” command found in most CLI softwares. They help you understand inner workings of the operating system, no internet connection needed. There are some trade-offs, too.<br>
Performance is not first-class, mostly because of all the security mitigations and checks done at runtime.<br>
I write Go code in neovim, and sometimes you can feel a slight slowdown when you’re compiling and editing multiple files at the same time, but usually I can’t notice any meaningful difference. Browsers are a different matter though, you can definitely feel something differs from the experience you can have on mainstream operating systems. But again, trade-offs.<br>
To use OpenBSD on the desktop you must be ready to sacrifice some of the goodies of mainstream OSes, but if you’re searching for a zen place to do your computing stuff, it’s the best you can get right now.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/unix/DirectoryDTypeHistory">The history of file type information being available in Unix directories</a></p>

<blockquote>
<p>The two things that Unix directory entries absolutely have to have are the name of the directory entry and its ‘inode’, by which we generically mean some stable kernel identifier for the file that will persist if it gets renamed, linked to other directories, and so on. Unsurprisingly, directory entries have had these since the days when you read the raw bytes of directories with read(), and for a long time that was all they had; if you wanted more than the name and the inode number, you had to stat() the file, not just read the directory. Then, well, I’ll quote myself from an old entry on a find optimization:<br>
[…], Unix filesystem developers realized that it was very common for programs reading directories to need to know a bit more about directory entries than just their names, especially their file types (find is the obvious case, but also consider things like ‘ls -F’). Given that the type of an active inode never changes, it’s possible to embed this information straight in the directory entry and then return this to user level, and that’s what developers did; on some systems, readdir(3) will now return directory entries with an additional d_type field that has the directory entry’s type.<br>
On Twitter, I recently grumbled about Illumos not having this d_type field. The ensuing conversation wound up with me curious about exactly where d_type came from and how far back it went. The answer turns out to be a bit surprising due to there being two sides of d_type.<br>
On the kernel side, d_type appears to have shown up in 4.4 BSD. The 4.4 BSD /usr/src/sys/dirent.h has a struct dirent that has a d_type field, but the field isn’t documented in either the comments in the file or in the getdirentries(2) manpage; both of those admit only to the traditional BSD dirent fields. This 4.4 BSD d_type was carried through to things that inherited from 4.4 BSD (Lite), specifically FreeBSD, but it continued to be undocumented for at least a while.<br>
(In FreeBSD, the most convenient history I can find is here, and the d_type field is present in sys/dirent.h as far back as FreeBSD 2.0, which seems to be as far as the repo goes for releases.)<br>
Documentation for d_type appeared in the getdirentries(2) manpage in FreeBSD 2.2.0, where the manpage itself claims to have been updated on May 3rd 1995 (cf). In FreeBSD, this appears to have been part of merging 4.4 BSD ‘Lite2’, which seems to have been done in 1997. I stumbled over a repo of UCB BSD commit history, and in it the documentation appears in this May 3rd 1995 change, which at least has the same date. It appears that FreeBSD 2.2.0 was released some time in 1997, which is when this would have appeared in an official release.<br>
In Linux, it seems that a dirent structure with a d_type member appeared only just before 2.4.0, which was released at the start of 2001. Linux took this long because the d_type field only appeared in the 64-bit ‘large file support’ version of the dirent structure, and so was only return by the new 64-bit getdents64() system call. This would have been a few years after FreeBSD officially documented d_type, and probably many years after it was actually available if you peeked at the structure definition.<br>
As far as I can tell, d_type is present on Linux, FreeBSD, OpenBSD, NetBSD, Dragonfly BSD, and Darwin (aka MacOS or OS X). It’s not present on Solaris and thus Illumos. As far as other commercial Unixes go, you’re on your own; all the links to manpages for things like AIX from my old entry on the remaining Unixes appear to have rotted away.<br>
Sidebar: The filesystem also matters on modern Unixes<br>
Even if your Unix supports d_type in directory entries, it doesn’t mean that it’s supported by the filesystem of any specific directory. As far as I know, every Unix with d_type support has support for it in their normal local filesystems, but it’s not guaranteed to be in all filesystems, especially non-Unix ones like FAT32. Your code should always be prepared to deal with a file type of DT_UNKNOWN.<br>
It’s also possible to have things the other way around, where you have a filesystem with support for file type information in directories that’s on a Unix that doesn’t support it. There are a number of plausible reasons for this to happen, but they’re either obvious or beyond the scope of this entry.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://euroquis.nl/bobulate/?p=1979">Multiboot Pinebook KDE neon</a></p>

<blockquote>
<p>Recently a KDE neon image for the Pinebook was announced. There is a new image, with a handful of fixes, which the KDE Plasma team has been working on over the past week and a half.<br>
Here’s a picture of my Pinebook running KDE neon — watching Panic! At the Disco’s High Hopes — sitting in front of my monitor that’s hooked up to one of my openSUSE systems. There are still some errata, and watching video sucks up battery, but for hacking on documentation from my hammock in the garden, or doing IRC meetings it’s a really nice machine.<br>
But one of the neat things about running KDE neon off of an SD card on the Pinebook is that it’s portable — that SD card can move around. So let’s talk about multiboot in the sense of “booting the same OS storage medium in different hardware units” rather than “booting different OS from a medium in a single hardware unit”. On these little ARM boards, u-boot does all the heavy lifting early in the boot process. So to re-use the KDE neon Pinebook image on another ARM board, the u-boot blocks need to be replaced.<br>
I have the u-boot from a Pine64 image (I forget what) lying around, 1015 blocks of 1024 bytes, which I can dd over the u-boot blocks on the SD card, dd bs=1k conv=notrunc,sync if=uboot.img of=/dev/da0 seek=8, and then the same SD card, with the filesystem and data from the Pinebook, will boot on the Pine64 board. Of course, to move the SD card back again, I need to restore the Pinebook u-boot blocks.<br>
Here’s a picture of my Pineboard (the base is a piece of the garden fence, it’s Douglas pine, with 4mm threaded rods acting as the corner posts for my Pine64 mini-rack), with power and network and a serial console attached, along with the serial console output of the same.<br>
The nice thing here is that the same software stack runs on the Pine64 but then has a wired network — which in turn means that if I switch on the other boards in that mini-rack, I’ve got a distcc-capable cluster for fast development, and vast NFS storage (served from ZFS on my FreeBSD machines) for source. I can develop in a high(er) powered environment, and then swap the card around into the Pinebook for testing-on-the-go.<br>
So to sum up: you can multiboot the KDE neon Pinebook image on other Pine64 hardware (i.e. the Pine64 board). To do so, you need to swap around u-boot blocks. The blocks can be picked out of an image built for each board, and then a particular image (e.g. the latest KDE neon Pinebook) can be run on either board.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2018-September/357883.html">Unexpected benefit with Ryzen – reducing power for build server</a></li>
<li><a href="https://mwl.io/archives/3758">Happy #CIDRDay!</a></li>
<li><a href="https://mwl.io/archives/3771">Absolute FreeBSD 3e ship date</a></li>
<li><a href="http://www.mug.org/">MWL FreeBSD talk @ October 9th 2018 - MUG Meeting</a></li>
<li><a href="https://www.ixsystems.com/blog/meetbsd-2018-countdown/">MeetBSD Oct 19-20</a></li>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-September/014218.html">October’s London *BSD meetup - 9th Oct 2018</a></li>
<li><a href="https://www.bsd.nrw/">NRW BUG Meeting at Trivago Oct. 9</a></li>
<li><a href="https://blog.socruel.nu/misc/eurobsdcon-2018.html">Lars Wittebrood blogs about his visit to EuroBSDCon 2018</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180925075334">EuroBSDcon 2018 OpenBSD slides available</a></li>
<li><a href="https://2018.eurobsdcon.org/talks-speakers/">EuroBSDCon conference site has most slides as well</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Brad - <a href="http://dpaste.com/3T9M2QC#wrap">Unmounted ZFS sends</a></li>
<li>Niclas - <a href="http://dpaste.com/11TKDK2">Report from a Meetup</a></li>
<li>Ghislain - <a href="http://dpaste.com/2790GC6">Bhyve not used?</a></li>
<li>Shane - <a href="http://dpaste.com/1P055SQ">zpool history and snapshots</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 265: Software Disenchantment | BSD Now 265</title>
  <link>https://www.bsdnow.tv/265</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2631</guid>
  <pubDate>Thu, 27 Sep 2018 04:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/01bccaf7-cfe6-48d1-90e8-8fd66badaeb6.mp3" length="61339126" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We report from our experiences at EuroBSDcon, disenchant software, LLVM 7.0.0 has been released, Thinkpad BIOS update options, HardenedBSD Foundation announced, and ZFS send vs. rsync.</itunes:subtitle>
  <itunes:duration>1:41:55</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We report from our experiences at EuroBSDcon, disenchant software, LLVM 7.0.0 has been released, Thinkpad BIOS update options, HardenedBSD Foundation announced, and ZFS send vs. rsync.
&lt;p&gt;##Headlines&lt;/p&gt;
&lt;p&gt;###[FreeBSD DevSummit &amp;amp; EuroBSDcon 2018 in Romania]&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Your hosts are back from EuroBSDcon 2018 held in Bucharest, Romania this year. The first two days of the conference are used for tutorials and devsummits (FreeBSD and NetBSD), while the last two are for talks.&lt;/li&gt;
&lt;li&gt;Although Benedict organized the devsummit in large parts, he did not attend it this year. He held his Ansible tutorial in the morning of the first day, followed by Niclas Zeising’s new ports and poudriere tutorial (which had a record attendance). It was intended for beginners that had never used poudriere before and those who wanted to create their first port. The tutorial was well received and Niclas already has ideas for extending it for future conferences.&lt;/li&gt;
&lt;li&gt;On the second day, Benedict took Kirk McKusick’s “An Introduction to the FreeBSD Open-Source Operating System” tutorial, held as a one full day class this year. Although it was reduced in content, it went into enough depth of many areas of the kernel and operating system to spark many questions from attendees. Clearly, this is a good start into kernel programming as Kirk provides enough material and backstories to understand why certain things are implemented as they are.&lt;/li&gt;
&lt;li&gt;Olivier Robert took &lt;a href="https://www.talegraph.com/tales/l2o9ltrvsE"&gt;https://www.talegraph.com/tales/l2o9ltrvsE&lt;/a&gt; (pictures from the devsummit) and created a nice gallery out of it.&lt;/li&gt;
&lt;li&gt;Devsummit evenings saw dinners at two restaurants that allowed developers to spend some time talking over food and drinks.&lt;/li&gt;
&lt;li&gt;The conference opened on the next day with the opening session held by Mihai Carabas. He introduced the first keynote speaker, a colleague of his who presented “Lightweight virtualization with LightVM and Unikraft”.&lt;/li&gt;
&lt;li&gt;Benedict helped out at the FreeBSD Foundation sponsor table and talked to people. He saw the following talks in between:&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Selfhosting as an alternative to the public cloud (by Albert Dengg)&lt;br&gt;
Using Boot Environments at Scale (by Allan Jude)&lt;br&gt;
Livepatching FreeBSD kernel (by Maciej Grochowski)&lt;br&gt;
FreeBSD: What to (Not) Monitor (by Andrew Fengler)&lt;br&gt;
FreeBSD Graphics (by Niclas Zeising)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Allan spent a lot of time talking to people and helping track down issues they were having, in addition to attending many talks:
&lt;blockquote&gt;
&lt;p&gt;Hacking together a FreeBSD presentation streaming box – For as little as possible (by Tom Jones)&lt;br&gt;
Introduction of FreeBSD in new environments (by Baptiste Daroussin)&lt;br&gt;
Keynote: Some computing and networking historical perspectives (by Ron Broersma)&lt;br&gt;
Livepatching FreeBSD kernel (by Maciej Grochowski)&lt;br&gt;
FreeBSD: What to (Not) Monitor (by Andrew Fengler)&lt;br&gt;
Being a BSD user (by Roller Angel)&lt;br&gt;
From “Hello World” to the VFS Layer: building a beadm for DragonFly BSD (by Michael Voight)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;/li&gt;
&lt;li&gt;We also met the winner of our Power Bagel raffle from &lt;a href="http://www.bsdnow.tv/episodes/2018_07_25-2_8_because_computers"&gt;Episode 2^8&lt;/a&gt;. He received the item in the meantime and had it with him at the conference, providing a power outlet to charge other people’s devices.&lt;/li&gt;
&lt;li&gt;During the closing session, &lt;a href="https://twitter.com/groffthebsdgoat"&gt;GroffTheBSDGoat&lt;/a&gt; was handed over to Deb Goodkin, who will bring the little guy to the &lt;a href="https://ghc.anitab.org/"&gt;Grace Hopper Celebration of Women in Computing conference&lt;/a&gt; and then to &lt;a href="http://meetbsd.com"&gt;MeetBSD&lt;/a&gt; later this year. It was also revealed that next year’s EuroBSDcon will be held in Lillehammer, Norway.&lt;/li&gt;
&lt;li&gt;Thanks to all the speakers, helpers, sponsors, organizers, and attendees for making it a successful conferences. There were no talks recorded this year, but the slides will be uploaded to the &lt;a href="http://eurobsdcon.org"&gt;EuroBSDcon website&lt;/a&gt; in a couple of weeks. The &lt;a href="https://www.openbsd.org/events.html#eurobsdcon2018"&gt;OpenBSD talks&lt;/a&gt; are already available, so check them out.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;###&lt;a href="http://tonsky.me/blog/disenchantment/"&gt;Software disenchantment&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I’ve been programming for 15 years now. Recently our industry’s lack of care for efficiency, simplicity, and excellence started really getting to me, to the point of me getting depressed by my own career and the IT in general.&lt;br&gt;
Modern cars work, let’s say for the sake of argument, at 98% of what’s physically possible with the current engine design. Modern buildings use just enough material to fulfill their function and stay safe under the given conditions. All planes converged to the optimal size/form/load and basically look the same.&lt;br&gt;
Only in software, it’s fine if a program runs at 1% or even 0.01% of the possible performance. Everybody just seems to be ok with it. People are often even proud about how much inefficient it is, as in “why should we worry, computers are fast enough”:&lt;br&gt;
@tveastman: I have a Python program I run every day, it takes 1.5 seconds. I spent six hours re-writing it in rust, now it takes 0.06 seconds. That efficiency improvement means I’ll make my time back in 41 years, 24 days :-)&lt;br&gt;
You’ve probably heard this mantra: “programmer time is more expensive than computer time”. What it means basically is that we’re wasting computers at an unprecedented scale. Would you buy a car if it eats 100 liters per 100 kilometers? How about 1000 liters? With computers, we do that all the time.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Everything is unbearably slow&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Look around: our portable computers are thousands of times more powerful than the ones that brought man to the moon. Yet every other webpage struggles to maintain a smooth 60fps scroll on the latest top-of-the-line MacBook Pro. I can comfortably play games, watch 4K videos but not scroll web pages? How is it ok?&lt;br&gt;
Google Inbox, a web app written by Google, running in Chrome browser also by Google, takes 13 seconds to open moderately-sized emails:&lt;br&gt;
It also animates empty white boxes instead of showing their content because it’s the only way anything can be animated on a webpage with decent performance. No, decent doesn’t mean 60fps, it’s rather “as fast as this web page could possibly go”. I’m dying to see web community answer when 120Hz displays become mainstream. Shit barely hits 60Hz already.&lt;br&gt;
Windows 10 takes 30 minutes to update. What could it possibly be doing for that long? That much time is enough to fully format my SSD drive, download a fresh build and install it like 5 times in a row.&lt;br&gt;
Pavel Fatin: Typing in editor is a relatively simple process, so even 286 PCs were able to provide a rather fluid typing experience.&lt;br&gt;
Modern text editors have higher latency than 42-year-old Emacs. Text editors! What can be simpler? On each keystroke, all you have to do is update tiny rectangular region and modern text editors can’t do that in 16ms. It’s a lot of time. A LOT. A 3D game can fill the whole screen with hundreds of thousands (!!!) of polygons in the same 16ms and also process input, recalculate the world and dynamically load/unload resources. How come?&lt;br&gt;
As a general trend, we’re not getting faster software with more features. We’re getting faster hardware that runs slower software with the same features. Everything works way below the possible speed. Ever wonder why your phone needs 30 to 60 seconds to boot? Why can’t it boot, say, in one second? There are no physical limitations to that. I would love to see that. I would love to see limits reached and explored, utilizing every last bit of performance we can get for something meaningful in a meaningful way.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Everything is HUUUUGE&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;And then there’s bloat. Web apps could open up to 10× faster if you just simply block all ads. Google begs everyone to stop shooting themselves in their feet with AMP initiative—a technology solution to a problem that doesn’t need any technology, just a little bit of common sense. If you remove bloat, the web becomes crazy fast. How smart do you have to be to understand that?&lt;br&gt;
Android system with no apps takes almost 6 Gb. Just think for a second how obscenely HUGE that number is. What’s in there, HD movies? I guess it’s basically code: kernel, drivers. Some string and resources too, sure, but those can’t be big. So, how many drivers do you need for a phone?&lt;br&gt;
Windows 95 was 30Mb. Today we have web pages heavier than that! Windows 10 is 4Gb, which is 133 times as big. But is it 133 times as superior? I mean, functionally they are basically the same. Yes, we have Cortana, but I doubt it takes 3970 Mb. But whatever Windows 10 is, is Android really 150% of that?&lt;br&gt;
Google keyboard app routinely eats 150 Mb. Is an app that draws 30 keys on a screen really five times more complex than the whole Windows 95? Google app, which is basically just a package for Google Web Search, is 350 Mb! Google Play Services, which I do not use (I don’t buy books, music or videos there)—300 Mb that just sit there and which I’m unable to delete.&lt;br&gt;
All that leaves me around 1 Gb for my photos after I install all the essential (social, chats, maps, taxi, banks etc) apps. And that’s with no games and no music at all! Remember times when an OS, apps and all your data fit on a floppy?&lt;br&gt;
Your desktop todo app is probably written in Electron and thus has userland driver for Xbox 360 controller in it, can render 3d graphics and play audio and take photos with your web camera.&lt;br&gt;
A simple text chat is notorious for its load speed and memory consumption. Yes, you really have to count Slack in as a resource-heavy application. I mean, chatroom and barebones text editor, those are supposed to be two of the less demanding apps in the whole world. Welcome to 2018.&lt;br&gt;
At least it works, you might say. Well, bigger doesn’t imply better. Bigger means someone has lost control. Bigger means we don’t know what’s going on. Bigger means complexity tax, performance tax, reliability tax. This is not the norm and should not become the norm. Overweight apps should mean a red flag. They should mean run away scared.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Better world manifesto&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I want to see progress. I want change. I want state-of-the-art in software engineering to improve, not just stand still. I don’t want to reinvent the same stuff over and over, less performant and more bloated each time. I want something to believe in, a worthy end goal, a future better than what we have today, and I want a community of engineers who share that vision.&lt;br&gt;
What we have today is not progress. We barely meet business goals with poor tools applied over the top. We’re stuck in local optima and nobody wants to move out. It’s not even a good place, it’s bloated and inefficient. We just somehow got used to it.&lt;br&gt;
So I want to call it out: where we are today is bullshit. As engineers, we can, and should, and will do better. We can have better tools, we can build better apps, faster, more predictable, more reliable, using fewer resources (orders of magnitude fewer!). We need to understand deeply what are we doing and why. We need to deliver: reliably, predictably, with topmost quality. We can—and should–take pride in our work. Not just “given what we had…”—no buts!&lt;br&gt;
I hope I’m not alone at this. I hope there are people out there who want to do the same. I’d appreciate if we at least start talking about how absurdly bad our current situation in the software industry is. And then we maybe figure out how to get out.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://lists.llvm.org/pipermail/llvm-announce/2018-September/000080.html"&gt;[llvm-announce] LLVM 7.0.0 Release&lt;/a&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;I am pleased to announce that LLVM 7 is now available.

Get it here: https://llvm.org/releases/download.html#7.0.0

The release contains the work on trunk up to SVN revision 338536 plus
work on the release branch. It is the result of the community's work
over the past six months, including: function multiversioning in Clang
with the 'target' attribute for ELF-based x86/x86_64 targets, improved
PCH support in clang-cl, preliminary DWARF v5 support, basic support
for OpenMP 4.5 offloading to NVPTX, OpenCL C++ support, MSan, X-Ray
and libFuzzer support for FreeBSD, early UBSan, X-Ray and libFuzzer
support for OpenBSD, UBSan checks for implicit conversions, many
long-tail compatibility issues fixed in lld which is now production
ready for ELF, COFF and MinGW, new tools llvm-exegesis, llvm-mca and
diagtool. And as usual, many optimizations, improved diagnostics, and
bug fixes.

For more details, see the release notes:
https://llvm.org/releases/7.0.0/docs/ReleaseNotes.html
https://llvm.org/releases/7.0.0/tools/clang/docs/ReleaseNotes.html
https://llvm.org/releases/7.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
https://llvm.org/releases/7.0.0/tools/lld/docs/ReleaseNotes.html

Thanks to everyone who helped with filing, fixing, and code reviewing
for the release-blocking bugs!

Special thanks to the release testers and packagers: Bero
Rosenkränzer, Brian Cain, Dimitry Andric, Jonas Hahnfeld, Lei Huang
Michał Górny, Sylvestre Ledru, Takumi Nakamura, and Vedant Kumar.

For questions or comments about the release, please contact the
community on the mailing lists. Onwards to LLVM 8!

Cheers,
Hans
&lt;/code&gt;&lt;/pre&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blog.raveland.org/post/thinkpad_update_bios/"&gt;Update your Thinkpad’s bios with Linux or OpenBSD&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Get your new bios&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;At first, go to the Lenovo website and download your new bios:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Go to lenovo support&lt;/li&gt;
&lt;li&gt;Use the search bar to find your product (example for me, x270)&lt;/li&gt;
&lt;li&gt;Choose the right product (if necessary) and click search&lt;/li&gt;
&lt;li&gt;On the right side, click on Update Your System&lt;/li&gt;
&lt;li&gt;Click on BIOS/UEFI&lt;/li&gt;
&lt;li&gt;Choose *BIOS Update (Bootable CD) for Windows *&lt;/li&gt;
&lt;li&gt;Download&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;For me the file is called like this : r0iuj25wd.iso&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Extract bios update&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Now you will need to install geteltorito.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;With OpenBSD:&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;$ doas pkgadd geteltorito&lt;/code&gt;&lt;br&gt;
&lt;code&gt;quirks-3.7 signed on 2018-09-09T13:15:19Z&lt;/code&gt;&lt;br&gt;
&lt;code&gt;geteltorito-0.6: ok&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;With Debian:&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;$ sudo apt-get install genisoimage&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Now we will extract the bios update :&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;$ geteltorito -o biosupdate.img r0iuj25wd.iso&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Booting catalog starts at sector: 20&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Manufacturer of CD: NERO BURNING ROM VER 12&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Image architecture: x86&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Boot media type is: harddisk&lt;/code&gt;&lt;br&gt;
&lt;code&gt;El Torito image starts at sector 27 and has 43008 sector(s) of 512 Bytes&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Image has been written to file "biosupdate.img".&lt;/code&gt;&lt;br&gt;
&lt;code&gt;This will create a file called biosupdate.img.&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Put the image on an USB key&lt;/li&gt;
&lt;li&gt;CAREFULL : on my computer, my USB key is sda1 on Linux and sd1 on OpenBSD.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Please check twice on your computer the name of your USB key.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;With OpenBSD :&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;$ doas dd if=biosupdate.img of=/dev/rsd1c&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;With Linux :&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;$ sudo dd if=biosupdate.img of=/dev/sda&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Now all you need is to reboot, to boot on your USB key and follow the instructions. Enjoy 😉&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://hardenedbsd.org/article/shawn-webb/2018-09-17/announcing-hardenedbsd-foundation"&gt;Announcing The HardenedBSD Foundation&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;In June of 2018, we announced our intent to become a not-for-profit, tax-exempt 501©(3) organization in the United States. It took a dedicated team months of work behind-the-scenes to make that happen. On 06 September 2018, HardenedBSD Foundation Corp was granted 501©(3) status, from which point all US-based persons making donations can deduct the donation from their taxes.&lt;br&gt;
We are grateful for those who contribute to HardenedBSD in whatever way they can. Thank you for making HardenedBSD possible. We look forward to a bright future, driven by a helpful and positive community.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSSendRecvVsRsync"&gt;How you migrate ZFS filesystems matters&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;If you want to move a ZFS filesystem around from one host to another, you have two general approaches; you can use ‘zfs send’ and ‘zfs receive’, or you can use a user level copying tool such as rsync (or ‘tar -cf | tar -xf’, or any number of similar options). Until recently, I had considered these two approaches to be more or less equivalent apart from their convenience and speed (which generally tilted in favour of ‘zfs send’). It turns out that this is not necessarily the case and there are situations where you will want one instead of the other.&lt;br&gt;
We have had two generations of ZFS fileservers so far, the Solaris ones and the OmniOS ones. When we moved from the first generation to the second generation, we migrated filesystems across using ‘zfs send’, including the filesystem with my home directory in it (we did this for various reasons). Recently I discovered that some old things in my filesystem didn’t have file type information in their directory entries. ZFS has been adding file type information to directories for a long time, but not quite as long as my home directory has been on ZFS.&lt;br&gt;
This illustrates an important difference between the ‘zfs send’ approach and the rsync approach, which is that zfs send doesn’t update or change at least some ZFS on-disk data structures, in the way that re-writing them from scratch from user level does. There are both positives and negatives to this, and a certain amount of rewriting does happen even in the ‘zfs send’ case (for example, all of the block pointers get changed, and ZFS will re-compress your data as applicable).&lt;br&gt;
I knew that in theory you had to copy things at the user level if you wanted to make sure that your ZFS filesystem and everything in it was fully up to date with the latest ZFS features. But I didn’t expect to hit a situation where it mattered in practice until, well, I did. Now I suspect that old files on our old filesystems may be partially missing a number of things, and I’m wondering how much of the various changes in ‘zfs upgrade -v’ apply even to old data.&lt;br&gt;
(I’d run into this sort of general thing before when I looked into ext3 to ext4 conversion on Linux.)&lt;br&gt;
With all that said, I doubt this will change our plans for migrating our ZFS filesystems in the future (to our third generation fileservers). ZFS sending and receiving is just too convenient, too fast and too reliable to give up. Rsync isn’t bad, but it’s not the same, and so we only use it when we have to (when we’re moving only some of the people in a filesystem instead of all of them, for example).&lt;br&gt;
PS: I was going to try to say something about what ‘zfs send’ did and didn’t update, but having looked briefly at the code I’ve concluded that I need to do more research before running my keyboard off. In the mean time, you can read the OpenZFS wiki page on ZFS send and receive, which has plenty of juicy technical details.&lt;br&gt;
PPS: Since eliminating all-zero blocks is a form of compression, you can turn zero-filled files into sparse files through a ZFS send/receive if the destination has compression enabled. As far as I know, genuine sparse files on the source will stay sparse through a ZFS send/receive even if they’re sent to a destination with compression off.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/BSD-Users-Stockholm/events/254235663/"&gt;BSD Users Stockholm Meetup #4: Tuesday, November 13, 2018 at 18:00&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://bsd-pl.org/en"&gt;BSD Poland User Group: Next Meeting: October 11, 2018, 18:15 - 21:15 at Warsaw University of Technology&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180915112028"&gt;n2k18 Hackathon report: Ken Westerback (krw@) on disklabel(8) work, dhclient(8) progress&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lists.xenproject.org/archives/html/mirageos-devel/2018-09/msg00013.html"&gt;Running MirageOS Unikernels on OpenBSD in vmm (Now Works)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180910070407"&gt;vmm(4) gets support for qcow2&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://oshogbo.vexillium.org/blog/52/"&gt;MeetBSD and SecurityBsides&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/cperciva/status/1041433506453155840"&gt;Colin Percival reduced FreeBSD startup time from 10627ms (11.2) to 4738ms (12.0)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-announce/2018-September/001842.html"&gt;FreeBSD 11.1 end-of-life&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/KnoxBUG-BSD-Linux-and-FOSS-Users-Unite/events/254759084"&gt;KnoxBug: Monday, October 1, 2018 at 18:00: Real-world Performance Advantages of NVDIMM and NVMe: Case Study with OpenZFS&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Todd - &lt;a href="http://dpaste.com/2QZEZPA"&gt;2 Nics, 1 bhyve and a jail cell&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Thomas - &lt;a href="http://dpaste.com/3SFM1YP#wrap"&gt;Deep Dive&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Morgan - &lt;a href="http://dpaste.com/07EK4RK#wrap"&gt;Send/Receive to Manage Fragmentation?&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Dominik - &lt;a href="http://dpaste.com/0SZJ0V4#wrap"&gt;hierarchical jails -&amp;gt; networking&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, ZFS rsync, Thinkpad, BIOS, LLVM, eurobsdcon, trip report, conference, bsd conference</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We report from our experiences at EuroBSDcon, disenchant software, LLVM 7.0.0 has been released, Thinkpad BIOS update options, HardenedBSD Foundation announced, and ZFS send vs. rsync.</p>

<p>##Headlines</p>

<p>###[FreeBSD DevSummit &amp; EuroBSDcon 2018 in Romania]</p>

<ul>
<li>Your hosts are back from EuroBSDcon 2018 held in Bucharest, Romania this year. The first two days of the conference are used for tutorials and devsummits (FreeBSD and NetBSD), while the last two are for talks.</li>
<li>Although Benedict organized the devsummit in large parts, he did not attend it this year. He held his Ansible tutorial in the morning of the first day, followed by Niclas Zeising’s new ports and poudriere tutorial (which had a record attendance). It was intended for beginners that had never used poudriere before and those who wanted to create their first port. The tutorial was well received and Niclas already has ideas for extending it for future conferences.</li>
<li>On the second day, Benedict took Kirk McKusick’s “An Introduction to the FreeBSD Open-Source Operating System” tutorial, held as a one full day class this year. Although it was reduced in content, it went into enough depth of many areas of the kernel and operating system to spark many questions from attendees. Clearly, this is a good start into kernel programming as Kirk provides enough material and backstories to understand why certain things are implemented as they are.</li>
<li>Olivier Robert took [<a href="https://www.talegraph.com/tales/l2o9ltrvsE">https://www.talegraph.com/tales/l2o9ltrvsE</a>](pictures from the devsummit) and created a nice gallery out of it.</li>
<li>Devsummit evenings saw dinners at two restaurants that allowed developers to spend some time talking over food and drinks.</li>
<li>The conference opened on the next day with the opening session held by Mihai Carabas. He introduced the first keynote speaker, a colleague of his who presented “Lightweight virtualization with LightVM and Unikraft”.</li>
<li>Benedict helped out at the FreeBSD Foundation sponsor table and talked to people. He saw the following talks in between:</li>
</ul>

<blockquote>
<p>Selfhosting as an alternative to the public cloud (by Albert Dengg)<br>
Using Boot Environments at Scale (by Allan Jude)<br>
Livepatching FreeBSD kernel (by Maciej Grochowski)<br>
FreeBSD: What to (Not) Monitor (by Andrew Fengler)<br>
FreeBSD Graphics (by Niclas Zeising)</p>
</blockquote>

<ul>
<li>Allan spent a lot of time talking to people and helping track down issues they were having, in addition to attending many talks:
<blockquote>
<p>Hacking together a FreeBSD presentation streaming box – For as little as possible (by Tom Jones)<br>
Introduction of FreeBSD in new environments (by Baptiste Daroussin)<br>
Keynote: Some computing and networking historical perspectives (by Ron Broersma)<br>
Livepatching FreeBSD kernel (by Maciej Grochowski)<br>
FreeBSD: What to (Not) Monitor (by Andrew Fengler)<br>
Being a BSD user (by Roller Angel)<br>
From “Hello World” to the VFS Layer: building a beadm for DragonFly BSD (by Michael Voight)</p>
</blockquote>
</li>
<li>We also met the winner of our Power Bagel raffle from <a href="http://www.bsdnow.tv/episodes/2018_07_25-2_8_because_computers">Episode 2^8</a>. He received the item in the meantime and had it with him at the conference, providing a power outlet to charge other people’s devices.</li>
<li>During the closing session, <a href="https://twitter.com/groffthebsdgoat">GroffTheBSDGoat</a> was handed over to Deb Goodkin, who will bring the little guy to the <a href="https://ghc.anitab.org/">Grace Hopper Celebration of Women in Computing conference</a> and then to <a href="http://meetbsd.com">MeetBSD</a> later this year. It was also revealed that next year’s EuroBSDcon will be held in Lillehammer, Norway.</li>
<li>Thanks to all the speakers, helpers, sponsors, organizers, and attendees for making it a successful conferences. There were no talks recorded this year, but the slides will be uploaded to the <a href="http://eurobsdcon.org">EuroBSDcon website</a> in a couple of weeks. The <a href="https://www.openbsd.org/events.html#eurobsdcon2018">OpenBSD talks</a> are already available, so check them out.</li>
</ul>

<p>###<a href="http://tonsky.me/blog/disenchantment/">Software disenchantment</a></p>

<blockquote>
<p>I’ve been programming for 15 years now. Recently our industry’s lack of care for efficiency, simplicity, and excellence started really getting to me, to the point of me getting depressed by my own career and the IT in general.<br>
Modern cars work, let’s say for the sake of argument, at 98% of what’s physically possible with the current engine design. Modern buildings use just enough material to fulfill their function and stay safe under the given conditions. All planes converged to the optimal size/form/load and basically look the same.<br>
Only in software, it’s fine if a program runs at 1% or even 0.01% of the possible performance. Everybody just seems to be ok with it. People are often even proud about how much inefficient it is, as in “why should we worry, computers are fast enough”:<br>
@tveastman: I have a Python program I run every day, it takes 1.5 seconds. I spent six hours re-writing it in rust, now it takes 0.06 seconds. That efficiency improvement means I’ll make my time back in 41 years, 24 days :-)<br>
You’ve probably heard this mantra: “programmer time is more expensive than computer time”. What it means basically is that we’re wasting computers at an unprecedented scale. Would you buy a car if it eats 100 liters per 100 kilometers? How about 1000 liters? With computers, we do that all the time.</p>
</blockquote>

<ul>
<li>Everything is unbearably slow</li>
</ul>

<blockquote>
<p>Look around: our portable computers are thousands of times more powerful than the ones that brought man to the moon. Yet every other webpage struggles to maintain a smooth 60fps scroll on the latest top-of-the-line MacBook Pro. I can comfortably play games, watch 4K videos but not scroll web pages? How is it ok?<br>
Google Inbox, a web app written by Google, running in Chrome browser also by Google, takes 13 seconds to open moderately-sized emails:<br>
It also animates empty white boxes instead of showing their content because it’s the only way anything can be animated on a webpage with decent performance. No, decent doesn’t mean 60fps, it’s rather “as fast as this web page could possibly go”. I’m dying to see web community answer when 120Hz displays become mainstream. Shit barely hits 60Hz already.<br>
Windows 10 takes 30 minutes to update. What could it possibly be doing for that long? That much time is enough to fully format my SSD drive, download a fresh build and install it like 5 times in a row.<br>
Pavel Fatin: Typing in editor is a relatively simple process, so even 286 PCs were able to provide a rather fluid typing experience.<br>
Modern text editors have higher latency than 42-year-old Emacs. Text editors! What can be simpler? On each keystroke, all you have to do is update tiny rectangular region and modern text editors can’t do that in 16ms. It’s a lot of time. A LOT. A 3D game can fill the whole screen with hundreds of thousands (!!!) of polygons in the same 16ms and also process input, recalculate the world and dynamically load/unload resources. How come?<br>
As a general trend, we’re not getting faster software with more features. We’re getting faster hardware that runs slower software with the same features. Everything works way below the possible speed. Ever wonder why your phone needs 30 to 60 seconds to boot? Why can’t it boot, say, in one second? There are no physical limitations to that. I would love to see that. I would love to see limits reached and explored, utilizing every last bit of performance we can get for something meaningful in a meaningful way.</p>
</blockquote>

<ul>
<li>Everything is HUUUUGE</li>
</ul>

<blockquote>
<p>And then there’s bloat. Web apps could open up to 10× faster if you just simply block all ads. Google begs everyone to stop shooting themselves in their feet with AMP initiative—a technology solution to a problem that doesn’t need any technology, just a little bit of common sense. If you remove bloat, the web becomes crazy fast. How smart do you have to be to understand that?<br>
Android system with no apps takes almost 6 Gb. Just think for a second how obscenely HUGE that number is. What’s in there, HD movies? I guess it’s basically code: kernel, drivers. Some string and resources too, sure, but those can’t be big. So, how many drivers do you need for a phone?<br>
Windows 95 was 30Mb. Today we have web pages heavier than that! Windows 10 is 4Gb, which is 133 times as big. But is it 133 times as superior? I mean, functionally they are basically the same. Yes, we have Cortana, but I doubt it takes 3970 Mb. But whatever Windows 10 is, is Android really 150% of that?<br>
Google keyboard app routinely eats 150 Mb. Is an app that draws 30 keys on a screen really five times more complex than the whole Windows 95? Google app, which is basically just a package for Google Web Search, is 350 Mb! Google Play Services, which I do not use (I don’t buy books, music or videos there)—300 Mb that just sit there and which I’m unable to delete.<br>
All that leaves me around 1 Gb for my photos after I install all the essential (social, chats, maps, taxi, banks etc) apps. And that’s with no games and no music at all! Remember times when an OS, apps and all your data fit on a floppy?<br>
Your desktop todo app is probably written in Electron and thus has userland driver for Xbox 360 controller in it, can render 3d graphics and play audio and take photos with your web camera.<br>
A simple text chat is notorious for its load speed and memory consumption. Yes, you really have to count Slack in as a resource-heavy application. I mean, chatroom and barebones text editor, those are supposed to be two of the less demanding apps in the whole world. Welcome to 2018.<br>
At least it works, you might say. Well, bigger doesn’t imply better. Bigger means someone has lost control. Bigger means we don’t know what’s going on. Bigger means complexity tax, performance tax, reliability tax. This is not the norm and should not become the norm. Overweight apps should mean a red flag. They should mean run away scared.</p>
</blockquote>

<ul>
<li>Better world manifesto</li>
</ul>

<blockquote>
<p>I want to see progress. I want change. I want state-of-the-art in software engineering to improve, not just stand still. I don’t want to reinvent the same stuff over and over, less performant and more bloated each time. I want something to believe in, a worthy end goal, a future better than what we have today, and I want a community of engineers who share that vision.<br>
What we have today is not progress. We barely meet business goals with poor tools applied over the top. We’re stuck in local optima and nobody wants to move out. It’s not even a good place, it’s bloated and inefficient. We just somehow got used to it.<br>
So I want to call it out: where we are today is bullshit. As engineers, we can, and should, and will do better. We can have better tools, we can build better apps, faster, more predictable, more reliable, using fewer resources (orders of magnitude fewer!). We need to understand deeply what are we doing and why. We need to deliver: reliably, predictably, with topmost quality. We can—and should–take pride in our work. Not just “given what we had…”—no buts!<br>
I hope I’m not alone at this. I hope there are people out there who want to do the same. I’d appreciate if we at least start talking about how absurdly bad our current situation in the software industry is. And then we maybe figure out how to get out.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://lists.llvm.org/pipermail/llvm-announce/2018-September/000080.html">[llvm-announce] LLVM 7.0.0 Release</a></p>

<pre><code>I am pleased to announce that LLVM 7 is now available.

Get it here: https://llvm.org/releases/download.html#7.0.0

The release contains the work on trunk up to SVN revision 338536 plus
work on the release branch. It is the result of the community's work
over the past six months, including: function multiversioning in Clang
with the 'target' attribute for ELF-based x86/x86_64 targets, improved
PCH support in clang-cl, preliminary DWARF v5 support, basic support
for OpenMP 4.5 offloading to NVPTX, OpenCL C++ support, MSan, X-Ray
and libFuzzer support for FreeBSD, early UBSan, X-Ray and libFuzzer
support for OpenBSD, UBSan checks for implicit conversions, many
long-tail compatibility issues fixed in lld which is now production
ready for ELF, COFF and MinGW, new tools llvm-exegesis, llvm-mca and
diagtool. And as usual, many optimizations, improved diagnostics, and
bug fixes.

For more details, see the release notes:
https://llvm.org/releases/7.0.0/docs/ReleaseNotes.html
https://llvm.org/releases/7.0.0/tools/clang/docs/ReleaseNotes.html
https://llvm.org/releases/7.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
https://llvm.org/releases/7.0.0/tools/lld/docs/ReleaseNotes.html

Thanks to everyone who helped with filing, fixing, and code reviewing
for the release-blocking bugs!

Special thanks to the release testers and packagers: Bero
Rosenkränzer, Brian Cain, Dimitry Andric, Jonas Hahnfeld, Lei Huang
Michał Górny, Sylvestre Ledru, Takumi Nakamura, and Vedant Kumar.

For questions or comments about the release, please contact the
community on the mailing lists. Onwards to LLVM 8!

Cheers,
Hans
</code></pre>

<p><hr></p>

<p>###<a href="https://blog.raveland.org/post/thinkpad_update_bios/">Update your Thinkpad’s bios with Linux or OpenBSD</a></p>

<ul>
<li>Get your new bios</li>
</ul>

<blockquote>
<p>At first, go to the Lenovo website and download your new bios:</p>
</blockquote>

<ul>
<li>Go to lenovo support</li>
<li>Use the search bar to find your product (example for me, x270)</li>
<li>Choose the right product (if necessary) and click search</li>
<li>On the right side, click on Update Your System</li>
<li>Click on BIOS/UEFI</li>
<li>Choose *BIOS Update (Bootable CD) for Windows *</li>
<li>Download</li>
</ul>

<blockquote>
<p>For me the file is called like this : r0iuj25wd.iso</p>
</blockquote>

<ul>
<li>Extract bios update</li>
</ul>

<blockquote>
<p>Now you will need to install geteltorito.</p>
</blockquote>

<ul>
<li>With OpenBSD:</li>
</ul>

<p><code>$ doas pkg_add geteltorito</code><br>
<code>quirks-3.7 signed on 2018-09-09T13:15:19Z</code><br>
<code>geteltorito-0.6: ok</code></p>

<ul>
<li>With Debian:</li>
</ul>

<p><code>$ sudo apt-get install genisoimage</code></p>

<ul>
<li>Now we will extract the bios update :</li>
</ul>

<p><code>$ geteltorito -o bios_update.img r0iuj25wd.iso</code><br>
<code>Booting catalog starts at sector: 20</code><br>
<code>Manufacturer of CD: NERO BURNING ROM VER 12</code><br>
<code>Image architecture: x86</code><br>
<code>Boot media type is: harddisk</code><br>
<code>El Torito image starts at sector 27 and has 43008 sector(s) of 512 Bytes</code><br>
<code></code><br>
<code>Image has been written to file &quot;bios_update.img&quot;.</code><br>
<code>This will create a file called bios_update.img.</code></p>

<ul>
<li>Put the image on an USB key</li>
<li>CAREFULL : on my computer, my USB key is sda1 on Linux and sd1 on OpenBSD.</li>
</ul>

<blockquote>
<p>Please check twice on your computer the name of your USB key.</p>
</blockquote>

<ul>
<li>With OpenBSD :</li>
</ul>

<p><code>$ doas dd if=bios_update.img of=/dev/rsd1c</code></p>

<ul>
<li>With Linux :</li>
</ul>

<p><code>$ sudo dd if=bios_update.img of=/dev/sda</code></p>

<blockquote>
<p>Now all you need is to reboot, to boot on your USB key and follow the instructions. Enjoy &#x1f609;</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://hardenedbsd.org/article/shawn-webb/2018-09-17/announcing-hardenedbsd-foundation">Announcing The HardenedBSD Foundation</a></p>

<blockquote>
<p>In June of 2018, we announced our intent to become a not-for-profit, tax-exempt 501©(3) organization in the United States. It took a dedicated team months of work behind-the-scenes to make that happen. On 06 September 2018, HardenedBSD Foundation Corp was granted 501©(3) status, from which point all US-based persons making donations can deduct the donation from their taxes.<br>
We are grateful for those who contribute to HardenedBSD in whatever way they can. Thank you for making HardenedBSD possible. We look forward to a bright future, driven by a helpful and positive community.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSSendRecvVsRsync">How you migrate ZFS filesystems matters</a></p>

<blockquote>
<p>If you want to move a ZFS filesystem around from one host to another, you have two general approaches; you can use ‘zfs send’ and ‘zfs receive’, or you can use a user level copying tool such as rsync (or ‘tar -cf | tar -xf’, or any number of similar options). Until recently, I had considered these two approaches to be more or less equivalent apart from their convenience and speed (which generally tilted in favour of ‘zfs send’). It turns out that this is not necessarily the case and there are situations where you will want one instead of the other.<br>
We have had two generations of ZFS fileservers so far, the Solaris ones and the OmniOS ones. When we moved from the first generation to the second generation, we migrated filesystems across using ‘zfs send’, including the filesystem with my home directory in it (we did this for various reasons). Recently I discovered that some old things in my filesystem didn’t have file type information in their directory entries. ZFS has been adding file type information to directories for a long time, but not quite as long as my home directory has been on ZFS.<br>
This illustrates an important difference between the ‘zfs send’ approach and the rsync approach, which is that zfs send doesn’t update or change at least some ZFS on-disk data structures, in the way that re-writing them from scratch from user level does. There are both positives and negatives to this, and a certain amount of rewriting does happen even in the ‘zfs send’ case (for example, all of the block pointers get changed, and ZFS will re-compress your data as applicable).<br>
I knew that in theory you had to copy things at the user level if you wanted to make sure that your ZFS filesystem and everything in it was fully up to date with the latest ZFS features. But I didn’t expect to hit a situation where it mattered in practice until, well, I did. Now I suspect that old files on our old filesystems may be partially missing a number of things, and I’m wondering how much of the various changes in ‘zfs upgrade -v’ apply even to old data.<br>
(I’d run into this sort of general thing before when I looked into ext3 to ext4 conversion on Linux.)<br>
With all that said, I doubt this will change our plans for migrating our ZFS filesystems in the future (to our third generation fileservers). ZFS sending and receiving is just too convenient, too fast and too reliable to give up. Rsync isn’t bad, but it’s not the same, and so we only use it when we have to (when we’re moving only some of the people in a filesystem instead of all of them, for example).<br>
PS: I was going to try to say something about what ‘zfs send’ did and didn’t update, but having looked briefly at the code I’ve concluded that I need to do more research before running my keyboard off. In the mean time, you can read the OpenZFS wiki page on ZFS send and receive, which has plenty of juicy technical details.<br>
PPS: Since eliminating all-zero blocks is a form of compression, you can turn zero-filled files into sparse files through a ZFS send/receive if the destination has compression enabled. As far as I know, genuine sparse files on the source will stay sparse through a ZFS send/receive even if they’re sent to a destination with compression off.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/254235663/">BSD Users Stockholm Meetup #4: Tuesday, November 13, 2018 at 18:00</a></li>
<li><a href="https://bsd-pl.org/en">BSD Poland User Group: Next Meeting: October 11, 2018, 18:15 - 21:15 at Warsaw University of Technology</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180915112028">n2k18 Hackathon report: Ken Westerback (krw@) on disklabel(8) work, dhclient(8) progress</a></li>
<li><a href="https://lists.xenproject.org/archives/html/mirageos-devel/2018-09/msg00013.html">Running MirageOS Unikernels on OpenBSD in vmm (Now Works)</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180910070407">vmm(4) gets support for qcow2</a></li>
<li><a href="https://oshogbo.vexillium.org/blog/52/">MeetBSD and SecurityBsides</a></li>
<li><a href="https://twitter.com/cperciva/status/1041433506453155840">Colin Percival reduced FreeBSD startup time from 10627ms (11.2) to 4738ms (12.0)</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2018-September/001842.html">FreeBSD 11.1 end-of-life</a></li>
<li><a href="https://www.meetup.com/KnoxBUG-BSD-Linux-and-FOSS-Users-Unite/events/254759084">KnoxBug: Monday, October 1, 2018 at 18:00: Real-world Performance Advantages of NVDIMM and NVMe: Case Study with OpenZFS</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Todd - <a href="http://dpaste.com/2QZEZPA">2 Nics, 1 bhyve and a jail cell</a></li>
<li>Thomas - <a href="http://dpaste.com/3SFM1YP#wrap">Deep Dive</a></li>
<li>Morgan - <a href="http://dpaste.com/07EK4RK#wrap">Send/Receive to Manage Fragmentation?</a></li>
<li>Dominik - <a href="http://dpaste.com/0SZJ0V4#wrap">hierarchical jails -&gt; networking</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We report from our experiences at EuroBSDcon, disenchant software, LLVM 7.0.0 has been released, Thinkpad BIOS update options, HardenedBSD Foundation announced, and ZFS send vs. rsync.</p>

<p>##Headlines</p>

<p>###[FreeBSD DevSummit &amp; EuroBSDcon 2018 in Romania]</p>

<ul>
<li>Your hosts are back from EuroBSDcon 2018 held in Bucharest, Romania this year. The first two days of the conference are used for tutorials and devsummits (FreeBSD and NetBSD), while the last two are for talks.</li>
<li>Although Benedict organized the devsummit in large parts, he did not attend it this year. He held his Ansible tutorial in the morning of the first day, followed by Niclas Zeising’s new ports and poudriere tutorial (which had a record attendance). It was intended for beginners that had never used poudriere before and those who wanted to create their first port. The tutorial was well received and Niclas already has ideas for extending it for future conferences.</li>
<li>On the second day, Benedict took Kirk McKusick’s “An Introduction to the FreeBSD Open-Source Operating System” tutorial, held as a one full day class this year. Although it was reduced in content, it went into enough depth of many areas of the kernel and operating system to spark many questions from attendees. Clearly, this is a good start into kernel programming as Kirk provides enough material and backstories to understand why certain things are implemented as they are.</li>
<li>Olivier Robert took [<a href="https://www.talegraph.com/tales/l2o9ltrvsE">https://www.talegraph.com/tales/l2o9ltrvsE</a>](pictures from the devsummit) and created a nice gallery out of it.</li>
<li>Devsummit evenings saw dinners at two restaurants that allowed developers to spend some time talking over food and drinks.</li>
<li>The conference opened on the next day with the opening session held by Mihai Carabas. He introduced the first keynote speaker, a colleague of his who presented “Lightweight virtualization with LightVM and Unikraft”.</li>
<li>Benedict helped out at the FreeBSD Foundation sponsor table and talked to people. He saw the following talks in between:</li>
</ul>

<blockquote>
<p>Selfhosting as an alternative to the public cloud (by Albert Dengg)<br>
Using Boot Environments at Scale (by Allan Jude)<br>
Livepatching FreeBSD kernel (by Maciej Grochowski)<br>
FreeBSD: What to (Not) Monitor (by Andrew Fengler)<br>
FreeBSD Graphics (by Niclas Zeising)</p>
</blockquote>

<ul>
<li>Allan spent a lot of time talking to people and helping track down issues they were having, in addition to attending many talks:
<blockquote>
<p>Hacking together a FreeBSD presentation streaming box – For as little as possible (by Tom Jones)<br>
Introduction of FreeBSD in new environments (by Baptiste Daroussin)<br>
Keynote: Some computing and networking historical perspectives (by Ron Broersma)<br>
Livepatching FreeBSD kernel (by Maciej Grochowski)<br>
FreeBSD: What to (Not) Monitor (by Andrew Fengler)<br>
Being a BSD user (by Roller Angel)<br>
From “Hello World” to the VFS Layer: building a beadm for DragonFly BSD (by Michael Voight)</p>
</blockquote>
</li>
<li>We also met the winner of our Power Bagel raffle from <a href="http://www.bsdnow.tv/episodes/2018_07_25-2_8_because_computers">Episode 2^8</a>. He received the item in the meantime and had it with him at the conference, providing a power outlet to charge other people’s devices.</li>
<li>During the closing session, <a href="https://twitter.com/groffthebsdgoat">GroffTheBSDGoat</a> was handed over to Deb Goodkin, who will bring the little guy to the <a href="https://ghc.anitab.org/">Grace Hopper Celebration of Women in Computing conference</a> and then to <a href="http://meetbsd.com">MeetBSD</a> later this year. It was also revealed that next year’s EuroBSDcon will be held in Lillehammer, Norway.</li>
<li>Thanks to all the speakers, helpers, sponsors, organizers, and attendees for making it a successful conferences. There were no talks recorded this year, but the slides will be uploaded to the <a href="http://eurobsdcon.org">EuroBSDcon website</a> in a couple of weeks. The <a href="https://www.openbsd.org/events.html#eurobsdcon2018">OpenBSD talks</a> are already available, so check them out.</li>
</ul>

<p>###<a href="http://tonsky.me/blog/disenchantment/">Software disenchantment</a></p>

<blockquote>
<p>I’ve been programming for 15 years now. Recently our industry’s lack of care for efficiency, simplicity, and excellence started really getting to me, to the point of me getting depressed by my own career and the IT in general.<br>
Modern cars work, let’s say for the sake of argument, at 98% of what’s physically possible with the current engine design. Modern buildings use just enough material to fulfill their function and stay safe under the given conditions. All planes converged to the optimal size/form/load and basically look the same.<br>
Only in software, it’s fine if a program runs at 1% or even 0.01% of the possible performance. Everybody just seems to be ok with it. People are often even proud about how much inefficient it is, as in “why should we worry, computers are fast enough”:<br>
@tveastman: I have a Python program I run every day, it takes 1.5 seconds. I spent six hours re-writing it in rust, now it takes 0.06 seconds. That efficiency improvement means I’ll make my time back in 41 years, 24 days :-)<br>
You’ve probably heard this mantra: “programmer time is more expensive than computer time”. What it means basically is that we’re wasting computers at an unprecedented scale. Would you buy a car if it eats 100 liters per 100 kilometers? How about 1000 liters? With computers, we do that all the time.</p>
</blockquote>

<ul>
<li>Everything is unbearably slow</li>
</ul>

<blockquote>
<p>Look around: our portable computers are thousands of times more powerful than the ones that brought man to the moon. Yet every other webpage struggles to maintain a smooth 60fps scroll on the latest top-of-the-line MacBook Pro. I can comfortably play games, watch 4K videos but not scroll web pages? How is it ok?<br>
Google Inbox, a web app written by Google, running in Chrome browser also by Google, takes 13 seconds to open moderately-sized emails:<br>
It also animates empty white boxes instead of showing their content because it’s the only way anything can be animated on a webpage with decent performance. No, decent doesn’t mean 60fps, it’s rather “as fast as this web page could possibly go”. I’m dying to see web community answer when 120Hz displays become mainstream. Shit barely hits 60Hz already.<br>
Windows 10 takes 30 minutes to update. What could it possibly be doing for that long? That much time is enough to fully format my SSD drive, download a fresh build and install it like 5 times in a row.<br>
Pavel Fatin: Typing in editor is a relatively simple process, so even 286 PCs were able to provide a rather fluid typing experience.<br>
Modern text editors have higher latency than 42-year-old Emacs. Text editors! What can be simpler? On each keystroke, all you have to do is update tiny rectangular region and modern text editors can’t do that in 16ms. It’s a lot of time. A LOT. A 3D game can fill the whole screen with hundreds of thousands (!!!) of polygons in the same 16ms and also process input, recalculate the world and dynamically load/unload resources. How come?<br>
As a general trend, we’re not getting faster software with more features. We’re getting faster hardware that runs slower software with the same features. Everything works way below the possible speed. Ever wonder why your phone needs 30 to 60 seconds to boot? Why can’t it boot, say, in one second? There are no physical limitations to that. I would love to see that. I would love to see limits reached and explored, utilizing every last bit of performance we can get for something meaningful in a meaningful way.</p>
</blockquote>

<ul>
<li>Everything is HUUUUGE</li>
</ul>

<blockquote>
<p>And then there’s bloat. Web apps could open up to 10× faster if you just simply block all ads. Google begs everyone to stop shooting themselves in their feet with AMP initiative—a technology solution to a problem that doesn’t need any technology, just a little bit of common sense. If you remove bloat, the web becomes crazy fast. How smart do you have to be to understand that?<br>
Android system with no apps takes almost 6 Gb. Just think for a second how obscenely HUGE that number is. What’s in there, HD movies? I guess it’s basically code: kernel, drivers. Some string and resources too, sure, but those can’t be big. So, how many drivers do you need for a phone?<br>
Windows 95 was 30Mb. Today we have web pages heavier than that! Windows 10 is 4Gb, which is 133 times as big. But is it 133 times as superior? I mean, functionally they are basically the same. Yes, we have Cortana, but I doubt it takes 3970 Mb. But whatever Windows 10 is, is Android really 150% of that?<br>
Google keyboard app routinely eats 150 Mb. Is an app that draws 30 keys on a screen really five times more complex than the whole Windows 95? Google app, which is basically just a package for Google Web Search, is 350 Mb! Google Play Services, which I do not use (I don’t buy books, music or videos there)—300 Mb that just sit there and which I’m unable to delete.<br>
All that leaves me around 1 Gb for my photos after I install all the essential (social, chats, maps, taxi, banks etc) apps. And that’s with no games and no music at all! Remember times when an OS, apps and all your data fit on a floppy?<br>
Your desktop todo app is probably written in Electron and thus has userland driver for Xbox 360 controller in it, can render 3d graphics and play audio and take photos with your web camera.<br>
A simple text chat is notorious for its load speed and memory consumption. Yes, you really have to count Slack in as a resource-heavy application. I mean, chatroom and barebones text editor, those are supposed to be two of the less demanding apps in the whole world. Welcome to 2018.<br>
At least it works, you might say. Well, bigger doesn’t imply better. Bigger means someone has lost control. Bigger means we don’t know what’s going on. Bigger means complexity tax, performance tax, reliability tax. This is not the norm and should not become the norm. Overweight apps should mean a red flag. They should mean run away scared.</p>
</blockquote>

<ul>
<li>Better world manifesto</li>
</ul>

<blockquote>
<p>I want to see progress. I want change. I want state-of-the-art in software engineering to improve, not just stand still. I don’t want to reinvent the same stuff over and over, less performant and more bloated each time. I want something to believe in, a worthy end goal, a future better than what we have today, and I want a community of engineers who share that vision.<br>
What we have today is not progress. We barely meet business goals with poor tools applied over the top. We’re stuck in local optima and nobody wants to move out. It’s not even a good place, it’s bloated and inefficient. We just somehow got used to it.<br>
So I want to call it out: where we are today is bullshit. As engineers, we can, and should, and will do better. We can have better tools, we can build better apps, faster, more predictable, more reliable, using fewer resources (orders of magnitude fewer!). We need to understand deeply what are we doing and why. We need to deliver: reliably, predictably, with topmost quality. We can—and should–take pride in our work. Not just “given what we had…”—no buts!<br>
I hope I’m not alone at this. I hope there are people out there who want to do the same. I’d appreciate if we at least start talking about how absurdly bad our current situation in the software industry is. And then we maybe figure out how to get out.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://lists.llvm.org/pipermail/llvm-announce/2018-September/000080.html">[llvm-announce] LLVM 7.0.0 Release</a></p>

<pre><code>I am pleased to announce that LLVM 7 is now available.

Get it here: https://llvm.org/releases/download.html#7.0.0

The release contains the work on trunk up to SVN revision 338536 plus
work on the release branch. It is the result of the community's work
over the past six months, including: function multiversioning in Clang
with the 'target' attribute for ELF-based x86/x86_64 targets, improved
PCH support in clang-cl, preliminary DWARF v5 support, basic support
for OpenMP 4.5 offloading to NVPTX, OpenCL C++ support, MSan, X-Ray
and libFuzzer support for FreeBSD, early UBSan, X-Ray and libFuzzer
support for OpenBSD, UBSan checks for implicit conversions, many
long-tail compatibility issues fixed in lld which is now production
ready for ELF, COFF and MinGW, new tools llvm-exegesis, llvm-mca and
diagtool. And as usual, many optimizations, improved diagnostics, and
bug fixes.

For more details, see the release notes:
https://llvm.org/releases/7.0.0/docs/ReleaseNotes.html
https://llvm.org/releases/7.0.0/tools/clang/docs/ReleaseNotes.html
https://llvm.org/releases/7.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
https://llvm.org/releases/7.0.0/tools/lld/docs/ReleaseNotes.html

Thanks to everyone who helped with filing, fixing, and code reviewing
for the release-blocking bugs!

Special thanks to the release testers and packagers: Bero
Rosenkränzer, Brian Cain, Dimitry Andric, Jonas Hahnfeld, Lei Huang
Michał Górny, Sylvestre Ledru, Takumi Nakamura, and Vedant Kumar.

For questions or comments about the release, please contact the
community on the mailing lists. Onwards to LLVM 8!

Cheers,
Hans
</code></pre>

<p><hr></p>

<p>###<a href="https://blog.raveland.org/post/thinkpad_update_bios/">Update your Thinkpad’s bios with Linux or OpenBSD</a></p>

<ul>
<li>Get your new bios</li>
</ul>

<blockquote>
<p>At first, go to the Lenovo website and download your new bios:</p>
</blockquote>

<ul>
<li>Go to lenovo support</li>
<li>Use the search bar to find your product (example for me, x270)</li>
<li>Choose the right product (if necessary) and click search</li>
<li>On the right side, click on Update Your System</li>
<li>Click on BIOS/UEFI</li>
<li>Choose *BIOS Update (Bootable CD) for Windows *</li>
<li>Download</li>
</ul>

<blockquote>
<p>For me the file is called like this : r0iuj25wd.iso</p>
</blockquote>

<ul>
<li>Extract bios update</li>
</ul>

<blockquote>
<p>Now you will need to install geteltorito.</p>
</blockquote>

<ul>
<li>With OpenBSD:</li>
</ul>

<p><code>$ doas pkg_add geteltorito</code><br>
<code>quirks-3.7 signed on 2018-09-09T13:15:19Z</code><br>
<code>geteltorito-0.6: ok</code></p>

<ul>
<li>With Debian:</li>
</ul>

<p><code>$ sudo apt-get install genisoimage</code></p>

<ul>
<li>Now we will extract the bios update :</li>
</ul>

<p><code>$ geteltorito -o bios_update.img r0iuj25wd.iso</code><br>
<code>Booting catalog starts at sector: 20</code><br>
<code>Manufacturer of CD: NERO BURNING ROM VER 12</code><br>
<code>Image architecture: x86</code><br>
<code>Boot media type is: harddisk</code><br>
<code>El Torito image starts at sector 27 and has 43008 sector(s) of 512 Bytes</code><br>
<code></code><br>
<code>Image has been written to file &quot;bios_update.img&quot;.</code><br>
<code>This will create a file called bios_update.img.</code></p>

<ul>
<li>Put the image on an USB key</li>
<li>CAREFULL : on my computer, my USB key is sda1 on Linux and sd1 on OpenBSD.</li>
</ul>

<blockquote>
<p>Please check twice on your computer the name of your USB key.</p>
</blockquote>

<ul>
<li>With OpenBSD :</li>
</ul>

<p><code>$ doas dd if=bios_update.img of=/dev/rsd1c</code></p>

<ul>
<li>With Linux :</li>
</ul>

<p><code>$ sudo dd if=bios_update.img of=/dev/sda</code></p>

<blockquote>
<p>Now all you need is to reboot, to boot on your USB key and follow the instructions. Enjoy &#x1f609;</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://hardenedbsd.org/article/shawn-webb/2018-09-17/announcing-hardenedbsd-foundation">Announcing The HardenedBSD Foundation</a></p>

<blockquote>
<p>In June of 2018, we announced our intent to become a not-for-profit, tax-exempt 501©(3) organization in the United States. It took a dedicated team months of work behind-the-scenes to make that happen. On 06 September 2018, HardenedBSD Foundation Corp was granted 501©(3) status, from which point all US-based persons making donations can deduct the donation from their taxes.<br>
We are grateful for those who contribute to HardenedBSD in whatever way they can. Thank you for making HardenedBSD possible. We look forward to a bright future, driven by a helpful and positive community.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSSendRecvVsRsync">How you migrate ZFS filesystems matters</a></p>

<blockquote>
<p>If you want to move a ZFS filesystem around from one host to another, you have two general approaches; you can use ‘zfs send’ and ‘zfs receive’, or you can use a user level copying tool such as rsync (or ‘tar -cf | tar -xf’, or any number of similar options). Until recently, I had considered these two approaches to be more or less equivalent apart from their convenience and speed (which generally tilted in favour of ‘zfs send’). It turns out that this is not necessarily the case and there are situations where you will want one instead of the other.<br>
We have had two generations of ZFS fileservers so far, the Solaris ones and the OmniOS ones. When we moved from the first generation to the second generation, we migrated filesystems across using ‘zfs send’, including the filesystem with my home directory in it (we did this for various reasons). Recently I discovered that some old things in my filesystem didn’t have file type information in their directory entries. ZFS has been adding file type information to directories for a long time, but not quite as long as my home directory has been on ZFS.<br>
This illustrates an important difference between the ‘zfs send’ approach and the rsync approach, which is that zfs send doesn’t update or change at least some ZFS on-disk data structures, in the way that re-writing them from scratch from user level does. There are both positives and negatives to this, and a certain amount of rewriting does happen even in the ‘zfs send’ case (for example, all of the block pointers get changed, and ZFS will re-compress your data as applicable).<br>
I knew that in theory you had to copy things at the user level if you wanted to make sure that your ZFS filesystem and everything in it was fully up to date with the latest ZFS features. But I didn’t expect to hit a situation where it mattered in practice until, well, I did. Now I suspect that old files on our old filesystems may be partially missing a number of things, and I’m wondering how much of the various changes in ‘zfs upgrade -v’ apply even to old data.<br>
(I’d run into this sort of general thing before when I looked into ext3 to ext4 conversion on Linux.)<br>
With all that said, I doubt this will change our plans for migrating our ZFS filesystems in the future (to our third generation fileservers). ZFS sending and receiving is just too convenient, too fast and too reliable to give up. Rsync isn’t bad, but it’s not the same, and so we only use it when we have to (when we’re moving only some of the people in a filesystem instead of all of them, for example).<br>
PS: I was going to try to say something about what ‘zfs send’ did and didn’t update, but having looked briefly at the code I’ve concluded that I need to do more research before running my keyboard off. In the mean time, you can read the OpenZFS wiki page on ZFS send and receive, which has plenty of juicy technical details.<br>
PPS: Since eliminating all-zero blocks is a form of compression, you can turn zero-filled files into sparse files through a ZFS send/receive if the destination has compression enabled. As far as I know, genuine sparse files on the source will stay sparse through a ZFS send/receive even if they’re sent to a destination with compression off.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/254235663/">BSD Users Stockholm Meetup #4: Tuesday, November 13, 2018 at 18:00</a></li>
<li><a href="https://bsd-pl.org/en">BSD Poland User Group: Next Meeting: October 11, 2018, 18:15 - 21:15 at Warsaw University of Technology</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180915112028">n2k18 Hackathon report: Ken Westerback (krw@) on disklabel(8) work, dhclient(8) progress</a></li>
<li><a href="https://lists.xenproject.org/archives/html/mirageos-devel/2018-09/msg00013.html">Running MirageOS Unikernels on OpenBSD in vmm (Now Works)</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180910070407">vmm(4) gets support for qcow2</a></li>
<li><a href="https://oshogbo.vexillium.org/blog/52/">MeetBSD and SecurityBsides</a></li>
<li><a href="https://twitter.com/cperciva/status/1041433506453155840">Colin Percival reduced FreeBSD startup time from 10627ms (11.2) to 4738ms (12.0)</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2018-September/001842.html">FreeBSD 11.1 end-of-life</a></li>
<li><a href="https://www.meetup.com/KnoxBUG-BSD-Linux-and-FOSS-Users-Unite/events/254759084">KnoxBug: Monday, October 1, 2018 at 18:00: Real-world Performance Advantages of NVDIMM and NVMe: Case Study with OpenZFS</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Todd - <a href="http://dpaste.com/2QZEZPA">2 Nics, 1 bhyve and a jail cell</a></li>
<li>Thomas - <a href="http://dpaste.com/3SFM1YP#wrap">Deep Dive</a></li>
<li>Morgan - <a href="http://dpaste.com/07EK4RK#wrap">Send/Receive to Manage Fragmentation?</a></li>
<li>Dominik - <a href="http://dpaste.com/0SZJ0V4#wrap">hierarchical jails -&gt; networking</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 264: Optimized-out | BSD Now 264</title>
  <link>https://www.bsdnow.tv/264</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2594</guid>
  <pubDate>Thu, 20 Sep 2018 01:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/870be997-e69a-4290-b287-0465a463522d.mp3" length="43367569" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD and DragonflyBSD benchmarks on AMD’s Threadripper, NetBSD 7.2 has been released, optimized out DTrace kernel symbols, stuck UEFI bootloaders, why ed is not a good editor today, tell your BSD story, and more.</itunes:subtitle>
  <itunes:duration>1:11:58</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD and DragonflyBSD benchmarks on AMD’s Threadripper, NetBSD 7.2 has been released, optimized out DTrace kernel symbols, stuck UEFI bootloaders, why ed is not a good editor today, tell your BSD story, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.phoronix.com/scan.php?page=article&amp;amp;item=bsd-threadripper-2990wx&amp;amp;num=1"&gt;FreeBSD &amp;amp; DragonFlyBSD Put Up A Strong Fight On AMD’s Threadripper 2990WX, Benchmarks Against Linux&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The past two weeks I have been delivering a great deal of AMD Threadripper 2990WX benchmarks on Linux as well as some against Windows and Windows Server. But recently I got around to trying out some of the BSD operating systems on this 32-core / 64-thread processor to see how they would run and to see whether they would have similar scaling issues or not like we’ve seen on the Windows side against Linux. In this article are FreeBSD and DragonFlyBSD benchmarks with the X399 + 2990WX compared to a few Linux distributions.&lt;br&gt;
The BSDs I focused my testing on were FreeBSD 11.2-STABLE and 12.0-CURRENT/ALPHA1 (the version in development) as well as iX System’s TrueOS that is tracking FreeBSD 12.0-CURRENT. Also included were DragonFlyBSD, with FreeBSD and DragonFlyBSD being tied as my favorite operating systems when it comes to the BSDs. When it came to FreeBSD 11.2-STABLE and 12.0-ALPHA1 on the Threadripper 2990WX, it worked out surprisingly well. I encountered no real issues during my two days of benchmarking on FreeBSD (and TrueOS). It was a great experience and FreeBSD was happy to exploit the 64 threads on the system.&lt;br&gt;
DragonFlyBSD was a bit of a different story… Last week when I started this BSD testing I tried DragonFly 5.2.2 as the latest stable release as well as a DragonFlyBSD 5.3 development snapshot from last week: both failed to boot in either BIOS or UEFI modes.&lt;br&gt;
But then a few days ago DragonFlyBSD lead developer Matthew Dillon bought himself a 2990WX platform. He made the necessary changes to get DragonFlyBSD 5.3 working and he ended up finding really great performance and potential out of the platform. So I tried the latest DragonFlyBSD 5.3 daily ISO on 22 August and indeed it now booted successfully and we were off to the races. Thus there are some DragonFlyBSD 5.3 benchmarks included in this article too.&lt;br&gt;
Just hours ago, Matthew Dillon landed some 2990WX topology and scheduler enhancements but that fell out of the scope of when DragonFly was installed on this system. But over the weekend or so I plan to re-test DragonFlyBSD 5.3 and see how those optimizations affect the overall 2990WX performance now on that BSD. DragonFlyBSD 5.4 stable should certainly be an interesting release on several fronts!&lt;br&gt;
With FreeBSD 11.2-STABLE and 12.0-ALPHA1 I ran benchmarks when using their stock compiler (LLVM Clang 6.0) as well as GCC 7.3 obtained via GCC 7.3. That was done to rule out compiler differences in benchmarking against the GCC-based Linux distributions. On DragonFlyBSD 5.3 it defaults to the GCC 5.4.1 but via pkg I also did a secondary run when upgraded to GCC 7.3.&lt;br&gt;
The hardware and BIOS/UEFI settings were maintained the same throughout the entire benchmarking process. The system was made up of the AMD Ryzen Threadripper 2990WX at stock speeds, the ASUS ROG ZENITH EXTREME motherboard, 4 x 8GB DDR4-3200MHz memory, Samsung 970 EVO 500GB NVMe SSD, and Radeon RX Vega 56 graphics card.&lt;br&gt;
All of these Linux vs. BSD benchmarks were carried out in a fully-automated and reproducible manner using the open-source Phoronix Test Suite benchmarking framework.&lt;br&gt;
While for the last of today’s BSD vs. Linux benchmarking on the Threadripper 2990WX, the Linux distributions came out slightly ahead of FreeBSD and DragonFlyBSD with GCC (another test having issues with Clang 6.0 on the BSDs).&lt;br&gt;
Overall, I was quite taken away by the BSD performance on the Threadripper 2990WX – particularly FreeBSD. In a surprising number of benchmarks, the BSDs were outperforming the tested Linux distributions though often by incredibly thin margins. Still, quite an accomplishment for these BSD operating systems and considering how much better Linux is already doing than Windows 10 / Windows Server on this 32-core / 64-thread processor. Then again, the BSDs like Linux have a long history of running on high core/thread-count systems, super computers, and other HPC environments.&lt;br&gt;
It will be interesting to see how much faster DragonFlyBSD can run given today’s commit to its kernel with scheduler and topology improvements for the 2990WX. Those additional DragonFlyBSD benchmarks will be published in the coming days once they are completed.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.netbsd.org/releases/formal-7/NetBSD-7.2.html"&gt;NetBSD 7.2 released&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The NetBSD Project is pleased to announce NetBSD 7.2, the second feature update of the NetBSD 7 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;General Security Note&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;The NetBSD 7.2 release is a maintenance release of the netbsd-7 branch, which had it's first major release, NetBSD 7.0 in September 2015. A lot of security features have been added to later NetBSD versions, and for new installations we highly recommend using our latest release, NetBSD 8.0 instead.&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Some highlights of the 7.2 release are:&lt;/li&gt;
&lt;li&gt;Support for USB 3.0.&lt;/li&gt;
&lt;li&gt;Enhancements to the Linux emulation subsystem.&lt;/li&gt;
&lt;li&gt;Fixes in binary compatibility for ancient NetBSD executables.&lt;/li&gt;
&lt;li&gt;iwm(4) driver for Intel Wireless 726x, 316x, 826x and 416x series added.&lt;/li&gt;
&lt;li&gt;Support for Raspberry Pi 3 added.&lt;/li&gt;
&lt;li&gt;Fix interrupt setup on Hyper-V VMs with Legacy Network Adapter.&lt;/li&gt;
&lt;li&gt;SVR4 and IBCS2 compatibility subsystems have been disabled by default (besides IBCS2 on VAX). These subsystems also do not auto-load their modules any more.&lt;/li&gt;
&lt;li&gt;Various USB stability enhancements.&lt;/li&gt;
&lt;li&gt;Numerous bug fixes and stability improvements.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Complete source and binaries for NetBSD 7.2 are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, SUP, and other services may be found at &lt;a href="https://www.NetBSD.org/mirrors/"&gt;https://www.NetBSD.org/mirrors/&lt;/a&gt;. We encourage users who wish to install via ISO or USB disk images to download via BitTorrent by using the torrent files supplied in the images area. A list of hashes for the NetBSD 7.2 distribution has been signed with the well-connected PGP key for the NetBSD Security Officer: &lt;a href="https://cdn.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.2_hashes.asc"&gt;https://cdn.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.2_hashes.asc&lt;/a&gt;&lt;br&gt;
NetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone. Free support services are available via our mailing lists and website. Commercial support is available from a variety of sources. More extensive information on NetBSD is available from our website:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://farhan.codes/2018/08/16/including-optimized-out-kernel-symbols-in-dtrace-on-freebsd/"&gt;Including optimized-out kernel symbols in dtrace on FreeBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Have you ever had dtrace(1) on FreeBSD fail to list a probe that should exist in the kernel? This is because Clang will optimize-out some functions. The result is ctfconvert(1) will not generate debugging symbols that dtrace(1) uses to identify probes. I have a quick solution to getting those probes visible to dtrace(1).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;In my case, I was trying to instrument on ieee80211_ioctl_get80211, whose sister function ieee80211_ioctl_set80211 has a dtrace(1) probe in the generic FreeBSD 11 and 12 kernels. Both functions are located in /usr/src/sys/net80211/ieee80211_ioctl.c.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;My first attempt was to add to /etc/make.conf as follows and recompile the kernel.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;CFLAGS+=-O0 and -fno-inline-functions&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;This failed to produce the dtrace(1) probe. Several other attempts failed and I was getting inconsistent compilation results (Is it me or is ieee80211_ioctl.c compiled with different flags if NO_CLEAN=1 is set?). When I manually compiled the object file by copying the compilation line for the object file and adding -O0 -fno-inline-functions, nm(1) on both the object file and kernel demonstrated that the symbol was present. I installed the kernel, rebooted and it was listed as a dtrace probe. Great!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;But as I continued to debug my WiFi driver (oh yeah, I’m very slowly extending rtwn(4)), I found myself rebuilding the kernel several times and frequently rebooting. Why not do this across the entire kernel?&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;After hacking around, my solution was to modify the build scripts. My solution was to edit /usr/src/sys/conf/kern.pre.mk and modify all optimization level 2 to optimization level 0. The following is my diff(1) on FreeBSD 12.0-CURRENT.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;A few thoughts:&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;This seems like a hack rather than a long-term solution. Either the problem is with the hard-coded optimization flags, or the inability to overwrite them in all places in make.conf.&lt;br&gt;
Removing optimizations is only something I would do in a non-production kernel, so its as if I have to choose between optimizations for a production kernel or having dtrace probes. But dtrace explicitly markets itself as not impactful on production.&lt;br&gt;
Using the dtrace pony as your featured image on WordPress does not render properly and must be rotated and modified. Blame Bryan Cantrill.&lt;br&gt;
If you have a better solution, please let me know and I will update the article, but this works for me!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.neelc.org/freebsd-uefi-on-asus-motherboards/"&gt;FreeBSD: UEFI Bootloader stuck on BootCurrent/BootOrder/BootInfo on Asus Motherboards (and fix!)&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Starting with FreeBSD CURRENT from about a few weeks of posting date, but including FreeBSD 12 alpha releases (not related to DEC Alpha), I noticed one thing: When I boot FreeBSD from UEFI on a homebuilt desktop with a Asus H87M-E motherboard, and have Root on ZFS, the bootloader gets stuck on lines like BootCurrent, BootOrder, and  BootInfo. This issue occurs when I try to boot directly to  efi\boot\bootx64.efi.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;One person had a similar issue on a Asus H87I-PLUS motherboard. This issue may or may not exist on other Asus motherboards, desktops, or laptops. This may be specific to Asus motherboards for Intel’s Haswell, but may also exist on newer systems (e.g. Skylake) or older (e.g. Ivy Bridge) with Asus motherboards, as well as Asus desktops or laptops.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;There are two solutions to this problem:&lt;/li&gt;
&lt;li&gt;Use Legacy BIOS mode instead of UEFI mode&lt;/li&gt;
&lt;li&gt;Install a FreeBSD UEFI Boot entry&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Keep in mind that I am not going to talk about this issue and third-party UEFI boot managers such as rEFInd here.&lt;br&gt;
The first option is rather straightforward: you need to make sure your computer has “Secure Boot” disabled and “Legacy Boot” or “CSM” enabled. Then, you need to make sure FreeBSD is installed in BIOS mode. However, this solution is (in my opinion) suboptimal. Why? Because:&lt;br&gt;
You won’t be able to use hard drives bigger than 2TB&lt;br&gt;
You are limited to MBR Partitioning on Asus motherboards with UEFI as Asus motherboards refuse to boot GPT partitioned disks in BIOS mode&lt;br&gt;
Legacy BIOS mode may not exist on future computers or motherboards (although those systems may not have this issue, and this issue may get fixed by then)&lt;br&gt;
The second option, however, is less straightforward, but will let you keep UEFI. Many UEFI systems, including affected Asus motherboards described here, include a boot manager built into the UEFI. FreeBSD includes a tool called efibootmgr to manage this, similar to the similarly-named tool in Linux, but with a different syntax.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/unix/EdNoLongerGoodEditor"&gt;Why ed(1) is not a good editor today&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I’ll start with my tweet:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;Heretical Unix opinion time: ed(1) may be the 'standard Unix editor', but it is not a particularly good editor outside of a limited environment that almost never applies today.&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;There is a certain portion of Unixdom that really likes ed(1), the ‘standard Unix editor’. Having actually used ed for a not insignificant amount of time (although it was the friendlier ‘UofT ed’ variant), I have some reactions to what I feel is sometimes overzealous praise of it. One of these is what I tweeted.&lt;br&gt;
The fundamental limitation of ed is that it is what I call an indirect manipulation interface, in contrast to the explicit manipulation interfaces of screen editors like vi and graphical editors like sam (which are generally lumped together as ‘visual’ editors, so called because they actually show you the text you’re editing). When you edit text in ed, you have some problems that you don’t have in visual editors; you have to maintain in your head the context of what the text looks like (and where you are in it), you have to figure out how to address portions of that text in order to modify them, and finally you have to think about how your edit commands will change the context. Copious use of ed’s p command can help with the first problem, but nothing really deals with the other two. In order to use ed, you basically have to simulate parts of ed in your head.&lt;br&gt;
Ed is a great editor in situations where the editor explicitly presenting this context is a very expensive or outright impossible operation. Ed works great on real teletypes, for example, or over extremely slow links where you want to send and receive as little data as possible (and on real teletypes you have some amount of context in the form of an actual printout that you can look back at). Back in the old days of Unix, this described a fairly large number of situations; you had actual teletypes, you had slow dialup links (and later slow, high latency network links), and you had slow and heavily overloaded systems.&lt;br&gt;
However, that’s no longer the situation today (at least almost all of the time). Modern systems and links can easily support visual editors that continually show you the context of the text and generally let you more or less directly manipulate it (whether that is through cursoring around it or using a mouse). Such editors are easier and faster to use, and they leave you with more brainpower free to think about things like the program you’re writing (which is the important thing).&lt;br&gt;
If you can use a visual editor, ed is not a particularly good editor to use instead; you will probably spend a lot of effort (and some amount of time) on doing by hand something that the visual editor will do for you. If you are very practiced at ed, maybe this partly goes away, but I maintain that you are still working harder than you need to be.&lt;br&gt;
The people who say that ed is a quite powerful editor are correct; ed is quite capable (although sadly limited by only editing a single file). It’s just that it’s also a pain to use.&lt;br&gt;
(They’re also correct that ed is the foundation of many other things in Unix, including sed and vi. But that doesn’t mean that the best way to learn or understand those things is to learn and use ed.)&lt;br&gt;
This doesn’t make ed a useless, vestigial thing on modern Unix, though. There are uses for ed in non-interactive editing, for example. But on modern Unix, ed is a specialized tool, much like dc. It’s worth knowing that ed is there and roughly what it can do, but it’s probably not worth learning how to use it before you need it. And you’re unlikely to ever be in a situation where it’s the best choice for interactive editing (and if you are, something has generally gone wrong).&lt;br&gt;
(But if you enjoy exploring the obscure corners of Unix, sure, go for it. Learn dc too, because it’s interesting in its own way and, like ed, it’s one of those classical old Unix programs.)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://twitter.com/DavieDavieDave/status/1040359656864903169"&gt;Is there any interest in a #BSD user group in #Montreal?&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.bsdjobs.com/people/hi.html"&gt;Tell your BSD story&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/finishing_leftover_tasks_from_google"&gt;Finishing leftover tasks from Google Summer of Code&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180906072459"&gt;Fuzzing the OpenBSD Kernel&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://lists.nycbug.org/pipermail/talk/2018-August/017692.html"&gt;ARM - any Tier-1 *BSD options?&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Chris - &lt;a href="http://dpaste.com/2Y6XBYN"&gt;byhve question&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Paulo - &lt;a href="http://dpaste.com/1A88F2W"&gt;Topic suggestion&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Bostjan - &lt;a href="http://dpaste.com/140ZHZD#wrap"&gt;How data gets to disk&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD and DragonflyBSD benchmarks on AMD’s Threadripper, NetBSD 7.2 has been released, optimized out DTrace kernel symbols, stuck UEFI bootloaders, why ed is not a good editor today, tell your BSD story, and more.</p>

<p>##Headlines<br>
###<a href="https://www.phoronix.com/scan.php?page=article&amp;item=bsd-threadripper-2990wx&amp;num=1">FreeBSD &amp; DragonFlyBSD Put Up A Strong Fight On AMD’s Threadripper 2990WX, Benchmarks Against Linux</a></p>

<blockquote>
<p>The past two weeks I have been delivering a great deal of AMD Threadripper 2990WX benchmarks on Linux as well as some against Windows and Windows Server. But recently I got around to trying out some of the BSD operating systems on this 32-core / 64-thread processor to see how they would run and to see whether they would have similar scaling issues or not like we’ve seen on the Windows side against Linux. In this article are FreeBSD and DragonFlyBSD benchmarks with the X399 + 2990WX compared to a few Linux distributions.<br>
The BSDs I focused my testing on were FreeBSD 11.2-STABLE and 12.0-CURRENT/ALPHA1 (the version in development) as well as iX System’s TrueOS that is tracking FreeBSD 12.0-CURRENT. Also included were DragonFlyBSD, with FreeBSD and DragonFlyBSD being tied as my favorite operating systems when it comes to the BSDs. When it came to FreeBSD 11.2-STABLE and 12.0-ALPHA1 on the Threadripper 2990WX, it worked out surprisingly well. I encountered no real issues during my two days of benchmarking on FreeBSD (and TrueOS). It was a great experience and FreeBSD was happy to exploit the 64 threads on the system.<br>
DragonFlyBSD was a bit of a different story… Last week when I started this BSD testing I tried DragonFly 5.2.2 as the latest stable release as well as a DragonFlyBSD 5.3 development snapshot from last week: both failed to boot in either BIOS or UEFI modes.<br>
But then a few days ago DragonFlyBSD lead developer Matthew Dillon bought himself a 2990WX platform. He made the necessary changes to get DragonFlyBSD 5.3 working and he ended up finding really great performance and potential out of the platform. So I tried the latest DragonFlyBSD 5.3 daily ISO on 22 August and indeed it now booted successfully and we were off to the races. Thus there are some DragonFlyBSD 5.3 benchmarks included in this article too.<br>
Just hours ago, Matthew Dillon landed some 2990WX topology and scheduler enhancements but that fell out of the scope of when DragonFly was installed on this system. But over the weekend or so I plan to re-test DragonFlyBSD 5.3 and see how those optimizations affect the overall 2990WX performance now on that BSD. DragonFlyBSD 5.4 stable should certainly be an interesting release on several fronts!<br>
With FreeBSD 11.2-STABLE and 12.0-ALPHA1 I ran benchmarks when using their stock compiler (LLVM Clang 6.0) as well as GCC 7.3 obtained via GCC 7.3. That was done to rule out compiler differences in benchmarking against the GCC-based Linux distributions. On DragonFlyBSD 5.3 it defaults to the GCC 5.4.1 but via pkg I also did a secondary run when upgraded to GCC 7.3.<br>
The hardware and BIOS/UEFI settings were maintained the same throughout the entire benchmarking process. The system was made up of the AMD Ryzen Threadripper 2990WX at stock speeds, the ASUS ROG ZENITH EXTREME motherboard, 4 x 8GB DDR4-3200MHz memory, Samsung 970 EVO 500GB NVMe SSD, and Radeon RX Vega 56 graphics card.<br>
All of these Linux vs. BSD benchmarks were carried out in a fully-automated and reproducible manner using the open-source Phoronix Test Suite benchmarking framework.<br>
While for the last of today’s BSD vs. Linux benchmarking on the Threadripper 2990WX, the Linux distributions came out slightly ahead of FreeBSD and DragonFlyBSD with GCC (another test having issues with Clang 6.0 on the BSDs).<br>
Overall, I was quite taken away by the BSD performance on the Threadripper 2990WX – particularly FreeBSD. In a surprising number of benchmarks, the BSDs were outperforming the tested Linux distributions though often by incredibly thin margins. Still, quite an accomplishment for these BSD operating systems and considering how much better Linux is already doing than Windows 10 / Windows Server on this 32-core / 64-thread processor. Then again, the BSDs like Linux have a long history of running on high core/thread-count systems, super computers, and other HPC environments.<br>
It will be interesting to see how much faster DragonFlyBSD can run given today’s commit to its kernel with scheduler and topology improvements for the 2990WX. Those additional DragonFlyBSD benchmarks will be published in the coming days once they are completed.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.netbsd.org/releases/formal-7/NetBSD-7.2.html">NetBSD 7.2 released</a></p>

<blockquote>
<p>The NetBSD Project is pleased to announce NetBSD 7.2, the second feature update of the NetBSD 7 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</p>
</blockquote>

<ul>
<li>General Security Note</li>
</ul>

<p><code>The NetBSD 7.2 release is a maintenance release of the netbsd-7 branch, which had it's first major release, NetBSD 7.0 in September 2015. A lot of security features have been added to later NetBSD versions, and for new installations we highly recommend using our latest release, NetBSD 8.0 instead.</code></p>

<ul>
<li>Some highlights of the 7.2 release are:</li>
<li>Support for USB 3.0.</li>
<li>Enhancements to the Linux emulation subsystem.</li>
<li>Fixes in binary compatibility for ancient NetBSD executables.</li>
<li>iwm(4) driver for Intel Wireless 726x, 316x, 826x and 416x series added.</li>
<li>Support for Raspberry Pi 3 added.</li>
<li>Fix interrupt setup on Hyper-V VMs with Legacy Network Adapter.</li>
<li>SVR4 and IBCS2 compatibility subsystems have been disabled by default (besides IBCS2 on VAX). These subsystems also do not auto-load their modules any more.</li>
<li>Various USB stability enhancements.</li>
<li>Numerous bug fixes and stability improvements.</li>
</ul>

<blockquote>
<p>Complete source and binaries for NetBSD 7.2 are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, SUP, and other services may be found at <a href="https://www.NetBSD.org/mirrors/">https://www.NetBSD.org/mirrors/</a>. We encourage users who wish to install via ISO or USB disk images to download via BitTorrent by using the torrent files supplied in the images area. A list of hashes for the NetBSD 7.2 distribution has been signed with the well-connected PGP key for the NetBSD Security Officer: <a href="https://cdn.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.2_hashes.asc">https://cdn.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.2_hashes.asc</a><br>
NetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone. Free support services are available via our mailing lists and website. Commercial support is available from a variety of sources. More extensive information on NetBSD is available from our website:</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://farhan.codes/2018/08/16/including-optimized-out-kernel-symbols-in-dtrace-on-freebsd/">Including optimized-out kernel symbols in dtrace on FreeBSD</a></p>

<blockquote>
<p>Have you ever had dtrace(1) on FreeBSD fail to list a probe that should exist in the kernel? This is because Clang will optimize-out some functions. The result is ctfconvert(1) will not generate debugging symbols that dtrace(1) uses to identify probes. I have a quick solution to getting those probes visible to dtrace(1).</p>
</blockquote>

<blockquote>
<p>In my case, I was trying to instrument on ieee80211_ioctl_get80211, whose sister function ieee80211_ioctl_set80211 has a dtrace(1) probe in the generic FreeBSD 11 and 12 kernels. Both functions are located in /usr/src/sys/net80211/ieee80211_ioctl.c.</p>
</blockquote>

<blockquote>
<p>My first attempt was to add to /etc/make.conf as follows and recompile the kernel.</p>
</blockquote>

<p><code>CFLAGS+=-O0 and -fno-inline-functions</code></p>

<blockquote>
<p>This failed to produce the dtrace(1) probe. Several other attempts failed and I was getting inconsistent compilation results (Is it me or is ieee80211_ioctl.c compiled with different flags if NO_CLEAN=1 is set?). When I manually compiled the object file by copying the compilation line for the object file and adding -O0 -fno-inline-functions, nm(1) on both the object file and kernel demonstrated that the symbol was present. I installed the kernel, rebooted and it was listed as a dtrace probe. Great!</p>
</blockquote>

<blockquote>
<p>But as I continued to debug my WiFi driver (oh yeah, I’m very slowly extending rtwn(4)), I found myself rebuilding the kernel several times and frequently rebooting. Why not do this across the entire kernel?</p>
</blockquote>

<blockquote>
<p>After hacking around, my solution was to modify the build scripts. My solution was to edit /usr/src/sys/conf/kern.pre.mk and modify all optimization level 2 to optimization level 0. The following is my diff(1) on FreeBSD 12.0-CURRENT.</p>
</blockquote>

<ul>
<li>A few thoughts:</li>
</ul>

<blockquote>
<p>This seems like a hack rather than a long-term solution. Either the problem is with the hard-coded optimization flags, or the inability to overwrite them in all places in make.conf.<br>
Removing optimizations is only something I would do in a non-production kernel, so its as if I have to choose between optimizations for a production kernel or having dtrace probes. But dtrace explicitly markets itself as not impactful on production.<br>
Using the dtrace pony as your featured image on WordPress does not render properly and must be rotated and modified. Blame Bryan Cantrill.<br>
If you have a better solution, please let me know and I will update the article, but this works for me!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.neelc.org/freebsd-uefi-on-asus-motherboards/">FreeBSD: UEFI Bootloader stuck on BootCurrent/BootOrder/BootInfo on Asus Motherboards (and fix!)</a></p>

<blockquote>
<p>Starting with FreeBSD CURRENT from about a few weeks of posting date, but including FreeBSD 12 alpha releases (not related to DEC Alpha), I noticed one thing: When I boot FreeBSD from UEFI on a homebuilt desktop with a Asus H87M-E motherboard, and have Root on ZFS, the bootloader gets stuck on lines like BootCurrent, BootOrder, and  BootInfo. This issue occurs when I try to boot directly to  efi\boot\bootx64.efi.</p>
</blockquote>

<blockquote>
<p>One person had a similar issue on a Asus H87I-PLUS motherboard. This issue may or may not exist on other Asus motherboards, desktops, or laptops. This may be specific to Asus motherboards for Intel’s Haswell, but may also exist on newer systems (e.g. Skylake) or older (e.g. Ivy Bridge) with Asus motherboards, as well as Asus desktops or laptops.</p>
</blockquote>

<ul>
<li>There are two solutions to this problem:</li>
<li>Use Legacy BIOS mode instead of UEFI mode</li>
<li>Install a FreeBSD UEFI Boot entry</li>
</ul>

<blockquote>
<p>Keep in mind that I am not going to talk about this issue and third-party UEFI boot managers such as rEFInd here.<br>
The first option is rather straightforward: you need to make sure your computer has “Secure Boot” disabled and “Legacy Boot” or “CSM” enabled. Then, you need to make sure FreeBSD is installed in BIOS mode. However, this solution is (in my opinion) suboptimal. Why? Because:<br>
You won’t be able to use hard drives bigger than 2TB<br>
You are limited to MBR Partitioning on Asus motherboards with UEFI as Asus motherboards refuse to boot GPT partitioned disks in BIOS mode<br>
Legacy BIOS mode may not exist on future computers or motherboards (although those systems may not have this issue, and this issue may get fixed by then)<br>
The second option, however, is less straightforward, but will let you keep UEFI. Many UEFI systems, including affected Asus motherboards described here, include a boot manager built into the UEFI. FreeBSD includes a tool called efibootmgr to manage this, similar to the similarly-named tool in Linux, but with a different syntax.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/unix/EdNoLongerGoodEditor">Why ed(1) is not a good editor today</a></p>

<blockquote>
<p>I’ll start with my tweet:</p>
</blockquote>

<p><code>Heretical Unix opinion time: ed(1) may be the 'standard Unix editor', but it is not a particularly good editor outside of a limited environment that almost never applies today.</code></p>

<blockquote>
<p>There is a certain portion of Unixdom that really likes ed(1), the ‘standard Unix editor’. Having actually used ed for a not insignificant amount of time (although it was the friendlier ‘UofT ed’ variant), I have some reactions to what I feel is sometimes overzealous praise of it. One of these is what I tweeted.<br>
The fundamental limitation of ed is that it is what I call an indirect manipulation interface, in contrast to the explicit manipulation interfaces of screen editors like vi and graphical editors like sam (which are generally lumped together as ‘visual’ editors, so called because they actually show you the text you’re editing). When you edit text in ed, you have some problems that you don’t have in visual editors; you have to maintain in your head the context of what the text looks like (and where you are in it), you have to figure out how to address portions of that text in order to modify them, and finally you have to think about how your edit commands will change the context. Copious use of ed’s p command can help with the first problem, but nothing really deals with the other two. In order to use ed, you basically have to simulate parts of ed in your head.<br>
Ed is a great editor in situations where the editor explicitly presenting this context is a very expensive or outright impossible operation. Ed works great on real teletypes, for example, or over extremely slow links where you want to send and receive as little data as possible (and on real teletypes you have some amount of context in the form of an actual printout that you can look back at). Back in the old days of Unix, this described a fairly large number of situations; you had actual teletypes, you had slow dialup links (and later slow, high latency network links), and you had slow and heavily overloaded systems.<br>
However, that’s no longer the situation today (at least almost all of the time). Modern systems and links can easily support visual editors that continually show you the context of the text and generally let you more or less directly manipulate it (whether that is through cursoring around it or using a mouse). Such editors are easier and faster to use, and they leave you with more brainpower free to think about things like the program you’re writing (which is the important thing).<br>
If you can use a visual editor, ed is not a particularly good editor to use instead; you will probably spend a lot of effort (and some amount of time) on doing by hand something that the visual editor will do for you. If you are very practiced at ed, maybe this partly goes away, but I maintain that you are still working harder than you need to be.<br>
The people who say that ed is a quite powerful editor are correct; ed is quite capable (although sadly limited by only editing a single file). It’s just that it’s also a pain to use.<br>
(They’re also correct that ed is the foundation of many other things in Unix, including sed and vi. But that doesn’t mean that the best way to learn or understand those things is to learn and use ed.)<br>
This doesn’t make ed a useless, vestigial thing on modern Unix, though. There are uses for ed in non-interactive editing, for example. But on modern Unix, ed is a specialized tool, much like dc. It’s worth knowing that ed is there and roughly what it can do, but it’s probably not worth learning how to use it before you need it. And you’re unlikely to ever be in a situation where it’s the best choice for interactive editing (and if you are, something has generally gone wrong).<br>
(But if you enjoy exploring the obscure corners of Unix, sure, go for it. Learn dc too, because it’s interesting in its own way and, like ed, it’s one of those classical old Unix programs.)</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://twitter.com/DavieDavieDave/status/1040359656864903169">Is there any interest in a #BSD user group in #Montreal?</a></li>
<li><a href="https://www.bsdjobs.com/people/hi.html">Tell your BSD story</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/finishing_leftover_tasks_from_google">Finishing leftover tasks from Google Summer of Code</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180906072459">Fuzzing the OpenBSD Kernel</a></li>
<li><a href="http://lists.nycbug.org/pipermail/talk/2018-August/017692.html">ARM - any Tier-1 *BSD options?</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Chris - <a href="http://dpaste.com/2Y6XBYN">byhve question</a></li>
<li>Paulo - <a href="http://dpaste.com/1A88F2W">Topic suggestion</a></li>
<li>Bostjan - <a href="http://dpaste.com/140ZHZD#wrap">How data gets to disk</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD and DragonflyBSD benchmarks on AMD’s Threadripper, NetBSD 7.2 has been released, optimized out DTrace kernel symbols, stuck UEFI bootloaders, why ed is not a good editor today, tell your BSD story, and more.</p>

<p>##Headlines<br>
###<a href="https://www.phoronix.com/scan.php?page=article&amp;item=bsd-threadripper-2990wx&amp;num=1">FreeBSD &amp; DragonFlyBSD Put Up A Strong Fight On AMD’s Threadripper 2990WX, Benchmarks Against Linux</a></p>

<blockquote>
<p>The past two weeks I have been delivering a great deal of AMD Threadripper 2990WX benchmarks on Linux as well as some against Windows and Windows Server. But recently I got around to trying out some of the BSD operating systems on this 32-core / 64-thread processor to see how they would run and to see whether they would have similar scaling issues or not like we’ve seen on the Windows side against Linux. In this article are FreeBSD and DragonFlyBSD benchmarks with the X399 + 2990WX compared to a few Linux distributions.<br>
The BSDs I focused my testing on were FreeBSD 11.2-STABLE and 12.0-CURRENT/ALPHA1 (the version in development) as well as iX System’s TrueOS that is tracking FreeBSD 12.0-CURRENT. Also included were DragonFlyBSD, with FreeBSD and DragonFlyBSD being tied as my favorite operating systems when it comes to the BSDs. When it came to FreeBSD 11.2-STABLE and 12.0-ALPHA1 on the Threadripper 2990WX, it worked out surprisingly well. I encountered no real issues during my two days of benchmarking on FreeBSD (and TrueOS). It was a great experience and FreeBSD was happy to exploit the 64 threads on the system.<br>
DragonFlyBSD was a bit of a different story… Last week when I started this BSD testing I tried DragonFly 5.2.2 as the latest stable release as well as a DragonFlyBSD 5.3 development snapshot from last week: both failed to boot in either BIOS or UEFI modes.<br>
But then a few days ago DragonFlyBSD lead developer Matthew Dillon bought himself a 2990WX platform. He made the necessary changes to get DragonFlyBSD 5.3 working and he ended up finding really great performance and potential out of the platform. So I tried the latest DragonFlyBSD 5.3 daily ISO on 22 August and indeed it now booted successfully and we were off to the races. Thus there are some DragonFlyBSD 5.3 benchmarks included in this article too.<br>
Just hours ago, Matthew Dillon landed some 2990WX topology and scheduler enhancements but that fell out of the scope of when DragonFly was installed on this system. But over the weekend or so I plan to re-test DragonFlyBSD 5.3 and see how those optimizations affect the overall 2990WX performance now on that BSD. DragonFlyBSD 5.4 stable should certainly be an interesting release on several fronts!<br>
With FreeBSD 11.2-STABLE and 12.0-ALPHA1 I ran benchmarks when using their stock compiler (LLVM Clang 6.0) as well as GCC 7.3 obtained via GCC 7.3. That was done to rule out compiler differences in benchmarking against the GCC-based Linux distributions. On DragonFlyBSD 5.3 it defaults to the GCC 5.4.1 but via pkg I also did a secondary run when upgraded to GCC 7.3.<br>
The hardware and BIOS/UEFI settings were maintained the same throughout the entire benchmarking process. The system was made up of the AMD Ryzen Threadripper 2990WX at stock speeds, the ASUS ROG ZENITH EXTREME motherboard, 4 x 8GB DDR4-3200MHz memory, Samsung 970 EVO 500GB NVMe SSD, and Radeon RX Vega 56 graphics card.<br>
All of these Linux vs. BSD benchmarks were carried out in a fully-automated and reproducible manner using the open-source Phoronix Test Suite benchmarking framework.<br>
While for the last of today’s BSD vs. Linux benchmarking on the Threadripper 2990WX, the Linux distributions came out slightly ahead of FreeBSD and DragonFlyBSD with GCC (another test having issues with Clang 6.0 on the BSDs).<br>
Overall, I was quite taken away by the BSD performance on the Threadripper 2990WX – particularly FreeBSD. In a surprising number of benchmarks, the BSDs were outperforming the tested Linux distributions though often by incredibly thin margins. Still, quite an accomplishment for these BSD operating systems and considering how much better Linux is already doing than Windows 10 / Windows Server on this 32-core / 64-thread processor. Then again, the BSDs like Linux have a long history of running on high core/thread-count systems, super computers, and other HPC environments.<br>
It will be interesting to see how much faster DragonFlyBSD can run given today’s commit to its kernel with scheduler and topology improvements for the 2990WX. Those additional DragonFlyBSD benchmarks will be published in the coming days once they are completed.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.netbsd.org/releases/formal-7/NetBSD-7.2.html">NetBSD 7.2 released</a></p>

<blockquote>
<p>The NetBSD Project is pleased to announce NetBSD 7.2, the second feature update of the NetBSD 7 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</p>
</blockquote>

<ul>
<li>General Security Note</li>
</ul>

<p><code>The NetBSD 7.2 release is a maintenance release of the netbsd-7 branch, which had it's first major release, NetBSD 7.0 in September 2015. A lot of security features have been added to later NetBSD versions, and for new installations we highly recommend using our latest release, NetBSD 8.0 instead.</code></p>

<ul>
<li>Some highlights of the 7.2 release are:</li>
<li>Support for USB 3.0.</li>
<li>Enhancements to the Linux emulation subsystem.</li>
<li>Fixes in binary compatibility for ancient NetBSD executables.</li>
<li>iwm(4) driver for Intel Wireless 726x, 316x, 826x and 416x series added.</li>
<li>Support for Raspberry Pi 3 added.</li>
<li>Fix interrupt setup on Hyper-V VMs with Legacy Network Adapter.</li>
<li>SVR4 and IBCS2 compatibility subsystems have been disabled by default (besides IBCS2 on VAX). These subsystems also do not auto-load their modules any more.</li>
<li>Various USB stability enhancements.</li>
<li>Numerous bug fixes and stability improvements.</li>
</ul>

<blockquote>
<p>Complete source and binaries for NetBSD 7.2 are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, SUP, and other services may be found at <a href="https://www.NetBSD.org/mirrors/">https://www.NetBSD.org/mirrors/</a>. We encourage users who wish to install via ISO or USB disk images to download via BitTorrent by using the torrent files supplied in the images area. A list of hashes for the NetBSD 7.2 distribution has been signed with the well-connected PGP key for the NetBSD Security Officer: <a href="https://cdn.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.2_hashes.asc">https://cdn.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.2_hashes.asc</a><br>
NetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone. Free support services are available via our mailing lists and website. Commercial support is available from a variety of sources. More extensive information on NetBSD is available from our website:</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://farhan.codes/2018/08/16/including-optimized-out-kernel-symbols-in-dtrace-on-freebsd/">Including optimized-out kernel symbols in dtrace on FreeBSD</a></p>

<blockquote>
<p>Have you ever had dtrace(1) on FreeBSD fail to list a probe that should exist in the kernel? This is because Clang will optimize-out some functions. The result is ctfconvert(1) will not generate debugging symbols that dtrace(1) uses to identify probes. I have a quick solution to getting those probes visible to dtrace(1).</p>
</blockquote>

<blockquote>
<p>In my case, I was trying to instrument on ieee80211_ioctl_get80211, whose sister function ieee80211_ioctl_set80211 has a dtrace(1) probe in the generic FreeBSD 11 and 12 kernels. Both functions are located in /usr/src/sys/net80211/ieee80211_ioctl.c.</p>
</blockquote>

<blockquote>
<p>My first attempt was to add to /etc/make.conf as follows and recompile the kernel.</p>
</blockquote>

<p><code>CFLAGS+=-O0 and -fno-inline-functions</code></p>

<blockquote>
<p>This failed to produce the dtrace(1) probe. Several other attempts failed and I was getting inconsistent compilation results (Is it me or is ieee80211_ioctl.c compiled with different flags if NO_CLEAN=1 is set?). When I manually compiled the object file by copying the compilation line for the object file and adding -O0 -fno-inline-functions, nm(1) on both the object file and kernel demonstrated that the symbol was present. I installed the kernel, rebooted and it was listed as a dtrace probe. Great!</p>
</blockquote>

<blockquote>
<p>But as I continued to debug my WiFi driver (oh yeah, I’m very slowly extending rtwn(4)), I found myself rebuilding the kernel several times and frequently rebooting. Why not do this across the entire kernel?</p>
</blockquote>

<blockquote>
<p>After hacking around, my solution was to modify the build scripts. My solution was to edit /usr/src/sys/conf/kern.pre.mk and modify all optimization level 2 to optimization level 0. The following is my diff(1) on FreeBSD 12.0-CURRENT.</p>
</blockquote>

<ul>
<li>A few thoughts:</li>
</ul>

<blockquote>
<p>This seems like a hack rather than a long-term solution. Either the problem is with the hard-coded optimization flags, or the inability to overwrite them in all places in make.conf.<br>
Removing optimizations is only something I would do in a non-production kernel, so its as if I have to choose between optimizations for a production kernel or having dtrace probes. But dtrace explicitly markets itself as not impactful on production.<br>
Using the dtrace pony as your featured image on WordPress does not render properly and must be rotated and modified. Blame Bryan Cantrill.<br>
If you have a better solution, please let me know and I will update the article, but this works for me!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.neelc.org/freebsd-uefi-on-asus-motherboards/">FreeBSD: UEFI Bootloader stuck on BootCurrent/BootOrder/BootInfo on Asus Motherboards (and fix!)</a></p>

<blockquote>
<p>Starting with FreeBSD CURRENT from about a few weeks of posting date, but including FreeBSD 12 alpha releases (not related to DEC Alpha), I noticed one thing: When I boot FreeBSD from UEFI on a homebuilt desktop with a Asus H87M-E motherboard, and have Root on ZFS, the bootloader gets stuck on lines like BootCurrent, BootOrder, and  BootInfo. This issue occurs when I try to boot directly to  efi\boot\bootx64.efi.</p>
</blockquote>

<blockquote>
<p>One person had a similar issue on a Asus H87I-PLUS motherboard. This issue may or may not exist on other Asus motherboards, desktops, or laptops. This may be specific to Asus motherboards for Intel’s Haswell, but may also exist on newer systems (e.g. Skylake) or older (e.g. Ivy Bridge) with Asus motherboards, as well as Asus desktops or laptops.</p>
</blockquote>

<ul>
<li>There are two solutions to this problem:</li>
<li>Use Legacy BIOS mode instead of UEFI mode</li>
<li>Install a FreeBSD UEFI Boot entry</li>
</ul>

<blockquote>
<p>Keep in mind that I am not going to talk about this issue and third-party UEFI boot managers such as rEFInd here.<br>
The first option is rather straightforward: you need to make sure your computer has “Secure Boot” disabled and “Legacy Boot” or “CSM” enabled. Then, you need to make sure FreeBSD is installed in BIOS mode. However, this solution is (in my opinion) suboptimal. Why? Because:<br>
You won’t be able to use hard drives bigger than 2TB<br>
You are limited to MBR Partitioning on Asus motherboards with UEFI as Asus motherboards refuse to boot GPT partitioned disks in BIOS mode<br>
Legacy BIOS mode may not exist on future computers or motherboards (although those systems may not have this issue, and this issue may get fixed by then)<br>
The second option, however, is less straightforward, but will let you keep UEFI. Many UEFI systems, including affected Asus motherboards described here, include a boot manager built into the UEFI. FreeBSD includes a tool called efibootmgr to manage this, similar to the similarly-named tool in Linux, but with a different syntax.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/unix/EdNoLongerGoodEditor">Why ed(1) is not a good editor today</a></p>

<blockquote>
<p>I’ll start with my tweet:</p>
</blockquote>

<p><code>Heretical Unix opinion time: ed(1) may be the 'standard Unix editor', but it is not a particularly good editor outside of a limited environment that almost never applies today.</code></p>

<blockquote>
<p>There is a certain portion of Unixdom that really likes ed(1), the ‘standard Unix editor’. Having actually used ed for a not insignificant amount of time (although it was the friendlier ‘UofT ed’ variant), I have some reactions to what I feel is sometimes overzealous praise of it. One of these is what I tweeted.<br>
The fundamental limitation of ed is that it is what I call an indirect manipulation interface, in contrast to the explicit manipulation interfaces of screen editors like vi and graphical editors like sam (which are generally lumped together as ‘visual’ editors, so called because they actually show you the text you’re editing). When you edit text in ed, you have some problems that you don’t have in visual editors; you have to maintain in your head the context of what the text looks like (and where you are in it), you have to figure out how to address portions of that text in order to modify them, and finally you have to think about how your edit commands will change the context. Copious use of ed’s p command can help with the first problem, but nothing really deals with the other two. In order to use ed, you basically have to simulate parts of ed in your head.<br>
Ed is a great editor in situations where the editor explicitly presenting this context is a very expensive or outright impossible operation. Ed works great on real teletypes, for example, or over extremely slow links where you want to send and receive as little data as possible (and on real teletypes you have some amount of context in the form of an actual printout that you can look back at). Back in the old days of Unix, this described a fairly large number of situations; you had actual teletypes, you had slow dialup links (and later slow, high latency network links), and you had slow and heavily overloaded systems.<br>
However, that’s no longer the situation today (at least almost all of the time). Modern systems and links can easily support visual editors that continually show you the context of the text and generally let you more or less directly manipulate it (whether that is through cursoring around it or using a mouse). Such editors are easier and faster to use, and they leave you with more brainpower free to think about things like the program you’re writing (which is the important thing).<br>
If you can use a visual editor, ed is not a particularly good editor to use instead; you will probably spend a lot of effort (and some amount of time) on doing by hand something that the visual editor will do for you. If you are very practiced at ed, maybe this partly goes away, but I maintain that you are still working harder than you need to be.<br>
The people who say that ed is a quite powerful editor are correct; ed is quite capable (although sadly limited by only editing a single file). It’s just that it’s also a pain to use.<br>
(They’re also correct that ed is the foundation of many other things in Unix, including sed and vi. But that doesn’t mean that the best way to learn or understand those things is to learn and use ed.)<br>
This doesn’t make ed a useless, vestigial thing on modern Unix, though. There are uses for ed in non-interactive editing, for example. But on modern Unix, ed is a specialized tool, much like dc. It’s worth knowing that ed is there and roughly what it can do, but it’s probably not worth learning how to use it before you need it. And you’re unlikely to ever be in a situation where it’s the best choice for interactive editing (and if you are, something has generally gone wrong).<br>
(But if you enjoy exploring the obscure corners of Unix, sure, go for it. Learn dc too, because it’s interesting in its own way and, like ed, it’s one of those classical old Unix programs.)</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://twitter.com/DavieDavieDave/status/1040359656864903169">Is there any interest in a #BSD user group in #Montreal?</a></li>
<li><a href="https://www.bsdjobs.com/people/hi.html">Tell your BSD story</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/finishing_leftover_tasks_from_google">Finishing leftover tasks from Google Summer of Code</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180906072459">Fuzzing the OpenBSD Kernel</a></li>
<li><a href="http://lists.nycbug.org/pipermail/talk/2018-August/017692.html">ARM - any Tier-1 *BSD options?</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Chris - <a href="http://dpaste.com/2Y6XBYN">byhve question</a></li>
<li>Paulo - <a href="http://dpaste.com/1A88F2W">Topic suggestion</a></li>
<li>Bostjan - <a href="http://dpaste.com/140ZHZD#wrap">How data gets to disk</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 263: Encrypt That Pool | BSD Now 263</title>
  <link>https://www.bsdnow.tv/263</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2528</guid>
  <pubDate>Fri, 07 Sep 2018 14:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c8edc035-36d5-4699-a081-43c1e08686bf.mp3" length="38437869" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Mitigating Spectre/Meltdown on HP Proliant servers, omniOS installation setup, debugging a memory corruption issue on OpenBSD, CfT for OpenZFS native encryption, Asigra TrueNAS backup appliance shown at VMworld, NetBSD 6 EoL, and more.</itunes:subtitle>
  <itunes:duration>1:03:45</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Mitigating Spectre/Meltdown on HP Proliant servers, omniOS installation setup, debugging a memory corruption issue on OpenBSD, CfT for OpenZFS native encryption, Asigra TrueNAS backup appliance shown at VMworld, NetBSD 6 EoL, and more.
&lt;hr&gt;
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.adminbyaccident.com/freebsd/how-to-freebsd/how-to-mitigate-spectre-and-meltdown-on-an-hp-proliant-server-with-freebsd/"&gt;How to mitigate Spectre and Meltdown on an HP Proliant server with FreeBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;As recently announced in a previous article I wanted to write a couple of guides on how to mitigate Spectre and Meltdown vulnerabilities in GNU/Linux and UNIX environments. It is always a good and I hope a standard practice to have your systems patched and if they aren’t for whatever the reason (that legacy thing you’re carrying on for ages) you may take the necessary extra steps to protect your environment. I never planned to do any article on patching anything. Nowadays it’s a no brainer and operating systems have provided the necessary tools for this to be easy and as smooth as possible. So why this article?&lt;br&gt;
Spectre and Meltdown are both hardware vulnerabilities. Major ones. They are meaningful for several reasons among them the world wide impact since they affect Intel and AMD systems which are ubiquitous. And second because patching hardware is not as easy, for the manufacturer and for the users or administrators in charge of the systems. There is still no known exploit around left out in the open hitting servers or desktops anywhere. The question is not if it will ever happen. The question is when will it happen. And it may be sooner than later. This is why big companies, governments and people in charge of big deployments are patching or have already patched their systems. But have you done it to your system? I know you have a firewall. Have you thought about CVE-2018-3639? This particular one could make your browser being a vector to get into your system. So, no, there is no reason to skip this.&lt;br&gt;
Patching these set of vulnerabilities implies some more steps and concerns than updating the operating system. If you are a regular Windows user I find rare you to be here and many of the things you will read may be foreign to you. I am not planning to do a guide on Windows systems since I believe someone else has or will do it and will do it better than me since I am not a pro Windows user. However there is one basic and common thing for all OS’s when dealing with Spectre and Meltdown and that is a microcode update is necessary for the OS patches to effectively work.&lt;br&gt;
What is microcode? You can read the Wikipedia article but in short it is basically a layer of code that allows chip manufacturers to deal with modifications on the hardware they’ve produced and the operating systems that will manage that hardware. Since there’s been some issues (namely Spectre and Meltdown) Intel and AMD respectively have released a series of microcode updates to address those problems. First series did come with serious problems and some regressions, to the point GNU/Linux producers stopped releasing the microcode updates through their release channels for updates and placed the ball on Intel’s roof. Patching fast does always include risks, specially when dealing with hardware. OS vendors have resumed their microcode update releases so all seems to be fine now.&lt;br&gt;
In order to update the microcode we’re faced with two options. Download the most recent BIOS release from our vendor, provided it patches the Spectre and Meltdown vulnerabilities, or patch it from the OS. If your hardware vendor has decided not to provide support on your hardware you are forced to use the latter solution. Yes, you can still keep your hardware. They usually come accompanied with a “release notes” file where there are some explanatory notes on what is fixed, what is new, etc. To make the search easy for you a news site collected the vendors list and linked the right support pages for anyone to look. In some scenarios it would be desirable not to replace the whole BIOS but just update the microcode from the OS side. In my case I should update an HP Proliant ML110 G7 box and the download link for that would be this.&lt;br&gt;
Instead of using the full blown BIOS update path we’ll use the inner utilities to patch Spectre and Meltdown on FreeBSD. So let’s put our hands on it&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;See the article for the technical breakdown&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://eerielinux.wordpress.com/2018/08/25/a-look-beyond-the-bsd-teacup-omnios-installation/"&gt;A look beyond the BSD teacup: OmniOS installation&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Five years ago I wrote a post about taking a look beyond the Linux teacup. I was an Arch Linux user back then and since there were projects like ArchBSD (called PacBSD today) and Arch Hurd, I decided to take a look at and write about them. Things have changed. Today I’m a happy FreeBSD user, but it’s time again to take a look beyond the teacup of operating systems that I’m familiar with.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Why Illumos / OmniOS?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;There are a couple of reasons. The Solaris derivatives are the other big community in the *nix family besides Linux and the BSDs and we hadn’t met so far. Working with ZFS on FreeBSD, I now and then I read messages that contain a reference to Illumos which certainly helps to keep up the awareness. Of course there has also been a bit of curiosity – what might the OS be like that grew ZFS?&lt;br&gt;
Also the Ravenports project that I participate in planned to support Solaris/Illumos right from the beginning. I wanted to at least be somewhat “prepared” when support for that platform would finally land. So I did a little research on the various derivatives available and settled on the one that I had heard a talk about at last year’s conference of the German Unix Users Group: “OmniOS – Solaris for the Rest of Us”. I would have chosen SmartOS as I admire what Bryan Cantrill does but for getting to know Illumos I prefer a traditional installation over a run-from-RAM system.&lt;br&gt;
Of course FreeBSD is not run by corporations, especially when compared to the state of Linux. And when it comes to sponsoring, OpenBSD also takes the money… When it comes to FreeBSD developers, there’s probably some truth to the claim that some of them are using macOS as their desktop systems while OpenBSD devs are more likely to develop on their OS of choice. But then there’s the statement that “every innovation in the past decade comes from Solaris”. Bhyve alone proves this wrong. But let’s be honest: Two of the major technologies that make FreeBSD a great platform today – ZFS and DTrace – actually do come from Solaris. PAM originates there and a more modern way of managing services as well. Also you hear good things about their zones and a lot of small utilities in general.&lt;br&gt;
In the end it was a lack of time that made me cheat and go down the easiest road: Create a Vagrantfile and just pull a VM image of the net that someone else had prepared… This worked to just make sure that the Raven packages work on OmniOS. I was determined to return, though – someday. You know how things go: “someday” is a pretty common alias for “probably never, actually.”&lt;br&gt;
But then I heard about a forum post on the BSDNow! podcast. The title “Initial OmniOS impressions by a BSD user” caught my attention. I read that it was written by somebody who had used FreeBSD for years but loathed the new Code of Conduct enough to leave. I also oppose the Conduct and have made that pretty clear in my February post [ ! -z ${COC} ] &amp;amp;&amp;amp; exit 1. As stated there, I have stayed with my favorite OS and continue to advocate it. I decided to stop reading the post and try things out on my own instead. Now I’ve finally found the time to do so.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;What’s next?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;That’s it for part one. In part two I’ll try to make the system useful. So far I have run into a problem that I haven’t been able to solve. But I have some time now to figure things out for the next post. Let’s see if I manage to get it working or if I have to report failure!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://wiki.freebsd.org/Memory"&gt;What are all these types of memory in top(1)?&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Earlier this week I convinced Mark Johnston, one of the FreeBSD VM experts to update a page on the FreeBSD wiki that I saw was being referenced on stackoverflow and similar sites&lt;/li&gt;
&lt;li&gt;Mark updated the explanations to be more correct, and to include more technical detail for inquiring minds&lt;/li&gt;
&lt;li&gt;He also added the new type that appeared in FreeBSD somewhat recently&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Active - Contains memory “actively” (recently) being used by applications&lt;br&gt;
Inactive - Contains memory that has not been touched recently, or was released from the Buffer Cache&lt;br&gt;
Laundry - Contains memory that Inactive but still potentially contains useful data that needs to be stored before this memory can be used again&lt;br&gt;
Wired - Memory that cannot be swapped out, including the kernel, network stack, and the ZFS ARC&lt;br&gt;
Buf - Buffer Cache, used my UFS and most filesystems except ZFS (which uses the ARC)&lt;br&gt;
Free - Memory that is immediately available for use by the rest of the system&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://nanxiao.me/en/openbsd-saves-me-again-debug-a-memory-corruption-issue/"&gt;OpenBSD saves me again! — Debug a memory corruption issue&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Yesterday, I came across a third-part library issue, which crashes at allocating memory:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;Program terminated with signal SIGSEGV, Segmentation fault.&lt;/code&gt;&lt;br&gt;
&lt;code&gt;#0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6&lt;/code&gt;&lt;br&gt;
&lt;code&gt;(gdb) bt&lt;/code&gt;&lt;br&gt;
&lt;code&gt;#0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6&lt;/code&gt;&lt;br&gt;
&lt;code&gt;#1 0x00007f594a5ab503 in malloc () from /usr/lib/libc.so.6&lt;/code&gt;&lt;br&gt;
&lt;code&gt;#2 0x00007f594b13f159 in operator new (sz=5767168) at /build/gcc/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;It is obvious that the memory tags are corrupted, but who is the murder? Since the library involves a lot of maths computation, it is not an easy task to grasp the code quickly. So I need to find another way:&lt;br&gt;
(1) Open all warnings during compilation: -Wall. Nothing found.&lt;br&gt;
(2) Use valgrind, but unfortunately, valgrind crashes itself:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;valgrind: the 'impossible' happened:&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Killed by fatal signal&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;host stacktrace:&lt;/code&gt;&lt;br&gt;
&lt;code&gt;==43326== at 0x58053139: get_bszB_as_is (m_mallocfree.c:303)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;==43326== by 0x58053139: get_bszB (m_mallocfree.c:315)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;==43326== by 0x58053139: vgPlain_arena_malloc (m_mallocfree.c:1799)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;==43326== by 0x5800BA84: vgMemCheck_new_block (mc_malloc_wrappers.c:372)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;==43326== by 0x5800BD39: vgMemCheck___builtin_vec_new (mc_malloc_wrappers.c:427)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;==43326== by 0x5809F785: do_client_request (scheduler.c:1866)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;==43326== by 0x5809F785: vgPlain_scheduler (scheduler.c:1433)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;==43326== by 0x580AED50: thread_wrapper (syswrap-linux.c:103)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;==43326== by 0x580AED50: run_a_thread_NORETURN (syswrap-linux.c:156)&lt;/code&gt;&lt;br&gt;
&lt;code&gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;sched status:&lt;/code&gt;&lt;br&gt;
&lt;code&gt;running_tid=1&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;(3) Change compiler, use clang instead of gcc, and hope it can give me some clues. Still no effect.&lt;br&gt;
(4) Switch Operating System from Linux to OpenBSD, the program crashes again. But this time, it tells me where the memory corruption occurs:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;Program terminated with signal SIGSEGV, Segmentation fault.&lt;/code&gt;&lt;br&gt;
&lt;code&gt;#0 0x000014b07f01e52d in addMod (r=&amp;lt;error reading variable&amp;gt;, a=4693443247995522, b=28622907746665631,&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I figure out the issue quickly, and not bother to understand the whole code. OpenBSD saves me again, thanks!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070832.html"&gt;Native Encryption for ZFS on FreeBSD (Call for Testing)&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;To anyone with an interest in native encryption in ZFS please test the projects/zfs-crypto-merge-0820 branch in my freebsd repo: &lt;a href="https://github.com/mattmacy/networking.git"&gt;https://github.com/mattmacy/networking.git&lt;/a&gt;&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;git clone https://github.com/mattmacy/networking.git -b projects/zfs-crypto-merge-0820&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The UI is quite close to the Oracle Solaris ZFS crypto with minor differences for specifying key location.&lt;br&gt;
Please note that once a feature is enabled on a pool it can’t be disabled. This means that if you enable encryption support on a pool you will never be able to import it in to a ZFS without encryption support. For this reason I would strongly advise against using this on any pool that can’t be easily replaced until this change has made its way in to HEAD after the freeze has been lifted.&lt;br&gt;
By way of background the original ZoL commit can be found at:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49"&gt;https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.ixsystems.com/blog/vmworld2018/"&gt;VMworld 2018: Showcasing Hybrid Cloud, Persistent Memory and the Asigra TrueNAS Backup Appliance&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;During its last year in Las Vegas before moving back to San Francisco, VMworld was abuzz with all the popular buzzwords, but the key focus was on supporting a more agile approach to hybrid cloud.&lt;br&gt;
Surveys of IT stakeholders and analysts agree that most businesses have multiple clouds spanning both public cloud providers and private data centers. While the exact numbers vary, well over half of businesses have a hybrid cloud strategy consisting of at least three different clouds.&lt;br&gt;
This focus on hybrid cloud provided the perfect timing for our announcement that iXsystems and Asigra are partnering to deliver the Asigra TrueNAS Backup Appliance, which combines Asigra Cloud Backup software backed by TrueNAS storage. Asigra TrueNAS Backup Appliances provide a self-healing and ransomware-resistent OpenZFS backup repository in your private cloud. The appliance can simultaneously be used as general-purpose file, block, and object storage. How does this tie in with the hybrid cloud? The Asigra Cloud Backup software can backup data from public cloud repositories – G Suite, Office 365, Salesforce, etc. – as well as intelligently move backed-up data to the public cloud for long-term retention.&lt;br&gt;
Another major theme at the technical sessions was persistent memory, as vSphere 6.7 added support for persistent memory – either as a storage tier or virtualized and presented to a guest OS. As detailed in our blog post from SNIA’s Persistent Memory Summit 2018, persistent memory is rapidly becoming mainstream. Persistent memory bridges the gap between memory and flash storage – providing near-memory latency storage that persists across reboots or power loss. vSphere allows both legacy and persistent memory-aware applications to leverage this ultra-fast storage tier. We were excited to show off our newly-introduced TrueNAS M-Series at VMworld, as all TrueNAS M40 and M50 models leverage NVDIMM persistent memory technology to provide a super-fast write cache, or SLOG, without any of the limitations of Flash technology.&lt;br&gt;
The iXsystems booth’s theme was “Enterprise Storage, Open Source Economics”. iXsystems leverages the power of Open Source software, combined with our enterprise-class hardware and support, to provide incredibly low TCO storage for virtualization environments. Our TrueNAS unified storage and server offerings are an ideal solution for your organization’s private cloud infrastructure. Combined with VMware NSX Hybrid Connect – formerly known as VMware Hybrid Cloud Extension – you can seamlessly shift running systems into a public cloud environment for a true hybrid cloud solution.&lt;br&gt;
Another special treat at this year’s booth was iXsystems Vice President of Engineering Kris Moore giving demos of an early version of “Project TrueView”, a single-pane of glass management solution for administration of multiple FreeNAS and TrueNAS systems. In addition to simplified administration and enhanced monitoring, Project TrueView will also provide Role-Based Access Control for finer-grained permissions management. A beta version of Project TrueView is expected to be available at the end of this year.&lt;br&gt;
Overall, we had a great week at VMworld 2018 with lots of good conversations with customers, press, analysts, and future customers about TrueNAS, the Asigra TrueNAS Backup Appliance, iXsystems servers, Project TrueView, and more – our booth was more popular than ever!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blog.netbsd.org/tnf/entry/end_of_life_for_netbsd1"&gt;End of life for NetBSD 6.x&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;In keeping with NetBSD’s policy of supporting only the latest (8.x) and next most recent (7.x) major branches, the recent release of NetBSD 8.0 marks the end of life for NetBSD 6.x. As in the past, a month of overlapping support has been provided in order to ease the migration to newer releases.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;As of now, the following branches are no longer maintained:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;netbsd-6-1&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;netbsd-6-0&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;netbsd-6&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;This means:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;There will be no more pullups to those branches (even for security issues)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;There will be no security advisories made for any those branches&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;The existing 6.x releases on &lt;a href="http://ftp.NetBSD.org"&gt;ftp.NetBSD.org&lt;/a&gt; will be moved into /pub/NetBSD-archive/&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;May NetBSD 8.0 serve you well! (And if it doesn’t, please submit a PR!)&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://imgur.com/a/fkzTwYm"&gt;Blast from the past: OpenBSD 3.7 CD artwork&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/romanzolotarev/status/1030345831751270400"&gt;People are asking about scale of BSD projects. Let’s figure it out…&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mwl.io/archives/3642"&gt;Tuesday, 21 August 18: me, on ed(1), at SemiBUG&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180813133939"&gt;arm64 gains RETGUARD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://fosdem.org/2019/news/2018-08-10-call-for-participation/"&gt;Call for participation&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/FreeBSD-UPB/bhyvearm64-utils"&gt;FreeBSD-UPB/bhyvearm64-utils&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Eric - &lt;a href="http://dpaste.com/2GY2S6T#wrap"&gt;FreeNAS for Vacation&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Patrick - &lt;a href="http://dpaste.com/347WCR3"&gt;Long Live Unix&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Jason - &lt;a href="http://dpaste.com/1B7E8F5#wrap"&gt;Jason - Full MP3 Recordings&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Bostjan - &lt;a href="http://dpaste.com/34AQNSE#wrap"&gt;Question about jails and kernel&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd,openbsd,netbsd,dragonflybsd,trueos,trident,hardenedbsd,tutorial,howto,guide,bsd,interview,vmworld,spectre,asigra</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Mitigating Spectre/Meltdown on HP Proliant servers, omniOS installation setup, debugging a memory corruption issue on OpenBSD, CfT for OpenZFS native encryption, Asigra TrueNAS backup appliance shown at VMworld, NetBSD 6 EoL, and more.<br>
<hr></p>

<p>##Headlines<br>
###<a href="https://www.adminbyaccident.com/freebsd/how-to-freebsd/how-to-mitigate-spectre-and-meltdown-on-an-hp-proliant-server-with-freebsd/">How to mitigate Spectre and Meltdown on an HP Proliant server with FreeBSD</a></p>

<blockquote>
<p>As recently announced in a previous article I wanted to write a couple of guides on how to mitigate Spectre and Meltdown vulnerabilities in GNU/Linux and UNIX environments. It is always a good and I hope a standard practice to have your systems patched and if they aren’t for whatever the reason (that legacy thing you’re carrying on for ages) you may take the necessary extra steps to protect your environment. I never planned to do any article on patching anything. Nowadays it’s a no brainer and operating systems have provided the necessary tools for this to be easy and as smooth as possible. So why this article?<br>
Spectre and Meltdown are both hardware vulnerabilities. Major ones. They are meaningful for several reasons among them the world wide impact since they affect Intel and AMD systems which are ubiquitous. And second because patching hardware is not as easy, for the manufacturer and for the users or administrators in charge of the systems. There is still no known exploit around left out in the open hitting servers or desktops anywhere. The question is not if it will ever happen. The question is when will it happen. And it may be sooner than later. This is why big companies, governments and people in charge of big deployments are patching or have already patched their systems. But have you done it to your system? I know you have a firewall. Have you thought about CVE-2018-3639? This particular one could make your browser being a vector to get into your system. So, no, there is no reason to skip this.<br>
Patching these set of vulnerabilities implies some more steps and concerns than updating the operating system. If you are a regular Windows user I find rare you to be here and many of the things you will read may be foreign to you. I am not planning to do a guide on Windows systems since I believe someone else has or will do it and will do it better than me since I am not a pro Windows user. However there is one basic and common thing for all OS’s when dealing with Spectre and Meltdown and that is a microcode update is necessary for the OS patches to effectively work.<br>
What is microcode? You can read the Wikipedia article but in short it is basically a layer of code that allows chip manufacturers to deal with modifications on the hardware they’ve produced and the operating systems that will manage that hardware. Since there’s been some issues (namely Spectre and Meltdown) Intel and AMD respectively have released a series of microcode updates to address those problems. First series did come with serious problems and some regressions, to the point GNU/Linux producers stopped releasing the microcode updates through their release channels for updates and placed the ball on Intel’s roof. Patching fast does always include risks, specially when dealing with hardware. OS vendors have resumed their microcode update releases so all seems to be fine now.<br>
In order to update the microcode we’re faced with two options. Download the most recent BIOS release from our vendor, provided it patches the Spectre and Meltdown vulnerabilities, or patch it from the OS. If your hardware vendor has decided not to provide support on your hardware you are forced to use the latter solution. Yes, you can still keep your hardware. They usually come accompanied with a “release notes” file where there are some explanatory notes on what is fixed, what is new, etc. To make the search easy for you a news site collected the vendors list and linked the right support pages for anyone to look. In some scenarios it would be desirable not to replace the whole BIOS but just update the microcode from the OS side. In my case I should update an HP Proliant ML110 G7 box and the download link for that would be this.<br>
Instead of using the full blown BIOS update path we’ll use the inner utilities to patch Spectre and Meltdown on FreeBSD. So let’s put our hands on it</p>
</blockquote>

<ul>
<li>See the article for the technical breakdown</li>
</ul>

<p><hr></p>

<p>###<a href="https://eerielinux.wordpress.com/2018/08/25/a-look-beyond-the-bsd-teacup-omnios-installation/">A look beyond the BSD teacup: OmniOS installation</a></p>

<blockquote>
<p>Five years ago I wrote a post about taking a look beyond the Linux teacup. I was an Arch Linux user back then and since there were projects like ArchBSD (called PacBSD today) and Arch Hurd, I decided to take a look at and write about them. Things have changed. Today I’m a happy FreeBSD user, but it’s time again to take a look beyond the teacup of operating systems that I’m familiar with.</p>
</blockquote>

<ul>
<li>Why Illumos / OmniOS?</li>
</ul>

<blockquote>
<p>There are a couple of reasons. The Solaris derivatives are the other big community in the *nix family besides Linux and the BSDs and we hadn’t met so far. Working with ZFS on FreeBSD, I now and then I read messages that contain a reference to Illumos which certainly helps to keep up the awareness. Of course there has also been a bit of curiosity – what might the OS be like that grew ZFS?<br>
Also the Ravenports project that I participate in planned to support Solaris/Illumos right from the beginning. I wanted to at least be somewhat “prepared” when support for that platform would finally land. So I did a little research on the various derivatives available and settled on the one that I had heard a talk about at last year’s conference of the German Unix Users Group: “OmniOS – Solaris for the Rest of Us”. I would have chosen SmartOS as I admire what Bryan Cantrill does but for getting to know Illumos I prefer a traditional installation over a run-from-RAM system.<br>
Of course FreeBSD is not run by corporations, especially when compared to the state of Linux. And when it comes to sponsoring, OpenBSD also takes the money… When it comes to FreeBSD developers, there’s probably some truth to the claim that some of them are using macOS as their desktop systems while OpenBSD devs are more likely to develop on their OS of choice. But then there’s the statement that “every innovation in the past decade comes from Solaris”. Bhyve alone proves this wrong. But let’s be honest: Two of the major technologies that make FreeBSD a great platform today – ZFS and DTrace – actually do come from Solaris. PAM originates there and a more modern way of managing services as well. Also you hear good things about their zones and a lot of small utilities in general.<br>
In the end it was a lack of time that made me cheat and go down the easiest road: Create a Vagrantfile and just pull a VM image of the net that someone else had prepared… This worked to just make sure that the Raven packages work on OmniOS. I was determined to return, though – someday. You know how things go: “someday” is a pretty common alias for “probably never, actually.”<br>
But then I heard about a forum post on the BSDNow! podcast. The title “Initial OmniOS impressions by a BSD user” caught my attention. I read that it was written by somebody who had used FreeBSD for years but loathed the new Code of Conduct enough to leave. I also oppose the Conduct and have made that pretty clear in my February post [ ! -z ${COC} ] &amp;&amp; exit 1. As stated there, I have stayed with my favorite OS and continue to advocate it. I decided to stop reading the post and try things out on my own instead. Now I’ve finally found the time to do so.</p>
</blockquote>

<ul>
<li>What’s next?</li>
</ul>

<blockquote>
<p>That’s it for part one. In part two I’ll try to make the system useful. So far I have run into a problem that I haven’t been able to solve. But I have some time now to figure things out for the next post. Let’s see if I manage to get it working or if I have to report failure!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://wiki.freebsd.org/Memory">What are all these types of memory in top(1)?</a></p>

<ul>
<li>Earlier this week I convinced Mark Johnston, one of the FreeBSD VM experts to update a page on the FreeBSD wiki that I saw was being referenced on stackoverflow and similar sites</li>
<li>Mark updated the explanations to be more correct, and to include more technical detail for inquiring minds</li>
<li>He also added the new type that appeared in FreeBSD somewhat recently</li>
</ul>

<blockquote>
<p>Active - Contains memory “actively” (recently) being used by applications<br>
Inactive - Contains memory that has not been touched recently, or was released from the Buffer Cache<br>
Laundry - Contains memory that Inactive but still potentially contains useful data that needs to be stored before this memory can be used again<br>
Wired - Memory that cannot be swapped out, including the kernel, network stack, and the ZFS ARC<br>
Buf - Buffer Cache, used my UFS and most filesystems except ZFS (which uses the ARC)<br>
Free - Memory that is immediately available for use by the rest of the system</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://nanxiao.me/en/openbsd-saves-me-again-debug-a-memory-corruption-issue/">OpenBSD saves me again! — Debug a memory corruption issue</a></p>

<blockquote>
<p>Yesterday, I came across a third-part library issue, which crashes at allocating memory:</p>
</blockquote>

<p><code>Program terminated with signal SIGSEGV, Segmentation fault.</code><br>
<code>#0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6</code><br>
<code>(gdb) bt</code><br>
<code>#0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6</code><br>
<code>#1 0x00007f594a5ab503 in malloc () from /usr/lib/libc.so.6</code><br>
<code>#2 0x00007f594b13f159 in operator new (sz=5767168) at /build/gcc/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50</code></p>

<blockquote>
<p>It is obvious that the memory tags are corrupted, but who is the murder? Since the library involves a lot of maths computation, it is not an easy task to grasp the code quickly. So I need to find another way:<br>
(1) Open all warnings during compilation: -Wall. Nothing found.<br>
(2) Use valgrind, but unfortunately, valgrind crashes itself:</p>
</blockquote>

<p><code>valgrind: the 'impossible' happened:</code><br>
<code>Killed by fatal signal</code><br>
<code></code><br>
<code>host stacktrace:</code><br>
<code>==43326== at 0x58053139: get_bszB_as_is (m_mallocfree.c:303)</code><br>
<code>==43326== by 0x58053139: get_bszB (m_mallocfree.c:315)</code><br>
<code>==43326== by 0x58053139: vgPlain_arena_malloc (m_mallocfree.c:1799)</code><br>
<code>==43326== by 0x5800BA84: vgMemCheck_new_block (mc_malloc_wrappers.c:372)</code><br>
<code>==43326== by 0x5800BD39: vgMemCheck___builtin_vec_new (mc_malloc_wrappers.c:427)</code><br>
<code>==43326== by 0x5809F785: do_client_request (scheduler.c:1866)</code><br>
<code>==43326== by 0x5809F785: vgPlain_scheduler (scheduler.c:1433)</code><br>
<code>==43326== by 0x580AED50: thread_wrapper (syswrap-linux.c:103)</code><br>
<code>==43326== by 0x580AED50: run_a_thread_NORETURN (syswrap-linux.c:156)</code><br>
<code></code><br>
<code>sched status:</code><br>
<code>running_tid=1</code></p>

<blockquote>
<p>(3) Change compiler, use clang instead of gcc, and hope it can give me some clues. Still no effect.<br>
(4) Switch Operating System from Linux to OpenBSD, the program crashes again. But this time, it tells me where the memory corruption occurs:</p>
</blockquote>

<p><code>Program terminated with signal SIGSEGV, Segmentation fault.</code><br>
<code>#0 0x000014b07f01e52d in addMod (r=&lt;error reading variable&gt;, a=4693443247995522, b=28622907746665631,</code></p>

<blockquote>
<p>I figure out the issue quickly, and not bother to understand the whole code. OpenBSD saves me again, thanks!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070832.html">Native Encryption for ZFS on FreeBSD (Call for Testing)</a></p>

<blockquote>
<p>To anyone with an interest in native encryption in ZFS please test the projects/zfs-crypto-merge-0820 branch in my freebsd repo: <a href="https://github.com/mattmacy/networking.git">https://github.com/mattmacy/networking.git</a></p>
</blockquote>

<p><code>git clone https://github.com/mattmacy/networking.git -b projects/zfs-crypto-merge-0820</code></p>

<blockquote>
<p>The UI is quite close to the Oracle Solaris ZFS crypto with minor differences for specifying key location.<br>
Please note that once a feature is enabled on a pool it can’t be disabled. This means that if you enable encryption support on a pool you will never be able to import it in to a ZFS without encryption support. For this reason I would strongly advise against using this on any pool that can’t be easily replaced until this change has made its way in to HEAD after the freeze has been lifted.<br>
By way of background the original ZoL commit can be found at:</p>
</blockquote>

<ul>
<li><a href="https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49">https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://www.ixsystems.com/blog/vmworld2018/">VMworld 2018: Showcasing Hybrid Cloud, Persistent Memory and the Asigra TrueNAS Backup Appliance</a></p>

<blockquote>
<p>During its last year in Las Vegas before moving back to San Francisco, VMworld was abuzz with all the popular buzzwords, but the key focus was on supporting a more agile approach to hybrid cloud.<br>
Surveys of IT stakeholders and analysts agree that most businesses have multiple clouds spanning both public cloud providers and private data centers. While the exact numbers vary, well over half of businesses have a hybrid cloud strategy consisting of at least three different clouds.<br>
This focus on hybrid cloud provided the perfect timing for our announcement that iXsystems and Asigra are partnering to deliver the Asigra TrueNAS Backup Appliance, which combines Asigra Cloud Backup software backed by TrueNAS storage. Asigra TrueNAS Backup Appliances provide a self-healing and ransomware-resistent OpenZFS backup repository in your private cloud. The appliance can simultaneously be used as general-purpose file, block, and object storage. How does this tie in with the hybrid cloud? The Asigra Cloud Backup software can backup data from public cloud repositories – G Suite, Office 365, Salesforce, etc. – as well as intelligently move backed-up data to the public cloud for long-term retention.<br>
Another major theme at the technical sessions was persistent memory, as vSphere 6.7 added support for persistent memory – either as a storage tier or virtualized and presented to a guest OS. As detailed in our blog post from SNIA’s Persistent Memory Summit 2018, persistent memory is rapidly becoming mainstream. Persistent memory bridges the gap between memory and flash storage – providing near-memory latency storage that persists across reboots or power loss. vSphere allows both legacy and persistent memory-aware applications to leverage this ultra-fast storage tier. We were excited to show off our newly-introduced TrueNAS M-Series at VMworld, as all TrueNAS M40 and M50 models leverage NVDIMM persistent memory technology to provide a super-fast write cache, or SLOG, without any of the limitations of Flash technology.<br>
The iXsystems booth’s theme was “Enterprise Storage, Open Source Economics”. iXsystems leverages the power of Open Source software, combined with our enterprise-class hardware and support, to provide incredibly low TCO storage for virtualization environments. Our TrueNAS unified storage and server offerings are an ideal solution for your organization’s private cloud infrastructure. Combined with VMware NSX Hybrid Connect – formerly known as VMware Hybrid Cloud Extension – you can seamlessly shift running systems into a public cloud environment for a true hybrid cloud solution.<br>
Another special treat at this year’s booth was iXsystems Vice President of Engineering Kris Moore giving demos of an early version of “Project TrueView”, a single-pane of glass management solution for administration of multiple FreeNAS and TrueNAS systems. In addition to simplified administration and enhanced monitoring, Project TrueView will also provide Role-Based Access Control for finer-grained permissions management. A beta version of Project TrueView is expected to be available at the end of this year.<br>
Overall, we had a great week at VMworld 2018 with lots of good conversations with customers, press, analysts, and future customers about TrueNAS, the Asigra TrueNAS Backup Appliance, iXsystems servers, Project TrueView, and more – our booth was more popular than ever!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/end_of_life_for_netbsd1">End of life for NetBSD 6.x</a></p>

<blockquote>
<p>In keeping with NetBSD’s policy of supporting only the latest (8.x) and next most recent (7.x) major branches, the recent release of NetBSD 8.0 marks the end of life for NetBSD 6.x. As in the past, a month of overlapping support has been provided in order to ease the migration to newer releases.</p>
</blockquote>

<ul>
<li>
<p>As of now, the following branches are no longer maintained:</p>
</li>
<li>
<p>netbsd-6-1</p>
</li>
<li>
<p>netbsd-6-0</p>
</li>
<li>
<p>netbsd-6</p>
</li>
<li>
<p>This means:</p>
</li>
<li>
<p>There will be no more pullups to those branches (even for security issues)</p>
</li>
<li>
<p>There will be no security advisories made for any those branches</p>
</li>
<li>
<p>The existing 6.x releases on <a href="http://ftp.NetBSD.org">ftp.NetBSD.org</a> will be moved into /pub/NetBSD-archive/</p>
</li>
<li>
<p>May NetBSD 8.0 serve you well! (And if it doesn’t, please submit a PR!)</p>
</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://imgur.com/a/fkzTwYm">Blast from the past: OpenBSD 3.7 CD artwork</a></li>
<li><a href="https://twitter.com/romanzolotarev/status/1030345831751270400">People are asking about scale of BSD projects. Let’s figure it out…</a></li>
<li><a href="https://mwl.io/archives/3642">Tuesday, 21 August 18: me, on ed(1), at SemiBUG</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180813133939">arm64 gains RETGUARD</a></li>
<li><a href="https://fosdem.org/2019/news/2018-08-10-call-for-participation/">Call for participation</a></li>
<li><a href="https://github.com/FreeBSD-UPB/bhyvearm64-utils">FreeBSD-UPB/bhyvearm64-utils</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Eric - <a href="http://dpaste.com/2GY2S6T#wrap">FreeNAS for Vacation</a></li>
<li>Patrick - <a href="http://dpaste.com/347WCR3">Long Live Unix</a></li>
<li>Jason - <a href="http://dpaste.com/1B7E8F5#wrap">Jason - Full MP3 Recordings</a></li>
<li>Bostjan - <a href="http://dpaste.com/34AQNSE#wrap">Question about jails and kernel</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Mitigating Spectre/Meltdown on HP Proliant servers, omniOS installation setup, debugging a memory corruption issue on OpenBSD, CfT for OpenZFS native encryption, Asigra TrueNAS backup appliance shown at VMworld, NetBSD 6 EoL, and more.<br>
<hr></p>

<p>##Headlines<br>
###<a href="https://www.adminbyaccident.com/freebsd/how-to-freebsd/how-to-mitigate-spectre-and-meltdown-on-an-hp-proliant-server-with-freebsd/">How to mitigate Spectre and Meltdown on an HP Proliant server with FreeBSD</a></p>

<blockquote>
<p>As recently announced in a previous article I wanted to write a couple of guides on how to mitigate Spectre and Meltdown vulnerabilities in GNU/Linux and UNIX environments. It is always a good and I hope a standard practice to have your systems patched and if they aren’t for whatever the reason (that legacy thing you’re carrying on for ages) you may take the necessary extra steps to protect your environment. I never planned to do any article on patching anything. Nowadays it’s a no brainer and operating systems have provided the necessary tools for this to be easy and as smooth as possible. So why this article?<br>
Spectre and Meltdown are both hardware vulnerabilities. Major ones. They are meaningful for several reasons among them the world wide impact since they affect Intel and AMD systems which are ubiquitous. And second because patching hardware is not as easy, for the manufacturer and for the users or administrators in charge of the systems. There is still no known exploit around left out in the open hitting servers or desktops anywhere. The question is not if it will ever happen. The question is when will it happen. And it may be sooner than later. This is why big companies, governments and people in charge of big deployments are patching or have already patched their systems. But have you done it to your system? I know you have a firewall. Have you thought about CVE-2018-3639? This particular one could make your browser being a vector to get into your system. So, no, there is no reason to skip this.<br>
Patching these set of vulnerabilities implies some more steps and concerns than updating the operating system. If you are a regular Windows user I find rare you to be here and many of the things you will read may be foreign to you. I am not planning to do a guide on Windows systems since I believe someone else has or will do it and will do it better than me since I am not a pro Windows user. However there is one basic and common thing for all OS’s when dealing with Spectre and Meltdown and that is a microcode update is necessary for the OS patches to effectively work.<br>
What is microcode? You can read the Wikipedia article but in short it is basically a layer of code that allows chip manufacturers to deal with modifications on the hardware they’ve produced and the operating systems that will manage that hardware. Since there’s been some issues (namely Spectre and Meltdown) Intel and AMD respectively have released a series of microcode updates to address those problems. First series did come with serious problems and some regressions, to the point GNU/Linux producers stopped releasing the microcode updates through their release channels for updates and placed the ball on Intel’s roof. Patching fast does always include risks, specially when dealing with hardware. OS vendors have resumed their microcode update releases so all seems to be fine now.<br>
In order to update the microcode we’re faced with two options. Download the most recent BIOS release from our vendor, provided it patches the Spectre and Meltdown vulnerabilities, or patch it from the OS. If your hardware vendor has decided not to provide support on your hardware you are forced to use the latter solution. Yes, you can still keep your hardware. They usually come accompanied with a “release notes” file where there are some explanatory notes on what is fixed, what is new, etc. To make the search easy for you a news site collected the vendors list and linked the right support pages for anyone to look. In some scenarios it would be desirable not to replace the whole BIOS but just update the microcode from the OS side. In my case I should update an HP Proliant ML110 G7 box and the download link for that would be this.<br>
Instead of using the full blown BIOS update path we’ll use the inner utilities to patch Spectre and Meltdown on FreeBSD. So let’s put our hands on it</p>
</blockquote>

<ul>
<li>See the article for the technical breakdown</li>
</ul>

<p><hr></p>

<p>###<a href="https://eerielinux.wordpress.com/2018/08/25/a-look-beyond-the-bsd-teacup-omnios-installation/">A look beyond the BSD teacup: OmniOS installation</a></p>

<blockquote>
<p>Five years ago I wrote a post about taking a look beyond the Linux teacup. I was an Arch Linux user back then and since there were projects like ArchBSD (called PacBSD today) and Arch Hurd, I decided to take a look at and write about them. Things have changed. Today I’m a happy FreeBSD user, but it’s time again to take a look beyond the teacup of operating systems that I’m familiar with.</p>
</blockquote>

<ul>
<li>Why Illumos / OmniOS?</li>
</ul>

<blockquote>
<p>There are a couple of reasons. The Solaris derivatives are the other big community in the *nix family besides Linux and the BSDs and we hadn’t met so far. Working with ZFS on FreeBSD, I now and then I read messages that contain a reference to Illumos which certainly helps to keep up the awareness. Of course there has also been a bit of curiosity – what might the OS be like that grew ZFS?<br>
Also the Ravenports project that I participate in planned to support Solaris/Illumos right from the beginning. I wanted to at least be somewhat “prepared” when support for that platform would finally land. So I did a little research on the various derivatives available and settled on the one that I had heard a talk about at last year’s conference of the German Unix Users Group: “OmniOS – Solaris for the Rest of Us”. I would have chosen SmartOS as I admire what Bryan Cantrill does but for getting to know Illumos I prefer a traditional installation over a run-from-RAM system.<br>
Of course FreeBSD is not run by corporations, especially when compared to the state of Linux. And when it comes to sponsoring, OpenBSD also takes the money… When it comes to FreeBSD developers, there’s probably some truth to the claim that some of them are using macOS as their desktop systems while OpenBSD devs are more likely to develop on their OS of choice. But then there’s the statement that “every innovation in the past decade comes from Solaris”. Bhyve alone proves this wrong. But let’s be honest: Two of the major technologies that make FreeBSD a great platform today – ZFS and DTrace – actually do come from Solaris. PAM originates there and a more modern way of managing services as well. Also you hear good things about their zones and a lot of small utilities in general.<br>
In the end it was a lack of time that made me cheat and go down the easiest road: Create a Vagrantfile and just pull a VM image of the net that someone else had prepared… This worked to just make sure that the Raven packages work on OmniOS. I was determined to return, though – someday. You know how things go: “someday” is a pretty common alias for “probably never, actually.”<br>
But then I heard about a forum post on the BSDNow! podcast. The title “Initial OmniOS impressions by a BSD user” caught my attention. I read that it was written by somebody who had used FreeBSD for years but loathed the new Code of Conduct enough to leave. I also oppose the Conduct and have made that pretty clear in my February post [ ! -z ${COC} ] &amp;&amp; exit 1. As stated there, I have stayed with my favorite OS and continue to advocate it. I decided to stop reading the post and try things out on my own instead. Now I’ve finally found the time to do so.</p>
</blockquote>

<ul>
<li>What’s next?</li>
</ul>

<blockquote>
<p>That’s it for part one. In part two I’ll try to make the system useful. So far I have run into a problem that I haven’t been able to solve. But I have some time now to figure things out for the next post. Let’s see if I manage to get it working or if I have to report failure!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://wiki.freebsd.org/Memory">What are all these types of memory in top(1)?</a></p>

<ul>
<li>Earlier this week I convinced Mark Johnston, one of the FreeBSD VM experts to update a page on the FreeBSD wiki that I saw was being referenced on stackoverflow and similar sites</li>
<li>Mark updated the explanations to be more correct, and to include more technical detail for inquiring minds</li>
<li>He also added the new type that appeared in FreeBSD somewhat recently</li>
</ul>

<blockquote>
<p>Active - Contains memory “actively” (recently) being used by applications<br>
Inactive - Contains memory that has not been touched recently, or was released from the Buffer Cache<br>
Laundry - Contains memory that Inactive but still potentially contains useful data that needs to be stored before this memory can be used again<br>
Wired - Memory that cannot be swapped out, including the kernel, network stack, and the ZFS ARC<br>
Buf - Buffer Cache, used my UFS and most filesystems except ZFS (which uses the ARC)<br>
Free - Memory that is immediately available for use by the rest of the system</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://nanxiao.me/en/openbsd-saves-me-again-debug-a-memory-corruption-issue/">OpenBSD saves me again! — Debug a memory corruption issue</a></p>

<blockquote>
<p>Yesterday, I came across a third-part library issue, which crashes at allocating memory:</p>
</blockquote>

<p><code>Program terminated with signal SIGSEGV, Segmentation fault.</code><br>
<code>#0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6</code><br>
<code>(gdb) bt</code><br>
<code>#0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6</code><br>
<code>#1 0x00007f594a5ab503 in malloc () from /usr/lib/libc.so.6</code><br>
<code>#2 0x00007f594b13f159 in operator new (sz=5767168) at /build/gcc/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50</code></p>

<blockquote>
<p>It is obvious that the memory tags are corrupted, but who is the murder? Since the library involves a lot of maths computation, it is not an easy task to grasp the code quickly. So I need to find another way:<br>
(1) Open all warnings during compilation: -Wall. Nothing found.<br>
(2) Use valgrind, but unfortunately, valgrind crashes itself:</p>
</blockquote>

<p><code>valgrind: the 'impossible' happened:</code><br>
<code>Killed by fatal signal</code><br>
<code></code><br>
<code>host stacktrace:</code><br>
<code>==43326== at 0x58053139: get_bszB_as_is (m_mallocfree.c:303)</code><br>
<code>==43326== by 0x58053139: get_bszB (m_mallocfree.c:315)</code><br>
<code>==43326== by 0x58053139: vgPlain_arena_malloc (m_mallocfree.c:1799)</code><br>
<code>==43326== by 0x5800BA84: vgMemCheck_new_block (mc_malloc_wrappers.c:372)</code><br>
<code>==43326== by 0x5800BD39: vgMemCheck___builtin_vec_new (mc_malloc_wrappers.c:427)</code><br>
<code>==43326== by 0x5809F785: do_client_request (scheduler.c:1866)</code><br>
<code>==43326== by 0x5809F785: vgPlain_scheduler (scheduler.c:1433)</code><br>
<code>==43326== by 0x580AED50: thread_wrapper (syswrap-linux.c:103)</code><br>
<code>==43326== by 0x580AED50: run_a_thread_NORETURN (syswrap-linux.c:156)</code><br>
<code></code><br>
<code>sched status:</code><br>
<code>running_tid=1</code></p>

<blockquote>
<p>(3) Change compiler, use clang instead of gcc, and hope it can give me some clues. Still no effect.<br>
(4) Switch Operating System from Linux to OpenBSD, the program crashes again. But this time, it tells me where the memory corruption occurs:</p>
</blockquote>

<p><code>Program terminated with signal SIGSEGV, Segmentation fault.</code><br>
<code>#0 0x000014b07f01e52d in addMod (r=&lt;error reading variable&gt;, a=4693443247995522, b=28622907746665631,</code></p>

<blockquote>
<p>I figure out the issue quickly, and not bother to understand the whole code. OpenBSD saves me again, thanks!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070832.html">Native Encryption for ZFS on FreeBSD (Call for Testing)</a></p>

<blockquote>
<p>To anyone with an interest in native encryption in ZFS please test the projects/zfs-crypto-merge-0820 branch in my freebsd repo: <a href="https://github.com/mattmacy/networking.git">https://github.com/mattmacy/networking.git</a></p>
</blockquote>

<p><code>git clone https://github.com/mattmacy/networking.git -b projects/zfs-crypto-merge-0820</code></p>

<blockquote>
<p>The UI is quite close to the Oracle Solaris ZFS crypto with minor differences for specifying key location.<br>
Please note that once a feature is enabled on a pool it can’t be disabled. This means that if you enable encryption support on a pool you will never be able to import it in to a ZFS without encryption support. For this reason I would strongly advise against using this on any pool that can’t be easily replaced until this change has made its way in to HEAD after the freeze has been lifted.<br>
By way of background the original ZoL commit can be found at:</p>
</blockquote>

<ul>
<li><a href="https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49">https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49</a></li>
</ul>

<p><hr></p>

<p>###<a href="https://www.ixsystems.com/blog/vmworld2018/">VMworld 2018: Showcasing Hybrid Cloud, Persistent Memory and the Asigra TrueNAS Backup Appliance</a></p>

<blockquote>
<p>During its last year in Las Vegas before moving back to San Francisco, VMworld was abuzz with all the popular buzzwords, but the key focus was on supporting a more agile approach to hybrid cloud.<br>
Surveys of IT stakeholders and analysts agree that most businesses have multiple clouds spanning both public cloud providers and private data centers. While the exact numbers vary, well over half of businesses have a hybrid cloud strategy consisting of at least three different clouds.<br>
This focus on hybrid cloud provided the perfect timing for our announcement that iXsystems and Asigra are partnering to deliver the Asigra TrueNAS Backup Appliance, which combines Asigra Cloud Backup software backed by TrueNAS storage. Asigra TrueNAS Backup Appliances provide a self-healing and ransomware-resistent OpenZFS backup repository in your private cloud. The appliance can simultaneously be used as general-purpose file, block, and object storage. How does this tie in with the hybrid cloud? The Asigra Cloud Backup software can backup data from public cloud repositories – G Suite, Office 365, Salesforce, etc. – as well as intelligently move backed-up data to the public cloud for long-term retention.<br>
Another major theme at the technical sessions was persistent memory, as vSphere 6.7 added support for persistent memory – either as a storage tier or virtualized and presented to a guest OS. As detailed in our blog post from SNIA’s Persistent Memory Summit 2018, persistent memory is rapidly becoming mainstream. Persistent memory bridges the gap between memory and flash storage – providing near-memory latency storage that persists across reboots or power loss. vSphere allows both legacy and persistent memory-aware applications to leverage this ultra-fast storage tier. We were excited to show off our newly-introduced TrueNAS M-Series at VMworld, as all TrueNAS M40 and M50 models leverage NVDIMM persistent memory technology to provide a super-fast write cache, or SLOG, without any of the limitations of Flash technology.<br>
The iXsystems booth’s theme was “Enterprise Storage, Open Source Economics”. iXsystems leverages the power of Open Source software, combined with our enterprise-class hardware and support, to provide incredibly low TCO storage for virtualization environments. Our TrueNAS unified storage and server offerings are an ideal solution for your organization’s private cloud infrastructure. Combined with VMware NSX Hybrid Connect – formerly known as VMware Hybrid Cloud Extension – you can seamlessly shift running systems into a public cloud environment for a true hybrid cloud solution.<br>
Another special treat at this year’s booth was iXsystems Vice President of Engineering Kris Moore giving demos of an early version of “Project TrueView”, a single-pane of glass management solution for administration of multiple FreeNAS and TrueNAS systems. In addition to simplified administration and enhanced monitoring, Project TrueView will also provide Role-Based Access Control for finer-grained permissions management. A beta version of Project TrueView is expected to be available at the end of this year.<br>
Overall, we had a great week at VMworld 2018 with lots of good conversations with customers, press, analysts, and future customers about TrueNAS, the Asigra TrueNAS Backup Appliance, iXsystems servers, Project TrueView, and more – our booth was more popular than ever!</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/end_of_life_for_netbsd1">End of life for NetBSD 6.x</a></p>

<blockquote>
<p>In keeping with NetBSD’s policy of supporting only the latest (8.x) and next most recent (7.x) major branches, the recent release of NetBSD 8.0 marks the end of life for NetBSD 6.x. As in the past, a month of overlapping support has been provided in order to ease the migration to newer releases.</p>
</blockquote>

<ul>
<li>
<p>As of now, the following branches are no longer maintained:</p>
</li>
<li>
<p>netbsd-6-1</p>
</li>
<li>
<p>netbsd-6-0</p>
</li>
<li>
<p>netbsd-6</p>
</li>
<li>
<p>This means:</p>
</li>
<li>
<p>There will be no more pullups to those branches (even for security issues)</p>
</li>
<li>
<p>There will be no security advisories made for any those branches</p>
</li>
<li>
<p>The existing 6.x releases on <a href="http://ftp.NetBSD.org">ftp.NetBSD.org</a> will be moved into /pub/NetBSD-archive/</p>
</li>
<li>
<p>May NetBSD 8.0 serve you well! (And if it doesn’t, please submit a PR!)</p>
</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://imgur.com/a/fkzTwYm">Blast from the past: OpenBSD 3.7 CD artwork</a></li>
<li><a href="https://twitter.com/romanzolotarev/status/1030345831751270400">People are asking about scale of BSD projects. Let’s figure it out…</a></li>
<li><a href="https://mwl.io/archives/3642">Tuesday, 21 August 18: me, on ed(1), at SemiBUG</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180813133939">arm64 gains RETGUARD</a></li>
<li><a href="https://fosdem.org/2019/news/2018-08-10-call-for-participation/">Call for participation</a></li>
<li><a href="https://github.com/FreeBSD-UPB/bhyvearm64-utils">FreeBSD-UPB/bhyvearm64-utils</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Eric - <a href="http://dpaste.com/2GY2S6T#wrap">FreeNAS for Vacation</a></li>
<li>Patrick - <a href="http://dpaste.com/347WCR3">Long Live Unix</a></li>
<li>Jason - <a href="http://dpaste.com/1B7E8F5#wrap">Jason - Full MP3 Recordings</a></li>
<li>Bostjan - <a href="http://dpaste.com/34AQNSE#wrap">Question about jails and kernel</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 262: OpenBSD Surfacing | BSD Now 262</title>
  <link>https://www.bsdnow.tv/262</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2521</guid>
  <pubDate>Thu, 06 Sep 2018 05:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6aa244ea-c5e6-4c69-b8a9-aac9c652d4e1.mp3" length="44187309" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD on Microsoft Surface Go, FreeBSD Foundation August Update, What’s taking so long with Project Trident, pkgsrc config file versioning, and MacOS remnants in ZFS code.</itunes:subtitle>
  <itunes:duration>1:13:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD on Microsoft Surface Go, FreeBSD Foundation August Update, What’s taking so long with Project Trident, pkgsrc config file versioning, and MacOS remnants in ZFS code.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://jcs.org/2018/08/31/surface_go"&gt;OpenBSD on the Microsoft Surface Go&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;For some reason I like small laptops and the constraints they place on me (as long as they’re still usable). I used a Dell Mini 9 for a long time back in the netbook days and was recently using an 11" MacBook Air as my primary development machine for many years. Recently Microsoft announced a smaller, cheaper version of its Surface tablets called Surface Go which piqued my interest.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Hardware&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The Surface Go is available in two hardware configurations: one with 4Gb of RAM and a 64Gb eMMC, and another with 8Gb of RAM with a 128Gb NVMe SSD. (I went with the latter.) Both ship with an Intel Pentium Gold 4415Y processor which is not very fast, but it’s certainly usable.&lt;br&gt;
The tablet measures 9.65" across, 6.9" tall, and 0.3" thick. Its 10" diagonal 3:2 touchscreen is covered with Gorilla Glass and has a resolution of 1800x1200. The bezel is quite large, especially for such a small screen, but it makes sense on a device that is meant to be held, to avoid accidental screen touches.&lt;br&gt;
The keyboard and touchpad are located on a separate, removable slab called the Surface Go Signature Type Cover which is sold separately. I opted for the “cobalt blue” cover which has a soft, cloth-like alcantara material. The cover attaches magnetically along the bottom edge of the device and presents USB-attached keyboard and touchpad devices. When the cover is folded up against the screen, it sends an ACPI sleep signal and is held to the screen magnetically. During normal use, the cover can be positioned flat on a surface or slightly raised up about 3/4" near the screen for better ergonomics. When using the device as a tablet, the cover can be rotated behind the screen which causes it to automatically stop sending keyboard and touchpad events until it is rotated back around.&lt;br&gt;
The keyboard has a decent amount of key travel and a good layout, with Home/End/Page Up/Page Down being accessible via Fn+Left/Right/Up/Down but also dedicated Home/End/Page Up/Page Down keys on the F9-F12 keys which I find quite useful since the keyboard layout is somewhat small. By default, the F1-F12 keys do not send F1-F12 key codes and Fn must be used, either held down temporarily or Fn pressed by itself to enable Fn-lock which annoyingly keeps the bright Fn LED illuminated. The keys are backlit with three levels of adjustment, handled by the keyboard itself with the F7 key.&lt;br&gt;
The touchpad on the Type Cover is a Windows Precision Touchpad connected via USB HID. It has a decent click feel but when the cover is angled up instead of flat on a surface, it sounds a bit hollow and cheap.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Surface Go Pen&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The touchscreen is powered by an Elantech chip connected via HID-over-i2c, which also supports pen input. A Surface Pen digitizer is available separately from Microsoft and comes in the same colors as the Type Covers. The pen works without any pairing necessary, though the top button on it works over Bluetooth so it requires pairing to use. Either way, the pen requires an AAAA battery inside it to operate. The Surface Pen can attach magnetically to the left side of the screen when not in use.&lt;br&gt;
A kickstand can swing out behind the display to use the tablet in a laptop form factor, which can adjust to any angle up to about 170 degrees. The kickstand stays firmly in place wherever it is positioned, which also means it requires a bit of force to pull it out when initially placing the Surface Go on a desk.&lt;br&gt;
Along the top of the display are a power button and physical volume rocker buttons. Along the right side are the 3.5mm headphone jack, USB-C port, power port, and microSD card slot located behind the kickstand.&lt;br&gt;
Charging can be done via USB-C or the dedicated charge port, which accommodates a magnetically-attached, thin barrel similar to Apple’s first generation MagSafe adapter. The charging cable has a white LED that glows when connected, which is kind of annoying since it’s near the mid-line of the screen rather than down by the keyboard. Unlike Apple’s MagSafe, the indicator light does not indicate whether the battery is charged or not. The barrel charger plug can be placed up or down, but in either direction I find it puts an awkward strain on the power cable coming out of it due to the vertical position of the port.&lt;br&gt;
Wireless connectivity is provided by a Qualcomm Atheros QCA6174 802.11ac chip which also provides Bluetooth connectivity.&lt;br&gt;
Most of the sensors on the device such as the gyroscope and ambient light sensor are connected behind an Intel Sensor Hub PCI device, which provides some power savings as the host CPU doesn’t have to poll the sensors all the time.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Firmware&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The Surface Go’s BIOS/firmware menu can be entered by holding down the Volume Up button, then pressing and releasing the Power button, and releasing Volume Up when the menu appears. Secure Boot as well as various hardware components can be disabled in this menu. Boot order can also be adjusted. A temporary boot menu can be brought up the same way but using Volume Down instead.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-august-2018/"&gt;FreeBSD Foundation Update, August 2018&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;MESSAGE FROM THE EXECUTIVE DIRECTOR&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Dear FreeBSD Community Member,&lt;br&gt;
It’s been a busy summer for the Foundation. From traveling around the globe spreading the word about FreeBSD to bringing on new team members to improve the Project’s Continuous Integration work, we’re very excited about what we’ve accomplished. Take a minute to check out the latest updates within our Foundation sponsored projects; read more about our advocacy efforts in Bangladesh and community building in Cambridge; don’t miss upcoming Travel Grant deadlines, and new Developer Summits; and be sure to find out how your support will ensure our progress continues into 2019.&lt;br&gt;
We can’t do this without you! Happy reading!! Deb&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;August 2018 Development Projects Update&lt;/li&gt;
&lt;li&gt;Fundraising Update: Supporting the Project&lt;/li&gt;
&lt;li&gt;August 2018 Release Engineering Update&lt;/li&gt;
&lt;li&gt;BSDCam 2018 Recap&lt;/li&gt;
&lt;li&gt;October 2018 FreeBSD Developer Summit Call for Participation&lt;/li&gt;
&lt;li&gt;SANOG32 and COSCUP 2018 Recap&lt;/li&gt;
&lt;li&gt;MeetBSD 2018 Travel Grant Application Deadline: September 7&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="http://project-trident.org/post/2018-09-04_what_is_taking_so_long/"&gt;Project Trident: What’s taking so long?&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;What is taking so long?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The short answer is that it’s complicated.&lt;br&gt;
Project Trident is quite literally a test of the new TrueOS build system. As expected, there have been quite a few bugs, undocumented features, and other optional bits that we discovered we needed that were not initially present. All of these things have to be addressed and retested in a constant back and forth process.&lt;br&gt;
While Ken and JT are both experienced developers, neither has done this kind of release engineering before. JT has done some release engineering back in his Linux days, but the TrueOS and FreeBSD build system is very different. Both Ken and JT are learning a completely new way of building a FreeBSD/TrueOS distribution. Please keep in mind that no one has used this new TrueOS build system before, so Ken and JT want to not only provide a good Trident release, but also provide a model or template for other potential TrueOS distributions too!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Where are we now?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Through perseverance, trial and error, and a lot of head-scratching we have reached the point of having successful builds. It took a while to get there, but now we are simply working out a few bugs with the new installer that Ken wrote as well as finding and fixing all the new Xorg configuration options which recently landed in FreeBSD. We also found that a number of services have been removed or replaced between TrueOS 18.03 and 18.06 so we are needing to adjust what we consider the “base” services for the desktop. All of these issues are being resolved and we are continually rebuilding and pulling in new patches from TrueOS as soon as they are committed.&lt;br&gt;
In the meantime we have made an early BETA release of Trident available to the users in our Telegram Channel for those who want to help out in testing these early versions.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Do you foresee any other delays?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;At the moment we are doing many iterations of testing and tweaking the install ISO and package configurations in order to ensure that all the critical functionality works out-of-box (networking, sound, video, basic apps, etc). While we do not foresee any other major delays, sometimes things happen that our outside of our control. For an example, one of the recent delays that hit recently was completely unexpected: we had a hard drive failure on our build server. Up until recently, The aptly named “Poseidon” build server was running a Micron m500dc drive, but that drive is now constantly reporting errors. Despite ordering a replacement Western Digital Blue SSD several weeks ago, we just received it this past week. The drive is now installed with the builder back to full functionality, but we did lose many precious days with the delay.&lt;br&gt;
The build server for Project Trident is very similar to the one that JT donated to the TrueOS project. JT had another DL580 G7, so he donated one to the Trident Project for their build server. Poseidon also has 256GB RAM (64 x 4GB sticks) which is a smidge higher than what the TrueOS builder has.&lt;br&gt;
Since we are talking about hardware, we probably should address another question we get often, “What Hardware are the devs testing on?” So let’s go ahead and answer that one now.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Developer Hardware&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;JT: His main test box is a custom-built Intel i7 7700K system running 32GB RAM, dual Intel Optane 900P drives, and an Nvidia 1070 GTX with four 4K Acer Monitors. He also uses a Lenovo x250 ThinkPad alongside a desk full of x230t and x220 ThinkPads. One of which he gave away at SouthEast LinuxFest this year, which you can read about here.  However it’s not done there, being a complete hardware hoarder, JT also tests on several Intel NUCs and his second laptop a Fujitsu t904, not to mention a Plethora of HP DL580 servers, a DL980 server, and a stack of BL485c, BL460c, and BL490c Blades in his HP c7000 and c3000 Bladecenter chassis. (Maybe it’s time for an intervention for his hardware collecting habits)&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Ken: For a laptop, he primarily uses a 3rd generation X1 Carbon, but also has an old Eee PC T101MT Netbook (dual core 1GHz, 2GB of memory) which he uses for verifying how well Trident works on low-end hardware. As far as workstations go, his office computer is an Intel i7 with an NVIDIA Geforce GTX 960 running three 4K monitors and he has a couple other custom-built workstations (1 AMD, 1 Intel+NVIDIA) at his home. Generally he assembled random workstations based on hardware that was given to him or that he could acquire cheap.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Tim: is using a third gen X1 Carbon and a custom built desktop with an Intel Core i5-4440 CPU, 16 GiB RAM, Nvidia GeForce GTX 750 Ti, and a RealTek 8168 / 8111 network card.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Rod: Rod uses… No one knows what Rod uses, It’s kinda like how many licks does it take to get to the center of a Tootsie-Roll Tootsie-Pop… the world may just never know.&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###NetBSD GSoC: pkgsrc config file versioning&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;A series of reports from the course of the summer on this Google Summer of Code project&lt;/li&gt;
&lt;li&gt;The goal of the project is to integrate with a VCS (Version Control System) to make managing local changes to config files for packages easier&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files"&gt;GSoC 2018 Reports: Configuration files versioning in pkgsrc, Part 1&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Packages may install code (both machine executable code and interpreted programs), documentation and manual pages, source headers, shared libraries and other resources such as graphic elements, sounds, fonts, document templates, translations and configuration files, or a combination of them.&lt;br&gt;
Configuration files are usually the means through which the behaviour of software without a user interface is specified. This covers parts of the operating systems, network daemons and programs in general that don’t come with an interactive graphical or textual interface as the principal mean for setting options.&lt;br&gt;
System wide configuration for operating system software tends to be kept under /etc, while configuration for software installed via pkgsrc ends up under LOCALBASE/etc (e.g., /usr/pkg/etc).&lt;br&gt;
Software packaged as part of pkgsrc provides example configuration files, if any, which usually get extracted to LOCALBASE/share/examples/PKGBASE/.&lt;br&gt;
Don’t worry: automatic merging is disabled by default, set $VCSAUTOMERGE to enable it.&lt;br&gt;
In order to avoid breakage, installed configuration is backed up first in the VCS, separating user-modified files from files that have been already automatically merged in the past, in order to allow the administrator to easily restore the last manually edited file in case of breakage.&lt;br&gt;
VCS functionality only applies to configuration files, not to rc.d scripts, and only if the environment variable $NOVCS is unset.&lt;br&gt;
The version control system to be used as a backend can be set through $VCS. It default to RCS, the Revision Control System, which works only locally and doesn’t support atomic transactions.&lt;br&gt;
Other backends such as CVS are supported and more will come; these, being used at the explicit request of the administrator, need to be already installed and placed in a directory part of $PATH.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files1"&gt;GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 2: remote repositories (git and CVS)&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;pkgsrc is now able to deploy configuration from packages being installed from a remote, site-specific vcs repository.&lt;br&gt;
User modified files are always tracked even if automerge functionality is not enabled, and a new tool, pkgconftrack(1), exists to manually store user changes made outside of package upgrade time.&lt;br&gt;
Version Control software is executed as the same user running pkgadd or make install, unless the user is “root”. In this case, a separate, unprivileged user, pkgvcsconf, gets created with its own home directory and a working login shell (but no password). The home directory is not strictly necessary, it exists to facilitate migrations betweens repositories and vcs changes; it also serves to store keys used to access remote repositories.&lt;br&gt;
Using git instead of rcs is simply done by setting VCS=git in pkginstall.conf&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files2"&gt;GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 3: remote repositories (SVN and Mercurial)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files3"&gt;GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 4: configuration deployment, pkgtools and future improvements&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Support for configuration tracking is in scripts, pkginstall scripts, that get built into binary packages and are run by pkgadd upon installation. The idea behind the proposal suggested that users of the new feature should be able to store revisions of their installed configuration files, and of package-provided default, both in local or remote repositories. With this capability in place, it doesn’t take much to make the scripts “pull” configuration from a VCS repository at installation time.&lt;br&gt;
That’s what setting VCSCONFPULL=yes in pkginstall.conf after having enabled VCSTRACKCONF does: You are free to use official, third party prebuilt packages that have no customization in them, enable these options, and point pkgsrc to a private conf repository. If it contains custom configuration for the software you are installing, an attempt will be made to use it and install it on your system. If it fails, pkginstall will fall back to using the defaults that come inside the package. RC scripts are always deployed from the binary package, if existing and PKGRCDSCRIPTS=yes in pkginstall.conf or the environment.&lt;br&gt;
This will be part of packages, not a separate solution like configuration management tools. It doesn’t support running scripts on the target system to customize the installation, it doesn’t come with its domain-specific language, it won’t run as a daemon or require remote logins to work. It’s quite limited in scope, but you can define a ROLE for your system in pkginstall.conf or in the environment, and pkgsrc will look for configuration you or your organization crafted for such a role (e.g., public, standalone webserver vs reverse proxy or node in a database cluster)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSDTypeAndMacOS"&gt;A little bit of the one-time MacOS version still lingers in ZFS&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Once upon a time, Apple came very close to releasing ZFS as part of MacOS. Apple did this work in its own copy of the ZFS source base (as far as I know), but the people in Sun knew about it and it turns out that even today there is one little lingering sign of this hoped-for and perhaps prepared-for ZFS port in the ZFS source code. Well, sort of, because it’s not quite in code.&lt;br&gt;
Lurking in the function that reads ZFS directories to turn (ZFS) directory entries into the filesystem independent format that the kernel wants is the following comment:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;objnum = ZFSDIRENTOBJ(zap.zafirstinteger);&lt;/code&gt;&lt;br&gt;
&lt;code&gt;/&lt;/code&gt;&lt;br&gt;
&lt;code&gt; MacOS X can extract the object type here such as:&lt;/code&gt;&lt;br&gt;
&lt;code&gt;* uint8t type = ZFSDIRENTTYPE(zap.zafirstinteger);&lt;/code&gt;&lt;br&gt;
&lt;code&gt;*/&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Specifically, this is in zfsreaddir in zfsvnops.c .&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;ZFS maintains file type information in directories. This information can’t be used on Solaris (and thus Illumos), where the overall kernel doesn’t have this in its filesystem independent directory entry format, but it could have been on MacOS (‘Darwin’), because MacOS is among the Unixes that support d_type. The comment itself dates all the way back to this 2007 commit, which includes the change ‘reserve bits in directory entry for file type’, which created the whole setup for this.&lt;br&gt;
I don’t know if this file type support was added specifically to help out Apple’s MacOS X port of ZFS, but it’s certainly possible, and in 2007 it seems likely that this port was at least on the minds of ZFS developers. It’s interesting but understandable that FreeBSD didn’t seem to have influenced them in the same way, at least as far as comments in the source code go; this file type support is equally useful for FreeBSD, and the FreeBSD ZFS port dates to 2007 too (per this announcement).&lt;br&gt;
Regardless of the exact reason that ZFS picked up maintaining file type information in directory entries, it’s quite useful for people on both FreeBSD and Linux that it does so. File type information is useful for any number of things and ZFS filesystems can (and do) provide this information on those Unixes, which helps make ZFS feel like a truly first class filesystem, one that supports all of the expected general system features.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="http://trafyx.com/?p=2551"&gt;Mac-like FreeBSD Laptop&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/08/21/syncthing-on-freebsd/"&gt;Syncthing on FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vermaden.wordpress.com/2018/08/24/new-zfs-boot-environments-tool/"&gt;New ZFS Boot Environments Tool&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://anadoxin.org/blog/my-systems-time-was-so-wrong-that-even-ntpd-didnt-work.html"&gt;My system’s time was so wrong, that even ntpd didn’t work&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.openssh.com/releasenotes.html#7.8"&gt;OpenSSH 7.8/7.8p1 (2018-08-24)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://2018.eurobsdcon.org/registration/"&gt;EuroBSD (Sept 20-23rd) registration Early Bird Period is coming to an end&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.meetbsd.com/"&gt;MeetBSD (Oct 18-20th) is coming up fast, hurry up and register!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://2019.asiabsdcon.org/"&gt;AsiaBSDcon 2019 Dates&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Will - &lt;a href="http://dpaste.com/2EQMHXV"&gt;Kudos and a Question&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Peter - &lt;a href="http://dpaste.com/2N6DC6P#wrap"&gt;Fanless Computers&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Ron - &lt;a href="http://dpaste.com/0MRG11V#wrap"&gt;ZFS disk clone or replace or something&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Bostjan - &lt;a href="http://dpaste.com/16B1WDB"&gt;ZFS Record Size&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD on Microsoft Surface Go, FreeBSD Foundation August Update, What’s taking so long with Project Trident, pkgsrc config file versioning, and MacOS remnants in ZFS code.</p>

<p>##Headlines<br>
###<a href="https://jcs.org/2018/08/31/surface_go">OpenBSD on the Microsoft Surface Go</a></p>

<blockquote>
<p>For some reason I like small laptops and the constraints they place on me (as long as they’re still usable). I used a Dell Mini 9 for a long time back in the netbook days and was recently using an 11&quot; MacBook Air as my primary development machine for many years. Recently Microsoft announced a smaller, cheaper version of its Surface tablets called Surface Go which piqued my interest.</p>
</blockquote>

<ul>
<li>Hardware</li>
</ul>

<blockquote>
<p>The Surface Go is available in two hardware configurations: one with 4Gb of RAM and a 64Gb eMMC, and another with 8Gb of RAM with a 128Gb NVMe SSD. (I went with the latter.) Both ship with an Intel Pentium Gold 4415Y processor which is not very fast, but it’s certainly usable.<br>
The tablet measures 9.65&quot; across, 6.9&quot; tall, and 0.3&quot; thick. Its 10&quot; diagonal 3:2 touchscreen is covered with Gorilla Glass and has a resolution of 1800x1200. The bezel is quite large, especially for such a small screen, but it makes sense on a device that is meant to be held, to avoid accidental screen touches.<br>
The keyboard and touchpad are located on a separate, removable slab called the Surface Go Signature Type Cover which is sold separately. I opted for the “cobalt blue” cover which has a soft, cloth-like alcantara material. The cover attaches magnetically along the bottom edge of the device and presents USB-attached keyboard and touchpad devices. When the cover is folded up against the screen, it sends an ACPI sleep signal and is held to the screen magnetically. During normal use, the cover can be positioned flat on a surface or slightly raised up about 3/4&quot; near the screen for better ergonomics. When using the device as a tablet, the cover can be rotated behind the screen which causes it to automatically stop sending keyboard and touchpad events until it is rotated back around.<br>
The keyboard has a decent amount of key travel and a good layout, with Home/End/Page Up/Page Down being accessible via Fn+Left/Right/Up/Down but also dedicated Home/End/Page Up/Page Down keys on the F9-F12 keys which I find quite useful since the keyboard layout is somewhat small. By default, the F1-F12 keys do not send F1-F12 key codes and Fn must be used, either held down temporarily or Fn pressed by itself to enable Fn-lock which annoyingly keeps the bright Fn LED illuminated. The keys are backlit with three levels of adjustment, handled by the keyboard itself with the F7 key.<br>
The touchpad on the Type Cover is a Windows Precision Touchpad connected via USB HID. It has a decent click feel but when the cover is angled up instead of flat on a surface, it sounds a bit hollow and cheap.</p>
</blockquote>

<ul>
<li>Surface Go Pen</li>
</ul>

<blockquote>
<p>The touchscreen is powered by an Elantech chip connected via HID-over-i2c, which also supports pen input. A Surface Pen digitizer is available separately from Microsoft and comes in the same colors as the Type Covers. The pen works without any pairing necessary, though the top button on it works over Bluetooth so it requires pairing to use. Either way, the pen requires an AAAA battery inside it to operate. The Surface Pen can attach magnetically to the left side of the screen when not in use.<br>
A kickstand can swing out behind the display to use the tablet in a laptop form factor, which can adjust to any angle up to about 170 degrees. The kickstand stays firmly in place wherever it is positioned, which also means it requires a bit of force to pull it out when initially placing the Surface Go on a desk.<br>
Along the top of the display are a power button and physical volume rocker buttons. Along the right side are the 3.5mm headphone jack, USB-C port, power port, and microSD card slot located behind the kickstand.<br>
Charging can be done via USB-C or the dedicated charge port, which accommodates a magnetically-attached, thin barrel similar to Apple’s first generation MagSafe adapter. The charging cable has a white LED that glows when connected, which is kind of annoying since it’s near the mid-line of the screen rather than down by the keyboard. Unlike Apple’s MagSafe, the indicator light does not indicate whether the battery is charged or not. The barrel charger plug can be placed up or down, but in either direction I find it puts an awkward strain on the power cable coming out of it due to the vertical position of the port.<br>
Wireless connectivity is provided by a Qualcomm Atheros QCA6174 802.11ac chip which also provides Bluetooth connectivity.<br>
Most of the sensors on the device such as the gyroscope and ambient light sensor are connected behind an Intel Sensor Hub PCI device, which provides some power savings as the host CPU doesn’t have to poll the sensors all the time.</p>
</blockquote>

<ul>
<li>Firmware</li>
</ul>

<blockquote>
<p>The Surface Go’s BIOS/firmware menu can be entered by holding down the Volume Up button, then pressing and releasing the Power button, and releasing Volume Up when the menu appears. Secure Boot as well as various hardware components can be disabled in this menu. Boot order can also be adjusted. A temporary boot menu can be brought up the same way but using Volume Down instead.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-august-2018/">FreeBSD Foundation Update, August 2018</a></p>

<ul>
<li>MESSAGE FROM THE EXECUTIVE DIRECTOR</li>
</ul>

<blockquote>
<p>Dear FreeBSD Community Member,<br>
It’s been a busy summer for the Foundation. From traveling around the globe spreading the word about FreeBSD to bringing on new team members to improve the Project’s Continuous Integration work, we’re very excited about what we’ve accomplished. Take a minute to check out the latest updates within our Foundation sponsored projects; read more about our advocacy efforts in Bangladesh and community building in Cambridge; don’t miss upcoming Travel Grant deadlines, and new Developer Summits; and be sure to find out how your support will ensure our progress continues into 2019.<br>
We can’t do this without you! Happy reading!! Deb</p>
</blockquote>

<ul>
<li>August 2018 Development Projects Update</li>
<li>Fundraising Update: Supporting the Project</li>
<li>August 2018 Release Engineering Update</li>
<li>BSDCam 2018 Recap</li>
<li>October 2018 FreeBSD Developer Summit Call for Participation</li>
<li>SANOG32 and COSCUP 2018 Recap</li>
<li>MeetBSD 2018 Travel Grant Application Deadline: September 7</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="http://project-trident.org/post/2018-09-04_what_is_taking_so_long/">Project Trident: What’s taking so long?</a></p>

<ul>
<li>What is taking so long?</li>
</ul>

<blockquote>
<p>The short answer is that it’s complicated.<br>
Project Trident is quite literally a test of the new TrueOS build system. As expected, there have been quite a few bugs, undocumented features, and other optional bits that we discovered we needed that were not initially present. All of these things have to be addressed and retested in a constant back and forth process.<br>
While Ken and JT are both experienced developers, neither has done this kind of release engineering before. JT has done some release engineering back in his Linux days, but the TrueOS and FreeBSD build system is very different. Both Ken and JT are learning a completely new way of building a FreeBSD/TrueOS distribution. Please keep in mind that no one has used this new TrueOS build system before, so Ken and JT want to not only provide a good Trident release, but also provide a model or template for other potential TrueOS distributions too!</p>
</blockquote>

<ul>
<li>Where are we now?</li>
</ul>

<blockquote>
<p>Through perseverance, trial and error, and a lot of head-scratching we have reached the point of having successful builds. It took a while to get there, but now we are simply working out a few bugs with the new installer that Ken wrote as well as finding and fixing all the new Xorg configuration options which recently landed in FreeBSD. We also found that a number of services have been removed or replaced between TrueOS 18.03 and 18.06 so we are needing to adjust what we consider the “base” services for the desktop. All of these issues are being resolved and we are continually rebuilding and pulling in new patches from TrueOS as soon as they are committed.<br>
In the meantime we have made an early BETA release of Trident available to the users in our Telegram Channel for those who want to help out in testing these early versions.</p>
</blockquote>

<ul>
<li>Do you foresee any other delays?</li>
</ul>

<blockquote>
<p>At the moment we are doing many iterations of testing and tweaking the install ISO and package configurations in order to ensure that all the critical functionality works out-of-box (networking, sound, video, basic apps, etc). While we do not foresee any other major delays, sometimes things happen that our outside of our control. For an example, one of the recent delays that hit recently was completely unexpected: we had a hard drive failure on our build server. Up until recently, The aptly named “Poseidon” build server was running a Micron m500dc drive, but that drive is now constantly reporting errors. Despite ordering a replacement Western Digital Blue SSD several weeks ago, we just received it this past week. The drive is now installed with the builder back to full functionality, but we did lose many precious days with the delay.<br>
The build server for Project Trident is very similar to the one that JT donated to the TrueOS project. JT had another DL580 G7, so he donated one to the Trident Project for their build server. Poseidon also has 256GB RAM (64 x 4GB sticks) which is a smidge higher than what the TrueOS builder has.<br>
Since we are talking about hardware, we probably should address another question we get often, “What Hardware are the devs testing on?” So let’s go ahead and answer that one now.</p>
</blockquote>

<ul>
<li>
<p>Developer Hardware</p>
</li>
<li>
<p>JT: His main test box is a custom-built Intel i7 7700K system running 32GB RAM, dual Intel Optane 900P drives, and an Nvidia 1070 GTX with four 4K Acer Monitors. He also uses a Lenovo x250 ThinkPad alongside a desk full of x230t and x220 ThinkPads. One of which he gave away at SouthEast LinuxFest this year, which you can read about here.  However it’s not done there, being a complete hardware hoarder, JT also tests on several Intel NUCs and his second laptop a Fujitsu t904, not to mention a Plethora of HP DL580 servers, a DL980 server, and a stack of BL485c, BL460c, and BL490c Blades in his HP c7000 and c3000 Bladecenter chassis. (Maybe it’s time for an intervention for his hardware collecting habits)</p>
</li>
<li>
<p>Ken: For a laptop, he primarily uses a 3rd generation X1 Carbon, but also has an old Eee PC T101MT Netbook (dual core 1GHz, 2GB of memory) which he uses for verifying how well Trident works on low-end hardware. As far as workstations go, his office computer is an Intel i7 with an NVIDIA Geforce GTX 960 running three 4K monitors and he has a couple other custom-built workstations (1 AMD, 1 Intel+NVIDIA) at his home. Generally he assembled random workstations based on hardware that was given to him or that he could acquire cheap.</p>
</li>
<li>
<p>Tim: is using a third gen X1 Carbon and a custom built desktop with an Intel Core i5-4440 CPU, 16 GiB RAM, Nvidia GeForce GTX 750 Ti, and a RealTek 8168 / 8111 network card.</p>
</li>
<li>
<p>Rod: Rod uses… No one knows what Rod uses, It’s kinda like how many licks does it take to get to the center of a Tootsie-Roll Tootsie-Pop… the world may just never know.</p>
</li>
</ul>

<p><hr></p>

<p>###NetBSD GSoC: pkgsrc config file versioning</p>

<ul>
<li>A series of reports from the course of the summer on this Google Summer of Code project</li>
<li>The goal of the project is to integrate with a VCS (Version Control System) to make managing local changes to config files for packages easier</li>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files">GSoC 2018 Reports: Configuration files versioning in pkgsrc, Part 1</a></li>
</ul>

<blockquote>
<p>Packages may install code (both machine executable code and interpreted programs), documentation and manual pages, source headers, shared libraries and other resources such as graphic elements, sounds, fonts, document templates, translations and configuration files, or a combination of them.<br>
Configuration files are usually the means through which the behaviour of software without a user interface is specified. This covers parts of the operating systems, network daemons and programs in general that don’t come with an interactive graphical or textual interface as the principal mean for setting options.<br>
System wide configuration for operating system software tends to be kept under /etc, while configuration for software installed via pkgsrc ends up under LOCALBASE/etc (e.g., /usr/pkg/etc).<br>
Software packaged as part of pkgsrc provides example configuration files, if any, which usually get extracted to LOCALBASE/share/examples/PKGBASE/.<br>
Don’t worry: automatic merging is disabled by default, set $VCSAUTOMERGE to enable it.<br>
In order to avoid breakage, installed configuration is backed up first in the VCS, separating user-modified files from files that have been already automatically merged in the past, in order to allow the administrator to easily restore the last manually edited file in case of breakage.<br>
VCS functionality only applies to configuration files, not to rc.d scripts, and only if the environment variable $NOVCS is unset.<br>
The version control system to be used as a backend can be set through $VCS. It default to RCS, the Revision Control System, which works only locally and doesn’t support atomic transactions.<br>
Other backends such as CVS are supported and more will come; these, being used at the explicit request of the administrator, need to be already installed and placed in a directory part of $PATH.</p>
</blockquote>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files1">GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 2: remote repositories (git and CVS)</a></li>
</ul>

<blockquote>
<p>pkgsrc is now able to deploy configuration from packages being installed from a remote, site-specific vcs repository.<br>
User modified files are always tracked even if automerge functionality is not enabled, and a new tool, pkgconftrack(1), exists to manually store user changes made outside of package upgrade time.<br>
Version Control software is executed as the same user running pkg_add or make install, unless the user is “root”. In this case, a separate, unprivileged user, pkgvcsconf, gets created with its own home directory and a working login shell (but no password). The home directory is not strictly necessary, it exists to facilitate migrations betweens repositories and vcs changes; it also serves to store keys used to access remote repositories.<br>
Using git instead of rcs is simply done by setting VCS=git in pkg_install.conf</p>
</blockquote>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files2">GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 3: remote repositories (SVN and Mercurial)</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files3">GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 4: configuration deployment, pkgtools and future improvements</a></li>
</ul>

<blockquote>
<p>Support for configuration tracking is in scripts, pkginstall scripts, that get built into binary packages and are run by pkg_add upon installation. The idea behind the proposal suggested that users of the new feature should be able to store revisions of their installed configuration files, and of package-provided default, both in local or remote repositories. With this capability in place, it doesn’t take much to make the scripts “pull” configuration from a VCS repository at installation time.<br>
That’s what setting VCSCONFPULL=yes in pkg_install.conf after having enabled VCSTRACK_CONF does: You are free to use official, third party prebuilt packages that have no customization in them, enable these options, and point pkgsrc to a private conf repository. If it contains custom configuration for the software you are installing, an attempt will be made to use it and install it on your system. If it fails, pkginstall will fall back to using the defaults that come inside the package. RC scripts are always deployed from the binary package, if existing and PKG_RCD_SCRIPTS=yes in pkg_install.conf or the environment.<br>
This will be part of packages, not a separate solution like configuration management tools. It doesn’t support running scripts on the target system to customize the installation, it doesn’t come with its domain-specific language, it won’t run as a daemon or require remote logins to work. It’s quite limited in scope, but you can define a ROLE for your system in pkg_install.conf or in the environment, and pkgsrc will look for configuration you or your organization crafted for such a role (e.g., public, standalone webserver vs reverse proxy or node in a database cluster)</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSDTypeAndMacOS">A little bit of the one-time MacOS version still lingers in ZFS</a></p>

<blockquote>
<p>Once upon a time, Apple came very close to releasing ZFS as part of MacOS. Apple did this work in its own copy of the ZFS source base (as far as I know), but the people in Sun knew about it and it turns out that even today there is one little lingering sign of this hoped-for and perhaps prepared-for ZFS port in the ZFS source code. Well, sort of, because it’s not quite in code.<br>
Lurking in the function that reads ZFS directories to turn (ZFS) directory entries into the filesystem independent format that the kernel wants is the following comment:</p>
</blockquote>

<p><code>objnum = ZFS_DIRENT_OBJ(zap.za_first_integer);</code><br>
<code>/*</code><br>
<code>* MacOS X can extract the object type here such as:</code><br>
<code>* uint8_t type = ZFS_DIRENT_TYPE(zap.za_first_integer);</code><br>
<code>*/</code></p>

<ul>
<li>Specifically, this is in zfs_readdir in zfs_vnops.c .</li>
</ul>

<blockquote>
<p>ZFS maintains file type information in directories. This information can’t be used on Solaris (and thus Illumos), where the overall kernel doesn’t have this in its filesystem independent directory entry format, but it could have been on MacOS (‘Darwin’), because MacOS is among the Unixes that support d_type. The comment itself dates all the way back to this 2007 commit, which includes the change ‘reserve bits in directory entry for file type’, which created the whole setup for this.<br>
I don’t know if this file type support was added specifically to help out Apple’s MacOS X port of ZFS, but it’s certainly possible, and in 2007 it seems likely that this port was at least on the minds of ZFS developers. It’s interesting but understandable that FreeBSD didn’t seem to have influenced them in the same way, at least as far as comments in the source code go; this file type support is equally useful for FreeBSD, and the FreeBSD ZFS port dates to 2007 too (per this announcement).<br>
Regardless of the exact reason that ZFS picked up maintaining file type information in directory entries, it’s quite useful for people on both FreeBSD and Linux that it does so. File type information is useful for any number of things and ZFS filesystems can (and do) provide this information on those Unixes, which helps make ZFS feel like a truly first class filesystem, one that supports all of the expected general system features.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="http://trafyx.com/?p=2551">Mac-like FreeBSD Laptop</a></li>
<li><a href="https://vermaden.wordpress.com/2018/08/21/syncthing-on-freebsd/">Syncthing on FreeBSD</a></li>
<li><a href="https://vermaden.wordpress.com/2018/08/24/new-zfs-boot-environments-tool/">New ZFS Boot Environments Tool</a></li>
<li><a href="http://anadoxin.org/blog/my-systems-time-was-so-wrong-that-even-ntpd-didnt-work.html">My system’s time was so wrong, that even ntpd didn’t work</a></li>
<li><a href="https://www.openssh.com/releasenotes.html#7.8">OpenSSH 7.8/7.8p1 (2018-08-24)</a></li>
<li><a href="https://2018.eurobsdcon.org/registration/">EuroBSD (Sept 20-23rd) registration Early Bird Period is coming to an end</a></li>
<li><a href="https://www.meetbsd.com/">MeetBSD (Oct 18-20th) is coming up fast, hurry up and register!</a></li>
<li><a href="https://2019.asiabsdcon.org/">AsiaBSDcon 2019 Dates</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Will - <a href="http://dpaste.com/2EQMHXV">Kudos and a Question</a></li>
<li>Peter - <a href="http://dpaste.com/2N6DC6P#wrap">Fanless Computers</a></li>
<li>Ron - <a href="http://dpaste.com/0MRG11V#wrap">ZFS disk clone or replace or something</a></li>
<li>Bostjan - <a href="http://dpaste.com/16B1WDB">ZFS Record Size</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD on Microsoft Surface Go, FreeBSD Foundation August Update, What’s taking so long with Project Trident, pkgsrc config file versioning, and MacOS remnants in ZFS code.</p>

<p>##Headlines<br>
###<a href="https://jcs.org/2018/08/31/surface_go">OpenBSD on the Microsoft Surface Go</a></p>

<blockquote>
<p>For some reason I like small laptops and the constraints they place on me (as long as they’re still usable). I used a Dell Mini 9 for a long time back in the netbook days and was recently using an 11&quot; MacBook Air as my primary development machine for many years. Recently Microsoft announced a smaller, cheaper version of its Surface tablets called Surface Go which piqued my interest.</p>
</blockquote>

<ul>
<li>Hardware</li>
</ul>

<blockquote>
<p>The Surface Go is available in two hardware configurations: one with 4Gb of RAM and a 64Gb eMMC, and another with 8Gb of RAM with a 128Gb NVMe SSD. (I went with the latter.) Both ship with an Intel Pentium Gold 4415Y processor which is not very fast, but it’s certainly usable.<br>
The tablet measures 9.65&quot; across, 6.9&quot; tall, and 0.3&quot; thick. Its 10&quot; diagonal 3:2 touchscreen is covered with Gorilla Glass and has a resolution of 1800x1200. The bezel is quite large, especially for such a small screen, but it makes sense on a device that is meant to be held, to avoid accidental screen touches.<br>
The keyboard and touchpad are located on a separate, removable slab called the Surface Go Signature Type Cover which is sold separately. I opted for the “cobalt blue” cover which has a soft, cloth-like alcantara material. The cover attaches magnetically along the bottom edge of the device and presents USB-attached keyboard and touchpad devices. When the cover is folded up against the screen, it sends an ACPI sleep signal and is held to the screen magnetically. During normal use, the cover can be positioned flat on a surface or slightly raised up about 3/4&quot; near the screen for better ergonomics. When using the device as a tablet, the cover can be rotated behind the screen which causes it to automatically stop sending keyboard and touchpad events until it is rotated back around.<br>
The keyboard has a decent amount of key travel and a good layout, with Home/End/Page Up/Page Down being accessible via Fn+Left/Right/Up/Down but also dedicated Home/End/Page Up/Page Down keys on the F9-F12 keys which I find quite useful since the keyboard layout is somewhat small. By default, the F1-F12 keys do not send F1-F12 key codes and Fn must be used, either held down temporarily or Fn pressed by itself to enable Fn-lock which annoyingly keeps the bright Fn LED illuminated. The keys are backlit with three levels of adjustment, handled by the keyboard itself with the F7 key.<br>
The touchpad on the Type Cover is a Windows Precision Touchpad connected via USB HID. It has a decent click feel but when the cover is angled up instead of flat on a surface, it sounds a bit hollow and cheap.</p>
</blockquote>

<ul>
<li>Surface Go Pen</li>
</ul>

<blockquote>
<p>The touchscreen is powered by an Elantech chip connected via HID-over-i2c, which also supports pen input. A Surface Pen digitizer is available separately from Microsoft and comes in the same colors as the Type Covers. The pen works without any pairing necessary, though the top button on it works over Bluetooth so it requires pairing to use. Either way, the pen requires an AAAA battery inside it to operate. The Surface Pen can attach magnetically to the left side of the screen when not in use.<br>
A kickstand can swing out behind the display to use the tablet in a laptop form factor, which can adjust to any angle up to about 170 degrees. The kickstand stays firmly in place wherever it is positioned, which also means it requires a bit of force to pull it out when initially placing the Surface Go on a desk.<br>
Along the top of the display are a power button and physical volume rocker buttons. Along the right side are the 3.5mm headphone jack, USB-C port, power port, and microSD card slot located behind the kickstand.<br>
Charging can be done via USB-C or the dedicated charge port, which accommodates a magnetically-attached, thin barrel similar to Apple’s first generation MagSafe adapter. The charging cable has a white LED that glows when connected, which is kind of annoying since it’s near the mid-line of the screen rather than down by the keyboard. Unlike Apple’s MagSafe, the indicator light does not indicate whether the battery is charged or not. The barrel charger plug can be placed up or down, but in either direction I find it puts an awkward strain on the power cable coming out of it due to the vertical position of the port.<br>
Wireless connectivity is provided by a Qualcomm Atheros QCA6174 802.11ac chip which also provides Bluetooth connectivity.<br>
Most of the sensors on the device such as the gyroscope and ambient light sensor are connected behind an Intel Sensor Hub PCI device, which provides some power savings as the host CPU doesn’t have to poll the sensors all the time.</p>
</blockquote>

<ul>
<li>Firmware</li>
</ul>

<blockquote>
<p>The Surface Go’s BIOS/firmware menu can be entered by holding down the Volume Up button, then pressing and releasing the Power button, and releasing Volume Up when the menu appears. Secure Boot as well as various hardware components can be disabled in this menu. Boot order can also be adjusted. A temporary boot menu can be brought up the same way but using Volume Down instead.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-august-2018/">FreeBSD Foundation Update, August 2018</a></p>

<ul>
<li>MESSAGE FROM THE EXECUTIVE DIRECTOR</li>
</ul>

<blockquote>
<p>Dear FreeBSD Community Member,<br>
It’s been a busy summer for the Foundation. From traveling around the globe spreading the word about FreeBSD to bringing on new team members to improve the Project’s Continuous Integration work, we’re very excited about what we’ve accomplished. Take a minute to check out the latest updates within our Foundation sponsored projects; read more about our advocacy efforts in Bangladesh and community building in Cambridge; don’t miss upcoming Travel Grant deadlines, and new Developer Summits; and be sure to find out how your support will ensure our progress continues into 2019.<br>
We can’t do this without you! Happy reading!! Deb</p>
</blockquote>

<ul>
<li>August 2018 Development Projects Update</li>
<li>Fundraising Update: Supporting the Project</li>
<li>August 2018 Release Engineering Update</li>
<li>BSDCam 2018 Recap</li>
<li>October 2018 FreeBSD Developer Summit Call for Participation</li>
<li>SANOG32 and COSCUP 2018 Recap</li>
<li>MeetBSD 2018 Travel Grant Application Deadline: September 7</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="http://project-trident.org/post/2018-09-04_what_is_taking_so_long/">Project Trident: What’s taking so long?</a></p>

<ul>
<li>What is taking so long?</li>
</ul>

<blockquote>
<p>The short answer is that it’s complicated.<br>
Project Trident is quite literally a test of the new TrueOS build system. As expected, there have been quite a few bugs, undocumented features, and other optional bits that we discovered we needed that were not initially present. All of these things have to be addressed and retested in a constant back and forth process.<br>
While Ken and JT are both experienced developers, neither has done this kind of release engineering before. JT has done some release engineering back in his Linux days, but the TrueOS and FreeBSD build system is very different. Both Ken and JT are learning a completely new way of building a FreeBSD/TrueOS distribution. Please keep in mind that no one has used this new TrueOS build system before, so Ken and JT want to not only provide a good Trident release, but also provide a model or template for other potential TrueOS distributions too!</p>
</blockquote>

<ul>
<li>Where are we now?</li>
</ul>

<blockquote>
<p>Through perseverance, trial and error, and a lot of head-scratching we have reached the point of having successful builds. It took a while to get there, but now we are simply working out a few bugs with the new installer that Ken wrote as well as finding and fixing all the new Xorg configuration options which recently landed in FreeBSD. We also found that a number of services have been removed or replaced between TrueOS 18.03 and 18.06 so we are needing to adjust what we consider the “base” services for the desktop. All of these issues are being resolved and we are continually rebuilding and pulling in new patches from TrueOS as soon as they are committed.<br>
In the meantime we have made an early BETA release of Trident available to the users in our Telegram Channel for those who want to help out in testing these early versions.</p>
</blockquote>

<ul>
<li>Do you foresee any other delays?</li>
</ul>

<blockquote>
<p>At the moment we are doing many iterations of testing and tweaking the install ISO and package configurations in order to ensure that all the critical functionality works out-of-box (networking, sound, video, basic apps, etc). While we do not foresee any other major delays, sometimes things happen that our outside of our control. For an example, one of the recent delays that hit recently was completely unexpected: we had a hard drive failure on our build server. Up until recently, The aptly named “Poseidon” build server was running a Micron m500dc drive, but that drive is now constantly reporting errors. Despite ordering a replacement Western Digital Blue SSD several weeks ago, we just received it this past week. The drive is now installed with the builder back to full functionality, but we did lose many precious days with the delay.<br>
The build server for Project Trident is very similar to the one that JT donated to the TrueOS project. JT had another DL580 G7, so he donated one to the Trident Project for their build server. Poseidon also has 256GB RAM (64 x 4GB sticks) which is a smidge higher than what the TrueOS builder has.<br>
Since we are talking about hardware, we probably should address another question we get often, “What Hardware are the devs testing on?” So let’s go ahead and answer that one now.</p>
</blockquote>

<ul>
<li>
<p>Developer Hardware</p>
</li>
<li>
<p>JT: His main test box is a custom-built Intel i7 7700K system running 32GB RAM, dual Intel Optane 900P drives, and an Nvidia 1070 GTX with four 4K Acer Monitors. He also uses a Lenovo x250 ThinkPad alongside a desk full of x230t and x220 ThinkPads. One of which he gave away at SouthEast LinuxFest this year, which you can read about here.  However it’s not done there, being a complete hardware hoarder, JT also tests on several Intel NUCs and his second laptop a Fujitsu t904, not to mention a Plethora of HP DL580 servers, a DL980 server, and a stack of BL485c, BL460c, and BL490c Blades in his HP c7000 and c3000 Bladecenter chassis. (Maybe it’s time for an intervention for his hardware collecting habits)</p>
</li>
<li>
<p>Ken: For a laptop, he primarily uses a 3rd generation X1 Carbon, but also has an old Eee PC T101MT Netbook (dual core 1GHz, 2GB of memory) which he uses for verifying how well Trident works on low-end hardware. As far as workstations go, his office computer is an Intel i7 with an NVIDIA Geforce GTX 960 running three 4K monitors and he has a couple other custom-built workstations (1 AMD, 1 Intel+NVIDIA) at his home. Generally he assembled random workstations based on hardware that was given to him or that he could acquire cheap.</p>
</li>
<li>
<p>Tim: is using a third gen X1 Carbon and a custom built desktop with an Intel Core i5-4440 CPU, 16 GiB RAM, Nvidia GeForce GTX 750 Ti, and a RealTek 8168 / 8111 network card.</p>
</li>
<li>
<p>Rod: Rod uses… No one knows what Rod uses, It’s kinda like how many licks does it take to get to the center of a Tootsie-Roll Tootsie-Pop… the world may just never know.</p>
</li>
</ul>

<p><hr></p>

<p>###NetBSD GSoC: pkgsrc config file versioning</p>

<ul>
<li>A series of reports from the course of the summer on this Google Summer of Code project</li>
<li>The goal of the project is to integrate with a VCS (Version Control System) to make managing local changes to config files for packages easier</li>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files">GSoC 2018 Reports: Configuration files versioning in pkgsrc, Part 1</a></li>
</ul>

<blockquote>
<p>Packages may install code (both machine executable code and interpreted programs), documentation and manual pages, source headers, shared libraries and other resources such as graphic elements, sounds, fonts, document templates, translations and configuration files, or a combination of them.<br>
Configuration files are usually the means through which the behaviour of software without a user interface is specified. This covers parts of the operating systems, network daemons and programs in general that don’t come with an interactive graphical or textual interface as the principal mean for setting options.<br>
System wide configuration for operating system software tends to be kept under /etc, while configuration for software installed via pkgsrc ends up under LOCALBASE/etc (e.g., /usr/pkg/etc).<br>
Software packaged as part of pkgsrc provides example configuration files, if any, which usually get extracted to LOCALBASE/share/examples/PKGBASE/.<br>
Don’t worry: automatic merging is disabled by default, set $VCSAUTOMERGE to enable it.<br>
In order to avoid breakage, installed configuration is backed up first in the VCS, separating user-modified files from files that have been already automatically merged in the past, in order to allow the administrator to easily restore the last manually edited file in case of breakage.<br>
VCS functionality only applies to configuration files, not to rc.d scripts, and only if the environment variable $NOVCS is unset.<br>
The version control system to be used as a backend can be set through $VCS. It default to RCS, the Revision Control System, which works only locally and doesn’t support atomic transactions.<br>
Other backends such as CVS are supported and more will come; these, being used at the explicit request of the administrator, need to be already installed and placed in a directory part of $PATH.</p>
</blockquote>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files1">GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 2: remote repositories (git and CVS)</a></li>
</ul>

<blockquote>
<p>pkgsrc is now able to deploy configuration from packages being installed from a remote, site-specific vcs repository.<br>
User modified files are always tracked even if automerge functionality is not enabled, and a new tool, pkgconftrack(1), exists to manually store user changes made outside of package upgrade time.<br>
Version Control software is executed as the same user running pkg_add or make install, unless the user is “root”. In this case, a separate, unprivileged user, pkgvcsconf, gets created with its own home directory and a working login shell (but no password). The home directory is not strictly necessary, it exists to facilitate migrations betweens repositories and vcs changes; it also serves to store keys used to access remote repositories.<br>
Using git instead of rcs is simply done by setting VCS=git in pkg_install.conf</p>
</blockquote>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files2">GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 3: remote repositories (SVN and Mercurial)</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files3">GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 4: configuration deployment, pkgtools and future improvements</a></li>
</ul>

<blockquote>
<p>Support for configuration tracking is in scripts, pkginstall scripts, that get built into binary packages and are run by pkg_add upon installation. The idea behind the proposal suggested that users of the new feature should be able to store revisions of their installed configuration files, and of package-provided default, both in local or remote repositories. With this capability in place, it doesn’t take much to make the scripts “pull” configuration from a VCS repository at installation time.<br>
That’s what setting VCSCONFPULL=yes in pkg_install.conf after having enabled VCSTRACK_CONF does: You are free to use official, third party prebuilt packages that have no customization in them, enable these options, and point pkgsrc to a private conf repository. If it contains custom configuration for the software you are installing, an attempt will be made to use it and install it on your system. If it fails, pkginstall will fall back to using the defaults that come inside the package. RC scripts are always deployed from the binary package, if existing and PKG_RCD_SCRIPTS=yes in pkg_install.conf or the environment.<br>
This will be part of packages, not a separate solution like configuration management tools. It doesn’t support running scripts on the target system to customize the installation, it doesn’t come with its domain-specific language, it won’t run as a daemon or require remote logins to work. It’s quite limited in scope, but you can define a ROLE for your system in pkg_install.conf or in the environment, and pkgsrc will look for configuration you or your organization crafted for such a role (e.g., public, standalone webserver vs reverse proxy or node in a database cluster)</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSDTypeAndMacOS">A little bit of the one-time MacOS version still lingers in ZFS</a></p>

<blockquote>
<p>Once upon a time, Apple came very close to releasing ZFS as part of MacOS. Apple did this work in its own copy of the ZFS source base (as far as I know), but the people in Sun knew about it and it turns out that even today there is one little lingering sign of this hoped-for and perhaps prepared-for ZFS port in the ZFS source code. Well, sort of, because it’s not quite in code.<br>
Lurking in the function that reads ZFS directories to turn (ZFS) directory entries into the filesystem independent format that the kernel wants is the following comment:</p>
</blockquote>

<p><code>objnum = ZFS_DIRENT_OBJ(zap.za_first_integer);</code><br>
<code>/*</code><br>
<code>* MacOS X can extract the object type here such as:</code><br>
<code>* uint8_t type = ZFS_DIRENT_TYPE(zap.za_first_integer);</code><br>
<code>*/</code></p>

<ul>
<li>Specifically, this is in zfs_readdir in zfs_vnops.c .</li>
</ul>

<blockquote>
<p>ZFS maintains file type information in directories. This information can’t be used on Solaris (and thus Illumos), where the overall kernel doesn’t have this in its filesystem independent directory entry format, but it could have been on MacOS (‘Darwin’), because MacOS is among the Unixes that support d_type. The comment itself dates all the way back to this 2007 commit, which includes the change ‘reserve bits in directory entry for file type’, which created the whole setup for this.<br>
I don’t know if this file type support was added specifically to help out Apple’s MacOS X port of ZFS, but it’s certainly possible, and in 2007 it seems likely that this port was at least on the minds of ZFS developers. It’s interesting but understandable that FreeBSD didn’t seem to have influenced them in the same way, at least as far as comments in the source code go; this file type support is equally useful for FreeBSD, and the FreeBSD ZFS port dates to 2007 too (per this announcement).<br>
Regardless of the exact reason that ZFS picked up maintaining file type information in directory entries, it’s quite useful for people on both FreeBSD and Linux that it does so. File type information is useful for any number of things and ZFS filesystems can (and do) provide this information on those Unixes, which helps make ZFS feel like a truly first class filesystem, one that supports all of the expected general system features.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="http://trafyx.com/?p=2551">Mac-like FreeBSD Laptop</a></li>
<li><a href="https://vermaden.wordpress.com/2018/08/21/syncthing-on-freebsd/">Syncthing on FreeBSD</a></li>
<li><a href="https://vermaden.wordpress.com/2018/08/24/new-zfs-boot-environments-tool/">New ZFS Boot Environments Tool</a></li>
<li><a href="http://anadoxin.org/blog/my-systems-time-was-so-wrong-that-even-ntpd-didnt-work.html">My system’s time was so wrong, that even ntpd didn’t work</a></li>
<li><a href="https://www.openssh.com/releasenotes.html#7.8">OpenSSH 7.8/7.8p1 (2018-08-24)</a></li>
<li><a href="https://2018.eurobsdcon.org/registration/">EuroBSD (Sept 20-23rd) registration Early Bird Period is coming to an end</a></li>
<li><a href="https://www.meetbsd.com/">MeetBSD (Oct 18-20th) is coming up fast, hurry up and register!</a></li>
<li><a href="https://2019.asiabsdcon.org/">AsiaBSDcon 2019 Dates</a></li>
</ul>

<p><hr></p>

<p>##Feedback/Questions</p>

<ul>
<li>Will - <a href="http://dpaste.com/2EQMHXV">Kudos and a Question</a></li>
<li>Peter - <a href="http://dpaste.com/2N6DC6P#wrap">Fanless Computers</a></li>
<li>Ron - <a href="http://dpaste.com/0MRG11V#wrap">ZFS disk clone or replace or something</a></li>
<li>Bostjan - <a href="http://dpaste.com/16B1WDB">ZFS Record Size</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 261: FreeBSDcon Flashback | BSD Now 261</title>
  <link>https://www.bsdnow.tv/261</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2488</guid>
  <pubDate>Thu, 30 Aug 2018 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9bf2ff39-f045-4c19-8416-f1a6da6d3f84.mp3" length="65719133" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Insight into TrueOS and Trident, stop evildoers with pf-badhost, Flashback to FreeBSDcon ‘99, OpenBSD’s measures against TLBleed, play Morrowind on OpenBSD in 5 steps, DragonflyBSD developers shocked at Threadripper performance, and more.</itunes:subtitle>
  <itunes:duration>1:49:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Insight into TrueOS and Trident, stop evildoers with pf-badhost, Flashback to FreeBSDcon ‘99, OpenBSD’s measures against TLBleed, play Morrowind on OpenBSD in 5 steps, DragonflyBSD developers shocked at Threadripper performance, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://itsfoss.com/project-trident-interview/"&gt;An Insight into the Future of TrueOS BSD and Project Trident&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Last month, TrueOS announced that they would be spinning off their desktop offering. The team behind the new project, named Project Trident, have been working furiously towards their first release. They did take a few minutes to answer some of our question about Project Trident and TrueOS. I would like to thank JT and Ken for taking the time to compile these answers.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: What is Project Trident?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: Project Trident is the continuation of the TrueOS Desktop. Essentially, it is the continuation of the primary “TrueOS software” that people have been using for the past 2 years. The continuing evolution of the entire TrueOS project has reached a stage where it became necessary to reorganize the project. To understand this change, it is important to know the history of the TrueOS project.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Originally, Kris Moore created PC-BSD. This was a Desktop release of FreeBSD focused on providing a simple and user-friendly graphical experience for FreeBSD. PC-BSD grew and matured over many years. During the evolution of PC-BSD, many users began asking for a server focused version of the software. Kris agreed, and TrueOS was born as a scaled down server version of PC-BSD. In late 2016, more contributors and growth resulted in significant changes to the PC-BSD codebase. Because the new development was so markedly different from the original PC-BSD design, it was decided to rebrand the project.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;TrueOS was chosen as the name for this new direction for PC-BSD as the project had grown beyond providing only a graphical front to FreeBSD and was beginning to make fundamental changes to the FreeBSD operating system. One of these changes was moving PC-BSD from being based on each FreeBSD Release to TrueOS being based on the active and less outdated FreeBSD Current. Other major changes are using OpenRC for service management and being more aggressive about addressing long-standing issues with the FreeBSD release process. TrueOS moved toward a rolling release cycle, twice a year, which tested and merged FreeBSD changes directly from the developer instead of waiting months or even years for the FreeBSD review process to finish. TrueOS also deprecated and removed obsolete technology much more regularly.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;As the TrueOS Project grew, the developers found these changes were needed by other FreeBSD-based projects. These projects began expressing interest in using TrueOS rather than FreeBSD as the base for their project. This demonstrated that TrueOS needed to again evolve into a distribution framework for any BSD project to use. This allows port maintainers and source developers from any BSD project to pool their resources and use the same source repositories while allowing every distribution to still customize, build, and release their own self-contained project. The result is a natural split of the traditional TrueOS team. There were now naturally two teams in the TrueOS project: those working on the build infrastructure and FreeBSD enhancements – the “core” part of the project, and those working on end-user experience and utility – the “desktop” part of the project.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;When the decision was made to formally split the projects, the obvious question that arose was what to call the “Desktop” project. As TrueOS was already positioned to be a BSD distribution platform, the developers agreed the desktop side should pick a new name. There were other considerations too, one notable being that we were concerned that if we continued to call the desktop project “TrueOS Desktop”, it would prevent people from considering TrueOS as the basis for their distribution because of misconceptions that TrueOS was a desktop-focused OS. It also helps to “level the playing field” for other desktop distributions like GhostBSD so that TrueOS is not viewed as having a single “blessed” desktop version.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: What features will TrueOS add to the FreeBSD base?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: TrueOS has already added a number of features to FreeBSD:&lt;br&gt;
OpenRC replaces rc.d for service management&lt;br&gt;
LibreSSL in base&lt;br&gt;
Root NSS certificates out-of-box&lt;br&gt;
Scriptable installations (pc-sysinstall)&lt;br&gt;
The full list of changes can be seen on the TrueOS repository (&lt;a href="https://github.com/trueos/trueos/blob/trueos-master/README.md"&gt;https://github.com/trueos/trueos/blob/trueos-master/README.md&lt;/a&gt;). This list does change quite regularly as FreeBSD development itself changes.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: I understand that TrueOS will have a new feature that will make creating a desktop spin of TrueOS very easy. Could you explain that new feature?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: Historically, one of the biggest hurdles for creating a desktop version of FreeBSD is that the build options for packages are tuned for servers rather than desktops. This means a desktop distribution cannot use the pre-built packages from FreeBSD and must build, use, and maintain a custom package repository. Maintaining a fork of the FreeBSD ports tree is no trivial task. TrueOS has created a full distribution framework so now all it takes to create a custom build of FreeBSD is a single JSON manifest file. There is now a single “source of truth” for the source and ports repositories that is maintained by the TrueOS team and regularly tagged with “stable” build markers. All projects can use this framework, which makes updates trivial.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: Do you think that the new focus of TrueOS will lead to the creation of more desktop-centered BSDs?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: That is the hope. Historically, creating a desktop-centered BSD has required a lot of specialized knowledge. Not only do most people not have this knowledge, but many do not even know what they need to learn until they start troubleshooting. TrueOS is trying to drastically simplify this process to enable the wider Open Source community to experiment, contribute, and enjoy BSD-based projects.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: What is going to happen to TrueOS Pico? Will Project Trident have ARM support?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: Project Trident will be dependent on TrueOS for ARM support. The developers have talked about the possibility of supporting ARM64 and RISC-V architectures, but it is not possible at the current time. If more Open Source contributors want to help develop ARM and RISC-V support, the TrueOS project is definitely willing to help test and integrate that code.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: What does this change (splitting Trus OS into Project Trident) mean for the Lumina desktop environment?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: Long-term, almost nothing. Lumina is still the desktop environment for Project Trident and will continue to be developed and enhanced alongside Project Trident just as it was for TrueOS. Short-term, we will be delaying the release of Lumina 2.0 and will release an updated version of the 1.x branch (1.5.0) instead. This is simply due to all the extra overhead to get Project Trident up and running. When things settle down into a rhythm, the development of Lumina will pick up once again.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: Are you planning on including any desktop environments besides Lumina?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: While Lumina is included by default, all of the other popular desktop environments will be available in the package repo exactly as they had been before.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: Any plans to include Steam to increase the userbase?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: Steam is still unavailable natively on FreeBSD, so we do not have any plans to ship it out of the box currently. In the meantime, we highly recommend installing the Windows version of Steam through the PlayOnBSD utility.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: What will happen to the AppCafe?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: The AppCafe is the name of the graphical interface for the “pkg” utility integrated into the SysAdm client created by TrueOS. This hasn’t changed. SysAdm, the graphical client, and by extension AppCafe are still available for all TrueOS-based distributions to use.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: Does Project Trident have any corporate sponsors lined up? If not, would you be open to it or would you prefer that it be community supported?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: iXsystems is the first corporate sponsor of Project Trident and we are always open to other sponsorships as well. We would prefer smaller individual contributions from the community, but we understand that larger project needs or special-purpose goals are much more difficult to achieve without allowing larger corporate sponsorships as well. In either case, Project Trident is always looking out for the best interests of the community and will not allow intrusive or harmful code to enter the project even if a company or individual tries to make that code part of a sponsorship deal.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: BSD always seems to be lagging in terms of support for newer devices. Will TrueOS be able to remedy that with a quicker release cycle?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: Yes! That was a primary reason for TrueOS to start tracking the CURRENT branch of FreeBSD in 2016. This allows for the changes that FreeBSD developers are making, including new hardware support, to be available much sooner than if we followed the FreeBSD release cycle.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s FOSS: Do you have any idea when Project Trident will have its first release?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Project Trident: Right now we are targeting a late August release date. This is because Project Trident is “kicking the wheels” on the new TrueOS distribution system. We want to ensure everything is working smoothly before we release. Going forward, we plan on having regular package updates every week or two for the end-user packages and a new release of Trident with an updated OS version every 6 months. This will follow the TrueOS release schedule with a small time offset.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.geoghegan.ca/pfbadhost.html"&gt;pf-badhost: Stop the evil doers in their tracks!&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;pf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet’s biggest irritants. Annoyances such as ssh bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.&lt;br&gt;
Filtering performance is exceptional, as the badhost list is stored in a pf table. To quote the OpenBSD FAQ page regarding tables: “the lookup time on a table holding 50,000 addresses is only slightly more than for one holding 50 addresses.”&lt;br&gt;
pf-badhost is simple and powerful. The blocklists are pulled from quality, trusted sources. The ‘Firehol’, ‘Emerging Threats’ and ‘Binary Defense’ block lists are used as they are popular, regularly updated lists of the internet’s most egregious offenders. The &lt;a href="http://pf-badhost.sh"&gt;pf-badhost.sh&lt;/a&gt; script can easily be expanded to use additional or alternate blocklists.&lt;br&gt;
pf-badhost works best when used in conjunction with unbound-adblock for the ultimate badhost blocking.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Notes:&lt;/li&gt;
&lt;li&gt;If you are trying to run pf-badhost on a LAN or are using NAT, you will want to add a rule to your pf.conf appearing BEFORE the pf-badhost rules allowing traffic to and from your local subnet so that you can still access your gateway and any DNS servers.&lt;/li&gt;
&lt;li&gt;Conversely, adding a line to &lt;a href="http://pf-badhost.sh"&gt;pf-badhost.sh&lt;/a&gt; that removes your subnet range from the &amp;lt;pfbadhost&amp;gt; table should also work. Just make sure you choose a subnet range / CIDR block that is actually in the list. 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 are the most common home/office subnet ranges.&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;DigitalOcean&lt;/strong&gt;&lt;br&gt;
&lt;a href="https://do.co/bsdnow"&gt;https://do.co/bsdnow&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="http://edition.cnn.com/TECH/computing/9911/01/freebsd.con99.idg/"&gt;FLASHBACK: FreeBSDCon’99: Fans of Linux’s lesser-known sibling gather for the first time&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;FreeBSD, a port of BSD Unix to Intel, has been around almost as long as Linux has – but without the media hype. Its developer and user community recently got a chance to get together for the first time, and they did it in the city where BSD – the Berkeley Software Distribution – was born some 25 years ago.&lt;br&gt;
October 17, 1999 marked a milestone in the history of FreeBSD – the first FreeBSD conference was held in the city where it all began, Berkeley, CA. Over 300 developers, users, and interested parties attended from around the globe.&lt;br&gt;
This was easily 50 percent more people than the conference organizers had expected. This first conference was meant to be a gathering mostly for developers and FreeBSD advocates. The turnout was surprisingly (and gratifyingly) large.&lt;br&gt;
In fact, attendance exceeded expectations so much that, for instance, Kirk McKusick had to add a second, identical tutorial on FreeBSD internals, because it was impossible for everyone to attend the first!&lt;br&gt;
But for a first-ever conference, I was impressed by how smoothly everything seemed to go. Sessions started on time, and the sessions I attended were well-run; nothing seemed to be too cold, dark, loud, late, or off-center.&lt;br&gt;
Of course, the best part about a conference such as this one is the opportunity to meet with other people who share similar interests. Lunches and breaks were a good time to meet people, as was the Tuesday night beer bash.&lt;br&gt;
The Wednesday night reception was of a type unusual for the technical conferences I usually attend – a three-hour Hornblower dinner cruise on San Francisco Bay. Not only did we all enjoy excellent food and company, but we all got to go up on deck and watch the lights of San Francisco and Berkeley as we drifted by. Although it’s nice when a conference attracts thousands of attendees, there are some things that can only be done with smaller groups of people; this was one of them.&lt;br&gt;
In short, this was a tiny conference, but a well-run one.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Sessions&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Although it was a relatively small conference, the number and quality of the sessions belied the size. Each of the three days of the conference featured a different keynote speaker. In addition to Jordan Hubbard, Jeremy Allison spoke on “Samba Futures” on day two, and Brian Behlendorf gave a talk on “FreeBSD and Apache: A Perfect Combo” to start off the third day.&lt;br&gt;
The conference sessions themselves were divided into six tracks: advocacy, business, development, networking, security, and panels. The panels track featured three different panels, made up of three different slices of the community: the FreeBSD core team, a press panel, and a prominent user panel with representatives from such prominent commercial users as Yahoo! and USWest.&lt;br&gt;
I was especially interested in Apple Computer’s talk in the development track. Wilfredo Sanchez, technical lead for open source projects at Apple (no, that’s not an oxymoron!) spoke about Apple’s Darwin project, the company’s operating system road map, and the role of BSD (and, specifically, FreeBSD) in Apple’s plans.&lt;br&gt;
Apple and Unix have had a long and uneasy history, from the Lisa through the A/UX project to today. Personally, I’m very optimistic about the chances for the Darwin project to succeed. Apple’s core OS kernel team has chosen FreeBSD as its reference platform. I’m looking forward to what this partnership will bring to both sides.&lt;br&gt;
Other development track sessions included in-depth tutorials on writing device drivers, basics of the Vinum Volume Manager, Fibre Channel, development models (the open repository model), and the FreeBSD Documentation Project (FDP). If you’re interested in contributing to the FreeBSD project, the FDP is a good place to start.&lt;br&gt;
Advocacy sessions included “How One Person Can Make a Difference” (a timeless topic that would find a home at any technical conference!) and “Starting and Managing A User Group” (trials and tribulations as well as rewards).&lt;br&gt;
The business track featured speakers from three commercial users of FreeBSD: Cybernet, USWest, and Applix. Applix presented its port of Applixware Office for FreeBSD and explained how Applix has taken the core services of Applixware into open source.&lt;br&gt;
Commercial applications and open source were once a rare combination; we can only hope the trend away from that state of affairs will continue.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Commercial use of FreeBSD&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The use of FreeBSD in embedded applications is increasing as well – and it is increasing at the same rate that hardware power is. These days, even inexpensive systems are able to run a BSD kernel.&lt;br&gt;
The BSD license and the solid TCP/IP stack prove significant enticements to this market as well. (Unlike the GNU Public License, the BSD license does not require that vendors make derivative works open source.)&lt;br&gt;
Companies such as USWest and Verio use FreeBSD for a wide variety of different Internet services.&lt;br&gt;
Yahoo! and Hotmail are examples of companies that use FreeBSD extensively for more specific purposes. Yahoo!, for example, has many hundreds of FreeBSD boxes, and Hotmail has almost 2000 FreeBSD machines at its data center in the San Francisco Bay area.&lt;br&gt;
Hotmail is owned by Microsoft, so the fact that it runs FreeBSD is a secret. Don’t tell anyone…&lt;br&gt;
When asked to comment on the increasing commercial interest in BSD, Hubbard said that FreeBSD is learning the Red Hat lesson. “Walnut Creek and others with business interests in FreeBSD have learned a few things from the Red Hat IPO,” he said, “and nobody is just sitting around now, content with business as usual. It’s clearly business as unusual in the open source world today.”&lt;br&gt;
Hubbard had also singled out some of BSD’s commercial partners, such as Whistle Communications, for praise in his opening day keynote. These partners play a key role in moving the project forward, he said, by contributing various enhancements and major new systems, such as Netgraph, as well as by contributing paid employee time spent on FreeBSD.&lt;br&gt;
Even short FreeBSD-related contacts can yield good results, Hubbard said. An example of this is the new jail() security code introduced in FreeBSD 3.x and 4.0, which was contributed by R &amp;amp; D Associates. A number of ISPs are also now donating the hardware and bandwidth that allows the project to provide more resource mirrors and experimental development sites.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;See you next year&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;And speaking of corporate sponsors, thanks go to Walnut Creek for sponsoring the conference, and to Yahoo! for covering all the expenses involved in bringing the entire FreeBSD core team to Berkeley.&lt;br&gt;
As a fan of FreeBSD, I’m happy to see that the project has finally produced a conference. It was time: many of the 16 core team members had been working together on a regular basis for nearly seven years without actually meeting face to face.&lt;br&gt;
It’s been an interesting year for open source projects. I’m looking forward to the next year – and the next BSD conference – to be even better.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://marc.info/?l=openbsd-tech&amp;amp;m=153504937925732&amp;amp;w=2"&gt;OpenBSD Recommends: Disable SMT/Hyperthreading in all Intel BIOSes&lt;/a&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;Two recently disclosed hardware bugs affected Intel cpus:

     - TLBleed

     - T1TF (the name "Foreshadow" refers to 1 of 3 aspects of this
             bug, more aspects are surely on the way)

Solving these bugs requires new cpu microcode, a coding workaround,
*AND* the disabling of SMT / Hyperthreading.

SMT is fundamentally broken because it shares resources between the two
cpu instances and those shared resources lack security differentiators.
Some of these side channel attacks aren't trivial, but we can expect
most of them to eventually work and leak kernel or cross-VM memory in
common usage circumstances, even such as javascript directly in a
browser.

There will be more hardware bugs and artifacts disclosed.  Due to the
way SMT interacts with speculative execution on Intel cpus, I expect SMT
to exacerbate most of the future problems.

A few months back, I urged people to disable hyperthreading on all
Intel cpus.  I need to repeat that:

    DISABLE HYPERTHREADING ON ALL YOUR INTEL MACHINES IN THE BIOS.

Also, update your BIOS firmware, if you can.

OpenBSD -current (and therefore 6.4) will not use hyperthreading if it
is enabled, and will update the cpu microcode if possible.

But what about 6.2 and 6.3?

The situation is very complex, continually evolving, and is taking too
much manpower away from other tasks.  Furthermore, Intel isn't telling
us what is coming next, and are doing a terrible job by not publically
documenting what operating systems must do to resolve the problems.  We
are having to do research by reading other operating systems.  There is
no time left to backport the changes -- we will not be issuing a
complete set of errata and syspatches against 6.2 and 6.3 because it is
turning into a distraction.

Rather than working on every required patch for 6.2/6.3, we will
re-focus manpower and make sure 6.4 contains the best solutions
possible.

So please try take responsibility for your own machines: Disable SMT in
the BIOS menu, and upgrade your BIOS if you can.

I'm going to spend my money at a more trustworthy vendor in the future.
&lt;/code&gt;&lt;/pre&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://medium.com/@enzuru/get-morrowind-running-on-openbsd-in-5-simple-steps-b65e20f3f0c"&gt;Get Morrowind running on OpenBSD in 5 simple steps&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;This article contains brief instructions on how to get one of the greatest Western RPGs of all time, The Elder Scrolls III: Morrowind, running on OpenBSD using the OpenMW open source engine recreation. These instructions were tested on a ThinkPad X1 Carbon Gen 3. The information was adapted from this OpenMW forum thread: &lt;a href="https://forum.openmw.org/viewtopic.php?t=3510"&gt;https://forum.openmw.org/viewtopic.php?t=3510&lt;/a&gt;&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Purchase and download the DRM-free version from GOG (also considered the best version due to the high quality PDF guide that it comes with): &lt;a href="https://www.gog.com/game/the_elder_scrolls_iii_morrowind_goty_edition"&gt;https://www.gog.com/game/theelderscrollsiiimorrowindgotyedition&lt;/a&gt;
&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Install the required packages built from the ports tree as root. openmw is the recreated game engine, and innoextract is how we will get the game data files out of the win32 executable.&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;pkgadd openmw innoextract&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Move the file from GOG setuptesmorrowindgoty2.0.0.7.exe into its own directory morrowind/ due to innoextract’s default behaviour of extracting into the current directory. Then type:&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;innoextract setuptesmorrowindgoty2.0.0.7.exe&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Type openmw-wizard and follow the straightforward instructions. Note that you have a pre-existing installation, and select the morrowind/app/Data Files folder that innoextract extracted.&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Type in openmw-launcher, toggle the settings to your preferences, and then hit play!&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;br&gt;
&lt;a href="https://twitter.com/allanjude/status/1034647571124367360"&gt;https://twitter.com/allanjude/status/1034647571124367360&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://euroquis.nl/bobulate/?p=1937"&gt;My First Clang Bug&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Part of the role of being a packager is compiling lots (and lots) of packages. That means compiling lots of code from interesting places and in a variety of styles. In my opinion, being a good packager also means providing feedback to upstream when things are bad. That means filing upstream bugs when possible, and upstreaming patches.&lt;br&gt;
One of the “exciting” moments in packaging is when tools change. So each and every major CMake update is an exercise in recompiling 2400 or more packages and adjusting bits and pieces. When a software project was last released in 2013, adjusting it to modern tools can become quite a chore (e.g. Squid Report Generator). CMake is excellent for maintaining backwards compatibility, generally accommodating old software with new policies. The most recent 3.12 release candidate had three issues filed from the FreeBSD side, all from fallout with older software.  I consider the hours put into good bug reports, part of being a good citizen of the Free Software world.&lt;br&gt;
My most interesting bug this week, though, came from one line of code somewhere in Kleopatra: QUNUSED(gpgagentdata);&lt;br&gt;
That one line triggered a really peculiar link error in KDE’s FreeBSD CI system. Yup … telling the compiler something is unused made it fall over. Commenting out that line got rid of the link error, but introduced a warning about an unused function. Working with KDE-PIM’s Volker Krause, we whittled the problem down to a six-line example program — two lines if you don’t care much for coding style. I’m glad, at that point, that I could throw it over the hedge to the LLVM team with some explanatory text. Watching the process on their side reminds me ever-so-strongly of how things work in KDE (or FreeBSD for that matter): Bugzilla, Phabricator, and git combine to be an effective workflow for developers (perhaps less so for end-users).&lt;br&gt;
Today I got a note saying that the issue had been resolved. So brief a time for a bug. Live fast. Get squashed young.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.phoronix.com/scan.php?page=newsitem&amp;amp;px=Threadripper-2990WX-DragonFly"&gt;DragonFlyBSD Now Runs On The Threadripper 2990WX, Developer Shocked At Performance&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Last week I carried out some tests of BSD vs. Linux on the new 32-core / 64-thread Threadripper 2990WX. I tested FreeBSD 11, FreeBSD 12, and TrueOS – those benchmarks will be published in the next few days. I tried DragonFlyBSD, but at the time it wouldn’t boot with this AMD HEDT processor. But now the latest DragonFlyBSD development kernel can handle the 2990WX and the lead DragonFly developer calls this new processor “a real beast” and is stunned by its performance potential.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;When I tried last week, the DragonFlyBSD 5.2.2 stable release nor DragonFlyBSD 5.3 daily snapshot would boot on the 2990WX. But it turns out Matthew Dillon, the lead developer of DragonFlyBSD, picked up a rig and has it running now. So in time for the next 5.4 stable release or those using the daily snapshots can have this 32-core / 64-thread Zen+ CPU running on this operating system long ago forked from FreeBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;In announcing his success in bringing up the 2990WX under DragonFlyBSD, which required a few minor changes, he shared his performance thoughts and hopes for the rig. “The cpu is a real beast, packing 32 cores and 64 threads. It blows away our dual-core Xeon to the tune of being +50% faster in concurrent compile tests, and it also blows away our older 4-socket Opteron (which we call ‘Monster’) by about the same margin. It’s an impressive CPU. For now the new beast is going to be used to help us improve I/O performance through the filesystem, further SMP work (but DFly scales pretty well to 64 threads already), and perhaps some driver to work to support the 10gbe on the mobo.”&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Dillon shared some results on the system as well. " The Threadripper 2990WX is a beast. It is at &lt;em&gt;least&lt;/em&gt; 50% faster than both the quad socket opteron and the dual socket Xeon system I tested against. The primary limitation for the 2990WX is likely its 4 channels of DDR4 memory, and like all Zen and Zen+ CPUs, memory performance matters more than CPU frequency (and costs almost no power to pump up the performance). That said, it still blow away a dual-socket Xeon with 3x the number of memory channels. That is impressive!"&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The well known BSD developer also added, “This puts the 2990WX at par efficiency vs a dual-socket Xeon system, and better than the dual-socket Xeon with slower memory and a power cap. This is VERY impressive. I should note that the 2990WX is more specialized with its asymetric NUMA architecture and 32 cores. I think the sweet spot in terms of CPU pricing and efficiency is likely going to be with the 2950X (16-cores/32-threads). It is clear that the 2990WX (32-cores/64-threads) will max out 4-channel memory bandwidth for many workloads, making it a more specialized part. But still awesome…This thing is an incredible beast, I’m glad I got it.”&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;While I have the FreeBSD vs. Linux benchmarks from a few days ago, it looks like now on my ever growing TODO list will be re-trying out the newest DragonFlyBSD daily snapshot for seeing how the performance compares in the mix. Stay tuned for the numbers that should be in the next day or two.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180810075449"&gt;X11 on really small devices&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180810131231"&gt;mandoc-1.14.4 released&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.netgate.com/blog/pfSense-book-available-to-everyone.html"&gt;The pfSense Book is now available to everyone&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mwl.io/archives/3619"&gt;MWL: Burn it down! Burn it all down!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/begriffs/obsd"&gt;Configuring OpenBSD: System and user config files for a more pleasant laptop&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-18:08.tcp.asc"&gt;FreeBSD Security Advisory: Resource exhaustion in TCP reassembly&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://discoverbsd.com/p/92d80d1497"&gt;OpenBSD Foundation gets first 2018 Iridium donation&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=337653"&gt;New ZFS commit solves issue a few users reported in the feedback segment&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/TridentProject/status/1034620476553867264"&gt;Project Trident should have a beta release by the end of next week&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/BSD-Users-Stockholm/events/253447019/"&gt;Reminder about Stockholm BUG: September 5, 17:30-22:00&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://bsd-pl.org/en"&gt;BSD-PL User Group: September 13, 18:30-21:00&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Malcom - &lt;a href="http://dpaste.com/15VVVCP"&gt;Having different routes per interface&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Bostjan - &lt;a href="http://dpaste.com/1Q14C6H#wrap"&gt;ZFS and integrity of data&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Michael - &lt;a href="http://dpaste.com/2JD17BP#wrap"&gt;Suggestion for Monitoring&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Barry - &lt;a href="http://dpaste.com/2GJ3RMG#wrap"&gt;Feedback&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, Hyperthreading, TLBleed, T1TF, Foreshadow, pf-badhost, Threadripper, X11</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Insight into TrueOS and Trident, stop evildoers with pf-badhost, Flashback to FreeBSDcon ‘99, OpenBSD’s measures against TLBleed, play Morrowind on OpenBSD in 5 steps, DragonflyBSD developers shocked at Threadripper performance, and more.</p>

<p>##Headlines<br>
###<a href="https://itsfoss.com/project-trident-interview/">An Insight into the Future of TrueOS BSD and Project Trident</a></p>

<blockquote>
<p>Last month, TrueOS announced that they would be spinning off their desktop offering. The team behind the new project, named Project Trident, have been working furiously towards their first release. They did take a few minutes to answer some of our question about Project Trident and TrueOS. I would like to thank JT and Ken for taking the time to compile these answers.</p>
</blockquote>

<ul>
<li>It’s FOSS: What is Project Trident?</li>
</ul>

<blockquote>
<p>Project Trident: Project Trident is the continuation of the TrueOS Desktop. Essentially, it is the continuation of the primary “TrueOS software” that people have been using for the past 2 years. The continuing evolution of the entire TrueOS project has reached a stage where it became necessary to reorganize the project. To understand this change, it is important to know the history of the TrueOS project.</p>
</blockquote>

<blockquote>
<p>Originally, Kris Moore created PC-BSD. This was a Desktop release of FreeBSD focused on providing a simple and user-friendly graphical experience for FreeBSD. PC-BSD grew and matured over many years. During the evolution of PC-BSD, many users began asking for a server focused version of the software. Kris agreed, and TrueOS was born as a scaled down server version of PC-BSD. In late 2016, more contributors and growth resulted in significant changes to the PC-BSD codebase. Because the new development was so markedly different from the original PC-BSD design, it was decided to rebrand the project.</p>
</blockquote>

<blockquote>
<p>TrueOS was chosen as the name for this new direction for PC-BSD as the project had grown beyond providing only a graphical front to FreeBSD and was beginning to make fundamental changes to the FreeBSD operating system. One of these changes was moving PC-BSD from being based on each FreeBSD Release to TrueOS being based on the active and less outdated FreeBSD Current. Other major changes are using OpenRC for service management and being more aggressive about addressing long-standing issues with the FreeBSD release process. TrueOS moved toward a rolling release cycle, twice a year, which tested and merged FreeBSD changes directly from the developer instead of waiting months or even years for the FreeBSD review process to finish. TrueOS also deprecated and removed obsolete technology much more regularly.</p>
</blockquote>

<blockquote>
<p>As the TrueOS Project grew, the developers found these changes were needed by other FreeBSD-based projects. These projects began expressing interest in using TrueOS rather than FreeBSD as the base for their project. This demonstrated that TrueOS needed to again evolve into a distribution framework for any BSD project to use. This allows port maintainers and source developers from any BSD project to pool their resources and use the same source repositories while allowing every distribution to still customize, build, and release their own self-contained project. The result is a natural split of the traditional TrueOS team. There were now naturally two teams in the TrueOS project: those working on the build infrastructure and FreeBSD enhancements – the “core” part of the project, and those working on end-user experience and utility – the “desktop” part of the project.</p>
</blockquote>

<blockquote>
<p>When the decision was made to formally split the projects, the obvious question that arose was what to call the “Desktop” project. As TrueOS was already positioned to be a BSD distribution platform, the developers agreed the desktop side should pick a new name. There were other considerations too, one notable being that we were concerned that if we continued to call the desktop project “TrueOS Desktop”, it would prevent people from considering TrueOS as the basis for their distribution because of misconceptions that TrueOS was a desktop-focused OS. It also helps to “level the playing field” for other desktop distributions like GhostBSD so that TrueOS is not viewed as having a single “blessed” desktop version.</p>
</blockquote>

<ul>
<li>It’s FOSS: What features will TrueOS add to the FreeBSD base?</li>
</ul>

<blockquote>
<p>Project Trident: TrueOS has already added a number of features to FreeBSD:<br>
OpenRC replaces rc.d for service management<br>
LibreSSL in base<br>
Root NSS certificates out-of-box<br>
Scriptable installations (pc-sysinstall)<br>
The full list of changes can be seen on the TrueOS repository (<a href="https://github.com/trueos/trueos/blob/trueos-master/README.md">https://github.com/trueos/trueos/blob/trueos-master/README.md</a>). This list does change quite regularly as FreeBSD development itself changes.</p>
</blockquote>

<ul>
<li>It’s FOSS: I understand that TrueOS will have a new feature that will make creating a desktop spin of TrueOS very easy. Could you explain that new feature?</li>
</ul>

<blockquote>
<p>Project Trident: Historically, one of the biggest hurdles for creating a desktop version of FreeBSD is that the build options for packages are tuned for servers rather than desktops. This means a desktop distribution cannot use the pre-built packages from FreeBSD and must build, use, and maintain a custom package repository. Maintaining a fork of the FreeBSD ports tree is no trivial task. TrueOS has created a full distribution framework so now all it takes to create a custom build of FreeBSD is a single JSON manifest file. There is now a single “source of truth” for the source and ports repositories that is maintained by the TrueOS team and regularly tagged with “stable” build markers. All projects can use this framework, which makes updates trivial.</p>
</blockquote>

<ul>
<li>It’s FOSS: Do you think that the new focus of TrueOS will lead to the creation of more desktop-centered BSDs?</li>
</ul>

<blockquote>
<p>Project Trident: That is the hope. Historically, creating a desktop-centered BSD has required a lot of specialized knowledge. Not only do most people not have this knowledge, but many do not even know what they need to learn until they start troubleshooting. TrueOS is trying to drastically simplify this process to enable the wider Open Source community to experiment, contribute, and enjoy BSD-based projects.</p>
</blockquote>

<ul>
<li>It’s FOSS: What is going to happen to TrueOS Pico? Will Project Trident have ARM support?</li>
</ul>

<blockquote>
<p>Project Trident: Project Trident will be dependent on TrueOS for ARM support. The developers have talked about the possibility of supporting ARM64 and RISC-V architectures, but it is not possible at the current time. If more Open Source contributors want to help develop ARM and RISC-V support, the TrueOS project is definitely willing to help test and integrate that code.</p>
</blockquote>

<ul>
<li>It’s FOSS: What does this change (splitting Trus OS into Project Trident) mean for the Lumina desktop environment?</li>
</ul>

<blockquote>
<p>Project Trident: Long-term, almost nothing. Lumina is still the desktop environment for Project Trident and will continue to be developed and enhanced alongside Project Trident just as it was for TrueOS. Short-term, we will be delaying the release of Lumina 2.0 and will release an updated version of the 1.x branch (1.5.0) instead. This is simply due to all the extra overhead to get Project Trident up and running. When things settle down into a rhythm, the development of Lumina will pick up once again.</p>
</blockquote>

<ul>
<li>It’s FOSS: Are you planning on including any desktop environments besides Lumina?</li>
</ul>

<blockquote>
<p>Project Trident: While Lumina is included by default, all of the other popular desktop environments will be available in the package repo exactly as they had been before.</p>
</blockquote>

<ul>
<li>It’s FOSS: Any plans to include Steam to increase the userbase?</li>
</ul>

<blockquote>
<p>Project Trident: Steam is still unavailable natively on FreeBSD, so we do not have any plans to ship it out of the box currently. In the meantime, we highly recommend installing the Windows version of Steam through the PlayOnBSD utility.</p>
</blockquote>

<ul>
<li>It’s FOSS: What will happen to the AppCafe?</li>
</ul>

<blockquote>
<p>Project Trident: The AppCafe is the name of the graphical interface for the “pkg” utility integrated into the SysAdm client created by TrueOS. This hasn’t changed. SysAdm, the graphical client, and by extension AppCafe are still available for all TrueOS-based distributions to use.</p>
</blockquote>

<ul>
<li>It’s FOSS: Does Project Trident have any corporate sponsors lined up? If not, would you be open to it or would you prefer that it be community supported?</li>
</ul>

<blockquote>
<p>Project Trident: iXsystems is the first corporate sponsor of Project Trident and we are always open to other sponsorships as well. We would prefer smaller individual contributions from the community, but we understand that larger project needs or special-purpose goals are much more difficult to achieve without allowing larger corporate sponsorships as well. In either case, Project Trident is always looking out for the best interests of the community and will not allow intrusive or harmful code to enter the project even if a company or individual tries to make that code part of a sponsorship deal.</p>
</blockquote>

<ul>
<li>It’s FOSS: BSD always seems to be lagging in terms of support for newer devices. Will TrueOS be able to remedy that with a quicker release cycle?</li>
</ul>

<blockquote>
<p>Project Trident: Yes! That was a primary reason for TrueOS to start tracking the CURRENT branch of FreeBSD in 2016. This allows for the changes that FreeBSD developers are making, including new hardware support, to be available much sooner than if we followed the FreeBSD release cycle.</p>
</blockquote>

<ul>
<li>It’s FOSS: Do you have any idea when Project Trident will have its first release?</li>
</ul>

<blockquote>
<p>Project Trident: Right now we are targeting a late August release date. This is because Project Trident is “kicking the wheels” on the new TrueOS distribution system. We want to ensure everything is working smoothly before we release. Going forward, we plan on having regular package updates every week or two for the end-user packages and a new release of Trident with an updated OS version every 6 months. This will follow the TrueOS release schedule with a small time offset.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.geoghegan.ca/pfbadhost.html">pf-badhost: Stop the evil doers in their tracks!</a></p>

<blockquote>
<p>pf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet’s biggest irritants. Annoyances such as ssh bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.<br>
Filtering performance is exceptional, as the badhost list is stored in a pf table. To quote the OpenBSD FAQ page regarding tables: “the lookup time on a table holding 50,000 addresses is only slightly more than for one holding 50 addresses.”<br>
pf-badhost is simple and powerful. The blocklists are pulled from quality, trusted sources. The ‘Firehol’, ‘Emerging Threats’ and ‘Binary Defense’ block lists are used as they are popular, regularly updated lists of the internet’s most egregious offenders. The <a href="http://pf-badhost.sh">pf-badhost.sh</a> script can easily be expanded to use additional or alternate blocklists.<br>
pf-badhost works best when used in conjunction with unbound-adblock for the ultimate badhost blocking.</p>
</blockquote>

<ul>
<li>Notes:</li>
<li>If you are trying to run pf-badhost on a LAN or are using NAT, you will want to add a rule to your pf.conf appearing BEFORE the pf-badhost rules allowing traffic to and from your local subnet so that you can still access your gateway and any DNS servers.</li>
<li>Conversely, adding a line to <a href="http://pf-badhost.sh">pf-badhost.sh</a> that removes your subnet range from the &lt;pfbadhost&gt; table should also work. Just make sure you choose a subnet range / CIDR block that is actually in the list. 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 are the most common home/office subnet ranges.</li>
</ul>

<p><hr></p>

<p><strong>DigitalOcean</strong><br>
<a href="https://do.co/bsdnow">https://do.co/bsdnow</a></p>

<p>###<a href="http://edition.cnn.com/TECH/computing/9911/01/freebsd.con99.idg/">FLASHBACK: FreeBSDCon’99: Fans of Linux’s lesser-known sibling gather for the first time</a></p>

<blockquote>
<p>FreeBSD, a port of BSD Unix to Intel, has been around almost as long as Linux has – but without the media hype. Its developer and user community recently got a chance to get together for the first time, and they did it in the city where BSD – the Berkeley Software Distribution – was born some 25 years ago.<br>
October 17, 1999 marked a milestone in the history of FreeBSD – the first FreeBSD conference was held in the city where it all began, Berkeley, CA. Over 300 developers, users, and interested parties attended from around the globe.<br>
This was easily 50 percent more people than the conference organizers had expected. This first conference was meant to be a gathering mostly for developers and FreeBSD advocates. The turnout was surprisingly (and gratifyingly) large.<br>
In fact, attendance exceeded expectations so much that, for instance, Kirk McKusick had to add a second, identical tutorial on FreeBSD internals, because it was impossible for everyone to attend the first!<br>
But for a first-ever conference, I was impressed by how smoothly everything seemed to go. Sessions started on time, and the sessions I attended were well-run; nothing seemed to be too cold, dark, loud, late, or off-center.<br>
Of course, the best part about a conference such as this one is the opportunity to meet with other people who share similar interests. Lunches and breaks were a good time to meet people, as was the Tuesday night beer bash.<br>
The Wednesday night reception was of a type unusual for the technical conferences I usually attend – a three-hour Hornblower dinner cruise on San Francisco Bay. Not only did we all enjoy excellent food and company, but we all got to go up on deck and watch the lights of San Francisco and Berkeley as we drifted by. Although it’s nice when a conference attracts thousands of attendees, there are some things that can only be done with smaller groups of people; this was one of them.<br>
In short, this was a tiny conference, but a well-run one.</p>
</blockquote>

<ul>
<li>Sessions</li>
</ul>

<blockquote>
<p>Although it was a relatively small conference, the number and quality of the sessions belied the size. Each of the three days of the conference featured a different keynote speaker. In addition to Jordan Hubbard, Jeremy Allison spoke on “Samba Futures” on day two, and Brian Behlendorf gave a talk on “FreeBSD and Apache: A Perfect Combo” to start off the third day.<br>
The conference sessions themselves were divided into six tracks: advocacy, business, development, networking, security, and panels. The panels track featured three different panels, made up of three different slices of the community: the FreeBSD core team, a press panel, and a prominent user panel with representatives from such prominent commercial users as Yahoo! and USWest.<br>
I was especially interested in Apple Computer’s talk in the development track. Wilfredo Sanchez, technical lead for open source projects at Apple (no, that’s not an oxymoron!) spoke about Apple’s Darwin project, the company’s operating system road map, and the role of BSD (and, specifically, FreeBSD) in Apple’s plans.<br>
Apple and Unix have had a long and uneasy history, from the Lisa through the A/UX project to today. Personally, I’m very optimistic about the chances for the Darwin project to succeed. Apple’s core OS kernel team has chosen FreeBSD as its reference platform. I’m looking forward to what this partnership will bring to both sides.<br>
Other development track sessions included in-depth tutorials on writing device drivers, basics of the Vinum Volume Manager, Fibre Channel, development models (the open repository model), and the FreeBSD Documentation Project (FDP). If you’re interested in contributing to the FreeBSD project, the FDP is a good place to start.<br>
Advocacy sessions included “How One Person Can Make a Difference” (a timeless topic that would find a home at any technical conference!) and “Starting and Managing A User Group” (trials and tribulations as well as rewards).<br>
The business track featured speakers from three commercial users of FreeBSD: Cybernet, USWest, and Applix. Applix presented its port of Applixware Office for FreeBSD and explained how Applix has taken the core services of Applixware into open source.<br>
Commercial applications and open source were once a rare combination; we can only hope the trend away from that state of affairs will continue.</p>
</blockquote>

<ul>
<li>Commercial use of FreeBSD</li>
</ul>

<blockquote>
<p>The use of FreeBSD in embedded applications is increasing as well – and it is increasing at the same rate that hardware power is. These days, even inexpensive systems are able to run a BSD kernel.<br>
The BSD license and the solid TCP/IP stack prove significant enticements to this market as well. (Unlike the GNU Public License, the BSD license does not require that vendors make derivative works open source.)<br>
Companies such as USWest and Verio use FreeBSD for a wide variety of different Internet services.<br>
Yahoo! and Hotmail are examples of companies that use FreeBSD extensively for more specific purposes. Yahoo!, for example, has many hundreds of FreeBSD boxes, and Hotmail has almost 2000 FreeBSD machines at its data center in the San Francisco Bay area.<br>
Hotmail is owned by Microsoft, so the fact that it runs FreeBSD is a secret. Don’t tell anyone…<br>
When asked to comment on the increasing commercial interest in BSD, Hubbard said that FreeBSD is learning the Red Hat lesson. “Walnut Creek and others with business interests in FreeBSD have learned a few things from the Red Hat IPO,” he said, “and nobody is just sitting around now, content with business as usual. It’s clearly business as unusual in the open source world today.”<br>
Hubbard had also singled out some of BSD’s commercial partners, such as Whistle Communications, for praise in his opening day keynote. These partners play a key role in moving the project forward, he said, by contributing various enhancements and major new systems, such as Netgraph, as well as by contributing paid employee time spent on FreeBSD.<br>
Even short FreeBSD-related contacts can yield good results, Hubbard said. An example of this is the new jail() security code introduced in FreeBSD 3.x and 4.0, which was contributed by R &amp; D Associates. A number of ISPs are also now donating the hardware and bandwidth that allows the project to provide more resource mirrors and experimental development sites.</p>
</blockquote>

<ul>
<li>See you next year</li>
</ul>

<blockquote>
<p>And speaking of corporate sponsors, thanks go to Walnut Creek for sponsoring the conference, and to Yahoo! for covering all the expenses involved in bringing the entire FreeBSD core team to Berkeley.<br>
As a fan of FreeBSD, I’m happy to see that the project has finally produced a conference. It was time: many of the 16 core team members had been working together on a regular basis for nearly seven years without actually meeting face to face.<br>
It’s been an interesting year for open source projects. I’m looking forward to the next year – and the next BSD conference – to be even better.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://marc.info/?l=openbsd-tech&amp;m=153504937925732&amp;w=2">OpenBSD Recommends: Disable SMT/Hyperthreading in all Intel BIOSes</a></p>

<pre><code>Two recently disclosed hardware bugs affected Intel cpus:

     - TLBleed

     - T1TF (the name &quot;Foreshadow&quot; refers to 1 of 3 aspects of this
             bug, more aspects are surely on the way)

Solving these bugs requires new cpu microcode, a coding workaround,
*AND* the disabling of SMT / Hyperthreading.

SMT is fundamentally broken because it shares resources between the two
cpu instances and those shared resources lack security differentiators.
Some of these side channel attacks aren't trivial, but we can expect
most of them to eventually work and leak kernel or cross-VM memory in
common usage circumstances, even such as javascript directly in a
browser.

There will be more hardware bugs and artifacts disclosed.  Due to the
way SMT interacts with speculative execution on Intel cpus, I expect SMT
to exacerbate most of the future problems.

A few months back, I urged people to disable hyperthreading on all
Intel cpus.  I need to repeat that:

    DISABLE HYPERTHREADING ON ALL YOUR INTEL MACHINES IN THE BIOS.

Also, update your BIOS firmware, if you can.

OpenBSD -current (and therefore 6.4) will not use hyperthreading if it
is enabled, and will update the cpu microcode if possible.

But what about 6.2 and 6.3?

The situation is very complex, continually evolving, and is taking too
much manpower away from other tasks.  Furthermore, Intel isn't telling
us what is coming next, and are doing a terrible job by not publically
documenting what operating systems must do to resolve the problems.  We
are having to do research by reading other operating systems.  There is
no time left to backport the changes -- we will not be issuing a
complete set of errata and syspatches against 6.2 and 6.3 because it is
turning into a distraction.

Rather than working on every required patch for 6.2/6.3, we will
re-focus manpower and make sure 6.4 contains the best solutions
possible.

So please try take responsibility for your own machines: Disable SMT in
the BIOS menu, and upgrade your BIOS if you can.

I'm going to spend my money at a more trustworthy vendor in the future.
</code></pre>

<p><hr></p>

<p>###<a href="https://medium.com/@enzuru/get-morrowind-running-on-openbsd-in-5-simple-steps-b65e20f3f0c">Get Morrowind running on OpenBSD in 5 simple steps</a></p>

<blockquote>
<p>This article contains brief instructions on how to get one of the greatest Western RPGs of all time, The Elder Scrolls III: Morrowind, running on OpenBSD using the OpenMW open source engine recreation. These instructions were tested on a ThinkPad X1 Carbon Gen 3. The information was adapted from this OpenMW forum thread: <a href="https://forum.openmw.org/viewtopic.php?t=3510">https://forum.openmw.org/viewtopic.php?t=3510</a></p>
</blockquote>

<ul>
<li>
<ol>
<li>Purchase and download the DRM-free version from GOG (also considered the best version due to the high quality PDF guide that it comes with): <a href="https://www.gog.com/game/the_elder_scrolls_iii_morrowind_goty_edition">https://www.gog.com/game/the_elder_scrolls_iii_morrowind_goty_edition</a></li>
</ol>
</li>
<li>
<ol start="2">
<li>Install the required packages built from the ports tree as root. openmw is the recreated game engine, and innoextract is how we will get the game data files out of the win32 executable.</li>
</ol>
</li>
</ul>

<p><code>pkg_add openmw innoextract</code></p>

<ul>
<li>
<ol start="3">
<li>Move the file from GOG setup_tes_morrowind_goty_2.0.0.7.exe into its own directory morrowind/ due to innoextract’s default behaviour of extracting into the current directory. Then type:</li>
</ol>
</li>
</ul>

<p><code>innoextract setup_tes_morrowind_goty_2.0.0.7.exe</code></p>

<ul>
<li>
<ol start="4">
<li>Type openmw-wizard and follow the straightforward instructions. Note that you have a pre-existing installation, and select the morrowind/app/Data Files folder that innoextract extracted.</li>
</ol>
</li>
<li>
<ol start="5">
<li>Type in openmw-launcher, toggle the settings to your preferences, and then hit play!</li>
</ol>
</li>
</ul>

<p><hr></p>

<p><strong>iXsystems</strong><br>
<a href="https://twitter.com/allanjude/status/1034647571124367360">https://twitter.com/allanjude/status/1034647571124367360</a></p>

<p>###<a href="https://euroquis.nl/bobulate/?p=1937">My First Clang Bug</a></p>

<blockquote>
<p>Part of the role of being a packager is compiling lots (and lots) of packages. That means compiling lots of code from interesting places and in a variety of styles. In my opinion, being a good packager also means providing feedback to upstream when things are bad. That means filing upstream bugs when possible, and upstreaming patches.<br>
One of the “exciting” moments in packaging is when tools change. So each and every major CMake update is an exercise in recompiling 2400 or more packages and adjusting bits and pieces. When a software project was last released in 2013, adjusting it to modern tools can become quite a chore (e.g. Squid Report Generator). CMake is excellent for maintaining backwards compatibility, generally accommodating old software with new policies. The most recent 3.12 release candidate had three issues filed from the FreeBSD side, all from fallout with older software.  I consider the hours put into good bug reports, part of being a good citizen of the Free Software world.<br>
My most interesting bug this week, though, came from one line of code somewhere in Kleopatra: Q_UNUSED(gpgagent_data);<br>
That one line triggered a really peculiar link error in KDE’s FreeBSD CI system. Yup … telling the compiler something is unused made it fall over. Commenting out that line got rid of the link error, but introduced a warning about an unused function. Working with KDE-PIM’s Volker Krause, we whittled the problem down to a six-line example program — two lines if you don’t care much for coding style. I’m glad, at that point, that I could throw it over the hedge to the LLVM team with some explanatory text. Watching the process on their side reminds me ever-so-strongly of how things work in KDE (or FreeBSD for that matter): Bugzilla, Phabricator, and git combine to be an effective workflow for developers (perhaps less so for end-users).<br>
Today I got a note saying that the issue had been resolved. So brief a time for a bug. Live fast. Get squashed young.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.phoronix.com/scan.php?page=news_item&amp;px=Threadripper-2990WX-DragonFly">DragonFlyBSD Now Runs On The Threadripper 2990WX, Developer Shocked At Performance</a></p>

<blockquote>
<p>Last week I carried out some tests of BSD vs. Linux on the new 32-core / 64-thread Threadripper 2990WX. I tested FreeBSD 11, FreeBSD 12, and TrueOS – those benchmarks will be published in the next few days. I tried DragonFlyBSD, but at the time it wouldn’t boot with this AMD HEDT processor. But now the latest DragonFlyBSD development kernel can handle the 2990WX and the lead DragonFly developer calls this new processor “a real beast” and is stunned by its performance potential.</p>
</blockquote>

<blockquote>
<p>When I tried last week, the DragonFlyBSD 5.2.2 stable release nor DragonFlyBSD 5.3 daily snapshot would boot on the 2990WX. But it turns out Matthew Dillon, the lead developer of DragonFlyBSD, picked up a rig and has it running now. So in time for the next 5.4 stable release or those using the daily snapshots can have this 32-core / 64-thread Zen+ CPU running on this operating system long ago forked from FreeBSD.</p>
</blockquote>

<blockquote>
<p>In announcing his success in bringing up the 2990WX under DragonFlyBSD, which required a few minor changes, he shared his performance thoughts and hopes for the rig. “The cpu is a real beast, packing 32 cores and 64 threads. It blows away our dual-core Xeon to the tune of being +50% faster in concurrent compile tests, and it also blows away our older 4-socket Opteron (which we call ‘Monster’) by about the same margin. It’s an impressive CPU. For now the new beast is going to be used to help us improve I/O performance through the filesystem, further SMP work (but DFly scales pretty well to 64 threads already), and perhaps some driver to work to support the 10gbe on the mobo.”</p>
</blockquote>

<blockquote>
<p>Dillon shared some results on the system as well. &quot; The Threadripper 2990WX is a beast. It is at <em>least</em> 50% faster than both the quad socket opteron and the dual socket Xeon system I tested against. The primary limitation for the 2990WX is likely its 4 channels of DDR4 memory, and like all Zen and Zen+ CPUs, memory performance matters more than CPU frequency (and costs almost no power to pump up the performance). That said, it still blow away a dual-socket Xeon with 3x the number of memory channels. That is impressive!&quot;</p>
</blockquote>

<blockquote>
<p>The well known BSD developer also added, “This puts the 2990WX at par efficiency vs a dual-socket Xeon system, and better than the dual-socket Xeon with slower memory and a power cap. This is VERY impressive. I should note that the 2990WX is more specialized with its asymetric NUMA architecture and 32 cores. I think the sweet spot in terms of CPU pricing and efficiency is likely going to be with the 2950X (16-cores/32-threads). It is clear that the 2990WX (32-cores/64-threads) will max out 4-channel memory bandwidth for many workloads, making it a more specialized part. But still awesome…This thing is an incredible beast, I’m glad I got it.”</p>
</blockquote>

<blockquote>
<p>While I have the FreeBSD vs. Linux benchmarks from a few days ago, it looks like now on my ever growing TODO list will be re-trying out the newest DragonFlyBSD daily snapshot for seeing how the performance compares in the mix. Stay tuned for the numbers that should be in the next day or two.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180810075449">X11 on really small devices</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180810131231">mandoc-1.14.4 released</a></li>
<li><a href="https://www.netgate.com/blog/pfSense-book-available-to-everyone.html">The pfSense Book is now available to everyone</a></li>
<li><a href="https://mwl.io/archives/3619">MWL: Burn it down! Burn it all down!</a></li>
<li><a href="https://github.com/begriffs/obsd">Configuring OpenBSD: System and user config files for a more pleasant laptop</a></li>
<li><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-18:08.tcp.asc">FreeBSD Security Advisory: Resource exhaustion in TCP reassembly</a></li>
<li><a href="https://discoverbsd.com/p/92d80d1497">OpenBSD Foundation gets first 2018 Iridium donation</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=337653">New ZFS commit solves issue a few users reported in the feedback segment</a></li>
<li><a href="https://twitter.com/TridentProject/status/1034620476553867264">Project Trident should have a beta release by the end of next week</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/253447019/">Reminder about Stockholm BUG: September 5, 17:30-22:00</a></li>
<li><a href="https://bsd-pl.org/en">BSD-PL User Group: September 13, 18:30-21:00</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Malcom - <a href="http://dpaste.com/15VVVCP">Having different routes per interface</a></li>
<li>Bostjan - <a href="http://dpaste.com/1Q14C6H#wrap">ZFS and integrity of data</a></li>
<li>Michael - <a href="http://dpaste.com/2JD17BP#wrap">Suggestion for Monitoring</a></li>
<li>Barry - <a href="http://dpaste.com/2GJ3RMG#wrap">Feedback</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Insight into TrueOS and Trident, stop evildoers with pf-badhost, Flashback to FreeBSDcon ‘99, OpenBSD’s measures against TLBleed, play Morrowind on OpenBSD in 5 steps, DragonflyBSD developers shocked at Threadripper performance, and more.</p>

<p>##Headlines<br>
###<a href="https://itsfoss.com/project-trident-interview/">An Insight into the Future of TrueOS BSD and Project Trident</a></p>

<blockquote>
<p>Last month, TrueOS announced that they would be spinning off their desktop offering. The team behind the new project, named Project Trident, have been working furiously towards their first release. They did take a few minutes to answer some of our question about Project Trident and TrueOS. I would like to thank JT and Ken for taking the time to compile these answers.</p>
</blockquote>

<ul>
<li>It’s FOSS: What is Project Trident?</li>
</ul>

<blockquote>
<p>Project Trident: Project Trident is the continuation of the TrueOS Desktop. Essentially, it is the continuation of the primary “TrueOS software” that people have been using for the past 2 years. The continuing evolution of the entire TrueOS project has reached a stage where it became necessary to reorganize the project. To understand this change, it is important to know the history of the TrueOS project.</p>
</blockquote>

<blockquote>
<p>Originally, Kris Moore created PC-BSD. This was a Desktop release of FreeBSD focused on providing a simple and user-friendly graphical experience for FreeBSD. PC-BSD grew and matured over many years. During the evolution of PC-BSD, many users began asking for a server focused version of the software. Kris agreed, and TrueOS was born as a scaled down server version of PC-BSD. In late 2016, more contributors and growth resulted in significant changes to the PC-BSD codebase. Because the new development was so markedly different from the original PC-BSD design, it was decided to rebrand the project.</p>
</blockquote>

<blockquote>
<p>TrueOS was chosen as the name for this new direction for PC-BSD as the project had grown beyond providing only a graphical front to FreeBSD and was beginning to make fundamental changes to the FreeBSD operating system. One of these changes was moving PC-BSD from being based on each FreeBSD Release to TrueOS being based on the active and less outdated FreeBSD Current. Other major changes are using OpenRC for service management and being more aggressive about addressing long-standing issues with the FreeBSD release process. TrueOS moved toward a rolling release cycle, twice a year, which tested and merged FreeBSD changes directly from the developer instead of waiting months or even years for the FreeBSD review process to finish. TrueOS also deprecated and removed obsolete technology much more regularly.</p>
</blockquote>

<blockquote>
<p>As the TrueOS Project grew, the developers found these changes were needed by other FreeBSD-based projects. These projects began expressing interest in using TrueOS rather than FreeBSD as the base for their project. This demonstrated that TrueOS needed to again evolve into a distribution framework for any BSD project to use. This allows port maintainers and source developers from any BSD project to pool their resources and use the same source repositories while allowing every distribution to still customize, build, and release their own self-contained project. The result is a natural split of the traditional TrueOS team. There were now naturally two teams in the TrueOS project: those working on the build infrastructure and FreeBSD enhancements – the “core” part of the project, and those working on end-user experience and utility – the “desktop” part of the project.</p>
</blockquote>

<blockquote>
<p>When the decision was made to formally split the projects, the obvious question that arose was what to call the “Desktop” project. As TrueOS was already positioned to be a BSD distribution platform, the developers agreed the desktop side should pick a new name. There were other considerations too, one notable being that we were concerned that if we continued to call the desktop project “TrueOS Desktop”, it would prevent people from considering TrueOS as the basis for their distribution because of misconceptions that TrueOS was a desktop-focused OS. It also helps to “level the playing field” for other desktop distributions like GhostBSD so that TrueOS is not viewed as having a single “blessed” desktop version.</p>
</blockquote>

<ul>
<li>It’s FOSS: What features will TrueOS add to the FreeBSD base?</li>
</ul>

<blockquote>
<p>Project Trident: TrueOS has already added a number of features to FreeBSD:<br>
OpenRC replaces rc.d for service management<br>
LibreSSL in base<br>
Root NSS certificates out-of-box<br>
Scriptable installations (pc-sysinstall)<br>
The full list of changes can be seen on the TrueOS repository (<a href="https://github.com/trueos/trueos/blob/trueos-master/README.md">https://github.com/trueos/trueos/blob/trueos-master/README.md</a>). This list does change quite regularly as FreeBSD development itself changes.</p>
</blockquote>

<ul>
<li>It’s FOSS: I understand that TrueOS will have a new feature that will make creating a desktop spin of TrueOS very easy. Could you explain that new feature?</li>
</ul>

<blockquote>
<p>Project Trident: Historically, one of the biggest hurdles for creating a desktop version of FreeBSD is that the build options for packages are tuned for servers rather than desktops. This means a desktop distribution cannot use the pre-built packages from FreeBSD and must build, use, and maintain a custom package repository. Maintaining a fork of the FreeBSD ports tree is no trivial task. TrueOS has created a full distribution framework so now all it takes to create a custom build of FreeBSD is a single JSON manifest file. There is now a single “source of truth” for the source and ports repositories that is maintained by the TrueOS team and regularly tagged with “stable” build markers. All projects can use this framework, which makes updates trivial.</p>
</blockquote>

<ul>
<li>It’s FOSS: Do you think that the new focus of TrueOS will lead to the creation of more desktop-centered BSDs?</li>
</ul>

<blockquote>
<p>Project Trident: That is the hope. Historically, creating a desktop-centered BSD has required a lot of specialized knowledge. Not only do most people not have this knowledge, but many do not even know what they need to learn until they start troubleshooting. TrueOS is trying to drastically simplify this process to enable the wider Open Source community to experiment, contribute, and enjoy BSD-based projects.</p>
</blockquote>

<ul>
<li>It’s FOSS: What is going to happen to TrueOS Pico? Will Project Trident have ARM support?</li>
</ul>

<blockquote>
<p>Project Trident: Project Trident will be dependent on TrueOS for ARM support. The developers have talked about the possibility of supporting ARM64 and RISC-V architectures, but it is not possible at the current time. If more Open Source contributors want to help develop ARM and RISC-V support, the TrueOS project is definitely willing to help test and integrate that code.</p>
</blockquote>

<ul>
<li>It’s FOSS: What does this change (splitting Trus OS into Project Trident) mean for the Lumina desktop environment?</li>
</ul>

<blockquote>
<p>Project Trident: Long-term, almost nothing. Lumina is still the desktop environment for Project Trident and will continue to be developed and enhanced alongside Project Trident just as it was for TrueOS. Short-term, we will be delaying the release of Lumina 2.0 and will release an updated version of the 1.x branch (1.5.0) instead. This is simply due to all the extra overhead to get Project Trident up and running. When things settle down into a rhythm, the development of Lumina will pick up once again.</p>
</blockquote>

<ul>
<li>It’s FOSS: Are you planning on including any desktop environments besides Lumina?</li>
</ul>

<blockquote>
<p>Project Trident: While Lumina is included by default, all of the other popular desktop environments will be available in the package repo exactly as they had been before.</p>
</blockquote>

<ul>
<li>It’s FOSS: Any plans to include Steam to increase the userbase?</li>
</ul>

<blockquote>
<p>Project Trident: Steam is still unavailable natively on FreeBSD, so we do not have any plans to ship it out of the box currently. In the meantime, we highly recommend installing the Windows version of Steam through the PlayOnBSD utility.</p>
</blockquote>

<ul>
<li>It’s FOSS: What will happen to the AppCafe?</li>
</ul>

<blockquote>
<p>Project Trident: The AppCafe is the name of the graphical interface for the “pkg” utility integrated into the SysAdm client created by TrueOS. This hasn’t changed. SysAdm, the graphical client, and by extension AppCafe are still available for all TrueOS-based distributions to use.</p>
</blockquote>

<ul>
<li>It’s FOSS: Does Project Trident have any corporate sponsors lined up? If not, would you be open to it or would you prefer that it be community supported?</li>
</ul>

<blockquote>
<p>Project Trident: iXsystems is the first corporate sponsor of Project Trident and we are always open to other sponsorships as well. We would prefer smaller individual contributions from the community, but we understand that larger project needs or special-purpose goals are much more difficult to achieve without allowing larger corporate sponsorships as well. In either case, Project Trident is always looking out for the best interests of the community and will not allow intrusive or harmful code to enter the project even if a company or individual tries to make that code part of a sponsorship deal.</p>
</blockquote>

<ul>
<li>It’s FOSS: BSD always seems to be lagging in terms of support for newer devices. Will TrueOS be able to remedy that with a quicker release cycle?</li>
</ul>

<blockquote>
<p>Project Trident: Yes! That was a primary reason for TrueOS to start tracking the CURRENT branch of FreeBSD in 2016. This allows for the changes that FreeBSD developers are making, including new hardware support, to be available much sooner than if we followed the FreeBSD release cycle.</p>
</blockquote>

<ul>
<li>It’s FOSS: Do you have any idea when Project Trident will have its first release?</li>
</ul>

<blockquote>
<p>Project Trident: Right now we are targeting a late August release date. This is because Project Trident is “kicking the wheels” on the new TrueOS distribution system. We want to ensure everything is working smoothly before we release. Going forward, we plan on having regular package updates every week or two for the end-user packages and a new release of Trident with an updated OS version every 6 months. This will follow the TrueOS release schedule with a small time offset.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.geoghegan.ca/pfbadhost.html">pf-badhost: Stop the evil doers in their tracks!</a></p>

<blockquote>
<p>pf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet’s biggest irritants. Annoyances such as ssh bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.<br>
Filtering performance is exceptional, as the badhost list is stored in a pf table. To quote the OpenBSD FAQ page regarding tables: “the lookup time on a table holding 50,000 addresses is only slightly more than for one holding 50 addresses.”<br>
pf-badhost is simple and powerful. The blocklists are pulled from quality, trusted sources. The ‘Firehol’, ‘Emerging Threats’ and ‘Binary Defense’ block lists are used as they are popular, regularly updated lists of the internet’s most egregious offenders. The <a href="http://pf-badhost.sh">pf-badhost.sh</a> script can easily be expanded to use additional or alternate blocklists.<br>
pf-badhost works best when used in conjunction with unbound-adblock for the ultimate badhost blocking.</p>
</blockquote>

<ul>
<li>Notes:</li>
<li>If you are trying to run pf-badhost on a LAN or are using NAT, you will want to add a rule to your pf.conf appearing BEFORE the pf-badhost rules allowing traffic to and from your local subnet so that you can still access your gateway and any DNS servers.</li>
<li>Conversely, adding a line to <a href="http://pf-badhost.sh">pf-badhost.sh</a> that removes your subnet range from the &lt;pfbadhost&gt; table should also work. Just make sure you choose a subnet range / CIDR block that is actually in the list. 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 are the most common home/office subnet ranges.</li>
</ul>

<p><hr></p>

<p><strong>DigitalOcean</strong><br>
<a href="https://do.co/bsdnow">https://do.co/bsdnow</a></p>

<p>###<a href="http://edition.cnn.com/TECH/computing/9911/01/freebsd.con99.idg/">FLASHBACK: FreeBSDCon’99: Fans of Linux’s lesser-known sibling gather for the first time</a></p>

<blockquote>
<p>FreeBSD, a port of BSD Unix to Intel, has been around almost as long as Linux has – but without the media hype. Its developer and user community recently got a chance to get together for the first time, and they did it in the city where BSD – the Berkeley Software Distribution – was born some 25 years ago.<br>
October 17, 1999 marked a milestone in the history of FreeBSD – the first FreeBSD conference was held in the city where it all began, Berkeley, CA. Over 300 developers, users, and interested parties attended from around the globe.<br>
This was easily 50 percent more people than the conference organizers had expected. This first conference was meant to be a gathering mostly for developers and FreeBSD advocates. The turnout was surprisingly (and gratifyingly) large.<br>
In fact, attendance exceeded expectations so much that, for instance, Kirk McKusick had to add a second, identical tutorial on FreeBSD internals, because it was impossible for everyone to attend the first!<br>
But for a first-ever conference, I was impressed by how smoothly everything seemed to go. Sessions started on time, and the sessions I attended were well-run; nothing seemed to be too cold, dark, loud, late, or off-center.<br>
Of course, the best part about a conference such as this one is the opportunity to meet with other people who share similar interests. Lunches and breaks were a good time to meet people, as was the Tuesday night beer bash.<br>
The Wednesday night reception was of a type unusual for the technical conferences I usually attend – a three-hour Hornblower dinner cruise on San Francisco Bay. Not only did we all enjoy excellent food and company, but we all got to go up on deck and watch the lights of San Francisco and Berkeley as we drifted by. Although it’s nice when a conference attracts thousands of attendees, there are some things that can only be done with smaller groups of people; this was one of them.<br>
In short, this was a tiny conference, but a well-run one.</p>
</blockquote>

<ul>
<li>Sessions</li>
</ul>

<blockquote>
<p>Although it was a relatively small conference, the number and quality of the sessions belied the size. Each of the three days of the conference featured a different keynote speaker. In addition to Jordan Hubbard, Jeremy Allison spoke on “Samba Futures” on day two, and Brian Behlendorf gave a talk on “FreeBSD and Apache: A Perfect Combo” to start off the third day.<br>
The conference sessions themselves were divided into six tracks: advocacy, business, development, networking, security, and panels. The panels track featured three different panels, made up of three different slices of the community: the FreeBSD core team, a press panel, and a prominent user panel with representatives from such prominent commercial users as Yahoo! and USWest.<br>
I was especially interested in Apple Computer’s talk in the development track. Wilfredo Sanchez, technical lead for open source projects at Apple (no, that’s not an oxymoron!) spoke about Apple’s Darwin project, the company’s operating system road map, and the role of BSD (and, specifically, FreeBSD) in Apple’s plans.<br>
Apple and Unix have had a long and uneasy history, from the Lisa through the A/UX project to today. Personally, I’m very optimistic about the chances for the Darwin project to succeed. Apple’s core OS kernel team has chosen FreeBSD as its reference platform. I’m looking forward to what this partnership will bring to both sides.<br>
Other development track sessions included in-depth tutorials on writing device drivers, basics of the Vinum Volume Manager, Fibre Channel, development models (the open repository model), and the FreeBSD Documentation Project (FDP). If you’re interested in contributing to the FreeBSD project, the FDP is a good place to start.<br>
Advocacy sessions included “How One Person Can Make a Difference” (a timeless topic that would find a home at any technical conference!) and “Starting and Managing A User Group” (trials and tribulations as well as rewards).<br>
The business track featured speakers from three commercial users of FreeBSD: Cybernet, USWest, and Applix. Applix presented its port of Applixware Office for FreeBSD and explained how Applix has taken the core services of Applixware into open source.<br>
Commercial applications and open source were once a rare combination; we can only hope the trend away from that state of affairs will continue.</p>
</blockquote>

<ul>
<li>Commercial use of FreeBSD</li>
</ul>

<blockquote>
<p>The use of FreeBSD in embedded applications is increasing as well – and it is increasing at the same rate that hardware power is. These days, even inexpensive systems are able to run a BSD kernel.<br>
The BSD license and the solid TCP/IP stack prove significant enticements to this market as well. (Unlike the GNU Public License, the BSD license does not require that vendors make derivative works open source.)<br>
Companies such as USWest and Verio use FreeBSD for a wide variety of different Internet services.<br>
Yahoo! and Hotmail are examples of companies that use FreeBSD extensively for more specific purposes. Yahoo!, for example, has many hundreds of FreeBSD boxes, and Hotmail has almost 2000 FreeBSD machines at its data center in the San Francisco Bay area.<br>
Hotmail is owned by Microsoft, so the fact that it runs FreeBSD is a secret. Don’t tell anyone…<br>
When asked to comment on the increasing commercial interest in BSD, Hubbard said that FreeBSD is learning the Red Hat lesson. “Walnut Creek and others with business interests in FreeBSD have learned a few things from the Red Hat IPO,” he said, “and nobody is just sitting around now, content with business as usual. It’s clearly business as unusual in the open source world today.”<br>
Hubbard had also singled out some of BSD’s commercial partners, such as Whistle Communications, for praise in his opening day keynote. These partners play a key role in moving the project forward, he said, by contributing various enhancements and major new systems, such as Netgraph, as well as by contributing paid employee time spent on FreeBSD.<br>
Even short FreeBSD-related contacts can yield good results, Hubbard said. An example of this is the new jail() security code introduced in FreeBSD 3.x and 4.0, which was contributed by R &amp; D Associates. A number of ISPs are also now donating the hardware and bandwidth that allows the project to provide more resource mirrors and experimental development sites.</p>
</blockquote>

<ul>
<li>See you next year</li>
</ul>

<blockquote>
<p>And speaking of corporate sponsors, thanks go to Walnut Creek for sponsoring the conference, and to Yahoo! for covering all the expenses involved in bringing the entire FreeBSD core team to Berkeley.<br>
As a fan of FreeBSD, I’m happy to see that the project has finally produced a conference. It was time: many of the 16 core team members had been working together on a regular basis for nearly seven years without actually meeting face to face.<br>
It’s been an interesting year for open source projects. I’m looking forward to the next year – and the next BSD conference – to be even better.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://marc.info/?l=openbsd-tech&amp;m=153504937925732&amp;w=2">OpenBSD Recommends: Disable SMT/Hyperthreading in all Intel BIOSes</a></p>

<pre><code>Two recently disclosed hardware bugs affected Intel cpus:

     - TLBleed

     - T1TF (the name &quot;Foreshadow&quot; refers to 1 of 3 aspects of this
             bug, more aspects are surely on the way)

Solving these bugs requires new cpu microcode, a coding workaround,
*AND* the disabling of SMT / Hyperthreading.

SMT is fundamentally broken because it shares resources between the two
cpu instances and those shared resources lack security differentiators.
Some of these side channel attacks aren't trivial, but we can expect
most of them to eventually work and leak kernel or cross-VM memory in
common usage circumstances, even such as javascript directly in a
browser.

There will be more hardware bugs and artifacts disclosed.  Due to the
way SMT interacts with speculative execution on Intel cpus, I expect SMT
to exacerbate most of the future problems.

A few months back, I urged people to disable hyperthreading on all
Intel cpus.  I need to repeat that:

    DISABLE HYPERTHREADING ON ALL YOUR INTEL MACHINES IN THE BIOS.

Also, update your BIOS firmware, if you can.

OpenBSD -current (and therefore 6.4) will not use hyperthreading if it
is enabled, and will update the cpu microcode if possible.

But what about 6.2 and 6.3?

The situation is very complex, continually evolving, and is taking too
much manpower away from other tasks.  Furthermore, Intel isn't telling
us what is coming next, and are doing a terrible job by not publically
documenting what operating systems must do to resolve the problems.  We
are having to do research by reading other operating systems.  There is
no time left to backport the changes -- we will not be issuing a
complete set of errata and syspatches against 6.2 and 6.3 because it is
turning into a distraction.

Rather than working on every required patch for 6.2/6.3, we will
re-focus manpower and make sure 6.4 contains the best solutions
possible.

So please try take responsibility for your own machines: Disable SMT in
the BIOS menu, and upgrade your BIOS if you can.

I'm going to spend my money at a more trustworthy vendor in the future.
</code></pre>

<p><hr></p>

<p>###<a href="https://medium.com/@enzuru/get-morrowind-running-on-openbsd-in-5-simple-steps-b65e20f3f0c">Get Morrowind running on OpenBSD in 5 simple steps</a></p>

<blockquote>
<p>This article contains brief instructions on how to get one of the greatest Western RPGs of all time, The Elder Scrolls III: Morrowind, running on OpenBSD using the OpenMW open source engine recreation. These instructions were tested on a ThinkPad X1 Carbon Gen 3. The information was adapted from this OpenMW forum thread: <a href="https://forum.openmw.org/viewtopic.php?t=3510">https://forum.openmw.org/viewtopic.php?t=3510</a></p>
</blockquote>

<ul>
<li>
<ol>
<li>Purchase and download the DRM-free version from GOG (also considered the best version due to the high quality PDF guide that it comes with): <a href="https://www.gog.com/game/the_elder_scrolls_iii_morrowind_goty_edition">https://www.gog.com/game/the_elder_scrolls_iii_morrowind_goty_edition</a></li>
</ol>
</li>
<li>
<ol start="2">
<li>Install the required packages built from the ports tree as root. openmw is the recreated game engine, and innoextract is how we will get the game data files out of the win32 executable.</li>
</ol>
</li>
</ul>

<p><code>pkg_add openmw innoextract</code></p>

<ul>
<li>
<ol start="3">
<li>Move the file from GOG setup_tes_morrowind_goty_2.0.0.7.exe into its own directory morrowind/ due to innoextract’s default behaviour of extracting into the current directory. Then type:</li>
</ol>
</li>
</ul>

<p><code>innoextract setup_tes_morrowind_goty_2.0.0.7.exe</code></p>

<ul>
<li>
<ol start="4">
<li>Type openmw-wizard and follow the straightforward instructions. Note that you have a pre-existing installation, and select the morrowind/app/Data Files folder that innoextract extracted.</li>
</ol>
</li>
<li>
<ol start="5">
<li>Type in openmw-launcher, toggle the settings to your preferences, and then hit play!</li>
</ol>
</li>
</ul>

<p><hr></p>

<p><strong>iXsystems</strong><br>
<a href="https://twitter.com/allanjude/status/1034647571124367360">https://twitter.com/allanjude/status/1034647571124367360</a></p>

<p>###<a href="https://euroquis.nl/bobulate/?p=1937">My First Clang Bug</a></p>

<blockquote>
<p>Part of the role of being a packager is compiling lots (and lots) of packages. That means compiling lots of code from interesting places and in a variety of styles. In my opinion, being a good packager also means providing feedback to upstream when things are bad. That means filing upstream bugs when possible, and upstreaming patches.<br>
One of the “exciting” moments in packaging is when tools change. So each and every major CMake update is an exercise in recompiling 2400 or more packages and adjusting bits and pieces. When a software project was last released in 2013, adjusting it to modern tools can become quite a chore (e.g. Squid Report Generator). CMake is excellent for maintaining backwards compatibility, generally accommodating old software with new policies. The most recent 3.12 release candidate had three issues filed from the FreeBSD side, all from fallout with older software.  I consider the hours put into good bug reports, part of being a good citizen of the Free Software world.<br>
My most interesting bug this week, though, came from one line of code somewhere in Kleopatra: Q_UNUSED(gpgagent_data);<br>
That one line triggered a really peculiar link error in KDE’s FreeBSD CI system. Yup … telling the compiler something is unused made it fall over. Commenting out that line got rid of the link error, but introduced a warning about an unused function. Working with KDE-PIM’s Volker Krause, we whittled the problem down to a six-line example program — two lines if you don’t care much for coding style. I’m glad, at that point, that I could throw it over the hedge to the LLVM team with some explanatory text. Watching the process on their side reminds me ever-so-strongly of how things work in KDE (or FreeBSD for that matter): Bugzilla, Phabricator, and git combine to be an effective workflow for developers (perhaps less so for end-users).<br>
Today I got a note saying that the issue had been resolved. So brief a time for a bug. Live fast. Get squashed young.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.phoronix.com/scan.php?page=news_item&amp;px=Threadripper-2990WX-DragonFly">DragonFlyBSD Now Runs On The Threadripper 2990WX, Developer Shocked At Performance</a></p>

<blockquote>
<p>Last week I carried out some tests of BSD vs. Linux on the new 32-core / 64-thread Threadripper 2990WX. I tested FreeBSD 11, FreeBSD 12, and TrueOS – those benchmarks will be published in the next few days. I tried DragonFlyBSD, but at the time it wouldn’t boot with this AMD HEDT processor. But now the latest DragonFlyBSD development kernel can handle the 2990WX and the lead DragonFly developer calls this new processor “a real beast” and is stunned by its performance potential.</p>
</blockquote>

<blockquote>
<p>When I tried last week, the DragonFlyBSD 5.2.2 stable release nor DragonFlyBSD 5.3 daily snapshot would boot on the 2990WX. But it turns out Matthew Dillon, the lead developer of DragonFlyBSD, picked up a rig and has it running now. So in time for the next 5.4 stable release or those using the daily snapshots can have this 32-core / 64-thread Zen+ CPU running on this operating system long ago forked from FreeBSD.</p>
</blockquote>

<blockquote>
<p>In announcing his success in bringing up the 2990WX under DragonFlyBSD, which required a few minor changes, he shared his performance thoughts and hopes for the rig. “The cpu is a real beast, packing 32 cores and 64 threads. It blows away our dual-core Xeon to the tune of being +50% faster in concurrent compile tests, and it also blows away our older 4-socket Opteron (which we call ‘Monster’) by about the same margin. It’s an impressive CPU. For now the new beast is going to be used to help us improve I/O performance through the filesystem, further SMP work (but DFly scales pretty well to 64 threads already), and perhaps some driver to work to support the 10gbe on the mobo.”</p>
</blockquote>

<blockquote>
<p>Dillon shared some results on the system as well. &quot; The Threadripper 2990WX is a beast. It is at <em>least</em> 50% faster than both the quad socket opteron and the dual socket Xeon system I tested against. The primary limitation for the 2990WX is likely its 4 channels of DDR4 memory, and like all Zen and Zen+ CPUs, memory performance matters more than CPU frequency (and costs almost no power to pump up the performance). That said, it still blow away a dual-socket Xeon with 3x the number of memory channels. That is impressive!&quot;</p>
</blockquote>

<blockquote>
<p>The well known BSD developer also added, “This puts the 2990WX at par efficiency vs a dual-socket Xeon system, and better than the dual-socket Xeon with slower memory and a power cap. This is VERY impressive. I should note that the 2990WX is more specialized with its asymetric NUMA architecture and 32 cores. I think the sweet spot in terms of CPU pricing and efficiency is likely going to be with the 2950X (16-cores/32-threads). It is clear that the 2990WX (32-cores/64-threads) will max out 4-channel memory bandwidth for many workloads, making it a more specialized part. But still awesome…This thing is an incredible beast, I’m glad I got it.”</p>
</blockquote>

<blockquote>
<p>While I have the FreeBSD vs. Linux benchmarks from a few days ago, it looks like now on my ever growing TODO list will be re-trying out the newest DragonFlyBSD daily snapshot for seeing how the performance compares in the mix. Stay tuned for the numbers that should be in the next day or two.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180810075449">X11 on really small devices</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180810131231">mandoc-1.14.4 released</a></li>
<li><a href="https://www.netgate.com/blog/pfSense-book-available-to-everyone.html">The pfSense Book is now available to everyone</a></li>
<li><a href="https://mwl.io/archives/3619">MWL: Burn it down! Burn it all down!</a></li>
<li><a href="https://github.com/begriffs/obsd">Configuring OpenBSD: System and user config files for a more pleasant laptop</a></li>
<li><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-18:08.tcp.asc">FreeBSD Security Advisory: Resource exhaustion in TCP reassembly</a></li>
<li><a href="https://discoverbsd.com/p/92d80d1497">OpenBSD Foundation gets first 2018 Iridium donation</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=337653">New ZFS commit solves issue a few users reported in the feedback segment</a></li>
<li><a href="https://twitter.com/TridentProject/status/1034620476553867264">Project Trident should have a beta release by the end of next week</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/253447019/">Reminder about Stockholm BUG: September 5, 17:30-22:00</a></li>
<li><a href="https://bsd-pl.org/en">BSD-PL User Group: September 13, 18:30-21:00</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Malcom - <a href="http://dpaste.com/15VVVCP">Having different routes per interface</a></li>
<li>Bostjan - <a href="http://dpaste.com/1Q14C6H#wrap">ZFS and integrity of data</a></li>
<li>Michael - <a href="http://dpaste.com/2JD17BP#wrap">Suggestion for Monitoring</a></li>
<li>Barry - <a href="http://dpaste.com/2GJ3RMG#wrap">Feedback</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 260: Hacking Tour of Europe | BSD Now 260</title>
  <link>https://www.bsdnow.tv/260</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2463</guid>
  <pubDate>Thu, 23 Aug 2018 05:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a3504e6e-2e15-4430-8917-d6a8782b461e.mp3" length="48332197" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Trip reports from the Essen Hackathon and BSDCam, CfT: ZFS native encryption and UFS trim consolidation, ZFS performance benchmarks on a FreeBSD server, how to port your OS to EC2, Vint Cerf about traceability, Remote Access console to an RPi3 running FreeBSD, and more.</itunes:subtitle>
  <itunes:duration>1:20:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Trip reports from the Essen Hackathon and BSDCam, CfT: ZFS native encryption and UFS trim consolidation, ZFS performance benchmarks on a FreeBSD server, how to port your OS to EC2, Vint Cerf about traceability, Remote Access console to an RPi3 running FreeBSD, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://wiki.freebsd.org/DevSummit/201808Hackathon"&gt;Essen Hackathon &amp;amp; BSDCam 2018 trip report&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Allan and Benedict met at FRA airport and then headed to the Air Rail terminal for our train to Essen where the Hackathon would happen over the weekend of Aug 10 - 12, 2018. Once there, we did not have to wait long until other early-arrivals would show up and soon we had about 10 people gathered for lunch. After buying some take-out pizzas and bringing it back to the Linuxhotel (there was a training still going on there so we could not get into our rooms yet), we sat in the sunny park and talked. More and more people arrived and soon, people started hacking on their laptops. Some people would not arrive until a few hours before midnight, but we already had a record appearance of 20 people in total.&lt;/li&gt;
&lt;li&gt;On Saturday, we gathered everyone in one of the seminar rooms that had rooms and chairs for us. After some organizational infos, we did an introductory round and Benedict wrote down on the whiteboard what people were interested in. It was not long until groups formed to talk about SSL in base, weird ZFS scrubs that would go over 100% completion (fixed now). Other people started working on ports, fixing bugs, or wrote documentation. The day ended in a &lt;a href="https://twitter.com/bsdbcr"&gt;BBQ in the Linuxhotel park&lt;/a&gt;, which was well received by everyone.&lt;/li&gt;
&lt;li&gt;On Sunday, after attendees packed up their luggage and stored it in the seminar room, we continued hacking until lunchtime. After a quick group picture, we headed to a local restaurant for the social event (which was not open on Saturday, otherwise we would have had it then). In the afternoon, most people departed, a good half of them were heading for BSDCam.&lt;/li&gt;
&lt;li&gt;&lt;a href="http://freshbsd.org/search?q=Essen+hackathon"&gt;Commits from the hackathon (the ones from 2018)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;Overall, the hackathon was well received by attendees and a lot of them liked the fact that it was close to another BSD gathering so they could nicely combine the two. Also, people thought about doing their own hackathon in the future, which is an exciting prospect. Thanks to all who attended, helped out here and there when needed. Special Thanks to &lt;a href="https://www.netzkommune.de/"&gt;Netzkommune GmbH&lt;/a&gt; for sponsoring the social event and the &lt;a href="http://linuxhotel.de/"&gt;Linuxhotel&lt;/a&gt; for having us.&lt;/li&gt;
&lt;li&gt;Benedict was having a regular work day on Monday after coming back from the hackathon, but flew out to Heathrow on Tuesday. Allan was in London a day earlier and arrived a couple of hours before Benedict in Cambridge. He headed for the Computer Lab even though the main event would not start until Wednesday. Most people gathered at the Maypole pub on Tuesday evening for welcomes, food and drinks.&lt;/li&gt;
&lt;li&gt;On Wednesday, a lot of people met in the breakfast room of Churchill College where most people were staying and went to the Computer Lab, which served as the main venue for BSDCam, together. The morning was spend with introductions and collecting what most people were interested in talking. This unconference style has worked well in the past and soon we had 10 main sessions together for the rest of this and the following two days (&lt;a href="https://bsdcam.cl.cam.ac.uk/"&gt;full schedule&lt;/a&gt;).&lt;/li&gt;
&lt;li&gt;Most sessions took notes, which you can find on the &lt;a href="https://wiki.freebsd.org/DevSummit/201808"&gt;FreeBSD wiki&lt;/a&gt;.&lt;/li&gt;
&lt;li&gt;On Thursday evening, we had a nice formal dinner at Trinity Hall.&lt;/li&gt;
&lt;li&gt;BSDCam 2018 was a great success with a lot of fruitful discussions and planning sessions. We thank the organizers for BSDCam for making it happen.&lt;/li&gt;
&lt;li&gt;A special mentions goes out to Robert Watson and his family. Even though he was not there, he had a good reason to miss it: they had their first child born at the beginning of the week. Congratulations and best wishes to all three of them!&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070832.html"&gt;Call for Testing: ZFS Native Encryption for FreeBSD&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;A port of the ZoL (ZFS-on-Linux) feature that provides native crypto support for ZFS is ready for testing on FreeBSD&lt;/li&gt;
&lt;li&gt;Most of the porting was done by &lt;a href="mailto:sef@freebsd.org"&gt;sef@freebsd.org&lt;/a&gt; (Sean Eric Fagan)&lt;/li&gt;
&lt;li&gt;The original ZoL commit is here: &lt;a href="https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49"&gt;https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;For an overview, see Tom Caputi’s presentation from the OpenZFS Developers Summit in 2016&lt;/li&gt;
&lt;li&gt;Video: &lt;a href="https://youtu.be/frnLiXclAMo"&gt;https://youtu.be/frnLiXclAMo&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Slides: &lt;a href="https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=sharing"&gt;https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=sharing&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;WARNING: test in VMs or with spare disks etc, pools created with this code, or upgraded to this version, will no longer be importable on systems that do not support this feature. The on-disk format or other things may change before the final version, so you will likely have to ‘zfs send | zfs recv’ the data on to a new pool&lt;/li&gt;
&lt;li&gt;Thanks for testing to help this feature land in FreeBSD&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070797.html"&gt;Call for Testing: UFS TRIM Consolidation&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Kirk Mckusick posts to the FreeBSD mailing list looking for testers for the new UFS TRIM Consolidation code&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;When deleting files on filesystems that are stored on flash-memory (solid-state) disk drives, the filesystem notifies the underlying disk of the blocks that it is no longer using. The notification allows the drive to avoid saving these blocks when it needs to flash (zero out) one of its flash pages. These notifications of no-longer-being-used blocks are referred to as TRIM notifications. In FreeBSD these TRIM notifications are sent from the filesystem to the drive using the BIODELETE command.&lt;br&gt;
Until now, the filesystem would send a separate message to the drive for each block of the file that was deleted. Each Gigabyte of file size resulted in over 3000 TRIM messages being sent to the drive. This burst of messages can overwhelm the drive’s task queue causing multiple second delays for read and write requests.&lt;br&gt;
This implementation collects runs of contiguous blocks in the file and then consolodates them into a single BIODELETE command to the drive. The BIODELETE command describes the run of blocks as a single large block being deleted. Each Gigabyte of file size can result in as few as two BIODELETE commands and is typically less than ten.  Though these larger BIODELETE commands take longer to run, they do not clog the drive task queue, so read and write commands can intersperse effectively with them.&lt;br&gt;
Though this new feature has been throughly reviewed and tested, it is being added disabled by default so as to minimize the possibility of disrupting the upcoming 12.0 release. It can be enabled by running `sysctl vfs.ffs.dotrimcons=1’’. Users are encouraged to test it. If no problems arise, we will consider requesting that it be enabled by default for 12.0.&lt;br&gt;
This support is off by default, but I am hoping that I can get enough testing to ensure that it (a) works, and (b) is helpful that it will be reasonable to have it turned on by default in 12.0. The cutoff for turning it on by default in 12.0 is September 19th. So I am requesting your testing feedback in the near-term. Please let me know if you have managed to use it successfully (or not) and also if it provided any performance difference (good or bad).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;To enable TRIM consolidation usesysctl vfs.ffs.dotrimcons=1’&lt;/li&gt;
&lt;li&gt;There is also a diff that adds additional statistics: &lt;a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070798.html"&gt;https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070798.html&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;You can also watch the volume and latency of BIODELETE commands by running &lt;code&gt;gstat&lt;/code&gt; with the -d flag&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://aravindh.net/post/zfs_performance/"&gt;ZFS performance&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Aravindh Sampathkumar, a Performance Engineer and Sysadmin posts some simple benchmarks he did on a new ZFS server&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;This is NOT an all-in post about ZFS performance. I built a FreeBSD+ZFS file server recently at work to serve as an offsite backup server. I wanted to run a few synthetic workloads on it and look at how it fares from performance perspective. Mostly for curiosity and learning purposes.&lt;br&gt;
As stated in the notes about building this server, performance was not one of the priorities, as this server will never face our active workload. What I care about from this server is its ability to work with rsync and keep the data synchronised with our primary storage server. With that context, I ran a few write tests to see how good our solution is and what to expect from it in terms of performance.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The article then uses FIO to do some benchmarks.&lt;/li&gt;
&lt;li&gt;As the author did, make sure you match the FIO block size to the ZFS record size to avoid write amplification. Either tune FIO or adjust the recordsize property in ZFS&lt;/li&gt;
&lt;li&gt;You also want to consider compression and cache effects&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Write Performance: Incompressible: 1600-2600 MB/s, Compressible: 2500-6600 MB/s&lt;br&gt;
Another over 1200 MB/s is enough to keep your 10 gigabit network saturated&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The increased latency that is seen with higher number of writers working, may be the result of the ZFS backpressure system (the write throttle). There is some tuning that can be done there. Specifically, since this machine has 768 GB of ram, you might allow more than 4GB of dirty data, which would mean you’d be able to write larger batches and not have to push back while you wait for a transaction group to flush when dealing with gigabytes/sec of writes&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="http://www.daemonology.net/blog/2018-07-14-port-OS-to-EC2.html"&gt;How to port your OS to EC2&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Colin Percival reflects on his FreeBSD on EC2 maintainership efforts in his blog:&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I’ve been the maintainer of the FreeBSD/EC2 platform for about 7.5 years now, and as far as “running things in virtual machines” goes, that remains the only operating system and the only cloud which I work on. That said, from time to time I get questions from people who want to port other operating systems into EC2, and being a member of the open source community, I do my best to help them. I realized a few days ago that rather than replying to emails one by one it would be more efficient to post something publicly; so — for the benefit of the dozen or so people who want to port operating systems to run in EC2, and the curiosity of maybe a thousand more people who use EC2 but will never build AMIs themselves — here’s a rough guide to building EC2 images.&lt;br&gt;
Before we can talk about building images, there are some things you need:&lt;br&gt;
Your OS needs to run on x86 hardware. 64-bit (“amd64”, “x86-64”) is ideal, but I’ve managed to run 32-bit FreeBSD on “64-bit” EC2 instances so at least in some cases that’s not strictly necessary.&lt;br&gt;
You almost certainly want to have drivers for Xen block devices (for all of the pre-Nitro EC2 instances) or for NVMe disks (for the most recent EC2 instances). Theoretically you could make do without these since there’s some ATA emulation available for bootstrapping, but if you want to do any disk I/O after the kernel finishes booting you’ll want to have a disk driver.&lt;br&gt;
Similarly, you need support for the Xen network interface (older instances), Intel 10 GbE SR-IOV networking (some newer but pre-Nitro instances), or Amazon’s “ENA” network adapters (on Nitro instances), unless you plan on having instances which don’t communicate over the network. The ENA driver is probably the hardest thing to port, since as far as I know there’s no way to get your hands on the hardware directly, and it’s very difficult to do any debugging in EC2 without having a working network.&lt;br&gt;
Finally, the obvious: You need to have an AWS account, and appropriate API access keys.&lt;br&gt;
Building a disk image&lt;/p&gt;
&lt;p&gt;Building an AMI&lt;br&gt;
I wrote a simple tool for converting disk images into EC2 instances: bsdec2-image-upload. It uploads a disk image to Amazon S3; makes an API call to import that disk image into an EBS volume; creates a snapshot of that volume; then registers an EC2 AMI using that snapshot.&lt;br&gt;
To use bsdec2-image-upload, you’ll first need to create an S3 bucket for it to use as a staging area. You can call it anything you like, but I recommend that you&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Create it in a “nearby” region (for performance reasons), and&lt;br&gt;
Set an S3 “lifecycle policy” which deletes objects automatically after 1 day (since bsdec2-image-upload doesn’t clean up the S3 bucket, and those objects are useless once you’ve finished creating an AMI).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Boot configuration&lt;br&gt;
Odds are that your instance started booting and got as far as the boot loader launching the kernel, but at some point after that things went sideways. Now we start the iterative process of building disk images, turning them into AMIs, launching said AMIs, and seeing where they break. Some things you’ll probably run into here:&lt;br&gt;
EC2 instances have two types of console available to them: A serial console and an VGA console. (Or rather, emulated serial and emulated VGA.) If you can have your kernel output go to both consoles, I recommend doing that. If you have to pick one, the serial console (which shows up as the “System Log” in EC2) is probably more useful than the VGA console (which shows up as “instance screenshot”) since it lets you see more than one screen of logs at once; but there’s a catch: Due to some bizarre breakage in EC2 — which I’ve been complaining about for ten years — the serial console is very “laggy”. If you find that you’re not getting any output, wait five minutes and try again.&lt;br&gt;
You may need to tell your kernel where to find the root filesystem. On FreeBSD we build our disk images using GPT labels, so we simply need to specify in /etc/fstab that the root filesystem is on /dev/gpt/rootfs; but if you can’t do this, you’ll probably need to have different AMIs for Nitro instances vs. non-Nitro instances since Xen block devices will typically show up with different device names from NVMe disks. On FreeBSD, I also needed to set the vfs.root.mountfrom kernel environment variable for a while; this also is no longer needed on FreeBSD but something similar may be needed on other systems.&lt;br&gt;
You’ll need to enable networking, using DHCP. On FreeBSD, this means placing ifconfigDEFAULT=“SYNCDHCP” into /etc/rc.conf; other systems will have other ways of specifying network parameters, and it may be necessary to specify a setting for the Xen network device, Intel SR-IOV network, and the Amazon ENA interface so that you’ll have the necessary configuration across all EC2 instance types. (On FreeBSD, ifconfigDEFAULT takes care of specifying the network settings which should apply for whatever network interface the kernel finds at boot time.)&lt;br&gt;
You’ll almost certainly want to turn on SSH, so that you can connect into newly launched instances and make use of them. Don’t worry about setting a password or creating a user to SSH into yet — we’ll take care of that later.&lt;br&gt;
EC2 configuration&lt;br&gt;
Now it’s time to make the AMI behave like an EC2 instance. To this end, I prepared a set of rc.d scripts for FreeBSD. Most importantly, they&lt;br&gt;
Print the SSH host keys to the console, so that you can veriy that they are correct when you first SSH in. (Remember, Verifying SSH host keys is more important than flossing every day.)&lt;br&gt;
Download the SSH public key you want to use for logging in, and create an account (by default, “ec2-user”) with that key set up for you.&lt;br&gt;
Fetch EC2 user-data and process it via configinit to allow you to configure the system as part of the process of launching it.&lt;br&gt;
If your OS has an rc system derived from NetBSD’s rc.d, you may be able to use these scripts without any changes by simply installing them and enabling them in /etc/rc.conf; otherwise you may need to write your own scripts using mine as a model.&lt;br&gt;
Firstboot scripts&lt;br&gt;
A feature I added to FreeBSD a few years ago is the concept of “firstboot” scripts: These startup scripts are only run the first time a system boots. The aforementioned configinit and SSH key fetching scripts are flagged this way — so if your OS doesn’t support the “firstboot” keyword on rc.d scripts you’ll need to hack around that — but EC2 instances also ship with other scripts set to run on the first boot:&lt;br&gt;
FreeBSD Update will fetch and install security and critical errata updates, and then reboot the system if necessary.&lt;br&gt;
The UFS filesystem on the “boot disk” will be automatically expanded to the full size of the disk — this makes it possible to specify a larger size of disk at EC2 instance launch time.&lt;br&gt;
Third-party packages will be automatically fetched and installed, according to a list in /etc/rc.conf. This is most useful if configinit is used to edit /etc/rc.conf, since it allows you to specify packages to install via the EC2 user-data.&lt;br&gt;
While none of these are strictly necessary, I find them to be extremely useful and highly recommend implementing similar functionality in your systems.&lt;br&gt;
Support my work!&lt;br&gt;
I hope you find this useful, or at very least interesting. Please consider supporting my work in this area; while I’m happy to contribute my time to supporting open source software, it would be nice if I had money coming in which I could use to cover incidental expenses (e.g., conference travel) so that I didn’t end up paying to contribute to FreeBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Digital Ocean&lt;/strong&gt;&lt;br&gt;
&lt;a href="https://do.co/bsdnow"&gt;https://do.co/bsdnow&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://cacm.acm.org/magazines/2018/8/229771-traceability/fulltext"&gt;Traceability, by Vint Cerf&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;A recent article from the August issue of the Communications of the ACM, for your contemplation:&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;At a recent workshop on cybersecurity in the U.K., a primary topic of consideration was how to preserve the freedom and openness of the Internet while protecting against the harmful behaviors that have emerged in this global medium. That this is a significant challenge cannot be overstated. The bad behaviors range from social network bullying and misinformation to email spam, distributed denial of service attacks, direct cyberattacks against infrastructure, malware propagation, identity theft, and a host of other ills requiring a wide range of technical and legal considerations. That these harmful behaviors can and do cross international boundaries only makes it more difficult to fashion effective responses.&lt;br&gt;
In other columns, I have argued for better software development tools to reduce the common mistakes that lead to vulnerabilities that are exploited. Here, I want to focus on another aspect of response related to law enforcement and tracking down perpetrators. Of course, not all harms are (or perhaps are not yet) illegal, but discovering those who cause them may still be warranted. The recent adoption and implementation of the General Data Protection Regulation (GDPR) in the European Union creates an interesting tension because it highlights the importance and value of privacy while those who do direct or indirect harm must be tracked down and their identities discovered.&lt;br&gt;
In passing, I mention that cryptography has sometimes been blamed for protecting the identity or actions of criminals but it is also a tool for protecting privacy. Arguments have been made for “back doors” to cryptographic systems but I am of the opinion that such proposals carry extremely high risk to privacy and safety. It is not my intent to argue this question in this column.&lt;br&gt;
What is of interest to me is a concept to which I was introduced at the Ditchley workshop, specifically, differential traceability. The ability to trace bad actors to bring them to justice seems to me an important goal in a civilized society. The tension with privacy protection leads to the idea that only under appropriate conditions can privacy be violated. By way of example, consider license plates on cars. They are usually arbitrary identifiers and special authority is needed to match them with the car owners (unless, of course, they are vanity plates like mine: “Cerfsup”). This is an example of differential traceability; the police department has the authority to demand ownership information from the Department of Motor Vehicles that issues the license plates. Ordinary citizens do not have this authority.&lt;br&gt;
In the Internet environment there are a variety of identifiers associated with users (including corporate users). Domain names, IP addresses, email addresses, and public cryptography keys are examples among many others. Some of these identifiers are dynamic and thus ambiguous. For example, IP addresses are not always permanent and may change (for example, temporary IP addresses assigned at Wi-Fi hotspots) or may be ambiguous in the case of Network Address Translation. Information about the time of assignment and the party to whom an IP address was assigned may be needed to identify an individual user. There has been considerable debate and even a recent court case regarding requirements to register users in domain name WHOIS databases in the context of the adoption of GDPR. If we are to accomplish the simultaneous objectives of protecting privacy while apprehending those engaged in harmful or criminal behavior on the Internet, we must find some balance between conflicting but desirable outcomes.&lt;br&gt;
This suggests to me that the notion of traceability under (internationally?) agreed circumstances (that is, differential traceability) might be a fruitful concept to explore. In most societies today, it is accepted that we must be identifiable to appropriate authorities under certain conditions (consider border crossings, traffic violation stops as examples). While there are conditions under which apparent anonymity is desirable and even justifiable (whistle-blowing, for example) absolute anonymity is actually quite difficult to achieve (another point made at the Ditchley workshop) and might not be absolutely desirable given the misbehaviors apparent anonymity invites. I expect this is a controversial conclusion and I look forward to subsequent discussion.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blackdot.be/2018/08/remote-access-console-using-raspberry-pi-3b-and-freebsd/"&gt;Remote Access Console using FreeBSD on an RPi3&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Our friend, and FOSDEM Booth Neighbour, Jorge, has posted a tutorial on how he created a remote access console for his SmartOS server and other machines in his homelab&lt;/li&gt;
&lt;li&gt;Parts:&lt;/li&gt;
&lt;li&gt;Raspberry Pi 3 B+&lt;/li&gt;
&lt;li&gt;NavoLabs micro POE Hat&lt;/li&gt;
&lt;li&gt;FT4232H  based USB-to-RS232 (4x) adapter&lt;/li&gt;
&lt;li&gt;Official Raspberry Pi case (optional)&lt;/li&gt;
&lt;li&gt;Heat-sink kit (optional)&lt;/li&gt;
&lt;li&gt;USB-to-TTL adaptor (optional)&lt;/li&gt;
&lt;li&gt;Sandisk 16Gb microSD&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;For the software I ended up using conserver. Below is a very brief tutorial on how to set everything up. I assume you have basic unix skills.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Get an RPi3 image, make some minor modifications for RPi3+, and write it to the USB stick&lt;/li&gt;
&lt;li&gt;Configure FreeBSD on the RPi3
&lt;ul&gt;
&lt;li&gt;Load the ‘muge’ Ethernet Driver&lt;/li&gt;
&lt;li&gt;Load USB serial support&lt;/li&gt;
&lt;li&gt;Load the FTDI driver&lt;/li&gt;
&lt;li&gt;Enable SSHd and Conserver&lt;/li&gt;
&lt;li&gt;Configure Conserver&lt;/li&gt;
&lt;li&gt;Setup log rotation&lt;/li&gt;
&lt;li&gt;Start Conserver&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;And you’re good to go&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A small bonus script I wrote to turn on the 2nd LED on the rPI once the system is booted, it will then blink the LED if someone is connected to any of the consoles.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;There is also a followup post with some additional tips: &lt;a href="https://blackdot.be/2018/08/freebsd-uart-and-raspberry-pi-3-b/"&gt;https://blackdot.be/2018/08/freebsd-uart-and-raspberry-pi-3-b/&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://twitter.com/ungleich/status/1031501391792156673"&gt;Annual Penguin Races&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.mcternan.me.uk/mscgen/"&gt;Mscgen - Message Sequence Chart generator&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://reviews.freebsd.org/D16723"&gt;This patch makes FreeBSD boot 500 - 800ms faster, please test on your hardware&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=338059"&gt;FreeBSD’s arc4random() replaced with OpenBSD ChaCha20 implementation&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/freebsdfndation/status/1031590348768915456"&gt;MeetBSD Devsummit open for registrations&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mwl.io/archives/3654"&gt;New Podcast interview with Michael W. Lucas&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;##Feedback/Questions&lt;br&gt;
We need more feedback emails. Please write to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;Additionally, we are considering a new segment to be added to the end of the show (to make it skippable), where we have a ~15 minute deep dive on a topic. Some initial ideas are on the Virtual Memory subsystem, the Scheduler, Capsicum, and GEOM. What topics would you like to get very detailed explanations of? Many of the explanations may have accompanying graphics, and not be very suitable for audio only listeners, that is why we are planning to put it at the very end of the episode.&lt;/p&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, zfs, performance, encryption, remote access, rpi3, raspberry pi</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Trip reports from the Essen Hackathon and BSDCam, CfT: ZFS native encryption and UFS trim consolidation, ZFS performance benchmarks on a FreeBSD server, how to port your OS to EC2, Vint Cerf about traceability, Remote Access console to an RPi3 running FreeBSD, and more.</p>

<p>##Headlines<br>
###<a href="https://wiki.freebsd.org/DevSummit/201808Hackathon">Essen Hackathon &amp; BSDCam 2018 trip report</a></p>

<ul>
<li>Allan and Benedict met at FRA airport and then headed to the Air Rail terminal for our train to Essen where the Hackathon would happen over the weekend of Aug 10 - 12, 2018. Once there, we did not have to wait long until other early-arrivals would show up and soon we had about 10 people gathered for lunch. After buying some take-out pizzas and bringing it back to the Linuxhotel (there was a training still going on there so we could not get into our rooms yet), we sat in the sunny park and talked. More and more people arrived and soon, people started hacking on their laptops. Some people would not arrive until a few hours before midnight, but we already had a record appearance of 20 people in total.</li>
<li>On Saturday, we gathered everyone in one of the seminar rooms that had rooms and chairs for us. After some organizational infos, we did an introductory round and Benedict wrote down on the whiteboard what people were interested in. It was not long until groups formed to talk about SSL in base, weird ZFS scrubs that would go over 100% completion (fixed now). Other people started working on ports, fixing bugs, or wrote documentation. The day ended in a <a href="https://twitter.com/bsdbcr">BBQ in the Linuxhotel park</a>, which was well received by everyone.</li>
<li>On Sunday, after attendees packed up their luggage and stored it in the seminar room, we continued hacking until lunchtime. After a quick group picture, we headed to a local restaurant for the social event (which was not open on Saturday, otherwise we would have had it then). In the afternoon, most people departed, a good half of them were heading for BSDCam.</li>
<li><a href="http://freshbsd.org/search?q=Essen+hackathon">Commits from the hackathon (the ones from 2018)</a></li>
<li>Overall, the hackathon was well received by attendees and a lot of them liked the fact that it was close to another BSD gathering so they could nicely combine the two. Also, people thought about doing their own hackathon in the future, which is an exciting prospect. Thanks to all who attended, helped out here and there when needed. Special Thanks to <a href="https://www.netzkommune.de/">Netzkommune GmbH</a> for sponsoring the social event and the <a href="http://linuxhotel.de/">Linuxhotel</a> for having us.</li>
<li>Benedict was having a regular work day on Monday after coming back from the hackathon, but flew out to Heathrow on Tuesday. Allan was in London a day earlier and arrived a couple of hours before Benedict in Cambridge. He headed for the Computer Lab even though the main event would not start until Wednesday. Most people gathered at the Maypole pub on Tuesday evening for welcomes, food and drinks.</li>
<li>On Wednesday, a lot of people met in the breakfast room of Churchill College where most people were staying and went to the Computer Lab, which served as the main venue for BSDCam, together. The morning was spend with introductions and collecting what most people were interested in talking. This unconference style has worked well in the past and soon we had 10 main sessions together for the rest of this and the following two days (<a href="https://bsdcam.cl.cam.ac.uk/">full schedule</a>).</li>
<li>Most sessions took notes, which you can find on the <a href="https://wiki.freebsd.org/DevSummit/201808">FreeBSD wiki</a>.</li>
<li>On Thursday evening, we had a nice formal dinner at Trinity Hall.</li>
<li>BSDCam 2018 was a great success with a lot of fruitful discussions and planning sessions. We thank the organizers for BSDCam for making it happen.</li>
<li>A special mentions goes out to Robert Watson and his family. Even though he was not there, he had a good reason to miss it: they had their first child born at the beginning of the week. Congratulations and best wishes to all three of them!</li>
</ul>

<p><hr></p>

<p>###<a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070832.html">Call for Testing: ZFS Native Encryption for FreeBSD</a></p>

<ul>
<li>A port of the ZoL (ZFS-on-Linux) feature that provides native crypto support for ZFS is ready for testing on FreeBSD</li>
<li>Most of the porting was done by <a href="mailto:sef@freebsd.org">sef@freebsd.org</a> (Sean Eric Fagan)</li>
<li>The original ZoL commit is here: <a href="https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49">https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49</a></li>
<li>For an overview, see Tom Caputi’s presentation from the OpenZFS Developers Summit in 2016</li>
<li>Video: <a href="https://youtu.be/frnLiXclAMo">https://youtu.be/frnLiXclAMo</a></li>
<li>Slides: <a href="https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=sharing">https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=sharing</a></li>
<li>WARNING: test in VMs or with spare disks etc, pools created with this code, or upgraded to this version, will no longer be importable on systems that do not support this feature. The on-disk format or other things may change before the final version, so you will likely have to ‘zfs send | zfs recv’ the data on to a new pool</li>
<li>Thanks for testing to help this feature land in FreeBSD</li>
</ul>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###<a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070797.html">Call for Testing: UFS TRIM Consolidation</a></p>

<ul>
<li>Kirk Mckusick posts to the FreeBSD mailing list looking for testers for the new UFS TRIM Consolidation code</li>
</ul>

<blockquote>
<p>When deleting files on filesystems that are stored on flash-memory (solid-state) disk drives, the filesystem notifies the underlying disk of the blocks that it is no longer using. The notification allows the drive to avoid saving these blocks when it needs to flash (zero out) one of its flash pages. These notifications of no-longer-being-used blocks are referred to as TRIM notifications. In FreeBSD these TRIM notifications are sent from the filesystem to the drive using the BIO_DELETE command.<br>
Until now, the filesystem would send a separate message to the drive for each block of the file that was deleted. Each Gigabyte of file size resulted in over 3000 TRIM messages being sent to the drive. This burst of messages can overwhelm the drive’s task queue causing multiple second delays for read and write requests.<br>
This implementation collects runs of contiguous blocks in the file and then consolodates them into a single BIO_DELETE command to the drive. The BIO_DELETE command describes the run of blocks as a single large block being deleted. Each Gigabyte of file size can result in as few as two BIO_DELETE commands and is typically less than ten.  Though these larger BIO_DELETE commands take longer to run, they do not clog the drive task queue, so read and write commands can intersperse effectively with them.<br>
Though this new feature has been throughly reviewed and tested, it is being added disabled by default so as to minimize the possibility of disrupting the upcoming 12.0 release. It can be enabled by running ``sysctl vfs.ffs.dotrimcons=1’’. Users are encouraged to test it. If no problems arise, we will consider requesting that it be enabled by default for 12.0.<br>
This support is off by default, but I am hoping that I can get enough testing to ensure that it (a) works, and (b) is helpful that it will be reasonable to have it turned on by default in 12.0. The cutoff for turning it on by default in 12.0 is September 19th. So I am requesting your testing feedback in the near-term. Please let me know if you have managed to use it successfully (or not) and also if it provided any performance difference (good or bad).</p>
</blockquote>

<ul>
<li>To enable TRIM consolidation use `sysctl vfs.ffs.dotrimcons=1’</li>
<li>There is also a diff that adds additional statistics: <a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070798.html">https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070798.html</a></li>
<li>You can also watch the volume and latency of BIO_DELETE commands by running <code>gstat</code> with the -d flag</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://aravindh.net/post/zfs_performance/">ZFS performance</a></p>

<ul>
<li>Aravindh Sampathkumar, a Performance Engineer and Sysadmin posts some simple benchmarks he did on a new ZFS server</li>
</ul>

<blockquote>
<p>This is NOT an all-in post about ZFS performance. I built a FreeBSD+ZFS file server recently at work to serve as an offsite backup server. I wanted to run a few synthetic workloads on it and look at how it fares from performance perspective. Mostly for curiosity and learning purposes.<br>
As stated in the notes about building this server, performance was not one of the priorities, as this server will never face our active workload. What I care about from this server is its ability to work with rsync and keep the data synchronised with our primary storage server. With that context, I ran a few write tests to see how good our solution is and what to expect from it in terms of performance.</p>
</blockquote>

<ul>
<li>The article then uses FIO to do some benchmarks.</li>
<li>As the author did, make sure you match the FIO block size to the ZFS record size to avoid write amplification. Either tune FIO or adjust the recordsize property in ZFS</li>
<li>You also want to consider compression and cache effects</li>
</ul>

<blockquote>
<p>Write Performance: Incompressible: 1600-2600 MB/s, Compressible: 2500-6600 MB/s<br>
Another over 1200 MB/s is enough to keep your 10 gigabit network saturated</p>
</blockquote>

<ul>
<li>The increased latency that is seen with higher number of writers working, may be the result of the ZFS backpressure system (the write throttle). There is some tuning that can be done there. Specifically, since this machine has 768 GB of ram, you might allow more than 4GB of dirty data, which would mean you’d be able to write larger batches and not have to push back while you wait for a transaction group to flush when dealing with gigabytes/sec of writes</li>
</ul>

<p><hr></p>

<p>###<a href="http://www.daemonology.net/blog/2018-07-14-port-OS-to-EC2.html">How to port your OS to EC2</a></p>

<ul>
<li>Colin Percival reflects on his FreeBSD on EC2 maintainership efforts in his blog:</li>
</ul>

<blockquote>
<p>I’ve been the maintainer of the FreeBSD/EC2 platform for about 7.5 years now, and as far as “running things in virtual machines” goes, that remains the only operating system and the only cloud which I work on. That said, from time to time I get questions from people who want to port other operating systems into EC2, and being a member of the open source community, I do my best to help them. I realized a few days ago that rather than replying to emails one by one it would be more efficient to post something publicly; so — for the benefit of the dozen or so people who want to port operating systems to run in EC2, and the curiosity of maybe a thousand more people who use EC2 but will never build AMIs themselves — here’s a rough guide to building EC2 images.<br>
Before we can talk about building images, there are some things you need:<br>
Your OS needs to run on x86 hardware. 64-bit (“amd64”, “x86-64”) is ideal, but I’ve managed to run 32-bit FreeBSD on “64-bit” EC2 instances so at least in some cases that’s not strictly necessary.<br>
You almost certainly want to have drivers for Xen block devices (for all of the pre-Nitro EC2 instances) or for NVMe disks (for the most recent EC2 instances). Theoretically you could make do without these since there’s some ATA emulation available for bootstrapping, but if you want to do any disk I/O after the kernel finishes booting you’ll want to have a disk driver.<br>
Similarly, you need support for the Xen network interface (older instances), Intel 10 GbE SR-IOV networking (some newer but pre-Nitro instances), or Amazon’s “ENA” network adapters (on Nitro instances), unless you plan on having instances which don’t communicate over the network. The ENA driver is probably the hardest thing to port, since as far as I know there’s no way to get your hands on the hardware directly, and it’s very difficult to do any debugging in EC2 without having a working network.<br>
Finally, the obvious: You need to have an AWS account, and appropriate API access keys.<br>
Building a disk image</p>
<p>Building an AMI<br>
I wrote a simple tool for converting disk images into EC2 instances: bsdec2-image-upload. It uploads a disk image to Amazon S3; makes an API call to import that disk image into an EBS volume; creates a snapshot of that volume; then registers an EC2 AMI using that snapshot.<br>
To use bsdec2-image-upload, you’ll first need to create an S3 bucket for it to use as a staging area. You can call it anything you like, but I recommend that you</p>
</blockquote>

<blockquote>
<p>Create it in a “nearby” region (for performance reasons), and<br>
Set an S3 “lifecycle policy” which deletes objects automatically after 1 day (since bsdec2-image-upload doesn’t clean up the S3 bucket, and those objects are useless once you’ve finished creating an AMI).</p>
</blockquote>

<blockquote>
<p>Boot configuration<br>
Odds are that your instance started booting and got as far as the boot loader launching the kernel, but at some point after that things went sideways. Now we start the iterative process of building disk images, turning them into AMIs, launching said AMIs, and seeing where they break. Some things you’ll probably run into here:<br>
EC2 instances have two types of console available to them: A serial console and an VGA console. (Or rather, emulated serial and emulated VGA.) If you can have your kernel output go to both consoles, I recommend doing that. If you have to pick one, the serial console (which shows up as the “System Log” in EC2) is probably more useful than the VGA console (which shows up as “instance screenshot”) since it lets you see more than one screen of logs at once; but there’s a catch: Due to some bizarre breakage in EC2 — which I’ve been complaining about for ten years — the serial console is very “laggy”. If you find that you’re not getting any output, wait five minutes and try again.<br>
You may need to tell your kernel where to find the root filesystem. On FreeBSD we build our disk images using GPT labels, so we simply need to specify in /etc/fstab that the root filesystem is on /dev/gpt/rootfs; but if you can’t do this, you’ll probably need to have different AMIs for Nitro instances vs. non-Nitro instances since Xen block devices will typically show up with different device names from NVMe disks. On FreeBSD, I also needed to set the vfs.root.mountfrom kernel environment variable for a while; this also is no longer needed on FreeBSD but something similar may be needed on other systems.<br>
You’ll need to enable networking, using DHCP. On FreeBSD, this means placing ifconfig_DEFAULT=“SYNCDHCP” into /etc/rc.conf; other systems will have other ways of specifying network parameters, and it may be necessary to specify a setting for the Xen network device, Intel SR-IOV network, and the Amazon ENA interface so that you’ll have the necessary configuration across all EC2 instance types. (On FreeBSD, ifconfig_DEFAULT takes care of specifying the network settings which should apply for whatever network interface the kernel finds at boot time.)<br>
You’ll almost certainly want to turn on SSH, so that you can connect into newly launched instances and make use of them. Don’t worry about setting a password or creating a user to SSH into yet — we’ll take care of that later.<br>
EC2 configuration<br>
Now it’s time to make the AMI behave like an EC2 instance. To this end, I prepared a set of rc.d scripts for FreeBSD. Most importantly, they<br>
Print the SSH host keys to the console, so that you can veriy that they are correct when you first SSH in. (Remember, Verifying SSH host keys is more important than flossing every day.)<br>
Download the SSH public key you want to use for logging in, and create an account (by default, “ec2-user”) with that key set up for you.<br>
Fetch EC2 user-data and process it via configinit to allow you to configure the system as part of the process of launching it.<br>
If your OS has an rc system derived from NetBSD’s rc.d, you may be able to use these scripts without any changes by simply installing them and enabling them in /etc/rc.conf; otherwise you may need to write your own scripts using mine as a model.<br>
Firstboot scripts<br>
A feature I added to FreeBSD a few years ago is the concept of “firstboot” scripts: These startup scripts are only run the first time a system boots. The aforementioned configinit and SSH key fetching scripts are flagged this way — so if your OS doesn’t support the “firstboot” keyword on rc.d scripts you’ll need to hack around that — but EC2 instances also ship with other scripts set to run on the first boot:<br>
FreeBSD Update will fetch and install security and critical errata updates, and then reboot the system if necessary.<br>
The UFS filesystem on the “boot disk” will be automatically expanded to the full size of the disk — this makes it possible to specify a larger size of disk at EC2 instance launch time.<br>
Third-party packages will be automatically fetched and installed, according to a list in /etc/rc.conf. This is most useful if configinit is used to edit /etc/rc.conf, since it allows you to specify packages to install via the EC2 user-data.<br>
While none of these are strictly necessary, I find them to be extremely useful and highly recommend implementing similar functionality in your systems.<br>
Support my work!<br>
I hope you find this useful, or at very least interesting. Please consider supporting my work in this area; while I’m happy to contribute my time to supporting open source software, it would be nice if I had money coming in which I could use to cover incidental expenses (e.g., conference travel) so that I didn’t end up paying to contribute to FreeBSD.</p>
</blockquote>

<p><hr></p>

<p><strong>Digital Ocean</strong><br>
<a href="https://do.co/bsdnow">https://do.co/bsdnow</a></p>

<p>###<a href="https://cacm.acm.org/magazines/2018/8/229771-traceability/fulltext">Traceability, by Vint Cerf</a></p>

<ul>
<li>A recent article from the August issue of the Communications of the ACM, for your contemplation:</li>
</ul>

<blockquote>
<p>At a recent workshop on cybersecurity in the U.K., a primary topic of consideration was how to preserve the freedom and openness of the Internet while protecting against the harmful behaviors that have emerged in this global medium. That this is a significant challenge cannot be overstated. The bad behaviors range from social network bullying and misinformation to email spam, distributed denial of service attacks, direct cyberattacks against infrastructure, malware propagation, identity theft, and a host of other ills requiring a wide range of technical and legal considerations. That these harmful behaviors can and do cross international boundaries only makes it more difficult to fashion effective responses.<br>
In other columns, I have argued for better software development tools to reduce the common mistakes that lead to vulnerabilities that are exploited. Here, I want to focus on another aspect of response related to law enforcement and tracking down perpetrators. Of course, not all harms are (or perhaps are not yet) illegal, but discovering those who cause them may still be warranted. The recent adoption and implementation of the General Data Protection Regulation (GDPR) in the European Union creates an interesting tension because it highlights the importance and value of privacy while those who do direct or indirect harm must be tracked down and their identities discovered.<br>
In passing, I mention that cryptography has sometimes been blamed for protecting the identity or actions of criminals but it is also a tool for protecting privacy. Arguments have been made for “back doors” to cryptographic systems but I am of the opinion that such proposals carry extremely high risk to privacy and safety. It is not my intent to argue this question in this column.<br>
What is of interest to me is a concept to which I was introduced at the Ditchley workshop, specifically, differential traceability. The ability to trace bad actors to bring them to justice seems to me an important goal in a civilized society. The tension with privacy protection leads to the idea that only under appropriate conditions can privacy be violated. By way of example, consider license plates on cars. They are usually arbitrary identifiers and special authority is needed to match them with the car owners (unless, of course, they are vanity plates like mine: “Cerfsup”). This is an example of differential traceability; the police department has the authority to demand ownership information from the Department of Motor Vehicles that issues the license plates. Ordinary citizens do not have this authority.<br>
In the Internet environment there are a variety of identifiers associated with users (including corporate users). Domain names, IP addresses, email addresses, and public cryptography keys are examples among many others. Some of these identifiers are dynamic and thus ambiguous. For example, IP addresses are not always permanent and may change (for example, temporary IP addresses assigned at Wi-Fi hotspots) or may be ambiguous in the case of Network Address Translation. Information about the time of assignment and the party to whom an IP address was assigned may be needed to identify an individual user. There has been considerable debate and even a recent court case regarding requirements to register users in domain name WHOIS databases in the context of the adoption of GDPR. If we are to accomplish the simultaneous objectives of protecting privacy while apprehending those engaged in harmful or criminal behavior on the Internet, we must find some balance between conflicting but desirable outcomes.<br>
This suggests to me that the notion of traceability under (internationally?) agreed circumstances (that is, differential traceability) might be a fruitful concept to explore. In most societies today, it is accepted that we must be identifiable to appropriate authorities under certain conditions (consider border crossings, traffic violation stops as examples). While there are conditions under which apparent anonymity is desirable and even justifiable (whistle-blowing, for example) absolute anonymity is actually quite difficult to achieve (another point made at the Ditchley workshop) and might not be absolutely desirable given the misbehaviors apparent anonymity invites. I expect this is a controversial conclusion and I look forward to subsequent discussion.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blackdot.be/2018/08/remote-access-console-using-raspberry-pi-3b-and-freebsd/">Remote Access Console using FreeBSD on an RPi3</a></p>

<ul>
<li>Our friend, and FOSDEM Booth Neighbour, Jorge, has posted a tutorial on how he created a remote access console for his SmartOS server and other machines in his homelab</li>
<li>Parts:</li>
<li>Raspberry Pi 3 B+</li>
<li>NavoLabs micro POE Hat</li>
<li>FT4232H  based USB-to-RS232 (4x) adapter</li>
<li>Official Raspberry Pi case (optional)</li>
<li>Heat-sink kit (optional)</li>
<li>USB-to-TTL adaptor (optional)</li>
<li>Sandisk 16Gb microSD</li>
</ul>

<blockquote>
<p>For the software I ended up using conserver. Below is a very brief tutorial on how to set everything up. I assume you have basic unix skills.</p>
</blockquote>

<ul>
<li>Get an RPi3 image, make some minor modifications for RPi3+, and write it to the USB stick</li>
<li>Configure FreeBSD on the RPi3
<ul>
<li>Load the ‘muge’ Ethernet Driver</li>
<li>Load USB serial support</li>
<li>Load the FTDI driver</li>
<li>Enable SSHd and Conserver</li>
<li>Configure Conserver</li>
<li>Setup log rotation</li>
<li>Start Conserver</li>
</ul>

<p></li><br>
<li>And you’re good to go</li><br>
</ul></p>

<blockquote>
<p>A small bonus script I wrote to turn on the 2nd LED on the rPI once the system is booted, it will then blink the LED if someone is connected to any of the consoles.</p>
</blockquote>

<ul>
<li>There is also a followup post with some additional tips: <a href="https://blackdot.be/2018/08/freebsd-uart-and-raspberry-pi-3-b/">https://blackdot.be/2018/08/freebsd-uart-and-raspberry-pi-3-b/</a></li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://twitter.com/ungleich/status/1031501391792156673">Annual Penguin Races</a></li>
<li><a href="http://www.mcternan.me.uk/mscgen/">Mscgen - Message Sequence Chart generator</a></li>
<li><a href="https://reviews.freebsd.org/D16723">This patch makes FreeBSD boot 500 - 800ms faster, please test on your hardware</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=338059">FreeBSD’s arc4random() replaced with OpenBSD ChaCha20 implementation</a></li>
<li><a href="https://twitter.com/freebsdfndation/status/1031590348768915456">MeetBSD Devsummit open for registrations</a></li>
<li><a href="https://mwl.io/archives/3654">New Podcast interview with Michael W. Lucas</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions<br>
We need more feedback emails. Please write to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></p>

<p>Additionally, we are considering a new segment to be added to the end of the show (to make it skippable), where we have a ~15 minute deep dive on a topic. Some initial ideas are on the Virtual Memory subsystem, the Scheduler, Capsicum, and GEOM. What topics would you like to get very detailed explanations of? Many of the explanations may have accompanying graphics, and not be very suitable for audio only listeners, that is why we are planning to put it at the very end of the episode.</p>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Trip reports from the Essen Hackathon and BSDCam, CfT: ZFS native encryption and UFS trim consolidation, ZFS performance benchmarks on a FreeBSD server, how to port your OS to EC2, Vint Cerf about traceability, Remote Access console to an RPi3 running FreeBSD, and more.</p>

<p>##Headlines<br>
###<a href="https://wiki.freebsd.org/DevSummit/201808Hackathon">Essen Hackathon &amp; BSDCam 2018 trip report</a></p>

<ul>
<li>Allan and Benedict met at FRA airport and then headed to the Air Rail terminal for our train to Essen where the Hackathon would happen over the weekend of Aug 10 - 12, 2018. Once there, we did not have to wait long until other early-arrivals would show up and soon we had about 10 people gathered for lunch. After buying some take-out pizzas and bringing it back to the Linuxhotel (there was a training still going on there so we could not get into our rooms yet), we sat in the sunny park and talked. More and more people arrived and soon, people started hacking on their laptops. Some people would not arrive until a few hours before midnight, but we already had a record appearance of 20 people in total.</li>
<li>On Saturday, we gathered everyone in one of the seminar rooms that had rooms and chairs for us. After some organizational infos, we did an introductory round and Benedict wrote down on the whiteboard what people were interested in. It was not long until groups formed to talk about SSL in base, weird ZFS scrubs that would go over 100% completion (fixed now). Other people started working on ports, fixing bugs, or wrote documentation. The day ended in a <a href="https://twitter.com/bsdbcr">BBQ in the Linuxhotel park</a>, which was well received by everyone.</li>
<li>On Sunday, after attendees packed up their luggage and stored it in the seminar room, we continued hacking until lunchtime. After a quick group picture, we headed to a local restaurant for the social event (which was not open on Saturday, otherwise we would have had it then). In the afternoon, most people departed, a good half of them were heading for BSDCam.</li>
<li><a href="http://freshbsd.org/search?q=Essen+hackathon">Commits from the hackathon (the ones from 2018)</a></li>
<li>Overall, the hackathon was well received by attendees and a lot of them liked the fact that it was close to another BSD gathering so they could nicely combine the two. Also, people thought about doing their own hackathon in the future, which is an exciting prospect. Thanks to all who attended, helped out here and there when needed. Special Thanks to <a href="https://www.netzkommune.de/">Netzkommune GmbH</a> for sponsoring the social event and the <a href="http://linuxhotel.de/">Linuxhotel</a> for having us.</li>
<li>Benedict was having a regular work day on Monday after coming back from the hackathon, but flew out to Heathrow on Tuesday. Allan was in London a day earlier and arrived a couple of hours before Benedict in Cambridge. He headed for the Computer Lab even though the main event would not start until Wednesday. Most people gathered at the Maypole pub on Tuesday evening for welcomes, food and drinks.</li>
<li>On Wednesday, a lot of people met in the breakfast room of Churchill College where most people were staying and went to the Computer Lab, which served as the main venue for BSDCam, together. The morning was spend with introductions and collecting what most people were interested in talking. This unconference style has worked well in the past and soon we had 10 main sessions together for the rest of this and the following two days (<a href="https://bsdcam.cl.cam.ac.uk/">full schedule</a>).</li>
<li>Most sessions took notes, which you can find on the <a href="https://wiki.freebsd.org/DevSummit/201808">FreeBSD wiki</a>.</li>
<li>On Thursday evening, we had a nice formal dinner at Trinity Hall.</li>
<li>BSDCam 2018 was a great success with a lot of fruitful discussions and planning sessions. We thank the organizers for BSDCam for making it happen.</li>
<li>A special mentions goes out to Robert Watson and his family. Even though he was not there, he had a good reason to miss it: they had their first child born at the beginning of the week. Congratulations and best wishes to all three of them!</li>
</ul>

<p><hr></p>

<p>###<a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070832.html">Call for Testing: ZFS Native Encryption for FreeBSD</a></p>

<ul>
<li>A port of the ZoL (ZFS-on-Linux) feature that provides native crypto support for ZFS is ready for testing on FreeBSD</li>
<li>Most of the porting was done by <a href="mailto:sef@freebsd.org">sef@freebsd.org</a> (Sean Eric Fagan)</li>
<li>The original ZoL commit is here: <a href="https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49">https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49</a></li>
<li>For an overview, see Tom Caputi’s presentation from the OpenZFS Developers Summit in 2016</li>
<li>Video: <a href="https://youtu.be/frnLiXclAMo">https://youtu.be/frnLiXclAMo</a></li>
<li>Slides: <a href="https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=sharing">https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=sharing</a></li>
<li>WARNING: test in VMs or with spare disks etc, pools created with this code, or upgraded to this version, will no longer be importable on systems that do not support this feature. The on-disk format or other things may change before the final version, so you will likely have to ‘zfs send | zfs recv’ the data on to a new pool</li>
<li>Thanks for testing to help this feature land in FreeBSD</li>
</ul>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###<a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070797.html">Call for Testing: UFS TRIM Consolidation</a></p>

<ul>
<li>Kirk Mckusick posts to the FreeBSD mailing list looking for testers for the new UFS TRIM Consolidation code</li>
</ul>

<blockquote>
<p>When deleting files on filesystems that are stored on flash-memory (solid-state) disk drives, the filesystem notifies the underlying disk of the blocks that it is no longer using. The notification allows the drive to avoid saving these blocks when it needs to flash (zero out) one of its flash pages. These notifications of no-longer-being-used blocks are referred to as TRIM notifications. In FreeBSD these TRIM notifications are sent from the filesystem to the drive using the BIO_DELETE command.<br>
Until now, the filesystem would send a separate message to the drive for each block of the file that was deleted. Each Gigabyte of file size resulted in over 3000 TRIM messages being sent to the drive. This burst of messages can overwhelm the drive’s task queue causing multiple second delays for read and write requests.<br>
This implementation collects runs of contiguous blocks in the file and then consolodates them into a single BIO_DELETE command to the drive. The BIO_DELETE command describes the run of blocks as a single large block being deleted. Each Gigabyte of file size can result in as few as two BIO_DELETE commands and is typically less than ten.  Though these larger BIO_DELETE commands take longer to run, they do not clog the drive task queue, so read and write commands can intersperse effectively with them.<br>
Though this new feature has been throughly reviewed and tested, it is being added disabled by default so as to minimize the possibility of disrupting the upcoming 12.0 release. It can be enabled by running ``sysctl vfs.ffs.dotrimcons=1’’. Users are encouraged to test it. If no problems arise, we will consider requesting that it be enabled by default for 12.0.<br>
This support is off by default, but I am hoping that I can get enough testing to ensure that it (a) works, and (b) is helpful that it will be reasonable to have it turned on by default in 12.0. The cutoff for turning it on by default in 12.0 is September 19th. So I am requesting your testing feedback in the near-term. Please let me know if you have managed to use it successfully (or not) and also if it provided any performance difference (good or bad).</p>
</blockquote>

<ul>
<li>To enable TRIM consolidation use `sysctl vfs.ffs.dotrimcons=1’</li>
<li>There is also a diff that adds additional statistics: <a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070798.html">https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070798.html</a></li>
<li>You can also watch the volume and latency of BIO_DELETE commands by running <code>gstat</code> with the -d flag</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://aravindh.net/post/zfs_performance/">ZFS performance</a></p>

<ul>
<li>Aravindh Sampathkumar, a Performance Engineer and Sysadmin posts some simple benchmarks he did on a new ZFS server</li>
</ul>

<blockquote>
<p>This is NOT an all-in post about ZFS performance. I built a FreeBSD+ZFS file server recently at work to serve as an offsite backup server. I wanted to run a few synthetic workloads on it and look at how it fares from performance perspective. Mostly for curiosity and learning purposes.<br>
As stated in the notes about building this server, performance was not one of the priorities, as this server will never face our active workload. What I care about from this server is its ability to work with rsync and keep the data synchronised with our primary storage server. With that context, I ran a few write tests to see how good our solution is and what to expect from it in terms of performance.</p>
</blockquote>

<ul>
<li>The article then uses FIO to do some benchmarks.</li>
<li>As the author did, make sure you match the FIO block size to the ZFS record size to avoid write amplification. Either tune FIO or adjust the recordsize property in ZFS</li>
<li>You also want to consider compression and cache effects</li>
</ul>

<blockquote>
<p>Write Performance: Incompressible: 1600-2600 MB/s, Compressible: 2500-6600 MB/s<br>
Another over 1200 MB/s is enough to keep your 10 gigabit network saturated</p>
</blockquote>

<ul>
<li>The increased latency that is seen with higher number of writers working, may be the result of the ZFS backpressure system (the write throttle). There is some tuning that can be done there. Specifically, since this machine has 768 GB of ram, you might allow more than 4GB of dirty data, which would mean you’d be able to write larger batches and not have to push back while you wait for a transaction group to flush when dealing with gigabytes/sec of writes</li>
</ul>

<p><hr></p>

<p>###<a href="http://www.daemonology.net/blog/2018-07-14-port-OS-to-EC2.html">How to port your OS to EC2</a></p>

<ul>
<li>Colin Percival reflects on his FreeBSD on EC2 maintainership efforts in his blog:</li>
</ul>

<blockquote>
<p>I’ve been the maintainer of the FreeBSD/EC2 platform for about 7.5 years now, and as far as “running things in virtual machines” goes, that remains the only operating system and the only cloud which I work on. That said, from time to time I get questions from people who want to port other operating systems into EC2, and being a member of the open source community, I do my best to help them. I realized a few days ago that rather than replying to emails one by one it would be more efficient to post something publicly; so — for the benefit of the dozen or so people who want to port operating systems to run in EC2, and the curiosity of maybe a thousand more people who use EC2 but will never build AMIs themselves — here’s a rough guide to building EC2 images.<br>
Before we can talk about building images, there are some things you need:<br>
Your OS needs to run on x86 hardware. 64-bit (“amd64”, “x86-64”) is ideal, but I’ve managed to run 32-bit FreeBSD on “64-bit” EC2 instances so at least in some cases that’s not strictly necessary.<br>
You almost certainly want to have drivers for Xen block devices (for all of the pre-Nitro EC2 instances) or for NVMe disks (for the most recent EC2 instances). Theoretically you could make do without these since there’s some ATA emulation available for bootstrapping, but if you want to do any disk I/O after the kernel finishes booting you’ll want to have a disk driver.<br>
Similarly, you need support for the Xen network interface (older instances), Intel 10 GbE SR-IOV networking (some newer but pre-Nitro instances), or Amazon’s “ENA” network adapters (on Nitro instances), unless you plan on having instances which don’t communicate over the network. The ENA driver is probably the hardest thing to port, since as far as I know there’s no way to get your hands on the hardware directly, and it’s very difficult to do any debugging in EC2 without having a working network.<br>
Finally, the obvious: You need to have an AWS account, and appropriate API access keys.<br>
Building a disk image</p>
<p>Building an AMI<br>
I wrote a simple tool for converting disk images into EC2 instances: bsdec2-image-upload. It uploads a disk image to Amazon S3; makes an API call to import that disk image into an EBS volume; creates a snapshot of that volume; then registers an EC2 AMI using that snapshot.<br>
To use bsdec2-image-upload, you’ll first need to create an S3 bucket for it to use as a staging area. You can call it anything you like, but I recommend that you</p>
</blockquote>

<blockquote>
<p>Create it in a “nearby” region (for performance reasons), and<br>
Set an S3 “lifecycle policy” which deletes objects automatically after 1 day (since bsdec2-image-upload doesn’t clean up the S3 bucket, and those objects are useless once you’ve finished creating an AMI).</p>
</blockquote>

<blockquote>
<p>Boot configuration<br>
Odds are that your instance started booting and got as far as the boot loader launching the kernel, but at some point after that things went sideways. Now we start the iterative process of building disk images, turning them into AMIs, launching said AMIs, and seeing where they break. Some things you’ll probably run into here:<br>
EC2 instances have two types of console available to them: A serial console and an VGA console. (Or rather, emulated serial and emulated VGA.) If you can have your kernel output go to both consoles, I recommend doing that. If you have to pick one, the serial console (which shows up as the “System Log” in EC2) is probably more useful than the VGA console (which shows up as “instance screenshot”) since it lets you see more than one screen of logs at once; but there’s a catch: Due to some bizarre breakage in EC2 — which I’ve been complaining about for ten years — the serial console is very “laggy”. If you find that you’re not getting any output, wait five minutes and try again.<br>
You may need to tell your kernel where to find the root filesystem. On FreeBSD we build our disk images using GPT labels, so we simply need to specify in /etc/fstab that the root filesystem is on /dev/gpt/rootfs; but if you can’t do this, you’ll probably need to have different AMIs for Nitro instances vs. non-Nitro instances since Xen block devices will typically show up with different device names from NVMe disks. On FreeBSD, I also needed to set the vfs.root.mountfrom kernel environment variable for a while; this also is no longer needed on FreeBSD but something similar may be needed on other systems.<br>
You’ll need to enable networking, using DHCP. On FreeBSD, this means placing ifconfig_DEFAULT=“SYNCDHCP” into /etc/rc.conf; other systems will have other ways of specifying network parameters, and it may be necessary to specify a setting for the Xen network device, Intel SR-IOV network, and the Amazon ENA interface so that you’ll have the necessary configuration across all EC2 instance types. (On FreeBSD, ifconfig_DEFAULT takes care of specifying the network settings which should apply for whatever network interface the kernel finds at boot time.)<br>
You’ll almost certainly want to turn on SSH, so that you can connect into newly launched instances and make use of them. Don’t worry about setting a password or creating a user to SSH into yet — we’ll take care of that later.<br>
EC2 configuration<br>
Now it’s time to make the AMI behave like an EC2 instance. To this end, I prepared a set of rc.d scripts for FreeBSD. Most importantly, they<br>
Print the SSH host keys to the console, so that you can veriy that they are correct when you first SSH in. (Remember, Verifying SSH host keys is more important than flossing every day.)<br>
Download the SSH public key you want to use for logging in, and create an account (by default, “ec2-user”) with that key set up for you.<br>
Fetch EC2 user-data and process it via configinit to allow you to configure the system as part of the process of launching it.<br>
If your OS has an rc system derived from NetBSD’s rc.d, you may be able to use these scripts without any changes by simply installing them and enabling them in /etc/rc.conf; otherwise you may need to write your own scripts using mine as a model.<br>
Firstboot scripts<br>
A feature I added to FreeBSD a few years ago is the concept of “firstboot” scripts: These startup scripts are only run the first time a system boots. The aforementioned configinit and SSH key fetching scripts are flagged this way — so if your OS doesn’t support the “firstboot” keyword on rc.d scripts you’ll need to hack around that — but EC2 instances also ship with other scripts set to run on the first boot:<br>
FreeBSD Update will fetch and install security and critical errata updates, and then reboot the system if necessary.<br>
The UFS filesystem on the “boot disk” will be automatically expanded to the full size of the disk — this makes it possible to specify a larger size of disk at EC2 instance launch time.<br>
Third-party packages will be automatically fetched and installed, according to a list in /etc/rc.conf. This is most useful if configinit is used to edit /etc/rc.conf, since it allows you to specify packages to install via the EC2 user-data.<br>
While none of these are strictly necessary, I find them to be extremely useful and highly recommend implementing similar functionality in your systems.<br>
Support my work!<br>
I hope you find this useful, or at very least interesting. Please consider supporting my work in this area; while I’m happy to contribute my time to supporting open source software, it would be nice if I had money coming in which I could use to cover incidental expenses (e.g., conference travel) so that I didn’t end up paying to contribute to FreeBSD.</p>
</blockquote>

<p><hr></p>

<p><strong>Digital Ocean</strong><br>
<a href="https://do.co/bsdnow">https://do.co/bsdnow</a></p>

<p>###<a href="https://cacm.acm.org/magazines/2018/8/229771-traceability/fulltext">Traceability, by Vint Cerf</a></p>

<ul>
<li>A recent article from the August issue of the Communications of the ACM, for your contemplation:</li>
</ul>

<blockquote>
<p>At a recent workshop on cybersecurity in the U.K., a primary topic of consideration was how to preserve the freedom and openness of the Internet while protecting against the harmful behaviors that have emerged in this global medium. That this is a significant challenge cannot be overstated. The bad behaviors range from social network bullying and misinformation to email spam, distributed denial of service attacks, direct cyberattacks against infrastructure, malware propagation, identity theft, and a host of other ills requiring a wide range of technical and legal considerations. That these harmful behaviors can and do cross international boundaries only makes it more difficult to fashion effective responses.<br>
In other columns, I have argued for better software development tools to reduce the common mistakes that lead to vulnerabilities that are exploited. Here, I want to focus on another aspect of response related to law enforcement and tracking down perpetrators. Of course, not all harms are (or perhaps are not yet) illegal, but discovering those who cause them may still be warranted. The recent adoption and implementation of the General Data Protection Regulation (GDPR) in the European Union creates an interesting tension because it highlights the importance and value of privacy while those who do direct or indirect harm must be tracked down and their identities discovered.<br>
In passing, I mention that cryptography has sometimes been blamed for protecting the identity or actions of criminals but it is also a tool for protecting privacy. Arguments have been made for “back doors” to cryptographic systems but I am of the opinion that such proposals carry extremely high risk to privacy and safety. It is not my intent to argue this question in this column.<br>
What is of interest to me is a concept to which I was introduced at the Ditchley workshop, specifically, differential traceability. The ability to trace bad actors to bring them to justice seems to me an important goal in a civilized society. The tension with privacy protection leads to the idea that only under appropriate conditions can privacy be violated. By way of example, consider license plates on cars. They are usually arbitrary identifiers and special authority is needed to match them with the car owners (unless, of course, they are vanity plates like mine: “Cerfsup”). This is an example of differential traceability; the police department has the authority to demand ownership information from the Department of Motor Vehicles that issues the license plates. Ordinary citizens do not have this authority.<br>
In the Internet environment there are a variety of identifiers associated with users (including corporate users). Domain names, IP addresses, email addresses, and public cryptography keys are examples among many others. Some of these identifiers are dynamic and thus ambiguous. For example, IP addresses are not always permanent and may change (for example, temporary IP addresses assigned at Wi-Fi hotspots) or may be ambiguous in the case of Network Address Translation. Information about the time of assignment and the party to whom an IP address was assigned may be needed to identify an individual user. There has been considerable debate and even a recent court case regarding requirements to register users in domain name WHOIS databases in the context of the adoption of GDPR. If we are to accomplish the simultaneous objectives of protecting privacy while apprehending those engaged in harmful or criminal behavior on the Internet, we must find some balance between conflicting but desirable outcomes.<br>
This suggests to me that the notion of traceability under (internationally?) agreed circumstances (that is, differential traceability) might be a fruitful concept to explore. In most societies today, it is accepted that we must be identifiable to appropriate authorities under certain conditions (consider border crossings, traffic violation stops as examples). While there are conditions under which apparent anonymity is desirable and even justifiable (whistle-blowing, for example) absolute anonymity is actually quite difficult to achieve (another point made at the Ditchley workshop) and might not be absolutely desirable given the misbehaviors apparent anonymity invites. I expect this is a controversial conclusion and I look forward to subsequent discussion.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blackdot.be/2018/08/remote-access-console-using-raspberry-pi-3b-and-freebsd/">Remote Access Console using FreeBSD on an RPi3</a></p>

<ul>
<li>Our friend, and FOSDEM Booth Neighbour, Jorge, has posted a tutorial on how he created a remote access console for his SmartOS server and other machines in his homelab</li>
<li>Parts:</li>
<li>Raspberry Pi 3 B+</li>
<li>NavoLabs micro POE Hat</li>
<li>FT4232H  based USB-to-RS232 (4x) adapter</li>
<li>Official Raspberry Pi case (optional)</li>
<li>Heat-sink kit (optional)</li>
<li>USB-to-TTL adaptor (optional)</li>
<li>Sandisk 16Gb microSD</li>
</ul>

<blockquote>
<p>For the software I ended up using conserver. Below is a very brief tutorial on how to set everything up. I assume you have basic unix skills.</p>
</blockquote>

<ul>
<li>Get an RPi3 image, make some minor modifications for RPi3+, and write it to the USB stick</li>
<li>Configure FreeBSD on the RPi3
<ul>
<li>Load the ‘muge’ Ethernet Driver</li>
<li>Load USB serial support</li>
<li>Load the FTDI driver</li>
<li>Enable SSHd and Conserver</li>
<li>Configure Conserver</li>
<li>Setup log rotation</li>
<li>Start Conserver</li>
</ul>

<p></li><br>
<li>And you’re good to go</li><br>
</ul></p>

<blockquote>
<p>A small bonus script I wrote to turn on the 2nd LED on the rPI once the system is booted, it will then blink the LED if someone is connected to any of the consoles.</p>
</blockquote>

<ul>
<li>There is also a followup post with some additional tips: <a href="https://blackdot.be/2018/08/freebsd-uart-and-raspberry-pi-3-b/">https://blackdot.be/2018/08/freebsd-uart-and-raspberry-pi-3-b/</a></li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://twitter.com/ungleich/status/1031501391792156673">Annual Penguin Races</a></li>
<li><a href="http://www.mcternan.me.uk/mscgen/">Mscgen - Message Sequence Chart generator</a></li>
<li><a href="https://reviews.freebsd.org/D16723">This patch makes FreeBSD boot 500 - 800ms faster, please test on your hardware</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=338059">FreeBSD’s arc4random() replaced with OpenBSD ChaCha20 implementation</a></li>
<li><a href="https://twitter.com/freebsdfndation/status/1031590348768915456">MeetBSD Devsummit open for registrations</a></li>
<li><a href="https://mwl.io/archives/3654">New Podcast interview with Michael W. Lucas</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions<br>
We need more feedback emails. Please write to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></p>

<p>Additionally, we are considering a new segment to be added to the end of the show (to make it skippable), where we have a ~15 minute deep dive on a topic. Some initial ideas are on the Virtual Memory subsystem, the Scheduler, Capsicum, and GEOM. What topics would you like to get very detailed explanations of? Many of the explanations may have accompanying graphics, and not be very suitable for audio only listeners, that is why we are planning to put it at the very end of the episode.</p>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 259: Long Live Unix | BSD Now 259</title>
  <link>https://www.bsdnow.tv/259</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2433</guid>
  <pubDate>Thu, 16 Aug 2018 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f1dc9150-bd92-4004-9643-095d9da96886.mp3" length="64748796" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The strange birth and long life of Unix, FreeBSD jail with a single public IP, EuroBSDcon 2018 talks and schedule, OpenBSD on G4 iBook, PAM template user, ZFS file server, and reflections on one year of OpenBSD use.</itunes:subtitle>
  <itunes:duration>1:47:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The strange birth and long life of Unix, FreeBSD jail with a single public IP, EuroBSDcon 2018 talks and schedule, OpenBSD on G4 iBook, PAM template user, ZFS file server, and reflections on one year of OpenBSD use.
&lt;h3&gt;
&lt;a&gt;&lt;/a&gt;Picking the contest winner&lt;/h3&gt;
&lt;ol&gt;
&lt;li&gt;Vincent&lt;/li&gt;
&lt;li&gt;Bostjan&lt;/li&gt;
&lt;li&gt;Andrew&lt;/li&gt;
&lt;li&gt;Klaus-Hendrik&lt;/li&gt;
&lt;li&gt;Will&lt;/li&gt;
&lt;li&gt;Toby&lt;/li&gt;
&lt;li&gt;Johnny&lt;/li&gt;
&lt;li&gt;David&lt;/li&gt;
&lt;li&gt;manfrom&lt;/li&gt;
&lt;li&gt;Niclas&lt;/li&gt;
&lt;li&gt;Gary&lt;/li&gt;
&lt;li&gt;Eddy&lt;/li&gt;
&lt;li&gt;Bruce&lt;/li&gt;
&lt;li&gt;Lizz&lt;/li&gt;
&lt;li&gt;Jim&lt;/li&gt;
&lt;/ol&gt;
&lt;p&gt;&lt;a href="https://www.random.org/integers/?num=1&amp;amp;min=0&amp;amp;max=15&amp;amp;col=1&amp;amp;base=10&amp;amp;format=html&amp;amp;rnd=new"&gt;Random number generator&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;##Headlines&lt;br&gt;
###&lt;a href="https://spectrum.ieee.org/tech-history/cyberspace/the-strange-birth-and-long-life-of-unix"&gt;The Strange Birth and Long Life of Unix&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;They say that when one door closes on you, another opens. People generally offer this bit of wisdom just to lend some solace after a misfortune. But sometimes it’s actually true. It certainly was for Ken Thompson and the late Dennis Ritchie, two of the greats of 20th-century information technology, when they created the Unix operating system, now considered one of the most inspiring and influential pieces of software ever written.&lt;br&gt;
A door had slammed shut for Thompson and Ritchie in March of 1969, when their employer, the American Telephone &amp;amp; Telegraph Co., withdrew from a collaborative project with the Massachusetts Institute of Technology and General Electric to create an interactive time-sharing system called Multics, which stood for “Multiplexed Information and Computing Service.” Time-sharing, a technique that lets multiple people use a single computer simultaneously, had been invented only a decade earlier. Multics was to combine time-sharing with other technological advances of the era, allowing users to phone a computer from remote terminals and then read e-mail, edit documents, run calculations, and so forth. It was to be a great leap forward from the way computers were mostly being used, with people tediously preparing and submitting batch jobs on punch cards to be run one by one.&lt;br&gt;
Over five years, AT&amp;amp;T invested millions in the Multics project, purchasing a GE-645 mainframe computer and dedicating to the effort many of the top researchers at the company’s renowned Bell Telephone Laboratories—­including Thompson and Ritchie, Joseph F. Ossanna, Stuart Feldman, M. Douglas McIlroy, and the late Robert Morris. But the new system was too ambitious, and it fell troublingly behind schedule. In the end, AT&amp;amp;T’s corporate leaders decided to pull the plug.&lt;br&gt;
After AT&amp;amp;T’s departure from the Multics project, managers at Bell Labs, in Murray Hill, N.J., became reluctant to allow any further work on computer operating systems, leaving some researchers there very frustrated. Although Multics hadn’t met many of its objectives, it had, as Ritchie later recalled, provided them with a “convenient interactive computing service, a good environment in which to do programming, [and] a system around which a fellowship could form.” Suddenly, it was gone.&lt;br&gt;
With heavy hearts, the researchers returned to using their old batch system. At such an inauspicious moment, with management dead set against the idea, it surely would have seemed foolhardy to continue designing computer operating systems. But that’s exactly what Thompson, Ritchie, and many of their Bell Labs colleagues did. Now, some 40 years later, we should be thankful that these programmers ignored their bosses and continued their labor of love, which gave the world Unix, one of the greatest computer operating systems of all time.&lt;br&gt;
The rogue project began in earnest when Thompson, Ritchie, and a third Bell Labs colleague, Rudd Canaday, began to sketch out on paper the design for a file system. Thompson then wrote the basics of a new operating system for the lab’s GE-645 mainframe. But with the Multics project ended, so too was the need for the GE-645. Thompson realized that any further programming he did on it was likely to go nowhere, so he dropped the effort.&lt;br&gt;
Thompson had passed some of his time after the demise of Multics writing a computer game called Space Travel, which simulated all the major bodies in the solar system along with a spaceship that could fly around them. Written for the GE-645, Space Travel was clunky to play—and expensive: roughly US $75 a game for the CPU time. Hunting around, Thompson came across a dusty PDP-7, a minicomputer built by Digital Equipment Corp. that some of his Bell Labs colleagues had purchased earlier for a circuit-analysis project. Thompson rewrote Space Travel to run on it.&lt;br&gt;
And with that little programming exercise, a second door cracked ajar. It was to swing wide open during the summer of 1969 when Thompson’s wife, Bonnie, spent a month visiting his parents to show off their newborn son. Thompson took advantage of his temporary bachelor existence to write a good chunk of what would become the Unix operating system for the discarded PDP‑7. The name Unix stems from a joke one of Thompson’s colleagues made: Because the new operating system supported only one user (Thompson), he saw it as an emasculated version of Multics and dubbed it “Un-multiplexed Information and Computing Service,” or Unics. The name later morphed into Unix.&lt;br&gt;
Initially, Thompson used the GE-645 to compose and compile the software, which he then downloaded to the PDP‑7. But he soon weaned himself from the mainframe, and by the end of 1969 he was able to write operating-system code on the PDP-7 itself. That was a step in the right direction. But Thompson and the others helping him knew that the PDP‑7, which was already obsolete, would not be able to sustain their skunkworks for long. They also knew that the lab’s management wasn’t about to allow any more research on operating systems.&lt;br&gt;
So Thompson and Ritchie got crea­tive. They formulated a proposal to their bosses to buy one of DEC’s newer minicomputers, a PDP-11, but couched the request in especially palatable terms. They said they were aiming to create tools for editing and formatting text, what you might call a word-processing system today. The fact that they would also have to write an operating system for the new machine to support the editor and text formatter was almost a footnote.&lt;br&gt;
Management took the bait, and an order for a PDP-11 was placed in May 1970. The machine itself arrived soon after, although the disk drives for it took more than six months to appear. During the interim, Thompson, Ritchie, and others continued to develop Unix on the PDP-7. After the PDP-11’s disks were installed, the researchers moved their increasingly complex operating system over to the new machine. Next they brought over the roff text formatter written by Ossanna and derived from the runoff program, which had been used in an earlier time-sharing system.&lt;br&gt;
Unix was put to its first real-world test within Bell Labs when three typists from AT&amp;amp;T’s patents department began using it to write, edit, and format patent applications. It was a hit. The patent department adopted the system wholeheartedly, which gave the researchers enough credibility to convince management to purchase another machine—a newer and more powerful PDP-11 model—allowing their stealth work on Unix to continue.&lt;br&gt;
During its earliest days, Unix evolved constantly, so the idea of issuing named versions or releases seemed inappropriate. But the researchers did issue new editions of the programmer’s manual periodically, and the early Unix systems were named after each such edition. The first edition of the manual was completed in November 1971.&lt;br&gt;
So what did the first edition of Unix offer that made it so great? For one thing, the system provided a hierarchical file system, which allowed something we all now take for granted: Files could be placed in directories—or equivalently, folders—that in turn could be put within other directories. Each file could contain no more than 64 kilobytes, and its name could be no more than six characters long. These restrictions seem awkwardly limiting now, but at the time they appeared perfectly adequate.&lt;br&gt;
Although Unix was ostensibly created for word processing, the only editor available in 1971 was the line-oriented ed. Today, ed is still the only editor guaranteed to be present on all Unix systems. Apart from the text-processing and general system applications, the first edition of Unix included games such as blackjack, chess, and tic-tac-toe. For the system administrator, there were tools to dump and restore disk images to magnetic tape, to read and write paper tapes, and to create, check, mount, and unmount removable disk packs.&lt;br&gt;
Most important, the system offered an interactive environment that by this time allowed time-sharing, so several people could use a single machine at once. Various programming languages were available to them, including BASIC, Fortran, the scripting of Unix commands, assembly language, and B. The last of these, a descendant of a BCPL (Basic Combined Programming Language), ultimately evolved into the immensely popular C language, which Ritchie created while also working on Unix.&lt;br&gt;
The first edition of Unix let programmers call 34 different low-level routines built into the operating system. It’s a testament to the system’s enduring nature that nearly all of these system calls are still available—and still heavily used—on modern Unix and Linux systems four decades on. For its time, first-­edition Unix provided a remarkably powerful environment for software development. Yet it contained just 4200 lines of code at its heart and occupied a measly 16 KB of main memory when it ran.&lt;br&gt;
Unix’s great influence can be traced in part to its elegant design, simplicity, portability, and serendipitous timing. But perhaps even more important was the devoted user community that soon grew up around it. And that came about only by an accident of its unique history.&lt;br&gt;
The story goes like this: For years Unix remained nothing more than a Bell Labs research project, but by 1973 its authors felt the system was mature enough for them to present a paper on its design and implementation at a symposium of the Association for Computing Machinery. That paper was published in 1974 in the Communications of the ACM. Its appearance brought a flurry of requests for copies of the software.&lt;br&gt;
This put AT&amp;amp;T in a bind. In 1956, AT&amp;amp;T had agreed to a U.S government consent decree that prevented the company from selling products not directly related to telephones and telecommunications, in return for its legal monopoly status in running the country’s long-distance phone service. So Unix could not be sold as a product. Instead, AT&amp;amp;T released the Unix source code under license to anyone who asked, charging only a nominal fee. The critical wrinkle here was that the consent decree prevented AT&amp;amp;T from supporting Unix. Indeed, for many years Bell Labs researchers proudly displayed their Unix policy at conferences with a slide that read, “No advertising, no support, no bug fixes, payment in advance.”&lt;br&gt;
With no other channels of support available to them, early Unix adopters banded together for mutual assistance, forming a loose network of user groups all over the world. They had the source code, which helped. And they didn’t view Unix as a standard software product, because nobody seemed to be looking after it. So these early Unix users themselves set about fixing bugs, writing new tools, and generally improving the system as they saw fit.&lt;br&gt;
The Usenix user group acted as a clearinghouse for the exchange of Unix software in the United States. People could send in magnetic tapes with new software or fixes to the system and get back tapes with the software and fixes that Usenix had received from others. In Australia, the University of New South Wales and the University of Sydney produced a more robust version of Unix, the Australian Unix Share Accounting Method, which could cope with larger numbers of concurrent users and offered better performance.&lt;br&gt;
By the mid-1970s, the environment of sharing that had sprung up around Unix resembled the open-source movement so prevalent today. Users far and wide were enthusiastically enhancing the system, and many of their improvements were being fed back to Bell Labs for incorporation in future releases. But as Unix became more popular, AT&amp;amp;T’s lawyers began looking harder at what various licensees were doing with their systems.&lt;br&gt;
One person who caught their eye was John Lions, a computer scientist then teaching at the University of New South Wales, in Australia. In 1977, he published what was probably the most famous computing book of the time, A Commentary on the Unix Operating System, which contained an annotated listing of the central source code for Unix.&lt;br&gt;
Unix’s licensing conditions allowed for the exchange of source code, and initially, Lions’s book was sold to licensees. But by 1979, AT&amp;amp;T’s lawyers had clamped down on the book’s distribution and use in academic classes. The anti­authoritarian Unix community reacted as you might expect, and samizdat copies of the book spread like wildfire. Many of us have nearly unreadable nth-­generation photocopies of the original book.&lt;br&gt;
End runs around AT&amp;amp;T’s lawyers indeed became the norm—even at Bell Labs. For example, between the release of the sixth edition of Unix in 1975 and the seventh edition in 1979, Thompson collected dozens of important bug fixes to the system, coming both from within and outside of Bell Labs. He wanted these to filter out to the existing Unix user base, but the company’s lawyers felt that this would constitute a form of support and balked at their release. Nevertheless, those bug fixes soon became widely distributed through unofficial channels. For instance, Lou Katz, the founding president of Usenix, received a phone call one day telling him that if he went down to a certain spot on Mountain Avenue (where Bell Labs was located) at 2 p.m., he would find something of interest. Sure enough, Katz found a magnetic tape with the bug fixes, which were rapidly in the hands of countless users.&lt;br&gt;
By the end of the 1970s, Unix, which had started a decade earlier as a reaction against the loss of a comfortable programming environment, was growing like a weed throughout academia and the IT industry. Unix would flower in the early 1980s before reaching the height of its popularity in the early 1990s.&lt;br&gt;
For many reasons, Unix has since given way to other commercial and noncommercial systems. But its legacy, that of an elegant, well-designed, comfortable environment for software development, lives on. In recognition of their accomplishment, Thompson and Ritchie were given the Japan Prize earlier this year, adding to a collection of honors that includes the United States’ National Medal of Technology and Innovation and the Association of Computing Machinery’s Turing Award. Many other, often very personal, tributes to Ritchie and his enormous influence on computing were widely shared after his death this past October.&lt;br&gt;
Unix is indeed one of the most influential operating systems ever invented. Its direct descendants now number in the hundreds. On one side of the family tree are various versions of Unix proper, which began to be commercialized in the 1980s after the Bell System monopoly was broken up, freeing AT&amp;amp;T from the stipulations of the 1956 consent decree. On the other side are various Unix-like operating systems derived from the version of Unix developed at the University of California, Berkeley, including the one Apple uses today on its computers, OS X. I say “Unix-like” because the developers of the Berkeley Software Distribution (BSD) Unix on which these systems were based worked hard to remove all the original AT&amp;amp;T code so that their software and its descendants would be freely distributable.&lt;br&gt;
The effectiveness of those efforts were, however, called into question when the AT&amp;amp;T subsidiary Unix System Laboratories filed suit against Berkeley Software Design and the Regents of the University of California in 1992 over intellectual property rights to this software. The university in turn filed a counterclaim against AT&amp;amp;T for breaches to the license it provided AT&amp;amp;T for the use of code developed at Berkeley. The ensuing legal quagmire slowed the development of free Unix-like clones, including 386BSD, which was designed for the Intel 386 chip, the CPU then found in many IBM PCs.&lt;br&gt;
Had this operating system been available at the time, Linus Torvalds says he probably wouldn’t have created Linux, an open-source Unix-like operating system he developed from scratch for PCs in the early 1990s. Linux has carried the Unix baton forward into the 21st century, powering a wide range of digital gadgets including wireless routers, televisions, desktop PCs, and Android smartphones. It even runs some supercomputers.&lt;br&gt;
Although AT&amp;amp;T quickly settled its legal disputes with Berkeley Software Design and the University of California, legal wrangling over intellectual property claims to various parts of Unix and Linux have continued over the years, often involving byzantine corporate relations. By 2004, no fewer than five major lawsuits had been filed. Just this past August, a software company called the TSG Group (formerly known as the SCO Group), lost a bid in court to claim ownership of Unix copyrights that Novell had acquired when it purchased the Unix System Laboratories from AT&amp;amp;T in 1993.&lt;br&gt;
As a programmer and Unix historian, I can’t help but find all this legal sparring a bit sad. From the very start, the authors and users of Unix worked as best they could to build and share, even if that meant defying authority. That outpouring of selflessness stands in sharp contrast to the greed that has driven subsequent legal battles over the ownership of Unix.&lt;br&gt;
The world of computer hardware and software moves forward startlingly fast. For IT professionals, the rapid pace of change is typically a wonderful thing. But it makes us susceptible to the loss of our own history, including important lessons from the past. To address this issue in a small way, in 1995 I started a mailing list of old-time Unix ­aficionados. That effort morphed into the Unix Heritage Society. Our goal is not only to save the history of Unix but also to collect and curate these old systems and, where possible, bring them back to life. With help from many talented members of this society, I was able to restore much of the old Unix software to working order, including Ritchie’s first C compiler from 1972 and the first Unix system to be written in C, dating from 1973.&lt;br&gt;
One holy grail that eluded us for a long time was the first edition of Unix in any form, electronic or otherwise. Then, in 2006, Al Kossow from the Computer History Museum, in Mountain View, Calif., unearthed a printed study of Unix dated 1972, which not only covered the internal workings of Unix but also included a complete assembly listing of the kernel, the main component of this operating system. This was an amazing find—like discovering an old Ford Model T collecting dust in a corner of a barn. But we didn’t just want to admire the chrome work from afar. We wanted to see the thing run again.&lt;br&gt;
In 2008, Tim Newsham, an independent programmer in Hawaii, and I assembled a team of like-minded Unix enthusiasts and set out to bring this ancient system back from the dead. The work was technically arduous and often frustrating, but in the end, we had a copy of the first edition of Unix running on an emulated PDP-11/20. We sent out messages announcing our success to all those we thought would be interested. Thompson, always succinct, simply replied, “Amazing.” Indeed, his brainchild was amazing, and I’ve been happy to do what I can to make it, and the story behind it, better known.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Digital Ocean&lt;/strong&gt;&lt;br&gt;
&lt;a href="http://do.co/bsdnow"&gt;http://do.co/bsdnow&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://www.davd.eu/posts-freebsd-jails-with-a-single-public-ip-address/"&gt;FreeBSD jails with a single public IP address&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Jails in FreeBSD provide a simple yet flexible way to set up a proper server layout. In the most setups the actual server only acts as the host system for the jails while the applications themselves run within those independent containers. Traditionally every jail has it’s own IP for the user to be able to address the individual services. But if you’re still using IPv4 this might get you in trouble as the most hosters don’t offer more than one single public IP address per server.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Create the internal network&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;In this case NAT (“Network Address Translation”) is a good way to expose services in different jails using the same IP address.&lt;br&gt;
First, let’s create an internal network (“NAT network”) at 192.168.0.0/24. You could generally use any private IPv4 address space as specified in RFC 1918. Here’s an overview: &lt;a href="https://en.wikipedia.org/wiki/Private_network"&gt;https://en.wikipedia.org/wiki/Privatenetwork&lt;/a&gt;. Using pf, FreeBSD’s firewall, we will map requests on different ports of the same public IP address to our individual jails as well as provide network access to the jails themselves.&lt;br&gt;
First let’s check which network devices are available. In my case there’s em0 which provides connectivity to the internet and lo0, the local loopback device.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code class="language-em0:"&gt;  options=209b&amp;lt;RXCSUM,TXCSUM,VLANMTU,VLANHWTAGGING,VLANHWCSUM,WOLMAGIC&amp;gt;
  [...]
  inet 172.31.1.100 netmask 0xffffff00 broadcast 172.31.1.255
  nd6 options=23&amp;lt;PERFORMNUD,ACCEPTRTADV,AUTO_LINKLOCAL&amp;gt;
  media: Ethernet autoselect (1000baseT &amp;lt;full-duplex&amp;gt;)
  status: active
lo0: flags=8049&amp;lt;UP,LOOPBACK,RUNNING,MULTICAST&amp;gt; metric 0 mtu 16384
  options=600003&amp;lt;RXCSUM,TXCSUM,RXCSUMIPV6,TXCSUMIPV6&amp;gt;
  inet6 ::1 prefixlen 128
  inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
  inet 127.0.0.1 netmask 0xff000000
  nd6 options=21&amp;lt;PERFORMNUD,AUTO_LINKLOCAL&amp;gt;```
&amp;gt; For our internal network, we create a cloned loopback device called lo1. Therefore we need to customize the /etc/rc.conf file, adding the following two lines:
cloned_interfaces="lo1"
ipv4_addrs_lo1="192.168.0.1-9/29"
&amp;gt; This defines a /29 network, offering IP addresses for a maximum of 6 jails:
ipcalc 192.168.0.1/29
Address:   192.168.0.1          11000000.10101000.00000000.00000 001
Netmask:   255.255.255.248 = 29 11111111.11111111.11111111.11111 000
Wildcard:  0.0.0.7              00000000.00000000.00000000.00000 111
=&amp;gt;
Network:   192.168.0.0/29       11000000.10101000.00000000.00000 000
HostMin:   192.168.0.1          11000000.10101000.00000000.00000 001
HostMax:   192.168.0.6          11000000.10101000.00000000.00000 110
Broadcast: 192.168.0.7          11000000.10101000.00000000.00000 111
Hosts/Net: 6                     Class C, Private Internet
&amp;gt; Then we need to restart the network. Please be aware of currently active SSH sessions as they might be dropped during restart. It’s a good moment to ensure you have KVM access to that server ;-)
service netif restart
&amp;gt; After reconnecting, our newly created loopback device is active:
lo1: flags=8049&amp;lt;UP,LOOPBACK,RUNNING,MULTICAST&amp;gt; metric 0 mtu 16384
  options=600003&amp;lt;RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6&amp;gt;
  inet 192.168.0.1 netmask 0xfffffff8
  inet 192.168.0.2 netmask 0xffffffff
  inet 192.168.0.3 netmask 0xffffffff
  inet 192.168.0.4 netmask 0xffffffff
  inet 192.168.0.5 netmask 0xffffffff
  inet 192.168.0.6 netmask 0xffffffff
  inet 192.168.0.7 netmask 0xffffffff
  inet 192.168.0.8 netmask 0xffffffff
  inet 192.168.0.9 netmask 0xffffffff
  nd6 options=29&amp;lt;PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL&amp;gt;
Setting up
&amp;gt; pf part of the FreeBSD base system, so we only have to configure and enable it. By this moment you should already have a clue of which services you want to expose. If this is not the case, just fix that file later on. In my example configuration, I have a jail running a webserver and another jail running a mailserver:
 Public IP address
IP_PUB="1.2.3.4"
 Packet normalization
scrub in all
 Allow outbound connections from within the jails
nat on em0 from lo1:network to any -&amp;gt; (em0)
 webserver jail at 192.168.0.2
rdr on em0 proto tcp from any to $IP_PUB port 443 -&amp;gt; 192.168.0.2
just an example in case you want to redirect to another port within your jail
rdr on em0 proto tcp from any to $IP_PUB port 80 -&amp;gt; 192.168.0.2 port 8080
mailserver jail at 192.168.0.3
rdr on em0 proto tcp from any to $IP_PUB port 25 -&amp;gt; 192.168.0.3
rdr on em0 proto tcp from any to $IP_PUB port 587 -&amp;gt; 192.168.0.3
rdr on em0 proto tcp from any to $IP_PUB port 143 -&amp;gt; 192.168.0.3
rdr on em0 proto tcp from any to $IP_PUB port 993 -&amp;gt; 192.168.0.3
&amp;gt; Now just enable pf like this (which is the equivalent of adding pf_enable=YES to /etc/rc.conf):
sysrc pf_enable="YES"
&amp;gt; and start it:
service pf start
Install ezjail
&amp;gt; Ezjail is a collection of scripts by erdgeist that allow you to easily manage your jails.
pkg install ezjail
&amp;gt; As an alternative, you could install ezjail from the ports tree. Now we need to set up the basejail which contains the shared base system for our jails. In fact, every jail that you create get’s will use that basejail to symlink directories related to the base system like /bin and /sbin. This can be accomplished by running
ezjail-admin install
&amp;gt; In the next step, we’ll copy the /etc/resolv.conf file from our host to the newjail, which is the template for newly created jails (the parts that are not provided by basejail), to ensure that domain resolution will work properly within our jails later on:
cp /etc/resolv.conf /usr/jails/newjail/etc/
&amp;gt; Last but not least, we enable ezjail and start it:
sysrc ezjail_enable="YES"
service ezjail start
Create a jail
&amp;gt; Creating a jail is as easy as it could probably be:
ezjail-admin create webserver 192.168.0.2
ezjail-admin start webserver
&amp;gt; Now you can access your jail using:
ezjail-admin console webserver
&amp;gt; Each jail contains a vanilla FreeBSD installation.
Deploy services
&amp;gt; Now you can spin up as many jails as you want to set up your services like web, mail or file shares. You should take care not to enable sshd within your jails, because that would cause problems with the service’s IP bindings. But this is not a problem, just SSH to the host and enter your jail using ezjail-admin console.
EuroBSDcon 2018 Talks &amp;amp; Schedule (https://2018.eurobsdcon.org/talks-schedule/)
News Roundup
OpenBSD on an iBook G4 (https://bobstechsite.com/openbsd-on-an-ibook-g4/)
&amp;gt; I've mentioned on social media and on the BTS podcast a few times that I wanted to try installing OpenBSD onto an old "snow white" iBook G4 I acquired last summer to see if I could make it a useful machine again in the year 2018.  This particular eBay purchase came with a 14" 1024x768 TFT screen, 1.07GHz PowerPC G4 processor, 1.5GB RAM, 100GB of HDD space and an ATI Radeon 9200 graphics card with 32 MB of SDRAM. The optical drive, ethernet port, battery &amp;amp; USB slots are also fully-functional. The only thing that doesn't work is the CMOS battery, but that's not unexpected for a device that was originally released in 2004.
Initial experiments
&amp;gt; This iBook originally arrived at my door running Apple Mac OSX Leopard and came with the original install disk, the iLife &amp;amp; iWork suites for 2008, various instruction manuals, a working power cable and a spare keyboard. As you'll see in the pictures I took for this post the characters on the buttons have started to wear away from 14 years of intensive use, but the replacement needs a very good clean before I decide to swap it in!
&amp;gt; After spending some time exploring the last version of OSX to support the IBM PowerPC processor architecture I tried to see if the hardware was capable of modern computing with Linux. Something I knew ahead of trying this was that the WiFi adapter was unlikely to work because it's a highly proprietary component designed by Apple to work specifically with OSX and nothing else, but I figured I could probably use a wireless USB dongle later to get around this limitation.
&amp;gt; Unfortunately I found that no recent versions of mainstream Linux distributions would boot off this machine. Debian has dropped support 32-bit PowerPC architectures and the PowerPC variants of Ubuntu 16.04 LTS (vanilla, MATE and Lubuntu) wouldn't even boot the installer! The only distribution I could reliably install on the hardware was Lubuntu 14.04 LTS.
&amp;gt; Unfortunately I'm not the biggest fan of the LXDE desktop for regular work and a lot of ported applications were old and broken because it clearly wasn't being maintained by people that use the hardware anymore. Ubuntu 14.04 is also approaching the end of its support life in early 2019, so this limited solution also has a limited shelf-life.
Over to BSD
&amp;gt; I discussed this problem with a few people on Mastodon and it was pointed out to me that OSX is built on the Darwin kernel, which happens to be a variant of BSD. NetBSD and OpenBSD fans in particular convinced me that their communities still saw the value of supporting these old pieces of kit and that I should give BSD a try.
&amp;gt; So yesterday evening I finally downloaded the "macppc" version of OpenBSD 6.3 with no idea what to expect. I hoped for the best but feared the worst because my last experience with this operating system was trying out PC-BSD in 2008 and discovering with disappointment that it didn't support any of the hardware on my Toshiba laptop.
&amp;gt; When I initially booted OpenBSD I was a little surprised to find the login screen provided no visual feedback when I typed in my password, but I can understand the security reasons for doing that. The initial desktop environment that was loaded was very basic. All I could see was a console output window, a terminal and a desktop switcher in the X11 environment the system had loaded.
&amp;gt; After a little Googling I found this blog post had some fantastic instructions to follow for the post-installation steps: https://sohcahtoa.org.uk/openbsd.html. I did have to adjust them slightly though because my iBook only has 1.5GB RAM and not every package that page suggests is available on macppc by default. You can see a full list here: https://ftp.openbsd.org/pub/OpenBSD/6.3/packages/powerpc/.
Final thoughts
&amp;gt; I was really impressed with the performance of OpenBSD's "macppc" port. It boots much faster than OSX Leopard on the same hardware and unlike Lubuntu 14.04 it doesn't randomly hang for no reason or crash if you launch something demanding like the GIMP.
&amp;gt; I was pleased to see that the command line tools I'm used to using on Linux have been ported across too. OpenBSD also had no issues with me performing basic desktop tasks on XFCE like browsing the web with NetSurf, playing audio files with VLC and editing images with the GIMP. Limited gaming is also theoretically possible if you're willing to build them (or an emulator) from source with SDL support.
&amp;gt; If I wanted to use this system for heavy duty work then I'd probably be inclined to run key applications like LibreOffice on a Raspberry Pi and then connect my iBook G4 to those using VNC or an SSH connection with X11 forwarding. BSD is UNIX after all, so using my ancient laptop as a dumb terminal should work reasonably well.
&amp;gt; In summary I was impressed with OpenBSD and its ability to breathe new life into this old Apple Mac. I'm genuinely excited about the idea of trying BSD with other devices on my network such as an old Asus Eee PC 900 netbook and at least one of the many Raspberry Pi devices I use. Whether I go the whole hog and replace Fedora on my main production laptop though remains to be seen!
The template user with PAM and login(1) (http://oshogbo.vexillium.org/blog/48)
&amp;gt; When you build a new service (or an appliance) you need your users to be able to configure it from the command line. To accomplish this you can create system accounts for all registered users in your service and assign them a special login shell which provides such limited functionality. This can be painful if you have a dynamic user database.
&amp;gt; Another challenge is authentication via remote services such as RADIUS. How can we implement  services when we authenticate through it and log into it as a different user? Furthermore, imagine a scenario when RADIUS decides on which account we have the right to access by sending an additional attribute.
&amp;gt; To address these two problems we can use a "template" user. Any of the PAM modules can set the value of the PAM_USER item. The value of this item will be used to determine which account we want to login. Only the "template" user must exist on the local password database, but the credential check can be omitted by the module.
&amp;gt; This functionality exists in the login(1) used by FreeBSD, HardenedBSD, DragonFlyBSD and illumos. The functionality doesn't exist in the login(1) used in NetBSD, and OpenBSD doesn't support PAM modules at all. In addition what  is also noteworthy is that such functionality was also in the OpenSSH but they decided to remove it and call it a security vulnerability (CVE 2015-6563). I can see how some people may have seen it that way, that’s why I recommend reading this article from an OpenPAM author and a FreeBSD security officer at the time.
&amp;gt; Knowing the background let's take a look at an example.
```PAMEXTERN int
pamsmauthenticate(pamhandlet *pamh, int flags _unused,
    int argc _unused, const char *argv[] _unused)
{
        const char *user, *password;
        int err;
    err = pam_get_user(pamh, &amp;amp;user, NULL);
    if (err != PAM_SUCCESS)
            return (err);

    err = pam_get_authtok(pamh, PAM_AUTHTOK, &amp;amp;password, NULL);
    if (err == PAM_CONV_ERR)
            return (err);
    if (err != PAM_SUCCESS)
            return (PAM_AUTH_ERR);

    err = authenticate(user, password);
    if (err != PAM_SUCCESS) {
            return (err);
    }

    return (pam_set_item(pamh, PAM_USER, "template"));
}
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;In the listing above we have an example of a PAM module. The pamgetuser(3) provides a username. The pamgetauthtok(3) shows us a secret given by the user. Both functions allow us to give an optional prompt which should be shown to the user. The authenticate function is our crafted function which authenticates the user. In our first scenario we wanted to keep all users in an external database. If authentication is successful we then switch to a template user which has  a shell set up for a script allowing us to configure the machine. In our second scenario the authenticate function authenticates the user in RADIUS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Another step is to add our PAM module to the /etc/pam.d/system or to the /etc/pam.d/login configuration:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;auth sufficient pamtemplate.so nowarn allowlocal&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Unfortunately the description of all these options goes beyond this article - if you would like to know more about it you can find them in the PAM manual. The last thing we need to do is to add our template user to the system which  you can do by the adduser(8) command or just simply modifying the /etc/master.passwd file and use pwdmkdb(8) program:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;$ tail -n /etc/master.passwd&lt;/code&gt;&lt;br&gt;
&lt;code&gt;template::1000:1000::0:0:User &amp;amp;:/:/usr/local/bin/templatesh&lt;/code&gt;&lt;br&gt;
&lt;code&gt;$ sudo pwdmkdb /etc/master.passwd&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;As you can see,the template user can be locked and we still can use it in our PAM module (the * character after login).&lt;br&gt;
I would like to thank Dag-Erling Smørgrav for pointing this functionality out to me when I was looking for it some time ago.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;br&gt;
&lt;a href="https://www.ixsystems.com/blog/vmworld2018-countdown/"&gt;iXsystems @ VMWorld&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://aravindh.net/posts/zfsfileserver/"&gt;ZFS file server&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;What is the need?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;At work, we run a compute cluster that uses an Isilon cluster as primary NAS storage. Excluding snapshots, we have about 200TB of research data, some of them in compressed formats, and others not. We needed an offsite backup file server that would constantly mirror our primary NAS and serve as a quick recovery source in case of a data loss in the the primary NAS. This offsite file server would be passive - will never face the wrath of the primary cluster workload.&lt;br&gt;
In addition to the role of a passive backup server, this solution would take on some passive report generation workloads as an ideal way of offloading some work from the primary NAS. The passive work is read-only.&lt;br&gt;
The backup server would keep snapshots in a best effort basis dating back to 10 years. However, this data on this backup server would be archived to tapes periodically.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;A simple guidance of priorities:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Data integrity &amp;gt; Cost of solution &amp;gt; Storage capacity &amp;gt; Performance.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Why not enterprise NAS? NetApp FAS or EMC Isilon or the like?&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;We decided that enterprise grade NAS like NetAPP FAS or EMC Isilon are prohibitively expensive and an overkill for our needs.&lt;br&gt;
An open source &amp;amp; cheaper alternative to enterprise grade filesystem with the level of durability we expect turned up to be ZFS. We’re already spoilt from using snapshots by a clever Copy-on-Write Filesystem(WAFL) by NetApp. ZFS providing snapshots in almost identical way was a big influence in the choice. This is also why we did not consider just a CentOS box with the default XFS filesystem.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;FreeBSD vs Debian for ZFS&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;This is a backup server, a long-term solution. Stability and reliability are key requirements. ZFS on Linux may be popular at this time, but there is a lot of churn around its development, which means there is a higher probability of bugs like this to occur. We’re not looking for cutting edge features here. Perhaps, Linux would be considered in the future.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;FreeBSD + ZFS&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;We already utilize FreeBSD and OpenBSD for infrastructure services and we have nothing but praises for the stability that the BSDs have provided us. We’d gladly use FreeBSD and OpenBSD wherever possible.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Okay, ZFS, but why not FreeNAS?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;IMHO, FreeNAS provides a integrated GUI management tool over FreeBSD for a novice user to setup and configure FreeBSD, ZFS, Jails and many other features. But, this user facing abstraction adds an extra layer of complexity to maintain that is just not worth it in simpler use cases like ours. For someone that appreciates the commandline interface, and understands FreeBSD enough to administer it, plain FreeBSD + ZFS is simpler and more robust than FreeNAS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Specifications&lt;/li&gt;
&lt;li&gt;Lenovo SR630 Rackserver&lt;/li&gt;
&lt;li&gt;2 X Intel Xeon silver 4110 CPUs&lt;/li&gt;
&lt;li&gt;768 GB of DDR4 ECC 2666 MHz RAM&lt;/li&gt;
&lt;li&gt;4 port SAS card configured in passthrough mode(JBOD)&lt;/li&gt;
&lt;li&gt;Intel network card with 10 Gb SFP+ ports&lt;/li&gt;
&lt;li&gt;128GB M.2 SSD for use as boot drive&lt;/li&gt;
&lt;li&gt;2 X HGST 4U60 JBOD&lt;/li&gt;
&lt;li&gt;120(2 X 60) X 10TB SAS disks&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://nanxiao.me/en/reflection-on-one-year-usage-of-openbsd/"&gt;Reflection on one-year usage of OpenBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I have used OpenBSD for more than one year, and it is time to give a summary of the experience:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;(1) What do I get from OpenBSD?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;a) A good UNIX tutorial. When I am curious about some UNIXcommands’ implementation, I will refer to OpenBSD source code, and I actually gain something every time. E.g., refresh socket programming skills from nc; know how to process file efficiently from cat.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;b) A better test bed. Although my work focus on developing programs on Linux, I will try to compile and run applications on OpenBSD if it is possible. One reason is OpenBSD usually gives more helpful warnings. E.g., hint like this:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;......&lt;/code&gt;&lt;br&gt;
&lt;code&gt;warning: sprintf() is often misused, please use snprintf()&lt;/code&gt;&lt;br&gt;
&lt;code&gt;......&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Or you can refer this post which I wrote before. The other is sometimes program run well on Linux may crash on OpenBSD, and OpenBSD can help you find hidden bugs.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;c) Some handy tools. E.g. I find tcpbench is useful, so I ported it into Linux for my own usage (project is here).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;(2) What I give back to OpenBSD?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;a) Patches. Although most of them are trivial modifications, they are still my contributions.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;b) Write blog posts to share experience about using OpenBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;c) Develop programs for OpenBSD/BSD: lscpu and free.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;d) Porting programs into OpenBSD: E.g., I find google/benchmark is a nifty tool, but lacks OpenBSD support, I submitted PR and it is accepted. So you can use google/benchmark on OpenBSD now.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Generally speaking, the time invested on OpenBSD is rewarding. If you are still hesitating, why not give a shot?&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.meetup.com/BSD-Users-Stockholm/events/253447019/"&gt;BSD Users Stockholm Meetup&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/playlist?list=PLeF8ZihVdpFfkICtA2HFsZecdC28_mrQh"&gt;BSDCan 2018 Playlist&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://forum.opnsense.org/index.php?PHPSESSID=hvuv2kg4js2nlfpm73ut5ro8p2&amp;amp;topic=9280.0"&gt;OPNsense 18.7 released&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://youtu.be/WLgdJwd5zcQ"&gt;Testing TrueOS (FreeBSD derivative) on real hardware ThinkPad T410&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2018-July/000946.html"&gt;Kernel Hacker Wanted!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/changeset/base/337411"&gt;Replace a pair of 8-bit writes to VGA memory with a single 16-bit write&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/changeset/base/337229"&gt;Reduce taskq and context-switch cost of zio pipe&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://reviews.freebsd.org/D16606"&gt;Proposed FreeBSD Memory Management change, expected to improve ZFS ARC interactions&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Anian_Z - &lt;a href="http://dpaste.com/093FC8R#wrap"&gt;Question&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Robert - &lt;a href="http://dpaste.com/0GG7Q2A#wrap"&gt;Pool question&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Lain - &lt;a href="http://dpaste.com/2BWPX9C"&gt;Congratulations&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Thomas - &lt;a href="http://dpaste.com/25NGAP3#wrap"&gt;L2arc&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd,openbsd,netbsd,dragonflybsd,trueos,trident,hardenedbsd,tutorial,howto,guide,bsd,interview,eurobsdcon,pam,zfs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The strange birth and long life of Unix, FreeBSD jail with a single public IP, EuroBSDcon 2018 talks and schedule, OpenBSD on G4 iBook, PAM template user, ZFS file server, and reflections on one year of OpenBSD use.</p>

<h3><a id="Picking_the_contest_winner_0"></a>Picking the contest winner</h3>

<ol>
<li>Vincent</li>
<li>Bostjan</li>
<li>Andrew</li>
<li>Klaus-Hendrik</li>
<li>Will</li>
<li>Toby</li>
<li>Johnny</li>
<li>David</li>
<li>manfrom</li>
<li>Niclas</li>
<li>Gary</li>
<li>Eddy</li>
<li>Bruce</li>
<li>Lizz</li>
<li>Jim</li>
</ol>

<p><a href="https://www.random.org/integers/?num=1&amp;min=0&amp;max=15&amp;col=1&amp;base=10&amp;format=html&amp;rnd=new">Random number generator</a></p>

<p>##Headlines<br>
###<a href="https://spectrum.ieee.org/tech-history/cyberspace/the-strange-birth-and-long-life-of-unix">The Strange Birth and Long Life of Unix</a></p>

<blockquote>
<p>They say that when one door closes on you, another opens. People generally offer this bit of wisdom just to lend some solace after a misfortune. But sometimes it’s actually true. It certainly was for Ken Thompson and the late Dennis Ritchie, two of the greats of 20th-century information technology, when they created the Unix operating system, now considered one of the most inspiring and influential pieces of software ever written.<br>
A door had slammed shut for Thompson and Ritchie in March of 1969, when their employer, the American Telephone &amp; Telegraph Co., withdrew from a collaborative project with the Massachusetts Institute of Technology and General Electric to create an interactive time-sharing system called Multics, which stood for “Multiplexed Information and Computing Service.” Time-sharing, a technique that lets multiple people use a single computer simultaneously, had been invented only a decade earlier. Multics was to combine time-sharing with other technological advances of the era, allowing users to phone a computer from remote terminals and then read e-mail, edit documents, run calculations, and so forth. It was to be a great leap forward from the way computers were mostly being used, with people tediously preparing and submitting batch jobs on punch cards to be run one by one.<br>
Over five years, AT&amp;T invested millions in the Multics project, purchasing a GE-645 mainframe computer and dedicating to the effort many of the top researchers at the company’s renowned Bell Telephone Laboratories—­including Thompson and Ritchie, Joseph F. Ossanna, Stuart Feldman, M. Douglas McIlroy, and the late Robert Morris. But the new system was too ambitious, and it fell troublingly behind schedule. In the end, AT&amp;T’s corporate leaders decided to pull the plug.<br>
After AT&amp;T’s departure from the Multics project, managers at Bell Labs, in Murray Hill, N.J., became reluctant to allow any further work on computer operating systems, leaving some researchers there very frustrated. Although Multics hadn’t met many of its objectives, it had, as Ritchie later recalled, provided them with a “convenient interactive computing service, a good environment in which to do programming, [and] a system around which a fellowship could form.” Suddenly, it was gone.<br>
With heavy hearts, the researchers returned to using their old batch system. At such an inauspicious moment, with management dead set against the idea, it surely would have seemed foolhardy to continue designing computer operating systems. But that’s exactly what Thompson, Ritchie, and many of their Bell Labs colleagues did. Now, some 40 years later, we should be thankful that these programmers ignored their bosses and continued their labor of love, which gave the world Unix, one of the greatest computer operating systems of all time.<br>
The rogue project began in earnest when Thompson, Ritchie, and a third Bell Labs colleague, Rudd Canaday, began to sketch out on paper the design for a file system. Thompson then wrote the basics of a new operating system for the lab’s GE-645 mainframe. But with the Multics project ended, so too was the need for the GE-645. Thompson realized that any further programming he did on it was likely to go nowhere, so he dropped the effort.<br>
Thompson had passed some of his time after the demise of Multics writing a computer game called Space Travel, which simulated all the major bodies in the solar system along with a spaceship that could fly around them. Written for the GE-645, Space Travel was clunky to play—and expensive: roughly US $75 a game for the CPU time. Hunting around, Thompson came across a dusty PDP-7, a minicomputer built by Digital Equipment Corp. that some of his Bell Labs colleagues had purchased earlier for a circuit-analysis project. Thompson rewrote Space Travel to run on it.<br>
And with that little programming exercise, a second door cracked ajar. It was to swing wide open during the summer of 1969 when Thompson’s wife, Bonnie, spent a month visiting his parents to show off their newborn son. Thompson took advantage of his temporary bachelor existence to write a good chunk of what would become the Unix operating system for the discarded PDP‑7. The name Unix stems from a joke one of Thompson’s colleagues made: Because the new operating system supported only one user (Thompson), he saw it as an emasculated version of Multics and dubbed it “Un-multiplexed Information and Computing Service,” or Unics. The name later morphed into Unix.<br>
Initially, Thompson used the GE-645 to compose and compile the software, which he then downloaded to the PDP‑7. But he soon weaned himself from the mainframe, and by the end of 1969 he was able to write operating-system code on the PDP-7 itself. That was a step in the right direction. But Thompson and the others helping him knew that the PDP‑7, which was already obsolete, would not be able to sustain their skunkworks for long. They also knew that the lab’s management wasn’t about to allow any more research on operating systems.<br>
So Thompson and Ritchie got crea­tive. They formulated a proposal to their bosses to buy one of DEC’s newer minicomputers, a PDP-11, but couched the request in especially palatable terms. They said they were aiming to create tools for editing and formatting text, what you might call a word-processing system today. The fact that they would also have to write an operating system for the new machine to support the editor and text formatter was almost a footnote.<br>
Management took the bait, and an order for a PDP-11 was placed in May 1970. The machine itself arrived soon after, although the disk drives for it took more than six months to appear. During the interim, Thompson, Ritchie, and others continued to develop Unix on the PDP-7. After the PDP-11’s disks were installed, the researchers moved their increasingly complex operating system over to the new machine. Next they brought over the roff text formatter written by Ossanna and derived from the runoff program, which had been used in an earlier time-sharing system.<br>
Unix was put to its first real-world test within Bell Labs when three typists from AT&amp;T’s patents department began using it to write, edit, and format patent applications. It was a hit. The patent department adopted the system wholeheartedly, which gave the researchers enough credibility to convince management to purchase another machine—a newer and more powerful PDP-11 model—allowing their stealth work on Unix to continue.<br>
During its earliest days, Unix evolved constantly, so the idea of issuing named versions or releases seemed inappropriate. But the researchers did issue new editions of the programmer’s manual periodically, and the early Unix systems were named after each such edition. The first edition of the manual was completed in November 1971.<br>
So what did the first edition of Unix offer that made it so great? For one thing, the system provided a hierarchical file system, which allowed something we all now take for granted: Files could be placed in directories—or equivalently, folders—that in turn could be put within other directories. Each file could contain no more than 64 kilobytes, and its name could be no more than six characters long. These restrictions seem awkwardly limiting now, but at the time they appeared perfectly adequate.<br>
Although Unix was ostensibly created for word processing, the only editor available in 1971 was the line-oriented ed. Today, ed is still the only editor guaranteed to be present on all Unix systems. Apart from the text-processing and general system applications, the first edition of Unix included games such as blackjack, chess, and tic-tac-toe. For the system administrator, there were tools to dump and restore disk images to magnetic tape, to read and write paper tapes, and to create, check, mount, and unmount removable disk packs.<br>
Most important, the system offered an interactive environment that by this time allowed time-sharing, so several people could use a single machine at once. Various programming languages were available to them, including BASIC, Fortran, the scripting of Unix commands, assembly language, and B. The last of these, a descendant of a BCPL (Basic Combined Programming Language), ultimately evolved into the immensely popular C language, which Ritchie created while also working on Unix.<br>
The first edition of Unix let programmers call 34 different low-level routines built into the operating system. It’s a testament to the system’s enduring nature that nearly all of these system calls are still available—and still heavily used—on modern Unix and Linux systems four decades on. For its time, first-­edition Unix provided a remarkably powerful environment for software development. Yet it contained just 4200 lines of code at its heart and occupied a measly 16 KB of main memory when it ran.<br>
Unix’s great influence can be traced in part to its elegant design, simplicity, portability, and serendipitous timing. But perhaps even more important was the devoted user community that soon grew up around it. And that came about only by an accident of its unique history.<br>
The story goes like this: For years Unix remained nothing more than a Bell Labs research project, but by 1973 its authors felt the system was mature enough for them to present a paper on its design and implementation at a symposium of the Association for Computing Machinery. That paper was published in 1974 in the Communications of the ACM. Its appearance brought a flurry of requests for copies of the software.<br>
This put AT&amp;T in a bind. In 1956, AT&amp;T had agreed to a U.S government consent decree that prevented the company from selling products not directly related to telephones and telecommunications, in return for its legal monopoly status in running the country’s long-distance phone service. So Unix could not be sold as a product. Instead, AT&amp;T released the Unix source code under license to anyone who asked, charging only a nominal fee. The critical wrinkle here was that the consent decree prevented AT&amp;T from supporting Unix. Indeed, for many years Bell Labs researchers proudly displayed their Unix policy at conferences with a slide that read, “No advertising, no support, no bug fixes, payment in advance.”<br>
With no other channels of support available to them, early Unix adopters banded together for mutual assistance, forming a loose network of user groups all over the world. They had the source code, which helped. And they didn’t view Unix as a standard software product, because nobody seemed to be looking after it. So these early Unix users themselves set about fixing bugs, writing new tools, and generally improving the system as they saw fit.<br>
The Usenix user group acted as a clearinghouse for the exchange of Unix software in the United States. People could send in magnetic tapes with new software or fixes to the system and get back tapes with the software and fixes that Usenix had received from others. In Australia, the University of New South Wales and the University of Sydney produced a more robust version of Unix, the Australian Unix Share Accounting Method, which could cope with larger numbers of concurrent users and offered better performance.<br>
By the mid-1970s, the environment of sharing that had sprung up around Unix resembled the open-source movement so prevalent today. Users far and wide were enthusiastically enhancing the system, and many of their improvements were being fed back to Bell Labs for incorporation in future releases. But as Unix became more popular, AT&amp;T’s lawyers began looking harder at what various licensees were doing with their systems.<br>
One person who caught their eye was John Lions, a computer scientist then teaching at the University of New South Wales, in Australia. In 1977, he published what was probably the most famous computing book of the time, A Commentary on the Unix Operating System, which contained an annotated listing of the central source code for Unix.<br>
Unix’s licensing conditions allowed for the exchange of source code, and initially, Lions’s book was sold to licensees. But by 1979, AT&amp;T’s lawyers had clamped down on the book’s distribution and use in academic classes. The anti­authoritarian Unix community reacted as you might expect, and samizdat copies of the book spread like wildfire. Many of us have nearly unreadable nth-­generation photocopies of the original book.<br>
End runs around AT&amp;T’s lawyers indeed became the norm—even at Bell Labs. For example, between the release of the sixth edition of Unix in 1975 and the seventh edition in 1979, Thompson collected dozens of important bug fixes to the system, coming both from within and outside of Bell Labs. He wanted these to filter out to the existing Unix user base, but the company’s lawyers felt that this would constitute a form of support and balked at their release. Nevertheless, those bug fixes soon became widely distributed through unofficial channels. For instance, Lou Katz, the founding president of Usenix, received a phone call one day telling him that if he went down to a certain spot on Mountain Avenue (where Bell Labs was located) at 2 p.m., he would find something of interest. Sure enough, Katz found a magnetic tape with the bug fixes, which were rapidly in the hands of countless users.<br>
By the end of the 1970s, Unix, which had started a decade earlier as a reaction against the loss of a comfortable programming environment, was growing like a weed throughout academia and the IT industry. Unix would flower in the early 1980s before reaching the height of its popularity in the early 1990s.<br>
For many reasons, Unix has since given way to other commercial and noncommercial systems. But its legacy, that of an elegant, well-designed, comfortable environment for software development, lives on. In recognition of their accomplishment, Thompson and Ritchie were given the Japan Prize earlier this year, adding to a collection of honors that includes the United States’ National Medal of Technology and Innovation and the Association of Computing Machinery’s Turing Award. Many other, often very personal, tributes to Ritchie and his enormous influence on computing were widely shared after his death this past October.<br>
Unix is indeed one of the most influential operating systems ever invented. Its direct descendants now number in the hundreds. On one side of the family tree are various versions of Unix proper, which began to be commercialized in the 1980s after the Bell System monopoly was broken up, freeing AT&amp;T from the stipulations of the 1956 consent decree. On the other side are various Unix-like operating systems derived from the version of Unix developed at the University of California, Berkeley, including the one Apple uses today on its computers, OS X. I say “Unix-like” because the developers of the Berkeley Software Distribution (BSD) Unix on which these systems were based worked hard to remove all the original AT&amp;T code so that their software and its descendants would be freely distributable.<br>
The effectiveness of those efforts were, however, called into question when the AT&amp;T subsidiary Unix System Laboratories filed suit against Berkeley Software Design and the Regents of the University of California in 1992 over intellectual property rights to this software. The university in turn filed a counterclaim against AT&amp;T for breaches to the license it provided AT&amp;T for the use of code developed at Berkeley. The ensuing legal quagmire slowed the development of free Unix-like clones, including 386BSD, which was designed for the Intel 386 chip, the CPU then found in many IBM PCs.<br>
Had this operating system been available at the time, Linus Torvalds says he probably wouldn’t have created Linux, an open-source Unix-like operating system he developed from scratch for PCs in the early 1990s. Linux has carried the Unix baton forward into the 21st century, powering a wide range of digital gadgets including wireless routers, televisions, desktop PCs, and Android smartphones. It even runs some supercomputers.<br>
Although AT&amp;T quickly settled its legal disputes with Berkeley Software Design and the University of California, legal wrangling over intellectual property claims to various parts of Unix and Linux have continued over the years, often involving byzantine corporate relations. By 2004, no fewer than five major lawsuits had been filed. Just this past August, a software company called the TSG Group (formerly known as the SCO Group), lost a bid in court to claim ownership of Unix copyrights that Novell had acquired when it purchased the Unix System Laboratories from AT&amp;T in 1993.<br>
As a programmer and Unix historian, I can’t help but find all this legal sparring a bit sad. From the very start, the authors and users of Unix worked as best they could to build and share, even if that meant defying authority. That outpouring of selflessness stands in sharp contrast to the greed that has driven subsequent legal battles over the ownership of Unix.<br>
The world of computer hardware and software moves forward startlingly fast. For IT professionals, the rapid pace of change is typically a wonderful thing. But it makes us susceptible to the loss of our own history, including important lessons from the past. To address this issue in a small way, in 1995 I started a mailing list of old-time Unix ­aficionados. That effort morphed into the Unix Heritage Society. Our goal is not only to save the history of Unix but also to collect and curate these old systems and, where possible, bring them back to life. With help from many talented members of this society, I was able to restore much of the old Unix software to working order, including Ritchie’s first C compiler from 1972 and the first Unix system to be written in C, dating from 1973.<br>
One holy grail that eluded us for a long time was the first edition of Unix in any form, electronic or otherwise. Then, in 2006, Al Kossow from the Computer History Museum, in Mountain View, Calif., unearthed a printed study of Unix dated 1972, which not only covered the internal workings of Unix but also included a complete assembly listing of the kernel, the main component of this operating system. This was an amazing find—like discovering an old Ford Model T collecting dust in a corner of a barn. But we didn’t just want to admire the chrome work from afar. We wanted to see the thing run again.<br>
In 2008, Tim Newsham, an independent programmer in Hawaii, and I assembled a team of like-minded Unix enthusiasts and set out to bring this ancient system back from the dead. The work was technically arduous and often frustrating, but in the end, we had a copy of the first edition of Unix running on an emulated PDP-11/20. We sent out messages announcing our success to all those we thought would be interested. Thompson, always succinct, simply replied, “Amazing.” Indeed, his brainchild was amazing, and I’ve been happy to do what I can to make it, and the story behind it, better known.</p>
</blockquote>

<p><hr></p>

<p><strong>Digital Ocean</strong><br>
<a href="http://do.co/bsdnow">http://do.co/bsdnow</a></p>

<p>###<a href="https://www.davd.eu/posts-freebsd-jails-with-a-single-public-ip-address/">FreeBSD jails with a single public IP address</a></p>

<blockquote>
<p>Jails in FreeBSD provide a simple yet flexible way to set up a proper server layout. In the most setups the actual server only acts as the host system for the jails while the applications themselves run within those independent containers. Traditionally every jail has it’s own IP for the user to be able to address the individual services. But if you’re still using IPv4 this might get you in trouble as the most hosters don’t offer more than one single public IP address per server.</p>
</blockquote>

<ul>
<li>Create the internal network</li>
</ul>

<blockquote>
<p>In this case NAT (“Network Address Translation”) is a good way to expose services in different jails using the same IP address.<br>
First, let’s create an internal network (“NAT network”) at 192.168.0.0/24. You could generally use any private IPv4 address space as specified in RFC 1918. Here’s an overview: <a href="https://en.wikipedia.org/wiki/Private_network">https://en.wikipedia.org/wiki/Private_network</a>. Using pf, FreeBSD’s firewall, we will map requests on different ports of the same public IP address to our individual jails as well as provide network access to the jails themselves.<br>
First let’s check which network devices are available. In my case there’s em0 which provides connectivity to the internet and lo0, the local loopback device.</p>
</blockquote>

<pre><code class="language-em0:">  options=209b&lt;RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC&gt;
  [...]
  inet 172.31.1.100 netmask 0xffffff00 broadcast 172.31.1.255
  nd6 options=23&lt;PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL&gt;
  media: Ethernet autoselect (1000baseT &lt;full-duplex&gt;)
  status: active

lo0: flags=8049&lt;UP,LOOPBACK,RUNNING,MULTICAST&gt; metric 0 mtu 16384
  options=600003&lt;RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6&gt;
  inet6 ::1 prefixlen 128
  inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
  inet 127.0.0.1 netmask 0xff000000
  nd6 options=21&lt;PERFORMNUD,AUTO_LINKLOCAL&gt;```

&gt; For our internal network, we create a cloned loopback device called lo1. Therefore we need to customize the /etc/rc.conf file, adding the following two lines:

```cloned_interfaces=&quot;lo1&quot;
ipv4_addrs_lo1=&quot;192.168.0.1-9/29&quot;```

&gt; This defines a /29 network, offering IP addresses for a maximum of 6 jails:

```ipcalc 192.168.0.1/29
Address:   192.168.0.1          11000000.10101000.00000000.00000 001
Netmask:   255.255.255.248 = 29 11111111.11111111.11111111.11111 000
Wildcard:  0.0.0.7              00000000.00000000.00000000.00000 111
=&gt;
Network:   192.168.0.0/29       11000000.10101000.00000000.00000 000
HostMin:   192.168.0.1          11000000.10101000.00000000.00000 001
HostMax:   192.168.0.6          11000000.10101000.00000000.00000 110
Broadcast: 192.168.0.7          11000000.10101000.00000000.00000 111
Hosts/Net: 6                     Class C, Private Internet```

&gt; Then we need to restart the network. Please be aware of currently active SSH sessions as they might be dropped during restart. It’s a good moment to ensure you have KVM access to that server ;-)

```service netif restart```

&gt; After reconnecting, our newly created loopback device is active:

```lo1: flags=8049&lt;UP,LOOPBACK,RUNNING,MULTICAST&gt; metric 0 mtu 16384
  options=600003&lt;RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6&gt;
  inet 192.168.0.1 netmask 0xfffffff8
  inet 192.168.0.2 netmask 0xffffffff
  inet 192.168.0.3 netmask 0xffffffff
  inet 192.168.0.4 netmask 0xffffffff
  inet 192.168.0.5 netmask 0xffffffff
  inet 192.168.0.6 netmask 0xffffffff
  inet 192.168.0.7 netmask 0xffffffff
  inet 192.168.0.8 netmask 0xffffffff
  inet 192.168.0.9 netmask 0xffffffff
  nd6 options=29&lt;PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL&gt;```

+ Setting up

&gt; pf part of the FreeBSD base system, so we only have to configure and enable it. By this moment you should already have a clue of which services you want to expose. If this is not the case, just fix that file later on. In my example configuration, I have a jail running a webserver and another jail running a mailserver:

 +  Public IP address
```IP_PUB=&quot;1.2.3.4&quot;```

 +  Packet normalization
```scrub in all```

 +  Allow outbound connections from within the jails
```nat on em0 from lo1:network to any -&gt; (em0)```

 +  webserver jail at 192.168.0.2
```rdr on em0 proto tcp from any to $IP_PUB port 443 -&gt; 192.168.0.2```

 + just an example in case you want to redirect to another port within your jail
```rdr on em0 proto tcp from any to $IP_PUB port 80 -&gt; 192.168.0.2 port 8080```

 + mailserver jail at 192.168.0.3
```rdr on em0 proto tcp from any to $IP_PUB port 25 -&gt; 192.168.0.3```
```rdr on em0 proto tcp from any to $IP_PUB port 587 -&gt; 192.168.0.3```
```rdr on em0 proto tcp from any to $IP_PUB port 143 -&gt; 192.168.0.3```
```rdr on em0 proto tcp from any to $IP_PUB port 993 -&gt; 192.168.0.3```

&gt; Now just enable pf like this (which is the equivalent of adding pf_enable=YES to /etc/rc.conf):

```sysrc pf_enable=&quot;YES&quot;```

&gt; and start it:

```service pf start```

+ Install ezjail

&gt; Ezjail is a collection of scripts by erdgeist that allow you to easily manage your jails.

```pkg install ezjail```

&gt; As an alternative, you could install ezjail from the ports tree. Now we need to set up the basejail which contains the shared base system for our jails. In fact, every jail that you create get’s will use that basejail to symlink directories related to the base system like /bin and /sbin. This can be accomplished by running

```ezjail-admin install```

&gt; In the next step, we’ll copy the /etc/resolv.conf file from our host to the newjail, which is the template for newly created jails (the parts that are not provided by basejail), to ensure that domain resolution will work properly within our jails later on:

```cp /etc/resolv.conf /usr/jails/newjail/etc/```

&gt; Last but not least, we enable ezjail and start it:

```sysrc ezjail_enable=&quot;YES&quot;```
```service ezjail start```

+ Create a jail

&gt; Creating a jail is as easy as it could probably be:

```ezjail-admin create webserver 192.168.0.2```
```ezjail-admin start webserver```

&gt; Now you can access your jail using:

```ezjail-admin console webserver```

&gt; Each jail contains a vanilla FreeBSD installation.

+ Deploy services

&gt; Now you can spin up as many jails as you want to set up your services like web, mail or file shares. You should take care not to enable sshd within your jails, because that would cause problems with the service’s IP bindings. But this is not a problem, just SSH to the host and enter your jail using ezjail-admin console.
***

###[EuroBSDcon 2018 Talks &amp; Schedule](https://2018.eurobsdcon.org/talks-schedule/)
***




##News Roundup
###[OpenBSD on an iBook G4](https://bobstechsite.com/openbsd-on-an-ibook-g4/)
&gt; I've mentioned on social media and on the BTS podcast a few times that I wanted to try installing OpenBSD onto an old &quot;snow white&quot; iBook G4 I acquired last summer to see if I could make it a useful machine again in the year 2018.  This particular eBay purchase came with a 14&quot; 1024x768 TFT screen, 1.07GHz PowerPC G4 processor, 1.5GB RAM, 100GB of HDD space and an ATI Radeon 9200 graphics card with 32 MB of SDRAM. The optical drive, ethernet port, battery &amp; USB slots are also fully-functional. The only thing that doesn't work is the CMOS battery, but that's not unexpected for a device that was originally released in 2004.

+ Initial experiments

&gt; This iBook originally arrived at my door running Apple Mac OSX Leopard and came with the original install disk, the iLife &amp; iWork suites for 2008, various instruction manuals, a working power cable and a spare keyboard. As you'll see in the pictures I took for this post the characters on the buttons have started to wear away from 14 years of intensive use, but the replacement needs a very good clean before I decide to swap it in!

&gt; After spending some time exploring the last version of OSX to support the IBM PowerPC processor architecture I tried to see if the hardware was capable of modern computing with Linux. Something I knew ahead of trying this was that the WiFi adapter was unlikely to work because it's a highly proprietary component designed by Apple to work specifically with OSX and nothing else, but I figured I could probably use a wireless USB dongle later to get around this limitation.

&gt; Unfortunately I found that no recent versions of mainstream Linux distributions would boot off this machine. Debian has dropped support 32-bit PowerPC architectures and the PowerPC variants of Ubuntu 16.04 LTS (vanilla, MATE and Lubuntu) wouldn't even boot the installer! The only distribution I could reliably install on the hardware was Lubuntu 14.04 LTS.

&gt; Unfortunately I'm not the biggest fan of the LXDE desktop for regular work and a lot of ported applications were old and broken because it clearly wasn't being maintained by people that use the hardware anymore. Ubuntu 14.04 is also approaching the end of its support life in early 2019, so this limited solution also has a limited shelf-life.

+ Over to BSD

&gt; I discussed this problem with a few people on Mastodon and it was pointed out to me that OSX is built on the Darwin kernel, which happens to be a variant of BSD. NetBSD and OpenBSD fans in particular convinced me that their communities still saw the value of supporting these old pieces of kit and that I should give BSD a try.

&gt; So yesterday evening I finally downloaded the &quot;macppc&quot; version of OpenBSD 6.3 with no idea what to expect. I hoped for the best but feared the worst because my last experience with this operating system was trying out PC-BSD in 2008 and discovering with disappointment that it didn't support any of the hardware on my Toshiba laptop.

&gt; When I initially booted OpenBSD I was a little surprised to find the login screen provided no visual feedback when I typed in my password, but I can understand the security reasons for doing that. The initial desktop environment that was loaded was very basic. All I could see was a console output window, a terminal and a desktop switcher in the X11 environment the system had loaded.

&gt; After a little Googling I found this blog post had some fantastic instructions to follow for the post-installation steps: https://sohcahtoa.org.uk/openbsd.html. I did have to adjust them slightly though because my iBook only has 1.5GB RAM and not every package that page suggests is available on macppc by default. You can see a full list here: https://ftp.openbsd.org/pub/OpenBSD/6.3/packages/powerpc/.

+ Final thoughts

&gt; I was really impressed with the performance of OpenBSD's &quot;macppc&quot; port. It boots much faster than OSX Leopard on the same hardware and unlike Lubuntu 14.04 it doesn't randomly hang for no reason or crash if you launch something demanding like the GIMP.

&gt; I was pleased to see that the command line tools I'm used to using on Linux have been ported across too. OpenBSD also had no issues with me performing basic desktop tasks on XFCE like browsing the web with NetSurf, playing audio files with VLC and editing images with the GIMP. Limited gaming is also theoretically possible if you're willing to build them (or an emulator) from source with SDL support.

&gt; If I wanted to use this system for heavy duty work then I'd probably be inclined to run key applications like LibreOffice on a Raspberry Pi and then connect my iBook G4 to those using VNC or an SSH connection with X11 forwarding. BSD is UNIX after all, so using my ancient laptop as a dumb terminal should work reasonably well.

&gt; In summary I was impressed with OpenBSD and its ability to breathe new life into this old Apple Mac. I'm genuinely excited about the idea of trying BSD with other devices on my network such as an old Asus Eee PC 900 netbook and at least one of the many Raspberry Pi devices I use. Whether I go the whole hog and replace Fedora on my main production laptop though remains to be seen!

***

###[The template user with PAM and login(1)](http://oshogbo.vexillium.org/blog/48)
&gt; When you build a new service (or an appliance) you need your users to be able to configure it from the command line. To accomplish this you can create system accounts for all registered users in your service and assign them a special login shell which provides such limited functionality. This can be painful if you have a dynamic user database.
&gt; Another challenge is authentication via remote services such as RADIUS. How can we implement  services when we authenticate through it and log into it as a different user? Furthermore, imagine a scenario when RADIUS decides on which account we have the right to access by sending an additional attribute.
&gt; To address these two problems we can use a &quot;template&quot; user. Any of the PAM modules can set the value of the PAM_USER item. The value of this item will be used to determine which account we want to login. Only the &quot;template&quot; user must exist on the local password database, but the credential check can be omitted by the module.
&gt; This functionality exists in the login(1) used by FreeBSD, HardenedBSD, DragonFlyBSD and illumos. The functionality doesn't exist in the login(1) used in NetBSD, and OpenBSD doesn't support PAM modules at all. In addition what  is also noteworthy is that such functionality was also in the OpenSSH but they decided to remove it and call it a security vulnerability (CVE 2015-6563). I can see how some people may have seen it that way, that’s why I recommend reading this article from an OpenPAM author and a FreeBSD security officer at the time.
&gt; Knowing the background let's take a look at an example.

```PAM_EXTERN int
pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
    int argc __unused, const char *argv[] __unused)
{
        const char *user, *password;
        int err;

        err = pam_get_user(pamh, &amp;user, NULL);
        if (err != PAM_SUCCESS)
                return (err);

        err = pam_get_authtok(pamh, PAM_AUTHTOK, &amp;password, NULL);
        if (err == PAM_CONV_ERR)
                return (err);
        if (err != PAM_SUCCESS)
                return (PAM_AUTH_ERR);

        err = authenticate(user, password);
        if (err != PAM_SUCCESS) {
                return (err);
        }

        return (pam_set_item(pamh, PAM_USER, &quot;template&quot;));
}
</code></pre>

<blockquote>
<p>In the listing above we have an example of a PAM module. The pam_get_user(3) provides a username. The pam_get_authtok(3) shows us a secret given by the user. Both functions allow us to give an optional prompt which should be shown to the user. The authenticate function is our crafted function which authenticates the user. In our first scenario we wanted to keep all users in an external database. If authentication is successful we then switch to a template user which has  a shell set up for a script allowing us to configure the machine. In our second scenario the authenticate function authenticates the user in RADIUS.</p>
</blockquote>

<blockquote>
<p>Another step is to add our PAM module to the /etc/pam.d/system or to the /etc/pam.d/login configuration:</p>
</blockquote>

<p><code>auth sufficient pam_template.so no_warn allow_local</code></p>

<blockquote>
<p>Unfortunately the description of all these options goes beyond this article - if you would like to know more about it you can find them in the PAM manual. The last thing we need to do is to add our template user to the system which  you can do by the adduser(8) command or just simply modifying the /etc/master.passwd file and use pwd_mkdb(8) program:</p>
</blockquote>

<p><code>$ tail -n /etc/master.passwd</code><br>
<code>template:*:1000:1000::0:0:User &amp;:/:/usr/local/bin/templatesh</code><br>
<code>$ sudo pwd_mkdb /etc/master.passwd</code></p>

<blockquote>
<p>As you can see,the template user can be locked and we still can use it in our PAM module (the * character after login).<br>
I would like to thank Dag-Erling Smørgrav for pointing this functionality out to me when I was looking for it some time ago.</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong><br>
<a href="https://www.ixsystems.com/blog/vmworld2018-countdown/">iXsystems @ VMWorld</a></p>

<p>###<a href="https://aravindh.net/posts/zfs_fileserver/">ZFS file server</a></p>

<ul>
<li>What is the need?</li>
</ul>

<blockquote>
<p>At work, we run a compute cluster that uses an Isilon cluster as primary NAS storage. Excluding snapshots, we have about 200TB of research data, some of them in compressed formats, and others not. We needed an offsite backup file server that would constantly mirror our primary NAS and serve as a quick recovery source in case of a data loss in the the primary NAS. This offsite file server would be passive - will never face the wrath of the primary cluster workload.<br>
In addition to the role of a passive backup server, this solution would take on some passive report generation workloads as an ideal way of offloading some work from the primary NAS. The passive work is read-only.<br>
The backup server would keep snapshots in a best effort basis dating back to 10 years. However, this data on this backup server would be archived to tapes periodically.</p>
</blockquote>

<ul>
<li>
<p>A simple guidance of priorities:</p>
</li>
<li>
<p>Data integrity &gt; Cost of solution &gt; Storage capacity &gt; Performance.</p>
</li>
<li>
<p>Why not enterprise NAS? NetApp FAS or EMC Isilon or the like?</p>
</li>
</ul>

<blockquote>
<p>We decided that enterprise grade NAS like NetAPP FAS or EMC Isilon are prohibitively expensive and an overkill for our needs.<br>
An open source &amp; cheaper alternative to enterprise grade filesystem with the level of durability we expect turned up to be ZFS. We’re already spoilt from using snapshots by a clever Copy-on-Write Filesystem(WAFL) by NetApp. ZFS providing snapshots in almost identical way was a big influence in the choice. This is also why we did not consider just a CentOS box with the default XFS filesystem.</p>
</blockquote>

<ul>
<li>FreeBSD vs Debian for ZFS</li>
</ul>

<blockquote>
<p>This is a backup server, a long-term solution. Stability and reliability are key requirements. ZFS on Linux may be popular at this time, but there is a lot of churn around its development, which means there is a higher probability of bugs like this to occur. We’re not looking for cutting edge features here. Perhaps, Linux would be considered in the future.</p>
</blockquote>

<ul>
<li>FreeBSD + ZFS</li>
</ul>

<blockquote>
<p>We already utilize FreeBSD and OpenBSD for infrastructure services and we have nothing but praises for the stability that the BSDs have provided us. We’d gladly use FreeBSD and OpenBSD wherever possible.</p>
</blockquote>

<ul>
<li>Okay, ZFS, but why not FreeNAS?</li>
</ul>

<blockquote>
<p>IMHO, FreeNAS provides a integrated GUI management tool over FreeBSD for a novice user to setup and configure FreeBSD, ZFS, Jails and many other features. But, this user facing abstraction adds an extra layer of complexity to maintain that is just not worth it in simpler use cases like ours. For someone that appreciates the commandline interface, and understands FreeBSD enough to administer it, plain FreeBSD + ZFS is simpler and more robust than FreeNAS.</p>
</blockquote>

<ul>
<li>Specifications</li>
<li>Lenovo SR630 Rackserver</li>
<li>2 X Intel Xeon silver 4110 CPUs</li>
<li>768 GB of DDR4 ECC 2666 MHz RAM</li>
<li>4 port SAS card configured in passthrough mode(JBOD)</li>
<li>Intel network card with 10 Gb SFP+ ports</li>
<li>128GB M.2 SSD for use as boot drive</li>
<li>2 X HGST 4U60 JBOD</li>
<li>120(2 X 60) X 10TB SAS disks</li>
</ul>

<p><hr></p>

<p>###<a href="https://nanxiao.me/en/reflection-on-one-year-usage-of-openbsd/">Reflection on one-year usage of OpenBSD</a></p>

<blockquote>
<p>I have used OpenBSD for more than one year, and it is time to give a summary of the experience:</p>
</blockquote>

<ul>
<li>(1) What do I get from OpenBSD?</li>
</ul>

<blockquote>
<p>a) A good UNIX tutorial. When I am curious about some UNIXcommands’ implementation, I will refer to OpenBSD source code, and I actually gain something every time. E.g., refresh socket programming skills from nc; know how to process file efficiently from cat.</p>
</blockquote>

<blockquote>
<p>b) A better test bed. Although my work focus on developing programs on Linux, I will try to compile and run applications on OpenBSD if it is possible. One reason is OpenBSD usually gives more helpful warnings. E.g., hint like this:</p>
</blockquote>

<p><code>......</code><br>
<code>warning: sprintf() is often misused, please use snprintf()</code><br>
<code>......</code></p>

<blockquote>
<p>Or you can refer this post which I wrote before. The other is sometimes program run well on Linux may crash on OpenBSD, and OpenBSD can help you find hidden bugs.</p>
</blockquote>

<blockquote>
<p>c) Some handy tools. E.g. I find tcpbench is useful, so I ported it into Linux for my own usage (project is here).</p>
</blockquote>

<ul>
<li>(2) What I give back to OpenBSD?</li>
</ul>

<blockquote>
<p>a) Patches. Although most of them are trivial modifications, they are still my contributions.</p>
</blockquote>

<blockquote>
<p>b) Write blog posts to share experience about using OpenBSD.</p>
</blockquote>

<blockquote>
<p>c) Develop programs for OpenBSD/*BSD: lscpu and free.</p>
</blockquote>

<blockquote>
<p>d) Porting programs into OpenBSD: E.g., I find google/benchmark is a nifty tool, but lacks OpenBSD support, I submitted PR and it is accepted. So you can use google/benchmark on OpenBSD now.</p>
</blockquote>

<ul>
<li>Generally speaking, the time invested on OpenBSD is rewarding. If you are still hesitating, why not give a shot?</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/253447019/">BSD Users Stockholm Meetup</a></li>
<li><a href="https://www.youtube.com/playlist?list=PLeF8ZihVdpFfkICtA2HFsZecdC28_mrQh">BSDCan 2018 Playlist</a></li>
<li><a href="https://forum.opnsense.org/index.php?PHPSESSID=hvuv2kg4js2nlfpm73ut5ro8p2&amp;topic=9280.0">OPNsense 18.7 released</a></li>
<li><a href="https://youtu.be/WLgdJwd5zcQ">Testing TrueOS (FreeBSD derivative) on real hardware ThinkPad T410</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2018-July/000946.html">Kernel Hacker Wanted!</a></li>
<li><a href="https://svnweb.freebsd.org/changeset/base/337411">Replace a pair of 8-bit writes to VGA memory with a single 16-bit write</a></li>
<li><a href="https://svnweb.freebsd.org/changeset/base/337229">Reduce taskq and context-switch cost of zio pipe</a></li>
<li><a href="https://reviews.freebsd.org/D16606">Proposed FreeBSD Memory Management change, expected to improve ZFS ARC interactions</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Anian_Z - <a href="http://dpaste.com/093FC8R#wrap">Question</a></li>
<li>Robert - <a href="http://dpaste.com/0GG7Q2A#wrap">Pool question</a></li>
<li>Lain - <a href="http://dpaste.com/2BWPX9C">Congratulations</a></li>
<li>Thomas - <a href="http://dpaste.com/25NGAP3#wrap">L2arc</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The strange birth and long life of Unix, FreeBSD jail with a single public IP, EuroBSDcon 2018 talks and schedule, OpenBSD on G4 iBook, PAM template user, ZFS file server, and reflections on one year of OpenBSD use.</p>

<h3><a id="Picking_the_contest_winner_0"></a>Picking the contest winner</h3>

<ol>
<li>Vincent</li>
<li>Bostjan</li>
<li>Andrew</li>
<li>Klaus-Hendrik</li>
<li>Will</li>
<li>Toby</li>
<li>Johnny</li>
<li>David</li>
<li>manfrom</li>
<li>Niclas</li>
<li>Gary</li>
<li>Eddy</li>
<li>Bruce</li>
<li>Lizz</li>
<li>Jim</li>
</ol>

<p><a href="https://www.random.org/integers/?num=1&amp;min=0&amp;max=15&amp;col=1&amp;base=10&amp;format=html&amp;rnd=new">Random number generator</a></p>

<p>##Headlines<br>
###<a href="https://spectrum.ieee.org/tech-history/cyberspace/the-strange-birth-and-long-life-of-unix">The Strange Birth and Long Life of Unix</a></p>

<blockquote>
<p>They say that when one door closes on you, another opens. People generally offer this bit of wisdom just to lend some solace after a misfortune. But sometimes it’s actually true. It certainly was for Ken Thompson and the late Dennis Ritchie, two of the greats of 20th-century information technology, when they created the Unix operating system, now considered one of the most inspiring and influential pieces of software ever written.<br>
A door had slammed shut for Thompson and Ritchie in March of 1969, when their employer, the American Telephone &amp; Telegraph Co., withdrew from a collaborative project with the Massachusetts Institute of Technology and General Electric to create an interactive time-sharing system called Multics, which stood for “Multiplexed Information and Computing Service.” Time-sharing, a technique that lets multiple people use a single computer simultaneously, had been invented only a decade earlier. Multics was to combine time-sharing with other technological advances of the era, allowing users to phone a computer from remote terminals and then read e-mail, edit documents, run calculations, and so forth. It was to be a great leap forward from the way computers were mostly being used, with people tediously preparing and submitting batch jobs on punch cards to be run one by one.<br>
Over five years, AT&amp;T invested millions in the Multics project, purchasing a GE-645 mainframe computer and dedicating to the effort many of the top researchers at the company’s renowned Bell Telephone Laboratories—­including Thompson and Ritchie, Joseph F. Ossanna, Stuart Feldman, M. Douglas McIlroy, and the late Robert Morris. But the new system was too ambitious, and it fell troublingly behind schedule. In the end, AT&amp;T’s corporate leaders decided to pull the plug.<br>
After AT&amp;T’s departure from the Multics project, managers at Bell Labs, in Murray Hill, N.J., became reluctant to allow any further work on computer operating systems, leaving some researchers there very frustrated. Although Multics hadn’t met many of its objectives, it had, as Ritchie later recalled, provided them with a “convenient interactive computing service, a good environment in which to do programming, [and] a system around which a fellowship could form.” Suddenly, it was gone.<br>
With heavy hearts, the researchers returned to using their old batch system. At such an inauspicious moment, with management dead set against the idea, it surely would have seemed foolhardy to continue designing computer operating systems. But that’s exactly what Thompson, Ritchie, and many of their Bell Labs colleagues did. Now, some 40 years later, we should be thankful that these programmers ignored their bosses and continued their labor of love, which gave the world Unix, one of the greatest computer operating systems of all time.<br>
The rogue project began in earnest when Thompson, Ritchie, and a third Bell Labs colleague, Rudd Canaday, began to sketch out on paper the design for a file system. Thompson then wrote the basics of a new operating system for the lab’s GE-645 mainframe. But with the Multics project ended, so too was the need for the GE-645. Thompson realized that any further programming he did on it was likely to go nowhere, so he dropped the effort.<br>
Thompson had passed some of his time after the demise of Multics writing a computer game called Space Travel, which simulated all the major bodies in the solar system along with a spaceship that could fly around them. Written for the GE-645, Space Travel was clunky to play—and expensive: roughly US $75 a game for the CPU time. Hunting around, Thompson came across a dusty PDP-7, a minicomputer built by Digital Equipment Corp. that some of his Bell Labs colleagues had purchased earlier for a circuit-analysis project. Thompson rewrote Space Travel to run on it.<br>
And with that little programming exercise, a second door cracked ajar. It was to swing wide open during the summer of 1969 when Thompson’s wife, Bonnie, spent a month visiting his parents to show off their newborn son. Thompson took advantage of his temporary bachelor existence to write a good chunk of what would become the Unix operating system for the discarded PDP‑7. The name Unix stems from a joke one of Thompson’s colleagues made: Because the new operating system supported only one user (Thompson), he saw it as an emasculated version of Multics and dubbed it “Un-multiplexed Information and Computing Service,” or Unics. The name later morphed into Unix.<br>
Initially, Thompson used the GE-645 to compose and compile the software, which he then downloaded to the PDP‑7. But he soon weaned himself from the mainframe, and by the end of 1969 he was able to write operating-system code on the PDP-7 itself. That was a step in the right direction. But Thompson and the others helping him knew that the PDP‑7, which was already obsolete, would not be able to sustain their skunkworks for long. They also knew that the lab’s management wasn’t about to allow any more research on operating systems.<br>
So Thompson and Ritchie got crea­tive. They formulated a proposal to their bosses to buy one of DEC’s newer minicomputers, a PDP-11, but couched the request in especially palatable terms. They said they were aiming to create tools for editing and formatting text, what you might call a word-processing system today. The fact that they would also have to write an operating system for the new machine to support the editor and text formatter was almost a footnote.<br>
Management took the bait, and an order for a PDP-11 was placed in May 1970. The machine itself arrived soon after, although the disk drives for it took more than six months to appear. During the interim, Thompson, Ritchie, and others continued to develop Unix on the PDP-7. After the PDP-11’s disks were installed, the researchers moved their increasingly complex operating system over to the new machine. Next they brought over the roff text formatter written by Ossanna and derived from the runoff program, which had been used in an earlier time-sharing system.<br>
Unix was put to its first real-world test within Bell Labs when three typists from AT&amp;T’s patents department began using it to write, edit, and format patent applications. It was a hit. The patent department adopted the system wholeheartedly, which gave the researchers enough credibility to convince management to purchase another machine—a newer and more powerful PDP-11 model—allowing their stealth work on Unix to continue.<br>
During its earliest days, Unix evolved constantly, so the idea of issuing named versions or releases seemed inappropriate. But the researchers did issue new editions of the programmer’s manual periodically, and the early Unix systems were named after each such edition. The first edition of the manual was completed in November 1971.<br>
So what did the first edition of Unix offer that made it so great? For one thing, the system provided a hierarchical file system, which allowed something we all now take for granted: Files could be placed in directories—or equivalently, folders—that in turn could be put within other directories. Each file could contain no more than 64 kilobytes, and its name could be no more than six characters long. These restrictions seem awkwardly limiting now, but at the time they appeared perfectly adequate.<br>
Although Unix was ostensibly created for word processing, the only editor available in 1971 was the line-oriented ed. Today, ed is still the only editor guaranteed to be present on all Unix systems. Apart from the text-processing and general system applications, the first edition of Unix included games such as blackjack, chess, and tic-tac-toe. For the system administrator, there were tools to dump and restore disk images to magnetic tape, to read and write paper tapes, and to create, check, mount, and unmount removable disk packs.<br>
Most important, the system offered an interactive environment that by this time allowed time-sharing, so several people could use a single machine at once. Various programming languages were available to them, including BASIC, Fortran, the scripting of Unix commands, assembly language, and B. The last of these, a descendant of a BCPL (Basic Combined Programming Language), ultimately evolved into the immensely popular C language, which Ritchie created while also working on Unix.<br>
The first edition of Unix let programmers call 34 different low-level routines built into the operating system. It’s a testament to the system’s enduring nature that nearly all of these system calls are still available—and still heavily used—on modern Unix and Linux systems four decades on. For its time, first-­edition Unix provided a remarkably powerful environment for software development. Yet it contained just 4200 lines of code at its heart and occupied a measly 16 KB of main memory when it ran.<br>
Unix’s great influence can be traced in part to its elegant design, simplicity, portability, and serendipitous timing. But perhaps even more important was the devoted user community that soon grew up around it. And that came about only by an accident of its unique history.<br>
The story goes like this: For years Unix remained nothing more than a Bell Labs research project, but by 1973 its authors felt the system was mature enough for them to present a paper on its design and implementation at a symposium of the Association for Computing Machinery. That paper was published in 1974 in the Communications of the ACM. Its appearance brought a flurry of requests for copies of the software.<br>
This put AT&amp;T in a bind. In 1956, AT&amp;T had agreed to a U.S government consent decree that prevented the company from selling products not directly related to telephones and telecommunications, in return for its legal monopoly status in running the country’s long-distance phone service. So Unix could not be sold as a product. Instead, AT&amp;T released the Unix source code under license to anyone who asked, charging only a nominal fee. The critical wrinkle here was that the consent decree prevented AT&amp;T from supporting Unix. Indeed, for many years Bell Labs researchers proudly displayed their Unix policy at conferences with a slide that read, “No advertising, no support, no bug fixes, payment in advance.”<br>
With no other channels of support available to them, early Unix adopters banded together for mutual assistance, forming a loose network of user groups all over the world. They had the source code, which helped. And they didn’t view Unix as a standard software product, because nobody seemed to be looking after it. So these early Unix users themselves set about fixing bugs, writing new tools, and generally improving the system as they saw fit.<br>
The Usenix user group acted as a clearinghouse for the exchange of Unix software in the United States. People could send in magnetic tapes with new software or fixes to the system and get back tapes with the software and fixes that Usenix had received from others. In Australia, the University of New South Wales and the University of Sydney produced a more robust version of Unix, the Australian Unix Share Accounting Method, which could cope with larger numbers of concurrent users and offered better performance.<br>
By the mid-1970s, the environment of sharing that had sprung up around Unix resembled the open-source movement so prevalent today. Users far and wide were enthusiastically enhancing the system, and many of their improvements were being fed back to Bell Labs for incorporation in future releases. But as Unix became more popular, AT&amp;T’s lawyers began looking harder at what various licensees were doing with their systems.<br>
One person who caught their eye was John Lions, a computer scientist then teaching at the University of New South Wales, in Australia. In 1977, he published what was probably the most famous computing book of the time, A Commentary on the Unix Operating System, which contained an annotated listing of the central source code for Unix.<br>
Unix’s licensing conditions allowed for the exchange of source code, and initially, Lions’s book was sold to licensees. But by 1979, AT&amp;T’s lawyers had clamped down on the book’s distribution and use in academic classes. The anti­authoritarian Unix community reacted as you might expect, and samizdat copies of the book spread like wildfire. Many of us have nearly unreadable nth-­generation photocopies of the original book.<br>
End runs around AT&amp;T’s lawyers indeed became the norm—even at Bell Labs. For example, between the release of the sixth edition of Unix in 1975 and the seventh edition in 1979, Thompson collected dozens of important bug fixes to the system, coming both from within and outside of Bell Labs. He wanted these to filter out to the existing Unix user base, but the company’s lawyers felt that this would constitute a form of support and balked at their release. Nevertheless, those bug fixes soon became widely distributed through unofficial channels. For instance, Lou Katz, the founding president of Usenix, received a phone call one day telling him that if he went down to a certain spot on Mountain Avenue (where Bell Labs was located) at 2 p.m., he would find something of interest. Sure enough, Katz found a magnetic tape with the bug fixes, which were rapidly in the hands of countless users.<br>
By the end of the 1970s, Unix, which had started a decade earlier as a reaction against the loss of a comfortable programming environment, was growing like a weed throughout academia and the IT industry. Unix would flower in the early 1980s before reaching the height of its popularity in the early 1990s.<br>
For many reasons, Unix has since given way to other commercial and noncommercial systems. But its legacy, that of an elegant, well-designed, comfortable environment for software development, lives on. In recognition of their accomplishment, Thompson and Ritchie were given the Japan Prize earlier this year, adding to a collection of honors that includes the United States’ National Medal of Technology and Innovation and the Association of Computing Machinery’s Turing Award. Many other, often very personal, tributes to Ritchie and his enormous influence on computing were widely shared after his death this past October.<br>
Unix is indeed one of the most influential operating systems ever invented. Its direct descendants now number in the hundreds. On one side of the family tree are various versions of Unix proper, which began to be commercialized in the 1980s after the Bell System monopoly was broken up, freeing AT&amp;T from the stipulations of the 1956 consent decree. On the other side are various Unix-like operating systems derived from the version of Unix developed at the University of California, Berkeley, including the one Apple uses today on its computers, OS X. I say “Unix-like” because the developers of the Berkeley Software Distribution (BSD) Unix on which these systems were based worked hard to remove all the original AT&amp;T code so that their software and its descendants would be freely distributable.<br>
The effectiveness of those efforts were, however, called into question when the AT&amp;T subsidiary Unix System Laboratories filed suit against Berkeley Software Design and the Regents of the University of California in 1992 over intellectual property rights to this software. The university in turn filed a counterclaim against AT&amp;T for breaches to the license it provided AT&amp;T for the use of code developed at Berkeley. The ensuing legal quagmire slowed the development of free Unix-like clones, including 386BSD, which was designed for the Intel 386 chip, the CPU then found in many IBM PCs.<br>
Had this operating system been available at the time, Linus Torvalds says he probably wouldn’t have created Linux, an open-source Unix-like operating system he developed from scratch for PCs in the early 1990s. Linux has carried the Unix baton forward into the 21st century, powering a wide range of digital gadgets including wireless routers, televisions, desktop PCs, and Android smartphones. It even runs some supercomputers.<br>
Although AT&amp;T quickly settled its legal disputes with Berkeley Software Design and the University of California, legal wrangling over intellectual property claims to various parts of Unix and Linux have continued over the years, often involving byzantine corporate relations. By 2004, no fewer than five major lawsuits had been filed. Just this past August, a software company called the TSG Group (formerly known as the SCO Group), lost a bid in court to claim ownership of Unix copyrights that Novell had acquired when it purchased the Unix System Laboratories from AT&amp;T in 1993.<br>
As a programmer and Unix historian, I can’t help but find all this legal sparring a bit sad. From the very start, the authors and users of Unix worked as best they could to build and share, even if that meant defying authority. That outpouring of selflessness stands in sharp contrast to the greed that has driven subsequent legal battles over the ownership of Unix.<br>
The world of computer hardware and software moves forward startlingly fast. For IT professionals, the rapid pace of change is typically a wonderful thing. But it makes us susceptible to the loss of our own history, including important lessons from the past. To address this issue in a small way, in 1995 I started a mailing list of old-time Unix ­aficionados. That effort morphed into the Unix Heritage Society. Our goal is not only to save the history of Unix but also to collect and curate these old systems and, where possible, bring them back to life. With help from many talented members of this society, I was able to restore much of the old Unix software to working order, including Ritchie’s first C compiler from 1972 and the first Unix system to be written in C, dating from 1973.<br>
One holy grail that eluded us for a long time was the first edition of Unix in any form, electronic or otherwise. Then, in 2006, Al Kossow from the Computer History Museum, in Mountain View, Calif., unearthed a printed study of Unix dated 1972, which not only covered the internal workings of Unix but also included a complete assembly listing of the kernel, the main component of this operating system. This was an amazing find—like discovering an old Ford Model T collecting dust in a corner of a barn. But we didn’t just want to admire the chrome work from afar. We wanted to see the thing run again.<br>
In 2008, Tim Newsham, an independent programmer in Hawaii, and I assembled a team of like-minded Unix enthusiasts and set out to bring this ancient system back from the dead. The work was technically arduous and often frustrating, but in the end, we had a copy of the first edition of Unix running on an emulated PDP-11/20. We sent out messages announcing our success to all those we thought would be interested. Thompson, always succinct, simply replied, “Amazing.” Indeed, his brainchild was amazing, and I’ve been happy to do what I can to make it, and the story behind it, better known.</p>
</blockquote>

<p><hr></p>

<p><strong>Digital Ocean</strong><br>
<a href="http://do.co/bsdnow">http://do.co/bsdnow</a></p>

<p>###<a href="https://www.davd.eu/posts-freebsd-jails-with-a-single-public-ip-address/">FreeBSD jails with a single public IP address</a></p>

<blockquote>
<p>Jails in FreeBSD provide a simple yet flexible way to set up a proper server layout. In the most setups the actual server only acts as the host system for the jails while the applications themselves run within those independent containers. Traditionally every jail has it’s own IP for the user to be able to address the individual services. But if you’re still using IPv4 this might get you in trouble as the most hosters don’t offer more than one single public IP address per server.</p>
</blockquote>

<ul>
<li>Create the internal network</li>
</ul>

<blockquote>
<p>In this case NAT (“Network Address Translation”) is a good way to expose services in different jails using the same IP address.<br>
First, let’s create an internal network (“NAT network”) at 192.168.0.0/24. You could generally use any private IPv4 address space as specified in RFC 1918. Here’s an overview: <a href="https://en.wikipedia.org/wiki/Private_network">https://en.wikipedia.org/wiki/Private_network</a>. Using pf, FreeBSD’s firewall, we will map requests on different ports of the same public IP address to our individual jails as well as provide network access to the jails themselves.<br>
First let’s check which network devices are available. In my case there’s em0 which provides connectivity to the internet and lo0, the local loopback device.</p>
</blockquote>

<pre><code class="language-em0:">  options=209b&lt;RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC&gt;
  [...]
  inet 172.31.1.100 netmask 0xffffff00 broadcast 172.31.1.255
  nd6 options=23&lt;PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL&gt;
  media: Ethernet autoselect (1000baseT &lt;full-duplex&gt;)
  status: active

lo0: flags=8049&lt;UP,LOOPBACK,RUNNING,MULTICAST&gt; metric 0 mtu 16384
  options=600003&lt;RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6&gt;
  inet6 ::1 prefixlen 128
  inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
  inet 127.0.0.1 netmask 0xff000000
  nd6 options=21&lt;PERFORMNUD,AUTO_LINKLOCAL&gt;```

&gt; For our internal network, we create a cloned loopback device called lo1. Therefore we need to customize the /etc/rc.conf file, adding the following two lines:

```cloned_interfaces=&quot;lo1&quot;
ipv4_addrs_lo1=&quot;192.168.0.1-9/29&quot;```

&gt; This defines a /29 network, offering IP addresses for a maximum of 6 jails:

```ipcalc 192.168.0.1/29
Address:   192.168.0.1          11000000.10101000.00000000.00000 001
Netmask:   255.255.255.248 = 29 11111111.11111111.11111111.11111 000
Wildcard:  0.0.0.7              00000000.00000000.00000000.00000 111
=&gt;
Network:   192.168.0.0/29       11000000.10101000.00000000.00000 000
HostMin:   192.168.0.1          11000000.10101000.00000000.00000 001
HostMax:   192.168.0.6          11000000.10101000.00000000.00000 110
Broadcast: 192.168.0.7          11000000.10101000.00000000.00000 111
Hosts/Net: 6                     Class C, Private Internet```

&gt; Then we need to restart the network. Please be aware of currently active SSH sessions as they might be dropped during restart. It’s a good moment to ensure you have KVM access to that server ;-)

```service netif restart```

&gt; After reconnecting, our newly created loopback device is active:

```lo1: flags=8049&lt;UP,LOOPBACK,RUNNING,MULTICAST&gt; metric 0 mtu 16384
  options=600003&lt;RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6&gt;
  inet 192.168.0.1 netmask 0xfffffff8
  inet 192.168.0.2 netmask 0xffffffff
  inet 192.168.0.3 netmask 0xffffffff
  inet 192.168.0.4 netmask 0xffffffff
  inet 192.168.0.5 netmask 0xffffffff
  inet 192.168.0.6 netmask 0xffffffff
  inet 192.168.0.7 netmask 0xffffffff
  inet 192.168.0.8 netmask 0xffffffff
  inet 192.168.0.9 netmask 0xffffffff
  nd6 options=29&lt;PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL&gt;```

+ Setting up

&gt; pf part of the FreeBSD base system, so we only have to configure and enable it. By this moment you should already have a clue of which services you want to expose. If this is not the case, just fix that file later on. In my example configuration, I have a jail running a webserver and another jail running a mailserver:

 +  Public IP address
```IP_PUB=&quot;1.2.3.4&quot;```

 +  Packet normalization
```scrub in all```

 +  Allow outbound connections from within the jails
```nat on em0 from lo1:network to any -&gt; (em0)```

 +  webserver jail at 192.168.0.2
```rdr on em0 proto tcp from any to $IP_PUB port 443 -&gt; 192.168.0.2```

 + just an example in case you want to redirect to another port within your jail
```rdr on em0 proto tcp from any to $IP_PUB port 80 -&gt; 192.168.0.2 port 8080```

 + mailserver jail at 192.168.0.3
```rdr on em0 proto tcp from any to $IP_PUB port 25 -&gt; 192.168.0.3```
```rdr on em0 proto tcp from any to $IP_PUB port 587 -&gt; 192.168.0.3```
```rdr on em0 proto tcp from any to $IP_PUB port 143 -&gt; 192.168.0.3```
```rdr on em0 proto tcp from any to $IP_PUB port 993 -&gt; 192.168.0.3```

&gt; Now just enable pf like this (which is the equivalent of adding pf_enable=YES to /etc/rc.conf):

```sysrc pf_enable=&quot;YES&quot;```

&gt; and start it:

```service pf start```

+ Install ezjail

&gt; Ezjail is a collection of scripts by erdgeist that allow you to easily manage your jails.

```pkg install ezjail```

&gt; As an alternative, you could install ezjail from the ports tree. Now we need to set up the basejail which contains the shared base system for our jails. In fact, every jail that you create get’s will use that basejail to symlink directories related to the base system like /bin and /sbin. This can be accomplished by running

```ezjail-admin install```

&gt; In the next step, we’ll copy the /etc/resolv.conf file from our host to the newjail, which is the template for newly created jails (the parts that are not provided by basejail), to ensure that domain resolution will work properly within our jails later on:

```cp /etc/resolv.conf /usr/jails/newjail/etc/```

&gt; Last but not least, we enable ezjail and start it:

```sysrc ezjail_enable=&quot;YES&quot;```
```service ezjail start```

+ Create a jail

&gt; Creating a jail is as easy as it could probably be:

```ezjail-admin create webserver 192.168.0.2```
```ezjail-admin start webserver```

&gt; Now you can access your jail using:

```ezjail-admin console webserver```

&gt; Each jail contains a vanilla FreeBSD installation.

+ Deploy services

&gt; Now you can spin up as many jails as you want to set up your services like web, mail or file shares. You should take care not to enable sshd within your jails, because that would cause problems with the service’s IP bindings. But this is not a problem, just SSH to the host and enter your jail using ezjail-admin console.
***

###[EuroBSDcon 2018 Talks &amp; Schedule](https://2018.eurobsdcon.org/talks-schedule/)
***




##News Roundup
###[OpenBSD on an iBook G4](https://bobstechsite.com/openbsd-on-an-ibook-g4/)
&gt; I've mentioned on social media and on the BTS podcast a few times that I wanted to try installing OpenBSD onto an old &quot;snow white&quot; iBook G4 I acquired last summer to see if I could make it a useful machine again in the year 2018.  This particular eBay purchase came with a 14&quot; 1024x768 TFT screen, 1.07GHz PowerPC G4 processor, 1.5GB RAM, 100GB of HDD space and an ATI Radeon 9200 graphics card with 32 MB of SDRAM. The optical drive, ethernet port, battery &amp; USB slots are also fully-functional. The only thing that doesn't work is the CMOS battery, but that's not unexpected for a device that was originally released in 2004.

+ Initial experiments

&gt; This iBook originally arrived at my door running Apple Mac OSX Leopard and came with the original install disk, the iLife &amp; iWork suites for 2008, various instruction manuals, a working power cable and a spare keyboard. As you'll see in the pictures I took for this post the characters on the buttons have started to wear away from 14 years of intensive use, but the replacement needs a very good clean before I decide to swap it in!

&gt; After spending some time exploring the last version of OSX to support the IBM PowerPC processor architecture I tried to see if the hardware was capable of modern computing with Linux. Something I knew ahead of trying this was that the WiFi adapter was unlikely to work because it's a highly proprietary component designed by Apple to work specifically with OSX and nothing else, but I figured I could probably use a wireless USB dongle later to get around this limitation.

&gt; Unfortunately I found that no recent versions of mainstream Linux distributions would boot off this machine. Debian has dropped support 32-bit PowerPC architectures and the PowerPC variants of Ubuntu 16.04 LTS (vanilla, MATE and Lubuntu) wouldn't even boot the installer! The only distribution I could reliably install on the hardware was Lubuntu 14.04 LTS.

&gt; Unfortunately I'm not the biggest fan of the LXDE desktop for regular work and a lot of ported applications were old and broken because it clearly wasn't being maintained by people that use the hardware anymore. Ubuntu 14.04 is also approaching the end of its support life in early 2019, so this limited solution also has a limited shelf-life.

+ Over to BSD

&gt; I discussed this problem with a few people on Mastodon and it was pointed out to me that OSX is built on the Darwin kernel, which happens to be a variant of BSD. NetBSD and OpenBSD fans in particular convinced me that their communities still saw the value of supporting these old pieces of kit and that I should give BSD a try.

&gt; So yesterday evening I finally downloaded the &quot;macppc&quot; version of OpenBSD 6.3 with no idea what to expect. I hoped for the best but feared the worst because my last experience with this operating system was trying out PC-BSD in 2008 and discovering with disappointment that it didn't support any of the hardware on my Toshiba laptop.

&gt; When I initially booted OpenBSD I was a little surprised to find the login screen provided no visual feedback when I typed in my password, but I can understand the security reasons for doing that. The initial desktop environment that was loaded was very basic. All I could see was a console output window, a terminal and a desktop switcher in the X11 environment the system had loaded.

&gt; After a little Googling I found this blog post had some fantastic instructions to follow for the post-installation steps: https://sohcahtoa.org.uk/openbsd.html. I did have to adjust them slightly though because my iBook only has 1.5GB RAM and not every package that page suggests is available on macppc by default. You can see a full list here: https://ftp.openbsd.org/pub/OpenBSD/6.3/packages/powerpc/.

+ Final thoughts

&gt; I was really impressed with the performance of OpenBSD's &quot;macppc&quot; port. It boots much faster than OSX Leopard on the same hardware and unlike Lubuntu 14.04 it doesn't randomly hang for no reason or crash if you launch something demanding like the GIMP.

&gt; I was pleased to see that the command line tools I'm used to using on Linux have been ported across too. OpenBSD also had no issues with me performing basic desktop tasks on XFCE like browsing the web with NetSurf, playing audio files with VLC and editing images with the GIMP. Limited gaming is also theoretically possible if you're willing to build them (or an emulator) from source with SDL support.

&gt; If I wanted to use this system for heavy duty work then I'd probably be inclined to run key applications like LibreOffice on a Raspberry Pi and then connect my iBook G4 to those using VNC or an SSH connection with X11 forwarding. BSD is UNIX after all, so using my ancient laptop as a dumb terminal should work reasonably well.

&gt; In summary I was impressed with OpenBSD and its ability to breathe new life into this old Apple Mac. I'm genuinely excited about the idea of trying BSD with other devices on my network such as an old Asus Eee PC 900 netbook and at least one of the many Raspberry Pi devices I use. Whether I go the whole hog and replace Fedora on my main production laptop though remains to be seen!

***

###[The template user with PAM and login(1)](http://oshogbo.vexillium.org/blog/48)
&gt; When you build a new service (or an appliance) you need your users to be able to configure it from the command line. To accomplish this you can create system accounts for all registered users in your service and assign them a special login shell which provides such limited functionality. This can be painful if you have a dynamic user database.
&gt; Another challenge is authentication via remote services such as RADIUS. How can we implement  services when we authenticate through it and log into it as a different user? Furthermore, imagine a scenario when RADIUS decides on which account we have the right to access by sending an additional attribute.
&gt; To address these two problems we can use a &quot;template&quot; user. Any of the PAM modules can set the value of the PAM_USER item. The value of this item will be used to determine which account we want to login. Only the &quot;template&quot; user must exist on the local password database, but the credential check can be omitted by the module.
&gt; This functionality exists in the login(1) used by FreeBSD, HardenedBSD, DragonFlyBSD and illumos. The functionality doesn't exist in the login(1) used in NetBSD, and OpenBSD doesn't support PAM modules at all. In addition what  is also noteworthy is that such functionality was also in the OpenSSH but they decided to remove it and call it a security vulnerability (CVE 2015-6563). I can see how some people may have seen it that way, that’s why I recommend reading this article from an OpenPAM author and a FreeBSD security officer at the time.
&gt; Knowing the background let's take a look at an example.

```PAM_EXTERN int
pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
    int argc __unused, const char *argv[] __unused)
{
        const char *user, *password;
        int err;

        err = pam_get_user(pamh, &amp;user, NULL);
        if (err != PAM_SUCCESS)
                return (err);

        err = pam_get_authtok(pamh, PAM_AUTHTOK, &amp;password, NULL);
        if (err == PAM_CONV_ERR)
                return (err);
        if (err != PAM_SUCCESS)
                return (PAM_AUTH_ERR);

        err = authenticate(user, password);
        if (err != PAM_SUCCESS) {
                return (err);
        }

        return (pam_set_item(pamh, PAM_USER, &quot;template&quot;));
}
</code></pre>

<blockquote>
<p>In the listing above we have an example of a PAM module. The pam_get_user(3) provides a username. The pam_get_authtok(3) shows us a secret given by the user. Both functions allow us to give an optional prompt which should be shown to the user. The authenticate function is our crafted function which authenticates the user. In our first scenario we wanted to keep all users in an external database. If authentication is successful we then switch to a template user which has  a shell set up for a script allowing us to configure the machine. In our second scenario the authenticate function authenticates the user in RADIUS.</p>
</blockquote>

<blockquote>
<p>Another step is to add our PAM module to the /etc/pam.d/system or to the /etc/pam.d/login configuration:</p>
</blockquote>

<p><code>auth sufficient pam_template.so no_warn allow_local</code></p>

<blockquote>
<p>Unfortunately the description of all these options goes beyond this article - if you would like to know more about it you can find them in the PAM manual. The last thing we need to do is to add our template user to the system which  you can do by the adduser(8) command or just simply modifying the /etc/master.passwd file and use pwd_mkdb(8) program:</p>
</blockquote>

<p><code>$ tail -n /etc/master.passwd</code><br>
<code>template:*:1000:1000::0:0:User &amp;:/:/usr/local/bin/templatesh</code><br>
<code>$ sudo pwd_mkdb /etc/master.passwd</code></p>

<blockquote>
<p>As you can see,the template user can be locked and we still can use it in our PAM module (the * character after login).<br>
I would like to thank Dag-Erling Smørgrav for pointing this functionality out to me when I was looking for it some time ago.</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong><br>
<a href="https://www.ixsystems.com/blog/vmworld2018-countdown/">iXsystems @ VMWorld</a></p>

<p>###<a href="https://aravindh.net/posts/zfs_fileserver/">ZFS file server</a></p>

<ul>
<li>What is the need?</li>
</ul>

<blockquote>
<p>At work, we run a compute cluster that uses an Isilon cluster as primary NAS storage. Excluding snapshots, we have about 200TB of research data, some of them in compressed formats, and others not. We needed an offsite backup file server that would constantly mirror our primary NAS and serve as a quick recovery source in case of a data loss in the the primary NAS. This offsite file server would be passive - will never face the wrath of the primary cluster workload.<br>
In addition to the role of a passive backup server, this solution would take on some passive report generation workloads as an ideal way of offloading some work from the primary NAS. The passive work is read-only.<br>
The backup server would keep snapshots in a best effort basis dating back to 10 years. However, this data on this backup server would be archived to tapes periodically.</p>
</blockquote>

<ul>
<li>
<p>A simple guidance of priorities:</p>
</li>
<li>
<p>Data integrity &gt; Cost of solution &gt; Storage capacity &gt; Performance.</p>
</li>
<li>
<p>Why not enterprise NAS? NetApp FAS or EMC Isilon or the like?</p>
</li>
</ul>

<blockquote>
<p>We decided that enterprise grade NAS like NetAPP FAS or EMC Isilon are prohibitively expensive and an overkill for our needs.<br>
An open source &amp; cheaper alternative to enterprise grade filesystem with the level of durability we expect turned up to be ZFS. We’re already spoilt from using snapshots by a clever Copy-on-Write Filesystem(WAFL) by NetApp. ZFS providing snapshots in almost identical way was a big influence in the choice. This is also why we did not consider just a CentOS box with the default XFS filesystem.</p>
</blockquote>

<ul>
<li>FreeBSD vs Debian for ZFS</li>
</ul>

<blockquote>
<p>This is a backup server, a long-term solution. Stability and reliability are key requirements. ZFS on Linux may be popular at this time, but there is a lot of churn around its development, which means there is a higher probability of bugs like this to occur. We’re not looking for cutting edge features here. Perhaps, Linux would be considered in the future.</p>
</blockquote>

<ul>
<li>FreeBSD + ZFS</li>
</ul>

<blockquote>
<p>We already utilize FreeBSD and OpenBSD for infrastructure services and we have nothing but praises for the stability that the BSDs have provided us. We’d gladly use FreeBSD and OpenBSD wherever possible.</p>
</blockquote>

<ul>
<li>Okay, ZFS, but why not FreeNAS?</li>
</ul>

<blockquote>
<p>IMHO, FreeNAS provides a integrated GUI management tool over FreeBSD for a novice user to setup and configure FreeBSD, ZFS, Jails and many other features. But, this user facing abstraction adds an extra layer of complexity to maintain that is just not worth it in simpler use cases like ours. For someone that appreciates the commandline interface, and understands FreeBSD enough to administer it, plain FreeBSD + ZFS is simpler and more robust than FreeNAS.</p>
</blockquote>

<ul>
<li>Specifications</li>
<li>Lenovo SR630 Rackserver</li>
<li>2 X Intel Xeon silver 4110 CPUs</li>
<li>768 GB of DDR4 ECC 2666 MHz RAM</li>
<li>4 port SAS card configured in passthrough mode(JBOD)</li>
<li>Intel network card with 10 Gb SFP+ ports</li>
<li>128GB M.2 SSD for use as boot drive</li>
<li>2 X HGST 4U60 JBOD</li>
<li>120(2 X 60) X 10TB SAS disks</li>
</ul>

<p><hr></p>

<p>###<a href="https://nanxiao.me/en/reflection-on-one-year-usage-of-openbsd/">Reflection on one-year usage of OpenBSD</a></p>

<blockquote>
<p>I have used OpenBSD for more than one year, and it is time to give a summary of the experience:</p>
</blockquote>

<ul>
<li>(1) What do I get from OpenBSD?</li>
</ul>

<blockquote>
<p>a) A good UNIX tutorial. When I am curious about some UNIXcommands’ implementation, I will refer to OpenBSD source code, and I actually gain something every time. E.g., refresh socket programming skills from nc; know how to process file efficiently from cat.</p>
</blockquote>

<blockquote>
<p>b) A better test bed. Although my work focus on developing programs on Linux, I will try to compile and run applications on OpenBSD if it is possible. One reason is OpenBSD usually gives more helpful warnings. E.g., hint like this:</p>
</blockquote>

<p><code>......</code><br>
<code>warning: sprintf() is often misused, please use snprintf()</code><br>
<code>......</code></p>

<blockquote>
<p>Or you can refer this post which I wrote before. The other is sometimes program run well on Linux may crash on OpenBSD, and OpenBSD can help you find hidden bugs.</p>
</blockquote>

<blockquote>
<p>c) Some handy tools. E.g. I find tcpbench is useful, so I ported it into Linux for my own usage (project is here).</p>
</blockquote>

<ul>
<li>(2) What I give back to OpenBSD?</li>
</ul>

<blockquote>
<p>a) Patches. Although most of them are trivial modifications, they are still my contributions.</p>
</blockquote>

<blockquote>
<p>b) Write blog posts to share experience about using OpenBSD.</p>
</blockquote>

<blockquote>
<p>c) Develop programs for OpenBSD/*BSD: lscpu and free.</p>
</blockquote>

<blockquote>
<p>d) Porting programs into OpenBSD: E.g., I find google/benchmark is a nifty tool, but lacks OpenBSD support, I submitted PR and it is accepted. So you can use google/benchmark on OpenBSD now.</p>
</blockquote>

<ul>
<li>Generally speaking, the time invested on OpenBSD is rewarding. If you are still hesitating, why not give a shot?</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/253447019/">BSD Users Stockholm Meetup</a></li>
<li><a href="https://www.youtube.com/playlist?list=PLeF8ZihVdpFfkICtA2HFsZecdC28_mrQh">BSDCan 2018 Playlist</a></li>
<li><a href="https://forum.opnsense.org/index.php?PHPSESSID=hvuv2kg4js2nlfpm73ut5ro8p2&amp;topic=9280.0">OPNsense 18.7 released</a></li>
<li><a href="https://youtu.be/WLgdJwd5zcQ">Testing TrueOS (FreeBSD derivative) on real hardware ThinkPad T410</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2018-July/000946.html">Kernel Hacker Wanted!</a></li>
<li><a href="https://svnweb.freebsd.org/changeset/base/337411">Replace a pair of 8-bit writes to VGA memory with a single 16-bit write</a></li>
<li><a href="https://svnweb.freebsd.org/changeset/base/337229">Reduce taskq and context-switch cost of zio pipe</a></li>
<li><a href="https://reviews.freebsd.org/D16606">Proposed FreeBSD Memory Management change, expected to improve ZFS ARC interactions</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Anian_Z - <a href="http://dpaste.com/093FC8R#wrap">Question</a></li>
<li>Robert - <a href="http://dpaste.com/0GG7Q2A#wrap">Pool question</a></li>
<li>Lain - <a href="http://dpaste.com/2BWPX9C">Congratulations</a></li>
<li>Thomas - <a href="http://dpaste.com/25NGAP3#wrap">L2arc</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 258: OS Foundations | BSD Now 258</title>
  <link>https://www.bsdnow.tv/258</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2390</guid>
  <pubDate>Wed, 08 Aug 2018 01:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2975f51c-21d4-41df-bae9-4e3616147a50.mp3" length="52903277" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD Foundation July Newsletter, a bunch of BSDCan trip reports, HardenedBSD Foundation status, FreeBSD and OSPFd, ZFS disk structure overview, and more Spectre mitigations in OpenBSD.</itunes:subtitle>
  <itunes:duration>1:27:52</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD Foundation July Newsletter, a bunch of BSDCan trip reports, HardenedBSD Foundation status, FreeBSD and OSPFd, ZFS disk structure overview, and more Spectre mitigations in OpenBSD.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-july-2018/"&gt;FreeBSD Foundation Update, July 2018&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;MESSAGE FROM THE EXECUTIVE DIRECTOR&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;We’re in the middle of summer here, in Boulder, CO. While the days are typically hot, they can also be quite unpredictable. Thanks to the Rocky Mountains, waking up to 50-degree (~10 C) foggy weather is not surprising. In spite of the unpredictable weather, many of us took some vacation this month. Whether it was extending the Fourth of July celebration,  spending time with family, or relaxing and enjoying the summer weather, we appreciated our time off, while still managing to accomplish a lot!&lt;br&gt;
In this newsletter, Glen Barber enlightens us about the upcoming 12.0 release. I gave a recap of OSCON, that Ed Maste and I attended, and Mark Johnston explains the work on his improved microcode loading project, that we are funding. Finally, Anne Dickison gives us a rundown on upcoming events and information on submitting a talk for MeetBSD.&lt;br&gt;
Your support helps us continue this work. Please consider making a donation today. We can’t do it without you. Happy reading!!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;June 2018 Development Projects Update&lt;/li&gt;
&lt;li&gt;Fundraising Update: Supporting the Project&lt;/li&gt;
&lt;li&gt;July 2018 Release Engineering Update&lt;/li&gt;
&lt;li&gt;OSCON 2018 Recap&lt;/li&gt;
&lt;li&gt;Submit Your Work: MeetBSD 2018&lt;/li&gt;
&lt;li&gt;FreeBSD Discount for 2018 SNIA Developer Conference&lt;/li&gt;
&lt;li&gt;EuroBSDcon 2018 Travel Grant Application Deadline: August 2&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###BSDCan Trip Reports&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-constantin-stan/"&gt;BSDCan 2018 Trip Report: Constantin Stan&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-danilo-g-baio/"&gt;BSDCan 2018 Trip Report: Danilo G. Baio&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-rodrigo-osorio/"&gt;BSDCan 2018 Trip Report: Rodrigo Osorio&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-dhananjay-balan/"&gt;BSDCan 2018 Trip Report: Dhananjay Balan&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-kyle-evans/"&gt;BSDCan 2018 Trip Report: Kyle Evans&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://blog.haraschak.com/freebsd-and-ospfd/"&gt;FreeBSD and OSPFd&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;With FreeBSD jails deployed around the world, static routing was getting a bit out of hand. Plus, when I needed to move a jail from one data center to another, I would have to update routing tables across multiple sites. Not ideal. Enter dynamic routing…&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;OSPF (open shortest path first) is an internal dynamic routing protocol that provides the autonomy that I needed and it’s fairly easy to setup. This article does not cover configuration of VPN links, ZFS, or Freebsd jails, however it’s recommended that you use seperate ZFS datasets per jail so that migration between hosts can be done with zfs send &amp;amp; receive.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;In this scenario, we have five FreeBSD servers in two different data centers. Each physical server runs anywhere between three to ten jails. When jails are deployed, they are assigned a /32 IP on lo2. From here, pf handles inbound port forwarding and outbound NAT. Links between each server are provided by OpenVPN TAP interfaces. (I used TAP to pass layer 2 traffic. I seem to remember that I needed TAP interfaces due to needing GRE tunnels on top of TUN interfaces to get OSPF to communicate. I’ve heard TAP is slower than TUN so I may revisit this.)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;In this example, we will use 172.16.2.0/24 as the range for OpenVPN P2P links and 172.16.3.0/24 as the range of IPs available for assignment to each jail. Previously, when deploying a jail, I assigned IPs based on the following groups:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;Server 1: 172.16.3.0/28&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Server 2: 172.16.3.16/28&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Server 3: 172.16.3.32/28&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Server 4: 172.16.3.48/28&lt;/code&gt;&lt;br&gt;
&lt;code&gt;Server 5: 172.16.3.64/28&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;When statically routing, this made routing tables a bit smaller and easier to manage. However, when I needed to migrate a jail to a new host, I had to add a new /32 to all routing tables. Now, with OSPF, this is no longer an issue, nor is it required.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;To get started, first we install the Quagga package.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;The two configuration files needed to get OSPFv2 running are /usr/local/etc/quagga/zebra.conf and /usr/local/etc/quagga/ospfd.conf.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Starting with zebra.conf, we’ll define the hostname and a management password.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Second, we will populate the ospfd.conf file.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;To break this down:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;service advanced-vty allows you to skip the en or enable command. Since I’m the only one who uses this service, it’s one less command to type.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ip ospf authentication message-digest and ip ospf message-diget-key… ignores non-authenticated OSPF communication. This is useful when communicating over the WAN and to prevent a replay attack. Since I’m using a VPN to communicate, I could exclude these.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;passive-interface default turns off the active communication of OSPF messages on all interfaces except for the interfaces listed as no passive-interface [interface name]. Since my ospf communication needs to leverage the VPNs, this prevents the servers from trying to send ospf data out the WAN interface (a firewall would work too).&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;network 172.16.2.0/23 area 0.0.0.0 lists a supernet of both 172.16.2.0/24 and 172.16.3.0/24. This ensures routes for the jails are advertised along with the P2P links used by OpenVPN. The OpenVPN links are not required but can provide another IP to access your server if one of the links goes down. (See the suggested tasks below).&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;At this point, we can enable the services in rc.conf.local and start them.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;We bind the management interface to 127.0.0.1 so that it’s only accessable to local telnet sessions. If you want to access this service remotely, you can bind to a remotely accessable IP. Remember telnet is not secure. If you need remote access, use a VPN.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;To manage the services, you can telnet to your host’s localhost address.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Use 2604 for the ospf service.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Remember, this is accessible by non-root users so set a good password.&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSBroadDiskStructure"&gt;A broad overview of how ZFS is structured on disk&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;When I wrote yesterday’s entry, it became clear that I didn’t understand as much about how ZFS is structured on disk (and that this matters, since I thought that ZFS copy on write updates updated a lot more than they do). So today I want to write down my new broad understanding of how this works. (All of this can be dug out of the old, draft ZFS on-disk format specification, but that spec is written in a very detailed way and things aren’t always immediately clear from it.)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Almost everything in ZFS is in DMU object. All objects are defined by a dnode, and object dnodes are almost always grouped together in an object set. Object sets are themselves DMU objects; they store dnodes as basically a giant array in a ‘file’, which uses data blocks and indirect blocks and so on, just like anything else. Within a single object set, dnodes have an object number, which is the index of their position in the object set’s array of dnodes. (Because an object number is just the index of the object’s dnode in its object set’s array of dnodes, object numbers are basically always going to be duplicated between object sets (and they’re always relative to an object set). For instance, pretty much every object set is going to have an object number ten, although not all object sets may have enough objects that they have an object number ten thousand. One corollary of this is that if you ask zdb to tell you about a given object number, you have to tell zdb what object set you’re talking about. Usually you do this by telling zdb which ZFS filesystem or dataset you mean.)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Each ZFS filesystem has its own object set for objects (and thus dnodes) used in the filesystem. As I discovered yesterday, every ZFS filesystem has a directory hierarchy and it may go many levels deep, but all of this directory hierarchy refers to directories and files using their object number.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;ZFS organizes and keeps track of filesystems, clones, and snapshots through the DSL (Dataset and Snapshot Layer). The DSL has all sorts of things; DSL directories, DSL datasets, and so on, all of which are objects and many of which refer to object sets (for example, every ZFS filesystem must refer to its current object set somehow). All of these DSL objects are themselves stored as dnodes in another object set, the Meta Object Set, which the uberblock points to. To my surprise, object sets are not stored in the MOS (and as a result do not have ‘object numbers’). Object sets are always referred to directly, without indirection, using a block pointer to the object set’s dnode.  (I think object sets are referred to directly so that snapshots can freeze their object set very simply.)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The DSL directories and datasets for your pool’s set of filesystems form a tree themselves (each filesystem has a DSL directory and at least one DSL dataset). However, just like in ZFS filesystems, all of the objects in this second tree refer to each other indirectly, by their MOS object number. Just as with files in ZFS filesystems, this level of indirection limits the amount of copy on write updates that ZFS had to do when something changes.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;PS: If you want to examine MOS objects with zdb, I think you do it with something like ‘zdb -vvv -d ssddata 1’, which will get you object number 1 of the MOS, which is the MOS object directory. If you want to ask zdb about an object in the pool’s root filesystem, use ‘zdb -vvv -d ssddata/ 1’. You can tell which one you’re getting depending on what zdb prints out. If it says ‘Dataset mos [META]’ you’re looking at objects from the MOS; if it says ‘Dataset ssddata [ZPL]’, you’re looking at the pool’s root filesystem (where object number 1 is the ZFS master node).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;PPS: I was going to write up what changed on a filesystem write, but then I realized that I didn’t know how blocks being allocated and freed are reflected in pool structures. So I’ll just say that I think that ignoring free space management, only four DMU objects get updated; the file itself, the filesystem’s object set, the filesystem’s DSL dataset object, and the MOS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;(As usual, doing the research to write this up taught me things that I didn’t know about ZFS.)&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Digital Ocean&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://hardenedbsd.org/article/shawn-webb/2018-07-11/mid-july-hardenedbsd-foundation-status"&gt;HardenedBSD Foundation Status&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;On 09 July 2018, the HardenedBSD Foundation Board of Directors held the kick-off meeting to start organizing the Foundation. The following people attended the kick-off meeting:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Shawn Webb (in person)&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;George Saylor (in person)&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Ben Welch (in person)&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Virginia Suydan (in person)&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Ben La Monica (phone)&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Dean Freeman (phone)&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;ol&gt;
&lt;li&gt;Christian Severt (phone)&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;We discussed the very first steps that need to be taken to organize the HardenedBSD Foundation as a 501©(3) not-for-profit organization in the US. We determined we could file a 1023EZ instead of the full-blown 1023. This will help speed the process up drastically.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The steps are laid out as follows:&lt;/li&gt;
&lt;li&gt;Register a Post Office Box (PO Box) (completed on 10 Jul 2018).&lt;/li&gt;
&lt;li&gt;Register The HardenedBSD Foundation as a tax-exempt nonstock corporation in the state of Maryland (started on 10 Jul 2018, submitted on 18 Jul 2018, granted 20 Jul 2018).&lt;/li&gt;
&lt;li&gt;Obtain a federal tax ID (obtained 20 Jul 2018).&lt;/li&gt;
&lt;li&gt;Close the current bank account and create a new one using the federal tax ID (completed on 20 Jul 2018).&lt;/li&gt;
&lt;li&gt;File the 1023EZ paperwork with the federal government (started on 20 Jul 2018).&lt;/li&gt;
&lt;li&gt;Hire an attorney to help draft the organization bylaws.&lt;/li&gt;
&lt;li&gt;Each of the steps must be done serially and in order.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;We added Christian Severt, who is on Emerald Onion’s Board of Directors, to the HardenedBSD Foundation Board of Directors as an advisor. He was foundational in getting Emerald Onion their 501©(3) tax-exempt, not-for-profit status and has really good insight. Additionally, he’s going to help HardenedBSD coordinate hosting services, figuring out the best deals for us.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;We promoted George Saylor to Vice President and changed Shawn Webb’s title to President and Director. This is to help resolve potential concerns both the state and federal agencies might have with an organization having only a single President role.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;We hope to be granted our 501©(3) status before the end of the year, though that may be subject to change. We are excited for the formation of the HardenedBSD Foundation, which will open up new opportunities not otherwise available to HardenedBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://undeadly.org/cgi?action=article;sid=20180724072257"&gt;More mitigations against speculative execution vulnerabilities&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Philip Guenther (guenther@) and Bryan Steele (brynet@) have added more mitigations against speculative execution CPU vulnerabilities on the amd64 platform.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code class="language-For"&gt;
CVSROOT:    /cvs
Module name:    src
Changes by: guenther@cvs.openbsd.org    2018/07/23 11:54:04
Modified files:
    sys/arch/amd64/amd64: locore.S 
    sys/arch/amd64/include: asm.h cpufunc.h frameasm.h 
Log message:
Do "Return stack refilling", based on the "Return stack underflow" discussion
and its associated appendix at https://support.google.com/faqs/answer/7625886
This should address at least some cases of "SpectreRSB" and earlier
Spectre variants; more commits to follow.
The refilling is done in the enter-kernel-from-userspace and
return-to-userspace-from-kernel paths, making sure to do it before
unblocking interrupts so that a successive interrupt can't get the
CPU to C code without doing this refill.  Per the link above, it
also does it immediately after mwait, apparently in case the low-power
CPU states of idle-via-mwait flush the RSB.
ok mlarkin@ deraadt@```
and:
```CVSROOT: /cvs
Module name:    src
Changes by: guenther@cvs.openbsd.org    2018/07/23 20:42:25
Modified files:
    sys/arch/amd64/amd64: locore.S vector.S vmm_support.S 
    sys/arch/amd64/include: asm.h cpufunc.h 
Log message:
Also do RSB refilling when context switching, after vmexits, and
when vmlaunch or vmresume fails.
Follow the lead of clang and the intel recommendation and do an lfence
after the pause in the speculation-stop path for retpoline, RSB refill,
and meltover ASM bits.
ok kettenis@ deraadt@```
"Mitigation G-2" for AMD processors:
```CVSROOT: /cvs
Module name:    src
Changes by: brynet@cvs.openbsd.org  2018/07/23 17:25:03
Modified files:
    sys/arch/amd64/amd64: identcpu.c 
    sys/arch/amd64/include: specialreg.h 
Log message:
Add "Mitigation G-2" per AMD's Whitepaper "Software Techniques for
Managing Speculation on AMD Processors"
By setting MSR C001_1029[1]=1, LFENCE becomes a dispatch serializing
instruction.
Tested on AMD FX-4100 "Bulldozer", and Linux guest in SVM vmd(8)
ok deraadt@ mlarkin@```
Beastie Bits
HardenedBSD will stop supporting 10-STABLE on 10 August 2018 (https://groups.google.com/a/hardenedbsd.org/forum/#!topic/users/xvU0g-g1l5U)
GSoC 2018 Reports: Integrate libFuzzer with the Basesystem, Part 2 (https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_integrate_libfuzzer1)
ZFS Boot Environments at PBUG (https://vermaden.wordpress.com/2018/07/30/zfs-boot-environments-at-pbug/)
Second Editions versus the Publishing Business (https://blather.michaelwlucas.com/archives/3229)
Theo de Raadt on "unveil(2) usage in base" (https://undeadly.org/cgi?action=article;sid=20180728063716)
rtadvd(8) has been replaced by rad(8) (https://undeadly.org/cgi?action=article;sid=20180724072205)
BSD Users Stockholm Meetup #3 (https://www.meetup.com/BSD-Users-Stockholm/events/253447019/)
Changes to NetBSD release support policy (https://blog.netbsd.org/tnf/entry/changes_to_netbsd_release_support)
The future of HAMMER1 (http://lists.dragonflybsd.org/pipermail/users/2018-July/357832.html)
***
Tarsnap
Feedback/Questions
Rodriguez - A Question (http://dpaste.com/0Y1B75Q#wrap)
Shane - About ZFS Mostly (http://dpaste.com/32YGNBY#wrap)
Leif - ZFS less than 8gb (http://dpaste.com/2GY6HHC#wrap)
Wayne - ZFS vs EMC (http://dpaste.com/17PSCXC#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
&lt;/code&gt;&lt;/pre&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, spectre, ospfd, zfs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD Foundation July Newsletter, a bunch of BSDCan trip reports, HardenedBSD Foundation status, FreeBSD and OSPFd, ZFS disk structure overview, and more Spectre mitigations in OpenBSD.</p>

<p>##Headlines<br>
###<a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-july-2018/">FreeBSD Foundation Update, July 2018</a></p>

<ul>
<li>MESSAGE FROM THE EXECUTIVE DIRECTOR</li>
</ul>

<blockquote>
<p>We’re in the middle of summer here, in Boulder, CO. While the days are typically hot, they can also be quite unpredictable. Thanks to the Rocky Mountains, waking up to 50-degree (~10 C) foggy weather is not surprising. In spite of the unpredictable weather, many of us took some vacation this month. Whether it was extending the Fourth of July celebration,  spending time with family, or relaxing and enjoying the summer weather, we appreciated our time off, while still managing to accomplish a lot!<br>
In this newsletter, Glen Barber enlightens us about the upcoming 12.0 release. I gave a recap of OSCON, that Ed Maste and I attended, and Mark Johnston explains the work on his improved microcode loading project, that we are funding. Finally, Anne Dickison gives us a rundown on upcoming events and information on submitting a talk for MeetBSD.<br>
Your support helps us continue this work. Please consider making a donation today. We can’t do it without you. Happy reading!!</p>
</blockquote>

<ul>
<li>June 2018 Development Projects Update</li>
<li>Fundraising Update: Supporting the Project</li>
<li>July 2018 Release Engineering Update</li>
<li>OSCON 2018 Recap</li>
<li>Submit Your Work: MeetBSD 2018</li>
<li>FreeBSD Discount for 2018 SNIA Developer Conference</li>
<li>EuroBSDcon 2018 Travel Grant Application Deadline: August 2</li>
</ul>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###BSDCan Trip Reports</p>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-constantin-stan/">BSDCan 2018 Trip Report: Constantin Stan</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-danilo-g-baio/">BSDCan 2018 Trip Report: Danilo G. Baio</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-rodrigo-osorio/">BSDCan 2018 Trip Report: Rodrigo Osorio</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-dhananjay-balan/">BSDCan 2018 Trip Report: Dhananjay Balan</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-kyle-evans/">BSDCan 2018 Trip Report: Kyle Evans</a></li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://blog.haraschak.com/freebsd-and-ospfd/">FreeBSD and OSPFd</a></p>

<blockquote>
<p>With FreeBSD jails deployed around the world, static routing was getting a bit out of hand. Plus, when I needed to move a jail from one data center to another, I would have to update routing tables across multiple sites. Not ideal. Enter dynamic routing…</p>
</blockquote>

<blockquote>
<p>OSPF (open shortest path first) is an internal dynamic routing protocol that provides the autonomy that I needed and it’s fairly easy to setup. This article does not cover configuration of VPN links, ZFS, or Freebsd jails, however it’s recommended that you use seperate ZFS datasets per jail so that migration between hosts can be done with zfs send &amp; receive.</p>
</blockquote>

<blockquote>
<p>In this scenario, we have five FreeBSD servers in two different data centers. Each physical server runs anywhere between three to ten jails. When jails are deployed, they are assigned a /32 IP on lo2. From here, pf handles inbound port forwarding and outbound NAT. Links between each server are provided by OpenVPN TAP interfaces. (I used TAP to pass layer 2 traffic. I seem to remember that I needed TAP interfaces due to needing GRE tunnels on top of TUN interfaces to get OSPF to communicate. I’ve heard TAP is slower than TUN so I may revisit this.)</p>
</blockquote>

<blockquote>
<p>In this example, we will use 172.16.2.0/24 as the range for OpenVPN P2P links and 172.16.3.0/24 as the range of IPs available for assignment to each jail. Previously, when deploying a jail, I assigned IPs based on the following groups:</p>
</blockquote>

<p><code>Server 1: 172.16.3.0/28</code><br>
<code>Server 2: 172.16.3.16/28</code><br>
<code>Server 3: 172.16.3.32/28</code><br>
<code>Server 4: 172.16.3.48/28</code><br>
<code>Server 5: 172.16.3.64/28</code></p>

<blockquote>
<p>When statically routing, this made routing tables a bit smaller and easier to manage. However, when I needed to migrate a jail to a new host, I had to add a new /32 to all routing tables. Now, with OSPF, this is no longer an issue, nor is it required.</p>
</blockquote>

<ul>
<li>
<p>To get started, first we install the Quagga package.</p>
</li>
<li>
<p>The two configuration files needed to get OSPFv2 running are /usr/local/etc/quagga/zebra.conf and /usr/local/etc/quagga/ospfd.conf.</p>
</li>
<li>
<p>Starting with zebra.conf, we’ll define the hostname and a management password.</p>
</li>
<li>
<p>Second, we will populate the ospfd.conf file.</p>
</li>
<li>
<p>To break this down:</p>
</li>
<li>
<p>service advanced-vty allows you to skip the en or enable command. Since I’m the only one who uses this service, it’s one less command to type.</p>
</li>
<li>
<p>ip ospf authentication message-digest and ip ospf message-diget-key… ignores non-authenticated OSPF communication. This is useful when communicating over the WAN and to prevent a replay attack. Since I’m using a VPN to communicate, I could exclude these.</p>
</li>
<li>
<p>passive-interface default turns off the active communication of OSPF messages on all interfaces except for the interfaces listed as no passive-interface [interface name]. Since my ospf communication needs to leverage the VPNs, this prevents the servers from trying to send ospf data out the WAN interface (a firewall would work too).</p>
</li>
<li>
<p>network 172.16.2.0/23 area 0.0.0.0 lists a supernet of both 172.16.2.0/24 and 172.16.3.0/24. This ensures routes for the jails are advertised along with the P2P links used by OpenVPN. The OpenVPN links are not required but can provide another IP to access your server if one of the links goes down. (See the suggested tasks below).</p>
</li>
<li>
<p>At this point, we can enable the services in rc.conf.local and start them.</p>
</li>
<li>
<p>We bind the management interface to 127.0.0.1 so that it’s only accessable to local telnet sessions. If you want to access this service remotely, you can bind to a remotely accessable IP. Remember telnet is not secure. If you need remote access, use a VPN.</p>
</li>
<li>
<p>To manage the services, you can telnet to your host’s localhost address.</p>
</li>
<li>
<p>Use 2604 for the ospf service.</p>
</li>
<li>
<p>Remember, this is accessible by non-root users so set a good password.</p>
</li>
</ul>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSBroadDiskStructure">A broad overview of how ZFS is structured on disk</a></p>

<blockquote>
<p>When I wrote yesterday’s entry, it became clear that I didn’t understand as much about how ZFS is structured on disk (and that this matters, since I thought that ZFS copy on write updates updated a lot more than they do). So today I want to write down my new broad understanding of how this works. (All of this can be dug out of the old, draft ZFS on-disk format specification, but that spec is written in a very detailed way and things aren’t always immediately clear from it.)</p>
</blockquote>

<blockquote>
<p>Almost everything in ZFS is in DMU object. All objects are defined by a dnode, and object dnodes are almost always grouped together in an object set. Object sets are themselves DMU objects; they store dnodes as basically a giant array in a ‘file’, which uses data blocks and indirect blocks and so on, just like anything else. Within a single object set, dnodes have an object number, which is the index of their position in the object set’s array of dnodes. (Because an object number is just the index of the object’s dnode in its object set’s array of dnodes, object numbers are basically always going to be duplicated between object sets (and they’re always relative to an object set). For instance, pretty much every object set is going to have an object number ten, although not all object sets may have enough objects that they have an object number ten thousand. One corollary of this is that if you ask zdb to tell you about a given object number, you have to tell zdb what object set you’re talking about. Usually you do this by telling zdb which ZFS filesystem or dataset you mean.)</p>
</blockquote>

<blockquote>
<p>Each ZFS filesystem has its own object set for objects (and thus dnodes) used in the filesystem. As I discovered yesterday, every ZFS filesystem has a directory hierarchy and it may go many levels deep, but all of this directory hierarchy refers to directories and files using their object number.</p>
</blockquote>

<blockquote>
<p>ZFS organizes and keeps track of filesystems, clones, and snapshots through the DSL (Dataset and Snapshot Layer). The DSL has all sorts of things; DSL directories, DSL datasets, and so on, all of which are objects and many of which refer to object sets (for example, every ZFS filesystem must refer to its current object set somehow). All of these DSL objects are themselves stored as dnodes in another object set, the Meta Object Set, which the uberblock points to. To my surprise, object sets are not stored in the MOS (and as a result do not have ‘object numbers’). Object sets are always referred to directly, without indirection, using a block pointer to the object set’s dnode.  (I think object sets are referred to directly so that snapshots can freeze their object set very simply.)</p>
</blockquote>

<blockquote>
<p>The DSL directories and datasets for your pool’s set of filesystems form a tree themselves (each filesystem has a DSL directory and at least one DSL dataset). However, just like in ZFS filesystems, all of the objects in this second tree refer to each other indirectly, by their MOS object number. Just as with files in ZFS filesystems, this level of indirection limits the amount of copy on write updates that ZFS had to do when something changes.</p>
</blockquote>

<blockquote>
<p>PS: If you want to examine MOS objects with zdb, I think you do it with something like ‘zdb -vvv -d ssddata 1’, which will get you object number 1 of the MOS, which is the MOS object directory. If you want to ask zdb about an object in the pool’s root filesystem, use ‘zdb -vvv -d ssddata/ 1’. You can tell which one you’re getting depending on what zdb prints out. If it says ‘Dataset mos [META]’ you’re looking at objects from the MOS; if it says ‘Dataset ssddata [ZPL]’, you’re looking at the pool’s root filesystem (where object number 1 is the ZFS master node).</p>
</blockquote>

<blockquote>
<p>PPS: I was going to write up what changed on a filesystem write, but then I realized that I didn’t know how blocks being allocated and freed are reflected in pool structures. So I’ll just say that I think that ignoring free space management, only four DMU objects get updated; the file itself, the filesystem’s object set, the filesystem’s DSL dataset object, and the MOS.</p>
</blockquote>

<ul>
<li>(As usual, doing the research to write this up taught me things that I didn’t know about ZFS.)</li>
</ul>

<p><hr></p>

<p><strong>Digital Ocean</strong></p>

<p>###<a href="https://hardenedbsd.org/article/shawn-webb/2018-07-11/mid-july-hardenedbsd-foundation-status">HardenedBSD Foundation Status</a></p>

<blockquote>
<p>On 09 July 2018, the HardenedBSD Foundation Board of Directors held the kick-off meeting to start organizing the Foundation. The following people attended the kick-off meeting:</p>
</blockquote>

<ul>
<li>
<ol>
<li>Shawn Webb (in person)</li>
</ol>
</li>
<li>
<ol start="2">
<li>George Saylor (in person)</li>
</ol>
</li>
<li>
<ol start="3">
<li>Ben Welch (in person)</li>
</ol>
</li>
<li>
<ol start="4">
<li>Virginia Suydan (in person)</li>
</ol>
</li>
<li>
<ol start="5">
<li>Ben La Monica (phone)</li>
</ol>
</li>
<li>
<ol start="6">
<li>Dean Freeman (phone)</li>
</ol>
</li>
<li>
<ol start="7">
<li>Christian Severt (phone)</li>
</ol>
</li>
</ul>

<blockquote>
<p>We discussed the very first steps that need to be taken to organize the HardenedBSD Foundation as a 501©(3) not-for-profit organization in the US. We determined we could file a 1023EZ instead of the full-blown 1023. This will help speed the process up drastically.</p>
</blockquote>

<ul>
<li>The steps are laid out as follows:</li>
<li>Register a Post Office Box (PO Box) (completed on 10 Jul 2018).</li>
<li>Register The HardenedBSD Foundation as a tax-exempt nonstock corporation in the state of Maryland (started on 10 Jul 2018, submitted on 18 Jul 2018, granted 20 Jul 2018).</li>
<li>Obtain a federal tax ID (obtained 20 Jul 2018).</li>
<li>Close the current bank account and create a new one using the federal tax ID (completed on 20 Jul 2018).</li>
<li>File the 1023EZ paperwork with the federal government (started on 20 Jul 2018).</li>
<li>Hire an attorney to help draft the organization bylaws.</li>
<li>Each of the steps must be done serially and in order.</li>
</ul>

<blockquote>
<p>We added Christian Severt, who is on Emerald Onion’s Board of Directors, to the HardenedBSD Foundation Board of Directors as an advisor. He was foundational in getting Emerald Onion their 501©(3) tax-exempt, not-for-profit status and has really good insight. Additionally, he’s going to help HardenedBSD coordinate hosting services, figuring out the best deals for us.</p>
</blockquote>

<blockquote>
<p>We promoted George Saylor to Vice President and changed Shawn Webb’s title to President and Director. This is to help resolve potential concerns both the state and federal agencies might have with an organization having only a single President role.</p>
</blockquote>

<blockquote>
<p>We hope to be granted our 501©(3) status before the end of the year, though that may be subject to change. We are excited for the formation of the HardenedBSD Foundation, which will open up new opportunities not otherwise available to HardenedBSD.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://undeadly.org/cgi?action=article;sid=20180724072257">More mitigations against speculative execution vulnerabilities</a></p>

<blockquote>
<p>Philip Guenther (guenther@) and Bryan Steele (brynet@) have added more mitigations against speculative execution CPU vulnerabilities on the amd64 platform.</p>
</blockquote>

<pre><code class="language-For">
CVSROOT:    /cvs
Module name:    src
Changes by: guenther@cvs.openbsd.org    2018/07/23 11:54:04

Modified files:
    sys/arch/amd64/amd64: locore.S 
    sys/arch/amd64/include: asm.h cpufunc.h frameasm.h 

Log message:
Do &quot;Return stack refilling&quot;, based on the &quot;Return stack underflow&quot; discussion
and its associated appendix at https://support.google.com/faqs/answer/7625886
This should address at least some cases of &quot;SpectreRSB&quot; and earlier
Spectre variants; more commits to follow.

The refilling is done in the enter-kernel-from-userspace and
return-to-userspace-from-kernel paths, making sure to do it before
unblocking interrupts so that a successive interrupt can't get the
CPU to C code without doing this refill.  Per the link above, it
also does it immediately after mwait, apparently in case the low-power
CPU states of idle-via-mwait flush the RSB.

ok mlarkin@ deraadt@```

+ and:

```CVSROOT: /cvs
Module name:    src
Changes by: guenther@cvs.openbsd.org    2018/07/23 20:42:25

Modified files:
    sys/arch/amd64/amd64: locore.S vector.S vmm_support.S 
    sys/arch/amd64/include: asm.h cpufunc.h 

Log message:
Also do RSB refilling when context switching, after vmexits, and
when vmlaunch or vmresume fails.

Follow the lead of clang and the intel recommendation and do an lfence
after the pause in the speculation-stop path for retpoline, RSB refill,
and meltover ASM bits.

ok kettenis@ deraadt@```

+ &quot;Mitigation G-2&quot; for AMD processors:

```CVSROOT: /cvs
Module name:    src
Changes by: brynet@cvs.openbsd.org  2018/07/23 17:25:03

Modified files:
    sys/arch/amd64/amd64: identcpu.c 
    sys/arch/amd64/include: specialreg.h 

Log message:
Add &quot;Mitigation G-2&quot; per AMD's Whitepaper &quot;Software Techniques for
Managing Speculation on AMD Processors&quot;

By setting MSR C001_1029[1]=1, LFENCE becomes a dispatch serializing
instruction.

Tested on AMD FX-4100 &quot;Bulldozer&quot;, and Linux guest in SVM vmd(8)

ok deraadt@ mlarkin@```
***


##Beastie Bits
+ [HardenedBSD will stop supporting 10-STABLE on 10 August 2018](https://groups.google.com/a/hardenedbsd.org/forum/#!topic/users/xvU0g-g1l5U)
+ [GSoC 2018 Reports: Integrate libFuzzer with the Basesystem, Part 2](https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_integrate_libfuzzer1)
+ [ZFS Boot Environments at PBUG](https://vermaden.wordpress.com/2018/07/30/zfs-boot-environments-at-pbug/)
+ [Second Editions versus the Publishing Business](https://blather.michaelwlucas.com/archives/3229)
+ [Theo de Raadt on &quot;unveil(2) usage in base&quot;](https://undeadly.org/cgi?action=article;sid=20180728063716)
+ [rtadvd(8) has been replaced by rad(8)](https://undeadly.org/cgi?action=article;sid=20180724072205)
+ [BSD Users Stockholm Meetup #3](https://www.meetup.com/BSD-Users-Stockholm/events/253447019/)
+ [Changes to NetBSD release support policy](https://blog.netbsd.org/tnf/entry/changes_to_netbsd_release_support)
+ [The future of HAMMER1](http://lists.dragonflybsd.org/pipermail/users/2018-July/357832.html)
***

**Tarsnap**

##Feedback/Questions
+ Rodriguez - [A Question](http://dpaste.com/0Y1B75Q#wrap)
+ Shane - [About ZFS Mostly](http://dpaste.com/32YGNBY#wrap)
+ Leif - [ZFS less than 8gb](http://dpaste.com/2GY6HHC#wrap)
+ Wayne - [ZFS vs EMC](http://dpaste.com/17PSCXC#wrap)
***

- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)
</code></pre>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD Foundation July Newsletter, a bunch of BSDCan trip reports, HardenedBSD Foundation status, FreeBSD and OSPFd, ZFS disk structure overview, and more Spectre mitigations in OpenBSD.</p>

<p>##Headlines<br>
###<a href="https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-july-2018/">FreeBSD Foundation Update, July 2018</a></p>

<ul>
<li>MESSAGE FROM THE EXECUTIVE DIRECTOR</li>
</ul>

<blockquote>
<p>We’re in the middle of summer here, in Boulder, CO. While the days are typically hot, they can also be quite unpredictable. Thanks to the Rocky Mountains, waking up to 50-degree (~10 C) foggy weather is not surprising. In spite of the unpredictable weather, many of us took some vacation this month. Whether it was extending the Fourth of July celebration,  spending time with family, or relaxing and enjoying the summer weather, we appreciated our time off, while still managing to accomplish a lot!<br>
In this newsletter, Glen Barber enlightens us about the upcoming 12.0 release. I gave a recap of OSCON, that Ed Maste and I attended, and Mark Johnston explains the work on his improved microcode loading project, that we are funding. Finally, Anne Dickison gives us a rundown on upcoming events and information on submitting a talk for MeetBSD.<br>
Your support helps us continue this work. Please consider making a donation today. We can’t do it without you. Happy reading!!</p>
</blockquote>

<ul>
<li>June 2018 Development Projects Update</li>
<li>Fundraising Update: Supporting the Project</li>
<li>July 2018 Release Engineering Update</li>
<li>OSCON 2018 Recap</li>
<li>Submit Your Work: MeetBSD 2018</li>
<li>FreeBSD Discount for 2018 SNIA Developer Conference</li>
<li>EuroBSDcon 2018 Travel Grant Application Deadline: August 2</li>
</ul>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###BSDCan Trip Reports</p>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-constantin-stan/">BSDCan 2018 Trip Report: Constantin Stan</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-danilo-g-baio/">BSDCan 2018 Trip Report: Danilo G. Baio</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-rodrigo-osorio/">BSDCan 2018 Trip Report: Rodrigo Osorio</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-dhananjay-balan/">BSDCan 2018 Trip Report: Dhananjay Balan</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-kyle-evans/">BSDCan 2018 Trip Report: Kyle Evans</a></li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://blog.haraschak.com/freebsd-and-ospfd/">FreeBSD and OSPFd</a></p>

<blockquote>
<p>With FreeBSD jails deployed around the world, static routing was getting a bit out of hand. Plus, when I needed to move a jail from one data center to another, I would have to update routing tables across multiple sites. Not ideal. Enter dynamic routing…</p>
</blockquote>

<blockquote>
<p>OSPF (open shortest path first) is an internal dynamic routing protocol that provides the autonomy that I needed and it’s fairly easy to setup. This article does not cover configuration of VPN links, ZFS, or Freebsd jails, however it’s recommended that you use seperate ZFS datasets per jail so that migration between hosts can be done with zfs send &amp; receive.</p>
</blockquote>

<blockquote>
<p>In this scenario, we have five FreeBSD servers in two different data centers. Each physical server runs anywhere between three to ten jails. When jails are deployed, they are assigned a /32 IP on lo2. From here, pf handles inbound port forwarding and outbound NAT. Links between each server are provided by OpenVPN TAP interfaces. (I used TAP to pass layer 2 traffic. I seem to remember that I needed TAP interfaces due to needing GRE tunnels on top of TUN interfaces to get OSPF to communicate. I’ve heard TAP is slower than TUN so I may revisit this.)</p>
</blockquote>

<blockquote>
<p>In this example, we will use 172.16.2.0/24 as the range for OpenVPN P2P links and 172.16.3.0/24 as the range of IPs available for assignment to each jail. Previously, when deploying a jail, I assigned IPs based on the following groups:</p>
</blockquote>

<p><code>Server 1: 172.16.3.0/28</code><br>
<code>Server 2: 172.16.3.16/28</code><br>
<code>Server 3: 172.16.3.32/28</code><br>
<code>Server 4: 172.16.3.48/28</code><br>
<code>Server 5: 172.16.3.64/28</code></p>

<blockquote>
<p>When statically routing, this made routing tables a bit smaller and easier to manage. However, when I needed to migrate a jail to a new host, I had to add a new /32 to all routing tables. Now, with OSPF, this is no longer an issue, nor is it required.</p>
</blockquote>

<ul>
<li>
<p>To get started, first we install the Quagga package.</p>
</li>
<li>
<p>The two configuration files needed to get OSPFv2 running are /usr/local/etc/quagga/zebra.conf and /usr/local/etc/quagga/ospfd.conf.</p>
</li>
<li>
<p>Starting with zebra.conf, we’ll define the hostname and a management password.</p>
</li>
<li>
<p>Second, we will populate the ospfd.conf file.</p>
</li>
<li>
<p>To break this down:</p>
</li>
<li>
<p>service advanced-vty allows you to skip the en or enable command. Since I’m the only one who uses this service, it’s one less command to type.</p>
</li>
<li>
<p>ip ospf authentication message-digest and ip ospf message-diget-key… ignores non-authenticated OSPF communication. This is useful when communicating over the WAN and to prevent a replay attack. Since I’m using a VPN to communicate, I could exclude these.</p>
</li>
<li>
<p>passive-interface default turns off the active communication of OSPF messages on all interfaces except for the interfaces listed as no passive-interface [interface name]. Since my ospf communication needs to leverage the VPNs, this prevents the servers from trying to send ospf data out the WAN interface (a firewall would work too).</p>
</li>
<li>
<p>network 172.16.2.0/23 area 0.0.0.0 lists a supernet of both 172.16.2.0/24 and 172.16.3.0/24. This ensures routes for the jails are advertised along with the P2P links used by OpenVPN. The OpenVPN links are not required but can provide another IP to access your server if one of the links goes down. (See the suggested tasks below).</p>
</li>
<li>
<p>At this point, we can enable the services in rc.conf.local and start them.</p>
</li>
<li>
<p>We bind the management interface to 127.0.0.1 so that it’s only accessable to local telnet sessions. If you want to access this service remotely, you can bind to a remotely accessable IP. Remember telnet is not secure. If you need remote access, use a VPN.</p>
</li>
<li>
<p>To manage the services, you can telnet to your host’s localhost address.</p>
</li>
<li>
<p>Use 2604 for the ospf service.</p>
</li>
<li>
<p>Remember, this is accessible by non-root users so set a good password.</p>
</li>
</ul>

<p><hr></p>

<p>###<a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSBroadDiskStructure">A broad overview of how ZFS is structured on disk</a></p>

<blockquote>
<p>When I wrote yesterday’s entry, it became clear that I didn’t understand as much about how ZFS is structured on disk (and that this matters, since I thought that ZFS copy on write updates updated a lot more than they do). So today I want to write down my new broad understanding of how this works. (All of this can be dug out of the old, draft ZFS on-disk format specification, but that spec is written in a very detailed way and things aren’t always immediately clear from it.)</p>
</blockquote>

<blockquote>
<p>Almost everything in ZFS is in DMU object. All objects are defined by a dnode, and object dnodes are almost always grouped together in an object set. Object sets are themselves DMU objects; they store dnodes as basically a giant array in a ‘file’, which uses data blocks and indirect blocks and so on, just like anything else. Within a single object set, dnodes have an object number, which is the index of their position in the object set’s array of dnodes. (Because an object number is just the index of the object’s dnode in its object set’s array of dnodes, object numbers are basically always going to be duplicated between object sets (and they’re always relative to an object set). For instance, pretty much every object set is going to have an object number ten, although not all object sets may have enough objects that they have an object number ten thousand. One corollary of this is that if you ask zdb to tell you about a given object number, you have to tell zdb what object set you’re talking about. Usually you do this by telling zdb which ZFS filesystem or dataset you mean.)</p>
</blockquote>

<blockquote>
<p>Each ZFS filesystem has its own object set for objects (and thus dnodes) used in the filesystem. As I discovered yesterday, every ZFS filesystem has a directory hierarchy and it may go many levels deep, but all of this directory hierarchy refers to directories and files using their object number.</p>
</blockquote>

<blockquote>
<p>ZFS organizes and keeps track of filesystems, clones, and snapshots through the DSL (Dataset and Snapshot Layer). The DSL has all sorts of things; DSL directories, DSL datasets, and so on, all of which are objects and many of which refer to object sets (for example, every ZFS filesystem must refer to its current object set somehow). All of these DSL objects are themselves stored as dnodes in another object set, the Meta Object Set, which the uberblock points to. To my surprise, object sets are not stored in the MOS (and as a result do not have ‘object numbers’). Object sets are always referred to directly, without indirection, using a block pointer to the object set’s dnode.  (I think object sets are referred to directly so that snapshots can freeze their object set very simply.)</p>
</blockquote>

<blockquote>
<p>The DSL directories and datasets for your pool’s set of filesystems form a tree themselves (each filesystem has a DSL directory and at least one DSL dataset). However, just like in ZFS filesystems, all of the objects in this second tree refer to each other indirectly, by their MOS object number. Just as with files in ZFS filesystems, this level of indirection limits the amount of copy on write updates that ZFS had to do when something changes.</p>
</blockquote>

<blockquote>
<p>PS: If you want to examine MOS objects with zdb, I think you do it with something like ‘zdb -vvv -d ssddata 1’, which will get you object number 1 of the MOS, which is the MOS object directory. If you want to ask zdb about an object in the pool’s root filesystem, use ‘zdb -vvv -d ssddata/ 1’. You can tell which one you’re getting depending on what zdb prints out. If it says ‘Dataset mos [META]’ you’re looking at objects from the MOS; if it says ‘Dataset ssddata [ZPL]’, you’re looking at the pool’s root filesystem (where object number 1 is the ZFS master node).</p>
</blockquote>

<blockquote>
<p>PPS: I was going to write up what changed on a filesystem write, but then I realized that I didn’t know how blocks being allocated and freed are reflected in pool structures. So I’ll just say that I think that ignoring free space management, only four DMU objects get updated; the file itself, the filesystem’s object set, the filesystem’s DSL dataset object, and the MOS.</p>
</blockquote>

<ul>
<li>(As usual, doing the research to write this up taught me things that I didn’t know about ZFS.)</li>
</ul>

<p><hr></p>

<p><strong>Digital Ocean</strong></p>

<p>###<a href="https://hardenedbsd.org/article/shawn-webb/2018-07-11/mid-july-hardenedbsd-foundation-status">HardenedBSD Foundation Status</a></p>

<blockquote>
<p>On 09 July 2018, the HardenedBSD Foundation Board of Directors held the kick-off meeting to start organizing the Foundation. The following people attended the kick-off meeting:</p>
</blockquote>

<ul>
<li>
<ol>
<li>Shawn Webb (in person)</li>
</ol>
</li>
<li>
<ol start="2">
<li>George Saylor (in person)</li>
</ol>
</li>
<li>
<ol start="3">
<li>Ben Welch (in person)</li>
</ol>
</li>
<li>
<ol start="4">
<li>Virginia Suydan (in person)</li>
</ol>
</li>
<li>
<ol start="5">
<li>Ben La Monica (phone)</li>
</ol>
</li>
<li>
<ol start="6">
<li>Dean Freeman (phone)</li>
</ol>
</li>
<li>
<ol start="7">
<li>Christian Severt (phone)</li>
</ol>
</li>
</ul>

<blockquote>
<p>We discussed the very first steps that need to be taken to organize the HardenedBSD Foundation as a 501©(3) not-for-profit organization in the US. We determined we could file a 1023EZ instead of the full-blown 1023. This will help speed the process up drastically.</p>
</blockquote>

<ul>
<li>The steps are laid out as follows:</li>
<li>Register a Post Office Box (PO Box) (completed on 10 Jul 2018).</li>
<li>Register The HardenedBSD Foundation as a tax-exempt nonstock corporation in the state of Maryland (started on 10 Jul 2018, submitted on 18 Jul 2018, granted 20 Jul 2018).</li>
<li>Obtain a federal tax ID (obtained 20 Jul 2018).</li>
<li>Close the current bank account and create a new one using the federal tax ID (completed on 20 Jul 2018).</li>
<li>File the 1023EZ paperwork with the federal government (started on 20 Jul 2018).</li>
<li>Hire an attorney to help draft the organization bylaws.</li>
<li>Each of the steps must be done serially and in order.</li>
</ul>

<blockquote>
<p>We added Christian Severt, who is on Emerald Onion’s Board of Directors, to the HardenedBSD Foundation Board of Directors as an advisor. He was foundational in getting Emerald Onion their 501©(3) tax-exempt, not-for-profit status and has really good insight. Additionally, he’s going to help HardenedBSD coordinate hosting services, figuring out the best deals for us.</p>
</blockquote>

<blockquote>
<p>We promoted George Saylor to Vice President and changed Shawn Webb’s title to President and Director. This is to help resolve potential concerns both the state and federal agencies might have with an organization having only a single President role.</p>
</blockquote>

<blockquote>
<p>We hope to be granted our 501©(3) status before the end of the year, though that may be subject to change. We are excited for the formation of the HardenedBSD Foundation, which will open up new opportunities not otherwise available to HardenedBSD.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://undeadly.org/cgi?action=article;sid=20180724072257">More mitigations against speculative execution vulnerabilities</a></p>

<blockquote>
<p>Philip Guenther (guenther@) and Bryan Steele (brynet@) have added more mitigations against speculative execution CPU vulnerabilities on the amd64 platform.</p>
</blockquote>

<pre><code class="language-For">
CVSROOT:    /cvs
Module name:    src
Changes by: guenther@cvs.openbsd.org    2018/07/23 11:54:04

Modified files:
    sys/arch/amd64/amd64: locore.S 
    sys/arch/amd64/include: asm.h cpufunc.h frameasm.h 

Log message:
Do &quot;Return stack refilling&quot;, based on the &quot;Return stack underflow&quot; discussion
and its associated appendix at https://support.google.com/faqs/answer/7625886
This should address at least some cases of &quot;SpectreRSB&quot; and earlier
Spectre variants; more commits to follow.

The refilling is done in the enter-kernel-from-userspace and
return-to-userspace-from-kernel paths, making sure to do it before
unblocking interrupts so that a successive interrupt can't get the
CPU to C code without doing this refill.  Per the link above, it
also does it immediately after mwait, apparently in case the low-power
CPU states of idle-via-mwait flush the RSB.

ok mlarkin@ deraadt@```

+ and:

```CVSROOT: /cvs
Module name:    src
Changes by: guenther@cvs.openbsd.org    2018/07/23 20:42:25

Modified files:
    sys/arch/amd64/amd64: locore.S vector.S vmm_support.S 
    sys/arch/amd64/include: asm.h cpufunc.h 

Log message:
Also do RSB refilling when context switching, after vmexits, and
when vmlaunch or vmresume fails.

Follow the lead of clang and the intel recommendation and do an lfence
after the pause in the speculation-stop path for retpoline, RSB refill,
and meltover ASM bits.

ok kettenis@ deraadt@```

+ &quot;Mitigation G-2&quot; for AMD processors:

```CVSROOT: /cvs
Module name:    src
Changes by: brynet@cvs.openbsd.org  2018/07/23 17:25:03

Modified files:
    sys/arch/amd64/amd64: identcpu.c 
    sys/arch/amd64/include: specialreg.h 

Log message:
Add &quot;Mitigation G-2&quot; per AMD's Whitepaper &quot;Software Techniques for
Managing Speculation on AMD Processors&quot;

By setting MSR C001_1029[1]=1, LFENCE becomes a dispatch serializing
instruction.

Tested on AMD FX-4100 &quot;Bulldozer&quot;, and Linux guest in SVM vmd(8)

ok deraadt@ mlarkin@```
***


##Beastie Bits
+ [HardenedBSD will stop supporting 10-STABLE on 10 August 2018](https://groups.google.com/a/hardenedbsd.org/forum/#!topic/users/xvU0g-g1l5U)
+ [GSoC 2018 Reports: Integrate libFuzzer with the Basesystem, Part 2](https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_integrate_libfuzzer1)
+ [ZFS Boot Environments at PBUG](https://vermaden.wordpress.com/2018/07/30/zfs-boot-environments-at-pbug/)
+ [Second Editions versus the Publishing Business](https://blather.michaelwlucas.com/archives/3229)
+ [Theo de Raadt on &quot;unveil(2) usage in base&quot;](https://undeadly.org/cgi?action=article;sid=20180728063716)
+ [rtadvd(8) has been replaced by rad(8)](https://undeadly.org/cgi?action=article;sid=20180724072205)
+ [BSD Users Stockholm Meetup #3](https://www.meetup.com/BSD-Users-Stockholm/events/253447019/)
+ [Changes to NetBSD release support policy](https://blog.netbsd.org/tnf/entry/changes_to_netbsd_release_support)
+ [The future of HAMMER1](http://lists.dragonflybsd.org/pipermail/users/2018-July/357832.html)
***

**Tarsnap**

##Feedback/Questions
+ Rodriguez - [A Question](http://dpaste.com/0Y1B75Q#wrap)
+ Shane - [About ZFS Mostly](http://dpaste.com/32YGNBY#wrap)
+ Leif - [ZFS less than 8gb](http://dpaste.com/2GY6HHC#wrap)
+ Wayne - [ZFS vs EMC](http://dpaste.com/17PSCXC#wrap)
***

- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)
</code></pre>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 257: Great NetBSD 8 | BSD Now 257</title>
  <link>https://www.bsdnow.tv/257</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2354</guid>
  <pubDate>Thu, 02 Aug 2018 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7928575b-6648-4fac-ba50-4d24e56a7b9b.mp3" length="50094426" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>NetBSD 8.0 available, FreeBSD on Scaleway’s ARM64 VPS, encrypted backups with OpenBSD, Dragonfly server storage upgrade, zpool checkpoints, g2k18 hackathon reports, and more.</itunes:subtitle>
  <itunes:duration>1:23:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>NetBSD 8.0 available, FreeBSD on Scaleway’s ARM64 VPS, encrypted backups with OpenBSD, Dragonfly server storage upgrade, zpool checkpoints, g2k18 hackathon reports, and more.
&lt;hr&gt;
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.netbsd.org/releases/formal-8/NetBSD-8.0.html"&gt;NetBSD v8.0 Released&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The NetBSD Project is pleased to announce NetBSD 8.0, the sixteenth major release of the NetBSD operating system.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;This release brings stability improvements, hundreds of bug fixes, and many new features.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Some highlights of the NetBSD 8.0 release are:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;USB stack rework, USB3 support added.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;In-kernel audio mixer (audio_system(9)).&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Reproducible builds (MKREPRO, see mk.conf(5)).&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Full userland debug information (MKDEBUG, see mk.conf(5)) available. While most install media do not come with them (for size reasons), the debug and xdebug sets can be downloaded and extracted as needed later. They provide full symbol information for all base system and X binaries and libraries and allow better error reporting and (userland) crash analysis.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;PaX MPROTECT (W^X) memory protection enforced by default on some architectures with fine-grained memory protection and suitable ELF formats: i386, amd64, evbarm, landisk.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;PaX ASLR (Address Space Layout Randomization) enabled by default on: i386, amd64, evbarm, landisk, sparc64.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Position independent executables by default for userland on: i386, amd64, arm, m68k, mips, sh3, sparc64.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;A new socket layer can(4) has been added for communication of devices on a CAN bus.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;A special pseudo interface ipsecif(4) for route-based VPNs has been added.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Parts of the network stack have been made MP-safe. The kernel option NET_MPSAFE is required to enable this.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Hardening of the network stack in general.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Various WAPBL (the NetBSD file system “log” option) stability and performance improvements.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Specific to i386 and amd64 CPUs:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Meltdown mitigation: SVS (Separate Virtual Space), enabled by default.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;SpectreV2 mitigation: retpoline (support in gcc), used by default for kernels. Other hardware mitigations are also available.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;SpectreV4 mitigations available for Intel and AMD.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;PopSS workaround: user access to debug registers is turned off by default.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Lazy FPU saving disabled on vulnerable Intel CPUs (“eagerfpu”).&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;SMAP support.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Improvement and hardening of the memory layout: W^X, fewer writable pages, better consistency, better performance.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;(U)EFI bootloader.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Many evbarm kernels now use FDT (flat device tree) information (loadable at boot time from an external file) for device configuration, the number of kernels has decreased but the number of boards has vastly increased.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Lots of updates to 3rd party software included:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;GCC 5.5 with support for Address Sanitizer and Undefined Behavior Sanitizer&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;GDB 7.12&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;GNU binutils 2.27&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Clang/LLVM 3.8.1&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;OpenSSH 7.6&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;OpenSSL 1.0.2k&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;mdocml 1.14.1&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;acpica 20170303&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;ntp 4.2.8p11-o&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;dhcpcd 7.0.6&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Lua 5.3.4&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://community.online.net/t/freebsd-on-arm64/6678"&gt;Running FreeBSD on the ARM64 VPS from Scaleway&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I’ve been thinking about this 6 since 2017, but only yesterday signed up for an account and played around with the ARM64 offering.&lt;br&gt;
Turns out it’s pretty great! KVM boots into UEFI, there’s a local VirtIO disk attached, no NBD junk required. So we can definitely run FreeBSD.&lt;br&gt;
I managed to “depenguinate” a running instance, the notes are below. Would be great if Scaleway offered an official image instead :wink:&lt;br&gt;
For some reason, unlike on x86 4, mounting additional volumes is not allowed 4 on ARM64 instances. So we’ll have to move the running Linux to a ramdisk using pivotroot and then we can do whatever to our one and only disk.&lt;br&gt;
Spin up an instance with Ubuntu Zesty and ssh in.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Prepare the system and change the root to a tmpfs:&lt;/li&gt;
&lt;/ul&gt;
&lt;pre&gt;&lt;code&gt;apt install gdisk
mount -t tmpfs tmpfs /tmp
cp -r /bin /sbin /etc /dev /root /home /lib /run /usr /var /tmp
mkdir /tmp/proc /tmp/sys /tmp/oldroot
mount /dev/vda /tmp/oldroot
mount --make-rprivate /
pivotroot /tmp /tmp/oldroot
for i in dev proc sys run; do mount --move /oldroot/$i /$i; done
systemctl daemon-reload
systemctl restart sshd
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;Now reconnect to ssh from a second terminal (note: rm the connection file if you use ControlPersist in ssh config), then exit the old session. Kill the old sshd process, restart or stop the rest of the stuff using the old disk:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;pkill -f notty
sed -ibak 's/RefuseManualStart.$//g' /lib/systemd/system/dbus.service
systemctl daemon-reload
systemctl restart dbus
systemctl daemon-reexec
systemctl stop user@0 ntp cron systemd-logind
systemctl restart systemd-journald systemd-udevd
pkill agetty
pkill rsyslogd
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;Check that nothing is touching /oldroot:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;lsof | grep oldroot
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;There will probably be an old dbus-daemon, kill it.&lt;br&gt;
And finally, unmount the old root and overwrite the hard disk with a memstick image:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;umount -R /oldroot
wget https://download.freebsd.org/ftp/snapshots/arm64/aarch64/ISO-IMAGES/12.0/FreeBSD-12.0-CURRENT-arm64-aarch64-20180719-r336479-mini-memstick.img.xz
xzcat FreeBSD-12.0-CURRENT-arm64-aarch64-20180719-r336479-mini-memstick.img.xz | dd if=/dev/stdin of=/dev/vda bs=1M
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;(Look for the newest snapshot, don’t copy paste the July 19 link above if you’re reading this in the future. Actually maybe use a release instead of CURRENT…)&lt;br&gt;
Now, fix the GPT: move the secondary table to the end of the disk and resize the table.&lt;br&gt;
It’s important to resize here, as FreeBSD does not do that and silently creates partitions that won’t persist across reboots&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;gdisk /dev/vda
x
e
s
4
w
y
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;And reboot. (You might actually want to hard reboot here: for some reason on the first reboot from Linux, pressing the any-key to enter the prompt in the loader hangs the console for me.)&lt;/p&gt;
&lt;p&gt;I didn’t have to go into the ESC menu and choose the local disk in the boot manager, it seems to boot from disk automatically.&lt;/p&gt;
&lt;p&gt;Now we’re in the FreeBSD EFI loader.&lt;br&gt;
For some reason, the (recently fixed? 2) serial autodetection from EFI is not working correctly. Or something.&lt;br&gt;
So you don’t get console output by default.&lt;br&gt;
To fix, you have to run these commands in the boot loader command prompt:&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;set console=comconsole,efi
boot
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;Ignore the warning about comconsole not being a valid console.&lt;br&gt;
Since there’s at least one (efi) that the loader thinks is valid, it sets the whole variable.)&lt;/p&gt;
&lt;p&gt;(UPD: shouldn’t be necessary in the next snapshot)&lt;/p&gt;
&lt;p&gt;Now it’s a regular installation process!&lt;br&gt;
When asked about partitioning, choose Shell, and manually add a partition and set up a root filesystem:&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;gpart add -t freebsd-zfs -a 4k -l zroot vtbd0
zpool create -R /mnt -O mountpoint=none -O atime=off zroot /dev/gpt/zroot
zfs create -o canmount=off -o mountpoint=none zroot/ROOT
zfs create -o mountpoint=/ zroot/ROOT/default
zfs create -o mountpoint=/usr zroot/ROOT/default/usr
zfs create -o mountpoint=/var zroot/ROOT/default/var
zfs create -o mountpoint=/var/log zroot/ROOT/default/var/log
zfs create -o mountpoint=/usr/home zroot/home
zpool set bootfs=zroot/ROOT/default zroot
exit
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;(In this example, I set up ZFS with a beadm-compatible layout which allows me to use Boot Environments.)&lt;/p&gt;
&lt;p&gt;In the post-install chroot shell, fix some configs like so:&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;echo 'zfsload="YES"' &amp;gt;&amp;gt; /boot/loader.conf
echo 'console="comconsole,efi"' &amp;gt;&amp;gt; /boot/loader.conf
echo 'vfs.zfs.arcmax="512M"' &amp;gt;&amp;gt; /boot/loader.conf
sysrc zfsenable=YES
exit
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;(Yeah, for some reason, the loader does not load zfs.ko’s dependency opensolaris.ko automatically here. idk what even. It does on my desktop and laptop.)&lt;/p&gt;
&lt;p&gt;Now you can reboot into the installed system!!&lt;/p&gt;
&lt;p&gt;Here’s how you can set up IPv6 (and root’s ssh key) auto configuration on boot:&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;Pkg bootstrap
pkg install curl
curl https://raw.githubusercontent.com/scaleway/image-tools/master/bases/overlay-common/usr/local/bin/scw-metadata &amp;gt; /usr/local/bin/scw-metadata
chmod +x /usr/local/bin/scw-metadata
echo '#!/bin/sh' &amp;gt; /etc/rc.local
echo 'PATH=/usr/local/bin:$PATH' &amp;gt;&amp;gt; /etc/rc.local
echo 'eval $(scw-metadata)' &amp;gt;&amp;gt; /etc/rc.local
echo 'echo $SSHPUBLICKEYS0KEY &amp;gt; /root/.ssh/authorizedkeys' &amp;gt;&amp;gt; /etc/rc.local
echo 'chmod 0400 /root/.ssh/authorizedkeys' &amp;gt;&amp;gt; /etc/rc.local
echo 'ifconfig vtnet0 inet6 $IPV6ADDRESS/$IPV6NETMASK' &amp;gt;&amp;gt; /etc/rc.local
echo 'route -6 add default $IPV6GATEWAY' &amp;gt;&amp;gt; /etc/rc.local
mkdir /run
mkdir /root/.ssh
sh /etc/rc.local
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;And to fix incoming TCP connections, configure the DHCP client to change the broadcast address:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;echo 'interface "vtnet0" { supersede broadcast-address 255.255.255.255; }' &amp;gt;&amp;gt; /etc/dhclient.conf&lt;/code&gt;&lt;br&gt;
&lt;code&gt;killall dhclient&lt;/code&gt;&lt;br&gt;
&lt;code&gt;dhclient vtnet0&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Other random notes:&lt;/li&gt;
&lt;li&gt;keep in mind that -CURRENT snapshots come with a debugging kernel by default, which limits syscall performance by a lot, you might want to build your own 2 with config GENERIC-NODEBUG&lt;/li&gt;
&lt;li&gt;also disable heavy malloc debugging features by running ln -s ‘abort:false,junk:false’ /etc/malloc.conf (yes that’s storing config in a symlink)&lt;/li&gt;
&lt;li&gt;you can reuse the installer’s partition for swap&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;* Digital Ocean **&lt;br&gt;
&lt;a href="http://do.co/bsdnow"&gt;http://do.co/bsdnow&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://dataswamp.org/~solene/2018-06-26-openbsd-easy-backup.html"&gt;Easy encrypted backups on OpenBSD with base tools&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Today’s topic is “Encrypted backups” using only OpenBSD base tools. I am planning to write a bigger article later about backups but it’s a wide topic with a lot of software to cover and a lot of explanations about the differents uses cases, needs, issues an solutions. Here I will stick on explaining how to make reliable backups for an OpenBSD system (my laptop).&lt;br&gt;
What we need is the dump command (see man 8 dump for its man page). It’s an utility to make a backup for a filesystem, it can only make a backup of one filesystem at a time. On my laptop I only backup /home partition so this solution is suitable for me while still being easy.&lt;br&gt;
Dump can do incremental backups, it means that it will only save what changed since the last backup of lower level. If you do not understand this, please refer to the dump man page.&lt;br&gt;
What is very interesting with dump is that it honors nodump flag which is an extended attribute of a FFS filesystem. One can use the command chflags nodump /home/solene/Downloads to tells dump not do save that folder (under some circumstances). By default, dump will not save thoses files, EXCEPT for a level 0 backup.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Important features of this backup solution:&lt;/li&gt;
&lt;li&gt;save files with attributes, permissions and flags&lt;/li&gt;
&lt;li&gt;can recreate a partition from a dump, restore files interactively, from a list or from its inode number (useful when you have files in lost+found)&lt;/li&gt;
&lt;li&gt;one dump = one file&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;My process is to make a huge dump of level 0 and keep it on a remote server, then, once a week I make a level 1 backup which will contain everything changed since the last dump of level 0, and everyday I do a level 2 backup of my files. The level 2 will contain latest files and the files changing a lot, which are often the most interesting. The level 1 backup is important because it will offload a lot of changes for the level 2.&lt;br&gt;
Let me explain: let says my full backup is 60 GB, full of pictures, sources files, GUI applications data files etc… A level 1 backup will contain every new picture, new projects, new GUI files etc… since the full backup, which will produce bigger and bigger dump over time, usually it is only 100 MB to 1GB. As I don’t add new pictures everyday or use new software everyday, the level 2 will take care of most littles changes to my data, like source code edited, little works on files etc… The level 2 backup is really small, I try to keep it under 50 MB so I can easily send it on my remote server everyday.&lt;br&gt;
One could you more dump level, up to level 9, but keep in mind that those are incremental. In my case, if I need to restore all my partition, I will need to use level 0, 1 and 2 to get up to latest backup state. If you want to restore a file deleted a few days ago, you need to remember in which level its latest version is.&lt;br&gt;
History note: dump was designed to be used with magnetic tapes.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;See the article for the remainder of the article&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="http://lists.dragonflybsd.org/pipermail/users/2018-July/357809.html"&gt;Status of DFly server storage upgrades (Matt Dillon)&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Last month we did some storage upgrades, particularly of internet-facing machines for package and OS distribution.  Yesterday we did a number of additional upgrades, described below.  All using funds generously donated by everyone!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The main repository server received a 2TB SSD to replace the HDDs it was using before.  This will improve access to a number of things maintained by this server, including the mail archives, and gives the main repo server more breathing room for repository expansion.  Space was at a premium before.  Now there’s plenty.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Monster, the quad socket opteron which we currently use as the database builder and repository that we export to our public grok service (&lt;a href="http://grok.dragonflybsd.org"&gt;grok.dragonflybsd.org&lt;/a&gt;) received a 512G SSD to add swap space for swapcache, to help cache the grok meta-data.  It now has 600GB of swapcache configured.  Over the next few weeks we will also be changing the grok updates to ping-pong between the two 4TB data drives it received in the last upgrade so we can do concurrent updates and web accesses without them tripping over each other performance-wise.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The main developer box, Leaf, received a 2TB SSD and we are currently in the midst of migrating all the developer accounts in /home and /build from its old HDDs to its new SSD.  This machine serves developer repos, developer web stuff, our home page and wiki, etc, so those will become snappier as well.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Hard drives are becoming real dinosaurs.  We still have a few left from the old days but in terms of active use the only HDDs we feel we really need to keep now are the ones we use for backups and grok data, owing to the amount of storage needed for those functions.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Five years ago when we received the blade server that now sits in the colo, we had a small 256G SSD for root on every blade, and everything else used HDDs.  To make things operate smoothly, most of that 256G root SSD was assigned to swapcache (200G of it, in fact, in most cases).  Even just 2 years ago replacing all those HDDs with SSDs, even just the ones being used to actively serve data and support developers, would have been cost prohibitive.  But today it isn’t and the only HDDs we really need anywhere are for backups or certain very large bits of bulk data (aka the grok source repository and index).  The way things are going, even the backup drives will probably become SSDs over the next two years.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###iX ad spot&lt;br&gt;
&lt;a href="https://www.ixsystems.com/blog/oscon2018/"&gt;OSCON 2018 Recap&lt;/a&gt;&lt;/p&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="http://oshogbo.vexillium.org/blog/46/"&gt;zpool checkpoints&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;In March, to FreeBSD landed a very interesting feature called ‘zpool checkpoints’. Before we jump straight into the topic, let’s take a step back and look at another ZFS feature called ‘snapshot’. Snapshot allows us to create an image of our single file systems. This gives us the option to modify data on the dataset without the fear of losing some data.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;A very good example of how to use ZFS snapshot is during an upgrade of database schema. Let us consider a situation where we have a few scripts which change our schema. Sometimes we are unable to upgrade in one transaction (for example, when we attempt to alter a table and then update it in single transaction). If our database is on dataset, we can just snapshot it, and if something goes wrong, simply rollback the file system to its previous state.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The problem with snapshot is that it works only on a single dataset. If we added some dataset, we wouldn’t then be able to create the snapshot which would rollback that operation. The same with changing the attributes of a dataset. If we change the compression on the dataset, we cannot rollback it. We would need to change that manually.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Another interesting problem involves upgrading the whole operating system when we upgrade system with a new ZFS version. What if we start upgrading our dataset and our kernel begins to crash? (If you use FreeBSD, I doubt you will ever have had that experience but still…). If we rollback to the old kernel, there is a chance the dataset will stop working because the new kernel doesn’t know how to use the new features.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Zpool checkpoints is the solution to all those problems. Instead of taking a single snapshot of the dataset, we can now take a snapshot of the whole pool. That means we will not only rollback the data but also all the metadata. If we rewind to the checkpoint, all our ZFS properties will be rolled back; the upgrade will be rolledback, and even the creation/deletion of the dataset, and the snapshot, will be rolledback.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Zpool Checkpoint has introduced a few simple functions:&lt;/li&gt;
&lt;li&gt;For a creating checkpoint:&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;zpool checkpoint &amp;lt;pool&amp;gt;&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Rollbacks state to checkpoint and remove the checkpoint:&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;zpool import -- rewind-to-checkpoint &amp;lt;pool&amp;gt;&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Mount the pool read only - this does not rollback the data:&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;zpool import --read-only=on --rewind-to-checkpoint&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Remove the checkpoint&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;zpool checkpoint --discard &amp;lt;pool&amp;gt; or zpool checkpoint -d &amp;lt;pool&amp;gt;&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;With this powerful feature we need to remember some safety rules:&lt;/li&gt;
&lt;li&gt;Scrub will work only on data that isn’t in checkpool.&lt;/li&gt;
&lt;li&gt;You can’t remove vdev if you have a checkpoint.&lt;/li&gt;
&lt;li&gt;You can’t split mirror.&lt;/li&gt;
&lt;li&gt;Reguid will not work either.&lt;/li&gt;
&lt;li&gt;Create a checkpoint when one of the disks is removed…&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;For me, this feature is incredibly useful, especially when upgrading an operating system, or when I need to experiment with additional data sets. If you speak Polish, I have some additional information for you. During the first Polish BSD user group meeting, I had the opportunity to give a short talk about this feature. Here you find the video of that talk, and here is the slideshow.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I would like to offer my thanks to Serapheim Dimitropoulos for developing this feature, and for being so kind in sharing with me so many of its intricacies. If you are interested in knowing more about the technical details of this feature, you should check out Serapheim’s blog, and his video about checkpoints.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###g2k18 Reports&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180728110010"&gt;g2k18 hackathon report: Ingo Schwarze on sed(1) bugfixing with Martijn van Duren, and about other small userland stuff&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180726184322"&gt;g2k18 hackathon report: Kenneth Westerback on dhcpd(8) fixes, disklabel(8) refactoring and more&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180716193511"&gt;g2k18 Hackathon Report: Marc Espie on ports and packages progress&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180716202456"&gt;g2k18 hackathon report: Antoine Jacoutot on porting&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180717074543"&gt;g2k18 hackathon report: Matthieu Herrb on font caches and xenodm&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180718060313"&gt;g2k18 hackathon report: Florian Obser on rtadvd(8) -&amp;gt; rad(8) progress (actually, rewrite)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180719100833"&gt;g2k18 Hackathon Report: Klemens Nanni on improvements to route(8), pfctl(8), and mount(2)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180721053002"&gt;g2k18 hackathon report: Carlos Cardenas on vmm/vmd progress, LACP&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180721053011"&gt;g2k18 hackathon report: Claudio Jeker on OpenBGPD developments&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://i.imgur.com/3t3cJF6.jpg"&gt;Picture of the last day of the g2k18 hackathon in Ljubljana, Slovenia&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.geeklan.co.uk/?p=2266"&gt;Something blogged (on pkgsrcCon 2018)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files"&gt;GSoC 2018 Reports: Configuration files versioning in pkgsrc, Part 1&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://bsd.network/@mulander/100390180499807877"&gt;There should be a global ‘awareness’ week for developers&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://bsd-pl.org/en"&gt;Polish BSD User Group – Upcoming Meeting: Aug 9th 2018&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://ukopenbsdusers.saneusergroup.org.uk/pipermail/uk-openbsd-users/2018-July/000430.html"&gt;London BSD User Group – Upcoming Meeting: Aug 14th 2018&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://whyzfsisbetter.com/"&gt;Phillip Smith’s collection of reasons why ZFS is better so that he does not have to repeat&lt;br&gt;
himself all the time&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://2018.eurobsdcon.org/registration-is-open/"&gt;EuroBSDCon 2018: Sept 20-23rd in Romania – Register NOW!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.meetbsd.com/call-for-papers/"&gt;MeetBSD 2018: Oct 19-20 in Santa Clara, California. Call for Papers closes on Aug 12&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Dale - &lt;a href="http://dpaste.com/1K452Y7#wrap"&gt;L2ARC recommendations &amp;amp; drive age question&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Todd - &lt;a href="http://dpaste.com/0WWHZ3E#wrap"&gt;ZFS &amp;amp; S3&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;efraim - &lt;a href="http://dpaste.com/36YP39B#wrap"&gt;License Poem&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Henrick - &lt;a href="http://dpaste.com/21D1KWA#wrap"&gt;Yet another ZFS question&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, arm64, encrypted backups, zpool checkpoints, g2k18 reports</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>NetBSD 8.0 available, FreeBSD on Scaleway’s ARM64 VPS, encrypted backups with OpenBSD, Dragonfly server storage upgrade, zpool checkpoints, g2k18 hackathon reports, and more.<br>
<hr></p>

<p>##Headlines<br>
###<a href="https://www.netbsd.org/releases/formal-8/NetBSD-8.0.html">NetBSD v8.0 Released</a></p>

<blockquote>
<p>The NetBSD Project is pleased to announce NetBSD 8.0, the sixteenth major release of the NetBSD operating system.</p>
</blockquote>

<blockquote>
<p>This release brings stability improvements, hundreds of bug fixes, and many new features.</p>
</blockquote>

<ul>
<li>
<p>Some highlights of the NetBSD 8.0 release are:</p>
</li>
<li>
<p>USB stack rework, USB3 support added.</p>
</li>
<li>
<p>In-kernel audio mixer (audio_system(9)).</p>
</li>
<li>
<p>Reproducible builds (MKREPRO, see mk.conf(5)).</p>
</li>
<li>
<p>Full userland debug information (MKDEBUG, see mk.conf(5)) available. While most install media do not come with them (for size reasons), the debug and xdebug sets can be downloaded and extracted as needed later. They provide full symbol information for all base system and X binaries and libraries and allow better error reporting and (userland) crash analysis.</p>
</li>
<li>
<p>PaX MPROTECT (W^X) memory protection enforced by default on some architectures with fine-grained memory protection and suitable ELF formats: i386, amd64, evbarm, landisk.</p>
</li>
<li>
<p>PaX ASLR (Address Space Layout Randomization) enabled by default on: i386, amd64, evbarm, landisk, sparc64.</p>
</li>
<li>
<p>Position independent executables by default for userland on: i386, amd64, arm, m68k, mips, sh3, sparc64.</p>
</li>
<li>
<p>A new socket layer can(4) has been added for communication of devices on a CAN bus.</p>
</li>
<li>
<p>A special pseudo interface ipsecif(4) for route-based VPNs has been added.</p>
</li>
<li>
<p>Parts of the network stack have been made MP-safe. The kernel option NET_MPSAFE is required to enable this.</p>
</li>
<li>
<p>Hardening of the network stack in general.</p>
</li>
<li>
<p>Various WAPBL (the NetBSD file system “log” option) stability and performance improvements.</p>
</li>
<li>
<p>Specific to i386 and amd64 CPUs:</p>
</li>
<li>
<p>Meltdown mitigation: SVS (Separate Virtual Space), enabled by default.</p>
</li>
<li>
<p>SpectreV2 mitigation: retpoline (support in gcc), used by default for kernels. Other hardware mitigations are also available.</p>
</li>
<li>
<p>SpectreV4 mitigations available for Intel and AMD.</p>
</li>
<li>
<p>PopSS workaround: user access to debug registers is turned off by default.</p>
</li>
<li>
<p>Lazy FPU saving disabled on vulnerable Intel CPUs (“eagerfpu”).</p>
</li>
<li>
<p>SMAP support.</p>
</li>
<li>
<p>Improvement and hardening of the memory layout: W^X, fewer writable pages, better consistency, better performance.</p>
</li>
<li>
<p>(U)EFI bootloader.</p>
</li>
<li>
<p>Many evbarm kernels now use FDT (flat device tree) information (loadable at boot time from an external file) for device configuration, the number of kernels has decreased but the number of boards has vastly increased.</p>
</li>
<li>
<p>Lots of updates to 3rd party software included:</p>
</li>
<li>
<p>GCC 5.5 with support for Address Sanitizer and Undefined Behavior Sanitizer</p>
</li>
<li>
<p>GDB 7.12</p>
</li>
<li>
<p>GNU binutils 2.27</p>
</li>
<li>
<p>Clang/LLVM 3.8.1</p>
</li>
<li>
<p>OpenSSH 7.6</p>
</li>
<li>
<p>OpenSSL 1.0.2k</p>
</li>
<li>
<p>mdocml 1.14.1</p>
</li>
<li>
<p>acpica 20170303</p>
</li>
<li>
<p>ntp 4.2.8p11-o</p>
</li>
<li>
<p>dhcpcd 7.0.6</p>
</li>
<li>
<p>Lua 5.3.4</p>
</li>
</ul>

<p><hr></p>

<p>###<a href="https://community.online.net/t/freebsd-on-arm64/6678">Running FreeBSD on the ARM64 VPS from Scaleway</a></p>

<blockquote>
<p>I’ve been thinking about this 6 since 2017, but only yesterday signed up for an account and played around with the ARM64 offering.<br>
Turns out it’s pretty great! KVM boots into UEFI, there’s a local VirtIO disk attached, no NBD junk required. So we can definitely run FreeBSD.<br>
I managed to “depenguinate” a running instance, the notes are below. Would be great if Scaleway offered an official image instead :wink:<br>
For some reason, unlike on x86 4, mounting additional volumes is not allowed 4 on ARM64 instances. So we’ll have to move the running Linux to a ramdisk using pivot_root and then we can do whatever to our one and only disk.<br>
Spin up an instance with Ubuntu Zesty and ssh in.</p>
</blockquote>

<ul>
<li>Prepare the system and change the root to a tmpfs:</li>
</ul>

<pre><code>apt install gdisk
mount -t tmpfs tmpfs /tmp
cp -r /bin /sbin /etc /dev /root /home /lib /run /usr /var /tmp
mkdir /tmp/proc /tmp/sys /tmp/oldroot
mount /dev/vda /tmp/oldroot
mount --make-rprivate /
pivot_root /tmp /tmp/oldroot
for i in dev proc sys run; do mount --move /oldroot/$i /$i; done
systemctl daemon-reload
systemctl restart sshd
</code></pre>

<blockquote>
<p>Now reconnect to ssh from a second terminal (note: rm the connection file if you use ControlPersist in ssh config), then exit the old session. Kill the old sshd process, restart or stop the rest of the stuff using the old disk:</p>
</blockquote>

<pre><code>pkill -f notty
sed -ibak 's/RefuseManualStart.*$//g' /lib/systemd/system/dbus.service
systemctl daemon-reload
systemctl restart dbus
systemctl daemon-reexec
systemctl stop user@0 ntp cron systemd-logind
systemctl restart systemd-journald systemd-udevd
pkill agetty
pkill rsyslogd
</code></pre>

<blockquote>
<p>Check that nothing is touching /oldroot:</p>
</blockquote>

<pre><code>lsof | grep oldroot
</code></pre>

<blockquote>
<p>There will probably be an old dbus-daemon, kill it.<br>
And finally, unmount the old root and overwrite the hard disk with a memstick image:</p>
</blockquote>

<pre><code>umount -R /oldroot
wget https://download.freebsd.org/ftp/snapshots/arm64/aarch64/ISO-IMAGES/12.0/FreeBSD-12.0-CURRENT-arm64-aarch64-20180719-r336479-mini-memstick.img.xz
xzcat FreeBSD-12.0-CURRENT-arm64-aarch64-20180719-r336479-mini-memstick.img.xz | dd if=/dev/stdin of=/dev/vda bs=1M
</code></pre>

<blockquote>
<p>(Look for the newest snapshot, don’t copy paste the July 19 link above if you’re reading this in the future. Actually maybe use a release instead of CURRENT…)<br>
Now, fix the GPT: move the secondary table to the end of the disk and resize the table.<br>
It’s important to resize here, as FreeBSD does not do that and silently creates partitions that won’t persist across reboots</p>
</blockquote>

<pre><code>gdisk /dev/vda
x
e
s
4
w
y
</code></pre>

<p>And reboot. (You might actually want to hard reboot here: for some reason on the first reboot from Linux, pressing the any-key to enter the prompt in the loader hangs the console for me.)</p>

<p>I didn’t have to go into the ESC menu and choose the local disk in the boot manager, it seems to boot from disk automatically.</p>

<p>Now we’re in the FreeBSD EFI loader.<br>
For some reason, the (recently fixed? 2) serial autodetection from EFI is not working correctly. Or something.<br>
So you don’t get console output by default.<br>
To fix, you have to run these commands in the boot loader command prompt:</p>

<pre><code>set console=comconsole,efi
boot
</code></pre>

<p>Ignore the warning about comconsole not being a valid console.<br>
Since there’s at least one (efi) that the loader thinks is valid, it sets the whole variable.)</p>

<p>(UPD: shouldn’t be necessary in the next snapshot)</p>

<p>Now it’s a regular installation process!<br>
When asked about partitioning, choose Shell, and manually add a partition and set up a root filesystem:</p>

<pre><code>gpart add -t freebsd-zfs -a 4k -l zroot vtbd0
zpool create -R /mnt -O mountpoint=none -O atime=off zroot /dev/gpt/zroot
zfs create -o canmount=off -o mountpoint=none zroot/ROOT
zfs create -o mountpoint=/ zroot/ROOT/default
zfs create -o mountpoint=/usr zroot/ROOT/default/usr
zfs create -o mountpoint=/var zroot/ROOT/default/var
zfs create -o mountpoint=/var/log zroot/ROOT/default/var/log
zfs create -o mountpoint=/usr/home zroot/home
zpool set bootfs=zroot/ROOT/default zroot
exit
</code></pre>

<p>(In this example, I set up ZFS with a beadm-compatible layout which allows me to use Boot Environments.)</p>

<p>In the post-install chroot shell, fix some configs like so:</p>

<pre><code>echo 'zfs_load=&quot;YES&quot;' &gt;&gt; /boot/loader.conf
echo 'console=&quot;comconsole,efi&quot;' &gt;&gt; /boot/loader.conf
echo 'vfs.zfs.arc_max=&quot;512M&quot;' &gt;&gt; /boot/loader.conf
sysrc zfs_enable=YES
exit
</code></pre>

<p>(Yeah, for some reason, the loader does not load zfs.ko’s dependency opensolaris.ko automatically here. idk what even. It does on my desktop and laptop.)</p>

<p>Now you can reboot into the installed system!!</p>

<p>Here’s how you can set up IPv6 (and root’s ssh key) auto configuration on boot:</p>

<pre><code>Pkg bootstrap
pkg install curl
curl https://raw.githubusercontent.com/scaleway/image-tools/master/bases/overlay-common/usr/local/bin/scw-metadata &gt; /usr/local/bin/scw-metadata
chmod +x /usr/local/bin/scw-metadata
echo '#\!/bin/sh' &gt; /etc/rc.local
echo 'PATH=/usr/local/bin:$PATH' &gt;&gt; /etc/rc.local
echo 'eval $(scw-metadata)' &gt;&gt; /etc/rc.local
echo 'echo $SSH_PUBLIC_KEYS_0_KEY &gt; /root/.ssh/authorized_keys' &gt;&gt; /etc/rc.local
echo 'chmod 0400 /root/.ssh/authorized_keys' &gt;&gt; /etc/rc.local
echo 'ifconfig vtnet0 inet6 $IPV6_ADDRESS/$IPV6_NETMASK' &gt;&gt; /etc/rc.local
echo 'route -6 add default $IPV6_GATEWAY' &gt;&gt; /etc/rc.local
mkdir /run
mkdir /root/.ssh
sh /etc/rc.local
</code></pre>

<blockquote>
<p>And to fix incoming TCP connections, configure the DHCP client to change the broadcast address:</p>
</blockquote>

<p><code>echo 'interface &quot;vtnet0&quot; { supersede broadcast-address 255.255.255.255; }' &gt;&gt; /etc/dhclient.conf</code><br>
<code>killall dhclient</code><br>
<code>dhclient vtnet0</code></p>

<ul>
<li>Other random notes:</li>
<li>keep in mind that -CURRENT snapshots come with a debugging kernel by default, which limits syscall performance by a lot, you might want to build your own 2 with config GENERIC-NODEBUG</li>
<li>also disable heavy malloc debugging features by running ln -s ‘abort:false,junk:false’ /etc/malloc.conf (yes that’s storing config in a symlink)</li>
<li>you can reuse the installer’s partition for swap</li>
</ul>

<p><hr></p>

<p>** Digital Ocean **<br>
<a href="http://do.co/bsdnow">http://do.co/bsdnow</a></p>

<p>###<a href="https://dataswamp.org/~solene/2018-06-26-openbsd-easy-backup.html">Easy encrypted backups on OpenBSD with base tools</a></p>

<blockquote>
<p>Today’s topic is “Encrypted backups” using only OpenBSD base tools. I am planning to write a bigger article later about backups but it’s a wide topic with a lot of software to cover and a lot of explanations about the differents uses cases, needs, issues an solutions. Here I will stick on explaining how to make reliable backups for an OpenBSD system (my laptop).<br>
What we need is the dump command (see man 8 dump for its man page). It’s an utility to make a backup for a filesystem, it can only make a backup of one filesystem at a time. On my laptop I only backup /home partition so this solution is suitable for me while still being easy.<br>
Dump can do incremental backups, it means that it will only save what changed since the last backup of lower level. If you do not understand this, please refer to the dump man page.<br>
What is very interesting with dump is that it honors nodump flag which is an extended attribute of a FFS filesystem. One can use the command chflags nodump /home/solene/Downloads to tells dump not do save that folder (under some circumstances). By default, dump will not save thoses files, EXCEPT for a level 0 backup.</p>
</blockquote>

<ul>
<li>Important features of this backup solution:</li>
<li>save files with attributes, permissions and flags</li>
<li>can recreate a partition from a dump, restore files interactively, from a list or from its inode number (useful when you have files in lost+found)</li>
<li>one dump = one file</li>
</ul>

<blockquote>
<p>My process is to make a huge dump of level 0 and keep it on a remote server, then, once a week I make a level 1 backup which will contain everything changed since the last dump of level 0, and everyday I do a level 2 backup of my files. The level 2 will contain latest files and the files changing a lot, which are often the most interesting. The level 1 backup is important because it will offload a lot of changes for the level 2.<br>
Let me explain: let says my full backup is 60 GB, full of pictures, sources files, GUI applications data files etc… A level 1 backup will contain every new picture, new projects, new GUI files etc… since the full backup, which will produce bigger and bigger dump over time, usually it is only 100 MB to 1GB. As I don’t add new pictures everyday or use new software everyday, the level 2 will take care of most littles changes to my data, like source code edited, little works on files etc… The level 2 backup is really small, I try to keep it under 50 MB so I can easily send it on my remote server everyday.<br>
One could you more dump level, up to level 9, but keep in mind that those are incremental. In my case, if I need to restore all my partition, I will need to use level 0, 1 and 2 to get up to latest backup state. If you want to restore a file deleted a few days ago, you need to remember in which level its latest version is.<br>
History note: dump was designed to be used with magnetic tapes.</p>
</blockquote>

<ul>
<li>See the article for the remainder of the article</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="http://lists.dragonflybsd.org/pipermail/users/2018-July/357809.html">Status of DFly server storage upgrades (Matt Dillon)</a></p>

<blockquote>
<p>Last month we did some storage upgrades, particularly of internet-facing machines for package and OS distribution.  Yesterday we did a number of additional upgrades, described below.  All using funds generously donated by everyone!</p>
</blockquote>

<blockquote>
<p>The main repository server received a 2TB SSD to replace the HDDs it was using before.  This will improve access to a number of things maintained by this server, including the mail archives, and gives the main repo server more breathing room for repository expansion.  Space was at a premium before.  Now there’s plenty.</p>
</blockquote>

<blockquote>
<p>Monster, the quad socket opteron which we currently use as the database builder and repository that we export to our public grok service (<a href="http://grok.dragonflybsd.org">grok.dragonflybsd.org</a>) received a 512G SSD to add swap space for swapcache, to help cache the grok meta-data.  It now has 600GB of swapcache configured.  Over the next few weeks we will also be changing the grok updates to ping-pong between the two 4TB data drives it received in the last upgrade so we can do concurrent updates and web accesses without them tripping over each other performance-wise.</p>
</blockquote>

<blockquote>
<p>The main developer box, Leaf, received a 2TB SSD and we are currently in the midst of migrating all the developer accounts in /home and /build from its old HDDs to its new SSD.  This machine serves developer repos, developer web stuff, our home page and wiki, etc, so those will become snappier as well.</p>
</blockquote>

<blockquote>
<p>Hard drives are becoming real dinosaurs.  We still have a few left from the old days but in terms of active use the only HDDs we feel we really need to keep now are the ones we use for backups and grok data, owing to the amount of storage needed for those functions.</p>
</blockquote>

<blockquote>
<p>Five years ago when we received the blade server that now sits in the colo, we had a small 256G SSD for root on every blade, and everything else used HDDs.  To make things operate smoothly, most of that 256G root SSD was assigned to swapcache (200G of it, in fact, in most cases).  Even just 2 years ago replacing all those HDDs with SSDs, even just the ones being used to actively serve data and support developers, would have been cost prohibitive.  But today it isn’t and the only HDDs we really need anywhere are for backups or certain very large bits of bulk data (aka the grok source repository and index).  The way things are going, even the backup drives will probably become SSDs over the next two years.</p>
</blockquote>

<p><hr></p>

<p>###iX ad spot<br>
<a href="https://www.ixsystems.com/blog/oscon2018/">OSCON 2018 Recap</a></p>

<p><hr></p>

<p>###<a href="http://oshogbo.vexillium.org/blog/46/">zpool checkpoints</a></p>

<blockquote>
<p>In March, to FreeBSD landed a very interesting feature called ‘zpool checkpoints’. Before we jump straight into the topic, let’s take a step back and look at another ZFS feature called ‘snapshot’. Snapshot allows us to create an image of our single file systems. This gives us the option to modify data on the dataset without the fear of losing some data.</p>
</blockquote>

<blockquote>
<p>A very good example of how to use ZFS snapshot is during an upgrade of database schema. Let us consider a situation where we have a few scripts which change our schema. Sometimes we are unable to upgrade in one transaction (for example, when we attempt to alter a table and then update it in single transaction). If our database is on dataset, we can just snapshot it, and if something goes wrong, simply rollback the file system to its previous state.</p>
</blockquote>

<blockquote>
<p>The problem with snapshot is that it works only on a single dataset. If we added some dataset, we wouldn’t then be able to create the snapshot which would rollback that operation. The same with changing the attributes of a dataset. If we change the compression on the dataset, we cannot rollback it. We would need to change that manually.</p>
</blockquote>

<blockquote>
<p>Another interesting problem involves upgrading the whole operating system when we upgrade system with a new ZFS version. What if we start upgrading our dataset and our kernel begins to crash? (If you use FreeBSD, I doubt you will ever have had that experience but still…). If we rollback to the old kernel, there is a chance the dataset will stop working because the new kernel doesn’t know how to use the new features.</p>
</blockquote>

<blockquote>
<p>Zpool checkpoints is the solution to all those problems. Instead of taking a single snapshot of the dataset, we can now take a snapshot of the whole pool. That means we will not only rollback the data but also all the metadata. If we rewind to the checkpoint, all our ZFS properties will be rolled back; the upgrade will be rolledback, and even the creation/deletion of the dataset, and the snapshot, will be rolledback.</p>
</blockquote>

<ul>
<li>Zpool Checkpoint has introduced a few simple functions:</li>
<li>For a creating checkpoint:</li>
</ul>

<p><code>zpool checkpoint &lt;pool&gt;</code></p>

<ul>
<li>Rollbacks state to checkpoint and remove the checkpoint:</li>
</ul>

<p><code>zpool import -- rewind-to-checkpoint &lt;pool&gt;</code></p>

<ul>
<li>Mount the pool read only - this does not rollback the data:</li>
</ul>

<p><code>zpool import --read-only=on --rewind-to-checkpoint</code></p>

<ul>
<li>Remove the checkpoint</li>
</ul>

<p><code>zpool checkpoint --discard &lt;pool&gt; or zpool checkpoint -d &lt;pool&gt;</code></p>

<ul>
<li>With this powerful feature we need to remember some safety rules:</li>
<li>Scrub will work only on data that isn’t in checkpool.</li>
<li>You can’t remove vdev if you have a checkpoint.</li>
<li>You can’t split mirror.</li>
<li>Reguid will not work either.</li>
<li>Create a checkpoint when one of the disks is removed…</li>
</ul>

<blockquote>
<p>For me, this feature is incredibly useful, especially when upgrading an operating system, or when I need to experiment with additional data sets. If you speak Polish, I have some additional information for you. During the first Polish BSD user group meeting, I had the opportunity to give a short talk about this feature. Here you find the video of that talk, and here is the slideshow.</p>
</blockquote>

<blockquote>
<p>I would like to offer my thanks to Serapheim Dimitropoulos for developing this feature, and for being so kind in sharing with me so many of its intricacies. If you are interested in knowing more about the technical details of this feature, you should check out Serapheim’s blog, and his video about checkpoints.</p>
</blockquote>

<p><hr></p>

<p>###g2k18 Reports</p>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180728110010">g2k18 hackathon report: Ingo Schwarze on sed(1) bugfixing with Martijn van Duren, and about other small userland stuff</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180726184322">g2k18 hackathon report: Kenneth Westerback on dhcpd(8) fixes, disklabel(8) refactoring and more</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180716193511">g2k18 Hackathon Report: Marc Espie on ports and packages progress</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180716202456">g2k18 hackathon report: Antoine Jacoutot on porting</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180717074543">g2k18 hackathon report: Matthieu Herrb on font caches and xenodm</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180718060313">g2k18 hackathon report: Florian Obser on rtadvd(8) -&gt; rad(8) progress (actually, rewrite)</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180719100833">g2k18 Hackathon Report: Klemens Nanni on improvements to route(8), pfctl(8), and mount(2)</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180721053002">g2k18 hackathon report: Carlos Cardenas on vmm/vmd progress, LACP</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180721053011">g2k18 hackathon report: Claudio Jeker on OpenBGPD developments</a></li>
<li><a href="https://i.imgur.com/3t3cJF6.jpg">Picture of the last day of the g2k18 hackathon in Ljubljana, Slovenia</a></li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.geeklan.co.uk/?p=2266">Something blogged (on pkgsrcCon 2018)</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files">GSoC 2018 Reports: Configuration files versioning in pkgsrc, Part 1</a></li>
<li><a href="https://bsd.network/@mulander/100390180499807877">There should be a global ‘awareness’ week for developers</a></li>
<li><a href="https://bsd-pl.org/en">Polish BSD User Group – Upcoming Meeting: Aug 9th 2018</a></li>
<li><a href="http://ukopenbsdusers.saneusergroup.org.uk/pipermail/uk-openbsd-users/2018-July/000430.html">London BSD User Group – Upcoming Meeting: Aug 14th 2018</a></li>
<li><a href="http://whyzfsisbetter.com/">Phillip Smith’s collection of reasons why ZFS is better so that he does not have to repeat<br>
himself all the time</a></li>
<li><a href="https://2018.eurobsdcon.org/registration-is-open/">EuroBSDCon 2018: Sept 20-23rd in Romania – Register NOW!</a></li>
<li><a href="https://www.meetbsd.com/call-for-papers/">MeetBSD 2018: Oct 19-20 in Santa Clara, California. Call for Papers closes on Aug 12</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Dale - <a href="http://dpaste.com/1K452Y7#wrap">L2ARC recommendations &amp; drive age question</a></li>
<li>Todd - <a href="http://dpaste.com/0WWHZ3E#wrap">ZFS &amp; S3</a></li>
<li>efraim - <a href="http://dpaste.com/36YP39B#wrap">License Poem</a></li>
<li>Henrick - <a href="http://dpaste.com/21D1KWA#wrap">Yet another ZFS question</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>NetBSD 8.0 available, FreeBSD on Scaleway’s ARM64 VPS, encrypted backups with OpenBSD, Dragonfly server storage upgrade, zpool checkpoints, g2k18 hackathon reports, and more.<br>
<hr></p>

<p>##Headlines<br>
###<a href="https://www.netbsd.org/releases/formal-8/NetBSD-8.0.html">NetBSD v8.0 Released</a></p>

<blockquote>
<p>The NetBSD Project is pleased to announce NetBSD 8.0, the sixteenth major release of the NetBSD operating system.</p>
</blockquote>

<blockquote>
<p>This release brings stability improvements, hundreds of bug fixes, and many new features.</p>
</blockquote>

<ul>
<li>
<p>Some highlights of the NetBSD 8.0 release are:</p>
</li>
<li>
<p>USB stack rework, USB3 support added.</p>
</li>
<li>
<p>In-kernel audio mixer (audio_system(9)).</p>
</li>
<li>
<p>Reproducible builds (MKREPRO, see mk.conf(5)).</p>
</li>
<li>
<p>Full userland debug information (MKDEBUG, see mk.conf(5)) available. While most install media do not come with them (for size reasons), the debug and xdebug sets can be downloaded and extracted as needed later. They provide full symbol information for all base system and X binaries and libraries and allow better error reporting and (userland) crash analysis.</p>
</li>
<li>
<p>PaX MPROTECT (W^X) memory protection enforced by default on some architectures with fine-grained memory protection and suitable ELF formats: i386, amd64, evbarm, landisk.</p>
</li>
<li>
<p>PaX ASLR (Address Space Layout Randomization) enabled by default on: i386, amd64, evbarm, landisk, sparc64.</p>
</li>
<li>
<p>Position independent executables by default for userland on: i386, amd64, arm, m68k, mips, sh3, sparc64.</p>
</li>
<li>
<p>A new socket layer can(4) has been added for communication of devices on a CAN bus.</p>
</li>
<li>
<p>A special pseudo interface ipsecif(4) for route-based VPNs has been added.</p>
</li>
<li>
<p>Parts of the network stack have been made MP-safe. The kernel option NET_MPSAFE is required to enable this.</p>
</li>
<li>
<p>Hardening of the network stack in general.</p>
</li>
<li>
<p>Various WAPBL (the NetBSD file system “log” option) stability and performance improvements.</p>
</li>
<li>
<p>Specific to i386 and amd64 CPUs:</p>
</li>
<li>
<p>Meltdown mitigation: SVS (Separate Virtual Space), enabled by default.</p>
</li>
<li>
<p>SpectreV2 mitigation: retpoline (support in gcc), used by default for kernels. Other hardware mitigations are also available.</p>
</li>
<li>
<p>SpectreV4 mitigations available for Intel and AMD.</p>
</li>
<li>
<p>PopSS workaround: user access to debug registers is turned off by default.</p>
</li>
<li>
<p>Lazy FPU saving disabled on vulnerable Intel CPUs (“eagerfpu”).</p>
</li>
<li>
<p>SMAP support.</p>
</li>
<li>
<p>Improvement and hardening of the memory layout: W^X, fewer writable pages, better consistency, better performance.</p>
</li>
<li>
<p>(U)EFI bootloader.</p>
</li>
<li>
<p>Many evbarm kernels now use FDT (flat device tree) information (loadable at boot time from an external file) for device configuration, the number of kernels has decreased but the number of boards has vastly increased.</p>
</li>
<li>
<p>Lots of updates to 3rd party software included:</p>
</li>
<li>
<p>GCC 5.5 with support for Address Sanitizer and Undefined Behavior Sanitizer</p>
</li>
<li>
<p>GDB 7.12</p>
</li>
<li>
<p>GNU binutils 2.27</p>
</li>
<li>
<p>Clang/LLVM 3.8.1</p>
</li>
<li>
<p>OpenSSH 7.6</p>
</li>
<li>
<p>OpenSSL 1.0.2k</p>
</li>
<li>
<p>mdocml 1.14.1</p>
</li>
<li>
<p>acpica 20170303</p>
</li>
<li>
<p>ntp 4.2.8p11-o</p>
</li>
<li>
<p>dhcpcd 7.0.6</p>
</li>
<li>
<p>Lua 5.3.4</p>
</li>
</ul>

<p><hr></p>

<p>###<a href="https://community.online.net/t/freebsd-on-arm64/6678">Running FreeBSD on the ARM64 VPS from Scaleway</a></p>

<blockquote>
<p>I’ve been thinking about this 6 since 2017, but only yesterday signed up for an account and played around with the ARM64 offering.<br>
Turns out it’s pretty great! KVM boots into UEFI, there’s a local VirtIO disk attached, no NBD junk required. So we can definitely run FreeBSD.<br>
I managed to “depenguinate” a running instance, the notes are below. Would be great if Scaleway offered an official image instead :wink:<br>
For some reason, unlike on x86 4, mounting additional volumes is not allowed 4 on ARM64 instances. So we’ll have to move the running Linux to a ramdisk using pivot_root and then we can do whatever to our one and only disk.<br>
Spin up an instance with Ubuntu Zesty and ssh in.</p>
</blockquote>

<ul>
<li>Prepare the system and change the root to a tmpfs:</li>
</ul>

<pre><code>apt install gdisk
mount -t tmpfs tmpfs /tmp
cp -r /bin /sbin /etc /dev /root /home /lib /run /usr /var /tmp
mkdir /tmp/proc /tmp/sys /tmp/oldroot
mount /dev/vda /tmp/oldroot
mount --make-rprivate /
pivot_root /tmp /tmp/oldroot
for i in dev proc sys run; do mount --move /oldroot/$i /$i; done
systemctl daemon-reload
systemctl restart sshd
</code></pre>

<blockquote>
<p>Now reconnect to ssh from a second terminal (note: rm the connection file if you use ControlPersist in ssh config), then exit the old session. Kill the old sshd process, restart or stop the rest of the stuff using the old disk:</p>
</blockquote>

<pre><code>pkill -f notty
sed -ibak 's/RefuseManualStart.*$//g' /lib/systemd/system/dbus.service
systemctl daemon-reload
systemctl restart dbus
systemctl daemon-reexec
systemctl stop user@0 ntp cron systemd-logind
systemctl restart systemd-journald systemd-udevd
pkill agetty
pkill rsyslogd
</code></pre>

<blockquote>
<p>Check that nothing is touching /oldroot:</p>
</blockquote>

<pre><code>lsof | grep oldroot
</code></pre>

<blockquote>
<p>There will probably be an old dbus-daemon, kill it.<br>
And finally, unmount the old root and overwrite the hard disk with a memstick image:</p>
</blockquote>

<pre><code>umount -R /oldroot
wget https://download.freebsd.org/ftp/snapshots/arm64/aarch64/ISO-IMAGES/12.0/FreeBSD-12.0-CURRENT-arm64-aarch64-20180719-r336479-mini-memstick.img.xz
xzcat FreeBSD-12.0-CURRENT-arm64-aarch64-20180719-r336479-mini-memstick.img.xz | dd if=/dev/stdin of=/dev/vda bs=1M
</code></pre>

<blockquote>
<p>(Look for the newest snapshot, don’t copy paste the July 19 link above if you’re reading this in the future. Actually maybe use a release instead of CURRENT…)<br>
Now, fix the GPT: move the secondary table to the end of the disk and resize the table.<br>
It’s important to resize here, as FreeBSD does not do that and silently creates partitions that won’t persist across reboots</p>
</blockquote>

<pre><code>gdisk /dev/vda
x
e
s
4
w
y
</code></pre>

<p>And reboot. (You might actually want to hard reboot here: for some reason on the first reboot from Linux, pressing the any-key to enter the prompt in the loader hangs the console for me.)</p>

<p>I didn’t have to go into the ESC menu and choose the local disk in the boot manager, it seems to boot from disk automatically.</p>

<p>Now we’re in the FreeBSD EFI loader.<br>
For some reason, the (recently fixed? 2) serial autodetection from EFI is not working correctly. Or something.<br>
So you don’t get console output by default.<br>
To fix, you have to run these commands in the boot loader command prompt:</p>

<pre><code>set console=comconsole,efi
boot
</code></pre>

<p>Ignore the warning about comconsole not being a valid console.<br>
Since there’s at least one (efi) that the loader thinks is valid, it sets the whole variable.)</p>

<p>(UPD: shouldn’t be necessary in the next snapshot)</p>

<p>Now it’s a regular installation process!<br>
When asked about partitioning, choose Shell, and manually add a partition and set up a root filesystem:</p>

<pre><code>gpart add -t freebsd-zfs -a 4k -l zroot vtbd0
zpool create -R /mnt -O mountpoint=none -O atime=off zroot /dev/gpt/zroot
zfs create -o canmount=off -o mountpoint=none zroot/ROOT
zfs create -o mountpoint=/ zroot/ROOT/default
zfs create -o mountpoint=/usr zroot/ROOT/default/usr
zfs create -o mountpoint=/var zroot/ROOT/default/var
zfs create -o mountpoint=/var/log zroot/ROOT/default/var/log
zfs create -o mountpoint=/usr/home zroot/home
zpool set bootfs=zroot/ROOT/default zroot
exit
</code></pre>

<p>(In this example, I set up ZFS with a beadm-compatible layout which allows me to use Boot Environments.)</p>

<p>In the post-install chroot shell, fix some configs like so:</p>

<pre><code>echo 'zfs_load=&quot;YES&quot;' &gt;&gt; /boot/loader.conf
echo 'console=&quot;comconsole,efi&quot;' &gt;&gt; /boot/loader.conf
echo 'vfs.zfs.arc_max=&quot;512M&quot;' &gt;&gt; /boot/loader.conf
sysrc zfs_enable=YES
exit
</code></pre>

<p>(Yeah, for some reason, the loader does not load zfs.ko’s dependency opensolaris.ko automatically here. idk what even. It does on my desktop and laptop.)</p>

<p>Now you can reboot into the installed system!!</p>

<p>Here’s how you can set up IPv6 (and root’s ssh key) auto configuration on boot:</p>

<pre><code>Pkg bootstrap
pkg install curl
curl https://raw.githubusercontent.com/scaleway/image-tools/master/bases/overlay-common/usr/local/bin/scw-metadata &gt; /usr/local/bin/scw-metadata
chmod +x /usr/local/bin/scw-metadata
echo '#\!/bin/sh' &gt; /etc/rc.local
echo 'PATH=/usr/local/bin:$PATH' &gt;&gt; /etc/rc.local
echo 'eval $(scw-metadata)' &gt;&gt; /etc/rc.local
echo 'echo $SSH_PUBLIC_KEYS_0_KEY &gt; /root/.ssh/authorized_keys' &gt;&gt; /etc/rc.local
echo 'chmod 0400 /root/.ssh/authorized_keys' &gt;&gt; /etc/rc.local
echo 'ifconfig vtnet0 inet6 $IPV6_ADDRESS/$IPV6_NETMASK' &gt;&gt; /etc/rc.local
echo 'route -6 add default $IPV6_GATEWAY' &gt;&gt; /etc/rc.local
mkdir /run
mkdir /root/.ssh
sh /etc/rc.local
</code></pre>

<blockquote>
<p>And to fix incoming TCP connections, configure the DHCP client to change the broadcast address:</p>
</blockquote>

<p><code>echo 'interface &quot;vtnet0&quot; { supersede broadcast-address 255.255.255.255; }' &gt;&gt; /etc/dhclient.conf</code><br>
<code>killall dhclient</code><br>
<code>dhclient vtnet0</code></p>

<ul>
<li>Other random notes:</li>
<li>keep in mind that -CURRENT snapshots come with a debugging kernel by default, which limits syscall performance by a lot, you might want to build your own 2 with config GENERIC-NODEBUG</li>
<li>also disable heavy malloc debugging features by running ln -s ‘abort:false,junk:false’ /etc/malloc.conf (yes that’s storing config in a symlink)</li>
<li>you can reuse the installer’s partition for swap</li>
</ul>

<p><hr></p>

<p>** Digital Ocean **<br>
<a href="http://do.co/bsdnow">http://do.co/bsdnow</a></p>

<p>###<a href="https://dataswamp.org/~solene/2018-06-26-openbsd-easy-backup.html">Easy encrypted backups on OpenBSD with base tools</a></p>

<blockquote>
<p>Today’s topic is “Encrypted backups” using only OpenBSD base tools. I am planning to write a bigger article later about backups but it’s a wide topic with a lot of software to cover and a lot of explanations about the differents uses cases, needs, issues an solutions. Here I will stick on explaining how to make reliable backups for an OpenBSD system (my laptop).<br>
What we need is the dump command (see man 8 dump for its man page). It’s an utility to make a backup for a filesystem, it can only make a backup of one filesystem at a time. On my laptop I only backup /home partition so this solution is suitable for me while still being easy.<br>
Dump can do incremental backups, it means that it will only save what changed since the last backup of lower level. If you do not understand this, please refer to the dump man page.<br>
What is very interesting with dump is that it honors nodump flag which is an extended attribute of a FFS filesystem. One can use the command chflags nodump /home/solene/Downloads to tells dump not do save that folder (under some circumstances). By default, dump will not save thoses files, EXCEPT for a level 0 backup.</p>
</blockquote>

<ul>
<li>Important features of this backup solution:</li>
<li>save files with attributes, permissions and flags</li>
<li>can recreate a partition from a dump, restore files interactively, from a list or from its inode number (useful when you have files in lost+found)</li>
<li>one dump = one file</li>
</ul>

<blockquote>
<p>My process is to make a huge dump of level 0 and keep it on a remote server, then, once a week I make a level 1 backup which will contain everything changed since the last dump of level 0, and everyday I do a level 2 backup of my files. The level 2 will contain latest files and the files changing a lot, which are often the most interesting. The level 1 backup is important because it will offload a lot of changes for the level 2.<br>
Let me explain: let says my full backup is 60 GB, full of pictures, sources files, GUI applications data files etc… A level 1 backup will contain every new picture, new projects, new GUI files etc… since the full backup, which will produce bigger and bigger dump over time, usually it is only 100 MB to 1GB. As I don’t add new pictures everyday or use new software everyday, the level 2 will take care of most littles changes to my data, like source code edited, little works on files etc… The level 2 backup is really small, I try to keep it under 50 MB so I can easily send it on my remote server everyday.<br>
One could you more dump level, up to level 9, but keep in mind that those are incremental. In my case, if I need to restore all my partition, I will need to use level 0, 1 and 2 to get up to latest backup state. If you want to restore a file deleted a few days ago, you need to remember in which level its latest version is.<br>
History note: dump was designed to be used with magnetic tapes.</p>
</blockquote>

<ul>
<li>See the article for the remainder of the article</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="http://lists.dragonflybsd.org/pipermail/users/2018-July/357809.html">Status of DFly server storage upgrades (Matt Dillon)</a></p>

<blockquote>
<p>Last month we did some storage upgrades, particularly of internet-facing machines for package and OS distribution.  Yesterday we did a number of additional upgrades, described below.  All using funds generously donated by everyone!</p>
</blockquote>

<blockquote>
<p>The main repository server received a 2TB SSD to replace the HDDs it was using before.  This will improve access to a number of things maintained by this server, including the mail archives, and gives the main repo server more breathing room for repository expansion.  Space was at a premium before.  Now there’s plenty.</p>
</blockquote>

<blockquote>
<p>Monster, the quad socket opteron which we currently use as the database builder and repository that we export to our public grok service (<a href="http://grok.dragonflybsd.org">grok.dragonflybsd.org</a>) received a 512G SSD to add swap space for swapcache, to help cache the grok meta-data.  It now has 600GB of swapcache configured.  Over the next few weeks we will also be changing the grok updates to ping-pong between the two 4TB data drives it received in the last upgrade so we can do concurrent updates and web accesses without them tripping over each other performance-wise.</p>
</blockquote>

<blockquote>
<p>The main developer box, Leaf, received a 2TB SSD and we are currently in the midst of migrating all the developer accounts in /home and /build from its old HDDs to its new SSD.  This machine serves developer repos, developer web stuff, our home page and wiki, etc, so those will become snappier as well.</p>
</blockquote>

<blockquote>
<p>Hard drives are becoming real dinosaurs.  We still have a few left from the old days but in terms of active use the only HDDs we feel we really need to keep now are the ones we use for backups and grok data, owing to the amount of storage needed for those functions.</p>
</blockquote>

<blockquote>
<p>Five years ago when we received the blade server that now sits in the colo, we had a small 256G SSD for root on every blade, and everything else used HDDs.  To make things operate smoothly, most of that 256G root SSD was assigned to swapcache (200G of it, in fact, in most cases).  Even just 2 years ago replacing all those HDDs with SSDs, even just the ones being used to actively serve data and support developers, would have been cost prohibitive.  But today it isn’t and the only HDDs we really need anywhere are for backups or certain very large bits of bulk data (aka the grok source repository and index).  The way things are going, even the backup drives will probably become SSDs over the next two years.</p>
</blockquote>

<p><hr></p>

<p>###iX ad spot<br>
<a href="https://www.ixsystems.com/blog/oscon2018/">OSCON 2018 Recap</a></p>

<p><hr></p>

<p>###<a href="http://oshogbo.vexillium.org/blog/46/">zpool checkpoints</a></p>

<blockquote>
<p>In March, to FreeBSD landed a very interesting feature called ‘zpool checkpoints’. Before we jump straight into the topic, let’s take a step back and look at another ZFS feature called ‘snapshot’. Snapshot allows us to create an image of our single file systems. This gives us the option to modify data on the dataset without the fear of losing some data.</p>
</blockquote>

<blockquote>
<p>A very good example of how to use ZFS snapshot is during an upgrade of database schema. Let us consider a situation where we have a few scripts which change our schema. Sometimes we are unable to upgrade in one transaction (for example, when we attempt to alter a table and then update it in single transaction). If our database is on dataset, we can just snapshot it, and if something goes wrong, simply rollback the file system to its previous state.</p>
</blockquote>

<blockquote>
<p>The problem with snapshot is that it works only on a single dataset. If we added some dataset, we wouldn’t then be able to create the snapshot which would rollback that operation. The same with changing the attributes of a dataset. If we change the compression on the dataset, we cannot rollback it. We would need to change that manually.</p>
</blockquote>

<blockquote>
<p>Another interesting problem involves upgrading the whole operating system when we upgrade system with a new ZFS version. What if we start upgrading our dataset and our kernel begins to crash? (If you use FreeBSD, I doubt you will ever have had that experience but still…). If we rollback to the old kernel, there is a chance the dataset will stop working because the new kernel doesn’t know how to use the new features.</p>
</blockquote>

<blockquote>
<p>Zpool checkpoints is the solution to all those problems. Instead of taking a single snapshot of the dataset, we can now take a snapshot of the whole pool. That means we will not only rollback the data but also all the metadata. If we rewind to the checkpoint, all our ZFS properties will be rolled back; the upgrade will be rolledback, and even the creation/deletion of the dataset, and the snapshot, will be rolledback.</p>
</blockquote>

<ul>
<li>Zpool Checkpoint has introduced a few simple functions:</li>
<li>For a creating checkpoint:</li>
</ul>

<p><code>zpool checkpoint &lt;pool&gt;</code></p>

<ul>
<li>Rollbacks state to checkpoint and remove the checkpoint:</li>
</ul>

<p><code>zpool import -- rewind-to-checkpoint &lt;pool&gt;</code></p>

<ul>
<li>Mount the pool read only - this does not rollback the data:</li>
</ul>

<p><code>zpool import --read-only=on --rewind-to-checkpoint</code></p>

<ul>
<li>Remove the checkpoint</li>
</ul>

<p><code>zpool checkpoint --discard &lt;pool&gt; or zpool checkpoint -d &lt;pool&gt;</code></p>

<ul>
<li>With this powerful feature we need to remember some safety rules:</li>
<li>Scrub will work only on data that isn’t in checkpool.</li>
<li>You can’t remove vdev if you have a checkpoint.</li>
<li>You can’t split mirror.</li>
<li>Reguid will not work either.</li>
<li>Create a checkpoint when one of the disks is removed…</li>
</ul>

<blockquote>
<p>For me, this feature is incredibly useful, especially when upgrading an operating system, or when I need to experiment with additional data sets. If you speak Polish, I have some additional information for you. During the first Polish BSD user group meeting, I had the opportunity to give a short talk about this feature. Here you find the video of that talk, and here is the slideshow.</p>
</blockquote>

<blockquote>
<p>I would like to offer my thanks to Serapheim Dimitropoulos for developing this feature, and for being so kind in sharing with me so many of its intricacies. If you are interested in knowing more about the technical details of this feature, you should check out Serapheim’s blog, and his video about checkpoints.</p>
</blockquote>

<p><hr></p>

<p>###g2k18 Reports</p>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180728110010">g2k18 hackathon report: Ingo Schwarze on sed(1) bugfixing with Martijn van Duren, and about other small userland stuff</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180726184322">g2k18 hackathon report: Kenneth Westerback on dhcpd(8) fixes, disklabel(8) refactoring and more</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180716193511">g2k18 Hackathon Report: Marc Espie on ports and packages progress</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180716202456">g2k18 hackathon report: Antoine Jacoutot on porting</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180717074543">g2k18 hackathon report: Matthieu Herrb on font caches and xenodm</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180718060313">g2k18 hackathon report: Florian Obser on rtadvd(8) -&gt; rad(8) progress (actually, rewrite)</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180719100833">g2k18 Hackathon Report: Klemens Nanni on improvements to route(8), pfctl(8), and mount(2)</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180721053002">g2k18 hackathon report: Carlos Cardenas on vmm/vmd progress, LACP</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180721053011">g2k18 hackathon report: Claudio Jeker on OpenBGPD developments</a></li>
<li><a href="https://i.imgur.com/3t3cJF6.jpg">Picture of the last day of the g2k18 hackathon in Ljubljana, Slovenia</a></li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.geeklan.co.uk/?p=2266">Something blogged (on pkgsrcCon 2018)</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files">GSoC 2018 Reports: Configuration files versioning in pkgsrc, Part 1</a></li>
<li><a href="https://bsd.network/@mulander/100390180499807877">There should be a global ‘awareness’ week for developers</a></li>
<li><a href="https://bsd-pl.org/en">Polish BSD User Group – Upcoming Meeting: Aug 9th 2018</a></li>
<li><a href="http://ukopenbsdusers.saneusergroup.org.uk/pipermail/uk-openbsd-users/2018-July/000430.html">London BSD User Group – Upcoming Meeting: Aug 14th 2018</a></li>
<li><a href="http://whyzfsisbetter.com/">Phillip Smith’s collection of reasons why ZFS is better so that he does not have to repeat<br>
himself all the time</a></li>
<li><a href="https://2018.eurobsdcon.org/registration-is-open/">EuroBSDCon 2018: Sept 20-23rd in Romania – Register NOW!</a></li>
<li><a href="https://www.meetbsd.com/call-for-papers/">MeetBSD 2018: Oct 19-20 in Santa Clara, California. Call for Papers closes on Aug 12</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Dale - <a href="http://dpaste.com/1K452Y7#wrap">L2ARC recommendations &amp; drive age question</a></li>
<li>Todd - <a href="http://dpaste.com/0WWHZ3E#wrap">ZFS &amp; S3</a></li>
<li>efraim - <a href="http://dpaste.com/36YP39B#wrap">License Poem</a></li>
<li>Henrick - <a href="http://dpaste.com/21D1KWA#wrap">Yet another ZFS question</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 256: Because Computers | BSD Now 2^8</title>
  <link>https://www.bsdnow.tv/256</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2304</guid>
  <pubDate>Wed, 25 Jul 2018 01:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d5ca53c5-7144-4ce4-9189-591a8ac5767b.mp3" length="63008930" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD ULE vs. Linux CFS, OpenBSD on Tuxedo InfinityBook, how zfs diff reports filenames efficiently, why choose FreeBSD over Linux, PS4 double free exploit, OpenBSD’s wifi autojoin, and FreeBSD jails the hard way.</itunes:subtitle>
  <itunes:duration>1:44:42</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD ULE vs. Linux CFS, OpenBSD on Tuxedo InfinityBook, how zfs diff reports filenames efficiently, why choose FreeBSD over Linux, PS4 double free exploit, OpenBSD’s wifi autojoin, and FreeBSD jails the hard way.
Win
Celebrate our 256th episode with us. You can win a Mogics Power Bagel (not sponsored).
To enter, go find the 4 episodes we did in December of 2017. In the opening, find the 4 letters in the bookshelf behind me. They spell different words in each of the 4 episodes. Send us these words in order to feedback@bsdnow.tv with the subject “bsdnow256” until August 8th, 2018 18:00 UTC and we’ll randomly draw the winner on the live show. We’ll then contact you to ship the item.
Only one item to win. All decisions are final. Better luck next time.
Headlines
Battle of the Schedulers: FreeBSD ULE vs. Linux CFS
Introduction
This paper analyzes the impact on application performance of the design and implementation choices made in two widely used open-source schedulers: ULE, the default FreeBSD scheduler, and CFS, the default Linux scheduler. We compare ULE and CFS in otherwise identical circumstances. We have ported ULE to Linux, and use it to schedule all threads that are normally scheduled by CFS. We compare the performance of a large suite of applications on the modified kernel running ULE and on the standard Linux kernel running CFS. The observed performance differences are solely the result of scheduling decisions, and do not reflect differences in other subsystems between FreeBSD and Linux. There is no overall winner. On many workloads the two schedulers perform similarly, but for some workloads there are significant and even surprising differences. ULE may cause starvation, even when executing a single application with identical threads, but this starvation may actually lead to better application performance for some workloads. The more complex load balancing mechanism of CFS reacts more quickly to workload changes, but ULE achieves better load balance in the long run.
Operating system kernel schedulers are responsible for maintaining high utilization of hardware resources (CPU cores, memory, I/O devices) while providing fast response time to latency-sensitive applications. They have to react to workload changes, and handle large numbers of cores and threads with minimal overhead [12]. This paper provides a comparison between the default schedulers of two of the most widely deployed open-source operating systems: the Completely Fair Scheduler (CFS) used in Linux, and the ULE scheduler used in FreeBSD. Our goal is not to declare an overall winner.
In fact, we find that for some workloads ULE is better and for others CFS is better. Instead, our goal is to illustrate how differences in the design and the implementation of the two schedulers are reflected in application performance under different workloads. ULE and CFS are both designed to schedule large numbers of threads on large multicore machines. Scalability considerations have led both schedulers to adopt per-core run-queues. On a context switch, a core accesses only its local run-queue to find the next thread to run. Periodically and at select times, e.g., when a thread wakes up, both ULE and CFS perform load balancing, i.e., they try to balance the amount of work waiting in the run-queues of different cores.
ULE and CFS, however, differ greatly in their design and implementation choices. FreeBSD ULE is a simple scheduler (2,950 lines of code in FreeBSD 11.1), while Linux CFS is much more complex (17,900 lines of code in the latest LTS Linux kernel, Linux 4.9). FreeBSD run-queues are FIFO. For load balancing, FreeBSD strives to even out the number of threads per core. In Linux, a core decides which thread to run next based on prior execution time, priority, and perceived cache behavior of the threads in its runqueue. Instead of evening out the number of threads between cores, Linux strives to even out the average amount of pending work.
Performance analysis
We now analyze the impact of the per-core scheduling on the performance of 37 applications. We define “performance” as follows: for database workloads and NAS applications, we compare the number of operations per second, and for the other applications we compare “execution time”. The higher the “performance”, the better a scheduler performs. Figure 5 presents the performance difference between CFS and ULE on a single core, with percentages above 0 meaning that the application executes faster with ULE than CFS.
Overall, the scheduler has little influence on most workloads. Indeed, most applications use threads that all perform the same work, thus both CFS and ULE endup scheduling all of the threads in a round-robin fashion. The average performance difference is 1.5%, in favor of ULE. Still, scimark is 36% slower on ULE than CFS, and apache is 40% faster on ULE than CFS. Scimark is a single-threaded Java application. It launches one compute thread, and the Java runtime executes other Java system threads in the background (for the garbage collector, I/O, etc.).
When the application is executed with ULE, the compute thread can be delayed, because Java system threads are considered interactive and get priority over the computation thread. The apache workload consists of two applications: the main server (httpd) running 100 threads, and ab, a single-threaded load injector.
The performance difference between ULE and CFS is explained by different choices regarding thread preemption. In ULE, full preemption is disabled, while CFS preempts the running thread when the thread that has just been woken up has a vruntime that is much smaller than the vruntime of the currently executing thread (1ms difference in practice). In CFS, ab is preempted 2 million times during the benchmark, while it never preempted with ULE.
This behavior is explained as follows: ab starts by sending 100 requests to the httpd server, and then waits for the server to answer. When ab is woken up, it checks which requests have been processed and sends new requests to the server. Since ab is single-threaded, all requests sent to the server are sent sequentially. In ULE, ab is able to send as many new requests as it has received responses. In CFS, every request sent by ab wakes up a httpd thread, which preempts ab.
Conclusion
Scheduling threads on a multicore machine is hard. In this paper, we perform a fair comparison of the design choices of two widely used schedulers: the ULE scheduler from FreeBSD and CFS from Linux. We show that they behave differently even on simple workloads, and that no scheduler performs better than the other on all workloads.
OpenBSD 6.3 on Tuxedo InfinityBook
Disclaimer:
I came across the Tuxedo Computers InfinityBook last year at the Open! Conference where Tuxedo had a small booth. Previously they came to my attention since they’re a member of the OSB Alliance on whose board I’m a member. Furthermore Tuxedo Computers are a sponsor of the OSBAR which I’m part of the organizational team.
OpenBSD on the Tuxedo InfinityBook
I’ve asked the guys over at Tuxedo Computers whether they would be interested to have some tests with *BSD done and that I could test drive one of their machines and give feedback on what works and what does not - and possibly look into it.+
Within a few weeks they shipped me a machine and last week the InfinityBook Pro 14” arrived. Awesome. Thanks already to the folks at Tuxedo Computers. The machine arrived accompanied by lot’s of swag :)
The InfinityBook is a very nice machine and allows a wide range of configuration. The configuration that was shipped to me:
Intel Core i7-8550U
1x 16GB RAM 2400Mhz Crucial Ballistix Sport LT
250 GB Samsung 860 EVO (M.2 SATAIII)
I used a USB-stick to boot install63.fs and re-installed the machine with OpenBSD. Full dmesg.
The installation went flawlessly, the needed intel firmware is being installed after installation automatically via fw_update(1).
Out of the box the graphics works and once installed the machine presents the login.
Video
When X starts the display is turned off for some reason. You will need to hit fn+f12 (the key with the moon on it) then the display will go on. Aside from that little nit, X works just fine and presents one the expected resolution.
External video is working just fine as well. Either via hdmi output or via the mini displayport connector.
The buttons for adjusting brightness (fn+f8 and fn+f9) are not working. Instead one has to use wsconsctl(8) to adjust the brightness.
Networking
The infinityBook has built-in ethernet, driven by re(4) And for the wireless interface the iwm(4) driver is being used. Both work as expected.
ACPI
Neither suspend nor hibernate work. Reporting of battery status is bogus as well. Some of the keyboard function keys work:
LCD on/off works (fn+f2)
Keyboard backlight dimming works (fn+f4)
Volume (fn+f5 / fn+f6) works
Sound
The azalia chipset is being used for audio processing. Works as expected, volume can be controlled via buttons (fn+f5, fn+f6) or via mixerctl.
Touchpad
Can be controlled via wsconsctl(8).
So far I must say, that the InfinityBook makes a nice machine - and I’m enjoying working with it.
iXsystems
iXsystems - Its all NAS
How ZFS makes things like ‘zfs diff’ report filenames efficiently
As a copy on write (file)system, ZFS can use the transaction group (txg) numbers that are embedded in ZFS block pointers to efficiently find the differences between two txgs; this is used in, for example, ZFS bookmarks. However, as I noted at the end of my entry on block pointers, this doesn’t give us a filesystem level difference; instead, it essentially gives us a list of inodes (okay, dnodes) that changed.
In theory, turning an inode or dnode number into the path to a file is an expensive operation; you basically have to search the entire filesystem until you find it. In practice, if you’ve ever run ‘zfs diff’, you’ve likely noticed that it runs pretty fast. Nor is this the only place that ZFS quickly turns dnode numbers into full paths, as it comes up in ‘zpool status’ reports about permanent errors. At one level, zfs diff and zpool status do this so rapidly because they ask the ZFS code in the kernel to do it for them. At another level, the question is how the kernel’s ZFS code can be so fast.
The interesting and surprising answer is that ZFS cheats, in a way that makes things very fast when it works and almost always works in normal filesystems and with normal usage patterns. The cheat is that ZFS dnodes record their parent’s object number.
If you’re familiar with the twists and turns of Unix filesystems, you’re now wondering how ZFS deals with hardlinks, which can cause a file to be in several directories at once and so have several parents (and then it can be removed from some of the directories). The answer is that ZFS doesn’t; a dnode only ever tracks a single parent, and ZFS accepts that this parent information can be inaccurate. I’ll quote the comment in zfsobjto_pobj:
When a link is removed [the file’s] parent pointer is not changed and will be invalid. There are two cases where a link is removed but the file stays around, when it goes to the delete queue and when there are additional links.
Before I get into the details, I want to say that I appreciate the brute force elegance of this cheat. The practical reality is that most Unix files today don’t have extra hardlinks, and when they do most hardlinks are done in ways that won’t break ZFS’s parent stuff. The result is that ZFS has picked an efficient implementation that works almost all of the time; in my opinion, the great benefit we get from having it around are more than worth the infrequent cases where it fails or malfunctions. Both zfs diff and having filenames show up in zpool status permanent error reports are very useful (and there may be other cases where this gets used).
The current details are that any time you hardlink a file to somewhere or rename it, ZFS updates the file’s parent to point to the new directory. Often this will wind up with a correct parent even after all of the dust settles; for example, a common pattern is to write a file to an initial location, hardlink it to its final destination, and then remove the initial location version. In this case, the parent will be correct and you’ll get the right name.
News Roundup
What is FreeBSD? Why Should You Choose It Over Linux?
Not too long ago I wondered if and in what situations FreeBSD could be faster than Linux and we received a good amount of informative feedback. So far, Linux rules the desktop space and FreeBSD rules the server space.
In the meantime, though, what exactly is FreeBSD? And at what times should you choose it over a GNU/Linux installation? Let’s tackle these questions.
FreeBSD is a free and open source derivative of BSD (Berkeley Software Distribution) with a focus on speed, stability, security, and consistency, among other features. It has been developed and maintained by a large community ever since its initial release many years ago on November 1, 1993.
BSD is the version of UNIX® that was developed at the University of California in Berkeley. And being a free and open source version, “Free” being a prefix to BSD is a no-brainer.
What’s FreeBSD Good For?
FreeBSD offers a plethora of advanced features and even boasts some not available in some commercial Operating Systems. It makes an excellent Internet and Intranet server thanks to its robust network services that allow it to maximize memory and work with heavy loads to deliver and maintain good response times for thousands of simultaneous user processes.
FreeBSD runs a huge number of applications with ease. At the moment, it has over 32,000 ported applications and libraries with support for desktop, server, and embedded environments. with that being said, let me also add that FreeBSD is excellent for working with advanced embedded platforms. Mail and web appliances, timer servers, routers, MIPS hardware platforms, etc. You name it!
FreeBSD is available to install in several ways and there are directions to follow for any method you want to use; be it via CD-ROM, over a network using NFS or FTP, or DVD.
FreeBSD is easy to contribute to and all you have to do is to locate the section of the FreeBSD code base to modify and carefully do a neat job. Potential contributors are also free to improve on its artwork and documentation, among other project aspects.
FreeBSD is backed by the FreeBSD Foundation, a non-profit organization that you can contribute to financially and all direct contributions are tax deductible.
FreeBSD’s license allows users to incorporate the use of proprietary software which is ideal for companies interested in generating revenues. Netflix, for example, could cite this as one of the reasons for using FreeBSD servers.
Why Should You Choose It over Linux?
From what I’ve gathered about both FreeBSD and Linux, FreeBSD has a better performance on servers than Linux does. Yes, its packaged applications are configured to offer better a performance than Linux and it is usually running fewer services by default, there really isn’t a way to certify which is faster because the answer is dependent on the running hardware and applications and how the system is tuned.
FreeBSD is reportedly more secure than Linux because of the way the whole project is developed and maintained.
Unlike with Linux, the FreeBSD project is controlled by a large community of developers around the world who fall into any of these categories; core team, contributors, and committers.
FreeBSD is much easier to learn and use because there aren’t a thousand and one distros to choose from with different package managers, DEs, etc.
FreeBSD is more convenient to contribute to because it is the entire OS that is preserved and not just the kernel and a repo as is the case with Linux. You can easily access all of its versions since they are sorted by release numbers.
Apart from the many documentations and guides that you can find online, FreeBSD has a single official documentation wherein you can find the solution to virtually any issue you will come across. So, you’re sure to find it resourceful.
FreeBSD has close to no software issues compared to Linux because it has Java, is capable of running Windows programs using Wine, and can run .NET programs using Mono.
FreeBSD’s ports/packages system allows you to compile software with specific configurations, thereby avoiding conflicting dependency and version issues.
Both the FreeBSD and GNU/Linux project are always receiving updates. The platform you decide to go with is largely dependent on what you want to use it for, your technical know-how, willingness to learn new stuff, and ultimately your preference.
What is your take on the topic? For what reasons would you choose FreeBSD over Linux if you would? Let us know what you think about both platforms in the comments section below.
PS4 5.05 BPF Double Free Kernel Exploit Writeup
Introduction
Welcome to the 5.0x kernel exploit write-up. A few months ago, a kernel vulnerability was discovered by qwertyoruiopz and an exploit was released for BPF which involved crafting an out-of-bounds (OOB) write via use-after-free (UAF) due to the lack of proper locking. It was a fun bug, and a very trivial exploit. Sony then removed the write functionality from BPF, so that exploit was patched. However, the core issue still remained (being the lack of locking). A very similar race condition still exists in BPF past 4.55, which we will go into detail below on. The full source of the exploit can be found here.
This bug is no longer accessible however past 5.05 firmware, because the BPF driver has finally been blocked from unprivileged processes - WebKit can no longer open it. Sony also introduced a new security mitigation in 5.0x firmwares to prevent the stack pointer from pointing into user space, however we’ll go more in detail on this a bit further down.
Assumptions
Some assumptions are made of the reader’s knowledge for the writeup. The avid reader should have a basic understanding of how memory allocators work - more specifically, how malloc() and free() allocate and deallocate memory respectively. They should also be aware that devices can be issued commands concurrently, as in, one command could be received while another one is being processed via threading. An understanding of C, x86, and exploitation basics is also very helpful, though not necessarily required.
Background
This section contains some helpful information to those newer to exploitation, or are unfamiliar with device drivers, or various exploit techniques such as heap spraying and race conditions. Feel free to skip to the “A Tale of Two Free()'s” section if you’re already familiar with this material.
What Are Drivers?
There are a few ways that applications can directly communicate with the operating system. One of which is system calls, which there are over 600 of in the PS4 kernel, ~500 of which are FreeBSD - the rest are Sony-implemented. Another method is through something called “Device Drivers”. Drivers are typically used to bridge the gap between software and hardware devices (usb drives, keyboard/mouse, webcams, etc) - though they can also be used just for software purposes.
There are a few operations that a userland application can perform on a driver (if it has sufficient permissions) to interface with it after opening it. In some instances, one can read from it, write to it, or in some cases, issue more complex commands to it via the ioctl() system call. The handlers for these commands are implemented in kernel space - this is important, because any bugs that could be exploited in an ioctl handler can be used as a privilege escalation straight to ring0 - typically the most privileged state.
Drivers are often the more weaker points of an operating system for attackers, because sometimes these drivers are written by developers who don’t understand how the kernel works, or the drivers are older and thus not wise to newer attack methods.
The BPF Device Driver
If we take a look around inside of WebKit’s sandbox, we’ll find a /dev directory. While this may seem like the root device driver path, it’s a lie. Many of the drivers that the PS4 has are not exposed to this directory, but rather only ones that are needed for WebKit’s operation (for the most part). For some reason though, BPF (aka. the “Berkely Packet Filter”) device is not only exposed to WebKit’s sandbox - it also has the privileges to open the device as R/W. This is very odd, because on most systems this driver is root-only (and for good reason). If you want to read more into this, refer to my previous write-up with 4.55FW.
What Are Packet Filters?
Below is an excerpt from the 4.55 bpfwrite writeup.
Since the bug is directly in the filter system, it is important to know the basics of what packet filters are. Filters are essentially sets of pseudo-instructions that are parsed by bpf_filter() (which are ran when packets are received). While the pseudo-instruction set is fairly minimal, it allows you to do things like perform basic arithmetic operations and copy values around inside it’s buffer. Breaking down the BPF VM in it’s entirety is far beyond the scope of this write-up, just know that the code produced by it is ran in kernel mode - this is why read/write access to /dev/bpf should be privileged.
Race Conditions
Race conditions occur when two processes/threads try to access a shared resource at the same time without mutual exclusion. The problem was ultimately solved by introducing concepts such as the “mutex” or “lock”. The idea is when one thread/process tries to access a resource, it will first acquire a lock, access it, then unlock it once it’s finished. If another thread/process tries to access it while the other has the lock, it will wait until the other thread is finished. This works fairly well - when it’s used properly.
Locking is hard to get right, especially when you try to implement fine-grained locking for performance. One single instruction or line of code outside the locking window could introduce a race condition. Not all race conditions are exploitable, but some are (such as this one) - and they can give an attacker very powerful bugs to work with.
Heap Spraying
The process of heap spraying is fairly simple - allocate a bunch of memory and fill it with controlled data in a loop and pray your allocation doesn’t get stolen from underneath you. It’s a very useful technique when exploiting something such as a use-after-free(), as you can use it to get controlled data into your target object’s backing memory.
By extension, it’s useful to do this for a double free() as well, because once we have a stale reference, we can use a heap spray to control the data. Since the object will be marked “free” - the allocator will eventually provide us with control over this memory, even though something else is still using it. That is, unless, something else has already stolen the pointer from you and corrupts it - then you’ll likely get a system crash, and that’s no fun. This is one factor that adds to the variance of exploits, and typically, the smaller the object, the more likely this is to happen.
Follow the link to read more of the article
DigitalOcean
http://do.co/bsdnow
OpenBSD gains Wi-Fi “auto-join”
In a change which is bound to be welcomed widely, -current has gained “auto-join” for Wi-Fi networks. Peter Hessler (phessler@) has been working on this for quite some time and he wrote about it in his p2k18 hackathon report. He has committed the work from the g2k18 hackathon in Ljubljana:
CVSROOT:    /cvs
Module name:    src
Changes by: phessler@cvs.openbsd.org    2018/07/11 14:18:09
Modified files:
    sbin/ifconfig  : ifconfig.8 ifconfig.c 
    sys/net80211   : ieee80211ioctl.c ieee80211ioctl.h 
                     ieee80211node.c ieee80211node.h 
                     ieee80211_var.h 
Log message:
Introduce 'auto-join' to the wifi 802.11 stack.
This allows a system to remember which ESSIDs it wants to connect to, any
relevant security configuration, and switch to it when the network we are
currently connected to is no longer available.
Works when connecting and switching between WPA2/WPA1/WEP/clear encryptions.
example hostname.if:
join home wpakey password
join work wpakey mekmitasdigoat
join open-lounge
join cafe wpakey cafe2018
join "wepnetwork" nwkey "12345"
dhcp
inet6 autoconf
up
OK stsp@ reyk@
and enthusiasm from every hackroom I've been in for the last 3 years
The usage should be clear from the commit message, but basically you ‘join’ all the networks you want to auto-join as you would previously use ‘nwid’ to connect to one specific network. Then the kernel will join the network that’s actually in range and do the rest automagically for you. When you move out of range of that network you lose connectivity until you come in range of the original (where things will continue to work as you’ve been used to) or one of the other networks (where you will associate and then get a new lease).
Thanks to Peter for working on this feature - something many a Wi-Fi using OpenBSD user will be able to benefit from.
FreeBSD Jails the hard way
There are many great options for managing FreeBSD Jails. iocage, warden and ez-jail aim to streamline the process and make it quick an easy to get going. But sometimes the tools built right into the OS are overlooked.
This post goes over what is involved in creating and managing jails using only the tools built into FreeBSD.
For this guide, I’m going to be putting my jails in /usr/local/jails.
I’ll start with a very simple, isolated jail. Then I’ll go over how to use ZFS snapshots, and lastly nullfs mounts to share the FreeBSD base files with multiple jails.
I’ll also show some examples of how to use the templating power of jail.conf to apply similar settings to all your jails.
Full Jail
Make a directory for the jail, or a zfs dataset if you prefer.
Download the FreeBSD base files, and any other parts of FreeBSD you want. In this example I’ll include the 32 bit libraries as well.
Update your FreeBSD base install.
Verify your download. We’re downloading these archives over FTP after all, we should confirm that this download is valid and not tampered with. The freebsd-update IDS command verifies the installation using a PGP key which is in your base system, which was presumably installed with an ISO that you verified using the FreeBSD signed checksums. Admittedly this step is a bit of paranoia, but I think it’s prudent.
Make sure you jail has the right timezone and dns servers and a hostname in rc.conf.
Edit jail.conf with the details about your jail.
Start and login to your jail.
11 commands and a config file, but this is the most tedious way to make a jail. With a little bit of templating it can be even easier. So I’ll start by making a template. Making a template is basically the same as steps 1, 2 and 3 above, but with a different destination folder, I’ll condense them here.
Creating a template
Create a template or a ZFS dataset. If you’d like to use the zfs clone method of deploying templates, you’ll need to create a zfs dataset instead of a folder.
Update your template with freebsd-update.
Verify your install
And that’s it, now you have a fully up to date jail template. If you’ve made this template with zfs, you can easily deploy it using zfs snapshots.
Deploying a template with ZFS snapshots
Create a snapshot. My last freebsd-update to my template brought it to patch level 17, so I’ll call my snapshot p10.
Clone the snapshot to a new jail.
Configure the jail hostname.
Add the jail definition to jail.conf, make sure you have the global jail settings from jail.conf listed in the fulljail example.
Start the jail.
The downside with the zfs approach is that each jail is now a fully independent, and if you need to update your jails, you have to update them all individually. By sharing a template using nullfs mounts you can have only one copy of the base system that only needs to be updated once.
Follow the link to see the rest of the article about
Thin jails using NullFS mounts
Simplifying jail.conf
Hopefully this has helped you understand the process of how to create and manage FreeBSD jails without tools that abstract away all the details. Those tools are often quite useful, but there is always benefit in learning to do things the hard way. And in this case, the hard way doesn’t seem to be that hard after all.
Beastie Bits
Meetup in Zurich #4, July edition (July 19) – Which you likely missed, but now you know to look for the August edition!
The next two BSD-PL User group meetings in Warsaw have been scheduled for July 30th and Aug 9th @ 1830 CEST – Submit your topic proposals now
Linux Geek Books - Humble Bundle
Extend loader(8) geli support to all architectures and all disk-like devices
Upgrading from a bootpool to a single encrypted pool – skip the gptzfsboot part, and manually update your EFI partition with loader.efi
The pkgsrc 2018Q2 for Illumos is available with 18500+ binary packages
NetBSD ARM64 Images Available with SMP for RPi3 / NanoPi / Pine64 Boards
Recently released CDE 2.3.0 running on Tribblix (Illumos)
An Interview With Tech &amp;amp; Science Fiction Author Michael W Lucas
A reminder : MeetBSD CFP
EuroBSDCon talk acceptances have gone out, and once the tutorials are confirmed, registration will open. That will likely have happened by time you see this episode, so go register! See you in Romania
Tarsnap
Feedback/Questions
Wilyarti - Adblocked on FreeBSD Continued…
Andrew - A Question and a Story
Matthew - Thanks
Brian - PCI-E Controller
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, ule, cfs, tuxedo, infinitybook, ps4, jails</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD ULE vs. Linux CFS, OpenBSD on Tuxedo InfinityBook, how zfs diff reports filenames efficiently, why choose FreeBSD over Linux, PS4 double free exploit, OpenBSD’s wifi autojoin, and FreeBSD jails the hard way.</p>

<h2>Win</h2>

<p>Celebrate our 256th episode with us. You can win a Mogics Power Bagel (not sponsored).</p>

<p>To enter, go find the 4 episodes we did in December of 2017. In the opening, find the 4 letters in the bookshelf behind me. They spell different words in each of the 4 episodes. Send us these words in order to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> with the subject “bsdnow256” until August 8th, 2018 18:00 UTC and we’ll randomly draw the winner on the live show. We’ll then contact you to ship the item.<br>
Only one item to win. All decisions are final. Better luck next time.</p>

<h2>Headlines</h2>

<h3>Battle of the Schedulers: FreeBSD ULE vs. Linux CFS</h3>

<p>Introduction<br>
This paper analyzes the impact on application performance of the design and implementation choices made in two widely used open-source schedulers: ULE, the default FreeBSD scheduler, and CFS, the default Linux scheduler. We compare ULE and CFS in otherwise identical circumstances. We have ported ULE to Linux, and use it to schedule all threads that are normally scheduled by CFS. We compare the performance of a large suite of applications on the modified kernel running ULE and on the standard Linux kernel running CFS. The observed performance differences are solely the result of scheduling decisions, and do not reflect differences in other subsystems between FreeBSD and Linux. There is no overall winner. On many workloads the two schedulers perform similarly, but for some workloads there are significant and even surprising differences. ULE may cause starvation, even when executing a single application with identical threads, but this starvation may actually lead to better application performance for some workloads. The more complex load balancing mechanism of CFS reacts more quickly to workload changes, but ULE achieves better load balance in the long run.<br>
Operating system kernel schedulers are responsible for maintaining high utilization of hardware resources (CPU cores, memory, I/O devices) while providing fast response time to latency-sensitive applications. They have to react to workload changes, and handle large numbers of cores and threads with minimal overhead [12]. This paper provides a comparison between the default schedulers of two of the most widely deployed open-source operating systems: the Completely Fair Scheduler (CFS) used in Linux, and the ULE scheduler used in FreeBSD. Our goal is not to declare an overall winner.<br>
In fact, we find that for some workloads ULE is better and for others CFS is better. Instead, our goal is to illustrate how differences in the design and the implementation of the two schedulers are reflected in application performance under different workloads. ULE and CFS are both designed to schedule large numbers of threads on large multicore machines. Scalability considerations have led both schedulers to adopt per-core run-queues. On a context switch, a core accesses only its local run-queue to find the next thread to run. Periodically and at select times, e.g., when a thread wakes up, both ULE and CFS perform load balancing, i.e., they try to balance the amount of work waiting in the run-queues of different cores.<br>
ULE and CFS, however, differ greatly in their design and implementation choices. FreeBSD ULE is a simple scheduler (2,950 lines of code in FreeBSD 11.1), while Linux CFS is much more complex (17,900 lines of code in the latest LTS Linux kernel, Linux 4.9). FreeBSD run-queues are FIFO. For load balancing, FreeBSD strives to even out the number of threads per core. In Linux, a core decides which thread to run next based on prior execution time, priority, and perceived cache behavior of the threads in its runqueue. Instead of evening out the number of threads between cores, Linux strives to even out the average amount of pending work.</p>

<p>Performance analysis<br>
We now analyze the impact of the per-core scheduling on the performance of 37 applications. We define “performance” as follows: for database workloads and NAS applications, we compare the number of operations per second, and for the other applications we compare “execution time”. The higher the “performance”, the better a scheduler performs. Figure 5 presents the performance difference between CFS and ULE on a single core, with percentages above 0 meaning that the application executes faster with ULE than CFS.<br>
Overall, the scheduler has little influence on most workloads. Indeed, most applications use threads that all perform the same work, thus both CFS and ULE endup scheduling all of the threads in a round-robin fashion. The average performance difference is 1.5%, in favor of ULE. Still, scimark is 36% slower on ULE than CFS, and apache is 40% faster on ULE than CFS. Scimark is a single-threaded Java application. It launches one compute thread, and the Java runtime executes other Java system threads in the background (for the garbage collector, I/O, etc.).<br>
When the application is executed with ULE, the compute thread can be delayed, because Java system threads are considered interactive and get priority over the computation thread. The apache workload consists of two applications: the main server (httpd) running 100 threads, and ab, a single-threaded load injector.<br>
The performance difference between ULE and CFS is explained by different choices regarding thread preemption. In ULE, full preemption is disabled, while CFS preempts the running thread when the thread that has just been woken up has a vruntime that is much smaller than the vruntime of the currently executing thread (1ms difference in practice). In CFS, ab is preempted 2 million times during the benchmark, while it never preempted with ULE.<br>
This behavior is explained as follows: ab starts by sending 100 requests to the httpd server, and then waits for the server to answer. When ab is woken up, it checks which requests have been processed and sends new requests to the server. Since ab is single-threaded, all requests sent to the server are sent sequentially. In ULE, ab is able to send as many new requests as it has received responses. In CFS, every request sent by ab wakes up a httpd thread, which preempts ab.</p>

<p>Conclusion<br>
Scheduling threads on a multicore machine is hard. In this paper, we perform a fair comparison of the design choices of two widely used schedulers: the ULE scheduler from FreeBSD and CFS from Linux. We show that they behave differently even on simple workloads, and that no scheduler performs better than the other on all workloads.</p>

<h3>OpenBSD 6.3 on Tuxedo InfinityBook</h3>

<p>Disclaimer:<br>
I came across the Tuxedo Computers InfinityBook last year at the Open! Conference where Tuxedo had a small booth. Previously they came to my attention since they’re a member of the OSB Alliance on whose board I’m a member. Furthermore Tuxedo Computers are a sponsor of the OSBAR which I’m part of the organizational team.</p>

<p>OpenBSD on the Tuxedo InfinityBook<br>
I’ve asked the guys over at Tuxedo Computers whether they would be interested to have some tests with *BSD done and that I could test drive one of their machines and give feedback on what works and what does not - and possibly look into it.+</p>

<p>Within a few weeks they shipped me a machine and last week the InfinityBook Pro 14” arrived. Awesome. Thanks already to the folks at Tuxedo Computers. The machine arrived accompanied by lot’s of swag :)</p>

<p>The InfinityBook is a very nice machine and allows a wide range of configuration. The configuration that was shipped to me:</p>

<p>Intel Core i7-8550U<br>
1x 16GB RAM 2400Mhz Crucial Ballistix Sport LT<br>
250 GB Samsung 860 EVO (M.2 SATAIII)</p>

<p>I used a USB-stick to boot install63.fs and re-installed the machine with OpenBSD. Full dmesg.</p>

<p>The installation went flawlessly, the needed intel firmware is being installed after installation automatically via fw_update(1).</p>

<p>Out of the box the graphics works and once installed the machine presents the login.</p>

<p>Video<br>
When X starts the display is turned off for some reason. You will need to hit fn+f12 (the key with the moon on it) then the display will go on. Aside from that little nit, X works just fine and presents one the expected resolution.</p>

<p>External video is working just fine as well. Either via hdmi output or via the mini displayport connector.</p>

<p>The buttons for adjusting brightness (fn+f8 and fn+f9) are not working. Instead one has to use wsconsctl(8) to adjust the brightness.</p>

<p>Networking<br>
The infinityBook has built-in ethernet, driven by re(4) And for the wireless interface the iwm(4) driver is being used. Both work as expected.</p>

<p>ACPI<br>
Neither suspend nor hibernate work. Reporting of battery status is bogus as well. Some of the keyboard function keys work:</p>

<p>LCD on/off works (fn+f2)<br>
Keyboard backlight dimming works (fn+f4)<br>
Volume (fn+f5 / fn+f6) works</p>

<p>Sound<br>
The azalia chipset is being used for audio processing. Works as expected, volume can be controlled via buttons (fn+f5, fn+f6) or via mixerctl.</p>

<p>Touchpad<br>
Can be controlled via wsconsctl(8).<br>
So far I must say, that the InfinityBook makes a nice machine - and I’m enjoying working with it.</p>

<p>iXsystems<br>
iXsystems - Its all NAS</p>

<h3>How ZFS makes things like ‘zfs diff’ report filenames efficiently</h3>

<p>As a copy on write (file)system, ZFS can use the transaction group (txg) numbers that are embedded in ZFS block pointers to efficiently find the differences between two txgs; this is used in, for example, ZFS bookmarks. However, as I noted at the end of my entry on block pointers, this doesn’t give us a filesystem level difference; instead, it essentially gives us a list of inodes (okay, dnodes) that changed.<br>
In theory, turning an inode or dnode number into the path to a file is an expensive operation; you basically have to search the entire filesystem until you find it. In practice, if you’ve ever run ‘zfs diff’, you’ve likely noticed that it runs pretty fast. Nor is this the only place that ZFS quickly turns dnode numbers into full paths, as it comes up in ‘zpool status’ reports about permanent errors. At one level, zfs diff and zpool status do this so rapidly because they ask the ZFS code in the kernel to do it for them. At another level, the question is how the kernel’s ZFS code can be so fast.<br>
The interesting and surprising answer is that ZFS cheats, in a way that makes things very fast when it works and almost always works in normal filesystems and with normal usage patterns. The cheat is that ZFS dnodes record their parent’s object number.<br>
If you’re familiar with the twists and turns of Unix filesystems, you’re now wondering how ZFS deals with hardlinks, which can cause a file to be in several directories at once and so have several parents (and then it can be removed from some of the directories). The answer is that ZFS doesn’t; a dnode only ever tracks a single parent, and ZFS accepts that this parent information can be inaccurate. I’ll quote the comment in zfs_obj_to_pobj:<br>
When a link is removed [the file’s] parent pointer is not changed and will be invalid. There are two cases where a link is removed but the file stays around, when it goes to the delete queue and when there are additional links.<br>
Before I get into the details, I want to say that I appreciate the brute force elegance of this cheat. The practical reality is that most Unix files today don’t have extra hardlinks, and when they do most hardlinks are done in ways that won’t break ZFS’s parent stuff. The result is that ZFS has picked an efficient implementation that works almost all of the time; in my opinion, the great benefit we get from having it around are more than worth the infrequent cases where it fails or malfunctions. Both zfs diff and having filenames show up in zpool status permanent error reports are very useful (and there may be other cases where this gets used).<br>
The current details are that any time you hardlink a file to somewhere or rename it, ZFS updates the file’s parent to point to the new directory. Often this will wind up with a correct parent even after all of the dust settles; for example, a common pattern is to write a file to an initial location, hardlink it to its final destination, and then remove the initial location version. In this case, the parent will be correct and you’ll get the right name.</p>

<h2>News Roundup</h2>

<h3>What is FreeBSD? Why Should You Choose It Over Linux?</h3>

<p>Not too long ago I wondered if and in what situations FreeBSD could be faster than Linux and we received a good amount of informative feedback. So far, Linux rules the desktop space and FreeBSD rules the server space.</p>

<p>In the meantime, though, what exactly is FreeBSD? And at what times should you choose it over a GNU/Linux installation? Let’s tackle these questions.</p>

<p>FreeBSD is a free and open source derivative of BSD (Berkeley Software Distribution) with a focus on speed, stability, security, and consistency, among other features. It has been developed and maintained by a large community ever since its initial release many years ago on November 1, 1993.</p>

<p>BSD is the version of UNIX® that was developed at the University of California in Berkeley. And being a free and open source version, “Free” being a prefix to BSD is a no-brainer.</p>

<p>What’s FreeBSD Good For?</p>

<p>FreeBSD offers a plethora of advanced features and even boasts some not available in some commercial Operating Systems. It makes an excellent Internet and Intranet server thanks to its robust network services that allow it to maximize memory and work with heavy loads to deliver and maintain good response times for thousands of simultaneous user processes.</p>

<p>FreeBSD runs a huge number of applications with ease. At the moment, it has over 32,000 ported applications and libraries with support for desktop, server, and embedded environments. with that being said, let me also add that FreeBSD is excellent for working with advanced embedded platforms. Mail and web appliances, timer servers, routers, MIPS hardware platforms, etc. You name it!</p>

<p>FreeBSD is available to install in several ways and there are directions to follow for any method you want to use; be it via CD-ROM, over a network using NFS or FTP, or DVD.</p>

<p>FreeBSD is easy to contribute to and all you have to do is to locate the section of the FreeBSD code base to modify and carefully do a neat job. Potential contributors are also free to improve on its artwork and documentation, among other project aspects.</p>

<p>FreeBSD is backed by the FreeBSD Foundation, a non-profit organization that you can contribute to financially and all direct contributions are tax deductible.</p>

<p>FreeBSD’s license allows users to incorporate the use of proprietary software which is ideal for companies interested in generating revenues. Netflix, for example, could cite this as one of the reasons for using FreeBSD servers.</p>

<p>Why Should You Choose It over Linux?</p>

<p>From what I’ve gathered about both FreeBSD and Linux, FreeBSD has a better performance on servers than Linux does. Yes, its packaged applications are configured to offer better a performance than Linux and it is usually running fewer services by default, there really isn’t a way to certify which is faster because the answer is dependent on the running hardware and applications and how the system is tuned.</p>

<p>FreeBSD is reportedly more secure than Linux because of the way the whole project is developed and maintained.</p>

<p>Unlike with Linux, the FreeBSD project is controlled by a large community of developers around the world who fall into any of these categories; core team, contributors, and committers.</p>

<p>FreeBSD is much easier to learn and use because there aren’t a thousand and one distros to choose from with different package managers, DEs, etc.</p>

<p>FreeBSD is more convenient to contribute to because it is the entire OS that is preserved and not just the kernel and a repo as is the case with Linux. You can easily access all of its versions since they are sorted by release numbers.</p>

<p>Apart from the many documentations and guides that you can find online, FreeBSD has a single official documentation wherein you can find the solution to virtually any issue you will come across. So, you’re sure to find it resourceful.</p>

<p>FreeBSD has close to no software issues compared to Linux because it has Java, is capable of running Windows programs using Wine, and can run .NET programs using Mono.</p>

<p>FreeBSD’s ports/packages system allows you to compile software with specific configurations, thereby avoiding conflicting dependency and version issues.</p>

<p>Both the FreeBSD and GNU/Linux project are always receiving updates. The platform you decide to go with is largely dependent on what you want to use it for, your technical know-how, willingness to learn new stuff, and ultimately your preference.<br>
What is your take on the topic? For what reasons would you choose FreeBSD over Linux if you would? Let us know what you think about both platforms in the comments section below.</p>

<h3>PS4 5.05 BPF Double Free Kernel Exploit Writeup</h3>

<p>Introduction<br>
Welcome to the 5.0x kernel exploit write-up. A few months ago, a kernel vulnerability was discovered by qwertyoruiopz and an exploit was released for BPF which involved crafting an out-of-bounds (OOB) write via use-after-free (UAF) due to the lack of proper locking. It was a fun bug, and a very trivial exploit. Sony then removed the write functionality from BPF, so that exploit was patched. However, the core issue still remained (being the lack of locking). A very similar race condition still exists in BPF past 4.55, which we will go into detail below on. The full source of the exploit can be found here.<br>
This bug is no longer accessible however past 5.05 firmware, because the BPF driver has finally been blocked from unprivileged processes - WebKit can no longer open it. Sony also introduced a new security mitigation in 5.0x firmwares to prevent the stack pointer from pointing into user space, however we’ll go more in detail on this a bit further down.</p>

<p>Assumptions<br>
Some assumptions are made of the reader’s knowledge for the writeup. The avid reader should have a basic understanding of how memory allocators work - more specifically, how malloc() and free() allocate and deallocate memory respectively. They should also be aware that devices can be issued commands concurrently, as in, one command could be received while another one is being processed via threading. An understanding of C, x86, and exploitation basics is also very helpful, though not necessarily required.</p>

<p>Background<br>
This section contains some helpful information to those newer to exploitation, or are unfamiliar with device drivers, or various exploit techniques such as heap spraying and race conditions. Feel free to skip to the “A Tale of Two Free()&#39;s” section if you’re already familiar with this material.</p>

<p>What Are Drivers?<br>
There are a few ways that applications can directly communicate with the operating system. One of which is system calls, which there are over 600 of in the PS4 kernel, ~500 of which are FreeBSD - the rest are Sony-implemented. Another method is through something called “Device Drivers”. Drivers are typically used to bridge the gap between software and hardware devices (usb drives, keyboard/mouse, webcams, etc) - though they can also be used just for software purposes.<br>
There are a few operations that a userland application can perform on a driver (if it has sufficient permissions) to interface with it after opening it. In some instances, one can read from it, write to it, or in some cases, issue more complex commands to it via the ioctl() system call. The handlers for these commands are implemented in kernel space - this is important, because any bugs that could be exploited in an ioctl handler can be used as a privilege escalation straight to ring0 - typically the most privileged state.<br>
Drivers are often the more weaker points of an operating system for attackers, because sometimes these drivers are written by developers who don’t understand how the kernel works, or the drivers are older and thus not wise to newer attack methods.</p>

<p>The BPF Device Driver<br>
If we take a look around inside of WebKit’s sandbox, we’ll find a /dev directory. While this may seem like the root device driver path, it’s a lie. Many of the drivers that the PS4 has are not exposed to this directory, but rather only ones that are needed for WebKit’s operation (for the most part). For some reason though, BPF (aka. the “Berkely Packet Filter”) device is not only exposed to WebKit’s sandbox - it also has the privileges to open the device as R/W. This is very odd, because on most systems this driver is root-only (and for good reason). If you want to read more into this, refer to my previous write-up with 4.55FW.</p>

<p>What Are Packet Filters?<br>
Below is an excerpt from the 4.55 bpfwrite writeup.<br>
Since the bug is directly in the filter system, it is important to know the basics of what packet filters are. Filters are essentially sets of pseudo-instructions that are parsed by bpf_filter() (which are ran when packets are received). While the pseudo-instruction set is fairly minimal, it allows you to do things like perform basic arithmetic operations and copy values around inside it’s buffer. Breaking down the BPF VM in it’s entirety is far beyond the scope of this write-up, just know that the code produced by it is ran in kernel mode - this is why read/write access to /dev/bpf should be privileged.</p>

<p>Race Conditions<br>
Race conditions occur when two processes/threads try to access a shared resource at the same time without mutual exclusion. The problem was ultimately solved by introducing concepts such as the “mutex” or “lock”. The idea is when one thread/process tries to access a resource, it will first acquire a lock, access it, then unlock it once it’s finished. If another thread/process tries to access it while the other has the lock, it will wait until the other thread is finished. This works fairly well - when it’s used properly.<br>
Locking is hard to get right, especially when you try to implement fine-grained locking for performance. One single instruction or line of code outside the locking window could introduce a race condition. Not all race conditions are exploitable, but some are (such as this one) - and they can give an attacker very powerful bugs to work with.</p>

<p>Heap Spraying<br>
The process of heap spraying is fairly simple - allocate a bunch of memory and fill it with controlled data in a loop and pray your allocation doesn’t get stolen from underneath you. It’s a very useful technique when exploiting something such as a use-after-free(), as you can use it to get controlled data into your target object’s backing memory.<br>
By extension, it’s useful to do this for a double free() as well, because once we have a stale reference, we can use a heap spray to control the data. Since the object will be marked “free” - the allocator will eventually provide us with control over this memory, even though something else is still using it. That is, unless, something else has already stolen the pointer from you and corrupts it - then you’ll likely get a system crash, and that’s no fun. This is one factor that adds to the variance of exploits, and typically, the smaller the object, the more likely this is to happen.</p>

<p>Follow the link to read more of the article<br>
DigitalOcean<br>
<a href="http://do.co/bsdnow" rel="nofollow">http://do.co/bsdnow</a></p>

<h3>OpenBSD gains Wi-Fi “auto-join”</h3>

<p>In a change which is bound to be welcomed widely, -current has gained “auto-join” for Wi-Fi networks. Peter Hessler (phessler@) has been working on this for quite some time and he wrote about it in his p2k18 hackathon report. He has committed the work from the g2k18 hackathon in Ljubljana:</p>

<p>CVSROOT:    /cvs<br>
Module name:    src<br>
Changes by: <a href="mailto:phessler@cvs.openbsd.org" rel="nofollow">phessler@cvs.openbsd.org</a>    2018/07/11 14:18:09</p>

<p>Modified files:<br>
    sbin/ifconfig  : ifconfig.8 ifconfig.c <br>
    sys/net80211   : ieee80211_ioctl.c ieee80211_ioctl.h <br>
                     ieee80211_node.c ieee80211_node.h <br>
                     ieee80211_var.h </p>

<p>Log message:<br>
Introduce &#39;auto-join&#39; to the wifi 802.11 stack.</p>

<p>This allows a system to remember which ESSIDs it wants to connect to, any<br>
relevant security configuration, and switch to it when the network we are<br>
currently connected to is no longer available.<br>
Works when connecting and switching between WPA2/WPA1/WEP/clear encryptions.</p>

<p>example hostname.if:<br>
join home wpakey password<br>
join work wpakey mekmitasdigoat<br>
join open-lounge<br>
join cafe wpakey cafe2018<br>
join &quot;wepnetwork&quot; nwkey &quot;12345&quot;<br>
dhcp<br>
inet6 autoconf<br>
up</p>

<p>OK stsp@ reyk@<br>
and enthusiasm from every hackroom I&#39;ve been in for the last 3 years<br>
The usage should be clear from the commit message, but basically you ‘join’ all the networks you want to auto-join as you would previously use ‘nwid’ to connect to one specific network. Then the kernel will join the network that’s actually in range and do the rest automagically for you. When you move out of range of that network you lose connectivity until you come in range of the original (where things will continue to work as you’ve been used to) or one of the other networks (where you will associate and then get a new lease).</p>

<p>Thanks to Peter for working on this feature - something many a Wi-Fi using OpenBSD user will be able to benefit from.</p>

<h3>FreeBSD Jails the hard way</h3>

<p>There are many great options for managing FreeBSD Jails. iocage, warden and ez-jail aim to streamline the process and make it quick an easy to get going. But sometimes the tools built right into the OS are overlooked.</p>

<p>This post goes over what is involved in creating and managing jails using only the tools built into FreeBSD.</p>

<p>For this guide, I’m going to be putting my jails in /usr/local/jails.</p>

<p>I’ll start with a very simple, isolated jail. Then I’ll go over how to use ZFS snapshots, and lastly nullfs mounts to share the FreeBSD base files with multiple jails.</p>

<p>I’ll also show some examples of how to use the templating power of jail.conf to apply similar settings to all your jails.</p>

<p>Full Jail<br>
Make a directory for the jail, or a zfs dataset if you prefer.<br>
Download the FreeBSD base files, and any other parts of FreeBSD you want. In this example I’ll include the 32 bit libraries as well.<br>
Update your FreeBSD base install.<br>
Verify your download. We’re downloading these archives over FTP after all, we should confirm that this download is valid and not tampered with. The freebsd-update IDS command verifies the installation using a PGP key which is in your base system, which was presumably installed with an ISO that you verified using the FreeBSD signed checksums. Admittedly this step is a bit of paranoia, but I think it’s prudent.<br>
Make sure you jail has the right timezone and dns servers and a hostname in rc.conf.<br>
Edit jail.conf with the details about your jail.<br>
Start and login to your jail.<br>
11 commands and a config file, but this is the most tedious way to make a jail. With a little bit of templating it can be even easier. So I’ll start by making a template. Making a template is basically the same as steps 1, 2 and 3 above, but with a different destination folder, I’ll condense them here.</p>

<p>Creating a template<br>
Create a template or a ZFS dataset. If you’d like to use the zfs clone method of deploying templates, you’ll need to create a zfs dataset instead of a folder.<br>
Update your template with freebsd-update.<br>
Verify your install<br>
And that’s it, now you have a fully up to date jail template. If you’ve made this template with zfs, you can easily deploy it using zfs snapshots.</p>

<p>Deploying a template with ZFS snapshots<br>
Create a snapshot. My last freebsd-update to my template brought it to patch level 17, so I’ll call my snapshot p10.<br>
Clone the snapshot to a new jail.<br>
Configure the jail hostname.<br>
Add the jail definition to jail.conf, make sure you have the global jail settings from jail.conf listed in the fulljail example.<br>
Start the jail.<br>
The downside with the zfs approach is that each jail is now a fully independent, and if you need to update your jails, you have to update them all individually. By sharing a template using nullfs mounts you can have only one copy of the base system that only needs to be updated once.</p>

<p>Follow the link to see the rest of the article about<br>
Thin jails using NullFS mounts<br>
Simplifying jail.conf<br>
Hopefully this has helped you understand the process of how to create and manage FreeBSD jails without tools that abstract away all the details. Those tools are often quite useful, but there is always benefit in learning to do things the hard way. And in this case, the hard way doesn’t seem to be that hard after all.</p>

<h2>Beastie Bits</h2>

<p>Meetup in Zurich #4, July edition (July 19) – Which you likely missed, but now you know to look for the August edition!<br>
The next two BSD-PL User group meetings in Warsaw have been scheduled for July 30th and Aug 9th @ 1830 CEST – Submit your topic proposals now<br>
Linux Geek Books - Humble Bundle<br>
Extend loader(8) geli support to all architectures and all disk-like devices<br>
Upgrading from a bootpool to a single encrypted pool – skip the gptzfsboot part, and manually update your EFI partition with loader.efi<br>
The pkgsrc 2018Q2 for Illumos is available with 18500+ binary packages<br>
NetBSD ARM64 Images Available with SMP for RPi3 / NanoPi / Pine64 Boards<br>
Recently released CDE 2.3.0 running on Tribblix (Illumos)<br>
An Interview With Tech &amp; Science Fiction Author Michael W Lucas<br>
A reminder : MeetBSD CFP<br>
EuroBSDCon talk acceptances have gone out, and once the tutorials are confirmed, registration will open. That will likely have happened by time you see this episode, so go register! See you in Romania<br>
Tarsnap</p>

<h2>Feedback/Questions</h2>

<p>Wilyarti - Adblocked on FreeBSD Continued…<br>
Andrew - A Question and a Story<br>
Matthew - Thanks<br>
Brian - PCI-E Controller<br>
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD ULE vs. Linux CFS, OpenBSD on Tuxedo InfinityBook, how zfs diff reports filenames efficiently, why choose FreeBSD over Linux, PS4 double free exploit, OpenBSD’s wifi autojoin, and FreeBSD jails the hard way.</p>

<h2>Win</h2>

<p>Celebrate our 256th episode with us. You can win a Mogics Power Bagel (not sponsored).</p>

<p>To enter, go find the 4 episodes we did in December of 2017. In the opening, find the 4 letters in the bookshelf behind me. They spell different words in each of the 4 episodes. Send us these words in order to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> with the subject “bsdnow256” until August 8th, 2018 18:00 UTC and we’ll randomly draw the winner on the live show. We’ll then contact you to ship the item.<br>
Only one item to win. All decisions are final. Better luck next time.</p>

<h2>Headlines</h2>

<h3>Battle of the Schedulers: FreeBSD ULE vs. Linux CFS</h3>

<p>Introduction<br>
This paper analyzes the impact on application performance of the design and implementation choices made in two widely used open-source schedulers: ULE, the default FreeBSD scheduler, and CFS, the default Linux scheduler. We compare ULE and CFS in otherwise identical circumstances. We have ported ULE to Linux, and use it to schedule all threads that are normally scheduled by CFS. We compare the performance of a large suite of applications on the modified kernel running ULE and on the standard Linux kernel running CFS. The observed performance differences are solely the result of scheduling decisions, and do not reflect differences in other subsystems between FreeBSD and Linux. There is no overall winner. On many workloads the two schedulers perform similarly, but for some workloads there are significant and even surprising differences. ULE may cause starvation, even when executing a single application with identical threads, but this starvation may actually lead to better application performance for some workloads. The more complex load balancing mechanism of CFS reacts more quickly to workload changes, but ULE achieves better load balance in the long run.<br>
Operating system kernel schedulers are responsible for maintaining high utilization of hardware resources (CPU cores, memory, I/O devices) while providing fast response time to latency-sensitive applications. They have to react to workload changes, and handle large numbers of cores and threads with minimal overhead [12]. This paper provides a comparison between the default schedulers of two of the most widely deployed open-source operating systems: the Completely Fair Scheduler (CFS) used in Linux, and the ULE scheduler used in FreeBSD. Our goal is not to declare an overall winner.<br>
In fact, we find that for some workloads ULE is better and for others CFS is better. Instead, our goal is to illustrate how differences in the design and the implementation of the two schedulers are reflected in application performance under different workloads. ULE and CFS are both designed to schedule large numbers of threads on large multicore machines. Scalability considerations have led both schedulers to adopt per-core run-queues. On a context switch, a core accesses only its local run-queue to find the next thread to run. Periodically and at select times, e.g., when a thread wakes up, both ULE and CFS perform load balancing, i.e., they try to balance the amount of work waiting in the run-queues of different cores.<br>
ULE and CFS, however, differ greatly in their design and implementation choices. FreeBSD ULE is a simple scheduler (2,950 lines of code in FreeBSD 11.1), while Linux CFS is much more complex (17,900 lines of code in the latest LTS Linux kernel, Linux 4.9). FreeBSD run-queues are FIFO. For load balancing, FreeBSD strives to even out the number of threads per core. In Linux, a core decides which thread to run next based on prior execution time, priority, and perceived cache behavior of the threads in its runqueue. Instead of evening out the number of threads between cores, Linux strives to even out the average amount of pending work.</p>

<p>Performance analysis<br>
We now analyze the impact of the per-core scheduling on the performance of 37 applications. We define “performance” as follows: for database workloads and NAS applications, we compare the number of operations per second, and for the other applications we compare “execution time”. The higher the “performance”, the better a scheduler performs. Figure 5 presents the performance difference between CFS and ULE on a single core, with percentages above 0 meaning that the application executes faster with ULE than CFS.<br>
Overall, the scheduler has little influence on most workloads. Indeed, most applications use threads that all perform the same work, thus both CFS and ULE endup scheduling all of the threads in a round-robin fashion. The average performance difference is 1.5%, in favor of ULE. Still, scimark is 36% slower on ULE than CFS, and apache is 40% faster on ULE than CFS. Scimark is a single-threaded Java application. It launches one compute thread, and the Java runtime executes other Java system threads in the background (for the garbage collector, I/O, etc.).<br>
When the application is executed with ULE, the compute thread can be delayed, because Java system threads are considered interactive and get priority over the computation thread. The apache workload consists of two applications: the main server (httpd) running 100 threads, and ab, a single-threaded load injector.<br>
The performance difference between ULE and CFS is explained by different choices regarding thread preemption. In ULE, full preemption is disabled, while CFS preempts the running thread when the thread that has just been woken up has a vruntime that is much smaller than the vruntime of the currently executing thread (1ms difference in practice). In CFS, ab is preempted 2 million times during the benchmark, while it never preempted with ULE.<br>
This behavior is explained as follows: ab starts by sending 100 requests to the httpd server, and then waits for the server to answer. When ab is woken up, it checks which requests have been processed and sends new requests to the server. Since ab is single-threaded, all requests sent to the server are sent sequentially. In ULE, ab is able to send as many new requests as it has received responses. In CFS, every request sent by ab wakes up a httpd thread, which preempts ab.</p>

<p>Conclusion<br>
Scheduling threads on a multicore machine is hard. In this paper, we perform a fair comparison of the design choices of two widely used schedulers: the ULE scheduler from FreeBSD and CFS from Linux. We show that they behave differently even on simple workloads, and that no scheduler performs better than the other on all workloads.</p>

<h3>OpenBSD 6.3 on Tuxedo InfinityBook</h3>

<p>Disclaimer:<br>
I came across the Tuxedo Computers InfinityBook last year at the Open! Conference where Tuxedo had a small booth. Previously they came to my attention since they’re a member of the OSB Alliance on whose board I’m a member. Furthermore Tuxedo Computers are a sponsor of the OSBAR which I’m part of the organizational team.</p>

<p>OpenBSD on the Tuxedo InfinityBook<br>
I’ve asked the guys over at Tuxedo Computers whether they would be interested to have some tests with *BSD done and that I could test drive one of their machines and give feedback on what works and what does not - and possibly look into it.+</p>

<p>Within a few weeks they shipped me a machine and last week the InfinityBook Pro 14” arrived. Awesome. Thanks already to the folks at Tuxedo Computers. The machine arrived accompanied by lot’s of swag :)</p>

<p>The InfinityBook is a very nice machine and allows a wide range of configuration. The configuration that was shipped to me:</p>

<p>Intel Core i7-8550U<br>
1x 16GB RAM 2400Mhz Crucial Ballistix Sport LT<br>
250 GB Samsung 860 EVO (M.2 SATAIII)</p>

<p>I used a USB-stick to boot install63.fs and re-installed the machine with OpenBSD. Full dmesg.</p>

<p>The installation went flawlessly, the needed intel firmware is being installed after installation automatically via fw_update(1).</p>

<p>Out of the box the graphics works and once installed the machine presents the login.</p>

<p>Video<br>
When X starts the display is turned off for some reason. You will need to hit fn+f12 (the key with the moon on it) then the display will go on. Aside from that little nit, X works just fine and presents one the expected resolution.</p>

<p>External video is working just fine as well. Either via hdmi output or via the mini displayport connector.</p>

<p>The buttons for adjusting brightness (fn+f8 and fn+f9) are not working. Instead one has to use wsconsctl(8) to adjust the brightness.</p>

<p>Networking<br>
The infinityBook has built-in ethernet, driven by re(4) And for the wireless interface the iwm(4) driver is being used. Both work as expected.</p>

<p>ACPI<br>
Neither suspend nor hibernate work. Reporting of battery status is bogus as well. Some of the keyboard function keys work:</p>

<p>LCD on/off works (fn+f2)<br>
Keyboard backlight dimming works (fn+f4)<br>
Volume (fn+f5 / fn+f6) works</p>

<p>Sound<br>
The azalia chipset is being used for audio processing. Works as expected, volume can be controlled via buttons (fn+f5, fn+f6) or via mixerctl.</p>

<p>Touchpad<br>
Can be controlled via wsconsctl(8).<br>
So far I must say, that the InfinityBook makes a nice machine - and I’m enjoying working with it.</p>

<p>iXsystems<br>
iXsystems - Its all NAS</p>

<h3>How ZFS makes things like ‘zfs diff’ report filenames efficiently</h3>

<p>As a copy on write (file)system, ZFS can use the transaction group (txg) numbers that are embedded in ZFS block pointers to efficiently find the differences between two txgs; this is used in, for example, ZFS bookmarks. However, as I noted at the end of my entry on block pointers, this doesn’t give us a filesystem level difference; instead, it essentially gives us a list of inodes (okay, dnodes) that changed.<br>
In theory, turning an inode or dnode number into the path to a file is an expensive operation; you basically have to search the entire filesystem until you find it. In practice, if you’ve ever run ‘zfs diff’, you’ve likely noticed that it runs pretty fast. Nor is this the only place that ZFS quickly turns dnode numbers into full paths, as it comes up in ‘zpool status’ reports about permanent errors. At one level, zfs diff and zpool status do this so rapidly because they ask the ZFS code in the kernel to do it for them. At another level, the question is how the kernel’s ZFS code can be so fast.<br>
The interesting and surprising answer is that ZFS cheats, in a way that makes things very fast when it works and almost always works in normal filesystems and with normal usage patterns. The cheat is that ZFS dnodes record their parent’s object number.<br>
If you’re familiar with the twists and turns of Unix filesystems, you’re now wondering how ZFS deals with hardlinks, which can cause a file to be in several directories at once and so have several parents (and then it can be removed from some of the directories). The answer is that ZFS doesn’t; a dnode only ever tracks a single parent, and ZFS accepts that this parent information can be inaccurate. I’ll quote the comment in zfs_obj_to_pobj:<br>
When a link is removed [the file’s] parent pointer is not changed and will be invalid. There are two cases where a link is removed but the file stays around, when it goes to the delete queue and when there are additional links.<br>
Before I get into the details, I want to say that I appreciate the brute force elegance of this cheat. The practical reality is that most Unix files today don’t have extra hardlinks, and when they do most hardlinks are done in ways that won’t break ZFS’s parent stuff. The result is that ZFS has picked an efficient implementation that works almost all of the time; in my opinion, the great benefit we get from having it around are more than worth the infrequent cases where it fails or malfunctions. Both zfs diff and having filenames show up in zpool status permanent error reports are very useful (and there may be other cases where this gets used).<br>
The current details are that any time you hardlink a file to somewhere or rename it, ZFS updates the file’s parent to point to the new directory. Often this will wind up with a correct parent even after all of the dust settles; for example, a common pattern is to write a file to an initial location, hardlink it to its final destination, and then remove the initial location version. In this case, the parent will be correct and you’ll get the right name.</p>

<h2>News Roundup</h2>

<h3>What is FreeBSD? Why Should You Choose It Over Linux?</h3>

<p>Not too long ago I wondered if and in what situations FreeBSD could be faster than Linux and we received a good amount of informative feedback. So far, Linux rules the desktop space and FreeBSD rules the server space.</p>

<p>In the meantime, though, what exactly is FreeBSD? And at what times should you choose it over a GNU/Linux installation? Let’s tackle these questions.</p>

<p>FreeBSD is a free and open source derivative of BSD (Berkeley Software Distribution) with a focus on speed, stability, security, and consistency, among other features. It has been developed and maintained by a large community ever since its initial release many years ago on November 1, 1993.</p>

<p>BSD is the version of UNIX® that was developed at the University of California in Berkeley. And being a free and open source version, “Free” being a prefix to BSD is a no-brainer.</p>

<p>What’s FreeBSD Good For?</p>

<p>FreeBSD offers a plethora of advanced features and even boasts some not available in some commercial Operating Systems. It makes an excellent Internet and Intranet server thanks to its robust network services that allow it to maximize memory and work with heavy loads to deliver and maintain good response times for thousands of simultaneous user processes.</p>

<p>FreeBSD runs a huge number of applications with ease. At the moment, it has over 32,000 ported applications and libraries with support for desktop, server, and embedded environments. with that being said, let me also add that FreeBSD is excellent for working with advanced embedded platforms. Mail and web appliances, timer servers, routers, MIPS hardware platforms, etc. You name it!</p>

<p>FreeBSD is available to install in several ways and there are directions to follow for any method you want to use; be it via CD-ROM, over a network using NFS or FTP, or DVD.</p>

<p>FreeBSD is easy to contribute to and all you have to do is to locate the section of the FreeBSD code base to modify and carefully do a neat job. Potential contributors are also free to improve on its artwork and documentation, among other project aspects.</p>

<p>FreeBSD is backed by the FreeBSD Foundation, a non-profit organization that you can contribute to financially and all direct contributions are tax deductible.</p>

<p>FreeBSD’s license allows users to incorporate the use of proprietary software which is ideal for companies interested in generating revenues. Netflix, for example, could cite this as one of the reasons for using FreeBSD servers.</p>

<p>Why Should You Choose It over Linux?</p>

<p>From what I’ve gathered about both FreeBSD and Linux, FreeBSD has a better performance on servers than Linux does. Yes, its packaged applications are configured to offer better a performance than Linux and it is usually running fewer services by default, there really isn’t a way to certify which is faster because the answer is dependent on the running hardware and applications and how the system is tuned.</p>

<p>FreeBSD is reportedly more secure than Linux because of the way the whole project is developed and maintained.</p>

<p>Unlike with Linux, the FreeBSD project is controlled by a large community of developers around the world who fall into any of these categories; core team, contributors, and committers.</p>

<p>FreeBSD is much easier to learn and use because there aren’t a thousand and one distros to choose from with different package managers, DEs, etc.</p>

<p>FreeBSD is more convenient to contribute to because it is the entire OS that is preserved and not just the kernel and a repo as is the case with Linux. You can easily access all of its versions since they are sorted by release numbers.</p>

<p>Apart from the many documentations and guides that you can find online, FreeBSD has a single official documentation wherein you can find the solution to virtually any issue you will come across. So, you’re sure to find it resourceful.</p>

<p>FreeBSD has close to no software issues compared to Linux because it has Java, is capable of running Windows programs using Wine, and can run .NET programs using Mono.</p>

<p>FreeBSD’s ports/packages system allows you to compile software with specific configurations, thereby avoiding conflicting dependency and version issues.</p>

<p>Both the FreeBSD and GNU/Linux project are always receiving updates. The platform you decide to go with is largely dependent on what you want to use it for, your technical know-how, willingness to learn new stuff, and ultimately your preference.<br>
What is your take on the topic? For what reasons would you choose FreeBSD over Linux if you would? Let us know what you think about both platforms in the comments section below.</p>

<h3>PS4 5.05 BPF Double Free Kernel Exploit Writeup</h3>

<p>Introduction<br>
Welcome to the 5.0x kernel exploit write-up. A few months ago, a kernel vulnerability was discovered by qwertyoruiopz and an exploit was released for BPF which involved crafting an out-of-bounds (OOB) write via use-after-free (UAF) due to the lack of proper locking. It was a fun bug, and a very trivial exploit. Sony then removed the write functionality from BPF, so that exploit was patched. However, the core issue still remained (being the lack of locking). A very similar race condition still exists in BPF past 4.55, which we will go into detail below on. The full source of the exploit can be found here.<br>
This bug is no longer accessible however past 5.05 firmware, because the BPF driver has finally been blocked from unprivileged processes - WebKit can no longer open it. Sony also introduced a new security mitigation in 5.0x firmwares to prevent the stack pointer from pointing into user space, however we’ll go more in detail on this a bit further down.</p>

<p>Assumptions<br>
Some assumptions are made of the reader’s knowledge for the writeup. The avid reader should have a basic understanding of how memory allocators work - more specifically, how malloc() and free() allocate and deallocate memory respectively. They should also be aware that devices can be issued commands concurrently, as in, one command could be received while another one is being processed via threading. An understanding of C, x86, and exploitation basics is also very helpful, though not necessarily required.</p>

<p>Background<br>
This section contains some helpful information to those newer to exploitation, or are unfamiliar with device drivers, or various exploit techniques such as heap spraying and race conditions. Feel free to skip to the “A Tale of Two Free()&#39;s” section if you’re already familiar with this material.</p>

<p>What Are Drivers?<br>
There are a few ways that applications can directly communicate with the operating system. One of which is system calls, which there are over 600 of in the PS4 kernel, ~500 of which are FreeBSD - the rest are Sony-implemented. Another method is through something called “Device Drivers”. Drivers are typically used to bridge the gap between software and hardware devices (usb drives, keyboard/mouse, webcams, etc) - though they can also be used just for software purposes.<br>
There are a few operations that a userland application can perform on a driver (if it has sufficient permissions) to interface with it after opening it. In some instances, one can read from it, write to it, or in some cases, issue more complex commands to it via the ioctl() system call. The handlers for these commands are implemented in kernel space - this is important, because any bugs that could be exploited in an ioctl handler can be used as a privilege escalation straight to ring0 - typically the most privileged state.<br>
Drivers are often the more weaker points of an operating system for attackers, because sometimes these drivers are written by developers who don’t understand how the kernel works, or the drivers are older and thus not wise to newer attack methods.</p>

<p>The BPF Device Driver<br>
If we take a look around inside of WebKit’s sandbox, we’ll find a /dev directory. While this may seem like the root device driver path, it’s a lie. Many of the drivers that the PS4 has are not exposed to this directory, but rather only ones that are needed for WebKit’s operation (for the most part). For some reason though, BPF (aka. the “Berkely Packet Filter”) device is not only exposed to WebKit’s sandbox - it also has the privileges to open the device as R/W. This is very odd, because on most systems this driver is root-only (and for good reason). If you want to read more into this, refer to my previous write-up with 4.55FW.</p>

<p>What Are Packet Filters?<br>
Below is an excerpt from the 4.55 bpfwrite writeup.<br>
Since the bug is directly in the filter system, it is important to know the basics of what packet filters are. Filters are essentially sets of pseudo-instructions that are parsed by bpf_filter() (which are ran when packets are received). While the pseudo-instruction set is fairly minimal, it allows you to do things like perform basic arithmetic operations and copy values around inside it’s buffer. Breaking down the BPF VM in it’s entirety is far beyond the scope of this write-up, just know that the code produced by it is ran in kernel mode - this is why read/write access to /dev/bpf should be privileged.</p>

<p>Race Conditions<br>
Race conditions occur when two processes/threads try to access a shared resource at the same time without mutual exclusion. The problem was ultimately solved by introducing concepts such as the “mutex” or “lock”. The idea is when one thread/process tries to access a resource, it will first acquire a lock, access it, then unlock it once it’s finished. If another thread/process tries to access it while the other has the lock, it will wait until the other thread is finished. This works fairly well - when it’s used properly.<br>
Locking is hard to get right, especially when you try to implement fine-grained locking for performance. One single instruction or line of code outside the locking window could introduce a race condition. Not all race conditions are exploitable, but some are (such as this one) - and they can give an attacker very powerful bugs to work with.</p>

<p>Heap Spraying<br>
The process of heap spraying is fairly simple - allocate a bunch of memory and fill it with controlled data in a loop and pray your allocation doesn’t get stolen from underneath you. It’s a very useful technique when exploiting something such as a use-after-free(), as you can use it to get controlled data into your target object’s backing memory.<br>
By extension, it’s useful to do this for a double free() as well, because once we have a stale reference, we can use a heap spray to control the data. Since the object will be marked “free” - the allocator will eventually provide us with control over this memory, even though something else is still using it. That is, unless, something else has already stolen the pointer from you and corrupts it - then you’ll likely get a system crash, and that’s no fun. This is one factor that adds to the variance of exploits, and typically, the smaller the object, the more likely this is to happen.</p>

<p>Follow the link to read more of the article<br>
DigitalOcean<br>
<a href="http://do.co/bsdnow" rel="nofollow">http://do.co/bsdnow</a></p>

<h3>OpenBSD gains Wi-Fi “auto-join”</h3>

<p>In a change which is bound to be welcomed widely, -current has gained “auto-join” for Wi-Fi networks. Peter Hessler (phessler@) has been working on this for quite some time and he wrote about it in his p2k18 hackathon report. He has committed the work from the g2k18 hackathon in Ljubljana:</p>

<p>CVSROOT:    /cvs<br>
Module name:    src<br>
Changes by: <a href="mailto:phessler@cvs.openbsd.org" rel="nofollow">phessler@cvs.openbsd.org</a>    2018/07/11 14:18:09</p>

<p>Modified files:<br>
    sbin/ifconfig  : ifconfig.8 ifconfig.c <br>
    sys/net80211   : ieee80211_ioctl.c ieee80211_ioctl.h <br>
                     ieee80211_node.c ieee80211_node.h <br>
                     ieee80211_var.h </p>

<p>Log message:<br>
Introduce &#39;auto-join&#39; to the wifi 802.11 stack.</p>

<p>This allows a system to remember which ESSIDs it wants to connect to, any<br>
relevant security configuration, and switch to it when the network we are<br>
currently connected to is no longer available.<br>
Works when connecting and switching between WPA2/WPA1/WEP/clear encryptions.</p>

<p>example hostname.if:<br>
join home wpakey password<br>
join work wpakey mekmitasdigoat<br>
join open-lounge<br>
join cafe wpakey cafe2018<br>
join &quot;wepnetwork&quot; nwkey &quot;12345&quot;<br>
dhcp<br>
inet6 autoconf<br>
up</p>

<p>OK stsp@ reyk@<br>
and enthusiasm from every hackroom I&#39;ve been in for the last 3 years<br>
The usage should be clear from the commit message, but basically you ‘join’ all the networks you want to auto-join as you would previously use ‘nwid’ to connect to one specific network. Then the kernel will join the network that’s actually in range and do the rest automagically for you. When you move out of range of that network you lose connectivity until you come in range of the original (where things will continue to work as you’ve been used to) or one of the other networks (where you will associate and then get a new lease).</p>

<p>Thanks to Peter for working on this feature - something many a Wi-Fi using OpenBSD user will be able to benefit from.</p>

<h3>FreeBSD Jails the hard way</h3>

<p>There are many great options for managing FreeBSD Jails. iocage, warden and ez-jail aim to streamline the process and make it quick an easy to get going. But sometimes the tools built right into the OS are overlooked.</p>

<p>This post goes over what is involved in creating and managing jails using only the tools built into FreeBSD.</p>

<p>For this guide, I’m going to be putting my jails in /usr/local/jails.</p>

<p>I’ll start with a very simple, isolated jail. Then I’ll go over how to use ZFS snapshots, and lastly nullfs mounts to share the FreeBSD base files with multiple jails.</p>

<p>I’ll also show some examples of how to use the templating power of jail.conf to apply similar settings to all your jails.</p>

<p>Full Jail<br>
Make a directory for the jail, or a zfs dataset if you prefer.<br>
Download the FreeBSD base files, and any other parts of FreeBSD you want. In this example I’ll include the 32 bit libraries as well.<br>
Update your FreeBSD base install.<br>
Verify your download. We’re downloading these archives over FTP after all, we should confirm that this download is valid and not tampered with. The freebsd-update IDS command verifies the installation using a PGP key which is in your base system, which was presumably installed with an ISO that you verified using the FreeBSD signed checksums. Admittedly this step is a bit of paranoia, but I think it’s prudent.<br>
Make sure you jail has the right timezone and dns servers and a hostname in rc.conf.<br>
Edit jail.conf with the details about your jail.<br>
Start and login to your jail.<br>
11 commands and a config file, but this is the most tedious way to make a jail. With a little bit of templating it can be even easier. So I’ll start by making a template. Making a template is basically the same as steps 1, 2 and 3 above, but with a different destination folder, I’ll condense them here.</p>

<p>Creating a template<br>
Create a template or a ZFS dataset. If you’d like to use the zfs clone method of deploying templates, you’ll need to create a zfs dataset instead of a folder.<br>
Update your template with freebsd-update.<br>
Verify your install<br>
And that’s it, now you have a fully up to date jail template. If you’ve made this template with zfs, you can easily deploy it using zfs snapshots.</p>

<p>Deploying a template with ZFS snapshots<br>
Create a snapshot. My last freebsd-update to my template brought it to patch level 17, so I’ll call my snapshot p10.<br>
Clone the snapshot to a new jail.<br>
Configure the jail hostname.<br>
Add the jail definition to jail.conf, make sure you have the global jail settings from jail.conf listed in the fulljail example.<br>
Start the jail.<br>
The downside with the zfs approach is that each jail is now a fully independent, and if you need to update your jails, you have to update them all individually. By sharing a template using nullfs mounts you can have only one copy of the base system that only needs to be updated once.</p>

<p>Follow the link to see the rest of the article about<br>
Thin jails using NullFS mounts<br>
Simplifying jail.conf<br>
Hopefully this has helped you understand the process of how to create and manage FreeBSD jails without tools that abstract away all the details. Those tools are often quite useful, but there is always benefit in learning to do things the hard way. And in this case, the hard way doesn’t seem to be that hard after all.</p>

<h2>Beastie Bits</h2>

<p>Meetup in Zurich #4, July edition (July 19) – Which you likely missed, but now you know to look for the August edition!<br>
The next two BSD-PL User group meetings in Warsaw have been scheduled for July 30th and Aug 9th @ 1830 CEST – Submit your topic proposals now<br>
Linux Geek Books - Humble Bundle<br>
Extend loader(8) geli support to all architectures and all disk-like devices<br>
Upgrading from a bootpool to a single encrypted pool – skip the gptzfsboot part, and manually update your EFI partition with loader.efi<br>
The pkgsrc 2018Q2 for Illumos is available with 18500+ binary packages<br>
NetBSD ARM64 Images Available with SMP for RPi3 / NanoPi / Pine64 Boards<br>
Recently released CDE 2.3.0 running on Tribblix (Illumos)<br>
An Interview With Tech &amp; Science Fiction Author Michael W Lucas<br>
A reminder : MeetBSD CFP<br>
EuroBSDCon talk acceptances have gone out, and once the tutorials are confirmed, registration will open. That will likely have happened by time you see this episode, so go register! See you in Romania<br>
Tarsnap</p>

<h2>Feedback/Questions</h2>

<p>Wilyarti - Adblocked on FreeBSD Continued…<br>
Andrew - A Question and a Story<br>
Matthew - Thanks<br>
Brian - PCI-E Controller<br>
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 255: What Are You Pointing At | BSD Now 255</title>
  <link>https://www.bsdnow.tv/255</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2267</guid>
  <pubDate>Wed, 18 Jul 2018 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ca9b19c1-e202-45d6-ac45-d0048a734c45.mp3" length="48457846" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>What ZFS blockpointers are, zero-day rewards offered, KDE on FreeBSD status, new FreeBSD core team, NetBSD WiFi refresh, poor man’s CI, and the power of Ctrl+T.</itunes:subtitle>
  <itunes:duration>1:20:27</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>What ZFS blockpointers are, zero-day rewards offered, KDE on FreeBSD status, new FreeBSD core team, NetBSD WiFi refresh, poor man’s CI, and the power of Ctrl+T.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSBlockPointers"&gt;What ZFS block pointers are and what’s in them&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I’ve mentioned ZFS block pointers in the past; for example, when I wrote about some details of ZFS DVAs, I said that DVAs are embedded in block pointers. But I’ve never really looked carefully at what is in block pointers and what that means and implies for ZFS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The very simple way to describe a ZFS block pointer is that it’s what ZFS uses in places where other filesystems would simply put a block number. Just like block numbers but unlike things like ZFS dnodes, a block pointer isn’t a separate on-disk entity; instead it’s an on disk data format and an in memory structure that shows up in other things. To quote from the (draft and old) ZFS on-disk specification (PDF):&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;A block pointer (blkptr_t) is a 128 byte ZFS structure used to physically locate, verify, and describe blocks of data on disk.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Block pointers are embedded in any ZFS on disk structure that points directly to other disk blocks, both for data and metadata. For instance, the dnode for a file contains block pointers that refer to either its data blocks (if it’s small enough) or indirect blocks, as I saw in this entry. However, as I discovered when I paid attention, most things in ZFS only point to dnodes indirectly, by giving their object number (either in a ZFS filesystem or in pool-wide metadata).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;So what’s in a block pointer itself? You can find the technical details for modern ZFS in spa.h, so I’m going to give a sort of summary. A regular block pointer contains:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;various metadata and flags about what the block pointer is for and what parts of it mean, including what type of object it points to.&lt;/li&gt;
&lt;li&gt;Up to three DVAs that say where to actually find the data on disk. There can be more than one DVA because you may have set the copies property to 2 or 3, or this may be metadata (which normally has two copies and may have more for sufficiently important metadata).&lt;/li&gt;
&lt;li&gt;The logical size (size before compression) and ‘physical’ size (the nominal size after compression) of the disk block. The physical size can do odd things and is not necessarily the asize (allocated size) for the DVA(s).&lt;/li&gt;
&lt;li&gt;The txgs that the block was born in, both logically and physically (the physical txg is apparently for dva[0]). The physical txg was added with ZFS deduplication but apparently also shows up in vdev removal.&lt;/li&gt;
&lt;li&gt;The checksum of the data the block pointer describes. This checksum implicitly covers the entire logical size of the data, and as a result you must read all of the data in order to verify it. This can be an issue on raidz vdevs or if the block had to use gang blocks.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Just like basically everything else in ZFS, block pointers don’t have an explicit checksum of their contents. Instead they’re implicitly covered by the checksum of whatever they’re embedded in; the block pointers in a dnode are covered by the overall checksum of the dnode, for example. Block pointers must include a checksum for the data they point to because such data is ‘out of line’ for the containing object.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;(The block pointers in a dnode don’t necessarily point straight to data. If there’s more than a bit of data in whatever the dnode covers, the dnode’s block pointers will instead point to some level of indirect block, which itself has some number of block pointers.)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;There is a special type of block pointer called an embedded block pointer. Embedded block pointers directly contain up to 112 bytes of data; apart from the data, they contain only the metadata fields and a logical birth txg. As with conventional block pointers, this data is implicitly covered by the checksum of the containing object.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Since block pointers directly contain the address of things on disk (in the form of DVAs), they have to change any time that address changes, which means any time ZFS does its copy on write thing. This forces a change in whatever contains the block pointer, which in turn ripples up to another block pointer (whatever points to said containing thing), and so on until we eventually reach the Meta Object Set and the uberblock. How this works is a bit complicated, but ZFS is designed to generally make this a relatively shallow change with not many levels of things involved (as I discovered recently).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;As far as I understand things, the logical birth txg of a block pointer is the transaction group in which the block pointer was allocated. Because of ZFS’s copy on write principle, this means that nothing underneath the block pointer has been updated or changed since that txg; if something changed, it would have been written to a new place on disk, which would have forced a change in at least one DVA and thus a ripple of updates that would update the logical birth txg.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;However, this doesn’t quite mean what I used to think it meant because of ZFS’s level of indirection. If you change a file by writing data to it, you will change some of the file’s block pointers, updating their logical birth txg, and you will change the file’s dnode. However, you won’t change any block pointers and thus any logical birth txgs for the filesystem directory the file is in (or anything else up the directory tree), because the directory refers to the file through its object number, not by directly pointing to its dnode. You can still use logical birth txgs to efficiently find changes from one txg to another, but you won’t necessarily get a filesystem level view of these changes; instead, as far as I can see, you will basically get a view of what object(s) in a filesystem changed (effectively, what inode numbers changed).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;(ZFS has an interesting hack to make things like ‘zfs diff’ work far more efficiently than you would expect in light of this, but that’s going to take yet another entry to cover.)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.bleepingcomputer.com/news/security/rewards-of-up-to-500-000-offered-for-freebsd-openbsd-netbsd-linux-zero-days/"&gt;Rewards of Up to $500,000 Offered for FreeBSD, OpenBSD, NetBSD, Linux Zero-Days&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Exploit broker Zerodium is offering rewards of up to $500,000 for zero-days in UNIX-based operating systems like OpenBSD, FreeBSD, NetBSD, but also for Linux distros such as Ubuntu, CentOS, Debian, and Tails.&lt;br&gt;
The offer, first advertised via Twitter earlier this week, is available as part of the company’s latest zero-day acquisition drive. Zerodium is known for buying zero-days and selling them to government agencies and law enforcement.&lt;br&gt;
The company runs a regular zero-day acquisition program through its website, but it often holds special drives with more substantial rewards when it needs zero-days of a specific category.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;BSD zero-day rewards will be on par with Linux payouts&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The US-based company held a previous drive with increased rewards for Linux zero-days in February, with rewards going as high as $45,000.&lt;br&gt;
In another zero-day acquisition drive announced on Twitter this week, the company said it was looking again for Linux zero-days, but also for exploits targeting BSD systems. This time around, rewards can go up to $500,000, for the right exploit.&lt;br&gt;
Zerodium told Bleeping Computer they’ll be aligning the temporary rewards for BSD systems with their usual payouts for Linux distros.&lt;br&gt;
The company’s usual payouts for Linux privilege escalation exploits can range from $10,000 to $30,000. Local privilege escalation (LPE) rewards can even reach $100,000 for “an exploit with an exceptional quality and coverage,” such as, for example, a Linux kernel exploit affecting all major distributions.&lt;br&gt;
Payouts for Linux remote code execution (RCE) exploits can bring in from $50,000 to $500,000 depending on the targeted software/service and its market share. The highest rewards are usually awarded for LPEs and RCEs affecting CentOS and Ubuntu distros.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Zero-day price varies based on exploitation chain&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The acquisition price of a submitted zero-day is directly tied to its requirements in terms of user interaction (no click, one click, two clicks, etc.), Zerodium said.&lt;br&gt;
Other factors include the exploit reliability, its success rate, the number of vulnerabilities chained together for the final exploit to work (more chained bugs means more chances for the exploit to break unexpectedly), and the OS configuration needed for the exploit to work (exploits are valued more if they work against default OS configs).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Zero-days in servers “can reach exceptional amounts”&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;“Price difference between systems is mostly driven by market shares,” Zerodium founder Chaouki Bekrar told Bleeping Computer via email.&lt;br&gt;
Asked about the logic behind these acquisition drives that pay increased rewards, Bekrar told Bleeping Computer the following:&lt;br&gt;
"Our aim is to always have, at any time, two or more fully functional exploits for every major software, hardware, or operating systems, meaning that from time to time we would promote a specific software/system on our social media to acquire new codes and strengthen our existing capabilities or extend them.”&lt;br&gt;
“We may also react to customers’ requests and their operational needs,” Bekrar said.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It’s becoming a crowded market&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Since Zerodium drew everyone’s attention to the exploit brokerage market in 2015, the market has gotten more and more crowded, but also more sleazy, with some companies being accused of selling zero-days to government agencies in countries with oppressive or dictatorial regimes, where they are often used against political oponents, journalists, and dissidents, instead of going after real criminals.&lt;br&gt;
The latest company who broke into the zero-day brokerage market is Crowdfense, who recently launched an acquisition program with prizes of $10 million, of which it already paid $4.5 million to researchers.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;a href="https://twitter.com/Zerodium/status/1012007051466162177"&gt;Twitter Announcement&lt;/a&gt;&lt;/p&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Digital Ocean&lt;/strong&gt;&lt;br&gt;
&lt;a href="http://do.co/bsdnow"&gt;http://do.co/bsdnow&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://euroquis.nl/bobulate/?p=1915"&gt;KDE on FreeBSD – June 2018&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The KDE-FreeBSD team (a half-dozen hardy individuals, with varying backgrounds and varying degrees of involvement depending on how employment is doing) has a status message in the #kde-freebsd channel on freenode. Right now it looks like this:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;http://FreeBSD.kde.org | Bleeding edge 
http://FreeBSD.kde.org/area51.php | Released: Qt 5.10.1, KDE SC 4.14.3, KF5 5.46.0, Applications 18.04.1, Plasma-5.12.5, Kdevelop-5.2.1, Digikam-5.9.0
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;It’s been a while since I wrote about KDE on FreeBSD, what with Calamares and third-party software happening as well. We’re better at keeping the IRC topic up-to-date than a lot of other sources of information (e.g. the FreeBSD quarterly reports, or the f.k.o website, which I’ll just dash off and update after writing this).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;In no particular order:&lt;/li&gt;
&lt;li&gt;Qt 5.10 is here, in a FrankenEngine incarnation: we still use WebEnging from Qt 5.9 because — like I’ve said before — WebEngine is such a gigantic pain in the butt to update with all the necessary patches to get it to compile.&lt;/li&gt;
&lt;li&gt;Our collection of downstream patches to Qt 5.10 is growing, slowly. None of them are upstreamable (e.g. libressl support) though.&lt;/li&gt;
&lt;li&gt;KDE Frameworks releases are generally pushed to ports within a week or two of release. Actually, now that there is a bigger stack of KDE software in FreeBSD ports the updates take longer because we have to do exp-runs.&lt;/li&gt;
&lt;li&gt;Similarly, Applications and Plasma releases are reasonably up-to-date. We dodged a bullet by not jumping on Plasma 5.13 right away, I see. Tobias is the person doing almost all of the drudge-work of these updates, he deserves a pint of something in Vienna this summer.&lt;/li&gt;
&lt;li&gt;The &lt;a href="http://freebsd.kde.org"&gt;freebsd.kde.org&lt;/a&gt; website has been slightly updated; it was terribly out-of-date.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;So we’re mostly-up-to-date, and mostly all packaged up and ready to go. Much of my day is spent in VMs packaged by other people, but it’s good to have a full KDE developer environment outside of them as well. (PS. Gotta hand it to Tomasz for &lt;a href="https://www.angrycane.com.br/wp-content/uploads/2018/06/download_flamingo_and_display.txt"&gt;the amazing application for downloading and displaying a flamingo&lt;/a&gt; … niche usecases FTW)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://lists.freebsd.org/pipermail/freebsd-announce/2018-July/001836.html"&gt;New FreeBSD Core Team Elected&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Active committers to the project have elected your tenth FreeBSD Core&lt;br&gt;
Team.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Allan Jude (allanjude)&lt;/li&gt;
&lt;li&gt;Benedict Reuschling (bcr)&lt;/li&gt;
&lt;li&gt;Brooks Davis (brooks)&lt;/li&gt;
&lt;li&gt;Hiroki Sato (hrs)&lt;/li&gt;
&lt;li&gt;Jeff Roberson (jeff)&lt;/li&gt;
&lt;li&gt;John Baldwin (jhb)&lt;/li&gt;
&lt;li&gt;Kris Moore (kmoore)&lt;/li&gt;
&lt;li&gt;Sean Chittenden (seanc)&lt;/li&gt;
&lt;li&gt;Warner Losh (imp)&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Let’s extend our gratitude to the outgoing Core Team members:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Baptiste Daroussin (bapt)&lt;/li&gt;
&lt;li&gt;Benno Rice (benno)&lt;/li&gt;
&lt;li&gt;Ed Maste (emaste)&lt;/li&gt;
&lt;li&gt;George V. Neville-Neil (gnn)&lt;/li&gt;
&lt;li&gt;Matthew Seaman (matthew)&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Matthew, after having served as the Core Team Secretary for the past&lt;br&gt;
four years, will be stepping down from that role.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The Core Team would also like to thank Dag-Erling Smørgrav for running a&lt;br&gt;
flawless election.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;To read about the responsibilities of the Core Team, refer to &lt;a href="https://www.freebsd.org/administration.html#t-core"&gt;https://www.freebsd.org/administration.html#t-core&lt;/a&gt;.&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://mail-index.netbsd.org/tech-net/2018/06/26/msg006943.html"&gt;NetBSD WiFi refresh&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The NetBSD Foundation is pleased to announce a summer 2018 contract with Philip Nelson (phil%&lt;a href="http://NetBSD.org"&gt;NetBSD.org&lt;/a&gt;@localhost) to update the IEEE 802.11 stack basing the update on the FreeBSD current code.  The goals of the project are:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Minimizing the differences between the FreeBSD and NetBSD IEEE 802.11 stack so future updates are easier.&lt;/li&gt;
&lt;li&gt;Adding support for the newer protocols 801.11/N and 802.11/AC.&lt;/li&gt;
&lt;li&gt;Improving SMP support in the IEEE 802.11 stack.&lt;/li&gt;
&lt;li&gt;Adding Virtual Access Point (VAP) support.&lt;/li&gt;
&lt;li&gt;Updating as many NIC drivers as time permits for the updated IEEE 802.11 stack and VAP changes.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Status reports will be posted to tech-net%&lt;a href="http://NetBSD.org"&gt;NetBSD.org&lt;/a&gt;@localhost every other week&lt;br&gt;
while the contract is active.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://github.com/billziss-gh/pmci"&gt;Poor Man’s CI - Hosted CI for BSD with shell scripting and duct tape&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Poor Man’s CI (PMCI - Poor Man’s Continuous Integration) is a collection of scripts that taken together work as a simple CI solution that runs on Google Cloud. While there are many advanced hosted CI systems today, and many of them are free for open source projects, none of them seem to offer a solution for the BSD operating systems (FreeBSD, NetBSD, OpenBSD, etc.)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The architecture of Poor Man’s CI is system agnostic. However in the implementation provided in this repository the only supported systems are FreeBSD and NetBSD. Support for additional systems is possible.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Poor Man’s CI runs on the Google Cloud. It is possible to set it up so that the service fits within the Google Cloud “Always Free” limits. In doing so the provided CI is not only hosted, but is also free! (Disclaimer: I am not affiliated with Google and do not otherwise endorse their products.)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;ARCHITECTURE&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A CI solution listens for “commit” (or more usually “push”) events, builds the associated repository at the appropriate place in its history and reports the results. Poor Man’s CI implements this very basic CI scenario using a simple architecture, which we present in this section.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Poor Man’s CI consists of the following components and their interactions:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Controller: Controls the overall process of accepting GitHub push events and starting builds. The Controller runs in the Cloud Functions environment and is implemented by the files in the controller source directory. It consists of the following components:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Listener: Listens for GitHub push events and posts them as work messages to the workq PubSub.&lt;/li&gt;
&lt;li&gt;Dispatcher: Receives work messages from the workq PubSub and a free instance name from the Builder Pool. It instantiates a builder instance named name in the Compute Engine environment and passes it the link of a repository to build.&lt;/li&gt;
&lt;li&gt;Collector: Receives done messages from the doneq PubSub and posts the freed instance name back to the Builder Pool.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;PubSub Topics:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;workq: Transports work messages that contain the link of the repository to build.&lt;/li&gt;
&lt;li&gt;poolq: Implements the Builder Pool, which contains the name’s of available builder instances. To acquire a builder name, pull a message from the poolq. To release a builder name, post it back into the poolq.&lt;/li&gt;
&lt;li&gt;doneq: Transports done messages (builder instance terminate and delete events). These message contain the name of freed builder instances.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;builder: A builder is a Compute Engine instance that performs a build of a repository and shuts down when the build is complete. A builder is instantiated from a VM image and a startx (startup-exit) script.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Build Logs: A Storage bucket that contains the logs of builds performed by builder instances.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Logging Sink: A Logging Sink captures builder instance terminate and delete events and posts them into the doneq.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;BUGS&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The Builder Pool is currently implemented as a PubSub; messages in the PubSub contain the names of available builder instances. Unfortunately a PubSub retains its messages for a maximum of 7 days. It is therefore possible that messages will be discarded and that your PMCI deployment will suddenly find itself out of builder instances. If this happens you can reseed the Builder Pool by running the commands below. However this is a serious BUG that should be fixed. For a related discussion see &lt;a href="https://tinyurl.com/ybkycuub"&gt;https://tinyurl.com/ybkycuub&lt;/a&gt;.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;$ ./pmci queuepost poolq builder0&lt;/code&gt;&lt;br&gt;
&lt;code&gt;# ./pmci queuepost poolq builder1&lt;/code&gt;&lt;br&gt;
&lt;code&gt;# ... repeat for as many builders as you want&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The Dispatcher is implemented as a Retry Background Cloud Function. It accepts work messages from the workq and attempts to pull a free name from the poolq. If that fails it returns an error, which instructs the infrastructure to retry. Because the infrastructure does not provide any retry controls, this currently happens immediately and the Dispatcher spins unproductively. This is currently mitigated by a “sleep” (setTimeout), but the Cloud Functions system still counts the Function as running and charges it accordingly. While this fits within the “Always Free” limits, it is something that should eventually be fixed (perhaps by the PubSub team). For a related discussion see &lt;a href="https://tinyurl.com/yb2vbwfd"&gt;https://tinyurl.com/yb2vbwfd&lt;/a&gt;.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blog.danielisz.org/2018/06/21/the-power-of-ctrlt/"&gt;The Power of Ctrl-T&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Did you know that you can check what a process is doing by pressing CTRL+T?&lt;br&gt;
Has it happened to you before that you were waiting for something to be finished that can take a lot of time, but there is no easy way to check the status. Like a dd, cp, mv and many others. All you have to do is press CTRL+T where the process is running.  This will output what’s happening and will not interrupt or mess with it in any way. This causes the operating system to output the SIGINFO signal.&lt;br&gt;
On FreeBSD it looks like this:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;ping pingtest.com
PING pingtest.com (5.22.149.135): 56 data bytes
64 bytes from 5.22.149.135: icmpseq=0 ttl=51 time=86.232 ms
64 bytes from 5.22.149.135: icmpseq=1 ttl=51 time=85.477 ms
64 bytes from 5.22.149.135: icmpseq=2 ttl=51 time=85.493 ms
64 bytes from 5.22.149.135: icmpseq=3 ttl=51 time=85.211 ms
64 bytes from 5.22.149.135: icmpseq=4 ttl=51 time=86.002 ms
load: 1.12 cmd: ping 94371 [select] 4.70r 0.00u 0.00s 0% 2500k
5/5 packets received (100.0%) 85.211 min / 85.683 avg / 86.232 max
64 bytes from 5.22.149.135: icmpseq=5 ttl=51 time=85.725 ms
64 bytes from 5.22.149.135: icmp_seq=6 ttl=51 time=85.510 ms
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;As you can see it not only outputs the name of the running command but the following parameters as well:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;94371 – PID
4.70r – since when is the process running
0.00u – user time
0.00s – system time
0% – CPU usage
2500k – resident set size of the process or RSS
``
&amp;gt; An even better example is with the following cp command:
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;cp FreeBSD-11.1-RELEASE-amd64-dvd1.iso /dev/null&lt;br&gt;
load: 0.99 cmd: cp 94412 [runnable] 1.61r 0.00u 0.39s 3% 3100k&lt;br&gt;
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&amp;gt; /dev/null 15%&lt;br&gt;
load: 0.91 cmd: cp 94412 [runnable] 2.91r 0.00u 0.80s 6% 3104k&lt;br&gt;
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&amp;gt; /dev/null 32%&lt;br&gt;
load: 0.91 cmd: cp 94412 [runnable] 4.20r 0.00u 1.23s 9% 3104k&lt;br&gt;
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&amp;gt; /dev/null 49%&lt;br&gt;
load: 0.91 cmd: cp 94412 [runnable] 5.43r 0.00u 1.64s 11% 3104k&lt;br&gt;
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&amp;gt; /dev/null 64%&lt;br&gt;
load: 1.07 cmd: cp 94412 [runnable] 6.65r 0.00u 2.05s 13% 3104k&lt;br&gt;
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&amp;gt; /dev/null 79%&lt;br&gt;
load: 1.07 cmd: cp 94412 [runnable] 7.87r 0.00u 2.43s 15% 3104k&lt;br&gt;
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&amp;gt; /dev/null 95%&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;
&amp;gt; I prcessed CTRL+T six times.  Without that, all the output would have been is the first line.
&amp;gt; Another example how the process is changing states:
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;wget &lt;a href="https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso"&gt;https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso&lt;/a&gt;&lt;br&gt;
–2018-06-17 18:47:48– &lt;a href="https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso"&gt;https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso&lt;/a&gt;&lt;br&gt;
Resolving &lt;a href="http://download.freebsd.org"&gt;download.freebsd.org&lt;/a&gt; (&lt;a href="http://download.freebsd.org"&gt;download.freebsd.org&lt;/a&gt;)… 96.47.72.72, 2610:1c1:1:606c::15:0&lt;br&gt;
Connecting to &lt;a href="http://download.freebsd.org"&gt;download.freebsd.org&lt;/a&gt; (&lt;a href="http://download.freebsd.org"&gt;download.freebsd.org&lt;/a&gt;)|96.47.72.72|:443… connected.&lt;br&gt;
HTTP request sent, awaiting response… 200 OK&lt;br&gt;
Length: 3348465664 (3.1G) [application/octet-stream]&lt;br&gt;
Saving to: ‘FreeBSD-11.1-RELEASE-amd64-dvd1.iso’&lt;/p&gt;
&lt;p&gt;FreeBSD-11.1-RELEASE-amd64-dvd1.iso 1%[&amp;gt; ] 41.04M 527KB/s eta 26m 49sload: 4.95 cmd: wget 10152 waiting 0.48u 0.72s&lt;br&gt;
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 1%[&amp;gt; ] 49.41M 659KB/s eta 25m 29sload: 12.64 cmd: wget 10152 waiting 0.55u 0.85s&lt;br&gt;
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 2%[=&amp;gt; ] 75.58M 6.31MB/s eta 20m 6s load: 11.71 cmd: wget 10152 running 0.73u 1.19s&lt;br&gt;
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 2%[=&amp;gt; ] 85.63M 6.83MB/s eta 18m 58sload: 11.71 cmd: wget 10152 waiting 0.80u 1.32s&lt;br&gt;
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 14%[==============&amp;gt; ] 460.23M 7.01MB/s eta 9m 0s 1&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;
&amp;gt; The bad news is that CTRl+T doesn’t work with Linux kernel, but you can use it on MacOS/OS-X:
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;—&amp;gt; Fetching distfiles for gmp&lt;br&gt;
—&amp;gt; Attempting to fetch gmp-6.1.2.tar.bz2 from &lt;a href="https://distfiles.macports.org/gmp"&gt;https://distfiles.macports.org/gmp&lt;/a&gt;&lt;br&gt;
—&amp;gt; Verifying checksums for gmp&lt;br&gt;
—&amp;gt; Extracting gmp&lt;br&gt;
—&amp;gt; Applying patches to gmp&lt;br&gt;
—&amp;gt; Configuring gmp&lt;br&gt;
load: 2.81 cmd: clang 74287 running 0.31u 0.28s&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;
&amp;gt; PS: If I recall correctly Feld showed me CTRL+T, thank you!
Beastie Bits
Half billion tries for a HAMMER2 bug (http://lists.dragonflybsd.org/pipermail/commits/2018-May/672263.html)
OpenBSD with various Desktops
OpenBSD 6.3 running twm window manager (https://youtu.be/v6XeC5wU2s4)
OpenBSD 6.3 jwm and rox desktop (https://youtu.be/jlSK2oi7CBc)
OpenBSD 6.3 cwm youtube video (https://youtu.be/mgqNyrP2CPs)
pf: Increase default state table size (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=336221)
***
Tarsnap
Feedback/Questions
Ben Sims - Full feed? (http://dpaste.com/3XVH91T#wrap)
Scott - Questions and Comments (http://dpaste.com/08P34YN#wrap)
Troels - Features of FreeBSD 11.2 that deserve a mention (http://dpaste.com/3DDPEC2#wrap)
Fred - Show Ideas (http://dpaste.com/296ZA0P#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
iXsystems It's all NAS (https://www.ixsystems.com/blog/its-all-nas/)
&lt;/code&gt;&lt;/pre&gt; 
</description>
  <itunes:keywords>freebsd,openbsd,netbsd,dragonflybsd,trueos,trident,hardenedbsd,tutorial,howto,guide,bsd,interview,kde,zfs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>What ZFS blockpointers are, zero-day rewards offered, KDE on FreeBSD status, new FreeBSD core team, NetBSD WiFi refresh, poor man’s CI, and the power of Ctrl+T.</p>

<p>##Headlines<br>
###<a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSBlockPointers">What ZFS block pointers are and what’s in them</a></p>

<blockquote>
<p>I’ve mentioned ZFS block pointers in the past; for example, when I wrote about some details of ZFS DVAs, I said that DVAs are embedded in block pointers. But I’ve never really looked carefully at what is in block pointers and what that means and implies for ZFS.</p>
</blockquote>

<blockquote>
<p>The very simple way to describe a ZFS block pointer is that it’s what ZFS uses in places where other filesystems would simply put a block number. Just like block numbers but unlike things like ZFS dnodes, a block pointer isn’t a separate on-disk entity; instead it’s an on disk data format and an in memory structure that shows up in other things. To quote from the (draft and old) ZFS on-disk specification (PDF):</p>
</blockquote>

<blockquote>
<p>A block pointer (blkptr_t) is a 128 byte ZFS structure used to physically locate, verify, and describe blocks of data on disk.</p>
</blockquote>

<blockquote>
<p>Block pointers are embedded in any ZFS on disk structure that points directly to other disk blocks, both for data and metadata. For instance, the dnode for a file contains block pointers that refer to either its data blocks (if it’s small enough) or indirect blocks, as I saw in this entry. However, as I discovered when I paid attention, most things in ZFS only point to dnodes indirectly, by giving their object number (either in a ZFS filesystem or in pool-wide metadata).</p>
</blockquote>

<blockquote>
<p>So what’s in a block pointer itself? You can find the technical details for modern ZFS in spa.h, so I’m going to give a sort of summary. A regular block pointer contains:</p>
</blockquote>

<ul>
<li>various metadata and flags about what the block pointer is for and what parts of it mean, including what type of object it points to.</li>
<li>Up to three DVAs that say where to actually find the data on disk. There can be more than one DVA because you may have set the copies property to 2 or 3, or this may be metadata (which normally has two copies and may have more for sufficiently important metadata).</li>
<li>The logical size (size before compression) and ‘physical’ size (the nominal size after compression) of the disk block. The physical size can do odd things and is not necessarily the asize (allocated size) for the DVA(s).</li>
<li>The txgs that the block was born in, both logically and physically (the physical txg is apparently for dva[0]). The physical txg was added with ZFS deduplication but apparently also shows up in vdev removal.</li>
<li>The checksum of the data the block pointer describes. This checksum implicitly covers the entire logical size of the data, and as a result you must read all of the data in order to verify it. This can be an issue on raidz vdevs or if the block had to use gang blocks.</li>
</ul>

<blockquote>
<p>Just like basically everything else in ZFS, block pointers don’t have an explicit checksum of their contents. Instead they’re implicitly covered by the checksum of whatever they’re embedded in; the block pointers in a dnode are covered by the overall checksum of the dnode, for example. Block pointers must include a checksum for the data they point to because such data is ‘out of line’ for the containing object.</p>
</blockquote>

<blockquote>
<p>(The block pointers in a dnode don’t necessarily point straight to data. If there’s more than a bit of data in whatever the dnode covers, the dnode’s block pointers will instead point to some level of indirect block, which itself has some number of block pointers.)</p>
</blockquote>

<blockquote>
<p>There is a special type of block pointer called an embedded block pointer. Embedded block pointers directly contain up to 112 bytes of data; apart from the data, they contain only the metadata fields and a logical birth txg. As with conventional block pointers, this data is implicitly covered by the checksum of the containing object.</p>
</blockquote>

<blockquote>
<p>Since block pointers directly contain the address of things on disk (in the form of DVAs), they have to change any time that address changes, which means any time ZFS does its copy on write thing. This forces a change in whatever contains the block pointer, which in turn ripples up to another block pointer (whatever points to said containing thing), and so on until we eventually reach the Meta Object Set and the uberblock. How this works is a bit complicated, but ZFS is designed to generally make this a relatively shallow change with not many levels of things involved (as I discovered recently).</p>
</blockquote>

<blockquote>
<p>As far as I understand things, the logical birth txg of a block pointer is the transaction group in which the block pointer was allocated. Because of ZFS’s copy on write principle, this means that nothing underneath the block pointer has been updated or changed since that txg; if something changed, it would have been written to a new place on disk, which would have forced a change in at least one DVA and thus a ripple of updates that would update the logical birth txg.</p>
</blockquote>

<blockquote>
<p>However, this doesn’t quite mean what I used to think it meant because of ZFS’s level of indirection. If you change a file by writing data to it, you will change some of the file’s block pointers, updating their logical birth txg, and you will change the file’s dnode. However, you won’t change any block pointers and thus any logical birth txgs for the filesystem directory the file is in (or anything else up the directory tree), because the directory refers to the file through its object number, not by directly pointing to its dnode. You can still use logical birth txgs to efficiently find changes from one txg to another, but you won’t necessarily get a filesystem level view of these changes; instead, as far as I can see, you will basically get a view of what object(s) in a filesystem changed (effectively, what inode numbers changed).</p>
</blockquote>

<blockquote>
<p>(ZFS has an interesting hack to make things like ‘zfs diff’ work far more efficiently than you would expect in light of this, but that’s going to take yet another entry to cover.)</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.bleepingcomputer.com/news/security/rewards-of-up-to-500-000-offered-for-freebsd-openbsd-netbsd-linux-zero-days/">Rewards of Up to $500,000 Offered for FreeBSD, OpenBSD, NetBSD, Linux Zero-Days</a></p>

<blockquote>
<p>Exploit broker Zerodium is offering rewards of up to $500,000 for zero-days in UNIX-based operating systems like OpenBSD, FreeBSD, NetBSD, but also for Linux distros such as Ubuntu, CentOS, Debian, and Tails.<br>
The offer, first advertised via Twitter earlier this week, is available as part of the company’s latest zero-day acquisition drive. Zerodium is known for buying zero-days and selling them to government agencies and law enforcement.<br>
The company runs a regular zero-day acquisition program through its website, but it often holds special drives with more substantial rewards when it needs zero-days of a specific category.</p>
</blockquote>

<ul>
<li>BSD zero-day rewards will be on par with Linux payouts</li>
</ul>

<blockquote>
<p>The US-based company held a previous drive with increased rewards for Linux zero-days in February, with rewards going as high as $45,000.<br>
In another zero-day acquisition drive announced on Twitter this week, the company said it was looking again for Linux zero-days, but also for exploits targeting BSD systems. This time around, rewards can go up to $500,000, for the right exploit.<br>
Zerodium told Bleeping Computer they’ll be aligning the temporary rewards for BSD systems with their usual payouts for Linux distros.<br>
The company’s usual payouts for Linux privilege escalation exploits can range from $10,000 to $30,000. Local privilege escalation (LPE) rewards can even reach $100,000 for “an exploit with an exceptional quality and coverage,” such as, for example, a Linux kernel exploit affecting all major distributions.<br>
Payouts for Linux remote code execution (RCE) exploits can bring in from $50,000 to $500,000 depending on the targeted software/service and its market share. The highest rewards are usually awarded for LPEs and RCEs affecting CentOS and Ubuntu distros.</p>
</blockquote>

<ul>
<li>Zero-day price varies based on exploitation chain</li>
</ul>

<blockquote>
<p>The acquisition price of a submitted zero-day is directly tied to its requirements in terms of user interaction (no click, one click, two clicks, etc.), Zerodium said.<br>
Other factors include the exploit reliability, its success rate, the number of vulnerabilities chained together for the final exploit to work (more chained bugs means more chances for the exploit to break unexpectedly), and the OS configuration needed for the exploit to work (exploits are valued more if they work against default OS configs).</p>
</blockquote>

<ul>
<li>Zero-days in servers “can reach exceptional amounts”</li>
</ul>

<blockquote>
<p>“Price difference between systems is mostly driven by market shares,” Zerodium founder Chaouki Bekrar told Bleeping Computer via email.<br>
Asked about the logic behind these acquisition drives that pay increased rewards, Bekrar told Bleeping Computer the following:<br>
&quot;Our aim is to always have, at any time, two or more fully functional exploits for every major software, hardware, or operating systems, meaning that from time to time we would promote a specific software/system on our social media to acquire new codes and strengthen our existing capabilities or extend them.”<br>
“We may also react to customers’ requests and their operational needs,” Bekrar said.</p>
</blockquote>

<ul>
<li>It’s becoming a crowded market</li>
</ul>

<blockquote>
<p>Since Zerodium drew everyone’s attention to the exploit brokerage market in 2015, the market has gotten more and more crowded, but also more sleazy, with some companies being accused of selling zero-days to government agencies in countries with oppressive or dictatorial regimes, where they are often used against political oponents, journalists, and dissidents, instead of going after real criminals.<br>
The latest company who broke into the zero-day brokerage market is Crowdfense, who recently launched an acquisition program with prizes of $10 million, of which it already paid $4.5 million to researchers.</p>
</blockquote>

<p><a href="https://twitter.com/Zerodium/status/1012007051466162177">Twitter Announcement</a></p>

<p><hr></p>

<p><strong>Digital Ocean</strong><br>
<a href="http://do.co/bsdnow">http://do.co/bsdnow</a></p>

<p>###<a href="https://euroquis.nl/bobulate/?p=1915">KDE on FreeBSD – June 2018</a></p>

<blockquote>
<p>The KDE-FreeBSD team (a half-dozen hardy individuals, with varying backgrounds and varying degrees of involvement depending on how employment is doing) has a status message in the #kde-freebsd channel on freenode. Right now it looks like this:</p>
</blockquote>

<pre><code>http://FreeBSD.kde.org | Bleeding edge 
http://FreeBSD.kde.org/area51.php | Released: Qt 5.10.1, KDE SC 4.14.3, KF5 5.46.0, Applications 18.04.1, Plasma-5.12.5, Kdevelop-5.2.1, Digikam-5.9.0
</code></pre>

<blockquote>
<p>It’s been a while since I wrote about KDE on FreeBSD, what with Calamares and third-party software happening as well. We’re better at keeping the IRC topic up-to-date than a lot of other sources of information (e.g. the FreeBSD quarterly reports, or the f.k.o website, which I’ll just dash off and update after writing this).</p>
</blockquote>

<ul>
<li>In no particular order:</li>
<li>Qt 5.10 is here, in a FrankenEngine incarnation: we still use WebEnging from Qt 5.9 because — like I’ve said before — WebEngine is such a gigantic pain in the butt to update with all the necessary patches to get it to compile.</li>
<li>Our collection of downstream patches to Qt 5.10 is growing, slowly. None of them are upstreamable (e.g. libressl support) though.</li>
<li>KDE Frameworks releases are generally pushed to ports within a week or two of release. Actually, now that there is a bigger stack of KDE software in FreeBSD ports the updates take longer because we have to do exp-runs.</li>
<li>Similarly, Applications and Plasma releases are reasonably up-to-date. We dodged a bullet by not jumping on Plasma 5.13 right away, I see. Tobias is the person doing almost all of the drudge-work of these updates, he deserves a pint of something in Vienna this summer.</li>
<li>The <a href="http://freebsd.kde.org">freebsd.kde.org</a> website has been slightly updated; it was terribly out-of-date.</li>
</ul>

<blockquote>
<p>So we’re mostly-up-to-date, and mostly all packaged up and ready to go. Much of my day is spent in VMs packaged by other people, but it’s good to have a full KDE developer environment outside of them as well. (PS. Gotta hand it to Tomasz for <a href="https://www.angrycane.com.br/wp-content/uploads/2018/06/download_flamingo_and_display.txt">the amazing application for downloading and displaying a flamingo</a> … niche usecases FTW)</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://lists.freebsd.org/pipermail/freebsd-announce/2018-July/001836.html">New FreeBSD Core Team Elected</a></p>

<blockquote>
<p>Active committers to the project have elected your tenth FreeBSD Core<br>
Team.</p>
</blockquote>

<ul>
<li>Allan Jude (allanjude)</li>
<li>Benedict Reuschling (bcr)</li>
<li>Brooks Davis (brooks)</li>
<li>Hiroki Sato (hrs)</li>
<li>Jeff Roberson (jeff)</li>
<li>John Baldwin (jhb)</li>
<li>Kris Moore (kmoore)</li>
<li>Sean Chittenden (seanc)</li>
<li>Warner Losh (imp)</li>
</ul>

<blockquote>
<p>Let’s extend our gratitude to the outgoing Core Team members:</p>
</blockquote>

<ul>
<li>Baptiste Daroussin (bapt)</li>
<li>Benno Rice (benno)</li>
<li>Ed Maste (emaste)</li>
<li>George V. Neville-Neil (gnn)</li>
<li>Matthew Seaman (matthew)</li>
</ul>

<blockquote>
<p>Matthew, after having served as the Core Team Secretary for the past<br>
four years, will be stepping down from that role.</p>
</blockquote>

<blockquote>
<p>The Core Team would also like to thank Dag-Erling Smørgrav for running a<br>
flawless election.</p>
</blockquote>

<ul>
<li>To read about the responsibilities of the Core Team, refer to <a href="https://www.freebsd.org/administration.html#t-core">https://www.freebsd.org/administration.html#t-core</a>.</li>
</ul>

<p><hr></p>

<p>###<a href="https://mail-index.netbsd.org/tech-net/2018/06/26/msg006943.html">NetBSD WiFi refresh</a></p>

<blockquote>
<p>The NetBSD Foundation is pleased to announce a summer 2018 contract with Philip Nelson (phil%<a href="http://NetBSD.org">NetBSD.org</a>@localhost) to update the IEEE 802.11 stack basing the update on the FreeBSD current code.  The goals of the project are:</p>
</blockquote>

<ul>
<li>Minimizing the differences between the FreeBSD and NetBSD IEEE 802.11 stack so future updates are easier.</li>
<li>Adding support for the newer protocols 801.11/N and 802.11/AC.</li>
<li>Improving SMP support in the IEEE 802.11 stack.</li>
<li>Adding Virtual Access Point (VAP) support.</li>
<li>Updating as many NIC drivers as time permits for the updated IEEE 802.11 stack and VAP changes.</li>
</ul>

<blockquote>
<p>Status reports will be posted to tech-net%<a href="http://NetBSD.org">NetBSD.org</a>@localhost every other week<br>
while the contract is active.</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###<a href="https://github.com/billziss-gh/pmci">Poor Man’s CI - Hosted CI for BSD with shell scripting and duct tape</a></p>

<blockquote>
<p>Poor Man’s CI (PMCI - Poor Man’s Continuous Integration) is a collection of scripts that taken together work as a simple CI solution that runs on Google Cloud. While there are many advanced hosted CI systems today, and many of them are free for open source projects, none of them seem to offer a solution for the BSD operating systems (FreeBSD, NetBSD, OpenBSD, etc.)</p>
</blockquote>

<blockquote>
<p>The architecture of Poor Man’s CI is system agnostic. However in the implementation provided in this repository the only supported systems are FreeBSD and NetBSD. Support for additional systems is possible.</p>
</blockquote>

<blockquote>
<p>Poor Man’s CI runs on the Google Cloud. It is possible to set it up so that the service fits within the Google Cloud “Always Free” limits. In doing so the provided CI is not only hosted, but is also free! (Disclaimer: I am not affiliated with Google and do not otherwise endorse their products.)</p>
</blockquote>

<ul>
<li>ARCHITECTURE</li>
</ul>

<blockquote>
<p>A CI solution listens for “commit” (or more usually “push”) events, builds the associated repository at the appropriate place in its history and reports the results. Poor Man’s CI implements this very basic CI scenario using a simple architecture, which we present in this section.</p>
</blockquote>

<ul>
<li>
<p>Poor Man’s CI consists of the following components and their interactions:</p>
</li>
<li>
<p>Controller: Controls the overall process of accepting GitHub push events and starting builds. The Controller runs in the Cloud Functions environment and is implemented by the files in the controller source directory. It consists of the following components:</p>
<ul>
<li>Listener: Listens for GitHub push events and posts them as work messages to the workq PubSub.</li>
<li>Dispatcher: Receives work messages from the workq PubSub and a free instance name from the Builder Pool. It instantiates a builder instance named name in the Compute Engine environment and passes it the link of a repository to build.</li>
<li>Collector: Receives done messages from the doneq PubSub and posts the freed instance name back to the Builder Pool.</li>
</ul>

<p></li><br>
<li></p>

<p>PubSub Topics:</p>

<ul>
<li>workq: Transports work messages that contain the link of the repository to build.</li>
<li>poolq: Implements the Builder Pool, which contains the name’s of available builder instances. To acquire a builder name, pull a message from the poolq. To release a builder name, post it back into the poolq.</li>
<li>doneq: Transports done messages (builder instance terminate and delete events). These message contain the name of freed builder instances.</li>
</ul>

<p></li><br>
<li></p>

<p>builder: A builder is a Compute Engine instance that performs a build of a repository and shuts down when the build is complete. A builder is instantiated from a VM image and a startx (startup-exit) script.</p>

<p></li><br>
<li></p>

<p>Build Logs: A Storage bucket that contains the logs of builds performed by builder instances.</p>

<p></li><br>
<li></p>

<p>Logging Sink: A Logging Sink captures builder instance terminate and delete events and posts them into the doneq.</p>

<p></li><br>
<li></p>

<p>BUGS</p>

<p></li><br>
</ul></p>

<blockquote>
<p>The Builder Pool is currently implemented as a PubSub; messages in the PubSub contain the names of available builder instances. Unfortunately a PubSub retains its messages for a maximum of 7 days. It is therefore possible that messages will be discarded and that your PMCI deployment will suddenly find itself out of builder instances. If this happens you can reseed the Builder Pool by running the commands below. However this is a serious BUG that should be fixed. For a related discussion see <a href="https://tinyurl.com/ybkycuub">https://tinyurl.com/ybkycuub</a>.</p>
</blockquote>

<p><code>$ ./pmci queue_post poolq builder0</code><br>
<code># ./pmci queue_post poolq builder1</code><br>
<code># ... repeat for as many builders as you want</code></p>

<blockquote>
<p>The Dispatcher is implemented as a Retry Background Cloud Function. It accepts work messages from the workq and attempts to pull a free name from the poolq. If that fails it returns an error, which instructs the infrastructure to retry. Because the infrastructure does not provide any retry controls, this currently happens immediately and the Dispatcher spins unproductively. This is currently mitigated by a “sleep” (setTimeout), but the Cloud Functions system still counts the Function as running and charges it accordingly. While this fits within the “Always Free” limits, it is something that should eventually be fixed (perhaps by the PubSub team). For a related discussion see <a href="https://tinyurl.com/yb2vbwfd">https://tinyurl.com/yb2vbwfd</a>.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.danielisz.org/2018/06/21/the-power-of-ctrlt/">The Power of Ctrl-T</a></p>

<blockquote>
<p>Did you know that you can check what a process is doing by pressing CTRL+T?<br>
Has it happened to you before that you were waiting for something to be finished that can take a lot of time, but there is no easy way to check the status. Like a dd, cp, mv and many others. All you have to do is press CTRL+T where the process is running.  This will output what’s happening and will not interrupt or mess with it in any way. This causes the operating system to output the SIGINFO signal.<br>
On FreeBSD it looks like this:</p>
</blockquote>

<pre><code>ping pingtest.com
PING pingtest.com (5.22.149.135): 56 data bytes
64 bytes from 5.22.149.135: icmp_seq=0 ttl=51 time=86.232 ms
64 bytes from 5.22.149.135: icmp_seq=1 ttl=51 time=85.477 ms
64 bytes from 5.22.149.135: icmp_seq=2 ttl=51 time=85.493 ms
64 bytes from 5.22.149.135: icmp_seq=3 ttl=51 time=85.211 ms
64 bytes from 5.22.149.135: icmp_seq=4 ttl=51 time=86.002 ms
load: 1.12 cmd: ping 94371 [select] 4.70r 0.00u 0.00s 0% 2500k
5/5 packets received (100.0%) 85.211 min / 85.683 avg / 86.232 max
64 bytes from 5.22.149.135: icmp_seq=5 ttl=51 time=85.725 ms
64 bytes from 5.22.149.135: icmp_seq=6 ttl=51 time=85.510 ms
</code></pre>

<blockquote>
<p>As you can see it not only outputs the name of the running command but the following parameters as well:</p>
</blockquote>

<pre><code>94371 – PID
4.70r – since when is the process running
0.00u – user time
0.00s – system time
0% – CPU usage
2500k – resident set size of the process or RSS
``

&gt; An even better example is with the following cp command:

</code></pre>

<p>cp FreeBSD-11.1-RELEASE-amd64-dvd1.iso /dev/null<br>
load: 0.99 cmd: cp 94412 [runnable] 1.61r 0.00u 0.39s 3% 3100k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 15%<br>
load: 0.91 cmd: cp 94412 [runnable] 2.91r 0.00u 0.80s 6% 3104k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 32%<br>
load: 0.91 cmd: cp 94412 [runnable] 4.20r 0.00u 1.23s 9% 3104k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 49%<br>
load: 0.91 cmd: cp 94412 [runnable] 5.43r 0.00u 1.64s 11% 3104k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 64%<br>
load: 1.07 cmd: cp 94412 [runnable] 6.65r 0.00u 2.05s 13% 3104k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 79%<br>
load: 1.07 cmd: cp 94412 [runnable] 7.87r 0.00u 2.43s 15% 3104k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 95%</p>

<pre><code>
&gt; I prcessed CTRL+T six times.  Without that, all the output would have been is the first line.

&gt; Another example how the process is changing states:

</code></pre>

<p>wget <a href="https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso">https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso</a><br>
–2018-06-17 18:47:48– <a href="https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso">https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso</a><br>
Resolving <a href="http://download.freebsd.org">download.freebsd.org</a> (<a href="http://download.freebsd.org">download.freebsd.org</a>)… 96.47.72.72, 2610:1c1:1:606c::15:0<br>
Connecting to <a href="http://download.freebsd.org">download.freebsd.org</a> (<a href="http://download.freebsd.org">download.freebsd.org</a>)|96.47.72.72|:443… connected.<br>
HTTP request sent, awaiting response… 200 OK<br>
Length: 3348465664 (3.1G) [application/octet-stream]<br>
Saving to: ‘FreeBSD-11.1-RELEASE-amd64-dvd1.iso’</p>

<p>FreeBSD-11.1-RELEASE-amd64-dvd1.iso 1%[&gt; ] 41.04M 527KB/s eta 26m 49sload: 4.95 cmd: wget 10152 waiting 0.48u 0.72s<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 1%[&gt; ] 49.41M 659KB/s eta 25m 29sload: 12.64 cmd: wget 10152 waiting 0.55u 0.85s<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 2%[=&gt; ] 75.58M 6.31MB/s eta 20m 6s load: 11.71 cmd: wget 10152 running 0.73u 1.19s<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 2%[=&gt; ] 85.63M 6.83MB/s eta 18m 58sload: 11.71 cmd: wget 10152 waiting 0.80u 1.32s<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 14%[==============&gt; ] 460.23M 7.01MB/s eta 9m 0s 1</p>

<pre><code>
&gt; The bad news is that CTRl+T doesn’t work with Linux kernel, but you can use it on MacOS/OS-X:

</code></pre>

<p>—&gt; Fetching distfiles for gmp<br>
—&gt; Attempting to fetch gmp-6.1.2.tar.bz2 from <a href="https://distfiles.macports.org/gmp">https://distfiles.macports.org/gmp</a><br>
—&gt; Verifying checksums for gmp<br>
—&gt; Extracting gmp<br>
—&gt; Applying patches to gmp<br>
—&gt; Configuring gmp<br>
load: 2.81 cmd: clang 74287 running 0.31u 0.28s</p>

<pre><code>
&gt; PS: If I recall correctly Feld showed me CTRL+T, thank you!

***


##Beastie Bits
+ [Half billion tries for a HAMMER2 bug](http://lists.dragonflybsd.org/pipermail/commits/2018-May/672263.html)
+ OpenBSD with various Desktops
 + [OpenBSD 6.3 running twm window manager](https://youtu.be/v6XeC5wU2s4)
 + [OpenBSD 6.3 jwm and rox desktop](https://youtu.be/jlSK2oi7CBc)
 + [OpenBSD 6.3 cwm youtube video](https://youtu.be/mgqNyrP2CPs)
+ [pf: Increase default state table size](https://svnweb.freebsd.org/base?view=revision&amp;revision=336221)
***

**Tarsnap**

##Feedback/Questions
+ Ben Sims - [Full feed?](http://dpaste.com/3XVH91T#wrap)
+ Scott - [Questions and Comments](http://dpaste.com/08P34YN#wrap)
+ Troels - [Features of FreeBSD 11.2 that deserve a mention](http://dpaste.com/3DDPEC2#wrap)
+ [Fred - Show Ideas](http://dpaste.com/296ZA0P#wrap)
***

- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)
***

***

iXsystems [It's all NAS](https://www.ixsystems.com/blog/its-all-nas/)
</code></pre>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>What ZFS blockpointers are, zero-day rewards offered, KDE on FreeBSD status, new FreeBSD core team, NetBSD WiFi refresh, poor man’s CI, and the power of Ctrl+T.</p>

<p>##Headlines<br>
###<a href="https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSBlockPointers">What ZFS block pointers are and what’s in them</a></p>

<blockquote>
<p>I’ve mentioned ZFS block pointers in the past; for example, when I wrote about some details of ZFS DVAs, I said that DVAs are embedded in block pointers. But I’ve never really looked carefully at what is in block pointers and what that means and implies for ZFS.</p>
</blockquote>

<blockquote>
<p>The very simple way to describe a ZFS block pointer is that it’s what ZFS uses in places where other filesystems would simply put a block number. Just like block numbers but unlike things like ZFS dnodes, a block pointer isn’t a separate on-disk entity; instead it’s an on disk data format and an in memory structure that shows up in other things. To quote from the (draft and old) ZFS on-disk specification (PDF):</p>
</blockquote>

<blockquote>
<p>A block pointer (blkptr_t) is a 128 byte ZFS structure used to physically locate, verify, and describe blocks of data on disk.</p>
</blockquote>

<blockquote>
<p>Block pointers are embedded in any ZFS on disk structure that points directly to other disk blocks, both for data and metadata. For instance, the dnode for a file contains block pointers that refer to either its data blocks (if it’s small enough) or indirect blocks, as I saw in this entry. However, as I discovered when I paid attention, most things in ZFS only point to dnodes indirectly, by giving their object number (either in a ZFS filesystem or in pool-wide metadata).</p>
</blockquote>

<blockquote>
<p>So what’s in a block pointer itself? You can find the technical details for modern ZFS in spa.h, so I’m going to give a sort of summary. A regular block pointer contains:</p>
</blockquote>

<ul>
<li>various metadata and flags about what the block pointer is for and what parts of it mean, including what type of object it points to.</li>
<li>Up to three DVAs that say where to actually find the data on disk. There can be more than one DVA because you may have set the copies property to 2 or 3, or this may be metadata (which normally has two copies and may have more for sufficiently important metadata).</li>
<li>The logical size (size before compression) and ‘physical’ size (the nominal size after compression) of the disk block. The physical size can do odd things and is not necessarily the asize (allocated size) for the DVA(s).</li>
<li>The txgs that the block was born in, both logically and physically (the physical txg is apparently for dva[0]). The physical txg was added with ZFS deduplication but apparently also shows up in vdev removal.</li>
<li>The checksum of the data the block pointer describes. This checksum implicitly covers the entire logical size of the data, and as a result you must read all of the data in order to verify it. This can be an issue on raidz vdevs or if the block had to use gang blocks.</li>
</ul>

<blockquote>
<p>Just like basically everything else in ZFS, block pointers don’t have an explicit checksum of their contents. Instead they’re implicitly covered by the checksum of whatever they’re embedded in; the block pointers in a dnode are covered by the overall checksum of the dnode, for example. Block pointers must include a checksum for the data they point to because such data is ‘out of line’ for the containing object.</p>
</blockquote>

<blockquote>
<p>(The block pointers in a dnode don’t necessarily point straight to data. If there’s more than a bit of data in whatever the dnode covers, the dnode’s block pointers will instead point to some level of indirect block, which itself has some number of block pointers.)</p>
</blockquote>

<blockquote>
<p>There is a special type of block pointer called an embedded block pointer. Embedded block pointers directly contain up to 112 bytes of data; apart from the data, they contain only the metadata fields and a logical birth txg. As with conventional block pointers, this data is implicitly covered by the checksum of the containing object.</p>
</blockquote>

<blockquote>
<p>Since block pointers directly contain the address of things on disk (in the form of DVAs), they have to change any time that address changes, which means any time ZFS does its copy on write thing. This forces a change in whatever contains the block pointer, which in turn ripples up to another block pointer (whatever points to said containing thing), and so on until we eventually reach the Meta Object Set and the uberblock. How this works is a bit complicated, but ZFS is designed to generally make this a relatively shallow change with not many levels of things involved (as I discovered recently).</p>
</blockquote>

<blockquote>
<p>As far as I understand things, the logical birth txg of a block pointer is the transaction group in which the block pointer was allocated. Because of ZFS’s copy on write principle, this means that nothing underneath the block pointer has been updated or changed since that txg; if something changed, it would have been written to a new place on disk, which would have forced a change in at least one DVA and thus a ripple of updates that would update the logical birth txg.</p>
</blockquote>

<blockquote>
<p>However, this doesn’t quite mean what I used to think it meant because of ZFS’s level of indirection. If you change a file by writing data to it, you will change some of the file’s block pointers, updating their logical birth txg, and you will change the file’s dnode. However, you won’t change any block pointers and thus any logical birth txgs for the filesystem directory the file is in (or anything else up the directory tree), because the directory refers to the file through its object number, not by directly pointing to its dnode. You can still use logical birth txgs to efficiently find changes from one txg to another, but you won’t necessarily get a filesystem level view of these changes; instead, as far as I can see, you will basically get a view of what object(s) in a filesystem changed (effectively, what inode numbers changed).</p>
</blockquote>

<blockquote>
<p>(ZFS has an interesting hack to make things like ‘zfs diff’ work far more efficiently than you would expect in light of this, but that’s going to take yet another entry to cover.)</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.bleepingcomputer.com/news/security/rewards-of-up-to-500-000-offered-for-freebsd-openbsd-netbsd-linux-zero-days/">Rewards of Up to $500,000 Offered for FreeBSD, OpenBSD, NetBSD, Linux Zero-Days</a></p>

<blockquote>
<p>Exploit broker Zerodium is offering rewards of up to $500,000 for zero-days in UNIX-based operating systems like OpenBSD, FreeBSD, NetBSD, but also for Linux distros such as Ubuntu, CentOS, Debian, and Tails.<br>
The offer, first advertised via Twitter earlier this week, is available as part of the company’s latest zero-day acquisition drive. Zerodium is known for buying zero-days and selling them to government agencies and law enforcement.<br>
The company runs a regular zero-day acquisition program through its website, but it often holds special drives with more substantial rewards when it needs zero-days of a specific category.</p>
</blockquote>

<ul>
<li>BSD zero-day rewards will be on par with Linux payouts</li>
</ul>

<blockquote>
<p>The US-based company held a previous drive with increased rewards for Linux zero-days in February, with rewards going as high as $45,000.<br>
In another zero-day acquisition drive announced on Twitter this week, the company said it was looking again for Linux zero-days, but also for exploits targeting BSD systems. This time around, rewards can go up to $500,000, for the right exploit.<br>
Zerodium told Bleeping Computer they’ll be aligning the temporary rewards for BSD systems with their usual payouts for Linux distros.<br>
The company’s usual payouts for Linux privilege escalation exploits can range from $10,000 to $30,000. Local privilege escalation (LPE) rewards can even reach $100,000 for “an exploit with an exceptional quality and coverage,” such as, for example, a Linux kernel exploit affecting all major distributions.<br>
Payouts for Linux remote code execution (RCE) exploits can bring in from $50,000 to $500,000 depending on the targeted software/service and its market share. The highest rewards are usually awarded for LPEs and RCEs affecting CentOS and Ubuntu distros.</p>
</blockquote>

<ul>
<li>Zero-day price varies based on exploitation chain</li>
</ul>

<blockquote>
<p>The acquisition price of a submitted zero-day is directly tied to its requirements in terms of user interaction (no click, one click, two clicks, etc.), Zerodium said.<br>
Other factors include the exploit reliability, its success rate, the number of vulnerabilities chained together for the final exploit to work (more chained bugs means more chances for the exploit to break unexpectedly), and the OS configuration needed for the exploit to work (exploits are valued more if they work against default OS configs).</p>
</blockquote>

<ul>
<li>Zero-days in servers “can reach exceptional amounts”</li>
</ul>

<blockquote>
<p>“Price difference between systems is mostly driven by market shares,” Zerodium founder Chaouki Bekrar told Bleeping Computer via email.<br>
Asked about the logic behind these acquisition drives that pay increased rewards, Bekrar told Bleeping Computer the following:<br>
&quot;Our aim is to always have, at any time, two or more fully functional exploits for every major software, hardware, or operating systems, meaning that from time to time we would promote a specific software/system on our social media to acquire new codes and strengthen our existing capabilities or extend them.”<br>
“We may also react to customers’ requests and their operational needs,” Bekrar said.</p>
</blockquote>

<ul>
<li>It’s becoming a crowded market</li>
</ul>

<blockquote>
<p>Since Zerodium drew everyone’s attention to the exploit brokerage market in 2015, the market has gotten more and more crowded, but also more sleazy, with some companies being accused of selling zero-days to government agencies in countries with oppressive or dictatorial regimes, where they are often used against political oponents, journalists, and dissidents, instead of going after real criminals.<br>
The latest company who broke into the zero-day brokerage market is Crowdfense, who recently launched an acquisition program with prizes of $10 million, of which it already paid $4.5 million to researchers.</p>
</blockquote>

<p><a href="https://twitter.com/Zerodium/status/1012007051466162177">Twitter Announcement</a></p>

<p><hr></p>

<p><strong>Digital Ocean</strong><br>
<a href="http://do.co/bsdnow">http://do.co/bsdnow</a></p>

<p>###<a href="https://euroquis.nl/bobulate/?p=1915">KDE on FreeBSD – June 2018</a></p>

<blockquote>
<p>The KDE-FreeBSD team (a half-dozen hardy individuals, with varying backgrounds and varying degrees of involvement depending on how employment is doing) has a status message in the #kde-freebsd channel on freenode. Right now it looks like this:</p>
</blockquote>

<pre><code>http://FreeBSD.kde.org | Bleeding edge 
http://FreeBSD.kde.org/area51.php | Released: Qt 5.10.1, KDE SC 4.14.3, KF5 5.46.0, Applications 18.04.1, Plasma-5.12.5, Kdevelop-5.2.1, Digikam-5.9.0
</code></pre>

<blockquote>
<p>It’s been a while since I wrote about KDE on FreeBSD, what with Calamares and third-party software happening as well. We’re better at keeping the IRC topic up-to-date than a lot of other sources of information (e.g. the FreeBSD quarterly reports, or the f.k.o website, which I’ll just dash off and update after writing this).</p>
</blockquote>

<ul>
<li>In no particular order:</li>
<li>Qt 5.10 is here, in a FrankenEngine incarnation: we still use WebEnging from Qt 5.9 because — like I’ve said before — WebEngine is such a gigantic pain in the butt to update with all the necessary patches to get it to compile.</li>
<li>Our collection of downstream patches to Qt 5.10 is growing, slowly. None of them are upstreamable (e.g. libressl support) though.</li>
<li>KDE Frameworks releases are generally pushed to ports within a week or two of release. Actually, now that there is a bigger stack of KDE software in FreeBSD ports the updates take longer because we have to do exp-runs.</li>
<li>Similarly, Applications and Plasma releases are reasonably up-to-date. We dodged a bullet by not jumping on Plasma 5.13 right away, I see. Tobias is the person doing almost all of the drudge-work of these updates, he deserves a pint of something in Vienna this summer.</li>
<li>The <a href="http://freebsd.kde.org">freebsd.kde.org</a> website has been slightly updated; it was terribly out-of-date.</li>
</ul>

<blockquote>
<p>So we’re mostly-up-to-date, and mostly all packaged up and ready to go. Much of my day is spent in VMs packaged by other people, but it’s good to have a full KDE developer environment outside of them as well. (PS. Gotta hand it to Tomasz for <a href="https://www.angrycane.com.br/wp-content/uploads/2018/06/download_flamingo_and_display.txt">the amazing application for downloading and displaying a flamingo</a> … niche usecases FTW)</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://lists.freebsd.org/pipermail/freebsd-announce/2018-July/001836.html">New FreeBSD Core Team Elected</a></p>

<blockquote>
<p>Active committers to the project have elected your tenth FreeBSD Core<br>
Team.</p>
</blockquote>

<ul>
<li>Allan Jude (allanjude)</li>
<li>Benedict Reuschling (bcr)</li>
<li>Brooks Davis (brooks)</li>
<li>Hiroki Sato (hrs)</li>
<li>Jeff Roberson (jeff)</li>
<li>John Baldwin (jhb)</li>
<li>Kris Moore (kmoore)</li>
<li>Sean Chittenden (seanc)</li>
<li>Warner Losh (imp)</li>
</ul>

<blockquote>
<p>Let’s extend our gratitude to the outgoing Core Team members:</p>
</blockquote>

<ul>
<li>Baptiste Daroussin (bapt)</li>
<li>Benno Rice (benno)</li>
<li>Ed Maste (emaste)</li>
<li>George V. Neville-Neil (gnn)</li>
<li>Matthew Seaman (matthew)</li>
</ul>

<blockquote>
<p>Matthew, after having served as the Core Team Secretary for the past<br>
four years, will be stepping down from that role.</p>
</blockquote>

<blockquote>
<p>The Core Team would also like to thank Dag-Erling Smørgrav for running a<br>
flawless election.</p>
</blockquote>

<ul>
<li>To read about the responsibilities of the Core Team, refer to <a href="https://www.freebsd.org/administration.html#t-core">https://www.freebsd.org/administration.html#t-core</a>.</li>
</ul>

<p><hr></p>

<p>###<a href="https://mail-index.netbsd.org/tech-net/2018/06/26/msg006943.html">NetBSD WiFi refresh</a></p>

<blockquote>
<p>The NetBSD Foundation is pleased to announce a summer 2018 contract with Philip Nelson (phil%<a href="http://NetBSD.org">NetBSD.org</a>@localhost) to update the IEEE 802.11 stack basing the update on the FreeBSD current code.  The goals of the project are:</p>
</blockquote>

<ul>
<li>Minimizing the differences between the FreeBSD and NetBSD IEEE 802.11 stack so future updates are easier.</li>
<li>Adding support for the newer protocols 801.11/N and 802.11/AC.</li>
<li>Improving SMP support in the IEEE 802.11 stack.</li>
<li>Adding Virtual Access Point (VAP) support.</li>
<li>Updating as many NIC drivers as time permits for the updated IEEE 802.11 stack and VAP changes.</li>
</ul>

<blockquote>
<p>Status reports will be posted to tech-net%<a href="http://NetBSD.org">NetBSD.org</a>@localhost every other week<br>
while the contract is active.</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###<a href="https://github.com/billziss-gh/pmci">Poor Man’s CI - Hosted CI for BSD with shell scripting and duct tape</a></p>

<blockquote>
<p>Poor Man’s CI (PMCI - Poor Man’s Continuous Integration) is a collection of scripts that taken together work as a simple CI solution that runs on Google Cloud. While there are many advanced hosted CI systems today, and many of them are free for open source projects, none of them seem to offer a solution for the BSD operating systems (FreeBSD, NetBSD, OpenBSD, etc.)</p>
</blockquote>

<blockquote>
<p>The architecture of Poor Man’s CI is system agnostic. However in the implementation provided in this repository the only supported systems are FreeBSD and NetBSD. Support for additional systems is possible.</p>
</blockquote>

<blockquote>
<p>Poor Man’s CI runs on the Google Cloud. It is possible to set it up so that the service fits within the Google Cloud “Always Free” limits. In doing so the provided CI is not only hosted, but is also free! (Disclaimer: I am not affiliated with Google and do not otherwise endorse their products.)</p>
</blockquote>

<ul>
<li>ARCHITECTURE</li>
</ul>

<blockquote>
<p>A CI solution listens for “commit” (or more usually “push”) events, builds the associated repository at the appropriate place in its history and reports the results. Poor Man’s CI implements this very basic CI scenario using a simple architecture, which we present in this section.</p>
</blockquote>

<ul>
<li>
<p>Poor Man’s CI consists of the following components and their interactions:</p>
</li>
<li>
<p>Controller: Controls the overall process of accepting GitHub push events and starting builds. The Controller runs in the Cloud Functions environment and is implemented by the files in the controller source directory. It consists of the following components:</p>
<ul>
<li>Listener: Listens for GitHub push events and posts them as work messages to the workq PubSub.</li>
<li>Dispatcher: Receives work messages from the workq PubSub and a free instance name from the Builder Pool. It instantiates a builder instance named name in the Compute Engine environment and passes it the link of a repository to build.</li>
<li>Collector: Receives done messages from the doneq PubSub and posts the freed instance name back to the Builder Pool.</li>
</ul>

<p></li><br>
<li></p>

<p>PubSub Topics:</p>

<ul>
<li>workq: Transports work messages that contain the link of the repository to build.</li>
<li>poolq: Implements the Builder Pool, which contains the name’s of available builder instances. To acquire a builder name, pull a message from the poolq. To release a builder name, post it back into the poolq.</li>
<li>doneq: Transports done messages (builder instance terminate and delete events). These message contain the name of freed builder instances.</li>
</ul>

<p></li><br>
<li></p>

<p>builder: A builder is a Compute Engine instance that performs a build of a repository and shuts down when the build is complete. A builder is instantiated from a VM image and a startx (startup-exit) script.</p>

<p></li><br>
<li></p>

<p>Build Logs: A Storage bucket that contains the logs of builds performed by builder instances.</p>

<p></li><br>
<li></p>

<p>Logging Sink: A Logging Sink captures builder instance terminate and delete events and posts them into the doneq.</p>

<p></li><br>
<li></p>

<p>BUGS</p>

<p></li><br>
</ul></p>

<blockquote>
<p>The Builder Pool is currently implemented as a PubSub; messages in the PubSub contain the names of available builder instances. Unfortunately a PubSub retains its messages for a maximum of 7 days. It is therefore possible that messages will be discarded and that your PMCI deployment will suddenly find itself out of builder instances. If this happens you can reseed the Builder Pool by running the commands below. However this is a serious BUG that should be fixed. For a related discussion see <a href="https://tinyurl.com/ybkycuub">https://tinyurl.com/ybkycuub</a>.</p>
</blockquote>

<p><code>$ ./pmci queue_post poolq builder0</code><br>
<code># ./pmci queue_post poolq builder1</code><br>
<code># ... repeat for as many builders as you want</code></p>

<blockquote>
<p>The Dispatcher is implemented as a Retry Background Cloud Function. It accepts work messages from the workq and attempts to pull a free name from the poolq. If that fails it returns an error, which instructs the infrastructure to retry. Because the infrastructure does not provide any retry controls, this currently happens immediately and the Dispatcher spins unproductively. This is currently mitigated by a “sleep” (setTimeout), but the Cloud Functions system still counts the Function as running and charges it accordingly. While this fits within the “Always Free” limits, it is something that should eventually be fixed (perhaps by the PubSub team). For a related discussion see <a href="https://tinyurl.com/yb2vbwfd">https://tinyurl.com/yb2vbwfd</a>.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.danielisz.org/2018/06/21/the-power-of-ctrlt/">The Power of Ctrl-T</a></p>

<blockquote>
<p>Did you know that you can check what a process is doing by pressing CTRL+T?<br>
Has it happened to you before that you were waiting for something to be finished that can take a lot of time, but there is no easy way to check the status. Like a dd, cp, mv and many others. All you have to do is press CTRL+T where the process is running.  This will output what’s happening and will not interrupt or mess with it in any way. This causes the operating system to output the SIGINFO signal.<br>
On FreeBSD it looks like this:</p>
</blockquote>

<pre><code>ping pingtest.com
PING pingtest.com (5.22.149.135): 56 data bytes
64 bytes from 5.22.149.135: icmp_seq=0 ttl=51 time=86.232 ms
64 bytes from 5.22.149.135: icmp_seq=1 ttl=51 time=85.477 ms
64 bytes from 5.22.149.135: icmp_seq=2 ttl=51 time=85.493 ms
64 bytes from 5.22.149.135: icmp_seq=3 ttl=51 time=85.211 ms
64 bytes from 5.22.149.135: icmp_seq=4 ttl=51 time=86.002 ms
load: 1.12 cmd: ping 94371 [select] 4.70r 0.00u 0.00s 0% 2500k
5/5 packets received (100.0%) 85.211 min / 85.683 avg / 86.232 max
64 bytes from 5.22.149.135: icmp_seq=5 ttl=51 time=85.725 ms
64 bytes from 5.22.149.135: icmp_seq=6 ttl=51 time=85.510 ms
</code></pre>

<blockquote>
<p>As you can see it not only outputs the name of the running command but the following parameters as well:</p>
</blockquote>

<pre><code>94371 – PID
4.70r – since when is the process running
0.00u – user time
0.00s – system time
0% – CPU usage
2500k – resident set size of the process or RSS
``

&gt; An even better example is with the following cp command:

</code></pre>

<p>cp FreeBSD-11.1-RELEASE-amd64-dvd1.iso /dev/null<br>
load: 0.99 cmd: cp 94412 [runnable] 1.61r 0.00u 0.39s 3% 3100k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 15%<br>
load: 0.91 cmd: cp 94412 [runnable] 2.91r 0.00u 0.80s 6% 3104k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 32%<br>
load: 0.91 cmd: cp 94412 [runnable] 4.20r 0.00u 1.23s 9% 3104k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 49%<br>
load: 0.91 cmd: cp 94412 [runnable] 5.43r 0.00u 1.64s 11% 3104k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 64%<br>
load: 1.07 cmd: cp 94412 [runnable] 6.65r 0.00u 2.05s 13% 3104k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 79%<br>
load: 1.07 cmd: cp 94412 [runnable] 7.87r 0.00u 2.43s 15% 3104k<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 95%</p>

<pre><code>
&gt; I prcessed CTRL+T six times.  Without that, all the output would have been is the first line.

&gt; Another example how the process is changing states:

</code></pre>

<p>wget <a href="https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso">https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso</a><br>
–2018-06-17 18:47:48– <a href="https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso">https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso</a><br>
Resolving <a href="http://download.freebsd.org">download.freebsd.org</a> (<a href="http://download.freebsd.org">download.freebsd.org</a>)… 96.47.72.72, 2610:1c1:1:606c::15:0<br>
Connecting to <a href="http://download.freebsd.org">download.freebsd.org</a> (<a href="http://download.freebsd.org">download.freebsd.org</a>)|96.47.72.72|:443… connected.<br>
HTTP request sent, awaiting response… 200 OK<br>
Length: 3348465664 (3.1G) [application/octet-stream]<br>
Saving to: ‘FreeBSD-11.1-RELEASE-amd64-dvd1.iso’</p>

<p>FreeBSD-11.1-RELEASE-amd64-dvd1.iso 1%[&gt; ] 41.04M 527KB/s eta 26m 49sload: 4.95 cmd: wget 10152 waiting 0.48u 0.72s<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 1%[&gt; ] 49.41M 659KB/s eta 25m 29sload: 12.64 cmd: wget 10152 waiting 0.55u 0.85s<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 2%[=&gt; ] 75.58M 6.31MB/s eta 20m 6s load: 11.71 cmd: wget 10152 running 0.73u 1.19s<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 2%[=&gt; ] 85.63M 6.83MB/s eta 18m 58sload: 11.71 cmd: wget 10152 waiting 0.80u 1.32s<br>
FreeBSD-11.1-RELEASE-amd64-dvd1.iso 14%[==============&gt; ] 460.23M 7.01MB/s eta 9m 0s 1</p>

<pre><code>
&gt; The bad news is that CTRl+T doesn’t work with Linux kernel, but you can use it on MacOS/OS-X:

</code></pre>

<p>—&gt; Fetching distfiles for gmp<br>
—&gt; Attempting to fetch gmp-6.1.2.tar.bz2 from <a href="https://distfiles.macports.org/gmp">https://distfiles.macports.org/gmp</a><br>
—&gt; Verifying checksums for gmp<br>
—&gt; Extracting gmp<br>
—&gt; Applying patches to gmp<br>
—&gt; Configuring gmp<br>
load: 2.81 cmd: clang 74287 running 0.31u 0.28s</p>

<pre><code>
&gt; PS: If I recall correctly Feld showed me CTRL+T, thank you!

***


##Beastie Bits
+ [Half billion tries for a HAMMER2 bug](http://lists.dragonflybsd.org/pipermail/commits/2018-May/672263.html)
+ OpenBSD with various Desktops
 + [OpenBSD 6.3 running twm window manager](https://youtu.be/v6XeC5wU2s4)
 + [OpenBSD 6.3 jwm and rox desktop](https://youtu.be/jlSK2oi7CBc)
 + [OpenBSD 6.3 cwm youtube video](https://youtu.be/mgqNyrP2CPs)
+ [pf: Increase default state table size](https://svnweb.freebsd.org/base?view=revision&amp;revision=336221)
***

**Tarsnap**

##Feedback/Questions
+ Ben Sims - [Full feed?](http://dpaste.com/3XVH91T#wrap)
+ Scott - [Questions and Comments](http://dpaste.com/08P34YN#wrap)
+ Troels - [Features of FreeBSD 11.2 that deserve a mention](http://dpaste.com/3DDPEC2#wrap)
+ [Fred - Show Ideas](http://dpaste.com/296ZA0P#wrap)
***

- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)
***

***

iXsystems [It's all NAS](https://www.ixsystems.com/blog/its-all-nas/)
</code></pre>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 254: Bare the OS | BSD Now 254</title>
  <link>https://www.bsdnow.tv/254</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2259</guid>
  <pubDate>Thu, 12 Jul 2018 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d28fb670-e841-4f88-b58f-768d8876f126.mp3" length="54900530" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Control flow integrity with HardenedBSD, fixing bufferbloat with OpenBSD’s pf, Bareos Backup Server on FreeBSD, MeetBSD CfP, crypto simplified interface, twitter gems, interesting BSD commits, and more.</itunes:subtitle>
  <itunes:duration>1:31:23</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Control flow integrity with HardenedBSD, fixing bufferbloat with OpenBSD’s pf, Bareos Backup Server on FreeBSD, MeetBSD CfP, crypto simplified interface, twitter gems, interesting BSD commits, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://vermaden.wordpress.com/2018/06/07/silent-fanless-freebsd-desktop-server/"&gt;Silent Fanless FreeBSD Desktop/Server&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Today I will write about silent fanless FreeBSD desktop or server computer … or NAS … or you name it, it can have multa##Headlines&lt;br&gt;
###&lt;a href="https://github.com/lattera/articles/blob/master/hardenedbsd/2018-05-26_cross-dso-cfi/article.md"&gt;Cross-DSO CFI in HardenedBSD&lt;/a&gt;&lt;br&gt;
Control Flow Integrity, or CFI, raises the bar for attackers aiming to hijack control flow and execute arbitrary code. The llvm compiler toolchain, included and used by default in HardenedBSD 12-CURRENT/amd64, supports forward-edge CFI. Backward-edge CFI support is gained via a tangential feature called SafeStack. Cross-DSO CFI builds upon ASLR and PaX NOEXEC for effectiveness.&lt;br&gt;
HardenedBSD supports non-Cross-DSO CFI in base for 12-CURRENT/amd64 and has it enabled for a few individual ports. The term “non-Cross-DSO CFI” means that CFI is enabled for code within an application’s codebase, but not for the shared libraries it depends on. Supporting non-Cross-DSO CFI is an important initial milestone for supporting Cross-DSO CFI, or CFI applied to both shared libraries and applications.&lt;br&gt;
This article discusses where HardenedBSD stands with regards to Cross-DSO CFI in base. We have made a lot of progress, yet we’re not even half-way there.&lt;br&gt;
Brace yourself: This article is going to be full of references to “Cross-DSO CFI.” Make a drinking game out of it. Or don’t. It’s your call. ;)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Using More llvm Toolchain Components&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;CFI requires compiling source files with Link-Time Optimization (LTO). I remembered hearing a few years back that llvm developers were able to compile the entirety of FreeBSD’s source code with LTO. Compiling with LTO produces intermediate object files as LLVM IR bitcode instead of ELF objects.&lt;br&gt;
In March of 2017, we started compiling all applications with LTO and non-Cross-DSO CFI. This also enabled ld.lld as the default linker in base since CFI requires lld. Commit f38b51668efcd53b8146789010611a4632cafade made the switch to ld.lld as the default linker while enabling non-Cross-DSO CFI at the same time.&lt;br&gt;
Building libraries in base requires applications like ar, ranlib, nm, and objdump. In FreeBSD 12-CURRENT, ar and ranlib are known as “BSD ar” and “BSD ranlib.” In fact, ar and ranlib are the same applications. One is hardlinked to another and the application changes behavior depending on arvgv[0] ending in “ranlib”. The ar, nm, and objdump used in FreeBSD do not support LLVM IR bitcode object files.&lt;br&gt;
In preparation for Cross-DSO CFI support, commit fe4bb0104fc75c7216a6dafe2d7db0e3f5fe8257 in October 2017 saw HardenedBSD switching ar, ranlib, nm, and objdump to their respective llvm components. The llvm versions due support LLVM IR bitcode object files (surprise!) There has been some fallout in the ports tree and we’ve added LLVM_AR_UNSAFE and friends to help transition those ports that dislike llvm-ar, llvm-ranlib, llvm-nm, and llvm-objdump.&lt;br&gt;
With ld.lld, llvm-ar, llvm-ranlib, llvm-nm, and llvm-objdump the default, HardenedBSD has effectively switched to a full llvm compiler toolchain in 12-CURRENT/amd64.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Building Libraries With LTO&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The primary 12-CURRENT development branch in HardenedBSD (hardened/current/master) only builds applications with LTO as mentioned in the secion above. My first attempt at building all static and shared libraries failed due to issues within llvm itself.&lt;br&gt;
I reported these issues to FreeBSD. Ed Maste (emaste@), Dimitry Andric (dim@), and llvm’s Rafael Espindola expertly helped address these issues. Various commits within the llvm project by Rafael fully and quickly resolved the issues brought up privately in emails.&lt;br&gt;
With llvm fixed, I could now build nearly every library in base with LTO. I noticed, however, that if I kept non-Cross-DSO CFI and SafeStack enabled, all applications would segfault. Even simplistic applications like /bin/ls.&lt;br&gt;
Disabling both non-Cross-DSO CFI and SafeStack, but keeping LTO produced a fully functioning world! I have spent the last few months figuring out why enabling either non-Cross-DSO CFI or SafeStack caused issues. This brings us to today.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The Sanitizers in FreeBSD&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;FreeBSD brought in all the files required for SafeStack and CFI. When compiling with SafeStack, llvm statically links a full sanitization framework into the application. FreeBSD includes a full copy of the sanitization framework in SafeStack, including the common C++ sanization namespaces. Thus, libclang_rt.safestack included code meant to be shared among all the sanitizers, not just SafeStack.&lt;br&gt;
I had naively taken a brute-force approach to setting up the libclang_rt.cfi static library. I copied the Makefile from libclang_rt.safestack and used that as a template for libclang_rt.cfi. This approach was incorrect due to breaking the One Definition Rule (ODR). Essentially, I ended up including a duplicate copy of the C++ classes and sanitizer runtime if both CFI and SafeStack were used.&lt;br&gt;
In my Cross-DSO CFI development VM, I now have SafeStack disabled across-the-board and am only compiling in CFI. As of 26 May 2018, an LTO-ified world (libs + apps) works in my limited testing. /bin/ls does not crash anymore! The second major milestone for Cross-DSO CFI has now been reached.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Known Issues And Limitations&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;There are a few known issues and regressions. Note that this list of known issues essentially also constitutes a “work-in-progress” and every known issue will be fixed prior to the official launch of Cross-DSO CFI.&lt;br&gt;
It seems llvm does not like statically compiling applications with LTO that have a mixture of C and C++ code. /sbin/devd is one of these applications. As such, when Cross-DSO CFI is enabled, devd is compiled as a Position-Independent Executable (PIE). Doing this breaks UFS systems where /usr is on a separate partition. We are currently looking into solving this issue to allow devd to be statically compiled again.&lt;br&gt;
NO_SHARED is now unset in the tools build stage (aka, bootstrap-tools, cross-tools). This is related to the static compilation issue above. Unsetting NO_SHARED for to tools build stage is only a band-aid until we can resolve static compliation with LTO.&lt;br&gt;
One goal of our Cross-DSO CFI integration work is to be able to support the cfi-icall scheme when dlopen(3) and dlsym(3)/dlfunc(3) is used. This means the runtime linker (RTLD), must be enhanced to know and care about the CFI runtime. This enhancement is not currently implemented, but is planned.&lt;br&gt;
When Cross-DSO CFI is enabled, SafeStack is disabled. This is because compiling with Cross-DSO CFI brings in a second copy of the sanitizer runtime, violating the One Definition Rule (ODR). Resolving this issue should be straightforward: Unify the sanitizer runtime into a single common library that both Cross-DSO CFI and SafeStack can link against.  When the installed world has Cross-DSO CFI enabled, performing a buildworld with Cross-DSO CFI disabled fails. This is somewhat related to the static compilation issue described above.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Current Status&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I’ve managed to get a Cross-DSO CFI world booting on bare metal (my development laptop) and in a VM. Some applications failed to work. Curiously, Firefox still worked (which also means xorg works).&lt;br&gt;
I’m now working through the known issues list, researching and learning.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Future Work&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Fixing pretty much everything in the “Known Issues And Limitations” section. ;P&lt;br&gt;
I need to create a static library that includes only a single copy of the common sanitizer framework code. Applications compiled with CFI or SafeStack will then only have a single copy of the framework.&lt;br&gt;
Next I will need to integrate support in the RTLD for Cross-DSO CFI. Applications with the cfi-icall scheme enabled that call functions resolved through dlsym(3) currently crash due to the lack of RTLD support. I need to make a design decision as to whether to only support adding cfi-icall whitelist entries only with dlfunc(3) or to also whitelist cfi-icall entries with the more widely used dlsym(3).&lt;br&gt;
There’s likely more items in the “TODO” bucket that I am not currently aware of. I’m treading in uncharted territory. I have no firm ETA for any bit of this work. We may gain Cross-DSO CFI support in 2018, but it’s looking like it will be later in either 2019 or 2020.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Conclusion&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I have been working on Cross-DSO CFI support in HardenedBSD for a little over a year now. A lot of progress is being made, yet there’s still some major hurdles to overcome. This work has already helped improve llvm and I hope more commits upstream to both FreeBSD and llvm will happen.&lt;br&gt;
We’re getting closer to being able to send out a preliminary Call For Testing (CFT). At the very least, I would like to solve the static linking issues prior to publishing the CFT. Expect it to be published before the end of 2018.&lt;br&gt;
I would like to thank Ed Maste, Dimitry Andric, and Rafael Espindola for their help, guidance, and support.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;br&gt;
FreeNAS 11.2-BETAs are starting to appear&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://vermaden.wordpress.com/2018/05/01/bareos-backup-server-on-freebsd/"&gt;Bareos Backup Server on FreeBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Ever heard about Bareos? Probably heard about Bacula. Read what is the difference here – Why Bareos forked from Bacula?&lt;br&gt;
Bareos (Backup Archiving Recovery Open Sourced) is a network based open source backup solution. It is 100% open source fork of the backup project from &lt;a href="http://bacula.org"&gt;bacula.org&lt;/a&gt; site. The fork is in development since late 2010 and it has a lot of new features. The source is published on github and licensed under AGPLv3 license. Bareos supports ‘Always Incremental backup which is interesting especially for users with big data. The time and network capacity consuming full backups only have to be taken once. Bareos comes with WebUI for administration tasks and restore file browser. Bareos can backup data to disk and to tape drives as well as tape libraries. It supports compression and encryption both hardware-based (like on LTO tape drives) and software-based. You can also get professional services and support from Bareos as well as Bareos subscription service that provides you access to special quality assured installation packages.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I started my sysadmin job with backup system as one of the new responsibilities, so it will be like going back to the roots. As I look on the ‘backup’ market it is more and more popular – especially in cloud oriented environments – to implement various levels of protection like GOLD, SILVER and BRONZE for example. They of course have different retention times, number of backups kept, different RTO and RPO. Below is a example implementation of BRONZE level backups in Bareos. I used 3 groups of A, B and C with FULL backup starting on DAY 0 (A group), DAY 1 (B group) and DAY 2 (C group).&lt;br&gt;
This way you still have FULL backups quite often and with 3 groups you can balance the network load. I for the days that we will not be doing FULL backups we will be doing DIFFERENTIAL backups. People often confuse them with INCREMENTAL backups. The difference is that DIFFERENTIAL backups are always against FULL backup, so its always ‘one level of combining’. INCREMENTAL ones are done against last done backup TYPE, so its possible to have 100+ levels of combining against 99 earlier INCREMENTAL backups and the 1 FULL backup. That is why I prefer DIFFERENTIAL ones here, faster recovery. That is all backups is about generally, recovery, some people/companies tend to forget that.&lt;br&gt;
The implementation of BRONZE in these three groups is not perfect, but ‘does the job’. I also made ‘simulation’ how these group will overlap at the end/beginning of the month, here is the result.&lt;br&gt;
Not bad for my taste.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Today I will show you how to install and configure Bareos Server based on FreeBSD operating system. It will be the most simplified setup with all services on single machine:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;bareos-dir&lt;/li&gt;
&lt;li&gt;bareos-sd&lt;/li&gt;
&lt;li&gt;bareos-webui&lt;/li&gt;
&lt;li&gt;bareos-fd&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I also assume that in order to provide storage space for the backup data itself You would mount resources from external NFS shares.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;To get in touch with Bareos terminology and technology check their great Manual in HTML or PDF version depending which format You prefer for reading documentation. Also their FAQ provides a lot of needed answers.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Also this diagram may be useful for You to get some grip into the Bareos world.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;System&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;As every system needs to have its name we will use latin word closest to backup here – replica – for our FreeBSD system hostname. The install would be generally the same as in the FreeBSD Desktop – Part 2 – Install article. Here is our installed FreeBSD system with login prompt.&lt;/p&gt;
&lt;/blockquote&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Control flow integrity with HardenedBSD, fixing bufferbloat with OpenBSD’s pf, Bareos Backup Server on FreeBSD, MeetBSD CfP, crypto simplified interface, twitter gems, interesting BSD commits, and more.</p>

<p>##Headlines<br>
###<a href="https://vermaden.wordpress.com/2018/06/07/silent-fanless-freebsd-desktop-server/">Silent Fanless FreeBSD Desktop/Server</a></p>

<blockquote>
<p>Today I will write about silent fanless FreeBSD desktop or server computer … or NAS … or you name it, it can have multa##Headlines<br>
###<a href="https://github.com/lattera/articles/blob/master/hardenedbsd/2018-05-26_cross-dso-cfi/article.md">Cross-DSO CFI in HardenedBSD</a><br>
Control Flow Integrity, or CFI, raises the bar for attackers aiming to hijack control flow and execute arbitrary code. The llvm compiler toolchain, included and used by default in HardenedBSD 12-CURRENT/amd64, supports forward-edge CFI. Backward-edge CFI support is gained via a tangential feature called SafeStack. Cross-DSO CFI builds upon ASLR and PaX NOEXEC for effectiveness.<br>
HardenedBSD supports non-Cross-DSO CFI in base for 12-CURRENT/amd64 and has it enabled for a few individual ports. The term “non-Cross-DSO CFI” means that CFI is enabled for code within an application’s codebase, but not for the shared libraries it depends on. Supporting non-Cross-DSO CFI is an important initial milestone for supporting Cross-DSO CFI, or CFI applied to both shared libraries and applications.<br>
This article discusses where HardenedBSD stands with regards to Cross-DSO CFI in base. We have made a lot of progress, yet we’re not even half-way there.<br>
Brace yourself: This article is going to be full of references to “Cross-DSO CFI.” Make a drinking game out of it. Or don’t. It’s your call. ;)</p>
</blockquote>

<ul>
<li>Using More llvm Toolchain Components</li>
</ul>

<blockquote>
<p>CFI requires compiling source files with Link-Time Optimization (LTO). I remembered hearing a few years back that llvm developers were able to compile the entirety of FreeBSD’s source code with LTO. Compiling with LTO produces intermediate object files as LLVM IR bitcode instead of ELF objects.<br>
In March of 2017, we started compiling all applications with LTO and non-Cross-DSO CFI. This also enabled ld.lld as the default linker in base since CFI requires lld. Commit f38b51668efcd53b8146789010611a4632cafade made the switch to ld.lld as the default linker while enabling non-Cross-DSO CFI at the same time.<br>
Building libraries in base requires applications like ar, ranlib, nm, and objdump. In FreeBSD 12-CURRENT, ar and ranlib are known as “BSD ar” and “BSD ranlib.” In fact, ar and ranlib are the same applications. One is hardlinked to another and the application changes behavior depending on arvgv[0] ending in “ranlib”. The ar, nm, and objdump used in FreeBSD do not support LLVM IR bitcode object files.<br>
In preparation for Cross-DSO CFI support, commit fe4bb0104fc75c7216a6dafe2d7db0e3f5fe8257 in October 2017 saw HardenedBSD switching ar, ranlib, nm, and objdump to their respective llvm components. The llvm versions due support LLVM IR bitcode object files (surprise!) There has been some fallout in the ports tree and we’ve added LLVM_AR_UNSAFE and friends to help transition those ports that dislike llvm-ar, llvm-ranlib, llvm-nm, and llvm-objdump.<br>
With ld.lld, llvm-ar, llvm-ranlib, llvm-nm, and llvm-objdump the default, HardenedBSD has effectively switched to a full llvm compiler toolchain in 12-CURRENT/amd64.</p>
</blockquote>

<ul>
<li>Building Libraries With LTO</li>
</ul>

<blockquote>
<p>The primary 12-CURRENT development branch in HardenedBSD (hardened/current/master) only builds applications with LTO as mentioned in the secion above. My first attempt at building all static and shared libraries failed due to issues within llvm itself.<br>
I reported these issues to FreeBSD. Ed Maste (emaste@), Dimitry Andric (dim@), and llvm’s Rafael Espindola expertly helped address these issues. Various commits within the llvm project by Rafael fully and quickly resolved the issues brought up privately in emails.<br>
With llvm fixed, I could now build nearly every library in base with LTO. I noticed, however, that if I kept non-Cross-DSO CFI and SafeStack enabled, all applications would segfault. Even simplistic applications like /bin/ls.<br>
Disabling both non-Cross-DSO CFI and SafeStack, but keeping LTO produced a fully functioning world! I have spent the last few months figuring out why enabling either non-Cross-DSO CFI or SafeStack caused issues. This brings us to today.</p>
</blockquote>

<ul>
<li>The Sanitizers in FreeBSD</li>
</ul>

<blockquote>
<p>FreeBSD brought in all the files required for SafeStack and CFI. When compiling with SafeStack, llvm statically links a full sanitization framework into the application. FreeBSD includes a full copy of the sanitization framework in SafeStack, including the common C++ sanization namespaces. Thus, libclang_rt.safestack included code meant to be shared among all the sanitizers, not just SafeStack.<br>
I had naively taken a brute-force approach to setting up the libclang_rt.cfi static library. I copied the Makefile from libclang_rt.safestack and used that as a template for libclang_rt.cfi. This approach was incorrect due to breaking the One Definition Rule (ODR). Essentially, I ended up including a duplicate copy of the C++ classes and sanitizer runtime if both CFI and SafeStack were used.<br>
In my Cross-DSO CFI development VM, I now have SafeStack disabled across-the-board and am only compiling in CFI. As of 26 May 2018, an LTO-ified world (libs + apps) works in my limited testing. /bin/ls does not crash anymore! The second major milestone for Cross-DSO CFI has now been reached.</p>
</blockquote>

<ul>
<li>Known Issues And Limitations</li>
</ul>

<blockquote>
<p>There are a few known issues and regressions. Note that this list of known issues essentially also constitutes a “work-in-progress” and every known issue will be fixed prior to the official launch of Cross-DSO CFI.<br>
It seems llvm does not like statically compiling applications with LTO that have a mixture of C and C++ code. /sbin/devd is one of these applications. As such, when Cross-DSO CFI is enabled, devd is compiled as a Position-Independent Executable (PIE). Doing this breaks UFS systems where /usr is on a separate partition. We are currently looking into solving this issue to allow devd to be statically compiled again.<br>
NO_SHARED is now unset in the tools build stage (aka, bootstrap-tools, cross-tools). This is related to the static compilation issue above. Unsetting NO_SHARED for to tools build stage is only a band-aid until we can resolve static compliation with LTO.<br>
One goal of our Cross-DSO CFI integration work is to be able to support the cfi-icall scheme when dlopen(3) and dlsym(3)/dlfunc(3) is used. This means the runtime linker (RTLD), must be enhanced to know and care about the CFI runtime. This enhancement is not currently implemented, but is planned.<br>
When Cross-DSO CFI is enabled, SafeStack is disabled. This is because compiling with Cross-DSO CFI brings in a second copy of the sanitizer runtime, violating the One Definition Rule (ODR). Resolving this issue should be straightforward: Unify the sanitizer runtime into a single common library that both Cross-DSO CFI and SafeStack can link against.  When the installed world has Cross-DSO CFI enabled, performing a buildworld with Cross-DSO CFI disabled fails. This is somewhat related to the static compilation issue described above.</p>
</blockquote>

<ul>
<li>Current Status</li>
</ul>

<blockquote>
<p>I’ve managed to get a Cross-DSO CFI world booting on bare metal (my development laptop) and in a VM. Some applications failed to work. Curiously, Firefox still worked (which also means xorg works).<br>
I’m now working through the known issues list, researching and learning.</p>
</blockquote>

<ul>
<li>Future Work</li>
</ul>

<blockquote>
<p>Fixing pretty much everything in the “Known Issues And Limitations” section. ;P<br>
I need to create a static library that includes only a single copy of the common sanitizer framework code. Applications compiled with CFI or SafeStack will then only have a single copy of the framework.<br>
Next I will need to integrate support in the RTLD for Cross-DSO CFI. Applications with the cfi-icall scheme enabled that call functions resolved through dlsym(3) currently crash due to the lack of RTLD support. I need to make a design decision as to whether to only support adding cfi-icall whitelist entries only with dlfunc(3) or to also whitelist cfi-icall entries with the more widely used dlsym(3).<br>
There’s likely more items in the “TODO” bucket that I am not currently aware of. I’m treading in uncharted territory. I have no firm ETA for any bit of this work. We may gain Cross-DSO CFI support in 2018, but it’s looking like it will be later in either 2019 or 2020.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>I have been working on Cross-DSO CFI support in HardenedBSD for a little over a year now. A lot of progress is being made, yet there’s still some major hurdles to overcome. This work has already helped improve llvm and I hope more commits upstream to both FreeBSD and llvm will happen.<br>
We’re getting closer to being able to send out a preliminary Call For Testing (CFT). At the very least, I would like to solve the static linking issues prior to publishing the CFT. Expect it to be published before the end of 2018.<br>
I would like to thank Ed Maste, Dimitry Andric, and Rafael Espindola for their help, guidance, and support.</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong><br>
FreeNAS 11.2-BETAs are starting to appear</p>

<p>###<a href="https://vermaden.wordpress.com/2018/05/01/bareos-backup-server-on-freebsd/">Bareos Backup Server on FreeBSD</a></p>

<blockquote>
<p>Ever heard about Bareos? Probably heard about Bacula. Read what is the difference here – Why Bareos forked from Bacula?<br>
Bareos (Backup Archiving Recovery Open Sourced) is a network based open source backup solution. It is 100% open source fork of the backup project from <a href="http://bacula.org">bacula.org</a> site. The fork is in development since late 2010 and it has a lot of new features. The source is published on github and licensed under AGPLv3 license. Bareos supports ‘Always Incremental backup which is interesting especially for users with big data. The time and network capacity consuming full backups only have to be taken once. Bareos comes with WebUI for administration tasks and restore file browser. Bareos can backup data to disk and to tape drives as well as tape libraries. It supports compression and encryption both hardware-based (like on LTO tape drives) and software-based. You can also get professional services and support from Bareos as well as Bareos subscription service that provides you access to special quality assured installation packages.</p>
</blockquote>

<blockquote>
<p>I started my sysadmin job with backup system as one of the new responsibilities, so it will be like going back to the roots. As I look on the ‘backup’ market it is more and more popular – especially in cloud oriented environments – to implement various levels of protection like GOLD, SILVER and BRONZE for example. They of course have different retention times, number of backups kept, different RTO and RPO. Below is a example implementation of BRONZE level backups in Bareos. I used 3 groups of A, B and C with FULL backup starting on DAY 0 (A group), DAY 1 (B group) and DAY 2 (C group).<br>
This way you still have FULL backups quite often and with 3 groups you can balance the network load. I for the days that we will not be doing FULL backups we will be doing DIFFERENTIAL backups. People often confuse them with INCREMENTAL backups. The difference is that DIFFERENTIAL backups are always against FULL backup, so its always ‘one level of combining’. INCREMENTAL ones are done against last done backup TYPE, so its possible to have 100+ levels of combining against 99 earlier INCREMENTAL backups and the 1 FULL backup. That is why I prefer DIFFERENTIAL ones here, faster recovery. That is all backups is about generally, recovery, some people/companies tend to forget that.<br>
The implementation of BRONZE in these three groups is not perfect, but ‘does the job’. I also made ‘simulation’ how these group will overlap at the end/beginning of the month, here is the result.<br>
Not bad for my taste.</p>
</blockquote>

<blockquote>
<p>Today I will show you how to install and configure Bareos Server based on FreeBSD operating system. It will be the most simplified setup with all services on single machine:</p>
</blockquote>

<ul>
<li>bareos-dir</li>
<li>bareos-sd</li>
<li>bareos-webui</li>
<li>bareos-fd</li>
</ul>

<blockquote>
<p>I also assume that in order to provide storage space for the backup data itself You would mount resources from external NFS shares.</p>
</blockquote>

<blockquote>
<p>To get in touch with Bareos terminology and technology check their great Manual in HTML or PDF version depending which format You prefer for reading documentation. Also their FAQ provides a lot of needed answers.</p>
</blockquote>

<blockquote>
<p>Also this diagram may be useful for You to get some grip into the Bareos world.</p>
</blockquote>

<ul>
<li>System</li>
</ul>

<blockquote>
<p>As every system needs to have its name we will use latin word closest to backup here – replica – for our FreeBSD system hostname. The install would be generally the same as in the FreeBSD Desktop – Part 2 – Install article. Here is our installed FreeBSD system with login prompt.</p>
</blockquote>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Control flow integrity with HardenedBSD, fixing bufferbloat with OpenBSD’s pf, Bareos Backup Server on FreeBSD, MeetBSD CfP, crypto simplified interface, twitter gems, interesting BSD commits, and more.</p>

<p>##Headlines<br>
###<a href="https://vermaden.wordpress.com/2018/06/07/silent-fanless-freebsd-desktop-server/">Silent Fanless FreeBSD Desktop/Server</a></p>

<blockquote>
<p>Today I will write about silent fanless FreeBSD desktop or server computer … or NAS … or you name it, it can have multa##Headlines<br>
###<a href="https://github.com/lattera/articles/blob/master/hardenedbsd/2018-05-26_cross-dso-cfi/article.md">Cross-DSO CFI in HardenedBSD</a><br>
Control Flow Integrity, or CFI, raises the bar for attackers aiming to hijack control flow and execute arbitrary code. The llvm compiler toolchain, included and used by default in HardenedBSD 12-CURRENT/amd64, supports forward-edge CFI. Backward-edge CFI support is gained via a tangential feature called SafeStack. Cross-DSO CFI builds upon ASLR and PaX NOEXEC for effectiveness.<br>
HardenedBSD supports non-Cross-DSO CFI in base for 12-CURRENT/amd64 and has it enabled for a few individual ports. The term “non-Cross-DSO CFI” means that CFI is enabled for code within an application’s codebase, but not for the shared libraries it depends on. Supporting non-Cross-DSO CFI is an important initial milestone for supporting Cross-DSO CFI, or CFI applied to both shared libraries and applications.<br>
This article discusses where HardenedBSD stands with regards to Cross-DSO CFI in base. We have made a lot of progress, yet we’re not even half-way there.<br>
Brace yourself: This article is going to be full of references to “Cross-DSO CFI.” Make a drinking game out of it. Or don’t. It’s your call. ;)</p>
</blockquote>

<ul>
<li>Using More llvm Toolchain Components</li>
</ul>

<blockquote>
<p>CFI requires compiling source files with Link-Time Optimization (LTO). I remembered hearing a few years back that llvm developers were able to compile the entirety of FreeBSD’s source code with LTO. Compiling with LTO produces intermediate object files as LLVM IR bitcode instead of ELF objects.<br>
In March of 2017, we started compiling all applications with LTO and non-Cross-DSO CFI. This also enabled ld.lld as the default linker in base since CFI requires lld. Commit f38b51668efcd53b8146789010611a4632cafade made the switch to ld.lld as the default linker while enabling non-Cross-DSO CFI at the same time.<br>
Building libraries in base requires applications like ar, ranlib, nm, and objdump. In FreeBSD 12-CURRENT, ar and ranlib are known as “BSD ar” and “BSD ranlib.” In fact, ar and ranlib are the same applications. One is hardlinked to another and the application changes behavior depending on arvgv[0] ending in “ranlib”. The ar, nm, and objdump used in FreeBSD do not support LLVM IR bitcode object files.<br>
In preparation for Cross-DSO CFI support, commit fe4bb0104fc75c7216a6dafe2d7db0e3f5fe8257 in October 2017 saw HardenedBSD switching ar, ranlib, nm, and objdump to their respective llvm components. The llvm versions due support LLVM IR bitcode object files (surprise!) There has been some fallout in the ports tree and we’ve added LLVM_AR_UNSAFE and friends to help transition those ports that dislike llvm-ar, llvm-ranlib, llvm-nm, and llvm-objdump.<br>
With ld.lld, llvm-ar, llvm-ranlib, llvm-nm, and llvm-objdump the default, HardenedBSD has effectively switched to a full llvm compiler toolchain in 12-CURRENT/amd64.</p>
</blockquote>

<ul>
<li>Building Libraries With LTO</li>
</ul>

<blockquote>
<p>The primary 12-CURRENT development branch in HardenedBSD (hardened/current/master) only builds applications with LTO as mentioned in the secion above. My first attempt at building all static and shared libraries failed due to issues within llvm itself.<br>
I reported these issues to FreeBSD. Ed Maste (emaste@), Dimitry Andric (dim@), and llvm’s Rafael Espindola expertly helped address these issues. Various commits within the llvm project by Rafael fully and quickly resolved the issues brought up privately in emails.<br>
With llvm fixed, I could now build nearly every library in base with LTO. I noticed, however, that if I kept non-Cross-DSO CFI and SafeStack enabled, all applications would segfault. Even simplistic applications like /bin/ls.<br>
Disabling both non-Cross-DSO CFI and SafeStack, but keeping LTO produced a fully functioning world! I have spent the last few months figuring out why enabling either non-Cross-DSO CFI or SafeStack caused issues. This brings us to today.</p>
</blockquote>

<ul>
<li>The Sanitizers in FreeBSD</li>
</ul>

<blockquote>
<p>FreeBSD brought in all the files required for SafeStack and CFI. When compiling with SafeStack, llvm statically links a full sanitization framework into the application. FreeBSD includes a full copy of the sanitization framework in SafeStack, including the common C++ sanization namespaces. Thus, libclang_rt.safestack included code meant to be shared among all the sanitizers, not just SafeStack.<br>
I had naively taken a brute-force approach to setting up the libclang_rt.cfi static library. I copied the Makefile from libclang_rt.safestack and used that as a template for libclang_rt.cfi. This approach was incorrect due to breaking the One Definition Rule (ODR). Essentially, I ended up including a duplicate copy of the C++ classes and sanitizer runtime if both CFI and SafeStack were used.<br>
In my Cross-DSO CFI development VM, I now have SafeStack disabled across-the-board and am only compiling in CFI. As of 26 May 2018, an LTO-ified world (libs + apps) works in my limited testing. /bin/ls does not crash anymore! The second major milestone for Cross-DSO CFI has now been reached.</p>
</blockquote>

<ul>
<li>Known Issues And Limitations</li>
</ul>

<blockquote>
<p>There are a few known issues and regressions. Note that this list of known issues essentially also constitutes a “work-in-progress” and every known issue will be fixed prior to the official launch of Cross-DSO CFI.<br>
It seems llvm does not like statically compiling applications with LTO that have a mixture of C and C++ code. /sbin/devd is one of these applications. As such, when Cross-DSO CFI is enabled, devd is compiled as a Position-Independent Executable (PIE). Doing this breaks UFS systems where /usr is on a separate partition. We are currently looking into solving this issue to allow devd to be statically compiled again.<br>
NO_SHARED is now unset in the tools build stage (aka, bootstrap-tools, cross-tools). This is related to the static compilation issue above. Unsetting NO_SHARED for to tools build stage is only a band-aid until we can resolve static compliation with LTO.<br>
One goal of our Cross-DSO CFI integration work is to be able to support the cfi-icall scheme when dlopen(3) and dlsym(3)/dlfunc(3) is used. This means the runtime linker (RTLD), must be enhanced to know and care about the CFI runtime. This enhancement is not currently implemented, but is planned.<br>
When Cross-DSO CFI is enabled, SafeStack is disabled. This is because compiling with Cross-DSO CFI brings in a second copy of the sanitizer runtime, violating the One Definition Rule (ODR). Resolving this issue should be straightforward: Unify the sanitizer runtime into a single common library that both Cross-DSO CFI and SafeStack can link against.  When the installed world has Cross-DSO CFI enabled, performing a buildworld with Cross-DSO CFI disabled fails. This is somewhat related to the static compilation issue described above.</p>
</blockquote>

<ul>
<li>Current Status</li>
</ul>

<blockquote>
<p>I’ve managed to get a Cross-DSO CFI world booting on bare metal (my development laptop) and in a VM. Some applications failed to work. Curiously, Firefox still worked (which also means xorg works).<br>
I’m now working through the known issues list, researching and learning.</p>
</blockquote>

<ul>
<li>Future Work</li>
</ul>

<blockquote>
<p>Fixing pretty much everything in the “Known Issues And Limitations” section. ;P<br>
I need to create a static library that includes only a single copy of the common sanitizer framework code. Applications compiled with CFI or SafeStack will then only have a single copy of the framework.<br>
Next I will need to integrate support in the RTLD for Cross-DSO CFI. Applications with the cfi-icall scheme enabled that call functions resolved through dlsym(3) currently crash due to the lack of RTLD support. I need to make a design decision as to whether to only support adding cfi-icall whitelist entries only with dlfunc(3) or to also whitelist cfi-icall entries with the more widely used dlsym(3).<br>
There’s likely more items in the “TODO” bucket that I am not currently aware of. I’m treading in uncharted territory. I have no firm ETA for any bit of this work. We may gain Cross-DSO CFI support in 2018, but it’s looking like it will be later in either 2019 or 2020.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>I have been working on Cross-DSO CFI support in HardenedBSD for a little over a year now. A lot of progress is being made, yet there’s still some major hurdles to overcome. This work has already helped improve llvm and I hope more commits upstream to both FreeBSD and llvm will happen.<br>
We’re getting closer to being able to send out a preliminary Call For Testing (CFT). At the very least, I would like to solve the static linking issues prior to publishing the CFT. Expect it to be published before the end of 2018.<br>
I would like to thank Ed Maste, Dimitry Andric, and Rafael Espindola for their help, guidance, and support.</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong><br>
FreeNAS 11.2-BETAs are starting to appear</p>

<p>###<a href="https://vermaden.wordpress.com/2018/05/01/bareos-backup-server-on-freebsd/">Bareos Backup Server on FreeBSD</a></p>

<blockquote>
<p>Ever heard about Bareos? Probably heard about Bacula. Read what is the difference here – Why Bareos forked from Bacula?<br>
Bareos (Backup Archiving Recovery Open Sourced) is a network based open source backup solution. It is 100% open source fork of the backup project from <a href="http://bacula.org">bacula.org</a> site. The fork is in development since late 2010 and it has a lot of new features. The source is published on github and licensed under AGPLv3 license. Bareos supports ‘Always Incremental backup which is interesting especially for users with big data. The time and network capacity consuming full backups only have to be taken once. Bareos comes with WebUI for administration tasks and restore file browser. Bareos can backup data to disk and to tape drives as well as tape libraries. It supports compression and encryption both hardware-based (like on LTO tape drives) and software-based. You can also get professional services and support from Bareos as well as Bareos subscription service that provides you access to special quality assured installation packages.</p>
</blockquote>

<blockquote>
<p>I started my sysadmin job with backup system as one of the new responsibilities, so it will be like going back to the roots. As I look on the ‘backup’ market it is more and more popular – especially in cloud oriented environments – to implement various levels of protection like GOLD, SILVER and BRONZE for example. They of course have different retention times, number of backups kept, different RTO and RPO. Below is a example implementation of BRONZE level backups in Bareos. I used 3 groups of A, B and C with FULL backup starting on DAY 0 (A group), DAY 1 (B group) and DAY 2 (C group).<br>
This way you still have FULL backups quite often and with 3 groups you can balance the network load. I for the days that we will not be doing FULL backups we will be doing DIFFERENTIAL backups. People often confuse them with INCREMENTAL backups. The difference is that DIFFERENTIAL backups are always against FULL backup, so its always ‘one level of combining’. INCREMENTAL ones are done against last done backup TYPE, so its possible to have 100+ levels of combining against 99 earlier INCREMENTAL backups and the 1 FULL backup. That is why I prefer DIFFERENTIAL ones here, faster recovery. That is all backups is about generally, recovery, some people/companies tend to forget that.<br>
The implementation of BRONZE in these three groups is not perfect, but ‘does the job’. I also made ‘simulation’ how these group will overlap at the end/beginning of the month, here is the result.<br>
Not bad for my taste.</p>
</blockquote>

<blockquote>
<p>Today I will show you how to install and configure Bareos Server based on FreeBSD operating system. It will be the most simplified setup with all services on single machine:</p>
</blockquote>

<ul>
<li>bareos-dir</li>
<li>bareos-sd</li>
<li>bareos-webui</li>
<li>bareos-fd</li>
</ul>

<blockquote>
<p>I also assume that in order to provide storage space for the backup data itself You would mount resources from external NFS shares.</p>
</blockquote>

<blockquote>
<p>To get in touch with Bareos terminology and technology check their great Manual in HTML or PDF version depending which format You prefer for reading documentation. Also their FAQ provides a lot of needed answers.</p>
</blockquote>

<blockquote>
<p>Also this diagram may be useful for You to get some grip into the Bareos world.</p>
</blockquote>

<ul>
<li>System</li>
</ul>

<blockquote>
<p>As every system needs to have its name we will use latin word closest to backup here – replica – for our FreeBSD system hostname. The install would be generally the same as in the FreeBSD Desktop – Part 2 – Install article. Here is our installed FreeBSD system with login prompt.</p>
</blockquote>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 253: Silence of the Fans | BSD Now 253</title>
  <link>https://www.bsdnow.tv/253</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2208</guid>
  <pubDate>Thu, 05 Jul 2018 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f597f732-405b-4f10-8d40-c00315bd064b.mp3" length="52181883" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Fanless server setup with FreeBSD, NetBSD on pinebooks, another BSDCan trip report, transparent network audio, MirBSD's Korn Shell on Plan9, static site generators on OpenBSD, and more.</itunes:subtitle>
  <itunes:duration>1:26:51</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Fanless server setup with FreeBSD, NetBSD on pinebooks, another BSDCan trip report, transparent network audio, MirBSD's Korn Shell on Plan9, static site generators on OpenBSD, and more.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://vermaden.wordpress.com/2018/06/07/silent-fanless-freebsd-desktop-server/"&gt;Silent Fanless FreeBSD Desktop/Server&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Today I will write about silent fanless FreeBSD desktop or server computer … or NAS … or you name it, it can have multiple purposes. It also very low power solution, which also means that it will not overheat. Silent means no fans at all, even for the PSU. The format of the system should also be brought to minimum, so Mini-ITX seems best solution here.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I have chosen Intel based solutions as they are very low power (6-10W), if you prefer AMD (as I often do) the closest solution in comparable price and power is Biostar A68N-2100 motherboard with AMD E1-2100 CPU and 9W power. Of course AMD has even more low power SoC solutions but finding the Mini-ITX motherboard with decent price is not an easy task. For comparison Intel has lots of such solutions below 6W whose can be nicely filtered on the &lt;a href="http://ark.intel.com"&gt;ark.intel.com&lt;/a&gt; page. Pity that AMD does not provide such filtration for their products. I also chosen AES instructions as storage encryption (GELI on FreeBSD) today seems as obvious as HTTPS for the web pages.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://vermaden.files.wordpress.com/2018/06/itx-mobo.jpg"&gt;Here is how the system look powered up and working&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;This motherboard uses Intel J3355 SoC which uses 10W and has AES instructions. It has two cores at your disposal but it also supports VT-x and EPT extensions so you can even run Bhyve on it.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Components&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Now, an example system would look like that one below, here are the components with their prices.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;$49  CPU/Motherboard ASRock J3355B-ITX Mini-ITX&lt;/li&gt;
&lt;li&gt;$14  RAM Crucial 4 GB DDR3L 1.35V (low power)&lt;/li&gt;
&lt;li&gt;$17  PSU 12V 160W Pico (internal)&lt;/li&gt;
&lt;li&gt;$11  PSU 12V 96W FSP (external)&lt;/li&gt;
&lt;li&gt;$5  USB 2.0 Drive 16 GB ADATA&lt;/li&gt;
&lt;li&gt;$4  USB Wireless 802.11n&lt;/li&gt;
&lt;li&gt;$100  TOTAL&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The PSU 12V 160W Pico (internal) and PSU 12V 96W FSP can be purchased on &lt;a href="http://aliexpress.com"&gt;aliexpress.com&lt;/a&gt; or &lt;a href="http://ebay.com"&gt;ebay.com&lt;/a&gt; for example, at least I got them there.  Here is the 12V 160W Pico (internal) PSU and its optional additional cables to power the optional HDDs. If course its one SATA power and one MOLEX power so additional MOLEX-SATA power adapter for about 1$ would be needed. Here is the 12V 96W FSP (external) PSU without the power cord.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;This gives as total silent fanless system price of about $120. Its about ONE TENTH OF THE COST of the cheapest FreeNAS hardware solution available – the FreeNAS Mini (Diskless) costs $1156 also without disks.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;You can put plain FreeBSD on top of it or Solaris/Illumos distribution OmniOSce which is server oriented. You can use prebuilt NAS solution based on FreeBSD like FreeNAS, NAS4Free, ZFSguru or even Solaris/Illumos based storage with napp-it appliance.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blog.netbsd.org/tnf/entry/pinebook"&gt;An annotated look at a NetBSD Pinebook’s startup&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Pinebook is an affordable 64-bit ARM notebook. Today we’re going to take a look at the kernel output at startup and talk about what hardware support is available on NetBSD.&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/jmcwhatever/status/998258710496628736/photo/1"&gt;Photo&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;Pinebook comes with 2GB RAM standard. A small amount of this is reserved by the kernel and framebuffer.&lt;/li&gt;
&lt;li&gt;NetBSD uses flattened device-tree (FDT) to enumerate devices on all Allwinner based SoCs. On a running system, you can inspect the device tree using the ofctl(8) utility:&lt;/li&gt;
&lt;li&gt;Pinebook’s Allwinner A64 processor is based on the ARM Cortex-A53. It is designed to run at frequencies up to 1.2GHz.&lt;/li&gt;
&lt;li&gt;The A64 is a quad core design. NetBSD’s aarch64 pmap does not yet support SMP, so three cores are disabled for now.&lt;/li&gt;
&lt;li&gt;The interrupt controller is a standard ARM GIC-400 design.&lt;/li&gt;
&lt;li&gt;Clock drivers for managing PLLs, module clock dividers, clock gating, software resets, etc. Information about the clock tree is exported in the hw.clk sysctl namespace (root access required to read these values).&lt;/li&gt;
&lt;/ul&gt;
&lt;pre&gt;&lt;code&gt;# sysctl hw.clk.sun50ia64ccu0.mmc2
hw.clk.sun50ia64ccu0.mmc2.rate = 200000000
hw.clk.sun50ia64ccu0.mmc2.parent = pllperiph02x
hw.clk.sun50ia64ccu0.mmc2.parent_domain = sun50ia64ccu0
&lt;/code&gt;&lt;/pre&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Digital Ocean&lt;/strong&gt;&lt;br&gt;
&lt;a href="http://do.co/bsdnow"&gt;http://do.co/bsdnow&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-mark-johnston/"&gt;BSDCan 2018 Trip Report: Mark Johnston&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;BSDCan is a highlight of my summers: the ability to have face-to-face conversations with fellow developers and contributors is invaluable and always helps refresh my enthusiasm for FreeBSD.  While in a perfect world we would all be able to communicate effectively over the Internet, it’s often noted that locking a group of developers together in a room can be a very efficient way to make progress on projects that otherwise get strung out over time, and to me this is one of the principal functions of BSD conferences.  In my case I was able to fix some kgdb bugs that had been hindering me for months; get some opinions on the design of a feature I’ve been working on for FreeBSD 12.0; hear about some ongoing usage of code that I’ve worked on; and do some pair-debugging of an issue that has been affecting another developer.&lt;br&gt;
As is tradition, on Tuesday night I dropped off my things at the university residence where I was staying, and headed straight to the Royal Oak.  This year it didn’t seem quite as packed with BSD developers, but I did meet several long-time colleagues and get a chance to catch up.  In particular, I chatted with Justin Hibbits and got to hear about the bring-up of FreeBSD on POWER9, a new CPU family released by IBM.  Justin was able to acquire a workstation based upon this CPU, which is a great motivator for getting FreeBSD into shape on that platform.  POWER9 also has some promise in the server market, so it’s important for FreeBSD to be a viable OS choice there.&lt;br&gt;
Wednesday morning saw the beginning of the two-day FreeBSD developer summit, which precedes the conference proper.  Gordon Tetlow led the summit and did an excellent job organizing things and keeping to the schedule.  The first presentation was by Deb Goodkin of the FreeBSD Foundation, who gave an overview of the Foundation’s role and activities. After Deb’s presentation, present members of the FreeBSD core team discussed the work they had done over the past two years, as well as open tasks that would be handed over to the new core team upon completion of the ongoing election.  Finally, Marius Strobl rounded off the day’s presentations by discussing the state and responsibilities of FreeBSD’s release engineering team.&lt;br&gt;
One side discussion of interest to me was around the notion of tightening integration with our Bugzilla instance; at moment we do not have any good means to mark a given bug as blocking a release, making it easy for bugs to slip into releases and thus lowering our overall quality.  With FreeBSD 12.0 upon us, I plan to help with the triage and fixes for known regressions before the release process begins.&lt;br&gt;
After a break, the rest of the morning was devoted to plans for features in upcoming FreeBSD releases.  This is one of my favorite discussion topics and typically takes the form of have/need/want, where developers collectively list features that they’ve developed and intend to upstream (have), features that they are missing (need), and nice-to-have features (want).  This year, instead of the usual format, we listed features that are intended to ship in FreeBSD 12.0.  The compiled list ended up being quite ambitious given how close we are to the beginning of the release cycle, but many individual developers (including myself) have signed up to deliver work.  I’m hopeful that most, if not all of it, will make it into the release.&lt;br&gt;
After lunch, I attended a discussion led by Matt Ahrens and Alexander Motin on OpenZFS.  Of particular interest to me were some observations made regarding the relative quantity and quality of contributions made by different “camps” of OpenZFS users (illumos, FreeBSD and ZoL), and their respective track records of upstreaming enhancements to the OpenZFS project. In part due to the high pace of changes in ZoL, the definition of “upstream” for ZFS has become murky, and of late ZFS changes have been ported directly from ZoL.  Alexander discussed some known problems with ZFS on FreeBSD that have been discovered through performance testing.  While I’m not familiar with ZFS internals, Alexander noted that ZFS’ write path has poor SMP scalability on FreeBSD owing to some limitations in a certain kernel API called taskqueue(9).  I would like to explore this problem further and perhaps integrate a relatively new alternative interface which should perform better.&lt;br&gt;
Friday and Saturday were, of course, taken up by BSDCan talks.  Friday’s keynote was by Benno Rice, who provided some history of UNIX boot systems as a precursor to some discussion of systemd and the difficulties presented by a user and developer community that actively resist change.  The rest of the morning was consumed by talks and passed by quickly. First was Colin Percival’s detailed examination of where the FreeBSD kernel spends time during boot, together with an overview of some infrastructure he added to track boot times. He also provided a list of improvements that have been made since he started taking measurements, and some areas we can further improve.  Colin’s existing work in this area has already brought about substantial reductions in boot time; amusingly, one of the remaining large delays comes from the keyboard driver, which contains a workaround for old PS/2 keyboards.  While there seems to be general agreement that the workaround is probably no longer needed on most systems, the lingering uncertainty around this prevents us from removing the workaround.  This is, sadly, a fairly typical example of an OS maintenance burden, and underscores the need to carefully document hardware bug workarounds.  After this talk, I got to see some rather novel demonstrations of system tracing using dwatch, a new utility by Devin Teske, which aims to provide a user-friendly interface to DTrace.  After lunch, I attended talks on netdump, a protocol for transmitting kernel dumps over a network after the system has panicked, and on a VPC implementation for FreeBSD.  After the talks ended, I headed yet again to the hacker lounge and had some fruitful discussions on early microcode loading (one of my features for FreeBSD 12.0). These led me to reconsider some aspects of my approach and saved me a lot of time.  Finally, I continued my debugging session from Wednesday with help from a couple of other developers.&lt;br&gt;
Saturday’s talks included a very thorough account by Li-Wen Hsu of his work in organizing a BSD conference in Taipei last year.  As one of the attendees, I had felt that the conference had gone quite smoothly and was taken aback by the number of details and pitfalls that Li-Wen enumerated during his talk. This was followed by an excellent talk by Baptiste Daroussin on the difficulties one encounters when deploying FreeBSD in new environments. Baptiste offered criticisms of a number of aspects of FreeBSD, some of which hit close to home as they involved portions of the system that I’ve worked on.&lt;br&gt;
At the conclusion of the talks, we all gathered in the main lecture hall, where Dan led a traditional and quite lively auction for charity.  I managed to snag a Pine64 board and will be getting FreeBSD installed on it the first chance I get.  At the end of the auction, we all headed to ByWard for dinner, concluding yet another BSDCan.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Thanks to Mark for sharing his experiences at this years BSDCan&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://undeadly.org/cgi?action=article&amp;amp;sid=20180410063454"&gt;Transparent network audio with mpd &amp;amp; sndiod&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Landry Breuil (landry@ when wearing his developer hat) wrote in…&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;I've been a huge fan of MPD over the years to centralize my audio collection, and i've been using it with the http output to stream the music as a radio on the computer i'm currently using…

audio_output {
       type            "sndio"
       name            "Local speakers"
       mixer_type      "software"
}
audio_output {
       type            "httpd"
       name            "HTTP stream"
       mixer_type      "software"
       encoder         "vorbis"
       port            "8000"
       format          "44100:16:2"
}
this setup worked for years, allows me to stream my home radio to $work by tunnelling the port 8000 over ssh via LocalForward, but that still has some issues:

a distinct timing gap between the 'local output' (ie the speakers connected to the machine where MPD is running) and the 'http output' caused by the time it takes to reencode the stream, which is ugly when you walk through the house and have a 15s delay
sometimes mplayer as a client doesn't detect the pauses in the stream and needs to be restarted
i need to configure/start a client on each computer and point it at the sound server url (can do via gmpc shoutcast client plugin…)
it's not that elegant to reencode the stream, and it wastes cpu cycles
So the current scheme is:

mpd -&amp;gt; http output -&amp;gt; network -&amp;gt; mplayer -&amp;gt; sndiod on remote machine
|
-&amp;gt; sndio output -&amp;gt; sndiod on soundserver
Fiddling a little bit with mpd outputs and reading the sndio output driver, i remembered sndiod has native network support… and the mpd sndio output allows you to specify a device (it uses SIO_DEVANY by default).

So in the end, it's super easy to:

enable network support in sndio on the remote machine i want the audio to play by adding -L&amp;lt;local ip&amp;gt; to sndiod_flags (i have two audio devices, with an input coming from the webcam):
sndiod_flags="-L10.246.200.10 -f rsnd/0 -f rsnd/1"
open pf on port 11025 from the sound server ip:
pass in proto tcp from 10.246.200.1 to any port 11025
configure a new output in mpd:
audio_output {
       type            "sndio"
       name            "sndio on renton"
       device          "snd@10.246.200.10/0"
       mixer_type      "software"
}
and enable the new output in mpd:
$mpc enable 2
Output 1 (Local speakers) is disabled
Output 2 (sndio on renton) is enabled
Output 3 (HTTP stream) is disabled
Results in a big win: no gap anymore with the local speakers, no reencoding, no need to configure a client to play the stream, and i can still probably reproduce the same scheme over ssh from $work using a RemoteForward.

mpd -&amp;gt; sndio output 2 -&amp;gt; network -&amp;gt; sndiod on remote machine
|
-&amp;gt; sndio output 1 -&amp;gt; sndiod on soundserver
Thanks ratchov@ for sndiod :)
&lt;/code&gt;&lt;/pre&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.mirbsd.org/permalinks/wlog-10_e20180415-tg.htm"&gt;MirBSD’s Korn Shell on Plan9 Jehanne&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Let start by saying that I’m not really a C programmer.&lt;br&gt;
My last public contribution to a POSIX C program was a little improvement to the Snort’s react module back in 2008.&lt;br&gt;
So while I know the C language well enough, I do not know anything about the subtleness of the standard library and I have little experience with POSIX semantics.&lt;br&gt;
This is not a big issue with Plan 9, since the C library and compiler are not standard anyway, but with Jehanne (a Plan 9 derivative of my own) I want to build a simple, loosely coupled, system that can actually run useful free software ported from UNIX.&lt;br&gt;
So I ported RedHat’s newlib to Jehanne on top of a new system library I wrote, LibPOSIX, that provides the necessary emulations. I wrote several test, checking they run the same on Linux and Jehanne, and then I begun looking for a real-world, battle tested, application to port first.&lt;br&gt;
I approached MirBSD’s Korn Shell for several reason:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;it is simple, powerful and well written&lt;/li&gt;
&lt;li&gt;it has been ported to several different operating systems&lt;/li&gt;
&lt;li&gt;it has few dependencies&lt;/li&gt;
&lt;li&gt;it’s the default shell in Android, so it’s really battle tested&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I was very confident. I had read the POSIX standard after all! And I had a test suite!&lt;br&gt;
I remember, I thought “Given newlib, how hard can it be?”&lt;br&gt;
The porting begun on September 1, 2017. It was completed by tg on January 5, 2018. 125 nights later.&lt;br&gt;
Turn out, my POSIX emulation was badly broken. Not just because of the usual bugs that any piece of C can have: I didn’t understood most POSIX semantics at all!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://www.romanzolotarev.com/ssg.html"&gt;Static site generator with rsync and lowdown on OpenBSD&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;ssg is a tiny POSIX-compliant shell script with few dependencies:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;lowdown(1) to parse markdown,&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;rsync(1) to copy temporary files, and&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;entr(1) to watch file changes.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;It generates Markdown articles to a static website.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;It copies the current directory to a temporary on in /tmp skipping .* and _*, renders all Markdown articles to HTML, generates RSS feed based on links from index.html, extracts the first &amp;lt;h1&amp;gt; tag from every article to generate a sitemap and use it as a page title, then wraps articles with a single HTML template, copies everything from the temporary directory to $DOCS/&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Why not Jekyll or “$X”?&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;ssg is one hundred times smaller than Jekyll.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;ssg and its dependencies are about 800KB combined. Compare that to 78MB of ruby with Jekyll and all the gems. So ssg can be installed in just few seconds on almost any Unix-like operating system.&lt;br&gt;
Obviously, ssg is tailored for my needs, it has all features I need and only those I use.&lt;br&gt;
Keeping ssg helps you to master your Unix-shell skills: awk, grep, sed, sh, cut, tr. As a web developer you work with lots of text: code and data. So you better master these wonderful tools.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Performance&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;100 pps. On modern computers ssg generates a hundred pages per second. Half of a time for markdown rendering and another half for wrapping articles into the template. I heard good static site generators work—twice as fast—at 200 pps, so there’s lots of performance that can be gained. ;)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.quora.com/Why-does-FreeBSD-have-virtually-no-0-desktop-market-share/answer/Terry-Lambert"&gt;Why does FreeBSD have virtually no (0%) desktop market share?&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Because someone made a horrible design decision back in 1984.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;In absolute fairness to those involved, it was an understandable decision, both from a research perspective, and from an economic perspective, although likely not, from a technology perspective.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Why and what.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The decision was taken because the X Window System was intended to run on cheap hardware, and, at the time, that meant reduced functionality in the end-point device with the physical display attached to it.&lt;br&gt;
At the same time, another force was acting to also limit X displays to display services only, rather than rolling in both window management and specific widget instances for common operational paradigms.&lt;br&gt;
Mostly, common operational paradigms didn’t really exist for windowing systems because they also simply didn’t exist at the time, and no one really knew how people were going to use the things, and so researchers didn’t want to commit future research to a set of hard constraints.&lt;br&gt;
So a decision was made: separate the display services from the application at the lowest level of graphics primitives currently in use at the time.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The ramifications of this were pretty staggering.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;First, it guaranteed that all higher level graphics would live on the host side of the X protocol, instead of on the display device side of the protocol.&lt;br&gt;
Despite a good understanding of Moore’s law, and the fact that, since no X Terminals existed at the time as hardware, but were instead running as emulations on workstations that had sufficient capability, this put the higher level GUI object libraries — referred to as “widgets” — in host libraries linked into the applications.&lt;br&gt;
Second, it guaranteed that display organization and management paradigms would also live on the host side of the protocol — assumed, in contradiction to the previous decision, to be running on the workstation.&lt;br&gt;
But, presumably, at some point, as lightweight X Terminals became available, to migrate to a particular host computer managing compute resource login/access services.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Between these early decisions reigned chaos.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Specifically, the consequences of these decisions have been with us ever since:&lt;br&gt;
Look-and-feel are a consequence of the toolkit chosen by the application programmer, rather than a user decision which applies universally to all applications.&lt;br&gt;
You could call this “lack of a theme”, and — although I personally despise the idea of customizing or “theming” desktops — this meant that one paradigm chosen by the user would not apply universally across all applications, no matter who had written them.&lt;br&gt;
Window management style is a preference.&lt;br&gt;
You could call this a more radical version of “theming” — which you will remember, I despise — but a consequence to this is that training is not universal across personnel using such systems, nor is it transferrable.&lt;br&gt;
In other words, I can’t send someone to a class, and have them come back and use the computers in the office as a tool, with the computer itself — and the elements not specific to the application itself — disappearing into the background.&lt;br&gt;
Both of these ultimately render an X-based system unsuitable for desktops.&lt;br&gt;
I can’t pay once for training. Training that I do pay for does not easily and naturally translate between applications. Each new version may radically alter the desktop management paradigm into unrecognizability.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Is there hope for the future?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Well, the Linux community has been working on something called Wayland, and it is very promising…&lt;br&gt;
…In the same way X was “very promising” in 1984, because, unfortunately, they are making exactly the same mistakes X made in 1984, rather than correcting them, now that we have 20/20 hindsight, and know what a mature widget library should look like.&lt;br&gt;
So Wayland is screwing up again.&lt;br&gt;
But hey, it only took us, what, 25 years to get from X in 1987 to Wayland in in 2012.&lt;br&gt;
Maybe if we try again in 2037, we can get to where Windows was in 1995.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://twitter.com/FranckPachot/status/1012606253338591232"&gt;New washing machine comes with 7 pages of open source licenses!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.bsdjobs.com/"&gt;BSD Jobs Site&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/wp-content/uploads/2018/05/FreeBSD-Foundation-May-2018-Update.pdf"&gt;FreeBSD Foundation Update, May 2018&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://freebsdjournal.org/"&gt;FreeBSD Journal looking for book reviewers&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://ramsdenj.com/2018/05/29/zedenv-zfs-boot-environment-manager.html"&gt;zedenv ZFS Boot Environment Manager&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Wouter - &lt;a href="http://dpaste.com/28959CK#wrap"&gt;Feedback&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Efraim - &lt;a href="http://dpaste.com/2RZ16K8#wrap"&gt;OS Suggestion&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;kevr - &lt;a href="http://dpaste.com/2PX7KSP#wrap"&gt;Raspberry Pi2/FreeBSD/Router on a Stick&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Vanja - &lt;a href="http://dpaste.com/0ARSVWE#wrap"&gt;Interview Suggestion&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, tutorial, howto, guide, bsd, interview, MirBSD, korn shell, Plan9 Jehanne, sndiod, bsdcan, PineBook</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Fanless server setup with FreeBSD, NetBSD on pinebooks, another BSDCan trip report, transparent network audio, MirBSD&#39;s Korn Shell on Plan9, static site generators on OpenBSD, and more.</p>

<p>##Headlines<br>
###<a href="https://vermaden.wordpress.com/2018/06/07/silent-fanless-freebsd-desktop-server/">Silent Fanless FreeBSD Desktop/Server</a></p>

<blockquote>
<p>Today I will write about silent fanless FreeBSD desktop or server computer … or NAS … or you name it, it can have multiple purposes. It also very low power solution, which also means that it will not overheat. Silent means no fans at all, even for the PSU. The format of the system should also be brought to minimum, so Mini-ITX seems best solution here.</p>
</blockquote>

<blockquote>
<p>I have chosen Intel based solutions as they are very low power (6-10W), if you prefer AMD (as I often do) the closest solution in comparable price and power is Biostar A68N-2100 motherboard with AMD E1-2100 CPU and 9W power. Of course AMD has even more low power SoC solutions but finding the Mini-ITX motherboard with decent price is not an easy task. For comparison Intel has lots of such solutions below 6W whose can be nicely filtered on the <a href="http://ark.intel.com">ark.intel.com</a> page. Pity that AMD does not provide such filtration for their products. I also chosen AES instructions as storage encryption (GELI on FreeBSD) today seems as obvious as HTTPS for the web pages.</p>
</blockquote>

<ul>
<li><a href="https://vermaden.files.wordpress.com/2018/06/itx-mobo.jpg">Here is how the system look powered up and working</a></li>
</ul>

<blockquote>
<p>This motherboard uses Intel J3355 SoC which uses 10W and has AES instructions. It has two cores at your disposal but it also supports VT-x and EPT extensions so you can even run Bhyve on it.</p>
</blockquote>

<ul>
<li>Components</li>
</ul>

<blockquote>
<p>Now, an example system would look like that one below, here are the components with their prices.</p>
</blockquote>

<ul>
<li>$49  CPU/Motherboard ASRock J3355B-ITX Mini-ITX</li>
<li>$14  RAM Crucial 4 GB DDR3L 1.35V (low power)</li>
<li>$17  PSU 12V 160W Pico (internal)</li>
<li>$11  PSU 12V 96W FSP (external)</li>
<li>$5  USB 2.0 Drive 16 GB ADATA</li>
<li>$4  USB Wireless 802.11n</li>
<li>$100  TOTAL</li>
</ul>

<blockquote>
<p>The PSU 12V 160W Pico (internal) and PSU 12V 96W FSP can be purchased on <a href="http://aliexpress.com">aliexpress.com</a> or <a href="http://ebay.com">ebay.com</a> for example, at least I got them there.  Here is the 12V 160W Pico (internal) PSU and its optional additional cables to power the optional HDDs. If course its one SATA power and one MOLEX power so additional MOLEX-SATA power adapter for about 1$ would be needed. Here is the 12V 96W FSP (external) PSU without the power cord.</p>
</blockquote>

<blockquote>
<p>This gives as total silent fanless system price of about $120. Its about ONE TENTH OF THE COST of the cheapest FreeNAS hardware solution available – the FreeNAS Mini (Diskless) costs $1156 also without disks.</p>
</blockquote>

<blockquote>
<p>You can put plain FreeBSD on top of it or Solaris/Illumos distribution OmniOSce which is server oriented. You can use prebuilt NAS solution based on FreeBSD like FreeNAS, NAS4Free, ZFSguru or even Solaris/Illumos based storage with napp-it appliance.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/pinebook">An annotated look at a NetBSD Pinebook’s startup</a></p>

<ul>
<li>Pinebook is an affordable 64-bit ARM notebook. Today we’re going to take a look at the kernel output at startup and talk about what hardware support is available on NetBSD.</li>
<li><a href="https://twitter.com/jmcwhatever/status/998258710496628736/photo/1">Photo</a></li>
<li>Pinebook comes with 2GB RAM standard. A small amount of this is reserved by the kernel and framebuffer.</li>
<li>NetBSD uses flattened device-tree (FDT) to enumerate devices on all Allwinner based SoCs. On a running system, you can inspect the device tree using the ofctl(8) utility:</li>
<li>Pinebook’s Allwinner A64 processor is based on the ARM Cortex-A53. It is designed to run at frequencies up to 1.2GHz.</li>
<li>The A64 is a quad core design. NetBSD’s aarch64 pmap does not yet support SMP, so three cores are disabled for now.</li>
<li>The interrupt controller is a standard ARM GIC-400 design.</li>
<li>Clock drivers for managing PLLs, module clock dividers, clock gating, software resets, etc. Information about the clock tree is exported in the hw.clk sysctl namespace (root access required to read these values).</li>
</ul>

<pre><code># sysctl hw.clk.sun50ia64ccu0.mmc2
hw.clk.sun50ia64ccu0.mmc2.rate = 200000000
hw.clk.sun50ia64ccu0.mmc2.parent = pll_periph0_2x
hw.clk.sun50ia64ccu0.mmc2.parent_domain = sun50ia64ccu0
</code></pre>

<p><hr></p>

<p><strong>Digital Ocean</strong><br>
<a href="http://do.co/bsdnow">http://do.co/bsdnow</a></p>

<p>###<a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-mark-johnston/">BSDCan 2018 Trip Report: Mark Johnston</a></p>

<blockquote>
<p>BSDCan is a highlight of my summers: the ability to have face-to-face conversations with fellow developers and contributors is invaluable and always helps refresh my enthusiasm for FreeBSD.  While in a perfect world we would all be able to communicate effectively over the Internet, it’s often noted that locking a group of developers together in a room can be a very efficient way to make progress on projects that otherwise get strung out over time, and to me this is one of the principal functions of BSD conferences.  In my case I was able to fix some kgdb bugs that had been hindering me for months; get some opinions on the design of a feature I’ve been working on for FreeBSD 12.0; hear about some ongoing usage of code that I’ve worked on; and do some pair-debugging of an issue that has been affecting another developer.<br>
As is tradition, on Tuesday night I dropped off my things at the university residence where I was staying, and headed straight to the Royal Oak.  This year it didn’t seem quite as packed with BSD developers, but I did meet several long-time colleagues and get a chance to catch up.  In particular, I chatted with Justin Hibbits and got to hear about the bring-up of FreeBSD on POWER9, a new CPU family released by IBM.  Justin was able to acquire a workstation based upon this CPU, which is a great motivator for getting FreeBSD into shape on that platform.  POWER9 also has some promise in the server market, so it’s important for FreeBSD to be a viable OS choice there.<br>
Wednesday morning saw the beginning of the two-day FreeBSD developer summit, which precedes the conference proper.  Gordon Tetlow led the summit and did an excellent job organizing things and keeping to the schedule.  The first presentation was by Deb Goodkin of the FreeBSD Foundation, who gave an overview of the Foundation’s role and activities. After Deb’s presentation, present members of the FreeBSD core team discussed the work they had done over the past two years, as well as open tasks that would be handed over to the new core team upon completion of the ongoing election.  Finally, Marius Strobl rounded off the day’s presentations by discussing the state and responsibilities of FreeBSD’s release engineering team.<br>
One side discussion of interest to me was around the notion of tightening integration with our Bugzilla instance; at moment we do not have any good means to mark a given bug as blocking a release, making it easy for bugs to slip into releases and thus lowering our overall quality.  With FreeBSD 12.0 upon us, I plan to help with the triage and fixes for known regressions before the release process begins.<br>
After a break, the rest of the morning was devoted to plans for features in upcoming FreeBSD releases.  This is one of my favorite discussion topics and typically takes the form of have/need/want, where developers collectively list features that they’ve developed and intend to upstream (have), features that they are missing (need), and nice-to-have features (want).  This year, instead of the usual format, we listed features that are intended to ship in FreeBSD 12.0.  The compiled list ended up being quite ambitious given how close we are to the beginning of the release cycle, but many individual developers (including myself) have signed up to deliver work.  I’m hopeful that most, if not all of it, will make it into the release.<br>
After lunch, I attended a discussion led by Matt Ahrens and Alexander Motin on OpenZFS.  Of particular interest to me were some observations made regarding the relative quantity and quality of contributions made by different “camps” of OpenZFS users (illumos, FreeBSD and ZoL), and their respective track records of upstreaming enhancements to the OpenZFS project. In part due to the high pace of changes in ZoL, the definition of “upstream” for ZFS has become murky, and of late ZFS changes have been ported directly from ZoL.  Alexander discussed some known problems with ZFS on FreeBSD that have been discovered through performance testing.  While I’m not familiar with ZFS internals, Alexander noted that ZFS’ write path has poor SMP scalability on FreeBSD owing to some limitations in a certain kernel API called taskqueue(9).  I would like to explore this problem further and perhaps integrate a relatively new alternative interface which should perform better.<br>
Friday and Saturday were, of course, taken up by BSDCan talks.  Friday’s keynote was by Benno Rice, who provided some history of UNIX boot systems as a precursor to some discussion of systemd and the difficulties presented by a user and developer community that actively resist change.  The rest of the morning was consumed by talks and passed by quickly. First was Colin Percival’s detailed examination of where the FreeBSD kernel spends time during boot, together with an overview of some infrastructure he added to track boot times. He also provided a list of improvements that have been made since he started taking measurements, and some areas we can further improve.  Colin’s existing work in this area has already brought about substantial reductions in boot time; amusingly, one of the remaining large delays comes from the keyboard driver, which contains a workaround for old PS/2 keyboards.  While there seems to be general agreement that the workaround is probably no longer needed on most systems, the lingering uncertainty around this prevents us from removing the workaround.  This is, sadly, a fairly typical example of an OS maintenance burden, and underscores the need to carefully document hardware bug workarounds.  After this talk, I got to see some rather novel demonstrations of system tracing using dwatch, a new utility by Devin Teske, which aims to provide a user-friendly interface to DTrace.  After lunch, I attended talks on netdump, a protocol for transmitting kernel dumps over a network after the system has panicked, and on a VPC implementation for FreeBSD.  After the talks ended, I headed yet again to the hacker lounge and had some fruitful discussions on early microcode loading (one of my features for FreeBSD 12.0). These led me to reconsider some aspects of my approach and saved me a lot of time.  Finally, I continued my debugging session from Wednesday with help from a couple of other developers.<br>
Saturday’s talks included a very thorough account by Li-Wen Hsu of his work in organizing a BSD conference in Taipei last year.  As one of the attendees, I had felt that the conference had gone quite smoothly and was taken aback by the number of details and pitfalls that Li-Wen enumerated during his talk. This was followed by an excellent talk by Baptiste Daroussin on the difficulties one encounters when deploying FreeBSD in new environments. Baptiste offered criticisms of a number of aspects of FreeBSD, some of which hit close to home as they involved portions of the system that I’ve worked on.<br>
At the conclusion of the talks, we all gathered in the main lecture hall, where Dan led a traditional and quite lively auction for charity.  I managed to snag a Pine64 board and will be getting FreeBSD installed on it the first chance I get.  At the end of the auction, we all headed to ByWard for dinner, concluding yet another BSDCan.</p>
</blockquote>

<ul>
<li>Thanks to Mark for sharing his experiences at this years BSDCan</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://undeadly.org/cgi?action=article&amp;sid=20180410063454">Transparent network audio with mpd &amp; sndiod</a></p>

<blockquote>
<p>Landry Breuil (landry@ when wearing his developer hat) wrote in…</p>
</blockquote>

<pre><code>I've been a huge fan of MPD over the years to centralize my audio collection, and i've been using it with the http output to stream the music as a radio on the computer i'm currently using…

audio_output {
       type            &quot;sndio&quot;
       name            &quot;Local speakers&quot;
       mixer_type      &quot;software&quot;
}
audio_output {
       type            &quot;httpd&quot;
       name            &quot;HTTP stream&quot;
       mixer_type      &quot;software&quot;
       encoder         &quot;vorbis&quot;
       port            &quot;8000&quot;
       format          &quot;44100:16:2&quot;
}
this setup worked for years, allows me to stream my home radio to $work by tunnelling the port 8000 over ssh via LocalForward, but that still has some issues:

a distinct timing gap between the 'local output' (ie the speakers connected to the machine where MPD is running) and the 'http output' caused by the time it takes to reencode the stream, which is ugly when you walk through the house and have a 15s delay
sometimes mplayer as a client doesn't detect the pauses in the stream and needs to be restarted
i need to configure/start a client on each computer and point it at the sound server url (can do via gmpc shoutcast client plugin…)
it's not that elegant to reencode the stream, and it wastes cpu cycles
So the current scheme is:

mpd -&gt; http output -&gt; network -&gt; mplayer -&gt; sndiod on remote machine
|
-&gt; sndio output -&gt; sndiod on soundserver
Fiddling a little bit with mpd outputs and reading the sndio output driver, i remembered sndiod has native network support… and the mpd sndio output allows you to specify a device (it uses SIO_DEVANY by default).

So in the end, it's super easy to:

enable network support in sndio on the remote machine i want the audio to play by adding -L&lt;local ip&gt; to sndiod_flags (i have two audio devices, with an input coming from the webcam):
sndiod_flags=&quot;-L10.246.200.10 -f rsnd/0 -f rsnd/1&quot;
open pf on port 11025 from the sound server ip:
pass in proto tcp from 10.246.200.1 to any port 11025
configure a new output in mpd:
audio_output {
       type            &quot;sndio&quot;
       name            &quot;sndio on renton&quot;
       device          &quot;snd@10.246.200.10/0&quot;
       mixer_type      &quot;software&quot;
}
and enable the new output in mpd:
$mpc enable 2
Output 1 (Local speakers) is disabled
Output 2 (sndio on renton) is enabled
Output 3 (HTTP stream) is disabled
Results in a big win: no gap anymore with the local speakers, no reencoding, no need to configure a client to play the stream, and i can still probably reproduce the same scheme over ssh from $work using a RemoteForward.

mpd -&gt; sndio output 2 -&gt; network -&gt; sndiod on remote machine
|
-&gt; sndio output 1 -&gt; sndiod on soundserver
Thanks ratchov@ for sndiod :)
</code></pre>

<p><hr></p>

<p>###<a href="https://www.mirbsd.org/permalinks/wlog-10_e20180415-tg.htm">MirBSD’s Korn Shell on Plan9 Jehanne</a></p>

<blockquote>
<p>Let start by saying that I’m not really a C programmer.<br>
My last public contribution to a POSIX C program was a little improvement to the Snort’s react module back in 2008.<br>
So while I know the C language well enough, I do not know anything about the subtleness of the standard library and I have little experience with POSIX semantics.<br>
This is not a big issue with Plan 9, since the C library and compiler are not standard anyway, but with Jehanne (a Plan 9 derivative of my own) I want to build a simple, loosely coupled, system that can actually run useful free software ported from UNIX.<br>
So I ported RedHat’s newlib to Jehanne on top of a new system library I wrote, LibPOSIX, that provides the necessary emulations. I wrote several test, checking they run the same on Linux and Jehanne, and then I begun looking for a real-world, battle tested, application to port first.<br>
I approached MirBSD’s Korn Shell for several reason:</p>
</blockquote>

<ul>
<li>it is simple, powerful and well written</li>
<li>it has been ported to several different operating systems</li>
<li>it has few dependencies</li>
<li>it’s the default shell in Android, so it’s really battle tested</li>
</ul>

<blockquote>
<p>I was very confident. I had read the POSIX standard after all! And I had a test suite!<br>
I remember, I thought “Given newlib, how hard can it be?”<br>
The porting begun on September 1, 2017. It was completed by tg on January 5, 2018. 125 nights later.<br>
Turn out, my POSIX emulation was badly broken. Not just because of the usual bugs that any piece of C can have: I didn’t understood most POSIX semantics at all!</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###<a href="https://www.romanzolotarev.com/ssg.html">Static site generator with rsync and lowdown on OpenBSD</a></p>

<ul>
<li>
<p>ssg is a tiny POSIX-compliant shell script with few dependencies:</p>
</li>
<li>
<p>lowdown(1) to parse markdown,</p>
</li>
<li>
<p>rsync(1) to copy temporary files, and</p>
</li>
<li>
<p>entr(1) to watch file changes.</p>
</li>
<li>
<p>It generates Markdown articles to a static website.</p>
</li>
<li>
<p>It copies the current directory to a temporary on in /tmp skipping .* and _*, renders all Markdown articles to HTML, generates RSS feed based on links from index.html, extracts the first &lt;h1&gt; tag from every article to generate a sitemap and use it as a page title, then wraps articles with a single HTML template, copies everything from the temporary directory to $DOCS/</p>
</li>
</ul>

<blockquote>
<p>Why not Jekyll or “$X”?</p>
</blockquote>

<ul>
<li>ssg is one hundred times smaller than Jekyll.</li>
</ul>

<blockquote>
<p>ssg and its dependencies are about 800KB combined. Compare that to 78MB of ruby with Jekyll and all the gems. So ssg can be installed in just few seconds on almost any Unix-like operating system.<br>
Obviously, ssg is tailored for my needs, it has all features I need and only those I use.<br>
Keeping ssg helps you to master your Unix-shell skills: awk, grep, sed, sh, cut, tr. As a web developer you work with lots of text: code and data. So you better master these wonderful tools.</p>
</blockquote>

<ul>
<li>Performance</li>
</ul>

<blockquote>
<p>100 pps. On modern computers ssg generates a hundred pages per second. Half of a time for markdown rendering and another half for wrapping articles into the template. I heard good static site generators work—twice as fast—at 200 pps, so there’s lots of performance that can be gained. ;)</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.quora.com/Why-does-FreeBSD-have-virtually-no-0-desktop-market-share/answer/Terry-Lambert">Why does FreeBSD have virtually no (0%) desktop market share?</a></p>

<ul>
<li>Because someone made a horrible design decision back in 1984.</li>
</ul>

<blockquote>
<p>In absolute fairness to those involved, it was an understandable decision, both from a research perspective, and from an economic perspective, although likely not, from a technology perspective.</p>
</blockquote>

<ul>
<li>Why and what.</li>
</ul>

<blockquote>
<p>The decision was taken because the X Window System was intended to run on cheap hardware, and, at the time, that meant reduced functionality in the end-point device with the physical display attached to it.<br>
At the same time, another force was acting to also limit X displays to display services only, rather than rolling in both window management and specific widget instances for common operational paradigms.<br>
Mostly, common operational paradigms didn’t really exist for windowing systems because they also simply didn’t exist at the time, and no one really knew how people were going to use the things, and so researchers didn’t want to commit future research to a set of hard constraints.<br>
So a decision was made: separate the display services from the application at the lowest level of graphics primitives currently in use at the time.</p>
</blockquote>

<ul>
<li>The ramifications of this were pretty staggering.</li>
</ul>

<blockquote>
<p>First, it guaranteed that all higher level graphics would live on the host side of the X protocol, instead of on the display device side of the protocol.<br>
Despite a good understanding of Moore’s law, and the fact that, since no X Terminals existed at the time as hardware, but were instead running as emulations on workstations that had sufficient capability, this put the higher level GUI object libraries — referred to as “widgets” — in host libraries linked into the applications.<br>
Second, it guaranteed that display organization and management paradigms would also live on the host side of the protocol — assumed, in contradiction to the previous decision, to be running on the workstation.<br>
But, presumably, at some point, as lightweight X Terminals became available, to migrate to a particular host computer managing compute resource login/access services.</p>
</blockquote>

<ul>
<li>Between these early decisions reigned chaos.</li>
</ul>

<blockquote>
<p>Specifically, the consequences of these decisions have been with us ever since:<br>
Look-and-feel are a consequence of the toolkit chosen by the application programmer, rather than a user decision which applies universally to all applications.<br>
You could call this “lack of a theme”, and — although I personally despise the idea of customizing or “theming” desktops — this meant that one paradigm chosen by the user would not apply universally across all applications, no matter who had written them.<br>
Window management style is a preference.<br>
You could call this a more radical version of “theming” — which you will remember, I despise — but a consequence to this is that training is not universal across personnel using such systems, nor is it transferrable.<br>
In other words, I can’t send someone to a class, and have them come back and use the computers in the office as a tool, with the computer itself — and the elements not specific to the application itself — disappearing into the background.<br>
Both of these ultimately render an X-based system unsuitable for desktops.<br>
I can’t pay once for training. Training that I do pay for does not easily and naturally translate between applications. Each new version may radically alter the desktop management paradigm into unrecognizability.</p>
</blockquote>

<ul>
<li>Is there hope for the future?</li>
</ul>

<blockquote>
<p>Well, the Linux community has been working on something called Wayland, and it is very promising…<br>
…In the same way X was “very promising” in 1984, because, unfortunately, they are making exactly the same mistakes X made in 1984, rather than correcting them, now that we have 20/20 hindsight, and know what a mature widget library should look like.<br>
So Wayland is screwing up again.<br>
But hey, it only took us, what, 25 years to get from X in 1987 to Wayland in in 2012.<br>
Maybe if we try again in 2037, we can get to where Windows was in 1995.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://twitter.com/FranckPachot/status/1012606253338591232">New washing machine comes with 7 pages of open source licenses!</a></li>
<li><a href="https://www.bsdjobs.com/">BSD Jobs Site</a></li>
<li><a href="https://www.freebsdfoundation.org/wp-content/uploads/2018/05/FreeBSD-Foundation-May-2018-Update.pdf">FreeBSD Foundation Update, May 2018</a></li>
<li><a href="http://freebsdjournal.org/">FreeBSD Journal looking for book reviewers</a></li>
<li><a href="https://ramsdenj.com/2018/05/29/zedenv-zfs-boot-environment-manager.html">zedenv ZFS Boot Environment Manager</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Wouter - <a href="http://dpaste.com/28959CK#wrap">Feedback</a></li>
<li>Efraim - <a href="http://dpaste.com/2RZ16K8#wrap">OS Suggestion</a></li>
<li>kevr - <a href="http://dpaste.com/2PX7KSP#wrap">Raspberry Pi2/FreeBSD/Router on a Stick</a></li>
<li>Vanja - <a href="http://dpaste.com/0ARSVWE#wrap">Interview Suggestion</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Fanless server setup with FreeBSD, NetBSD on pinebooks, another BSDCan trip report, transparent network audio, MirBSD&#39;s Korn Shell on Plan9, static site generators on OpenBSD, and more.</p>

<p>##Headlines<br>
###<a href="https://vermaden.wordpress.com/2018/06/07/silent-fanless-freebsd-desktop-server/">Silent Fanless FreeBSD Desktop/Server</a></p>

<blockquote>
<p>Today I will write about silent fanless FreeBSD desktop or server computer … or NAS … or you name it, it can have multiple purposes. It also very low power solution, which also means that it will not overheat. Silent means no fans at all, even for the PSU. The format of the system should also be brought to minimum, so Mini-ITX seems best solution here.</p>
</blockquote>

<blockquote>
<p>I have chosen Intel based solutions as they are very low power (6-10W), if you prefer AMD (as I often do) the closest solution in comparable price and power is Biostar A68N-2100 motherboard with AMD E1-2100 CPU and 9W power. Of course AMD has even more low power SoC solutions but finding the Mini-ITX motherboard with decent price is not an easy task. For comparison Intel has lots of such solutions below 6W whose can be nicely filtered on the <a href="http://ark.intel.com">ark.intel.com</a> page. Pity that AMD does not provide such filtration for their products. I also chosen AES instructions as storage encryption (GELI on FreeBSD) today seems as obvious as HTTPS for the web pages.</p>
</blockquote>

<ul>
<li><a href="https://vermaden.files.wordpress.com/2018/06/itx-mobo.jpg">Here is how the system look powered up and working</a></li>
</ul>

<blockquote>
<p>This motherboard uses Intel J3355 SoC which uses 10W and has AES instructions. It has two cores at your disposal but it also supports VT-x and EPT extensions so you can even run Bhyve on it.</p>
</blockquote>

<ul>
<li>Components</li>
</ul>

<blockquote>
<p>Now, an example system would look like that one below, here are the components with their prices.</p>
</blockquote>

<ul>
<li>$49  CPU/Motherboard ASRock J3355B-ITX Mini-ITX</li>
<li>$14  RAM Crucial 4 GB DDR3L 1.35V (low power)</li>
<li>$17  PSU 12V 160W Pico (internal)</li>
<li>$11  PSU 12V 96W FSP (external)</li>
<li>$5  USB 2.0 Drive 16 GB ADATA</li>
<li>$4  USB Wireless 802.11n</li>
<li>$100  TOTAL</li>
</ul>

<blockquote>
<p>The PSU 12V 160W Pico (internal) and PSU 12V 96W FSP can be purchased on <a href="http://aliexpress.com">aliexpress.com</a> or <a href="http://ebay.com">ebay.com</a> for example, at least I got them there.  Here is the 12V 160W Pico (internal) PSU and its optional additional cables to power the optional HDDs. If course its one SATA power and one MOLEX power so additional MOLEX-SATA power adapter for about 1$ would be needed. Here is the 12V 96W FSP (external) PSU without the power cord.</p>
</blockquote>

<blockquote>
<p>This gives as total silent fanless system price of about $120. Its about ONE TENTH OF THE COST of the cheapest FreeNAS hardware solution available – the FreeNAS Mini (Diskless) costs $1156 also without disks.</p>
</blockquote>

<blockquote>
<p>You can put plain FreeBSD on top of it or Solaris/Illumos distribution OmniOSce which is server oriented. You can use prebuilt NAS solution based on FreeBSD like FreeNAS, NAS4Free, ZFSguru or even Solaris/Illumos based storage with napp-it appliance.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/pinebook">An annotated look at a NetBSD Pinebook’s startup</a></p>

<ul>
<li>Pinebook is an affordable 64-bit ARM notebook. Today we’re going to take a look at the kernel output at startup and talk about what hardware support is available on NetBSD.</li>
<li><a href="https://twitter.com/jmcwhatever/status/998258710496628736/photo/1">Photo</a></li>
<li>Pinebook comes with 2GB RAM standard. A small amount of this is reserved by the kernel and framebuffer.</li>
<li>NetBSD uses flattened device-tree (FDT) to enumerate devices on all Allwinner based SoCs. On a running system, you can inspect the device tree using the ofctl(8) utility:</li>
<li>Pinebook’s Allwinner A64 processor is based on the ARM Cortex-A53. It is designed to run at frequencies up to 1.2GHz.</li>
<li>The A64 is a quad core design. NetBSD’s aarch64 pmap does not yet support SMP, so three cores are disabled for now.</li>
<li>The interrupt controller is a standard ARM GIC-400 design.</li>
<li>Clock drivers for managing PLLs, module clock dividers, clock gating, software resets, etc. Information about the clock tree is exported in the hw.clk sysctl namespace (root access required to read these values).</li>
</ul>

<pre><code># sysctl hw.clk.sun50ia64ccu0.mmc2
hw.clk.sun50ia64ccu0.mmc2.rate = 200000000
hw.clk.sun50ia64ccu0.mmc2.parent = pll_periph0_2x
hw.clk.sun50ia64ccu0.mmc2.parent_domain = sun50ia64ccu0
</code></pre>

<p><hr></p>

<p><strong>Digital Ocean</strong><br>
<a href="http://do.co/bsdnow">http://do.co/bsdnow</a></p>

<p>###<a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-mark-johnston/">BSDCan 2018 Trip Report: Mark Johnston</a></p>

<blockquote>
<p>BSDCan is a highlight of my summers: the ability to have face-to-face conversations with fellow developers and contributors is invaluable and always helps refresh my enthusiasm for FreeBSD.  While in a perfect world we would all be able to communicate effectively over the Internet, it’s often noted that locking a group of developers together in a room can be a very efficient way to make progress on projects that otherwise get strung out over time, and to me this is one of the principal functions of BSD conferences.  In my case I was able to fix some kgdb bugs that had been hindering me for months; get some opinions on the design of a feature I’ve been working on for FreeBSD 12.0; hear about some ongoing usage of code that I’ve worked on; and do some pair-debugging of an issue that has been affecting another developer.<br>
As is tradition, on Tuesday night I dropped off my things at the university residence where I was staying, and headed straight to the Royal Oak.  This year it didn’t seem quite as packed with BSD developers, but I did meet several long-time colleagues and get a chance to catch up.  In particular, I chatted with Justin Hibbits and got to hear about the bring-up of FreeBSD on POWER9, a new CPU family released by IBM.  Justin was able to acquire a workstation based upon this CPU, which is a great motivator for getting FreeBSD into shape on that platform.  POWER9 also has some promise in the server market, so it’s important for FreeBSD to be a viable OS choice there.<br>
Wednesday morning saw the beginning of the two-day FreeBSD developer summit, which precedes the conference proper.  Gordon Tetlow led the summit and did an excellent job organizing things and keeping to the schedule.  The first presentation was by Deb Goodkin of the FreeBSD Foundation, who gave an overview of the Foundation’s role and activities. After Deb’s presentation, present members of the FreeBSD core team discussed the work they had done over the past two years, as well as open tasks that would be handed over to the new core team upon completion of the ongoing election.  Finally, Marius Strobl rounded off the day’s presentations by discussing the state and responsibilities of FreeBSD’s release engineering team.<br>
One side discussion of interest to me was around the notion of tightening integration with our Bugzilla instance; at moment we do not have any good means to mark a given bug as blocking a release, making it easy for bugs to slip into releases and thus lowering our overall quality.  With FreeBSD 12.0 upon us, I plan to help with the triage and fixes for known regressions before the release process begins.<br>
After a break, the rest of the morning was devoted to plans for features in upcoming FreeBSD releases.  This is one of my favorite discussion topics and typically takes the form of have/need/want, where developers collectively list features that they’ve developed and intend to upstream (have), features that they are missing (need), and nice-to-have features (want).  This year, instead of the usual format, we listed features that are intended to ship in FreeBSD 12.0.  The compiled list ended up being quite ambitious given how close we are to the beginning of the release cycle, but many individual developers (including myself) have signed up to deliver work.  I’m hopeful that most, if not all of it, will make it into the release.<br>
After lunch, I attended a discussion led by Matt Ahrens and Alexander Motin on OpenZFS.  Of particular interest to me were some observations made regarding the relative quantity and quality of contributions made by different “camps” of OpenZFS users (illumos, FreeBSD and ZoL), and their respective track records of upstreaming enhancements to the OpenZFS project. In part due to the high pace of changes in ZoL, the definition of “upstream” for ZFS has become murky, and of late ZFS changes have been ported directly from ZoL.  Alexander discussed some known problems with ZFS on FreeBSD that have been discovered through performance testing.  While I’m not familiar with ZFS internals, Alexander noted that ZFS’ write path has poor SMP scalability on FreeBSD owing to some limitations in a certain kernel API called taskqueue(9).  I would like to explore this problem further and perhaps integrate a relatively new alternative interface which should perform better.<br>
Friday and Saturday were, of course, taken up by BSDCan talks.  Friday’s keynote was by Benno Rice, who provided some history of UNIX boot systems as a precursor to some discussion of systemd and the difficulties presented by a user and developer community that actively resist change.  The rest of the morning was consumed by talks and passed by quickly. First was Colin Percival’s detailed examination of where the FreeBSD kernel spends time during boot, together with an overview of some infrastructure he added to track boot times. He also provided a list of improvements that have been made since he started taking measurements, and some areas we can further improve.  Colin’s existing work in this area has already brought about substantial reductions in boot time; amusingly, one of the remaining large delays comes from the keyboard driver, which contains a workaround for old PS/2 keyboards.  While there seems to be general agreement that the workaround is probably no longer needed on most systems, the lingering uncertainty around this prevents us from removing the workaround.  This is, sadly, a fairly typical example of an OS maintenance burden, and underscores the need to carefully document hardware bug workarounds.  After this talk, I got to see some rather novel demonstrations of system tracing using dwatch, a new utility by Devin Teske, which aims to provide a user-friendly interface to DTrace.  After lunch, I attended talks on netdump, a protocol for transmitting kernel dumps over a network after the system has panicked, and on a VPC implementation for FreeBSD.  After the talks ended, I headed yet again to the hacker lounge and had some fruitful discussions on early microcode loading (one of my features for FreeBSD 12.0). These led me to reconsider some aspects of my approach and saved me a lot of time.  Finally, I continued my debugging session from Wednesday with help from a couple of other developers.<br>
Saturday’s talks included a very thorough account by Li-Wen Hsu of his work in organizing a BSD conference in Taipei last year.  As one of the attendees, I had felt that the conference had gone quite smoothly and was taken aback by the number of details and pitfalls that Li-Wen enumerated during his talk. This was followed by an excellent talk by Baptiste Daroussin on the difficulties one encounters when deploying FreeBSD in new environments. Baptiste offered criticisms of a number of aspects of FreeBSD, some of which hit close to home as they involved portions of the system that I’ve worked on.<br>
At the conclusion of the talks, we all gathered in the main lecture hall, where Dan led a traditional and quite lively auction for charity.  I managed to snag a Pine64 board and will be getting FreeBSD installed on it the first chance I get.  At the end of the auction, we all headed to ByWard for dinner, concluding yet another BSDCan.</p>
</blockquote>

<ul>
<li>Thanks to Mark for sharing his experiences at this years BSDCan</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://undeadly.org/cgi?action=article&amp;sid=20180410063454">Transparent network audio with mpd &amp; sndiod</a></p>

<blockquote>
<p>Landry Breuil (landry@ when wearing his developer hat) wrote in…</p>
</blockquote>

<pre><code>I've been a huge fan of MPD over the years to centralize my audio collection, and i've been using it with the http output to stream the music as a radio on the computer i'm currently using…

audio_output {
       type            &quot;sndio&quot;
       name            &quot;Local speakers&quot;
       mixer_type      &quot;software&quot;
}
audio_output {
       type            &quot;httpd&quot;
       name            &quot;HTTP stream&quot;
       mixer_type      &quot;software&quot;
       encoder         &quot;vorbis&quot;
       port            &quot;8000&quot;
       format          &quot;44100:16:2&quot;
}
this setup worked for years, allows me to stream my home radio to $work by tunnelling the port 8000 over ssh via LocalForward, but that still has some issues:

a distinct timing gap between the 'local output' (ie the speakers connected to the machine where MPD is running) and the 'http output' caused by the time it takes to reencode the stream, which is ugly when you walk through the house and have a 15s delay
sometimes mplayer as a client doesn't detect the pauses in the stream and needs to be restarted
i need to configure/start a client on each computer and point it at the sound server url (can do via gmpc shoutcast client plugin…)
it's not that elegant to reencode the stream, and it wastes cpu cycles
So the current scheme is:

mpd -&gt; http output -&gt; network -&gt; mplayer -&gt; sndiod on remote machine
|
-&gt; sndio output -&gt; sndiod on soundserver
Fiddling a little bit with mpd outputs and reading the sndio output driver, i remembered sndiod has native network support… and the mpd sndio output allows you to specify a device (it uses SIO_DEVANY by default).

So in the end, it's super easy to:

enable network support in sndio on the remote machine i want the audio to play by adding -L&lt;local ip&gt; to sndiod_flags (i have two audio devices, with an input coming from the webcam):
sndiod_flags=&quot;-L10.246.200.10 -f rsnd/0 -f rsnd/1&quot;
open pf on port 11025 from the sound server ip:
pass in proto tcp from 10.246.200.1 to any port 11025
configure a new output in mpd:
audio_output {
       type            &quot;sndio&quot;
       name            &quot;sndio on renton&quot;
       device          &quot;snd@10.246.200.10/0&quot;
       mixer_type      &quot;software&quot;
}
and enable the new output in mpd:
$mpc enable 2
Output 1 (Local speakers) is disabled
Output 2 (sndio on renton) is enabled
Output 3 (HTTP stream) is disabled
Results in a big win: no gap anymore with the local speakers, no reencoding, no need to configure a client to play the stream, and i can still probably reproduce the same scheme over ssh from $work using a RemoteForward.

mpd -&gt; sndio output 2 -&gt; network -&gt; sndiod on remote machine
|
-&gt; sndio output 1 -&gt; sndiod on soundserver
Thanks ratchov@ for sndiod :)
</code></pre>

<p><hr></p>

<p>###<a href="https://www.mirbsd.org/permalinks/wlog-10_e20180415-tg.htm">MirBSD’s Korn Shell on Plan9 Jehanne</a></p>

<blockquote>
<p>Let start by saying that I’m not really a C programmer.<br>
My last public contribution to a POSIX C program was a little improvement to the Snort’s react module back in 2008.<br>
So while I know the C language well enough, I do not know anything about the subtleness of the standard library and I have little experience with POSIX semantics.<br>
This is not a big issue with Plan 9, since the C library and compiler are not standard anyway, but with Jehanne (a Plan 9 derivative of my own) I want to build a simple, loosely coupled, system that can actually run useful free software ported from UNIX.<br>
So I ported RedHat’s newlib to Jehanne on top of a new system library I wrote, LibPOSIX, that provides the necessary emulations. I wrote several test, checking they run the same on Linux and Jehanne, and then I begun looking for a real-world, battle tested, application to port first.<br>
I approached MirBSD’s Korn Shell for several reason:</p>
</blockquote>

<ul>
<li>it is simple, powerful and well written</li>
<li>it has been ported to several different operating systems</li>
<li>it has few dependencies</li>
<li>it’s the default shell in Android, so it’s really battle tested</li>
</ul>

<blockquote>
<p>I was very confident. I had read the POSIX standard after all! And I had a test suite!<br>
I remember, I thought “Given newlib, how hard can it be?”<br>
The porting begun on September 1, 2017. It was completed by tg on January 5, 2018. 125 nights later.<br>
Turn out, my POSIX emulation was badly broken. Not just because of the usual bugs that any piece of C can have: I didn’t understood most POSIX semantics at all!</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###<a href="https://www.romanzolotarev.com/ssg.html">Static site generator with rsync and lowdown on OpenBSD</a></p>

<ul>
<li>
<p>ssg is a tiny POSIX-compliant shell script with few dependencies:</p>
</li>
<li>
<p>lowdown(1) to parse markdown,</p>
</li>
<li>
<p>rsync(1) to copy temporary files, and</p>
</li>
<li>
<p>entr(1) to watch file changes.</p>
</li>
<li>
<p>It generates Markdown articles to a static website.</p>
</li>
<li>
<p>It copies the current directory to a temporary on in /tmp skipping .* and _*, renders all Markdown articles to HTML, generates RSS feed based on links from index.html, extracts the first &lt;h1&gt; tag from every article to generate a sitemap and use it as a page title, then wraps articles with a single HTML template, copies everything from the temporary directory to $DOCS/</p>
</li>
</ul>

<blockquote>
<p>Why not Jekyll or “$X”?</p>
</blockquote>

<ul>
<li>ssg is one hundred times smaller than Jekyll.</li>
</ul>

<blockquote>
<p>ssg and its dependencies are about 800KB combined. Compare that to 78MB of ruby with Jekyll and all the gems. So ssg can be installed in just few seconds on almost any Unix-like operating system.<br>
Obviously, ssg is tailored for my needs, it has all features I need and only those I use.<br>
Keeping ssg helps you to master your Unix-shell skills: awk, grep, sed, sh, cut, tr. As a web developer you work with lots of text: code and data. So you better master these wonderful tools.</p>
</blockquote>

<ul>
<li>Performance</li>
</ul>

<blockquote>
<p>100 pps. On modern computers ssg generates a hundred pages per second. Half of a time for markdown rendering and another half for wrapping articles into the template. I heard good static site generators work—twice as fast—at 200 pps, so there’s lots of performance that can be gained. ;)</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://www.quora.com/Why-does-FreeBSD-have-virtually-no-0-desktop-market-share/answer/Terry-Lambert">Why does FreeBSD have virtually no (0%) desktop market share?</a></p>

<ul>
<li>Because someone made a horrible design decision back in 1984.</li>
</ul>

<blockquote>
<p>In absolute fairness to those involved, it was an understandable decision, both from a research perspective, and from an economic perspective, although likely not, from a technology perspective.</p>
</blockquote>

<ul>
<li>Why and what.</li>
</ul>

<blockquote>
<p>The decision was taken because the X Window System was intended to run on cheap hardware, and, at the time, that meant reduced functionality in the end-point device with the physical display attached to it.<br>
At the same time, another force was acting to also limit X displays to display services only, rather than rolling in both window management and specific widget instances for common operational paradigms.<br>
Mostly, common operational paradigms didn’t really exist for windowing systems because they also simply didn’t exist at the time, and no one really knew how people were going to use the things, and so researchers didn’t want to commit future research to a set of hard constraints.<br>
So a decision was made: separate the display services from the application at the lowest level of graphics primitives currently in use at the time.</p>
</blockquote>

<ul>
<li>The ramifications of this were pretty staggering.</li>
</ul>

<blockquote>
<p>First, it guaranteed that all higher level graphics would live on the host side of the X protocol, instead of on the display device side of the protocol.<br>
Despite a good understanding of Moore’s law, and the fact that, since no X Terminals existed at the time as hardware, but were instead running as emulations on workstations that had sufficient capability, this put the higher level GUI object libraries — referred to as “widgets” — in host libraries linked into the applications.<br>
Second, it guaranteed that display organization and management paradigms would also live on the host side of the protocol — assumed, in contradiction to the previous decision, to be running on the workstation.<br>
But, presumably, at some point, as lightweight X Terminals became available, to migrate to a particular host computer managing compute resource login/access services.</p>
</blockquote>

<ul>
<li>Between these early decisions reigned chaos.</li>
</ul>

<blockquote>
<p>Specifically, the consequences of these decisions have been with us ever since:<br>
Look-and-feel are a consequence of the toolkit chosen by the application programmer, rather than a user decision which applies universally to all applications.<br>
You could call this “lack of a theme”, and — although I personally despise the idea of customizing or “theming” desktops — this meant that one paradigm chosen by the user would not apply universally across all applications, no matter who had written them.<br>
Window management style is a preference.<br>
You could call this a more radical version of “theming” — which you will remember, I despise — but a consequence to this is that training is not universal across personnel using such systems, nor is it transferrable.<br>
In other words, I can’t send someone to a class, and have them come back and use the computers in the office as a tool, with the computer itself — and the elements not specific to the application itself — disappearing into the background.<br>
Both of these ultimately render an X-based system unsuitable for desktops.<br>
I can’t pay once for training. Training that I do pay for does not easily and naturally translate between applications. Each new version may radically alter the desktop management paradigm into unrecognizability.</p>
</blockquote>

<ul>
<li>Is there hope for the future?</li>
</ul>

<blockquote>
<p>Well, the Linux community has been working on something called Wayland, and it is very promising…<br>
…In the same way X was “very promising” in 1984, because, unfortunately, they are making exactly the same mistakes X made in 1984, rather than correcting them, now that we have 20/20 hindsight, and know what a mature widget library should look like.<br>
So Wayland is screwing up again.<br>
But hey, it only took us, what, 25 years to get from X in 1987 to Wayland in in 2012.<br>
Maybe if we try again in 2037, we can get to where Windows was in 1995.</p>
</blockquote>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://twitter.com/FranckPachot/status/1012606253338591232">New washing machine comes with 7 pages of open source licenses!</a></li>
<li><a href="https://www.bsdjobs.com/">BSD Jobs Site</a></li>
<li><a href="https://www.freebsdfoundation.org/wp-content/uploads/2018/05/FreeBSD-Foundation-May-2018-Update.pdf">FreeBSD Foundation Update, May 2018</a></li>
<li><a href="http://freebsdjournal.org/">FreeBSD Journal looking for book reviewers</a></li>
<li><a href="https://ramsdenj.com/2018/05/29/zedenv-zfs-boot-environment-manager.html">zedenv ZFS Boot Environment Manager</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Wouter - <a href="http://dpaste.com/28959CK#wrap">Feedback</a></li>
<li>Efraim - <a href="http://dpaste.com/2RZ16K8#wrap">OS Suggestion</a></li>
<li>kevr - <a href="http://dpaste.com/2PX7KSP#wrap">Raspberry Pi2/FreeBSD/Router on a Stick</a></li>
<li>Vanja - <a href="http://dpaste.com/0ARSVWE#wrap">Interview Suggestion</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 252: Goes to 11.2 | BSD Now 252</title>
  <link>https://www.bsdnow.tv/252</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2170</guid>
  <pubDate>Thu, 28 Jun 2018 03:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ee4c7eca-8ae4-44bc-965b-9631a9d99865.mp3" length="56727001" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 11.2 has been released, setting up an MTA behind Tor, running pfsense on DigitalOcean, one year of C, using OpenBGPD to announce VM networks, the power to serve, and a BSDCan trip report.</itunes:subtitle>
  <itunes:duration>1:34:26</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 11.2 has been released, setting up an MTA behind Tor, running pfsense on DigitalOcean, one year of C, using OpenBGPD to announce VM networks, the power to serve, and a BSDCan trip report.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.freebsd.org/releases/11.2R/announce.html"&gt;FreeBSD 11.2-RELEASE Available&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;FreeBSD 11.2 was released today (June 27th) and is ready for download&lt;/li&gt;
&lt;li&gt;Highlights:&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;OpenSSH has been updated to version 7.5p1.&lt;br&gt;
OpenSSL has been updated to version 1.0.2o.&lt;br&gt;
The clang, llvm, lldb and compiler-rt utilities have been updated to version 6.0.0.&lt;br&gt;
The libarchive(3) library has been updated to version 3.3.2.&lt;br&gt;
The libxo(3) library has been updated to version 0.9.0.&lt;br&gt;
Major Device driver updates to:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;cxgbe(4) – Chelsio 10/25/40/50/100 gigabit NICs – version 1.16.63.0 supports T4, T5 and T6&lt;/li&gt;
&lt;li&gt;ixl(4) – Intel 10 and 40 gigabit NICs, updated to version 1.9.9-k&lt;/li&gt;
&lt;li&gt;ng_pppoe(4) – driver has been updated to add support for user-supplied Host-Uniq tags&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;New drivers:&lt;br&gt;
+ drm-next-kmod driver supporting integrated Intel graphics with the i915 driver.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;mlx5io(4) – a new IOCTL interface for Mellanox ConnectX-4 and ConnectX-5 10/20/25/40/50/56/100 gigabit NICs&lt;/li&gt;
&lt;li&gt;ocs_fc(4) – Emulex Fibre Channel 8/16/32 gigabit Host Adapters&lt;/li&gt;
&lt;li&gt;smartpqi(4) – HP Gen10 Smart Array Controller Family&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The newsyslog(8) utility has been updated to support RFC5424-compliant messages when rotating system logs&lt;br&gt;
The diskinfo(8) utility has been updated to include two new flags, -s which displays the disk identity (usually the serial number), and -p which displays the physical path to the disk in a storage controller.&lt;br&gt;
The top(1) utility has been updated to allow filtering on multiple user names when the    -U flag is used&lt;br&gt;
The umount(8) utility has been updated to include a new flag, -N, which is used to forcefully unmount an NFS mounted filesystem.&lt;br&gt;
The ps(1) utility has been updated to display if a process is running with capsicum(4) capability mode, indicated by the flag ‘C’&lt;br&gt;
The service(8) utility has been updated to include a new flag, -j, which is used to interact with services running within a jail(8). The argument to -j can be either the name or numeric jail ID&lt;br&gt;
The mlx5tool(8) utility has been added, which is used to manage Connect-X 4 and Connect-X 5 devices supported by mlx5io(4).&lt;br&gt;
The ifconfig(8) utility has been updated to include a random option, which when used with the ether option, generates a random MAC address for an interface.&lt;br&gt;
The dwatch(1) utility has been introduced&lt;br&gt;
The efibootmgr(8) utility has been added, which is used to manipulate the EFI boot manager.&lt;br&gt;
The etdump(1) utility has been added, which is used to view El Torito boot catalog information.&lt;br&gt;
The linux(4) ABI compatibility layer has been updated to include support for musl consumers.&lt;br&gt;
The fdescfs(5) filesystem has been updated to support Linux®-specific fd(4) /dev/fd and /proc/self/fd behavior&lt;br&gt;
Support for virtio_console(4) has been added to bhyve(4).&lt;br&gt;
The length of GELI passphrases entered when booting a system with encrypted disks is now hidden by default. See the configuration options in geli(8) to restore the previous behavior.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;In addition to the usual CD/DVD ISO, Memstick, and prebuilt VM images (raw, qcow2, vhd, and vmdk), FreeBSD 11.2 is also available on:
&lt;ul&gt;
&lt;li&gt;Amazon EC2&lt;/li&gt;
&lt;li&gt;Google Compute Engine&lt;/li&gt;
&lt;li&gt;Hashicorp/Atlas Vagrant&lt;/li&gt;
&lt;li&gt;Microsoft Azure&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;In addition to a generic ARM64 image for devices like the Pine64 and Raspberry Pi 3, specific images are provided for:
&lt;ul&gt;
&lt;li&gt;GUMSTIX&lt;/li&gt;
&lt;li&gt;BANANAPI&lt;/li&gt;
&lt;li&gt;BEAGLEBONE&lt;/li&gt;
&lt;li&gt;CUBIEBOARD&lt;/li&gt;
&lt;li&gt;CUBIEBOARD2&lt;/li&gt;
&lt;li&gt;CUBOX-HUMMINGBOARD&lt;/li&gt;
&lt;li&gt;RASPBERRY PI 2&lt;/li&gt;
&lt;li&gt;PANDABOARD&lt;/li&gt;
&lt;li&gt;WANDBOARD&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/releases/11.2R/relnotes.html"&gt;Full Release Notes&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://github.com/lattera/articles/blob/master/opsec/2018-05-08_torified_mta/article.md"&gt;Setting up an MTA Behind Tor&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;This article will document how to set up OpenSMTPD behind a fully Tor-ified network. Given that Tor’s DNS resolver code does not support MX record lookups, care must be taken for setting up an MTA behind a fully Tor-ified network. OpenSMTPD was chosen because it was easy to modify to force it to fall back to A/AAAA lookups when MX lookups failed with a DNS result code of NOTIMP (4).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Note that as of 08 May 2018, the OpenSMTPD project is planning a configuration file language change. The proposed change has not landed. Once it does, this article will be updated to reflect both the old language and new.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The reason to use an MTA behing a fully Tor-ified network is to be able to support email behind the .onion TLD. This setup will only allow us to send and receive email to and from the .onion TLD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Requirements:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;A fully Tor-ified network&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;HardenedBSD as the operating system&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;A server (or VM) running HardenedBSD behind the fully Tor-ified network.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;/usr/ports is empty&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Or is already pre-populated with the HardenedBSD Ports tree&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Why use HardenedBSD? We get all the features of FreeBSD (ZFS, DTrace, bhyve, and jails) with enhanced security through exploit mitigations and system hardening. Tor has a very unique threat landscape and using a hardened ecosystem is crucial to mitigating risks and threats.&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Also note that this article reflects how I’ve set up my MTA. I’ve included configuration files verbatim. You will need to replace the text that refers to my .onion domain with yours.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;On 08 May 2018, HardenedBSD’s version of OpenSMTPD just gained support for running an MTA behind Tor. The package repositories do not yet contain the patch, so we will compile OpenSMTPD from ports.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Steps&lt;/li&gt;
&lt;li&gt;Installation&lt;/li&gt;
&lt;li&gt;Generating Cryptographic Key Material&lt;/li&gt;
&lt;li&gt;Tor Configuration&lt;/li&gt;
&lt;li&gt;OpenSMTPD Configuration&lt;/li&gt;
&lt;li&gt;Dovecot Configuration&lt;/li&gt;
&lt;li&gt;Testing your configuration&lt;/li&gt;
&lt;li&gt;Optional: Webmail Access&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;br&gt;
&lt;a href="https://www.forbes.com/sites/forbestechcouncil/2018/06/21/strings-attached-knowing-when-and-when-not-to-accept-vc-funding/#30f9f18f46ec"&gt;https://www.forbes.com/sites/forbestechcouncil/2018/06/21/strings-attached-knowing-when-and-when-not-to-accept-vc-funding/#30f9f18f46ec&lt;/a&gt;&lt;br&gt;
&lt;a href="https://www.ixsystems.com/blog/self-2018-recap/"&gt;https://www.ixsystems.com/blog/self-2018-recap/&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://squigly.blogspot.com/2018/02/running-pfsense-on-digitalocean-droplet.html"&gt;Running pfSense on a Digital Ocean Droplet&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I love pfSense (and opnSense, no discrimination here). I use it for just about anything, from homelab to large scale deployments and I’ll give out on any fancy &amp;lt;enter brand name fw appliance here&amp;gt; for a pfSense setup on a decent hardware.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I also love DigitalOcean, if you ever used them, you know why, if you never did, head over and try, you’ll understand why.&lt;br&gt;
&amp;lt;shameless plug: head over to &lt;a href="http://JupiterBroadcasting.com"&gt;JupiterBroadcasting.com&lt;/a&gt;, the &lt;em&gt;best&lt;/em&gt; technology content out there, they have coupon codes to get you started with DO&amp;gt;.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Unfortunately, while DO offers tremendous amount of useful distros and applications, pfSense isn’t one of them. But, where there’s a will, there’s a way, and here’s how to get pfSense up and running on DO so you can have it as the gatekeeper to your kingdom.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Start by creating a FreeBSD droplet, choose your droplet size (for modest setups, I find the 5$ to be quite awesome):&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;There are many useful things you can do with pfSense on your droplet, from OpenVPN, squid, firewalling, fancy routing, url filtering, dns black listing and much much more.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;One note though, before we wrap up:&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;You have two ways to initiate the initial setup wizard of the web-configurator:&lt;br&gt;
Spin up another droplet, log into it and browse your way to the INTERNAL ip address of the internal NIC you’ve set up. This is the long and tedious way, but it’s also somewhat safer  as it eliminates the small window of risk the second method poses.&lt;br&gt;
or&lt;br&gt;
Once your  WAN address is all setup, your pfSense is ready to accept https connection to start the initial web-configurator setup.&lt;br&gt;
Thing is, there’s a default, well known set of credential to this initial wizard (admin:pfsense), so, there is a slight window of opportunity that someone can swoop in (assuming they know you’ve installed pfsense + your wan IP address + the exact time window between setting up the WAN interface and completing the wizard) and do &amp;lt;enter scary thing here&amp;gt;.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I leave it up to you which of the path you’d like to go, either way, once you’re done with the web-configurator wizard, you’ll have a shiny new pfSense installation at your disposal running on your favorite VPS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Hopefully this was helpful for someone, I hope to get a similar post soon detailing how to get FreeNAS up and running on DO.&lt;br&gt;
Many thanks to Tubsta and his blogpost as well as to Allan Jude, Kris Moore and Benedict Reuschling for their AWESOME and inspiring podcast, BSD Now.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="http://floooh.github.io/2018/06/02/one-year-of-c.html"&gt;One year of C&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;It’s now nearly a year that I started writing non-trivial amounts of C code again (the first sokol_gfx.h commit was on the 14-Jul-2017), so I guess it’s time for a little retrospective.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;In the beginning it was more of an experiment: I wanted to see how much I would miss some of the more useful C++ features (for instance namespaces, function overloading, ‘simple’ template code for containers, …), and whether it is possible to write non-trivial codebases in C without going mad.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Here are all the github projects I wrote in C:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;sokol: a slowly growing set of platform-abstraction headers&lt;/li&gt;
&lt;li&gt;sokol-samples - examples for Sokol&lt;/li&gt;
&lt;li&gt;chips - 8-bit chip emulators&lt;/li&gt;
&lt;li&gt;chips-test - tests and examples for the chip- emulators, including some complete home computer emulators (minus sound)&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;All in all these are around 32k lines of code (not including 3rd party code like flextGL and HandmadeMath). I think I wrote more C code in the recent 10 months than any other language.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;So one thing seems to be clear: yes, it’s possible to write a non-trivial amount of C code that does something useful without going mad (and it’s even quite enjoyable I might add).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Here’s a few things I learned:&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Pick the right language for a problem&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;C is a perfect match for WebAssembly&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;C99 is a huge improvement over C89&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;The dangers of pointers and explicit memory management are overrated&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Less Boilerplate Code&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Less Language Feature ‘Anxiety’&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Conclusion&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;All in all my “C experiment” is a success. For a lot of problems, picking C over C++ may be the better choice since C is a much simpler language (btw, did you notice how there are hardly any books, conferences or discussions about C despite being a fairly popular language? Apart from the neverending bickering about undefined behaviour from the compiler people of course ;) There simply isn’t much to discuss about a language that can be learned in an afternoon.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I don’t like some of the old POSIX or Linux APIs as much as the next guy (e.g. ioctl(), the socket API or some of the CRT library functions), but that’s an API design problem, not a language problem. It’s possible to build friendly C APIs with a bit of care and thinking, especially when C99’s designated initialization can be used (C++ should really make sure that the full C99 language can be used from inside C++ instead of continuing to wander off into an entirely different direction).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://empt1e.blogspot.com/2018/06/configuring-openbgpd-to-announce-vms.html"&gt;Configuring OpenBGPD to announce VM’s virtual networks&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;We use BGP quite heavily at work, and even though I’m not interacting with that directly, it feels like it’s something very useful to learn at least on some basic level. The most effective and fun way of learning technology is finding some practical application, so I decided to see if it could help to improve networking management for my Virtual Machines.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;My setup is fairly simple: I have a host that runs bhyve VMs and I have a desktop system from where I ssh to VMs, both hosts run FreeBSD. All VMs are connected to each other through a bridge and have a common network 10.0.1/24. The point of this exercise is to be able to ssh to these VMs from desktop without adding static routes and without adding vmhost’s external interfaces to the VMs bridge.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I’ve installed openbgpd on both hosts and configured it like this:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;vmhost: /usr/local/etc/bgpd.conf
AS 65002
router-id 192.168.87.48
fib-update no
network 10.0.1.1/24
neighbor 192.168.87.41 {
    descr "desktop"
    remote-as 65001
}
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;Here, router-id is set vmhost’s IP address in my home network (192.168.87/24), fib-update no is set to forbid routing table update, which I initially set for testing, but keeping it as vmhost is not supposed to learn new routes from desktop anyway. network announces my VMs network and neighbor describes my desktop box. Now the desktop box:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;desktop: /usr/local/etc/bgpd.conf
AS 65001
router-id 192.168.87.41
fib-update yes
neighbor 192.168.87.48 {                                                                                                                                                                                           
        descr "vmhost"                                                                                                                                                                                             
        remote-as 65002                                                                                                                                                                                            
}
&lt;/code&gt;&lt;/pre&gt;
&lt;blockquote&gt;
&lt;p&gt;It’s pretty similar to vmhost’s bgpd.conf, but no networks are announced here, and fib-update is set to yes because the whole point is to get VM routes added. Both hosts have to have the openbgpd service enabled:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;pre&gt;&lt;code&gt;/etc/rc.conf.local
openbgpdenable="YES"
&lt;/code&gt;&lt;/pre&gt;
&lt;ul&gt;
&lt;li&gt;Conclusion&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;As mentioned already, similar result could be achieved without using BGP by using either static routes or bridging interfaces differently, but the purpose of this exercise is to get some basic hands-on experience with BGP. Right now I’m looking into extending my setup in order to try more complex BGP schema. I’m thinking about adding some software switches in front of my VMs or maybe adding a second VM host (if budget allows). You’re welcome to comment if you have some ideas how to extend this setup for educational purposes in the context of BGP and networking.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;As a side note, I really like openbgpd so far. Its configuration file format is clean and simple, documentation is good, error and information messages are clear, and CLI has intuitive syntax.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Digital Ocean&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://nocomplexity.com/the-power-to-serve/"&gt;The Power to Serve&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;All people within the IT Industry should known where the slogan “The Power To Serve” is exposed every day to millions of people. But maybe too much wishful thinking from me. But without “The Power To Serve” the IT industry today will look totally different. Companies like Apple, Juniper, Cisco and even WatsApp would not exist in their current form.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I provide IT architecture services to make your complex IT landscape manageable and I love to solve complex security and privacy challenges. Complex challenges where people, processes and systems are heavily interrelated. For this knowledge intensive work I often run some IT experiments. When you run experiments nowadays you have a choice:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Rent some cloud based services or&lt;/li&gt;
&lt;li&gt;DIY (Do IT Yourself) on premise&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Running your own developments experiments on your own infrastructure can be time consuming. However smart automation saves time and money. And by creating your own CICD pipeline (Continuous Integration, Continuous Deployment) you stay on top of core infrastructure developments. Even hands-on. Knowing how things work from a technical ‘hands-on’ perspective gives great advantages when it comes to solving complex business IT problems. Making a clear distinguish between a business problem or IT problem is useless. Business and IT problems are related. Sometimes causal related, but more often indirect by one or more non linear feedback loops. Almost every business depends of IT systems. Bad IT means often that your customers will leave your business.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;One of the things of FeeBSD for me is still FreeBSD Jails. In 2015 I had luck to attend to a presentation of the legendary hacker Poul-Henning Kamp . Check his BSD bio to see what he has done for the FreeBSD community! FreeBSD jails are a light way to visualize your system without enormous overhead. Now that the development on Linux for LXD/LXD is more mature (lxd is the next generation system container manager on linux) there is finally again an alternative for a nice chroot Linux based system again. At least when you do not need the overhead and management complexity that comes with Kubernetes or Docker.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;FreeBSD means control and quality for me. When there is an open source package I need, I want to install it from source. It gives me more control and always some extra knowledge on how things work. So no precompiled binaries for me on my BSD systems! If a build on FreeBSD fails most of the time this is an alert regarding the quality for me.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;If a complex OSS package is not available at all in the FreeBSD ports collection there should be a reason for it. Is it really that nobody on the world wants to do this dirty maintenance work? Or is there another cause that running this software on FreeBSD is not possible…There are currently 32644 ports available on FreeBSD. So all the major programming language, databases and middleware libraries are present. The FreeBSD organization is a mature organization and since this is one of the largest OSS projects worldwide learning how this community manages to keep innovation and creates and maintains software is a good entrance for learning how complex IT systems function.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;FreeBSD is of course BSD licensed. It worked well! There is still a strong community with lots of strong commercial sponsors around the community. Of course: sometimes a GPL license makes more sense. So beside FreeBSD I also love GPL software and the rationale and principles behind it. So my hope is that maybe within the next 25 years the hard battle between BSD vs GPL churches will be more rationalized and normalized. Principles are good, but as all good IT architects know: With good principles alone you never make a good system. So use requirements and not only principles to figure out what OSS license fits your project. There is never one size fits all.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;June 19, 1993 was the day the official name for FreeBSD was agreed upon. So this blog is written to celebrate 25th anniversary of FreeBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###Dave’s BSDCan trip report&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;So far, only one person has bothered to send in a BSDCan trip report. Our warmest thanks to Dave for doing his part.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Hello guys! During the last show, you asked for a trip report regarding BSDCan 2018.&lt;br&gt;
This was my first time attending BSDCan. However, BSDCan was my second BSD conference overall, my first being vBSDCon 2017 in Reston, VA.&lt;br&gt;
Arriving early Thursday evening and after checking into the hotel, I headed straight to the Red Lion for the registration, picked up my badge and swag and then headed towards the ‘DMS’ building for the newbies talk. The only thing is, I couldn’t find the DMS building! Fortunately I found a BSDCan veteran who was heading there themselves. My only suggestion is to include the full building name and address on the BSDCan web site, or even a link to Google maps to help out with the navigation. The on-campus street maps didn’t have ‘DMS’ written on them anywhere. But I digress.&lt;br&gt;
Once I made it to the newbies talk hosted by Dan Langille and Michael W Lucas, it highlighted places to meet, an overview of what is happening, details about the ‘BSDCan widow/widower tours’ and most importantly, the 6-2-1 rule!&lt;br&gt;
The following morning, we were present with tea/coffee, muffins and other goodies to help prepare us for the day ahead.&lt;br&gt;
The first talk, “The Tragedy of systemd” covered what systemd did wrong and how the BSD community could improve on the ideas behind it.&lt;br&gt;
With the exception of Michael W Lucas, SSH Key Management and Kirk McKusick, The Evolution of FreeBSD Governance talk, I pretty much attended all of the ZFS talks including the lunchtime BoF session, hosted by Allan Jude. Coming from FreeNAS and being involved in the community, this is where my main interest and motivation lies. Since then I have been able to share some of that information with the FreeNAS community forums and chatroom.&lt;br&gt;
I also attended the “Speculating about Intel” lunchtime BoF session hosted by Theo de Raddt, which proved to be “interesting”.&lt;br&gt;
The talks ended with the wrap up session with a few words from Dan, covering the record attendance and made very clear there “was no cabal”. Followed by the the handing over of Groff the BSD goat to a new owner, thank you’s from the FreeBSD Foundation to various community committers and maintainers, finally ending with the charity auction, where a things like a Canadian $20 bill sold for $40, a signed FreeBSD Foundation shirt originally worn by George Neville-Neil, a lost laptop charger, Michael’s used gelato spoon, various books, the last cookie and more importantly, the second to last cookie!&lt;br&gt;
After the auction, we all headed to the Red Lion for food and drinks, sponsored by iXsystems.&lt;br&gt;
I would like to thank the BSDCan organizers, speakers and sponsors for a great conference. I will certainly hope to attend next year!&lt;br&gt;
Regards,&lt;br&gt;
Dave (aka m0nkey)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Thanks to Dave for sharing his experiences with us and our viewers&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-advocacy/2008-August/003674.html"&gt;Robert Watson (from 2008) on how much FreeBSD is in Mac OS X &lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://aloiskraus.wordpress.com/2018/06/16/why-skylakex-cpus-are-sometimes-50-slower-how-intel-has-broken-existing-code/"&gt;Why Intel Skylake CPUs are sometimes 50% slower than older CPUs&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lobste.rs/s/bos5cr/practical_unix_manuals_mdoc"&gt;Kristaps Dzonsons is looking for somebody to maintain this as mentioned at this link&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.reddit.com/r/freebsd/comments/87rru4/formatting_floppy_disks_in_a_usb_floppy_disk_drive/"&gt;camcontrol(8) saves the day again! Formatting floppy disks in a USB floppy disk drive&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.reddit.com/r/openbsd_gaming/comments/898ey5/32_great_indie_games_now_playable_on_current_7/"&gt;32+ great indie games now playable on OpenBSD -current; 7 currently on sale!&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://bsd-pl.org/en"&gt;Warsaw BSD User Group. June 27 2018 18:30-21:00, Wheel Systems Office, Aleje Jerozolimskie 178, Warsaw&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Ron - &lt;a href="http://dpaste.com/2B6CWDM#wrap"&gt;Adding a disk to ZFS&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Marshall - &lt;a href="http://dpaste.com/2W7VD6K#wrap"&gt;zfs question&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Thomas - &lt;a href="http://dpaste.com/1FS7534#wrap"&gt;Allan, the myth perpetuator&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Ross - &lt;a href="http://dpaste.com/1HWQWB6#wrap"&gt;ZFS IO stats per dataset&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, trident, hardenedbsd, tutorial, howto, guide, bsd, interview, OpenBGPD, MTA, TOR, pfsense</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 11.2 has been released, setting up an MTA behind Tor, running pfsense on DigitalOcean, one year of C, using OpenBGPD to announce VM networks, the power to serve, and a BSDCan trip report.</p>

<p>##Headlines<br>
###<a href="https://www.freebsd.org/releases/11.2R/announce.html">FreeBSD 11.2-RELEASE Available</a></p>

<ul>
<li>FreeBSD 11.2 was released today (June 27th) and is ready for download</li>
<li>Highlights:</li>
</ul>

<blockquote>
<p>OpenSSH has been updated to version 7.5p1.<br>
OpenSSL has been updated to version 1.0.2o.<br>
The clang, llvm, lldb and compiler-rt utilities have been updated to version 6.0.0.<br>
The libarchive(3) library has been updated to version 3.3.2.<br>
The libxo(3) library has been updated to version 0.9.0.<br>
Major Device driver updates to:</p>
</blockquote>

<ul>
<li>cxgbe(4) – Chelsio 10/25/40/50/100 gigabit NICs – version 1.16.63.0 supports T4, T5 and T6</li>
<li>ixl(4) – Intel 10 and 40 gigabit NICs, updated to version 1.9.9-k</li>
<li>ng_pppoe(4) – driver has been updated to add support for user-supplied Host-Uniq tags</li>
</ul>

<blockquote>
<p>New drivers:<br>
+ drm-next-kmod driver supporting integrated Intel graphics with the i915 driver.</p>
</blockquote>

<ul>
<li>mlx5io(4) – a new IOCTL interface for Mellanox ConnectX-4 and ConnectX-5 10/20/25/40/50/56/100 gigabit NICs</li>
<li>ocs_fc(4) – Emulex Fibre Channel 8/16/32 gigabit Host Adapters</li>
<li>smartpqi(4) – HP Gen10 Smart Array Controller Family</li>
</ul>

<blockquote>
<p>The newsyslog(8) utility has been updated to support RFC5424-compliant messages when rotating system logs<br>
The diskinfo(8) utility has been updated to include two new flags, -s which displays the disk identity (usually the serial number), and -p which displays the physical path to the disk in a storage controller.<br>
The top(1) utility has been updated to allow filtering on multiple user names when the    -U flag is used<br>
The umount(8) utility has been updated to include a new flag, -N, which is used to forcefully unmount an NFS mounted filesystem.<br>
The ps(1) utility has been updated to display if a process is running with capsicum(4) capability mode, indicated by the flag ‘C’<br>
The service(8) utility has been updated to include a new flag, -j, which is used to interact with services running within a jail(8). The argument to -j can be either the name or numeric jail ID<br>
The mlx5tool(8) utility has been added, which is used to manage Connect-X 4 and Connect-X 5 devices supported by mlx5io(4).<br>
The ifconfig(8) utility has been updated to include a random option, which when used with the ether option, generates a random MAC address for an interface.<br>
The dwatch(1) utility has been introduced<br>
The efibootmgr(8) utility has been added, which is used to manipulate the EFI boot manager.<br>
The etdump(1) utility has been added, which is used to view El Torito boot catalog information.<br>
The linux(4) ABI compatibility layer has been updated to include support for musl consumers.<br>
The fdescfs(5) filesystem has been updated to support Linux®-specific fd(4) /dev/fd and /proc/self/fd behavior<br>
Support for virtio_console(4) has been added to bhyve(4).<br>
The length of GELI passphrases entered when booting a system with encrypted disks is now hidden by default. See the configuration options in geli(8) to restore the previous behavior.</p>
</blockquote>

<ul>
<li>In addition to the usual CD/DVD ISO, Memstick, and prebuilt VM images (raw, qcow2, vhd, and vmdk), FreeBSD 11.2 is also available on:
<ul>
<li>Amazon EC2</li>
<li>Google Compute Engine</li>
<li>Hashicorp/Atlas Vagrant</li>
<li>Microsoft Azure</li>
</ul>

<p></li><br>
<li>In addition to a generic ARM64 image for devices like the Pine64 and Raspberry Pi 3, specific images are provided for:</p>

<ul>
<li>GUMSTIX</li>
<li>BANANAPI</li>
<li>BEAGLEBONE</li>
<li>CUBIEBOARD</li>
<li>CUBIEBOARD2</li>
<li>CUBOX-HUMMINGBOARD</li>
<li>RASPBERRY PI 2</li>
<li>PANDABOARD</li>
<li>WANDBOARD</li>
</ul>

<p></li><br>
<li><a href="https://www.freebsd.org/releases/11.2R/relnotes.html">Full Release Notes</a></li><br>
</ul><br>
<hr></p>

<p>###<a href="https://github.com/lattera/articles/blob/master/opsec/2018-05-08_torified_mta/article.md">Setting up an MTA Behind Tor</a></p>

<blockquote>
<p>This article will document how to set up OpenSMTPD behind a fully Tor-ified network. Given that Tor’s DNS resolver code does not support MX record lookups, care must be taken for setting up an MTA behind a fully Tor-ified network. OpenSMTPD was chosen because it was easy to modify to force it to fall back to A/AAAA lookups when MX lookups failed with a DNS result code of NOTIMP (4).</p>
</blockquote>

<blockquote>
<p>Note that as of 08 May 2018, the OpenSMTPD project is planning a configuration file language change. The proposed change has not landed. Once it does, this article will be updated to reflect both the old language and new.</p>
</blockquote>

<blockquote>
<p>The reason to use an MTA behing a fully Tor-ified network is to be able to support email behind the .onion TLD. This setup will only allow us to send and receive email to and from the .onion TLD.</p>
</blockquote>

<ul>
<li>
<p>Requirements:</p>
</li>
<li>
<p>A fully Tor-ified network</p>
</li>
<li>
<p>HardenedBSD as the operating system</p>
</li>
<li>
<p>A server (or VM) running HardenedBSD behind the fully Tor-ified network.</p>
</li>
<li>
<p>/usr/ports is empty</p>
</li>
<li>
<p>Or is already pre-populated with the HardenedBSD Ports tree</p>
</li>
<li>
<p>Why use HardenedBSD? We get all the features of FreeBSD (ZFS, DTrace, bhyve, and jails) with enhanced security through exploit mitigations and system hardening. Tor has a very unique threat landscape and using a hardened ecosystem is crucial to mitigating risks and threats.</p>
</li>
</ul>

<blockquote>
<p>Also note that this article reflects how I’ve set up my MTA. I’ve included configuration files verbatim. You will need to replace the text that refers to my .onion domain with yours.</p>
</blockquote>

<blockquote>
<p>On 08 May 2018, HardenedBSD’s version of OpenSMTPD just gained support for running an MTA behind Tor. The package repositories do not yet contain the patch, so we will compile OpenSMTPD from ports.</p>
</blockquote>

<ul>
<li>Steps</li>
<li>Installation</li>
<li>Generating Cryptographic Key Material</li>
<li>Tor Configuration</li>
<li>OpenSMTPD Configuration</li>
<li>Dovecot Configuration</li>
<li>Testing your configuration</li>
<li>Optional: Webmail Access</li>
</ul>

<p><hr></p>

<p><strong>iXsystems</strong><br>
<a href="https://www.forbes.com/sites/forbestechcouncil/2018/06/21/strings-attached-knowing-when-and-when-not-to-accept-vc-funding/#30f9f18f46ec">https://www.forbes.com/sites/forbestechcouncil/2018/06/21/strings-attached-knowing-when-and-when-not-to-accept-vc-funding/#30f9f18f46ec</a><br>
<a href="https://www.ixsystems.com/blog/self-2018-recap/">https://www.ixsystems.com/blog/self-2018-recap/</a></p>

<p>###<a href="https://squigly.blogspot.com/2018/02/running-pfsense-on-digitalocean-droplet.html">Running pfSense on a Digital Ocean Droplet</a></p>

<blockquote>
<p>I love pfSense (and opnSense, no discrimination here). I use it for just about anything, from homelab to large scale deployments and I’ll give out on any fancy &lt;enter brand name fw appliance here&gt; for a pfSense setup on a decent hardware.</p>
</blockquote>

<blockquote>
<p>I also love DigitalOcean, if you ever used them, you know why, if you never did, head over and try, you’ll understand why.<br>
&lt;shameless plug: head over to <a href="http://JupiterBroadcasting.com">JupiterBroadcasting.com</a>, the <em>best</em> technology content out there, they have coupon codes to get you started with DO&gt;.</p>
</blockquote>

<blockquote>
<p>Unfortunately, while DO offers tremendous amount of useful distros and applications, pfSense isn’t one of them. But, where there’s a will, there’s a way, and here’s how to get pfSense up and running on DO so you can have it as the gatekeeper to your kingdom.</p>
</blockquote>

<blockquote>
<p>Start by creating a FreeBSD droplet, choose your droplet size (for modest setups, I find the 5$ to be quite awesome):</p>
</blockquote>

<blockquote>
<p>There are many useful things you can do with pfSense on your droplet, from OpenVPN, squid, firewalling, fancy routing, url filtering, dns black listing and much much more.</p>
</blockquote>

<ul>
<li>One note though, before we wrap up:</li>
</ul>

<blockquote>
<p>You have two ways to initiate the initial setup wizard of the web-configurator:<br>
Spin up another droplet, log into it and browse your way to the INTERNAL ip address of the internal NIC you’ve set up. This is the long and tedious way, but it’s also somewhat safer  as it eliminates the small window of risk the second method poses.<br>
or<br>
Once your  WAN address is all setup, your pfSense is ready to accept https connection to start the initial web-configurator setup.<br>
Thing is, there’s a default, well known set of credential to this initial wizard (admin:pfsense), so, there is a slight window of opportunity that someone can swoop in (assuming they know you’ve installed pfsense + your wan IP address + the exact time window between setting up the WAN interface and completing the wizard) and do &lt;enter scary thing here&gt;.</p>
</blockquote>

<blockquote>
<p>I leave it up to you which of the path you’d like to go, either way, once you’re done with the web-configurator wizard, you’ll have a shiny new pfSense installation at your disposal running on your favorite VPS.</p>
</blockquote>

<blockquote>
<p>Hopefully this was helpful for someone, I hope to get a similar post soon detailing how to get FreeNAS up and running on DO.<br>
Many thanks to Tubsta and his blogpost as well as to Allan Jude, Kris Moore and Benedict Reuschling for their AWESOME and inspiring podcast, BSD Now.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="http://floooh.github.io/2018/06/02/one-year-of-c.html">One year of C</a></p>

<blockquote>
<p>It’s now nearly a year that I started writing non-trivial amounts of C code again (the first sokol_gfx.h commit was on the 14-Jul-2017), so I guess it’s time for a little retrospective.</p>
</blockquote>

<blockquote>
<p>In the beginning it was more of an experiment: I wanted to see how much I would miss some of the more useful C++ features (for instance namespaces, function overloading, ‘simple’ template code for containers, …), and whether it is possible to write non-trivial codebases in C without going mad.</p>
</blockquote>

<blockquote>
<p>Here are all the github projects I wrote in C:</p>
</blockquote>

<ul>
<li>sokol: a slowly growing set of platform-abstraction headers</li>
<li>sokol-samples - examples for Sokol</li>
<li>chips - 8-bit chip emulators</li>
<li>chips-test - tests and examples for the chip- emulators, including some complete home computer emulators (minus sound)</li>
</ul>

<blockquote>
<p>All in all these are around 32k lines of code (not including 3rd party code like flextGL and HandmadeMath). I think I wrote more C code in the recent 10 months than any other language.</p>
</blockquote>

<blockquote>
<p>So one thing seems to be clear: yes, it’s possible to write a non-trivial amount of C code that does something useful without going mad (and it’s even quite enjoyable I might add).</p>
</blockquote>

<ul>
<li>
<p>Here’s a few things I learned:</p>
</li>
<li>
<p>Pick the right language for a problem</p>
</li>
<li>
<p>C is a perfect match for WebAssembly</p>
</li>
<li>
<p>C99 is a huge improvement over C89</p>
</li>
<li>
<p>The dangers of pointers and explicit memory management are overrated</p>
</li>
<li>
<p>Less Boilerplate Code</p>
</li>
<li>
<p>Less Language Feature ‘Anxiety’</p>
</li>
<li>
<p>Conclusion</p>
</li>
</ul>

<blockquote>
<p>All in all my “C experiment” is a success. For a lot of problems, picking C over C++ may be the better choice since C is a much simpler language (btw, did you notice how there are hardly any books, conferences or discussions about C despite being a fairly popular language? Apart from the neverending bickering about undefined behaviour from the compiler people of course ;) There simply isn’t much to discuss about a language that can be learned in an afternoon.</p>
</blockquote>

<blockquote>
<p>I don’t like some of the old POSIX or Linux APIs as much as the next guy (e.g. ioctl(), the socket API or some of the CRT library functions), but that’s an API design problem, not a language problem. It’s possible to build friendly C APIs with a bit of care and thinking, especially when C99’s designated initialization can be used (C++ should really make sure that the full C99 language can be used from inside C++ instead of continuing to wander off into an entirely different direction).</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://empt1e.blogspot.com/2018/06/configuring-openbgpd-to-announce-vms.html">Configuring OpenBGPD to announce VM’s virtual networks</a></p>

<blockquote>
<p>We use BGP quite heavily at work, and even though I’m not interacting with that directly, it feels like it’s something very useful to learn at least on some basic level. The most effective and fun way of learning technology is finding some practical application, so I decided to see if it could help to improve networking management for my Virtual Machines.</p>
</blockquote>

<blockquote>
<p>My setup is fairly simple: I have a host that runs bhyve VMs and I have a desktop system from where I ssh to VMs, both hosts run FreeBSD. All VMs are connected to each other through a bridge and have a common network 10.0.1/24. The point of this exercise is to be able to ssh to these VMs from desktop without adding static routes and without adding vmhost’s external interfaces to the VMs bridge.</p>
</blockquote>

<blockquote>
<p>I’ve installed openbgpd on both hosts and configured it like this:</p>
</blockquote>

<pre><code>vmhost: /usr/local/etc/bgpd.conf
AS 65002
router-id 192.168.87.48
fib-update no

network 10.0.1.1/24

neighbor 192.168.87.41 {
    descr &quot;desktop&quot;
    remote-as 65001
}
</code></pre>

<blockquote>
<p>Here, router-id is set vmhost’s IP address in my home network (192.168.87/24), fib-update no is set to forbid routing table update, which I initially set for testing, but keeping it as vmhost is not supposed to learn new routes from desktop anyway. network announces my VMs network and neighbor describes my desktop box. Now the desktop box:</p>
</blockquote>

<pre><code>desktop: /usr/local/etc/bgpd.conf
AS 65001
router-id 192.168.87.41
fib-update yes

neighbor 192.168.87.48 {                                                                                                                                                                                           
        descr &quot;vmhost&quot;                                                                                                                                                                                             
        remote-as 65002                                                                                                                                                                                            
}
</code></pre>

<blockquote>
<p>It’s pretty similar to vmhost’s bgpd.conf, but no networks are announced here, and fib-update is set to yes because the whole point is to get VM routes added. Both hosts have to have the openbgpd service enabled:</p>
</blockquote>

<pre><code>/etc/rc.conf.local
openbgpd_enable=&quot;YES&quot;
</code></pre>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>As mentioned already, similar result could be achieved without using BGP by using either static routes or bridging interfaces differently, but the purpose of this exercise is to get some basic hands-on experience with BGP. Right now I’m looking into extending my setup in order to try more complex BGP schema. I’m thinking about adding some software switches in front of my VMs or maybe adding a second VM host (if budget allows). You’re welcome to comment if you have some ideas how to extend this setup for educational purposes in the context of BGP and networking.</p>
</blockquote>

<blockquote>
<p>As a side note, I really like openbgpd so far. Its configuration file format is clean and simple, documentation is good, error and information messages are clear, and CLI has intuitive syntax.</p>
</blockquote>

<p><hr></p>

<p><strong>Digital Ocean</strong></p>

<p>###<a href="https://nocomplexity.com/the-power-to-serve/">The Power to Serve</a></p>

<blockquote>
<p>All people within the IT Industry should known where the slogan “The Power To Serve” is exposed every day to millions of people. But maybe too much wishful thinking from me. But without “The Power To Serve” the IT industry today will look totally different. Companies like Apple, Juniper, Cisco and even WatsApp would not exist in their current form.</p>
</blockquote>

<blockquote>
<p>I provide IT architecture services to make your complex IT landscape manageable and I love to solve complex security and privacy challenges. Complex challenges where people, processes and systems are heavily interrelated. For this knowledge intensive work I often run some IT experiments. When you run experiments nowadays you have a choice:</p>
</blockquote>

<ul>
<li>Rent some cloud based services or</li>
<li>DIY (Do IT Yourself) on premise</li>
</ul>

<blockquote>
<p>Running your own developments experiments on your own infrastructure can be time consuming. However smart automation saves time and money. And by creating your own CICD pipeline (Continuous Integration, Continuous Deployment) you stay on top of core infrastructure developments. Even hands-on. Knowing how things work from a technical ‘hands-on’ perspective gives great advantages when it comes to solving complex business IT problems. Making a clear distinguish between a business problem or IT problem is useless. Business and IT problems are related. Sometimes causal related, but more often indirect by one or more non linear feedback loops. Almost every business depends of IT systems. Bad IT means often that your customers will leave your business.</p>
</blockquote>

<blockquote>
<p>One of the things of FeeBSD for me is still FreeBSD Jails. In 2015 I had luck to attend to a presentation of the legendary hacker Poul-Henning Kamp . Check his BSD bio to see what he has done for the FreeBSD community! FreeBSD jails are a light way to visualize your system without enormous overhead. Now that the development on Linux for LXD/LXD is more mature (lxd is the next generation system container manager on linux) there is finally again an alternative for a nice chroot Linux based system again. At least when you do not need the overhead and management complexity that comes with Kubernetes or Docker.</p>
</blockquote>

<blockquote>
<p>FreeBSD means control and quality for me. When there is an open source package I need, I want to install it from source. It gives me more control and always some extra knowledge on how things work. So no precompiled binaries for me on my BSD systems! If a build on FreeBSD fails most of the time this is an alert regarding the quality for me.</p>
</blockquote>

<blockquote>
<p>If a complex OSS package is not available at all in the FreeBSD ports collection there should be a reason for it. Is it really that nobody on the world wants to do this dirty maintenance work? Or is there another cause that running this software on FreeBSD is not possible…There are currently 32644 ports available on FreeBSD. So all the major programming language, databases and middleware libraries are present. The FreeBSD organization is a mature organization and since this is one of the largest OSS projects worldwide learning how this community manages to keep innovation and creates and maintains software is a good entrance for learning how complex IT systems function.</p>
</blockquote>

<blockquote>
<p>FreeBSD is of course BSD licensed. It worked well! There is still a strong community with lots of strong commercial sponsors around the community. Of course: sometimes a GPL license makes more sense. So beside FreeBSD I also love GPL software and the rationale and principles behind it. So my hope is that maybe within the next 25 years the hard battle between BSD vs GPL churches will be more rationalized and normalized. Principles are good, but as all good IT architects know: With good principles alone you never make a good system. So use requirements and not only principles to figure out what OSS license fits your project. There is never one size fits all.</p>
</blockquote>

<blockquote>
<p>June 19, 1993 was the day the official name for FreeBSD was agreed upon. So this blog is written to celebrate 25th anniversary of FreeBSD.</p>
</blockquote>

<p><hr></p>

<p>###Dave’s BSDCan trip report</p>

<ul>
<li>So far, only one person has bothered to send in a BSDCan trip report. Our warmest thanks to Dave for doing his part.</li>
</ul>

<blockquote>
<p>Hello guys! During the last show, you asked for a trip report regarding BSDCan 2018.<br>
This was my first time attending BSDCan. However, BSDCan was my second BSD conference overall, my first being vBSDCon 2017 in Reston, VA.<br>
Arriving early Thursday evening and after checking into the hotel, I headed straight to the Red Lion for the registration, picked up my badge and swag and then headed towards the ‘DMS’ building for the newbies talk. The only thing is, I couldn’t find the DMS building! Fortunately I found a BSDCan veteran who was heading there themselves. My only suggestion is to include the full building name and address on the BSDCan web site, or even a link to Google maps to help out with the navigation. The on-campus street maps didn’t have ‘DMS’ written on them anywhere. But I digress.<br>
Once I made it to the newbies talk hosted by Dan Langille and Michael W Lucas, it highlighted places to meet, an overview of what is happening, details about the ‘BSDCan widow/widower tours’ and most importantly, the 6-2-1 rule!<br>
The following morning, we were present with tea/coffee, muffins and other goodies to help prepare us for the day ahead.<br>
The first talk, “The Tragedy of systemd” covered what systemd did wrong and how the BSD community could improve on the ideas behind it.<br>
With the exception of Michael W Lucas, SSH Key Management and Kirk McKusick, The Evolution of FreeBSD Governance talk, I pretty much attended all of the ZFS talks including the lunchtime BoF session, hosted by Allan Jude. Coming from FreeNAS and being involved in the community, this is where my main interest and motivation lies. Since then I have been able to share some of that information with the FreeNAS community forums and chatroom.<br>
I also attended the “Speculating about Intel” lunchtime BoF session hosted by Theo de Raddt, which proved to be “interesting”.<br>
The talks ended with the wrap up session with a few words from Dan, covering the record attendance and made very clear there “was no cabal”. Followed by the the handing over of Groff the BSD goat to a new owner, thank you’s from the FreeBSD Foundation to various community committers and maintainers, finally ending with the charity auction, where a things like a Canadian $20 bill sold for $40, a signed FreeBSD Foundation shirt originally worn by George Neville-Neil, a lost laptop charger, Michael’s used gelato spoon, various books, the last cookie and more importantly, the second to last cookie!<br>
After the auction, we all headed to the Red Lion for food and drinks, sponsored by iXsystems.<br>
I would like to thank the BSDCan organizers, speakers and sponsors for a great conference. I will certainly hope to attend next year!<br>
Regards,<br>
Dave (aka m0nkey_)</p>
</blockquote>

<ul>
<li>Thanks to Dave for sharing his experiences with us and our viewers</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-advocacy/2008-August/003674.html">Robert Watson (from 2008) on how much FreeBSD is in Mac OS X </a></li>
<li><a href="https://aloiskraus.wordpress.com/2018/06/16/why-skylakex-cpus-are-sometimes-50-slower-how-intel-has-broken-existing-code/">Why Intel Skylake CPUs are sometimes 50% slower than older CPUs</a></li>
<li><a href="https://lobste.rs/s/bos5cr/practical_unix_manuals_mdoc">Kristaps Dzonsons is looking for somebody to maintain this as mentioned at this link</a></li>
<li><a href="https://www.reddit.com/r/freebsd/comments/87rru4/formatting_floppy_disks_in_a_usb_floppy_disk_drive/">camcontrol(8) saves the day again! Formatting floppy disks in a USB floppy disk drive</a></li>
<li><a href="https://www.reddit.com/r/openbsd_gaming/comments/898ey5/32_great_indie_games_now_playable_on_current_7/">32+ great indie games now playable on OpenBSD -current; 7 currently on sale!</a></li>
<li><a href="https://bsd-pl.org/en">Warsaw BSD User Group. June 27 2018 18:30-21:00, Wheel Systems Office, Aleje Jerozolimskie 178, Warsaw</a></li>
</ul>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Ron - <a href="http://dpaste.com/2B6CWDM#wrap">Adding a disk to ZFS</a></li>
<li>Marshall - <a href="http://dpaste.com/2W7VD6K#wrap">zfs question</a></li>
<li>Thomas - <a href="http://dpaste.com/1FS7534#wrap">Allan, the myth perpetuator</a></li>
<li>Ross - <a href="http://dpaste.com/1HWQWB6#wrap">ZFS IO stats per dataset</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 11.2 has been released, setting up an MTA behind Tor, running pfsense on DigitalOcean, one year of C, using OpenBGPD to announce VM networks, the power to serve, and a BSDCan trip report.</p>

<p>##Headlines<br>
###<a href="https://www.freebsd.org/releases/11.2R/announce.html">FreeBSD 11.2-RELEASE Available</a></p>

<ul>
<li>FreeBSD 11.2 was released today (June 27th) and is ready for download</li>
<li>Highlights:</li>
</ul>

<blockquote>
<p>OpenSSH has been updated to version 7.5p1.<br>
OpenSSL has been updated to version 1.0.2o.<br>
The clang, llvm, lldb and compiler-rt utilities have been updated to version 6.0.0.<br>
The libarchive(3) library has been updated to version 3.3.2.<br>
The libxo(3) library has been updated to version 0.9.0.<br>
Major Device driver updates to:</p>
</blockquote>

<ul>
<li>cxgbe(4) – Chelsio 10/25/40/50/100 gigabit NICs – version 1.16.63.0 supports T4, T5 and T6</li>
<li>ixl(4) – Intel 10 and 40 gigabit NICs, updated to version 1.9.9-k</li>
<li>ng_pppoe(4) – driver has been updated to add support for user-supplied Host-Uniq tags</li>
</ul>

<blockquote>
<p>New drivers:<br>
+ drm-next-kmod driver supporting integrated Intel graphics with the i915 driver.</p>
</blockquote>

<ul>
<li>mlx5io(4) – a new IOCTL interface for Mellanox ConnectX-4 and ConnectX-5 10/20/25/40/50/56/100 gigabit NICs</li>
<li>ocs_fc(4) – Emulex Fibre Channel 8/16/32 gigabit Host Adapters</li>
<li>smartpqi(4) – HP Gen10 Smart Array Controller Family</li>
</ul>

<blockquote>
<p>The newsyslog(8) utility has been updated to support RFC5424-compliant messages when rotating system logs<br>
The diskinfo(8) utility has been updated to include two new flags, -s which displays the disk identity (usually the serial number), and -p which displays the physical path to the disk in a storage controller.<br>
The top(1) utility has been updated to allow filtering on multiple user names when the    -U flag is used<br>
The umount(8) utility has been updated to include a new flag, -N, which is used to forcefully unmount an NFS mounted filesystem.<br>
The ps(1) utility has been updated to display if a process is running with capsicum(4) capability mode, indicated by the flag ‘C’<br>
The service(8) utility has been updated to include a new flag, -j, which is used to interact with services running within a jail(8). The argument to -j can be either the name or numeric jail ID<br>
The mlx5tool(8) utility has been added, which is used to manage Connect-X 4 and Connect-X 5 devices supported by mlx5io(4).<br>
The ifconfig(8) utility has been updated to include a random option, which when used with the ether option, generates a random MAC address for an interface.<br>
The dwatch(1) utility has been introduced<br>
The efibootmgr(8) utility has been added, which is used to manipulate the EFI boot manager.<br>
The etdump(1) utility has been added, which is used to view El Torito boot catalog information.<br>
The linux(4) ABI compatibility layer has been updated to include support for musl consumers.<br>
The fdescfs(5) filesystem has been updated to support Linux®-specific fd(4) /dev/fd and /proc/self/fd behavior<br>
Support for virtio_console(4) has been added to bhyve(4).<br>
The length of GELI passphrases entered when booting a system with encrypted disks is now hidden by default. See the configuration options in geli(8) to restore the previous behavior.</p>
</blockquote>

<ul>
<li>In addition to the usual CD/DVD ISO, Memstick, and prebuilt VM images (raw, qcow2, vhd, and vmdk), FreeBSD 11.2 is also available on:
<ul>
<li>Amazon EC2</li>
<li>Google Compute Engine</li>
<li>Hashicorp/Atlas Vagrant</li>
<li>Microsoft Azure</li>
</ul>

<p></li><br>
<li>In addition to a generic ARM64 image for devices like the Pine64 and Raspberry Pi 3, specific images are provided for:</p>

<ul>
<li>GUMSTIX</li>
<li>BANANAPI</li>
<li>BEAGLEBONE</li>
<li>CUBIEBOARD</li>
<li>CUBIEBOARD2</li>
<li>CUBOX-HUMMINGBOARD</li>
<li>RASPBERRY PI 2</li>
<li>PANDABOARD</li>
<li>WANDBOARD</li>
</ul>

<p></li><br>
<li><a href="https://www.freebsd.org/releases/11.2R/relnotes.html">Full Release Notes</a></li><br>
</ul><br>
<hr></p>

<p>###<a href="https://github.com/lattera/articles/blob/master/opsec/2018-05-08_torified_mta/article.md">Setting up an MTA Behind Tor</a></p>

<blockquote>
<p>This article will document how to set up OpenSMTPD behind a fully Tor-ified network. Given that Tor’s DNS resolver code does not support MX record lookups, care must be taken for setting up an MTA behind a fully Tor-ified network. OpenSMTPD was chosen because it was easy to modify to force it to fall back to A/AAAA lookups when MX lookups failed with a DNS result code of NOTIMP (4).</p>
</blockquote>

<blockquote>
<p>Note that as of 08 May 2018, the OpenSMTPD project is planning a configuration file language change. The proposed change has not landed. Once it does, this article will be updated to reflect both the old language and new.</p>
</blockquote>

<blockquote>
<p>The reason to use an MTA behing a fully Tor-ified network is to be able to support email behind the .onion TLD. This setup will only allow us to send and receive email to and from the .onion TLD.</p>
</blockquote>

<ul>
<li>
<p>Requirements:</p>
</li>
<li>
<p>A fully Tor-ified network</p>
</li>
<li>
<p>HardenedBSD as the operating system</p>
</li>
<li>
<p>A server (or VM) running HardenedBSD behind the fully Tor-ified network.</p>
</li>
<li>
<p>/usr/ports is empty</p>
</li>
<li>
<p>Or is already pre-populated with the HardenedBSD Ports tree</p>
</li>
<li>
<p>Why use HardenedBSD? We get all the features of FreeBSD (ZFS, DTrace, bhyve, and jails) with enhanced security through exploit mitigations and system hardening. Tor has a very unique threat landscape and using a hardened ecosystem is crucial to mitigating risks and threats.</p>
</li>
</ul>

<blockquote>
<p>Also note that this article reflects how I’ve set up my MTA. I’ve included configuration files verbatim. You will need to replace the text that refers to my .onion domain with yours.</p>
</blockquote>

<blockquote>
<p>On 08 May 2018, HardenedBSD’s version of OpenSMTPD just gained support for running an MTA behind Tor. The package repositories do not yet contain the patch, so we will compile OpenSMTPD from ports.</p>
</blockquote>

<ul>
<li>Steps</li>
<li>Installation</li>
<li>Generating Cryptographic Key Material</li>
<li>Tor Configuration</li>
<li>OpenSMTPD Configuration</li>
<li>Dovecot Configuration</li>
<li>Testing your configuration</li>
<li>Optional: Webmail Access</li>
</ul>

<p><hr></p>

<p><strong>iXsystems</strong><br>
<a href="https://www.forbes.com/sites/forbestechcouncil/2018/06/21/strings-attached-knowing-when-and-when-not-to-accept-vc-funding/#30f9f18f46ec">https://www.forbes.com/sites/forbestechcouncil/2018/06/21/strings-attached-knowing-when-and-when-not-to-accept-vc-funding/#30f9f18f46ec</a><br>
<a href="https://www.ixsystems.com/blog/self-2018-recap/">https://www.ixsystems.com/blog/self-2018-recap/</a></p>

<p>###<a href="https://squigly.blogspot.com/2018/02/running-pfsense-on-digitalocean-droplet.html">Running pfSense on a Digital Ocean Droplet</a></p>

<blockquote>
<p>I love pfSense (and opnSense, no discrimination here). I use it for just about anything, from homelab to large scale deployments and I’ll give out on any fancy &lt;enter brand name fw appliance here&gt; for a pfSense setup on a decent hardware.</p>
</blockquote>

<blockquote>
<p>I also love DigitalOcean, if you ever used them, you know why, if you never did, head over and try, you’ll understand why.<br>
&lt;shameless plug: head over to <a href="http://JupiterBroadcasting.com">JupiterBroadcasting.com</a>, the <em>best</em> technology content out there, they have coupon codes to get you started with DO&gt;.</p>
</blockquote>

<blockquote>
<p>Unfortunately, while DO offers tremendous amount of useful distros and applications, pfSense isn’t one of them. But, where there’s a will, there’s a way, and here’s how to get pfSense up and running on DO so you can have it as the gatekeeper to your kingdom.</p>
</blockquote>

<blockquote>
<p>Start by creating a FreeBSD droplet, choose your droplet size (for modest setups, I find the 5$ to be quite awesome):</p>
</blockquote>

<blockquote>
<p>There are many useful things you can do with pfSense on your droplet, from OpenVPN, squid, firewalling, fancy routing, url filtering, dns black listing and much much more.</p>
</blockquote>

<ul>
<li>One note though, before we wrap up:</li>
</ul>

<blockquote>
<p>You have two ways to initiate the initial setup wizard of the web-configurator:<br>
Spin up another droplet, log into it and browse your way to the INTERNAL ip address of the internal NIC you’ve set up. This is the long and tedious way, but it’s also somewhat safer  as it eliminates the small window of risk the second method poses.<br>
or<br>
Once your  WAN address is all setup, your pfSense is ready to accept https connection to start the initial web-configurator setup.<br>
Thing is, there’s a default, well known set of credential to this initial wizard (admin:pfsense), so, there is a slight window of opportunity that someone can swoop in (assuming they know you’ve installed pfsense + your wan IP address + the exact time window between setting up the WAN interface and completing the wizard) and do &lt;enter scary thing here&gt;.</p>
</blockquote>

<blockquote>
<p>I leave it up to you which of the path you’d like to go, either way, once you’re done with the web-configurator wizard, you’ll have a shiny new pfSense installation at your disposal running on your favorite VPS.</p>
</blockquote>

<blockquote>
<p>Hopefully this was helpful for someone, I hope to get a similar post soon detailing how to get FreeNAS up and running on DO.<br>
Many thanks to Tubsta and his blogpost as well as to Allan Jude, Kris Moore and Benedict Reuschling for their AWESOME and inspiring podcast, BSD Now.</p>
</blockquote>

<p><hr></p>

<p>##News Roundup<br>
###<a href="http://floooh.github.io/2018/06/02/one-year-of-c.html">One year of C</a></p>

<blockquote>
<p>It’s now nearly a year that I started writing non-trivial amounts of C code again (the first sokol_gfx.h commit was on the 14-Jul-2017), so I guess it’s time for a little retrospective.</p>
</blockquote>

<blockquote>
<p>In the beginning it was more of an experiment: I wanted to see how much I would miss some of the more useful C++ features (for instance namespaces, function overloading, ‘simple’ template code for containers, …), and whether it is possible to write non-trivial codebases in C without going mad.</p>
</blockquote>

<blockquote>
<p>Here are all the github projects I wrote in C:</p>
</blockquote>

<ul>
<li>sokol: a slowly growing set of platform-abstraction headers</li>
<li>sokol-samples - examples for Sokol</li>
<li>chips - 8-bit chip emulators</li>
<li>chips-test - tests and examples for the chip- emulators, including some complete home computer emulators (minus sound)</li>
</ul>

<blockquote>
<p>All in all these are around 32k lines of code (not including 3rd party code like flextGL and HandmadeMath). I think I wrote more C code in the recent 10 months than any other language.</p>
</blockquote>

<blockquote>
<p>So one thing seems to be clear: yes, it’s possible to write a non-trivial amount of C code that does something useful without going mad (and it’s even quite enjoyable I might add).</p>
</blockquote>

<ul>
<li>
<p>Here’s a few things I learned:</p>
</li>
<li>
<p>Pick the right language for a problem</p>
</li>
<li>
<p>C is a perfect match for WebAssembly</p>
</li>
<li>
<p>C99 is a huge improvement over C89</p>
</li>
<li>
<p>The dangers of pointers and explicit memory management are overrated</p>
</li>
<li>
<p>Less Boilerplate Code</p>
</li>
<li>
<p>Less Language Feature ‘Anxiety’</p>
</li>
<li>
<p>Conclusion</p>
</li>
</ul>

<blockquote>
<p>All in all my “C experiment” is a success. For a lot of problems, picking C over C++ may be the better choice since C is a much simpler language (btw, did you notice how there are hardly any books, conferences or discussions about C despite being a fairly popular language? Apart from the neverending bickering about undefined behaviour from the compiler people of course ;) There simply isn’t much to discuss about a language that can be learned in an afternoon.</p>
</blockquote>

<blockquote>
<p>I don’t like some of the old POSIX or Linux APIs as much as the next guy (e.g. ioctl(), the socket API or some of the CRT library functions), but that’s an API design problem, not a language problem. It’s possible to build friendly C APIs with a bit of care and thinking, especially when C99’s designated initialization can be used (C++ should really make sure that the full C99 language can be used from inside C++ instead of continuing to wander off into an entirely different direction).</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://empt1e.blogspot.com/2018/06/configuring-openbgpd-to-announce-vms.html">Configuring OpenBGPD to announce VM’s virtual networks</a></p>

<blockquote>
<p>We use BGP quite heavily at work, and even though I’m not interacting with that directly, it feels like it’s something very useful to learn at least on some basic level. The most effective and fun way of learning technology is finding some practical application, so I decided to see if it could help to improve networking management for my Virtual Machines.</p>
</blockquote>

<blockquote>
<p>My setup is fairly simple: I have a host that runs bhyve VMs and I have a desktop system from where I ssh to VMs, both hosts run FreeBSD. All VMs are connected to each other through a bridge and have a common network 10.0.1/24. The point of this exercise is to be able to ssh to these VMs from desktop without adding static routes and without adding vmhost’s external interfaces to the VMs bridge.</p>
</blockquote>

<blockquote>
<p>I’ve installed openbgpd on both hosts and configured it like this:</p>
</blockquote>

<pre><code>vmhost: /usr/local/etc/bgpd.conf
AS 65002
router-id 192.168.87.48
fib-update no

network 10.0.1.1/24

neighbor 192.168.87.41 {
    descr &quot;desktop&quot;
    remote-as 65001
}
</code></pre>

<blockquote>
<p>Here, router-id is set vmhost’s IP address in my home network (192.168.87/24), fib-update no is set to forbid routing table update, which I initially set for testing, but keeping it as vmhost is not supposed to learn new routes from desktop anyway. network announces my VMs network and neighbor describes my desktop box. Now the desktop box:</p>
</blockquote>

<pre><code>desktop: /usr/local/etc/bgpd.conf
AS 65001
router-id 192.168.87.41
fib-update yes

neighbor 192.168.87.48 {                                                                                                                                                                                           
        descr &quot;vmhost&quot;                                                                                                                                                                                             
        remote-as 65002                                                                                                                                                                                            
}
</code></pre>

<blockquote>
<p>It’s pretty similar to vmhost’s bgpd.conf, but no networks are announced here, and fib-update is set to yes because the whole point is to get VM routes added. Both hosts have to have the openbgpd service enabled:</p>
</blockquote>

<pre><code>/etc/rc.conf.local
openbgpd_enable=&quot;YES&quot;
</code></pre>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>As mentioned already, similar result could be achieved without using BGP by using either static routes or bridging interfaces differently, but the purpose of this exercise is to get some basic hands-on experience with BGP. Right now I’m looking into extending my setup in order to try more complex BGP schema. I’m thinking about adding some software switches in front of my VMs or maybe adding a second VM host (if budget allows). You’re welcome to comment if you have some ideas how to extend this setup for educational purposes in the context of BGP and networking.</p>
</blockquote>

<blockquote>
<p>As a side note, I really like openbgpd so far. Its configuration file format is clean and simple, documentation is good, error and information messages are clear, and CLI has intuitive syntax.</p>
</blockquote>

<p><hr></p>

<p><strong>Digital Ocean</strong></p>

<p>###<a href="https://nocomplexity.com/the-power-to-serve/">The Power to Serve</a></p>

<blockquote>
<p>All people within the IT Industry should known where the slogan “The Power To Serve” is exposed every day to millions of people. But maybe too much wishful thinking from me. But without “The Power To Serve” the IT industry today will look totally different. Companies like Apple, Juniper, Cisco and even WatsApp would not exist in their current form.</p>
</blockquote>

<blockquote>
<p>I provide IT architecture services to make your complex IT landscape manageable and I love to solve complex security and privacy challenges. Complex challenges where people, processes and systems are heavily interrelated. For this knowledge intensive work I often run some IT experiments. When you run experiments nowadays you have a choice:</p>
</blockquote>

<ul>
<li>Rent some cloud based services or</li>
<li>DIY (Do IT Yourself) on premise</li>
</ul>

<blockquote>
<p>Running your own developments experiments on your own infrastructure can be time consuming. However smart automation saves time and money. And by creating your own CICD pipeline (Continuous Integration, Continuous Deployment) you stay on top of core infrastructure developments. Even hands-on. Knowing how things work from a technical ‘hands-on’ perspective gives great advantages when it comes to solving complex business IT problems. Making a clear distinguish between a business problem or IT problem is useless. Business and IT problems are related. Sometimes causal related, but more often indirect by one or more non linear feedback loops. Almost every business depends of IT systems. Bad IT means often that your customers will leave your business.</p>
</blockquote>

<blockquote>
<p>One of the things of FeeBSD for me is still FreeBSD Jails. In 2015 I had luck to attend to a presentation of the legendary hacker Poul-Henning Kamp . Check his BSD bio to see what he has done for the FreeBSD community! FreeBSD jails are a light way to visualize your system without enormous overhead. Now that the development on Linux for LXD/LXD is more mature (lxd is the next generation system container manager on linux) there is finally again an alternative for a nice chroot Linux based system again. At least when you do not need the overhead and management complexity that comes with Kubernetes or Docker.</p>
</blockquote>

<blockquote>
<p>FreeBSD means control and quality for me. When there is an open source package I need, I want to install it from source. It gives me more control and always some extra knowledge on how things work. So no precompiled binaries for me on my BSD systems! If a build on FreeBSD fails most of the time this is an alert regarding the quality for me.</p>
</blockquote>

<blockquote>
<p>If a complex OSS package is not available at all in the FreeBSD ports collection there should be a reason for it. Is it really that nobody on the world wants to do this dirty maintenance work? Or is there another cause that running this software on FreeBSD is not possible…There are currently 32644 ports available on FreeBSD. So all the major programming language, databases and middleware libraries are present. The FreeBSD organization is a mature organization and since this is one of the largest OSS projects worldwide learning how this community manages to keep innovation and creates and maintains software is a good entrance for learning how complex IT systems function.</p>
</blockquote>

<blockquote>
<p>FreeBSD is of course BSD licensed. It worked well! There is still a strong community with lots of strong commercial sponsors around the community. Of course: sometimes a GPL license makes more sense. So beside FreeBSD I also love GPL software and the rationale and principles behind it. So my hope is that maybe within the next 25 years the hard battle between BSD vs GPL churches will be more rationalized and normalized. Principles are good, but as all good IT architects know: With good principles alone you never make a good system. So use requirements and not only principles to figure out what OSS license fits your project. There is never one size fits all.</p>
</blockquote>

<blockquote>
<p>June 19, 1993 was the day the official name for FreeBSD was agreed upon. So this blog is written to celebrate 25th anniversary of FreeBSD.</p>
</blockquote>

<p><hr></p>

<p>###Dave’s BSDCan trip report</p>

<ul>
<li>So far, only one person has bothered to send in a BSDCan trip report. Our warmest thanks to Dave for doing his part.</li>
</ul>

<blockquote>
<p>Hello guys! During the last show, you asked for a trip report regarding BSDCan 2018.<br>
This was my first time attending BSDCan. However, BSDCan was my second BSD conference overall, my first being vBSDCon 2017 in Reston, VA.<br>
Arriving early Thursday evening and after checking into the hotel, I headed straight to the Red Lion for the registration, picked up my badge and swag and then headed towards the ‘DMS’ building for the newbies talk. The only thing is, I couldn’t find the DMS building! Fortunately I found a BSDCan veteran who was heading there themselves. My only suggestion is to include the full building name and address on the BSDCan web site, or even a link to Google maps to help out with the navigation. The on-campus street maps didn’t have ‘DMS’ written on them anywhere. But I digress.<br>
Once I made it to the newbies talk hosted by Dan Langille and Michael W Lucas, it highlighted places to meet, an overview of what is happening, details about the ‘BSDCan widow/widower tours’ and most importantly, the 6-2-1 rule!<br>
The following morning, we were present with tea/coffee, muffins and other goodies to help prepare us for the day ahead.<br>
The first talk, “The Tragedy of systemd” covered what systemd did wrong and how the BSD community could improve on the ideas behind it.<br>
With the exception of Michael W Lucas, SSH Key Management and Kirk McKusick, The Evolution of FreeBSD Governance talk, I pretty much attended all of the ZFS talks including the lunchtime BoF session, hosted by Allan Jude. Coming from FreeNAS and being involved in the community, this is where my main interest and motivation lies. Since then I have been able to share some of that information with the FreeNAS community forums and chatroom.<br>
I also attended the “Speculating about Intel” lunchtime BoF session hosted by Theo de Raddt, which proved to be “interesting”.<br>
The talks ended with the wrap up session with a few words from Dan, covering the record attendance and made very clear there “was no cabal”. Followed by the the handing over of Groff the BSD goat to a new owner, thank you’s from the FreeBSD Foundation to various community committers and maintainers, finally ending with the charity auction, where a things like a Canadian $20 bill sold for $40, a signed FreeBSD Foundation shirt originally worn by George Neville-Neil, a lost laptop charger, Michael’s used gelato spoon, various books, the last cookie and more importantly, the second to last cookie!<br>
After the auction, we all headed to the Red Lion for food and drinks, sponsored by iXsystems.<br>
I would like to thank the BSDCan organizers, speakers and sponsors for a great conference. I will certainly hope to attend next year!<br>
Regards,<br>
Dave (aka m0nkey_)</p>
</blockquote>

<ul>
<li>Thanks to Dave for sharing his experiences with us and our viewers</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-advocacy/2008-August/003674.html">Robert Watson (from 2008) on how much FreeBSD is in Mac OS X </a></li>
<li><a href="https://aloiskraus.wordpress.com/2018/06/16/why-skylakex-cpus-are-sometimes-50-slower-how-intel-has-broken-existing-code/">Why Intel Skylake CPUs are sometimes 50% slower than older CPUs</a></li>
<li><a href="https://lobste.rs/s/bos5cr/practical_unix_manuals_mdoc">Kristaps Dzonsons is looking for somebody to maintain this as mentioned at this link</a></li>
<li><a href="https://www.reddit.com/r/freebsd/comments/87rru4/formatting_floppy_disks_in_a_usb_floppy_disk_drive/">camcontrol(8) saves the day again! Formatting floppy disks in a USB floppy disk drive</a></li>
<li><a href="https://www.reddit.com/r/openbsd_gaming/comments/898ey5/32_great_indie_games_now_playable_on_current_7/">32+ great indie games now playable on OpenBSD -current; 7 currently on sale!</a></li>
<li><a href="https://bsd-pl.org/en">Warsaw BSD User Group. June 27 2018 18:30-21:00, Wheel Systems Office, Aleje Jerozolimskie 178, Warsaw</a></li>
</ul>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Ron - <a href="http://dpaste.com/2B6CWDM#wrap">Adding a disk to ZFS</a></li>
<li>Marshall - <a href="http://dpaste.com/2W7VD6K#wrap">zfs question</a></li>
<li>Thomas - <a href="http://dpaste.com/1FS7534#wrap">Allan, the myth perpetuator</a></li>
<li>Ross - <a href="http://dpaste.com/1HWQWB6#wrap">ZFS IO stats per dataset</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 251: Crypto HAMMER | BSD Now 251</title>
  <link>https://www.bsdnow.tv/251</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2136</guid>
  <pubDate>Thu, 21 Jun 2018 05:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/034d5002-639f-4744-a773-9c000ce91d1c.mp3" length="53300210" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>DragonflyBSD’s hammer1 encrypted master/slave setup, second part of our BSDCan recap, NomadBSD 1.1-RC1 available, OpenBSD adds an LDAP client to base, FreeBSD gets pNFS support, Intel FPU Speculation Vulnerability confirmed, and what some Unix command names mean.</itunes:subtitle>
  <itunes:duration>1:28:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>DragonflyBSD’s hammer1 encrypted master/slave setup, second part of our BSDCan recap, NomadBSD 1.1-RC1 available, OpenBSD adds an LDAP client to base, FreeBSD gets pNFS support, Intel FPU Speculation Vulnerability confirmed, and what some Unix command names mean.
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://www.reddit.com/r/dragonflybsd/comments/8riwtx/towards_a_hammer1_masterslave_encrypted_setup/"&gt;DragonflyBSD: Towards a HAMMER1 master/slave encrypted setup with LUKS&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I just wanted to share my experience with setting up DragonFly master/slave HAMMER1 PFS’s on top of LUKS&lt;br&gt;
So after a long time using an Synology for my NFS needs, I decided it was time to rethink my setup a little since I had several issues with it :&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;You cannot run NFS on top of encrypted partitions easily&lt;/li&gt;
&lt;li&gt;I suspect I am having some some data corruption (bitrot) on the ext4 filesystem&lt;/li&gt;
&lt;li&gt;the NIC was stcuk to 100 Mbps instead of 1 Gbps even after swapping cables, switches, you name it&lt;/li&gt;
&lt;li&gt;It’s proprietary&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I have been playing with DragonFly in the past and knew about HAMMER, now I just had the perfect excuse to actually use it in production :) After setting up the OS, creating the LUKS partition and HAMMER FS was easy :&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;kdload dm&lt;/code&gt;&lt;br&gt;
&lt;code&gt;cryptsetup luksFormat /dev/serno/&amp;lt;id1&amp;gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;cryptsetup luksOpen /dev/serno/&amp;lt;id1&amp;gt; fort_knox&lt;/code&gt;&lt;br&gt;
&lt;code&gt;newfs_hammer -L hammer1_secure_master /dev/mapper/fort_knox&lt;/code&gt;&lt;br&gt;
&lt;code&gt;cryptsetup luksFormat /dev/serno/&amp;lt;id2&amp;gt;&lt;/code&gt;&lt;br&gt;
&lt;code&gt;cryptsetup luksOpen /dev/serno/&amp;lt;id2&amp;gt; fort_knox_slave&lt;/code&gt;&lt;br&gt;
&lt;code&gt;newfs_hammer -L hammer1_secure_slave /dev/mapper/fort_knox_slave&lt;/code&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Mount the 2 drives :&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;code&gt;mount /dev/mapper/fort_knox /fort_knox&lt;/code&gt;&lt;br&gt;
&lt;code&gt;mount /dev/mapper_fort_know_slave /fort_knox_slave&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;You can now put your data under /fort_knox&lt;br&gt;
Now, off to setting up the replication, first get the shared-uuid of /fort_knox&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;hammer pfs-status /fort_knox&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Create a PFS slave “linked” to the master&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;hammer pfs-slave /fort_knox_slave/pfs/slave shared-uuid=f9e7cc0d-eb59-10e3-a5b5-01e6e7cefc12&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;And then stream your data to the slave PFS !&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;hammer mirror-stream /fort_knox /fort_knox_slave/pfs/slave&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;After that, setting NFS is fairly trivial even though I had problem with the /etc/exports syntax which is different than Linux&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;There’s a few things I wish would be better though but nothing too problematic or without workarounds :&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Cannot unlock LUKS partitions at boot time afaik (Acceptable tradeoff for the added security LUKS gives me vs my old Synology setup) but this force me to run a script to unlock LUKS, mount hammer and start mirror-stream at each boot&lt;/li&gt;
&lt;li&gt;No S1/S3 sleep so I made a script to shutdown the system when there’s no network neighborgs to serve the NFS&lt;/li&gt;
&lt;li&gt;As my system isn’t online 24/7 for energy reasons, I guess will have to run hammer cleanup myself from time to time&lt;/li&gt;
&lt;li&gt;Some uncertainty because hey, it’s kind of exotic but exciting too :)&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Overall, I am happy, HAMMER1 and PFS are looking really good, DragonFly is a neat Unix and the community is super friendly (Matthew Dillon actually provided me with a kernel patch to fix the broken ACPI on the PC holding this setup, many thanks!), the system is still a “work in progress” but it is already serving my files as I write this post.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Let’s see in 6 months how it goes in the longer run !&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Helpful resources : &lt;a href="https://www.dragonflybsd.org/docs/how_to_implement_hammer_pseudo_file_system__40___pfs___41___slave_mirroring_from_pfs_master/"&gt;https://www.dragonflybsd.org/docs/how_to_implement_hammer_pseudo_file_system__40___pfs___41___slave_mirroring_from_pfs_master/&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###BSDCan 2018 Recap&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;As promised, here is our second part of our BSDCan report, covering the conference proper. The last tutorials/devsummit of that day lead directly into the conference, as people could pick up their registration packs at the Red Lion and have a drink with fellow BSD folks.&lt;/li&gt;
&lt;li&gt;Allan and I were there only briefly, as we wanted to get back to the “Newcomers orientation and mentorship” session lead by Michael W. Lucas. This session is intended for people that are new to BSDCan (maybe their first BSD conference ever?) and may have questions. Michael explained everything from the 6-2-1 rule (hours of sleep, meals per day, and number of showers that attendees should have at a minimum), to the partner and widowers program (lead by his wife Liz), to the sessions that people should not miss (opening, closing, and hallway track). Old-time BSDCan folks were asked to stand up so that people can recognize them and ask them any questions they might have during the conferences. The session was well attended. Afterwards, people went for dinner in groups, a big one lead by Michael Lucas to his favorite Shawarma place, followed by gelato (of course). This allowed newbies to mingle over dinner and ice cream, creating a welcoming atmosphere.&lt;/li&gt;
&lt;li&gt;The next day, after Dan Langille opened the conference, Benno Rice gave the keynote presentation about “The Tragedy of Systemd”.&lt;/li&gt;
&lt;li&gt;Benedict went to the following talks:&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;“Automating Network Infrastructures with Ansible on FreeBSD” in the DevSummit track. A good talk that connected well with his Ansible tutorial and even allowed some discussions among participants.&lt;br&gt;
“All along the dwatch tower”: Devin delivered a well prepared talk. I first thought that the number of slides would not fit into the time slot, but she even managed to give a demo of her work, which was well received. The dwatch tool she wrote should make it easy for people to get started with DTrace without learning too much about the syntax at first. The visualizations were certainly nice to see, combining different tools together in a new way.&lt;br&gt;
ZFS BoF, lead by Allan and Matthew Ahrens&lt;br&gt;
SSH Key Management by Michael W. Lucas. Yet another great talk where I learned a lot. I did not get to the SSH CA chapter in the new SSH Mastery book, so this was a good way to wet my appetite for it and motivated me to look into creating one for the cluster that I’m managing.&lt;br&gt;
The rest of the day was spent at the FreeBSD Foundation table, talking to various folks. Then, Allan and I had an interview with Kirk McKusick for National FreeBSD Day, then we had a core meeting, followed by a core dinner.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Day 2:
&lt;blockquote&gt;
&lt;p&gt;“Flexible Disk Use in OpenZFS”: Matthew Ahrens talking about the feature he is implementing to expand a RAID-Z with a single disk, as well as device removal.&lt;br&gt;
Allan’s talk about his efforts to implement ZSTD in OpenZFS as another compression algorithm. I liked his overview slides with the numbers comparing the algorithms for their effectiveness and his personal story about the sometimes rocky road to get the feature implemented.&lt;br&gt;
“zrepl - ZFS replication” by Christian Schwarz, was well prepared and even had a demo to show what his snapshot replication tool can do. We covered it on the show before and people can find it under sysutils/zrepl. Feedback and help is welcome.&lt;br&gt;
“The Evolution of FreeBSD Governance” by Kirk McKusick was yet another great talk by him covering the early days of FreeBSD until today, detailing some of the progress and challenges the project faced over the years in terms of leadership and governance. This is an ongoing process that everyone in the community should participate in to keep the project healthy and infused with fresh blood.&lt;br&gt;
Closing session and auction were funny and great as always.&lt;br&gt;
All in all, yet another amazing BSDCan. Thank you Dan Langille and your organizing team for making it happen! Well done.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Digital Ocean&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="http://nomadbsd.org/index.html#rel1.1-rc1"&gt;NomadBSD 1.1-RC1 Released&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The first – and hopefully final – release candidate of NomadBSD 1.1 is available!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Changes&lt;/li&gt;
&lt;li&gt;The base system has been upgraded to FreeBSD 11.2-RC3&lt;/li&gt;
&lt;li&gt;EFI booting has been fixed.&lt;/li&gt;
&lt;li&gt;Support for modern Intel GPUs has been added.&lt;/li&gt;
&lt;li&gt;Support for installing packages has been added.&lt;/li&gt;
&lt;li&gt;Improved setup menu.&lt;/li&gt;
&lt;li&gt;More software packages:&lt;/li&gt;
&lt;li&gt;benchmarks/bonnie++&lt;/li&gt;
&lt;li&gt;DSBDisplaySettings&lt;/li&gt;
&lt;li&gt;DSBExec&lt;/li&gt;
&lt;li&gt;DSBSu&lt;/li&gt;
&lt;li&gt;mail/thunderbird&lt;/li&gt;
&lt;li&gt;net/mosh&lt;/li&gt;
&lt;li&gt;ports-mgmt/octopkg&lt;/li&gt;
&lt;li&gt;print/qpdfview&lt;/li&gt;
&lt;li&gt;security/nmap&lt;/li&gt;
&lt;li&gt;sysutils/ddrescue&lt;/li&gt;
&lt;li&gt;sysutils/fusefs-hfsfuse&lt;/li&gt;
&lt;li&gt;sysutils/fusefs-sshfs&lt;/li&gt;
&lt;li&gt;sysutils/sleuthkit&lt;/li&gt;
&lt;li&gt;www/lynx&lt;/li&gt;
&lt;li&gt;x11-wm/compton&lt;/li&gt;
&lt;li&gt;x11/xev&lt;/li&gt;
&lt;li&gt;x11/xterm&lt;/li&gt;
&lt;li&gt;Many improvements and bugfixes&lt;br&gt;
The image and instructions can be found &lt;a href="http://nomadbsd.org/download.html"&gt;here&lt;/a&gt;.&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://undeadly.org/cgi?action=article;sid=20180616115514"&gt;LDAP client added to -current&lt;/a&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CVSROOT:    /cvs
Module name:    src
Changes by: reyk@cvs.openbsd.org    2018/06/13 09:45:58

Log message:
    Import ldap(1), a simple ldap search client.
    We have an ldapd(8) server and ypldap in base, so it makes sense to
    have a simple LDAP client without depending on the OpenLDAP package.
    This tool can be used in an ssh(1) AuthorizedKeysCommand script.
    
    With feedback from many including millert@ schwarze@ gilles@ dlg@ jsing@
    
    OK deraadt@
    
    Status:
    
    Vendor Tag: reyk
    Release Tags:   ldap_20180613
    
    N src/usr.bin/ldap/Makefile
    N src/usr.bin/ldap/aldap.c
    N src/usr.bin/ldap/aldap.h
    N src/usr.bin/ldap/ber.c
    N src/usr.bin/ldap/ber.h
    N src/usr.bin/ldap/ldap.1
    N src/usr.bin/ldap/ldapclient.c
    N src/usr.bin/ldap/log.c
    N src/usr.bin/ldap/log.h
    
    No conflicts created by this import
&lt;/code&gt;&lt;/pre&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://undeadly.org/cgi?action=article;sid=20180614064341"&gt;Intel® FPU Speculation Vulnerability Confirmed&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Earlier this month, Philip Guenther (guenther@) &lt;a href="https://marc.info/?l=openbsd-cvs&amp;amp;m=152818076013158&amp;amp;w=2"&gt;committed&lt;/a&gt; (to amd64 -current) a change from lazy to semi-eager FPU switching to mitigate against rumored FPU state leakage in Intel® CPUs.&lt;/li&gt;
&lt;li&gt;Theo de Raadt (deraadt@) discussed this in &lt;a href="https://undeadly.org/cgi?action=article;sid=20180611101817"&gt;his BSDCan 2018 session&lt;/a&gt;.&lt;/li&gt;
&lt;li&gt;Using information disclosed in Theo’s talk, &lt;a href="https://twitter.com/cperciva/status/1007010583244230656"&gt;Colin Percival&lt;/a&gt; developed a proof-of-concept exploit in around 5 hours. This seems to have prompted an early end to an embargo (in which OpenBSD was not involved), and the &lt;a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00145.html"&gt;official announcement&lt;/a&gt; of the vulnerability.&lt;/li&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=335072"&gt;FPU change in FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;pre&gt;&lt;code&gt;Summary:
System software may utilize the Lazy FP state restore technique to delay the restoring of state until an instruction operating on that state is actually executed by the new process. Systems using Intel® Core-based microprocessors may potentially allow a local process to infer data utilizing Lazy FP state restore from another process through a speculative execution side channel.
Description:
System software may opt to utilize Lazy FP state restore instead of eager save and restore of the state upon a context switch. Lazy restored states are potentially vulnerable to exploits where one process may infer register values of other processes through a speculative execution side channel that infers their value.
·    CVSS - 4.3 Medium CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Affected Products:
Intel® Core-based microprocessors.
Recommendations:
If an XSAVE-enabled feature is disabled, then we recommend either its state component bitmap in the extended control register (XCR0) is set to 0 (e.g. XCR0[bit 2]=0 for AVX, XCR0[bits 7:5]=0 for AVX512) or the corresponding register states of the feature should be cleared prior to being disabled. Also for relevant states (e.g. x87, SSE, AVX, etc.), Intel recommends system software developers utilize Eager FP state restore in lieu of Lazy FP state restore.
Acknowledgements:
Intel would like to thank Julian Stecklina from Amazon Germany, Thomas Prescher from Cyberus Technology GmbH (https://www.cyberus-technology.de/), Zdenek Sojka from SYSGO AG (http://sysgo.com), and Colin Percival for reporting this issue and working with us on coordinated disclosure.
&lt;/code&gt;&lt;/pre&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;br&gt;
iX Ad Spot&lt;br&gt;
&lt;a href="https://www.ixsystems.com/blog/bsdcan-2018-recap/"&gt;iX Systems - BSDCan 2018 Recap&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=335012"&gt;FreeBSD gets pNFS support&lt;/a&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;Merge the pNFS server code from projects/pnfs-planb-server into head.

This code merge adds a pNFS service to the NFSv4.1 server. Although it is
a large commit it should not affect behaviour for a non-pNFS NFS server.
Some documentation on how this works can be found at:
Merge the pN http://people.freebsd.org/~rmacklem/pnfs-planb-setup.txt
and will hopefully be turned into a proper document soon.
This is a merge of the kernel code. Userland and man page changes will
come soon, once the dust settles on this merge.
It has passed a "make universe", so I hope it will not cause build problems.
It also adds NFSv4.1 server support for the "current stateid".

Here is a brief overview of the pNFS service:
A pNFS service separates the Read/Write operations from all the other NFSv4.1
Metadata operations. It is hoped that this separation allows a pNFS service
to be configured that exceeds the limits of a single NFS server for either
storage capacity and/or I/O bandwidth.
It is possible to configure mirroring within the data servers (DSs) so that
the data storage file for an MDS file will be mirrored on two or more of
the DSs.
When this is used, failure of a DS will not stop the pNFS service and a
failed DS can be recovered once repaired while the pNFS service continues
to operate.  Although two way mirroring would be the norm, it is possible
to set a mirroring level of up to four or the number of DSs, whichever is
less.
The Metadata server will always be a single point of failure,
just as a single NFS server is.

A Plan B pNFS service consists of a single MetaData Server (MDS) and K
Data Servers (DS), all of which are recent FreeBSD systems.
Clients will mount the MDS as they would a single NFS server.
When files are created, the MDS creates a file tree identical to what a
single NFS server creates, except that all the regular (VREG) files will
be empty. As such, if you look at the exported tree on the MDS directly
on the MDS server (not via an NFS mount), the files will all be of size 0.
Each of these files will also have two extended attributes in the system
attribute name space:
pnfsd.dsfile - This extended attrbute stores the information that
    the MDS needs to find the data storage file(s) on DS(s) for this file.
pnfsd.dsattr - This extended attribute stores the Size, AccessTime, ModifyTime
    and Change attributes for the file, so that the MDS doesn't need to
    acquire the attributes from the DS for every Getattr operation.
For each regular (VREG) file, the MDS creates a data storage file on one
(or more if mirroring is enabled) of the DSs in one of the "dsNN"
subdirectories.  The name of this file is the file handle
of the file on the MDS in hexadecimal so that the name is unique.
The DSs use subdirectories named "ds0" to "dsN" so that no one directory
gets too large. The value of "N" is set via the sysctl vfs.nfsd.dsdirsize
on the MDS, with the default being 20.
For production servers that will store a lot of files, this value should
probably be much larger.
It can be increased when the "nfsd" daemon is not running on the MDS,
once the "dsK" directories are created.

For pNFS aware NFSv4.1 clients, the FreeBSD server will return two pieces
of information to the client that allows it to do I/O directly to the DS.
DeviceInfo - This is relatively static information that defines what a DS
             is. The critical bits of information returned by the FreeBSD
             server is the IP address of the DS and, for the Flexible
             File layout, that NFSv4.1 is to be used and that it is
             "tightly coupled".
             There is a "deviceid" which identifies the DeviceInfo.
Layout     - This is per file and can be recalled by the server when it
             is no longer valid. For the FreeBSD server, there is support
             for two types of layout, call File and Flexible File layout.
             Both allow the client to do I/O on the DS via NFSv4.1 I/O
             operations. The Flexible File layout is a more recent variant
             that allows specification of mirrors, where the client is
             expected to do writes to all mirrors to maintain them in a
             consistent state. The Flexible File layout also allows the
             client to report I/O errors for a DS back to the MDS.
             The Flexible File layout supports two variants referred to as
             "tightly coupled" vs "loosely coupled". The FreeBSD server always
             uses the "tightly coupled" variant where the client uses the
             same credentials to do I/O on the DS as it would on the MDS.
             For the "loosely coupled" variant, the layout specifies a
             synthetic user/group that the client uses to do I/O on the DS.
             The FreeBSD server does not do striping and always returns
             layouts for the entire file. The critical information in a layout
             is Read vs Read/Writea and DeviceID(s) that identify which
             DS(s) the data is stored on.

At this time, the MDS generates File Layout layouts to NFSv4.1 clients
that know how to do pNFS for the non-mirrored DS case unless the sysctl
vfs.nfsd.default_flexfile is set non-zero, in which case Flexible File
layouts are generated.
The mirrored DS configuration always generates Flexible File layouts.
For NFS clients that do not support NFSv4.1 pNFS, all I/O operations
are done against the MDS which acts as a proxy for the appropriate DS(s).
When the MDS receives an I/O RPC, it will do the RPC on the DS as a proxy.
If the DS is on the same machine, the MDS/DS will do the RPC on the DS as
a proxy and so on, until the machine runs out of some resource, such as
session slots or mbufs.
As such, DSs must be separate systems from the MDS.

***

###[What does {some strange unix command name} stand for?](http://www.unixguide.net/unix/faq/1.3.shtml)

+ awk = "Aho Weinberger and Kernighan" 
+ grep = "Global Regular Expression Print" 
+ fgrep = "Fixed GREP". 
+ egrep = "Extended GREP" 
+ cat = "CATenate" 
+ gecos = "General Electric Comprehensive Operating Supervisor" 
+ nroff = "New ROFF" 
+ troff = "Typesetter new ROFF" 
+ tee = T 
+ bss = "Block Started by Symbol
+ biff = "BIFF" 
+ rc (as in ".cshrc" or "/etc/rc") = "RunCom" 
+ Don Libes' book "Life with Unix" contains lots more of these 
tidbits. 
***

##Beastie Bits
+ [RetroBSD: Unix for microcontrollers](http://retrobsd.org/wiki/doku.php)
+ [On the matter of OpenBSD breaking embargos (KRACK)](https://marc.info/?l=openbsd-tech&amp;amp;m=152910536208954&amp;amp;w=2)
+ [Theo's Basement Computer Paradise (1998)](https://zeus.theos.com/deraadt/hosts.html)
+ [Airport Extreme runs NetBSD](https://jcs.org/2018/06/12/airport_ssh)
+ [What UNIX shell could have been](https://rain-1.github.io/shell-2.html)

***
Tarsnap ad
***

##Feedback/Questions
+ We need more feedback and questions. Please email feedback@bsdnow.tv 
+ Also, many of you owe us BSDCan trip reports! We have shared what our experience at BSDCan was like, but we want to hear about yours. What can we do better next year? What was it like being there for the first time?
+ [Jason writes in](https://slexy.org/view/s205jU58X2)
    + https://www.wheelsystems.com/en/products/wheel-fudo-psm/
+ [June 19th was National FreeBSD Day](https://twitter.com/search?src=typd&amp;amp;q=%23FreeBSDDay)
***

- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)
***

&lt;/code&gt;&lt;/pre&gt; 
</description>
  <itunes:keywords>freebsd,openbsd,netbsd,dragonflybsd,trueos,trident,hardenedbsd,tutorial,howto,guide,bsd,interview,hammer,Intel,NomadBSD,LDAP,pNFS,RetroBSD</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>DragonflyBSD’s hammer1 encrypted master/slave setup, second part of our BSDCan recap, NomadBSD 1.1-RC1 available, OpenBSD adds an LDAP client to base, FreeBSD gets pNFS support, Intel FPU Speculation Vulnerability confirmed, and what some Unix command names mean.</p>

<p>##Headlines<br>
###<a href="https://www.reddit.com/r/dragonflybsd/comments/8riwtx/towards_a_hammer1_masterslave_encrypted_setup/">DragonflyBSD: Towards a HAMMER1 master/slave encrypted setup with LUKS</a></p>

<blockquote>
<p>I just wanted to share my experience with setting up DragonFly master/slave HAMMER1 PFS’s on top of LUKS<br>
So after a long time using an Synology for my NFS needs, I decided it was time to rethink my setup a little since I had several issues with it :</p>
</blockquote>

<ul>
<li>You cannot run NFS on top of encrypted partitions easily</li>
<li>I suspect I am having some some data corruption (bitrot) on the ext4 filesystem</li>
<li>the NIC was stcuk to 100 Mbps instead of 1 Gbps even after swapping cables, switches, you name it</li>
<li>It’s proprietary</li>
</ul>

<blockquote>
<p>I have been playing with DragonFly in the past and knew about HAMMER, now I just had the perfect excuse to actually use it in production :) After setting up the OS, creating the LUKS partition and HAMMER FS was easy :</p>
</blockquote>

<p><code>kdload dm</code><br>
<code>cryptsetup luksFormat /dev/serno/&lt;id1&gt;</code><br>
<code>cryptsetup luksOpen /dev/serno/&lt;id1&gt; fort_knox</code><br>
<code>newfs_hammer -L hammer1_secure_master /dev/mapper/fort_knox</code><br>
<code>cryptsetup luksFormat /dev/serno/&lt;id2&gt;</code><br>
<code>cryptsetup luksOpen /dev/serno/&lt;id2&gt; fort_knox_slave</code><br>
<code>newfs_hammer -L hammer1_secure_slave /dev/mapper/fort_knox_slave</code></p>

<ul>
<li>Mount the 2 drives :</li>
</ul>

<p><code>mount /dev/mapper/fort_knox /fort_knox</code><br>
<code>mount /dev/mapper_fort_know_slave /fort_knox_slave</code></p>

<blockquote>
<p>You can now put your data under /fort_knox<br>
Now, off to setting up the replication, first get the shared-uuid of /fort_knox</p>
</blockquote>

<p><code>hammer pfs-status /fort_knox</code></p>

<blockquote>
<p>Create a PFS slave “linked” to the master</p>
</blockquote>

<p><code>hammer pfs-slave /fort_knox_slave/pfs/slave shared-uuid=f9e7cc0d-eb59-10e3-a5b5-01e6e7cefc12</code></p>

<blockquote>
<p>And then stream your data to the slave PFS !</p>
</blockquote>

<p><code>hammer mirror-stream /fort_knox /fort_knox_slave/pfs/slave</code></p>

<blockquote>
<p>After that, setting NFS is fairly trivial even though I had problem with the /etc/exports syntax which is different than Linux</p>
</blockquote>

<blockquote>
<p>There’s a few things I wish would be better though but nothing too problematic or without workarounds :</p>
</blockquote>

<ul>
<li>Cannot unlock LUKS partitions at boot time afaik (Acceptable tradeoff for the added security LUKS gives me vs my old Synology setup) but this force me to run a script to unlock LUKS, mount hammer and start mirror-stream at each boot</li>
<li>No S1/S3 sleep so I made a script to shutdown the system when there’s no network neighborgs to serve the NFS</li>
<li>As my system isn’t online 24/7 for energy reasons, I guess will have to run hammer cleanup myself from time to time</li>
<li>Some uncertainty because hey, it’s kind of exotic but exciting too :)</li>
</ul>

<blockquote>
<p>Overall, I am happy, HAMMER1 and PFS are looking really good, DragonFly is a neat Unix and the community is super friendly (Matthew Dillon actually provided me with a kernel patch to fix the broken ACPI on the PC holding this setup, many thanks!), the system is still a “work in progress” but it is already serving my files as I write this post.</p>
</blockquote>

<blockquote>
<p>Let’s see in 6 months how it goes in the longer run !</p>
</blockquote>

<ul>
<li>Helpful resources : <a href="https://www.dragonflybsd.org/docs/how_to_implement_hammer_pseudo_file_system__40___pfs___41___slave_mirroring_from_pfs_master/">https://www.dragonflybsd.org/docs/how_to_implement_hammer_pseudo_file_system__40___pfs___41___slave_mirroring_from_pfs_master/</a></li>
</ul>

<p><hr></p>

<p>###BSDCan 2018 Recap</p>

<ul>
<li>As promised, here is our second part of our BSDCan report, covering the conference proper. The last tutorials/devsummit of that day lead directly into the conference, as people could pick up their registration packs at the Red Lion and have a drink with fellow BSD folks.</li>
<li>Allan and I were there only briefly, as we wanted to get back to the “Newcomers orientation and mentorship” session lead by Michael W. Lucas. This session is intended for people that are new to BSDCan (maybe their first BSD conference ever?) and may have questions. Michael explained everything from the 6-2-1 rule (hours of sleep, meals per day, and number of showers that attendees should have at a minimum), to the partner and widowers program (lead by his wife Liz), to the sessions that people should not miss (opening, closing, and hallway track). Old-time BSDCan folks were asked to stand up so that people can recognize them and ask them any questions they might have during the conferences. The session was well attended. Afterwards, people went for dinner in groups, a big one lead by Michael Lucas to his favorite Shawarma place, followed by gelato (of course). This allowed newbies to mingle over dinner and ice cream, creating a welcoming atmosphere.</li>
<li>The next day, after Dan Langille opened the conference, Benno Rice gave the keynote presentation about “The Tragedy of Systemd”.</li>
<li>Benedict went to the following talks:</li>
</ul>

<blockquote>
<p>“Automating Network Infrastructures with Ansible on FreeBSD” in the DevSummit track. A good talk that connected well with his Ansible tutorial and even allowed some discussions among participants.<br>
“All along the dwatch tower”: Devin delivered a well prepared talk. I first thought that the number of slides would not fit into the time slot, but she even managed to give a demo of her work, which was well received. The dwatch tool she wrote should make it easy for people to get started with DTrace without learning too much about the syntax at first. The visualizations were certainly nice to see, combining different tools together in a new way.<br>
ZFS BoF, lead by Allan and Matthew Ahrens<br>
SSH Key Management by Michael W. Lucas. Yet another great talk where I learned a lot. I did not get to the SSH CA chapter in the new SSH Mastery book, so this was a good way to wet my appetite for it and motivated me to look into creating one for the cluster that I’m managing.<br>
The rest of the day was spent at the FreeBSD Foundation table, talking to various folks. Then, Allan and I had an interview with Kirk McKusick for National FreeBSD Day, then we had a core meeting, followed by a core dinner.</p>
</blockquote>

<ul>
<li>Day 2:
<blockquote>
<p>“Flexible Disk Use in OpenZFS”: Matthew Ahrens talking about the feature he is implementing to expand a RAID-Z with a single disk, as well as device removal.<br>
Allan’s talk about his efforts to implement ZSTD in OpenZFS as another compression algorithm. I liked his overview slides with the numbers comparing the algorithms for their effectiveness and his personal story about the sometimes rocky road to get the feature implemented.<br>
“zrepl - ZFS replication” by Christian Schwarz, was well prepared and even had a demo to show what his snapshot replication tool can do. We covered it on the show before and people can find it under sysutils/zrepl. Feedback and help is welcome.<br>
“The Evolution of FreeBSD Governance” by Kirk McKusick was yet another great talk by him covering the early days of FreeBSD until today, detailing some of the progress and challenges the project faced over the years in terms of leadership and governance. This is an ongoing process that everyone in the community should participate in to keep the project healthy and infused with fresh blood.<br>
Closing session and auction were funny and great as always.<br>
All in all, yet another amazing BSDCan. Thank you Dan Langille and your organizing team for making it happen! Well done.</p>
</blockquote>
</li>
</ul>

<p><hr></p>

<p><strong>Digital Ocean</strong></p>

<p>###<a href="http://nomadbsd.org/index.html#rel1.1-rc1">NomadBSD 1.1-RC1 Released</a></p>

<blockquote>
<p>The first – and hopefully final – release candidate of NomadBSD 1.1 is available!</p>
</blockquote>

<ul>
<li>Changes</li>
<li>The base system has been upgraded to FreeBSD 11.2-RC3</li>
<li>EFI booting has been fixed.</li>
<li>Support for modern Intel GPUs has been added.</li>
<li>Support for installing packages has been added.</li>
<li>Improved setup menu.</li>
<li>More software packages:</li>
<li>benchmarks/bonnie++</li>
<li>DSBDisplaySettings</li>
<li>DSBExec</li>
<li>DSBSu</li>
<li>mail/thunderbird</li>
<li>net/mosh</li>
<li>ports-mgmt/octopkg</li>
<li>print/qpdfview</li>
<li>security/nmap</li>
<li>sysutils/ddrescue</li>
<li>sysutils/fusefs-hfsfuse</li>
<li>sysutils/fusefs-sshfs</li>
<li>sysutils/sleuthkit</li>
<li>www/lynx</li>
<li>x11-wm/compton</li>
<li>x11/xev</li>
<li>x11/xterm</li>
<li>Many improvements and bugfixes<br>
The image and instructions can be found <a href="http://nomadbsd.org/download.html">here</a>.</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://undeadly.org/cgi?action=article;sid=20180616115514">LDAP client added to -current</a></p>

<pre><code>CVSROOT:    /cvs
Module name:    src
Changes by: reyk@cvs.openbsd.org    2018/06/13 09:45:58

Log message:
    Import ldap(1), a simple ldap search client.
    We have an ldapd(8) server and ypldap in base, so it makes sense to
    have a simple LDAP client without depending on the OpenLDAP package.
    This tool can be used in an ssh(1) AuthorizedKeysCommand script.
    
    With feedback from many including millert@ schwarze@ gilles@ dlg@ jsing@
    
    OK deraadt@
    
    Status:
    
    Vendor Tag: reyk
    Release Tags:   ldap_20180613
    
    N src/usr.bin/ldap/Makefile
    N src/usr.bin/ldap/aldap.c
    N src/usr.bin/ldap/aldap.h
    N src/usr.bin/ldap/ber.c
    N src/usr.bin/ldap/ber.h
    N src/usr.bin/ldap/ldap.1
    N src/usr.bin/ldap/ldapclient.c
    N src/usr.bin/ldap/log.c
    N src/usr.bin/ldap/log.h
    
    No conflicts created by this import
</code></pre>

<p><hr></p>

<p>###<a href="https://undeadly.org/cgi?action=article;sid=20180614064341">Intel® FPU Speculation Vulnerability Confirmed</a></p>

<ul>
<li>Earlier this month, Philip Guenther (guenther@) <a href="https://marc.info/?l=openbsd-cvs&amp;m=152818076013158&amp;w=2">committed</a> (to amd64 -current) a change from lazy to semi-eager FPU switching to mitigate against rumored FPU state leakage in Intel® CPUs.</li>
<li>Theo de Raadt (deraadt@) discussed this in <a href="https://undeadly.org/cgi?action=article;sid=20180611101817">his BSDCan 2018 session</a>.</li>
<li>Using information disclosed in Theo’s talk, <a href="https://twitter.com/cperciva/status/1007010583244230656">Colin Percival</a> developed a proof-of-concept exploit in around 5 hours. This seems to have prompted an early end to an embargo (in which OpenBSD was not involved), and the <a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00145.html">official announcement</a> of the vulnerability.</li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=335072">FPU change in FreeBSD</a></li>
</ul>

<pre><code>Summary:

System software may utilize the Lazy FP state restore technique to delay the restoring of state until an instruction operating on that state is actually executed by the new process. Systems using Intel® Core-based microprocessors may potentially allow a local process to infer data utilizing Lazy FP state restore from another process through a speculative execution side channel.

Description:

System software may opt to utilize Lazy FP state restore instead of eager save and restore of the state upon a context switch. Lazy restored states are potentially vulnerable to exploits where one process may infer register values of other processes through a speculative execution side channel that infers their value.

    ·    CVSS - 4.3 Medium CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Affected Products:

Intel® Core-based microprocessors.

Recommendations:

If an XSAVE-enabled feature is disabled, then we recommend either its state component bitmap in the extended control register (XCR0) is set to 0 (e.g. XCR0[bit 2]=0 for AVX, XCR0[bits 7:5]=0 for AVX512) or the corresponding register states of the feature should be cleared prior to being disabled. Also for relevant states (e.g. x87, SSE, AVX, etc.), Intel recommends system software developers utilize Eager FP state restore in lieu of Lazy FP state restore.

Acknowledgements:

Intel would like to thank Julian Stecklina from Amazon Germany, Thomas Prescher from Cyberus Technology GmbH (https://www.cyberus-technology.de/), Zdenek Sojka from SYSGO AG (http://sysgo.com), and Colin Percival for reporting this issue and working with us on coordinated disclosure.
</code></pre>

<p><hr></p>

<p><strong>iXsystems</strong><br>
iX Ad Spot<br>
###<a href="https://www.ixsystems.com/blog/bsdcan-2018-recap/">iX Systems - BSDCan 2018 Recap</a></p>

<p>###<a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=335012">FreeBSD gets pNFS support</a></p>

<pre><code>Merge the pNFS server code from projects/pnfs-planb-server into head.

This code merge adds a pNFS service to the NFSv4.1 server. Although it is
a large commit it should not affect behaviour for a non-pNFS NFS server.
Some documentation on how this works can be found at:
Merge the pN http://people.freebsd.org/~rmacklem/pnfs-planb-setup.txt
and will hopefully be turned into a proper document soon.
This is a merge of the kernel code. Userland and man page changes will
come soon, once the dust settles on this merge.
It has passed a &quot;make universe&quot;, so I hope it will not cause build problems.
It also adds NFSv4.1 server support for the &quot;current stateid&quot;.

Here is a brief overview of the pNFS service:
A pNFS service separates the Read/Write operations from all the other NFSv4.1
Metadata operations. It is hoped that this separation allows a pNFS service
to be configured that exceeds the limits of a single NFS server for either
storage capacity and/or I/O bandwidth.
It is possible to configure mirroring within the data servers (DSs) so that
the data storage file for an MDS file will be mirrored on two or more of
the DSs.
When this is used, failure of a DS will not stop the pNFS service and a
failed DS can be recovered once repaired while the pNFS service continues
to operate.  Although two way mirroring would be the norm, it is possible
to set a mirroring level of up to four or the number of DSs, whichever is
less.
The Metadata server will always be a single point of failure,
just as a single NFS server is.

A Plan B pNFS service consists of a single MetaData Server (MDS) and K
Data Servers (DS), all of which are recent FreeBSD systems.
Clients will mount the MDS as they would a single NFS server.
When files are created, the MDS creates a file tree identical to what a
single NFS server creates, except that all the regular (VREG) files will
be empty. As such, if you look at the exported tree on the MDS directly
on the MDS server (not via an NFS mount), the files will all be of size 0.
Each of these files will also have two extended attributes in the system
attribute name space:
pnfsd.dsfile - This extended attrbute stores the information that
    the MDS needs to find the data storage file(s) on DS(s) for this file.
pnfsd.dsattr - This extended attribute stores the Size, AccessTime, ModifyTime
    and Change attributes for the file, so that the MDS doesn't need to
    acquire the attributes from the DS for every Getattr operation.
For each regular (VREG) file, the MDS creates a data storage file on one
(or more if mirroring is enabled) of the DSs in one of the &quot;dsNN&quot;
subdirectories.  The name of this file is the file handle
of the file on the MDS in hexadecimal so that the name is unique.
The DSs use subdirectories named &quot;ds0&quot; to &quot;dsN&quot; so that no one directory
gets too large. The value of &quot;N&quot; is set via the sysctl vfs.nfsd.dsdirsize
on the MDS, with the default being 20.
For production servers that will store a lot of files, this value should
probably be much larger.
It can be increased when the &quot;nfsd&quot; daemon is not running on the MDS,
once the &quot;dsK&quot; directories are created.

For pNFS aware NFSv4.1 clients, the FreeBSD server will return two pieces
of information to the client that allows it to do I/O directly to the DS.
DeviceInfo - This is relatively static information that defines what a DS
             is. The critical bits of information returned by the FreeBSD
             server is the IP address of the DS and, for the Flexible
             File layout, that NFSv4.1 is to be used and that it is
             &quot;tightly coupled&quot;.
             There is a &quot;deviceid&quot; which identifies the DeviceInfo.
Layout     - This is per file and can be recalled by the server when it
             is no longer valid. For the FreeBSD server, there is support
             for two types of layout, call File and Flexible File layout.
             Both allow the client to do I/O on the DS via NFSv4.1 I/O
             operations. The Flexible File layout is a more recent variant
             that allows specification of mirrors, where the client is
             expected to do writes to all mirrors to maintain them in a
             consistent state. The Flexible File layout also allows the
             client to report I/O errors for a DS back to the MDS.
             The Flexible File layout supports two variants referred to as
             &quot;tightly coupled&quot; vs &quot;loosely coupled&quot;. The FreeBSD server always
             uses the &quot;tightly coupled&quot; variant where the client uses the
             same credentials to do I/O on the DS as it would on the MDS.
             For the &quot;loosely coupled&quot; variant, the layout specifies a
             synthetic user/group that the client uses to do I/O on the DS.
             The FreeBSD server does not do striping and always returns
             layouts for the entire file. The critical information in a layout
             is Read vs Read/Writea and DeviceID(s) that identify which
             DS(s) the data is stored on.

At this time, the MDS generates File Layout layouts to NFSv4.1 clients
that know how to do pNFS for the non-mirrored DS case unless the sysctl
vfs.nfsd.default_flexfile is set non-zero, in which case Flexible File
layouts are generated.
The mirrored DS configuration always generates Flexible File layouts.
For NFS clients that do not support NFSv4.1 pNFS, all I/O operations
are done against the MDS which acts as a proxy for the appropriate DS(s).
When the MDS receives an I/O RPC, it will do the RPC on the DS as a proxy.
If the DS is on the same machine, the MDS/DS will do the RPC on the DS as
a proxy and so on, until the machine runs out of some resource, such as
session slots or mbufs.
As such, DSs must be separate systems from the MDS.

***

###[What does {some strange unix command name} stand for?](http://www.unixguide.net/unix/faq/1.3.shtml)

+ awk = &quot;Aho Weinberger and Kernighan&quot; 
+ grep = &quot;Global Regular Expression Print&quot; 
+ fgrep = &quot;Fixed GREP&quot;. 
+ egrep = &quot;Extended GREP&quot; 
+ cat = &quot;CATenate&quot; 
+ gecos = &quot;General Electric Comprehensive Operating Supervisor&quot; 
+ nroff = &quot;New ROFF&quot; 
+ troff = &quot;Typesetter new ROFF&quot; 
+ tee = T 
+ bss = &quot;Block Started by Symbol
+ biff = &quot;BIFF&quot; 
+ rc (as in &quot;.cshrc&quot; or &quot;/etc/rc&quot;) = &quot;RunCom&quot; 
+ Don Libes' book &quot;Life with Unix&quot; contains lots more of these 
tidbits. 
***

##Beastie Bits
+ [RetroBSD: Unix for microcontrollers](http://retrobsd.org/wiki/doku.php)
+ [On the matter of OpenBSD breaking embargos (KRACK)](https://marc.info/?l=openbsd-tech&amp;m=152910536208954&amp;w=2)
+ [Theo's Basement Computer Paradise (1998)](https://zeus.theos.com/deraadt/hosts.html)
+ [Airport Extreme runs NetBSD](https://jcs.org/2018/06/12/airport_ssh)
+ [What UNIX shell could have been](https://rain-1.github.io/shell-2.html)

***
Tarsnap ad
***

##Feedback/Questions
+ We need more feedback and questions. Please email feedback@bsdnow.tv 
+ Also, many of you owe us BSDCan trip reports! We have shared what our experience at BSDCan was like, but we want to hear about yours. What can we do better next year? What was it like being there for the first time?
+ [Jason writes in](https://slexy.org/view/s205jU58X2)
    + https://www.wheelsystems.com/en/products/wheel-fudo-psm/
+ [June 19th was National FreeBSD Day](https://twitter.com/search?src=typd&amp;q=%23FreeBSDDay)
***

- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)
***

</code></pre>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>DragonflyBSD’s hammer1 encrypted master/slave setup, second part of our BSDCan recap, NomadBSD 1.1-RC1 available, OpenBSD adds an LDAP client to base, FreeBSD gets pNFS support, Intel FPU Speculation Vulnerability confirmed, and what some Unix command names mean.</p>

<p>##Headlines<br>
###<a href="https://www.reddit.com/r/dragonflybsd/comments/8riwtx/towards_a_hammer1_masterslave_encrypted_setup/">DragonflyBSD: Towards a HAMMER1 master/slave encrypted setup with LUKS</a></p>

<blockquote>
<p>I just wanted to share my experience with setting up DragonFly master/slave HAMMER1 PFS’s on top of LUKS<br>
So after a long time using an Synology for my NFS needs, I decided it was time to rethink my setup a little since I had several issues with it :</p>
</blockquote>

<ul>
<li>You cannot run NFS on top of encrypted partitions easily</li>
<li>I suspect I am having some some data corruption (bitrot) on the ext4 filesystem</li>
<li>the NIC was stcuk to 100 Mbps instead of 1 Gbps even after swapping cables, switches, you name it</li>
<li>It’s proprietary</li>
</ul>

<blockquote>
<p>I have been playing with DragonFly in the past and knew about HAMMER, now I just had the perfect excuse to actually use it in production :) After setting up the OS, creating the LUKS partition and HAMMER FS was easy :</p>
</blockquote>

<p><code>kdload dm</code><br>
<code>cryptsetup luksFormat /dev/serno/&lt;id1&gt;</code><br>
<code>cryptsetup luksOpen /dev/serno/&lt;id1&gt; fort_knox</code><br>
<code>newfs_hammer -L hammer1_secure_master /dev/mapper/fort_knox</code><br>
<code>cryptsetup luksFormat /dev/serno/&lt;id2&gt;</code><br>
<code>cryptsetup luksOpen /dev/serno/&lt;id2&gt; fort_knox_slave</code><br>
<code>newfs_hammer -L hammer1_secure_slave /dev/mapper/fort_knox_slave</code></p>

<ul>
<li>Mount the 2 drives :</li>
</ul>

<p><code>mount /dev/mapper/fort_knox /fort_knox</code><br>
<code>mount /dev/mapper_fort_know_slave /fort_knox_slave</code></p>

<blockquote>
<p>You can now put your data under /fort_knox<br>
Now, off to setting up the replication, first get the shared-uuid of /fort_knox</p>
</blockquote>

<p><code>hammer pfs-status /fort_knox</code></p>

<blockquote>
<p>Create a PFS slave “linked” to the master</p>
</blockquote>

<p><code>hammer pfs-slave /fort_knox_slave/pfs/slave shared-uuid=f9e7cc0d-eb59-10e3-a5b5-01e6e7cefc12</code></p>

<blockquote>
<p>And then stream your data to the slave PFS !</p>
</blockquote>

<p><code>hammer mirror-stream /fort_knox /fort_knox_slave/pfs/slave</code></p>

<blockquote>
<p>After that, setting NFS is fairly trivial even though I had problem with the /etc/exports syntax which is different than Linux</p>
</blockquote>

<blockquote>
<p>There’s a few things I wish would be better though but nothing too problematic or without workarounds :</p>
</blockquote>

<ul>
<li>Cannot unlock LUKS partitions at boot time afaik (Acceptable tradeoff for the added security LUKS gives me vs my old Synology setup) but this force me to run a script to unlock LUKS, mount hammer and start mirror-stream at each boot</li>
<li>No S1/S3 sleep so I made a script to shutdown the system when there’s no network neighborgs to serve the NFS</li>
<li>As my system isn’t online 24/7 for energy reasons, I guess will have to run hammer cleanup myself from time to time</li>
<li>Some uncertainty because hey, it’s kind of exotic but exciting too :)</li>
</ul>

<blockquote>
<p>Overall, I am happy, HAMMER1 and PFS are looking really good, DragonFly is a neat Unix and the community is super friendly (Matthew Dillon actually provided me with a kernel patch to fix the broken ACPI on the PC holding this setup, many thanks!), the system is still a “work in progress” but it is already serving my files as I write this post.</p>
</blockquote>

<blockquote>
<p>Let’s see in 6 months how it goes in the longer run !</p>
</blockquote>

<ul>
<li>Helpful resources : <a href="https://www.dragonflybsd.org/docs/how_to_implement_hammer_pseudo_file_system__40___pfs___41___slave_mirroring_from_pfs_master/">https://www.dragonflybsd.org/docs/how_to_implement_hammer_pseudo_file_system__40___pfs___41___slave_mirroring_from_pfs_master/</a></li>
</ul>

<p><hr></p>

<p>###BSDCan 2018 Recap</p>

<ul>
<li>As promised, here is our second part of our BSDCan report, covering the conference proper. The last tutorials/devsummit of that day lead directly into the conference, as people could pick up their registration packs at the Red Lion and have a drink with fellow BSD folks.</li>
<li>Allan and I were there only briefly, as we wanted to get back to the “Newcomers orientation and mentorship” session lead by Michael W. Lucas. This session is intended for people that are new to BSDCan (maybe their first BSD conference ever?) and may have questions. Michael explained everything from the 6-2-1 rule (hours of sleep, meals per day, and number of showers that attendees should have at a minimum), to the partner and widowers program (lead by his wife Liz), to the sessions that people should not miss (opening, closing, and hallway track). Old-time BSDCan folks were asked to stand up so that people can recognize them and ask them any questions they might have during the conferences. The session was well attended. Afterwards, people went for dinner in groups, a big one lead by Michael Lucas to his favorite Shawarma place, followed by gelato (of course). This allowed newbies to mingle over dinner and ice cream, creating a welcoming atmosphere.</li>
<li>The next day, after Dan Langille opened the conference, Benno Rice gave the keynote presentation about “The Tragedy of Systemd”.</li>
<li>Benedict went to the following talks:</li>
</ul>

<blockquote>
<p>“Automating Network Infrastructures with Ansible on FreeBSD” in the DevSummit track. A good talk that connected well with his Ansible tutorial and even allowed some discussions among participants.<br>
“All along the dwatch tower”: Devin delivered a well prepared talk. I first thought that the number of slides would not fit into the time slot, but she even managed to give a demo of her work, which was well received. The dwatch tool she wrote should make it easy for people to get started with DTrace without learning too much about the syntax at first. The visualizations were certainly nice to see, combining different tools together in a new way.<br>
ZFS BoF, lead by Allan and Matthew Ahrens<br>
SSH Key Management by Michael W. Lucas. Yet another great talk where I learned a lot. I did not get to the SSH CA chapter in the new SSH Mastery book, so this was a good way to wet my appetite for it and motivated me to look into creating one for the cluster that I’m managing.<br>
The rest of the day was spent at the FreeBSD Foundation table, talking to various folks. Then, Allan and I had an interview with Kirk McKusick for National FreeBSD Day, then we had a core meeting, followed by a core dinner.</p>
</blockquote>

<ul>
<li>Day 2:
<blockquote>
<p>“Flexible Disk Use in OpenZFS”: Matthew Ahrens talking about the feature he is implementing to expand a RAID-Z with a single disk, as well as device removal.<br>
Allan’s talk about his efforts to implement ZSTD in OpenZFS as another compression algorithm. I liked his overview slides with the numbers comparing the algorithms for their effectiveness and his personal story about the sometimes rocky road to get the feature implemented.<br>
“zrepl - ZFS replication” by Christian Schwarz, was well prepared and even had a demo to show what his snapshot replication tool can do. We covered it on the show before and people can find it under sysutils/zrepl. Feedback and help is welcome.<br>
“The Evolution of FreeBSD Governance” by Kirk McKusick was yet another great talk by him covering the early days of FreeBSD until today, detailing some of the progress and challenges the project faced over the years in terms of leadership and governance. This is an ongoing process that everyone in the community should participate in to keep the project healthy and infused with fresh blood.<br>
Closing session and auction were funny and great as always.<br>
All in all, yet another amazing BSDCan. Thank you Dan Langille and your organizing team for making it happen! Well done.</p>
</blockquote>
</li>
</ul>

<p><hr></p>

<p><strong>Digital Ocean</strong></p>

<p>###<a href="http://nomadbsd.org/index.html#rel1.1-rc1">NomadBSD 1.1-RC1 Released</a></p>

<blockquote>
<p>The first – and hopefully final – release candidate of NomadBSD 1.1 is available!</p>
</blockquote>

<ul>
<li>Changes</li>
<li>The base system has been upgraded to FreeBSD 11.2-RC3</li>
<li>EFI booting has been fixed.</li>
<li>Support for modern Intel GPUs has been added.</li>
<li>Support for installing packages has been added.</li>
<li>Improved setup menu.</li>
<li>More software packages:</li>
<li>benchmarks/bonnie++</li>
<li>DSBDisplaySettings</li>
<li>DSBExec</li>
<li>DSBSu</li>
<li>mail/thunderbird</li>
<li>net/mosh</li>
<li>ports-mgmt/octopkg</li>
<li>print/qpdfview</li>
<li>security/nmap</li>
<li>sysutils/ddrescue</li>
<li>sysutils/fusefs-hfsfuse</li>
<li>sysutils/fusefs-sshfs</li>
<li>sysutils/sleuthkit</li>
<li>www/lynx</li>
<li>x11-wm/compton</li>
<li>x11/xev</li>
<li>x11/xterm</li>
<li>Many improvements and bugfixes<br>
The image and instructions can be found <a href="http://nomadbsd.org/download.html">here</a>.</li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://undeadly.org/cgi?action=article;sid=20180616115514">LDAP client added to -current</a></p>

<pre><code>CVSROOT:    /cvs
Module name:    src
Changes by: reyk@cvs.openbsd.org    2018/06/13 09:45:58

Log message:
    Import ldap(1), a simple ldap search client.
    We have an ldapd(8) server and ypldap in base, so it makes sense to
    have a simple LDAP client without depending on the OpenLDAP package.
    This tool can be used in an ssh(1) AuthorizedKeysCommand script.
    
    With feedback from many including millert@ schwarze@ gilles@ dlg@ jsing@
    
    OK deraadt@
    
    Status:
    
    Vendor Tag: reyk
    Release Tags:   ldap_20180613
    
    N src/usr.bin/ldap/Makefile
    N src/usr.bin/ldap/aldap.c
    N src/usr.bin/ldap/aldap.h
    N src/usr.bin/ldap/ber.c
    N src/usr.bin/ldap/ber.h
    N src/usr.bin/ldap/ldap.1
    N src/usr.bin/ldap/ldapclient.c
    N src/usr.bin/ldap/log.c
    N src/usr.bin/ldap/log.h
    
    No conflicts created by this import
</code></pre>

<p><hr></p>

<p>###<a href="https://undeadly.org/cgi?action=article;sid=20180614064341">Intel® FPU Speculation Vulnerability Confirmed</a></p>

<ul>
<li>Earlier this month, Philip Guenther (guenther@) <a href="https://marc.info/?l=openbsd-cvs&amp;m=152818076013158&amp;w=2">committed</a> (to amd64 -current) a change from lazy to semi-eager FPU switching to mitigate against rumored FPU state leakage in Intel® CPUs.</li>
<li>Theo de Raadt (deraadt@) discussed this in <a href="https://undeadly.org/cgi?action=article;sid=20180611101817">his BSDCan 2018 session</a>.</li>
<li>Using information disclosed in Theo’s talk, <a href="https://twitter.com/cperciva/status/1007010583244230656">Colin Percival</a> developed a proof-of-concept exploit in around 5 hours. This seems to have prompted an early end to an embargo (in which OpenBSD was not involved), and the <a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00145.html">official announcement</a> of the vulnerability.</li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=335072">FPU change in FreeBSD</a></li>
</ul>

<pre><code>Summary:

System software may utilize the Lazy FP state restore technique to delay the restoring of state until an instruction operating on that state is actually executed by the new process. Systems using Intel® Core-based microprocessors may potentially allow a local process to infer data utilizing Lazy FP state restore from another process through a speculative execution side channel.

Description:

System software may opt to utilize Lazy FP state restore instead of eager save and restore of the state upon a context switch. Lazy restored states are potentially vulnerable to exploits where one process may infer register values of other processes through a speculative execution side channel that infers their value.

    ·    CVSS - 4.3 Medium CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Affected Products:

Intel® Core-based microprocessors.

Recommendations:

If an XSAVE-enabled feature is disabled, then we recommend either its state component bitmap in the extended control register (XCR0) is set to 0 (e.g. XCR0[bit 2]=0 for AVX, XCR0[bits 7:5]=0 for AVX512) or the corresponding register states of the feature should be cleared prior to being disabled. Also for relevant states (e.g. x87, SSE, AVX, etc.), Intel recommends system software developers utilize Eager FP state restore in lieu of Lazy FP state restore.

Acknowledgements:

Intel would like to thank Julian Stecklina from Amazon Germany, Thomas Prescher from Cyberus Technology GmbH (https://www.cyberus-technology.de/), Zdenek Sojka from SYSGO AG (http://sysgo.com), and Colin Percival for reporting this issue and working with us on coordinated disclosure.
</code></pre>

<p><hr></p>

<p><strong>iXsystems</strong><br>
iX Ad Spot<br>
###<a href="https://www.ixsystems.com/blog/bsdcan-2018-recap/">iX Systems - BSDCan 2018 Recap</a></p>

<p>###<a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=335012">FreeBSD gets pNFS support</a></p>

<pre><code>Merge the pNFS server code from projects/pnfs-planb-server into head.

This code merge adds a pNFS service to the NFSv4.1 server. Although it is
a large commit it should not affect behaviour for a non-pNFS NFS server.
Some documentation on how this works can be found at:
Merge the pN http://people.freebsd.org/~rmacklem/pnfs-planb-setup.txt
and will hopefully be turned into a proper document soon.
This is a merge of the kernel code. Userland and man page changes will
come soon, once the dust settles on this merge.
It has passed a &quot;make universe&quot;, so I hope it will not cause build problems.
It also adds NFSv4.1 server support for the &quot;current stateid&quot;.

Here is a brief overview of the pNFS service:
A pNFS service separates the Read/Write operations from all the other NFSv4.1
Metadata operations. It is hoped that this separation allows a pNFS service
to be configured that exceeds the limits of a single NFS server for either
storage capacity and/or I/O bandwidth.
It is possible to configure mirroring within the data servers (DSs) so that
the data storage file for an MDS file will be mirrored on two or more of
the DSs.
When this is used, failure of a DS will not stop the pNFS service and a
failed DS can be recovered once repaired while the pNFS service continues
to operate.  Although two way mirroring would be the norm, it is possible
to set a mirroring level of up to four or the number of DSs, whichever is
less.
The Metadata server will always be a single point of failure,
just as a single NFS server is.

A Plan B pNFS service consists of a single MetaData Server (MDS) and K
Data Servers (DS), all of which are recent FreeBSD systems.
Clients will mount the MDS as they would a single NFS server.
When files are created, the MDS creates a file tree identical to what a
single NFS server creates, except that all the regular (VREG) files will
be empty. As such, if you look at the exported tree on the MDS directly
on the MDS server (not via an NFS mount), the files will all be of size 0.
Each of these files will also have two extended attributes in the system
attribute name space:
pnfsd.dsfile - This extended attrbute stores the information that
    the MDS needs to find the data storage file(s) on DS(s) for this file.
pnfsd.dsattr - This extended attribute stores the Size, AccessTime, ModifyTime
    and Change attributes for the file, so that the MDS doesn't need to
    acquire the attributes from the DS for every Getattr operation.
For each regular (VREG) file, the MDS creates a data storage file on one
(or more if mirroring is enabled) of the DSs in one of the &quot;dsNN&quot;
subdirectories.  The name of this file is the file handle
of the file on the MDS in hexadecimal so that the name is unique.
The DSs use subdirectories named &quot;ds0&quot; to &quot;dsN&quot; so that no one directory
gets too large. The value of &quot;N&quot; is set via the sysctl vfs.nfsd.dsdirsize
on the MDS, with the default being 20.
For production servers that will store a lot of files, this value should
probably be much larger.
It can be increased when the &quot;nfsd&quot; daemon is not running on the MDS,
once the &quot;dsK&quot; directories are created.

For pNFS aware NFSv4.1 clients, the FreeBSD server will return two pieces
of information to the client that allows it to do I/O directly to the DS.
DeviceInfo - This is relatively static information that defines what a DS
             is. The critical bits of information returned by the FreeBSD
             server is the IP address of the DS and, for the Flexible
             File layout, that NFSv4.1 is to be used and that it is
             &quot;tightly coupled&quot;.
             There is a &quot;deviceid&quot; which identifies the DeviceInfo.
Layout     - This is per file and can be recalled by the server when it
             is no longer valid. For the FreeBSD server, there is support
             for two types of layout, call File and Flexible File layout.
             Both allow the client to do I/O on the DS via NFSv4.1 I/O
             operations. The Flexible File layout is a more recent variant
             that allows specification of mirrors, where the client is
             expected to do writes to all mirrors to maintain them in a
             consistent state. The Flexible File layout also allows the
             client to report I/O errors for a DS back to the MDS.
             The Flexible File layout supports two variants referred to as
             &quot;tightly coupled&quot; vs &quot;loosely coupled&quot;. The FreeBSD server always
             uses the &quot;tightly coupled&quot; variant where the client uses the
             same credentials to do I/O on the DS as it would on the MDS.
             For the &quot;loosely coupled&quot; variant, the layout specifies a
             synthetic user/group that the client uses to do I/O on the DS.
             The FreeBSD server does not do striping and always returns
             layouts for the entire file. The critical information in a layout
             is Read vs Read/Writea and DeviceID(s) that identify which
             DS(s) the data is stored on.

At this time, the MDS generates File Layout layouts to NFSv4.1 clients
that know how to do pNFS for the non-mirrored DS case unless the sysctl
vfs.nfsd.default_flexfile is set non-zero, in which case Flexible File
layouts are generated.
The mirrored DS configuration always generates Flexible File layouts.
For NFS clients that do not support NFSv4.1 pNFS, all I/O operations
are done against the MDS which acts as a proxy for the appropriate DS(s).
When the MDS receives an I/O RPC, it will do the RPC on the DS as a proxy.
If the DS is on the same machine, the MDS/DS will do the RPC on the DS as
a proxy and so on, until the machine runs out of some resource, such as
session slots or mbufs.
As such, DSs must be separate systems from the MDS.

***

###[What does {some strange unix command name} stand for?](http://www.unixguide.net/unix/faq/1.3.shtml)

+ awk = &quot;Aho Weinberger and Kernighan&quot; 
+ grep = &quot;Global Regular Expression Print&quot; 
+ fgrep = &quot;Fixed GREP&quot;. 
+ egrep = &quot;Extended GREP&quot; 
+ cat = &quot;CATenate&quot; 
+ gecos = &quot;General Electric Comprehensive Operating Supervisor&quot; 
+ nroff = &quot;New ROFF&quot; 
+ troff = &quot;Typesetter new ROFF&quot; 
+ tee = T 
+ bss = &quot;Block Started by Symbol
+ biff = &quot;BIFF&quot; 
+ rc (as in &quot;.cshrc&quot; or &quot;/etc/rc&quot;) = &quot;RunCom&quot; 
+ Don Libes' book &quot;Life with Unix&quot; contains lots more of these 
tidbits. 
***

##Beastie Bits
+ [RetroBSD: Unix for microcontrollers](http://retrobsd.org/wiki/doku.php)
+ [On the matter of OpenBSD breaking embargos (KRACK)](https://marc.info/?l=openbsd-tech&amp;m=152910536208954&amp;w=2)
+ [Theo's Basement Computer Paradise (1998)](https://zeus.theos.com/deraadt/hosts.html)
+ [Airport Extreme runs NetBSD](https://jcs.org/2018/06/12/airport_ssh)
+ [What UNIX shell could have been](https://rain-1.github.io/shell-2.html)

***
Tarsnap ad
***

##Feedback/Questions
+ We need more feedback and questions. Please email feedback@bsdnow.tv 
+ Also, many of you owe us BSDCan trip reports! We have shared what our experience at BSDCan was like, but we want to hear about yours. What can we do better next year? What was it like being there for the first time?
+ [Jason writes in](https://slexy.org/view/s205jU58X2)
    + https://www.wheelsystems.com/en/products/wheel-fudo-psm/
+ [June 19th was National FreeBSD Day](https://twitter.com/search?src=typd&amp;q=%23FreeBSDDay)
***

- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)
***

</code></pre>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 250: BSDCan 2018 Recap | BSD Now 250</title>
  <link>https://www.bsdnow.tv/250</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2107</guid>
  <pubDate>Thu, 14 Jun 2018 07:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4a856940-c133-4d38-98e6-88d80a82c29a.mp3" length="60891452" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>TrueOS becoming a downstream fork with Trident, our BSDCan 2018 recap, HardenedBSD Foundation founding efforts, VPN with OpenIKED on OpenBSD, FreeBSD on a System76 Galago Pro, and hardware accelerated crypto on Octeons.</itunes:subtitle>
  <itunes:duration>1:41:10</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>TrueOS becoming a downstream fork with Trident, our BSDCan 2018 recap, HardenedBSD Foundation founding efforts, VPN with OpenIKED on OpenBSD, FreeBSD on a System76 Galago Pro, and hardware accelerated crypto on Octeons.
&lt;p&gt;##Headlines##&lt;br&gt;
&lt;a href="https://www.trueos.org/blog/trueosdownstream/"&gt;TrueOS to Focus on Core Operating System&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;The TrueOS Project has some big plans in the works, and we want to take a minute and share them with you. Many have come to know TrueOS as the “graphical FreeBSD” that makes things easy for newcomers to the BSDs. Today we’re announcing that TrueOS is shifting our focus a bit to become a cutting-edge operating system that keeps all of the stability that you know and love from ZFS (OpenZFS) and FreeBSD, and adds additional features to create a fresh, innovative operating system. Our goal is to create a core-centric operating system that is modular, functional, and perfect for do-it-yourselfers and advanced users alike.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;TrueOS will become a downstream fork that will build on FreeBSD by integrating new software technologies like OpenRC and LibreSSL. Work has already begun which allows TrueOS to be used as a base platform for other projects, including JSON-based manifests, integrated Poudriere / pkg tools and much more. We’re planning on a six month release cycle to keep development moving and fresh, allowing us to bring you hot new features to ZFS, bhyve and related tools in a timely manner. This makes TrueOS the perfect fit to serve as the basis for building other distributions.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Some of you are probably asking yourselves “But what if I want to have a graphical desktop?” Don’t worry! We’re making sure that everyone who knows and loves the legacy desktop version of TrueOS will be able to continue using a FreeBSD-based, graphical operating system in the future. For instance, if you want to add KDE, just use sudo pkg install kde and voila! You have your new shiny desktop. Easy right? This allows us to get back to our roots of being a desktop agnostic operating system. If you want to add a new desktop environment, you get to pick the one that best suits your use.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;We know that some of you will still be looking for an out-of-the-box solution similar to legacy PC-BSD and TrueOS. We’re happy to announce that Project Trident will take over graphical FreeBSD development going forward. Not much is going to change in that regard other than a new name! You’ll still have Lumina Desktop as a lightweight and feature-rich desktop environment and tons of utilities from the legacy TrueOS toolchain like sysadm and AppCafe. There will be migration paths available for those that would like to move to other FreeBSD-based distributions like Project Trident or GhostBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;We look forward to this new chapter for TrueOS and hope you will give the new edition a spin! Tell us what you think about the new changes by leaving us a comment. Don’t forget you can ask us questions on our Twitter and be a part of our community by joining the new TrueOS Forums when they go live in about a week. Thanks for being a loyal fan of TrueOS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;###&lt;a href="http://project-trident.org/faq"&gt;Project Trident FAQ&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Q: Why did you pick the name “Project Trident”?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A: We were looking for a name that was unique, yet would still relate to the BSD community. Since Beastie (the FreeBSD mascot) is always pictured with a trident, it felt like that would be a great name.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Q: Where can users go for technical support?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A: At the moment, Project Trident will continue sharing the TrueOS community forums and Telegram channels. We are currently evaluating dedicated options for support channels in the future.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Q: Can I help contribute to the project?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A: We are always looking for developers who want to join the project. If you’re not a developer you can still help, as a community project we will be more reliant on contributions from the community in the form of how-to guides and other user-centric documentation and support systems.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Q: How is the project supported financially?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A: Project Trident is sponsored by the community, from both individuals and corporations. iXsystems has stepped up as the first enterprise-level sponsor of the project, and has been instrumental in getting Project Trident up and running. Please visit the Sponsors page to see all the current sponsors.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Q: How can I help support the project financially?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A: Several methods exist, from one time or recurring donations via Paypal to limited time swag t-shirt campaigns during the year. We are also looking into more alternative methods of support, so please visit the Sponsors page to see all the current methods of sponsorship.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Q: Will there be any transparency of the financial donations and expenditures?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A: Yes, we will be totally open with how much money comes into the project and what it is spent on. Due to concerns of privacy, we will not identify individuals and their donation amounts unless they specifically request to be identified. We will release a monthly overview in/out ledger, so that community members can see where their money is going.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Relationship with TrueOS&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Project Trident does have very close ties to the TrueOS project, since most of the original Project Trident developers were once part of the TrueOS project before it became a distribution platform. For users of the TrueOS desktop, we have some additional questions and answers below.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Q: Do we need to be at a certain TrueOS install level/release to upgrade?&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A: As long as you have a TrueOS system which has been updated to at least the 18.03 release you should be able to just perform a system update to be automatically upgraded to Project Trident.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Q: Which members moved from TrueOS to Project Trident?&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A: Project Trident is being led by prior members of the TrueOS desktop team. Ken and JT (development), Tim (documentation) and Rod (Community/Support). Since Project Trident is a community-first project, we look forward to working with new members of the team.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://www.bsdcan.org/2018"&gt;BSDCan&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;BSDCan finished Saturday last week&lt;/li&gt;
&lt;li&gt;It started with the GoatBoF on Tuesday at the Royal Oak Pub, where people had a chance to meet and greet. Benedict could not attend due to an all-day FreeBSD Foundation meeting and and even FreeBSD Journal Editorial Board meeting.&lt;/li&gt;
&lt;li&gt;The FreeBSD devsummit was held the next two days in parallel to the tutorials. Gordon Tetlow, who organized the devsummit, opened the devsummit. Deb Goodkin from the FreeBSD Foundation gave the first talk with a Foundation update, highlighting current and future efforts. Li-Wen Hsu is now employed by the Foundation to assist in QA work (Jenkins, CI/CD) and Gordon Tetlow has a part-time contract to help secteam as their secretary.&lt;/li&gt;
&lt;li&gt;Next, the FreeBSD core team (among them Allan and Benedict) gave a talk about what has happened this last term. With a core election currently running, some of these items will carry over to the next core team, but there were also some finished ones like the FCP process and FreeBSD members initiative. People in the audience asked questions on various topics of interest.&lt;/li&gt;
&lt;li&gt;After the coffee break, the release engineering team gave a talk about their efforts in terms of making releases happen in time and good quality.&lt;/li&gt;
&lt;li&gt;Benedict had to give his Ansible tutorial in the afternoon, which had roughly 15 people attending. Most of them beginners, we could get some good discussions going and I also learned a few new tricks. The overall feedback was positive and one even asked what I’m going to teach next year.&lt;/li&gt;
&lt;li&gt;The second day of the FreeBSD devsummit began with Gordon Tetlow giving an insight into the FreeBSD Security team (aka secteam). He gave a overview of secteam members and responsibilities, explaining the process based on a long past advisory. Developers were encouraged to help out secteam. NDAs and proper disclosure of vulnerabilities were also discussed, and the audience had some feedback and questions.&lt;/li&gt;
&lt;li&gt;When the coffee break was over, the FreeBSD 12.0 planning session happened. A &lt;a href="https://wiki.freebsd.org/DevSummit/201806/HaveNeedWant12"&gt;Google doc&lt;/a&gt; served as a collaborative way of gathering features and things left to do. People signed up for it or were volunteered. Some features won’t make it into 12.0 as they are not 100% ready for prime time and need a few more rounds of testing and bugfixing. Still, 12.0 will have some compelling features.&lt;/li&gt;
&lt;li&gt;
&lt;a href="https://theta360.com/s/xuR4ogsjGmu584JJju0vUaTA"&gt;A 360° group picture&lt;/a&gt; was taken after lunch, and then people split up into the working groups for the afternoon or started hacking in the UofO Henderson residence.&lt;/li&gt;
&lt;li&gt;Benedict and Allan both attended the OpenZFS working group, lead by Matt Ahrens. He presented the completed and outstanding work in FreeBSD, without spoiling too much of the ZFS presentations of various people that happened later at the conference.&lt;/li&gt;
&lt;li&gt;Benedict joined the boot code session a bit late (hallway track is the reason) when most things seem to have already been discussed.&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.talegraph.com/tales/WmObSRejzT"&gt;BSDCan 2018 — Ottawa (In Pictures)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://photos.google.com/share/AF1QipPv_eOz9z-e8R23DkSEcMLF9ivl8est0H4k0lkAoIdY0Jgsn4eyKT54fPyy4EukCw?key=RmJoNS1uOHU2djRDdzZxNGM4ZEY1dFVKamhCNThR"&gt;iXsystems Photos from BSDCan 2018&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="https://hardenedbsd.org/article/shawn-webb/2018-06-09/june-hardenedbsd-foundation-update"&gt;June HardenedBSD Foundation Update&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;We at HardenedBSD are working towards starting up a 501©(3) not-for-profit organization in the USA. Setting up this organization will allow future donations to be tax deductible. We’ve made progress and would like to share with you the current state of affairs.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;We have identified, sent invitations out, and received acceptance letters from six people who will serve on the HardenedBSD Foundation Board of Directors. You can find their bios below. In the latter half of June 2018 or the beginning half of July 2018, we will meet for the first time as a board and formally begin the process of creating the documentation needed to submit to the local, state, and federal tax services.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Here’s a brief introduction to those who will serve on the board:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;W. Dean Freeman (Advisor): Dean has ten years of professional experience with deploying and security Unix and networking systems, including assessing systems security for government certification and assessing the efficacy of security products. He was introduced to Unix via FreeBSD 2.2.8 on an ISP shell account as a teenager. Formerly, he was the Snort port maintainer for FreeBSD while working in the Sourcefire VRT, and has contributed entropy-related patches to the FreeBSD and HardenedBSD projects – a topic on which he presented at vBSDCon 2017.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Ben La Monica (Advisor): Ben is a Senior Technology Manager of Software Engineering at Morningstar, Inc and has been developing software for over 15 years in a variety of languages. He advocates open source software and enjoys tinkering with electronics and home automation.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;George Saylor (Advisor): George is a Technical Directory at G2, Inc. Mr. Saylor has over 28 years of information systems and security experience in a broad range of disciplines. His core focus areas are automation and standards in the event correlation space as well as penetration and exploitation of computer systems. Mr Saylor was also a co-founder of the OpenSCAP project.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Virginia Suydan (Accountant and general administrator): Accountant and general administrator for the HardenedBSD Foundation. She has worked with Shawn Webb for tax and accounting purposes for over six years.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Shawn Webb (Director): Co-founder of HardenedBSD and all-around infosec wonk. He has worked and played in the infosec industry, doing both offensive and defensive research, for around fifteen years. He loves open source technologies and likes to frustrate the bad guys.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Ben Welch (Advisor): Ben is currently a Security Engineer at G2, Inc. He graduated from Pennsylvania College of Technology with a Bachelors in Information Assurance and Security. Ben likes long walks, beaches, candlelight dinners, and attending various conferences like BSides and ShmooCon.&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://medium.com/@cmacrae/your-own-vpn-with-openiked-openbsd-13d7abd3d1d4"&gt;Your own VPN with OpenIKED &amp;amp; OpenBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Remote connectivity to your home network is something I think a lot of people find desirable. Over the years, I’ve just established an SSH tunnel and use it as a SOCKS proxy, sending my traffic through that. It’s a nice solution for a “poor man’s VPN”, but it can be a bit clunky, and it’s not great having to expose SSH to the world, even if you make sure to lock everything down &lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I set out the other day to finally do it properly. I’d come across this great post by Gordon Turner: &lt;a href="https://blog.gordonturner.com/2018/02/25/openbsd-6-2-vpn-endpoint-for-ios-and-macos/"&gt;OpenBSD 6.2 VPN Endpoint for iOS and macOS&lt;/a&gt;&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Whilst it was exactly what I was looking for, it outlined how to set up an L2TP VPN. Really, I wanted IKEv2 for performance and security reasons (I won’t elaborate on this here, if you’re curious about the differences, there’s a lot of content out on the web explaining this).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The client systems I’d be using have native support for IKEv2 (iOS, macOS, other BSD systems). But, I couldn’t find any tutorials in the same vein.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;So, let’s get stuck in!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;A quick note ✍️&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;This guide will walk through the set up of an IKEv2 VPN using OpenIKED on OpenBSD. It will detail a “road warrior” configuration, and use a PSK (pre-shared-key) for authentication. I’m sure it can be easily adapted to work on any other platforms that OpenIKED is available on, but keep in mind my steps are specifically for OpenBSD.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Server Configuration&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;As with all my home infrastructure, I crafted this set-up declaratively. So, I had the deployment of the VM setup in Terraform (deployed on my private Triton cluster), and wrote the configuration in Ansible, then tied them together using radekg/terraform-provisioner-ansible.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;One of the reasons I love Ansible is that its syntax is very simplistic, yet expressive. As such, I feel it fits very well into explaining these steps with snippets of the playbook I wrote.  I’ll link the full playbook a bit further down for those interested.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;See the full article for the information on:&lt;/li&gt;
&lt;li&gt;sysctl parameters&lt;/li&gt;
&lt;li&gt;The naughty list (optional)&lt;/li&gt;
&lt;li&gt;Configure the VPN network interface&lt;/li&gt;
&lt;li&gt;Configure the firewall&lt;/li&gt;
&lt;li&gt;Configure the iked service&lt;/li&gt;
&lt;li&gt;Gateway configuration&lt;/li&gt;
&lt;li&gt;Client configuration&lt;/li&gt;
&lt;li&gt;Troubleshooting&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;DigitalOcean&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://corrupted.io/2018/05/15/system76-free-bsd.html"&gt;FreeBSD on a System76 Galago Pro&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Hey all, It’s been a while since I last posted but I thought I would hammer something out here. My most recent purchase was a System76 Galago Pro. I thought, afer playing with POP! OS a bit, is there any reason I couldn’t get BSD on this thing. Turns out the answer is no, no there isnt and it works pretty decently.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;To get some accounting stuff out of the way I tested this all on FreeBSD Head and 11.1, and all of it is valid as of May 10, 2018. Head is a fast moving target so some of this is only bound to improve.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;The hardware&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Intel Core i5 Gen 8&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;UHD Graphics 620&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;16 GB DDR4 Ram&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;RTL8411B PCI Express Card Reader&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;RTL8111 Gigabit ethernet controller&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Intel HD Audio&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Samsung SSD 960 PRO 512GB NVMe&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;The caveats&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;There are a few things that I cant seem to make work straight out of the box, and that is the SD Card reader, the backlight, and the audio is a bit finicky. Also the trackpad doesn’t respond to two finger scrolling. The wiki is mostly up to date, there are a few edits that need to be made still but there is a bug where I cant register an account yet so I haven’t made all the changes.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Processor&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;It works like any other Intel processor. Pstates and throttling work.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Graphics&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The boot menu sets itself to what looks like 1024x768, but works as you expect in a tiny window. The text console does the full 3200x1800 resolution, but the text is ultra tiny. There isnt a font for the console that covers hidpi screens yet. As for X Windows it requres the drm-kmod-next package. Once installed follow the directions from the package and it works with almost no fuss. I have it running on X with full intel acceleration, but it is running at it’s full 3200x1800 resolution, to scale that down just do xrandr --output eDP-1 --scale 0.5x0.5 it will blow it up to roughly 200%. Due to limitations with X windows and hidpi it is harder to get more granular.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Intel Wireless 8265&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The wireless uses the iwm module, as of right now it does not seem to automagically load right now. Adding iwm_load=“YES” will cause the module to load on boot and kldload iwm&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Battery&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I seem to be getting about 5 hours out of the battery, but everything reports out of the box as expected. I could get more by throttling the CPU down speed wise.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Overall impression&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;It is a pretty decent experience. While not as polished as a Thinkpad there is a lot of potential with a bit of work and polishing. The laptop itself is not bad, the keyboard is responsive. The build quality is pretty solid. My only real complaint is the trackpad is stiff to click and sort of tiny. They seem to be a bit indifferent to non linux OSes running on the gear but that isnt anything new. I wont have any problems using it and is enough that when I work through this laptop, but I’m not sure at this stage if my next machine will be a System76 laptop, but they have impressed me enough to put them in the running when I go to look for my next portable machine but it hasn’t yet replaced the hole left in my heart by lenovo messing with the thinkpad.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://undeadly.org/cgi?action=article;sid=20180418073437"&gt;Hardware accelerated AES/HMAC-SHA on octeons&lt;/a&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;In this commit, visa@ submitted code (disabled for now) to use built-in acceleration on octeon CPUs, much like AESNI for x86s.
I decided to test tcpbench(1) and IPsec, before and after updating and enabling the octcrypto(4) driver.
I didn't capture detailed perf stats from before the update, I had heard someone say that Edgerouter Lite boxes would only do some 6MBit/s over ipsec, so I set up a really simple ipsec.conf with ike esp from A to B leading to a policy of
esp tunnel from A to B spi 0xdeadbeef auth hmac-sha2-256 enc aes
going from one ERL to another (I collect octeons, so I have a bunch to test with) and let tcpbench run for a while on it. My numbers hovered around 7Mbit/s, which coincided with what I've heard, and also that most of the CPU gets used while doing it.
Then I edited /sys/arch/octeon/conf/GENERIC, removed the # from octcrypto0 at mainbus0 and recompiled. Booted into the new kernel and got a octcrypto0 line in dmesg, and it was time to rock the ipsec tunnel again. The crypto algorithm and HMAC used by default on ipsec coincides nicely with the list of accelerated functions provided by the driver.
Before we get to tunnel traffic numbers, just one quick look at what systat pigs says while the ipsec is running at full steam:
 PID USER        NAME                 CPU     20\    40\    60\    80\  100\
   58917 root        crypto             52.25 #################
   42636 root        softnet            42.48 ##############
                     (idle)             29.74 #########
    1059 root        tcpbench           24.22 #######
   67777 root        crynlk             19.58 ######
So this indicates that the load from doing ipsec and generating the traffic is somewhat nicely evened out over the two cores in the Edgerouter, and there's even some CPU left unused, which means I can actually ssh into it and have it usable. I have had it running for almost 2 days now, moving some 2.1TB over the tunnel.
Now for the new and improved performance numbers:
   204452123        4740752       37.402  100.00% 
Conn:   1 Mbps:       37.402 Peak Mbps:       58.870 Avg Mbps:       37.402
   204453149        4692968       36.628  100.00% 
Conn:   1 Mbps:       36.628 Peak Mbps:       58.870 Avg Mbps:       36.628
   204454167        5405552       42.480  100.00% 
Conn:   1 Mbps:       42.480 Peak Mbps:       58.870 Avg Mbps:       42.480
   204455188        5202496       40.804  100.00% 
Conn:   1 Mbps:       40.804 Peak Mbps:       58.870 Avg Mbps:       40.804
   204456194        5062208       40.256  100.00% 
Conn:   1 Mbps:       40.256 Peak Mbps:       58.870 Avg Mbps:       40.256
The tcpbench numbers fluctuate up and down a bit, but the output is nice enough to actually keep tabs on the peak values. Peaking to 58.8MBit/s! Of course, as you can see, the average is lower but nice anyhow.
A manyfold increase in performance, which is good enough in itself, but also moves the throughput from a speed that would make a poor but cheap gateway to something actually useful and decent for many home network speeds. Biggest problem after this gets enabled will be that my options to buy cheap used ERLs diminish.
&lt;/code&gt;&lt;/pre&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="http://www.etinc.com/122/Using-FreeBSD-Text-Dumps"&gt;Using FreeBSD Text Dumps&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=334391"&gt;llvm’s lld now the default linker for amd64 on FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blather.michaelwlucas.com/archives/3194"&gt;Author Discoverability&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.openbsd.org/papers/BeckPledgeUnveilBSDCan2018.pdf"&gt;Pledge and Unveil in OpenBSD {pdf}&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://2018.eurobsdcon.org/call-for-papers/"&gt;EuroBSDCon 2018 CFP Closes June 17, hurry up and get your submissions in&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://2018.eurobsdcon.org/paul-schenkeveld-travel-grant/"&gt;Just want to attend, but need help getting to the conference? Applications for the Paul Schenkeveld travel grant accepted until June 15th&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Casey - &lt;a href="http://dpaste.com/2H42V7W#wrap"&gt;ZFS on Digital Ocean&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Jürgen - &lt;a href="http://dpaste.com/3N7ZN8C#wrap"&gt;A Question&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Kevin - &lt;a href="http://dpaste.com/231CY5Z#wrap"&gt;Failover best practice&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Dennis - &lt;a href="http://dpaste.com/1QPNB25#wrap"&gt;SQL&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, OpenIKED, HardenedBSD, Trident, Project Trident, bsdcan</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>TrueOS becoming a downstream fork with Trident, our BSDCan 2018 recap, HardenedBSD Foundation founding efforts, VPN with OpenIKED on OpenBSD, FreeBSD on a System76 Galago Pro, and hardware accelerated crypto on Octeons.</p>

<p>##Headlines##<br>
###<a href="https://www.trueos.org/blog/trueosdownstream/">TrueOS to Focus on Core Operating System</a></p>

<blockquote>
<p>The TrueOS Project has some big plans in the works, and we want to take a minute and share them with you. Many have come to know TrueOS as the “graphical FreeBSD” that makes things easy for newcomers to the BSDs. Today we’re announcing that TrueOS is shifting our focus a bit to become a cutting-edge operating system that keeps all of the stability that you know and love from ZFS (OpenZFS) and FreeBSD, and adds additional features to create a fresh, innovative operating system. Our goal is to create a core-centric operating system that is modular, functional, and perfect for do-it-yourselfers and advanced users alike.</p>
</blockquote>

<blockquote>
<p>TrueOS will become a downstream fork that will build on FreeBSD by integrating new software technologies like OpenRC and LibreSSL. Work has already begun which allows TrueOS to be used as a base platform for other projects, including JSON-based manifests, integrated Poudriere / pkg tools and much more. We’re planning on a six month release cycle to keep development moving and fresh, allowing us to bring you hot new features to ZFS, bhyve and related tools in a timely manner. This makes TrueOS the perfect fit to serve as the basis for building other distributions.</p>
</blockquote>

<blockquote>
<p>Some of you are probably asking yourselves “But what if I want to have a graphical desktop?” Don’t worry! We’re making sure that everyone who knows and loves the legacy desktop version of TrueOS will be able to continue using a FreeBSD-based, graphical operating system in the future. For instance, if you want to add KDE, just use sudo pkg install kde and voila! You have your new shiny desktop. Easy right? This allows us to get back to our roots of being a desktop agnostic operating system. If you want to add a new desktop environment, you get to pick the one that best suits your use.</p>
</blockquote>

<blockquote>
<p>We know that some of you will still be looking for an out-of-the-box solution similar to legacy PC-BSD and TrueOS. We’re happy to announce that Project Trident will take over graphical FreeBSD development going forward. Not much is going to change in that regard other than a new name! You’ll still have Lumina Desktop as a lightweight and feature-rich desktop environment and tons of utilities from the legacy TrueOS toolchain like sysadm and AppCafe. There will be migration paths available for those that would like to move to other FreeBSD-based distributions like Project Trident or GhostBSD.</p>
</blockquote>

<blockquote>
<p>We look forward to this new chapter for TrueOS and hope you will give the new edition a spin! Tell us what you think about the new changes by leaving us a comment. Don’t forget you can ask us questions on our Twitter and be a part of our community by joining the new TrueOS Forums when they go live in about a week. Thanks for being a loyal fan of TrueOS.</p>
</blockquote>

<p>###<a href="http://project-trident.org/faq">Project Trident FAQ</a></p>

<ul>
<li>Q: Why did you pick the name “Project Trident”?</li>
</ul>

<blockquote>
<p>A: We were looking for a name that was unique, yet would still relate to the BSD community. Since Beastie (the FreeBSD mascot) is always pictured with a trident, it felt like that would be a great name.</p>
</blockquote>

<ul>
<li>Q: Where can users go for technical support?</li>
</ul>

<blockquote>
<p>A: At the moment, Project Trident will continue sharing the TrueOS community forums and Telegram channels. We are currently evaluating dedicated options for support channels in the future.</p>
</blockquote>

<ul>
<li>Q: Can I help contribute to the project?</li>
</ul>

<blockquote>
<p>A: We are always looking for developers who want to join the project. If you’re not a developer you can still help, as a community project we will be more reliant on contributions from the community in the form of how-to guides and other user-centric documentation and support systems.</p>
</blockquote>

<ul>
<li>Q: How is the project supported financially?</li>
</ul>

<blockquote>
<p>A: Project Trident is sponsored by the community, from both individuals and corporations. iXsystems has stepped up as the first enterprise-level sponsor of the project, and has been instrumental in getting Project Trident up and running. Please visit the Sponsors page to see all the current sponsors.</p>
</blockquote>

<ul>
<li>Q: How can I help support the project financially?</li>
</ul>

<blockquote>
<p>A: Several methods exist, from one time or recurring donations via Paypal to limited time swag t-shirt campaigns during the year. We are also looking into more alternative methods of support, so please visit the Sponsors page to see all the current methods of sponsorship.</p>
</blockquote>

<ul>
<li>Q: Will there be any transparency of the financial donations and expenditures?</li>
</ul>

<blockquote>
<p>A: Yes, we will be totally open with how much money comes into the project and what it is spent on. Due to concerns of privacy, we will not identify individuals and their donation amounts unless they specifically request to be identified. We will release a monthly overview in/out ledger, so that community members can see where their money is going.</p>
</blockquote>

<ul>
<li>
<p>Relationship with TrueOS</p>
</li>
<li>
<p>Project Trident does have very close ties to the TrueOS project, since most of the original Project Trident developers were once part of the TrueOS project before it became a distribution platform. For users of the TrueOS desktop, we have some additional questions and answers below.</p>
</li>
<li>
<p>Q: Do we need to be at a certain TrueOS install level/release to upgrade?</p>
</li>
</ul>

<blockquote>
<p>A: As long as you have a TrueOS system which has been updated to at least the 18.03 release you should be able to just perform a system update to be automatically upgraded to Project Trident.</p>
</blockquote>

<ul>
<li>Q: Which members moved from TrueOS to Project Trident?</li>
</ul>

<blockquote>
<p>A: Project Trident is being led by prior members of the TrueOS desktop team. Ken and JT (development), Tim (documentation) and Rod (Community/Support). Since Project Trident is a community-first project, we look forward to working with new members of the team.</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###<a href="https://www.bsdcan.org/2018">BSDCan</a></p>

<ul>
<li>BSDCan finished Saturday last week</li>
<li>It started with the GoatBoF on Tuesday at the Royal Oak Pub, where people had a chance to meet and greet. Benedict could not attend due to an all-day FreeBSD Foundation meeting and and even FreeBSD Journal Editorial Board meeting.</li>
<li>The FreeBSD devsummit was held the next two days in parallel to the tutorials. Gordon Tetlow, who organized the devsummit, opened the devsummit. Deb Goodkin from the FreeBSD Foundation gave the first talk with a Foundation update, highlighting current and future efforts. Li-Wen Hsu is now employed by the Foundation to assist in QA work (Jenkins, CI/CD) and Gordon Tetlow has a part-time contract to help secteam as their secretary.</li>
<li>Next, the FreeBSD core team (among them Allan and Benedict) gave a talk about what has happened this last term. With a core election currently running, some of these items will carry over to the next core team, but there were also some finished ones like the FCP process and FreeBSD members initiative. People in the audience asked questions on various topics of interest.</li>
<li>After the coffee break, the release engineering team gave a talk about their efforts in terms of making releases happen in time and good quality.</li>
<li>Benedict had to give his Ansible tutorial in the afternoon, which had roughly 15 people attending. Most of them beginners, we could get some good discussions going and I also learned a few new tricks. The overall feedback was positive and one even asked what I’m going to teach next year.</li>
<li>The second day of the FreeBSD devsummit began with Gordon Tetlow giving an insight into the FreeBSD Security team (aka secteam). He gave a overview of secteam members and responsibilities, explaining the process based on a long past advisory. Developers were encouraged to help out secteam. NDAs and proper disclosure of vulnerabilities were also discussed, and the audience had some feedback and questions.</li>
<li>When the coffee break was over, the FreeBSD 12.0 planning session happened. A <a href="https://wiki.freebsd.org/DevSummit/201806/HaveNeedWant12">Google doc</a> served as a collaborative way of gathering features and things left to do. People signed up for it or were volunteered. Some features won’t make it into 12.0 as they are not 100% ready for prime time and need a few more rounds of testing and bugfixing. Still, 12.0 will have some compelling features.</li>
<li><a href="https://theta360.com/s/xuR4ogsjGmu584JJju0vUaTA">A 360° group picture</a> was taken after lunch, and then people split up into the working groups for the afternoon or started hacking in the UofO Henderson residence.</li>
<li>Benedict and Allan both attended the OpenZFS working group, lead by Matt Ahrens. He presented the completed and outstanding work in FreeBSD, without spoiling too much of the ZFS presentations of various people that happened later at the conference.</li>
<li>Benedict joined the boot code session a bit late (hallway track is the reason) when most things seem to have already been discussed.</li>
<li><a href="https://www.talegraph.com/tales/WmObSRejzT">BSDCan 2018 — Ottawa (In Pictures)</a></li>
<li><a href="https://photos.google.com/share/AF1QipPv_eOz9z-e8R23DkSEcMLF9ivl8est0H4k0lkAoIdY0Jgsn4eyKT54fPyy4EukCw?key=RmJoNS1uOHU2djRDdzZxNGM4ZEY1dFVKamhCNThR">iXsystems Photos from BSDCan 2018</a></li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://hardenedbsd.org/article/shawn-webb/2018-06-09/june-hardenedbsd-foundation-update">June HardenedBSD Foundation Update</a></p>

<blockquote>
<p>We at HardenedBSD are working towards starting up a 501©(3) not-for-profit organization in the USA. Setting up this organization will allow future donations to be tax deductible. We’ve made progress and would like to share with you the current state of affairs.</p>
</blockquote>

<blockquote>
<p>We have identified, sent invitations out, and received acceptance letters from six people who will serve on the HardenedBSD Foundation Board of Directors. You can find their bios below. In the latter half of June 2018 or the beginning half of July 2018, we will meet for the first time as a board and formally begin the process of creating the documentation needed to submit to the local, state, and federal tax services.</p>
</blockquote>

<blockquote>
<p>Here’s a brief introduction to those who will serve on the board:</p>
</blockquote>

<ul>
<li>
<p>W. Dean Freeman (Advisor): Dean has ten years of professional experience with deploying and security Unix and networking systems, including assessing systems security for government certification and assessing the efficacy of security products. He was introduced to Unix via FreeBSD 2.2.8 on an ISP shell account as a teenager. Formerly, he was the Snort port maintainer for FreeBSD while working in the Sourcefire VRT, and has contributed entropy-related patches to the FreeBSD and HardenedBSD projects – a topic on which he presented at vBSDCon 2017.</p>
</li>
<li>
<p>Ben La Monica (Advisor): Ben is a Senior Technology Manager of Software Engineering at Morningstar, Inc and has been developing software for over 15 years in a variety of languages. He advocates open source software and enjoys tinkering with electronics and home automation.</p>
</li>
<li>
<p>George Saylor (Advisor): George is a Technical Directory at G2, Inc. Mr. Saylor has over 28 years of information systems and security experience in a broad range of disciplines. His core focus areas are automation and standards in the event correlation space as well as penetration and exploitation of computer systems. Mr Saylor was also a co-founder of the OpenSCAP project.</p>
</li>
<li>
<p>Virginia Suydan (Accountant and general administrator): Accountant and general administrator for the HardenedBSD Foundation. She has worked with Shawn Webb for tax and accounting purposes for over six years.</p>
</li>
<li>
<p>Shawn Webb (Director): Co-founder of HardenedBSD and all-around infosec wonk. He has worked and played in the infosec industry, doing both offensive and defensive research, for around fifteen years. He loves open source technologies and likes to frustrate the bad guys.</p>
</li>
<li>
<p>Ben Welch (Advisor): Ben is currently a Security Engineer at G2, Inc. He graduated from Pennsylvania College of Technology with a Bachelors in Information Assurance and Security. Ben likes long walks, beaches, candlelight dinners, and attending various conferences like BSides and ShmooCon.</p>
</li>
</ul>

<p><hr></p>

<p>###<a href="https://medium.com/@cmacrae/your-own-vpn-with-openiked-openbsd-13d7abd3d1d4">Your own VPN with OpenIKED &amp; OpenBSD</a></p>

<blockquote>
<p>Remote connectivity to your home network is something I think a lot of people find desirable. Over the years, I’ve just established an SSH tunnel and use it as a SOCKS proxy, sending my traffic through that. It’s a nice solution for a “poor man’s VPN”, but it can be a bit clunky, and it’s not great having to expose SSH to the world, even if you make sure to lock everything down </p>
</blockquote>

<blockquote>
<p>I set out the other day to finally do it properly. I’d come across this great post by Gordon Turner: <a href="https://blog.gordonturner.com/2018/02/25/openbsd-6-2-vpn-endpoint-for-ios-and-macos/">OpenBSD 6.2 VPN Endpoint for iOS and macOS</a></p>
</blockquote>

<blockquote>
<p>Whilst it was exactly what I was looking for, it outlined how to set up an L2TP VPN. Really, I wanted IKEv2 for performance and security reasons (I won’t elaborate on this here, if you’re curious about the differences, there’s a lot of content out on the web explaining this).</p>
</blockquote>

<blockquote>
<p>The client systems I’d be using have native support for IKEv2 (iOS, macOS, other BSD systems). But, I couldn’t find any tutorials in the same vein.</p>
</blockquote>

<blockquote>
<p>So, let’s get stuck in!</p>
</blockquote>

<ul>
<li>A quick note ✍️</li>
</ul>

<blockquote>
<p>This guide will walk through the set up of an IKEv2 VPN using OpenIKED on OpenBSD. It will detail a “road warrior” configuration, and use a PSK (pre-shared-key) for authentication. I’m sure it can be easily adapted to work on any other platforms that OpenIKED is available on, but keep in mind my steps are specifically for OpenBSD.</p>
</blockquote>

<ul>
<li>Server Configuration</li>
</ul>

<blockquote>
<p>As with all my home infrastructure, I crafted this set-up declaratively. So, I had the deployment of the VM setup in Terraform (deployed on my private Triton cluster), and wrote the configuration in Ansible, then tied them together using radekg/terraform-provisioner-ansible.</p>
</blockquote>

<blockquote>
<p>One of the reasons I love Ansible is that its syntax is very simplistic, yet expressive. As such, I feel it fits very well into explaining these steps with snippets of the playbook I wrote.  I’ll link the full playbook a bit further down for those interested.</p>
</blockquote>

<ul>
<li>See the full article for the information on:</li>
<li>sysctl parameters</li>
<li>The naughty list (optional)</li>
<li>Configure the VPN network interface</li>
<li>Configure the firewall</li>
<li>Configure the iked service</li>
<li>Gateway configuration</li>
<li>Client configuration</li>
<li>Troubleshooting</li>
</ul>

<p><hr></p>

<p><strong>DigitalOcean</strong></p>

<p>###<a href="https://corrupted.io/2018/05/15/system76-free-bsd.html">FreeBSD on a System76 Galago Pro</a></p>

<blockquote>
<p>Hey all, It’s been a while since I last posted but I thought I would hammer something out here. My most recent purchase was a System76 Galago Pro. I thought, afer playing with POP! OS a bit, is there any reason I couldn’t get BSD on this thing. Turns out the answer is no, no there isnt and it works pretty decently.</p>
</blockquote>

<blockquote>
<p>To get some accounting stuff out of the way I tested this all on FreeBSD Head and 11.1, and all of it is valid as of May 10, 2018. Head is a fast moving target so some of this is only bound to improve.</p>
</blockquote>

<ul>
<li>
<p>The hardware</p>
</li>
<li>
<p>Intel Core i5 Gen 8</p>
</li>
<li>
<p>UHD Graphics 620</p>
</li>
<li>
<p>16 GB DDR4 Ram</p>
</li>
<li>
<p>RTL8411B PCI Express Card Reader</p>
</li>
<li>
<p>RTL8111 Gigabit ethernet controller</p>
</li>
<li>
<p>Intel HD Audio</p>
</li>
<li>
<p>Samsung SSD 960 PRO 512GB NVMe</p>
</li>
<li>
<p>The caveats</p>
</li>
</ul>

<blockquote>
<p>There are a few things that I cant seem to make work straight out of the box, and that is the SD Card reader, the backlight, and the audio is a bit finicky. Also the trackpad doesn’t respond to two finger scrolling. The wiki is mostly up to date, there are a few edits that need to be made still but there is a bug where I cant register an account yet so I haven’t made all the changes.</p>
</blockquote>

<ul>
<li>Processor</li>
</ul>

<blockquote>
<p>It works like any other Intel processor. Pstates and throttling work.</p>
</blockquote>

<ul>
<li>Graphics</li>
</ul>

<blockquote>
<p>The boot menu sets itself to what looks like 1024x768, but works as you expect in a tiny window. The text console does the full 3200x1800 resolution, but the text is ultra tiny. There isnt a font for the console that covers hidpi screens yet. As for X Windows it requres the drm-kmod-next package. Once installed follow the directions from the package and it works with almost no fuss. I have it running on X with full intel acceleration, but it is running at it’s full 3200x1800 resolution, to scale that down just do xrandr --output eDP-1 --scale 0.5x0.5 it will blow it up to roughly 200%. Due to limitations with X windows and hidpi it is harder to get more granular.</p>
</blockquote>

<ul>
<li>Intel Wireless 8265</li>
</ul>

<blockquote>
<p>The wireless uses the iwm module, as of right now it does not seem to automagically load right now. Adding iwm_load=“YES” will cause the module to load on boot and kldload iwm</p>
</blockquote>

<ul>
<li>Battery</li>
</ul>

<blockquote>
<p>I seem to be getting about 5 hours out of the battery, but everything reports out of the box as expected. I could get more by throttling the CPU down speed wise.</p>
</blockquote>

<ul>
<li>Overall impression</li>
</ul>

<blockquote>
<p>It is a pretty decent experience. While not as polished as a Thinkpad there is a lot of potential with a bit of work and polishing. The laptop itself is not bad, the keyboard is responsive. The build quality is pretty solid. My only real complaint is the trackpad is stiff to click and sort of tiny. They seem to be a bit indifferent to non linux OSes running on the gear but that isnt anything new. I wont have any problems using it and is enough that when I work through this laptop, but I’m not sure at this stage if my next machine will be a System76 laptop, but they have impressed me enough to put them in the running when I go to look for my next portable machine but it hasn’t yet replaced the hole left in my heart by lenovo messing with the thinkpad.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://undeadly.org/cgi?action=article;sid=20180418073437">Hardware accelerated AES/HMAC-SHA on octeons</a></p>

<pre><code>In this commit, visa@ submitted code (disabled for now) to use built-in acceleration on octeon CPUs, much like AESNI for x86s.

I decided to test tcpbench(1) and IPsec, before and after updating and enabling the octcrypto(4) driver.

I didn't capture detailed perf stats from before the update, I had heard someone say that Edgerouter Lite boxes would only do some 6MBit/s over ipsec, so I set up a really simple ipsec.conf with ike esp from A to B leading to a policy of

esp tunnel from A to B spi 0xdeadbeef auth hmac-sha2-256 enc aes
going from one ERL to another (I collect octeons, so I have a bunch to test with) and let tcpbench run for a while on it. My numbers hovered around 7Mbit/s, which coincided with what I've heard, and also that most of the CPU gets used while doing it.
Then I edited /sys/arch/octeon/conf/GENERIC, removed the # from octcrypto0 at mainbus0 and recompiled. Booted into the new kernel and got a octcrypto0 line in dmesg, and it was time to rock the ipsec tunnel again. The crypto algorithm and HMAC used by default on ipsec coincides nicely with the list of accelerated functions provided by the driver.

Before we get to tunnel traffic numbers, just one quick look at what systat pigs says while the ipsec is running at full steam:

     PID USER        NAME                 CPU     20\    40\    60\    80\  100\
   58917 root        crypto             52.25 #################
   42636 root        softnet            42.48 ##############
                     (idle)             29.74 #########
    1059 root        tcpbench           24.22 #######
   67777 root        crynlk             19.58 ######
So this indicates that the load from doing ipsec and generating the traffic is somewhat nicely evened out over the two cores in the Edgerouter, and there's even some CPU left unused, which means I can actually ssh into it and have it usable. I have had it running for almost 2 days now, moving some 2.1TB over the tunnel.
Now for the new and improved performance numbers:

   204452123        4740752       37.402  100.00% 
Conn:   1 Mbps:       37.402 Peak Mbps:       58.870 Avg Mbps:       37.402
   204453149        4692968       36.628  100.00% 
Conn:   1 Mbps:       36.628 Peak Mbps:       58.870 Avg Mbps:       36.628
   204454167        5405552       42.480  100.00% 
Conn:   1 Mbps:       42.480 Peak Mbps:       58.870 Avg Mbps:       42.480
   204455188        5202496       40.804  100.00% 
Conn:   1 Mbps:       40.804 Peak Mbps:       58.870 Avg Mbps:       40.804
   204456194        5062208       40.256  100.00% 
Conn:   1 Mbps:       40.256 Peak Mbps:       58.870 Avg Mbps:       40.256

The tcpbench numbers fluctuate up and down a bit, but the output is nice enough to actually keep tabs on the peak values. Peaking to 58.8MBit/s! Of course, as you can see, the average is lower but nice anyhow.

A manyfold increase in performance, which is good enough in itself, but also moves the throughput from a speed that would make a poor but cheap gateway to something actually useful and decent for many home network speeds. Biggest problem after this gets enabled will be that my options to buy cheap used ERLs diminish.
</code></pre>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="http://www.etinc.com/122/Using-FreeBSD-Text-Dumps">Using FreeBSD Text Dumps</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=334391">llvm’s lld now the default linker for amd64 on FreeBSD</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3194">Author Discoverability</a></li>
<li><a href="https://www.openbsd.org/papers/BeckPledgeUnveilBSDCan2018.pdf">Pledge and Unveil in OpenBSD {pdf}</a></li>
<li><a href="https://2018.eurobsdcon.org/call-for-papers/">EuroBSDCon 2018 CFP Closes June 17, hurry up and get your submissions in</a></li>
<li><a href="https://2018.eurobsdcon.org/paul-schenkeveld-travel-grant/">Just want to attend, but need help getting to the conference? Applications for the Paul Schenkeveld travel grant accepted until June 15th</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Casey - <a href="http://dpaste.com/2H42V7W#wrap">ZFS on Digital Ocean</a></li>
<li>Jürgen - <a href="http://dpaste.com/3N7ZN8C#wrap">A Question</a></li>
<li>Kevin - <a href="http://dpaste.com/231CY5Z#wrap">Failover best practice</a></li>
<li>Dennis - <a href="http://dpaste.com/1QPNB25#wrap">SQL</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>TrueOS becoming a downstream fork with Trident, our BSDCan 2018 recap, HardenedBSD Foundation founding efforts, VPN with OpenIKED on OpenBSD, FreeBSD on a System76 Galago Pro, and hardware accelerated crypto on Octeons.</p>

<p>##Headlines##<br>
###<a href="https://www.trueos.org/blog/trueosdownstream/">TrueOS to Focus on Core Operating System</a></p>

<blockquote>
<p>The TrueOS Project has some big plans in the works, and we want to take a minute and share them with you. Many have come to know TrueOS as the “graphical FreeBSD” that makes things easy for newcomers to the BSDs. Today we’re announcing that TrueOS is shifting our focus a bit to become a cutting-edge operating system that keeps all of the stability that you know and love from ZFS (OpenZFS) and FreeBSD, and adds additional features to create a fresh, innovative operating system. Our goal is to create a core-centric operating system that is modular, functional, and perfect for do-it-yourselfers and advanced users alike.</p>
</blockquote>

<blockquote>
<p>TrueOS will become a downstream fork that will build on FreeBSD by integrating new software technologies like OpenRC and LibreSSL. Work has already begun which allows TrueOS to be used as a base platform for other projects, including JSON-based manifests, integrated Poudriere / pkg tools and much more. We’re planning on a six month release cycle to keep development moving and fresh, allowing us to bring you hot new features to ZFS, bhyve and related tools in a timely manner. This makes TrueOS the perfect fit to serve as the basis for building other distributions.</p>
</blockquote>

<blockquote>
<p>Some of you are probably asking yourselves “But what if I want to have a graphical desktop?” Don’t worry! We’re making sure that everyone who knows and loves the legacy desktop version of TrueOS will be able to continue using a FreeBSD-based, graphical operating system in the future. For instance, if you want to add KDE, just use sudo pkg install kde and voila! You have your new shiny desktop. Easy right? This allows us to get back to our roots of being a desktop agnostic operating system. If you want to add a new desktop environment, you get to pick the one that best suits your use.</p>
</blockquote>

<blockquote>
<p>We know that some of you will still be looking for an out-of-the-box solution similar to legacy PC-BSD and TrueOS. We’re happy to announce that Project Trident will take over graphical FreeBSD development going forward. Not much is going to change in that regard other than a new name! You’ll still have Lumina Desktop as a lightweight and feature-rich desktop environment and tons of utilities from the legacy TrueOS toolchain like sysadm and AppCafe. There will be migration paths available for those that would like to move to other FreeBSD-based distributions like Project Trident or GhostBSD.</p>
</blockquote>

<blockquote>
<p>We look forward to this new chapter for TrueOS and hope you will give the new edition a spin! Tell us what you think about the new changes by leaving us a comment. Don’t forget you can ask us questions on our Twitter and be a part of our community by joining the new TrueOS Forums when they go live in about a week. Thanks for being a loyal fan of TrueOS.</p>
</blockquote>

<p>###<a href="http://project-trident.org/faq">Project Trident FAQ</a></p>

<ul>
<li>Q: Why did you pick the name “Project Trident”?</li>
</ul>

<blockquote>
<p>A: We were looking for a name that was unique, yet would still relate to the BSD community. Since Beastie (the FreeBSD mascot) is always pictured with a trident, it felt like that would be a great name.</p>
</blockquote>

<ul>
<li>Q: Where can users go for technical support?</li>
</ul>

<blockquote>
<p>A: At the moment, Project Trident will continue sharing the TrueOS community forums and Telegram channels. We are currently evaluating dedicated options for support channels in the future.</p>
</blockquote>

<ul>
<li>Q: Can I help contribute to the project?</li>
</ul>

<blockquote>
<p>A: We are always looking for developers who want to join the project. If you’re not a developer you can still help, as a community project we will be more reliant on contributions from the community in the form of how-to guides and other user-centric documentation and support systems.</p>
</blockquote>

<ul>
<li>Q: How is the project supported financially?</li>
</ul>

<blockquote>
<p>A: Project Trident is sponsored by the community, from both individuals and corporations. iXsystems has stepped up as the first enterprise-level sponsor of the project, and has been instrumental in getting Project Trident up and running. Please visit the Sponsors page to see all the current sponsors.</p>
</blockquote>

<ul>
<li>Q: How can I help support the project financially?</li>
</ul>

<blockquote>
<p>A: Several methods exist, from one time or recurring donations via Paypal to limited time swag t-shirt campaigns during the year. We are also looking into more alternative methods of support, so please visit the Sponsors page to see all the current methods of sponsorship.</p>
</blockquote>

<ul>
<li>Q: Will there be any transparency of the financial donations and expenditures?</li>
</ul>

<blockquote>
<p>A: Yes, we will be totally open with how much money comes into the project and what it is spent on. Due to concerns of privacy, we will not identify individuals and their donation amounts unless they specifically request to be identified. We will release a monthly overview in/out ledger, so that community members can see where their money is going.</p>
</blockquote>

<ul>
<li>
<p>Relationship with TrueOS</p>
</li>
<li>
<p>Project Trident does have very close ties to the TrueOS project, since most of the original Project Trident developers were once part of the TrueOS project before it became a distribution platform. For users of the TrueOS desktop, we have some additional questions and answers below.</p>
</li>
<li>
<p>Q: Do we need to be at a certain TrueOS install level/release to upgrade?</p>
</li>
</ul>

<blockquote>
<p>A: As long as you have a TrueOS system which has been updated to at least the 18.03 release you should be able to just perform a system update to be automatically upgraded to Project Trident.</p>
</blockquote>

<ul>
<li>Q: Which members moved from TrueOS to Project Trident?</li>
</ul>

<blockquote>
<p>A: Project Trident is being led by prior members of the TrueOS desktop team. Ken and JT (development), Tim (documentation) and Rod (Community/Support). Since Project Trident is a community-first project, we look forward to working with new members of the team.</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###<a href="https://www.bsdcan.org/2018">BSDCan</a></p>

<ul>
<li>BSDCan finished Saturday last week</li>
<li>It started with the GoatBoF on Tuesday at the Royal Oak Pub, where people had a chance to meet and greet. Benedict could not attend due to an all-day FreeBSD Foundation meeting and and even FreeBSD Journal Editorial Board meeting.</li>
<li>The FreeBSD devsummit was held the next two days in parallel to the tutorials. Gordon Tetlow, who organized the devsummit, opened the devsummit. Deb Goodkin from the FreeBSD Foundation gave the first talk with a Foundation update, highlighting current and future efforts. Li-Wen Hsu is now employed by the Foundation to assist in QA work (Jenkins, CI/CD) and Gordon Tetlow has a part-time contract to help secteam as their secretary.</li>
<li>Next, the FreeBSD core team (among them Allan and Benedict) gave a talk about what has happened this last term. With a core election currently running, some of these items will carry over to the next core team, but there were also some finished ones like the FCP process and FreeBSD members initiative. People in the audience asked questions on various topics of interest.</li>
<li>After the coffee break, the release engineering team gave a talk about their efforts in terms of making releases happen in time and good quality.</li>
<li>Benedict had to give his Ansible tutorial in the afternoon, which had roughly 15 people attending. Most of them beginners, we could get some good discussions going and I also learned a few new tricks. The overall feedback was positive and one even asked what I’m going to teach next year.</li>
<li>The second day of the FreeBSD devsummit began with Gordon Tetlow giving an insight into the FreeBSD Security team (aka secteam). He gave a overview of secteam members and responsibilities, explaining the process based on a long past advisory. Developers were encouraged to help out secteam. NDAs and proper disclosure of vulnerabilities were also discussed, and the audience had some feedback and questions.</li>
<li>When the coffee break was over, the FreeBSD 12.0 planning session happened. A <a href="https://wiki.freebsd.org/DevSummit/201806/HaveNeedWant12">Google doc</a> served as a collaborative way of gathering features and things left to do. People signed up for it or were volunteered. Some features won’t make it into 12.0 as they are not 100% ready for prime time and need a few more rounds of testing and bugfixing. Still, 12.0 will have some compelling features.</li>
<li><a href="https://theta360.com/s/xuR4ogsjGmu584JJju0vUaTA">A 360° group picture</a> was taken after lunch, and then people split up into the working groups for the afternoon or started hacking in the UofO Henderson residence.</li>
<li>Benedict and Allan both attended the OpenZFS working group, lead by Matt Ahrens. He presented the completed and outstanding work in FreeBSD, without spoiling too much of the ZFS presentations of various people that happened later at the conference.</li>
<li>Benedict joined the boot code session a bit late (hallway track is the reason) when most things seem to have already been discussed.</li>
<li><a href="https://www.talegraph.com/tales/WmObSRejzT">BSDCan 2018 — Ottawa (In Pictures)</a></li>
<li><a href="https://photos.google.com/share/AF1QipPv_eOz9z-e8R23DkSEcMLF9ivl8est0H4k0lkAoIdY0Jgsn4eyKT54fPyy4EukCw?key=RmJoNS1uOHU2djRDdzZxNGM4ZEY1dFVKamhCNThR">iXsystems Photos from BSDCan 2018</a></li>
</ul>

<p><hr></p>

<p>##News Roundup<br>
###<a href="https://hardenedbsd.org/article/shawn-webb/2018-06-09/june-hardenedbsd-foundation-update">June HardenedBSD Foundation Update</a></p>

<blockquote>
<p>We at HardenedBSD are working towards starting up a 501©(3) not-for-profit organization in the USA. Setting up this organization will allow future donations to be tax deductible. We’ve made progress and would like to share with you the current state of affairs.</p>
</blockquote>

<blockquote>
<p>We have identified, sent invitations out, and received acceptance letters from six people who will serve on the HardenedBSD Foundation Board of Directors. You can find their bios below. In the latter half of June 2018 or the beginning half of July 2018, we will meet for the first time as a board and formally begin the process of creating the documentation needed to submit to the local, state, and federal tax services.</p>
</blockquote>

<blockquote>
<p>Here’s a brief introduction to those who will serve on the board:</p>
</blockquote>

<ul>
<li>
<p>W. Dean Freeman (Advisor): Dean has ten years of professional experience with deploying and security Unix and networking systems, including assessing systems security for government certification and assessing the efficacy of security products. He was introduced to Unix via FreeBSD 2.2.8 on an ISP shell account as a teenager. Formerly, he was the Snort port maintainer for FreeBSD while working in the Sourcefire VRT, and has contributed entropy-related patches to the FreeBSD and HardenedBSD projects – a topic on which he presented at vBSDCon 2017.</p>
</li>
<li>
<p>Ben La Monica (Advisor): Ben is a Senior Technology Manager of Software Engineering at Morningstar, Inc and has been developing software for over 15 years in a variety of languages. He advocates open source software and enjoys tinkering with electronics and home automation.</p>
</li>
<li>
<p>George Saylor (Advisor): George is a Technical Directory at G2, Inc. Mr. Saylor has over 28 years of information systems and security experience in a broad range of disciplines. His core focus areas are automation and standards in the event correlation space as well as penetration and exploitation of computer systems. Mr Saylor was also a co-founder of the OpenSCAP project.</p>
</li>
<li>
<p>Virginia Suydan (Accountant and general administrator): Accountant and general administrator for the HardenedBSD Foundation. She has worked with Shawn Webb for tax and accounting purposes for over six years.</p>
</li>
<li>
<p>Shawn Webb (Director): Co-founder of HardenedBSD and all-around infosec wonk. He has worked and played in the infosec industry, doing both offensive and defensive research, for around fifteen years. He loves open source technologies and likes to frustrate the bad guys.</p>
</li>
<li>
<p>Ben Welch (Advisor): Ben is currently a Security Engineer at G2, Inc. He graduated from Pennsylvania College of Technology with a Bachelors in Information Assurance and Security. Ben likes long walks, beaches, candlelight dinners, and attending various conferences like BSides and ShmooCon.</p>
</li>
</ul>

<p><hr></p>

<p>###<a href="https://medium.com/@cmacrae/your-own-vpn-with-openiked-openbsd-13d7abd3d1d4">Your own VPN with OpenIKED &amp; OpenBSD</a></p>

<blockquote>
<p>Remote connectivity to your home network is something I think a lot of people find desirable. Over the years, I’ve just established an SSH tunnel and use it as a SOCKS proxy, sending my traffic through that. It’s a nice solution for a “poor man’s VPN”, but it can be a bit clunky, and it’s not great having to expose SSH to the world, even if you make sure to lock everything down </p>
</blockquote>

<blockquote>
<p>I set out the other day to finally do it properly. I’d come across this great post by Gordon Turner: <a href="https://blog.gordonturner.com/2018/02/25/openbsd-6-2-vpn-endpoint-for-ios-and-macos/">OpenBSD 6.2 VPN Endpoint for iOS and macOS</a></p>
</blockquote>

<blockquote>
<p>Whilst it was exactly what I was looking for, it outlined how to set up an L2TP VPN. Really, I wanted IKEv2 for performance and security reasons (I won’t elaborate on this here, if you’re curious about the differences, there’s a lot of content out on the web explaining this).</p>
</blockquote>

<blockquote>
<p>The client systems I’d be using have native support for IKEv2 (iOS, macOS, other BSD systems). But, I couldn’t find any tutorials in the same vein.</p>
</blockquote>

<blockquote>
<p>So, let’s get stuck in!</p>
</blockquote>

<ul>
<li>A quick note ✍️</li>
</ul>

<blockquote>
<p>This guide will walk through the set up of an IKEv2 VPN using OpenIKED on OpenBSD. It will detail a “road warrior” configuration, and use a PSK (pre-shared-key) for authentication. I’m sure it can be easily adapted to work on any other platforms that OpenIKED is available on, but keep in mind my steps are specifically for OpenBSD.</p>
</blockquote>

<ul>
<li>Server Configuration</li>
</ul>

<blockquote>
<p>As with all my home infrastructure, I crafted this set-up declaratively. So, I had the deployment of the VM setup in Terraform (deployed on my private Triton cluster), and wrote the configuration in Ansible, then tied them together using radekg/terraform-provisioner-ansible.</p>
</blockquote>

<blockquote>
<p>One of the reasons I love Ansible is that its syntax is very simplistic, yet expressive. As such, I feel it fits very well into explaining these steps with snippets of the playbook I wrote.  I’ll link the full playbook a bit further down for those interested.</p>
</blockquote>

<ul>
<li>See the full article for the information on:</li>
<li>sysctl parameters</li>
<li>The naughty list (optional)</li>
<li>Configure the VPN network interface</li>
<li>Configure the firewall</li>
<li>Configure the iked service</li>
<li>Gateway configuration</li>
<li>Client configuration</li>
<li>Troubleshooting</li>
</ul>

<p><hr></p>

<p><strong>DigitalOcean</strong></p>

<p>###<a href="https://corrupted.io/2018/05/15/system76-free-bsd.html">FreeBSD on a System76 Galago Pro</a></p>

<blockquote>
<p>Hey all, It’s been a while since I last posted but I thought I would hammer something out here. My most recent purchase was a System76 Galago Pro. I thought, afer playing with POP! OS a bit, is there any reason I couldn’t get BSD on this thing. Turns out the answer is no, no there isnt and it works pretty decently.</p>
</blockquote>

<blockquote>
<p>To get some accounting stuff out of the way I tested this all on FreeBSD Head and 11.1, and all of it is valid as of May 10, 2018. Head is a fast moving target so some of this is only bound to improve.</p>
</blockquote>

<ul>
<li>
<p>The hardware</p>
</li>
<li>
<p>Intel Core i5 Gen 8</p>
</li>
<li>
<p>UHD Graphics 620</p>
</li>
<li>
<p>16 GB DDR4 Ram</p>
</li>
<li>
<p>RTL8411B PCI Express Card Reader</p>
</li>
<li>
<p>RTL8111 Gigabit ethernet controller</p>
</li>
<li>
<p>Intel HD Audio</p>
</li>
<li>
<p>Samsung SSD 960 PRO 512GB NVMe</p>
</li>
<li>
<p>The caveats</p>
</li>
</ul>

<blockquote>
<p>There are a few things that I cant seem to make work straight out of the box, and that is the SD Card reader, the backlight, and the audio is a bit finicky. Also the trackpad doesn’t respond to two finger scrolling. The wiki is mostly up to date, there are a few edits that need to be made still but there is a bug where I cant register an account yet so I haven’t made all the changes.</p>
</blockquote>

<ul>
<li>Processor</li>
</ul>

<blockquote>
<p>It works like any other Intel processor. Pstates and throttling work.</p>
</blockquote>

<ul>
<li>Graphics</li>
</ul>

<blockquote>
<p>The boot menu sets itself to what looks like 1024x768, but works as you expect in a tiny window. The text console does the full 3200x1800 resolution, but the text is ultra tiny. There isnt a font for the console that covers hidpi screens yet. As for X Windows it requres the drm-kmod-next package. Once installed follow the directions from the package and it works with almost no fuss. I have it running on X with full intel acceleration, but it is running at it’s full 3200x1800 resolution, to scale that down just do xrandr --output eDP-1 --scale 0.5x0.5 it will blow it up to roughly 200%. Due to limitations with X windows and hidpi it is harder to get more granular.</p>
</blockquote>

<ul>
<li>Intel Wireless 8265</li>
</ul>

<blockquote>
<p>The wireless uses the iwm module, as of right now it does not seem to automagically load right now. Adding iwm_load=“YES” will cause the module to load on boot and kldload iwm</p>
</blockquote>

<ul>
<li>Battery</li>
</ul>

<blockquote>
<p>I seem to be getting about 5 hours out of the battery, but everything reports out of the box as expected. I could get more by throttling the CPU down speed wise.</p>
</blockquote>

<ul>
<li>Overall impression</li>
</ul>

<blockquote>
<p>It is a pretty decent experience. While not as polished as a Thinkpad there is a lot of potential with a bit of work and polishing. The laptop itself is not bad, the keyboard is responsive. The build quality is pretty solid. My only real complaint is the trackpad is stiff to click and sort of tiny. They seem to be a bit indifferent to non linux OSes running on the gear but that isnt anything new. I wont have any problems using it and is enough that when I work through this laptop, but I’m not sure at this stage if my next machine will be a System76 laptop, but they have impressed me enough to put them in the running when I go to look for my next portable machine but it hasn’t yet replaced the hole left in my heart by lenovo messing with the thinkpad.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://undeadly.org/cgi?action=article;sid=20180418073437">Hardware accelerated AES/HMAC-SHA on octeons</a></p>

<pre><code>In this commit, visa@ submitted code (disabled for now) to use built-in acceleration on octeon CPUs, much like AESNI for x86s.

I decided to test tcpbench(1) and IPsec, before and after updating and enabling the octcrypto(4) driver.

I didn't capture detailed perf stats from before the update, I had heard someone say that Edgerouter Lite boxes would only do some 6MBit/s over ipsec, so I set up a really simple ipsec.conf with ike esp from A to B leading to a policy of

esp tunnel from A to B spi 0xdeadbeef auth hmac-sha2-256 enc aes
going from one ERL to another (I collect octeons, so I have a bunch to test with) and let tcpbench run for a while on it. My numbers hovered around 7Mbit/s, which coincided with what I've heard, and also that most of the CPU gets used while doing it.
Then I edited /sys/arch/octeon/conf/GENERIC, removed the # from octcrypto0 at mainbus0 and recompiled. Booted into the new kernel and got a octcrypto0 line in dmesg, and it was time to rock the ipsec tunnel again. The crypto algorithm and HMAC used by default on ipsec coincides nicely with the list of accelerated functions provided by the driver.

Before we get to tunnel traffic numbers, just one quick look at what systat pigs says while the ipsec is running at full steam:

     PID USER        NAME                 CPU     20\    40\    60\    80\  100\
   58917 root        crypto             52.25 #################
   42636 root        softnet            42.48 ##############
                     (idle)             29.74 #########
    1059 root        tcpbench           24.22 #######
   67777 root        crynlk             19.58 ######
So this indicates that the load from doing ipsec and generating the traffic is somewhat nicely evened out over the two cores in the Edgerouter, and there's even some CPU left unused, which means I can actually ssh into it and have it usable. I have had it running for almost 2 days now, moving some 2.1TB over the tunnel.
Now for the new and improved performance numbers:

   204452123        4740752       37.402  100.00% 
Conn:   1 Mbps:       37.402 Peak Mbps:       58.870 Avg Mbps:       37.402
   204453149        4692968       36.628  100.00% 
Conn:   1 Mbps:       36.628 Peak Mbps:       58.870 Avg Mbps:       36.628
   204454167        5405552       42.480  100.00% 
Conn:   1 Mbps:       42.480 Peak Mbps:       58.870 Avg Mbps:       42.480
   204455188        5202496       40.804  100.00% 
Conn:   1 Mbps:       40.804 Peak Mbps:       58.870 Avg Mbps:       40.804
   204456194        5062208       40.256  100.00% 
Conn:   1 Mbps:       40.256 Peak Mbps:       58.870 Avg Mbps:       40.256

The tcpbench numbers fluctuate up and down a bit, but the output is nice enough to actually keep tabs on the peak values. Peaking to 58.8MBit/s! Of course, as you can see, the average is lower but nice anyhow.

A manyfold increase in performance, which is good enough in itself, but also moves the throughput from a speed that would make a poor but cheap gateway to something actually useful and decent for many home network speeds. Biggest problem after this gets enabled will be that my options to buy cheap used ERLs diminish.
</code></pre>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="http://www.etinc.com/122/Using-FreeBSD-Text-Dumps">Using FreeBSD Text Dumps</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=334391">llvm’s lld now the default linker for amd64 on FreeBSD</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3194">Author Discoverability</a></li>
<li><a href="https://www.openbsd.org/papers/BeckPledgeUnveilBSDCan2018.pdf">Pledge and Unveil in OpenBSD {pdf}</a></li>
<li><a href="https://2018.eurobsdcon.org/call-for-papers/">EuroBSDCon 2018 CFP Closes June 17, hurry up and get your submissions in</a></li>
<li><a href="https://2018.eurobsdcon.org/paul-schenkeveld-travel-grant/">Just want to attend, but need help getting to the conference? Applications for the Paul Schenkeveld travel grant accepted until June 15th</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>Casey - <a href="http://dpaste.com/2H42V7W#wrap">ZFS on Digital Ocean</a></li>
<li>Jürgen - <a href="http://dpaste.com/3N7ZN8C#wrap">A Question</a></li>
<li>Kevin - <a href="http://dpaste.com/231CY5Z#wrap">Failover best practice</a></li>
<li>Dennis - <a href="http://dpaste.com/1QPNB25#wrap">SQL</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 249: Router On A Stick | BSD Now 249</title>
  <link>https://www.bsdnow.tv/249</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2072</guid>
  <pubDate>Wed, 06 Jun 2018 14:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9447bcc4-4425-4ae0-bc1e-0fb13362e0e2.mp3" length="51237875" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenZFS and DTrace updates in NetBSD, NetBSD network security stack audit, Performance of MySQL on ZFS, OpenSMTP results from p2k18, legacy Windows backup to FreeNAS, ZFS block size importance, and NetBSD as router on a stick.</itunes:subtitle>
  <itunes:duration>1:25:17</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenZFS and DTrace updates in NetBSD, NetBSD network security stack audit, Performance of MySQL on ZFS, OpenSMTP results from p2k18, legacy Windows backup to FreeNAS, ZFS block size importance, and NetBSD as router on a stick.
&lt;hr&gt;
&lt;p&gt;##Headlines&lt;br&gt;
&lt;a href="https://mail-index.netbsd.org/source-changes/2018/05/28/msg095541.html"&gt;ZFS and DTrace update lands in NetBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;merge a new version of the CDDL dtrace and ZFS code. This changes the upstream vendor from OpenSolaris to FreeBSD, and this version is based on FreeBSD svn r315983.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;r315983 is from March 2017 (14 months ago), so there is still more work to do&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;in addition to the 10 years of improvements from upstream, this version also has these NetBSD-specific enhancements:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;dtrace FBT probes can now be placed in kernel modules.&lt;/li&gt;
&lt;li&gt;ZFS now supports mmap().&lt;/li&gt;
&lt;/ul&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;This brings NetBSD 10 years forward, and they should be able to catch the rest of the way up fairly quickly&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://blog.netbsd.org/tnf/entry/network_security_audit"&gt;NetBSD network stack security audit&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Maxime Villard has been working on an audit of the NetBSD network stack, a project sponsored by The NetBSD Foundation, which has served all users of BSD-derived operating systems.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;Over the last five months, hundreds of patches were committed to the source tree as a result of this work. Dozens of bugs were fixed, among which a good number of actual, remotely-triggerable vulnerabilities.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Changes were made to strengthen the networking subsystems and improve code quality: reinforce the mbuf API, add many KASSERTs to enforce assumptions, simplify packet handling, and verify compliance with RFCs. This was done in several layers of the NetBSD kernel, from device drivers to L4 handlers.&lt;br&gt;
In the course of investigating several bugs discovered in NetBSD, I happened to look at the network stacks of other operating systems, to see whether they had already fixed the issues, and if so how. Needless to say, I found bugs there too.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;A lot of code is shared between the BSDs, so it is especially helpful when one finds a bug, to check the other BSDs and share the fix.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The IPv6 Buffer Overflow: The overflow allowed an attacker to write one byte of packet-controlled data into ‘packetstorage+off’, where ‘off’ could be approximately controlled too. This allowed at least a pretty bad remote DoS/Crash&lt;br&gt;
The IPsec Infinite Loop: When receiving an IPv6-AH packet, the IPsec entry point was not correctly computing the length of the IPv6 suboptions, and this, before authentication. As a result, a specially-crafted IPv6 packet could trigger an infinite loop in the kernel (making it unresponsive). In addition this flaw allowed a limited buffer overflow - where the data being written was however not controllable by the attacker.&lt;br&gt;
The IPPROTO Typo: While looking at the IPv6 Multicast code, I stumbled across a pretty simple yet pretty bad mistake: at one point the Pim6 entry point would return IPPROTONONE instead of IPPROTODONE. Returning IPPROTONONE was entirely wrong: it caused the kernel to keep iterating on the IPv6 packet chain, while the packet storage was already freed.&lt;br&gt;
The PF Signedness Bug: A bug was found in NetBSD’s implementation of the PF firewall, that did not affect the other BSDs. In the initial PF code a particular macro was used as an alias to a number. This macro formed a signed integer. NetBSD replaced the macro with a sizeof(), which returns an unsigned result.&lt;br&gt;
The NPF Integer Overflow: An integer overflow could be triggered in NPF, when parsing an IPv6 packet with large options. This could cause NPF to look for the L4 payload at the wrong offset within the packet, and it allowed an attacker to bypass any L4 filtering rule on IPv6.&lt;br&gt;
The IPsec Fragment Attack: I noticed some time ago that when reassembling fragments (in either IPv4 or IPv6), the kernel was not removing the MPKTHDR flag on the secondary mbufs in mbuf chains. This flag is supposed to indicate that a given mbuf is the head of the chain it forms; having the flag on secondary mbufs was suspicious.&lt;br&gt;
What Now: Not all protocols and layers of the network stack were verified, because of time constraints, and also because of unexpected events: the recent x86 CPU bugs, which I was the only one able to fix promptly. A todo list will be left when the project end date is reached, for someone else to pick up. Me perhaps, later this year? We’ll see.&lt;br&gt;
This security audit of NetBSD’s network stack is sponsored by The NetBSD Foundation, and serves all users of BSD-derived operating systems. The NetBSD Foundation is a non-profit organization, and welcomes any donations that help continue funding projects of this kind.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;DigitalOcean&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://www.percona.com/blog/2018/05/15/about-zfs-performance/"&gt;MySQL on ZFS Performance&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I used sysbench to create a table of 10M rows and then, using export/import tablespace, I copied it 329 times. I ended up with 330 tables for a total size of about 850GB. The dataset generated by sysbench is not very compressible, so I used lz4 compression in ZFS. For the other ZFS settings, I used what can be found in my earlier ZFS posts but with the ARC size limited to 1GB. I then used that plain configuration for the first benchmarks. Here are the results with the sysbench point-select benchmark, a uniform distribution and eight threads. The InnoDB buffer pool was set to 2.5GB.&lt;br&gt;
In both cases, the load is IO bound. The disk is doing exactly the allowed 3000 IOPS. The above graph appears to be a clear demonstration that XFS is much faster than ZFS, right? But is that really the case? The way the dataset has been created is extremely favorable to XFS since there is absolutely no file fragmentation. Once you have all the files opened, a read IOP is just a single fseek call to an offset and ZFS doesn’t need to access any intermediate inode. The above result is about as fair as saying MyISAM is faster than InnoDB based only on table scan performance results of unfragmented tables and default configuration. ZFS is much less affected by the file level fragmentation, especially for point access type.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;ZFS stores the files in B-trees in a very similar fashion as InnoDB stores data. To access a piece of data in a B-tree, you need to access the top level page (often called root node) and then one block per level down to a leaf-node containing the data. With no cache, to read something from a three levels B-tree thus requires 3 IOPS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The extra IOPS performed by ZFS are needed to access those internal blocks in the B-trees of the files. These internal blocks are labeled as metadata. Essentially, in the above benchmark, the ARC is too small to contain all the internal blocks of the table files’ B-trees. If we continue the comparison with InnoDB, it would be like running with a buffer pool too small to contain the non-leaf pages. The test dataset I used has about 600MB of non-leaf pages, about 0.1% of the total size, which was well cached by the 3GB buffer pool. So only one InnoDB page, a leaf page, needed to be read per point-select statement.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;To correctly set the ARC size to cache the metadata, you have two choices. First, you can guess values for the ARC size and experiment. Second, you can try to evaluate it by looking at the ZFS internal data. Let’s review these two approaches.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;You’ll read/hear often the ratio 1GB of ARC for 1TB of data, which is about the same 0.1% ratio as for InnoDB. I wrote about that ratio a few times, having nothing better to propose. Actually, I found it depends a lot on the recordsize used. The 0.1% ratio implies a ZFS recordsize of 128KB. A ZFS filesystem with a recordsize of 128KB will use much less metadata than another one using a recordsize of 16KB because it has 8x fewer leaf pages. Fewer leaf pages require less B-tree internal nodes, hence less metadata. A filesystem with a recordsize of 128KB is excellent for sequential access as it maximizes compression and reduces the IOPS but it is poor for small random access operations like the ones MySQL/InnoDB does.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;In order to improve ZFS performance, I had 3 options:&lt;/li&gt;
&lt;li&gt;Increase the ARC size to 7GB&lt;/li&gt;
&lt;li&gt;Use a larger Innodb page size like 64KB&lt;/li&gt;
&lt;li&gt;Add a L2ARC&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;I was reluctant to grow the ARC to 7GB, which was nearly half the overall system memory. At best, the ZFS performance would only match XFS. A larger InnoDB page size would increase the CPU load for decompression on an instance with only two vCPUs; not great either. The last option, the L2ARC, was the most promising.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;ZFS is much more complex than XFS and EXT4 but, that also means it has more tunables/options. I used a simplistic setup and an unfair benchmark which initially led to poor ZFS results. With the same benchmark, very favorable to XFS, I added a ZFS L2ARC and that completely reversed the situation, more than tripling the ZFS results, now 66% above XFS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Conclusion&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;We have seen in this post why the general perception is that ZFS under-performs compared to XFS or EXT4. The presence of B-trees for the files has a big impact on the amount of metadata ZFS needs to handle, especially when the recordsize is small. The metadata consists mostly of the non-leaf pages (or internal nodes) of the B-trees. When properly cached, the performance of ZFS is excellent. ZFS allows you to optimize the use of EBS volumes, both in term of IOPS and size when the instance has fast ephemeral storage devices. Using the ephemeral device of an i3.large instance for the ZFS L2ARC, ZFS outperformed XFS by 66%.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://poolp.org/posts/2018-04-30/opensmtpd-new-config/"&gt;OpenSMTPD new config&lt;/a&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;TL;DR:
OpenBSD #p2k18 hackathon took place at Epitech in Nantes.
I was organizing the hackathon but managed to make progress on OpenSMTPD.
As mentioned at EuroBSDCon the one-line per rule config format was a design error.
A new configuration grammar is almost ready and the underlying structures are simplified.
Refactor removes ~750 lines of code and solves _many issues that were side-effects of the design error.
New features are going to be unlocked thanks to this.
&lt;/code&gt;&lt;/pre&gt;
&lt;ul&gt;
&lt;li&gt;Anatomy of a design error&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;OpenSMTPD started ten years ago out of dissatisfaction with other solutions, mainly because I considered them way too complex for me not to get things wrong from time to time.&lt;br&gt;
The initial configuration format was very different, I was inspired by pyr@’s hoststated, which eventually became relayd, and designed my configuration format with blocks enclosed by brackets.&lt;br&gt;
When I first showed OpenSMTPD to pyr@, he convinced me that PF-like one-line rules would be awesome, and it was awesome indeed.&lt;br&gt;
It helped us maintain our goal of simple configuration files, it helped fight feature creeping, it helped us gain popularity and become a relevant MTA, it helped us get where we are now 10 years later.&lt;br&gt;
That being said, I believe this was a design error. A design error that could not have been predicted until we hit the wall to understand WHY this was an error. One-line rules are semantically wrong, they are SMTP wrong, they are wrong.&lt;br&gt;
One-line rules are making the entire daemon more complex, preventing some features from being implemented, making others more complex than they should be, they no longer serve our goals.&lt;br&gt;
To get to the point: we should move to two-line rules :-)&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;Anatomy of a design error&lt;br&gt;
OpenSMTPD started ten years ago out of dissatisfaction with other solutions, mainly because I considered them way too complex for me not to get things wrong from time to time.&lt;/p&gt;
&lt;p&gt;The initial configuration format was very different, I was inspired by pyr@’s hoststated, which eventually became relayd, and designed my configuration format with blocks enclosed by brackets.&lt;/p&gt;
&lt;p&gt;When I first showed OpenSMTPD to pyr@, he convinced me that PF-like one-line rules would be awesome, and it was awesome indeed.&lt;/p&gt;
&lt;p&gt;It helped us maintain our goal of simple configuration files, it helped fight feature creeping, it helped us gain popularity and become a relevant MTA, it helped us get where we are now 10 years later.&lt;/p&gt;
&lt;p&gt;That being said, I believe this was a design error. A design error that could not have been predicted until we hit the wall to understand WHY this was an error. One-line rules are semantically wrong, they are SMTP wrong, they are wrong.&lt;/p&gt;
&lt;p&gt;One-line rules are making the entire daemon more complex, preventing some features from being implemented, making others more complex than they should be, they no longer serve our goals.&lt;/p&gt;
&lt;p&gt;To get to the point: we should move to two-line rules :-)&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;The problem with one-line rules&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;OpenSMTPD decides to accept or reject messages based on one-line rules such as:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;&lt;code&gt;accept from any for domain poolp.org deliver to mbox&lt;/code&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;Which can essentially be split into three units:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;the decision: accept/reject&lt;/li&gt;
&lt;li&gt;the matching: from any for domain &lt;a href="http://poolp.org"&gt;poolp.org&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;the (default) action: deliver to mbox&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;To ensure that we meet the requirements of the transactions, the matching must be performed during the SMTP transaction before we take a decision for the recipient.&lt;br&gt;
Given that the rule is atomic, that it doesn’t have an identifier and that the action is part of it, the two only ways to make sure we can remember the action to take later on at delivery time is to either:&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;save the action in the envelope, which is what we do today&lt;/li&gt;
&lt;li&gt;evaluate the envelope again at delivery&lt;/li&gt;
&lt;li&gt;And this this where it gets tricky… both solutions are NOT ok.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The first solution, which we’ve been using for a decade, was to save the action within the envelope and kind of carve it in stone. This works fine… however it comes with the downsides that errors fixed in configuration files can’t be caught up by envelopes, that delivery action must be validated way ahead of time during the SMTP transaction which is much trickier, that the parsing of delivery methods takes place as the _smtpd user rather than the recipient user, and that envelope structures that are passed all over OpenSMTPD carry delivery-time informations, and more, and more, and more. The code becomes more complex in general, less safe in some particular places, and some areas are nightmarish to deal with because they have to deal with completely unrelated code that can’t be dealt with later in the code path.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;The second solution can’t be done. An envelope may be the result of nested rules, for example an external client, hitting an alias, hitting a user with a .forward file resolving to a user. An envelope on disk may no longer match any rule or it may match a completely different rule If we could ensure that it matched the same rule, evaluating the ruleset may spawn new envelopes which would violate the transaction. Trying to imagine how we could work around this leads to more and more and more RFC violations, incoherent states, duplicate mails, etc…&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;There is simply no way to deal with this with atomic rules, the matching and the action must be two separate units that are evaluated at two different times, failure to do so will necessarily imply that you’re either using our first solution and all its downsides, or that you are currently in a world of pain trying to figure out why everything is burning around you. The minute the action is written to an on-disk envelope, you have failed.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;A proper ruleset must define a set of matching patterns resolving to an action identifier that is carved in stone, AND a set of named action set that is resolved dynamically at delivery time.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Follow the link above to see the rest of the article&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Break&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;##News Roundup&lt;br&gt;
&lt;a href="http://fortysomethinggeek.blogspot.com/2012/09/legacy-windows-rsync-backup-to-freenas.html"&gt;Backing up a legacy Windows machine to a FreeNAS with rsync&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I have some old Windows servers (10 years and counting) and I have been using rsync to back them up to my FreeNAS box. It has been working great for me.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;First of all, I do have my Windows servers backup in virtualized format. However, those are only one-time snapshops that I run once in a while. These are classic ASP IIS web servers that I can easily put up on a new VM. However, many of these legacy servers generate gigabytes of data a day in their repositories. Running VM conversion daily is not ideal.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;My solution was to use some sort of rsync solution just for the data repos. I’ve tried some applications that didn’t work too well with Samba shares and these old servers have slow I/O. Copying files to external sata or usb drive was not ideal. We’ve moved on from Windows to Linux and do not have any Windows file servers of capacity to provide network backups.  Hence, I decided to use Delta Copy with FreeNAS. So here is a little write up on how to set it up. I have 4 Windows 2000 servers backing up daily with this method.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;First, download Delta Copy and install it. It is open-source and pretty much free. It is basically a wrapper for cygwin’s rsync. When you install it, it will ask you to install the Server services which allows you to run it as a Rsync server on Windows. You don’t need to do this. Instead, you will be just using the Delta Copy Client application. But before we do that, we will need to configure our Rsync service for our Windows Clients on FreeNAS.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;In FreeNAS, go under Services , Select Rsync &amp;gt;  Rsync Modules &amp;gt; Add Rsync Module.&lt;/li&gt;
&lt;li&gt;Then fill out the form; giving the module a name and set the path. In my example, I simply called it WIN and linked it to a user called backupuser.&lt;/li&gt;
&lt;li&gt;This process is much easier than trying to configure the daemon rsyncd.conf file by hand.&lt;/li&gt;
&lt;li&gt;Now, on the Windows Client, start the DeltaCopy Client. You will create a new Profile.&lt;/li&gt;
&lt;li&gt;You will need to enter the IP of the Rsync server (FreeNAS) and specify the module name which will be called “Virtual Directory Name.”  When you pull the select menu, the list of Rsync Modules you created earlier in FreeNAS will populate.&lt;/li&gt;
&lt;li&gt;You can set authentication. On the server, you can restrict by IP and do other things to lock down your rsync.&lt;/li&gt;
&lt;li&gt;Next, you will add folders (and/or files) you want to synchronize.&lt;/li&gt;
&lt;li&gt;Once the paths are set up, you can run a sync by right clicking the profile name.&lt;/li&gt;
&lt;li&gt;Here, I made a test sync to a home folder of a virtualized windows box. As you can see, I mounted the rsync volume on my mac to see the progress. The rsync worked beautifully. DeltaCopy did what it was told.&lt;/li&gt;
&lt;li&gt;Once you get everything working. The next thing to do is set schedules. If you done tasks schedules in Windows before, it is pretty straightforward. DeltaCopy has a link in the application to directly create a new task for you. I set my backups to run nightly and it has been working great.&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;There you have it. Windows rsync to FreeNAS using DeltaCopy.&lt;br&gt;
The nice thing about FreeNAS is you don’t have to modify /etc/rsyncd.conf files. Everything can be done in the web admin.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;###&lt;a href="https://r3xnation.wordpress.com/2018/04/10/how-to-write-atf-tests-for-netbsd/amp/"&gt;How to write ATF tests for NetBSD&lt;/a&gt;&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;I have recently started contributing to the amazing NetBSD foundation. I was thinking of trying out a new OS for a long time. Switching to the NetBSD OS has been a fun change.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;My first contribution to the NetBSD foundation was adding regression tests for the Address Sanitizer (ASan) in the Automated Testing Framework(ATF) which NetBSD has. I managed to complete it with the help of my really amazing mentor Kamil. This post is gonna be about the ATF framework that NetBSD has and how to you can add multiple tests with ease.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Intro&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;In ATF tests we will basically be talking about test programs which are a suite of test cases for a specific application or program.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;The ATF suite of Commands&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;There are a variety of commands that the atf suite offers. These include :&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;atf-check: The versatile command that is a vital part of the checking process. man page&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;atf-run: Command used to run a test program. man page&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;atf-fail: Report failure of a test case.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;atf-report: used to pretty print the atf-run. man page&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;atf-set: To set atf test conditions.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;We will be taking a better look at the syntax and usage later.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Let’s start with the Basics&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;The ATF testing framework comes preinstalled with a default NetBSD installation. It is used to write tests for various applications and commands in NetBSD.  One can write the Test programs in either the C language or in shell script. In this post I will be dealing with the Bash part.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Follow the link above to see the rest of the article&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="http://brian.candler.me/posts/the-importance-of-zfs-blocksize/"&gt;The Importance of ZFS Block Size&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Warning! WARNING! Don’t just do things because some random blog says so&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;One of the important tunables in ZFS is the recordsize (for normal datasets) and volblocksize (for zvols). These default to 128KB and 8KB respectively.&lt;br&gt;
As I understand it, this is the unit of work in ZFS. If you modify one byte in a large file with the default 128KB record size, it causes the whole 128KB to be read in, one byte to be changed, and a new 128KB block to be written out.&lt;br&gt;
As a result, the official recommendation is to use a block size which aligns with the underlying workload: so for example if you are using a database which reads and writes 16KB chunks then you should use a 16KB block size, and if you are running VMs containing an ext4 filesystem, which uses a 4KB block size, you should set a 4KB block size&lt;br&gt;
You can see it has a 16GB total file size, of which 8.5G has been touched and consumes space - that is, it’s a “sparse” file. The used space is also visible by looking at the zfs filesystem which this file resides in&lt;br&gt;
Then I tried to copy the image file whilst maintaining its “sparseness”, that is, only touching the blocks of the zvol which needed to be touched. The original used only 8.42G, but the copy uses 14.6GB - almost the entire 16GB has been touched! What’s gone wrong?&lt;br&gt;
I finally realised that the difference between the zfs filesystem and the zvol is the block size. I recreated the zvol with a 128K block size&lt;br&gt;
That’s better. The disk usage of the zvol is now exactly the same as for the sparse file in the filesystem dataset&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;It does impact the read speed too. 4K blocks took 5:52, and 128K blocks took 3:20&lt;/li&gt;
&lt;li&gt;Part of this is the amount of metadata that has to be read, see the MySQL benchmarks from earlier in the show&lt;/li&gt;
&lt;li&gt;And yes, using a larger block size will increase the compression efficiency, since the compressor has more redundant data to optimize.&lt;/li&gt;
&lt;li&gt;Some of the savings, and the speedup is because a lot less metadata had to be written&lt;/li&gt;
&lt;li&gt;Your zpool layout also plays a big role, if you use 4Kn disks, and RAID-Z2, using a volblocksize of 8k will actually result in a large amount of wasted space because of RAID-Z padding. Although, if you enable compression, your 8k records may compress to only 4k, and then all the numbers change again.&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;###&lt;a href="https://www.fukr.org.uk/?p=184"&gt;Using a Raspberry Pi 2 as a Router on a Stick Starring NetBSD&lt;/a&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Sorry we didn’t answer you quickly enough&lt;/li&gt;
&lt;/ul&gt;
&lt;blockquote&gt;
&lt;p&gt;A few weeks ago I set about upgrading my feeble networking skills by playing around with a Cisco 2970 switch. I set up a couple of VLANs and found the urge to set up a router to route between them. The 2970 isn’t a modern layer 3 switch so what am I to do?&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Why not make use of the Raspberry Pi 2 that I’ve never used and put it to some good use as a ‘router on a stick’.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I could install a Linux based OS as I am quite familiar with it but where’s the fun in that? In my home lab I use SmartOS which by the way is a shit hot hypervisor but as far as I know there aren’t any Illumos distributions for the Raspberry Pi. On the desktop I use Solus OS which is by far the slickest Linux based OS that I’ve had the pleasure to use but Solus’ focus is purely desktop. It’s looking like BSD then!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;I believe FreeBSD is renowned for it’s top notch networking stack and so I wrote to the BSDNow show on Jupiter Broadcasting for some help but it seems that the FreeBSD chaps from the show are off on a jolly to some BSD conference or another(love the show by the way).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;It looks like me and the luvverly NetBSD are on a date this Saturday. I’ve always had a secret love for NetBSD. She’s a beautiful, charming and promiscuous lover(looking at the supported architectures) and I just can’t stop going back to her despite her misgivings(ahem, zfs). Just my type of grrrl!&lt;/p&gt;
&lt;/blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;Let’s crack on…&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ul&gt;
&lt;li&gt;Follow the link above to see the rest of the article&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;##Beastie Bits&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.bsdjobs.com/"&gt;BSD Jobs&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2018-May/000944.html"&gt;University of Aberdeen’s Internet Transport Research Group is hiring&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://youtu.be/YnNpgtjrM9U"&gt;VR demo on OpenBSD via OpenHMD with OSVR HDK2&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://rachelbythebay.com/w/2018/04/05/bangpatch/"&gt;patch runs ed, and ed can run anything (mentions FreeBSD and OpenBSD)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/jwilm/alacritty/blob/master/README.md"&gt;Alacritty (OpenGL-powered terminal emulator) now supports OpenBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180413065457"&gt;MAP_STACK Stack Register Checking Committed to -current&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://2018.eurobsdcon.org/call-for-papers/"&gt;EuroBSDCon CfP till June 17, 2018&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;##Feedback/Questions&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;NeutronDaemon - &lt;a href="http://dpaste.com/3E0SR5Y#wrap"&gt;Tutorial request&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Kurt - &lt;a href="http://dpaste.com/01CWKM5#wrap"&gt;Question about transferability/bi-directionality of ZFS snapshots and send/receive&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Peter - &lt;a href="http://dpaste.com/3N1BGQF#wrap"&gt;A Question and much love for BSD Now&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Peter - &lt;a href="http://dpaste.com/20R2DTG"&gt;netgraph state&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd,openbsd,netbsd,dragonflybsd,trueos,tutorial,howto,guide,bsd,interview,dtrace,sysbench,InnoDB,OpenSMTPD,samba,rsync,ATF tests,raspberry pi 2</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenZFS and DTrace updates in NetBSD, NetBSD network security stack audit, Performance of MySQL on ZFS, OpenSMTP results from p2k18, legacy Windows backup to FreeNAS, ZFS block size importance, and NetBSD as router on a stick.<br>
<hr></p>

<p>##Headlines<br>
###<a href="https://mail-index.netbsd.org/source-changes/2018/05/28/msg095541.html">ZFS and DTrace update lands in NetBSD</a></p>

<blockquote>
<p>merge a new version of the CDDL dtrace and ZFS code. This changes the upstream vendor from OpenSolaris to FreeBSD, and this version is based on FreeBSD svn r315983.</p>
</blockquote>

<ul>
<li>r315983 is from March 2017 (14 months ago), so there is still more work to do</li>
</ul>

<blockquote>
<p>in addition to the 10 years of improvements from upstream, this version also has these NetBSD-specific enhancements:</p>
<ul>
<li>dtrace FBT probes can now be placed in kernel modules.</li>
<li>ZFS now supports mmap().</li>
</ul>
</blockquote>

<ul>
<li>This brings NetBSD 10 years forward, and they should be able to catch the rest of the way up fairly quickly</li>
</ul>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/network_security_audit">NetBSD network stack security audit</a></p>

<ul>
<li>Maxime Villard has been working on an audit of the NetBSD network stack, a project sponsored by The NetBSD Foundation, which has served all users of BSD-derived operating systems.</li>
</ul>

<blockquote>
<p>Over the last five months, hundreds of patches were committed to the source tree as a result of this work. Dozens of bugs were fixed, among which a good number of actual, remotely-triggerable vulnerabilities.</p>
</blockquote>

<blockquote>
<p>Changes were made to strengthen the networking subsystems and improve code quality: reinforce the mbuf API, add many KASSERTs to enforce assumptions, simplify packet handling, and verify compliance with RFCs. This was done in several layers of the NetBSD kernel, from device drivers to L4 handlers.<br>
In the course of investigating several bugs discovered in NetBSD, I happened to look at the network stacks of other operating systems, to see whether they had already fixed the issues, and if so how. Needless to say, I found bugs there too.</p>
</blockquote>

<ul>
<li>A lot of code is shared between the BSDs, so it is especially helpful when one finds a bug, to check the other BSDs and share the fix.</li>
</ul>

<blockquote>
<p>The IPv6 Buffer Overflow: The overflow allowed an attacker to write one byte of packet-controlled data into ‘packet_storage+off’, where ‘off’ could be approximately controlled too. This allowed at least a pretty bad remote DoS/Crash<br>
The IPsec Infinite Loop: When receiving an IPv6-AH packet, the IPsec entry point was not correctly computing the length of the IPv6 suboptions, and this, before authentication. As a result, a specially-crafted IPv6 packet could trigger an infinite loop in the kernel (making it unresponsive). In addition this flaw allowed a limited buffer overflow - where the data being written was however not controllable by the attacker.<br>
The IPPROTO Typo: While looking at the IPv6 Multicast code, I stumbled across a pretty simple yet pretty bad mistake: at one point the Pim6 entry point would return IPPROTO_NONE instead of IPPROTO_DONE. Returning IPPROTO_NONE was entirely wrong: it caused the kernel to keep iterating on the IPv6 packet chain, while the packet storage was already freed.<br>
The PF Signedness Bug: A bug was found in NetBSD’s implementation of the PF firewall, that did not affect the other BSDs. In the initial PF code a particular macro was used as an alias to a number. This macro formed a signed integer. NetBSD replaced the macro with a sizeof(), which returns an unsigned result.<br>
The NPF Integer Overflow: An integer overflow could be triggered in NPF, when parsing an IPv6 packet with large options. This could cause NPF to look for the L4 payload at the wrong offset within the packet, and it allowed an attacker to bypass any L4 filtering rule on IPv6.<br>
The IPsec Fragment Attack: I noticed some time ago that when reassembling fragments (in either IPv4 or IPv6), the kernel was not removing the M_PKTHDR flag on the secondary mbufs in mbuf chains. This flag is supposed to indicate that a given mbuf is the head of the chain it forms; having the flag on secondary mbufs was suspicious.<br>
What Now: Not all protocols and layers of the network stack were verified, because of time constraints, and also because of unexpected events: the recent x86 CPU bugs, which I was the only one able to fix promptly. A todo list will be left when the project end date is reached, for someone else to pick up. Me perhaps, later this year? We’ll see.<br>
This security audit of NetBSD’s network stack is sponsored by The NetBSD Foundation, and serves all users of BSD-derived operating systems. The NetBSD Foundation is a non-profit organization, and welcomes any donations that help continue funding projects of this kind.</p>
</blockquote>

<p><hr></p>

<p><strong>DigitalOcean</strong></p>

<p>###<a href="https://www.percona.com/blog/2018/05/15/about-zfs-performance/">MySQL on ZFS Performance</a></p>

<blockquote>
<p>I used sysbench to create a table of 10M rows and then, using export/import tablespace, I copied it 329 times. I ended up with 330 tables for a total size of about 850GB. The dataset generated by sysbench is not very compressible, so I used lz4 compression in ZFS. For the other ZFS settings, I used what can be found in my earlier ZFS posts but with the ARC size limited to 1GB. I then used that plain configuration for the first benchmarks. Here are the results with the sysbench point-select benchmark, a uniform distribution and eight threads. The InnoDB buffer pool was set to 2.5GB.<br>
In both cases, the load is IO bound. The disk is doing exactly the allowed 3000 IOPS. The above graph appears to be a clear demonstration that XFS is much faster than ZFS, right? But is that really the case? The way the dataset has been created is extremely favorable to XFS since there is absolutely no file fragmentation. Once you have all the files opened, a read IOP is just a single fseek call to an offset and ZFS doesn’t need to access any intermediate inode. The above result is about as fair as saying MyISAM is faster than InnoDB based only on table scan performance results of unfragmented tables and default configuration. ZFS is much less affected by the file level fragmentation, especially for point access type.</p>
</blockquote>

<blockquote>
<p>ZFS stores the files in B-trees in a very similar fashion as InnoDB stores data. To access a piece of data in a B-tree, you need to access the top level page (often called root node) and then one block per level down to a leaf-node containing the data. With no cache, to read something from a three levels B-tree thus requires 3 IOPS.</p>
</blockquote>

<blockquote>
<p>The extra IOPS performed by ZFS are needed to access those internal blocks in the B-trees of the files. These internal blocks are labeled as metadata. Essentially, in the above benchmark, the ARC is too small to contain all the internal blocks of the table files’ B-trees. If we continue the comparison with InnoDB, it would be like running with a buffer pool too small to contain the non-leaf pages. The test dataset I used has about 600MB of non-leaf pages, about 0.1% of the total size, which was well cached by the 3GB buffer pool. So only one InnoDB page, a leaf page, needed to be read per point-select statement.</p>
</blockquote>

<blockquote>
<p>To correctly set the ARC size to cache the metadata, you have two choices. First, you can guess values for the ARC size and experiment. Second, you can try to evaluate it by looking at the ZFS internal data. Let’s review these two approaches.</p>
</blockquote>

<blockquote>
<p>You’ll read/hear often the ratio 1GB of ARC for 1TB of data, which is about the same 0.1% ratio as for InnoDB. I wrote about that ratio a few times, having nothing better to propose. Actually, I found it depends a lot on the recordsize used. The 0.1% ratio implies a ZFS recordsize of 128KB. A ZFS filesystem with a recordsize of 128KB will use much less metadata than another one using a recordsize of 16KB because it has 8x fewer leaf pages. Fewer leaf pages require less B-tree internal nodes, hence less metadata. A filesystem with a recordsize of 128KB is excellent for sequential access as it maximizes compression and reduces the IOPS but it is poor for small random access operations like the ones MySQL/InnoDB does.</p>
</blockquote>

<ul>
<li>In order to improve ZFS performance, I had 3 options:</li>
<li>Increase the ARC size to 7GB</li>
<li>Use a larger Innodb page size like 64KB</li>
<li>Add a L2ARC</li>
</ul>

<blockquote>
<p>I was reluctant to grow the ARC to 7GB, which was nearly half the overall system memory. At best, the ZFS performance would only match XFS. A larger InnoDB page size would increase the CPU load for decompression on an instance with only two vCPUs; not great either. The last option, the L2ARC, was the most promising.</p>
</blockquote>

<blockquote>
<p>ZFS is much more complex than XFS and EXT4 but, that also means it has more tunables/options. I used a simplistic setup and an unfair benchmark which initially led to poor ZFS results. With the same benchmark, very favorable to XFS, I added a ZFS L2ARC and that completely reversed the situation, more than tripling the ZFS results, now 66% above XFS.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>We have seen in this post why the general perception is that ZFS under-performs compared to XFS or EXT4. The presence of B-trees for the files has a big impact on the amount of metadata ZFS needs to handle, especially when the recordsize is small. The metadata consists mostly of the non-leaf pages (or internal nodes) of the B-trees. When properly cached, the performance of ZFS is excellent. ZFS allows you to optimize the use of EBS volumes, both in term of IOPS and size when the instance has fast ephemeral storage devices. Using the ephemeral device of an i3.large instance for the ZFS L2ARC, ZFS outperformed XFS by 66%.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://poolp.org/posts/2018-04-30/opensmtpd-new-config/">OpenSMTPD new config</a></p>

<pre><code>TL;DR:
OpenBSD #p2k18 hackathon took place at Epitech in Nantes.
I was organizing the hackathon but managed to make progress on OpenSMTPD.
As mentioned at EuroBSDCon the one-line per rule config format was a design error.
A new configuration grammar is almost ready and the underlying structures are simplified.
Refactor removes ~750 lines of code and solves _many_ issues that were side-effects of the design error.
New features are going to be unlocked thanks to this.
</code></pre>

<ul>
<li>Anatomy of a design error</li>
</ul>

<blockquote>
<p>OpenSMTPD started ten years ago out of dissatisfaction with other solutions, mainly because I considered them way too complex for me not to get things wrong from time to time.<br>
The initial configuration format was very different, I was inspired by pyr@’s hoststated, which eventually became relayd, and designed my configuration format with blocks enclosed by brackets.<br>
When I first showed OpenSMTPD to pyr@, he convinced me that PF-like one-line rules would be awesome, and it was awesome indeed.<br>
It helped us maintain our goal of simple configuration files, it helped fight feature creeping, it helped us gain popularity and become a relevant MTA, it helped us get where we are now 10 years later.<br>
That being said, I believe this was a design error. A design error that could not have been predicted until we hit the wall to understand WHY this was an error. One-line rules are semantically wrong, they are SMTP wrong, they are wrong.<br>
One-line rules are making the entire daemon more complex, preventing some features from being implemented, making others more complex than they should be, they no longer serve our goals.<br>
To get to the point: we should move to two-line rules :-)</p>
</blockquote>

<p>Anatomy of a design error<br>
OpenSMTPD started ten years ago out of dissatisfaction with other solutions, mainly because I considered them way too complex for me not to get things wrong from time to time.</p>

<p>The initial configuration format was very different, I was inspired by pyr@’s hoststated, which eventually became relayd, and designed my configuration format with blocks enclosed by brackets.</p>

<p>When I first showed OpenSMTPD to pyr@, he convinced me that PF-like one-line rules would be awesome, and it was awesome indeed.</p>

<p>It helped us maintain our goal of simple configuration files, it helped fight feature creeping, it helped us gain popularity and become a relevant MTA, it helped us get where we are now 10 years later.</p>

<p>That being said, I believe this was a design error. A design error that could not have been predicted until we hit the wall to understand WHY this was an error. One-line rules are semantically wrong, they are SMTP wrong, they are wrong.</p>

<p>One-line rules are making the entire daemon more complex, preventing some features from being implemented, making others more complex than they should be, they no longer serve our goals.</p>

<p>To get to the point: we should move to two-line rules :-)</p>

<ul>
<li>The problem with one-line rules</li>
</ul>

<blockquote>
<p>OpenSMTPD decides to accept or reject messages based on one-line rules such as:</p>
</blockquote>

<p><code>accept from any for domain poolp.org deliver to mbox</code></p>

<blockquote>
<p>Which can essentially be split into three units:</p>
</blockquote>

<ul>
<li>the decision: accept/reject</li>
<li>the matching: from any for domain <a href="http://poolp.org">poolp.org</a></li>
<li>the (default) action: deliver to mbox</li>
</ul>

<blockquote>
<p>To ensure that we meet the requirements of the transactions, the matching must be performed during the SMTP transaction before we take a decision for the recipient.<br>
Given that the rule is atomic, that it doesn’t have an identifier and that the action is part of it, the two only ways to make sure we can remember the action to take later on at delivery time is to either:</p>
</blockquote>

<ul>
<li>save the action in the envelope, which is what we do today</li>
<li>evaluate the envelope again at delivery</li>
<li>And this this where it gets tricky… both solutions are NOT ok.</li>
</ul>

<blockquote>
<p>The first solution, which we’ve been using for a decade, was to save the action within the envelope and kind of carve it in stone. This works fine… however it comes with the downsides that errors fixed in configuration files can’t be caught up by envelopes, that delivery action must be validated way ahead of time during the SMTP transaction which is much trickier, that the parsing of delivery methods takes place as the _smtpd user rather than the recipient user, and that envelope structures that are passed all over OpenSMTPD carry delivery-time informations, and more, and more, and more. The code becomes more complex in general, less safe in some particular places, and some areas are nightmarish to deal with because they have to deal with completely unrelated code that can’t be dealt with later in the code path.</p>
</blockquote>

<blockquote>
<p>The second solution can’t be done. An envelope may be the result of nested rules, for example an external client, hitting an alias, hitting a user with a .forward file resolving to a user. An envelope on disk may no longer match any rule or it may match a completely different rule If we could ensure that it matched the same rule, evaluating the ruleset may spawn new envelopes which would violate the transaction. Trying to imagine how we could work around this leads to more and more and more RFC violations, incoherent states, duplicate mails, etc…</p>
</blockquote>

<blockquote>
<p>There is simply no way to deal with this with atomic rules, the matching and the action must be two separate units that are evaluated at two different times, failure to do so will necessarily imply that you’re either using our first solution and all its downsides, or that you are currently in a world of pain trying to figure out why everything is burning around you. The minute the action is written to an on-disk envelope, you have failed.</p>
</blockquote>

<blockquote>
<p>A proper ruleset must define a set of matching patterns resolving to an action identifier that is carved in stone, AND a set of named action set that is resolved dynamically at delivery time.</p>
</blockquote>

<ul>
<li>Follow the link above to see the rest of the article</li>
</ul>

<p><hr></p>

<p><strong>Break</strong></p>

<p>##News Roundup<br>
###<a href="http://fortysomethinggeek.blogspot.com/2012/09/legacy-windows-rsync-backup-to-freenas.html">Backing up a legacy Windows machine to a FreeNAS with rsync</a></p>

<blockquote>
<p>I have some old Windows servers (10 years and counting) and I have been using rsync to back them up to my FreeNAS box. It has been working great for me.</p>
</blockquote>

<blockquote>
<p>First of all, I do have my Windows servers backup in virtualized format. However, those are only one-time snapshops that I run once in a while. These are classic ASP IIS web servers that I can easily put up on a new VM. However, many of these legacy servers generate gigabytes of data a day in their repositories. Running VM conversion daily is not ideal.</p>
</blockquote>

<blockquote>
<p>My solution was to use some sort of rsync solution just for the data repos. I’ve tried some applications that didn’t work too well with Samba shares and these old servers have slow I/O. Copying files to external sata or usb drive was not ideal. We’ve moved on from Windows to Linux and do not have any Windows file servers of capacity to provide network backups.  Hence, I decided to use Delta Copy with FreeNAS. So here is a little write up on how to set it up. I have 4 Windows 2000 servers backing up daily with this method.</p>
</blockquote>

<blockquote>
<p>First, download Delta Copy and install it. It is open-source and pretty much free. It is basically a wrapper for cygwin’s rsync. When you install it, it will ask you to install the Server services which allows you to run it as a Rsync server on Windows. You don’t need to do this. Instead, you will be just using the Delta Copy Client application. But before we do that, we will need to configure our Rsync service for our Windows Clients on FreeNAS.</p>
</blockquote>

<ul>
<li>In FreeNAS, go under Services , Select Rsync &gt;  Rsync Modules &gt; Add Rsync Module.</li>
<li>Then fill out the form; giving the module a name and set the path. In my example, I simply called it WIN and linked it to a user called backupuser.</li>
<li>This process is much easier than trying to configure the daemon rsyncd.conf file by hand.</li>
<li>Now, on the Windows Client, start the DeltaCopy Client. You will create a new Profile.</li>
<li>You will need to enter the IP of the Rsync server (FreeNAS) and specify the module name which will be called “Virtual Directory Name.”  When you pull the select menu, the list of Rsync Modules you created earlier in FreeNAS will populate.</li>
<li>You can set authentication. On the server, you can restrict by IP and do other things to lock down your rsync.</li>
<li>Next, you will add folders (and/or files) you want to synchronize.</li>
<li>Once the paths are set up, you can run a sync by right clicking the profile name.</li>
<li>Here, I made a test sync to a home folder of a virtualized windows box. As you can see, I mounted the rsync volume on my mac to see the progress. The rsync worked beautifully. DeltaCopy did what it was told.</li>
<li>Once you get everything working. The next thing to do is set schedules. If you done tasks schedules in Windows before, it is pretty straightforward. DeltaCopy has a link in the application to directly create a new task for you. I set my backups to run nightly and it has been working great.</li>
</ul>

<blockquote>
<p>There you have it. Windows rsync to FreeNAS using DeltaCopy.<br>
The nice thing about FreeNAS is you don’t have to modify /etc/rsyncd.conf files. Everything can be done in the web admin.</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###<a href="https://r3xnation.wordpress.com/2018/04/10/how-to-write-atf-tests-for-netbsd/amp/">How to write ATF tests for NetBSD</a></p>

<blockquote>
<p>I have recently started contributing to the amazing NetBSD foundation. I was thinking of trying out a new OS for a long time. Switching to the NetBSD OS has been a fun change.</p>
</blockquote>

<blockquote>
<p>My first contribution to the NetBSD foundation was adding regression tests for the Address Sanitizer (ASan) in the Automated Testing Framework(ATF) which NetBSD has. I managed to complete it with the help of my really amazing mentor Kamil. This post is gonna be about the ATF framework that NetBSD has and how to you can add multiple tests with ease.</p>
</blockquote>

<ul>
<li>Intro</li>
</ul>

<blockquote>
<p>In ATF tests we will basically be talking about test programs which are a suite of test cases for a specific application or program.</p>
</blockquote>

<ul>
<li>The ATF suite of Commands</li>
</ul>

<blockquote>
<p>There are a variety of commands that the atf suite offers. These include :</p>
</blockquote>

<ul>
<li>
<p>atf-check: The versatile command that is a vital part of the checking process. man page</p>
</li>
<li>
<p>atf-run: Command used to run a test program. man page</p>
</li>
<li>
<p>atf-fail: Report failure of a test case.</p>
</li>
<li>
<p>atf-report: used to pretty print the atf-run. man page</p>
</li>
<li>
<p>atf-set: To set atf test conditions.</p>
</li>
<li>
<p>We will be taking a better look at the syntax and usage later.</p>
</li>
<li>
<p>Let’s start with the Basics</p>
</li>
</ul>

<blockquote>
<p>The ATF testing framework comes preinstalled with a default NetBSD installation. It is used to write tests for various applications and commands in NetBSD.  One can write the Test programs in either the C language or in shell script. In this post I will be dealing with the Bash part.</p>
</blockquote>

<ul>
<li>Follow the link above to see the rest of the article</li>
</ul>

<p><hr></p>

<p>###<a href="http://brian.candler.me/posts/the-importance-of-zfs-blocksize/">The Importance of ZFS Block Size</a></p>

<ul>
<li>Warning! WARNING! Don’t just do things because some random blog says so</li>
</ul>

<blockquote>
<p>One of the important tunables in ZFS is the recordsize (for normal datasets) and volblocksize (for zvols). These default to 128KB and 8KB respectively.<br>
As I understand it, this is the unit of work in ZFS. If you modify one byte in a large file with the default 128KB record size, it causes the whole 128KB to be read in, one byte to be changed, and a new 128KB block to be written out.<br>
As a result, the official recommendation is to use a block size which aligns with the underlying workload: so for example if you are using a database which reads and writes 16KB chunks then you should use a 16KB block size, and if you are running VMs containing an ext4 filesystem, which uses a 4KB block size, you should set a 4KB block size<br>
You can see it has a 16GB total file size, of which 8.5G has been touched and consumes space - that is, it’s a “sparse” file. The used space is also visible by looking at the zfs filesystem which this file resides in<br>
Then I tried to copy the image file whilst maintaining its “sparseness”, that is, only touching the blocks of the zvol which needed to be touched. The original used only 8.42G, but the copy uses 14.6GB - almost the entire 16GB has been touched! What’s gone wrong?<br>
I finally realised that the difference between the zfs filesystem and the zvol is the block size. I recreated the zvol with a 128K block size<br>
That’s better. The disk usage of the zvol is now exactly the same as for the sparse file in the filesystem dataset</p>
</blockquote>

<ul>
<li>It does impact the read speed too. 4K blocks took 5:52, and 128K blocks took 3:20</li>
<li>Part of this is the amount of metadata that has to be read, see the MySQL benchmarks from earlier in the show</li>
<li>And yes, using a larger block size will increase the compression efficiency, since the compressor has more redundant data to optimize.</li>
<li>Some of the savings, and the speedup is because a lot less metadata had to be written</li>
<li>Your zpool layout also plays a big role, if you use 4Kn disks, and RAID-Z2, using a volblocksize of 8k will actually result in a large amount of wasted space because of RAID-Z padding. Although, if you enable compression, your 8k records may compress to only 4k, and then all the numbers change again.</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.fukr.org.uk/?p=184">Using a Raspberry Pi 2 as a Router on a Stick Starring NetBSD</a></p>

<ul>
<li>Sorry we didn’t answer you quickly enough</li>
</ul>

<blockquote>
<p>A few weeks ago I set about upgrading my feeble networking skills by playing around with a Cisco 2970 switch. I set up a couple of VLANs and found the urge to set up a router to route between them. The 2970 isn’t a modern layer 3 switch so what am I to do?</p>
</blockquote>

<blockquote>
<p>Why not make use of the Raspberry Pi 2 that I’ve never used and put it to some good use as a ‘router on a stick’.</p>
</blockquote>

<blockquote>
<p>I could install a Linux based OS as I am quite familiar with it but where’s the fun in that? In my home lab I use SmartOS which by the way is a shit hot hypervisor but as far as I know there aren’t any Illumos distributions for the Raspberry Pi. On the desktop I use Solus OS which is by far the slickest Linux based OS that I’ve had the pleasure to use but Solus’ focus is purely desktop. It’s looking like BSD then!</p>
</blockquote>

<blockquote>
<p>I believe FreeBSD is renowned for it’s top notch networking stack and so I wrote to the BSDNow show on Jupiter Broadcasting for some help but it seems that the FreeBSD chaps from the show are off on a jolly to some BSD conference or another(love the show by the way).</p>
</blockquote>

<blockquote>
<p>It looks like me and the luvverly NetBSD are on a date this Saturday. I’ve always had a secret love for NetBSD. She’s a beautiful, charming and promiscuous lover(looking at the supported architectures) and I just can’t stop going back to her despite her misgivings(ahem, zfs). Just my type of grrrl!</p>
</blockquote>

<blockquote>
<p>Let’s crack on…</p>
</blockquote>

<ul>
<li>Follow the link above to see the rest of the article</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.bsdjobs.com/">BSD Jobs</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2018-May/000944.html">University of Aberdeen’s Internet Transport Research Group is hiring</a></li>
<li><a href="https://youtu.be/YnNpgtjrM9U">VR demo on OpenBSD via OpenHMD with OSVR HDK2</a></li>
<li><a href="https://rachelbythebay.com/w/2018/04/05/bangpatch/">patch runs ed, and ed can run anything (mentions FreeBSD and OpenBSD)</a></li>
<li><a href="https://github.com/jwilm/alacritty/blob/master/README.md">Alacritty (OpenGL-powered terminal emulator) now supports OpenBSD</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180413065457">MAP_STACK Stack Register Checking Committed to -current</a></li>
<li><a href="https://2018.eurobsdcon.org/call-for-papers/">EuroBSDCon CfP till June 17, 2018</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>NeutronDaemon - <a href="http://dpaste.com/3E0SR5Y#wrap">Tutorial request</a></li>
<li>Kurt - <a href="http://dpaste.com/01CWKM5#wrap">Question about transferability/bi-directionality of ZFS snapshots and send/receive</a></li>
<li>Peter - <a href="http://dpaste.com/3N1BGQF#wrap">A Question and much love for BSD Now</a></li>
<li>Peter - <a href="http://dpaste.com/20R2DTG">netgraph state</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenZFS and DTrace updates in NetBSD, NetBSD network security stack audit, Performance of MySQL on ZFS, OpenSMTP results from p2k18, legacy Windows backup to FreeNAS, ZFS block size importance, and NetBSD as router on a stick.<br>
<hr></p>

<p>##Headlines<br>
###<a href="https://mail-index.netbsd.org/source-changes/2018/05/28/msg095541.html">ZFS and DTrace update lands in NetBSD</a></p>

<blockquote>
<p>merge a new version of the CDDL dtrace and ZFS code. This changes the upstream vendor from OpenSolaris to FreeBSD, and this version is based on FreeBSD svn r315983.</p>
</blockquote>

<ul>
<li>r315983 is from March 2017 (14 months ago), so there is still more work to do</li>
</ul>

<blockquote>
<p>in addition to the 10 years of improvements from upstream, this version also has these NetBSD-specific enhancements:</p>
<ul>
<li>dtrace FBT probes can now be placed in kernel modules.</li>
<li>ZFS now supports mmap().</li>
</ul>
</blockquote>

<ul>
<li>This brings NetBSD 10 years forward, and they should be able to catch the rest of the way up fairly quickly</li>
</ul>

<p><hr></p>

<p>###<a href="https://blog.netbsd.org/tnf/entry/network_security_audit">NetBSD network stack security audit</a></p>

<ul>
<li>Maxime Villard has been working on an audit of the NetBSD network stack, a project sponsored by The NetBSD Foundation, which has served all users of BSD-derived operating systems.</li>
</ul>

<blockquote>
<p>Over the last five months, hundreds of patches were committed to the source tree as a result of this work. Dozens of bugs were fixed, among which a good number of actual, remotely-triggerable vulnerabilities.</p>
</blockquote>

<blockquote>
<p>Changes were made to strengthen the networking subsystems and improve code quality: reinforce the mbuf API, add many KASSERTs to enforce assumptions, simplify packet handling, and verify compliance with RFCs. This was done in several layers of the NetBSD kernel, from device drivers to L4 handlers.<br>
In the course of investigating several bugs discovered in NetBSD, I happened to look at the network stacks of other operating systems, to see whether they had already fixed the issues, and if so how. Needless to say, I found bugs there too.</p>
</blockquote>

<ul>
<li>A lot of code is shared between the BSDs, so it is especially helpful when one finds a bug, to check the other BSDs and share the fix.</li>
</ul>

<blockquote>
<p>The IPv6 Buffer Overflow: The overflow allowed an attacker to write one byte of packet-controlled data into ‘packet_storage+off’, where ‘off’ could be approximately controlled too. This allowed at least a pretty bad remote DoS/Crash<br>
The IPsec Infinite Loop: When receiving an IPv6-AH packet, the IPsec entry point was not correctly computing the length of the IPv6 suboptions, and this, before authentication. As a result, a specially-crafted IPv6 packet could trigger an infinite loop in the kernel (making it unresponsive). In addition this flaw allowed a limited buffer overflow - where the data being written was however not controllable by the attacker.<br>
The IPPROTO Typo: While looking at the IPv6 Multicast code, I stumbled across a pretty simple yet pretty bad mistake: at one point the Pim6 entry point would return IPPROTO_NONE instead of IPPROTO_DONE. Returning IPPROTO_NONE was entirely wrong: it caused the kernel to keep iterating on the IPv6 packet chain, while the packet storage was already freed.<br>
The PF Signedness Bug: A bug was found in NetBSD’s implementation of the PF firewall, that did not affect the other BSDs. In the initial PF code a particular macro was used as an alias to a number. This macro formed a signed integer. NetBSD replaced the macro with a sizeof(), which returns an unsigned result.<br>
The NPF Integer Overflow: An integer overflow could be triggered in NPF, when parsing an IPv6 packet with large options. This could cause NPF to look for the L4 payload at the wrong offset within the packet, and it allowed an attacker to bypass any L4 filtering rule on IPv6.<br>
The IPsec Fragment Attack: I noticed some time ago that when reassembling fragments (in either IPv4 or IPv6), the kernel was not removing the M_PKTHDR flag on the secondary mbufs in mbuf chains. This flag is supposed to indicate that a given mbuf is the head of the chain it forms; having the flag on secondary mbufs was suspicious.<br>
What Now: Not all protocols and layers of the network stack were verified, because of time constraints, and also because of unexpected events: the recent x86 CPU bugs, which I was the only one able to fix promptly. A todo list will be left when the project end date is reached, for someone else to pick up. Me perhaps, later this year? We’ll see.<br>
This security audit of NetBSD’s network stack is sponsored by The NetBSD Foundation, and serves all users of BSD-derived operating systems. The NetBSD Foundation is a non-profit organization, and welcomes any donations that help continue funding projects of this kind.</p>
</blockquote>

<p><hr></p>

<p><strong>DigitalOcean</strong></p>

<p>###<a href="https://www.percona.com/blog/2018/05/15/about-zfs-performance/">MySQL on ZFS Performance</a></p>

<blockquote>
<p>I used sysbench to create a table of 10M rows and then, using export/import tablespace, I copied it 329 times. I ended up with 330 tables for a total size of about 850GB. The dataset generated by sysbench is not very compressible, so I used lz4 compression in ZFS. For the other ZFS settings, I used what can be found in my earlier ZFS posts but with the ARC size limited to 1GB. I then used that plain configuration for the first benchmarks. Here are the results with the sysbench point-select benchmark, a uniform distribution and eight threads. The InnoDB buffer pool was set to 2.5GB.<br>
In both cases, the load is IO bound. The disk is doing exactly the allowed 3000 IOPS. The above graph appears to be a clear demonstration that XFS is much faster than ZFS, right? But is that really the case? The way the dataset has been created is extremely favorable to XFS since there is absolutely no file fragmentation. Once you have all the files opened, a read IOP is just a single fseek call to an offset and ZFS doesn’t need to access any intermediate inode. The above result is about as fair as saying MyISAM is faster than InnoDB based only on table scan performance results of unfragmented tables and default configuration. ZFS is much less affected by the file level fragmentation, especially for point access type.</p>
</blockquote>

<blockquote>
<p>ZFS stores the files in B-trees in a very similar fashion as InnoDB stores data. To access a piece of data in a B-tree, you need to access the top level page (often called root node) and then one block per level down to a leaf-node containing the data. With no cache, to read something from a three levels B-tree thus requires 3 IOPS.</p>
</blockquote>

<blockquote>
<p>The extra IOPS performed by ZFS are needed to access those internal blocks in the B-trees of the files. These internal blocks are labeled as metadata. Essentially, in the above benchmark, the ARC is too small to contain all the internal blocks of the table files’ B-trees. If we continue the comparison with InnoDB, it would be like running with a buffer pool too small to contain the non-leaf pages. The test dataset I used has about 600MB of non-leaf pages, about 0.1% of the total size, which was well cached by the 3GB buffer pool. So only one InnoDB page, a leaf page, needed to be read per point-select statement.</p>
</blockquote>

<blockquote>
<p>To correctly set the ARC size to cache the metadata, you have two choices. First, you can guess values for the ARC size and experiment. Second, you can try to evaluate it by looking at the ZFS internal data. Let’s review these two approaches.</p>
</blockquote>

<blockquote>
<p>You’ll read/hear often the ratio 1GB of ARC for 1TB of data, which is about the same 0.1% ratio as for InnoDB. I wrote about that ratio a few times, having nothing better to propose. Actually, I found it depends a lot on the recordsize used. The 0.1% ratio implies a ZFS recordsize of 128KB. A ZFS filesystem with a recordsize of 128KB will use much less metadata than another one using a recordsize of 16KB because it has 8x fewer leaf pages. Fewer leaf pages require less B-tree internal nodes, hence less metadata. A filesystem with a recordsize of 128KB is excellent for sequential access as it maximizes compression and reduces the IOPS but it is poor for small random access operations like the ones MySQL/InnoDB does.</p>
</blockquote>

<ul>
<li>In order to improve ZFS performance, I had 3 options:</li>
<li>Increase the ARC size to 7GB</li>
<li>Use a larger Innodb page size like 64KB</li>
<li>Add a L2ARC</li>
</ul>

<blockquote>
<p>I was reluctant to grow the ARC to 7GB, which was nearly half the overall system memory. At best, the ZFS performance would only match XFS. A larger InnoDB page size would increase the CPU load for decompression on an instance with only two vCPUs; not great either. The last option, the L2ARC, was the most promising.</p>
</blockquote>

<blockquote>
<p>ZFS is much more complex than XFS and EXT4 but, that also means it has more tunables/options. I used a simplistic setup and an unfair benchmark which initially led to poor ZFS results. With the same benchmark, very favorable to XFS, I added a ZFS L2ARC and that completely reversed the situation, more than tripling the ZFS results, now 66% above XFS.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>We have seen in this post why the general perception is that ZFS under-performs compared to XFS or EXT4. The presence of B-trees for the files has a big impact on the amount of metadata ZFS needs to handle, especially when the recordsize is small. The metadata consists mostly of the non-leaf pages (or internal nodes) of the B-trees. When properly cached, the performance of ZFS is excellent. ZFS allows you to optimize the use of EBS volumes, both in term of IOPS and size when the instance has fast ephemeral storage devices. Using the ephemeral device of an i3.large instance for the ZFS L2ARC, ZFS outperformed XFS by 66%.</p>
</blockquote>

<p><hr></p>

<p>###<a href="https://poolp.org/posts/2018-04-30/opensmtpd-new-config/">OpenSMTPD new config</a></p>

<pre><code>TL;DR:
OpenBSD #p2k18 hackathon took place at Epitech in Nantes.
I was organizing the hackathon but managed to make progress on OpenSMTPD.
As mentioned at EuroBSDCon the one-line per rule config format was a design error.
A new configuration grammar is almost ready and the underlying structures are simplified.
Refactor removes ~750 lines of code and solves _many_ issues that were side-effects of the design error.
New features are going to be unlocked thanks to this.
</code></pre>

<ul>
<li>Anatomy of a design error</li>
</ul>

<blockquote>
<p>OpenSMTPD started ten years ago out of dissatisfaction with other solutions, mainly because I considered them way too complex for me not to get things wrong from time to time.<br>
The initial configuration format was very different, I was inspired by pyr@’s hoststated, which eventually became relayd, and designed my configuration format with blocks enclosed by brackets.<br>
When I first showed OpenSMTPD to pyr@, he convinced me that PF-like one-line rules would be awesome, and it was awesome indeed.<br>
It helped us maintain our goal of simple configuration files, it helped fight feature creeping, it helped us gain popularity and become a relevant MTA, it helped us get where we are now 10 years later.<br>
That being said, I believe this was a design error. A design error that could not have been predicted until we hit the wall to understand WHY this was an error. One-line rules are semantically wrong, they are SMTP wrong, they are wrong.<br>
One-line rules are making the entire daemon more complex, preventing some features from being implemented, making others more complex than they should be, they no longer serve our goals.<br>
To get to the point: we should move to two-line rules :-)</p>
</blockquote>

<p>Anatomy of a design error<br>
OpenSMTPD started ten years ago out of dissatisfaction with other solutions, mainly because I considered them way too complex for me not to get things wrong from time to time.</p>

<p>The initial configuration format was very different, I was inspired by pyr@’s hoststated, which eventually became relayd, and designed my configuration format with blocks enclosed by brackets.</p>

<p>When I first showed OpenSMTPD to pyr@, he convinced me that PF-like one-line rules would be awesome, and it was awesome indeed.</p>

<p>It helped us maintain our goal of simple configuration files, it helped fight feature creeping, it helped us gain popularity and become a relevant MTA, it helped us get where we are now 10 years later.</p>

<p>That being said, I believe this was a design error. A design error that could not have been predicted until we hit the wall to understand WHY this was an error. One-line rules are semantically wrong, they are SMTP wrong, they are wrong.</p>

<p>One-line rules are making the entire daemon more complex, preventing some features from being implemented, making others more complex than they should be, they no longer serve our goals.</p>

<p>To get to the point: we should move to two-line rules :-)</p>

<ul>
<li>The problem with one-line rules</li>
</ul>

<blockquote>
<p>OpenSMTPD decides to accept or reject messages based on one-line rules such as:</p>
</blockquote>

<p><code>accept from any for domain poolp.org deliver to mbox</code></p>

<blockquote>
<p>Which can essentially be split into three units:</p>
</blockquote>

<ul>
<li>the decision: accept/reject</li>
<li>the matching: from any for domain <a href="http://poolp.org">poolp.org</a></li>
<li>the (default) action: deliver to mbox</li>
</ul>

<blockquote>
<p>To ensure that we meet the requirements of the transactions, the matching must be performed during the SMTP transaction before we take a decision for the recipient.<br>
Given that the rule is atomic, that it doesn’t have an identifier and that the action is part of it, the two only ways to make sure we can remember the action to take later on at delivery time is to either:</p>
</blockquote>

<ul>
<li>save the action in the envelope, which is what we do today</li>
<li>evaluate the envelope again at delivery</li>
<li>And this this where it gets tricky… both solutions are NOT ok.</li>
</ul>

<blockquote>
<p>The first solution, which we’ve been using for a decade, was to save the action within the envelope and kind of carve it in stone. This works fine… however it comes with the downsides that errors fixed in configuration files can’t be caught up by envelopes, that delivery action must be validated way ahead of time during the SMTP transaction which is much trickier, that the parsing of delivery methods takes place as the _smtpd user rather than the recipient user, and that envelope structures that are passed all over OpenSMTPD carry delivery-time informations, and more, and more, and more. The code becomes more complex in general, less safe in some particular places, and some areas are nightmarish to deal with because they have to deal with completely unrelated code that can’t be dealt with later in the code path.</p>
</blockquote>

<blockquote>
<p>The second solution can’t be done. An envelope may be the result of nested rules, for example an external client, hitting an alias, hitting a user with a .forward file resolving to a user. An envelope on disk may no longer match any rule or it may match a completely different rule If we could ensure that it matched the same rule, evaluating the ruleset may spawn new envelopes which would violate the transaction. Trying to imagine how we could work around this leads to more and more and more RFC violations, incoherent states, duplicate mails, etc…</p>
</blockquote>

<blockquote>
<p>There is simply no way to deal with this with atomic rules, the matching and the action must be two separate units that are evaluated at two different times, failure to do so will necessarily imply that you’re either using our first solution and all its downsides, or that you are currently in a world of pain trying to figure out why everything is burning around you. The minute the action is written to an on-disk envelope, you have failed.</p>
</blockquote>

<blockquote>
<p>A proper ruleset must define a set of matching patterns resolving to an action identifier that is carved in stone, AND a set of named action set that is resolved dynamically at delivery time.</p>
</blockquote>

<ul>
<li>Follow the link above to see the rest of the article</li>
</ul>

<p><hr></p>

<p><strong>Break</strong></p>

<p>##News Roundup<br>
###<a href="http://fortysomethinggeek.blogspot.com/2012/09/legacy-windows-rsync-backup-to-freenas.html">Backing up a legacy Windows machine to a FreeNAS with rsync</a></p>

<blockquote>
<p>I have some old Windows servers (10 years and counting) and I have been using rsync to back them up to my FreeNAS box. It has been working great for me.</p>
</blockquote>

<blockquote>
<p>First of all, I do have my Windows servers backup in virtualized format. However, those are only one-time snapshops that I run once in a while. These are classic ASP IIS web servers that I can easily put up on a new VM. However, many of these legacy servers generate gigabytes of data a day in their repositories. Running VM conversion daily is not ideal.</p>
</blockquote>

<blockquote>
<p>My solution was to use some sort of rsync solution just for the data repos. I’ve tried some applications that didn’t work too well with Samba shares and these old servers have slow I/O. Copying files to external sata or usb drive was not ideal. We’ve moved on from Windows to Linux and do not have any Windows file servers of capacity to provide network backups.  Hence, I decided to use Delta Copy with FreeNAS. So here is a little write up on how to set it up. I have 4 Windows 2000 servers backing up daily with this method.</p>
</blockquote>

<blockquote>
<p>First, download Delta Copy and install it. It is open-source and pretty much free. It is basically a wrapper for cygwin’s rsync. When you install it, it will ask you to install the Server services which allows you to run it as a Rsync server on Windows. You don’t need to do this. Instead, you will be just using the Delta Copy Client application. But before we do that, we will need to configure our Rsync service for our Windows Clients on FreeNAS.</p>
</blockquote>

<ul>
<li>In FreeNAS, go under Services , Select Rsync &gt;  Rsync Modules &gt; Add Rsync Module.</li>
<li>Then fill out the form; giving the module a name and set the path. In my example, I simply called it WIN and linked it to a user called backupuser.</li>
<li>This process is much easier than trying to configure the daemon rsyncd.conf file by hand.</li>
<li>Now, on the Windows Client, start the DeltaCopy Client. You will create a new Profile.</li>
<li>You will need to enter the IP of the Rsync server (FreeNAS) and specify the module name which will be called “Virtual Directory Name.”  When you pull the select menu, the list of Rsync Modules you created earlier in FreeNAS will populate.</li>
<li>You can set authentication. On the server, you can restrict by IP and do other things to lock down your rsync.</li>
<li>Next, you will add folders (and/or files) you want to synchronize.</li>
<li>Once the paths are set up, you can run a sync by right clicking the profile name.</li>
<li>Here, I made a test sync to a home folder of a virtualized windows box. As you can see, I mounted the rsync volume on my mac to see the progress. The rsync worked beautifully. DeltaCopy did what it was told.</li>
<li>Once you get everything working. The next thing to do is set schedules. If you done tasks schedules in Windows before, it is pretty straightforward. DeltaCopy has a link in the application to directly create a new task for you. I set my backups to run nightly and it has been working great.</li>
</ul>

<blockquote>
<p>There you have it. Windows rsync to FreeNAS using DeltaCopy.<br>
The nice thing about FreeNAS is you don’t have to modify /etc/rsyncd.conf files. Everything can be done in the web admin.</p>
</blockquote>

<p><hr></p>

<p><strong>iXsystems</strong></p>

<p>###<a href="https://r3xnation.wordpress.com/2018/04/10/how-to-write-atf-tests-for-netbsd/amp/">How to write ATF tests for NetBSD</a></p>

<blockquote>
<p>I have recently started contributing to the amazing NetBSD foundation. I was thinking of trying out a new OS for a long time. Switching to the NetBSD OS has been a fun change.</p>
</blockquote>

<blockquote>
<p>My first contribution to the NetBSD foundation was adding regression tests for the Address Sanitizer (ASan) in the Automated Testing Framework(ATF) which NetBSD has. I managed to complete it with the help of my really amazing mentor Kamil. This post is gonna be about the ATF framework that NetBSD has and how to you can add multiple tests with ease.</p>
</blockquote>

<ul>
<li>Intro</li>
</ul>

<blockquote>
<p>In ATF tests we will basically be talking about test programs which are a suite of test cases for a specific application or program.</p>
</blockquote>

<ul>
<li>The ATF suite of Commands</li>
</ul>

<blockquote>
<p>There are a variety of commands that the atf suite offers. These include :</p>
</blockquote>

<ul>
<li>
<p>atf-check: The versatile command that is a vital part of the checking process. man page</p>
</li>
<li>
<p>atf-run: Command used to run a test program. man page</p>
</li>
<li>
<p>atf-fail: Report failure of a test case.</p>
</li>
<li>
<p>atf-report: used to pretty print the atf-run. man page</p>
</li>
<li>
<p>atf-set: To set atf test conditions.</p>
</li>
<li>
<p>We will be taking a better look at the syntax and usage later.</p>
</li>
<li>
<p>Let’s start with the Basics</p>
</li>
</ul>

<blockquote>
<p>The ATF testing framework comes preinstalled with a default NetBSD installation. It is used to write tests for various applications and commands in NetBSD.  One can write the Test programs in either the C language or in shell script. In this post I will be dealing with the Bash part.</p>
</blockquote>

<ul>
<li>Follow the link above to see the rest of the article</li>
</ul>

<p><hr></p>

<p>###<a href="http://brian.candler.me/posts/the-importance-of-zfs-blocksize/">The Importance of ZFS Block Size</a></p>

<ul>
<li>Warning! WARNING! Don’t just do things because some random blog says so</li>
</ul>

<blockquote>
<p>One of the important tunables in ZFS is the recordsize (for normal datasets) and volblocksize (for zvols). These default to 128KB and 8KB respectively.<br>
As I understand it, this is the unit of work in ZFS. If you modify one byte in a large file with the default 128KB record size, it causes the whole 128KB to be read in, one byte to be changed, and a new 128KB block to be written out.<br>
As a result, the official recommendation is to use a block size which aligns with the underlying workload: so for example if you are using a database which reads and writes 16KB chunks then you should use a 16KB block size, and if you are running VMs containing an ext4 filesystem, which uses a 4KB block size, you should set a 4KB block size<br>
You can see it has a 16GB total file size, of which 8.5G has been touched and consumes space - that is, it’s a “sparse” file. The used space is also visible by looking at the zfs filesystem which this file resides in<br>
Then I tried to copy the image file whilst maintaining its “sparseness”, that is, only touching the blocks of the zvol which needed to be touched. The original used only 8.42G, but the copy uses 14.6GB - almost the entire 16GB has been touched! What’s gone wrong?<br>
I finally realised that the difference between the zfs filesystem and the zvol is the block size. I recreated the zvol with a 128K block size<br>
That’s better. The disk usage of the zvol is now exactly the same as for the sparse file in the filesystem dataset</p>
</blockquote>

<ul>
<li>It does impact the read speed too. 4K blocks took 5:52, and 128K blocks took 3:20</li>
<li>Part of this is the amount of metadata that has to be read, see the MySQL benchmarks from earlier in the show</li>
<li>And yes, using a larger block size will increase the compression efficiency, since the compressor has more redundant data to optimize.</li>
<li>Some of the savings, and the speedup is because a lot less metadata had to be written</li>
<li>Your zpool layout also plays a big role, if you use 4Kn disks, and RAID-Z2, using a volblocksize of 8k will actually result in a large amount of wasted space because of RAID-Z padding. Although, if you enable compression, your 8k records may compress to only 4k, and then all the numbers change again.</li>
</ul>

<p><hr></p>

<p>###<a href="https://www.fukr.org.uk/?p=184">Using a Raspberry Pi 2 as a Router on a Stick Starring NetBSD</a></p>

<ul>
<li>Sorry we didn’t answer you quickly enough</li>
</ul>

<blockquote>
<p>A few weeks ago I set about upgrading my feeble networking skills by playing around with a Cisco 2970 switch. I set up a couple of VLANs and found the urge to set up a router to route between them. The 2970 isn’t a modern layer 3 switch so what am I to do?</p>
</blockquote>

<blockquote>
<p>Why not make use of the Raspberry Pi 2 that I’ve never used and put it to some good use as a ‘router on a stick’.</p>
</blockquote>

<blockquote>
<p>I could install a Linux based OS as I am quite familiar with it but where’s the fun in that? In my home lab I use SmartOS which by the way is a shit hot hypervisor but as far as I know there aren’t any Illumos distributions for the Raspberry Pi. On the desktop I use Solus OS which is by far the slickest Linux based OS that I’ve had the pleasure to use but Solus’ focus is purely desktop. It’s looking like BSD then!</p>
</blockquote>

<blockquote>
<p>I believe FreeBSD is renowned for it’s top notch networking stack and so I wrote to the BSDNow show on Jupiter Broadcasting for some help but it seems that the FreeBSD chaps from the show are off on a jolly to some BSD conference or another(love the show by the way).</p>
</blockquote>

<blockquote>
<p>It looks like me and the luvverly NetBSD are on a date this Saturday. I’ve always had a secret love for NetBSD. She’s a beautiful, charming and promiscuous lover(looking at the supported architectures) and I just can’t stop going back to her despite her misgivings(ahem, zfs). Just my type of grrrl!</p>
</blockquote>

<blockquote>
<p>Let’s crack on…</p>
</blockquote>

<ul>
<li>Follow the link above to see the rest of the article</li>
</ul>

<p><hr></p>

<p>##Beastie Bits</p>

<ul>
<li><a href="https://www.bsdjobs.com/">BSD Jobs</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2018-May/000944.html">University of Aberdeen’s Internet Transport Research Group is hiring</a></li>
<li><a href="https://youtu.be/YnNpgtjrM9U">VR demo on OpenBSD via OpenHMD with OSVR HDK2</a></li>
<li><a href="https://rachelbythebay.com/w/2018/04/05/bangpatch/">patch runs ed, and ed can run anything (mentions FreeBSD and OpenBSD)</a></li>
<li><a href="https://github.com/jwilm/alacritty/blob/master/README.md">Alacritty (OpenGL-powered terminal emulator) now supports OpenBSD</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180413065457">MAP_STACK Stack Register Checking Committed to -current</a></li>
<li><a href="https://2018.eurobsdcon.org/call-for-papers/">EuroBSDCon CfP till June 17, 2018</a></li>
</ul>

<p><hr></p>

<p><strong>Tarsnap</strong></p>

<p>##Feedback/Questions</p>

<ul>
<li>NeutronDaemon - <a href="http://dpaste.com/3E0SR5Y#wrap">Tutorial request</a></li>
<li>Kurt - <a href="http://dpaste.com/01CWKM5#wrap">Question about transferability/bi-directionality of ZFS snapshots and send/receive</a></li>
<li>Peter - <a href="http://dpaste.com/3N1BGQF#wrap">A Question and much love for BSD Now</a></li>
<li>Peter - <a href="http://dpaste.com/20R2DTG">netgraph state</a></li>
</ul>

<p><hr></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 248: Show Me The Mooney | BSD Now 248</title>
  <link>https://www.bsdnow.tv/248</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-2016</guid>
  <pubDate>Tue, 29 May 2018 14:30:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a0ea5b3c-e781-499e-bfa4-cee1d550f915.mp3" length="62803024" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>DragonflyBSD release 5.2.1 is here, BPF kernel exploit writeup, Remote Debugging the running OpenBSD kernel, interview with Patrick Mooney, FreeBSD buildbot setup in a jail, dumping your USB, and 5 years of gaming on FreeBSD.</itunes:subtitle>
  <itunes:duration>1:44:33</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>DragonflyBSD release 5.2.1 is here, BPF kernel exploit writeup, Remote Debugging the running OpenBSD kernel, interview with Patrick Mooney, FreeBSD buildbot setup in a jail, dumping your USB, and 5 years of gaming on FreeBSD.
&lt;h2&gt;Headlines&lt;/h2&gt;
&lt;h3&gt;&lt;a href="https://www.dragonflybsd.org/release52/"&gt;DragonFlyBSD: release52 (w/stable HAMMER2, as default root)&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;DragonflyBSD 5.2.1 was released on May 21, 2018&lt;/li&gt;
&lt;li&gt;&amp;gt; Big Ticket items:


&lt;blockquote&gt;
  Meltdown and Spectre mitigation support
  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectre&lt;em&gt;mitigation and machdep.meltdown&lt;/em&gt;mitigation.
  HAMMER2
  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.
  Clustered support is not yet available.
  ipfw Updates
  Implement state based "redirect", i.e. without using libalias.
  ipfw now supports all possible ICMP types.
  Fix ICMP&lt;em&gt;MAXTYPE assumptions (now 40 as of this release).
  Improved graphics support
  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs
  Add 24-bit pixel format support to the EFI frame buffer code.
  Significantly improve fbio support for the "scfb" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.
  Partly implement the FBIO&lt;/em&gt;BLANK ioctl for display powersaving.
  Syscons waits for drm modesetting at appropriate places, avoiding races.&lt;/blockquote&gt;
&lt;/li&gt;
  &lt;/ul&gt;
  &lt;hr&gt;


&lt;h3&gt;&lt;a href="https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md"&gt;PS4 4.55 BPF Race Condition Kernel Exploit Writeup&lt;/a&gt;&lt;/h3&gt;



&lt;blockquote&gt;
  &lt;p&gt;Note: While this bug is primarily interesting for exploitation on the PS4, this bug can also potentially be exploited on other unpatched platforms using FreeBSD if the attacker has read/write permissions on /dev/bpf, or if they want to escalate from root user to kernel code execution. As such, I've published it under the "FreeBSD" folder and not the "PS4" folder.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Introduction&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Welcome to the kernel portion of the PS4 4.55FW full exploit chain write-up. This bug was found by qwerty, and is fairly unique in the way it's exploited, so I wanted to do a detailed write-up on how it worked. The full source of the exploit can be found &lt;a href="https://github.com/Cryptogenic/PS4-4.55-Kernel-Exploit"&gt;here&lt;/a&gt;. I've previously covered the webkit exploit implementation for userland access &lt;a href="https://github.com/Cryptogenic/Exploit-Writeups/blob/master/WebKit/setAttributeNodeNS%20UAF%20Write-up.md"&gt;here&lt;/a&gt;.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;FreeBSD or Sony's fault? Why not both...&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Interestingly, this bug is actually a FreeBSD bug and was not (at least directly) introduced by Sony code. While this is a FreeBSD bug however, it's not very useful for most systems because the /dev/bpf device driver is root-owned, and the permissions for it are set to 0600 (meaning owner has read/write privileges, and nobody else does) - though it can be used for escalating from root to kernel mode code execution. However, let’s take a look at the make_dev() call inside the PS4 kernel for /dev/bpf (taken from a 4.05 kernel dump).&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;&lt;code&gt;
seg000:FFFFFFFFA181F15B                 lea     rdi, unk_FFFFFFFFA2D77640
seg000:FFFFFFFFA181F162                 lea     r9, aBpf        ; "bpf"
seg000:FFFFFFFFA181F169                 mov     esi, 0
seg000:FFFFFFFFA181F16E                 mov     edx, 0
seg000:FFFFFFFFA181F173                 xor     ecx, ecx
seg000:FFFFFFFFA181F175                 mov     r8d, 1B6h
seg000:FFFFFFFFA181F17B                 xor     eax, eax
seg000:FFFFFFFFA181F17D                 mov     cs:qword_FFFFFFFFA34EC770, 0
seg000:FFFFFFFFA181F188                 call    make_dev
&lt;/code&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;We see UID 0 (the UID for the root user) getting moved into the register for the 3rd argument, which is the owner argument. However, the permissions bits are being set to 0x1B6, which in octal is 0666. This means anyone can open /dev/bpf with read/write privileges. I’m not sure why this is the case, qwerty speculates that perhaps bpf is used for LAN gaming. In any case, this was a poor design decision because bpf is usually considered privileged, and should not be accessible to a process that is completely untrusted, such as WebKit. On most platforms, permissions for /dev/bpf will be set to 0x180, or 0600.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Race Conditions - What are they?&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;The class of the bug abused in this exploit is known as a "race condition". Before we get into bug specifics, it's important for the reader to understand what race conditions are and how they can be an issue (especially in something like a kernel). Often in complex software (such as a kernel), resources will be shared (or "global"). This means other threads could potentially execute code that will access some resource that could be accessed by another thread at the same point in time. What happens if one thread accesses this resource while another thread does without exclusive access? Race conditions are introduced.&lt;/p&gt;
  
  &lt;p&gt;Race conditions are defined as possible scenarios where events happen in a sequence different than the developer intended which leads to undefined behavior. In simple, single-threaded programs, this is not an issue because execution is linear. In more complex programs where code can be running in parallel however, this becomes a real issue. To prevent these problems, atomic instructions and locking mechanisms were introduced. When one thread wants to access a critical resource, it will attempt to acquire a "lock". If another thread is already using this resource, generally the thread attempting to acquire the lock will wait until the other thread is finished with it. Each thread must release the lock to the resource after they're done with it, failure to do so could result in a deadlock.&lt;/p&gt;
  
  &lt;p&gt;While locking mechanisms such as mutexes have been introduced, developers sometimes struggle to use them properly. For example, what if a piece of shared data gets validated and processed, but while the processing of the data is locked, the validation is not? There is a window between validation and locking where that data can change, and while the developer thinks the data has been validated, it could be substituted with something malicious after it is validated, but before it is used. Parallel programming can be difficult, especially when, as a developer, you also want to factor in the fact that you don't want to put too much code in between locking and unlocking as it can impact performance.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;See &lt;a href="https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md"&gt;article&lt;/a&gt; for the rest&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;/p&gt;

&lt;h3&gt;&lt;a href="http://bijanebrahimi.github.io/blog/remote-debugging-the-running-openbsd-kernel.html"&gt;Remote Debugging the running OpenBSD kernel&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;Subtitled: A way to understand the OpenBSD internals
+&amp;gt; The Problem
+&amp;gt; A few month ago, I tried porting the FreeBSD kdb along with it's gdb stub implementations to OpenBSD as a practice of learning the internals of an BSD operating system. The ddb code in both FreeBSD and OpenBSD looks pretty much the same and the GDB Remote Serial Protocol looks very minimal.
+&amp;gt; But sadly I got very busy and the work is stalled but I'm planning on resuming the attempt as soon as I get the chance, But there is an alternative way to Debugging the OpenBSD kernel via QEMU. What I did below is basically the same with a few minor changes which I hope to describe it as best.
+&amp;gt; Installing OpenBSD on Qemu
+&amp;gt; For debugging the kernel, we need a working OpenBSD system running on Qemu. I chose to create a raw disk file to be able to easily mount it later via the host and copy the custom kernel onto it.


&lt;blockquote&gt;
  $ qemu-img create -f raw disk.raw 5G
  $ qemu-system-x86&lt;em&gt;64 -m 256M \
  -drive format=raw,file=install63.fs \
  -drive format=raw,file=disk.raw
  +&amp;gt; Custom Kernel
  +&amp;gt; To debug the kernel, we need a version of the kernel with debugging symbols and for that we have to recompile it first. The process is documented at Building the System from Source:
  ...
  +&amp;gt; Then we can copy the bsd kernel to the guest machine and keep the bsd.gdb on the host to start the remote debugging via gdb.
  +&amp;gt; Remote debugging kernel
  +&amp;gt; Now it's to time to boot the guest with the new custom kernel. Remember that the -s argument enables the gdb server on qemu on localhost port 1234 by default:
  $ qemu-system-x86&lt;/em&gt;64 -m 256M -s \
     -net nic -net user \
  -drive format=raw,file=install63.fs \
  +&amp;gt; Now to finally attach to the running kernel:&lt;/blockquote&gt;
&lt;/li&gt;
  &lt;/ul&gt;
  &lt;hr&gt;


&lt;h2&gt;Interview - Patrick Mooney - Software Engineer &lt;a href="pmooney@pfmooney.com"&gt;pmooney@pfmooney.com&lt;/a&gt; / &lt;a href="https://twitter.com/pfmooney"&gt;@pfmooney&lt;/a&gt;
&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;BR: How did you first get introduced to UNIX?&lt;/li&gt;
&lt;li&gt;AJ: What got you started contributing to an open source project?&lt;/li&gt;
&lt;li&gt;BR: What sorts of things have you worked on in the past?&lt;/li&gt;
&lt;li&gt;AJ: Can you tell us more about what attracted you to illumos?&lt;/li&gt;
&lt;li&gt;BR: How did you get interested in, and started with, systems development?&lt;/li&gt;
&lt;li&gt;AJ: When did you first get interested in bhyve?&lt;/li&gt;
&lt;li&gt;BR: How much work was it to take the years-old port of bhyve and get it working on modern IllumOS?&lt;/li&gt;
&lt;li&gt;AJ: What was the process for getting the bhyve port caught up to current FreeBSD?&lt;/li&gt;
&lt;li&gt;BR: How usable is bhyve on illumOS?&lt;/li&gt;
&lt;li&gt;AJ: What area are you most interested in improving in bhyve?&lt;/li&gt;
&lt;li&gt;BR: Do you think the FreeBSD and illumos versions of bhyve will stay in sync with each other?&lt;/li&gt;
&lt;li&gt;AJ: What do you do for fun?&lt;/li&gt;
&lt;li&gt;BR: Anything else you want to mention?&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails"&gt;Setting up buildbot in FreeBSD Jails&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;In this article, I would like to present a tutorial to set up buildbot, a continuous integration (CI) software (like Jenkins, drone, etc.), making use of FreeBSD’s containerization mechanism "jails". We will cover terminology, rationale for using both buildbot and jails together, and installation steps. At the end, you will have a working buildbot instance using its sample build configuration, ready to play around with your own CI plans (or even CD, it’s very flexible!). Some hints for production-grade installations are given, but the tutorial steps are meant for a test environment (namely a virtual machine). Buildbot’s configuration and detailed concepts are not in scope here.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Table of contents&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Choosing host operating system and version for buildbot&lt;/li&gt;
&lt;li&gt;Create a FreeBSD playground&lt;/li&gt;
&lt;li&gt;Introduction to jails&lt;/li&gt;
&lt;li&gt;Overview of buildbot&lt;/li&gt;
&lt;li&gt;Set up jails&lt;/li&gt;
&lt;li&gt;Install buildbot master&lt;/li&gt;
&lt;li&gt;Run buildbot master&lt;/li&gt;
&lt;li&gt;Install buildbot worker&lt;/li&gt;
&lt;li&gt;Run buildbot worker&lt;/li&gt;
&lt;li&gt;Set up web server nginx to access buildbot UI&lt;/li&gt;
&lt;li&gt;Run your first build&lt;/li&gt;
&lt;li&gt;Production hints&lt;/li&gt;
&lt;li&gt;Finished!&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;&lt;p&gt;Choosing host operating system and version for buildbot&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;We choose the released version of FreeBSD (11.1-RELEASE at the moment). There is no particular reason for it, and as a matter of fact buildbot as a Python-based server is very cross-platform; therefore the underlying OS platform and version should not make a large difference.&lt;/p&gt;
  
  &lt;p&gt;It will make a difference for what you do with buildbot, however. For instance, poudriere is the de-facto standard for building packages from source on FreeBSD. Builds run in jails which may be any FreeBSD base system version older or equal to the host’s version (reason will be explained below). In other words, if the host is FreeBSD 11.1, build jails created by poudriere could e.g. use 9.1, 10.3, 11.0, 11.1, but potentially not version 12 or newer because of incompatibilities with the host’s kernel (jails do not run their own kernel as full virtual machines do). To not prolong this article over the intended scope, the details of which nice things could be done or automated with buildbot are not covered.&lt;/p&gt;
  
  &lt;p&gt;Package names on the FreeBSD platform are independent of the OS version, since external software (as in: not part of base system) is maintained in FreeBSD ports. So, if your chosen FreeBSD version (here: 11) is still officially supported, the packages mentioned in this post should work. In the unlikely event of package name changes before you read this article, you should be able to find the actual package names like pkg search buildbot.&lt;/p&gt;
  
  &lt;p&gt;Other operating systems like the various Linux distributions will use different package names but might also offer buildbot pre-packaged. If not, the buildbot installation manual offers steps to install it manually. In such case, the downside is that you will have to maintain and update the buildbot modules outside the stability and (semi-)automatic updates of your OS packages.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;See &lt;a href="https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails"&gt;article&lt;/a&gt; for the rest&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;DigitalOcean&lt;/strong&gt;&lt;/p&gt;

&lt;h3&gt;&lt;a href="http://www.grenadille.net/post/2018/03/29/Dumping-your-USB"&gt;Dumping your USB&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;One of the many new features of OpenBSD 6.3 is the possibility to dump USB traffic to userland via bpf(4). This can be done with tcpdump(8) by specifying a USB bus as interface:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;```&lt;/p&gt;

&lt;h1&gt;tcpdump -Xx -i usb0&lt;/h1&gt;

&lt;p&gt;tcpdump: listening on usb0, link-type USBPCAP
12:28:03.317945 bus 0 &amp;lt; addr 1: ep1 intr 2
  0000: 0400                                     ..&lt;/p&gt;

&lt;p&gt;12:28:03.318018 bus 0 &amp;gt; addr 1: ep0 ctrl 8
  0000: 00a3 0000 0002 0004 00                   ......... &lt;br&gt;
[...]
```&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;As you might have noted I decided to implement the existing USBPcap capture format. A capture format is required because USB packets do not include all the necessary information to properly interpret them. I first thought I would implement libpcap's DLT&lt;em&gt;USB but then I quickly realize that this was not a standard. It is instead a FreeBSD specific format which has been since then renamed DLT&lt;/em&gt;USB&lt;em&gt;FREEBSD.
  But I didn't want to embrace xkcd #927, so I look at the existing formats: DLT&lt;/em&gt;USB&lt;em&gt;FREEBSD, DLT&lt;/em&gt;USB&lt;em&gt;LINUX, DLT&lt;/em&gt;USB&lt;em&gt;LINUX&lt;/em&gt;MMAPPED, DLT&lt;em&gt;USB&lt;/em&gt;DARWIN and DLT_USBPCAP. I was first a bit sad to see that nobody could agree on a common format then I moved on and picked the simplest one: USBPcap.
  Implementing an already existing format gives us out-of-box support for all the tools supporting it. That's why having common formats let us share our energy. In the case of USBPcap it is already supported by Wireshark, so you can already inspect your packet graphically. For that you need to first capture raw packets:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;```&lt;/p&gt;

&lt;h1&gt;tcpdump -s 3303 -w usb.pcap -i usb0&lt;/h1&gt;

&lt;p&gt;tcpdump: listening on usb0, link-type USBPCAP
^C
208 packets received by filter
0 packets dropped by kernel
```&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;USB packets can be quite big, that's why I'm not using tcpdump(8)'s default packet size. In this case, I want to make sure I can dump the complete uaudio(4) frames.
  It is important to say that what is dumped to userland is what the USB stack sees. Packets sent on the wire might differ, especially when it comes to retries and timing. So this feature is not here to replace any USB analyser, however I hope that it will help people understand how things work and what the USB stack is doing. Even I found some interesting timing issues while implementing isochronous support.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.romanzolotarev.com/openbsd/webserver.html"&gt;Run OpenBSD on your web server&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.romanzolotarev.com/vultr.html"&gt;Deploy and login to your OpenBSD server first.&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;As soon as you're there you can enable an httpd(8) daemon, it's already installed on OpenBSD, you just need to configure it:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;&lt;code&gt;www# vi /etc/httpd.conf&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Add two server sections---one for www and another for naked domain (all requests are redirected to www).&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;```
server "www.example.com" {
  listen on * port 80
  root "/htdocs/www.example.com"
}&lt;/p&gt;

&lt;p&gt;server "example.com" {
  listen on * port 80
  block return 301 "http://www.example.com$REQUEST_URI"
}
```&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;httpd is chrooted to /var/www by default, so let's make a document root directory:&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;code&gt;www# mkdir -p /var/www/htdocs/www.example.com&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Save and check this configuration:&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;code&gt;
www# httpd -n
configuration ok
&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Enable httpd(8) daemon and start it.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;code&gt;
www# rcctl enable httpd
www# rcctl start httpd
&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;Publish your website&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;Copy your website content into /var/www/htdocs/www.example.com and then test it your web browser.&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;code&gt;http://XXX.XXX.XXX.XXX/&lt;/code&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;Your web server should be up and running.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Update DNS records&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;If there is another HTTPS server using this domain, configure that server to redirect all HTTPS requests to HTTP.&lt;/p&gt;
  
  &lt;p&gt;Now as your new server is ready you can update DNS records accordingly.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;&lt;code&gt;
    example.com. 300 IN     A XXX.XXX.XXX.XXX
www.example.com. 300 IN     A XXX.XXX.XXX.XXX
&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Examine your DNS is propagated.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;code&gt;$ dig example.com www.example.com&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;Check IP addresses it answer sections. If they are correct, you should be able to access your new web server by its domain name.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;&lt;a href="https://www.romanzolotarev.com/openbsd/acme-client.html"&gt;What's next? Enable HTTPS on your server.&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://euroquis.nl/bobulate/?p=1827"&gt;Modern Akonadi and KMail on FreeBSD&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;For, quite literally a year or more, KMail and Akonadi on FreeBSD have been only marginally useful, at best. KDE4 era KMail was pretty darn good, but everything after that has had a number of FreeBSD users tearing out their hair. Sure, you can go to Trojitá, which has its own special problems and is generally “meh”, or bail out entirely to webmail, but .. KMail is a really great mail client when it works. Which, on Linux desktops, is nearly always, and on FreeBSD, is was nearly never.&lt;/p&gt;
  
  &lt;p&gt;I looked at it with Dan and Volker last summer, briefly, and we got not much further than “hmm”. There’s a message about “The world is going to end!” which hardly makes sense, it means that a message has been truncated or corrupted while traversing a UNIX domain socket.&lt;/p&gt;
  
  &lt;p&gt;Now Alexandre Martins — praise be! — has wandered in with a likely solution. KDE Bug 381850 contains a suggestion, which deserves to be publicised (and tested):&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;&lt;code&gt;sysctl net.local.stream.recvspace=65536&lt;/code&gt;
&lt;code&gt;sysctl net.local.stream.sendspace=65536&lt;/code&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;The default FreeBSD UNIX local socket buffer space is 8kiB. Bumping the size up to 64kiB — which matches the size that Linux has by default — suddenly makes KMail and Akonadi shine again. No other changes, no recompiling, just .. bump the sysctls (perhaps also in /etc/sysctl.conf) and KMail from Area51 hums along all day without ending the world.&lt;/p&gt;
  
  &lt;p&gt;Since changing this value may have other effects, and Akonadi shouldn’t be dependent on a specific buffer size anyway, I’m looking into the Akonadi code (encouraged by Dan) to either automatically size the socket buffers, or to figure out where in the underlying code the assumption about buffer size lives. So for now, sysctl can make KMail users on FreeBSD happy, and later we hope to have things fully automatic (and if that doesn’t pan out, well, pkg-message exists).&lt;/p&gt;
  
  &lt;p&gt;PS. Modern KDE PIM applications — Akonadi, KMail — which live in the deskutils/ category of the official FreeBSD ports were added to the official tree April 10th, so you can get your fix now from the official tree.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="http://lists.dragonflybsd.org/pipermail/users/2018-April/335722.html"&gt;pkg-provides support for DragonFly (from Rodrigo Osorio)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://monades.roperzh.com/memories-writing-parser-man-pages/"&gt;Memories of writing a parser for man pages&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://developeronfire.com/podcast/episode-198-bryan-cantrill-persistence-and-action"&gt;Bryan Cantrill interview over at DeveloperOnFire podcast&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://minnie.tuhs.org/pipermail/tuhs/2018-March/013285.html"&gt;1978-03-25 - 2018-03-25: 40 years BSD Mail&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://imgur.com/a/KOTJS"&gt;My 5 years of FreeBSD gaming: a compendium of free games and engines running natively on FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://reviews.freebsd.org/D15562"&gt;Sequential Resilver being upstreamed to FreeBSD, from FreeNAS, where it was ported from ZFS-on-Linux&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2018-May/000944.html"&gt;University of Aberdeen’s Internet Transport Research Group is hiring  &lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap ad&lt;/strong&gt;&lt;/p&gt;

&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Dave - &lt;a href="http://dpaste.com/0KHRB4Z#wrap"&gt;mounting non-filesystem things inside jails&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Morgan - &lt;a href="http://dpaste.com/10QD42T#wrap"&gt;ZFS on Linux Data loss bug&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Rene - &lt;a href="http://dpaste.com/30VM51S#wrap"&gt;How to keep your ISP’s nose out of your browser history with encrypted DNS&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Rodriguez - &lt;a href="http://dpaste.com/3WVYR9D#wrap"&gt;Feedback question! Relating to Windows&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, HAMMER2, PS4, Kernel Exploit, debugging</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>DragonflyBSD release 5.2.1 is here, BPF kernel exploit writeup, Remote Debugging the running OpenBSD kernel, interview with Patrick Mooney, FreeBSD buildbot setup in a jail, dumping your USB, and 5 years of gaming on FreeBSD.</p>

<h2>Headlines</h2>

<h3><a href="https://www.dragonflybsd.org/release52/">DragonFlyBSD: release52 (w/stable HAMMER2, as default root)</a></h3>

<ul>
<li>DragonflyBSD 5.2.1 was released on May 21, 2018</li>
<li>> Big Ticket items:


<blockquote>
  Meltdown and Spectre mitigation support
  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectre<em>mitigation and machdep.meltdown</em>mitigation.
  HAMMER2
  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.
  Clustered support is not yet available.
  ipfw Updates
  Implement state based "redirect", i.e. without using libalias.
  ipfw now supports all possible ICMP types.
  Fix ICMP<em>MAXTYPE assumptions (now 40 as of this release).
  Improved graphics support
  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs
  Add 24-bit pixel format support to the EFI frame buffer code.
  Significantly improve fbio support for the "scfb" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.
  Partly implement the FBIO</em>BLANK ioctl for display powersaving.
  Syscons waits for drm modesetting at appropriate places, avoiding races.</li>
  </ul>
  <hr />
</blockquote>

<h3><a href="https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md">PS4 4.55 BPF Race Condition Kernel Exploit Writeup</a></h3>



<blockquote>
  <p>Note: While this bug is primarily interesting for exploitation on the PS4, this bug can also potentially be exploited on other unpatched platforms using FreeBSD if the attacker has read/write permissions on /dev/bpf, or if they want to escalate from root user to kernel code execution. As such, I've published it under the "FreeBSD" folder and not the "PS4" folder.</p>
</blockquote>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
  <p>Welcome to the kernel portion of the PS4 4.55FW full exploit chain write-up. This bug was found by qwerty, and is fairly unique in the way it's exploited, so I wanted to do a detailed write-up on how it worked. The full source of the exploit can be found <a href="https://github.com/Cryptogenic/PS4-4.55-Kernel-Exploit">here</a>. I've previously covered the webkit exploit implementation for userland access <a href="https://github.com/Cryptogenic/Exploit-Writeups/blob/master/WebKit/setAttributeNodeNS%20UAF%20Write-up.md">here</a>.</p>
</blockquote>

<ul>
<li>FreeBSD or Sony's fault? Why not both...</li>
</ul>

<blockquote>
  <p>Interestingly, this bug is actually a FreeBSD bug and was not (at least directly) introduced by Sony code. While this is a FreeBSD bug however, it's not very useful for most systems because the /dev/bpf device driver is root-owned, and the permissions for it are set to 0600 (meaning owner has read/write privileges, and nobody else does) - though it can be used for escalating from root to kernel mode code execution. However, let’s take a look at the make_dev() call inside the PS4 kernel for /dev/bpf (taken from a 4.05 kernel dump).</p>
</blockquote>

<p><code>
seg000:FFFFFFFFA181F15B                 lea     rdi, unk_FFFFFFFFA2D77640
seg000:FFFFFFFFA181F162                 lea     r9, aBpf        ; "bpf"
seg000:FFFFFFFFA181F169                 mov     esi, 0
seg000:FFFFFFFFA181F16E                 mov     edx, 0
seg000:FFFFFFFFA181F173                 xor     ecx, ecx
seg000:FFFFFFFFA181F175                 mov     r8d, 1B6h
seg000:FFFFFFFFA181F17B                 xor     eax, eax
seg000:FFFFFFFFA181F17D                 mov     cs:qword_FFFFFFFFA34EC770, 0
seg000:FFFFFFFFA181F188                 call    make_dev
</code></p>

<blockquote>
  <p>We see UID 0 (the UID for the root user) getting moved into the register for the 3rd argument, which is the owner argument. However, the permissions bits are being set to 0x1B6, which in octal is 0666. This means anyone can open /dev/bpf with read/write privileges. I’m not sure why this is the case, qwerty speculates that perhaps bpf is used for LAN gaming. In any case, this was a poor design decision because bpf is usually considered privileged, and should not be accessible to a process that is completely untrusted, such as WebKit. On most platforms, permissions for /dev/bpf will be set to 0x180, or 0600.</p>
</blockquote>

<ul>
<li>Race Conditions - What are they?</li>
</ul>

<blockquote>
  <p>The class of the bug abused in this exploit is known as a "race condition". Before we get into bug specifics, it's important for the reader to understand what race conditions are and how they can be an issue (especially in something like a kernel). Often in complex software (such as a kernel), resources will be shared (or "global"). This means other threads could potentially execute code that will access some resource that could be accessed by another thread at the same point in time. What happens if one thread accesses this resource while another thread does without exclusive access? Race conditions are introduced.</p>
  
  <p>Race conditions are defined as possible scenarios where events happen in a sequence different than the developer intended which leads to undefined behavior. In simple, single-threaded programs, this is not an issue because execution is linear. In more complex programs where code can be running in parallel however, this becomes a real issue. To prevent these problems, atomic instructions and locking mechanisms were introduced. When one thread wants to access a critical resource, it will attempt to acquire a "lock". If another thread is already using this resource, generally the thread attempting to acquire the lock will wait until the other thread is finished with it. Each thread must release the lock to the resource after they're done with it, failure to do so could result in a deadlock.</p>
  
  <p>While locking mechanisms such as mutexes have been introduced, developers sometimes struggle to use them properly. For example, what if a piece of shared data gets validated and processed, but while the processing of the data is locked, the validation is not? There is a window between validation and locking where that data can change, and while the developer thinks the data has been validated, it could be substituted with something malicious after it is validated, but before it is used. Parallel programming can be difficult, especially when, as a developer, you also want to factor in the fact that you don't want to put too much code in between locking and unlocking as it can impact performance.</p>
</blockquote>

<ul>
<li>See <a href="https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md">article</a> for the rest</li>
</ul>

<p><hr /></p>

<p><strong>iXsystems</strong></p>

<h3><a href="http://bijanebrahimi.github.io/blog/remote-debugging-the-running-openbsd-kernel.html">Remote Debugging the running OpenBSD kernel</a></h3>

<ul>
<li>Subtitled: A way to understand the OpenBSD internals
+> The Problem
+> A few month ago, I tried porting the FreeBSD kdb along with it's gdb stub implementations to OpenBSD as a practice of learning the internals of an BSD operating system. The ddb code in both FreeBSD and OpenBSD looks pretty much the same and the GDB Remote Serial Protocol looks very minimal.
+> But sadly I got very busy and the work is stalled but I'm planning on resuming the attempt as soon as I get the chance, But there is an alternative way to Debugging the OpenBSD kernel via QEMU. What I did below is basically the same with a few minor changes which I hope to describe it as best.
+> Installing OpenBSD on Qemu
+> For debugging the kernel, we need a working OpenBSD system running on Qemu. I chose to create a raw disk file to be able to easily mount it later via the host and copy the custom kernel onto it.


<blockquote>
  $ qemu-img create -f raw disk.raw 5G
  $ qemu-system-x86<em>64 -m 256M \
  -drive format=raw,file=install63.fs \
  -drive format=raw,file=disk.raw
  +> Custom Kernel
  +> To debug the kernel, we need a version of the kernel with debugging symbols and for that we have to recompile it first. The process is documented at Building the System from Source:
  ...
  +> Then we can copy the bsd kernel to the guest machine and keep the bsd.gdb on the host to start the remote debugging via gdb.
  +> Remote debugging kernel
  +> Now it's to time to boot the guest with the new custom kernel. Remember that the -s argument enables the gdb server on qemu on localhost port 1234 by default:
  $ qemu-system-x86</em>64 -m 256M -s \
     -net nic -net user \
  -drive format=raw,file=install63.fs \
  +> Now to finally attach to the running kernel:</li>
  </ul>
  <hr />
</blockquote>

<h2>Interview - Patrick Mooney - Software Engineer <a href="pmooney@pfmooney.com">pmooney@pfmooney.com</a> / <a href="https://twitter.com/pfmooney">@pfmooney</a></h2>

<ul>
<li>BR: How did you first get introduced to UNIX?</li>
<li>AJ: What got you started contributing to an open source project?</li>
<li>BR: What sorts of things have you worked on in the past?</li>
<li>AJ: Can you tell us more about what attracted you to illumos?</li>
<li>BR: How did you get interested in, and started with, systems development?</li>
<li>AJ: When did you first get interested in bhyve?</li>
<li>BR: How much work was it to take the years-old port of bhyve and get it working on modern IllumOS?</li>
<li>AJ: What was the process for getting the bhyve port caught up to current FreeBSD?</li>
<li>BR: How usable is bhyve on illumOS?</li>
<li>AJ: What area are you most interested in improving in bhyve?</li>
<li>BR: Do you think the FreeBSD and illumos versions of bhyve will stay in sync with each other?</li>
<li>AJ: What do you do for fun?</li>
<li>BR: Anything else you want to mention?</li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails">Setting up buildbot in FreeBSD Jails</a></h3>

<blockquote>
  <p>In this article, I would like to present a tutorial to set up buildbot, a continuous integration (CI) software (like Jenkins, drone, etc.), making use of FreeBSD’s containerization mechanism "jails". We will cover terminology, rationale for using both buildbot and jails together, and installation steps. At the end, you will have a working buildbot instance using its sample build configuration, ready to play around with your own CI plans (or even CD, it’s very flexible!). Some hints for production-grade installations are given, but the tutorial steps are meant for a test environment (namely a virtual machine). Buildbot’s configuration and detailed concepts are not in scope here.</p>
</blockquote>

<ul>
<li><p>Table of contents</p>

<ul><li>Choosing host operating system and version for buildbot</li>
<li>Create a FreeBSD playground</li>
<li>Introduction to jails</li>
<li>Overview of buildbot</li>
<li>Set up jails</li>
<li>Install buildbot master</li>
<li>Run buildbot master</li>
<li>Install buildbot worker</li>
<li>Run buildbot worker</li>
<li>Set up web server nginx to access buildbot UI</li>
<li>Run your first build</li>
<li>Production hints</li>
<li>Finished!</li></ul></li>
<li><p>Choosing host operating system and version for buildbot</p></li>
</ul>

<blockquote>
  <p>We choose the released version of FreeBSD (11.1-RELEASE at the moment). There is no particular reason for it, and as a matter of fact buildbot as a Python-based server is very cross-platform; therefore the underlying OS platform and version should not make a large difference.</p>
  
  <p>It will make a difference for what you do with buildbot, however. For instance, poudriere is the de-facto standard for building packages from source on FreeBSD. Builds run in jails which may be any FreeBSD base system version older or equal to the host’s version (reason will be explained below). In other words, if the host is FreeBSD 11.1, build jails created by poudriere could e.g. use 9.1, 10.3, 11.0, 11.1, but potentially not version 12 or newer because of incompatibilities with the host’s kernel (jails do not run their own kernel as full virtual machines do). To not prolong this article over the intended scope, the details of which nice things could be done or automated with buildbot are not covered.</p>
  
  <p>Package names on the FreeBSD platform are independent of the OS version, since external software (as in: not part of base system) is maintained in FreeBSD ports. So, if your chosen FreeBSD version (here: 11) is still officially supported, the packages mentioned in this post should work. In the unlikely event of package name changes before you read this article, you should be able to find the actual package names like pkg search buildbot.</p>
  
  <p>Other operating systems like the various Linux distributions will use different package names but might also offer buildbot pre-packaged. If not, the buildbot installation manual offers steps to install it manually. In such case, the downside is that you will have to maintain and update the buildbot modules outside the stability and (semi-)automatic updates of your OS packages.</p>
</blockquote>

<ul>
<li>See <a href="https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails">article</a> for the rest</li>
</ul>

<p><hr /></p>

<p><strong>DigitalOcean</strong></p>

<h3><a href="http://www.grenadille.net/post/2018/03/29/Dumping-your-USB">Dumping your USB</a></h3>

<blockquote>
  <p>One of the many new features of OpenBSD 6.3 is the possibility to dump USB traffic to userland via bpf(4). This can be done with tcpdump(8) by specifying a USB bus as interface:</p>
</blockquote>

<p>```</p>

<h1>tcpdump -Xx -i usb0</h1>

<p>tcpdump: listening on usb0, link-type USBPCAP
12:28:03.317945 bus 0 &lt; addr 1: ep1 intr 2
  0000: 0400                                     ..</p>

<p>12:28:03.318018 bus 0 > addr 1: ep0 ctrl 8
  0000: 00a3 0000 0002 0004 00                   ......... <br />
[...]
```</p>

<blockquote>
  <p>As you might have noted I decided to implement the existing USBPcap capture format. A capture format is required because USB packets do not include all the necessary information to properly interpret them. I first thought I would implement libpcap's DLT<em>USB but then I quickly realize that this was not a standard. It is instead a FreeBSD specific format which has been since then renamed DLT</em>USB<em>FREEBSD.
  But I didn't want to embrace xkcd #927, so I look at the existing formats: DLT</em>USB<em>FREEBSD, DLT</em>USB<em>LINUX, DLT</em>USB<em>LINUX</em>MMAPPED, DLT<em>USB</em>DARWIN and DLT_USBPCAP. I was first a bit sad to see that nobody could agree on a common format then I moved on and picked the simplest one: USBPcap.
  Implementing an already existing format gives us out-of-box support for all the tools supporting it. That's why having common formats let us share our energy. In the case of USBPcap it is already supported by Wireshark, so you can already inspect your packet graphically. For that you need to first capture raw packets:</p>
</blockquote>

<p>```</p>

<h1>tcpdump -s 3303 -w usb.pcap -i usb0</h1>

<p>tcpdump: listening on usb0, link-type USBPCAP
^C
208 packets received by filter
0 packets dropped by kernel
```</p>

<blockquote>
  <p>USB packets can be quite big, that's why I'm not using tcpdump(8)'s default packet size. In this case, I want to make sure I can dump the complete uaudio(4) frames.
  It is important to say that what is dumped to userland is what the USB stack sees. Packets sent on the wire might differ, especially when it comes to retries and timing. So this feature is not here to replace any USB analyser, however I hope that it will help people understand how things work and what the USB stack is doing. Even I found some interesting timing issues while implementing isochronous support.</p>
</blockquote>

<p><hr /></p>

<h3><a href="https://www.romanzolotarev.com/openbsd/webserver.html">Run OpenBSD on your web server</a></h3>

<ul>
<li><a href="https://www.romanzolotarev.com/vultr.html">Deploy and login to your OpenBSD server first.</a></li>
</ul>

<blockquote>
  <p>As soon as you're there you can enable an httpd(8) daemon, it's already installed on OpenBSD, you just need to configure it:</p>
</blockquote>

<p><code>www# vi /etc/httpd.conf</code></p>

<ul>
<li>Add two server sections---one for www and another for naked domain (all requests are redirected to www).</li>
</ul>

<p>```
server "www.example.com" {
  listen on * port 80
  root "/htdocs/www.example.com"
}</p>

<p>server "example.com" {
  listen on * port 80
  block return 301 "http://www.example.com$REQUEST_URI"
}
```</p>

<ul>
<li>httpd is chrooted to /var/www by default, so let's make a document root directory:</li>
</ul>

<p><code>www# mkdir -p /var/www/htdocs/www.example.com</code></p>

<ul>
<li>Save and check this configuration:</li>
</ul>

<p><code>
www# httpd -n
configuration ok
</code></p>

<ul>
<li>Enable httpd(8) daemon and start it.</li>
</ul>

<p><code>
www# rcctl enable httpd
www# rcctl start httpd
</code></p>

<ul>
<li><p>Publish your website</p></li>
<li><p>Copy your website content into /var/www/htdocs/www.example.com and then test it your web browser.</p></li>
</ul>

<p><code>http://XXX.XXX.XXX.XXX/</code></p>

<blockquote>
  <p>Your web server should be up and running.</p>
</blockquote>

<ul>
<li>Update DNS records</li>
</ul>

<blockquote>
  <p>If there is another HTTPS server using this domain, configure that server to redirect all HTTPS requests to HTTP.</p>
  
  <p>Now as your new server is ready you can update DNS records accordingly.</p>
</blockquote>

<p><code>
    example.com. 300 IN     A XXX.XXX.XXX.XXX
www.example.com. 300 IN     A XXX.XXX.XXX.XXX
</code></p>

<ul>
<li>Examine your DNS is propagated.</li>
</ul>

<p><code>$ dig example.com www.example.com</code></p>

<ul>
<li><p>Check IP addresses it answer sections. If they are correct, you should be able to access your new web server by its domain name.</p></li>
<li><p><a href="https://www.romanzolotarev.com/openbsd/acme-client.html">What's next? Enable HTTPS on your server.</a></p></li>
</ul>

<p><hr /></p>

<h3><a href="https://euroquis.nl/bobulate/?p=1827">Modern Akonadi and KMail on FreeBSD</a></h3>

<blockquote>
  <p>For, quite literally a year or more, KMail and Akonadi on FreeBSD have been only marginally useful, at best. KDE4 era KMail was pretty darn good, but everything after that has had a number of FreeBSD users tearing out their hair. Sure, you can go to Trojitá, which has its own special problems and is generally “meh”, or bail out entirely to webmail, but .. KMail is a really great mail client when it works. Which, on Linux desktops, is nearly always, and on FreeBSD, is was nearly never.</p>
  
  <p>I looked at it with Dan and Volker last summer, briefly, and we got not much further than “hmm”. There’s a message about “The world is going to end!” which hardly makes sense, it means that a message has been truncated or corrupted while traversing a UNIX domain socket.</p>
  
  <p>Now Alexandre Martins — praise be! — has wandered in with a likely solution. KDE Bug 381850 contains a suggestion, which deserves to be publicised (and tested):</p>
</blockquote>

<p><code>sysctl net.local.stream.recvspace=65536</code>
<code>sysctl net.local.stream.sendspace=65536</code></p>

<blockquote>
  <p>The default FreeBSD UNIX local socket buffer space is 8kiB. Bumping the size up to 64kiB — which matches the size that Linux has by default — suddenly makes KMail and Akonadi shine again. No other changes, no recompiling, just .. bump the sysctls (perhaps also in /etc/sysctl.conf) and KMail from Area51 hums along all day without ending the world.</p>
  
  <p>Since changing this value may have other effects, and Akonadi shouldn’t be dependent on a specific buffer size anyway, I’m looking into the Akonadi code (encouraged by Dan) to either automatically size the socket buffers, or to figure out where in the underlying code the assumption about buffer size lives. So for now, sysctl can make KMail users on FreeBSD happy, and later we hope to have things fully automatic (and if that doesn’t pan out, well, pkg-message exists).</p>
  
  <p>PS. Modern KDE PIM applications — Akonadi, KMail — which live in the deskutils/ category of the official FreeBSD ports were added to the official tree April 10th, so you can get your fix now from the official tree.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2018-April/335722.html">pkg-provides support for DragonFly (from Rodrigo Osorio)</a></li>
<li><a href="https://monades.roperzh.com/memories-writing-parser-man-pages/">Memories of writing a parser for man pages</a></li>
<li><a href="http://developeronfire.com/podcast/episode-198-bryan-cantrill-persistence-and-action">Bryan Cantrill interview over at DeveloperOnFire podcast</a></li>
<li><a href="http://minnie.tuhs.org/pipermail/tuhs/2018-March/013285.html">1978-03-25 - 2018-03-25: 40 years BSD Mail</a></li>
<li><a href="https://imgur.com/a/KOTJS">My 5 years of FreeBSD gaming: a compendium of free games and engines running natively on FreeBSD</a></li>
<li><a href="https://reviews.freebsd.org/D15562">Sequential Resilver being upstreamed to FreeBSD, from FreeNAS, where it was ported from ZFS-on-Linux</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2018-May/000944.html">University of Aberdeen’s Internet Transport Research Group is hiring  </a></li>
</ul>

<p><hr /></p>

<p><strong>Tarsnap ad</strong></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Dave - <a href="http://dpaste.com/0KHRB4Z#wrap">mounting non-filesystem things inside jails</a></li>
<li>Morgan - <a href="http://dpaste.com/10QD42T#wrap">ZFS on Linux Data loss bug</a></li>
<li>Rene - <a href="http://dpaste.com/30VM51S#wrap">How to keep your ISP’s nose out of your browser history with encrypted DNS</a></li>
<li>Rodriguez - <a href="http://dpaste.com/3WVYR9D#wrap">Feedback question! Relating to Windows</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>DragonflyBSD release 5.2.1 is here, BPF kernel exploit writeup, Remote Debugging the running OpenBSD kernel, interview with Patrick Mooney, FreeBSD buildbot setup in a jail, dumping your USB, and 5 years of gaming on FreeBSD.</p>

<h2>Headlines</h2>

<h3><a href="https://www.dragonflybsd.org/release52/">DragonFlyBSD: release52 (w/stable HAMMER2, as default root)</a></h3>

<ul>
<li>DragonflyBSD 5.2.1 was released on May 21, 2018</li>
<li>> Big Ticket items:


<blockquote>
  Meltdown and Spectre mitigation support
  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectre<em>mitigation and machdep.meltdown</em>mitigation.
  HAMMER2
  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.
  Clustered support is not yet available.
  ipfw Updates
  Implement state based "redirect", i.e. without using libalias.
  ipfw now supports all possible ICMP types.
  Fix ICMP<em>MAXTYPE assumptions (now 40 as of this release).
  Improved graphics support
  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs
  Add 24-bit pixel format support to the EFI frame buffer code.
  Significantly improve fbio support for the "scfb" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.
  Partly implement the FBIO</em>BLANK ioctl for display powersaving.
  Syscons waits for drm modesetting at appropriate places, avoiding races.</li>
  </ul>
  <hr />
</blockquote>

<h3><a href="https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md">PS4 4.55 BPF Race Condition Kernel Exploit Writeup</a></h3>



<blockquote>
  <p>Note: While this bug is primarily interesting for exploitation on the PS4, this bug can also potentially be exploited on other unpatched platforms using FreeBSD if the attacker has read/write permissions on /dev/bpf, or if they want to escalate from root user to kernel code execution. As such, I've published it under the "FreeBSD" folder and not the "PS4" folder.</p>
</blockquote>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
  <p>Welcome to the kernel portion of the PS4 4.55FW full exploit chain write-up. This bug was found by qwerty, and is fairly unique in the way it's exploited, so I wanted to do a detailed write-up on how it worked. The full source of the exploit can be found <a href="https://github.com/Cryptogenic/PS4-4.55-Kernel-Exploit">here</a>. I've previously covered the webkit exploit implementation for userland access <a href="https://github.com/Cryptogenic/Exploit-Writeups/blob/master/WebKit/setAttributeNodeNS%20UAF%20Write-up.md">here</a>.</p>
</blockquote>

<ul>
<li>FreeBSD or Sony's fault? Why not both...</li>
</ul>

<blockquote>
  <p>Interestingly, this bug is actually a FreeBSD bug and was not (at least directly) introduced by Sony code. While this is a FreeBSD bug however, it's not very useful for most systems because the /dev/bpf device driver is root-owned, and the permissions for it are set to 0600 (meaning owner has read/write privileges, and nobody else does) - though it can be used for escalating from root to kernel mode code execution. However, let’s take a look at the make_dev() call inside the PS4 kernel for /dev/bpf (taken from a 4.05 kernel dump).</p>
</blockquote>

<p><code>
seg000:FFFFFFFFA181F15B                 lea     rdi, unk_FFFFFFFFA2D77640
seg000:FFFFFFFFA181F162                 lea     r9, aBpf        ; "bpf"
seg000:FFFFFFFFA181F169                 mov     esi, 0
seg000:FFFFFFFFA181F16E                 mov     edx, 0
seg000:FFFFFFFFA181F173                 xor     ecx, ecx
seg000:FFFFFFFFA181F175                 mov     r8d, 1B6h
seg000:FFFFFFFFA181F17B                 xor     eax, eax
seg000:FFFFFFFFA181F17D                 mov     cs:qword_FFFFFFFFA34EC770, 0
seg000:FFFFFFFFA181F188                 call    make_dev
</code></p>

<blockquote>
  <p>We see UID 0 (the UID for the root user) getting moved into the register for the 3rd argument, which is the owner argument. However, the permissions bits are being set to 0x1B6, which in octal is 0666. This means anyone can open /dev/bpf with read/write privileges. I’m not sure why this is the case, qwerty speculates that perhaps bpf is used for LAN gaming. In any case, this was a poor design decision because bpf is usually considered privileged, and should not be accessible to a process that is completely untrusted, such as WebKit. On most platforms, permissions for /dev/bpf will be set to 0x180, or 0600.</p>
</blockquote>

<ul>
<li>Race Conditions - What are they?</li>
</ul>

<blockquote>
  <p>The class of the bug abused in this exploit is known as a "race condition". Before we get into bug specifics, it's important for the reader to understand what race conditions are and how they can be an issue (especially in something like a kernel). Often in complex software (such as a kernel), resources will be shared (or "global"). This means other threads could potentially execute code that will access some resource that could be accessed by another thread at the same point in time. What happens if one thread accesses this resource while another thread does without exclusive access? Race conditions are introduced.</p>
  
  <p>Race conditions are defined as possible scenarios where events happen in a sequence different than the developer intended which leads to undefined behavior. In simple, single-threaded programs, this is not an issue because execution is linear. In more complex programs where code can be running in parallel however, this becomes a real issue. To prevent these problems, atomic instructions and locking mechanisms were introduced. When one thread wants to access a critical resource, it will attempt to acquire a "lock". If another thread is already using this resource, generally the thread attempting to acquire the lock will wait until the other thread is finished with it. Each thread must release the lock to the resource after they're done with it, failure to do so could result in a deadlock.</p>
  
  <p>While locking mechanisms such as mutexes have been introduced, developers sometimes struggle to use them properly. For example, what if a piece of shared data gets validated and processed, but while the processing of the data is locked, the validation is not? There is a window between validation and locking where that data can change, and while the developer thinks the data has been validated, it could be substituted with something malicious after it is validated, but before it is used. Parallel programming can be difficult, especially when, as a developer, you also want to factor in the fact that you don't want to put too much code in between locking and unlocking as it can impact performance.</p>
</blockquote>

<ul>
<li>See <a href="https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md">article</a> for the rest</li>
</ul>

<p><hr /></p>

<p><strong>iXsystems</strong></p>

<h3><a href="http://bijanebrahimi.github.io/blog/remote-debugging-the-running-openbsd-kernel.html">Remote Debugging the running OpenBSD kernel</a></h3>

<ul>
<li>Subtitled: A way to understand the OpenBSD internals
+> The Problem
+> A few month ago, I tried porting the FreeBSD kdb along with it's gdb stub implementations to OpenBSD as a practice of learning the internals of an BSD operating system. The ddb code in both FreeBSD and OpenBSD looks pretty much the same and the GDB Remote Serial Protocol looks very minimal.
+> But sadly I got very busy and the work is stalled but I'm planning on resuming the attempt as soon as I get the chance, But there is an alternative way to Debugging the OpenBSD kernel via QEMU. What I did below is basically the same with a few minor changes which I hope to describe it as best.
+> Installing OpenBSD on Qemu
+> For debugging the kernel, we need a working OpenBSD system running on Qemu. I chose to create a raw disk file to be able to easily mount it later via the host and copy the custom kernel onto it.


<blockquote>
  $ qemu-img create -f raw disk.raw 5G
  $ qemu-system-x86<em>64 -m 256M \
  -drive format=raw,file=install63.fs \
  -drive format=raw,file=disk.raw
  +> Custom Kernel
  +> To debug the kernel, we need a version of the kernel with debugging symbols and for that we have to recompile it first. The process is documented at Building the System from Source:
  ...
  +> Then we can copy the bsd kernel to the guest machine and keep the bsd.gdb on the host to start the remote debugging via gdb.
  +> Remote debugging kernel
  +> Now it's to time to boot the guest with the new custom kernel. Remember that the -s argument enables the gdb server on qemu on localhost port 1234 by default:
  $ qemu-system-x86</em>64 -m 256M -s \
     -net nic -net user \
  -drive format=raw,file=install63.fs \
  +> Now to finally attach to the running kernel:</li>
  </ul>
  <hr />
</blockquote>

<h2>Interview - Patrick Mooney - Software Engineer <a href="pmooney@pfmooney.com">pmooney@pfmooney.com</a> / <a href="https://twitter.com/pfmooney">@pfmooney</a></h2>

<ul>
<li>BR: How did you first get introduced to UNIX?</li>
<li>AJ: What got you started contributing to an open source project?</li>
<li>BR: What sorts of things have you worked on in the past?</li>
<li>AJ: Can you tell us more about what attracted you to illumos?</li>
<li>BR: How did you get interested in, and started with, systems development?</li>
<li>AJ: When did you first get interested in bhyve?</li>
<li>BR: How much work was it to take the years-old port of bhyve and get it working on modern IllumOS?</li>
<li>AJ: What was the process for getting the bhyve port caught up to current FreeBSD?</li>
<li>BR: How usable is bhyve on illumOS?</li>
<li>AJ: What area are you most interested in improving in bhyve?</li>
<li>BR: Do you think the FreeBSD and illumos versions of bhyve will stay in sync with each other?</li>
<li>AJ: What do you do for fun?</li>
<li>BR: Anything else you want to mention?</li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails">Setting up buildbot in FreeBSD Jails</a></h3>

<blockquote>
  <p>In this article, I would like to present a tutorial to set up buildbot, a continuous integration (CI) software (like Jenkins, drone, etc.), making use of FreeBSD’s containerization mechanism "jails". We will cover terminology, rationale for using both buildbot and jails together, and installation steps. At the end, you will have a working buildbot instance using its sample build configuration, ready to play around with your own CI plans (or even CD, it’s very flexible!). Some hints for production-grade installations are given, but the tutorial steps are meant for a test environment (namely a virtual machine). Buildbot’s configuration and detailed concepts are not in scope here.</p>
</blockquote>

<ul>
<li><p>Table of contents</p>

<ul><li>Choosing host operating system and version for buildbot</li>
<li>Create a FreeBSD playground</li>
<li>Introduction to jails</li>
<li>Overview of buildbot</li>
<li>Set up jails</li>
<li>Install buildbot master</li>
<li>Run buildbot master</li>
<li>Install buildbot worker</li>
<li>Run buildbot worker</li>
<li>Set up web server nginx to access buildbot UI</li>
<li>Run your first build</li>
<li>Production hints</li>
<li>Finished!</li></ul></li>
<li><p>Choosing host operating system and version for buildbot</p></li>
</ul>

<blockquote>
  <p>We choose the released version of FreeBSD (11.1-RELEASE at the moment). There is no particular reason for it, and as a matter of fact buildbot as a Python-based server is very cross-platform; therefore the underlying OS platform and version should not make a large difference.</p>
  
  <p>It will make a difference for what you do with buildbot, however. For instance, poudriere is the de-facto standard for building packages from source on FreeBSD. Builds run in jails which may be any FreeBSD base system version older or equal to the host’s version (reason will be explained below). In other words, if the host is FreeBSD 11.1, build jails created by poudriere could e.g. use 9.1, 10.3, 11.0, 11.1, but potentially not version 12 or newer because of incompatibilities with the host’s kernel (jails do not run their own kernel as full virtual machines do). To not prolong this article over the intended scope, the details of which nice things could be done or automated with buildbot are not covered.</p>
  
  <p>Package names on the FreeBSD platform are independent of the OS version, since external software (as in: not part of base system) is maintained in FreeBSD ports. So, if your chosen FreeBSD version (here: 11) is still officially supported, the packages mentioned in this post should work. In the unlikely event of package name changes before you read this article, you should be able to find the actual package names like pkg search buildbot.</p>
  
  <p>Other operating systems like the various Linux distributions will use different package names but might also offer buildbot pre-packaged. If not, the buildbot installation manual offers steps to install it manually. In such case, the downside is that you will have to maintain and update the buildbot modules outside the stability and (semi-)automatic updates of your OS packages.</p>
</blockquote>

<ul>
<li>See <a href="https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails">article</a> for the rest</li>
</ul>

<p><hr /></p>

<p><strong>DigitalOcean</strong></p>

<h3><a href="http://www.grenadille.net/post/2018/03/29/Dumping-your-USB">Dumping your USB</a></h3>

<blockquote>
  <p>One of the many new features of OpenBSD 6.3 is the possibility to dump USB traffic to userland via bpf(4). This can be done with tcpdump(8) by specifying a USB bus as interface:</p>
</blockquote>

<p>```</p>

<h1>tcpdump -Xx -i usb0</h1>

<p>tcpdump: listening on usb0, link-type USBPCAP
12:28:03.317945 bus 0 &lt; addr 1: ep1 intr 2
  0000: 0400                                     ..</p>

<p>12:28:03.318018 bus 0 > addr 1: ep0 ctrl 8
  0000: 00a3 0000 0002 0004 00                   ......... <br />
[...]
```</p>

<blockquote>
  <p>As you might have noted I decided to implement the existing USBPcap capture format. A capture format is required because USB packets do not include all the necessary information to properly interpret them. I first thought I would implement libpcap's DLT<em>USB but then I quickly realize that this was not a standard. It is instead a FreeBSD specific format which has been since then renamed DLT</em>USB<em>FREEBSD.
  But I didn't want to embrace xkcd #927, so I look at the existing formats: DLT</em>USB<em>FREEBSD, DLT</em>USB<em>LINUX, DLT</em>USB<em>LINUX</em>MMAPPED, DLT<em>USB</em>DARWIN and DLT_USBPCAP. I was first a bit sad to see that nobody could agree on a common format then I moved on and picked the simplest one: USBPcap.
  Implementing an already existing format gives us out-of-box support for all the tools supporting it. That's why having common formats let us share our energy. In the case of USBPcap it is already supported by Wireshark, so you can already inspect your packet graphically. For that you need to first capture raw packets:</p>
</blockquote>

<p>```</p>

<h1>tcpdump -s 3303 -w usb.pcap -i usb0</h1>

<p>tcpdump: listening on usb0, link-type USBPCAP
^C
208 packets received by filter
0 packets dropped by kernel
```</p>

<blockquote>
  <p>USB packets can be quite big, that's why I'm not using tcpdump(8)'s default packet size. In this case, I want to make sure I can dump the complete uaudio(4) frames.
  It is important to say that what is dumped to userland is what the USB stack sees. Packets sent on the wire might differ, especially when it comes to retries and timing. So this feature is not here to replace any USB analyser, however I hope that it will help people understand how things work and what the USB stack is doing. Even I found some interesting timing issues while implementing isochronous support.</p>
</blockquote>

<p><hr /></p>

<h3><a href="https://www.romanzolotarev.com/openbsd/webserver.html">Run OpenBSD on your web server</a></h3>

<ul>
<li><a href="https://www.romanzolotarev.com/vultr.html">Deploy and login to your OpenBSD server first.</a></li>
</ul>

<blockquote>
  <p>As soon as you're there you can enable an httpd(8) daemon, it's already installed on OpenBSD, you just need to configure it:</p>
</blockquote>

<p><code>www# vi /etc/httpd.conf</code></p>

<ul>
<li>Add two server sections---one for www and another for naked domain (all requests are redirected to www).</li>
</ul>

<p>```
server "www.example.com" {
  listen on * port 80
  root "/htdocs/www.example.com"
}</p>

<p>server "example.com" {
  listen on * port 80
  block return 301 "http://www.example.com$REQUEST_URI"
}
```</p>

<ul>
<li>httpd is chrooted to /var/www by default, so let's make a document root directory:</li>
</ul>

<p><code>www# mkdir -p /var/www/htdocs/www.example.com</code></p>

<ul>
<li>Save and check this configuration:</li>
</ul>

<p><code>
www# httpd -n
configuration ok
</code></p>

<ul>
<li>Enable httpd(8) daemon and start it.</li>
</ul>

<p><code>
www# rcctl enable httpd
www# rcctl start httpd
</code></p>

<ul>
<li><p>Publish your website</p></li>
<li><p>Copy your website content into /var/www/htdocs/www.example.com and then test it your web browser.</p></li>
</ul>

<p><code>http://XXX.XXX.XXX.XXX/</code></p>

<blockquote>
  <p>Your web server should be up and running.</p>
</blockquote>

<ul>
<li>Update DNS records</li>
</ul>

<blockquote>
  <p>If there is another HTTPS server using this domain, configure that server to redirect all HTTPS requests to HTTP.</p>
  
  <p>Now as your new server is ready you can update DNS records accordingly.</p>
</blockquote>

<p><code>
    example.com. 300 IN     A XXX.XXX.XXX.XXX
www.example.com. 300 IN     A XXX.XXX.XXX.XXX
</code></p>

<ul>
<li>Examine your DNS is propagated.</li>
</ul>

<p><code>$ dig example.com www.example.com</code></p>

<ul>
<li><p>Check IP addresses it answer sections. If they are correct, you should be able to access your new web server by its domain name.</p></li>
<li><p><a href="https://www.romanzolotarev.com/openbsd/acme-client.html">What's next? Enable HTTPS on your server.</a></p></li>
</ul>

<p><hr /></p>

<h3><a href="https://euroquis.nl/bobulate/?p=1827">Modern Akonadi and KMail on FreeBSD</a></h3>

<blockquote>
  <p>For, quite literally a year or more, KMail and Akonadi on FreeBSD have been only marginally useful, at best. KDE4 era KMail was pretty darn good, but everything after that has had a number of FreeBSD users tearing out their hair. Sure, you can go to Trojitá, which has its own special problems and is generally “meh”, or bail out entirely to webmail, but .. KMail is a really great mail client when it works. Which, on Linux desktops, is nearly always, and on FreeBSD, is was nearly never.</p>
  
  <p>I looked at it with Dan and Volker last summer, briefly, and we got not much further than “hmm”. There’s a message about “The world is going to end!” which hardly makes sense, it means that a message has been truncated or corrupted while traversing a UNIX domain socket.</p>
  
  <p>Now Alexandre Martins — praise be! — has wandered in with a likely solution. KDE Bug 381850 contains a suggestion, which deserves to be publicised (and tested):</p>
</blockquote>

<p><code>sysctl net.local.stream.recvspace=65536</code>
<code>sysctl net.local.stream.sendspace=65536</code></p>

<blockquote>
  <p>The default FreeBSD UNIX local socket buffer space is 8kiB. Bumping the size up to 64kiB — which matches the size that Linux has by default — suddenly makes KMail and Akonadi shine again. No other changes, no recompiling, just .. bump the sysctls (perhaps also in /etc/sysctl.conf) and KMail from Area51 hums along all day without ending the world.</p>
  
  <p>Since changing this value may have other effects, and Akonadi shouldn’t be dependent on a specific buffer size anyway, I’m looking into the Akonadi code (encouraged by Dan) to either automatically size the socket buffers, or to figure out where in the underlying code the assumption about buffer size lives. So for now, sysctl can make KMail users on FreeBSD happy, and later we hope to have things fully automatic (and if that doesn’t pan out, well, pkg-message exists).</p>
  
  <p>PS. Modern KDE PIM applications — Akonadi, KMail — which live in the deskutils/ category of the official FreeBSD ports were added to the official tree April 10th, so you can get your fix now from the official tree.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2018-April/335722.html">pkg-provides support for DragonFly (from Rodrigo Osorio)</a></li>
<li><a href="https://monades.roperzh.com/memories-writing-parser-man-pages/">Memories of writing a parser for man pages</a></li>
<li><a href="http://developeronfire.com/podcast/episode-198-bryan-cantrill-persistence-and-action">Bryan Cantrill interview over at DeveloperOnFire podcast</a></li>
<li><a href="http://minnie.tuhs.org/pipermail/tuhs/2018-March/013285.html">1978-03-25 - 2018-03-25: 40 years BSD Mail</a></li>
<li><a href="https://imgur.com/a/KOTJS">My 5 years of FreeBSD gaming: a compendium of free games and engines running natively on FreeBSD</a></li>
<li><a href="https://reviews.freebsd.org/D15562">Sequential Resilver being upstreamed to FreeBSD, from FreeNAS, where it was ported from ZFS-on-Linux</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2018-May/000944.html">University of Aberdeen’s Internet Transport Research Group is hiring  </a></li>
</ul>

<p><hr /></p>

<p><strong>Tarsnap ad</strong></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Dave - <a href="http://dpaste.com/0KHRB4Z#wrap">mounting non-filesystem things inside jails</a></li>
<li>Morgan - <a href="http://dpaste.com/10QD42T#wrap">ZFS on Linux Data loss bug</a></li>
<li>Rene - <a href="http://dpaste.com/30VM51S#wrap">How to keep your ISP’s nose out of your browser history with encrypted DNS</a></li>
<li>Rodriguez - <a href="http://dpaste.com/3WVYR9D#wrap">Feedback question! Relating to Windows</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 247: Interning for FreeBSD | BSD Now 247</title>
  <link>https://www.bsdnow.tv/247</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-1994</guid>
  <pubDate>Thu, 24 May 2018 15:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/31bf045b-2e53-459e-a40e-993a51ceccdb.mp3" length="54062460" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD internship learnings, exciting developments coming to FreeBSD, running FreeNAS on DigitalOcean, Network Manager control for OpenBSD, OpenZFS User Conference Videos are here and batch editing files with ed.</itunes:subtitle>
  <itunes:duration>1:29:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD internship learnings, exciting developments coming to FreeBSD, running FreeNAS on DigitalOcean, Network Manager control for OpenBSD, OpenZFS User Conference Videos are here and batch editing files with ed.
&lt;h2&gt;Headlines&lt;/h2&gt;
&lt;h3&gt;&lt;a href="https://www.freebsdfoundation.org/blog/guest-blog-what-i-learned-during-my-freebsd-internship/"&gt;What I learned during my FreeBSD intership&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Hi, my name is Mitchell Horne. I am a computer engineering student at the University of Waterloo, currently in my third year of studies, and fortunate to have been one of the FreeBSD Foundation’s co-op students this past term (January to April). During this time I worked under Ed Maste, in the Foundation’s small Kitchener office, along with another co-op student Arshan Khanifar. My term has now come to an end, and so I’d like to share a little bit about my experience as a newcomer to FreeBSD and open-source development.&lt;/p&gt;
  
  &lt;p&gt;I’ll begin with some quick background — and a small admission of guilt. I have been an open-source user for a large part of my life. When I was a teenager I started playing around with Linux, which opened my eyes to the wider world of free software. Other than some small contributions to GNOME, my experience has been mostly as an end user; however, the value of these projects and the open-source philosophy was not lost on me, and is most of what motivated my interest in this position. Before beginning this term I had no personal experience with any of the BSDs, although I knew of their existence and was extremely excited to receive the position. I knew it would be a great opportunity for growth, but I must confess that my naivety about FreeBSD caused me to make the silent assumption that this would be a form of compromise — a stepping stone that would eventually allow me to work on open-source projects that are somehow “greater” or more “legitimate”. After four months spent immersed in this project I have learned how it operates, witnessed its community, and learned about its history. I am happy to admit that I was completely mistaken. Saying it now seems obvious, but FreeBSD is a project with its own distinct uses, goals, and identity. For many there may exist no greater opportunity than to work on FreeBSD full time, and with what I know now I would have a hard time coming up with a project that is more “legitimate”.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;What I Liked&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;In all cases, the work I submitted this term was reviewed by no less than two people before being committed. The feedback and criticism I received was always both constructive and to the point, and it commented on everything from high-level ideas to small style issues. I appreciate having these thorough reviews in place, since I believe it ultimately encourages people to accept only their best work. It is indicative of the high quality that already exists within every aspect of this project, and this commitment to quality is something that should continue to be honored as a core value. As I’ve discovered in some of my previous work terms, it is all too easy cut corners in the name of a deadline or changing priorities, but the fact that FreeBSD doesn’t need to make these types of compromises is a testament to the power of free software.&lt;/p&gt;
  
  &lt;p&gt;It’s a small thing, but the quality and completeness of the FreeBSD documentation was hugely helpful throughout my term. Everything you might need to know about utilities, library functions, the kernel, and more can be found in a man page; and the handbook is a great resource as both an introduction to the operating system and a reference. I only wish I had taken some time earlier in the term to explore the different documents more thoroughly, as they cover a wide range of interesting and useful topics. The effort people put into writing and maintaining FreeBSD’s documentation is easy to overlook, but its value cannot be overstated.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;What I Learned&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Although there was a lot I enjoyed, there were certainly many struggles I faced throughout the term, and lessons to be learned from them. I expect that some of issues I faced may be specific to FreeBSD, while others may be common to open-source projects in general. I don’t have enough experience to speculate on which is which, so I will leave this to the reader.&lt;/p&gt;
  
  &lt;p&gt;The first lesson can be summed up simply: you have to advocate for your own work. FreeBSD is made up in large part by volunteer efforts, and in many cases there is more work to go around than people available to do it. A consequence of this is that there will not be anybody there to check up on you. Even in my position where I actually had a direct supervisor, Ed often had his plate full with so many other things that the responsibility to find someone to look at my work fell to me. Admittedly, a couple of smaller changes I worked on got left behind or stuck in review simply because there wasn’t a clear person/place to reach out to.&lt;/p&gt;
  
  &lt;p&gt;I think this is both a barrier of entry to FreeBSD and a mental hurdle that I needed to get over. If there’s a change you want to see included or reviewed, then you may have to be the one to push for it, and there’s nothing wrong with that. Perhaps this process should be easier for newcomers or infrequent contributors (the disconnect between Bugzilla and Phabricator definitely leaves a lot to be desired), but we also have to be aware that this simply isn’t the reality right now. Getting your work looked at may require a little bit more self-motivation, but I’d argue that there are much worse problems a project like FreeBSD could have than this.&lt;/p&gt;
  
  &lt;p&gt;I understand this a lot better now, but it is still something I struggle with. I’m not naturally the type of person who easily connects with others or asks for help, so I see this as an area for future growth rather than simply a struggle I encountered and overcame over the course of this work term. Certainly it is an important skill to understand the value of your own work, and equally important is the ability to communicate that value to others.&lt;/p&gt;
  
  &lt;p&gt;I also learned the importance of starting small. My first week or two on the job mainly involved getting set up and comfortable with the workflow. After this initial stage, I began exploring the project and found myself overwhelmed by its scale. With so many possible areas to investigate, and so much work happening at once, I felt quite lost on where to begin. Many of the potential projects I found were too far beyond my experience level, and most small bugs were picked up and fixed quickly by more experienced contributors before I could even get to them.&lt;/p&gt;
  
  &lt;p&gt;It’s easy to make the mistake that FreeBSD is made up solely of a few rock-star committers that do everything. This is how it appears at face-value, as reading through commits, bug reports, and mailing lists yields a few of the same names over and over. The reality is that just as important are the hundreds of users and infrequent contributors who take the time to submit bug reports, patches, or feedback. Even though there are some people who would fall under the umbrella of a rock-star committer, they didn’t get there overnight. Rather, they have built their skills and knowledge through many years of involvement in FreeBSD and similar projects.&lt;/p&gt;
  
  &lt;p&gt;As a student coming into this project and having high expectations of myself, it was easy to set the bar too high by comparing myself against those big committers, and feel that my work was insignificant, inadequate, and simply too infrequent. In reality, there is no reason I should have felt this way. In a way, this comparison is disrespectful to those who have reached this level, as it took them a long time to get there, and it’s a humbling reminder that any skill worth learning requires time, patience, and dedication. It is easy to focus on an end product and simply wish to be there, but in order to be truly successful one must start small, and find satisfaction in the struggle of learning something new. I take pride in the many small successes I’ve had throughout my term here, and appreciate the fact that my journey into FreeBSD and open-source software is only just beginning.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Closing Thoughts&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;I would like to close with some brief thank-you’s. First, to everyone at the Foundation for being so helpful, and allowing this position to exist in the first place. I am extremely grateful to have been given this unique opportunity to learn about and give back to the open-source world. I’d also like to thank my office mates; Ed: for being an excellent mentor, who offered an endless wealth of knowledge and willingness to share it. My classmate and fellow intern Arshan: for giving me a sense of camaraderie and the comforting reminder that at many moments he was as lost as I was. Finally, a quick thanks to everyone else I crossed paths with who offered reviews and advice. I appreciate your help and look forward to working with you all further.&lt;/p&gt;
  
  &lt;p&gt;I am walking away from this co-op with a much greater appreciation for this project, and have made it a goal to remain involved in some capacity. I feel that I’ve gained a little bit of a wider perspective on my place in the software world, something I never really got from my previous co-ops. Whether it ends up being just a stepping stone, or the beginning of much larger involvement, I thoroughly enjoyed my time here.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;Recent Developments in FreeBSD&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=333890"&gt;Support for encrypted, compressed (gzip and zstd), and network crash dumps enabled by default on most platforms&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=333649"&gt;Intel Microcode Splitter&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=334005"&gt;Intel Spec Store Bypass Disable control&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=333713"&gt;Raspberry Pi 3B+ Ethernet Driver&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://reviews.freebsd.org/D15522"&gt;IBRS for i386&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;Upcoming:&lt;/li&gt;
&lt;li&gt;&lt;a href="https://reviews.freebsd.org/D15523"&gt;Microcode updater for AMD CPUs&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://reviews.freebsd.org/D15525"&gt;the RACK TCP/IP stack, from Netflix&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;Voting in the FreeBSD Core Election begins today:&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;DigitalOcean&lt;/strong&gt;
&lt;a href="http://do.co/bsdnow"&gt;Digital Ocean Promo Link for BSD Now Listeners&lt;/a&gt;&lt;/p&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="http://www.shlomimarco.com/blog/running-freenas-on-a-digitalocean-droplet"&gt;Running FreeNAS on a DigitalOcean Droplet&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;Need to backup your FreeNAS offsite? Run a locked down instance in the cloud, and replicate to it&lt;/li&gt;
&lt;li&gt;The tutorial walks though the steps of converting a fresh FreeBSD based droplet into a FreeNAS&lt;/li&gt;
&lt;li&gt;Create a droplet, and add a small secondary block-storage device&lt;/li&gt;
&lt;li&gt;Boot the droplet, login, and download FreeNAS&lt;/li&gt;
&lt;li&gt;Disable swap, enable ‘foot shooting’ mode in GEOM&lt;/li&gt;
&lt;li&gt;use dd to write the FreeNAS installer to the boot disk&lt;/li&gt;
&lt;li&gt;Reboot the droplet, and use the FreeNAS installer to install FreeNAS to the secondary block storage device&lt;/li&gt;
&lt;li&gt;Now, reimage the droplet with FreeBSD again, to replace the FreeNAS installer&lt;/li&gt;
&lt;li&gt;Boot, and dd FreeNAS from the secondary block storage device back to the boot disk&lt;/li&gt;
&lt;li&gt;You can now destroy the secondary block device&lt;/li&gt;
&lt;li&gt;Now you have a FreeNAS, and can take it from there.&lt;/li&gt;
&lt;li&gt;Use the FreeNAS replication wizard to configure sending snapshots from your home NAS to your cloud NAS&lt;/li&gt;
&lt;li&gt;Note: You might consider creating a new block storage device to create a larger pool, that you can more easily grow over time, rather than using the boot device in the droplet as your main pool.&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="http://www.vincentdelft.be/post/post_20180411"&gt;Network Manager Control for OpenBSD (Updated)&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;Generalities&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;I just remind the scope of this small tool:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;allow you to pre-define several cable or wifi connections&lt;/li&gt;
&lt;li&gt;let nmctl to connect automatically to the first available one&lt;/li&gt;
&lt;li&gt;allow you to easily switch from one network connection to an other one&lt;/li&gt;
&lt;li&gt;create openbox dynamic menus&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;&lt;p&gt;Enhancements in this version&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;This is my second development version: 0.2.
  I've added performed several changes in the code:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;code style cleanup, to better match the python recommendations&lt;/li&gt;
&lt;li&gt;adapt the tool to allow to connect to an Open-wifi having blancs in the name. This happens in some hotels&lt;/li&gt;
&lt;li&gt;implement a loop as work-around concerning the arp table issue.&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;The source code is still on the git of Sourceforge.net. 
   You can see the files &lt;a href="https://sourceforge.net/p/nmctl/code/ci/master/tree/"&gt;here&lt;/a&gt;&lt;/p&gt;
  
  &lt;p&gt;And you can download the last version &lt;a href="https://sourceforge.net/p/nmctl/code/ci/master/tarball"&gt;here&lt;/a&gt;&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Feedbacks after few months&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;I'm using this script on my OpenBSD laptop since about 5 months. In my case, I'm mainly using the openbox menus and the --restart option.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;The Openbox menus&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;The openbox menus are working fine. As explain in my previous blog, I just have to create 2 entries in my openbox's menu.xml file, and all the rest comes automatically from nmctl itself thanks to the --list and --scan options.
  I've not changed this part of nmctl since it works as expected (for me :-) ).&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;The --restart option&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Because I'm very lazy, and because OpenBSD is very simple to use, I've added the command "nmctl --restart" in the /etc/apm/resume script. Thanks to apmd, this script will be used each time I'm opening the lid of my laptop. 
  In other words, each time I'll opening my laptop, nmctl will search the optimum network connection for me.
  But I had several issues in this scenario.
  Most of the problems were linked to the arp table issues. Indeed, in some circumstances, my proxy IP address was associated to the cable interface instead of the wifi interface or vice-versa. As consequence I'm not able to connect to the proxy, thus not able to connect to internet. So the ping to google (final test nmctl perform) is failing.
  Knowing that anyhow, I'm doing a full arp cleanup, it's not clear for me from where this problem come from. To solve this situation I've implemented a "retry" concept. In other words, before testing an another possible network connection (as listed in my /etc/nmctl.conf file), the script try 3x the current connection's parameters.
  If you want to reduce or increase this figures, you can do it via the --retry parameter.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Results of my expertise with this small tool&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Where ever I'm located, my laptop is now connecting automatically to the wifi / cable connection previously identified for this location.
  Currently I have 3 places where I have Wifi credentials and 2 offices places where I just have to plug the network cable.
  Since the /etc/apm/resume scripts is triggered when I open the lid of the laptop, I just have to make sure that I plug the RJ45 before opening the laptop. For the rest, I do not have to type any commands, OpenBSD do all what is needed ;-).
  I hotels or restaurants, I can just connect to the Open Wifi thanks to the openbox menu created by "nmctl --scan".&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;Next steps&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;Documentation&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;The tool is missing lot of documentation. I appreciate OpenBSD for his great documentation, so I have to do the same.
  I plan to write a README and a man page at first instances.
  But since my laziness, I will do it as soon as I see some interest for this tool from other persons.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Tests&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;I now have to travel and see how to see the script react on the different situations.
  Interested persons are welcome to share with me the outcome of their tests.
  I'm curious how it work.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://an.undulating.space/post/180411-erl-openbsd-upgrade/"&gt;OpenBSD 6.3 on EdgeRouter Lite simple upgrade method&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;TL;DR&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;OpenBSD 6.3 oceton upgrade instructions may not factor that your ERL is running from the USB key they want wiped with the miniroot63.fs image loaded on.
  Place the bsd.rd for OpenBSD 6.3 on the sd0i slice used by U-Boot for the kernel, and then edit the boot command to run it.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;a tiny upgrade&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;The OpenBSD documentation is comprehensive, but there might be rough corners around what are probably edge cases in their user base. People running EdgeRouter Lite hardware for example, who are looking to upgrade from 6.2 to 6.3.
  The documentation, which gave us everything we needed last time, left me with some questions about how to upgrade. In INSTALL.octeon, the Upgrading section does mention:
  The best solution, whenever possible, is to backup your data and reinstall from scratch
  I had to check if that directive existed in the documentation for other architectures. I wondered if oceton users were getting singled out. We were not. Just simplicity and pragmatism.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Reading on:&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;To upgrade OpenBSD 6.3 from a previous version, start with the general instructions in the section "Installing OpenBSD".
  But that section requires us to boot off of TFTP or NFS. Which I don’t want to do right now. Could also use a USB stick with the miniroot63.fs installed on it.
  But as the ERL only has a single USB port, we would have to remove the USB stick with the current install on it. Once we get to the Install or Upgrade prompt, there would be nothing to upgrade.
  Well, I guess I could use a USB hub. But the ERL’s USB port is inside the case. With all the screws in. And the tools are neatly put away. And I’d have to pull the USB hub from behind a workstation. And it’s two am. And I cleaned up the cabling in the lab this past weekend. Looks nice for once.
  So I don’t want to futz around with all that.
  There must be an almost imperceptibly easier way of doing this than setting up a TFTP server or NFS share in five minutes… Right?&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;
&lt;a href="https://www.ixsystems.com/blog/boisetechshow-2018/"&gt;Boise Technology Show 2018 Recap&lt;/a&gt;&lt;/p&gt;

&lt;h3&gt;&lt;a href="http://zfs.datto.com/"&gt;OpenZFS User Conference Slides &amp;amp; Videos&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://vimeo.com/album/5150026/video/266112599"&gt;Thank you ZFS&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vimeo.com/album/5150026/video/266112475"&gt;ZSTD Compression&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vimeo.com/album/5150026/video/266111164"&gt;Pool Layout Considerations&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vimeo.com/album/5150026/video/266111346"&gt;ZFS Releases&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vimeo.com/album/5150026/video/266112077"&gt;Helping Developers Help You&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vimeo.com/album/5150026/video/266112233"&gt;ZFS and MySQL on Linux&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vimeo.com/album/5150026/video/266110985"&gt;Micron&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vimeo.com/album/5150026/video/266108105"&gt;OSNEXUS&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vimeo.com/album/5150026/video/266107946"&gt;ZFS at Six Feet Up&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://vimeo.com/album/5150026/video/266107372"&gt;Flexible Disk Use with OpenZFS&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://jvns.ca/blog/2018/05/11/batch-editing-files-with-ed/"&gt;Batch editing files with ed&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;what’s ‘ed’?&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;ed is this sort of terrifying text editor. A typical interaction with ed for me in the past has gone something like this:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;&lt;code&gt;
$ ed
help
?
h
?
asdfasdfasdfsadf
?
&amp;lt;close terminal in frustration&amp;gt;
&lt;/code&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;Basically if you do something wrong, ed will just print out a single, unhelpful, ?. So I’d basically dismissed ed as an old arcane Unix tool that had no practical use today.
  vi is a successor to ed, except with a visual interface instead of this ?&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;surprise: Ed is actually sort of cool and fun&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;So if Ed is a terrifying thing that only prints ? at you, why am I writing a blog post about it? WELL!!!!
  On April 1 this year, Michael W Lucas published a new short book called Ed Mastery. I like his writing, and even though it was sort of an april fool’s joke, it was ALSO a legitimate actual real book, and so I bought it and read it to see if his claims that Ed is actually interesting were true.
  And it was so cool!!!! I found out:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;how to get Ed to give you better error messages than just ?&lt;/li&gt;
&lt;li&gt;that the name of the grep command comes from ed syntax (g/re/p)&lt;/li&gt;
&lt;li&gt;the basics of how to navigate and edit files using ed&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;All of that was a cool Unix history lesson, but did not make me want to actually use Ed in real life. But!!!&lt;/p&gt;
  
  &lt;p&gt;The other neat thing about Ed (that did make me want to use it!) is that any Ed session corresponds to a script that you can replay! So if I know Ed, then I can use Ed basically as a way to easily apply vim-macro-like programs to my files.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://blather.michaelwlucas.com/archives/3186"&gt;FreeBSD Mastery: Jails -- Help make it happen &lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=MsY-BafQgj4"&gt;Video: OpenZFS Basics presented by George Wilson and Matt Ahrens at Scale 16x back in March 2018&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.dragonflydigest.com/2018/05/17/21257.html"&gt;DragonFlyBSD’s IPFW gets highspeed lockless in-kernel NAT&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.reddit.com/r/openbsd/comments/8ei00k/a_love_letter_to_openbsd/"&gt;A Love Letter to OpenBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blather.michaelwlucas.com/archives/3176"&gt;New talks, and the F-bomb&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://manpages.bsd.lv/mdoc.html"&gt;Practical UNIX Manuals: mdoc&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-advocacy/2018-May/004758.html"&gt;BSD Meetup in Zurich: May 24th&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.eventbrite.com/e/the-polish-bsd-user-group-1-meetup-tickets-45941857332"&gt;BSD Meetup in Warsaw: May 24th&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://meetbsd.com/"&gt;MeetBSD 2018&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;

&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Seth - &lt;a href="http://dpaste.com/12R65X4#wrap"&gt;First time poudriere Builder&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Farhan - &lt;a href="http://dpaste.com/1GHCGY5#wrap"&gt;Why we didn't go FreeBSD&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;architech - &lt;a href="http://dpaste.com/1H72FGE#wrap"&gt;Encryption Feedback&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Dave - &lt;a href="http://dpaste.com/27YH93Y#wrap"&gt;Handy Tip on setting up automated coredump handling for FreeBSD&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, FreeBSD Internship, FreeNAS, Digital Ocean, Network Manager, EdgeRouter Lite, OpenZFS, ed</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD internship learnings, exciting developments coming to FreeBSD, running FreeNAS on DigitalOcean, Network Manager control for OpenBSD, OpenZFS User Conference Videos are here and batch editing files with ed.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/guest-blog-what-i-learned-during-my-freebsd-internship/">What I learned during my FreeBSD intership</a></h3>

<blockquote>
  <p>Hi, my name is Mitchell Horne. I am a computer engineering student at the University of Waterloo, currently in my third year of studies, and fortunate to have been one of the FreeBSD Foundation’s co-op students this past term (January to April). During this time I worked under Ed Maste, in the Foundation’s small Kitchener office, along with another co-op student Arshan Khanifar. My term has now come to an end, and so I’d like to share a little bit about my experience as a newcomer to FreeBSD and open-source development.</p>
  
  <p>I’ll begin with some quick background — and a small admission of guilt. I have been an open-source user for a large part of my life. When I was a teenager I started playing around with Linux, which opened my eyes to the wider world of free software. Other than some small contributions to GNOME, my experience has been mostly as an end user; however, the value of these projects and the open-source philosophy was not lost on me, and is most of what motivated my interest in this position. Before beginning this term I had no personal experience with any of the BSDs, although I knew of their existence and was extremely excited to receive the position. I knew it would be a great opportunity for growth, but I must confess that my naivety about FreeBSD caused me to make the silent assumption that this would be a form of compromise — a stepping stone that would eventually allow me to work on open-source projects that are somehow “greater” or more “legitimate”. After four months spent immersed in this project I have learned how it operates, witnessed its community, and learned about its history. I am happy to admit that I was completely mistaken. Saying it now seems obvious, but FreeBSD is a project with its own distinct uses, goals, and identity. For many there may exist no greater opportunity than to work on FreeBSD full time, and with what I know now I would have a hard time coming up with a project that is more “legitimate”.</p>
</blockquote>

<ul>
<li>What I Liked</li>
</ul>

<blockquote>
  <p>In all cases, the work I submitted this term was reviewed by no less than two people before being committed. The feedback and criticism I received was always both constructive and to the point, and it commented on everything from high-level ideas to small style issues. I appreciate having these thorough reviews in place, since I believe it ultimately encourages people to accept only their best work. It is indicative of the high quality that already exists within every aspect of this project, and this commitment to quality is something that should continue to be honored as a core value. As I’ve discovered in some of my previous work terms, it is all too easy cut corners in the name of a deadline or changing priorities, but the fact that FreeBSD doesn’t need to make these types of compromises is a testament to the power of free software.</p>
  
  <p>It’s a small thing, but the quality and completeness of the FreeBSD documentation was hugely helpful throughout my term. Everything you might need to know about utilities, library functions, the kernel, and more can be found in a man page; and the handbook is a great resource as both an introduction to the operating system and a reference. I only wish I had taken some time earlier in the term to explore the different documents more thoroughly, as they cover a wide range of interesting and useful topics. The effort people put into writing and maintaining FreeBSD’s documentation is easy to overlook, but its value cannot be overstated.</p>
</blockquote>

<ul>
<li>What I Learned</li>
</ul>

<blockquote>
  <p>Although there was a lot I enjoyed, there were certainly many struggles I faced throughout the term, and lessons to be learned from them. I expect that some of issues I faced may be specific to FreeBSD, while others may be common to open-source projects in general. I don’t have enough experience to speculate on which is which, so I will leave this to the reader.</p>
  
  <p>The first lesson can be summed up simply: you have to advocate for your own work. FreeBSD is made up in large part by volunteer efforts, and in many cases there is more work to go around than people available to do it. A consequence of this is that there will not be anybody there to check up on you. Even in my position where I actually had a direct supervisor, Ed often had his plate full with so many other things that the responsibility to find someone to look at my work fell to me. Admittedly, a couple of smaller changes I worked on got left behind or stuck in review simply because there wasn’t a clear person/place to reach out to.</p>
  
  <p>I think this is both a barrier of entry to FreeBSD and a mental hurdle that I needed to get over. If there’s a change you want to see included or reviewed, then you may have to be the one to push for it, and there’s nothing wrong with that. Perhaps this process should be easier for newcomers or infrequent contributors (the disconnect between Bugzilla and Phabricator definitely leaves a lot to be desired), but we also have to be aware that this simply isn’t the reality right now. Getting your work looked at may require a little bit more self-motivation, but I’d argue that there are much worse problems a project like FreeBSD could have than this.</p>
  
  <p>I understand this a lot better now, but it is still something I struggle with. I’m not naturally the type of person who easily connects with others or asks for help, so I see this as an area for future growth rather than simply a struggle I encountered and overcame over the course of this work term. Certainly it is an important skill to understand the value of your own work, and equally important is the ability to communicate that value to others.</p>
  
  <p>I also learned the importance of starting small. My first week or two on the job mainly involved getting set up and comfortable with the workflow. After this initial stage, I began exploring the project and found myself overwhelmed by its scale. With so many possible areas to investigate, and so much work happening at once, I felt quite lost on where to begin. Many of the potential projects I found were too far beyond my experience level, and most small bugs were picked up and fixed quickly by more experienced contributors before I could even get to them.</p>
  
  <p>It’s easy to make the mistake that FreeBSD is made up solely of a few rock-star committers that do everything. This is how it appears at face-value, as reading through commits, bug reports, and mailing lists yields a few of the same names over and over. The reality is that just as important are the hundreds of users and infrequent contributors who take the time to submit bug reports, patches, or feedback. Even though there are some people who would fall under the umbrella of a rock-star committer, they didn’t get there overnight. Rather, they have built their skills and knowledge through many years of involvement in FreeBSD and similar projects.</p>
  
  <p>As a student coming into this project and having high expectations of myself, it was easy to set the bar too high by comparing myself against those big committers, and feel that my work was insignificant, inadequate, and simply too infrequent. In reality, there is no reason I should have felt this way. In a way, this comparison is disrespectful to those who have reached this level, as it took them a long time to get there, and it’s a humbling reminder that any skill worth learning requires time, patience, and dedication. It is easy to focus on an end product and simply wish to be there, but in order to be truly successful one must start small, and find satisfaction in the struggle of learning something new. I take pride in the many small successes I’ve had throughout my term here, and appreciate the fact that my journey into FreeBSD and open-source software is only just beginning.</p>
</blockquote>

<ul>
<li>Closing Thoughts</li>
</ul>

<blockquote>
  <p>I would like to close with some brief thank-you’s. First, to everyone at the Foundation for being so helpful, and allowing this position to exist in the first place. I am extremely grateful to have been given this unique opportunity to learn about and give back to the open-source world. I’d also like to thank my office mates; Ed: for being an excellent mentor, who offered an endless wealth of knowledge and willingness to share it. My classmate and fellow intern Arshan: for giving me a sense of camaraderie and the comforting reminder that at many moments he was as lost as I was. Finally, a quick thanks to everyone else I crossed paths with who offered reviews and advice. I appreciate your help and look forward to working with you all further.</p>
  
  <p>I am walking away from this co-op with a much greater appreciation for this project, and have made it a goal to remain involved in some capacity. I feel that I’ve gained a little bit of a wider perspective on my place in the software world, something I never really got from my previous co-ops. Whether it ends up being just a stepping stone, or the beginning of much larger involvement, I thoroughly enjoyed my time here.</p>
</blockquote>

<p><hr /></p>

<h3>Recent Developments in FreeBSD</h3>

<ul>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=333890">Support for encrypted, compressed (gzip and zstd), and network crash dumps enabled by default on most platforms</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=333649">Intel Microcode Splitter</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=334005">Intel Spec Store Bypass Disable control</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=333713">Raspberry Pi 3B+ Ethernet Driver</a></li>
<li><a href="https://reviews.freebsd.org/D15522">IBRS for i386</a></li>
<li>Upcoming:</li>
<li><a href="https://reviews.freebsd.org/D15523">Microcode updater for AMD CPUs</a></li>
<li><a href="https://reviews.freebsd.org/D15525">the RACK TCP/IP stack, from Netflix</a></li>
<li>Voting in the FreeBSD Core Election begins today:</li>
</ul>

<p><hr /></p>

<p><strong>DigitalOcean</strong>
<a href="http://do.co/bsdnow">Digital Ocean Promo Link for BSD Now Listeners</a></p>

<p><hr /></p>

<h3><a href="http://www.shlomimarco.com/blog/running-freenas-on-a-digitalocean-droplet">Running FreeNAS on a DigitalOcean Droplet</a></h3>

<ul>
<li>Need to backup your FreeNAS offsite? Run a locked down instance in the cloud, and replicate to it</li>
<li>The tutorial walks though the steps of converting a fresh FreeBSD based droplet into a FreeNAS</li>
<li>Create a droplet, and add a small secondary block-storage device</li>
<li>Boot the droplet, login, and download FreeNAS</li>
<li>Disable swap, enable ‘foot shooting’ mode in GEOM</li>
<li>use dd to write the FreeNAS installer to the boot disk</li>
<li>Reboot the droplet, and use the FreeNAS installer to install FreeNAS to the secondary block storage device</li>
<li>Now, reimage the droplet with FreeBSD again, to replace the FreeNAS installer</li>
<li>Boot, and dd FreeNAS from the secondary block storage device back to the boot disk</li>
<li>You can now destroy the secondary block device</li>
<li>Now you have a FreeNAS, and can take it from there.</li>
<li>Use the FreeNAS replication wizard to configure sending snapshots from your home NAS to your cloud NAS</li>
<li>Note: You might consider creating a new block storage device to create a larger pool, that you can more easily grow over time, rather than using the boot device in the droplet as your main pool.</li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="http://www.vincentdelft.be/post/post_20180411">Network Manager Control for OpenBSD (Updated)</a></h3>

<ul>
<li>Generalities</li>
<li><p>I just remind the scope of this small tool:</p>

<ul><li>allow you to pre-define several cable or wifi connections</li>
<li>let nmctl to connect automatically to the first available one</li>
<li>allow you to easily switch from one network connection to an other one</li>
<li>create openbox dynamic menus</li></ul></li>
<li><p>Enhancements in this version</p></li>
</ul>

<blockquote>
  <p>This is my second development version: 0.2.
  I've added performed several changes in the code:</p>
</blockquote>

<ul>
<li>code style cleanup, to better match the python recommendations</li>
<li>adapt the tool to allow to connect to an Open-wifi having blancs in the name. This happens in some hotels</li>
<li>implement a loop as work-around concerning the arp table issue.</li>
</ul>

<blockquote>
  <p>The source code is still on the git of Sourceforge.net. 
   You can see the files <a href="https://sourceforge.net/p/nmctl/code/ci/master/tree/">here</a></p>
  
  <p>And you can download the last version <a href="https://sourceforge.net/p/nmctl/code/ci/master/tarball">here</a></p>
</blockquote>

<ul>
<li>Feedbacks after few months</li>
</ul>

<blockquote>
  <p>I'm using this script on my OpenBSD laptop since about 5 months. In my case, I'm mainly using the openbox menus and the --restart option.</p>
</blockquote>

<ul>
<li>The Openbox menus</li>
</ul>

<blockquote>
  <p>The openbox menus are working fine. As explain in my previous blog, I just have to create 2 entries in my openbox's menu.xml file, and all the rest comes automatically from nmctl itself thanks to the --list and --scan options.
  I've not changed this part of nmctl since it works as expected (for me :-) ).</p>
</blockquote>

<ul>
<li>The --restart option</li>
</ul>

<blockquote>
  <p>Because I'm very lazy, and because OpenBSD is very simple to use, I've added the command "nmctl --restart" in the /etc/apm/resume script. Thanks to apmd, this script will be used each time I'm opening the lid of my laptop. 
  In other words, each time I'll opening my laptop, nmctl will search the optimum network connection for me.
  But I had several issues in this scenario.
  Most of the problems were linked to the arp table issues. Indeed, in some circumstances, my proxy IP address was associated to the cable interface instead of the wifi interface or vice-versa. As consequence I'm not able to connect to the proxy, thus not able to connect to internet. So the ping to google (final test nmctl perform) is failing.
  Knowing that anyhow, I'm doing a full arp cleanup, it's not clear for me from where this problem come from. To solve this situation I've implemented a "retry" concept. In other words, before testing an another possible network connection (as listed in my /etc/nmctl.conf file), the script try 3x the current connection's parameters.
  If you want to reduce or increase this figures, you can do it via the --retry parameter.</p>
</blockquote>

<ul>
<li>Results of my expertise with this small tool</li>
</ul>

<blockquote>
  <p>Where ever I'm located, my laptop is now connecting automatically to the wifi / cable connection previously identified for this location.
  Currently I have 3 places where I have Wifi credentials and 2 offices places where I just have to plug the network cable.
  Since the /etc/apm/resume scripts is triggered when I open the lid of the laptop, I just have to make sure that I plug the RJ45 before opening the laptop. For the rest, I do not have to type any commands, OpenBSD do all what is needed ;-).
  I hotels or restaurants, I can just connect to the Open Wifi thanks to the openbox menu created by "nmctl --scan".</p>
</blockquote>

<ul>
<li><p>Next steps</p></li>
<li><p>Documentation</p></li>
</ul>

<blockquote>
  <p>The tool is missing lot of documentation. I appreciate OpenBSD for his great documentation, so I have to do the same.
  I plan to write a README and a man page at first instances.
  But since my laziness, I will do it as soon as I see some interest for this tool from other persons.</p>
</blockquote>

<ul>
<li>Tests</li>
</ul>

<blockquote>
  <p>I now have to travel and see how to see the script react on the different situations.
  Interested persons are welcome to share with me the outcome of their tests.
  I'm curious how it work.</p>
</blockquote>

<p><hr /></p>

<h3><a href="https://an.undulating.space/post/180411-erl-openbsd-upgrade/">OpenBSD 6.3 on EdgeRouter Lite simple upgrade method</a></h3>

<ul>
<li>TL;DR</li>
</ul>

<blockquote>
  <p>OpenBSD 6.3 oceton upgrade instructions may not factor that your ERL is running from the USB key they want wiped with the miniroot63.fs image loaded on.
  Place the bsd.rd for OpenBSD 6.3 on the sd0i slice used by U-Boot for the kernel, and then edit the boot command to run it.</p>
</blockquote>

<ul>
<li>a tiny upgrade</li>
</ul>

<blockquote>
  <p>The OpenBSD documentation is comprehensive, but there might be rough corners around what are probably edge cases in their user base. People running EdgeRouter Lite hardware for example, who are looking to upgrade from 6.2 to 6.3.
  The documentation, which gave us everything we needed last time, left me with some questions about how to upgrade. In INSTALL.octeon, the Upgrading section does mention:
  The best solution, whenever possible, is to backup your data and reinstall from scratch
  I had to check if that directive existed in the documentation for other architectures. I wondered if oceton users were getting singled out. We were not. Just simplicity and pragmatism.</p>
</blockquote>

<ul>
<li>Reading on:</li>
</ul>

<blockquote>
  <p>To upgrade OpenBSD 6.3 from a previous version, start with the general instructions in the section "Installing OpenBSD".
  But that section requires us to boot off of TFTP or NFS. Which I don’t want to do right now. Could also use a USB stick with the miniroot63.fs installed on it.
  But as the ERL only has a single USB port, we would have to remove the USB stick with the current install on it. Once we get to the Install or Upgrade prompt, there would be nothing to upgrade.
  Well, I guess I could use a USB hub. But the ERL’s USB port is inside the case. With all the screws in. And the tools are neatly put away. And I’d have to pull the USB hub from behind a workstation. And it’s two am. And I cleaned up the cabling in the lab this past weekend. Looks nice for once.
  So I don’t want to futz around with all that.
  There must be an almost imperceptibly easier way of doing this than setting up a TFTP server or NFS share in five minutes… Right?</p>
</blockquote>

<p><hr /></p>

<p><strong>iXsystems</strong>
<a href="https://www.ixsystems.com/blog/boisetechshow-2018/">Boise Technology Show 2018 Recap</a></p>

<h3><a href="http://zfs.datto.com/">OpenZFS User Conference Slides &amp; Videos</a></h3>

<ul>
<li><a href="https://vimeo.com/album/5150026/video/266112599">Thank you ZFS</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266112475">ZSTD Compression</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266111164">Pool Layout Considerations</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266111346">ZFS Releases</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266112077">Helping Developers Help You</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266112233">ZFS and MySQL on Linux</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266110985">Micron</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266108105">OSNEXUS</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266107946">ZFS at Six Feet Up</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266107372">Flexible Disk Use with OpenZFS</a></li>
</ul>

<p><hr /></p>

<h3><a href="https://jvns.ca/blog/2018/05/11/batch-editing-files-with-ed/">Batch editing files with ed</a></h3>

<ul>
<li>what’s ‘ed’?</li>
</ul>

<blockquote>
  <p>ed is this sort of terrifying text editor. A typical interaction with ed for me in the past has gone something like this:</p>
</blockquote>

<p><code>
$ ed
help
?
h
?
asdfasdfasdfsadf
?
&lt;close terminal in frustration&gt;
</code></p>

<blockquote>
  <p>Basically if you do something wrong, ed will just print out a single, unhelpful, ?. So I’d basically dismissed ed as an old arcane Unix tool that had no practical use today.
  vi is a successor to ed, except with a visual interface instead of this ?</p>
</blockquote>

<ul>
<li>surprise: Ed is actually sort of cool and fun</li>
</ul>

<blockquote>
  <p>So if Ed is a terrifying thing that only prints ? at you, why am I writing a blog post about it? WELL!!!!
  On April 1 this year, Michael W Lucas published a new short book called Ed Mastery. I like his writing, and even though it was sort of an april fool’s joke, it was ALSO a legitimate actual real book, and so I bought it and read it to see if his claims that Ed is actually interesting were true.
  And it was so cool!!!! I found out:</p>
</blockquote>

<ul>
<li>how to get Ed to give you better error messages than just ?</li>
<li>that the name of the grep command comes from ed syntax (g/re/p)</li>
<li>the basics of how to navigate and edit files using ed</li>
</ul>

<blockquote>
  <p>All of that was a cool Unix history lesson, but did not make me want to actually use Ed in real life. But!!!</p>
  
  <p>The other neat thing about Ed (that did make me want to use it!) is that any Ed session corresponds to a script that you can replay! So if I know Ed, then I can use Ed basically as a way to easily apply vim-macro-like programs to my files.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blather.michaelwlucas.com/archives/3186">FreeBSD Mastery: Jails -- Help make it happen </a></li>
<li><a href="https://www.youtube.com/watch?v=MsY-BafQgj4">Video: OpenZFS Basics presented by George Wilson and Matt Ahrens at Scale 16x back in March 2018</a></li>
<li><a href="https://www.dragonflydigest.com/2018/05/17/21257.html">DragonFlyBSD’s IPFW gets highspeed lockless in-kernel NAT</a></li>
<li><a href="https://www.reddit.com/r/openbsd/comments/8ei00k/a_love_letter_to_openbsd/">A Love Letter to OpenBSD</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3176">New talks, and the F-bomb</a></li>
<li><a href="https://manpages.bsd.lv/mdoc.html">Practical UNIX Manuals: mdoc</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-advocacy/2018-May/004758.html">BSD Meetup in Zurich: May 24th</a></li>
<li><a href="https://www.eventbrite.com/e/the-polish-bsd-user-group-1-meetup-tickets-45941857332">BSD Meetup in Warsaw: May 24th</a></li>
<li><a href="http://meetbsd.com/">MeetBSD 2018</a></li>
</ul>

<p><hr /></p>

<p><strong>Tarsnap</strong></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Seth - <a href="http://dpaste.com/12R65X4#wrap">First time poudriere Builder</a></li>
<li>Farhan - <a href="http://dpaste.com/1GHCGY5#wrap">Why we didn't go FreeBSD</a></li>
<li>architech - <a href="http://dpaste.com/1H72FGE#wrap">Encryption Feedback</a></li>
<li>Dave - <a href="http://dpaste.com/27YH93Y#wrap">Handy Tip on setting up automated coredump handling for FreeBSD</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD internship learnings, exciting developments coming to FreeBSD, running FreeNAS on DigitalOcean, Network Manager control for OpenBSD, OpenZFS User Conference Videos are here and batch editing files with ed.</p>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/guest-blog-what-i-learned-during-my-freebsd-internship/">What I learned during my FreeBSD intership</a></h3>

<blockquote>
  <p>Hi, my name is Mitchell Horne. I am a computer engineering student at the University of Waterloo, currently in my third year of studies, and fortunate to have been one of the FreeBSD Foundation’s co-op students this past term (January to April). During this time I worked under Ed Maste, in the Foundation’s small Kitchener office, along with another co-op student Arshan Khanifar. My term has now come to an end, and so I’d like to share a little bit about my experience as a newcomer to FreeBSD and open-source development.</p>
  
  <p>I’ll begin with some quick background — and a small admission of guilt. I have been an open-source user for a large part of my life. When I was a teenager I started playing around with Linux, which opened my eyes to the wider world of free software. Other than some small contributions to GNOME, my experience has been mostly as an end user; however, the value of these projects and the open-source philosophy was not lost on me, and is most of what motivated my interest in this position. Before beginning this term I had no personal experience with any of the BSDs, although I knew of their existence and was extremely excited to receive the position. I knew it would be a great opportunity for growth, but I must confess that my naivety about FreeBSD caused me to make the silent assumption that this would be a form of compromise — a stepping stone that would eventually allow me to work on open-source projects that are somehow “greater” or more “legitimate”. After four months spent immersed in this project I have learned how it operates, witnessed its community, and learned about its history. I am happy to admit that I was completely mistaken. Saying it now seems obvious, but FreeBSD is a project with its own distinct uses, goals, and identity. For many there may exist no greater opportunity than to work on FreeBSD full time, and with what I know now I would have a hard time coming up with a project that is more “legitimate”.</p>
</blockquote>

<ul>
<li>What I Liked</li>
</ul>

<blockquote>
  <p>In all cases, the work I submitted this term was reviewed by no less than two people before being committed. The feedback and criticism I received was always both constructive and to the point, and it commented on everything from high-level ideas to small style issues. I appreciate having these thorough reviews in place, since I believe it ultimately encourages people to accept only their best work. It is indicative of the high quality that already exists within every aspect of this project, and this commitment to quality is something that should continue to be honored as a core value. As I’ve discovered in some of my previous work terms, it is all too easy cut corners in the name of a deadline or changing priorities, but the fact that FreeBSD doesn’t need to make these types of compromises is a testament to the power of free software.</p>
  
  <p>It’s a small thing, but the quality and completeness of the FreeBSD documentation was hugely helpful throughout my term. Everything you might need to know about utilities, library functions, the kernel, and more can be found in a man page; and the handbook is a great resource as both an introduction to the operating system and a reference. I only wish I had taken some time earlier in the term to explore the different documents more thoroughly, as they cover a wide range of interesting and useful topics. The effort people put into writing and maintaining FreeBSD’s documentation is easy to overlook, but its value cannot be overstated.</p>
</blockquote>

<ul>
<li>What I Learned</li>
</ul>

<blockquote>
  <p>Although there was a lot I enjoyed, there were certainly many struggles I faced throughout the term, and lessons to be learned from them. I expect that some of issues I faced may be specific to FreeBSD, while others may be common to open-source projects in general. I don’t have enough experience to speculate on which is which, so I will leave this to the reader.</p>
  
  <p>The first lesson can be summed up simply: you have to advocate for your own work. FreeBSD is made up in large part by volunteer efforts, and in many cases there is more work to go around than people available to do it. A consequence of this is that there will not be anybody there to check up on you. Even in my position where I actually had a direct supervisor, Ed often had his plate full with so many other things that the responsibility to find someone to look at my work fell to me. Admittedly, a couple of smaller changes I worked on got left behind or stuck in review simply because there wasn’t a clear person/place to reach out to.</p>
  
  <p>I think this is both a barrier of entry to FreeBSD and a mental hurdle that I needed to get over. If there’s a change you want to see included or reviewed, then you may have to be the one to push for it, and there’s nothing wrong with that. Perhaps this process should be easier for newcomers or infrequent contributors (the disconnect between Bugzilla and Phabricator definitely leaves a lot to be desired), but we also have to be aware that this simply isn’t the reality right now. Getting your work looked at may require a little bit more self-motivation, but I’d argue that there are much worse problems a project like FreeBSD could have than this.</p>
  
  <p>I understand this a lot better now, but it is still something I struggle with. I’m not naturally the type of person who easily connects with others or asks for help, so I see this as an area for future growth rather than simply a struggle I encountered and overcame over the course of this work term. Certainly it is an important skill to understand the value of your own work, and equally important is the ability to communicate that value to others.</p>
  
  <p>I also learned the importance of starting small. My first week or two on the job mainly involved getting set up and comfortable with the workflow. After this initial stage, I began exploring the project and found myself overwhelmed by its scale. With so many possible areas to investigate, and so much work happening at once, I felt quite lost on where to begin. Many of the potential projects I found were too far beyond my experience level, and most small bugs were picked up and fixed quickly by more experienced contributors before I could even get to them.</p>
  
  <p>It’s easy to make the mistake that FreeBSD is made up solely of a few rock-star committers that do everything. This is how it appears at face-value, as reading through commits, bug reports, and mailing lists yields a few of the same names over and over. The reality is that just as important are the hundreds of users and infrequent contributors who take the time to submit bug reports, patches, or feedback. Even though there are some people who would fall under the umbrella of a rock-star committer, they didn’t get there overnight. Rather, they have built their skills and knowledge through many years of involvement in FreeBSD and similar projects.</p>
  
  <p>As a student coming into this project and having high expectations of myself, it was easy to set the bar too high by comparing myself against those big committers, and feel that my work was insignificant, inadequate, and simply too infrequent. In reality, there is no reason I should have felt this way. In a way, this comparison is disrespectful to those who have reached this level, as it took them a long time to get there, and it’s a humbling reminder that any skill worth learning requires time, patience, and dedication. It is easy to focus on an end product and simply wish to be there, but in order to be truly successful one must start small, and find satisfaction in the struggle of learning something new. I take pride in the many small successes I’ve had throughout my term here, and appreciate the fact that my journey into FreeBSD and open-source software is only just beginning.</p>
</blockquote>

<ul>
<li>Closing Thoughts</li>
</ul>

<blockquote>
  <p>I would like to close with some brief thank-you’s. First, to everyone at the Foundation for being so helpful, and allowing this position to exist in the first place. I am extremely grateful to have been given this unique opportunity to learn about and give back to the open-source world. I’d also like to thank my office mates; Ed: for being an excellent mentor, who offered an endless wealth of knowledge and willingness to share it. My classmate and fellow intern Arshan: for giving me a sense of camaraderie and the comforting reminder that at many moments he was as lost as I was. Finally, a quick thanks to everyone else I crossed paths with who offered reviews and advice. I appreciate your help and look forward to working with you all further.</p>
  
  <p>I am walking away from this co-op with a much greater appreciation for this project, and have made it a goal to remain involved in some capacity. I feel that I’ve gained a little bit of a wider perspective on my place in the software world, something I never really got from my previous co-ops. Whether it ends up being just a stepping stone, or the beginning of much larger involvement, I thoroughly enjoyed my time here.</p>
</blockquote>

<p><hr /></p>

<h3>Recent Developments in FreeBSD</h3>

<ul>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=333890">Support for encrypted, compressed (gzip and zstd), and network crash dumps enabled by default on most platforms</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=333649">Intel Microcode Splitter</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=334005">Intel Spec Store Bypass Disable control</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=333713">Raspberry Pi 3B+ Ethernet Driver</a></li>
<li><a href="https://reviews.freebsd.org/D15522">IBRS for i386</a></li>
<li>Upcoming:</li>
<li><a href="https://reviews.freebsd.org/D15523">Microcode updater for AMD CPUs</a></li>
<li><a href="https://reviews.freebsd.org/D15525">the RACK TCP/IP stack, from Netflix</a></li>
<li>Voting in the FreeBSD Core Election begins today:</li>
</ul>

<p><hr /></p>

<p><strong>DigitalOcean</strong>
<a href="http://do.co/bsdnow">Digital Ocean Promo Link for BSD Now Listeners</a></p>

<p><hr /></p>

<h3><a href="http://www.shlomimarco.com/blog/running-freenas-on-a-digitalocean-droplet">Running FreeNAS on a DigitalOcean Droplet</a></h3>

<ul>
<li>Need to backup your FreeNAS offsite? Run a locked down instance in the cloud, and replicate to it</li>
<li>The tutorial walks though the steps of converting a fresh FreeBSD based droplet into a FreeNAS</li>
<li>Create a droplet, and add a small secondary block-storage device</li>
<li>Boot the droplet, login, and download FreeNAS</li>
<li>Disable swap, enable ‘foot shooting’ mode in GEOM</li>
<li>use dd to write the FreeNAS installer to the boot disk</li>
<li>Reboot the droplet, and use the FreeNAS installer to install FreeNAS to the secondary block storage device</li>
<li>Now, reimage the droplet with FreeBSD again, to replace the FreeNAS installer</li>
<li>Boot, and dd FreeNAS from the secondary block storage device back to the boot disk</li>
<li>You can now destroy the secondary block device</li>
<li>Now you have a FreeNAS, and can take it from there.</li>
<li>Use the FreeNAS replication wizard to configure sending snapshots from your home NAS to your cloud NAS</li>
<li>Note: You might consider creating a new block storage device to create a larger pool, that you can more easily grow over time, rather than using the boot device in the droplet as your main pool.</li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="http://www.vincentdelft.be/post/post_20180411">Network Manager Control for OpenBSD (Updated)</a></h3>

<ul>
<li>Generalities</li>
<li><p>I just remind the scope of this small tool:</p>

<ul><li>allow you to pre-define several cable or wifi connections</li>
<li>let nmctl to connect automatically to the first available one</li>
<li>allow you to easily switch from one network connection to an other one</li>
<li>create openbox dynamic menus</li></ul></li>
<li><p>Enhancements in this version</p></li>
</ul>

<blockquote>
  <p>This is my second development version: 0.2.
  I've added performed several changes in the code:</p>
</blockquote>

<ul>
<li>code style cleanup, to better match the python recommendations</li>
<li>adapt the tool to allow to connect to an Open-wifi having blancs in the name. This happens in some hotels</li>
<li>implement a loop as work-around concerning the arp table issue.</li>
</ul>

<blockquote>
  <p>The source code is still on the git of Sourceforge.net. 
   You can see the files <a href="https://sourceforge.net/p/nmctl/code/ci/master/tree/">here</a></p>
  
  <p>And you can download the last version <a href="https://sourceforge.net/p/nmctl/code/ci/master/tarball">here</a></p>
</blockquote>

<ul>
<li>Feedbacks after few months</li>
</ul>

<blockquote>
  <p>I'm using this script on my OpenBSD laptop since about 5 months. In my case, I'm mainly using the openbox menus and the --restart option.</p>
</blockquote>

<ul>
<li>The Openbox menus</li>
</ul>

<blockquote>
  <p>The openbox menus are working fine. As explain in my previous blog, I just have to create 2 entries in my openbox's menu.xml file, and all the rest comes automatically from nmctl itself thanks to the --list and --scan options.
  I've not changed this part of nmctl since it works as expected (for me :-) ).</p>
</blockquote>

<ul>
<li>The --restart option</li>
</ul>

<blockquote>
  <p>Because I'm very lazy, and because OpenBSD is very simple to use, I've added the command "nmctl --restart" in the /etc/apm/resume script. Thanks to apmd, this script will be used each time I'm opening the lid of my laptop. 
  In other words, each time I'll opening my laptop, nmctl will search the optimum network connection for me.
  But I had several issues in this scenario.
  Most of the problems were linked to the arp table issues. Indeed, in some circumstances, my proxy IP address was associated to the cable interface instead of the wifi interface or vice-versa. As consequence I'm not able to connect to the proxy, thus not able to connect to internet. So the ping to google (final test nmctl perform) is failing.
  Knowing that anyhow, I'm doing a full arp cleanup, it's not clear for me from where this problem come from. To solve this situation I've implemented a "retry" concept. In other words, before testing an another possible network connection (as listed in my /etc/nmctl.conf file), the script try 3x the current connection's parameters.
  If you want to reduce or increase this figures, you can do it via the --retry parameter.</p>
</blockquote>

<ul>
<li>Results of my expertise with this small tool</li>
</ul>

<blockquote>
  <p>Where ever I'm located, my laptop is now connecting automatically to the wifi / cable connection previously identified for this location.
  Currently I have 3 places where I have Wifi credentials and 2 offices places where I just have to plug the network cable.
  Since the /etc/apm/resume scripts is triggered when I open the lid of the laptop, I just have to make sure that I plug the RJ45 before opening the laptop. For the rest, I do not have to type any commands, OpenBSD do all what is needed ;-).
  I hotels or restaurants, I can just connect to the Open Wifi thanks to the openbox menu created by "nmctl --scan".</p>
</blockquote>

<ul>
<li><p>Next steps</p></li>
<li><p>Documentation</p></li>
</ul>

<blockquote>
  <p>The tool is missing lot of documentation. I appreciate OpenBSD for his great documentation, so I have to do the same.
  I plan to write a README and a man page at first instances.
  But since my laziness, I will do it as soon as I see some interest for this tool from other persons.</p>
</blockquote>

<ul>
<li>Tests</li>
</ul>

<blockquote>
  <p>I now have to travel and see how to see the script react on the different situations.
  Interested persons are welcome to share with me the outcome of their tests.
  I'm curious how it work.</p>
</blockquote>

<p><hr /></p>

<h3><a href="https://an.undulating.space/post/180411-erl-openbsd-upgrade/">OpenBSD 6.3 on EdgeRouter Lite simple upgrade method</a></h3>

<ul>
<li>TL;DR</li>
</ul>

<blockquote>
  <p>OpenBSD 6.3 oceton upgrade instructions may not factor that your ERL is running from the USB key they want wiped with the miniroot63.fs image loaded on.
  Place the bsd.rd for OpenBSD 6.3 on the sd0i slice used by U-Boot for the kernel, and then edit the boot command to run it.</p>
</blockquote>

<ul>
<li>a tiny upgrade</li>
</ul>

<blockquote>
  <p>The OpenBSD documentation is comprehensive, but there might be rough corners around what are probably edge cases in their user base. People running EdgeRouter Lite hardware for example, who are looking to upgrade from 6.2 to 6.3.
  The documentation, which gave us everything we needed last time, left me with some questions about how to upgrade. In INSTALL.octeon, the Upgrading section does mention:
  The best solution, whenever possible, is to backup your data and reinstall from scratch
  I had to check if that directive existed in the documentation for other architectures. I wondered if oceton users were getting singled out. We were not. Just simplicity and pragmatism.</p>
</blockquote>

<ul>
<li>Reading on:</li>
</ul>

<blockquote>
  <p>To upgrade OpenBSD 6.3 from a previous version, start with the general instructions in the section "Installing OpenBSD".
  But that section requires us to boot off of TFTP or NFS. Which I don’t want to do right now. Could also use a USB stick with the miniroot63.fs installed on it.
  But as the ERL only has a single USB port, we would have to remove the USB stick with the current install on it. Once we get to the Install or Upgrade prompt, there would be nothing to upgrade.
  Well, I guess I could use a USB hub. But the ERL’s USB port is inside the case. With all the screws in. And the tools are neatly put away. And I’d have to pull the USB hub from behind a workstation. And it’s two am. And I cleaned up the cabling in the lab this past weekend. Looks nice for once.
  So I don’t want to futz around with all that.
  There must be an almost imperceptibly easier way of doing this than setting up a TFTP server or NFS share in five minutes… Right?</p>
</blockquote>

<p><hr /></p>

<p><strong>iXsystems</strong>
<a href="https://www.ixsystems.com/blog/boisetechshow-2018/">Boise Technology Show 2018 Recap</a></p>

<h3><a href="http://zfs.datto.com/">OpenZFS User Conference Slides &amp; Videos</a></h3>

<ul>
<li><a href="https://vimeo.com/album/5150026/video/266112599">Thank you ZFS</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266112475">ZSTD Compression</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266111164">Pool Layout Considerations</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266111346">ZFS Releases</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266112077">Helping Developers Help You</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266112233">ZFS and MySQL on Linux</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266110985">Micron</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266108105">OSNEXUS</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266107946">ZFS at Six Feet Up</a></li>
<li><a href="https://vimeo.com/album/5150026/video/266107372">Flexible Disk Use with OpenZFS</a></li>
</ul>

<p><hr /></p>

<h3><a href="https://jvns.ca/blog/2018/05/11/batch-editing-files-with-ed/">Batch editing files with ed</a></h3>

<ul>
<li>what’s ‘ed’?</li>
</ul>

<blockquote>
  <p>ed is this sort of terrifying text editor. A typical interaction with ed for me in the past has gone something like this:</p>
</blockquote>

<p><code>
$ ed
help
?
h
?
asdfasdfasdfsadf
?
&lt;close terminal in frustration&gt;
</code></p>

<blockquote>
  <p>Basically if you do something wrong, ed will just print out a single, unhelpful, ?. So I’d basically dismissed ed as an old arcane Unix tool that had no practical use today.
  vi is a successor to ed, except with a visual interface instead of this ?</p>
</blockquote>

<ul>
<li>surprise: Ed is actually sort of cool and fun</li>
</ul>

<blockquote>
  <p>So if Ed is a terrifying thing that only prints ? at you, why am I writing a blog post about it? WELL!!!!
  On April 1 this year, Michael W Lucas published a new short book called Ed Mastery. I like his writing, and even though it was sort of an april fool’s joke, it was ALSO a legitimate actual real book, and so I bought it and read it to see if his claims that Ed is actually interesting were true.
  And it was so cool!!!! I found out:</p>
</blockquote>

<ul>
<li>how to get Ed to give you better error messages than just ?</li>
<li>that the name of the grep command comes from ed syntax (g/re/p)</li>
<li>the basics of how to navigate and edit files using ed</li>
</ul>

<blockquote>
  <p>All of that was a cool Unix history lesson, but did not make me want to actually use Ed in real life. But!!!</p>
  
  <p>The other neat thing about Ed (that did make me want to use it!) is that any Ed session corresponds to a script that you can replay! So if I know Ed, then I can use Ed basically as a way to easily apply vim-macro-like programs to my files.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blather.michaelwlucas.com/archives/3186">FreeBSD Mastery: Jails -- Help make it happen </a></li>
<li><a href="https://www.youtube.com/watch?v=MsY-BafQgj4">Video: OpenZFS Basics presented by George Wilson and Matt Ahrens at Scale 16x back in March 2018</a></li>
<li><a href="https://www.dragonflydigest.com/2018/05/17/21257.html">DragonFlyBSD’s IPFW gets highspeed lockless in-kernel NAT</a></li>
<li><a href="https://www.reddit.com/r/openbsd/comments/8ei00k/a_love_letter_to_openbsd/">A Love Letter to OpenBSD</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3176">New talks, and the F-bomb</a></li>
<li><a href="https://manpages.bsd.lv/mdoc.html">Practical UNIX Manuals: mdoc</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-advocacy/2018-May/004758.html">BSD Meetup in Zurich: May 24th</a></li>
<li><a href="https://www.eventbrite.com/e/the-polish-bsd-user-group-1-meetup-tickets-45941857332">BSD Meetup in Warsaw: May 24th</a></li>
<li><a href="http://meetbsd.com/">MeetBSD 2018</a></li>
</ul>

<p><hr /></p>

<p><strong>Tarsnap</strong></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Seth - <a href="http://dpaste.com/12R65X4#wrap">First time poudriere Builder</a></li>
<li>Farhan - <a href="http://dpaste.com/1GHCGY5#wrap">Why we didn't go FreeBSD</a></li>
<li>architech - <a href="http://dpaste.com/1H72FGE#wrap">Encryption Feedback</a></li>
<li>Dave - <a href="http://dpaste.com/27YH93Y#wrap">Handy Tip on setting up automated coredump handling for FreeBSD</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 246: Properly Coordinated Disclosure | BSD Now 246</title>
  <link>https://www.bsdnow.tv/246</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-1954</guid>
  <pubDate>Thu, 17 May 2018 01:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ef0afdeb-1a67-441c-9317-8405a2572cd6.mp3" length="54017115" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>How Intel docs were misinterpreted by almost any OS, a look at the mininet SDN emulator, do’s and don’ts for FreeBSD, OpenBSD community going gold, ed mastery is a must read, and the distributed object store minio on FreeBSD.</itunes:subtitle>
  <itunes:duration>1:29:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>How Intel docs were misinterpreted by almost any OS, a look at the mininet SDN emulator, do’s and don’ts for FreeBSD, OpenBSD community going gold, ed mastery is a must read, and the distributed object store minio on FreeBSD.
&lt;h2&gt;Headlines&lt;/h2&gt;
&lt;h3&gt;&lt;a href="https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html"&gt;Intel documentation flaw sees instruction misimplemented in almost every OS&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash.
  OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs. 
  + A detailed white paper describes this behavior &lt;a href="http://everdox.net/popss.pdf"&gt;here&lt;/a&gt;
  + &lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=333368"&gt;FreeBSD Commit&lt;/a&gt;
  Thank you to the MSRC Incident Response Team, and in particular Greg Lenti and Nate Warfield, for coordinating the response to this issue across multiple vendors.
  Thanks to Computer Recycling at The Working Center of Kitchener for making hardware available to allow us to test the patch on additional CPU families.
  + &lt;a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc"&gt;FreeBSD Security Advisory&lt;/a&gt;
  + &lt;a href="https://www.dragonflydigest.com/2018/05/09/21231.html"&gt;DragonFlyBSD Post&lt;/a&gt;
  + &lt;a href="https://www.kb.cert.org/vuls/id/CHEU-AYC3MZ"&gt;NetBSD does not support debug register and so is not affected.&lt;/a&gt;
  + &lt;a href="https://www.kb.cert.org/vuls/id/CHEU-AYC3MR"&gt;OpenBSD also appears to not be affected, “We are not aware of further vendor information regarding this vulnerability.”&lt;/a&gt;
  + &lt;a href="https://illumos.topicbox.com/groups/developer/T9cd475bd5497caa9"&gt;IllumOS Not Impacted&lt;/a&gt;&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.freebsdfoundation.org/blog/guest-post-a-look-at-sdn-emulator-mininet/"&gt;Guest Post – A Look at SDN Emulator Mininet&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;A guest post on the FreeBSD Foundation’s blog by developer Ayaka Koshibe


&lt;blockquote&gt;
  At this year’s AsiaBSDCon, I presented a talk about a SDN network emulator called Mininet, and my ongoing work to make it more portable. That presentation was focused on the OpenBSD version of the port, and I breezed past the detail that I also had a version or Mininet working on FreeBSD. Because I was given the opportunity, I’d like to share a bit about the FreeBSD version of Mininet. It will not only be about what Mininet is and why it might be interesting, but also a recounting of my experience as a user making a first-time attempt at porting an application to FreeBSD.
  Mininet started off as a tool used by academic researchers to emulate OpenFlow networks when they didn’t have convenient access to actual networks. Because of its history, Mininet became associated strongly with networks that use OpenFlow for their control channels. But, it has also become fairly popular among developers working in, and among several universities for research and teaching about, SDN (Software Defined Networking)
  I began using Mininet as an intern at my university’s network research lab. I was using FreeBSD by that time, and wasn’t too happy to learn that Mininet wouldn’t work on anything but Linux. I gradually got tired of having to run a Linux VM just to use Mininet, and one day it clicked in my mind that I can actually try porting it to FreeBSD.
  Mininet creates a topology using the resource virtualization features that Linux has. Specifically, nodes are bash processes running in network namespaces, and the nodes are interconnected using veth virtual Ethernet links. Switches and controllers are just nodes whose shells have run the right commands to configure a software switch or start a controller application. Mininet can therefore be viewed as a series of Python libraries that run the system commands necessary to create network namespaces and veth interfaces, assemble a specified topology, and coordinate how user commands aimed at nodes (since they are just shells) are run.
  Coming back to the port, I chose to use vnet jails to replace the network namespaces, and epair(4) links to replace the veth links. For the SDN functionality, I needed at least one switch and controller that can be run on FreeBSD. I chose OpenvSwitch(OVS) for the switch, since it was available in ports and is well-known by the SDN world, and Ryu for the controller since it’s being actively developed and used and supports more recent versions of OpenFlow.
  I have discussed the possibility of upstreaming my work. Although they were excited about it, I was asked about a script for creating VMs with Mininet preinstalled, and continuous integration support for my fork of the repository. I started taking a look at the release scripts for creating a VM, and after seeing that it would be much easier to use the scripts if I can get Mininet and Ryu added to the ports tree, I also tried a hand at submitting some ports. For CI support, Mininet uses Travis, which unfortunately doesn’t support FreeBSD. For this, I plan to look at a minimalistic CI tool called contbuild, which looks simple enough to get running and is written portably.
  This is very much a work-in-progress, and one going at a glacial pace. Even though the company that I work for does use Mininet, but doesn’t use FreeBSD, so this is something that I’ve been working on in my free time. Earlier on, it was the learning curve that made progress slow. When I started, I hadn’t done anything more than run FreeBSD on a laptop, and uneventfully build a few applications from the ports tree. Right off the bat, using vnet jails meant learning how to build and run a custom kernel. This was the easy part, as the handbook was clear about how to do this. When I moved from using FreeBSD 10.3 to 11, I found that I can panic my machine by quickly creating and destroying OVS switches and jails. I submitted a bug report, but decided to go one step further and actually try to debug the panic for myself. With the help of a few people well-versed in systems programming and the developer’s handbook, I was able to come up with a fix, and get it accepted. This pretty much brings my porting experiment to the present day, where I’m slowly working out the pieces that I mentioned earlier.
  In the beginning, I thought that this Mininet port would be a weekend project where I come out knowing thing or two about using vnet jails and with one less VM to run. Instead, it became a crash course in building and debugging kernels and submitting bug reports, patches, and ports. It’d like to mention that I wouldn’t have gotten far at all if it weren’t for the helpful folks, the documentation, and how debuggable FreeBSD is. I enjoy good challenges and learning experiences, and this has definitely been both.&lt;/blockquote&gt;
&lt;/li&gt;
  &lt;li&gt;Thank you to Ayaka for working to port Mininet to the BSDs, and for sharing her experiences with us.&lt;/li&gt;
  &lt;li&gt;If you want to see the OpenBSD version of the talk, the video from &lt;a href="https://www.youtube.com/watch?v=Vg9Czjm9aV8"&gt;AsiaBSDCon is here&lt;/a&gt;, and it will be presented again at BSDCan.&lt;/li&gt;
  &lt;/ul&gt;
  &lt;hr&gt;


**iXsystems**
[iXsystems LFNW Recap](https://www.ixsystems.com/blog/lfnw-2018-recap/)


&lt;hr&gt;





&lt;h3&gt;&lt;a href="https://forums.freebsd.org/threads/10-dos-and-dont-for-freebsd.65618/"&gt;10 Beginner Do's and Don't for FreeBSD&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;1) Don't mix ports and binary packages&lt;/li&gt;
&lt;li&gt;2) Don't edit 'default' files&lt;/li&gt;
&lt;li&gt;3) Don't mess with /etc/crontab&lt;/li&gt;
&lt;li&gt;4) Don't mess with /etc/passwd and /etc/groups either!&lt;/li&gt;
&lt;li&gt;5) Reconsider the removal of any options from your customized kernel configuration&lt;/li&gt;
&lt;li&gt;6) Don't change the root shell to something else&lt;/li&gt;
&lt;li&gt;7) Don't use the root user all the time&lt;/li&gt;
&lt;li&gt;8) /var/backups is a thing&lt;/li&gt;
&lt;li&gt;9) Check system integrity using /etc/mtree&lt;/li&gt;
&lt;li&gt;10) What works for me doesn't have to work for you!&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180419060427"&gt;OpenBSD Community Goes Gold for 2018!&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;Ken Westerback (krw@ when wearing his developer hat) writes:&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;```
Monthly paypal donations from the OpenBSD community have made the community the OpenBSD Foundation's first Gold level contributor for 2018!&lt;/p&gt;

&lt;p&gt;2018 is the third consecutive year that the community has reached Gold status or better.&lt;/p&gt;

&lt;p&gt;These monthly paypal commitments by the community are our most reliable source of funds and thus the most useful for financial planning purposes. We are extremely thankful for the continuing support and hope the community matches their 2017 achievement of Platinum status. Or even their 2016 achievement of Iridium status.&lt;/p&gt;

&lt;p&gt;Sign up now for a monthly donation!&lt;/p&gt;

&lt;p&gt;Note that Bitcoin contributions have been re-enabled now that our Bitcoin intermediary has re-certified our Canadian paperwork.&lt;/p&gt;

&lt;p&gt;https://www.openbsdfoundation.org/donations.html
```&lt;/p&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="http://bsdly.blogspot.com/2018/04/ed1-mastery-is-must-for-real-unix-person.html"&gt;ed(1) mastery is a must read for real unix people&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;In some circles on the Internet, your choice of text editor is a serious matter.&lt;/p&gt;
  
  &lt;p&gt;We've all seen the threads on mailing lits, USENET news groups and web forums about the relative merits of Emacs vs vi, including endless iterations of flame wars, and sometimes even involving lesser known or non-portable editing environments.&lt;/p&gt;
  
  &lt;p&gt;And then of course, from the Linux newbies we have seen an endless stream of tweeted graphical 'memes' about the editor vim (aka 'vi Improved') versus the various apparently friendlier-to-some options such as GNU nano. Apparently even the 'improved' version of the classical and ubiquitous vi(1) editor is a challenge even to exit for a significant subset of the younger generation.&lt;/p&gt;
  
  &lt;p&gt;Yes, your choice of text editor or editing environment is a serious matter. Mainly because text processing is so fundamental to our interactions with computers.&lt;/p&gt;
  
  &lt;p&gt;But for those of us who keep our systems on a real Unix (such as OpenBSD or FreeBSD), there is no real contest. The OpenBSD base system contains several text editors including vi(1) and the almost-emacs mg(1), but ed(1) remains the standard editor.&lt;/p&gt;
  
  &lt;p&gt;Now Michael Lucas has written a book to guide the as yet uninitiated to the fundamentals of the original Unix text editor. It is worth keeping in mind that much of Unix and its original standard text editor written back when the standard output and default user interface was more likely than not a printing terminal.&lt;/p&gt;
  
  &lt;p&gt;To some of us, reading and following the narrative of Ed Mastery is a trip down memory lane. To others, following along the text will illustrate the horror of the world of pre-graphic computer interfaces. For others again, the fact that ed(1) doesn't use your terminal settings much at all offers hope of fixing things when something or somebody screwed up your system so you don't have a working terminal for that visual editor.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;DigitalOcean&lt;/strong&gt;
&lt;a href="http://do.co/bsdnow"&gt;Digital Ocean Promo Link for BSD Now Listeners&lt;/a&gt;&lt;/p&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://vermaden.wordpress.com/2018/04/16/distributed-object-storage-with-minio-on-freebsd/"&gt;Distributed Object Storage with Minio on FreeBSD&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Free and open source distributed object storage server compatible with Amazon S3 v2/v4 API. Offers data protection against hardware failures using erasure code and bitrot detection. Supports highly available distributed setup. Provides confidentiality, integrity and authenticity assurances for encrypted data with negligible performance overhead. Both server side and client side encryption are supported. Below is the image of example Minio setup.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://vermaden.files.wordpress.com/2018/04/minio-architecture-diagram-distributed.jpg?w=960"&gt;Architecture Diagram &lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;The Minio identifies itself as the ZFS of Cloud Object Storage. This guide will show You how to setup highly available distributed Minio storage on the FreeBSD operating system with ZFS as backend for Minio data. For convenience we will use FreeBSD Jails operating system level virtualization.&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Setup&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;The setup will assume that You have 3 datacenters and assumption that you have two datacenters in whose the most of the data must reside and that the third datacenter is used as a ‘quorum/witness’ role. Distributed Minio supports up to 16 nodes/drives total, so we may juggle with that number to balance data between desired datacenters. As we have 16 drives to allocate resources on 3 sites we will use 7 + 7 + 2 approach here. The datacenters where most of the data must reside have 7/16 ratio while the ‘quorum/witness’ datacenter have only 2/16 ratio. Thanks to built in Minio redundancy we may loose (turn off for example) any one of those machines and our object storage will still be available and ready to use for any purpose.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Jails&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;First we will create 3 jails for our proof of concept Minio setup, storage1 will have the ‘quorum/witness’ role while storage2 and storage3 will have the ‘data’ role. To distinguish commands I type on the host system and storageX Jail I use two different prompts, this way it should be obvious what command to execute and where.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;WeI know the FreeNAS people have been working on integrating this&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://kristaps.bsd.lv/kcgi/tutorial6.html"&gt;Best practises for pledge(2) security&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Let's set the record straight for securing kcgi CGI and FastCGI applications with pledge(2). This is focussed on secure OpenBSD deployments.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Theory&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Internally, kcgi makes considerable use of available security tools. But it's also designed to be invoked in a secure environment. We'll start with pledge(2), which has been around on OpenBSD since version 5.9. If you're reading this tutorial, you're probably on OpenBSD, and you probably have knowledge of pledge(2).&lt;/p&gt;
  
  &lt;p&gt;How to begin? Read kcgi(3). It includes canonical information on which pledge(2) promises you'll need for each function in the library. This is just a tutorial—the manpage is canonical and overrides what you may read here.&lt;/p&gt;
  
  &lt;p&gt;Next, assess the promises that your application needs. From kcgi(3), it's easy to see which promises we'll need to start. You'll need to augment this list with whichever tools you're also using. The general push is to start with the broadest set of required promises, then restrict as quickly as possible. Sometimes this can be done in a single pledge(2), but other times it takes a few.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-April/014194.html"&gt;April's London *BSD meetup - notes&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-May/014198.html"&gt;May’s London *BSD Meetup: May 22nd &lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://2018.eurobsdcon.org/call-for-papers/"&gt;Call for Papers for EuroBSDcon 2018&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/journal/"&gt;FreeBSD Journal March/April Desktop/Laptop issue&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lwn.net/Articles/752063/"&gt;LWN followup on the PostgreSQL fsync() issue&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://awards.acm.org/outstanding-contribution"&gt;The Association for Computing Machinery recognizes Steve Bourne for outstanding contributions&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Ray - &lt;a href="http://dpaste.com/1F8RX6H#wrap"&gt;Speaking at Conferences&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Casey - &lt;a href="http://dpaste.com/364FTMM#wrap"&gt;Questions&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Jeremy - &lt;a href="http://dpaste.com/3GWHP9N#wrap"&gt;zfs in the enterprise&lt;/a&gt;
&lt;ul&gt;&lt;li&gt;&lt;a href="https://wiki.freebsd.org/HAST"&gt;HAST + ZFS&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;Lars - &lt;a href="http://dpaste.com/1HDZFA3"&gt;Civil Infrastructure Platform use of *BSD&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, MinIO, SDN Emulator Mininet, PostgresQL</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>How Intel docs were misinterpreted by almost any OS, a look at the mininet SDN emulator, do’s and don’ts for FreeBSD, OpenBSD community going gold, ed mastery is a must read, and the distributed object store minio on FreeBSD.</p>

<h2>Headlines</h2>

<h3><a href="https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html">Intel documentation flaw sees instruction misimplemented in almost every OS</a></h3>

<blockquote>
  <p>A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash.
  OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs. 
  + A detailed white paper describes this behavior <a href="http://everdox.net/popss.pdf">here</a>
  + <a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=333368">FreeBSD Commit</a>
  Thank you to the MSRC Incident Response Team, and in particular Greg Lenti and Nate Warfield, for coordinating the response to this issue across multiple vendors.
  Thanks to Computer Recycling at The Working Center of Kitchener for making hardware available to allow us to test the patch on additional CPU families.
  + <a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc">FreeBSD Security Advisory</a>
  + <a href="https://www.dragonflydigest.com/2018/05/09/21231.html">DragonFlyBSD Post</a>
  + <a href="https://www.kb.cert.org/vuls/id/CHEU-AYC3MZ">NetBSD does not support debug register and so is not affected.</a>
  + <a href="https://www.kb.cert.org/vuls/id/CHEU-AYC3MR">OpenBSD also appears to not be affected, “We are not aware of further vendor information regarding this vulnerability.”</a>
  + <a href="https://illumos.topicbox.com/groups/developer/T9cd475bd5497caa9">IllumOS Not Impacted</a></p>
</blockquote>

<p><hr /></p>

<h3><a href="https://www.freebsdfoundation.org/blog/guest-post-a-look-at-sdn-emulator-mininet/">Guest Post – A Look at SDN Emulator Mininet</a></h3>

<ul>
<li>A guest post on the FreeBSD Foundation’s blog by developer Ayaka Koshibe


<blockquote>
  At this year’s AsiaBSDCon, I presented a talk about a SDN network emulator called Mininet, and my ongoing work to make it more portable. That presentation was focused on the OpenBSD version of the port, and I breezed past the detail that I also had a version or Mininet working on FreeBSD. Because I was given the opportunity, I’d like to share a bit about the FreeBSD version of Mininet. It will not only be about what Mininet is and why it might be interesting, but also a recounting of my experience as a user making a first-time attempt at porting an application to FreeBSD.
  Mininet started off as a tool used by academic researchers to emulate OpenFlow networks when they didn’t have convenient access to actual networks. Because of its history, Mininet became associated strongly with networks that use OpenFlow for their control channels. But, it has also become fairly popular among developers working in, and among several universities for research and teaching about, SDN (Software Defined Networking)
  I began using Mininet as an intern at my university’s network research lab. I was using FreeBSD by that time, and wasn’t too happy to learn that Mininet wouldn’t work on anything but Linux. I gradually got tired of having to run a Linux VM just to use Mininet, and one day it clicked in my mind that I can actually try porting it to FreeBSD.
  Mininet creates a topology using the resource virtualization features that Linux has. Specifically, nodes are bash processes running in network namespaces, and the nodes are interconnected using veth virtual Ethernet links. Switches and controllers are just nodes whose shells have run the right commands to configure a software switch or start a controller application. Mininet can therefore be viewed as a series of Python libraries that run the system commands necessary to create network namespaces and veth interfaces, assemble a specified topology, and coordinate how user commands aimed at nodes (since they are just shells) are run.
  Coming back to the port, I chose to use vnet jails to replace the network namespaces, and epair(4) links to replace the veth links. For the SDN functionality, I needed at least one switch and controller that can be run on FreeBSD. I chose OpenvSwitch(OVS) for the switch, since it was available in ports and is well-known by the SDN world, and Ryu for the controller since it’s being actively developed and used and supports more recent versions of OpenFlow.
  I have discussed the possibility of upstreaming my work. Although they were excited about it, I was asked about a script for creating VMs with Mininet preinstalled, and continuous integration support for my fork of the repository. I started taking a look at the release scripts for creating a VM, and after seeing that it would be much easier to use the scripts if I can get Mininet and Ryu added to the ports tree, I also tried a hand at submitting some ports. For CI support, Mininet uses Travis, which unfortunately doesn’t support FreeBSD. For this, I plan to look at a minimalistic CI tool called contbuild, which looks simple enough to get running and is written portably.
  This is very much a work-in-progress, and one going at a glacial pace. Even though the company that I work for does use Mininet, but doesn’t use FreeBSD, so this is something that I’ve been working on in my free time. Earlier on, it was the learning curve that made progress slow. When I started, I hadn’t done anything more than run FreeBSD on a laptop, and uneventfully build a few applications from the ports tree. Right off the bat, using vnet jails meant learning how to build and run a custom kernel. This was the easy part, as the handbook was clear about how to do this. When I moved from using FreeBSD 10.3 to 11, I found that I can panic my machine by quickly creating and destroying OVS switches and jails. I submitted a bug report, but decided to go one step further and actually try to debug the panic for myself. With the help of a few people well-versed in systems programming and the developer’s handbook, I was able to come up with a fix, and get it accepted. This pretty much brings my porting experiment to the present day, where I’m slowly working out the pieces that I mentioned earlier.
  In the beginning, I thought that this Mininet port would be a weekend project where I come out knowing thing or two about using vnet jails and with one less VM to run. Instead, it became a crash course in building and debugging kernels and submitting bug reports, patches, and ports. It’d like to mention that I wouldn’t have gotten far at all if it weren’t for the helpful folks, the documentation, and how debuggable FreeBSD is. I enjoy good challenges and learning experiences, and this has definitely been both.</li>
  <li>Thank you to Ayaka for working to port Mininet to the BSDs, and for sharing her experiences with us.</li>
  <li>If you want to see the OpenBSD version of the talk, the video from <a href="https://www.youtube.com/watch?v=Vg9Czjm9aV8">AsiaBSDCon is here</a>, and it will be presented again at BSDCan.</li>
  </ul>
  <hr />
</blockquote>

**iXsystems**
[iXsystems LFNW Recap](https://www.ixsystems.com/blog/lfnw-2018-recap/)


<hr />





<h3><a href="https://forums.freebsd.org/threads/10-dos-and-dont-for-freebsd.65618/">10 Beginner Do's and Don't for FreeBSD</a></h3>

<ul>
<li>1) Don't mix ports and binary packages</li>
<li>2) Don't edit 'default' files</li>
<li>3) Don't mess with /etc/crontab</li>
<li>4) Don't mess with /etc/passwd and /etc/groups either!</li>
<li>5) Reconsider the removal of any options from your customized kernel configuration</li>
<li>6) Don't change the root shell to something else</li>
<li>7) Don't use the root user all the time</li>
<li>8) /var/backups is a thing</li>
<li>9) Check system integrity using /etc/mtree</li>
<li>10) What works for me doesn't have to work for you!</li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180419060427">OpenBSD Community Goes Gold for 2018!</a></h3>

<ul>
<li>Ken Westerback (krw@ when wearing his developer hat) writes:</li>
</ul>

<p>```
Monthly paypal donations from the OpenBSD community have made the community the OpenBSD Foundation's first Gold level contributor for 2018!</p>

<p>2018 is the third consecutive year that the community has reached Gold status or better.</p>

<p>These monthly paypal commitments by the community are our most reliable source of funds and thus the most useful for financial planning purposes. We are extremely thankful for the continuing support and hope the community matches their 2017 achievement of Platinum status. Or even their 2016 achievement of Iridium status.</p>

<p>Sign up now for a monthly donation!</p>

<p>Note that Bitcoin contributions have been re-enabled now that our Bitcoin intermediary has re-certified our Canadian paperwork.</p>

<p>https://www.openbsdfoundation.org/donations.html
```</p>

<p><hr /></p>

<h3><a href="http://bsdly.blogspot.com/2018/04/ed1-mastery-is-must-for-real-unix-person.html">ed(1) mastery is a must read for real unix people</a></h3>

<blockquote>
  <p>In some circles on the Internet, your choice of text editor is a serious matter.</p>
  
  <p>We've all seen the threads on mailing lits, USENET news groups and web forums about the relative merits of Emacs vs vi, including endless iterations of flame wars, and sometimes even involving lesser known or non-portable editing environments.</p>
  
  <p>And then of course, from the Linux newbies we have seen an endless stream of tweeted graphical 'memes' about the editor vim (aka 'vi Improved') versus the various apparently friendlier-to-some options such as GNU nano. Apparently even the 'improved' version of the classical and ubiquitous vi(1) editor is a challenge even to exit for a significant subset of the younger generation.</p>
  
  <p>Yes, your choice of text editor or editing environment is a serious matter. Mainly because text processing is so fundamental to our interactions with computers.</p>
  
  <p>But for those of us who keep our systems on a real Unix (such as OpenBSD or FreeBSD), there is no real contest. The OpenBSD base system contains several text editors including vi(1) and the almost-emacs mg(1), but ed(1) remains the standard editor.</p>
  
  <p>Now Michael Lucas has written a book to guide the as yet uninitiated to the fundamentals of the original Unix text editor. It is worth keeping in mind that much of Unix and its original standard text editor written back when the standard output and default user interface was more likely than not a printing terminal.</p>
  
  <p>To some of us, reading and following the narrative of Ed Mastery is a trip down memory lane. To others, following along the text will illustrate the horror of the world of pre-graphic computer interfaces. For others again, the fact that ed(1) doesn't use your terminal settings much at all offers hope of fixing things when something or somebody screwed up your system so you don't have a working terminal for that visual editor.</p>
</blockquote>

<p><hr /></p>

<p><strong>DigitalOcean</strong>
<a href="http://do.co/bsdnow">Digital Ocean Promo Link for BSD Now Listeners</a></p>

<p><hr /></p>

<h3><a href="https://vermaden.wordpress.com/2018/04/16/distributed-object-storage-with-minio-on-freebsd/">Distributed Object Storage with Minio on FreeBSD</a></h3>

<blockquote>
  <p>Free and open source distributed object storage server compatible with Amazon S3 v2/v4 API. Offers data protection against hardware failures using erasure code and bitrot detection. Supports highly available distributed setup. Provides confidentiality, integrity and authenticity assurances for encrypted data with negligible performance overhead. Both server side and client side encryption are supported. Below is the image of example Minio setup.</p>
</blockquote>

<ul>
<li><a href="https://vermaden.files.wordpress.com/2018/04/minio-architecture-diagram-distributed.jpg?w=960">Architecture Diagram </a></li>
</ul>

<p>The Minio identifies itself as the ZFS of Cloud Object Storage. This guide will show You how to setup highly available distributed Minio storage on the FreeBSD operating system with ZFS as backend for Minio data. For convenience we will use FreeBSD Jails operating system level virtualization.</p>

<ul>
<li>Setup</li>
</ul>

<blockquote>
  <p>The setup will assume that You have 3 datacenters and assumption that you have two datacenters in whose the most of the data must reside and that the third datacenter is used as a ‘quorum/witness’ role. Distributed Minio supports up to 16 nodes/drives total, so we may juggle with that number to balance data between desired datacenters. As we have 16 drives to allocate resources on 3 sites we will use 7 + 7 + 2 approach here. The datacenters where most of the data must reside have 7/16 ratio while the ‘quorum/witness’ datacenter have only 2/16 ratio. Thanks to built in Minio redundancy we may loose (turn off for example) any one of those machines and our object storage will still be available and ready to use for any purpose.</p>
</blockquote>

<ul>
<li>Jails</li>
</ul>

<blockquote>
  <p>First we will create 3 jails for our proof of concept Minio setup, storage1 will have the ‘quorum/witness’ role while storage2 and storage3 will have the ‘data’ role. To distinguish commands I type on the host system and storageX Jail I use two different prompts, this way it should be obvious what command to execute and where.</p>
</blockquote>

<ul>
<li>WeI know the FreeNAS people have been working on integrating this</li>
</ul>

<p><hr /></p>

<h3><a href="https://kristaps.bsd.lv/kcgi/tutorial6.html">Best practises for pledge(2) security</a></h3>

<blockquote>
  <p>Let's set the record straight for securing kcgi CGI and FastCGI applications with pledge(2). This is focussed on secure OpenBSD deployments.</p>
</blockquote>

<ul>
<li>Theory</li>
</ul>

<blockquote>
  <p>Internally, kcgi makes considerable use of available security tools. But it's also designed to be invoked in a secure environment. We'll start with pledge(2), which has been around on OpenBSD since version 5.9. If you're reading this tutorial, you're probably on OpenBSD, and you probably have knowledge of pledge(2).</p>
  
  <p>How to begin? Read kcgi(3). It includes canonical information on which pledge(2) promises you'll need for each function in the library. This is just a tutorial—the manpage is canonical and overrides what you may read here.</p>
  
  <p>Next, assess the promises that your application needs. From kcgi(3), it's easy to see which promises we'll need to start. You'll need to augment this list with whichever tools you're also using. The general push is to start with the broadest set of required promises, then restrict as quickly as possible. Sometimes this can be done in a single pledge(2), but other times it takes a few.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-April/014194.html">April's London *BSD meetup - notes</a></li>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-May/014198.html">May’s London *BSD Meetup: May 22nd </a></li>
<li><a href="https://2018.eurobsdcon.org/call-for-papers/">Call for Papers for EuroBSDcon 2018</a></li>
<li><a href="https://www.freebsdfoundation.org/journal/">FreeBSD Journal March/April Desktop/Laptop issue</a></li>
<li><a href="https://lwn.net/Articles/752063/">LWN followup on the PostgreSQL fsync() issue</a></li>
<li><a href="https://awards.acm.org/outstanding-contribution">The Association for Computing Machinery recognizes Steve Bourne for outstanding contributions</a></li>
</ul>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Ray - <a href="http://dpaste.com/1F8RX6H#wrap">Speaking at Conferences</a></li>
<li>Casey - <a href="http://dpaste.com/364FTMM#wrap">Questions</a></li>
<li>Jeremy - <a href="http://dpaste.com/3GWHP9N#wrap">zfs in the enterprise</a>
<ul><li><a href="https://wiki.freebsd.org/HAST">HAST + ZFS</a></li></ul></li>
<li>Lars - <a href="http://dpaste.com/1HDZFA3">Civil Infrastructure Platform use of *BSD</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>How Intel docs were misinterpreted by almost any OS, a look at the mininet SDN emulator, do’s and don’ts for FreeBSD, OpenBSD community going gold, ed mastery is a must read, and the distributed object store minio on FreeBSD.</p>

<h2>Headlines</h2>

<h3><a href="https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html">Intel documentation flaw sees instruction misimplemented in almost every OS</a></h3>

<blockquote>
  <p>A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash.
  OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs. 
  + A detailed white paper describes this behavior <a href="http://everdox.net/popss.pdf">here</a>
  + <a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=333368">FreeBSD Commit</a>
  Thank you to the MSRC Incident Response Team, and in particular Greg Lenti and Nate Warfield, for coordinating the response to this issue across multiple vendors.
  Thanks to Computer Recycling at The Working Center of Kitchener for making hardware available to allow us to test the patch on additional CPU families.
  + <a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc">FreeBSD Security Advisory</a>
  + <a href="https://www.dragonflydigest.com/2018/05/09/21231.html">DragonFlyBSD Post</a>
  + <a href="https://www.kb.cert.org/vuls/id/CHEU-AYC3MZ">NetBSD does not support debug register and so is not affected.</a>
  + <a href="https://www.kb.cert.org/vuls/id/CHEU-AYC3MR">OpenBSD also appears to not be affected, “We are not aware of further vendor information regarding this vulnerability.”</a>
  + <a href="https://illumos.topicbox.com/groups/developer/T9cd475bd5497caa9">IllumOS Not Impacted</a></p>
</blockquote>

<p><hr /></p>

<h3><a href="https://www.freebsdfoundation.org/blog/guest-post-a-look-at-sdn-emulator-mininet/">Guest Post – A Look at SDN Emulator Mininet</a></h3>

<ul>
<li>A guest post on the FreeBSD Foundation’s blog by developer Ayaka Koshibe


<blockquote>
  At this year’s AsiaBSDCon, I presented a talk about a SDN network emulator called Mininet, and my ongoing work to make it more portable. That presentation was focused on the OpenBSD version of the port, and I breezed past the detail that I also had a version or Mininet working on FreeBSD. Because I was given the opportunity, I’d like to share a bit about the FreeBSD version of Mininet. It will not only be about what Mininet is and why it might be interesting, but also a recounting of my experience as a user making a first-time attempt at porting an application to FreeBSD.
  Mininet started off as a tool used by academic researchers to emulate OpenFlow networks when they didn’t have convenient access to actual networks. Because of its history, Mininet became associated strongly with networks that use OpenFlow for their control channels. But, it has also become fairly popular among developers working in, and among several universities for research and teaching about, SDN (Software Defined Networking)
  I began using Mininet as an intern at my university’s network research lab. I was using FreeBSD by that time, and wasn’t too happy to learn that Mininet wouldn’t work on anything but Linux. I gradually got tired of having to run a Linux VM just to use Mininet, and one day it clicked in my mind that I can actually try porting it to FreeBSD.
  Mininet creates a topology using the resource virtualization features that Linux has. Specifically, nodes are bash processes running in network namespaces, and the nodes are interconnected using veth virtual Ethernet links. Switches and controllers are just nodes whose shells have run the right commands to configure a software switch or start a controller application. Mininet can therefore be viewed as a series of Python libraries that run the system commands necessary to create network namespaces and veth interfaces, assemble a specified topology, and coordinate how user commands aimed at nodes (since they are just shells) are run.
  Coming back to the port, I chose to use vnet jails to replace the network namespaces, and epair(4) links to replace the veth links. For the SDN functionality, I needed at least one switch and controller that can be run on FreeBSD. I chose OpenvSwitch(OVS) for the switch, since it was available in ports and is well-known by the SDN world, and Ryu for the controller since it’s being actively developed and used and supports more recent versions of OpenFlow.
  I have discussed the possibility of upstreaming my work. Although they were excited about it, I was asked about a script for creating VMs with Mininet preinstalled, and continuous integration support for my fork of the repository. I started taking a look at the release scripts for creating a VM, and after seeing that it would be much easier to use the scripts if I can get Mininet and Ryu added to the ports tree, I also tried a hand at submitting some ports. For CI support, Mininet uses Travis, which unfortunately doesn’t support FreeBSD. For this, I plan to look at a minimalistic CI tool called contbuild, which looks simple enough to get running and is written portably.
  This is very much a work-in-progress, and one going at a glacial pace. Even though the company that I work for does use Mininet, but doesn’t use FreeBSD, so this is something that I’ve been working on in my free time. Earlier on, it was the learning curve that made progress slow. When I started, I hadn’t done anything more than run FreeBSD on a laptop, and uneventfully build a few applications from the ports tree. Right off the bat, using vnet jails meant learning how to build and run a custom kernel. This was the easy part, as the handbook was clear about how to do this. When I moved from using FreeBSD 10.3 to 11, I found that I can panic my machine by quickly creating and destroying OVS switches and jails. I submitted a bug report, but decided to go one step further and actually try to debug the panic for myself. With the help of a few people well-versed in systems programming and the developer’s handbook, I was able to come up with a fix, and get it accepted. This pretty much brings my porting experiment to the present day, where I’m slowly working out the pieces that I mentioned earlier.
  In the beginning, I thought that this Mininet port would be a weekend project where I come out knowing thing or two about using vnet jails and with one less VM to run. Instead, it became a crash course in building and debugging kernels and submitting bug reports, patches, and ports. It’d like to mention that I wouldn’t have gotten far at all if it weren’t for the helpful folks, the documentation, and how debuggable FreeBSD is. I enjoy good challenges and learning experiences, and this has definitely been both.</li>
  <li>Thank you to Ayaka for working to port Mininet to the BSDs, and for sharing her experiences with us.</li>
  <li>If you want to see the OpenBSD version of the talk, the video from <a href="https://www.youtube.com/watch?v=Vg9Czjm9aV8">AsiaBSDCon is here</a>, and it will be presented again at BSDCan.</li>
  </ul>
  <hr />
</blockquote>

**iXsystems**
[iXsystems LFNW Recap](https://www.ixsystems.com/blog/lfnw-2018-recap/)


<hr />





<h3><a href="https://forums.freebsd.org/threads/10-dos-and-dont-for-freebsd.65618/">10 Beginner Do's and Don't for FreeBSD</a></h3>

<ul>
<li>1) Don't mix ports and binary packages</li>
<li>2) Don't edit 'default' files</li>
<li>3) Don't mess with /etc/crontab</li>
<li>4) Don't mess with /etc/passwd and /etc/groups either!</li>
<li>5) Reconsider the removal of any options from your customized kernel configuration</li>
<li>6) Don't change the root shell to something else</li>
<li>7) Don't use the root user all the time</li>
<li>8) /var/backups is a thing</li>
<li>9) Check system integrity using /etc/mtree</li>
<li>10) What works for me doesn't have to work for you!</li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180419060427">OpenBSD Community Goes Gold for 2018!</a></h3>

<ul>
<li>Ken Westerback (krw@ when wearing his developer hat) writes:</li>
</ul>

<p>```
Monthly paypal donations from the OpenBSD community have made the community the OpenBSD Foundation's first Gold level contributor for 2018!</p>

<p>2018 is the third consecutive year that the community has reached Gold status or better.</p>

<p>These monthly paypal commitments by the community are our most reliable source of funds and thus the most useful for financial planning purposes. We are extremely thankful for the continuing support and hope the community matches their 2017 achievement of Platinum status. Or even their 2016 achievement of Iridium status.</p>

<p>Sign up now for a monthly donation!</p>

<p>Note that Bitcoin contributions have been re-enabled now that our Bitcoin intermediary has re-certified our Canadian paperwork.</p>

<p>https://www.openbsdfoundation.org/donations.html
```</p>

<p><hr /></p>

<h3><a href="http://bsdly.blogspot.com/2018/04/ed1-mastery-is-must-for-real-unix-person.html">ed(1) mastery is a must read for real unix people</a></h3>

<blockquote>
  <p>In some circles on the Internet, your choice of text editor is a serious matter.</p>
  
  <p>We've all seen the threads on mailing lits, USENET news groups and web forums about the relative merits of Emacs vs vi, including endless iterations of flame wars, and sometimes even involving lesser known or non-portable editing environments.</p>
  
  <p>And then of course, from the Linux newbies we have seen an endless stream of tweeted graphical 'memes' about the editor vim (aka 'vi Improved') versus the various apparently friendlier-to-some options such as GNU nano. Apparently even the 'improved' version of the classical and ubiquitous vi(1) editor is a challenge even to exit for a significant subset of the younger generation.</p>
  
  <p>Yes, your choice of text editor or editing environment is a serious matter. Mainly because text processing is so fundamental to our interactions with computers.</p>
  
  <p>But for those of us who keep our systems on a real Unix (such as OpenBSD or FreeBSD), there is no real contest. The OpenBSD base system contains several text editors including vi(1) and the almost-emacs mg(1), but ed(1) remains the standard editor.</p>
  
  <p>Now Michael Lucas has written a book to guide the as yet uninitiated to the fundamentals of the original Unix text editor. It is worth keeping in mind that much of Unix and its original standard text editor written back when the standard output and default user interface was more likely than not a printing terminal.</p>
  
  <p>To some of us, reading and following the narrative of Ed Mastery is a trip down memory lane. To others, following along the text will illustrate the horror of the world of pre-graphic computer interfaces. For others again, the fact that ed(1) doesn't use your terminal settings much at all offers hope of fixing things when something or somebody screwed up your system so you don't have a working terminal for that visual editor.</p>
</blockquote>

<p><hr /></p>

<p><strong>DigitalOcean</strong>
<a href="http://do.co/bsdnow">Digital Ocean Promo Link for BSD Now Listeners</a></p>

<p><hr /></p>

<h3><a href="https://vermaden.wordpress.com/2018/04/16/distributed-object-storage-with-minio-on-freebsd/">Distributed Object Storage with Minio on FreeBSD</a></h3>

<blockquote>
  <p>Free and open source distributed object storage server compatible with Amazon S3 v2/v4 API. Offers data protection against hardware failures using erasure code and bitrot detection. Supports highly available distributed setup. Provides confidentiality, integrity and authenticity assurances for encrypted data with negligible performance overhead. Both server side and client side encryption are supported. Below is the image of example Minio setup.</p>
</blockquote>

<ul>
<li><a href="https://vermaden.files.wordpress.com/2018/04/minio-architecture-diagram-distributed.jpg?w=960">Architecture Diagram </a></li>
</ul>

<p>The Minio identifies itself as the ZFS of Cloud Object Storage. This guide will show You how to setup highly available distributed Minio storage on the FreeBSD operating system with ZFS as backend for Minio data. For convenience we will use FreeBSD Jails operating system level virtualization.</p>

<ul>
<li>Setup</li>
</ul>

<blockquote>
  <p>The setup will assume that You have 3 datacenters and assumption that you have two datacenters in whose the most of the data must reside and that the third datacenter is used as a ‘quorum/witness’ role. Distributed Minio supports up to 16 nodes/drives total, so we may juggle with that number to balance data between desired datacenters. As we have 16 drives to allocate resources on 3 sites we will use 7 + 7 + 2 approach here. The datacenters where most of the data must reside have 7/16 ratio while the ‘quorum/witness’ datacenter have only 2/16 ratio. Thanks to built in Minio redundancy we may loose (turn off for example) any one of those machines and our object storage will still be available and ready to use for any purpose.</p>
</blockquote>

<ul>
<li>Jails</li>
</ul>

<blockquote>
  <p>First we will create 3 jails for our proof of concept Minio setup, storage1 will have the ‘quorum/witness’ role while storage2 and storage3 will have the ‘data’ role. To distinguish commands I type on the host system and storageX Jail I use two different prompts, this way it should be obvious what command to execute and where.</p>
</blockquote>

<ul>
<li>WeI know the FreeNAS people have been working on integrating this</li>
</ul>

<p><hr /></p>

<h3><a href="https://kristaps.bsd.lv/kcgi/tutorial6.html">Best practises for pledge(2) security</a></h3>

<blockquote>
  <p>Let's set the record straight for securing kcgi CGI and FastCGI applications with pledge(2). This is focussed on secure OpenBSD deployments.</p>
</blockquote>

<ul>
<li>Theory</li>
</ul>

<blockquote>
  <p>Internally, kcgi makes considerable use of available security tools. But it's also designed to be invoked in a secure environment. We'll start with pledge(2), which has been around on OpenBSD since version 5.9. If you're reading this tutorial, you're probably on OpenBSD, and you probably have knowledge of pledge(2).</p>
  
  <p>How to begin? Read kcgi(3). It includes canonical information on which pledge(2) promises you'll need for each function in the library. This is just a tutorial—the manpage is canonical and overrides what you may read here.</p>
  
  <p>Next, assess the promises that your application needs. From kcgi(3), it's easy to see which promises we'll need to start. You'll need to augment this list with whichever tools you're also using. The general push is to start with the broadest set of required promises, then restrict as quickly as possible. Sometimes this can be done in a single pledge(2), but other times it takes a few.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-April/014194.html">April's London *BSD meetup - notes</a></li>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-May/014198.html">May’s London *BSD Meetup: May 22nd </a></li>
<li><a href="https://2018.eurobsdcon.org/call-for-papers/">Call for Papers for EuroBSDcon 2018</a></li>
<li><a href="https://www.freebsdfoundation.org/journal/">FreeBSD Journal March/April Desktop/Laptop issue</a></li>
<li><a href="https://lwn.net/Articles/752063/">LWN followup on the PostgreSQL fsync() issue</a></li>
<li><a href="https://awards.acm.org/outstanding-contribution">The Association for Computing Machinery recognizes Steve Bourne for outstanding contributions</a></li>
</ul>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Ray - <a href="http://dpaste.com/1F8RX6H#wrap">Speaking at Conferences</a></li>
<li>Casey - <a href="http://dpaste.com/364FTMM#wrap">Questions</a></li>
<li>Jeremy - <a href="http://dpaste.com/3GWHP9N#wrap">zfs in the enterprise</a>
<ul><li><a href="https://wiki.freebsd.org/HAST">HAST + ZFS</a></li></ul></li>
<li>Lars - <a href="http://dpaste.com/1HDZFA3">Civil Infrastructure Platform use of *BSD</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 245: ZFS User Conf 2018 | BSD Now 245</title>
  <link>https://www.bsdnow.tv/245</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-1913</guid>
  <pubDate>Thu, 10 May 2018 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b6503021-a9eb-471a-8089-2dc3647bc58c.mp3" length="61107427" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Allan’s recap of the ZFS User conference, first impressions of OmniOS by a BSD user, Nextcloud 13 setup on FreeBSD, OpenBSD on a fanless desktop computer, an intro to HardenedBSD, and DragonFlyBSD getting some SMP improvements.</itunes:subtitle>
  <itunes:duration>1:24:37</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Allan’s recap of the ZFS User conference, first impressions of OmniOS by a BSD user, Nextcloud 13 setup on FreeBSD, OpenBSD on a fanless desktop computer, an intro to HardenedBSD, and DragonFlyBSD getting some SMP improvements.
&lt;hr&gt;
&lt;h2&gt;Headlines&lt;/h2&gt;

&lt;h3&gt;ZFS User Conference Recap&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;Attendees met for breakfast on the fourth floor, in a lunchroom type area just outside of the theatre. One entire wall was made of lego base plates, and there were buckets of different coloured lego embedded in the wall.&lt;/li&gt;
&lt;li&gt;The talks started with Matt Ahrens discussing how the 2nd most requested feature of ZFS, Device Removal, has now landed, then pivoting into the MOST requested feature, RAID-Z expansion, and his work on that so far, which included the first functional prototype, on FreeBSD.&lt;/li&gt;
&lt;li&gt;Then our friend Calvin Hendryx-Parker presented how he solves all of his backup headaches with ZFS. I provided him some helpful hints to optimize his setup and improve the throughput of his backups&lt;/li&gt;
&lt;li&gt;Then Steven Umbehocker of OSNEXUS talked about their products, and how they manage large numbers of ZFS nodes&lt;/li&gt;
&lt;li&gt;After a very nice lunch, Orlando Pichardo of Micron talked about the future of flash, and their new 7.5TB SATA SSDs. Discussion of these devices after the talk may lead to enhancements to ZFS to better support these new larger flash devices that use larger logical sector sizes.&lt;/li&gt;
&lt;li&gt;Alek Pinchuk of Datto talked about Pool Layout Considerations&lt;/li&gt;
&lt;li&gt;then Tony Hutter of LLNL talked about the release process for ZFS on Linux&lt;/li&gt;
&lt;li&gt;Then Tom Caputi of Datto presented: Helping Developers Help You, guidance for users submitting bug reports, with some good and bad examples&lt;/li&gt;
&lt;li&gt;Then we had a nice cocktail party and dinner, and stayed late into the night talked about ZFS&lt;/li&gt;
&lt;li&gt;The next day, Jervin Real of Percona, presented: ZFS and MySQL on Linux, the Sweet Spots. Mostly outlining some benchmark they had done, some of the results were curious and some additional digging may turn up enhancements that can be made to ZFS, or just better tuning advice for high traffic MySQL servers.&lt;/li&gt;
&lt;li&gt;Then I presented my ZSTD compression work, which had been referenced in 2 of the previous talks, as people are anxious to get their hands on this code.&lt;/li&gt;
&lt;li&gt;Lastly, Eric Sproul of Circonus, gave his talk: Thank You, ZFS. It thanked ZFS and its Community for making their companies product possible, and then provided an update to his presentation from last year, where they were having problems with extremely high levels of ZFS fragmentation. This also sparked a longer conversation after the talk was over.&lt;/li&gt;
&lt;li&gt;Then we had a BBQ lunch, and after some more talking, the conference broke up.&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.linuxquestions.org/questions/solaris-opensolaris-20/initial-omnios-impressions-by-a-bsd-user-4175626757/"&gt;Initial OmniOS impressions by a BSD user&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I had been using FreeBSD as my main web server OS since 2012 and I liked it so much that I even contributed money and code to it. However, since the FreeBSD guys (and gals) decided to install anti-tech feminism, I have been considering to move away from it for quite some time now.&lt;/p&gt;
  
  &lt;p&gt;As my growing needs require stronger hardware, it was finally time to rent a new server. I do not intend to run FreeBSD on it. Although the most obvious choice would be OpenBSD (I run it on another server and it works just fine), I plan to have a couple of databases running on the new machine, and database throughput has never been one of OpenBSD's strong points. This is my chance to give illumos another try. As neither WiFi nor desktop environments are relevant on a no-X11 server, the server-focused OmniOS seemed to fit my needs.&lt;/p&gt;
  
  &lt;p&gt;My current (to be phased out) setup on FreeBSD is:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;apache24 with SSL support, running five websites on six domains (both HTTP and HTTPS)&lt;/li&gt;
&lt;li&gt;a (somewhat large) Tiny Tiny RSS installation from git, updated via cronjob&lt;/li&gt;
&lt;li&gt;sbcl running a daily cronjob of my Web-to-RSS parser&lt;/li&gt;
&lt;li&gt;an FTP server where I share stuff with friends&lt;/li&gt;
&lt;li&gt;an IRC bouncer&lt;/li&gt;
&lt;li&gt;MariaDB and PostgreSQL for some of the hosted services&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;I would not consider anything of that too esoteric for a modern operating system. Since I was not really using anything mod_rewrite-related, I was perfectly ready to replace apache24 by nginx, remembering that the prepackaged apache24 on FreeBSD did not support HTTPS out of the box and I had ended up installing it from the ports. That is the only change in my setup which I am actively planning.&lt;/p&gt;
  
  &lt;p&gt;So here's what I noticed.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;First impressions:&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Hooray, a BSD boot loader! Finally an operating system without grub - I made my experiences with that and I don't want to repeat them too often.&lt;/p&gt;
  
  &lt;p&gt;It is weird that the installer won't accept "mydomain.org" as a hostname but sendmail complains that "mydomain" is not a valid hostname right from the start, OmniOS sent me into Maintenance Mode to fix that. A good start, right? So the first completely new thing I had to find out on my new shiny toy was how to change the hostname. There is no /etc/rc.conf in it and hostname mydomain.org was only valid for one login session. I found out that the hostname has to be changed in three different files under /etc on Solaris - the third one did not even exist for me. Changing the other two files seems to have solved this problem for me.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Random findings:&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;~ I was wondering how many resources my (mostly idle) new web server was using - I always thought Solaris was rather fat, but it still felt fast to me.&lt;/p&gt;
  
  &lt;p&gt;Ah, right - we're in Unixland and we need to think outside of the box. This table was really helpful: although a number of things are different between OmniOS and SmartOS, I found out that the *stat tools do what top does. I could probably just install top from one of the package managers, but I failed to find a reason to do so. I had 99% idle CPU and RAM - that's all I wanted to know.&lt;/p&gt;
  
  &lt;p&gt;~ Trying to set up twtxt informed me that Python 3.6 (from pkgin) expects LANG and LC_ALL to be set. Weird - did FreeBSD do that for me? It's been a while ... at least that was easy to fix.&lt;/p&gt;
  
  &lt;p&gt;~ SMF - Solaris's version of init - confuses me. It has "levels" similar to Gentoo's OpenRC, but it mostly shuts up during the boot process. Stuff from pkgsrc, e.g. nginx, comes with a description how to set up the particular service, but I should probably read more about it. What if, one day, I install a package which is not made ready for OmniOS? I'll have to find out how to write SMF scripts. But that should not be my highest priority.&lt;/p&gt;
  
  &lt;p&gt;~ The OmniOS documentation talks a lot about "zones" which, if I understand that correctly, mostly equal FreeBSD's "jails". This could be my chance to try to respect a better separation between my various services - if my lazyness won't take over again. (It probably will.)&lt;/p&gt;
  
  &lt;p&gt;~ OmniOS's default shell - rather un-unixy - seems to be the bash. Update: I was informed about a mistake here: the default shell is ksh93, there are bogus .bashrc files lying around though.&lt;/p&gt;
  
  &lt;p&gt;~ Somewhere in between, my sshd had a hiccup or, at least, logging into it took longer than usual. If that happens again, I should investigate.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Conclusion:&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;By the time of me writing this, I have a basic web server with an awesome performance and a lot of applications ready to be configured only one click away. The more I play with it, the more I have the feeling that I have missed a lot while wasting my time with FreeBSD. For a system that is said to be "dying", OmniOS feels well-thought and, when equipped with a reasonable package management, comes with everything I need to reproduce my FreeBSD setup without losing functionality.&lt;/p&gt;
  
  &lt;p&gt;I'm looking forward to what will happen with it.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;DigitalOcean&lt;/strong&gt;
http://do.co/bsdnow&lt;/p&gt;

&lt;h3&gt;[Open Source Hardware Camp 2018 — Sat 30/06 &amp;amp; Sun 01/07, Lincoln, UK&lt;/h3&gt;

&lt;p&gt;(includes 'Open-source RISC-V core quickstart' and 'An introductory workshop to NetBSD on embedded platforms')](http://oshug.org/pipermail/oshug/2018-April/000635.html)&lt;/p&gt;

&lt;p&gt;```
Hi All,&lt;/p&gt;

&lt;p&gt;I'm pleased to announce that we have 10 talks and 7 workshops confirmed
for Open Source Hardware Camp 2018, with the possibility of one or two
more. Registration is now open!&lt;/p&gt;

&lt;p&gt;For the first time ever we will be hosting OSHCamp in Lincoln and a huge
thanks to Sarah Markall for helping to make this happen.&lt;/p&gt;

&lt;p&gt;As in previous years, there will be a social event on the Saturday
evening and we have a room booked at the Wig and Mitre. Food will be
available.&lt;/p&gt;

&lt;p&gt;There will likely be a few of us meeting up for pre-conference drinks on
the Friday evening also.&lt;/p&gt;

&lt;p&gt;Details of the programme can be found below and, as ever, we have an
excellent mix of topics being covered.&lt;/p&gt;

&lt;p&gt;Cheers,&lt;/p&gt;

&lt;p&gt;Andrew
```&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Open Source Hardware Camp 2018&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;On the 30th June 2018, 09:00 Saturday morning - 16:00 on the Sunday
  afternoon at The Blue Room, The Lawn, Union Rd, Lincoln, LN1 3BU.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Registration: http://oshug.org/event/oshcamp2018&lt;/li&gt;
&lt;li&gt;Open Source Hardware Camp 2018 will be hosted in the historic county
town of Lincoln — home to, amongst others, noted engine builders Ruston
&amp;amp; Hornsby (now Siemens, via GEC and English Electric).&lt;/li&gt;
&lt;li&gt;Lincoln is well served by rail, reachable from Leeds and London within
2-2.5 hours, and 4-5 hours from Edinburgh and Southampton.&lt;/li&gt;
&lt;li&gt;There will be a social at the Wig and Mitre on the Saturday evening.&lt;/li&gt;
&lt;li&gt;For travel and accommodation information information please see the
event page on oshug.org.&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://vermaden.wordpress.com/2018/04/04/nextcloud-13-on-freebsd/"&gt;Nextcloud 13 on FreeBSD&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Today I would like to share a setup of Nextcloud 13 running on a FreeBSD system. To make things more interesting it would be running inside a FreeBSD Jail. I will not describe the Nextcloud setup itself here as its large enough for several blog posts.&lt;/p&gt;
  
  &lt;p&gt;Official Nextcloud 13 documentation recommends following setup:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;MySQL/MariaDB&lt;/li&gt;
&lt;li&gt;PHP 7.0 (or newer)&lt;/li&gt;
&lt;li&gt;Apache 2.4 (with mod_php)&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;I prefer PostgreSQL database to MySQL/MariaDB and I prefer fast and lean Nginx web server to Apache, so my setup is based on these components:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;PostgreSQL 10.3&lt;/li&gt;
&lt;li&gt;PHP 7.2.4&lt;/li&gt;
&lt;li&gt;Nginx 1.12.2 (with php-fpm)&lt;/li&gt;
&lt;li&gt;Memcached 1.5.7&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;The Memcached subsystem is least important, it can be easily changed into something more modern like Redis for example. I prefer not to use any third party tools for FreeBSD Jails management. Not because they are bad or something like that. There are just many choices for good FreeBSD Jails management and I want to provide a GENERIC example for Nextcloud 13 in a Jail, not for a specific management tool.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Host&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Lets start with preparing the FreeBSD Host with needed settings. We need to allow using raw sockets in Jails. For the future optional upgrades of the Jail we will also allow using chflags(1) in Jails.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.romanzolotarev.com/setup.html"&gt;OpenBSD on my fanless desktop computer&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;You asked me about my setup. Here you go.&lt;/p&gt;
  
  &lt;p&gt;I’ve been using OpenBSD on servers for years as a web developer, but never had a chance to dive in to system administration before. If you appreciate the simplicity of OpenBSD and you have to give it a try on your desktop.&lt;/p&gt;
  
  &lt;p&gt;Bear in mind, this is a relatively cheap ergonomic setup, because all I need is xterm(1) with Vim and Firefox, I don’t care about CPU/GPU performance or mobility too much, but I want a large screen and a good keyboard.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;&lt;code&gt;
Item                                    Price, USD
Zotac CI527 NANO-BE                        $371
16GB RAM Crucial DDR4-2133                    $127
250GB SSD Samsung 850 EVO                    $104
Asus VZ249HE 23.8" IPS Full HD                    $129
ErgoDox EZ V3, Cherry MX Brown, blank DCS            $325
Kensington Orbit Trackball                        $33
Total                                    $1,107
&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;OpenBSD&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;I tried few times to install OpenBSD on my MacBooks—I heard some models are compatible with it,—but in my case it was a bit of a fiasco (thanks to Nvidia and Broadcom). That’s why I bought a new computer, just to be able to run this wonderful operating system.&lt;/p&gt;
  
  &lt;p&gt;Now I run -stable on my desktop and servers. Servers are supposed to be reliable, that’s obvious, why not run -current on a desktop? Because -stable is shipped every six months and I that’s is often enough for me. I prefer slow fashion.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;
iX Ad Spot &lt;a href="https://www.ixsystems.com/blog/nab-2018-recap-2/"&gt;NAB 2018 – Michael Dexter’s Recap&lt;/a&gt;&lt;/p&gt;

&lt;h3&gt;&lt;a href="https://vermaden.wordpress.com/2018/04/06/introduction-to-hardenedbsd-world/"&gt;Introduction to HardenedBSD World&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;HardenedBSD is a security enhanced fork of FreeBSD which happened in 2014. HardenedBSD is implementing many exploit mitigation and security technologies on top of FreeBSD which all started with implementation of Address Space Layout Randomization (ASLR). The fork has been created for ease of development.&lt;/p&gt;
  
  &lt;p&gt;To cite the https://hardenedbsd.org/content/about page – “HardenedBSD aims to implement innovative exploit mitigation and security solutions for the FreeBSD community. (…) HardenedBSD takes a holistic approach to security by hardening the system and implementing exploit mitigation technologies.”&lt;/p&gt;
  
  &lt;p&gt;Most FreeBSD enthusiasts know mfsBSD project by Martin Matuska – http://mfsbsd.vx.sk/ – FreeBSD system loaded completely into memory. The mfsBSD synonym for the HardenedBSD world is SoloBSD – http://www.solobsd.org/ – which is based on HardenedBSD sources.&lt;/p&gt;
  
  &lt;p&gt;One may ask how HardenedBSD project compared to more well know for its security OpenBSD system and it is very important question. The OpenBSD developers try to write ‘good’ code without dirty hacks for performance or other reasons. Clean and secure code is most important in OpenBSD world. The OpenBSD project even made security audit of all OpenBSD code available, line by line. This was easier to achieve in FreeBSD or HardenedBSD because OpenBSD code base its about ten times smaller. This has also other implications, possibilities. While FreeBSD (and HardenedBSD) offer many new features like mature SMP subsystem even with some NUMA support, ZFS filesystem, GEOM storage framework, Bhyve virtualization, Virtualbox option and many other new modern features the OpenBSD remains classic UNIX system with UFS filesystem and with very ‘theoretical’ SMP support. The vmm project tried to implement new hypervisor in OpenBSD world, but because of lack of support for graphics its for OpenBSD, Illumos and Linux currently, You will not virtualize Windows or Mac OS X there. This is also only virtualization option for OpenBSD as there are no Jails on OpenBSD. Current Bhyve implementation allows one even to boot latest Windows 2019 Technology Preview.&lt;/p&gt;
  
  &lt;p&gt;A HardenedBSD project is FreeBSD system code base with LOTS of security mechanisms and mitigations that are not available on FreeBSD system. For example entire lib32 tree has been disabled by default on HardenedBSD to make it more secure. Also LibreSSL is the default SSL library on HardenedBSD, same as OpenBSD while FreeBSD uses OpenSSL for compatibility reasons.&lt;/p&gt;
  
  &lt;p&gt;Comparison between LibreSSL and OpenSSL vulnerabilities.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;https://en.wikipedia.org/wiki/LibreSSL#Security&lt;/li&gt;
&lt;li&gt;https://wiki.freebsd.org/LibreSSL#LibreSSL&lt;em&gt;.28and&lt;/em&gt;OpenSSL.29&lt;em&gt;Security&lt;/em&gt;Vulnerabilities&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;One may see HardenedBSD as FreeBSD being successfully pulled up to the OpenBSD level (at least that is the goal), but as FreeBSD has tons more code and features it will be harder and longer process to achieve the goal.&lt;/p&gt;
  
  &lt;p&gt;As I do not have that much competence on the security field I will just repost the comparison from the HardenedBSD project versus other BSD systems. The comparison is also available here – https://hardenedbsd.org/content/easy-feature-comparison – on the HardenedBSD website.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.tomatkinson.uk/git.html"&gt;Running my own git server&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Note: This article is predominantly based on work by Hiltjo Posthuma who you should read because I would have spent far too much time failing to set things up if it wasn’t for their post. Not only have they written lots of very interesting posts, they write some really brilliant programs&lt;/p&gt;
  
  &lt;p&gt;Since I started university 3 years ago, I started using lots of services from lots of different companies. The “cloud” trend led me to believe that I wanted other people to look after my data for me. I was wrong. Since finding myself loving the ethos of OpenBSD, I found myself wanting to apply this ethos to the services I use as well. Not only is it important to me because of the security benefits, but also because I like the minimalist style OpenBSD portrays. This is the first in a mini-series documenting my move from bloated, hosted, sometimes proprietary services to minimal, well-written, free, self-hosted services.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Tools &amp;amp; applications&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;These are the programs I am going to be using to get my git server up and running:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;&lt;code&gt;
httpd(8)
acme-client(1)
git(1)
cgit(1)
slowcgi(8)
&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Setting up httpd&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Ensure you have the necessary flags enabled in your /etc/rc.conf.local:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Configuring cgit&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;When using the OpenBSD httpd(8), it will serve it’s content in a chrooted environment,which defaults to the home directory of the user it runs as, which is www in this case. This means that the chroot is limited to the directory /var/www and it’s contents.&lt;/p&gt;
  
  &lt;p&gt;In order to configure cgit, there must be a cgitrc file available to cgit. This is found at the location stored in $CGIT_CONFIG, which defaults to /conf/cgitrc. Because of the chroot, this file is actually stored at /var/www/conf/cgitrc.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://blather.michaelwlucas.com/archives/3173"&gt;My Penguicon 2018 Schedule&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://rachelbythebay.com/w/2018/04/16/signal/"&gt;sigaction: see who killed you (and more)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://mail-index.netbsd.org/netbsd-announce/2018/04/20/msg000284.html"&gt;Takeshi steps down from NetBSD core team after 13 years&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=DragonFlyBSD-More-Perf-For-5.4"&gt;DragonFlyBSD Kernel Gets Some SMP Improvements – Phoronix&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://m.youtube.com/watch?v=bT_k06Xg-BE"&gt;Writing FreeBSD Malware&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;strong&gt;Tarsnap ad&lt;/strong&gt;&lt;/p&gt;

&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Troels - &lt;a href="http://dpaste.com/35K0BD7#wrap"&gt;Question regarding ZFS xattr&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Mike - &lt;a href="http://dpaste.com/33X1K80#wrap"&gt;Sharing your screen&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Wilyarti - &lt;a href="http://dpaste.com/0D452Q0#wrap"&gt;Adlocking on FreeBSD&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Brad - &lt;a href="http://dpaste.com/08XAHNY#wrap"&gt;Recommendations for snapshot strategy&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Allan’s recap of the ZFS User conference, first impressions of OmniOS by a BSD user, Nextcloud 13 setup on FreeBSD, OpenBSD on a fanless desktop computer, an intro to HardenedBSD, and DragonFlyBSD getting some SMP improvements.<br>
<hr /></p>

<h2>Headlines</h2>

<h3>ZFS User Conference Recap</h3>

<ul>
<li>Attendees met for breakfast on the fourth floor, in a lunchroom type area just outside of the theatre. One entire wall was made of lego base plates, and there were buckets of different coloured lego embedded in the wall.</li>
<li>The talks started with Matt Ahrens discussing how the 2nd most requested feature of ZFS, Device Removal, has now landed, then pivoting into the MOST requested feature, RAID-Z expansion, and his work on that so far, which included the first functional prototype, on FreeBSD.</li>
<li>Then our friend Calvin Hendryx-Parker presented how he solves all of his backup headaches with ZFS. I provided him some helpful hints to optimize his setup and improve the throughput of his backups</li>
<li>Then Steven Umbehocker of OSNEXUS talked about their products, and how they manage large numbers of ZFS nodes</li>
<li>After a very nice lunch, Orlando Pichardo of Micron talked about the future of flash, and their new 7.5TB SATA SSDs. Discussion of these devices after the talk may lead to enhancements to ZFS to better support these new larger flash devices that use larger logical sector sizes.</li>
<li>Alek Pinchuk of Datto talked about Pool Layout Considerations</li>
<li>then Tony Hutter of LLNL talked about the release process for ZFS on Linux</li>
<li>Then Tom Caputi of Datto presented: Helping Developers Help You, guidance for users submitting bug reports, with some good and bad examples</li>
<li>Then we had a nice cocktail party and dinner, and stayed late into the night talked about ZFS</li>
<li>The next day, Jervin Real of Percona, presented: ZFS and MySQL on Linux, the Sweet Spots. Mostly outlining some benchmark they had done, some of the results were curious and some additional digging may turn up enhancements that can be made to ZFS, or just better tuning advice for high traffic MySQL servers.</li>
<li>Then I presented my ZSTD compression work, which had been referenced in 2 of the previous talks, as people are anxious to get their hands on this code.</li>
<li>Lastly, Eric Sproul of Circonus, gave his talk: Thank You, ZFS. It thanked ZFS and its Community for making their companies product possible, and then provided an update to his presentation from last year, where they were having problems with extremely high levels of ZFS fragmentation. This also sparked a longer conversation after the talk was over.</li>
<li>Then we had a BBQ lunch, and after some more talking, the conference broke up.</li>
</ul>

<p><hr /></p>

<h3><a href="https://www.linuxquestions.org/questions/solaris-opensolaris-20/initial-omnios-impressions-by-a-bsd-user-4175626757/">Initial OmniOS impressions by a BSD user</a></h3>

<blockquote>
  <p>I had been using FreeBSD as my main web server OS since 2012 and I liked it so much that I even contributed money and code to it. However, since the FreeBSD guys (and gals) decided to install anti-tech feminism, I have been considering to move away from it for quite some time now.</p>
  
  <p>As my growing needs require stronger hardware, it was finally time to rent a new server. I do not intend to run FreeBSD on it. Although the most obvious choice would be OpenBSD (I run it on another server and it works just fine), I plan to have a couple of databases running on the new machine, and database throughput has never been one of OpenBSD's strong points. This is my chance to give illumos another try. As neither WiFi nor desktop environments are relevant on a no-X11 server, the server-focused OmniOS seemed to fit my needs.</p>
  
  <p>My current (to be phased out) setup on FreeBSD is:</p>
</blockquote>

<ul>
<li>apache24 with SSL support, running five websites on six domains (both HTTP and HTTPS)</li>
<li>a (somewhat large) Tiny Tiny RSS installation from git, updated via cronjob</li>
<li>sbcl running a daily cronjob of my Web-to-RSS parser</li>
<li>an FTP server where I share stuff with friends</li>
<li>an IRC bouncer</li>
<li>MariaDB and PostgreSQL for some of the hosted services</li>
</ul>

<blockquote>
  <p>I would not consider anything of that too esoteric for a modern operating system. Since I was not really using anything mod_rewrite-related, I was perfectly ready to replace apache24 by nginx, remembering that the prepackaged apache24 on FreeBSD did not support HTTPS out of the box and I had ended up installing it from the ports. That is the only change in my setup which I am actively planning.</p>
  
  <p>So here's what I noticed.</p>
</blockquote>

<ul>
<li>First impressions:</li>
</ul>

<blockquote>
  <p>Hooray, a BSD boot loader! Finally an operating system without grub - I made my experiences with that and I don't want to repeat them too often.</p>
  
  <p>It is weird that the installer won't accept "mydomain.org" as a hostname but sendmail complains that "mydomain" is not a valid hostname right from the start, OmniOS sent me into Maintenance Mode to fix that. A good start, right? So the first completely new thing I had to find out on my new shiny toy was how to change the hostname. There is no /etc/rc.conf in it and hostname mydomain.org was only valid for one login session. I found out that the hostname has to be changed in three different files under /etc on Solaris - the third one did not even exist for me. Changing the other two files seems to have solved this problem for me.</p>
</blockquote>

<ul>
<li>Random findings:</li>
</ul>

<blockquote>
  <p>~ I was wondering how many resources my (mostly idle) new web server was using - I always thought Solaris was rather fat, but it still felt fast to me.</p>
  
  <p>Ah, right - we're in Unixland and we need to think outside of the box. This table was really helpful: although a number of things are different between OmniOS and SmartOS, I found out that the *stat tools do what top does. I could probably just install top from one of the package managers, but I failed to find a reason to do so. I had 99% idle CPU and RAM - that's all I wanted to know.</p>
  
  <p>~ Trying to set up twtxt informed me that Python 3.6 (from pkgin) expects LANG and LC_ALL to be set. Weird - did FreeBSD do that for me? It's been a while ... at least that was easy to fix.</p>
  
  <p>~ SMF - Solaris's version of init - confuses me. It has "levels" similar to Gentoo's OpenRC, but it mostly shuts up during the boot process. Stuff from pkgsrc, e.g. nginx, comes with a description how to set up the particular service, but I should probably read more about it. What if, one day, I install a package which is not made ready for OmniOS? I'll have to find out how to write SMF scripts. But that should not be my highest priority.</p>
  
  <p>~ The OmniOS documentation talks a lot about "zones" which, if I understand that correctly, mostly equal FreeBSD's "jails". This could be my chance to try to respect a better separation between my various services - if my lazyness won't take over again. (It probably will.)</p>
  
  <p>~ OmniOS's default shell - rather un-unixy - seems to be the bash. Update: I was informed about a mistake here: the default shell is ksh93, there are bogus .bashrc files lying around though.</p>
  
  <p>~ Somewhere in between, my sshd had a hiccup or, at least, logging into it took longer than usual. If that happens again, I should investigate.</p>
</blockquote>

<ul>
<li>Conclusion:</li>
</ul>

<blockquote>
  <p>By the time of me writing this, I have a basic web server with an awesome performance and a lot of applications ready to be configured only one click away. The more I play with it, the more I have the feeling that I have missed a lot while wasting my time with FreeBSD. For a system that is said to be "dying", OmniOS feels well-thought and, when equipped with a reasonable package management, comes with everything I need to reproduce my FreeBSD setup without losing functionality.</p>
  
  <p>I'm looking forward to what will happen with it.</p>
</blockquote>

<p><hr /></p>

<p><strong>DigitalOcean</strong>
http://do.co/bsdnow</p>

<h3>[Open Source Hardware Camp 2018 — Sat 30/06 &amp; Sun 01/07, Lincoln, UK</h3>

<p>(includes 'Open-source RISC-V core quickstart' and 'An introductory workshop to NetBSD on embedded platforms')](http://oshug.org/pipermail/oshug/2018-April/000635.html)</p>

<p>```
Hi All,</p>

<p>I'm pleased to announce that we have 10 talks and 7 workshops confirmed
for Open Source Hardware Camp 2018, with the possibility of one or two
more. Registration is now open!</p>

<p>For the first time ever we will be hosting OSHCamp in Lincoln and a huge
thanks to Sarah Markall for helping to make this happen.</p>

<p>As in previous years, there will be a social event on the Saturday
evening and we have a room booked at the Wig and Mitre. Food will be
available.</p>

<p>There will likely be a few of us meeting up for pre-conference drinks on
the Friday evening also.</p>

<p>Details of the programme can be found below and, as ever, we have an
excellent mix of topics being covered.</p>

<p>Cheers,</p>

<p>Andrew
```</p>

<ul>
<li>Open Source Hardware Camp 2018</li>
</ul>

<blockquote>
  <p>On the 30th June 2018, 09:00 Saturday morning - 16:00 on the Sunday
  afternoon at The Blue Room, The Lawn, Union Rd, Lincoln, LN1 3BU.</p>
</blockquote>

<ul>
<li>Registration: http://oshug.org/event/oshcamp2018</li>
<li>Open Source Hardware Camp 2018 will be hosted in the historic county
town of Lincoln — home to, amongst others, noted engine builders Ruston
&amp; Hornsby (now Siemens, via GEC and English Electric).</li>
<li>Lincoln is well served by rail, reachable from Leeds and London within
2-2.5 hours, and 4-5 hours from Edinburgh and Southampton.</li>
<li>There will be a social at the Wig and Mitre on the Saturday evening.</li>
<li>For travel and accommodation information information please see the
event page on oshug.org.</li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://vermaden.wordpress.com/2018/04/04/nextcloud-13-on-freebsd/">Nextcloud 13 on FreeBSD</a></h3>

<blockquote>
  <p>Today I would like to share a setup of Nextcloud 13 running on a FreeBSD system. To make things more interesting it would be running inside a FreeBSD Jail. I will not describe the Nextcloud setup itself here as its large enough for several blog posts.</p>
  
  <p>Official Nextcloud 13 documentation recommends following setup:</p>
</blockquote>

<ul>
<li>MySQL/MariaDB</li>
<li>PHP 7.0 (or newer)</li>
<li>Apache 2.4 (with mod_php)</li>
</ul>

<blockquote>
  <p>I prefer PostgreSQL database to MySQL/MariaDB and I prefer fast and lean Nginx web server to Apache, so my setup is based on these components:</p>
</blockquote>

<ul>
<li>PostgreSQL 10.3</li>
<li>PHP 7.2.4</li>
<li>Nginx 1.12.2 (with php-fpm)</li>
<li>Memcached 1.5.7</li>
</ul>

<blockquote>
  <p>The Memcached subsystem is least important, it can be easily changed into something more modern like Redis for example. I prefer not to use any third party tools for FreeBSD Jails management. Not because they are bad or something like that. There are just many choices for good FreeBSD Jails management and I want to provide a GENERIC example for Nextcloud 13 in a Jail, not for a specific management tool.</p>
</blockquote>

<ul>
<li>Host</li>
</ul>

<blockquote>
  <p>Lets start with preparing the FreeBSD Host with needed settings. We need to allow using raw sockets in Jails. For the future optional upgrades of the Jail we will also allow using chflags(1) in Jails.</p>
</blockquote>

<p><hr /></p>

<h3><a href="https://www.romanzolotarev.com/setup.html">OpenBSD on my fanless desktop computer</a></h3>

<blockquote>
  <p>You asked me about my setup. Here you go.</p>
  
  <p>I’ve been using OpenBSD on servers for years as a web developer, but never had a chance to dive in to system administration before. If you appreciate the simplicity of OpenBSD and you have to give it a try on your desktop.</p>
  
  <p>Bear in mind, this is a relatively cheap ergonomic setup, because all I need is xterm(1) with Vim and Firefox, I don’t care about CPU/GPU performance or mobility too much, but I want a large screen and a good keyboard.</p>
</blockquote>

<p><code>
Item                                    Price, USD
Zotac CI527 NANO-BE                        $371
16GB RAM Crucial DDR4-2133                    $127
250GB SSD Samsung 850 EVO                    $104
Asus VZ249HE 23.8" IPS Full HD                    $129
ErgoDox EZ V3, Cherry MX Brown, blank DCS            $325
Kensington Orbit Trackball                        $33
Total                                    $1,107
</code></p>

<ul>
<li>OpenBSD</li>
</ul>

<blockquote>
  <p>I tried few times to install OpenBSD on my MacBooks—I heard some models are compatible with it,—but in my case it was a bit of a fiasco (thanks to Nvidia and Broadcom). That’s why I bought a new computer, just to be able to run this wonderful operating system.</p>
  
  <p>Now I run -stable on my desktop and servers. Servers are supposed to be reliable, that’s obvious, why not run -current on a desktop? Because -stable is shipped every six months and I that’s is often enough for me. I prefer slow fashion.</p>
</blockquote>

<p><hr /></p>

<p><strong>iXsystems</strong>
iX Ad Spot <a href="https://www.ixsystems.com/blog/nab-2018-recap-2/">NAB 2018 – Michael Dexter’s Recap</a></p>

<h3><a href="https://vermaden.wordpress.com/2018/04/06/introduction-to-hardenedbsd-world/">Introduction to HardenedBSD World</a></h3>

<blockquote>
  <p>HardenedBSD is a security enhanced fork of FreeBSD which happened in 2014. HardenedBSD is implementing many exploit mitigation and security technologies on top of FreeBSD which all started with implementation of Address Space Layout Randomization (ASLR). The fork has been created for ease of development.</p>
  
  <p>To cite the https://hardenedbsd.org/content/about page – “HardenedBSD aims to implement innovative exploit mitigation and security solutions for the FreeBSD community. (…) HardenedBSD takes a holistic approach to security by hardening the system and implementing exploit mitigation technologies.”</p>
  
  <p>Most FreeBSD enthusiasts know mfsBSD project by Martin Matuska – http://mfsbsd.vx.sk/ – FreeBSD system loaded completely into memory. The mfsBSD synonym for the HardenedBSD world is SoloBSD – http://www.solobsd.org/ – which is based on HardenedBSD sources.</p>
  
  <p>One may ask how HardenedBSD project compared to more well know for its security OpenBSD system and it is very important question. The OpenBSD developers try to write ‘good’ code without dirty hacks for performance or other reasons. Clean and secure code is most important in OpenBSD world. The OpenBSD project even made security audit of all OpenBSD code available, line by line. This was easier to achieve in FreeBSD or HardenedBSD because OpenBSD code base its about ten times smaller. This has also other implications, possibilities. While FreeBSD (and HardenedBSD) offer many new features like mature SMP subsystem even with some NUMA support, ZFS filesystem, GEOM storage framework, Bhyve virtualization, Virtualbox option and many other new modern features the OpenBSD remains classic UNIX system with UFS filesystem and with very ‘theoretical’ SMP support. The vmm project tried to implement new hypervisor in OpenBSD world, but because of lack of support for graphics its for OpenBSD, Illumos and Linux currently, You will not virtualize Windows or Mac OS X there. This is also only virtualization option for OpenBSD as there are no Jails on OpenBSD. Current Bhyve implementation allows one even to boot latest Windows 2019 Technology Preview.</p>
  
  <p>A HardenedBSD project is FreeBSD system code base with LOTS of security mechanisms and mitigations that are not available on FreeBSD system. For example entire lib32 tree has been disabled by default on HardenedBSD to make it more secure. Also LibreSSL is the default SSL library on HardenedBSD, same as OpenBSD while FreeBSD uses OpenSSL for compatibility reasons.</p>
  
  <p>Comparison between LibreSSL and OpenSSL vulnerabilities.</p>
</blockquote>

<ul>
<li>https://en.wikipedia.org/wiki/LibreSSL#Security</li>
<li>https://wiki.freebsd.org/LibreSSL#LibreSSL<em>.28and</em>OpenSSL.29<em>Security</em>Vulnerabilities</li>
</ul>

<blockquote>
  <p>One may see HardenedBSD as FreeBSD being successfully pulled up to the OpenBSD level (at least that is the goal), but as FreeBSD has tons more code and features it will be harder and longer process to achieve the goal.</p>
  
  <p>As I do not have that much competence on the security field I will just repost the comparison from the HardenedBSD project versus other BSD systems. The comparison is also available here – https://hardenedbsd.org/content/easy-feature-comparison – on the HardenedBSD website.</p>
</blockquote>

<p><hr /></p>

<h3><a href="https://www.tomatkinson.uk/git.html">Running my own git server</a></h3>

<blockquote>
  <p>Note: This article is predominantly based on work by Hiltjo Posthuma who you should read because I would have spent far too much time failing to set things up if it wasn’t for their post. Not only have they written lots of very interesting posts, they write some really brilliant programs</p>
  
  <p>Since I started university 3 years ago, I started using lots of services from lots of different companies. The “cloud” trend led me to believe that I wanted other people to look after my data for me. I was wrong. Since finding myself loving the ethos of OpenBSD, I found myself wanting to apply this ethos to the services I use as well. Not only is it important to me because of the security benefits, but also because I like the minimalist style OpenBSD portrays. This is the first in a mini-series documenting my move from bloated, hosted, sometimes proprietary services to minimal, well-written, free, self-hosted services.</p>
</blockquote>

<ul>
<li>Tools &amp; applications</li>
</ul>

<blockquote>
  <p>These are the programs I am going to be using to get my git server up and running:</p>
</blockquote>

<p><code>
httpd(8)
acme-client(1)
git(1)
cgit(1)
slowcgi(8)
</code></p>

<ul>
<li>Setting up httpd</li>
</ul>

<blockquote>
  <p>Ensure you have the necessary flags enabled in your /etc/rc.conf.local:</p>
</blockquote>

<ul>
<li>Configuring cgit</li>
</ul>

<blockquote>
  <p>When using the OpenBSD httpd(8), it will serve it’s content in a chrooted environment,which defaults to the home directory of the user it runs as, which is www in this case. This means that the chroot is limited to the directory /var/www and it’s contents.</p>
  
  <p>In order to configure cgit, there must be a cgitrc file available to cgit. This is found at the location stored in $CGIT_CONFIG, which defaults to /conf/cgitrc. Because of the chroot, this file is actually stored at /var/www/conf/cgitrc.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blather.michaelwlucas.com/archives/3173">My Penguicon 2018 Schedule</a></li>
<li><a href="https://rachelbythebay.com/w/2018/04/16/signal/">sigaction: see who killed you (and more)</a></li>
<li><a href="http://mail-index.netbsd.org/netbsd-announce/2018/04/20/msg000284.html">Takeshi steps down from NetBSD core team after 13 years</a></li>
<li><a href="https://www.phoronix.com/scan.php?page=news_item&amp;px=DragonFlyBSD-More-Perf-For-5.4">DragonFlyBSD Kernel Gets Some SMP Improvements – Phoronix</a></li>
<li><a href="https://m.youtube.com/watch?v=bT_k06Xg-BE">Writing FreeBSD Malware</a></li>
</ul>

<p><strong>Tarsnap ad</strong></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Troels - <a href="http://dpaste.com/35K0BD7#wrap">Question regarding ZFS xattr</a></li>
<li>Mike - <a href="http://dpaste.com/33X1K80#wrap">Sharing your screen</a></li>
<li>Wilyarti - <a href="http://dpaste.com/0D452Q0#wrap">Adlocking on FreeBSD</a></li>
<li>Brad - <a href="http://dpaste.com/08XAHNY#wrap">Recommendations for snapshot strategy</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Allan’s recap of the ZFS User conference, first impressions of OmniOS by a BSD user, Nextcloud 13 setup on FreeBSD, OpenBSD on a fanless desktop computer, an intro to HardenedBSD, and DragonFlyBSD getting some SMP improvements.<br>
<hr /></p>

<h2>Headlines</h2>

<h3>ZFS User Conference Recap</h3>

<ul>
<li>Attendees met for breakfast on the fourth floor, in a lunchroom type area just outside of the theatre. One entire wall was made of lego base plates, and there were buckets of different coloured lego embedded in the wall.</li>
<li>The talks started with Matt Ahrens discussing how the 2nd most requested feature of ZFS, Device Removal, has now landed, then pivoting into the MOST requested feature, RAID-Z expansion, and his work on that so far, which included the first functional prototype, on FreeBSD.</li>
<li>Then our friend Calvin Hendryx-Parker presented how he solves all of his backup headaches with ZFS. I provided him some helpful hints to optimize his setup and improve the throughput of his backups</li>
<li>Then Steven Umbehocker of OSNEXUS talked about their products, and how they manage large numbers of ZFS nodes</li>
<li>After a very nice lunch, Orlando Pichardo of Micron talked about the future of flash, and their new 7.5TB SATA SSDs. Discussion of these devices after the talk may lead to enhancements to ZFS to better support these new larger flash devices that use larger logical sector sizes.</li>
<li>Alek Pinchuk of Datto talked about Pool Layout Considerations</li>
<li>then Tony Hutter of LLNL talked about the release process for ZFS on Linux</li>
<li>Then Tom Caputi of Datto presented: Helping Developers Help You, guidance for users submitting bug reports, with some good and bad examples</li>
<li>Then we had a nice cocktail party and dinner, and stayed late into the night talked about ZFS</li>
<li>The next day, Jervin Real of Percona, presented: ZFS and MySQL on Linux, the Sweet Spots. Mostly outlining some benchmark they had done, some of the results were curious and some additional digging may turn up enhancements that can be made to ZFS, or just better tuning advice for high traffic MySQL servers.</li>
<li>Then I presented my ZSTD compression work, which had been referenced in 2 of the previous talks, as people are anxious to get their hands on this code.</li>
<li>Lastly, Eric Sproul of Circonus, gave his talk: Thank You, ZFS. It thanked ZFS and its Community for making their companies product possible, and then provided an update to his presentation from last year, where they were having problems with extremely high levels of ZFS fragmentation. This also sparked a longer conversation after the talk was over.</li>
<li>Then we had a BBQ lunch, and after some more talking, the conference broke up.</li>
</ul>

<p><hr /></p>

<h3><a href="https://www.linuxquestions.org/questions/solaris-opensolaris-20/initial-omnios-impressions-by-a-bsd-user-4175626757/">Initial OmniOS impressions by a BSD user</a></h3>

<blockquote>
  <p>I had been using FreeBSD as my main web server OS since 2012 and I liked it so much that I even contributed money and code to it. However, since the FreeBSD guys (and gals) decided to install anti-tech feminism, I have been considering to move away from it for quite some time now.</p>
  
  <p>As my growing needs require stronger hardware, it was finally time to rent a new server. I do not intend to run FreeBSD on it. Although the most obvious choice would be OpenBSD (I run it on another server and it works just fine), I plan to have a couple of databases running on the new machine, and database throughput has never been one of OpenBSD's strong points. This is my chance to give illumos another try. As neither WiFi nor desktop environments are relevant on a no-X11 server, the server-focused OmniOS seemed to fit my needs.</p>
  
  <p>My current (to be phased out) setup on FreeBSD is:</p>
</blockquote>

<ul>
<li>apache24 with SSL support, running five websites on six domains (both HTTP and HTTPS)</li>
<li>a (somewhat large) Tiny Tiny RSS installation from git, updated via cronjob</li>
<li>sbcl running a daily cronjob of my Web-to-RSS parser</li>
<li>an FTP server where I share stuff with friends</li>
<li>an IRC bouncer</li>
<li>MariaDB and PostgreSQL for some of the hosted services</li>
</ul>

<blockquote>
  <p>I would not consider anything of that too esoteric for a modern operating system. Since I was not really using anything mod_rewrite-related, I was perfectly ready to replace apache24 by nginx, remembering that the prepackaged apache24 on FreeBSD did not support HTTPS out of the box and I had ended up installing it from the ports. That is the only change in my setup which I am actively planning.</p>
  
  <p>So here's what I noticed.</p>
</blockquote>

<ul>
<li>First impressions:</li>
</ul>

<blockquote>
  <p>Hooray, a BSD boot loader! Finally an operating system without grub - I made my experiences with that and I don't want to repeat them too often.</p>
  
  <p>It is weird that the installer won't accept "mydomain.org" as a hostname but sendmail complains that "mydomain" is not a valid hostname right from the start, OmniOS sent me into Maintenance Mode to fix that. A good start, right? So the first completely new thing I had to find out on my new shiny toy was how to change the hostname. There is no /etc/rc.conf in it and hostname mydomain.org was only valid for one login session. I found out that the hostname has to be changed in three different files under /etc on Solaris - the third one did not even exist for me. Changing the other two files seems to have solved this problem for me.</p>
</blockquote>

<ul>
<li>Random findings:</li>
</ul>

<blockquote>
  <p>~ I was wondering how many resources my (mostly idle) new web server was using - I always thought Solaris was rather fat, but it still felt fast to me.</p>
  
  <p>Ah, right - we're in Unixland and we need to think outside of the box. This table was really helpful: although a number of things are different between OmniOS and SmartOS, I found out that the *stat tools do what top does. I could probably just install top from one of the package managers, but I failed to find a reason to do so. I had 99% idle CPU and RAM - that's all I wanted to know.</p>
  
  <p>~ Trying to set up twtxt informed me that Python 3.6 (from pkgin) expects LANG and LC_ALL to be set. Weird - did FreeBSD do that for me? It's been a while ... at least that was easy to fix.</p>
  
  <p>~ SMF - Solaris's version of init - confuses me. It has "levels" similar to Gentoo's OpenRC, but it mostly shuts up during the boot process. Stuff from pkgsrc, e.g. nginx, comes with a description how to set up the particular service, but I should probably read more about it. What if, one day, I install a package which is not made ready for OmniOS? I'll have to find out how to write SMF scripts. But that should not be my highest priority.</p>
  
  <p>~ The OmniOS documentation talks a lot about "zones" which, if I understand that correctly, mostly equal FreeBSD's "jails". This could be my chance to try to respect a better separation between my various services - if my lazyness won't take over again. (It probably will.)</p>
  
  <p>~ OmniOS's default shell - rather un-unixy - seems to be the bash. Update: I was informed about a mistake here: the default shell is ksh93, there are bogus .bashrc files lying around though.</p>
  
  <p>~ Somewhere in between, my sshd had a hiccup or, at least, logging into it took longer than usual. If that happens again, I should investigate.</p>
</blockquote>

<ul>
<li>Conclusion:</li>
</ul>

<blockquote>
  <p>By the time of me writing this, I have a basic web server with an awesome performance and a lot of applications ready to be configured only one click away. The more I play with it, the more I have the feeling that I have missed a lot while wasting my time with FreeBSD. For a system that is said to be "dying", OmniOS feels well-thought and, when equipped with a reasonable package management, comes with everything I need to reproduce my FreeBSD setup without losing functionality.</p>
  
  <p>I'm looking forward to what will happen with it.</p>
</blockquote>

<p><hr /></p>

<p><strong>DigitalOcean</strong>
http://do.co/bsdnow</p>

<h3>[Open Source Hardware Camp 2018 — Sat 30/06 &amp; Sun 01/07, Lincoln, UK</h3>

<p>(includes 'Open-source RISC-V core quickstart' and 'An introductory workshop to NetBSD on embedded platforms')](http://oshug.org/pipermail/oshug/2018-April/000635.html)</p>

<p>```
Hi All,</p>

<p>I'm pleased to announce that we have 10 talks and 7 workshops confirmed
for Open Source Hardware Camp 2018, with the possibility of one or two
more. Registration is now open!</p>

<p>For the first time ever we will be hosting OSHCamp in Lincoln and a huge
thanks to Sarah Markall for helping to make this happen.</p>

<p>As in previous years, there will be a social event on the Saturday
evening and we have a room booked at the Wig and Mitre. Food will be
available.</p>

<p>There will likely be a few of us meeting up for pre-conference drinks on
the Friday evening also.</p>

<p>Details of the programme can be found below and, as ever, we have an
excellent mix of topics being covered.</p>

<p>Cheers,</p>

<p>Andrew
```</p>

<ul>
<li>Open Source Hardware Camp 2018</li>
</ul>

<blockquote>
  <p>On the 30th June 2018, 09:00 Saturday morning - 16:00 on the Sunday
  afternoon at The Blue Room, The Lawn, Union Rd, Lincoln, LN1 3BU.</p>
</blockquote>

<ul>
<li>Registration: http://oshug.org/event/oshcamp2018</li>
<li>Open Source Hardware Camp 2018 will be hosted in the historic county
town of Lincoln — home to, amongst others, noted engine builders Ruston
&amp; Hornsby (now Siemens, via GEC and English Electric).</li>
<li>Lincoln is well served by rail, reachable from Leeds and London within
2-2.5 hours, and 4-5 hours from Edinburgh and Southampton.</li>
<li>There will be a social at the Wig and Mitre on the Saturday evening.</li>
<li>For travel and accommodation information information please see the
event page on oshug.org.</li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://vermaden.wordpress.com/2018/04/04/nextcloud-13-on-freebsd/">Nextcloud 13 on FreeBSD</a></h3>

<blockquote>
  <p>Today I would like to share a setup of Nextcloud 13 running on a FreeBSD system. To make things more interesting it would be running inside a FreeBSD Jail. I will not describe the Nextcloud setup itself here as its large enough for several blog posts.</p>
  
  <p>Official Nextcloud 13 documentation recommends following setup:</p>
</blockquote>

<ul>
<li>MySQL/MariaDB</li>
<li>PHP 7.0 (or newer)</li>
<li>Apache 2.4 (with mod_php)</li>
</ul>

<blockquote>
  <p>I prefer PostgreSQL database to MySQL/MariaDB and I prefer fast and lean Nginx web server to Apache, so my setup is based on these components:</p>
</blockquote>

<ul>
<li>PostgreSQL 10.3</li>
<li>PHP 7.2.4</li>
<li>Nginx 1.12.2 (with php-fpm)</li>
<li>Memcached 1.5.7</li>
</ul>

<blockquote>
  <p>The Memcached subsystem is least important, it can be easily changed into something more modern like Redis for example. I prefer not to use any third party tools for FreeBSD Jails management. Not because they are bad or something like that. There are just many choices for good FreeBSD Jails management and I want to provide a GENERIC example for Nextcloud 13 in a Jail, not for a specific management tool.</p>
</blockquote>

<ul>
<li>Host</li>
</ul>

<blockquote>
  <p>Lets start with preparing the FreeBSD Host with needed settings. We need to allow using raw sockets in Jails. For the future optional upgrades of the Jail we will also allow using chflags(1) in Jails.</p>
</blockquote>

<p><hr /></p>

<h3><a href="https://www.romanzolotarev.com/setup.html">OpenBSD on my fanless desktop computer</a></h3>

<blockquote>
  <p>You asked me about my setup. Here you go.</p>
  
  <p>I’ve been using OpenBSD on servers for years as a web developer, but never had a chance to dive in to system administration before. If you appreciate the simplicity of OpenBSD and you have to give it a try on your desktop.</p>
  
  <p>Bear in mind, this is a relatively cheap ergonomic setup, because all I need is xterm(1) with Vim and Firefox, I don’t care about CPU/GPU performance or mobility too much, but I want a large screen and a good keyboard.</p>
</blockquote>

<p><code>
Item                                    Price, USD
Zotac CI527 NANO-BE                        $371
16GB RAM Crucial DDR4-2133                    $127
250GB SSD Samsung 850 EVO                    $104
Asus VZ249HE 23.8" IPS Full HD                    $129
ErgoDox EZ V3, Cherry MX Brown, blank DCS            $325
Kensington Orbit Trackball                        $33
Total                                    $1,107
</code></p>

<ul>
<li>OpenBSD</li>
</ul>

<blockquote>
  <p>I tried few times to install OpenBSD on my MacBooks—I heard some models are compatible with it,—but in my case it was a bit of a fiasco (thanks to Nvidia and Broadcom). That’s why I bought a new computer, just to be able to run this wonderful operating system.</p>
  
  <p>Now I run -stable on my desktop and servers. Servers are supposed to be reliable, that’s obvious, why not run -current on a desktop? Because -stable is shipped every six months and I that’s is often enough for me. I prefer slow fashion.</p>
</blockquote>

<p><hr /></p>

<p><strong>iXsystems</strong>
iX Ad Spot <a href="https://www.ixsystems.com/blog/nab-2018-recap-2/">NAB 2018 – Michael Dexter’s Recap</a></p>

<h3><a href="https://vermaden.wordpress.com/2018/04/06/introduction-to-hardenedbsd-world/">Introduction to HardenedBSD World</a></h3>

<blockquote>
  <p>HardenedBSD is a security enhanced fork of FreeBSD which happened in 2014. HardenedBSD is implementing many exploit mitigation and security technologies on top of FreeBSD which all started with implementation of Address Space Layout Randomization (ASLR). The fork has been created for ease of development.</p>
  
  <p>To cite the https://hardenedbsd.org/content/about page – “HardenedBSD aims to implement innovative exploit mitigation and security solutions for the FreeBSD community. (…) HardenedBSD takes a holistic approach to security by hardening the system and implementing exploit mitigation technologies.”</p>
  
  <p>Most FreeBSD enthusiasts know mfsBSD project by Martin Matuska – http://mfsbsd.vx.sk/ – FreeBSD system loaded completely into memory. The mfsBSD synonym for the HardenedBSD world is SoloBSD – http://www.solobsd.org/ – which is based on HardenedBSD sources.</p>
  
  <p>One may ask how HardenedBSD project compared to more well know for its security OpenBSD system and it is very important question. The OpenBSD developers try to write ‘good’ code without dirty hacks for performance or other reasons. Clean and secure code is most important in OpenBSD world. The OpenBSD project even made security audit of all OpenBSD code available, line by line. This was easier to achieve in FreeBSD or HardenedBSD because OpenBSD code base its about ten times smaller. This has also other implications, possibilities. While FreeBSD (and HardenedBSD) offer many new features like mature SMP subsystem even with some NUMA support, ZFS filesystem, GEOM storage framework, Bhyve virtualization, Virtualbox option and many other new modern features the OpenBSD remains classic UNIX system with UFS filesystem and with very ‘theoretical’ SMP support. The vmm project tried to implement new hypervisor in OpenBSD world, but because of lack of support for graphics its for OpenBSD, Illumos and Linux currently, You will not virtualize Windows or Mac OS X there. This is also only virtualization option for OpenBSD as there are no Jails on OpenBSD. Current Bhyve implementation allows one even to boot latest Windows 2019 Technology Preview.</p>
  
  <p>A HardenedBSD project is FreeBSD system code base with LOTS of security mechanisms and mitigations that are not available on FreeBSD system. For example entire lib32 tree has been disabled by default on HardenedBSD to make it more secure. Also LibreSSL is the default SSL library on HardenedBSD, same as OpenBSD while FreeBSD uses OpenSSL for compatibility reasons.</p>
  
  <p>Comparison between LibreSSL and OpenSSL vulnerabilities.</p>
</blockquote>

<ul>
<li>https://en.wikipedia.org/wiki/LibreSSL#Security</li>
<li>https://wiki.freebsd.org/LibreSSL#LibreSSL<em>.28and</em>OpenSSL.29<em>Security</em>Vulnerabilities</li>
</ul>

<blockquote>
  <p>One may see HardenedBSD as FreeBSD being successfully pulled up to the OpenBSD level (at least that is the goal), but as FreeBSD has tons more code and features it will be harder and longer process to achieve the goal.</p>
  
  <p>As I do not have that much competence on the security field I will just repost the comparison from the HardenedBSD project versus other BSD systems. The comparison is also available here – https://hardenedbsd.org/content/easy-feature-comparison – on the HardenedBSD website.</p>
</blockquote>

<p><hr /></p>

<h3><a href="https://www.tomatkinson.uk/git.html">Running my own git server</a></h3>

<blockquote>
  <p>Note: This article is predominantly based on work by Hiltjo Posthuma who you should read because I would have spent far too much time failing to set things up if it wasn’t for their post. Not only have they written lots of very interesting posts, they write some really brilliant programs</p>
  
  <p>Since I started university 3 years ago, I started using lots of services from lots of different companies. The “cloud” trend led me to believe that I wanted other people to look after my data for me. I was wrong. Since finding myself loving the ethos of OpenBSD, I found myself wanting to apply this ethos to the services I use as well. Not only is it important to me because of the security benefits, but also because I like the minimalist style OpenBSD portrays. This is the first in a mini-series documenting my move from bloated, hosted, sometimes proprietary services to minimal, well-written, free, self-hosted services.</p>
</blockquote>

<ul>
<li>Tools &amp; applications</li>
</ul>

<blockquote>
  <p>These are the programs I am going to be using to get my git server up and running:</p>
</blockquote>

<p><code>
httpd(8)
acme-client(1)
git(1)
cgit(1)
slowcgi(8)
</code></p>

<ul>
<li>Setting up httpd</li>
</ul>

<blockquote>
  <p>Ensure you have the necessary flags enabled in your /etc/rc.conf.local:</p>
</blockquote>

<ul>
<li>Configuring cgit</li>
</ul>

<blockquote>
  <p>When using the OpenBSD httpd(8), it will serve it’s content in a chrooted environment,which defaults to the home directory of the user it runs as, which is www in this case. This means that the chroot is limited to the directory /var/www and it’s contents.</p>
  
  <p>In order to configure cgit, there must be a cgitrc file available to cgit. This is found at the location stored in $CGIT_CONFIG, which defaults to /conf/cgitrc. Because of the chroot, this file is actually stored at /var/www/conf/cgitrc.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blather.michaelwlucas.com/archives/3173">My Penguicon 2018 Schedule</a></li>
<li><a href="https://rachelbythebay.com/w/2018/04/16/signal/">sigaction: see who killed you (and more)</a></li>
<li><a href="http://mail-index.netbsd.org/netbsd-announce/2018/04/20/msg000284.html">Takeshi steps down from NetBSD core team after 13 years</a></li>
<li><a href="https://www.phoronix.com/scan.php?page=news_item&amp;px=DragonFlyBSD-More-Perf-For-5.4">DragonFlyBSD Kernel Gets Some SMP Improvements – Phoronix</a></li>
<li><a href="https://m.youtube.com/watch?v=bT_k06Xg-BE">Writing FreeBSD Malware</a></li>
</ul>

<p><strong>Tarsnap ad</strong></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Troels - <a href="http://dpaste.com/35K0BD7#wrap">Question regarding ZFS xattr</a></li>
<li>Mike - <a href="http://dpaste.com/33X1K80#wrap">Sharing your screen</a></li>
<li>Wilyarti - <a href="http://dpaste.com/0D452Q0#wrap">Adlocking on FreeBSD</a></li>
<li>Brad - <a href="http://dpaste.com/08XAHNY#wrap">Recommendations for snapshot strategy</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 243: Understanding The Scheduler | BSD Now 243</title>
  <link>https://www.bsdnow.tv/243</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-1826</guid>
  <pubDate>Wed, 25 Apr 2018 16:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/bc8d0c60-eef3-488f-9d07-65122019420b.mp3" length="61676635" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 6.3 and DragonflyBSD 5.2 are released, bug fix for disappearing files in OpenZFS on Linux (and only Linux), understanding the FreeBSD CPU scheduler, NetBSD on RPI3, thoughts on being a committer for 20 years, and 5 reasons to use FreeBSD in 2018.</itunes:subtitle>
  <itunes:duration>1:25:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 6.3 and DragonflyBSD 5.2 are released, bug fix for disappearing files in OpenZFS on Linux (and only Linux), understanding the FreeBSD CPU scheduler, NetBSD on RPI3, thoughts on being a committer for 20 years, and 5 reasons to use FreeBSD in 2018.
&lt;h2&gt;Headlines&lt;/h2&gt;
&lt;h3&gt;&lt;a href="https://www.openbsd.org/63.html"&gt;OpenBSD 6.3 released&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;Punctual as ever, OpenBSD 6.3 has been releases with the following features/changes:


&lt;blockquote&gt;
  Improved HW support, including:
  SMP support on OpenBSD/arm64 platforms
  vmm/vmd improvements:
  IEEE 802.11 wireless stack improvements
  Generic network stack improvements
  Installer improvements
  Routing daemons and other userland network improvements
  Security improvements
  dhclient(8) improvements
  Assorted improvements
  OpenSMTPD 6.0.4
  OpenSSH 7.7
  LibreSSL 2.7.2&lt;/blockquote&gt;
&lt;/li&gt;
  &lt;/ul&gt;
  &lt;hr&gt;


&lt;h3&gt;&lt;a href="https://www.dragonflybsd.org/release52/"&gt;DragonFlyBSD 5.2 released&lt;/a&gt;&lt;/h3&gt;



&lt;blockquote&gt;
  &lt;p&gt;Big-ticket items
  Meltdown and Spectre mitigation support
  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectre&lt;em&gt;mitigation and machdep.meltdown&lt;/em&gt;mitigation.
  HAMMER2
  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.
  Clustered support is not yet available.
  ipfw Updates
  Implement state based "redirect", i.e. without using libalias.
  ipfw now supports all possible ICMP types.
  Fix ICMP&lt;em&gt;MAXTYPE assumptions (now 40 as of this release).
  Improved graphics support
  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs
  Add 24-bit pixel format support to the EFI frame buffer code.
  Significantly improve fbio support for the "scfb" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.
  Partly implement the FBIO&lt;/em&gt;BLANK ioctl for display powersaving.
  Syscons waits for drm modesetting at appropriate places, avoiding races.
  + For more details, check out the “All changes since DragonFly 5.0” section.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;






&lt;h3&gt;&lt;a href="https://github.com/zfsonlinux/zfs/issues/7401"&gt;ZFS on Linux bug causes files to disappear&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;A bug in ZoL 0.7.7 caused 0.7.8 to be released just 3 days after the release&lt;/li&gt;
&lt;li&gt;The bug only impacts Linux, the change that caused the problem was not upstreamed yet, so does not impact ZFS on illumos, FreeBSD, OS X, or Windows&lt;/li&gt;
&lt;li&gt;The bug can cause files being copied into a directory to not be properly linked to the directory, so they will no longer be listed in the contents of the directory&lt;/li&gt;
&lt;li&gt;ZoL developers are working on a tool to allow you to recover the data, since no data was actually lost, the files were just not properly registered as part of the directory&lt;/li&gt;
&lt;li&gt;The bug was introduced in a commit made in February, that attempted to improve performance of datasets created with the case insensitivity option. In an effort to improve performance, they introduced a limit to cap to give up (return ENOSPC) if growing the directory ZAP failed twice.&lt;/li&gt;
&lt;li&gt;The ZAP is the key-value pair data structure that contains metadata for a directory, including a hash table of the files that are in a directory. When a directory has a large number of files, the ZAP is converted to a FatZAP, and additional space may need to be allocated as additional files are added.


&lt;blockquote&gt;
  Commit cc63068 caused ENOSPC error when copy a large amount of files between two directories. The reason is that the patch limits zap leaf expansion to 2 retries, and return ENOSPC when failed.&lt;/blockquote&gt;
&lt;/li&gt;
  &lt;li&gt;Finding the root cause of this issue was somewhat hampered by the fact that many people were not able to reproduce the issue. It turns out this was caused by an entirely unrelated change to GNU coreutils.&lt;/li&gt;
  &lt;li&gt;On later versions of GNU Coreutils, the files were returned in a sorted order, resulting in them hitting different buckets in the hash table, and not tripping the retry limit&lt;/li&gt;
  &lt;li&gt;Tools like rsync were unaffected, because they always sort the files before copying&lt;/li&gt;
  &lt;li&gt;If you did not see any ENOSPC errors, you were likely not impacted
  The intent for limiting retries is to prevent pointlessly growing table to max size when adding a block full of entries with same name in different case in mixed mode. However, it turns out we cannot use any limit on the retry. When we copy files from one directory in readdir order, we are copying in hash order, one leaf block at a time. Which means that if the leaf block in source directory has expanded 6 times, and you copy those entries in that block, by the time you need to expand the leaf in destination directory, you need to expand it 6 times in one go. So any limit on the retry will result in error where it shouldn't.&lt;/li&gt;
  &lt;li&gt;Recommendations for Users from Ryan Yao:
  The regression makes it so that creating a new file could fail with ENOSPC after which files created in that directory could become orphaned. Existing files seem okay, but I have yet to confirm that myself and I cannot speak for what others know. It is incredibly difficult to reproduce on systems running coreutils 8.23 or later. So far, reports have only come from people using coreutils 8.22 or older. The directory size actually gets incremented for each orphaned file, which makes it wrong after orphan files happen.
  We will likely have some way to recover the orphaned files (like ext4’s lost+found) and fix the directory sizes in the very near future. Snapshots of the damaged datasets are problematic though. Until we have a subcommand to fix it (not including the snapshots, which we would have to list), the damage can be removed from a system that has it either by rolling back to a snapshot before it happened or creating a new dataset with 0.7.6 (or another release other than 0.7.7), moving everything to the new dataset and destroying the old. That will restore things to pristine condition.
  It should also be possible to check for pools that are affected, but I have yet to finish my analysis to be certain that no false negatives occur when checking, so I will avoid saying how for now.&lt;/li&gt;
  &lt;li&gt;Writes to existing files cannot trigger this bug, only adding new files to a directory in bulk&lt;/li&gt;
  &lt;/ul&gt;
  &lt;hr&gt;


&lt;h2&gt;News Roundup&lt;/h2&gt;



&lt;h3&gt;&lt;a href="https://blog.des.no/2018/04/twenty-years/"&gt;des@’s thoughts on being a FreeBSD committer for 20 years&lt;/a&gt;&lt;/h3&gt;



&lt;blockquote&gt;
  &lt;p&gt;Yesterday was the twentieth anniversary of my FreeBSD commit bit, and tomorrow will be the twentieth anniversary of my first commit. I figured I’d split the difference and write a few words about it today.&lt;/p&gt;
  
  &lt;p&gt;My level of engagement with the FreeBSD project has varied greatly over the twenty years I’ve been a committer. There have been times when I worked on it full-time, and times when I did not touch it for months. The last few years, health issues and life events have consumed my time and sapped my energy, and my contributions have come in bursts. Commit statistics do not tell the whole story, though: even when not working on FreeBSD directly, I have worked on side projects which, like OpenPAM, may one day find their way into FreeBSD.&lt;/p&gt;
  
  &lt;p&gt;My contributions have not been limited to code. I was the project’s first Bugmeister; I’ve served on the Security Team for a long time, and have been both Security Officer and Deputy Security Officer; I managed the last four Core Team elections and am doing so again this year.&lt;/p&gt;
  
  &lt;p&gt;In return, the project has taught me much about programming and software engineering. It taught me code hygiene and the importance of clarity over cleverness; it taught me the ins and outs of revision control; it taught me the importance of good documentation, and how to write it; and it taught me good release engineering practices.&lt;/p&gt;
  
  &lt;p&gt;Last but not least, it has provided me with the opportunity to work with some of the best people in the field. I have the privilege today to count several of them among my friends.&lt;/p&gt;
  
  &lt;p&gt;For better or worse, the FreeBSD project has shaped my career and my life. It set me on the path to information security in general and IAA in particular, and opened many a door for me. I would not be where I am now without it.&lt;/p&gt;
  
  &lt;p&gt;I won’t pretend to be able to tell the future. I don’t know how long I will remain active in the FreeBSD project and community. It could be another twenty years; or it could be ten, or five, or less. All I know is that FreeBSD and I still have things to teach each other, and I don’t intend to call it quits any time soon.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;






&lt;h3&gt;&lt;a href="https://www.ixsystems.com/blog/truenas-m-series/?utm_source=twitter.com&amp;amp;utm_medium=bsdnow&amp;amp;utm_campaign=truenas+m+series"&gt;iXsystems unveils new TrueNAS M-Series Unified Storage Line&lt;/a&gt;&lt;/h3&gt;



&lt;blockquote&gt;
  &lt;p&gt;San Jose, Calif., April 10, 2018 — iXsystems, the leader in Enterprise Open Source servers and software-defined storage, announced the TrueNAS M40 and M50 as the newest high-performance models in its hybrid, unified storage product line. The TrueNAS M-Series harnesses NVMe and NVDIMM to bring all-flash array performance to the award-winning TrueNAS hybrid arrays. It also includes the Intel® Xeon® Scalable Family of Processors and supports up to 100GbE and 32Gb Fibre Channel networking. Sitting between the all-flash TrueNAS Z50 and the hybrid TrueNAS X-Series in the product line, the TrueNAS M-Series delivers up to 10 Petabytes of highly-available and flash-powered network attached storage and rounds out a comprehensive product set that has a capacity and performance option for every storage budget.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Designed for On-Premises &amp;amp; Enterprise Cloud Environments&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;As a unified file, block, and object sharing solution, TrueNAS can meet the needs of file serving, backup, virtualization, media production, and private cloud users thanks to its support for the SMB, NFS, AFP, iSCSI, Fibre Channel, and S3 protocols.&lt;/p&gt;
  
  &lt;p&gt;At the heart of the TrueNAS M-Series is a custom 4U, dual-controller head unit that supports up to 24 3.5” drives and comes in two models, the M40 and M50, for maximum flexibility and scalability. The TrueNAS M40 uses NVDIMMs for write cache, SSDs for read cache, and up to two external 60-bay expansion shelves that unlock up to 2PB in capacity. The TrueNAS M50 uses NVDIMMs for write caching, NVMe drives for read caching, and up to twelve external 60-bay expansion shelves to scale upwards of 10PB. The dual-controller design provides high-availability failover and non-disruptive upgrades for mission-critical enterprise environments.&lt;/p&gt;
  
  &lt;p&gt;By design, the TrueNAS M-Series unleashes cutting-edge persistent memory technology for demanding performance and capacity workloads, enabling businesses to accelerate enterprise applications and deploy enterprise private clouds that are twice the capacity of previous TrueNAS models. It also supports replication to the Amazon S3, BackBlaze B2, Google Cloud, and Microsoft Azure cloud platforms and can deliver an object store using the ubiquitous S3 object storage protocol at a fraction of the cost of the public cloud.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Fast&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;As a true enterprise storage platform, the TrueNAS M50 supports very demanding performance workloads with up to four active 100GbE ports, 3TB of RAM, 32GB of NVDIMM write cache and up to 15TB of NVMe flash read cache. The TrueNAS M40 and M50 include up to 24/7 and global next-business-day support, putting IT at ease. The modular and tool-less design of the M-Series allows for easy, non-disruptive servicing and upgrading by end-users and support technicians for guaranteed uptime. TrueNAS has US-Based support provided by the engineering team that developed it, offering the rapid response that every enterprise needs.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Award-Winning TrueNAS Features&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Enterprise: Perfectly suited for private clouds and enterprise workloads such as file sharing, backups, M&amp;amp;E, surveillance, and hosting virtual machines.&lt;/li&gt;
&lt;li&gt;Unified: Utilizes SMB, AFP, NFS for file storage, iSCSI, Fibre Channel and OpenStack Cinder for block storage, and S3-compatible APIs for object storage. Supports every common operating system, hypervisor, and application.&lt;/li&gt;
&lt;li&gt;Economical: Deploy an enterprise private cloud and reduce storage TCO by 70% over AWS with built-in enterprise-class features such as in-line compression, deduplication, clones, and thin-provisioning.&lt;/li&gt;
&lt;li&gt;Safe: The OpenZFS file system ensures data integrity with best-in-class replication and snapshotting. Customers can replicate data to the rest of the iXsystems storage lineup and to the public cloud.&lt;/li&gt;
&lt;li&gt;Reliable: High Availability option with dual hot-swappable controllers for continuous data availability and 99.999% uptime.&lt;/li&gt;
&lt;li&gt;Familiar: Provision and manage storage with the same simple and powerful WebUI and REST APIs used in all iXsystems storage products, as well as iXsystems’ FreeNAS Software.&lt;/li&gt;
&lt;li&gt;Certified: TrueNAS has passed the Citrix Ready, VMware Ready, and Veeam Ready certifications, reducing the risk of deploying a virtualized infrastructure.&lt;/li&gt;
&lt;li&gt;Open: By using industry-standard sharing protocols, the OpenZFS Open Source enterprise file system and FreeNAS, the world’s #1 Open Source storage operating system (and also engineered by iXsystems), TrueNAS is the most open enterprise storage solution on the market.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;&lt;p&gt;Availability&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;The TrueNAS M40 and M50 will be generally available in April 2018 through the iXsystems global channel partner network. The TrueNAS M-Series starts at under $20,000 USD and can be easily expanded using a linear “per terabyte” pricing model. With typical compression, a Petabtye can be stored for under $100,000 USD. TrueNAS comes with an all-inclusive software suite that provides NFS, Windows SMB, iSCSI, snapshots, clones and replication.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;For more information, visit www.ixsystems.com/TrueNAS &lt;/li&gt;
&lt;li&gt;&lt;a href="TrueNAS%20M-Series%20What's%20New"&gt;TrueNAS M-Series What's New Video&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-stable/2018-April/088678.html"&gt;Understanding and tuning the FreeBSD Scheduler &lt;/a&gt;&lt;/h3&gt;

&lt;p&gt;```
Occasionally I noticed that the system would not quickly process the
tasks i need done, but instead prefer other, longrunning tasks. I
figured it must be related to the scheduler, and decided it hates me.&lt;/p&gt;

&lt;p&gt;A closer look shows the behaviour as follows (single CPU):&lt;/p&gt;

&lt;p&gt;Lets run an I/O-active task, e.g, postgres VACUUM that would
continuously read from big files (while doing compute as well [1]):&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;pool        alloc   free   read  write   read  write
  cache           -      -      -      -      -      -
   ada1s4    7.08G  10.9G  1.58K      0  12.9M      0&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Now start an endless loop:&lt;/p&gt;

&lt;h1&gt;while true; do :; done&lt;/h1&gt;

&lt;p&gt;And the effect is:&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;pool        alloc   free   read  write   read  write
  cache           -      -      -      -      -      -
   ada1s4    7.08G  10.9G      9      0  76.8K      0&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;The VACUUM gets almost stuck! This figures with WCPU in "top":&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND
  85583 root        99    0  7044K  1944K RUN      1:06  92.21% bash
  53005 pgsql       52    0   620M 91856K RUN      5:47   0.50% postgres&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Hacking on kern.sched.quantum makes it quite a bit better:&lt;/p&gt;

&lt;h1&gt;sysctl kern.sched.quantum=1&lt;/h1&gt;

&lt;p&gt;kern.sched.quantum: 94488 -&amp;gt; 7874&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;pool        alloc   free   read  write   read  write
  cache           -      -      -      -      -      -
   ada1s4    7.08G  10.9G    395      0  3.12M      0&lt;/p&gt;
  
  &lt;p&gt;PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND
  85583 root        94    0  7044K  1944K RUN      4:13  70.80% bash
  53005 pgsql       52    0   276M 91856K RUN      5:52  11.83% postgres&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Now, as usual, the "root-cause" questions arise: What exactly does
this "quantum"? Is this solution a workaround, i.e. actually something
else is wrong, and has it tradeoff in other situations? Or otherwise,
why is such a default value chosen, which appears to be ill-deceived?&lt;/p&gt;

&lt;p&gt;The docs for the quantum parameter are a bit unsatisfying - they say
its the max num of ticks a process gets - and what happens when
they're exhausted? If by default the endless loop is actually allowed
to continue running for 94k ticks (or 94ms, more likely) uninterrupted,
then that explains the perceived behaviour - buts thats certainly not
what a scheduler should do when other procs are ready to run.&lt;/p&gt;

&lt;p&gt;11.1-RELEASE-p7, kern.hz=200. Switching tickless mode on or off does
not influence the matter. Starting the endless loop with "nice" does
not influence the matter.&lt;/p&gt;

&lt;p&gt;[1]
A pure-I/O job without compute load, like "dd", does not show
this behaviour. Also, when other tasks are running, the unjust
behaviour is not so stongly pronounced.
```&lt;/p&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://mail-index.netbsd.org/port-arm/2018/04/01/msg004702.html"&gt;aarch64 support added&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I have committed about adding initial support for aarch64.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;booting log on RaspberryPI3:&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;```
    boot NetBSD/evbarm (aarch64)
    Drop to EL1...OK
    Creating VA=PA tables
    Creating KSEG tables
    Creating KVA=PA tables
    Creating devmap tables
    MMU Enable...OK
    VSTART          = ffffffc000001ff4
    FDT&amp;lt;3ab46000&amp;gt; devmap cpufunc bootstrap consinit ok
    uboot: args 0x3ab46000, 0, 0, 0&lt;/p&gt;

&lt;pre&gt;&lt;code&gt;NetBSD/evbarm (fdt) booting ...
FDT /memory [0] @ 0x0 size 0x3b000000
MEM: add 0-3b000000
MEM: res 0-1000
MEM: res 3ab46000-3ab4a000
Usable memory:
  1000 - 3ab45fff
  3ab4a000 - 3affffff
initarm: kernel phys start 1000000 end 17bd000
MEM: res 1000000-17bd000
bootargs: root=axe0
  1000 - ffffff
  17bd000 - 3ab45fff
  3ab4a000 - 3affffff
------------------------------------------
kern_vtopdiff         = 0xffffffbfff000000
physical_start        = 0x0000000000001000
kernel_start_phys     = 0x0000000001000000
kernel_end_phys       = 0x00000000017bd000
physical_end          = 0x000000003ab45000
VM_MIN_KERNEL_ADDRESS = 0xffffffc000000000
kernel_start_l2       = 0xffffffc000000000
kernel_start          = 0xffffffc000000000
kernel_end            = 0xffffffc0007bd000
kernel_end_l2         = 0xffffffc000800000
(kernel va area)
(devmap va area)
VM_MAX_KERNEL_ADDRESS = 0xffffffffffe00000
------------------------------------------
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,
    2018 The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018
        ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64
total memory = 936 MB
avail memory = 877 MB
&lt;/code&gt;&lt;/pre&gt;

&lt;p&gt;…&lt;/p&gt;

&lt;pre&gt;&lt;code&gt;Starting local daemons:.
Updating motd.
Starting sshd.
Starting inetd.
Starting cron.
The following components reported failures:
    /etc/rc.d/swap2
See /var/run/rc.log for more information.
Fri Mar 30 12:35:31 JST 2018

NetBSD/evbarm (rpi3) (console)

login: root
Last login: Fri Mar 30 12:30:24 2018 on console

rpi3# uname -ap
NetBSD rpi3 8.99.14 NetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018  ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64 evbarm aarch64
rpi3#
&lt;/code&gt;&lt;/pre&gt;

&lt;p&gt;```&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;Now, multiuser mode works stably on fdt based boards (RPI3,SUNXI,TEGRA). But there are still some problems, more time is required for release. also SMP is not yet. See sys/arch/aarch64/aarch64/TODO for more detail. Especially the problems around TLS of rtld, and C++ stack unwindings are too difficult for me to solve, I give up and need someone's help (^o^)/ Since C++ doesn't work, ATF also doesn't work. If the ATF works, it will clarify more issues.&lt;/p&gt;
  
  &lt;p&gt;sys/arch/evbarm64 is gone and integrated into sys/arch/evbarm. One evbarm/conf/GENERIC64 kernel binary supports all fdt (bcm2837,sunxi,tegra) based boards. While on 32bit, sys/arch/evbarm/conf/GENERIC will support all fdt based boards...but doesn't work yet. (WIP)&lt;/p&gt;
  
  &lt;p&gt;My deepest appreciation goes to Tohru Nishimura (nisimura@) whose writes vector handlers, context switchings, and so on. and his comments and suggestions were innumerably valuable. I would also like to thank Nick Hudson (skrll@) and Jared McNeill (jmcneill@) whose added support FDT and integrated into evbarm. Finally, I would like to thank Matt Thomas (matt@) whose commited aarch64
  toolchains and preliminary support for aarch64.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/watch?v=hvuWI5hzD5U"&gt;5 Reasons to Use FreeBSD in 2018&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/johalun/status/983645780509712384"&gt;Rewriting Intel gigabit network driver in Rust&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/DLangille/status/983360090240684034"&gt;Recruiting to make Elastic Search on FreeBSD better&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/Tubsta/status/981058685219688448"&gt;Windows Server 2019 Preview, in bhyve on FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://blather.michaelwlucas.com/archives/3126"&gt;“SSH Mastery, 2nd ed” in hardcover&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Jason - &lt;a href="http://dpaste.com/0JN4V1K#wrap"&gt;ZFS Transfer option&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Luis - &lt;a href="http://dpaste.com/3MH4QRF#wrap"&gt;ZFS Pools&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;&lt;a href="https://clonos.tekroutine.com/"&gt;ClonOS &lt;/a&gt;&lt;/li&gt;
&lt;li&gt;Michael - &lt;a href="http://dpaste.com/3MN5F74#wrap"&gt;Tech Conferences&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;anonymous - &lt;a href="http://dpaste.com/18J24QJ#wrap"&gt;BSD trash on removable drives&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt; 
</description>
  <itunes:keywords>BSD,DragonflyBSD,freebsd,guide,howto,Interview,NetBSD,OpenBSD,trueos,tutorial</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 6.3 and DragonflyBSD 5.2 are released, bug fix for disappearing files in OpenZFS on Linux (and only Linux), understanding the FreeBSD CPU scheduler, NetBSD on RPI3, thoughts on being a committer for 20 years, and 5 reasons to use FreeBSD in 2018.</p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/63.html">OpenBSD 6.3 released</a></h3>

<ul>
<li>Punctual as ever, OpenBSD 6.3 has been releases with the following features/changes:


<blockquote>
  Improved HW support, including:
  SMP support on OpenBSD/arm64 platforms
  vmm/vmd improvements:
  IEEE 802.11 wireless stack improvements
  Generic network stack improvements
  Installer improvements
  Routing daemons and other userland network improvements
  Security improvements
  dhclient(8) improvements
  Assorted improvements
  OpenSMTPD 6.0.4
  OpenSSH 7.7
  LibreSSL 2.7.2</li>
  </ul>
  <hr />
</blockquote>

<h3><a href="https://www.dragonflybsd.org/release52/">DragonFlyBSD 5.2 released</a></h3>



<blockquote>
  <p>Big-ticket items
  Meltdown and Spectre mitigation support
  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectre<em>mitigation and machdep.meltdown</em>mitigation.
  HAMMER2
  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.
  Clustered support is not yet available.
  ipfw Updates
  Implement state based "redirect", i.e. without using libalias.
  ipfw now supports all possible ICMP types.
  Fix ICMP<em>MAXTYPE assumptions (now 40 as of this release).
  Improved graphics support
  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs
  Add 24-bit pixel format support to the EFI frame buffer code.
  Significantly improve fbio support for the "scfb" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.
  Partly implement the FBIO</em>BLANK ioctl for display powersaving.
  Syscons waits for drm modesetting at appropriate places, avoiding races.
  + For more details, check out the “All changes since DragonFly 5.0” section.</p>
</blockquote>

<hr />






<h3><a href="https://github.com/zfsonlinux/zfs/issues/7401">ZFS on Linux bug causes files to disappear</a></h3>

<ul>
<li>A bug in ZoL 0.7.7 caused 0.7.8 to be released just 3 days after the release</li>
<li>The bug only impacts Linux, the change that caused the problem was not upstreamed yet, so does not impact ZFS on illumos, FreeBSD, OS X, or Windows</li>
<li>The bug can cause files being copied into a directory to not be properly linked to the directory, so they will no longer be listed in the contents of the directory</li>
<li>ZoL developers are working on a tool to allow you to recover the data, since no data was actually lost, the files were just not properly registered as part of the directory</li>
<li>The bug was introduced in a commit made in February, that attempted to improve performance of datasets created with the case insensitivity option. In an effort to improve performance, they introduced a limit to cap to give up (return ENOSPC) if growing the directory ZAP failed twice.</li>
<li>The ZAP is the key-value pair data structure that contains metadata for a directory, including a hash table of the files that are in a directory. When a directory has a large number of files, the ZAP is converted to a FatZAP, and additional space may need to be allocated as additional files are added.


<blockquote>
  Commit cc63068 caused ENOSPC error when copy a large amount of files between two directories. The reason is that the patch limits zap leaf expansion to 2 retries, and return ENOSPC when failed.</li>
  <li>Finding the root cause of this issue was somewhat hampered by the fact that many people were not able to reproduce the issue. It turns out this was caused by an entirely unrelated change to GNU coreutils.</li>
  <li>On later versions of GNU Coreutils, the files were returned in a sorted order, resulting in them hitting different buckets in the hash table, and not tripping the retry limit</li>
  <li>Tools like rsync were unaffected, because they always sort the files before copying</li>
  <li>If you did not see any ENOSPC errors, you were likely not impacted
  The intent for limiting retries is to prevent pointlessly growing table to max size when adding a block full of entries with same name in different case in mixed mode. However, it turns out we cannot use any limit on the retry. When we copy files from one directory in readdir order, we are copying in hash order, one leaf block at a time. Which means that if the leaf block in source directory has expanded 6 times, and you copy those entries in that block, by the time you need to expand the leaf in destination directory, you need to expand it 6 times in one go. So any limit on the retry will result in error where it shouldn't.</li>
  <li>Recommendations for Users from Ryan Yao:
  The regression makes it so that creating a new file could fail with ENOSPC after which files created in that directory could become orphaned. Existing files seem okay, but I have yet to confirm that myself and I cannot speak for what others know. It is incredibly difficult to reproduce on systems running coreutils 8.23 or later. So far, reports have only come from people using coreutils 8.22 or older. The directory size actually gets incremented for each orphaned file, which makes it wrong after orphan files happen.
  We will likely have some way to recover the orphaned files (like ext4’s lost+found) and fix the directory sizes in the very near future. Snapshots of the damaged datasets are problematic though. Until we have a subcommand to fix it (not including the snapshots, which we would have to list), the damage can be removed from a system that has it either by rolling back to a snapshot before it happened or creating a new dataset with 0.7.6 (or another release other than 0.7.7), moving everything to the new dataset and destroying the old. That will restore things to pristine condition.
  It should also be possible to check for pools that are affected, but I have yet to finish my analysis to be certain that no false negatives occur when checking, so I will avoid saying how for now.</li>
  <li>Writes to existing files cannot trigger this bug, only adding new files to a directory in bulk</li>
  </ul>
  <hr />
</blockquote>

<h2>News Roundup</h2>



<h3><a href="https://blog.des.no/2018/04/twenty-years/">des@’s thoughts on being a FreeBSD committer for 20 years</a></h3>



<blockquote>
  <p>Yesterday was the twentieth anniversary of my FreeBSD commit bit, and tomorrow will be the twentieth anniversary of my first commit. I figured I’d split the difference and write a few words about it today.</p>
  
  <p>My level of engagement with the FreeBSD project has varied greatly over the twenty years I’ve been a committer. There have been times when I worked on it full-time, and times when I did not touch it for months. The last few years, health issues and life events have consumed my time and sapped my energy, and my contributions have come in bursts. Commit statistics do not tell the whole story, though: even when not working on FreeBSD directly, I have worked on side projects which, like OpenPAM, may one day find their way into FreeBSD.</p>
  
  <p>My contributions have not been limited to code. I was the project’s first Bugmeister; I’ve served on the Security Team for a long time, and have been both Security Officer and Deputy Security Officer; I managed the last four Core Team elections and am doing so again this year.</p>
  
  <p>In return, the project has taught me much about programming and software engineering. It taught me code hygiene and the importance of clarity over cleverness; it taught me the ins and outs of revision control; it taught me the importance of good documentation, and how to write it; and it taught me good release engineering practices.</p>
  
  <p>Last but not least, it has provided me with the opportunity to work with some of the best people in the field. I have the privilege today to count several of them among my friends.</p>
  
  <p>For better or worse, the FreeBSD project has shaped my career and my life. It set me on the path to information security in general and IAA in particular, and opened many a door for me. I would not be where I am now without it.</p>
  
  <p>I won’t pretend to be able to tell the future. I don’t know how long I will remain active in the FreeBSD project and community. It could be another twenty years; or it could be ten, or five, or less. All I know is that FreeBSD and I still have things to teach each other, and I don’t intend to call it quits any time soon.</p>
</blockquote>

<hr />






<h3><a href="https://www.ixsystems.com/blog/truenas-m-series/?utm_source=twitter.com&amp;utm_medium=bsdnow&amp;utm_campaign=truenas+m+series">iXsystems unveils new TrueNAS M-Series Unified Storage Line</a></h3>



<blockquote>
  <p>San Jose, Calif., April 10, 2018 — iXsystems, the leader in Enterprise Open Source servers and software-defined storage, announced the TrueNAS M40 and M50 as the newest high-performance models in its hybrid, unified storage product line. The TrueNAS M-Series harnesses NVMe and NVDIMM to bring all-flash array performance to the award-winning TrueNAS hybrid arrays. It also includes the Intel® Xeon® Scalable Family of Processors and supports up to 100GbE and 32Gb Fibre Channel networking. Sitting between the all-flash TrueNAS Z50 and the hybrid TrueNAS X-Series in the product line, the TrueNAS M-Series delivers up to 10 Petabytes of highly-available and flash-powered network attached storage and rounds out a comprehensive product set that has a capacity and performance option for every storage budget.</p>
</blockquote>

<ul>
<li>Designed for On-Premises &amp; Enterprise Cloud Environments</li>
</ul>

<blockquote>
  <p>As a unified file, block, and object sharing solution, TrueNAS can meet the needs of file serving, backup, virtualization, media production, and private cloud users thanks to its support for the SMB, NFS, AFP, iSCSI, Fibre Channel, and S3 protocols.</p>
  
  <p>At the heart of the TrueNAS M-Series is a custom 4U, dual-controller head unit that supports up to 24 3.5” drives and comes in two models, the M40 and M50, for maximum flexibility and scalability. The TrueNAS M40 uses NVDIMMs for write cache, SSDs for read cache, and up to two external 60-bay expansion shelves that unlock up to 2PB in capacity. The TrueNAS M50 uses NVDIMMs for write caching, NVMe drives for read caching, and up to twelve external 60-bay expansion shelves to scale upwards of 10PB. The dual-controller design provides high-availability failover and non-disruptive upgrades for mission-critical enterprise environments.</p>
  
  <p>By design, the TrueNAS M-Series unleashes cutting-edge persistent memory technology for demanding performance and capacity workloads, enabling businesses to accelerate enterprise applications and deploy enterprise private clouds that are twice the capacity of previous TrueNAS models. It also supports replication to the Amazon S3, BackBlaze B2, Google Cloud, and Microsoft Azure cloud platforms and can deliver an object store using the ubiquitous S3 object storage protocol at a fraction of the cost of the public cloud.</p>
</blockquote>

<ul>
<li>Fast</li>
</ul>

<blockquote>
  <p>As a true enterprise storage platform, the TrueNAS M50 supports very demanding performance workloads with up to four active 100GbE ports, 3TB of RAM, 32GB of NVDIMM write cache and up to 15TB of NVMe flash read cache. The TrueNAS M40 and M50 include up to 24/7 and global next-business-day support, putting IT at ease. The modular and tool-less design of the M-Series allows for easy, non-disruptive servicing and upgrading by end-users and support technicians for guaranteed uptime. TrueNAS has US-Based support provided by the engineering team that developed it, offering the rapid response that every enterprise needs.</p>
</blockquote>

<ul>
<li><p>Award-Winning TrueNAS Features</p>

<ul><li>Enterprise: Perfectly suited for private clouds and enterprise workloads such as file sharing, backups, M&amp;E, surveillance, and hosting virtual machines.</li>
<li>Unified: Utilizes SMB, AFP, NFS for file storage, iSCSI, Fibre Channel and OpenStack Cinder for block storage, and S3-compatible APIs for object storage. Supports every common operating system, hypervisor, and application.</li>
<li>Economical: Deploy an enterprise private cloud and reduce storage TCO by 70% over AWS with built-in enterprise-class features such as in-line compression, deduplication, clones, and thin-provisioning.</li>
<li>Safe: The OpenZFS file system ensures data integrity with best-in-class replication and snapshotting. Customers can replicate data to the rest of the iXsystems storage lineup and to the public cloud.</li>
<li>Reliable: High Availability option with dual hot-swappable controllers for continuous data availability and 99.999% uptime.</li>
<li>Familiar: Provision and manage storage with the same simple and powerful WebUI and REST APIs used in all iXsystems storage products, as well as iXsystems’ FreeNAS Software.</li>
<li>Certified: TrueNAS has passed the Citrix Ready, VMware Ready, and Veeam Ready certifications, reducing the risk of deploying a virtualized infrastructure.</li>
<li>Open: By using industry-standard sharing protocols, the OpenZFS Open Source enterprise file system and FreeNAS, the world’s #1 Open Source storage operating system (and also engineered by iXsystems), TrueNAS is the most open enterprise storage solution on the market.</li></ul></li>
<li><p>Availability</p></li>
</ul>

<blockquote>
  <p>The TrueNAS M40 and M50 will be generally available in April 2018 through the iXsystems global channel partner network. The TrueNAS M-Series starts at under $20,000 USD and can be easily expanded using a linear “per terabyte” pricing model. With typical compression, a Petabtye can be stored for under $100,000 USD. TrueNAS comes with an all-inclusive software suite that provides NFS, Windows SMB, iSCSI, snapshots, clones and replication.</p>
</blockquote>

<ul>
<li>For more information, visit www.ixsystems.com/TrueNAS </li>
<li><a href="TrueNAS M-Series What's New">TrueNAS M-Series What's New Video</a></li>
</ul>

<p><hr /></p>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2018-April/088678.html">Understanding and tuning the FreeBSD Scheduler </a></h3>

<p>```
Occasionally I noticed that the system would not quickly process the
tasks i need done, but instead prefer other, longrunning tasks. I
figured it must be related to the scheduler, and decided it hates me.</p>

<p>A closer look shows the behaviour as follows (single CPU):</p>

<p>Lets run an I/O-active task, e.g, postgres VACUUM that would
continuously read from big files (while doing compute as well [1]):</p>

<blockquote>
  <p>pool        alloc   free   read  write   read  write
  cache           -      -      -      -      -      -
   ada1s4    7.08G  10.9G  1.58K      0  12.9M      0</p>
</blockquote>

<p>Now start an endless loop:</p>

<h1>while true; do :; done</h1>

<p>And the effect is:</p>

<blockquote>
  <p>pool        alloc   free   read  write   read  write
  cache           -      -      -      -      -      -
   ada1s4    7.08G  10.9G      9      0  76.8K      0</p>
</blockquote>

<p>The VACUUM gets almost stuck! This figures with WCPU in "top":</p>

<blockquote>
  <p>PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND
  85583 root        99    0  7044K  1944K RUN      1:06  92.21% bash
  53005 pgsql       52    0   620M 91856K RUN      5:47   0.50% postgres</p>
</blockquote>

<p>Hacking on kern.sched.quantum makes it quite a bit better:</p>

<h1>sysctl kern.sched.quantum=1</h1>

<p>kern.sched.quantum: 94488 -> 7874</p>

<blockquote>
  <p>pool        alloc   free   read  write   read  write
  cache           -      -      -      -      -      -
   ada1s4    7.08G  10.9G    395      0  3.12M      0</p>
  
  <p>PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND
  85583 root        94    0  7044K  1944K RUN      4:13  70.80% bash
  53005 pgsql       52    0   276M 91856K RUN      5:52  11.83% postgres</p>
</blockquote>

<p>Now, as usual, the "root-cause" questions arise: What exactly does
this "quantum"? Is this solution a workaround, i.e. actually something
else is wrong, and has it tradeoff in other situations? Or otherwise,
why is such a default value chosen, which appears to be ill-deceived?</p>

<p>The docs for the quantum parameter are a bit unsatisfying - they say
its the max num of ticks a process gets - and what happens when
they're exhausted? If by default the endless loop is actually allowed
to continue running for 94k ticks (or 94ms, more likely) uninterrupted,
then that explains the perceived behaviour - buts thats certainly not
what a scheduler should do when other procs are ready to run.</p>

<p>11.1-RELEASE-p7, kern.hz=200. Switching tickless mode on or off does
not influence the matter. Starting the endless loop with "nice" does
not influence the matter.</p>

<p>[1]
A pure-I/O job without compute load, like "dd", does not show
this behaviour. Also, when other tasks are running, the unjust
behaviour is not so stongly pronounced.
```</p>

<p><hr /></p>

<h3><a href="https://mail-index.netbsd.org/port-arm/2018/04/01/msg004702.html">aarch64 support added</a></h3>

<blockquote>
  <p>I have committed about adding initial support for aarch64.</p>
</blockquote>

<ul>
<li>booting log on RaspberryPI3:</li>
</ul>

<p>```
    boot NetBSD/evbarm (aarch64)
    Drop to EL1...OK
    Creating VA=PA tables
    Creating KSEG tables
    Creating KVA=PA tables
    Creating devmap tables
    MMU Enable...OK
    VSTART          = ffffffc000001ff4
    FDT&lt;3ab46000> devmap cpufunc bootstrap consinit ok
    uboot: args 0x3ab46000, 0, 0, 0</p>

<pre><code>NetBSD/evbarm (fdt) booting ...
FDT /memory [0] @ 0x0 size 0x3b000000
MEM: add 0-3b000000
MEM: res 0-1000
MEM: res 3ab46000-3ab4a000
Usable memory:
  1000 - 3ab45fff
  3ab4a000 - 3affffff
initarm: kernel phys start 1000000 end 17bd000
MEM: res 1000000-17bd000
bootargs: root=axe0
  1000 - ffffff
  17bd000 - 3ab45fff
  3ab4a000 - 3affffff
------------------------------------------
kern_vtopdiff         = 0xffffffbfff000000
physical_start        = 0x0000000000001000
kernel_start_phys     = 0x0000000001000000
kernel_end_phys       = 0x00000000017bd000
physical_end          = 0x000000003ab45000
VM_MIN_KERNEL_ADDRESS = 0xffffffc000000000
kernel_start_l2       = 0xffffffc000000000
kernel_start          = 0xffffffc000000000
kernel_end            = 0xffffffc0007bd000
kernel_end_l2         = 0xffffffc000800000
(kernel va area)
(devmap va area)
VM_MAX_KERNEL_ADDRESS = 0xffffffffffe00000
------------------------------------------
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,
    2018 The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018
        ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64
total memory = 936 MB
avail memory = 877 MB
</code></pre>

<p>…</p>

<pre><code>Starting local daemons:.
Updating motd.
Starting sshd.
Starting inetd.
Starting cron.
The following components reported failures:
    /etc/rc.d/swap2
See /var/run/rc.log for more information.
Fri Mar 30 12:35:31 JST 2018

NetBSD/evbarm (rpi3) (console)

login: root
Last login: Fri Mar 30 12:30:24 2018 on console

rpi3# uname -ap
NetBSD rpi3 8.99.14 NetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018  ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64 evbarm aarch64
rpi3#
</code></pre>

<p>```</p>

<blockquote>
  <p>Now, multiuser mode works stably on fdt based boards (RPI3,SUNXI,TEGRA). But there are still some problems, more time is required for release. also SMP is not yet. See sys/arch/aarch64/aarch64/TODO for more detail. Especially the problems around TLS of rtld, and C++ stack unwindings are too difficult for me to solve, I give up and need someone's help (^o^)/ Since C++ doesn't work, ATF also doesn't work. If the ATF works, it will clarify more issues.</p>
  
  <p>sys/arch/evbarm64 is gone and integrated into sys/arch/evbarm. One evbarm/conf/GENERIC64 kernel binary supports all fdt (bcm2837,sunxi,tegra) based boards. While on 32bit, sys/arch/evbarm/conf/GENERIC will support all fdt based boards...but doesn't work yet. (WIP)</p>
  
  <p>My deepest appreciation goes to Tohru Nishimura (nisimura@) whose writes vector handlers, context switchings, and so on. and his comments and suggestions were innumerably valuable. I would also like to thank Nick Hudson (skrll@) and Jared McNeill (jmcneill@) whose added support FDT and integrated into evbarm. Finally, I would like to thank Matt Thomas (matt@) whose commited aarch64
  toolchains and preliminary support for aarch64.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=hvuWI5hzD5U">5 Reasons to Use FreeBSD in 2018</a></li>
<li><a href="https://twitter.com/johalun/status/983645780509712384">Rewriting Intel gigabit network driver in Rust</a></li>
<li><a href="https://twitter.com/DLangille/status/983360090240684034">Recruiting to make Elastic Search on FreeBSD better</a></li>
<li><a href="https://twitter.com/Tubsta/status/981058685219688448">Windows Server 2019 Preview, in bhyve on FreeBSD</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3126">“SSH Mastery, 2nd ed” in hardcover</a></li>
</ul>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Jason - <a href="http://dpaste.com/0JN4V1K#wrap">ZFS Transfer option</a></li>
<li>Luis - <a href="http://dpaste.com/3MH4QRF#wrap">ZFS Pools</a></li>
<li><a href="https://clonos.tekroutine.com/">ClonOS </a></li>
<li>Michael - <a href="http://dpaste.com/3MN5F74#wrap">Tech Conferences</a></li>
<li>anonymous - <a href="http://dpaste.com/18J24QJ#wrap">BSD trash on removable drives</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 6.3 and DragonflyBSD 5.2 are released, bug fix for disappearing files in OpenZFS on Linux (and only Linux), understanding the FreeBSD CPU scheduler, NetBSD on RPI3, thoughts on being a committer for 20 years, and 5 reasons to use FreeBSD in 2018.</p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/63.html">OpenBSD 6.3 released</a></h3>

<ul>
<li>Punctual as ever, OpenBSD 6.3 has been releases with the following features/changes:


<blockquote>
  Improved HW support, including:
  SMP support on OpenBSD/arm64 platforms
  vmm/vmd improvements:
  IEEE 802.11 wireless stack improvements
  Generic network stack improvements
  Installer improvements
  Routing daemons and other userland network improvements
  Security improvements
  dhclient(8) improvements
  Assorted improvements
  OpenSMTPD 6.0.4
  OpenSSH 7.7
  LibreSSL 2.7.2</li>
  </ul>
  <hr />
</blockquote>

<h3><a href="https://www.dragonflybsd.org/release52/">DragonFlyBSD 5.2 released</a></h3>



<blockquote>
  <p>Big-ticket items
  Meltdown and Spectre mitigation support
  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectre<em>mitigation and machdep.meltdown</em>mitigation.
  HAMMER2
  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.
  Clustered support is not yet available.
  ipfw Updates
  Implement state based "redirect", i.e. without using libalias.
  ipfw now supports all possible ICMP types.
  Fix ICMP<em>MAXTYPE assumptions (now 40 as of this release).
  Improved graphics support
  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs
  Add 24-bit pixel format support to the EFI frame buffer code.
  Significantly improve fbio support for the "scfb" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.
  Partly implement the FBIO</em>BLANK ioctl for display powersaving.
  Syscons waits for drm modesetting at appropriate places, avoiding races.
  + For more details, check out the “All changes since DragonFly 5.0” section.</p>
</blockquote>

<hr />






<h3><a href="https://github.com/zfsonlinux/zfs/issues/7401">ZFS on Linux bug causes files to disappear</a></h3>

<ul>
<li>A bug in ZoL 0.7.7 caused 0.7.8 to be released just 3 days after the release</li>
<li>The bug only impacts Linux, the change that caused the problem was not upstreamed yet, so does not impact ZFS on illumos, FreeBSD, OS X, or Windows</li>
<li>The bug can cause files being copied into a directory to not be properly linked to the directory, so they will no longer be listed in the contents of the directory</li>
<li>ZoL developers are working on a tool to allow you to recover the data, since no data was actually lost, the files were just not properly registered as part of the directory</li>
<li>The bug was introduced in a commit made in February, that attempted to improve performance of datasets created with the case insensitivity option. In an effort to improve performance, they introduced a limit to cap to give up (return ENOSPC) if growing the directory ZAP failed twice.</li>
<li>The ZAP is the key-value pair data structure that contains metadata for a directory, including a hash table of the files that are in a directory. When a directory has a large number of files, the ZAP is converted to a FatZAP, and additional space may need to be allocated as additional files are added.


<blockquote>
  Commit cc63068 caused ENOSPC error when copy a large amount of files between two directories. The reason is that the patch limits zap leaf expansion to 2 retries, and return ENOSPC when failed.</li>
  <li>Finding the root cause of this issue was somewhat hampered by the fact that many people were not able to reproduce the issue. It turns out this was caused by an entirely unrelated change to GNU coreutils.</li>
  <li>On later versions of GNU Coreutils, the files were returned in a sorted order, resulting in them hitting different buckets in the hash table, and not tripping the retry limit</li>
  <li>Tools like rsync were unaffected, because they always sort the files before copying</li>
  <li>If you did not see any ENOSPC errors, you were likely not impacted
  The intent for limiting retries is to prevent pointlessly growing table to max size when adding a block full of entries with same name in different case in mixed mode. However, it turns out we cannot use any limit on the retry. When we copy files from one directory in readdir order, we are copying in hash order, one leaf block at a time. Which means that if the leaf block in source directory has expanded 6 times, and you copy those entries in that block, by the time you need to expand the leaf in destination directory, you need to expand it 6 times in one go. So any limit on the retry will result in error where it shouldn't.</li>
  <li>Recommendations for Users from Ryan Yao:
  The regression makes it so that creating a new file could fail with ENOSPC after which files created in that directory could become orphaned. Existing files seem okay, but I have yet to confirm that myself and I cannot speak for what others know. It is incredibly difficult to reproduce on systems running coreutils 8.23 or later. So far, reports have only come from people using coreutils 8.22 or older. The directory size actually gets incremented for each orphaned file, which makes it wrong after orphan files happen.
  We will likely have some way to recover the orphaned files (like ext4’s lost+found) and fix the directory sizes in the very near future. Snapshots of the damaged datasets are problematic though. Until we have a subcommand to fix it (not including the snapshots, which we would have to list), the damage can be removed from a system that has it either by rolling back to a snapshot before it happened or creating a new dataset with 0.7.6 (or another release other than 0.7.7), moving everything to the new dataset and destroying the old. That will restore things to pristine condition.
  It should also be possible to check for pools that are affected, but I have yet to finish my analysis to be certain that no false negatives occur when checking, so I will avoid saying how for now.</li>
  <li>Writes to existing files cannot trigger this bug, only adding new files to a directory in bulk</li>
  </ul>
  <hr />
</blockquote>

<h2>News Roundup</h2>



<h3><a href="https://blog.des.no/2018/04/twenty-years/">des@’s thoughts on being a FreeBSD committer for 20 years</a></h3>



<blockquote>
  <p>Yesterday was the twentieth anniversary of my FreeBSD commit bit, and tomorrow will be the twentieth anniversary of my first commit. I figured I’d split the difference and write a few words about it today.</p>
  
  <p>My level of engagement with the FreeBSD project has varied greatly over the twenty years I’ve been a committer. There have been times when I worked on it full-time, and times when I did not touch it for months. The last few years, health issues and life events have consumed my time and sapped my energy, and my contributions have come in bursts. Commit statistics do not tell the whole story, though: even when not working on FreeBSD directly, I have worked on side projects which, like OpenPAM, may one day find their way into FreeBSD.</p>
  
  <p>My contributions have not been limited to code. I was the project’s first Bugmeister; I’ve served on the Security Team for a long time, and have been both Security Officer and Deputy Security Officer; I managed the last four Core Team elections and am doing so again this year.</p>
  
  <p>In return, the project has taught me much about programming and software engineering. It taught me code hygiene and the importance of clarity over cleverness; it taught me the ins and outs of revision control; it taught me the importance of good documentation, and how to write it; and it taught me good release engineering practices.</p>
  
  <p>Last but not least, it has provided me with the opportunity to work with some of the best people in the field. I have the privilege today to count several of them among my friends.</p>
  
  <p>For better or worse, the FreeBSD project has shaped my career and my life. It set me on the path to information security in general and IAA in particular, and opened many a door for me. I would not be where I am now without it.</p>
  
  <p>I won’t pretend to be able to tell the future. I don’t know how long I will remain active in the FreeBSD project and community. It could be another twenty years; or it could be ten, or five, or less. All I know is that FreeBSD and I still have things to teach each other, and I don’t intend to call it quits any time soon.</p>
</blockquote>

<hr />






<h3><a href="https://www.ixsystems.com/blog/truenas-m-series/?utm_source=twitter.com&amp;utm_medium=bsdnow&amp;utm_campaign=truenas+m+series">iXsystems unveils new TrueNAS M-Series Unified Storage Line</a></h3>



<blockquote>
  <p>San Jose, Calif., April 10, 2018 — iXsystems, the leader in Enterprise Open Source servers and software-defined storage, announced the TrueNAS M40 and M50 as the newest high-performance models in its hybrid, unified storage product line. The TrueNAS M-Series harnesses NVMe and NVDIMM to bring all-flash array performance to the award-winning TrueNAS hybrid arrays. It also includes the Intel® Xeon® Scalable Family of Processors and supports up to 100GbE and 32Gb Fibre Channel networking. Sitting between the all-flash TrueNAS Z50 and the hybrid TrueNAS X-Series in the product line, the TrueNAS M-Series delivers up to 10 Petabytes of highly-available and flash-powered network attached storage and rounds out a comprehensive product set that has a capacity and performance option for every storage budget.</p>
</blockquote>

<ul>
<li>Designed for On-Premises &amp; Enterprise Cloud Environments</li>
</ul>

<blockquote>
  <p>As a unified file, block, and object sharing solution, TrueNAS can meet the needs of file serving, backup, virtualization, media production, and private cloud users thanks to its support for the SMB, NFS, AFP, iSCSI, Fibre Channel, and S3 protocols.</p>
  
  <p>At the heart of the TrueNAS M-Series is a custom 4U, dual-controller head unit that supports up to 24 3.5” drives and comes in two models, the M40 and M50, for maximum flexibility and scalability. The TrueNAS M40 uses NVDIMMs for write cache, SSDs for read cache, and up to two external 60-bay expansion shelves that unlock up to 2PB in capacity. The TrueNAS M50 uses NVDIMMs for write caching, NVMe drives for read caching, and up to twelve external 60-bay expansion shelves to scale upwards of 10PB. The dual-controller design provides high-availability failover and non-disruptive upgrades for mission-critical enterprise environments.</p>
  
  <p>By design, the TrueNAS M-Series unleashes cutting-edge persistent memory technology for demanding performance and capacity workloads, enabling businesses to accelerate enterprise applications and deploy enterprise private clouds that are twice the capacity of previous TrueNAS models. It also supports replication to the Amazon S3, BackBlaze B2, Google Cloud, and Microsoft Azure cloud platforms and can deliver an object store using the ubiquitous S3 object storage protocol at a fraction of the cost of the public cloud.</p>
</blockquote>

<ul>
<li>Fast</li>
</ul>

<blockquote>
  <p>As a true enterprise storage platform, the TrueNAS M50 supports very demanding performance workloads with up to four active 100GbE ports, 3TB of RAM, 32GB of NVDIMM write cache and up to 15TB of NVMe flash read cache. The TrueNAS M40 and M50 include up to 24/7 and global next-business-day support, putting IT at ease. The modular and tool-less design of the M-Series allows for easy, non-disruptive servicing and upgrading by end-users and support technicians for guaranteed uptime. TrueNAS has US-Based support provided by the engineering team that developed it, offering the rapid response that every enterprise needs.</p>
</blockquote>

<ul>
<li><p>Award-Winning TrueNAS Features</p>

<ul><li>Enterprise: Perfectly suited for private clouds and enterprise workloads such as file sharing, backups, M&amp;E, surveillance, and hosting virtual machines.</li>
<li>Unified: Utilizes SMB, AFP, NFS for file storage, iSCSI, Fibre Channel and OpenStack Cinder for block storage, and S3-compatible APIs for object storage. Supports every common operating system, hypervisor, and application.</li>
<li>Economical: Deploy an enterprise private cloud and reduce storage TCO by 70% over AWS with built-in enterprise-class features such as in-line compression, deduplication, clones, and thin-provisioning.</li>
<li>Safe: The OpenZFS file system ensures data integrity with best-in-class replication and snapshotting. Customers can replicate data to the rest of the iXsystems storage lineup and to the public cloud.</li>
<li>Reliable: High Availability option with dual hot-swappable controllers for continuous data availability and 99.999% uptime.</li>
<li>Familiar: Provision and manage storage with the same simple and powerful WebUI and REST APIs used in all iXsystems storage products, as well as iXsystems’ FreeNAS Software.</li>
<li>Certified: TrueNAS has passed the Citrix Ready, VMware Ready, and Veeam Ready certifications, reducing the risk of deploying a virtualized infrastructure.</li>
<li>Open: By using industry-standard sharing protocols, the OpenZFS Open Source enterprise file system and FreeNAS, the world’s #1 Open Source storage operating system (and also engineered by iXsystems), TrueNAS is the most open enterprise storage solution on the market.</li></ul></li>
<li><p>Availability</p></li>
</ul>

<blockquote>
  <p>The TrueNAS M40 and M50 will be generally available in April 2018 through the iXsystems global channel partner network. The TrueNAS M-Series starts at under $20,000 USD and can be easily expanded using a linear “per terabyte” pricing model. With typical compression, a Petabtye can be stored for under $100,000 USD. TrueNAS comes with an all-inclusive software suite that provides NFS, Windows SMB, iSCSI, snapshots, clones and replication.</p>
</blockquote>

<ul>
<li>For more information, visit www.ixsystems.com/TrueNAS </li>
<li><a href="TrueNAS M-Series What's New">TrueNAS M-Series What's New Video</a></li>
</ul>

<p><hr /></p>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2018-April/088678.html">Understanding and tuning the FreeBSD Scheduler </a></h3>

<p>```
Occasionally I noticed that the system would not quickly process the
tasks i need done, but instead prefer other, longrunning tasks. I
figured it must be related to the scheduler, and decided it hates me.</p>

<p>A closer look shows the behaviour as follows (single CPU):</p>

<p>Lets run an I/O-active task, e.g, postgres VACUUM that would
continuously read from big files (while doing compute as well [1]):</p>

<blockquote>
  <p>pool        alloc   free   read  write   read  write
  cache           -      -      -      -      -      -
   ada1s4    7.08G  10.9G  1.58K      0  12.9M      0</p>
</blockquote>

<p>Now start an endless loop:</p>

<h1>while true; do :; done</h1>

<p>And the effect is:</p>

<blockquote>
  <p>pool        alloc   free   read  write   read  write
  cache           -      -      -      -      -      -
   ada1s4    7.08G  10.9G      9      0  76.8K      0</p>
</blockquote>

<p>The VACUUM gets almost stuck! This figures with WCPU in "top":</p>

<blockquote>
  <p>PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND
  85583 root        99    0  7044K  1944K RUN      1:06  92.21% bash
  53005 pgsql       52    0   620M 91856K RUN      5:47   0.50% postgres</p>
</blockquote>

<p>Hacking on kern.sched.quantum makes it quite a bit better:</p>

<h1>sysctl kern.sched.quantum=1</h1>

<p>kern.sched.quantum: 94488 -> 7874</p>

<blockquote>
  <p>pool        alloc   free   read  write   read  write
  cache           -      -      -      -      -      -
   ada1s4    7.08G  10.9G    395      0  3.12M      0</p>
  
  <p>PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND
  85583 root        94    0  7044K  1944K RUN      4:13  70.80% bash
  53005 pgsql       52    0   276M 91856K RUN      5:52  11.83% postgres</p>
</blockquote>

<p>Now, as usual, the "root-cause" questions arise: What exactly does
this "quantum"? Is this solution a workaround, i.e. actually something
else is wrong, and has it tradeoff in other situations? Or otherwise,
why is such a default value chosen, which appears to be ill-deceived?</p>

<p>The docs for the quantum parameter are a bit unsatisfying - they say
its the max num of ticks a process gets - and what happens when
they're exhausted? If by default the endless loop is actually allowed
to continue running for 94k ticks (or 94ms, more likely) uninterrupted,
then that explains the perceived behaviour - buts thats certainly not
what a scheduler should do when other procs are ready to run.</p>

<p>11.1-RELEASE-p7, kern.hz=200. Switching tickless mode on or off does
not influence the matter. Starting the endless loop with "nice" does
not influence the matter.</p>

<p>[1]
A pure-I/O job without compute load, like "dd", does not show
this behaviour. Also, when other tasks are running, the unjust
behaviour is not so stongly pronounced.
```</p>

<p><hr /></p>

<h3><a href="https://mail-index.netbsd.org/port-arm/2018/04/01/msg004702.html">aarch64 support added</a></h3>

<blockquote>
  <p>I have committed about adding initial support for aarch64.</p>
</blockquote>

<ul>
<li>booting log on RaspberryPI3:</li>
</ul>

<p>```
    boot NetBSD/evbarm (aarch64)
    Drop to EL1...OK
    Creating VA=PA tables
    Creating KSEG tables
    Creating KVA=PA tables
    Creating devmap tables
    MMU Enable...OK
    VSTART          = ffffffc000001ff4
    FDT&lt;3ab46000> devmap cpufunc bootstrap consinit ok
    uboot: args 0x3ab46000, 0, 0, 0</p>

<pre><code>NetBSD/evbarm (fdt) booting ...
FDT /memory [0] @ 0x0 size 0x3b000000
MEM: add 0-3b000000
MEM: res 0-1000
MEM: res 3ab46000-3ab4a000
Usable memory:
  1000 - 3ab45fff
  3ab4a000 - 3affffff
initarm: kernel phys start 1000000 end 17bd000
MEM: res 1000000-17bd000
bootargs: root=axe0
  1000 - ffffff
  17bd000 - 3ab45fff
  3ab4a000 - 3affffff
------------------------------------------
kern_vtopdiff         = 0xffffffbfff000000
physical_start        = 0x0000000000001000
kernel_start_phys     = 0x0000000001000000
kernel_end_phys       = 0x00000000017bd000
physical_end          = 0x000000003ab45000
VM_MIN_KERNEL_ADDRESS = 0xffffffc000000000
kernel_start_l2       = 0xffffffc000000000
kernel_start          = 0xffffffc000000000
kernel_end            = 0xffffffc0007bd000
kernel_end_l2         = 0xffffffc000800000
(kernel va area)
(devmap va area)
VM_MAX_KERNEL_ADDRESS = 0xffffffffffe00000
------------------------------------------
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,
    2018 The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018
        ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64
total memory = 936 MB
avail memory = 877 MB
</code></pre>

<p>…</p>

<pre><code>Starting local daemons:.
Updating motd.
Starting sshd.
Starting inetd.
Starting cron.
The following components reported failures:
    /etc/rc.d/swap2
See /var/run/rc.log for more information.
Fri Mar 30 12:35:31 JST 2018

NetBSD/evbarm (rpi3) (console)

login: root
Last login: Fri Mar 30 12:30:24 2018 on console

rpi3# uname -ap
NetBSD rpi3 8.99.14 NetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018  ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64 evbarm aarch64
rpi3#
</code></pre>

<p>```</p>

<blockquote>
  <p>Now, multiuser mode works stably on fdt based boards (RPI3,SUNXI,TEGRA). But there are still some problems, more time is required for release. also SMP is not yet. See sys/arch/aarch64/aarch64/TODO for more detail. Especially the problems around TLS of rtld, and C++ stack unwindings are too difficult for me to solve, I give up and need someone's help (^o^)/ Since C++ doesn't work, ATF also doesn't work. If the ATF works, it will clarify more issues.</p>
  
  <p>sys/arch/evbarm64 is gone and integrated into sys/arch/evbarm. One evbarm/conf/GENERIC64 kernel binary supports all fdt (bcm2837,sunxi,tegra) based boards. While on 32bit, sys/arch/evbarm/conf/GENERIC will support all fdt based boards...but doesn't work yet. (WIP)</p>
  
  <p>My deepest appreciation goes to Tohru Nishimura (nisimura@) whose writes vector handlers, context switchings, and so on. and his comments and suggestions were innumerably valuable. I would also like to thank Nick Hudson (skrll@) and Jared McNeill (jmcneill@) whose added support FDT and integrated into evbarm. Finally, I would like to thank Matt Thomas (matt@) whose commited aarch64
  toolchains and preliminary support for aarch64.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=hvuWI5hzD5U">5 Reasons to Use FreeBSD in 2018</a></li>
<li><a href="https://twitter.com/johalun/status/983645780509712384">Rewriting Intel gigabit network driver in Rust</a></li>
<li><a href="https://twitter.com/DLangille/status/983360090240684034">Recruiting to make Elastic Search on FreeBSD better</a></li>
<li><a href="https://twitter.com/Tubsta/status/981058685219688448">Windows Server 2019 Preview, in bhyve on FreeBSD</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3126">“SSH Mastery, 2nd ed” in hardcover</a></li>
</ul>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Jason - <a href="http://dpaste.com/0JN4V1K#wrap">ZFS Transfer option</a></li>
<li>Luis - <a href="http://dpaste.com/3MH4QRF#wrap">ZFS Pools</a></li>
<li><a href="https://clonos.tekroutine.com/">ClonOS </a></li>
<li>Michael - <a href="http://dpaste.com/3MN5F74#wrap">Tech Conferences</a></li>
<li>anonymous - <a href="http://dpaste.com/18J24QJ#wrap">BSD trash on removable drives</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 242: Linux Takes The Fastpath | BSD Now 242</title>
  <link>https://www.bsdnow.tv/242</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-1788</guid>
  <pubDate>Wed, 18 Apr 2018 14:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/729a44d2-5a5b-4879-8700-d519931d67f0.mp3" length="60077262" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>TrueOS Stable 18.03 released, a look at F-stack, the secret to an open source business model, intro to jails and jail networking, FreeBSD Foundation March update, and the ipsec Errata.</itunes:subtitle>
  <itunes:duration>1:23:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>TrueOS Stable 18.03 released, a look at F-stack, the secret to an open source business model, intro to jails and jail networking, FreeBSD Foundation March update, and the ipsec Errata.
&lt;h2&gt;Headlines&lt;/h2&gt;
&lt;h3&gt;&lt;a href="https://trueos.org/blog/trueos-stable-18-03-release/"&gt;TrueOS STABLE 18.03 Release&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;The TrueOS team is pleased to announce the availability of a new STABLE release of the TrueOS project (version 18.03). This is a special release due to the security issues impacting the computing world since the beginning of 2018. In particular, mitigating the “Meltdown” and “Spectre” system exploits make it necessary to update the entire package ecosystem for TrueOS. This release does not replace the scheduled June STABLE update, but provides the necessary and expected security updates for the STABLE release branch of TrueOS, even though this is part-way through our normal release cycle.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Important changes between version 17.12 and 18.03&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;“Meltdown” security fixes: This release contains all the fixes to FreeBSD which mitigate the security issues for systems that utilize Intel-based processors when running virtual machines such as FreeBSD jails. Please note that virtual machines or jails must also be updated to a version of FreeBSD or TrueOS which contains these security fixes.&lt;/li&gt;
&lt;li&gt;“Spectre” security mitigations: This release contains all current mitigations from FreeBSD HEAD for the Spectre memory-isolation attacks (Variant 2). All 3rd-party packages for this release are also compiled with LLVM/Clang 6 (the “retpoline” mitigation strategy). This fixes many memory allocation issues and enforces stricter requirements for code completeness and memory usage within applications. Unfortunately, some 3rd-party applications became unavailable as pre-compiled packages due to non-compliance with these updated standards. These applications are currently being fixed either by the upstream authors or the FreeBSD port maintainers. If there are any concerns about the availability of a critical application for a specific workflow, please search through the changelog of packages between TrueOS 17.12 and 18.03 to verify the status of the application.&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Most systems will need microcode updates for additional Spectre mitigations. The microcode updates are not enabled by default. This work is considered experimental because it is in active development by the upstream vendors. If desired, the microcode updates are available with the new devcpu-data package, which is available in the Appcafe. Install this package and enable the new microcode_update service to apply the latest runtime code when booting the system.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Important security-based package updates&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;LibreSSL is updated from version 2.6.3 -&amp;gt; 2.6.4&lt;/li&gt;
&lt;li&gt;Reminder: LibreSSL is used on TrueOS to build any package which does not explicitly require OpenSSL. All applications that utilize the SSL transport layer are now running with the latest security updates.&lt;/li&gt;
&lt;li&gt;Browser updates: (Keep in mind that many browsers have also implemented their own security mitigations in the aftermath of the Spectre exploit.)&lt;/li&gt;
&lt;li&gt;Firefox: 57.0.1 -&amp;gt; 58.0.2&lt;/li&gt;
&lt;li&gt;Chromium: 61.0.3163.100 -&amp;gt; 63.0.3239.132&lt;/li&gt;
&lt;li&gt;Qt5 Webengine (QupZilla, Falkon, many others): 5.7.1 -&amp;gt; 5.9.4&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;&lt;p&gt;All pre-compiled packages for this release are built with the latest versions of LLVM/Clang, unless the package explicitly requires GCC. These packages also utilize the latest compile-time mitigations for memory-access security concerns.&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://github.com/F-Stack/f-stack"&gt;F-Stack&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;F-Stack is an user space network development kit with high performance based on DPDK, FreeBSD TCP/IP stack and coroutine API. http://www.f-stack.org&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;Introduction
With the rapid development of NIC, the poor performance of data packets processing with Linux kernel has become the bottleneck. However, the rapid development of the Internet needs high performance of network processing, kernel bypass has caught more and more attentions. There are various similar technologies appear, such as DPDK, NETMAP and PF_RING. The main idea of kernel bypass is that Linux is only used to deal with control flow, all data streams are processed in user space. Therefore, kernel bypass can avoid performance bottlenecks caused by kernel packet copying, thread scheduling, system calls and interrupts. Furthermore, kernel bypass can achieve higher performance with multi optimizing methods. Within various techniques, DPDK has been widely used because of its more thorough isolation from kernel scheduling and active community support.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;F-Stack is an open source network framework with high performance based on DPDK. With following characteristics&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Ultra high network performance which can achieve network card under full load, 10 million concurrent connections, 5 million RPS, 1 million CPS.&lt;/li&gt;
&lt;li&gt;Transplant FreeBSD 11.01 user space stack, provides a complete stack function, cut a great amount of irrelevant features. Therefore greatly enhance the performance.&lt;/li&gt;
&lt;li&gt;Support Nginx, Redis and other mature applications, service can easily use F-Stack&lt;/li&gt;
&lt;li&gt;With Multi-process architecture, easy to extend&lt;/li&gt;
&lt;li&gt;Provide micro thread interface. Various applications with stateful app can easily use F-Stack to get high performance without processing complex asynchronous logic.&lt;/li&gt;
&lt;li&gt;Provide Epoll/Kqueue interface that allow many kinds of applications easily use F-Stack&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;&lt;p&gt;History&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;In order to deal with the increasingly severe DDoS attacks, authorized DNS server of Tencent Cloud DNSPod switched from Gigabit Ethernet to 10-Gigabit at the end of 2012. We faced several options, one is to continue to use the original model another is to use kernel bypass technology. After several rounds of investigation, we finally chose to develop our next generation of DNS server based on DPDK. The reason is DPDK provides ultra-high performance and can be seamlessly extended to 40G, or even 100G NIC in the future.&lt;/p&gt;
  
  &lt;p&gt;After several months of development and testing, DKDNS, high-performance DNS server based on DPDK officially released in October 2013. It's capable of achieving up to 11 million QPS with a single 10GE port and 18.2 million QPS with two 10GE ports. And then we developed a user-space TCP/IP stack called F-Stack that can process 0.6 million RPS with a single 10GE port.&lt;/p&gt;
  
  &lt;p&gt;With the fast growth of Tencent Cloud, more and more services need higher network access performance. Meanwhile, F-Stack was continuous improving driven by the business growth, and ultimately developed into a general network access framework. But this TCP/IP stack couldn't meet the needs of these services while continue to develop and maintain a complete network stack will cost high, we've tried several plans and finally determined to port FreeBSD(11.0 stable) TCP/IP stack into F-Stack. Thus, we can reduce the cost of maintenance and follow up the improvement from community quickly.Thanks to libplebnet and libuinet, this work becomes a lot easier.&lt;/p&gt;
  
  &lt;p&gt;With the rapid development of all kinds of application, in order to help different APPs quick and easily use F-Stack, F-Stack has integrated Nginx, Redis and other commonly used APPs, and a micro thread framework, and provides a standard Epoll/Kqueue interface.&lt;/p&gt;
  
  &lt;p&gt;Currently, besides authorized DNS server of DNSPod, there are various products in Tencent Cloud has used the F-Stack, such as HttpDNS (D+), COS access module, CDN access module, etc..&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;/p&gt;

&lt;h3&gt;&lt;a href="https://www.forbes.com/sites/forbestechcouncil/2018/04/02/leadership-is-the-secret-to-an-open-source-business-model/#a2beca765c78"&gt;Leadership Is The Secret To An Open Source Business Model&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;A Forbes article by Mike Lauth, CEO of iXsystems


&lt;blockquote&gt;
  There is a good chance you’ve never heard of open source software and an even greater one that you’re using it every day without even realizing it. Open source software is computer software that is available under a variety of licenses that all encourage the sharing of the software and its underlying source code. Open source has powered the internet from day one and today powers the cloud and just about everything connected to it from your mobile phone to virtually every internet of things device.
  FreeNAS is one of two open source operating systems that my company, iXsystems, develops and distributes free of charge and is at the heart of our line of TrueNAS enterprise storage products. While some of our competitors sell storage software similar to FreeNAS, we not only give it away but also do so with truly no strings attached -- competitors can and do take FreeNAS and build products based on it with zero obligation to share their changes. The freedom to do so is the fundamental tenet of permissively licensed open source software, and while it sounds self-defeating to be this generous, we’ve proven that leadership, not licensing, is the true secret to a successful open source business model.
  We each have our own personal definition of what is fair when it comes to open source. At iXsystems, we made a conscious decision to base FreeNAS and TrueOS on the FreeBSD operating system developed by the FreeBSD project. We stand on the shoulders of giants by using FreeBSD and we consider it quite reasonable to give back on the same generous terms that the FreeBSD project offers us. We could be selective in what we provide free of charge, but we believe that doing so would be short-sighted. In the long game we’re playing, the leadership we provide over the open source projects we produce is infinitely more important than any restrictions provided by the licenses of those and other open source projects.
  Twenty years in, we have no reason to change our free-software-on-great-hardware business model and giving away the software has brought an unexpected side-benefit: the largest Q/A department in the world, staffed by our passionate users who volunteer to let us know every thought they have about our software. We wouldn’t change a thing, and I encourage you to find exactly what win-win goodwill you and your company can provide to your constituents to make them not just a customer base but a community.&lt;/blockquote&gt;
&lt;/li&gt;
  &lt;li&gt;Drive The Conversation
  It took a leap of faith for us to give away the heart of our products in exchange for a passionate community, but doing so changes your customer's relationship with your brand from priced to priceless. This kind of relationship leverages a social contract instead of a legal one. Taking this approach empowers your users in ways they will not experience with other companies and it is your responsibility to lead, rather than control them with a project like FreeNAS&lt;/li&gt;
  &lt;li&gt;Relieve Customer Pain Points With Every New Release
  Responsiveness to the needs of your constituents is what distinguishes project leadership from project dictatorship. Be sure to balance your vision for your products and projects with the “real world” needs of your users. While our competition can use the software we develop, they will at best wow users with specific features rather than project-wide ones. Never underestimate how grateful a user will be when you make their job easier.&lt;/li&gt;
  &lt;li&gt;Accept That A Patent Is Not A Business Model
  Patents are considered the ultimate control mechanism in the technology industry, but they only provide a business model if you have a monopoly and monopolies are illegal. Resist getting hung up on the control you can establish over your customers and spend your time acquiring and empowering them. The moment you both realize that your success is mutual, you have a relationship that will last longer than any single sale. You’ll be pleasantly surprised how the relationships you build will transcend the specific companies that friends you make work for.&lt;/li&gt;
  &lt;li&gt;Distinguish Leadership From Management
  Every company has various levels of management, but leadership is the magic that creates markets where they did not exist and aligns paying customers with value that you can deliver in a profitable manner. Leadership and vision are ultimately the most proprietary aspects of a technology business, over every patentable piece of hardware or licensable piece of software. Whether you create a new market or bring efficiency to an existing one, your leadership is your secret weapon -- not your level of control.&lt;/li&gt;
  &lt;/ul&gt;
  &lt;hr&gt;


&lt;h2&gt;News Roundup&lt;/h2&gt;



&lt;h3&gt;&lt;a href="https://www.skyforge.at/posts/an-introduction-to-jails-and-jail-networking/"&gt;Introduction to Jails and Jail Networking on FreeBSD&lt;/a&gt;&lt;/h3&gt;



&lt;blockquote&gt;
  &lt;p&gt;Jails basically partition a FreeBSD system into various isolated sub-systems called jails. The syscall and userspace tools first appeared in FreeBSD 4.0 (~ March 2000) with subsequent releases expanding functionality and improving existing features as well as usability.
  + For Linux users, jails are similar to LXC, used for resource/process isolation. Unlike LXC however, jails are a first-class concept and are well integrated into the base system. Essentially however, both offer a chroot-with-extra-separation feeling.
  Setting up a jail is a fairly simple process, which can essentially be split into three steps:
    + Place the stuff you want to run and the stuff it needs to run somewhere on your filesystem.
    + Add some basic configuration for the jail in jail.conf.
    + Fire up the jail.
  To confirm that the jail started successfully we can use the jls utility:
  We can now enter the jailed environment by using jexec, which will by default execute a root shell inside the named jail
  A jail can only see and use addresses that have been passed down to it by the parent system. This creates a slight problem with the loopback address: The host would probably like to keep that address to itself and not share it with any jail.
  Because of this, the loopback-address inside a jail is emulated by the system:
    + 127.0.0.1 is an alias for the first IPv4-address assigned to the jail.
    + ::1 is an alias for the first IPv6-address assigned to the jail.
  While this looks simple enough and usually works just fine[tm], it is also a source of many problems. Just imagine if your jail has only one single global IPv4 assigned to it. A daemon binding its (possibly unsecured) control port to the loopback-address would then unwillingly be exposed to the rest of the internet, which is hardly ever a good idea.
  + So, create an extra loopback adapter, and make the first IP in each jail a private loopback address
  + The tutorial goes on to cover making multiple jails share a single public IP address using NAT
  + It also covers more advanced concepts like ‘thin’ jails, to save some disk space if you are going to create a large number of jails, and how to upgrade them after the fact
  + Finally, it covers the integration with a lot of common tools, like identifying and filter jailed processes using top and ps, or using the package managers support for jails to install packages in a jail from the outside.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;



**DigitalOcean**



&lt;h3&gt;SmartOS release-20180315&lt;/h3&gt;

```

Hello All,

The latest bi-weekly "release" branch build of SmartOS is up:


&lt;pre&gt;&lt;code&gt;curl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest.iso
curl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest-USB.img.bz2
curl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest.vmwarevm.tar.bz2
&lt;/code&gt;&lt;/pre&gt;

A generated changelog is here:

&lt;pre&gt;&lt;code&gt;https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos.html#20180329T002644Z
&lt;/code&gt;&lt;/pre&gt;

The full build bits directory, for those interested, is here in Manta:

&lt;pre&gt;&lt;code&gt;/Joyent_Dev/public/SmartOS/20180329T002644Z
&lt;/code&gt;&lt;/pre&gt;

&lt;h1&gt;Highlights&lt;/h1&gt;

Firewall rules created with fwadm(1M) can now use the PRIORITY keyword to
specify a higher precedence for a rule.

This release has includes mitigation of the Intel Meltdown vulnerability in the
form of kpti (kernel page table isolation) with PCID (process context
identifier) support

This release also includes experimental support for bhyve branded zones.




&lt;h1&gt;General Info&lt;/h1&gt;

Every second Thursday we roll a "release-YYYYMMDD" release branch and
builds for SmartOS (and Triton DataCenter and Manta, as well).

Cheers,
Josh Wilsdon, on behalf of the SmartOS developers
https://smartos.org
``` 

&lt;ul&gt;
&lt;li&gt;Here's a screencap from q5sys' machine showing the output of sysinfo: https://i.imgur.com/MFkNi76.jpg&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://www.freebsdfoundation.org/wp-content/uploads/2018/03/FreeBSD-Foundation-March-2018-Update-1.pdf"&gt;FreeBSD Foundation March 2018 Update&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;&amp;gt; Syzkaller update: Syzkaller is a coverage-guided system call fuzzer. It invokes syscalls with arbitrary and changing inputs, and is intended to use code coverage data to guide changes to system call inputs in order to access larger and larger portions of the kernel in the search for bugs.&lt;/li&gt;
&lt;li&gt;&amp;gt; Last term’s student focused largely on scripts to deploy and configure Syzkaller on Packet.net’s hosting infrastructure, but did not get to the code coverage integration required for Syzkaller to be effective. This term co-op student Mitchell Horne has been adding code coverage support in FreeBSD for Syzkaller.&lt;/li&gt;
&lt;li&gt;&amp;gt; The Linux code coverage support for Syzkaller is known as kcov and was submitted by Dmitry Vyukov, Syzkaller’s author. Kcov is purposebuilt for Syzkaller:
&lt;ul&gt;
&lt;li&gt;&amp;gt; kcov provides code coverage collection for coverage-guided fuzzing (randomized testing). Coverage-guided fuzzing is a testing technique that uses coverage feedback to determine new interesting inputs to a system.&lt;/li&gt;
&lt;li&gt;&amp;gt; kcov does not aim to collect as much coverage as possible. It aims to collect more or less stable coverage that is function of syscall inputs. To achieve this goal it does not collect coverage in soft/hard interrupts and instrumentation of some inherently non-deterministic or non-interesting parts of kernel is disabled (e.g. scheduler, locking).&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;&amp;gt; Mitchell implemented equivalent functionality for FreeBSD - a distinct implementation, but modelled on the one in Linux. These patches are currently in review, as are minor changes to Syzkaller to use the new interface on FreeBSD.&lt;/li&gt;
&lt;li&gt;&amp;gt; We still have some additional work to fully integrate Syzkaller and run it on a consistent basis, but the brief testing that has been completed suggests this work will provide a very valuable improvement in test coverage and opportunities for system hardening: we tested Syzkaller with Mitchell's code coverage patch over a weekend. It provoked kernel crashes hundreds of times faster than without his work.&lt;/li&gt;
&lt;li&gt;&amp;gt; I want to say thank you to NetApp for becoming an Iridium Partner again this
year! (Donations between $100,000 - $249,999) It’s companies like NetApp, who recognize the importance of supporting our efforts, that allow us to continue to provide software improvements, advocate for FreeBSD, and help lead the release engineering and security efforts.&lt;/li&gt;
&lt;li&gt;&amp;gt; Conference Recap: FOSSASIA 2018&lt;/li&gt;
&lt;li&gt;Foundation Director Philip Paeps went to FOSSASIA, which is possibly the largest open source event in Asia. The FreeBSD Foundation sponsored the conference.&lt;/li&gt;
&lt;li&gt;Our booth had a constant stream of traffic over the weekend and we handed out hundreds of FreeBSD stickers, pens and flyers. Many attendees of FOSSASIA had never heard of FreeBSD before and are now keen to start exploring and perhaps even contributing. By the end of the conference, there were FreeBSD stickers everywhere!&lt;/li&gt;
&lt;li&gt;&amp;gt; One particular hallway-track conversation led to an invitation to present FreeBSD at a "Women Who Code" evening in Kuala Lumpur later this week (Thursday 29th March). I spent the days after the conference meeting companies who use (or want to use) FreeBSD in Singapore.&lt;/li&gt;
&lt;li&gt;&amp;gt; SCaLE 16x: The Foundation sponsored a FreeBSD table in the expo hall that was
staffed by Dru Lavigne, Warren Block, and Deb Goodkin. Our purpose was to promote FreeBSD, and attract more users and contributors to the Project. We had a steady flow of people stopping by our table, asking inquisitive questions, and picking up some cool swag and FreeBSD handouts.&lt;/li&gt;
&lt;li&gt;Deb Goodkin took some tutorials/trainings there and talked to a lot of other open source projects.&lt;/li&gt;
&lt;li&gt;&lt;blockquote&gt;
  &lt;p&gt;Next year, we have the opportunity to have a BSD track, similar to the BSD Devroom at FOSDEM. We are looking for some volunteers in Southern California who can help organize this one or two-day event and help us educate more people about the BSDs. Let us know if you
  would like to help with this effort.&lt;/p&gt;
&lt;/blockquote&gt;&lt;/li&gt;
&lt;li&gt;&lt;blockquote&gt;
  &lt;p&gt;Roll Call: #WhoUsesFreeBSD&lt;/p&gt;
&lt;/blockquote&gt;&lt;/li&gt;
&lt;li&gt;&lt;blockquote&gt;
  &lt;p&gt;Many of you probably saw our post on social media asking Who Uses FreeBSD. Please help us answer this question to assist us in determining FreeBSD market share data, promote how companies are successfully using FreeBSD to encourage more companies to embrace
  FreeBSD, and to update the list of users on our website. Knowing who uses FreeBSD helps our contributors know where to look for jobs; knowing what universities teach with FreeBSD, helps companies know where to recruit, and knowing what products use FreeBSD helps us determine what features and technologies to support.&lt;/p&gt;
&lt;/blockquote&gt;&lt;/li&gt;
&lt;li&gt;&lt;blockquote&gt;
  &lt;p&gt;New Hosting Partner: Oregon State University Open Source Lab&lt;/p&gt;
&lt;/blockquote&gt;&lt;/li&gt;
&lt;li&gt;&amp;gt; We are pleased to announce that the Oregon State University (OSU) Open Source Lab (OSL), which hosts infrastructure for over 160 different open source projects, has agreed to host some of our servers for FreeBSD development.  The first server, which should be arriving shortly, is an HP Enterprise Proliant DL360 Gen10 configured with NVDIMM memory which will be initially used for further development and testing of permanent memory support in the kernel.&lt;/li&gt;
&lt;li&gt;Stay tuned for more news from the FreeBSD Foundation in May (next newsletter).&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://daniel.haxx.se/blog/2018/03/20/twenty-years-1998-2018/"&gt;cURL is 20 today&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.skyforge.at/posts/a-note-in-sysvipc-and-jails-on-freebsd/"&gt;A Note on SYSVIPC and Jails on FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://marc.info/?l=openbsd-announce&amp;amp;m=152149507725894&amp;amp;w=2"&gt;OpenBSD Errata: March 20th, 2018 (ipsec)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/security/advisories.html"&gt;FreeBSD Security Advisories for IPSEC and vt &lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.tecmint.com/pkg-command-examples-to-manage-packages-in-freebsd/"&gt;23 Useful PKG Command Examples to Manage Packages in FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;

&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Casey - &lt;a href="http://dpaste.com/2VMH555#wrap"&gt;Cool Editor&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Nelson - &lt;a href="http://dpaste.com/2NTE4SD#wrap"&gt;New article on FreeBSD vs MacOS&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Damian - &lt;a href="http://dpaste.com/0FYWVHD#wrap"&gt;Mysterious Reverse Proxy 504&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Nelson - &lt;a href="http://dpaste.com/0BTGTVP#wrap"&gt;FreeBSD, rsync, nasty bug, now fixed&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>TrueOS Stable 18.03 released, a look at F-stack, the secret to an open source business model, intro to jails and jail networking, FreeBSD Foundation March update, and the ipsec Errata.</p>

<h2>Headlines</h2>

<h3><a href="https://trueos.org/blog/trueos-stable-18-03-release/">TrueOS STABLE 18.03 Release</a></h3>

<blockquote>
  <p>The TrueOS team is pleased to announce the availability of a new STABLE release of the TrueOS project (version 18.03). This is a special release due to the security issues impacting the computing world since the beginning of 2018. In particular, mitigating the “Meltdown” and “Spectre” system exploits make it necessary to update the entire package ecosystem for TrueOS. This release does not replace the scheduled June STABLE update, but provides the necessary and expected security updates for the STABLE release branch of TrueOS, even though this is part-way through our normal release cycle.</p>
</blockquote>

<ul>
<li><p>Important changes between version 17.12 and 18.03</p>

<ul><li>“Meltdown” security fixes: This release contains all the fixes to FreeBSD which mitigate the security issues for systems that utilize Intel-based processors when running virtual machines such as FreeBSD jails. Please note that virtual machines or jails must also be updated to a version of FreeBSD or TrueOS which contains these security fixes.</li>
<li>“Spectre” security mitigations: This release contains all current mitigations from FreeBSD HEAD for the Spectre memory-isolation attacks (Variant 2). All 3rd-party packages for this release are also compiled with LLVM/Clang 6 (the “retpoline” mitigation strategy). This fixes many memory allocation issues and enforces stricter requirements for code completeness and memory usage within applications. Unfortunately, some 3rd-party applications became unavailable as pre-compiled packages due to non-compliance with these updated standards. These applications are currently being fixed either by the upstream authors or the FreeBSD port maintainers. If there are any concerns about the availability of a critical application for a specific workflow, please search through the changelog of packages between TrueOS 17.12 and 18.03 to verify the status of the application.</li></ul></li>
</ul>

<blockquote>
  <p>Most systems will need microcode updates for additional Spectre mitigations. The microcode updates are not enabled by default. This work is considered experimental because it is in active development by the upstream vendors. If desired, the microcode updates are available with the new devcpu-data package, which is available in the Appcafe. Install this package and enable the new microcode_update service to apply the latest runtime code when booting the system.</p>
</blockquote>

<ul>
<li><p>Important security-based package updates</p>

<ul><li>LibreSSL is updated from version 2.6.3 -> 2.6.4</li>
<li>Reminder: LibreSSL is used on TrueOS to build any package which does not explicitly require OpenSSL. All applications that utilize the SSL transport layer are now running with the latest security updates.</li>
<li>Browser updates: (Keep in mind that many browsers have also implemented their own security mitigations in the aftermath of the Spectre exploit.)</li>
<li>Firefox: 57.0.1 -> 58.0.2</li>
<li>Chromium: 61.0.3163.100 -> 63.0.3239.132</li>
<li>Qt5 Webengine (QupZilla, Falkon, many others): 5.7.1 -> 5.9.4</li></ul></li>
<li><p>All pre-compiled packages for this release are built with the latest versions of LLVM/Clang, unless the package explicitly requires GCC. These packages also utilize the latest compile-time mitigations for memory-access security concerns.</p></li>
</ul>

<p><hr /></p>

<h3><a href="https://github.com/F-Stack/f-stack">F-Stack</a></h3>

<blockquote>
  <p>F-Stack is an user space network development kit with high performance based on DPDK, FreeBSD TCP/IP stack and coroutine API. http://www.f-stack.org</p>
</blockquote>

<ul>
<li><p>Introduction
With the rapid development of NIC, the poor performance of data packets processing with Linux kernel has become the bottleneck. However, the rapid development of the Internet needs high performance of network processing, kernel bypass has caught more and more attentions. There are various similar technologies appear, such as DPDK, NETMAP and PF_RING. The main idea of kernel bypass is that Linux is only used to deal with control flow, all data streams are processed in user space. Therefore, kernel bypass can avoid performance bottlenecks caused by kernel packet copying, thread scheduling, system calls and interrupts. Furthermore, kernel bypass can achieve higher performance with multi optimizing methods. Within various techniques, DPDK has been widely used because of its more thorough isolation from kernel scheduling and active community support.</p></li>
<li><p>F-Stack is an open source network framework with high performance based on DPDK. With following characteristics</p>

<ul><li>Ultra high network performance which can achieve network card under full load, 10 million concurrent connections, 5 million RPS, 1 million CPS.</li>
<li>Transplant FreeBSD 11.01 user space stack, provides a complete stack function, cut a great amount of irrelevant features. Therefore greatly enhance the performance.</li>
<li>Support Nginx, Redis and other mature applications, service can easily use F-Stack</li>
<li>With Multi-process architecture, easy to extend</li>
<li>Provide micro thread interface. Various applications with stateful app can easily use F-Stack to get high performance without processing complex asynchronous logic.</li>
<li>Provide Epoll/Kqueue interface that allow many kinds of applications easily use F-Stack</li></ul></li>
<li><p>History</p></li>
</ul>

<blockquote>
  <p>In order to deal with the increasingly severe DDoS attacks, authorized DNS server of Tencent Cloud DNSPod switched from Gigabit Ethernet to 10-Gigabit at the end of 2012. We faced several options, one is to continue to use the original model another is to use kernel bypass technology. After several rounds of investigation, we finally chose to develop our next generation of DNS server based on DPDK. The reason is DPDK provides ultra-high performance and can be seamlessly extended to 40G, or even 100G NIC in the future.</p>
  
  <p>After several months of development and testing, DKDNS, high-performance DNS server based on DPDK officially released in October 2013. It's capable of achieving up to 11 million QPS with a single 10GE port and 18.2 million QPS with two 10GE ports. And then we developed a user-space TCP/IP stack called F-Stack that can process 0.6 million RPS with a single 10GE port.</p>
  
  <p>With the fast growth of Tencent Cloud, more and more services need higher network access performance. Meanwhile, F-Stack was continuous improving driven by the business growth, and ultimately developed into a general network access framework. But this TCP/IP stack couldn't meet the needs of these services while continue to develop and maintain a complete network stack will cost high, we've tried several plans and finally determined to port FreeBSD(11.0 stable) TCP/IP stack into F-Stack. Thus, we can reduce the cost of maintenance and follow up the improvement from community quickly.Thanks to libplebnet and libuinet, this work becomes a lot easier.</p>
  
  <p>With the rapid development of all kinds of application, in order to help different APPs quick and easily use F-Stack, F-Stack has integrated Nginx, Redis and other commonly used APPs, and a micro thread framework, and provides a standard Epoll/Kqueue interface.</p>
  
  <p>Currently, besides authorized DNS server of DNSPod, there are various products in Tencent Cloud has used the F-Stack, such as HttpDNS (D+), COS access module, CDN access module, etc..</p>
</blockquote>

<p><hr /></p>

<p><strong>iXsystems</strong></p>

<h3><a href="https://www.forbes.com/sites/forbestechcouncil/2018/04/02/leadership-is-the-secret-to-an-open-source-business-model/#a2beca765c78">Leadership Is The Secret To An Open Source Business Model</a></h3>

<ul>
<li>A Forbes article by Mike Lauth, CEO of iXsystems


<blockquote>
  There is a good chance you’ve never heard of open source software and an even greater one that you’re using it every day without even realizing it. Open source software is computer software that is available under a variety of licenses that all encourage the sharing of the software and its underlying source code. Open source has powered the internet from day one and today powers the cloud and just about everything connected to it from your mobile phone to virtually every internet of things device.
  FreeNAS is one of two open source operating systems that my company, iXsystems, develops and distributes free of charge and is at the heart of our line of TrueNAS enterprise storage products. While some of our competitors sell storage software similar to FreeNAS, we not only give it away but also do so with truly no strings attached -- competitors can and do take FreeNAS and build products based on it with zero obligation to share their changes. The freedom to do so is the fundamental tenet of permissively licensed open source software, and while it sounds self-defeating to be this generous, we’ve proven that leadership, not licensing, is the true secret to a successful open source business model.
  We each have our own personal definition of what is fair when it comes to open source. At iXsystems, we made a conscious decision to base FreeNAS and TrueOS on the FreeBSD operating system developed by the FreeBSD project. We stand on the shoulders of giants by using FreeBSD and we consider it quite reasonable to give back on the same generous terms that the FreeBSD project offers us. We could be selective in what we provide free of charge, but we believe that doing so would be short-sighted. In the long game we’re playing, the leadership we provide over the open source projects we produce is infinitely more important than any restrictions provided by the licenses of those and other open source projects.
  Twenty years in, we have no reason to change our free-software-on-great-hardware business model and giving away the software has brought an unexpected side-benefit: the largest Q/A department in the world, staffed by our passionate users who volunteer to let us know every thought they have about our software. We wouldn’t change a thing, and I encourage you to find exactly what win-win goodwill you and your company can provide to your constituents to make them not just a customer base but a community.</li>
  <li>Drive The Conversation
  It took a leap of faith for us to give away the heart of our products in exchange for a passionate community, but doing so changes your customer's relationship with your brand from priced to priceless. This kind of relationship leverages a social contract instead of a legal one. Taking this approach empowers your users in ways they will not experience with other companies and it is your responsibility to lead, rather than control them with a project like FreeNAS</li>
  <li>Relieve Customer Pain Points With Every New Release
  Responsiveness to the needs of your constituents is what distinguishes project leadership from project dictatorship. Be sure to balance your vision for your products and projects with the “real world” needs of your users. While our competition can use the software we develop, they will at best wow users with specific features rather than project-wide ones. Never underestimate how grateful a user will be when you make their job easier.</li>
  <li>Accept That A Patent Is Not A Business Model
  Patents are considered the ultimate control mechanism in the technology industry, but they only provide a business model if you have a monopoly and monopolies are illegal. Resist getting hung up on the control you can establish over your customers and spend your time acquiring and empowering them. The moment you both realize that your success is mutual, you have a relationship that will last longer than any single sale. You’ll be pleasantly surprised how the relationships you build will transcend the specific companies that friends you make work for.</li>
  <li>Distinguish Leadership From Management
  Every company has various levels of management, but leadership is the magic that creates markets where they did not exist and aligns paying customers with value that you can deliver in a profitable manner. Leadership and vision are ultimately the most proprietary aspects of a technology business, over every patentable piece of hardware or licensable piece of software. Whether you create a new market or bring efficiency to an existing one, your leadership is your secret weapon -- not your level of control.</li>
  </ul>
  <hr />
</blockquote>

<h2>News Roundup</h2>



<h3><a href="https://www.skyforge.at/posts/an-introduction-to-jails-and-jail-networking/">Introduction to Jails and Jail Networking on FreeBSD</a></h3>



<blockquote>
  <p>Jails basically partition a FreeBSD system into various isolated sub-systems called jails. The syscall and userspace tools first appeared in FreeBSD 4.0 (~ March 2000) with subsequent releases expanding functionality and improving existing features as well as usability.
  + For Linux users, jails are similar to LXC, used for resource/process isolation. Unlike LXC however, jails are a first-class concept and are well integrated into the base system. Essentially however, both offer a chroot-with-extra-separation feeling.
  Setting up a jail is a fairly simple process, which can essentially be split into three steps:
    + Place the stuff you want to run and the stuff it needs to run somewhere on your filesystem.
    + Add some basic configuration for the jail in jail.conf.
    + Fire up the jail.
  To confirm that the jail started successfully we can use the jls utility:
  We can now enter the jailed environment by using jexec, which will by default execute a root shell inside the named jail
  A jail can only see and use addresses that have been passed down to it by the parent system. This creates a slight problem with the loopback address: The host would probably like to keep that address to itself and not share it with any jail.
  Because of this, the loopback-address inside a jail is emulated by the system:
    + 127.0.0.1 is an alias for the first IPv4-address assigned to the jail.
    + ::1 is an alias for the first IPv6-address assigned to the jail.
  While this looks simple enough and usually works just fine[tm], it is also a source of many problems. Just imagine if your jail has only one single global IPv4 assigned to it. A daemon binding its (possibly unsecured) control port to the loopback-address would then unwillingly be exposed to the rest of the internet, which is hardly ever a good idea.
  + So, create an extra loopback adapter, and make the first IP in each jail a private loopback address
  + The tutorial goes on to cover making multiple jails share a single public IP address using NAT
  + It also covers more advanced concepts like ‘thin’ jails, to save some disk space if you are going to create a large number of jails, and how to upgrade them after the fact
  + Finally, it covers the integration with a lot of common tools, like identifying and filter jailed processes using top and ps, or using the package managers support for jails to install packages in a jail from the outside.</p>
</blockquote>

<hr />



**DigitalOcean**



<h3>SmartOS release-20180315</h3>

```

Hello All,

The latest bi-weekly "release" branch build of SmartOS is up:


<pre><code>curl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest.iso
curl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest-USB.img.bz2
curl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest.vmwarevm.tar.bz2
</code></pre>

A generated changelog is here:

<pre><code>https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos.html#20180329T002644Z
</code></pre>

The full build bits directory, for those interested, is here in Manta:

<pre><code>/Joyent_Dev/public/SmartOS/20180329T002644Z
</code></pre>

<h1>Highlights</h1>

Firewall rules created with fwadm(1M) can now use the PRIORITY keyword to
specify a higher precedence for a rule.

This release has includes mitigation of the Intel Meltdown vulnerability in the
form of kpti (kernel page table isolation) with PCID (process context
identifier) support

This release also includes experimental support for bhyve branded zones.




<h1>General Info</h1>

Every second Thursday we roll a "release-YYYYMMDD" release branch and
builds for SmartOS (and Triton DataCenter and Manta, as well).

Cheers,
Josh Wilsdon, on behalf of the SmartOS developers
https://smartos.org
``` 

<ul>
<li>Here's a screencap from q5sys' machine showing the output of sysinfo: https://i.imgur.com/MFkNi76.jpg</li>
</ul>

<p><hr /></p>

<h3><a href="https://www.freebsdfoundation.org/wp-content/uploads/2018/03/FreeBSD-Foundation-March-2018-Update-1.pdf">FreeBSD Foundation March 2018 Update</a></h3>

<ul>
<li>> Syzkaller update: Syzkaller is a coverage-guided system call fuzzer. It invokes syscalls with arbitrary and changing inputs, and is intended to use code coverage data to guide changes to system call inputs in order to access larger and larger portions of the kernel in the search for bugs.</li>
<li>> Last term’s student focused largely on scripts to deploy and configure Syzkaller on Packet.net’s hosting infrastructure, but did not get to the code coverage integration required for Syzkaller to be effective. This term co-op student Mitchell Horne has been adding code coverage support in FreeBSD for Syzkaller.</li>
<li>> The Linux code coverage support for Syzkaller is known as kcov and was submitted by Dmitry Vyukov, Syzkaller’s author. Kcov is purposebuilt for Syzkaller:
<ul><li>> kcov provides code coverage collection for coverage-guided fuzzing (randomized testing). Coverage-guided fuzzing is a testing technique that uses coverage feedback to determine new interesting inputs to a system.</li>
<li>> kcov does not aim to collect as much coverage as possible. It aims to collect more or less stable coverage that is function of syscall inputs. To achieve this goal it does not collect coverage in soft/hard interrupts and instrumentation of some inherently non-deterministic or non-interesting parts of kernel is disabled (e.g. scheduler, locking).</li></ul></li>
<li>> Mitchell implemented equivalent functionality for FreeBSD - a distinct implementation, but modelled on the one in Linux. These patches are currently in review, as are minor changes to Syzkaller to use the new interface on FreeBSD.</li>
<li>> We still have some additional work to fully integrate Syzkaller and run it on a consistent basis, but the brief testing that has been completed suggests this work will provide a very valuable improvement in test coverage and opportunities for system hardening: we tested Syzkaller with Mitchell's code coverage patch over a weekend. It provoked kernel crashes hundreds of times faster than without his work.</li>
<li>> I want to say thank you to NetApp for becoming an Iridium Partner again this
year! (Donations between $100,000 - $249,999) It’s companies like NetApp, who recognize the importance of supporting our efforts, that allow us to continue to provide software improvements, advocate for FreeBSD, and help lead the release engineering and security efforts.</li>
<li>> Conference Recap: FOSSASIA 2018</li>
<li>Foundation Director Philip Paeps went to FOSSASIA, which is possibly the largest open source event in Asia. The FreeBSD Foundation sponsored the conference.</li>
<li>Our booth had a constant stream of traffic over the weekend and we handed out hundreds of FreeBSD stickers, pens and flyers. Many attendees of FOSSASIA had never heard of FreeBSD before and are now keen to start exploring and perhaps even contributing. By the end of the conference, there were FreeBSD stickers everywhere!</li>
<li>> One particular hallway-track conversation led to an invitation to present FreeBSD at a "Women Who Code" evening in Kuala Lumpur later this week (Thursday 29th March). I spent the days after the conference meeting companies who use (or want to use) FreeBSD in Singapore.</li>
<li>> SCaLE 16x: The Foundation sponsored a FreeBSD table in the expo hall that was
staffed by Dru Lavigne, Warren Block, and Deb Goodkin. Our purpose was to promote FreeBSD, and attract more users and contributors to the Project. We had a steady flow of people stopping by our table, asking inquisitive questions, and picking up some cool swag and FreeBSD handouts.</li>
<li>Deb Goodkin took some tutorials/trainings there and talked to a lot of other open source projects.</li>
<li><blockquote>
  <p>Next year, we have the opportunity to have a BSD track, similar to the BSD Devroom at FOSDEM. We are looking for some volunteers in Southern California who can help organize this one or two-day event and help us educate more people about the BSDs. Let us know if you
  would like to help with this effort.</p>
</blockquote></li>
<li><blockquote>
  <p>Roll Call: #WhoUsesFreeBSD</p>
</blockquote></li>
<li><blockquote>
  <p>Many of you probably saw our post on social media asking Who Uses FreeBSD. Please help us answer this question to assist us in determining FreeBSD market share data, promote how companies are successfully using FreeBSD to encourage more companies to embrace
  FreeBSD, and to update the list of users on our website. Knowing who uses FreeBSD helps our contributors know where to look for jobs; knowing what universities teach with FreeBSD, helps companies know where to recruit, and knowing what products use FreeBSD helps us determine what features and technologies to support.</p>
</blockquote></li>
<li><blockquote>
  <p>New Hosting Partner: Oregon State University Open Source Lab</p>
</blockquote></li>
<li>> We are pleased to announce that the Oregon State University (OSU) Open Source Lab (OSL), which hosts infrastructure for over 160 different open source projects, has agreed to host some of our servers for FreeBSD development.  The first server, which should be arriving shortly, is an HP Enterprise Proliant DL360 Gen10 configured with NVDIMM memory which will be initially used for further development and testing of permanent memory support in the kernel.</li>
<li>Stay tuned for more news from the FreeBSD Foundation in May (next newsletter).</li>
</ul>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://daniel.haxx.se/blog/2018/03/20/twenty-years-1998-2018/">cURL is 20 today</a></li>
<li><a href="https://www.skyforge.at/posts/a-note-in-sysvipc-and-jails-on-freebsd/">A Note on SYSVIPC and Jails on FreeBSD</a></li>
<li><a href="https://marc.info/?l=openbsd-announce&amp;m=152149507725894&amp;w=2">OpenBSD Errata: March 20th, 2018 (ipsec)</a></li>
<li><a href="https://www.freebsd.org/security/advisories.html">FreeBSD Security Advisories for IPSEC and vt </a></li>
<li><a href="https://www.tecmint.com/pkg-command-examples-to-manage-packages-in-freebsd/">23 Useful PKG Command Examples to Manage Packages in FreeBSD</a></li>
</ul>

<p><hr /></p>

<p><strong>Tarsnap</strong></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Casey - <a href="http://dpaste.com/2VMH555#wrap">Cool Editor</a></li>
<li>Nelson - <a href="http://dpaste.com/2NTE4SD#wrap">New article on FreeBSD vs MacOS</a></li>
<li>Damian - <a href="http://dpaste.com/0FYWVHD#wrap">Mysterious Reverse Proxy 504</a></li>
<li>Nelson - <a href="http://dpaste.com/0BTGTVP#wrap">FreeBSD, rsync, nasty bug, now fixed</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>TrueOS Stable 18.03 released, a look at F-stack, the secret to an open source business model, intro to jails and jail networking, FreeBSD Foundation March update, and the ipsec Errata.</p>

<h2>Headlines</h2>

<h3><a href="https://trueos.org/blog/trueos-stable-18-03-release/">TrueOS STABLE 18.03 Release</a></h3>

<blockquote>
  <p>The TrueOS team is pleased to announce the availability of a new STABLE release of the TrueOS project (version 18.03). This is a special release due to the security issues impacting the computing world since the beginning of 2018. In particular, mitigating the “Meltdown” and “Spectre” system exploits make it necessary to update the entire package ecosystem for TrueOS. This release does not replace the scheduled June STABLE update, but provides the necessary and expected security updates for the STABLE release branch of TrueOS, even though this is part-way through our normal release cycle.</p>
</blockquote>

<ul>
<li><p>Important changes between version 17.12 and 18.03</p>

<ul><li>“Meltdown” security fixes: This release contains all the fixes to FreeBSD which mitigate the security issues for systems that utilize Intel-based processors when running virtual machines such as FreeBSD jails. Please note that virtual machines or jails must also be updated to a version of FreeBSD or TrueOS which contains these security fixes.</li>
<li>“Spectre” security mitigations: This release contains all current mitigations from FreeBSD HEAD for the Spectre memory-isolation attacks (Variant 2). All 3rd-party packages for this release are also compiled with LLVM/Clang 6 (the “retpoline” mitigation strategy). This fixes many memory allocation issues and enforces stricter requirements for code completeness and memory usage within applications. Unfortunately, some 3rd-party applications became unavailable as pre-compiled packages due to non-compliance with these updated standards. These applications are currently being fixed either by the upstream authors or the FreeBSD port maintainers. If there are any concerns about the availability of a critical application for a specific workflow, please search through the changelog of packages between TrueOS 17.12 and 18.03 to verify the status of the application.</li></ul></li>
</ul>

<blockquote>
  <p>Most systems will need microcode updates for additional Spectre mitigations. The microcode updates are not enabled by default. This work is considered experimental because it is in active development by the upstream vendors. If desired, the microcode updates are available with the new devcpu-data package, which is available in the Appcafe. Install this package and enable the new microcode_update service to apply the latest runtime code when booting the system.</p>
</blockquote>

<ul>
<li><p>Important security-based package updates</p>

<ul><li>LibreSSL is updated from version 2.6.3 -> 2.6.4</li>
<li>Reminder: LibreSSL is used on TrueOS to build any package which does not explicitly require OpenSSL. All applications that utilize the SSL transport layer are now running with the latest security updates.</li>
<li>Browser updates: (Keep in mind that many browsers have also implemented their own security mitigations in the aftermath of the Spectre exploit.)</li>
<li>Firefox: 57.0.1 -> 58.0.2</li>
<li>Chromium: 61.0.3163.100 -> 63.0.3239.132</li>
<li>Qt5 Webengine (QupZilla, Falkon, many others): 5.7.1 -> 5.9.4</li></ul></li>
<li><p>All pre-compiled packages for this release are built with the latest versions of LLVM/Clang, unless the package explicitly requires GCC. These packages also utilize the latest compile-time mitigations for memory-access security concerns.</p></li>
</ul>

<p><hr /></p>

<h3><a href="https://github.com/F-Stack/f-stack">F-Stack</a></h3>

<blockquote>
  <p>F-Stack is an user space network development kit with high performance based on DPDK, FreeBSD TCP/IP stack and coroutine API. http://www.f-stack.org</p>
</blockquote>

<ul>
<li><p>Introduction
With the rapid development of NIC, the poor performance of data packets processing with Linux kernel has become the bottleneck. However, the rapid development of the Internet needs high performance of network processing, kernel bypass has caught more and more attentions. There are various similar technologies appear, such as DPDK, NETMAP and PF_RING. The main idea of kernel bypass is that Linux is only used to deal with control flow, all data streams are processed in user space. Therefore, kernel bypass can avoid performance bottlenecks caused by kernel packet copying, thread scheduling, system calls and interrupts. Furthermore, kernel bypass can achieve higher performance with multi optimizing methods. Within various techniques, DPDK has been widely used because of its more thorough isolation from kernel scheduling and active community support.</p></li>
<li><p>F-Stack is an open source network framework with high performance based on DPDK. With following characteristics</p>

<ul><li>Ultra high network performance which can achieve network card under full load, 10 million concurrent connections, 5 million RPS, 1 million CPS.</li>
<li>Transplant FreeBSD 11.01 user space stack, provides a complete stack function, cut a great amount of irrelevant features. Therefore greatly enhance the performance.</li>
<li>Support Nginx, Redis and other mature applications, service can easily use F-Stack</li>
<li>With Multi-process architecture, easy to extend</li>
<li>Provide micro thread interface. Various applications with stateful app can easily use F-Stack to get high performance without processing complex asynchronous logic.</li>
<li>Provide Epoll/Kqueue interface that allow many kinds of applications easily use F-Stack</li></ul></li>
<li><p>History</p></li>
</ul>

<blockquote>
  <p>In order to deal with the increasingly severe DDoS attacks, authorized DNS server of Tencent Cloud DNSPod switched from Gigabit Ethernet to 10-Gigabit at the end of 2012. We faced several options, one is to continue to use the original model another is to use kernel bypass technology. After several rounds of investigation, we finally chose to develop our next generation of DNS server based on DPDK. The reason is DPDK provides ultra-high performance and can be seamlessly extended to 40G, or even 100G NIC in the future.</p>
  
  <p>After several months of development and testing, DKDNS, high-performance DNS server based on DPDK officially released in October 2013. It's capable of achieving up to 11 million QPS with a single 10GE port and 18.2 million QPS with two 10GE ports. And then we developed a user-space TCP/IP stack called F-Stack that can process 0.6 million RPS with a single 10GE port.</p>
  
  <p>With the fast growth of Tencent Cloud, more and more services need higher network access performance. Meanwhile, F-Stack was continuous improving driven by the business growth, and ultimately developed into a general network access framework. But this TCP/IP stack couldn't meet the needs of these services while continue to develop and maintain a complete network stack will cost high, we've tried several plans and finally determined to port FreeBSD(11.0 stable) TCP/IP stack into F-Stack. Thus, we can reduce the cost of maintenance and follow up the improvement from community quickly.Thanks to libplebnet and libuinet, this work becomes a lot easier.</p>
  
  <p>With the rapid development of all kinds of application, in order to help different APPs quick and easily use F-Stack, F-Stack has integrated Nginx, Redis and other commonly used APPs, and a micro thread framework, and provides a standard Epoll/Kqueue interface.</p>
  
  <p>Currently, besides authorized DNS server of DNSPod, there are various products in Tencent Cloud has used the F-Stack, such as HttpDNS (D+), COS access module, CDN access module, etc..</p>
</blockquote>

<p><hr /></p>

<p><strong>iXsystems</strong></p>

<h3><a href="https://www.forbes.com/sites/forbestechcouncil/2018/04/02/leadership-is-the-secret-to-an-open-source-business-model/#a2beca765c78">Leadership Is The Secret To An Open Source Business Model</a></h3>

<ul>
<li>A Forbes article by Mike Lauth, CEO of iXsystems


<blockquote>
  There is a good chance you’ve never heard of open source software and an even greater one that you’re using it every day without even realizing it. Open source software is computer software that is available under a variety of licenses that all encourage the sharing of the software and its underlying source code. Open source has powered the internet from day one and today powers the cloud and just about everything connected to it from your mobile phone to virtually every internet of things device.
  FreeNAS is one of two open source operating systems that my company, iXsystems, develops and distributes free of charge and is at the heart of our line of TrueNAS enterprise storage products. While some of our competitors sell storage software similar to FreeNAS, we not only give it away but also do so with truly no strings attached -- competitors can and do take FreeNAS and build products based on it with zero obligation to share their changes. The freedom to do so is the fundamental tenet of permissively licensed open source software, and while it sounds self-defeating to be this generous, we’ve proven that leadership, not licensing, is the true secret to a successful open source business model.
  We each have our own personal definition of what is fair when it comes to open source. At iXsystems, we made a conscious decision to base FreeNAS and TrueOS on the FreeBSD operating system developed by the FreeBSD project. We stand on the shoulders of giants by using FreeBSD and we consider it quite reasonable to give back on the same generous terms that the FreeBSD project offers us. We could be selective in what we provide free of charge, but we believe that doing so would be short-sighted. In the long game we’re playing, the leadership we provide over the open source projects we produce is infinitely more important than any restrictions provided by the licenses of those and other open source projects.
  Twenty years in, we have no reason to change our free-software-on-great-hardware business model and giving away the software has brought an unexpected side-benefit: the largest Q/A department in the world, staffed by our passionate users who volunteer to let us know every thought they have about our software. We wouldn’t change a thing, and I encourage you to find exactly what win-win goodwill you and your company can provide to your constituents to make them not just a customer base but a community.</li>
  <li>Drive The Conversation
  It took a leap of faith for us to give away the heart of our products in exchange for a passionate community, but doing so changes your customer's relationship with your brand from priced to priceless. This kind of relationship leverages a social contract instead of a legal one. Taking this approach empowers your users in ways they will not experience with other companies and it is your responsibility to lead, rather than control them with a project like FreeNAS</li>
  <li>Relieve Customer Pain Points With Every New Release
  Responsiveness to the needs of your constituents is what distinguishes project leadership from project dictatorship. Be sure to balance your vision for your products and projects with the “real world” needs of your users. While our competition can use the software we develop, they will at best wow users with specific features rather than project-wide ones. Never underestimate how grateful a user will be when you make their job easier.</li>
  <li>Accept That A Patent Is Not A Business Model
  Patents are considered the ultimate control mechanism in the technology industry, but they only provide a business model if you have a monopoly and monopolies are illegal. Resist getting hung up on the control you can establish over your customers and spend your time acquiring and empowering them. The moment you both realize that your success is mutual, you have a relationship that will last longer than any single sale. You’ll be pleasantly surprised how the relationships you build will transcend the specific companies that friends you make work for.</li>
  <li>Distinguish Leadership From Management
  Every company has various levels of management, but leadership is the magic that creates markets where they did not exist and aligns paying customers with value that you can deliver in a profitable manner. Leadership and vision are ultimately the most proprietary aspects of a technology business, over every patentable piece of hardware or licensable piece of software. Whether you create a new market or bring efficiency to an existing one, your leadership is your secret weapon -- not your level of control.</li>
  </ul>
  <hr />
</blockquote>

<h2>News Roundup</h2>



<h3><a href="https://www.skyforge.at/posts/an-introduction-to-jails-and-jail-networking/">Introduction to Jails and Jail Networking on FreeBSD</a></h3>



<blockquote>
  <p>Jails basically partition a FreeBSD system into various isolated sub-systems called jails. The syscall and userspace tools first appeared in FreeBSD 4.0 (~ March 2000) with subsequent releases expanding functionality and improving existing features as well as usability.
  + For Linux users, jails are similar to LXC, used for resource/process isolation. Unlike LXC however, jails are a first-class concept and are well integrated into the base system. Essentially however, both offer a chroot-with-extra-separation feeling.
  Setting up a jail is a fairly simple process, which can essentially be split into three steps:
    + Place the stuff you want to run and the stuff it needs to run somewhere on your filesystem.
    + Add some basic configuration for the jail in jail.conf.
    + Fire up the jail.
  To confirm that the jail started successfully we can use the jls utility:
  We can now enter the jailed environment by using jexec, which will by default execute a root shell inside the named jail
  A jail can only see and use addresses that have been passed down to it by the parent system. This creates a slight problem with the loopback address: The host would probably like to keep that address to itself and not share it with any jail.
  Because of this, the loopback-address inside a jail is emulated by the system:
    + 127.0.0.1 is an alias for the first IPv4-address assigned to the jail.
    + ::1 is an alias for the first IPv6-address assigned to the jail.
  While this looks simple enough and usually works just fine[tm], it is also a source of many problems. Just imagine if your jail has only one single global IPv4 assigned to it. A daemon binding its (possibly unsecured) control port to the loopback-address would then unwillingly be exposed to the rest of the internet, which is hardly ever a good idea.
  + So, create an extra loopback adapter, and make the first IP in each jail a private loopback address
  + The tutorial goes on to cover making multiple jails share a single public IP address using NAT
  + It also covers more advanced concepts like ‘thin’ jails, to save some disk space if you are going to create a large number of jails, and how to upgrade them after the fact
  + Finally, it covers the integration with a lot of common tools, like identifying and filter jailed processes using top and ps, or using the package managers support for jails to install packages in a jail from the outside.</p>
</blockquote>

<hr />



**DigitalOcean**



<h3>SmartOS release-20180315</h3>

```

Hello All,

The latest bi-weekly "release" branch build of SmartOS is up:


<pre><code>curl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest.iso
curl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest-USB.img.bz2
curl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest.vmwarevm.tar.bz2
</code></pre>

A generated changelog is here:

<pre><code>https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos.html#20180329T002644Z
</code></pre>

The full build bits directory, for those interested, is here in Manta:

<pre><code>/Joyent_Dev/public/SmartOS/20180329T002644Z
</code></pre>

<h1>Highlights</h1>

Firewall rules created with fwadm(1M) can now use the PRIORITY keyword to
specify a higher precedence for a rule.

This release has includes mitigation of the Intel Meltdown vulnerability in the
form of kpti (kernel page table isolation) with PCID (process context
identifier) support

This release also includes experimental support for bhyve branded zones.




<h1>General Info</h1>

Every second Thursday we roll a "release-YYYYMMDD" release branch and
builds for SmartOS (and Triton DataCenter and Manta, as well).

Cheers,
Josh Wilsdon, on behalf of the SmartOS developers
https://smartos.org
``` 

<ul>
<li>Here's a screencap from q5sys' machine showing the output of sysinfo: https://i.imgur.com/MFkNi76.jpg</li>
</ul>

<p><hr /></p>

<h3><a href="https://www.freebsdfoundation.org/wp-content/uploads/2018/03/FreeBSD-Foundation-March-2018-Update-1.pdf">FreeBSD Foundation March 2018 Update</a></h3>

<ul>
<li>> Syzkaller update: Syzkaller is a coverage-guided system call fuzzer. It invokes syscalls with arbitrary and changing inputs, and is intended to use code coverage data to guide changes to system call inputs in order to access larger and larger portions of the kernel in the search for bugs.</li>
<li>> Last term’s student focused largely on scripts to deploy and configure Syzkaller on Packet.net’s hosting infrastructure, but did not get to the code coverage integration required for Syzkaller to be effective. This term co-op student Mitchell Horne has been adding code coverage support in FreeBSD for Syzkaller.</li>
<li>> The Linux code coverage support for Syzkaller is known as kcov and was submitted by Dmitry Vyukov, Syzkaller’s author. Kcov is purposebuilt for Syzkaller:
<ul><li>> kcov provides code coverage collection for coverage-guided fuzzing (randomized testing). Coverage-guided fuzzing is a testing technique that uses coverage feedback to determine new interesting inputs to a system.</li>
<li>> kcov does not aim to collect as much coverage as possible. It aims to collect more or less stable coverage that is function of syscall inputs. To achieve this goal it does not collect coverage in soft/hard interrupts and instrumentation of some inherently non-deterministic or non-interesting parts of kernel is disabled (e.g. scheduler, locking).</li></ul></li>
<li>> Mitchell implemented equivalent functionality for FreeBSD - a distinct implementation, but modelled on the one in Linux. These patches are currently in review, as are minor changes to Syzkaller to use the new interface on FreeBSD.</li>
<li>> We still have some additional work to fully integrate Syzkaller and run it on a consistent basis, but the brief testing that has been completed suggests this work will provide a very valuable improvement in test coverage and opportunities for system hardening: we tested Syzkaller with Mitchell's code coverage patch over a weekend. It provoked kernel crashes hundreds of times faster than without his work.</li>
<li>> I want to say thank you to NetApp for becoming an Iridium Partner again this
year! (Donations between $100,000 - $249,999) It’s companies like NetApp, who recognize the importance of supporting our efforts, that allow us to continue to provide software improvements, advocate for FreeBSD, and help lead the release engineering and security efforts.</li>
<li>> Conference Recap: FOSSASIA 2018</li>
<li>Foundation Director Philip Paeps went to FOSSASIA, which is possibly the largest open source event in Asia. The FreeBSD Foundation sponsored the conference.</li>
<li>Our booth had a constant stream of traffic over the weekend and we handed out hundreds of FreeBSD stickers, pens and flyers. Many attendees of FOSSASIA had never heard of FreeBSD before and are now keen to start exploring and perhaps even contributing. By the end of the conference, there were FreeBSD stickers everywhere!</li>
<li>> One particular hallway-track conversation led to an invitation to present FreeBSD at a "Women Who Code" evening in Kuala Lumpur later this week (Thursday 29th March). I spent the days after the conference meeting companies who use (or want to use) FreeBSD in Singapore.</li>
<li>> SCaLE 16x: The Foundation sponsored a FreeBSD table in the expo hall that was
staffed by Dru Lavigne, Warren Block, and Deb Goodkin. Our purpose was to promote FreeBSD, and attract more users and contributors to the Project. We had a steady flow of people stopping by our table, asking inquisitive questions, and picking up some cool swag and FreeBSD handouts.</li>
<li>Deb Goodkin took some tutorials/trainings there and talked to a lot of other open source projects.</li>
<li><blockquote>
  <p>Next year, we have the opportunity to have a BSD track, similar to the BSD Devroom at FOSDEM. We are looking for some volunteers in Southern California who can help organize this one or two-day event and help us educate more people about the BSDs. Let us know if you
  would like to help with this effort.</p>
</blockquote></li>
<li><blockquote>
  <p>Roll Call: #WhoUsesFreeBSD</p>
</blockquote></li>
<li><blockquote>
  <p>Many of you probably saw our post on social media asking Who Uses FreeBSD. Please help us answer this question to assist us in determining FreeBSD market share data, promote how companies are successfully using FreeBSD to encourage more companies to embrace
  FreeBSD, and to update the list of users on our website. Knowing who uses FreeBSD helps our contributors know where to look for jobs; knowing what universities teach with FreeBSD, helps companies know where to recruit, and knowing what products use FreeBSD helps us determine what features and technologies to support.</p>
</blockquote></li>
<li><blockquote>
  <p>New Hosting Partner: Oregon State University Open Source Lab</p>
</blockquote></li>
<li>> We are pleased to announce that the Oregon State University (OSU) Open Source Lab (OSL), which hosts infrastructure for over 160 different open source projects, has agreed to host some of our servers for FreeBSD development.  The first server, which should be arriving shortly, is an HP Enterprise Proliant DL360 Gen10 configured with NVDIMM memory which will be initially used for further development and testing of permanent memory support in the kernel.</li>
<li>Stay tuned for more news from the FreeBSD Foundation in May (next newsletter).</li>
</ul>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://daniel.haxx.se/blog/2018/03/20/twenty-years-1998-2018/">cURL is 20 today</a></li>
<li><a href="https://www.skyforge.at/posts/a-note-in-sysvipc-and-jails-on-freebsd/">A Note on SYSVIPC and Jails on FreeBSD</a></li>
<li><a href="https://marc.info/?l=openbsd-announce&amp;m=152149507725894&amp;w=2">OpenBSD Errata: March 20th, 2018 (ipsec)</a></li>
<li><a href="https://www.freebsd.org/security/advisories.html">FreeBSD Security Advisories for IPSEC and vt </a></li>
<li><a href="https://www.tecmint.com/pkg-command-examples-to-manage-packages-in-freebsd/">23 Useful PKG Command Examples to Manage Packages in FreeBSD</a></li>
</ul>

<p><hr /></p>

<p><strong>Tarsnap</strong></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Casey - <a href="http://dpaste.com/2VMH555#wrap">Cool Editor</a></li>
<li>Nelson - <a href="http://dpaste.com/2NTE4SD#wrap">New article on FreeBSD vs MacOS</a></li>
<li>Damian - <a href="http://dpaste.com/0FYWVHD#wrap">Mysterious Reverse Proxy 504</a></li>
<li>Nelson - <a href="http://dpaste.com/0BTGTVP#wrap">FreeBSD, rsync, nasty bug, now fixed</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 240: TCP Blackbox Recording | BSD Now 240</title>
  <link>https://www.bsdnow.tv/240</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-1717</guid>
  <pubDate>Sat, 07 Apr 2018 15:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b3126658-f33d-4d1b-9298-94929ae3e52e.mp3" length="47822501" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>New ZFS features landing in FreeBSD, MAP_STACK for OpenBSD, how to write safer C code with Clang’s address sanitizer, Michael W. Lucas on sponsor gifts, TCP blackbox recorder, and Dell disk system hacking.</itunes:subtitle>
  <itunes:duration>1:39:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>New ZFS features landing in FreeBSD, MAP_STACK for OpenBSD, how to write safer C code with Clang’s address sanitizer, Michael W. Lucas on sponsor gifts, TCP blackbox recorder, and Dell disk system hacking.
&lt;h2&gt;Headlines&lt;/h2&gt;
&lt;h3&gt;[A number of Upstream ZFS features landed in FreeBSD this week]&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=331711"&gt;9188 increase size of dbuf cache to reduce indirect block decompression&lt;/a&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;With compressed ARC (6950) we use up to 25% of our CPU to decompress indirect blocks, under a workload of random cached reads. To reduce this decompression cost, we would like to increase the size of the dbuf cache so that more indirect blocks can be stored uncompressed.
  If we are caching entire large files of recordsize=8K, the indirect blocks use 1/64th as much memory as the data blocks (assuming they have the same compression ratio). We suggest making the dbuf cache be 1/32nd of all memory, so that in this scenario we should be able to keep all the indirect blocks decompressed in the dbuf cache. (We want it to be more than the 1/64th that the indirect blocks would use because we need to cache other stuff in the dbuf cache as well.)
  In real world workloads, this won't help as dramatically as the example above, but we think it's still worth it because the risk of decreasing performance is low. The potential negative performance impact is that we will be slightly reducing the size of the ARC (by ~3%).&lt;/p&gt;
&lt;/blockquote&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=331701"&gt;9166 zfs storage pool checkpoint&lt;/a&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;The idea of Storage Pool Checkpoint (aka zpool checkpoint) deals with exactly that.  It can be thought of as a “pool-wide snapshot” (or a variation of extreme rewind that doesn’t corrupt your data).  It remembers the entire state of the pool at the point that it was taken and the user can revert back to it later or discard it.  Its generic use case is an administrator that is about to perform a set of destructive actions to ZFS as part of a critical procedure.  She takes a checkpoint of the pool before performing the actions, then rewinds back to it if one of them fails or puts the pool into an unexpected state.  Otherwise, she discards it.  With the assumption that no one else is making modifications to ZFS, she basically wraps all these actions into a “high-level transaction”.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;/li&gt;
&lt;li&gt;&lt;p&gt;&lt;a href="https://sdimitro.github.io/post/zpool-checkpoint/"&gt;More information&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=331404"&gt;8484 Implement aggregate sum and use for arc counters&lt;/a&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;In pursuit of improving performance on multi-core systems, we should implements fanned out counters and use them to improve the performance of some of the arc statistics. These stats are updated extremely frequently, and can consume a significant amount of CPU time.&lt;/p&gt;
&lt;/blockquote&gt;
&lt;/li&gt;
&lt;li&gt;&lt;p&gt;And a small bug fix authored by me:&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;
&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=331709"&gt;9321 arc&lt;em&gt;loan&lt;/em&gt;compressed&lt;em&gt;buf() can increment arc&lt;/em&gt;loaned&lt;em&gt;bytes by the wrong value&lt;/em&gt;&lt;/a&gt;


&lt;blockquote&gt;
  arcloan&lt;em&gt;compressed&lt;/em&gt;buf() increments arc&lt;em&gt;loaned&lt;/em&gt;bytes by psize unconditionally In the case of zfs&lt;em&gt;compressed&lt;/em&gt;arc&lt;em&gt;enabled=0, when the buf is returned via arc&lt;/em&gt;return&lt;em&gt;buf(), if ARC&lt;/em&gt;BUF&lt;em&gt;COMPRESSED(buf) is false, then arc&lt;/em&gt;loaned&lt;em&gt;bytes is decremented by lsize, not psize.
  Switch to using arc&lt;/em&gt;buf&lt;em&gt;size(buf), instead of psize, which will return psize or lsize, depending on the result of ARC&lt;/em&gt;BUF_COMPRESSED(buf).&lt;/blockquote&gt;
&lt;/li&gt;
  &lt;/ul&gt;
  &lt;hr&gt;


&lt;h3&gt;&lt;a href="https://marc.info/?l=openbsd-tech&amp;amp;m=152035796722258&amp;amp;w=2"&gt;MAP_STACK for OpenBSD&lt;/a&gt;&lt;/h3&gt;



&lt;blockquote&gt;
  &lt;p&gt;Almost 2 decades ago we started work on W^X.  The concept was simple. Pages that are writable, should not be executable.  We applied this concept object by object, trying to seperate objects with different qualities to different pages. The first one we handled was the signal trampoline at the top of the stack.  We just kept making changes in the same vein.  Eventually W^X came to some of our kernel address spaces also.
  The fundamental concept is that an object should only have the
  permissions necessary, and any other operation should fault.  The only permission separations we have are kernel vs userland, and then read, write, and execute.
  How about we add another new permission!  This is not a hardware permission, but a software permission.  It is opportunistically enforced by the kernel.
  the permission is MAP&lt;em&gt;STACK.  If you want to use memory as a stack, you must mmap it with that flag bit.  The kernel does so automatically for the stack region of a process's stack.  Two other types of stack occur: thread stacks, and alternate signal stacks.  Those are handled in clever ways.
  When a system call happens, we check if the stack-pointer register points to such a page.  If it doesn't, the program is killed.  We have tightened the ABI.  You may no longer point your stack register at non-stack memory.  You'll be killed.  This checking code is MI, so it works for all platforms.
  Since page-permissions are generally done on page boundaries, there is caveat that thread and altstacks must now be page-sized and page-aligned, so that we can enforce the MAP&lt;/em&gt;STACK attribute correctly.  It is possible that a few ports need some massaging to satisfy this condition, but we haven't found any which break yet.  A syslog_r has been added so that we can identify these failure cases. Also, the faulting cases are quite verbose for now, to help identify the programs we need to repair.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;



**iXsystems**



&lt;h3&gt;&lt;a href="https://dev.to/loderunner/writing-safer-c-with-clang-address-sanitizer"&gt;Writing Safer C with the Clang Address Sanitizer&lt;/a&gt;&lt;/h3&gt;



&lt;blockquote&gt;
  &lt;p&gt;We wanted to improve our password strength algorithm, and decided to go for the industry-standard zxcvbn, from the people at Dropbox. Our web front-end would use the default Javascript library, and for mobile and desktop, we chose to use the C implementation as it was the lowest common denominator for all platforms.
  Bootstrapping all of this together was done pretty fast. I had toyed around with a few sample passwords so I decided to run it through the test suite we had for the previous password strength evaluator. The test generates a large number of random passwords according to different rules and expects the strength to be in a given range. But the test runner kept crashing with segmentation faults.
  It turns out the library has a lot of buffer overflow cases that are usually "harmless", but eventually crash your program when you run the evaluator function too much. I started fixing the cases I could see, but reading someone else's algorithms to track down tiny memory errors got old pretty fast. I needed a tool to help me.
  That's when I thought of Clang's Address Sanitizer.
  AddressSanitizer is a fast memory error detector. It consists of a compiler instrumentation module and a run-time library
  Let's try the sanitizer on a simple program. We'll allocate a buffer on the heap, copy each character of a string into it, and print it to standard output.
  + The site walks through a simple example which contains an error, it writes past the end of a buffer
  + The code works as expected, and nothing bad happens. It must be fine…
  + Then they compile it again with the address sanitizer actived
  So what can we gather from that pile of hex? Let's go through it line by line.
  AddressSanitizer found a heap buffer overflow at 0x60200000ef3d, a seemingly valid address (not NULL or any other clearly faulty value).
  + ASAN points directly to the line of code that is causing the problem
  We're writing outside of the heap in this instruction. And AddressSanitizer isn't having it.
  This is definitely one of my favorite indications. In addition to telling which line in the code failed and where in the memory the failure happened, you get a complete description of the closest allocated region in memory (which is probably the region you were trying to access).
  + They then walk through combining this with lldb, the Clang debugger, to actually interactively inspect the state of the problem when an invalid memory access happens
  Back to my practical case, how did I put the address sanitizer to good use? I simply ran the test suite, compiled with the sanitizer, with lldb. Sure enough, it stopped on every line that could cause a crash. It turns out there were many cases where zxcvbn-c wrote past the end of allocated buffers, on the heap and on the stack. I fixed those cases in the C library and ran the tests again. Not a segfault in sight!
  I've used memory tools in the past, but they were usually unwieldy, or put such a toll on performance that they were useless in any real-life case. Clang's address sanitizer turned out to be detailed, reliable, and surprisingly easy to use. I've heard of the miracles of Valgrind but macOS hardly supports it, making it a pain to use on my MacBook Pro.
  Coupled with Clang's static analyzer, AddressSanitizer is going to become a mandatory stop for evaluating code quality. It's also going to be the first tool I grab when facing confusing memory issues. There are many more case where I could use early failure and memory history to debug my code. For example, if a program crashes when accessing member of a deallocated object, we could easily trace the event that caused the deallocation, saving hours of adding and reading logs to retrace just what happened.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;







&lt;h2&gt;News Roundup&lt;/h2&gt;



&lt;h3&gt;&lt;a href="https://blather.michaelwlucas.com/archives/3131"&gt;On sponsor gifts&lt;/a&gt;&lt;/h3&gt;



&lt;blockquote&gt;
  &lt;p&gt;Note the little stack of customs forms off to the side. It’s like I’ve learned a lesson from standing at the post office counter filling out those stupid forms. Sponsors should get their books soon.&lt;/p&gt;
  
  &lt;p&gt;This seems like an apropos moment to talk about what I do for print sponsors. I say I send them “a gift,” but what does that really mean? The obvious thing to ship them is a copy of the book I’ve written. Flat-out selling print books online has tax implications, though.&lt;/p&gt;
  
  &lt;p&gt;Sponsors might have guessed that they’d get a copy of the book. But I shipped them the hardcover, which isn’t my usual practice.&lt;/p&gt;
  
  &lt;p&gt;That’s because I send sponsors a gift. As it’s a gift, I get to choose what I send. I want to send them something nice, to encourage them to sponsor another book. It makes no sense for me to send a sponsor a Singing Wedgie-O-Gram. (Well, maybe a couple sponsors. You know who you are.)&lt;/p&gt;
  
  &lt;p&gt;The poor bastards who bought into my scam–er, sponsored my untitled book–have no idea what’s coming. As of right now, their sensible guesses are woefully incomplete.&lt;/p&gt;
  
  &lt;p&gt;Future books? They might get a copy of the book. They might get book plus something. They might just get the something. Folks who sponsor the jails book might get a cake with a file in it. Who knows?&lt;/p&gt;
  
  &lt;p&gt;It’s a gift. It’s my job to make that gift worthwhile.&lt;/p&gt;
  
  &lt;p&gt;And to amuse myself. Because otherwise, what’s the point?&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;





&lt;h3&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=331347"&gt;TCP Blackbox Recorder&lt;/a&gt;&lt;/h3&gt;

```
Add the "TCP Blackbox Recorder" which we discussed at the developer
summits at BSDCan and BSDCam in 2017.

The TCP Blackbox Recorder allows you to capture events on a TCP connection
in a ring buffer. It stores metadata with the event. It optionally stores
the TCP header associated with an event (if the event is associated with a
packet) and also optionally stores information on the sockets.

It supports setting a log ID on a TCP connection and using this to correlate
multiple connections that share a common log ID.

You can log connections in different modes. If you are doing a coordinated
test with a particular connection, you may tell the system to put it in
mode 4 (continuous dump). Or, if you just want to monitor for errors, you
can put it in mode 1 (ring buffer) and dump all the ring buffers associated
with the connection ID when we receive an error signal for that connection
ID. You can set a default mode that will be applied to a particular ratio
of incoming connections. You can also manually set a mode using a socket
option.

This commit includes only basic probes. rrs@ has added quite an abundance
of probes in his TCP development work. He plans to commit those soon.

There are user-space programs which we plan to commit as ports. These read
the data from the log device and output pcapng files, and then let you
analyze the data (and metadata) in the pcapng files.

Reviewed by:    gnn (previous version)
Obtained from:    Netflix, Inc.
Relnotes:    yes
Differential Revision:    https://reviews.freebsd.org/D11085
```



&lt;hr&gt;



**Digital Ocean**



&lt;h3&gt;&lt;a href="https://euroquis.nl/bobulate/?p=1812"&gt;Outta the way, KDE4&lt;/a&gt;&lt;/h3&gt;



&lt;blockquote&gt;
  &lt;p&gt;KDE4 has been rudely moved aside on FreeBSD. It still installs (use x11/kde4) and should update without a problem, but this is another step towards adding modern KDE (Plasma 5 and Applications) to the official FreeBSD Ports tree.
  This has taken a long time mostly for administrative reasons, getting all the bits lined up so that people sticking with KDE4 (which, right now, would be everyone using KDE from official ports and packages on FreeBSD) don’t end up with a broken desktop. We don’t want that. But now that everything Qt4 and kdelibs4-based has been moved aside by suffixing it with -kde4, we have the unsuffixed names free to indicate the latest-and-greatest from upstream.&lt;/p&gt;
  
  &lt;p&gt;KDE4 users will see a lot of packages moving around and being renamed, but no functional changes. Curiously, the KDE4 desktop depends on Qt5 and KDE Frameworks 5 — and it has for quite some time already, because the Oxygen icons are shared with KDE Frameworks, but primarily because FileLight was updated to the modern KDE Applications version some time ago (the KDE4 version had some serious bugs, although I can not remember what they were). Now that the names are cleaned up, we could consider giving KDE4 users the buggy version back.&lt;/p&gt;
  
  &lt;p&gt;From here on, we’ve got the following things lined up:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Qt 5.10 is being worked on, except for WebEngine (it would slow down an update way too much), because Plasma is going to want Qt 5.10 soon.&lt;/li&gt;
&lt;li&gt;CMake 3.11 is in the -rc stage, so that is being lined up.&lt;/li&gt;
&lt;li&gt;The kde5-import branch in KDE-FreeBSD’s copy of the FreeBSD ports tree (e.g. Area51) is being prepped and polished for a few big SVN commits that will add all the new bits.&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;So we’ve been saying Real Soon Now ™ for years, but things are Realer Sooner Nower ™ now.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="http://blog.frankleonhardt.com/2017/del-fs12-nv7-and-other-2u-server-e-g-c6100-disk-system-hacking/"&gt;Dell FS12-NV7 and other 2U server (e.g. C6100) disk system hacking&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;A while back I reviewed the Dell FS12-NV7 – a 2U rack server being sold cheap by all and sundry. It’s a powerful box, even by modern standards, but one of its big drawbacks is the disk system it comes with. But it needn’t be.&lt;/p&gt;
  
  &lt;p&gt;There are two viable solutions, depending on what you want to do. You can make use of the SAS backplane, using SAS and/or SATA drives, or you can go for fewer SATA drives and free up one or more PCIe slots as Plan B. You probably have an FS12 because it looks good for building a drive array (or even FreeNAS) so I’ll deal with Plan A first.&lt;/p&gt;
  
  &lt;p&gt;Like most Dell servers, this comes with a Dell PERC RAID SAS controller – a PERC6/i to be precise. This ‘I’ means it has internal connectors; the /E is the same but its sockets are external.&lt;/p&gt;
  
  &lt;p&gt;The PERC connects to a twelve-slot backplane forming a drive array at the front of the box. More on the backplane later; it’s the PERCs you need to worry about.&lt;/p&gt;
  
  &lt;p&gt;The PERC6 is actually an LSI Megaraid 1078 card, which is just the thing you need if you’re running an operating system like Windows that doesn’t support a volume manager, striping and other grown-up stuff. Or if your OS does have these features, but you just don’t trust it. If you are running such an OS you may as well stick to the PERC6, and good luck to you. If you’re using BSD (including FreeNAS), Solaris or a Linux distribution that handles disk arrays, read on. The PERC6 is a solution to a problem you probably don’t have, but in all other respects its a turkey. You really want a straightforward HBA (Host Bus Adapter) that allows your clever operating system to talk directly with the drives.&lt;/p&gt;
  
  &lt;p&gt;Any SAS card based on the 1078 (such as the PERC6) is likely to have problems with drives larger than 2Tb. I’m not completely sure why, but I suspect it only applies to SATA. Unfortunately I don’t have any very large SAS drives to test this theory. A 2Tb limit isn’t really such a problem when you’re talking about a high performance array, as lots of small drives are a better option anyway. But it does matter if you’re building a very large datastore and don’t mind slower access and very significant resilvering times when you replace a drive. And for large datastores, very large SATA drives save you a whole lot of cash. The best capacity/cost ratio is for 5Gb SATA drives&lt;/p&gt;
  
  &lt;p&gt;Some Dell PERCs can be re-flashed with LSI firmware and used as a normal HBA. Unfortunately the PERC6 isn’t one of them. I believe the PERC6/R can be, but those I’ve seen in a FS12 are just a bit too old. So the first thing you’ll need to do is dump them in the recycling or try and sell them on eBay.&lt;/p&gt;
  
  &lt;p&gt;There are actually two PERC6 cards in most machine, and they each support eight SAS channels through two SFF-8484 connectors on each card. Given there are twelve drives slots, one of the PERCs is only half used. Sometimes they have a cable going off to a battery located near the fans. This is used in a desperate attempt to keep the data in the card’s cache safe in order to avoid write holes corrupting NTFS during a power failure, although the data on the on-drive caches won’t be so lucky. If you’re using a file system like that, make sure you have a UPS for the whole lot.&lt;/p&gt;
  
  &lt;p&gt;But we’re going to put the PERCs out of our misery and replace them with some nice new LSI HBAs that will do our operating system’s bidding and let it talk to the drives as it knows best. But which to pick? First we need to know what we’re connecting.&lt;/p&gt;
  
  &lt;p&gt;Moving to the front of the case there are twelve metal drive slots with a backplane behind. Dell makes machines with either backplanes or expanders. A backplane has a 1:1 SAS channel to drive connection; an expander takes one SAS channel and multiplexes it to (usually) four drives. You could always swap the blackplane with an expander, but I like the 1:1 nature of a backplane. It’s faster, especially if you’re configured as an array. And besides, we don’t want to spend more money than we need to, otherwise we wouldn’t be hot-rodding a cheap 2U server in the first place – expanders are expensive. Bizarrely, HBAs are cheap in comparison. So we need twelve channels of SAS that will connect to the sockets on the backplane.&lt;/p&gt;
  
  &lt;p&gt;The HBA you will probably want to go with is an LSI, as these have great OS support. Other cards are available, but check that the drivers are also available. The obvious choice for SAS aficionados is the LSI 9211-8i, which has eight internal channels. This is based on an LSI 2000 series chip, the 2008, which is the de-facto standard. There’s also four-channel -4i version, so you could get your twelve channels using one of each – but the price difference is small these days, so you might as well go for two -8i cards. If you want cheaper there are 1068-based equivalent cards, and these work just fine at about half the price. They probably won’t work with larger disks, only operate at 3Gb and the original SAS standard. However, the 2000 series is only about £25 extra and gives you more options for the future. A good investment. Conversely, the latest 3000 series cards can do some extra stuff (particularly to do with active cables) but I can’t see any great advantage in paying megabucks for one unless you’re going really high-end – in which case the NV12 isn’t the box for you anyway. And you’d need some very fast drives and a faster backplane to see any speed advantage. And probably a new motherboard….&lt;/p&gt;
  
  &lt;p&gt;Whether the 6Gb SAS2 of the 9211-8i is any use on the backplane, which was designed for 3Gb, I don’t know. If it matters that much to you you probably need to spend a lot more money. A drive array with a direct 3Gb to each drive is going to shift fast enough for most purposes.&lt;/p&gt;
  
  &lt;p&gt;Once you have removed the PERCs and plugged in your modern-ish 9211 HBAs, your next problem is going to be the cable. Both the PERCs and the backplane have SFF-8484 multi-lane connectors, which you might not recognise. SAS is a point-to-point system, the same as SATA, and a multi-lane cable is simply four single cables in a bundle with one plug. (Newer versions of SAS have more). SFF-8484 multi-lane connectors are somewhat rare, (but unfortunately this doesn’t make them valuable if you were hoping to flog them on eBay). The world switched quickly to the SFF-8087 for multi-lane SAS. The signals are electrically the same, but the connector is not.&lt;/p&gt;
  
  &lt;p&gt;Please generate and paste your ad code here. If left empty, the ad location will be highlighted on your blog pages with a reminder to enter your code. Mid-Post
  So there are two snags with this backplane. Firstly it’s designed to work with PERC controllers; secondly it has the old SFF-8484 connectors on the back, and any SAS cables you find are likely to have SFF-8087.&lt;/p&gt;
  
  &lt;p&gt;First things first – there is actually a jumper on the backplane to tell it whether it’s talking to a PERC or a standard LSI HBA. All you need to do is find it and change it. Fortunately there are very few jumpers to choose from (i.e. two), and you know the link is already in the wrong place. So try them one at a time until it works. The one you want may be labelled J15, but I wouldn’t like to say this was the same on every variant.&lt;/p&gt;
  
  &lt;p&gt;Second problem: the cable. You can get cables with an SFF-8087 on one end and an SFF-8484 on the other. These should work. But they’re usually rather expensive. If you want to make your own, it’s a PITA but at least you have the connectors already (assuming you didn’t bin the ones on the PERC cables).&lt;/p&gt;
  
  &lt;p&gt;I don’t know what committee designed SAS cable connectors, but ease of construction wasn’t foremost in their collective minds. You’re basically soldering twisted pair to a tiny PCB. This is mechanically rubbish, of course, as the slightest force on the cable will lift the track. Therefore its usual to cover the whole joint in solidified gunk (technical term) to protect it. Rewiring SAS connectors is definitely not easy.&lt;/p&gt;
  
  &lt;p&gt;I’ve tried various ways of soldering to them, none of which were satisfactory or rewarding. One method is to clip the all bare wires you wish to solder using something like a bulldog clip so they’re at lined up horizontally and then press then adjust the clamp so they’re gently pressed to the tracks on the board, making final adjustments with a strong magnifying glass and a fine tweezers. You can then either solder them with a fine temperature-controlled iron, or have pre-coated the pads with solder paste and flash across it with an SMD rework station. I’d love to know how they’re actually manufactured – using a precision jig I assume.&lt;/p&gt;
  
  &lt;p&gt;The “easy” way is to avoid soldering the connectors at all; simply cut existing cables in half and join one to the other. I’ve used prototyping matrix board for this. Strip and twist the conductors, push them through a hole and solder. This keeps things compact but manageable. We’re dealing with twisted pair here, so maintain the twists as close as possible to the board – it actually works quite well.&lt;/p&gt;
  
  &lt;p&gt;However, I’ve now found a reasonably-priced source of the appropriate cable so I don’t do this any more. Contact me if you need some in the UK.&lt;/p&gt;
  
  &lt;p&gt;So all that remains is to plug your HBAs to the backplane, shove in some drives and you’re away. If you’re at this stage, it “just works”. The access lights for all the drives do their thing as they should. The only mystery is how you can get the ident LED to come on; this may be controlled by the PERC when it detects a failure using the so-called sideband channel, or it may be operated by the electronics on the backplane. It’s workings are, I’m afraid, something of a mystery still – it’s got too much electronics on board to be a completely passive backplane.&lt;/p&gt;
  
  &lt;p&gt;Plan B: SATA&lt;/p&gt;
  
  &lt;p&gt;If you plan to use only SATA drives, especially if you don’t intend using more than six, it makes little sense to bother with SAS at all. The Gigabyte motherboard comes with half a dozen perfectly good 3Gb SATA channels, and if you need more you can always put another controller in a PCIe slot, or even USB. The advantages are lower cost and you get to free up two PCIe slots for more interesting things.&lt;/p&gt;
  
  &lt;p&gt;The down-side is that you can’t use the SAS backplane, but you can still use the mounting bays.&lt;/p&gt;
  
  &lt;p&gt;Removing the backplane looks tricky, but it really isn’t when you look a bit closer. Take out the fans first (held in place by rubber blocks), undo a couple of screws and it just lifts and slides out. You can then slot and lock in the drives and connect the SATA connectors directly to the back of the drives. You could even slide them out again without opening the case, as long as the cable was long enough and you manually detached the cable it when it was withdrawn. And let’s face it – drives are likely to last for years so even with half a dozen it’s not that great a hardship to open the case occasionally.&lt;/p&gt;
  
  &lt;p&gt;Next comes power. The PSU has a special connector for the backplane and two standard SATA power plugs. You could split these three ways using an adapter, but if you have a lot of drives you might want to re-wire the cables going to the backplane plug. It can definitely power twelve drives.&lt;/p&gt;
  
  &lt;p&gt;And that’s almost all there is to it. Unfortunately the main fans are connected to the backplane, which you’ve just removed. You can power them from an adapter on the drive power cables, but there are unused fan connectors on the motherboard. I’m doing a bit more research on cooling options, but this approach has promising possibilities for noise reduction.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://euroquis.nl/bobulate/?p=1787"&gt;Adriaan de Groot’s post FOSDEM blog post&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.manios.ca/blog/2018/01/my-first-freenas/"&gt;My First FreeNAS&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://lists.freebsd.org/pipermail/freebsd-fs/2018-March/025997.html"&gt;smart(8) Call for Testing by Michael Dexter&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-travel-grant-application-now-open/"&gt;BSDCan 2018 Travel Grant Application Now Open&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://divelog.blue/linus_torvalds.html"&gt;BSD Developer Kristaps Dzonsons interviews Linus Torvalds, about diving&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://twitter.com/michaeldexter/status/979236774667939840"&gt;Twitter vote - The secret to a faster FreeBSD default build world...&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://tmate.io/"&gt;tmate - Instant terminal sharing&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;Tarsnap&lt;/strong&gt;&lt;/p&gt;

&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Vikash - &lt;a href="http://dpaste.com/05X35B1#wrap"&gt;Getting a port added&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Chris Wells - &lt;a href="http://dpaste.com/05S7A6V#wrap"&gt;Quarterly Ports Branch&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;&lt;a href="https://github.com/freebsd/freebsd-ci"&gt;FreeBSD-CI configs on Github&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://wiki.freebsd.org/Jenkins"&gt;Jenkins on the FreeBSD Wiki&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;Gordon - &lt;a href="http://dpaste.com/0HSVFE7#wrap"&gt;Centralised storage suggestions&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt; 
</description>
  <itunes:keywords>BSD,DragonflyBSD,freebsd,guide,howto,Interview,NetBSD,OpenBSD,trueos,tutorial</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>New ZFS features landing in FreeBSD, MAP_STACK for OpenBSD, how to write safer C code with Clang’s address sanitizer, Michael W. Lucas on sponsor gifts, TCP blackbox recorder, and Dell disk system hacking.</p>

<h2>Headlines</h2>

<h3>[A number of Upstream ZFS features landed in FreeBSD this week]</h3>

<ul>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331711">9188 increase size of dbuf cache to reduce indirect block decompression</a></p>

<blockquote>
  <p>With compressed ARC (6950) we use up to 25% of our CPU to decompress indirect blocks, under a workload of random cached reads. To reduce this decompression cost, we would like to increase the size of the dbuf cache so that more indirect blocks can be stored uncompressed.
  If we are caching entire large files of recordsize=8K, the indirect blocks use 1/64th as much memory as the data blocks (assuming they have the same compression ratio). We suggest making the dbuf cache be 1/32nd of all memory, so that in this scenario we should be able to keep all the indirect blocks decompressed in the dbuf cache. (We want it to be more than the 1/64th that the indirect blocks would use because we need to cache other stuff in the dbuf cache as well.)
  In real world workloads, this won't help as dramatically as the example above, but we think it's still worth it because the risk of decreasing performance is low. The potential negative performance impact is that we will be slightly reducing the size of the ARC (by ~3%).</p>
</blockquote></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331701">9166 zfs storage pool checkpoint</a></p>

<blockquote>
  <p>The idea of Storage Pool Checkpoint (aka zpool checkpoint) deals with exactly that.  It can be thought of as a “pool-wide snapshot” (or a variation of extreme rewind that doesn’t corrupt your data).  It remembers the entire state of the pool at the point that it was taken and the user can revert back to it later or discard it.  Its generic use case is an administrator that is about to perform a set of destructive actions to ZFS as part of a critical procedure.  She takes a checkpoint of the pool before performing the actions, then rewinds back to it if one of them fails or puts the pool into an unexpected state.  Otherwise, she discards it.  With the assumption that no one else is making modifications to ZFS, she basically wraps all these actions into a “high-level transaction”.</p>
</blockquote></li>
<li><p><a href="https://sdimitro.github.io/post/zpool-checkpoint/">More information</a></p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331404">8484 Implement aggregate sum and use for arc counters</a></p>

<blockquote>
  <p>In pursuit of improving performance on multi-core systems, we should implements fanned out counters and use them to improve the performance of some of the arc statistics. These stats are updated extremely frequently, and can consume a significant amount of CPU time.</p>
</blockquote></li>
<li><p>And a small bug fix authored by me:</p></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331709">9321 arc<em>loan</em>compressed<em>buf() can increment arc</em>loaned<em>bytes by the wrong value</a>


<blockquote>
  arc</em>loan<em>compressed</em>buf() increments arc<em>loaned</em>bytes by psize unconditionally In the case of zfs<em>compressed</em>arc<em>enabled=0, when the buf is returned via arc</em>return<em>buf(), if ARC</em>BUF<em>COMPRESSED(buf) is false, then arc</em>loaned<em>bytes is decremented by lsize, not psize.
  Switch to using arc</em>buf<em>size(buf), instead of psize, which will return psize or lsize, depending on the result of ARC</em>BUF_COMPRESSED(buf).</li>
  </ul>
  <hr />
</blockquote>

<h3><a href="https://marc.info/?l=openbsd-tech&amp;m=152035796722258&amp;w=2">MAP_STACK for OpenBSD</a></h3>



<blockquote>
  <p>Almost 2 decades ago we started work on W^X.  The concept was simple. Pages that are writable, should not be executable.  We applied this concept object by object, trying to seperate objects with different qualities to different pages. The first one we handled was the signal trampoline at the top of the stack.  We just kept making changes in the same vein.  Eventually W^X came to some of our kernel address spaces also.
  The fundamental concept is that an object should only have the
  permissions necessary, and any other operation should fault.  The only permission separations we have are kernel vs userland, and then read, write, and execute.
  How about we add another new permission!  This is not a hardware permission, but a software permission.  It is opportunistically enforced by the kernel.
  the permission is MAP<em>STACK.  If you want to use memory as a stack, you must mmap it with that flag bit.  The kernel does so automatically for the stack region of a process's stack.  Two other types of stack occur: thread stacks, and alternate signal stacks.  Those are handled in clever ways.
  When a system call happens, we check if the stack-pointer register points to such a page.  If it doesn't, the program is killed.  We have tightened the ABI.  You may no longer point your stack register at non-stack memory.  You'll be killed.  This checking code is MI, so it works for all platforms.
  Since page-permissions are generally done on page boundaries, there is caveat that thread and altstacks must now be page-sized and page-aligned, so that we can enforce the MAP</em>STACK attribute correctly.  It is possible that a few ports need some massaging to satisfy this condition, but we haven't found any which break yet.  A syslog_r has been added so that we can identify these failure cases. Also, the faulting cases are quite verbose for now, to help identify the programs we need to repair.</p>
</blockquote>

<hr />



**iXsystems**



<h3><a href="https://dev.to/loderunner/writing-safer-c-with-clang-address-sanitizer">Writing Safer C with the Clang Address Sanitizer</a></h3>



<blockquote>
  <p>We wanted to improve our password strength algorithm, and decided to go for the industry-standard zxcvbn, from the people at Dropbox. Our web front-end would use the default Javascript library, and for mobile and desktop, we chose to use the C implementation as it was the lowest common denominator for all platforms.
  Bootstrapping all of this together was done pretty fast. I had toyed around with a few sample passwords so I decided to run it through the test suite we had for the previous password strength evaluator. The test generates a large number of random passwords according to different rules and expects the strength to be in a given range. But the test runner kept crashing with segmentation faults.
  It turns out the library has a lot of buffer overflow cases that are usually "harmless", but eventually crash your program when you run the evaluator function too much. I started fixing the cases I could see, but reading someone else's algorithms to track down tiny memory errors got old pretty fast. I needed a tool to help me.
  That's when I thought of Clang's Address Sanitizer.
  AddressSanitizer is a fast memory error detector. It consists of a compiler instrumentation module and a run-time library
  Let's try the sanitizer on a simple program. We'll allocate a buffer on the heap, copy each character of a string into it, and print it to standard output.
  + The site walks through a simple example which contains an error, it writes past the end of a buffer
  + The code works as expected, and nothing bad happens. It must be fine…
  + Then they compile it again with the address sanitizer actived
  So what can we gather from that pile of hex? Let's go through it line by line.
  AddressSanitizer found a heap buffer overflow at 0x60200000ef3d, a seemingly valid address (not NULL or any other clearly faulty value).
  + ASAN points directly to the line of code that is causing the problem
  We're writing outside of the heap in this instruction. And AddressSanitizer isn't having it.
  This is definitely one of my favorite indications. In addition to telling which line in the code failed and where in the memory the failure happened, you get a complete description of the closest allocated region in memory (which is probably the region you were trying to access).
  + They then walk through combining this with lldb, the Clang debugger, to actually interactively inspect the state of the problem when an invalid memory access happens
  Back to my practical case, how did I put the address sanitizer to good use? I simply ran the test suite, compiled with the sanitizer, with lldb. Sure enough, it stopped on every line that could cause a crash. It turns out there were many cases where zxcvbn-c wrote past the end of allocated buffers, on the heap and on the stack. I fixed those cases in the C library and ran the tests again. Not a segfault in sight!
  I've used memory tools in the past, but they were usually unwieldy, or put such a toll on performance that they were useless in any real-life case. Clang's address sanitizer turned out to be detailed, reliable, and surprisingly easy to use. I've heard of the miracles of Valgrind but macOS hardly supports it, making it a pain to use on my MacBook Pro.
  Coupled with Clang's static analyzer, AddressSanitizer is going to become a mandatory stop for evaluating code quality. It's also going to be the first tool I grab when facing confusing memory issues. There are many more case where I could use early failure and memory history to debug my code. For example, if a program crashes when accessing member of a deallocated object, we could easily trace the event that caused the deallocation, saving hours of adding and reading logs to retrace just what happened.</p>
</blockquote>

<hr />







<h2>News Roundup</h2>



<h3><a href="https://blather.michaelwlucas.com/archives/3131">On sponsor gifts</a></h3>



<blockquote>
  <p>Note the little stack of customs forms off to the side. It’s like I’ve learned a lesson from standing at the post office counter filling out those stupid forms. Sponsors should get their books soon.</p>
  
  <p>This seems like an apropos moment to talk about what I do for print sponsors. I say I send them “a gift,” but what does that really mean? The obvious thing to ship them is a copy of the book I’ve written. Flat-out selling print books online has tax implications, though.</p>
  
  <p>Sponsors might have guessed that they’d get a copy of the book. But I shipped them the hardcover, which isn’t my usual practice.</p>
  
  <p>That’s because I send sponsors a gift. As it’s a gift, I get to choose what I send. I want to send them something nice, to encourage them to sponsor another book. It makes no sense for me to send a sponsor a Singing Wedgie-O-Gram. (Well, maybe a couple sponsors. You know who you are.)</p>
  
  <p>The poor bastards who bought into my scam–er, sponsored my untitled book–have no idea what’s coming. As of right now, their sensible guesses are woefully incomplete.</p>
  
  <p>Future books? They might get a copy of the book. They might get book plus something. They might just get the something. Folks who sponsor the jails book might get a cake with a file in it. Who knows?</p>
  
  <p>It’s a gift. It’s my job to make that gift worthwhile.</p>
  
  <p>And to amuse myself. Because otherwise, what’s the point?</p>
</blockquote>

<hr />





<h3><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331347">TCP Blackbox Recorder</a></h3>

```
Add the "TCP Blackbox Recorder" which we discussed at the developer
summits at BSDCan and BSDCam in 2017.

The TCP Blackbox Recorder allows you to capture events on a TCP connection
in a ring buffer. It stores metadata with the event. It optionally stores
the TCP header associated with an event (if the event is associated with a
packet) and also optionally stores information on the sockets.

It supports setting a log ID on a TCP connection and using this to correlate
multiple connections that share a common log ID.

You can log connections in different modes. If you are doing a coordinated
test with a particular connection, you may tell the system to put it in
mode 4 (continuous dump). Or, if you just want to monitor for errors, you
can put it in mode 1 (ring buffer) and dump all the ring buffers associated
with the connection ID when we receive an error signal for that connection
ID. You can set a default mode that will be applied to a particular ratio
of incoming connections. You can also manually set a mode using a socket
option.

This commit includes only basic probes. rrs@ has added quite an abundance
of probes in his TCP development work. He plans to commit those soon.

There are user-space programs which we plan to commit as ports. These read
the data from the log device and output pcapng files, and then let you
analyze the data (and metadata) in the pcapng files.

Reviewed by:    gnn (previous version)
Obtained from:    Netflix, Inc.
Relnotes:    yes
Differential Revision:    https://reviews.freebsd.org/D11085
```



<hr />



**Digital Ocean**



<h3><a href="https://euroquis.nl/bobulate/?p=1812">Outta the way, KDE4</a></h3>



<blockquote>
  <p>KDE4 has been rudely moved aside on FreeBSD. It still installs (use x11/kde4) and should update without a problem, but this is another step towards adding modern KDE (Plasma 5 and Applications) to the official FreeBSD Ports tree.
  This has taken a long time mostly for administrative reasons, getting all the bits lined up so that people sticking with KDE4 (which, right now, would be everyone using KDE from official ports and packages on FreeBSD) don’t end up with a broken desktop. We don’t want that. But now that everything Qt4 and kdelibs4-based has been moved aside by suffixing it with -kde4, we have the unsuffixed names free to indicate the latest-and-greatest from upstream.</p>
  
  <p>KDE4 users will see a lot of packages moving around and being renamed, but no functional changes. Curiously, the KDE4 desktop depends on Qt5 and KDE Frameworks 5 — and it has for quite some time already, because the Oxygen icons are shared with KDE Frameworks, but primarily because FileLight was updated to the modern KDE Applications version some time ago (the KDE4 version had some serious bugs, although I can not remember what they were). Now that the names are cleaned up, we could consider giving KDE4 users the buggy version back.</p>
  
  <p>From here on, we’ve got the following things lined up:</p>
</blockquote>

<ul>
<li>Qt 5.10 is being worked on, except for WebEngine (it would slow down an update way too much), because Plasma is going to want Qt 5.10 soon.</li>
<li>CMake 3.11 is in the -rc stage, so that is being lined up.</li>
<li>The kde5-import branch in KDE-FreeBSD’s copy of the FreeBSD ports tree (e.g. Area51) is being prepped and polished for a few big SVN commits that will add all the new bits.</li>
</ul>

<blockquote>
  <p>So we’ve been saying Real Soon Now ™ for years, but things are Realer Sooner Nower ™ now.</p>
</blockquote>

<p><hr /></p>

<h3><a href="http://blog.frankleonhardt.com/2017/del-fs12-nv7-and-other-2u-server-e-g-c6100-disk-system-hacking/">Dell FS12-NV7 and other 2U server (e.g. C6100) disk system hacking</a></h3>

<blockquote>
  <p>A while back I reviewed the Dell FS12-NV7 – a 2U rack server being sold cheap by all and sundry. It’s a powerful box, even by modern standards, but one of its big drawbacks is the disk system it comes with. But it needn’t be.</p>
  
  <p>There are two viable solutions, depending on what you want to do. You can make use of the SAS backplane, using SAS and/or SATA drives, or you can go for fewer SATA drives and free up one or more PCIe slots as Plan B. You probably have an FS12 because it looks good for building a drive array (or even FreeNAS) so I’ll deal with Plan A first.</p>
  
  <p>Like most Dell servers, this comes with a Dell PERC RAID SAS controller – a PERC6/i to be precise. This ‘I’ means it has internal connectors; the /E is the same but its sockets are external.</p>
  
  <p>The PERC connects to a twelve-slot backplane forming a drive array at the front of the box. More on the backplane later; it’s the PERCs you need to worry about.</p>
  
  <p>The PERC6 is actually an LSI Megaraid 1078 card, which is just the thing you need if you’re running an operating system like Windows that doesn’t support a volume manager, striping and other grown-up stuff. Or if your OS does have these features, but you just don’t trust it. If you are running such an OS you may as well stick to the PERC6, and good luck to you. If you’re using BSD (including FreeNAS), Solaris or a Linux distribution that handles disk arrays, read on. The PERC6 is a solution to a problem you probably don’t have, but in all other respects its a turkey. You really want a straightforward HBA (Host Bus Adapter) that allows your clever operating system to talk directly with the drives.</p>
  
  <p>Any SAS card based on the 1078 (such as the PERC6) is likely to have problems with drives larger than 2Tb. I’m not completely sure why, but I suspect it only applies to SATA. Unfortunately I don’t have any very large SAS drives to test this theory. A 2Tb limit isn’t really such a problem when you’re talking about a high performance array, as lots of small drives are a better option anyway. But it does matter if you’re building a very large datastore and don’t mind slower access and very significant resilvering times when you replace a drive. And for large datastores, very large SATA drives save you a whole lot of cash. The best capacity/cost ratio is for 5Gb SATA drives</p>
  
  <p>Some Dell PERCs can be re-flashed with LSI firmware and used as a normal HBA. Unfortunately the PERC6 isn’t one of them. I believe the PERC6/R can be, but those I’ve seen in a FS12 are just a bit too old. So the first thing you’ll need to do is dump them in the recycling or try and sell them on eBay.</p>
  
  <p>There are actually two PERC6 cards in most machine, and they each support eight SAS channels through two SFF-8484 connectors on each card. Given there are twelve drives slots, one of the PERCs is only half used. Sometimes they have a cable going off to a battery located near the fans. This is used in a desperate attempt to keep the data in the card’s cache safe in order to avoid write holes corrupting NTFS during a power failure, although the data on the on-drive caches won’t be so lucky. If you’re using a file system like that, make sure you have a UPS for the whole lot.</p>
  
  <p>But we’re going to put the PERCs out of our misery and replace them with some nice new LSI HBAs that will do our operating system’s bidding and let it talk to the drives as it knows best. But which to pick? First we need to know what we’re connecting.</p>
  
  <p>Moving to the front of the case there are twelve metal drive slots with a backplane behind. Dell makes machines with either backplanes or expanders. A backplane has a 1:1 SAS channel to drive connection; an expander takes one SAS channel and multiplexes it to (usually) four drives. You could always swap the blackplane with an expander, but I like the 1:1 nature of a backplane. It’s faster, especially if you’re configured as an array. And besides, we don’t want to spend more money than we need to, otherwise we wouldn’t be hot-rodding a cheap 2U server in the first place – expanders are expensive. Bizarrely, HBAs are cheap in comparison. So we need twelve channels of SAS that will connect to the sockets on the backplane.</p>
  
  <p>The HBA you will probably want to go with is an LSI, as these have great OS support. Other cards are available, but check that the drivers are also available. The obvious choice for SAS aficionados is the LSI 9211-8i, which has eight internal channels. This is based on an LSI 2000 series chip, the 2008, which is the de-facto standard. There’s also four-channel -4i version, so you could get your twelve channels using one of each – but the price difference is small these days, so you might as well go for two -8i cards. If you want cheaper there are 1068-based equivalent cards, and these work just fine at about half the price. They probably won’t work with larger disks, only operate at 3Gb and the original SAS standard. However, the 2000 series is only about £25 extra and gives you more options for the future. A good investment. Conversely, the latest 3000 series cards can do some extra stuff (particularly to do with active cables) but I can’t see any great advantage in paying megabucks for one unless you’re going really high-end – in which case the NV12 isn’t the box for you anyway. And you’d need some very fast drives and a faster backplane to see any speed advantage. And probably a new motherboard….</p>
  
  <p>Whether the 6Gb SAS2 of the 9211-8i is any use on the backplane, which was designed for 3Gb, I don’t know. If it matters that much to you you probably need to spend a lot more money. A drive array with a direct 3Gb to each drive is going to shift fast enough for most purposes.</p>
  
  <p>Once you have removed the PERCs and plugged in your modern-ish 9211 HBAs, your next problem is going to be the cable. Both the PERCs and the backplane have SFF-8484 multi-lane connectors, which you might not recognise. SAS is a point-to-point system, the same as SATA, and a multi-lane cable is simply four single cables in a bundle with one plug. (Newer versions of SAS have more). SFF-8484 multi-lane connectors are somewhat rare, (but unfortunately this doesn’t make them valuable if you were hoping to flog them on eBay). The world switched quickly to the SFF-8087 for multi-lane SAS. The signals are electrically the same, but the connector is not.</p>
  
  <p>Please generate and paste your ad code here. If left empty, the ad location will be highlighted on your blog pages with a reminder to enter your code. Mid-Post
  So there are two snags with this backplane. Firstly it’s designed to work with PERC controllers; secondly it has the old SFF-8484 connectors on the back, and any SAS cables you find are likely to have SFF-8087.</p>
  
  <p>First things first – there is actually a jumper on the backplane to tell it whether it’s talking to a PERC or a standard LSI HBA. All you need to do is find it and change it. Fortunately there are very few jumpers to choose from (i.e. two), and you know the link is already in the wrong place. So try them one at a time until it works. The one you want may be labelled J15, but I wouldn’t like to say this was the same on every variant.</p>
  
  <p>Second problem: the cable. You can get cables with an SFF-8087 on one end and an SFF-8484 on the other. These should work. But they’re usually rather expensive. If you want to make your own, it’s a PITA but at least you have the connectors already (assuming you didn’t bin the ones on the PERC cables).</p>
  
  <p>I don’t know what committee designed SAS cable connectors, but ease of construction wasn’t foremost in their collective minds. You’re basically soldering twisted pair to a tiny PCB. This is mechanically rubbish, of course, as the slightest force on the cable will lift the track. Therefore its usual to cover the whole joint in solidified gunk (technical term) to protect it. Rewiring SAS connectors is definitely not easy.</p>
  
  <p>I’ve tried various ways of soldering to them, none of which were satisfactory or rewarding. One method is to clip the all bare wires you wish to solder using something like a bulldog clip so they’re at lined up horizontally and then press then adjust the clamp so they’re gently pressed to the tracks on the board, making final adjustments with a strong magnifying glass and a fine tweezers. You can then either solder them with a fine temperature-controlled iron, or have pre-coated the pads with solder paste and flash across it with an SMD rework station. I’d love to know how they’re actually manufactured – using a precision jig I assume.</p>
  
  <p>The “easy” way is to avoid soldering the connectors at all; simply cut existing cables in half and join one to the other. I’ve used prototyping matrix board for this. Strip and twist the conductors, push them through a hole and solder. This keeps things compact but manageable. We’re dealing with twisted pair here, so maintain the twists as close as possible to the board – it actually works quite well.</p>
  
  <p>However, I’ve now found a reasonably-priced source of the appropriate cable so I don’t do this any more. Contact me if you need some in the UK.</p>
  
  <p>So all that remains is to plug your HBAs to the backplane, shove in some drives and you’re away. If you’re at this stage, it “just works”. The access lights for all the drives do their thing as they should. The only mystery is how you can get the ident LED to come on; this may be controlled by the PERC when it detects a failure using the so-called sideband channel, or it may be operated by the electronics on the backplane. It’s workings are, I’m afraid, something of a mystery still – it’s got too much electronics on board to be a completely passive backplane.</p>
  
  <p>Plan B: SATA</p>
  
  <p>If you plan to use only SATA drives, especially if you don’t intend using more than six, it makes little sense to bother with SAS at all. The Gigabyte motherboard comes with half a dozen perfectly good 3Gb SATA channels, and if you need more you can always put another controller in a PCIe slot, or even USB. The advantages are lower cost and you get to free up two PCIe slots for more interesting things.</p>
  
  <p>The down-side is that you can’t use the SAS backplane, but you can still use the mounting bays.</p>
  
  <p>Removing the backplane looks tricky, but it really isn’t when you look a bit closer. Take out the fans first (held in place by rubber blocks), undo a couple of screws and it just lifts and slides out. You can then slot and lock in the drives and connect the SATA connectors directly to the back of the drives. You could even slide them out again without opening the case, as long as the cable was long enough and you manually detached the cable it when it was withdrawn. And let’s face it – drives are likely to last for years so even with half a dozen it’s not that great a hardship to open the case occasionally.</p>
  
  <p>Next comes power. The PSU has a special connector for the backplane and two standard SATA power plugs. You could split these three ways using an adapter, but if you have a lot of drives you might want to re-wire the cables going to the backplane plug. It can definitely power twelve drives.</p>
  
  <p>And that’s almost all there is to it. Unfortunately the main fans are connected to the backplane, which you’ve just removed. You can power them from an adapter on the drive power cables, but there are unused fan connectors on the motherboard. I’m doing a bit more research on cooling options, but this approach has promising possibilities for noise reduction.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://euroquis.nl/bobulate/?p=1787">Adriaan de Groot’s post FOSDEM blog post</a></li>
<li><a href="https://www.manios.ca/blog/2018/01/my-first-freenas/">My First FreeNAS</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-fs/2018-March/025997.html">smart(8) Call for Testing by Michael Dexter</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-travel-grant-application-now-open/">BSDCan 2018 Travel Grant Application Now Open</a></li>
<li><a href="https://divelog.blue/linus_torvalds.html">BSD Developer Kristaps Dzonsons interviews Linus Torvalds, about diving</a></li>
<li><a href="https://twitter.com/michaeldexter/status/979236774667939840">Twitter vote - The secret to a faster FreeBSD default build world...</a></li>
<li><a href="https://tmate.io/">tmate - Instant terminal sharing</a></li>
</ul>

<p><hr /></p>

<p><strong>Tarsnap</strong></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Vikash - <a href="http://dpaste.com/05X35B1#wrap">Getting a port added</a></li>
<li>Chris Wells - <a href="http://dpaste.com/05S7A6V#wrap">Quarterly Ports Branch</a></li>
<li><a href="https://github.com/freebsd/freebsd-ci">FreeBSD-CI configs on Github</a></li>
<li><a href="https://wiki.freebsd.org/Jenkins">Jenkins on the FreeBSD Wiki</a></li>
<li>Gordon - <a href="http://dpaste.com/0HSVFE7#wrap">Centralised storage suggestions</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>New ZFS features landing in FreeBSD, MAP_STACK for OpenBSD, how to write safer C code with Clang’s address sanitizer, Michael W. Lucas on sponsor gifts, TCP blackbox recorder, and Dell disk system hacking.</p>

<h2>Headlines</h2>

<h3>[A number of Upstream ZFS features landed in FreeBSD this week]</h3>

<ul>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331711">9188 increase size of dbuf cache to reduce indirect block decompression</a></p>

<blockquote>
  <p>With compressed ARC (6950) we use up to 25% of our CPU to decompress indirect blocks, under a workload of random cached reads. To reduce this decompression cost, we would like to increase the size of the dbuf cache so that more indirect blocks can be stored uncompressed.
  If we are caching entire large files of recordsize=8K, the indirect blocks use 1/64th as much memory as the data blocks (assuming they have the same compression ratio). We suggest making the dbuf cache be 1/32nd of all memory, so that in this scenario we should be able to keep all the indirect blocks decompressed in the dbuf cache. (We want it to be more than the 1/64th that the indirect blocks would use because we need to cache other stuff in the dbuf cache as well.)
  In real world workloads, this won't help as dramatically as the example above, but we think it's still worth it because the risk of decreasing performance is low. The potential negative performance impact is that we will be slightly reducing the size of the ARC (by ~3%).</p>
</blockquote></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331701">9166 zfs storage pool checkpoint</a></p>

<blockquote>
  <p>The idea of Storage Pool Checkpoint (aka zpool checkpoint) deals with exactly that.  It can be thought of as a “pool-wide snapshot” (or a variation of extreme rewind that doesn’t corrupt your data).  It remembers the entire state of the pool at the point that it was taken and the user can revert back to it later or discard it.  Its generic use case is an administrator that is about to perform a set of destructive actions to ZFS as part of a critical procedure.  She takes a checkpoint of the pool before performing the actions, then rewinds back to it if one of them fails or puts the pool into an unexpected state.  Otherwise, she discards it.  With the assumption that no one else is making modifications to ZFS, she basically wraps all these actions into a “high-level transaction”.</p>
</blockquote></li>
<li><p><a href="https://sdimitro.github.io/post/zpool-checkpoint/">More information</a></p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331404">8484 Implement aggregate sum and use for arc counters</a></p>

<blockquote>
  <p>In pursuit of improving performance on multi-core systems, we should implements fanned out counters and use them to improve the performance of some of the arc statistics. These stats are updated extremely frequently, and can consume a significant amount of CPU time.</p>
</blockquote></li>
<li><p>And a small bug fix authored by me:</p></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331709">9321 arc<em>loan</em>compressed<em>buf() can increment arc</em>loaned<em>bytes by the wrong value</a>


<blockquote>
  arc</em>loan<em>compressed</em>buf() increments arc<em>loaned</em>bytes by psize unconditionally In the case of zfs<em>compressed</em>arc<em>enabled=0, when the buf is returned via arc</em>return<em>buf(), if ARC</em>BUF<em>COMPRESSED(buf) is false, then arc</em>loaned<em>bytes is decremented by lsize, not psize.
  Switch to using arc</em>buf<em>size(buf), instead of psize, which will return psize or lsize, depending on the result of ARC</em>BUF_COMPRESSED(buf).</li>
  </ul>
  <hr />
</blockquote>

<h3><a href="https://marc.info/?l=openbsd-tech&amp;m=152035796722258&amp;w=2">MAP_STACK for OpenBSD</a></h3>



<blockquote>
  <p>Almost 2 decades ago we started work on W^X.  The concept was simple. Pages that are writable, should not be executable.  We applied this concept object by object, trying to seperate objects with different qualities to different pages. The first one we handled was the signal trampoline at the top of the stack.  We just kept making changes in the same vein.  Eventually W^X came to some of our kernel address spaces also.
  The fundamental concept is that an object should only have the
  permissions necessary, and any other operation should fault.  The only permission separations we have are kernel vs userland, and then read, write, and execute.
  How about we add another new permission!  This is not a hardware permission, but a software permission.  It is opportunistically enforced by the kernel.
  the permission is MAP<em>STACK.  If you want to use memory as a stack, you must mmap it with that flag bit.  The kernel does so automatically for the stack region of a process's stack.  Two other types of stack occur: thread stacks, and alternate signal stacks.  Those are handled in clever ways.
  When a system call happens, we check if the stack-pointer register points to such a page.  If it doesn't, the program is killed.  We have tightened the ABI.  You may no longer point your stack register at non-stack memory.  You'll be killed.  This checking code is MI, so it works for all platforms.
  Since page-permissions are generally done on page boundaries, there is caveat that thread and altstacks must now be page-sized and page-aligned, so that we can enforce the MAP</em>STACK attribute correctly.  It is possible that a few ports need some massaging to satisfy this condition, but we haven't found any which break yet.  A syslog_r has been added so that we can identify these failure cases. Also, the faulting cases are quite verbose for now, to help identify the programs we need to repair.</p>
</blockquote>

<hr />



**iXsystems**



<h3><a href="https://dev.to/loderunner/writing-safer-c-with-clang-address-sanitizer">Writing Safer C with the Clang Address Sanitizer</a></h3>



<blockquote>
  <p>We wanted to improve our password strength algorithm, and decided to go for the industry-standard zxcvbn, from the people at Dropbox. Our web front-end would use the default Javascript library, and for mobile and desktop, we chose to use the C implementation as it was the lowest common denominator for all platforms.
  Bootstrapping all of this together was done pretty fast. I had toyed around with a few sample passwords so I decided to run it through the test suite we had for the previous password strength evaluator. The test generates a large number of random passwords according to different rules and expects the strength to be in a given range. But the test runner kept crashing with segmentation faults.
  It turns out the library has a lot of buffer overflow cases that are usually "harmless", but eventually crash your program when you run the evaluator function too much. I started fixing the cases I could see, but reading someone else's algorithms to track down tiny memory errors got old pretty fast. I needed a tool to help me.
  That's when I thought of Clang's Address Sanitizer.
  AddressSanitizer is a fast memory error detector. It consists of a compiler instrumentation module and a run-time library
  Let's try the sanitizer on a simple program. We'll allocate a buffer on the heap, copy each character of a string into it, and print it to standard output.
  + The site walks through a simple example which contains an error, it writes past the end of a buffer
  + The code works as expected, and nothing bad happens. It must be fine…
  + Then they compile it again with the address sanitizer actived
  So what can we gather from that pile of hex? Let's go through it line by line.
  AddressSanitizer found a heap buffer overflow at 0x60200000ef3d, a seemingly valid address (not NULL or any other clearly faulty value).
  + ASAN points directly to the line of code that is causing the problem
  We're writing outside of the heap in this instruction. And AddressSanitizer isn't having it.
  This is definitely one of my favorite indications. In addition to telling which line in the code failed and where in the memory the failure happened, you get a complete description of the closest allocated region in memory (which is probably the region you were trying to access).
  + They then walk through combining this with lldb, the Clang debugger, to actually interactively inspect the state of the problem when an invalid memory access happens
  Back to my practical case, how did I put the address sanitizer to good use? I simply ran the test suite, compiled with the sanitizer, with lldb. Sure enough, it stopped on every line that could cause a crash. It turns out there were many cases where zxcvbn-c wrote past the end of allocated buffers, on the heap and on the stack. I fixed those cases in the C library and ran the tests again. Not a segfault in sight!
  I've used memory tools in the past, but they were usually unwieldy, or put such a toll on performance that they were useless in any real-life case. Clang's address sanitizer turned out to be detailed, reliable, and surprisingly easy to use. I've heard of the miracles of Valgrind but macOS hardly supports it, making it a pain to use on my MacBook Pro.
  Coupled with Clang's static analyzer, AddressSanitizer is going to become a mandatory stop for evaluating code quality. It's also going to be the first tool I grab when facing confusing memory issues. There are many more case where I could use early failure and memory history to debug my code. For example, if a program crashes when accessing member of a deallocated object, we could easily trace the event that caused the deallocation, saving hours of adding and reading logs to retrace just what happened.</p>
</blockquote>

<hr />







<h2>News Roundup</h2>



<h3><a href="https://blather.michaelwlucas.com/archives/3131">On sponsor gifts</a></h3>



<blockquote>
  <p>Note the little stack of customs forms off to the side. It’s like I’ve learned a lesson from standing at the post office counter filling out those stupid forms. Sponsors should get their books soon.</p>
  
  <p>This seems like an apropos moment to talk about what I do for print sponsors. I say I send them “a gift,” but what does that really mean? The obvious thing to ship them is a copy of the book I’ve written. Flat-out selling print books online has tax implications, though.</p>
  
  <p>Sponsors might have guessed that they’d get a copy of the book. But I shipped them the hardcover, which isn’t my usual practice.</p>
  
  <p>That’s because I send sponsors a gift. As it’s a gift, I get to choose what I send. I want to send them something nice, to encourage them to sponsor another book. It makes no sense for me to send a sponsor a Singing Wedgie-O-Gram. (Well, maybe a couple sponsors. You know who you are.)</p>
  
  <p>The poor bastards who bought into my scam–er, sponsored my untitled book–have no idea what’s coming. As of right now, their sensible guesses are woefully incomplete.</p>
  
  <p>Future books? They might get a copy of the book. They might get book plus something. They might just get the something. Folks who sponsor the jails book might get a cake with a file in it. Who knows?</p>
  
  <p>It’s a gift. It’s my job to make that gift worthwhile.</p>
  
  <p>And to amuse myself. Because otherwise, what’s the point?</p>
</blockquote>

<hr />





<h3><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331347">TCP Blackbox Recorder</a></h3>

```
Add the "TCP Blackbox Recorder" which we discussed at the developer
summits at BSDCan and BSDCam in 2017.

The TCP Blackbox Recorder allows you to capture events on a TCP connection
in a ring buffer. It stores metadata with the event. It optionally stores
the TCP header associated with an event (if the event is associated with a
packet) and also optionally stores information on the sockets.

It supports setting a log ID on a TCP connection and using this to correlate
multiple connections that share a common log ID.

You can log connections in different modes. If you are doing a coordinated
test with a particular connection, you may tell the system to put it in
mode 4 (continuous dump). Or, if you just want to monitor for errors, you
can put it in mode 1 (ring buffer) and dump all the ring buffers associated
with the connection ID when we receive an error signal for that connection
ID. You can set a default mode that will be applied to a particular ratio
of incoming connections. You can also manually set a mode using a socket
option.

This commit includes only basic probes. rrs@ has added quite an abundance
of probes in his TCP development work. He plans to commit those soon.

There are user-space programs which we plan to commit as ports. These read
the data from the log device and output pcapng files, and then let you
analyze the data (and metadata) in the pcapng files.

Reviewed by:    gnn (previous version)
Obtained from:    Netflix, Inc.
Relnotes:    yes
Differential Revision:    https://reviews.freebsd.org/D11085
```



<hr />



**Digital Ocean**



<h3><a href="https://euroquis.nl/bobulate/?p=1812">Outta the way, KDE4</a></h3>



<blockquote>
  <p>KDE4 has been rudely moved aside on FreeBSD. It still installs (use x11/kde4) and should update without a problem, but this is another step towards adding modern KDE (Plasma 5 and Applications) to the official FreeBSD Ports tree.
  This has taken a long time mostly for administrative reasons, getting all the bits lined up so that people sticking with KDE4 (which, right now, would be everyone using KDE from official ports and packages on FreeBSD) don’t end up with a broken desktop. We don’t want that. But now that everything Qt4 and kdelibs4-based has been moved aside by suffixing it with -kde4, we have the unsuffixed names free to indicate the latest-and-greatest from upstream.</p>
  
  <p>KDE4 users will see a lot of packages moving around and being renamed, but no functional changes. Curiously, the KDE4 desktop depends on Qt5 and KDE Frameworks 5 — and it has for quite some time already, because the Oxygen icons are shared with KDE Frameworks, but primarily because FileLight was updated to the modern KDE Applications version some time ago (the KDE4 version had some serious bugs, although I can not remember what they were). Now that the names are cleaned up, we could consider giving KDE4 users the buggy version back.</p>
  
  <p>From here on, we’ve got the following things lined up:</p>
</blockquote>

<ul>
<li>Qt 5.10 is being worked on, except for WebEngine (it would slow down an update way too much), because Plasma is going to want Qt 5.10 soon.</li>
<li>CMake 3.11 is in the -rc stage, so that is being lined up.</li>
<li>The kde5-import branch in KDE-FreeBSD’s copy of the FreeBSD ports tree (e.g. Area51) is being prepped and polished for a few big SVN commits that will add all the new bits.</li>
</ul>

<blockquote>
  <p>So we’ve been saying Real Soon Now ™ for years, but things are Realer Sooner Nower ™ now.</p>
</blockquote>

<p><hr /></p>

<h3><a href="http://blog.frankleonhardt.com/2017/del-fs12-nv7-and-other-2u-server-e-g-c6100-disk-system-hacking/">Dell FS12-NV7 and other 2U server (e.g. C6100) disk system hacking</a></h3>

<blockquote>
  <p>A while back I reviewed the Dell FS12-NV7 – a 2U rack server being sold cheap by all and sundry. It’s a powerful box, even by modern standards, but one of its big drawbacks is the disk system it comes with. But it needn’t be.</p>
  
  <p>There are two viable solutions, depending on what you want to do. You can make use of the SAS backplane, using SAS and/or SATA drives, or you can go for fewer SATA drives and free up one or more PCIe slots as Plan B. You probably have an FS12 because it looks good for building a drive array (or even FreeNAS) so I’ll deal with Plan A first.</p>
  
  <p>Like most Dell servers, this comes with a Dell PERC RAID SAS controller – a PERC6/i to be precise. This ‘I’ means it has internal connectors; the /E is the same but its sockets are external.</p>
  
  <p>The PERC connects to a twelve-slot backplane forming a drive array at the front of the box. More on the backplane later; it’s the PERCs you need to worry about.</p>
  
  <p>The PERC6 is actually an LSI Megaraid 1078 card, which is just the thing you need if you’re running an operating system like Windows that doesn’t support a volume manager, striping and other grown-up stuff. Or if your OS does have these features, but you just don’t trust it. If you are running such an OS you may as well stick to the PERC6, and good luck to you. If you’re using BSD (including FreeNAS), Solaris or a Linux distribution that handles disk arrays, read on. The PERC6 is a solution to a problem you probably don’t have, but in all other respects its a turkey. You really want a straightforward HBA (Host Bus Adapter) that allows your clever operating system to talk directly with the drives.</p>
  
  <p>Any SAS card based on the 1078 (such as the PERC6) is likely to have problems with drives larger than 2Tb. I’m not completely sure why, but I suspect it only applies to SATA. Unfortunately I don’t have any very large SAS drives to test this theory. A 2Tb limit isn’t really such a problem when you’re talking about a high performance array, as lots of small drives are a better option anyway. But it does matter if you’re building a very large datastore and don’t mind slower access and very significant resilvering times when you replace a drive. And for large datastores, very large SATA drives save you a whole lot of cash. The best capacity/cost ratio is for 5Gb SATA drives</p>
  
  <p>Some Dell PERCs can be re-flashed with LSI firmware and used as a normal HBA. Unfortunately the PERC6 isn’t one of them. I believe the PERC6/R can be, but those I’ve seen in a FS12 are just a bit too old. So the first thing you’ll need to do is dump them in the recycling or try and sell them on eBay.</p>
  
  <p>There are actually two PERC6 cards in most machine, and they each support eight SAS channels through two SFF-8484 connectors on each card. Given there are twelve drives slots, one of the PERCs is only half used. Sometimes they have a cable going off to a battery located near the fans. This is used in a desperate attempt to keep the data in the card’s cache safe in order to avoid write holes corrupting NTFS during a power failure, although the data on the on-drive caches won’t be so lucky. If you’re using a file system like that, make sure you have a UPS for the whole lot.</p>
  
  <p>But we’re going to put the PERCs out of our misery and replace them with some nice new LSI HBAs that will do our operating system’s bidding and let it talk to the drives as it knows best. But which to pick? First we need to know what we’re connecting.</p>
  
  <p>Moving to the front of the case there are twelve metal drive slots with a backplane behind. Dell makes machines with either backplanes or expanders. A backplane has a 1:1 SAS channel to drive connection; an expander takes one SAS channel and multiplexes it to (usually) four drives. You could always swap the blackplane with an expander, but I like the 1:1 nature of a backplane. It’s faster, especially if you’re configured as an array. And besides, we don’t want to spend more money than we need to, otherwise we wouldn’t be hot-rodding a cheap 2U server in the first place – expanders are expensive. Bizarrely, HBAs are cheap in comparison. So we need twelve channels of SAS that will connect to the sockets on the backplane.</p>
  
  <p>The HBA you will probably want to go with is an LSI, as these have great OS support. Other cards are available, but check that the drivers are also available. The obvious choice for SAS aficionados is the LSI 9211-8i, which has eight internal channels. This is based on an LSI 2000 series chip, the 2008, which is the de-facto standard. There’s also four-channel -4i version, so you could get your twelve channels using one of each – but the price difference is small these days, so you might as well go for two -8i cards. If you want cheaper there are 1068-based equivalent cards, and these work just fine at about half the price. They probably won’t work with larger disks, only operate at 3Gb and the original SAS standard. However, the 2000 series is only about £25 extra and gives you more options for the future. A good investment. Conversely, the latest 3000 series cards can do some extra stuff (particularly to do with active cables) but I can’t see any great advantage in paying megabucks for one unless you’re going really high-end – in which case the NV12 isn’t the box for you anyway. And you’d need some very fast drives and a faster backplane to see any speed advantage. And probably a new motherboard….</p>
  
  <p>Whether the 6Gb SAS2 of the 9211-8i is any use on the backplane, which was designed for 3Gb, I don’t know. If it matters that much to you you probably need to spend a lot more money. A drive array with a direct 3Gb to each drive is going to shift fast enough for most purposes.</p>
  
  <p>Once you have removed the PERCs and plugged in your modern-ish 9211 HBAs, your next problem is going to be the cable. Both the PERCs and the backplane have SFF-8484 multi-lane connectors, which you might not recognise. SAS is a point-to-point system, the same as SATA, and a multi-lane cable is simply four single cables in a bundle with one plug. (Newer versions of SAS have more). SFF-8484 multi-lane connectors are somewhat rare, (but unfortunately this doesn’t make them valuable if you were hoping to flog them on eBay). The world switched quickly to the SFF-8087 for multi-lane SAS. The signals are electrically the same, but the connector is not.</p>
  
  <p>Please generate and paste your ad code here. If left empty, the ad location will be highlighted on your blog pages with a reminder to enter your code. Mid-Post
  So there are two snags with this backplane. Firstly it’s designed to work with PERC controllers; secondly it has the old SFF-8484 connectors on the back, and any SAS cables you find are likely to have SFF-8087.</p>
  
  <p>First things first – there is actually a jumper on the backplane to tell it whether it’s talking to a PERC or a standard LSI HBA. All you need to do is find it and change it. Fortunately there are very few jumpers to choose from (i.e. two), and you know the link is already in the wrong place. So try them one at a time until it works. The one you want may be labelled J15, but I wouldn’t like to say this was the same on every variant.</p>
  
  <p>Second problem: the cable. You can get cables with an SFF-8087 on one end and an SFF-8484 on the other. These should work. But they’re usually rather expensive. If you want to make your own, it’s a PITA but at least you have the connectors already (assuming you didn’t bin the ones on the PERC cables).</p>
  
  <p>I don’t know what committee designed SAS cable connectors, but ease of construction wasn’t foremost in their collective minds. You’re basically soldering twisted pair to a tiny PCB. This is mechanically rubbish, of course, as the slightest force on the cable will lift the track. Therefore its usual to cover the whole joint in solidified gunk (technical term) to protect it. Rewiring SAS connectors is definitely not easy.</p>
  
  <p>I’ve tried various ways of soldering to them, none of which were satisfactory or rewarding. One method is to clip the all bare wires you wish to solder using something like a bulldog clip so they’re at lined up horizontally and then press then adjust the clamp so they’re gently pressed to the tracks on the board, making final adjustments with a strong magnifying glass and a fine tweezers. You can then either solder them with a fine temperature-controlled iron, or have pre-coated the pads with solder paste and flash across it with an SMD rework station. I’d love to know how they’re actually manufactured – using a precision jig I assume.</p>
  
  <p>The “easy” way is to avoid soldering the connectors at all; simply cut existing cables in half and join one to the other. I’ve used prototyping matrix board for this. Strip and twist the conductors, push them through a hole and solder. This keeps things compact but manageable. We’re dealing with twisted pair here, so maintain the twists as close as possible to the board – it actually works quite well.</p>
  
  <p>However, I’ve now found a reasonably-priced source of the appropriate cable so I don’t do this any more. Contact me if you need some in the UK.</p>
  
  <p>So all that remains is to plug your HBAs to the backplane, shove in some drives and you’re away. If you’re at this stage, it “just works”. The access lights for all the drives do their thing as they should. The only mystery is how you can get the ident LED to come on; this may be controlled by the PERC when it detects a failure using the so-called sideband channel, or it may be operated by the electronics on the backplane. It’s workings are, I’m afraid, something of a mystery still – it’s got too much electronics on board to be a completely passive backplane.</p>
  
  <p>Plan B: SATA</p>
  
  <p>If you plan to use only SATA drives, especially if you don’t intend using more than six, it makes little sense to bother with SAS at all. The Gigabyte motherboard comes with half a dozen perfectly good 3Gb SATA channels, and if you need more you can always put another controller in a PCIe slot, or even USB. The advantages are lower cost and you get to free up two PCIe slots for more interesting things.</p>
  
  <p>The down-side is that you can’t use the SAS backplane, but you can still use the mounting bays.</p>
  
  <p>Removing the backplane looks tricky, but it really isn’t when you look a bit closer. Take out the fans first (held in place by rubber blocks), undo a couple of screws and it just lifts and slides out. You can then slot and lock in the drives and connect the SATA connectors directly to the back of the drives. You could even slide them out again without opening the case, as long as the cable was long enough and you manually detached the cable it when it was withdrawn. And let’s face it – drives are likely to last for years so even with half a dozen it’s not that great a hardship to open the case occasionally.</p>
  
  <p>Next comes power. The PSU has a special connector for the backplane and two standard SATA power plugs. You could split these three ways using an adapter, but if you have a lot of drives you might want to re-wire the cables going to the backplane plug. It can definitely power twelve drives.</p>
  
  <p>And that’s almost all there is to it. Unfortunately the main fans are connected to the backplane, which you’ve just removed. You can power them from an adapter on the drive power cables, but there are unused fan connectors on the motherboard. I’m doing a bit more research on cooling options, but this approach has promising possibilities for noise reduction.</p>
</blockquote>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://euroquis.nl/bobulate/?p=1787">Adriaan de Groot’s post FOSDEM blog post</a></li>
<li><a href="https://www.manios.ca/blog/2018/01/my-first-freenas/">My First FreeNAS</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-fs/2018-March/025997.html">smart(8) Call for Testing by Michael Dexter</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-travel-grant-application-now-open/">BSDCan 2018 Travel Grant Application Now Open</a></li>
<li><a href="https://divelog.blue/linus_torvalds.html">BSD Developer Kristaps Dzonsons interviews Linus Torvalds, about diving</a></li>
<li><a href="https://twitter.com/michaeldexter/status/979236774667939840">Twitter vote - The secret to a faster FreeBSD default build world...</a></li>
<li><a href="https://tmate.io/">tmate - Instant terminal sharing</a></li>
</ul>

<p><hr /></p>

<p><strong>Tarsnap</strong></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Vikash - <a href="http://dpaste.com/05X35B1#wrap">Getting a port added</a></li>
<li>Chris Wells - <a href="http://dpaste.com/05S7A6V#wrap">Quarterly Ports Branch</a></li>
<li><a href="https://github.com/freebsd/freebsd-ci">FreeBSD-CI configs on Github</a></li>
<li><a href="https://wiki.freebsd.org/Jenkins">Jenkins on the FreeBSD Wiki</a></li>
<li>Gordon - <a href="http://dpaste.com/0HSVFE7#wrap">Centralised storage suggestions</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 239: The Return To ptrace | BSD Now 239</title>
  <link>https://www.bsdnow.tv/239</link>
  <guid isPermaLink="false">http://feed.jupiter.zone/bsdnow#entry-1668</guid>
  <pubDate>Thu, 29 Mar 2018 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/17c4fe12-c4ee-47a7-8d14-1a73407e86f4.mp3" length="44655271" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD firewalling Windows 10, NetBSD’s return to ptrace, TCP Alternative Backoff, the BSD Poetic license, and AsiaBSDcon 2018 videos available.</itunes:subtitle>
  <itunes:duration>1:32:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD firewalling Windows 10, NetBSD’s return to ptrace, TCP Alternative Backoff, the BSD Poetic license, and AsiaBSDcon 2018 videos available.
&lt;h3&gt;RSS Feeds:&lt;/h3&gt;
&lt;p&gt;&lt;a href="http://feeds.feedburner.com/BsdNowMp3"&gt;MP3 Feed&lt;/a&gt; &lt;strong&gt;|&lt;/strong&gt; &lt;a href="https://itunes.apple.com/us/podcast/bsd-now-mp3/id701045710?mt=2"&gt;iTunes Feed&lt;/a&gt; &lt;strong&gt;|&lt;/strong&gt; &lt;a href="http://feeds.feedburner.com/BsdNowHd"&gt;HD Vid Feed&lt;/a&gt; &lt;strong&gt;|&lt;/strong&gt; &lt;a href="http://bitlove.org/jupiterbroadcasting/bsdnowhd/feed"&gt;HD Torrent Feed&lt;/a&gt;&lt;/p&gt;

&lt;h3&gt;
&lt;a href="http://www.patreon.com/jupitersignal"&gt;Become a supporter on Patreon&lt;/a&gt;:&lt;/h3&gt;

&lt;p&gt;&lt;a href="http://www.patreon.com/jupitersignal"&gt;&lt;img src="http://i.imgur.com/2ioAf3Q.png" alt="Patreon"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;h3&gt;- Show Notes: -&lt;/h3&gt;

&lt;h2&gt;Headlines&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://www.ibm.com/developerworks/community/blogs/karsten/entry/Preventing_Windows_10_and_untrusted_software_from_having_full_access_to_the_internet?lang=en"&gt;Preventing Windows 10 and untrusted software from having full access to the internet using OpenBSD&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Whilst setting up one of my development laptops to port some software to Windows I noticed Windows 10 doing crazy things like installing or updating apps and games by default after initial setup. The one I noticed in particular was Candy Crush Soda Saga which for those who don't know of it is some cheesy little puzzle game originally for consumer devices. I honestly did not want software like this near to a development machine. It has also been reported that Windows 10 now also updates core system software without notifying the user. Surely this destroys any vaguely deterministic behaviour, in my opinion making Windows 10 by default almost useless for development testbeds.&lt;/p&gt;
  
  &lt;p&gt;Deciding instead to start from scratch but this time to set the inbuilt Windows Firewall to be very restrictive and only allow a few select programs to communicate. In this case all I really needed to be online was Firefox, Subversion and Putty. To my amusement (and astonishment) I found out that the Windows firewall could be modified to give access very easily by programs during installation (usually because this task needs to be done with admin privileges). It also seems that Windows store Apps can change the windows firewall settings at any point. One way to get around this issue could be to install a 3rd party firewall that most software will not have knowledge about and thus not attempt to break through. However the only decent firewall I have used was Sygate Pro which unfortunately is no longer supported by recent operating systems. The last supported versions was 2003, XP and 2000. In short, I avoid 3rd party firewalls.&lt;/p&gt;
  
  &lt;p&gt;Instead I decided to trap Windows 10 (and all of it's rogue updaters) behind a virtual machine running OpenBSD. This effectively provided me with a full blown firewall appliance. From here I could then allow specific software I trusted through the firewall (via a proxy) in a safe, controlled and deterministic manner. For other interested developers (and security conscious users) and for my own reference, I have listed the steps taken here:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;1) First and foremost disable the Windows DHCP service - this is so no IP can be obtained on any interface. This effectively stops any communication with any network on the host system. This can be done by running services.msc with admin privileges and stopping and disabling the service called DHCP Client.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;2) Install or enable your favorite virtualization software - I have tested this with both VirtualBox and Hyper-V. Note that on non-server versions of Windows, in order to get Hyper-V working, your processor also needs to support SLAT which is daft so to avoid faffing about, I recommend using VirtualBox to get round this seemingly arbitrary restriction.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;3) Install OpenBSD on the VM - Note, if you decide to use Hyper-V, its hardware support isn't 100% perfect to run OpenBSD and you will need to disable a couple of things in the kernel. At the initial boot prompt, run the following commands.&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;code&gt;
config -e -o /bsd /bsd
disable acpi
disable mpbios
&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;4) Add a host only virtual adapter to the VM - This is the one which we are going to connect through the VM with. Look at the IP that VirtualBox assigns this in network manager on the host machine. Mine was [b]192.168.56.1[/b]. Set up the adapter in the OpenBSD VM to have a static address on the same subnet. For example [b]192.168.56.2[/b]. If you are using Hyper-V and OpenBSD, make sure you add a "Legacy Interface" because no guest additions are available. Then set up a virtual switch which is host only.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;5) Add a bridged adapter to the VM - then assign it to whichever interface you wanted to connect to the external network with. Note that if using Wireless, set the bridged adapters MAC address to the same as your physical device or the access point will reject it. This is not needed (or possible) on Hyper-V because the actual device is "shared" rather than bridged so the same MAC address is used. Again, if you use Hyper-V, then add another virtual switch and attach it to your chosen external interface. VMs in Hyper-V "share" an adapter within a virtual switch and there is the option to also disable the hosts ability to use this interface at the same time which is fine for an additional level of security if those pesky rogue apps and updaters can also enable / disable DHCP service one day which wouldn't be too surprising.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;6) Connect to your network in the host OS - In case of Wireless, select the correct network from the list and type in a password if needed. Windows will probably say "no internet available", it also does not assign an IP address which is fine.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;7) Install the Squid proxy package on the OpenBSD guest and enable the daemon&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;```&lt;/p&gt;

&lt;h4&gt;pkg_add squid&lt;/h4&gt;

&lt;h4&gt;echo 'squid_flags=""' &amp;gt;&amp;gt; /etc/rc.conf.local&lt;/h4&gt;

&lt;h4&gt;/etc/rc.d/squid start&lt;/h4&gt;

&lt;p&gt;```&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;We will use this service for a limited selection of "safe and trusted" programs to connect to the outside world from within the Windows 10 host. You can also use putty on the host to connect to the VM via SSH and create a SOCKS proxy which software like Firefox can also use to connect externally.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;8) Configure the software you want to be able to access the external network with&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Firefox - go to the connection settings and specify the VMs IP address for the proxy.&lt;/li&gt;
&lt;li&gt;Subversion - modify the %HOME%\AppData\Roaming\Subversion\servers file and change the HTTP proxy field to the VMs IP. This is important to communicate with GitHub via https:// (Yes, GitHub also supports Subversion). For svn:// addresses you can use Putty to port forward.&lt;/li&gt;
&lt;li&gt;Chromium/Chrome - unfortunately uses the global Windows proxy settings which defeats much of the purpose of this exercise if we were going to allow &lt;em&gt;all&lt;/em&gt; of Windows access to the internet via the proxy. It would become mayhem again. However we can still use Putty to create a SOCKS proxy and then launch the browser with the following flags:&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;code&gt;
--proxy-server="socks5://&amp;lt;VM IP&amp;gt;:&amp;lt;SOCKS PORT&amp;gt;"
--host-resolver-rules="MAP * 0.0.0.0 , EXCLUDE &amp;lt;VM IP&amp;gt;"
&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;9) Congratulations, you are now done - Admittedly this process can be a bit fiddly to set up but it completely prevents Windows 10 from making a complete mess. This solution is probably also useful for those who like privacy or don't like the idea of their software "phoning home". Hope you find this useful and if you have any issues, please feel free to leave questions in the comments.&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://blog.netbsd.org/tnf/entry/lldb_restoration_and_return_to"&gt;LLDB restoration and return to ptrace(2)&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I've managed to unbreak the LLDB debugger as much as possible with the current kernel and hit problems with ptrace(2) that are causing issues with further work on proper NetBSD support. Meanwhile, I've upstreamed all the planned NetBSD patches to sanitizers and helped other BSDs to gain better or initial support.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;LLDB&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Since the last time I worked on LLDB, we have introduced many changes to the kernel interfaces (most notably related to signals) that apparently fixed some bugs in Go and introduced regressions in ptrace(2). Part of the regressions were noted by the existing ATF tests. However, the breakage was only marked as a new problem to resolve. For completeness, the ptrace(2) code was also cleaned up by Christos Zoulas, and we fixed some bugs with compat32.&lt;/p&gt;
  
  &lt;p&gt;I've fixed a crash in *NetBSD::Factory::Launch(), triggered on startup of the lldb-server application.&lt;/p&gt;
  
  &lt;p&gt;Here is the commit message:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;```
We cannot call process_up-&amp;gt;SetState() inside
the NativeProcessNetBSD::Factory::Launch
function because it triggers a NULL pointer
deference.&lt;/p&gt;

&lt;p&gt;The generic code for launching a process in:
GDBRemoteCommunicationServerLLGS::LaunchProcess
sets the m&lt;em&gt;debugged&lt;/em&gt;process&lt;em&gt;up pointer after
a successful call to  m&lt;/em&gt;process&lt;em&gt;factory.Launch().
If we attempt to call process&lt;/em&gt;up-&amp;gt;SetState()
inside a platform specific Launch function we
end up dereferencing a NULL pointer in
NativeProcessProtocol::GetCurrentThreadID().&lt;/p&gt;

&lt;p&gt;Use the proper call process&lt;em&gt;up-&amp;gt;SetState(,false)
that sets notify&lt;/em&gt;delegates to false.
```&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Sanitizers&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;I suspended development of new features in sanitizers last month, but I was still in the process of upstreaming of local patches. This process was time-consuming as it required rebasing patches, adding dedicated tests, and addressing all other requests and comments from the upstream developers.&lt;/p&gt;
  
  &lt;p&gt;I'm not counting hot fixes, as some changes were triggering build or test issues on !NetBSD hosts. Thankfully all these issues were addressed quickly. The final result is a reduction of local delta size of almost 1MB to less than 100KB (1205 lines of diff). The remaining patches are rescheduled for later, mostly because they depend on extra work with cross-OS tests and prior integration of sanitizers with the basesystem distribution. I didn't want to put extra work here in the current state of affairs and, I've registered as a mentor for Google Summer of Code for the NetBSD Foundation and prepared Software Quality improvement tasks in order to outsource part of the labour.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Userland changes&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;I've also improved documentation for some of the features of NetBSD, described in man-pages. These pieces of information were sometimes wrong or incomplete, and this makes covering the NetBSD system with features such as sanitizers harder as there is a mismatch between the actual code and the documented code.&lt;/p&gt;
  
  &lt;p&gt;Some pieces of software also require better namespacing support, these days mostly for the POSIX standard. I've fixed few low-hanging fruits there and requested pullups to NetBSD-8(BETA).&lt;/p&gt;
  
  &lt;p&gt;I thank the developers for improving the landed code in order to ship the best solutions for users.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;BSD collaboration in LLVM&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;A One-man-show in human activity is usually less fun and productive than collaboration in a team. This is also true in software development. Last month I was helping as a reviewer to port LLVM features to FreeBSD and when possible to OpenBSD. This included MSan/FreeBSD, libFuzzer/FreeBSD, XRay/FreeBSD and UBSan/OpenBSD.&lt;/p&gt;
  
  &lt;p&gt;I've landed most of the submitted and reviewed code to the mainstream LLVM tree.&lt;/p&gt;
  
  &lt;p&gt;Part of the code also verified the correctness of NetBSD routes in the existing porting efforts and showed new options for improvement. This is the reason why I've landed preliminary XRay/NetBSD code and added missing NetBSD bits to ToolChain::getOSLibName(). The latter produced setup issues with the prebuilt LLVM toolchain, as the directory name with compiler-rt goodies were located in a path like ./lib/clang/7.0.0/lib/netbsd8.99.12 with a varying OS version. This could stop working after upgrades, so I've simplified it to "netbsd", similar to FreeBSD and Solaris.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Prebuilt toolchain for testers&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;I've prepared a build of Clang/LLVM with LLDB and compiler-rt features prebuilt on NetBSD/amd64 v. 8.99.12:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;&lt;code&gt;llvm-clang-compilerrt-lldb-7.0.0beta_2018-02-28.tar.bz2&lt;/code&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Plan for the next milestone&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;With the approaching NetBSD 8.0 release I plan to finish backporting a few changes there from HEAD:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Remove one unused feature from ptrace(2), PT&lt;em&gt;SET&lt;/em&gt;SIGMASK &amp;amp; PT&lt;em&gt;GET&lt;/em&gt;SIGMASK. I've originally introduced these operations with criu/rr-like software in mind, but they are misusing or even abusing ptrace(2) and are not regular process debuggers. I plan to remove this operation from HEAD and backport this to NetBSD-8(BETA), before the release, so no compat will be required for this call. Future ports of criu/rr should involve dedicated kernel support for such requirements.
Finish the backport of &lt;em&gt;UC&lt;/em&gt;MACHINE_FP() to NetBSD-8. This will allow use of the same code in sanitizers in HEAD and NetBSD-8.0.&lt;/li&gt;
&lt;li&gt;By popular demand, improve the regnsub(3) and regasub(3) API, adding support for more or less substitutions than 10.&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;Once done, I will return to ptrace(2) debugging and corrections.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;DigitalOcean&lt;/strong&gt;&lt;/p&gt;

&lt;h3&gt;&lt;a href="https://t.pagef.lt/working-with-the-netbsd-kernel/"&gt;Working with the NetBSD kernel&lt;/a&gt;&lt;/h3&gt;

&lt;ul&gt;
&lt;li&gt;Overview&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;When working on complex systems, such as OS kernels, your attention span and cognitive energy are too valuable to be wasted on inefficiencies pertaining to ancillary tasks. After experimenting with different environmental setups for kernel debugging, some of which were awkward and distracting from my main objectives, I have arrived to my current workflow, which is described here. This approach is mainly oriented towards security research and the study of kernel internals.&lt;/p&gt;
  
  &lt;p&gt;Before delving into the details, this is the general outline of my environment:&lt;/p&gt;
  
  &lt;p&gt;My host system runs Linux. My target system is a QEMU guest.&lt;/p&gt;
  
  &lt;p&gt;I’m tracing and debugging on my host system by attaching GDB (with NetBSD x86-64 ABI support) to QEMU’s built-in GDB server.
  I work with NetBSD-current. All sources are built on my host system with the cross-compilation toolchain produced by build.sh.
  I use NFS to share the source tree and the build artifacts between the target and the host.
  I find IDEs awkward, so for codebase navigation I mainly rely on vim, tmux and ctags.
  For non-intrusive instrumentation, such as figuring out control flow, I’m using dtrace.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Preparing the host system&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;QEMU&lt;/li&gt;
&lt;li&gt;GDB&lt;/li&gt;
&lt;li&gt;NFS Exports&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;&lt;p&gt;Building NetBSD-current&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;A word of warning&lt;/p&gt;

&lt;ul&gt;&lt;li&gt;Now is a great time to familiarize yourself with the build.sh tool and its options. Be especially carefull with the following options:&lt;/li&gt;&lt;/ul&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;code&gt;
    -r          Remove contents of TOOLDIR and DESTDIR before building.
    -u          Set MKUPDATE=yes; do not run "make clean" first.
        Without this, everything is rebuilt, including the tools.
&lt;/code&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;Chance are, you do not want to use these options once you’ve successfully built the cross-compilation toolchain and your entire userland, because building those takes time and there aren’t many good reasons to recompile them from scratch. Here’s what to expect:&lt;/p&gt;
  
  &lt;p&gt;On my desktop, running a quad-core Intel i5-3470 at 3.20GHz with 24GB of RAM and underlying directory structure residing on a SSD drive, the entire process took about 55 minutes. I was running make with -j12, so the machine was quite busy.
  On an old Dell D630 laptop, running Intel Core 2 Duo T7500 at 2.20GHz with 4GB of RAM and a slow hard drive (5400RPM), the process took approximatelly 2.5 hours. I was running make with -j4. Based on the temperature alerts and CPU clock throttling messages, it was quite a struggle.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;Acquiring the sources&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Compiling the sources&lt;/p&gt;

&lt;ul&gt;&lt;li&gt;Preparing the guest system&lt;/li&gt;&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;Provisioning your guest&lt;/li&gt;
&lt;li&gt;Pkgin and NFS shares&lt;/li&gt;
&lt;li&gt;Tailoring the kernel for debugging&lt;/li&gt;
&lt;li&gt;Installing the new kernel&lt;/li&gt;
&lt;li&gt;Configuring DTrace&lt;/li&gt;
&lt;li&gt;Debugging the guest’s kernel&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;h2&gt;News Roundup&lt;/h2&gt;

&lt;h3&gt;&lt;a href="https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=331214"&gt;Add support for the experimental Internet-Draft "TCP Alternative Backoff”&lt;/a&gt;&lt;/h3&gt;

&lt;p&gt;```
Add support for the experimental Internet-Draft "TCP Alternative Backoff with
ECN (ABE)" proposal to the New Reno congestion control algorithm module.
ABE reduces the amount of congestion window reduction in response to
ECN-signalled congestion relative to the loss-inferred congestion response.&lt;/p&gt;

&lt;p&gt;More details about ABE can be found in the Internet-Draft:
https://tools.ietf.org/html/draft-ietf-tcpm-alternativebackoff-ecn&lt;/p&gt;

&lt;p&gt;The implementation introduces four new sysctls:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;net.inet.tcp.cc.abe defaults to 0 (disabled) and can be set to non-zero to
enable ABE for ECN-enabled TCP connections.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;net.inet.tcp.cc.newreno.beta and net.inet.tcp.cc.newreno.beta&lt;em&gt;ecn set the
multiplicative window decrease factor, specified as a percentage, applied to
the congestion window in response to a loss-based or ECN-based congestion
signal respectively. They default to the values specified in the draft i.e.
beta=50 and beta&lt;/em&gt;ecn=80.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;net.inet.tcp.cc.abe_frlossreduce defaults to 0 (disabled) and can be set to
non-zero to enable the use of standard beta (50% by default) when repairing
loss during an ECN-signalled congestion recovery episode. It enables a more
conservative congestion response and is provided for the purposes of
experimentation as a result of some discussion at IETF 100 in Singapore.&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;The values of beta and beta&lt;em&gt;ecn can also be set per-connection by way of the
TCP&lt;/em&gt;CCALGOOPT TCP-level socket option and the new CC&lt;em&gt;NEWRENO&lt;/em&gt;BETA or
CC&lt;em&gt;NEWRENO&lt;/em&gt;BETA_ECN CC algo sub-options.&lt;/p&gt;

&lt;p&gt;Submitted by:    Tom Jones &lt;a href="mailto:tj@enoti.me"&gt;tj@enoti.me&lt;/a&gt;
Tested by:    Tom Jones &lt;a href="mailto:tj@enoti.me"&gt;tj@enoti.me&lt;/a&gt;, Grenville Armitage &lt;a href="mailto:garmitage@swin.edu.au"&gt;garmitage@swin.edu.au&lt;/a&gt;
Relnotes:    Yes
Differential Revision:    https://reviews.freebsd.org/D11616
```&lt;/p&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180228225937"&gt;Meltdown-mitigation syspatch/errata now available&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;The recent changes in -current mitigating the Meltdown vulnerability have been backported to the 6.1 and 6.2 (amd64) releases, and the syspatch update (for 6.2) is now available.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://marc.info/?l=openbsd-cvs&amp;amp;m=151964860620856&amp;amp;w=2"&gt;6.1&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;```
Changes by:    bluhm@cvs.openbsd.org   2018/02/26 05:36:18
Log message:
Implement a workaround against the Meltdown flaw in Intel CPUs.
The following changes have been backported from OpenBSD -current.&lt;/p&gt;

&lt;p&gt;Changes by:     guenther@cvs.openbsd.org        2018/01/06 15:03:13
Log message:
Handle %gs like %[def]s and reset set it in cpu_switchto() instead of on
every return to userspace.&lt;/p&gt;

&lt;p&gt;Changes by:     mlarkin@cvs.openbsd.org 2018/01/06 18:08:20
Log message:
Add identcpu.c and specialreg.h definitions for the new Intel/AMD MSRs
that should help mitigate spectre. This is just the detection piece, these
features are not yet used.
Part of a larger ongoing effort to mitigate meltdown/spectre. i386 will
come later; it needs some machdep.c cleanup first.&lt;/p&gt;

&lt;p&gt;Changes by:     mlarkin@cvs.openbsd.org 2018/01/07 12:56:19
Log message:
remove all PG_G global page mappings from the kernel when running on
Intel CPUs. Part of an ongoing set of commits to mitigate the Intel
"meltdown" CVE. This diff does not confer any immunity to that
vulnerability - subsequent commits are still needed and are being
worked on presently.
ok guenther, deraadt&lt;/p&gt;

&lt;p&gt;Changes by:     mlarkin@cvs.openbsd.org 2018/01/12 01:21:30
Log message:
IBRS -&amp;gt; IBRS,IBPB in identifycpu lines&lt;/p&gt;

&lt;p&gt;Changes by:     guenther@cvs.openbsd.org        2018/02/21 12:24:15
Log message:
Meltdown: implement user/kernel page table separation.
On Intel CPUs which speculate past user/supervisor page permission checks,
use a separate page table for userspace with only the minimum of kernel code
and data required for the transitions to/from the kernel (still marked as
supervisor-only, of course):
- the IDT (RO)
- three pages of kernel text in the .kutext section for interrupt, trap,
and syscall trampoline code (RX)
- one page of kernel data in the .kudata section for TLB flush IPIs (RW)
- the lapic page (RW, uncachable)
- per CPU: one page for the TSS+GDT (RO) and one page for trampoline
stacks (RW)
When a syscall, trap, or interrupt takes a CPU from userspace to kernel the
trampoline code switches page tables, switches stacks to the thread's real
kernel stack, then copies over the necessary bits from the trampoline stack.
On return to userspace the opposite occurs: recreate the iretq frame on the
trampoline stack, switch stack, switch page tables, and return to userspace.
mlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing
issues on MP in particular, and drove the final push to completion.
Many rounds of testing by naddy@, sthen@, and others
Thanks to Alex Wilson from Joyent for early discussions about trampolines
and their data requirements.
Per-CPU page layout mostly inspired by DragonFlyBSD.
ok mlarkin@ deraadt@&lt;/p&gt;

&lt;p&gt;Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:18:59
Log message:
The GNU assembler does not understand 1ULL, so replace the constant
with 1.  Then it compiles with gcc, sign and size do not matter
here.&lt;/p&gt;

&lt;p&gt;Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:27:14
Log message:
The compile time assertion for cpu info did not work with gcc.
Rephrase the condition in a way that both gcc and clang accept it.&lt;/p&gt;

&lt;p&gt;Changes by:     guenther@cvs.openbsd.org        2018/02/22 13:36:40
Log message:
Set the PG_G (global) bit on the special page table entries that are shared
between the u-k and u+k tables, because they're actually in &lt;em&gt;all&lt;/em&gt; tables.&lt;/p&gt;

&lt;p&gt;OpenBSD 6.1 errata 037
```&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;6.2&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;```
Changes by:    bluhm@cvs.openbsd.org   2018/02/26 05:29:48
Log message:
Implement a workaround against the Meltdown flaw in Intel CPUs.
The following changes have been backported from OpenBSD -current.&lt;/p&gt;

&lt;p&gt;Changes by:     guenther@cvs.openbsd.org        2018/01/06 15:03:13
Log message:
Handle %gs like %[def]s and reset set it in cpu_switchto() instead of on
every return to userspace.&lt;/p&gt;

&lt;p&gt;Changes by:     mlarkin@cvs.openbsd.org 2018/01/06 18:08:20
Log message:
Add identcpu.c and specialreg.h definitions for the new Intel/AMD MSRs
that should help mitigate spectre. This is just the detection piece, these
features are not yet used.
Part of a larger ongoing effort to mitigate meltdown/spectre. i386 will
come later; it needs some machdep.c cleanup first.&lt;/p&gt;

&lt;p&gt;Changes by:     mlarkin@cvs.openbsd.org 2018/01/07 12:56:19
Log message:
remove all PG_G global page mappings from the kernel when running on
Intel CPUs. Part of an ongoing set of commits to mitigate the Intel
"meltdown" CVE. This diff does not confer any immunity to that
vulnerability - subsequent commits are still needed and are being
worked on presently.&lt;/p&gt;

&lt;p&gt;Changes by:     mlarkin@cvs.openbsd.org 2018/01/12 01:21:30
Log message:
IBRS -&amp;gt; IBRS,IBPB in identifycpu lines&lt;/p&gt;

&lt;p&gt;Changes by:     guenther@cvs.openbsd.org        2018/02/21 12:24:15
Log message:
Meltdown: implement user/kernel page table separation.
On Intel CPUs which speculate past user/supervisor page permission checks,
use a separate page table for userspace with only the minimum of kernel code
and data required for the transitions to/from the kernel (still marked as
supervisor-only, of course):
- the IDT (RO)
- three pages of kernel text in the .kutext section for interrupt, trap,
and syscall trampoline code (RX)
- one page of kernel data in the .kudata section for TLB flush IPIs (RW)
- the lapic page (RW, uncachable)
- per CPU: one page for the TSS+GDT (RO) and one page for trampoline
stacks (RW)
When a syscall, trap, or interrupt takes a CPU from userspace to kernel the
trampoline code switches page tables, switches stacks to the thread's real
kernel stack, then copies over the necessary bits from the trampoline stack.
On return to userspace the opposite occurs: recreate the iretq frame on the
trampoline stack, switch stack, switch page tables, and return to userspace.
mlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing
issues on MP in particular, and drove the final push to completion.
Many rounds of testing by naddy@, sthen@, and others
Thanks to Alex Wilson from Joyent for early discussions about trampolines
and their data requirements.
Per-CPU page layout mostly inspired by DragonFlyBSD.&lt;/p&gt;

&lt;p&gt;Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:18:59
Log message:
The GNU assembler does not understand 1ULL, so replace the constant
with 1.  Then it compiles with gcc, sign and size do not matter
here.&lt;/p&gt;

&lt;p&gt;Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:27:14
Log message:
The compile time assertion for cpu info did not work with gcc.
Rephrase the condition in a way that both gcc and clang accept it.&lt;/p&gt;

&lt;p&gt;Changes by:     guenther@cvs.openbsd.org        2018/02/22 13:36:40
Log message:
Set the PG_G (global) bit on the special page table entries that are shared
between the u-k and u+k tables, because they're actually in &lt;em&gt;all&lt;/em&gt; tables.&lt;/p&gt;

&lt;p&gt;OpenBSD 6.2 errata 009
```&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://man.openbsd.org/syspatch"&gt;syspatch&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;iXsystems&lt;/strong&gt;&lt;/p&gt;

&lt;h3&gt;&lt;a href="https://undeadly.org/cgi?action=article;sid=20180302002131"&gt;a2k18 Hackathon Report: Ken Westerback on dhclient and more&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;Ken Westerback (krw@) has sent in the first report from the (recently concluded) a2k18 hackathon:&lt;/p&gt;
&lt;/blockquote&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;&lt;a href="http://www.gcmap.com/mapui?P=YYZ-YVR-MEL-ZQN-CHC-DUD,DUD-WLG-AKL-SYD-BNE-YVR-YYZ"&gt;YYZ -&amp;gt; YVR -&amp;gt; MEL -&amp;gt; ZQN -&amp;gt; CHC -&amp;gt; DUD -&amp;gt; WLG -&amp;gt; AKL -&amp;gt; SYD -&amp;gt; BNE -&amp;gt; YVR -&amp;gt; YYZ&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;For those of you who don’t speak Airport code:&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;Toronto -&amp;gt; Vancouver -&amp;gt; Melbourne -&amp;gt; Queenstown -&amp;gt; Christchurch -&amp;gt; Dunedin&lt;/li&gt;
&lt;li&gt;Then: Dunedin -&amp;gt; Wellington -&amp;gt; Auckland -&amp;gt; Sydney -&amp;gt; Brisbane -&amp;gt; Vancouver -&amp;gt; Toronto&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;```&lt;/p&gt;

&lt;p&gt;Whew.&lt;/p&gt;

&lt;p&gt;Once in Dunedin the hacking commenced. The background was a regular tick of new meltdown diffs to test in addition to whatever work one was actually engaged in. I was lucky (?) in that none of the problems with the various versions cropped up on my laptop.
```&lt;/p&gt;

&lt;p&gt;```
I worked with rpe@ and tb@ to make the install script create the 'correct' FQDN when dhclient was involved. I worked with tb@ on some code cleanup in various bits of the base. dhclient(8) got some nice cleanup, further pruning/improving log messages in particular. In addition the oddball -q option was flipped into the more normal -v. I.e. be quiet by default and verbose on request.&lt;/p&gt;

&lt;p&gt;More substantially the use of recorded leases was made less intrusive by avoiding continual reconfiguration of the interface with the same information. The 'request', 'require' and 'ignore' dhclient.conf(5) statement were changed so they are cumulative, making it easier to build longer lists of affected options.&lt;/p&gt;

&lt;p&gt;I tweaked softraid(4) to remove a handrolled version of duid_format().&lt;/p&gt;

&lt;p&gt;I sprinkled a couple of M_WAITOK into amd64 and i386 mpbios to document that there is really no need to check for NULL being returned from some malloc() calls.&lt;/p&gt;

&lt;p&gt;I continued to help test the new filesystem quiescing logic that deraadt@ committed during the hackathon.&lt;/p&gt;

&lt;p&gt;I only locked myself out of my room once!&lt;/p&gt;

&lt;p&gt;Fueled by the excellent coffee from local institutions The Good Earth Cafe and The Good Oil Cafe, and the excellent hacking facilities and accommodations at the University of Otago it was another enjoyable and productive hackathon south of the equator. And I even saw penguins.&lt;/p&gt;

&lt;p&gt;Thanks to Jim Cheetham and the support from the project and the OpenBSD Foundation that made it all possible
```&lt;/p&gt;

&lt;hr&gt;
&lt;h3&gt;&lt;a href="https://blog.gerv.net/2018/03/poetic-license/"&gt;Poetic License&lt;/a&gt;&lt;/h3&gt;

&lt;blockquote&gt;
  &lt;p&gt;I found this when going through old documents. It looks like I wrote it and never posted it. Perhaps I didn’t consider it finished at the time. But looking at it now, I think it’s good enough to share. It’s a redrafting of the BSD licence, in poetic form. Maybe I had plans to do other licences one day; I can’t remember.&lt;/p&gt;
  
  &lt;p&gt;I’ve interleaved it with the original license text so you can see how true, or otherwise, I’ve been to it. Enjoy :-)&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;```
Copyright (c) , 
All rights reserved.&lt;/p&gt;

&lt;p&gt;Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
```&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;You may redistribute and use –
  as source or binary, as you choose,
  and with some changes or without –
  this software; let there be no doubt.
  But you must meet conditions three,
  if in compliance you wish to be.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;&lt;code&gt;
1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
  notice, this list of conditions and the following disclaimer in the
  documentation and/or other materials provided with the distribution.
3. Neither the name of the  nor the names of its
   contributors may be used to endorse or promote products derived
   from this software without specific prior written permission.
&lt;/code&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;The first is obvious, of course –
  To keep this text within the source.
  The second is for binaries
  Place in the docs a copy, please.
  A moral lesson from this ode –
  Don’t strip the copyright on code.&lt;/p&gt;
  
  &lt;p&gt;The third applies when you promote:
  You must not take, from us who wrote,
  our names and make it seem as true
  we like or love your version too.
  (Unless, of course, you contact us
  And get our written assensus.)&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;&lt;code&gt;
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS  IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
&lt;/code&gt;&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;One final point to be laid out
  (You must forgive my need to shout):
  THERE IS NO WARRANTY FOR THIS
  WHATEVER THING MAY GO AMISS.
  EXPRESS, IMPLIED, IT’S ALL THE SAME –
  RESPONSIBILITY DISCLAIMED.&lt;/p&gt;
  
  &lt;p&gt;WE ARE NOT LIABLE FOR LOSS
  NO MATTER HOW INCURRED THE COST
  THE TYPE OR STYLE OF DAMAGE DONE
  WHATE’ER THE LEGAL THEORY SPUN.
  THIS STILL REMAINS AS TRUE IF YOU
  INFORM US WHAT YOU PLAN TO DO.&lt;/p&gt;
  
  &lt;p&gt;When all is told, we sum up thus –
  Do what you like, just don’t sue us.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr&gt;
&lt;hr&gt;
&lt;h2&gt;Beastie Bits&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.youtube.com/playlist?list=PLnTFqpZk5ebDZwT-bmYcIwv76yhmTfl0l"&gt;AsiaBSDCon 2018 Videos&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsdfoundation.org/past-issues/storage/"&gt;The January/February 2018 FreeBSD Journal is Here&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://mail-index.netbsd.org/pkgsrc-users/2018/01/04/msg026073.html"&gt;Announcing the pkgsrc-2017Q4 release (2018-01-04)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.bsdhh.org/bsdhh-de-index.html"&gt;BSD Hamburg Event&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://zfs.datto.com/"&gt;ZFS User conference&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=Unreal-Engine-4-FreeBSD"&gt;Unreal Engine 4 Being Brought Natively To FreeBSD By Independent Developer&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;p&gt;Tarsnap ad&lt;/p&gt;

&lt;hr&gt;
&lt;h2&gt;Feedback/Questions&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Philippe - &lt;a href="http://dpaste.com/2643BF5#wrap"&gt;I heart FreeBSD and other questions&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Cyrus - &lt;a href="http://dpaste.com/3NTH14J#wrap"&gt;BSD Now is excellent&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Architect - &lt;a href="http://dpaste.com/317BP8X#wrap"&gt;Combined Feedback&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Dale - &lt;a href="http://dpaste.com/284G4TQ#wrap"&gt;ZFS on Linux moving to ZFS on FreeBSD&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;Tommi - &lt;a href="http://dpaste.com/1KGMRGM#wrap"&gt;New BUG in Finland&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt;
&lt;ul&gt;
&lt;li&gt;Send questions, comments, show ideas/topics, or stories you want mentioned on the show to &lt;a href="mailto:feedback@bsdnow.tv"&gt;feedback@bsdnow.tv&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;hr&gt; 
</description>
  <itunes:keywords>BSD,DragonflyBSD,freebsd,guide,howto,Interview,NetBSD,OpenBSD,trueos,tutorial</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD firewalling Windows 10, NetBSD’s return to ptrace, TCP Alternative Backoff, the BSD Poetic license, and AsiaBSDcon 2018 videos available.</p>

<h3>RSS Feeds:</h3>

<p><a href="http://feeds.feedburner.com/BsdNowMp3">MP3 Feed</a> <strong>|</strong> <a href="https://itunes.apple.com/us/podcast/bsd-now-mp3/id701045710?mt=2">iTunes Feed</a> <strong>|</strong> <a href="http://feeds.feedburner.com/BsdNowHd">HD Vid Feed</a> <strong>|</strong> <a href="http://bitlove.org/jupiterbroadcasting/bsdnowhd/feed">HD Torrent Feed</a></p>

<h3><a href="http://www.patreon.com/jupitersignal">Become a supporter on Patreon</a>:</h3>

<p><a href="http://www.patreon.com/jupitersignal" rel="Support us on Patreon"><img src="http://i.imgur.com/2ioAf3Q.png" alt="Patreon" /></a></p>

<h3>- Show Notes: -</h3>

<h2>Headlines</h2>

<h3><a href="https://www.ibm.com/developerworks/community/blogs/karsten/entry/Preventing_Windows_10_and_untrusted_software_from_having_full_access_to_the_internet?lang=en">Preventing Windows 10 and untrusted software from having full access to the internet using OpenBSD</a></h3>

<blockquote>
  <p>Whilst setting up one of my development laptops to port some software to Windows I noticed Windows 10 doing crazy things like installing or updating apps and games by default after initial setup. The one I noticed in particular was Candy Crush Soda Saga which for those who don't know of it is some cheesy little puzzle game originally for consumer devices. I honestly did not want software like this near to a development machine. It has also been reported that Windows 10 now also updates core system software without notifying the user. Surely this destroys any vaguely deterministic behaviour, in my opinion making Windows 10 by default almost useless for development testbeds.</p>
  
  <p>Deciding instead to start from scratch but this time to set the inbuilt Windows Firewall to be very restrictive and only allow a few select programs to communicate. In this case all I really needed to be online was Firefox, Subversion and Putty. To my amusement (and astonishment) I found out that the Windows firewall could be modified to give access very easily by programs during installation (usually because this task needs to be done with admin privileges). It also seems that Windows store Apps can change the windows firewall settings at any point. One way to get around this issue could be to install a 3rd party firewall that most software will not have knowledge about and thus not attempt to break through. However the only decent firewall I have used was Sygate Pro which unfortunately is no longer supported by recent operating systems. The last supported versions was 2003, XP and 2000. In short, I avoid 3rd party firewalls.</p>
  
  <p>Instead I decided to trap Windows 10 (and all of it's rogue updaters) behind a virtual machine running OpenBSD. This effectively provided me with a full blown firewall appliance. From here I could then allow specific software I trusted through the firewall (via a proxy) in a safe, controlled and deterministic manner. For other interested developers (and security conscious users) and for my own reference, I have listed the steps taken here:</p>
</blockquote>

<ul>
<li><p>1) First and foremost disable the Windows DHCP service - this is so no IP can be obtained on any interface. This effectively stops any communication with any network on the host system. This can be done by running services.msc with admin privileges and stopping and disabling the service called DHCP Client.</p></li>
<li><p>2) Install or enable your favorite virtualization software - I have tested this with both VirtualBox and Hyper-V. Note that on non-server versions of Windows, in order to get Hyper-V working, your processor also needs to support SLAT which is daft so to avoid faffing about, I recommend using VirtualBox to get round this seemingly arbitrary restriction.</p></li>
<li><p>3) Install OpenBSD on the VM - Note, if you decide to use Hyper-V, its hardware support isn't 100% perfect to run OpenBSD and you will need to disable a couple of things in the kernel. At the initial boot prompt, run the following commands.</p></li>
</ul>

<p><code>
config -e -o /bsd /bsd
disable acpi
disable mpbios
</code></p>

<ul>
<li><p>4) Add a host only virtual adapter to the VM - This is the one which we are going to connect through the VM with. Look at the IP that VirtualBox assigns this in network manager on the host machine. Mine was [b]192.168.56.1[/b]. Set up the adapter in the OpenBSD VM to have a static address on the same subnet. For example [b]192.168.56.2[/b]. If you are using Hyper-V and OpenBSD, make sure you add a "Legacy Interface" because no guest additions are available. Then set up a virtual switch which is host only.</p></li>
<li><p>5) Add a bridged adapter to the VM - then assign it to whichever interface you wanted to connect to the external network with. Note that if using Wireless, set the bridged adapters MAC address to the same as your physical device or the access point will reject it. This is not needed (or possible) on Hyper-V because the actual device is "shared" rather than bridged so the same MAC address is used. Again, if you use Hyper-V, then add another virtual switch and attach it to your chosen external interface. VMs in Hyper-V "share" an adapter within a virtual switch and there is the option to also disable the hosts ability to use this interface at the same time which is fine for an additional level of security if those pesky rogue apps and updaters can also enable / disable DHCP service one day which wouldn't be too surprising.</p></li>
<li><p>6) Connect to your network in the host OS - In case of Wireless, select the correct network from the list and type in a password if needed. Windows will probably say "no internet available", it also does not assign an IP address which is fine.</p></li>
<li><p>7) Install the Squid proxy package on the OpenBSD guest and enable the daemon</p></li>
</ul>

<p>```</p>

<h4>pkg_add squid</h4>

<h4>echo 'squid_flags=""' >> /etc/rc.conf.local</h4>

<h4>/etc/rc.d/squid start</h4>

<p>```</p>

<blockquote>
  <p>We will use this service for a limited selection of "safe and trusted" programs to connect to the outside world from within the Windows 10 host. You can also use putty on the host to connect to the VM via SSH and create a SOCKS proxy which software like Firefox can also use to connect externally.</p>
</blockquote>

<ul>
<li><p>8) Configure the software you want to be able to access the external network with</p>

<ul><li>Firefox - go to the connection settings and specify the VMs IP address for the proxy.</li>
<li>Subversion - modify the %HOME%\AppData\Roaming\Subversion\servers file and change the HTTP proxy field to the VMs IP. This is important to communicate with GitHub via https:// (Yes, GitHub also supports Subversion). For svn:// addresses you can use Putty to port forward.</li>
<li>Chromium/Chrome - unfortunately uses the global Windows proxy settings which defeats much of the purpose of this exercise if we were going to allow <em>all</em> of Windows access to the internet via the proxy. It would become mayhem again. However we can still use Putty to create a SOCKS proxy and then launch the browser with the following flags:</li></ul></li>
</ul>

<p><code>
--proxy-server="socks5://&lt;VM IP&gt;:&lt;SOCKS PORT&gt;"
--host-resolver-rules="MAP * 0.0.0.0 , EXCLUDE &lt;VM IP&gt;"
</code></p>

<ul>
<li>9) Congratulations, you are now done - Admittedly this process can be a bit fiddly to set up but it completely prevents Windows 10 from making a complete mess. This solution is probably also useful for those who like privacy or don't like the idea of their software "phoning home". Hope you find this useful and if you have any issues, please feel free to leave questions in the comments.</li>
</ul>

<p><hr /></p>

<h3><a href="https://blog.netbsd.org/tnf/entry/lldb_restoration_and_return_to">LLDB restoration and return to ptrace(2)</a></h3>

<blockquote>
  <p>I've managed to unbreak the LLDB debugger as much as possible with the current kernel and hit problems with ptrace(2) that are causing issues with further work on proper NetBSD support. Meanwhile, I've upstreamed all the planned NetBSD patches to sanitizers and helped other BSDs to gain better or initial support.</p>
</blockquote>

<ul>
<li>LLDB</li>
</ul>

<blockquote>
  <p>Since the last time I worked on LLDB, we have introduced many changes to the kernel interfaces (most notably related to signals) that apparently fixed some bugs in Go and introduced regressions in ptrace(2). Part of the regressions were noted by the existing ATF tests. However, the breakage was only marked as a new problem to resolve. For completeness, the ptrace(2) code was also cleaned up by Christos Zoulas, and we fixed some bugs with compat32.</p>
  
  <p>I've fixed a crash in *NetBSD::Factory::Launch(), triggered on startup of the lldb-server application.</p>
  
  <p>Here is the commit message:</p>
</blockquote>

<p>```
We cannot call process_up->SetState() inside
the NativeProcessNetBSD::Factory::Launch
function because it triggers a NULL pointer
deference.</p>

<p>The generic code for launching a process in:
GDBRemoteCommunicationServerLLGS::LaunchProcess
sets the m<em>debugged</em>process<em>up pointer after
a successful call to  m</em>process<em>factory.Launch().
If we attempt to call process</em>up->SetState()
inside a platform specific Launch function we
end up dereferencing a NULL pointer in
NativeProcessProtocol::GetCurrentThreadID().</p>

<p>Use the proper call process<em>up->SetState(,false)
that sets notify</em>delegates to false.
```</p>

<ul>
<li>Sanitizers</li>
</ul>

<blockquote>
  <p>I suspended development of new features in sanitizers last month, but I was still in the process of upstreaming of local patches. This process was time-consuming as it required rebasing patches, adding dedicated tests, and addressing all other requests and comments from the upstream developers.</p>
  
  <p>I'm not counting hot fixes, as some changes were triggering build or test issues on !NetBSD hosts. Thankfully all these issues were addressed quickly. The final result is a reduction of local delta size of almost 1MB to less than 100KB (1205 lines of diff). The remaining patches are rescheduled for later, mostly because they depend on extra work with cross-OS tests and prior integration of sanitizers with the basesystem distribution. I didn't want to put extra work here in the current state of affairs and, I've registered as a mentor for Google Summer of Code for the NetBSD Foundation and prepared Software Quality improvement tasks in order to outsource part of the labour.</p>
</blockquote>

<ul>
<li>Userland changes</li>
</ul>

<blockquote>
  <p>I've also improved documentation for some of the features of NetBSD, described in man-pages. These pieces of information were sometimes wrong or incomplete, and this makes covering the NetBSD system with features such as sanitizers harder as there is a mismatch between the actual code and the documented code.</p>
  
  <p>Some pieces of software also require better namespacing support, these days mostly for the POSIX standard. I've fixed few low-hanging fruits there and requested pullups to NetBSD-8(BETA).</p>
  
  <p>I thank the developers for improving the landed code in order to ship the best solutions for users.</p>
</blockquote>

<ul>
<li>BSD collaboration in LLVM</li>
</ul>

<blockquote>
  <p>A One-man-show in human activity is usually less fun and productive than collaboration in a team. This is also true in software development. Last month I was helping as a reviewer to port LLVM features to FreeBSD and when possible to OpenBSD. This included MSan/FreeBSD, libFuzzer/FreeBSD, XRay/FreeBSD and UBSan/OpenBSD.</p>
  
  <p>I've landed most of the submitted and reviewed code to the mainstream LLVM tree.</p>
  
  <p>Part of the code also verified the correctness of NetBSD routes in the existing porting efforts and showed new options for improvement. This is the reason why I've landed preliminary XRay/NetBSD code and added missing NetBSD bits to ToolChain::getOSLibName(). The latter produced setup issues with the prebuilt LLVM toolchain, as the directory name with compiler-rt goodies were located in a path like ./lib/clang/7.0.0/lib/netbsd8.99.12 with a varying OS version. This could stop working after upgrades, so I've simplified it to "netbsd", similar to FreeBSD and Solaris.</p>
</blockquote>

<ul>
<li>Prebuilt toolchain for testers</li>
</ul>

<blockquote>
  <p>I've prepared a build of Clang/LLVM with LLDB and compiler-rt features prebuilt on NetBSD/amd64 v. 8.99.12:</p>
</blockquote>

<p><code>llvm-clang-compilerrt-lldb-7.0.0beta_2018-02-28.tar.bz2</code></p>

<ul>
<li>Plan for the next milestone</li>
</ul>

<blockquote>
  <p>With the approaching NetBSD 8.0 release I plan to finish backporting a few changes there from HEAD:</p>
</blockquote>

<ul>
<li>Remove one unused feature from ptrace(2), PT<em>SET</em>SIGMASK &amp; PT<em>GET</em>SIGMASK. I've originally introduced these operations with criu/rr-like software in mind, but they are misusing or even abusing ptrace(2) and are not regular process debuggers. I plan to remove this operation from HEAD and backport this to NetBSD-8(BETA), before the release, so no compat will be required for this call. Future ports of criu/rr should involve dedicated kernel support for such requirements.
Finish the backport of <em>UC</em>MACHINE_FP() to NetBSD-8. This will allow use of the same code in sanitizers in HEAD and NetBSD-8.0.</li>
<li>By popular demand, improve the regnsub(3) and regasub(3) API, adding support for more or less substitutions than 10.</li>
</ul>

<blockquote>
  <p>Once done, I will return to ptrace(2) debugging and corrections.</p>
</blockquote>

<p><hr /></p>

<p><strong>DigitalOcean</strong></p>

<h3><a href="https://t.pagef.lt/working-with-the-netbsd-kernel/">Working with the NetBSD kernel</a></h3>

<ul>
<li>Overview</li>
</ul>

<blockquote>
  <p>When working on complex systems, such as OS kernels, your attention span and cognitive energy are too valuable to be wasted on inefficiencies pertaining to ancillary tasks. After experimenting with different environmental setups for kernel debugging, some of which were awkward and distracting from my main objectives, I have arrived to my current workflow, which is described here. This approach is mainly oriented towards security research and the study of kernel internals.</p>
  
  <p>Before delving into the details, this is the general outline of my environment:</p>
  
  <p>My host system runs Linux. My target system is a QEMU guest.</p>
  
  <p>I’m tracing and debugging on my host system by attaching GDB (with NetBSD x86-64 ABI support) to QEMU’s built-in GDB server.
  I work with NetBSD-current. All sources are built on my host system with the cross-compilation toolchain produced by build.sh.
  I use NFS to share the source tree and the build artifacts between the target and the host.
  I find IDEs awkward, so for codebase navigation I mainly rely on vim, tmux and ctags.
  For non-intrusive instrumentation, such as figuring out control flow, I’m using dtrace.</p>
</blockquote>

<ul>
<li><p>Preparing the host system</p>

<ul><li>QEMU</li>
<li>GDB</li>
<li>NFS Exports</li></ul></li>
<li><p>Building NetBSD-current</p></li>
<li><p>A word of warning</p>

<ul><li>Now is a great time to familiarize yourself with the build.sh tool and its options. Be especially carefull with the following options:</li></ul></li>
</ul>

<p><code>
    -r          Remove contents of TOOLDIR and DESTDIR before building.
    -u          Set MKUPDATE=yes; do not run "make clean" first.
        Without this, everything is rebuilt, including the tools.
</code></p>

<blockquote>
  <p>Chance are, you do not want to use these options once you’ve successfully built the cross-compilation toolchain and your entire userland, because building those takes time and there aren’t many good reasons to recompile them from scratch. Here’s what to expect:</p>
  
  <p>On my desktop, running a quad-core Intel i5-3470 at 3.20GHz with 24GB of RAM and underlying directory structure residing on a SSD drive, the entire process took about 55 minutes. I was running make with -j12, so the machine was quite busy.
  On an old Dell D630 laptop, running Intel Core 2 Duo T7500 at 2.20GHz with 4GB of RAM and a slow hard drive (5400RPM), the process took approximatelly 2.5 hours. I was running make with -j4. Based on the temperature alerts and CPU clock throttling messages, it was quite a struggle.</p>
</blockquote>

<ul>
<li>Acquiring the sources</li>
<li><p>Compiling the sources</p>

<ul><li>Preparing the guest system</li></ul></li>
<li>Provisioning your guest</li>
<li>Pkgin and NFS shares</li>
<li>Tailoring the kernel for debugging</li>
<li>Installing the new kernel</li>
<li>Configuring DTrace</li>
<li>Debugging the guest’s kernel</li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331214">Add support for the experimental Internet-Draft "TCP Alternative Backoff”</a></h3>

<p>```
Add support for the experimental Internet-Draft "TCP Alternative Backoff with
ECN (ABE)" proposal to the New Reno congestion control algorithm module.
ABE reduces the amount of congestion window reduction in response to
ECN-signalled congestion relative to the loss-inferred congestion response.</p>

<p>More details about ABE can be found in the Internet-Draft:
https://tools.ietf.org/html/draft-ietf-tcpm-alternativebackoff-ecn</p>

<p>The implementation introduces four new sysctls:</p>

<ul>
<li><p>net.inet.tcp.cc.abe defaults to 0 (disabled) and can be set to non-zero to
enable ABE for ECN-enabled TCP connections.</p></li>
<li><p>net.inet.tcp.cc.newreno.beta and net.inet.tcp.cc.newreno.beta<em>ecn set the
multiplicative window decrease factor, specified as a percentage, applied to
the congestion window in response to a loss-based or ECN-based congestion
signal respectively. They default to the values specified in the draft i.e.
beta=50 and beta</em>ecn=80.</p></li>
<li><p>net.inet.tcp.cc.abe_frlossreduce defaults to 0 (disabled) and can be set to
non-zero to enable the use of standard beta (50% by default) when repairing
loss during an ECN-signalled congestion recovery episode. It enables a more
conservative congestion response and is provided for the purposes of
experimentation as a result of some discussion at IETF 100 in Singapore.</p></li>
</ul>

<p>The values of beta and beta<em>ecn can also be set per-connection by way of the
TCP</em>CCALGOOPT TCP-level socket option and the new CC<em>NEWRENO</em>BETA or
CC<em>NEWRENO</em>BETA_ECN CC algo sub-options.</p>

<p>Submitted by:    Tom Jones <a href="&#x6D;&#x61;i&#x6C;&#x74;&#111;:&#x74;&#x6A;&#64;&#x65;&#x6E;&#x6F;&#x74;&#105;.&#x6D;&#101;">&#x74;&#x6A;&#64;&#x65;&#x6E;&#x6F;&#x74;&#105;.&#x6D;&#101;</a>
Tested by:    Tom Jones <a href="&#x6D;&#97;&#105;&#x6C;&#x74;&#x6F;:&#116;&#x6A;&#64;&#101;&#x6E;&#111;&#116;&#105;&#x2E;&#x6D;&#101;">&#116;&#x6A;&#64;&#101;&#x6E;&#111;&#116;&#105;&#x2E;&#x6D;&#101;</a>, Grenville Armitage <a href="&#109;&#x61;&#105;&#x6C;&#x74;&#x6F;:&#103;&#97;&#x72;&#109;&#x69;ta&#x67;&#x65;&#64;&#x73;&#119;&#105;&#x6E;.&#x65;d&#117;.&#97;&#117;">&#103;&#97;&#x72;&#109;&#x69;ta&#x67;&#x65;&#64;&#x73;&#119;&#105;&#x6E;.&#x65;d&#117;.&#97;&#117;</a>
Relnotes:    Yes
Differential Revision:    https://reviews.freebsd.org/D11616
```</p>

<p><hr /></p>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180228225937">Meltdown-mitigation syspatch/errata now available</a></h3>

<blockquote>
  <p>The recent changes in -current mitigating the Meltdown vulnerability have been backported to the 6.1 and 6.2 (amd64) releases, and the syspatch update (for 6.2) is now available.</p>
</blockquote>

<ul>
<li><a href="https://marc.info/?l=openbsd-cvs&amp;m=151964860620856&amp;w=2">6.1</a></li>
</ul>

<p>```
Changes by:    bluhm@cvs.openbsd.org   2018/02/26 05:36:18
Log message:
Implement a workaround against the Meltdown flaw in Intel CPUs.
The following changes have been backported from OpenBSD -current.</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/01/06 15:03:13
Log message:
Handle %gs like %[def]s and reset set it in cpu_switchto() instead of on
every return to userspace.</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/06 18:08:20
Log message:
Add identcpu.c and specialreg.h definitions for the new Intel/AMD MSRs
that should help mitigate spectre. This is just the detection piece, these
features are not yet used.
Part of a larger ongoing effort to mitigate meltdown/spectre. i386 will
come later; it needs some machdep.c cleanup first.</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/07 12:56:19
Log message:
remove all PG_G global page mappings from the kernel when running on
Intel CPUs. Part of an ongoing set of commits to mitigate the Intel
"meltdown" CVE. This diff does not confer any immunity to that
vulnerability - subsequent commits are still needed and are being
worked on presently.
ok guenther, deraadt</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/12 01:21:30
Log message:
IBRS -> IBRS,IBPB in identifycpu lines</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/02/21 12:24:15
Log message:
Meltdown: implement user/kernel page table separation.
On Intel CPUs which speculate past user/supervisor page permission checks,
use a separate page table for userspace with only the minimum of kernel code
and data required for the transitions to/from the kernel (still marked as
supervisor-only, of course):
- the IDT (RO)
- three pages of kernel text in the .kutext section for interrupt, trap,
and syscall trampoline code (RX)
- one page of kernel data in the .kudata section for TLB flush IPIs (RW)
- the lapic page (RW, uncachable)
- per CPU: one page for the TSS+GDT (RO) and one page for trampoline
stacks (RW)
When a syscall, trap, or interrupt takes a CPU from userspace to kernel the
trampoline code switches page tables, switches stacks to the thread's real
kernel stack, then copies over the necessary bits from the trampoline stack.
On return to userspace the opposite occurs: recreate the iretq frame on the
trampoline stack, switch stack, switch page tables, and return to userspace.
mlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing
issues on MP in particular, and drove the final push to completion.
Many rounds of testing by naddy@, sthen@, and others
Thanks to Alex Wilson from Joyent for early discussions about trampolines
and their data requirements.
Per-CPU page layout mostly inspired by DragonFlyBSD.
ok mlarkin@ deraadt@</p>

<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:18:59
Log message:
The GNU assembler does not understand 1ULL, so replace the constant
with 1.  Then it compiles with gcc, sign and size do not matter
here.</p>

<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:27:14
Log message:
The compile time assertion for cpu info did not work with gcc.
Rephrase the condition in a way that both gcc and clang accept it.</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/02/22 13:36:40
Log message:
Set the PG_G (global) bit on the special page table entries that are shared
between the u-k and u+k tables, because they're actually in <em>all</em> tables.</p>

<p>OpenBSD 6.1 errata 037
```</p>

<ul>
<li>6.2</li>
</ul>

<p>```
Changes by:    bluhm@cvs.openbsd.org   2018/02/26 05:29:48
Log message:
Implement a workaround against the Meltdown flaw in Intel CPUs.
The following changes have been backported from OpenBSD -current.</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/01/06 15:03:13
Log message:
Handle %gs like %[def]s and reset set it in cpu_switchto() instead of on
every return to userspace.</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/06 18:08:20
Log message:
Add identcpu.c and specialreg.h definitions for the new Intel/AMD MSRs
that should help mitigate spectre. This is just the detection piece, these
features are not yet used.
Part of a larger ongoing effort to mitigate meltdown/spectre. i386 will
come later; it needs some machdep.c cleanup first.</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/07 12:56:19
Log message:
remove all PG_G global page mappings from the kernel when running on
Intel CPUs. Part of an ongoing set of commits to mitigate the Intel
"meltdown" CVE. This diff does not confer any immunity to that
vulnerability - subsequent commits are still needed and are being
worked on presently.</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/12 01:21:30
Log message:
IBRS -> IBRS,IBPB in identifycpu lines</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/02/21 12:24:15
Log message:
Meltdown: implement user/kernel page table separation.
On Intel CPUs which speculate past user/supervisor page permission checks,
use a separate page table for userspace with only the minimum of kernel code
and data required for the transitions to/from the kernel (still marked as
supervisor-only, of course):
- the IDT (RO)
- three pages of kernel text in the .kutext section for interrupt, trap,
and syscall trampoline code (RX)
- one page of kernel data in the .kudata section for TLB flush IPIs (RW)
- the lapic page (RW, uncachable)
- per CPU: one page for the TSS+GDT (RO) and one page for trampoline
stacks (RW)
When a syscall, trap, or interrupt takes a CPU from userspace to kernel the
trampoline code switches page tables, switches stacks to the thread's real
kernel stack, then copies over the necessary bits from the trampoline stack.
On return to userspace the opposite occurs: recreate the iretq frame on the
trampoline stack, switch stack, switch page tables, and return to userspace.
mlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing
issues on MP in particular, and drove the final push to completion.
Many rounds of testing by naddy@, sthen@, and others
Thanks to Alex Wilson from Joyent for early discussions about trampolines
and their data requirements.
Per-CPU page layout mostly inspired by DragonFlyBSD.</p>

<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:18:59
Log message:
The GNU assembler does not understand 1ULL, so replace the constant
with 1.  Then it compiles with gcc, sign and size do not matter
here.</p>

<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:27:14
Log message:
The compile time assertion for cpu info did not work with gcc.
Rephrase the condition in a way that both gcc and clang accept it.</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/02/22 13:36:40
Log message:
Set the PG_G (global) bit on the special page table entries that are shared
between the u-k and u+k tables, because they're actually in <em>all</em> tables.</p>

<p>OpenBSD 6.2 errata 009
```</p>

<ul>
<li><a href="https://man.openbsd.org/syspatch">syspatch</a></li>
</ul>

<p><hr /></p>

<p><strong>iXsystems</strong></p>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180302002131">a2k18 Hackathon Report: Ken Westerback on dhclient and more</a></h3>

<blockquote>
  <p>Ken Westerback (krw@) has sent in the first report from the (recently concluded) a2k18 hackathon:</p>
</blockquote>

<ul>
<li><p><a href="http://www.gcmap.com/mapui?P=YYZ-YVR-MEL-ZQN-CHC-DUD,DUD-WLG-AKL-SYD-BNE-YVR-YYZ">YYZ -> YVR -> MEL -> ZQN -> CHC -> DUD -> WLG -> AKL -> SYD -> BNE -> YVR -> YYZ</a></p></li>
<li><p>For those of you who don’t speak Airport code:</p></li>
<li>Toronto -> Vancouver -> Melbourne -> Queenstown -> Christchurch -> Dunedin</li>
<li>Then: Dunedin -> Wellington -> Auckland -> Sydney -> Brisbane -> Vancouver -> Toronto</li>
</ul>

<p>```</p>

<p>Whew.</p>

<p>Once in Dunedin the hacking commenced. The background was a regular tick of new meltdown diffs to test in addition to whatever work one was actually engaged in. I was lucky (?) in that none of the problems with the various versions cropped up on my laptop.
```</p>

<p>```
I worked with rpe@ and tb@ to make the install script create the 'correct' FQDN when dhclient was involved. I worked with tb@ on some code cleanup in various bits of the base. dhclient(8) got some nice cleanup, further pruning/improving log messages in particular. In addition the oddball -q option was flipped into the more normal -v. I.e. be quiet by default and verbose on request.</p>

<p>More substantially the use of recorded leases was made less intrusive by avoiding continual reconfiguration of the interface with the same information. The 'request', 'require' and 'ignore' dhclient.conf(5) statement were changed so they are cumulative, making it easier to build longer lists of affected options.</p>

<p>I tweaked softraid(4) to remove a handrolled version of duid_format().</p>

<p>I sprinkled a couple of M_WAITOK into amd64 and i386 mpbios to document that there is really no need to check for NULL being returned from some malloc() calls.</p>

<p>I continued to help test the new filesystem quiescing logic that deraadt@ committed during the hackathon.</p>

<p>I only locked myself out of my room once!</p>

<p>Fueled by the excellent coffee from local institutions The Good Earth Cafe and The Good Oil Cafe, and the excellent hacking facilities and accommodations at the University of Otago it was another enjoyable and productive hackathon south of the equator. And I even saw penguins.</p>

<p>Thanks to Jim Cheetham and the support from the project and the OpenBSD Foundation that made it all possible
```</p>

<p><hr /></p>

<h3><a href="https://blog.gerv.net/2018/03/poetic-license/">Poetic License</a></h3>

<blockquote>
  <p>I found this when going through old documents. It looks like I wrote it and never posted it. Perhaps I didn’t consider it finished at the time. But looking at it now, I think it’s good enough to share. It’s a redrafting of the BSD licence, in poetic form. Maybe I had plans to do other licences one day; I can’t remember.</p>
  
  <p>I’ve interleaved it with the original license text so you can see how true, or otherwise, I’ve been to it. Enjoy :-)</p>
</blockquote>

<p>```
Copyright (c) <YEAR>, <OWNER>
All rights reserved.</p>

<p>Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
```</p>

<blockquote>
  <p>You may redistribute and use –
  as source or binary, as you choose,
  and with some changes or without –
  this software; let there be no doubt.
  But you must meet conditions three,
  if in compliance you wish to be.</p>
</blockquote>

<p><code>
1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
  notice, this list of conditions and the following disclaimer in the
  documentation and/or other materials provided with the distribution.
3. Neither the name of the  nor the names of its
   contributors may be used to endorse or promote products derived
   from this software without specific prior written permission.
</code></p>

<blockquote>
  <p>The first is obvious, of course –
  To keep this text within the source.
  The second is for binaries
  Place in the docs a copy, please.
  A moral lesson from this ode –
  Don’t strip the copyright on code.</p>
  
  <p>The third applies when you promote:
  You must not take, from us who wrote,
  our names and make it seem as true
  we like or love your version too.
  (Unless, of course, you contact us
  And get our written assensus.)</p>
</blockquote>

<p><code>
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS  IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
</code></p>

<blockquote>
  <p>One final point to be laid out
  (You must forgive my need to shout):
  THERE IS NO WARRANTY FOR THIS
  WHATEVER THING MAY GO AMISS.
  EXPRESS, IMPLIED, IT’S ALL THE SAME –
  RESPONSIBILITY DISCLAIMED.</p>
  
  <p>WE ARE NOT LIABLE FOR LOSS
  NO MATTER HOW INCURRED THE COST
  THE TYPE OR STYLE OF DAMAGE DONE
  WHATE’ER THE LEGAL THEORY SPUN.
  THIS STILL REMAINS AS TRUE IF YOU
  INFORM US WHAT YOU PLAN TO DO.</p>
  
  <p>When all is told, we sum up thus –
  Do what you like, just don’t sue us.</p>
</blockquote>

<p><hr /></p>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/playlist?list=PLnTFqpZk5ebDZwT-bmYcIwv76yhmTfl0l">AsiaBSDCon 2018 Videos</a></li>
<li><a href="https://www.freebsdfoundation.org/past-issues/storage/">The January/February 2018 FreeBSD Journal is Here</a></li>
<li><a href="https://mail-index.netbsd.org/pkgsrc-users/2018/01/04/msg026073.html">Announcing the pkgsrc-2017Q4 release (2018-01-04)</a></li>
<li><a href="https://www.bsdhh.org/bsdhh-de-index.html">BSD Hamburg Event</a></li>
<li><a href="http://zfs.datto.com/">ZFS User conference</a></li>
<li><a href="https://www.phoronix.com/scan.php?page=news_item&amp;px=Unreal-Engine-4-FreeBSD">Unreal Engine 4 Being Brought Natively To FreeBSD By Independent Developer</a></li>
</ul>

<p><hr /></p>

<p>Tarsnap ad</p>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Philippe - <a href="http://dpaste.com/2643BF5#wrap">I heart FreeBSD and other questions</a></li>
<li>Cyrus - <a href="http://dpaste.com/3NTH14J#wrap">BSD Now is excellent</a></li>
<li>Architect - <a href="http://dpaste.com/317BP8X#wrap">Combined Feedback</a></li>
<li>Dale - <a href="http://dpaste.com/284G4TQ#wrap">ZFS on Linux moving to ZFS on FreeBSD</a></li>
<li>Tommi - <a href="http://dpaste.com/1KGMRGM#wrap">New BUG in Finland</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD firewalling Windows 10, NetBSD’s return to ptrace, TCP Alternative Backoff, the BSD Poetic license, and AsiaBSDcon 2018 videos available.</p>

<h3>RSS Feeds:</h3>

<p><a href="http://feeds.feedburner.com/BsdNowMp3">MP3 Feed</a> <strong>|</strong> <a href="https://itunes.apple.com/us/podcast/bsd-now-mp3/id701045710?mt=2">iTunes Feed</a> <strong>|</strong> <a href="http://feeds.feedburner.com/BsdNowHd">HD Vid Feed</a> <strong>|</strong> <a href="http://bitlove.org/jupiterbroadcasting/bsdnowhd/feed">HD Torrent Feed</a></p>

<h3><a href="http://www.patreon.com/jupitersignal">Become a supporter on Patreon</a>:</h3>

<p><a href="http://www.patreon.com/jupitersignal" rel="Support us on Patreon"><img src="http://i.imgur.com/2ioAf3Q.png" alt="Patreon" /></a></p>

<h3>- Show Notes: -</h3>

<h2>Headlines</h2>

<h3><a href="https://www.ibm.com/developerworks/community/blogs/karsten/entry/Preventing_Windows_10_and_untrusted_software_from_having_full_access_to_the_internet?lang=en">Preventing Windows 10 and untrusted software from having full access to the internet using OpenBSD</a></h3>

<blockquote>
  <p>Whilst setting up one of my development laptops to port some software to Windows I noticed Windows 10 doing crazy things like installing or updating apps and games by default after initial setup. The one I noticed in particular was Candy Crush Soda Saga which for those who don't know of it is some cheesy little puzzle game originally for consumer devices. I honestly did not want software like this near to a development machine. It has also been reported that Windows 10 now also updates core system software without notifying the user. Surely this destroys any vaguely deterministic behaviour, in my opinion making Windows 10 by default almost useless for development testbeds.</p>
  
  <p>Deciding instead to start from scratch but this time to set the inbuilt Windows Firewall to be very restrictive and only allow a few select programs to communicate. In this case all I really needed to be online was Firefox, Subversion and Putty. To my amusement (and astonishment) I found out that the Windows firewall could be modified to give access very easily by programs during installation (usually because this task needs to be done with admin privileges). It also seems that Windows store Apps can change the windows firewall settings at any point. One way to get around this issue could be to install a 3rd party firewall that most software will not have knowledge about and thus not attempt to break through. However the only decent firewall I have used was Sygate Pro which unfortunately is no longer supported by recent operating systems. The last supported versions was 2003, XP and 2000. In short, I avoid 3rd party firewalls.</p>
  
  <p>Instead I decided to trap Windows 10 (and all of it's rogue updaters) behind a virtual machine running OpenBSD. This effectively provided me with a full blown firewall appliance. From here I could then allow specific software I trusted through the firewall (via a proxy) in a safe, controlled and deterministic manner. For other interested developers (and security conscious users) and for my own reference, I have listed the steps taken here:</p>
</blockquote>

<ul>
<li><p>1) First and foremost disable the Windows DHCP service - this is so no IP can be obtained on any interface. This effectively stops any communication with any network on the host system. This can be done by running services.msc with admin privileges and stopping and disabling the service called DHCP Client.</p></li>
<li><p>2) Install or enable your favorite virtualization software - I have tested this with both VirtualBox and Hyper-V. Note that on non-server versions of Windows, in order to get Hyper-V working, your processor also needs to support SLAT which is daft so to avoid faffing about, I recommend using VirtualBox to get round this seemingly arbitrary restriction.</p></li>
<li><p>3) Install OpenBSD on the VM - Note, if you decide to use Hyper-V, its hardware support isn't 100% perfect to run OpenBSD and you will need to disable a couple of things in the kernel. At the initial boot prompt, run the following commands.</p></li>
</ul>

<p><code>
config -e -o /bsd /bsd
disable acpi
disable mpbios
</code></p>

<ul>
<li><p>4) Add a host only virtual adapter to the VM - This is the one which we are going to connect through the VM with. Look at the IP that VirtualBox assigns this in network manager on the host machine. Mine was [b]192.168.56.1[/b]. Set up the adapter in the OpenBSD VM to have a static address on the same subnet. For example [b]192.168.56.2[/b]. If you are using Hyper-V and OpenBSD, make sure you add a "Legacy Interface" because no guest additions are available. Then set up a virtual switch which is host only.</p></li>
<li><p>5) Add a bridged adapter to the VM - then assign it to whichever interface you wanted to connect to the external network with. Note that if using Wireless, set the bridged adapters MAC address to the same as your physical device or the access point will reject it. This is not needed (or possible) on Hyper-V because the actual device is "shared" rather than bridged so the same MAC address is used. Again, if you use Hyper-V, then add another virtual switch and attach it to your chosen external interface. VMs in Hyper-V "share" an adapter within a virtual switch and there is the option to also disable the hosts ability to use this interface at the same time which is fine for an additional level of security if those pesky rogue apps and updaters can also enable / disable DHCP service one day which wouldn't be too surprising.</p></li>
<li><p>6) Connect to your network in the host OS - In case of Wireless, select the correct network from the list and type in a password if needed. Windows will probably say "no internet available", it also does not assign an IP address which is fine.</p></li>
<li><p>7) Install the Squid proxy package on the OpenBSD guest and enable the daemon</p></li>
</ul>

<p>```</p>

<h4>pkg_add squid</h4>

<h4>echo 'squid_flags=""' >> /etc/rc.conf.local</h4>

<h4>/etc/rc.d/squid start</h4>

<p>```</p>

<blockquote>
  <p>We will use this service for a limited selection of "safe and trusted" programs to connect to the outside world from within the Windows 10 host. You can also use putty on the host to connect to the VM via SSH and create a SOCKS proxy which software like Firefox can also use to connect externally.</p>
</blockquote>

<ul>
<li><p>8) Configure the software you want to be able to access the external network with</p>

<ul><li>Firefox - go to the connection settings and specify the VMs IP address for the proxy.</li>
<li>Subversion - modify the %HOME%\AppData\Roaming\Subversion\servers file and change the HTTP proxy field to the VMs IP. This is important to communicate with GitHub via https:// (Yes, GitHub also supports Subversion). For svn:// addresses you can use Putty to port forward.</li>
<li>Chromium/Chrome - unfortunately uses the global Windows proxy settings which defeats much of the purpose of this exercise if we were going to allow <em>all</em> of Windows access to the internet via the proxy. It would become mayhem again. However we can still use Putty to create a SOCKS proxy and then launch the browser with the following flags:</li></ul></li>
</ul>

<p><code>
--proxy-server="socks5://&lt;VM IP&gt;:&lt;SOCKS PORT&gt;"
--host-resolver-rules="MAP * 0.0.0.0 , EXCLUDE &lt;VM IP&gt;"
</code></p>

<ul>
<li>9) Congratulations, you are now done - Admittedly this process can be a bit fiddly to set up but it completely prevents Windows 10 from making a complete mess. This solution is probably also useful for those who like privacy or don't like the idea of their software "phoning home". Hope you find this useful and if you have any issues, please feel free to leave questions in the comments.</li>
</ul>

<p><hr /></p>

<h3><a href="https://blog.netbsd.org/tnf/entry/lldb_restoration_and_return_to">LLDB restoration and return to ptrace(2)</a></h3>

<blockquote>
  <p>I've managed to unbreak the LLDB debugger as much as possible with the current kernel and hit problems with ptrace(2) that are causing issues with further work on proper NetBSD support. Meanwhile, I've upstreamed all the planned NetBSD patches to sanitizers and helped other BSDs to gain better or initial support.</p>
</blockquote>

<ul>
<li>LLDB</li>
</ul>

<blockquote>
  <p>Since the last time I worked on LLDB, we have introduced many changes to the kernel interfaces (most notably related to signals) that apparently fixed some bugs in Go and introduced regressions in ptrace(2). Part of the regressions were noted by the existing ATF tests. However, the breakage was only marked as a new problem to resolve. For completeness, the ptrace(2) code was also cleaned up by Christos Zoulas, and we fixed some bugs with compat32.</p>
  
  <p>I've fixed a crash in *NetBSD::Factory::Launch(), triggered on startup of the lldb-server application.</p>
  
  <p>Here is the commit message:</p>
</blockquote>

<p>```
We cannot call process_up->SetState() inside
the NativeProcessNetBSD::Factory::Launch
function because it triggers a NULL pointer
deference.</p>

<p>The generic code for launching a process in:
GDBRemoteCommunicationServerLLGS::LaunchProcess
sets the m<em>debugged</em>process<em>up pointer after
a successful call to  m</em>process<em>factory.Launch().
If we attempt to call process</em>up->SetState()
inside a platform specific Launch function we
end up dereferencing a NULL pointer in
NativeProcessProtocol::GetCurrentThreadID().</p>

<p>Use the proper call process<em>up->SetState(,false)
that sets notify</em>delegates to false.
```</p>

<ul>
<li>Sanitizers</li>
</ul>

<blockquote>
  <p>I suspended development of new features in sanitizers last month, but I was still in the process of upstreaming of local patches. This process was time-consuming as it required rebasing patches, adding dedicated tests, and addressing all other requests and comments from the upstream developers.</p>
  
  <p>I'm not counting hot fixes, as some changes were triggering build or test issues on !NetBSD hosts. Thankfully all these issues were addressed quickly. The final result is a reduction of local delta size of almost 1MB to less than 100KB (1205 lines of diff). The remaining patches are rescheduled for later, mostly because they depend on extra work with cross-OS tests and prior integration of sanitizers with the basesystem distribution. I didn't want to put extra work here in the current state of affairs and, I've registered as a mentor for Google Summer of Code for the NetBSD Foundation and prepared Software Quality improvement tasks in order to outsource part of the labour.</p>
</blockquote>

<ul>
<li>Userland changes</li>
</ul>

<blockquote>
  <p>I've also improved documentation for some of the features of NetBSD, described in man-pages. These pieces of information were sometimes wrong or incomplete, and this makes covering the NetBSD system with features such as sanitizers harder as there is a mismatch between the actual code and the documented code.</p>
  
  <p>Some pieces of software also require better namespacing support, these days mostly for the POSIX standard. I've fixed few low-hanging fruits there and requested pullups to NetBSD-8(BETA).</p>
  
  <p>I thank the developers for improving the landed code in order to ship the best solutions for users.</p>
</blockquote>

<ul>
<li>BSD collaboration in LLVM</li>
</ul>

<blockquote>
  <p>A One-man-show in human activity is usually less fun and productive than collaboration in a team. This is also true in software development. Last month I was helping as a reviewer to port LLVM features to FreeBSD and when possible to OpenBSD. This included MSan/FreeBSD, libFuzzer/FreeBSD, XRay/FreeBSD and UBSan/OpenBSD.</p>
  
  <p>I've landed most of the submitted and reviewed code to the mainstream LLVM tree.</p>
  
  <p>Part of the code also verified the correctness of NetBSD routes in the existing porting efforts and showed new options for improvement. This is the reason why I've landed preliminary XRay/NetBSD code and added missing NetBSD bits to ToolChain::getOSLibName(). The latter produced setup issues with the prebuilt LLVM toolchain, as the directory name with compiler-rt goodies were located in a path like ./lib/clang/7.0.0/lib/netbsd8.99.12 with a varying OS version. This could stop working after upgrades, so I've simplified it to "netbsd", similar to FreeBSD and Solaris.</p>
</blockquote>

<ul>
<li>Prebuilt toolchain for testers</li>
</ul>

<blockquote>
  <p>I've prepared a build of Clang/LLVM with LLDB and compiler-rt features prebuilt on NetBSD/amd64 v. 8.99.12:</p>
</blockquote>

<p><code>llvm-clang-compilerrt-lldb-7.0.0beta_2018-02-28.tar.bz2</code></p>

<ul>
<li>Plan for the next milestone</li>
</ul>

<blockquote>
  <p>With the approaching NetBSD 8.0 release I plan to finish backporting a few changes there from HEAD:</p>
</blockquote>

<ul>
<li>Remove one unused feature from ptrace(2), PT<em>SET</em>SIGMASK &amp; PT<em>GET</em>SIGMASK. I've originally introduced these operations with criu/rr-like software in mind, but they are misusing or even abusing ptrace(2) and are not regular process debuggers. I plan to remove this operation from HEAD and backport this to NetBSD-8(BETA), before the release, so no compat will be required for this call. Future ports of criu/rr should involve dedicated kernel support for such requirements.
Finish the backport of <em>UC</em>MACHINE_FP() to NetBSD-8. This will allow use of the same code in sanitizers in HEAD and NetBSD-8.0.</li>
<li>By popular demand, improve the regnsub(3) and regasub(3) API, adding support for more or less substitutions than 10.</li>
</ul>

<blockquote>
  <p>Once done, I will return to ptrace(2) debugging and corrections.</p>
</blockquote>

<p><hr /></p>

<p><strong>DigitalOcean</strong></p>

<h3><a href="https://t.pagef.lt/working-with-the-netbsd-kernel/">Working with the NetBSD kernel</a></h3>

<ul>
<li>Overview</li>
</ul>

<blockquote>
  <p>When working on complex systems, such as OS kernels, your attention span and cognitive energy are too valuable to be wasted on inefficiencies pertaining to ancillary tasks. After experimenting with different environmental setups for kernel debugging, some of which were awkward and distracting from my main objectives, I have arrived to my current workflow, which is described here. This approach is mainly oriented towards security research and the study of kernel internals.</p>
  
  <p>Before delving into the details, this is the general outline of my environment:</p>
  
  <p>My host system runs Linux. My target system is a QEMU guest.</p>
  
  <p>I’m tracing and debugging on my host system by attaching GDB (with NetBSD x86-64 ABI support) to QEMU’s built-in GDB server.
  I work with NetBSD-current. All sources are built on my host system with the cross-compilation toolchain produced by build.sh.
  I use NFS to share the source tree and the build artifacts between the target and the host.
  I find IDEs awkward, so for codebase navigation I mainly rely on vim, tmux and ctags.
  For non-intrusive instrumentation, such as figuring out control flow, I’m using dtrace.</p>
</blockquote>

<ul>
<li><p>Preparing the host system</p>

<ul><li>QEMU</li>
<li>GDB</li>
<li>NFS Exports</li></ul></li>
<li><p>Building NetBSD-current</p></li>
<li><p>A word of warning</p>

<ul><li>Now is a great time to familiarize yourself with the build.sh tool and its options. Be especially carefull with the following options:</li></ul></li>
</ul>

<p><code>
    -r          Remove contents of TOOLDIR and DESTDIR before building.
    -u          Set MKUPDATE=yes; do not run "make clean" first.
        Without this, everything is rebuilt, including the tools.
</code></p>

<blockquote>
  <p>Chance are, you do not want to use these options once you’ve successfully built the cross-compilation toolchain and your entire userland, because building those takes time and there aren’t many good reasons to recompile them from scratch. Here’s what to expect:</p>
  
  <p>On my desktop, running a quad-core Intel i5-3470 at 3.20GHz with 24GB of RAM and underlying directory structure residing on a SSD drive, the entire process took about 55 minutes. I was running make with -j12, so the machine was quite busy.
  On an old Dell D630 laptop, running Intel Core 2 Duo T7500 at 2.20GHz with 4GB of RAM and a slow hard drive (5400RPM), the process took approximatelly 2.5 hours. I was running make with -j4. Based on the temperature alerts and CPU clock throttling messages, it was quite a struggle.</p>
</blockquote>

<ul>
<li>Acquiring the sources</li>
<li><p>Compiling the sources</p>

<ul><li>Preparing the guest system</li></ul></li>
<li>Provisioning your guest</li>
<li>Pkgin and NFS shares</li>
<li>Tailoring the kernel for debugging</li>
<li>Installing the new kernel</li>
<li>Configuring DTrace</li>
<li>Debugging the guest’s kernel</li>
</ul>

<p><hr /></p>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=331214">Add support for the experimental Internet-Draft "TCP Alternative Backoff”</a></h3>

<p>```
Add support for the experimental Internet-Draft "TCP Alternative Backoff with
ECN (ABE)" proposal to the New Reno congestion control algorithm module.
ABE reduces the amount of congestion window reduction in response to
ECN-signalled congestion relative to the loss-inferred congestion response.</p>

<p>More details about ABE can be found in the Internet-Draft:
https://tools.ietf.org/html/draft-ietf-tcpm-alternativebackoff-ecn</p>

<p>The implementation introduces four new sysctls:</p>

<ul>
<li><p>net.inet.tcp.cc.abe defaults to 0 (disabled) and can be set to non-zero to
enable ABE for ECN-enabled TCP connections.</p></li>
<li><p>net.inet.tcp.cc.newreno.beta and net.inet.tcp.cc.newreno.beta<em>ecn set the
multiplicative window decrease factor, specified as a percentage, applied to
the congestion window in response to a loss-based or ECN-based congestion
signal respectively. They default to the values specified in the draft i.e.
beta=50 and beta</em>ecn=80.</p></li>
<li><p>net.inet.tcp.cc.abe_frlossreduce defaults to 0 (disabled) and can be set to
non-zero to enable the use of standard beta (50% by default) when repairing
loss during an ECN-signalled congestion recovery episode. It enables a more
conservative congestion response and is provided for the purposes of
experimentation as a result of some discussion at IETF 100 in Singapore.</p></li>
</ul>

<p>The values of beta and beta<em>ecn can also be set per-connection by way of the
TCP</em>CCALGOOPT TCP-level socket option and the new CC<em>NEWRENO</em>BETA or
CC<em>NEWRENO</em>BETA_ECN CC algo sub-options.</p>

<p>Submitted by:    Tom Jones <a href="&#x6D;&#x61;i&#x6C;&#x74;&#111;:&#x74;&#x6A;&#64;&#x65;&#x6E;&#x6F;&#x74;&#105;.&#x6D;&#101;">&#x74;&#x6A;&#64;&#x65;&#x6E;&#x6F;&#x74;&#105;.&#x6D;&#101;</a>
Tested by:    Tom Jones <a href="&#x6D;&#97;&#105;&#x6C;&#x74;&#x6F;:&#116;&#x6A;&#64;&#101;&#x6E;&#111;&#116;&#105;&#x2E;&#x6D;&#101;">&#116;&#x6A;&#64;&#101;&#x6E;&#111;&#116;&#105;&#x2E;&#x6D;&#101;</a>, Grenville Armitage <a href="&#109;&#x61;&#105;&#x6C;&#x74;&#x6F;:&#103;&#97;&#x72;&#109;&#x69;ta&#x67;&#x65;&#64;&#x73;&#119;&#105;&#x6E;.&#x65;d&#117;.&#97;&#117;">&#103;&#97;&#x72;&#109;&#x69;ta&#x67;&#x65;&#64;&#x73;&#119;&#105;&#x6E;.&#x65;d&#117;.&#97;&#117;</a>
Relnotes:    Yes
Differential Revision:    https://reviews.freebsd.org/D11616
```</p>

<p><hr /></p>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180228225937">Meltdown-mitigation syspatch/errata now available</a></h3>

<blockquote>
  <p>The recent changes in -current mitigating the Meltdown vulnerability have been backported to the 6.1 and 6.2 (amd64) releases, and the syspatch update (for 6.2) is now available.</p>
</blockquote>

<ul>
<li><a href="https://marc.info/?l=openbsd-cvs&amp;m=151964860620856&amp;w=2">6.1</a></li>
</ul>

<p>```
Changes by:    bluhm@cvs.openbsd.org   2018/02/26 05:36:18
Log message:
Implement a workaround against the Meltdown flaw in Intel CPUs.
The following changes have been backported from OpenBSD -current.</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/01/06 15:03:13
Log message:
Handle %gs like %[def]s and reset set it in cpu_switchto() instead of on
every return to userspace.</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/06 18:08:20
Log message:
Add identcpu.c and specialreg.h definitions for the new Intel/AMD MSRs
that should help mitigate spectre. This is just the detection piece, these
features are not yet used.
Part of a larger ongoing effort to mitigate meltdown/spectre. i386 will
come later; it needs some machdep.c cleanup first.</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/07 12:56:19
Log message:
remove all PG_G global page mappings from the kernel when running on
Intel CPUs. Part of an ongoing set of commits to mitigate the Intel
"meltdown" CVE. This diff does not confer any immunity to that
vulnerability - subsequent commits are still needed and are being
worked on presently.
ok guenther, deraadt</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/12 01:21:30
Log message:
IBRS -> IBRS,IBPB in identifycpu lines</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/02/21 12:24:15
Log message:
Meltdown: implement user/kernel page table separation.
On Intel CPUs which speculate past user/supervisor page permission checks,
use a separate page table for userspace with only the minimum of kernel code
and data required for the transitions to/from the kernel (still marked as
supervisor-only, of course):
- the IDT (RO)
- three pages of kernel text in the .kutext section for interrupt, trap,
and syscall trampoline code (RX)
- one page of kernel data in the .kudata section for TLB flush IPIs (RW)
- the lapic page (RW, uncachable)
- per CPU: one page for the TSS+GDT (RO) and one page for trampoline
stacks (RW)
When a syscall, trap, or interrupt takes a CPU from userspace to kernel the
trampoline code switches page tables, switches stacks to the thread's real
kernel stack, then copies over the necessary bits from the trampoline stack.
On return to userspace the opposite occurs: recreate the iretq frame on the
trampoline stack, switch stack, switch page tables, and return to userspace.
mlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing
issues on MP in particular, and drove the final push to completion.
Many rounds of testing by naddy@, sthen@, and others
Thanks to Alex Wilson from Joyent for early discussions about trampolines
and their data requirements.
Per-CPU page layout mostly inspired by DragonFlyBSD.
ok mlarkin@ deraadt@</p>

<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:18:59
Log message:
The GNU assembler does not understand 1ULL, so replace the constant
with 1.  Then it compiles with gcc, sign and size do not matter
here.</p>

<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:27:14
Log message:
The compile time assertion for cpu info did not work with gcc.
Rephrase the condition in a way that both gcc and clang accept it.</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/02/22 13:36:40
Log message:
Set the PG_G (global) bit on the special page table entries that are shared
between the u-k and u+k tables, because they're actually in <em>all</em> tables.</p>

<p>OpenBSD 6.1 errata 037
```</p>

<ul>
<li>6.2</li>
</ul>

<p>```
Changes by:    bluhm@cvs.openbsd.org   2018/02/26 05:29:48
Log message:
Implement a workaround against the Meltdown flaw in Intel CPUs.
The following changes have been backported from OpenBSD -current.</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/01/06 15:03:13
Log message:
Handle %gs like %[def]s and reset set it in cpu_switchto() instead of on
every return to userspace.</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/06 18:08:20
Log message:
Add identcpu.c and specialreg.h definitions for the new Intel/AMD MSRs
that should help mitigate spectre. This is just the detection piece, these
features are not yet used.
Part of a larger ongoing effort to mitigate meltdown/spectre. i386 will
come later; it needs some machdep.c cleanup first.</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/07 12:56:19
Log message:
remove all PG_G global page mappings from the kernel when running on
Intel CPUs. Part of an ongoing set of commits to mitigate the Intel
"meltdown" CVE. This diff does not confer any immunity to that
vulnerability - subsequent commits are still needed and are being
worked on presently.</p>

<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/12 01:21:30
Log message:
IBRS -> IBRS,IBPB in identifycpu lines</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/02/21 12:24:15
Log message:
Meltdown: implement user/kernel page table separation.
On Intel CPUs which speculate past user/supervisor page permission checks,
use a separate page table for userspace with only the minimum of kernel code
and data required for the transitions to/from the kernel (still marked as
supervisor-only, of course):
- the IDT (RO)
- three pages of kernel text in the .kutext section for interrupt, trap,
and syscall trampoline code (RX)
- one page of kernel data in the .kudata section for TLB flush IPIs (RW)
- the lapic page (RW, uncachable)
- per CPU: one page for the TSS+GDT (RO) and one page for trampoline
stacks (RW)
When a syscall, trap, or interrupt takes a CPU from userspace to kernel the
trampoline code switches page tables, switches stacks to the thread's real
kernel stack, then copies over the necessary bits from the trampoline stack.
On return to userspace the opposite occurs: recreate the iretq frame on the
trampoline stack, switch stack, switch page tables, and return to userspace.
mlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing
issues on MP in particular, and drove the final push to completion.
Many rounds of testing by naddy@, sthen@, and others
Thanks to Alex Wilson from Joyent for early discussions about trampolines
and their data requirements.
Per-CPU page layout mostly inspired by DragonFlyBSD.</p>

<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:18:59
Log message:
The GNU assembler does not understand 1ULL, so replace the constant
with 1.  Then it compiles with gcc, sign and size do not matter
here.</p>

<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:27:14
Log message:
The compile time assertion for cpu info did not work with gcc.
Rephrase the condition in a way that both gcc and clang accept it.</p>

<p>Changes by:     guenther@cvs.openbsd.org        2018/02/22 13:36:40
Log message:
Set the PG_G (global) bit on the special page table entries that are shared
between the u-k and u+k tables, because they're actually in <em>all</em> tables.</p>

<p>OpenBSD 6.2 errata 009
```</p>

<ul>
<li><a href="https://man.openbsd.org/syspatch">syspatch</a></li>
</ul>

<p><hr /></p>

<p><strong>iXsystems</strong></p>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180302002131">a2k18 Hackathon Report: Ken Westerback on dhclient and more</a></h3>

<blockquote>
  <p>Ken Westerback (krw@) has sent in the first report from the (recently concluded) a2k18 hackathon:</p>
</blockquote>

<ul>
<li><p><a href="http://www.gcmap.com/mapui?P=YYZ-YVR-MEL-ZQN-CHC-DUD,DUD-WLG-AKL-SYD-BNE-YVR-YYZ">YYZ -> YVR -> MEL -> ZQN -> CHC -> DUD -> WLG -> AKL -> SYD -> BNE -> YVR -> YYZ</a></p></li>
<li><p>For those of you who don’t speak Airport code:</p></li>
<li>Toronto -> Vancouver -> Melbourne -> Queenstown -> Christchurch -> Dunedin</li>
<li>Then: Dunedin -> Wellington -> Auckland -> Sydney -> Brisbane -> Vancouver -> Toronto</li>
</ul>

<p>```</p>

<p>Whew.</p>

<p>Once in Dunedin the hacking commenced. The background was a regular tick of new meltdown diffs to test in addition to whatever work one was actually engaged in. I was lucky (?) in that none of the problems with the various versions cropped up on my laptop.
```</p>

<p>```
I worked with rpe@ and tb@ to make the install script create the 'correct' FQDN when dhclient was involved. I worked with tb@ on some code cleanup in various bits of the base. dhclient(8) got some nice cleanup, further pruning/improving log messages in particular. In addition the oddball -q option was flipped into the more normal -v. I.e. be quiet by default and verbose on request.</p>

<p>More substantially the use of recorded leases was made less intrusive by avoiding continual reconfiguration of the interface with the same information. The 'request', 'require' and 'ignore' dhclient.conf(5) statement were changed so they are cumulative, making it easier to build longer lists of affected options.</p>

<p>I tweaked softraid(4) to remove a handrolled version of duid_format().</p>

<p>I sprinkled a couple of M_WAITOK into amd64 and i386 mpbios to document that there is really no need to check for NULL being returned from some malloc() calls.</p>

<p>I continued to help test the new filesystem quiescing logic that deraadt@ committed during the hackathon.</p>

<p>I only locked myself out of my room once!</p>

<p>Fueled by the excellent coffee from local institutions The Good Earth Cafe and The Good Oil Cafe, and the excellent hacking facilities and accommodations at the University of Otago it was another enjoyable and productive hackathon south of the equator. And I even saw penguins.</p>

<p>Thanks to Jim Cheetham and the support from the project and the OpenBSD Foundation that made it all possible
```</p>

<p><hr /></p>

<h3><a href="https://blog.gerv.net/2018/03/poetic-license/">Poetic License</a></h3>

<blockquote>
  <p>I found this when going through old documents. It looks like I wrote it and never posted it. Perhaps I didn’t consider it finished at the time. But looking at it now, I think it’s good enough to share. It’s a redrafting of the BSD licence, in poetic form. Maybe I had plans to do other licences one day; I can’t remember.</p>
  
  <p>I’ve interleaved it with the original license text so you can see how true, or otherwise, I’ve been to it. Enjoy :-)</p>
</blockquote>

<p>```
Copyright (c) <YEAR>, <OWNER>
All rights reserved.</p>

<p>Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
```</p>

<blockquote>
  <p>You may redistribute and use –
  as source or binary, as you choose,
  and with some changes or without –
  this software; let there be no doubt.
  But you must meet conditions three,
  if in compliance you wish to be.</p>
</blockquote>

<p><code>
1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
  notice, this list of conditions and the following disclaimer in the
  documentation and/or other materials provided with the distribution.
3. Neither the name of the  nor the names of its
   contributors may be used to endorse or promote products derived
   from this software without specific prior written permission.
</code></p>

<blockquote>
  <p>The first is obvious, of course –
  To keep this text within the source.
  The second is for binaries
  Place in the docs a copy, please.
  A moral lesson from this ode –
  Don’t strip the copyright on code.</p>
  
  <p>The third applies when you promote:
  You must not take, from us who wrote,
  our names and make it seem as true
  we like or love your version too.
  (Unless, of course, you contact us
  And get our written assensus.)</p>
</blockquote>

<p><code>
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS  IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
</code></p>

<blockquote>
  <p>One final point to be laid out
  (You must forgive my need to shout):
  THERE IS NO WARRANTY FOR THIS
  WHATEVER THING MAY GO AMISS.
  EXPRESS, IMPLIED, IT’S ALL THE SAME –
  RESPONSIBILITY DISCLAIMED.</p>
  
  <p>WE ARE NOT LIABLE FOR LOSS
  NO MATTER HOW INCURRED THE COST
  THE TYPE OR STYLE OF DAMAGE DONE
  WHATE’ER THE LEGAL THEORY SPUN.
  THIS STILL REMAINS AS TRUE IF YOU
  INFORM US WHAT YOU PLAN TO DO.</p>
  
  <p>When all is told, we sum up thus –
  Do what you like, just don’t sue us.</p>
</blockquote>

<p><hr /></p>

<p><hr /></p>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/playlist?list=PLnTFqpZk5ebDZwT-bmYcIwv76yhmTfl0l">AsiaBSDCon 2018 Videos</a></li>
<li><a href="https://www.freebsdfoundation.org/past-issues/storage/">The January/February 2018 FreeBSD Journal is Here</a></li>
<li><a href="https://mail-index.netbsd.org/pkgsrc-users/2018/01/04/msg026073.html">Announcing the pkgsrc-2017Q4 release (2018-01-04)</a></li>
<li><a href="https://www.bsdhh.org/bsdhh-de-index.html">BSD Hamburg Event</a></li>
<li><a href="http://zfs.datto.com/">ZFS User conference</a></li>
<li><a href="https://www.phoronix.com/scan.php?page=news_item&amp;px=Unreal-Engine-4-FreeBSD">Unreal Engine 4 Being Brought Natively To FreeBSD By Independent Developer</a></li>
</ul>

<p><hr /></p>

<p>Tarsnap ad</p>

<p><hr /></p>

<h2>Feedback/Questions</h2>

<ul>
<li>Philippe - <a href="http://dpaste.com/2643BF5#wrap">I heart FreeBSD and other questions</a></li>
<li>Cyrus - <a href="http://dpaste.com/3NTH14J#wrap">BSD Now is excellent</a></li>
<li>Architect - <a href="http://dpaste.com/317BP8X#wrap">Combined Feedback</a></li>
<li>Dale - <a href="http://dpaste.com/284G4TQ#wrap">ZFS on Linux moving to ZFS on FreeBSD</a></li>
<li>Tommi - <a href="http://dpaste.com/1KGMRGM#wrap">New BUG in Finland</a></li>
</ul>

<p><hr /></p>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li>
</ul>

<p><hr /></p>]]>
  </itunes:summary>
</item>
<item>
  <title>238: VLAN-Zezes-ki in Hardware</title>
  <link>https://www.bsdnow.tv/238</link>
  <guid isPermaLink="false">19a3e093-c80b-4eae-84c6-aa128d0c61d7</guid>
  <pubDate>Wed, 21 Mar 2018 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/19a3e093-c80b-4eae-84c6-aa128d0c61d7.mp3" length="89016628" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Looking at Lumina Desktop 2.0, 2 months of KPTI development in SmartOS, OpenBSD email service, an interview with Ryan Zezeski, NomadBSD released, and John Carmack's programming retreat with OpenBSD.</itunes:subtitle>
  <itunes:duration>2:03:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Looking at Lumina Desktop 2.0, 2 months of KPTI development in SmartOS, OpenBSD email service, an interview with Ryan Zezeski, NomadBSD released, and John Carmack's programming retreat with OpenBSD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Looking at Lumina Desktop 2.0 (https://www.trueos.org/blog/looking-lumina-desktop-2-0/)
A few weeks ago I sat down with Lead Developer Ken Moore of the TrueOS Project to get answers to some of the most frequently asked questions about Lumina Desktop from the open source community. Here is what he said on Lumina Desktop 2.0.  Do you have a question for Ken and the rest of the team over at the TrueOS Project? Make sure to read the interview and comment below. We are glad to answer your questions!
Ken: Lumina Desktop 2.0 is a significant overhaul compared to Lumina 1.x. Almost every single subsystem of the desktop has been streamlined, resulting in a nearly-total conversion in many important areas.
With Lumina Desktop 2.0 we will finally achieve our long-term goal of turning Lumina into a complete, end-to-end management system for the graphical session and removing all the current runtime dependencies from Lumina 1.x (Fluxbox, xscreensaver, compton/xcompmgr). The functionality from those utilities is now provided by Lumina Desktop itself.
Going along with the session management changes, we have compressed the entire desktop into a single, multi-threaded binary. This means that if any rogue script or tool starts trying to muck about with the memory used by the desktop (probably even more relevant now than when we started working on this), the entire desktop session will close/crash rather than allowing targeted application crashes to bypass the session security mechanisms. By the same token, this also prevents “man-in-the-middle” type of attacks because the desktop does not use any sort of external messaging system to communicate (looking at you dbus). This also gives a large performance boost to Lumina Desktop
The entire system for how a user’s settings get saved and loaded has been completely redone, making it a “layered” settings system which allows the default settings (Lumina) to get transparently replaced by system settings (OS/Distributor/SysAdmin) which can get replaced by individual user settings. This results in the actual changes in the user setting files to be kept to a minimum and allows for a smooth transition between updates to the OS or Desktop. This also provides the ability to “restrict” a user’s desktop session (based on a system config file) to the default system settings and read-only user sessions for certain business applications.
The entire graphical interface has been written in QML in order to fully-utilize hardware-based GPU acceleration with OpenGL while the backend logic and management systems are still written entirely in C++. This results in blazing fast performance on the backend systems (myriad multi-threaded C++ objects) as well as a smooth and responsive graphical interface with all the bells and whistles (drag and drop, compositing, shading, etc).
Q: Are there future plans to implement something like Lumina in a MAC Jail?
While I have never tried out Lumina in a MAC jail, I do not see anything on that page which should stop it from running in one right now. Lumina is already designed to be run as an unpriviledged user and is very smart about probing the system to find out what is/not available before showing anything to the user. The only thing that comes to mind is that you might need to open up some other system devices so that X11 itself can draw to the display (graphical environment setup is a bit different than CLI environment).
Q: I look forward to these changes. I know the last time I used it when I would scroll I would get flashes like the refresh rate was not high enough. It will be nice to have a fast system as well as I know with the more changes Linux is becoming slower. Not once it has loaded but in the loading process. I will do another download when these changes come out and install again and maybe stay this time.
If I recall correctly, one of the very first versions of Lumina (pre-1.0) would occasionally flicker. If that is still happening, you might want to verify that you are using the proper video driver for your hardware and/or enable the compositor within the Lumina settings.
Q: Why was enlightenment project not considered for TrueOS? It is BSD licensed and is written in C.
This was a common question about 4(?) years ago with the first release of the Lumina desktop and it basically boiled down to long-term support and reliability of the underlying toolkit. Some of the things we had to consider were: cross-platform/cross-architecture support, dependency reliability and support framework (Qt5 &amp;gt; EFL), and runtime requirements and dependency tracking (Qt5 is lighter than the EFL). That plus the fact that the EFL specifically states that it is linux-focused and the BSD’s are just an afterthought (especially at the time we were doing the evaluation).
Q: I have two questions.
1) The default layout of Unity(menu bar with actual menu entries on top and icon dock on the side) is one of the few things I liked about my first voyage into non-Windows systems, and have been missing since moving on to other distros(and now also other non-Linux systems). However in 1.4.0 screenshots on Lumina’s site, the OSX-like layout has the menu attached to the window. Will 2.0 be able to have the menus on the bar?
2) Is there any timeline for a public release, or are you taking a “when it’s ready” approach?
In Lumina you can already put panels on the left/right side of the screen and give you something like the layout of the Unity desktop. The embedded menu system is not available in Lumina because that is not a specification supported by X11 and the window manager standards at the present time. The way that functionality is currently run on Linux is a hacky-bypass of the display system which only really works with the GTK3 and Qt5 toolkits, resulting in very odd overall desktop behavior in mixed environments where some apps use other graphical toolkits.
We are targetting the 18.06 STABLE release of TrueOS for Lumina 2, but that is just a guideline and if necessary we will push back the release date to allow for additional testing/fixing as needed.
A long two months (https://blog.cooperi.net/a-long-two-months)
IllumOS/SmartOS developer Alex Wilson describes the journey of developing KPTI for IllumOS
&amp;gt; On Monday (January 1st) I had the day off work for New Year's day, as is usual in most of the western world, so I slept in late. Lou and her friend decided to go to the wax museum and see several tourist attractions around SF, and I decided to pass the day at home reading. That afternoon, work chat started talking about a Tumblr post by pythonsweetness about an Intel hardware security bug. At the time I definitely did not suspect that this was going to occupy most of my working life for the next (almost) two months.
Like many people who work on system security, I had read Anders Fogh's post about a "Negative Result" in speculative execution research in July of 2017. At the time I thought it was an interesting writeup and I remember being glad that researchers were looking into this area. I sent the post to Bryan and asked him about his thoughts on it at the time, to which he replied saying that "it would be shocking if they left a way to directly leak out memory in the speculative execution". None of us seriously thought that there would be low-hanging fruit down that research path, but we also felt it was important that there was someone doing work in the area who was committed to public disclosure.
At first, after reading the blog post on Monday, we thought (or hoped) that the bug might "just" be a KASLR bypass and wouldn't require a lot of urgency. We tried to reach out to Intel at work to get more information but were met with silence. (We wouldn't hear back from them until after the disclosure was already made public.) The speculation on Tuesday intensified, until finally on Wednesday morning I arrived at the office to find links to late Tuesday night tweets revealing exploits that allowed arbitrary kernel memory reads.
Wednesday was not a happy day. Intel finally responded to our emails -- after they had already initiated public disclosure. We all spent a lot of time reading. An arbitrary kernel memory read (an info leak) is not that uncommon as far as bugs go, but for the most part they tend to be fairly easy to fix. The thing that makes the Meltdown and Spectre bugs particularly notable is that in order to mitigate them, a large amount of change is required in very deep low-level parts of the kernel. The kind of deep parts of the kernel where there are 20-year old errata workarounds that were single-line changes that you have to be very careful to not accidentally undo; the kind of parts where, as they say, mortals fear to tread.
On Friday we saw the patches Matthew Dillon put together for DragonFlyBSD for the first time. These were the first patches for KPTI that were very straightforward to read and understand, and applied to a BSD-derived kernel that was similar to those I'm accustomed to working on.
To mitigate Meltdown (and partially one of the Spectre variants), you have to make sure that speculative execution cannot reach any sensitive data from a user context. This basically means that the pages the kernel uses for anything potentially sensitive have to be unmapped when we are running user code. Traditionally, CPUs that were built to run a multi-user, UNIX-like OS did this by default (SPARC is an example of such a CPU which has completely separate address spaces for the kernel and userland). However, x86 descends from a single-address-space microcontroller that has grown up avoiding backwards-incompatible changes, and has never really introduced a clean notion of multiple address spaces (segmentation is the closest feature really, and it was thrown out for 64-bit AMD64). Instead, operating systems for x86 have generally wound up (at least in the post-AMD64 era) with flat address space models where the kernel text and data is always present in the page table no matter whether you're in user or kernel mode. The kernel mappings simply have the "supervisor" bit set on them so that user code can't directly access them.
The mitigation is basically to stop doing this: to stop mapping the kernel text, data and other memory into the page table while we're running in userland. Unfortunately, the x86 design does not make this easy. In order to be able to take interrupts or traps, the CPU has to have a number of structures mapped in the current page table at all times. There is also no ability to tell an x86 CPU that you want it to switch page tables when an interrupt occurs. So, the code that we jump to when we take an interrupt, as well as space for a stack to push context onto have to be available in both page tables. And finally, of course, we need to be able to figure out somehow what the other page table we should switch to is when we enter the kernel.
When we looked at the patches for Linux (and also the DragonFlyBSD patches at the time) on Friday and started asking questions, it became pretty evident that the initial work done by both was done under time constraints. Both had left the full kernel text mapped in both page tables, and the Linux trampoline design seemed over-complex. I started talking over some ideas with Robert Mustacchi about ways to fix these and who we should talk to, and reached out to some of my old workmates from the University of Queensland who were involved with OpenBSD. It seemed to me that the OpenBSD developers would care about these issues even more than we did, and would want to work out how to do the mitigation right.
I ended up sending an email to Philip Guenther on Friday afternoon, and on Saturday morning I drove an hour or so to meet up with him for coffee to talk page tables and interrupt trampolines. We wound up spending a good 6 hours at the coffee shop, and I came back with several pages of notes and a half-decent idea of the shape of the work to come.
One detail we missed that day was the interaction of per-CPU structures with per-process page tables. Much of the interrupt trampoline work is most easily done by using per-CPU structures in memory (and you definitely want a per-CPU stack!). If you combine that with per-process page tables, however, you have a problem: if you leave all the per-CPU areas mapped in all the processes, you will leak information (via Meltdown) about the state of one process to a different one when taking interrupts. In particular, you will leak things like %rip, which ruins all the work being done with PIE and ASLR pretty quickly. So, there are two options: you can either allocate the per-CPU structures per-process (so you end up with $NCPUS * $NPROCS of them); or you can make the page tables per-CPU.
OpenBSD, like Linux and the other implementations so far, decided to go down the road of per-CPU per-process pages to solve this issue. For illumos, we took the other route.
In illumos, it turned out that we already had per-CPU page tables. Robert and I re-discovered this on the Sunday of that week. We use them for 32-bit processes due to having full P&amp;gt;V PAE support in our kernel (which is, as it turns out, relatively uncommon amongst open-source OS). The logic to deal with creating and managing them and updating them was all already written, and after reading the code we concluded we could basically make a few small changes and re-use all of it. So we did.
By the end of that second week, we had a prototype that could get to userland. But, when working on this kind of kernel change we have a rule of thumb we use: after the first 70% of the patch is done and we can boot again, now it's time for the second 70%. In fact it turned out to be more like the second 200% for us -- a tedious long tail of bugs to solve that ended up necessitating some changes in the design as well.
At first we borrowed the method that Matt Dillon used for DragonFlyBSD, by putting the temporary "stack" space and state data for the interrupt trampolines into an extra page tacked onto the end of *%gs (in illumos the structure that lives there is the cpu_t). 
If you read the existing logic in interrupt handlers for dealing with %gs though, you will quickly notice that the corner cases start to build up. There are a bunch of situations where the kernel temporarily alters %gs, and some of the ways to mess it up have security consequences that end up being worse than the bug we're trying to fix. As it turns out, there are no less than 3 different ways that ISRs use to try to get to having the right cpu_t in %gs on illumos, as it turns out, and they are all subtly different. Trying to tell which you should use when requires a bunch of test logic that in turn requires branches and changes to the CPU state, which is difficult to do in a trampoline where you're trying to avoid altering that state as much as possible until you've got the real stack online to push things into.
I kept in touch with Philip Guenther and Mike Larkin from the OpenBSD project throughout the weeks that followed. In one of the discussions we had, we talked about the NMI/MCE handlers and the fact that their handling currently on OpenBSD neglected some nasty corner-cases around interrupting an existing trap handler. A big part of the solution to those issues was to use a feature called IST, which allows you to unconditionally change stacks when you take an interrupt.
Traditionally, x86 only changes the stack pointer (%rsp on AMD64) while taking an interrupt when there is a privilege level change. If you take an interrupt while already in the kernel, the CPU does not change the stack pointer, and simply pushes the interrupt stack frame onto the stack you're already using. IST makes the change of stack pointer unconditional. If used unwisely, this is a bad idea: if you stay on that stack and turn interrupts back on, you could take another interrupt and clobber the frame you're already in. However, in it I saw a possible way to simplify the KPTI trampoline logic and avoid having to deal with %gs.
A few weeks into the project, John Levon joined us at work. He had previously worked on a bunch of Xen-related stuff as well as other parts of the kernel very close to where we were, so he quickly got up to speed with the KPTI work as well. He and I drafted out a "crazy idea" on the whiteboard one afternoon where we would use IST for all interrupts on the system, and put the "stack" they used in the KPTI page on the end of the cpu_t. Then, they could easily use stack-relative addresses to get the page table to change to, then pivot their stack to the real kernel stack memory, and throw away (almost) all the conditional logic. A few days later, we had convinced each other that this was the way to go.
Two of the most annoying x86 issues we had to work around were related to the SYSENTER instruction. This instruction is used to make "fast" system calls in 32-bit userland. It has a couple of unfortunate properties: firstly, it doesn't save or restore RFLAGS, so the kernel code has to take care of this (and be very careful not to clobber any of it before saving or after restoring it). Secondly, if you execute SYSENTER with the TF ("trap"/single-step flag) set by a debugger, the resulting debug trap's frame points at kernel code instead of the user code where it actually happened. The first one requires some careful gymnastics on the entry and return trampolines specifically for SYSENTER, while the second is a nasty case that is incidentally made easier by using IST. With IST, we can simply make the debug trap trampoline check for whether we took the trap in another trampoline's code, and reset %cr3 and the destination stack. This works for single-stepping into any of the handlers, not just the one for SYSENTER.
To make debugging easier, we decided that traps like the debug/single-step trap (as well as faults like page faults, #GP, etc.) would push their interrupt frame in a different part of the KPTI state page to normal interrupts. We applied this change to all the traps that can interrupt another trampoline (based on the instructions we used). These "paranoid" traps also set a flag in the KPTI struct to mark it busy (and jump to the double-fault handler if it is), to work around some bugs where double-faults are not correctly generated.
It's been a long and busy two months, with lots of time spent building, testing, and validating the code. We've run it on as many kinds of machines as we could get our hands on, to try to make sure we catch issues. The time we've spent on this has been validated several times in the process by finding bugs that could have been nasty in production.
One great example: our patches on Westmere-EP Xeons were causing busy machines to throw a lot of L0 I-cache parity errors. This seemed very mysterious at first, and it took us a few times seeing it to believe that it was actually our fault. This was actually caused by the accidental activation of a CPU errata for Westmere (B52, "Memory Aliasing of Code Pages May Cause Unpredictable System Behaviour") -- it turned out we had made a typo and put the "cacheable" flag into a variable named flags instead of attrs where it belonged when setting up the page tables. This was causing performance degradation on other machines, but on Westmere it causes cache parity errors as well. This is a great example of the surprising consequences that small mistakes in this kind of code can end up having. In the end, I'm glad that that erratum existed, otherwise it may have been a long time before we caught that bug.
As of this week, Mike and Philip have committed the OpenBSD patches for KPTI to their repository, and the patches for illumos are out for review. It's a nice kind of symmetry that the two projects who started on the work together after the public disclosure at the same time are both almost ready to ship at the same time at the other end. I'm feeling hopeful, and looking forward to further future collaborations like this with our cousins, the BSDs.
The IllumOS work has since landed, on March 12th (https://github.com/joyent/illumos-joyent/commit/d85fbfe15cf9925f83722b6d62da49d549af615c)
***
OpenBSD Email Service (https://github.com/vedetta-com/caesonia)
Features
Efficient: configured to run on min. 512MB RAM and 20GB SSD, a KVM (cloud) VPS for around $2.50/mo
15GB+ uncompressed Maildir, rivals top free-email providers (grow by upgrading SSD)
Email messages are gzip compressed, at least 1/3 more space with level 6 default
Server side full text search (headers and body) can be enabled (to use the extra space)
Mobile data friendly: IMAPS connections are compressed
Subaddress (+tag) support, to filter and monitor email addresses
Virtual domains, aliases, and credentials in files, Berkeley DB, or SQLite3
Naive Bayes rspamd filtering with supervised learning: the lowest false positive spam detection rates
Carefree automated Spam/ and Trash/ cleaning service (default: older than 30 days)
Automated quota management, gently assists when over quota
Easy backup MX setup: using the same configuration, install in minutes on a different host
Worry-free automated master/master replication with backup MX, prevents accidental loss of email messages
Resilient: the backup MX can be used as primary, even when the primary is not down, both perfect replicas
Flexible: switching roles is easy, making the process of changing VPS hosts a breeze (no downtime)
DMARC (with DKIM and SPF) email-validation system, to detect and prevent email spoofing
Daily (spartan) stats, to keep track of things
Your sieve scripts and managesieve configuration, let's get started
Considerations
By design, email message headers need to be public, for exchanges to happen. The body of the message can be encrypted by the user, if desired. Moreover, there is no way to prevent the host from having access to the virtual machine. Therefore, full disk encryption (at rest) may not be necessary.
Given our low memory requirements, and the single-purpose concept of email service, Roundcube or other web-based IMAP email clients should be on a different VPS.
Antivirus software users (usually) have the service running on their devices. ClamAV can easily be incorporated into this configuration, if affected by the types of malware it protects against, but will require around 1GB additional RAM (or another VPS).
Every email message is important, if properly delivered, for Bayes classification. At least 200 ham and 200 spam messages are required to learn what one considers junk. By default (change to use case), a rspamd score above 50% will send the message to Spam/. Moving messages in and out of Spam/ changes this score. After 95%, the message is flagged as "seen" and can be safely ignored.
Spamd is effective at greylisting and stopping high volume spam, if it becomes a problem. It will be an option when IPv6 is supported, along with bgp-spamd.
System mail is delivered to an alias mapped to a virtual user served by the service. This way, messages are guaranteed to be delivered via encrypted connection. It is not possible for real users to alias, nor mail an external mail address with the default configuration. e.g. puffy@mercury.example.com is wheel, with an alias mapped to (virtual) puffy@example.com, and user (puffy) can be different for each.
Interview - Ryan Zezeski - rpz@joyent.com (mailto:rpz@joyent.com) / @rzezeski (https://twitter.com/rzezeski)
News Roundup
John Carmack's programming retreat to hermit coding with OpenBSD (https://www.facebook.com/permalink.php?story_fbid=2110408722526967&amp;amp;id=100006735798590)
After a several year gap, I finally took another week-long programming retreat, where I could work in hermit mode, away from the normal press of work. My wife has been generously offering it to me the last few years, but I’m generally bad at taking vacations from work.
As a change of pace from my current Oculus work, I wanted to write some from-scratch-in-C++ neural network implementations, and I wanted to do it with a strictly base OpenBSD system. Someone remarked that is a pretty random pairing, but it worked out ok.
Despite not having actually used it, I have always been fond of the idea of OpenBSD — a relatively minimal and opinionated system with a cohesive vision and an emphasis on quality and craftsmanship. Linux is a lot of things, but cohesive isn’t one of them.
I’m not a Unix geek. I get around ok, but I am most comfortable developing in Visual Studio on Windows. I thought a week of full immersion work in the old school Unix style would be interesting, even if it meant working at a slower pace. It was sort of an adventure in retro computing — this was fvwm and vi. Not vim, actual BSD vi.
In the end, I didn’t really explore the system all that much, with 95% of my time in just the basic vi / make / gdb operations. I appreciated the good man pages, as I tried to do everything within the self contained system, without resorting to internet searches. Seeing references to 30+ year old things like Tektronix terminals was amusing.
I was a little surprised that the C++ support wasn’t very good. G++ didn’t support C++11, and LLVM C++ didn’t play nicely with gdb. Gdb crashed on me a lot as well, I suspect due to C++ issues. I know you can get more recent versions through ports, but I stuck with using the base system.
In hindsight, I should have just gone full retro and done everything in ANSI C. I do have plenty of days where, like many older programmers, I think “Maybe C++ isn’t as much of a net positive as we assume...”. There is still much that I like, but it isn’t a hardship for me to build small projects in plain C.
Maybe next time I do this I will try to go full emacs, another major culture that I don’t have much exposure to.
I have a decent overview understanding of most machine learning algorithms, and I have done some linear classifier and decision tree work, but for some reason I have avoided neural networks. On some level, I suspect that Deep Learning being so trendy tweaked a little bit of contrarian in me, and I still have a little bit of a reflexive bias against “throw everything at the NN and let it sort it out!”
In the spirit of my retro theme, I had printed out several of Yann LeCun’s old papers and was considering doing everything completely off line, as if I was actually in a mountain cabin somewhere, but I wound up watching a lot of the Stanford CS231N lectures on YouTube, and found them really valuable. Watching lecture videos is something that I very rarely do — it is normally hard for me to feel the time is justified, but on retreat it was great!
I don’t think I have anything particularly insightful to add about neural networks, but it was a very productive week for me, solidifying “book knowledge” into real experience.
I used a common pattern for me: get first results with hacky code, then write a brand new and clean implementation with the lessons learned, so they both exist and can be cross checked.
I initially got backprop wrong both times, comparison with numerical differentiation was critical! It is interesting that things still train even when various parts are pretty wrong — as long as the sign is right most of the time, progress is often made.
I was pretty happy with my multi-layer neural net code; it wound up in a form that I can just drop it into future efforts. Yes, for anything serious I should use an established library, but there are a lot of times when just having a single .cpp and .h file that you wrote ever line of is convenient.
My conv net code just got to the hacky but working phase, I could have used another day or two to make a clean and flexible implementation.
One thing I found interesting was that when testing on MNIST with my initial NN before adding any convolutions, I was getting significantly better results than the non-convolutional NN reported for comparison in LeCun ‘98 — right around 2% error on the test set with a single 100 node hidden layer, versus 3% for both wider and deeper nets back then. I attribute this to the modern best practices —ReLU, Softmax, and better initialization.
This is one of the most fascinating things about NN work — it is all so simple, and the breakthrough advances are often things that can be expressed with just a few lines of code. It feels like there are some similarities with ray tracing in the graphics world, where you can implement a physically based light transport ray tracer quite quickly, and produce state of the art images if you have the data and enough runtime patience.
I got a much better gut-level understanding of overtraining / generalization / regularization by exploring a bunch of training parameters. On the last night before I had to head home, I froze the architecture and just played with hyperparameters. “Training!” Is definitely worse than “Compiling!” for staying focused.
Now I get to keep my eyes open for a work opportunity to use the new skills!
I am dreading what my email and workspace are going to look like when I get into the office tomorrow.
Stack-register Checking (https://undeadly.org/cgi?action=article;sid=20180310000858)
Recently, Theo de Raadt (deraadt@) described a new type of mitigation he has been working on together with Stefan Kempf (stefan@):
How about we add another new permission!  This is not a hardware permission, but a software permission.  It is opportunistically enforced by the kernel.
The permission is MAP_STACK.  If you want to use memory as a stack, you must mmap it with that flag bit.  The kernel does so automatically for the stack region of a process's stack.  Two other types of stack occur: thread stacks, and alternate signal stacks.  Those are handled
in clever ways.
When a system call happens, we check if the stack-pointer register points to such a page.  If it doesn't, the program is killed.  We have tightened the ABI.  You may no longer point your stack register at non-stack memory.  You'll be killed.  This checking code is MI, so it works for all platforms.
For more detail, see Theo's original message (https://marc.info/?l=openbsd-tech&amp;amp;m=152035796722258&amp;amp;w=2).
This is now available in snapshots, and people are finding the first problems in the ports tree already. So far, few issues have been uncovered, but as Theo points out, more testing is necessary:
Fairly good results.
A total of 4 problems have been found so far.  go, SBCL, and two cases in src/regress which failed the new page-alignment requirement.  The SBCL and go ones were found at buildtime, since they use themselves to complete build.
But more page-alignment violations may be found in ports at runtime.
This is something I worry about a bit.  So please everyone out there can help: Use snapshots which contain the stack-check diff, update to new packages, and test all possible packages.  Really need a lot of testing for this, so please help out.
So, everybody, install the latest snapshot and try all your favorite ports. This is the time to report issues you find, so there is a good chance this additional security feature is present in 6.3 (and works with third party software from packages).
NomadBSD 1.0 has been released (https://freeshell.de/~mk/projects/nomadbsd.html)
NomadBSD is a live system for flash drives, based on FreeBSD® 11.1 (amd64)
Change Log
The setup process has been improved.
Support for optional geli encryption of the home partition has been added
Auto-detection of NVIDIA graphics cards and their corresponding driver has been added.  (Thanks to holgerw and lme from BSDForen.de)
An rc script to start the GEOM disk scheduler on the root device has been added.
More software has been added:
accessibility/redshift (starts automatically)
audio/cantata
audio/musicpd
audio/ncmpc
ftp/filezilla
games/bsdtris
mail/neomutt
math/galculator
net-p2p/transmission-qt5
security/fpm2
sysutils/bsdstats
x11/metalock
x11/xbindkeys
Several smaller improvements and bugfixes.
Screenshots
https://freeshell.de/~mk/projects/nomadbsd-ss1.png
https://freeshell.de/~mk/projects/nomadbsd-ss2.png
https://freeshell.de/~mk/projects/nomadbsd-ss3.png
https://freeshell.de/~mk/projects/nomadbsd-ss4.png
https://freeshell.de/~mk/projects/nomadbsd-ss5.png
https://freeshell.de/~mk/projects/nomadbsd-ss6.png
Beastie Bits
KnoxBug - Nagios (http://knoxbug.org/2018-03-27)
vBSDcon videos landing (https://www.youtube.com/playlist?list=PLfJr0tWo35bc9FG_reSki2S5S0G8imqB4)
AsiaBSDCon 2017 videos (https://www.youtube.com/playlist?list=PLnTFqpZk5ebBTyXedudGm6CwedJGsE2Py)
DragonFlyBSD Adds New "Ptr_Restrict" Security Option (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=DragonFlyBSD-Ptr-Restrict)
A Dexter needs your help (https://twitter.com/michaeldexter/status/975603855407788032)
Mike Larkin at bhyvecon 2018: OpenBSD vmm(4) update (https://undeadly.org/cgi?action=article;sid=20180309064801)
[HEADS UP] - OFED/RDMA stack update (https://lists.freebsd.org/pipermail/freebsd-arch/2018-March/018900.html)
***
Feedback/Questions
Ron - Interview someone using DragonflyBSD (http://dpaste.com/3BM6GSW#wrap)
Brad - Gaming and all (http://dpaste.com/3X4ZZK2#wrap)
Mohammad - Sockets vs TCP (http://dpaste.com/0PJMKRD#wrap)
Paul - All or at least most of Bryan Cantrill's Talks (http://dpaste.com/2WXVR1X#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Looking at Lumina Desktop 2.0, 2 months of KPTI development in SmartOS, OpenBSD email service, an interview with Ryan Zezeski, NomadBSD released, and John Carmack&#39;s programming retreat with OpenBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.trueos.org/blog/looking-lumina-desktop-2-0/" rel="nofollow">Looking at Lumina Desktop 2.0</a></h3>

<blockquote>
<p>A few weeks ago I sat down with Lead Developer Ken Moore of the TrueOS Project to get answers to some of the most frequently asked questions about Lumina Desktop from the open source community. Here is what he said on Lumina Desktop 2.0.  Do you have a question for Ken and the rest of the team over at the TrueOS Project? Make sure to read the interview and comment below. We are glad to answer your questions!</p>

<p>Ken: Lumina Desktop 2.0 is a significant overhaul compared to Lumina 1.x. Almost every single subsystem of the desktop has been streamlined, resulting in a nearly-total conversion in many important areas.</p>

<p>With Lumina Desktop 2.0 we will finally achieve our long-term goal of turning Lumina into a complete, end-to-end management system for the graphical session and removing all the current runtime dependencies from Lumina 1.x (Fluxbox, xscreensaver, compton/xcompmgr). The functionality from those utilities is now provided by Lumina Desktop itself.</p>

<p>Going along with the session management changes, we have compressed the entire desktop into a single, multi-threaded binary. This means that if any rogue script or tool starts trying to muck about with the memory used by the desktop (probably even more relevant now than when we started working on this), the entire desktop session will close/crash rather than allowing targeted application crashes to bypass the session security mechanisms. By the same token, this also prevents man-in-the-middle type of attacks because the desktop does not use any sort of external messaging system to communicate (looking at you <code>dbus</code>). This also gives a large performance boost to Lumina Desktop</p>

<p>The entire system for how a users settings get saved and loaded has been completely redone, making it a layered settings system which allows the default settings (Lumina) to get transparently replaced by system settings (OS/Distributor/SysAdmin) which can get replaced by individual user settings. This results in the actual changes in the user setting files to be kept to a minimum and allows for a smooth transition between updates to the OS or Desktop. This also provides the ability to restrict a users desktop session (based on a system config file) to the default system settings and read-only user sessions for certain business applications.</p>

<p>The entire graphical interface has been written in QML in order to fully-utilize hardware-based GPU acceleration with OpenGL while the backend logic and management systems are still written entirely in C++. This results in blazing fast performance on the backend systems (myriad multi-threaded C++ objects) as well as a smooth and responsive graphical interface with all the bells and whistles (drag and drop, compositing, shading, etc).</p>
</blockquote>

<ul>
<li>Q: Are there future plans to implement something like Lumina in a MAC Jail?</li>
</ul>

<blockquote>
<p>While I have never tried out Lumina in a MAC jail, I do not see anything on that page which should stop it from running in one right now. Lumina is already designed to be run as an unpriviledged user and is very smart about probing the system to find out what is/not available before showing anything to the user. The only thing that comes to mind is that you might need to open up some other system devices so that X11 itself can draw to the display (graphical environment setup is a bit different than CLI environment).</p>
</blockquote>

<ul>
<li>Q: I look forward to these changes. I know the last time I used it when I would scroll I would get flashes like the refresh rate was not high enough. It will be nice to have a fast system as well as I know with the more changes Linux is becoming slower. Not once it has loaded but in the loading process. I will do another download when these changes come out and install again and maybe stay this time.</li>
</ul>

<blockquote>
<p>If I recall correctly, one of the very first versions of Lumina (pre-1.0) would occasionally flicker. If that is still happening, you might want to verify that you are using the proper video driver for your hardware and/or enable the compositor within the Lumina settings.</p>
</blockquote>

<ul>
<li>Q: Why was enlightenment project not considered for TrueOS? It is BSD licensed and is written in C.</li>
</ul>

<blockquote>
<p>This was a common question about 4(?) years ago with the first release of the Lumina desktop and it basically boiled down to long-term support and reliability of the underlying toolkit. Some of the things we had to consider were: cross-platform/cross-architecture support, dependency reliability and support framework (Qt5 &gt; EFL), and runtime requirements and dependency tracking (Qt5 is lighter than the EFL). That plus the fact that the EFL specifically states that it is linux-focused and the BSDs are just an afterthought (especially at the time we were doing the evaluation).</p>
</blockquote>

<ul>
<li>Q: I have two questions.

<ul>
<li>1) The default layout of Unity(menu bar with actual menu entries on top and icon dock on the side) is one of the few things I liked about my first voyage into non-Windows systems, and have been missing since moving on to other distros(and now also other non-Linux systems). However in 1.4.0 screenshots on Luminas site, the OSX-like layout has the menu attached to the window. Will 2.0 be able to have the menus on the bar?</li>
<li>2) Is there any timeline for a public release, or are you taking a when its ready approach?</li>
</ul></li>
</ul>

<blockquote>
<ol>
<li>In Lumina you can already put panels on the left/right side of the screen and give you something like the layout of the Unity desktop. The embedded menu system is not available in Lumina because that is not a specification supported by X11 and the window manager standards at the present time. The way that functionality is currently run on Linux is a hacky-bypass of the display system which only really works with the GTK3 and Qt5 toolkits, resulting in very odd overall desktop behavior in mixed environments where some apps use other graphical toolkits.</li>
<li>We are targetting the 18.06 STABLE release of TrueOS for Lumina 2, but that is just a guideline and if necessary we will push back the release date to allow for additional testing/fixing as needed.</li>
</ol>
</blockquote>

<hr>

<h3><a href="https://blog.cooperi.net/a-long-two-months" rel="nofollow">A long two months</a></h3>

<ul>
<li>IllumOS/SmartOS developer Alex Wilson describes the journey of developing KPTI for IllumOS
&gt; On Monday (January 1st) I had the day off work for New Year&#39;s day, as is usual in most of the western world, so I slept in late. Lou and her friend decided to go to the wax museum and see several tourist attractions around SF, and I decided to pass the day at home reading. That afternoon, work chat started talking about a Tumblr post by pythonsweetness about an Intel hardware security bug. At the time I definitely did not suspect that this was going to occupy most of my working life for the next (almost) two months.</li>
</ul>

<blockquote>
<p>Like many people who work on system security, I had read Anders Fogh&#39;s post about a &quot;Negative Result&quot; in speculative execution research in July of 2017. At the time I thought it was an interesting writeup and I remember being glad that researchers were looking into this area. I sent the post to Bryan and asked him about his thoughts on it at the time, to which he replied saying that &quot;it would be shocking if they left a way to directly leak out memory in the speculative execution&quot;. None of us seriously thought that there would be low-hanging fruit down that research path, but we also felt it was important that there was someone doing work in the area who was committed to public disclosure.</p>

<p>At first, after reading the blog post on Monday, we thought (or hoped) that the bug might &quot;just&quot; be a KASLR bypass and wouldn&#39;t require a lot of urgency. We tried to reach out to Intel at work to get more information but were met with silence. (We wouldn&#39;t hear back from them until after the disclosure was already made public.) The speculation on Tuesday intensified, until finally on Wednesday morning I arrived at the office to find links to late Tuesday night tweets revealing exploits that allowed arbitrary kernel memory reads.</p>

<p>Wednesday was not a happy day. Intel finally responded to our emails -- after they had already initiated public disclosure. We all spent a lot of time reading. An arbitrary kernel memory read (an info leak) is not that uncommon as far as bugs go, but for the most part they tend to be fairly easy to fix. The thing that makes the Meltdown and Spectre bugs particularly notable is that in order to mitigate them, a large amount of change is required in very deep low-level parts of the kernel. The kind of deep parts of the kernel where there are 20-year old errata workarounds that were single-line changes that you have to be very careful to not accidentally undo; the kind of parts where, as they say, mortals fear to tread.</p>

<p>On Friday we saw the patches Matthew Dillon put together for DragonFlyBSD for the first time. These were the first patches for KPTI that were very straightforward to read and understand, and applied to a BSD-derived kernel that was similar to those I&#39;m accustomed to working on.</p>

<p>To mitigate Meltdown (and partially one of the Spectre variants), you have to make sure that speculative execution cannot reach any sensitive data from a user context. This basically means that the pages the kernel uses for anything potentially sensitive have to be unmapped when we are running user code. Traditionally, CPUs that were built to run a multi-user, UNIX-like OS did this by default (SPARC is an example of such a CPU which has completely separate address spaces for the kernel and userland). However, x86 descends from a single-address-space microcontroller that has grown up avoiding backwards-incompatible changes, and has never really introduced a clean notion of multiple address spaces (segmentation is the closest feature really, and it was thrown out for 64-bit AMD64). Instead, operating systems for x86 have generally wound up (at least in the post-AMD64 era) with flat address space models where the kernel text and data is always present in the page table no matter whether you&#39;re in user or kernel mode. The kernel mappings simply have the &quot;supervisor&quot; bit set on them so that user code can&#39;t directly access them.</p>

<p>The mitigation is basically to stop doing this: to stop mapping the kernel text, data and other memory into the page table while we&#39;re running in userland. Unfortunately, the x86 design does not make this easy. In order to be able to take interrupts or traps, the CPU has to have a number of structures mapped in the current page table at all times. There is also no ability to tell an x86 CPU that you want it to switch page tables when an interrupt occurs. So, the code that we jump to when we take an interrupt, as well as space for a stack to push context onto have to be available in both page tables. And finally, of course, we need to be able to figure out somehow what the other page table we should switch to is when we enter the kernel.</p>

<p>When we looked at the patches for Linux (and also the DragonFlyBSD patches at the time) on Friday and started asking questions, it became pretty evident that the initial work done by both was done under time constraints. Both had left the full kernel text mapped in both page tables, and the Linux trampoline design seemed over-complex. I started talking over some ideas with Robert Mustacchi about ways to fix these and who we should talk to, and reached out to some of my old workmates from the University of Queensland who were involved with OpenBSD. It seemed to me that the OpenBSD developers would care about these issues even more than we did, and would want to work out how to do the mitigation right.</p>

<p>I ended up sending an email to Philip Guenther on Friday afternoon, and on Saturday morning I drove an hour or so to meet up with him for coffee to talk page tables and interrupt trampolines. We wound up spending a good 6 hours at the coffee shop, and I came back with several pages of notes and a half-decent idea of the shape of the work to come.</p>

<p>One detail we missed that day was the interaction of per-CPU structures with per-process page tables. Much of the interrupt trampoline work is most easily done by using per-CPU structures in memory (and you definitely want a per-CPU stack!). If you combine that with per-process page tables, however, you have a problem: if you leave all the per-CPU areas mapped in all the processes, you will leak information (via Meltdown) about the state of one process to a different one when taking interrupts. In particular, you will leak things like %rip, which ruins all the work being done with PIE and ASLR pretty quickly. So, there are two options: you can either allocate the per-CPU structures per-process (so you end up with $NCPUS * $NPROCS of them); or you can make the page tables per-CPU.</p>

<p>OpenBSD, like Linux and the other implementations so far, decided to go down the road of per-CPU per-process pages to solve this issue. For illumos, we took the other route.</p>

<p>In illumos, it turned out that we already had per-CPU page tables. Robert and I re-discovered this on the Sunday of that week. We use them for 32-bit processes due to having full P&gt;V PAE support in our kernel (which is, as it turns out, relatively uncommon amongst open-source OS). The logic to deal with creating and managing them and updating them was all already written, and after reading the code we concluded we could basically make a few small changes and re-use all of it. So we did.</p>

<p>By the end of that second week, we had a prototype that could get to userland. But, when working on this kind of kernel change we have a rule of thumb we use: after the first 70% of the patch is done and we can boot again, now it&#39;s time for the second 70%. In fact it turned out to be more like the second 200% for us -- a tedious long tail of bugs to solve that ended up necessitating some changes in the design as well.</p>

<p>At first we borrowed the method that Matt Dillon used for DragonFlyBSD, by putting the temporary &quot;stack&quot; space and state data for the interrupt trampolines into an extra page tacked onto the end of *%gs (in illumos the structure that lives there is the cpu_t). </p>

<p>If you read the existing logic in interrupt handlers for dealing with %gs though, you will quickly notice that the corner cases start to build up. There are a bunch of situations where the kernel temporarily alters %gs, and some of the ways to mess it up have security consequences that end up being worse than the bug we&#39;re trying to fix. As it turns out, there are no less than 3 different ways that ISRs use to try to get to having the right cpu_t in %gs on illumos, as it turns out, and they are all subtly different. Trying to tell which you should use when requires a bunch of test logic that in turn requires branches and changes to the CPU state, which is difficult to do in a trampoline where you&#39;re trying to avoid altering that state as much as possible until you&#39;ve got the real stack online to push things into.</p>

<p>I kept in touch with Philip Guenther and Mike Larkin from the OpenBSD project throughout the weeks that followed. In one of the discussions we had, we talked about the NMI/MCE handlers and the fact that their handling currently on OpenBSD neglected some nasty corner-cases around interrupting an existing trap handler. A big part of the solution to those issues was to use a feature called IST, which allows you to unconditionally change stacks when you take an interrupt.</p>

<p>Traditionally, x86 only changes the stack pointer (%rsp on AMD64) while taking an interrupt when there is a privilege level change. If you take an interrupt while already in the kernel, the CPU does not change the stack pointer, and simply pushes the interrupt stack frame onto the stack you&#39;re already using. IST makes the change of stack pointer unconditional. If used unwisely, this is a bad idea: if you stay on that stack and turn interrupts back on, you could take another interrupt and clobber the frame you&#39;re already in. However, in it I saw a possible way to simplify the KPTI trampoline logic and avoid having to deal with %gs.</p>

<p>A few weeks into the project, John Levon joined us at work. He had previously worked on a bunch of Xen-related stuff as well as other parts of the kernel very close to where we were, so he quickly got up to speed with the KPTI work as well. He and I drafted out a &quot;crazy idea&quot; on the whiteboard one afternoon where we would use IST for all interrupts on the system, and put the &quot;stack&quot; they used in the KPTI page on the end of the cpu_t. Then, they could easily use stack-relative addresses to get the page table to change to, then pivot their stack to the real kernel stack memory, and throw away (almost) all the conditional logic. A few days later, we had convinced each other that this was the way to go.</p>

<p>Two of the most annoying x86 issues we had to work around were related to the SYSENTER instruction. This instruction is used to make &quot;fast&quot; system calls in 32-bit userland. It has a couple of unfortunate properties: firstly, it doesn&#39;t save or restore RFLAGS, so the kernel code has to take care of this (and be very careful not to clobber any of it before saving or after restoring it). Secondly, if you execute SYSENTER with the TF (&quot;trap&quot;/single-step flag) set by a debugger, the resulting debug trap&#39;s frame points at kernel code instead of the user code where it actually happened. The first one requires some careful gymnastics on the entry and return trampolines specifically for SYSENTER, while the second is a nasty case that is incidentally made easier by using IST. With IST, we can simply make the debug trap trampoline check for whether we took the trap in another trampoline&#39;s code, and reset %cr3 and the destination stack. This works for single-stepping into any of the handlers, not just the one for SYSENTER.</p>

<p>To make debugging easier, we decided that traps like the debug/single-step trap (as well as faults like page faults, #GP, etc.) would push their interrupt frame in a different part of the KPTI state page to normal interrupts. We applied this change to all the traps that can interrupt another trampoline (based on the instructions we used). These &quot;paranoid&quot; traps also set a flag in the KPTI struct to mark it busy (and jump to the double-fault handler if it is), to work around some bugs where double-faults are not correctly generated.</p>

<p>It&#39;s been a long and busy two months, with lots of time spent building, testing, and validating the code. We&#39;ve run it on as many kinds of machines as we could get our hands on, to try to make sure we catch issues. The time we&#39;ve spent on this has been validated several times in the process by finding bugs that could have been nasty in production.</p>

<p>One great example: our patches on Westmere-EP Xeons were causing busy machines to throw a lot of L0 I-cache parity errors. This seemed very mysterious at first, and it took us a few times seeing it to believe that it was actually our fault. This was actually caused by the accidental activation of a CPU errata for Westmere (B52, &quot;Memory Aliasing of Code Pages May Cause Unpredictable System Behaviour&quot;) -- it turned out we had made a typo and put the &quot;cacheable&quot; flag into a variable named flags instead of attrs where it belonged when setting up the page tables. This was causing performance degradation on other machines, but on Westmere it causes cache parity errors as well. This is a great example of the surprising consequences that small mistakes in this kind of code can end up having. In the end, I&#39;m glad that that erratum existed, otherwise it may have been a long time before we caught that bug.</p>

<p>As of this week, Mike and Philip have committed the OpenBSD patches for KPTI to their repository, and the patches for illumos are out for review. It&#39;s a nice kind of symmetry that the two projects who started on the work together after the public disclosure at the same time are both almost ready to ship at the same time at the other end. I&#39;m feeling hopeful, and looking forward to further future collaborations like this with our cousins, the BSDs.</p>
</blockquote>

<ul>
<li>The IllumOS work has since landed, on <a href="https://github.com/joyent/illumos-joyent/commit/d85fbfe15cf9925f83722b6d62da49d549af615c" rel="nofollow">March 12th</a>
***</li>
</ul>

<h3><a href="https://github.com/vedetta-com/caesonia" rel="nofollow">OpenBSD Email Service</a></h3>

<ul>
<li>Features

<ul>
<li>Efficient: configured to run on min. 512MB RAM and 20GB SSD, a KVM (cloud) VPS for around $2.50/mo</li>
<li>15GB+ uncompressed Maildir, rivals top free-email providers (grow by upgrading SSD)</li>
<li>Email messages are gzip compressed, at least 1/3 more space with level 6 default</li>
<li>Server side full text search (headers and body) can be enabled (to use the extra space)</li>
<li>Mobile data friendly: IMAPS connections are compressed</li>
<li>Subaddress (+tag) support, to filter and monitor email addresses</li>
<li>Virtual domains, aliases, and credentials in files, Berkeley DB, or SQLite3</li>
<li>Naive Bayes rspamd filtering with supervised learning: the lowest false positive spam detection rates</li>
<li>Carefree automated Spam/ and Trash/ cleaning service (default: older than 30 days)</li>
<li>Automated quota management, gently assists when over quota</li>
<li>Easy backup MX setup: using the same configuration, install in minutes on a different host</li>
<li>Worry-free automated master/master replication with backup MX, prevents accidental loss of email messages</li>
<li>Resilient: the backup MX can be used as primary, even when the primary is not down, both perfect replicas</li>
<li>Flexible: switching roles is easy, making the process of changing VPS hosts a breeze (no downtime)</li>
<li>DMARC (with DKIM and SPF) email-validation system, to detect and prevent email spoofing</li>
<li>Daily (spartan) stats, to keep track of things</li>
<li>Your sieve scripts and managesieve configuration, let&#39;s get started</li>
</ul></li>
<li>Considerations</li>
</ul>

<blockquote>
<p>By design, email message headers need to be public, for exchanges to happen. The body of the message can be encrypted by the user, if desired. Moreover, there is no way to prevent the host from having access to the virtual machine. Therefore, full disk encryption (at rest) may not be necessary.</p>

<p>Given our low memory requirements, and the single-purpose concept of email service, Roundcube or other web-based IMAP email clients should be on a different VPS.</p>

<p>Antivirus software users (usually) have the service running on their devices. ClamAV can easily be incorporated into this configuration, if affected by the types of malware it protects against, but will require around 1GB additional RAM (or another VPS).</p>

<p>Every email message is important, if properly delivered, for Bayes classification. At least 200 ham and 200 spam messages are required to learn what one considers junk. By default (change to use case), a rspamd score above 50% will send the message to Spam/. Moving messages in and out of Spam/ changes this score. After 95%, the message is flagged as &quot;seen&quot; and can be safely ignored.</p>

<p>Spamd is effective at greylisting and stopping high volume spam, if it becomes a problem. It will be an option when IPv6 is supported, along with bgp-spamd.</p>

<p>System mail is delivered to an alias mapped to a virtual user served by the service. This way, messages are guaranteed to be delivered via encrypted connection. It is not possible for real users to alias, nor mail an external mail address with the default configuration. e.g. <a href="mailto:puffy@mercury.example.com" rel="nofollow">puffy@mercury.example.com</a> is wheel, with an alias mapped to (virtual) <a href="mailto:puffy@example.com" rel="nofollow">puffy@example.com</a>, and user (puffy) can be different for each.</p>

<hr>
</blockquote>

<h2>Interview - Ryan Zezeski - <a href="mailto:rpz@joyent.com" rel="nofollow">rpz@joyent.com</a> / <a href="https://twitter.com/rzezeski" rel="nofollow">@rzezeski</a></h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.facebook.com/permalink.php?story_fbid=2110408722526967&id=100006735798590" rel="nofollow">John Carmack&#39;s programming retreat to hermit coding with OpenBSD</a></h3>

<blockquote>
<p>After a several year gap, I finally took another week-long programming retreat, where I could work in hermit mode, away from the normal press of work. My wife has been generously offering it to me the last few years, but Im generally bad at taking vacations from work.<br>
As a change of pace from my current Oculus work, I wanted to write some from-scratch-in-C++ neural network implementations, and I wanted to do it with a strictly base OpenBSD system. Someone remarked that is a pretty random pairing, but it worked out ok.<br>
Despite not having actually used it, I have always been fond of the idea of OpenBSD  a relatively minimal and opinionated system with a cohesive vision and an emphasis on quality and craftsmanship. Linux is a lot of things, but cohesive isnt one of them.<br>
Im not a Unix geek. I get around ok, but I am most comfortable developing in Visual Studio on Windows. I thought a week of full immersion work in the old school Unix style would be interesting, even if it meant working at a slower pace. It was sort of an adventure in retro computing  this was fvwm and vi. Not vim, actual BSD vi.<br>
In the end, I didnt really explore the system all that much, with 95% of my time in just the basic vi / make / gdb operations. I appreciated the good man pages, as I tried to do everything within the self contained system, without resorting to internet searches. Seeing references to 30+ year old things like Tektronix terminals was amusing.<br>
I was a little surprised that the C++ support wasnt very good. G++ didnt support C++11, and LLVM C++ didnt play nicely with gdb. Gdb crashed on me a lot as well, I suspect due to C++ issues. I know you can get more recent versions through ports, but I stuck with using the base system.<br>
In hindsight, I should have just gone full retro and done everything in ANSI C. I do have plenty of days where, like many older programmers, I think Maybe C++ isnt as much of a net positive as we assume.... There is still much that I like, but it isnt a hardship for me to build small projects in plain C.<br>
Maybe next time I do this I will try to go full emacs, another major culture that I dont have much exposure to.<br>
I have a decent overview understanding of most machine learning algorithms, and I have done some linear classifier and decision tree work, but for some reason I have avoided neural networks. On some level, I suspect that Deep Learning being so trendy tweaked a little bit of contrarian in me, and I still have a little bit of a reflexive bias against throw everything at the NN and let it sort it out!<br>
In the spirit of my retro theme, I had printed out several of Yann LeCuns old papers and was considering doing everything completely off line, as if I was actually in a mountain cabin somewhere, but I wound up watching a lot of the Stanford CS231N lectures on YouTube, and found them really valuable. Watching lecture videos is something that I very rarely do  it is normally hard for me to feel the time is justified, but on retreat it was great!<br>
I dont think I have anything particularly insightful to add about neural networks, but it was a very productive week for me, solidifying book knowledge into real experience.<br>
I used a common pattern for me: get first results with hacky code, then write a brand new and clean implementation with the lessons learned, so they both exist and can be cross checked.<br>
I initially got backprop wrong both times, comparison with numerical differentiation was critical! It is interesting that things still train even when various parts are pretty wrong  as long as the sign is right most of the time, progress is often made.<br>
I was pretty happy with my multi-layer neural net code; it wound up in a form that I can just drop it into future efforts. Yes, for anything serious I should use an established library, but there are a lot of times when just having a single .cpp and .h file that you wrote ever line of is convenient.<br>
My conv net code just got to the hacky but working phase, I could have used another day or two to make a clean and flexible implementation.<br>
One thing I found interesting was that when testing on MNIST with my initial NN before adding any convolutions, I was getting significantly better results than the non-convolutional NN reported for comparison in LeCun 98  right around 2% error on the test set with a single 100 node hidden layer, versus 3% for both wider and deeper nets back then. I attribute this to the modern best practices ReLU, Softmax, and better initialization.<br>
This is one of the most fascinating things about NN work  it is all so simple, and the breakthrough advances are often things that can be expressed with just a few lines of code. It feels like there are some similarities with ray tracing in the graphics world, where you can implement a physically based light transport ray tracer quite quickly, and produce state of the art images if you have the data and enough runtime patience.<br>
I got a much better gut-level understanding of overtraining / generalization / regularization by exploring a bunch of training parameters. On the last night before I had to head home, I froze the architecture and just played with hyperparameters. Training! Is definitely worse than Compiling! for staying focused.<br>
Now I get to keep my eyes open for a work opportunity to use the new skills!<br>
I am dreading what my email and workspace are going to look like when I get into the office tomorrow.</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180310000858" rel="nofollow">Stack-register Checking</a></h3>

<blockquote>
<p>Recently, Theo de Raadt (deraadt@) described a new type of mitigation he has been working on together with Stefan Kempf (stefan@):<br>
How about we add another new permission!  This is not a hardware permission, but a software permission.  It is opportunistically enforced by the kernel.<br>
The permission is MAP_STACK.  If you want to use memory as a stack, you must mmap it with that flag bit.  The kernel does so automatically for the stack region of a process&#39;s stack.  Two other types of stack occur: thread stacks, and alternate signal stacks.  Those are handled<br>
in clever ways.<br>
When a system call happens, we check if the stack-pointer register points to such a page.  If it doesn&#39;t, the program is killed.  We have tightened the ABI.  You may no longer point your stack register at non-stack memory.  You&#39;ll be killed.  This checking code is MI, so it works for all platforms.</p>
</blockquote>

<ul>
<li>For more detail, see <a href="https://marc.info/?l=openbsd-tech&m=152035796722258&w=2" rel="nofollow">Theo&#39;s original message</a>.</li>
</ul>

<blockquote>
<p>This is now available in snapshots, and people are finding the first problems in the ports tree already. So far, few issues have been uncovered, but as Theo points out, more testing is necessary:</p>

<p>Fairly good results.<br>
A total of 4 problems have been found so far.  go, SBCL, and two cases in src/regress which failed the new page-alignment requirement.  The SBCL and go ones were found at buildtime, since they use themselves to complete build.<br>
But more page-alignment violations may be found in ports at runtime.<br>
This is something I worry about a bit.  So please everyone out there can help: Use snapshots which contain the stack-check diff, update to new packages, and test all possible packages.  Really need a lot of testing for this, so please help out.</p>

<p>So, everybody, install the latest snapshot and try all your favorite ports. This is the time to report issues you find, so there is a good chance this additional security feature is present in 6.3 (and works with third party software from packages).</p>
</blockquote>

<hr>

<h3><a href="https://freeshell.de/%7Emk/projects/nomadbsd.html" rel="nofollow">NomadBSD 1.0 has been released</a></h3>

<ul>
<li>NomadBSD is a live system for flash drives, based on FreeBSD® 11.1 (amd64)</li>
<li>Change Log

<ul>
<li>The setup process has been improved.</li>
<li>Support for optional geli encryption of the home partition has been added</li>
<li>Auto-detection of NVIDIA graphics cards and their corresponding driver has been added.  (Thanks to holgerw and lme from BSDForen.de)</li>
<li>An rc script to start the GEOM disk scheduler on the root device has been added.</li>
</ul></li>
<li>More software has been added:

<ul>
<li>accessibility/redshift (starts automatically)</li>
<li>audio/cantata</li>
<li>audio/musicpd</li>
<li>audio/ncmpc</li>
<li>ftp/filezilla</li>
<li>games/bsdtris</li>
<li>mail/neomutt</li>
<li>math/galculator</li>
<li>net-p2p/transmission-qt5</li>
<li>security/fpm2</li>
<li>sysutils/bsdstats</li>
<li>x11/metalock</li>
<li>x11/xbindkeys</li>
<li>Several smaller improvements and bugfixes.</li>
</ul></li>
<li>Screenshots

<ul>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss1.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss1.png</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss2.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss2.png</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss3.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss3.png</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss4.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss4.png</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss5.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss5.png</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss6.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss6.png</a></li>
</ul></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://knoxbug.org/2018-03-27" rel="nofollow">KnoxBug - Nagios</a></li>
<li><a href="https://www.youtube.com/playlist?list=PLfJr0tWo35bc9FG_reSki2S5S0G8imqB4" rel="nofollow">vBSDcon videos landing</a></li>
<li><a href="https://www.youtube.com/playlist?list=PLnTFqpZk5ebBTyXedudGm6CwedJGsE2Py" rel="nofollow">AsiaBSDCon 2017 videos</a></li>
<li><a href="https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-Ptr-Restrict" rel="nofollow">DragonFlyBSD Adds New &quot;Ptr_Restrict&quot; Security Option</a></li>
<li><a href="https://twitter.com/michaeldexter/status/975603855407788032" rel="nofollow">A Dexter needs your help</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180309064801" rel="nofollow">Mike Larkin at bhyvecon 2018: OpenBSD vmm(4) update</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-arch/2018-March/018900.html" rel="nofollow">[HEADS UP] - OFED/RDMA stack update</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Ron - <a href="http://dpaste.com/3BM6GSW#wrap" rel="nofollow">Interview someone using DragonflyBSD</a></li>
<li>Brad - <a href="http://dpaste.com/3X4ZZK2#wrap" rel="nofollow">Gaming and all</a></li>
<li>Mohammad - <a href="http://dpaste.com/0PJMKRD#wrap" rel="nofollow">Sockets vs TCP</a></li>
<li>Paul - <a href="http://dpaste.com/2WXVR1X#wrap" rel="nofollow">All or at least most of Bryan Cantrill&#39;s Talks</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Looking at Lumina Desktop 2.0, 2 months of KPTI development in SmartOS, OpenBSD email service, an interview with Ryan Zezeski, NomadBSD released, and John Carmack&#39;s programming retreat with OpenBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.trueos.org/blog/looking-lumina-desktop-2-0/" rel="nofollow">Looking at Lumina Desktop 2.0</a></h3>

<blockquote>
<p>A few weeks ago I sat down with Lead Developer Ken Moore of the TrueOS Project to get answers to some of the most frequently asked questions about Lumina Desktop from the open source community. Here is what he said on Lumina Desktop 2.0.  Do you have a question for Ken and the rest of the team over at the TrueOS Project? Make sure to read the interview and comment below. We are glad to answer your questions!</p>

<p>Ken: Lumina Desktop 2.0 is a significant overhaul compared to Lumina 1.x. Almost every single subsystem of the desktop has been streamlined, resulting in a nearly-total conversion in many important areas.</p>

<p>With Lumina Desktop 2.0 we will finally achieve our long-term goal of turning Lumina into a complete, end-to-end management system for the graphical session and removing all the current runtime dependencies from Lumina 1.x (Fluxbox, xscreensaver, compton/xcompmgr). The functionality from those utilities is now provided by Lumina Desktop itself.</p>

<p>Going along with the session management changes, we have compressed the entire desktop into a single, multi-threaded binary. This means that if any rogue script or tool starts trying to muck about with the memory used by the desktop (probably even more relevant now than when we started working on this), the entire desktop session will close/crash rather than allowing targeted application crashes to bypass the session security mechanisms. By the same token, this also prevents man-in-the-middle type of attacks because the desktop does not use any sort of external messaging system to communicate (looking at you <code>dbus</code>). This also gives a large performance boost to Lumina Desktop</p>

<p>The entire system for how a users settings get saved and loaded has been completely redone, making it a layered settings system which allows the default settings (Lumina) to get transparently replaced by system settings (OS/Distributor/SysAdmin) which can get replaced by individual user settings. This results in the actual changes in the user setting files to be kept to a minimum and allows for a smooth transition between updates to the OS or Desktop. This also provides the ability to restrict a users desktop session (based on a system config file) to the default system settings and read-only user sessions for certain business applications.</p>

<p>The entire graphical interface has been written in QML in order to fully-utilize hardware-based GPU acceleration with OpenGL while the backend logic and management systems are still written entirely in C++. This results in blazing fast performance on the backend systems (myriad multi-threaded C++ objects) as well as a smooth and responsive graphical interface with all the bells and whistles (drag and drop, compositing, shading, etc).</p>
</blockquote>

<ul>
<li>Q: Are there future plans to implement something like Lumina in a MAC Jail?</li>
</ul>

<blockquote>
<p>While I have never tried out Lumina in a MAC jail, I do not see anything on that page which should stop it from running in one right now. Lumina is already designed to be run as an unpriviledged user and is very smart about probing the system to find out what is/not available before showing anything to the user. The only thing that comes to mind is that you might need to open up some other system devices so that X11 itself can draw to the display (graphical environment setup is a bit different than CLI environment).</p>
</blockquote>

<ul>
<li>Q: I look forward to these changes. I know the last time I used it when I would scroll I would get flashes like the refresh rate was not high enough. It will be nice to have a fast system as well as I know with the more changes Linux is becoming slower. Not once it has loaded but in the loading process. I will do another download when these changes come out and install again and maybe stay this time.</li>
</ul>

<blockquote>
<p>If I recall correctly, one of the very first versions of Lumina (pre-1.0) would occasionally flicker. If that is still happening, you might want to verify that you are using the proper video driver for your hardware and/or enable the compositor within the Lumina settings.</p>
</blockquote>

<ul>
<li>Q: Why was enlightenment project not considered for TrueOS? It is BSD licensed and is written in C.</li>
</ul>

<blockquote>
<p>This was a common question about 4(?) years ago with the first release of the Lumina desktop and it basically boiled down to long-term support and reliability of the underlying toolkit. Some of the things we had to consider were: cross-platform/cross-architecture support, dependency reliability and support framework (Qt5 &gt; EFL), and runtime requirements and dependency tracking (Qt5 is lighter than the EFL). That plus the fact that the EFL specifically states that it is linux-focused and the BSDs are just an afterthought (especially at the time we were doing the evaluation).</p>
</blockquote>

<ul>
<li>Q: I have two questions.

<ul>
<li>1) The default layout of Unity(menu bar with actual menu entries on top and icon dock on the side) is one of the few things I liked about my first voyage into non-Windows systems, and have been missing since moving on to other distros(and now also other non-Linux systems). However in 1.4.0 screenshots on Luminas site, the OSX-like layout has the menu attached to the window. Will 2.0 be able to have the menus on the bar?</li>
<li>2) Is there any timeline for a public release, or are you taking a when its ready approach?</li>
</ul></li>
</ul>

<blockquote>
<ol>
<li>In Lumina you can already put panels on the left/right side of the screen and give you something like the layout of the Unity desktop. The embedded menu system is not available in Lumina because that is not a specification supported by X11 and the window manager standards at the present time. The way that functionality is currently run on Linux is a hacky-bypass of the display system which only really works with the GTK3 and Qt5 toolkits, resulting in very odd overall desktop behavior in mixed environments where some apps use other graphical toolkits.</li>
<li>We are targetting the 18.06 STABLE release of TrueOS for Lumina 2, but that is just a guideline and if necessary we will push back the release date to allow for additional testing/fixing as needed.</li>
</ol>
</blockquote>

<hr>

<h3><a href="https://blog.cooperi.net/a-long-two-months" rel="nofollow">A long two months</a></h3>

<ul>
<li>IllumOS/SmartOS developer Alex Wilson describes the journey of developing KPTI for IllumOS
&gt; On Monday (January 1st) I had the day off work for New Year&#39;s day, as is usual in most of the western world, so I slept in late. Lou and her friend decided to go to the wax museum and see several tourist attractions around SF, and I decided to pass the day at home reading. That afternoon, work chat started talking about a Tumblr post by pythonsweetness about an Intel hardware security bug. At the time I definitely did not suspect that this was going to occupy most of my working life for the next (almost) two months.</li>
</ul>

<blockquote>
<p>Like many people who work on system security, I had read Anders Fogh&#39;s post about a &quot;Negative Result&quot; in speculative execution research in July of 2017. At the time I thought it was an interesting writeup and I remember being glad that researchers were looking into this area. I sent the post to Bryan and asked him about his thoughts on it at the time, to which he replied saying that &quot;it would be shocking if they left a way to directly leak out memory in the speculative execution&quot;. None of us seriously thought that there would be low-hanging fruit down that research path, but we also felt it was important that there was someone doing work in the area who was committed to public disclosure.</p>

<p>At first, after reading the blog post on Monday, we thought (or hoped) that the bug might &quot;just&quot; be a KASLR bypass and wouldn&#39;t require a lot of urgency. We tried to reach out to Intel at work to get more information but were met with silence. (We wouldn&#39;t hear back from them until after the disclosure was already made public.) The speculation on Tuesday intensified, until finally on Wednesday morning I arrived at the office to find links to late Tuesday night tweets revealing exploits that allowed arbitrary kernel memory reads.</p>

<p>Wednesday was not a happy day. Intel finally responded to our emails -- after they had already initiated public disclosure. We all spent a lot of time reading. An arbitrary kernel memory read (an info leak) is not that uncommon as far as bugs go, but for the most part they tend to be fairly easy to fix. The thing that makes the Meltdown and Spectre bugs particularly notable is that in order to mitigate them, a large amount of change is required in very deep low-level parts of the kernel. The kind of deep parts of the kernel where there are 20-year old errata workarounds that were single-line changes that you have to be very careful to not accidentally undo; the kind of parts where, as they say, mortals fear to tread.</p>

<p>On Friday we saw the patches Matthew Dillon put together for DragonFlyBSD for the first time. These were the first patches for KPTI that were very straightforward to read and understand, and applied to a BSD-derived kernel that was similar to those I&#39;m accustomed to working on.</p>

<p>To mitigate Meltdown (and partially one of the Spectre variants), you have to make sure that speculative execution cannot reach any sensitive data from a user context. This basically means that the pages the kernel uses for anything potentially sensitive have to be unmapped when we are running user code. Traditionally, CPUs that were built to run a multi-user, UNIX-like OS did this by default (SPARC is an example of such a CPU which has completely separate address spaces for the kernel and userland). However, x86 descends from a single-address-space microcontroller that has grown up avoiding backwards-incompatible changes, and has never really introduced a clean notion of multiple address spaces (segmentation is the closest feature really, and it was thrown out for 64-bit AMD64). Instead, operating systems for x86 have generally wound up (at least in the post-AMD64 era) with flat address space models where the kernel text and data is always present in the page table no matter whether you&#39;re in user or kernel mode. The kernel mappings simply have the &quot;supervisor&quot; bit set on them so that user code can&#39;t directly access them.</p>

<p>The mitigation is basically to stop doing this: to stop mapping the kernel text, data and other memory into the page table while we&#39;re running in userland. Unfortunately, the x86 design does not make this easy. In order to be able to take interrupts or traps, the CPU has to have a number of structures mapped in the current page table at all times. There is also no ability to tell an x86 CPU that you want it to switch page tables when an interrupt occurs. So, the code that we jump to when we take an interrupt, as well as space for a stack to push context onto have to be available in both page tables. And finally, of course, we need to be able to figure out somehow what the other page table we should switch to is when we enter the kernel.</p>

<p>When we looked at the patches for Linux (and also the DragonFlyBSD patches at the time) on Friday and started asking questions, it became pretty evident that the initial work done by both was done under time constraints. Both had left the full kernel text mapped in both page tables, and the Linux trampoline design seemed over-complex. I started talking over some ideas with Robert Mustacchi about ways to fix these and who we should talk to, and reached out to some of my old workmates from the University of Queensland who were involved with OpenBSD. It seemed to me that the OpenBSD developers would care about these issues even more than we did, and would want to work out how to do the mitigation right.</p>

<p>I ended up sending an email to Philip Guenther on Friday afternoon, and on Saturday morning I drove an hour or so to meet up with him for coffee to talk page tables and interrupt trampolines. We wound up spending a good 6 hours at the coffee shop, and I came back with several pages of notes and a half-decent idea of the shape of the work to come.</p>

<p>One detail we missed that day was the interaction of per-CPU structures with per-process page tables. Much of the interrupt trampoline work is most easily done by using per-CPU structures in memory (and you definitely want a per-CPU stack!). If you combine that with per-process page tables, however, you have a problem: if you leave all the per-CPU areas mapped in all the processes, you will leak information (via Meltdown) about the state of one process to a different one when taking interrupts. In particular, you will leak things like %rip, which ruins all the work being done with PIE and ASLR pretty quickly. So, there are two options: you can either allocate the per-CPU structures per-process (so you end up with $NCPUS * $NPROCS of them); or you can make the page tables per-CPU.</p>

<p>OpenBSD, like Linux and the other implementations so far, decided to go down the road of per-CPU per-process pages to solve this issue. For illumos, we took the other route.</p>

<p>In illumos, it turned out that we already had per-CPU page tables. Robert and I re-discovered this on the Sunday of that week. We use them for 32-bit processes due to having full P&gt;V PAE support in our kernel (which is, as it turns out, relatively uncommon amongst open-source OS). The logic to deal with creating and managing them and updating them was all already written, and after reading the code we concluded we could basically make a few small changes and re-use all of it. So we did.</p>

<p>By the end of that second week, we had a prototype that could get to userland. But, when working on this kind of kernel change we have a rule of thumb we use: after the first 70% of the patch is done and we can boot again, now it&#39;s time for the second 70%. In fact it turned out to be more like the second 200% for us -- a tedious long tail of bugs to solve that ended up necessitating some changes in the design as well.</p>

<p>At first we borrowed the method that Matt Dillon used for DragonFlyBSD, by putting the temporary &quot;stack&quot; space and state data for the interrupt trampolines into an extra page tacked onto the end of *%gs (in illumos the structure that lives there is the cpu_t). </p>

<p>If you read the existing logic in interrupt handlers for dealing with %gs though, you will quickly notice that the corner cases start to build up. There are a bunch of situations where the kernel temporarily alters %gs, and some of the ways to mess it up have security consequences that end up being worse than the bug we&#39;re trying to fix. As it turns out, there are no less than 3 different ways that ISRs use to try to get to having the right cpu_t in %gs on illumos, as it turns out, and they are all subtly different. Trying to tell which you should use when requires a bunch of test logic that in turn requires branches and changes to the CPU state, which is difficult to do in a trampoline where you&#39;re trying to avoid altering that state as much as possible until you&#39;ve got the real stack online to push things into.</p>

<p>I kept in touch with Philip Guenther and Mike Larkin from the OpenBSD project throughout the weeks that followed. In one of the discussions we had, we talked about the NMI/MCE handlers and the fact that their handling currently on OpenBSD neglected some nasty corner-cases around interrupting an existing trap handler. A big part of the solution to those issues was to use a feature called IST, which allows you to unconditionally change stacks when you take an interrupt.</p>

<p>Traditionally, x86 only changes the stack pointer (%rsp on AMD64) while taking an interrupt when there is a privilege level change. If you take an interrupt while already in the kernel, the CPU does not change the stack pointer, and simply pushes the interrupt stack frame onto the stack you&#39;re already using. IST makes the change of stack pointer unconditional. If used unwisely, this is a bad idea: if you stay on that stack and turn interrupts back on, you could take another interrupt and clobber the frame you&#39;re already in. However, in it I saw a possible way to simplify the KPTI trampoline logic and avoid having to deal with %gs.</p>

<p>A few weeks into the project, John Levon joined us at work. He had previously worked on a bunch of Xen-related stuff as well as other parts of the kernel very close to where we were, so he quickly got up to speed with the KPTI work as well. He and I drafted out a &quot;crazy idea&quot; on the whiteboard one afternoon where we would use IST for all interrupts on the system, and put the &quot;stack&quot; they used in the KPTI page on the end of the cpu_t. Then, they could easily use stack-relative addresses to get the page table to change to, then pivot their stack to the real kernel stack memory, and throw away (almost) all the conditional logic. A few days later, we had convinced each other that this was the way to go.</p>

<p>Two of the most annoying x86 issues we had to work around were related to the SYSENTER instruction. This instruction is used to make &quot;fast&quot; system calls in 32-bit userland. It has a couple of unfortunate properties: firstly, it doesn&#39;t save or restore RFLAGS, so the kernel code has to take care of this (and be very careful not to clobber any of it before saving or after restoring it). Secondly, if you execute SYSENTER with the TF (&quot;trap&quot;/single-step flag) set by a debugger, the resulting debug trap&#39;s frame points at kernel code instead of the user code where it actually happened. The first one requires some careful gymnastics on the entry and return trampolines specifically for SYSENTER, while the second is a nasty case that is incidentally made easier by using IST. With IST, we can simply make the debug trap trampoline check for whether we took the trap in another trampoline&#39;s code, and reset %cr3 and the destination stack. This works for single-stepping into any of the handlers, not just the one for SYSENTER.</p>

<p>To make debugging easier, we decided that traps like the debug/single-step trap (as well as faults like page faults, #GP, etc.) would push their interrupt frame in a different part of the KPTI state page to normal interrupts. We applied this change to all the traps that can interrupt another trampoline (based on the instructions we used). These &quot;paranoid&quot; traps also set a flag in the KPTI struct to mark it busy (and jump to the double-fault handler if it is), to work around some bugs where double-faults are not correctly generated.</p>

<p>It&#39;s been a long and busy two months, with lots of time spent building, testing, and validating the code. We&#39;ve run it on as many kinds of machines as we could get our hands on, to try to make sure we catch issues. The time we&#39;ve spent on this has been validated several times in the process by finding bugs that could have been nasty in production.</p>

<p>One great example: our patches on Westmere-EP Xeons were causing busy machines to throw a lot of L0 I-cache parity errors. This seemed very mysterious at first, and it took us a few times seeing it to believe that it was actually our fault. This was actually caused by the accidental activation of a CPU errata for Westmere (B52, &quot;Memory Aliasing of Code Pages May Cause Unpredictable System Behaviour&quot;) -- it turned out we had made a typo and put the &quot;cacheable&quot; flag into a variable named flags instead of attrs where it belonged when setting up the page tables. This was causing performance degradation on other machines, but on Westmere it causes cache parity errors as well. This is a great example of the surprising consequences that small mistakes in this kind of code can end up having. In the end, I&#39;m glad that that erratum existed, otherwise it may have been a long time before we caught that bug.</p>

<p>As of this week, Mike and Philip have committed the OpenBSD patches for KPTI to their repository, and the patches for illumos are out for review. It&#39;s a nice kind of symmetry that the two projects who started on the work together after the public disclosure at the same time are both almost ready to ship at the same time at the other end. I&#39;m feeling hopeful, and looking forward to further future collaborations like this with our cousins, the BSDs.</p>
</blockquote>

<ul>
<li>The IllumOS work has since landed, on <a href="https://github.com/joyent/illumos-joyent/commit/d85fbfe15cf9925f83722b6d62da49d549af615c" rel="nofollow">March 12th</a>
***</li>
</ul>

<h3><a href="https://github.com/vedetta-com/caesonia" rel="nofollow">OpenBSD Email Service</a></h3>

<ul>
<li>Features

<ul>
<li>Efficient: configured to run on min. 512MB RAM and 20GB SSD, a KVM (cloud) VPS for around $2.50/mo</li>
<li>15GB+ uncompressed Maildir, rivals top free-email providers (grow by upgrading SSD)</li>
<li>Email messages are gzip compressed, at least 1/3 more space with level 6 default</li>
<li>Server side full text search (headers and body) can be enabled (to use the extra space)</li>
<li>Mobile data friendly: IMAPS connections are compressed</li>
<li>Subaddress (+tag) support, to filter and monitor email addresses</li>
<li>Virtual domains, aliases, and credentials in files, Berkeley DB, or SQLite3</li>
<li>Naive Bayes rspamd filtering with supervised learning: the lowest false positive spam detection rates</li>
<li>Carefree automated Spam/ and Trash/ cleaning service (default: older than 30 days)</li>
<li>Automated quota management, gently assists when over quota</li>
<li>Easy backup MX setup: using the same configuration, install in minutes on a different host</li>
<li>Worry-free automated master/master replication with backup MX, prevents accidental loss of email messages</li>
<li>Resilient: the backup MX can be used as primary, even when the primary is not down, both perfect replicas</li>
<li>Flexible: switching roles is easy, making the process of changing VPS hosts a breeze (no downtime)</li>
<li>DMARC (with DKIM and SPF) email-validation system, to detect and prevent email spoofing</li>
<li>Daily (spartan) stats, to keep track of things</li>
<li>Your sieve scripts and managesieve configuration, let&#39;s get started</li>
</ul></li>
<li>Considerations</li>
</ul>

<blockquote>
<p>By design, email message headers need to be public, for exchanges to happen. The body of the message can be encrypted by the user, if desired. Moreover, there is no way to prevent the host from having access to the virtual machine. Therefore, full disk encryption (at rest) may not be necessary.</p>

<p>Given our low memory requirements, and the single-purpose concept of email service, Roundcube or other web-based IMAP email clients should be on a different VPS.</p>

<p>Antivirus software users (usually) have the service running on their devices. ClamAV can easily be incorporated into this configuration, if affected by the types of malware it protects against, but will require around 1GB additional RAM (or another VPS).</p>

<p>Every email message is important, if properly delivered, for Bayes classification. At least 200 ham and 200 spam messages are required to learn what one considers junk. By default (change to use case), a rspamd score above 50% will send the message to Spam/. Moving messages in and out of Spam/ changes this score. After 95%, the message is flagged as &quot;seen&quot; and can be safely ignored.</p>

<p>Spamd is effective at greylisting and stopping high volume spam, if it becomes a problem. It will be an option when IPv6 is supported, along with bgp-spamd.</p>

<p>System mail is delivered to an alias mapped to a virtual user served by the service. This way, messages are guaranteed to be delivered via encrypted connection. It is not possible for real users to alias, nor mail an external mail address with the default configuration. e.g. <a href="mailto:puffy@mercury.example.com" rel="nofollow">puffy@mercury.example.com</a> is wheel, with an alias mapped to (virtual) <a href="mailto:puffy@example.com" rel="nofollow">puffy@example.com</a>, and user (puffy) can be different for each.</p>

<hr>
</blockquote>

<h2>Interview - Ryan Zezeski - <a href="mailto:rpz@joyent.com" rel="nofollow">rpz@joyent.com</a> / <a href="https://twitter.com/rzezeski" rel="nofollow">@rzezeski</a></h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.facebook.com/permalink.php?story_fbid=2110408722526967&id=100006735798590" rel="nofollow">John Carmack&#39;s programming retreat to hermit coding with OpenBSD</a></h3>

<blockquote>
<p>After a several year gap, I finally took another week-long programming retreat, where I could work in hermit mode, away from the normal press of work. My wife has been generously offering it to me the last few years, but Im generally bad at taking vacations from work.<br>
As a change of pace from my current Oculus work, I wanted to write some from-scratch-in-C++ neural network implementations, and I wanted to do it with a strictly base OpenBSD system. Someone remarked that is a pretty random pairing, but it worked out ok.<br>
Despite not having actually used it, I have always been fond of the idea of OpenBSD  a relatively minimal and opinionated system with a cohesive vision and an emphasis on quality and craftsmanship. Linux is a lot of things, but cohesive isnt one of them.<br>
Im not a Unix geek. I get around ok, but I am most comfortable developing in Visual Studio on Windows. I thought a week of full immersion work in the old school Unix style would be interesting, even if it meant working at a slower pace. It was sort of an adventure in retro computing  this was fvwm and vi. Not vim, actual BSD vi.<br>
In the end, I didnt really explore the system all that much, with 95% of my time in just the basic vi / make / gdb operations. I appreciated the good man pages, as I tried to do everything within the self contained system, without resorting to internet searches. Seeing references to 30+ year old things like Tektronix terminals was amusing.<br>
I was a little surprised that the C++ support wasnt very good. G++ didnt support C++11, and LLVM C++ didnt play nicely with gdb. Gdb crashed on me a lot as well, I suspect due to C++ issues. I know you can get more recent versions through ports, but I stuck with using the base system.<br>
In hindsight, I should have just gone full retro and done everything in ANSI C. I do have plenty of days where, like many older programmers, I think Maybe C++ isnt as much of a net positive as we assume.... There is still much that I like, but it isnt a hardship for me to build small projects in plain C.<br>
Maybe next time I do this I will try to go full emacs, another major culture that I dont have much exposure to.<br>
I have a decent overview understanding of most machine learning algorithms, and I have done some linear classifier and decision tree work, but for some reason I have avoided neural networks. On some level, I suspect that Deep Learning being so trendy tweaked a little bit of contrarian in me, and I still have a little bit of a reflexive bias against throw everything at the NN and let it sort it out!<br>
In the spirit of my retro theme, I had printed out several of Yann LeCuns old papers and was considering doing everything completely off line, as if I was actually in a mountain cabin somewhere, but I wound up watching a lot of the Stanford CS231N lectures on YouTube, and found them really valuable. Watching lecture videos is something that I very rarely do  it is normally hard for me to feel the time is justified, but on retreat it was great!<br>
I dont think I have anything particularly insightful to add about neural networks, but it was a very productive week for me, solidifying book knowledge into real experience.<br>
I used a common pattern for me: get first results with hacky code, then write a brand new and clean implementation with the lessons learned, so they both exist and can be cross checked.<br>
I initially got backprop wrong both times, comparison with numerical differentiation was critical! It is interesting that things still train even when various parts are pretty wrong  as long as the sign is right most of the time, progress is often made.<br>
I was pretty happy with my multi-layer neural net code; it wound up in a form that I can just drop it into future efforts. Yes, for anything serious I should use an established library, but there are a lot of times when just having a single .cpp and .h file that you wrote ever line of is convenient.<br>
My conv net code just got to the hacky but working phase, I could have used another day or two to make a clean and flexible implementation.<br>
One thing I found interesting was that when testing on MNIST with my initial NN before adding any convolutions, I was getting significantly better results than the non-convolutional NN reported for comparison in LeCun 98  right around 2% error on the test set with a single 100 node hidden layer, versus 3% for both wider and deeper nets back then. I attribute this to the modern best practices ReLU, Softmax, and better initialization.<br>
This is one of the most fascinating things about NN work  it is all so simple, and the breakthrough advances are often things that can be expressed with just a few lines of code. It feels like there are some similarities with ray tracing in the graphics world, where you can implement a physically based light transport ray tracer quite quickly, and produce state of the art images if you have the data and enough runtime patience.<br>
I got a much better gut-level understanding of overtraining / generalization / regularization by exploring a bunch of training parameters. On the last night before I had to head home, I froze the architecture and just played with hyperparameters. Training! Is definitely worse than Compiling! for staying focused.<br>
Now I get to keep my eyes open for a work opportunity to use the new skills!<br>
I am dreading what my email and workspace are going to look like when I get into the office tomorrow.</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180310000858" rel="nofollow">Stack-register Checking</a></h3>

<blockquote>
<p>Recently, Theo de Raadt (deraadt@) described a new type of mitigation he has been working on together with Stefan Kempf (stefan@):<br>
How about we add another new permission!  This is not a hardware permission, but a software permission.  It is opportunistically enforced by the kernel.<br>
The permission is MAP_STACK.  If you want to use memory as a stack, you must mmap it with that flag bit.  The kernel does so automatically for the stack region of a process&#39;s stack.  Two other types of stack occur: thread stacks, and alternate signal stacks.  Those are handled<br>
in clever ways.<br>
When a system call happens, we check if the stack-pointer register points to such a page.  If it doesn&#39;t, the program is killed.  We have tightened the ABI.  You may no longer point your stack register at non-stack memory.  You&#39;ll be killed.  This checking code is MI, so it works for all platforms.</p>
</blockquote>

<ul>
<li>For more detail, see <a href="https://marc.info/?l=openbsd-tech&m=152035796722258&w=2" rel="nofollow">Theo&#39;s original message</a>.</li>
</ul>

<blockquote>
<p>This is now available in snapshots, and people are finding the first problems in the ports tree already. So far, few issues have been uncovered, but as Theo points out, more testing is necessary:</p>

<p>Fairly good results.<br>
A total of 4 problems have been found so far.  go, SBCL, and two cases in src/regress which failed the new page-alignment requirement.  The SBCL and go ones were found at buildtime, since they use themselves to complete build.<br>
But more page-alignment violations may be found in ports at runtime.<br>
This is something I worry about a bit.  So please everyone out there can help: Use snapshots which contain the stack-check diff, update to new packages, and test all possible packages.  Really need a lot of testing for this, so please help out.</p>

<p>So, everybody, install the latest snapshot and try all your favorite ports. This is the time to report issues you find, so there is a good chance this additional security feature is present in 6.3 (and works with third party software from packages).</p>
</blockquote>

<hr>

<h3><a href="https://freeshell.de/%7Emk/projects/nomadbsd.html" rel="nofollow">NomadBSD 1.0 has been released</a></h3>

<ul>
<li>NomadBSD is a live system for flash drives, based on FreeBSD® 11.1 (amd64)</li>
<li>Change Log

<ul>
<li>The setup process has been improved.</li>
<li>Support for optional geli encryption of the home partition has been added</li>
<li>Auto-detection of NVIDIA graphics cards and their corresponding driver has been added.  (Thanks to holgerw and lme from BSDForen.de)</li>
<li>An rc script to start the GEOM disk scheduler on the root device has been added.</li>
</ul></li>
<li>More software has been added:

<ul>
<li>accessibility/redshift (starts automatically)</li>
<li>audio/cantata</li>
<li>audio/musicpd</li>
<li>audio/ncmpc</li>
<li>ftp/filezilla</li>
<li>games/bsdtris</li>
<li>mail/neomutt</li>
<li>math/galculator</li>
<li>net-p2p/transmission-qt5</li>
<li>security/fpm2</li>
<li>sysutils/bsdstats</li>
<li>x11/metalock</li>
<li>x11/xbindkeys</li>
<li>Several smaller improvements and bugfixes.</li>
</ul></li>
<li>Screenshots

<ul>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss1.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss1.png</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss2.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss2.png</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss3.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss3.png</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss4.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss4.png</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss5.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss5.png</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/nomadbsd-ss6.png" rel="nofollow">https://freeshell.de/~mk/projects/nomadbsd-ss6.png</a></li>
</ul></li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://knoxbug.org/2018-03-27" rel="nofollow">KnoxBug - Nagios</a></li>
<li><a href="https://www.youtube.com/playlist?list=PLfJr0tWo35bc9FG_reSki2S5S0G8imqB4" rel="nofollow">vBSDcon videos landing</a></li>
<li><a href="https://www.youtube.com/playlist?list=PLnTFqpZk5ebBTyXedudGm6CwedJGsE2Py" rel="nofollow">AsiaBSDCon 2017 videos</a></li>
<li><a href="https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-Ptr-Restrict" rel="nofollow">DragonFlyBSD Adds New &quot;Ptr_Restrict&quot; Security Option</a></li>
<li><a href="https://twitter.com/michaeldexter/status/975603855407788032" rel="nofollow">A Dexter needs your help</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180309064801" rel="nofollow">Mike Larkin at bhyvecon 2018: OpenBSD vmm(4) update</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-arch/2018-March/018900.html" rel="nofollow">[HEADS UP] - OFED/RDMA stack update</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Ron - <a href="http://dpaste.com/3BM6GSW#wrap" rel="nofollow">Interview someone using DragonflyBSD</a></li>
<li>Brad - <a href="http://dpaste.com/3X4ZZK2#wrap" rel="nofollow">Gaming and all</a></li>
<li>Mohammad - <a href="http://dpaste.com/0PJMKRD#wrap" rel="nofollow">Sockets vs TCP</a></li>
<li>Paul - <a href="http://dpaste.com/2WXVR1X#wrap" rel="nofollow">All or at least most of Bryan Cantrill&#39;s Talks</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>237: AsiaBSDcon 2018</title>
  <link>https://www.bsdnow.tv/237</link>
  <guid isPermaLink="false">b77208bf-14b6-4644-bbca-40bc1ff1e594</guid>
  <pubDate>Wed, 14 Mar 2018 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b77208bf-14b6-4644-bbca-40bc1ff1e594.mp3" length="71307220" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>AsiaBSDcon review, Meltdown and Spectre Patches in FreeBSD stable, Interview with MidnightBSD founder, 8 months with TrueOS, mysteries of GNU and BSD split</itunes:subtitle>
  <itunes:duration>1:39:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>AsiaBSDcon review, Meltdown and Spectre Patches in FreeBSD stable, Interview with MidnightBSD founder, 8 months with TrueOS, mysteries of GNU and BSD split
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
AsiaBSDCon 2018 has concluded (https://2018.asiabsdcon.org/)
We have just returned from AsiaBSDCon in Tokyo, Japan last weekend
Please excuse our jetlag
The conference consisted two days of meeting followed by 2 days of paper presentations
We arrived a few days early to see some sights and take a few extra delicious meals in Tokyo
The first day of meetings was a FreeBSD developer summit (while Benedict was teaching his two tutorials) where we discussed the FreeBSD release cycle and our thoughts on improving it, the new Casper capsicum helper service, and developments in SDIO which will eventually enable WiFi and SD card readers on more embedded devices
The second day of meetings consisted of bhyvecon, a miniconf that covered development in all hypervisors on all BSDs. It also included presentations on the porting of bhyve to IllumOS.
Then the conference started
There were a number of great presentations, plus an amazing hallway track as usual
It was great to see many old friends and to spend time discussing the latest happenings in BSD. A couple of people came by and asked to take a picture with us and we were happy to do that.
***
FreeBSD releases Spectre and Meltdown mitigations for 11.1 (https://www.freebsd.org/security/advisories/FreeBSD-SA-18:03.speculative_execution.asc)
Speculative execution vulnerability mitigation is a work in progress.  This advisory addresses the most significant issues for FreeBSD 11.1 on amd64 CPUs.  We expect to update this advisory to include 10.x for amd64 CPUs.  Future FreeBSD releases will address this issue on i386 and other CPUs.  freebsd-update will include changes on i386 as part of this update due to common code changes shared between amd64 and i386, however it contains no functional changes for i386 (in particular, it does not mitigate the issue on i386).
Many modern processors have implementation issues that allow unprivileged attackers to bypass user-kernel or inter-process memory access restrictions by exploiting speculative execution and shared resources (for example, caches).
An attacker may be able to read secret data from the kernel or from a process when executing untrusted code (for example, in a web browser).
+ Meltdown:
The mitigation is known as Page Table Isolation (PTI).  PTI largely separates kernel and user mode page tables, so that even during speculative execution most of the kernel's data is unmapped and not accessible.
A demonstration of the Meltdown vulnerability is available at https://github.com/dag-erling/meltdown.  A positive result is definitive (that is, the vulnerability exists with certainty).  A negative result indicates either that the CPU is not affected, or that the test is not capable of demonstrating the issue on the CPU (and may need to be modified).
A patched kernel will automatically enable PTI on Intel CPUs.  The status can be checked via the vm.pmap.pti sysctl 
PTI introduces a performance regression.  The observed performance loss is significant in microbenchmarks of system call overhead, but is much smaller for many real workloads.
+ Spectre V2:
There are two common mitigations for Spectre V2.  This patch includes a mitigation using Indirect Branch Restricted Speculation, a feature available via a microcode update from processor manufacturers.  The alternate mitigation, Retpoline, is a feature available in newer compilers.  The feasibility of applying Retpoline to stable branches and/or releases is under
investigation.
The patch includes the IBRS mitigation for Spectre V2.  To use the mitigation the system must have an updated microcode; with older microcode a patched kernel will function without the mitigation.
IBRS can be disabled via the hw.ibrsdisable sysctl (and tunable), and the status can be checked via the hw.ibrsactive sysctl.  IBRS may be enabled or disabled at runtime.  Additional detail on microcode updates will follow.
+ Wiki tracking the vulnerabilities and mitigations on different platforms (https://wiki.freebsd.org/SpeculativeExecutionVulnerabilities)
Interview with MidnightBSD Founder and Lead Dev Lucas Holt (https://itsfoss.com/midnightbsd-founder-lucas-holt/)
Recently, I have taken a little dip into the world of BSD. As part of my attempt to understand the BSD world a little better, I connected with Lucas Holt (MidnightBSD founder and lead developer) to ask him a few questions about his project. Here are his answers.
It’s FOSS: Please explain MidnightBSD in a nutshell. How is it different than other BSDs?
Lucas Holt: MidnightBSD is a desktop focused operating system. When it’s considered stable, it will provide a full desktop experience. This differs from other efforts such as TrueOS or GhostBSD in that it’s not a distro of FreeBSD, but rather a fork. MidnightBSD has its own package manager, mport as well as unique package cluster software and several features built into user land such as mDNSresponder, libdispatch, and customizations throughout the system.
It’s FOSS: Who is MidnightBSD aimed at?
Lucas Holt: The goal with MidnightBSD has always been to provide a desktop OS that’s usable for everyday tasks and that even somewhat non technical people can use. Early versions of Mac OS X were certainly an inspiration. In practice, we’re rather far from that goal at this point, but it’s been an excellent learning opportunity.
It’s FOSS: What is your background in computers?
Lucas Holt: I started in technical support at a small ISP and moved into web design and system administration. While there, I learned BSDi, Solaris and Linux. I also started tinkering with programming web apps in ASP and a little perl CGI. I then did a mix of programming and system administration jobs through college and graduated with a bachelors in C.S. from Eastern Michigan University. During that time, I learned NetBSD and FreeBSD. I started working on several projects such as porting Apple’s HFS+ code to FreeBSD 6 and working on getting the nforce2 chipset SATA controller working with FreeBSD 6, with the latter getting committed. I got a real taste for BSD and after seeing the lack of interest in the community for desktop BSDs, I started MidnightBSD. I began work on it in late 2005.
Currently, I’m a Senior Software Engineer focusing on backend rest services by day and a part-time graduate student at the University of Michigan Flint.
It’s FOSS: I recently installed TrueOS. I was disappointed that a couple of the programs I wanted were not available. The FreeBSD port system looked mildly complicated for beginners. I’m used to using pacman to get the job done quickly. How does MidnightBSD deal with ports?
Lucas Holt: MidnightBSD has it’s own port system, mports, which shared similarities with FreeBSD ports as well as some ideas from OpenBSD. We decided early on that decent package management was essential for regular users. Power users will still use ports for certain software, but it’s just so time consuming to build everything. We started work on our own package manager, mport.
Every package is a tar lzma archive with a sqlite3 manifest file as well as a sqlite 3 index that’s downloaded from our server. This allows users to query and customize the package system with standard SQL queries. We’re also building more user friendly graphical tools.
Package availability is another issue that most BSDs have. Software tends to be written for one or two operating systems and many projects are reluctant to support other systems, particularly smaller projects like MidnightBSD. There are certainly gaps. All of the BSD projects need more volunteers to help with porting software and keeping it up to date.
It’s FOSS: During your June 2015 interview on BSDNow, you mentioned that even though you support both i386 and amd64, that you recommend people choose amd64. Do you have any plans to drop i386 support in the future, like many have done?
Lucas Holt: Yes, we do plan to drop i386 support, mostly because of the extra work needed to build and maintain packages. I’ve held off on this so far because I had a lot of feedback from users in South America that they still needed it. For now, the plan is to keep i386 support through 1.0 release. That’s probably a year or two out.
It’s FOSS: What desktop environments does MidnightBSD support?
Lucas Holt: The original plan was to use Etoile as a desktop environment, but that project changed focus. We currently support Xfce, Gnome 3, WindowMaker + GNUstep + Gworkspace as primary choices. We also have several other window managers and desktop environments available such as Enlightenment, rat poison, afterstep, etc.
Early versions offered KDE 3.x but we had some issues with KDE 4. We may revisit that with newer versions.
It’s FOSS: What is MidnightBSD’s default filesystem? Do you support DragonflyBSD’s HAMMER filesystem? What other filesystems?
Lucas Holt: Boot volumes are UFS2. We also support ZFS for additional storage. We have read support for ExFat, NTFS, ext2, CD9660. NFS v3 and v4 are also supported for network file systems.
We do not support HAMMER, although it was considered. I would love to see HAMMER2 get added to MidnightBSD eventually.
It’s FOSS: Is MidnightBSD affected by the recent Spectre and Meltdown issues?
Lucas Holt: Yes. Most operating systems were affected by these issues. We were not informed of the issue until the general public became aware. Work is ongoing to come up with appropriate mitigations. Unfortunately, we do not have a patch yet.
It’s FOSS: The Raspberry Pi and its many clones have made the ARM platform very popular. Are there any plans to make MidnightBSD available on that platform?
Lucas Holt: No immediate plans. ARM is an interesting architecture, but by the very nature of SoC designs, takes a lot of work to support a broad number of devices. It might be possible when we stop supporting i386 or if someone volunteers to work on the ARM port.
Eventually, I think most hobby systems will need to run ARM chips. Intel’s planning on locking down hardware with UEFI 3 and this may make it difficult to run on commodity hardware in the future not only for MidnightBSD but other systems as well.
At one point, MidinightBSD ran on sparc64. When workstations were killed off, we dropped support. A desktop OS on a server platform makes little sense.
It’s FOSS: Does MidnightBSD offer support for Linux applications?
Lucas Holt: Yes, we offer Linux emulation. It’s emulating a 2.6.16 kernel currently and that needs to be updated so support newer apps. It’s possible to run semi-recent versions of Firefox, Thunderbird, Java, and OpenOffice on it though. I’ve also used it to host game servers in the past and play older games such as Quake 3, enemy territory, etc.
It’s FOSS: Could you comment on the recent dust-up between the Pale Moon browser developers and the team behind the OpenBSD ports system?
[Author’s Note: For those who haven’t heard about this, let me summarize. Last month, someone from the OpenBSD team added the Pale Moon browser to their ports collection. A Pale Moon developer demanded that they include Pale Moon’s libraries instead of using system libraries. As the conversation continued, it got more hostile, especially on the Pale Moon side. The net result is that Pale Moon will not be available on OpenBSD, MidnightBSD, or FreeBSD.]
Lucas Holt: I found this discussion frustrating. Many of the BSD projects hear a lot of complaints about browser availability and compatibility. With Firefox moving to Rust, it makes it even more difficult. Then you get into branding issues. Like Firefox, the Pale Moon developers have decided to protect their brand at the cost of users. Unlike the Firefox devs, they’ve made even stranger requirements for branding. It is not possible to use a system library version of anything with Pale Moon and keep their branding requirements. As such, we cannot offer Pale Moon in MidnightBSD.
The reason this is an issue for an open source project is that many third party libraries are used in something as complex as a web browser. For instance, Gecko-based browsers use several multimedia libraries, sqlite3 (for bookmarks), audio and video codecs, etc. Trying to maintain upstream patches for each of these items is difficult. That’s why the BSDs have ports collections to begin with. It allows us to track and manage custom patches to make all these libraries work. We go through a lot of effort in keeping these up to date. Sometimes upstream patches don’t get included. That means our versions are the only working copies. With pale moon’s policy, we’d need to submit separate patches to their customized versions of all these libraries too and any new release of the browser would not be available as changes occur. It might not even be possible to compile pale moon without a patch locally.
With regard to Rust, it requires porting the language, as well as an appropriate version of LLVM before you can even start on the browser.
It’s FOSS: If someone wanted to contribute to your project, both financial and technical, how can they do that?
Lucas Holt: Financial assistance for the project can be submitted online. We have a page outlining how to make donations with Patreon, Paypal or via bitcoin. Donations are not tax deductible. You can learn more at http://www.midnightbsd.org/donate/
We also need assistance with translations, porting applications, and working on the actual OS. Interested parties can contact us on the mailing list or through IRC on freenode #midnightbsd We also could use assistance with mirroring ISOs and packages.
I would like to thank Lucas for taking the time to reply to my many questions. For more information about MidnightBSD or to download it, please visit their website. The most recent version of MidnightBSD is 0.8.6.
News Roundup
8 months with TrueOS (https://inflo.ws/blog/post/2018-03-03-trueos-8th-month-review/)
Purpose of this review - what it is and what it is not.
I vowed to write down what I felt about TrueOS if I ever got to the six month mark of usage. This is just that. This is neither a tutorial, nor a piece of evangelism dedicated towards it.
This is also not a review of specific parts of TrueOS such as Lumina or AppCafe, since I don't use them at all.
In the spirit of presenting a screen shot, here is my i3wm displaying 4 windows in one screen - a configuration that I never use. https://inflo.ws/blog/images/trues-screenshot.png
The primary tasks I get done with my computer.
I need a tiling wm with multi-desktop capability. As regards what I do with a computer, it is fairly straightforward to describe if I just list down my most frequently used applications.

xterm (CLI)
Emacs (General editing and org mode)
Intellij IDEA (Java, Kotlin, SQL)
Firefox (Main web browser, with Multi-Account Containers)
Thunderbird (Work e-mail)
Notmuchmail (Personal e-mail)
Chromium/Iridium (Dumb web browser)
Telegram Desktop
weechat (with wee-slack)
cmus (Music player)
mpv (Video player)
mps-youtube (Youtube client)
transmission-gtk
Postgresql10 (daemon)
Rabbitmq (daemon)
Seafile (file sync)
Shotwell (manage pictures)
GIMP (Edit pictures)
Calibre (Manage e-books)
VirtualBox

All of these are available as binary packages from the repository. Since I use Intellij Ultimate edition, I decided to download the no-jdk linux version from the website rather than install it. This would make sure that it gets updated regularly.
Why did I pick TrueOS ?
I ran various Linux distributions from 2001 all the way till 2009, till I discovered Arch, and continued with it till 2017. I tried out Void for two months before I switched to TrueOS.
Over the last few years, I started feeling like no matter which Linux distribution I touched, they all just stopped making a lot of sense. Generally in the way things were organised, and particularly in terms of software like systemd, which just got pushed down my throat. I couldn't wrap my head around half the things going on in my computer.
Mostly I found that Linux distributions stopped becoming a collection of applications that got developed together to something more coupled by software mechanisms like systemd - and that process was more and more opaque. I don't want to talk about the merits and de-merits of systemd, lets just say that I found it of no use and an unnecessary hassle.
In February, I found myself in charge of the entire technology stack of a company, and I was free to make choices. A friend who was a long time FreeBSD user convinced me to try it on the servers. My requirement then was to run Postgres, Rabbitmq, Nginx and a couple of JVM processes. The setup was zero hassle and it hasn't changed much in a year.
About three months of running FreeBSD-11.x on servers was enough for me to consider it for my laptop. I was very apprehensive of hardware support, but luckily my computer is a Thinkpad, and Thinkpads sort of work out of the box with various BSDs.
My general requirements were:
Must run Intellij IDEA.
Must have proper graphics and sound driver support.
Must be able to run VirtualBox.
I had to pick from FreeBSD, NetBSD and OpenBSD, since these were the major BSDs that I was familiar with. One of my requirements was that I needed to be able to run VMs just in case I needed to test something on Windows/Linux. This ruled out OpenBSD. Then I was left with NetBSD and FreeBSD. NetBSD's driver support for newer Intel chip-sets were questionable, and FreeBSD was the only choice then.
When I was digging through FreeBSD forums, I found out that running the 11.x RELEASE on my laptop was out of the question since it didn't have proper drivers for my chip-set either.
A few more hours of digging led me to GhostBSD and TrueOS. I picked TrueOS straightaway because - well because TrueOS came from the old PC-BSD and it was built off FreeBSD-12-CURRENT with the latest drivers integrated.
I downloaded the UNSTABLE version available in June 2017, backed up ALL my data and home directory, and then installed it. There were no glitches during installation - I simply followed the installation as described in the handbook and everything was fine.
My entire switch from Arch/Void to TrueOS took about an hour, discounting the time it took to backup my data to an external hard disk. It was that easy. Everything I wanted to work just worked, everything was available in the repo.
Tweaks from cooltrainer.org : I discovered this excellent tutorial that describes setting up a FreeBSD 11 desktop. It documents several useful tweaks, some of which I applied. A few examples - Fonts, VirtualBox, Firewall, UTF-8 sections.
TrueOS (and FreeBSD) specific things I liked
Open-rc
The open-rc init system is familiar and is well documented.
TrueOS specific parts are described here.
When I installed postgresql10-server, there was no open-rc script for it, but I could cobble one together in two hours with zero prior experience writing init scripts. Later on I figured out that the init script for postgresql9 would work for 10 as well, and used that.
Boot Environments
This was an alien concept to me, but the first time I did an update without waiting for a CDN sync to finish, my computer booted into the shell and remained there. The friendly people at TrueOS discourse asked me to roll back to an older BE and wait for sync to finish.
I dug through the forums and found "ZFS / Snapshots basics &amp;amp; How-To’s for those new to TrueOS". This describes ZFS and BEs, and is well worth reading.
ZFS
My experience with boot environments was enough to convince me about the utility of ZFS. I am still reading about it and trying things out, and whatever I read just convinces me more about why it is good.
File-system layout
Coming from the Linux world, how the FreeBSD file-system is laid out seemed odd at first. Then I realised that it was the Linux distros that were doing the odd thing. e.g : The whole OS is split into base system and applications. All the non base system configurations and apps go into /usr/local. That made a lot of sense.
The entire OS is developed along with its applications as a single coherent entity, and that shows.
Documentation
The handbooks for both TrueOS and FreeBSD are really really good. For e.g, I kept some files in an LUKS encrypted drive (when I used Arch Linux). To find an equivalent, all I had to do was read the handbook and look at the GELI section. It is actually nice being able to go to a source like Handbook and things from there just work.
Arch Linux and Gentoo has excellent documentation as well, if anyone is wondering about Linux distros.
Community
The TrueOS community on both Telegram as well as on Discourse are very friendly and patient. They help out a lot and do not get upset when I pose really stupid questions. TrueOS core developers hangout in the Telegram chat-room too, and it is nice being able to talk to them directly about things.
What did not work in TrueOS ?
The following things that worked during my Linux tenure doesn't work in TrueOS.
Netflix
Google Hangouts
Electron based applications (Slack, Skype)
These are not major concerns for the kind of work I do, so it doesn't bother me much. I run a WinXP VM to play some old games, and a Bunsenlabs installation for Linux things like Hangouts/Netflix.
I don't have a video calling system setup in TrueOS because I use my phone for both voice and video calls exclusively.
Why am I staying on TrueOS ?
Great community - whether on Discourse or on the telegram channel, the people make you feel welcome. If things go unanswered, someone will promise to work on it/file a bug/suggest work-arounds.
Switching to TrueOS was philosophical as well - I thought a lot more about licenses, and I have arrived at the conclusion that I like BSD more than GPL. I believe it is a more practical license.
I believe TrueOS is improving continuously, and is a great desktop UNIX if you put some time into it.
AsiaBSDCon 2016 videos now available (https://www.youtube.com/playlist?list=PLnTFqpZk5ebD-FfVScL-x6ZnZSecMA1jI)
The videos from AsiaBSDCon 2016 have been posted to youtube, 30 videos in all
We’ll cover the videos from 2017 next week
The videos from 2018 should be posted in 4-6 weeks
I are working on a new version of https://papers.freebsd.org/ that will make it easier to find the papers, slides, and videos of all talks related to FreeBSD
***
syspatches will be provided for both supported releases (https://undeadly.org/cgi?action=article;sid=20180307234243)
Good news for people doing upgrades only once per year: syspatches will be provided for both supported releases. The commit from T.J. Townsend (tj@) speaks for itself:
```
Subject:    CVS: cvs.openbsd.org: www
From:       T.J. Townsend 
Date:       2018-03-06 22:09:12
CVSROOT:    /cvs
Module name:    www
Changes by: tj@cvs.openbsd.org  2018/03/06 15:09:12
Modified files:
    .              : errata61.html stable.html 
    faq            : faq10.html 
Log message:
syspatches will now be provided for both supported releases.
```
Thanks to all the developers involved in providing these!
Update: An official announcement has been released:
```
I'm happy to announce that we are now able to provide two releases worth
of syspatches on the amd64 and i386 platforms. The binary patches for
6.1 will hit the mirrors shortly, so you will be able to catch up with
the errata on
   https://www.openbsd.org/errata61.html
using the syspatch utility. People running amd64 will thus get the
meltdown workaround.
This means in particular that 6.2 will remain supported by syspatch when
6.3 comes out.
Thanks to robert and ajacoutot for their amazing work on syspatch and
for all their help. Thanks also to tj and the volunteers from #openbsd
for their timely tests and of course to Theo for overseeing it all.
```
Exploring permutations and a mystery with BSD and GNU split filenames (https://www.lorainekv.com/permutations_split_and_gsplit/)
Recently, I was playing around with the split command-line tool on Mac OS X, and I decided to chop a 4000-line file into 4000 separate single-line files. However, when I attempted to run split -l1, I ran into a funny error:
split: too many files
Curious to see if any splitting had occurred, I ran ls and sure enough, a huge list of filenames appeared, such as:

xaa
xab
...
xzy
xzz

Now I could see why you'd run out of unique filenames - there are only 26 letters in the alphabet and these filenames were only three letters long. Also, they all seemed to begin with the letter "x".
BSD split's filename defaults
I checked the manual for split's defaults and confirmed what I was seeing:
each file into which the file is split is named by the prefix followed by a lexically ordered suffix using suffix_length characters in the range 'a-z'. If -a is not specified, two letters are used as the suffix....with the prefix 'x' and with suffixes as above.
Got it, so running split with the defaults for prefix name and suffix length will give me filenames that always start with the letter "x" followed by two-letter alphabetical permutations composed of a-z letters, with repeats allowed. I say "repeats allowed" because I noticed filenames such as xaa and xbb in the output.
Side node: The reason why I say "permutations" rather than "combinations" is because letter order matters. For example, xab and xba are two distinct and legitimate filenames. Here's a nice explanation about the difference between permutations and combinations.
Some permutation math
So how many filenames can you get from the BSD split tool using the defaults? There are permutation formulas out there for repeating values and non-repeating values. Based on split's behavior, I wanted to use the repeating values formula:
n^r where n equals the number of possible values (26 for a-z) and r equals the number of values (2, since there are only 2 letters after "x" in the filename).
26^2 = 676
So the total number of filename permutations allowed with BSD split's defaults should be 676.
To double check, I ran ls | wc -l to get the total number of files in my split_test directory. The output was 677. If you subtract my original input file, input.txt, then you have 676, or the number of permutations split would allow before running out of filenames!
Neat. But I still wanted my 4000 files.
Moar permutations pls
While 26^2 permutations doesn't support 4000 different filenames, I wondered if I could increase r to 3. Then, I'd have 17,576 different filename permutations to play with - more than enough.
Earlier, I remembered the manual mentioning suffix length:
-a suffixlength
Use suffixlength letters to form the suffix of the file name.
So I passed 3 in with the -a flag and guess what? I got my 4000 files!

split -l1 -a3 input.txt 
ls | wc -l
4001

But that was a lot of work. It would be great if split would just handle these permutations and suffix lengths by default!
In fact, I vaguely remember splitting large files into smaller ones with numerical filenames, which I prefer. I also remember not having to worry about suffixes in the past. But numerical filenames didn't seem to be an option with split installed on Mac OS X - there was no mention of it in the manual.
Turns out that I was remembering GNU split from using the Debian OS two years ago, a different flavor of the split tool with different defaults and behaviors.
Beastie Bits
Michael Lucas is speaking at mug.org 10 April 2018 (https://blather.michaelwlucas.com/archives/3121)
PkgsrcCon 2018 July 7+8 Berlin (http://pkgsrc.org/pkgsrcCon/2018/)
Tint2 rocks (http://www.vincentdelft.be/post/post_20180310)
Open Source Summit Europe 2018 Call for Proposals (https://www.freebsdfoundation.org/news-and-events/call-for-papers/open-source-summit-europe-2018-call-for-proposals/)
Travel Grants for BSDCan 2018 (https://www.freebsdfoundation.org/blog/bsdcan-2018-travel-grant-application-now-open/)
BSDCan 2018 FreeBSD Developers Summit Call for Proposals (https://www.freebsdfoundation.org/news-and-events/call-for-papers/bsdcan-2018-freebsd-developers-summit-call-for-proposals/)
OpenBSD vmm(4) update, by Mike Larkin (https://www.openbsd.org/papers/asiabsdcon2018-vmm-slides.pdf)
Feedback/Questions
Morgan ZFS Install Question (http://dpaste.com/3NZN49P#wrap)
Andre - Splitting ZFS Array, or not (http://dpaste.com/3V09BZ5#wrap)
Jake - Python Projects (http://dpaste.com/2CY5MRE#wrap)
Dave - Screen Sharing &amp;amp; Video Conference (http://dpaste.com/257WGCB#wrap)
James - ZFS disk id switching (http://dpaste.com/3HAPZ90#wrap)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>AsiaBSDcon review, Meltdown and Spectre Patches in FreeBSD stable, Interview with MidnightBSD founder, 8 months with TrueOS, mysteries of GNU and BSD split</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://2018.asiabsdcon.org/" rel="nofollow">AsiaBSDCon 2018 has concluded</a></h3>

<ul>
<li>We have just returned from AsiaBSDCon in Tokyo, Japan last weekend</li>
<li>Please excuse our jetlag</li>
<li>The conference consisted two days of meeting followed by 2 days of paper presentations</li>
<li>We arrived a few days early to see some sights and take a few extra delicious meals in Tokyo</li>
<li>The first day of meetings was a FreeBSD developer summit (while Benedict was teaching his two tutorials) where we discussed the FreeBSD release cycle and our thoughts on improving it, the new Casper capsicum helper service, and developments in SDIO which will eventually enable WiFi and SD card readers on more embedded devices</li>
<li>The second day of meetings consisted of bhyvecon, a miniconf that covered development in all hypervisors on all BSDs. It also included presentations on the porting of bhyve to IllumOS.</li>
<li>Then the conference started</li>
<li>There were a number of great presentations, plus an amazing hallway track as usual</li>
<li>It was great to see many old friends and to spend time discussing the latest happenings in BSD. A couple of people came by and asked to take a picture with us and we were happy to do that.
***</li>
</ul>

<h3><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-18:03.speculative_execution.asc" rel="nofollow">FreeBSD releases Spectre and Meltdown mitigations for 11.1</a></h3>

<blockquote>
<p>Speculative execution vulnerability mitigation is a work in progress.  This advisory addresses the most significant issues for FreeBSD 11.1 on amd64 CPUs.  We expect to update this advisory to include 10.x for amd64 CPUs.  Future FreeBSD releases will address this issue on i386 and other CPUs.  freebsd-update will include changes on i386 as part of this update due to common code changes shared between amd64 and i386, however it contains no functional changes for i386 (in particular, it does not mitigate the issue on i386).<br>
Many modern processors have implementation issues that allow unprivileged attackers to bypass user-kernel or inter-process memory access restrictions by exploiting speculative execution and shared resources (for example, caches).<br>
An attacker may be able to read secret data from the kernel or from a process when executing untrusted code (for example, in a web browser).</p>

<ul>
<li>Meltdown:
The mitigation is known as Page Table Isolation (PTI).  PTI largely separates kernel and user mode page tables, so that even during speculative execution most of the kernel&#39;s data is unmapped and not accessible.
A demonstration of the Meltdown vulnerability is available at <a href="https://github.com/dag-erling/meltdown" rel="nofollow">https://github.com/dag-erling/meltdown</a>.  A positive result is definitive (that is, the vulnerability exists with certainty).  A negative result indicates either that the CPU is not affected, or that the test is not capable of demonstrating the issue on the CPU (and may need to be modified).
A patched kernel will automatically enable PTI on Intel CPUs.  The status can be checked via the vm.pmap.pti sysctl 
PTI introduces a performance regression.  The observed performance loss is significant in microbenchmarks of system call overhead, but is much smaller for many real workloads.</li>
<li>Spectre V2:
There are two common mitigations for Spectre V2.  This patch includes a mitigation using Indirect Branch Restricted Speculation, a feature available via a microcode update from processor manufacturers.  The alternate mitigation, Retpoline, is a feature available in newer compilers.  The feasibility of applying Retpoline to stable branches and/or releases is under
investigation.
The patch includes the IBRS mitigation for Spectre V2.  To use the mitigation the system must have an updated microcode; with older microcode a patched kernel will function without the mitigation.
IBRS can be disabled via the hw.ibrs_disable sysctl (and tunable), and the status can be checked via the hw.ibrs_active sysctl.  IBRS may be enabled or disabled at runtime.  Additional detail on microcode updates will follow.</li>
<li><a href="https://wiki.freebsd.org/SpeculativeExecutionVulnerabilities" rel="nofollow">Wiki tracking the vulnerabilities and mitigations on different platforms</a>
***</li>
</ul>
</blockquote>

<h3><a href="https://itsfoss.com/midnightbsd-founder-lucas-holt/" rel="nofollow">Interview with MidnightBSD Founder and Lead Dev Lucas Holt</a></h3>

<blockquote>
<p>Recently, I have taken a little dip into the world of BSD. As part of my attempt to understand the BSD world a little better, I connected with Lucas Holt (MidnightBSD founder and lead developer) to ask him a few questions about his project. Here are his answers.</p>

<p>Its FOSS: Please explain MidnightBSD in a nutshell. How is it different than other BSDs?</p>

<p>Lucas Holt: MidnightBSD is a desktop focused operating system. When its considered stable, it will provide a full desktop experience. This differs from other efforts such as TrueOS or GhostBSD in that its not a distro of FreeBSD, but rather a fork. MidnightBSD has its own package manager, mport as well as unique package cluster software and several features built into user land such as mDNSresponder, libdispatch, and customizations throughout the system.</p>

<p>Its FOSS: Who is MidnightBSD aimed at?</p>

<p>Lucas Holt: The goal with MidnightBSD has always been to provide a desktop OS thats usable for everyday tasks and that even somewhat non technical people can use. Early versions of Mac OS X were certainly an inspiration. In practice, were rather far from that goal at this point, but its been an excellent learning opportunity.</p>

<p>Its FOSS: What is your background in computers?</p>

<p>Lucas Holt: I started in technical support at a small ISP and moved into web design and system administration. While there, I learned BSDi, Solaris and Linux. I also started tinkering with programming web apps in ASP and a little perl CGI. I then did a mix of programming and system administration jobs through college and graduated with a bachelors in C.S. from Eastern Michigan University. During that time, I learned NetBSD and FreeBSD. I started working on several projects such as porting Apples HFS+ code to FreeBSD 6 and working on getting the nforce2 chipset SATA controller working with FreeBSD 6, with the latter getting committed. I got a real taste for BSD and after seeing the lack of interest in the community for desktop BSDs, I started MidnightBSD. I began work on it in late 2005.<br>
Currently, Im a Senior Software Engineer focusing on backend rest services by day and a part-time graduate student at the University of Michigan Flint.</p>

<p>Its FOSS: I recently installed TrueOS. I was disappointed that a couple of the programs I wanted were not available. The FreeBSD port system looked mildly complicated for beginners. Im used to using pacman to get the job done quickly. How does MidnightBSD deal with ports?</p>

<p>Lucas Holt: MidnightBSD has its own port system, mports, which shared similarities with FreeBSD ports as well as some ideas from OpenBSD. We decided early on that decent package management was essential for regular users. Power users will still use ports for certain software, but its just so time consuming to build everything. We started work on our own package manager, mport.<br>
Every package is a tar lzma archive with a sqlite3 manifest file as well as a sqlite 3 index thats downloaded from our server. This allows users to query and customize the package system with standard SQL queries. Were also building more user friendly graphical tools.<br>
Package availability is another issue that most BSDs have. Software tends to be written for one or two operating systems and many projects are reluctant to support other systems, particularly smaller projects like MidnightBSD. There are certainly gaps. All of the BSD projects need more volunteers to help with porting software and keeping it up to date.</p>

<p>Its FOSS: During your June 2015 interview on BSDNow, you mentioned that even though you support both i386 and amd64, that you recommend people choose amd64. Do you have any plans to drop i386 support in the future, like many have done?</p>

<p>Lucas Holt: Yes, we do plan to drop i386 support, mostly because of the extra work needed to build and maintain packages. Ive held off on this so far because I had a lot of feedback from users in South America that they still needed it. For now, the plan is to keep i386 support through 1.0 release. Thats probably a year or two out.</p>

<p>Its FOSS: What desktop environments does MidnightBSD support?</p>

<p>Lucas Holt: The original plan was to use Etoile as a desktop environment, but that project changed focus. We currently support Xfce, Gnome 3, WindowMaker + GNUstep + Gworkspace as primary choices. We also have several other window managers and desktop environments available such as Enlightenment, rat poison, afterstep, etc.<br>
Early versions offered KDE 3.x but we had some issues with KDE 4. We may revisit that with newer versions.</p>

<p>Its FOSS: What is MidnightBSDs default filesystem? Do you support DragonflyBSDs HAMMER filesystem? What other filesystems?</p>

<p>Lucas Holt: Boot volumes are UFS2. We also support ZFS for additional storage. We have read support for ExFat, NTFS, ext2, CD9660. NFS v3 and v4 are also supported for network file systems.<br>
We do not support HAMMER, although it was considered. I would love to see HAMMER2 get added to MidnightBSD eventually.</p>

<p>Its FOSS: Is MidnightBSD affected by the recent Spectre and Meltdown issues?</p>

<p>Lucas Holt: Yes. Most operating systems were affected by these issues. We were not informed of the issue until the general public became aware. Work is ongoing to come up with appropriate mitigations. Unfortunately, we do not have a patch yet.</p>

<p>Its FOSS: The Raspberry Pi and its many clones have made the ARM platform very popular. Are there any plans to make MidnightBSD available on that platform?</p>

<p>Lucas Holt: No immediate plans. ARM is an interesting architecture, but by the very nature of SoC designs, takes a lot of work to support a broad number of devices. It might be possible when we stop supporting i386 or if someone volunteers to work on the ARM port.<br>
Eventually, I think most hobby systems will need to run ARM chips. Intels planning on locking down hardware with UEFI 3 and this may make it difficult to run on commodity hardware in the future not only for MidnightBSD but other systems as well.<br>
At one point, MidinightBSD ran on sparc64. When workstations were killed off, we dropped support. A desktop OS on a server platform makes little sense.</p>

<p>Its FOSS: Does MidnightBSD offer support for Linux applications?</p>

<p>Lucas Holt: Yes, we offer Linux emulation. Its emulating a 2.6.16 kernel currently and that needs to be updated so support newer apps. Its possible to run semi-recent versions of Firefox, Thunderbird, Java, and OpenOffice on it though. Ive also used it to host game servers in the past and play older games such as Quake 3, enemy territory, etc.</p>

<p>Its FOSS: Could you comment on the recent dust-up between the Pale Moon browser developers and the team behind the OpenBSD ports system?</p>
</blockquote>

<ul>
<li>[Authors Note: For those who havent heard about this, let me summarize. Last month, someone from the OpenBSD team added the Pale Moon browser to their ports collection. A Pale Moon developer demanded that they include Pale Moons libraries instead of using system libraries. As the conversation continued, it got more hostile, especially on the Pale Moon side. The net result is that Pale Moon will not be available on OpenBSD, MidnightBSD, or FreeBSD.]</li>
</ul>

<blockquote>
<p>Lucas Holt: I found this discussion frustrating. Many of the BSD projects hear a lot of complaints about browser availability and compatibility. With Firefox moving to Rust, it makes it even more difficult. Then you get into branding issues. Like Firefox, the Pale Moon developers have decided to protect their brand at the cost of users. Unlike the Firefox devs, theyve made even stranger requirements for branding. It is not possible to use a system library version of anything with Pale Moon and keep their branding requirements. As such, we cannot offer Pale Moon in MidnightBSD.<br>
The reason this is an issue for an open source project is that many third party libraries are used in something as complex as a web browser. For instance, Gecko-based browsers use several multimedia libraries, sqlite3 (for bookmarks), audio and video codecs, etc. Trying to maintain upstream patches for each of these items is difficult. Thats why the BSDs have ports collections to begin with. It allows us to track and manage custom patches to make all these libraries work. We go through a lot of effort in keeping these up to date. Sometimes upstream patches dont get included. That means our versions are the only working copies. With pale moons policy, wed need to submit separate patches to their customized versions of all these libraries too and any new release of the browser would not be available as changes occur. It might not even be possible to compile pale moon without a patch locally.<br>
With regard to Rust, it requires porting the language, as well as an appropriate version of LLVM before you can even start on the browser.</p>

<p>Its FOSS: If someone wanted to contribute to your project, both financial and technical, how can they do that?</p>

<p>Lucas Holt: Financial assistance for the project can be submitted online. We have a page outlining how to make donations with Patreon, Paypal or via bitcoin. Donations are not tax deductible. You can learn more at <a href="http://www.midnightbsd.org/donate/" rel="nofollow">http://www.midnightbsd.org/donate/</a><br>
We also need assistance with translations, porting applications, and working on the actual OS. Interested parties can contact us on the mailing list or through IRC on freenode #midnightbsd We also could use assistance with mirroring ISOs and packages.</p>

<p>I would like to thank Lucas for taking the time to reply to my many questions. For more information about MidnightBSD or to download it, please visit their website. The most recent version of MidnightBSD is 0.8.6.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://inflo.ws/blog/post/2018-03-03-trueos-8th-month-review/" rel="nofollow">8 months with TrueOS</a></h3>

<ul>
<li>Purpose of this review - what it is and what it is not.</li>
</ul>

<blockquote>
<p>I vowed to write down what I felt about TrueOS if I ever got to the six month mark of usage. This is just that. This is neither a tutorial, nor a piece of evangelism dedicated towards it.</p>

<p>This is also not a review of specific parts of TrueOS such as Lumina or AppCafe, since I don&#39;t use them at all.</p>

<p>In the spirit of presenting a screen shot, here is my i3wm displaying 4 windows in one screen - a configuration that I never use. <a href="https://inflo.ws/blog/images/trues-screenshot.png" rel="nofollow">https://inflo.ws/blog/images/trues-screenshot.png</a></p>
</blockquote>

<ul>
<li>The primary tasks I get done with my computer.</li>
</ul>

<blockquote>
<p>I need a tiling wm with multi-desktop capability. As regards what I do with a computer, it is fairly straightforward to describe if I just list down my most frequently used applications.</p>
</blockquote>

<pre><code>xterm (CLI)
Emacs (General editing and org mode)
Intellij IDEA (Java, Kotlin, SQL)
Firefox (Main web browser, with Multi-Account Containers)
Thunderbird (Work e-mail)
Notmuchmail (Personal e-mail)
Chromium/Iridium (Dumb web browser)
Telegram Desktop
weechat (with wee-slack)
cmus (Music player)
mpv (Video player)
mps-youtube (Youtube client)
transmission-gtk
Postgresql10 (daemon)
Rabbitmq (daemon)
Seafile (file sync)
Shotwell (manage pictures)
GIMP (Edit pictures)
Calibre (Manage e-books)
VirtualBox
</code></pre>

<blockquote>
<p>All of these are available as binary packages from the repository. Since I use Intellij Ultimate edition, I decided to download the no-jdk linux version from the website rather than install it. This would make sure that it gets updated regularly.</p>
</blockquote>

<ul>
<li>Why did I pick TrueOS ?</li>
</ul>

<blockquote>
<p>I ran various Linux distributions from 2001 all the way till 2009, till I discovered Arch, and continued with it till 2017. I tried out Void for two months before I switched to TrueOS.</p>

<p>Over the last few years, I started feeling like no matter which Linux distribution I touched, they all just stopped making a lot of sense. Generally in the way things were organised, and particularly in terms of software like systemd, which just got pushed down my throat. I couldn&#39;t wrap my head around half the things going on in my computer.</p>

<p>Mostly I found that Linux distributions stopped becoming a collection of applications that got developed together to something more coupled by software mechanisms like systemd - and that process was more and more opaque. I don&#39;t want to talk about the merits and de-merits of systemd, lets just say that I found it of no use and an unnecessary hassle.</p>

<p>In February, I found myself in charge of the entire technology stack of a company, and I was free to make choices. A friend who was a long time FreeBSD user convinced me to try it on the servers. My requirement then was to run Postgres, Rabbitmq, Nginx and a couple of JVM processes. The setup was zero hassle and it hasn&#39;t changed much in a year.</p>

<p>About three months of running FreeBSD-11.x on servers was enough for me to consider it for my laptop. I was very apprehensive of hardware support, but luckily my computer is a Thinkpad, and Thinkpads sort of work out of the box with various BSDs.</p>

<p>My general requirements were:</p>
</blockquote>

<ul>
<li>Must run Intellij IDEA.</li>
<li>Must have proper graphics and sound driver support.</li>
<li>Must be able to run VirtualBox.</li>
</ul>

<blockquote>
<p>I had to pick from FreeBSD, NetBSD and OpenBSD, since these were the major BSDs that I was familiar with. One of my requirements was that I needed to be able to run VMs just in case I needed to test something on Windows/Linux. This ruled out OpenBSD. Then I was left with NetBSD and FreeBSD. NetBSD&#39;s driver support for newer Intel chip-sets were questionable, and FreeBSD was the only choice then.</p>

<p>When I was digging through FreeBSD forums, I found out that running the 11.x RELEASE on my laptop was out of the question since it didn&#39;t have proper drivers for my chip-set either.</p>

<p>A few more hours of digging led me to GhostBSD and TrueOS. I picked TrueOS straightaway because - well because TrueOS came from the old PC-BSD and it was built off FreeBSD-12-CURRENT with the latest drivers integrated.</p>

<p>I downloaded the UNSTABLE version available in June 2017, backed up ALL my data and home directory, and then installed it. There were no glitches during installation - I simply followed the installation as described in the handbook and everything was fine.</p>

<p>My entire switch from Arch/Void to TrueOS took about an hour, discounting the time it took to backup my data to an external hard disk. It was that easy. Everything I wanted to work just worked, everything was available in the repo.</p>

<p>Tweaks from cooltrainer.org : I discovered this excellent tutorial that describes setting up a FreeBSD 11 desktop. It documents several useful tweaks, some of which I applied. A few examples - Fonts, VirtualBox, Firewall, UTF-8 sections.</p>
</blockquote>

<ul>
<li><p>TrueOS (and FreeBSD) specific things I liked</p>

<ul>
<li>Open-rc</li>
</ul></li>
</ul>

<blockquote>
<p>The open-rc init system is familiar and is well documented.<br>
TrueOS specific parts are described here.<br>
When I installed postgresql10-server, there was no open-rc script for it, but I could cobble one together in two hours with zero prior experience writing init scripts. Later on I figured out that the init script for postgresql9 would work for 10 as well, and used that.</p>
</blockquote>

<ul>
<li>Boot Environments</li>
</ul>

<blockquote>
<p>This was an alien concept to me, but the first time I did an update without waiting for a CDN sync to finish, my computer booted into the shell and remained there. The friendly people at TrueOS discourse asked me to roll back to an older BE and wait for sync to finish.<br>
I dug through the forums and found &quot;ZFS / Snapshots basics &amp; How-Tos for those new to TrueOS&quot;. This describes ZFS and BEs, and is well worth reading.</p>
</blockquote>

<ul>
<li>ZFS</li>
</ul>

<blockquote>
<p>My experience with boot environments was enough to convince me about the utility of ZFS. I am still reading about it and trying things out, and whatever I read just convinces me more about why it is good.</p>
</blockquote>

<ul>
<li>File-system layout</li>
</ul>

<blockquote>
<p>Coming from the Linux world, how the FreeBSD file-system is laid out seemed odd at first. Then I realised that it was the Linux distros that were doing the odd thing. e.g : The whole OS is split into base system and applications. All the non base system configurations and apps go into /usr/local. That made a lot of sense.<br>
The entire OS is developed along with its applications as a single coherent entity, and that shows.</p>
</blockquote>

<ul>
<li>Documentation</li>
</ul>

<blockquote>
<p>The handbooks for both TrueOS and FreeBSD are really really good. For e.g, I kept some files in an LUKS encrypted drive (when I used Arch Linux). To find an equivalent, all I had to do was read the handbook and look at the GELI section. It is actually nice being able to go to a source like Handbook and things from there just work.<br>
Arch Linux and Gentoo has excellent documentation as well, if anyone is wondering about Linux distros.</p>
</blockquote>

<ul>
<li>Community</li>
</ul>

<blockquote>
<p>The TrueOS community on both Telegram as well as on Discourse are very friendly and patient. They help out a lot and do not get upset when I pose really stupid questions. TrueOS core developers hangout in the Telegram chat-room too, and it is nice being able to talk to them directly about things.</p>
</blockquote>

<ul>
<li>What did not work in TrueOS ?</li>
</ul>

<blockquote>
<p>The following things that worked during my Linux tenure doesn&#39;t work in TrueOS.</p>
</blockquote>

<ul>
<li>Netflix</li>
<li>Google Hangouts</li>
<li>Electron based applications (Slack, Skype)</li>
</ul>

<blockquote>
<p>These are not major concerns for the kind of work I do, so it doesn&#39;t bother me much. I run a WinXP VM to play some old games, and a Bunsenlabs installation for Linux things like Hangouts/Netflix.</p>

<p>I don&#39;t have a video calling system setup in TrueOS because I use my phone for both voice and video calls exclusively.</p>
</blockquote>

<ul>
<li>Why am I staying on TrueOS ?</li>
</ul>

<blockquote>
<p>Great community - whether on Discourse or on the telegram channel, the people make you feel welcome. If things go unanswered, someone will promise to work on it/file a bug/suggest work-arounds.</p>

<p>Switching to TrueOS was philosophical as well - I thought a lot more about licenses, and I have arrived at the conclusion that I like BSD more than GPL. I believe it is a more practical license.</p>

<p>I believe TrueOS is improving continuously, and is a great desktop UNIX if you put some time into it.</p>
</blockquote>

<hr>

<h3><a href="https://www.youtube.com/playlist?list=PLnTFqpZk5ebD-FfVScL-x6ZnZSecMA1jI" rel="nofollow">AsiaBSDCon 2016 videos now available</a></h3>

<ul>
<li>The videos from AsiaBSDCon 2016 have been posted to youtube, 30 videos in all</li>
<li>Well cover the videos from 2017 next week</li>
<li>The videos from 2018 should be posted in 4-6 weeks</li>
<li>I are working on a new version of <a href="https://papers.freebsd.org/" rel="nofollow">https://papers.freebsd.org/</a> that will make it easier to find the papers, slides, and videos of all talks related to FreeBSD
***</li>
</ul>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180307234243" rel="nofollow">syspatches will be provided for both supported releases</a></h3>

<blockquote>
<p>Good news for people doing upgrades only once per year: syspatches will be provided for both supported releases. The commit from T.J. Townsend (tj@) speaks for itself:</p>
</blockquote>

<pre><code>Subject:    CVS: cvs.openbsd.org: www
From:       T.J. Townsend &lt;tj () openbsd ! org&gt;
Date:       2018-03-06 22:09:12

CVSROOT:    /cvs
Module name:    www
Changes by: tj@cvs.openbsd.org  2018/03/06 15:09:12

Modified files:
    .              : errata61.html stable.html 
    faq            : faq10.html 

Log message:
syspatches will now be provided for both supported releases.
</code></pre>

<blockquote>
<p>Thanks to all the developers involved in providing these!</p>
</blockquote>

<ul>
<li>Update: An official announcement has been released:</li>
</ul>

<pre><code>I&#39;m happy to announce that we are now able to provide two releases worth
of syspatches on the amd64 and i386 platforms. The binary patches for
6.1 will hit the mirrors shortly, so you will be able to catch up with
the errata on

   https://www.openbsd.org/errata61.html

using the syspatch utility. People running amd64 will thus get the
meltdown workaround.

This means in particular that 6.2 will remain supported by syspatch when
6.3 comes out.

Thanks to robert and ajacoutot for their amazing work on syspatch and
for all their help. Thanks also to tj and the volunteers from #openbsd
for their timely tests and of course to Theo for overseeing it all.
</code></pre>

<hr>

<h3><a href="https://www.lorainekv.com/permutations_split_and_gsplit/" rel="nofollow">Exploring permutations and a mystery with BSD and GNU split filenames</a></h3>

<blockquote>
<p>Recently, I was playing around with the split command-line tool on Mac OS X, and I decided to chop a 4000-line file into 4000 separate single-line files. However, when I attempted to run split -l1, I ran into a funny error:</p>
</blockquote>

<p><code>split: too many files</code></p>

<blockquote>
<p>Curious to see if any splitting had occurred, I ran ls and sure enough, a huge list of filenames appeared, such as:</p>
</blockquote>

<pre><code>xaa
xab
...
xzy
xzz
</code></pre>

<blockquote>
<p>Now I could see why you&#39;d run out of unique filenames - there are only 26 letters in the alphabet and these filenames were only three letters long. Also, they all seemed to begin with the letter &quot;x&quot;.</p>
</blockquote>

<ul>
<li>BSD split&#39;s filename defaults</li>
</ul>

<blockquote>
<p>I checked the manual for split&#39;s defaults and confirmed what I was seeing:</p>

<p>each file into which the file is split is named by the prefix followed by a lexically ordered suffix using suffix_length characters in the range &#39;a-z&#39;. If -a is not specified, two letters are used as the suffix....with the prefix &#39;x&#39; and with suffixes as above.</p>

<p>Got it, so running split with the defaults for prefix name and suffix length will give me filenames that always start with the letter &quot;x&quot; followed by two-letter alphabetical permutations composed of a-z letters, with repeats allowed. I say &quot;repeats allowed&quot; because I noticed filenames such as xaa and xbb in the output.</p>

<p>Side node: The reason why I say &quot;permutations&quot; rather than &quot;combinations&quot; is because letter order matters. For example, xab and xba are two distinct and legitimate filenames. Here&#39;s a nice explanation about the difference between permutations and combinations.</p>
</blockquote>

<ul>
<li>Some permutation math</li>
</ul>

<blockquote>
<p>So how many filenames can you get from the BSD split tool using the defaults? There are permutation formulas out there for repeating values and non-repeating values. Based on split&#39;s behavior, I wanted to use the repeating values formula:</p>

<p>n<sup>r</sup> where n equals the number of possible values (26 for a-z) and r equals the number of values (2, since there are only 2 letters after &quot;x&quot; in the filename).</p>

<p>26<sup>2</sup> = 676</p>

<p>So the total number of filename permutations allowed with BSD split&#39;s defaults should be 676.</p>

<p>To double check, I ran ls | wc -l to get the total number of files in my split_test directory. The output was 677. If you subtract my original input file, input.txt, then you have 676, or the number of permutations split would allow before running out of filenames!</p>

<p>Neat. But I still wanted my 4000 files.</p>
</blockquote>

<ul>
<li>Moar permutations pls</li>
</ul>

<blockquote>
<p>While 26<sup>2</sup> permutations doesn&#39;t support 4000 different filenames, I wondered if I could increase r to 3. Then, I&#39;d have 17,576 different filename permutations to play with - more than enough.</p>

<p>Earlier, I remembered the manual mentioning suffix length:</p>

<p>-a suffix_length<br>
Use suffix_length letters to form the suffix of the file name.</p>

<p>So I passed 3 in with the -a flag and guess what? I got my 4000 files!</p>
</blockquote>

<pre><code>split -l1 -a3 input.txt 
ls | wc -l
4001
</code></pre>

<blockquote>
<p>But that was a lot of work. It would be great if split would just handle these permutations and suffix lengths by default!</p>

<p>In fact, I vaguely remember splitting large files into smaller ones with numerical filenames, which I prefer. I also remember not having to worry about suffixes in the past. But numerical filenames didn&#39;t seem to be an option with split installed on Mac OS X - there was no mention of it in the manual.</p>

<p>Turns out that I was remembering GNU split from using the Debian OS two years ago, a different flavor of the split tool with different defaults and behaviors.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://blather.michaelwlucas.com/archives/3121" rel="nofollow">Michael Lucas is speaking at mug.org 10 April 2018</a><br>
<a href="http://pkgsrc.org/pkgsrcCon/2018/" rel="nofollow">PkgsrcCon 2018 July 7+8 Berlin</a><br>
<a href="http://www.vincentdelft.be/post/post_20180310" rel="nofollow">Tint2 rocks</a><br>
<a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/open-source-summit-europe-2018-call-for-proposals/" rel="nofollow">Open Source Summit Europe 2018 Call for Proposals</a><br>
<a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-travel-grant-application-now-open/" rel="nofollow">Travel Grants for BSDCan 2018</a><br>
<a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/bsdcan-2018-freebsd-developers-summit-call-for-proposals/" rel="nofollow">BSDCan 2018 FreeBSD Developers Summit Call for Proposals</a><br>
<a href="https://www.openbsd.org/papers/asiabsdcon2018-vmm-slides.pdf" rel="nofollow">OpenBSD vmm(4) update, by Mike Larkin</a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="http://dpaste.com/3NZN49P#wrap" rel="nofollow">Morgan ZFS Install Question</a></p></li>
<li><p><a href="http://dpaste.com/3V09BZ5#wrap" rel="nofollow">Andre - Splitting ZFS Array, or not</a></p></li>
<li><p><a href="http://dpaste.com/2CY5MRE#wrap" rel="nofollow">Jake - Python Projects</a></p></li>
<li><p><a href="http://dpaste.com/257WGCB#wrap" rel="nofollow">Dave - Screen Sharing &amp; Video Conference</a></p></li>
<li><p><a href="http://dpaste.com/3HAPZ90#wrap" rel="nofollow">James - ZFS disk id switching</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>AsiaBSDcon review, Meltdown and Spectre Patches in FreeBSD stable, Interview with MidnightBSD founder, 8 months with TrueOS, mysteries of GNU and BSD split</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://2018.asiabsdcon.org/" rel="nofollow">AsiaBSDCon 2018 has concluded</a></h3>

<ul>
<li>We have just returned from AsiaBSDCon in Tokyo, Japan last weekend</li>
<li>Please excuse our jetlag</li>
<li>The conference consisted two days of meeting followed by 2 days of paper presentations</li>
<li>We arrived a few days early to see some sights and take a few extra delicious meals in Tokyo</li>
<li>The first day of meetings was a FreeBSD developer summit (while Benedict was teaching his two tutorials) where we discussed the FreeBSD release cycle and our thoughts on improving it, the new Casper capsicum helper service, and developments in SDIO which will eventually enable WiFi and SD card readers on more embedded devices</li>
<li>The second day of meetings consisted of bhyvecon, a miniconf that covered development in all hypervisors on all BSDs. It also included presentations on the porting of bhyve to IllumOS.</li>
<li>Then the conference started</li>
<li>There were a number of great presentations, plus an amazing hallway track as usual</li>
<li>It was great to see many old friends and to spend time discussing the latest happenings in BSD. A couple of people came by and asked to take a picture with us and we were happy to do that.
***</li>
</ul>

<h3><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-18:03.speculative_execution.asc" rel="nofollow">FreeBSD releases Spectre and Meltdown mitigations for 11.1</a></h3>

<blockquote>
<p>Speculative execution vulnerability mitigation is a work in progress.  This advisory addresses the most significant issues for FreeBSD 11.1 on amd64 CPUs.  We expect to update this advisory to include 10.x for amd64 CPUs.  Future FreeBSD releases will address this issue on i386 and other CPUs.  freebsd-update will include changes on i386 as part of this update due to common code changes shared between amd64 and i386, however it contains no functional changes for i386 (in particular, it does not mitigate the issue on i386).<br>
Many modern processors have implementation issues that allow unprivileged attackers to bypass user-kernel or inter-process memory access restrictions by exploiting speculative execution and shared resources (for example, caches).<br>
An attacker may be able to read secret data from the kernel or from a process when executing untrusted code (for example, in a web browser).</p>

<ul>
<li>Meltdown:
The mitigation is known as Page Table Isolation (PTI).  PTI largely separates kernel and user mode page tables, so that even during speculative execution most of the kernel&#39;s data is unmapped and not accessible.
A demonstration of the Meltdown vulnerability is available at <a href="https://github.com/dag-erling/meltdown" rel="nofollow">https://github.com/dag-erling/meltdown</a>.  A positive result is definitive (that is, the vulnerability exists with certainty).  A negative result indicates either that the CPU is not affected, or that the test is not capable of demonstrating the issue on the CPU (and may need to be modified).
A patched kernel will automatically enable PTI on Intel CPUs.  The status can be checked via the vm.pmap.pti sysctl 
PTI introduces a performance regression.  The observed performance loss is significant in microbenchmarks of system call overhead, but is much smaller for many real workloads.</li>
<li>Spectre V2:
There are two common mitigations for Spectre V2.  This patch includes a mitigation using Indirect Branch Restricted Speculation, a feature available via a microcode update from processor manufacturers.  The alternate mitigation, Retpoline, is a feature available in newer compilers.  The feasibility of applying Retpoline to stable branches and/or releases is under
investigation.
The patch includes the IBRS mitigation for Spectre V2.  To use the mitigation the system must have an updated microcode; with older microcode a patched kernel will function without the mitigation.
IBRS can be disabled via the hw.ibrs_disable sysctl (and tunable), and the status can be checked via the hw.ibrs_active sysctl.  IBRS may be enabled or disabled at runtime.  Additional detail on microcode updates will follow.</li>
<li><a href="https://wiki.freebsd.org/SpeculativeExecutionVulnerabilities" rel="nofollow">Wiki tracking the vulnerabilities and mitigations on different platforms</a>
***</li>
</ul>
</blockquote>

<h3><a href="https://itsfoss.com/midnightbsd-founder-lucas-holt/" rel="nofollow">Interview with MidnightBSD Founder and Lead Dev Lucas Holt</a></h3>

<blockquote>
<p>Recently, I have taken a little dip into the world of BSD. As part of my attempt to understand the BSD world a little better, I connected with Lucas Holt (MidnightBSD founder and lead developer) to ask him a few questions about his project. Here are his answers.</p>

<p>Its FOSS: Please explain MidnightBSD in a nutshell. How is it different than other BSDs?</p>

<p>Lucas Holt: MidnightBSD is a desktop focused operating system. When its considered stable, it will provide a full desktop experience. This differs from other efforts such as TrueOS or GhostBSD in that its not a distro of FreeBSD, but rather a fork. MidnightBSD has its own package manager, mport as well as unique package cluster software and several features built into user land such as mDNSresponder, libdispatch, and customizations throughout the system.</p>

<p>Its FOSS: Who is MidnightBSD aimed at?</p>

<p>Lucas Holt: The goal with MidnightBSD has always been to provide a desktop OS thats usable for everyday tasks and that even somewhat non technical people can use. Early versions of Mac OS X were certainly an inspiration. In practice, were rather far from that goal at this point, but its been an excellent learning opportunity.</p>

<p>Its FOSS: What is your background in computers?</p>

<p>Lucas Holt: I started in technical support at a small ISP and moved into web design and system administration. While there, I learned BSDi, Solaris and Linux. I also started tinkering with programming web apps in ASP and a little perl CGI. I then did a mix of programming and system administration jobs through college and graduated with a bachelors in C.S. from Eastern Michigan University. During that time, I learned NetBSD and FreeBSD. I started working on several projects such as porting Apples HFS+ code to FreeBSD 6 and working on getting the nforce2 chipset SATA controller working with FreeBSD 6, with the latter getting committed. I got a real taste for BSD and after seeing the lack of interest in the community for desktop BSDs, I started MidnightBSD. I began work on it in late 2005.<br>
Currently, Im a Senior Software Engineer focusing on backend rest services by day and a part-time graduate student at the University of Michigan Flint.</p>

<p>Its FOSS: I recently installed TrueOS. I was disappointed that a couple of the programs I wanted were not available. The FreeBSD port system looked mildly complicated for beginners. Im used to using pacman to get the job done quickly. How does MidnightBSD deal with ports?</p>

<p>Lucas Holt: MidnightBSD has its own port system, mports, which shared similarities with FreeBSD ports as well as some ideas from OpenBSD. We decided early on that decent package management was essential for regular users. Power users will still use ports for certain software, but its just so time consuming to build everything. We started work on our own package manager, mport.<br>
Every package is a tar lzma archive with a sqlite3 manifest file as well as a sqlite 3 index thats downloaded from our server. This allows users to query and customize the package system with standard SQL queries. Were also building more user friendly graphical tools.<br>
Package availability is another issue that most BSDs have. Software tends to be written for one or two operating systems and many projects are reluctant to support other systems, particularly smaller projects like MidnightBSD. There are certainly gaps. All of the BSD projects need more volunteers to help with porting software and keeping it up to date.</p>

<p>Its FOSS: During your June 2015 interview on BSDNow, you mentioned that even though you support both i386 and amd64, that you recommend people choose amd64. Do you have any plans to drop i386 support in the future, like many have done?</p>

<p>Lucas Holt: Yes, we do plan to drop i386 support, mostly because of the extra work needed to build and maintain packages. Ive held off on this so far because I had a lot of feedback from users in South America that they still needed it. For now, the plan is to keep i386 support through 1.0 release. Thats probably a year or two out.</p>

<p>Its FOSS: What desktop environments does MidnightBSD support?</p>

<p>Lucas Holt: The original plan was to use Etoile as a desktop environment, but that project changed focus. We currently support Xfce, Gnome 3, WindowMaker + GNUstep + Gworkspace as primary choices. We also have several other window managers and desktop environments available such as Enlightenment, rat poison, afterstep, etc.<br>
Early versions offered KDE 3.x but we had some issues with KDE 4. We may revisit that with newer versions.</p>

<p>Its FOSS: What is MidnightBSDs default filesystem? Do you support DragonflyBSDs HAMMER filesystem? What other filesystems?</p>

<p>Lucas Holt: Boot volumes are UFS2. We also support ZFS for additional storage. We have read support for ExFat, NTFS, ext2, CD9660. NFS v3 and v4 are also supported for network file systems.<br>
We do not support HAMMER, although it was considered. I would love to see HAMMER2 get added to MidnightBSD eventually.</p>

<p>Its FOSS: Is MidnightBSD affected by the recent Spectre and Meltdown issues?</p>

<p>Lucas Holt: Yes. Most operating systems were affected by these issues. We were not informed of the issue until the general public became aware. Work is ongoing to come up with appropriate mitigations. Unfortunately, we do not have a patch yet.</p>

<p>Its FOSS: The Raspberry Pi and its many clones have made the ARM platform very popular. Are there any plans to make MidnightBSD available on that platform?</p>

<p>Lucas Holt: No immediate plans. ARM is an interesting architecture, but by the very nature of SoC designs, takes a lot of work to support a broad number of devices. It might be possible when we stop supporting i386 or if someone volunteers to work on the ARM port.<br>
Eventually, I think most hobby systems will need to run ARM chips. Intels planning on locking down hardware with UEFI 3 and this may make it difficult to run on commodity hardware in the future not only for MidnightBSD but other systems as well.<br>
At one point, MidinightBSD ran on sparc64. When workstations were killed off, we dropped support. A desktop OS on a server platform makes little sense.</p>

<p>Its FOSS: Does MidnightBSD offer support for Linux applications?</p>

<p>Lucas Holt: Yes, we offer Linux emulation. Its emulating a 2.6.16 kernel currently and that needs to be updated so support newer apps. Its possible to run semi-recent versions of Firefox, Thunderbird, Java, and OpenOffice on it though. Ive also used it to host game servers in the past and play older games such as Quake 3, enemy territory, etc.</p>

<p>Its FOSS: Could you comment on the recent dust-up between the Pale Moon browser developers and the team behind the OpenBSD ports system?</p>
</blockquote>

<ul>
<li>[Authors Note: For those who havent heard about this, let me summarize. Last month, someone from the OpenBSD team added the Pale Moon browser to their ports collection. A Pale Moon developer demanded that they include Pale Moons libraries instead of using system libraries. As the conversation continued, it got more hostile, especially on the Pale Moon side. The net result is that Pale Moon will not be available on OpenBSD, MidnightBSD, or FreeBSD.]</li>
</ul>

<blockquote>
<p>Lucas Holt: I found this discussion frustrating. Many of the BSD projects hear a lot of complaints about browser availability and compatibility. With Firefox moving to Rust, it makes it even more difficult. Then you get into branding issues. Like Firefox, the Pale Moon developers have decided to protect their brand at the cost of users. Unlike the Firefox devs, theyve made even stranger requirements for branding. It is not possible to use a system library version of anything with Pale Moon and keep their branding requirements. As such, we cannot offer Pale Moon in MidnightBSD.<br>
The reason this is an issue for an open source project is that many third party libraries are used in something as complex as a web browser. For instance, Gecko-based browsers use several multimedia libraries, sqlite3 (for bookmarks), audio and video codecs, etc. Trying to maintain upstream patches for each of these items is difficult. Thats why the BSDs have ports collections to begin with. It allows us to track and manage custom patches to make all these libraries work. We go through a lot of effort in keeping these up to date. Sometimes upstream patches dont get included. That means our versions are the only working copies. With pale moons policy, wed need to submit separate patches to their customized versions of all these libraries too and any new release of the browser would not be available as changes occur. It might not even be possible to compile pale moon without a patch locally.<br>
With regard to Rust, it requires porting the language, as well as an appropriate version of LLVM before you can even start on the browser.</p>

<p>Its FOSS: If someone wanted to contribute to your project, both financial and technical, how can they do that?</p>

<p>Lucas Holt: Financial assistance for the project can be submitted online. We have a page outlining how to make donations with Patreon, Paypal or via bitcoin. Donations are not tax deductible. You can learn more at <a href="http://www.midnightbsd.org/donate/" rel="nofollow">http://www.midnightbsd.org/donate/</a><br>
We also need assistance with translations, porting applications, and working on the actual OS. Interested parties can contact us on the mailing list or through IRC on freenode #midnightbsd We also could use assistance with mirroring ISOs and packages.</p>

<p>I would like to thank Lucas for taking the time to reply to my many questions. For more information about MidnightBSD or to download it, please visit their website. The most recent version of MidnightBSD is 0.8.6.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://inflo.ws/blog/post/2018-03-03-trueos-8th-month-review/" rel="nofollow">8 months with TrueOS</a></h3>

<ul>
<li>Purpose of this review - what it is and what it is not.</li>
</ul>

<blockquote>
<p>I vowed to write down what I felt about TrueOS if I ever got to the six month mark of usage. This is just that. This is neither a tutorial, nor a piece of evangelism dedicated towards it.</p>

<p>This is also not a review of specific parts of TrueOS such as Lumina or AppCafe, since I don&#39;t use them at all.</p>

<p>In the spirit of presenting a screen shot, here is my i3wm displaying 4 windows in one screen - a configuration that I never use. <a href="https://inflo.ws/blog/images/trues-screenshot.png" rel="nofollow">https://inflo.ws/blog/images/trues-screenshot.png</a></p>
</blockquote>

<ul>
<li>The primary tasks I get done with my computer.</li>
</ul>

<blockquote>
<p>I need a tiling wm with multi-desktop capability. As regards what I do with a computer, it is fairly straightforward to describe if I just list down my most frequently used applications.</p>
</blockquote>

<pre><code>xterm (CLI)
Emacs (General editing and org mode)
Intellij IDEA (Java, Kotlin, SQL)
Firefox (Main web browser, with Multi-Account Containers)
Thunderbird (Work e-mail)
Notmuchmail (Personal e-mail)
Chromium/Iridium (Dumb web browser)
Telegram Desktop
weechat (with wee-slack)
cmus (Music player)
mpv (Video player)
mps-youtube (Youtube client)
transmission-gtk
Postgresql10 (daemon)
Rabbitmq (daemon)
Seafile (file sync)
Shotwell (manage pictures)
GIMP (Edit pictures)
Calibre (Manage e-books)
VirtualBox
</code></pre>

<blockquote>
<p>All of these are available as binary packages from the repository. Since I use Intellij Ultimate edition, I decided to download the no-jdk linux version from the website rather than install it. This would make sure that it gets updated regularly.</p>
</blockquote>

<ul>
<li>Why did I pick TrueOS ?</li>
</ul>

<blockquote>
<p>I ran various Linux distributions from 2001 all the way till 2009, till I discovered Arch, and continued with it till 2017. I tried out Void for two months before I switched to TrueOS.</p>

<p>Over the last few years, I started feeling like no matter which Linux distribution I touched, they all just stopped making a lot of sense. Generally in the way things were organised, and particularly in terms of software like systemd, which just got pushed down my throat. I couldn&#39;t wrap my head around half the things going on in my computer.</p>

<p>Mostly I found that Linux distributions stopped becoming a collection of applications that got developed together to something more coupled by software mechanisms like systemd - and that process was more and more opaque. I don&#39;t want to talk about the merits and de-merits of systemd, lets just say that I found it of no use and an unnecessary hassle.</p>

<p>In February, I found myself in charge of the entire technology stack of a company, and I was free to make choices. A friend who was a long time FreeBSD user convinced me to try it on the servers. My requirement then was to run Postgres, Rabbitmq, Nginx and a couple of JVM processes. The setup was zero hassle and it hasn&#39;t changed much in a year.</p>

<p>About three months of running FreeBSD-11.x on servers was enough for me to consider it for my laptop. I was very apprehensive of hardware support, but luckily my computer is a Thinkpad, and Thinkpads sort of work out of the box with various BSDs.</p>

<p>My general requirements were:</p>
</blockquote>

<ul>
<li>Must run Intellij IDEA.</li>
<li>Must have proper graphics and sound driver support.</li>
<li>Must be able to run VirtualBox.</li>
</ul>

<blockquote>
<p>I had to pick from FreeBSD, NetBSD and OpenBSD, since these were the major BSDs that I was familiar with. One of my requirements was that I needed to be able to run VMs just in case I needed to test something on Windows/Linux. This ruled out OpenBSD. Then I was left with NetBSD and FreeBSD. NetBSD&#39;s driver support for newer Intel chip-sets were questionable, and FreeBSD was the only choice then.</p>

<p>When I was digging through FreeBSD forums, I found out that running the 11.x RELEASE on my laptop was out of the question since it didn&#39;t have proper drivers for my chip-set either.</p>

<p>A few more hours of digging led me to GhostBSD and TrueOS. I picked TrueOS straightaway because - well because TrueOS came from the old PC-BSD and it was built off FreeBSD-12-CURRENT with the latest drivers integrated.</p>

<p>I downloaded the UNSTABLE version available in June 2017, backed up ALL my data and home directory, and then installed it. There were no glitches during installation - I simply followed the installation as described in the handbook and everything was fine.</p>

<p>My entire switch from Arch/Void to TrueOS took about an hour, discounting the time it took to backup my data to an external hard disk. It was that easy. Everything I wanted to work just worked, everything was available in the repo.</p>

<p>Tweaks from cooltrainer.org : I discovered this excellent tutorial that describes setting up a FreeBSD 11 desktop. It documents several useful tweaks, some of which I applied. A few examples - Fonts, VirtualBox, Firewall, UTF-8 sections.</p>
</blockquote>

<ul>
<li><p>TrueOS (and FreeBSD) specific things I liked</p>

<ul>
<li>Open-rc</li>
</ul></li>
</ul>

<blockquote>
<p>The open-rc init system is familiar and is well documented.<br>
TrueOS specific parts are described here.<br>
When I installed postgresql10-server, there was no open-rc script for it, but I could cobble one together in two hours with zero prior experience writing init scripts. Later on I figured out that the init script for postgresql9 would work for 10 as well, and used that.</p>
</blockquote>

<ul>
<li>Boot Environments</li>
</ul>

<blockquote>
<p>This was an alien concept to me, but the first time I did an update without waiting for a CDN sync to finish, my computer booted into the shell and remained there. The friendly people at TrueOS discourse asked me to roll back to an older BE and wait for sync to finish.<br>
I dug through the forums and found &quot;ZFS / Snapshots basics &amp; How-Tos for those new to TrueOS&quot;. This describes ZFS and BEs, and is well worth reading.</p>
</blockquote>

<ul>
<li>ZFS</li>
</ul>

<blockquote>
<p>My experience with boot environments was enough to convince me about the utility of ZFS. I am still reading about it and trying things out, and whatever I read just convinces me more about why it is good.</p>
</blockquote>

<ul>
<li>File-system layout</li>
</ul>

<blockquote>
<p>Coming from the Linux world, how the FreeBSD file-system is laid out seemed odd at first. Then I realised that it was the Linux distros that were doing the odd thing. e.g : The whole OS is split into base system and applications. All the non base system configurations and apps go into /usr/local. That made a lot of sense.<br>
The entire OS is developed along with its applications as a single coherent entity, and that shows.</p>
</blockquote>

<ul>
<li>Documentation</li>
</ul>

<blockquote>
<p>The handbooks for both TrueOS and FreeBSD are really really good. For e.g, I kept some files in an LUKS encrypted drive (when I used Arch Linux). To find an equivalent, all I had to do was read the handbook and look at the GELI section. It is actually nice being able to go to a source like Handbook and things from there just work.<br>
Arch Linux and Gentoo has excellent documentation as well, if anyone is wondering about Linux distros.</p>
</blockquote>

<ul>
<li>Community</li>
</ul>

<blockquote>
<p>The TrueOS community on both Telegram as well as on Discourse are very friendly and patient. They help out a lot and do not get upset when I pose really stupid questions. TrueOS core developers hangout in the Telegram chat-room too, and it is nice being able to talk to them directly about things.</p>
</blockquote>

<ul>
<li>What did not work in TrueOS ?</li>
</ul>

<blockquote>
<p>The following things that worked during my Linux tenure doesn&#39;t work in TrueOS.</p>
</blockquote>

<ul>
<li>Netflix</li>
<li>Google Hangouts</li>
<li>Electron based applications (Slack, Skype)</li>
</ul>

<blockquote>
<p>These are not major concerns for the kind of work I do, so it doesn&#39;t bother me much. I run a WinXP VM to play some old games, and a Bunsenlabs installation for Linux things like Hangouts/Netflix.</p>

<p>I don&#39;t have a video calling system setup in TrueOS because I use my phone for both voice and video calls exclusively.</p>
</blockquote>

<ul>
<li>Why am I staying on TrueOS ?</li>
</ul>

<blockquote>
<p>Great community - whether on Discourse or on the telegram channel, the people make you feel welcome. If things go unanswered, someone will promise to work on it/file a bug/suggest work-arounds.</p>

<p>Switching to TrueOS was philosophical as well - I thought a lot more about licenses, and I have arrived at the conclusion that I like BSD more than GPL. I believe it is a more practical license.</p>

<p>I believe TrueOS is improving continuously, and is a great desktop UNIX if you put some time into it.</p>
</blockquote>

<hr>

<h3><a href="https://www.youtube.com/playlist?list=PLnTFqpZk5ebD-FfVScL-x6ZnZSecMA1jI" rel="nofollow">AsiaBSDCon 2016 videos now available</a></h3>

<ul>
<li>The videos from AsiaBSDCon 2016 have been posted to youtube, 30 videos in all</li>
<li>Well cover the videos from 2017 next week</li>
<li>The videos from 2018 should be posted in 4-6 weeks</li>
<li>I are working on a new version of <a href="https://papers.freebsd.org/" rel="nofollow">https://papers.freebsd.org/</a> that will make it easier to find the papers, slides, and videos of all talks related to FreeBSD
***</li>
</ul>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180307234243" rel="nofollow">syspatches will be provided for both supported releases</a></h3>

<blockquote>
<p>Good news for people doing upgrades only once per year: syspatches will be provided for both supported releases. The commit from T.J. Townsend (tj@) speaks for itself:</p>
</blockquote>

<pre><code>Subject:    CVS: cvs.openbsd.org: www
From:       T.J. Townsend &lt;tj () openbsd ! org&gt;
Date:       2018-03-06 22:09:12

CVSROOT:    /cvs
Module name:    www
Changes by: tj@cvs.openbsd.org  2018/03/06 15:09:12

Modified files:
    .              : errata61.html stable.html 
    faq            : faq10.html 

Log message:
syspatches will now be provided for both supported releases.
</code></pre>

<blockquote>
<p>Thanks to all the developers involved in providing these!</p>
</blockquote>

<ul>
<li>Update: An official announcement has been released:</li>
</ul>

<pre><code>I&#39;m happy to announce that we are now able to provide two releases worth
of syspatches on the amd64 and i386 platforms. The binary patches for
6.1 will hit the mirrors shortly, so you will be able to catch up with
the errata on

   https://www.openbsd.org/errata61.html

using the syspatch utility. People running amd64 will thus get the
meltdown workaround.

This means in particular that 6.2 will remain supported by syspatch when
6.3 comes out.

Thanks to robert and ajacoutot for their amazing work on syspatch and
for all their help. Thanks also to tj and the volunteers from #openbsd
for their timely tests and of course to Theo for overseeing it all.
</code></pre>

<hr>

<h3><a href="https://www.lorainekv.com/permutations_split_and_gsplit/" rel="nofollow">Exploring permutations and a mystery with BSD and GNU split filenames</a></h3>

<blockquote>
<p>Recently, I was playing around with the split command-line tool on Mac OS X, and I decided to chop a 4000-line file into 4000 separate single-line files. However, when I attempted to run split -l1, I ran into a funny error:</p>
</blockquote>

<p><code>split: too many files</code></p>

<blockquote>
<p>Curious to see if any splitting had occurred, I ran ls and sure enough, a huge list of filenames appeared, such as:</p>
</blockquote>

<pre><code>xaa
xab
...
xzy
xzz
</code></pre>

<blockquote>
<p>Now I could see why you&#39;d run out of unique filenames - there are only 26 letters in the alphabet and these filenames were only three letters long. Also, they all seemed to begin with the letter &quot;x&quot;.</p>
</blockquote>

<ul>
<li>BSD split&#39;s filename defaults</li>
</ul>

<blockquote>
<p>I checked the manual for split&#39;s defaults and confirmed what I was seeing:</p>

<p>each file into which the file is split is named by the prefix followed by a lexically ordered suffix using suffix_length characters in the range &#39;a-z&#39;. If -a is not specified, two letters are used as the suffix....with the prefix &#39;x&#39; and with suffixes as above.</p>

<p>Got it, so running split with the defaults for prefix name and suffix length will give me filenames that always start with the letter &quot;x&quot; followed by two-letter alphabetical permutations composed of a-z letters, with repeats allowed. I say &quot;repeats allowed&quot; because I noticed filenames such as xaa and xbb in the output.</p>

<p>Side node: The reason why I say &quot;permutations&quot; rather than &quot;combinations&quot; is because letter order matters. For example, xab and xba are two distinct and legitimate filenames. Here&#39;s a nice explanation about the difference between permutations and combinations.</p>
</blockquote>

<ul>
<li>Some permutation math</li>
</ul>

<blockquote>
<p>So how many filenames can you get from the BSD split tool using the defaults? There are permutation formulas out there for repeating values and non-repeating values. Based on split&#39;s behavior, I wanted to use the repeating values formula:</p>

<p>n<sup>r</sup> where n equals the number of possible values (26 for a-z) and r equals the number of values (2, since there are only 2 letters after &quot;x&quot; in the filename).</p>

<p>26<sup>2</sup> = 676</p>

<p>So the total number of filename permutations allowed with BSD split&#39;s defaults should be 676.</p>

<p>To double check, I ran ls | wc -l to get the total number of files in my split_test directory. The output was 677. If you subtract my original input file, input.txt, then you have 676, or the number of permutations split would allow before running out of filenames!</p>

<p>Neat. But I still wanted my 4000 files.</p>
</blockquote>

<ul>
<li>Moar permutations pls</li>
</ul>

<blockquote>
<p>While 26<sup>2</sup> permutations doesn&#39;t support 4000 different filenames, I wondered if I could increase r to 3. Then, I&#39;d have 17,576 different filename permutations to play with - more than enough.</p>

<p>Earlier, I remembered the manual mentioning suffix length:</p>

<p>-a suffix_length<br>
Use suffix_length letters to form the suffix of the file name.</p>

<p>So I passed 3 in with the -a flag and guess what? I got my 4000 files!</p>
</blockquote>

<pre><code>split -l1 -a3 input.txt 
ls | wc -l
4001
</code></pre>

<blockquote>
<p>But that was a lot of work. It would be great if split would just handle these permutations and suffix lengths by default!</p>

<p>In fact, I vaguely remember splitting large files into smaller ones with numerical filenames, which I prefer. I also remember not having to worry about suffixes in the past. But numerical filenames didn&#39;t seem to be an option with split installed on Mac OS X - there was no mention of it in the manual.</p>

<p>Turns out that I was remembering GNU split from using the Debian OS two years ago, a different flavor of the split tool with different defaults and behaviors.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://blather.michaelwlucas.com/archives/3121" rel="nofollow">Michael Lucas is speaking at mug.org 10 April 2018</a><br>
<a href="http://pkgsrc.org/pkgsrcCon/2018/" rel="nofollow">PkgsrcCon 2018 July 7+8 Berlin</a><br>
<a href="http://www.vincentdelft.be/post/post_20180310" rel="nofollow">Tint2 rocks</a><br>
<a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/open-source-summit-europe-2018-call-for-proposals/" rel="nofollow">Open Source Summit Europe 2018 Call for Proposals</a><br>
<a href="https://www.freebsdfoundation.org/blog/bsdcan-2018-travel-grant-application-now-open/" rel="nofollow">Travel Grants for BSDCan 2018</a><br>
<a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/bsdcan-2018-freebsd-developers-summit-call-for-proposals/" rel="nofollow">BSDCan 2018 FreeBSD Developers Summit Call for Proposals</a><br>
<a href="https://www.openbsd.org/papers/asiabsdcon2018-vmm-slides.pdf" rel="nofollow">OpenBSD vmm(4) update, by Mike Larkin</a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="http://dpaste.com/3NZN49P#wrap" rel="nofollow">Morgan ZFS Install Question</a></p></li>
<li><p><a href="http://dpaste.com/3V09BZ5#wrap" rel="nofollow">Andre - Splitting ZFS Array, or not</a></p></li>
<li><p><a href="http://dpaste.com/2CY5MRE#wrap" rel="nofollow">Jake - Python Projects</a></p></li>
<li><p><a href="http://dpaste.com/257WGCB#wrap" rel="nofollow">Dave - Screen Sharing &amp; Video Conference</a></p></li>
<li><p><a href="http://dpaste.com/3HAPZ90#wrap" rel="nofollow">James - ZFS disk id switching</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>236: How a cd works</title>
  <link>https://www.bsdnow.tv/236</link>
  <guid isPermaLink="false">2b307489-eb54-4432-8391-e65980da511d</guid>
  <pubDate>Wed, 07 Mar 2018 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2b307489-eb54-4432-8391-e65980da511d.mp3" length="87714580" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We’ll cover OpenBSD’s defensive approach to OS security, help you  Understanding Syscall Conventions for Different Platforms, Mishandling SMTP Sender Verification, how the cd command works, and the LUA boot loader coming to FreeBSD.</itunes:subtitle>
  <itunes:duration>2:01:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We’ll cover OpenBSD’s defensive approach to OS security, help you  Understanding Syscall Conventions for Different Platforms, Mishandling SMTP Sender Verification, how the cd command works, and the LUA boot loader coming to FreeBSD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Pledge: OpenBSD’s defensive approach to OS Security (https://medium.com/@_neerajpal/pledge-openbsds-defensive-approach-for-os-security-86629ef779ce)
The meaning of Pledge is same as in the real world, that is, “a solemn promise or undertaking”.
So, in OpenBSD: Calling pledge in a program means to promise that the program will only use certain resources.
How does it make a program more secure?
It limits the operation of a program. Example: You wrote a program named ‘abc’ that only needed the stdio to just print something to stdout.
You added pledge to use only stdio and nothing else.
Then, a malicious user found out that there is a vulnerability in your program which one can exploit and get into shell (or root shell).
Exploiting your program to open a shell (or root shell) will result in the kernel killing the process with SIGABRT (which cannot be caught/ignored) and will generate a log (which you can find with dmesg).
This happens because before executing other codes of your program, the code first pledges not to use anything other than stdio promise/operations. But, opening a shell or root shell will call several other system-calls which are distributed in lots of other promises like “stdio”, “proc”, “exec” etc. They are all forbidden because the program has already promised not to use any promises other than stdio.
Pledge is not a system call filter. So, it is not used to restrict system calls.
For example,
pledge(“read”,NULL) ? wrong syntax of the pledge()
pledge(“stdio inet”,NULL) ? correct syntax of the pledge()
Pledge works on stdio, dns, inet, etc. promises but not directly on system calls like read, write, etc. And, unique functionality of pledge() is that it works on behavioral approach not just like 1:1 approach with the system calls.
On 11 December 2017, Theo de Raadt said:

List: openbsd-tech
Subject: pledge execpromises
From: Theo de Raadt 
Date: 2017–12–11 21:20:51
Message-ID: 6735.1513027251 () cvs ! openbsd ! org
This will probably be committed in the next day or so.
The 2nd argument of pledge() becomes execpromises, which is what
will gets activated after execve.
There is also a small new feature called “error”, which causes
violating system calls to return -1 with ENOSYS rather than killing
the process. This must be used with EXTREME CAUTION because libraries
and programs are full of unchecked system calls. If you carry on past
one of these failures, your program is in uncharted territory and
risks of exploitation become high.
“error” is being introduced for a different reason: The pre-exec
process’s expectation of what the post-exec process will do might
mismatch, so “error” allows things like starting an editor which has
no network access or maybe other restrictions in the future…

Every Journey Starts with a FAIL...or Understanding Syscall Conventions for Different Platforms (http://k3research.outerhaven.de/posts/every-journey-starts-with-a-fail.html)
Introduction
Not long ago I started looking into FreeBSD kernel exploitation. There are only a few resources but probably the best starting point is argp's Phrack article from 2009[0]. And while he does only provide one technique, I wanted to understand it and port it to a modern FreeBSD release before describing new, own researched techniques.
Well, at least this was my plan. In reality I ended researching how different operating systems resp. the same operating system but for different architectures implement syscalls. Hence, new exploiting methods have to wait for another post. In this one I want to describe my personal FAIL while porting argp's exploit example to a FreeBSD 11.1-RELEASE running on a 64bit processor. Maybe this will give other people interested in kernel stuff some insights they didn't know before. If you already know how syscalls work on 32bit and 64bit *BSD because you are an experienced exploit or kernel developer, you will probably want to search for something
else to read. Moreover, some of the debugging stuff can look laborious because I wanted to show the steps I have done while attacking my problem instead of showing a simple walkthrough to the solution.
The Problem
argp described in his article vulnerable code consisting of a loadable kernel module which exposes a syscall to the userland. Because it was written around the time when FreeBSD 8-RELEASE came out and because he has written himself that the code needs smaller adjustments to work with this version (it was written for FreeBSD 7) I thought I will first port it to
FreeBSD 11.1-RELEASE. Moreover it was written for an Intel 32bit processor architecture as we can see from his shellcode examples. Hence, I wanted to go right away the harder way and modify it to work on an 64bit processor.
Why the Original Code Worked While It Was Wrong
As written above, the syscall convention for the 32bit architecture is different from the one for the 64bit architecture. Indeed, a syscall on a 32bit FreeBSD system passes the arguments via the stack while the syscall offset is stored in the EAX register. The transfer into the kernel address space is done in 'cpufetchsyscall_args' in 'sys/i386/i386/trap.c'.
```
int
cpufetchsyscallargs(struct thread *td, struct syscallargs *sa)
{
    ...
    frame = td-&amp;gt;td_frame;
params = (caddr_t)frame-&amp;gt;tf_esp + sizeof(int);
sa-&amp;gt;code = frame-&amp;gt;tf_eax;

...

if (params != NULL &amp;amp;&amp;amp; sa-&amp;gt;narg != 0)
    error = copyin(params, (caddr_t)sa-&amp;gt;args,
        (u_int)(sa-&amp;gt;narg * sizeof(int)));
else
...
}
```
That is, 'params' points to ESP+4 bytes offset. Later, the arguments are copied into the kernel space which is referenced by 'sa-&amp;gt;args'. 'args' is an array of eight 'registert' which is defined as 'int32t' on the 32bit platform in comparison to the 64bit platform. And as 'struct args' only
consisted of integers they got copied into the syscall arguments which are given to the trigger function inside the kernel module. We could verify this by changing 'int op' to 'long long op' in the kernel module and in trigger.c. We get the following output:

root@freebsd64:trigger/ # ./trigger
0x28414000
256
3
1
0x28414000
256
4294967295
2
root@freebsd64:trigger/ #

To bring this to an end: argp's version only worked for his special choice of arguments and only on 32bit. On 32bit FreeBSD platforms the arguments are transferred into kernel space by 4 byte integers, hence it will only work for integers anyway. On 64bit FreeBSD platforms we have to use syscall(2) in the intended way.
iXsystems
New Disks! (https://www.ixsystems.com/blog/gdpr-countdown/)
A Life Lesson in Mishandling SMTP Sender Verification (https://bsdly.blogspot.co.uk/2018/02/a-life-lesson-in-mishandling-smtp.html)
It all started with one of those rare spam mails that got through.
This one was hawking address lists, much like the ones I occasionally receive to addresses that I can not turn into spamtraps. The message was addressed to, of all things, root@skapet.bsdly.net. (The message with full headers has been preserved here for reference).
Yes, that's right, they sent their spam to root@. And a quick peek at the headers revealed that like most of those attempts at hawking address lists for spamming that actually make it to a mailbox here, this one had been sent by an outlook.com customer.
The problem with spam delivered via outlook.com is that you can't usefully blacklist the sending server, since the largish chunk of the world that uses some sort of Microsoft hosted email solution (Office365 and its ilk) have their usually legitimate mail delivered via the very same infrastructure.
And since outlook.com is one of the mail providers that doesn't play well with greylisting (it spreads its retries across no less than 81 subnets (the output of 'echo outlook.com | doas smtpctl spf walk' is preserved here), it's fairly common practice to just whitelist all those networks and avoid the hassle of lost or delayed mail to and from Microsoft customers.
I was going to just ignore this message too, but we've seen an increasing number of spammy outfits taking advantage of outlook.com's seeming right of way to innocent third parties' mail boxes.
So I decided to try both to do my best at demoralizing this particular sender and alert outlook.com to their problem. I wrote a messsage (preserved here) with a Cc: to abuse@outlook.com where the meat is,
```
Ms Farell,
The address root@skapet.bsdly.net has never been subscribed to any mailing list, for obvious reasons. Whoever sold you an address list with that address on it are criminals and you should at least demand your money back.
Whoever handles abuse@outlook.com will appreciate the attachment, which is a copy of the message as it arrived here with all headers intact.
Yours sincerely,
Peter N. M. Hansteen
```
What happened next is quite amazing.
If my analysis is correct, it may not be possible for senders who are not themselves outlook.com customers to actually reach the outlook.com abuse team.
Any student or practitioner of SMTP mail delivery should know that SPF records should only happen on ingress, that is at the point where the mail traffic enters your infrastructure and the sender IP address is the original one. Leave the check for later when the message may have been forwarded, and you do not have sufficient data to perform the check.
Whenever I encounter incredibly stupid and functionally destructive configuration errors like this I tend to believe they're down to simple incompetence and not malice.
But this one has me wondering. If you essentially require incoming mail to include the contents of spf.outlook.com (currently no less than 81 subnets) as valid senders for the domain, you are essentially saying that only outlook.com customers are allowed to communicate.
If that restriction is a result of a deliberate choice rather than a simple configuration error, the problem moves out of the technical sphere and could conceivably become a legal matter, depending on what outlook.com have specified in their contracts that they are selling to their customers.
But let us assume that this is indeed a matter of simple bad luck or incompetence and that the solution is indeed technical.
I would have liked to report this to whoever does technical things at that domain via email, but unfortunately there are indications that being their customer is a precondition for using that channel of communication to them.
I hope they fix that, and soon. And then move on to terminating their spamming customers' contracts.
The main lesson to be learned from this is that when you shop around for email service, please do yourself a favor and make an effort to ensure that your prospective providers actually understand how the modern-ish SMTP addons SPF, DKIM and DMARC actually work.
Otherwise you may end up receiving more of the mail you don't want than what you do want, and your own mail may end up not being delivered as intended.
News Roundup
Running Salt Proxy Minions on OpenBSD (https://mirceaulinic.net/2018-02-14-openbsd-salt-proxy/)
As I have previously attempted several times in the past, I am (finally) very close to switch to OpenBSD, a more stable and reliable operating system that I like. Before starting to make the actual change on both personal and work computer, I started testing some of the tools I’m currently using, and understand what are the expectations.
In general I didn’t encounter issues, or when I did, I found the answers in the documentation (which is really great), or various forums. I didn’t find however any questions regarding Proxy Minions on OpenBSD which is why I thought it might be helpful to share my experience.
Installation and Startup
With these said, I started playing with Salt, and it was simple and straightforward. First step - install Salt: pkg_add salt. This will bring several ports for Python futures, ZeroMQ, or Tornado which are needed for Salt.
After configuring the pillar_roots in the /etc/salt/master config file for the Master, I started up the master process using rcctl:
Starting up the Proxy Minions
The Salt package for OpenBSD comes with the rc file for salt-proxy as well, /etc/rc.d/salt_proxy
While typically you run a single regular Minion on a given machine, it is very like that there are multiple Proxy processes. Additionally, the default Salt rc file has the following configuration for the salt-proxy daemon:
Starting many Proxy Minions
I have managed to startup a Proxy Minion, but what about many? Executing the three commands above for each and every device is tedious and cannot scale very well. I thus have figured the following way:
Have a separate rc file per Proxy, each having the daemon instruction explicitly specifying its Minion ID
Start the service (using the regular Minion that controls the machine where the Proxy processes are running)
And the test Proxy Minion is then up (after accepting the key, i.e,, salt-key -a test)
Extending the same to a (very) large number of Proxy Minions, you can easily manage the rc files and start the services using a Salt State executed on the regular Minion:
Using the file.managed State function to generate the contents of the rc file for each Proxy, with its own Minion ID.
Using the service.running State function start the service.
These two steps would suffice to start an arbitrary number of Proxy Minions, and the command executed will always be the same regardless how many processes you aim to manage.
Conclusions
I am still a novice when it comes to OpenBSD, I have plenty to learn, but it looks like the transition will be much smoother than I expected. I am already looking forward to the handover, and - most importantly - I will no longer be using systemd. :-)
LUA boot loader coming very soon (https://lists.freebsd.org/pipermail/freebsd-current/2018-February/068464.html)
As you may know, the Lua (http://www.lua.org) boot loader has been in the works for some time. It started out life as a GSoC in 2014 by Pedro Souza mentored by Wojciech A. Koszek. Rui Paulo created a svn project branch to try to integrate it. I rebased that effort into a github branch which Pedro Arthur fixed up. Over the past year, I've been cleaning up the boot loader
for other reasons, and found the time was ripe to start integrating this into the tree. However, those integration efforts have taken a while as my day-job work on the boot loader took priority. In the mean time, Ed Maste and the FreeBSD Foundation funded Zakary Nafziger to enhance the original GSoC Lua scripts to bring it closer to parity with the evolution of the FORTH menu system since the GSoC project started.
I'm pleased to announce that all these threads of development have converged and I'll be pushing the FreeBSD Lua Loader later today. This loader uses Lua as its scripting language instead of FORTH. While co-existance is planned, the timeline for it is looking to be a few weeks
and I didn't want to delay pushing this into the tree for that.
To try the loader, you'll need to build WITHOUTFORTH=yes and WITHLOADERLUA=yes. Fortunately, you needn't do a full world to do this, you can do it in src/stand and install the result (be sure to have the options for both the build and the install). This will replace your current
/boot/loader that is scripted with FORTH to one that's scripted with Lua.
It will install the lua scripts in /boot/lua. The boot is scripted with /boot/lua/loader.lua instead of /boot/loader.rc. You are strongly advised to create a backup copy of /boot/loader before testing (eg cp /boot/loader /boot/loaderforth), since you'll need to boot that from boot2 if something
goes wrong. I've tested it extensively, though, with userboot.so and it's test program, so all the initial kinks of finding the lua scripts, etc have been worked out.
While it's possible to build all the /boot/loader variants with Lua, I've just tested a BIOS booting /boot/loader both with and without menus enabled. I've not tested any of the other variants and the instructions for testing some of them may be rather tedious (especially UEFI, if you want a
simple path to back out). Since there's not been full convergence testing, you'll almost certainly find bumps in this system. Also, all the build-system APIs are likely not yet final.
I put  MFC after a month on the commit. Due to the heroic (dare I say almost crazy) work of Kyle Evans on merging all the revs from -current to 11, I'm planning a MFC to 11 after the co-existence issues are hammered out. In 11, FORTH will be the default, and Lua will  be built by default, but users will have to do something to use it. 12, both FORTH and Lua will be built and installed, with Lua as default (barring unforeseen complications). Once the co-existence stuff goes in, I imagine we'll make the switch to Lua by default shortly after that. In 13, FORTH will be removed unless there's a really really compelling case made to keep it.
So please give it a spin and give me any feedback, documentation updates and/or bug fixes. I'm especially interested in reviews from people that have embedded Lua in other projects or experts in Lua that can improve the robustness of the menu code.
Bitcoin Full Node on FreeBSD (https://bsdmag.org/5374-2/)
What is a Bitcoin ?
Bitcoin is a valuable popular open-source cryptocurrency that was invented by Satoshi Nakamoto in 2009. Bitcoins have value because they possess same characteristics like money (durability, portability, fungibility, scarcity, divisibility, and recognizability), but based on the properties of mathematics rather than on physical properties (like gold and silver) or trust in central authorities (like fiat currencies). In short, Bitcoin is backed by mathematics.
Bitcoin is the first decentralized peer-to-peer cryptocurrency that is controlled by its users.
Transactions take place directly between users, and are later verified by network nodes with digital signature and then placed in a public distributed ledger called a blockchain. Bitcoin is unique in that only 21 million bitcoins will ever be created. The unit of the bitcoin system is bitcoin or mBTC.
What is a Bitcoin Wallet ?
A wallet is nothing more than a pair of public and private keys that are created by a client to store the digital credentials for your bitcoin.
There are several types of wallets:

Desktop Wallet
Token Wallet
Online Wallet
Mobile Wallet
A token wallet is the safest way to work with bitcoin network, but you can use your mobile or pc as a bitcoin wallet.

What is a Blockchain?
A blockchain is a ledger that records bitcoin transactions. The blockchain is a distributed database that achieves independent verification of the chain of ownership. Each network node stores its own copy of the blockchain. Transactions will broadcast on the bitcoin network, and about 2400 transactions create a block. These blocks are building blocks of the blockchain.
What is Mining?
Mining is the process of dedicating computing power to process transactions, secure the network, and keep everyone in the system synchronized together. It has been designed to be fully decentralized.
Miners need mining software with specialized hardware. Mining software listens for transactions broadcasted through the peer-to-peer network and performs appropriate tasks to process and confirm these transactions. Bitcoin miners perform this work because they can earn transaction fees paid by users for faster transaction processing.
New transactions have to be confirmed then be included in a block along with a mathematical proof of work. Such proofs are very hard to generate because there is no way to create them other than by trying billions of calculations per second. Hence, miners are required to perform these calculations before their blocks are accepted by the network and before they are rewarded. As more people start to mine, the difficulty of finding valid blocks is automatically increased by the network to ensure that the average time to find a block remains equal to 10 minutes. As a result, mining is a very competitive business where no individual miner can control what is included in the blockchain.
The proof of work is also designed to depend on the previous block to force a chronological order in the blockchain. This makes it exponentially difficult to reverse previous transactions because it would require the recalculation of the proofs of work of all the subsequent blocks. When two blocks are found at the same time, miners work on the first block they receive and switch to the longest chain of blocks as soon as the next block is found. This allows mining to secure and maintain a global consensus based on processing power.
What is Pooled Mining?
You have more chances if you participate with others to create a block. In a pool, all participating miners get paid every time a participating server solves a block. The payment depends on the amount of work an individual miner contributed to help find that block.
What is a Full Node?
A full node is a client that fully validates transactions and blocks. Full nodes also help the network by accepting transactions and blocks from other full nodes, validating those transactions and blocks, and then relaying them to further full nodes.
Many people and organizations volunteer to run full nodes using spare computing and bandwidth resources.
What is a Bitcoind?
bitcoind is a Bitcoin client under the MIT license in 32-bit and 64-bit versions for Windows, GNU/Linux-based OSes, Mac OS X, OpenBSD and FreeBSD as well.
Conclusion
Cryptocurrencies are replacement for banking we know today, and bitcoin is the game changer. Mining bitcoin with typical hardware is not a good idea. It needs specialized devices like ASIC, but you can create a full node and help the bitcoin network.
Useful Links
https://en.wikipedia.org/wiki/Cryptocurrency
https://bitcoin.org/en/faq
***
Latest DRM Graphics work
The DRM Graphics stack from Linux is ported to FreeBSD on an ongoing basis to provide support for accelerated graphics for Intel and AMD GPUs.
The LinuxKPI bits that the drm-next-kmod driver port depends on have been merged into stable/11 and will be included as part of the upcoming FreeBSD 11.2  (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=462202)
Additionally, the version of the drives has been updated from Linux 4.9 to Linux 4.11 with a number of additional devices being supported (https://lists.freebsd.org/pipermail/freebsd-current/2018-February/068690.html)
***
How does cd work? (https://blog.safia.rocks/post/171311670379/how-does-cd-work)
In my last blog post, I dove into some of the code behind the sudo command. I thought this was pretty fun. sudo is one of those commands that I use quite often but haven’t had the chance to look into truly. I started thinking about other commands that I use on a daily basis but had little understanding of the internals of. The first command that came to mind is cd. cd stands for change directory. Simply put, it allows you to set your current working directory to a different directory.
I read through some of the code that was defined in this file. Some of it was in functions, and other bits were in templates, but after a while, I figured that most of the code was a wrapper around a function called chdir. A lot of the functions defined in the cd.def file linked above actually just invoke chdir and handle errors and parameter cleaning.
So all in all, here is what happens when you run cd on the command line.
The cd builtin is invoked as part of the Bash shell.
The Bash shell invokes the chdir function.
The chdir function is part of Unix and invokes the chdir system call.
The Unix kernel executes the chdir call and does its own low-level thing.
I could dive in a little bit more into how #4 works, but let’s be honest, I’ve already read too much code at this point, and my eyes are starting to hurt.
Beastie Bits
Stockholm BSD User Group: March 22 (https://www.meetup.com/BSD-Users-Stockholm/events/247552279/)
Open Source Hardware Camp 2018 (30/06 &amp;amp; 01/07) Call for Participation (http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-February/014182.html)
Initial release schedule announcement for FreeBSD 11.2 (https://www.freebsd.org/releases/11.2R/schedule.html)
Serious Shell Programming (Devin Teske) (https://www.gitbook.com/book/freebsdfrau/serious-shell-programming/details)
SSH Mastery 2/e out (https://blather.michaelwlucas.com/archives/3115)
TCP Fast Open client side lands in FreeBSD  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=330001)
Help the Tor BSD Project increase the OS diversity of Tor nodes, for your own safety, and everyone else's  (https://torbsd.org/open-letter.html)
5 Differences Between TrueOS &amp;amp; Linux (https://www.kompulsa.com/2018/02/23/5-differences-trueos-linux/)
***
Feedback/Questions
Ambrose - Bunch of questions (http://dpaste.com/0KRRG18#wrap)
Eddy - ZFSoL with single SSD (http://dpaste.com/0MTXYJN#wrap)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Well cover OpenBSDs defensive approach to OS security, help you  Understanding Syscall Conventions for Different Platforms, Mishandling SMTP Sender Verification, how the cd command works, and the LUA boot loader coming to FreeBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://medium.com/@_neerajpal/pledge-openbsds-defensive-approach-for-os-security-86629ef779ce" rel="nofollow">Pledge: OpenBSDs defensive approach to OS Security</a></h3>

<blockquote>
<p>The meaning of Pledge is same as in the real world, that is, a solemn promise or undertaking.</p>

<p>So, in OpenBSD: Calling pledge in a program means to promise that the program will only use certain resources.</p>
</blockquote>

<ul>
<li>How does it make a program more secure?</li>
</ul>

<blockquote>
<p>It limits the operation of a program. Example: You wrote a program named abc that only needed the stdio to just print something to stdout.</p>
</blockquote>

<ul>
<li>You added pledge to use only stdio and nothing else.</li>
<li>Then, a malicious user found out that there is a vulnerability in your program which one can exploit and get into shell (or root shell).</li>
<li>Exploiting your program to open a shell (or root shell) will result in the kernel killing the process with SIGABRT (which cannot be caught/ignored) and will generate a log (which you can find with dmesg).</li>
</ul>

<blockquote>
<p>This happens because before executing other codes of your program, the code first pledges not to use anything other than stdio promise/operations. But, opening a shell or root shell will call several other system-calls which are distributed in lots of other promises like stdio, proc, exec etc. They are all forbidden because the program has already promised not to use any promises other than stdio.</p>

<p>Pledge is not a system call filter. So, it is not used to restrict system calls.<br>
For example,</p>
</blockquote>

<ul>
<li>pledge(read,NULL) ? wrong syntax of the pledge()</li>
<li>pledge(stdio inet,NULL) ? correct syntax of the pledge()</li>
</ul>

<blockquote>
<p>Pledge works on stdio, dns, inet, etc. promises but not directly on system calls like read, write, etc. And, unique functionality of pledge() is that it works on behavioral approach not just like 1:1 approach with the system calls.</p>

<p>On 11 December 2017, Theo de Raadt said:</p>
</blockquote>

<pre><code>List: openbsd-tech
Subject: pledge execpromises
From: Theo de Raadt &lt;deraadt () openbsd ! org&gt;
Date: 20171211 21:20:51
Message-ID: 6735.1513027251 () cvs ! openbsd ! org
This will probably be committed in the next day or so.
The 2nd argument of pledge() becomes execpromises, which is what
will gets activated after execve.
There is also a small new feature called error, which causes
violating system calls to return -1 with ENOSYS rather than killing
the process. This must be used with EXTREME CAUTION because libraries
and programs are full of unchecked system calls. If you carry on past
one of these failures, your program is in uncharted territory and
risks of exploitation become high.
error is being introduced for a different reason: The pre-exec
processs expectation of what the post-exec process will do might
mismatch, so error allows things like starting an editor which has
no network access or maybe other restrictions in the future
</code></pre>

<hr>

<h3><a href="http://k3research.outerhaven.de/posts/every-journey-starts-with-a-fail.html" rel="nofollow">Every Journey Starts with a FAIL...or Understanding Syscall Conventions for Different Platforms</a></h3>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
<p>Not long ago I started looking into FreeBSD kernel exploitation. There are only a few resources but probably the best starting point is argp&#39;s Phrack article from 2009[0]. And while he does only provide one technique, I wanted to understand it and port it to a modern FreeBSD release before describing new, own researched techniques.</p>

<p>Well, at least this was my plan. In reality I ended researching how different operating systems resp. the same operating system but for different architectures implement syscalls. Hence, new exploiting methods have to wait for another post. In this one I want to describe my personal FAIL while porting argp&#39;s exploit example to a FreeBSD 11.1-RELEASE running on a 64bit processor. Maybe this will give other people interested in kernel stuff some insights they didn&#39;t know before. If you already know how syscalls work on 32bit and 64bit *BSD because you are an experienced exploit or kernel developer, you will probably want to search for something<br>
else to read. Moreover, some of the debugging stuff can look laborious because I wanted to show the steps I have done while attacking my problem instead of showing a simple walkthrough to the solution.</p>
</blockquote>

<ul>
<li>The Problem</li>
</ul>

<blockquote>
<p>argp described in his article vulnerable code consisting of a loadable kernel module which exposes a syscall to the userland. Because it was written around the time when FreeBSD 8-RELEASE came out and because he has written himself that the code needs smaller adjustments to work with this version (it was written for FreeBSD 7) I thought I will first port it to<br>
FreeBSD 11.1-RELEASE. Moreover it was written for an Intel 32bit processor architecture as we can see from his shellcode examples. Hence, I wanted to go right away the harder way and modify it to work on an 64bit processor.</p>
</blockquote>

<ul>
<li>Why the Original Code Worked While It Was Wrong</li>
</ul>

<blockquote>
<p>As written above, the syscall convention for the 32bit architecture is different from the one for the 64bit architecture. Indeed, a syscall on a 32bit FreeBSD system passes the arguments via the stack while the syscall offset is stored in the EAX register. The transfer into the kernel address space is done in &#39;cpu_fetch_syscall_args&#39; in &#39;sys/i386/i386/trap.c&#39;.</p>
</blockquote>

<pre><code>int
cpu_fetch_syscall_args(struct thread *td, struct syscall_args *sa)
{
    ...
    frame = td-&gt;td_frame;

    params = (caddr_t)frame-&gt;tf_esp + sizeof(int);
    sa-&gt;code = frame-&gt;tf_eax;

    ...

    if (params != NULL &amp;&amp; sa-&gt;narg != 0)
        error = copyin(params, (caddr_t)sa-&gt;args,
            (u_int)(sa-&gt;narg * sizeof(int)));
    else
    ...
}
</code></pre>

<blockquote>
<p>That is, &#39;params&#39; points to ESP+4 bytes offset. Later, the arguments are copied into the kernel space which is referenced by &#39;sa-&gt;args&#39;. &#39;args&#39; is an array of eight &#39;register_t&#39; which is defined as &#39;int32_t&#39; on the 32bit platform in comparison to the 64bit platform. And as &#39;struct args&#39; only<br>
consisted of integers they got copied into the syscall arguments which are given to the trigger function inside the kernel module. We could verify this by changing &#39;int op&#39; to &#39;long long op&#39; in the kernel module and in trigger.c. We get the following output:</p>
</blockquote>

<pre><code>root@freebsd64:trigger/ # ./trigger
0x28414000
256
3
1
0x28414000
256
4294967295
2
root@freebsd64:trigger/ #
</code></pre>

<blockquote>
<p>To bring this to an end: argp&#39;s version only worked for his special choice of arguments and only on 32bit. On 32bit FreeBSD platforms the arguments are transferred into kernel space by 4 byte integers, hence it will only work for integers anyway. On 64bit FreeBSD platforms we have to use syscall(2) in the intended way.</p>
</blockquote>

<hr>

<h3>iXsystems</h3>

<ul>
<li><a href="https://www.ixsystems.com/blog/gdpr-countdown/" rel="nofollow">New Disks!</a></li>
</ul>

<h3><a href="https://bsdly.blogspot.co.uk/2018/02/a-life-lesson-in-mishandling-smtp.html" rel="nofollow">A Life Lesson in Mishandling SMTP Sender Verification</a></h3>

<blockquote>
<p>It all started with one of those rare spam mails that got through.</p>

<p>This one was hawking address lists, much like the ones I occasionally receive to addresses that I can not turn into spamtraps. The message was addressed to, of all things, <a href="mailto:root@skapet.bsdly.net" rel="nofollow">root@skapet.bsdly.net</a>. (The message with full headers has been preserved here for reference).</p>

<p>Yes, that&#39;s right, they sent their spam to <a href="mailto:root@" rel="nofollow">root@</a>. And a quick peek at the headers revealed that like most of those attempts at hawking address lists for spamming that actually make it to a mailbox here, this one had been sent by an outlook.com customer.</p>

<p>The problem with spam delivered via outlook.com is that you can&#39;t usefully blacklist the sending server, since the largish chunk of the world that uses some sort of Microsoft hosted email solution (Office365 and its ilk) have their usually legitimate mail delivered via the very same infrastructure.</p>

<p>And since outlook.com is one of the mail providers that doesn&#39;t play well with greylisting (it spreads its retries across no less than 81 subnets (the output of &#39;echo outlook.com | doas smtpctl spf walk&#39; is preserved here), it&#39;s fairly common practice to just whitelist all those networks and avoid the hassle of lost or delayed mail to and from Microsoft customers.</p>

<p>I was going to just ignore this message too, but we&#39;ve seen an increasing number of spammy outfits taking advantage of outlook.com&#39;s seeming right of way to innocent third parties&#39; mail boxes.</p>

<p>So I decided to try both to do my best at demoralizing this particular sender and alert outlook.com to their problem. I wrote a messsage (preserved here) with a Cc: to <a href="mailto:abuse@outlook.com" rel="nofollow">abuse@outlook.com</a> where the meat is,</p>
</blockquote>

<pre><code>Ms Farell,

The address root@skapet.bsdly.net has never been subscribed to any mailing list, for obvious reasons. Whoever sold you an address list with that address on it are criminals and you should at least demand your money back.

Whoever handles abuse@outlook.com will appreciate the attachment, which is a copy of the message as it arrived here with all headers intact.

Yours sincerely,
Peter N. M. Hansteen
</code></pre>

<blockquote>
<p>What happened next is quite amazing.</p>

<p>If my analysis is correct, it may not be possible for senders who are not themselves outlook.com customers to actually reach the outlook.com abuse team.</p>

<p>Any student or practitioner of SMTP mail delivery should know that SPF records should only happen on ingress, that is at the point where the mail traffic enters your infrastructure and the sender IP address is the original one. Leave the check for later when the message may have been forwarded, and you do not have sufficient data to perform the check.</p>

<p>Whenever I encounter incredibly stupid and functionally destructive configuration errors like this I tend to believe they&#39;re down to simple incompetence and not malice.</p>

<p>But this one has me wondering. If you essentially require incoming mail to include the contents of spf.outlook.com (currently no less than 81 subnets) as valid senders for the domain, you are essentially saying that only outlook.com customers are allowed to communicate.</p>

<p>If that restriction is a result of a deliberate choice rather than a simple configuration error, the problem moves out of the technical sphere and could conceivably become a legal matter, depending on what outlook.com have specified in their contracts that they are selling to their customers.</p>

<p>But let us assume that this is indeed a matter of simple bad luck or incompetence and that the solution is indeed technical.</p>

<p>I would have liked to report this to whoever does technical things at that domain via email, but unfortunately there are indications that being their customer is a precondition for using that channel of communication to them.</p>

<p>I hope they fix that, and soon. And then move on to terminating their spamming customers&#39; contracts.</p>

<p>The main lesson to be learned from this is that when you shop around for email service, please do yourself a favor and make an effort to ensure that your prospective providers actually understand how the modern-ish SMTP addons SPF, DKIM and DMARC actually work.</p>

<p>Otherwise you may end up receiving more of the mail you don&#39;t want than what you do want, and your own mail may end up not being delivered as intended.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mirceaulinic.net/2018-02-14-openbsd-salt-proxy/" rel="nofollow">Running Salt Proxy Minions on OpenBSD</a></h3>

<blockquote>
<p>As I have previously attempted several times in the past, I am (finally) very close to switch to OpenBSD, a more stable and reliable operating system that I like. Before starting to make the actual change on both personal and work computer, I started testing some of the tools Im currently using, and understand what are the expectations.</p>

<p>In general I didnt encounter issues, or when I did, I found the answers in the documentation (which is really great), or various forums. I didnt find however any questions regarding Proxy Minions on OpenBSD which is why I thought it might be helpful to share my experience.</p>
</blockquote>

<ul>
<li>Installation and Startup</li>
</ul>

<blockquote>
<p>With these said, I started playing with Salt, and it was simple and straightforward. First step - install Salt: pkg_add salt. This will bring several ports for Python futures, ZeroMQ, or Tornado which are needed for Salt.</p>

<p>After configuring the pillar_roots in the /etc/salt/master config file for the Master, I started up the master process using rcctl:</p>
</blockquote>

<ul>
<li>Starting up the Proxy Minions</li>
</ul>

<blockquote>
<p>The Salt package for OpenBSD comes with the rc file for salt-proxy as well, /etc/rc.d/salt_proxy<br>
While typically you run a single regular Minion on a given machine, it is very like that there are multiple Proxy processes. Additionally, the default Salt rc file has the following configuration for the salt-proxy daemon:</p>
</blockquote>

<ul>
<li>Starting many Proxy Minions</li>
</ul>

<blockquote>
<p>I have managed to startup a Proxy Minion, but what about many? Executing the three commands above for each and every device is tedious and cannot scale very well. I thus have figured the following way:</p>
</blockquote>

<ul>
<li>Have a separate rc file per Proxy, each having the daemon instruction explicitly specifying its Minion ID</li>
<li>Start the service (using the regular Minion that controls the machine where the Proxy processes are running)</li>
<li>And the test Proxy Minion is then up (after accepting the key, i.e,, salt-key -a test)</li>
</ul>

<blockquote>
<p>Extending the same to a (very) large number of Proxy Minions, you can easily manage the rc files and start the services using a Salt State executed on the regular Minion:</p>
</blockquote>

<ul>
<li>Using the file.managed State function to generate the contents of the rc file for each Proxy, with its own Minion ID.</li>
<li>Using the service.running State function start the service.</li>
</ul>

<blockquote>
<p>These two steps would suffice to start an arbitrary number of Proxy Minions, and the command executed will always be the same regardless how many processes you aim to manage.</p>
</blockquote>

<ul>
<li>Conclusions</li>
</ul>

<blockquote>
<p>I am still a novice when it comes to OpenBSD, I have plenty to learn, but it looks like the transition will be much smoother than I expected. I am already looking forward to the handover, and - most importantly - I will no longer be using systemd. :-)</p>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-February/068464.html" rel="nofollow">LUA boot loader coming very soon</a></h3>

<blockquote>
<p>As you may know, the Lua (<a href="http://www.lua.org" rel="nofollow">http://www.lua.org</a>) boot loader has been in the works for some time. It started out life as a GSoC in 2014 by Pedro Souza mentored by Wojciech A. Koszek. Rui Paulo created a svn project branch to try to integrate it. I rebased that effort into a github branch which Pedro Arthur fixed up. Over the past year, I&#39;ve been cleaning up the boot loader<br>
for other reasons, and found the time was ripe to start integrating this into the tree. However, those integration efforts have taken a while as my day-job work on the boot loader took priority. In the mean time, Ed Maste and the FreeBSD Foundation funded Zakary Nafziger to enhance the original GSoC Lua scripts to bring it closer to parity with the evolution of the FORTH menu system since the GSoC project started.</p>

<p>I&#39;m pleased to announce that all these threads of development have converged and I&#39;ll be pushing the FreeBSD Lua Loader later today. This loader uses Lua as its scripting language instead of FORTH. While co-existance is planned, the timeline for it is looking to be a few weeks<br>
and I didn&#39;t want to delay pushing this into the tree for that.</p>

<p>To try the loader, you&#39;ll need to build WITHOUT_FORTH=yes and WITH_LOADER_LUA=yes. Fortunately, you needn&#39;t do a full world to do this, you can do it in src/stand and install the result (be sure to have the options for both the build and the install). This will replace your current<br>
/boot/loader that is scripted with FORTH to one that&#39;s scripted with Lua.<br>
It will install the lua scripts in /boot/lua. The boot is scripted with /boot/lua/loader.lua instead of /boot/loader.rc. You are strongly advised to create a backup copy of /boot/loader before testing (eg cp /boot/loader /boot/loader_forth), since you&#39;ll need to boot that from boot2 if something<br>
goes wrong. I&#39;ve tested it extensively, though, with userboot.so and it&#39;s test program, so all the initial kinks of finding the lua scripts, etc have been worked out.</p>

<p>While it&#39;s possible to build all the /boot/loader variants with Lua, I&#39;ve just tested a BIOS booting /boot/loader both with and without menus enabled. I&#39;ve not tested any of the other variants and the instructions for testing some of them may be rather tedious (especially UEFI, if you want a<br>
simple path to back out). Since there&#39;s not been full convergence testing, you&#39;ll almost certainly find bumps in this system. Also, all the build-system APIs are likely not yet final.</p>

<p>I put  MFC after a month on the commit. Due to the heroic (dare I say almost crazy) work of Kyle Evans on merging all the revs from -current to 11, I&#39;m planning a MFC to 11 after the co-existence issues are hammered out. In 11, FORTH will be the default, and Lua will  be built by default, but users will have to do something to use it. 12, both FORTH and Lua will be built and installed, with Lua as default (barring unforeseen complications). Once the co-existence stuff goes in, I imagine we&#39;ll make the switch to Lua by default shortly after that. In 13, FORTH will be removed unless there&#39;s a really really compelling case made to keep it.</p>

<p>So please give it a spin and give me any feedback, documentation updates and/or bug fixes. I&#39;m especially interested in reviews from people that have embedded Lua in other projects or experts in Lua that can improve the robustness of the menu code.</p>

<hr>
</blockquote>

<h3><a href="https://bsdmag.org/5374-2/" rel="nofollow">Bitcoin Full Node on FreeBSD</a></h3>

<ul>
<li>What is a Bitcoin ?</li>
</ul>

<blockquote>
<p>Bitcoin is a valuable popular open-source cryptocurrency that was invented by Satoshi Nakamoto in 2009. Bitcoins have value because they possess same characteristics like money (durability, portability, fungibility, scarcity, divisibility, and recognizability), but based on the properties of mathematics rather than on physical properties (like gold and silver) or trust in central authorities (like fiat currencies). In short, Bitcoin is backed by mathematics.<br>
Bitcoin is the first decentralized peer-to-peer cryptocurrency that is controlled by its users.<br>
Transactions take place directly between users, and are later verified by network nodes with digital signature and then placed in a public distributed ledger called a blockchain. Bitcoin is unique in that only 21 million bitcoins will ever be created. The unit of the bitcoin system is bitcoin or mBTC.</p>
</blockquote>

<ul>
<li>What is a Bitcoin Wallet ?</li>
</ul>

<blockquote>
<p>A wallet is nothing more than a pair of public and private keys that are created by a client to store the digital credentials for your bitcoin.</p>

<p>There are several types of wallets:</p>
</blockquote>

<pre><code>Desktop Wallet
Token Wallet
Online Wallet
Mobile Wallet
A token wallet is the safest way to work with bitcoin network, but you can use your mobile or pc as a bitcoin wallet.
</code></pre>

<ul>
<li>What is a Blockchain?</li>
</ul>

<blockquote>
<p>A blockchain is a ledger that records bitcoin transactions. The blockchain is a distributed database that achieves independent verification of the chain of ownership. Each network node stores its own copy of the blockchain. Transactions will broadcast on the bitcoin network, and about 2400 transactions create a block. These blocks are building blocks of the blockchain.</p>
</blockquote>

<ul>
<li>What is Mining?</li>
</ul>

<blockquote>
<p>Mining is the process of dedicating computing power to process transactions, secure the network, and keep everyone in the system synchronized together. It has been designed to be fully decentralized.<br>
Miners need mining software with specialized hardware. Mining software listens for transactions broadcasted through the peer-to-peer network and performs appropriate tasks to process and confirm these transactions. Bitcoin miners perform this work because they can earn transaction fees paid by users for faster transaction processing.<br>
New transactions have to be confirmed then be included in a block along with a mathematical proof of work. Such proofs are very hard to generate because there is no way to create them other than by trying billions of calculations per second. Hence, miners are required to perform these calculations before their blocks are accepted by the network and before they are rewarded. As more people start to mine, the difficulty of finding valid blocks is automatically increased by the network to ensure that the average time to find a block remains equal to 10 minutes. As a result, mining is a very competitive business where no individual miner can control what is included in the blockchain.<br>
The proof of work is also designed to depend on the previous block to force a chronological order in the blockchain. This makes it exponentially difficult to reverse previous transactions because it would require the recalculation of the proofs of work of all the subsequent blocks. When two blocks are found at the same time, miners work on the first block they receive and switch to the longest chain of blocks as soon as the next block is found. This allows mining to secure and maintain a global consensus based on processing power.</p>
</blockquote>

<ul>
<li>What is Pooled Mining?</li>
</ul>

<blockquote>
<p>You have more chances if you participate with others to create a block. In a pool, all participating miners get paid every time a participating server solves a block. The payment depends on the amount of work an individual miner contributed to help find that block.</p>
</blockquote>

<ul>
<li>What is a Full Node?</li>
</ul>

<blockquote>
<p>A full node is a client that fully validates transactions and blocks. Full nodes also help the network by accepting transactions and blocks from other full nodes, validating those transactions and blocks, and then relaying them to further full nodes.<br>
Many people and organizations volunteer to run full nodes using spare computing and bandwidth resources.</p>
</blockquote>

<ul>
<li>What is a Bitcoind?</li>
</ul>

<blockquote>
<p>bitcoind is a Bitcoin client under the MIT license in 32-bit and 64-bit versions for Windows, GNU/Linux-based OSes, Mac OS X, OpenBSD and FreeBSD as well.</p>

<p>Conclusion</p>
</blockquote>

<ul>
<li>Cryptocurrencies are replacement for banking we know today, and bitcoin is the game changer. Mining bitcoin with typical hardware is not a good idea. It needs specialized devices like ASIC, but you can create a full node and help the bitcoin network.</li>
<li>Useful Links

<ul>
<li><a href="https://en.wikipedia.org/wiki/Cryptocurrency" rel="nofollow">https://en.wikipedia.org/wiki/Cryptocurrency</a></li>
<li><a href="https://bitcoin.org/en/faq" rel="nofollow">https://bitcoin.org/en/faq</a>
***</li>
</ul></li>
</ul>

<h3>Latest DRM Graphics work</h3>

<ul>
<li>The DRM Graphics stack from Linux is ported to FreeBSD on an ongoing basis to provide support for accelerated graphics for Intel and AMD GPUs.</li>
<li><a href="https://svnweb.freebsd.org/ports?view=revision&revision=462202" rel="nofollow">The LinuxKPI bits that the drm-next-kmod driver port depends on have been merged into stable/11 and will be included as part of the upcoming FreeBSD 11.2 </a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-February/068690.html" rel="nofollow">Additionally, the version of the drives has been updated from Linux 4.9 to Linux 4.11 with a number of additional devices being supported</a>
***</li>
</ul>

<h3><a href="https://blog.safia.rocks/post/171311670379/how-does-cd-work" rel="nofollow">How does <code>cd</code> work?</a></h3>

<blockquote>
<p>In my last blog post, I dove into some of the code behind the sudo command. I thought this was pretty fun. sudo is one of those commands that I use quite often but havent had the chance to look into truly. I started thinking about other commands that I use on a daily basis but had little understanding of the internals of. The first command that came to mind is cd. cd stands for change directory. Simply put, it allows you to set your current working directory to a different directory.<br>
I read through some of the code that was defined in this file. Some of it was in functions, and other bits were in templates, but after a while, I figured that most of the code was a wrapper around a function called chdir. A lot of the functions defined in the cd.def file linked above actually just invoke chdir and handle errors and parameter cleaning.<br>
So all in all, here is what happens when you run cd on the command line.</p>
</blockquote>

<ul>
<li>The cd builtin is invoked as part of the Bash shell.</li>
<li>The Bash shell invokes the chdir function.</li>
<li>The chdir function is part of Unix and invokes the chdir system call.</li>
<li>The Unix kernel executes the chdir call and does its own low-level thing.</li>
</ul>

<blockquote>
<p>I could dive in a little bit more into how #4 works, but lets be honest, Ive already read too much code at this point, and my eyes are starting to hurt.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/247552279/" rel="nofollow">Stockholm BSD User Group: March 22</a></li>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-February/014182.html" rel="nofollow">Open Source Hardware Camp 2018 (30/06 &amp; 01/07) Call for Participation</a></li>
<li><a href="https://www.freebsd.org/releases/11.2R/schedule.html" rel="nofollow">Initial release schedule announcement for FreeBSD 11.2</a></li>
<li><a href="https://www.gitbook.com/book/freebsdfrau/serious-shell-programming/details" rel="nofollow">Serious Shell Programming (Devin Teske)</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3115" rel="nofollow">SSH Mastery 2/e out</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=330001" rel="nofollow">TCP Fast Open client side lands in FreeBSD </a></li>
<li><a href="https://torbsd.org/open-letter.html" rel="nofollow">Help the Tor BSD Project increase the OS diversity of Tor nodes, for your own safety, and everyone else&#39;s </a></li>
<li><a href="https://www.kompulsa.com/2018/02/23/5-differences-trueos-linux/" rel="nofollow">5 Differences Between TrueOS &amp; Linux</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Ambrose - <a href="http://dpaste.com/0KRRG18#wrap" rel="nofollow">Bunch of questions</a></li>
<li>Eddy - <a href="http://dpaste.com/0MTXYJN#wrap" rel="nofollow">ZFSoL with single SSD</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Well cover OpenBSDs defensive approach to OS security, help you  Understanding Syscall Conventions for Different Platforms, Mishandling SMTP Sender Verification, how the cd command works, and the LUA boot loader coming to FreeBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://medium.com/@_neerajpal/pledge-openbsds-defensive-approach-for-os-security-86629ef779ce" rel="nofollow">Pledge: OpenBSDs defensive approach to OS Security</a></h3>

<blockquote>
<p>The meaning of Pledge is same as in the real world, that is, a solemn promise or undertaking.</p>

<p>So, in OpenBSD: Calling pledge in a program means to promise that the program will only use certain resources.</p>
</blockquote>

<ul>
<li>How does it make a program more secure?</li>
</ul>

<blockquote>
<p>It limits the operation of a program. Example: You wrote a program named abc that only needed the stdio to just print something to stdout.</p>
</blockquote>

<ul>
<li>You added pledge to use only stdio and nothing else.</li>
<li>Then, a malicious user found out that there is a vulnerability in your program which one can exploit and get into shell (or root shell).</li>
<li>Exploiting your program to open a shell (or root shell) will result in the kernel killing the process with SIGABRT (which cannot be caught/ignored) and will generate a log (which you can find with dmesg).</li>
</ul>

<blockquote>
<p>This happens because before executing other codes of your program, the code first pledges not to use anything other than stdio promise/operations. But, opening a shell or root shell will call several other system-calls which are distributed in lots of other promises like stdio, proc, exec etc. They are all forbidden because the program has already promised not to use any promises other than stdio.</p>

<p>Pledge is not a system call filter. So, it is not used to restrict system calls.<br>
For example,</p>
</blockquote>

<ul>
<li>pledge(read,NULL) ? wrong syntax of the pledge()</li>
<li>pledge(stdio inet,NULL) ? correct syntax of the pledge()</li>
</ul>

<blockquote>
<p>Pledge works on stdio, dns, inet, etc. promises but not directly on system calls like read, write, etc. And, unique functionality of pledge() is that it works on behavioral approach not just like 1:1 approach with the system calls.</p>

<p>On 11 December 2017, Theo de Raadt said:</p>
</blockquote>

<pre><code>List: openbsd-tech
Subject: pledge execpromises
From: Theo de Raadt &lt;deraadt () openbsd ! org&gt;
Date: 20171211 21:20:51
Message-ID: 6735.1513027251 () cvs ! openbsd ! org
This will probably be committed in the next day or so.
The 2nd argument of pledge() becomes execpromises, which is what
will gets activated after execve.
There is also a small new feature called error, which causes
violating system calls to return -1 with ENOSYS rather than killing
the process. This must be used with EXTREME CAUTION because libraries
and programs are full of unchecked system calls. If you carry on past
one of these failures, your program is in uncharted territory and
risks of exploitation become high.
error is being introduced for a different reason: The pre-exec
processs expectation of what the post-exec process will do might
mismatch, so error allows things like starting an editor which has
no network access or maybe other restrictions in the future
</code></pre>

<hr>

<h3><a href="http://k3research.outerhaven.de/posts/every-journey-starts-with-a-fail.html" rel="nofollow">Every Journey Starts with a FAIL...or Understanding Syscall Conventions for Different Platforms</a></h3>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
<p>Not long ago I started looking into FreeBSD kernel exploitation. There are only a few resources but probably the best starting point is argp&#39;s Phrack article from 2009[0]. And while he does only provide one technique, I wanted to understand it and port it to a modern FreeBSD release before describing new, own researched techniques.</p>

<p>Well, at least this was my plan. In reality I ended researching how different operating systems resp. the same operating system but for different architectures implement syscalls. Hence, new exploiting methods have to wait for another post. In this one I want to describe my personal FAIL while porting argp&#39;s exploit example to a FreeBSD 11.1-RELEASE running on a 64bit processor. Maybe this will give other people interested in kernel stuff some insights they didn&#39;t know before. If you already know how syscalls work on 32bit and 64bit *BSD because you are an experienced exploit or kernel developer, you will probably want to search for something<br>
else to read. Moreover, some of the debugging stuff can look laborious because I wanted to show the steps I have done while attacking my problem instead of showing a simple walkthrough to the solution.</p>
</blockquote>

<ul>
<li>The Problem</li>
</ul>

<blockquote>
<p>argp described in his article vulnerable code consisting of a loadable kernel module which exposes a syscall to the userland. Because it was written around the time when FreeBSD 8-RELEASE came out and because he has written himself that the code needs smaller adjustments to work with this version (it was written for FreeBSD 7) I thought I will first port it to<br>
FreeBSD 11.1-RELEASE. Moreover it was written for an Intel 32bit processor architecture as we can see from his shellcode examples. Hence, I wanted to go right away the harder way and modify it to work on an 64bit processor.</p>
</blockquote>

<ul>
<li>Why the Original Code Worked While It Was Wrong</li>
</ul>

<blockquote>
<p>As written above, the syscall convention for the 32bit architecture is different from the one for the 64bit architecture. Indeed, a syscall on a 32bit FreeBSD system passes the arguments via the stack while the syscall offset is stored in the EAX register. The transfer into the kernel address space is done in &#39;cpu_fetch_syscall_args&#39; in &#39;sys/i386/i386/trap.c&#39;.</p>
</blockquote>

<pre><code>int
cpu_fetch_syscall_args(struct thread *td, struct syscall_args *sa)
{
    ...
    frame = td-&gt;td_frame;

    params = (caddr_t)frame-&gt;tf_esp + sizeof(int);
    sa-&gt;code = frame-&gt;tf_eax;

    ...

    if (params != NULL &amp;&amp; sa-&gt;narg != 0)
        error = copyin(params, (caddr_t)sa-&gt;args,
            (u_int)(sa-&gt;narg * sizeof(int)));
    else
    ...
}
</code></pre>

<blockquote>
<p>That is, &#39;params&#39; points to ESP+4 bytes offset. Later, the arguments are copied into the kernel space which is referenced by &#39;sa-&gt;args&#39;. &#39;args&#39; is an array of eight &#39;register_t&#39; which is defined as &#39;int32_t&#39; on the 32bit platform in comparison to the 64bit platform. And as &#39;struct args&#39; only<br>
consisted of integers they got copied into the syscall arguments which are given to the trigger function inside the kernel module. We could verify this by changing &#39;int op&#39; to &#39;long long op&#39; in the kernel module and in trigger.c. We get the following output:</p>
</blockquote>

<pre><code>root@freebsd64:trigger/ # ./trigger
0x28414000
256
3
1
0x28414000
256
4294967295
2
root@freebsd64:trigger/ #
</code></pre>

<blockquote>
<p>To bring this to an end: argp&#39;s version only worked for his special choice of arguments and only on 32bit. On 32bit FreeBSD platforms the arguments are transferred into kernel space by 4 byte integers, hence it will only work for integers anyway. On 64bit FreeBSD platforms we have to use syscall(2) in the intended way.</p>
</blockquote>

<hr>

<h3>iXsystems</h3>

<ul>
<li><a href="https://www.ixsystems.com/blog/gdpr-countdown/" rel="nofollow">New Disks!</a></li>
</ul>

<h3><a href="https://bsdly.blogspot.co.uk/2018/02/a-life-lesson-in-mishandling-smtp.html" rel="nofollow">A Life Lesson in Mishandling SMTP Sender Verification</a></h3>

<blockquote>
<p>It all started with one of those rare spam mails that got through.</p>

<p>This one was hawking address lists, much like the ones I occasionally receive to addresses that I can not turn into spamtraps. The message was addressed to, of all things, <a href="mailto:root@skapet.bsdly.net" rel="nofollow">root@skapet.bsdly.net</a>. (The message with full headers has been preserved here for reference).</p>

<p>Yes, that&#39;s right, they sent their spam to <a href="mailto:root@" rel="nofollow">root@</a>. And a quick peek at the headers revealed that like most of those attempts at hawking address lists for spamming that actually make it to a mailbox here, this one had been sent by an outlook.com customer.</p>

<p>The problem with spam delivered via outlook.com is that you can&#39;t usefully blacklist the sending server, since the largish chunk of the world that uses some sort of Microsoft hosted email solution (Office365 and its ilk) have their usually legitimate mail delivered via the very same infrastructure.</p>

<p>And since outlook.com is one of the mail providers that doesn&#39;t play well with greylisting (it spreads its retries across no less than 81 subnets (the output of &#39;echo outlook.com | doas smtpctl spf walk&#39; is preserved here), it&#39;s fairly common practice to just whitelist all those networks and avoid the hassle of lost or delayed mail to and from Microsoft customers.</p>

<p>I was going to just ignore this message too, but we&#39;ve seen an increasing number of spammy outfits taking advantage of outlook.com&#39;s seeming right of way to innocent third parties&#39; mail boxes.</p>

<p>So I decided to try both to do my best at demoralizing this particular sender and alert outlook.com to their problem. I wrote a messsage (preserved here) with a Cc: to <a href="mailto:abuse@outlook.com" rel="nofollow">abuse@outlook.com</a> where the meat is,</p>
</blockquote>

<pre><code>Ms Farell,

The address root@skapet.bsdly.net has never been subscribed to any mailing list, for obvious reasons. Whoever sold you an address list with that address on it are criminals and you should at least demand your money back.

Whoever handles abuse@outlook.com will appreciate the attachment, which is a copy of the message as it arrived here with all headers intact.

Yours sincerely,
Peter N. M. Hansteen
</code></pre>

<blockquote>
<p>What happened next is quite amazing.</p>

<p>If my analysis is correct, it may not be possible for senders who are not themselves outlook.com customers to actually reach the outlook.com abuse team.</p>

<p>Any student or practitioner of SMTP mail delivery should know that SPF records should only happen on ingress, that is at the point where the mail traffic enters your infrastructure and the sender IP address is the original one. Leave the check for later when the message may have been forwarded, and you do not have sufficient data to perform the check.</p>

<p>Whenever I encounter incredibly stupid and functionally destructive configuration errors like this I tend to believe they&#39;re down to simple incompetence and not malice.</p>

<p>But this one has me wondering. If you essentially require incoming mail to include the contents of spf.outlook.com (currently no less than 81 subnets) as valid senders for the domain, you are essentially saying that only outlook.com customers are allowed to communicate.</p>

<p>If that restriction is a result of a deliberate choice rather than a simple configuration error, the problem moves out of the technical sphere and could conceivably become a legal matter, depending on what outlook.com have specified in their contracts that they are selling to their customers.</p>

<p>But let us assume that this is indeed a matter of simple bad luck or incompetence and that the solution is indeed technical.</p>

<p>I would have liked to report this to whoever does technical things at that domain via email, but unfortunately there are indications that being their customer is a precondition for using that channel of communication to them.</p>

<p>I hope they fix that, and soon. And then move on to terminating their spamming customers&#39; contracts.</p>

<p>The main lesson to be learned from this is that when you shop around for email service, please do yourself a favor and make an effort to ensure that your prospective providers actually understand how the modern-ish SMTP addons SPF, DKIM and DMARC actually work.</p>

<p>Otherwise you may end up receiving more of the mail you don&#39;t want than what you do want, and your own mail may end up not being delivered as intended.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mirceaulinic.net/2018-02-14-openbsd-salt-proxy/" rel="nofollow">Running Salt Proxy Minions on OpenBSD</a></h3>

<blockquote>
<p>As I have previously attempted several times in the past, I am (finally) very close to switch to OpenBSD, a more stable and reliable operating system that I like. Before starting to make the actual change on both personal and work computer, I started testing some of the tools Im currently using, and understand what are the expectations.</p>

<p>In general I didnt encounter issues, or when I did, I found the answers in the documentation (which is really great), or various forums. I didnt find however any questions regarding Proxy Minions on OpenBSD which is why I thought it might be helpful to share my experience.</p>
</blockquote>

<ul>
<li>Installation and Startup</li>
</ul>

<blockquote>
<p>With these said, I started playing with Salt, and it was simple and straightforward. First step - install Salt: pkg_add salt. This will bring several ports for Python futures, ZeroMQ, or Tornado which are needed for Salt.</p>

<p>After configuring the pillar_roots in the /etc/salt/master config file for the Master, I started up the master process using rcctl:</p>
</blockquote>

<ul>
<li>Starting up the Proxy Minions</li>
</ul>

<blockquote>
<p>The Salt package for OpenBSD comes with the rc file for salt-proxy as well, /etc/rc.d/salt_proxy<br>
While typically you run a single regular Minion on a given machine, it is very like that there are multiple Proxy processes. Additionally, the default Salt rc file has the following configuration for the salt-proxy daemon:</p>
</blockquote>

<ul>
<li>Starting many Proxy Minions</li>
</ul>

<blockquote>
<p>I have managed to startup a Proxy Minion, but what about many? Executing the three commands above for each and every device is tedious and cannot scale very well. I thus have figured the following way:</p>
</blockquote>

<ul>
<li>Have a separate rc file per Proxy, each having the daemon instruction explicitly specifying its Minion ID</li>
<li>Start the service (using the regular Minion that controls the machine where the Proxy processes are running)</li>
<li>And the test Proxy Minion is then up (after accepting the key, i.e,, salt-key -a test)</li>
</ul>

<blockquote>
<p>Extending the same to a (very) large number of Proxy Minions, you can easily manage the rc files and start the services using a Salt State executed on the regular Minion:</p>
</blockquote>

<ul>
<li>Using the file.managed State function to generate the contents of the rc file for each Proxy, with its own Minion ID.</li>
<li>Using the service.running State function start the service.</li>
</ul>

<blockquote>
<p>These two steps would suffice to start an arbitrary number of Proxy Minions, and the command executed will always be the same regardless how many processes you aim to manage.</p>
</blockquote>

<ul>
<li>Conclusions</li>
</ul>

<blockquote>
<p>I am still a novice when it comes to OpenBSD, I have plenty to learn, but it looks like the transition will be much smoother than I expected. I am already looking forward to the handover, and - most importantly - I will no longer be using systemd. :-)</p>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-February/068464.html" rel="nofollow">LUA boot loader coming very soon</a></h3>

<blockquote>
<p>As you may know, the Lua (<a href="http://www.lua.org" rel="nofollow">http://www.lua.org</a>) boot loader has been in the works for some time. It started out life as a GSoC in 2014 by Pedro Souza mentored by Wojciech A. Koszek. Rui Paulo created a svn project branch to try to integrate it. I rebased that effort into a github branch which Pedro Arthur fixed up. Over the past year, I&#39;ve been cleaning up the boot loader<br>
for other reasons, and found the time was ripe to start integrating this into the tree. However, those integration efforts have taken a while as my day-job work on the boot loader took priority. In the mean time, Ed Maste and the FreeBSD Foundation funded Zakary Nafziger to enhance the original GSoC Lua scripts to bring it closer to parity with the evolution of the FORTH menu system since the GSoC project started.</p>

<p>I&#39;m pleased to announce that all these threads of development have converged and I&#39;ll be pushing the FreeBSD Lua Loader later today. This loader uses Lua as its scripting language instead of FORTH. While co-existance is planned, the timeline for it is looking to be a few weeks<br>
and I didn&#39;t want to delay pushing this into the tree for that.</p>

<p>To try the loader, you&#39;ll need to build WITHOUT_FORTH=yes and WITH_LOADER_LUA=yes. Fortunately, you needn&#39;t do a full world to do this, you can do it in src/stand and install the result (be sure to have the options for both the build and the install). This will replace your current<br>
/boot/loader that is scripted with FORTH to one that&#39;s scripted with Lua.<br>
It will install the lua scripts in /boot/lua. The boot is scripted with /boot/lua/loader.lua instead of /boot/loader.rc. You are strongly advised to create a backup copy of /boot/loader before testing (eg cp /boot/loader /boot/loader_forth), since you&#39;ll need to boot that from boot2 if something<br>
goes wrong. I&#39;ve tested it extensively, though, with userboot.so and it&#39;s test program, so all the initial kinks of finding the lua scripts, etc have been worked out.</p>

<p>While it&#39;s possible to build all the /boot/loader variants with Lua, I&#39;ve just tested a BIOS booting /boot/loader both with and without menus enabled. I&#39;ve not tested any of the other variants and the instructions for testing some of them may be rather tedious (especially UEFI, if you want a<br>
simple path to back out). Since there&#39;s not been full convergence testing, you&#39;ll almost certainly find bumps in this system. Also, all the build-system APIs are likely not yet final.</p>

<p>I put  MFC after a month on the commit. Due to the heroic (dare I say almost crazy) work of Kyle Evans on merging all the revs from -current to 11, I&#39;m planning a MFC to 11 after the co-existence issues are hammered out. In 11, FORTH will be the default, and Lua will  be built by default, but users will have to do something to use it. 12, both FORTH and Lua will be built and installed, with Lua as default (barring unforeseen complications). Once the co-existence stuff goes in, I imagine we&#39;ll make the switch to Lua by default shortly after that. In 13, FORTH will be removed unless there&#39;s a really really compelling case made to keep it.</p>

<p>So please give it a spin and give me any feedback, documentation updates and/or bug fixes. I&#39;m especially interested in reviews from people that have embedded Lua in other projects or experts in Lua that can improve the robustness of the menu code.</p>

<hr>
</blockquote>

<h3><a href="https://bsdmag.org/5374-2/" rel="nofollow">Bitcoin Full Node on FreeBSD</a></h3>

<ul>
<li>What is a Bitcoin ?</li>
</ul>

<blockquote>
<p>Bitcoin is a valuable popular open-source cryptocurrency that was invented by Satoshi Nakamoto in 2009. Bitcoins have value because they possess same characteristics like money (durability, portability, fungibility, scarcity, divisibility, and recognizability), but based on the properties of mathematics rather than on physical properties (like gold and silver) or trust in central authorities (like fiat currencies). In short, Bitcoin is backed by mathematics.<br>
Bitcoin is the first decentralized peer-to-peer cryptocurrency that is controlled by its users.<br>
Transactions take place directly between users, and are later verified by network nodes with digital signature and then placed in a public distributed ledger called a blockchain. Bitcoin is unique in that only 21 million bitcoins will ever be created. The unit of the bitcoin system is bitcoin or mBTC.</p>
</blockquote>

<ul>
<li>What is a Bitcoin Wallet ?</li>
</ul>

<blockquote>
<p>A wallet is nothing more than a pair of public and private keys that are created by a client to store the digital credentials for your bitcoin.</p>

<p>There are several types of wallets:</p>
</blockquote>

<pre><code>Desktop Wallet
Token Wallet
Online Wallet
Mobile Wallet
A token wallet is the safest way to work with bitcoin network, but you can use your mobile or pc as a bitcoin wallet.
</code></pre>

<ul>
<li>What is a Blockchain?</li>
</ul>

<blockquote>
<p>A blockchain is a ledger that records bitcoin transactions. The blockchain is a distributed database that achieves independent verification of the chain of ownership. Each network node stores its own copy of the blockchain. Transactions will broadcast on the bitcoin network, and about 2400 transactions create a block. These blocks are building blocks of the blockchain.</p>
</blockquote>

<ul>
<li>What is Mining?</li>
</ul>

<blockquote>
<p>Mining is the process of dedicating computing power to process transactions, secure the network, and keep everyone in the system synchronized together. It has been designed to be fully decentralized.<br>
Miners need mining software with specialized hardware. Mining software listens for transactions broadcasted through the peer-to-peer network and performs appropriate tasks to process and confirm these transactions. Bitcoin miners perform this work because they can earn transaction fees paid by users for faster transaction processing.<br>
New transactions have to be confirmed then be included in a block along with a mathematical proof of work. Such proofs are very hard to generate because there is no way to create them other than by trying billions of calculations per second. Hence, miners are required to perform these calculations before their blocks are accepted by the network and before they are rewarded. As more people start to mine, the difficulty of finding valid blocks is automatically increased by the network to ensure that the average time to find a block remains equal to 10 minutes. As a result, mining is a very competitive business where no individual miner can control what is included in the blockchain.<br>
The proof of work is also designed to depend on the previous block to force a chronological order in the blockchain. This makes it exponentially difficult to reverse previous transactions because it would require the recalculation of the proofs of work of all the subsequent blocks. When two blocks are found at the same time, miners work on the first block they receive and switch to the longest chain of blocks as soon as the next block is found. This allows mining to secure and maintain a global consensus based on processing power.</p>
</blockquote>

<ul>
<li>What is Pooled Mining?</li>
</ul>

<blockquote>
<p>You have more chances if you participate with others to create a block. In a pool, all participating miners get paid every time a participating server solves a block. The payment depends on the amount of work an individual miner contributed to help find that block.</p>
</blockquote>

<ul>
<li>What is a Full Node?</li>
</ul>

<blockquote>
<p>A full node is a client that fully validates transactions and blocks. Full nodes also help the network by accepting transactions and blocks from other full nodes, validating those transactions and blocks, and then relaying them to further full nodes.<br>
Many people and organizations volunteer to run full nodes using spare computing and bandwidth resources.</p>
</blockquote>

<ul>
<li>What is a Bitcoind?</li>
</ul>

<blockquote>
<p>bitcoind is a Bitcoin client under the MIT license in 32-bit and 64-bit versions for Windows, GNU/Linux-based OSes, Mac OS X, OpenBSD and FreeBSD as well.</p>

<p>Conclusion</p>
</blockquote>

<ul>
<li>Cryptocurrencies are replacement for banking we know today, and bitcoin is the game changer. Mining bitcoin with typical hardware is not a good idea. It needs specialized devices like ASIC, but you can create a full node and help the bitcoin network.</li>
<li>Useful Links

<ul>
<li><a href="https://en.wikipedia.org/wiki/Cryptocurrency" rel="nofollow">https://en.wikipedia.org/wiki/Cryptocurrency</a></li>
<li><a href="https://bitcoin.org/en/faq" rel="nofollow">https://bitcoin.org/en/faq</a>
***</li>
</ul></li>
</ul>

<h3>Latest DRM Graphics work</h3>

<ul>
<li>The DRM Graphics stack from Linux is ported to FreeBSD on an ongoing basis to provide support for accelerated graphics for Intel and AMD GPUs.</li>
<li><a href="https://svnweb.freebsd.org/ports?view=revision&revision=462202" rel="nofollow">The LinuxKPI bits that the drm-next-kmod driver port depends on have been merged into stable/11 and will be included as part of the upcoming FreeBSD 11.2 </a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-February/068690.html" rel="nofollow">Additionally, the version of the drives has been updated from Linux 4.9 to Linux 4.11 with a number of additional devices being supported</a>
***</li>
</ul>

<h3><a href="https://blog.safia.rocks/post/171311670379/how-does-cd-work" rel="nofollow">How does <code>cd</code> work?</a></h3>

<blockquote>
<p>In my last blog post, I dove into some of the code behind the sudo command. I thought this was pretty fun. sudo is one of those commands that I use quite often but havent had the chance to look into truly. I started thinking about other commands that I use on a daily basis but had little understanding of the internals of. The first command that came to mind is cd. cd stands for change directory. Simply put, it allows you to set your current working directory to a different directory.<br>
I read through some of the code that was defined in this file. Some of it was in functions, and other bits were in templates, but after a while, I figured that most of the code was a wrapper around a function called chdir. A lot of the functions defined in the cd.def file linked above actually just invoke chdir and handle errors and parameter cleaning.<br>
So all in all, here is what happens when you run cd on the command line.</p>
</blockquote>

<ul>
<li>The cd builtin is invoked as part of the Bash shell.</li>
<li>The Bash shell invokes the chdir function.</li>
<li>The chdir function is part of Unix and invokes the chdir system call.</li>
<li>The Unix kernel executes the chdir call and does its own low-level thing.</li>
</ul>

<blockquote>
<p>I could dive in a little bit more into how #4 works, but lets be honest, Ive already read too much code at this point, and my eyes are starting to hurt.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/247552279/" rel="nofollow">Stockholm BSD User Group: March 22</a></li>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-February/014182.html" rel="nofollow">Open Source Hardware Camp 2018 (30/06 &amp; 01/07) Call for Participation</a></li>
<li><a href="https://www.freebsd.org/releases/11.2R/schedule.html" rel="nofollow">Initial release schedule announcement for FreeBSD 11.2</a></li>
<li><a href="https://www.gitbook.com/book/freebsdfrau/serious-shell-programming/details" rel="nofollow">Serious Shell Programming (Devin Teske)</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3115" rel="nofollow">SSH Mastery 2/e out</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=330001" rel="nofollow">TCP Fast Open client side lands in FreeBSD </a></li>
<li><a href="https://torbsd.org/open-letter.html" rel="nofollow">Help the Tor BSD Project increase the OS diversity of Tor nodes, for your own safety, and everyone else&#39;s </a></li>
<li><a href="https://www.kompulsa.com/2018/02/23/5-differences-trueos-linux/" rel="nofollow">5 Differences Between TrueOS &amp; Linux</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Ambrose - <a href="http://dpaste.com/0KRRG18#wrap" rel="nofollow">Bunch of questions</a></li>
<li>Eddy - <a href="http://dpaste.com/0MTXYJN#wrap" rel="nofollow">ZFSoL with single SSD</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>235: I C you BSD</title>
  <link>https://www.bsdnow.tv/235</link>
  <guid isPermaLink="false">460ca95a-5b37-4d69-9367-525dfa539ab6</guid>
  <pubDate>Wed, 28 Feb 2018 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/460ca95a-5b37-4d69-9367-525dfa539ab6.mp3" length="90339700" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>How the term open source was created, running FreeBSD on ThinkPad T530, Moving away from Windows, Unknown Giants, as well as OpenBSD and FreeDOS.</itunes:subtitle>
  <itunes:duration>2:05:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>How the term open source was created, running FreeBSD on ThinkPad T530, Moving away from Windows, Unknown Giants, as well as OpenBSD and FreeDOS.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
How I coined the term 'open source' (https://opensource.com/article/18/2/coining-term-open-source-software)
In a few days, on February 3, the 20th anniversary of the introduction of the term "open source software" is upon us. As open source software grows in popularity and powers some of the most robust and important innovations of our time, we reflect on its rise to prominence.
I am the originator of the term "open source software" and came up with it while executive director at Foresight Institute. Not a software developer like the rest, I thank Linux programmer Todd Anderson for supporting the term and proposing it to the group.
This is my account of how I came up with it, how it was proposed, and the subsequent reactions. Of course, there are a number of accounts of the coining of the term, for example by Eric Raymond and Richard Stallman, yet this is mine, written on January 2, 2006.
It has never been published, until today.
The introduction of the term "open source software" was a deliberate effort to make this field of endeavor more understandable to newcomers and to business, which was viewed as necessary to its spread to a broader community of users. The problem with the main earlier label, "free software," was not its political connotations, but that—to newcomers—its seeming focus on price is distracting. A term was needed that focuses on the key issue of source code and that does not immediately confuse those new to the concept. The first term that came along at the right time and fulfilled these requirements was rapidly adopted: open source.
This term had long been used in an "intelligence" (i.e., spying) context, but to my knowledge, use of the term with respect to software prior to 1998 has not been confirmed. The account below describes how the term open source software caught on and became the name of both an industry and a movement.
Meetings on computer security
In late 1997, weekly meetings were being held at Foresight Institute to discuss computer security. Foresight is a nonprofit think tank focused on nanotechnology and artificial intelligence, and software security is regarded as central to the reliability and security of both. We had identified free software as a promising approach to improving software security and reliability and were looking for ways to promote it. Interest in free software was starting to grow outside the programming community, and it was increasingly clear that an opportunity was coming to change the world. However, just how to do this was unclear, and we were groping for strategies.
At these meetings, we discussed the need for a new term due to the confusion factor. The argument was as follows: those new to the term "free software" assume it is referring to the price. Oldtimers must then launch into an explanation, usually given as follows: "We mean free as in freedom, not free as in beer." At this point, a discussion on software has turned into one about the price of an alcoholic beverage. The problem was not that explaining the meaning is impossible—the problem was that the name for an important idea should not be so confusing to newcomers. A clearer term was needed. No political issues were raised regarding the free software term; the issue was its lack of clarity to those new to the concept.
Releasing Netscape
On February 2, 1998, Eric Raymond arrived on a visit to work with Netscape on the plan to release the browser code under a free-software-style license. We held a meeting that night at Foresight's office in Los Altos to strategize and refine our message. In addition to Eric and me, active participants included Brian Behlendorf, Michael Tiemann, Todd Anderson, Mark S. Miller, and Ka-Ping Yee. But at that meeting, the field was still described as free software or, by Brian, "source code available" software.
While in town, Eric used Foresight as a base of operations. At one point during his visit, he was called to the phone to talk with a couple of Netscape legal and/or marketing staff. When he was finished, I asked to be put on the phone with them—one man and one woman, perhaps Mitchell Baker—so I could bring up the need for a new term. They agreed in principle immediately, but no specific term was agreed upon.
Between meetings that week, I was still focused on the need for a better name and came up with the term "open source software." While not ideal, it struck me as good enough. I ran it by at least four others: Eric Drexler, Mark Miller, and Todd Anderson liked it, while a friend in marketing and public relations felt the term "open" had been overused and abused and believed we could do better. He was right in theory; however, I didn't have a better idea, so I thought I would try to go ahead and introduce it. In hindsight, I should have simply proposed it to Eric Raymond, but I didn't know him well at the time, so I took an indirect strategy instead.
Todd had agreed strongly about the need for a new term and offered to assist in getting the term introduced. This was helpful because, as a non-programmer, my influence within the free software community was weak. My work in nanotechnology education at Foresight was a plus, but not enough for me to be taken very seriously on free software questions. As a Linux programmer, Todd would be listened to more closely.
The key meeting
Later that week, on February 5, 1998, a group was assembled at VA Research to brainstorm on strategy. Attending—in addition to Eric Raymond, Todd, and me—were Larry Augustin, Sam Ockman, and attending by phone, Jon "maddog" Hall.
The primary topic was promotion strategy, especially which companies to approach. I said little, but was looking for an opportunity to introduce the proposed term. I felt that it wouldn't work for me to just blurt out, "All you technical people should start using my new term." Most of those attending didn't know me, and for all I knew, they might not even agree that a new term was greatly needed, or even somewhat desirable.
Fortunately, Todd was on the ball. Instead of making an assertion that the community should use this specific new term, he did something less directive—a smart thing to do with this community of strong-willed individuals. He simply used the term in a sentence on another topic—just dropped it into the conversation to see what happened. I went on alert, hoping for a response, but there was none at first. The discussion continued on the original topic. It seemed only he and I had noticed the usage.
Not so—memetic evolution was in action. A few minutes later, one of the others used the term, evidently without noticing, still discussing a topic other than terminology. Todd and I looked at each other out of the corners of our eyes to check: yes, we had both noticed what happened. I was excited—it might work! But I kept quiet: I still had low status in this group. Probably some were wondering why Eric had invited me at all.
Toward the end of the meeting, the question of terminology was brought up explicitly, probably by Todd or Eric. Maddog mentioned "freely distributable" as an earlier term, and "cooperatively developed" as a newer term. Eric listed "free software," "open source," and "sourceware" as the main options. Todd advocated the "open source" model, and Eric endorsed this. I didn't say much, letting Todd and Eric pull the (loose, informal) consensus together around the open source name. It was clear that to most of those at the meeting, the name change was not the most important thing discussed there; a relatively minor issue. Only about 10% of my notes from this meeting are on the terminology question.
But I was elated. These were some key leaders in the community, and they liked the new name, or at least didn't object. This was a very good sign. There was probably not much more I could do to help; Eric Raymond was far better positioned to spread the new meme, and he did. Bruce Perens signed on to the effort immediately, helping set up Opensource.org and playing a key role in spreading the new term.
For the name to succeed, it was necessary, or at least highly desirable, that Tim O'Reilly agree and actively use it in his many projects on behalf of the community. Also helpful would be use of the term in the upcoming official release of the Netscape Navigator code. By late February, both O'Reilly &amp;amp; Associates and Netscape had started to use the term.
Getting the name out
After this, there was a period during which the term was promoted by Eric Raymond to the media, by Tim O'Reilly to business, and by both to the programming community. It seemed to spread very quickly.
On April 7, 1998, Tim O'Reilly held a meeting of key leaders in the field. Announced in advance as the first "Freeware Summit," by April 14 it was referred to as the first "Open Source Summit."
These months were extremely exciting for open source. Every week, it seemed, a new company announced plans to participate. Reading Slashdot became a necessity, even for those like me who were only peripherally involved. I strongly believe that the new term was helpful in enabling this rapid spread into business, which then enabled wider use by the public.
A quick Google search indicates that "open source" appears more often than "free software," but there still is substantial use of the free software term, which remains useful and should be included when communicating with audiences who prefer it.
A happy twinge
When an early account of the terminology change written by Eric Raymond was posted on the Open Source Initiative website, I was listed as being at the VA brainstorming meeting, but not as the originator of the term. This was my own fault; I had neglected to tell Eric the details. My impulse was to let it pass and stay in the background, but Todd felt otherwise. He suggested to me that one day I would be glad to be known as the person who coined the name "open source software." He explained the situation to Eric, who promptly updated his site.
Coming up with a phrase is a small contribution, but I admit to being grateful to those who remember to credit me with it. Every time I hear it, which is very often now, it gives me a little happy twinge.
The big credit for persuading the community goes to Eric Raymond and Tim O'Reilly, who made it happen. Thanks to them for crediting me, and to Todd Anderson for his role throughout. The above is not a complete account of open source history; apologies to the many key players whose names do not appear. Those seeking a more complete account should refer to the links in this article and elsewhere on the net.
FreeBSD on a Laptop - A guide to a fully functional installation of FreeBSD on a ThinkPad T530 (https://www.c0ffee.net/blog/freebsd-on-a-laptop)
As I stated my previous post, I recently dug up my old ThinkPad T530 after the embarrassing stream of OS X security bugs this month. Although this ThinkPad ran Gentoo faithfully during my time in graduate school at Clemson, these days I'd much rather spend time my wife and baby than fighting with emerge and USE flags. FreeBSD has always been my OS of choice, and laptop support seems to be much better than it was a few years ago. In this guide, I'll show you the tweaks I made to wrestle FreeBSD into a decent experience on a laptop.
Unlike my usual posts, this time I'm going to assume you're already pretty familiar with FreeBSD. If you're a layman looking for your first BSD-based desktop, I highly recommend checking out TrueOS (previously PC-BSD): they've basically taken FreeBSD and packaged it with all the latest drivers, along with a user-friendly installer and custom desktop environment out of the box. TrueOS is an awesome project–the only reason I don't use it is because I'm old, grumpy, and persnickety about having my operating system just so.
Anyway, if you'd still like to take the plunge, read on. Keep in mind, I'm using a ThinkPad T530, but other ThinkPads of the same generation should be similarly compatible.
Here's what you'll get:
Decent battery life (8-9 hours with a new 9-cell battery)
UEFI boot and full-disk encryption
WiFi (Intel Ultimate-N 6300)
Ethernet (Intel PRO/1000)
Screen brightness adjustment
Suspend/Resume on lid close (make sure to disable TPM in BIOS)
Audio (Realtek ALC269 HDA, speakers and headphone jack)
Keyboard multimedia buttons
Touchpad/Trackpoint
Graphics Acceleration (with integrated Intel graphics, NVIDIA card disabled in BIOS)
What I haven't tested yet:
Bluetooth
Webcam
Fingerprint reader
SD Card slot
Installation
Power Saving
Tweaks for Desktop Use
X11
Fonts
Login Manager: SLiM
Desktop Environment: i3
Applications
The LLVM Sanitizers stage accomplished (https://blog.netbsd.org/tnf/entry/the_llvm_sanitizers_stage_accomplished)
I've managed to get the Memory Sanitizer to work for the elementary base system utilities, like ps(1), awk(1) and ksh(1). This means that the toolchain is ready for tests and improvements. I've iterated over the basesystem utilities and I looked for bugs, both in programs and in sanitizers. The number of detected bugs in the userland programs was low, there merely was one reading of an uninitialized variable in ps(1).
A prebuilt LLVM toolchain
I've prepared a prebuilt toolchain with Clang, LLVM, LLDB and compiler-rt for NetBSD/amd64. I prepared the toolchain on 8.99.12, however I have received reports that it works on other older releases. Link: llvm-clang-compilerrt-lldb-7.0.0beta_2018-01-24.tar.bz2
The archive has to be untarballed to /usr/local (however it might work to some extent in other paths).
This toolchain contains a prebuilt tree of the LLVM projects from a snapshot of 7.0.0(svn). It is a pristine snapshot of HEAD with patches from pkgsrc-wip for llvm, clang, compiler-rt and lldb.
Sanitizers
Notable changes in sanitizers, all of them are in the context of NetBSD support.

Added fstat(2) MSan interceptor.
Support for kvm(3) interceptors in the common sanitizer code.
Added devname(3) and devname_r(3) interceptors to the common sanitizer code.
Added sysctl(3) familty of functions interceptors in the common sanitizer code.
Added strlcpy(3)/strlcat(3) interceptors in the common sanitizer code.
Added getgrouplist(3)/getgroupmembership(3) interceptors in the common sanitizer code.
Correct ctype(3) interceptors in a code using Native Language Support.
Correct tzset(3) interceptor in MSan.
Correct localtime(3) interceptor in the common sanitizer code.
Added paccept(2) interceptor to the common sanitizer code.
Added access(2) and faccessat(2) interceptors to the common sanitizer code.
Added acct(2) interceptor to the common sanitizer code.
Added accept4(2) interceptor to the common sanitizer code.
Added fgetln(3) interceptor to the common sanitizer code.
Added interceptors for the pwcache(3)-style functions in the common sanitizer code.
Added interceptors for the getprotoent(3)-style functions in the common sanitizer code.
Added interceptors for the getnetent(3)-style functions in the common sanitizer code.
Added interceptors for the fts(3)-style functions in the common sanitizer code.
Added lstat(3) interceptor in MSan.
Added strftime(3) interceptor in the common sanitizer code.
Added strmode(3) interceptor in the common sanitizer code.
Added interceptors for the regex(3)-style functions in the common sanitizer code.
Disabled unwanted interceptor __sigsetjmp in TSan.

Base system changes
I've tidied up inclusion of the internal namespace.h header in libc. This has hidden the usage of public global symbol names of:

strlcat -&amp;gt; _strlcat
sysconf -&amp;gt; __sysconf
closedir -&amp;gt; _closedir
fparseln -&amp;gt; _fparseln
kill -&amp;gt; _kill
mkstemp -&amp;gt; _mkstemp
reallocarr -&amp;gt; _reallocarr
strcasecmp -&amp;gt; _strcasecmp
strncasecmp -&amp;gt; _strncasecmp
strptime -&amp;gt; _strptime
strtok_r -&amp;gt; _strtok_r
sysctl -&amp;gt; _sysctl
dlopen -&amp;gt; __dlopen
dlclose -&amp;gt; __dlclose
dlsym -&amp;gt; __dlsym
strlcpy -&amp;gt; _strlcpy
fdopen -&amp;gt; _fdopen
mmap -&amp;gt; _mmap
strdup -&amp;gt; _strdup

The purpose of these changes was to stop triggering interceptors recursively. Such interceptors lead to sanitization of internals of unprepared (not recompiled with sanitizers) prebuilt code. It's not trivial to sanitize libc's internals and the sanitizers are not designed to do so. This means that they are not a full replacement of Valgrind-like software, but a a supplement in the developer toolbox. Valgrind translates native code to a bytecode virtual machine, while sanitizers are designed to work with interceptors inside the pristine elementary libraries (libc, libm, librt, libpthread) and embed functionality into the executable's code.
I've also reverted the vadvise(2) syscall removal, from the previous month. This caused a regression in legacy code recompiled against still supported compat layers. Newly compiled code will use a libc's stub of vadvise(2).
I've also prepared a patch installing dedicated headers for sanitizers along with the base system GCC. It's still discussed and should land the sources soon.
Future directions and goals
Possible paths in random order:
In the quartet of UBSan (Undefined Behavior Sanitizer), ASan (Address Sanitizer), TSan (Thread Sanitizer), MSan (Memory Sanitizer) we need to add the fifth basic sanitizer: LSan (Leak Sanitizer). The Leak Sanitizer (detector of memory leaks) demands a stable ptrace(2) interface for processes with multiple threads (unless we want to build a custom kernel interface).
Integrate the sanitizers with the userland framework in order to ship with the native toolchain to users.
Port sanitizers from LLVM to GCC.
Allow to sanitize programs linked against userland libraries other than libc, librt, libm and libpthread; by a global option (like MKSANITIZER) producing a userland that is partially prebuilt with a desired sanitizer. This is required to run e.g. MSanitized programs against editline(3). So far, there is no Operating System distribution in existence with a native integration with sanitizers. There are 3rd party scripts for certain OSes to build a stack of software dependencies in order to validate a piece of software.
Execute ATF tests with the userland rebuilt with supported flavors of sanitizers and catch regressions.
Finish porting of modern linkers designed for large C++ software, such as GNU GOLD and LLVM LLD. Today the bottleneck with building the LLVM toolchain is a suboptimal linker GNU ld(1).
I've decided to not open new battlefields and return now to porting LLDB and fixing ptrace(2).
Plan for the next milestone
Keep upstreaming a pile of local compiler-rt patches.
Restore the LLDB support for traced programs with a single thread.
Interview - Goran Mekic - meka@tilda.center (mailto:meka@tilda.center) / @meka_floss (https://twitter.com/meka_floss)
CBSD website (https://bsdstore.ru) Jail and VM Manager
***
News Roundup
Finally Moving Away From Windows (https://www.manios.ca/blog/2018/01/finally-moving-away-from-windows/)
Broken Window
Thanks to a combination of some really impressive malware, bad clicking, and poor website choices, I had to blow away my Windows 10 installation. Not that it was Window’s fault, but a piece of malware had infected my computer when I tried to download a long lost driver for an even longer lost RAID card for a server. A word of advice – the download you’re looking for is never on an ad-infested forum in another language. In any case, I had been meaning to switch away from Windows soon. I didn’t have my entire plan ready, but now was as good a time as any.
My line of work requires me to maintain some form of Windows installation, so I decided to keep it in a VM rather than dual booting as I was developing code and not running any high-end visual stuff like games. My first thought was to install Arch or Gentoo Linux, but the last time I attempted a Gentoo installation it left me bootless. Not that there is anything wrong with Gentoo, it was probably my fault, but I like the idea of some sort of installer so I looked at rock-solid Debian. My dad had installed Debian on his sweet new cutting-edge Lenovo laptop he received recently from work. He often raves about his cool scripts and much more effective customized experience, but often complains about his hybrid GPU support as he has an Intel/Nvidia hybrid display adapter (he has finally resolved it and now boasts his 6 connected displays).
I didn’t want to install Windows again, but something didn’t feel right about installing some flavour of Linux. Back at home I have a small collection of FreeBSD servers running in all sorts of jails and other physical hardware, with the exception of one Debian server which I had the hardest time dealing with (it would be FreeBSD too if 802.11ac support was there as it is acting as my WiFi/gateway/IDS/IPS). I loved my FreeBSD servers, and yes I will write posts about each one soon enough. I wanted that cleanliness and familiarity on my desktop as well (I really love the ports collection!). It’s settled – I will run FreeBSD on my laptop. This also created a new rivalry with my father, which is not a bad thing either.
Playing Devil’s Advocate
The first thing I needed to do was backup my Windows data. This was easy enough, just run a Windows Image Backup and it will- wait, what? Why isn’t this working? I didn’t want to fiddle with this too long because I didn’t actually need an image just the data. I ended up just copying over the files to an external hard disk. Once that was done, I downloaded and verified the latest FreeBSD 11.1 RELEASE memstick image and flashed it to my trusty 8GB Verbatim USB stick. I’ve had this thing since 2007, it works great for being my re-writable “CD”. I booted it up and started the installation. I knew this installer pretty well as I had test-installed FreeBSD and OpenBSD in VMs when I was researching a Unix style replacement OS last year. In any case, I left most of the defaults (I didn’t want to play with custom kernels right now) and I selected all packages. This downloaded them from the FreeBSD FTP server as I only had the memstick image. The installer finished and I was off to my first boot. Great! so far so good. FreeBSD loaded up and I did a ‘pkg upgrade’ just to make sure that everything was up to date.
Alright, time to get down to business. I needed nano. I just can’t use vi, or just not yet. I don’t care about being a vi-wizard, that’s just too much effort for me. Anyway, just a ‘pkg install nano’ and I had my editor. Next was obvious, I needed x11. XFCE was common, and there were plenty of tutorials out there. I wont bore you with those details, but it went something like ‘pkg install xfce’ and I got all the dependencies. Don’t forget to install SLiM to make it seamless. There are some configs in the .login I think. SLiM needs to be called once the boot drops you to the login so that you get SLiM’s nice GUI login instead of the CLI login screen. Then SLiM passes you off to XFCE. I think I followed this and this. Awesome. Now that x11 is working, it’s time to get all of my apps from Windows. Obviously, I can’t get everything (ie. Visual Studio, Office). But in my Windows installation, I had chosen many open-source or cross-compiled apps as they either worked better or so that I was ready to move away from Windows at a moments notice. ‘pkg install firefox thunderbird hexchat pidgin gpa keepass owncloud-client transmission-qt5 veracrypt openvpn’ were some immediate picks. There are a lot more that I downloaded later, but these are a few I use everyday. My laptop also has the same hybrid display adapter config that my dad’s has, but I chose to only run Intel graphics, so dual screens are no problem for me. I’ll add Nvidia support later, but it’s not a priority.
After I had imported my private keys and loaded my firefox and thunderbird settings, I wanted to get my Windows VM running right away as I was burning productive days at work fiddling with this. I had only two virtualisation options; qemu/kvm and bhyve. qemu/kvm wasn’t available in pkg, and looked real dirty to compile, from FreeBSD’s point of view. My dad is using qemu/kvm with virt-manager to manage all of his Windows/Unix VMs alike. I wanted that experience, but I also wanted packages that could be updated and I didn’t want to mess up a compile. bhyve was a better choice. It was built-in, it was more compatible with Windows (from what I read), and this is a great step-by-step article for Windows 10 on FreeBSD 11 bhyve! I had already tried to get virt-manager to work with bhyve with no luck. I don’t think libvirt connects with bhyve completely, or maybe my config is wrong. But I didn’t have time to fiddle with it. I managed it all through command lines and that has worked perfectly so far. Well sorta, there was an issue installing SQL Server, and only SQL Server, on my Windows VM. This was due to a missing ‘sectorsize=512’ setting on the disk parameter on the bhyve command line. That was only found after A LOT of digging because the SQL Server install didn’t log the error properly. I eventually found out that SQL Server only likes one sector size of disks for the install and my virtual disk geometry was incorrect.
Apps Apps Apps
I installed Windows 10 on my bhyve VM and I got that all setup with the apps I needed for work. Mostly Office, Visual Studio, and vSphere for managing our server farm. Plus all of the annoying 3rd party VPN software (I’m looking at you Dell and Cisco). Alright, with the Windows VM done, I can now work at work and finish FreeBSD mostly during the nights. I still needed my remote files (I setup an ownCloud instance on a FreeNAS jail at home) so I setup the client. Now, normally on Windows I would come to work and connect to my home network using OpenVPN (again, I have a OpenVPN FreeNAS jail at home) and the ownCloud desktop would be able to handle changing DNS destination IPs Not on FreeBSD (and Linux too?). I ended up just configuring the ownCloud client to just connect to the home LAN IP for the ownCloud server and always connecting the OpenVPN to sync things. It kinda sucks, but at least it works. I left that running at home overnight to get a full sync (~130GB cloud sync, another reason I use it over Google or Microsoft). Once that was done I moved onto the fstab as I had another 1TB SSD in my laptop with other files. I messed around with fstab and my NFS shares to my FreeNAS at home, but took them out as they made the boot time so long when I wasn’t at home. I would only mount them when my OpenVPN connected or manually. I really wanted to install SpaceFM, but it’s only available as a package on Debian and their non-package install script doesn’t work on FreeBSD (packages are named differently). I tried doing it manually, but it was too much work. As my dad was the one who introduced me to it, he still uses it as a use-case for his Debian setup. Instead I kept to the original PCManFM and it works just fine. I also loaded up my Bitcoin and Litecoin wallets and pointed them to the blockchain that I has used on Windows after their sync, they loaded perfectly and my balances were there. I kinda wish there was the Bitcoin-ABC full node Bitcoin Cash wallet package on FreeBSD, but I’m sure it will come out later.
The rest is essentially just tweaks and making the environment more comfortable for me, and with most programs installed as packages I feel a lot better with upgrades and audit checking (‘pkg audit -F’ is really helpful!). I will always hate Python, actually, I will always hate any app that has it’s own package manager. I do miss the GUI GitHub tool on Windows. It was a really good-looking way to view all of my repos. The last thing (which is increasing it’s priority every time I go to a social media site or YouTube) is fonts. My god I never thought it was such a problem, and UTF support is complicated. If anyone knows how to get all UTF characters to show up, please let me know. I’d really like Wikipedia articles to load perfectly (I followed this post and there are still some missing). There are some extra tweaks I followed here and here.
Conclusion
I successfully migrated from Windows 10 to FreeBSD 11.1 with minimal consequence. Shout out goes to the entire FreeBSD community. So many helpful people in there, and the forums are a great place to find tons of information. Also thanks to the ones who wrote the how-to articles I’ve referenced. I never would have gotten bhyve to work and I’d still probably be messing with my X config without them. I guess my take home from this is to not be afraid to make changes that may change how comfortable I am in an environment. I’m always open to comments and questions, please feel free to make them below. I purposefully didn’t include too many technical things or commands in this article as I wanted to focus on the larger picture of the migration as a whole not the struggles of xorg.conf, but if you would like to see some of the configs or commands I used, let me know and I’ll include some!
TrueOS Rules of Conduct (https://www.trueos.org/rulesofconduct/)
We believe code is truly agnostic and embrace inclusiveness regardless of a person’s individual beliefs. As such we only ask the following when participating in TrueOS public events and digital forums:
Treat each other with respect and professionalism.
Leave personal and TrueOS unrelated conversations to other channels.
In other words, it’s all about the code. Users who feel the above rules have been violated in some way can register a complaint with abuse@trueos.org
+ Shorter than the BSD License (https://twitter.com/trueos/status/965994363070353413)
+ Positive response from the community (https://twitter.com/freebsdbytes/status/966567686015782912)
I really like the @TrueOS Code of Conduct, unlike some other CoCs. It's short, clear and covers everything.
Most #OpenSource projects are labour of love. Why do you need a something that reads like a legal contract?
FreeBSD: The Unknown Giant (https://neomoevius.tumblr.com/post/171108458234/freebsd-the-unknown-giant)
I decided to write this article as a gratitude for the recent fast answer of the FreeBSD/TrueOS community with my questions and doubts. I am impressed how fast and how they tried to help me about this operating system which I used in the past(2000-2007) but recently in 2017 I began to use it again.
+ A lot has changed in 10 years
I was looking around the internet, trying to do some research about recent information about FreeBSD and other versions or an easy to use spins like PCBSD (now TrueOS)
I used to be Windows/Mac user for so many years until 2014 when I decided to use Linux as my desktop OS just because I wanted to use something different. I always wanted to use unix or a unix-like operating system, nowadays my main objective is to learn more about  these operating systems (Debian Linux, TrueOS or FreeBSD).
FreeBSD has similarities with Linux, with two major differences in scope and licensing: FreeBSD maintains a complete operating system, i.e. the project delivers kernel, device drivers, userland utilities and documentation, as opposed to Linux delivering a kernel and drivers only and relying on third-parties for system software; and FreeBSD source code is generally released under a permissive BSD license as opposed to the copyleft GPL used by Linux.“
But why do I call FreeBSD “The Unknown Giant”?, because the code base of this operating system has been used by other companies to develop their own operating system for products like computers or also game consoles.
+ FreeBSD is used for storage appliances, firewalls, email scanners, network scanners, network security appliances, load balancers, video servers, and more
So many people now will learn that not only “linux is everywhere” but also that “FreeBSD is everywhere too”
By the way speaking about movies, Do you remember the movie “The Matrix”? FreeBSD was used to make the movie: “The photo-realistic surroundings generated by this method were incorporated into the bullet time scene, and linear interpolation filled in any gaps of the still images to produce a fluent dynamic motion; the computer-generated “lead in” and “lead out” slides were filled in between frames in sequence to get an illusion of orbiting the scene. Manex Visual Effects used a cluster farm running the Unix-like operating system FreeBSD to render many of the film’s visual effects”
+ FreeBSD Press Release re: The Matrix  (https://www.freebsd.org/news/press-rel-1.html)
I hope that I gave a good reference, information and now so many people can understand why I am going to use just Debian Linux and FreeBSD(TrueOS) to do so many different stuff (music, 3d animation, video editing and text editing) instead use a Mac or Windows.
+ FreeBSD really is the unknown giant.
OpenBSD and FreeDOS vs the hell in earth (https://steemit.com/openbsd/@npna/openbsd-and-freedos-vs-the-hell-in-earth)
Yes sir, yes. Our family, composed until now by OpenBSD, Alpine Linux and Docker is rapidly growing. And yes, sir. Yes. All together we're fighting against your best friends, the infamous, the ugliest, the worst...the dudes called the privacy cannibals. Do you know what i mean, sure?
We're working hard, no matter what time is it, no matter in what part in the world we are, no matter if we've no money. We perfectly know that you cannot do nothing against the true. And we're doing our best to expand our true, our doors are opened to all the good guys, there's a lot here but their brain was fucked by your shit tv, your fake news, your laws, etc etc etc. We're alive, we're here to fight against you.
Tonight, yes it's a Friday night and we're working, we're ready to welcome with open arms an old guy, his experience will give us more power. Welcome to: FreeDOS
But why we want to build a bootable usb stick with FreeDOS under our strong OpenBSD? The answer is as usual to fight against the privacy cannibals!
More than one decade ago the old BIOS was silently replaced by the more capable and advanced UEFI, this is absolutely normal because of the pass of the years and exponencial grow of the power of our personal computers. UEFI is a complex system, it's like a standalone system operative with direct access to every component of our (yes, it's our not your!) machine. But...wait a moment...do you know how to use it? Do you ever know that it exist? And one more thing, it's secure? The answer to this question is totally insane, no, it's not secure. The idea is good, the company that started in theory is one of the most important in IT, it's Intel.
The history is very large and obviously we're going to go very deep in it, but trust me UEFI and the various friend of him, like ME, TPM are insecure and closed source! Like the hell in earth.
A FreeDOS bootable usb image under OpenBSD
But let's start preparing our OpenBSD to put order in this chaos:
$ mkdir -p freedos/stuff
$ cd freedos/stuff
$ wget https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.0/fdboot.img
$ wget https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/sys/sys-freedos-linux/sys-freedos-linux.zip
$ wget https://download.lenovo.com/consumer/desktop/o35jy19usa_y900.exe
$ wget http://145.130.102.57/domoticx/software/amiflasher/AFUDOS%20Flasher%205.05.04.7z
Explanation in clear language as usual: create two directory, download the minimal boot disc image of FreeDOS, download Syslinux assembler MBR bootloaders, download the last Windows only UEFI update from Lenovo and download the relative unknown utility from AMI to flash our motherboard UEFI chipset. Go ahead:
$ doas pkg_add -U nasm unzip dosfstools cabextract p7zip
nasm the Netwide Assembler, a portable 80x86 assembler. 
unzip list, test and extract compressed files in a ZIP archive. 
dosfstoolsa collections of utilities to manipulate MS-DOSfs. 
cabextract program to extract files from cabinet. 
p7zipcollection of utilities to manipulate 7zip archives.

$ mkdir sys-freedos-linux &amp;amp;&amp;amp; cd sys-freedos-linux
$ unzip ../sys-freedos-linux.zip
$ cd ~/freedos &amp;amp;&amp;amp; mkdir old new
$ dd if=/dev/null of=freedos.img bs=1024 seek=20480
$ mkfs.fat freedos.img

Create another working directory, cd into it, unzip the archive that we've downloaded, return to the working root and create another twos directories. dd is one of the most important utilities in the unix world to manipulate at byte level input and output:
The dd utility copies the standard input to the standard output, applying any specified conversions. Input data is read and written in 512-byte blocks. If input reads are short, input from multiple reads are aggregated to form the output block. When finished, dd displays the number of complete and partial input and output blocks and truncated input records to the standard error output.
We're creating here a virtual disk with bs=1024 we're setting both input and output block to 1024bytes; with seek=20480 we require 20480bytes. This is the result:
-rw-r--r-- 1 taglio taglio 20971520 Feb 3 00:11 freedos.img.
Next we format the virtual disk using the MS-DOS filesystem. Go ahead:

$ doas su
$ perl stuff/sys-freedos-linux/sys-freedos.pl --disk=freedos.img
$ vnconfig vnd0 stuff/fdboot.img
$ vnconfig vnd1 freedos.img
$ mount -t msdos /dev/vnd0c old/
$ mount -t msdos /dev/vnd1c new/

We use the perl utility from syslinux to write the MBR of our virtual disk freedos.img. Next we create to loop virtual node using the OpenBSD utility vnconfig. Take care here because it is quite different from Linux, but as usual is clear and simple. The virtual nodes are associated to the downloaded fdboot.img and the newly created freedos.img. Next we mount the two virtual nodes cpartitions; in OpenBSD cpartition describes the entire physical disk. Quite different from Linux, take care.

$ cp -R old/* new/
$ cd stuff
$ mkdir o35jy19usa
$ cabextract -d o35jy19usa o35jy19usa_y900.exe
$ doas su
$ cp o35jy19usa/ ../new/
$ mkdir afudos &amp;amp;&amp;amp; cd afudos
$ 7z e ../AFUDOS*
$ doas su
$ cp AFUDOS.exe ../../new/
$ umount ~/freedos/old/ &amp;amp;&amp;amp; umount ~/freedos/new/
$ vnconfig -u vnd1 &amp;amp;&amp;amp; vnconfig -u vnd0

Copy all files and directories in the new virtual node partition, extract the Lenovo cabinet in a new directory, copy the result in our new image, extract the afudos utility and like the others copy it. Umount the partitions and destroy the loop vnode.
Beastie Bits
NetBSD - A modern operating system for your retro battlestation (https://www.geeklan.co.uk/files/fosdem2018-retro)
FOSDEM OS distribution (https://twitter.com/pvaneynd/status/960181163578019840/photo/1)
Update on two pledge-related changes (https://marc.info/?l=openbsd-tech&amp;amp;m=151268831628549)
*execpromises (https://marc.info/?l=openbsd-cvs&amp;amp;m=151304116010721&amp;amp;w=2)
Slides for (BSD from scratch - from source to OS with ease on NetBSD) (https://www.geeklan.co.uk/files/fosdem2018-bsd/)
Goobyte LastPass: You're fired!  (https://blog.crashed.org/goodbye-lastpass/)
***
Feedback/Questions
Scott - ZFS Mirror with SLOG (http://dpaste.com/22Z8C6Z#wrap)
Troels - Question about compressed ARC (http://dpaste.com/3X2R1BV#wrap)
Jeff - FreeBSD Desktop DNS (http://dpaste.com/2BQ9HFB#wrap)
Jonathon - Bhyve and gpu passthrough (http://dpaste.com/0TTT0DB#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>How the term open source was created, running FreeBSD on ThinkPad T530, Moving away from Windows, Unknown Giants, as well as OpenBSD and FreeDOS.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://opensource.com/article/18/2/coining-term-open-source-software" rel="nofollow">How I coined the term &#39;open source&#39;</a></h3>

<blockquote>
<p>In a few days, on February 3, the 20th anniversary of the introduction of the term &quot;open source software&quot; is upon us. As open source software grows in popularity and powers some of the most robust and important innovations of our time, we reflect on its rise to prominence.</p>

<p>I am the originator of the term &quot;open source software&quot; and came up with it while executive director at Foresight Institute. Not a software developer like the rest, I thank Linux programmer Todd Anderson for supporting the term and proposing it to the group.</p>

<p>This is my account of how I came up with it, how it was proposed, and the subsequent reactions. Of course, there are a number of accounts of the coining of the term, for example by Eric Raymond and Richard Stallman, yet this is mine, written on January 2, 2006.</p>

<p>It has never been published, until today.</p>

<p>The introduction of the term &quot;open source software&quot; was a deliberate effort to make this field of endeavor more understandable to newcomers and to business, which was viewed as necessary to its spread to a broader community of users. The problem with the main earlier label, &quot;free software,&quot; was not its political connotations, but that—to newcomers—its seeming focus on price is distracting. A term was needed that focuses on the key issue of source code and that does not immediately confuse those new to the concept. The first term that came along at the right time and fulfilled these requirements was rapidly adopted: open source.</p>

<p>This term had long been used in an &quot;intelligence&quot; (i.e., spying) context, but to my knowledge, use of the term with respect to software prior to 1998 has not been confirmed. The account below describes how the term open source software caught on and became the name of both an industry and a movement.</p>
</blockquote>

<ul>
<li>Meetings on computer security</li>
</ul>

<blockquote>
<p>In late 1997, weekly meetings were being held at Foresight Institute to discuss computer security. Foresight is a nonprofit think tank focused on nanotechnology and artificial intelligence, and software security is regarded as central to the reliability and security of both. We had identified free software as a promising approach to improving software security and reliability and were looking for ways to promote it. Interest in free software was starting to grow outside the programming community, and it was increasingly clear that an opportunity was coming to change the world. However, just how to do this was unclear, and we were groping for strategies.</p>

<p>At these meetings, we discussed the need for a new term due to the confusion factor. The argument was as follows: those new to the term &quot;free software&quot; assume it is referring to the price. Oldtimers must then launch into an explanation, usually given as follows: &quot;We mean free as in freedom, not free as in beer.&quot; At this point, a discussion on software has turned into one about the price of an alcoholic beverage. The problem was not that explaining the meaning is impossible—the problem was that the name for an important idea should not be so confusing to newcomers. A clearer term was needed. No political issues were raised regarding the free software term; the issue was its lack of clarity to those new to the concept.</p>
</blockquote>

<ul>
<li>Releasing Netscape</li>
</ul>

<blockquote>
<p>On February 2, 1998, Eric Raymond arrived on a visit to work with Netscape on the plan to release the browser code under a free-software-style license. We held a meeting that night at Foresight&#39;s office in Los Altos to strategize and refine our message. In addition to Eric and me, active participants included Brian Behlendorf, Michael Tiemann, Todd Anderson, Mark S. Miller, and Ka-Ping Yee. But at that meeting, the field was still described as free software or, by Brian, &quot;source code available&quot; software.</p>

<p>While in town, Eric used Foresight as a base of operations. At one point during his visit, he was called to the phone to talk with a couple of Netscape legal and/or marketing staff. When he was finished, I asked to be put on the phone with them—one man and one woman, perhaps Mitchell Baker—so I could bring up the need for a new term. They agreed in principle immediately, but no specific term was agreed upon.</p>

<p>Between meetings that week, I was still focused on the need for a better name and came up with the term &quot;open source software.&quot; While not ideal, it struck me as good enough. I ran it by at least four others: Eric Drexler, Mark Miller, and Todd Anderson liked it, while a friend in marketing and public relations felt the term &quot;open&quot; had been overused and abused and believed we could do better. He was right in theory; however, I didn&#39;t have a better idea, so I thought I would try to go ahead and introduce it. In hindsight, I should have simply proposed it to Eric Raymond, but I didn&#39;t know him well at the time, so I took an indirect strategy instead.</p>

<p>Todd had agreed strongly about the need for a new term and offered to assist in getting the term introduced. This was helpful because, as a non-programmer, my influence within the free software community was weak. My work in nanotechnology education at Foresight was a plus, but not enough for me to be taken very seriously on free software questions. As a Linux programmer, Todd would be listened to more closely.</p>
</blockquote>

<ul>
<li>The key meeting</li>
</ul>

<blockquote>
<p>Later that week, on February 5, 1998, a group was assembled at VA Research to brainstorm on strategy. Attending—in addition to Eric Raymond, Todd, and me—were Larry Augustin, Sam Ockman, and attending by phone, Jon &quot;maddog&quot; Hall.</p>

<p>The primary topic was promotion strategy, especially which companies to approach. I said little, but was looking for an opportunity to introduce the proposed term. I felt that it wouldn&#39;t work for me to just blurt out, &quot;All you technical people should start using my new term.&quot; Most of those attending didn&#39;t know me, and for all I knew, they might not even agree that a new term was greatly needed, or even somewhat desirable.</p>

<p>Fortunately, Todd was on the ball. Instead of making an assertion that the community should use this specific new term, he did something less directive—a smart thing to do with this community of strong-willed individuals. He simply used the term in a sentence on another topic—just dropped it into the conversation to see what happened. I went on alert, hoping for a response, but there was none at first. The discussion continued on the original topic. It seemed only he and I had noticed the usage.</p>

<p>Not so—memetic evolution was in action. A few minutes later, one of the others used the term, evidently without noticing, still discussing a topic other than terminology. Todd and I looked at each other out of the corners of our eyes to check: yes, we had both noticed what happened. I was excited—it might work! But I kept quiet: I still had low status in this group. Probably some were wondering why Eric had invited me at all.</p>

<p>Toward the end of the meeting, the question of terminology was brought up explicitly, probably by Todd or Eric. Maddog mentioned &quot;freely distributable&quot; as an earlier term, and &quot;cooperatively developed&quot; as a newer term. Eric listed &quot;free software,&quot; &quot;open source,&quot; and &quot;sourceware&quot; as the main options. Todd advocated the &quot;open source&quot; model, and Eric endorsed this. I didn&#39;t say much, letting Todd and Eric pull the (loose, informal) consensus together around the open source name. It was clear that to most of those at the meeting, the name change was not the most important thing discussed there; a relatively minor issue. Only about 10% of my notes from this meeting are on the terminology question.</p>

<p>But I was elated. These were some key leaders in the community, and they liked the new name, or at least didn&#39;t object. This was a very good sign. There was probably not much more I could do to help; Eric Raymond was far better positioned to spread the new meme, and he did. Bruce Perens signed on to the effort immediately, helping set up Opensource.org and playing a key role in spreading the new term.</p>

<p>For the name to succeed, it was necessary, or at least highly desirable, that Tim O&#39;Reilly agree and actively use it in his many projects on behalf of the community. Also helpful would be use of the term in the upcoming official release of the Netscape Navigator code. By late February, both O&#39;Reilly &amp; Associates and Netscape had started to use the term.</p>
</blockquote>

<ul>
<li>Getting the name out</li>
</ul>

<blockquote>
<p>After this, there was a period during which the term was promoted by Eric Raymond to the media, by Tim O&#39;Reilly to business, and by both to the programming community. It seemed to spread very quickly.</p>

<p>On April 7, 1998, Tim O&#39;Reilly held a meeting of key leaders in the field. Announced in advance as the first &quot;Freeware Summit,&quot; by April 14 it was referred to as the first &quot;Open Source Summit.&quot;</p>

<p>These months were extremely exciting for open source. Every week, it seemed, a new company announced plans to participate. Reading Slashdot became a necessity, even for those like me who were only peripherally involved. I strongly believe that the new term was helpful in enabling this rapid spread into business, which then enabled wider use by the public.</p>

<p>A quick Google search indicates that &quot;open source&quot; appears more often than &quot;free software,&quot; but there still is substantial use of the free software term, which remains useful and should be included when communicating with audiences who prefer it.</p>
</blockquote>

<ul>
<li>A happy twinge</li>
</ul>

<blockquote>
<p>When an early account of the terminology change written by Eric Raymond was posted on the Open Source Initiative website, I was listed as being at the VA brainstorming meeting, but not as the originator of the term. This was my own fault; I had neglected to tell Eric the details. My impulse was to let it pass and stay in the background, but Todd felt otherwise. He suggested to me that one day I would be glad to be known as the person who coined the name &quot;open source software.&quot; He explained the situation to Eric, who promptly updated his site.</p>

<p>Coming up with a phrase is a small contribution, but I admit to being grateful to those who remember to credit me with it. Every time I hear it, which is very often now, it gives me a little happy twinge.</p>

<p>The big credit for persuading the community goes to Eric Raymond and Tim O&#39;Reilly, who made it happen. Thanks to them for crediting me, and to Todd Anderson for his role throughout. The above is not a complete account of open source history; apologies to the many key players whose names do not appear. Those seeking a more complete account should refer to the links in this article and elsewhere on the net.</p>
</blockquote>

<hr>

<h3><a href="https://www.c0ffee.net/blog/freebsd-on-a-laptop" rel="nofollow">FreeBSD on a Laptop - A guide to a fully functional installation of FreeBSD on a ThinkPad T530</a></h3>

<blockquote>
<p>As I stated my previous post, I recently dug up my old ThinkPad T530 after the embarrassing stream of OS X security bugs this month. Although this ThinkPad ran Gentoo faithfully during my time in graduate school at Clemson, these days I&#39;d much rather spend time my wife and baby than fighting with emerge and USE flags. FreeBSD has always been my OS of choice, and laptop support seems to be much better than it was a few years ago. In this guide, I&#39;ll show you the tweaks I made to wrestle FreeBSD into a decent experience on a laptop.</p>

<p>Unlike my usual posts, this time I&#39;m going to assume you&#39;re already pretty familiar with FreeBSD. If you&#39;re a layman looking for your first BSD-based desktop, I highly recommend checking out TrueOS (previously PC-BSD): they&#39;ve basically taken FreeBSD and packaged it with all the latest drivers, along with a user-friendly installer and custom desktop environment out of the box. TrueOS is an awesome project–the only reason I don&#39;t use it is because I&#39;m old, grumpy, and persnickety about having my operating system just so.</p>

<p>Anyway, if you&#39;d still like to take the plunge, read on. Keep in mind, I&#39;m using a ThinkPad T530, but other ThinkPads of the same generation should be similarly compatible.</p>
</blockquote>

<ul>
<li><p>Here&#39;s what you&#39;ll get:</p>

<ul>
<li>Decent battery life (8-9 hours with a new 9-cell battery)</li>
<li>UEFI boot and full-disk encryption</li>
<li>WiFi (Intel Ultimate-N 6300)</li>
<li>Ethernet (Intel PRO/1000)</li>
<li>Screen brightness adjustment</li>
<li>Suspend/Resume on lid close (make sure to disable TPM in BIOS)</li>
<li>Audio (Realtek ALC269 HDA, speakers and headphone jack)</li>
<li>Keyboard multimedia buttons</li>
<li>Touchpad/Trackpoint</li>
<li>Graphics Acceleration (with integrated Intel graphics, NVIDIA card disabled in BIOS)</li>
</ul></li>
<li><p>What I haven&#39;t tested yet:</p>

<ul>
<li>Bluetooth</li>
<li>Webcam</li>
<li>Fingerprint reader</li>
<li>SD Card slot</li>
</ul></li>
<li><p>Installation</p></li>
<li><p>Power Saving</p></li>
<li><p>Tweaks for Desktop Use</p></li>
<li><p>X11</p></li>
<li><p>Fonts</p></li>
<li><p>Login Manager: SLiM</p></li>
<li><p>Desktop Environment: i3</p></li>
<li><p>Applications</p></li>
</ul>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/the_llvm_sanitizers_stage_accomplished" rel="nofollow">The LLVM Sanitizers stage accomplished</a></h3>

<blockquote>
<p>I&#39;ve managed to get the Memory Sanitizer to work for the elementary base system utilities, like ps(1), awk(1) and ksh(1). This means that the toolchain is ready for tests and improvements. I&#39;ve iterated over the basesystem utilities and I looked for bugs, both in programs and in sanitizers. The number of detected bugs in the userland programs was low, there merely was one reading of an uninitialized variable in ps(1).</p>
</blockquote>

<ul>
<li>A prebuilt LLVM toolchain</li>
</ul>

<blockquote>
<p>I&#39;ve prepared a prebuilt toolchain with Clang, LLVM, LLDB and compiler-rt for NetBSD/amd64. I prepared the toolchain on 8.99.12, however I have received reports that it works on other older releases. Link: llvm-clang-compilerrt-lldb-7.0.0beta_2018-01-24.tar.bz2</p>

<p>The archive has to be untarballed to /usr/local (however it might work to some extent in other paths).</p>

<p>This toolchain contains a prebuilt tree of the LLVM projects from a snapshot of 7.0.0(svn). It is a pristine snapshot of HEAD with patches from pkgsrc-wip for llvm, clang, compiler-rt and lldb.</p>
</blockquote>

<ul>
<li>Sanitizers

<ul>
<li>Notable changes in sanitizers, all of them are in the context of NetBSD support.</li>
</ul></li>
</ul>

<pre><code>Added fstat(2) MSan interceptor.
Support for kvm(3) interceptors in the common sanitizer code.
Added devname(3) and devname_r(3) interceptors to the common sanitizer code.
Added sysctl(3) familty of functions interceptors in the common sanitizer code.
Added strlcpy(3)/strlcat(3) interceptors in the common sanitizer code.
Added getgrouplist(3)/getgroupmembership(3) interceptors in the common sanitizer code.
Correct ctype(3) interceptors in a code using Native Language Support.
Correct tzset(3) interceptor in MSan.
Correct localtime(3) interceptor in the common sanitizer code.
Added paccept(2) interceptor to the common sanitizer code.
Added access(2) and faccessat(2) interceptors to the common sanitizer code.
Added acct(2) interceptor to the common sanitizer code.
Added accept4(2) interceptor to the common sanitizer code.
Added fgetln(3) interceptor to the common sanitizer code.
Added interceptors for the pwcache(3)-style functions in the common sanitizer code.
Added interceptors for the getprotoent(3)-style functions in the common sanitizer code.
Added interceptors for the getnetent(3)-style functions in the common sanitizer code.
Added interceptors for the fts(3)-style functions in the common sanitizer code.
Added lstat(3) interceptor in MSan.
Added strftime(3) interceptor in the common sanitizer code.
Added strmode(3) interceptor in the common sanitizer code.
Added interceptors for the regex(3)-style functions in the common sanitizer code.
Disabled unwanted interceptor __sigsetjmp in TSan.
</code></pre>

<ul>
<li>Base system changes</li>
</ul>

<blockquote>
<p>I&#39;ve tidied up inclusion of the internal namespace.h header in libc. This has hidden the usage of public global symbol names of:</p>
</blockquote>

<pre><code>strlcat -&gt; _strlcat
sysconf -&gt; __sysconf
closedir -&gt; _closedir
fparseln -&gt; _fparseln
kill -&gt; _kill
mkstemp -&gt; _mkstemp
reallocarr -&gt; _reallocarr
strcasecmp -&gt; _strcasecmp
strncasecmp -&gt; _strncasecmp
strptime -&gt; _strptime
strtok_r -&gt; _strtok_r
sysctl -&gt; _sysctl
dlopen -&gt; __dlopen
dlclose -&gt; __dlclose
dlsym -&gt; __dlsym
strlcpy -&gt; _strlcpy
fdopen -&gt; _fdopen
mmap -&gt; _mmap
strdup -&gt; _strdup
</code></pre>

<blockquote>
<p>The purpose of these changes was to stop triggering interceptors recursively. Such interceptors lead to sanitization of internals of unprepared (not recompiled with sanitizers) prebuilt code. It&#39;s not trivial to sanitize libc&#39;s internals and the sanitizers are not designed to do so. This means that they are not a full replacement of Valgrind-like software, but a a supplement in the developer toolbox. Valgrind translates native code to a bytecode virtual machine, while sanitizers are designed to work with interceptors inside the pristine elementary libraries (libc, libm, librt, libpthread) and embed functionality into the executable&#39;s code.</p>

<p>I&#39;ve also reverted the vadvise(2) syscall removal, from the previous month. This caused a regression in legacy code recompiled against still supported compat layers. Newly compiled code will use a libc&#39;s stub of vadvise(2).</p>

<p>I&#39;ve also prepared a patch installing dedicated headers for sanitizers along with the base system GCC. It&#39;s still discussed and should land the sources soon.</p>
</blockquote>

<ul>
<li>Future directions and goals

<ul>
<li>Possible paths in random order:</li>
<li>In the quartet of UBSan (Undefined Behavior Sanitizer), ASan (Address Sanitizer), TSan (Thread Sanitizer), MSan (Memory Sanitizer) we need to add the fifth basic sanitizer: LSan (Leak Sanitizer). The Leak Sanitizer (detector of memory leaks) demands a stable ptrace(2) interface for processes with multiple threads (unless we want to build a custom kernel interface).</li>
<li>Integrate the sanitizers with the userland framework in order to ship with the native toolchain to users.</li>
<li>Port sanitizers from LLVM to GCC.</li>
<li>Allow to sanitize programs linked against userland libraries other than libc, librt, libm and libpthread; by a global option (like MKSANITIZER) producing a userland that is partially prebuilt with a desired sanitizer. This is required to run e.g. MSanitized programs against editline(3). So far, there is no Operating System distribution in existence with a native integration with sanitizers. There are 3rd party scripts for certain OSes to build a stack of software dependencies in order to validate a piece of software.</li>
<li>Execute ATF tests with the userland rebuilt with supported flavors of sanitizers and catch regressions.</li>
<li>Finish porting of modern linkers designed for large C++ software, such as GNU GOLD and LLVM LLD. Today the bottleneck with building the LLVM toolchain is a suboptimal linker GNU ld(1).</li>
</ul></li>
</ul>

<blockquote>
<p>I&#39;ve decided to not open new battlefields and return now to porting LLDB and fixing ptrace(2).</p>
</blockquote>

<ul>
<li>Plan for the next milestone

<ul>
<li>Keep upstreaming a pile of local compiler-rt patches.</li>
<li>Restore the LLDB support for traced programs with a single thread.</li>
</ul></li>
</ul>

<hr>

<h2>Interview - Goran Mekic - <a href="mailto:meka@tilda.center" rel="nofollow">meka@tilda.center</a> / <a href="https://twitter.com/meka_floss" rel="nofollow">@meka_floss</a></h2>

<ul>
<li><a href="https://bsdstore.ru" rel="nofollow">CBSD website</a> Jail and VM Manager
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.manios.ca/blog/2018/01/finally-moving-away-from-windows/" rel="nofollow">Finally Moving Away From Windows</a></h3>

<ul>
<li>Broken Window</li>
</ul>

<blockquote>
<p>Thanks to a combination of some really impressive malware, bad clicking, and poor website choices, I had to blow away my Windows 10 installation. Not that it was Window’s fault, but a piece of malware had infected my computer when I tried to download a long lost driver for an even longer lost RAID card for a server. A word of advice – the download you’re looking for is never on an ad-infested forum in another language. In any case, I had been meaning to switch away from Windows soon. I didn’t have my entire plan ready, but now was as good a time as any.</p>

<p>My line of work requires me to maintain some form of Windows installation, so I decided to keep it in a VM rather than dual booting as I was developing code and not running any high-end visual stuff like games. My first thought was to install Arch or Gentoo Linux, but the last time I attempted a Gentoo installation it left me bootless. Not that there is anything wrong with Gentoo, it was probably my fault, but I like the idea of some sort of installer so I looked at rock-solid Debian. My dad had installed Debian on his sweet new cutting-edge Lenovo laptop he received recently from work. He often raves about his cool scripts and much more effective customized experience, but often complains about his hybrid GPU support as he has an Intel/Nvidia hybrid display adapter (he has finally resolved it and now boasts his 6 connected displays).</p>

<p>I didn’t want to install Windows again, but something didn’t feel right about installing some flavour of Linux. Back at home I have a small collection of FreeBSD servers running in all sorts of jails and other physical hardware, with the exception of one Debian server which I had the hardest time dealing with (it would be FreeBSD too if 802.11ac support was there as it is acting as my WiFi/gateway/IDS/IPS). I loved my FreeBSD servers, and yes I will write posts about each one soon enough. I wanted that cleanliness and familiarity on my desktop as well (I really love the ports collection!). It’s settled – I will run FreeBSD on my laptop. This also created a new rivalry with my father, which is not a bad thing either.</p>
</blockquote>

<ul>
<li>Playing Devil’s Advocate</li>
</ul>

<blockquote>
<p>The first thing I needed to do was backup my Windows data. This was easy enough, just run a Windows Image Backup and it will- wait, what? Why isn’t this working? I didn’t want to fiddle with this too long because I didn’t actually need an image just the data. I ended up just copying over the files to an external hard disk. Once that was done, I downloaded and verified the latest FreeBSD 11.1 RELEASE memstick image and flashed it to my trusty 8GB Verbatim USB stick. I’ve had this thing since 2007, it works great for being my re-writable “CD”. I booted it up and started the installation. I knew this installer pretty well as I had test-installed FreeBSD and OpenBSD in VMs when I was researching a Unix style replacement OS last year. In any case, I left most of the defaults (I didn’t want to play with custom kernels right now) and I selected all packages. This downloaded them from the FreeBSD FTP server as I only had the memstick image. The installer finished and I was off to my first boot. Great! so far so good. FreeBSD loaded up and I did a ‘pkg upgrade’ just to make sure that everything was up to date.</p>

<p>Alright, time to get down to business. I needed nano. I just can’t use vi, or just not yet. I don’t care about being a vi-wizard, that’s just too much effort for me. Anyway, just a ‘pkg install nano’ and I had my editor. Next was obvious, I needed x11. XFCE was common, and there were plenty of tutorials out there. I wont bore you with those details, but it went something like ‘pkg install xfce’ and I got all the dependencies. Don’t forget to install SLiM to make it seamless. There are some configs in the .login I think. SLiM needs to be called once the boot drops you to the login so that you get SLiM’s nice GUI login instead of the CLI login screen. Then SLiM passes you off to XFCE. I think I followed this and this. Awesome. Now that x11 is working, it’s time to get all of my apps from Windows. Obviously, I can’t get everything (ie. Visual Studio, Office). But in my Windows installation, I had chosen many open-source or cross-compiled apps as they either worked better or so that I was ready to move away from Windows at a moments notice. ‘pkg install firefox thunderbird hexchat pidgin gpa keepass owncloud-client transmission-qt5 veracrypt openvpn’ were some immediate picks. There are a lot more that I downloaded later, but these are a few I use everyday. My laptop also has the same hybrid display adapter config that my dad’s has, but I chose to only run Intel graphics, so dual screens are no problem for me. I’ll add Nvidia support later, but it’s not a priority.</p>

<p>After I had imported my private keys and loaded my firefox and thunderbird settings, I wanted to get my Windows VM running right away as I was burning productive days at work fiddling with this. I had only two virtualisation options; qemu/kvm and bhyve. qemu/kvm wasn’t available in pkg, and looked real dirty to compile, from FreeBSD’s point of view. My dad is using qemu/kvm with virt-manager to manage all of his Windows/Unix VMs alike. I wanted that experience, but I also wanted packages that could be updated and I didn’t want to mess up a compile. bhyve was a better choice. It was built-in, it was more compatible with Windows (from what I read), and this is a great step-by-step article for Windows 10 on FreeBSD 11 bhyve! I had already tried to get virt-manager to work with bhyve with no luck. I don’t think libvirt connects with bhyve completely, or maybe my config is wrong. But I didn’t have time to fiddle with it. I managed it all through command lines and that has worked perfectly so far. Well sorta, there was an issue installing SQL Server, and only SQL Server, on my Windows VM. This was due to a missing ‘sectorsize=512’ setting on the disk parameter on the bhyve command line. That was only found after A LOT of digging because the SQL Server install didn’t log the error properly. I eventually found out that SQL Server only likes one sector size of disks for the install and my virtual disk geometry was incorrect.</p>
</blockquote>

<ul>
<li>Apps Apps Apps</li>
</ul>

<blockquote>
<p>I installed Windows 10 on my bhyve VM and I got that all setup with the apps I needed for work. Mostly Office, Visual Studio, and vSphere for managing our server farm. Plus all of the annoying 3rd party VPN software (I’m looking at you Dell and Cisco). Alright, with the Windows VM done, I can now work at work and finish FreeBSD mostly during the nights. I still needed my remote files (I setup an ownCloud instance on a FreeNAS jail at home) so I setup the client. Now, normally on Windows I would come to work and connect to my home network using OpenVPN (again, I have a OpenVPN FreeNAS jail at home) and the ownCloud desktop would be able to handle changing DNS destination IPs Not on FreeBSD (and Linux too?). I ended up just configuring the ownCloud client to just connect to the home LAN IP for the ownCloud server and always connecting the OpenVPN to sync things. It kinda sucks, but at least it works. I left that running at home overnight to get a full sync (~130GB cloud sync, another reason I use it over Google or Microsoft). Once that was done I moved onto the fstab as I had another 1TB SSD in my laptop with other files. I messed around with fstab and my NFS shares to my FreeNAS at home, but took them out as they made the boot time so long when I wasn’t at home. I would only mount them when my OpenVPN connected or manually. I really wanted to install SpaceFM, but it’s only available as a package on Debian and their non-package install script doesn’t work on FreeBSD (packages are named differently). I tried doing it manually, but it was too much work. As my dad was the one who introduced me to it, he still uses it as a use-case for his Debian setup. Instead I kept to the original PCManFM and it works just fine. I also loaded up my Bitcoin and Litecoin wallets and pointed them to the blockchain that I has used on Windows after their sync, they loaded perfectly and my balances were there. I kinda wish there was the Bitcoin-ABC full node Bitcoin Cash wallet package on FreeBSD, but I’m sure it will come out later.</p>

<p>The rest is essentially just tweaks and making the environment more comfortable for me, and with most programs installed as packages I feel a lot better with upgrades and audit checking (‘pkg audit -F’ is really helpful!). I will always hate Python, actually, I will always hate any app that has it’s own package manager. I do miss the GUI GitHub tool on Windows. It was a really good-looking way to view all of my repos. The last thing (which is increasing it’s priority every time I go to a social media site or YouTube) is fonts. My god I never thought it was such a problem, and UTF support is complicated. If anyone knows how to get all UTF characters to show up, please let me know. I’d really like Wikipedia articles to load perfectly (I followed this post and there are still some missing). There are some extra tweaks I followed here and here.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>I successfully migrated from Windows 10 to FreeBSD 11.1 with minimal consequence. Shout out goes to the entire FreeBSD community. So many helpful people in there, and the forums are a great place to find tons of information. Also thanks to the ones who wrote the how-to articles I’ve referenced. I never would have gotten bhyve to work and I’d still probably be messing with my X config without them. I guess my take home from this is to not be afraid to make changes that may change how comfortable I am in an environment. I’m always open to comments and questions, please feel free to make them below. I purposefully didn’t include too many technical things or commands in this article as I wanted to focus on the larger picture of the migration as a whole not the struggles of xorg.conf, but if you would like to see some of the configs or commands I used, let me know and I’ll include some!</p>
</blockquote>

<hr>

<h3><a href="https://www.trueos.org/rulesofconduct/" rel="nofollow">TrueOS Rules of Conduct</a></h3>

<blockquote>
<p>We believe code is truly agnostic and embrace inclusiveness regardless of a person’s individual beliefs. As such we only ask the following when participating in TrueOS public events and digital forums:<br>
Treat each other with respect and professionalism.<br>
Leave personal and TrueOS unrelated conversations to other channels.<br>
In other words, it’s all about the code. Users who feel the above rules have been violated in some way can register a complaint with <a href="mailto:abuse@trueos.org" rel="nofollow">abuse@trueos.org</a></p>

<ul>
<li><a href="https://twitter.com/trueos/status/965994363070353413" rel="nofollow">Shorter than the BSD License</a></li>
<li><a href="https://twitter.com/freebsdbytes/status/966567686015782912" rel="nofollow">Positive response from the community</a>
I really like the @TrueOS Code of Conduct, unlike some other CoCs. It&#39;s short, clear and covers everything.
Most #OpenSource projects are labour of love. Why do you need a something that reads like a legal contract?
***</li>
</ul>
</blockquote>

<h3><a href="https://neomoevius.tumblr.com/post/171108458234/freebsd-the-unknown-giant" rel="nofollow">FreeBSD: The Unknown Giant</a></h3>

<blockquote>
<p>I decided to write this article as a gratitude for the recent fast answer of the FreeBSD/TrueOS community with my questions and doubts. I am impressed how fast and how they tried to help me about this operating system which I used in the past(2000-2007) but recently in 2017 I began to use it again.</p>

<ul>
<li>A lot has changed in 10 years
I was looking around the internet, trying to do some research about recent information about FreeBSD and other versions or an easy to use spins like PCBSD (now TrueOS)
I used to be Windows/Mac user for so many years until 2014 when I decided to use Linux as my desktop OS just because I wanted to use something different. I always wanted to use unix or a unix-like operating system, nowadays my main objective is to learn more about  these operating systems (Debian Linux, TrueOS or FreeBSD).
FreeBSD has similarities with Linux, with two major differences in scope and licensing: FreeBSD maintains a complete operating system, i.e. the project delivers kernel, device drivers, userland utilities and documentation, as opposed to Linux delivering a kernel and drivers only and relying on third-parties for system software; and FreeBSD source code is generally released under a permissive BSD license as opposed to the copyleft GPL used by Linux.“
But why do I call FreeBSD “The Unknown Giant”?, because the code base of this operating system has been used by other companies to develop their own operating system for products like computers or also game consoles.</li>
<li>FreeBSD is used for storage appliances, firewalls, email scanners, network scanners, network security appliances, load balancers, video servers, and more
So many people now will learn that not only “linux is everywhere” but also that “FreeBSD is everywhere too”
By the way speaking about movies, Do you remember the movie “The Matrix”? FreeBSD was used to make the movie: “The photo-realistic surroundings generated by this method were incorporated into the bullet time scene, and linear interpolation filled in any gaps of the still images to produce a fluent dynamic motion; the computer-generated “lead in” and “lead out” slides were filled in between frames in sequence to get an illusion of orbiting the scene. Manex Visual Effects used a cluster farm running the Unix-like operating system FreeBSD to render many of the film’s visual effects”</li>
<li><a href="https://www.freebsd.org/news/press-rel-1.html" rel="nofollow">FreeBSD Press Release re: The Matrix </a>
I hope that I gave a good reference, information and now so many people can understand why I am going to use just Debian Linux and FreeBSD(TrueOS) to do so many different stuff (music, 3d animation, video editing and text editing) instead use a Mac or Windows.</li>
<li>FreeBSD really is the unknown giant.
***</li>
</ul>
</blockquote>

<h3><a href="https://steemit.com/openbsd/@npna/openbsd-and-freedos-vs-the-hell-in-earth" rel="nofollow">OpenBSD and FreeDOS vs the hell in earth</a></h3>

<blockquote>
<p>Yes sir, yes. Our family, composed until now by OpenBSD, Alpine Linux and Docker is rapidly growing. And yes, sir. Yes. All together we&#39;re fighting against your best friends, the infamous, the ugliest, the worst...the dudes called the privacy cannibals. Do you know what i mean, sure?<br>
We&#39;re working hard, no matter what time is it, no matter in what part in the world we are, no matter if we&#39;ve no money. We perfectly know that you cannot do nothing against the true. And we&#39;re doing our best to expand our true, our doors are opened to all the good guys, there&#39;s a lot here but their brain was fucked by your shit tv, your fake news, your laws, etc etc etc. We&#39;re alive, we&#39;re here to fight against you.<br>
Tonight, yes it&#39;s a Friday night and we&#39;re working, we&#39;re ready to welcome with open arms an old guy, his experience will give us more power. Welcome to: FreeDOS</p>

<p>But why we want to build a bootable usb stick with FreeDOS under our strong OpenBSD? The answer is as usual to fight against the privacy cannibals!<br>
More than one decade ago the old BIOS was silently replaced by the more capable and advanced UEFI, this is absolutely normal because of the pass of the years and exponencial grow of the power of our personal computers. UEFI is a complex system, it&#39;s like a standalone system operative with direct access to every component of our (yes, it&#39;s our not your!) machine. But...wait a moment...do you know how to use it? Do you ever know that it exist? And one more thing, it&#39;s secure? The answer to this question is totally insane, no, it&#39;s not secure. The idea is good, the company that started in theory is one of the most important in IT, it&#39;s Intel.<br>
The history is very large and obviously we&#39;re going to go very deep in it, but trust me UEFI and the various friend of him, like ME, TPM are insecure and closed source! Like the hell in earth.</p>
</blockquote>

<ul>
<li>A FreeDOS bootable usb image under OpenBSD</li>
</ul>

<blockquote>
<p>But let&#39;s start preparing our OpenBSD to put order in this chaos:</p>
</blockquote>

<p>$ mkdir -p freedos/stuff<br>
$ cd freedos/stuff<br>
$ wget <a href="https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.0/fdboot.img" rel="nofollow">https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.0/fdboot.img</a><br>
$ wget <a href="https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/sys/sys-freedos-linux/sys-freedos-linux.zip" rel="nofollow">https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/sys/sys-freedos-linux/sys-freedos-linux.zip</a><br>
$ wget <a href="https://download.lenovo.com/consumer/desktop/o35jy19usa_y900.exe" rel="nofollow">https://download.lenovo.com/consumer/desktop/o35jy19usa_y900.exe</a><br>
$ wget <a href="http://145.130.102.57/domoticx/software/amiflasher/AFUDOS%20Flasher%205.05.04.7z" rel="nofollow">http://145.130.102.57/domoticx/software/amiflasher/AFUDOS%20Flasher%205.05.04.7z</a><br>
Explanation in clear language as usual: create two directory, download the minimal boot disc image of FreeDOS, download Syslinux assembler MBR bootloaders, download the last Windows only UEFI update from Lenovo and download the relative unknown utility from AMI to flash our motherboard UEFI chipset. Go ahead:</p>

<p><code>$ doas pkg_add -U nasm unzip dosfstools cabextract p7zip</code></p>

<ul>
<li>nasm the Netwide Assembler, a portable 80x86 assembler. </li>
<li>unzip list, test and extract compressed files in a ZIP archive. </li>
<li>dosfstoolsa collections of utilities to manipulate MS-DOSfs. </li>
<li>cabextract program to extract files from cabinet. </li>
<li>p7zipcollection of utilities to manipulate 7zip archives.</li>
</ul>

<pre><code>$ mkdir sys-freedos-linux &amp;&amp; cd sys-freedos-linux
$ unzip ../sys-freedos-linux.zip
$ cd ~/freedos &amp;&amp; mkdir old new
$ dd if=/dev/null of=freedos.img bs=1024 seek=20480
$ mkfs.fat freedos.img
</code></pre>

<blockquote>
<p>Create another working directory, cd into it, unzip the archive that we&#39;ve downloaded, return to the working root and create another twos directories. dd is one of the most important utilities in the unix world to manipulate at byte level input and output:</p>

<p>The dd utility copies the standard input to the standard output, applying any specified conversions. Input data is read and written in 512-byte blocks. If input reads are short, input from multiple reads are aggregated to form the output block. When finished, dd displays the number of complete and partial input and output blocks and truncated input records to the standard error output.</p>

<p>We&#39;re creating here a virtual disk with bs=1024 we&#39;re setting both input and output block to 1024bytes; with seek=20480 we require 20480bytes. This is the result:</p>
</blockquote>

<p><code>-rw-r--r-- 1 taglio taglio 20971520 Feb 3 00:11 freedos.img.</code></p>

<blockquote>
<p>Next we format the virtual disk using the MS-DOS filesystem. Go ahead:</p>
</blockquote>

<pre><code>$ doas su
$ perl stuff/sys-freedos-linux/sys-freedos.pl --disk=freedos.img
$ vnconfig vnd0 stuff/fdboot.img
$ vnconfig vnd1 freedos.img
$ mount -t msdos /dev/vnd0c old/
$ mount -t msdos /dev/vnd1c new/
</code></pre>

<blockquote>
<p>We use the perl utility from syslinux to write the MBR of our virtual disk freedos.img. Next we create to loop virtual node using the OpenBSD utility vnconfig. Take care here because it is quite different from Linux, but as usual is clear and simple. The virtual nodes are associated to the downloaded fdboot.img and the newly created freedos.img. Next we mount the two virtual nodes cpartitions; in OpenBSD cpartition describes the entire physical disk. Quite different from Linux, take care.</p>
</blockquote>

<pre><code>$ cp -R old/* new/
$ cd stuff
$ mkdir o35jy19usa
$ cabextract -d o35jy19usa o35jy19usa_y900.exe
$ doas su
$ cp o35jy19usa/ ../new/
$ mkdir afudos &amp;&amp; cd afudos
$ 7z e ../AFUDOS*
$ doas su
$ cp AFUDOS.exe ../../new/
$ umount ~/freedos/old/ &amp;&amp; umount ~/freedos/new/
$ vnconfig -u vnd1 &amp;&amp; vnconfig -u vnd0
</code></pre>

<blockquote>
<p>Copy all files and directories in the new virtual node partition, extract the Lenovo cabinet in a new directory, copy the result in our new image, extract the afudos utility and like the others copy it. Umount the partitions and destroy the loop vnode.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.geeklan.co.uk/files/fosdem2018-retro" rel="nofollow">NetBSD - A modern operating system for your retro battlestation</a></li>
<li><a href="https://twitter.com/pvaneynd/status/960181163578019840/photo/1" rel="nofollow">FOSDEM OS distribution</a></li>
<li><a href="https://marc.info/?l=openbsd-tech&m=151268831628549" rel="nofollow">Update on two pledge-related changes</a></li>
<li><a href="https://marc.info/?l=openbsd-cvs&m=151304116010721&w=2" rel="nofollow">*execpromises</a></li>
<li><a href="https://www.geeklan.co.uk/files/fosdem2018-bsd/" rel="nofollow">Slides for (BSD from scratch - from source to OS with ease on NetBSD)</a></li>
<li><a href="https://blog.crashed.org/goodbye-lastpass/" rel="nofollow">Goobyte LastPass: You&#39;re fired! </a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Scott - <a href="http://dpaste.com/22Z8C6Z#wrap" rel="nofollow">ZFS Mirror with SLOG</a></li>
<li>Troels - <a href="http://dpaste.com/3X2R1BV#wrap" rel="nofollow">Question about compressed ARC</a></li>
<li>Jeff - <a href="http://dpaste.com/2BQ9HFB#wrap" rel="nofollow">FreeBSD Desktop DNS</a></li>
<li>Jonathon - <a href="http://dpaste.com/0TTT0DB#wrap" rel="nofollow">Bhyve and gpu passthrough</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>How the term open source was created, running FreeBSD on ThinkPad T530, Moving away from Windows, Unknown Giants, as well as OpenBSD and FreeDOS.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://opensource.com/article/18/2/coining-term-open-source-software" rel="nofollow">How I coined the term &#39;open source&#39;</a></h3>

<blockquote>
<p>In a few days, on February 3, the 20th anniversary of the introduction of the term &quot;open source software&quot; is upon us. As open source software grows in popularity and powers some of the most robust and important innovations of our time, we reflect on its rise to prominence.</p>

<p>I am the originator of the term &quot;open source software&quot; and came up with it while executive director at Foresight Institute. Not a software developer like the rest, I thank Linux programmer Todd Anderson for supporting the term and proposing it to the group.</p>

<p>This is my account of how I came up with it, how it was proposed, and the subsequent reactions. Of course, there are a number of accounts of the coining of the term, for example by Eric Raymond and Richard Stallman, yet this is mine, written on January 2, 2006.</p>

<p>It has never been published, until today.</p>

<p>The introduction of the term &quot;open source software&quot; was a deliberate effort to make this field of endeavor more understandable to newcomers and to business, which was viewed as necessary to its spread to a broader community of users. The problem with the main earlier label, &quot;free software,&quot; was not its political connotations, but that—to newcomers—its seeming focus on price is distracting. A term was needed that focuses on the key issue of source code and that does not immediately confuse those new to the concept. The first term that came along at the right time and fulfilled these requirements was rapidly adopted: open source.</p>

<p>This term had long been used in an &quot;intelligence&quot; (i.e., spying) context, but to my knowledge, use of the term with respect to software prior to 1998 has not been confirmed. The account below describes how the term open source software caught on and became the name of both an industry and a movement.</p>
</blockquote>

<ul>
<li>Meetings on computer security</li>
</ul>

<blockquote>
<p>In late 1997, weekly meetings were being held at Foresight Institute to discuss computer security. Foresight is a nonprofit think tank focused on nanotechnology and artificial intelligence, and software security is regarded as central to the reliability and security of both. We had identified free software as a promising approach to improving software security and reliability and were looking for ways to promote it. Interest in free software was starting to grow outside the programming community, and it was increasingly clear that an opportunity was coming to change the world. However, just how to do this was unclear, and we were groping for strategies.</p>

<p>At these meetings, we discussed the need for a new term due to the confusion factor. The argument was as follows: those new to the term &quot;free software&quot; assume it is referring to the price. Oldtimers must then launch into an explanation, usually given as follows: &quot;We mean free as in freedom, not free as in beer.&quot; At this point, a discussion on software has turned into one about the price of an alcoholic beverage. The problem was not that explaining the meaning is impossible—the problem was that the name for an important idea should not be so confusing to newcomers. A clearer term was needed. No political issues were raised regarding the free software term; the issue was its lack of clarity to those new to the concept.</p>
</blockquote>

<ul>
<li>Releasing Netscape</li>
</ul>

<blockquote>
<p>On February 2, 1998, Eric Raymond arrived on a visit to work with Netscape on the plan to release the browser code under a free-software-style license. We held a meeting that night at Foresight&#39;s office in Los Altos to strategize and refine our message. In addition to Eric and me, active participants included Brian Behlendorf, Michael Tiemann, Todd Anderson, Mark S. Miller, and Ka-Ping Yee. But at that meeting, the field was still described as free software or, by Brian, &quot;source code available&quot; software.</p>

<p>While in town, Eric used Foresight as a base of operations. At one point during his visit, he was called to the phone to talk with a couple of Netscape legal and/or marketing staff. When he was finished, I asked to be put on the phone with them—one man and one woman, perhaps Mitchell Baker—so I could bring up the need for a new term. They agreed in principle immediately, but no specific term was agreed upon.</p>

<p>Between meetings that week, I was still focused on the need for a better name and came up with the term &quot;open source software.&quot; While not ideal, it struck me as good enough. I ran it by at least four others: Eric Drexler, Mark Miller, and Todd Anderson liked it, while a friend in marketing and public relations felt the term &quot;open&quot; had been overused and abused and believed we could do better. He was right in theory; however, I didn&#39;t have a better idea, so I thought I would try to go ahead and introduce it. In hindsight, I should have simply proposed it to Eric Raymond, but I didn&#39;t know him well at the time, so I took an indirect strategy instead.</p>

<p>Todd had agreed strongly about the need for a new term and offered to assist in getting the term introduced. This was helpful because, as a non-programmer, my influence within the free software community was weak. My work in nanotechnology education at Foresight was a plus, but not enough for me to be taken very seriously on free software questions. As a Linux programmer, Todd would be listened to more closely.</p>
</blockquote>

<ul>
<li>The key meeting</li>
</ul>

<blockquote>
<p>Later that week, on February 5, 1998, a group was assembled at VA Research to brainstorm on strategy. Attending—in addition to Eric Raymond, Todd, and me—were Larry Augustin, Sam Ockman, and attending by phone, Jon &quot;maddog&quot; Hall.</p>

<p>The primary topic was promotion strategy, especially which companies to approach. I said little, but was looking for an opportunity to introduce the proposed term. I felt that it wouldn&#39;t work for me to just blurt out, &quot;All you technical people should start using my new term.&quot; Most of those attending didn&#39;t know me, and for all I knew, they might not even agree that a new term was greatly needed, or even somewhat desirable.</p>

<p>Fortunately, Todd was on the ball. Instead of making an assertion that the community should use this specific new term, he did something less directive—a smart thing to do with this community of strong-willed individuals. He simply used the term in a sentence on another topic—just dropped it into the conversation to see what happened. I went on alert, hoping for a response, but there was none at first. The discussion continued on the original topic. It seemed only he and I had noticed the usage.</p>

<p>Not so—memetic evolution was in action. A few minutes later, one of the others used the term, evidently without noticing, still discussing a topic other than terminology. Todd and I looked at each other out of the corners of our eyes to check: yes, we had both noticed what happened. I was excited—it might work! But I kept quiet: I still had low status in this group. Probably some were wondering why Eric had invited me at all.</p>

<p>Toward the end of the meeting, the question of terminology was brought up explicitly, probably by Todd or Eric. Maddog mentioned &quot;freely distributable&quot; as an earlier term, and &quot;cooperatively developed&quot; as a newer term. Eric listed &quot;free software,&quot; &quot;open source,&quot; and &quot;sourceware&quot; as the main options. Todd advocated the &quot;open source&quot; model, and Eric endorsed this. I didn&#39;t say much, letting Todd and Eric pull the (loose, informal) consensus together around the open source name. It was clear that to most of those at the meeting, the name change was not the most important thing discussed there; a relatively minor issue. Only about 10% of my notes from this meeting are on the terminology question.</p>

<p>But I was elated. These were some key leaders in the community, and they liked the new name, or at least didn&#39;t object. This was a very good sign. There was probably not much more I could do to help; Eric Raymond was far better positioned to spread the new meme, and he did. Bruce Perens signed on to the effort immediately, helping set up Opensource.org and playing a key role in spreading the new term.</p>

<p>For the name to succeed, it was necessary, or at least highly desirable, that Tim O&#39;Reilly agree and actively use it in his many projects on behalf of the community. Also helpful would be use of the term in the upcoming official release of the Netscape Navigator code. By late February, both O&#39;Reilly &amp; Associates and Netscape had started to use the term.</p>
</blockquote>

<ul>
<li>Getting the name out</li>
</ul>

<blockquote>
<p>After this, there was a period during which the term was promoted by Eric Raymond to the media, by Tim O&#39;Reilly to business, and by both to the programming community. It seemed to spread very quickly.</p>

<p>On April 7, 1998, Tim O&#39;Reilly held a meeting of key leaders in the field. Announced in advance as the first &quot;Freeware Summit,&quot; by April 14 it was referred to as the first &quot;Open Source Summit.&quot;</p>

<p>These months were extremely exciting for open source. Every week, it seemed, a new company announced plans to participate. Reading Slashdot became a necessity, even for those like me who were only peripherally involved. I strongly believe that the new term was helpful in enabling this rapid spread into business, which then enabled wider use by the public.</p>

<p>A quick Google search indicates that &quot;open source&quot; appears more often than &quot;free software,&quot; but there still is substantial use of the free software term, which remains useful and should be included when communicating with audiences who prefer it.</p>
</blockquote>

<ul>
<li>A happy twinge</li>
</ul>

<blockquote>
<p>When an early account of the terminology change written by Eric Raymond was posted on the Open Source Initiative website, I was listed as being at the VA brainstorming meeting, but not as the originator of the term. This was my own fault; I had neglected to tell Eric the details. My impulse was to let it pass and stay in the background, but Todd felt otherwise. He suggested to me that one day I would be glad to be known as the person who coined the name &quot;open source software.&quot; He explained the situation to Eric, who promptly updated his site.</p>

<p>Coming up with a phrase is a small contribution, but I admit to being grateful to those who remember to credit me with it. Every time I hear it, which is very often now, it gives me a little happy twinge.</p>

<p>The big credit for persuading the community goes to Eric Raymond and Tim O&#39;Reilly, who made it happen. Thanks to them for crediting me, and to Todd Anderson for his role throughout. The above is not a complete account of open source history; apologies to the many key players whose names do not appear. Those seeking a more complete account should refer to the links in this article and elsewhere on the net.</p>
</blockquote>

<hr>

<h3><a href="https://www.c0ffee.net/blog/freebsd-on-a-laptop" rel="nofollow">FreeBSD on a Laptop - A guide to a fully functional installation of FreeBSD on a ThinkPad T530</a></h3>

<blockquote>
<p>As I stated my previous post, I recently dug up my old ThinkPad T530 after the embarrassing stream of OS X security bugs this month. Although this ThinkPad ran Gentoo faithfully during my time in graduate school at Clemson, these days I&#39;d much rather spend time my wife and baby than fighting with emerge and USE flags. FreeBSD has always been my OS of choice, and laptop support seems to be much better than it was a few years ago. In this guide, I&#39;ll show you the tweaks I made to wrestle FreeBSD into a decent experience on a laptop.</p>

<p>Unlike my usual posts, this time I&#39;m going to assume you&#39;re already pretty familiar with FreeBSD. If you&#39;re a layman looking for your first BSD-based desktop, I highly recommend checking out TrueOS (previously PC-BSD): they&#39;ve basically taken FreeBSD and packaged it with all the latest drivers, along with a user-friendly installer and custom desktop environment out of the box. TrueOS is an awesome project–the only reason I don&#39;t use it is because I&#39;m old, grumpy, and persnickety about having my operating system just so.</p>

<p>Anyway, if you&#39;d still like to take the plunge, read on. Keep in mind, I&#39;m using a ThinkPad T530, but other ThinkPads of the same generation should be similarly compatible.</p>
</blockquote>

<ul>
<li><p>Here&#39;s what you&#39;ll get:</p>

<ul>
<li>Decent battery life (8-9 hours with a new 9-cell battery)</li>
<li>UEFI boot and full-disk encryption</li>
<li>WiFi (Intel Ultimate-N 6300)</li>
<li>Ethernet (Intel PRO/1000)</li>
<li>Screen brightness adjustment</li>
<li>Suspend/Resume on lid close (make sure to disable TPM in BIOS)</li>
<li>Audio (Realtek ALC269 HDA, speakers and headphone jack)</li>
<li>Keyboard multimedia buttons</li>
<li>Touchpad/Trackpoint</li>
<li>Graphics Acceleration (with integrated Intel graphics, NVIDIA card disabled in BIOS)</li>
</ul></li>
<li><p>What I haven&#39;t tested yet:</p>

<ul>
<li>Bluetooth</li>
<li>Webcam</li>
<li>Fingerprint reader</li>
<li>SD Card slot</li>
</ul></li>
<li><p>Installation</p></li>
<li><p>Power Saving</p></li>
<li><p>Tweaks for Desktop Use</p></li>
<li><p>X11</p></li>
<li><p>Fonts</p></li>
<li><p>Login Manager: SLiM</p></li>
<li><p>Desktop Environment: i3</p></li>
<li><p>Applications</p></li>
</ul>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/the_llvm_sanitizers_stage_accomplished" rel="nofollow">The LLVM Sanitizers stage accomplished</a></h3>

<blockquote>
<p>I&#39;ve managed to get the Memory Sanitizer to work for the elementary base system utilities, like ps(1), awk(1) and ksh(1). This means that the toolchain is ready for tests and improvements. I&#39;ve iterated over the basesystem utilities and I looked for bugs, both in programs and in sanitizers. The number of detected bugs in the userland programs was low, there merely was one reading of an uninitialized variable in ps(1).</p>
</blockquote>

<ul>
<li>A prebuilt LLVM toolchain</li>
</ul>

<blockquote>
<p>I&#39;ve prepared a prebuilt toolchain with Clang, LLVM, LLDB and compiler-rt for NetBSD/amd64. I prepared the toolchain on 8.99.12, however I have received reports that it works on other older releases. Link: llvm-clang-compilerrt-lldb-7.0.0beta_2018-01-24.tar.bz2</p>

<p>The archive has to be untarballed to /usr/local (however it might work to some extent in other paths).</p>

<p>This toolchain contains a prebuilt tree of the LLVM projects from a snapshot of 7.0.0(svn). It is a pristine snapshot of HEAD with patches from pkgsrc-wip for llvm, clang, compiler-rt and lldb.</p>
</blockquote>

<ul>
<li>Sanitizers

<ul>
<li>Notable changes in sanitizers, all of them are in the context of NetBSD support.</li>
</ul></li>
</ul>

<pre><code>Added fstat(2) MSan interceptor.
Support for kvm(3) interceptors in the common sanitizer code.
Added devname(3) and devname_r(3) interceptors to the common sanitizer code.
Added sysctl(3) familty of functions interceptors in the common sanitizer code.
Added strlcpy(3)/strlcat(3) interceptors in the common sanitizer code.
Added getgrouplist(3)/getgroupmembership(3) interceptors in the common sanitizer code.
Correct ctype(3) interceptors in a code using Native Language Support.
Correct tzset(3) interceptor in MSan.
Correct localtime(3) interceptor in the common sanitizer code.
Added paccept(2) interceptor to the common sanitizer code.
Added access(2) and faccessat(2) interceptors to the common sanitizer code.
Added acct(2) interceptor to the common sanitizer code.
Added accept4(2) interceptor to the common sanitizer code.
Added fgetln(3) interceptor to the common sanitizer code.
Added interceptors for the pwcache(3)-style functions in the common sanitizer code.
Added interceptors for the getprotoent(3)-style functions in the common sanitizer code.
Added interceptors for the getnetent(3)-style functions in the common sanitizer code.
Added interceptors for the fts(3)-style functions in the common sanitizer code.
Added lstat(3) interceptor in MSan.
Added strftime(3) interceptor in the common sanitizer code.
Added strmode(3) interceptor in the common sanitizer code.
Added interceptors for the regex(3)-style functions in the common sanitizer code.
Disabled unwanted interceptor __sigsetjmp in TSan.
</code></pre>

<ul>
<li>Base system changes</li>
</ul>

<blockquote>
<p>I&#39;ve tidied up inclusion of the internal namespace.h header in libc. This has hidden the usage of public global symbol names of:</p>
</blockquote>

<pre><code>strlcat -&gt; _strlcat
sysconf -&gt; __sysconf
closedir -&gt; _closedir
fparseln -&gt; _fparseln
kill -&gt; _kill
mkstemp -&gt; _mkstemp
reallocarr -&gt; _reallocarr
strcasecmp -&gt; _strcasecmp
strncasecmp -&gt; _strncasecmp
strptime -&gt; _strptime
strtok_r -&gt; _strtok_r
sysctl -&gt; _sysctl
dlopen -&gt; __dlopen
dlclose -&gt; __dlclose
dlsym -&gt; __dlsym
strlcpy -&gt; _strlcpy
fdopen -&gt; _fdopen
mmap -&gt; _mmap
strdup -&gt; _strdup
</code></pre>

<blockquote>
<p>The purpose of these changes was to stop triggering interceptors recursively. Such interceptors lead to sanitization of internals of unprepared (not recompiled with sanitizers) prebuilt code. It&#39;s not trivial to sanitize libc&#39;s internals and the sanitizers are not designed to do so. This means that they are not a full replacement of Valgrind-like software, but a a supplement in the developer toolbox. Valgrind translates native code to a bytecode virtual machine, while sanitizers are designed to work with interceptors inside the pristine elementary libraries (libc, libm, librt, libpthread) and embed functionality into the executable&#39;s code.</p>

<p>I&#39;ve also reverted the vadvise(2) syscall removal, from the previous month. This caused a regression in legacy code recompiled against still supported compat layers. Newly compiled code will use a libc&#39;s stub of vadvise(2).</p>

<p>I&#39;ve also prepared a patch installing dedicated headers for sanitizers along with the base system GCC. It&#39;s still discussed and should land the sources soon.</p>
</blockquote>

<ul>
<li>Future directions and goals

<ul>
<li>Possible paths in random order:</li>
<li>In the quartet of UBSan (Undefined Behavior Sanitizer), ASan (Address Sanitizer), TSan (Thread Sanitizer), MSan (Memory Sanitizer) we need to add the fifth basic sanitizer: LSan (Leak Sanitizer). The Leak Sanitizer (detector of memory leaks) demands a stable ptrace(2) interface for processes with multiple threads (unless we want to build a custom kernel interface).</li>
<li>Integrate the sanitizers with the userland framework in order to ship with the native toolchain to users.</li>
<li>Port sanitizers from LLVM to GCC.</li>
<li>Allow to sanitize programs linked against userland libraries other than libc, librt, libm and libpthread; by a global option (like MKSANITIZER) producing a userland that is partially prebuilt with a desired sanitizer. This is required to run e.g. MSanitized programs against editline(3). So far, there is no Operating System distribution in existence with a native integration with sanitizers. There are 3rd party scripts for certain OSes to build a stack of software dependencies in order to validate a piece of software.</li>
<li>Execute ATF tests with the userland rebuilt with supported flavors of sanitizers and catch regressions.</li>
<li>Finish porting of modern linkers designed for large C++ software, such as GNU GOLD and LLVM LLD. Today the bottleneck with building the LLVM toolchain is a suboptimal linker GNU ld(1).</li>
</ul></li>
</ul>

<blockquote>
<p>I&#39;ve decided to not open new battlefields and return now to porting LLDB and fixing ptrace(2).</p>
</blockquote>

<ul>
<li>Plan for the next milestone

<ul>
<li>Keep upstreaming a pile of local compiler-rt patches.</li>
<li>Restore the LLDB support for traced programs with a single thread.</li>
</ul></li>
</ul>

<hr>

<h2>Interview - Goran Mekic - <a href="mailto:meka@tilda.center" rel="nofollow">meka@tilda.center</a> / <a href="https://twitter.com/meka_floss" rel="nofollow">@meka_floss</a></h2>

<ul>
<li><a href="https://bsdstore.ru" rel="nofollow">CBSD website</a> Jail and VM Manager
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.manios.ca/blog/2018/01/finally-moving-away-from-windows/" rel="nofollow">Finally Moving Away From Windows</a></h3>

<ul>
<li>Broken Window</li>
</ul>

<blockquote>
<p>Thanks to a combination of some really impressive malware, bad clicking, and poor website choices, I had to blow away my Windows 10 installation. Not that it was Window’s fault, but a piece of malware had infected my computer when I tried to download a long lost driver for an even longer lost RAID card for a server. A word of advice – the download you’re looking for is never on an ad-infested forum in another language. In any case, I had been meaning to switch away from Windows soon. I didn’t have my entire plan ready, but now was as good a time as any.</p>

<p>My line of work requires me to maintain some form of Windows installation, so I decided to keep it in a VM rather than dual booting as I was developing code and not running any high-end visual stuff like games. My first thought was to install Arch or Gentoo Linux, but the last time I attempted a Gentoo installation it left me bootless. Not that there is anything wrong with Gentoo, it was probably my fault, but I like the idea of some sort of installer so I looked at rock-solid Debian. My dad had installed Debian on his sweet new cutting-edge Lenovo laptop he received recently from work. He often raves about his cool scripts and much more effective customized experience, but often complains about his hybrid GPU support as he has an Intel/Nvidia hybrid display adapter (he has finally resolved it and now boasts his 6 connected displays).</p>

<p>I didn’t want to install Windows again, but something didn’t feel right about installing some flavour of Linux. Back at home I have a small collection of FreeBSD servers running in all sorts of jails and other physical hardware, with the exception of one Debian server which I had the hardest time dealing with (it would be FreeBSD too if 802.11ac support was there as it is acting as my WiFi/gateway/IDS/IPS). I loved my FreeBSD servers, and yes I will write posts about each one soon enough. I wanted that cleanliness and familiarity on my desktop as well (I really love the ports collection!). It’s settled – I will run FreeBSD on my laptop. This also created a new rivalry with my father, which is not a bad thing either.</p>
</blockquote>

<ul>
<li>Playing Devil’s Advocate</li>
</ul>

<blockquote>
<p>The first thing I needed to do was backup my Windows data. This was easy enough, just run a Windows Image Backup and it will- wait, what? Why isn’t this working? I didn’t want to fiddle with this too long because I didn’t actually need an image just the data. I ended up just copying over the files to an external hard disk. Once that was done, I downloaded and verified the latest FreeBSD 11.1 RELEASE memstick image and flashed it to my trusty 8GB Verbatim USB stick. I’ve had this thing since 2007, it works great for being my re-writable “CD”. I booted it up and started the installation. I knew this installer pretty well as I had test-installed FreeBSD and OpenBSD in VMs when I was researching a Unix style replacement OS last year. In any case, I left most of the defaults (I didn’t want to play with custom kernels right now) and I selected all packages. This downloaded them from the FreeBSD FTP server as I only had the memstick image. The installer finished and I was off to my first boot. Great! so far so good. FreeBSD loaded up and I did a ‘pkg upgrade’ just to make sure that everything was up to date.</p>

<p>Alright, time to get down to business. I needed nano. I just can’t use vi, or just not yet. I don’t care about being a vi-wizard, that’s just too much effort for me. Anyway, just a ‘pkg install nano’ and I had my editor. Next was obvious, I needed x11. XFCE was common, and there were plenty of tutorials out there. I wont bore you with those details, but it went something like ‘pkg install xfce’ and I got all the dependencies. Don’t forget to install SLiM to make it seamless. There are some configs in the .login I think. SLiM needs to be called once the boot drops you to the login so that you get SLiM’s nice GUI login instead of the CLI login screen. Then SLiM passes you off to XFCE. I think I followed this and this. Awesome. Now that x11 is working, it’s time to get all of my apps from Windows. Obviously, I can’t get everything (ie. Visual Studio, Office). But in my Windows installation, I had chosen many open-source or cross-compiled apps as they either worked better or so that I was ready to move away from Windows at a moments notice. ‘pkg install firefox thunderbird hexchat pidgin gpa keepass owncloud-client transmission-qt5 veracrypt openvpn’ were some immediate picks. There are a lot more that I downloaded later, but these are a few I use everyday. My laptop also has the same hybrid display adapter config that my dad’s has, but I chose to only run Intel graphics, so dual screens are no problem for me. I’ll add Nvidia support later, but it’s not a priority.</p>

<p>After I had imported my private keys and loaded my firefox and thunderbird settings, I wanted to get my Windows VM running right away as I was burning productive days at work fiddling with this. I had only two virtualisation options; qemu/kvm and bhyve. qemu/kvm wasn’t available in pkg, and looked real dirty to compile, from FreeBSD’s point of view. My dad is using qemu/kvm with virt-manager to manage all of his Windows/Unix VMs alike. I wanted that experience, but I also wanted packages that could be updated and I didn’t want to mess up a compile. bhyve was a better choice. It was built-in, it was more compatible with Windows (from what I read), and this is a great step-by-step article for Windows 10 on FreeBSD 11 bhyve! I had already tried to get virt-manager to work with bhyve with no luck. I don’t think libvirt connects with bhyve completely, or maybe my config is wrong. But I didn’t have time to fiddle with it. I managed it all through command lines and that has worked perfectly so far. Well sorta, there was an issue installing SQL Server, and only SQL Server, on my Windows VM. This was due to a missing ‘sectorsize=512’ setting on the disk parameter on the bhyve command line. That was only found after A LOT of digging because the SQL Server install didn’t log the error properly. I eventually found out that SQL Server only likes one sector size of disks for the install and my virtual disk geometry was incorrect.</p>
</blockquote>

<ul>
<li>Apps Apps Apps</li>
</ul>

<blockquote>
<p>I installed Windows 10 on my bhyve VM and I got that all setup with the apps I needed for work. Mostly Office, Visual Studio, and vSphere for managing our server farm. Plus all of the annoying 3rd party VPN software (I’m looking at you Dell and Cisco). Alright, with the Windows VM done, I can now work at work and finish FreeBSD mostly during the nights. I still needed my remote files (I setup an ownCloud instance on a FreeNAS jail at home) so I setup the client. Now, normally on Windows I would come to work and connect to my home network using OpenVPN (again, I have a OpenVPN FreeNAS jail at home) and the ownCloud desktop would be able to handle changing DNS destination IPs Not on FreeBSD (and Linux too?). I ended up just configuring the ownCloud client to just connect to the home LAN IP for the ownCloud server and always connecting the OpenVPN to sync things. It kinda sucks, but at least it works. I left that running at home overnight to get a full sync (~130GB cloud sync, another reason I use it over Google or Microsoft). Once that was done I moved onto the fstab as I had another 1TB SSD in my laptop with other files. I messed around with fstab and my NFS shares to my FreeNAS at home, but took them out as they made the boot time so long when I wasn’t at home. I would only mount them when my OpenVPN connected or manually. I really wanted to install SpaceFM, but it’s only available as a package on Debian and their non-package install script doesn’t work on FreeBSD (packages are named differently). I tried doing it manually, but it was too much work. As my dad was the one who introduced me to it, he still uses it as a use-case for his Debian setup. Instead I kept to the original PCManFM and it works just fine. I also loaded up my Bitcoin and Litecoin wallets and pointed them to the blockchain that I has used on Windows after their sync, they loaded perfectly and my balances were there. I kinda wish there was the Bitcoin-ABC full node Bitcoin Cash wallet package on FreeBSD, but I’m sure it will come out later.</p>

<p>The rest is essentially just tweaks and making the environment more comfortable for me, and with most programs installed as packages I feel a lot better with upgrades and audit checking (‘pkg audit -F’ is really helpful!). I will always hate Python, actually, I will always hate any app that has it’s own package manager. I do miss the GUI GitHub tool on Windows. It was a really good-looking way to view all of my repos. The last thing (which is increasing it’s priority every time I go to a social media site or YouTube) is fonts. My god I never thought it was such a problem, and UTF support is complicated. If anyone knows how to get all UTF characters to show up, please let me know. I’d really like Wikipedia articles to load perfectly (I followed this post and there are still some missing). There are some extra tweaks I followed here and here.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>I successfully migrated from Windows 10 to FreeBSD 11.1 with minimal consequence. Shout out goes to the entire FreeBSD community. So many helpful people in there, and the forums are a great place to find tons of information. Also thanks to the ones who wrote the how-to articles I’ve referenced. I never would have gotten bhyve to work and I’d still probably be messing with my X config without them. I guess my take home from this is to not be afraid to make changes that may change how comfortable I am in an environment. I’m always open to comments and questions, please feel free to make them below. I purposefully didn’t include too many technical things or commands in this article as I wanted to focus on the larger picture of the migration as a whole not the struggles of xorg.conf, but if you would like to see some of the configs or commands I used, let me know and I’ll include some!</p>
</blockquote>

<hr>

<h3><a href="https://www.trueos.org/rulesofconduct/" rel="nofollow">TrueOS Rules of Conduct</a></h3>

<blockquote>
<p>We believe code is truly agnostic and embrace inclusiveness regardless of a person’s individual beliefs. As such we only ask the following when participating in TrueOS public events and digital forums:<br>
Treat each other with respect and professionalism.<br>
Leave personal and TrueOS unrelated conversations to other channels.<br>
In other words, it’s all about the code. Users who feel the above rules have been violated in some way can register a complaint with <a href="mailto:abuse@trueos.org" rel="nofollow">abuse@trueos.org</a></p>

<ul>
<li><a href="https://twitter.com/trueos/status/965994363070353413" rel="nofollow">Shorter than the BSD License</a></li>
<li><a href="https://twitter.com/freebsdbytes/status/966567686015782912" rel="nofollow">Positive response from the community</a>
I really like the @TrueOS Code of Conduct, unlike some other CoCs. It&#39;s short, clear and covers everything.
Most #OpenSource projects are labour of love. Why do you need a something that reads like a legal contract?
***</li>
</ul>
</blockquote>

<h3><a href="https://neomoevius.tumblr.com/post/171108458234/freebsd-the-unknown-giant" rel="nofollow">FreeBSD: The Unknown Giant</a></h3>

<blockquote>
<p>I decided to write this article as a gratitude for the recent fast answer of the FreeBSD/TrueOS community with my questions and doubts. I am impressed how fast and how they tried to help me about this operating system which I used in the past(2000-2007) but recently in 2017 I began to use it again.</p>

<ul>
<li>A lot has changed in 10 years
I was looking around the internet, trying to do some research about recent information about FreeBSD and other versions or an easy to use spins like PCBSD (now TrueOS)
I used to be Windows/Mac user for so many years until 2014 when I decided to use Linux as my desktop OS just because I wanted to use something different. I always wanted to use unix or a unix-like operating system, nowadays my main objective is to learn more about  these operating systems (Debian Linux, TrueOS or FreeBSD).
FreeBSD has similarities with Linux, with two major differences in scope and licensing: FreeBSD maintains a complete operating system, i.e. the project delivers kernel, device drivers, userland utilities and documentation, as opposed to Linux delivering a kernel and drivers only and relying on third-parties for system software; and FreeBSD source code is generally released under a permissive BSD license as opposed to the copyleft GPL used by Linux.“
But why do I call FreeBSD “The Unknown Giant”?, because the code base of this operating system has been used by other companies to develop their own operating system for products like computers or also game consoles.</li>
<li>FreeBSD is used for storage appliances, firewalls, email scanners, network scanners, network security appliances, load balancers, video servers, and more
So many people now will learn that not only “linux is everywhere” but also that “FreeBSD is everywhere too”
By the way speaking about movies, Do you remember the movie “The Matrix”? FreeBSD was used to make the movie: “The photo-realistic surroundings generated by this method were incorporated into the bullet time scene, and linear interpolation filled in any gaps of the still images to produce a fluent dynamic motion; the computer-generated “lead in” and “lead out” slides were filled in between frames in sequence to get an illusion of orbiting the scene. Manex Visual Effects used a cluster farm running the Unix-like operating system FreeBSD to render many of the film’s visual effects”</li>
<li><a href="https://www.freebsd.org/news/press-rel-1.html" rel="nofollow">FreeBSD Press Release re: The Matrix </a>
I hope that I gave a good reference, information and now so many people can understand why I am going to use just Debian Linux and FreeBSD(TrueOS) to do so many different stuff (music, 3d animation, video editing and text editing) instead use a Mac or Windows.</li>
<li>FreeBSD really is the unknown giant.
***</li>
</ul>
</blockquote>

<h3><a href="https://steemit.com/openbsd/@npna/openbsd-and-freedos-vs-the-hell-in-earth" rel="nofollow">OpenBSD and FreeDOS vs the hell in earth</a></h3>

<blockquote>
<p>Yes sir, yes. Our family, composed until now by OpenBSD, Alpine Linux and Docker is rapidly growing. And yes, sir. Yes. All together we&#39;re fighting against your best friends, the infamous, the ugliest, the worst...the dudes called the privacy cannibals. Do you know what i mean, sure?<br>
We&#39;re working hard, no matter what time is it, no matter in what part in the world we are, no matter if we&#39;ve no money. We perfectly know that you cannot do nothing against the true. And we&#39;re doing our best to expand our true, our doors are opened to all the good guys, there&#39;s a lot here but their brain was fucked by your shit tv, your fake news, your laws, etc etc etc. We&#39;re alive, we&#39;re here to fight against you.<br>
Tonight, yes it&#39;s a Friday night and we&#39;re working, we&#39;re ready to welcome with open arms an old guy, his experience will give us more power. Welcome to: FreeDOS</p>

<p>But why we want to build a bootable usb stick with FreeDOS under our strong OpenBSD? The answer is as usual to fight against the privacy cannibals!<br>
More than one decade ago the old BIOS was silently replaced by the more capable and advanced UEFI, this is absolutely normal because of the pass of the years and exponencial grow of the power of our personal computers. UEFI is a complex system, it&#39;s like a standalone system operative with direct access to every component of our (yes, it&#39;s our not your!) machine. But...wait a moment...do you know how to use it? Do you ever know that it exist? And one more thing, it&#39;s secure? The answer to this question is totally insane, no, it&#39;s not secure. The idea is good, the company that started in theory is one of the most important in IT, it&#39;s Intel.<br>
The history is very large and obviously we&#39;re going to go very deep in it, but trust me UEFI and the various friend of him, like ME, TPM are insecure and closed source! Like the hell in earth.</p>
</blockquote>

<ul>
<li>A FreeDOS bootable usb image under OpenBSD</li>
</ul>

<blockquote>
<p>But let&#39;s start preparing our OpenBSD to put order in this chaos:</p>
</blockquote>

<p>$ mkdir -p freedos/stuff<br>
$ cd freedos/stuff<br>
$ wget <a href="https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.0/fdboot.img" rel="nofollow">https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.0/fdboot.img</a><br>
$ wget <a href="https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/sys/sys-freedos-linux/sys-freedos-linux.zip" rel="nofollow">https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/sys/sys-freedos-linux/sys-freedos-linux.zip</a><br>
$ wget <a href="https://download.lenovo.com/consumer/desktop/o35jy19usa_y900.exe" rel="nofollow">https://download.lenovo.com/consumer/desktop/o35jy19usa_y900.exe</a><br>
$ wget <a href="http://145.130.102.57/domoticx/software/amiflasher/AFUDOS%20Flasher%205.05.04.7z" rel="nofollow">http://145.130.102.57/domoticx/software/amiflasher/AFUDOS%20Flasher%205.05.04.7z</a><br>
Explanation in clear language as usual: create two directory, download the minimal boot disc image of FreeDOS, download Syslinux assembler MBR bootloaders, download the last Windows only UEFI update from Lenovo and download the relative unknown utility from AMI to flash our motherboard UEFI chipset. Go ahead:</p>

<p><code>$ doas pkg_add -U nasm unzip dosfstools cabextract p7zip</code></p>

<ul>
<li>nasm the Netwide Assembler, a portable 80x86 assembler. </li>
<li>unzip list, test and extract compressed files in a ZIP archive. </li>
<li>dosfstoolsa collections of utilities to manipulate MS-DOSfs. </li>
<li>cabextract program to extract files from cabinet. </li>
<li>p7zipcollection of utilities to manipulate 7zip archives.</li>
</ul>

<pre><code>$ mkdir sys-freedos-linux &amp;&amp; cd sys-freedos-linux
$ unzip ../sys-freedos-linux.zip
$ cd ~/freedos &amp;&amp; mkdir old new
$ dd if=/dev/null of=freedos.img bs=1024 seek=20480
$ mkfs.fat freedos.img
</code></pre>

<blockquote>
<p>Create another working directory, cd into it, unzip the archive that we&#39;ve downloaded, return to the working root and create another twos directories. dd is one of the most important utilities in the unix world to manipulate at byte level input and output:</p>

<p>The dd utility copies the standard input to the standard output, applying any specified conversions. Input data is read and written in 512-byte blocks. If input reads are short, input from multiple reads are aggregated to form the output block. When finished, dd displays the number of complete and partial input and output blocks and truncated input records to the standard error output.</p>

<p>We&#39;re creating here a virtual disk with bs=1024 we&#39;re setting both input and output block to 1024bytes; with seek=20480 we require 20480bytes. This is the result:</p>
</blockquote>

<p><code>-rw-r--r-- 1 taglio taglio 20971520 Feb 3 00:11 freedos.img.</code></p>

<blockquote>
<p>Next we format the virtual disk using the MS-DOS filesystem. Go ahead:</p>
</blockquote>

<pre><code>$ doas su
$ perl stuff/sys-freedos-linux/sys-freedos.pl --disk=freedos.img
$ vnconfig vnd0 stuff/fdboot.img
$ vnconfig vnd1 freedos.img
$ mount -t msdos /dev/vnd0c old/
$ mount -t msdos /dev/vnd1c new/
</code></pre>

<blockquote>
<p>We use the perl utility from syslinux to write the MBR of our virtual disk freedos.img. Next we create to loop virtual node using the OpenBSD utility vnconfig. Take care here because it is quite different from Linux, but as usual is clear and simple. The virtual nodes are associated to the downloaded fdboot.img and the newly created freedos.img. Next we mount the two virtual nodes cpartitions; in OpenBSD cpartition describes the entire physical disk. Quite different from Linux, take care.</p>
</blockquote>

<pre><code>$ cp -R old/* new/
$ cd stuff
$ mkdir o35jy19usa
$ cabextract -d o35jy19usa o35jy19usa_y900.exe
$ doas su
$ cp o35jy19usa/ ../new/
$ mkdir afudos &amp;&amp; cd afudos
$ 7z e ../AFUDOS*
$ doas su
$ cp AFUDOS.exe ../../new/
$ umount ~/freedos/old/ &amp;&amp; umount ~/freedos/new/
$ vnconfig -u vnd1 &amp;&amp; vnconfig -u vnd0
</code></pre>

<blockquote>
<p>Copy all files and directories in the new virtual node partition, extract the Lenovo cabinet in a new directory, copy the result in our new image, extract the afudos utility and like the others copy it. Umount the partitions and destroy the loop vnode.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.geeklan.co.uk/files/fosdem2018-retro" rel="nofollow">NetBSD - A modern operating system for your retro battlestation</a></li>
<li><a href="https://twitter.com/pvaneynd/status/960181163578019840/photo/1" rel="nofollow">FOSDEM OS distribution</a></li>
<li><a href="https://marc.info/?l=openbsd-tech&m=151268831628549" rel="nofollow">Update on two pledge-related changes</a></li>
<li><a href="https://marc.info/?l=openbsd-cvs&m=151304116010721&w=2" rel="nofollow">*execpromises</a></li>
<li><a href="https://www.geeklan.co.uk/files/fosdem2018-bsd/" rel="nofollow">Slides for (BSD from scratch - from source to OS with ease on NetBSD)</a></li>
<li><a href="https://blog.crashed.org/goodbye-lastpass/" rel="nofollow">Goobyte LastPass: You&#39;re fired! </a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Scott - <a href="http://dpaste.com/22Z8C6Z#wrap" rel="nofollow">ZFS Mirror with SLOG</a></li>
<li>Troels - <a href="http://dpaste.com/3X2R1BV#wrap" rel="nofollow">Question about compressed ARC</a></li>
<li>Jeff - <a href="http://dpaste.com/2BQ9HFB#wrap" rel="nofollow">FreeBSD Desktop DNS</a></li>
<li>Jonathon - <a href="http://dpaste.com/0TTT0DB#wrap" rel="nofollow">Bhyve and gpu passthrough</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>234: Code and Community</title>
  <link>https://www.bsdnow.tv/234</link>
  <guid isPermaLink="false">f6baf9a1-e78a-4997-9a29-0ca6f7453383</guid>
  <pubDate>Wed, 21 Feb 2018 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f6baf9a1-e78a-4997-9a29-0ca6f7453383.mp3" length="74658100" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>GSoC 2018 Projects announced, tutorial FreeBSD jails with iocage, new Code of Conduct for FreeBSD, libhijack, and fancy monitoring for OpenSMTPD</itunes:subtitle>
  <itunes:duration>1:43:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>GSoC 2018 Projects announced, tutorial FreeBSD jails with iocage, new Code of Conduct for FreeBSD, libhijack, and fancy monitoring for OpenSMTPD
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Google Summer of Code 2018 (https://summerofcode.withgoogle.com/organizations/?sp-page=5)
FreeBSD (https://www.freebsd.org/projects/summerofcode.html)
FreeBSD Google Summer oF Code Ideas (https://wiki.freebsd.org/SummerOfCodeIdeas)
You can join #freebsd-soc on the efnet IRC network to chat with FreeBSD developers interested in mentoring student proposals and projects, past FreeBSD/GSoC students, and other students applying to FreeBSD/GSoC this year.
NetBSD (https://mail-index.netbsd.org/netbsd-advocacy/2018/02/12/msg000765.html)
You can get a stipend (paid for by Google) and spend a few months getting to know and improving the insides of NetBSD or pkgsrc.
```
The schedule is:
12-27 March             Applying
23 April                Find out if you were accepted
14 May - 22 August      Do the project!
We have some suggestions for suitable projects:
- ARM EFI bootloader
- Using libFuzzer on base tools
- Refactoring ALTQ (QoS implementation) and integrating with NPF
- Testsuite for libcurses
- Improve pkgin
Other suggestions and details are at:
https://wiki.netbsd.org/projects/gsoc/
```
These projects are suggestions; you can come up with your own. Suggestions for other suitable projects are welcome.
Feel free to contact, or chat around on IRC: irc.freenode.org #netbsd #netbsd-code #pkgsrc
Haiku (https://summerofcode.withgoogle.com/organizations/4821756754264064/)
Students: How to Apply for a Haiku Idea (https://www.haiku-os.org/community/gsoc/2018/students)
Project Ideas (https://www.haiku-os.org/community/gsoc/2018/ideas)
&amp;gt; If you have questions you can contact the devs on IRC: irc.freenode.org #haiku
FreeBSD Jails with iocage (http://norrist.devio.us/iocage_freebsd.html)
Introduction
FreeBSD jails allow users to run multiple, isolated instances of FreeBSD on a single server. Iocage simplifies the management of FreeBSD Jails. Following this tutorial, the jails will be configured to bind to an IP address on the jail host's internal network, and the host OS will pass traffic from the external network to the jail.
The jails will be managed with Iocage. Iocage uses ZFS properties to store configuration data for each jail, so a ZFS file system is required.
Network setup These steps will:
Set up the internal network.
Enable the pf packet filter
Configure pf pass internet traffic to and from the jail.
PF is full featured firewall, and can do more than just pass traffic to an internal network. Refer to the PF documentation for additional configuration options.
Run the following to configure the internal network and enable pf.

sysrc cloned_interfaces+="lo1"
sysrc ifconfig_lo1="inet 192.0.2.1/24"
sysrc pf_enable="YES"

Put the following in /etc/pf.conf
```
Variables
ext_if should be set to the hosts external NIC
extif = "vtnet0"
jailif = "lo1"
jailnet = $jailif:network
NAT allows the jails to access the external network
nat on $extif from $jailnet to any -&amp;gt; ($ext_if)
Redirect traffic on port 80 to the web server jail
Add similar rules for additional jails
rdr pass on $ext_if inet proto tcp to port 80 -&amp;gt; 192.0.2.10
```
Reboot to activate the network changes
ZFS
The best way to use ZFS on a VPS is to attach block storage as a new disk.
If block storage is not available, you can optionally use a file as the ZFS device.
Enable and start ZFS.

sysrc zfs_enable="YES"
service zfs start

ZFS using Block storage
List the available disks. 
If you are using a VPS, the block store will probably be the second disk.
geom disk list
Create a ZFS pool named jailstore.
zpool create jailstore  /dev/vtbd1
ZFS using a file
Create the ZFS file.
dd if=/dev/zero of=/zfsfile bs=1M count=4096
Create a ZFS pool named jailstore.
zpool create jailstore /zfsfile
Install iocage the easy way
pkg install py36-iocage
Skip to "Using iocage"
Install iocage the hard way
Swap file
Smaller servers may not have enough RAM to build iocage. If needed, create a swap file and reboot.

dd if=/dev/zero of=/swapfile bs=1M count=1024
echo 'swapfile="/swapfile"' &amp;gt;&amp;gt; /etc/rc.conf
reboot

Install some build dependencies
pkg install subversion python36 git-lite libgit2  py36-pip
Building iocage requires the FreeBSD source.
svn checkout https://svn.freebsd.org/base/releng/11.1 /usr/src
Get the latest FreeBSD ports tree.
```
portsnap fetch
portsnap extract
```
+ build iocage.

cd /usr/ports/sysutils/iocage/
make install

Using iocage
```
iocage activate jailstore
iocage fetch
iocage create -n www ip4_addr="lo1|192.0.2.10/24" -r 11.1-RELEASE
iocage start www
iocage console www
```
Once you have a shell inside the jail, install and start Apache.

pkg install apache24
sysrc apache24_enable="yes"
service apache24 start

Port 80 on the jail will now be accessible on the hosts IP address.
Multiple jails.
Additional jails can be installed using the example above.
Install the new jail with the iocage create command , but use a different IP address
Expose the new jail to the network by adding additional rules to pf.conf.
iXsystems
SNIA Persistent Memory Summit 2018 Report (https://www.ixsystems.com/blog/snia-report-2018/)
New FreeBSD Code of Conduct (https://www.freebsd.org/internal/code-of-conduct.html)
The FreeBSD Project is inclusive. We want the FreeBSD Project to be a venue where people of all backgrounds can work together to make the best operating system, built by a strong community. These values extend beyond just development to all aspects of the Project. All those given recognition as members of the Project in whatever form are seen as ambassadors of the Project.
Diversity is a huge strength and is critical to the long term success of the Project. To that end we have a few ground rules that we ask people to adhere to. This code applies equally to everyone representing the FreeBSD Project in any way, from new members, to committers, to the core team itself. These rules are intended to ensure a safe, harassment-free environment for all and to ensure that everyone feels welcome both working within, and interacting with, the Project.
This document is not an exhaustive list of things that you should not do. Rather, consider it a guide to make it easier to enrich all of us and the technical communities in which we participate.
This code of conduct applies to all spaces used by the FreeBSD Project, including our mailing lists, IRC channels, and social media, both online and off. Anyone who is found to violate this code of conduct may be sanctioned or expelled from FreeBSD Project controlled spaces at the discretion of the FreeBSD Code of Conduct Committee.
Some FreeBSD Project spaces may have additional rules in place, which will be made clearly available to participants. Participants are responsible for knowing and abiding by these rules. 
Harassment includes but is not limited to:
+ Comments that reinforce systemic oppression related to gender, gender identity and expression, sexual orientation, disability, mental illness, neurodiversity, physical appearance, body size, age, race, or religion.
+ Unwelcome comments regarding a person's lifestyle choices and practices, including those related to food, health, parenting, drugs, and employment.
+ Deliberate misgendering.
+ Deliberate use of "dead" or rejected names.
+ Gratuitous or off-topic sexual images or behaviour in spaces where they're not appropriate.
+ Physical contact and simulated physical contact (e.g., textual descriptions like "hug" or "backrub") without consent or after a request to stop.
+ Threats of violence.
+ Incitement of violence towards any individual, including encouraging a person to commit suicide or to engage in self-harm.
+ Deliberate intimidation.
+ Stalking or following.
+ Harassing photography or recording, including logging online activity for harassment purposes.
+ Sustained disruption of discussion.
+ Unwelcome sexual attention.
+ Pattern of inappropriate social contact, such as requesting/assuming inappropriate levels of intimacy with others.
+ Continued one-on-one communication after requests to cease.
+ Deliberate "outing" of any private aspect of a person's identity without their consent except as necessary to protect vulnerable people from intentional abuse.
+ Publication of non-harassing private communication without consent.
+ Publication of non-harassing private communication with consent but in a way that intentionally misrepresents the communication (e.g., removes context that changes the meaning).
+ Knowingly making harmful false claims about a person.
Interview - Benno Rice - benno@freebsd.org (mailto:benno@freebsd.org) / @jeamland (https://twitter.com/jeamland)
News Roundup
libhijack in PoC||GTFO 0x17! (https://www.soldierx.com/news/libhijack-PoCGTFO-0x17)
Hijacking Your Free Beasties
In the land of red devils known as Beasties exists a system devoid of meaningful exploit mitigations. As we explore this vast land of opportunity, we will meet our ELFish friends, [p]tracing their very moves in order to hijack them. Since unprivileged process debugging is
enabled by default on FreeBSD, we can abuse PTrace to create anonymous memory mappings, inject code into them, and overwrite PLT/GOT entries. We will revive a tool called libhijack to make our nefarious activities of hijacking ELFs via PTrace relatively easy.
Nothing presented here is technically new. However, this type of work has not been documented in this much detail, tying it all into one cohesive work. In Phrack 56, Silvio Cesare taught us ELF research enthusiasts how to hook the PLT/GOT. The Phrack 59 article on Runtime Process Infection briefly introduces the concept of injecting shared objects by injecting shellcode via PTrace that calls dlopen(). No other piece of research, however, has discovered the joys of forcing the application to create anonymous memory mappings in which to inject
Code.
This is only part one of a series of planned articles that will follow libhijack's development. The end goal is to be able to anonymously inject shared objects. The libhijack project is maintained by the SoldierX community.
Previous Research
All prior work injects code into the stack, the heap, or existing executable code. All three methods create issues on today's systems. On amd64 and arm64, the two architectures libhijack cares about, the stack is non-executable by default. jemalloc, the heap implementation
on FreeBSD, creates non-executable mappings. Obviously overwriting existing executable code destroys a part of the executable image.
The Role of ELF
&amp;gt; FreeBSD provides a nifty API for inspecting the entire virtual memory space of an application. The results returned from the API tells us the protection flags (readable, writable, executable) of each mapping. If FreeBSD provides such a rich API, why would we need to parse the
ELF headers?
PLT/GOT hijacking requires parsing ELF headers. One would not be able to find the PLT/GOT without iterating through the Process Headers to find the Dynamic Headers, eventually ending up with the DT_PLTGOT entry.
With FreeBSD's libprocstat API, we don't have a need for parsing ELF headers until we get to the PLT/GOT stage, but doing so early makes it easier for the attacker using libhijack
The Future of libhijack
Writing devious code in assembly is cumbersome. Assembly doesn't scale well to multiple architectures. Instead, we would like to write our devious code in C, compiling to a shared object that gets injected anonymously. This requires writing a remote RTLD within libhijack and
is in progress. Writing a remote RTLD will take a while as doing so is not an easy task.
Additionally, creation of a general-purpose helper library that gets injected would be helpful. It could aid in PLT/GOT redirection attacks, possibly storing the addresses of functions we've previously hijacked. This work is dependent on the remote RTLD.
libhijack currently lacks documentation. Once the ABI and API stabilize, formal documentation will be written.
Conclusion
Using libhijack, we can easily create anonymous memory mappings, inject into them arbitrary code, and hijack the PLT/GOT on FreeBSD. On HardenedBSD, a hardened derivative of FreeBSD, libhijack is fully mitigated through PaX NOEXEC.
We've demonstrated that wrapper-style Capsicum is ineffective on FreeBSD. Through the use of libhijack, we emulate a control flow hijack in which the application is forced to call sandbox_open and fdlopen on the resulting file descriptor.
Further work to support anonymous injection of full shared objects, along with their dependencies, will be supported in the future. Imagine injecting libpcap into Apache to sniff traffic whenever "GET /pcap" is sent.
In order to prevent abuse of PTrace, FreeBSD should set the security.bsd.unprivilegedprocdebug to 0 by default. In order to prevent process manipulation, FreeBSD should implement PaX NOEXEC.
libhijack can be found at https://github.com/SoldierX/libhijack
Introduction to POSIX shell (https://sircmpwn.github.io/2018/02/05/Introduction-to-POSIX-shell.html)
What the heck is the POSIX shell anyway? Well, the POSIX (the Portable Operating System Interface) shell is the standard Unix shell - standard meaning it was formally defined and shipped in a published standard. This makes shell scripts written for it portable, something no other shell can lay claim to. The POSIX shell is basically a formalized version of the venerable Bourne shell, and on your system it lives at /bin/sh, unless you’re one of the unlucky masses for whom this is a symlink to bash.
Why use POSIX shell?
The “Bourne Again shell”, aka bash, is not standardized. Its grammar, features, and behavior aren’t formally written up anywhere, and only one implementation of bash exists. Without a standard, bash is defined by its implementation. POSIX shell, on the other hand, has many competing implementations on many different operating systems - all of which are compatible with each other because they conform to the standard.
Any shell that utilizes features specific to Bash are not portable, which means you cannot take them with you to any other system. Many Linux-based systems do not use Bash or GNU coreutils. Outside of Linux, pretty much everyone but Hurd does not ship GNU tools, including bash1. On any of these systems, scripts using “bashisms” will not work.
This is bad if your users wish to utilize your software anywhere other than GNU/Linux. If your build tooling utilizes bashisms, your software will not build on anything but GNU/Linux. If you ship runtime scripts that use bashisms, your software will not run on anything but GNU/Linux. The case for sticking to POSIX shell in shipping software is compelling, but I argue that you should stick to POSIX shell for your personal scripts, too. You might not care now, but when you feel like flirting with other Unicies you’ll thank me when all of your scripts work.
One place where POSIX shell does not shine is for interactive use - a place where I think bash sucks, too. Any shell you want to use for your day-to-day command line work is okay in my book. I use fish. Use whatever you like interactively, but stick to POSIX sh for your scripts.
How do I use POSIX shell?
At the top of your scripts, put #!/bin/sh. You don’t have to worry about using env here like you might have been trained to do with bash: /bin/sh is the standardized location for the POSIX shell, and any standards-conforming system will either put it there or make your script work anyway.
The next step is to avoid bashisms. There are many, but here are a few that might trip you up:
[[ condition ]] does not work; use [ condition ]
Arrays do not work; use IFS
Local variables do not work; use a subshell
The easiest way to learn about POSIX shell is to read the standard - it’s not too dry and shorter than you think.
Using standard coreutils
The last step to writing portable scripts is to use portable tools. Your system may have GNU coreutils installed, which provides tools like grep and cut. Unfortunately, GNU has extended these tools with its own non-portable flags and tools. It’s important that you avoid these.
One dead giveaway of a non-portable flag is long flags, e.g. grep --file=FILE as opposed to grep -f. The POSIX standard only defines the getopt function - not the proprietary GNU getopt_long function that’s used to interpret long options. As a result, no long flags are standardized. You might worry that this will make your scripts difficult to understand, but I think that on the whole it will not. Shell scripts are already pretty alien and require some knowledge to understand. Is knowledge of what the magic word grep means much different from knowledge of what grep -E means?
I also like that short flags allow you to make more concise command lines. Which is better: ps --all --format=user --without-tty, or ps -aux? If you are inclined to think the former, do you also prefer function(a, b, c) { return a + b + c; } over (a, b, c) =&amp;gt; a + b + c? Conciseness matters, and POSIX shell supports comments if necessary!
Some tips for using short flags:
They can be collapsed: cmd -a -b -c is equivalent to cmd -abc
If they take additional arguments, either a space or no separation is acceptable: cmd -f"hello world" or cmd -f "hello world"
A good reference for learning about standardized commands is, once again, the standard. From this page, search for the command you want, or navigate through “Shell &amp;amp; Utilities” -&amp;gt; “Utilities” for a list. If you have man-pages installed, you will also find POSIX man pages installed on your system with the p postfix, such as man 1p grep. Note: at the time of writing, the POSIX man pages do not use dashes if your locale is UTF-8, which makes searching for flags with / difficult. Use env LC_ALL=POSIX man 1p grep if you need to search for flags, and I’ll speak to the maintainer of man-pages about this.
FreeBSD Broadcom Wi-Fi Improvements (http://landonf.org/code/freebsd/Broadcom_WiFi_Improvements.20180122.html)
Introduction
Since 2015, I've been working on improving FreeBSD support for Broadcom Wi-Fi devices and SoCs, including authoring the bhnd(4) driver family, which provides a unified bus and driver programming interface for these devices.
First committed in early 2016, bhnd(4) allowed us to quickly bring up FreeBSD/MIPS on Broadcom SoCs, but it has taken much longer to implement the full set of features required to support modern Broadcom SoftMAC Wi-Fi hardware.
Thanks to the generosity of the FreeBSD Foundation, I've recently finished implementing the necessary improvements to the bhnd(4) driver family. With these changes in place, I was finally able to port the existing bwn(4) Broadcom SoftMAC Wi-Fi driver to the bhnd(4) bus, and implement initial support for the BCM43224 and BCM43225 chipsets, with additional hardware support to be forthcoming.
Now that my efforts on FreeBSD/Broadcom Wi-Fi support have progressed far enough to be generally useful, I wanted to take some time to provide a brief overview of Broadcom's Wi-Fi hardware, and explain how my work provides a foundation for further FreeBSD Broadcom Wi-Fi/SoC improvements.
A Brief Background on Broadcom Wi-Fi Hardware
Broadcom's Wi-Fi devices are members of the Broadcom Home Networking Division (BHND) device family; other BHND devices include MIPS/ARM SoCs (including Wi-Fi SoCs commonly found in consumer access points), as well as a large variety of related networking hardware.
BHND devices utilize a common set of Broadcom IP cores (or "functional blocks") connected via one of two on-chip bus architectures:
Hardware designed prior to 2009 used Broadcom’s “SSB” backplane architecture, based on Sonics Silicon’s interconnect IP.
Subsequent hardware adopted Broadcom’s “BCMA” backplane, based on ARM’s AMBA IP. The IP cores used in earlier SSB-based devices were adapted for compatibility with the new backplane.
 When BHND hardware is used in a PCI Wi-Fi card, or a SDIO Wi-Fi module, the device's dual-mode peripheral controller is configured to operate as an endpoint device on the host's peripheral bus, bridging access to the SoC hardware:
Host access to SoC address space is provided via a set of register windows (e.g., a set of configurable windows into SoC address space mapped via PCI BARs)
DMA is supported by the bridge core’s sparse mapping of host address space into the backplane address space. These address regions may be used as a target for the on-chip DMA engines.
Any backplane interrupt vectors routed to the bridge core may be mapped by the bridge to host interrupts (e.g., PCI INTx/MSI/MSI-X).
The host is generally expected to provide drivers for the IP cores found on the SoC backplane; since these cores are found in both BHND SoCs and BHND Wi-Fi devices, it is advantageous to share driver and platform code between the two targets.
Modernizing FreeBSD's Broadcom SoftMAC Wi-Fi Support
FreeBSD support for Broadcom SoftMAC Wi-Fi adapters is provided by two partially overlapping PCI/CardBus drivers:
Legacy Wi-Fi adapters are supported by bwi(4). This driver remains in-tree to support devices incompatible with v4 or later firmware (e.g. BCM4301, BCM4302, BCM4306 rev 1-2), all of which were released prior to December 2002.
Modern Wi-Fi adapters are supported by bwn(4), with access to on-chip cores mediated by bhnd(4).
Prior to my work porting bwn(4) to bhnd(4), access to on-chip cores was mediated by sibabwn, a PCI/WiFi-specific derivative of the legacy siba(4) SSB bus driver. There were two major limitations to sibabwn that have long blocked adding support for newer SoftMAC Wi-Fi chipsets: the newer BCMA interconnect found in post-2009 hardware was not supported by siba(4), and siba_bwn assumed a PCI/PCIe bridge, preventing its use on FreeBSD/MIPS Broadcom SoCs with interconnect-attached D11 cores.
The new bhnd(4) driver family, written as a replacement for siba(4) and siba_bwn, provides:
A unified bus driver interface for both SSB and BCMA on-chip interconnects
A generic BHND bridge driver framework for host-connected BHND devices (e.g. Wi-Fi adapters, etc)
A PCI/PCIe bridge core driver, for PCI-attached BHND devices.
An abstract BHND NVRAM API, with support for the varied NVRAM formats found in BHND Wi-Fi adapters and SoCs.
Drivers for common BHND platform peripherals (UARTs, SPROM/flash, PMUs, etc)
By porting bwn(4) to bhnd(4), we are now able to support existing BCMA devices with MAC/PHY/Radio combinations readily supported by bwn(4), as was the case with the BCM43224 and BCM43225 chipsets. This also opens the door to porting additional PHY support from Broadcom’s ISC-licensed Linux drivers, and will allow us to bring up bwn(4) on Broadcom WiSoCs supported by FreeBSD/MIPS.
Monitor OpenSMTPD using Logstash and Grafana (https://www.tumfatig.net/20180129/monitor-opensmtpd-using-logstash-grafana/)
Logs are usefull. Graphs are sexy. Here’s a way to get a view on what happens to your OpenSMTPD traffic, using Web v2.0 tools ; namely Logstash &amp;amp; Grafana.
For those who would not be aware of those tools, logstash is some kind of log-parser that can eat syslog formatted logs and write them into elasticsearch ; in “document” format. Grafana is a Web frontend that can dig into various databases and render graphics from requests.
I won’t go into the whole “how to install” process here. Installation is quite straight forward and online documentation is quite clear.
What you need
OpenSMTPD deals with emails and logs its activity via Syslog.
Syslog is configured to send the logs to Logstash.
Logstash has a set of rules configured to transform the text-oriented information into searchable document-oriented data. The transformed data is stored into Elasticsearch.
Elasticsearch provides Web API to search and find stuff.
Grafana connects to ELS to get data and draw the graphs.
Beastie Bits
CharmBUG Presentation - Writing FreeBSD Malware (https://www.meetup.com/CharmBUG/events/247995596/)
March London *BSD meeting 13/03/18 (http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-February/014180.html)
FreBSD Ports Workshop (https://wiki.freebsd.org/MateuszPiotrowski/Ports/Workshop)
The history of NetBSD/atari and support for ATARI compatible Milan / OSC2018Osaka (https://speakerdeck.com/tsutsui/osc2018osaka)
SSH Mastery, 2nd Edition (https://www.tiltedwindmillpress.com/?product=ssh-mastery-2nd-edition)
***
Feedback/Questions
Stephen - Viewer Interview Question (http://dpaste.com/06WTRB9#wrap)
pb - trust expanding your 280TB pool (http://dpaste.com/0TZV6CM#wrap)
Tim - ZFS questions for the ZFS Man (http://dpaste.com/0759X1E#wrap)
Daniel - ZFS full backup question (http://dpaste.com/1SJXSBQ#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>GSoC 2018 Projects announced, tutorial FreeBSD jails with iocage, new Code of Conduct for FreeBSD, libhijack, and fancy monitoring for OpenSMTPD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://summerofcode.withgoogle.com/organizations/?sp-page=5" rel="nofollow">Google Summer of Code 2018</a></h3>

<ul>
<li><a href="https://www.freebsd.org/projects/summerofcode.html" rel="nofollow">FreeBSD</a></li>
<li><a href="https://wiki.freebsd.org/SummerOfCodeIdeas" rel="nofollow">FreeBSD Google Summer oF Code Ideas</a></li>
</ul>

<blockquote>
<p>You can join #freebsd-soc on the efnet IRC network to chat with FreeBSD developers interested in mentoring student proposals and projects, past FreeBSD/GSoC students, and other students applying to FreeBSD/GSoC this year.</p>
</blockquote>

<ul>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2018/02/12/msg000765.html" rel="nofollow">NetBSD</a></li>
</ul>

<blockquote>
<p>You can get a stipend (paid for by Google) and spend a few months getting to know and improving the insides of NetBSD or pkgsrc.</p>
</blockquote>

<pre><code>The schedule is:
12-27 March             Applying
23 April                Find out if you were accepted
14 May - 22 August      Do the project!

We have some suggestions for suitable projects:
- ARM EFI bootloader
- Using libFuzzer on base tools
- Refactoring ALTQ (QoS implementation) and integrating with NPF
- Testsuite for libcurses
- Improve pkgin

Other suggestions and details are at:
https://wiki.netbsd.org/projects/gsoc/
</code></pre>

<blockquote>
<p>These projects are suggestions; you can come up with your own. Suggestions for other suitable projects are welcome.</p>

<p>Feel free to contact, or chat around on IRC: irc.freenode.org #netbsd #netbsd-code #pkgsrc</p>
</blockquote>

<ul>
<li><a href="https://summerofcode.withgoogle.com/organizations/4821756754264064/" rel="nofollow">Haiku</a>

<ul>
<li><a href="https://www.haiku-os.org/community/gsoc/2018/students" rel="nofollow">Students: How to Apply for a Haiku Idea</a></li>
<li><a href="https://www.haiku-os.org/community/gsoc/2018/ideas" rel="nofollow">Project Ideas</a>
&gt; If you have questions you can contact the devs on IRC: irc.freenode.org #haiku</li>
</ul></li>
</ul>

<hr>

<h3><a href="http://norrist.devio.us/iocage_freebsd.html" rel="nofollow">FreeBSD Jails with iocage</a></h3>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
<p>FreeBSD jails allow users to run multiple, isolated instances of FreeBSD on a single server. Iocage simplifies the management of FreeBSD Jails. Following this tutorial, the jails will be configured to bind to an IP address on the jail host&#39;s internal network, and the host OS will pass traffic from the external network to the jail.</p>

<p>The jails will be managed with Iocage. Iocage uses ZFS properties to store configuration data for each jail, so a ZFS file system is required.</p>
</blockquote>

<ul>
<li>Network setup These steps will:

<ul>
<li>Set up the internal network.</li>
<li>Enable the pf packet filter</li>
<li>Configure pf pass internet traffic to and from the jail.</li>
</ul></li>
</ul>

<blockquote>
<p>PF is full featured firewall, and can do more than just pass traffic to an internal network. Refer to the PF documentation for additional configuration options.</p>
</blockquote>

<ul>
<li>Run the following to configure the internal network and enable pf.</li>
</ul>

<pre><code>sysrc cloned_interfaces+=&quot;lo1&quot;
sysrc ifconfig_lo1=&quot;inet 192.0.2.1/24&quot;
sysrc pf_enable=&quot;YES&quot;
</code></pre>

<ul>
<li>Put the following in /etc/pf.conf</li>
</ul>

<pre><code># Variables
# ext_if should be set to the hosts external NIC
ext_if = &quot;vtnet0&quot;
jail_if = &quot;lo1&quot;
jail_net = $jail_if:network

# NAT allows the jails to access the external network
nat on $ext_if from $jail_net to any -&gt; ($ext_if)

# Redirect traffic on port 80 to the web server jail
# Add similar rules for additional jails
rdr pass on $ext_if inet proto tcp to port 80 -&gt; 192.0.2.10
</code></pre>

<ul>
<li><p>Reboot to activate the network changes</p></li>
<li><p>ZFS</p></li>
</ul>

<blockquote>
<p>The best way to use ZFS on a VPS is to attach block storage as a new disk.<br>
If block storage is not available, you can optionally use a file as the ZFS device.</p>
</blockquote>

<ul>
<li>Enable and start ZFS.</li>
</ul>

<pre><code>sysrc zfs_enable=&quot;YES&quot;
service zfs start
</code></pre>

<ul>
<li>ZFS using Block storage</li>
</ul>

<blockquote>
<p>List the available disks. <br>
If you are using a VPS, the block store will probably be the second disk.</p>
</blockquote>

<p><code>geom disk list</code></p>

<ul>
<li>Create a ZFS pool named jailstore.</li>
</ul>

<p><code>zpool create jailstore  /dev/vtbd1</code></p>

<ul>
<li>ZFS using a file</li>
</ul>

<blockquote>
<p>Create the ZFS file.</p>
</blockquote>

<p><code>dd if=/dev/zero of=/zfsfile bs=1M count=4096</code></p>

<ul>
<li>Create a ZFS pool named jailstore.</li>
</ul>

<p><code>zpool create jailstore /zfsfile</code></p>

<ul>
<li>Install iocage the easy way</li>
</ul>

<p><code>pkg install py36-iocage</code></p>

<blockquote>
<p>Skip to &quot;Using iocage&quot;</p>
</blockquote>

<ul>
<li>Install iocage the hard way</li>
<li>Swap file</li>
</ul>

<blockquote>
<p>Smaller servers may not have enough RAM to build iocage. If needed, create a swap file and reboot.</p>
</blockquote>

<pre><code>dd if=/dev/zero of=/swapfile bs=1M count=1024
echo &#39;swapfile=&quot;/swapfile&quot;&#39; &gt;&gt; /etc/rc.conf
reboot
</code></pre>

<ul>
<li>Install some build dependencies</li>
</ul>

<p><code>pkg install subversion python36 git-lite libgit2  py36-pip</code></p>

<ul>
<li>Building iocage requires the FreeBSD source.</li>
</ul>

<p><code>svn checkout https://svn.freebsd.org/base/releng/11.1 /usr/src</code></p>

<ul>
<li>Get the latest FreeBSD ports tree.</li>
</ul>

<pre><code>portsnap fetch
portsnap extract

</code></pre>

<ul>
<li>build iocage.</li>
</ul>

<pre><code>cd /usr/ports/sysutils/iocage/
make install
</code></pre>

<ul>
<li>Using iocage</li>
</ul>

<pre><code>iocage activate jailstore
iocage fetch

iocage create -n www ip4_addr=&quot;lo1|192.0.2.10/24&quot; -r 11.1-RELEASE
iocage start www
iocage console www
</code></pre>

<blockquote>
<p>Once you have a shell inside the jail, install and start Apache.</p>
</blockquote>

<pre><code>pkg install apache24
sysrc apache24_enable=&quot;yes&quot;
service apache24 start
</code></pre>

<blockquote>
<p>Port 80 on the jail will now be accessible on the hosts IP address.</p>
</blockquote>

<ul>
<li>Multiple jails.</li>
</ul>

<blockquote>
<p>Additional jails can be installed using the example above.</p>
</blockquote>

<ul>
<li>Install the new jail with the iocage create command , but use a different IP address</li>
<li>Expose the new jail to the network by adding additional rules to pf.conf.</li>
</ul>

<hr>

<h3>iXsystems</h3>

<ul>
<li><a href="https://www.ixsystems.com/blog/snia-report-2018/" rel="nofollow">SNIA Persistent Memory Summit 2018 Report</a></li>
</ul>

<h3><a href="https://www.freebsd.org/internal/code-of-conduct.html" rel="nofollow">New FreeBSD Code of Conduct</a></h3>

<blockquote>
<p>The FreeBSD Project is inclusive. We want the FreeBSD Project to be a venue where people of all backgrounds can work together to make the best operating system, built by a strong community. These values extend beyond just development to all aspects of the Project. All those given recognition as members of the Project in whatever form are seen as ambassadors of the Project.</p>

<p>Diversity is a huge strength and is critical to the long term success of the Project. To that end we have a few ground rules that we ask people to adhere to. This code applies equally to everyone representing the FreeBSD Project in any way, from new members, to committers, to the core team itself. These rules are intended to ensure a safe, harassment-free environment for all and to ensure that everyone feels welcome both working within, and interacting with, the Project.</p>

<p>This document is not an exhaustive list of things that you should not do. Rather, consider it a guide to make it easier to enrich all of us and the technical communities in which we participate.</p>

<p>This code of conduct applies to all spaces used by the FreeBSD Project, including our mailing lists, IRC channels, and social media, both online and off. Anyone who is found to violate this code of conduct may be sanctioned or expelled from FreeBSD Project controlled spaces at the discretion of the FreeBSD Code of Conduct Committee.</p>

<p>Some FreeBSD Project spaces may have additional rules in place, which will be made clearly available to participants. Participants are responsible for knowing and abiding by these rules. </p>
</blockquote>

<p>Harassment includes but is not limited to:</p>

<ul>
<li>Comments that reinforce systemic oppression related to gender, gender identity and expression, sexual orientation, disability, mental illness, neurodiversity, physical appearance, body size, age, race, or religion.</li>
<li>Unwelcome comments regarding a person&#39;s lifestyle choices and practices, including those related to food, health, parenting, drugs, and employment.</li>
<li>Deliberate misgendering.</li>
<li>Deliberate use of &quot;dead&quot; or rejected names.</li>
<li>Gratuitous or off-topic sexual images or behaviour in spaces where they&#39;re not appropriate.</li>
<li>Physical contact and simulated physical contact (e.g., textual descriptions like &quot;<em>hug</em>&quot; or &quot;<em>backrub</em>&quot;) without consent or after a request to stop.</li>
<li>Threats of violence.</li>
<li>Incitement of violence towards any individual, including encouraging a person to commit suicide or to engage in self-harm.</li>
<li>Deliberate intimidation.</li>
<li>Stalking or following.</li>
<li>Harassing photography or recording, including logging online activity for harassment purposes.</li>
<li>Sustained disruption of discussion.</li>
<li>Unwelcome sexual attention.</li>
<li>Pattern of inappropriate social contact, such as requesting/assuming inappropriate levels of intimacy with others.</li>
<li>Continued one-on-one communication after requests to cease.</li>
<li>Deliberate &quot;outing&quot; of any private aspect of a person&#39;s identity without their consent except as necessary to protect vulnerable people from intentional abuse.</li>
<li>Publication of non-harassing private communication without consent.</li>
<li>Publication of non-harassing private communication with consent but in a way that intentionally misrepresents the communication (e.g., removes context that changes the meaning).</li>
<li>Knowingly making harmful false claims about a person.
***</li>
</ul>

<h2>Interview - Benno Rice - <a href="mailto:benno@freebsd.org" rel="nofollow">benno@freebsd.org</a> / <a href="https://twitter.com/jeamland" rel="nofollow">@jeamland</a></h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.soldierx.com/news/libhijack-PoCGTFO-0x17" rel="nofollow">libhijack in PoC||GTFO 0x17!</a></h3>

<ul>
<li>Hijacking Your Free Beasties</li>
</ul>

<blockquote>
<p>In the land of red devils known as Beasties exists a system devoid of meaningful exploit mitigations. As we explore this vast land of opportunity, we will meet our ELFish friends, [p]tracing their very moves in order to hijack them. Since unprivileged process debugging is<br>
enabled by default on FreeBSD, we can abuse PTrace to create anonymous memory mappings, inject code into them, and overwrite PLT/GOT entries. We will revive a tool called libhijack to make our nefarious activities of hijacking ELFs via PTrace relatively easy.</p>

<p>Nothing presented here is technically new. However, this type of work has not been documented in this much detail, tying it all into one cohesive work. In Phrack 56, Silvio Cesare taught us ELF research enthusiasts how to hook the PLT/GOT. The Phrack 59 article on Runtime Process Infection briefly introduces the concept of injecting shared objects by injecting shellcode via PTrace that calls dlopen(). No other piece of research, however, has discovered the joys of forcing the application to create anonymous memory mappings in which to inject<br>
Code.</p>

<p>This is only part one of a series of planned articles that will follow libhijack&#39;s development. The end goal is to be able to anonymously inject shared objects. The libhijack project is maintained by the SoldierX community.</p>
</blockquote>

<ul>
<li>Previous Research</li>
</ul>

<blockquote>
<p>All prior work injects code into the stack, the heap, or existing executable code. All three methods create issues on today&#39;s systems. On amd64 and arm64, the two architectures libhijack cares about, the stack is non-executable by default. jemalloc, the heap implementation<br>
on FreeBSD, creates non-executable mappings. Obviously overwriting existing executable code destroys a part of the executable image.</p>
</blockquote>

<ul>
<li>The Role of ELF
&gt; FreeBSD provides a nifty API for inspecting the entire virtual memory space of an application. The results returned from the API tells us the protection flags (readable, writable, executable) of each mapping. If FreeBSD provides such a rich API, why would we need to parse the
ELF headers?</li>
</ul>

<blockquote>
<p>PLT/GOT hijacking requires parsing ELF headers. One would not be able to find the PLT/GOT without iterating through the Process Headers to find the Dynamic Headers, eventually ending up with the DT_PLTGOT entry.</p>

<p>With FreeBSD&#39;s libprocstat API, we don&#39;t have a need for parsing ELF headers until we get to the PLT/GOT stage, but doing so early makes it easier for the attacker using libhijack</p>
</blockquote>

<ul>
<li>The Future of libhijack</li>
</ul>

<blockquote>
<p>Writing devious code in assembly is cumbersome. Assembly doesn&#39;t scale well to multiple architectures. Instead, we would like to write our devious code in C, compiling to a shared object that gets injected anonymously. This requires writing a remote RTLD within libhijack and<br>
is in progress. Writing a remote RTLD will take a while as doing so is not an easy task.</p>

<p>Additionally, creation of a general-purpose helper library that gets injected would be helpful. It could aid in PLT/GOT redirection attacks, possibly storing the addresses of functions we&#39;ve previously hijacked. This work is dependent on the remote RTLD.</p>

<p>libhijack currently lacks documentation. Once the ABI and API stabilize, formal documentation will be written.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>Using libhijack, we can easily create anonymous memory mappings, inject into them arbitrary code, and hijack the PLT/GOT on FreeBSD. On HardenedBSD, a hardened derivative of FreeBSD, libhijack is fully mitigated through PaX NOEXEC.</p>

<p>We&#39;ve demonstrated that wrapper-style Capsicum is ineffective on FreeBSD. Through the use of libhijack, we emulate a control flow hijack in which the application is forced to call sandbox_open and fdlopen on the resulting file descriptor.</p>

<p>Further work to support anonymous injection of full shared objects, along with their dependencies, will be supported in the future. Imagine injecting libpcap into Apache to sniff traffic whenever &quot;GET /pcap&quot; is sent.</p>

<p>In order to prevent abuse of PTrace, FreeBSD should set the security.bsd.unprivileged_proc_debug to 0 by default. In order to prevent process manipulation, FreeBSD should implement PaX NOEXEC.</p>
</blockquote>

<ul>
<li>libhijack can be found at <a href="https://github.com/SoldierX/libhijack" rel="nofollow">https://github.com/SoldierX/libhijack</a></li>
</ul>

<hr>

<h3><a href="https://sircmpwn.github.io/2018/02/05/Introduction-to-POSIX-shell.html" rel="nofollow">Introduction to POSIX shell</a></h3>

<blockquote>
<p>What the heck is the POSIX shell anyway? Well, the POSIX (the Portable Operating System Interface) shell is the standard Unix shell - standard meaning it was formally defined and shipped in a published standard. This makes shell scripts written for it portable, something no other shell can lay claim to. The POSIX shell is basically a formalized version of the venerable Bourne shell, and on your system it lives at /bin/sh, unless you’re one of the unlucky masses for whom this is a symlink to bash.</p>
</blockquote>

<ul>
<li>Why use POSIX shell?</li>
</ul>

<blockquote>
<p>The “Bourne Again shell”, aka bash, is not standardized. Its grammar, features, and behavior aren’t formally written up anywhere, and only one implementation of bash exists. Without a standard, bash is defined by its implementation. POSIX shell, on the other hand, has many competing implementations on many different operating systems - all of which are compatible with each other because they conform to the standard.</p>

<p>Any shell that utilizes features specific to Bash are not portable, which means you cannot take them with you to any other system. Many Linux-based systems do not use Bash or GNU coreutils. Outside of Linux, pretty much everyone but Hurd does not ship GNU tools, including bash1. On any of these systems, scripts using “bashisms” will not work.</p>

<p>This is bad if your users wish to utilize your software anywhere other than GNU/Linux. If your build tooling utilizes bashisms, your software will not build on anything but GNU/Linux. If you ship runtime scripts that use bashisms, your software will not run on anything but GNU/Linux. The case for sticking to POSIX shell in shipping software is compelling, but I argue that you should stick to POSIX shell for your personal scripts, too. You might not care now, but when you feel like flirting with other Unicies you’ll thank me when all of your scripts work.</p>

<p>One place where POSIX shell does not shine is for interactive use - a place where I think bash sucks, too. Any shell you want to use for your day-to-day command line work is okay in my book. I use fish. Use whatever you like interactively, but stick to POSIX sh for your scripts.</p>
</blockquote>

<ul>
<li>How do I use POSIX shell?</li>
</ul>

<blockquote>
<p>At the top of your scripts, put #!/bin/sh. You don’t have to worry about using env here like you might have been trained to do with bash: /bin/sh is the standardized location for the POSIX shell, and any standards-conforming system will either put it there or make your script work anyway.</p>

<p>The next step is to avoid bashisms. There are many, but here are a few that might trip you up:</p>
</blockquote>

<ul>
<li>[[ condition ]] does not work; use [ condition ]</li>
<li>Arrays do not work; use IFS</li>
<li>Local variables do not work; use a subshell</li>
</ul>

<blockquote>
<p>The easiest way to learn about POSIX shell is to read the standard - it’s not too dry and shorter than you think.</p>
</blockquote>

<ul>
<li>Using standard coreutils</li>
</ul>

<blockquote>
<p>The last step to writing portable scripts is to use portable tools. Your system may have GNU coreutils installed, which provides tools like grep and cut. Unfortunately, GNU has extended these tools with its own non-portable flags and tools. It’s important that you avoid these.</p>

<p>One dead giveaway of a non-portable flag is long flags, e.g. grep --file=FILE as opposed to grep -f. The POSIX standard only defines the getopt function - not the proprietary GNU getopt_long function that’s used to interpret long options. As a result, no long flags are standardized. You might worry that this will make your scripts difficult to understand, but I think that on the whole it will not. Shell scripts are already pretty alien and require some knowledge to understand. Is knowledge of what the magic word grep means much different from knowledge of what grep -E means?</p>

<p>I also like that short flags allow you to make more concise command lines. Which is better: ps --all --format=user --without-tty, or ps -aux? If you are inclined to think the former, do you also prefer function(a, b, c) { return a + b + c; } over (a, b, c) =&gt; a + b + c? Conciseness matters, and POSIX shell supports comments if necessary!</p>
</blockquote>

<ul>
<li>Some tips for using short flags:</li>
<li>They can be collapsed: cmd -a -b -c is equivalent to cmd -abc</li>
<li>If they take additional arguments, either a space or no separation is acceptable: cmd -f&quot;hello world&quot; or cmd -f &quot;hello world&quot;</li>
</ul>

<blockquote>
<p>A good reference for learning about standardized commands is, once again, the standard. From this page, search for the command you want, or navigate through “Shell &amp; Utilities” -&gt; “Utilities” for a list. If you have man-pages installed, you will also find POSIX man pages installed on your system with the p postfix, such as man 1p grep. Note: at the time of writing, the POSIX man pages do not use dashes if your locale is UTF-8, which makes searching for flags with / difficult. Use env LC_ALL=POSIX man 1p grep if you need to search for flags, and I’ll speak to the maintainer of man-pages about this.</p>
</blockquote>

<hr>

<h3><a href="http://landonf.org/code/freebsd/Broadcom_WiFi_Improvements.20180122.html" rel="nofollow">FreeBSD Broadcom Wi-Fi Improvements</a></h3>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
<p>Since 2015, I&#39;ve been working on improving FreeBSD support for Broadcom Wi-Fi devices and SoCs, including authoring the bhnd(4) driver family, which provides a unified bus and driver programming interface for these devices.</p>

<p>First committed in early 2016, bhnd(4) allowed us to quickly bring up FreeBSD/MIPS on Broadcom SoCs, but it has taken much longer to implement the full set of features required to support modern Broadcom SoftMAC Wi-Fi hardware.</p>

<p>Thanks to the generosity of the FreeBSD Foundation, I&#39;ve recently finished implementing the necessary improvements to the bhnd(4) driver family. With these changes in place, I was finally able to port the existing bwn(4) Broadcom SoftMAC Wi-Fi driver to the bhnd(4) bus, and implement initial support for the BCM43224 and BCM43225 chipsets, with additional hardware support to be forthcoming.</p>

<p>Now that my efforts on FreeBSD/Broadcom Wi-Fi support have progressed far enough to be generally useful, I wanted to take some time to provide a brief overview of Broadcom&#39;s Wi-Fi hardware, and explain how my work provides a foundation for further FreeBSD Broadcom Wi-Fi/SoC improvements.</p>
</blockquote>

<ul>
<li>A Brief Background on Broadcom Wi-Fi Hardware</li>
</ul>

<blockquote>
<p>Broadcom&#39;s Wi-Fi devices are members of the Broadcom Home Networking Division (BHND) device family; other BHND devices include MIPS/ARM SoCs (including Wi-Fi SoCs commonly found in consumer access points), as well as a large variety of related networking hardware.</p>
</blockquote>

<ul>
<li>BHND devices utilize a common set of Broadcom IP cores (or &quot;functional blocks&quot;) connected via one of two on-chip bus architectures:</li>
<li>Hardware designed prior to 2009 used Broadcom’s “SSB” backplane architecture, based on Sonics Silicon’s interconnect IP.</li>
<li>Subsequent hardware adopted Broadcom’s “BCMA” backplane, based on ARM’s AMBA IP. The IP cores used in earlier SSB-based devices were adapted for compatibility with the new backplane.</li>
</ul>

<blockquote>
<p>When BHND hardware is used in a PCI Wi-Fi card, or a SDIO Wi-Fi module, the device&#39;s dual-mode peripheral controller is configured to operate as an endpoint device on the host&#39;s peripheral bus, bridging access to the SoC hardware:</p>
</blockquote>

<ul>
<li>Host access to SoC address space is provided via a set of register windows (e.g., a set of configurable windows into SoC address space mapped via PCI BARs)</li>
<li>DMA is supported by the bridge core’s sparse mapping of host address space into the backplane address space. These address regions may be used as a target for the on-chip DMA engines.</li>
<li>Any backplane interrupt vectors routed to the bridge core may be mapped by the bridge to host interrupts (e.g., PCI INTx/MSI/MSI-X).</li>
</ul>

<blockquote>
<p>The host is generally expected to provide drivers for the IP cores found on the SoC backplane; since these cores are found in both BHND SoCs and BHND Wi-Fi devices, it is advantageous to share driver and platform code between the two targets.</p>
</blockquote>

<ul>
<li><p>Modernizing FreeBSD&#39;s Broadcom SoftMAC Wi-Fi Support</p>

<ul>
<li>FreeBSD support for Broadcom SoftMAC Wi-Fi adapters is provided by two partially overlapping PCI/CardBus drivers:</li>
<li>Legacy Wi-Fi adapters are supported by bwi(4). This driver remains in-tree to support devices incompatible with v4 or later firmware (e.g. BCM4301, BCM4302, BCM4306 rev 1-2), all of which were released prior to December 2002.</li>
<li>Modern Wi-Fi adapters are supported by bwn(4), with access to on-chip cores mediated by bhnd(4).</li>
</ul></li>
</ul>

<blockquote>
<p>Prior to my work porting bwn(4) to bhnd(4), access to on-chip cores was mediated by siba_bwn, a PCI/WiFi-specific derivative of the legacy siba(4) SSB bus driver. There were two major limitations to siba_bwn that have long blocked adding support for newer SoftMAC Wi-Fi chipsets: the newer BCMA interconnect found in post-2009 hardware was not supported by siba(4), and siba_bwn assumed a PCI/PCIe bridge, preventing its use on FreeBSD/MIPS Broadcom SoCs with interconnect-attached D11 cores.</p>
</blockquote>

<ul>
<li>The new bhnd(4) driver family, written as a replacement for siba(4) and siba_bwn, provides:</li>
<li>A unified bus driver interface for both SSB and BCMA on-chip interconnects</li>
<li>A generic BHND bridge driver framework for host-connected BHND devices (e.g. Wi-Fi adapters, etc)</li>
<li>A PCI/PCIe bridge core driver, for PCI-attached BHND devices.</li>
<li>An abstract BHND NVRAM API, with support for the varied NVRAM formats found in BHND Wi-Fi adapters and SoCs.</li>
<li>Drivers for common BHND platform peripherals (UARTs, SPROM/flash, PMUs, etc)</li>
</ul>

<blockquote>
<p>By porting bwn(4) to bhnd(4), we are now able to support existing BCMA devices with MAC/PHY/Radio combinations readily supported by bwn(4), as was the case with the BCM43224 and BCM43225 chipsets. This also opens the door to porting additional PHY support from Broadcom’s ISC-licensed Linux drivers, and will allow us to bring up bwn(4) on Broadcom WiSoCs supported by FreeBSD/MIPS.</p>
</blockquote>

<hr>

<h3><a href="https://www.tumfatig.net/20180129/monitor-opensmtpd-using-logstash-grafana/" rel="nofollow">Monitor OpenSMTPD using Logstash and Grafana</a></h3>

<blockquote>
<p>Logs are usefull. Graphs are sexy. Here’s a way to get a view on what happens to your OpenSMTPD traffic, using Web v2.0 tools ; namely Logstash &amp; Grafana.<br>
For those who would not be aware of those tools, logstash is some kind of log-parser that can eat syslog formatted logs and write them into elasticsearch ; in “document” format. Grafana is a Web frontend that can dig into various databases and render graphics from requests.<br>
I won’t go into the whole “how to install” process here. Installation is quite straight forward and online documentation is quite clear.</p>
</blockquote>

<ul>
<li>What you need</li>
</ul>

<blockquote>
<p>OpenSMTPD deals with emails and logs its activity via Syslog.<br>
Syslog is configured to send the logs to Logstash.<br>
Logstash has a set of rules configured to transform the text-oriented information into searchable document-oriented data. The transformed data is stored into Elasticsearch.<br>
Elasticsearch provides Web API to search and find stuff.<br>
Grafana connects to ELS to get data and draw the graphs.</p>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.meetup.com/CharmBUG/events/247995596/" rel="nofollow">CharmBUG Presentation - Writing FreeBSD Malware</a></li>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-February/014180.html" rel="nofollow">March London *BSD meeting 13/03/18</a></li>
<li><a href="https://wiki.freebsd.org/MateuszPiotrowski/Ports/Workshop" rel="nofollow">FreBSD Ports Workshop</a></li>
<li><a href="https://speakerdeck.com/tsutsui/osc2018osaka" rel="nofollow">The history of NetBSD/atari and support for ATARI compatible Milan / OSC2018Osaka</a></li>
<li><a href="https://www.tiltedwindmillpress.com/?product=ssh-mastery-2nd-edition" rel="nofollow">SSH Mastery, 2nd Edition</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Stephen - <a href="http://dpaste.com/06WTRB9#wrap" rel="nofollow">Viewer Interview Question</a></li>
<li>pb - <a href="http://dpaste.com/0TZV6CM#wrap" rel="nofollow">trust expanding your 280TB pool</a></li>
<li>Tim - <a href="http://dpaste.com/0759X1E#wrap" rel="nofollow">ZFS questions for the ZFS Man</a></li>
<li>Daniel - <a href="http://dpaste.com/1SJXSBQ#wrap" rel="nofollow">ZFS full backup question</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>GSoC 2018 Projects announced, tutorial FreeBSD jails with iocage, new Code of Conduct for FreeBSD, libhijack, and fancy monitoring for OpenSMTPD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://summerofcode.withgoogle.com/organizations/?sp-page=5" rel="nofollow">Google Summer of Code 2018</a></h3>

<ul>
<li><a href="https://www.freebsd.org/projects/summerofcode.html" rel="nofollow">FreeBSD</a></li>
<li><a href="https://wiki.freebsd.org/SummerOfCodeIdeas" rel="nofollow">FreeBSD Google Summer oF Code Ideas</a></li>
</ul>

<blockquote>
<p>You can join #freebsd-soc on the efnet IRC network to chat with FreeBSD developers interested in mentoring student proposals and projects, past FreeBSD/GSoC students, and other students applying to FreeBSD/GSoC this year.</p>
</blockquote>

<ul>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2018/02/12/msg000765.html" rel="nofollow">NetBSD</a></li>
</ul>

<blockquote>
<p>You can get a stipend (paid for by Google) and spend a few months getting to know and improving the insides of NetBSD or pkgsrc.</p>
</blockquote>

<pre><code>The schedule is:
12-27 March             Applying
23 April                Find out if you were accepted
14 May - 22 August      Do the project!

We have some suggestions for suitable projects:
- ARM EFI bootloader
- Using libFuzzer on base tools
- Refactoring ALTQ (QoS implementation) and integrating with NPF
- Testsuite for libcurses
- Improve pkgin

Other suggestions and details are at:
https://wiki.netbsd.org/projects/gsoc/
</code></pre>

<blockquote>
<p>These projects are suggestions; you can come up with your own. Suggestions for other suitable projects are welcome.</p>

<p>Feel free to contact, or chat around on IRC: irc.freenode.org #netbsd #netbsd-code #pkgsrc</p>
</blockquote>

<ul>
<li><a href="https://summerofcode.withgoogle.com/organizations/4821756754264064/" rel="nofollow">Haiku</a>

<ul>
<li><a href="https://www.haiku-os.org/community/gsoc/2018/students" rel="nofollow">Students: How to Apply for a Haiku Idea</a></li>
<li><a href="https://www.haiku-os.org/community/gsoc/2018/ideas" rel="nofollow">Project Ideas</a>
&gt; If you have questions you can contact the devs on IRC: irc.freenode.org #haiku</li>
</ul></li>
</ul>

<hr>

<h3><a href="http://norrist.devio.us/iocage_freebsd.html" rel="nofollow">FreeBSD Jails with iocage</a></h3>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
<p>FreeBSD jails allow users to run multiple, isolated instances of FreeBSD on a single server. Iocage simplifies the management of FreeBSD Jails. Following this tutorial, the jails will be configured to bind to an IP address on the jail host&#39;s internal network, and the host OS will pass traffic from the external network to the jail.</p>

<p>The jails will be managed with Iocage. Iocage uses ZFS properties to store configuration data for each jail, so a ZFS file system is required.</p>
</blockquote>

<ul>
<li>Network setup These steps will:

<ul>
<li>Set up the internal network.</li>
<li>Enable the pf packet filter</li>
<li>Configure pf pass internet traffic to and from the jail.</li>
</ul></li>
</ul>

<blockquote>
<p>PF is full featured firewall, and can do more than just pass traffic to an internal network. Refer to the PF documentation for additional configuration options.</p>
</blockquote>

<ul>
<li>Run the following to configure the internal network and enable pf.</li>
</ul>

<pre><code>sysrc cloned_interfaces+=&quot;lo1&quot;
sysrc ifconfig_lo1=&quot;inet 192.0.2.1/24&quot;
sysrc pf_enable=&quot;YES&quot;
</code></pre>

<ul>
<li>Put the following in /etc/pf.conf</li>
</ul>

<pre><code># Variables
# ext_if should be set to the hosts external NIC
ext_if = &quot;vtnet0&quot;
jail_if = &quot;lo1&quot;
jail_net = $jail_if:network

# NAT allows the jails to access the external network
nat on $ext_if from $jail_net to any -&gt; ($ext_if)

# Redirect traffic on port 80 to the web server jail
# Add similar rules for additional jails
rdr pass on $ext_if inet proto tcp to port 80 -&gt; 192.0.2.10
</code></pre>

<ul>
<li><p>Reboot to activate the network changes</p></li>
<li><p>ZFS</p></li>
</ul>

<blockquote>
<p>The best way to use ZFS on a VPS is to attach block storage as a new disk.<br>
If block storage is not available, you can optionally use a file as the ZFS device.</p>
</blockquote>

<ul>
<li>Enable and start ZFS.</li>
</ul>

<pre><code>sysrc zfs_enable=&quot;YES&quot;
service zfs start
</code></pre>

<ul>
<li>ZFS using Block storage</li>
</ul>

<blockquote>
<p>List the available disks. <br>
If you are using a VPS, the block store will probably be the second disk.</p>
</blockquote>

<p><code>geom disk list</code></p>

<ul>
<li>Create a ZFS pool named jailstore.</li>
</ul>

<p><code>zpool create jailstore  /dev/vtbd1</code></p>

<ul>
<li>ZFS using a file</li>
</ul>

<blockquote>
<p>Create the ZFS file.</p>
</blockquote>

<p><code>dd if=/dev/zero of=/zfsfile bs=1M count=4096</code></p>

<ul>
<li>Create a ZFS pool named jailstore.</li>
</ul>

<p><code>zpool create jailstore /zfsfile</code></p>

<ul>
<li>Install iocage the easy way</li>
</ul>

<p><code>pkg install py36-iocage</code></p>

<blockquote>
<p>Skip to &quot;Using iocage&quot;</p>
</blockquote>

<ul>
<li>Install iocage the hard way</li>
<li>Swap file</li>
</ul>

<blockquote>
<p>Smaller servers may not have enough RAM to build iocage. If needed, create a swap file and reboot.</p>
</blockquote>

<pre><code>dd if=/dev/zero of=/swapfile bs=1M count=1024
echo &#39;swapfile=&quot;/swapfile&quot;&#39; &gt;&gt; /etc/rc.conf
reboot
</code></pre>

<ul>
<li>Install some build dependencies</li>
</ul>

<p><code>pkg install subversion python36 git-lite libgit2  py36-pip</code></p>

<ul>
<li>Building iocage requires the FreeBSD source.</li>
</ul>

<p><code>svn checkout https://svn.freebsd.org/base/releng/11.1 /usr/src</code></p>

<ul>
<li>Get the latest FreeBSD ports tree.</li>
</ul>

<pre><code>portsnap fetch
portsnap extract

</code></pre>

<ul>
<li>build iocage.</li>
</ul>

<pre><code>cd /usr/ports/sysutils/iocage/
make install
</code></pre>

<ul>
<li>Using iocage</li>
</ul>

<pre><code>iocage activate jailstore
iocage fetch

iocage create -n www ip4_addr=&quot;lo1|192.0.2.10/24&quot; -r 11.1-RELEASE
iocage start www
iocage console www
</code></pre>

<blockquote>
<p>Once you have a shell inside the jail, install and start Apache.</p>
</blockquote>

<pre><code>pkg install apache24
sysrc apache24_enable=&quot;yes&quot;
service apache24 start
</code></pre>

<blockquote>
<p>Port 80 on the jail will now be accessible on the hosts IP address.</p>
</blockquote>

<ul>
<li>Multiple jails.</li>
</ul>

<blockquote>
<p>Additional jails can be installed using the example above.</p>
</blockquote>

<ul>
<li>Install the new jail with the iocage create command , but use a different IP address</li>
<li>Expose the new jail to the network by adding additional rules to pf.conf.</li>
</ul>

<hr>

<h3>iXsystems</h3>

<ul>
<li><a href="https://www.ixsystems.com/blog/snia-report-2018/" rel="nofollow">SNIA Persistent Memory Summit 2018 Report</a></li>
</ul>

<h3><a href="https://www.freebsd.org/internal/code-of-conduct.html" rel="nofollow">New FreeBSD Code of Conduct</a></h3>

<blockquote>
<p>The FreeBSD Project is inclusive. We want the FreeBSD Project to be a venue where people of all backgrounds can work together to make the best operating system, built by a strong community. These values extend beyond just development to all aspects of the Project. All those given recognition as members of the Project in whatever form are seen as ambassadors of the Project.</p>

<p>Diversity is a huge strength and is critical to the long term success of the Project. To that end we have a few ground rules that we ask people to adhere to. This code applies equally to everyone representing the FreeBSD Project in any way, from new members, to committers, to the core team itself. These rules are intended to ensure a safe, harassment-free environment for all and to ensure that everyone feels welcome both working within, and interacting with, the Project.</p>

<p>This document is not an exhaustive list of things that you should not do. Rather, consider it a guide to make it easier to enrich all of us and the technical communities in which we participate.</p>

<p>This code of conduct applies to all spaces used by the FreeBSD Project, including our mailing lists, IRC channels, and social media, both online and off. Anyone who is found to violate this code of conduct may be sanctioned or expelled from FreeBSD Project controlled spaces at the discretion of the FreeBSD Code of Conduct Committee.</p>

<p>Some FreeBSD Project spaces may have additional rules in place, which will be made clearly available to participants. Participants are responsible for knowing and abiding by these rules. </p>
</blockquote>

<p>Harassment includes but is not limited to:</p>

<ul>
<li>Comments that reinforce systemic oppression related to gender, gender identity and expression, sexual orientation, disability, mental illness, neurodiversity, physical appearance, body size, age, race, or religion.</li>
<li>Unwelcome comments regarding a person&#39;s lifestyle choices and practices, including those related to food, health, parenting, drugs, and employment.</li>
<li>Deliberate misgendering.</li>
<li>Deliberate use of &quot;dead&quot; or rejected names.</li>
<li>Gratuitous or off-topic sexual images or behaviour in spaces where they&#39;re not appropriate.</li>
<li>Physical contact and simulated physical contact (e.g., textual descriptions like &quot;<em>hug</em>&quot; or &quot;<em>backrub</em>&quot;) without consent or after a request to stop.</li>
<li>Threats of violence.</li>
<li>Incitement of violence towards any individual, including encouraging a person to commit suicide or to engage in self-harm.</li>
<li>Deliberate intimidation.</li>
<li>Stalking or following.</li>
<li>Harassing photography or recording, including logging online activity for harassment purposes.</li>
<li>Sustained disruption of discussion.</li>
<li>Unwelcome sexual attention.</li>
<li>Pattern of inappropriate social contact, such as requesting/assuming inappropriate levels of intimacy with others.</li>
<li>Continued one-on-one communication after requests to cease.</li>
<li>Deliberate &quot;outing&quot; of any private aspect of a person&#39;s identity without their consent except as necessary to protect vulnerable people from intentional abuse.</li>
<li>Publication of non-harassing private communication without consent.</li>
<li>Publication of non-harassing private communication with consent but in a way that intentionally misrepresents the communication (e.g., removes context that changes the meaning).</li>
<li>Knowingly making harmful false claims about a person.
***</li>
</ul>

<h2>Interview - Benno Rice - <a href="mailto:benno@freebsd.org" rel="nofollow">benno@freebsd.org</a> / <a href="https://twitter.com/jeamland" rel="nofollow">@jeamland</a></h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.soldierx.com/news/libhijack-PoCGTFO-0x17" rel="nofollow">libhijack in PoC||GTFO 0x17!</a></h3>

<ul>
<li>Hijacking Your Free Beasties</li>
</ul>

<blockquote>
<p>In the land of red devils known as Beasties exists a system devoid of meaningful exploit mitigations. As we explore this vast land of opportunity, we will meet our ELFish friends, [p]tracing their very moves in order to hijack them. Since unprivileged process debugging is<br>
enabled by default on FreeBSD, we can abuse PTrace to create anonymous memory mappings, inject code into them, and overwrite PLT/GOT entries. We will revive a tool called libhijack to make our nefarious activities of hijacking ELFs via PTrace relatively easy.</p>

<p>Nothing presented here is technically new. However, this type of work has not been documented in this much detail, tying it all into one cohesive work. In Phrack 56, Silvio Cesare taught us ELF research enthusiasts how to hook the PLT/GOT. The Phrack 59 article on Runtime Process Infection briefly introduces the concept of injecting shared objects by injecting shellcode via PTrace that calls dlopen(). No other piece of research, however, has discovered the joys of forcing the application to create anonymous memory mappings in which to inject<br>
Code.</p>

<p>This is only part one of a series of planned articles that will follow libhijack&#39;s development. The end goal is to be able to anonymously inject shared objects. The libhijack project is maintained by the SoldierX community.</p>
</blockquote>

<ul>
<li>Previous Research</li>
</ul>

<blockquote>
<p>All prior work injects code into the stack, the heap, or existing executable code. All three methods create issues on today&#39;s systems. On amd64 and arm64, the two architectures libhijack cares about, the stack is non-executable by default. jemalloc, the heap implementation<br>
on FreeBSD, creates non-executable mappings. Obviously overwriting existing executable code destroys a part of the executable image.</p>
</blockquote>

<ul>
<li>The Role of ELF
&gt; FreeBSD provides a nifty API for inspecting the entire virtual memory space of an application. The results returned from the API tells us the protection flags (readable, writable, executable) of each mapping. If FreeBSD provides such a rich API, why would we need to parse the
ELF headers?</li>
</ul>

<blockquote>
<p>PLT/GOT hijacking requires parsing ELF headers. One would not be able to find the PLT/GOT without iterating through the Process Headers to find the Dynamic Headers, eventually ending up with the DT_PLTGOT entry.</p>

<p>With FreeBSD&#39;s libprocstat API, we don&#39;t have a need for parsing ELF headers until we get to the PLT/GOT stage, but doing so early makes it easier for the attacker using libhijack</p>
</blockquote>

<ul>
<li>The Future of libhijack</li>
</ul>

<blockquote>
<p>Writing devious code in assembly is cumbersome. Assembly doesn&#39;t scale well to multiple architectures. Instead, we would like to write our devious code in C, compiling to a shared object that gets injected anonymously. This requires writing a remote RTLD within libhijack and<br>
is in progress. Writing a remote RTLD will take a while as doing so is not an easy task.</p>

<p>Additionally, creation of a general-purpose helper library that gets injected would be helpful. It could aid in PLT/GOT redirection attacks, possibly storing the addresses of functions we&#39;ve previously hijacked. This work is dependent on the remote RTLD.</p>

<p>libhijack currently lacks documentation. Once the ABI and API stabilize, formal documentation will be written.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>Using libhijack, we can easily create anonymous memory mappings, inject into them arbitrary code, and hijack the PLT/GOT on FreeBSD. On HardenedBSD, a hardened derivative of FreeBSD, libhijack is fully mitigated through PaX NOEXEC.</p>

<p>We&#39;ve demonstrated that wrapper-style Capsicum is ineffective on FreeBSD. Through the use of libhijack, we emulate a control flow hijack in which the application is forced to call sandbox_open and fdlopen on the resulting file descriptor.</p>

<p>Further work to support anonymous injection of full shared objects, along with their dependencies, will be supported in the future. Imagine injecting libpcap into Apache to sniff traffic whenever &quot;GET /pcap&quot; is sent.</p>

<p>In order to prevent abuse of PTrace, FreeBSD should set the security.bsd.unprivileged_proc_debug to 0 by default. In order to prevent process manipulation, FreeBSD should implement PaX NOEXEC.</p>
</blockquote>

<ul>
<li>libhijack can be found at <a href="https://github.com/SoldierX/libhijack" rel="nofollow">https://github.com/SoldierX/libhijack</a></li>
</ul>

<hr>

<h3><a href="https://sircmpwn.github.io/2018/02/05/Introduction-to-POSIX-shell.html" rel="nofollow">Introduction to POSIX shell</a></h3>

<blockquote>
<p>What the heck is the POSIX shell anyway? Well, the POSIX (the Portable Operating System Interface) shell is the standard Unix shell - standard meaning it was formally defined and shipped in a published standard. This makes shell scripts written for it portable, something no other shell can lay claim to. The POSIX shell is basically a formalized version of the venerable Bourne shell, and on your system it lives at /bin/sh, unless you’re one of the unlucky masses for whom this is a symlink to bash.</p>
</blockquote>

<ul>
<li>Why use POSIX shell?</li>
</ul>

<blockquote>
<p>The “Bourne Again shell”, aka bash, is not standardized. Its grammar, features, and behavior aren’t formally written up anywhere, and only one implementation of bash exists. Without a standard, bash is defined by its implementation. POSIX shell, on the other hand, has many competing implementations on many different operating systems - all of which are compatible with each other because they conform to the standard.</p>

<p>Any shell that utilizes features specific to Bash are not portable, which means you cannot take them with you to any other system. Many Linux-based systems do not use Bash or GNU coreutils. Outside of Linux, pretty much everyone but Hurd does not ship GNU tools, including bash1. On any of these systems, scripts using “bashisms” will not work.</p>

<p>This is bad if your users wish to utilize your software anywhere other than GNU/Linux. If your build tooling utilizes bashisms, your software will not build on anything but GNU/Linux. If you ship runtime scripts that use bashisms, your software will not run on anything but GNU/Linux. The case for sticking to POSIX shell in shipping software is compelling, but I argue that you should stick to POSIX shell for your personal scripts, too. You might not care now, but when you feel like flirting with other Unicies you’ll thank me when all of your scripts work.</p>

<p>One place where POSIX shell does not shine is for interactive use - a place where I think bash sucks, too. Any shell you want to use for your day-to-day command line work is okay in my book. I use fish. Use whatever you like interactively, but stick to POSIX sh for your scripts.</p>
</blockquote>

<ul>
<li>How do I use POSIX shell?</li>
</ul>

<blockquote>
<p>At the top of your scripts, put #!/bin/sh. You don’t have to worry about using env here like you might have been trained to do with bash: /bin/sh is the standardized location for the POSIX shell, and any standards-conforming system will either put it there or make your script work anyway.</p>

<p>The next step is to avoid bashisms. There are many, but here are a few that might trip you up:</p>
</blockquote>

<ul>
<li>[[ condition ]] does not work; use [ condition ]</li>
<li>Arrays do not work; use IFS</li>
<li>Local variables do not work; use a subshell</li>
</ul>

<blockquote>
<p>The easiest way to learn about POSIX shell is to read the standard - it’s not too dry and shorter than you think.</p>
</blockquote>

<ul>
<li>Using standard coreutils</li>
</ul>

<blockquote>
<p>The last step to writing portable scripts is to use portable tools. Your system may have GNU coreutils installed, which provides tools like grep and cut. Unfortunately, GNU has extended these tools with its own non-portable flags and tools. It’s important that you avoid these.</p>

<p>One dead giveaway of a non-portable flag is long flags, e.g. grep --file=FILE as opposed to grep -f. The POSIX standard only defines the getopt function - not the proprietary GNU getopt_long function that’s used to interpret long options. As a result, no long flags are standardized. You might worry that this will make your scripts difficult to understand, but I think that on the whole it will not. Shell scripts are already pretty alien and require some knowledge to understand. Is knowledge of what the magic word grep means much different from knowledge of what grep -E means?</p>

<p>I also like that short flags allow you to make more concise command lines. Which is better: ps --all --format=user --without-tty, or ps -aux? If you are inclined to think the former, do you also prefer function(a, b, c) { return a + b + c; } over (a, b, c) =&gt; a + b + c? Conciseness matters, and POSIX shell supports comments if necessary!</p>
</blockquote>

<ul>
<li>Some tips for using short flags:</li>
<li>They can be collapsed: cmd -a -b -c is equivalent to cmd -abc</li>
<li>If they take additional arguments, either a space or no separation is acceptable: cmd -f&quot;hello world&quot; or cmd -f &quot;hello world&quot;</li>
</ul>

<blockquote>
<p>A good reference for learning about standardized commands is, once again, the standard. From this page, search for the command you want, or navigate through “Shell &amp; Utilities” -&gt; “Utilities” for a list. If you have man-pages installed, you will also find POSIX man pages installed on your system with the p postfix, such as man 1p grep. Note: at the time of writing, the POSIX man pages do not use dashes if your locale is UTF-8, which makes searching for flags with / difficult. Use env LC_ALL=POSIX man 1p grep if you need to search for flags, and I’ll speak to the maintainer of man-pages about this.</p>
</blockquote>

<hr>

<h3><a href="http://landonf.org/code/freebsd/Broadcom_WiFi_Improvements.20180122.html" rel="nofollow">FreeBSD Broadcom Wi-Fi Improvements</a></h3>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
<p>Since 2015, I&#39;ve been working on improving FreeBSD support for Broadcom Wi-Fi devices and SoCs, including authoring the bhnd(4) driver family, which provides a unified bus and driver programming interface for these devices.</p>

<p>First committed in early 2016, bhnd(4) allowed us to quickly bring up FreeBSD/MIPS on Broadcom SoCs, but it has taken much longer to implement the full set of features required to support modern Broadcom SoftMAC Wi-Fi hardware.</p>

<p>Thanks to the generosity of the FreeBSD Foundation, I&#39;ve recently finished implementing the necessary improvements to the bhnd(4) driver family. With these changes in place, I was finally able to port the existing bwn(4) Broadcom SoftMAC Wi-Fi driver to the bhnd(4) bus, and implement initial support for the BCM43224 and BCM43225 chipsets, with additional hardware support to be forthcoming.</p>

<p>Now that my efforts on FreeBSD/Broadcom Wi-Fi support have progressed far enough to be generally useful, I wanted to take some time to provide a brief overview of Broadcom&#39;s Wi-Fi hardware, and explain how my work provides a foundation for further FreeBSD Broadcom Wi-Fi/SoC improvements.</p>
</blockquote>

<ul>
<li>A Brief Background on Broadcom Wi-Fi Hardware</li>
</ul>

<blockquote>
<p>Broadcom&#39;s Wi-Fi devices are members of the Broadcom Home Networking Division (BHND) device family; other BHND devices include MIPS/ARM SoCs (including Wi-Fi SoCs commonly found in consumer access points), as well as a large variety of related networking hardware.</p>
</blockquote>

<ul>
<li>BHND devices utilize a common set of Broadcom IP cores (or &quot;functional blocks&quot;) connected via one of two on-chip bus architectures:</li>
<li>Hardware designed prior to 2009 used Broadcom’s “SSB” backplane architecture, based on Sonics Silicon’s interconnect IP.</li>
<li>Subsequent hardware adopted Broadcom’s “BCMA” backplane, based on ARM’s AMBA IP. The IP cores used in earlier SSB-based devices were adapted for compatibility with the new backplane.</li>
</ul>

<blockquote>
<p>When BHND hardware is used in a PCI Wi-Fi card, or a SDIO Wi-Fi module, the device&#39;s dual-mode peripheral controller is configured to operate as an endpoint device on the host&#39;s peripheral bus, bridging access to the SoC hardware:</p>
</blockquote>

<ul>
<li>Host access to SoC address space is provided via a set of register windows (e.g., a set of configurable windows into SoC address space mapped via PCI BARs)</li>
<li>DMA is supported by the bridge core’s sparse mapping of host address space into the backplane address space. These address regions may be used as a target for the on-chip DMA engines.</li>
<li>Any backplane interrupt vectors routed to the bridge core may be mapped by the bridge to host interrupts (e.g., PCI INTx/MSI/MSI-X).</li>
</ul>

<blockquote>
<p>The host is generally expected to provide drivers for the IP cores found on the SoC backplane; since these cores are found in both BHND SoCs and BHND Wi-Fi devices, it is advantageous to share driver and platform code between the two targets.</p>
</blockquote>

<ul>
<li><p>Modernizing FreeBSD&#39;s Broadcom SoftMAC Wi-Fi Support</p>

<ul>
<li>FreeBSD support for Broadcom SoftMAC Wi-Fi adapters is provided by two partially overlapping PCI/CardBus drivers:</li>
<li>Legacy Wi-Fi adapters are supported by bwi(4). This driver remains in-tree to support devices incompatible with v4 or later firmware (e.g. BCM4301, BCM4302, BCM4306 rev 1-2), all of which were released prior to December 2002.</li>
<li>Modern Wi-Fi adapters are supported by bwn(4), with access to on-chip cores mediated by bhnd(4).</li>
</ul></li>
</ul>

<blockquote>
<p>Prior to my work porting bwn(4) to bhnd(4), access to on-chip cores was mediated by siba_bwn, a PCI/WiFi-specific derivative of the legacy siba(4) SSB bus driver. There were two major limitations to siba_bwn that have long blocked adding support for newer SoftMAC Wi-Fi chipsets: the newer BCMA interconnect found in post-2009 hardware was not supported by siba(4), and siba_bwn assumed a PCI/PCIe bridge, preventing its use on FreeBSD/MIPS Broadcom SoCs with interconnect-attached D11 cores.</p>
</blockquote>

<ul>
<li>The new bhnd(4) driver family, written as a replacement for siba(4) and siba_bwn, provides:</li>
<li>A unified bus driver interface for both SSB and BCMA on-chip interconnects</li>
<li>A generic BHND bridge driver framework for host-connected BHND devices (e.g. Wi-Fi adapters, etc)</li>
<li>A PCI/PCIe bridge core driver, for PCI-attached BHND devices.</li>
<li>An abstract BHND NVRAM API, with support for the varied NVRAM formats found in BHND Wi-Fi adapters and SoCs.</li>
<li>Drivers for common BHND platform peripherals (UARTs, SPROM/flash, PMUs, etc)</li>
</ul>

<blockquote>
<p>By porting bwn(4) to bhnd(4), we are now able to support existing BCMA devices with MAC/PHY/Radio combinations readily supported by bwn(4), as was the case with the BCM43224 and BCM43225 chipsets. This also opens the door to porting additional PHY support from Broadcom’s ISC-licensed Linux drivers, and will allow us to bring up bwn(4) on Broadcom WiSoCs supported by FreeBSD/MIPS.</p>
</blockquote>

<hr>

<h3><a href="https://www.tumfatig.net/20180129/monitor-opensmtpd-using-logstash-grafana/" rel="nofollow">Monitor OpenSMTPD using Logstash and Grafana</a></h3>

<blockquote>
<p>Logs are usefull. Graphs are sexy. Here’s a way to get a view on what happens to your OpenSMTPD traffic, using Web v2.0 tools ; namely Logstash &amp; Grafana.<br>
For those who would not be aware of those tools, logstash is some kind of log-parser that can eat syslog formatted logs and write them into elasticsearch ; in “document” format. Grafana is a Web frontend that can dig into various databases and render graphics from requests.<br>
I won’t go into the whole “how to install” process here. Installation is quite straight forward and online documentation is quite clear.</p>
</blockquote>

<ul>
<li>What you need</li>
</ul>

<blockquote>
<p>OpenSMTPD deals with emails and logs its activity via Syslog.<br>
Syslog is configured to send the logs to Logstash.<br>
Logstash has a set of rules configured to transform the text-oriented information into searchable document-oriented data. The transformed data is stored into Elasticsearch.<br>
Elasticsearch provides Web API to search and find stuff.<br>
Grafana connects to ELS to get data and draw the graphs.</p>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.meetup.com/CharmBUG/events/247995596/" rel="nofollow">CharmBUG Presentation - Writing FreeBSD Malware</a></li>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-February/014180.html" rel="nofollow">March London *BSD meeting 13/03/18</a></li>
<li><a href="https://wiki.freebsd.org/MateuszPiotrowski/Ports/Workshop" rel="nofollow">FreBSD Ports Workshop</a></li>
<li><a href="https://speakerdeck.com/tsutsui/osc2018osaka" rel="nofollow">The history of NetBSD/atari and support for ATARI compatible Milan / OSC2018Osaka</a></li>
<li><a href="https://www.tiltedwindmillpress.com/?product=ssh-mastery-2nd-edition" rel="nofollow">SSH Mastery, 2nd Edition</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Stephen - <a href="http://dpaste.com/06WTRB9#wrap" rel="nofollow">Viewer Interview Question</a></li>
<li>pb - <a href="http://dpaste.com/0TZV6CM#wrap" rel="nofollow">trust expanding your 280TB pool</a></li>
<li>Tim - <a href="http://dpaste.com/0759X1E#wrap" rel="nofollow">ZFS questions for the ZFS Man</a></li>
<li>Daniel - <a href="http://dpaste.com/1SJXSBQ#wrap" rel="nofollow">ZFS full backup question</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>233: High on ZFS</title>
  <link>https://www.bsdnow.tv/233</link>
  <guid isPermaLink="false">5647e1f4-9a10-426a-bb98-165793302cb3</guid>
  <pubDate>Wed, 14 Feb 2018 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5647e1f4-9a10-426a-bb98-165793302cb3.mp3" length="79804372" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We explain the physics behind ZFS, DTrace switching to the GPL, Emacs debugging, syncookies coming to PF &amp; FreeBSD’s history on EC2.</itunes:subtitle>
  <itunes:duration>1:50:50</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We explain the physics behind ZFS, DTrace switching to the GPL, Emacs debugging, syncookies coming to PF &amp;amp; FreeBSD’s history on EC2.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
128 bit storage: Are you high? (https://blogs.oracle.com/bonwick/128-bit-storage:-are-you-high)
For people who have heard about ZFS boiling oceans and wonder where that is coming from, we dug out this old piece from 2004 on the blog of ZFS co-creator Jeff Bonwick, originally from the Sun website.
64 bits would have been plenty ... but then you can't talk out of your ass about boiling oceans then, can you?
Well, it's a fair question. Why did we make ZFS a 128-bit storage system? What on earth made us think it's necessary? And how do we know it's sufficient? Let's start with the easy one: how do we know it's necessary?
 Some customers already have datasets on the order of a petabyte, or 2^50 bytes. Thus the 64-bit capacity limit of 2^64 bytes is only 14 doublings away. Moore's Law for storage predicts that capacity will continue to double every 9-12 months, which means we'll start to hit the 64-bit limit in about a decade. Storage systems tend to live for several decades, so it would be foolish to create a new one without anticipating the needs that will surely arise within its projected lifetime.
If 64 bits isn't enough, the next logical step is 128 bits. That's enough to survive Moore's Law until I'm dead, and after that, it's not my problem. But it does raise the question: what are the theoretical limits to storage capacity?
Although we'd all like Moore's Law to continue forever, quantum mechanics imposes some fundamental limits on the computation rate and information capacity of any physical device. In particular, it has been shown that 1 kilogram of matter confined to 1 liter of space can perform at most 10^51 operations per second on at most 10^31 bits of information [see Seth Lloyd, "Ultimate physical limits to computation." Nature 406, 1047-1054 (2000)]. A fully-populated 128-bit storage pool would contain 2^128 blocks = 2^137 bytes = 2^140 bits; therefore the minimum mass required to hold the bits would be (2^140 bits) / (10^31 bits/kg) = 136 billion kg.
That's a lot of gear.
To operate at the 1031 bits/kg limit, however, the entire mass of the computer must be in the form of pure energy. By E=mc^2, the rest energy of 136 billion kg is 1.2x1028 J. The mass of the oceans is about 1.4x1021 kg. It takes about 4,000 J to raise the temperature of 1 kg of water by 1 degree Celcius, and thus about 400,000 J to heat 1 kg of water from freezing to boiling.
The latent heat of vaporization adds another 2 million J/kg.
Thus the energy required to boil the oceans is about 2.4x106 J/kg * 1.4x1021 kg = 
3.4x1027 J. Thus, fully populating a 128-bit storage pool would, literally, require more energy than boiling the oceans.
Best part of all: you don’t have to understand any of this to use ZFS. Rest assured that you won’t hit any limits with that filesystem for a long time. You still have to buy bigger disks over time, though...
***
dtrace for Linux, Oracle relicenses dtrace (https://gnu.wildebeest.org/blog/mjw/2018/02/14/dtrace-for-linux-oracle-does-the-right-thing/)
At Fosdem we had a talk on dtrace for linux in the Debugging Tools devroom.
Not explicitly mentioned in that talk, but certainly the most exciting thing, is that Oracle is doing a proper linux kernel port:
```
 commit e1744f50ee9bc1978d41db7cc93bcf30687853e6
 Author: Tomas Jedlicka tomas.jedlicka@oracle.com
 Date: Tue Aug 1 09:15:44 2017 -0400
 dtrace: Integrate DTrace Modules into kernel proper
 This changeset integrates DTrace module sources into the main kernel
 source tree under the GPLv2 license. Sources have been moved to
 appropriate locations in the kernel tree.
 ```
That is right, dtrace dropped the CDDL and switched to the GPL!
The user space code dtrace-utils and libdtrace-ctf (a combination of GPLv2 and UPL) can be found on the DTrace Project Source Control page. The NEWS file mentions the license switch (and that it is build upon elfutils, which I personally was pleased to find out).
The kernel sources (GPLv2+ for the core kernel and UPL for the uapi) are slightly harder to find because they are inside the uek kernel source tree, but following the above commit you can easily get at the whole linux kernel dtrace directory.
The UPL is the Universal Permissive License, which according to the FSF is a lax, non-copyleft license that is compatible with the GNU GPL.
Thank you Oracle for making everyone’s life easier by waving your magic relicensing wand!
Now there is lots of hard work to do to actually properly integrate this. And I am sure there are a lot of technical hurdles when trying to get this upstreamed into the mainline kernel. But that is just hard work. Which we can now start collaborating on in earnest.
Like systemtap and the Dynamic Probes (dprobes) before it, dtrace is a whole system observability tool combining tracing, profiling and probing/debugging techniques. Something the upstream linux kernel hackers don’t always appreciate when presented as one large system. They prefer having separate small tweaks for tracing, profiling and probing which are mostly separate from each other. It took years for the various hooks, kprobes, uprobes, markers, etc. from systemtap (and other systems) to get upstream. But these days they are. And there is now even a byte code interpreter (eBPF) in the mainline kernel as originally envisioned by dprobes, which systemtap can now target through stapbpf. So with all those techniques now available in the linux kernel it will be exciting to see if dtrace for linux can unite them all.
Debugging Emacs or: How I Learned to Stop Worrying and Love DTrace (http://nullprogram.com/blog/2018/01/17/)
For some time Elfeed was experiencing a strange, spurious failure. Every so often users were seeing an error (spoiler warning) when updating feeds: “error in process sentinel: Search failed.” If you use Elfeed, you might have even seen this yourself. From the surface it appeared that curl, tasked with the responsibility for downloading feed data, was producing incomplete output despite reporting a successful run. Since the run was successful, Elfeed assumed certain data was in curl’s output buffer, but, since it wasn’t, it failed hard.
Unfortunately this issue was not reproducible. Manually running curl outside of Emacs never revealed any issues. Asking Elfeed to retry fetching the feeds would work fine. The issue would only randomly rear its head when Elfeed was fetching many feeds in parallel, under stress. By the time the error was discovered, the curl process had exited and vital debugging information was lost. Considering that this was likely to be a bug in Emacs itself, there really wasn’t a reliable way to capture the necessary debugging information from within Emacs Lisp. And, indeed, this later proved to be the case.
A quick-and-dirty work around is to use condition-case to catch and swallow the error. When the bizarre issue shows up, rather than fail badly in front of the user, Elfeed could attempt to swallow the error — assuming it can be reliably detected — and treat the fetch as simply a failure. That didn’t sit comfortably with me. Elfeed had done its due diligence checking for errors already. Someone was lying to Elfeed, and I intended to catch them with their pants on fire. Someday.
I’d just need to witness the bug on one of my own machines. Elfeed is part of my daily routine, so surely I’d have to experience this issue myself someday. My plan was, should that day come, to run a modified Elfeed, instrumented to capture extra data. I would have also routinely run Emacs under GDB so that I could inspect the failure more deeply.
For now I just had to wait to hunt that zebra.
Bryan Cantrill, DTrace, and FreeBSD
Over the holidays I re-discovered Bryan Cantrill, a systems software engineer who worked for Sun between 1996 and 2010, and is most well known for DTrace. My first exposure to him was in a BSD Now interview in 2015. I had re-watched that interview and decided there was a lot more I had to learn from him. He’s become a personal hero to me. So I scoured the internet for more of his writing and talks.
Some interesting operating system technology came out of Sun during its final 15 or so years — most notably DTrace and ZFS — and Bryan speaks about it passionately. Almost as a matter of luck, most of it survived the Oracle acquisition thanks to Sun releasing it as open source in just the nick of time. Otherwise it would have been lost forever. The scattered ex-Sun employees, still passionate about their prior work at Sun, along with some of their old customers have since picked up the pieces and kept going as a community under the name illumos. It’s like an open source flotilla.
Naturally I wanted to get my hands on this stuff to try it out for myself. Is it really as good as they say? Normally I stick to Linux, but it (generally) doesn’t have these Sun technologies available. The main reason is license incompatibility. Sun released its code under the CDDL, which is incompatible with the GPL. Ubuntu does infamously include ZFS, but other distributions are unwilling to take that risk. Porting DTrace is a serious undertaking since it’s got its fingers throughout the kernel, which also makes the licensing issues even more complicated.
Linux has a reputation for Not Invented Here (NIH) syndrome, and these licensing issues certainly contribute to that. Rather than adopt ZFS and DTrace, they’ve been reinvented from scratch: btrfs instead of ZFS, and a slew of partial options instead of DTrace. Normally I’m most interested in system call tracing, and my go to is strace, though it certainly has its limitations — including this situation of debugging curl under Emacs. Another famous example of NIH is Linux’s epoll(2), which is a broken version of BSD kqueue(2).
So, if I want to try these for myself, I’ll need to install a different operating system. I’ve dabbled with OmniOS, an OS built on illumos, in virtual machines, using it as an alien environment to test some of my software (e.g. enchive). OmniOS has a philosophy called Keep Your Software To Yourself (KYSTY), which is really just code for “we don’t do packaging.” Honestly, you can’t blame them since they’re a tiny community. The best solution to this is probably pkgsrc, which is essentially a universal packaging system. Otherwise you’re on your own.
There’s also openindiana, which is a more friendly desktop-oriented illumos distribution. Still, the short of it is that you’re very much on your own when things don’t work. The situation is like running Linux a couple decades ago, when it was still difficult to do.
If you’re interested in trying DTrace, the easiest option these days is probably FreeBSD. It’s got a big, active community, thorough documentation, and a huge selection of packages. Its license (the BSD license, duh) is compatible with the CDDL, so both ZFS and DTrace have been ported to FreeBSD.
What is DTrace?
I’ve done all this talking but haven’t yet described what DTrace really is. I won’t pretend to write my own tutorial, but I’ll provide enough information to follow along. DTrace is a tracing framework for debugging production systems in real time, both for the kernel and for applications. The “production systems” part means it’s stable and safe — using DTrace won’t put your system at risk of crashing or damaging data. The “real time” part means it has little impact on performance. You can use DTrace on live, active systems with little impact. Both of these core design principles are vital for troubleshooting those really tricky bugs that only show up in production.
There are DTrace probes scattered all throughout the system: on system calls, scheduler events, networking events, process events, signals, virtual memory events, etc. Using a specialized language called D (unrelated to the general purpose programming language D), you can dynamically add behavior at these instrumentation points. Generally the behavior is to capture information, but it can also manipulate the event being traced.
Each probe is fully identified by a 4-tuple delimited by colons: provider, module, function, and probe name. An empty element denotes a sort of wildcard. For example, syscall::open:entry is a probe at the beginning (i.e. “entry”) of open(2). syscall:::entry matches all system call entry probes.
Unlike strace on Linux which monitors a specific process, DTrace applies to the entire system when active. To run curl under strace from Emacs, I’d have to modify Emacs’ behavior to do so. With DTrace I can instrument every curl process without making a single change to Emacs, and with negligible impact to Emacs. That’s a big deal.
So, when it comes to this Elfeed issue, FreeBSD is much better poised for debugging the problem. All I have to do is catch it in the act. However, it’s been months since that bug report and I’m not really making this connection yet. I’m just hoping I eventually find an interesting problem where I can apply DTrace.
Bryan Cantrill: Talks I have given (http://dtrace.org/blogs/bmc/2018/02/03/talks/)
***
News Roundup
a2k18 Hackathon preview: Syncookies coming to PF (https://undeadly.org/cgi?action=article;sid=20180207090000)
As you may have heard, the a2k18 hackathon is in progress. As can be seen from the commit messages, several items of goodness are being worked on.
One eagerly anticipated item is the arrival of TCP syncookies (read: another important tool in your anti-DDoS toolset) in PF. Henning Brauer (henning@) added the code in a series of commits on February 6th, 2018, with this one containing the explanation:
```
syncookies for pf.
when syncookies are on, pf will blindly answer each and every SYN with a syncookie-SYNACK. Upon reception of the ACK completing the 3WHS, pf will reconstruct the original SYN, shove it through pf_test, where state will be created if the ruleset permits it. Then massage the freshly created state (we won't see the SYNACK), set up the sequence number modulator, and call into the existing synproxy code to start the 3WHS with the backend host.
Add an - somewhat basic for now - adaptive mode where syncookies get enabled if a certain percentage of the state table is filled up with half-open tcp connections. This makes pf firewalls resilient against large synflood attacks.
syncookies are off by default until we gained more experience, considered experimental for now.
see http://bulabula.org/papers/2017/bsdcan/ for more details.
joint work with sashan@, widely discussed and with lots of input by many
```
The first release to have this feature available will probably be the upcoming OpenBSD 6.3 if a sufficient number of people test this in their setups (hint, hint). More info is likely to emerge soon in post-hackathon writeups, so watch this space!
[Pale Moon]
A Perfect example of how not to approach OS developers/packagers
Removed from OpenBSD Ports due to Licensing Issues (https://github.com/jasperla/openbsd-wip/issues/86)
FreeBSD Palemoon branding violation (https://lists.freebsd.org/pipermail/freebsd-ports/2018-February/112455.html)
Mightnight BSD's response (https://twitter.com/midnightbsd/status/961232422091280386)
***
FreeBSD EC2 History (http://www.daemonology.net/blog/2018-02-12-FreeBSD-EC2-history.html)
A couple years ago Jeff Barr published a blog post with a timeline of EC2 instances. I thought at the time that I should write up a timeline of the FreeBSD/EC2 platform, but I didn't get around to it; but last week, as I prepared to ask for sponsorship for my work I decided that it was time to sit down and collect together the long history of how the platform has evolved and improved over the years.
Normally I don't edit blog posts after publishing them (with the exception of occasional typographical corrections), but I do plan on keeping this post up to date with future developments.
August 25, 2006: Amazon EC2 launches. It supports a single version of Ubuntu Linux; FreeBSD is not available.
December 13, 2010: I manage to get FreeBSD running on EC2 t1.micro instances.
March 22, 2011: I manage to get FreeBSD running on EC2 "cluster compute" instances.
July 8, 2011: I get FreeBSD 8.2 running on all 64-bit EC2 instance types, by marking it as "Windows" in order to get access to Xen/HVM virtualization. (Unfortunately this meant that users had to pay the higher "Windows" hourly pricing.)
January 16, 2012: I get FreeBSD 9.0 running on 32-bit EC2 instances via the same "defenestration" trick. (Again, paying the "Windows" prices.)
August 16, 2012: I move the FreeBSD rc.d scripts which handle "EC2" functionality (e.g., logging SSH host keys to the console) into the FreeBSD ports tree.
October 7, 2012: I rework the build process for FreeBSD 9.1-RC1 and later to use "world" bits extracted from the release ISOs; only the kernel is custom-built. Also, the default SSH user changes from "root" to "ec2-user".
October 31, 2012: Amazon launches the "M3" family of instances, which support Xen/HVM without FreeBSD needing to pay the "Windows" tax.
November 21, 2012: I get FreeBSD added to the AWS Marketplace.
October 2, 2013: I finish merging kernel patches into the FreeBSD base system, and rework the AMI build (again) so that FreeBSD 10.0-ALPHA4 and later use bits extracted from the release ISOs for the entire system (world + kernel). FreeBSD Update can now be used for updating everything (because now FreeBSD/EC2 uses a GENERIC kernel).
October 27, 2013: I add code to EC2 images so that FreeBSD 10.0-BETA2 and later AMIs will run FreeBSD Update when they first boot in order to download and install any critical updates.
December 1, 2013: I add code to EC2 images so that FreeBSD 10.0-BETA4 and later AMIs bootstrap the pkg tool and install packages at boot time (by default, the "awscli" package).
December 9, 2013: I add configinit to FreeBSD 10.0-RC1 and later to allow systems to be easily configured via EC2 user-data.
July 1, 2014: Amazon launches the "T2" family of instances; now the most modern family for every type of EC2 instance (regular, high-memory, high-CPU, high-I/O, burstable) supports HVM and there should no longer be any need for FreeBSD users to pay the "Windows tax".
November 24, 2014: I add code to FreeBSD 10.2 and later to automatically resize their root filesystems when they first boot; this means that a larger root disk can be specified at instance launch time and everything will work as expected.
April 1, 2015: I integrate the FreeBSD/EC2 build process into the FreeBSD release building process; FreeBSD 10.2-BETA1 and later AMIs are built by the FreeBSD release engineering team.
January 12, 2016: I enable Intel 82599-based "first generation EC2 Enhanced Networking" in FreeBSD 11.0 and later.
June 9, 2016: I enable the new EC2 VGA console functionality in FreeBSD 11.0 and later. (The old serial console also continues to work.)
June 24, 2016: Intel 82599-based Enhanced Networking works reliably in FreeBSD 11.0 and later thanks to discovering and working around a Xen bug.
June 29, 2016: I improve throughput on Xen blkfront devices (/dev/xbd*) by enabling indirect segment I/Os in FreeBSD 10.4 and later. (I wrote this functionality in July 2015, but left it disabled by default a first because a bug in EC2 caused it to hurt performance on some instances.)
July 7, 2016: I fix a bug in FreeBSD's virtual memory initialization in order to allow it to support boot with 128 CPUs; aka. FreeBSD 11.0 and later support the EC2 x1.32xlarge instance type.
January 26, 2017: I change the default configuration in FreeBSD 11.1 and later to support EC2's IPv6 networking setup out of the box (once you flip all of the necessary switches to enable IPv6 in EC2 itself).
May 20, 2017: In collaboration with Rick Macklem, I make FreeBSD 11.1 and later compatible with the Amazon "Elastic File System" (aka. NFSv4-as-a-service) via the newly added "oneopenown" mount option (and lots of bug fixes).
May 25, 2017: I enable support for the Amazon "Elastic Network Adapter" in FreeBSD 11.1 and later. (The vast majority of the work — porting the driver code — was done by Semihalf with sponsorship from Amazon.)
December 5, 2017: I change the default configuration in FreeBSD 11.2 and later to make use of the Amazon Time Sync Service (aka. NTP-as-a-service).
The current status
The upcoming FreeBSD release (11.2) supports: IPv6, Enhanced Networking (both generations), Amazon Elastic File System, Amazon Time Sync Service, both consoles (Serial VGA), and every EC2 instance type (although I'm not sure if FreeBSD has drivers to make use of the FPGA or GPU hardware on those instances).
Colin's Patreon' page if you'd like to support him (https://www.patreon.com/cperciva)
X network transparency
X's network transparency has wound up mostly being a failure (https://utcc.utoronto.ca/~cks/space/blog/unix/XNetworkTransparencyFailure)
I was recently reading Mark Dominus's entry about some X keyboard problems, in which he said in passing (quoting himself):
I have been wondering for years if X's vaunted network transparency was as big a failure as it seemed: an interesting idea, worth trying out, but one that eventually turned out to be more trouble than it was worth. [...]
My first reaction was to bristle, because I use X's network transparency all of the time at work. I have several programs to make it work very smoothly, and some core portions of my environment would be basically impossible without it. But there's a big qualification on my use of X's network transparency, namely that it's essentially all for text. When I occasionally go outside of this all-text environment of xterms and emacs and so on, it doesn't go as well.
X's network transparency was not designed as 'it will run xterm well'; originally it was to be something that should let you run almost everything remotely, providing a full environment. Even apart from the practical issues covered in Daniel Stone's slide presentation, it's clear that it's been years since X could deliver a real first class environment over the network. You cannot operate with X over the network in the same way that you do locally. Trying to do so is painful and involves many things that either don't work at all or perform so badly that you don't want to use them.
In my view, there are two things that did in general X network transparency. The first is that networks turned out to not be fast enough even for ordinary things that people wanted to do, at least not the way that X used them. The obvious case is web browsers; once the web moved to lots of images and worse, video, that was pretty much it, especially with 24-bit colour.
(It's obviously not impossible to deliver video across the network with good performance, since YouTube and everyone else does it. But their video is highly encoded in specialized formats, not handled by any sort of general 'send successive images to the display' system.)
The second is that the communication facilities that X provided were too narrow and limited. This forced people to go outside of them in order to do all sorts of things, starting with audio and moving on to things like DBus and other ways of coordinating environments, handling sophisticated configuration systems, modern fonts, and so on. When people designed these additional communication protocols, the result generally wasn't something that could be used over the network (especially not without a bunch of setup work that you had to do in addition to remote X). Basic X clients that use X properties for everything may be genuinely network transparent, but there are very few of those left these days. (Not even xterm is any more, at least if you use XFT fonts. XFT fonts are rendered in the client, and so different hosts may have different renderings of the same thing, cf.)
&amp;lt; What remains of X's network transparency is still useful to some of us, but it's only a shadow of what the original design aimed for. I don't think it was a mistake for X to specifically design it in (to the extent that they did, which is less than you might think), and it did help X out pragmatically in the days of X terminals, but that's mostly it.
(I continue to think that remote display protocols are useful in general, but I'm in an usual situation. Most people only ever interact with remote machines with either text mode SSH or a browser talking to a web server on the remote machine.)
PS: The X protocol issues with synchronous requests that Daniel Stone talks about don't help the situation, but I think that even with those edges sanded off X's network transparency wouldn't be a success. Arguably X's protocol model committed a lesser version of part of the NeWS mistake.
X's network transparency was basically free at the time (https://utcc.utoronto.ca/~cks/space/blog/unix/XFreeNetworkTransparency)
I recently wrote an entry about how X's network transparency has wound up mostly being a failure for various reasons. However, there is an important flipside to the story of X's network transparency, and that is that X's network transparency was almost free at the time and in the context it was created. Unlike the situation today, in the beginning X did not have to give up lots of performance or other things in order to get network transparency.
X originated in the mid 1980s and it was explicitly created to be portable across various Unixes, especially BSD-derived ones (because those were what universities were mostly using at that time). In the mid to late 1980s, Unix had very few IPC methods, especially portable ones. In particular, BSD systems did not have shared memory (it was called 'System V IPC' for the obvious reasons). BSD had TCP and Unix sockets, some System V machines had TCP (and you could likely assume that more would get it), and in general your safest bet was to assume some sort of abstract stream protocol and then allow for switchable concrete backends. Unsurprisingly, this is exactly what X did; the core protocol is defined as a bidirectional stream of bytes over an abstracted channel. (And the concrete implementation of $DISPLAY has always let you specify the transport mechanism, as well as allowing your local system to pick the best mechanism it has.)
Once you've decided that your protocol has to run over abstracted streams, it's not that much more work to make it network transparent (TCP provides streams, after all). X could have refused to make the byte order of the stream clear or required the server and the client to have access to some shared files (eg for fonts), but I don't think either would have been a particularly big win. I'm sure that it took some extra effort and care to make X work across TCP from a different machine, but I don't think it took very much. (At the same time, my explanation here is probably a bit ahistorical. X's initial development seems relatively strongly tied to sometimes having clients on different machines than the display, which is not unreasonable for the era. But it doesn't hurt to get a feature that you want anyway for a low cost.)
I believe it's important here that X was intended to be portable across different Unixes. If you don't care about portability and can get changes made to your Unix, you can do better (for example, you can add some sort of shared memory or process to process virtual memory transfer). I'm not sure how the 1980s versions of SunView worked, but I believe they were very SunOS dependent. Wikipedia says SunView was partly implemented in the kernel, which is certainly one way to both share memory and speed things up.
PS: Sharing memory through mmap() and friends was years in the future at this point and required significant changes when it arrived.
Beastie Bits
Grace Hopper Celebration 2018 Call for Participation (https://www.freebsdfoundation.org/news-and-events/call-for-papers/grace-hopper-celebration-2018-call-for-participation/)
Google Summer of Code: Call for Project Ideas (https://www.freebsdfoundation.org/blog/google-summer-of-code-call-for-project-ideas/)
The OpenBSD Foundation 2018 Fundraising Campaign (https://undeadly.org/cgi?action=article;sid=20180129190641)
SSH Mastery 2/e out (https://blather.michaelwlucas.com/archives/3115)
AsiaBSDcon 2018 Registration is open (https://2018.asiabsdcon.org/)
Tarsnap support for Bitcoin ending April 1st; and a Chrome bug (http://mail.tarsnap.com/tarsnap-announce/msg00042.html)
Feedback/Questions
Todd - Couple Questions (http://dpaste.com/195HGHY#wrap)
Seth - Tar Snap (http://dpaste.com/1N7NQVQ#wrap)
Alex - sudo question (http://dpaste.com/3D9P1DW#wrap)
Thomas - FreeBSD on ARM? (http://dpaste.com/24NMG47#wrap)
Albert - Austria BSD User Group (http://dpaste.com/373CRX7#wrap)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We explain the physics behind ZFS, DTrace switching to the GPL, Emacs debugging, syncookies coming to PF &amp; FreeBSD’s history on EC2.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blogs.oracle.com/bonwick/128-bit-storage:-are-you-high" rel="nofollow">128 bit storage: Are you high?</a></h3>

<ul>
<li>For people who have heard about ZFS boiling oceans and wonder where that is coming from, we dug out this old piece from 2004 on the blog of ZFS co-creator Jeff Bonwick, originally from the Sun website.</li>
</ul>

<blockquote>
<p>64 bits would have been plenty ... but then you can&#39;t talk out of your ass about boiling oceans then, can you?<br>
Well, it&#39;s a fair question. Why did we make ZFS a 128-bit storage system? What on earth made us think it&#39;s necessary? And how do we know it&#39;s sufficient? Let&#39;s start with the easy one: how do we know it&#39;s necessary?<br>
 Some customers already have datasets on the order of a petabyte, or 2<sup>50</sup> bytes. Thus the 64-bit capacity limit of 2<sup>64</sup> bytes is only 14 doublings away. Moore&#39;s Law for storage predicts that capacity will continue to double every 9-12 months, which means we&#39;ll start to hit the 64-bit limit in about a decade. Storage systems tend to live for several decades, so it would be foolish to create a new one without anticipating the needs that will surely arise within its projected lifetime.<br>
If 64 bits isn&#39;t enough, the next logical step is 128 bits. That&#39;s enough to survive Moore&#39;s Law until I&#39;m dead, and after that, it&#39;s not my problem. But it does raise the question: what are the theoretical limits to storage capacity?<br>
Although we&#39;d all like Moore&#39;s Law to continue forever, quantum mechanics imposes some fundamental limits on the computation rate and information capacity of any physical device. In particular, it has been shown that 1 kilogram of matter confined to 1 liter of space can perform at most 10<sup>51</sup> operations per second on at most 10<sup>31</sup> bits of information [see Seth Lloyd, &quot;Ultimate physical limits to computation.&quot; Nature 406, 1047-1054 (2000)]. A fully-populated 128-bit storage pool would contain 2<sup>128</sup> blocks = 2<sup>137</sup> bytes = 2<sup>140</sup> bits; therefore the minimum mass required to hold the bits would be (2<sup>140</sup> bits) / (10<sup>31</sup> bits/kg) = 136 billion kg.<br>
That&#39;s a lot of gear.<br>
To operate at the 1031 bits/kg limit, however, the entire mass of the computer must be in the form of pure energy. By E=mc<sup>2,</sup> the rest energy of 136 billion kg is 1.2x1028 J. The mass of the oceans is about 1.4x1021 kg. It takes about 4,000 J to raise the temperature of 1 kg of water by 1 degree Celcius, and thus about 400,000 J to heat 1 kg of water from freezing to boiling.<br>
The latent heat of vaporization adds another 2 million J/kg.<br>
Thus the energy required to boil the oceans is about 2.4x106 J/kg * 1.4x1021 kg = <br>
3.4x1027 J. Thus, fully populating a 128-bit storage pool would, literally, require more energy than boiling the oceans.</p>
</blockquote>

<ul>
<li>Best part of all: you don’t have to understand any of this to use ZFS. Rest assured that you won’t hit any limits with that filesystem for a long time. You still have to buy bigger disks over time, though...
***</li>
</ul>

<h3><a href="https://gnu.wildebeest.org/blog/mjw/2018/02/14/dtrace-for-linux-oracle-does-the-right-thing/" rel="nofollow">dtrace for Linux, Oracle relicenses dtrace</a></h3>

<blockquote>
<p>At Fosdem we had a talk on dtrace for linux in the Debugging Tools devroom.</p>

<p>Not explicitly mentioned in that talk, but certainly the most exciting thing, is that Oracle is doing a proper linux kernel port:</p>
</blockquote>

<pre><code> commit e1744f50ee9bc1978d41db7cc93bcf30687853e6
 Author: Tomas Jedlicka &lt;tomas.jedlicka@oracle.com&gt;
 Date: Tue Aug 1 09:15:44 2017 -0400

 dtrace: Integrate DTrace Modules into kernel proper

 This changeset integrates DTrace module sources into the main kernel
 source tree under the GPLv2 license. Sources have been moved to
 appropriate locations in the kernel tree.
</code></pre>

<blockquote>
<p>That is right, dtrace dropped the CDDL and switched to the GPL!</p>

<p>The user space code dtrace-utils and libdtrace-ctf (a combination of GPLv2 and UPL) can be found on the DTrace Project Source Control page. The NEWS file mentions the license switch (and that it is build upon elfutils, which I personally was pleased to find out).</p>

<p>The kernel sources (GPLv2+ for the core kernel and UPL for the uapi) are slightly harder to find because they are inside the uek kernel source tree, but following the above commit you can easily get at the whole linux kernel dtrace directory.</p>

<p>The UPL is the Universal Permissive License, which according to the FSF is a lax, non-copyleft license that is compatible with the GNU GPL.</p>

<p>Thank you Oracle for making everyone’s life easier by waving your magic relicensing wand!</p>

<p>Now there is lots of hard work to do to actually properly integrate this. And I am sure there are a lot of technical hurdles when trying to get this upstreamed into the mainline kernel. But that is just hard work. Which we can now start collaborating on in earnest.</p>

<p>Like systemtap and the Dynamic Probes (dprobes) before it, dtrace is a whole system observability tool combining tracing, profiling and probing/debugging techniques. Something the upstream linux kernel hackers don’t always appreciate when presented as one large system. They prefer having separate small tweaks for tracing, profiling and probing which are mostly separate from each other. It took years for the various hooks, kprobes, uprobes, markers, etc. from systemtap (and other systems) to get upstream. But these days they are. And there is now even a byte code interpreter (eBPF) in the mainline kernel as originally envisioned by dprobes, which systemtap can now target through stapbpf. So with all those techniques now available in the linux kernel it will be exciting to see if dtrace for linux can unite them all.</p>
</blockquote>

<hr>

<h3><a href="http://nullprogram.com/blog/2018/01/17/" rel="nofollow">Debugging Emacs or: How I Learned to Stop Worrying and Love DTrace</a></h3>

<blockquote>
<p>For some time Elfeed was experiencing a strange, spurious failure. Every so often users were seeing an error (spoiler warning) when updating feeds: “error in process sentinel: Search failed.” If you use Elfeed, you might have even seen this yourself. From the surface it appeared that curl, tasked with the responsibility for downloading feed data, was producing incomplete output despite reporting a successful run. Since the run was successful, Elfeed assumed certain data was in curl’s output buffer, but, since it wasn’t, it failed hard.</p>

<p>Unfortunately this issue was not reproducible. Manually running curl outside of Emacs never revealed any issues. Asking Elfeed to retry fetching the feeds would work fine. The issue would only randomly rear its head when Elfeed was fetching many feeds in parallel, under stress. By the time the error was discovered, the curl process had exited and vital debugging information was lost. Considering that this was likely to be a bug in Emacs itself, there really wasn’t a reliable way to capture the necessary debugging information from within Emacs Lisp. And, indeed, this later proved to be the case.</p>

<p>A quick-and-dirty work around is to use condition-case to catch and swallow the error. When the bizarre issue shows up, rather than fail badly in front of the user, Elfeed could attempt to swallow the error — assuming it can be reliably detected — and treat the fetch as simply a failure. That didn’t sit comfortably with me. Elfeed had done its due diligence checking for errors already. Someone was lying to Elfeed, and I intended to catch them with their pants on fire. Someday.</p>

<p>I’d just need to witness the bug on one of my own machines. Elfeed is part of my daily routine, so surely I’d have to experience this issue myself someday. My plan was, should that day come, to run a modified Elfeed, instrumented to capture extra data. I would have also routinely run Emacs under GDB so that I could inspect the failure more deeply.</p>

<p>For now I just had to wait to hunt that zebra.</p>
</blockquote>

<ul>
<li>Bryan Cantrill, DTrace, and FreeBSD</li>
</ul>

<blockquote>
<p>Over the holidays I re-discovered Bryan Cantrill, a systems software engineer who worked for Sun between 1996 and 2010, and is most well known for DTrace. My first exposure to him was in a BSD Now interview in 2015. I had re-watched that interview and decided there was a lot more I had to learn from him. He’s become a personal hero to me. So I scoured the internet for more of his writing and talks.</p>

<p>Some interesting operating system technology came out of Sun during its final 15 or so years — most notably DTrace and ZFS — and Bryan speaks about it passionately. Almost as a matter of luck, most of it survived the Oracle acquisition thanks to Sun releasing it as open source in just the nick of time. Otherwise it would have been lost forever. The scattered ex-Sun employees, still passionate about their prior work at Sun, along with some of their old customers have since picked up the pieces and kept going as a community under the name illumos. It’s like an open source flotilla.</p>

<p>Naturally I wanted to get my hands on this stuff to try it out for myself. Is it really as good as they say? Normally I stick to Linux, but it (generally) doesn’t have these Sun technologies available. The main reason is license incompatibility. Sun released its code under the CDDL, which is incompatible with the GPL. Ubuntu does infamously include ZFS, but other distributions are unwilling to take that risk. Porting DTrace is a serious undertaking since it’s got its fingers throughout the kernel, which also makes the licensing issues even more complicated.</p>

<p>Linux has a reputation for Not Invented Here (NIH) syndrome, and these licensing issues certainly contribute to that. Rather than adopt ZFS and DTrace, they’ve been reinvented from scratch: btrfs instead of ZFS, and a slew of partial options instead of DTrace. Normally I’m most interested in system call tracing, and my go to is strace, though it certainly has its limitations — including this situation of debugging curl under Emacs. Another famous example of NIH is Linux’s epoll(2), which is a broken version of BSD kqueue(2).</p>

<p>So, if I want to try these for myself, I’ll need to install a different operating system. I’ve dabbled with OmniOS, an OS built on illumos, in virtual machines, using it as an alien environment to test some of my software (e.g. enchive). OmniOS has a philosophy called Keep Your Software To Yourself (KYSTY), which is really just code for “we don’t do packaging.” Honestly, you can’t blame them since they’re a tiny community. The best solution to this is probably pkgsrc, which is essentially a universal packaging system. Otherwise you’re on your own.</p>

<p>There’s also openindiana, which is a more friendly desktop-oriented illumos distribution. Still, the short of it is that you’re very much on your own when things don’t work. The situation is like running Linux a couple decades ago, when it was still difficult to do.</p>

<p>If you’re interested in trying DTrace, the easiest option these days is probably FreeBSD. It’s got a big, active community, thorough documentation, and a huge selection of packages. Its license (the BSD license, duh) is compatible with the CDDL, so both ZFS and DTrace have been ported to FreeBSD.</p>
</blockquote>

<ul>
<li>What is DTrace?</li>
</ul>

<blockquote>
<p>I’ve done all this talking but haven’t yet described what DTrace really is. I won’t pretend to write my own tutorial, but I’ll provide enough information to follow along. DTrace is a tracing framework for debugging production systems in real time, both for the kernel and for applications. The “production systems” part means it’s stable and safe — using DTrace won’t put your system at risk of crashing or damaging data. The “real time” part means it has little impact on performance. You can use DTrace on live, active systems with little impact. Both of these core design principles are vital for troubleshooting those really tricky bugs that only show up in production.</p>

<p>There are DTrace probes scattered all throughout the system: on system calls, scheduler events, networking events, process events, signals, virtual memory events, etc. Using a specialized language called D (unrelated to the general purpose programming language D), you can dynamically add behavior at these instrumentation points. Generally the behavior is to capture information, but it can also manipulate the event being traced.</p>

<p>Each probe is fully identified by a 4-tuple delimited by colons: provider, module, function, and probe name. An empty element denotes a sort of wildcard. For example, syscall::open:entry is a probe at the beginning (i.e. “entry”) of open(2). syscall:::entry matches all system call entry probes.</p>

<p>Unlike strace on Linux which monitors a specific process, DTrace applies to the entire system when active. To run curl under strace from Emacs, I’d have to modify Emacs’ behavior to do so. With DTrace I can instrument every curl process without making a single change to Emacs, and with negligible impact to Emacs. That’s a big deal.</p>

<p>So, when it comes to this Elfeed issue, FreeBSD is much better poised for debugging the problem. All I have to do is catch it in the act. However, it’s been months since that bug report and I’m not really making this connection yet. I’m just hoping I eventually find an interesting problem where I can apply DTrace.</p>
</blockquote>

<ul>
<li><a href="http://dtrace.org/blogs/bmc/2018/02/03/talks/" rel="nofollow">Bryan Cantrill: Talks I have given</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180207090000" rel="nofollow">a2k18 Hackathon preview: Syncookies coming to PF</a></h3>

<blockquote>
<p>As you may have heard, the a2k18 hackathon is in progress. As can be seen from the commit messages, several items of goodness are being worked on.<br>
One eagerly anticipated item is the arrival of TCP syncookies (read: another important tool in your anti-DDoS toolset) in PF. Henning Brauer (henning@) added the code in a series of commits on February 6th, 2018, with this one containing the explanation:</p>
</blockquote>

<pre><code>syncookies for pf.

when syncookies are on, pf will blindly answer each and every SYN with a syncookie-SYNACK. Upon reception of the ACK completing the 3WHS, pf will reconstruct the original SYN, shove it through pf_test, where state will be created if the ruleset permits it. Then massage the freshly created state (we won&#39;t see the SYNACK), set up the sequence number modulator, and call into the existing synproxy code to start the 3WHS with the backend host.

Add an - somewhat basic for now - adaptive mode where syncookies get enabled if a certain percentage of the state table is filled up with half-open tcp connections. This makes pf firewalls resilient against large synflood attacks.

syncookies are off by default until we gained more experience, considered experimental for now.

see http://bulabula.org/papers/2017/bsdcan/ for more details.

joint work with sashan@, widely discussed and with lots of input by many
</code></pre>

<blockquote>
<p>The first release to have this feature available will probably be the upcoming OpenBSD 6.3 if a sufficient number of people test this in their setups (hint, hint). More info is likely to emerge soon in post-hackathon writeups, so watch this space!</p>
</blockquote>

<hr>

<h3>[Pale Moon]</h3>

<ul>
<li>A Perfect example of how not to approach OS developers/packagers</li>
<li><a href="https://github.com/jasperla/openbsd-wip/issues/86" rel="nofollow">Removed from OpenBSD Ports due to Licensing Issues</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2018-February/112455.html" rel="nofollow">FreeBSD Palemoon branding violation</a></li>
<li><a href="https://twitter.com/midnightbsd/status/961232422091280386" rel="nofollow">Mightnight BSD&#39;s response</a>
***</li>
</ul>

<h3><a href="http://www.daemonology.net/blog/2018-02-12-FreeBSD-EC2-history.html" rel="nofollow">FreeBSD EC2 History</a></h3>

<blockquote>
<p>A couple years ago Jeff Barr published a blog post with a timeline of EC2 instances. I thought at the time that I should write up a timeline of the FreeBSD/EC2 platform, but I didn&#39;t get around to it; but last week, as I prepared to ask for sponsorship for my work I decided that it was time to sit down and collect together the long history of how the platform has evolved and improved over the years.<br>
Normally I don&#39;t edit blog posts after publishing them (with the exception of occasional typographical corrections), but I do plan on keeping this post up to date with future developments.</p>
</blockquote>

<ul>
<li>August 25, 2006: Amazon EC2 launches. It supports a single version of Ubuntu Linux; FreeBSD is not available.</li>
<li>December 13, 2010: I manage to get FreeBSD running on EC2 t1.micro instances.</li>
<li>March 22, 2011: I manage to get FreeBSD running on EC2 &quot;cluster compute&quot; instances.</li>
<li>July 8, 2011: I get FreeBSD 8.2 running on all 64-bit EC2 instance types, by marking it as &quot;Windows&quot; in order to get access to Xen/HVM virtualization. (Unfortunately this meant that users had to pay the higher &quot;Windows&quot; hourly pricing.)</li>
<li>January 16, 2012: I get FreeBSD 9.0 running on 32-bit EC2 instances via the same &quot;defenestration&quot; trick. (Again, paying the &quot;Windows&quot; prices.)</li>
<li>August 16, 2012: I move the FreeBSD rc.d scripts which handle &quot;EC2&quot; functionality (e.g., logging SSH host keys to the console) into the FreeBSD ports tree.</li>
<li>October 7, 2012: I rework the build process for FreeBSD 9.1-RC1 and later to use &quot;world&quot; bits extracted from the release ISOs; only the kernel is custom-built. Also, the default SSH user changes from &quot;root&quot; to &quot;ec2-user&quot;.</li>
<li>October 31, 2012: Amazon launches the &quot;M3&quot; family of instances, which support Xen/HVM without FreeBSD needing to pay the &quot;Windows&quot; tax.</li>
<li>November 21, 2012: I get FreeBSD added to the AWS Marketplace.</li>
<li>October 2, 2013: I finish merging kernel patches into the FreeBSD base system, and rework the AMI build (again) so that FreeBSD 10.0-ALPHA4 and later use bits extracted from the release ISOs for the entire system (world + kernel). FreeBSD Update can now be used for updating everything (because now FreeBSD/EC2 uses a GENERIC kernel).</li>
<li>October 27, 2013: I add code to EC2 images so that FreeBSD 10.0-BETA2 and later AMIs will run FreeBSD Update when they first boot in order to download and install any critical updates.</li>
<li>December 1, 2013: I add code to EC2 images so that FreeBSD 10.0-BETA4 and later AMIs bootstrap the pkg tool and install packages at boot time (by default, the &quot;awscli&quot; package).</li>
<li>December 9, 2013: I add configinit to FreeBSD 10.0-RC1 and later to allow systems to be easily configured via EC2 user-data.</li>
<li>July 1, 2014: Amazon launches the &quot;T2&quot; family of instances; now the most modern family for every type of EC2 instance (regular, high-memory, high-CPU, high-I/O, burstable) supports HVM and there should no longer be any need for FreeBSD users to pay the &quot;Windows tax&quot;.</li>
<li>November 24, 2014: I add code to FreeBSD 10.2 and later to automatically resize their root filesystems when they first boot; this means that a larger root disk can be specified at instance launch time and everything will work as expected.</li>
<li>April 1, 2015: I integrate the FreeBSD/EC2 build process into the FreeBSD release building process; FreeBSD 10.2-BETA1 and later AMIs are built by the FreeBSD release engineering team.</li>
<li>January 12, 2016: I enable Intel 82599-based &quot;first generation EC2 Enhanced Networking&quot; in FreeBSD 11.0 and later.</li>
<li>June 9, 2016: I enable the new EC2 VGA console functionality in FreeBSD 11.0 and later. (The old serial console also continues to work.)</li>
<li>June 24, 2016: Intel 82599-based Enhanced Networking works reliably in FreeBSD 11.0 and later thanks to discovering and working around a Xen bug.</li>
<li>June 29, 2016: I improve throughput on Xen blkfront devices (/dev/xbd*) by enabling indirect segment I/Os in FreeBSD 10.4 and later. (I wrote this functionality in July 2015, but left it disabled by default a first because a bug in EC2 caused it to hurt performance on some instances.)</li>
<li>July 7, 2016: I fix a bug in FreeBSD&#39;s virtual memory initialization in order to allow it to support boot with 128 CPUs; aka. FreeBSD 11.0 and later support the EC2 x1.32xlarge instance type.</li>
<li>January 26, 2017: I change the default configuration in FreeBSD 11.1 and later to support EC2&#39;s IPv6 networking setup out of the box (once you flip all of the necessary switches to enable IPv6 in EC2 itself).</li>
<li>May 20, 2017: In collaboration with Rick Macklem, I make FreeBSD 11.1 and later compatible with the Amazon &quot;Elastic File System&quot; (aka. NFSv4-as-a-service) via the newly added &quot;oneopenown&quot; mount option (and lots of bug fixes).</li>
<li>May 25, 2017: I enable support for the Amazon &quot;Elastic Network Adapter&quot; in FreeBSD 11.1 and later. (The vast majority of the work — porting the driver code — was done by Semihalf with sponsorship from Amazon.)</li>
<li><p>December 5, 2017: I change the default configuration in FreeBSD 11.2 and later to make use of the Amazon Time Sync Service (aka. NTP-as-a-service).</p></li>
<li><p>The current status</p></li>
<li><p>The upcoming FreeBSD release (11.2) supports: IPv6, Enhanced Networking (both generations), Amazon Elastic File System, Amazon Time Sync Service, both consoles (Serial VGA), and every EC2 instance type (although I&#39;m not sure if FreeBSD has drivers to make use of the FPGA or GPU hardware on those instances).</p></li>
<li><p><a href="https://www.patreon.com/cperciva" rel="nofollow">Colin&#39;s Patreon&#39; page if you&#39;d like to support him</a></p></li>
</ul>

<hr>

<h3>X network transparency</h3>

<ul>
<li><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/XNetworkTransparencyFailure" rel="nofollow">X&#39;s network transparency has wound up mostly being a failure</a></li>
</ul>

<blockquote>
<p>I was recently reading Mark Dominus&#39;s entry about some X keyboard problems, in which he said in passing (quoting himself):</p>

<p>I have been wondering for years if X&#39;s vaunted network transparency was as big a failure as it seemed: an interesting idea, worth trying out, but one that eventually turned out to be more trouble than it was worth. [...]</p>

<p>My first reaction was to bristle, because I use X&#39;s network transparency all of the time at work. I have several programs to make it work very smoothly, and some core portions of my environment would be basically impossible without it. But there&#39;s a big qualification on my use of X&#39;s network transparency, namely that it&#39;s essentially all for text. When I occasionally go outside of this all-text environment of xterms and emacs and so on, it doesn&#39;t go as well.</p>

<p>X&#39;s network transparency was not designed as &#39;it will run xterm well&#39;; originally it was to be something that should let you run almost everything remotely, providing a full environment. Even apart from the practical issues covered in Daniel Stone&#39;s slide presentation, it&#39;s clear that it&#39;s been years since X could deliver a real first class environment over the network. You cannot operate with X over the network in the same way that you do locally. Trying to do so is painful and involves many things that either don&#39;t work at all or perform so badly that you don&#39;t want to use them.</p>

<p>In my view, there are two things that did in general X network transparency. The first is that networks turned out to not be fast enough even for ordinary things that people wanted to do, at least not the way that X used them. The obvious case is web browsers; once the web moved to lots of images and worse, video, that was pretty much it, especially with 24-bit colour.</p>

<p>(It&#39;s obviously not impossible to deliver video across the network with good performance, since YouTube and everyone else does it. But their video is highly encoded in specialized formats, not handled by any sort of general &#39;send successive images to the display&#39; system.)</p>

<p>The second is that the communication facilities that X provided were too narrow and limited. This forced people to go outside of them in order to do all sorts of things, starting with audio and moving on to things like DBus and other ways of coordinating environments, handling sophisticated configuration systems, modern fonts, and so on. When people designed these additional communication protocols, the result generally wasn&#39;t something that could be used over the network (especially not without a bunch of setup work that you had to do in addition to remote X). Basic X clients that use X properties for everything may be genuinely network transparent, but there are very few of those left these days. (Not even xterm is any more, at least if you use XFT fonts. XFT fonts are rendered in the client, and so different hosts may have different renderings of the same thing, cf.)</p>
</blockquote>

<p>&lt; What remains of X&#39;s network transparency is still useful to some of us, but it&#39;s only a shadow of what the original design aimed for. I don&#39;t think it was a mistake for X to specifically design it in (to the extent that they did, which is less than you might think), and it did help X out pragmatically in the days of X terminals, but that&#39;s mostly it.</p>

<p>(I continue to think that remote display protocols are useful in general, but I&#39;m in an usual situation. Most people only ever interact with remote machines with either text mode SSH or a browser talking to a web server on the remote machine.)</p>

<blockquote>
<p>PS: The X protocol issues with synchronous requests that Daniel Stone talks about don&#39;t help the situation, but I think that even with those edges sanded off X&#39;s network transparency wouldn&#39;t be a success. Arguably X&#39;s protocol model committed a lesser version of part of the NeWS mistake.</p>
</blockquote>

<ul>
<li><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/XFreeNetworkTransparency" rel="nofollow">X&#39;s network transparency was basically free at the time</a></li>
</ul>

<blockquote>
<p>I recently wrote an entry about how X&#39;s network transparency has wound up mostly being a failure for various reasons. However, there is an important flipside to the story of X&#39;s network transparency, and that is that X&#39;s network transparency was almost free at the time and in the context it was created. Unlike the situation today, in the beginning X did not have to give up lots of performance or other things in order to get network transparency.</p>

<p>X originated in the mid 1980s and it was explicitly created to be portable across various Unixes, especially BSD-derived ones (because those were what universities were mostly using at that time). In the mid to late 1980s, Unix had very few IPC methods, especially portable ones. In particular, BSD systems did not have shared memory (it was called &#39;System V IPC&#39; for the obvious reasons). BSD had TCP and Unix sockets, some System V machines had TCP (and you could likely assume that more would get it), and in general your safest bet was to assume some sort of abstract stream protocol and then allow for switchable concrete backends. Unsurprisingly, this is exactly what X did; the core protocol is defined as a bidirectional stream of bytes over an abstracted channel. (And the concrete implementation of $DISPLAY has always let you specify the transport mechanism, as well as allowing your local system to pick the best mechanism it has.)</p>

<p>Once you&#39;ve decided that your protocol has to run over abstracted streams, it&#39;s not that much more work to make it network transparent (TCP provides streams, after all). X could have refused to make the byte order of the stream clear or required the server and the client to have access to some shared files (eg for fonts), but I don&#39;t think either would have been a particularly big win. I&#39;m sure that it took some extra effort and care to make X work across TCP from a different machine, but I don&#39;t think it took very much. (At the same time, my explanation here is probably a bit ahistorical. X&#39;s initial development seems relatively strongly tied to sometimes having clients on different machines than the display, which is not unreasonable for the era. But it doesn&#39;t hurt to get a feature that you want anyway for a low cost.)</p>

<p>I believe it&#39;s important here that X was intended to be portable across different Unixes. If you don&#39;t care about portability and can get changes made to your Unix, you can do better (for example, you can add some sort of shared memory or process to process virtual memory transfer). I&#39;m not sure how the 1980s versions of SunView worked, but I believe they were very SunOS dependent. Wikipedia says SunView was partly implemented in the kernel, which is certainly one way to both share memory and speed things up.</p>

<p>PS: Sharing memory through mmap() and friends was years in the future at this point and required significant changes when it arrived.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/grace-hopper-celebration-2018-call-for-participation/" rel="nofollow">Grace Hopper Celebration 2018 Call for Participation</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/google-summer-of-code-call-for-project-ideas/" rel="nofollow">Google Summer of Code: Call for Project Ideas</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180129190641" rel="nofollow">The OpenBSD Foundation 2018 Fundraising Campaign</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3115" rel="nofollow">SSH Mastery 2/e out</a></li>
<li><a href="https://2018.asiabsdcon.org/" rel="nofollow">AsiaBSDcon 2018 Registration is open</a></li>
<li><a href="http://mail.tarsnap.com/tarsnap-announce/msg00042.html" rel="nofollow">Tarsnap support for Bitcoin ending April 1st; and a Chrome bug</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Todd - <a href="http://dpaste.com/195HGHY#wrap" rel="nofollow">Couple Questions</a></li>
<li>Seth - <a href="http://dpaste.com/1N7NQVQ#wrap" rel="nofollow">Tar Snap</a></li>
<li>Alex - <a href="http://dpaste.com/3D9P1DW#wrap" rel="nofollow">sudo question</a></li>
<li>Thomas - <a href="http://dpaste.com/24NMG47#wrap" rel="nofollow">FreeBSD on ARM?</a></li>
<li>Albert - <a href="http://dpaste.com/373CRX7#wrap" rel="nofollow">Austria BSD User Group</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We explain the physics behind ZFS, DTrace switching to the GPL, Emacs debugging, syncookies coming to PF &amp; FreeBSD’s history on EC2.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blogs.oracle.com/bonwick/128-bit-storage:-are-you-high" rel="nofollow">128 bit storage: Are you high?</a></h3>

<ul>
<li>For people who have heard about ZFS boiling oceans and wonder where that is coming from, we dug out this old piece from 2004 on the blog of ZFS co-creator Jeff Bonwick, originally from the Sun website.</li>
</ul>

<blockquote>
<p>64 bits would have been plenty ... but then you can&#39;t talk out of your ass about boiling oceans then, can you?<br>
Well, it&#39;s a fair question. Why did we make ZFS a 128-bit storage system? What on earth made us think it&#39;s necessary? And how do we know it&#39;s sufficient? Let&#39;s start with the easy one: how do we know it&#39;s necessary?<br>
 Some customers already have datasets on the order of a petabyte, or 2<sup>50</sup> bytes. Thus the 64-bit capacity limit of 2<sup>64</sup> bytes is only 14 doublings away. Moore&#39;s Law for storage predicts that capacity will continue to double every 9-12 months, which means we&#39;ll start to hit the 64-bit limit in about a decade. Storage systems tend to live for several decades, so it would be foolish to create a new one without anticipating the needs that will surely arise within its projected lifetime.<br>
If 64 bits isn&#39;t enough, the next logical step is 128 bits. That&#39;s enough to survive Moore&#39;s Law until I&#39;m dead, and after that, it&#39;s not my problem. But it does raise the question: what are the theoretical limits to storage capacity?<br>
Although we&#39;d all like Moore&#39;s Law to continue forever, quantum mechanics imposes some fundamental limits on the computation rate and information capacity of any physical device. In particular, it has been shown that 1 kilogram of matter confined to 1 liter of space can perform at most 10<sup>51</sup> operations per second on at most 10<sup>31</sup> bits of information [see Seth Lloyd, &quot;Ultimate physical limits to computation.&quot; Nature 406, 1047-1054 (2000)]. A fully-populated 128-bit storage pool would contain 2<sup>128</sup> blocks = 2<sup>137</sup> bytes = 2<sup>140</sup> bits; therefore the minimum mass required to hold the bits would be (2<sup>140</sup> bits) / (10<sup>31</sup> bits/kg) = 136 billion kg.<br>
That&#39;s a lot of gear.<br>
To operate at the 1031 bits/kg limit, however, the entire mass of the computer must be in the form of pure energy. By E=mc<sup>2,</sup> the rest energy of 136 billion kg is 1.2x1028 J. The mass of the oceans is about 1.4x1021 kg. It takes about 4,000 J to raise the temperature of 1 kg of water by 1 degree Celcius, and thus about 400,000 J to heat 1 kg of water from freezing to boiling.<br>
The latent heat of vaporization adds another 2 million J/kg.<br>
Thus the energy required to boil the oceans is about 2.4x106 J/kg * 1.4x1021 kg = <br>
3.4x1027 J. Thus, fully populating a 128-bit storage pool would, literally, require more energy than boiling the oceans.</p>
</blockquote>

<ul>
<li>Best part of all: you don’t have to understand any of this to use ZFS. Rest assured that you won’t hit any limits with that filesystem for a long time. You still have to buy bigger disks over time, though...
***</li>
</ul>

<h3><a href="https://gnu.wildebeest.org/blog/mjw/2018/02/14/dtrace-for-linux-oracle-does-the-right-thing/" rel="nofollow">dtrace for Linux, Oracle relicenses dtrace</a></h3>

<blockquote>
<p>At Fosdem we had a talk on dtrace for linux in the Debugging Tools devroom.</p>

<p>Not explicitly mentioned in that talk, but certainly the most exciting thing, is that Oracle is doing a proper linux kernel port:</p>
</blockquote>

<pre><code> commit e1744f50ee9bc1978d41db7cc93bcf30687853e6
 Author: Tomas Jedlicka &lt;tomas.jedlicka@oracle.com&gt;
 Date: Tue Aug 1 09:15:44 2017 -0400

 dtrace: Integrate DTrace Modules into kernel proper

 This changeset integrates DTrace module sources into the main kernel
 source tree under the GPLv2 license. Sources have been moved to
 appropriate locations in the kernel tree.
</code></pre>

<blockquote>
<p>That is right, dtrace dropped the CDDL and switched to the GPL!</p>

<p>The user space code dtrace-utils and libdtrace-ctf (a combination of GPLv2 and UPL) can be found on the DTrace Project Source Control page. The NEWS file mentions the license switch (and that it is build upon elfutils, which I personally was pleased to find out).</p>

<p>The kernel sources (GPLv2+ for the core kernel and UPL for the uapi) are slightly harder to find because they are inside the uek kernel source tree, but following the above commit you can easily get at the whole linux kernel dtrace directory.</p>

<p>The UPL is the Universal Permissive License, which according to the FSF is a lax, non-copyleft license that is compatible with the GNU GPL.</p>

<p>Thank you Oracle for making everyone’s life easier by waving your magic relicensing wand!</p>

<p>Now there is lots of hard work to do to actually properly integrate this. And I am sure there are a lot of technical hurdles when trying to get this upstreamed into the mainline kernel. But that is just hard work. Which we can now start collaborating on in earnest.</p>

<p>Like systemtap and the Dynamic Probes (dprobes) before it, dtrace is a whole system observability tool combining tracing, profiling and probing/debugging techniques. Something the upstream linux kernel hackers don’t always appreciate when presented as one large system. They prefer having separate small tweaks for tracing, profiling and probing which are mostly separate from each other. It took years for the various hooks, kprobes, uprobes, markers, etc. from systemtap (and other systems) to get upstream. But these days they are. And there is now even a byte code interpreter (eBPF) in the mainline kernel as originally envisioned by dprobes, which systemtap can now target through stapbpf. So with all those techniques now available in the linux kernel it will be exciting to see if dtrace for linux can unite them all.</p>
</blockquote>

<hr>

<h3><a href="http://nullprogram.com/blog/2018/01/17/" rel="nofollow">Debugging Emacs or: How I Learned to Stop Worrying and Love DTrace</a></h3>

<blockquote>
<p>For some time Elfeed was experiencing a strange, spurious failure. Every so often users were seeing an error (spoiler warning) when updating feeds: “error in process sentinel: Search failed.” If you use Elfeed, you might have even seen this yourself. From the surface it appeared that curl, tasked with the responsibility for downloading feed data, was producing incomplete output despite reporting a successful run. Since the run was successful, Elfeed assumed certain data was in curl’s output buffer, but, since it wasn’t, it failed hard.</p>

<p>Unfortunately this issue was not reproducible. Manually running curl outside of Emacs never revealed any issues. Asking Elfeed to retry fetching the feeds would work fine. The issue would only randomly rear its head when Elfeed was fetching many feeds in parallel, under stress. By the time the error was discovered, the curl process had exited and vital debugging information was lost. Considering that this was likely to be a bug in Emacs itself, there really wasn’t a reliable way to capture the necessary debugging information from within Emacs Lisp. And, indeed, this later proved to be the case.</p>

<p>A quick-and-dirty work around is to use condition-case to catch and swallow the error. When the bizarre issue shows up, rather than fail badly in front of the user, Elfeed could attempt to swallow the error — assuming it can be reliably detected — and treat the fetch as simply a failure. That didn’t sit comfortably with me. Elfeed had done its due diligence checking for errors already. Someone was lying to Elfeed, and I intended to catch them with their pants on fire. Someday.</p>

<p>I’d just need to witness the bug on one of my own machines. Elfeed is part of my daily routine, so surely I’d have to experience this issue myself someday. My plan was, should that day come, to run a modified Elfeed, instrumented to capture extra data. I would have also routinely run Emacs under GDB so that I could inspect the failure more deeply.</p>

<p>For now I just had to wait to hunt that zebra.</p>
</blockquote>

<ul>
<li>Bryan Cantrill, DTrace, and FreeBSD</li>
</ul>

<blockquote>
<p>Over the holidays I re-discovered Bryan Cantrill, a systems software engineer who worked for Sun between 1996 and 2010, and is most well known for DTrace. My first exposure to him was in a BSD Now interview in 2015. I had re-watched that interview and decided there was a lot more I had to learn from him. He’s become a personal hero to me. So I scoured the internet for more of his writing and talks.</p>

<p>Some interesting operating system technology came out of Sun during its final 15 or so years — most notably DTrace and ZFS — and Bryan speaks about it passionately. Almost as a matter of luck, most of it survived the Oracle acquisition thanks to Sun releasing it as open source in just the nick of time. Otherwise it would have been lost forever. The scattered ex-Sun employees, still passionate about their prior work at Sun, along with some of their old customers have since picked up the pieces and kept going as a community under the name illumos. It’s like an open source flotilla.</p>

<p>Naturally I wanted to get my hands on this stuff to try it out for myself. Is it really as good as they say? Normally I stick to Linux, but it (generally) doesn’t have these Sun technologies available. The main reason is license incompatibility. Sun released its code under the CDDL, which is incompatible with the GPL. Ubuntu does infamously include ZFS, but other distributions are unwilling to take that risk. Porting DTrace is a serious undertaking since it’s got its fingers throughout the kernel, which also makes the licensing issues even more complicated.</p>

<p>Linux has a reputation for Not Invented Here (NIH) syndrome, and these licensing issues certainly contribute to that. Rather than adopt ZFS and DTrace, they’ve been reinvented from scratch: btrfs instead of ZFS, and a slew of partial options instead of DTrace. Normally I’m most interested in system call tracing, and my go to is strace, though it certainly has its limitations — including this situation of debugging curl under Emacs. Another famous example of NIH is Linux’s epoll(2), which is a broken version of BSD kqueue(2).</p>

<p>So, if I want to try these for myself, I’ll need to install a different operating system. I’ve dabbled with OmniOS, an OS built on illumos, in virtual machines, using it as an alien environment to test some of my software (e.g. enchive). OmniOS has a philosophy called Keep Your Software To Yourself (KYSTY), which is really just code for “we don’t do packaging.” Honestly, you can’t blame them since they’re a tiny community. The best solution to this is probably pkgsrc, which is essentially a universal packaging system. Otherwise you’re on your own.</p>

<p>There’s also openindiana, which is a more friendly desktop-oriented illumos distribution. Still, the short of it is that you’re very much on your own when things don’t work. The situation is like running Linux a couple decades ago, when it was still difficult to do.</p>

<p>If you’re interested in trying DTrace, the easiest option these days is probably FreeBSD. It’s got a big, active community, thorough documentation, and a huge selection of packages. Its license (the BSD license, duh) is compatible with the CDDL, so both ZFS and DTrace have been ported to FreeBSD.</p>
</blockquote>

<ul>
<li>What is DTrace?</li>
</ul>

<blockquote>
<p>I’ve done all this talking but haven’t yet described what DTrace really is. I won’t pretend to write my own tutorial, but I’ll provide enough information to follow along. DTrace is a tracing framework for debugging production systems in real time, both for the kernel and for applications. The “production systems” part means it’s stable and safe — using DTrace won’t put your system at risk of crashing or damaging data. The “real time” part means it has little impact on performance. You can use DTrace on live, active systems with little impact. Both of these core design principles are vital for troubleshooting those really tricky bugs that only show up in production.</p>

<p>There are DTrace probes scattered all throughout the system: on system calls, scheduler events, networking events, process events, signals, virtual memory events, etc. Using a specialized language called D (unrelated to the general purpose programming language D), you can dynamically add behavior at these instrumentation points. Generally the behavior is to capture information, but it can also manipulate the event being traced.</p>

<p>Each probe is fully identified by a 4-tuple delimited by colons: provider, module, function, and probe name. An empty element denotes a sort of wildcard. For example, syscall::open:entry is a probe at the beginning (i.e. “entry”) of open(2). syscall:::entry matches all system call entry probes.</p>

<p>Unlike strace on Linux which monitors a specific process, DTrace applies to the entire system when active. To run curl under strace from Emacs, I’d have to modify Emacs’ behavior to do so. With DTrace I can instrument every curl process without making a single change to Emacs, and with negligible impact to Emacs. That’s a big deal.</p>

<p>So, when it comes to this Elfeed issue, FreeBSD is much better poised for debugging the problem. All I have to do is catch it in the act. However, it’s been months since that bug report and I’m not really making this connection yet. I’m just hoping I eventually find an interesting problem where I can apply DTrace.</p>
</blockquote>

<ul>
<li><a href="http://dtrace.org/blogs/bmc/2018/02/03/talks/" rel="nofollow">Bryan Cantrill: Talks I have given</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180207090000" rel="nofollow">a2k18 Hackathon preview: Syncookies coming to PF</a></h3>

<blockquote>
<p>As you may have heard, the a2k18 hackathon is in progress. As can be seen from the commit messages, several items of goodness are being worked on.<br>
One eagerly anticipated item is the arrival of TCP syncookies (read: another important tool in your anti-DDoS toolset) in PF. Henning Brauer (henning@) added the code in a series of commits on February 6th, 2018, with this one containing the explanation:</p>
</blockquote>

<pre><code>syncookies for pf.

when syncookies are on, pf will blindly answer each and every SYN with a syncookie-SYNACK. Upon reception of the ACK completing the 3WHS, pf will reconstruct the original SYN, shove it through pf_test, where state will be created if the ruleset permits it. Then massage the freshly created state (we won&#39;t see the SYNACK), set up the sequence number modulator, and call into the existing synproxy code to start the 3WHS with the backend host.

Add an - somewhat basic for now - adaptive mode where syncookies get enabled if a certain percentage of the state table is filled up with half-open tcp connections. This makes pf firewalls resilient against large synflood attacks.

syncookies are off by default until we gained more experience, considered experimental for now.

see http://bulabula.org/papers/2017/bsdcan/ for more details.

joint work with sashan@, widely discussed and with lots of input by many
</code></pre>

<blockquote>
<p>The first release to have this feature available will probably be the upcoming OpenBSD 6.3 if a sufficient number of people test this in their setups (hint, hint). More info is likely to emerge soon in post-hackathon writeups, so watch this space!</p>
</blockquote>

<hr>

<h3>[Pale Moon]</h3>

<ul>
<li>A Perfect example of how not to approach OS developers/packagers</li>
<li><a href="https://github.com/jasperla/openbsd-wip/issues/86" rel="nofollow">Removed from OpenBSD Ports due to Licensing Issues</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2018-February/112455.html" rel="nofollow">FreeBSD Palemoon branding violation</a></li>
<li><a href="https://twitter.com/midnightbsd/status/961232422091280386" rel="nofollow">Mightnight BSD&#39;s response</a>
***</li>
</ul>

<h3><a href="http://www.daemonology.net/blog/2018-02-12-FreeBSD-EC2-history.html" rel="nofollow">FreeBSD EC2 History</a></h3>

<blockquote>
<p>A couple years ago Jeff Barr published a blog post with a timeline of EC2 instances. I thought at the time that I should write up a timeline of the FreeBSD/EC2 platform, but I didn&#39;t get around to it; but last week, as I prepared to ask for sponsorship for my work I decided that it was time to sit down and collect together the long history of how the platform has evolved and improved over the years.<br>
Normally I don&#39;t edit blog posts after publishing them (with the exception of occasional typographical corrections), but I do plan on keeping this post up to date with future developments.</p>
</blockquote>

<ul>
<li>August 25, 2006: Amazon EC2 launches. It supports a single version of Ubuntu Linux; FreeBSD is not available.</li>
<li>December 13, 2010: I manage to get FreeBSD running on EC2 t1.micro instances.</li>
<li>March 22, 2011: I manage to get FreeBSD running on EC2 &quot;cluster compute&quot; instances.</li>
<li>July 8, 2011: I get FreeBSD 8.2 running on all 64-bit EC2 instance types, by marking it as &quot;Windows&quot; in order to get access to Xen/HVM virtualization. (Unfortunately this meant that users had to pay the higher &quot;Windows&quot; hourly pricing.)</li>
<li>January 16, 2012: I get FreeBSD 9.0 running on 32-bit EC2 instances via the same &quot;defenestration&quot; trick. (Again, paying the &quot;Windows&quot; prices.)</li>
<li>August 16, 2012: I move the FreeBSD rc.d scripts which handle &quot;EC2&quot; functionality (e.g., logging SSH host keys to the console) into the FreeBSD ports tree.</li>
<li>October 7, 2012: I rework the build process for FreeBSD 9.1-RC1 and later to use &quot;world&quot; bits extracted from the release ISOs; only the kernel is custom-built. Also, the default SSH user changes from &quot;root&quot; to &quot;ec2-user&quot;.</li>
<li>October 31, 2012: Amazon launches the &quot;M3&quot; family of instances, which support Xen/HVM without FreeBSD needing to pay the &quot;Windows&quot; tax.</li>
<li>November 21, 2012: I get FreeBSD added to the AWS Marketplace.</li>
<li>October 2, 2013: I finish merging kernel patches into the FreeBSD base system, and rework the AMI build (again) so that FreeBSD 10.0-ALPHA4 and later use bits extracted from the release ISOs for the entire system (world + kernel). FreeBSD Update can now be used for updating everything (because now FreeBSD/EC2 uses a GENERIC kernel).</li>
<li>October 27, 2013: I add code to EC2 images so that FreeBSD 10.0-BETA2 and later AMIs will run FreeBSD Update when they first boot in order to download and install any critical updates.</li>
<li>December 1, 2013: I add code to EC2 images so that FreeBSD 10.0-BETA4 and later AMIs bootstrap the pkg tool and install packages at boot time (by default, the &quot;awscli&quot; package).</li>
<li>December 9, 2013: I add configinit to FreeBSD 10.0-RC1 and later to allow systems to be easily configured via EC2 user-data.</li>
<li>July 1, 2014: Amazon launches the &quot;T2&quot; family of instances; now the most modern family for every type of EC2 instance (regular, high-memory, high-CPU, high-I/O, burstable) supports HVM and there should no longer be any need for FreeBSD users to pay the &quot;Windows tax&quot;.</li>
<li>November 24, 2014: I add code to FreeBSD 10.2 and later to automatically resize their root filesystems when they first boot; this means that a larger root disk can be specified at instance launch time and everything will work as expected.</li>
<li>April 1, 2015: I integrate the FreeBSD/EC2 build process into the FreeBSD release building process; FreeBSD 10.2-BETA1 and later AMIs are built by the FreeBSD release engineering team.</li>
<li>January 12, 2016: I enable Intel 82599-based &quot;first generation EC2 Enhanced Networking&quot; in FreeBSD 11.0 and later.</li>
<li>June 9, 2016: I enable the new EC2 VGA console functionality in FreeBSD 11.0 and later. (The old serial console also continues to work.)</li>
<li>June 24, 2016: Intel 82599-based Enhanced Networking works reliably in FreeBSD 11.0 and later thanks to discovering and working around a Xen bug.</li>
<li>June 29, 2016: I improve throughput on Xen blkfront devices (/dev/xbd*) by enabling indirect segment I/Os in FreeBSD 10.4 and later. (I wrote this functionality in July 2015, but left it disabled by default a first because a bug in EC2 caused it to hurt performance on some instances.)</li>
<li>July 7, 2016: I fix a bug in FreeBSD&#39;s virtual memory initialization in order to allow it to support boot with 128 CPUs; aka. FreeBSD 11.0 and later support the EC2 x1.32xlarge instance type.</li>
<li>January 26, 2017: I change the default configuration in FreeBSD 11.1 and later to support EC2&#39;s IPv6 networking setup out of the box (once you flip all of the necessary switches to enable IPv6 in EC2 itself).</li>
<li>May 20, 2017: In collaboration with Rick Macklem, I make FreeBSD 11.1 and later compatible with the Amazon &quot;Elastic File System&quot; (aka. NFSv4-as-a-service) via the newly added &quot;oneopenown&quot; mount option (and lots of bug fixes).</li>
<li>May 25, 2017: I enable support for the Amazon &quot;Elastic Network Adapter&quot; in FreeBSD 11.1 and later. (The vast majority of the work — porting the driver code — was done by Semihalf with sponsorship from Amazon.)</li>
<li><p>December 5, 2017: I change the default configuration in FreeBSD 11.2 and later to make use of the Amazon Time Sync Service (aka. NTP-as-a-service).</p></li>
<li><p>The current status</p></li>
<li><p>The upcoming FreeBSD release (11.2) supports: IPv6, Enhanced Networking (both generations), Amazon Elastic File System, Amazon Time Sync Service, both consoles (Serial VGA), and every EC2 instance type (although I&#39;m not sure if FreeBSD has drivers to make use of the FPGA or GPU hardware on those instances).</p></li>
<li><p><a href="https://www.patreon.com/cperciva" rel="nofollow">Colin&#39;s Patreon&#39; page if you&#39;d like to support him</a></p></li>
</ul>

<hr>

<h3>X network transparency</h3>

<ul>
<li><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/XNetworkTransparencyFailure" rel="nofollow">X&#39;s network transparency has wound up mostly being a failure</a></li>
</ul>

<blockquote>
<p>I was recently reading Mark Dominus&#39;s entry about some X keyboard problems, in which he said in passing (quoting himself):</p>

<p>I have been wondering for years if X&#39;s vaunted network transparency was as big a failure as it seemed: an interesting idea, worth trying out, but one that eventually turned out to be more trouble than it was worth. [...]</p>

<p>My first reaction was to bristle, because I use X&#39;s network transparency all of the time at work. I have several programs to make it work very smoothly, and some core portions of my environment would be basically impossible without it. But there&#39;s a big qualification on my use of X&#39;s network transparency, namely that it&#39;s essentially all for text. When I occasionally go outside of this all-text environment of xterms and emacs and so on, it doesn&#39;t go as well.</p>

<p>X&#39;s network transparency was not designed as &#39;it will run xterm well&#39;; originally it was to be something that should let you run almost everything remotely, providing a full environment. Even apart from the practical issues covered in Daniel Stone&#39;s slide presentation, it&#39;s clear that it&#39;s been years since X could deliver a real first class environment over the network. You cannot operate with X over the network in the same way that you do locally. Trying to do so is painful and involves many things that either don&#39;t work at all or perform so badly that you don&#39;t want to use them.</p>

<p>In my view, there are two things that did in general X network transparency. The first is that networks turned out to not be fast enough even for ordinary things that people wanted to do, at least not the way that X used them. The obvious case is web browsers; once the web moved to lots of images and worse, video, that was pretty much it, especially with 24-bit colour.</p>

<p>(It&#39;s obviously not impossible to deliver video across the network with good performance, since YouTube and everyone else does it. But their video is highly encoded in specialized formats, not handled by any sort of general &#39;send successive images to the display&#39; system.)</p>

<p>The second is that the communication facilities that X provided were too narrow and limited. This forced people to go outside of them in order to do all sorts of things, starting with audio and moving on to things like DBus and other ways of coordinating environments, handling sophisticated configuration systems, modern fonts, and so on. When people designed these additional communication protocols, the result generally wasn&#39;t something that could be used over the network (especially not without a bunch of setup work that you had to do in addition to remote X). Basic X clients that use X properties for everything may be genuinely network transparent, but there are very few of those left these days. (Not even xterm is any more, at least if you use XFT fonts. XFT fonts are rendered in the client, and so different hosts may have different renderings of the same thing, cf.)</p>
</blockquote>

<p>&lt; What remains of X&#39;s network transparency is still useful to some of us, but it&#39;s only a shadow of what the original design aimed for. I don&#39;t think it was a mistake for X to specifically design it in (to the extent that they did, which is less than you might think), and it did help X out pragmatically in the days of X terminals, but that&#39;s mostly it.</p>

<p>(I continue to think that remote display protocols are useful in general, but I&#39;m in an usual situation. Most people only ever interact with remote machines with either text mode SSH or a browser talking to a web server on the remote machine.)</p>

<blockquote>
<p>PS: The X protocol issues with synchronous requests that Daniel Stone talks about don&#39;t help the situation, but I think that even with those edges sanded off X&#39;s network transparency wouldn&#39;t be a success. Arguably X&#39;s protocol model committed a lesser version of part of the NeWS mistake.</p>
</blockquote>

<ul>
<li><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/XFreeNetworkTransparency" rel="nofollow">X&#39;s network transparency was basically free at the time</a></li>
</ul>

<blockquote>
<p>I recently wrote an entry about how X&#39;s network transparency has wound up mostly being a failure for various reasons. However, there is an important flipside to the story of X&#39;s network transparency, and that is that X&#39;s network transparency was almost free at the time and in the context it was created. Unlike the situation today, in the beginning X did not have to give up lots of performance or other things in order to get network transparency.</p>

<p>X originated in the mid 1980s and it was explicitly created to be portable across various Unixes, especially BSD-derived ones (because those were what universities were mostly using at that time). In the mid to late 1980s, Unix had very few IPC methods, especially portable ones. In particular, BSD systems did not have shared memory (it was called &#39;System V IPC&#39; for the obvious reasons). BSD had TCP and Unix sockets, some System V machines had TCP (and you could likely assume that more would get it), and in general your safest bet was to assume some sort of abstract stream protocol and then allow for switchable concrete backends. Unsurprisingly, this is exactly what X did; the core protocol is defined as a bidirectional stream of bytes over an abstracted channel. (And the concrete implementation of $DISPLAY has always let you specify the transport mechanism, as well as allowing your local system to pick the best mechanism it has.)</p>

<p>Once you&#39;ve decided that your protocol has to run over abstracted streams, it&#39;s not that much more work to make it network transparent (TCP provides streams, after all). X could have refused to make the byte order of the stream clear or required the server and the client to have access to some shared files (eg for fonts), but I don&#39;t think either would have been a particularly big win. I&#39;m sure that it took some extra effort and care to make X work across TCP from a different machine, but I don&#39;t think it took very much. (At the same time, my explanation here is probably a bit ahistorical. X&#39;s initial development seems relatively strongly tied to sometimes having clients on different machines than the display, which is not unreasonable for the era. But it doesn&#39;t hurt to get a feature that you want anyway for a low cost.)</p>

<p>I believe it&#39;s important here that X was intended to be portable across different Unixes. If you don&#39;t care about portability and can get changes made to your Unix, you can do better (for example, you can add some sort of shared memory or process to process virtual memory transfer). I&#39;m not sure how the 1980s versions of SunView worked, but I believe they were very SunOS dependent. Wikipedia says SunView was partly implemented in the kernel, which is certainly one way to both share memory and speed things up.</p>

<p>PS: Sharing memory through mmap() and friends was years in the future at this point and required significant changes when it arrived.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/grace-hopper-celebration-2018-call-for-participation/" rel="nofollow">Grace Hopper Celebration 2018 Call for Participation</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/google-summer-of-code-call-for-project-ideas/" rel="nofollow">Google Summer of Code: Call for Project Ideas</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180129190641" rel="nofollow">The OpenBSD Foundation 2018 Fundraising Campaign</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3115" rel="nofollow">SSH Mastery 2/e out</a></li>
<li><a href="https://2018.asiabsdcon.org/" rel="nofollow">AsiaBSDcon 2018 Registration is open</a></li>
<li><a href="http://mail.tarsnap.com/tarsnap-announce/msg00042.html" rel="nofollow">Tarsnap support for Bitcoin ending April 1st; and a Chrome bug</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Todd - <a href="http://dpaste.com/195HGHY#wrap" rel="nofollow">Couple Questions</a></li>
<li>Seth - <a href="http://dpaste.com/1N7NQVQ#wrap" rel="nofollow">Tar Snap</a></li>
<li>Alex - <a href="http://dpaste.com/3D9P1DW#wrap" rel="nofollow">sudo question</a></li>
<li>Thomas - <a href="http://dpaste.com/24NMG47#wrap" rel="nofollow">FreeBSD on ARM?</a></li>
<li>Albert - <a href="http://dpaste.com/373CRX7#wrap" rel="nofollow">Austria BSD User Group</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>232: FOSDEM 2018</title>
  <link>https://www.bsdnow.tv/232</link>
  <guid isPermaLink="false">2246fb14-61bb-4387-942b-f8ba55f48deb</guid>
  <pubDate>Wed, 07 Feb 2018 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2246fb14-61bb-4387-942b-f8ba55f48deb.mp3" length="68482228" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We talk about our recent trip to FOSDEM, we discuss the pros and cons of permissive licensing, cover the installation of OpenBSD on a dedibox with full-disk encryption, the new Lumina guide repository, and we explain ZFS vs. OpenZFS.</itunes:subtitle>
  <itunes:duration>1:35:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We talk about our recent trip to FOSDEM, we discuss the pros and cons of permissive licensing, cover the installation of OpenBSD on a dedibox with full-disk encryption, the new Lumina guide repository, and we explain ZFS vs. OpenZFS.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
[FOSDEM Trip report]
Your BSDNow hosts were both at FOSDEM in Brussels, Belgium over the weekend.
On the friday before FOSDEM, we held a FreeBSD devsummit (3rd consecutive year), sponsored by the FreeBSD Foundation and organized by Benedict (with the help from Kristof Provost, who did it in previous years but could not make it this year). We had 21 people attend, a good mixture of FreeBSD committers (mostly ports) and guests. After introductions, we collected topics and discussed various topics, including a new plan for a future FreeBSD release roadmap (more frequent releases, so that features from HEAD can be tried out earlier in RELEASES). The devsummit concluded with a nice dinner in a nearby restaurant.
On Saturday, first day of FOSDEM, we set up the FreeBSD Foundation table with flyers, stickers, FreeBSD Journal print editions, and a small RPI 3 demo system that Deb Goodkin brought. Our table was located next to the Illumos table like last year. This allowed us to continue the good relationship that we have with the Illumos people and Allan helped a little bit getting bhyve to run on Illumos with UEFI. Meanwhile, our table was visited by a lot of people who would ask questions about FreeBSD, take info material, or talk about their use cases. We were busy refilling the table throughout the day and luckily, we had many helpers at the table. Some items we had ran out in the early afternoon, an indicator of how popular they were.
Saturday also featured a BSD devroom (https://twitter.com/fosdembsd), organized by Rodrigo Osorio. You can find the list of talks and the recordings on the BSD Devroom schedule (https://fosdem.org/2018/schedule/track/bsd/). The room was very crowded and popular. Deb Goodkin gave the opening talk with an overview of what the Foundation is doing to change the world. Other speakers from various BSD projects presented their talks after that with a range of topics. Among them, Allan gave his talk about ZFS: Advanced Integration (https://fosdem.org/2018/schedule/event/zfs_advanced_integration/), while Benedict presented his Reflections on Teaching a Unix Class With FreeBSD (https://fosdem.org/2018/schedule/event/reflections_on_reaching_unix_class_with_freebsd/).
Sunday was just as busy on the FreeBSD table as Saturday and we finally ran out of stickers and some other goodies. We were happy with the results of the two days. Some very interesting conversations at the table about FreeBSD took place, some of which we’re going to follow up afterwards.
Check out the FOSDEM schedule as many talk recordings are already available, and especially the ones from the BSD devroom if you could not attend the conference. We would like to thank everyone who attended the FreeBSD devsummit, who helped out at the FreeBSD table and organized the BSD devroom. Also, thanks to all the speakers, organizers, and helping hands making FOSDEM another success this year.
***
NetBSD kernel wscons IOCTL vulnerable bug class (http://blog.infosectcbr.com.au/2018/01/netbsd-kernel-wscons-ioctl-vulnerable.html)
I discovered this bug class during the InfoSect public code review session we ran looking specifically at the NetBSD kernel. I found a couple of these bugs and then after the session was complete, I went back and realised the same bug was scattered in other drivers. In total, 17 instances of this vulnerability and its variants were discovered.
In all fairness, I came across this bug class during my kernel audits in 2002 and most instances were patched. It just seems there are more bugs now in NetBSD while OpenBSD and FreeBSD have practically eliminated them.
See slide 41 in http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-cesare.pdf (http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-cesare.pdf) for exactly the same bug (class) 16 years ago.
The format of the this blog post is as follows:
Introduction
Example of the Bug Class
How to Fix
How to Detect Automatically with Coccinelle
More Bugs
Conclusion
These source files had bugs

./dev/tc/tfb.c
./dev/ic/bt485.c
./dev/pci/radeonfb.c
./dev/ic/sti.c
./dev/sbus/tcx.c
./dev/tc/mfb.c
./dev/tc/sfb.c
./dev/tc/stic.c
./dev/tc/cfb.c
./dev/tc/xcfb.c
./dev/tc/sfbplus.c
./arch/arm/allwinner/awin_debe.c
./arch/arm/iomd/vidcvideo.c
./arch/pmax/ibus/pm.c
./dev/ic/igfsb.c
./dev/ic/bt463.c
./arch/luna68k/dev/lunafb.c

Reporting of the bugs was easy. In less than a week from reporting the specific instances of each bug, patches were committed into the mainline kernel. Thanks to Luke Mewburn from NetBSD for coming to the code review session at InfoSect and coordinating with the NetBSD security team.
The patches to fix these issues are in NetBSD: https://mail-index.netbsd.org/source-changes/2018/01/24/msg091428.html (https://mail-index.netbsd.org/source-changes/2018/01/24/msg091428.html)
"Permissive licensing is wrong!” – Is it? (https://eerielinux.wordpress.com/2017/11/25/permissive-licensing-is-wrong-is-it-1-2/)
A few weeks ago I’ve been attacked by some GNU zealots on a German tech site after speaking in favor of permissive licenses. Unfortunately a discussion was not possible there because that would require the will to actually communicate instead of simply accusing the other side of vile motives. Since I actually do care about this topic and a reader asked for a post about it in comments a while ago, here we go.
This first part tries to sum up the most important things around the topic. I deliberately aim for an objective overview that tries not to be one-sided. The second part will then contain my points in defence of permissive licensing.
Why license software at all?
Licenses exist for reasons of protection. If you’re the author/inventor of some software, a story or whatever product, you get to decide what to do with it. You can keep it for yourself or you can give it away. If you decide for the latter, you have to decide who may use it and in which way(s). In case you intend to give it to a (potentially) large group of people, you may not want to be asked for permission to xyz by everybody. That’s when you decide to write a license which states what you are allowing and explicitly disallowing.
Most of the well-known commercial licenses focus on what you’re not allowed to do (usually things like copying, disassembling, etc.). Open source licenses on the other hand are meant to grant the user rights (e.g. the right to distribute) while reserving some rights or only giving permission under certain conditions – and they usually make you claim responsibility for using the software. For these reasons licenses can actually be a good thing!
If you got an unlicensed piece of code, you’re not legally allowed to do anything with it without getting the author’s permission first. And even if you got that permission, your project would be risky, since the author can withdraw it later. A proper license protects both parties. The author doesn’t get his mail account full of email asking for permission, he’s save from legal trouble if his code breaks anything for you and at the same time you have legal certainty when you decide to put the code to long-term use.
Permissive vs. Copyleft (in a nutshell)
In short terms, permissive licensing usually goes like this: “Here you are, have fun. Oh, and don’t sue me if it does something else than what you expect!” Yes, it’s that easy and there’s little to dispute over.
Copyleft on the other side sounds like this (if you ask somebody in favor of Copyleft): “Sure, you can use it, it’s free. Just keep it free, ok?”. Also quite simple. And not too bad, eh? Other people however read the same thing like this: “Yes, you’re free to use it. Just read these ten pages of legalese and be dead certain that you comply. If you got something wrong, we will absolutely make you regret it.”
The GNU Public license (GPL)
The most popular copyleft license in use is the GPL (in various versions) (https://www.gnu.org/licenses/gpl.html). It got more and more complex with each version – and to be fair, it had to, because it was necessary to react to new threats and loop holes that were found later. The GNU project states that they are committed to protect what they call the four freedoms of free software:

the freedom to use the software for any purpose
the freedom to change the software to suit your needs
the freedom to share the software with your friends and neighbors
the freedom to share the changes you make

These are freedoms that every supporter of open source software should be able to agree with. So what’s the deal with all the hostility and fighting between the two camps? Let’s take a look at a permissive license, too.
The BSD license
Unlike the GPL, the BSD family of licenses begun with a rather simple license that span four rules (“original BSD license”). It was later revised and reduced to three (“modified BSD license”). And the modern BSD license that e.g. FreeBSD uses is even just two (“simplified BSD license”).
Did you read the GPLv3 that I linked to above? If you are using GPL’d code you really should. In case you don’t feel like reading all of it, at least take a look and grasp how long that text is. Now compare it to the complete modern BSD license (https://opensource.org/licenses/bsd-license.php).
What’s the problem?
There are essentially two problems that cause all the trouble. The first one is the question of what should be subject to the freedom that we’re talking about. And closely related, the second one is where that freedom needs to end.
Ironically both camps claim that freedom is the one important thing and it must not be restricted. The GPL is meant to protect the freedom of the software and enforces the availability of the source code, hence limiting the freedom of actual persons. BSD on the other hand is meant to protect the freedom of human beings who should be able to use the software as they see fit – even if that means closing down former open source code!
The GNU camp taunts permissive licenses as being “lax” for not providing the protection that they want. The other camp points out that the GPL is a complex monster and that it is virulent in nature: Since it’s very strict in a lot of areas, it’s incompatible with many other licenses. This makes it complicated to mix GPL and non-GPL code and in the cases where it’s legally possible, the GPL’s terms will take precedence and necessarily be in effect for the whole combined work.
Who’s right?
That totally depends on what you want to achieve. There are pros and cons to both – and in fact we’re only looking at the big picture here. There’s also e.g. the Apache license which is often deemed as kind of middle ground. Then you may want to consider the difference between weak (e.g. LGPL) as well as strong copyleft (GPL). Licensing is a potentially huge topic. But let’s keep it simple here because the exact details are actually not necessary to understand the essence of our topic.
In the next post I’ll present my stance on why permissive licensing is a good thing and copyleft is more problematic than many people may think.
“Permissive licensing is wrong?” – No it’s not! (https://eerielinux.wordpress.com/2018/01/25/permissive-licensing-is-wrong-no-its-not-2-2/)
The previous post gave a short introduction into the topic of software licenses, focusing on the GPL vs. BSD discussion. This one is basically my response to some typical arguments I’ve seen from people who seem to loathe permissive licensing. I’ll write this in dialog style, hoping that this makes it a little lighter to read.
Roundup
Install OpenBSD on dedibox with full-disk encryption (https://poolp.org/posts/2018-01-29/install-openbsd-on-dedibox-with-full-disk-encryption/)
TL;DR:
I run several "dedibox" servers at online.net, all powered by OpenBSD. OpenBSD is not officially supported so you have to work-around. Running full-disk encrypted OpenBSD there is a piece of cake. As a bonus, my first steps within a brand new booted machine ;-)
Step #0: choosing your server
OpenBSD is not officially supported, I can’t guarantee that this will work for you on any kind of server online.net provides, however I’ve been running https://poolp.org on OpenBSD there since 2008, only switching machines as they were getting a bit old and new offers came up.
Currently, I’m running two SC 2016 (SATA) and one XC 2016 (SSD) boxes, all three running OpenBSD reliably ever since I installed them.
Recently I’ve been willing to reinstall the XC one after I did some experiments that turned it into a FrankenBSD, so this was the right occasion to document how I do it for future references.
I wrote an article similar to this a few years ago relying on qemu to install to the disk, since then online.net provided access to a virtual serial console accessed within the browser, making it much more convenient to install without the qemu indirection which hid the NIC devices and disks duid and required tricks.
The method I currently use is a mix and adaptation from the techniques described in https://www.2f30.org/guides/openbsd-dedibox.html to boot the installer, and the technique described in https://geekyschmidt.com/2011/01/19/configuring-openbsd-softraid-fo-encryption.html to setup the crypto slice.
Step #1: boot to rescue mode
Step #2: boot to the installer
Step #3: prepare softraid
Step #4: reboot to encrypted OpenBSD system
Bonus: further tightening your system
enable doas
disable the root account
update system with syspatch
add my ssh public key to my ~/.ssh/authorized_keys
disable password authentication within ssh
reboot so you boot on a brand new up-to-date system with latest stable kernel
VOILA !
January 2018 Development Projects Update (https://www.freebsdfoundation.org/blog/january-2018-development-projects-update/)
Spectre and Meltdown in FreeBSD
Issues affecting most CPUs used in servers, desktops, laptops, and mobile devices are in the news. These hardware vulnerabilities, known by the code-names “Meltdown” and “Spectre”, allow malicious programs to read data to which they should not have access. This potentially includes credentials, cryptographic material, or other secrets. They were originally identified by a researcher from Google’s Project Zero, and were also independently discovered by researchers and academics from Cyberus Technology, Graz University of Technology, the University of Pennsylvania, the University of Maryland, Rambus, the University of Adelaide and Data61.
These vulnerabilities affect many CPU architectures supported by FreeBSD, but the 64-bit x86 family of processors from Intel and AMD are the most widely used, and are a high priority for software changes to mitigate the effects of Meltdown and Spectre. In particular, the Meltdown issue affects Intel CPUs and may be used to extract secret data from the running kernel, and therefore, is the most important issue to address.
The FreeBSD Foundation collaborates with Intel, and under this relationship participated in a briefing to understand the details of these issues and plan the mitigations to be applied to the x86 architectures supported by FreeBSD. We also made arrangements to have FreeBSD’s security officer join me in the briefing. It is through the generous support of the Foundation’s donors that we are able to dedicate resources to focus on these issues on demand as they arise.
Foundation staff member Konstantin (Kostik) Belousov is an expert on FreeBSD’s Virtual Memory (VM) system as well as low-level x86 details, and is developing the x86 kernel mitigations for FreeBSD.
The mitigation for Meltdown is known as Page Table Isolation (PTI). Kostik created a PTI implementation which was initially committed in mid-January and is available in the FreeBSD-CURRENT development repository. This is the same approach used by the Linux kernel to mitigate Meltdown.
One of the drawbacks of the PTI mitigation is that it incurs a performance regression. Kostik recently reworked FreeBSD’s use of Process-Context Identifiers (PCID) in order to regain some of the performance loss incurred by PTI. This change is also now available in FreeBSD-CURRENT.
The issue known as Spectre comes in two variants, and variant 2 is the more troubling and pressing one. It may be mitigated in one of two ways: by using a technique called “retpoline” in the compiler, or by making use of a CPU feature introduced in a processor microcode update. Both options are under active development. Kostik’s change to implement the CPU-based mitigation is currently in review. Unfortunately, it introduces a significant performance penalty and alternatives are preferred, if available.
For most cases, the compiler-based retpoline mitigation is likely to be the chosen mitigation. Having switched to the Clang compiler for the base system and most of the ports collection some years ago, FreeBSD is well-positioned to deploy Clang-based mitigations. FreeBSD developer Dimitry Andric is spearheading the update of Clang/LLVM in FreeBSD to version 6.0 in anticipation of its official release; FreeBSD-CURRENT now includes an interim snapshot. I have been assisting with the import, particularly with respect to LLVM’s lld linker, and will support the integration of retpoline. This support is expected to be merged into FreeBSD in the coming weeks.
The Foundation’s co-op students have also participated in the response to these vulnerabilities. Mitchell Horne developed the patch to control the PTI mitigation default setting, while Arshan Khanifar benchmarked the performance impact of the in-progress mitigation patches. In addition, Arshan and Mitchell each developed changes to FreeBSD’s tool chain to support the full set of mitigations that will be applied.
These mitigations will continue be tested, benchmarked, and refined in FreeBSD-CURRENT before being merged into stable branches and then being made available as updates to FreeBSD releases. Details on the timing of these merges and releases will be shared as they become available.
I would like to acknowledge all of those in the FreeBSD community who have participated in FreeBSD’s response to Meltdown and Spectre, for testing, reviewing, and coordinating x86 mitigations, for developing mitigations for other processor architectures and for the Bhyve hypervisor, and for working on the toolchain-based mitigations.
Guides: Getting Started &amp;amp; Lumina Theme Submissions (https://lumina-desktop.org/guides-getting-started-lumina-themes/)
I am pleased to announce the beginning of a new sub-series of blog posts for the Lumina project: Guides!
The TrueOS/Lumina projects want to support our users as they use Lumina or experiment with TrueOS. To that end, we’ve recently set up a central repository for our users to share instructions or other “how-to” guides with each other! Project developers and contributors will also submit guides to the repository on occasion, but the overall goal is to provide a simple hub for instructions written by any Lumina or TrueOS user. This will make it easier for users to not only find a “how-to” for some procedure, but also a very easy way to “give back” to the community by writing simple instructions or more detailed guides.
Guides Repository
Our first guide to get the whole thing started was created by the TrueOS Linebacker (https://discourse.trueos.org/t/introducing-the-trueos-linebacker/991)  (with technical assistance from our own q5sys). In this guide, Terry Tate will walk you through the steps necessary to submit new wallpaper images to the Lumina Themes collection. This procedure is fully documented with screenshots every step of the way, walking you through a simple procedure that only requires a web browser and a Github account!
Guide: Lumina Themes Submissions (https://github.com/trueos/guides/blob/master/lumina-themes-submissions/readme.md)
The end result of this guide was that Terry Tate was able to submit this cool new “Lunar-4K” wallpaper to the “lumina-nature” collection.
TrueOS Community Guides (https://github.com/trueos/guides/tree/master)
ZFS vs. OpenZFS (by Michael Dexter) (https://www.ixsystems.com/blog/zfs-vs-openzfs/)
You’ve probably heard us say a mix of “ZFS” and “OpenZFS” and an explanation is long-overdue. Our Senior Analyst clears up what ZFS and OpenZFS refer to and how they differ.
I admit that we geeks tend to get caught up in the nuts and bolts of enterprise storage and overlook the more obvious questions that users might have. You’ve probably noticed that this blog and the FreeNAS blog refer to “ZFS” and “OpenZFS” seemingly at random when talking about the amazing file system at the heart of FreeNAS and every storage product that iXsystems sells. I will do my best to clarify what exactly these two terms refer to.
From its inception, “ZFS” has referred to the “Zettabyte File System” developed at Sun Microsystems and published under the CDDL Open Source license in 2005 as part of the OpenSolaris operating system. ZFS was revolutionary for completely decoupling the file system from specialized storage hardware and even a specific computer platform. The portable nature and advanced features of ZFS led FreeBSD, Linux, and even Apple developers to start porting ZFS to their operating systems and by 2008, FreeBSD shipped with ZFS in the 7.0 release. For the first time, ZFS empowered users of any budget with enterprise-class scalability and data integrity and management features like checksumming, compression and snapshotting, and those features remain unrivaled at any price to this day. On any ZFS platform, administrators use the zpool and zfs utilities to configure and manage their storage devices and file systems respectively. Both commands employ a user-friendly syntax such as‘zfs create mypool/mydataset’ and I welcome you to watch the appropriately-titled webinar “Why we love ZFS &amp;amp; you should too” or try a completely-graphical ZFS experience with FreeNAS.
Yes, ZFS is really as good as people say it is.
After enjoying nearly a decade of refinement by a growing group of developers around the world, ZFS became the property of database vendor Oracle, which ceased public development of both ZFS and OpenSolaris in 2010. Disappointed but undeterred, a group of OpenSolaris users and developers forked the last public release of OpenSolaris as the Illumos project. To this day, Illumos represents the official upstream home of the Open Source OpenSolaris technologies, including ZFS. The Illumos project enjoys healthy vendor and user participation but the portable nature and compelling features of ZFS soon produced far more ZFS users than Illumos users around the world. While most if not all users of Illumos and its derivatives are ZFS users, the majority of ZFS users are not Illumos users, thanks significantly in part to FreeNAS which uses the FreeBSD operating system. This imbalance plus several successful ZFS Day events led ZFS co-founder Matt Ahrens and a group of ZFS developers to announce the OpenZFS project, which would remain a part of the Illumos code base but would be free to coordinate development efforts and events around their favorite file system. ZFS Day has grown into the two-day OpenZFS Developer Summit and is stronger than ever, a testament to the passion and dedication of the OpenZFS community.
Oracle has steadily continued to develop its own proprietary branch of ZFS and Matt Ahrens points out that over 50% of the original OpenSolaris ZFS code has been replaced in OpenZFS with community contributions. This means that there are, sadly, two politically and technologically-incompatible branches of “ZFS” but fortunately, OpenZFS is orders of magnitude more popular thanks to its open nature. The two projects should be referred to as “Oracle ZFS” and “OpenZFS” to distinguish them as development efforts, but the user still types the ‘zfs’ command, which on FreeBSD relies on the ‘zfs.ko’ kernel module. My impression is that the terms of the CDDL license under which the OpenZFS branch of ZFS is published protects its users from any patent and trademark risks. Hopefully, this all helps you distinguish the OpenZFS project from the ZFS technology.
Beastie Bits
Explaining Shell (https://explainshell.com/)
OPNsense® 18.1 Released (https://opnsense.org/opnsense-18-1-released/)
“SSH Mastery 2/e” copyedits back (https://blather.michaelwlucas.com/archives/3104)
Sponsoring a Scam (https://blather.michaelwlucas.com/archives/3106)
Thursday, February 8, 2018 - Come to Netflix to talk about FreeBSD (https://www.meetup.com/BAFUG-Bay-Area-FreeBSD-User-Group/events/246623825/)
BSD User Group meeting in Stockholm: March 22, 17:30 - 21:00 (https://www.meetup.com/BSD-Users-Stockholm/events/247552279/)
FreeBSD Flavoured talks from Linux.conf.au: You can’t unit test C, right? (https://www.youtube.com/watch?v=z-uWt5wVVkU) and A Brief History of I/O (https://www.youtube.com/watch?v=qAhZEI_6lbc)
EuroBSDcon 2018 website is up (https://2018.eurobsdcon.org/)
Full day bhyvecon Tokyo, Japan, March 9, 2018 (http://bhyvecon.org/)
***
Feedback/Questions
Thomas - freebsd installer improvements (http://dpaste.com/3G2F7RC#wrap)
Mohammad - FreeBSD 11 installation from a read only rescue disk (http://dpaste.com/0HGK3FQ#wrap)
Stan - Follow up on guide you covered (http://dpaste.com/2S169SH#wrap)
Jalal - couple questions (http://dpaste.com/35N8QXP#wrap)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We talk about our recent trip to FOSDEM, we discuss the pros and cons of permissive licensing, cover the installation of OpenBSD on a dedibox with full-disk encryption, the new Lumina guide repository, and we explain ZFS vs. OpenZFS.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>[FOSDEM Trip report]</h3>

<ul>
<li>Your BSDNow hosts were both at FOSDEM in Brussels, Belgium over the weekend.</li>
<li>On the friday before FOSDEM, we held a FreeBSD devsummit (3rd consecutive year), sponsored by the FreeBSD Foundation and organized by Benedict (with the help from Kristof Provost, who did it in previous years but could not make it this year). We had 21 people attend, a good mixture of FreeBSD committers (mostly ports) and guests. After introductions, we collected topics and discussed various topics, including a new plan for a future FreeBSD release roadmap (more frequent releases, so that features from HEAD can be tried out earlier in RELEASES). The devsummit concluded with a nice dinner in a nearby restaurant.</li>
<li>On Saturday, first day of FOSDEM, we set up the FreeBSD Foundation table with flyers, stickers, FreeBSD Journal print editions, and a small RPI 3 demo system that Deb Goodkin brought. Our table was located next to the Illumos table like last year. This allowed us to continue the good relationship that we have with the Illumos people and Allan helped a little bit getting bhyve to run on Illumos with UEFI. Meanwhile, our table was visited by a lot of people who would ask questions about FreeBSD, take info material, or talk about their use cases. We were busy refilling the table throughout the day and luckily, we had many helpers at the table. Some items we had ran out in the early afternoon, an indicator of how popular they were.</li>
<li>Saturday also featured a <a href="https://twitter.com/fosdembsd" rel="nofollow">BSD devroom</a>, organized by Rodrigo Osorio. You can find the list of talks and the recordings on the <a href="https://fosdem.org/2018/schedule/track/bsd/" rel="nofollow">BSD Devroom schedule</a>. The room was very crowded and popular. Deb Goodkin gave the opening talk with an overview of what the Foundation is doing to change the world. Other speakers from various BSD projects presented their talks after that with a range of topics. Among them, Allan gave his talk about <a href="https://fosdem.org/2018/schedule/event/zfs_advanced_integration/" rel="nofollow">ZFS: Advanced Integration</a>, while Benedict presented his <a href="https://fosdem.org/2018/schedule/event/reflections_on_reaching_unix_class_with_freebsd/" rel="nofollow">Reflections on Teaching a Unix Class With FreeBSD</a>.</li>
<li>Sunday was just as busy on the FreeBSD table as Saturday and we finally ran out of stickers and some other goodies. We were happy with the results of the two days. Some very interesting conversations at the table about FreeBSD took place, some of which were going to follow up afterwards.</li>
<li>Check out the FOSDEM schedule as many talk recordings are already available, and especially the ones from the BSD devroom if you could not attend the conference. We would like to thank everyone who attended the FreeBSD devsummit, who helped out at the FreeBSD table and organized the BSD devroom. Also, thanks to all the speakers, organizers, and helping hands making FOSDEM another success this year.
***</li>
</ul>

<h3><a href="http://blog.infosectcbr.com.au/2018/01/netbsd-kernel-wscons-ioctl-vulnerable.html" rel="nofollow">NetBSD kernel wscons IOCTL vulnerable bug class</a></h3>

<blockquote>
<p>I discovered this bug class during the InfoSect public code review session we ran looking specifically at the NetBSD kernel. I found a couple of these bugs and then after the session was complete, I went back and realised the same bug was scattered in other drivers. In total, 17 instances of this vulnerability and its variants were discovered.<br>
In all fairness, I came across this bug class during my kernel audits in 2002 and most instances were patched. It just seems there are more bugs now in NetBSD while OpenBSD and FreeBSD have practically eliminated them.</p>
</blockquote>

<ul>
<li><p>See slide 41 in <a href="http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-cesare.pdf" rel="nofollow">http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-cesare.pdf</a> for exactly the same bug (class) 16 years ago.</p></li>
<li><p>The format of the this blog post is as follows:</p></li>
<li><p>Introduction</p></li>
<li><p>Example of the Bug Class</p></li>
<li><p>How to Fix</p></li>
<li><p>How to Detect Automatically with Coccinelle</p></li>
<li><p>More Bugs</p></li>
<li><p>Conclusion</p></li>
<li><p>These source files had bugs</p></li>
</ul>

<pre><code>./dev/tc/tfb.c
./dev/ic/bt485.c
./dev/pci/radeonfb.c
./dev/ic/sti.c
./dev/sbus/tcx.c
./dev/tc/mfb.c
./dev/tc/sfb.c
./dev/tc/stic.c
./dev/tc/cfb.c
./dev/tc/xcfb.c
./dev/tc/sfbplus.c
./arch/arm/allwinner/awin_debe.c
./arch/arm/iomd/vidcvideo.c
./arch/pmax/ibus/pm.c
./dev/ic/igfsb.c
./dev/ic/bt463.c
./arch/luna68k/dev/lunafb.c
</code></pre>

<blockquote>
<p>Reporting of the bugs was easy. In less than a week from reporting the specific instances of each bug, patches were committed into the mainline kernel. Thanks to Luke Mewburn from NetBSD for coming to the code review session at InfoSect and coordinating with the NetBSD security team.</p>
</blockquote>

<ul>
<li>The patches to fix these issues are in NetBSD: <a href="https://mail-index.netbsd.org/source-changes/2018/01/24/msg091428.html" rel="nofollow">https://mail-index.netbsd.org/source-changes/2018/01/24/msg091428.html</a></li>
</ul>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2017/11/25/permissive-licensing-is-wrong-is-it-1-2/" rel="nofollow">&quot;Permissive licensing is wrong!  Is it?</a></h3>

<blockquote>
<p>A few weeks ago Ive been attacked by some GNU zealots on a German tech site after speaking in favor of permissive licenses. Unfortunately a discussion was not possible there because that would require the will to actually communicate instead of simply accusing the other side of vile motives. Since I actually do care about this topic and a reader asked for a post about it in comments a while ago, here we go.</p>

<p>This first part tries to sum up the most important things around the topic. I deliberately aim for an objective overview that tries not to be one-sided. The second part will then contain my points in defence of permissive licensing.</p>
</blockquote>

<ul>
<li><p>Why license software at all?</p>

<blockquote>
<p>Licenses exist for reasons of protection. If youre the author/inventor of some software, a story or whatever product, you get to decide what to do with it. You can keep it for yourself or you can give it away. If you decide for the latter, you have to decide who may use it and in which way(s). In case you intend to give it to a (potentially) large group of people, you may not want to be asked for permission to xyz by everybody. Thats when you decide to write a license which states what you are allowing and explicitly disallowing.<br>
Most of the well-known commercial licenses focus on what youre not allowed to do (usually things like copying, disassembling, etc.). Open source licenses on the other hand are meant to grant the user rights (e.g. the right to distribute) while reserving some rights or only giving permission under certain conditions  and they usually make you claim responsibility for using the software. For these reasons licenses can actually be a good thing!<br>
If you got an unlicensed piece of code, youre not legally allowed to do anything with it without getting the authors permission first. And even if you got that permission, your project would be risky, since the author can withdraw it later. A proper license protects both parties. The author doesnt get his mail account full of email asking for permission, hes save from legal trouble if his code breaks anything for you and at the same time you have legal certainty when you decide to put the code to long-term use.</p>
</blockquote></li>
<li><p>Permissive vs. Copyleft (in a nutshell)</p></li>
</ul>

<blockquote>
<p>In short terms, permissive licensing usually goes like this: Here you are, have fun. Oh, and dont sue me if it does something else than what you expect! Yes, its that easy and theres little to dispute over.<br>
Copyleft on the other side sounds like this (if you ask somebody in favor of Copyleft): Sure, you can use it, its free. Just keep it free, ok?. Also quite simple. And not too bad, eh? Other people however read the same thing like this: Yes, youre free to use it. Just read these ten pages of legalese and be dead certain that you comply. If you got something wrong, we will absolutely make you regret it.</p>
</blockquote>

<ul>
<li>The GNU Public license (GPL)</li>
</ul>

<blockquote>
<p><a href="https://www.gnu.org/licenses/gpl.html" rel="nofollow">The most popular copyleft license in use is the GPL (in various versions)</a>. It got more and more complex with each version  and to be fair, it had to, because it was necessary to react to new threats and loop holes that were found later. The GNU project states that they are committed to protect what they call the four freedoms of free software:</p>
</blockquote>

<pre><code>the freedom to use the software for any purpose
the freedom to change the software to suit your needs
the freedom to share the software with your friends and neighbors
the freedom to share the changes you make
</code></pre>

<blockquote>
<p>These are freedoms that every supporter of open source software should be able to agree with. So whats the deal with all the hostility and fighting between the two camps? Lets take a look at a permissive license, too.</p>
</blockquote>

<ul>
<li>The BSD license</li>
</ul>

<blockquote>
<p>Unlike the GPL, the BSD family of licenses begun with a rather simple license that span four rules (original BSD license). It was later revised and reduced to three (modified BSD license). And the modern BSD license that e.g. FreeBSD uses is even just two (simplified BSD license).</p>

<p>Did you read the GPLv3 that I linked to above? If you are using GPLd code you really should. In case you dont feel like reading all of it, at least take a look and grasp how long that text is. <a href="https://opensource.org/licenses/bsd-license.php" rel="nofollow">Now compare it to the complete modern BSD license</a>.</p>
</blockquote>

<ul>
<li>Whats the problem?</li>
</ul>

<blockquote>
<p>There are essentially two problems that cause all the trouble. The first one is the question of what should be subject to the freedom that were talking about. And closely related, the second one is where that freedom needs to end.</p>

<p>Ironically both camps claim that freedom is the one important thing and it must not be restricted. The GPL is meant to protect the freedom of the software and enforces the availability of the source code, hence limiting the freedom of actual persons. BSD on the other hand is meant to protect the freedom of human beings who should be able to use the software as they see fit  even if that means closing down former open source code!</p>

<p>The GNU camp taunts permissive licenses as being lax for not providing the protection that they want. The other camp points out that the GPL is a complex monster and that it is virulent in nature: Since its very strict in a lot of areas, its incompatible with many other licenses. This makes it complicated to mix GPL and non-GPL code and in the cases where its legally possible, the GPLs terms will take precedence and necessarily be in effect for the whole combined work.</p>
</blockquote>

<ul>
<li>Whos right?</li>
</ul>

<blockquote>
<p>That totally depends on what you want to achieve. There are pros and cons to both  and in fact were only looking at the big picture here. Theres also e.g. the Apache license which is often deemed as kind of middle ground. Then you may want to consider the difference between weak (e.g. LGPL) as well as strong copyleft (GPL). Licensing is a potentially huge topic. But lets keep it simple here because the exact details are actually not necessary to understand the essence of our topic.</p>

<p>In the next post Ill present my stance on why permissive licensing is a good thing and copyleft is more problematic than many people may think.</p>
</blockquote>

<ul>
<li><a href="https://eerielinux.wordpress.com/2018/01/25/permissive-licensing-is-wrong-no-its-not-2-2/" rel="nofollow">Permissive licensing is wrong?  No its not!</a></li>
</ul>

<blockquote>
<p>The previous post gave a short introduction into the topic of software licenses, focusing on the GPL vs. BSD discussion. This one is basically my response to some typical arguments Ive seen from people who seem to loathe permissive licensing. Ill write this in dialog style, hoping that this makes it a little lighter to read.</p>
</blockquote>

<hr>

<h2>Roundup</h2>

<h3><a href="https://poolp.org/posts/2018-01-29/install-openbsd-on-dedibox-with-full-disk-encryption/" rel="nofollow">Install OpenBSD on dedibox with full-disk encryption</a></h3>

<ul>
<li>TL;DR:</li>
</ul>

<blockquote>
<p>I run several &quot;dedibox&quot; servers at online.net, all powered by OpenBSD. OpenBSD is not officially supported so you have to work-around. Running full-disk encrypted OpenBSD there is a piece of cake. As a bonus, my first steps within a brand new booted machine ;-)</p>
</blockquote>

<ul>
<li>Step #0: choosing your server</li>
</ul>

<blockquote>
<p>OpenBSD is not officially supported, I cant guarantee that this will work for you on any kind of server online.net provides, however Ive been running <a href="https://poolp.org" rel="nofollow">https://poolp.org</a> on OpenBSD there since 2008, only switching machines as they were getting a bit old and new offers came up.</p>

<p>Currently, Im running two SC 2016 (SATA) and one XC 2016 (SSD) boxes, all three running OpenBSD reliably ever since I installed them.</p>

<p>Recently Ive been willing to reinstall the XC one after I did some experiments that turned it into a FrankenBSD, so this was the right occasion to document how I do it for future references.</p>

<p>I wrote an article similar to this a few years ago relying on qemu to install to the disk, since then online.net provided access to a virtual serial console accessed within the browser, making it much more convenient to install without the qemu indirection which hid the NIC devices and disks duid and required tricks.</p>

<p>The method I currently use is a mix and adaptation from the techniques described in <a href="https://www.2f30.org/guides/openbsd-dedibox.html" rel="nofollow">https://www.2f30.org/guides/openbsd-dedibox.html</a> to boot the installer, and the technique described in <a href="https://geekyschmidt.com/2011/01/19/configuring-openbsd-softraid-fo-encryption.html" rel="nofollow">https://geekyschmidt.com/2011/01/19/configuring-openbsd-softraid-fo-encryption.html</a> to setup the crypto slice.</p>
</blockquote>

<ul>
<li>Step #1: boot to rescue mode</li>
<li>Step #2: boot to the installer</li>
<li>Step #3: prepare softraid</li>
<li>Step #4: reboot to encrypted OpenBSD system</li>
<li>Bonus: further tightening your system</li>
<li>enable doas</li>
<li>disable the root account</li>
<li>update system with syspatch</li>
<li>add my ssh public key to my ~/.ssh/authorized_keys</li>
<li>disable password authentication within ssh</li>
<li>reboot so you boot on a brand new up-to-date system with latest stable kernel</li>
<li>VOILA !</li>
</ul>

<hr>

<h3><a href="https://www.freebsdfoundation.org/blog/january-2018-development-projects-update/" rel="nofollow">January 2018 Development Projects Update</a></h3>

<ul>
<li>Spectre and Meltdown in FreeBSD</li>
</ul>

<blockquote>
<p>Issues affecting most CPUs used in servers, desktops, laptops, and mobile devices are in the news. These hardware vulnerabilities, known by the code-names Meltdown and Spectre, allow malicious programs to read data to which they should not have access. This potentially includes credentials, cryptographic material, or other secrets. They were originally identified by a researcher from Googles Project Zero, and were also independently discovered by researchers and academics from Cyberus Technology, Graz University of Technology, the University of Pennsylvania, the University of Maryland, Rambus, the University of Adelaide and Data61.</p>

<p>These vulnerabilities affect many CPU architectures supported by FreeBSD, but the 64-bit x86 family of processors from Intel and AMD are the most widely used, and are a high priority for software changes to mitigate the effects of Meltdown and Spectre. In particular, the Meltdown issue affects Intel CPUs and may be used to extract secret data from the running kernel, and therefore, is the most important issue to address.</p>

<p>The FreeBSD Foundation collaborates with Intel, and under this relationship participated in a briefing to understand the details of these issues and plan the mitigations to be applied to the x86 architectures supported by FreeBSD. We also made arrangements to have FreeBSDs security officer join me in the briefing. It is through the generous support of the Foundations donors that we are able to dedicate resources to focus on these issues on demand as they arise.</p>

<p>Foundation staff member Konstantin (Kostik) Belousov is an expert on FreeBSDs Virtual Memory (VM) system as well as low-level x86 details, and is developing the x86 kernel mitigations for FreeBSD.</p>

<p>The mitigation for Meltdown is known as Page Table Isolation (PTI). Kostik created a PTI implementation which was initially committed in mid-January and is available in the FreeBSD-CURRENT development repository. This is the same approach used by the Linux kernel to mitigate Meltdown.</p>

<p>One of the drawbacks of the PTI mitigation is that it incurs a performance regression. Kostik recently reworked FreeBSDs use of Process-Context Identifiers (PCID) in order to regain some of the performance loss incurred by PTI. This change is also now available in FreeBSD-CURRENT.</p>

<p>The issue known as Spectre comes in two variants, and variant 2 is the more troubling and pressing one. It may be mitigated in one of two ways: by using a technique called retpoline in the compiler, or by making use of a CPU feature introduced in a processor microcode update. Both options are under active development. Kostiks change to implement the CPU-based mitigation is currently in review. Unfortunately, it introduces a significant performance penalty and alternatives are preferred, if available.</p>

<p>For most cases, the compiler-based retpoline mitigation is likely to be the chosen mitigation. Having switched to the Clang compiler for the base system and most of the ports collection some years ago, FreeBSD is well-positioned to deploy Clang-based mitigations. FreeBSD developer Dimitry Andric is spearheading the update of Clang/LLVM in FreeBSD to version 6.0 in anticipation of its official release; FreeBSD-CURRENT now includes an interim snapshot. I have been assisting with the import, particularly with respect to LLVMs lld linker, and will support the integration of retpoline. This support is expected to be merged into FreeBSD in the coming weeks.</p>

<p>The Foundations co-op students have also participated in the response to these vulnerabilities. Mitchell Horne developed the patch to control the PTI mitigation default setting, while Arshan Khanifar benchmarked the performance impact of the in-progress mitigation patches. In addition, Arshan and Mitchell each developed changes to FreeBSDs tool chain to support the full set of mitigations that will be applied.</p>

<p>These mitigations will continue be tested, benchmarked, and refined in FreeBSD-CURRENT before being merged into stable branches and then being made available as updates to FreeBSD releases. Details on the timing of these merges and releases will be shared as they become available.</p>

<p>I would like to acknowledge all of those in the FreeBSD community who have participated in FreeBSDs response to Meltdown and Spectre, for testing, reviewing, and coordinating x86 mitigations, for developing mitigations for other processor architectures and for the Bhyve hypervisor, and for working on the toolchain-based mitigations.</p>
</blockquote>

<hr>

<h3><a href="https://lumina-desktop.org/guides-getting-started-lumina-themes/" rel="nofollow">Guides: Getting Started &amp; Lumina Theme Submissions</a></h3>

<blockquote>
<p>I am pleased to announce the beginning of a new sub-series of blog posts for the Lumina project: Guides!</p>

<p>The TrueOS/Lumina projects want to support our users as they use Lumina or experiment with TrueOS. To that end, weve recently set up a central repository for our users to share instructions or other how-to guides with each other! Project developers and contributors will also submit guides to the repository on occasion, but the overall goal is to provide a simple hub for instructions written by any Lumina or TrueOS user. This will make it easier for users to not only find a how-to for some procedure, but also a very easy way to give back to the community by writing simple instructions or more detailed guides.</p>
</blockquote>

<ul>
<li>Guides Repository</li>
</ul>

<blockquote>
<p>Our first guide to get the whole thing started was created by the <a href="https://discourse.trueos.org/t/introducing-the-trueos-linebacker/991" rel="nofollow">TrueOS Linebacker</a>  (with technical assistance from our own q5sys). In this guide, Terry Tate will walk you through the steps necessary to submit new wallpaper images to the Lumina Themes collection. This procedure is fully documented with screenshots every step of the way, walking you through a simple procedure that only requires a web browser and a Github account!</p>
</blockquote>

<ul>
<li><a href="https://github.com/trueos/guides/blob/master/lumina-themes-submissions/readme.md" rel="nofollow">Guide: Lumina Themes Submissions</a></li>
</ul>

<blockquote>
<p>The end result of this guide was that Terry Tate was able to submit this cool new Lunar-4K wallpaper to the lumina-nature collection.</p>
</blockquote>

<ul>
<li><a href="https://github.com/trueos/guides/tree/master" rel="nofollow">TrueOS Community Guides</a></li>
</ul>

<hr>

<h3><a href="https://www.ixsystems.com/blog/zfs-vs-openzfs/" rel="nofollow">ZFS vs. OpenZFS (by Michael Dexter)</a></h3>

<blockquote>
<p>Youve probably heard us say a mix of ZFS and OpenZFS and an explanation is long-overdue. Our Senior Analyst clears up what ZFS and OpenZFS refer to and how they differ.<br>
I admit that we geeks tend to get caught up in the nuts and bolts of enterprise storage and overlook the more obvious questions that users might have. Youve probably noticed that this blog and the FreeNAS blog refer to ZFS and OpenZFS seemingly at random when talking about the amazing file system at the heart of FreeNAS and every storage product that iXsystems sells. I will do my best to clarify what exactly these two terms refer to.<br>
From its inception, ZFS has referred to the Zettabyte File System developed at Sun Microsystems and published under the CDDL Open Source license in 2005 as part of the OpenSolaris operating system. ZFS was revolutionary for completely decoupling the file system from specialized storage hardware and even a specific computer platform. The portable nature and advanced features of ZFS led FreeBSD, Linux, and even Apple developers to start porting ZFS to their operating systems and by 2008, FreeBSD shipped with ZFS in the 7.0 release. For the first time, ZFS empowered users of any budget with enterprise-class scalability and data integrity and management features like checksumming, compression and snapshotting, and those features remain unrivaled at any price to this day. On any ZFS platform, administrators use the zpool and zfs utilities to configure and manage their storage devices and file systems respectively. Both commands employ a user-friendly syntax such aszfs create mypool/mydataset and I welcome you to watch the appropriately-titled webinar Why we love ZFS &amp; you should too or try a completely-graphical ZFS experience with FreeNAS.<br>
Yes, ZFS is really as good as people say it is.<br>
After enjoying nearly a decade of refinement by a growing group of developers around the world, ZFS became the property of database vendor Oracle, which ceased public development of both ZFS and OpenSolaris in 2010. Disappointed but undeterred, a group of OpenSolaris users and developers forked the last public release of OpenSolaris as the Illumos project. To this day, Illumos represents the official upstream home of the Open Source OpenSolaris technologies, including ZFS. The Illumos project enjoys healthy vendor and user participation but the portable nature and compelling features of ZFS soon produced far more ZFS users than Illumos users around the world. While most if not all users of Illumos and its derivatives are ZFS users, the majority of ZFS users are not Illumos users, thanks significantly in part to FreeNAS which uses the FreeBSD operating system. This imbalance plus several successful ZFS Day events led ZFS co-founder Matt Ahrens and a group of ZFS developers to announce the OpenZFS project, which would remain a part of the Illumos code base but would be free to coordinate development efforts and events around their favorite file system. ZFS Day has grown into the two-day OpenZFS Developer Summit and is stronger than ever, a testament to the passion and dedication of the OpenZFS community.<br>
Oracle has steadily continued to develop its own proprietary branch of ZFS and Matt Ahrens points out that over 50% of the original OpenSolaris ZFS code has been replaced in OpenZFS with community contributions. This means that there are, sadly, two politically and technologically-incompatible branches of ZFS but fortunately, OpenZFS is orders of magnitude more popular thanks to its open nature. The two projects should be referred to as Oracle ZFS and OpenZFS to distinguish them as development efforts, but the user still types the zfs command, which on FreeBSD relies on the zfs.ko kernel module. My impression is that the terms of the CDDL license under which the OpenZFS branch of ZFS is published protects its users from any patent and trademark risks. Hopefully, this all helps you distinguish the OpenZFS project from the ZFS technology.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://explainshell.com/" rel="nofollow">Explaining Shell</a></li>
<li><a href="https://opnsense.org/opnsense-18-1-released/" rel="nofollow">OPNsense® 18.1 Released</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3104" rel="nofollow">SSH Mastery 2/e copyedits back</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3106" rel="nofollow">Sponsoring a Scam</a></li>
<li><a href="https://www.meetup.com/BAFUG-Bay-Area-FreeBSD-User-Group/events/246623825/" rel="nofollow">Thursday, February 8, 2018 - Come to Netflix to talk about FreeBSD</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/247552279/" rel="nofollow">BSD User Group meeting in Stockholm: March 22, 17:30 - 21:00</a></li>
<li>FreeBSD Flavoured talks from Linux.conf.au: <a href="https://www.youtube.com/watch?v=z-uWt5wVVkU" rel="nofollow">You cant unit test C, right?</a> and <a href="https://www.youtube.com/watch?v=qAhZEI_6lbc" rel="nofollow">A Brief History of I/O</a></li>
<li><a href="https://2018.eurobsdcon.org/" rel="nofollow">EuroBSDcon 2018 website is up</a></li>
<li><a href="http://bhyvecon.org/" rel="nofollow">Full day bhyvecon Tokyo, Japan, March 9, 2018</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Thomas - <a href="http://dpaste.com/3G2F7RC#wrap" rel="nofollow">freebsd installer improvements</a></li>
<li>Mohammad - <a href="http://dpaste.com/0HGK3FQ#wrap" rel="nofollow">FreeBSD 11 installation from a read only rescue disk</a></li>
<li>Stan - <a href="http://dpaste.com/2S169SH#wrap" rel="nofollow">Follow up on guide you covered</a></li>
<li>Jalal - <a href="http://dpaste.com/35N8QXP#wrap" rel="nofollow">couple questions</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We talk about our recent trip to FOSDEM, we discuss the pros and cons of permissive licensing, cover the installation of OpenBSD on a dedibox with full-disk encryption, the new Lumina guide repository, and we explain ZFS vs. OpenZFS.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>[FOSDEM Trip report]</h3>

<ul>
<li>Your BSDNow hosts were both at FOSDEM in Brussels, Belgium over the weekend.</li>
<li>On the friday before FOSDEM, we held a FreeBSD devsummit (3rd consecutive year), sponsored by the FreeBSD Foundation and organized by Benedict (with the help from Kristof Provost, who did it in previous years but could not make it this year). We had 21 people attend, a good mixture of FreeBSD committers (mostly ports) and guests. After introductions, we collected topics and discussed various topics, including a new plan for a future FreeBSD release roadmap (more frequent releases, so that features from HEAD can be tried out earlier in RELEASES). The devsummit concluded with a nice dinner in a nearby restaurant.</li>
<li>On Saturday, first day of FOSDEM, we set up the FreeBSD Foundation table with flyers, stickers, FreeBSD Journal print editions, and a small RPI 3 demo system that Deb Goodkin brought. Our table was located next to the Illumos table like last year. This allowed us to continue the good relationship that we have with the Illumos people and Allan helped a little bit getting bhyve to run on Illumos with UEFI. Meanwhile, our table was visited by a lot of people who would ask questions about FreeBSD, take info material, or talk about their use cases. We were busy refilling the table throughout the day and luckily, we had many helpers at the table. Some items we had ran out in the early afternoon, an indicator of how popular they were.</li>
<li>Saturday also featured a <a href="https://twitter.com/fosdembsd" rel="nofollow">BSD devroom</a>, organized by Rodrigo Osorio. You can find the list of talks and the recordings on the <a href="https://fosdem.org/2018/schedule/track/bsd/" rel="nofollow">BSD Devroom schedule</a>. The room was very crowded and popular. Deb Goodkin gave the opening talk with an overview of what the Foundation is doing to change the world. Other speakers from various BSD projects presented their talks after that with a range of topics. Among them, Allan gave his talk about <a href="https://fosdem.org/2018/schedule/event/zfs_advanced_integration/" rel="nofollow">ZFS: Advanced Integration</a>, while Benedict presented his <a href="https://fosdem.org/2018/schedule/event/reflections_on_reaching_unix_class_with_freebsd/" rel="nofollow">Reflections on Teaching a Unix Class With FreeBSD</a>.</li>
<li>Sunday was just as busy on the FreeBSD table as Saturday and we finally ran out of stickers and some other goodies. We were happy with the results of the two days. Some very interesting conversations at the table about FreeBSD took place, some of which were going to follow up afterwards.</li>
<li>Check out the FOSDEM schedule as many talk recordings are already available, and especially the ones from the BSD devroom if you could not attend the conference. We would like to thank everyone who attended the FreeBSD devsummit, who helped out at the FreeBSD table and organized the BSD devroom. Also, thanks to all the speakers, organizers, and helping hands making FOSDEM another success this year.
***</li>
</ul>

<h3><a href="http://blog.infosectcbr.com.au/2018/01/netbsd-kernel-wscons-ioctl-vulnerable.html" rel="nofollow">NetBSD kernel wscons IOCTL vulnerable bug class</a></h3>

<blockquote>
<p>I discovered this bug class during the InfoSect public code review session we ran looking specifically at the NetBSD kernel. I found a couple of these bugs and then after the session was complete, I went back and realised the same bug was scattered in other drivers. In total, 17 instances of this vulnerability and its variants were discovered.<br>
In all fairness, I came across this bug class during my kernel audits in 2002 and most instances were patched. It just seems there are more bugs now in NetBSD while OpenBSD and FreeBSD have practically eliminated them.</p>
</blockquote>

<ul>
<li><p>See slide 41 in <a href="http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-cesare.pdf" rel="nofollow">http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-cesare.pdf</a> for exactly the same bug (class) 16 years ago.</p></li>
<li><p>The format of the this blog post is as follows:</p></li>
<li><p>Introduction</p></li>
<li><p>Example of the Bug Class</p></li>
<li><p>How to Fix</p></li>
<li><p>How to Detect Automatically with Coccinelle</p></li>
<li><p>More Bugs</p></li>
<li><p>Conclusion</p></li>
<li><p>These source files had bugs</p></li>
</ul>

<pre><code>./dev/tc/tfb.c
./dev/ic/bt485.c
./dev/pci/radeonfb.c
./dev/ic/sti.c
./dev/sbus/tcx.c
./dev/tc/mfb.c
./dev/tc/sfb.c
./dev/tc/stic.c
./dev/tc/cfb.c
./dev/tc/xcfb.c
./dev/tc/sfbplus.c
./arch/arm/allwinner/awin_debe.c
./arch/arm/iomd/vidcvideo.c
./arch/pmax/ibus/pm.c
./dev/ic/igfsb.c
./dev/ic/bt463.c
./arch/luna68k/dev/lunafb.c
</code></pre>

<blockquote>
<p>Reporting of the bugs was easy. In less than a week from reporting the specific instances of each bug, patches were committed into the mainline kernel. Thanks to Luke Mewburn from NetBSD for coming to the code review session at InfoSect and coordinating with the NetBSD security team.</p>
</blockquote>

<ul>
<li>The patches to fix these issues are in NetBSD: <a href="https://mail-index.netbsd.org/source-changes/2018/01/24/msg091428.html" rel="nofollow">https://mail-index.netbsd.org/source-changes/2018/01/24/msg091428.html</a></li>
</ul>

<hr>

<h3><a href="https://eerielinux.wordpress.com/2017/11/25/permissive-licensing-is-wrong-is-it-1-2/" rel="nofollow">&quot;Permissive licensing is wrong!  Is it?</a></h3>

<blockquote>
<p>A few weeks ago Ive been attacked by some GNU zealots on a German tech site after speaking in favor of permissive licenses. Unfortunately a discussion was not possible there because that would require the will to actually communicate instead of simply accusing the other side of vile motives. Since I actually do care about this topic and a reader asked for a post about it in comments a while ago, here we go.</p>

<p>This first part tries to sum up the most important things around the topic. I deliberately aim for an objective overview that tries not to be one-sided. The second part will then contain my points in defence of permissive licensing.</p>
</blockquote>

<ul>
<li><p>Why license software at all?</p>

<blockquote>
<p>Licenses exist for reasons of protection. If youre the author/inventor of some software, a story or whatever product, you get to decide what to do with it. You can keep it for yourself or you can give it away. If you decide for the latter, you have to decide who may use it and in which way(s). In case you intend to give it to a (potentially) large group of people, you may not want to be asked for permission to xyz by everybody. Thats when you decide to write a license which states what you are allowing and explicitly disallowing.<br>
Most of the well-known commercial licenses focus on what youre not allowed to do (usually things like copying, disassembling, etc.). Open source licenses on the other hand are meant to grant the user rights (e.g. the right to distribute) while reserving some rights or only giving permission under certain conditions  and they usually make you claim responsibility for using the software. For these reasons licenses can actually be a good thing!<br>
If you got an unlicensed piece of code, youre not legally allowed to do anything with it without getting the authors permission first. And even if you got that permission, your project would be risky, since the author can withdraw it later. A proper license protects both parties. The author doesnt get his mail account full of email asking for permission, hes save from legal trouble if his code breaks anything for you and at the same time you have legal certainty when you decide to put the code to long-term use.</p>
</blockquote></li>
<li><p>Permissive vs. Copyleft (in a nutshell)</p></li>
</ul>

<blockquote>
<p>In short terms, permissive licensing usually goes like this: Here you are, have fun. Oh, and dont sue me if it does something else than what you expect! Yes, its that easy and theres little to dispute over.<br>
Copyleft on the other side sounds like this (if you ask somebody in favor of Copyleft): Sure, you can use it, its free. Just keep it free, ok?. Also quite simple. And not too bad, eh? Other people however read the same thing like this: Yes, youre free to use it. Just read these ten pages of legalese and be dead certain that you comply. If you got something wrong, we will absolutely make you regret it.</p>
</blockquote>

<ul>
<li>The GNU Public license (GPL)</li>
</ul>

<blockquote>
<p><a href="https://www.gnu.org/licenses/gpl.html" rel="nofollow">The most popular copyleft license in use is the GPL (in various versions)</a>. It got more and more complex with each version  and to be fair, it had to, because it was necessary to react to new threats and loop holes that were found later. The GNU project states that they are committed to protect what they call the four freedoms of free software:</p>
</blockquote>

<pre><code>the freedom to use the software for any purpose
the freedom to change the software to suit your needs
the freedom to share the software with your friends and neighbors
the freedom to share the changes you make
</code></pre>

<blockquote>
<p>These are freedoms that every supporter of open source software should be able to agree with. So whats the deal with all the hostility and fighting between the two camps? Lets take a look at a permissive license, too.</p>
</blockquote>

<ul>
<li>The BSD license</li>
</ul>

<blockquote>
<p>Unlike the GPL, the BSD family of licenses begun with a rather simple license that span four rules (original BSD license). It was later revised and reduced to three (modified BSD license). And the modern BSD license that e.g. FreeBSD uses is even just two (simplified BSD license).</p>

<p>Did you read the GPLv3 that I linked to above? If you are using GPLd code you really should. In case you dont feel like reading all of it, at least take a look and grasp how long that text is. <a href="https://opensource.org/licenses/bsd-license.php" rel="nofollow">Now compare it to the complete modern BSD license</a>.</p>
</blockquote>

<ul>
<li>Whats the problem?</li>
</ul>

<blockquote>
<p>There are essentially two problems that cause all the trouble. The first one is the question of what should be subject to the freedom that were talking about. And closely related, the second one is where that freedom needs to end.</p>

<p>Ironically both camps claim that freedom is the one important thing and it must not be restricted. The GPL is meant to protect the freedom of the software and enforces the availability of the source code, hence limiting the freedom of actual persons. BSD on the other hand is meant to protect the freedom of human beings who should be able to use the software as they see fit  even if that means closing down former open source code!</p>

<p>The GNU camp taunts permissive licenses as being lax for not providing the protection that they want. The other camp points out that the GPL is a complex monster and that it is virulent in nature: Since its very strict in a lot of areas, its incompatible with many other licenses. This makes it complicated to mix GPL and non-GPL code and in the cases where its legally possible, the GPLs terms will take precedence and necessarily be in effect for the whole combined work.</p>
</blockquote>

<ul>
<li>Whos right?</li>
</ul>

<blockquote>
<p>That totally depends on what you want to achieve. There are pros and cons to both  and in fact were only looking at the big picture here. Theres also e.g. the Apache license which is often deemed as kind of middle ground. Then you may want to consider the difference between weak (e.g. LGPL) as well as strong copyleft (GPL). Licensing is a potentially huge topic. But lets keep it simple here because the exact details are actually not necessary to understand the essence of our topic.</p>

<p>In the next post Ill present my stance on why permissive licensing is a good thing and copyleft is more problematic than many people may think.</p>
</blockquote>

<ul>
<li><a href="https://eerielinux.wordpress.com/2018/01/25/permissive-licensing-is-wrong-no-its-not-2-2/" rel="nofollow">Permissive licensing is wrong?  No its not!</a></li>
</ul>

<blockquote>
<p>The previous post gave a short introduction into the topic of software licenses, focusing on the GPL vs. BSD discussion. This one is basically my response to some typical arguments Ive seen from people who seem to loathe permissive licensing. Ill write this in dialog style, hoping that this makes it a little lighter to read.</p>
</blockquote>

<hr>

<h2>Roundup</h2>

<h3><a href="https://poolp.org/posts/2018-01-29/install-openbsd-on-dedibox-with-full-disk-encryption/" rel="nofollow">Install OpenBSD on dedibox with full-disk encryption</a></h3>

<ul>
<li>TL;DR:</li>
</ul>

<blockquote>
<p>I run several &quot;dedibox&quot; servers at online.net, all powered by OpenBSD. OpenBSD is not officially supported so you have to work-around. Running full-disk encrypted OpenBSD there is a piece of cake. As a bonus, my first steps within a brand new booted machine ;-)</p>
</blockquote>

<ul>
<li>Step #0: choosing your server</li>
</ul>

<blockquote>
<p>OpenBSD is not officially supported, I cant guarantee that this will work for you on any kind of server online.net provides, however Ive been running <a href="https://poolp.org" rel="nofollow">https://poolp.org</a> on OpenBSD there since 2008, only switching machines as they were getting a bit old and new offers came up.</p>

<p>Currently, Im running two SC 2016 (SATA) and one XC 2016 (SSD) boxes, all three running OpenBSD reliably ever since I installed them.</p>

<p>Recently Ive been willing to reinstall the XC one after I did some experiments that turned it into a FrankenBSD, so this was the right occasion to document how I do it for future references.</p>

<p>I wrote an article similar to this a few years ago relying on qemu to install to the disk, since then online.net provided access to a virtual serial console accessed within the browser, making it much more convenient to install without the qemu indirection which hid the NIC devices and disks duid and required tricks.</p>

<p>The method I currently use is a mix and adaptation from the techniques described in <a href="https://www.2f30.org/guides/openbsd-dedibox.html" rel="nofollow">https://www.2f30.org/guides/openbsd-dedibox.html</a> to boot the installer, and the technique described in <a href="https://geekyschmidt.com/2011/01/19/configuring-openbsd-softraid-fo-encryption.html" rel="nofollow">https://geekyschmidt.com/2011/01/19/configuring-openbsd-softraid-fo-encryption.html</a> to setup the crypto slice.</p>
</blockquote>

<ul>
<li>Step #1: boot to rescue mode</li>
<li>Step #2: boot to the installer</li>
<li>Step #3: prepare softraid</li>
<li>Step #4: reboot to encrypted OpenBSD system</li>
<li>Bonus: further tightening your system</li>
<li>enable doas</li>
<li>disable the root account</li>
<li>update system with syspatch</li>
<li>add my ssh public key to my ~/.ssh/authorized_keys</li>
<li>disable password authentication within ssh</li>
<li>reboot so you boot on a brand new up-to-date system with latest stable kernel</li>
<li>VOILA !</li>
</ul>

<hr>

<h3><a href="https://www.freebsdfoundation.org/blog/january-2018-development-projects-update/" rel="nofollow">January 2018 Development Projects Update</a></h3>

<ul>
<li>Spectre and Meltdown in FreeBSD</li>
</ul>

<blockquote>
<p>Issues affecting most CPUs used in servers, desktops, laptops, and mobile devices are in the news. These hardware vulnerabilities, known by the code-names Meltdown and Spectre, allow malicious programs to read data to which they should not have access. This potentially includes credentials, cryptographic material, or other secrets. They were originally identified by a researcher from Googles Project Zero, and were also independently discovered by researchers and academics from Cyberus Technology, Graz University of Technology, the University of Pennsylvania, the University of Maryland, Rambus, the University of Adelaide and Data61.</p>

<p>These vulnerabilities affect many CPU architectures supported by FreeBSD, but the 64-bit x86 family of processors from Intel and AMD are the most widely used, and are a high priority for software changes to mitigate the effects of Meltdown and Spectre. In particular, the Meltdown issue affects Intel CPUs and may be used to extract secret data from the running kernel, and therefore, is the most important issue to address.</p>

<p>The FreeBSD Foundation collaborates with Intel, and under this relationship participated in a briefing to understand the details of these issues and plan the mitigations to be applied to the x86 architectures supported by FreeBSD. We also made arrangements to have FreeBSDs security officer join me in the briefing. It is through the generous support of the Foundations donors that we are able to dedicate resources to focus on these issues on demand as they arise.</p>

<p>Foundation staff member Konstantin (Kostik) Belousov is an expert on FreeBSDs Virtual Memory (VM) system as well as low-level x86 details, and is developing the x86 kernel mitigations for FreeBSD.</p>

<p>The mitigation for Meltdown is known as Page Table Isolation (PTI). Kostik created a PTI implementation which was initially committed in mid-January and is available in the FreeBSD-CURRENT development repository. This is the same approach used by the Linux kernel to mitigate Meltdown.</p>

<p>One of the drawbacks of the PTI mitigation is that it incurs a performance regression. Kostik recently reworked FreeBSDs use of Process-Context Identifiers (PCID) in order to regain some of the performance loss incurred by PTI. This change is also now available in FreeBSD-CURRENT.</p>

<p>The issue known as Spectre comes in two variants, and variant 2 is the more troubling and pressing one. It may be mitigated in one of two ways: by using a technique called retpoline in the compiler, or by making use of a CPU feature introduced in a processor microcode update. Both options are under active development. Kostiks change to implement the CPU-based mitigation is currently in review. Unfortunately, it introduces a significant performance penalty and alternatives are preferred, if available.</p>

<p>For most cases, the compiler-based retpoline mitigation is likely to be the chosen mitigation. Having switched to the Clang compiler for the base system and most of the ports collection some years ago, FreeBSD is well-positioned to deploy Clang-based mitigations. FreeBSD developer Dimitry Andric is spearheading the update of Clang/LLVM in FreeBSD to version 6.0 in anticipation of its official release; FreeBSD-CURRENT now includes an interim snapshot. I have been assisting with the import, particularly with respect to LLVMs lld linker, and will support the integration of retpoline. This support is expected to be merged into FreeBSD in the coming weeks.</p>

<p>The Foundations co-op students have also participated in the response to these vulnerabilities. Mitchell Horne developed the patch to control the PTI mitigation default setting, while Arshan Khanifar benchmarked the performance impact of the in-progress mitigation patches. In addition, Arshan and Mitchell each developed changes to FreeBSDs tool chain to support the full set of mitigations that will be applied.</p>

<p>These mitigations will continue be tested, benchmarked, and refined in FreeBSD-CURRENT before being merged into stable branches and then being made available as updates to FreeBSD releases. Details on the timing of these merges and releases will be shared as they become available.</p>

<p>I would like to acknowledge all of those in the FreeBSD community who have participated in FreeBSDs response to Meltdown and Spectre, for testing, reviewing, and coordinating x86 mitigations, for developing mitigations for other processor architectures and for the Bhyve hypervisor, and for working on the toolchain-based mitigations.</p>
</blockquote>

<hr>

<h3><a href="https://lumina-desktop.org/guides-getting-started-lumina-themes/" rel="nofollow">Guides: Getting Started &amp; Lumina Theme Submissions</a></h3>

<blockquote>
<p>I am pleased to announce the beginning of a new sub-series of blog posts for the Lumina project: Guides!</p>

<p>The TrueOS/Lumina projects want to support our users as they use Lumina or experiment with TrueOS. To that end, weve recently set up a central repository for our users to share instructions or other how-to guides with each other! Project developers and contributors will also submit guides to the repository on occasion, but the overall goal is to provide a simple hub for instructions written by any Lumina or TrueOS user. This will make it easier for users to not only find a how-to for some procedure, but also a very easy way to give back to the community by writing simple instructions or more detailed guides.</p>
</blockquote>

<ul>
<li>Guides Repository</li>
</ul>

<blockquote>
<p>Our first guide to get the whole thing started was created by the <a href="https://discourse.trueos.org/t/introducing-the-trueos-linebacker/991" rel="nofollow">TrueOS Linebacker</a>  (with technical assistance from our own q5sys). In this guide, Terry Tate will walk you through the steps necessary to submit new wallpaper images to the Lumina Themes collection. This procedure is fully documented with screenshots every step of the way, walking you through a simple procedure that only requires a web browser and a Github account!</p>
</blockquote>

<ul>
<li><a href="https://github.com/trueos/guides/blob/master/lumina-themes-submissions/readme.md" rel="nofollow">Guide: Lumina Themes Submissions</a></li>
</ul>

<blockquote>
<p>The end result of this guide was that Terry Tate was able to submit this cool new Lunar-4K wallpaper to the lumina-nature collection.</p>
</blockquote>

<ul>
<li><a href="https://github.com/trueos/guides/tree/master" rel="nofollow">TrueOS Community Guides</a></li>
</ul>

<hr>

<h3><a href="https://www.ixsystems.com/blog/zfs-vs-openzfs/" rel="nofollow">ZFS vs. OpenZFS (by Michael Dexter)</a></h3>

<blockquote>
<p>Youve probably heard us say a mix of ZFS and OpenZFS and an explanation is long-overdue. Our Senior Analyst clears up what ZFS and OpenZFS refer to and how they differ.<br>
I admit that we geeks tend to get caught up in the nuts and bolts of enterprise storage and overlook the more obvious questions that users might have. Youve probably noticed that this blog and the FreeNAS blog refer to ZFS and OpenZFS seemingly at random when talking about the amazing file system at the heart of FreeNAS and every storage product that iXsystems sells. I will do my best to clarify what exactly these two terms refer to.<br>
From its inception, ZFS has referred to the Zettabyte File System developed at Sun Microsystems and published under the CDDL Open Source license in 2005 as part of the OpenSolaris operating system. ZFS was revolutionary for completely decoupling the file system from specialized storage hardware and even a specific computer platform. The portable nature and advanced features of ZFS led FreeBSD, Linux, and even Apple developers to start porting ZFS to their operating systems and by 2008, FreeBSD shipped with ZFS in the 7.0 release. For the first time, ZFS empowered users of any budget with enterprise-class scalability and data integrity and management features like checksumming, compression and snapshotting, and those features remain unrivaled at any price to this day. On any ZFS platform, administrators use the zpool and zfs utilities to configure and manage their storage devices and file systems respectively. Both commands employ a user-friendly syntax such aszfs create mypool/mydataset and I welcome you to watch the appropriately-titled webinar Why we love ZFS &amp; you should too or try a completely-graphical ZFS experience with FreeNAS.<br>
Yes, ZFS is really as good as people say it is.<br>
After enjoying nearly a decade of refinement by a growing group of developers around the world, ZFS became the property of database vendor Oracle, which ceased public development of both ZFS and OpenSolaris in 2010. Disappointed but undeterred, a group of OpenSolaris users and developers forked the last public release of OpenSolaris as the Illumos project. To this day, Illumos represents the official upstream home of the Open Source OpenSolaris technologies, including ZFS. The Illumos project enjoys healthy vendor and user participation but the portable nature and compelling features of ZFS soon produced far more ZFS users than Illumos users around the world. While most if not all users of Illumos and its derivatives are ZFS users, the majority of ZFS users are not Illumos users, thanks significantly in part to FreeNAS which uses the FreeBSD operating system. This imbalance plus several successful ZFS Day events led ZFS co-founder Matt Ahrens and a group of ZFS developers to announce the OpenZFS project, which would remain a part of the Illumos code base but would be free to coordinate development efforts and events around their favorite file system. ZFS Day has grown into the two-day OpenZFS Developer Summit and is stronger than ever, a testament to the passion and dedication of the OpenZFS community.<br>
Oracle has steadily continued to develop its own proprietary branch of ZFS and Matt Ahrens points out that over 50% of the original OpenSolaris ZFS code has been replaced in OpenZFS with community contributions. This means that there are, sadly, two politically and technologically-incompatible branches of ZFS but fortunately, OpenZFS is orders of magnitude more popular thanks to its open nature. The two projects should be referred to as Oracle ZFS and OpenZFS to distinguish them as development efforts, but the user still types the zfs command, which on FreeBSD relies on the zfs.ko kernel module. My impression is that the terms of the CDDL license under which the OpenZFS branch of ZFS is published protects its users from any patent and trademark risks. Hopefully, this all helps you distinguish the OpenZFS project from the ZFS technology.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://explainshell.com/" rel="nofollow">Explaining Shell</a></li>
<li><a href="https://opnsense.org/opnsense-18-1-released/" rel="nofollow">OPNsense® 18.1 Released</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3104" rel="nofollow">SSH Mastery 2/e copyedits back</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3106" rel="nofollow">Sponsoring a Scam</a></li>
<li><a href="https://www.meetup.com/BAFUG-Bay-Area-FreeBSD-User-Group/events/246623825/" rel="nofollow">Thursday, February 8, 2018 - Come to Netflix to talk about FreeBSD</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/247552279/" rel="nofollow">BSD User Group meeting in Stockholm: March 22, 17:30 - 21:00</a></li>
<li>FreeBSD Flavoured talks from Linux.conf.au: <a href="https://www.youtube.com/watch?v=z-uWt5wVVkU" rel="nofollow">You cant unit test C, right?</a> and <a href="https://www.youtube.com/watch?v=qAhZEI_6lbc" rel="nofollow">A Brief History of I/O</a></li>
<li><a href="https://2018.eurobsdcon.org/" rel="nofollow">EuroBSDcon 2018 website is up</a></li>
<li><a href="http://bhyvecon.org/" rel="nofollow">Full day bhyvecon Tokyo, Japan, March 9, 2018</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Thomas - <a href="http://dpaste.com/3G2F7RC#wrap" rel="nofollow">freebsd installer improvements</a></li>
<li>Mohammad - <a href="http://dpaste.com/0HGK3FQ#wrap" rel="nofollow">FreeBSD 11 installation from a read only rescue disk</a></li>
<li>Stan - <a href="http://dpaste.com/2S169SH#wrap" rel="nofollow">Follow up on guide you covered</a></li>
<li>Jalal - <a href="http://dpaste.com/35N8QXP#wrap" rel="nofollow">couple questions</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>231: Unix Architecture Evolution</title>
  <link>https://www.bsdnow.tv/231</link>
  <guid isPermaLink="false">06b29fa5-0520-4e4d-a373-9e10de3ea498</guid>
  <pubDate>Thu, 01 Feb 2018 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/06b29fa5-0520-4e4d-a373-9e10de3ea498.mp3" length="61159252" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We cover an interview about Unix Architecture Evolution, another vBSDcon trip report, how to teach an old Unix about backspace, new NUMA support coming to FreeBSD, and stack pointer checking in OpenBSD.</itunes:subtitle>
  <itunes:duration>1:24:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We cover an interview about Unix Architecture Evolution, another vBSDcon trip report, how to teach an old Unix about backspace, new NUMA support coming to FreeBSD, and stack pointer checking in OpenBSD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Unix Architecture Evolution from the 1970 PDP-7 to the 2017 FreeBSD (https://fosdem.org/2018/interviews/diomidis-spinellis/)
Q: Could you briefly introduce yourself?
I’m a professor of software engineering, a programmer at heart, and a technology author. Currently I’m also the editor in chief of the IEEE Software magazine. I recently published the book Effective Debugging, where I detail 66 ways to debug software and systems.
Q: What will your talk be about, exactly?
I will describe how the architecture of the Unix operating system evolved over the past half century, starting from an unnamed system written in PDP-7 assembly language and ending with a modern FreeBSD system. My talk is based, first, on a GitHub repository where I tried to record the system’s history from 1970 until today and, second, on the evolution of documented facilities (user commands, system calls, library functions) across revisions. I will thus present the early system’s defining architectural features (layering, system calls, devices as files, an interpreter, and process management) and the important ones that followed in subsequent releases: the tree directory structure, user contributed code, I/O redirection, the shell as a user program, groups, pipes, scripting, and little languages.
Q: Why this topic?
Unix stands out as a major engineering breakthrough due to its exemplary design, its numerous technical contributions, its impact, its development model, and its widespread use. Furthermore, the design of the Unix programming environment has been characterized as one offering unusual simplicity, power, and elegance. Consequently, there are many lessons that we can learn by studying the evolution of the Unix architecture, which we can apply to the design of new systems. I often see modern systems that suffer from a bloat of architectural features and a lack of clear form on which functionality can be built. I believe that many of the modern Unix architecture defining features are excellent examples of what we should strive toward as system architects.
Q: What do you hope to accomplish by giving this talk? What do you expect?
I’d like FOSDEM attendees to leave the talk with their mind full with architectural features of timeless quality. I want them to realize that architectural elegance isn’t derived by piling design patterns and does not need to be expensive in terms of resources. Rather, beautiful architecture can be achieved on an extremely modest scale. Furthermore, I want attendees to appreciate the importance of adopting flexible conventions rather than rigid enforcement mechanisms. Finally, I want to demonstrate through examples that the open source culture was part of Unix from its earliest days.
Q: What are the most significant milestones in the development of Unix?
The architectural development of Unix follows a path of continuous evolution, albeit at a slowing pace, so I don’t see here the most important milestones. I would however define as significant milestones two key changes in the way Unix was developed. The first occurred in the late 1970s when significant activity shifted from a closely-knit team of researchers at the AT&amp;amp;T Bell Labs to the Computer Science Research Group in the University of California at Berkeley. This opened the system to academic contributions and growth through competitive research funding. The second took place in the late 1980s and the 1990s when Berkeley open-sourced the the code it had developed (by that time a large percentage of the system) and enthusiasts built on it to create complete open source operating system distributions: 386BSD, and then FreeBSD, NetBSD, OpenBSD, and others.
Q: In which areas has the development of Unix stalled?
The data I will show demonstrate that there were in the past some long periods where the number of C library functions and system calls remained mostly stable. Nowadays there is significant growth in the number of all documented facilities with the exception of file formats. I’m looking forward to a discussion regarding the meaning of these growth patterns in the Q&amp;amp;A session after the talk.
Q: What are the core features that still link the 1970 PDP-7 system to the latest FreeBSD 11.1 release, almost half a century apart?
Over the past half-century the Unix system has grown by four orders of magnitude from a few thousand lines of code to many millions. Nevertheless, looking at a 1970s architecture diagram and a current one reveals that the initial architectural blocks are still with us today. Furthermore, most system calls, user programs, and C library functions of that era have survived until today with essentially similar functionality. I’ve even found in modern FreeBSD some lines of code that have survived unchanged for 40 years.
Q: Can we still add innovative changes to operating systems like FreeBSD without breaking the ‘Unix philosophy’? Will there be a moment where FreeBSD isn’t recognizable anymore as a descendant of the 1970 PDP-7 system?
There’s a saying that “form liberates”. So having available a time-tested form for developing operating system functionality allows you to innovate in areas that matter rather than reinventing the wheel.
Such concepts include having commands act as a filter, providing manual pages with a consistent structure, supplying build information in the form of a Makefile, installing files in a well-defined directory hierarchy, implementing filesystems with an standardized object-oriented interface, and packaging reusable functions as a library. Within this framework there’s ample space for both incremental additions (think of jq, the JSON query command) and radical innovations (consider the Solaris-derived ZFS and dtrace functionality). For this reason I think that BSD and Linux systems will always be recognizable as direct or intellectual descendants of the 1970s Research Unix editions.
Q: Have you enjoyed previous FOSDEM editions?
Immensely! As an academic I need to attend many scientific conferences and meetings in order to present research results and interact with colleagues. This means too much time spent traveling and away from home, and a limited number of conferences I’m in the end able to attend. Nevertheless, attending FOSDEM is an easy decision due to the world-changing nature of its theme, the breadth of the topics presented, the participants’ enthusiasm and energy, as well as the exemplary, very efficient conference organization.
Another vBSDCon trip report we just found (https://www.weaponizedawesome.com/blog/?cat=53)
We just got tipped about another trip report from vBSDCon, this time from one of the first time speakers: W. Dean Freeman
Recently I had the honor of co-presenting on the internals of FreeBSD’s Kernel RNG with John-Mark Gurney at the 3rd biennial vBSDCon, hosted in Reston, VA hosted by Verisign.
I’ve been in and out of the FreeBSD community for about 20 years. As I’ve mentioned on here before, my first Unix encounter was FreeBSD 2.2.8 when I was in the 7th or 8th grade. However, for all that time I’ve never managed to get out to any of the cons. I’ve been to one or two BUG meetings and I’ve met some folks from IRC before, but nothing like this.
A BSD conference is a very different experience than anything else out there. You have to try it, it is the only way to truly understand it.
I’d also not had to do a stand-up presentation really since college before this. So, my first BSD con and my first time presenting rolled into one made for an interesting experience.
See, he didn’t say terrifying. It went very well. You should totally submit a talk for the next conference, even if it is your first.
That said, it was amazing and invigorating experience. I got to meet a few big names in the FreeBSD community, discuss projects, ideas for FreeBSD, etc. I did seem to spend an unusual amount of time talking about FIPS and Common Criteria with folks, but to me that’s a good sign and indicative that there is interest in working to close gaps between FreeBSD and the current requirements so that we can start getting FreeBSD and more BSD-based products into the government and start whittling away the domination of Linux (especially since Oracle has cut Solaris, SPARC and the ZFS storage appliance business units).
There is nothing that can match the high bandwidth interchange of ideas in person. The internet has made all kinds of communication possible, and we use it all the time, but every once in a while, getting together in person is hugely valuable.
Dean then went on to list some of the talks he found most valuable, including DTrace, Capsicum, bhyve, *BSD security tools, and Paul Vixie’s talk about gets()
I think the talk that really had the biggest impact on me, however, was Kyle Kneisl’s talk on BSD community dynamics. One of the key points he asked was whether the things that drew us to the BSD community in the first place would be able to happen today. Obviously, I’m not a 12 or 13 year old kid anymore, but it really got me thinking. That, combined with getting face time with people I’d previously only known as screen names has recently drawn me back into participating in IRC and rejoining mailing lists (wdf on freenode. be on the lookout!)
Then Dean covered some thoughts on his own talk:
JMG and my talk seems to have been well received, with people paying lots of attention. I don’t know what a typical number of questions is for one of these things, but on day one there weren’t that many questions.  We got about 5 during our question time and spent most of the rest of the day fielding questions from interested attendees. Getting a “great talk!” from GNN after coming down from the stage was probably one of the major highlights for me.
I remember my first solo talk, and GNN asking the right question in the middle to get me to explain a part of it I had missed. It was very helpful.
I think key to the interest in our presentation was that JMG did a good job framing a very complicated topic’s importance in terms everyone could understand.  It also helped that we got to drop some serious truth bombs.
Final Thoughts:
I met a lot of folks in person for the first time, and met some people I’d never known online before. It was a great community and I’m glad I got a chance to expand my network.
Verisign were excellent hosts and they took good care of both speakers (covering airfare, rooms, etc.) and also conference attendees at large. The dinners that they hosted were quite good as well.
I’m definitely interested in attending vBSDCon again and now that I’ve had a taste of meeting IRL with the community on scale of more than a handful, I have every intention of finally making it to BSDCan next year (I’d said it in 2017, but then moved to Texas for a new job and it wasn’t going to be practical). This year for sure, though!
Teaching an Almost 40-year Old UNIX about Backspace (https://virtuallyfun.com/2018/01/17/teaching_an_almost_40-year_old_unix_about_backspace/)
Introduction
I have been messing with the UNIX® operating system, Seventh Edition (commonly known as UNIX V7 or just V7) for a while now. V7 dates from 1979, so it’s about 40 years old at this point. The last post was on V7/x86, but since I’ve run into various issues with it, I moved on to a proper installation of V7 on SIMH. The Internet has some really good resources on installing V7 in SIMH. Thus, I set out on my own journey on installing and using V7 a while ago, but that was remarkably uneventful.
One convenience that I have been dearly missing since the switch from V7/x86 is a functioning backspace key. There seem to be multiple different definitions of backspace:
BS, as in ASCII character 8 (010, 0x08, also represented as ^H), and
DEL, as in ASCII character 127 (0177, 0x7F, also represented as ^?).
V7 does not accept either for input by default. Instead, # is used as the erase character and @ is used as the kill character. These defaults have been there since UNIX V1. In fact, they have been “there” since Multics, where they got chosen seemingly arbitrarily. The erase character erases the character before it. The kill character kills (deletes) the whole line. For example, “ba##gooo#d” would be interpreted as “good” and “bad line@good line” would be interpreted as “good line”.
There is some debate on whether BS or DEL is the correct character for terminals to send when the user presses the backspace key. However, most programs have settled on DEL today. tmux forces DEL, even if the terminal emulator sends BS, so simply changing my terminal to send BS was not an option. The change from the defaults outlined here to today’s modern-day defaults occurred between 4.1BSD and 4.2BSD. enf on Hacker News has written a nice overview of the various conventions
Getting the Diff
For future generations as well as myself when I inevitably majorly break this installation of V7, I wanted to make a diff. However, my V7 is installed in SIMH. I am not a very intelligent man, I didn’t keep backup copies of the files I’d changed. Getting data out of this emulated machine is an exercise in frustration.
In the end, I printed everything on screen using cat(1) and copied that out. Then I performed a manual diff against the original source code tree because tabs got converted to spaces in the process. Then I applied the changes to clean copies that did have the tabs. And finally, I actually invoked diff(1).
Closing Thoughts
Figuring all this out took me a few days. Penetrating how the system is put together was surprisingly fairly hard at first, but then the difficulty curve eased up. It was an interesting exercise in some kind of “reverse engineering” and I definitely learned something about tty handling. I was, however, not pleased with using ed(1), even if I do know the basics. vi(1) is a blessing that I did not appreciate enough until recently. Had I also been unable to access recursive grep(1) on my host and scroll through the code, I would’ve probably given up. Writing UNIX under those kinds of editing conditions is an amazing feat. I have nothing but the greatest respect for software developers of those days.
News Roundup
New NUMA support coming to FreeBSD CURRENT (https://lists.freebsd.org/pipermail/freebsd-current/2018-January/068145.html)
Hello folks,
I am working on merging improved NUMA support with policy implemented by cpuset(2) over the next week.  This work has been supported by Dell/EMC's Isilon product division and Netflix.  You can see some discussion of these changes here:
https://reviews.freebsd.org/D13403
https://reviews.freebsd.org/D13289
https://reviews.freebsd.org/D13545
The work has been done in user/jeff/numa if you want to look at svn history or experiment with the branch.  It has been tested by Peter Holm on i386 and amd64 and it has been verified to work on arm at various points.
We are working towards compatibility with libnuma and linux mbind.  These commits will bring in improved support for NUMA in the kernel.  There are new domain specific allocation functions available to kernel for UMA, malloc, kmem, and vmpage*.  busdmamem consumers will automatically be placed in the correct domain, bringing automatic improvements to some 
device performance.
cpuset will be able to constrains processes, groups of processes, jails, etc. to subsets of the system memory domains, just as it can with sets of cpus.  It can set default policy for any of the above.  Threads can use cpusets to set policy that specifies a subset of their visible domains.
Available policies are first-touch (local in linux terms), round-robin (similar to linux interleave), and preferred.  For now, the default is round-robin.  You can achieve a fixed domain policy by using round-robin with a bitmask of a single domain.  As the scheduler and VM become more 
sophisticated we may switch the default to first-touch as linux does.
Currently these features are enabled with VMNUMAALLOC and MAXMEMDOM.  It will eventually be NUMA/MAXMEMDOM to match SMP/MAXCPU.  The current NUMA syscalls and VMNUMAALLOC code was 'experimental' and will be deprecated. numactl will continue to be supported although cpuset should be preferred going forward as it supports the full feature set of the new API.
Thank you for your patience as I deal with the inevitable fallout of such sweeping changes.  If you do have bugs, please file them in bugzilla, or reach out to me directly.  I don't always have time to catch up on all of my mailing list mail and regretfully things slip through the cracks when 
they are not addressed directly to me.
Thanks,
Jeff
Stack pointer checking – OpenBSD (https://marc.info/?l=openbsd-tech&amp;amp;m=151572838911297&amp;amp;w=2)
Stefan (stefan@) and I have been working for a few months on this diff, with help from a few others.
At every trap and system call, it checks if the stack-pointer is on a page that is marked MAPSTACK.  execve() is changed to create such mappings for the process stack.  Also, libpthread is taught the new MAPSTACK flag to use with mmap().
There is no corresponding system call which can set MAP_FLAG on an existing page, you can only set the flag by mapping new memory into place.  That is a piece of the security model.
The purpose of this change is to twart stack pivots, which apparently have gained some popularity in JIT ROP attacks.  It makes it difficult to place the ROP stack in regular data memory, and then perform a system call from it.  Workarounds are cumbersome, increasing the need for far more gadgetry.  But also the trap case -- if any memory experiences a demand page fault, the same check will occur and potentially also kill the process.
We have experimented a little with performing this check during device interrupts, but there are some locking concerns and performance may then become a concern.  It'll be best to gain experience from handle of syncronous trap cases first.
chrome and other applications I use run fine!
I'm asking for some feedback to discover what ports this breaks, we'd like to know.  Those would be ports which try to (unconventionally) create their stacks in malloc()'d memory or inside another Data structure.  Most of them are probably easily fixed ...
Qt 5.9 on FreeBSD (https://euroquis.nl/bobulate/?p=1768)
Tobias and Raphael have spent the past month or so hammering on the Qt 5.9 branch, which has (finally!) landed in the official FreeBSD ports tree. This brings FreeBSD back up-to-date with current Qt releases and, more importantly, up-to-date with the Qt release KDE software is increasingly expecting. With Qt 5.9, the Elisa music player works, for instance (where it has run-time errors with Qt 5.7, even if it compiles). The KDE-FreeBSD CI system has had Qt 5.9 for some time already, but that was hand-compiled and jimmied into the system, rather than being a “proper” ports build.
The new Qt version uses a new build system, which is one of the things that really slowed us down from a packaging perspective. Some modules have been reshuffled in the process. Some applications depending on Qt internal-private headers have been fixed along the way. The Telegram desktop client continues to be a pain in the butt that way.
Following on from Qt 5.9 there has been some work in getting ready for Clang 6 support; in general the KDE and Qt stack is clean and modern C++, so it’s more infrastructural tweaks than fixing code. Outside of our silo, I still see lots of wonky C++ code being fixed and plenty of confusion between pointers and integers and strings and chars and .. ugh. Speaking of ugh, I’m still planning to clean up Qt4 on ARM aarch64 for FreeBSD; this boils down to stealing suitable qatomic implementations from Arch Linux.
For regular users of Qt applications on FreeBSD, there should be few to no changes required outside the regular upgrade cycle. For KDE Plasma users, note that development of the ports has changed branches; as we get closer to actually landing modern KDE bits, things have been renamed and reshuffled and mulled over so often that the old plasma5 branch wasn’t really right anymore. The kde5-import branch is where it’s at nowadays, and the instructions are the same: the x11/kde5 metaport will give you all the KDE Frameworks 5, KDE Plasma Desktop and modern KDE Applications you need.
Adding IPv6 to an Nginx website on FreeBSD / FreshPorts (https://dan.langille.org/2018/01/13/adding-ipv6-to-an-nginx-website-on-freebsd-freshports/)
FreshPorts recently moved to an IPv6-capable server but until today, that capability has not been utilized.
There were a number of things I had to configure, but this will not necessarily be an exhaustive list for you to follow. Some steps might be missing, and it might not apply to your situation.
All of this took about 3 hours.
We are using:
FreeBSD 11.1
Bind 9.9.11
nginx 1.12.2
Fallout
I expect some monitoring fallout from this change. I suspect some of my monitoring assumes IP4 and now that IPv6 is available, I need to monitor both IP addresses.
ZFS on TrueOS: Why We Love OpenZFS (https://www.trueos.org/blog/zfs-trueos-love-openzfs/)
TrueOS was the first desktop operating system to fully implement the OpenZFS (Zettabyte File System or ZFS for short) enterprise file system in a stable production environment. To fully understand why we love ZFS, we will look back to the early days of TrueOS (formerly PC-BSD). The development team had been using the UFS file system in TrueOS because of its solid track record with FreeBSD-based computer systems and its ability to check file consistency with the built-in check utility fsck.
However, as computing demands increased, problems began to surface. Slow fsck file verification on large file systems, slow replication speeds, and inconsistency in data integrity while using UFS logging / journaling began to hinder users. It quickly became apparent that TrueOS users would need a file system that scales with evolving enterprise storage needs, offers the best data protection, and works just as well on a hobbyist system or desktop computer.
Kris Moore, the founder of the TrueOS project, first heard about OpenZFS in 2007 from chatter on the FreeBSD mailing lists. In 2008, the TrueOS development team was thrilled to learn that the FreeBSD Project had ported ZFS. At the time, ZFS was still unproven as a graphical desktop solution, but Kris saw a perfect opportunity to offer ZFS as a cutting-edge file system option in the TrueOS installer, allowing the TrueOS project to act as an indicator of how OpenZFS would fair in real-world production use.
The team was blown away by the reception and quality of OpenZFS on FreeBSD-based systems. By its nature, ZFS is a copy-on-write (CoW) file system that won’t move a block of data until it both writes the data and verifies its integrity. This is very different from most other file systems in use today. ZFS is able to assure that data stays consistent between writes by automatically comparing write checksums, which mitigates bit rot. ZFS also comes with native RaidZ functionality that allows for enterprise data management and redundancy without the need for expensive traditional RAID cards. ZFS snapshots allow for system configuration backups in a split-second. You read that right. TrueOS can backup or restore snapshots in less than a second using the ZFS file system.
Given these advantages, the TrueOS team decided to use ZFS as its exclusive file system starting in 2013, and we haven’t looked back since. ZFS offers TrueOS users the stable workstation experience they want, while simultaneously scaling to meet the increasing demands of the enterprise storage market. TrueOS users are frequently commenting on how easy it is to use ZFS snapshots with our built-in snapshot utility. This allows users the freedom to experiment with their system knowing they can restore it in seconds if anything goes wrong. If you haven’t had a chance to try ZFS with TrueOS, browse to our download page and make sure to grab a copy of TrueOS. You’ll be blown away by the ease of use, data protection functionality, and incredible flexibility of RaidZ.
Beastie Bits
Source Code Podcast Interview with Michael W Lucas (https://blather.michaelwlucas.com/archives/3099)
Operating System of the Year 2017: NetBSD Third place (https://w3techs.com/blog/entry/web_technologies_of_the_year_2017)
OPNsense 18.1-RC1 released (https://opnsense.org/opnsense-18-1-rc1-released/)
Personal OpenBSD Wiki Notes (https://balu-wiki.readthedocs.io/en/latest/security/openbsd.html)
BSD section can use some contribution (https://guide.freecodecamp.org/bsd-os/)
The Third Research Edition Unix Programmer's Manual (now available in PDF) (https://github.com/dspinellis/unix-v3man)
Feedback/Questions
Alex - my first freebsd bug (http://dpaste.com/3DSV7BC#wrap)
John - Suggested Speakers (http://dpaste.com/2QFR4MT#wrap) 
Todd - Two questions (http://dpaste.com/2FQ450Q#wrap)
Matthew - CentOS to FreeBSD (http://dpaste.com/3KA29E0#wrap)
Brian - Brian - openbsd 6.2 and enlightenment .17 (http://dpaste.com/24DYF1J#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We cover an interview about Unix Architecture Evolution, another vBSDcon trip report, how to teach an old Unix about backspace, new NUMA support coming to FreeBSD, and stack pointer checking in OpenBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://fosdem.org/2018/interviews/diomidis-spinellis/" rel="nofollow">Unix Architecture Evolution from the 1970 PDP-7 to the 2017 FreeBSD</a></h3>

<ul>
<li>Q: Could you briefly introduce yourself?</li>
</ul>

<blockquote>
<p>Im a professor of software engineering, a programmer at heart, and a technology author. Currently Im also the editor in chief of the IEEE Software magazine. I recently published the book Effective Debugging, where I detail 66 ways to debug software and systems.</p>
</blockquote>

<ul>
<li>Q: What will your talk be about, exactly?</li>
</ul>

<blockquote>
<p>I will describe how the architecture of the Unix operating system evolved over the past half century, starting from an unnamed system written in PDP-7 assembly language and ending with a modern FreeBSD system. My talk is based, first, on a GitHub repository where I tried to record the systems history from 1970 until today and, second, on the evolution of documented facilities (user commands, system calls, library functions) across revisions. I will thus present the early systems defining architectural features (layering, system calls, devices as files, an interpreter, and process management) and the important ones that followed in subsequent releases: the tree directory structure, user contributed code, I/O redirection, the shell as a user program, groups, pipes, scripting, and little languages.</p>
</blockquote>

<ul>
<li>Q: Why this topic?</li>
</ul>

<blockquote>
<p>Unix stands out as a major engineering breakthrough due to its exemplary design, its numerous technical contributions, its impact, its development model, and its widespread use. Furthermore, the design of the Unix programming environment has been characterized as one offering unusual simplicity, power, and elegance. Consequently, there are many lessons that we can learn by studying the evolution of the Unix architecture, which we can apply to the design of new systems. I often see modern systems that suffer from a bloat of architectural features and a lack of clear form on which functionality can be built. I believe that many of the modern Unix architecture defining features are excellent examples of what we should strive toward as system architects.</p>
</blockquote>

<ul>
<li>Q: What do you hope to accomplish by giving this talk? What do you expect?</li>
</ul>

<blockquote>
<p>Id like FOSDEM attendees to leave the talk with their mind full with architectural features of timeless quality. I want them to realize that architectural elegance isnt derived by piling design patterns and does not need to be expensive in terms of resources. Rather, beautiful architecture can be achieved on an extremely modest scale. Furthermore, I want attendees to appreciate the importance of adopting flexible conventions rather than rigid enforcement mechanisms. Finally, I want to demonstrate through examples that the open source culture was part of Unix from its earliest days.</p>
</blockquote>

<ul>
<li>Q: What are the most significant milestones in the development of Unix?</li>
</ul>

<blockquote>
<p>The architectural development of Unix follows a path of continuous evolution, albeit at a slowing pace, so I dont see here the most important milestones. I would however define as significant milestones two key changes in the way Unix was developed. The first occurred in the late 1970s when significant activity shifted from a closely-knit team of researchers at the AT&amp;T Bell Labs to the Computer Science Research Group in the University of California at Berkeley. This opened the system to academic contributions and growth through competitive research funding. The second took place in the late 1980s and the 1990s when Berkeley open-sourced the the code it had developed (by that time a large percentage of the system) and enthusiasts built on it to create complete open source operating system distributions: 386BSD, and then FreeBSD, NetBSD, OpenBSD, and others.</p>
</blockquote>

<ul>
<li>Q: In which areas has the development of Unix stalled?</li>
</ul>

<blockquote>
<p>The data I will show demonstrate that there were in the past some long periods where the number of C library functions and system calls remained mostly stable. Nowadays there is significant growth in the number of all documented facilities with the exception of file formats. Im looking forward to a discussion regarding the meaning of these growth patterns in the Q&amp;A session after the talk.</p>
</blockquote>

<ul>
<li>Q: What are the core features that still link the 1970 PDP-7 system to the latest FreeBSD 11.1 release, almost half a century apart?</li>
</ul>

<blockquote>
<p>Over the past half-century the Unix system has grown by four orders of magnitude from a few thousand lines of code to many millions. Nevertheless, looking at a 1970s architecture diagram and a current one reveals that the initial architectural blocks are still with us today. Furthermore, most system calls, user programs, and C library functions of that era have survived until today with essentially similar functionality. Ive even found in modern FreeBSD some lines of code that have survived unchanged for 40 years.</p>
</blockquote>

<ul>
<li>Q: Can we still add innovative changes to operating systems like FreeBSD without breaking the Unix philosophy? Will there be a moment where FreeBSD isnt recognizable anymore as a descendant of the 1970 PDP-7 system?</li>
</ul>

<blockquote>
<p>Theres a saying that form liberates. So having available a time-tested form for developing operating system functionality allows you to innovate in areas that matter rather than reinventing the wheel.</p>

<p>Such concepts include having commands act as a filter, providing manual pages with a consistent structure, supplying build information in the form of a Makefile, installing files in a well-defined directory hierarchy, implementing filesystems with an standardized object-oriented interface, and packaging reusable functions as a library. Within this framework theres ample space for both incremental additions (think of jq, the JSON query command) and radical innovations (consider the Solaris-derived ZFS and dtrace functionality). For this reason I think that BSD and Linux systems will always be recognizable as direct or intellectual descendants of the 1970s Research Unix editions.</p>
</blockquote>

<ul>
<li>Q: Have you enjoyed previous FOSDEM editions?</li>
</ul>

<blockquote>
<p>Immensely! As an academic I need to attend many scientific conferences and meetings in order to present research results and interact with colleagues. This means too much time spent traveling and away from home, and a limited number of conferences Im in the end able to attend. Nevertheless, attending FOSDEM is an easy decision due to the world-changing nature of its theme, the breadth of the topics presented, the participants enthusiasm and energy, as well as the exemplary, very efficient conference organization.</p>
</blockquote>

<hr>

<h3><a href="https://www.weaponizedawesome.com/blog/?cat=53" rel="nofollow">Another vBSDCon trip report we just found</a></h3>

<ul>
<li>We just got tipped about another trip report from vBSDCon, this time from one of the first time speakers: W. Dean Freeman</li>
</ul>

<blockquote>
<p>Recently I had the honor of co-presenting on the internals of FreeBSDs Kernel RNG with John-Mark Gurney at the 3rd biennial vBSDCon, hosted in Reston, VA hosted by Verisign.<br>
Ive been in and out of the FreeBSD community for about 20 years. As Ive mentioned on here before, my first Unix encounter was FreeBSD 2.2.8 when I was in the 7th or 8th grade. However, for all that time Ive never managed to get out to any of the cons. Ive been to one or two BUG meetings and Ive met some folks from IRC before, but nothing like this.</p>
</blockquote>

<ul>
<li>A BSD conference is a very different experience than anything else out there. You have to try it, it is the only way to truly understand it.</li>
</ul>

<blockquote>
<p>Id also not had to do a stand-up presentation really since college before this. So, my first BSD con and my first time presenting rolled into one made for an interesting experience.</p>
</blockquote>

<ul>
<li>See, he didnt say terrifying. It went very well. You should totally submit a talk for the next conference, even if it is your first.</li>
</ul>

<blockquote>
<p>That said, it was amazing and invigorating experience. I got to meet a few big names in the FreeBSD community, discuss projects, ideas for FreeBSD, etc. I did seem to spend an unusual amount of time talking about FIPS and Common Criteria with folks, but to me thats a good sign and indicative that there is interest in working to close gaps between FreeBSD and the current requirements so that we can start getting FreeBSD and more BSD-based products into the government and start whittling away the domination of Linux (especially since Oracle has cut Solaris, SPARC and the ZFS storage appliance business units).</p>
</blockquote>

<ul>
<li>There is nothing that can match the high bandwidth interchange of ideas in person. The internet has made all kinds of communication possible, and we use it all the time, but every once in a while, getting together in person is hugely valuable.</li>
<li>Dean then went on to list some of the talks he found most valuable, including DTrace, Capsicum, bhyve, *BSD security tools, and Paul Vixies talk about gets()</li>
</ul>

<blockquote>
<p>I think the talk that really had the biggest impact on me, however, was Kyle Kneisls talk on BSD community dynamics. One of the key points he asked was whether the things that drew us to the BSD community in the first place would be able to happen today. Obviously, Im not a 12 or 13 year old kid anymore, but it really got me thinking. That, combined with getting face time with people Id previously only known as screen names has recently drawn me back into participating in IRC and rejoining mailing lists (wdf on freenode. be on the lookout!)</p>
</blockquote>

<ul>
<li>Then Dean covered some thoughts on his own talk:</li>
</ul>

<blockquote>
<p>JMG and my talk seems to have been well received, with people paying lots of attention. I dont know what a typical number of questions is for one of these things, but on day one there werent that many questions.  We got about 5 during our question time and spent most of the rest of the day fielding questions from interested attendees. Getting a great talk! from GNN after coming down from the stage was probably one of the major highlights for me.</p>
</blockquote>

<ul>
<li>I remember my first solo talk, and GNN asking the right question in the middle to get me to explain a part of it I had missed. It was very helpful.</li>
</ul>

<blockquote>
<p>I think key to the interest in our presentation was that JMG did a good job framing a very complicated topics importance in terms everyone could understand.  It also helped that we got to drop some serious truth bombs.</p>
</blockquote>

<ul>
<li>Final Thoughts:</li>
</ul>

<blockquote>
<p>I met a lot of folks in person for the first time, and met some people Id never known online before. It was a great community and Im glad I got a chance to expand my network.<br>
Verisign were excellent hosts and they took good care of both speakers (covering airfare, rooms, etc.) and also conference attendees at large. The dinners that they hosted were quite good as well.<br>
Im definitely interested in attending vBSDCon again and now that Ive had a taste of meeting IRL with the community on scale of more than a handful, I have every intention of finally making it to BSDCan next year (Id said it in 2017, but then moved to Texas for a new job and it wasnt going to be practical). This year for sure, though!</p>

<hr>
</blockquote>

<h3><a href="https://virtuallyfun.com/2018/01/17/teaching_an_almost_40-year_old_unix_about_backspace/" rel="nofollow">Teaching an Almost 40-year Old UNIX about Backspace</a></h3>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
<p>I have been messing with the UNIX® operating system, Seventh Edition (commonly known as UNIX V7 or just V7) for a while now. V7 dates from 1979, so its about 40 years old at this point. The last post was on V7/x86, but since Ive run into various issues with it, I moved on to a proper installation of V7 on SIMH. The Internet has some really good resources on installing V7 in SIMH. Thus, I set out on my own journey on installing and using V7 a while ago, but that was remarkably uneventful.</p>

<p>One convenience that I have been dearly missing since the switch from V7/x86 is a functioning backspace key. There seem to be multiple different definitions of backspace:</p>

<p>BS, as in ASCII character 8 (010, 0x08, also represented as <sup>H),</sup> and<br>
DEL, as in ASCII character 127 (0177, 0x7F, also represented as <sup>?).</sup><br>
V7 does not accept either for input by default. Instead, # is used as the erase character and @ is used as the kill character. These defaults have been there since UNIX V1. In fact, they have been there since Multics, where they got chosen seemingly arbitrarily. The erase character erases the character before it. The kill character kills (deletes) the whole line. For example, ba##gooo#d would be interpreted as good and bad line@good line would be interpreted as good line.</p>

<p>There is some debate on whether BS or DEL is the correct character for terminals to send when the user presses the backspace key. However, most programs have settled on DEL today. tmux forces DEL, even if the terminal emulator sends BS, so simply changing my terminal to send BS was not an option. The change from the defaults outlined here to todays modern-day defaults occurred between 4.1BSD and 4.2BSD. enf on Hacker News has written a nice overview of the various conventions</p>
</blockquote>

<ul>
<li>Getting the Diff</li>
</ul>

<blockquote>
<p>For future generations as well as myself when I inevitably majorly break this installation of V7, I wanted to make a diff. However, my V7 is installed in SIMH. I am not a very intelligent man, I didnt keep backup copies of the files Id changed. Getting data out of this emulated machine is an exercise in frustration.</p>

<p>In the end, I printed everything on screen using cat(1) and copied that out. Then I performed a manual diff against the original source code tree because tabs got converted to spaces in the process. Then I applied the changes to clean copies that did have the tabs. And finally, I actually invoked diff(1).</p>
</blockquote>

<ul>
<li>Closing Thoughts</li>
</ul>

<blockquote>
<p>Figuring all this out took me a few days. Penetrating how the system is put together was surprisingly fairly hard at first, but then the difficulty curve eased up. It was an interesting exercise in some kind of reverse engineering and I definitely learned something about tty handling. I was, however, not pleased with using ed(1), even if I do know the basics. vi(1) is a blessing that I did not appreciate enough until recently. Had I also been unable to access recursive grep(1) on my host and scroll through the code, I wouldve probably given up. Writing UNIX under those kinds of editing conditions is an amazing feat. I have nothing but the greatest respect for software developers of those days.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-January/068145.html" rel="nofollow">New NUMA support coming to FreeBSD CURRENT</a></h3>

<blockquote>
<p>Hello folks,</p>

<p>I am working on merging improved NUMA support with policy implemented by cpuset(2) over the next week.  This work has been supported by Dell/EMC&#39;s Isilon product division and Netflix.  You can see some discussion of these changes here:</p>

<p><a href="https://reviews.freebsd.org/D13403" rel="nofollow">https://reviews.freebsd.org/D13403</a><br>
<a href="https://reviews.freebsd.org/D13289" rel="nofollow">https://reviews.freebsd.org/D13289</a><br>
<a href="https://reviews.freebsd.org/D13545" rel="nofollow">https://reviews.freebsd.org/D13545</a></p>

<p>The work has been done in user/jeff/numa if you want to look at svn history or experiment with the branch.  It has been tested by Peter Holm on i386 and amd64 and it has been verified to work on arm at various points.</p>

<p>We are working towards compatibility with libnuma and linux mbind.  These commits will bring in improved support for NUMA in the kernel.  There are new domain specific allocation functions available to kernel for UMA, malloc, kmem_, and vm_page*.  busdmamem consumers will automatically be placed in the correct domain, bringing automatic improvements to some <br>
device performance.</p>

<p>cpuset will be able to constrains processes, groups of processes, jails, etc. to subsets of the system memory domains, just as it can with sets of cpus.  It can set default policy for any of the above.  Threads can use cpusets to set policy that specifies a subset of their visible domains.</p>

<p>Available policies are first-touch (local in linux terms), round-robin (similar to linux interleave), and preferred.  For now, the default is round-robin.  You can achieve a fixed domain policy by using round-robin with a bitmask of a single domain.  As the scheduler and VM become more <br>
sophisticated we may switch the default to first-touch as linux does.</p>

<p>Currently these features are enabled with VM_NUMA_ALLOC and MAXMEMDOM.  It will eventually be NUMA/MAXMEMDOM to match SMP/MAXCPU.  The current NUMA syscalls and VM_NUMA_ALLOC code was &#39;experimental&#39; and will be deprecated. numactl will continue to be supported although cpuset should be preferred going forward as it supports the full feature set of the new API.</p>

<p>Thank you for your patience as I deal with the inevitable fallout of such sweeping changes.  If you do have bugs, please file them in bugzilla, or reach out to me directly.  I don&#39;t always have time to catch up on all of my mailing list mail and regretfully things slip through the cracks when <br>
they are not addressed directly to me.</p>

<p>Thanks,<br>
Jeff</p>

<hr>
</blockquote>

<h3><a href="https://marc.info/?l=openbsd-tech&m=151572838911297&w=2" rel="nofollow">Stack pointer checking  OpenBSD</a></h3>

<blockquote>
<p>Stefan (stefan@) and I have been working for a few months on this diff, with help from a few others.</p>

<p>At every trap and system call, it checks if the stack-pointer is on a page that is marked MAP_STACK.  execve() is changed to create such mappings for the process stack.  Also, libpthread is taught the new MAP_STACK flag to use with mmap().</p>

<p>There is no corresponding system call which can set MAP_FLAG on an existing page, you can only set the flag by mapping new memory into place.  That is a piece of the security model.</p>

<p>The purpose of this change is to twart stack pivots, which apparently have gained some popularity in JIT ROP attacks.  It makes it difficult to place the ROP stack in regular data memory, and then perform a system call from it.  Workarounds are cumbersome, increasing the need for far more gadgetry.  But also the trap case -- if any memory experiences a demand page fault, the same check will occur and potentially also kill the process.</p>

<p>We have experimented a little with performing this check during device interrupts, but there are some locking concerns and performance may then become a concern.  It&#39;ll be best to gain experience from handle of syncronous trap cases first.</p>

<p>chrome and other applications I use run fine!</p>

<p>I&#39;m asking for some feedback to discover what ports this breaks, we&#39;d like to know.  Those would be ports which try to (unconventionally) create their stacks in malloc()&#39;d memory or inside another Data structure.  Most of them are probably easily fixed ...</p>
</blockquote>

<hr>

<h3><a href="https://euroquis.nl/bobulate/?p=1768" rel="nofollow">Qt 5.9 on FreeBSD</a></h3>

<blockquote>
<p>Tobias and Raphael have spent the past month or so hammering on the Qt 5.9 branch, which has (finally!) landed in the official FreeBSD ports tree. This brings FreeBSD back up-to-date with current Qt releases and, more importantly, up-to-date with the Qt release KDE software is increasingly expecting. With Qt 5.9, the Elisa music player works, for instance (where it has run-time errors with Qt 5.7, even if it compiles). The KDE-FreeBSD CI system has had Qt 5.9 for some time already, but that was hand-compiled and jimmied into the system, rather than being a proper ports build.</p>

<p>The new Qt version uses a new build system, which is one of the things that really slowed us down from a packaging perspective. Some modules have been reshuffled in the process. Some applications depending on Qt internal-private headers have been fixed along the way. The Telegram desktop client continues to be a pain in the butt that way.</p>

<p>Following on from Qt 5.9 there has been some work in getting ready for Clang 6 support; in general the KDE and Qt stack is clean and modern C++, so its more infrastructural tweaks than fixing code. Outside of our silo, I still see lots of wonky C++ code being fixed and plenty of confusion between pointers and integers and strings and chars and .. ugh. Speaking of ugh, Im still planning to clean up Qt4 on ARM aarch64 for FreeBSD; this boils down to stealing suitable qatomic implementations from Arch Linux.</p>

<p>For regular users of Qt applications on FreeBSD, there should be few to no changes required outside the regular upgrade cycle. For KDE Plasma users, note that development of the ports has changed branches; as we get closer to actually landing modern KDE bits, things have been renamed and reshuffled and mulled over so often that the old plasma5 branch wasnt really right anymore. The kde5-import branch is where its at nowadays, and the instructions are the same: the x11/kde5 metaport will give you all the KDE Frameworks 5, KDE Plasma Desktop and modern KDE Applications you need.</p>
</blockquote>

<hr>

<h3><a href="https://dan.langille.org/2018/01/13/adding-ipv6-to-an-nginx-website-on-freebsd-freshports/" rel="nofollow">Adding IPv6 to an Nginx website on FreeBSD / FreshPorts</a></h3>

<ul>
<li><p>FreshPorts recently moved to an IPv6-capable server but until today, that capability has not been utilized.</p></li>
<li><p>There were a number of things I had to configure, but this will not necessarily be an exhaustive list for you to follow. Some steps might be missing, and it might not apply to your situation.</p></li>
</ul>

<blockquote>
<p>All of this took about 3 hours.</p>
</blockquote>

<ul>
<li><p>We are using:</p>

<ul>
<li>FreeBSD 11.1</li>
<li>Bind 9.9.11</li>
<li>nginx 1.12.2</li>
</ul></li>
<li><p>Fallout</p></li>
</ul>

<blockquote>
<p>I expect some monitoring fallout from this change. I suspect some of my monitoring assumes IP4 and now that IPv6 is available, I need to monitor both IP addresses.</p>
</blockquote>

<hr>

<h3><a href="https://www.trueos.org/blog/zfs-trueos-love-openzfs/" rel="nofollow">ZFS on TrueOS: Why We Love OpenZFS</a></h3>

<blockquote>
<p>TrueOS was the first desktop operating system to fully implement the OpenZFS (Zettabyte File System or ZFS for short) enterprise file system in a stable production environment. To fully understand why we love ZFS, we will look back to the early days of TrueOS (formerly PC-BSD). The development team had been using the UFS file system in TrueOS because of its solid track record with FreeBSD-based computer systems and its ability to check file consistency with the built-in check utility fsck.</p>

<p>However, as computing demands increased, problems began to surface. Slow fsck file verification on large file systems, slow replication speeds, and inconsistency in data integrity while using UFS logging / journaling began to hinder users. It quickly became apparent that TrueOS users would need a file system that scales with evolving enterprise storage needs, offers the best data protection, and works just as well on a hobbyist system or desktop computer.</p>

<p>Kris Moore, the founder of the TrueOS project, first heard about OpenZFS in 2007 from chatter on the FreeBSD mailing lists. In 2008, the TrueOS development team was thrilled to learn that the FreeBSD Project had ported ZFS. At the time, ZFS was still unproven as a graphical desktop solution, but Kris saw a perfect opportunity to offer ZFS as a cutting-edge file system option in the TrueOS installer, allowing the TrueOS project to act as an indicator of how OpenZFS would fair in real-world production use.</p>

<p>The team was blown away by the reception and quality of OpenZFS on FreeBSD-based systems. By its nature, ZFS is a copy-on-write (CoW) file system that wont move a block of data until it both writes the data and verifies its integrity. This is very different from most other file systems in use today. ZFS is able to assure that data stays consistent between writes by automatically comparing write checksums, which mitigates bit rot. ZFS also comes with native RaidZ functionality that allows for enterprise data management and redundancy without the need for expensive traditional RAID cards. ZFS snapshots allow for system configuration backups in a split-second. You read that right. TrueOS can backup or restore snapshots in less than a second using the ZFS file system.</p>

<p>Given these advantages, the TrueOS team decided to use ZFS as its exclusive file system starting in 2013, and we havent looked back since. ZFS offers TrueOS users the stable workstation experience they want, while simultaneously scaling to meet the increasing demands of the enterprise storage market. TrueOS users are frequently commenting on how easy it is to use ZFS snapshots with our built-in snapshot utility. This allows users the freedom to experiment with their system knowing they can restore it in seconds if anything goes wrong. If you havent had a chance to try ZFS with TrueOS, browse to our download page and make sure to grab a copy of TrueOS. Youll be blown away by the ease of use, data protection functionality, and incredible flexibility of RaidZ.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blather.michaelwlucas.com/archives/3099" rel="nofollow">Source Code Podcast Interview with Michael W Lucas</a></li>
<li><a href="https://w3techs.com/blog/entry/web_technologies_of_the_year_2017" rel="nofollow">Operating System of the Year 2017: NetBSD Third place</a></li>
<li><a href="https://opnsense.org/opnsense-18-1-rc1-released/" rel="nofollow">OPNsense 18.1-RC1 released</a></li>
<li><a href="https://balu-wiki.readthedocs.io/en/latest/security/openbsd.html" rel="nofollow">Personal OpenBSD Wiki Notes</a></li>
<li><a href="https://guide.freecodecamp.org/bsd-os/" rel="nofollow">BSD section can use some contribution</a></li>
<li><a href="https://github.com/dspinellis/unix-v3man" rel="nofollow">The Third Research Edition Unix Programmer&#39;s Manual (now available in PDF)</a></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Alex - <a href="http://dpaste.com/3DSV7BC#wrap" rel="nofollow">my first freebsd bug</a></li>
<li>John - <a href="http://dpaste.com/2QFR4MT#wrap" rel="nofollow">Suggested Speakers</a> </li>
<li>Todd - <a href="http://dpaste.com/2FQ450Q#wrap" rel="nofollow">Two questions</a></li>
<li>Matthew - <a href="http://dpaste.com/3KA29E0#wrap" rel="nofollow">CentOS to FreeBSD</a></li>
<li>Brian - <a href="http://dpaste.com/24DYF1J#wrap" rel="nofollow">Brian - openbsd 6.2 and enlightenment .17</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We cover an interview about Unix Architecture Evolution, another vBSDcon trip report, how to teach an old Unix about backspace, new NUMA support coming to FreeBSD, and stack pointer checking in OpenBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://fosdem.org/2018/interviews/diomidis-spinellis/" rel="nofollow">Unix Architecture Evolution from the 1970 PDP-7 to the 2017 FreeBSD</a></h3>

<ul>
<li>Q: Could you briefly introduce yourself?</li>
</ul>

<blockquote>
<p>Im a professor of software engineering, a programmer at heart, and a technology author. Currently Im also the editor in chief of the IEEE Software magazine. I recently published the book Effective Debugging, where I detail 66 ways to debug software and systems.</p>
</blockquote>

<ul>
<li>Q: What will your talk be about, exactly?</li>
</ul>

<blockquote>
<p>I will describe how the architecture of the Unix operating system evolved over the past half century, starting from an unnamed system written in PDP-7 assembly language and ending with a modern FreeBSD system. My talk is based, first, on a GitHub repository where I tried to record the systems history from 1970 until today and, second, on the evolution of documented facilities (user commands, system calls, library functions) across revisions. I will thus present the early systems defining architectural features (layering, system calls, devices as files, an interpreter, and process management) and the important ones that followed in subsequent releases: the tree directory structure, user contributed code, I/O redirection, the shell as a user program, groups, pipes, scripting, and little languages.</p>
</blockquote>

<ul>
<li>Q: Why this topic?</li>
</ul>

<blockquote>
<p>Unix stands out as a major engineering breakthrough due to its exemplary design, its numerous technical contributions, its impact, its development model, and its widespread use. Furthermore, the design of the Unix programming environment has been characterized as one offering unusual simplicity, power, and elegance. Consequently, there are many lessons that we can learn by studying the evolution of the Unix architecture, which we can apply to the design of new systems. I often see modern systems that suffer from a bloat of architectural features and a lack of clear form on which functionality can be built. I believe that many of the modern Unix architecture defining features are excellent examples of what we should strive toward as system architects.</p>
</blockquote>

<ul>
<li>Q: What do you hope to accomplish by giving this talk? What do you expect?</li>
</ul>

<blockquote>
<p>Id like FOSDEM attendees to leave the talk with their mind full with architectural features of timeless quality. I want them to realize that architectural elegance isnt derived by piling design patterns and does not need to be expensive in terms of resources. Rather, beautiful architecture can be achieved on an extremely modest scale. Furthermore, I want attendees to appreciate the importance of adopting flexible conventions rather than rigid enforcement mechanisms. Finally, I want to demonstrate through examples that the open source culture was part of Unix from its earliest days.</p>
</blockquote>

<ul>
<li>Q: What are the most significant milestones in the development of Unix?</li>
</ul>

<blockquote>
<p>The architectural development of Unix follows a path of continuous evolution, albeit at a slowing pace, so I dont see here the most important milestones. I would however define as significant milestones two key changes in the way Unix was developed. The first occurred in the late 1970s when significant activity shifted from a closely-knit team of researchers at the AT&amp;T Bell Labs to the Computer Science Research Group in the University of California at Berkeley. This opened the system to academic contributions and growth through competitive research funding. The second took place in the late 1980s and the 1990s when Berkeley open-sourced the the code it had developed (by that time a large percentage of the system) and enthusiasts built on it to create complete open source operating system distributions: 386BSD, and then FreeBSD, NetBSD, OpenBSD, and others.</p>
</blockquote>

<ul>
<li>Q: In which areas has the development of Unix stalled?</li>
</ul>

<blockquote>
<p>The data I will show demonstrate that there were in the past some long periods where the number of C library functions and system calls remained mostly stable. Nowadays there is significant growth in the number of all documented facilities with the exception of file formats. Im looking forward to a discussion regarding the meaning of these growth patterns in the Q&amp;A session after the talk.</p>
</blockquote>

<ul>
<li>Q: What are the core features that still link the 1970 PDP-7 system to the latest FreeBSD 11.1 release, almost half a century apart?</li>
</ul>

<blockquote>
<p>Over the past half-century the Unix system has grown by four orders of magnitude from a few thousand lines of code to many millions. Nevertheless, looking at a 1970s architecture diagram and a current one reveals that the initial architectural blocks are still with us today. Furthermore, most system calls, user programs, and C library functions of that era have survived until today with essentially similar functionality. Ive even found in modern FreeBSD some lines of code that have survived unchanged for 40 years.</p>
</blockquote>

<ul>
<li>Q: Can we still add innovative changes to operating systems like FreeBSD without breaking the Unix philosophy? Will there be a moment where FreeBSD isnt recognizable anymore as a descendant of the 1970 PDP-7 system?</li>
</ul>

<blockquote>
<p>Theres a saying that form liberates. So having available a time-tested form for developing operating system functionality allows you to innovate in areas that matter rather than reinventing the wheel.</p>

<p>Such concepts include having commands act as a filter, providing manual pages with a consistent structure, supplying build information in the form of a Makefile, installing files in a well-defined directory hierarchy, implementing filesystems with an standardized object-oriented interface, and packaging reusable functions as a library. Within this framework theres ample space for both incremental additions (think of jq, the JSON query command) and radical innovations (consider the Solaris-derived ZFS and dtrace functionality). For this reason I think that BSD and Linux systems will always be recognizable as direct or intellectual descendants of the 1970s Research Unix editions.</p>
</blockquote>

<ul>
<li>Q: Have you enjoyed previous FOSDEM editions?</li>
</ul>

<blockquote>
<p>Immensely! As an academic I need to attend many scientific conferences and meetings in order to present research results and interact with colleagues. This means too much time spent traveling and away from home, and a limited number of conferences Im in the end able to attend. Nevertheless, attending FOSDEM is an easy decision due to the world-changing nature of its theme, the breadth of the topics presented, the participants enthusiasm and energy, as well as the exemplary, very efficient conference organization.</p>
</blockquote>

<hr>

<h3><a href="https://www.weaponizedawesome.com/blog/?cat=53" rel="nofollow">Another vBSDCon trip report we just found</a></h3>

<ul>
<li>We just got tipped about another trip report from vBSDCon, this time from one of the first time speakers: W. Dean Freeman</li>
</ul>

<blockquote>
<p>Recently I had the honor of co-presenting on the internals of FreeBSDs Kernel RNG with John-Mark Gurney at the 3rd biennial vBSDCon, hosted in Reston, VA hosted by Verisign.<br>
Ive been in and out of the FreeBSD community for about 20 years. As Ive mentioned on here before, my first Unix encounter was FreeBSD 2.2.8 when I was in the 7th or 8th grade. However, for all that time Ive never managed to get out to any of the cons. Ive been to one or two BUG meetings and Ive met some folks from IRC before, but nothing like this.</p>
</blockquote>

<ul>
<li>A BSD conference is a very different experience than anything else out there. You have to try it, it is the only way to truly understand it.</li>
</ul>

<blockquote>
<p>Id also not had to do a stand-up presentation really since college before this. So, my first BSD con and my first time presenting rolled into one made for an interesting experience.</p>
</blockquote>

<ul>
<li>See, he didnt say terrifying. It went very well. You should totally submit a talk for the next conference, even if it is your first.</li>
</ul>

<blockquote>
<p>That said, it was amazing and invigorating experience. I got to meet a few big names in the FreeBSD community, discuss projects, ideas for FreeBSD, etc. I did seem to spend an unusual amount of time talking about FIPS and Common Criteria with folks, but to me thats a good sign and indicative that there is interest in working to close gaps between FreeBSD and the current requirements so that we can start getting FreeBSD and more BSD-based products into the government and start whittling away the domination of Linux (especially since Oracle has cut Solaris, SPARC and the ZFS storage appliance business units).</p>
</blockquote>

<ul>
<li>There is nothing that can match the high bandwidth interchange of ideas in person. The internet has made all kinds of communication possible, and we use it all the time, but every once in a while, getting together in person is hugely valuable.</li>
<li>Dean then went on to list some of the talks he found most valuable, including DTrace, Capsicum, bhyve, *BSD security tools, and Paul Vixies talk about gets()</li>
</ul>

<blockquote>
<p>I think the talk that really had the biggest impact on me, however, was Kyle Kneisls talk on BSD community dynamics. One of the key points he asked was whether the things that drew us to the BSD community in the first place would be able to happen today. Obviously, Im not a 12 or 13 year old kid anymore, but it really got me thinking. That, combined with getting face time with people Id previously only known as screen names has recently drawn me back into participating in IRC and rejoining mailing lists (wdf on freenode. be on the lookout!)</p>
</blockquote>

<ul>
<li>Then Dean covered some thoughts on his own talk:</li>
</ul>

<blockquote>
<p>JMG and my talk seems to have been well received, with people paying lots of attention. I dont know what a typical number of questions is for one of these things, but on day one there werent that many questions.  We got about 5 during our question time and spent most of the rest of the day fielding questions from interested attendees. Getting a great talk! from GNN after coming down from the stage was probably one of the major highlights for me.</p>
</blockquote>

<ul>
<li>I remember my first solo talk, and GNN asking the right question in the middle to get me to explain a part of it I had missed. It was very helpful.</li>
</ul>

<blockquote>
<p>I think key to the interest in our presentation was that JMG did a good job framing a very complicated topics importance in terms everyone could understand.  It also helped that we got to drop some serious truth bombs.</p>
</blockquote>

<ul>
<li>Final Thoughts:</li>
</ul>

<blockquote>
<p>I met a lot of folks in person for the first time, and met some people Id never known online before. It was a great community and Im glad I got a chance to expand my network.<br>
Verisign were excellent hosts and they took good care of both speakers (covering airfare, rooms, etc.) and also conference attendees at large. The dinners that they hosted were quite good as well.<br>
Im definitely interested in attending vBSDCon again and now that Ive had a taste of meeting IRL with the community on scale of more than a handful, I have every intention of finally making it to BSDCan next year (Id said it in 2017, but then moved to Texas for a new job and it wasnt going to be practical). This year for sure, though!</p>

<hr>
</blockquote>

<h3><a href="https://virtuallyfun.com/2018/01/17/teaching_an_almost_40-year_old_unix_about_backspace/" rel="nofollow">Teaching an Almost 40-year Old UNIX about Backspace</a></h3>

<ul>
<li>Introduction</li>
</ul>

<blockquote>
<p>I have been messing with the UNIX® operating system, Seventh Edition (commonly known as UNIX V7 or just V7) for a while now. V7 dates from 1979, so its about 40 years old at this point. The last post was on V7/x86, but since Ive run into various issues with it, I moved on to a proper installation of V7 on SIMH. The Internet has some really good resources on installing V7 in SIMH. Thus, I set out on my own journey on installing and using V7 a while ago, but that was remarkably uneventful.</p>

<p>One convenience that I have been dearly missing since the switch from V7/x86 is a functioning backspace key. There seem to be multiple different definitions of backspace:</p>

<p>BS, as in ASCII character 8 (010, 0x08, also represented as <sup>H),</sup> and<br>
DEL, as in ASCII character 127 (0177, 0x7F, also represented as <sup>?).</sup><br>
V7 does not accept either for input by default. Instead, # is used as the erase character and @ is used as the kill character. These defaults have been there since UNIX V1. In fact, they have been there since Multics, where they got chosen seemingly arbitrarily. The erase character erases the character before it. The kill character kills (deletes) the whole line. For example, ba##gooo#d would be interpreted as good and bad line@good line would be interpreted as good line.</p>

<p>There is some debate on whether BS or DEL is the correct character for terminals to send when the user presses the backspace key. However, most programs have settled on DEL today. tmux forces DEL, even if the terminal emulator sends BS, so simply changing my terminal to send BS was not an option. The change from the defaults outlined here to todays modern-day defaults occurred between 4.1BSD and 4.2BSD. enf on Hacker News has written a nice overview of the various conventions</p>
</blockquote>

<ul>
<li>Getting the Diff</li>
</ul>

<blockquote>
<p>For future generations as well as myself when I inevitably majorly break this installation of V7, I wanted to make a diff. However, my V7 is installed in SIMH. I am not a very intelligent man, I didnt keep backup copies of the files Id changed. Getting data out of this emulated machine is an exercise in frustration.</p>

<p>In the end, I printed everything on screen using cat(1) and copied that out. Then I performed a manual diff against the original source code tree because tabs got converted to spaces in the process. Then I applied the changes to clean copies that did have the tabs. And finally, I actually invoked diff(1).</p>
</blockquote>

<ul>
<li>Closing Thoughts</li>
</ul>

<blockquote>
<p>Figuring all this out took me a few days. Penetrating how the system is put together was surprisingly fairly hard at first, but then the difficulty curve eased up. It was an interesting exercise in some kind of reverse engineering and I definitely learned something about tty handling. I was, however, not pleased with using ed(1), even if I do know the basics. vi(1) is a blessing that I did not appreciate enough until recently. Had I also been unable to access recursive grep(1) on my host and scroll through the code, I wouldve probably given up. Writing UNIX under those kinds of editing conditions is an amazing feat. I have nothing but the greatest respect for software developers of those days.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2018-January/068145.html" rel="nofollow">New NUMA support coming to FreeBSD CURRENT</a></h3>

<blockquote>
<p>Hello folks,</p>

<p>I am working on merging improved NUMA support with policy implemented by cpuset(2) over the next week.  This work has been supported by Dell/EMC&#39;s Isilon product division and Netflix.  You can see some discussion of these changes here:</p>

<p><a href="https://reviews.freebsd.org/D13403" rel="nofollow">https://reviews.freebsd.org/D13403</a><br>
<a href="https://reviews.freebsd.org/D13289" rel="nofollow">https://reviews.freebsd.org/D13289</a><br>
<a href="https://reviews.freebsd.org/D13545" rel="nofollow">https://reviews.freebsd.org/D13545</a></p>

<p>The work has been done in user/jeff/numa if you want to look at svn history or experiment with the branch.  It has been tested by Peter Holm on i386 and amd64 and it has been verified to work on arm at various points.</p>

<p>We are working towards compatibility with libnuma and linux mbind.  These commits will bring in improved support for NUMA in the kernel.  There are new domain specific allocation functions available to kernel for UMA, malloc, kmem_, and vm_page*.  busdmamem consumers will automatically be placed in the correct domain, bringing automatic improvements to some <br>
device performance.</p>

<p>cpuset will be able to constrains processes, groups of processes, jails, etc. to subsets of the system memory domains, just as it can with sets of cpus.  It can set default policy for any of the above.  Threads can use cpusets to set policy that specifies a subset of their visible domains.</p>

<p>Available policies are first-touch (local in linux terms), round-robin (similar to linux interleave), and preferred.  For now, the default is round-robin.  You can achieve a fixed domain policy by using round-robin with a bitmask of a single domain.  As the scheduler and VM become more <br>
sophisticated we may switch the default to first-touch as linux does.</p>

<p>Currently these features are enabled with VM_NUMA_ALLOC and MAXMEMDOM.  It will eventually be NUMA/MAXMEMDOM to match SMP/MAXCPU.  The current NUMA syscalls and VM_NUMA_ALLOC code was &#39;experimental&#39; and will be deprecated. numactl will continue to be supported although cpuset should be preferred going forward as it supports the full feature set of the new API.</p>

<p>Thank you for your patience as I deal with the inevitable fallout of such sweeping changes.  If you do have bugs, please file them in bugzilla, or reach out to me directly.  I don&#39;t always have time to catch up on all of my mailing list mail and regretfully things slip through the cracks when <br>
they are not addressed directly to me.</p>

<p>Thanks,<br>
Jeff</p>

<hr>
</blockquote>

<h3><a href="https://marc.info/?l=openbsd-tech&m=151572838911297&w=2" rel="nofollow">Stack pointer checking  OpenBSD</a></h3>

<blockquote>
<p>Stefan (stefan@) and I have been working for a few months on this diff, with help from a few others.</p>

<p>At every trap and system call, it checks if the stack-pointer is on a page that is marked MAP_STACK.  execve() is changed to create such mappings for the process stack.  Also, libpthread is taught the new MAP_STACK flag to use with mmap().</p>

<p>There is no corresponding system call which can set MAP_FLAG on an existing page, you can only set the flag by mapping new memory into place.  That is a piece of the security model.</p>

<p>The purpose of this change is to twart stack pivots, which apparently have gained some popularity in JIT ROP attacks.  It makes it difficult to place the ROP stack in regular data memory, and then perform a system call from it.  Workarounds are cumbersome, increasing the need for far more gadgetry.  But also the trap case -- if any memory experiences a demand page fault, the same check will occur and potentially also kill the process.</p>

<p>We have experimented a little with performing this check during device interrupts, but there are some locking concerns and performance may then become a concern.  It&#39;ll be best to gain experience from handle of syncronous trap cases first.</p>

<p>chrome and other applications I use run fine!</p>

<p>I&#39;m asking for some feedback to discover what ports this breaks, we&#39;d like to know.  Those would be ports which try to (unconventionally) create their stacks in malloc()&#39;d memory or inside another Data structure.  Most of them are probably easily fixed ...</p>
</blockquote>

<hr>

<h3><a href="https://euroquis.nl/bobulate/?p=1768" rel="nofollow">Qt 5.9 on FreeBSD</a></h3>

<blockquote>
<p>Tobias and Raphael have spent the past month or so hammering on the Qt 5.9 branch, which has (finally!) landed in the official FreeBSD ports tree. This brings FreeBSD back up-to-date with current Qt releases and, more importantly, up-to-date with the Qt release KDE software is increasingly expecting. With Qt 5.9, the Elisa music player works, for instance (where it has run-time errors with Qt 5.7, even if it compiles). The KDE-FreeBSD CI system has had Qt 5.9 for some time already, but that was hand-compiled and jimmied into the system, rather than being a proper ports build.</p>

<p>The new Qt version uses a new build system, which is one of the things that really slowed us down from a packaging perspective. Some modules have been reshuffled in the process. Some applications depending on Qt internal-private headers have been fixed along the way. The Telegram desktop client continues to be a pain in the butt that way.</p>

<p>Following on from Qt 5.9 there has been some work in getting ready for Clang 6 support; in general the KDE and Qt stack is clean and modern C++, so its more infrastructural tweaks than fixing code. Outside of our silo, I still see lots of wonky C++ code being fixed and plenty of confusion between pointers and integers and strings and chars and .. ugh. Speaking of ugh, Im still planning to clean up Qt4 on ARM aarch64 for FreeBSD; this boils down to stealing suitable qatomic implementations from Arch Linux.</p>

<p>For regular users of Qt applications on FreeBSD, there should be few to no changes required outside the regular upgrade cycle. For KDE Plasma users, note that development of the ports has changed branches; as we get closer to actually landing modern KDE bits, things have been renamed and reshuffled and mulled over so often that the old plasma5 branch wasnt really right anymore. The kde5-import branch is where its at nowadays, and the instructions are the same: the x11/kde5 metaport will give you all the KDE Frameworks 5, KDE Plasma Desktop and modern KDE Applications you need.</p>
</blockquote>

<hr>

<h3><a href="https://dan.langille.org/2018/01/13/adding-ipv6-to-an-nginx-website-on-freebsd-freshports/" rel="nofollow">Adding IPv6 to an Nginx website on FreeBSD / FreshPorts</a></h3>

<ul>
<li><p>FreshPorts recently moved to an IPv6-capable server but until today, that capability has not been utilized.</p></li>
<li><p>There were a number of things I had to configure, but this will not necessarily be an exhaustive list for you to follow. Some steps might be missing, and it might not apply to your situation.</p></li>
</ul>

<blockquote>
<p>All of this took about 3 hours.</p>
</blockquote>

<ul>
<li><p>We are using:</p>

<ul>
<li>FreeBSD 11.1</li>
<li>Bind 9.9.11</li>
<li>nginx 1.12.2</li>
</ul></li>
<li><p>Fallout</p></li>
</ul>

<blockquote>
<p>I expect some monitoring fallout from this change. I suspect some of my monitoring assumes IP4 and now that IPv6 is available, I need to monitor both IP addresses.</p>
</blockquote>

<hr>

<h3><a href="https://www.trueos.org/blog/zfs-trueos-love-openzfs/" rel="nofollow">ZFS on TrueOS: Why We Love OpenZFS</a></h3>

<blockquote>
<p>TrueOS was the first desktop operating system to fully implement the OpenZFS (Zettabyte File System or ZFS for short) enterprise file system in a stable production environment. To fully understand why we love ZFS, we will look back to the early days of TrueOS (formerly PC-BSD). The development team had been using the UFS file system in TrueOS because of its solid track record with FreeBSD-based computer systems and its ability to check file consistency with the built-in check utility fsck.</p>

<p>However, as computing demands increased, problems began to surface. Slow fsck file verification on large file systems, slow replication speeds, and inconsistency in data integrity while using UFS logging / journaling began to hinder users. It quickly became apparent that TrueOS users would need a file system that scales with evolving enterprise storage needs, offers the best data protection, and works just as well on a hobbyist system or desktop computer.</p>

<p>Kris Moore, the founder of the TrueOS project, first heard about OpenZFS in 2007 from chatter on the FreeBSD mailing lists. In 2008, the TrueOS development team was thrilled to learn that the FreeBSD Project had ported ZFS. At the time, ZFS was still unproven as a graphical desktop solution, but Kris saw a perfect opportunity to offer ZFS as a cutting-edge file system option in the TrueOS installer, allowing the TrueOS project to act as an indicator of how OpenZFS would fair in real-world production use.</p>

<p>The team was blown away by the reception and quality of OpenZFS on FreeBSD-based systems. By its nature, ZFS is a copy-on-write (CoW) file system that wont move a block of data until it both writes the data and verifies its integrity. This is very different from most other file systems in use today. ZFS is able to assure that data stays consistent between writes by automatically comparing write checksums, which mitigates bit rot. ZFS also comes with native RaidZ functionality that allows for enterprise data management and redundancy without the need for expensive traditional RAID cards. ZFS snapshots allow for system configuration backups in a split-second. You read that right. TrueOS can backup or restore snapshots in less than a second using the ZFS file system.</p>

<p>Given these advantages, the TrueOS team decided to use ZFS as its exclusive file system starting in 2013, and we havent looked back since. ZFS offers TrueOS users the stable workstation experience they want, while simultaneously scaling to meet the increasing demands of the enterprise storage market. TrueOS users are frequently commenting on how easy it is to use ZFS snapshots with our built-in snapshot utility. This allows users the freedom to experiment with their system knowing they can restore it in seconds if anything goes wrong. If you havent had a chance to try ZFS with TrueOS, browse to our download page and make sure to grab a copy of TrueOS. Youll be blown away by the ease of use, data protection functionality, and incredible flexibility of RaidZ.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blather.michaelwlucas.com/archives/3099" rel="nofollow">Source Code Podcast Interview with Michael W Lucas</a></li>
<li><a href="https://w3techs.com/blog/entry/web_technologies_of_the_year_2017" rel="nofollow">Operating System of the Year 2017: NetBSD Third place</a></li>
<li><a href="https://opnsense.org/opnsense-18-1-rc1-released/" rel="nofollow">OPNsense 18.1-RC1 released</a></li>
<li><a href="https://balu-wiki.readthedocs.io/en/latest/security/openbsd.html" rel="nofollow">Personal OpenBSD Wiki Notes</a></li>
<li><a href="https://guide.freecodecamp.org/bsd-os/" rel="nofollow">BSD section can use some contribution</a></li>
<li><a href="https://github.com/dspinellis/unix-v3man" rel="nofollow">The Third Research Edition Unix Programmer&#39;s Manual (now available in PDF)</a></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Alex - <a href="http://dpaste.com/3DSV7BC#wrap" rel="nofollow">my first freebsd bug</a></li>
<li>John - <a href="http://dpaste.com/2QFR4MT#wrap" rel="nofollow">Suggested Speakers</a> </li>
<li>Todd - <a href="http://dpaste.com/2FQ450Q#wrap" rel="nofollow">Two questions</a></li>
<li>Matthew - <a href="http://dpaste.com/3KA29E0#wrap" rel="nofollow">CentOS to FreeBSD</a></li>
<li>Brian - <a href="http://dpaste.com/24DYF1J#wrap" rel="nofollow">Brian - openbsd 6.2 and enlightenment .17</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>230: Your questions, Part III</title>
  <link>https://www.bsdnow.tv/230</link>
  <guid isPermaLink="false">cb9ee437-7c5c-4e4c-99b2-4270ffbfbae2</guid>
  <pubDate>Wed, 24 Jan 2018 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cb9ee437-7c5c-4e4c-99b2-4270ffbfbae2.mp3" length="84236980" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We provide you with updates to Spectre and Meltdown from various BSD projects, a review of TrueOS from Linux, how to set up FreeBSD on ThinkPad x240, and a whole bunch of beastie bits.</itunes:subtitle>
  <itunes:duration>1:56:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We provide you with updates to Spectre and Meltdown from various BSD projects, a review of TrueOS from Linux, how to set up FreeBSD on ThinkPad x240, and a whole bunch of beastie bits.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
KPTI patch lands in FreeBSD -current (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=328083)
After a heroic effort by Konstantin Belousov kib@FreeBSD.org, the first meltdown patch has landed in FreeBSD
This creates separate page tables for the Kernel and userland, and switches between them when executions enters the kernel, and when it returns to userland
It is currently off by default, but you are encouraged to test it, so it can be merged back to the release branches. Set vm.pmap.pti=1 in /boot/loader.conf
The existing implementation of PCID (process-context identifiers), is not compatible with the new PTI code, and is disabled when PTI is enabled, decreasing performance. A future patch will use PCID in a way that is compatible with PTI.
PCID allows the OS to annotate memory mappings to specific processes, so that they can be flushed selectively, and so that they are only used when in the context of that application.
Once the developers are relatively confident in the correctness of the code that has landed in -current, it will be ported back to FreeBSD 10 and 11, and released as a security advisory.
Apparently porting back to FreeBSD 11 only has some relatively simple merge conflicts, but 10 will be more work.
Former FreeBSD Security Officer Dag-Erling Smørgrav has created a meltdown testing and PoC tool (https://github.com/dag-erling/meltdown) that you can use to check your system. It is not finished yet, and doesn’t seem to work with newer processors (haswell and newer).
The first partial mitigation for Spectre variant 2 (https://svnweb.freebsd.org/changeset/base/328011) for bhyve on AMD64 has also been committed
The latest information is always available on the FreeBSD Wiki (https://wiki.freebsd.org/action/edit/SpeculativeExecutionVulnerabilities)
***
Some thoughts on Spectre and Meltdown (http://www.daemonology.net/blog/2018-01-17-some-thoughts-on-spectre-and-meltdown.html)
Colin Percival breaks down how these vulnerabilities work, with same nice analogies
What is a side channel:
I want to know when my girlfriend's passport expires, but she won't show me her passport (she complains that it has a horrible photo) and refuses to tell me the expiry date. I tell her that I'm going to take her to Europe on vacation in August and watch what happens: If she runs out to renew her passport, I know that it will expire before August; while if she doesn't get her passport renewed, I know that it will remain valid beyond that date. Her desire to ensure that her passport would be valid inadvertently revealed to me some information: Whether its expiry date was before or after August.
Spectre Variant 1: 
I tell my girlfriend that I'm going to take her on vacation in June, but I don't tell her where yet; however, she knows that it will either be somewhere within Canada (for which she doesn't need a passport, since we live in Vancouver) or somewhere in Europe. She knows that it takes time to get a passport renewed, so she checks her passport and (if it was about to expire) gets it renewed just in case I later reveal that I'm going to take her to Europe. If I tell her later that I'm only taking her to Ottawa — well, she didn't need to renew her passport after all, but in the meantime her behaviour has already revealed to me whether her passport was about to expire. This is what Google refers to "variant 1" of the Spectre vulnerability: Even though she didn't need her passport, she made sure it was still valid just in case she was going to need it.
Spectre Variant 2:
I spend a week talking about how Oxford is a wonderful place to visit and I really enjoyed the years I spent there, and then I tell her that I want to take her on vacation. She very reasonably assumes that — since I've been talking about Oxford so much — I must be planning on taking her to England, and runs off to check her passport and potentially renew it... but in fact I tricked her and I'm only planning on taking her to Ottawa.
Meltdown:
I tell my girlfriend that I want to take her to the Korean peninsula. She knows that her passport is valid for long enough; but she immediately runs off to check that her North Korean visa hasn't expired. Why does she have a North Korean visa, you ask? Good question. She doesn't — but she runs off to check its expiry date anyway! Because she doesn't have a North Korean visa, she (somehow) checks the expiry date on someone else's North Korean visa, and then (if it is about to expire) runs out to renew it — and so by telling her that I want to take her to Korea for a vacation I find out something she couldn't have told me even if she wanted to.
Final thoughts on vulnerability disclosure
The way these issues were handled was a mess; frankly, I expected better of Google, I expected better of Intel, and I expected better of the Linux community. When I found that Hyper-Threading was easily exploitable, I spent five months notifying the security community and preparing everyone for my announcement of the vulnerability; but when the embargo ended at midnight UTC and FreeBSD published its advisory a few minutes later, the broader world was taken entirely by surprise. Nobody knew what was coming aside from the people who needed to know; and the people who needed to know had months of warning.
Contrast that with what happened this time around. Google discovered a problem and reported it to Intel, AMD, and ARM on June 1st. Did they then go around contacting all of the operating systems which would need to work on fixes for this? Not even close. FreeBSD was notified the week before Christmas, over six months after the vulnerabilities were discovered. Now, FreeBSD can occasionally respond very quickly to security vulnerabilities, even when they arise at inconvenient times — on November 30th 2009 a vulnerability was reported at 22:12 UTC, and on December 1st I provided a patch at 01:20 UTC, barely over 3 hours later — but that was an extremely simple bug which needed only a few lines of code to fix; the Spectre and Meltdown issues are orders of magnitude more complex.
To make things worse, the Linux community was notified and couldn't keep their mouths shut. Standard practice for multi-vendor advisories like this is that an embargo date is set, and nobody does anything publicly prior to that date. People don't publish advisories; they don't commit patches into their public source code repositories; and they definitely don't engage in arguments on public mailing lists about whether the patches are needed for different CPUs. As a result, despite an embargo date being set for January 9th, by January 4th anyone who cared knew about the issues and there was code being passed around on Twitter for exploiting them.
This is not the first time I've seen people get sloppy with embargoes recently, but it's by far the worst case. As an industry we pride ourselves on the concept of responsible disclosure — ensuring that people are notified in time to prepare fixes before an issue is disclosed publicly — but in this case there was far too much disclosure and nowhere near enough responsibility. We can do better, and I sincerely hope that next time we do.
CPU microcode update code for amd64 (https://undeadly.org/cgi?action=article;sid=20180115073406)
 (https://marc.info/?l=openbsd-tech&amp;amp;m=151588857304763&amp;amp;w=2)
Patrick Wildt (patrick@) recently committed some code that will update the Intel microcode on many Intel CPUs, a diff initially written by Stefan Fritsch (sf@). The microcode of your CPU is basically the firmware that runs on your (Intel) processor, defining its instruction set in terms of so called "microinstructions". The new code depends, of course, on the corresponding firmware package, ported by Patrick which can be installed using a very recent fw_update(1). Of course, this all plays into the recently revealed problems in Intel (and other) CPUs, Meltdown and Spectre.
Now Theo has explained the workings of the code on openbsd-tech, detailing some of the challenges in updating microcode on CPUs where your OS is already starting to run.
Theo hints at future updates to the intel-firmware package in his mail: (https://marc.info/?l=openbsd-tech&amp;amp;m=151588857304763&amp;amp;w=2)
Patrick and others committed amd64 Intel cpu microcode update code over the last few days.  The approach isn't perfect, but it is good enough for a start.  I want to explain the situation.
When you fw_update, you'll get the firmware files.
Upon a reboot, it will attempt to update the microcode on your cpus.
Maybe there isn't a new microcode.  Maybe your BIOS has a copy of the microcode and installs it before booting OpenBSD.
This firmware installation is done a little late.  Doing it better will require some work in the bootblocks to find the firmware files, but time is a bit short to do that right now.
The branch-target-cache flushing features added in new microcode are not being used yet.  There is more code which has to be written, but again other work is happening first.
Also, Intel is saying their new microcodes sucks and people should wait a little.
"Hi, my name is Intel and I'm an cheating speculator".
Several developers are working on mitigations for these issues, attacking the problem from several angles. Expect to see more updates to a CVS tree near you soon.
Intel: as a *BSD user, I am fucking pissed! (https://malcont.net/2018/01/dont-like-meltdown-spectre-releated-bugs-handled/)
I wasn’t going to write anything on the recently found x64 architecture – related bugs. I’m not a kernel developer nor even a programmer and I can’t say that I have a solid understanding of what Meltdown and Spectre attacks are. Also there already is a ton of articles and posts written by people who have no grasp of the subject.
I’m however a malcontent and I find this a good way to express my feelings:
Intel: as a *BSD user, I am fucking pissed!
Meltdown, Spectre and BSD – the “pissed” part
Part of my work is UNIX-like systems administration – including BSDs and Linuces. As much as I am happy with Linux changes already made, I am beyond pissed about how the BSDs were handled by Intel – because they were not. FreeBSD Security Team received some heads-up just before Xmas, while OpenBSD, NetBSD and DragonflyBSD teams received no prior warnings.
Meltdown and Spectre attacks are hard to perform. It is a hard work to mitigate them in the software, as the bugs lay in the CPUs and are not fixable by microcode updates. Developers are trying to mitigate these bugs in a way that will deliver smallest performance losses. A lot of time consuming work is needed to fix CPU vendors’ mistakes. Linux developers had this time. BSD developers did not.
BSD user base too small?
BSD user base is small in comparison to Linux. Seems that it’s too small for Intel. PlayStation4 consoles are FreeBSD-based (and use AMD CPUs) but I think it’s safe to say that gaming devices are not the most important systems to be fixed. Netflix serves their content off FreeBSD but the bugs are not remotely exploitable (possibly not including JavaScript, but it’s running someone’s code locally) so there’s probably not much harm to be done here either.
However gamers and Netflix aren’t the only ones who use *BSD systems. I’d say that there is more than a few FreeBSD, NetBSD, OpenBSD and DragonFlyBSD servers on the internet.
In March 2017, Intel promised “more timely support to FreeBSD”. They knew about flaws in their CPUs in June and decided that a timely manner is the end of December – short before the embargo was to be lifted.
Intel and Google (probably Intel more): it was your job to pick the correct people to whom the bugs can be disclosed. In my humble opinion you chose poorly by disclosing these issues with ONLY Apple, Microsoft, and the Linux Foundation, of OS vendors. You did much harm to the BSD community.
Intel: It’s your bugs. And you offered “more support” to the FreeBSD Foundation less than 3 months prior to being informed (my guess is that you knew much earlier) on the flaws in YOUR products. I don’t want to write more here as the wording would be too strong.
Interview - Viewer Questions
These days, do you consider yourself more of an programmer or a sysadmin? Which one do you enjoy more?
Does FreeBSD/BSD enable your business or would another OS suit your needs just as well?
You’ve hinted that you use FreeBSD as part of your business. Can you elaborate on that and give some technical detail on how it’s used in that environment?
If you were allowed three wishes for anything at all to be implemented or changed in ZFS, what would they be, and why?
Per Dataset throughput and IOPS limiting
Per-File Cloning and/or zfsmv (move a file from one dataset to another, without copying)
Cluster support
Allan, you have previously mentioned that you have worked on FreeBSD on MIPS, what made you choose the Onion Omega over something like the Raspberry Pi?
What is BSD Now’s association with Jupiter broadcasting, and how did the relationship come to be? Jupiter seems to be associated with several Linux-themed podcasts, and I’m wondering how and why BSD Now joined Jupiter. The two communities (the Linuxes and BSDs) don’t always seem to mix freely -- or do they?
What kind of keyboard is that? Have you ever tried an ErgoDox? The ErgoDox EZ is made by a Canadian.
You mentioned when doing one of your talks on UCL for FreeBSD that you had only recently learned C. I am also aware of your history also on contributing to the FreeBSD handbook and to documentation in general. Given you started with C relatively recently, what made you want to learn it, how quickly did you pick it up, and is it your favourite language? It is most inspiring to me, as you are clearly so talented, and of all the languages I have learned (including C++), I still prefer C in my heart of hearts. I'd be really interested to hear your answer, many thanks.
***
News Roundup
LinuxAndUbuntu Review Of TrueOS A Unix Based OS (http://www.linuxandubuntu.com/home/linuxandubuntu-review-of-trueos-a-unix-based-os)
Trust me, the name TrueOS takes me back to 1990s when Tru64 UNIX operating system made its presence. TrueOS is PC-BSD’s new unified brand built upon FreeBSD-CURRENT code base. Note that TrueOS is not a Linux distro but is BSD Unix. FreeBSD is known for its cutting-edge features, security, scalability, and ability to work both as a server and desktop operating system.  TrueOS aims at having user-friendliness with the power of FreeBSD OS. Let us start with going into details of different aspects of the TrueOS.
TrueOS History
?
TrueOS was founded by Kris Moore in 2005 with name PC-BSD.  Initial version focused to make FreeBSD easy to use starting with providing GUI based installer (to relatively complicated FreeBSD installer). In the year 2006, PC-BSD was acquired by iXsystems. Before rebranding as TrueOS in Sept 2016, PC-BSD reached a stage starting considering better than vanilla FreeBSD.  Older PC-BSD version used to support both x86 and x86-64 architecture.
Kris Moore, the developer founder, says about rebranding: “We’ve already been using TrueOS for the server side of PC-BSD, and it made sense to unify the names. PC-BSD doesn’t reflect server or embedded well. TrueOS Desktop/Server/Embedded can be real products, avoids some of the alphabet soup, and gives us a more catchy name.”
TrueOS First Impression
?
The startup is little longer; may be due to starting up of many services.  The heavy KDE well suited to PC-BSD.  The C++/Qt5 based Lumina desktop environment is light and fast.  The Lumina offers an easy way to configure menu and panels.  I did not face any problems for continuous use of two weeks on a virtual machine having the minimal configuration: 1 GB RAM, 20 GB hard disk and Intel 3.06 GHz i3 processor. The Lumina desktop is light and fast. The developers of Lumina know what they are doing and have a good idea of what makes a good IDE.  As it happens with any new desktop environment, it needs some time to settle.  Let us hope that they keep to the path they are on with it.
Conclusion
?
The TrueOS is impressive when consider it as relatively young.  It is a daring step that TrueOS developers took FreeBSD Current rather than FreeBSD Stable code base. Overall it has created its own place from the legacy shadow of PC-BSD.  Starting with easy installation TrueOS is a good combination of software and utilities that make the system ready to use. Go and get a TrueOS ISO to unleash the “bleeding edge” tag of FreeBSD
Thinkpad x240 - FreeBSD Setup (http://stygix.org/nix/x240-freebsd.php)
What follows is a record of how I set up FreeBSD to be my daily driver OS on the Lenovo Thinkpad X240. Everything seems to work great. Although, the touchpad needs some tweaking. I've tried several configurations, even recompiling Xorg with EVDEV support and all that, to no avail. Eventually I will figure it out. Do not sleep the laptop from the command line. Do it from within Xorg, or it will not wake up. I don't know why. You can do it from a terminal within Xorg, just not from the naked command line without Xorg started. It also will not sleep by closing the lid. I included a sudo config that allows you to run /usr/sbin/zzz without a password, so what I do is I have a key combo assigned within i3wm to run "sudo /usr/sbin/zzz". It works fine this way.
I go into detail when it comes to setting up Xorg with i3wm. You can skip this if you want, but if you've never used a tiling window manager, it will handle screen real estate very efficiently on a laptop with a 12.5-inch screen and a touchpad.
First, download the amd64 image for 11.1-RELEASE and flash it to a USB pen drive. For the Unices, use this:
# dd if=FreeBSD-11.1-RELEASE-amd64-memstick.img of=/dev/da0 bs=1M conv=sync
Obviously, you'll change /dev/da0 to whatever the USB pen drive is assigned. Plug it in, check dmesg.
Leave it plugged in, restart the laptop. When prompted, tap Enter to halt the boot process, then F12 to select a bootable device. Choose the USB drive.
I won't go through the actual install process, but it is pretty damn easy so just look at a guide or two and you'll be fine. If you can install Debian, you can install FreeBSD. I will, however, recommend ZFS if you have over 4GB of RAM (my particular variant of the X240 has 8GB of RAM, so yours should have at least 4GB), along with an encrypted disk, and an encrypted SWAP partition. When prompted to add an additional user, and you get to the question where it asks for additional groups, please make sure you add the user to "wheel". The rest should be self-explanatory during the install.
Now for the good shit. You just booted into a fresh FreeBSD install. Now what? Well, time to fire up vi and open some config files...
CNN Article about CDROM.com and FreeBSD, from 1999 (https://www.cnn.com/TECH/computing/9904/08/cdrom.idg/index.html)
Walnut Creek CDROM sells a lot of CD-ROMs, but it gives away even more data. Specifically, anyone who has Internet access is free to log into wcarchive (ftp.cdrom.com) and start downloading bits.
Even with a good Internet connection, however, you should expect to be at it for a while. At the present time, wcarchive resides on half a terabyte (500 GB) of RAID 5-disk storage. Even if your 56-Kbps modem can deliver seven kilobytes per second, downloading the complete archive would take you 70 million seconds. Even then, some of the files would be more than two years out of date, so a bit of "back and fill" would be needed.
Of course, nobody uses wcarchive that way. Instead, they just drop in when they need the odd file or two. The FTP server is very accommodating; 3,600 simultaneous download sessions is the current limit and an upgrade to 10,000 sessions is in the works.
This translates to about 800 GB per day of downloads. Bob Bruce (Walnut Creek's founder) says he's thinking about issuing a press release when they reach a terabyte a day. But 800 GB isn't all that shabby....
The hardware
Because FTP archives don't do a lot of thinking, wcarchive doesn't need a massive cluster of CPUs. In fact, it gets by with a single 200-MHz P6 Pentium Pro and a measly(!) 1 GB of RAM. The I/O support, however, is fairly impressive.
A six-channel Mylex RAID controller (DAC960SXI; Ultra-Wide SCSI-SCSI) is the centerpiece of the I/O subsystem. Two channels link it to the PC ("Personal Computer"!?!), via a dual-channel Adaptec card (AHA-3940AUW; PCI to Ultra-Wide SCSI). An 256-MB internal cache helps it to eliminate recurring disk accesses.
Four nine-drive disk arrays provide the actual storage. The two larger arrays use 18-GB IBM drives; the two smaller arrays use 9-GB Micropolis and Quantum drives. A separate 4-GB Quantum drive is used as the "system disk."
The output side is handled by a single Intel 100Base-T controller (Pro/100B PCI), which feeds into the Internet through a number of shared DS3 (45 Mbps) and OC3 (155 Mbps) circuits.
A detailed description of the system is available as ftp.cdrom.com/archive-info/configuration;
The software
The system software is rather prosaic: a copy of FreeBSD, supplemented by home-grown FTP mirroring and server code. Because of the massive hardware support, the software "only" needs to keep the I/O going in an efficient and reliable manner.
FreeBSD, the "prosaic" operating system mentioned above, merits a bit more discussion. Like Linux, FreeBSD is open source. Anyone can examine, modify, and/or redistribute the source code. And, like Linux, an active user community helps the authors to find bugs, improve documentation, and generally support the OS.
Unlike Linux, FreeBSD is derived from the Berkeley Unix code that forms the foundation for most commercial Unix variants. When you use the "fast file system" (cylinder groups, long file names, symbolic links, etc.), TCP/IP networking, termcap, or even vi, you are using Berkeley Unix additions.
The version of BSD underlying FreeBSD, however, is "pure" BSD; don't look for the System V modifications you see in Solaris. Instead, think of it as SunOS, brought up to date with Kerberos, modern sendmail, an updated filesystem, and more. Solid, fast, and free!
One of FreeBSD's finest innovations, the Ports Collection, makes FreeBSD a delight for open source application users. The Ports Collection automates the downloading, building, and installation (including de-installation) of 2,300+ open source packages.
The company
Walnut Creek CDROM has been around for several years now, so you are likely to be familiar with its offerings. You may not realize, however, that it provides the major financial support for FreeBSD.
The FreeBSD support has two purposes. First, it provides the company with a solid base to run wcarchive and other massive projects. Second, it ties in with the company's mission of making software (and data) economically accessible.
Bob Bruce, the firm's founder, is an interesting guy: laid back and somewhat conservative in manner, but productive and innovative in practice. Here is a possibly illustrative story.
When Bob started selling CD-ROMs, disc caddies were selling for $15 each. Bob thought that was rather high, so he started investigating the marketplace. A long-distance call to Japan got him Sony's fax number; a series of faxes got him in touch with the salespeople.
It turned out that caddies were available, in bulk, for only a few dollars each. Bulk, in this case, meant pallet-loads of 10,000 caddies. In an act of great faith, Bob purchased a pallet of caddies, then proceeded to sell them for five dollars each.
The results were everything he might have wished. Folks who bought his CD-ROMs added caddies to their orders; folks who bought piles of caddies added in a disc or two. Either way, Walnut Creek CDROM was making a name for itself.
Many pallet-loads later, the company is still selling caddies, making and distributing CD-ROMs, and giving away bits. Walnut Creek CDROM is a real open-source success story; its breadth and depth of offerings is well worth a look.
Beastie Bits
OpenBSD adds kqueue event support to DRM, to detect device changes like HDMI cables being plugged in, and trigger randr events (https://github.com/openbsd/src/commit/b8584f4233dc11a328cd245a5843ec3d67462200)
Thesis describing QUAD3, a unix-like, multi-tasking operating system for the 6502 processor  (https://archive.org/details/AMultiTaskingOperatingSystemForMicrocomputers)
Windows is getting chmod and chown... (https://blogs.msdn.microsoft.com/commandline/2018/01/12/chmod-chown-wsl-improvements/)
Timeline: How they kept Meltdown and Spectre secret for so long  (https://www.theverge.com/platform/amp/2018/1/11/16878670/meltdown-spectre-disclosure-embargo-google-microsoft-linux)
bsd.network is a *BSD-themed Mastodon Instance (https://bsd.network/): Peter Hessler is administering a new Mastodon instance, running in an OpenBSD VM on top of an OpenBSD vmm hypervisor
Computer-Aided Instruction on UNIX (https://virtuallyfun.com/wordpress/wp-content/uploads/2017/12/whfUb.pdf)
AsiaBSDCon 2018 Travel Grant Application Now Open (https://www.freebsdfoundation.org/blog/asiabsdcon-2018-travel-grant-application-now-open/)
AsiaBSDCon 2018 FreeBSD Developers Summit Call for Proposals (https://www.freebsdfoundation.org/news-and-events/call-for-papers/asiabsdcon-2018-freebsd-developers-summit-call-for-proposals/)
LinuxFest Northwest 2018 Call for Proposals (https://www.freebsdfoundation.org/news-and-events/call-for-papers/linuxfest-northwest-2018-call-for-proposals/)
Feedback/Questions
Jason - Dont break my ports (http://dpaste.com/05PRNG2)
Wilyarti - show content (http://dpaste.com/1BG8GZW) https://clinetworking.wordpress.com/2017/12/08/data-de-duplication-file-diff-ing-and-s3-style-object-storage-using-digital-ocean-spaces
Scott - Your show is Perfect! (http://dpaste.com/0KER8YE#wrap)
Ken - Community Culture (http://dpaste.com/0WT8285#wrap)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We provide you with updates to Spectre and Meltdown from various BSD projects, a review of TrueOS from Linux, how to set up FreeBSD on ThinkPad x240, and a whole bunch of beastie bits.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=328083" rel="nofollow">KPTI patch lands in FreeBSD -current</a></h3>

<ul>
<li>After a heroic effort by Konstantin Belousov <a href="mailto:kib@FreeBSD.org" rel="nofollow">kib@FreeBSD.org</a>, the first meltdown patch has landed in FreeBSD</li>
<li>This creates separate page tables for the Kernel and userland, and switches between them when executions enters the kernel, and when it returns to userland</li>
<li>It is currently off by default, but you are encouraged to test it, so it can be merged back to the release branches. Set vm.pmap.pti=1 in /boot/loader.conf</li>
<li>The existing implementation of PCID (process-context identifiers), is not compatible with the new PTI code, and is disabled when PTI is enabled, decreasing performance. A future patch will use PCID in a way that is compatible with PTI.</li>
<li>PCID allows the OS to annotate memory mappings to specific processes, so that they can be flushed selectively, and so that they are only used when in the context of that application.</li>
<li>Once the developers are relatively confident in the correctness of the code that has landed in -current, it will be ported back to FreeBSD 10 and 11, and released as a security advisory.</li>
<li>Apparently porting back to FreeBSD 11 only has some relatively simple merge conflicts, but 10 will be more work.</li>
<li>Former FreeBSD Security Officer Dag-Erling Smørgrav has created a <a href="https://github.com/dag-erling/meltdown" rel="nofollow">meltdown testing and PoC tool</a> that you can use to check your system. It is not finished yet, and doesnt seem to work with newer processors (haswell and newer).</li>
<li>The first partial <a href="https://svnweb.freebsd.org/changeset/base/328011" rel="nofollow">mitigation for Spectre variant 2</a> for bhyve on AMD64 has also been committed</li>
<li><a href="https://wiki.freebsd.org/action/edit/SpeculativeExecutionVulnerabilities" rel="nofollow">The latest information is always available on the FreeBSD Wiki</a>
***</li>
</ul>

<h3><a href="http://www.daemonology.net/blog/2018-01-17-some-thoughts-on-spectre-and-meltdown.html" rel="nofollow">Some thoughts on Spectre and Meltdown</a></h3>

<ul>
<li>Colin Percival breaks down how these vulnerabilities work, with same nice analogies</li>
<li>What is a side channel:</li>
</ul>

<blockquote>
<p>I want to know when my girlfriend&#39;s passport expires, but she won&#39;t show me her passport (she complains that it has a horrible photo) and refuses to tell me the expiry date. I tell her that I&#39;m going to take her to Europe on vacation in August and watch what happens: If she runs out to renew her passport, I know that it will expire before August; while if she doesn&#39;t get her passport renewed, I know that it will remain valid beyond that date. Her desire to ensure that her passport would be valid inadvertently revealed to me some information: Whether its expiry date was before or after August.</p>
</blockquote>

<ul>
<li>Spectre Variant 1: </li>
</ul>

<blockquote>
<p>I tell my girlfriend that I&#39;m going to take her on vacation in June, but I don&#39;t tell her where yet; however, she knows that it will either be somewhere within Canada (for which she doesn&#39;t need a passport, since we live in Vancouver) or somewhere in Europe. She knows that it takes time to get a passport renewed, so she checks her passport and (if it was about to expire) gets it renewed just in case I later reveal that I&#39;m going to take her to Europe. If I tell her later that I&#39;m only taking her to Ottawa  well, she didn&#39;t need to renew her passport after all, but in the meantime her behaviour has already revealed to me whether her passport was about to expire. This is what Google refers to &quot;variant 1&quot; of the Spectre vulnerability: Even though she didn&#39;t need her passport, she made sure it was still valid just in case she was going to need it.</p>
</blockquote>

<ul>
<li>Spectre Variant 2:</li>
</ul>

<blockquote>
<p>I spend a week talking about how Oxford is a wonderful place to visit and I really enjoyed the years I spent there, and then I tell her that I want to take her on vacation. She very reasonably assumes that  since I&#39;ve been talking about Oxford so much  I must be planning on taking her to England, and runs off to check her passport and potentially renew it... but in fact I tricked her and I&#39;m only planning on taking her to Ottawa.</p>
</blockquote>

<ul>
<li>Meltdown:</li>
</ul>

<blockquote>
<p>I tell my girlfriend that I want to take her to the Korean peninsula. She knows that her passport is valid for long enough; but she immediately runs off to check that her North Korean visa hasn&#39;t expired. Why does she have a North Korean visa, you ask? Good question. She doesn&#39;t  but she runs off to check its expiry date anyway! Because she doesn&#39;t have a North Korean visa, she (somehow) checks the expiry date on someone else&#39;s North Korean visa, and then (if it is about to expire) runs out to renew it  and so by telling her that I want to take her to Korea for a vacation I find out something she couldn&#39;t have told me even if she wanted to.<br>
Final thoughts on vulnerability disclosure<br>
The way these issues were handled was a mess; frankly, I expected better of Google, I expected better of Intel, and I expected better of the Linux community. When I found that Hyper-Threading was easily exploitable, I spent five months notifying the security community and preparing everyone for my announcement of the vulnerability; but when the embargo ended at midnight UTC and FreeBSD published its advisory a few minutes later, the broader world was taken entirely by surprise. Nobody knew what was coming aside from the people who needed to know; and the people who needed to know had months of warning.<br>
Contrast that with what happened this time around. Google discovered a problem and reported it to Intel, AMD, and ARM on June 1st. Did they then go around contacting all of the operating systems which would need to work on fixes for this? Not even close. FreeBSD was notified the week before Christmas, over six months after the vulnerabilities were discovered. Now, FreeBSD can occasionally respond very quickly to security vulnerabilities, even when they arise at inconvenient times  on November 30th 2009 a vulnerability was reported at 22:12 UTC, and on December 1st I provided a patch at 01:20 UTC, barely over 3 hours later  but that was an extremely simple bug which needed only a few lines of code to fix; the Spectre and Meltdown issues are orders of magnitude more complex.<br>
To make things worse, the Linux community was notified and couldn&#39;t keep their mouths shut. Standard practice for multi-vendor advisories like this is that an embargo date is set, and <strong>nobody does anything publicly prior to that date</strong>. People don&#39;t publish advisories; they don&#39;t commit patches into their public source code repositories; and they definitely don&#39;t engage in arguments on public mailing lists about whether the patches are needed for different CPUs. As a result, despite an embargo date being set for January 9th, by January 4th anyone who cared knew about the issues and there was code being passed around on Twitter for exploiting them.<br>
This is not the first time I&#39;ve seen people get sloppy with embargoes recently, but it&#39;s by far the worst case. As an industry we pride ourselves on the concept of responsible disclosure  ensuring that people are notified in time to prepare fixes before an issue is disclosed publicly  but in this case there was far too much disclosure and nowhere near enough responsibility. We can do better, and I sincerely hope that next time we do.</p>
</blockquote>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180115073406" rel="nofollow">CPU microcode update code for amd64</a></h3>

<p><a href="https://marc.info/?l=openbsd-tech&m=151588857304763&w=2" rel="nofollow"></a></p>

<ul>
<li>Patrick Wildt (patrick@) recently committed some code that will update the Intel microcode on many Intel CPUs, a diff initially written by Stefan Fritsch (sf@). The microcode of your CPU is basically the firmware that runs on your (Intel) processor, defining its instruction set in terms of so called &quot;microinstructions&quot;. The new code depends, of course, on the corresponding firmware package, ported by Patrick which can be installed using a very recent fw_update(1). Of course, this all plays into the recently revealed problems in Intel (and other) CPUs, Meltdown and Spectre.</li>
<li>Now Theo has explained the workings of the code on openbsd-tech, detailing some of the challenges in updating microcode on CPUs where your OS is already starting to run.</li>
<li><a href="https://marc.info/?l=openbsd-tech&m=151588857304763&w=2" rel="nofollow">Theo hints at future updates to the intel-firmware package in his mail:</a></li>
</ul>

<blockquote>
<p>Patrick and others committed amd64 Intel cpu microcode update code over the last few days.  The approach isn&#39;t perfect, but it is good enough for a start.  I want to explain the situation.<br>
When you fw_update, you&#39;ll get the firmware files.<br>
Upon a reboot, it will attempt to update the microcode on your cpus.<br>
Maybe there isn&#39;t a new microcode.  Maybe your BIOS has a copy of the microcode and installs it before booting OpenBSD.<br>
This firmware installation is done a little late.  Doing it better will require some work in the bootblocks to find the firmware files, but time is a bit short to do that right now.<br>
The branch-target-cache flushing features added in new microcode are not being used yet.  There is more code which has to be written, but again other work is happening first.<br>
Also, Intel is saying their new microcodes sucks and people should wait a little.<br>
&quot;Hi, my name is Intel and I&#39;m an cheating speculator&quot;.</p>
</blockquote>

<ul>
<li>Several developers are working on mitigations for these issues, attacking the problem from several angles. Expect to see more updates to a CVS tree near you soon.</li>
</ul>

<hr>

<h3><a href="https://malcont.net/2018/01/dont-like-meltdown-spectre-releated-bugs-handled/" rel="nofollow">Intel: as a *BSD user, I am fucking pissed!</a></h3>

<blockquote>
<p>I wasnt going to write anything on the recently found x64 architecture  related bugs. Im not a kernel developer nor even a programmer and I cant say that I have a solid understanding of what Meltdown and Spectre attacks are. Also there already is a ton of articles and posts written by people who have no grasp of the subject.<br>
Im however a malcontent and I find this a good way to express my feelings:</p>

<p>Intel: as a *BSD user, I am fucking pissed!</p>
</blockquote>

<ul>
<li>Meltdown, Spectre and BSD  the pissed part</li>
</ul>

<blockquote>
<p>Part of my work is UNIX-like systems administration  including BSDs and Linuces. As much as I am happy with Linux changes already made, I am beyond pissed about how the BSDs were handled by Intel  because they were not. FreeBSD Security Team received some heads-up just before Xmas, while OpenBSD, NetBSD and DragonflyBSD teams received no prior warnings.</p>

<p>Meltdown and Spectre attacks are hard to perform. It is a hard work to mitigate them in the software, as the bugs lay in the CPUs and are not fixable by microcode updates. Developers are trying to mitigate these bugs in a way that will deliver smallest performance losses. A lot of time consuming work is needed to fix CPU vendors mistakes. Linux developers had this time. BSD developers did not.</p>
</blockquote>

<ul>
<li>BSD user base too small?</li>
</ul>

<blockquote>
<p>BSD user base is small in comparison to Linux. Seems that its too small for Intel. PlayStation4 consoles are FreeBSD-based (and use AMD CPUs) but I think its safe to say that gaming devices are not the most important systems to be fixed. Netflix serves their content off FreeBSD but the bugs are not remotely exploitable (possibly not including JavaScript, but its running someones code locally) so theres probably not much harm to be done here either.<br>
However gamers and Netflix arent the only ones who use *BSD systems. Id say that there is more than a few FreeBSD, NetBSD, OpenBSD and DragonFlyBSD servers on the internet.</p>

<p>In March 2017, Intel promised more timely support to FreeBSD. They knew about flaws in their CPUs in June and decided that a timely manner is the end of December  short before the embargo was to be lifted.</p>

<p>Intel and Google (probably Intel more): it was your job to pick the correct people to whom the bugs can be disclosed. In my humble opinion you chose poorly by disclosing these issues with ONLY Apple, Microsoft, and the Linux Foundation, of OS vendors. You did much harm to the BSD community.</p>

<p>Intel: Its your bugs. And you offered more support to the FreeBSD Foundation less than 3 months prior to being informed (my guess is that you knew much earlier) on the flaws in YOUR products. I dont want to write more here as the wording would be too strong.</p>
</blockquote>

<hr>

<h2>Interview - Viewer Questions</h2>

<ul>
<li>These days, do you consider yourself more of an programmer or a sysadmin? Which one do you enjoy more?</li>
<li>Does FreeBSD/BSD enable your business or would another OS suit your needs just as well?</li>
<li>Youve hinted that you use FreeBSD as part of your business. Can you elaborate on that and give some technical detail on how its used in that environment?</li>
<li>If you were allowed three wishes for anything at all to be implemented or changed in ZFS, what would they be, and why?

<ul>
<li>Per Dataset throughput and IOPS limiting</li>
<li>Per-File Cloning and/or zfsmv (move a file from one dataset to another, without copying)</li>
<li>Cluster support</li>
</ul></li>
<li>Allan, you have previously mentioned that you have worked on FreeBSD on MIPS, what made you choose the Onion Omega over something like the Raspberry Pi?</li>
<li>What is BSD Nows association with Jupiter broadcasting, and how did the relationship come to be? Jupiter seems to be associated with several Linux-themed podcasts, and Im wondering how and why BSD Now joined Jupiter. The two communities (the Linuxes and BSDs) dont always seem to mix freely -- or do they?</li>
<li>What kind of keyboard is that? Have you ever tried an ErgoDox? The ErgoDox EZ is made by a Canadian.</li>
<li>You mentioned when doing one of your talks on UCL for FreeBSD that you had only recently learned C. I am also aware of your history also on contributing to the FreeBSD handbook and to documentation in general. Given you started with C relatively recently, what made you want to learn it, how quickly did you pick it up, and is it your favourite language? It is most inspiring to me, as you are clearly so talented, and of all the languages I have learned (including C++), I still prefer C in my heart of hearts. I&#39;d be really interested to hear your answer, many thanks.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.linuxandubuntu.com/home/linuxandubuntu-review-of-trueos-a-unix-based-os" rel="nofollow">LinuxAndUbuntu Review Of TrueOS A Unix Based OS</a></h3>

<blockquote>
<p>Trust me, the name TrueOS takes me back to 1990s when Tru64 UNIX operating system made its presence. TrueOS is PC-BSDs new unified brand built upon FreeBSD-CURRENT code base. Note that TrueOS is not a Linux distro but is BSD Unix. FreeBSD is known for its cutting-edge features, security, scalability, and ability to work both as a server and desktop operating system.  TrueOS aims at having user-friendliness with the power of FreeBSD OS. Let us start with going into details of different aspects of the TrueOS.</p>
</blockquote>

<ul>
<li><p>TrueOS History<br>
?</p>

<blockquote>
<p>TrueOS was founded by Kris Moore in 2005 with name PC-BSD.  Initial version focused to make FreeBSD easy to use starting with providing GUI based installer (to relatively complicated FreeBSD installer). In the year 2006, PC-BSD was acquired by iXsystems. Before rebranding as TrueOS in Sept 2016, PC-BSD reached a stage starting considering better than vanilla FreeBSD.  Older PC-BSD version used to support both x86 and x86-64 architecture.<br>
Kris Moore, the developer founder, says about rebranding: Weve already been using TrueOS for the server side of PC-BSD, and it made sense to unify the names. PC-BSD doesnt reflect server or embedded well. TrueOS Desktop/Server/Embedded can be real products, avoids some of the alphabet soup, and gives us a more catchy name.</p>
</blockquote></li>
<li><p>TrueOS First Impression<br>
?</p>

<blockquote>
<p>The startup is little longer; may be due to starting up of many services.  The heavy KDE well suited to PC-BSD.  The C++/Qt5 based Lumina desktop environment is light and fast.  The Lumina offers an easy way to configure menu and panels.  I did not face any problems for continuous use of two weeks on a virtual machine having the minimal configuration: 1 GB RAM, 20 GB hard disk and Intel 3.06 GHz i3 processor. The Lumina desktop is light and fast. The developers of Lumina know what they are doing and have a good idea of what makes a good IDE.  As it happens with any new desktop environment, it needs some time to settle.  Let us hope that they keep to the path they are on with it.</p>
</blockquote></li>
<li><p>Conclusion<br>
?</p>

<blockquote>
<p>The TrueOS is impressive when consider it as relatively young.  It is a daring step that TrueOS developers took FreeBSD Current rather than FreeBSD Stable code base. Overall it has created its own place from the legacy shadow of PC-BSD.  Starting with easy installation TrueOS is a good combination of software and utilities that make the system ready to use. Go and get a TrueOS ISO to unleash the bleeding edge tag of FreeBSD</p>
</blockquote></li>
</ul>

<hr>

<h3><a href="http://stygix.org/nix/x240-freebsd.php" rel="nofollow">Thinkpad x240 - FreeBSD Setup</a></h3>

<blockquote>
<p>What follows is a record of how I set up FreeBSD to be my daily driver OS on the Lenovo Thinkpad X240. Everything seems to work great. Although, the touchpad needs some tweaking. I&#39;ve tried several configurations, even recompiling Xorg with EVDEV support and all that, to no avail. Eventually I will figure it out. Do not sleep the laptop from the command line. Do it from within Xorg, or it will not wake up. I don&#39;t know why. You can do it from a terminal within Xorg, just not from the naked command line without Xorg started. It also will not sleep by closing the lid. I included a sudo config that allows you to run /usr/sbin/zzz without a password, so what I do is I have a key combo assigned within i3wm to run &quot;sudo /usr/sbin/zzz&quot;. It works fine this way.</p>

<p>I go into detail when it comes to setting up Xorg with i3wm. You can skip this if you want, but if you&#39;ve never used a tiling window manager, it will handle screen real estate very efficiently on a laptop with a 12.5-inch screen and a touchpad.</p>

<p>First, download the amd64 image for 11.1-RELEASE and flash it to a USB pen drive. For the Unices, use this:</p>
</blockquote>

<p><code># dd if=FreeBSD-11.1-RELEASE-amd64-memstick.img of=/dev/da0 bs=1M conv=sync</code></p>

<blockquote>
<p>Obviously, you&#39;ll change /dev/da0 to whatever the USB pen drive is assigned. Plug it in, check dmesg.</p>

<p>Leave it plugged in, restart the laptop. When prompted, tap Enter to halt the boot process, then F12 to select a bootable device. Choose the USB drive.</p>

<p>I won&#39;t go through the actual install process, but it is pretty damn easy so just look at a guide or two and you&#39;ll be fine. If you can install Debian, you can install FreeBSD. I will, however, recommend ZFS if you have over 4GB of RAM (my particular variant of the X240 has 8GB of RAM, so yours should have at least 4GB), along with an encrypted disk, and an encrypted SWAP partition. When prompted to add an additional user, and you get to the question where it asks for additional groups, please make sure you add the user to &quot;wheel&quot;. The rest should be self-explanatory during the install.</p>

<p>Now for the good shit. You just booted into a fresh FreeBSD install. Now what? Well, time to fire up vi and open some config files...</p>

<hr>
</blockquote>

<h3><a href="https://www.cnn.com/TECH/computing/9904/08/cdrom.idg/index.html" rel="nofollow">CNN Article about CDROM.com and FreeBSD, from 1999</a></h3>

<blockquote>
<p>Walnut Creek CDROM sells a lot of CD-ROMs, but it gives away even more data. Specifically, anyone who has Internet access is free to log into wcarchive (ftp.cdrom.com) and start downloading bits.<br>
Even with a good Internet connection, however, you should expect to be at it for a while. At the present time, wcarchive resides on half a terabyte (500 GB) of RAID 5-disk storage. Even if your 56-Kbps modem can deliver seven kilobytes per second, downloading the complete archive would take you 70 million seconds. Even then, some of the files would be more than two years out of date, so a bit of &quot;back and fill&quot; would be needed.<br>
Of course, nobody uses wcarchive that way. Instead, they just drop in when they need the odd file or two. The FTP server is very accommodating; 3,600 simultaneous download sessions is the current limit and an upgrade to 10,000 sessions is in the works.<br>
This translates to about 800 GB per day of downloads. Bob Bruce (Walnut Creek&#39;s founder) says he&#39;s thinking about issuing a press release when they reach a terabyte a day. But 800 GB isn&#39;t all that shabby....</p>
</blockquote>

<ul>
<li>The hardware</li>
</ul>

<blockquote>
<p>Because FTP archives don&#39;t do a lot of thinking, wcarchive doesn&#39;t need a massive cluster of CPUs. In fact, it gets by with a single 200-MHz P6 Pentium Pro and a measly(!) 1 GB of RAM. The I/O support, however, is fairly impressive.<br>
A six-channel Mylex RAID controller (DAC960SXI; Ultra-Wide SCSI-SCSI) is the centerpiece of the I/O subsystem. Two channels link it to the PC (&quot;Personal Computer&quot;!?!), via a dual-channel Adaptec card (AHA-3940AUW; PCI to Ultra-Wide SCSI). An 256-MB internal cache helps it to eliminate recurring disk accesses.<br>
Four nine-drive disk arrays provide the actual storage. The two larger arrays use 18-GB IBM drives; the two smaller arrays use 9-GB Micropolis and Quantum drives. A separate 4-GB Quantum drive is used as the &quot;system disk.&quot;<br>
The output side is handled by a single Intel 100Base-T controller (Pro/100B PCI), which feeds into the Internet through a number of shared DS3 (45 Mbps) and OC3 (155 Mbps) circuits.<br>
A detailed description of the system is available as ftp.cdrom.com/archive-info/configuration;</p>
</blockquote>

<ul>
<li>The software</li>
</ul>

<blockquote>
<p>The system software is rather prosaic: a copy of FreeBSD, supplemented by home-grown FTP mirroring and server code. Because of the massive hardware support, the software &quot;only&quot; needs to keep the I/O going in an efficient and reliable manner.<br>
FreeBSD, the &quot;prosaic&quot; operating system mentioned above, merits a bit more discussion. Like Linux, FreeBSD is open source. Anyone can examine, modify, and/or redistribute the source code. And, like Linux, an active user community helps the authors to find bugs, improve documentation, and generally support the OS.<br>
Unlike Linux, FreeBSD is derived from the Berkeley Unix code that forms the foundation for most commercial Unix variants. When you use the &quot;fast file system&quot; (cylinder groups, long file names, symbolic links, etc.), TCP/IP networking, termcap, or even vi, you are using Berkeley Unix additions.<br>
The version of BSD underlying FreeBSD, however, is &quot;pure&quot; BSD; don&#39;t look for the System V modifications you see in Solaris. Instead, think of it as SunOS, brought up to date with Kerberos, modern sendmail, an updated filesystem, and more. Solid, fast, and free!<br>
One of FreeBSD&#39;s finest innovations, the Ports Collection, makes FreeBSD a delight for open source application users. The Ports Collection automates the downloading, building, and installation (including de-installation) of 2,300+ open source packages.</p>
</blockquote>

<ul>
<li>The company</li>
</ul>

<blockquote>
<p>Walnut Creek CDROM has been around for several years now, so you are likely to be familiar with its offerings. You may not realize, however, that it provides the major financial support for FreeBSD.<br>
The FreeBSD support has two purposes. First, it provides the company with a solid base to run wcarchive and other massive projects. Second, it ties in with the company&#39;s mission of making software (and data) economically accessible.<br>
Bob Bruce, the firm&#39;s founder, is an interesting guy: laid back and somewhat conservative in manner, but productive and innovative in practice. Here is a possibly illustrative story.<br>
When Bob started selling CD-ROMs, disc caddies were selling for $15 each. Bob thought that was rather high, so he started investigating the marketplace. A long-distance call to Japan got him Sony&#39;s fax number; a series of faxes got him in touch with the salespeople.<br>
It turned out that caddies were available, in bulk, for only a few dollars each. Bulk, in this case, meant pallet-loads of 10,000 caddies. In an act of great faith, Bob purchased a pallet of caddies, then proceeded to sell them for five dollars each.<br>
The results were everything he might have wished. Folks who bought his CD-ROMs added caddies to their orders; folks who bought piles of caddies added in a disc or two. Either way, Walnut Creek CDROM was making a name for itself.<br>
Many pallet-loads later, the company is still selling caddies, making and distributing CD-ROMs, and giving away bits. Walnut Creek CDROM is a real open-source success story; its breadth and depth of offerings is well worth a look.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://github.com/openbsd/src/commit/b8584f4233dc11a328cd245a5843ec3d67462200" rel="nofollow">OpenBSD adds kqueue event support to DRM, to detect device changes like HDMI cables being plugged in, and trigger randr events</a></li>
<li><a href="https://archive.org/details/AMultiTaskingOperatingSystemForMicrocomputers" rel="nofollow">Thesis describing QUAD3, a unix-like, multi-tasking operating system for the 6502 processor </a></li>
<li><a href="https://blogs.msdn.microsoft.com/commandline/2018/01/12/chmod-chown-wsl-improvements/" rel="nofollow">Windows is getting chmod and chown...</a></li>
<li><a href="https://www.theverge.com/platform/amp/2018/1/11/16878670/meltdown-spectre-disclosure-embargo-google-microsoft-linux" rel="nofollow">Timeline: How they kept Meltdown and Spectre secret for so long </a></li>
<li><a href="https://bsd.network/" rel="nofollow">bsd.network is a *BSD-themed Mastodon Instance</a>: Peter Hessler is administering a new Mastodon instance, running in an OpenBSD VM on top of an OpenBSD vmm hypervisor</li>
<li><a href="https://virtuallyfun.com/wordpress/wp-content/uploads/2017/12/whfUb.pdf" rel="nofollow">Computer-Aided Instruction on UNIX</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/asiabsdcon-2018-travel-grant-application-now-open/" rel="nofollow">AsiaBSDCon 2018 Travel Grant Application Now Open</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/asiabsdcon-2018-freebsd-developers-summit-call-for-proposals/" rel="nofollow">AsiaBSDCon 2018 FreeBSD Developers Summit Call for Proposals</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/linuxfest-northwest-2018-call-for-proposals/" rel="nofollow">LinuxFest Northwest 2018 Call for Proposals</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Jason - <a href="http://dpaste.com/05PRNG2" rel="nofollow">Dont break my ports</a></li>
<li><p>Wilyarti - <a href="http://dpaste.com/1BG8GZW" rel="nofollow">show content</a> <a href="https://clinetworking.wordpress.com/2017/12/08/data-de-duplication-file-diff-ing-and-s3-style-object-storage-using-digital-ocean-spaces" rel="nofollow">https://clinetworking.wordpress.com/2017/12/08/data-de-duplication-file-diff-ing-and-s3-style-object-storage-using-digital-ocean-spaces</a></p></li>
<li><p>Scott - <a href="http://dpaste.com/0KER8YE#wrap" rel="nofollow">Your show is Perfect!</a></p></li>
<li><p>Ken - <a href="http://dpaste.com/0WT8285#wrap" rel="nofollow">Community Culture</a></p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We provide you with updates to Spectre and Meltdown from various BSD projects, a review of TrueOS from Linux, how to set up FreeBSD on ThinkPad x240, and a whole bunch of beastie bits.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=328083" rel="nofollow">KPTI patch lands in FreeBSD -current</a></h3>

<ul>
<li>After a heroic effort by Konstantin Belousov <a href="mailto:kib@FreeBSD.org" rel="nofollow">kib@FreeBSD.org</a>, the first meltdown patch has landed in FreeBSD</li>
<li>This creates separate page tables for the Kernel and userland, and switches between them when executions enters the kernel, and when it returns to userland</li>
<li>It is currently off by default, but you are encouraged to test it, so it can be merged back to the release branches. Set vm.pmap.pti=1 in /boot/loader.conf</li>
<li>The existing implementation of PCID (process-context identifiers), is not compatible with the new PTI code, and is disabled when PTI is enabled, decreasing performance. A future patch will use PCID in a way that is compatible with PTI.</li>
<li>PCID allows the OS to annotate memory mappings to specific processes, so that they can be flushed selectively, and so that they are only used when in the context of that application.</li>
<li>Once the developers are relatively confident in the correctness of the code that has landed in -current, it will be ported back to FreeBSD 10 and 11, and released as a security advisory.</li>
<li>Apparently porting back to FreeBSD 11 only has some relatively simple merge conflicts, but 10 will be more work.</li>
<li>Former FreeBSD Security Officer Dag-Erling Smørgrav has created a <a href="https://github.com/dag-erling/meltdown" rel="nofollow">meltdown testing and PoC tool</a> that you can use to check your system. It is not finished yet, and doesnt seem to work with newer processors (haswell and newer).</li>
<li>The first partial <a href="https://svnweb.freebsd.org/changeset/base/328011" rel="nofollow">mitigation for Spectre variant 2</a> for bhyve on AMD64 has also been committed</li>
<li><a href="https://wiki.freebsd.org/action/edit/SpeculativeExecutionVulnerabilities" rel="nofollow">The latest information is always available on the FreeBSD Wiki</a>
***</li>
</ul>

<h3><a href="http://www.daemonology.net/blog/2018-01-17-some-thoughts-on-spectre-and-meltdown.html" rel="nofollow">Some thoughts on Spectre and Meltdown</a></h3>

<ul>
<li>Colin Percival breaks down how these vulnerabilities work, with same nice analogies</li>
<li>What is a side channel:</li>
</ul>

<blockquote>
<p>I want to know when my girlfriend&#39;s passport expires, but she won&#39;t show me her passport (she complains that it has a horrible photo) and refuses to tell me the expiry date. I tell her that I&#39;m going to take her to Europe on vacation in August and watch what happens: If she runs out to renew her passport, I know that it will expire before August; while if she doesn&#39;t get her passport renewed, I know that it will remain valid beyond that date. Her desire to ensure that her passport would be valid inadvertently revealed to me some information: Whether its expiry date was before or after August.</p>
</blockquote>

<ul>
<li>Spectre Variant 1: </li>
</ul>

<blockquote>
<p>I tell my girlfriend that I&#39;m going to take her on vacation in June, but I don&#39;t tell her where yet; however, she knows that it will either be somewhere within Canada (for which she doesn&#39;t need a passport, since we live in Vancouver) or somewhere in Europe. She knows that it takes time to get a passport renewed, so she checks her passport and (if it was about to expire) gets it renewed just in case I later reveal that I&#39;m going to take her to Europe. If I tell her later that I&#39;m only taking her to Ottawa  well, she didn&#39;t need to renew her passport after all, but in the meantime her behaviour has already revealed to me whether her passport was about to expire. This is what Google refers to &quot;variant 1&quot; of the Spectre vulnerability: Even though she didn&#39;t need her passport, she made sure it was still valid just in case she was going to need it.</p>
</blockquote>

<ul>
<li>Spectre Variant 2:</li>
</ul>

<blockquote>
<p>I spend a week talking about how Oxford is a wonderful place to visit and I really enjoyed the years I spent there, and then I tell her that I want to take her on vacation. She very reasonably assumes that  since I&#39;ve been talking about Oxford so much  I must be planning on taking her to England, and runs off to check her passport and potentially renew it... but in fact I tricked her and I&#39;m only planning on taking her to Ottawa.</p>
</blockquote>

<ul>
<li>Meltdown:</li>
</ul>

<blockquote>
<p>I tell my girlfriend that I want to take her to the Korean peninsula. She knows that her passport is valid for long enough; but she immediately runs off to check that her North Korean visa hasn&#39;t expired. Why does she have a North Korean visa, you ask? Good question. She doesn&#39;t  but she runs off to check its expiry date anyway! Because she doesn&#39;t have a North Korean visa, she (somehow) checks the expiry date on someone else&#39;s North Korean visa, and then (if it is about to expire) runs out to renew it  and so by telling her that I want to take her to Korea for a vacation I find out something she couldn&#39;t have told me even if she wanted to.<br>
Final thoughts on vulnerability disclosure<br>
The way these issues were handled was a mess; frankly, I expected better of Google, I expected better of Intel, and I expected better of the Linux community. When I found that Hyper-Threading was easily exploitable, I spent five months notifying the security community and preparing everyone for my announcement of the vulnerability; but when the embargo ended at midnight UTC and FreeBSD published its advisory a few minutes later, the broader world was taken entirely by surprise. Nobody knew what was coming aside from the people who needed to know; and the people who needed to know had months of warning.<br>
Contrast that with what happened this time around. Google discovered a problem and reported it to Intel, AMD, and ARM on June 1st. Did they then go around contacting all of the operating systems which would need to work on fixes for this? Not even close. FreeBSD was notified the week before Christmas, over six months after the vulnerabilities were discovered. Now, FreeBSD can occasionally respond very quickly to security vulnerabilities, even when they arise at inconvenient times  on November 30th 2009 a vulnerability was reported at 22:12 UTC, and on December 1st I provided a patch at 01:20 UTC, barely over 3 hours later  but that was an extremely simple bug which needed only a few lines of code to fix; the Spectre and Meltdown issues are orders of magnitude more complex.<br>
To make things worse, the Linux community was notified and couldn&#39;t keep their mouths shut. Standard practice for multi-vendor advisories like this is that an embargo date is set, and <strong>nobody does anything publicly prior to that date</strong>. People don&#39;t publish advisories; they don&#39;t commit patches into their public source code repositories; and they definitely don&#39;t engage in arguments on public mailing lists about whether the patches are needed for different CPUs. As a result, despite an embargo date being set for January 9th, by January 4th anyone who cared knew about the issues and there was code being passed around on Twitter for exploiting them.<br>
This is not the first time I&#39;ve seen people get sloppy with embargoes recently, but it&#39;s by far the worst case. As an industry we pride ourselves on the concept of responsible disclosure  ensuring that people are notified in time to prepare fixes before an issue is disclosed publicly  but in this case there was far too much disclosure and nowhere near enough responsibility. We can do better, and I sincerely hope that next time we do.</p>
</blockquote>

<hr>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20180115073406" rel="nofollow">CPU microcode update code for amd64</a></h3>

<p><a href="https://marc.info/?l=openbsd-tech&m=151588857304763&w=2" rel="nofollow"></a></p>

<ul>
<li>Patrick Wildt (patrick@) recently committed some code that will update the Intel microcode on many Intel CPUs, a diff initially written by Stefan Fritsch (sf@). The microcode of your CPU is basically the firmware that runs on your (Intel) processor, defining its instruction set in terms of so called &quot;microinstructions&quot;. The new code depends, of course, on the corresponding firmware package, ported by Patrick which can be installed using a very recent fw_update(1). Of course, this all plays into the recently revealed problems in Intel (and other) CPUs, Meltdown and Spectre.</li>
<li>Now Theo has explained the workings of the code on openbsd-tech, detailing some of the challenges in updating microcode on CPUs where your OS is already starting to run.</li>
<li><a href="https://marc.info/?l=openbsd-tech&m=151588857304763&w=2" rel="nofollow">Theo hints at future updates to the intel-firmware package in his mail:</a></li>
</ul>

<blockquote>
<p>Patrick and others committed amd64 Intel cpu microcode update code over the last few days.  The approach isn&#39;t perfect, but it is good enough for a start.  I want to explain the situation.<br>
When you fw_update, you&#39;ll get the firmware files.<br>
Upon a reboot, it will attempt to update the microcode on your cpus.<br>
Maybe there isn&#39;t a new microcode.  Maybe your BIOS has a copy of the microcode and installs it before booting OpenBSD.<br>
This firmware installation is done a little late.  Doing it better will require some work in the bootblocks to find the firmware files, but time is a bit short to do that right now.<br>
The branch-target-cache flushing features added in new microcode are not being used yet.  There is more code which has to be written, but again other work is happening first.<br>
Also, Intel is saying their new microcodes sucks and people should wait a little.<br>
&quot;Hi, my name is Intel and I&#39;m an cheating speculator&quot;.</p>
</blockquote>

<ul>
<li>Several developers are working on mitigations for these issues, attacking the problem from several angles. Expect to see more updates to a CVS tree near you soon.</li>
</ul>

<hr>

<h3><a href="https://malcont.net/2018/01/dont-like-meltdown-spectre-releated-bugs-handled/" rel="nofollow">Intel: as a *BSD user, I am fucking pissed!</a></h3>

<blockquote>
<p>I wasnt going to write anything on the recently found x64 architecture  related bugs. Im not a kernel developer nor even a programmer and I cant say that I have a solid understanding of what Meltdown and Spectre attacks are. Also there already is a ton of articles and posts written by people who have no grasp of the subject.<br>
Im however a malcontent and I find this a good way to express my feelings:</p>

<p>Intel: as a *BSD user, I am fucking pissed!</p>
</blockquote>

<ul>
<li>Meltdown, Spectre and BSD  the pissed part</li>
</ul>

<blockquote>
<p>Part of my work is UNIX-like systems administration  including BSDs and Linuces. As much as I am happy with Linux changes already made, I am beyond pissed about how the BSDs were handled by Intel  because they were not. FreeBSD Security Team received some heads-up just before Xmas, while OpenBSD, NetBSD and DragonflyBSD teams received no prior warnings.</p>

<p>Meltdown and Spectre attacks are hard to perform. It is a hard work to mitigate them in the software, as the bugs lay in the CPUs and are not fixable by microcode updates. Developers are trying to mitigate these bugs in a way that will deliver smallest performance losses. A lot of time consuming work is needed to fix CPU vendors mistakes. Linux developers had this time. BSD developers did not.</p>
</blockquote>

<ul>
<li>BSD user base too small?</li>
</ul>

<blockquote>
<p>BSD user base is small in comparison to Linux. Seems that its too small for Intel. PlayStation4 consoles are FreeBSD-based (and use AMD CPUs) but I think its safe to say that gaming devices are not the most important systems to be fixed. Netflix serves their content off FreeBSD but the bugs are not remotely exploitable (possibly not including JavaScript, but its running someones code locally) so theres probably not much harm to be done here either.<br>
However gamers and Netflix arent the only ones who use *BSD systems. Id say that there is more than a few FreeBSD, NetBSD, OpenBSD and DragonFlyBSD servers on the internet.</p>

<p>In March 2017, Intel promised more timely support to FreeBSD. They knew about flaws in their CPUs in June and decided that a timely manner is the end of December  short before the embargo was to be lifted.</p>

<p>Intel and Google (probably Intel more): it was your job to pick the correct people to whom the bugs can be disclosed. In my humble opinion you chose poorly by disclosing these issues with ONLY Apple, Microsoft, and the Linux Foundation, of OS vendors. You did much harm to the BSD community.</p>

<p>Intel: Its your bugs. And you offered more support to the FreeBSD Foundation less than 3 months prior to being informed (my guess is that you knew much earlier) on the flaws in YOUR products. I dont want to write more here as the wording would be too strong.</p>
</blockquote>

<hr>

<h2>Interview - Viewer Questions</h2>

<ul>
<li>These days, do you consider yourself more of an programmer or a sysadmin? Which one do you enjoy more?</li>
<li>Does FreeBSD/BSD enable your business or would another OS suit your needs just as well?</li>
<li>Youve hinted that you use FreeBSD as part of your business. Can you elaborate on that and give some technical detail on how its used in that environment?</li>
<li>If you were allowed three wishes for anything at all to be implemented or changed in ZFS, what would they be, and why?

<ul>
<li>Per Dataset throughput and IOPS limiting</li>
<li>Per-File Cloning and/or zfsmv (move a file from one dataset to another, without copying)</li>
<li>Cluster support</li>
</ul></li>
<li>Allan, you have previously mentioned that you have worked on FreeBSD on MIPS, what made you choose the Onion Omega over something like the Raspberry Pi?</li>
<li>What is BSD Nows association with Jupiter broadcasting, and how did the relationship come to be? Jupiter seems to be associated with several Linux-themed podcasts, and Im wondering how and why BSD Now joined Jupiter. The two communities (the Linuxes and BSDs) dont always seem to mix freely -- or do they?</li>
<li>What kind of keyboard is that? Have you ever tried an ErgoDox? The ErgoDox EZ is made by a Canadian.</li>
<li>You mentioned when doing one of your talks on UCL for FreeBSD that you had only recently learned C. I am also aware of your history also on contributing to the FreeBSD handbook and to documentation in general. Given you started with C relatively recently, what made you want to learn it, how quickly did you pick it up, and is it your favourite language? It is most inspiring to me, as you are clearly so talented, and of all the languages I have learned (including C++), I still prefer C in my heart of hearts. I&#39;d be really interested to hear your answer, many thanks.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.linuxandubuntu.com/home/linuxandubuntu-review-of-trueos-a-unix-based-os" rel="nofollow">LinuxAndUbuntu Review Of TrueOS A Unix Based OS</a></h3>

<blockquote>
<p>Trust me, the name TrueOS takes me back to 1990s when Tru64 UNIX operating system made its presence. TrueOS is PC-BSDs new unified brand built upon FreeBSD-CURRENT code base. Note that TrueOS is not a Linux distro but is BSD Unix. FreeBSD is known for its cutting-edge features, security, scalability, and ability to work both as a server and desktop operating system.  TrueOS aims at having user-friendliness with the power of FreeBSD OS. Let us start with going into details of different aspects of the TrueOS.</p>
</blockquote>

<ul>
<li><p>TrueOS History<br>
?</p>

<blockquote>
<p>TrueOS was founded by Kris Moore in 2005 with name PC-BSD.  Initial version focused to make FreeBSD easy to use starting with providing GUI based installer (to relatively complicated FreeBSD installer). In the year 2006, PC-BSD was acquired by iXsystems. Before rebranding as TrueOS in Sept 2016, PC-BSD reached a stage starting considering better than vanilla FreeBSD.  Older PC-BSD version used to support both x86 and x86-64 architecture.<br>
Kris Moore, the developer founder, says about rebranding: Weve already been using TrueOS for the server side of PC-BSD, and it made sense to unify the names. PC-BSD doesnt reflect server or embedded well. TrueOS Desktop/Server/Embedded can be real products, avoids some of the alphabet soup, and gives us a more catchy name.</p>
</blockquote></li>
<li><p>TrueOS First Impression<br>
?</p>

<blockquote>
<p>The startup is little longer; may be due to starting up of many services.  The heavy KDE well suited to PC-BSD.  The C++/Qt5 based Lumina desktop environment is light and fast.  The Lumina offers an easy way to configure menu and panels.  I did not face any problems for continuous use of two weeks on a virtual machine having the minimal configuration: 1 GB RAM, 20 GB hard disk and Intel 3.06 GHz i3 processor. The Lumina desktop is light and fast. The developers of Lumina know what they are doing and have a good idea of what makes a good IDE.  As it happens with any new desktop environment, it needs some time to settle.  Let us hope that they keep to the path they are on with it.</p>
</blockquote></li>
<li><p>Conclusion<br>
?</p>

<blockquote>
<p>The TrueOS is impressive when consider it as relatively young.  It is a daring step that TrueOS developers took FreeBSD Current rather than FreeBSD Stable code base. Overall it has created its own place from the legacy shadow of PC-BSD.  Starting with easy installation TrueOS is a good combination of software and utilities that make the system ready to use. Go and get a TrueOS ISO to unleash the bleeding edge tag of FreeBSD</p>
</blockquote></li>
</ul>

<hr>

<h3><a href="http://stygix.org/nix/x240-freebsd.php" rel="nofollow">Thinkpad x240 - FreeBSD Setup</a></h3>

<blockquote>
<p>What follows is a record of how I set up FreeBSD to be my daily driver OS on the Lenovo Thinkpad X240. Everything seems to work great. Although, the touchpad needs some tweaking. I&#39;ve tried several configurations, even recompiling Xorg with EVDEV support and all that, to no avail. Eventually I will figure it out. Do not sleep the laptop from the command line. Do it from within Xorg, or it will not wake up. I don&#39;t know why. You can do it from a terminal within Xorg, just not from the naked command line without Xorg started. It also will not sleep by closing the lid. I included a sudo config that allows you to run /usr/sbin/zzz without a password, so what I do is I have a key combo assigned within i3wm to run &quot;sudo /usr/sbin/zzz&quot;. It works fine this way.</p>

<p>I go into detail when it comes to setting up Xorg with i3wm. You can skip this if you want, but if you&#39;ve never used a tiling window manager, it will handle screen real estate very efficiently on a laptop with a 12.5-inch screen and a touchpad.</p>

<p>First, download the amd64 image for 11.1-RELEASE and flash it to a USB pen drive. For the Unices, use this:</p>
</blockquote>

<p><code># dd if=FreeBSD-11.1-RELEASE-amd64-memstick.img of=/dev/da0 bs=1M conv=sync</code></p>

<blockquote>
<p>Obviously, you&#39;ll change /dev/da0 to whatever the USB pen drive is assigned. Plug it in, check dmesg.</p>

<p>Leave it plugged in, restart the laptop. When prompted, tap Enter to halt the boot process, then F12 to select a bootable device. Choose the USB drive.</p>

<p>I won&#39;t go through the actual install process, but it is pretty damn easy so just look at a guide or two and you&#39;ll be fine. If you can install Debian, you can install FreeBSD. I will, however, recommend ZFS if you have over 4GB of RAM (my particular variant of the X240 has 8GB of RAM, so yours should have at least 4GB), along with an encrypted disk, and an encrypted SWAP partition. When prompted to add an additional user, and you get to the question where it asks for additional groups, please make sure you add the user to &quot;wheel&quot;. The rest should be self-explanatory during the install.</p>

<p>Now for the good shit. You just booted into a fresh FreeBSD install. Now what? Well, time to fire up vi and open some config files...</p>

<hr>
</blockquote>

<h3><a href="https://www.cnn.com/TECH/computing/9904/08/cdrom.idg/index.html" rel="nofollow">CNN Article about CDROM.com and FreeBSD, from 1999</a></h3>

<blockquote>
<p>Walnut Creek CDROM sells a lot of CD-ROMs, but it gives away even more data. Specifically, anyone who has Internet access is free to log into wcarchive (ftp.cdrom.com) and start downloading bits.<br>
Even with a good Internet connection, however, you should expect to be at it for a while. At the present time, wcarchive resides on half a terabyte (500 GB) of RAID 5-disk storage. Even if your 56-Kbps modem can deliver seven kilobytes per second, downloading the complete archive would take you 70 million seconds. Even then, some of the files would be more than two years out of date, so a bit of &quot;back and fill&quot; would be needed.<br>
Of course, nobody uses wcarchive that way. Instead, they just drop in when they need the odd file or two. The FTP server is very accommodating; 3,600 simultaneous download sessions is the current limit and an upgrade to 10,000 sessions is in the works.<br>
This translates to about 800 GB per day of downloads. Bob Bruce (Walnut Creek&#39;s founder) says he&#39;s thinking about issuing a press release when they reach a terabyte a day. But 800 GB isn&#39;t all that shabby....</p>
</blockquote>

<ul>
<li>The hardware</li>
</ul>

<blockquote>
<p>Because FTP archives don&#39;t do a lot of thinking, wcarchive doesn&#39;t need a massive cluster of CPUs. In fact, it gets by with a single 200-MHz P6 Pentium Pro and a measly(!) 1 GB of RAM. The I/O support, however, is fairly impressive.<br>
A six-channel Mylex RAID controller (DAC960SXI; Ultra-Wide SCSI-SCSI) is the centerpiece of the I/O subsystem. Two channels link it to the PC (&quot;Personal Computer&quot;!?!), via a dual-channel Adaptec card (AHA-3940AUW; PCI to Ultra-Wide SCSI). An 256-MB internal cache helps it to eliminate recurring disk accesses.<br>
Four nine-drive disk arrays provide the actual storage. The two larger arrays use 18-GB IBM drives; the two smaller arrays use 9-GB Micropolis and Quantum drives. A separate 4-GB Quantum drive is used as the &quot;system disk.&quot;<br>
The output side is handled by a single Intel 100Base-T controller (Pro/100B PCI), which feeds into the Internet through a number of shared DS3 (45 Mbps) and OC3 (155 Mbps) circuits.<br>
A detailed description of the system is available as ftp.cdrom.com/archive-info/configuration;</p>
</blockquote>

<ul>
<li>The software</li>
</ul>

<blockquote>
<p>The system software is rather prosaic: a copy of FreeBSD, supplemented by home-grown FTP mirroring and server code. Because of the massive hardware support, the software &quot;only&quot; needs to keep the I/O going in an efficient and reliable manner.<br>
FreeBSD, the &quot;prosaic&quot; operating system mentioned above, merits a bit more discussion. Like Linux, FreeBSD is open source. Anyone can examine, modify, and/or redistribute the source code. And, like Linux, an active user community helps the authors to find bugs, improve documentation, and generally support the OS.<br>
Unlike Linux, FreeBSD is derived from the Berkeley Unix code that forms the foundation for most commercial Unix variants. When you use the &quot;fast file system&quot; (cylinder groups, long file names, symbolic links, etc.), TCP/IP networking, termcap, or even vi, you are using Berkeley Unix additions.<br>
The version of BSD underlying FreeBSD, however, is &quot;pure&quot; BSD; don&#39;t look for the System V modifications you see in Solaris. Instead, think of it as SunOS, brought up to date with Kerberos, modern sendmail, an updated filesystem, and more. Solid, fast, and free!<br>
One of FreeBSD&#39;s finest innovations, the Ports Collection, makes FreeBSD a delight for open source application users. The Ports Collection automates the downloading, building, and installation (including de-installation) of 2,300+ open source packages.</p>
</blockquote>

<ul>
<li>The company</li>
</ul>

<blockquote>
<p>Walnut Creek CDROM has been around for several years now, so you are likely to be familiar with its offerings. You may not realize, however, that it provides the major financial support for FreeBSD.<br>
The FreeBSD support has two purposes. First, it provides the company with a solid base to run wcarchive and other massive projects. Second, it ties in with the company&#39;s mission of making software (and data) economically accessible.<br>
Bob Bruce, the firm&#39;s founder, is an interesting guy: laid back and somewhat conservative in manner, but productive and innovative in practice. Here is a possibly illustrative story.<br>
When Bob started selling CD-ROMs, disc caddies were selling for $15 each. Bob thought that was rather high, so he started investigating the marketplace. A long-distance call to Japan got him Sony&#39;s fax number; a series of faxes got him in touch with the salespeople.<br>
It turned out that caddies were available, in bulk, for only a few dollars each. Bulk, in this case, meant pallet-loads of 10,000 caddies. In an act of great faith, Bob purchased a pallet of caddies, then proceeded to sell them for five dollars each.<br>
The results were everything he might have wished. Folks who bought his CD-ROMs added caddies to their orders; folks who bought piles of caddies added in a disc or two. Either way, Walnut Creek CDROM was making a name for itself.<br>
Many pallet-loads later, the company is still selling caddies, making and distributing CD-ROMs, and giving away bits. Walnut Creek CDROM is a real open-source success story; its breadth and depth of offerings is well worth a look.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://github.com/openbsd/src/commit/b8584f4233dc11a328cd245a5843ec3d67462200" rel="nofollow">OpenBSD adds kqueue event support to DRM, to detect device changes like HDMI cables being plugged in, and trigger randr events</a></li>
<li><a href="https://archive.org/details/AMultiTaskingOperatingSystemForMicrocomputers" rel="nofollow">Thesis describing QUAD3, a unix-like, multi-tasking operating system for the 6502 processor </a></li>
<li><a href="https://blogs.msdn.microsoft.com/commandline/2018/01/12/chmod-chown-wsl-improvements/" rel="nofollow">Windows is getting chmod and chown...</a></li>
<li><a href="https://www.theverge.com/platform/amp/2018/1/11/16878670/meltdown-spectre-disclosure-embargo-google-microsoft-linux" rel="nofollow">Timeline: How they kept Meltdown and Spectre secret for so long </a></li>
<li><a href="https://bsd.network/" rel="nofollow">bsd.network is a *BSD-themed Mastodon Instance</a>: Peter Hessler is administering a new Mastodon instance, running in an OpenBSD VM on top of an OpenBSD vmm hypervisor</li>
<li><a href="https://virtuallyfun.com/wordpress/wp-content/uploads/2017/12/whfUb.pdf" rel="nofollow">Computer-Aided Instruction on UNIX</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/asiabsdcon-2018-travel-grant-application-now-open/" rel="nofollow">AsiaBSDCon 2018 Travel Grant Application Now Open</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/asiabsdcon-2018-freebsd-developers-summit-call-for-proposals/" rel="nofollow">AsiaBSDCon 2018 FreeBSD Developers Summit Call for Proposals</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/linuxfest-northwest-2018-call-for-proposals/" rel="nofollow">LinuxFest Northwest 2018 Call for Proposals</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Jason - <a href="http://dpaste.com/05PRNG2" rel="nofollow">Dont break my ports</a></li>
<li><p>Wilyarti - <a href="http://dpaste.com/1BG8GZW" rel="nofollow">show content</a> <a href="https://clinetworking.wordpress.com/2017/12/08/data-de-duplication-file-diff-ing-and-s3-style-object-storage-using-digital-ocean-spaces" rel="nofollow">https://clinetworking.wordpress.com/2017/12/08/data-de-duplication-file-diff-ing-and-s3-style-object-storage-using-digital-ocean-spaces</a></p></li>
<li><p>Scott - <a href="http://dpaste.com/0KER8YE#wrap" rel="nofollow">Your show is Perfect!</a></p></li>
<li><p>Ken - <a href="http://dpaste.com/0WT8285#wrap" rel="nofollow">Community Culture</a></p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>229: The Meltdown of Spectre</title>
  <link>https://www.bsdnow.tv/229</link>
  <guid isPermaLink="false">73543d49-f8be-481c-b9ed-34ad42cc934e</guid>
  <pubDate>Wed, 17 Jan 2018 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/73543d49-f8be-481c-b9ed-34ad42cc934e.mp3" length="78241972" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We review Meltdown and Spectre responses from various BSD projects, show you how to run CentOS with bhyve, GhostBSD 11.1 is out, and we look at the case against the fork syscall.</itunes:subtitle>
  <itunes:duration>1:48:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We review Meltdown and Spectre responses from various BSD projects, show you how to run CentOS with bhyve, GhostBSD 11.1 is out, and we look at the case against the fork syscall.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
More Meltdown
Much has been happened this week, but before we get into a status update of the various mitigations on the other BSDs, some important updates:
Intel has recalled the microcode update they issued on January 8th. It turns out this update can cause Haswell and Broadwell based systems to randomly reboot, with some frequency. (https://newsroom.intel.com/news/intel-security-issue-update-addressing-reboot-issues/)
AMD has confirmed that its processors are vulnerable to both variants of Spectre, and the the fix for variant #2 will require a forthcoming microcode update, in addition to OS level mitigations (https://www.amd.com/en/corporate/speculative-execution)
Fujitsu has provided a status report for most of its products, including SPARC hardware (https://sp.ts.fujitsu.com/dmsp/Publications/public/Intel-Side-Channel-Analysis-Method-Security-Review-CVE2017-5715-vulnerability-Fujitsu-products.pdf)
The Register of course has some commentary (https://www.theregister.co.uk/2018/01/12/intel_warns_meltdown_spectre_fixes_make_broadwells_haswells_unstable/)
If new code is needed, Intel will need to get it right: the company already faces numerous class action lawsuits. Data centre operators already scrambling to conduct unplanned maintenance will not be happy about the fix reducing stability.
AMD has said that operating system patches alone will address the Spectre bounds check bypass bug. Fixing Spectre’s branch target injection flaw will require firmware fixes that AMD has said will start to arrive for Ryzen and EPYC CPUs this week.
The Register has also asked other server vendors how they’re addressing the bugs. Oracle has patched its Linux, but has told us it has “No comment/statement on this as of now” in response to our query about its x86 systems, x86 cloud, Linux and Solaris on x86. The no comment regarding Linux is odd as fixes for Oracle Linux landed here (https://linux.oracle.com/errata/ELSA-2018-4006.html) on January 9th.
SPARC-using Fujitsu, meanwhile, has published advice (PDF) revealing how it will address the twin bugs in its servers and PCs, and also saying its SPARC systems are “under investigation”.
Response from OpenBSD: (https://undeadly.org/cgi?action=article;sid=20180106082238)
'Meltdown, aka "Dear Intel, you suck"' (https://marc.info/?t=151521438600001&amp;amp;r=1&amp;amp;w=2)
Theo de Raadt's response to Meltdown (https://www.itwire.com/security/81338-handling-of-cpu-bug-disclosure-incredibly-bad-openbsd-s-de-raadt.html)
That time in 2007 when Theo talked about how Intel x86 had major design problems in their chips (https://marc.info/?l=openbsd-misc&amp;amp;m=118296441702631&amp;amp;w=2)
OpenBSD gets a Microcode updater (https://marc.info/?l=openbsd-cvs&amp;amp;m=151570987406841&amp;amp;w=2)
Response from Dragonfly BSD: (http://lists.dragonflybsd.org/pipermail/users/2018-January/313758.html)
The longer response in four commits
One (http://lists.dragonflybsd.org/pipermail/commits/2018-January/627151.html)
Two (http://lists.dragonflybsd.org/pipermail/commits/2018-January/627152.html)
Three (http://lists.dragonflybsd.org/pipermail/commits/2018-January/627153.html)
Four (http://lists.dragonflybsd.org/pipermail/commits/2018-January/627154.html)
Even more Meltdown (https://www.dragonflydigest.com/2018/01/10/20718.html)
DragonflyBSD master now has full IBRS and IBPB support (http://lists.dragonflybsd.org/pipermail/users/2018-January/335643.html)
IBRS (Indirect Branch Restricted Speculation): The x86 IBRS feature requires corresponding microcode support. It mitigates the variant 2 vulnerability.
If IBRS is set, near returns and near indirect jumps/calls will not allow their predicted target address to be controlled by code that executed in a less privileged prediction mode before the IBRS mode was last written with a value of 1 or on another logical processor so long as all RSB entries from the previous less privileged prediction mode are overwritten.
Speculation on Skylake and later requires these patches ("dynamic IBRS") be used instead of retpoline.  If you are very paranoid or you run on a CPU where IBRS=1 is cheaper, you may also want to run in "IBRS always" mode.
IBPB (Indirect Branch Prediction Barrier): Setting of IBPB ensures that earlier code's behavior does not control later indirect branch predictions.  It is used when context switching to new untrusted address space. Unlike IBRS, IBPB is a command MSR and does not retain its state.
DragonFlyBSD's Meltdown Fix Causing More Slowdowns Than Linux (https://www.phoronix.com/scan.php?page=article&amp;amp;item=dragonfly-bsd-meltdown&amp;amp;num=1)
NetBSD HOTPATCH() (http://mail-index.netbsd.org/source-changes/2018/01/07/msg090945.html)
NetBSD SVS (Separate Virtual Space) (http://mail-index.netbsd.org/source-changes/2018/01/07/msg090952.html)
Running CentOS with Bhyve (https://www.daemon-security.com/2018/01/bhyve-centos-0110.html)
With the addition of UEFI in FreeBSD (since version 11), users of bhyve can use the UEFI boot loader instead of the grub2-bhyve port for booting operating systems such as Microsoft Windows, Linux and OpenBSD. The following page provides information necessary for setting up bhyve with UEFI boot loader support:
https://wiki.freebsd.org/bhyve/UEFI
Features have been added to vmrun.sh to make it easier to setup the UEFI boot loader, but the following is required to install the UEFI firmware pkg:
# pkg install -y uefi-edk2-bhyve
With graphical support, you can use a vnc client like tigervnc, which can be installed with the following command:
# pkg install -y tigervnc
In the case of most corporate or government environments, the Linux of choice is RHEL, or CentOS. Utilizing bhyve, you can test and install CentOS in a bhyve VM the same way you would deploy a Linux VM in production. The first step is to download the CentOS iso (for this tutorial I used the CentOS minimal ISO): http://isoredirect.centos.org/centos/7/isos/x8664/CentOS-7-x8664-Minimal-1708.iso
I normally use a ZFS Volume (zvol) when running bhyve VMs. Run the following commands to create a zvol (ensure you have enough disk space to perform these operations):
# zfs create -V20G -o volmode=dev zroot/centos0
(zroot in this case is the zpool I am using)
Similar to my previous post about vmrun.sh, you need certain items to be configured on FreeBSD in order to use bhyve. The following commands are necessary to get things running:
```
echo "vfs.zfs.vol.mode=2" &amp;gt;&amp;gt; /boot/loader.conf
kldload vmm
ifconfig tap0 create
sysctl net.link.tap.uponopen=1
net.link.tap.uponopen: 0 -&amp;gt; 1
ifconfig bridge0 create
ifconfig bridge0 addm em0 addm tap0
ifconfig bridge0 up
```
(replace em0 with whatever your physical interface is).
There are a number of utilities that can be used to manage bhyve VMs, and I am sure there is a way to use vmrun.sh to run Linux VMs, but since all of the HowTos for running Linux use the bhyve command line, the following script is what I use for running CentOS with bhyve.
```
!/bin/sh
General bhyve install/run script for CentOS
Based on scripts from pr1ntf and lattera
HOST="127.0.0.1" 
PORT="5901"
ISO="/tmp/centos.iso"
VMNAME="centos"
ZVOL="centos0" 
SERIAL="nmda0A"
TAP="tap1" 
CPU="1"
RAM="1024M"
HEIGHT="800"
WIDTH="600"
if [ "$1" == "install" ];
then 
Kill it before starting it
bhyvectl --destroy --vm=$VMNAME
bhyve -c $CPU -m $RAM -H -P -A \ 
-s 0,hostbridge \
-s 2,virtio-net,$TAP \ 
-s 3,ahci-cd,$ISO \
-s 4,virtio-blk,/dev/zvol/zroot/$ZVOL \
-s 29,fbuf,tcp=$HOST:$PORT,w=$WIDTH,h=$HEIGHT \ 
-s 30,xhci,tablet \
-s 31,lpc -l com1,/dev/$SERIAL \ 
-l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd \
$VMNAME
kill it after
bhyvectl --destroy --vm=$VMNAME
elif [ "$1" == "run" ];
then 
Kill it before starting it
bhyvectl --destroy --vm=centos 
bhyve -c $CPU -m $RAM -w -H \
-s 0,hostbridge \
-s 2,virtio-net,$TAP \ 
-s 4,virtio-blk,/dev/zvol/zroot/$ZVOL \
-s 29,fbuf,tcp=$HOST:$PORT,w=$WIDTH,h=$HEIGHT \ 
-s 30,xhci,tablet \
-s 31,lpc -l com1,/dev/$SERIAL \ 
-l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd \
$VMNAME &amp;amp;
else 
echo "Please type install or run"; 
fi 
```
The variables at the top of the script can be adjusted to fit your own needs. With the addition of the graphics output protocol in UEFI (or UEFI-GOP), a VNC console is launched and hosted with the HOST and PORT setting. There is a password option available for the VNC service, but the connection should be treated as insecure. It is advised to only listen on localhost with the VNC console and tunnel into the host of the bhyve VM. Now with the ISO copied to /tmp/centos.iso, and the script saved as centos.sh you can run the following command to start the install:
# ./centos.sh install
At this point, using vncviewer (on the local machine, or over an SSH tunnel), you should be able to bring up the console and run the CentOS installer as normal. The absolutely most critical item is to resolve an issue with the booting of UEFI after the installation has completed. Because of the path used in bhyve, you need to run the following to be able to boot CentOS after the installation:
# cp -f /mnt/sysimage/boot/efi/EFI/centos/grubx64.efi /mnt/sysimage/boot/efi/EFI/BOOT
With this setting changed, the same script can be used to launch your CentOS VM as needed:
# ./centos.sh run
If you are interested in a better solution for managing your Linux VM, take a look at the various bhyve management ports in the FreeBSD ports tree.
Interview - newnix architect - @newnix (https://bsd.network/@newnix)
News Roundup
GhostBSD 11.1 - FreeBSD for the desktop (https://distrowatch.com/weekly.php?issue=20180108#ghostbsd)
GhostBSD is a desktop oriented operating system which is based on FreeBSD. The project takes the FreeBSD operating system and adds a desktop environment, some popular applications, a graphical package manager and Linux binary compatibility. GhostBSD is available in two flavours, MATE and Xfce, and is currently available for 64-bit x86 computers exclusively. I downloaded the MATE edition which is available as a 2.3GB ISO file. 
Installing 
GhostBSD's system installer is a graphical application which begins by asking us for our preferred language, which we can select from a list. We can then select our keyboard's layout and our time zone. When it comes to partitioning we have three main options: let GhostBSD take over the entire disk using UFS as the file system, create a custom UFS layout or take over the entire disk using ZFS as the file system. UFS is a classic file system and quite popular, it is more or less FreeBSD's equivalent to Linux's ext4. ZFS is a more advanced file system with snapshots, multi-disk volumes and optional deduplication of data. I decided to try the ZFS option. 
Once I selected ZFS I didn't have many more options to go through. I was given the chance to set the size of my swap space and choose whether to set up ZFS as a plain volume, with a mirrored disk for backup or in a RAID arrangement with multiple disks. I stayed with the plain, single disk arrangement. We are then asked to create a password for the root account and create a username and password for a regular user account. The installer lets us pick our account's shell with the default being fish, which seemed unusual. Other shells, including bash, csh, tcsh, ksh and zsh are available. The installer goes to work copying files and offers to reboot our computer when it is done. 
Early impressions 
The newly installed copy of GhostBSD boots to a graphical login screen where we can sign into the account we created during the install process. Signing into our account loads the MATE 1.18 desktop environment. I found MATE to be responsive and applications were quick to open. Early on I noticed odd window behaviour where windows would continue to slide around after I moved them with the mouse, as if the windows were skidding on ice. Turning off compositing in the MATE settings panel corrected this behaviour. I also found the desktop's default font (Montserrat Alternates) to be hard on my eyes as the font is thin and, for lack of a better term, bubbly. Fonts can be easily adjusted in the settings panel. 
A few minutes after I signed into my account, a notification appeared in the system tray letting me know software updates were available. Clicking the update icon brings up a small window showing us a list of package updates and, if any are available, updates to the base operating system. FreeBSD, and therefore GhostBSD, both separate the core operating system from the applications (packages) which run on the operating system. This means we can update the core of the system separately from the applications. GhostBSD's core remains relatively static and minimal while applications are updated using a semi-rolling schedule. 
When we are updating the core operating system, the update manager will give us the option of rebooting the system to finish the process. We can dismiss this prompt to continue working, but the wording of the prompt may be confusing. When asked if we want to reboot to continue the update process, the options presented to us are "Continue" or "Restart". The Continue option closes the update manager and returns us to the MATE desktop. 
The update manager worked well for me and the only issue I ran into was when I dismissed the update manager and then wanted to install updates later. There are two launchers for the update manager, one in MATE's System menu and one in the settings panel. Clicking either of these launchers didn't accomplish anything. Running the update manager from the command line simply caused the process to lock up until killed. I found if I had dismissed the update manager once, I'd have to wait until I logged in again to use it. Alternatively, I could use a command line tool or use the OctoPkg package manager to install package updates. 
Conclusions 
Most of my time with GhostBSD, I was impressed and happy with the operating system. GhostBSD builds on a solid, stable FreeBSD core. We benefit from FreeBSD's performance and its large collection of open source software packages. The MATE desktop was very responsive in my trial and the system is relatively light on memory, even when run on ZFS which has a reputation for taking up more memory than other file systems. 
FreeBSD Looks At Making Wayland Support Available By Default (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=FreeBSD-Wayland-Availability)
There's an active discussion this week about making Wayland support available by default on FreeBSD. 
FreeBSD has working Wayland support -- well, assuming you have working Intel / Radeon graphics -- and do have Weston and some other Wayland components available via FreeBSD Ports. FreeBSD has offered working Wayland support that is "quite usable" for more than one year. But, it's not too easy to get going with Wayland on FreeBSD. 
Right now those FreeBSD desktop users wanting to use/develop with Wayland currently need to rebuild the GTK3 tool-kit, Mesa, and other packages with Wayland support enabled. This call for action now is about allowing the wayland=on to be made the default. 
This move would then allow these dependencies to be built with Wayland support by default, but for the foreseeable future FreeBSD will continue defaulting to X.Org-based sessions. 
The FreeBSD developers mostly acknowledge that Wayland is the future and the cost of enabling Wayland support by default is just slightly larger packages, but that weight is still leaner than the size of the X.Org code-base and its dependencies. 
FreeBSD vote thread (https://lists.freebsd.org/pipermail/freebsd-ports/2017-December/111906.html)
TrueOS Fliped the switch already (https://github.com/trueos/trueos-core/commit/f48dba9d4e8cefc45d6f72336e7a0b5f42a2f6f1)
fork is not my favorite syscall (https://sircmpwn.github.io/2018/01/02/The-case-against-fork.html)
This article has been on my to-write list for a while now. In my opinion, fork is one of the most questionable design choices of Unix. I don’t understand the circumstances that led to its creation, and I grieve over the legacy rationale that keeps it alive to this day.
Let’s set the scene. It’s 1971 and you’re a fly on the wall in Bell Labs, watching the first edition of Unix being designed for the PDP-11/20. This machine has a 16-bit address space with no more than 248 kilobytes of memory. They’re discussing how they’re going to support programs that spawn new programs, and someone has a brilliant idea. “What if we copied the entire address space of the program into a new process running from the same spot, then let them overwrite themselves with the new program?” This got a rousing laugh out of everyone present, then they moved on to a better design which would become immortalized in the most popular and influential operating system of all time.
At least, that’s the story I’d like to have been told. In actual fact, the laughter becomes consensus. There’s an obvious problem with this approach: every time you want to execute a new program, the entire process space is copied and promptly discarded when the new program begins. Usually when I complain about fork, this the point when its supporters play the virtual memory card, pointing out that modern operating systems don’t actually have to copy the whole address space. We’ll get to that, but first — First Edition Unix does copy the whole process space, so this excuse wouldn’t have held up at the time. By Fourth Edition Unix (the next one for which kernel sources survived), they had wisened up a bit, and started only copying segments when they faulted.
This model leads to a number of problems. One is that the new process inherits all of the parent’s process descriptors, so you have to close them all before you exec another process. However, unless you’re manually keeping tabs on your open file descriptors, there is no way to know what file handles you must close! The hack that solves this is CLOEXEC, the first of many hacks that deal with fork’s poor design choices. This file descriptors problem balloons a bit - consider for example if you want to set up a pipe. You have to establish a piped pair of file descriptors in the parent, then close every fd but the pipe in the child, then dup2 the pipe file descriptor over the (now recently closed) file descriptor 1. By this point you’ve probably had to do several non-trivial operations and utilize a handful of variables from the parent process space, which hopefully were on the stack so that we don’t end up copying segments into the new process space anyway.
These problems, however, pale in comparison to my number one complaint with the fork model. Fork is the direct cause of the stupidest component I’ve ever heard of in an operating system: the out-of-memory (aka OOM) killer. Say you have a process which is using half of the physical memory on your system, and wants to spawn a tiny program. Since fork “copies” the entire process, you might be inclined to think that this would make fork fail. But, on Linux and many other operating systems since, it does not fail! They agree that it’s stupid to copy the entire process just to exec something else, but because fork is Important for Backwards Compatibility, they just fake it and reuse the same memory map (except read-only), then trap the faults and actually copy later. The hope is that the child will get on with it and exec before this happens.
However, nothing prevents the child from doing something other than exec - it’s free to use the memory space however it desires! This approach now leads to memory overcommittment - Linux has promised memory it does not have. As a result, when it really does run out of physical memory, Linux will just kill off processes until it has some memory back. Linux makes an awfully big fuss about “never breaking userspace” for a kernel that will lie about memory it doesn’t have, then kill programs that try to use the back-alley memory they were given. That this nearly 50 year old crappy design choice has come to this astonishes me.
Alas, I cannot rant forever without discussing the alternatives. There are better process models that have been developed since Unix!
The first attempt I know of is BSD’s vfork syscall, which is, in a nutshell, the same as fork but with severe limitations on what you do in the child process (i.e. nothing other than calling exec straight away). There are loads of problems with vfork. It only handles the most basic of use cases: you cannot set up a pipe, cannot set up a pty, and can’t even close open file descriptors you inherited from the parent. Also, you couldn’t really be sure of what variables you were and weren’t editing or allowed to edit, considering the limitations of the C specification. Overall this syscall ended up being pretty useless.
Another model is posixspawn, which is a hell of an interface. It’s far too complicated for me to detail here, and in my opinion far too complicated to ever consider using in practice. Even if it could be understood by mortals, it’s a really bad implementation of the spawn paradigm — it basically operates like fork backwards, and inherits many of the same flaws. You still have to deal with children inheriting your file descriptors, for example, only now you do it in the parent process. It’s also straight-up impossible to make a genuine pipe with posixspawn. (Note: a reader corrected me - this is indeed possible via posixspawnfileactionsadddup2.)
Let’s talk about the good models - rfork and spawn (at least, if spawn is done right). rfork originated from plan9 and is a beautiful little coconut of a syscall, much like the rest of plan9. They also implement fork, but it’s a special case of rfork. plan9 does not distinguish between processes and threads - all threads are processes and vice versa. However, new processes in plan9 are not the everything-must-go fuckfest of your typical fork call. Instead, you specify exactly what the child should get from you. You can choose to include (or not include) your memory space, file descriptors, environment, or a number of other things specific to plan9. There’s a cool flag that makes it so you don’t have to reap the process, too, which is nice because reaping children is another really stupid idea. It still has some problems, mainly around creating pipes without tremendous file descriptor fuckery, but it’s basically as good as the fork model gets. Note: Linux offers this via the clone syscall now, but everyone just fork+execs anyway.
The other model is the spawn model, which I prefer. This is the approach I took in my own kernel for KnightOS, and I think it’s also used in NT (Microsoft’s kernel). I don’t really know much about NT, but I can tell you how it works in KnightOS. Basically, when you create a new process, it is kept in limbo until the parent consents to begin. You are given a handle with which you can configure the process - you can change its environment, load it up with file descriptors to your liking, and so on. When you’re ready for it to begin, you give the go-ahead and it’s off to the races. The spawn model has none of the flaws of fork.
Both fork and exec can be useful at times, but spawning is much better for 90% of their use-cases. If I were to write a new kernel today, I’d probably take a leaf from plan9’s book and find a happy medium between rfork and spawn, so you could use spawn to start new threads in your process space as well. To the brave OS designers of the future, ready to shrug off the weight of legacy: please reconsider fork.
Enable ld.lld as bootstrap linker by default on amd64 (https://svnweb.freebsd.org/changeset/base/327783)
Enable ld.lld as bootstrap linker by default on amd64
For some time we have been planning to migrate to LLVM's lld linker.
Having a man page was the last blocking issue for using ld.lld to link
the base system kernel + userland, now addressed by r327770.  Link the
kernel and userland libraries and binaries with ld.lld by default, for
additional test coverage.
This has been a long time in the making.  On 2013-04-13 I submitted an
upstream tracking issue in LLVM PR 23214: [META] Using LLD as FreeBSD's
system linker.  Since then 85 individual issues were identified, and
submitted as dependencies.  These have been addressed along with two
and a half years of other lld development and improvement.
I'd like to express deep gratitude to upstream lld developers Rui
Ueyama, Rafael Espindola, George Rimar and Davide Italiano.  They put in
substantial effort in addressing the issues we found affecting
FreeBSD/amd64.
To revert to using ld.bfd as the bootstrap linker, in /etc/src.conf set
   WITHOUTLLDBOOTSTRAP=yes
If you need to set this, please follow up with a PR or post to the
freebsd-toolchain mailing list explaining how default WITHLLDBOOTSTRAP
failed for your use case.
Note that GNU ld.bfd is still installed as /usr/bin/ld, and will still
be used for linking ports.  ld.lld can be installed as /usr/bin/ld by
setting in /etc/src.conf
WITH_LLD_IS_LLD=yes
A followup commit will set WITHLLDIS_LD by default, possibly after
Clang/LLVM/lld 6.0 is merged to FreeBSD.
Release notes:    Yes
Sponsored by: The FreeBSD Foundation
Followup: https://www.mail-archive.com/svn-src-all@freebsd.org/msg155493.html
***
Beastie Bits
BSDCAN2017 Interview with Peter Hessler, Reyk Floeter, and Henning Brauer (https://undeadly.org/cgi?action=article;sid=20171229080944)
video (https://www.youtube.com/watch?v=e-Xim3_rJns)
DSBMD (https://freeshell.de/~mk/projects/dsbmd.html)
ccc34 talk - May contain DTraces of FreeBSD (https://media.ccc.de/v/34c3-9196-may_contain_dtraces_of_freebsd)
[scripts to run an OpenBSD mirror, rsync and verify])(https://github.com/bluhm/mirror-openbsd)
Old School PC Fonts (https://int10h.org/oldschool-pc-fonts/readme/)
Feedback/Questions
David - Approach and Tools for Snapshots and Remote Replication (http://dpaste.com/33HKKEM#wrap)
Brian - Help getting my FreeBSD systems talking across the city (http://dpaste.com/3QWFEYR#wrap)
Malcolm - First BSD Meetup in Stockholm happened and it was great (http://dpaste.com/1Z9Y8H1)
Brad - Update on TrueOS system (http://dpaste.com/3EC9RGG#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We review Meltdown and Spectre responses from various BSD projects, show you how to run CentOS with bhyve, GhostBSD 11.1 is out, and we look at the case against the fork syscall.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>More Meltdown</h3>

<ul>
<li><p>Much has been happened this week, but before we get into a status update of the various mitigations on the other BSDs, some important updates:</p>

<ul>
<li><a href="https://newsroom.intel.com/news/intel-security-issue-update-addressing-reboot-issues/" rel="nofollow">Intel has recalled the microcode update they issued on January 8th. It turns out this update can cause Haswell and Broadwell based systems to randomly reboot, with some frequency.</a></li>
<li><a href="https://www.amd.com/en/corporate/speculative-execution" rel="nofollow">AMD has confirmed that its processors are vulnerable to both variants of Spectre, and the the fix for variant #2 will require a forthcoming microcode update, in addition to OS level mitigations</a></li>
<li><a href="https://sp.ts.fujitsu.com/dmsp/Publications/public/Intel-Side-Channel-Analysis-Method-Security-Review-CVE2017-5715-vulnerability-Fujitsu-products.pdf" rel="nofollow">Fujitsu has provided a status report for most of its products, including SPARC hardware</a></li>
</ul></li>
<li><p><a href="https://www.theregister.co.uk/2018/01/12/intel_warns_meltdown_spectre_fixes_make_broadwells_haswells_unstable/" rel="nofollow">The Register of course has some commentary</a></p></li>
</ul>

<blockquote>
<p>If new code is needed, Intel will need to get it right: the company already faces numerous class action lawsuits. Data centre operators already scrambling to conduct unplanned maintenance will not be happy about the fix reducing stability.<br>
AMD has said that operating system patches alone will address the Spectre bounds check bypass bug. Fixing Spectres branch target injection flaw will require firmware fixes that AMD has said will start to arrive for Ryzen and EPYC CPUs this week.<br>
The Register has also asked other server vendors how theyre addressing the bugs. Oracle has patched its Linux, but has told us it has No comment/statement on this as of now in response to our query about its x86 systems, x86 cloud, Linux and Solaris on x86. The no comment regarding Linux is odd as fixes for Oracle Linux landed <a href="https://linux.oracle.com/errata/ELSA-2018-4006.html" rel="nofollow">here</a> on January 9th.<br>
SPARC-using Fujitsu, meanwhile, has published advice (PDF) revealing how it will address the twin bugs in its servers and PCs, and also saying its SPARC systems are under investigation.</p>
</blockquote>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180106082238" rel="nofollow">Response from OpenBSD:</a></li>
</ul>

<p><a href="https://marc.info/?t=151521438600001&r=1&w=2" rel="nofollow">&#39;Meltdown, aka &quot;Dear Intel, you suck&quot;&#39;</a></p>

<ul>
<li><p><a href="https://www.itwire.com/security/81338-handling-of-cpu-bug-disclosure-incredibly-bad-openbsd-s-de-raadt.html" rel="nofollow">Theo de Raadt&#39;s response to Meltdown</a></p></li>
<li><p><a href="https://marc.info/?l=openbsd-misc&m=118296441702631&w=2" rel="nofollow">That time in 2007 when Theo talked about how Intel x86 had major design problems in their chips</a></p></li>
<li><p><a href="https://marc.info/?l=openbsd-cvs&m=151570987406841&w=2" rel="nofollow">OpenBSD gets a Microcode updater</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2018-January/313758.html" rel="nofollow">Response from Dragonfly BSD:</a><br>
The longer response in four commits</p>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2018-January/627151.html" rel="nofollow">One</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2018-January/627152.html" rel="nofollow">Two</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2018-January/627153.html" rel="nofollow">Three</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2018-January/627154.html" rel="nofollow">Four</a></li>
</ul></li>
<li><p><a href="https://www.dragonflydigest.com/2018/01/10/20718.html" rel="nofollow">Even more Meltdown</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2018-January/335643.html" rel="nofollow">DragonflyBSD master now has full IBRS and IBPB support</a></p>

<ul>
<li>IBRS (Indirect Branch Restricted Speculation): The x86 IBRS feature requires corresponding microcode support. It mitigates the variant 2 vulnerability.</li>
<li>If IBRS is set, near returns and near indirect jumps/calls will not allow their predicted target address to be controlled by code that executed in a less privileged prediction mode before the IBRS mode was last written with a value of 1 or on another logical processor so long as all RSB entries from the previous less privileged prediction mode are overwritten.</li>
<li>Speculation on Skylake and later requires these patches (&quot;dynamic IBRS&quot;) be used instead of retpoline.  If you are very paranoid or you run on a CPU where IBRS=1 is cheaper, you may also want to run in &quot;IBRS always&quot; mode.</li>
<li>IBPB (Indirect Branch Prediction Barrier): Setting of IBPB ensures that earlier code&#39;s behavior does not control later indirect branch predictions.  It is used when context switching to new untrusted address space. Unlike IBRS, IBPB is a command MSR and does not retain its state.</li>
</ul></li>
<li><p><a href="https://www.phoronix.com/scan.php?page=article&item=dragonfly-bsd-meltdown&num=1" rel="nofollow">DragonFlyBSD&#39;s Meltdown Fix Causing More Slowdowns Than Linux</a></p></li>
<li><p><a href="http://mail-index.netbsd.org/source-changes/2018/01/07/msg090945.html" rel="nofollow">NetBSD HOTPATCH()</a></p></li>
<li><p><a href="http://mail-index.netbsd.org/source-changes/2018/01/07/msg090952.html" rel="nofollow">NetBSD SVS (Separate Virtual Space)</a></p></li>
</ul>

<hr>

<h3><a href="https://www.daemon-security.com/2018/01/bhyve-centos-0110.html" rel="nofollow">Running CentOS with Bhyve</a></h3>

<blockquote>
<p>With the addition of UEFI in FreeBSD (since version 11), users of bhyve can use the UEFI boot loader instead of the grub2-bhyve port for booting operating systems such as Microsoft Windows, Linux and OpenBSD. The following page provides information necessary for setting up bhyve with UEFI boot loader support:<br>
<a href="https://wiki.freebsd.org/bhyve/UEFI" rel="nofollow">https://wiki.freebsd.org/bhyve/UEFI</a><br>
Features have been added to vmrun.sh to make it easier to setup the UEFI boot loader, but the following is required to install the UEFI firmware pkg:</p>

<p><code># pkg install -y uefi-edk2-bhyve</code></p>

<p>With graphical support, you can use a vnc client like tigervnc, which can be installed with the following command:</p>

<p><code># pkg install -y tigervnc</code></p>

<p>In the case of most corporate or government environments, the Linux of choice is RHEL, or CentOS. Utilizing bhyve, you can test and install CentOS in a bhyve VM the same way you would deploy a Linux VM in production. The first step is to download the CentOS iso (for this tutorial I used the CentOS minimal ISO): <a href="http://isoredirect.centos.org/centos/7/isos/x86_64/CentOS-7-x86_64-Minimal-1708.iso" rel="nofollow">http://isoredirect.centos.org/centos/7/isos/x86_64/CentOS-7-x86_64-Minimal-1708.iso</a></p>

<p>I normally use a ZFS Volume (zvol) when running bhyve VMs. Run the following commands to create a zvol (ensure you have enough disk space to perform these operations):</p>

<p><code># zfs create -V20G -o volmode=dev zroot/centos0</code></p>
</blockquote>

<ul>
<li>(zroot in this case is the zpool I am using)</li>
</ul>

<blockquote>
<p>Similar to my previous post about vmrun.sh, you need certain items to be configured on FreeBSD in order to use bhyve. The following commands are necessary to get things running:</p>

<pre><code># echo &quot;vfs.zfs.vol.mode=2&quot; &gt;&gt; /boot/loader.conf
# kldload vmm
# ifconfig tap0 create
# sysctl net.link.tap.up_on_open=1
net.link.tap.up_on_open: 0 -&gt; 1
# ifconfig bridge0 create
# ifconfig bridge0 addm em0 addm tap0
# ifconfig bridge0 up
</code></pre>
</blockquote>

<ul>
<li>(replace em0 with whatever your physical interface is).</li>
</ul>

<blockquote>
<p>There are a number of utilities that can be used to manage bhyve VMs, and I am sure there is a way to use vmrun.sh to run Linux VMs, but since all of the HowTos for running Linux use the bhyve command line, the following script is what I use for running CentOS with bhyve.</p>

<pre><code>#!/bin/sh
#
# General bhyve install/run script for CentOS
# Based on scripts from pr1ntf and lattera 

HOST=&quot;127.0.0.1&quot; 
PORT=&quot;5901&quot;
ISO=&quot;/tmp/centos.iso&quot;
VMNAME=&quot;centos&quot;
ZVOL=&quot;centos0&quot; 
SERIAL=&quot;nmda0A&quot;
TAP=&quot;tap1&quot; 
CPU=&quot;1&quot;
RAM=&quot;1024M&quot;
HEIGHT=&quot;800&quot;
WIDTH=&quot;600&quot;

if [ &quot;$1&quot; == &quot;install&quot; ];
then 

#Kill it before starting it
bhyvectl --destroy --vm=$VMNAME

bhyve -c $CPU -m $RAM -H -P -A \ 
-s 0,hostbridge \
-s 2,virtio-net,$TAP \ 
-s 3,ahci-cd,$ISO \
-s 4,virtio-blk,/dev/zvol/zroot/$ZVOL \
-s 29,fbuf,tcp=$HOST:$PORT,w=$WIDTH,h=$HEIGHT \ 
-s 30,xhci,tablet \
-s 31,lpc -l com1,/dev/$SERIAL \ 
-l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd \
$VMNAME

#kill it after 
bhyvectl --destroy --vm=$VMNAME

elif [ &quot;$1&quot; == &quot;run&quot; ];
then 

#Kill it before starting it
bhyvectl --destroy --vm=centos 

bhyve -c $CPU -m $RAM -w -H \
-s 0,hostbridge \
-s 2,virtio-net,$TAP \ 
-s 4,virtio-blk,/dev/zvol/zroot/$ZVOL \
-s 29,fbuf,tcp=$HOST:$PORT,w=$WIDTH,h=$HEIGHT \ 
-s 30,xhci,tablet \
-s 31,lpc -l com1,/dev/$SERIAL \ 
-l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd \
$VMNAME &amp;

else 
echo &quot;Please type install or run&quot;; 
fi 
</code></pre>

<p>The variables at the top of the script can be adjusted to fit your own needs. With the addition of the graphics output protocol in UEFI (or UEFI-GOP), a VNC console is launched and hosted with the HOST and PORT setting. There is a password option available for the VNC service, but the connection should be treated as insecure. It is advised to only listen on localhost with the VNC console and tunnel into the host of the bhyve VM. Now with the ISO copied to /tmp/centos.iso, and the script saved as centos.sh you can run the following command to start the install:</p>

<p><code># ./centos.sh install</code></p>

<p>At this point, using vncviewer (on the local machine, or over an SSH tunnel), you should be able to bring up the console and run the CentOS installer as normal. The absolutely most critical item is to resolve an issue with the booting of UEFI after the installation has completed. Because of the path used in bhyve, you need to run the following to be able to boot CentOS after the installation:</p>
</blockquote>

<p><code># cp -f /mnt/sysimage/boot/efi/EFI/centos/grubx64.efi /mnt/sysimage/boot/efi/EFI/BOOT</code></p>

<blockquote>
<p>With this setting changed, the same script can be used to launch your CentOS VM as needed:</p>
</blockquote>

<p><code># ./centos.sh run</code></p>

<blockquote>
<p>If you are interested in a better solution for managing your Linux VM, take a look at the various bhyve management ports in the FreeBSD ports tree.</p>
</blockquote>

<hr>

<h2>Interview - newnix architect - <a href="https://bsd.network/@newnix" rel="nofollow">@newnix</a></h2>

<h2>News Roundup</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20180108#ghostbsd" rel="nofollow">GhostBSD 11.1 - FreeBSD for the desktop</a></h3>

<blockquote>
<p>GhostBSD is a desktop oriented operating system which is based on FreeBSD. The project takes the FreeBSD operating system and adds a desktop environment, some popular applications, a graphical package manager and Linux binary compatibility. GhostBSD is available in two flavours, MATE and Xfce, and is currently available for 64-bit x86 computers exclusively. I downloaded the MATE edition which is available as a 2.3GB ISO file. </p>
</blockquote>

<ul>
<li>Installing </li>
</ul>

<blockquote>
<p>GhostBSD&#39;s system installer is a graphical application which begins by asking us for our preferred language, which we can select from a list. We can then select our keyboard&#39;s layout and our time zone. When it comes to partitioning we have three main options: let GhostBSD take over the entire disk using UFS as the file system, create a custom UFS layout or take over the entire disk using ZFS as the file system. UFS is a classic file system and quite popular, it is more or less FreeBSD&#39;s equivalent to Linux&#39;s ext4. ZFS is a more advanced file system with snapshots, multi-disk volumes and optional deduplication of data. I decided to try the ZFS option. </p>

<p>Once I selected ZFS I didn&#39;t have many more options to go through. I was given the chance to set the size of my swap space and choose whether to set up ZFS as a plain volume, with a mirrored disk for backup or in a RAID arrangement with multiple disks. I stayed with the plain, single disk arrangement. We are then asked to create a password for the root account and create a username and password for a regular user account. The installer lets us pick our account&#39;s shell with the default being fish, which seemed unusual. Other shells, including bash, csh, tcsh, ksh and zsh are available. The installer goes to work copying files and offers to reboot our computer when it is done. </p>
</blockquote>

<ul>
<li>Early impressions </li>
</ul>

<blockquote>
<p>The newly installed copy of GhostBSD boots to a graphical login screen where we can sign into the account we created during the install process. Signing into our account loads the MATE 1.18 desktop environment. I found MATE to be responsive and applications were quick to open. Early on I noticed odd window behaviour where windows would continue to slide around after I moved them with the mouse, as if the windows were skidding on ice. Turning off compositing in the MATE settings panel corrected this behaviour. I also found the desktop&#39;s default font (Montserrat Alternates) to be hard on my eyes as the font is thin and, for lack of a better term, bubbly. Fonts can be easily adjusted in the settings panel. </p>

<p>A few minutes after I signed into my account, a notification appeared in the system tray letting me know software updates were available. Clicking the update icon brings up a small window showing us a list of package updates and, if any are available, updates to the base operating system. FreeBSD, and therefore GhostBSD, both separate the core operating system from the applications (packages) which run on the operating system. This means we can update the core of the system separately from the applications. GhostBSD&#39;s core remains relatively static and minimal while applications are updated using a semi-rolling schedule. </p>

<p>When we are updating the core operating system, the update manager will give us the option of rebooting the system to finish the process. We can dismiss this prompt to continue working, but the wording of the prompt may be confusing. When asked if we want to reboot to continue the update process, the options presented to us are &quot;Continue&quot; or &quot;Restart&quot;. The Continue option closes the update manager and returns us to the MATE desktop. </p>

<p>The update manager worked well for me and the only issue I ran into was when I dismissed the update manager and then wanted to install updates later. There are two launchers for the update manager, one in MATE&#39;s System menu and one in the settings panel. Clicking either of these launchers didn&#39;t accomplish anything. Running the update manager from the command line simply caused the process to lock up until killed. I found if I had dismissed the update manager once, I&#39;d have to wait until I logged in again to use it. Alternatively, I could use a command line tool or use the OctoPkg package manager to install package updates. </p>
</blockquote>

<ul>
<li>Conclusions </li>
</ul>

<blockquote>
<p>Most of my time with GhostBSD, I was impressed and happy with the operating system. GhostBSD builds on a solid, stable FreeBSD core. We benefit from FreeBSD&#39;s performance and its large collection of open source software packages. The MATE desktop was very responsive in my trial and the system is relatively light on memory, even when run on ZFS which has a reputation for taking up more memory than other file systems. </p>
</blockquote>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=FreeBSD-Wayland-Availability" rel="nofollow">FreeBSD Looks At Making Wayland Support Available By Default</a></h3>

<blockquote>
<p>There&#39;s an active discussion this week about making Wayland support available by default on FreeBSD. </p>

<p>FreeBSD has working Wayland support -- well, assuming you have working Intel / Radeon graphics -- and do have Weston and some other Wayland components available via FreeBSD Ports. FreeBSD has offered working Wayland support that is &quot;quite usable&quot; for more than one year. But, it&#39;s not too easy to get going with Wayland on FreeBSD. </p>

<p>Right now those FreeBSD desktop users wanting to use/develop with Wayland currently need to rebuild the GTK3 tool-kit, Mesa, and other packages with Wayland support enabled. This call for action now is about allowing the wayland=on to be made the default. </p>

<p>This move would then allow these dependencies to be built with Wayland support by default, but for the foreseeable future FreeBSD will continue defaulting to X.Org-based sessions. </p>

<p>The FreeBSD developers mostly acknowledge that Wayland is the future and the cost of enabling Wayland support by default is just slightly larger packages, but that weight is still leaner than the size of the X.Org code-base and its dependencies. </p>
</blockquote>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2017-December/111906.html" rel="nofollow">FreeBSD vote thread</a></li>
<li><a href="https://github.com/trueos/trueos-core/commit/f48dba9d4e8cefc45d6f72336e7a0b5f42a2f6f1" rel="nofollow">TrueOS Fliped the switch already</a></li>
</ul>

<hr>

<h3><a href="https://sircmpwn.github.io/2018/01/02/The-case-against-fork.html" rel="nofollow">fork is not my favorite syscall</a></h3>

<blockquote>
<p>This article has been on my to-write list for a while now. In my opinion, fork is one of the most questionable design choices of Unix. I dont understand the circumstances that led to its creation, and I grieve over the legacy rationale that keeps it alive to this day.</p>

<p>Lets set the scene. Its 1971 and youre a fly on the wall in Bell Labs, watching the first edition of Unix being designed for the PDP-11/20. This machine has a 16-bit address space with no more than 248 kilobytes of memory. Theyre discussing how theyre going to support programs that spawn new programs, and someone has a brilliant idea. What if we copied the entire address space of the program into a new process running from the same spot, then let them overwrite themselves with the new program? This got a rousing laugh out of everyone present, then they moved on to a better design which would become immortalized in the most popular and influential operating system of all time.</p>

<p>At least, thats the story Id like to have been told. In actual fact, the laughter becomes consensus. Theres an obvious problem with this approach: every time you want to execute a new program, the entire process space is copied and promptly discarded when the new program begins. Usually when I complain about fork, this the point when its supporters play the virtual memory card, pointing out that modern operating systems dont actually have to copy the whole address space. Well get to that, but first  First Edition Unix does copy the whole process space, so this excuse wouldnt have held up at the time. By Fourth Edition Unix (the next one for which kernel sources survived), they had wisened up a bit, and started only copying segments when they faulted.</p>

<p>This model leads to a number of problems. One is that the new process inherits all of the parents process descriptors, so you have to close them all before you exec another process. However, unless youre manually keeping tabs on your open file descriptors, there is no way to know what file handles you must close! The hack that solves this is CLOEXEC, the first of many hacks that deal with forks poor design choices. This file descriptors problem balloons a bit - consider for example if you want to set up a pipe. You have to establish a piped pair of file descriptors in the parent, then close every fd but the pipe in the child, then dup2 the pipe file descriptor over the (now recently closed) file descriptor 1. By this point youve probably had to do several non-trivial operations and utilize a handful of variables from the parent process space, which hopefully were on the stack so that we dont end up copying segments into the new process space anyway.</p>

<p>These problems, however, pale in comparison to my number one complaint with the fork model. Fork is the direct cause of the stupidest component Ive ever heard of in an operating system: the out-of-memory (aka OOM) killer. Say you have a process which is using half of the physical memory on your system, and wants to spawn a tiny program. Since fork copies the entire process, you might be inclined to think that this would make fork fail. But, on Linux and many other operating systems since, it does not fail! They agree that its stupid to copy the entire process just to exec something else, but because fork is Important for Backwards Compatibility, they just fake it and reuse the same memory map (except read-only), then trap the faults and actually copy later. The hope is that the child will get on with it and exec before this happens.</p>

<p>However, nothing prevents the child from doing something other than exec - its free to use the memory space however it desires! This approach now leads to memory overcommittment - Linux has promised memory it does not have. As a result, when it really does run out of physical memory, Linux will just kill off processes until it has some memory back. Linux makes an awfully big fuss about never breaking userspace for a kernel that will lie about memory it doesnt have, then kill programs that try to use the back-alley memory they were given. That this nearly 50 year old crappy design choice has come to this astonishes me.</p>

<p>Alas, I cannot rant forever without discussing the alternatives. There are better process models that have been developed since Unix!</p>

<p>The first attempt I know of is BSDs vfork syscall, which is, in a nutshell, the same as fork but with severe limitations on what you do in the child process (i.e. nothing other than calling exec straight away). There are loads of problems with vfork. It only handles the most basic of use cases: you cannot set up a pipe, cannot set up a pty, and cant even close open file descriptors you inherited from the parent. Also, you couldnt really be sure of what variables you were and werent editing or allowed to edit, considering the limitations of the C specification. Overall this syscall ended up being pretty useless.</p>

<p>Another model is posix_spawn, which is a hell of an interface. Its far too complicated for me to detail here, and in my opinion far too complicated to ever consider using in practice. Even if it could be understood by mortals, its a really bad implementation of the spawn paradigm  it basically operates like fork backwards, and inherits many of the same flaws. You still have to deal with children inheriting your file descriptors, for example, only now you do it in the parent process. Its also straight-up impossible to make a genuine pipe with posix_spawn. (Note: a reader corrected me - this is indeed possible via posix_spawn_file_actions_adddup2.)</p>

<p>Lets talk about the good models - rfork and spawn (at least, if spawn is done right). rfork originated from plan9 and is a beautiful little coconut of a syscall, much like the rest of plan9. They also implement fork, but its a special case of rfork. plan9 does not distinguish between processes and threads - all threads are processes and vice versa. However, new processes in plan9 are not the everything-must-go fuckfest of your typical fork call. Instead, you specify exactly what the child should get from you. You can choose to include (or not include) your memory space, file descriptors, environment, or a number of other things specific to plan9. Theres a cool flag that makes it so you dont have to reap the process, too, which is nice because reaping children is another really stupid idea. It still has some problems, mainly around creating pipes without tremendous file descriptor fuckery, but its basically as good as the fork model gets. Note: Linux offers this via the clone syscall now, but everyone just fork+execs anyway.</p>

<p>The other model is the spawn model, which I prefer. This is the approach I took in my own kernel for KnightOS, and I think its also used in NT (Microsofts kernel). I dont really know much about NT, but I can tell you how it works in KnightOS. Basically, when you create a new process, it is kept in limbo until the parent consents to begin. You are given a handle with which you can configure the process - you can change its environment, load it up with file descriptors to your liking, and so on. When youre ready for it to begin, you give the go-ahead and its off to the races. The spawn model has none of the flaws of fork.</p>

<p>Both fork and exec can be useful at times, but spawning is much better for 90% of their use-cases. If I were to write a new kernel today, Id probably take a leaf from plan9s book and find a happy medium between rfork and spawn, so you could use spawn to start new threads in your process space as well. To the brave OS designers of the future, ready to shrug off the weight of legacy: please reconsider fork.</p>

<hr>
</blockquote>

<h3><a href="https://svnweb.freebsd.org/changeset/base/327783" rel="nofollow">Enable ld.lld as bootstrap linker by default on amd64</a></h3>

<ul>
<li>Enable ld.lld as bootstrap linker by default on amd64</li>
</ul>

<blockquote>
<p>For some time we have been planning to migrate to LLVM&#39;s lld linker.<br>
Having a man page was the last blocking issue for using ld.lld to link<br>
the base system kernel + userland, now addressed by r327770.  Link the<br>
kernel and userland libraries and binaries with ld.lld by default, for<br>
additional test coverage.</p>

<p>This has been a long time in the making.  On 2013-04-13 I submitted an<br>
upstream tracking issue in LLVM PR 23214: [META] Using LLD as FreeBSD&#39;s<br>
system linker.  Since then 85 individual issues were identified, and<br>
submitted as dependencies.  These have been addressed along with two<br>
and a half years of other lld development and improvement.</p>

<p>I&#39;d like to express deep gratitude to upstream lld developers Rui<br>
Ueyama, Rafael Espindola, George Rimar and Davide Italiano.  They put in<br>
substantial effort in addressing the issues we found affecting<br>
FreeBSD/amd64.</p>

<p>To revert to using ld.bfd as the bootstrap linker, in /etc/src.conf set</p>

<p>WITHOUT_LLD_BOOTSTRAP=yes</p>

<p>If you need to set this, please follow up with a PR or post to the<br>
freebsd-toolchain mailing list explaining how default WITH_LLD_BOOTSTRAP<br>
failed for your use case.</p>

<p>Note that GNU ld.bfd is still installed as /usr/bin/ld, and will still<br>
be used for linking ports.  ld.lld can be installed as /usr/bin/ld by<br>
setting in /etc/src.conf</p>

<pre><code>WITH_LLD_IS_LLD=yes
</code></pre>

<p>A followup commit will set WITH_LLD_IS_LD by default, possibly after<br>
Clang/LLVM/lld 6.0 is merged to FreeBSD.</p>

<p>Release notes:    Yes<br>
Sponsored by: The FreeBSD Foundation</p>
</blockquote>

<ul>
<li>Followup: <a href="https://www.mail-archive.com/svn-src-all@freebsd.org/msg155493.html" rel="nofollow">https://www.mail-archive.com/svn-src-all@freebsd.org/msg155493.html</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171229080944" rel="nofollow">BSDCAN2017 Interview with Peter Hessler, Reyk Floeter, and Henning Brauer</a></li>
<li><a href="https://www.youtube.com/watch?v=e-Xim3_rJns" rel="nofollow">video</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/dsbmd.html" rel="nofollow">DSBMD</a></li>
<li><a href="https://media.ccc.de/v/34c3-9196-may_contain_dtraces_of_freebsd" rel="nofollow">ccc34 talk - May contain DTraces of FreeBSD</a></li>
<li>[scripts to run an OpenBSD mirror, rsync and verify])(<a href="https://github.com/bluhm/mirror-openbsd" rel="nofollow">https://github.com/bluhm/mirror-openbsd</a>)</li>
<li><a href="https://int10h.org/oldschool-pc-fonts/readme/" rel="nofollow">Old School PC Fonts</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>David - <a href="http://dpaste.com/33HKKEM#wrap" rel="nofollow">Approach and Tools for Snapshots and Remote Replication</a></li>
<li>Brian - <a href="http://dpaste.com/3QWFEYR#wrap" rel="nofollow">Help getting my FreeBSD systems talking across the city</a></li>
<li>Malcolm - <a href="http://dpaste.com/1Z9Y8H1" rel="nofollow">First BSD Meetup in Stockholm happened and it was great</a></li>
<li>Brad - <a href="http://dpaste.com/3EC9RGG#wrap" rel="nofollow">Update on TrueOS system</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We review Meltdown and Spectre responses from various BSD projects, show you how to run CentOS with bhyve, GhostBSD 11.1 is out, and we look at the case against the fork syscall.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>More Meltdown</h3>

<ul>
<li><p>Much has been happened this week, but before we get into a status update of the various mitigations on the other BSDs, some important updates:</p>

<ul>
<li><a href="https://newsroom.intel.com/news/intel-security-issue-update-addressing-reboot-issues/" rel="nofollow">Intel has recalled the microcode update they issued on January 8th. It turns out this update can cause Haswell and Broadwell based systems to randomly reboot, with some frequency.</a></li>
<li><a href="https://www.amd.com/en/corporate/speculative-execution" rel="nofollow">AMD has confirmed that its processors are vulnerable to both variants of Spectre, and the the fix for variant #2 will require a forthcoming microcode update, in addition to OS level mitigations</a></li>
<li><a href="https://sp.ts.fujitsu.com/dmsp/Publications/public/Intel-Side-Channel-Analysis-Method-Security-Review-CVE2017-5715-vulnerability-Fujitsu-products.pdf" rel="nofollow">Fujitsu has provided a status report for most of its products, including SPARC hardware</a></li>
</ul></li>
<li><p><a href="https://www.theregister.co.uk/2018/01/12/intel_warns_meltdown_spectre_fixes_make_broadwells_haswells_unstable/" rel="nofollow">The Register of course has some commentary</a></p></li>
</ul>

<blockquote>
<p>If new code is needed, Intel will need to get it right: the company already faces numerous class action lawsuits. Data centre operators already scrambling to conduct unplanned maintenance will not be happy about the fix reducing stability.<br>
AMD has said that operating system patches alone will address the Spectre bounds check bypass bug. Fixing Spectres branch target injection flaw will require firmware fixes that AMD has said will start to arrive for Ryzen and EPYC CPUs this week.<br>
The Register has also asked other server vendors how theyre addressing the bugs. Oracle has patched its Linux, but has told us it has No comment/statement on this as of now in response to our query about its x86 systems, x86 cloud, Linux and Solaris on x86. The no comment regarding Linux is odd as fixes for Oracle Linux landed <a href="https://linux.oracle.com/errata/ELSA-2018-4006.html" rel="nofollow">here</a> on January 9th.<br>
SPARC-using Fujitsu, meanwhile, has published advice (PDF) revealing how it will address the twin bugs in its servers and PCs, and also saying its SPARC systems are under investigation.</p>
</blockquote>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20180106082238" rel="nofollow">Response from OpenBSD:</a></li>
</ul>

<p><a href="https://marc.info/?t=151521438600001&r=1&w=2" rel="nofollow">&#39;Meltdown, aka &quot;Dear Intel, you suck&quot;&#39;</a></p>

<ul>
<li><p><a href="https://www.itwire.com/security/81338-handling-of-cpu-bug-disclosure-incredibly-bad-openbsd-s-de-raadt.html" rel="nofollow">Theo de Raadt&#39;s response to Meltdown</a></p></li>
<li><p><a href="https://marc.info/?l=openbsd-misc&m=118296441702631&w=2" rel="nofollow">That time in 2007 when Theo talked about how Intel x86 had major design problems in their chips</a></p></li>
<li><p><a href="https://marc.info/?l=openbsd-cvs&m=151570987406841&w=2" rel="nofollow">OpenBSD gets a Microcode updater</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2018-January/313758.html" rel="nofollow">Response from Dragonfly BSD:</a><br>
The longer response in four commits</p>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2018-January/627151.html" rel="nofollow">One</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2018-January/627152.html" rel="nofollow">Two</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2018-January/627153.html" rel="nofollow">Three</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2018-January/627154.html" rel="nofollow">Four</a></li>
</ul></li>
<li><p><a href="https://www.dragonflydigest.com/2018/01/10/20718.html" rel="nofollow">Even more Meltdown</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2018-January/335643.html" rel="nofollow">DragonflyBSD master now has full IBRS and IBPB support</a></p>

<ul>
<li>IBRS (Indirect Branch Restricted Speculation): The x86 IBRS feature requires corresponding microcode support. It mitigates the variant 2 vulnerability.</li>
<li>If IBRS is set, near returns and near indirect jumps/calls will not allow their predicted target address to be controlled by code that executed in a less privileged prediction mode before the IBRS mode was last written with a value of 1 or on another logical processor so long as all RSB entries from the previous less privileged prediction mode are overwritten.</li>
<li>Speculation on Skylake and later requires these patches (&quot;dynamic IBRS&quot;) be used instead of retpoline.  If you are very paranoid or you run on a CPU where IBRS=1 is cheaper, you may also want to run in &quot;IBRS always&quot; mode.</li>
<li>IBPB (Indirect Branch Prediction Barrier): Setting of IBPB ensures that earlier code&#39;s behavior does not control later indirect branch predictions.  It is used when context switching to new untrusted address space. Unlike IBRS, IBPB is a command MSR and does not retain its state.</li>
</ul></li>
<li><p><a href="https://www.phoronix.com/scan.php?page=article&item=dragonfly-bsd-meltdown&num=1" rel="nofollow">DragonFlyBSD&#39;s Meltdown Fix Causing More Slowdowns Than Linux</a></p></li>
<li><p><a href="http://mail-index.netbsd.org/source-changes/2018/01/07/msg090945.html" rel="nofollow">NetBSD HOTPATCH()</a></p></li>
<li><p><a href="http://mail-index.netbsd.org/source-changes/2018/01/07/msg090952.html" rel="nofollow">NetBSD SVS (Separate Virtual Space)</a></p></li>
</ul>

<hr>

<h3><a href="https://www.daemon-security.com/2018/01/bhyve-centos-0110.html" rel="nofollow">Running CentOS with Bhyve</a></h3>

<blockquote>
<p>With the addition of UEFI in FreeBSD (since version 11), users of bhyve can use the UEFI boot loader instead of the grub2-bhyve port for booting operating systems such as Microsoft Windows, Linux and OpenBSD. The following page provides information necessary for setting up bhyve with UEFI boot loader support:<br>
<a href="https://wiki.freebsd.org/bhyve/UEFI" rel="nofollow">https://wiki.freebsd.org/bhyve/UEFI</a><br>
Features have been added to vmrun.sh to make it easier to setup the UEFI boot loader, but the following is required to install the UEFI firmware pkg:</p>

<p><code># pkg install -y uefi-edk2-bhyve</code></p>

<p>With graphical support, you can use a vnc client like tigervnc, which can be installed with the following command:</p>

<p><code># pkg install -y tigervnc</code></p>

<p>In the case of most corporate or government environments, the Linux of choice is RHEL, or CentOS. Utilizing bhyve, you can test and install CentOS in a bhyve VM the same way you would deploy a Linux VM in production. The first step is to download the CentOS iso (for this tutorial I used the CentOS minimal ISO): <a href="http://isoredirect.centos.org/centos/7/isos/x86_64/CentOS-7-x86_64-Minimal-1708.iso" rel="nofollow">http://isoredirect.centos.org/centos/7/isos/x86_64/CentOS-7-x86_64-Minimal-1708.iso</a></p>

<p>I normally use a ZFS Volume (zvol) when running bhyve VMs. Run the following commands to create a zvol (ensure you have enough disk space to perform these operations):</p>

<p><code># zfs create -V20G -o volmode=dev zroot/centos0</code></p>
</blockquote>

<ul>
<li>(zroot in this case is the zpool I am using)</li>
</ul>

<blockquote>
<p>Similar to my previous post about vmrun.sh, you need certain items to be configured on FreeBSD in order to use bhyve. The following commands are necessary to get things running:</p>

<pre><code># echo &quot;vfs.zfs.vol.mode=2&quot; &gt;&gt; /boot/loader.conf
# kldload vmm
# ifconfig tap0 create
# sysctl net.link.tap.up_on_open=1
net.link.tap.up_on_open: 0 -&gt; 1
# ifconfig bridge0 create
# ifconfig bridge0 addm em0 addm tap0
# ifconfig bridge0 up
</code></pre>
</blockquote>

<ul>
<li>(replace em0 with whatever your physical interface is).</li>
</ul>

<blockquote>
<p>There are a number of utilities that can be used to manage bhyve VMs, and I am sure there is a way to use vmrun.sh to run Linux VMs, but since all of the HowTos for running Linux use the bhyve command line, the following script is what I use for running CentOS with bhyve.</p>

<pre><code>#!/bin/sh
#
# General bhyve install/run script for CentOS
# Based on scripts from pr1ntf and lattera 

HOST=&quot;127.0.0.1&quot; 
PORT=&quot;5901&quot;
ISO=&quot;/tmp/centos.iso&quot;
VMNAME=&quot;centos&quot;
ZVOL=&quot;centos0&quot; 
SERIAL=&quot;nmda0A&quot;
TAP=&quot;tap1&quot; 
CPU=&quot;1&quot;
RAM=&quot;1024M&quot;
HEIGHT=&quot;800&quot;
WIDTH=&quot;600&quot;

if [ &quot;$1&quot; == &quot;install&quot; ];
then 

#Kill it before starting it
bhyvectl --destroy --vm=$VMNAME

bhyve -c $CPU -m $RAM -H -P -A \ 
-s 0,hostbridge \
-s 2,virtio-net,$TAP \ 
-s 3,ahci-cd,$ISO \
-s 4,virtio-blk,/dev/zvol/zroot/$ZVOL \
-s 29,fbuf,tcp=$HOST:$PORT,w=$WIDTH,h=$HEIGHT \ 
-s 30,xhci,tablet \
-s 31,lpc -l com1,/dev/$SERIAL \ 
-l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd \
$VMNAME

#kill it after 
bhyvectl --destroy --vm=$VMNAME

elif [ &quot;$1&quot; == &quot;run&quot; ];
then 

#Kill it before starting it
bhyvectl --destroy --vm=centos 

bhyve -c $CPU -m $RAM -w -H \
-s 0,hostbridge \
-s 2,virtio-net,$TAP \ 
-s 4,virtio-blk,/dev/zvol/zroot/$ZVOL \
-s 29,fbuf,tcp=$HOST:$PORT,w=$WIDTH,h=$HEIGHT \ 
-s 30,xhci,tablet \
-s 31,lpc -l com1,/dev/$SERIAL \ 
-l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd \
$VMNAME &amp;

else 
echo &quot;Please type install or run&quot;; 
fi 
</code></pre>

<p>The variables at the top of the script can be adjusted to fit your own needs. With the addition of the graphics output protocol in UEFI (or UEFI-GOP), a VNC console is launched and hosted with the HOST and PORT setting. There is a password option available for the VNC service, but the connection should be treated as insecure. It is advised to only listen on localhost with the VNC console and tunnel into the host of the bhyve VM. Now with the ISO copied to /tmp/centos.iso, and the script saved as centos.sh you can run the following command to start the install:</p>

<p><code># ./centos.sh install</code></p>

<p>At this point, using vncviewer (on the local machine, or over an SSH tunnel), you should be able to bring up the console and run the CentOS installer as normal. The absolutely most critical item is to resolve an issue with the booting of UEFI after the installation has completed. Because of the path used in bhyve, you need to run the following to be able to boot CentOS after the installation:</p>
</blockquote>

<p><code># cp -f /mnt/sysimage/boot/efi/EFI/centos/grubx64.efi /mnt/sysimage/boot/efi/EFI/BOOT</code></p>

<blockquote>
<p>With this setting changed, the same script can be used to launch your CentOS VM as needed:</p>
</blockquote>

<p><code># ./centos.sh run</code></p>

<blockquote>
<p>If you are interested in a better solution for managing your Linux VM, take a look at the various bhyve management ports in the FreeBSD ports tree.</p>
</blockquote>

<hr>

<h2>Interview - newnix architect - <a href="https://bsd.network/@newnix" rel="nofollow">@newnix</a></h2>

<h2>News Roundup</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20180108#ghostbsd" rel="nofollow">GhostBSD 11.1 - FreeBSD for the desktop</a></h3>

<blockquote>
<p>GhostBSD is a desktop oriented operating system which is based on FreeBSD. The project takes the FreeBSD operating system and adds a desktop environment, some popular applications, a graphical package manager and Linux binary compatibility. GhostBSD is available in two flavours, MATE and Xfce, and is currently available for 64-bit x86 computers exclusively. I downloaded the MATE edition which is available as a 2.3GB ISO file. </p>
</blockquote>

<ul>
<li>Installing </li>
</ul>

<blockquote>
<p>GhostBSD&#39;s system installer is a graphical application which begins by asking us for our preferred language, which we can select from a list. We can then select our keyboard&#39;s layout and our time zone. When it comes to partitioning we have three main options: let GhostBSD take over the entire disk using UFS as the file system, create a custom UFS layout or take over the entire disk using ZFS as the file system. UFS is a classic file system and quite popular, it is more or less FreeBSD&#39;s equivalent to Linux&#39;s ext4. ZFS is a more advanced file system with snapshots, multi-disk volumes and optional deduplication of data. I decided to try the ZFS option. </p>

<p>Once I selected ZFS I didn&#39;t have many more options to go through. I was given the chance to set the size of my swap space and choose whether to set up ZFS as a plain volume, with a mirrored disk for backup or in a RAID arrangement with multiple disks. I stayed with the plain, single disk arrangement. We are then asked to create a password for the root account and create a username and password for a regular user account. The installer lets us pick our account&#39;s shell with the default being fish, which seemed unusual. Other shells, including bash, csh, tcsh, ksh and zsh are available. The installer goes to work copying files and offers to reboot our computer when it is done. </p>
</blockquote>

<ul>
<li>Early impressions </li>
</ul>

<blockquote>
<p>The newly installed copy of GhostBSD boots to a graphical login screen where we can sign into the account we created during the install process. Signing into our account loads the MATE 1.18 desktop environment. I found MATE to be responsive and applications were quick to open. Early on I noticed odd window behaviour where windows would continue to slide around after I moved them with the mouse, as if the windows were skidding on ice. Turning off compositing in the MATE settings panel corrected this behaviour. I also found the desktop&#39;s default font (Montserrat Alternates) to be hard on my eyes as the font is thin and, for lack of a better term, bubbly. Fonts can be easily adjusted in the settings panel. </p>

<p>A few minutes after I signed into my account, a notification appeared in the system tray letting me know software updates were available. Clicking the update icon brings up a small window showing us a list of package updates and, if any are available, updates to the base operating system. FreeBSD, and therefore GhostBSD, both separate the core operating system from the applications (packages) which run on the operating system. This means we can update the core of the system separately from the applications. GhostBSD&#39;s core remains relatively static and minimal while applications are updated using a semi-rolling schedule. </p>

<p>When we are updating the core operating system, the update manager will give us the option of rebooting the system to finish the process. We can dismiss this prompt to continue working, but the wording of the prompt may be confusing. When asked if we want to reboot to continue the update process, the options presented to us are &quot;Continue&quot; or &quot;Restart&quot;. The Continue option closes the update manager and returns us to the MATE desktop. </p>

<p>The update manager worked well for me and the only issue I ran into was when I dismissed the update manager and then wanted to install updates later. There are two launchers for the update manager, one in MATE&#39;s System menu and one in the settings panel. Clicking either of these launchers didn&#39;t accomplish anything. Running the update manager from the command line simply caused the process to lock up until killed. I found if I had dismissed the update manager once, I&#39;d have to wait until I logged in again to use it. Alternatively, I could use a command line tool or use the OctoPkg package manager to install package updates. </p>
</blockquote>

<ul>
<li>Conclusions </li>
</ul>

<blockquote>
<p>Most of my time with GhostBSD, I was impressed and happy with the operating system. GhostBSD builds on a solid, stable FreeBSD core. We benefit from FreeBSD&#39;s performance and its large collection of open source software packages. The MATE desktop was very responsive in my trial and the system is relatively light on memory, even when run on ZFS which has a reputation for taking up more memory than other file systems. </p>
</blockquote>

<hr>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=FreeBSD-Wayland-Availability" rel="nofollow">FreeBSD Looks At Making Wayland Support Available By Default</a></h3>

<blockquote>
<p>There&#39;s an active discussion this week about making Wayland support available by default on FreeBSD. </p>

<p>FreeBSD has working Wayland support -- well, assuming you have working Intel / Radeon graphics -- and do have Weston and some other Wayland components available via FreeBSD Ports. FreeBSD has offered working Wayland support that is &quot;quite usable&quot; for more than one year. But, it&#39;s not too easy to get going with Wayland on FreeBSD. </p>

<p>Right now those FreeBSD desktop users wanting to use/develop with Wayland currently need to rebuild the GTK3 tool-kit, Mesa, and other packages with Wayland support enabled. This call for action now is about allowing the wayland=on to be made the default. </p>

<p>This move would then allow these dependencies to be built with Wayland support by default, but for the foreseeable future FreeBSD will continue defaulting to X.Org-based sessions. </p>

<p>The FreeBSD developers mostly acknowledge that Wayland is the future and the cost of enabling Wayland support by default is just slightly larger packages, but that weight is still leaner than the size of the X.Org code-base and its dependencies. </p>
</blockquote>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2017-December/111906.html" rel="nofollow">FreeBSD vote thread</a></li>
<li><a href="https://github.com/trueos/trueos-core/commit/f48dba9d4e8cefc45d6f72336e7a0b5f42a2f6f1" rel="nofollow">TrueOS Fliped the switch already</a></li>
</ul>

<hr>

<h3><a href="https://sircmpwn.github.io/2018/01/02/The-case-against-fork.html" rel="nofollow">fork is not my favorite syscall</a></h3>

<blockquote>
<p>This article has been on my to-write list for a while now. In my opinion, fork is one of the most questionable design choices of Unix. I dont understand the circumstances that led to its creation, and I grieve over the legacy rationale that keeps it alive to this day.</p>

<p>Lets set the scene. Its 1971 and youre a fly on the wall in Bell Labs, watching the first edition of Unix being designed for the PDP-11/20. This machine has a 16-bit address space with no more than 248 kilobytes of memory. Theyre discussing how theyre going to support programs that spawn new programs, and someone has a brilliant idea. What if we copied the entire address space of the program into a new process running from the same spot, then let them overwrite themselves with the new program? This got a rousing laugh out of everyone present, then they moved on to a better design which would become immortalized in the most popular and influential operating system of all time.</p>

<p>At least, thats the story Id like to have been told. In actual fact, the laughter becomes consensus. Theres an obvious problem with this approach: every time you want to execute a new program, the entire process space is copied and promptly discarded when the new program begins. Usually when I complain about fork, this the point when its supporters play the virtual memory card, pointing out that modern operating systems dont actually have to copy the whole address space. Well get to that, but first  First Edition Unix does copy the whole process space, so this excuse wouldnt have held up at the time. By Fourth Edition Unix (the next one for which kernel sources survived), they had wisened up a bit, and started only copying segments when they faulted.</p>

<p>This model leads to a number of problems. One is that the new process inherits all of the parents process descriptors, so you have to close them all before you exec another process. However, unless youre manually keeping tabs on your open file descriptors, there is no way to know what file handles you must close! The hack that solves this is CLOEXEC, the first of many hacks that deal with forks poor design choices. This file descriptors problem balloons a bit - consider for example if you want to set up a pipe. You have to establish a piped pair of file descriptors in the parent, then close every fd but the pipe in the child, then dup2 the pipe file descriptor over the (now recently closed) file descriptor 1. By this point youve probably had to do several non-trivial operations and utilize a handful of variables from the parent process space, which hopefully were on the stack so that we dont end up copying segments into the new process space anyway.</p>

<p>These problems, however, pale in comparison to my number one complaint with the fork model. Fork is the direct cause of the stupidest component Ive ever heard of in an operating system: the out-of-memory (aka OOM) killer. Say you have a process which is using half of the physical memory on your system, and wants to spawn a tiny program. Since fork copies the entire process, you might be inclined to think that this would make fork fail. But, on Linux and many other operating systems since, it does not fail! They agree that its stupid to copy the entire process just to exec something else, but because fork is Important for Backwards Compatibility, they just fake it and reuse the same memory map (except read-only), then trap the faults and actually copy later. The hope is that the child will get on with it and exec before this happens.</p>

<p>However, nothing prevents the child from doing something other than exec - its free to use the memory space however it desires! This approach now leads to memory overcommittment - Linux has promised memory it does not have. As a result, when it really does run out of physical memory, Linux will just kill off processes until it has some memory back. Linux makes an awfully big fuss about never breaking userspace for a kernel that will lie about memory it doesnt have, then kill programs that try to use the back-alley memory they were given. That this nearly 50 year old crappy design choice has come to this astonishes me.</p>

<p>Alas, I cannot rant forever without discussing the alternatives. There are better process models that have been developed since Unix!</p>

<p>The first attempt I know of is BSDs vfork syscall, which is, in a nutshell, the same as fork but with severe limitations on what you do in the child process (i.e. nothing other than calling exec straight away). There are loads of problems with vfork. It only handles the most basic of use cases: you cannot set up a pipe, cannot set up a pty, and cant even close open file descriptors you inherited from the parent. Also, you couldnt really be sure of what variables you were and werent editing or allowed to edit, considering the limitations of the C specification. Overall this syscall ended up being pretty useless.</p>

<p>Another model is posix_spawn, which is a hell of an interface. Its far too complicated for me to detail here, and in my opinion far too complicated to ever consider using in practice. Even if it could be understood by mortals, its a really bad implementation of the spawn paradigm  it basically operates like fork backwards, and inherits many of the same flaws. You still have to deal with children inheriting your file descriptors, for example, only now you do it in the parent process. Its also straight-up impossible to make a genuine pipe with posix_spawn. (Note: a reader corrected me - this is indeed possible via posix_spawn_file_actions_adddup2.)</p>

<p>Lets talk about the good models - rfork and spawn (at least, if spawn is done right). rfork originated from plan9 and is a beautiful little coconut of a syscall, much like the rest of plan9. They also implement fork, but its a special case of rfork. plan9 does not distinguish between processes and threads - all threads are processes and vice versa. However, new processes in plan9 are not the everything-must-go fuckfest of your typical fork call. Instead, you specify exactly what the child should get from you. You can choose to include (or not include) your memory space, file descriptors, environment, or a number of other things specific to plan9. Theres a cool flag that makes it so you dont have to reap the process, too, which is nice because reaping children is another really stupid idea. It still has some problems, mainly around creating pipes without tremendous file descriptor fuckery, but its basically as good as the fork model gets. Note: Linux offers this via the clone syscall now, but everyone just fork+execs anyway.</p>

<p>The other model is the spawn model, which I prefer. This is the approach I took in my own kernel for KnightOS, and I think its also used in NT (Microsofts kernel). I dont really know much about NT, but I can tell you how it works in KnightOS. Basically, when you create a new process, it is kept in limbo until the parent consents to begin. You are given a handle with which you can configure the process - you can change its environment, load it up with file descriptors to your liking, and so on. When youre ready for it to begin, you give the go-ahead and its off to the races. The spawn model has none of the flaws of fork.</p>

<p>Both fork and exec can be useful at times, but spawning is much better for 90% of their use-cases. If I were to write a new kernel today, Id probably take a leaf from plan9s book and find a happy medium between rfork and spawn, so you could use spawn to start new threads in your process space as well. To the brave OS designers of the future, ready to shrug off the weight of legacy: please reconsider fork.</p>

<hr>
</blockquote>

<h3><a href="https://svnweb.freebsd.org/changeset/base/327783" rel="nofollow">Enable ld.lld as bootstrap linker by default on amd64</a></h3>

<ul>
<li>Enable ld.lld as bootstrap linker by default on amd64</li>
</ul>

<blockquote>
<p>For some time we have been planning to migrate to LLVM&#39;s lld linker.<br>
Having a man page was the last blocking issue for using ld.lld to link<br>
the base system kernel + userland, now addressed by r327770.  Link the<br>
kernel and userland libraries and binaries with ld.lld by default, for<br>
additional test coverage.</p>

<p>This has been a long time in the making.  On 2013-04-13 I submitted an<br>
upstream tracking issue in LLVM PR 23214: [META] Using LLD as FreeBSD&#39;s<br>
system linker.  Since then 85 individual issues were identified, and<br>
submitted as dependencies.  These have been addressed along with two<br>
and a half years of other lld development and improvement.</p>

<p>I&#39;d like to express deep gratitude to upstream lld developers Rui<br>
Ueyama, Rafael Espindola, George Rimar and Davide Italiano.  They put in<br>
substantial effort in addressing the issues we found affecting<br>
FreeBSD/amd64.</p>

<p>To revert to using ld.bfd as the bootstrap linker, in /etc/src.conf set</p>

<p>WITHOUT_LLD_BOOTSTRAP=yes</p>

<p>If you need to set this, please follow up with a PR or post to the<br>
freebsd-toolchain mailing list explaining how default WITH_LLD_BOOTSTRAP<br>
failed for your use case.</p>

<p>Note that GNU ld.bfd is still installed as /usr/bin/ld, and will still<br>
be used for linking ports.  ld.lld can be installed as /usr/bin/ld by<br>
setting in /etc/src.conf</p>

<pre><code>WITH_LLD_IS_LLD=yes
</code></pre>

<p>A followup commit will set WITH_LLD_IS_LD by default, possibly after<br>
Clang/LLVM/lld 6.0 is merged to FreeBSD.</p>

<p>Release notes:    Yes<br>
Sponsored by: The FreeBSD Foundation</p>
</blockquote>

<ul>
<li>Followup: <a href="https://www.mail-archive.com/svn-src-all@freebsd.org/msg155493.html" rel="nofollow">https://www.mail-archive.com/svn-src-all@freebsd.org/msg155493.html</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171229080944" rel="nofollow">BSDCAN2017 Interview with Peter Hessler, Reyk Floeter, and Henning Brauer</a></li>
<li><a href="https://www.youtube.com/watch?v=e-Xim3_rJns" rel="nofollow">video</a></li>
<li><a href="https://freeshell.de/%7Emk/projects/dsbmd.html" rel="nofollow">DSBMD</a></li>
<li><a href="https://media.ccc.de/v/34c3-9196-may_contain_dtraces_of_freebsd" rel="nofollow">ccc34 talk - May contain DTraces of FreeBSD</a></li>
<li>[scripts to run an OpenBSD mirror, rsync and verify])(<a href="https://github.com/bluhm/mirror-openbsd" rel="nofollow">https://github.com/bluhm/mirror-openbsd</a>)</li>
<li><a href="https://int10h.org/oldschool-pc-fonts/readme/" rel="nofollow">Old School PC Fonts</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>David - <a href="http://dpaste.com/33HKKEM#wrap" rel="nofollow">Approach and Tools for Snapshots and Remote Replication</a></li>
<li>Brian - <a href="http://dpaste.com/3QWFEYR#wrap" rel="nofollow">Help getting my FreeBSD systems talking across the city</a></li>
<li>Malcolm - <a href="http://dpaste.com/1Z9Y8H1" rel="nofollow">First BSD Meetup in Stockholm happened and it was great</a></li>
<li>Brad - <a href="http://dpaste.com/3EC9RGG#wrap" rel="nofollow">Update on TrueOS system</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>228: The Spectre of Meltdown</title>
  <link>https://www.bsdnow.tv/228</link>
  <guid isPermaLink="false">4e0833ff-c2bf-4a7d-ac29-9249c3bc8114</guid>
  <pubDate>Wed, 10 Jan 2018 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4e0833ff-c2bf-4a7d-ac29-9249c3bc8114.mp3" length="80596084" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We review the information about Spectre &amp; Meltdown thus far, we look at NetBSD memory sanitizer progress, Postgres on ZFS &amp; show you a bit about NomadBSD.</itunes:subtitle>
  <itunes:duration>1:51:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We review the information about Spectre &amp;amp; Meltdown thus far, we look at NetBSD memory sanitizer progress, Postgres on ZFS &amp;amp; show you a bit about NomadBSD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Meltdown Spectre
Official Site (https://meltdownattack.com/)
Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign (https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/)
Intel’s official response (https://newsroom.intel.com/news/intel-responds-to-security-research-findings/)
The Register mocks intels response with pithy annotations (https://www.theregister.co.uk/2018/01/04/intel_meltdown_spectre_bugs_the_registers_annotations/)
Intel’s Analysis PDF (https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf)
XKCD (https://xkcd.com/1938/)
Response from FreeBSD (https://lists.freebsd.org/pipermail/freebsd-security/2018-January/009719.html)
FreeBSD's patch WIP (https://reviews.freebsd.org/D13797)
Why Raspberry Pi isn’t vulnerable to Spectre or Meltdown (https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/)
Xen mitigation patches (https://lists.xenproject.org/archives/html/xen-devel/2018-01/msg00110.html)
Overview of affected FreeBSD Platforms/Architectures (https://wiki.freebsd.org/SpeculativeExecutionVulnerabilities)
Groff's response (https://twitter.com/GroffTheBSDGoat/status/949372300368867328)
##### We’ll cover OpenBSD, NetBSD, and DragonflyBSD’s responses in next weeks episode.
***
###The LLVM Memory Sanitizer support work in progress (https://blog.netbsd.org/tnf/entry/the_llvm_memory_sanitizer_support)
&amp;gt; In the past 31 days, I've managed to get the core functionality of MSan to work. This is an uninitialized memory usage detector. MSan is a special sanitizer because it requires knowledge of every entry to the basesystem library and every entry to the kernel through public interfaces. This is mandatory in order to mark memory regions as initialized.  Most of the work has been done directly for MSan. However, part of the work helped generic features in compiler-rt.
Sanitizers
&amp;gt; Changes in the sanitizer are listed below in chronological order. Almost all of the changes mentioned here landed upstream. A few small patches were reverted due to breaking non-NetBSD hosts and are rescheduled for further investigation. I maintain these patches locally and have moved on for now to work on the remaining features.
NetBSD syscall hooks
&amp;gt; I wrote a large patch (815kb!) adding support for NetBSD syscall hooks for use with sanitizers. 
NetBSD ioctl(2) hooks
&amp;gt; Similar to the syscall hooks, there is need to handle every ioctl(2) call. I've created the needed patch, this time shorter - for less than 300kb.
New patches still pending for upstream review
&amp;gt; There are two corrections that I've created, and they are still pending upstream for review:
Add MSan interceptor for fstat(2)](https://reviews.llvm.org/D41637)
 Correct the setitimer interceptor on NetBSD)](https://reviews.llvm.org/D41502)
&amp;gt; I've got a few more local patches that require cleanup before submitting to review.
NetBSD basesystem corrections
Sanitizers in Go
The MSan state as of today
Solaris support in sanitizers
&amp;gt; I've helped the Solaris team add basic support for Sanitizers (ASan, UBsan). This does not help NetBSD directly, however indirectly it improves the overall support for non-Linux hosts and helps to catch more Linuxisms in the code.
Plan for the next milestone
&amp;gt; I plan to continue the work on MSan and correct sanitizing of the NetBSD basesystem utilities. This mandates me to iterate over the basesystem libraries implementing the missing interceptors and correcting the current support of the existing ones. My milestone is to build all src/bin programs against Memory Sanitizer and when possible execute them cleanly.
This work was sponsored by The NetBSD Foundation.
The NetBSD Foundation is a non-profit organization and welcomes any donations to help us continue funding projects and services to the open-source community. Please consider visiting the following URL, and chip in what you can: http://netbsd.org/donations/#how-to-donate (http://netbsd.org/donations/#how-to-donate)
***
##News Roundup
###MWL’s 2017 Wrap-Up (https://blather.michaelwlucas.com/archives/3078)
&amp;gt; The obvious place to start is my 2016 wrap-up post](https://blather.michaelwlucas.com/archives/2822), where I listed goals for 2017. As usual, these goals were wildly delusional.
&amp;gt; The short answer is, my iron was back up to normal. My writing speed wasn’t, though. I’d lost too much general health, and needed hard exercise to recover it. Yes, writing requires physical endurance. Maintaining that level of concentration for several hours a day demands a certain level of blood flow to the brain. I could have faked it in a day job, but when self-employed as an artist? Not so much.
&amp;gt; Then there’s travel. I did my usual BSDCan trip, plus two educational trips to Lincoln City, Oregon. The current political mayhem convinced me that if I wanted to hit EuroBSDCon any time in the next few years, I should do it in the very near future. So I went to Paris, where I promptly got pickpocketed. (Thankfully, they didn’t get my passport.) I was actively writing the third edition of Absolute FreeBSD, so I visited BSDCam in Cambridge to get the latest information and a sense of where FreeBSD was going. I also did weekends at Kansas LinuxFest (because they asked and paid for my trip) and Penguicon.
&amp;gt; (Because people will ask: why EuroBSDCon and not AsiaBSDCon? A six-hour transatlantic flight requires that I take a substantial dose of heavy-grade tranquilizers. I’m incapable of making intelligent decisions while on those drugs, or for several hours afterward. They don’t last long enough for twelve-hour flight to Japan, so I need to be accompanied by someone qualified to tell me when I need to take the next dose partway through the flight. This isn’t a predetermined time that I can set an alarm for; it depends on how the clonazepam affects me at those altitudes. A drug overdose while flying over the North Pole would be bad. When I can arrange that qualified companion, I’ll make the trip.)
&amp;gt; I need most of the preceding week to prepare for long trips. I need the following week to recover from time shifts and general exhaustion. Additionally, I have to hoard people juice for a few weeks beforehand so I can deal with folks during these expeditions. Travel disrupts my dojo time as well, which impacts my health.
&amp;gt; Taken as a whole: I didn’t get nearly as much done as I hoped.
I wrote more stories, but Kris Rusch bludgeoned me into submitting them to trad markets. (The woman is a brute, I tell you. Cross her at your peril.)
Among my 2017 titles, my fiction outsold the tech books. No, not Prohibition Orcs–all four of the people who buy those love them, but the sales tell me I’ve done something wrong with those tales.
My cozy mystery git commit murder outsold Relayd and Httpd Mastery.
But what outdid them both, as well as most of my older books? What title utterly dominated my sales for the last quarter of the year? It was of course, my open source software political satire disguised as porn Savaged by Systemd: an Erotic Unix Encounter. (https://www.michaelwarrenlucas.com/index.php/romance#sbs)
&amp;gt; I can’t believe I just wrote that paragraph.
The good news is, once I recovered from EuroBSDCon, my writing got better.
I finished Absolute FreeBSD, 3rd edition and submitted it to the publisher.
I wrote the second edition of SSH Mastery (no link, because you can’t order it yet.)
I’m plowing through git sync murder, the sequel to git commit murder. I don’t get to see the new Star Wars movie until I finish GSM, so hopefully that’ll be this month.
All in all, I wrote 480,200 words in 2017. Most of that was after September. It’s annoyingly close to breaking half a million, but after 2016’s scandalous 195,700, I’ll take it.
***
###PG Phriday: Postgres on ZFS (https://blog.2ndquadrant.com/pg-phriday-postgres-zfs/)
&amp;gt; ZFS is a filesystem originally created by Sun Microsystems, and has been available for BSD over a decade. While Postgres will run just fine on BSD, most Postgres installations are historically Linux-based systems. ZFS on Linux has had much more of a rocky road to integration due to perceived license incompatibilities.
&amp;gt; As a consequence, administrators were reluctant or outright refused to run ZFS on their Linux clusters. It wasn’t until OpenZFS was introduced in 2013 that this slowly began to change. These days, ZFS and Linux are starting to become more integrated, and Canonical of Ubuntu fame even announced direct support for ZFS in their 16.04 LTS release.
&amp;gt; So how can a relatively obscure filesystem designed by a now-defunct hardware and software company help Postgres? Let’s find out!
Eddie waited til he finished high school
&amp;gt; Old server hardware is dirt cheap these days, and make for a perfect lab for testing suspicious configurations. This is the server we’ll be using for these tests for those following along at home, or want some point of reference:

Dell R710
x2 Intel X5660 CPUs, for up to 24 threads
64GB RAM
x4 1TB 7200RPM SATA HDDs
H200 RAID card configured for Host Bus Adapter (HBA) mode
250GB Samsung 850 EVO SSD

&amp;gt; The H200 is particularly important, as ZFS acts as its own RAID system. It also has its own checksumming and other algorithms that don’t like RAID cards getting in the way. As such, we put the card itself in a mode that facilitates this use case.
&amp;gt; Due to that, we lose out on any battery-backed write cache the RAID card might offer. To make up for it, it’s fairly common to use an SSD or other persistent fast storage to act both as a write cache, and a read cache. This also transforms our HDDs into hybrid storage automatically, which is a huge performance boost on a budget.
She had a guitar and she taught him some chords
&amp;gt; First things first: we need a filesystem. This hardware has four 1TB HDDs, and a 250GB SSD. To keep this article from being too long, we’ve already placed GPT partition tables on all the HDDs, and split the SSD into 50GB for the OS, 32GB for the write cache, and 150GB for the read cache. A more robust setup would probably use separate SSDs or a mirrored pair for these, but labs are fair game.
They moved into a place they both could afford
&amp;gt; Let’s start by getting a performance baseline for the hardware. We might expect peak performance at 12 or 24 threads because the server has 12 real CPUs and 24 threads, but query throughput actually topped out at concurrent 32 processes. We can scratch our heads over this later, for now, we can consider it the maximum capabilities of this hardware.
Here’s a small sample:
```
$&amp;gt; pgbench -S -j 32 -c 32 -M prepared -T 20 pgbench
...
tps = 264661.135288 (including connections establishing)
tps = 264849.345595 (excluding connections establishing)
```
So far, this is pretty standard behavior. 260k prepared queries per second is great read performance, but this is supposed to be a filesystem demonstration. Let’s get ZFS involved.
+ The papers said Ed always played from the heart
Let’s repeat that same test with writes enabled. Once that happens, filesystem syncs, dirty pages, WAL overhead, and other things should drastically reduce overall throughput. That’s an expected result, but how much are we looking at, here?
```
$&amp;gt; pgbench -j 32 -c 32 -M prepared -T 10 pgbench
...
tps = 6153.877658 (including connections establishing)
tps = 6162.392166 (excluding connections establishing)
```
SSD cache or not, storage overhead is a painful reality. Still, 6000 TPS with writes enabled is a great result for this hardware. Or is it? Can we actually do better?
Consider the Postgres fullpagewrites parameter. Tomas Vondra has written about it in the past as a necessity to prevent WAL corruption due to partial writes. The WAL is both streaming replication and crash recovery, so its integrity is of utmost importance. As a result, this is one parameter almost everyone should leave alone.
ZFS is Copy on Write (CoW). As a result, it’s not possible to have a torn page because a page can’t be partially written without reverting to the previous copy. This means we can actually turn off fullpagewrites in the Postgres config. The results are some fairly startling performance gains:

$&amp;gt; pgbench -j 32 -c 32 -M prepared -T 10 pgbench


tps = 10325.200812 (including connections establishing)
tps = 10336.807218 (excluding connections establishing)

That’s nearly a 70% improvement. Due to write amplification caused by full page writes, Postgres produced 1.2GB of WAL files during a 1-minute pgbench test, but only 160MB with full page writes disabled.
To be fair, a 32-thread pgbench write test is extremely abusive and certainly not a typical usage scenario. However, ZFS just ensured our storage a much lower write load by altering one single parameter. That means the capabilities of the hardware have also been extended to higher write workloads as IO bandwidth is not being consumed by WAL traffic.
+ They both met movie stars, partied and mingled
Astute readers may have noticed we didn’t change the default ZFS block size from 128k to align with the Postgres default of 8kb. 
As it turns out, the 128kb blocks allow ZFS to better combine some of those 8kb Postgres pages to save space. That will allow our measly 2TB to go a lot further than is otherwise possible.
Please note that this is not de-duplication, but simple lz4 compression, which is nearly real-time in terms of CPU overhead. De-duplication on ZFS is currently an uncertain bizzaro universe populated with misshapen horrors crawling along a broken landscape. It’s a world of extreme memory overhead for de-duplication tables, and potential lost data due to inherent conflicts with the CoW underpinnings. Please don’t use it, let anyone else use it, or even think about using it, ever.
+ They made a record and it went in the chart
We’re still not done. One important aspect of ZFS as a CoW filesystem, is that it has integrated snapshots.
Consider the scenario where a dev is connected to the wrong system and drops what they think is a table in a QA environment. It turns out they were in the wrong terminal and just erased a critical production table, and now everyone is frantic.
+ The future was wide open
It’s difficult to discount an immediately observable reduction in write overhead. Snapshots have a multitude of accepted and potential use cases, as well. In addition to online low-overhead compression, and the hybrid cache layer, ZFS boasts a plethora of features we didn’t explore.
Built-in checksums with integrated self-healing suggest it isn’t entirely necessary to re-initialize an existing Postgres instance to enable checksums. The filesystem itself ensures checksums are validated and correct, especially if we have more than one drive resource in our pool. It even goes the extra mile and actively corrects inconsistencies when encountered.
I immediately discounted ZFS back in 2012 because the company I worked for at the time was a pure Linux shop. ZFS was only available using the FUSE driver back then, meaning ZFS only worked through userspace with no real kernel integration. It was fun to tinker with, but nobody sane would use that on a production server of any description.
Things have changed quite drastically since then. I’ve stopped waiting for btrfs to become viable, and ZFS has probably taken the throne away from XFS as my filesystem of choice. Future editions of the Postgres High Availability Cookbook will reflect this as well.
Postgres MVCC and ZFS CoW seem made for each other. I’m curious to see what will transpire over the next few years now that ZFS has reached mainstream acceptance in at least one major Linux distribution.
NomadBSD (https://github.com/mrclksr/NomadBSD)
 About
NomadBSD is a live system for flash drives, based on FreeBSD.
Screenshots
http://freeshell.de/~mk/download/nomadbsd-ss1.png
http://freeshell.de/~mk/download/nomadbsd-ss2.png
 Requirements for building the image
A recent FreeBSD system
 Requirements for running NomadBSD
A 4GB (or more) flash drive
A System capable running FreeBSD 11.1 (amd64)
 Building the image
~~ csh
# make image
~~
 Writing the image to an USB memory stick
~~ csh
# dd if=nomadbsd.img of=/dev/da0 bs=10240 conv=sync
~~
 Resize filesystem to use the entire USB memory
Boot NomadBSD into single user mode, and execute:
~~
# gpart delete -i 2 da0s1
# gpart resize -i 1 da0
# gpart commit da0s1
~~
Determine the partition size in megabytes using 
fdisk da0
and calculate the remaining size of da0s1a:
 =  - .
~~
# gpart resize -i 1 -s M da0s1
# gpart add -t freebsd-swap -i 2 da0s1
# glabel label NomadBSDsw da0s1b
# service growfs onestart
# reboot
~~
FreeBSD forum thread (https://forums.freebsd.org/threads/63888/)
A short screen capture video of the NomadBSD system running in VirtualBox (https://freeshell.de/~mk/download/nomad_capture.mp4)
***
##Beastie Bits
Coolpkg, a package manager inspired by Nix for OpenBSD (https://github.com/andrewchambers/coolpkg)
zrepl - ZFS replication (https://zrepl.github.io/)
OpenBSD hotplugd automount script (https://bijanebrahimi.github.io/blog/openbsd-hotplugd-scripting.html)
Ancient troff sources vs. modern-day groff (https://virtuallyfun.com/2017/12/22/learn-ancient-troff-sources-vs-modern-day-groff/)
Paypal donation balance and status.. thanks everyone! (http://lists.dragonflybsd.org/pipermail/users/2017-December/313752.html)
Supervised FreeBSD rc.d script for a Go daemon (updated in last few days) (https://redbyte.eu/en/blog/supervised-freebsd-init-script-for-go-deamon/)
A Brief History of sed (https://blog.sourcerer.io/a-brief-history-of-sed-6eaf00302ed)
Flamegraph: Why does my AWS instance boot so slow? (http://www.daemonology.net/timestamping/tslog-c5.4xlarge.svg)
***
##Feedback/Questions
Jeremy - Replacing Drive in a Zpool (http://dpaste.com/319593M#wrap)
Dan’s Blog  (https://dan.langille.org/2017/08/16/swapping-5tb-in-3tb-out/)
Tim - Keeping GELI key through reboot (http://dpaste.com/11QTA06)
Brian - Mixing 2.5 and 3.5 drives (http://dpaste.com/2JQVD10#wrap)
Troels - zfs swap on FreeBSD (http://dpaste.com/147WAFR#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We review the information about Spectre &amp; Meltdown thus far, we look at NetBSD memory sanitizer progress, Postgres on ZFS &amp; show you a bit about NomadBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>Meltdown Spectre</h3>

<ul>
<li><a href="https://meltdownattack.com/" rel="nofollow">Official Site</a></li>
<li><a href="https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/" rel="nofollow">Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign</a></li>
<li><a href="https://newsroom.intel.com/news/intel-responds-to-security-research-findings/" rel="nofollow">Intel’s official response</a></li>
<li><a href="https://www.theregister.co.uk/2018/01/04/intel_meltdown_spectre_bugs_the_registers_annotations/" rel="nofollow">The Register mocks intels response with pithy annotations</a></li>
<li><a href="https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf" rel="nofollow">Intel’s Analysis PDF</a></li>
<li><a href="https://xkcd.com/1938/" rel="nofollow">XKCD</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-security/2018-January/009719.html" rel="nofollow">Response from FreeBSD</a></li>
<li><a href="https://reviews.freebsd.org/D13797" rel="nofollow">FreeBSD&#39;s patch WIP</a></li>
<li><a href="https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/" rel="nofollow">Why Raspberry Pi isn’t vulnerable to Spectre or Meltdown</a></li>
<li><a href="https://lists.xenproject.org/archives/html/xen-devel/2018-01/msg00110.html" rel="nofollow">Xen mitigation patches</a></li>
<li><a href="https://wiki.freebsd.org/SpeculativeExecutionVulnerabilities" rel="nofollow">Overview of affected FreeBSD Platforms/Architectures</a></li>
<li><a href="https://twitter.com/GroffTheBSDGoat/status/949372300368867328" rel="nofollow">Groff&#39;s response</a>
##### We’ll cover OpenBSD, NetBSD, and DragonflyBSD’s responses in next weeks episode.
***
###<a href="https://blog.netbsd.org/tnf/entry/the_llvm_memory_sanitizer_support" rel="nofollow">The LLVM Memory Sanitizer support work in progress</a>
&gt; In the past 31 days, I&#39;ve managed to get the core functionality of MSan to work. This is an uninitialized memory usage detector. MSan is a special sanitizer because it requires knowledge of every entry to the basesystem library and every entry to the kernel through public interfaces. This is mandatory in order to mark memory regions as initialized.  Most of the work has been done directly for MSan. However, part of the work helped generic features in compiler-rt.</li>
<li>Sanitizers
&gt; Changes in the sanitizer are listed below in chronological order. Almost all of the changes mentioned here landed upstream. A few small patches were reverted due to breaking non-NetBSD hosts and are rescheduled for further investigation. I maintain these patches locally and have moved on for now to work on the remaining features.</li>
<li>NetBSD syscall hooks
&gt; I wrote a large patch (815kb!) adding support for NetBSD syscall hooks for use with sanitizers. </li>
<li>NetBSD ioctl(2) hooks
&gt; Similar to the syscall hooks, there is need to handle every ioctl(2) call. I&#39;ve created the needed patch, this time shorter - for less than 300kb.</li>
<li>New patches still pending for upstream review
&gt; There are two corrections that I&#39;ve created, and they are still pending upstream for review:</li>
<li>Add MSan interceptor for fstat(2)](<a href="https://reviews.llvm.org/D41637" rel="nofollow">https://reviews.llvm.org/D41637</a>)</li>
<li> Correct the setitimer interceptor on NetBSD)](<a href="https://reviews.llvm.org/D41502" rel="nofollow">https://reviews.llvm.org/D41502</a>)
&gt; I&#39;ve got a few more local patches that require cleanup before submitting to review.</li>
<li>NetBSD basesystem corrections</li>
<li>Sanitizers in Go</li>
<li>The MSan state as of today</li>
<li>Solaris support in sanitizers
&gt; I&#39;ve helped the Solaris team add basic support for Sanitizers (ASan, UBsan). This does not help NetBSD directly, however indirectly it improves the overall support for non-Linux hosts and helps to catch more Linuxisms in the code.</li>
<li>Plan for the next milestone
&gt; I plan to continue the work on MSan and correct sanitizing of the NetBSD basesystem utilities. This mandates me to iterate over the basesystem libraries implementing the missing interceptors and correcting the current support of the existing ones. My milestone is to build all src/<em>bin</em> programs against Memory Sanitizer and when possible execute them cleanly.</li>
<li>This work was sponsored by The NetBSD Foundation.</li>
<li>The NetBSD Foundation is a non-profit organization and welcomes any donations to help us continue funding projects and services to the open-source community. Please consider visiting the following URL, and chip in what you can: <a href="http://netbsd.org/donations/#how-to-donate" rel="nofollow">http://netbsd.org/donations/#how-to-donate</a>
***
##News Roundup
###<a href="https://blather.michaelwlucas.com/archives/3078" rel="nofollow">MWL’s 2017 Wrap-Up</a>
&gt; The obvious place to start is my 2016 wrap-up post](<a href="https://blather.michaelwlucas.com/archives/2822" rel="nofollow">https://blather.michaelwlucas.com/archives/2822</a>), where I listed goals for 2017. As usual, these goals were wildly delusional.
&gt; The short answer is, my iron was back up to normal. My writing speed wasn’t, though. I’d lost too much general health, and needed hard exercise to recover it. Yes, writing requires physical endurance. Maintaining that level of concentration for several hours a day demands a certain level of blood flow to the brain. I could have faked it in a day job, but when self-employed as an artist? Not so much.
&gt; Then there’s travel. I did my usual BSDCan trip, plus two educational trips to Lincoln City, Oregon. The current political mayhem convinced me that if I wanted to hit EuroBSDCon any time in the next few years, I should do it in the very near future. So I went to Paris, where I promptly got pickpocketed. (Thankfully, they didn’t get my passport.) I was actively writing the third edition of Absolute FreeBSD, so I visited BSDCam in Cambridge to get the latest information and a sense of where FreeBSD was going. I also did weekends at Kansas LinuxFest (because they asked and paid for my trip) and Penguicon.
&gt; (Because people will ask: why EuroBSDCon and not AsiaBSDCon? A six-hour transatlantic flight requires that I take a substantial dose of heavy-grade tranquilizers. I’m incapable of making intelligent decisions while on those drugs, or for several hours afterward. They don’t last long enough for twelve-hour flight to Japan, so I need to be accompanied by someone qualified to tell me when I need to take the next dose partway through the flight. This isn’t a predetermined time that I can set an alarm for; it depends on how the clonazepam affects me at those altitudes. A drug overdose while flying over the North Pole would be bad. When I can arrange that qualified companion, I’ll make the trip.)
&gt; I need most of the preceding week to prepare for long trips. I need the following week to recover from time shifts and general exhaustion. Additionally, I have to hoard people juice for a few weeks beforehand so I can deal with folks during these expeditions. Travel disrupts my dojo time as well, which impacts my health.
&gt; Taken as a whole: I didn’t get nearly as much done as I hoped.</li>
<li>I wrote more stories, but Kris Rusch bludgeoned me into submitting them to trad markets. (The woman is a brute, I tell you. Cross her at your peril.)</li>
<li>Among my 2017 titles, my fiction outsold the tech books. No, not Prohibition Orcs–all four of the people who buy those love them, but the sales tell me I’ve done something wrong with those tales.</li>
<li>My cozy mystery git commit murder outsold Relayd and Httpd Mastery.</li>
<li>But what outdid them both, as well as most of my older books? What title utterly dominated my sales for the last quarter of the year? It was of course, my open source software political satire disguised as porn <a href="https://www.michaelwarrenlucas.com/index.php/romance#sbs" rel="nofollow">Savaged by Systemd: an Erotic Unix Encounter.</a>
&gt; I can’t believe I just wrote that paragraph.</li>
<li>The good news is, once I recovered from EuroBSDCon, my writing got better.</li>
<li>I finished Absolute FreeBSD, 3rd edition and submitted it to the publisher.</li>
<li>I wrote the second edition of SSH Mastery (no link, because you can’t order it yet.)</li>
<li>I’m plowing through git sync murder, the sequel to git commit murder. I don’t get to see the new Star Wars movie until I finish GSM, so hopefully that’ll be this month.</li>
<li>All in all, I wrote 480,200 words in 2017. Most of that was after September. It’s annoyingly close to breaking half a million, but after 2016’s scandalous 195,700, I’ll take it.
***
###<a href="https://blog.2ndquadrant.com/pg-phriday-postgres-zfs/" rel="nofollow">PG Phriday: Postgres on ZFS</a>
&gt; ZFS is a filesystem originally created by Sun Microsystems, and has been available for BSD over a decade. While Postgres will run just fine on BSD, most Postgres installations are historically Linux-based systems. ZFS on Linux has had much more of a rocky road to integration due to perceived license incompatibilities.
&gt; As a consequence, administrators were reluctant or outright refused to run ZFS on their Linux clusters. It wasn’t until OpenZFS was introduced in 2013 that this slowly began to change. These days, ZFS and Linux are starting to become more integrated, and Canonical of Ubuntu fame even announced direct support for ZFS in their 16.04 LTS release.
&gt; So how can a relatively obscure filesystem designed by a now-defunct hardware and software company help Postgres? Let’s find out!</li>
<li>Eddie waited til he finished high school
&gt; Old server hardware is dirt cheap these days, and make for a perfect lab for testing suspicious configurations. This is the server we’ll be using for these tests for those following along at home, or want some point of reference:
<code>
Dell R710
x2 Intel X5660 CPUs, for up to 24 threads
64GB RAM
x4 1TB 7200RPM SATA HDDs
H200 RAID card configured for Host Bus Adapter (HBA) mode
250GB Samsung 850 EVO SSD
</code>
&gt; The H200 is particularly important, as ZFS acts as its own RAID system. It also has its own checksumming and other algorithms that don’t like RAID cards getting in the way. As such, we put the card itself in a mode that facilitates this use case.
&gt; Due to that, we lose out on any battery-backed write cache the RAID card might offer. To make up for it, it’s fairly common to use an SSD or other persistent fast storage to act both as a write cache, and a read cache. This also transforms our HDDs into hybrid storage automatically, which is a huge performance boost on a budget.</li>
<li>She had a guitar and she taught him some chords
&gt; First things first: we need a filesystem. This hardware has four 1TB HDDs, and a 250GB SSD. To keep this article from being too long, we’ve already placed GPT partition tables on all the HDDs, and split the SSD into 50GB for the OS, 32GB for the write cache, and 150GB for the read cache. A more robust setup would probably use separate SSDs or a mirrored pair for these, but labs are fair game.</li>
<li>They moved into a place they both could afford
&gt; Let’s start by getting a performance baseline for the hardware. We might expect peak performance at 12 or 24 threads because the server has 12 real CPUs and 24 threads, but query throughput actually topped out at concurrent 32 processes. We can scratch our heads over this later, for now, we can consider it the maximum capabilities of this hardware.
Here’s a small sample:
```
$&gt; pgbench -S -j 32 -c 32 -M prepared -T 20 pgbench</li>
</ul>

<p>...<br>
tps = 264661.135288 (including connections establishing)<br>
tps = 264849.345595 (excluding connections establishing)</p>

<pre><code>&gt; So far, this is pretty standard behavior. 260k prepared queries per second is great read performance, but this is supposed to be a filesystem demonstration. Let’s get ZFS involved.
+ The papers said Ed always played from the heart
&gt; Let’s repeat that same test with writes enabled. Once that happens, filesystem syncs, dirty pages, WAL overhead, and other things should drastically reduce overall throughput. That’s an expected result, but how much are we looking at, here?
</code></pre>

<p>$&gt; pgbench -j 32 -c 32 -M prepared -T 10 pgbench</p>

<p>...<br>
tps = 6153.877658 (including connections establishing)<br>
tps = 6162.392166 (excluding connections establishing)</p>

<pre><code>&gt; SSD cache or not, storage overhead is a painful reality. Still, 6000 TPS with writes enabled is a great result for this hardware. Or is it? Can we actually do better?
&gt; Consider the Postgres full_page_writes parameter. Tomas Vondra has written about it in the past as a necessity to prevent WAL corruption due to partial writes. The WAL is both streaming replication and crash recovery, so its integrity is of utmost importance. As a result, this is one parameter almost everyone should leave alone.
&gt; ZFS is Copy on Write (CoW). As a result, it’s not possible to have a torn page because a page can’t be partially written without reverting to the previous copy. This means we can actually turn off full_page_writes in the Postgres config. The results are some fairly startling performance gains:
</code></pre>

<p>$&gt; pgbench -j 32 -c 32 -M prepared -T 10 pgbench</p>

<pre><code></code></pre>

<p>tps = 10325.200812 (including connections establishing)<br>
tps = 10336.807218 (excluding connections establishing)</p>

<pre><code>&gt; That’s nearly a 70% improvement. Due to write amplification caused by full page writes, Postgres produced 1.2GB of WAL files during a 1-minute pgbench test, but only 160MB with full page writes disabled.
&gt; To be fair, a 32-thread pgbench write test is extremely abusive and certainly not a typical usage scenario. However, ZFS just ensured our storage a much lower write load by altering one single parameter. That means the capabilities of the hardware have also been extended to higher write workloads as IO bandwidth is not being consumed by WAL traffic.
+ They both met movie stars, partied and mingled
&gt; Astute readers may have noticed we didn’t change the default ZFS block size from 128k to align with the Postgres default of 8kb. 
&gt; As it turns out, the 128kb blocks allow ZFS to better combine some of those 8kb Postgres pages to save space. That will allow our measly 2TB to go a lot further than is otherwise possible.
&gt; Please note that this is not de-duplication, but simple lz4 compression, which is nearly real-time in terms of CPU overhead. De-duplication on ZFS is currently an uncertain bizzaro universe populated with misshapen horrors crawling along a broken landscape. It’s a world of extreme memory overhead for de-duplication tables, and potential lost data due to inherent conflicts with the CoW underpinnings. Please don’t use it, let anyone else use it, or even think about using it, ever.
+ They made a record and it went in the chart
&gt; We’re still not done. One important aspect of ZFS as a CoW filesystem, is that it has integrated snapshots.
&gt; Consider the scenario where a dev is connected to the wrong system and drops what they think is a table in a QA environment. It turns out they were in the wrong terminal and just erased a critical production table, and now everyone is frantic.
+ The future was wide open
&gt; It’s difficult to discount an immediately observable reduction in write overhead. Snapshots have a multitude of accepted and potential use cases, as well. In addition to online low-overhead compression, and the hybrid cache layer, ZFS boasts a plethora of features we didn’t explore.
&gt; Built-in checksums with integrated self-healing suggest it isn’t entirely necessary to re-initialize an existing Postgres instance to enable checksums. The filesystem itself ensures checksums are validated and correct, especially if we have more than one drive resource in our pool. It even goes the extra mile and actively corrects inconsistencies when encountered.
&gt; I immediately discounted ZFS back in 2012 because the company I worked for at the time was a pure Linux shop. ZFS was only available using the FUSE driver back then, meaning ZFS only worked through userspace with no real kernel integration. It was fun to tinker with, but nobody sane would use that on a production server of any description.
&gt; Things have changed quite drastically since then. I’ve stopped waiting for btrfs to become viable, and ZFS has probably taken the throne away from XFS as my filesystem of choice. Future editions of the Postgres High Availability Cookbook will reflect this as well.
&gt; Postgres MVCC and ZFS CoW seem made for each other. I’m curious to see what will transpire over the next few years now that ZFS has reached mainstream acceptance in at least one major Linux distribution.
***
###[NomadBSD](https://github.com/mrclksr/NomadBSD)
+  About
&gt; NomadBSD is a live system for flash drives, based on FreeBSD.
+ Screenshots
![](http://freeshell.de/~mk/download/nomadbsd-ss1.png)
![](http://freeshell.de/~mk/download/nomadbsd-ss2.png)
+  Requirements for building the image
A recent FreeBSD system
+  Requirements for running NomadBSD
* A 4GB (or more) flash drive
* A System capable running FreeBSD 11.1 (amd64)
+  Building the image
~~ csh
# make image
~~
+  Writing the image to an USB memory stick
~~ csh
# dd if=nomadbsd.img of=/dev/da0 bs=10240 conv=sync
~~
+  Resize filesystem to use the entire USB memory
 + Boot NomadBSD into single user mode, and execute:
~~
# gpart delete -i 2 da0s1
# gpart resize -i 1 da0
# gpart commit da0s1
~~
 + Determine the partition size in megabytes using 
 ````fdisk da0````
 + and calculate the remaining size of da0s1a:
````&lt;REMAIN&gt; = &lt;SIZE OF PARTITION IN MB&gt; - &lt;DESIRED SWAP SIZE IN MB&gt;````.
~~
# gpart resize -i 1 -s &lt;REMAIN&gt;M da0s1
# gpart add -t freebsd-swap -i 2 da0s1
# glabel label NomadBSDsw da0s1b
# service growfs onestart
# reboot
~~
+ [FreeBSD forum thread](https://forums.freebsd.org/threads/63888/)
+ [A short screen capture video of the NomadBSD system running in VirtualBox](https://freeshell.de/~mk/download/nomad_capture.mp4)
***
##Beastie Bits
+ [Coolpkg, a package manager inspired by Nix for OpenBSD](https://github.com/andrewchambers/coolpkg)
+ [zrepl - ZFS replication](https://zrepl.github.io/)
+ [OpenBSD hotplugd automount script](https://bijanebrahimi.github.io/blog/openbsd-hotplugd-scripting.html)
+ [Ancient troff sources vs. modern-day groff](https://virtuallyfun.com/2017/12/22/learn-ancient-troff-sources-vs-modern-day-groff/)
+ [Paypal donation balance and status.. thanks everyone!](http://lists.dragonflybsd.org/pipermail/users/2017-December/313752.html)
+ [Supervised FreeBSD rc.d script for a Go daemon (updated in last few days)](https://redbyte.eu/en/blog/supervised-freebsd-init-script-for-go-deamon/)
+ [A Brief History of sed](https://blog.sourcerer.io/a-brief-history-of-sed-6eaf00302ed)
+ [Flamegraph: Why does my AWS instance boot so slow?](http://www.daemonology.net/timestamping/tslog-c5.4xlarge.svg)
***
##Feedback/Questions
+ Jeremy - [Replacing Drive in a Zpool](http://dpaste.com/319593M#wrap)
+ [Dan’s Blog ](https://dan.langille.org/2017/08/16/swapping-5tb-in-3tb-out/)
+ Tim - [Keeping GELI key through reboot](http://dpaste.com/11QTA06)
+ Brian - [Mixing 2.5 and 3.5 drives](http://dpaste.com/2JQVD10#wrap)
+ Troels - [zfs swap on FreeBSD](http://dpaste.com/147WAFR#wrap)
***
</code></pre>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We review the information about Spectre &amp; Meltdown thus far, we look at NetBSD memory sanitizer progress, Postgres on ZFS &amp; show you a bit about NomadBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>Meltdown Spectre</h3>

<ul>
<li><a href="https://meltdownattack.com/" rel="nofollow">Official Site</a></li>
<li><a href="https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/" rel="nofollow">Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign</a></li>
<li><a href="https://newsroom.intel.com/news/intel-responds-to-security-research-findings/" rel="nofollow">Intel’s official response</a></li>
<li><a href="https://www.theregister.co.uk/2018/01/04/intel_meltdown_spectre_bugs_the_registers_annotations/" rel="nofollow">The Register mocks intels response with pithy annotations</a></li>
<li><a href="https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf" rel="nofollow">Intel’s Analysis PDF</a></li>
<li><a href="https://xkcd.com/1938/" rel="nofollow">XKCD</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-security/2018-January/009719.html" rel="nofollow">Response from FreeBSD</a></li>
<li><a href="https://reviews.freebsd.org/D13797" rel="nofollow">FreeBSD&#39;s patch WIP</a></li>
<li><a href="https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/" rel="nofollow">Why Raspberry Pi isn’t vulnerable to Spectre or Meltdown</a></li>
<li><a href="https://lists.xenproject.org/archives/html/xen-devel/2018-01/msg00110.html" rel="nofollow">Xen mitigation patches</a></li>
<li><a href="https://wiki.freebsd.org/SpeculativeExecutionVulnerabilities" rel="nofollow">Overview of affected FreeBSD Platforms/Architectures</a></li>
<li><a href="https://twitter.com/GroffTheBSDGoat/status/949372300368867328" rel="nofollow">Groff&#39;s response</a>
##### We’ll cover OpenBSD, NetBSD, and DragonflyBSD’s responses in next weeks episode.
***
###<a href="https://blog.netbsd.org/tnf/entry/the_llvm_memory_sanitizer_support" rel="nofollow">The LLVM Memory Sanitizer support work in progress</a>
&gt; In the past 31 days, I&#39;ve managed to get the core functionality of MSan to work. This is an uninitialized memory usage detector. MSan is a special sanitizer because it requires knowledge of every entry to the basesystem library and every entry to the kernel through public interfaces. This is mandatory in order to mark memory regions as initialized.  Most of the work has been done directly for MSan. However, part of the work helped generic features in compiler-rt.</li>
<li>Sanitizers
&gt; Changes in the sanitizer are listed below in chronological order. Almost all of the changes mentioned here landed upstream. A few small patches were reverted due to breaking non-NetBSD hosts and are rescheduled for further investigation. I maintain these patches locally and have moved on for now to work on the remaining features.</li>
<li>NetBSD syscall hooks
&gt; I wrote a large patch (815kb!) adding support for NetBSD syscall hooks for use with sanitizers. </li>
<li>NetBSD ioctl(2) hooks
&gt; Similar to the syscall hooks, there is need to handle every ioctl(2) call. I&#39;ve created the needed patch, this time shorter - for less than 300kb.</li>
<li>New patches still pending for upstream review
&gt; There are two corrections that I&#39;ve created, and they are still pending upstream for review:</li>
<li>Add MSan interceptor for fstat(2)](<a href="https://reviews.llvm.org/D41637" rel="nofollow">https://reviews.llvm.org/D41637</a>)</li>
<li> Correct the setitimer interceptor on NetBSD)](<a href="https://reviews.llvm.org/D41502" rel="nofollow">https://reviews.llvm.org/D41502</a>)
&gt; I&#39;ve got a few more local patches that require cleanup before submitting to review.</li>
<li>NetBSD basesystem corrections</li>
<li>Sanitizers in Go</li>
<li>The MSan state as of today</li>
<li>Solaris support in sanitizers
&gt; I&#39;ve helped the Solaris team add basic support for Sanitizers (ASan, UBsan). This does not help NetBSD directly, however indirectly it improves the overall support for non-Linux hosts and helps to catch more Linuxisms in the code.</li>
<li>Plan for the next milestone
&gt; I plan to continue the work on MSan and correct sanitizing of the NetBSD basesystem utilities. This mandates me to iterate over the basesystem libraries implementing the missing interceptors and correcting the current support of the existing ones. My milestone is to build all src/<em>bin</em> programs against Memory Sanitizer and when possible execute them cleanly.</li>
<li>This work was sponsored by The NetBSD Foundation.</li>
<li>The NetBSD Foundation is a non-profit organization and welcomes any donations to help us continue funding projects and services to the open-source community. Please consider visiting the following URL, and chip in what you can: <a href="http://netbsd.org/donations/#how-to-donate" rel="nofollow">http://netbsd.org/donations/#how-to-donate</a>
***
##News Roundup
###<a href="https://blather.michaelwlucas.com/archives/3078" rel="nofollow">MWL’s 2017 Wrap-Up</a>
&gt; The obvious place to start is my 2016 wrap-up post](<a href="https://blather.michaelwlucas.com/archives/2822" rel="nofollow">https://blather.michaelwlucas.com/archives/2822</a>), where I listed goals for 2017. As usual, these goals were wildly delusional.
&gt; The short answer is, my iron was back up to normal. My writing speed wasn’t, though. I’d lost too much general health, and needed hard exercise to recover it. Yes, writing requires physical endurance. Maintaining that level of concentration for several hours a day demands a certain level of blood flow to the brain. I could have faked it in a day job, but when self-employed as an artist? Not so much.
&gt; Then there’s travel. I did my usual BSDCan trip, plus two educational trips to Lincoln City, Oregon. The current political mayhem convinced me that if I wanted to hit EuroBSDCon any time in the next few years, I should do it in the very near future. So I went to Paris, where I promptly got pickpocketed. (Thankfully, they didn’t get my passport.) I was actively writing the third edition of Absolute FreeBSD, so I visited BSDCam in Cambridge to get the latest information and a sense of where FreeBSD was going. I also did weekends at Kansas LinuxFest (because they asked and paid for my trip) and Penguicon.
&gt; (Because people will ask: why EuroBSDCon and not AsiaBSDCon? A six-hour transatlantic flight requires that I take a substantial dose of heavy-grade tranquilizers. I’m incapable of making intelligent decisions while on those drugs, or for several hours afterward. They don’t last long enough for twelve-hour flight to Japan, so I need to be accompanied by someone qualified to tell me when I need to take the next dose partway through the flight. This isn’t a predetermined time that I can set an alarm for; it depends on how the clonazepam affects me at those altitudes. A drug overdose while flying over the North Pole would be bad. When I can arrange that qualified companion, I’ll make the trip.)
&gt; I need most of the preceding week to prepare for long trips. I need the following week to recover from time shifts and general exhaustion. Additionally, I have to hoard people juice for a few weeks beforehand so I can deal with folks during these expeditions. Travel disrupts my dojo time as well, which impacts my health.
&gt; Taken as a whole: I didn’t get nearly as much done as I hoped.</li>
<li>I wrote more stories, but Kris Rusch bludgeoned me into submitting them to trad markets. (The woman is a brute, I tell you. Cross her at your peril.)</li>
<li>Among my 2017 titles, my fiction outsold the tech books. No, not Prohibition Orcs–all four of the people who buy those love them, but the sales tell me I’ve done something wrong with those tales.</li>
<li>My cozy mystery git commit murder outsold Relayd and Httpd Mastery.</li>
<li>But what outdid them both, as well as most of my older books? What title utterly dominated my sales for the last quarter of the year? It was of course, my open source software political satire disguised as porn <a href="https://www.michaelwarrenlucas.com/index.php/romance#sbs" rel="nofollow">Savaged by Systemd: an Erotic Unix Encounter.</a>
&gt; I can’t believe I just wrote that paragraph.</li>
<li>The good news is, once I recovered from EuroBSDCon, my writing got better.</li>
<li>I finished Absolute FreeBSD, 3rd edition and submitted it to the publisher.</li>
<li>I wrote the second edition of SSH Mastery (no link, because you can’t order it yet.)</li>
<li>I’m plowing through git sync murder, the sequel to git commit murder. I don’t get to see the new Star Wars movie until I finish GSM, so hopefully that’ll be this month.</li>
<li>All in all, I wrote 480,200 words in 2017. Most of that was after September. It’s annoyingly close to breaking half a million, but after 2016’s scandalous 195,700, I’ll take it.
***
###<a href="https://blog.2ndquadrant.com/pg-phriday-postgres-zfs/" rel="nofollow">PG Phriday: Postgres on ZFS</a>
&gt; ZFS is a filesystem originally created by Sun Microsystems, and has been available for BSD over a decade. While Postgres will run just fine on BSD, most Postgres installations are historically Linux-based systems. ZFS on Linux has had much more of a rocky road to integration due to perceived license incompatibilities.
&gt; As a consequence, administrators were reluctant or outright refused to run ZFS on their Linux clusters. It wasn’t until OpenZFS was introduced in 2013 that this slowly began to change. These days, ZFS and Linux are starting to become more integrated, and Canonical of Ubuntu fame even announced direct support for ZFS in their 16.04 LTS release.
&gt; So how can a relatively obscure filesystem designed by a now-defunct hardware and software company help Postgres? Let’s find out!</li>
<li>Eddie waited til he finished high school
&gt; Old server hardware is dirt cheap these days, and make for a perfect lab for testing suspicious configurations. This is the server we’ll be using for these tests for those following along at home, or want some point of reference:
<code>
Dell R710
x2 Intel X5660 CPUs, for up to 24 threads
64GB RAM
x4 1TB 7200RPM SATA HDDs
H200 RAID card configured for Host Bus Adapter (HBA) mode
250GB Samsung 850 EVO SSD
</code>
&gt; The H200 is particularly important, as ZFS acts as its own RAID system. It also has its own checksumming and other algorithms that don’t like RAID cards getting in the way. As such, we put the card itself in a mode that facilitates this use case.
&gt; Due to that, we lose out on any battery-backed write cache the RAID card might offer. To make up for it, it’s fairly common to use an SSD or other persistent fast storage to act both as a write cache, and a read cache. This also transforms our HDDs into hybrid storage automatically, which is a huge performance boost on a budget.</li>
<li>She had a guitar and she taught him some chords
&gt; First things first: we need a filesystem. This hardware has four 1TB HDDs, and a 250GB SSD. To keep this article from being too long, we’ve already placed GPT partition tables on all the HDDs, and split the SSD into 50GB for the OS, 32GB for the write cache, and 150GB for the read cache. A more robust setup would probably use separate SSDs or a mirrored pair for these, but labs are fair game.</li>
<li>They moved into a place they both could afford
&gt; Let’s start by getting a performance baseline for the hardware. We might expect peak performance at 12 or 24 threads because the server has 12 real CPUs and 24 threads, but query throughput actually topped out at concurrent 32 processes. We can scratch our heads over this later, for now, we can consider it the maximum capabilities of this hardware.
Here’s a small sample:
```
$&gt; pgbench -S -j 32 -c 32 -M prepared -T 20 pgbench</li>
</ul>

<p>...<br>
tps = 264661.135288 (including connections establishing)<br>
tps = 264849.345595 (excluding connections establishing)</p>

<pre><code>&gt; So far, this is pretty standard behavior. 260k prepared queries per second is great read performance, but this is supposed to be a filesystem demonstration. Let’s get ZFS involved.
+ The papers said Ed always played from the heart
&gt; Let’s repeat that same test with writes enabled. Once that happens, filesystem syncs, dirty pages, WAL overhead, and other things should drastically reduce overall throughput. That’s an expected result, but how much are we looking at, here?
</code></pre>

<p>$&gt; pgbench -j 32 -c 32 -M prepared -T 10 pgbench</p>

<p>...<br>
tps = 6153.877658 (including connections establishing)<br>
tps = 6162.392166 (excluding connections establishing)</p>

<pre><code>&gt; SSD cache or not, storage overhead is a painful reality. Still, 6000 TPS with writes enabled is a great result for this hardware. Or is it? Can we actually do better?
&gt; Consider the Postgres full_page_writes parameter. Tomas Vondra has written about it in the past as a necessity to prevent WAL corruption due to partial writes. The WAL is both streaming replication and crash recovery, so its integrity is of utmost importance. As a result, this is one parameter almost everyone should leave alone.
&gt; ZFS is Copy on Write (CoW). As a result, it’s not possible to have a torn page because a page can’t be partially written without reverting to the previous copy. This means we can actually turn off full_page_writes in the Postgres config. The results are some fairly startling performance gains:
</code></pre>

<p>$&gt; pgbench -j 32 -c 32 -M prepared -T 10 pgbench</p>

<pre><code></code></pre>

<p>tps = 10325.200812 (including connections establishing)<br>
tps = 10336.807218 (excluding connections establishing)</p>

<pre><code>&gt; That’s nearly a 70% improvement. Due to write amplification caused by full page writes, Postgres produced 1.2GB of WAL files during a 1-minute pgbench test, but only 160MB with full page writes disabled.
&gt; To be fair, a 32-thread pgbench write test is extremely abusive and certainly not a typical usage scenario. However, ZFS just ensured our storage a much lower write load by altering one single parameter. That means the capabilities of the hardware have also been extended to higher write workloads as IO bandwidth is not being consumed by WAL traffic.
+ They both met movie stars, partied and mingled
&gt; Astute readers may have noticed we didn’t change the default ZFS block size from 128k to align with the Postgres default of 8kb. 
&gt; As it turns out, the 128kb blocks allow ZFS to better combine some of those 8kb Postgres pages to save space. That will allow our measly 2TB to go a lot further than is otherwise possible.
&gt; Please note that this is not de-duplication, but simple lz4 compression, which is nearly real-time in terms of CPU overhead. De-duplication on ZFS is currently an uncertain bizzaro universe populated with misshapen horrors crawling along a broken landscape. It’s a world of extreme memory overhead for de-duplication tables, and potential lost data due to inherent conflicts with the CoW underpinnings. Please don’t use it, let anyone else use it, or even think about using it, ever.
+ They made a record and it went in the chart
&gt; We’re still not done. One important aspect of ZFS as a CoW filesystem, is that it has integrated snapshots.
&gt; Consider the scenario where a dev is connected to the wrong system and drops what they think is a table in a QA environment. It turns out they were in the wrong terminal and just erased a critical production table, and now everyone is frantic.
+ The future was wide open
&gt; It’s difficult to discount an immediately observable reduction in write overhead. Snapshots have a multitude of accepted and potential use cases, as well. In addition to online low-overhead compression, and the hybrid cache layer, ZFS boasts a plethora of features we didn’t explore.
&gt; Built-in checksums with integrated self-healing suggest it isn’t entirely necessary to re-initialize an existing Postgres instance to enable checksums. The filesystem itself ensures checksums are validated and correct, especially if we have more than one drive resource in our pool. It even goes the extra mile and actively corrects inconsistencies when encountered.
&gt; I immediately discounted ZFS back in 2012 because the company I worked for at the time was a pure Linux shop. ZFS was only available using the FUSE driver back then, meaning ZFS only worked through userspace with no real kernel integration. It was fun to tinker with, but nobody sane would use that on a production server of any description.
&gt; Things have changed quite drastically since then. I’ve stopped waiting for btrfs to become viable, and ZFS has probably taken the throne away from XFS as my filesystem of choice. Future editions of the Postgres High Availability Cookbook will reflect this as well.
&gt; Postgres MVCC and ZFS CoW seem made for each other. I’m curious to see what will transpire over the next few years now that ZFS has reached mainstream acceptance in at least one major Linux distribution.
***
###[NomadBSD](https://github.com/mrclksr/NomadBSD)
+  About
&gt; NomadBSD is a live system for flash drives, based on FreeBSD.
+ Screenshots
![](http://freeshell.de/~mk/download/nomadbsd-ss1.png)
![](http://freeshell.de/~mk/download/nomadbsd-ss2.png)
+  Requirements for building the image
A recent FreeBSD system
+  Requirements for running NomadBSD
* A 4GB (or more) flash drive
* A System capable running FreeBSD 11.1 (amd64)
+  Building the image
~~ csh
# make image
~~
+  Writing the image to an USB memory stick
~~ csh
# dd if=nomadbsd.img of=/dev/da0 bs=10240 conv=sync
~~
+  Resize filesystem to use the entire USB memory
 + Boot NomadBSD into single user mode, and execute:
~~
# gpart delete -i 2 da0s1
# gpart resize -i 1 da0
# gpart commit da0s1
~~
 + Determine the partition size in megabytes using 
 ````fdisk da0````
 + and calculate the remaining size of da0s1a:
````&lt;REMAIN&gt; = &lt;SIZE OF PARTITION IN MB&gt; - &lt;DESIRED SWAP SIZE IN MB&gt;````.
~~
# gpart resize -i 1 -s &lt;REMAIN&gt;M da0s1
# gpart add -t freebsd-swap -i 2 da0s1
# glabel label NomadBSDsw da0s1b
# service growfs onestart
# reboot
~~
+ [FreeBSD forum thread](https://forums.freebsd.org/threads/63888/)
+ [A short screen capture video of the NomadBSD system running in VirtualBox](https://freeshell.de/~mk/download/nomad_capture.mp4)
***
##Beastie Bits
+ [Coolpkg, a package manager inspired by Nix for OpenBSD](https://github.com/andrewchambers/coolpkg)
+ [zrepl - ZFS replication](https://zrepl.github.io/)
+ [OpenBSD hotplugd automount script](https://bijanebrahimi.github.io/blog/openbsd-hotplugd-scripting.html)
+ [Ancient troff sources vs. modern-day groff](https://virtuallyfun.com/2017/12/22/learn-ancient-troff-sources-vs-modern-day-groff/)
+ [Paypal donation balance and status.. thanks everyone!](http://lists.dragonflybsd.org/pipermail/users/2017-December/313752.html)
+ [Supervised FreeBSD rc.d script for a Go daemon (updated in last few days)](https://redbyte.eu/en/blog/supervised-freebsd-init-script-for-go-deamon/)
+ [A Brief History of sed](https://blog.sourcerer.io/a-brief-history-of-sed-6eaf00302ed)
+ [Flamegraph: Why does my AWS instance boot so slow?](http://www.daemonology.net/timestamping/tslog-c5.4xlarge.svg)
***
##Feedback/Questions
+ Jeremy - [Replacing Drive in a Zpool](http://dpaste.com/319593M#wrap)
+ [Dan’s Blog ](https://dan.langille.org/2017/08/16/swapping-5tb-in-3tb-out/)
+ Tim - [Keeping GELI key through reboot](http://dpaste.com/11QTA06)
+ Brian - [Mixing 2.5 and 3.5 drives](http://dpaste.com/2JQVD10#wrap)
+ Troels - [zfs swap on FreeBSD](http://dpaste.com/147WAFR#wrap)
***
</code></pre>]]>
  </itunes:summary>
</item>
<item>
  <title>227: The long core dump</title>
  <link>https://www.bsdnow.tv/227</link>
  <guid isPermaLink="false">a7f9f9fa-3d35-4f58-8709-12f6a433b446</guid>
  <pubDate>Wed, 03 Jan 2018 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a7f9f9fa-3d35-4f58-8709-12f6a433b446.mp3" length="66175060" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We walk through dumping a PS4 kernel in only 6 days, tell you the news that NetBSD 7.1.1 has been released, details on how to run FreeBSD on a Thinkpad T470, and there’s progress in OpenBSD’s pledge.</itunes:subtitle>
  <itunes:duration>1:31:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We walk through dumping a PS4 kernel in only 6 days, tell you the news that NetBSD 7.1.1 has been released, details on how to run FreeBSD on a Thinkpad T470, and there’s progress in OpenBSD’s pledge.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
NetBSD 7.1.1 released (http://www.netbsd.org/releases/formal-7/NetBSD-7.1.1.html)
The NetBSD Project is pleased to announce NetBSD 7.1.1, the first security/critical update of the NetBSD 7.1 release branch. It represents a selected subset of fixes deemed important for security or stability reasons.
Complete source and binaries for NetBSD 7.1.1 are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, and other services may be found at https://www.NetBSD.org/mirrors/. We encourage users who wish to install via ISO or USB disk images to download via BitTorrent by using the torrent files supplied in the images area. A list of hashes for the NetBSD 7.1.1 distribution has been signed with the well-connected PGP key for the NetBSD Security Officer: https://ftp.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.1.1_hashes.asc
NetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone. Free support services are available via our mailing lists and website. Commercial support is available from a variety of sources. More extensive information on NetBSD is available from our website:
NetBSD website (www.NetBSD.org)
+Changes Between 7.1 and 7.1.1 Below is an abbreviated list of changes in this release. The complete list can be found in the CHANGES-7.1.1 file in the top level directory of the NetBSD 7.1.1 release tree.
Security Advisory Fixes The following security advisories were fixed:
NetBSD-SA2017-004 buffer overflow via cmap for 4 graphics drivers.
NetBSD-SA2017-005 x86: vulnerabilities in context handling.
NetBSD-SA2017-006 Vnode reference leak in the openat system call.
NetBSD-SA2018-001 Several vulnerabilities in context handling
NetBSD-SA2018-002 Local DoS in virecover
Note: Advisories prior to NetBSD-SA2017-004 do not affect NetBSD 7.1.1.
Userland changes
dhcrelay(8): Fix bug that prevented proper operation when run in the background.
Heimdal: Update to 7.1. Fix CVE-2017-11103.
mtree(8): Don't modify strings stored in hash, otherwise filling up of directory hierarchy stops if the same hash value occurs in directory and leaf.
ping(8): Fix cksum calculation for clearing the cached route.
resize_ffs(8): Fix numerous overflow errors which can lead to superblock corruption on large filesystems.
rtadvd(8): Fix the default value of rltime. PR bin/51994.
Update BIND to 9.10.5-P2.
Update expat to 2.2.1.
Update ntp to 4.2.8p10.
Update root.cache to 2017102400.
Update tzdata to 2017c.
vi(1): Don't garble display when when resizing nvi in xterm.
wpa_supplicant/hostapd: Update to 2.6.
Apply fixes for CVEs 2017-13077 through 2017-13082 and CVEs 2017-13086 through 2017-13088.
X: Apply fixes for CVEs 2017-12176 through 2017-12187, 2017-10971, 2017-10972, 2017-13722, 2017-13720, 2017-16611, and 2017-16612.
***
###Dumping a PS4 Kernel in "Only" 6 Days (https://fail0verflow.com/blog/2017/ps4-crashdump-dump/)
&amp;gt; What if a secure device had an attacker-viewable crashdump format? What if that same device allowed putting arbitrary memory into the crashdump? Amazingly, the ps4 tempted fate by supporting both of these features! Let’s see how that turned out…
Crashdumps on PS4
The crash handling infrastructure of the ps4 kernel is interesting for 2 main reasons:
It is ps4-specific code (likely to be buggy)
If the crashdump can be decoded, we will gain very useful info for finding bugs and creating reliable exploits
On a normal FreeBSD system, a kernel panic will create a dump by calling kernreboot with the RBDUMP flag. This then leads to doadump being called, which will dump a rather tiny amount of information about the kernel image itself to some storage device.
On ps4, the replacement for doadump is mdbgrundump, which can be called from panic or directly from trapfatal. The amount of information stored into the dump is gigantic by comparison - kernel state for all process, thread, and vm objects are included, along with some metadata about loaded libraries. Other obvious changes from the vanilla FreeBSD method are that the mdbgrun_dump encodes data recorded into the dump on a field-by-field basis and additionally encrypts the resulting buffer before finally storing it to disk.
Dumping Anything
Let’s zoom in to a special part of mdbgrundump - where it iterates over all process’ threads and tries to dump some pthread state:
dumpstate is a temporary buffer which will eventually make it into the crashdump. To summarize, sysdump_internalcallreaduser can be made to function as a read-anywhere oracle. This is because fsbase will point into our (owned) webkit process’ usermode address space. Thus, even without changing the actual fsbase value, we may freely change the value of tcbthread, which is stored at fsbase + 0x10.
Further, sysdump_internalcall_readuser will happily read from a kernel address and put the result into the dump.
We can now put any kernel location into the dump, but we still need to decrypt and decode it…
Aside from that, there’s also the issue that we may only add 0x10 bytes per thread in this manner…
Further reading:
Crashdump Crypto
Crashdump Decoding
Crashdump Automation
Triggering the Vulnerability
The Fix (Kind of…)
Fin
Appendix
Crashdump Decryptor
NXDP Decoder
***
###BSDTW 2017 Conference Recap: Li-Wen Hsu (https://www.freebsdfoundation.org/blog/bsdtw-2017-conference-recap-li-wen-hsu/)
BSDTW 2017 Conference Recap: Li-Wen Hsu
12/28/2017
&amp;gt; Last month, we held BSDTW 2017 on November 11-12th, 2017 in Taipei, Taiwan. It was the second largest BSD conference in Taiwan and the first one in this decade. In 2004, the first AsiaBSDCon was also held in Taipei. Then all of the following AsiaBSDCon conferences were held in Tokyo, Japan. (AsiaBSDCon 2018 will be in Tokyo again next year, please submit your talk proposal by December 31th 2017, and attend the conference on March 8th-11th)
&amp;gt; We wanted to start small with the first BSDTW because we were not sure how much sponsorship or how many volunteers we might have. BSDTW 2017 was a single track, two-day conference with 11 selected 50 minute presentations and 1 WIP/lightning talk session consisting of 8 short talks. I do regret that we did not have any local presenters this year. It is also a similar problem at AsiaBSDCon. Unsurprisingly, as with AsiaBSDcon, the travel reimbursement took up a large part of the whole conference budget. We do have many good people that work in Asia, but we still need to encourage people to present their work more.
&amp;gt; We had over 130 registered attendees, with 30% of them coming from outside of Taiwan. To our knowledge, in recent years, this is the only open source conference in Taiwan to be held entirely in English, and to have such a large portion of international attendees. This is also the first open source conference in Taiwan to focus entirely on operating systems. The attendees included students, professors, engineers or CTOs, and CEOs from technology companies. This is also the first time that GroffTheBSDGoat visited Taiwan! We were surprised that after the silence for so many years, there are still so many people that use and love BSD near us. We saw many old friends, who had “disappeared” for a long time, came back, and were glad to meet many new friends at the conference. I am really happy that this conference was able to bring together these people, from local and abroad. After attending BSD conferences around the world for many years, I feel that the friendship between BSD users is the most important thing in the BSD community, and one of the main reasons people stay. It has been my pleasure to bring this community back to my friends in my homeland.
&amp;gt; After the two-day event, I truly understand that bootstrapping a new conference is a very hard job. One with many aspects that you don’t even imagine until you’re really in the process of planning an event. I now have an even greater respect for all of the conference organizers and realize that we need to have more people help them, to keep these conferences continue to get better and better. Plus, there will always be room for a new conference!
&amp;gt; Thanks to the FreeBSD Foundation for being the biggest sponsor of BSDTW 2017 and always being the strongest backend of our community. We are excited about the many local companies and organizations that helped us whether with people, materials or financially. We even had 21 personal sponsors, more than two times the number of other big open source conferences in Taiwan.
&amp;gt; As I said in the closing session, I’m not sure if there will be 2nd BSDTW next year. It still depends on the amount of sponsorship and number of volunteers. However, we will definitely hold more smaller meetups in the next year to keep building up the local BSD community.
&amp;gt; Finally, in the beginning of this month, we had a “post-conference media workshop” for organizing the media files we collected in the BSDTW 2017. Here are the review article in Traditional Chinese and the photos: https://medium.com/@bsdtw/bsdtw-2017-總回顧-a402788daede (https://medium.com/@bsdtw/bsdtw-2017-總回顧-a402788daede) &amp;amp;&amp;amp;
https://www.flickr.com/photos/bsdtw/albums/72157689410035911 (https://www.flickr.com/photos/bsdtw/albums/72157689410035911)
***
##News Roundup
###Running FreeBSD on a Lenovo T470s (https://blog.grem.de/pages/t470s.html)
Running FreeBSD on the Lenovo T470s ThinkPad
&amp;gt; Installing FreeBSD on this machine was super easy. As I couldn't find a comprehensive/encouraging how-to about installing FreeBSD on a recent ThinkPad, I just wrote up the one below. It includes details about my personal setup, which are not required to run FreeBSD on this model, but which are more to my own taste. I still think this can be a quite useful inspiration for others who want to run their own customized configurations.
Specs
&amp;gt; The system I use has these specifications:
Type: 20JS-001EGE
CPU: Intel Core i7-6600U, 2x 2.60GHz
RAM: 20GB DDR4
SSD: 512GB NVMe
Graphics: Intel HD Graphics 520 (IGP), 1x HDMI 1.4
Display: 14", 1920x1080, non-glare, IPS
Ports: 3x USB-A 3.0, 1x Thunderbolt 3, 1x Gb LAN
Wireless: WLAN 802.11a/b/g/n/ac, Bluetooth 4.1, LTE (Micro-SIM)
Cardreader: SD/SDHC/SDXC/MMC
Webcam: 0.9 Megapixel
Extras: MIL-STD-810G, Pointing Stick, Fingerprint-Reader, Docking port
Things that work
&amp;gt; Basically everything I care about:
Accelerated video
Keyboard
Touchpad/ClickPad (like expected in a modern laptop)
SSD
WiFi
Sound
HDMI out
Suspend to RAM
Webcam
Things that don't work
Fingerprint reader
Potentially anything I didn't test
Battery life is okay, but could be better.
Installation of the base system
&amp;gt; I used a snapshot release of 12-CURRENT as the basis of my installation, particularly the one of 13th of December 2017.
&amp;gt; I dd'ed it onto a memory stick and boot the laptop. I started a standard installation and created an encrypted ZFS pool on nvme0, using encryption, swap encryption and partition scheme "GPT (UEFI)".
&amp;gt; After installation, it boots straight up.
Ports tree used
&amp;gt; All work is based on a head ports tree from about Dec 18, 22:15 CET, which should be more or less r456672.
Preferred ClickPad configuration
&amp;gt; As I'm not a fan of the the pointing stick, I disabled it in the bios. My final ClickPad configuration will be: Click to click (not tap), no middle button, right button in the lower right corner. As the old synaptics driver doesn't provide good thumb detection, libinput will be used.
Check out the laptop list on the FreeBSD wiki for compatibility: (https://wiki.freebsd.org/Laptops/)
***
###FreeBSD desktop LiveCD creator (https://github.com/pkgdemon/comet)
Introduction
&amp;gt; The purpose of this tool is quickly generate bloat free images containing stock FreeBSD, and supported desktop environments.
Features
FreeBSD 11.1-RELEASE
AMD64
Gnome &amp;amp; KDE desktop environments
Hybrid DVD/USB image
Screenshots
[Gnome LiveCD])https://github.com/pkgdemon/comet/raw/master/screenshots/gnome-livecd.png?raw=true)
KDE LiveCD (https://github.com/pkgdemon/comet/raw/master/screenshots/kde-livecd.png?raw=true)
System Requirements
FreeBSD 11.1, or higher for AMD64
20GB of free disk space
1GB of free memory
UFS, or ZFS
Initial Setup
Install the required packages:
pkg install git grub2-pcbsd grub2-efi xorriso
Clone the repo:
git clone https://www.github.com/pkgdemon/comet
Enter the directory for running the LiveCD creator:
cd comet/src
Credentials for live media
&amp;gt; User: liveuser
&amp;gt; Password: freebsd
***
###iXsystems
StorageCrypter Ransomware: Security Threat or Clickbait? (https://www.ixsystems.com/blog/storagecrypter/)
###pledge() work in progress (https://undeadly.org/cgi?action=article;sid=20171208082246)
&amp;gt; I wanted to give an update that a two pledge-related changes are being worked on. The semantics and integration are complicated so it is taking some time.
&amp;gt; One is execpromises. This will become the 2nd argument of pledge(). This allows one to set the pledge for the new image after pledge "exec"-allowed execve(). A warning though: utilizing this in software isn't as easy as you might think! The fork+exec + startup sequences needed to be studied quite carefully to ensure the newly-executed child doesn't ask for more than the parent's execpromises. In my experiments such a circumstance is exceedingly common, so the problem is eased by introducing a new pledge feature which allows pledge violations to return ENOSYS or such rather than killing the process.
&amp;gt; This feature also needs to be used with great caution (especially in privileged programs) because programs which fail to observe errors may continue operating forward very incorrectly; you've lost the ability to catch it failing, and provide care by fixing the problem.
&amp;gt; The other is pledgepaths. The semantics are still being tuned a bit. Before the first call to pledge() in a process, one can pledgepath() directories. Then later after pledge(), file access operations only work if the traversal of the path crosses one of those pre-declared directories (but better make sure you don't move a directory, because the kernel remembers and reasons about the vnode of the directory rather than the path). Something similar is being worked on for files, but we are still adjusting that, as well as a flag parameter for the pledgepath() call which may constrain the operations done on such files.
&amp;gt; As such, pledgepath() will become a filesystem containment mechanism unlike chroot() because paths will still be based upon true /.
&amp;gt; Patience.
***
###The anatomy of tee program on OpenBSD (http://nanxiao.me/en/the-anatomy-of-tee-program-on-openbsd/)
&amp;gt; The tee command is used to read content from standard input and displays it not only in standard output but also saves to other files simultaneously. The source code of tee in OpenBSD is very simple, and I want to give it an analysis:
&amp;gt; (1) tee leverages Singlely-linked List defined in sys/queue.h to manage outputted files (including standard output):
struct list {
SLIST_ENTRY(list) next;
int fd;
char *name;
};
SLIST_HEAD(, list) head;
......
static void
add(int fd, char *name)
{
struct list *p;
......
SLIST_INSERT_HEAD(&amp;amp;head, p, next);
}
int
main(int argc, char *argv[])
{
struct list *p;
......
SLIST_INIT(&amp;amp;head);
......
SLIST_FOREACH(p, &amp;amp;head, next) {
......
}
}
&amp;gt; To understand it easily, I extract the macros from sys/queue.h and created a file which utilizes the marcos:
#define SLIST_HEAD(name, type) \
struct name { \
struct type *slh_first; /* first element */ \
}
#define SLIST_ENTRY(type) \
struct { \
struct type *sle_next; /* next element */ \
}
#define SLIST_FIRST(head) ((head)-&amp;gt;slh_first)
#define SLIST_END(head) NULL
#define SLIST_EMPTY(head) (SLIST_FIRST(head) == SLIST_END(head))
#define SLIST_NEXT(elm, field) ((elm)-&amp;gt;field.sle_next)
#define SLIST_FOREACH(var, head, field) \
for((var) = SLIST_FIRST(head); \
(var) != SLIST_END(head); \
(var) = SLIST_NEXT(var, field))
#define SLIST_INIT(head) { \
SLIST_FIRST(head) = SLIST_END(head); \
}
#define SLIST_INSERT_HEAD(head, elm, field) do { \
(elm)-&amp;gt;field.sle_next = (head)-&amp;gt;slh_first; \
(head)-&amp;gt;slh_first = (elm); \
} while (0)
struct list {
SLIST_ENTRY(list) next;
int fd;
char *name;
};
SLIST_HEAD(, list) head;
int
main(int argc, char *argv[])
{
struct list *p;
SLIST_INIT(&amp;amp;head);
SLIST_INSERT_HEAD(&amp;amp;head, p, next);
SLIST_FOREACH(p, &amp;amp;head, next) {
}
}
&amp;gt; Then employed gcc‘s pre-processing function:
# gcc -E slist.c
# 1 "slist.c"
# 1 ""
# 1 ""
# 1 "slist.c"
# 30 "slist.c"
struct list {
struct { struct list *sle_next; } next;
int fd;
char *name;
};
struct { struct list *slh_first; } head;
int
main(int argc, char *argv[])
{
struct list *p;
{ ((&amp;amp;head)-&amp;gt;slh_first) = NULL; };
do { (p)-&amp;gt;next.sle_next = (&amp;amp;head)-&amp;gt;slh_first; (&amp;amp;head)-&amp;gt;slh_first = (p); } while (0);
for((p) = ((&amp;amp;head)-&amp;gt;slh_first); (p) != NULL; (p) = ((p)-&amp;gt;next.sle_next)) {
}
}

&amp;gt; It becomes clear now! The head node in list contains only 1 member: slhfirst, which points to the first valid node. For the elements in the list, it is embedded with next struct which uses slenext to refer to next buddy.
&amp;gt; (2) By default, tee will overwrite the output files. If you want to append it, use -a option, and the code is as following:

while (*argv) {
if ((fd = open(*argv, O_WRONLY | O_CREAT |
(append ? O_APPEND : O_TRUNC), DEFFILEMODE)) == -1) {
......
}
......
}

&amp;gt; (3) The next part is the skeleton of saving content to files:

while ((rval = read(STDIN_FILENO, buf, sizeof(buf))) &amp;gt; 0) {
SLIST_FOREACH(p, &amp;amp;head, next) {
n = rval;
bp = buf;
do {
if ((wval = write(p-&amp;gt;fd, bp, n)) == -1) {
......
}
bp += wval;
} while (n -= wval);
}
}
&amp;gt; We need to iterates every opened file descriptor and write contents into it.
&amp;gt; (4) Normally, theinterrupt signal will cause tee exit:
# tee
fdkfkdfjk
fdkfkdfjk
^C
#
&amp;gt; To disable this feature, use -i option:
# tee -i
fdhfhd
fdhfhd
^C^C
&amp;gt; The corresponding code is like this:
......
case 'i':
(void)signal(SIGINT, SIG_IGN);
break;
***
##Beastie Bits
What I learned from reading the OpenBSD's network stack source code (https://bijanebrahimi.github.io/blog/openbsds-network-stack-part-1.html)
Broadcom BCM43224 and BCM43225 Wi-Fi cards now supported by bwn(4) (https://github.com/freebsd/freebsd/commit/888843e26a4e393f405c1c6cbdfc5b701670d363)
Ingo details searching man pages (https://marc.info/?l=openbsd-misc&amp;amp;m=151320195122669&amp;amp;w=2)
DTrace &amp;amp; ZFS Being Updated On NetBSD, Moving Away From Old OpenSolaris Code (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=NetBSD-ZFS-DTrace-Updating)
Linux Professional Institute and BSD Certification Group Join Efforts (http://www.lpi.org/articles/linux-professional-institute-and-bsd-certification-group-join-efforts)
The FreeBSD Foundation thanks Donors (https://www.freebsdfoundation.org/blog/thank-you-2/)
##Feedback/Questions
Alex - My first freebsd bug (http://dpaste.com/3DSV7BC#wrap)
John - Suggested Speakers (http://dpaste.com/2QFR4MT#wrap)
Todd - Two questions (http://dpaste.com/2FQ450Q#wrap)
Matthew - CentOS to FreeBSD (http://dpaste.com/3KA29E0#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We walk through dumping a PS4 kernel in only 6 days, tell you the news that NetBSD 7.1.1 has been released, details on how to run FreeBSD on a Thinkpad T470, and there’s progress in OpenBSD’s pledge.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.netbsd.org/releases/formal-7/NetBSD-7.1.1.html" rel="nofollow">NetBSD 7.1.1 released</a></h3>

<ul>
<li>The NetBSD Project is pleased to announce NetBSD 7.1.1, the first security/critical update of the NetBSD 7.1 release branch. It represents a selected subset of fixes deemed important for security or stability reasons.</li>
<li>Complete source and binaries for NetBSD 7.1.1 are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, and other services may be found at <a href="https://www.NetBSD.org/mirrors/" rel="nofollow">https://www.NetBSD.org/mirrors/</a>. We encourage users who wish to install via ISO or USB disk images to download via BitTorrent by using the torrent files supplied in the images area. A list of hashes for the NetBSD 7.1.1 distribution has been signed with the well-connected PGP key for the NetBSD Security Officer: <a href="https://ftp.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.1.1_hashes.asc" rel="nofollow">https://ftp.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.1.1_hashes.asc</a></li>
<li>NetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone. Free support services are available via our mailing lists and website. Commercial support is available from a variety of sources. More extensive information on NetBSD is available from our website:</li>
<li>[NetBSD website](<a href="http://www.NetBSD.org" rel="nofollow">www.NetBSD.org</a>)
+Changes Between 7.1 and 7.1.1 Below is an abbreviated list of changes in this release. The complete list can be found in the CHANGES-7.1.1 file in the top level directory of the NetBSD 7.1.1 release tree.

<ul>
<li>Security Advisory Fixes The following security advisories were fixed:</li>
<li>NetBSD-SA2017-004 buffer overflow via cmap for 4 graphics drivers.</li>
<li>NetBSD-SA2017-005 x86: vulnerabilities in context handling.</li>
<li>NetBSD-SA2017-006 Vnode reference leak in the openat system call.</li>
<li>NetBSD-SA2018-001 Several vulnerabilities in context handling</li>
<li>NetBSD-SA2018-002 Local DoS in virecover</li>
<li>Note: Advisories prior to NetBSD-SA2017-004 do not affect NetBSD 7.1.1.</li>
<li>Userland changes</li>
<li>dhcrelay(8): Fix bug that prevented proper operation when run in the background.</li>
<li>Heimdal: Update to 7.1. Fix CVE-2017-11103.</li>
<li>mtree(8): Don&#39;t modify strings stored in hash, otherwise filling up of directory hierarchy stops if the same hash value occurs in directory and leaf.</li>
<li>ping(8): Fix cksum calculation for clearing the cached route.</li>
<li>resize_ffs(8): Fix numerous overflow errors which can lead to superblock corruption on large filesystems.</li>
<li>rtadvd(8): Fix the default value of rltime. PR bin/51994.</li>
<li>Update BIND to 9.10.5-P2.</li>
<li>Update expat to 2.2.1.</li>
<li>Update ntp to 4.2.8p10.</li>
<li>Update root.cache to 2017102400.</li>
<li>Update tzdata to 2017c.</li>
<li>vi(1): Don&#39;t garble display when when resizing nvi in xterm.</li>
</ul></li>
<li>wpa_supplicant/hostapd: Update to 2.6.</li>
<li>Apply fixes for CVEs 2017-13077 through 2017-13082 and CVEs 2017-13086 through 2017-13088.</li>
<li>X: Apply fixes for CVEs 2017-12176 through 2017-12187, 2017-10971, 2017-10972, 2017-13722, 2017-13720, 2017-16611, and 2017-16612.
***
###<a href="https://fail0verflow.com/blog/2017/ps4-crashdump-dump/" rel="nofollow">Dumping a PS4 Kernel in &quot;Only&quot; 6 Days</a>
&gt; What if a secure device had an attacker-viewable crashdump format? What if that same device allowed putting arbitrary memory into the crashdump? Amazingly, the ps4 tempted fate by supporting both of these features! Let’s see how that turned out…</li>
<li>Crashdumps on PS4

<ul>
<li>The crash handling infrastructure of the ps4 kernel is interesting for 2 main reasons:</li>
<li>It is ps4-specific code (likely to be buggy)</li>
<li>If the crashdump can be decoded, we will gain very useful info for finding bugs and creating reliable exploits</li>
<li>On a normal FreeBSD system, a kernel panic will create a dump by calling kern_reboot with the RB_DUMP flag. This then leads to doadump being called, which will dump a rather tiny amount of information about the kernel image itself to some storage device.</li>
<li>On ps4, the replacement for doadump is mdbg_run_dump, which can be called from panic or directly from trap_fatal. The amount of information stored into the dump is gigantic by comparison - kernel state for all process, thread, and vm objects are included, along with some metadata about loaded libraries. Other obvious changes from the vanilla FreeBSD method are that the mdbg_run_dump encodes data recorded into the dump on a field-by-field basis and additionally encrypts the resulting buffer before finally storing it to disk.</li>
</ul></li>
<li>Dumping Anything

<ul>
<li>Let’s zoom in to a special part of mdbg_run_dump - where it iterates over all process’ threads and tries to dump some pthread state:</li>
<li>dumpstate is a temporary buffer which will eventually make it into the crashdump. To summarize, sysdump__internal_call_readuser can be made to function as a read-anywhere oracle. This is because fsbase will point into our (owned) webkit process’ usermode address space. Thus, even without changing the actual fsbase value, we may freely change the value of tcb_thread, which is stored at fsbase + 0x10.</li>
<li>Further, sysdump__internal_call_readuser will happily read from a kernel address and put the result into the dump.</li>
<li>We can now put any kernel location into the dump, but we still need to decrypt and decode it…</li>
<li>Aside from that, there’s also the issue that we may only add 0x10 bytes per thread in this manner…</li>
</ul></li>
<li>Further reading:

<ul>
<li>Crashdump Crypto</li>
<li>Crashdump Decoding</li>
<li>Crashdump Automation</li>
<li>Triggering the Vulnerability</li>
<li>The Fix (Kind of…)</li>
<li>Fin</li>
</ul></li>
<li>Appendix

<ul>
<li>Crashdump Decryptor</li>
<li>NXDP Decoder
***
###<a href="https://www.freebsdfoundation.org/blog/bsdtw-2017-conference-recap-li-wen-hsu/" rel="nofollow">BSDTW 2017 Conference Recap: Li-Wen Hsu</a></li>
</ul></li>
<li>BSDTW 2017 Conference Recap: Li-Wen Hsu</li>
<li>12/28/2017
&gt; Last month, we held BSDTW 2017 on November 11-12th, 2017 in Taipei, Taiwan. It was the second largest BSD conference in Taiwan and the first one in this decade. In 2004, the first AsiaBSDCon was also held in Taipei. Then all of the following AsiaBSDCon conferences were held in Tokyo, Japan. (AsiaBSDCon 2018 will be in Tokyo again next year, please submit your talk proposal by December 31th 2017, and attend the conference on March 8th-11th)
&gt; We wanted to start small with the first BSDTW because we were not sure how much sponsorship or how many volunteers we might have. BSDTW 2017 was a single track, two-day conference with 11 selected 50 minute presentations and 1 WIP/lightning talk session consisting of 8 short talks. I do regret that we did not have any local presenters this year. It is also a similar problem at AsiaBSDCon. Unsurprisingly, as with AsiaBSDcon, the travel reimbursement took up a large part of the whole conference budget. We do have many good people that work in Asia, but we still need to encourage people to present their work more.
&gt; We had over 130 registered attendees, with 30% of them coming from outside of Taiwan. To our knowledge, in recent years, this is the only open source conference in Taiwan to be held entirely in English, and to have such a large portion of international attendees. This is also the first open source conference in Taiwan to focus entirely on operating systems. The attendees included students, professors, engineers or CTOs, and CEOs from technology companies. This is also the first time that GroffTheBSDGoat visited Taiwan! We were surprised that after the silence for so many years, there are still so many people that use and love BSD near us. We saw many old friends, who had “disappeared” for a long time, came back, and were glad to meet many new friends at the conference. I am really happy that this conference was able to bring together these people, from local and abroad. After attending BSD conferences around the world for many years, I feel that the friendship between BSD users is the most important thing in the BSD community, and one of the main reasons people stay. It has been my pleasure to bring this community back to my friends in my homeland.
&gt; After the two-day event, I truly understand that bootstrapping a new conference is a very hard job. One with many aspects that you don’t even imagine until you’re really in the process of planning an event. I now have an even greater respect for all of the conference organizers and realize that we need to have more people help them, to keep these conferences continue to get better and better. Plus, there will always be room for a new conference!
&gt; Thanks to the FreeBSD Foundation for being the biggest sponsor of BSDTW 2017 and always being the strongest backend of our community. We are excited about the many local companies and organizations that helped us whether with people, materials or financially. We even had 21 personal sponsors, more than two times the number of other big open source conferences in Taiwan.
&gt; As I said in the closing session, I’m not sure if there will be 2nd BSDTW next year. It still depends on the amount of sponsorship and number of volunteers. However, we will definitely hold more smaller meetups in the next year to keep building up the local BSD community.
&gt; Finally, in the beginning of this month, we had a “post-conference media workshop” for organizing the media files we collected in the BSDTW 2017. Here are the review article in Traditional Chinese and the photos: <a href="https://medium.com/@bsdtw/bsdtw-2017-%E7%B8%BD%E5%9B%9E%E9%A1%A7-a402788daede" rel="nofollow">https://medium.com/@bsdtw/bsdtw-2017-總回顧-a402788daede</a> &amp;&amp;
<a href="https://www.flickr.com/photos/bsdtw/albums/72157689410035911" rel="nofollow">https://www.flickr.com/photos/bsdtw/albums/72157689410035911</a>
***
##News Roundup
###<a href="https://blog.grem.de/pages/t470s.html" rel="nofollow">Running FreeBSD on a Lenovo T470s</a></li>
<li>Running FreeBSD on the Lenovo T470s ThinkPad
&gt; Installing FreeBSD on this machine was super easy. As I couldn&#39;t find a comprehensive/encouraging how-to about installing FreeBSD on a recent ThinkPad, I just wrote up the one below. It includes details about my personal setup, which are not required to run FreeBSD on this model, but which are more to my own taste. I still think this can be a quite useful inspiration for others who want to run their own customized configurations.</li>
<li>Specs
&gt; The system I use has these specifications:</li>
<li>Type: 20JS-001EGE</li>
<li>CPU: Intel Core i7-6600U, 2x 2.60GHz</li>
<li>RAM: 20GB DDR4</li>
<li>SSD: 512GB NVMe</li>
<li>Graphics: Intel HD Graphics 520 (IGP), 1x HDMI 1.4</li>
<li>Display: 14&quot;, 1920x1080, non-glare, IPS</li>
<li>Ports: 3x USB-A 3.0, 1x Thunderbolt 3, 1x Gb LAN</li>
<li>Wireless: WLAN 802.11a/b/g/n/ac, Bluetooth 4.1, LTE (Micro-SIM)</li>
<li>Cardreader: SD/SDHC/SDXC/MMC</li>
<li>Webcam: 0.9 Megapixel</li>
<li>Extras: MIL-STD-810G, Pointing Stick, Fingerprint-Reader, Docking port</li>
<li>Things that work
&gt; Basically everything I care about:

<ul>
<li>Accelerated video</li>
<li>Keyboard</li>
<li>Touchpad/ClickPad (like expected in a modern laptop)</li>
<li>SSD</li>
<li>WiFi</li>
<li>Sound</li>
<li>HDMI out</li>
<li>Suspend to RAM</li>
<li>Webcam</li>
</ul></li>
<li>Things that don&#39;t work

<ul>
<li>Fingerprint reader</li>
<li>Potentially anything I didn&#39;t test</li>
<li>Battery life is okay, but could be better.</li>
</ul></li>
<li>Installation of the base system
&gt; I used a snapshot release of 12-CURRENT as the basis of my installation, particularly the one of 13th of December 2017.
&gt; I dd&#39;ed it onto a memory stick and boot the laptop. I started a standard installation and created an encrypted ZFS pool on nvme0, using encryption, swap encryption and partition scheme &quot;GPT (UEFI)&quot;.
&gt; After installation, it boots straight up.</li>
<li>Ports tree used
&gt; All work is based on a head ports tree from about Dec 18, 22:15 CET, which should be more or less r456672.</li>
<li>Preferred ClickPad configuration
&gt; As I&#39;m not a fan of the the pointing stick, I disabled it in the bios. My final ClickPad configuration will be: Click to click (not tap), no middle button, right button in the lower right corner. As the old synaptics driver doesn&#39;t provide good thumb detection, libinput will be used.</li>
<li>Check out the laptop list on the FreeBSD wiki for compatibility: (<a href="https://wiki.freebsd.org/Laptops/" rel="nofollow">https://wiki.freebsd.org/Laptops/</a>)
***
###<a href="https://github.com/pkgdemon/comet" rel="nofollow">FreeBSD desktop LiveCD creator</a></li>
<li>Introduction
&gt; The purpose of this tool is quickly generate bloat free images containing stock FreeBSD, and supported desktop environments.</li>
<li>Features</li>
<li>FreeBSD 11.1-RELEASE</li>
<li>AMD64</li>
<li>Gnome &amp; KDE desktop environments</li>
<li>Hybrid DVD/USB image</li>
<li>Screenshots</li>
<li>[Gnome LiveCD])<a href="https://github.com/pkgdemon/comet/raw/master/screenshots/gnome-livecd.png?raw=true" rel="nofollow">https://github.com/pkgdemon/comet/raw/master/screenshots/gnome-livecd.png?raw=true</a>)</li>
<li><a href="https://github.com/pkgdemon/comet/raw/master/screenshots/kde-livecd.png?raw=true" rel="nofollow">KDE LiveCD</a></li>
<li>System Requirements</li>
<li>FreeBSD 11.1, or higher for AMD64</li>
<li>20GB of free disk space</li>
<li>1GB of free memory</li>
<li>UFS, or ZFS</li>
<li>Initial Setup</li>
<li>Install the required packages:
<code>pkg install git grub2-pcbsd grub2-efi xorriso</code></li>
<li>Clone the repo:
<code>git clone https://www.github.com/pkgdemon/comet</code></li>
<li>Enter the directory for running the LiveCD creator:
<code>cd comet/src</code></li>
<li>Credentials for live media
&gt; User: liveuser
&gt; Password: freebsd
***
###iXsystems</li>
<li><a href="https://www.ixsystems.com/blog/storagecrypter/" rel="nofollow">StorageCrypter Ransomware: Security Threat or Clickbait?</a>
###<a href="https://undeadly.org/cgi?action=article;sid=20171208082246" rel="nofollow">pledge() work in progress</a>
&gt; I wanted to give an update that a two pledge-related changes are being worked on. The semantics and integration are complicated so it is taking some time.
&gt; One is execpromises. This will become the 2nd argument of pledge(). This allows one to set the pledge for the new image after pledge &quot;exec&quot;-allowed execve(). A warning though: utilizing this in software isn&#39;t as easy as you might think! The fork+exec + startup sequences needed to be studied quite carefully to ensure the newly-executed child doesn&#39;t ask for more than the parent&#39;s execpromises. In my experiments such a circumstance is exceedingly common, so the problem is eased by introducing a new pledge feature which allows pledge violations to return ENOSYS or such rather than killing the process.
&gt; This feature also needs to be used with great caution (especially in privileged programs) because programs which fail to observe errors may continue operating forward very incorrectly; you&#39;ve lost the ability to catch it failing, and provide care by fixing the problem.
&gt; The other is pledgepaths. The semantics are still being tuned a bit. Before the first call to pledge() in a process, one can pledgepath() directories. Then later after pledge(), file access operations only work if the traversal of the path crosses one of those pre-declared directories (but better make sure you don&#39;t move a directory, because the kernel remembers and reasons about the vnode of the directory rather than the path). Something similar is being worked on for files, but we are still adjusting that, as well as a flag parameter for the pledgepath() call which may constrain the operations done on such files.
&gt; As such, pledgepath() will become a filesystem containment mechanism unlike chroot() because paths will still be based upon true /.
&gt; Patience.
***
###<a href="http://nanxiao.me/en/the-anatomy-of-tee-program-on-openbsd/" rel="nofollow">The anatomy of tee program on OpenBSD</a>
&gt; The tee command is used to read content from standard input and displays it not only in standard output but also saves to other files simultaneously. The source code of tee in OpenBSD is very simple, and I want to give it an analysis:
&gt; (1) tee leverages Singlely-linked List defined in sys/queue.h to manage outputted files (including standard output):
<code>struct list {
SLIST_ENTRY(list) next;
int fd;
char *name;
};
SLIST_HEAD(, list) head;
......
static void
add(int fd, char *name)
{
struct list *p;
......
SLIST_INSERT_HEAD(&amp;head, p, next);
}
int
main(int argc, char *argv[])
{
struct list *p;
......
SLIST_INIT(&amp;head);
......
SLIST_FOREACH(p, &amp;head, next) {
......
}
}</code>
&gt; To understand it easily, I extract the macros from sys/queue.h and created a file which utilizes the marcos:
<code>&amp;#35;define SLIST_HEAD(name, type) \
struct name { \
struct type *slh_first; /* first element */ \
}
&amp;#35;define SLIST_ENTRY(type) \
struct { \
struct type *sle_next; /* next element */ \
}
&amp;#35;define SLIST_FIRST(head) ((head)-&gt;slh_first)
&amp;#35;define SLIST_END(head) NULL
&amp;#35;define SLIST_EMPTY(head) (SLIST_FIRST(head) == SLIST_END(head))
&amp;#35;define SLIST_NEXT(elm, field) ((elm)-&gt;field.sle_next)
&amp;#35;define SLIST_FOREACH(var, head, field) \
for((var) = SLIST_FIRST(head); \
(var) != SLIST_END(head); \
(var) = SLIST_NEXT(var, field))
&amp;#35;define SLIST_INIT(head) { \
SLIST_FIRST(head) = SLIST_END(head); \
}
&amp;#35;define SLIST_INSERT_HEAD(head, elm, field) do { \
(elm)-&gt;field.sle_next = (head)-&gt;slh_first; \
(head)-&gt;slh_first = (elm); \
} while (0)
struct list {
SLIST_ENTRY(list) next;
int fd;
char *name;
};
SLIST_HEAD(, list) head;
int
main(int argc, char *argv[])
{
struct list *p;
SLIST_INIT(&amp;head);
SLIST_INSERT_HEAD(&amp;head, p, next);
SLIST_FOREACH(p, &amp;head, next) {
}
}</code>
&gt; Then employed gcc‘s pre-processing function:
<code>&amp;#35; gcc -E slist.c
&amp;#35; 1 &quot;slist.c&quot;
&amp;#35; 1 &quot;&lt;built-in&gt;&quot;
&amp;#35; 1 &quot;&lt;command-line&gt;&quot;
&amp;#35; 1 &quot;slist.c&quot;
&amp;#35; 30 &quot;slist.c&quot;
struct list {
struct { struct list *sle_next; } next;
int fd;
char *name;
};
struct { struct list *slh_first; } head;
int
main(int argc, char *argv[])
{
struct list *p;
{ ((&amp;head)-&gt;slh_first) = NULL; };
do { (p)-&gt;next.sle_next = (&amp;head)-&gt;slh_first; (&amp;head)-&gt;slh_first = (p); } while (0);
for((p) = ((&amp;head)-&gt;slh_first); (p) != NULL; (p) = ((p)-&gt;next.sle_next)) {
}
}
</code>
&gt; It becomes clear now! The head node in list contains only 1 member: slh_first, which points to the first valid node. For the elements in the list, it is embedded with next struct which uses sle_next to refer to next buddy.
&gt; (2) By default, tee will overwrite the output files. If you want to append it, use -a option, and the code is as following:
<code>
while (*argv) {
if ((fd = open(*argv, O_WRONLY | O_CREAT |
(append ? O_APPEND : O_TRUNC), DEFFILEMODE)) == -1) {
......
}
......
}
</code>
&gt; (3) The next part is the skeleton of saving content to files:
<code>
while ((rval = read(STDIN_FILENO, buf, sizeof(buf))) &gt; 0) {
SLIST_FOREACH(p, &amp;head, next) {
n = rval;
bp = buf;
do {
if ((wval = write(p-&gt;fd, bp, n)) == -1) {
......
}
bp += wval;
} while (n -= wval);
}
}</code>
&gt; We need to iterates every opened file descriptor and write contents into it.
&gt; (4) Normally, theinterrupt signal will cause tee exit:
<code>&amp;#35; tee
fdkfkdfjk
fdkfkdfjk
^C
&amp;#35;</code>
&gt; To disable this feature, use -i option:
<code>&amp;#35; tee -i
fdhfhd
fdhfhd
^C^C</code>
&gt; The corresponding code is like this:
<code>......
case &#39;i&#39;:
(void)signal(SIGINT, SIG_IGN);
break;</code>
***
##Beastie Bits
+ <a href="https://bijanebrahimi.github.io/blog/openbsds-network-stack-part-1.html" rel="nofollow">What I learned from reading the OpenBSD&#39;s network stack source code</a>
+ <a href="https://github.com/freebsd/freebsd/commit/888843e26a4e393f405c1c6cbdfc5b701670d363" rel="nofollow">Broadcom BCM43224 and BCM43225 Wi-Fi cards now supported by bwn(4)</a>
+ <a href="https://marc.info/?l=openbsd-misc&m=151320195122669&w=2" rel="nofollow">Ingo details searching man pages</a>
+ <a href="https://www.phoronix.com/scan.php?page=news_item&px=NetBSD-ZFS-DTrace-Updating" rel="nofollow">DTrace &amp; ZFS Being Updated On NetBSD, Moving Away From Old OpenSolaris Code</a>
+ <a href="http://www.lpi.org/articles/linux-professional-institute-and-bsd-certification-group-join-efforts" rel="nofollow">Linux Professional Institute and BSD Certification Group Join Efforts</a>
+ <a href="https://www.freebsdfoundation.org/blog/thank-you-2/" rel="nofollow">The FreeBSD Foundation thanks Donors</a>
##Feedback/Questions
+ Alex - <a href="http://dpaste.com/3DSV7BC#wrap" rel="nofollow">My first freebsd bug</a>
+ John - <a href="http://dpaste.com/2QFR4MT#wrap" rel="nofollow">Suggested Speakers</a>
+ Todd - <a href="http://dpaste.com/2FQ450Q#wrap" rel="nofollow">Two questions</a>
+ Matthew - <a href="http://dpaste.com/3KA29E0#wrap" rel="nofollow">CentOS to FreeBSD</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We walk through dumping a PS4 kernel in only 6 days, tell you the news that NetBSD 7.1.1 has been released, details on how to run FreeBSD on a Thinkpad T470, and there’s progress in OpenBSD’s pledge.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.netbsd.org/releases/formal-7/NetBSD-7.1.1.html" rel="nofollow">NetBSD 7.1.1 released</a></h3>

<ul>
<li>The NetBSD Project is pleased to announce NetBSD 7.1.1, the first security/critical update of the NetBSD 7.1 release branch. It represents a selected subset of fixes deemed important for security or stability reasons.</li>
<li>Complete source and binaries for NetBSD 7.1.1 are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, and other services may be found at <a href="https://www.NetBSD.org/mirrors/" rel="nofollow">https://www.NetBSD.org/mirrors/</a>. We encourage users who wish to install via ISO or USB disk images to download via BitTorrent by using the torrent files supplied in the images area. A list of hashes for the NetBSD 7.1.1 distribution has been signed with the well-connected PGP key for the NetBSD Security Officer: <a href="https://ftp.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.1.1_hashes.asc" rel="nofollow">https://ftp.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.1.1_hashes.asc</a></li>
<li>NetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone. Free support services are available via our mailing lists and website. Commercial support is available from a variety of sources. More extensive information on NetBSD is available from our website:</li>
<li>[NetBSD website](<a href="http://www.NetBSD.org" rel="nofollow">www.NetBSD.org</a>)
+Changes Between 7.1 and 7.1.1 Below is an abbreviated list of changes in this release. The complete list can be found in the CHANGES-7.1.1 file in the top level directory of the NetBSD 7.1.1 release tree.

<ul>
<li>Security Advisory Fixes The following security advisories were fixed:</li>
<li>NetBSD-SA2017-004 buffer overflow via cmap for 4 graphics drivers.</li>
<li>NetBSD-SA2017-005 x86: vulnerabilities in context handling.</li>
<li>NetBSD-SA2017-006 Vnode reference leak in the openat system call.</li>
<li>NetBSD-SA2018-001 Several vulnerabilities in context handling</li>
<li>NetBSD-SA2018-002 Local DoS in virecover</li>
<li>Note: Advisories prior to NetBSD-SA2017-004 do not affect NetBSD 7.1.1.</li>
<li>Userland changes</li>
<li>dhcrelay(8): Fix bug that prevented proper operation when run in the background.</li>
<li>Heimdal: Update to 7.1. Fix CVE-2017-11103.</li>
<li>mtree(8): Don&#39;t modify strings stored in hash, otherwise filling up of directory hierarchy stops if the same hash value occurs in directory and leaf.</li>
<li>ping(8): Fix cksum calculation for clearing the cached route.</li>
<li>resize_ffs(8): Fix numerous overflow errors which can lead to superblock corruption on large filesystems.</li>
<li>rtadvd(8): Fix the default value of rltime. PR bin/51994.</li>
<li>Update BIND to 9.10.5-P2.</li>
<li>Update expat to 2.2.1.</li>
<li>Update ntp to 4.2.8p10.</li>
<li>Update root.cache to 2017102400.</li>
<li>Update tzdata to 2017c.</li>
<li>vi(1): Don&#39;t garble display when when resizing nvi in xterm.</li>
</ul></li>
<li>wpa_supplicant/hostapd: Update to 2.6.</li>
<li>Apply fixes for CVEs 2017-13077 through 2017-13082 and CVEs 2017-13086 through 2017-13088.</li>
<li>X: Apply fixes for CVEs 2017-12176 through 2017-12187, 2017-10971, 2017-10972, 2017-13722, 2017-13720, 2017-16611, and 2017-16612.
***
###<a href="https://fail0verflow.com/blog/2017/ps4-crashdump-dump/" rel="nofollow">Dumping a PS4 Kernel in &quot;Only&quot; 6 Days</a>
&gt; What if a secure device had an attacker-viewable crashdump format? What if that same device allowed putting arbitrary memory into the crashdump? Amazingly, the ps4 tempted fate by supporting both of these features! Let’s see how that turned out…</li>
<li>Crashdumps on PS4

<ul>
<li>The crash handling infrastructure of the ps4 kernel is interesting for 2 main reasons:</li>
<li>It is ps4-specific code (likely to be buggy)</li>
<li>If the crashdump can be decoded, we will gain very useful info for finding bugs and creating reliable exploits</li>
<li>On a normal FreeBSD system, a kernel panic will create a dump by calling kern_reboot with the RB_DUMP flag. This then leads to doadump being called, which will dump a rather tiny amount of information about the kernel image itself to some storage device.</li>
<li>On ps4, the replacement for doadump is mdbg_run_dump, which can be called from panic or directly from trap_fatal. The amount of information stored into the dump is gigantic by comparison - kernel state for all process, thread, and vm objects are included, along with some metadata about loaded libraries. Other obvious changes from the vanilla FreeBSD method are that the mdbg_run_dump encodes data recorded into the dump on a field-by-field basis and additionally encrypts the resulting buffer before finally storing it to disk.</li>
</ul></li>
<li>Dumping Anything

<ul>
<li>Let’s zoom in to a special part of mdbg_run_dump - where it iterates over all process’ threads and tries to dump some pthread state:</li>
<li>dumpstate is a temporary buffer which will eventually make it into the crashdump. To summarize, sysdump__internal_call_readuser can be made to function as a read-anywhere oracle. This is because fsbase will point into our (owned) webkit process’ usermode address space. Thus, even without changing the actual fsbase value, we may freely change the value of tcb_thread, which is stored at fsbase + 0x10.</li>
<li>Further, sysdump__internal_call_readuser will happily read from a kernel address and put the result into the dump.</li>
<li>We can now put any kernel location into the dump, but we still need to decrypt and decode it…</li>
<li>Aside from that, there’s also the issue that we may only add 0x10 bytes per thread in this manner…</li>
</ul></li>
<li>Further reading:

<ul>
<li>Crashdump Crypto</li>
<li>Crashdump Decoding</li>
<li>Crashdump Automation</li>
<li>Triggering the Vulnerability</li>
<li>The Fix (Kind of…)</li>
<li>Fin</li>
</ul></li>
<li>Appendix

<ul>
<li>Crashdump Decryptor</li>
<li>NXDP Decoder
***
###<a href="https://www.freebsdfoundation.org/blog/bsdtw-2017-conference-recap-li-wen-hsu/" rel="nofollow">BSDTW 2017 Conference Recap: Li-Wen Hsu</a></li>
</ul></li>
<li>BSDTW 2017 Conference Recap: Li-Wen Hsu</li>
<li>12/28/2017
&gt; Last month, we held BSDTW 2017 on November 11-12th, 2017 in Taipei, Taiwan. It was the second largest BSD conference in Taiwan and the first one in this decade. In 2004, the first AsiaBSDCon was also held in Taipei. Then all of the following AsiaBSDCon conferences were held in Tokyo, Japan. (AsiaBSDCon 2018 will be in Tokyo again next year, please submit your talk proposal by December 31th 2017, and attend the conference on March 8th-11th)
&gt; We wanted to start small with the first BSDTW because we were not sure how much sponsorship or how many volunteers we might have. BSDTW 2017 was a single track, two-day conference with 11 selected 50 minute presentations and 1 WIP/lightning talk session consisting of 8 short talks. I do regret that we did not have any local presenters this year. It is also a similar problem at AsiaBSDCon. Unsurprisingly, as with AsiaBSDcon, the travel reimbursement took up a large part of the whole conference budget. We do have many good people that work in Asia, but we still need to encourage people to present their work more.
&gt; We had over 130 registered attendees, with 30% of them coming from outside of Taiwan. To our knowledge, in recent years, this is the only open source conference in Taiwan to be held entirely in English, and to have such a large portion of international attendees. This is also the first open source conference in Taiwan to focus entirely on operating systems. The attendees included students, professors, engineers or CTOs, and CEOs from technology companies. This is also the first time that GroffTheBSDGoat visited Taiwan! We were surprised that after the silence for so many years, there are still so many people that use and love BSD near us. We saw many old friends, who had “disappeared” for a long time, came back, and were glad to meet many new friends at the conference. I am really happy that this conference was able to bring together these people, from local and abroad. After attending BSD conferences around the world for many years, I feel that the friendship between BSD users is the most important thing in the BSD community, and one of the main reasons people stay. It has been my pleasure to bring this community back to my friends in my homeland.
&gt; After the two-day event, I truly understand that bootstrapping a new conference is a very hard job. One with many aspects that you don’t even imagine until you’re really in the process of planning an event. I now have an even greater respect for all of the conference organizers and realize that we need to have more people help them, to keep these conferences continue to get better and better. Plus, there will always be room for a new conference!
&gt; Thanks to the FreeBSD Foundation for being the biggest sponsor of BSDTW 2017 and always being the strongest backend of our community. We are excited about the many local companies and organizations that helped us whether with people, materials or financially. We even had 21 personal sponsors, more than two times the number of other big open source conferences in Taiwan.
&gt; As I said in the closing session, I’m not sure if there will be 2nd BSDTW next year. It still depends on the amount of sponsorship and number of volunteers. However, we will definitely hold more smaller meetups in the next year to keep building up the local BSD community.
&gt; Finally, in the beginning of this month, we had a “post-conference media workshop” for organizing the media files we collected in the BSDTW 2017. Here are the review article in Traditional Chinese and the photos: <a href="https://medium.com/@bsdtw/bsdtw-2017-%E7%B8%BD%E5%9B%9E%E9%A1%A7-a402788daede" rel="nofollow">https://medium.com/@bsdtw/bsdtw-2017-總回顧-a402788daede</a> &amp;&amp;
<a href="https://www.flickr.com/photos/bsdtw/albums/72157689410035911" rel="nofollow">https://www.flickr.com/photos/bsdtw/albums/72157689410035911</a>
***
##News Roundup
###<a href="https://blog.grem.de/pages/t470s.html" rel="nofollow">Running FreeBSD on a Lenovo T470s</a></li>
<li>Running FreeBSD on the Lenovo T470s ThinkPad
&gt; Installing FreeBSD on this machine was super easy. As I couldn&#39;t find a comprehensive/encouraging how-to about installing FreeBSD on a recent ThinkPad, I just wrote up the one below. It includes details about my personal setup, which are not required to run FreeBSD on this model, but which are more to my own taste. I still think this can be a quite useful inspiration for others who want to run their own customized configurations.</li>
<li>Specs
&gt; The system I use has these specifications:</li>
<li>Type: 20JS-001EGE</li>
<li>CPU: Intel Core i7-6600U, 2x 2.60GHz</li>
<li>RAM: 20GB DDR4</li>
<li>SSD: 512GB NVMe</li>
<li>Graphics: Intel HD Graphics 520 (IGP), 1x HDMI 1.4</li>
<li>Display: 14&quot;, 1920x1080, non-glare, IPS</li>
<li>Ports: 3x USB-A 3.0, 1x Thunderbolt 3, 1x Gb LAN</li>
<li>Wireless: WLAN 802.11a/b/g/n/ac, Bluetooth 4.1, LTE (Micro-SIM)</li>
<li>Cardreader: SD/SDHC/SDXC/MMC</li>
<li>Webcam: 0.9 Megapixel</li>
<li>Extras: MIL-STD-810G, Pointing Stick, Fingerprint-Reader, Docking port</li>
<li>Things that work
&gt; Basically everything I care about:

<ul>
<li>Accelerated video</li>
<li>Keyboard</li>
<li>Touchpad/ClickPad (like expected in a modern laptop)</li>
<li>SSD</li>
<li>WiFi</li>
<li>Sound</li>
<li>HDMI out</li>
<li>Suspend to RAM</li>
<li>Webcam</li>
</ul></li>
<li>Things that don&#39;t work

<ul>
<li>Fingerprint reader</li>
<li>Potentially anything I didn&#39;t test</li>
<li>Battery life is okay, but could be better.</li>
</ul></li>
<li>Installation of the base system
&gt; I used a snapshot release of 12-CURRENT as the basis of my installation, particularly the one of 13th of December 2017.
&gt; I dd&#39;ed it onto a memory stick and boot the laptop. I started a standard installation and created an encrypted ZFS pool on nvme0, using encryption, swap encryption and partition scheme &quot;GPT (UEFI)&quot;.
&gt; After installation, it boots straight up.</li>
<li>Ports tree used
&gt; All work is based on a head ports tree from about Dec 18, 22:15 CET, which should be more or less r456672.</li>
<li>Preferred ClickPad configuration
&gt; As I&#39;m not a fan of the the pointing stick, I disabled it in the bios. My final ClickPad configuration will be: Click to click (not tap), no middle button, right button in the lower right corner. As the old synaptics driver doesn&#39;t provide good thumb detection, libinput will be used.</li>
<li>Check out the laptop list on the FreeBSD wiki for compatibility: (<a href="https://wiki.freebsd.org/Laptops/" rel="nofollow">https://wiki.freebsd.org/Laptops/</a>)
***
###<a href="https://github.com/pkgdemon/comet" rel="nofollow">FreeBSD desktop LiveCD creator</a></li>
<li>Introduction
&gt; The purpose of this tool is quickly generate bloat free images containing stock FreeBSD, and supported desktop environments.</li>
<li>Features</li>
<li>FreeBSD 11.1-RELEASE</li>
<li>AMD64</li>
<li>Gnome &amp; KDE desktop environments</li>
<li>Hybrid DVD/USB image</li>
<li>Screenshots</li>
<li>[Gnome LiveCD])<a href="https://github.com/pkgdemon/comet/raw/master/screenshots/gnome-livecd.png?raw=true" rel="nofollow">https://github.com/pkgdemon/comet/raw/master/screenshots/gnome-livecd.png?raw=true</a>)</li>
<li><a href="https://github.com/pkgdemon/comet/raw/master/screenshots/kde-livecd.png?raw=true" rel="nofollow">KDE LiveCD</a></li>
<li>System Requirements</li>
<li>FreeBSD 11.1, or higher for AMD64</li>
<li>20GB of free disk space</li>
<li>1GB of free memory</li>
<li>UFS, or ZFS</li>
<li>Initial Setup</li>
<li>Install the required packages:
<code>pkg install git grub2-pcbsd grub2-efi xorriso</code></li>
<li>Clone the repo:
<code>git clone https://www.github.com/pkgdemon/comet</code></li>
<li>Enter the directory for running the LiveCD creator:
<code>cd comet/src</code></li>
<li>Credentials for live media
&gt; User: liveuser
&gt; Password: freebsd
***
###iXsystems</li>
<li><a href="https://www.ixsystems.com/blog/storagecrypter/" rel="nofollow">StorageCrypter Ransomware: Security Threat or Clickbait?</a>
###<a href="https://undeadly.org/cgi?action=article;sid=20171208082246" rel="nofollow">pledge() work in progress</a>
&gt; I wanted to give an update that a two pledge-related changes are being worked on. The semantics and integration are complicated so it is taking some time.
&gt; One is execpromises. This will become the 2nd argument of pledge(). This allows one to set the pledge for the new image after pledge &quot;exec&quot;-allowed execve(). A warning though: utilizing this in software isn&#39;t as easy as you might think! The fork+exec + startup sequences needed to be studied quite carefully to ensure the newly-executed child doesn&#39;t ask for more than the parent&#39;s execpromises. In my experiments such a circumstance is exceedingly common, so the problem is eased by introducing a new pledge feature which allows pledge violations to return ENOSYS or such rather than killing the process.
&gt; This feature also needs to be used with great caution (especially in privileged programs) because programs which fail to observe errors may continue operating forward very incorrectly; you&#39;ve lost the ability to catch it failing, and provide care by fixing the problem.
&gt; The other is pledgepaths. The semantics are still being tuned a bit. Before the first call to pledge() in a process, one can pledgepath() directories. Then later after pledge(), file access operations only work if the traversal of the path crosses one of those pre-declared directories (but better make sure you don&#39;t move a directory, because the kernel remembers and reasons about the vnode of the directory rather than the path). Something similar is being worked on for files, but we are still adjusting that, as well as a flag parameter for the pledgepath() call which may constrain the operations done on such files.
&gt; As such, pledgepath() will become a filesystem containment mechanism unlike chroot() because paths will still be based upon true /.
&gt; Patience.
***
###<a href="http://nanxiao.me/en/the-anatomy-of-tee-program-on-openbsd/" rel="nofollow">The anatomy of tee program on OpenBSD</a>
&gt; The tee command is used to read content from standard input and displays it not only in standard output but also saves to other files simultaneously. The source code of tee in OpenBSD is very simple, and I want to give it an analysis:
&gt; (1) tee leverages Singlely-linked List defined in sys/queue.h to manage outputted files (including standard output):
<code>struct list {
SLIST_ENTRY(list) next;
int fd;
char *name;
};
SLIST_HEAD(, list) head;
......
static void
add(int fd, char *name)
{
struct list *p;
......
SLIST_INSERT_HEAD(&amp;head, p, next);
}
int
main(int argc, char *argv[])
{
struct list *p;
......
SLIST_INIT(&amp;head);
......
SLIST_FOREACH(p, &amp;head, next) {
......
}
}</code>
&gt; To understand it easily, I extract the macros from sys/queue.h and created a file which utilizes the marcos:
<code>&amp;#35;define SLIST_HEAD(name, type) \
struct name { \
struct type *slh_first; /* first element */ \
}
&amp;#35;define SLIST_ENTRY(type) \
struct { \
struct type *sle_next; /* next element */ \
}
&amp;#35;define SLIST_FIRST(head) ((head)-&gt;slh_first)
&amp;#35;define SLIST_END(head) NULL
&amp;#35;define SLIST_EMPTY(head) (SLIST_FIRST(head) == SLIST_END(head))
&amp;#35;define SLIST_NEXT(elm, field) ((elm)-&gt;field.sle_next)
&amp;#35;define SLIST_FOREACH(var, head, field) \
for((var) = SLIST_FIRST(head); \
(var) != SLIST_END(head); \
(var) = SLIST_NEXT(var, field))
&amp;#35;define SLIST_INIT(head) { \
SLIST_FIRST(head) = SLIST_END(head); \
}
&amp;#35;define SLIST_INSERT_HEAD(head, elm, field) do { \
(elm)-&gt;field.sle_next = (head)-&gt;slh_first; \
(head)-&gt;slh_first = (elm); \
} while (0)
struct list {
SLIST_ENTRY(list) next;
int fd;
char *name;
};
SLIST_HEAD(, list) head;
int
main(int argc, char *argv[])
{
struct list *p;
SLIST_INIT(&amp;head);
SLIST_INSERT_HEAD(&amp;head, p, next);
SLIST_FOREACH(p, &amp;head, next) {
}
}</code>
&gt; Then employed gcc‘s pre-processing function:
<code>&amp;#35; gcc -E slist.c
&amp;#35; 1 &quot;slist.c&quot;
&amp;#35; 1 &quot;&lt;built-in&gt;&quot;
&amp;#35; 1 &quot;&lt;command-line&gt;&quot;
&amp;#35; 1 &quot;slist.c&quot;
&amp;#35; 30 &quot;slist.c&quot;
struct list {
struct { struct list *sle_next; } next;
int fd;
char *name;
};
struct { struct list *slh_first; } head;
int
main(int argc, char *argv[])
{
struct list *p;
{ ((&amp;head)-&gt;slh_first) = NULL; };
do { (p)-&gt;next.sle_next = (&amp;head)-&gt;slh_first; (&amp;head)-&gt;slh_first = (p); } while (0);
for((p) = ((&amp;head)-&gt;slh_first); (p) != NULL; (p) = ((p)-&gt;next.sle_next)) {
}
}
</code>
&gt; It becomes clear now! The head node in list contains only 1 member: slh_first, which points to the first valid node. For the elements in the list, it is embedded with next struct which uses sle_next to refer to next buddy.
&gt; (2) By default, tee will overwrite the output files. If you want to append it, use -a option, and the code is as following:
<code>
while (*argv) {
if ((fd = open(*argv, O_WRONLY | O_CREAT |
(append ? O_APPEND : O_TRUNC), DEFFILEMODE)) == -1) {
......
}
......
}
</code>
&gt; (3) The next part is the skeleton of saving content to files:
<code>
while ((rval = read(STDIN_FILENO, buf, sizeof(buf))) &gt; 0) {
SLIST_FOREACH(p, &amp;head, next) {
n = rval;
bp = buf;
do {
if ((wval = write(p-&gt;fd, bp, n)) == -1) {
......
}
bp += wval;
} while (n -= wval);
}
}</code>
&gt; We need to iterates every opened file descriptor and write contents into it.
&gt; (4) Normally, theinterrupt signal will cause tee exit:
<code>&amp;#35; tee
fdkfkdfjk
fdkfkdfjk
^C
&amp;#35;</code>
&gt; To disable this feature, use -i option:
<code>&amp;#35; tee -i
fdhfhd
fdhfhd
^C^C</code>
&gt; The corresponding code is like this:
<code>......
case &#39;i&#39;:
(void)signal(SIGINT, SIG_IGN);
break;</code>
***
##Beastie Bits
+ <a href="https://bijanebrahimi.github.io/blog/openbsds-network-stack-part-1.html" rel="nofollow">What I learned from reading the OpenBSD&#39;s network stack source code</a>
+ <a href="https://github.com/freebsd/freebsd/commit/888843e26a4e393f405c1c6cbdfc5b701670d363" rel="nofollow">Broadcom BCM43224 and BCM43225 Wi-Fi cards now supported by bwn(4)</a>
+ <a href="https://marc.info/?l=openbsd-misc&m=151320195122669&w=2" rel="nofollow">Ingo details searching man pages</a>
+ <a href="https://www.phoronix.com/scan.php?page=news_item&px=NetBSD-ZFS-DTrace-Updating" rel="nofollow">DTrace &amp; ZFS Being Updated On NetBSD, Moving Away From Old OpenSolaris Code</a>
+ <a href="http://www.lpi.org/articles/linux-professional-institute-and-bsd-certification-group-join-efforts" rel="nofollow">Linux Professional Institute and BSD Certification Group Join Efforts</a>
+ <a href="https://www.freebsdfoundation.org/blog/thank-you-2/" rel="nofollow">The FreeBSD Foundation thanks Donors</a>
##Feedback/Questions
+ Alex - <a href="http://dpaste.com/3DSV7BC#wrap" rel="nofollow">My first freebsd bug</a>
+ John - <a href="http://dpaste.com/2QFR4MT#wrap" rel="nofollow">Suggested Speakers</a>
+ Todd - <a href="http://dpaste.com/2FQ450Q#wrap" rel="nofollow">Two questions</a>
+ Matthew - <a href="http://dpaste.com/3KA29E0#wrap" rel="nofollow">CentOS to FreeBSD</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>226: SSL: Santa’s Syscall List</title>
  <link>https://www.bsdnow.tv/226</link>
  <guid isPermaLink="false">12b503ea-38c7-458a-b5b3-6893c50337b1</guid>
  <pubDate>Wed, 27 Dec 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/12b503ea-38c7-458a-b5b3-6893c50337b1.mp3" length="91934356" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We read the FreeBSD Q3 status report, explore good and bad syscalls, list GOG Games for OpenBSD, and show you what devmatch can do.</itunes:subtitle>
  <itunes:duration>2:07:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We read the FreeBSD Q3 status report, explore good and bad syscalls, list GOG Games for OpenBSD, and show you what devmatch can do.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD Q3 Status Report 2017 (https://lists.freebsd.org/pipermail/freebsd-announce/2017-December/001818.html)
FreeBSD Team Reports
FreeBSD Release Engineering Team
Ports Collection
The FreeBSD Core Team
The FreeBSD Foundation
Projects
FreeBSD CI
Kernel
Intel 10G iflib Driver Update
Intel iWARP Support
pNFS Server Plan B
Architectures
AMD Zen (family 17h) support
Userland Programs
Updates to GDB
Ports
FreeBSDDesktop
OpenJFX 8
Puppet
Documentation
Absolute FreeBSD, 3rd Edition
Manual Pages
Third-Party Projects
The nosh Project
####FreeBSD Foundation Q4 Update (https://www.freebsdfoundation.org/wp-content/uploads/2017/12/FreeBSD-Foundation-Q4-Update.pdf)
***
###11 syscalls that rock the world (https://www.cloudatomiclab.com/prosyscall/)
0. read
&amp;gt; You cannot go wrong with a read. You can barely EFAULT it! On Linux amd64 it is syscall zero. If all its arguments are zero it returns zero. Cool!
1. pipe
&amp;gt; The society for the preservation of historic calling conventions is very fond of pipe, as in many operating systems and architectures it preserves the fun feature of returning both of the file descriptors as return values. At least Linux MIPS does, and NetBSD does even on x86 and amd64. Multiple return values are making a comeback in languages like Lua and Go, but C has always had a bit of a funny thing about them, but they have long been supported in many calling conventions, so let us use them in syscalls! Well, one syscall.
2. kqueue
&amp;gt; When the world went all C10K on our ass, and scaleable polling was a thing, Linux went epoll, the BSDs went kqueue and Solaris went /dev/poll. The nicest interface was kqueue, while epoll is some mix of edge and level triggered semantics and design errors so bugs are still being found.
3. unshare
&amp;gt; Sounds like a selfish syscall, but this generous syscall call is the basis of Linux namespaces, allowing a process to isolate its resources. Containers are built from unshares.
4. setns
&amp;gt; If you liked unshare, its younger but cooler friend takes file descriptors for namespaces. Pass it down a unix socket to another process, or stash it for later, and do that namespace switching. All the best system calls take file descriptors.
5. execveat
&amp;gt; Despite its somewhat confusing name (FreeBSD has the saner fexecve, but other BSDs do not have support last time I checked), this syscall finally lets you execute a program just given a file descriptor for the file. I say finally, as Linux only implemented this in 3.19, which means it is hard to rely on it (yeah, stop using those stupid old kernels folks). Before that Glibc had a terrible userspace implementation that is basically useless. Perfect for creating sandboxes, as you can sandbox a program into a filesystem with nothing at all in, or with a totally controlled tree, by opening the file to execute before chroot or changing the namespace.
6. pdfork
&amp;gt; Too cool for Linux, you have to head out to FreeBSD for this one. Like fork, but you get a file descriptor for the process not a pid. Then you can throw it in the kqueue or send it to another process. Once you have tried process descriptors you will never go back.
7. signalfd
&amp;gt; You might detect a theme here, but if you have ever written traditional 1980s style signal handlers you know how much they suck. How about turning your signals into messages that you can read on, you guessed it, file descriptors. Like, usable.
8. wstat
&amp;gt; This one is from Plan 9. It does the opposite of stat and writes the same structure. Simples. Avoids having chmod, chown, rename, utime and so on, by the simple expedient of making the syscall symmetric. Why not?
9. clonefile
&amp;gt; The only cool syscall on OSX, and only supported on the new APFS filesystem. Copies whole files or directories on a single syscall using copy on write for all the data. Look on my works, copyfilerange and despair.
10. pledge
&amp;gt; The little sandbox that worked. OpenBSD only here, they managed to make a simple sandbox that was practical for real programs, like the base OpenBSD system. Capsicum form FreeBSD (and promised for Linux for years but no sign) is a lovely design, and gave us pdfork, but its still kind of difficult and intrusive to implement. Linux has, well, seccomp, LSMs, and still nothing that usable for the average program.
###Eleven syscalls that suck (https://www.cloudatomiclab.com/antisyscall/)
0. ioctl
&amp;gt; It can‘t decide if it‘s arguments are integers, strings, or some struct that is lost in the midst of time. Make up your mind! Plan 9 was invented to get rid of this.
1. fcntl
&amp;gt; Just like ioctl but for some different miscellaneous operations, because one miscelleny is not enough.
2. tuxcall
&amp;gt; Linux put a web server in the kernel! To win a benchmark contest with Microsoft! It had it‘s own syscall! My enum tux_reactions are YUK! Don‘t worry though, it was a distro patch (thanks Red Hat!) and never made it upstream, so only the man page and reserved number survive to taunt you and remind you that the path of the righteous is beset by premature optmization!
3. iosetup
&amp;gt; The Linux asynchronous IO syscalls are almost entirely useless! Almost nothing works! You have to use ODIRECT for a start. And then they still barely work! They have one use, benchmarking SSDs, to show what speed you could get if only there was a usable API. Want async IO in kernel? Use Windows!
4. stat, and its friends and relatives
&amp;gt; Yes this one is useful, but can you find the data structure it uses? We have oldstat, oldfstat, ustat, oldlstat, statfs, fstatfs, stat, lstat, fstat, stat64, lstat64, fstat64, statfs64, fstatfs64, fstatat64 for stating files and links and filesystems in Linux. A new bunch will be along soon for Y2038. Simplify your life, use a BSD, where they cleaned up the mess as they did the cooking! Linux on 32 bit platforms is just sucky in comparison, and will get worse. And don’t even look at MIPS, where the padding is wrong.
5. Linux on MIPS
&amp;gt; Not a syscall, a whole implemntation of the Linux ABI. Unlike the lovely clean BSDs, Linux is different on each architecture, system calls randomly take arguments in different orders, and constants have different values, and there are special syscalls. But MIPS takes the biscuit, the whole packet of biscuits. It was made to be binary compatible with old SGI machines that don’t even exist, and has more syscall ABIs than I have had hot dinners. Clean it up! Make a new sane MIPS ABI and deprecate the old ones, nothing like adding another variant. So annoying I think I threw out all my MIPS machines, each different.
6. inotify, fanotify and friends
&amp;gt; Linux has no fewer than three file system change notification protocols. The first, dnotify hopped on ioctl‘s sidekick fcntl, while the two later ones, inotify and fanotify added a bunch more syscalls. You can use any of them, and they still will not provide the notification API you want for most applications. Most people use the second one, inotify and curse it. Did you know kqueue can do this on the BSDs?
7. personality
&amp;gt; Oozing in personality, but we just don’t get along. Basically obsolete, as the kernel can decide what kind of system emulation to do from binaries directly, it stays around with some use cases in persuading ./configure it is running on a 32 bit system. But it can turn off ASLR, and let the CVEs right into your system. We need less persoanlity!
8. gettimeofday
&amp;gt; Still has an obsolete timezone value from an old times when people thought timezones should go all the way to the kernel. Now we know that your computer should not know. Set its clock to UTC. Do the timezones in the UI based on where the user is, not the computer. You should use clock_gettime now. Don’t even talk to me about locales. This syscall is fast though, don’t use it for benchmarking, its in the VDSO.
9. splice and tee
&amp;gt; These, back in 2005 were a quite nice idea, although Linux said then “it is incomplete, the interfaces are ugly, and it will oops the system if anything goes wrong”. It won’t oops your system now, but usage has not taken off. The nice idea from Linus was that a pipe is just a ring buffer in the kernel, that can have a more general API and use cases for performant code, but a decade on it hasn’t really worked out. It was also supposed to be a more general sendfile, which in many ways was the successor of that Tux web server, but I think sendfile is still more widely used.
10. userfaultfd
&amp;gt; Yes, I like file descriptors. Yes CRIU is kind of cool. But userspace handling page faults? Is nothing sacred? I get that you can do this badly with a SIGSEGV handler, but talk about lipstick on a pig.
***
###OpenBSD 6.0 on an iMac G3 from 1999 (http://www.increasinglyadequate.com/macppc.html)
&amp;gt; A while ago I spent $50 for an iMac G3 (aka the iMac,1). This iconic model restored Apple's fortunes in the late '90s. Since the iMac G3 can still boot Mac OSes 8 and 9, I mostly use the machine to indulge a nostalgia for childhood schooldays spent poking at the operating system and playing Escape Velocity. But before I got around to that, I decided to try out the software that the previous owner had left on the machine. The antiquated OSX 10.2 install and 12 year old versions of Safari and Internet Explorer were too slow and old to use for anything. Updating to newer software was almost impossible; a later OSX is required to run the little PowerPC-compatible software still languishing in forgotten corners of the Internet. This got me thinking: could this machine be used, really used, nowadays? Lacking a newer OSX disc, I decided to try the most recent OpenBSD release. (And, since then, to re-try with each new OpenBSD release.) Below are the results of this experiment (plus a working xorg.conf file) and a few background notes.
Background
&amp;gt; This iMac is a Revision D iMac G3 in grape. It's part of the iMac,1 family of computers. This family includes all tray-loading iMac G3s. (Later iMac G3s had a slot-loading CD drive and different components.) Save for a slightly faster processor, a dedicated graphics card, and cosmetic tweaks to the case, my iMac is identical to the prior year's line-launching Bondi Blue iMac. My machine has had its memory upgraded from 32 MB to 320 MB. Thank Goodness.
&amp;gt; The Revision D iMac G3 shipped with Mac OS 8.5. It can run up to Mac OS 9.2.2 or OSX 10.3.9. Other operating systems that tout support for the iMac,1 include NetBSD, OpenBSD, and a shrinking number of Linux distributions.
&amp;gt; OpenBSD is simple (by design) and well-maintained. In contrast, NetBSD seems rather more complex and featureful, and I have heard grumbling that despite its reputation for portability, NetBSD really only works well on amd64. I'd test that assertion if OpenBSD's macppc installation instructions didn't seem much simpler than NetBSD's. Linux is even more complicated, although most distros are put together in a way that you can mostly ignore that complexity (until you can't). In the end I went with OpenBSD because I am familiar with it and because I like it.
Installing OpenBSD on the iMac,1
&amp;gt; Installing OpenBSD on this iMac was simple. It's the same procedure as installing OpenBSD on an amd64 rig. You put in the installation disc; you tell the machine to boot from it; and then you answer a few prompts, most of which simply ask you to press enter. In this case, OpenBSD recognizes all machine's hardware just fine, including sound and networking, though I had a little trouble with video.
&amp;gt; The OpenBSD documentation says video should just work and that an xorg.conf file isn't necessary. As such, it no longer ships with an xorg.conf file. Though that's never posed a problem on my other OpenBSD machines, it does here. Video doesn't work out of the box on my iMac,1. startx just blanks the screen. Fortunately, because the BSDs use a centralized development model where each operating system is stored in one repository, OpenBSD's website provides a web interface to the source code going back to the early days. I was able to find the last version of the sample xorg.conf that used to ship on macppc. With a little tweaking, I transformed that file into this one (https://www.increasinglyadequate.com/files/xorg.conf), with which video works just fine. Just drop it into your iMac's /etc/X11 directory. You'll also need to remember to set the machdep.allowaperture sysctl to 2 (e.g., as root run sysctl machdep.allowaperture=2), although the installer will do that automatically if you answer yes to the question about whether you plan to run X.
&amp;gt; All that being said, video performance is pretty poor. I am either doing something wrong, or OpenBSD doesn't have accelerated video for this iMac, or this machine is just really old! I will discuss performance below.
Running OpenBSD on the iMac,1
&amp;gt; The machine performs okay under OpenBSD. You can expect to ably run minimalistic software under minimalistic window managers. I tried dillo, mrxvt, and cmus under cwm and fvwm. Performance here was just fine. I also tried Firefox 26, 33, and 34 under fvwm and cwm. Firefox ran, but "modern," Javascript-heavy sites were an exercise in frustration; the 2015 version of CNN.com basically froze Firefox for 30 seconds or more. A lighter browser like dillo is doable.
&amp;gt; You'll notice that I used the past-tense to talk about Firefox. Firefox currently doesn't build on PowerPC on OpenBSD. Neither does Chromium. Neither do a fair number of applications. But whatever -- there's still a lot of lighter applications available, and it's these you'll use day-to-day on a decades-old machine.
&amp;gt; Lightweight window managers work okay, as you'd expect. You can even run heavier desktop environments, such as xfce, though you'll give up a lot of performance.
&amp;gt; I ran the Ubench benchmark on this iMac and two more modern machines also running OpenBSD. The benchmark seems like an old one; I don't know how (if at all) it accounts for hardware changes in the past 13 years. That is, I don't know if the difference in score accurately measures the difference in real-world performance. Here are the results anyway:
Conclusion
&amp;gt; Except for when I check to see if OpenBSD still works, I run Mac OS9 on this rig. I have faster and better machines for running OpenBSD. If I didn't -- if this rig were, improbably, all I had left, and I was waiting on the rush delivery of something modern -- then I would use OpenBSD on my iMac,1. I'd have to stick to lightweight applications, but at least they'd be up-to-date and running on a simple, stable, OS.
***
##News Roundup
###34th Chaos Communication Congress Schedule (https://events.ccc.de/congress/2017/Fahrplan/index.html)
Many talks are streamed live (http://streaming.media.ccc.de/34c3), a good mixture of english and german talks
May contain DTraces of FreeBSD (https://events.ccc.de/congress/2017/Fahrplan/events/9196.html)
Are all BSDs created equally? (https://events.ccc.de/congress/2017/Fahrplan/events/8968.html)
library operating systems (https://events.ccc.de/congress/2017/Fahrplan/events/8949.html)
Hardening Open Source Development (https://events.ccc.de/congress/2017/Fahrplan/events/9249.html)
***
###OpenBSD 6.2 + CDE (https://jamesdeagle.blogspot.co.uk/2017/12/openbsd-62-cde.html)
&amp;gt; If you've noticed a disruption in the time-space continuum recently, it is likely because I have finally been able to compile and install the Common Desktop Environment (CDE) in a current and actively-developed operating system (OpenBSD 6.2 in this case).
&amp;gt; This comes after so many attempts (across multiple platforms) that ended up with the build process prematurely stopping itself in its own tracks for a variety of infinitesimal reasons that were beyond my comprehension as a non-programmer, or when there was success it was not without some broken parts. As for the latter, I've been able to build CDE on OpenIndiana Hipster, but with an end product where I'm unable to change the color scheme in dtstyle (because "useColorObj" is set to "False"), with a default color scheme that is low-res and unpleasant. As for changing "useColorObj" to "True", I tried every recommended trick I could find online, but nothing worked. 
&amp;gt; My recent attempts at installing CDE on OpenBSD (version 6.1) saw the process stop due to a number of errors that are pure gibberish to these naive eyes. While disappointing, it was par for the course within my miserable experience with trying to build this particular desktop environment. As I wrote in this space in November 2015, in the course of explaining part of my imperitive for installing Solaris 10: 
&amp;gt; And so I have come to think of building the recently open-sourced CDE as being akin to a coffee mug I saw many years ago. One side of the mug read "Turn the mug to see how to keep an idiot busy." On the other side, it read "Turn the mug to see how to keep an idiot busy." I'm through feeling like an idiot, which is partially why I'm on this one-week journey with Solaris 10.
&amp;gt; While I thoroughly enjoyed running Solaris 10 on my ThinkPad T61p, and felt a devilish thrill at using it out in the open at my local MacBook- and iPhone-infested Starbucks and causing general befuddlement and consternation among the occasional prying yoga mom, I never felt like I could do much with it beyond explore the SunOS 5.10 command line and watch YouTube videos. While still supported by its current corporate owner (whose name I don't even want to type), it is no longer actively developed and is thus little more than a retro toy. I hated the idea of installing anything else over it, but productivity beckoned and it was time to tearfully and reluctantly drag myself off the dance floor.
&amp;gt; In any case, just last week I noticed that the Sourceforge page for the OpenBSD build had some 6.2-specific notes by way of a series of four patches, and so I decided 'what the heck, let's give this puppy another whirl'. After an initial abortive attempt at a build, I surmised that I hadn't applied the four patches correctly. A day or two later, I took a deep breath and tried again, this time resolving to not proceed with the time make World build command until I could see some sign of a successful patch process. (This time around, I downloaded the patches and moved them into the directory containing the CDE makefiles, and issued each patch command as patch  Once I had the thing up and running, and with a mind bursting with fruit flavor, I started messing about. The first order of business was to create a custom color scheme modelled after the default color scheme in UnixWare. (Despite any baggage that system carries from its previous ownership under SCO, I adored the aesthetics of UnixWare 7.1.4 two years ago when I installed the free one month trial version on my ThinkPad. For reasons that escape me now, I named my newly-created color scheme in honor of UnixWare 7.1.3.)
&amp;gt; Like a proud papa, I immediately tweeted the above screenshot and risked irritating a Linux kid or two in the process, given SCO's anti-climatic anti-Linux patent trolling from way back when. (I'm not out to irritate penguinistas, I just sure like this color scheme.)
Final Thoughts
&amp;gt; It may look a little clunky at first, and may be a little bling-challenged, but the more I use CDE and adapt to it, the more it feels like an extension of my brain. Perhaps this is because it has a lot zip and behaves in a consistent and coherent manner. (I don't want to go too much further down that road here, as OSnews's Thom Holwerda already gave a good rundown about ten years ago.)
&amp;gt; Now that I have succesfully paired my absolute favorite operating system with a desktop environment that has exerted an intense gravitational hold on me for many, many years, I don't anticipate distrohopping any time soon. And as I attain a more advanced knowledge of CDE, I'll be chronicling any new discoveries here for the sake of anyone following me from behind as I feel my way around this darkened room.
***
###devmatch(8) added to FreeBSD HEAD (https://www.mail-archive.com/svn-src-all@freebsd.org/msg154719.html)
```
Log:
Match unattached devices on the system to potential kernel modules.
  devmatch(8) matchs up devices in the system device tree with drivers
  that may match them. For each unattached device in the system, it
  tries to find matching PNP info in the linker hints and prints modules
  to load to claim the devices.
  In --unbound mode, devmatch can look for drivers that have attached to
  devices in the device tree and have plug and play information, but for
  which no PNP info exists. This helps find drivers that haven't been
  converted yet that are in use on this system.
  In addition, the ability to dump out linker.hints is provided.
  Future commits will add hooks to devd.conf and rc.d to fully automate
  using this information.
Added:
  head/usr.sbin/devmatch/
  head/usr.sbin/devmatch/Makefile   (contents, props changed)
  head/usr.sbin/devmatch/devmatch.8   (contents, props changed)
  head/usr.sbin/devmatch/devmatch.c   (contents, props changed)
Modified:
  head/usr.sbin/Makefile
Modified: head/usr.sbin/Makefile
```
+ Oh, you naughty committers: :-) https://www.mail-archive.com/svn-src-all@freebsd.org/msg154720.html
Beastie Bits
New FreeBSD Journal issue: Monitoring and Metrics (https://www.freebsdfoundation.org/journal/)
OpenBSD Engine Mix available on GOG.com (https://www.gog.com/mix/openbsd_engine_available)
OpenBSD Foundation reached their 2017 fundraising goal (http://www.openbsdfoundation.org/campaign2017.html)
TrueOS 17.12 Review – An Easy BSD (https://www.youtube.com/watch?v=nKr1GCsV-gA)
LibreSSL 2.6.4 Released (https://bsdsec.net/articles/libressl-2-6-4-released-fixed)
***
##Feedback/Questions
Mike - BSD 217 &amp;amp; Winning over Linux Users (http://dpaste.com/3AB7J4P#wrap)
JLR - Boot Environments Broken? (http://dpaste.com/2K0ZDH9#wrap)
Kevr - ZFS question and suggestion (http://dpaste.com/04MXA5P#wrap)
Ivan - FreeBSD read cache - ZFS (http://dpaste.com/1P9ETGQ#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We read the FreeBSD Q3 status report, explore good and bad syscalls, list GOG Games for OpenBSD, and show you what devmatch can do.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2017-December/001818.html" rel="nofollow">FreeBSD Q3 Status Report 2017</a></h3>

<ul>
<li>FreeBSD Team Reports

<ul>
<li>FreeBSD Release Engineering Team</li>
<li>Ports Collection</li>
<li>The FreeBSD Core Team</li>
<li>The FreeBSD Foundation</li>
</ul></li>
<li>Projects

<ul>
<li>FreeBSD CI</li>
</ul></li>
<li>Kernel

<ul>
<li>Intel 10G iflib Driver Update</li>
<li>Intel iWARP Support</li>
<li>pNFS Server Plan B</li>
</ul></li>
<li>Architectures

<ul>
<li>AMD Zen (family 17h) support</li>
</ul></li>
<li>Userland Programs

<ul>
<li>Updates to GDB</li>
</ul></li>
<li>Ports

<ul>
<li>FreeBSDDesktop</li>
<li>OpenJFX 8</li>
<li>Puppet</li>
</ul></li>
<li>Documentation

<ul>
<li>Absolute FreeBSD, 3rd Edition</li>
<li>Manual Pages</li>
</ul></li>
<li>Third-Party Projects

<ul>
<li>The nosh Project
####<a href="https://www.freebsdfoundation.org/wp-content/uploads/2017/12/FreeBSD-Foundation-Q4-Update.pdf" rel="nofollow">FreeBSD Foundation Q4 Update</a>
***
###<a href="https://www.cloudatomiclab.com/prosyscall/" rel="nofollow">11 syscalls that rock the world</a></li>
</ul></li>
<li>0. read
&gt; You cannot go wrong with a read. You can barely EFAULT it! On Linux amd64 it is syscall zero. If all its arguments are zero it returns zero. Cool!</li>
<li>1. pipe
&gt; The society for the preservation of historic calling conventions is very fond of pipe, as in many operating systems and architectures it preserves the fun feature of returning both of the file descriptors as return values. At least Linux MIPS does, and NetBSD does even on x86 and amd64. Multiple return values are making a comeback in languages like Lua and Go, but C has always had a bit of a funny thing about them, but they have long been supported in many calling conventions, so let us use them in syscalls! Well, one syscall.</li>
<li>2. kqueue
&gt; When the world went all C10K on our ass, and scaleable polling was a thing, Linux went epoll, the BSDs went kqueue and Solaris went /dev/poll. The nicest interface was kqueue, while epoll is some mix of edge and level triggered semantics and design errors so bugs are still being found.</li>
<li>3. unshare
&gt; Sounds like a selfish syscall, but this generous syscall call is the basis of Linux namespaces, allowing a process to isolate its resources. Containers are built from unshares.</li>
<li>4. setns
&gt; If you liked unshare, its younger but cooler friend takes file descriptors for namespaces. Pass it down a unix socket to another process, or stash it for later, and do that namespace switching. All the best system calls take file descriptors.</li>
<li>5. execveat
&gt; Despite its somewhat confusing name (FreeBSD has the saner fexecve, but other BSDs do not have support last time I checked), this syscall finally lets you execute a program just given a file descriptor for the file. I say finally, as Linux only implemented this in 3.19, which means it is hard to rely on it (yeah, stop using those stupid old kernels folks). Before that Glibc had a terrible userspace implementation that is basically useless. Perfect for creating sandboxes, as you can sandbox a program into a filesystem with nothing at all in, or with a totally controlled tree, by opening the file to execute before chroot or changing the namespace.</li>
<li>6. pdfork
&gt; Too cool for Linux, you have to head out to FreeBSD for this one. Like fork, but you get a file descriptor for the process not a pid. Then you can throw it in the kqueue or send it to another process. Once you have tried process descriptors you will never go back.</li>
<li>7. signalfd
&gt; You might detect a theme here, but if you have ever written traditional 1980s style signal handlers you know how much they suck. How about turning your signals into messages that you can read on, you guessed it, file descriptors. Like, usable.</li>
<li>8. wstat
&gt; This one is from Plan 9. It does the opposite of stat and writes the same structure. Simples. Avoids having chmod, chown, rename, utime and so on, by the simple expedient of making the syscall symmetric. Why not?</li>
<li>9. clonefile
&gt; The only cool syscall on OSX, and only supported on the new APFS filesystem. Copies whole files or directories on a single syscall using copy on write for all the data. Look on my works, copy_file_range and despair.</li>
<li>10. pledge
&gt; The little sandbox that worked. OpenBSD only here, they managed to make a simple sandbox that was practical for real programs, like the base OpenBSD system. Capsicum form FreeBSD (and promised for Linux for years but no sign) is a lovely design, and gave us pdfork, but its still kind of difficult and intrusive to implement. Linux has, well, seccomp, LSMs, and still nothing that usable for the average program.
###<a href="https://www.cloudatomiclab.com/antisyscall/" rel="nofollow">Eleven syscalls that suck</a></li>
<li>0. ioctl
&gt; It can‘t decide if it‘s arguments are integers, strings, or some struct that is lost in the midst of time. Make up your mind! Plan 9 was invented to get rid of this.</li>
<li>1. fcntl
&gt; Just like ioctl but for some different miscellaneous operations, because one miscelleny is not enough.</li>
<li>2. tuxcall
&gt; Linux put a web server in the kernel! To win a benchmark contest with Microsoft! It had it‘s own syscall! My enum tux_reactions are YUK! Don‘t worry though, it was a distro patch (thanks Red Hat!) and never made it upstream, so only the man page and reserved number survive to taunt you and remind you that the path of the righteous is beset by premature optmization!</li>
<li>3. io_setup
&gt; The Linux asynchronous IO syscalls are almost entirely useless! Almost nothing works! You have to use O_DIRECT for a start. And then they still barely work! They have one use, benchmarking SSDs, to show what speed you could get if only there was a usable API. Want async IO in kernel? Use Windows!</li>
<li>4. stat, and its friends and relatives
&gt; Yes this one is useful, but can you find the data structure it uses? We have oldstat, oldfstat, ustat, oldlstat, statfs, fstatfs, stat, lstat, fstat, stat64, lstat64, fstat64, statfs64, fstatfs64, fstatat64 for stating files and links and filesystems in Linux. A new bunch will be along soon for Y2038. Simplify your life, use a BSD, where they cleaned up the mess as they did the cooking! Linux on 32 bit platforms is just sucky in comparison, and will get worse. And don’t even look at MIPS, where the padding is wrong.</li>
<li>5. Linux on MIPS
&gt; Not a syscall, a whole implemntation of the Linux ABI. Unlike the lovely clean BSDs, Linux is different on each architecture, system calls randomly take arguments in different orders, and constants have different values, and there are special syscalls. But MIPS takes the biscuit, the whole packet of biscuits. It was made to be binary compatible with old SGI machines that don’t even exist, and has more syscall ABIs than I have had hot dinners. Clean it up! Make a new sane MIPS ABI and deprecate the old ones, nothing like adding another variant. So annoying I think I threw out all my MIPS machines, each different.</li>
<li>6. inotify, fanotify and friends
&gt; Linux has no fewer than three file system change notification protocols. The first, dnotify hopped on ioctl‘s sidekick fcntl, while the two later ones, inotify and fanotify added a bunch more syscalls. You can use any of them, and they still will not provide the notification API you want for most applications. Most people use the second one, inotify and curse it. Did you know kqueue can do this on the BSDs?</li>
<li>7. personality
&gt; Oozing in personality, but we just don’t get along. Basically obsolete, as the kernel can decide what kind of system emulation to do from binaries directly, it stays around with some use cases in persuading ./configure it is running on a 32 bit system. But it can turn off ASLR, and let the CVEs right into your system. We need less persoanlity!</li>
<li>8. gettimeofday
&gt; Still has an obsolete timezone value from an old times when people thought timezones should go all the way to the kernel. Now we know that your computer should not know. Set its clock to UTC. Do the timezones in the UI based on where the user is, not the computer. You should use clock_gettime now. Don’t even talk to me about locales. This syscall is fast though, don’t use it for benchmarking, its in the VDSO.</li>
<li>9. splice and tee
&gt; These, back in 2005 were a quite nice idea, although Linux said then “it is incomplete, the interfaces are ugly, and it will oops the system if anything goes wrong”. It won’t oops your system now, but usage has not taken off. The nice idea from Linus was that a pipe is just a ring buffer in the kernel, that can have a more general API and use cases for performant code, but a decade on it hasn’t really worked out. It was also supposed to be a more general sendfile, which in many ways was the successor of that Tux web server, but I think sendfile is still more widely used.</li>
<li>10. userfaultfd
&gt; Yes, I like file descriptors. Yes CRIU is kind of cool. But userspace handling page faults? Is nothing sacred? I get that you can do this badly with a SIGSEGV handler, but talk about lipstick on a pig.
***
###<a href="http://www.increasinglyadequate.com/macppc.html" rel="nofollow">OpenBSD 6.0 on an iMac G3 from 1999</a>
&gt; A while ago I spent $50 for an iMac G3 (aka the iMac,1). This iconic model restored Apple&#39;s fortunes in the late &#39;90s. Since the iMac G3 can still boot Mac OSes 8 and 9, I mostly use the machine to indulge a nostalgia for childhood schooldays spent poking at the operating system and playing Escape Velocity. But before I got around to that, I decided to try out the software that the previous owner had left on the machine. The antiquated OSX 10.2 install and 12 year old versions of Safari and Internet Explorer were too slow and old to use for anything. Updating to newer software was almost impossible; a later OSX is required to run the little PowerPC-compatible software still languishing in forgotten corners of the Internet. This got me thinking: could this machine be used, really used, nowadays? Lacking a newer OSX disc, I decided to try the most recent OpenBSD release. (And, since then, to re-try with each new OpenBSD release.) Below are the results of this experiment (plus a working xorg.conf file) and a few background notes.</li>
<li>Background
&gt; This iMac is a Revision D iMac G3 in grape. It&#39;s part of the iMac,1 family of computers. This family includes all tray-loading iMac G3s. (Later iMac G3s had a slot-loading CD drive and different components.) Save for a slightly faster processor, a dedicated graphics card, and cosmetic tweaks to the case, my iMac is identical to the prior year&#39;s line-launching Bondi Blue iMac. My machine has had its memory upgraded from 32 MB to 320 MB. Thank Goodness.
&gt; The Revision D iMac G3 shipped with Mac OS 8.5. It can run up to Mac OS 9.2.2 or OSX 10.3.9. Other operating systems that tout support for the iMac,1 include NetBSD, OpenBSD, and a shrinking number of Linux distributions.
&gt; OpenBSD is simple (by design) and well-maintained. In contrast, NetBSD seems rather more complex and featureful, and I have heard grumbling that despite its reputation for portability, NetBSD really only works well on amd64. I&#39;d test that assertion if OpenBSD&#39;s macppc installation instructions didn&#39;t seem much simpler than NetBSD&#39;s. Linux is even more complicated, although most distros are put together in a way that you can mostly ignore that complexity (until you can&#39;t). In the end I went with OpenBSD because I am familiar with it and because I like it.</li>
<li>Installing OpenBSD on the iMac,1
&gt; Installing OpenBSD on this iMac was simple. It&#39;s the same procedure as installing OpenBSD on an amd64 rig. You put in the installation disc; you tell the machine to boot from it; and then you answer a few prompts, most of which simply ask you to press enter. In this case, OpenBSD recognizes all machine&#39;s hardware just fine, including sound and networking, though I had a little trouble with video.
&gt; The OpenBSD documentation says video should just work and that an xorg.conf file isn&#39;t necessary. As such, it no longer ships with an xorg.conf file. Though that&#39;s never posed a problem on my other OpenBSD machines, it does here. Video doesn&#39;t work out of the box on my iMac,1. startx just blanks the screen. Fortunately, because the BSDs use a centralized development model where each operating system is stored in one repository, OpenBSD&#39;s website provides a web interface to the source code going back to the early days. I was able to find the last version of the sample xorg.conf that used to ship on macppc. With a little tweaking, I transformed that file into <a href="https://www.increasinglyadequate.com/files/xorg.conf" rel="nofollow">this one</a>, with which video works just fine. Just drop it into your iMac&#39;s /etc/X11 directory. You&#39;ll also need to remember to set the machdep.allowaperture sysctl to 2 (e.g., as root run sysctl machdep.allowaperture=2), although the installer will do that automatically if you answer yes to the question about whether you plan to run X.
&gt; All that being said, video performance is pretty poor. I am either doing something wrong, or OpenBSD doesn&#39;t have accelerated video for this iMac, or this machine is just really old! I will discuss performance below.</li>
<li>Running OpenBSD on the iMac,1
&gt; The machine performs okay under OpenBSD. You can expect to ably run minimalistic software under minimalistic window managers. I tried dillo, mrxvt, and cmus under cwm and fvwm. Performance here was just fine. I also tried Firefox 26, 33, and 34 under fvwm and cwm. Firefox ran, but &quot;modern,&quot; Javascript-heavy sites were an exercise in frustration; the 2015 version of CNN.com basically froze Firefox for 30 seconds or more. A lighter browser like dillo is doable.
&gt; You&#39;ll notice that I used the past-tense to talk about Firefox. Firefox currently doesn&#39;t build on PowerPC on OpenBSD. Neither does Chromium. Neither do a fair number of applications. But whatever -- there&#39;s still a lot of lighter applications available, and it&#39;s these you&#39;ll use day-to-day on a decades-old machine.
&gt; Lightweight window managers work okay, as you&#39;d expect. You can even run heavier desktop environments, such as xfce, though you&#39;ll give up a lot of performance.
&gt; I ran the Ubench benchmark on this iMac and two more modern machines also running OpenBSD. The benchmark seems like an old one; I don&#39;t know how (if at all) it accounts for hardware changes in the past 13 years. That is, I don&#39;t know if the difference in score accurately measures the difference in real-world performance. Here are the results anyway:</li>
<li>Conclusion
&gt; Except for when I check to see if OpenBSD still works, I run Mac OS9 on this rig. I have faster and better machines for running OpenBSD. If I didn&#39;t -- if this rig were, improbably, all I had left, and I was waiting on the rush delivery of something modern -- then I would use OpenBSD on my iMac,1. I&#39;d have to stick to lightweight applications, but at least they&#39;d be up-to-date and running on a simple, stable, OS.
***
##News Roundup
###<a href="https://events.ccc.de/congress/2017/Fahrplan/index.html" rel="nofollow">34th Chaos Communication Congress Schedule</a></li>
<li>Many talks are <a href="http://streaming.media.ccc.de/34c3" rel="nofollow">streamed live</a>, a good mixture of english and german talks</li>
<li><a href="https://events.ccc.de/congress/2017/Fahrplan/events/9196.html" rel="nofollow">May contain DTraces of FreeBSD</a></li>
<li><a href="https://events.ccc.de/congress/2017/Fahrplan/events/8968.html" rel="nofollow">Are all BSDs created equally?</a></li>
<li><a href="https://events.ccc.de/congress/2017/Fahrplan/events/8949.html" rel="nofollow">library operating systems</a></li>
<li><a href="https://events.ccc.de/congress/2017/Fahrplan/events/9249.html" rel="nofollow">Hardening Open Source Development</a>
***
###<a href="https://jamesdeagle.blogspot.co.uk/2017/12/openbsd-62-cde.html" rel="nofollow">OpenBSD 6.2 + CDE</a>
&gt; If you&#39;ve noticed a disruption in the time-space continuum recently, it is likely because I have finally been able to compile and install the Common Desktop Environment (CDE) in a current and actively-developed operating system (OpenBSD 6.2 in this case).
&gt; This comes after so many attempts (across multiple platforms) that ended up with the build process prematurely stopping itself in its own tracks for a variety of infinitesimal reasons that were beyond my comprehension as a non-programmer, or when there was success it was not without some broken parts. As for the latter, I&#39;ve been able to build CDE on OpenIndiana Hipster, but with an end product where I&#39;m unable to change the color scheme in dtstyle (because &quot;useColorObj&quot; is set to &quot;False&quot;), with a default color scheme that is low-res and unpleasant. As for changing &quot;useColorObj&quot; to &quot;True&quot;, I tried every recommended trick I could find online, but nothing worked. 
&gt; My recent attempts at installing CDE on OpenBSD (version 6.1) saw the process stop due to a number of errors that are pure gibberish to these naive eyes. While disappointing, it was par for the course within my miserable experience with trying to build this particular desktop environment. As I wrote in this space in November 2015, in the course of explaining part of my imperitive for installing Solaris 10: 
&gt; And so I have come to think of building the recently open-sourced CDE as being akin to a coffee mug I saw many years ago. One side of the mug read &quot;Turn the mug to see how to keep an idiot busy.&quot; On the other side, it read &quot;Turn the mug to see how to keep an idiot busy.&quot; I&#39;m through feeling like an idiot, which is partially why I&#39;m on this one-week journey with Solaris 10.
&gt; While I thoroughly enjoyed running Solaris 10 on my ThinkPad T61p, and felt a devilish thrill at using it out in the open at my local MacBook- and iPhone-infested Starbucks and causing general befuddlement and consternation among the occasional prying yoga mom, I never felt like I could do much with it beyond explore the SunOS 5.10 command line and watch YouTube videos. While still supported by its current corporate owner (whose name I don&#39;t even want to type), it is no longer actively developed and is thus little more than a retro toy. I hated the idea of installing anything else over it, but productivity beckoned and it was time to tearfully and reluctantly drag myself off the dance floor.
&gt; In any case, just last week I noticed that the Sourceforge page for the OpenBSD build had some 6.2-specific notes by way of a series of four patches, and so I decided &#39;what the heck, let&#39;s give this puppy another whirl&#39;. After an initial abortive attempt at a build, I surmised that I hadn&#39;t applied the four patches correctly. A day or two later, I took a deep breath and tried again, this time resolving to not proceed with the time make World build command until I could see some sign of a successful patch process. (This time around, I downloaded the patches and moved them into the directory containing the CDE makefiles, and issued each patch command as patch <filename.patch and then reading the output carefully to determine which file in the source code was to be patched, and entering the filename when asked.)
> Once I had the thing up and running, and with a mind bursting with fruit flavor, I started messing about. The first order of business was to create a custom color scheme modelled after the default color scheme in UnixWare. (Despite any baggage that system carries from its previous ownership under SCO, I adored the aesthetics of UnixWare 7.1.4 two years ago when I installed the free one month trial version on my ThinkPad. For reasons that escape me now, I named my newly-created color scheme in honor of UnixWare 7.1.3.)
&gt; Like a proud papa, I immediately tweeted the above screenshot and risked irritating a Linux kid or two in the process, given SCO&#39;s anti-climatic anti-Linux patent trolling from way back when. (I&#39;m not out to irritate penguinistas, I just sure like this color scheme.)</li>
<li>Final Thoughts
&gt; It may look a little clunky at first, and may be a little bling-challenged, but the more I use CDE and adapt to it, the more it feels like an extension of my brain. Perhaps this is because it has a lot zip and behaves in a consistent and coherent manner. (I don&#39;t want to go too much further down that road here, as OSnews&#39;s Thom Holwerda already gave a good rundown about ten years ago.)
&gt; Now that I have succesfully paired my absolute favorite operating system with a desktop environment that has exerted an intense gravitational hold on me for many, many years, I don&#39;t anticipate distrohopping any time soon. And as I attain a more advanced knowledge of CDE, I&#39;ll be chronicling any new discoveries here for the sake of anyone following me from behind as I feel my way around this darkened room.
***
###<a href="https://www.mail-archive.com/svn-src-all@freebsd.org/msg154719.html" rel="nofollow">devmatch(8) added to FreeBSD HEAD</a>
```
Log:
Match unattached devices on the system to potential kernel modules.</li>
</ul>

<p>devmatch(8) matchs up devices in the system device tree with drivers<br>
  that may match them. For each unattached device in the system, it<br>
  tries to find matching PNP info in the linker hints and prints modules<br>
  to load to claim the devices.</p>

<p>In --unbound mode, devmatch can look for drivers that have attached to<br>
  devices in the device tree and have plug and play information, but for<br>
  which no PNP info exists. This helps find drivers that haven&#39;t been<br>
  converted yet that are in use on this system.</p>

<p>In addition, the ability to dump out linker.hints is provided.</p>

<p>Future commits will add hooks to devd.conf and rc.d to fully automate<br>
  using this information.<br>
Added:<br>
  head/usr.sbin/devmatch/<br>
  head/usr.sbin/devmatch/Makefile   (contents, props changed)<br>
  head/usr.sbin/devmatch/devmatch.8   (contents, props changed)<br>
  head/usr.sbin/devmatch/devmatch.c   (contents, props changed)<br>
Modified:<br>
  head/usr.sbin/Makefile<br>
Modified: head/usr.sbin/Makefile</p>

<pre><code>+ Oh, you naughty committers: :-) https://www.mail-archive.com/svn-src-all@freebsd.org/msg154720.html
***
##Beastie Bits
+ [New FreeBSD Journal issue: Monitoring and Metrics](https://www.freebsdfoundation.org/journal/)
+ [OpenBSD Engine Mix available on GOG.com](https://www.gog.com/mix/openbsd_engine_available)
+ [OpenBSD Foundation reached their 2017 fundraising goal](http://www.openbsdfoundation.org/campaign2017.html)
+ [TrueOS 17.12 Review – An Easy BSD](https://www.youtube.com/watch?v=nKr1GCsV-gA)
+ [LibreSSL 2.6.4 Released](https://bsdsec.net/articles/libressl-2-6-4-released-fixed)
***
##Feedback/Questions
+ Mike - [BSD 217 &amp; Winning over Linux Users](http://dpaste.com/3AB7J4P#wrap)
+ JLR - [Boot Environments Broken?](http://dpaste.com/2K0ZDH9#wrap)
+ Kevr - [ZFS question and suggestion](http://dpaste.com/04MXA5P#wrap)
+ Ivan - [FreeBSD read cache - ZFS](http://dpaste.com/1P9ETGQ#wrap)
***
</code></pre>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We read the FreeBSD Q3 status report, explore good and bad syscalls, list GOG Games for OpenBSD, and show you what devmatch can do.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2017-December/001818.html" rel="nofollow">FreeBSD Q3 Status Report 2017</a></h3>

<ul>
<li>FreeBSD Team Reports

<ul>
<li>FreeBSD Release Engineering Team</li>
<li>Ports Collection</li>
<li>The FreeBSD Core Team</li>
<li>The FreeBSD Foundation</li>
</ul></li>
<li>Projects

<ul>
<li>FreeBSD CI</li>
</ul></li>
<li>Kernel

<ul>
<li>Intel 10G iflib Driver Update</li>
<li>Intel iWARP Support</li>
<li>pNFS Server Plan B</li>
</ul></li>
<li>Architectures

<ul>
<li>AMD Zen (family 17h) support</li>
</ul></li>
<li>Userland Programs

<ul>
<li>Updates to GDB</li>
</ul></li>
<li>Ports

<ul>
<li>FreeBSDDesktop</li>
<li>OpenJFX 8</li>
<li>Puppet</li>
</ul></li>
<li>Documentation

<ul>
<li>Absolute FreeBSD, 3rd Edition</li>
<li>Manual Pages</li>
</ul></li>
<li>Third-Party Projects

<ul>
<li>The nosh Project
####<a href="https://www.freebsdfoundation.org/wp-content/uploads/2017/12/FreeBSD-Foundation-Q4-Update.pdf" rel="nofollow">FreeBSD Foundation Q4 Update</a>
***
###<a href="https://www.cloudatomiclab.com/prosyscall/" rel="nofollow">11 syscalls that rock the world</a></li>
</ul></li>
<li>0. read
&gt; You cannot go wrong with a read. You can barely EFAULT it! On Linux amd64 it is syscall zero. If all its arguments are zero it returns zero. Cool!</li>
<li>1. pipe
&gt; The society for the preservation of historic calling conventions is very fond of pipe, as in many operating systems and architectures it preserves the fun feature of returning both of the file descriptors as return values. At least Linux MIPS does, and NetBSD does even on x86 and amd64. Multiple return values are making a comeback in languages like Lua and Go, but C has always had a bit of a funny thing about them, but they have long been supported in many calling conventions, so let us use them in syscalls! Well, one syscall.</li>
<li>2. kqueue
&gt; When the world went all C10K on our ass, and scaleable polling was a thing, Linux went epoll, the BSDs went kqueue and Solaris went /dev/poll. The nicest interface was kqueue, while epoll is some mix of edge and level triggered semantics and design errors so bugs are still being found.</li>
<li>3. unshare
&gt; Sounds like a selfish syscall, but this generous syscall call is the basis of Linux namespaces, allowing a process to isolate its resources. Containers are built from unshares.</li>
<li>4. setns
&gt; If you liked unshare, its younger but cooler friend takes file descriptors for namespaces. Pass it down a unix socket to another process, or stash it for later, and do that namespace switching. All the best system calls take file descriptors.</li>
<li>5. execveat
&gt; Despite its somewhat confusing name (FreeBSD has the saner fexecve, but other BSDs do not have support last time I checked), this syscall finally lets you execute a program just given a file descriptor for the file. I say finally, as Linux only implemented this in 3.19, which means it is hard to rely on it (yeah, stop using those stupid old kernels folks). Before that Glibc had a terrible userspace implementation that is basically useless. Perfect for creating sandboxes, as you can sandbox a program into a filesystem with nothing at all in, or with a totally controlled tree, by opening the file to execute before chroot or changing the namespace.</li>
<li>6. pdfork
&gt; Too cool for Linux, you have to head out to FreeBSD for this one. Like fork, but you get a file descriptor for the process not a pid. Then you can throw it in the kqueue or send it to another process. Once you have tried process descriptors you will never go back.</li>
<li>7. signalfd
&gt; You might detect a theme here, but if you have ever written traditional 1980s style signal handlers you know how much they suck. How about turning your signals into messages that you can read on, you guessed it, file descriptors. Like, usable.</li>
<li>8. wstat
&gt; This one is from Plan 9. It does the opposite of stat and writes the same structure. Simples. Avoids having chmod, chown, rename, utime and so on, by the simple expedient of making the syscall symmetric. Why not?</li>
<li>9. clonefile
&gt; The only cool syscall on OSX, and only supported on the new APFS filesystem. Copies whole files or directories on a single syscall using copy on write for all the data. Look on my works, copy_file_range and despair.</li>
<li>10. pledge
&gt; The little sandbox that worked. OpenBSD only here, they managed to make a simple sandbox that was practical for real programs, like the base OpenBSD system. Capsicum form FreeBSD (and promised for Linux for years but no sign) is a lovely design, and gave us pdfork, but its still kind of difficult and intrusive to implement. Linux has, well, seccomp, LSMs, and still nothing that usable for the average program.
###<a href="https://www.cloudatomiclab.com/antisyscall/" rel="nofollow">Eleven syscalls that suck</a></li>
<li>0. ioctl
&gt; It can‘t decide if it‘s arguments are integers, strings, or some struct that is lost in the midst of time. Make up your mind! Plan 9 was invented to get rid of this.</li>
<li>1. fcntl
&gt; Just like ioctl but for some different miscellaneous operations, because one miscelleny is not enough.</li>
<li>2. tuxcall
&gt; Linux put a web server in the kernel! To win a benchmark contest with Microsoft! It had it‘s own syscall! My enum tux_reactions are YUK! Don‘t worry though, it was a distro patch (thanks Red Hat!) and never made it upstream, so only the man page and reserved number survive to taunt you and remind you that the path of the righteous is beset by premature optmization!</li>
<li>3. io_setup
&gt; The Linux asynchronous IO syscalls are almost entirely useless! Almost nothing works! You have to use O_DIRECT for a start. And then they still barely work! They have one use, benchmarking SSDs, to show what speed you could get if only there was a usable API. Want async IO in kernel? Use Windows!</li>
<li>4. stat, and its friends and relatives
&gt; Yes this one is useful, but can you find the data structure it uses? We have oldstat, oldfstat, ustat, oldlstat, statfs, fstatfs, stat, lstat, fstat, stat64, lstat64, fstat64, statfs64, fstatfs64, fstatat64 for stating files and links and filesystems in Linux. A new bunch will be along soon for Y2038. Simplify your life, use a BSD, where they cleaned up the mess as they did the cooking! Linux on 32 bit platforms is just sucky in comparison, and will get worse. And don’t even look at MIPS, where the padding is wrong.</li>
<li>5. Linux on MIPS
&gt; Not a syscall, a whole implemntation of the Linux ABI. Unlike the lovely clean BSDs, Linux is different on each architecture, system calls randomly take arguments in different orders, and constants have different values, and there are special syscalls. But MIPS takes the biscuit, the whole packet of biscuits. It was made to be binary compatible with old SGI machines that don’t even exist, and has more syscall ABIs than I have had hot dinners. Clean it up! Make a new sane MIPS ABI and deprecate the old ones, nothing like adding another variant. So annoying I think I threw out all my MIPS machines, each different.</li>
<li>6. inotify, fanotify and friends
&gt; Linux has no fewer than three file system change notification protocols. The first, dnotify hopped on ioctl‘s sidekick fcntl, while the two later ones, inotify and fanotify added a bunch more syscalls. You can use any of them, and they still will not provide the notification API you want for most applications. Most people use the second one, inotify and curse it. Did you know kqueue can do this on the BSDs?</li>
<li>7. personality
&gt; Oozing in personality, but we just don’t get along. Basically obsolete, as the kernel can decide what kind of system emulation to do from binaries directly, it stays around with some use cases in persuading ./configure it is running on a 32 bit system. But it can turn off ASLR, and let the CVEs right into your system. We need less persoanlity!</li>
<li>8. gettimeofday
&gt; Still has an obsolete timezone value from an old times when people thought timezones should go all the way to the kernel. Now we know that your computer should not know. Set its clock to UTC. Do the timezones in the UI based on where the user is, not the computer. You should use clock_gettime now. Don’t even talk to me about locales. This syscall is fast though, don’t use it for benchmarking, its in the VDSO.</li>
<li>9. splice and tee
&gt; These, back in 2005 were a quite nice idea, although Linux said then “it is incomplete, the interfaces are ugly, and it will oops the system if anything goes wrong”. It won’t oops your system now, but usage has not taken off. The nice idea from Linus was that a pipe is just a ring buffer in the kernel, that can have a more general API and use cases for performant code, but a decade on it hasn’t really worked out. It was also supposed to be a more general sendfile, which in many ways was the successor of that Tux web server, but I think sendfile is still more widely used.</li>
<li>10. userfaultfd
&gt; Yes, I like file descriptors. Yes CRIU is kind of cool. But userspace handling page faults? Is nothing sacred? I get that you can do this badly with a SIGSEGV handler, but talk about lipstick on a pig.
***
###<a href="http://www.increasinglyadequate.com/macppc.html" rel="nofollow">OpenBSD 6.0 on an iMac G3 from 1999</a>
&gt; A while ago I spent $50 for an iMac G3 (aka the iMac,1). This iconic model restored Apple&#39;s fortunes in the late &#39;90s. Since the iMac G3 can still boot Mac OSes 8 and 9, I mostly use the machine to indulge a nostalgia for childhood schooldays spent poking at the operating system and playing Escape Velocity. But before I got around to that, I decided to try out the software that the previous owner had left on the machine. The antiquated OSX 10.2 install and 12 year old versions of Safari and Internet Explorer were too slow and old to use for anything. Updating to newer software was almost impossible; a later OSX is required to run the little PowerPC-compatible software still languishing in forgotten corners of the Internet. This got me thinking: could this machine be used, really used, nowadays? Lacking a newer OSX disc, I decided to try the most recent OpenBSD release. (And, since then, to re-try with each new OpenBSD release.) Below are the results of this experiment (plus a working xorg.conf file) and a few background notes.</li>
<li>Background
&gt; This iMac is a Revision D iMac G3 in grape. It&#39;s part of the iMac,1 family of computers. This family includes all tray-loading iMac G3s. (Later iMac G3s had a slot-loading CD drive and different components.) Save for a slightly faster processor, a dedicated graphics card, and cosmetic tweaks to the case, my iMac is identical to the prior year&#39;s line-launching Bondi Blue iMac. My machine has had its memory upgraded from 32 MB to 320 MB. Thank Goodness.
&gt; The Revision D iMac G3 shipped with Mac OS 8.5. It can run up to Mac OS 9.2.2 or OSX 10.3.9. Other operating systems that tout support for the iMac,1 include NetBSD, OpenBSD, and a shrinking number of Linux distributions.
&gt; OpenBSD is simple (by design) and well-maintained. In contrast, NetBSD seems rather more complex and featureful, and I have heard grumbling that despite its reputation for portability, NetBSD really only works well on amd64. I&#39;d test that assertion if OpenBSD&#39;s macppc installation instructions didn&#39;t seem much simpler than NetBSD&#39;s. Linux is even more complicated, although most distros are put together in a way that you can mostly ignore that complexity (until you can&#39;t). In the end I went with OpenBSD because I am familiar with it and because I like it.</li>
<li>Installing OpenBSD on the iMac,1
&gt; Installing OpenBSD on this iMac was simple. It&#39;s the same procedure as installing OpenBSD on an amd64 rig. You put in the installation disc; you tell the machine to boot from it; and then you answer a few prompts, most of which simply ask you to press enter. In this case, OpenBSD recognizes all machine&#39;s hardware just fine, including sound and networking, though I had a little trouble with video.
&gt; The OpenBSD documentation says video should just work and that an xorg.conf file isn&#39;t necessary. As such, it no longer ships with an xorg.conf file. Though that&#39;s never posed a problem on my other OpenBSD machines, it does here. Video doesn&#39;t work out of the box on my iMac,1. startx just blanks the screen. Fortunately, because the BSDs use a centralized development model where each operating system is stored in one repository, OpenBSD&#39;s website provides a web interface to the source code going back to the early days. I was able to find the last version of the sample xorg.conf that used to ship on macppc. With a little tweaking, I transformed that file into <a href="https://www.increasinglyadequate.com/files/xorg.conf" rel="nofollow">this one</a>, with which video works just fine. Just drop it into your iMac&#39;s /etc/X11 directory. You&#39;ll also need to remember to set the machdep.allowaperture sysctl to 2 (e.g., as root run sysctl machdep.allowaperture=2), although the installer will do that automatically if you answer yes to the question about whether you plan to run X.
&gt; All that being said, video performance is pretty poor. I am either doing something wrong, or OpenBSD doesn&#39;t have accelerated video for this iMac, or this machine is just really old! I will discuss performance below.</li>
<li>Running OpenBSD on the iMac,1
&gt; The machine performs okay under OpenBSD. You can expect to ably run minimalistic software under minimalistic window managers. I tried dillo, mrxvt, and cmus under cwm and fvwm. Performance here was just fine. I also tried Firefox 26, 33, and 34 under fvwm and cwm. Firefox ran, but &quot;modern,&quot; Javascript-heavy sites were an exercise in frustration; the 2015 version of CNN.com basically froze Firefox for 30 seconds or more. A lighter browser like dillo is doable.
&gt; You&#39;ll notice that I used the past-tense to talk about Firefox. Firefox currently doesn&#39;t build on PowerPC on OpenBSD. Neither does Chromium. Neither do a fair number of applications. But whatever -- there&#39;s still a lot of lighter applications available, and it&#39;s these you&#39;ll use day-to-day on a decades-old machine.
&gt; Lightweight window managers work okay, as you&#39;d expect. You can even run heavier desktop environments, such as xfce, though you&#39;ll give up a lot of performance.
&gt; I ran the Ubench benchmark on this iMac and two more modern machines also running OpenBSD. The benchmark seems like an old one; I don&#39;t know how (if at all) it accounts for hardware changes in the past 13 years. That is, I don&#39;t know if the difference in score accurately measures the difference in real-world performance. Here are the results anyway:</li>
<li>Conclusion
&gt; Except for when I check to see if OpenBSD still works, I run Mac OS9 on this rig. I have faster and better machines for running OpenBSD. If I didn&#39;t -- if this rig were, improbably, all I had left, and I was waiting on the rush delivery of something modern -- then I would use OpenBSD on my iMac,1. I&#39;d have to stick to lightweight applications, but at least they&#39;d be up-to-date and running on a simple, stable, OS.
***
##News Roundup
###<a href="https://events.ccc.de/congress/2017/Fahrplan/index.html" rel="nofollow">34th Chaos Communication Congress Schedule</a></li>
<li>Many talks are <a href="http://streaming.media.ccc.de/34c3" rel="nofollow">streamed live</a>, a good mixture of english and german talks</li>
<li><a href="https://events.ccc.de/congress/2017/Fahrplan/events/9196.html" rel="nofollow">May contain DTraces of FreeBSD</a></li>
<li><a href="https://events.ccc.de/congress/2017/Fahrplan/events/8968.html" rel="nofollow">Are all BSDs created equally?</a></li>
<li><a href="https://events.ccc.de/congress/2017/Fahrplan/events/8949.html" rel="nofollow">library operating systems</a></li>
<li><a href="https://events.ccc.de/congress/2017/Fahrplan/events/9249.html" rel="nofollow">Hardening Open Source Development</a>
***
###<a href="https://jamesdeagle.blogspot.co.uk/2017/12/openbsd-62-cde.html" rel="nofollow">OpenBSD 6.2 + CDE</a>
&gt; If you&#39;ve noticed a disruption in the time-space continuum recently, it is likely because I have finally been able to compile and install the Common Desktop Environment (CDE) in a current and actively-developed operating system (OpenBSD 6.2 in this case).
&gt; This comes after so many attempts (across multiple platforms) that ended up with the build process prematurely stopping itself in its own tracks for a variety of infinitesimal reasons that were beyond my comprehension as a non-programmer, or when there was success it was not without some broken parts. As for the latter, I&#39;ve been able to build CDE on OpenIndiana Hipster, but with an end product where I&#39;m unable to change the color scheme in dtstyle (because &quot;useColorObj&quot; is set to &quot;False&quot;), with a default color scheme that is low-res and unpleasant. As for changing &quot;useColorObj&quot; to &quot;True&quot;, I tried every recommended trick I could find online, but nothing worked. 
&gt; My recent attempts at installing CDE on OpenBSD (version 6.1) saw the process stop due to a number of errors that are pure gibberish to these naive eyes. While disappointing, it was par for the course within my miserable experience with trying to build this particular desktop environment. As I wrote in this space in November 2015, in the course of explaining part of my imperitive for installing Solaris 10: 
&gt; And so I have come to think of building the recently open-sourced CDE as being akin to a coffee mug I saw many years ago. One side of the mug read &quot;Turn the mug to see how to keep an idiot busy.&quot; On the other side, it read &quot;Turn the mug to see how to keep an idiot busy.&quot; I&#39;m through feeling like an idiot, which is partially why I&#39;m on this one-week journey with Solaris 10.
&gt; While I thoroughly enjoyed running Solaris 10 on my ThinkPad T61p, and felt a devilish thrill at using it out in the open at my local MacBook- and iPhone-infested Starbucks and causing general befuddlement and consternation among the occasional prying yoga mom, I never felt like I could do much with it beyond explore the SunOS 5.10 command line and watch YouTube videos. While still supported by its current corporate owner (whose name I don&#39;t even want to type), it is no longer actively developed and is thus little more than a retro toy. I hated the idea of installing anything else over it, but productivity beckoned and it was time to tearfully and reluctantly drag myself off the dance floor.
&gt; In any case, just last week I noticed that the Sourceforge page for the OpenBSD build had some 6.2-specific notes by way of a series of four patches, and so I decided &#39;what the heck, let&#39;s give this puppy another whirl&#39;. After an initial abortive attempt at a build, I surmised that I hadn&#39;t applied the four patches correctly. A day or two later, I took a deep breath and tried again, this time resolving to not proceed with the time make World build command until I could see some sign of a successful patch process. (This time around, I downloaded the patches and moved them into the directory containing the CDE makefiles, and issued each patch command as patch <filename.patch and then reading the output carefully to determine which file in the source code was to be patched, and entering the filename when asked.)
> Once I had the thing up and running, and with a mind bursting with fruit flavor, I started messing about. The first order of business was to create a custom color scheme modelled after the default color scheme in UnixWare. (Despite any baggage that system carries from its previous ownership under SCO, I adored the aesthetics of UnixWare 7.1.4 two years ago when I installed the free one month trial version on my ThinkPad. For reasons that escape me now, I named my newly-created color scheme in honor of UnixWare 7.1.3.)
&gt; Like a proud papa, I immediately tweeted the above screenshot and risked irritating a Linux kid or two in the process, given SCO&#39;s anti-climatic anti-Linux patent trolling from way back when. (I&#39;m not out to irritate penguinistas, I just sure like this color scheme.)</li>
<li>Final Thoughts
&gt; It may look a little clunky at first, and may be a little bling-challenged, but the more I use CDE and adapt to it, the more it feels like an extension of my brain. Perhaps this is because it has a lot zip and behaves in a consistent and coherent manner. (I don&#39;t want to go too much further down that road here, as OSnews&#39;s Thom Holwerda already gave a good rundown about ten years ago.)
&gt; Now that I have succesfully paired my absolute favorite operating system with a desktop environment that has exerted an intense gravitational hold on me for many, many years, I don&#39;t anticipate distrohopping any time soon. And as I attain a more advanced knowledge of CDE, I&#39;ll be chronicling any new discoveries here for the sake of anyone following me from behind as I feel my way around this darkened room.
***
###<a href="https://www.mail-archive.com/svn-src-all@freebsd.org/msg154719.html" rel="nofollow">devmatch(8) added to FreeBSD HEAD</a>
```
Log:
Match unattached devices on the system to potential kernel modules.</li>
</ul>

<p>devmatch(8) matchs up devices in the system device tree with drivers<br>
  that may match them. For each unattached device in the system, it<br>
  tries to find matching PNP info in the linker hints and prints modules<br>
  to load to claim the devices.</p>

<p>In --unbound mode, devmatch can look for drivers that have attached to<br>
  devices in the device tree and have plug and play information, but for<br>
  which no PNP info exists. This helps find drivers that haven&#39;t been<br>
  converted yet that are in use on this system.</p>

<p>In addition, the ability to dump out linker.hints is provided.</p>

<p>Future commits will add hooks to devd.conf and rc.d to fully automate<br>
  using this information.<br>
Added:<br>
  head/usr.sbin/devmatch/<br>
  head/usr.sbin/devmatch/Makefile   (contents, props changed)<br>
  head/usr.sbin/devmatch/devmatch.8   (contents, props changed)<br>
  head/usr.sbin/devmatch/devmatch.c   (contents, props changed)<br>
Modified:<br>
  head/usr.sbin/Makefile<br>
Modified: head/usr.sbin/Makefile</p>

<pre><code>+ Oh, you naughty committers: :-) https://www.mail-archive.com/svn-src-all@freebsd.org/msg154720.html
***
##Beastie Bits
+ [New FreeBSD Journal issue: Monitoring and Metrics](https://www.freebsdfoundation.org/journal/)
+ [OpenBSD Engine Mix available on GOG.com](https://www.gog.com/mix/openbsd_engine_available)
+ [OpenBSD Foundation reached their 2017 fundraising goal](http://www.openbsdfoundation.org/campaign2017.html)
+ [TrueOS 17.12 Review – An Easy BSD](https://www.youtube.com/watch?v=nKr1GCsV-gA)
+ [LibreSSL 2.6.4 Released](https://bsdsec.net/articles/libressl-2-6-4-released-fixed)
***
##Feedback/Questions
+ Mike - [BSD 217 &amp; Winning over Linux Users](http://dpaste.com/3AB7J4P#wrap)
+ JLR - [Boot Environments Broken?](http://dpaste.com/2K0ZDH9#wrap)
+ Kevr - [ZFS question and suggestion](http://dpaste.com/04MXA5P#wrap)
+ Ivan - [FreeBSD read cache - ZFS](http://dpaste.com/1P9ETGQ#wrap)
***
</code></pre>]]>
  </itunes:summary>
</item>
<item>
  <title>225: The one true OS</title>
  <link>https://www.bsdnow.tv/225</link>
  <guid isPermaLink="false">5f2c1de5-e2e3-49c6-8e12-39b0f4b76458</guid>
  <pubDate>Wed, 20 Dec 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5f2c1de5-e2e3-49c6-8e12-39b0f4b76458.mp3" length="77115604" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>TrueOS stable 17.12 is out, we have an OpenBSD workstation guide for you, learnings from the PDP-11, FreeBSD 2017 Releng recap and Duo SSH.</itunes:subtitle>
  <itunes:duration>1:47:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>TrueOS stable 17.12 is out, we have an OpenBSD workstation guide for you, learnings from the PDP-11, FreeBSD 2017 Releng recap and Duo SSH.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
TrueOS stable release 17.12 (https://www.trueos.org/blog/trueos-17-12-release/)
We are pleased to announce a new release of the 6-month STABLE version of TrueOS!
This release cycle focused on lots of cleanup and stabilization of the distinguishing features of TrueOS: OpenRC, boot speed, removable-device management, SysAdm API integrations, Lumina improvements, and more. We have also been working quite a bit on the server offering of TrueOS, and are pleased to provide new text-based server images with support for Virtualization systems such as bhyve! This allows for simple server deployments which also take advantage of the TrueOS improvements to FreeBSD such as:
Sane service management and status reporting with OpenRC
Reliable, non-interactive system update mechanism with fail-safe boot environment support.
Graphical management of remote TrueOS servers through SysAdm (also provides a reliable API for administrating systems remotely).
LibreSSL for all base SSL support.
Base system managed via packages (allows for additional fine-tuning).
Base system is smaller due to the removal of the old GCC version in base. Any compiler and/or version may be installed and used via packages as desired.
Support for newer graphics drivers and chipsets (graphics, networking, wifi, and more)
TrueOS Version 17.12 (2017, December) is now available for download from the TrueOS website. Both the STABLE and UNSTABLE package repositories have also been updated in-sync with each other, so current users only need to follow the prompts about updating their system to run the new release.
We are also pleased to announce the availability of TrueOS Sponsorships! If you would like to help contribute to the project financially we now have the ability to accept both one-time donations as well as recurring monthly donations which wil help us advocate for TrueOS around the world.  Thank you all for using and supporting TrueOS!
Notable Changes:
Over 1100 OpenRC services have been created for 3rd-party packages. This should ensure the functionality of nearly all available 3rd-party packages that install/use their own services.
The OpenRC services for FreeBSD itself have been overhauled, resulting in significantly shorter boot times.
Separate install images for desktops and servers (server image uses a text/console installer)
Bhyve support for TrueOS Server Install
FreeBSD base is synced with 12.0-CURRENT as of December 4th, 2017 (Github commit: 209d01f)
FreeBSD ports tree is synced as of November 30th (pre-FLAVOR changes)
Lumina Desktop has been updated/developed from 1.3.0 to 1.4.1
PCDM now supports multiple simultaneous graphical sessions
Removable devices are now managed through the “automounter” service.
Devices are “announced” as available to the system via *.desktop shortcuts in /media. These shortcuts also contain a variety of optional “Actions” that may be performed on the device.
Devices are only mounted while they are being used (such as when browsing via the command line or a file manager).
Devices are automatically unmounted as soon as they stop being accessed.
Integrated support for all major filesystems (UFS, EXT, FAT, NTFS, ExFAT, etc..)
NOTE: The Lumina desktop is the only one which supports this functionality at the present time.
The TrueOS update system has moved to an “active” update backend. This means that the user will need to actually start the update process by clicking the “Update Now” button in SysAdm, Lumina, or PCDM (as well as the command-line option). The staging of the update files is still performed automatically by default but this (and many other options) can be easily changed in the “Update Manager” settings as desired.
Known Errata:
[VirtualBox] Running FreeBSD within a VirtualBox VM is known to occasionally receive non-existent mouse clicks – particularly when using a scroll wheel or two-finger scroll.
Quick Links:
TrueOS Forums (https://discourse.trueos.org/)
TrueOS Bugs (https://github.com/trueos/trueos-core/issues)
TrueOS Handbook (https://www.trueos.org/handbook/trueos.html)
TrueOS Community Chat on Telegram (https://t.me/TrueOSCommunity)
***
OpenBSD Workstation Guide (https://begriffs.com/posts/2017-05-17-linux-workstation-guide.html)
Design Goals
User actions should complete instantaneously. While I understand if compiling code and rendering videos takes time, opening programs and moving windows should have no observable delay. The system should use minimalist tools.
Corollary: cache data offline when possible. Everything from OpenStreetMaps to StackExchange can be stored locally. No reason to repeatedly hit the internet to query them. This also improves privacy because the initial download is indiscriminate and doesn’t reveal personal queries or patterns of computer activity.
No idling program should use a perceptible amount of CPU. Why does CalendarAgent on my Macbook sometimes use 150% CPU for fifteen minutes? Who knows. Why are background ChromeHelpers chugging along at upper-single-digit CPU? I didn’t realize that holding a rendered DOM could be so challenging.
Avoid interpreted languages, web-based desktop apps, and JavaScript garbage. There, I said it. Take your Electron apps with you to /dev/null!
Stability. Old fashioned programs on a conservative OS on quality mainstream hardware. There are enough challenges to tackle without a bleeding edge system being one of them.
Delegate to quality hardware components. Why use a janky ncurses software audio mixer when you can use…an actual audio mixer?
Hardware privacy. No cameras or microphones that I can’t physically disconnect. Also real hardware protection for cryptographic keys.
Software privacy. Commercial software and operating systems have gotten so terrible about this. I even catch Mac command line tools trying to call Google Analytics. Sorry homebrew, your cute emojis don’t make up for the surveillance.
The Hardware
Core
To get the best hardware for the money I’m opting for a desktop computer. Haven’t had one since the early 2000s and it feels anachronistic, but it will outperform a laptop of similar cost. After much searching, I found the HP Z240 Tower Workstation. It’s no-nonsense and supports exactly the customizations I was looking for:
No operating system pre-loaded (Cut out the “Windows tax”)
Intel Xeon E3-1270 v6 processor (Supports ECC ram)
16 GB (2x8 GB) DDR4-2400 ECC Unbuffered memory (2400Mhz is the full memory clock speed supported by the Xeon)
256 GB HP Z Turbo Drive G2 PCIe SSD (Uses NVMe rather than SATA for faster throughput, supported by nvme(4))
No graphics card (We’ll add our own)
Intel® Ethernet I210-T1 PCIe (Supported by em(4))
A modest discrete video card will enable 2D Glamor acceleration on X11. The Radeon HD 6450 (sold separately) is fanless and listed as supported by radeon(4).
Why build a solid computer and not protect it? Externally, the APC BR1300G UPS will protect the system from power surges and abrupt shutdowns.
Peripherals
The Matias Ergo Pro uses mechanical switches for that old fashioned clicky sound. It also includes dedicated buttons along the side for copying and pasting. Why is that cool? Well, it improves secondary selection, a technique that Sun computers used but time forgot.
Since we’re talking about a home office workstation, you may want a printer. The higher quality printers speak PostScript and PDF natively. Unix machines connect to them on TCP port 9100 and send PostScript commands directly. (You can print via telnet if you know the commands!) The Brother HL-L5100DN is a duplex LaserJet which allows that “raw” TCP printing.
Audio/Video
I know a lot of people enjoy surrounding themselves with a wall of monitors like they’re in the heart of NASA Mission Control, but I find multi-monitor setups slightly disorienting. It introduces an extra bit of cognitive overhead to determine which monitor is for what exactly. That’s why I’d go with a modest, crisp Dell UltraSharp 24" U2417H. It’s 1080p and yeah there are 4k monitors nowadays, but text and icons are small enough as it is for me!
If I ever considered a second monitor it would be e-ink for comfortably reading electronic copies of books or long articles. The price is currently too high to justify the purchase, but the most promising monitor seems to be the Dasung Paperlike.
In the other direction, video input, it’s more flexible to use a general-purpose HDMI capture box like the Rongyuxuan than settle on a particular webcam. This allows hooking up a real camera, or any other video device.
Although the motherboard for this system has built-in audio, we should use a card with better OpenBSD support. The WBTUO PCIe card uses a C-Media CMI8768 chipset, handled by cmpci(4). The card provides S/PDIFF in and out ports if you ever want to use an external DAC or ADC.
The way to connect it with other things is with a dedicated hardware mixer. The Behringer Xenyx 802 has all the connections needed, and the ability to route audio to and from the computer and a variety of devices at once. The mixer may seem an odd peripheral, but I want to mix the computer with an old fashioned CD player, ham radio gear, and amplifier so this unifies the audio setup.
When doing remote pair programming or video team meetings it’s nice to have a quality microphone. The best ones for this kind of work are directional, with a cardioid reception pattern. The MXL 770 condenser mic is perfect, and uses a powered XLR connection supplied by the mixer.
Backups
 We’re going dead simple and old-school, back to tapes. There are a set of tape standards called LTO-n. As n increases the tape capacity gets bigger, but the tape drive gets more expensive. In my opinion the best balance these days for the home user is LTO-3. You can usually find an HP Ultrium 960 LTO-3 on eBay for 150 dollars. The cartridges hold 800GB and are about 15 dollars apiece. Hard drives keep coming down in price, but these tapes are very cheap and simpler than keeping a bunch of disk drives. Also tape has proven longevity, and good recoverability.
To use old fashioned tech like this you need a SCSI host bus adapter like the Adaptec 29320LPE, supported by ahd(4).
Cryptography
You don’t want to generate and store secret keys on a general purpose network attached computer. The attack surface is a mile wide. Generating or manipulating “offline” secret keys needs to happen on a separate computer with no network access.
Little boards like the Raspberry Pi would be good except they use ARM processors (incompatible with Tails OS) and have wifi. The JaguarBoard is a small x86 machine with no wireless capability. Just switch the keyboard and monitor over to this machine for your “cleanroom.” 
jaguar board: Generating keys requires entropy. The Linux kernel on Tails samples system properties to generate randomness, but why not help it out with a dedicated true random number generator (TRNG)? Bit Babbler supplies pure randomness at a high bitrate through USB. (OneRNG works better on the OpenBSD main system, via uonerng(4).)
bit babbler: This little computer will save its results onto a OpenPGP Smartcard V2.1. This card provides write-only access to keys, and computes cryptographic primitives internally to sign and encrypt messages. To use it with a regular computer, hook up a Cherry ST2000 card reader. This reader has a PIN pad built in, so no keylogger on the main computer could even obtain your decryption PIN.
The Software
We take the beefed up hardware above and pair it with ninja-fast software written in C. Some text-based, others raw X11 graphical apps unencumbered by ties to any specific window manager.
I’d advise OpenBSD for the underlying operating system, not a Linux. OpenBSD has greater internal consistency, their man pages are impeccable, and they make it a priority to prune old code to keep the system minimal.
What Have We Learned from the PDP-11? (https://dave.cheney.net/2017/12/04/what-have-we-learned-from-the-pdp-11)
The paper I have chosen tonight is a retrospective on a computer design. It is one of a series of papers by Gordon Bell, and various co-authors, spanning the design, growth, and eventual replacement of the companies iconic line of PDP-11 mini computers.
This year represents the 60th anniversary of the founding of the company that produced the PDP-11. It is also 40 years since this paper was written, so I thought it would be entertaining to review Bell’s retrospective through the lens of our own 20/20 hindsight.
To set the scene for this paper, first we should talk a little about the company that produced the PDP-11, the Digital Equipment Corporation of Maynard, Massachusetts. Better known as DEC.
It’s also worth noting that the name PDP is an acronym for “Programmed Data Processor”, as at the time, computers had a reputation of being large, complicated, and expensive machines, and DEC’s venture capitalists would not support them if they built a “computer”
A computer is not solely determined by its architecture; it reflects the technological, economic, and human aspects of the environment in which it was designed and built. […] The finished computer is a product of the total design environment.
“Right from the get go, Bell is letting us know that the success of any computer project is not abstractly building the best computer but building the right computer, and that takes context.”
It is the nature of computer engineering to be goal-oriented, with pressure to produce deliverable products. It is therefore difficult to plan for an extensive lifetime.
Because of the open nature of the PDP-11, anything which interpreted the instructions according to the processor specification, was a PDP-11, so there had been a rush within DEC, once it was clear that the PDP-11 market was heating up, to build implementations; you had different groups building fast, expensive ones and cost reduced slower ones
The first weakness of minicomputers was their limited addressing capability. The biggest (and most common) mistake that can be made in a computer design is that of not providing enough address bits for memory addressing and management.
A second weakness of minicomputers was their tendency not to have enough registers. This was corrected for the PDP-11 by providing eight 16-bit registers. Later, six 32-bit registers were added for floating-point arithmetic.  […] More registers would increase the multiprogramming context switch time and confuse the user.
“It’s also interesting to note Bell’s concern that additional registers would confuse the user. In the early 1970’s the assumption that the machine would be programmed directly in assembly was still the prevailing mindset.”
A third weakness of minicomputers was their lack of hardware stack capability. In the PDP-11, this was solved with the autoincrement/autodecrement addressing mechanism. This solution is unique to the PDP-11 and has proven to be exceptionally useful. (In fact, it has been copied by other designers.)
“Nowadays it’s hard to imagine hardware that doesn’t have a notion of a stack, but consider that a stack isn’t important if you don’t need recursion.”
“The design for the PDP-11 was laid down in 1969 and if we look at the programming languages of the time, FORTRAN and COBOL, neither supported recursive function calls. The function call sequence would often store the return address at a blank word at the start of the procedure making recursion impossible.”
A fourth weakness, limited interrupt capability and slow context switching, was essentially solved with the device of UNIBUS interrupt vectors, which direct device interrupts.
The basic mechanism is very fast, requiring only four memory cycles from the time an interrupt request is issued until the first instruction of the interrupt routine begins execution.
A fifth weakness of prior minicomputers, inadequate character-handling capability, was met in the PDP-11 by providing direct byte addressing capability.
“Strings and character handling were of increasing importance during the 1960’s as scientific and business computing converged. The predominant character encodings at the time were 6 bit character sets which provided just enough space for upper case letters, the digits 0 to 9, space, and a few punctuation characters sufficient for printing financial reports.”
“Because memory was so expensive, placing one 6 bit character into a 12 or 18 bit word was simply unacceptable so characters would be packed into words. This proved efficient for storage, but complex for operations like move, compare, and concatenate, which had to account for a character appearing in the top or bottom of the word, expending valuable words of program storage to cope.”
“The problem was addressed in the PDP-11 by allowing the machine to operate on memory as both a 16-bit word, and the increasingly popular 8-bit byte. The expenditure of 2 additional bits per character was felt to be worth it for simpler string handling, and also eased the adoption of the increasingly popular 7-bit ASCII standard of which DEC were a proponent at the time. Bell concludes this point with the throw away line:”
Although string instructions are not yet provided in the hardware, the common string operations (move, compare, concatenate) can be programmed with very short loops.
A sixth weakness, the inability to use read-only memories, was avoided in the PDP-11. Most code written for the PDP-11 tends to be pure and reentrant without special effort by the programmer, allowing a read-only memory (ROM) to be used directly.
A seventh weakness, one common to many minicomputers, was primitive I/O capabilities.
A ninth weakness of minicomputers was the high cost of programming them. Many users program in assembly language, without the comfortable environment of editors, file systems, and debuggers available on bigger systems. The PDP-11 does not seem to have overcome this weakness, although it appears that more complex systems are being built successfully with the PDP-11 than with its predecessors, the PDP-8 and PDP-15.
The problems faced by computer designers can usually be attributed to one of two causes: inexperience or second-systemitis
Before the PDP-11, there was no UNIX. Before the PDP-11, there was no C, this is the computer that C was designed on. If you want to know why the classical C int is 16 bits wide, it’s because of the PDP-11. UNIX bought us ideas such as pipes, everything is a file, and interactive computing.
UNIX, which had arrived at Berkley in 1974 aboard a tape carried by Ken Thompson, would evolve into the west coast flavoured Berkley Systems Distribution. Berkeley UNIX had been ported to the VAX by the start of the 1980’s and was thriving as the counter cultural alternative to DEC’s own VMS operating system. Berkeley UNIX spawned a new generation of hackers who would go on to form companies like Sun micro systems, and languages like Self, which lead directly to the development of Java. UNIX was ported to a bewildering array of computer systems during the 80’s and the fallout from the UNIX wars gave us the various BSD operating systems who continue to this day.
The article, and the papers it is summarizing, contain a lot more than we could possibly dig into even if we dedicated the entire show to the topic
***
News Roundup
Two-factor authentication SSH with Duo in FreeBSD 11 (https://www.teachnix.com/2017/11/29/configuring-two-factor-authentication-on-freebsd-with-duo/)
This setup uses an SSH key as the first factor of authentication. Please watch Part 1 on setting up SSH keys and how to scp it to your server.
Video guide (https://www.youtube.com/watch?v=E5EuvF-iaV0)
Register for a free account at Duo.com
Install the Duo package on your FreeBSD server
pkg install -y duo
Log into the Duo site &amp;gt; Applications &amp;gt; Protect an Application &amp;gt; Search for Unix application &amp;gt; Protect this Application This will generate the keys we need to configure Duo.
Edit the Duo config file using the course notes template
vi /usr/local/etc/pam_duo.conf
Example config

[duo]
; Duo integration key
ikey = Integration key goes here
; Duo secret key
skey = Secret key goes here
; Duo API host
host = API hostname goes here

Change the permissions of the Duo config file. If the permissions are not correct then the service will not function properly.
chmod 600 /usr/local/etc/pam_duo.conf
Edit the SSHD config file using the course notes template
vi /etc/ssh/sshd_config
Example config

ListenAddress 0.0.0.0
Port 22
PasswordAuthentication no
UsePAM yes
ChallengeResponseAuthentication yes
UseDNS no
PermitRootLogin yes
AuthenticationMethods publickey,keyboard-interactive

Edit PAM to configure SSHD for Duo using the course notes template
Example config
```
# auth
auth            sufficient      pamopie.so             nowarn nofakeprompts
auth            requisite       pamopieaccess.so       nowarn allowlocal
auth            required        /usr/local/lib/security/pamduo.so
# session
# session        optional        pamssh.so              wantagent
session         required        pam_permit.so
# password
# password       sufficient      pamkrb5.so             nowarn tryfirstpass
password        required        pamunix.so             nowarn tryfirstpass
```
Restart the sshd service
service sshd restart
SSH into your FreeBSD server and follow the link it outputs to enroll your phone with Duo.
ssh server.example.com
SSH into your server again
ssh server.example.com
Choose your preferred method and it should log you into your server.
FreeBSD 2017 Release Engineering Recap (https://www.freebsdfoundation.org/blog/2017-release-engineering-recap/)
This past year was undoubtedly a rather busy and successful year for the Release Engineering Team. Throughout the year, development snapshot builds for FreeBSD-CURRENT and supported FreeBSD-STABLE branches were continually provided. In addition, work to package the base system using pkg(8) continued throughout the year and remains ongoing.
The FreeBSD Release Engineering Team worked on the FreeBSD 11.1-RELEASE, with the code slush starting mid-May. The FreeBSD 11.1-RELEASE cycle stayed on schedule, with the final release build starting July 21, and the final release announcement following on July 25, building upon the stability and reliability of 11.0-RELEASE.
Milestones during the 11.1-RELEASE cycle can be found on the 11.1 schedule page (https://www.freebsd.org/releases/11.1R/schedule.html). The final announcement is available here (https://www.freebsd.org/releases/11.1R/announce.html).
The FreeBSD Release Engineering Team started the FreeBSD 10.4-RELEASE cycle, led by Marius Strobl. The FreeBSD 10.4-RELEASE cycle continued on schedule, with the only adjustments to the schedule being the addition of BETA4 and the removal of RC3. FreeBSD 10.4-RELEASE builds upon the stability and reliability of FreeBSD 10.3-RELEASE, and is planned to be the final release from the stable/10 branch.
Milestones during the 10.4-RELEASE cycle can be found on the 10.4 schedule page (https://www.freebsd.org/releases/10.4R/schedule.html). The final announcement is available here (https://www.freebsd.org/releases/10.4R/announce.html).
In addition to these releases, support for additional arm single-board computer images were added, notably Raspberry Pi 3 and Pine64. Additionally, release-related documentation effective 12.0-RELEASE and later has been moved from the base system repository to the documentation repository, making it possible to update related documentation as necessary post-release.
Additionally, the FreeBSD Release Engineering article in the Project Handbook had been rewritten to outline current practices used by the Release Engineering Team. For more information on the procedures and processes the FreeBSD Release Engineering Team follows, the new article is available here  and continually updated as procedures change.
Finally, following the availability of FreeBSD 11.1-RELEASE, Glen Barber attended the September Developer Summit hosted at vBSDCon in Reston, VA, USA, where he gave a brief talk comprising of several points relating directly to the 11.1-RELEASE cycle. In particular, some of the points covered included what he felt went well during the release cycle, what did not go as well as it could have, and what we, as a Project, could do better to improve the release process. The slides from the talk are available in the FreeBSD Wiki.
During the question and answer time following the talk, some questions asked included:
Q: Should developers use the ‘Relnotes’ tag in the Subversion commit template more loosely, at risk of an increase in false positives.
A: When asked when the tag in the template was initially added, the answer would have been “no”, however in hindsight it is easier to sift through the false positives, than to comb through months or years of commit logs.
Q: What issues are present preventing moving release-related documentation to the documentation repository?
A: There were some rendering issues last time it was investigated, but it is really nothing more than taking the time to fix those issues. (Note, that since this talk, the migration of the documentation in question had moved.)
Q: Does it make sense to extend the timeframe between milestone builds during a release cycle from one week to two weeks, to allow more time for testing, for example, RC1 versus RC2?
A: No. It would extend the length of the release cycle with no real benefit between milestones since as we draw nearer to the end of a given release cycle, the number of changes to that code base significantly reduce.
FLIMP - GIMP Exploit on FreeBSD (https://flimp.fuzzing-project.org)
In 2014, when starting the Fuzzing Project (https://fuzzing-project.org/), Hanno Böck did some primitive fuzzing on GIMP and reported two bugs. They weren't fixed and were forgotten in the public bug tracker.
Recently Tobias Stöckmann found one of these bugs (https://bugzilla.gnome.org/show_bug.cgi?id=739133) (CVE-2017-17785) and figured out that it's easy to exploit.
What kind of bug is that?
It's a classic heap buffer overflow in the FLIC parser. FLIC is a file format for animations and was introduced by Autodesk Animator.
How does the exploit work?
Tobias has created a detailed writeup (https://flimp.fuzzing-project.org/exploit.html).
The exploit doesn't work for me!
We figured out it's unreliable and the memory addresses are depending on many circumstances. The exploit ZIP comes with two variations using different memory addresses.
Try both of them. We also noticed putting the files in a subdirectory sometimes made the exploit work.
Anything more to tell about the GIMP?
There's a wide variety of graphics formats. GIMP tries to support many of them, including many legacy formats that nobody is using any more today.
While this has obvious advantages - you can access the old images you may find on a backup CD from 1995 - it comes with risks. Support for many obscure file formats means many parsers that hardly anyone ever looks at.
So... what about the other parsers?
The second bug (https://bugzilla.gnome.org/show_bug.cgi?id=739134) (CVE-2017-17786), which is a simple overread, was in the TGA parser. Furthermore we found buffer overreads in the XCF parser (https://bugzilla.gnome.org/show_bug.cgi?id=790783) (CVE-2017-17788), the Gimp Brush (GBR) parser (https://bugzilla.gnome.org/show_bug.cgi?id=790784) (CVE-2017-17784) and the Paint Shop Pro (PSP) parser (https://bugzilla.gnome.org/show_bug.cgi?id=790849) (CVE-2017-17789).
We found another Heap buffer overflow (https://bugzilla.gnome.org/show_bug.cgi?id=790849) in the Paint Shop Pro parser (CVE-2017-17787) which is probably also exploitable.
In other words: The GIMP import parsers are full of memory safety bugs.
What should happen?
First of all obviously all known memory safety bugs should be fixed.
Furthermore we believe the way GIMP plugins work is not ideal for security testing. The plug-ins are separate executables, however they can't be executed on their own, as they communicate with the main GIMP process.
Ideally either these plug-ins should be changed in a way that allows running them directly from the command line or - even better - they should be turned into libraries. The latter would also have the advantage of making the parser code useable for other software projects.
Finally it might be a good idea to sandbox the import parsers.
Dell FS12-NV7 Review – Bargain FreeBSD/ZFS box (http://blog.frankleonhardt.com/2017/dell-fs12-nv7-review-bargain-freebsdzfs-box/)
It seems just about everyone selling refurbished data centre kit has a load of Dell FS12-NV7’s to flog. Dell FS-what? You won’t find them in the Dell catalogue, that’s for sure. They look a bit like C2100s of some vintage, and they have a lot in common. But on closer inspection they’re obviously a “special” for an important customer. Given the number of them knocking around, it’s obviously a customer with big data, centres stuffed full of servers with a lot of processing to do. Here’s a hint: It’s not Google or Amazon.
So, should you be buying a weirdo box with no documentation whatsoever? I’d say yes, definitely. If you’re interests are anything like mine. In a 2U box you can get twin 4-core CPUs and 64Gb of RAM for £150 or less. What’s not to like? Ah yes, the complete lack of documentation.
Over the next few weeks I intend to cover that. And to start off this is my first PC review for nearly twenty years.
As I mentioned, it’s a 2U full length heavy metal box on rails. On the back there are the usual I/O ports: a 9-way RS-232, VGA, two 1Gb Ethernet, two USB2 and a PS/2 keyboard and mouse. The front is taken up by twelve 3.5″ hard drive bays, with the status lights and power button on one of the mounting ears to make room. Unlike other Dell servers, all the connections are on the back, only.
So, in summary, you’re getting a lot for your money if its the kind of thing you want. It’s ideal as a high-performance Unix box with plenty of drive bays (preferably running BSD and ZFS). In this configuration it really shifts. Major bang-per-buck. Another idea I’ve had is using it for a flight simulator. That’s a lot of RAM and processors for the money. If you forego the SAS controllers in the PCIe slots and dump in a decent graphics card and sound board, it’s hard to see what’s could be better (and you get jet engine sound effects without a speaker).
So who should buy one of these? BSD geeks is the obvious answer. With a bit of tweaking they’re a dream. It can build-absolutely-everything in 20-30 minutes. For storage you can put fast SAS drives in and it goes like the wind, even at 3Gb bandwidth per drive. I don’t know if it works with FreeNAS but I can’t see why not – I’m using mostly FreeBSD 11.1 and the generic kernel is fine. And if you want to run a load of weird operating systems (like Windows XP) in VM format, it seems to work very well with the Xen hypervisor and Dom0 under FreeBSD. Or CentOS if you prefer.
So I shall end this review in true PCW style:
Pros:
Cheap
Lots of CPUs,
Lots of RAM
Lots of HD slots
Great for BSD/ZFS or VMs
Cons:
Noisy
no AES-NI
SAS needs upgrading
Limited PCI slots
As I’ve mentioned, the noise and SAS are easy and relatively cheap to fix, and thanks to BitCoin miners, even the PCI slot problem can be sorted. I’ll talk about this in a later post.
Beastie Bits
Reflections on Hackathons (https://undeadly.org/cgi?action=article;sid=20171126090055)
7-Part Video Crash Course on SaltStack For FreeBSD (https://www.youtube.com/watch?v=HijG0hWebZk&amp;amp;list=PL5yV8umka8YQOr1wm719In5LITdGzQMOF)
The LLVM Thread Sanitizer has been ported to NetBSD (https://blog.netbsd.org/tnf/entry/the_llvm_thread_sanitizer_has)
The First Unix Port (1998) (http://bitsavers.informatik.uni-stuttgart.de/bits/Interdata/32bit/unix/univWollongong_v6/miller.pdf)
arm64 platform now officially supported [and has syspatch(8)] (https://undeadly.org/cgi?action=article;sid=20171208082238)
BSDCan 2018 Call for Participation (https://www.freebsdfoundation.org/news-and-events/call-for-papers/bsdcan-2018-call-for-participation/)
AsiaBSDCon 2018 Call for Papers (https://www.freebsdfoundation.org/news-and-events/call-for-papers/asiabsdcon-2018-call-for-papers/)
***
Feedback/Questions
Shawn - DragonFlyBSD vagrant images (http://dpaste.com/3PRPJHG#wrap)
Ben - undermydesk (http://dpaste.com/0AZ32ZB#wrap)
Ken - Conferences (http://dpaste.com/3E8FQC6#wrap)
Ben - ssh keys (http://dpaste.com/0E4538Q#wrap)
SSH Chaining (https://www.bsdnow.tv/tutorials/ssh-chaining)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>TrueOS stable 17.12 is out, we have an OpenBSD workstation guide for you, learnings from the PDP-11, FreeBSD 2017 Releng recap and Duo SSH.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.trueos.org/blog/trueos-17-12-release/" rel="nofollow">TrueOS stable release 17.12</a></h3>

<blockquote>
<p>We are pleased to announce a new release of the 6-month STABLE version of TrueOS!<br>
This release cycle focused on lots of cleanup and stabilization of the distinguishing features of TrueOS: OpenRC, boot speed, removable-device management, SysAdm API integrations, Lumina improvements, and more. We have also been working quite a bit on the server offering of TrueOS, and are pleased to provide new text-based server images with support for Virtualization systems such as bhyve! This allows for simple server deployments which also take advantage of the TrueOS improvements to FreeBSD such as:</p>
</blockquote>

<ul>
<li>Sane service management and status reporting with OpenRC</li>
<li>Reliable, non-interactive system update mechanism with fail-safe boot environment support.</li>
<li>Graphical management of remote TrueOS servers through SysAdm (also provides a reliable API for administrating systems remotely).</li>
<li>LibreSSL for all base SSL support.</li>
<li>Base system managed via packages (allows for additional fine-tuning).</li>
<li>Base system is smaller due to the removal of the old GCC version in base. Any compiler and/or version may be installed and used via packages as desired.</li>
<li>Support for newer graphics drivers and chipsets (graphics, networking, wifi, and more)</li>
</ul>

<blockquote>
<p>TrueOS Version 17.12 (2017, December) is now available for download from the TrueOS website. Both the STABLE and UNSTABLE package repositories have also been updated in-sync with each other, so current users only need to follow the prompts about updating their system to run the new release.<br>
We are also pleased to announce the availability of TrueOS Sponsorships! If you would like to help contribute to the project financially we now have the ability to accept both one-time donations as well as recurring monthly donations which wil help us advocate for TrueOS around the world.  Thank you all for using and supporting TrueOS!</p>
</blockquote>

<ul>
<li>Notable Changes:

<ul>
<li>Over 1100 OpenRC services have been created for 3rd-party packages. This should ensure the functionality of nearly all available 3rd-party packages that install/use their own services.</li>
<li>The OpenRC services for FreeBSD itself have been overhauled, resulting in significantly shorter boot times.</li>
<li>Separate install images for desktops and servers (server image uses a text/console installer)</li>
<li>Bhyve support for TrueOS Server Install</li>
<li>FreeBSD base is synced with 12.0-CURRENT as of December 4th, 2017 (Github commit: 209d01f)</li>
<li>FreeBSD ports tree is synced as of November 30th (pre-FLAVOR changes)</li>
<li>Lumina Desktop has been updated/developed from 1.3.0 to 1.4.1</li>
<li>PCDM now supports multiple simultaneous graphical sessions</li>
<li>Removable devices are now managed through the “automounter” service.</li>
<li>Devices are “announced” as available to the system via *.desktop shortcuts in /media. These shortcuts also contain a variety of optional “Actions” that may be performed on the device.</li>
<li>Devices are only mounted while they are being used (such as when browsing via the command line or a file manager).</li>
<li>Devices are automatically unmounted as soon as they stop being accessed.</li>
<li>Integrated support for all major filesystems (UFS, EXT, FAT, NTFS, ExFAT, etc..)</li>
<li>NOTE: The Lumina desktop is the only one which supports this functionality at the present time.</li>
<li>The TrueOS update system has moved to an “active” update backend. This means that the user will need to actually start the update process by clicking the “Update Now” button in SysAdm, Lumina, or PCDM (as well as the command-line option). The staging of the update files is still performed automatically by default but this (and many other options) can be easily changed in the “Update Manager” settings as desired.</li>
</ul></li>
<li>Known Errata:

<ul>
<li>[VirtualBox] Running FreeBSD within a VirtualBox VM is known to occasionally receive non-existent mouse clicks – particularly when using a scroll wheel or two-finger scroll.</li>
</ul></li>
<li>Quick Links:

<ul>
<li><a href="https://discourse.trueos.org/" rel="nofollow">TrueOS Forums</a></li>
<li><a href="https://github.com/trueos/trueos-core/issues" rel="nofollow">TrueOS Bugs</a></li>
<li><a href="https://www.trueos.org/handbook/trueos.html" rel="nofollow">TrueOS Handbook</a></li>
<li><a href="https://t.me/TrueOSCommunity" rel="nofollow">TrueOS Community Chat on Telegram</a>
***</li>
</ul></li>
</ul>

<h3><a href="https://begriffs.com/posts/2017-05-17-linux-workstation-guide.html" rel="nofollow">OpenBSD Workstation Guide</a></h3>

<ul>
<li>Design Goals</li>
<li>User actions should complete instantaneously. While I understand if compiling code and rendering videos takes time, opening programs and moving windows should have no observable delay. The system should use minimalist tools.</li>
<li>Corollary: cache data offline when possible. Everything from OpenStreetMaps to StackExchange can be stored locally. No reason to repeatedly hit the internet to query them. This also improves privacy because the initial download is indiscriminate and doesn’t reveal personal queries or patterns of computer activity.</li>
<li>No idling program should use a perceptible amount of CPU. Why does CalendarAgent on my Macbook sometimes use 150% CPU for fifteen minutes? Who knows. Why are background ChromeHelpers chugging along at upper-single-digit CPU? I didn’t realize that holding a rendered DOM could be so challenging.</li>
<li>Avoid interpreted languages, web-based desktop apps, and JavaScript garbage. There, I said it. Take your Electron apps with you to /dev/null!</li>
<li>Stability. Old fashioned programs on a conservative OS on quality mainstream hardware. There are enough challenges to tackle without a bleeding edge system being one of them.</li>
<li>Delegate to quality hardware components. Why use a janky ncurses software audio mixer when you can use…an actual audio mixer?</li>
<li>Hardware privacy. No cameras or microphones that I can’t physically disconnect. Also real hardware protection for cryptographic keys.</li>
<li>Software privacy. Commercial software and operating systems have gotten so terrible about this. I even catch Mac command line tools trying to call Google Analytics. Sorry homebrew, your cute emojis don’t make up for the surveillance.

<ul>
<li>The Hardware</li>
<li>Core</li>
</ul></li>
</ul>

<blockquote>
<p>To get the best hardware for the money I’m opting for a desktop computer. Haven’t had one since the early 2000s and it feels anachronistic, but it will outperform a laptop of similar cost. After much searching, I found the HP Z240 Tower Workstation. It’s no-nonsense and supports exactly the customizations I was looking for:</p>
</blockquote>

<ul>
<li>No operating system pre-loaded (Cut out the “Windows tax”)</li>
<li>Intel Xeon E3-1270 v6 processor (Supports ECC ram)</li>
<li>16 GB (2x8 GB) DDR4-2400 ECC Unbuffered memory (2400Mhz is the full memory clock speed supported by the Xeon)</li>
<li>256 GB HP Z Turbo Drive G2 PCIe SSD (Uses NVMe rather than SATA for faster throughput, supported by nvme(4))</li>
<li>No graphics card (We’ll add our own)</li>
<li><p>Intel® Ethernet I210-T1 PCIe (Supported by em(4))</p></li>
<li><p>A modest discrete video card will enable 2D Glamor acceleration on X11. The Radeon HD 6450 (sold separately) is fanless and listed as supported by radeon(4).</p></li>
<li><p>Why build a solid computer and not protect it? Externally, the APC BR1300G UPS will protect the system from power surges and abrupt shutdowns.</p>

<ul>
<li>Peripherals</li>
</ul></li>
</ul>

<blockquote>
<p>The Matias Ergo Pro uses mechanical switches for that old fashioned clicky sound. It also includes dedicated buttons along the side for copying and pasting. Why is that cool? Well, it improves secondary selection, a technique that Sun computers used but time forgot.<br>
Since we’re talking about a home office workstation, you may want a printer. The higher quality printers speak PostScript and PDF natively. Unix machines connect to them on TCP port 9100 and send PostScript commands directly. (You can print via telnet if you know the commands!) The Brother HL-L5100DN is a duplex LaserJet which allows that “raw” TCP printing.</p>
</blockquote>

<ul>
<li>Audio/Video</li>
</ul>

<blockquote>
<p>I know a lot of people enjoy surrounding themselves with a wall of monitors like they’re in the heart of NASA Mission Control, but I find multi-monitor setups slightly disorienting. It introduces an extra bit of cognitive overhead to determine which monitor is for what exactly. That’s why I’d go with a modest, crisp Dell UltraSharp 24&quot; U2417H. It’s 1080p and yeah there are 4k monitors nowadays, but text and icons are small enough as it is for me!<br>
If I ever considered a second monitor it would be e-ink for comfortably reading electronic copies of books or long articles. The price is currently too high to justify the purchase, but the most promising monitor seems to be the Dasung Paperlike.<br>
In the other direction, video input, it’s more flexible to use a general-purpose HDMI capture box like the Rongyuxuan than settle on a particular webcam. This allows hooking up a real camera, or any other video device.<br>
Although the motherboard for this system has built-in audio, we should use a card with better OpenBSD support. The WBTUO PCIe card uses a C-Media CMI8768 chipset, handled by cmpci(4). The card provides S/PDIFF in and out ports if you ever want to use an external DAC or ADC.<br>
The way to connect it with other things is with a dedicated hardware mixer. The Behringer Xenyx 802 has all the connections needed, and the ability to route audio to and from the computer and a variety of devices at once. The mixer may seem an odd peripheral, but I want to mix the computer with an old fashioned CD player, ham radio gear, and amplifier so this unifies the audio setup.<br>
When doing remote pair programming or video team meetings it’s nice to have a quality microphone. The best ones for this kind of work are directional, with a cardioid reception pattern. The MXL 770 condenser mic is perfect, and uses a powered XLR connection supplied by the mixer.</p>
</blockquote>

<ul>
<li>Backups</li>
</ul>

<blockquote>
<p>We’re going dead simple and old-school, back to tapes. There are a set of tape standards called LTO-n. As n increases the tape capacity gets bigger, but the tape drive gets more expensive. In my opinion the best balance these days for the home user is LTO-3. You can usually find an HP Ultrium 960 LTO-3 on eBay for 150 dollars. The cartridges hold 800GB and are about 15 dollars apiece. Hard drives keep coming down in price, but these tapes are very cheap and simpler than keeping a bunch of disk drives. Also tape has proven longevity, and good recoverability.<br>
To use old fashioned tech like this you need a SCSI host bus adapter like the Adaptec 29320LPE, supported by ahd(4).</p>
</blockquote>

<ul>
<li>Cryptography</li>
</ul>

<blockquote>
<p>You don’t want to generate and store secret keys on a general purpose network attached computer. The attack surface is a mile wide. Generating or manipulating “offline” secret keys needs to happen on a separate computer with no network access.<br>
Little boards like the Raspberry Pi would be good except they use ARM processors (incompatible with Tails OS) and have wifi. The JaguarBoard is a small x86 machine with no wireless capability. Just switch the keyboard and monitor over to this machine for your “cleanroom.” <br>
jaguar board: Generating keys requires entropy. The Linux kernel on Tails samples system properties to generate randomness, but why not help it out with a dedicated true random number generator (TRNG)? Bit Babbler supplies pure randomness at a high bitrate through USB. (OneRNG works better on the OpenBSD main system, via uonerng(4).)<br>
bit babbler: This little computer will save its results onto a OpenPGP Smartcard V2.1. This card provides write-only access to keys, and computes cryptographic primitives internally to sign and encrypt messages. To use it with a regular computer, hook up a Cherry ST2000 card reader. This reader has a PIN pad built in, so no keylogger on the main computer could even obtain your decryption PIN.</p>
</blockquote>

<ul>
<li>The Software</li>
</ul>

<blockquote>
<p>We take the beefed up hardware above and pair it with ninja-fast software written in C. Some text-based, others raw X11 graphical apps unencumbered by ties to any specific window manager.<br>
I’d advise OpenBSD for the underlying operating system, not a Linux. OpenBSD has greater internal consistency, their man pages are impeccable, and they make it a priority to prune old code to keep the system minimal.</p>

<hr>
</blockquote>

<h3><a href="https://dave.cheney.net/2017/12/04/what-have-we-learned-from-the-pdp-11" rel="nofollow">What Have We Learned from the PDP-11?</a></h3>

<blockquote>
<p>The paper I have chosen tonight is a retrospective on a computer design. It is one of a series of papers by Gordon Bell, and various co-authors, spanning the design, growth, and eventual replacement of the companies iconic line of PDP-11 mini computers.<br>
This year represents the 60th anniversary of the founding of the company that produced the PDP-11. It is also 40 years since this paper was written, so I thought it would be entertaining to review Bell’s retrospective through the lens of our own 20/20 hindsight.<br>
To set the scene for this paper, first we should talk a little about the company that produced the PDP-11, the Digital Equipment Corporation of Maynard, Massachusetts. Better known as DEC.<br>
It’s also worth noting that the name PDP is an acronym for “Programmed Data Processor”, as at the time, computers had a reputation of being large, complicated, and expensive machines, and DEC’s venture capitalists would not support them if they built a “computer”<br>
A computer is not solely determined by its architecture; it reflects the technological, economic, and human aspects of the environment in which it was designed and built. […] The finished computer is a product of the total design environment.</p>
</blockquote>

<ul>
<li>“Right from the get go, Bell is letting us know that the success of any computer project is not abstractly building the best computer but building the right computer, and that takes context.”</li>
</ul>

<blockquote>
<p>It is the nature of computer engineering to be goal-oriented, with pressure to produce deliverable products. It is therefore difficult to plan for an extensive lifetime.<br>
Because of the open nature of the PDP-11, anything which interpreted the instructions according to the processor specification, was a PDP-11, so there had been a rush within DEC, once it was clear that the PDP-11 market was heating up, to build implementations; you had different groups building fast, expensive ones and cost reduced slower ones<br>
The first weakness of minicomputers was their limited addressing capability. The biggest (and most common) mistake that can be made in a computer design is that of not providing enough address bits for memory addressing and management.<br>
A second weakness of minicomputers was their tendency not to have enough registers. This was corrected for the PDP-11 by providing eight 16-bit registers. Later, six 32-bit registers were added for floating-point arithmetic.  […] More registers would increase the multiprogramming context switch time and confuse the user.</p>
</blockquote>

<ul>
<li>“It’s also interesting to note Bell’s concern that additional registers would confuse the user. In the early 1970’s the assumption that the machine would be programmed directly in assembly was still the prevailing mindset.”</li>
</ul>

<blockquote>
<p>A third weakness of minicomputers was their lack of hardware stack capability. In the PDP-11, this was solved with the autoincrement/autodecrement addressing mechanism. This solution is unique to the PDP-11 and has proven to be exceptionally useful. (In fact, it has been copied by other designers.)</p>
</blockquote>

<ul>
<li>“Nowadays it’s hard to imagine hardware that doesn’t have a notion of a stack, but consider that a stack isn’t important if you don’t need recursion.”</li>
<li>“The design for the PDP-11 was laid down in 1969 and if we look at the programming languages of the time, FORTRAN and COBOL, neither supported recursive function calls. The function call sequence would often store the return address at a blank word at the start of the procedure making recursion impossible.”</li>
</ul>

<blockquote>
<p>A fourth weakness, limited interrupt capability and slow context switching, was essentially solved with the device of UNIBUS interrupt vectors, which direct device interrupts.<br>
The basic mechanism is very fast, requiring only four memory cycles from the time an interrupt request is issued until the first instruction of the interrupt routine begins execution.<br>
A fifth weakness of prior minicomputers, inadequate character-handling capability, was met in the PDP-11 by providing direct byte addressing capability.</p>
</blockquote>

<ul>
<li>“Strings and character handling were of increasing importance during the 1960’s as scientific and business computing converged. The predominant character encodings at the time were 6 bit character sets which provided just enough space for upper case letters, the digits 0 to 9, space, and a few punctuation characters sufficient for printing financial reports.”</li>
<li>“Because memory was so expensive, placing one 6 bit character into a 12 or 18 bit word was simply unacceptable so characters would be packed into words. This proved efficient for storage, but complex for operations like move, compare, and concatenate, which had to account for a character appearing in the top or bottom of the word, expending valuable words of program storage to cope.”</li>
<li>“The problem was addressed in the PDP-11 by allowing the machine to operate on memory as both a 16-bit word, and the increasingly popular 8-bit byte. The expenditure of 2 additional bits per character was felt to be worth it for simpler string handling, and also eased the adoption of the increasingly popular 7-bit ASCII standard of which DEC were a proponent at the time. Bell concludes this point with the throw away line:”</li>
</ul>

<blockquote>
<p>Although string instructions are not yet provided in the hardware, the common string operations (move, compare, concatenate) can be programmed with very short loops.<br>
A sixth weakness, the inability to use read-only memories, was avoided in the PDP-11. Most code written for the PDP-11 tends to be pure and reentrant without special effort by the programmer, allowing a read-only memory (ROM) to be used directly.<br>
A seventh weakness, one common to many minicomputers, was primitive I/O capabilities.<br>
A ninth weakness of minicomputers was the high cost of programming them. Many users program in assembly language, without the comfortable environment of editors, file systems, and debuggers available on bigger systems. The PDP-11 does not seem to have overcome this weakness, although it appears that more complex systems are being built successfully with the PDP-11 than with its predecessors, the PDP-8 and PDP-15.<br>
The problems faced by computer designers can usually be attributed to one of two causes: inexperience or second-systemitis<br>
Before the PDP-11, there was no UNIX. Before the PDP-11, there was no C, this is the computer that C was designed on. If you want to know why the classical C int is 16 bits wide, it’s because of the PDP-11. UNIX bought us ideas such as pipes, everything is a file, and interactive computing.<br>
UNIX, which had arrived at Berkley in 1974 aboard a tape carried by Ken Thompson, would evolve into the west coast flavoured Berkley Systems Distribution. Berkeley UNIX had been ported to the VAX by the start of the 1980’s and was thriving as the counter cultural alternative to DEC’s own VMS operating system. Berkeley UNIX spawned a new generation of hackers who would go on to form companies like Sun micro systems, and languages like Self, which lead directly to the development of Java. UNIX was ported to a bewildering array of computer systems during the 80’s and the fallout from the UNIX wars gave us the various BSD operating systems who continue to this day.</p>
</blockquote>

<ul>
<li>The article, and the papers it is summarizing, contain a lot more than we could possibly dig into even if we dedicated the entire show to the topic
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.teachnix.com/2017/11/29/configuring-two-factor-authentication-on-freebsd-with-duo/" rel="nofollow">Two-factor authentication SSH with Duo in FreeBSD 11</a></h3>

<blockquote>
<p>This setup uses an SSH key as the first factor of authentication. Please watch Part 1 on setting up SSH keys and how to scp it to your server.</p>
</blockquote>

<ul>
<li><p><a href="https://www.youtube.com/watch?v=E5EuvF-iaV0" rel="nofollow">Video guide</a></p></li>
<li><p>Register for a free account at Duo.com</p></li>
<li><p>Install the Duo package on your FreeBSD server</p></li>
</ul>

<p><code>pkg install -y duo</code></p>

<ul>
<li>Log into the Duo site &gt; Applications &gt; Protect an Application &gt; Search for Unix application &gt; Protect this Application This will generate the keys we need to configure Duo.</li>
<li>Edit the Duo config file using the course notes template</li>
</ul>

<p><code>vi /usr/local/etc/pam_duo.conf</code></p>

<ul>
<li>Example config</li>
</ul>

<pre><code>[duo]
; Duo integration key
ikey = Integration key goes here
; Duo secret key
skey = Secret key goes here
; Duo API host
host = API hostname goes here
</code></pre>

<ul>
<li>Change the permissions of the Duo config file. If the permissions are not correct then the service will not function properly.</li>
</ul>

<p><code>chmod 600 /usr/local/etc/pam_duo.conf</code></p>

<ul>
<li>Edit the SSHD config file using the course notes template</li>
</ul>

<p><code>vi /etc/ssh/sshd_config</code></p>

<ul>
<li>Example config</li>
</ul>

<pre><code>ListenAddress 0.0.0.0
Port 22
PasswordAuthentication no
UsePAM yes
ChallengeResponseAuthentication yes
UseDNS no
PermitRootLogin yes
AuthenticationMethods publickey,keyboard-interactive
</code></pre>

<ul>
<li>Edit PAM to configure SSHD for Duo using the course notes template</li>
<li>Example config</li>
</ul>

<pre><code>&amp;#35; auth
auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
auth            required        /usr/local/lib/security/pam_duo.so

&amp;#35; session
&amp;#35; session        optional        pam_ssh.so              want_agent
session         required        pam_permit.so

&amp;#35; password
&amp;#35; password       sufficient      pam_krb5.so             no_warn try_first_pass
password        required        pam_unix.so             no_warn try_first_pass
</code></pre>

<ul>
<li>Restart the sshd service</li>
</ul>

<p><code>service sshd restart</code></p>

<ul>
<li>SSH into your FreeBSD server and follow the link it outputs to enroll your phone with Duo.</li>
</ul>

<p><code>ssh server.example.com</code></p>

<ul>
<li>SSH into your server again</li>
</ul>

<p><code>ssh server.example.com</code></p>

<ul>
<li>Choose your preferred method and it should log you into your server.</li>
</ul>

<hr>

<h3><a href="https://www.freebsdfoundation.org/blog/2017-release-engineering-recap/" rel="nofollow">FreeBSD 2017 Release Engineering Recap</a></h3>

<blockquote>
<p>This past year was undoubtedly a rather busy and successful year for the Release Engineering Team. Throughout the year, development snapshot builds for FreeBSD-CURRENT and supported FreeBSD-STABLE branches were continually provided. In addition, work to package the base system using pkg(8) continued throughout the year and remains ongoing.<br>
The FreeBSD Release Engineering Team worked on the FreeBSD 11.1-RELEASE, with the code slush starting mid-May. The FreeBSD 11.1-RELEASE cycle stayed on schedule, with the final release build starting July 21, and the final release announcement following on July 25, building upon the stability and reliability of 11.0-RELEASE.<br>
Milestones during the 11.1-RELEASE cycle can be found on the <a href="https://www.freebsd.org/releases/11.1R/schedule.html" rel="nofollow">11.1 schedule page</a>. The final announcement is available <a href="https://www.freebsd.org/releases/11.1R/announce.html" rel="nofollow">here</a>.<br>
The FreeBSD Release Engineering Team started the FreeBSD 10.4-RELEASE cycle, led by Marius Strobl. The FreeBSD 10.4-RELEASE cycle continued on schedule, with the only adjustments to the schedule being the addition of BETA4 and the removal of RC3. FreeBSD 10.4-RELEASE builds upon the stability and reliability of FreeBSD 10.3-RELEASE, and is planned to be the final release from the stable/10 branch.<br>
Milestones during the 10.4-RELEASE cycle can be found on the <a href="https://www.freebsd.org/releases/10.4R/schedule.html" rel="nofollow">10.4 schedule page</a>. The final announcement is available <a href="https://www.freebsd.org/releases/10.4R/announce.html" rel="nofollow">here</a>.<br>
In addition to these releases, support for additional arm single-board computer images were added, notably Raspberry Pi 3 and Pine64. Additionally, release-related documentation effective 12.0-RELEASE and later has been moved from the base system repository to the documentation repository, making it possible to update related documentation as necessary post-release.<br>
Additionally, the FreeBSD Release Engineering article in the Project Handbook had been rewritten to outline current practices used by the Release Engineering Team. For more information on the procedures and processes the FreeBSD Release Engineering Team follows, the new article is available here  and continually updated as procedures change.<br>
Finally, following the availability of FreeBSD 11.1-RELEASE, Glen Barber attended the September Developer Summit hosted at vBSDCon in Reston, VA, USA, where he gave a brief talk comprising of several points relating directly to the 11.1-RELEASE cycle. In particular, some of the points covered included what he felt went well during the release cycle, what did not go as well as it could have, and what we, as a Project, could do better to improve the release process. The slides from the talk are available in the FreeBSD Wiki.<br>
During the question and answer time following the talk, some questions asked included:</p>
</blockquote>

<ul>
<li>Q: Should developers use the ‘Relnotes’ tag in the Subversion commit template more loosely, at risk of an increase in false positives.</li>
</ul>

<blockquote>
<p>A: When asked when the tag in the template was initially added, the answer would have been “no”, however in hindsight it is easier to sift through the false positives, than to comb through months or years of commit logs.</p>
</blockquote>

<ul>
<li>Q: What issues are present preventing moving release-related documentation to the documentation repository?</li>
</ul>

<blockquote>
<p>A: There were some rendering issues last time it was investigated, but it is really nothing more than taking the time to fix those issues. (Note, that since this talk, the migration of the documentation in question had moved.)</p>
</blockquote>

<ul>
<li>Q: Does it make sense to extend the timeframe between milestone builds during a release cycle from one week to two weeks, to allow more time for testing, for example, RC1 versus RC2?</li>
</ul>

<blockquote>
<p>A: No. It would extend the length of the release cycle with no real benefit between milestones since as we draw nearer to the end of a given release cycle, the number of changes to that code base significantly reduce.</p>
</blockquote>

<hr>

<h3><a href="https://flimp.fuzzing-project.org" rel="nofollow">FLIMP - GIMP Exploit on FreeBSD</a></h3>

<blockquote>
<p>In 2014, when starting the <a href="https://fuzzing-project.org/" rel="nofollow">Fuzzing Project</a>, Hanno Böck did some primitive fuzzing on GIMP and reported two bugs. They weren&#39;t fixed and were forgotten in the public bug tracker.<br>
Recently Tobias Stöckmann found <a href="https://bugzilla.gnome.org/show_bug.cgi?id=739133" rel="nofollow">one of these bugs</a> (CVE-2017-17785) and figured out that it&#39;s easy to exploit.</p>
</blockquote>

<ul>
<li>What kind of bug is that?</li>
</ul>

<blockquote>
<p>It&#39;s a classic heap buffer overflow in the FLIC parser. FLIC is a file format for animations and was introduced by Autodesk Animator.</p>
</blockquote>

<ul>
<li>How does the exploit work?</li>
</ul>

<blockquote>
<p>Tobias has created a <a href="https://flimp.fuzzing-project.org/exploit.html" rel="nofollow">detailed writeup</a>.</p>
</blockquote>

<ul>
<li>The exploit doesn&#39;t work for me!</li>
</ul>

<blockquote>
<p>We figured out it&#39;s unreliable and the memory addresses are depending on many circumstances. The exploit ZIP comes with two variations using different memory addresses.<br>
Try both of them. We also noticed putting the files in a subdirectory sometimes made the exploit work.</p>
</blockquote>

<ul>
<li>Anything more to tell about the GIMP?</li>
</ul>

<blockquote>
<p>There&#39;s a wide variety of graphics formats. GIMP tries to support many of them, including many legacy formats that nobody is using any more today.<br>
While this has obvious advantages - you can access the old images you may find on a backup CD from 1995 - it comes with risks. Support for many obscure file formats means many parsers that hardly anyone ever looks at.</p>
</blockquote>

<ul>
<li>So... what about the other parsers?</li>
</ul>

<blockquote>
<p>The <a href="https://bugzilla.gnome.org/show_bug.cgi?id=739134" rel="nofollow">second bug</a> (CVE-2017-17786), which is a simple overread, was in the TGA parser. Furthermore we found buffer overreads in the <a href="https://bugzilla.gnome.org/show_bug.cgi?id=790783" rel="nofollow">XCF parser</a> (CVE-2017-17788), the <a href="https://bugzilla.gnome.org/show_bug.cgi?id=790784" rel="nofollow">Gimp Brush (GBR) parser</a> (CVE-2017-17784) and the <a href="https://bugzilla.gnome.org/show_bug.cgi?id=790849" rel="nofollow">Paint Shop Pro (PSP) parser</a> (CVE-2017-17789).<br>
We found another <a href="https://bugzilla.gnome.org/show_bug.cgi?id=790849" rel="nofollow">Heap buffer overflow</a> in the Paint Shop Pro parser (CVE-2017-17787) which is probably also exploitable.<br>
In other words: The GIMP import parsers are full of memory safety bugs.</p>
</blockquote>

<ul>
<li>What should happen?</li>
</ul>

<blockquote>
<p>First of all obviously all known memory safety bugs should be fixed.<br>
Furthermore we believe the way GIMP plugins work is not ideal for security testing. The plug-ins are separate executables, however they can&#39;t be executed on their own, as they communicate with the main GIMP process.<br>
Ideally either these plug-ins should be changed in a way that allows running them directly from the command line or - even better - they should be turned into libraries. The latter would also have the advantage of making the parser code useable for other software projects.<br>
Finally it might be a good idea to sandbox the import parsers.</p>

<hr>
</blockquote>

<h3><a href="http://blog.frankleonhardt.com/2017/dell-fs12-nv7-review-bargain-freebsdzfs-box/" rel="nofollow">Dell FS12-NV7 Review – Bargain FreeBSD/ZFS box</a></h3>

<blockquote>
<p>It seems just about everyone selling refurbished data centre kit has a load of Dell FS12-NV7’s to flog. Dell FS-what? You won’t find them in the Dell catalogue, that’s for sure. They look a bit like C2100s of some vintage, and they have a lot in common. But on closer inspection they’re obviously a “special” for an important customer. Given the number of them knocking around, it’s obviously a customer with big data, centres stuffed full of servers with a lot of processing to do. Here’s a hint: It’s not Google or Amazon.<br>
So, should you be buying a weirdo box with no documentation whatsoever? I’d say yes, definitely. If you’re interests are anything like mine. In a 2U box you can get twin 4-core CPUs and 64Gb of RAM for £150 or less. What’s not to like? Ah yes, the complete lack of documentation.<br>
Over the next few weeks I intend to cover that. And to start off this is my first PC review for nearly twenty years.<br>
As I mentioned, it’s a 2U full length heavy metal box on rails. On the back there are the usual I/O ports: a 9-way RS-232, VGA, two 1Gb Ethernet, two USB2 and a PS/2 keyboard and mouse. The front is taken up by twelve 3.5″ hard drive bays, with the status lights and power button on one of the mounting ears to make room. Unlike other Dell servers, all the connections are on the back, only.<br>
So, in summary, you’re getting a lot for your money if its the kind of thing you want. It’s ideal as a high-performance Unix box with plenty of drive bays (preferably running BSD and ZFS). In this configuration it really shifts. Major bang-per-buck. Another idea I’ve had is using it for a flight simulator. That’s a lot of RAM and processors for the money. If you forego the SAS controllers in the PCIe slots and dump in a decent graphics card and sound board, it’s hard to see what’s could be better (and you get jet engine sound effects without a speaker).<br>
So who should buy one of these? BSD geeks is the obvious answer. With a bit of tweaking they’re a dream. It can build-absolutely-everything in 20-30 minutes. For storage you can put fast SAS drives in and it goes like the wind, even at 3Gb bandwidth per drive. I don’t know if it works with FreeNAS but I can’t see why not – I’m using mostly FreeBSD 11.1 and the generic kernel is fine. And if you want to run a load of weird operating systems (like Windows XP) in VM format, it seems to work very well with the Xen hypervisor and Dom0 under FreeBSD. Or CentOS if you prefer.<br>
So I shall end this review in true PCW style:</p>
</blockquote>

<ul>
<li>Pros:

<ul>
<li>Cheap</li>
<li>Lots of CPUs,</li>
<li>Lots of RAM</li>
<li>Lots of HD slots</li>
<li>Great for BSD/ZFS or VMs</li>
</ul></li>
<li>Cons:

<ul>
<li>Noisy</li>
<li>no AES-NI</li>
<li>SAS needs upgrading</li>
<li>Limited PCI slots</li>
</ul></li>
</ul>

<blockquote>
<p>As I’ve mentioned, the noise and SAS are easy and relatively cheap to fix, and thanks to BitCoin miners, even the PCI slot problem can be sorted. I’ll talk about this in a later post.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171126090055" rel="nofollow">Reflections on Hackathons</a></li>
<li><a href="https://www.youtube.com/watch?v=HijG0hWebZk&list=PL5yV8umka8YQOr1wm719In5LITdGzQMOF" rel="nofollow">7-Part Video Crash Course on SaltStack For FreeBSD</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/the_llvm_thread_sanitizer_has" rel="nofollow">The LLVM Thread Sanitizer has been ported to NetBSD</a></li>
<li><a href="http://bitsavers.informatik.uni-stuttgart.de/bits/Interdata/32bit/unix/univWollongong_v6/miller.pdf" rel="nofollow">The First Unix Port (1998)</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171208082238" rel="nofollow">arm64 platform now officially supported [and has syspatch(8)]</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/bsdcan-2018-call-for-participation/" rel="nofollow">BSDCan 2018 Call for Participation</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/asiabsdcon-2018-call-for-papers/" rel="nofollow">AsiaBSDCon 2018 Call for Papers</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Shawn - <a href="http://dpaste.com/3PRPJHG#wrap" rel="nofollow">DragonFlyBSD vagrant images</a></li>
<li>Ben - <a href="http://dpaste.com/0AZ32ZB#wrap" rel="nofollow">undermydesk</a></li>
<li>Ken - <a href="http://dpaste.com/3E8FQC6#wrap" rel="nofollow">Conferences</a></li>
<li>Ben - <a href="http://dpaste.com/0E4538Q#wrap" rel="nofollow">ssh keys</a>

<ul>
<li><a href="https://www.bsdnow.tv/tutorials/ssh-chaining" rel="nofollow">SSH Chaining</a>
***</li>
</ul></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>TrueOS stable 17.12 is out, we have an OpenBSD workstation guide for you, learnings from the PDP-11, FreeBSD 2017 Releng recap and Duo SSH.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.trueos.org/blog/trueos-17-12-release/" rel="nofollow">TrueOS stable release 17.12</a></h3>

<blockquote>
<p>We are pleased to announce a new release of the 6-month STABLE version of TrueOS!<br>
This release cycle focused on lots of cleanup and stabilization of the distinguishing features of TrueOS: OpenRC, boot speed, removable-device management, SysAdm API integrations, Lumina improvements, and more. We have also been working quite a bit on the server offering of TrueOS, and are pleased to provide new text-based server images with support for Virtualization systems such as bhyve! This allows for simple server deployments which also take advantage of the TrueOS improvements to FreeBSD such as:</p>
</blockquote>

<ul>
<li>Sane service management and status reporting with OpenRC</li>
<li>Reliable, non-interactive system update mechanism with fail-safe boot environment support.</li>
<li>Graphical management of remote TrueOS servers through SysAdm (also provides a reliable API for administrating systems remotely).</li>
<li>LibreSSL for all base SSL support.</li>
<li>Base system managed via packages (allows for additional fine-tuning).</li>
<li>Base system is smaller due to the removal of the old GCC version in base. Any compiler and/or version may be installed and used via packages as desired.</li>
<li>Support for newer graphics drivers and chipsets (graphics, networking, wifi, and more)</li>
</ul>

<blockquote>
<p>TrueOS Version 17.12 (2017, December) is now available for download from the TrueOS website. Both the STABLE and UNSTABLE package repositories have also been updated in-sync with each other, so current users only need to follow the prompts about updating their system to run the new release.<br>
We are also pleased to announce the availability of TrueOS Sponsorships! If you would like to help contribute to the project financially we now have the ability to accept both one-time donations as well as recurring monthly donations which wil help us advocate for TrueOS around the world.  Thank you all for using and supporting TrueOS!</p>
</blockquote>

<ul>
<li>Notable Changes:

<ul>
<li>Over 1100 OpenRC services have been created for 3rd-party packages. This should ensure the functionality of nearly all available 3rd-party packages that install/use their own services.</li>
<li>The OpenRC services for FreeBSD itself have been overhauled, resulting in significantly shorter boot times.</li>
<li>Separate install images for desktops and servers (server image uses a text/console installer)</li>
<li>Bhyve support for TrueOS Server Install</li>
<li>FreeBSD base is synced with 12.0-CURRENT as of December 4th, 2017 (Github commit: 209d01f)</li>
<li>FreeBSD ports tree is synced as of November 30th (pre-FLAVOR changes)</li>
<li>Lumina Desktop has been updated/developed from 1.3.0 to 1.4.1</li>
<li>PCDM now supports multiple simultaneous graphical sessions</li>
<li>Removable devices are now managed through the “automounter” service.</li>
<li>Devices are “announced” as available to the system via *.desktop shortcuts in /media. These shortcuts also contain a variety of optional “Actions” that may be performed on the device.</li>
<li>Devices are only mounted while they are being used (such as when browsing via the command line or a file manager).</li>
<li>Devices are automatically unmounted as soon as they stop being accessed.</li>
<li>Integrated support for all major filesystems (UFS, EXT, FAT, NTFS, ExFAT, etc..)</li>
<li>NOTE: The Lumina desktop is the only one which supports this functionality at the present time.</li>
<li>The TrueOS update system has moved to an “active” update backend. This means that the user will need to actually start the update process by clicking the “Update Now” button in SysAdm, Lumina, or PCDM (as well as the command-line option). The staging of the update files is still performed automatically by default but this (and many other options) can be easily changed in the “Update Manager” settings as desired.</li>
</ul></li>
<li>Known Errata:

<ul>
<li>[VirtualBox] Running FreeBSD within a VirtualBox VM is known to occasionally receive non-existent mouse clicks – particularly when using a scroll wheel or two-finger scroll.</li>
</ul></li>
<li>Quick Links:

<ul>
<li><a href="https://discourse.trueos.org/" rel="nofollow">TrueOS Forums</a></li>
<li><a href="https://github.com/trueos/trueos-core/issues" rel="nofollow">TrueOS Bugs</a></li>
<li><a href="https://www.trueos.org/handbook/trueos.html" rel="nofollow">TrueOS Handbook</a></li>
<li><a href="https://t.me/TrueOSCommunity" rel="nofollow">TrueOS Community Chat on Telegram</a>
***</li>
</ul></li>
</ul>

<h3><a href="https://begriffs.com/posts/2017-05-17-linux-workstation-guide.html" rel="nofollow">OpenBSD Workstation Guide</a></h3>

<ul>
<li>Design Goals</li>
<li>User actions should complete instantaneously. While I understand if compiling code and rendering videos takes time, opening programs and moving windows should have no observable delay. The system should use minimalist tools.</li>
<li>Corollary: cache data offline when possible. Everything from OpenStreetMaps to StackExchange can be stored locally. No reason to repeatedly hit the internet to query them. This also improves privacy because the initial download is indiscriminate and doesn’t reveal personal queries or patterns of computer activity.</li>
<li>No idling program should use a perceptible amount of CPU. Why does CalendarAgent on my Macbook sometimes use 150% CPU for fifteen minutes? Who knows. Why are background ChromeHelpers chugging along at upper-single-digit CPU? I didn’t realize that holding a rendered DOM could be so challenging.</li>
<li>Avoid interpreted languages, web-based desktop apps, and JavaScript garbage. There, I said it. Take your Electron apps with you to /dev/null!</li>
<li>Stability. Old fashioned programs on a conservative OS on quality mainstream hardware. There are enough challenges to tackle without a bleeding edge system being one of them.</li>
<li>Delegate to quality hardware components. Why use a janky ncurses software audio mixer when you can use…an actual audio mixer?</li>
<li>Hardware privacy. No cameras or microphones that I can’t physically disconnect. Also real hardware protection for cryptographic keys.</li>
<li>Software privacy. Commercial software and operating systems have gotten so terrible about this. I even catch Mac command line tools trying to call Google Analytics. Sorry homebrew, your cute emojis don’t make up for the surveillance.

<ul>
<li>The Hardware</li>
<li>Core</li>
</ul></li>
</ul>

<blockquote>
<p>To get the best hardware for the money I’m opting for a desktop computer. Haven’t had one since the early 2000s and it feels anachronistic, but it will outperform a laptop of similar cost. After much searching, I found the HP Z240 Tower Workstation. It’s no-nonsense and supports exactly the customizations I was looking for:</p>
</blockquote>

<ul>
<li>No operating system pre-loaded (Cut out the “Windows tax”)</li>
<li>Intel Xeon E3-1270 v6 processor (Supports ECC ram)</li>
<li>16 GB (2x8 GB) DDR4-2400 ECC Unbuffered memory (2400Mhz is the full memory clock speed supported by the Xeon)</li>
<li>256 GB HP Z Turbo Drive G2 PCIe SSD (Uses NVMe rather than SATA for faster throughput, supported by nvme(4))</li>
<li>No graphics card (We’ll add our own)</li>
<li><p>Intel® Ethernet I210-T1 PCIe (Supported by em(4))</p></li>
<li><p>A modest discrete video card will enable 2D Glamor acceleration on X11. The Radeon HD 6450 (sold separately) is fanless and listed as supported by radeon(4).</p></li>
<li><p>Why build a solid computer and not protect it? Externally, the APC BR1300G UPS will protect the system from power surges and abrupt shutdowns.</p>

<ul>
<li>Peripherals</li>
</ul></li>
</ul>

<blockquote>
<p>The Matias Ergo Pro uses mechanical switches for that old fashioned clicky sound. It also includes dedicated buttons along the side for copying and pasting. Why is that cool? Well, it improves secondary selection, a technique that Sun computers used but time forgot.<br>
Since we’re talking about a home office workstation, you may want a printer. The higher quality printers speak PostScript and PDF natively. Unix machines connect to them on TCP port 9100 and send PostScript commands directly. (You can print via telnet if you know the commands!) The Brother HL-L5100DN is a duplex LaserJet which allows that “raw” TCP printing.</p>
</blockquote>

<ul>
<li>Audio/Video</li>
</ul>

<blockquote>
<p>I know a lot of people enjoy surrounding themselves with a wall of monitors like they’re in the heart of NASA Mission Control, but I find multi-monitor setups slightly disorienting. It introduces an extra bit of cognitive overhead to determine which monitor is for what exactly. That’s why I’d go with a modest, crisp Dell UltraSharp 24&quot; U2417H. It’s 1080p and yeah there are 4k monitors nowadays, but text and icons are small enough as it is for me!<br>
If I ever considered a second monitor it would be e-ink for comfortably reading electronic copies of books or long articles. The price is currently too high to justify the purchase, but the most promising monitor seems to be the Dasung Paperlike.<br>
In the other direction, video input, it’s more flexible to use a general-purpose HDMI capture box like the Rongyuxuan than settle on a particular webcam. This allows hooking up a real camera, or any other video device.<br>
Although the motherboard for this system has built-in audio, we should use a card with better OpenBSD support. The WBTUO PCIe card uses a C-Media CMI8768 chipset, handled by cmpci(4). The card provides S/PDIFF in and out ports if you ever want to use an external DAC or ADC.<br>
The way to connect it with other things is with a dedicated hardware mixer. The Behringer Xenyx 802 has all the connections needed, and the ability to route audio to and from the computer and a variety of devices at once. The mixer may seem an odd peripheral, but I want to mix the computer with an old fashioned CD player, ham radio gear, and amplifier so this unifies the audio setup.<br>
When doing remote pair programming or video team meetings it’s nice to have a quality microphone. The best ones for this kind of work are directional, with a cardioid reception pattern. The MXL 770 condenser mic is perfect, and uses a powered XLR connection supplied by the mixer.</p>
</blockquote>

<ul>
<li>Backups</li>
</ul>

<blockquote>
<p>We’re going dead simple and old-school, back to tapes. There are a set of tape standards called LTO-n. As n increases the tape capacity gets bigger, but the tape drive gets more expensive. In my opinion the best balance these days for the home user is LTO-3. You can usually find an HP Ultrium 960 LTO-3 on eBay for 150 dollars. The cartridges hold 800GB and are about 15 dollars apiece. Hard drives keep coming down in price, but these tapes are very cheap and simpler than keeping a bunch of disk drives. Also tape has proven longevity, and good recoverability.<br>
To use old fashioned tech like this you need a SCSI host bus adapter like the Adaptec 29320LPE, supported by ahd(4).</p>
</blockquote>

<ul>
<li>Cryptography</li>
</ul>

<blockquote>
<p>You don’t want to generate and store secret keys on a general purpose network attached computer. The attack surface is a mile wide. Generating or manipulating “offline” secret keys needs to happen on a separate computer with no network access.<br>
Little boards like the Raspberry Pi would be good except they use ARM processors (incompatible with Tails OS) and have wifi. The JaguarBoard is a small x86 machine with no wireless capability. Just switch the keyboard and monitor over to this machine for your “cleanroom.” <br>
jaguar board: Generating keys requires entropy. The Linux kernel on Tails samples system properties to generate randomness, but why not help it out with a dedicated true random number generator (TRNG)? Bit Babbler supplies pure randomness at a high bitrate through USB. (OneRNG works better on the OpenBSD main system, via uonerng(4).)<br>
bit babbler: This little computer will save its results onto a OpenPGP Smartcard V2.1. This card provides write-only access to keys, and computes cryptographic primitives internally to sign and encrypt messages. To use it with a regular computer, hook up a Cherry ST2000 card reader. This reader has a PIN pad built in, so no keylogger on the main computer could even obtain your decryption PIN.</p>
</blockquote>

<ul>
<li>The Software</li>
</ul>

<blockquote>
<p>We take the beefed up hardware above and pair it with ninja-fast software written in C. Some text-based, others raw X11 graphical apps unencumbered by ties to any specific window manager.<br>
I’d advise OpenBSD for the underlying operating system, not a Linux. OpenBSD has greater internal consistency, their man pages are impeccable, and they make it a priority to prune old code to keep the system minimal.</p>

<hr>
</blockquote>

<h3><a href="https://dave.cheney.net/2017/12/04/what-have-we-learned-from-the-pdp-11" rel="nofollow">What Have We Learned from the PDP-11?</a></h3>

<blockquote>
<p>The paper I have chosen tonight is a retrospective on a computer design. It is one of a series of papers by Gordon Bell, and various co-authors, spanning the design, growth, and eventual replacement of the companies iconic line of PDP-11 mini computers.<br>
This year represents the 60th anniversary of the founding of the company that produced the PDP-11. It is also 40 years since this paper was written, so I thought it would be entertaining to review Bell’s retrospective through the lens of our own 20/20 hindsight.<br>
To set the scene for this paper, first we should talk a little about the company that produced the PDP-11, the Digital Equipment Corporation of Maynard, Massachusetts. Better known as DEC.<br>
It’s also worth noting that the name PDP is an acronym for “Programmed Data Processor”, as at the time, computers had a reputation of being large, complicated, and expensive machines, and DEC’s venture capitalists would not support them if they built a “computer”<br>
A computer is not solely determined by its architecture; it reflects the technological, economic, and human aspects of the environment in which it was designed and built. […] The finished computer is a product of the total design environment.</p>
</blockquote>

<ul>
<li>“Right from the get go, Bell is letting us know that the success of any computer project is not abstractly building the best computer but building the right computer, and that takes context.”</li>
</ul>

<blockquote>
<p>It is the nature of computer engineering to be goal-oriented, with pressure to produce deliverable products. It is therefore difficult to plan for an extensive lifetime.<br>
Because of the open nature of the PDP-11, anything which interpreted the instructions according to the processor specification, was a PDP-11, so there had been a rush within DEC, once it was clear that the PDP-11 market was heating up, to build implementations; you had different groups building fast, expensive ones and cost reduced slower ones<br>
The first weakness of minicomputers was their limited addressing capability. The biggest (and most common) mistake that can be made in a computer design is that of not providing enough address bits for memory addressing and management.<br>
A second weakness of minicomputers was their tendency not to have enough registers. This was corrected for the PDP-11 by providing eight 16-bit registers. Later, six 32-bit registers were added for floating-point arithmetic.  […] More registers would increase the multiprogramming context switch time and confuse the user.</p>
</blockquote>

<ul>
<li>“It’s also interesting to note Bell’s concern that additional registers would confuse the user. In the early 1970’s the assumption that the machine would be programmed directly in assembly was still the prevailing mindset.”</li>
</ul>

<blockquote>
<p>A third weakness of minicomputers was their lack of hardware stack capability. In the PDP-11, this was solved with the autoincrement/autodecrement addressing mechanism. This solution is unique to the PDP-11 and has proven to be exceptionally useful. (In fact, it has been copied by other designers.)</p>
</blockquote>

<ul>
<li>“Nowadays it’s hard to imagine hardware that doesn’t have a notion of a stack, but consider that a stack isn’t important if you don’t need recursion.”</li>
<li>“The design for the PDP-11 was laid down in 1969 and if we look at the programming languages of the time, FORTRAN and COBOL, neither supported recursive function calls. The function call sequence would often store the return address at a blank word at the start of the procedure making recursion impossible.”</li>
</ul>

<blockquote>
<p>A fourth weakness, limited interrupt capability and slow context switching, was essentially solved with the device of UNIBUS interrupt vectors, which direct device interrupts.<br>
The basic mechanism is very fast, requiring only four memory cycles from the time an interrupt request is issued until the first instruction of the interrupt routine begins execution.<br>
A fifth weakness of prior minicomputers, inadequate character-handling capability, was met in the PDP-11 by providing direct byte addressing capability.</p>
</blockquote>

<ul>
<li>“Strings and character handling were of increasing importance during the 1960’s as scientific and business computing converged. The predominant character encodings at the time were 6 bit character sets which provided just enough space for upper case letters, the digits 0 to 9, space, and a few punctuation characters sufficient for printing financial reports.”</li>
<li>“Because memory was so expensive, placing one 6 bit character into a 12 or 18 bit word was simply unacceptable so characters would be packed into words. This proved efficient for storage, but complex for operations like move, compare, and concatenate, which had to account for a character appearing in the top or bottom of the word, expending valuable words of program storage to cope.”</li>
<li>“The problem was addressed in the PDP-11 by allowing the machine to operate on memory as both a 16-bit word, and the increasingly popular 8-bit byte. The expenditure of 2 additional bits per character was felt to be worth it for simpler string handling, and also eased the adoption of the increasingly popular 7-bit ASCII standard of which DEC were a proponent at the time. Bell concludes this point with the throw away line:”</li>
</ul>

<blockquote>
<p>Although string instructions are not yet provided in the hardware, the common string operations (move, compare, concatenate) can be programmed with very short loops.<br>
A sixth weakness, the inability to use read-only memories, was avoided in the PDP-11. Most code written for the PDP-11 tends to be pure and reentrant without special effort by the programmer, allowing a read-only memory (ROM) to be used directly.<br>
A seventh weakness, one common to many minicomputers, was primitive I/O capabilities.<br>
A ninth weakness of minicomputers was the high cost of programming them. Many users program in assembly language, without the comfortable environment of editors, file systems, and debuggers available on bigger systems. The PDP-11 does not seem to have overcome this weakness, although it appears that more complex systems are being built successfully with the PDP-11 than with its predecessors, the PDP-8 and PDP-15.<br>
The problems faced by computer designers can usually be attributed to one of two causes: inexperience or second-systemitis<br>
Before the PDP-11, there was no UNIX. Before the PDP-11, there was no C, this is the computer that C was designed on. If you want to know why the classical C int is 16 bits wide, it’s because of the PDP-11. UNIX bought us ideas such as pipes, everything is a file, and interactive computing.<br>
UNIX, which had arrived at Berkley in 1974 aboard a tape carried by Ken Thompson, would evolve into the west coast flavoured Berkley Systems Distribution. Berkeley UNIX had been ported to the VAX by the start of the 1980’s and was thriving as the counter cultural alternative to DEC’s own VMS operating system. Berkeley UNIX spawned a new generation of hackers who would go on to form companies like Sun micro systems, and languages like Self, which lead directly to the development of Java. UNIX was ported to a bewildering array of computer systems during the 80’s and the fallout from the UNIX wars gave us the various BSD operating systems who continue to this day.</p>
</blockquote>

<ul>
<li>The article, and the papers it is summarizing, contain a lot more than we could possibly dig into even if we dedicated the entire show to the topic
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.teachnix.com/2017/11/29/configuring-two-factor-authentication-on-freebsd-with-duo/" rel="nofollow">Two-factor authentication SSH with Duo in FreeBSD 11</a></h3>

<blockquote>
<p>This setup uses an SSH key as the first factor of authentication. Please watch Part 1 on setting up SSH keys and how to scp it to your server.</p>
</blockquote>

<ul>
<li><p><a href="https://www.youtube.com/watch?v=E5EuvF-iaV0" rel="nofollow">Video guide</a></p></li>
<li><p>Register for a free account at Duo.com</p></li>
<li><p>Install the Duo package on your FreeBSD server</p></li>
</ul>

<p><code>pkg install -y duo</code></p>

<ul>
<li>Log into the Duo site &gt; Applications &gt; Protect an Application &gt; Search for Unix application &gt; Protect this Application This will generate the keys we need to configure Duo.</li>
<li>Edit the Duo config file using the course notes template</li>
</ul>

<p><code>vi /usr/local/etc/pam_duo.conf</code></p>

<ul>
<li>Example config</li>
</ul>

<pre><code>[duo]
; Duo integration key
ikey = Integration key goes here
; Duo secret key
skey = Secret key goes here
; Duo API host
host = API hostname goes here
</code></pre>

<ul>
<li>Change the permissions of the Duo config file. If the permissions are not correct then the service will not function properly.</li>
</ul>

<p><code>chmod 600 /usr/local/etc/pam_duo.conf</code></p>

<ul>
<li>Edit the SSHD config file using the course notes template</li>
</ul>

<p><code>vi /etc/ssh/sshd_config</code></p>

<ul>
<li>Example config</li>
</ul>

<pre><code>ListenAddress 0.0.0.0
Port 22
PasswordAuthentication no
UsePAM yes
ChallengeResponseAuthentication yes
UseDNS no
PermitRootLogin yes
AuthenticationMethods publickey,keyboard-interactive
</code></pre>

<ul>
<li>Edit PAM to configure SSHD for Duo using the course notes template</li>
<li>Example config</li>
</ul>

<pre><code>&amp;#35; auth
auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
auth            required        /usr/local/lib/security/pam_duo.so

&amp;#35; session
&amp;#35; session        optional        pam_ssh.so              want_agent
session         required        pam_permit.so

&amp;#35; password
&amp;#35; password       sufficient      pam_krb5.so             no_warn try_first_pass
password        required        pam_unix.so             no_warn try_first_pass
</code></pre>

<ul>
<li>Restart the sshd service</li>
</ul>

<p><code>service sshd restart</code></p>

<ul>
<li>SSH into your FreeBSD server and follow the link it outputs to enroll your phone with Duo.</li>
</ul>

<p><code>ssh server.example.com</code></p>

<ul>
<li>SSH into your server again</li>
</ul>

<p><code>ssh server.example.com</code></p>

<ul>
<li>Choose your preferred method and it should log you into your server.</li>
</ul>

<hr>

<h3><a href="https://www.freebsdfoundation.org/blog/2017-release-engineering-recap/" rel="nofollow">FreeBSD 2017 Release Engineering Recap</a></h3>

<blockquote>
<p>This past year was undoubtedly a rather busy and successful year for the Release Engineering Team. Throughout the year, development snapshot builds for FreeBSD-CURRENT and supported FreeBSD-STABLE branches were continually provided. In addition, work to package the base system using pkg(8) continued throughout the year and remains ongoing.<br>
The FreeBSD Release Engineering Team worked on the FreeBSD 11.1-RELEASE, with the code slush starting mid-May. The FreeBSD 11.1-RELEASE cycle stayed on schedule, with the final release build starting July 21, and the final release announcement following on July 25, building upon the stability and reliability of 11.0-RELEASE.<br>
Milestones during the 11.1-RELEASE cycle can be found on the <a href="https://www.freebsd.org/releases/11.1R/schedule.html" rel="nofollow">11.1 schedule page</a>. The final announcement is available <a href="https://www.freebsd.org/releases/11.1R/announce.html" rel="nofollow">here</a>.<br>
The FreeBSD Release Engineering Team started the FreeBSD 10.4-RELEASE cycle, led by Marius Strobl. The FreeBSD 10.4-RELEASE cycle continued on schedule, with the only adjustments to the schedule being the addition of BETA4 and the removal of RC3. FreeBSD 10.4-RELEASE builds upon the stability and reliability of FreeBSD 10.3-RELEASE, and is planned to be the final release from the stable/10 branch.<br>
Milestones during the 10.4-RELEASE cycle can be found on the <a href="https://www.freebsd.org/releases/10.4R/schedule.html" rel="nofollow">10.4 schedule page</a>. The final announcement is available <a href="https://www.freebsd.org/releases/10.4R/announce.html" rel="nofollow">here</a>.<br>
In addition to these releases, support for additional arm single-board computer images were added, notably Raspberry Pi 3 and Pine64. Additionally, release-related documentation effective 12.0-RELEASE and later has been moved from the base system repository to the documentation repository, making it possible to update related documentation as necessary post-release.<br>
Additionally, the FreeBSD Release Engineering article in the Project Handbook had been rewritten to outline current practices used by the Release Engineering Team. For more information on the procedures and processes the FreeBSD Release Engineering Team follows, the new article is available here  and continually updated as procedures change.<br>
Finally, following the availability of FreeBSD 11.1-RELEASE, Glen Barber attended the September Developer Summit hosted at vBSDCon in Reston, VA, USA, where he gave a brief talk comprising of several points relating directly to the 11.1-RELEASE cycle. In particular, some of the points covered included what he felt went well during the release cycle, what did not go as well as it could have, and what we, as a Project, could do better to improve the release process. The slides from the talk are available in the FreeBSD Wiki.<br>
During the question and answer time following the talk, some questions asked included:</p>
</blockquote>

<ul>
<li>Q: Should developers use the ‘Relnotes’ tag in the Subversion commit template more loosely, at risk of an increase in false positives.</li>
</ul>

<blockquote>
<p>A: When asked when the tag in the template was initially added, the answer would have been “no”, however in hindsight it is easier to sift through the false positives, than to comb through months or years of commit logs.</p>
</blockquote>

<ul>
<li>Q: What issues are present preventing moving release-related documentation to the documentation repository?</li>
</ul>

<blockquote>
<p>A: There were some rendering issues last time it was investigated, but it is really nothing more than taking the time to fix those issues. (Note, that since this talk, the migration of the documentation in question had moved.)</p>
</blockquote>

<ul>
<li>Q: Does it make sense to extend the timeframe between milestone builds during a release cycle from one week to two weeks, to allow more time for testing, for example, RC1 versus RC2?</li>
</ul>

<blockquote>
<p>A: No. It would extend the length of the release cycle with no real benefit between milestones since as we draw nearer to the end of a given release cycle, the number of changes to that code base significantly reduce.</p>
</blockquote>

<hr>

<h3><a href="https://flimp.fuzzing-project.org" rel="nofollow">FLIMP - GIMP Exploit on FreeBSD</a></h3>

<blockquote>
<p>In 2014, when starting the <a href="https://fuzzing-project.org/" rel="nofollow">Fuzzing Project</a>, Hanno Böck did some primitive fuzzing on GIMP and reported two bugs. They weren&#39;t fixed and were forgotten in the public bug tracker.<br>
Recently Tobias Stöckmann found <a href="https://bugzilla.gnome.org/show_bug.cgi?id=739133" rel="nofollow">one of these bugs</a> (CVE-2017-17785) and figured out that it&#39;s easy to exploit.</p>
</blockquote>

<ul>
<li>What kind of bug is that?</li>
</ul>

<blockquote>
<p>It&#39;s a classic heap buffer overflow in the FLIC parser. FLIC is a file format for animations and was introduced by Autodesk Animator.</p>
</blockquote>

<ul>
<li>How does the exploit work?</li>
</ul>

<blockquote>
<p>Tobias has created a <a href="https://flimp.fuzzing-project.org/exploit.html" rel="nofollow">detailed writeup</a>.</p>
</blockquote>

<ul>
<li>The exploit doesn&#39;t work for me!</li>
</ul>

<blockquote>
<p>We figured out it&#39;s unreliable and the memory addresses are depending on many circumstances. The exploit ZIP comes with two variations using different memory addresses.<br>
Try both of them. We also noticed putting the files in a subdirectory sometimes made the exploit work.</p>
</blockquote>

<ul>
<li>Anything more to tell about the GIMP?</li>
</ul>

<blockquote>
<p>There&#39;s a wide variety of graphics formats. GIMP tries to support many of them, including many legacy formats that nobody is using any more today.<br>
While this has obvious advantages - you can access the old images you may find on a backup CD from 1995 - it comes with risks. Support for many obscure file formats means many parsers that hardly anyone ever looks at.</p>
</blockquote>

<ul>
<li>So... what about the other parsers?</li>
</ul>

<blockquote>
<p>The <a href="https://bugzilla.gnome.org/show_bug.cgi?id=739134" rel="nofollow">second bug</a> (CVE-2017-17786), which is a simple overread, was in the TGA parser. Furthermore we found buffer overreads in the <a href="https://bugzilla.gnome.org/show_bug.cgi?id=790783" rel="nofollow">XCF parser</a> (CVE-2017-17788), the <a href="https://bugzilla.gnome.org/show_bug.cgi?id=790784" rel="nofollow">Gimp Brush (GBR) parser</a> (CVE-2017-17784) and the <a href="https://bugzilla.gnome.org/show_bug.cgi?id=790849" rel="nofollow">Paint Shop Pro (PSP) parser</a> (CVE-2017-17789).<br>
We found another <a href="https://bugzilla.gnome.org/show_bug.cgi?id=790849" rel="nofollow">Heap buffer overflow</a> in the Paint Shop Pro parser (CVE-2017-17787) which is probably also exploitable.<br>
In other words: The GIMP import parsers are full of memory safety bugs.</p>
</blockquote>

<ul>
<li>What should happen?</li>
</ul>

<blockquote>
<p>First of all obviously all known memory safety bugs should be fixed.<br>
Furthermore we believe the way GIMP plugins work is not ideal for security testing. The plug-ins are separate executables, however they can&#39;t be executed on their own, as they communicate with the main GIMP process.<br>
Ideally either these plug-ins should be changed in a way that allows running them directly from the command line or - even better - they should be turned into libraries. The latter would also have the advantage of making the parser code useable for other software projects.<br>
Finally it might be a good idea to sandbox the import parsers.</p>

<hr>
</blockquote>

<h3><a href="http://blog.frankleonhardt.com/2017/dell-fs12-nv7-review-bargain-freebsdzfs-box/" rel="nofollow">Dell FS12-NV7 Review – Bargain FreeBSD/ZFS box</a></h3>

<blockquote>
<p>It seems just about everyone selling refurbished data centre kit has a load of Dell FS12-NV7’s to flog. Dell FS-what? You won’t find them in the Dell catalogue, that’s for sure. They look a bit like C2100s of some vintage, and they have a lot in common. But on closer inspection they’re obviously a “special” for an important customer. Given the number of them knocking around, it’s obviously a customer with big data, centres stuffed full of servers with a lot of processing to do. Here’s a hint: It’s not Google or Amazon.<br>
So, should you be buying a weirdo box with no documentation whatsoever? I’d say yes, definitely. If you’re interests are anything like mine. In a 2U box you can get twin 4-core CPUs and 64Gb of RAM for £150 or less. What’s not to like? Ah yes, the complete lack of documentation.<br>
Over the next few weeks I intend to cover that. And to start off this is my first PC review for nearly twenty years.<br>
As I mentioned, it’s a 2U full length heavy metal box on rails. On the back there are the usual I/O ports: a 9-way RS-232, VGA, two 1Gb Ethernet, two USB2 and a PS/2 keyboard and mouse. The front is taken up by twelve 3.5″ hard drive bays, with the status lights and power button on one of the mounting ears to make room. Unlike other Dell servers, all the connections are on the back, only.<br>
So, in summary, you’re getting a lot for your money if its the kind of thing you want. It’s ideal as a high-performance Unix box with plenty of drive bays (preferably running BSD and ZFS). In this configuration it really shifts. Major bang-per-buck. Another idea I’ve had is using it for a flight simulator. That’s a lot of RAM and processors for the money. If you forego the SAS controllers in the PCIe slots and dump in a decent graphics card and sound board, it’s hard to see what’s could be better (and you get jet engine sound effects without a speaker).<br>
So who should buy one of these? BSD geeks is the obvious answer. With a bit of tweaking they’re a dream. It can build-absolutely-everything in 20-30 minutes. For storage you can put fast SAS drives in and it goes like the wind, even at 3Gb bandwidth per drive. I don’t know if it works with FreeNAS but I can’t see why not – I’m using mostly FreeBSD 11.1 and the generic kernel is fine. And if you want to run a load of weird operating systems (like Windows XP) in VM format, it seems to work very well with the Xen hypervisor and Dom0 under FreeBSD. Or CentOS if you prefer.<br>
So I shall end this review in true PCW style:</p>
</blockquote>

<ul>
<li>Pros:

<ul>
<li>Cheap</li>
<li>Lots of CPUs,</li>
<li>Lots of RAM</li>
<li>Lots of HD slots</li>
<li>Great for BSD/ZFS or VMs</li>
</ul></li>
<li>Cons:

<ul>
<li>Noisy</li>
<li>no AES-NI</li>
<li>SAS needs upgrading</li>
<li>Limited PCI slots</li>
</ul></li>
</ul>

<blockquote>
<p>As I’ve mentioned, the noise and SAS are easy and relatively cheap to fix, and thanks to BitCoin miners, even the PCI slot problem can be sorted. I’ll talk about this in a later post.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171126090055" rel="nofollow">Reflections on Hackathons</a></li>
<li><a href="https://www.youtube.com/watch?v=HijG0hWebZk&list=PL5yV8umka8YQOr1wm719In5LITdGzQMOF" rel="nofollow">7-Part Video Crash Course on SaltStack For FreeBSD</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/the_llvm_thread_sanitizer_has" rel="nofollow">The LLVM Thread Sanitizer has been ported to NetBSD</a></li>
<li><a href="http://bitsavers.informatik.uni-stuttgart.de/bits/Interdata/32bit/unix/univWollongong_v6/miller.pdf" rel="nofollow">The First Unix Port (1998)</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171208082238" rel="nofollow">arm64 platform now officially supported [and has syspatch(8)]</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/bsdcan-2018-call-for-participation/" rel="nofollow">BSDCan 2018 Call for Participation</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/asiabsdcon-2018-call-for-papers/" rel="nofollow">AsiaBSDCon 2018 Call for Papers</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Shawn - <a href="http://dpaste.com/3PRPJHG#wrap" rel="nofollow">DragonFlyBSD vagrant images</a></li>
<li>Ben - <a href="http://dpaste.com/0AZ32ZB#wrap" rel="nofollow">undermydesk</a></li>
<li>Ken - <a href="http://dpaste.com/3E8FQC6#wrap" rel="nofollow">Conferences</a></li>
<li>Ben - <a href="http://dpaste.com/0E4538Q#wrap" rel="nofollow">ssh keys</a>

<ul>
<li><a href="https://www.bsdnow.tv/tutorials/ssh-chaining" rel="nofollow">SSH Chaining</a>
***</li>
</ul></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>224: The Bus Factor</title>
  <link>https://www.bsdnow.tv/224</link>
  <guid isPermaLink="false">58d9f7dd-0328-4641-b34f-fb00673ba9fb</guid>
  <pubDate>Wed, 13 Dec 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/58d9f7dd-0328-4641-b34f-fb00673ba9fb.mp3" length="72307156" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We try to answer what happens to an open source project after a developers death, we tell you about the last bootstrapped tech company in Silicon Valley, we have an update to the NetBSD Thread sanitizer, and show how to use use cabal on OpenBSD</itunes:subtitle>
  <itunes:duration>1:40:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We try to answer what happens to an open source project after a developers death, we tell you about the last bootstrapped tech company in Silicon Valley, we have an update to the NetBSD Thread sanitizer, and show how to use use cabal on OpenBSD
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Life after death, for code (https://www.wired.com/story/giving-open-source-projects-life-after-a-developers-death/)
YOU'VE PROBABLY NEVER heard of the late Jim Weirich or his software. But you've almost certainly used apps built on his work.
Weirich helped create several key tools for Ruby, the popular programming language used to write the code for sites like Hulu, Kickstarter, Twitter, and countless others. His code was open source, meaning that anyone could use it and modify it. "He was a seminal member of the western world's Ruby community," says Justin Searls, a Ruby developer and co-founder of the software company Test Double.
When Weirich died in 2014, Searls noticed that no one was maintaining one of Weirich's software-testing tools. That meant there would be no one to approve changes if other developers submitted bug fixes, security patches, or other improvements. Any tests that relied on the tool would eventually fail, as the code became outdated and incompatible with newer tech.
The incident highlights a growing concern in the open-source software community. What happens to code after programmers pass away? Much has been written about what happens to social-media accounts after users die. But it’s been less of an issue among programmers. In part, that’s because most companies and governments relied on commercial software maintained by teams of people. But today, more programs rely on obscure but crucial software like Weirich's.
Some open-source projects are well known, such as the Linux operating system or Google's artificial-intelligence framework TensorFlow. But each of these projects depend on smaller libraries of open-source code. And those libraries depend on other libraries. The result is a complex, but largely hidden, web of software dependencies.
That can create big problems, as in 2014 when a security vulnerability known as "Heartbleed" was found in OpenSSL, an open-source program used by nearly every website that processes credit- or debit-card payments. The software comes bundled with most versions of Linux, but was maintained by a small team of volunteers who didn't have the time or resources to do extensive security audits. Shortly after the Heartbleed fiasco, a security issue was discovered in another common open-source application called Bash that left countless web servers and other devices vulnerable to attack.
There are surely more undiscovered vulnerabilities. Libraries.io, a group that analyzes connections between software projects, has identified more than 2,400 open-source libraries that are used in at least 1,000 other programs but have received little attention from the open-source community.
Security problems are only one part of the issue. If software libraries aren't kept up to date, they may stop working with newer software. That means an application that depends on an outdated library may not work after a user updates other software. When a developer dies or abandons a project, everyone who depends on that software can be affected. Last year when programmer Azer Koçulu deleted a tiny library called Leftpad from the internet, it created ripple effects that reportedly caused headaches at Facebook, Netflix, and elsewhere.
The Bus Factor
The fewer people with ownership of a piece of software, the greater the risk that it could be orphaned. Developers even have a morbid name for this: the bus factor, meaning the number of people who would have to be hit by a bus before there's no one left to maintain the project. Libraries.io has identified about 3,000 open-source libraries that are used in many other programs but have only a handful of contributors.
Orphaned projects are a risk of using open-source software, though commercial software makers can leave users in a similar bind when they stop supporting or updating older programs. In some cases, motivated programmers adopt orphaned open-source code.
That's what Searls did with one of Weirich’s projects. Weirich's most-popular projects had co-managers by the time of his death. But Searls noticed one, the testing tool Rspec-Given, hadn't been handed off, and wanted to take responsibility for updating it. But he ran into a few snags along the way.
Rspec-Given's code was hosted on the popular code-hosting and collaboration site GitHub, home to 67 million codebases. Weirich's Rspec-Given page on GitHub was the main place for people to report bugs or to volunteer to help improve the code. But GitHub wouldn’t give Searls control of the page, because Weirich had not named him before he died. So Searls had to create a new copy of the code, and host it elsewhere. He also had to convince the operators of Ruby Gems, a “package-management system” for distributing code, to use his version of Rspec-Given, instead of Weirich's, so that all users would have access to Searls’ changes. GitHub declined to discuss its policies around transferring control of projects.
That solved potential problems related to Rspec-Given, but it opened Searls' eyes to the many things that could go wrong. “It’s easy to see open source as a purely technical phenomenon,” Searls says. “But once something takes off and is depended on by hundreds of other people, it becomes a social phenomenon as well.”
The maintainers of most package-management systems have at least an ad-hoc process for transferring control over a library, but that process usually depends on someone noticing that a project has been orphaned and then volunteering to adopt it. "We don’t have an official policy mostly because it hasn’t come up all that often," says Evan Phoenix of the Ruby Gems project. "We do have an adviser council that is used to decide these types of things case by case."
Some package managers now monitor their libraries and flag widely used projects that haven't been updated in a long time. Neil Bowers, who helps maintain a package manager for the programming language Perl, says he sometimes seeks out volunteers to take over orphan projects. Bowers says his group vets claims that a project has been abandoned, and the people proposing to take it over.
A 'Dead-Man's Switch'
Taking over Rspec-Given inspired Searls, who was only 30 at the time, to make a will and a succession plan for his own open-source projects. There are other things developers can do to help future-proof their work. They can, for example, transfer the copyrights to a foundation, such as the Apache Foundation. But many open-source projects essentially start as hobbies, so programmers may not think to transfer ownership until it is too late.
Searls suggests that GitHub and package managers such as Gems could add something like a "dead man's switch" to their platform, which would allow programmers to automatically transfer ownership of a project or an account to someone else if the creator doesn’t log in or make changes after a set period of time.
But a transition plan means more than just giving people access to the code. Michael Droettboom, who took over a popular mathematics library called Matplotlib after its creator John Hunter died in 2012, points out that successors also need to understand the code. "Sometimes there are parts of the code that only one person understands," he says. "The knowledge exists only in one person's head."
That means getting people involved in a project earlier, ideally as soon as it is used by people other than the original developer. That has another advantage, Searls points out, in distributing the work of maintaining a project to help prevent developer burnout.
The Last Bootstrapped Tech Company In Silicon Valley (https://www.forbes.com/sites/forbestechcouncil/2017/12/12/the-last-bootstrapped-tech-company-in-silicon-valley/2/#4d53d50f1e4d)
My business partner, Matt Olander, and I were intimately familiar with the ups and downs of the Silicon Valley tech industry when we acquired the remnants of our then-employer BSDi’s enterprise computer business in 2002 and assumed the roles of CEO and CTO. Fast-forward to today, and we still work in the same buildings where BSDi started in 1996, though you’d hardly recognize them today.
As the business grew from a startup to a global brand, our success came from always ensuring we ran a profitable business. While that may sound obvious, keep in mind that we are in the heart of Silicon Valley where venture capitalists hunt for the unicorn company that will skyrocket to a billion-dollar valuation. Unicorns like Facebook and Twitter unquestionably exist, but they are the exception.
Live By The VC, Die By The VC
After careful consideration, Matt and I decided to bootstrap our company rather than seek funding. The first dot-com bubble had recently burst, and we were seeing close friends lose their jobs right and left at VC-funded companies based on dubious business plans. While we did not have much cash on hand, we did have a customer base and treasured those customers as our greatest asset. We concluded that meeting their needs was the surest path to meeting ours, and the rest would simply be details to address individually. This strategy ended up working so well that we have many of the same customers to this day.
After deciding to bootstrap, we made a decision on a matter that has left egg on the face of many of our competitors: We seated sales next to support under one roof at our manufacturing facility in Silicon Valley. Dell's decision to outsource some of its support overseas in the early 2000s was the greatest gift it could have given us. Some of our sales and support staff have worked with the same clients for over a decade, and we concluded that no amount of funding could buy that mutual loyalty. While accepting venture capital or an acquisition may make you rich, it does not guarantee that your customers, employees or even business will be taken care of. Our motto is, “Treat your customers like friends and employees like family,” and we have an incredibly low employee turnover to show for it.
Thanks to these principles, iXsystems has remained employee-owned, debt-free and profitable from the day we took it over -- all without VC funding, which is why we call ourselves the "last bootstrapped tech company in Silicon Valley." As a result, we now provide enterprise servers to thousands of customers, including top Fortune 500 companies, research and educational institutions, all branches of the military, and numerous government entities.
Over time, however, we realized that we were selling more and more third-party data storage systems with every order. We saw this as a new opportunity. We had partnered with several storage vendors to meet our customers’ needs, but every time we did, we opened a can of worms with regard to supporting our customers to our standards. Given a choice of risking being dragged down by our partners or outmaneuvered by competitors with their own storage portfolios, we made a conscious decision to develop a line of storage products that would not only complement our enterprise servers but tightly integrate with them.
To accelerate this effort, we adopted the FreeNAS open-source software-defined storage project in 2009 and haven’t looked back. The move enabled us to focus on storage, fully leveraging our experience with enterprise hardware and our open source heritage in equal measures. We saw many storage startups appear every quarter, struggling to establish their niche in a sea of competitors. We wondered how they’d instantly master hardware to avoid the partnering mistakes that we made years ago, given that storage hardware and software are truly inseparable at the enterprise level. We entered the storage market with the required hardware expertise, capacity and, most importantly, revenue, allowing us to develop our storage line at our own pace.
Grow Up, But On Your Own Terms
By not having the external pressure from VCs or shareholders that your competitors have, you're free to set your own priorities and charge fair prices for your products. Our customers consistently tell us how refreshing our sales and marketing approaches are. We consider honesty, transparency and responsible marketing the only viable strategy when you’re bootstrapped. Your reputation with your customers and vendors should mean everything to you, and we can honestly say that the loyalty we have developed is priceless.
So how can your startup venture down a similar path? Here's our advice for playing the long game:
Relate your experiences to each fad: Our industry is a firehose of fads and buzzwords, and it can be difficult to distinguish the genuine trends from the flops. Analyze every new buzzword in terms of your own products, services and experiences, and monitor customer trends even more carefully. Some buzzwords will even formalize things you have been doing for years.
Value personal relationships: Companies come and go, but you will maintain many clients and colleagues for decades, regardless of the hat they currently wear. Encourage relationship building at every level of your company because you may encounter someone again.
Trust your instincts and your colleagues: No contractual terms or credit rating system can beat the instincts you will develop over time for judging the ability of individuals and companies to deliver. You know your business, employees and customers best.
Looking back, I don't think I’d change a thing. We need to be in Silicon Valley for the prime customers, vendors and talent, and it’s a point of pride that our customers recognize how different we are from the norm. Free of a venture capital “runway” and driven by these principles, we look forward to the next 20 years in this highly-competitive industry.
Creating an AS for fun and profit (http://blog.thelifeofkenneth.com/2017/11/creating-autonomous-system-for-fun-and.html)
At its core, the Internet is an interconnected fabric of separate networks. Each network which makes up the Internet is operated independently and only interconnects with other networks in clearly defined places.
For smaller networks like your home, the interaction between your network and the rest of the Internet is usually pretty simple: you buy an Internet service plan from an ISP (Internet Service Provider), they give you some kind of hand-off through something like a DSL or cable modem, and give you access to "the entire Internet". Your router (which is likely also a WiFi access point and Ethernet switch) then only needs to know about two things; your local computers and devices are on one side, and the ENTIRE Internet is on the other side of that network link given to you by your ISP.
For most people, that's the extent of what's needed to be understood about how the Internet works. Pick the best ISP, buy a connection from them, and attach computers needing access to the Internet. And that's fine, as long as you're happy with only having one Internet connection from one vendor, who will lend you some arbitrary IP address(es) for the extend of your service agreement, but that starts not being good enough when you don't want to be beholden to a single ISP or a single connection for your connectivity to the Internet.
That also isn't good enough if you are an Internet Service Provider so you are literally a part of the Internet. You can't assume that the entire Internet is that way when half of the Internet is actually in the other direction. This is when you really have to start thinking about the Internet and treating the Internet as a very large mesh of independent connected organizations instead of an abstract cloud icon on the edge of your local network map.  Which is pretty much never for most of us.
Almost no one needs to consider the Internet at this level. The long flight of steps from DSL for your apartment up to needing to be an integral part of the Internet means that pretty much regardless of what level of Internet service you need for your projects, you can probably pay someone else to provide it and don't need to sit down and learn how BGP works and what an Autonomous System is. But let's ignore that for one second, and talk about how to become your own ISP.
To become your own Internet Service Provider with customers who pay you to access the Internet, or be your own web hosting provider with customers who pay you to be accessible from the Internet, or your own transit provider who has customers who pay you to move their customer's packets to other people's customers, you need a few things:
Your own public IP address space allocated to you by an Internet numbering organization
Your own Autonomous System Number (ASN) to identify your network as separate from everyone else's networks
At least one router connected to a different autonomous system speaking the Border Gateway Protocol to tell the rest of the Internet that your address space is accessible from your autonomous system.
So... I recently set up my own autonomous system... and I don't really have a fantastic justification for it...
My motivation was twofold:
One of my friends and I sat down and figured it out that splitting the cost of a rack in Hurricane Electric's FMT2 data center marginally lowered our monthly hosting expenses vs all the paid services we're using scattered across the Internet which can all be condensed into this one rack.
And this first reason on its own is a perfectly valid justification for paying for co-location space at a data center like Hurricane Electric's, but isn't actually a valid reason for running it as an autonomous system, because Hurricane Electric will gladly let you use their address space for your servers hosted in their building. That's usually part of the deal when you pay for space in a data center: power, cooling, Internet connectivity, and your own IP addresses.
Another one of my friends challenged me to do it as an Autonomous System.
So admittedly, my justification for going through the additional trouble to set up this single rack of servers as an AS is a little more tenuous. I will readily admit that, more than anything else, this was a "hold my beer" sort of engineering moment, and not something that is at all needed to achieve what we actually needed (a rack to park all our servers in).
But what the hell; I've figured out how to do it, so I figured it would make an entertaining blog post. 
So here's how I set up a multi-homed autonomous system on a shoe-string budget:
Step 1. Found a Company
Step 2. Get Yourself Public Address Space
Step 3. Find Yourself Multiple Other Autonomous Systems to Peer With
Step 4. Apply for an Autonomous System Number
Step 5. Source a Router Capable of Handling the Entire Internet Routing Table
Step 6. Turn it All On and Pray
And we're off to the races.
At this point, Hurricane Electric is feeding us all ~700k routes for the Internet, we're feeding them our two routes for our local IPv4 and IPv6 subnets, and all that's left to do is order all our cross-connects to other ASes in the building willing to peer with us (mostly for fun) and load in all our servers to build our own personal corner of the Internet.
The only major goof so far has been accidentally feeding the full IPv6 table to our first other peer that we turned on, but thankfully he has a much more powerful supervisor than the Sup720-BXL, so he just sent me an email to knock that off, a little fiddling with my BGP egress policies, and we were all set.
In the end, setting up my own autonomous system wasn't exactly simple, it was definitely not justified, but some times in life you just need to take the more difficult path. And there's a certain amount of pride in being able to claim that I'm part of the actual Internet. That's pretty neat. 
And of course, thanks to all of my friends who variously contributed parts, pieces, resources, and know-how to this on-going project. I had to pull in a lot of favors to pull this off, and I appreciate it.
News Roundup
One year checkpoint and Thread Sanitizer update (https://blog.netbsd.org/tnf/entry/one_year_checkpoint_and_thread)
The past year has been started with bugfixes and the development of regression tests for ptrace(2) and related kernel features, as well as the continuation of bringing LLDB support and LLVM sanitizers (ASan + UBsan and partial TSan + Msan) to NetBSD.  My plan for the next year is to finish implementing TSan and MSan support, followed by a long run of bug fixes for LLDB, ptrace(2), and other related kernel subsystems
TSan
In the past month, I've developed Thread Sanitizer far enough to have a subset of its tests pass on NetBSD, started with addressing breakage related to the memory layout of processes. The reason for this breakage was narrowed down to the current implementation of ASLR, which was too aggressive and which didn't allow enough space to be mapped for Shadow memory. The fix for this was to either force the disabling of ASLR per-process, or globally on the system. The same will certainly happen for MSan executables. After some other corrections, I got TSan to work for the first time ever on October 14th. This was a big achievement, so I've made a snapshot available. Getting the snapshot of execution under GDB was pure hazard.
```
$ gdb ./a.out                                  
GNU gdb (GDB) 7.12
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64--netbsd".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./a.out...done.
(gdb) r
Starting program: /public/llvm-build/a.out 
[New LWP 2]
WARNING: ThreadSanitizer: data race (pid=1621)
  Write of size 4 at 0x000001475d70 by thread T1:
    #0 Thread1 /public/llvm-build/tsan.c:4:10 (a.out+0x46bf71)
  Previous write of size 4 at 0x000001475d70 by main thread:
    #0 main /public/llvm-build/tsan.c:10:10 (a.out+0x46bfe6)
  Location is global 'Global' of size 4 at 0x000001475d70 (a.out+0x000001475d70)
  Thread T1 (tid=2, running) created by main thread at:
    #0 pthreadcreate /public/llvm/projects/compiler-rt/lib/tsan/rtl/tsaninterceptors.cc:930:3 (a.out+0x412120)
    #1 main /public/llvm-build/tsan.c:9:3 (a.out+0x46bfd1)
SUMMARY: ThreadSanitizer: data race /public/llvm-build/tsan.c:4:10 in Thread1
Thread 2 received signal SIGSEGV, Segmentation fault.
```
I was able to get the above execution results around 10% of the time (being under a tracer had no positive effect on the frequency of successful executions).  I've managed to hit the following final results for this month, with another set of bugfixes and improvements:

check-tsan:
Expected Passes    : 248
Expected Failures  : 1
Unsupported Tests  : 83
Unexpected Failures: 44

At the end of the month, TSan can now reliably executabe the same (already-working) program every time. The majority of failures are in tests verifying sanitization of correct mutex locking usage. There are still problems with NetBSD-specific libc and libpthread bootstrap code that conflicts with TSan. Certain functions (pthreadcreate(3), pthreadkeycreate(3), _cxaatexit()) cannot be started early by TSan initialization, and must be deferred late enough for the sanitizer to work correctly.
MSan
I've prepared a scratch support for MSan on NetBSD to help in researching how far along it is. I've also cloned and adapted the existing FreeBSD bits; however, the code still needs more work and isn't functional yet. The number of passed tests (5) is negligible and most likely does not work at all. The conclusion after this research is that TSan shall be finished first, as it touches similar code. In the future, there will be likely another round of iterating the system structs and types and adding the missing ones for NetBSD. So far, this part has been done before executing the real MSan code. I've added one missing symbol that was missing and was detected when attempting to link a test program with MSan.
Sanitizers
The GCC team has merged the LLVM sanitizer code, which has resulted in almost-complete support for ASan and UBsan on NetBSD. It can be found in the latest GCC8 snapshot, located in pkgsrc-wip/gcc8snapshot. Though, do note that there is an issue with getting backtraces from libasan.so, which can be worked-around by backtracing ASan events in a debugger. UBsan also passes all GCC regression tests and appears to work fine. The code enabling sanitizers on the GCC/NetBSD frontend will be submitted upstream once the backtracing issue is fixed and I'm satisfied that there are no other problems. I've managed to upstream a large portion of generic+TSan+MSan code to compiler-rt and reduce local patches to only the ones that are in progress. This deals with any rebasing issues, and allows me to just focus on the delta that is being worked on. I've tried out the LLDB builds which have TSan/NetBSD enabled, and they built and started fine. However, there were some false positives related to the mutex locking/unlocking code.
Plans for the next milestone
The general goals are to finish TSan and MSan and switch back to LLDB debugging. I plan to verify the impact of the TSan bootstrap initialization on the observed crashes and research the remaining failures.
This work was sponsored by The NetBSD Foundation.
The NetBSD Foundation is a non-profit organization and welcomes any donations to help us continue funding projects and services to the open-source community. Please consider visiting the following URL, and chip in what you can:
The scourge of systemd (https://blog.ungleich.ch/en-us/cms/blog/2017/12/10/the-importance-of-devuan/)
While this article is actually couched in terms of promoting devuan, a de-systemd-ed version of debian, it would seem the same logic could be applied to all of the BSDs
Let's say every car manufacturer recently discovered a new technology named "doord", which lets you open up car doors much faster than before. It only takes 0.05 seconds, instead of 1.2 seconds on average. So every time you open a door, you are much, much faster!
Many of the manufacturers decide to implement doord, because the company providing doord makes it clear that it is beneficial for everyone. And additional to opening doors faster, it also standardises things. How to turn on your car? It is the same now everywhere, it is not necessarily to look for the keyhole anymore.
Unfortunately though, sometimes doord does not stop the engine. Or if it is cold outside, it stops the ignition process, because it takes too long. Doord also changes the way your navigation system works, because that is totally related to opening doors, but leads to some users being unable to navigate, which is accepted as collateral damage. In the end, you at least have faster door opening and a standard way to turn on the car. Oh, and if you are in a traffic jam and have to restart the engine often, it will stop restarting it after several times, because that's not what you are supposed to do. You can open the engine hood and tune that setting though, but it will be reset once you buy a new car.
Some of you might now ask themselves "Is systemd THAT bad?". And my answer to it is: No. It is even worse. Systemd developers split the community over a tiny detail that decreases stability significantly and increases complexity for not much real value. And this is not theoretical: We tried to build Data Center Light on Debian and Ubuntu, but servers that don't boot, that don't reboot or systemd-resolved that constantly interferes with our core network configuration made it too expensive to run Debian or Ubuntu.
Yes, you read right: too expensive. While I am writing here in flowery words, the reason to use Devuan is hard calculated costs. We are a small team at ungleich and we simply don't have the time to fix problems caused by systemd on a daily basis. This is even without calculating the security risks that come with systemd.
Using cabal on OpenBSD (https://deftly.net/posts/2017-10-12-using-cabal-on-openbsd.html)
Since W^X became mandatory in OpenBSD (https://undeadly.org/cgi?action=article&amp;amp;sid=20160527203200), W^X’d binaries are only allowed to be executed from designated locations (mount points). If you used the auto partition layout during install, your /usr/local/ will be mounted with wxallowed. For example, here is the entry for my current machine:

/dev/sd2g on /usr/local type ffs (local, nodev, wxallowed, softdep)

This is a great feature, but if you build applications outside of the wxallowed partition, you are going to run into some issues, especially in the case of cabal (python as well).
Here is an example of what you would see when attempting to do cabal install pandoc:

qbit@slip[1]:~? cabal update
Config file path source is default config file.
Config file /home/qbit/.cabal/config not found.
Writing default configuration to /home/qbit/.cabal/config
Downloading the latest package list from hackage.haskell.org
qbit@slip[0]:~? cabal install pandoc
Resolving dependencies...
.....
cabal: user error (Error: some packages failed to install:
JuicyPixels-3.2.8.3 failed during the configure step. The exception was:
/home/qbit/.cabal/setup-exe-cache/setup-Simple-Cabal-1.22.5.0-x86_64-openbsd-ghc-7.10.3: runProcess: runInteractiveProcess: exec: permission denied (Permission denied)

The error isn’t actually what it says. The untrained eye would assume permissions issue. A quick check of dmesg reveals what is really happening:

/home/qbit/.cabal/setup-exe-cache/setup-Simple-Cabal-1.22.5.0-x86_64-openbsd-ghc-7.10.3(22924): W^X binary outside wxallowed mountpoint

OpenBSD is killing the above binary because it is violating W^X and hasn’t been safely kept in its /usr/local corral!
We could solve this problem quickly by marking our /home as wxallowed, however, this would be heavy handed and reckless (we don’t want to allow other potentially unsafe binaries to execute.. just the cabal stuff).
Instead, we will build all our cabal stuff in /usr/local by using a symlink!

doas mkdir -p /usr/local/{cabal,cabal/build} # make our cabal and build dirs
doas chown -R user:wheel /usr/local/cabal    # set perms
rm -rf ~/.cabal                              # kill the old non-working cabal
ln -s /usr/local/cabal ~/.cabal              # link it!

We are almost there! Some cabal packages build outside of ~/.cabal:

cabal install hakyll
.....
Building foundation-0.0.14...                                                   Preprocessing library foundation-0.0.14...
hsc2hs: dist/build/Foundation/System/Bindings/Posix_hsc_make: runProcess: runInteractiveProcess: exec: permission denied (Permission denied)
Downloading time-locale-compat-0.1.1.3...
.....

Fortunately, all of the packages I have come across that do this all respect the TMPDIR environment variable!

alias cabal='env TMPDIR=/usr/local/cabal/build/ cabal'

With this alias, you should be able to cabal without issue (so far pandoc, shellcheck and hakyll have all built fine)!
TL;DR

# This assumes /usr/local/ is mounted as wxallowed.
#
doas mkdir -p /usr/local/{cabal,cabal/build}
doas chown -R user:wheel /usr/local/cabal
rm -rf ~/.cabal
ln -s /usr/local/cabal ~/.cabal
alias cabal='env TMPDIR=/usr/local/cabal/build/ cabal'
cabal install pandoc

FreeBSD and APRS, or "hm what happens when none of this is well documented.." (https://adrianchadd.blogspot.co.uk/2017/10/freebsd-and-aprs-or-hm-what-happens.html)
Here's another point along my quest for amateur radio on FreeBSD - bring up basic APRS support. Yes, someone else has done the work, but in the normal open source way it was .. inconsistently documented.
First is figuring out the hardware platform. I chose the following:
A Baofeng UV5R2, since they're cheap, plentiful, and do both VHF and UHF;
A cable to do sound level conversion and isolation (and yes, I really should post a circuit diagram and picture..);
A USB sound device, primarily so I can whack it into FreeBSD/Linux devices to get a separate sound card for doing radio work;
FreeBSD laptop (it'll become a raspberry pi + GPS + sensor + LCD thingy later, but this'll do to start with.)
The Baofeng is easy - set it to the right frequency (VHF APRS sits on 144.390MHz), turn on VOX so I don't have to make up a PTT cable, done/done.
The PTT bit isn't that hard - one of the microphone jack pins is actually PTT (if you ground it, it engages PTT) so when you make the cable just ensure you expose a ground pin and PTT pin so you can upgrade it later.
The cable itself isn't that hard either - I had a baofeng handmic lying around (they're like $5) so I pulled it apart for the cable. I'll try to remember to take pictures of that.
Here's a picture I found on the internet that shows the pinout: image (https://3.bp.blogspot.com/-58HUyt-9SUw/Wdz6uMauWlI/AAAAAAAAVz8/e7OrnRzN3908UYGUIRI1EBYJ5UcnO0qRgCLcBGAs/s1600/aprs-cable.png)
Now, I went a bit further. I bought a bunch of 600 ohm isolation transformers for audio work, so I wired it up as follows:
From the audio output of the USB sound card, I wired up a little attenuator - input is 2k to ground, then 10k to the input side of the transformer; then the output side of the transformer has a 0.01uF greencap capacitor to the microphone input of the baofeng;
From the baofeng I just wired it up to the transformer, then the output side of that went into a 0.01uF greencap capacitor in series to the microphone input of the sound card.
In both instances those capacitors are there as DC blockers.
Ok, so that bit is easy. Then on to the software side. The normal way people do this stuff is "direwolf" on Linux. So, "pkg install direwolf" installed it. That was easy.
Configuring it up was a bit less easy. I found this guide to be helpful (https://andrewmemory.wordpress.com/tag/direwolf/)
FreeBSD has the example direwolf config in /usr/local/share/doc/direwolf/examples/direwolf.conf . Now, direwolf will run as a normal user (there's no rc.d script for it yet!) and by default runs out of the current directory. So:

$ cd ~
$ cp /usr/local/share/doc/direwolf/examples/direwolf.conf . 
$ (edit it)
$ direwolf

Editing it isn't that hard - you need to change your callsign and the audio device.
OK, here is the main undocumented bit for FreeBSD - the sound device can just be /dev/dsp . It isn't an ALSA name! Don't waste time trying to use ALSA names. Instead, just find the device you want and reference it. For me the USB sound card shows up as /dev/dsp3 (which is very non specific as USB sound devices come and go, but that's a later problem!) but it's enough to bring it up.
So yes, following the above guide, using the right sound device name resulted in a working APRS modem.
Next up - something to talk to it. This is called 'xastir'. It's .. well, when you run it, you'll find exactly how old an X application it is. It's very nostalgically old. But, it is enough to get APRS positioning up and test both the TCP/IP side of APRS and the actual radio radio side.
Here's the guide I followed: (https://andrewmemory.wordpress.com/2015/03/22/setting-up-direwolfxastir-on-a-raspberry-pi/)
So, that was it! So far so good. It actually works well enough to decode and watch APRS traffic around me. I managed to get out position information to the APRS network over both TCP/IP and relayed via VHF radio.
Beastie Bits
Zebras All the Way Down - Bryan Cantrill (https://www.youtube.com/watch?v=fE2KDzZaxvE)
Your impact on FreeBSD (https://www.freebsdfoundation.org/blog/your-impact-on-freebsd/)
The Secret to a good Gui (https://bsdmag.org/secret-good-gui/)
containerd hits v1.0.0 (https://github.com/containerd/containerd/releases/tag/v1.0.0)
FreeBSD 11.1 Custom Kernels Made Easy - Configuring And Installing A Custom Kernel (https://www.youtube.com/watch?v=lzdg_2bUh9Y&amp;amp;t=)
Debugging (https://pbs.twimg.com/media/DQgCNq6UEAEqa1W.jpg:large)
***
Feedback/Questions
Bostjan - Backup Tapes (http://dpaste.com/22ZVJ12#wrap)
Philipp - A long time ago, there was a script (http://dpaste.com/13E8RGR#wrap)
Adam - ZFS Pool Monitoring (http://dpaste.com/3BQXXPM#wrap)
Damian - KnoxBug (http://dpaste.com/0ZZVM4R#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We try to answer what happens to an open source project after a developers death, we tell you about the last bootstrapped tech company in Silicon Valley, we have an update to the NetBSD Thread sanitizer, and show how to use use cabal on OpenBSD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.wired.com/story/giving-open-source-projects-life-after-a-developers-death/" rel="nofollow">Life after death, for code</a></h3>

<blockquote>
<p>YOU&#39;VE PROBABLY NEVER heard of the late Jim Weirich or his software. But you&#39;ve almost certainly used apps built on his work.<br>
Weirich helped create several key tools for Ruby, the popular programming language used to write the code for sites like Hulu, Kickstarter, Twitter, and countless others. His code was open source, meaning that anyone could use it and modify it. &quot;He was a seminal member of the western world&#39;s Ruby community,&quot; says Justin Searls, a Ruby developer and co-founder of the software company Test Double.<br>
When Weirich died in 2014, Searls noticed that no one was maintaining one of Weirich&#39;s software-testing tools. That meant there would be no one to approve changes if other developers submitted bug fixes, security patches, or other improvements. Any tests that relied on the tool would eventually fail, as the code became outdated and incompatible with newer tech.<br>
The incident highlights a growing concern in the open-source software community. What happens to code after programmers pass away? Much has been written about what happens to social-media accounts after users die. But its been less of an issue among programmers. In part, thats because most companies and governments relied on commercial software maintained by teams of people. But today, more programs rely on obscure but crucial software like Weirich&#39;s.<br>
Some open-source projects are well known, such as the Linux operating system or Google&#39;s artificial-intelligence framework TensorFlow. But each of these projects depend on smaller libraries of open-source code. And those libraries depend on other libraries. The result is a complex, but largely hidden, web of software dependencies.<br>
That can create big problems, as in 2014 when a security vulnerability known as &quot;Heartbleed&quot; was found in OpenSSL, an open-source program used by nearly every website that processes credit- or debit-card payments. The software comes bundled with most versions of Linux, but was maintained by a small team of volunteers who didn&#39;t have the time or resources to do extensive security audits. Shortly after the Heartbleed fiasco, a security issue was discovered in another common open-source application called Bash that left countless web servers and other devices vulnerable to attack.<br>
There are surely more undiscovered vulnerabilities. Libraries.io, a group that analyzes connections between software projects, has identified more than 2,400 open-source libraries that are used in at least 1,000 other programs but have received little attention from the open-source community.<br>
Security problems are only one part of the issue. If software libraries aren&#39;t kept up to date, they may stop working with newer software. That means an application that depends on an outdated library may not work after a user updates other software. When a developer dies or abandons a project, everyone who depends on that software can be affected. Last year when programmer Azer Koçulu deleted a tiny library called Leftpad from the internet, it created ripple effects that reportedly caused headaches at Facebook, Netflix, and elsewhere.</p>
</blockquote>

<ul>
<li>The Bus Factor</li>
</ul>

<blockquote>
<p>The fewer people with ownership of a piece of software, the greater the risk that it could be orphaned. Developers even have a morbid name for this: the bus factor, meaning the number of people who would have to be hit by a bus before there&#39;s no one left to maintain the project. Libraries.io has identified about 3,000 open-source libraries that are used in many other programs but have only a handful of contributors.<br>
Orphaned projects are a risk of using open-source software, though commercial software makers can leave users in a similar bind when they stop supporting or updating older programs. In some cases, motivated programmers adopt orphaned open-source code.<br>
That&#39;s what Searls did with one of Weirichs projects. Weirich&#39;s most-popular projects had co-managers by the time of his death. But Searls noticed one, the testing tool Rspec-Given, hadn&#39;t been handed off, and wanted to take responsibility for updating it. But he ran into a few snags along the way.<br>
Rspec-Given&#39;s code was hosted on the popular code-hosting and collaboration site GitHub, home to 67 million codebases. Weirich&#39;s Rspec-Given page on GitHub was the main place for people to report bugs or to volunteer to help improve the code. But GitHub wouldnt give Searls control of the page, because Weirich had not named him before he died. So Searls had to create a new copy of the code, and host it elsewhere. He also had to convince the operators of Ruby Gems, a package-management system for distributing code, to use his version of Rspec-Given, instead of Weirich&#39;s, so that all users would have access to Searls changes. GitHub declined to discuss its policies around transferring control of projects.</p>

<p>That solved potential problems related to Rspec-Given, but it opened Searls&#39; eyes to the many things that could go wrong. Its easy to see open source as a purely technical phenomenon, Searls says. But once something takes off and is depended on by hundreds of other people, it becomes a social phenomenon as well.<br>
The maintainers of most package-management systems have at least an ad-hoc process for transferring control over a library, but that process usually depends on someone noticing that a project has been orphaned and then volunteering to adopt it. &quot;We dont have an official policy mostly because it hasnt come up all that often,&quot; says Evan Phoenix of the Ruby Gems project. &quot;We do have an adviser council that is used to decide these types of things case by case.&quot;<br>
Some package managers now monitor their libraries and flag widely used projects that haven&#39;t been updated in a long time. Neil Bowers, who helps maintain a package manager for the programming language Perl, says he sometimes seeks out volunteers to take over orphan projects. Bowers says his group vets claims that a project has been abandoned, and the people proposing to take it over.</p>
</blockquote>

<ul>
<li>A &#39;Dead-Man&#39;s Switch&#39;</li>
</ul>

<blockquote>
<p>Taking over Rspec-Given inspired Searls, who was only 30 at the time, to make a will and a succession plan for his own open-source projects. There are other things developers can do to help future-proof their work. They can, for example, transfer the copyrights to a foundation, such as the Apache Foundation. But many open-source projects essentially start as hobbies, so programmers may not think to transfer ownership until it is too late.<br>
Searls suggests that GitHub and package managers such as Gems could add something like a &quot;dead man&#39;s switch&quot; to their platform, which would allow programmers to automatically transfer ownership of a project or an account to someone else if the creator doesnt log in or make changes after a set period of time.<br>
But a transition plan means more than just giving people access to the code. Michael Droettboom, who took over a popular mathematics library called Matplotlib after its creator John Hunter died in 2012, points out that successors also need to understand the code. &quot;Sometimes there are parts of the code that only one person understands,&quot; he says. &quot;The knowledge exists only in one person&#39;s head.&quot;<br>
That means getting people involved in a project earlier, ideally as soon as it is used by people other than the original developer. That has another advantage, Searls points out, in distributing the work of maintaining a project to help prevent developer burnout.</p>
</blockquote>

<hr>

<h3><a href="https://www.forbes.com/sites/forbestechcouncil/2017/12/12/the-last-bootstrapped-tech-company-in-silicon-valley/2/#4d53d50f1e4d" rel="nofollow">The Last Bootstrapped Tech Company In Silicon Valley</a></h3>

<blockquote>
<p>My business partner, Matt Olander, and I were intimately familiar with the ups and downs of the Silicon Valley tech industry when we acquired the remnants of our then-employer BSDis enterprise computer business in 2002 and assumed the roles of CEO and CTO. Fast-forward to today, and we still work in the same buildings where BSDi started in 1996, though youd hardly recognize them today.<br>
As the business grew from a startup to a global brand, our success came from always ensuring we ran a profitable business. While that may sound obvious, keep in mind that we are in the heart of Silicon Valley where venture capitalists hunt for the unicorn company that will skyrocket to a billion-dollar valuation. Unicorns like Facebook and Twitter unquestionably exist, but they are the exception.</p>
</blockquote>

<ul>
<li>Live By The VC, Die By The VC</li>
</ul>

<blockquote>
<p>After careful consideration, Matt and I decided to bootstrap our company rather than seek funding. The first dot-com bubble had recently burst, and we were seeing close friends lose their jobs right and left at VC-funded companies based on dubious business plans. While we did not have much cash on hand, we did have a customer base and treasured those customers as our greatest asset. We concluded that meeting their needs was the surest path to meeting ours, and the rest would simply be details to address individually. This strategy ended up working so well that we have many of the same customers to this day.<br>
After deciding to bootstrap, we made a decision on a matter that has left egg on the face of many of our competitors: We seated sales next to support under one roof at our manufacturing facility in Silicon Valley. Dell&#39;s decision to outsource some of its support overseas in the early 2000s was the greatest gift it could have given us. Some of our sales and support staff have worked with the same clients for over a decade, and we concluded that no amount of funding could buy that mutual loyalty. While accepting venture capital or an acquisition may make you rich, it does not guarantee that your customers, employees or even business will be taken care of. Our motto is, Treat your customers like friends and employees like family, and we have an incredibly low employee turnover to show for it.<br>
Thanks to these principles, iXsystems has remained employee-owned, debt-free and profitable from the day we took it over -- all without VC funding, which is why we call ourselves the &quot;last bootstrapped tech company in Silicon Valley.&quot; As a result, we now provide enterprise servers to thousands of customers, including top Fortune 500 companies, research and educational institutions, all branches of the military, and numerous government entities.<br>
Over time, however, we realized that we were selling more and more third-party data storage systems with every order. We saw this as a new opportunity. We had partnered with several storage vendors to meet our customers needs, but every time we did, we opened a can of worms with regard to supporting our customers to our standards. Given a choice of risking being dragged down by our partners or outmaneuvered by competitors with their own storage portfolios, we made a conscious decision to develop a line of storage products that would not only complement our enterprise servers but tightly integrate with them.<br>
To accelerate this effort, we adopted the FreeNAS open-source software-defined storage project in 2009 and havent looked back. The move enabled us to focus on storage, fully leveraging our experience with enterprise hardware and our open source heritage in equal measures. We saw many storage startups appear every quarter, struggling to establish their niche in a sea of competitors. We wondered how theyd instantly master hardware to avoid the partnering mistakes that we made years ago, given that storage hardware and software are truly inseparable at the enterprise level. We entered the storage market with the required hardware expertise, capacity and, most importantly, revenue, allowing us to develop our storage line at our own pace.</p>
</blockquote>

<ul>
<li>Grow Up, But On Your Own Terms</li>
</ul>

<blockquote>
<p>By not having the external pressure from VCs or shareholders that your competitors have, you&#39;re free to set your own priorities and charge fair prices for your products. Our customers consistently tell us how refreshing our sales and marketing approaches are. We consider honesty, transparency and responsible marketing the only viable strategy when youre bootstrapped. Your reputation with your customers and vendors should mean everything to you, and we can honestly say that the loyalty we have developed is priceless.<br>
So how can your startup venture down a similar path? Here&#39;s our advice for playing the long game:</p>
</blockquote>

<ul>
<li>Relate your experiences to each fad: Our industry is a firehose of fads and buzzwords, and it can be difficult to distinguish the genuine trends from the flops. Analyze every new buzzword in terms of your own products, services and experiences, and monitor customer trends even more carefully. Some buzzwords will even formalize things you have been doing for years.</li>
<li>Value personal relationships: Companies come and go, but you will maintain many clients and colleagues for decades, regardless of the hat they currently wear. Encourage relationship building at every level of your company because you may encounter someone again.</li>
<li>Trust your instincts and your colleagues: No contractual terms or credit rating system can beat the instincts you will develop over time for judging the ability of individuals and companies to deliver. You know your business, employees and customers best.</li>
</ul>

<blockquote>
<p>Looking back, I don&#39;t think Id change a thing. We need to be in Silicon Valley for the prime customers, vendors and talent, and its a point of pride that our customers recognize how different we are from the norm. Free of a venture capital runway and driven by these principles, we look forward to the next 20 years in this highly-competitive industry.</p>
</blockquote>

<hr>

<h3><a href="http://blog.thelifeofkenneth.com/2017/11/creating-autonomous-system-for-fun-and.html" rel="nofollow">Creating an AS for fun and profit</a></h3>

<blockquote>
<p>At its core, the Internet is an interconnected fabric of separate networks. Each network which makes up the Internet is operated independently and only interconnects with other networks in clearly defined places.<br>
For smaller networks like your home, the interaction between your network and the rest of the Internet is usually pretty simple: you buy an Internet service plan from an ISP (Internet Service Provider), they give you some kind of hand-off through something like a DSL or cable modem, and give you access to &quot;the entire Internet&quot;. Your router (which is likely also a WiFi access point and Ethernet switch) then only needs to know about two things; your local computers and devices are on one side, and the ENTIRE Internet is on the other side of that network link given to you by your ISP.<br>
For most people, that&#39;s the extent of what&#39;s needed to be understood about how the Internet works. Pick the best ISP, buy a connection from them, and attach computers needing access to the Internet. And that&#39;s fine, as long as you&#39;re happy with only having one Internet connection from one vendor, who will lend you some arbitrary IP address(es) for the extend of your service agreement, but that starts not being good enough when you don&#39;t want to be beholden to a single ISP or a single connection for your connectivity to the Internet.<br>
That also isn&#39;t good enough if you <em>are</em> an Internet Service Provider so you are literally a part of the Internet. You can&#39;t assume that the entire Internet is that way when half of the Internet is actually in the other direction. This is when you really have to start thinking about the Internet and treating the Internet as a very large mesh of independent connected organizations instead of an abstract cloud icon on the edge of your local network map.  Which is pretty much never for most of us.<br>
Almost no one needs to consider the Internet at this level. The long flight of steps from DSL for your apartment up to needing to be an integral part of the Internet means that pretty much regardless of what level of Internet service you need for your projects, you can probably pay someone else to provide it and don&#39;t need to sit down and learn how BGP works and what an Autonomous System is. But let&#39;s ignore that for one second, and talk about how to become your own ISP.</p>
</blockquote>

<ul>
<li>To become your own Internet Service Provider with customers who pay you to access the Internet, or be your own web hosting provider with customers who pay you to be accessible from the Internet, or your own transit provider who has customers who pay you to move their customer&#39;s packets to other people&#39;s customers, you need a few things:

<ul>
<li>Your own public IP address space allocated to you by an Internet numbering organization</li>
<li>Your own Autonomous System Number (ASN) to identify your network as separate from everyone else&#39;s networks</li>
<li>At least one router connected to a different autonomous system speaking the Border Gateway Protocol to tell the rest of the Internet that your address space is accessible from your autonomous system.</li>
</ul></li>
</ul>

<blockquote>
<p>So... I recently set up my own autonomous system... and I don&#39;t really have a fantastic justification for it...</p>
</blockquote>

<ul>
<li>My motivation was twofold:

<ul>
<li>One of my friends and I sat down and figured it out that splitting the cost of a rack in Hurricane Electric&#39;s FMT2 data center marginally lowered our monthly hosting expenses vs all the paid services we&#39;re using scattered across the Internet which can all be condensed into this one rack.</li>
<li>And this first reason on its own is a perfectly valid justification for paying for co-location space at a data center like Hurricane Electric&#39;s, but isn&#39;t actually a valid reason for running it as an autonomous system, because Hurricane Electric will gladly let you use their address space for your servers hosted in their building. That&#39;s usually part of the deal when you pay for space in a data center: power, cooling, Internet connectivity, and your own IP addresses.</li>
<li>Another one of my friends challenged me to do it as an Autonomous System.</li>
<li>So admittedly, my justification for going through the additional trouble to set up this single rack of servers as an AS is a little more tenuous. I will readily admit that, more than anything else, this was a &quot;hold my beer&quot; sort of engineering moment, and not something that is at all needed to achieve what we actually needed (a rack to park all our servers in).</li>
</ul></li>
</ul>

<blockquote>
<p>But what the hell; I&#39;ve figured out how to do it, so I figured it would make an entertaining blog post. </p>
</blockquote>

<ul>
<li>So here&#39;s how I set up a multi-homed autonomous system on a shoe-string budget:

<ul>
<li>Step 1. Found a Company</li>
<li>Step 2. Get Yourself Public Address Space</li>
<li>Step 3. Find Yourself Multiple Other Autonomous Systems to Peer With</li>
<li>Step 4. Apply for an Autonomous System Number</li>
<li>Step 5. Source a Router Capable of Handling the Entire Internet Routing Table</li>
<li>Step 6. Turn it All On and Pray</li>
<li>And we&#39;re off to the races.</li>
</ul></li>
</ul>

<blockquote>
<p>At this point, Hurricane Electric is feeding us all ~700k routes for the Internet, we&#39;re feeding them our two routes for our local IPv4 and IPv6 subnets, and all that&#39;s left to do is order all our cross-connects to other ASes in the building willing to peer with us (mostly for fun) and load in all our servers to build our own personal corner of the Internet.<br>
The only major goof so far has been accidentally feeding the full IPv6 table to our first other peer that we turned on, but thankfully he has a much more powerful supervisor than the Sup720-BXL, so he just sent me an email to knock that off, a little fiddling with my BGP egress policies, and we were all set.<br>
In the end, setting up my own autonomous system wasn&#39;t exactly simple, it was definitely not justified, but some times in life you just need to take the more difficult path. And there&#39;s a certain amount of pride in being able to claim that I&#39;m part of the actual Internet. That&#39;s pretty neat. <br>
And of course, thanks to all of my friends who variously contributed parts, pieces, resources, and know-how to this on-going project. I had to pull in a lot of favors to pull this off, and I appreciate it.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/one_year_checkpoint_and_thread" rel="nofollow">One year checkpoint and Thread Sanitizer update</a></h3>

<blockquote>
<p>The past year has been started with bugfixes and the development of regression tests for ptrace(2) and related kernel features, as well as the continuation of bringing LLDB support and LLVM sanitizers (ASan + UBsan and partial TSan + Msan) to NetBSD.  My plan for the next year is to finish implementing TSan and MSan support, followed by a long run of bug fixes for LLDB, ptrace(2), and other related kernel subsystems</p>
</blockquote>

<ul>
<li>TSan</li>
</ul>

<blockquote>
<p>In the past month, I&#39;ve developed Thread Sanitizer far enough to have a subset of its tests pass on NetBSD, started with addressing breakage related to the memory layout of processes. The reason for this breakage was narrowed down to the current implementation of ASLR, which was too aggressive and which didn&#39;t allow enough space to be mapped for Shadow memory. The fix for this was to either force the disabling of ASLR per-process, or globally on the system. The same will certainly happen for MSan executables. After some other corrections, I got TSan to work for the first time ever on October 14th. This was a big achievement, so I&#39;ve made a snapshot available. Getting the snapshot of execution under GDB was pure hazard.</p>
</blockquote>

<pre><code>$ gdb ./a.out                                  
GNU gdb (GDB) 7.12
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type &quot;show copying&quot;
and &quot;show warranty&quot; for details.
This GDB was configured as &quot;x86_64--netbsd&quot;.
Type &quot;show configuration&quot; for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type &quot;help&quot;.
Type &quot;apropos word&quot; to search for commands related to &quot;word&quot;...
Reading symbols from ./a.out...done.
(gdb) r
Starting program: /public/llvm-build/a.out 
[New LWP 2]

WARNING: ThreadSanitizer: data race (pid=1621)
  Write of size 4 at 0x000001475d70 by thread T1:
    #0 Thread1 /public/llvm-build/tsan.c:4:10 (a.out+0x46bf71)

  Previous write of size 4 at 0x000001475d70 by main thread:
    #0 main /public/llvm-build/tsan.c:10:10 (a.out+0x46bfe6)

  Location is global &#39;Global&#39; of size 4 at 0x000001475d70 (a.out+0x000001475d70)

  Thread T1 (tid=2, running) created by main thread at:
    #0 pthread_create /public/llvm/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:930:3 (a.out+0x412120)
    #1 main /public/llvm-build/tsan.c:9:3 (a.out+0x46bfd1)

SUMMARY: ThreadSanitizer: data race /public/llvm-build/tsan.c:4:10 in Thread1

Thread 2 received signal SIGSEGV, Segmentation fault.
</code></pre>

<blockquote>
<p>I was able to get the above execution results around 10% of the time (being under a tracer had no positive effect on the frequency of successful executions).  I&#39;ve managed to hit the following final results for this month, with another set of bugfixes and improvements:</p>
</blockquote>

<pre><code>check-tsan:
Expected Passes    : 248
Expected Failures  : 1
Unsupported Tests  : 83
Unexpected Failures: 44
</code></pre>

<blockquote>
<p>At the end of the month, TSan can now reliably executabe the same (already-working) program every time. The majority of failures are in tests verifying sanitization of correct mutex locking usage. There are still problems with NetBSD-specific libc and libpthread bootstrap code that conflicts with TSan. Certain functions (pthread_create(3), pthread_key_create(3), _cxa_atexit()) cannot be started early by TSan initialization, and must be deferred late enough for the sanitizer to work correctly.</p>
</blockquote>

<ul>
<li>MSan</li>
</ul>

<blockquote>
<p>I&#39;ve prepared a scratch support for MSan on NetBSD to help in researching how far along it is. I&#39;ve also cloned and adapted the existing FreeBSD bits; however, the code still needs more work and isn&#39;t functional yet. The number of passed tests (5) is negligible and most likely does not work at all. The conclusion after this research is that TSan shall be finished first, as it touches similar code. In the future, there will be likely another round of iterating the system structs and types and adding the missing ones for NetBSD. So far, this part has been done before executing the real MSan code. I&#39;ve added one missing symbol that was missing and was detected when attempting to link a test program with MSan.</p>
</blockquote>

<ul>
<li>Sanitizers</li>
</ul>

<blockquote>
<p>The GCC team has merged the LLVM sanitizer code, which has resulted in almost-complete support for ASan and UBsan on NetBSD. It can be found in the latest GCC8 snapshot, located in pkgsrc-wip/gcc8snapshot. Though, do note that there is an issue with getting backtraces from libasan.so, which can be worked-around by backtracing ASan events in a debugger. UBsan also passes all GCC regression tests and appears to work fine. The code enabling sanitizers on the GCC/NetBSD frontend will be submitted upstream once the backtracing issue is fixed and I&#39;m satisfied that there are no other problems. I&#39;ve managed to upstream a large portion of generic+TSan+MSan code to compiler-rt and reduce local patches to only the ones that are in progress. This deals with any rebasing issues, and allows me to just focus on the delta that is being worked on. I&#39;ve tried out the LLDB builds which have TSan/NetBSD enabled, and they built and started fine. However, there were some false positives related to the mutex locking/unlocking code.</p>
</blockquote>

<ul>
<li>Plans for the next milestone</li>
</ul>

<blockquote>
<p>The general goals are to finish TSan and MSan and switch back to LLDB debugging. I plan to verify the impact of the TSan bootstrap initialization on the observed crashes and research the remaining failures.</p>
</blockquote>

<ul>
<li>This work was sponsored by The NetBSD Foundation.</li>
</ul>

<blockquote>
<p>The NetBSD Foundation is a non-profit organization and welcomes any donations to help us continue funding projects and services to the open-source community. Please consider visiting the following URL, and chip in what you can:</p>
</blockquote>

<hr>

<h3><a href="https://blog.ungleich.ch/en-us/cms/blog/2017/12/10/the-importance-of-devuan/" rel="nofollow">The scourge of systemd</a></h3>

<ul>
<li>While this article is actually couched in terms of promoting devuan, a de-systemd-ed version of debian, it would seem the same logic could be applied to all of the BSDs</li>
</ul>

<blockquote>
<p>Let&#39;s say every car manufacturer recently discovered a new technology named &quot;doord&quot;, which lets you open up car doors much faster than before. It only takes 0.05 seconds, instead of 1.2 seconds on average. So every time you open a door, you are much, much faster!<br>
Many of the manufacturers decide to implement doord, because the company providing doord makes it clear that it is beneficial for everyone. And additional to opening doors faster, it also standardises things. How to turn on your car? It is the same now everywhere, it is not necessarily to look for the keyhole anymore.<br>
Unfortunately though, sometimes doord does not stop the engine. Or if it is cold outside, it stops the ignition process, because it takes too long. Doord also changes the way your navigation system works, because that is totally related to opening doors, but leads to some users being unable to navigate, which is accepted as collateral damage. In the end, you at least have faster door opening and a standard way to turn on the car. Oh, and if you are in a traffic jam and have to restart the engine often, it will stop restarting it after several times, because that&#39;s not what you are supposed to do. You can open the engine hood and tune that setting though, but it will be reset once you buy a new car.<br>
Some of you might now ask themselves &quot;Is systemd THAT bad?&quot;. And my answer to it is: No. It is even worse. Systemd developers split the community over a tiny detail that decreases stability significantly and increases complexity for not much real value. And this is not theoretical: We tried to build Data Center Light on Debian and Ubuntu, but servers that don&#39;t boot, that don&#39;t reboot or systemd-resolved that constantly interferes with our core network configuration made it too expensive to run Debian or Ubuntu.<br>
Yes, you read right: too expensive. While I am writing here in flowery words, the reason to use Devuan is hard calculated costs. We are a small team at ungleich and we simply don&#39;t have the time to fix problems caused by systemd on a daily basis. This is even without calculating the security risks that come with systemd.</p>

<hr>
</blockquote>

<h3><a href="https://deftly.net/posts/2017-10-12-using-cabal-on-openbsd.html" rel="nofollow">Using cabal on OpenBSD</a></h3>

<blockquote>
<p>Since <a href="https://undeadly.org/cgi?action=article&sid=20160527203200" rel="nofollow">W<sup>X</sup> became mandatory in OpenBSD</a>, W<sup>Xd</sup> binaries are only allowed to be executed from designated locations (mount points). If you used the auto partition layout during install, your /usr/local/ will be mounted with wxallowed. For example, here is the entry for my current machine:</p>
</blockquote>

<pre><code>/dev/sd2g on /usr/local type ffs (local, nodev, wxallowed, softdep)
</code></pre>

<blockquote>
<p>This is a great feature, but if you build applications outside of the wxallowed partition, you are going to run into some issues, especially in the case of cabal (python as well).<br>
Here is an example of what you would see when attempting to do cabal install pandoc:</p>
</blockquote>

<pre><code>qbit@slip[1]:~? cabal update
Config file path source is default config file.
Config file /home/qbit/.cabal/config not found.
Writing default configuration to /home/qbit/.cabal/config
Downloading the latest package list from hackage.haskell.org
qbit@slip[0]:~? cabal install pandoc
Resolving dependencies...
.....
cabal: user error (Error: some packages failed to install:
JuicyPixels-3.2.8.3 failed during the configure step. The exception was:
/home/qbit/.cabal/setup-exe-cache/setup-Simple-Cabal-1.22.5.0-x86_64-openbsd-ghc-7.10.3: runProcess: runInteractiveProcess: exec: permission denied (Permission denied)
</code></pre>

<blockquote>
<p>The error isnt actually what it says. The untrained eye would assume permissions issue. A quick check of dmesg reveals what is really happening:</p>
</blockquote>

<pre><code>/home/qbit/.cabal/setup-exe-cache/setup-Simple-Cabal-1.22.5.0-x86_64-openbsd-ghc-7.10.3(22924): W^X binary outside wxallowed mountpoint
</code></pre>

<blockquote>
<p>OpenBSD is killing the above binary because it is violating W<sup>X</sup> and hasnt been safely kept in its /usr/local corral!<br>
We could solve this problem quickly by marking our /home as wxallowed, however, this would be heavy handed and reckless (we dont want to allow other potentially unsafe binaries to execute.. just the cabal stuff).<br>
Instead, we will build all our cabal stuff in /usr/local by using a symlink!</p>
</blockquote>

<pre><code>doas mkdir -p /usr/local/{cabal,cabal/build} # make our cabal and build dirs
doas chown -R user:wheel /usr/local/cabal    # set perms
rm -rf ~/.cabal                              # kill the old non-working cabal
ln -s /usr/local/cabal ~/.cabal              # link it!
</code></pre>

<blockquote>
<p>We are almost there! Some cabal packages build outside of ~/.cabal:</p>
</blockquote>

<pre><code>cabal install hakyll
.....
Building foundation-0.0.14...                                                   Preprocessing library foundation-0.0.14...
hsc2hs: dist/build/Foundation/System/Bindings/Posix_hsc_make: runProcess: runInteractiveProcess: exec: permission denied (Permission denied)
Downloading time-locale-compat-0.1.1.3...
.....
</code></pre>

<blockquote>
<p>Fortunately, all of the packages I have come across that do this all respect the TMPDIR environment variable!</p>
</blockquote>

<pre><code>alias cabal=&#39;env TMPDIR=/usr/local/cabal/build/ cabal&#39;
</code></pre>

<blockquote>
<p>With this alias, you should be able to cabal without issue (so far pandoc, shellcheck and hakyll have all built fine)!</p>
</blockquote>

<ul>
<li>TL;DR</li>
</ul>

<pre><code>&amp;#35; This assumes /usr/local/ is mounted as wxallowed.
&amp;#35;
doas mkdir -p /usr/local/{cabal,cabal/build}
doas chown -R user:wheel /usr/local/cabal
rm -rf ~/.cabal
ln -s /usr/local/cabal ~/.cabal
alias cabal=&#39;env TMPDIR=/usr/local/cabal/build/ cabal&#39;
cabal install pandoc
</code></pre>

<hr>

<h3><a href="https://adrianchadd.blogspot.co.uk/2017/10/freebsd-and-aprs-or-hm-what-happens.html" rel="nofollow">FreeBSD and APRS, or &quot;hm what happens when none of this is well documented..&quot;</a></h3>

<blockquote>
<p>Here&#39;s another point along my quest for amateur radio on FreeBSD - bring up basic APRS support. Yes, someone else has done the work, but in the normal open source way it was .. inconsistently documented.</p>
</blockquote>

<ul>
<li>First is figuring out the hardware platform. I chose the following:

<ul>
<li>A Baofeng UV5R2, since they&#39;re cheap, plentiful, and do both VHF and UHF;</li>
<li>A cable to do sound level conversion and isolation (and yes, I really should post a circuit diagram and picture..);</li>
<li>A USB sound device, primarily so I can whack it into FreeBSD/Linux devices to get a separate sound card for doing radio work;</li>
<li>FreeBSD laptop (it&#39;ll become a raspberry pi + GPS + sensor + LCD thingy later, but this&#39;ll do to start with.)</li>
<li>The Baofeng is easy - set it to the right frequency (VHF APRS sits on 144.390MHz), turn on VOX so I don&#39;t have to make up a PTT cable, done/done.</li>
</ul></li>
</ul>

<blockquote>
<p>The PTT bit isn&#39;t that hard - one of the microphone jack pins is actually PTT (if you ground it, it engages PTT) so when you make the cable just ensure you expose a ground pin and PTT pin so you can upgrade it later.</p>

<p>The cable itself isn&#39;t that hard either - I had a baofeng handmic lying around (they&#39;re like $5) so I pulled it apart for the cable. I&#39;ll try to remember to take pictures of that.</p>
</blockquote>

<ul>
<li>Here&#39;s a picture I found on the internet that shows the pinout: <a href="https://3.bp.blogspot.com/-58HUyt-9SUw/Wdz6uMauWlI/AAAAAAAAVz8/e7OrnRzN3908UYGUIRI1EBYJ5UcnO0qRgCLcBGAs/s1600/aprs-cable.png" rel="nofollow">image</a></li>
</ul>

<blockquote>
<p>Now, I went a bit further. I bought a bunch of 600 ohm isolation transformers for audio work, so I wired it up as follows:<br>
From the audio output of the USB sound card, I wired up a little attenuator - input is 2k to ground, then 10k to the input side of the transformer; then the output side of the transformer has a 0.01uF greencap capacitor to the microphone input of the baofeng;<br>
From the baofeng I just wired it up to the transformer, then the output side of that went into a 0.01uF greencap capacitor in series to the microphone input of the sound card.<br>
In both instances those capacitors are there as DC blockers.</p>

<p>Ok, so that bit is easy. Then on to the software side. The normal way people do this stuff is &quot;direwolf&quot; on Linux. So, &quot;pkg install direwolf&quot; installed it. That was easy.<br>
Configuring it up was a bit less easy. <a href="https://andrewmemory.wordpress.com/tag/direwolf/" rel="nofollow">I found this guide to be helpful</a><br>
FreeBSD has the example direwolf config in /usr/local/share/doc/direwolf/examples/direwolf.conf . Now, direwolf will run as a normal user (there&#39;s no rc.d script for it yet!) and by default runs out of the current directory. So:</p>
</blockquote>

<pre><code>$ cd ~
$ cp /usr/local/share/doc/direwolf/examples/direwolf.conf . 
$ (edit it)
$ direwolf
</code></pre>

<blockquote>
<p>Editing it isn&#39;t that hard - you need to change your callsign and the audio device.</p>

<p>OK, here is the main undocumented bit for FreeBSD - the sound device can just be /dev/dsp . It isn&#39;t an ALSA name! Don&#39;t waste time trying to use ALSA names. Instead, just find the device you want and reference it. For me the USB sound card shows up as /dev/dsp3 (which is very non specific as USB sound devices come and go, but that&#39;s a later problem!) but it&#39;s enough to bring it up.</p>

<p>So yes, following the above guide, using the right sound device name resulted in a working APRS modem.</p>

<p>Next up - something to talk to it. This is called &#39;xastir&#39;. It&#39;s .. well, when you run it, you&#39;ll find exactly how old an X application it is. It&#39;s very nostalgically old. But, it is enough to get APRS positioning up and test both the TCP/IP side of APRS and the actual radio radio side.</p>
</blockquote>

<ul>
<li><a href="https://andrewmemory.wordpress.com/2015/03/22/setting-up-direwolfxastir-on-a-raspberry-pi/" rel="nofollow">Here&#39;s the guide I followed:</a></li>
</ul>

<blockquote>
<p>So, that was it! So far so good. It actually works well enough to decode and watch APRS traffic around me. I managed to get out position information to the APRS network over both TCP/IP and relayed via VHF radio.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=fE2KDzZaxvE" rel="nofollow">Zebras All the Way Down - Bryan Cantrill</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/your-impact-on-freebsd/" rel="nofollow">Your impact on FreeBSD</a></li>
<li><a href="https://bsdmag.org/secret-good-gui/" rel="nofollow">The Secret to a good Gui</a></li>
<li><a href="https://github.com/containerd/containerd/releases/tag/v1.0.0" rel="nofollow">containerd hits v1.0.0</a></li>
<li><a href="https://www.youtube.com/watch?v=lzdg_2bUh9Y&t=" rel="nofollow">FreeBSD 11.1 Custom Kernels Made Easy - Configuring And Installing A Custom Kernel</a></li>
<li><a href="https://pbs.twimg.com/media/DQgCNq6UEAEqa1W.jpg:large" rel="nofollow">Debugging</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Bostjan - <a href="http://dpaste.com/22ZVJ12#wrap" rel="nofollow">Backup Tapes</a></li>
<li>Philipp - <a href="http://dpaste.com/13E8RGR#wrap" rel="nofollow">A long time ago, there was a script</a></li>
<li>Adam - <a href="http://dpaste.com/3BQXXPM#wrap" rel="nofollow">ZFS Pool Monitoring</a></li>
<li>Damian - <a href="http://dpaste.com/0ZZVM4R#wrap" rel="nofollow">KnoxBug</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We try to answer what happens to an open source project after a developers death, we tell you about the last bootstrapped tech company in Silicon Valley, we have an update to the NetBSD Thread sanitizer, and show how to use use cabal on OpenBSD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.wired.com/story/giving-open-source-projects-life-after-a-developers-death/" rel="nofollow">Life after death, for code</a></h3>

<blockquote>
<p>YOU&#39;VE PROBABLY NEVER heard of the late Jim Weirich or his software. But you&#39;ve almost certainly used apps built on his work.<br>
Weirich helped create several key tools for Ruby, the popular programming language used to write the code for sites like Hulu, Kickstarter, Twitter, and countless others. His code was open source, meaning that anyone could use it and modify it. &quot;He was a seminal member of the western world&#39;s Ruby community,&quot; says Justin Searls, a Ruby developer and co-founder of the software company Test Double.<br>
When Weirich died in 2014, Searls noticed that no one was maintaining one of Weirich&#39;s software-testing tools. That meant there would be no one to approve changes if other developers submitted bug fixes, security patches, or other improvements. Any tests that relied on the tool would eventually fail, as the code became outdated and incompatible with newer tech.<br>
The incident highlights a growing concern in the open-source software community. What happens to code after programmers pass away? Much has been written about what happens to social-media accounts after users die. But its been less of an issue among programmers. In part, thats because most companies and governments relied on commercial software maintained by teams of people. But today, more programs rely on obscure but crucial software like Weirich&#39;s.<br>
Some open-source projects are well known, such as the Linux operating system or Google&#39;s artificial-intelligence framework TensorFlow. But each of these projects depend on smaller libraries of open-source code. And those libraries depend on other libraries. The result is a complex, but largely hidden, web of software dependencies.<br>
That can create big problems, as in 2014 when a security vulnerability known as &quot;Heartbleed&quot; was found in OpenSSL, an open-source program used by nearly every website that processes credit- or debit-card payments. The software comes bundled with most versions of Linux, but was maintained by a small team of volunteers who didn&#39;t have the time or resources to do extensive security audits. Shortly after the Heartbleed fiasco, a security issue was discovered in another common open-source application called Bash that left countless web servers and other devices vulnerable to attack.<br>
There are surely more undiscovered vulnerabilities. Libraries.io, a group that analyzes connections between software projects, has identified more than 2,400 open-source libraries that are used in at least 1,000 other programs but have received little attention from the open-source community.<br>
Security problems are only one part of the issue. If software libraries aren&#39;t kept up to date, they may stop working with newer software. That means an application that depends on an outdated library may not work after a user updates other software. When a developer dies or abandons a project, everyone who depends on that software can be affected. Last year when programmer Azer Koçulu deleted a tiny library called Leftpad from the internet, it created ripple effects that reportedly caused headaches at Facebook, Netflix, and elsewhere.</p>
</blockquote>

<ul>
<li>The Bus Factor</li>
</ul>

<blockquote>
<p>The fewer people with ownership of a piece of software, the greater the risk that it could be orphaned. Developers even have a morbid name for this: the bus factor, meaning the number of people who would have to be hit by a bus before there&#39;s no one left to maintain the project. Libraries.io has identified about 3,000 open-source libraries that are used in many other programs but have only a handful of contributors.<br>
Orphaned projects are a risk of using open-source software, though commercial software makers can leave users in a similar bind when they stop supporting or updating older programs. In some cases, motivated programmers adopt orphaned open-source code.<br>
That&#39;s what Searls did with one of Weirichs projects. Weirich&#39;s most-popular projects had co-managers by the time of his death. But Searls noticed one, the testing tool Rspec-Given, hadn&#39;t been handed off, and wanted to take responsibility for updating it. But he ran into a few snags along the way.<br>
Rspec-Given&#39;s code was hosted on the popular code-hosting and collaboration site GitHub, home to 67 million codebases. Weirich&#39;s Rspec-Given page on GitHub was the main place for people to report bugs or to volunteer to help improve the code. But GitHub wouldnt give Searls control of the page, because Weirich had not named him before he died. So Searls had to create a new copy of the code, and host it elsewhere. He also had to convince the operators of Ruby Gems, a package-management system for distributing code, to use his version of Rspec-Given, instead of Weirich&#39;s, so that all users would have access to Searls changes. GitHub declined to discuss its policies around transferring control of projects.</p>

<p>That solved potential problems related to Rspec-Given, but it opened Searls&#39; eyes to the many things that could go wrong. Its easy to see open source as a purely technical phenomenon, Searls says. But once something takes off and is depended on by hundreds of other people, it becomes a social phenomenon as well.<br>
The maintainers of most package-management systems have at least an ad-hoc process for transferring control over a library, but that process usually depends on someone noticing that a project has been orphaned and then volunteering to adopt it. &quot;We dont have an official policy mostly because it hasnt come up all that often,&quot; says Evan Phoenix of the Ruby Gems project. &quot;We do have an adviser council that is used to decide these types of things case by case.&quot;<br>
Some package managers now monitor their libraries and flag widely used projects that haven&#39;t been updated in a long time. Neil Bowers, who helps maintain a package manager for the programming language Perl, says he sometimes seeks out volunteers to take over orphan projects. Bowers says his group vets claims that a project has been abandoned, and the people proposing to take it over.</p>
</blockquote>

<ul>
<li>A &#39;Dead-Man&#39;s Switch&#39;</li>
</ul>

<blockquote>
<p>Taking over Rspec-Given inspired Searls, who was only 30 at the time, to make a will and a succession plan for his own open-source projects. There are other things developers can do to help future-proof their work. They can, for example, transfer the copyrights to a foundation, such as the Apache Foundation. But many open-source projects essentially start as hobbies, so programmers may not think to transfer ownership until it is too late.<br>
Searls suggests that GitHub and package managers such as Gems could add something like a &quot;dead man&#39;s switch&quot; to their platform, which would allow programmers to automatically transfer ownership of a project or an account to someone else if the creator doesnt log in or make changes after a set period of time.<br>
But a transition plan means more than just giving people access to the code. Michael Droettboom, who took over a popular mathematics library called Matplotlib after its creator John Hunter died in 2012, points out that successors also need to understand the code. &quot;Sometimes there are parts of the code that only one person understands,&quot; he says. &quot;The knowledge exists only in one person&#39;s head.&quot;<br>
That means getting people involved in a project earlier, ideally as soon as it is used by people other than the original developer. That has another advantage, Searls points out, in distributing the work of maintaining a project to help prevent developer burnout.</p>
</blockquote>

<hr>

<h3><a href="https://www.forbes.com/sites/forbestechcouncil/2017/12/12/the-last-bootstrapped-tech-company-in-silicon-valley/2/#4d53d50f1e4d" rel="nofollow">The Last Bootstrapped Tech Company In Silicon Valley</a></h3>

<blockquote>
<p>My business partner, Matt Olander, and I were intimately familiar with the ups and downs of the Silicon Valley tech industry when we acquired the remnants of our then-employer BSDis enterprise computer business in 2002 and assumed the roles of CEO and CTO. Fast-forward to today, and we still work in the same buildings where BSDi started in 1996, though youd hardly recognize them today.<br>
As the business grew from a startup to a global brand, our success came from always ensuring we ran a profitable business. While that may sound obvious, keep in mind that we are in the heart of Silicon Valley where venture capitalists hunt for the unicorn company that will skyrocket to a billion-dollar valuation. Unicorns like Facebook and Twitter unquestionably exist, but they are the exception.</p>
</blockquote>

<ul>
<li>Live By The VC, Die By The VC</li>
</ul>

<blockquote>
<p>After careful consideration, Matt and I decided to bootstrap our company rather than seek funding. The first dot-com bubble had recently burst, and we were seeing close friends lose their jobs right and left at VC-funded companies based on dubious business plans. While we did not have much cash on hand, we did have a customer base and treasured those customers as our greatest asset. We concluded that meeting their needs was the surest path to meeting ours, and the rest would simply be details to address individually. This strategy ended up working so well that we have many of the same customers to this day.<br>
After deciding to bootstrap, we made a decision on a matter that has left egg on the face of many of our competitors: We seated sales next to support under one roof at our manufacturing facility in Silicon Valley. Dell&#39;s decision to outsource some of its support overseas in the early 2000s was the greatest gift it could have given us. Some of our sales and support staff have worked with the same clients for over a decade, and we concluded that no amount of funding could buy that mutual loyalty. While accepting venture capital or an acquisition may make you rich, it does not guarantee that your customers, employees or even business will be taken care of. Our motto is, Treat your customers like friends and employees like family, and we have an incredibly low employee turnover to show for it.<br>
Thanks to these principles, iXsystems has remained employee-owned, debt-free and profitable from the day we took it over -- all without VC funding, which is why we call ourselves the &quot;last bootstrapped tech company in Silicon Valley.&quot; As a result, we now provide enterprise servers to thousands of customers, including top Fortune 500 companies, research and educational institutions, all branches of the military, and numerous government entities.<br>
Over time, however, we realized that we were selling more and more third-party data storage systems with every order. We saw this as a new opportunity. We had partnered with several storage vendors to meet our customers needs, but every time we did, we opened a can of worms with regard to supporting our customers to our standards. Given a choice of risking being dragged down by our partners or outmaneuvered by competitors with their own storage portfolios, we made a conscious decision to develop a line of storage products that would not only complement our enterprise servers but tightly integrate with them.<br>
To accelerate this effort, we adopted the FreeNAS open-source software-defined storage project in 2009 and havent looked back. The move enabled us to focus on storage, fully leveraging our experience with enterprise hardware and our open source heritage in equal measures. We saw many storage startups appear every quarter, struggling to establish their niche in a sea of competitors. We wondered how theyd instantly master hardware to avoid the partnering mistakes that we made years ago, given that storage hardware and software are truly inseparable at the enterprise level. We entered the storage market with the required hardware expertise, capacity and, most importantly, revenue, allowing us to develop our storage line at our own pace.</p>
</blockquote>

<ul>
<li>Grow Up, But On Your Own Terms</li>
</ul>

<blockquote>
<p>By not having the external pressure from VCs or shareholders that your competitors have, you&#39;re free to set your own priorities and charge fair prices for your products. Our customers consistently tell us how refreshing our sales and marketing approaches are. We consider honesty, transparency and responsible marketing the only viable strategy when youre bootstrapped. Your reputation with your customers and vendors should mean everything to you, and we can honestly say that the loyalty we have developed is priceless.<br>
So how can your startup venture down a similar path? Here&#39;s our advice for playing the long game:</p>
</blockquote>

<ul>
<li>Relate your experiences to each fad: Our industry is a firehose of fads and buzzwords, and it can be difficult to distinguish the genuine trends from the flops. Analyze every new buzzword in terms of your own products, services and experiences, and monitor customer trends even more carefully. Some buzzwords will even formalize things you have been doing for years.</li>
<li>Value personal relationships: Companies come and go, but you will maintain many clients and colleagues for decades, regardless of the hat they currently wear. Encourage relationship building at every level of your company because you may encounter someone again.</li>
<li>Trust your instincts and your colleagues: No contractual terms or credit rating system can beat the instincts you will develop over time for judging the ability of individuals and companies to deliver. You know your business, employees and customers best.</li>
</ul>

<blockquote>
<p>Looking back, I don&#39;t think Id change a thing. We need to be in Silicon Valley for the prime customers, vendors and talent, and its a point of pride that our customers recognize how different we are from the norm. Free of a venture capital runway and driven by these principles, we look forward to the next 20 years in this highly-competitive industry.</p>
</blockquote>

<hr>

<h3><a href="http://blog.thelifeofkenneth.com/2017/11/creating-autonomous-system-for-fun-and.html" rel="nofollow">Creating an AS for fun and profit</a></h3>

<blockquote>
<p>At its core, the Internet is an interconnected fabric of separate networks. Each network which makes up the Internet is operated independently and only interconnects with other networks in clearly defined places.<br>
For smaller networks like your home, the interaction between your network and the rest of the Internet is usually pretty simple: you buy an Internet service plan from an ISP (Internet Service Provider), they give you some kind of hand-off through something like a DSL or cable modem, and give you access to &quot;the entire Internet&quot;. Your router (which is likely also a WiFi access point and Ethernet switch) then only needs to know about two things; your local computers and devices are on one side, and the ENTIRE Internet is on the other side of that network link given to you by your ISP.<br>
For most people, that&#39;s the extent of what&#39;s needed to be understood about how the Internet works. Pick the best ISP, buy a connection from them, and attach computers needing access to the Internet. And that&#39;s fine, as long as you&#39;re happy with only having one Internet connection from one vendor, who will lend you some arbitrary IP address(es) for the extend of your service agreement, but that starts not being good enough when you don&#39;t want to be beholden to a single ISP or a single connection for your connectivity to the Internet.<br>
That also isn&#39;t good enough if you <em>are</em> an Internet Service Provider so you are literally a part of the Internet. You can&#39;t assume that the entire Internet is that way when half of the Internet is actually in the other direction. This is when you really have to start thinking about the Internet and treating the Internet as a very large mesh of independent connected organizations instead of an abstract cloud icon on the edge of your local network map.  Which is pretty much never for most of us.<br>
Almost no one needs to consider the Internet at this level. The long flight of steps from DSL for your apartment up to needing to be an integral part of the Internet means that pretty much regardless of what level of Internet service you need for your projects, you can probably pay someone else to provide it and don&#39;t need to sit down and learn how BGP works and what an Autonomous System is. But let&#39;s ignore that for one second, and talk about how to become your own ISP.</p>
</blockquote>

<ul>
<li>To become your own Internet Service Provider with customers who pay you to access the Internet, or be your own web hosting provider with customers who pay you to be accessible from the Internet, or your own transit provider who has customers who pay you to move their customer&#39;s packets to other people&#39;s customers, you need a few things:

<ul>
<li>Your own public IP address space allocated to you by an Internet numbering organization</li>
<li>Your own Autonomous System Number (ASN) to identify your network as separate from everyone else&#39;s networks</li>
<li>At least one router connected to a different autonomous system speaking the Border Gateway Protocol to tell the rest of the Internet that your address space is accessible from your autonomous system.</li>
</ul></li>
</ul>

<blockquote>
<p>So... I recently set up my own autonomous system... and I don&#39;t really have a fantastic justification for it...</p>
</blockquote>

<ul>
<li>My motivation was twofold:

<ul>
<li>One of my friends and I sat down and figured it out that splitting the cost of a rack in Hurricane Electric&#39;s FMT2 data center marginally lowered our monthly hosting expenses vs all the paid services we&#39;re using scattered across the Internet which can all be condensed into this one rack.</li>
<li>And this first reason on its own is a perfectly valid justification for paying for co-location space at a data center like Hurricane Electric&#39;s, but isn&#39;t actually a valid reason for running it as an autonomous system, because Hurricane Electric will gladly let you use their address space for your servers hosted in their building. That&#39;s usually part of the deal when you pay for space in a data center: power, cooling, Internet connectivity, and your own IP addresses.</li>
<li>Another one of my friends challenged me to do it as an Autonomous System.</li>
<li>So admittedly, my justification for going through the additional trouble to set up this single rack of servers as an AS is a little more tenuous. I will readily admit that, more than anything else, this was a &quot;hold my beer&quot; sort of engineering moment, and not something that is at all needed to achieve what we actually needed (a rack to park all our servers in).</li>
</ul></li>
</ul>

<blockquote>
<p>But what the hell; I&#39;ve figured out how to do it, so I figured it would make an entertaining blog post. </p>
</blockquote>

<ul>
<li>So here&#39;s how I set up a multi-homed autonomous system on a shoe-string budget:

<ul>
<li>Step 1. Found a Company</li>
<li>Step 2. Get Yourself Public Address Space</li>
<li>Step 3. Find Yourself Multiple Other Autonomous Systems to Peer With</li>
<li>Step 4. Apply for an Autonomous System Number</li>
<li>Step 5. Source a Router Capable of Handling the Entire Internet Routing Table</li>
<li>Step 6. Turn it All On and Pray</li>
<li>And we&#39;re off to the races.</li>
</ul></li>
</ul>

<blockquote>
<p>At this point, Hurricane Electric is feeding us all ~700k routes for the Internet, we&#39;re feeding them our two routes for our local IPv4 and IPv6 subnets, and all that&#39;s left to do is order all our cross-connects to other ASes in the building willing to peer with us (mostly for fun) and load in all our servers to build our own personal corner of the Internet.<br>
The only major goof so far has been accidentally feeding the full IPv6 table to our first other peer that we turned on, but thankfully he has a much more powerful supervisor than the Sup720-BXL, so he just sent me an email to knock that off, a little fiddling with my BGP egress policies, and we were all set.<br>
In the end, setting up my own autonomous system wasn&#39;t exactly simple, it was definitely not justified, but some times in life you just need to take the more difficult path. And there&#39;s a certain amount of pride in being able to claim that I&#39;m part of the actual Internet. That&#39;s pretty neat. <br>
And of course, thanks to all of my friends who variously contributed parts, pieces, resources, and know-how to this on-going project. I had to pull in a lot of favors to pull this off, and I appreciate it.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/one_year_checkpoint_and_thread" rel="nofollow">One year checkpoint and Thread Sanitizer update</a></h3>

<blockquote>
<p>The past year has been started with bugfixes and the development of regression tests for ptrace(2) and related kernel features, as well as the continuation of bringing LLDB support and LLVM sanitizers (ASan + UBsan and partial TSan + Msan) to NetBSD.  My plan for the next year is to finish implementing TSan and MSan support, followed by a long run of bug fixes for LLDB, ptrace(2), and other related kernel subsystems</p>
</blockquote>

<ul>
<li>TSan</li>
</ul>

<blockquote>
<p>In the past month, I&#39;ve developed Thread Sanitizer far enough to have a subset of its tests pass on NetBSD, started with addressing breakage related to the memory layout of processes. The reason for this breakage was narrowed down to the current implementation of ASLR, which was too aggressive and which didn&#39;t allow enough space to be mapped for Shadow memory. The fix for this was to either force the disabling of ASLR per-process, or globally on the system. The same will certainly happen for MSan executables. After some other corrections, I got TSan to work for the first time ever on October 14th. This was a big achievement, so I&#39;ve made a snapshot available. Getting the snapshot of execution under GDB was pure hazard.</p>
</blockquote>

<pre><code>$ gdb ./a.out                                  
GNU gdb (GDB) 7.12
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type &quot;show copying&quot;
and &quot;show warranty&quot; for details.
This GDB was configured as &quot;x86_64--netbsd&quot;.
Type &quot;show configuration&quot; for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type &quot;help&quot;.
Type &quot;apropos word&quot; to search for commands related to &quot;word&quot;...
Reading symbols from ./a.out...done.
(gdb) r
Starting program: /public/llvm-build/a.out 
[New LWP 2]

WARNING: ThreadSanitizer: data race (pid=1621)
  Write of size 4 at 0x000001475d70 by thread T1:
    #0 Thread1 /public/llvm-build/tsan.c:4:10 (a.out+0x46bf71)

  Previous write of size 4 at 0x000001475d70 by main thread:
    #0 main /public/llvm-build/tsan.c:10:10 (a.out+0x46bfe6)

  Location is global &#39;Global&#39; of size 4 at 0x000001475d70 (a.out+0x000001475d70)

  Thread T1 (tid=2, running) created by main thread at:
    #0 pthread_create /public/llvm/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:930:3 (a.out+0x412120)
    #1 main /public/llvm-build/tsan.c:9:3 (a.out+0x46bfd1)

SUMMARY: ThreadSanitizer: data race /public/llvm-build/tsan.c:4:10 in Thread1

Thread 2 received signal SIGSEGV, Segmentation fault.
</code></pre>

<blockquote>
<p>I was able to get the above execution results around 10% of the time (being under a tracer had no positive effect on the frequency of successful executions).  I&#39;ve managed to hit the following final results for this month, with another set of bugfixes and improvements:</p>
</blockquote>

<pre><code>check-tsan:
Expected Passes    : 248
Expected Failures  : 1
Unsupported Tests  : 83
Unexpected Failures: 44
</code></pre>

<blockquote>
<p>At the end of the month, TSan can now reliably executabe the same (already-working) program every time. The majority of failures are in tests verifying sanitization of correct mutex locking usage. There are still problems with NetBSD-specific libc and libpthread bootstrap code that conflicts with TSan. Certain functions (pthread_create(3), pthread_key_create(3), _cxa_atexit()) cannot be started early by TSan initialization, and must be deferred late enough for the sanitizer to work correctly.</p>
</blockquote>

<ul>
<li>MSan</li>
</ul>

<blockquote>
<p>I&#39;ve prepared a scratch support for MSan on NetBSD to help in researching how far along it is. I&#39;ve also cloned and adapted the existing FreeBSD bits; however, the code still needs more work and isn&#39;t functional yet. The number of passed tests (5) is negligible and most likely does not work at all. The conclusion after this research is that TSan shall be finished first, as it touches similar code. In the future, there will be likely another round of iterating the system structs and types and adding the missing ones for NetBSD. So far, this part has been done before executing the real MSan code. I&#39;ve added one missing symbol that was missing and was detected when attempting to link a test program with MSan.</p>
</blockquote>

<ul>
<li>Sanitizers</li>
</ul>

<blockquote>
<p>The GCC team has merged the LLVM sanitizer code, which has resulted in almost-complete support for ASan and UBsan on NetBSD. It can be found in the latest GCC8 snapshot, located in pkgsrc-wip/gcc8snapshot. Though, do note that there is an issue with getting backtraces from libasan.so, which can be worked-around by backtracing ASan events in a debugger. UBsan also passes all GCC regression tests and appears to work fine. The code enabling sanitizers on the GCC/NetBSD frontend will be submitted upstream once the backtracing issue is fixed and I&#39;m satisfied that there are no other problems. I&#39;ve managed to upstream a large portion of generic+TSan+MSan code to compiler-rt and reduce local patches to only the ones that are in progress. This deals with any rebasing issues, and allows me to just focus on the delta that is being worked on. I&#39;ve tried out the LLDB builds which have TSan/NetBSD enabled, and they built and started fine. However, there were some false positives related to the mutex locking/unlocking code.</p>
</blockquote>

<ul>
<li>Plans for the next milestone</li>
</ul>

<blockquote>
<p>The general goals are to finish TSan and MSan and switch back to LLDB debugging. I plan to verify the impact of the TSan bootstrap initialization on the observed crashes and research the remaining failures.</p>
</blockquote>

<ul>
<li>This work was sponsored by The NetBSD Foundation.</li>
</ul>

<blockquote>
<p>The NetBSD Foundation is a non-profit organization and welcomes any donations to help us continue funding projects and services to the open-source community. Please consider visiting the following URL, and chip in what you can:</p>
</blockquote>

<hr>

<h3><a href="https://blog.ungleich.ch/en-us/cms/blog/2017/12/10/the-importance-of-devuan/" rel="nofollow">The scourge of systemd</a></h3>

<ul>
<li>While this article is actually couched in terms of promoting devuan, a de-systemd-ed version of debian, it would seem the same logic could be applied to all of the BSDs</li>
</ul>

<blockquote>
<p>Let&#39;s say every car manufacturer recently discovered a new technology named &quot;doord&quot;, which lets you open up car doors much faster than before. It only takes 0.05 seconds, instead of 1.2 seconds on average. So every time you open a door, you are much, much faster!<br>
Many of the manufacturers decide to implement doord, because the company providing doord makes it clear that it is beneficial for everyone. And additional to opening doors faster, it also standardises things. How to turn on your car? It is the same now everywhere, it is not necessarily to look for the keyhole anymore.<br>
Unfortunately though, sometimes doord does not stop the engine. Or if it is cold outside, it stops the ignition process, because it takes too long. Doord also changes the way your navigation system works, because that is totally related to opening doors, but leads to some users being unable to navigate, which is accepted as collateral damage. In the end, you at least have faster door opening and a standard way to turn on the car. Oh, and if you are in a traffic jam and have to restart the engine often, it will stop restarting it after several times, because that&#39;s not what you are supposed to do. You can open the engine hood and tune that setting though, but it will be reset once you buy a new car.<br>
Some of you might now ask themselves &quot;Is systemd THAT bad?&quot;. And my answer to it is: No. It is even worse. Systemd developers split the community over a tiny detail that decreases stability significantly and increases complexity for not much real value. And this is not theoretical: We tried to build Data Center Light on Debian and Ubuntu, but servers that don&#39;t boot, that don&#39;t reboot or systemd-resolved that constantly interferes with our core network configuration made it too expensive to run Debian or Ubuntu.<br>
Yes, you read right: too expensive. While I am writing here in flowery words, the reason to use Devuan is hard calculated costs. We are a small team at ungleich and we simply don&#39;t have the time to fix problems caused by systemd on a daily basis. This is even without calculating the security risks that come with systemd.</p>

<hr>
</blockquote>

<h3><a href="https://deftly.net/posts/2017-10-12-using-cabal-on-openbsd.html" rel="nofollow">Using cabal on OpenBSD</a></h3>

<blockquote>
<p>Since <a href="https://undeadly.org/cgi?action=article&sid=20160527203200" rel="nofollow">W<sup>X</sup> became mandatory in OpenBSD</a>, W<sup>Xd</sup> binaries are only allowed to be executed from designated locations (mount points). If you used the auto partition layout during install, your /usr/local/ will be mounted with wxallowed. For example, here is the entry for my current machine:</p>
</blockquote>

<pre><code>/dev/sd2g on /usr/local type ffs (local, nodev, wxallowed, softdep)
</code></pre>

<blockquote>
<p>This is a great feature, but if you build applications outside of the wxallowed partition, you are going to run into some issues, especially in the case of cabal (python as well).<br>
Here is an example of what you would see when attempting to do cabal install pandoc:</p>
</blockquote>

<pre><code>qbit@slip[1]:~? cabal update
Config file path source is default config file.
Config file /home/qbit/.cabal/config not found.
Writing default configuration to /home/qbit/.cabal/config
Downloading the latest package list from hackage.haskell.org
qbit@slip[0]:~? cabal install pandoc
Resolving dependencies...
.....
cabal: user error (Error: some packages failed to install:
JuicyPixels-3.2.8.3 failed during the configure step. The exception was:
/home/qbit/.cabal/setup-exe-cache/setup-Simple-Cabal-1.22.5.0-x86_64-openbsd-ghc-7.10.3: runProcess: runInteractiveProcess: exec: permission denied (Permission denied)
</code></pre>

<blockquote>
<p>The error isnt actually what it says. The untrained eye would assume permissions issue. A quick check of dmesg reveals what is really happening:</p>
</blockquote>

<pre><code>/home/qbit/.cabal/setup-exe-cache/setup-Simple-Cabal-1.22.5.0-x86_64-openbsd-ghc-7.10.3(22924): W^X binary outside wxallowed mountpoint
</code></pre>

<blockquote>
<p>OpenBSD is killing the above binary because it is violating W<sup>X</sup> and hasnt been safely kept in its /usr/local corral!<br>
We could solve this problem quickly by marking our /home as wxallowed, however, this would be heavy handed and reckless (we dont want to allow other potentially unsafe binaries to execute.. just the cabal stuff).<br>
Instead, we will build all our cabal stuff in /usr/local by using a symlink!</p>
</blockquote>

<pre><code>doas mkdir -p /usr/local/{cabal,cabal/build} # make our cabal and build dirs
doas chown -R user:wheel /usr/local/cabal    # set perms
rm -rf ~/.cabal                              # kill the old non-working cabal
ln -s /usr/local/cabal ~/.cabal              # link it!
</code></pre>

<blockquote>
<p>We are almost there! Some cabal packages build outside of ~/.cabal:</p>
</blockquote>

<pre><code>cabal install hakyll
.....
Building foundation-0.0.14...                                                   Preprocessing library foundation-0.0.14...
hsc2hs: dist/build/Foundation/System/Bindings/Posix_hsc_make: runProcess: runInteractiveProcess: exec: permission denied (Permission denied)
Downloading time-locale-compat-0.1.1.3...
.....
</code></pre>

<blockquote>
<p>Fortunately, all of the packages I have come across that do this all respect the TMPDIR environment variable!</p>
</blockquote>

<pre><code>alias cabal=&#39;env TMPDIR=/usr/local/cabal/build/ cabal&#39;
</code></pre>

<blockquote>
<p>With this alias, you should be able to cabal without issue (so far pandoc, shellcheck and hakyll have all built fine)!</p>
</blockquote>

<ul>
<li>TL;DR</li>
</ul>

<pre><code>&amp;#35; This assumes /usr/local/ is mounted as wxallowed.
&amp;#35;
doas mkdir -p /usr/local/{cabal,cabal/build}
doas chown -R user:wheel /usr/local/cabal
rm -rf ~/.cabal
ln -s /usr/local/cabal ~/.cabal
alias cabal=&#39;env TMPDIR=/usr/local/cabal/build/ cabal&#39;
cabal install pandoc
</code></pre>

<hr>

<h3><a href="https://adrianchadd.blogspot.co.uk/2017/10/freebsd-and-aprs-or-hm-what-happens.html" rel="nofollow">FreeBSD and APRS, or &quot;hm what happens when none of this is well documented..&quot;</a></h3>

<blockquote>
<p>Here&#39;s another point along my quest for amateur radio on FreeBSD - bring up basic APRS support. Yes, someone else has done the work, but in the normal open source way it was .. inconsistently documented.</p>
</blockquote>

<ul>
<li>First is figuring out the hardware platform. I chose the following:

<ul>
<li>A Baofeng UV5R2, since they&#39;re cheap, plentiful, and do both VHF and UHF;</li>
<li>A cable to do sound level conversion and isolation (and yes, I really should post a circuit diagram and picture..);</li>
<li>A USB sound device, primarily so I can whack it into FreeBSD/Linux devices to get a separate sound card for doing radio work;</li>
<li>FreeBSD laptop (it&#39;ll become a raspberry pi + GPS + sensor + LCD thingy later, but this&#39;ll do to start with.)</li>
<li>The Baofeng is easy - set it to the right frequency (VHF APRS sits on 144.390MHz), turn on VOX so I don&#39;t have to make up a PTT cable, done/done.</li>
</ul></li>
</ul>

<blockquote>
<p>The PTT bit isn&#39;t that hard - one of the microphone jack pins is actually PTT (if you ground it, it engages PTT) so when you make the cable just ensure you expose a ground pin and PTT pin so you can upgrade it later.</p>

<p>The cable itself isn&#39;t that hard either - I had a baofeng handmic lying around (they&#39;re like $5) so I pulled it apart for the cable. I&#39;ll try to remember to take pictures of that.</p>
</blockquote>

<ul>
<li>Here&#39;s a picture I found on the internet that shows the pinout: <a href="https://3.bp.blogspot.com/-58HUyt-9SUw/Wdz6uMauWlI/AAAAAAAAVz8/e7OrnRzN3908UYGUIRI1EBYJ5UcnO0qRgCLcBGAs/s1600/aprs-cable.png" rel="nofollow">image</a></li>
</ul>

<blockquote>
<p>Now, I went a bit further. I bought a bunch of 600 ohm isolation transformers for audio work, so I wired it up as follows:<br>
From the audio output of the USB sound card, I wired up a little attenuator - input is 2k to ground, then 10k to the input side of the transformer; then the output side of the transformer has a 0.01uF greencap capacitor to the microphone input of the baofeng;<br>
From the baofeng I just wired it up to the transformer, then the output side of that went into a 0.01uF greencap capacitor in series to the microphone input of the sound card.<br>
In both instances those capacitors are there as DC blockers.</p>

<p>Ok, so that bit is easy. Then on to the software side. The normal way people do this stuff is &quot;direwolf&quot; on Linux. So, &quot;pkg install direwolf&quot; installed it. That was easy.<br>
Configuring it up was a bit less easy. <a href="https://andrewmemory.wordpress.com/tag/direwolf/" rel="nofollow">I found this guide to be helpful</a><br>
FreeBSD has the example direwolf config in /usr/local/share/doc/direwolf/examples/direwolf.conf . Now, direwolf will run as a normal user (there&#39;s no rc.d script for it yet!) and by default runs out of the current directory. So:</p>
</blockquote>

<pre><code>$ cd ~
$ cp /usr/local/share/doc/direwolf/examples/direwolf.conf . 
$ (edit it)
$ direwolf
</code></pre>

<blockquote>
<p>Editing it isn&#39;t that hard - you need to change your callsign and the audio device.</p>

<p>OK, here is the main undocumented bit for FreeBSD - the sound device can just be /dev/dsp . It isn&#39;t an ALSA name! Don&#39;t waste time trying to use ALSA names. Instead, just find the device you want and reference it. For me the USB sound card shows up as /dev/dsp3 (which is very non specific as USB sound devices come and go, but that&#39;s a later problem!) but it&#39;s enough to bring it up.</p>

<p>So yes, following the above guide, using the right sound device name resulted in a working APRS modem.</p>

<p>Next up - something to talk to it. This is called &#39;xastir&#39;. It&#39;s .. well, when you run it, you&#39;ll find exactly how old an X application it is. It&#39;s very nostalgically old. But, it is enough to get APRS positioning up and test both the TCP/IP side of APRS and the actual radio radio side.</p>
</blockquote>

<ul>
<li><a href="https://andrewmemory.wordpress.com/2015/03/22/setting-up-direwolfxastir-on-a-raspberry-pi/" rel="nofollow">Here&#39;s the guide I followed:</a></li>
</ul>

<blockquote>
<p>So, that was it! So far so good. It actually works well enough to decode and watch APRS traffic around me. I managed to get out position information to the APRS network over both TCP/IP and relayed via VHF radio.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=fE2KDzZaxvE" rel="nofollow">Zebras All the Way Down - Bryan Cantrill</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/your-impact-on-freebsd/" rel="nofollow">Your impact on FreeBSD</a></li>
<li><a href="https://bsdmag.org/secret-good-gui/" rel="nofollow">The Secret to a good Gui</a></li>
<li><a href="https://github.com/containerd/containerd/releases/tag/v1.0.0" rel="nofollow">containerd hits v1.0.0</a></li>
<li><a href="https://www.youtube.com/watch?v=lzdg_2bUh9Y&t=" rel="nofollow">FreeBSD 11.1 Custom Kernels Made Easy - Configuring And Installing A Custom Kernel</a></li>
<li><a href="https://pbs.twimg.com/media/DQgCNq6UEAEqa1W.jpg:large" rel="nofollow">Debugging</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Bostjan - <a href="http://dpaste.com/22ZVJ12#wrap" rel="nofollow">Backup Tapes</a></li>
<li>Philipp - <a href="http://dpaste.com/13E8RGR#wrap" rel="nofollow">A long time ago, there was a script</a></li>
<li>Adam - <a href="http://dpaste.com/3BQXXPM#wrap" rel="nofollow">ZFS Pool Monitoring</a></li>
<li>Damian - <a href="http://dpaste.com/0ZZVM4R#wrap" rel="nofollow">KnoxBug</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>223: Compile once, debug twice</title>
  <link>https://www.bsdnow.tv/223</link>
  <guid isPermaLink="false">d183f10c-66be-49a7-b233-18c3a30ecdb4</guid>
  <pubDate>Wed, 06 Dec 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d183f10c-66be-49a7-b233-18c3a30ecdb4.mp3" length="80350996" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Picking a compiler for debuggability, how to port Rust apps to FreeBSD, what the point of Docker is on FreeBSD/Solaris, another EuroBSDcon recap, and network manager control in OpenBSD</itunes:subtitle>
  <itunes:duration>1:51:35</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Picking a compiler for debuggability, how to port Rust apps to FreeBSD, what the point of Docker is on FreeBSD/Solaris, another EuroBSDcon recap, and network manager control in OpenBSD
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Compile once, Debug twice: Picking a compiler for debuggability, part 1 of 3 (https://backtrace.io/blog/compile-once-debug-twice-picking-a-compiler-for-debuggability-1of3/)
An interesting look into why when you try to debug a crash, you can often find all of the useful information has been ‘optimized out’
Have you ever had an assert get triggered only to result in a useless core dump with missing variable information or an invalid callstack?
Common factors that go into selecting a C or C++ compiler are: availability, correctness, compilation speed and application performance. A factor that is often neglected is debug information quality, which symbolic debuggers use to reconcile application executable state to the source-code form that is familiar to most software engineers.
When production builds of an application fail, the level of access to program state directly impacts the ability for a software engineer to investigate and fix a bug. If a compiler has optimized out a variable or is unable to express to a symbolic debugger how to reconstruct the value of a variable, the engineer’s investigation process is significantly impacted. Either the engineer has to attempt to recreate the problem, iterate through speculative fixes or attempt to perform prohibitively expensive debugging, such as reconstructing program state through executable code analysis.
Debug information quality is in fact not proportionally related to the quality of the generated executable code and wildly varies from compiler to compiler.
Different compilers emit debug information at varying levels of quality and accuracy. However, certain optimizations will certainly impact any debugger’s ability to generate accurate stack traces or extract variable values. 
In the above program, the value of argv is extracted and then the program is paused. The ckprloadptr function performs a read from the region of memory pointed to by argv, in a manner that prevents the compiler from performing optimization on it. This ensures that the memory access occurs and for this reason, the value of argv must be accessible by the time ckprloadptr is executed.
When compiled with gcc, the debugger fails to find the value of the variable. The compiler determines that the value of argv is no longer needed after the ckprload_ptr operation and so doesn’t bother paying the cost of saving the value.
Some optimizations generate executable code whose call stack cannot be sufficiently disambiguated to reconcile a call stack that mirrors that of the source program. Two common culprits for this are tail call optimization and basic block commoning.
In another example
If the program receives a first argument of 1, then function is called with the argument of "a". If the program receives a first argument of 2, then function is called with the argument of "b". However, if we compile this program with clang, the stack traces in both cases are identical! clang informs the debugger that the function f invoked the function("b") branch where x = 2 even if x = 1.
Though some optimizations will certainly impact the accuracy of a symbolic debugger, some compilers simply lack the ability to generate debug information in the presence of certain optimizations. One common optimization is induction variable elimination. A variable that’s incremented or decremented by a constant on every iteration of a loop or derived from another variable that follows this pattern, is an induction variable.
Coupled with other optimizations, the compiler is then able to generate code that doesn’t actually rely on a dedicated counter variable “i” for maintaining the current offset into “buffer”.
As you can see, i is completely optimized out. The compiler determines it doesn’t have to pay the cost of maintaining the induction variable i. It maintains the pointer in the register %rdi. The code is effectively rewritten to something closer to this:
So the for loop, changes into a while loop, with a condition of the end of the input
We have shown some common optimizations that may get in the way of the debuggability of your application and demonstrated a disparity in debug information quality across two popular compilers. In the next blog post of this series, we will examine how gcc and clang stack up with regards to debug information quality across a myriad of synthetic applications and real world applications.
Looking forward to part 2
***
This is how you can port your rust application to FreeBSD (https://medium.com/@andoriyu/this-is-how-you-can-port-your-rust-application-to-freebsd-7d3e9f1bc3df)
This is how you can port your rust application to FreeBSD
The FreeBSD Ports Collection is the way almost everyone installs applications (“ports”) on FreeBSD. Like everything else about FreeBSD, it is primarily a volunteer effort. It is important to keep this in mind when reading this document.
In FreeBSD, anyone may submit a new port, or volunteer to maintain an existing unmaintained port. No special commit privilege is needed.
For this guide I will use fd tool written by David Peter as example project.
Prerequisites
FreeBSD installation (VM is fine)
Local ports tree (done via svn)
portlint (located at devel/portlint)
poudriere (located at ports-mgmt/poudriere)[optional]
Getting ports tree
When you install FreeBSD opt-out of the ports tree. Install svn:

pkg install svn
svn checkout https://svn.freebsd.org/ports/head /usr/ports

Poudriere
Sometimes you might get asked to show poudriere build log, sometimes you won’t. It’s good to have anyway. If you choose to use poudriere, use ZFS. There are plenty of guides on the subject. FreeBSD Porter’s Handbook is the most complete source of information on porting to FreeBSD.
Makefile
Whole porting process in most cases is writing one Makefile. I recommend doing something like this.
Here is the one I wrote for fd:
Port metadata
Each port must have one primary category in case of fd it will be sysutils, therefore it's located in /usr/ports/systuils/fd.

PORTNAME= fd
CATEGORIES= sysutils

Since this port conflicts with other util named fd I specified package suffix as: PKGNAMESUFFIX= -find and indicate conflict: CONFLICTS_INSTALL= fd-[0-9]*. That means to install it from packages user will have to type:

pkg install fd-find

Licenses
This section is different for every port, but in case of fd it's pretty straightforward:

LICENSE= MIT APACHE20
LICENSE_COMB= dual

Since fd includes the text of licenses you should do this as well:

LICENSE_FILE_MIT= ${WRKSRC}/LICENSE-MIT
LICENSE_FILE_APACHE20= ${WRKSRC}/LICENSE-APACHE

Distfiles
FreeBSD has a requirement that all ports must allow offline building. That means you have specified which files are needed to be downloaded. Luckily we now have helpers to download GitHub sources directly from GitHub:

USE_GITHUB= yes
GH_ACCOUNT= sharkdp

Since PORTNANE is fd it will try to download sources for sharkdp/fd. By default it's going to download tag: 

${DISTVERSIONPREFIX}${DISTVERSION}${DISTVERSIONSUFFIX}

fd uses v as the prefix, therefore we need to specify: DISTVERSIONPREFIX= v.
It's also possible to specify GH_TAGNAME in case tag name doesn't match that pattern.
Extra packages
There are very few rust projects that are standalone and use no crates dependencies. It’s used to be PITA to make it work offline, but now cargo is a first class citizen in ports:

USES= cargo
CARGO_CRATES= aho-corasick-0.6.3 \
              atty-0.2.3 \
              # and so goes on

Yes, you have to specify each dependency. Luckily, there is a magic awk script that turns Cargo.lock into what you need. Execute make cargo-crates in the port root. This will fail because you're missing checksum for the original source files:

make makesum
make cargo-crates

This will give you what you need. Double check that result is correct. There is a way to ignore checksum error, but I can’t remember… Execute make makesum again.
CARGO_OUT
If. build.rs relies on that you have to change it. fd allows you to use SHELLCOMPLETIONSDIR to specify where completions go, while ripgrep doesn't. In our case we just specify SHELLCOMPLETIONSDIR:

SHELL_COMPLETIONS_DIR= ${WRKDIR}/shell-completions-dir CARGO_ENV= SHELL_COMPLETIONS_DIR=${SHELL_COMPLETIONS_DIR}

PLIST
FreeBSD is very strict about files it’s installing and it won’t allow you to install random files that get lost. You have to specify which files you’re installing. In this case, it’s just two:

PLIST_FILES= bin/fd \
             man/man1/fd.1.gz

Note that sources for fd have uncompressed man file, while here it’s listed as compressed. If port installs a lot of files, specify them in pkg-plist like here. To actually install them:

post-install:
  @${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/fd
  ${INSTALL_MAN}${WRKSRC}/doc/fd.1 ${STAGEDIR}${MAN1PREFIX}/man/man1

Shell completions
clap-rs can generate shell completions for you, it's usually handled by build.rs script. First, we need to define options:

OPTIONS_DEFINE= BASH FISH ZSH # list options
OPTIONS_DEFAULT= BASH FISH ZSH # select them by default
BASH_PLIST_FILES= etc/bash_completion.d/fd.bash-completion 
FISH_PLIST_FILES= share/fish/completions/fd.fish
ZSH_PLIST_FILES= share/zsh/site-functions/_fd

To actually install them:

post-install-BASH-on:
 @${MKDIR} ${STAGEDIR}${PREFIX}/etc/bash_completion.d
 ${INSTALL_DATA} ${SHELL_COMPLETIONS_DIR}/fd.bash-completion \
 ${STAGEDIR}${PREFIX}/etc/bash_completion.d
post-install-FISH-on:
 @${MKDIR} ${STAGEDIR}${PREFIX}/share/fish/completions
 ${INSTALL_DATA} ${SHELL_COMPLETIONS_DIR}/fd.fish \
 ${STAGEDIR}${PREFIX}/share/fish/completions
post-install-ZSH-on:
 @${MKDIR} ${STAGEDIR}${PREFIX}/share/zsh/site-functions
 ${INSTALL_DATA} ${SHELL_COMPLETIONS_DIR}/_fd \
 ${STAGEDIR}${PREFIX}/share/zsh/site-functions

Bonus round - Patching source code
Sometimes you have to patch it and send the patch upstream. Merging it upstream can take awhile, so you can patch it as part of the install process. An easy way to do it:
 Go to work/ dir
Copy file you want to patch and add .orig suffix to it
Edit file you want to patch
Execute make makepatch in port's root
Submitting port
First, make sure portlint -AC doesn't give you any errors or warnings. Second, make sure poudriere can build it on both amd64 and i386. If it can't?—?you have to either fix it or mark port broken for that arch.
Follow this steps like I did steps. If you have any issues you can always ask your question in freebsd-ports on freenode try to find your answer in porter’s handbook before asking.
Conference Recap: EuroBSDCon 2017 Recap (https://www.freebsdfoundation.org/blog/conference-recap-eurobsdcon-2017-recap/)
The location was wonderful and I loved sneaking out and exploring the city when I could. From what I heard, it was the largest BSD conference in history, with over 320 attendees!
Each venue is unique and draws many local BSD enthusiasts, who normally wouldn’t be able to travel to a conference. I love having the chance to talk to these people about how they are involved in the projects and what they would like to do. Most of the time, they are asking me questions about how they can get more involved and how we can help.
Magical is how I would describe the conference social event. To stand in front of the dinner cruise on the Seine, with the Eiffel Tower standing tall, lit up in the night, while working – talking to our community members, was incredible. But, let me start at the beginning.
We attend these conferences to talk to our community members, to find out what they are working on, determine technologies that should be supported in FreeBSD, and what we can do to help and improve FreeBSD.
We started the week with a half-day board meeting on Wednesday. BSD conferences give us a chance to not only meet with community members around the world, but to have face-to-face meetings with our team members, who are also located around the world. We worked on refining our strategic direction and goals, determining what upcoming conferences we want FreeBSD presence at and who can give FreeBSD talks and workshops there, discussed current and potential software development projects, and discussed how we can help raise awareness about and increase the use of FreeBSD in Europe.
Thursday was the first day of the FreeBSD developer summit, led by our very own Benedict Reuschling. He surprised us all by having us participate in a very clever quiz on France. 45 of us signed into the software, where he’d show the question on the screen and we had a limited amount of time to select our answers, with the results listed on the screen. It was actually a lot of fun, especially since they didn’t publicize the names of the people who got the questions wrong. The lucky or most knowledgeable person on France, was des@freebsd.org.
Some of our board members ran tutorials in parallel to the summit. Kirk McKusick gave his legendary tutorial,  An Introduction to the FreeBSD Open-Source Operating System , George Neville-Neil gave his tutorial, DTrace for Developers, and Benedict Reuschling gave a tutorial on, Managing BSD systems with Ansible.
I was pleased to have two chairs from ACM-W Europe run an “Increasing Diversity in the BSDs” BoF for the second year in a row. We broke up into three groups to discuss different gender bias situations, and what we can do to address these types of situations, to make the BSD projects more diverse, welcoming, and inclusive. At the end, people asked that we continue these discussions at future BSD conferences and suggested having an expert in the field give a talk on how to increase the diversity in our projects.
As I mentioned earlier, the social dinner was on a boat cruising along the Seine. I had a chance to talk to community members in a more social environment. With the conference being in France, we had a lot of first time attendees from France. I enjoyed talking to many of them, as well as other people I only get to see at the European conferences. Sunday was full of more presentations and conversations. During the closing session, I gave a short talk on the Foundation and the work we are doing. Then, Benedict Reuschling, Board Vice President, came up and gave out recognition awards to four FreeBSD contributors who have made an impact on the Project.
News Roundup
Playing with the pine64 (https://chown.me/blog/playing-with-the-pine64.html)
Daniel Jakots writes in his blog about his experiences with his two pine64 boards: 
Finding something to install on it
6 weeks ago, I ordered two pine64 units. I didn't (and still don't) have much plan for them, but I wanted to play with some cheap boards. I finally received them this week. Initially I wanted to install some Linux stuff on it, I didn't have much requirement so I thought I would just look what seems to be easy and/or the best supported systemd flavour. I headed over their wiki. Everything seems either not really maintained, done by some random people or both. I am not saying random people do bad things, just that installing some random things from the Internet is not really my cup of tea.
I heard about Armbian (https://www.armbian.com/pine64/) but the server flavour seems to be experimental so I got scared of it. And sadly, the whole things looks like to be alot undermanned.
So I went for OpenBSD because I know the stuff and who to har^Wkindly ask for help. Spoiler alert, it's boring because it just works.
Getting OpenBSD on it
I downloaded miniroot62.fs, dd'ed it on the micro SD card. I was afraid I'd need to fiddle with some things like sysutils/dtb because I don't know what I would have needed to do. That's because I don't know what it does and for this precise reason I was wrong and I didn't need to do anything. So just dd the miniroot62.fs and you can go to next checkpoint.
I plugged an HDMI cable, ethernet cable and the power, it booted, I could read for 10 seconds but then it got dark. Of course it's because you need a serial console. Of course I didn't have one.
I thought about trying to install OpenBSD blindly, I could have probably succeeded with autoinstall buuuuuut…
Following some good pieces of advice from OpenBSD people I bought some cp2102 (I didn't try to understand what it was or what were the other possibilities, I just wanted something that would work :D).
I looked how to plug the thing. It appears you can plug it on two different places but if you plug it on the Euler bus it could power a bit the board so if you try to reboot it, it would then mess with the power disruption and could lead a unclean reboot.
You just need to plug three cables: GND, TXD and RXD. Of course, the TXD goes on the RXD pin from the picture and the RXD goes on the TXD pin. Guess why I'm telling you that! 
That's it
Then you can connect with the usual
$ cu -dl /dev/cuaU0 -s 115200
What’s the point of Docker on FreeBSD or Solaris? (http://blog.frankleonhardt.com/2017/whats-the-point-of-docker-on-freebsd-or-solaris/)
Penguinisters are very keen on their docker, but for the rest of us it may be difficult to see what the fuss is all about – it’s only been around a few years and everyone’s talking about it. And someone asked again today. What are we missing?
Well docker is a solution to a Linux (and Windows) problem that FreeBSD/Solaris doesn’t have. Until recently, the Linux kernel only implemented the original user isolation model involving chroot. More recent kernels have had Control Groups added, which are intended to provide isolation for a group of processes (namespaces). This came out of Google, and they’ve extended to concept to include processor resource allocation as one of the knobs, which could be a good idea for FreeBSD. The scheduler is aware of the JID of the process it’s about to schedule, and I might take a look in the forthcoming winter evenings. But I digress.
So if isolation (containerisation in Linux terms) is in the Linux kernel, what is Docker bringing to the party? The only thing I can think of is standardisation and an easy user interface (at the expense of having Python installed). You might think of it in similar terms to ezjail – a complex system intended to do something that is otherwise very simple.
To make a jail in FreeBSD all you need do is copy the files for your system  to a directory. This can even be a whole server’s system disk if you like, and jails can run inside jails.  You then create a very simple config file, giving the jail a name, the path to your files and an what IP addresses to pass through (if any) and you’re done. Just type “service jail nameofjal start”, and off it goes.
Is there any advantage in running Docker? Well, in a way, there is. Docker has a repository of system images that you can just install and run, and this is what a lot of people want. They’re a bit like virtual appliances, but not mind-numbingly inefficient.
You can actually run docker on FreeBSD. A port was done a couple of years ago, but it relies on the 64-bit Linux emulation that started to appear in 10.x. The newer the version of FreeBSD the better.
Docker is in ports/sysutils/docker-freebsd. It makes uses of jails instead of Linux cgroups, and requires ZFS rather than UFS for file system isolation. I believe the Linux version uses Union FS but I could be completely wrong on that.
The FreeBSD port works with the Docker hub repository, giving you access to thousands of pre-packaged system images to play with. And that’s about as far as I’ve ever tested it. If you want to run the really tricky stuff (like Windows) you probably want full hardware emulation and something like  Xen. If you want to deploy or migrate FreeBSD or Solaris systems, just copy a new tarball in to the directory and go. It’s a non-problem, so why make it more complicated?
Given the increasing frequency Docker turns up in conversations, it’s probably worth taking seriously as Linux applications get packaged up in to images for easy access. Jails/Zones may be more efficient, and Docker images are limited to binary, but convenience tends to win in many environments.
Network Manager Control for OpenBSD (http://www.vincentdelft.be/post/post_20171023)
I propose you a small script allowing you to easily manage your networks connections. This script is integrated within the openbox dynamic menus. Moreover, it allow you to automatically have the connections you have pre-defined based.
I was frustrated to not be able to swap quickly from one network interface to an another, to connect simply and quickly to my wifi, to my cable connection, to the wifi of a friend, ... 
Every time you have to type the ifconfig commands, .... This is nice, but boring. Surely, when you are in a middle of a presentation and you just want a quick connection to your mobile in tethering mode.
Thanks to OpenBSD those commands are not so hard, but this frustrate me to not be able to do it with one click. Directly from my windows environment. Since I'm using Openbox, from a menu of openbox.
So, I've looked around to see what is currently existing. 
One tool I've found was netctl (https://github.com/akpoff/netctl). The idea is to have a repository of hostname.if files ready to use for different cases. 
The idea sounds great, but I had some difficulties to use it. 
But what annoys me the most, is that it modify the current hostname.if files in /etc. 
To my eyes, I would avoid to modify those files because they are my working basis. I want to rely on them and make sure that my network will be back to a normal mode after a reboot. 
Nevertheless, if I've well understood netctl, you have a feature where it will look for the predefined network config matching the environment where you are. Very cool.
So, after having played with netctl, look for alternative on internet, I've decided to create nmctl. A small python script which just perform the mandatory network commands.
1. nmctl: a Network Manager Control tool for OpenBSD
Nmctl a small tool that allow you to manage your network connections. 
Why python ? Just because it's the easiest programming language for me. But I should maybe rewrite it in shell, more standard in the OpenBSD world than python.
1.1. download and install
I've put nmctl on my sourceforge account here (https://sourceforge.net/p/nmctl/code/ci/master/tree/)
You can dowload the last version here (https://sourceforge.net/p/nmctl/code/ci/master/tarball)
To install you just have to run: make install (as root)
The per-requists are:
- having python2.7 installed
- Since nmctl must be run as root, I strongly recommend you to run it via doas (http://man.openbsd.org/doas.conf.5).
1.2. The config file
First you have to create a config and store it in /etc/nmctl.conf. 
This file must respect few rules:
Each block must starts with a line having the following format: '''&amp;lt;-name-&amp;gt;:&amp;lt;-interface-&amp;gt;'''
Each following lines must start by at least one space. Those lines have more or less the same format as for hostname.if.
You have to create a block with the name "open". This will be used to establish a connection to the Open Wifi around you (in restaurant for example)
The order of those elements is important. In case you use the -restart option, nmctl will try each of those network configs one after one until it can ping www.google.com. (if you wan to ping something else, you can change it in the python script if you want).
You can use external commands. Just preced them with the "!".
You have macors. Macros allow you to perform some actions. The 2 currently implemented are '''&amp;lt;-nwid-&amp;gt;''' and '''&amp;lt;-random mac-&amp;gt;'''.
You can use keywords. Currently the only one implemented is "dhcp"
Basically you can put all commands that nmctl will apply to the interface to which those commands are referring to. So, you will always have "ifconfig &amp;lt;-interface-&amp;gt; &amp;lt;-command you type in the config file-&amp;gt;". 
Check the manpage of ifconfig to see how flexible command is.
You have currently 2 macros:
- &amp;lt;-nwid-&amp;gt; which refers to the "nwid &amp;lt;-nwid name-&amp;gt;" when you select an Open Wifi with the -open option of nmctl.
- &amp;lt;-random mac-&amp;gt; is a macro generating a random mac address. This is useful test a dhcp server for example.
The keyword "dhcp" will trigger a command like "dhclient &amp;lt;-interface-&amp;gt;".
1.3. Config file sample.
Let me show you one nmctl.conf example. It speaks by itself.
```
# the name open is required for Open wifi. 
# this is the interface that nmctl will take to establish a connection
# We must put the macro . This is where nmctl will put the nwid command
# and the selected openwifi selected by the parameter --open
open:iwn0
 !route flush
  -wpa
 dhcp
cable:em0
 !route flush
 dhcp
lgg4:iwn0
 !route flush
 nwid LGG4s_8114 wpakey aanotherpassword
 dhcp
home:iwn0
 !route flush
 nwid Linksys19594 wpakey apassword
 dhcp
college:iwn0
 !route flush
 nwid john wpakey haahaaaguessme
 dhcp
cable_fixip:em0
 !route flush
 inet 192.168.3.3 netmask 255.255.255.0
 !route add -host default 192.168.3.1
# with this network interface I'm using the macro  
# which will do what you guess it will do :-)
cable_random:em0
 !route flush
 lladdr 
 dhcp
```
In this config we have several cable's networks associated with my interface "em0" and several wifi networks associated with my wireless interface "iwn0".
You see that you can switch from dhcp, to fixed IP and even you can play with the random mac address macro.
Thanks to the network called "open", you can connect to any open wifi system. To do that, just type ''' nmctl --open &amp;lt;-name of the open wifi-&amp;gt;'''
So, now, with just one command you can switch from one network configuration to an another one. 
That's become cool :-).
2. Integration with openbox
Thanks to the dynamic menu feature of oenbox[sic], you can have your different pre-defined networks under one click of your mouse.
For that, you just have to add, at the most appropriate place for you, the following code in your ./config/openbox/menu.xml


  
  
  

In this case, you see the different networks as defined in the config file just above.
3. Automatically identify your available connection and connect to it in one go
But the most interesting part, is coming from a loop through all of your defined networks. 
This loop is reachable via the -restart option.
Basically the idea is to loop from the first network config to the last and test a ping for each of them. Once the ping works, we break the loop and keep this setting.
Thus where ever you are, you just have to initiate a nmctl -restart and you will be connected to the network you have defined for this place. There is one small exception, the open-wifis. We do not include them in this loop exercise.
Thus the way you define your config file is important. 
Since the network called "open" is dedicated to "open wifi", it will not be part of this scan exercise. I propose you keep it at the first place.
Then, in my case, if my mobile, called lgg4, is open and visible by my laptop, I will connect it immediately. 
Second, I check if my "home wifi" is visible. 
Third, if I have a cable connected on my laptop, I'm using this connection and do a dhcp command. 
Then, I check to see if my laptop is not viewing the "college" wifi. 
? and so on until a ping command works.
If you do not have a cable in your laptop and if none of your pre-defined wifi connections are visible, the scan will stop.
3.1 examples
No cable connected, no pre-defined wifi around me:

t420:~$ time doas nmctl -r 
nwids around you:  bbox2-d954
    0m02.97s real     0m00.08s user     0m00.11s system
t420:~$ 
t420:~$

I'm at home and my wifi router is running:
```
t420:~$ time doas nmctl -r 
nwids around you:  Linksys19594 bbox2-d954
ifconfig em0 down: 0
default              fw                   done
fw                   00:22:4d:ac:30:fd    done
nas                  link#2               done
route flush: 0
ifconfig iwn0 nwid Linksys19594  ...: 0
iwn0: no link ........... sleeping
dhclient iwn0: 0
Done.
PING www.google.com (216.58.212.164): 56 data bytes
64 bytes from 216.58.212.164: icmp_seq=0 ttl=52 time=12.758 ms
--- www.google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 12.758/12.758/12.758/0.000 ms
ping -c1 -w2 www.google.com: 0
    0m22.49s real     0m00.08s user     0m00.11s system
t420:~$
```
I'm at home but tethering is active on my mobile:
```
t420:~$ 
t420:~$ time doas nmctl -r 
nwids around you:  Linksys19594 bbox2-d954 LGG4s8114
ifconfig em0 down: 0
default              fw                   done
fw                   00:22:4d:ac:30:fd    done
nas                  link#2               done
route flush: 0
ifconfig iwn0 nwid LGG4s8114  ...: 0
iwn0: DHCPDISCOVER - interval 1
iwn0: DHCPDISCOVER - interval 2
iwn0: DHCPOFFER from 192.168.43.1 (a0:91:69:be:10:49)
iwn0: DHCPREQUEST to 255.255.255.255
iwn0: DHCPACK from 192.168.43.1 (a0:91:69:be:10:49)
iwn0: bound to 192.168.43.214 -- renewal in 1800 seconds
dhclient iwn0: 0
Done.
ping: Warning: www.google.com has multiple addresses; using 173.194.69.99
PING www.google.com (173.194.69.99): 56 data bytes
64 bytes from 173.194.69.99: icmp_seq=0 ttl=43 time=42.863 ms
--- www.google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 42.863/42.863/42.863/0.000 ms
ping -c1 -w2 www.google.com: 0
    0m13.78s real     0m00.08s user     0m00.13s system
t420:~$
```
Same situation, but I cut the tethering just after the scan. Thus the dhcp command will not succeed. 
We see that, after timeouts, nmctl see that the ping is failing (return code 1), thus he pass to the next possible pre-defined network.
```
t420:~$ time doas nmctl -r 
nwids around you:  Linksys19594 bbox2-d954 LGG4s8114
ifconfig em0 down: 0
default              192.168.43.1         done
192.168.43.1         a0:91:69:be:10:49    done
route flush: 0
ifconfig iwn0 nwid LGG4s8114  ...: 0
iwn0: no link ........... sleeping
dhclient iwn0: 0
Done.
ping: no address associated with name
ping -c1 -w2 www.google.com: 1
ifconfig em0 down: 0
192.168.43.1         link#2               done
route flush: 0
ifconfig iwn0 nwid Linksys19594  ...: 0
iwn0: DHCPREQUEST to 255.255.255.255
iwn0: DHCPACK from 192.168.3.1 (00:22:4d:ac:30:fd)
iwn0: bound to 192.168.3.16 -- renewal in 302400 seconds
dhclient iwn0: 0
Done.
PING www.google.com (216.58.212.164): 56 data bytes
64 bytes from 216.58.212.164: icmp_seq=0 ttl=52 time=12.654 ms
--- www.google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 12.654/12.654/12.654/0.000 ms
ping -c1 -w2 www.google.com: 0
    3m34.85s real     0m00.17s user     0m00.20s system
t420:~$
```
OpenVPN Setup Guide for FreeBSD (https://www.c0ffee.net/blog/openvpn-guide)
OpenVPN Setup Guide
Browse securely from anywhere using a personal VPN with OpenVPN, LDAP, FreeBSD, and PF.
A VPN allows you to securely extend a private network over the internet via tunneling protocols and traffic encryption. For most people, a VPN offers two primary features: (1) the ability to access services on your local network over the internet, and (2) secure internet connectivity over an untrusted network. In this guide, I'll describe how to set up a personal VPN using OpenVPN on FreeBSD. The configuration can use both SSL certificates and LDAP credentials for authentication. We'll also be using the PF firewall to NAT traffic from our VPN out to the internet.
One important note about running your own VPN: since you are most likely hosting your server using a VPS or hosting provider, with a public IP address allocated specifically to you, your VPN will not give you any extra anonymity on the internet. If anything, you'll be making yourself more of a target, since all your activity can be trivially traced back to your server's IP address. So while your VPN will protect you from a snooping hacker on the free WiFi at Starbucks, it won't protect you from a federal investigation.
This guide assumes you are running FreeBSD with the PF firewall. If you're using a different Unix flavor, I'll probably get you most of the way there—but you'll be on your own when configuring your firewall and networking.
Finally, I've used example.com and a non-routable public IP address for all the examples in this guide. You'll need to replace them with your own domain name and public IP address.
Beastie Bits
BSDCan 2017 videos (https://www.youtube.com/channel/UCuQhwHMJ0yK2zlfyRr1XZ_Q/feed)
Getting started with OpenBSD device driver development PDF (https://www.openbsd.org/papers/eurobsdcon2017-device-drivers.pdf)
AWS CloudWatch Logs agent for FreeBSD (https://macfoo.wordpress.com/2017/10/27/aws-cloudwatch-logs-agent-for-freebsd/)
FreeBSD Foundation November 2017 Development Projects Update (https://www.freebsdfoundation.org/blog/november-2017-development-projects-update/)
Schedule for the BSD Devroom at FOSDEM 2018 (https://fosdem.org/2018/schedule/track/bsd/)
***
Feedback/Questions
Matt - The show and Cantrill (http://dpaste.com/35VNXR5#wrap)
Paulo - FreeBSD Question (http://dpaste.com/17E9Z2W#wrap)
Steven - Virtualization under FreeBSD (http://dpaste.com/1N6F0TC#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Picking a compiler for debuggability, how to port Rust apps to FreeBSD, what the point of Docker is on FreeBSD/Solaris, another EuroBSDcon recap, and network manager control in OpenBSD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://backtrace.io/blog/compile-once-debug-twice-picking-a-compiler-for-debuggability-1of3/" rel="nofollow">Compile once, Debug twice: Picking a compiler for debuggability, part 1 of 3</a></h3>

<ul>
<li>An interesting look into why when you try to debug a crash, you can often find all of the useful information has been optimized out</li>
</ul>

<blockquote>
<p>Have you ever had an assert get triggered only to result in a useless core dump with missing variable information or an invalid callstack?<br>
Common factors that go into selecting a C or C++ compiler are: availability, correctness, compilation speed and application performance. A factor that is often neglected is debug information quality, which symbolic debuggers use to reconcile application executable state to the source-code form that is familiar to most software engineers.<br>
When production builds of an application fail, the level of access to program state directly impacts the ability for a software engineer to investigate and fix a bug. If a compiler has optimized out a variable or is unable to express to a symbolic debugger how to reconstruct the value of a variable, the engineers investigation process is significantly impacted. Either the engineer has to attempt to recreate the problem, iterate through speculative fixes or attempt to perform prohibitively expensive debugging, such as reconstructing program state through executable code analysis.<br>
Debug information quality is in fact not proportionally related to the quality of the generated executable code and wildly varies from compiler to compiler.<br>
Different compilers emit debug information at varying levels of quality and accuracy. However, certain optimizations will certainly impact any debuggers ability to generate accurate stack traces or extract variable values. <br>
In the above program, the value of argv is extracted and then the program is paused. The ck_pr_load_ptr function performs a read from the region of memory pointed to by argv, in a manner that prevents the compiler from performing optimization on it. This ensures that the memory access occurs and for this reason, the value of argv must be accessible by the time ck_pr_load_ptr is executed.<br>
When compiled with gcc, the debugger fails to find the value of the variable. The compiler determines that the value of argv is no longer needed after the ck_pr_load_ptr operation and so doesnt bother paying the cost of saving the value.<br>
Some optimizations generate executable code whose call stack cannot be sufficiently disambiguated to reconcile a call stack that mirrors that of the source program. Two common culprits for this are tail call optimization and basic block commoning.</p>
</blockquote>

<ul>
<li>In another example</li>
</ul>

<blockquote>
<p>If the program receives a first argument of 1, then function is called with the argument of &quot;a&quot;. If the program receives a first argument of 2, then function is called with the argument of &quot;b&quot;. However, if we compile this program with clang, the stack traces in both cases are identical! clang informs the debugger that the function f invoked the function(&quot;b&quot;) branch where x = 2 even if x = 1.<br>
Though some optimizations will certainly impact the accuracy of a symbolic debugger, some compilers simply lack the ability to generate debug information in the presence of certain optimizations. One common optimization is induction variable elimination. A variable thats incremented or decremented by a constant on every iteration of a loop or derived from another variable that follows this pattern, is an induction variable.<br>
Coupled with other optimizations, the compiler is then able to generate code that doesnt actually rely on a dedicated counter variable i for maintaining the current offset into buffer.<br>
As you can see, i is completely optimized out. The compiler determines it doesnt have to pay the cost of maintaining the induction variable i. It maintains the pointer in the register %rdi. The code is effectively rewritten to something closer to this:</p>
</blockquote>

<ul>
<li>So the for loop, changes into a while loop, with a condition of the end of the input</li>
</ul>

<blockquote>
<p>We have shown some common optimizations that may get in the way of the debuggability of your application and demonstrated a disparity in debug information quality across two popular compilers. In the next blog post of this series, we will examine how gcc and clang stack up with regards to debug information quality across a myriad of synthetic applications and real world applications.</p>
</blockquote>

<ul>
<li>Looking forward to part 2
***</li>
</ul>

<h3><a href="https://medium.com/@andoriyu/this-is-how-you-can-port-your-rust-application-to-freebsd-7d3e9f1bc3df" rel="nofollow">This is how you can port your rust application to FreeBSD</a></h3>

<ul>
<li>This is how you can port your rust application to FreeBSD</li>
</ul>

<blockquote>
<p>The FreeBSD Ports Collection is the way almost everyone installs applications (ports) on FreeBSD. Like everything else about FreeBSD, it is primarily a volunteer effort. It is important to keep this in mind when reading this document.<br>
In FreeBSD, anyone may submit a new port, or volunteer to maintain an existing unmaintained port. No special commit privilege is needed.<br>
For this guide I will use fd tool written by David Peter as example project.</p>
</blockquote>

<ul>
<li><p>Prerequisites</p>

<ul>
<li>FreeBSD installation (VM is fine)</li>
<li>Local ports tree (done via svn)</li>
<li>portlint (located at devel/portlint)</li>
<li>poudriere (located at ports-mgmt/poudriere)[optional]</li>
</ul></li>
<li><p>Getting ports tree</p>

<ul>
<li>When you install FreeBSD opt-out of the ports tree. Install svn:</li>
</ul></li>
</ul>

<pre><code>pkg install svn
svn checkout https://svn.freebsd.org/ports/head /usr/ports
</code></pre>

<ul>
<li>Poudriere</li>
</ul>

<blockquote>
<p>Sometimes you might get asked to show poudriere build log, sometimes you wont. Its good to have anyway. If you choose to use poudriere, use ZFS. There are plenty of guides on the subject. FreeBSD Porters Handbook is the most complete source of information on porting to FreeBSD.</p>
</blockquote>

<ul>
<li>Makefile</li>
</ul>

<blockquote>
<p>Whole porting process in most cases is writing one Makefile. I recommend doing something like this.<br>
Here is the one I wrote for fd:</p>
</blockquote>

<ul>
<li>Port metadata</li>
</ul>

<blockquote>
<p>Each port must have one primary category in case of fd it will be sysutils, therefore it&#39;s located in /usr/ports/systuils/fd.</p>
</blockquote>

<pre><code>PORTNAME= fd
CATEGORIES= sysutils
</code></pre>

<blockquote>
<p>Since this port conflicts with other util named fd I specified package suffix as: PKGNAMESUFFIX= -find and indicate conflict: CONFLICTS_INSTALL= fd-[0-9]*. That means to install it from packages user will have to type:</p>
</blockquote>

<pre><code>pkg install fd-find
</code></pre>

<ul>
<li>Licenses</li>
</ul>

<blockquote>
<p>This section is different for every port, but in case of fd it&#39;s pretty straightforward:</p>
</blockquote>

<pre><code>LICENSE= MIT APACHE20
LICENSE_COMB= dual
</code></pre>

<blockquote>
<p>Since fd includes the text of licenses you should do this as well:</p>
</blockquote>

<pre><code>LICENSE_FILE_MIT= ${WRKSRC}/LICENSE-MIT
LICENSE_FILE_APACHE20= ${WRKSRC}/LICENSE-APACHE
</code></pre>

<ul>
<li>Distfiles</li>
</ul>

<blockquote>
<p>FreeBSD has a requirement that all ports must allow offline building. That means you have specified which files are needed to be downloaded. Luckily we now have helpers to download GitHub sources directly from GitHub:</p>
</blockquote>

<pre><code>USE_GITHUB= yes
GH_ACCOUNT= sharkdp
</code></pre>

<blockquote>
<p>Since PORTNANE is fd it will try to download sources for sharkdp/fd. By default it&#39;s going to download tag: </p>
</blockquote>

<pre><code>${DISTVERSIONPREFIX}${DISTVERSION}${DISTVERSIONSUFFIX}
</code></pre>

<blockquote>
<p>fd uses v as the prefix, therefore we need to specify: DISTVERSIONPREFIX= v.<br>
It&#39;s also possible to specify GH_TAGNAME in case tag name doesn&#39;t match that pattern.</p>
</blockquote>

<ul>
<li>Extra packages</li>
</ul>

<blockquote>
<p>There are very few rust projects that are standalone and use no crates dependencies. Its used to be PITA to make it work offline, but now cargo is a first class citizen in ports:</p>
</blockquote>

<pre><code>USES= cargo
CARGO_CRATES= aho-corasick-0.6.3 \
              atty-0.2.3 \
              # and so goes on
</code></pre>

<blockquote>
<p>Yes, you have to specify each dependency. Luckily, there is a magic awk script that turns Cargo.lock into what you need. Execute make cargo-crates in the port root. This will fail because you&#39;re missing checksum for the original source files:</p>
</blockquote>

<pre><code>make makesum
make cargo-crates
</code></pre>

<blockquote>
<p>This will give you what you need. Double check that result is correct. There is a way to ignore checksum error, but I cant remember Execute make makesum again.</p>
</blockquote>

<ul>
<li>CARGO_OUT</li>
</ul>

<blockquote>
<p>If. build.rs relies on that you have to change it. fd allows you to use SHELL_COMPLETIONS_DIR to specify where completions go, while ripgrep doesn&#39;t. In our case we just specify SHELL_COMPLETIONS_DIR:</p>
</blockquote>

<pre><code>SHELL_COMPLETIONS_DIR= ${WRKDIR}/shell-completions-dir CARGO_ENV= SHELL_COMPLETIONS_DIR=${SHELL_COMPLETIONS_DIR}
</code></pre>

<ul>
<li>PLIST</li>
</ul>

<blockquote>
<p>FreeBSD is very strict about files its installing and it wont allow you to install random files that get lost. You have to specify which files youre installing. In this case, its just two:</p>
</blockquote>

<pre><code>PLIST_FILES= bin/fd \
             man/man1/fd.1.gz
</code></pre>

<blockquote>
<p>Note that sources for fd have uncompressed man file, while here its listed as compressed. If port installs a lot of files, specify them in pkg-plist like here. To actually install them:</p>
</blockquote>

<pre><code>post-install:
  @${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/fd
  ${INSTALL_MAN}${WRKSRC}/doc/fd.1 ${STAGEDIR}${MAN1PREFIX}/man/man1
</code></pre>

<ul>
<li>Shell completions</li>
</ul>

<blockquote>
<p>clap-rs can generate shell completions for you, it&#39;s usually handled by build.rs script. First, we need to define options:</p>
</blockquote>

<pre><code>OPTIONS_DEFINE= BASH FISH ZSH # list options
OPTIONS_DEFAULT= BASH FISH ZSH # select them by default
BASH_PLIST_FILES= etc/bash_completion.d/fd.bash-completion 
FISH_PLIST_FILES= share/fish/completions/fd.fish
ZSH_PLIST_FILES= share/zsh/site-functions/_fd
</code></pre>

<blockquote>
<p>To actually install them:</p>
</blockquote>

<pre><code>post-install-BASH-on:
 @${MKDIR} ${STAGEDIR}${PREFIX}/etc/bash_completion.d
 ${INSTALL_DATA} ${SHELL_COMPLETIONS_DIR}/fd.bash-completion \
 ${STAGEDIR}${PREFIX}/etc/bash_completion.d
post-install-FISH-on:
 @${MKDIR} ${STAGEDIR}${PREFIX}/share/fish/completions
 ${INSTALL_DATA} ${SHELL_COMPLETIONS_DIR}/fd.fish \
 ${STAGEDIR}${PREFIX}/share/fish/completions
post-install-ZSH-on:
 @${MKDIR} ${STAGEDIR}${PREFIX}/share/zsh/site-functions
 ${INSTALL_DATA} ${SHELL_COMPLETIONS_DIR}/_fd \
 ${STAGEDIR}${PREFIX}/share/zsh/site-functions
</code></pre>

<ul>
<li>Bonus round - Patching source code</li>
</ul>

<blockquote>
<p>Sometimes you have to patch it and send the patch upstream. Merging it upstream can take awhile, so you can patch it as part of the install process. An easy way to do it:</p>
</blockquote>

<ul>
<li> Go to work/ dir</li>
<li>Copy file you want to patch and add .orig suffix to it</li>
<li>Edit file you want to patch</li>
<li><p>Execute make makepatch in port&#39;s root</p></li>
<li><p>Submitting port</p></li>
</ul>

<blockquote>
<p>First, make sure portlint -AC doesn&#39;t give you any errors or warnings. Second, make sure poudriere can build it on both amd64 and i386. If it can&#39;t??you have to either fix it or mark port broken for that arch.<br>
Follow this steps like I did steps. If you have any issues you can always ask your question in freebsd-ports on freenode try to find your answer in porters handbook before asking.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsdfoundation.org/blog/conference-recap-eurobsdcon-2017-recap/" rel="nofollow">Conference Recap: EuroBSDCon 2017 Recap</a></h3>

<blockquote>
<p>The location was wonderful and I loved sneaking out and exploring the city when I could. From what I heard, it was the largest BSD conference in history, with over 320 attendees!<br>
Each venue is unique and draws many local BSD enthusiasts, who normally wouldnt be able to travel to a conference. I love having the chance to talk to these people about how they are involved in the projects and what they would like to do. Most of the time, they are asking me questions about how they can get more involved and how we can help.<br>
<em>Magical</em> is how I would describe the conference social event. To stand in front of the dinner cruise on the Seine, with the Eiffel Tower standing tall, lit up in the night, while working  talking to our community members, was incredible. But, let me start at the beginning.<br>
We attend these conferences to talk to our community members, to find out what they are working on, determine technologies that should be supported in FreeBSD, and what we can do to help and improve FreeBSD.<br>
We started the week with a half-day board meeting on Wednesday. BSD conferences give us a chance to not only meet with community members around the world, but to have face-to-face meetings with our team members, who are also located around the world. We worked on refining our strategic direction and goals, determining what upcoming conferences we want FreeBSD presence at and who can give FreeBSD talks and workshops there, discussed current and potential software development projects, and discussed how we can help raise awareness about and increase the use of FreeBSD in Europe.<br>
Thursday was the first day of the FreeBSD developer summit, led by our very own Benedict Reuschling. He surprised us all by having us participate in a very clever quiz on France. 45 of us signed into the software, where hed show the question on the screen and we had a limited amount of time to select our answers, with the results listed on the screen. It was actually a lot of fun, especially since they didnt publicize the names of the people who got the questions wrong. The lucky or most knowledgeable person on France, was <a href="mailto:des@freebsd.org" rel="nofollow">des@freebsd.org</a>.<br>
Some of our board members ran tutorials in parallel to the summit. Kirk McKusick gave his legendary tutorial,  An Introduction to the FreeBSD Open-Source Operating System , George Neville-Neil gave his tutorial, DTrace for Developers, and Benedict Reuschling gave a tutorial on, Managing BSD systems with Ansible.<br>
I was pleased to have two chairs from ACM-W Europe run an Increasing Diversity in the BSDs BoF for the second year in a row. We broke up into three groups to discuss different gender bias situations, and what we can do to address these types of situations, to make the BSD projects more diverse, welcoming, and inclusive. At the end, people asked that we continue these discussions at future BSD conferences and suggested having an expert in the field give a talk on how to increase the diversity in our projects.<br>
As I mentioned earlier, the social dinner was on a boat cruising along the Seine. I had a chance to talk to community members in a more social environment. With the conference being in France, we had a lot of first time attendees from France. I enjoyed talking to many of them, as well as other people I only get to see at the European conferences. Sunday was full of more presentations and conversations. During the closing session, I gave a short talk on the Foundation and the work we are doing. Then, Benedict Reuschling, Board Vice President, came up and gave out recognition awards to four FreeBSD contributors who have made an impact on the Project.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://chown.me/blog/playing-with-the-pine64.html" rel="nofollow">Playing with the pine64</a></h3>

<ul>
<li>Daniel Jakots writes in his blog about his experiences with his two pine64 boards: </li>
</ul>

<blockquote>
<p>Finding something to install on it<br>
6 weeks ago, I ordered two pine64 units. I didn&#39;t (and still don&#39;t) have much plan for them, but I wanted to play with some cheap boards. I finally received them this week. Initially I wanted to install some Linux stuff on it, I didn&#39;t have much requirement so I thought I would just look what seems to be easy and/or the best supported systemd flavour. I headed over their wiki. Everything seems either not really maintained, done by some random people or both. I am not saying random people do bad things, just that installing some random things from the Internet is not really my cup of tea.<br>
I heard about <a href="https://www.armbian.com/pine64/" rel="nofollow">Armbian</a> but the server flavour seems to be experimental so I got scared of it. And sadly, the whole things looks like to be alot undermanned.<br>
So I went for OpenBSD because I know the stuff and who to har<sup>Wkindly</sup> ask for help. Spoiler alert, it&#39;s boring because it just works.</p>
</blockquote>

<ul>
<li>Getting OpenBSD on it</li>
</ul>

<blockquote>
<p>I downloaded miniroot62.fs, dd&#39;ed it on the micro SD card. I was afraid I&#39;d need to fiddle with some things like sysutils/dtb because I don&#39;t know what I would have needed to do. That&#39;s because I don&#39;t know what it does and for this precise reason I was wrong and I didn&#39;t need to do anything. So just dd the miniroot62.fs and you can go to next checkpoint.<br>
I plugged an HDMI cable, ethernet cable and the power, it booted, I could read for 10 seconds but then it got dark. Of course it&#39;s because you need a serial console. Of course I didn&#39;t have one.<br>
I thought about trying to install OpenBSD blindly, I could have probably succeeded with autoinstall buuuuuut<br>
Following some good pieces of advice from OpenBSD people I bought some cp2102 (I didn&#39;t try to understand what it was or what were the other possibilities, I just wanted something that would work :D).<br>
I looked how to plug the thing. It appears you can plug it on two different places but if you plug it on the Euler bus it could power a bit the board so if you try to reboot it, it would then mess with the power disruption and could lead a unclean reboot.<br>
You just need to plug three cables: GND, TXD and RXD. Of course, the TXD goes on the RXD pin from the picture and the RXD goes on the TXD pin. Guess why I&#39;m telling you that! </p>
</blockquote>

<ul>
<li>That&#39;s it</li>
<li>Then you can connect with the usual</li>
</ul>

<blockquote>
<p>$ cu -dl /dev/cuaU0 -s 115200</p>

<hr>
</blockquote>

<h3><a href="http://blog.frankleonhardt.com/2017/whats-the-point-of-docker-on-freebsd-or-solaris/" rel="nofollow">Whats the point of Docker on FreeBSD or Solaris?</a></h3>

<blockquote>
<p>Penguinisters are very keen on their docker, but for the rest of us it may be difficult to see what the fuss is all about  its only been around a few years and everyones talking about it. And someone asked again today. What are we missing?<br>
Well docker is a solution to a Linux (and Windows) problem that FreeBSD/Solaris doesnt have. Until recently, the Linux kernel only implemented the original user isolation model involving chroot. More recent kernels have had Control Groups added, which are intended to provide isolation for a group of processes (namespaces). This came out of Google, and theyve extended to concept to include processor resource allocation as one of the knobs, which could be a good idea for FreeBSD. The scheduler is aware of the JID of the process its about to schedule, and I might take a look in the forthcoming winter evenings. But I digress.<br>
So if isolation (containerisation in Linux terms) is in the Linux kernel, what is Docker bringing to the party? The only thing I can think of is standardisation and an easy user interface (at the expense of having Python installed). You might think of it in similar terms to ezjail  a complex system intended to do something that is otherwise very simple.<br>
To make a jail in FreeBSD all you need do is copy the files for your system  to a directory. This can even be a whole servers system disk if you like, and jails can run inside jails.  You then create a very simple config file, giving the jail a name, the path to your files and an what IP addresses to pass through (if any) and youre done. Just type service jail nameofjal start, and off it goes.<br>
Is there any advantage in running Docker? Well, in a way, there is. Docker has a repository of system images that you can just install and run, and this is what a lot of people want. Theyre a bit like virtual appliances, but not mind-numbingly inefficient.<br>
You can actually run docker on FreeBSD. A port was done a couple of years ago, but it relies on the 64-bit Linux emulation that started to appear in 10.x. The newer the version of FreeBSD the better.<br>
Docker is in ports/sysutils/docker-freebsd. It makes uses of jails instead of Linux cgroups, and requires ZFS rather than UFS for file system isolation. I believe the Linux version uses Union FS but I could be completely wrong on that.<br>
The FreeBSD port works with the Docker hub repository, giving you access to thousands of pre-packaged system images to play with. And thats about as far as Ive ever tested it. If you want to run the really tricky stuff (like Windows) you probably want full hardware emulation and something like  Xen. If you want to deploy or migrate FreeBSD or Solaris systems, just copy a new tarball in to the directory and go. Its a non-problem, so why make it more complicated?<br>
Given the increasing frequency Docker turns up in conversations, its probably worth taking seriously as Linux applications get packaged up in to images for easy access. Jails/Zones may be more efficient, and Docker images are limited to binary, but convenience tends to win in many environments.</p>

<hr>
</blockquote>

<h3><a href="http://www.vincentdelft.be/post/post_20171023" rel="nofollow">Network Manager Control for OpenBSD</a></h3>

<blockquote>
<p>I propose you a small script allowing you to easily manage your networks connections. This script is integrated within the openbox dynamic menus. Moreover, it allow you to automatically have the connections you have pre-defined based.<br>
I was frustrated to not be able to swap quickly from one network interface to an another, to connect simply and quickly to my wifi, to my cable connection, to the wifi of a friend, ... <br>
Every time you have to type the ifconfig commands, .... This is nice, but boring. Surely, when you are in a middle of a presentation and you just want a quick connection to your mobile in tethering mode.<br>
Thanks to OpenBSD those commands are not so hard, but this frustrate me to not be able to do it with one click. Directly from my windows environment. Since I&#39;m using Openbox, from a menu of openbox.<br>
So, I&#39;ve looked around to see what is currently existing. <br>
One tool I&#39;ve found was <a href="https://github.com/akpoff/netctl" rel="nofollow">netctl</a>. The idea is to have a repository of hostname.if files ready to use for different cases. <br>
The idea sounds great, but I had some difficulties to use it. <br>
But what annoys me the most, is that it modify the current hostname.if files in /etc. <br>
To my eyes, I would avoid to modify those files because they are my working basis. I want to rely on them and make sure that my network will be back to a normal mode after a reboot. <br>
Nevertheless, if I&#39;ve well understood netctl, you have a feature where it will look for the predefined network config matching the environment where you are. Very cool.<br>
So, after having played with netctl, look for alternative on internet, I&#39;ve decided to create nmctl. A small python script which just perform the mandatory network commands.</p>
</blockquote>

<ul>
<li>1. nmctl: a Network Manager Control tool for OpenBSD</li>
</ul>

<blockquote>
<p>Nmctl a small tool that allow you to manage your network connections. <br>
Why python ? Just because it&#39;s the easiest programming language for me. But I should maybe rewrite it in shell, more standard in the OpenBSD world than python.</p>
</blockquote>

<ul>
<li>1.1. download and install</li>
</ul>

<blockquote>
<p>I&#39;ve put nmctl on my sourceforge account <a href="https://sourceforge.net/p/nmctl/code/ci/master/tree/" rel="nofollow">here</a><br>
You can dowload the last version <a href="https://sourceforge.net/p/nmctl/code/ci/master/tarball" rel="nofollow">here</a><br>
To install you just have to run: make install (as root)<br>
The per-requists are:</p>

<ul>
<li>having python2.7 installed</li>
<li>Since nmctl must be run as root, I strongly recommend you to run it via <a href="http://man.openbsd.org/doas.conf.5" rel="nofollow">doas</a>.</li>
</ul>
</blockquote>

<ul>
<li>1.2. The config file</li>
</ul>

<blockquote>
<p>First you have to create a config and store it in /etc/nmctl.conf. <br>
This file must respect few rules:<br>
Each block must starts with a line having the following format: &#39;&#39;&#39;&lt;-name-&gt;:&lt;-interface-&gt;&#39;&#39;&#39;<br>
Each following lines must start by at least one space. Those lines have more or less the same format as for hostname.if.<br>
You have to create a block with the name &quot;open&quot;. This will be used to establish a connection to the Open Wifi around you (in restaurant for example)<br>
The order of those elements is important. In case you use the -restart option, nmctl will try each of those network configs one after one until it can ping <a href="http://www.google.com" rel="nofollow">www.google.com</a>. (if you wan to ping something else, you can change it in the python script if you want).<br>
You can use external commands. Just preced them with the &quot;!&quot;.<br>
You have macors. Macros allow you to perform some actions. The 2 currently implemented are &#39;&#39;&#39;&lt;-nwid-&gt;&#39;&#39;&#39; and &#39;&#39;&#39;&lt;-random mac-&gt;&#39;&#39;&#39;.<br>
You can use keywords. Currently the only one implemented is &quot;dhcp&quot;<br>
Basically you can put all commands that nmctl will apply to the interface to which those commands are referring to. So, you will always have &quot;ifconfig &lt;-interface-&gt; &lt;-command you type in the config file-&gt;&quot;. <br>
Check the manpage of ifconfig to see how flexible command is.<br>
You have currently 2 macros:</p>

<ul>
<li>&lt;-nwid-&gt; which refers to the &quot;nwid &lt;-nwid name-&gt;&quot; when you select an Open Wifi with the -open option of nmctl.</li>
<li>&lt;-random mac-&gt; is a macro generating a random mac address. This is useful test a dhcp server for example.</li>
</ul>

<p>The keyword &quot;dhcp&quot; will trigger a command like &quot;dhclient &lt;-interface-&gt;&quot;.</p>
</blockquote>

<ul>
<li>1.3. Config file sample.</li>
</ul>

<blockquote>
<p>Let me show you one nmctl.conf example. It speaks by itself.</p>
</blockquote>

<pre><code>
&amp;#35; the name open is required for Open wifi. 
&amp;#35; this is the interface that nmctl will take to establish a connection
&amp;#35; We must put the macro &lt;nwid&gt;. This is where nmctl will put the nwid command
&amp;#35; and the selected openwifi selected by the parameter --open

open:iwn0
 !route flush
 &lt;nwid&gt; -wpa
 dhcp

cable:em0
 !route flush
 dhcp

lgg4:iwn0
 !route flush
 nwid LGG4s_8114 wpakey aanotherpassword
 dhcp

home:iwn0
 !route flush
 nwid Linksys19594 wpakey apassword
 dhcp

college:iwn0
 !route flush
 nwid john wpakey haahaaaguessme
 dhcp

cable_fixip:em0
 !route flush
 inet 192.168.3.3 netmask 255.255.255.0
 !route add -host default 192.168.3.1

&amp;#35; with this network interface I&#39;m using the macro &lt;random mac&gt; 
&amp;#35; which will do what you guess it will do :-)
cable_random:em0
 !route flush
 lladdr &lt;random mac&gt;
 dhcp

</code></pre>

<blockquote>
<p>In this config we have several cable&#39;s networks associated with my interface &quot;em0&quot; and several wifi networks associated with my wireless interface &quot;iwn0&quot;.<br>
You see that you can switch from dhcp, to fixed IP and even you can play with the random mac address macro.<br>
Thanks to the network called &quot;open&quot;, you can connect to any open wifi system. To do that, just type &#39;&#39;&#39; nmctl --open &lt;-name of the open wifi-&gt;&#39;&#39;&#39;<br>
So, now, with just one command you can switch from one network configuration to an another one. <br>
That&#39;s become cool :-).</p>
</blockquote>

<ul>
<li>2. Integration with openbox</li>
</ul>

<blockquote>
<p>Thanks to the dynamic menu feature of oenbox[sic], you can have your different pre-defined networks under one click of your mouse.<br>
For that, you just have to add, at the most appropriate place for you, the following code in your ./config/openbox/menu.xml</p>
</blockquote>

<pre><code>&lt;menu id=&quot;network-menu&quot; label=&quot;Network&quot;&gt;
  &lt;menu id=&quot;wifi-list&quot; label=&quot;Wifi configured&quot;  execute=&quot;doas /usr/local/bin/nmctl --list&quot; /&gt;
  &lt;menu id=&quot;wifi-scan&quot; label=&quot;Wifi scan&quot;  execute=&quot;doas /usr/local/bin/nmctl --scan&quot; /&gt;
  &lt;separator /&gt;
</code></pre>

<blockquote>
<p>In this case, you see the different networks as defined in the config file just above.</p>
</blockquote>

<ul>
<li>3. Automatically identify your available connection and connect to it in one go</li>
</ul>

<blockquote>
<p>But the most interesting part, is coming from a loop through all of your defined networks. <br>
This loop is reachable via the -restart option.<br>
Basically the idea is to loop from the first network config to the last and test a ping for each of them. Once the ping works, we break the loop and keep this setting.<br>
Thus where ever you are, you just have to initiate a nmctl -restart and you will be connected to the network you have defined for this place. There is one small exception, the open-wifis. We do not include them in this loop exercise.<br>
Thus the way you define your config file is important. <br>
Since the network called &quot;open&quot; is dedicated to &quot;open wifi&quot;, it will not be part of this scan exercise. I propose you keep it at the first place.<br>
Then, in my case, if my mobile, called lgg4, is open and visible by my laptop, I will connect it immediately. <br>
Second, I check if my &quot;home wifi&quot; is visible. <br>
Third, if I have a cable connected on my laptop, I&#39;m using this connection and do a dhcp command. <br>
Then, I check to see if my laptop is not viewing the &quot;college&quot; wifi. <br>
? and so on until a ping command works.<br>
If you do not have a cable in your laptop and if none of your pre-defined wifi connections are visible, the scan will stop.</p>
</blockquote>

<ul>
<li>3.1 examples</li>
</ul>

<blockquote>
<p>No cable connected, no pre-defined wifi around me:</p>
</blockquote>

<pre><code>t420:~$ time doas nmctl -r 
nwids around you:  bbox2-d954
    0m02.97s real     0m00.08s user     0m00.11s system
t420:~$ 
t420:~$
</code></pre>

<blockquote>
<p>I&#39;m at home and my wifi router is running:</p>
</blockquote>

<pre><code>t420:~$ time doas nmctl -r 
nwids around you:  Linksys19594 bbox2-d954
ifconfig em0 down: 0
default              fw                   done
fw                   00:22:4d:ac:30:fd    done
nas                  link#2               done
route flush: 0
ifconfig iwn0 nwid Linksys19594  ...: 0
iwn0: no link ........... sleeping
dhclient iwn0: 0
Done.
PING www.google.com (216.58.212.164): 56 data bytes
64 bytes from 216.58.212.164: icmp_seq=0 ttl=52 time=12.758 ms

--- www.google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 12.758/12.758/12.758/0.000 ms
ping -c1 -w2 www.google.com: 0
    0m22.49s real     0m00.08s user     0m00.11s system
t420:~$
</code></pre>

<blockquote>
<p>I&#39;m at home but tethering is active on my mobile:</p>
</blockquote>

<pre><code>t420:~$ 
t420:~$ time doas nmctl -r 
nwids around you:  Linksys19594 bbox2-d954 LGG4s_8114
ifconfig em0 down: 0
default              fw                   done
fw                   00:22:4d:ac:30:fd    done
nas                  link#2               done
route flush: 0
ifconfig iwn0 nwid LGG4s_8114  ...: 0
iwn0: DHCPDISCOVER - interval 1
iwn0: DHCPDISCOVER - interval 2
iwn0: DHCPOFFER from 192.168.43.1 (a0:91:69:be:10:49)
iwn0: DHCPREQUEST to 255.255.255.255
iwn0: DHCPACK from 192.168.43.1 (a0:91:69:be:10:49)
iwn0: bound to 192.168.43.214 -- renewal in 1800 seconds
dhclient iwn0: 0
Done.
ping: Warning: www.google.com has multiple addresses; using 173.194.69.99
PING www.google.com (173.194.69.99): 56 data bytes
64 bytes from 173.194.69.99: icmp_seq=0 ttl=43 time=42.863 ms

--- www.google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 42.863/42.863/42.863/0.000 ms
ping -c1 -w2 www.google.com: 0
    0m13.78s real     0m00.08s user     0m00.13s system
t420:~$
</code></pre>

<blockquote>
<p>Same situation, but I cut the tethering just after the scan. Thus the dhcp command will not succeed. <br>
We see that, after timeouts, nmctl see that the ping is failing (return code 1), thus he pass to the next possible pre-defined network.</p>
</blockquote>

<pre><code>t420:~$ time doas nmctl -r 
nwids around you:  Linksys19594 bbox2-d954 LGG4s_8114
ifconfig em0 down: 0
default              192.168.43.1         done
192.168.43.1         a0:91:69:be:10:49    done
route flush: 0
ifconfig iwn0 nwid LGG4s_8114  ...: 0
iwn0: no link ........... sleeping
dhclient iwn0: 0
Done.
ping: no address associated with name
ping -c1 -w2 www.google.com: 1
ifconfig em0 down: 0
192.168.43.1         link#2               done
route flush: 0
ifconfig iwn0 nwid Linksys19594  ...: 0
iwn0: DHCPREQUEST to 255.255.255.255
iwn0: DHCPACK from 192.168.3.1 (00:22:4d:ac:30:fd)
iwn0: bound to 192.168.3.16 -- renewal in 302400 seconds
dhclient iwn0: 0
Done.
PING www.google.com (216.58.212.164): 56 data bytes
64 bytes from 216.58.212.164: icmp_seq=0 ttl=52 time=12.654 ms

--- www.google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 12.654/12.654/12.654/0.000 ms
ping -c1 -w2 www.google.com: 0
    3m34.85s real     0m00.17s user     0m00.20s system
t420:~$
</code></pre>

<hr>

<h3><a href="https://www.c0ffee.net/blog/openvpn-guide" rel="nofollow">OpenVPN Setup Guide for FreeBSD</a></h3>

<ul>
<li>OpenVPN Setup Guide

<ul>
<li>Browse securely from anywhere using a personal VPN with OpenVPN, LDAP, FreeBSD, and PF.</li>
</ul></li>
</ul>

<blockquote>
<p>A VPN allows you to securely extend a private network over the internet via tunneling protocols and traffic encryption. For most people, a VPN offers two primary features: (1) the ability to access services on your local network over the internet, and (2) secure internet connectivity over an untrusted network. In this guide, I&#39;ll describe how to set up a personal VPN using OpenVPN on FreeBSD. The configuration can use both SSL certificates and LDAP credentials for authentication. We&#39;ll also be using the PF firewall to NAT traffic from our VPN out to the internet.<br>
One important note about running your own VPN: since you are most likely hosting your server using a VPS or hosting provider, with a public IP address allocated specifically to you, your VPN will not give you any extra anonymity on the internet. If anything, you&#39;ll be making yourself more of a target, since all your activity can be trivially traced back to your server&#39;s IP address. So while your VPN will protect you from a snooping hacker on the free WiFi at Starbucks, it won&#39;t protect you from a federal investigation.<br>
This guide assumes you are running FreeBSD with the PF firewall. If you&#39;re using a different Unix flavor, I&#39;ll probably get you most of the way therebut you&#39;ll be on your own when configuring your firewall and networking.<br>
Finally, I&#39;ve used example.com and a non-routable public IP address for all the examples in this guide. You&#39;ll need to replace them with your own domain name and public IP address.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/channel/UCuQhwHMJ0yK2zlfyRr1XZ_Q/feed" rel="nofollow">BSDCan 2017 videos</a></li>
<li><a href="https://www.openbsd.org/papers/eurobsdcon2017-device-drivers.pdf" rel="nofollow">Getting started with OpenBSD device driver development PDF</a></li>
<li><a href="https://macfoo.wordpress.com/2017/10/27/aws-cloudwatch-logs-agent-for-freebsd/" rel="nofollow">AWS CloudWatch Logs agent for FreeBSD</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/november-2017-development-projects-update/" rel="nofollow">FreeBSD Foundation November 2017 Development Projects Update</a></li>
<li><a href="https://fosdem.org/2018/schedule/track/bsd/" rel="nofollow">Schedule for the BSD Devroom at FOSDEM 2018</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Matt - <a href="http://dpaste.com/35VNXR5#wrap" rel="nofollow">The show and Cantrill</a></li>
<li>Paulo - <a href="http://dpaste.com/17E9Z2W#wrap" rel="nofollow">FreeBSD Question</a></li>
<li>Steven - <a href="http://dpaste.com/1N6F0TC#wrap" rel="nofollow">Virtualization under FreeBSD</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Picking a compiler for debuggability, how to port Rust apps to FreeBSD, what the point of Docker is on FreeBSD/Solaris, another EuroBSDcon recap, and network manager control in OpenBSD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://backtrace.io/blog/compile-once-debug-twice-picking-a-compiler-for-debuggability-1of3/" rel="nofollow">Compile once, Debug twice: Picking a compiler for debuggability, part 1 of 3</a></h3>

<ul>
<li>An interesting look into why when you try to debug a crash, you can often find all of the useful information has been optimized out</li>
</ul>

<blockquote>
<p>Have you ever had an assert get triggered only to result in a useless core dump with missing variable information or an invalid callstack?<br>
Common factors that go into selecting a C or C++ compiler are: availability, correctness, compilation speed and application performance. A factor that is often neglected is debug information quality, which symbolic debuggers use to reconcile application executable state to the source-code form that is familiar to most software engineers.<br>
When production builds of an application fail, the level of access to program state directly impacts the ability for a software engineer to investigate and fix a bug. If a compiler has optimized out a variable or is unable to express to a symbolic debugger how to reconstruct the value of a variable, the engineers investigation process is significantly impacted. Either the engineer has to attempt to recreate the problem, iterate through speculative fixes or attempt to perform prohibitively expensive debugging, such as reconstructing program state through executable code analysis.<br>
Debug information quality is in fact not proportionally related to the quality of the generated executable code and wildly varies from compiler to compiler.<br>
Different compilers emit debug information at varying levels of quality and accuracy. However, certain optimizations will certainly impact any debuggers ability to generate accurate stack traces or extract variable values. <br>
In the above program, the value of argv is extracted and then the program is paused. The ck_pr_load_ptr function performs a read from the region of memory pointed to by argv, in a manner that prevents the compiler from performing optimization on it. This ensures that the memory access occurs and for this reason, the value of argv must be accessible by the time ck_pr_load_ptr is executed.<br>
When compiled with gcc, the debugger fails to find the value of the variable. The compiler determines that the value of argv is no longer needed after the ck_pr_load_ptr operation and so doesnt bother paying the cost of saving the value.<br>
Some optimizations generate executable code whose call stack cannot be sufficiently disambiguated to reconcile a call stack that mirrors that of the source program. Two common culprits for this are tail call optimization and basic block commoning.</p>
</blockquote>

<ul>
<li>In another example</li>
</ul>

<blockquote>
<p>If the program receives a first argument of 1, then function is called with the argument of &quot;a&quot;. If the program receives a first argument of 2, then function is called with the argument of &quot;b&quot;. However, if we compile this program with clang, the stack traces in both cases are identical! clang informs the debugger that the function f invoked the function(&quot;b&quot;) branch where x = 2 even if x = 1.<br>
Though some optimizations will certainly impact the accuracy of a symbolic debugger, some compilers simply lack the ability to generate debug information in the presence of certain optimizations. One common optimization is induction variable elimination. A variable thats incremented or decremented by a constant on every iteration of a loop or derived from another variable that follows this pattern, is an induction variable.<br>
Coupled with other optimizations, the compiler is then able to generate code that doesnt actually rely on a dedicated counter variable i for maintaining the current offset into buffer.<br>
As you can see, i is completely optimized out. The compiler determines it doesnt have to pay the cost of maintaining the induction variable i. It maintains the pointer in the register %rdi. The code is effectively rewritten to something closer to this:</p>
</blockquote>

<ul>
<li>So the for loop, changes into a while loop, with a condition of the end of the input</li>
</ul>

<blockquote>
<p>We have shown some common optimizations that may get in the way of the debuggability of your application and demonstrated a disparity in debug information quality across two popular compilers. In the next blog post of this series, we will examine how gcc and clang stack up with regards to debug information quality across a myriad of synthetic applications and real world applications.</p>
</blockquote>

<ul>
<li>Looking forward to part 2
***</li>
</ul>

<h3><a href="https://medium.com/@andoriyu/this-is-how-you-can-port-your-rust-application-to-freebsd-7d3e9f1bc3df" rel="nofollow">This is how you can port your rust application to FreeBSD</a></h3>

<ul>
<li>This is how you can port your rust application to FreeBSD</li>
</ul>

<blockquote>
<p>The FreeBSD Ports Collection is the way almost everyone installs applications (ports) on FreeBSD. Like everything else about FreeBSD, it is primarily a volunteer effort. It is important to keep this in mind when reading this document.<br>
In FreeBSD, anyone may submit a new port, or volunteer to maintain an existing unmaintained port. No special commit privilege is needed.<br>
For this guide I will use fd tool written by David Peter as example project.</p>
</blockquote>

<ul>
<li><p>Prerequisites</p>

<ul>
<li>FreeBSD installation (VM is fine)</li>
<li>Local ports tree (done via svn)</li>
<li>portlint (located at devel/portlint)</li>
<li>poudriere (located at ports-mgmt/poudriere)[optional]</li>
</ul></li>
<li><p>Getting ports tree</p>

<ul>
<li>When you install FreeBSD opt-out of the ports tree. Install svn:</li>
</ul></li>
</ul>

<pre><code>pkg install svn
svn checkout https://svn.freebsd.org/ports/head /usr/ports
</code></pre>

<ul>
<li>Poudriere</li>
</ul>

<blockquote>
<p>Sometimes you might get asked to show poudriere build log, sometimes you wont. Its good to have anyway. If you choose to use poudriere, use ZFS. There are plenty of guides on the subject. FreeBSD Porters Handbook is the most complete source of information on porting to FreeBSD.</p>
</blockquote>

<ul>
<li>Makefile</li>
</ul>

<blockquote>
<p>Whole porting process in most cases is writing one Makefile. I recommend doing something like this.<br>
Here is the one I wrote for fd:</p>
</blockquote>

<ul>
<li>Port metadata</li>
</ul>

<blockquote>
<p>Each port must have one primary category in case of fd it will be sysutils, therefore it&#39;s located in /usr/ports/systuils/fd.</p>
</blockquote>

<pre><code>PORTNAME= fd
CATEGORIES= sysutils
</code></pre>

<blockquote>
<p>Since this port conflicts with other util named fd I specified package suffix as: PKGNAMESUFFIX= -find and indicate conflict: CONFLICTS_INSTALL= fd-[0-9]*. That means to install it from packages user will have to type:</p>
</blockquote>

<pre><code>pkg install fd-find
</code></pre>

<ul>
<li>Licenses</li>
</ul>

<blockquote>
<p>This section is different for every port, but in case of fd it&#39;s pretty straightforward:</p>
</blockquote>

<pre><code>LICENSE= MIT APACHE20
LICENSE_COMB= dual
</code></pre>

<blockquote>
<p>Since fd includes the text of licenses you should do this as well:</p>
</blockquote>

<pre><code>LICENSE_FILE_MIT= ${WRKSRC}/LICENSE-MIT
LICENSE_FILE_APACHE20= ${WRKSRC}/LICENSE-APACHE
</code></pre>

<ul>
<li>Distfiles</li>
</ul>

<blockquote>
<p>FreeBSD has a requirement that all ports must allow offline building. That means you have specified which files are needed to be downloaded. Luckily we now have helpers to download GitHub sources directly from GitHub:</p>
</blockquote>

<pre><code>USE_GITHUB= yes
GH_ACCOUNT= sharkdp
</code></pre>

<blockquote>
<p>Since PORTNANE is fd it will try to download sources for sharkdp/fd. By default it&#39;s going to download tag: </p>
</blockquote>

<pre><code>${DISTVERSIONPREFIX}${DISTVERSION}${DISTVERSIONSUFFIX}
</code></pre>

<blockquote>
<p>fd uses v as the prefix, therefore we need to specify: DISTVERSIONPREFIX= v.<br>
It&#39;s also possible to specify GH_TAGNAME in case tag name doesn&#39;t match that pattern.</p>
</blockquote>

<ul>
<li>Extra packages</li>
</ul>

<blockquote>
<p>There are very few rust projects that are standalone and use no crates dependencies. Its used to be PITA to make it work offline, but now cargo is a first class citizen in ports:</p>
</blockquote>

<pre><code>USES= cargo
CARGO_CRATES= aho-corasick-0.6.3 \
              atty-0.2.3 \
              # and so goes on
</code></pre>

<blockquote>
<p>Yes, you have to specify each dependency. Luckily, there is a magic awk script that turns Cargo.lock into what you need. Execute make cargo-crates in the port root. This will fail because you&#39;re missing checksum for the original source files:</p>
</blockquote>

<pre><code>make makesum
make cargo-crates
</code></pre>

<blockquote>
<p>This will give you what you need. Double check that result is correct. There is a way to ignore checksum error, but I cant remember Execute make makesum again.</p>
</blockquote>

<ul>
<li>CARGO_OUT</li>
</ul>

<blockquote>
<p>If. build.rs relies on that you have to change it. fd allows you to use SHELL_COMPLETIONS_DIR to specify where completions go, while ripgrep doesn&#39;t. In our case we just specify SHELL_COMPLETIONS_DIR:</p>
</blockquote>

<pre><code>SHELL_COMPLETIONS_DIR= ${WRKDIR}/shell-completions-dir CARGO_ENV= SHELL_COMPLETIONS_DIR=${SHELL_COMPLETIONS_DIR}
</code></pre>

<ul>
<li>PLIST</li>
</ul>

<blockquote>
<p>FreeBSD is very strict about files its installing and it wont allow you to install random files that get lost. You have to specify which files youre installing. In this case, its just two:</p>
</blockquote>

<pre><code>PLIST_FILES= bin/fd \
             man/man1/fd.1.gz
</code></pre>

<blockquote>
<p>Note that sources for fd have uncompressed man file, while here its listed as compressed. If port installs a lot of files, specify them in pkg-plist like here. To actually install them:</p>
</blockquote>

<pre><code>post-install:
  @${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/fd
  ${INSTALL_MAN}${WRKSRC}/doc/fd.1 ${STAGEDIR}${MAN1PREFIX}/man/man1
</code></pre>

<ul>
<li>Shell completions</li>
</ul>

<blockquote>
<p>clap-rs can generate shell completions for you, it&#39;s usually handled by build.rs script. First, we need to define options:</p>
</blockquote>

<pre><code>OPTIONS_DEFINE= BASH FISH ZSH # list options
OPTIONS_DEFAULT= BASH FISH ZSH # select them by default
BASH_PLIST_FILES= etc/bash_completion.d/fd.bash-completion 
FISH_PLIST_FILES= share/fish/completions/fd.fish
ZSH_PLIST_FILES= share/zsh/site-functions/_fd
</code></pre>

<blockquote>
<p>To actually install them:</p>
</blockquote>

<pre><code>post-install-BASH-on:
 @${MKDIR} ${STAGEDIR}${PREFIX}/etc/bash_completion.d
 ${INSTALL_DATA} ${SHELL_COMPLETIONS_DIR}/fd.bash-completion \
 ${STAGEDIR}${PREFIX}/etc/bash_completion.d
post-install-FISH-on:
 @${MKDIR} ${STAGEDIR}${PREFIX}/share/fish/completions
 ${INSTALL_DATA} ${SHELL_COMPLETIONS_DIR}/fd.fish \
 ${STAGEDIR}${PREFIX}/share/fish/completions
post-install-ZSH-on:
 @${MKDIR} ${STAGEDIR}${PREFIX}/share/zsh/site-functions
 ${INSTALL_DATA} ${SHELL_COMPLETIONS_DIR}/_fd \
 ${STAGEDIR}${PREFIX}/share/zsh/site-functions
</code></pre>

<ul>
<li>Bonus round - Patching source code</li>
</ul>

<blockquote>
<p>Sometimes you have to patch it and send the patch upstream. Merging it upstream can take awhile, so you can patch it as part of the install process. An easy way to do it:</p>
</blockquote>

<ul>
<li> Go to work/ dir</li>
<li>Copy file you want to patch and add .orig suffix to it</li>
<li>Edit file you want to patch</li>
<li><p>Execute make makepatch in port&#39;s root</p></li>
<li><p>Submitting port</p></li>
</ul>

<blockquote>
<p>First, make sure portlint -AC doesn&#39;t give you any errors or warnings. Second, make sure poudriere can build it on both amd64 and i386. If it can&#39;t??you have to either fix it or mark port broken for that arch.<br>
Follow this steps like I did steps. If you have any issues you can always ask your question in freebsd-ports on freenode try to find your answer in porters handbook before asking.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsdfoundation.org/blog/conference-recap-eurobsdcon-2017-recap/" rel="nofollow">Conference Recap: EuroBSDCon 2017 Recap</a></h3>

<blockquote>
<p>The location was wonderful and I loved sneaking out and exploring the city when I could. From what I heard, it was the largest BSD conference in history, with over 320 attendees!<br>
Each venue is unique and draws many local BSD enthusiasts, who normally wouldnt be able to travel to a conference. I love having the chance to talk to these people about how they are involved in the projects and what they would like to do. Most of the time, they are asking me questions about how they can get more involved and how we can help.<br>
<em>Magical</em> is how I would describe the conference social event. To stand in front of the dinner cruise on the Seine, with the Eiffel Tower standing tall, lit up in the night, while working  talking to our community members, was incredible. But, let me start at the beginning.<br>
We attend these conferences to talk to our community members, to find out what they are working on, determine technologies that should be supported in FreeBSD, and what we can do to help and improve FreeBSD.<br>
We started the week with a half-day board meeting on Wednesday. BSD conferences give us a chance to not only meet with community members around the world, but to have face-to-face meetings with our team members, who are also located around the world. We worked on refining our strategic direction and goals, determining what upcoming conferences we want FreeBSD presence at and who can give FreeBSD talks and workshops there, discussed current and potential software development projects, and discussed how we can help raise awareness about and increase the use of FreeBSD in Europe.<br>
Thursday was the first day of the FreeBSD developer summit, led by our very own Benedict Reuschling. He surprised us all by having us participate in a very clever quiz on France. 45 of us signed into the software, where hed show the question on the screen and we had a limited amount of time to select our answers, with the results listed on the screen. It was actually a lot of fun, especially since they didnt publicize the names of the people who got the questions wrong. The lucky or most knowledgeable person on France, was <a href="mailto:des@freebsd.org" rel="nofollow">des@freebsd.org</a>.<br>
Some of our board members ran tutorials in parallel to the summit. Kirk McKusick gave his legendary tutorial,  An Introduction to the FreeBSD Open-Source Operating System , George Neville-Neil gave his tutorial, DTrace for Developers, and Benedict Reuschling gave a tutorial on, Managing BSD systems with Ansible.<br>
I was pleased to have two chairs from ACM-W Europe run an Increasing Diversity in the BSDs BoF for the second year in a row. We broke up into three groups to discuss different gender bias situations, and what we can do to address these types of situations, to make the BSD projects more diverse, welcoming, and inclusive. At the end, people asked that we continue these discussions at future BSD conferences and suggested having an expert in the field give a talk on how to increase the diversity in our projects.<br>
As I mentioned earlier, the social dinner was on a boat cruising along the Seine. I had a chance to talk to community members in a more social environment. With the conference being in France, we had a lot of first time attendees from France. I enjoyed talking to many of them, as well as other people I only get to see at the European conferences. Sunday was full of more presentations and conversations. During the closing session, I gave a short talk on the Foundation and the work we are doing. Then, Benedict Reuschling, Board Vice President, came up and gave out recognition awards to four FreeBSD contributors who have made an impact on the Project.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://chown.me/blog/playing-with-the-pine64.html" rel="nofollow">Playing with the pine64</a></h3>

<ul>
<li>Daniel Jakots writes in his blog about his experiences with his two pine64 boards: </li>
</ul>

<blockquote>
<p>Finding something to install on it<br>
6 weeks ago, I ordered two pine64 units. I didn&#39;t (and still don&#39;t) have much plan for them, but I wanted to play with some cheap boards. I finally received them this week. Initially I wanted to install some Linux stuff on it, I didn&#39;t have much requirement so I thought I would just look what seems to be easy and/or the best supported systemd flavour. I headed over their wiki. Everything seems either not really maintained, done by some random people or both. I am not saying random people do bad things, just that installing some random things from the Internet is not really my cup of tea.<br>
I heard about <a href="https://www.armbian.com/pine64/" rel="nofollow">Armbian</a> but the server flavour seems to be experimental so I got scared of it. And sadly, the whole things looks like to be alot undermanned.<br>
So I went for OpenBSD because I know the stuff and who to har<sup>Wkindly</sup> ask for help. Spoiler alert, it&#39;s boring because it just works.</p>
</blockquote>

<ul>
<li>Getting OpenBSD on it</li>
</ul>

<blockquote>
<p>I downloaded miniroot62.fs, dd&#39;ed it on the micro SD card. I was afraid I&#39;d need to fiddle with some things like sysutils/dtb because I don&#39;t know what I would have needed to do. That&#39;s because I don&#39;t know what it does and for this precise reason I was wrong and I didn&#39;t need to do anything. So just dd the miniroot62.fs and you can go to next checkpoint.<br>
I plugged an HDMI cable, ethernet cable and the power, it booted, I could read for 10 seconds but then it got dark. Of course it&#39;s because you need a serial console. Of course I didn&#39;t have one.<br>
I thought about trying to install OpenBSD blindly, I could have probably succeeded with autoinstall buuuuuut<br>
Following some good pieces of advice from OpenBSD people I bought some cp2102 (I didn&#39;t try to understand what it was or what were the other possibilities, I just wanted something that would work :D).<br>
I looked how to plug the thing. It appears you can plug it on two different places but if you plug it on the Euler bus it could power a bit the board so if you try to reboot it, it would then mess with the power disruption and could lead a unclean reboot.<br>
You just need to plug three cables: GND, TXD and RXD. Of course, the TXD goes on the RXD pin from the picture and the RXD goes on the TXD pin. Guess why I&#39;m telling you that! </p>
</blockquote>

<ul>
<li>That&#39;s it</li>
<li>Then you can connect with the usual</li>
</ul>

<blockquote>
<p>$ cu -dl /dev/cuaU0 -s 115200</p>

<hr>
</blockquote>

<h3><a href="http://blog.frankleonhardt.com/2017/whats-the-point-of-docker-on-freebsd-or-solaris/" rel="nofollow">Whats the point of Docker on FreeBSD or Solaris?</a></h3>

<blockquote>
<p>Penguinisters are very keen on their docker, but for the rest of us it may be difficult to see what the fuss is all about  its only been around a few years and everyones talking about it. And someone asked again today. What are we missing?<br>
Well docker is a solution to a Linux (and Windows) problem that FreeBSD/Solaris doesnt have. Until recently, the Linux kernel only implemented the original user isolation model involving chroot. More recent kernels have had Control Groups added, which are intended to provide isolation for a group of processes (namespaces). This came out of Google, and theyve extended to concept to include processor resource allocation as one of the knobs, which could be a good idea for FreeBSD. The scheduler is aware of the JID of the process its about to schedule, and I might take a look in the forthcoming winter evenings. But I digress.<br>
So if isolation (containerisation in Linux terms) is in the Linux kernel, what is Docker bringing to the party? The only thing I can think of is standardisation and an easy user interface (at the expense of having Python installed). You might think of it in similar terms to ezjail  a complex system intended to do something that is otherwise very simple.<br>
To make a jail in FreeBSD all you need do is copy the files for your system  to a directory. This can even be a whole servers system disk if you like, and jails can run inside jails.  You then create a very simple config file, giving the jail a name, the path to your files and an what IP addresses to pass through (if any) and youre done. Just type service jail nameofjal start, and off it goes.<br>
Is there any advantage in running Docker? Well, in a way, there is. Docker has a repository of system images that you can just install and run, and this is what a lot of people want. Theyre a bit like virtual appliances, but not mind-numbingly inefficient.<br>
You can actually run docker on FreeBSD. A port was done a couple of years ago, but it relies on the 64-bit Linux emulation that started to appear in 10.x. The newer the version of FreeBSD the better.<br>
Docker is in ports/sysutils/docker-freebsd. It makes uses of jails instead of Linux cgroups, and requires ZFS rather than UFS for file system isolation. I believe the Linux version uses Union FS but I could be completely wrong on that.<br>
The FreeBSD port works with the Docker hub repository, giving you access to thousands of pre-packaged system images to play with. And thats about as far as Ive ever tested it. If you want to run the really tricky stuff (like Windows) you probably want full hardware emulation and something like  Xen. If you want to deploy or migrate FreeBSD or Solaris systems, just copy a new tarball in to the directory and go. Its a non-problem, so why make it more complicated?<br>
Given the increasing frequency Docker turns up in conversations, its probably worth taking seriously as Linux applications get packaged up in to images for easy access. Jails/Zones may be more efficient, and Docker images are limited to binary, but convenience tends to win in many environments.</p>

<hr>
</blockquote>

<h3><a href="http://www.vincentdelft.be/post/post_20171023" rel="nofollow">Network Manager Control for OpenBSD</a></h3>

<blockquote>
<p>I propose you a small script allowing you to easily manage your networks connections. This script is integrated within the openbox dynamic menus. Moreover, it allow you to automatically have the connections you have pre-defined based.<br>
I was frustrated to not be able to swap quickly from one network interface to an another, to connect simply and quickly to my wifi, to my cable connection, to the wifi of a friend, ... <br>
Every time you have to type the ifconfig commands, .... This is nice, but boring. Surely, when you are in a middle of a presentation and you just want a quick connection to your mobile in tethering mode.<br>
Thanks to OpenBSD those commands are not so hard, but this frustrate me to not be able to do it with one click. Directly from my windows environment. Since I&#39;m using Openbox, from a menu of openbox.<br>
So, I&#39;ve looked around to see what is currently existing. <br>
One tool I&#39;ve found was <a href="https://github.com/akpoff/netctl" rel="nofollow">netctl</a>. The idea is to have a repository of hostname.if files ready to use for different cases. <br>
The idea sounds great, but I had some difficulties to use it. <br>
But what annoys me the most, is that it modify the current hostname.if files in /etc. <br>
To my eyes, I would avoid to modify those files because they are my working basis. I want to rely on them and make sure that my network will be back to a normal mode after a reboot. <br>
Nevertheless, if I&#39;ve well understood netctl, you have a feature where it will look for the predefined network config matching the environment where you are. Very cool.<br>
So, after having played with netctl, look for alternative on internet, I&#39;ve decided to create nmctl. A small python script which just perform the mandatory network commands.</p>
</blockquote>

<ul>
<li>1. nmctl: a Network Manager Control tool for OpenBSD</li>
</ul>

<blockquote>
<p>Nmctl a small tool that allow you to manage your network connections. <br>
Why python ? Just because it&#39;s the easiest programming language for me. But I should maybe rewrite it in shell, more standard in the OpenBSD world than python.</p>
</blockquote>

<ul>
<li>1.1. download and install</li>
</ul>

<blockquote>
<p>I&#39;ve put nmctl on my sourceforge account <a href="https://sourceforge.net/p/nmctl/code/ci/master/tree/" rel="nofollow">here</a><br>
You can dowload the last version <a href="https://sourceforge.net/p/nmctl/code/ci/master/tarball" rel="nofollow">here</a><br>
To install you just have to run: make install (as root)<br>
The per-requists are:</p>

<ul>
<li>having python2.7 installed</li>
<li>Since nmctl must be run as root, I strongly recommend you to run it via <a href="http://man.openbsd.org/doas.conf.5" rel="nofollow">doas</a>.</li>
</ul>
</blockquote>

<ul>
<li>1.2. The config file</li>
</ul>

<blockquote>
<p>First you have to create a config and store it in /etc/nmctl.conf. <br>
This file must respect few rules:<br>
Each block must starts with a line having the following format: &#39;&#39;&#39;&lt;-name-&gt;:&lt;-interface-&gt;&#39;&#39;&#39;<br>
Each following lines must start by at least one space. Those lines have more or less the same format as for hostname.if.<br>
You have to create a block with the name &quot;open&quot;. This will be used to establish a connection to the Open Wifi around you (in restaurant for example)<br>
The order of those elements is important. In case you use the -restart option, nmctl will try each of those network configs one after one until it can ping <a href="http://www.google.com" rel="nofollow">www.google.com</a>. (if you wan to ping something else, you can change it in the python script if you want).<br>
You can use external commands. Just preced them with the &quot;!&quot;.<br>
You have macors. Macros allow you to perform some actions. The 2 currently implemented are &#39;&#39;&#39;&lt;-nwid-&gt;&#39;&#39;&#39; and &#39;&#39;&#39;&lt;-random mac-&gt;&#39;&#39;&#39;.<br>
You can use keywords. Currently the only one implemented is &quot;dhcp&quot;<br>
Basically you can put all commands that nmctl will apply to the interface to which those commands are referring to. So, you will always have &quot;ifconfig &lt;-interface-&gt; &lt;-command you type in the config file-&gt;&quot;. <br>
Check the manpage of ifconfig to see how flexible command is.<br>
You have currently 2 macros:</p>

<ul>
<li>&lt;-nwid-&gt; which refers to the &quot;nwid &lt;-nwid name-&gt;&quot; when you select an Open Wifi with the -open option of nmctl.</li>
<li>&lt;-random mac-&gt; is a macro generating a random mac address. This is useful test a dhcp server for example.</li>
</ul>

<p>The keyword &quot;dhcp&quot; will trigger a command like &quot;dhclient &lt;-interface-&gt;&quot;.</p>
</blockquote>

<ul>
<li>1.3. Config file sample.</li>
</ul>

<blockquote>
<p>Let me show you one nmctl.conf example. It speaks by itself.</p>
</blockquote>

<pre><code>
&amp;#35; the name open is required for Open wifi. 
&amp;#35; this is the interface that nmctl will take to establish a connection
&amp;#35; We must put the macro &lt;nwid&gt;. This is where nmctl will put the nwid command
&amp;#35; and the selected openwifi selected by the parameter --open

open:iwn0
 !route flush
 &lt;nwid&gt; -wpa
 dhcp

cable:em0
 !route flush
 dhcp

lgg4:iwn0
 !route flush
 nwid LGG4s_8114 wpakey aanotherpassword
 dhcp

home:iwn0
 !route flush
 nwid Linksys19594 wpakey apassword
 dhcp

college:iwn0
 !route flush
 nwid john wpakey haahaaaguessme
 dhcp

cable_fixip:em0
 !route flush
 inet 192.168.3.3 netmask 255.255.255.0
 !route add -host default 192.168.3.1

&amp;#35; with this network interface I&#39;m using the macro &lt;random mac&gt; 
&amp;#35; which will do what you guess it will do :-)
cable_random:em0
 !route flush
 lladdr &lt;random mac&gt;
 dhcp

</code></pre>

<blockquote>
<p>In this config we have several cable&#39;s networks associated with my interface &quot;em0&quot; and several wifi networks associated with my wireless interface &quot;iwn0&quot;.<br>
You see that you can switch from dhcp, to fixed IP and even you can play with the random mac address macro.<br>
Thanks to the network called &quot;open&quot;, you can connect to any open wifi system. To do that, just type &#39;&#39;&#39; nmctl --open &lt;-name of the open wifi-&gt;&#39;&#39;&#39;<br>
So, now, with just one command you can switch from one network configuration to an another one. <br>
That&#39;s become cool :-).</p>
</blockquote>

<ul>
<li>2. Integration with openbox</li>
</ul>

<blockquote>
<p>Thanks to the dynamic menu feature of oenbox[sic], you can have your different pre-defined networks under one click of your mouse.<br>
For that, you just have to add, at the most appropriate place for you, the following code in your ./config/openbox/menu.xml</p>
</blockquote>

<pre><code>&lt;menu id=&quot;network-menu&quot; label=&quot;Network&quot;&gt;
  &lt;menu id=&quot;wifi-list&quot; label=&quot;Wifi configured&quot;  execute=&quot;doas /usr/local/bin/nmctl --list&quot; /&gt;
  &lt;menu id=&quot;wifi-scan&quot; label=&quot;Wifi scan&quot;  execute=&quot;doas /usr/local/bin/nmctl --scan&quot; /&gt;
  &lt;separator /&gt;
</code></pre>

<blockquote>
<p>In this case, you see the different networks as defined in the config file just above.</p>
</blockquote>

<ul>
<li>3. Automatically identify your available connection and connect to it in one go</li>
</ul>

<blockquote>
<p>But the most interesting part, is coming from a loop through all of your defined networks. <br>
This loop is reachable via the -restart option.<br>
Basically the idea is to loop from the first network config to the last and test a ping for each of them. Once the ping works, we break the loop and keep this setting.<br>
Thus where ever you are, you just have to initiate a nmctl -restart and you will be connected to the network you have defined for this place. There is one small exception, the open-wifis. We do not include them in this loop exercise.<br>
Thus the way you define your config file is important. <br>
Since the network called &quot;open&quot; is dedicated to &quot;open wifi&quot;, it will not be part of this scan exercise. I propose you keep it at the first place.<br>
Then, in my case, if my mobile, called lgg4, is open and visible by my laptop, I will connect it immediately. <br>
Second, I check if my &quot;home wifi&quot; is visible. <br>
Third, if I have a cable connected on my laptop, I&#39;m using this connection and do a dhcp command. <br>
Then, I check to see if my laptop is not viewing the &quot;college&quot; wifi. <br>
? and so on until a ping command works.<br>
If you do not have a cable in your laptop and if none of your pre-defined wifi connections are visible, the scan will stop.</p>
</blockquote>

<ul>
<li>3.1 examples</li>
</ul>

<blockquote>
<p>No cable connected, no pre-defined wifi around me:</p>
</blockquote>

<pre><code>t420:~$ time doas nmctl -r 
nwids around you:  bbox2-d954
    0m02.97s real     0m00.08s user     0m00.11s system
t420:~$ 
t420:~$
</code></pre>

<blockquote>
<p>I&#39;m at home and my wifi router is running:</p>
</blockquote>

<pre><code>t420:~$ time doas nmctl -r 
nwids around you:  Linksys19594 bbox2-d954
ifconfig em0 down: 0
default              fw                   done
fw                   00:22:4d:ac:30:fd    done
nas                  link#2               done
route flush: 0
ifconfig iwn0 nwid Linksys19594  ...: 0
iwn0: no link ........... sleeping
dhclient iwn0: 0
Done.
PING www.google.com (216.58.212.164): 56 data bytes
64 bytes from 216.58.212.164: icmp_seq=0 ttl=52 time=12.758 ms

--- www.google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 12.758/12.758/12.758/0.000 ms
ping -c1 -w2 www.google.com: 0
    0m22.49s real     0m00.08s user     0m00.11s system
t420:~$
</code></pre>

<blockquote>
<p>I&#39;m at home but tethering is active on my mobile:</p>
</blockquote>

<pre><code>t420:~$ 
t420:~$ time doas nmctl -r 
nwids around you:  Linksys19594 bbox2-d954 LGG4s_8114
ifconfig em0 down: 0
default              fw                   done
fw                   00:22:4d:ac:30:fd    done
nas                  link#2               done
route flush: 0
ifconfig iwn0 nwid LGG4s_8114  ...: 0
iwn0: DHCPDISCOVER - interval 1
iwn0: DHCPDISCOVER - interval 2
iwn0: DHCPOFFER from 192.168.43.1 (a0:91:69:be:10:49)
iwn0: DHCPREQUEST to 255.255.255.255
iwn0: DHCPACK from 192.168.43.1 (a0:91:69:be:10:49)
iwn0: bound to 192.168.43.214 -- renewal in 1800 seconds
dhclient iwn0: 0
Done.
ping: Warning: www.google.com has multiple addresses; using 173.194.69.99
PING www.google.com (173.194.69.99): 56 data bytes
64 bytes from 173.194.69.99: icmp_seq=0 ttl=43 time=42.863 ms

--- www.google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 42.863/42.863/42.863/0.000 ms
ping -c1 -w2 www.google.com: 0
    0m13.78s real     0m00.08s user     0m00.13s system
t420:~$
</code></pre>

<blockquote>
<p>Same situation, but I cut the tethering just after the scan. Thus the dhcp command will not succeed. <br>
We see that, after timeouts, nmctl see that the ping is failing (return code 1), thus he pass to the next possible pre-defined network.</p>
</blockquote>

<pre><code>t420:~$ time doas nmctl -r 
nwids around you:  Linksys19594 bbox2-d954 LGG4s_8114
ifconfig em0 down: 0
default              192.168.43.1         done
192.168.43.1         a0:91:69:be:10:49    done
route flush: 0
ifconfig iwn0 nwid LGG4s_8114  ...: 0
iwn0: no link ........... sleeping
dhclient iwn0: 0
Done.
ping: no address associated with name
ping -c1 -w2 www.google.com: 1
ifconfig em0 down: 0
192.168.43.1         link#2               done
route flush: 0
ifconfig iwn0 nwid Linksys19594  ...: 0
iwn0: DHCPREQUEST to 255.255.255.255
iwn0: DHCPACK from 192.168.3.1 (00:22:4d:ac:30:fd)
iwn0: bound to 192.168.3.16 -- renewal in 302400 seconds
dhclient iwn0: 0
Done.
PING www.google.com (216.58.212.164): 56 data bytes
64 bytes from 216.58.212.164: icmp_seq=0 ttl=52 time=12.654 ms

--- www.google.com ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 12.654/12.654/12.654/0.000 ms
ping -c1 -w2 www.google.com: 0
    3m34.85s real     0m00.17s user     0m00.20s system
t420:~$
</code></pre>

<hr>

<h3><a href="https://www.c0ffee.net/blog/openvpn-guide" rel="nofollow">OpenVPN Setup Guide for FreeBSD</a></h3>

<ul>
<li>OpenVPN Setup Guide

<ul>
<li>Browse securely from anywhere using a personal VPN with OpenVPN, LDAP, FreeBSD, and PF.</li>
</ul></li>
</ul>

<blockquote>
<p>A VPN allows you to securely extend a private network over the internet via tunneling protocols and traffic encryption. For most people, a VPN offers two primary features: (1) the ability to access services on your local network over the internet, and (2) secure internet connectivity over an untrusted network. In this guide, I&#39;ll describe how to set up a personal VPN using OpenVPN on FreeBSD. The configuration can use both SSL certificates and LDAP credentials for authentication. We&#39;ll also be using the PF firewall to NAT traffic from our VPN out to the internet.<br>
One important note about running your own VPN: since you are most likely hosting your server using a VPS or hosting provider, with a public IP address allocated specifically to you, your VPN will not give you any extra anonymity on the internet. If anything, you&#39;ll be making yourself more of a target, since all your activity can be trivially traced back to your server&#39;s IP address. So while your VPN will protect you from a snooping hacker on the free WiFi at Starbucks, it won&#39;t protect you from a federal investigation.<br>
This guide assumes you are running FreeBSD with the PF firewall. If you&#39;re using a different Unix flavor, I&#39;ll probably get you most of the way therebut you&#39;ll be on your own when configuring your firewall and networking.<br>
Finally, I&#39;ve used example.com and a non-routable public IP address for all the examples in this guide. You&#39;ll need to replace them with your own domain name and public IP address.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/channel/UCuQhwHMJ0yK2zlfyRr1XZ_Q/feed" rel="nofollow">BSDCan 2017 videos</a></li>
<li><a href="https://www.openbsd.org/papers/eurobsdcon2017-device-drivers.pdf" rel="nofollow">Getting started with OpenBSD device driver development PDF</a></li>
<li><a href="https://macfoo.wordpress.com/2017/10/27/aws-cloudwatch-logs-agent-for-freebsd/" rel="nofollow">AWS CloudWatch Logs agent for FreeBSD</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/november-2017-development-projects-update/" rel="nofollow">FreeBSD Foundation November 2017 Development Projects Update</a></li>
<li><a href="https://fosdem.org/2018/schedule/track/bsd/" rel="nofollow">Schedule for the BSD Devroom at FOSDEM 2018</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Matt - <a href="http://dpaste.com/35VNXR5#wrap" rel="nofollow">The show and Cantrill</a></li>
<li>Paulo - <a href="http://dpaste.com/17E9Z2W#wrap" rel="nofollow">FreeBSD Question</a></li>
<li>Steven - <a href="http://dpaste.com/1N6F0TC#wrap" rel="nofollow">Virtualization under FreeBSD</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>222: How Netflix works</title>
  <link>https://www.bsdnow.tv/222</link>
  <guid isPermaLink="false">b3352064-ac33-44ac-98e5-88f7acdd5d0b</guid>
  <pubDate>Wed, 29 Nov 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b3352064-ac33-44ac-98e5-88f7acdd5d0b.mp3" length="91743412" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We take a look at two-faced Oracle, cover a FAMP installation, how Netflix works the complex stuff, and show you who the patron of yak shaving is.</itunes:subtitle>
  <itunes:duration>2:07:25</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We take a look at two-faced Oracle, cover a FAMP installation, how Netflix works the complex stuff, and show you who the patron of yak shaving is.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Why is Oracle so two-faced over open source? (https://www.theregister.co.uk/2017/10/12/oracle_must_grow_up_on_open_source/)
Oracle loves open source. 
Except when the database giant hates open source. Which, according to its recent lobbying of the US federal government, seems to be "most of the time". Yes, Oracle has recently joined the Cloud Native Computing Foundation (CNCF) to up its support for open-source Kubernetes and, yes, it has long supported (and contributed to) Linux. And, yes, Oracle has even gone so far as to (finally) open up Java development by putting it under a foundation's stewardship. Yet this same, seemingly open Oracle has actively hammered the US government to consider that "there is no math that can justify open source from a cost perspective as the cost of support plus the opportunity cost of forgoing features, functions, automation and security overwhelm any presumed cost savings." That punch to the face was delivered in a letter to Christopher Liddell, a former Microsoft CFO and now director of Trump's American Technology Council, by Kenneth Glueck, Oracle senior vice president.
The US government had courted input on its IT modernisation programme. Others writing back to Liddell included AT&amp;amp;T, Cisco, Microsoft and VMware.
In other words, based on its letter, what Oracle wants us to believe is that open source leads to greater costs and poorly secured, limply featured software. Nor is Oracle content to leave it there, also arguing that open source is exactly how the private sector does not function, seemingly forgetting that most of the leading infrastructure, big data, and mobile software today is open source.
Details! Rather than take this counterproductive detour into self-serving silliness, Oracle would do better to follow Microsoft's path. Microsoft, too, used to Janus-face its way through open source, simultaneously supporting and bashing it. Only under chief executive Satya Nadella's reign did Microsoft realise it's OK to fully embrace open source, and its financial results have loved the commitment. Oracle has much to learn, and emulate, in Microsoft's approach.
I love you, you're perfect. 
Now change Oracle has never been particularly warm and fuzzy about open source. As founder Larry Ellison might put it, Oracle is a profit-seeking corporation, not a peace-loving charity. To the extent that Oracle embraces open source, therefore it does so for financial reward, just like every other corporation. Few, however, are as blunt as Oracle about this fact of corporate open-source life. As Ellison told the Financial Times back in 2006: "If an open-source product gets good enough, we'll simply take it. So the great thing about open source is nobody owns it – a company like Oracle is free to take it for nothing, include it in our products and charge for support, and that's what we'll do. "So it is not disruptive at all – you have to find places to add value. Once open source gets good enough, competing with it would be insane... We don't have to fight open source, we have to exploit open source." "Exploit" sounds about right. While Oracle doesn't crack the top-10 corporate contributors to the Linux kernel, it does register a respectable number 12, which helps it influence the platform enough to feel comfortable building its IaaS offering on Linux (and Xen for virtualisation). Oracle has also managed to continue growing MySQL's clout in the industry while improving it as a product and business. As for Kubernetes, Oracle's decision to join the CNCF also came with P&amp;amp;L strings attached. "CNCF technologies such as Kubernetes, Prometheus, gRPC and OpenTracing are critical parts of both our own and our customers' development toolchains," said Mark Cavage, vice president of software development at Oracle. One can argue that Oracle has figured out the exploitation angle reasonably well. This, however, refers to the right kind of exploitation, the kind that even free software activist Richard Stallman can love (or, at least, tolerate). But when it comes to government lobbying, Oracle looks a lot more like Mr Hyde than Dr Jekyll.
Lies, damned lies, and Oracle lobbying
The current US president has many problems (OK, many, many problems), but his decision to follow the Obama administration's support for IT modernisation is commendable. Most recently, the Trump White House asked for feedback on how best to continue improving government IT. Oracle's response is high comedy in many respects. As TechDirt's Mike Masnick summarises, Oracle's "latest crusade is against open-source technology being used by the federal government – and against the government hiring people out of Silicon Valley to help create more modern systems. Instead, Oracle would apparently prefer the government just give it lots of money." Oracle is very good at making lots of money. As such, its request for even more isn't too surprising. What is surprising is the brazenness of its position. As Masnick opines: "The sheer contempt found in Oracle's submission on IT modernization is pretty stunning." Why? Because Oracle contradicts much that it publicly states in other forums about open source and innovation. More than this, Oracle contradicts much of what we now know is essential to competitive differentiation in an increasingly software and data-driven world.
Take, for example, Oracle's contention that "significant IT development expertise is not... central to successful modernization efforts". What? In our "software is eating the world" existence Oracle clearly believes that CIOs are buyers, not doers: "The most important skill set of CIOs today is to critically compete and evaluate commercial alternatives to capture the benefits of innovation conducted at scale, and then to manage the implementation of those technologies efficiently." While there is some truth to Oracle's claim – every project shouldn't be a custom one-off that must be supported forever – it's crazy to think that a CIO – government or otherwise – is doing their job effectively by simply shovelling cash into vendors' bank accounts.
Indeed, as Masnick points out: "If it weren't for Oracle's failures, there might not even be a USDS [the US Digital Service created in 2014 to modernise federal IT]. USDS really grew out of the emergency hiring of some top-notch internet engineers in response to the Healthcare.gov rollout debacle. And if you don't recall, a big part of that debacle was blamed on Oracle's technology." In short, blindly giving money to Oracle and other big vendors is the opposite of IT modernisation.
In its letter to Liddell, Oracle proceeded to make the fantastic (by which I mean "silly and false") claim that "the fact is that the use of open-source software has been declining rapidly in the private sector". What?!? This is so incredibly untrue that Oracle should score points for being willing to say it out loud. Take a stroll through the most prominent software in big data (Hadoop, Spark, Kafka, etc.), mobile (Android), application development (Kubernetes, Docker), machine learning/AI (TensorFlow, MxNet), and compare it to Oracle's statement. One conclusion must be that Oracle believes its CIO audience is incredibly stupid. Oracle then tells a half-truth by declaring: "There is no math that can justify open source from a cost perspective." How so? Because "the cost of support plus the opportunity cost of forgoing features, functions, automation and security overwhelm any presumed cost savings." Which I guess is why Oracle doesn't use any open source like Linux, Kubernetes, etc. in its services.
Oops.
The Vendor Formerly Known As Satan
The thing is, Oracle doesn't need to do this and, for its own good, shouldn't do this. After all, we already know how this plays out. We need only look at what happened with Microsoft. Remember when Microsoft wanted us to "get the facts" about Linux? Now it's a big-time contributor to Linux. Remember when it told us open source was anti-American and a cancer? Now it aggressively contributes to a huge variety of open-source projects, some of them homegrown in Redmond, and tells the world that "Microsoft loves open source." Of course, Microsoft loves open source for the same reason any corporation does: it drives revenue as developers look to build applications filled with open-source components on Azure. There's nothing wrong with that. 
Would Microsoft prefer government IT to purchase SQL Server instead of open-source-licensed PostgreSQL? Sure. But look for a single line in its response to the Trump executive order that signals "open source is bad". You won't find it. Why? Because Microsoft understands that open source is a friend, not foe, and has learned how to monetise it. Microsoft, in short, is no longer conflicted about open source. It can compete at the product level while embracing open source at the project level, which helps fuel its overall product and business strategy. Oracle isn't there yet, and is still stuck where Microsoft was a decade ago.
It's time to grow up, Oracle. For a company that builds great software and understands that it increasingly needs to depend on open source to build that software, it's disingenuous at best to lobby the US government to put the freeze on open source. Oracle needs to learn from Microsoft, stop worrying and love the open-source bomb. It was a key ingredient in Microsoft's resurgence. Maybe it could help Oracle get a cloud clue, too.  
Install FAMP on FreeBSD (https://www.linuxsecrets.com/home/3164-install-famp-on-freebsd)
The acronym FAMP refers to a set of free open source applications which are commonly used in Web server environments called Apache, MySQL and PHP on the FreeBSD operating system, which provides a server stack that provides web services, database and PHP.
Prerequisites
sudo Installed and working - Please read
Apache
PHP5 or PHP7 
MySQL or MariaDB
Install your favorite editor, ours is vi
Note: You don't need to upgrade FreeBSD but make sure all patches have been installed and your port tree is up-2-date if you plan to update by ports.
Install Ports
portsnap fetch
You must use sudo for each indivdual command during installations. Please see link above for installing sudo.
Searching Available Apache Versions to Install
pkg search apache
Install Apache
To install Apache 2.4 using pkg. The apache 2.4 user account managing Apache is www in FreeBSD.
pkg install apache24
Confirmation yes prompt and hit y for yes to install Apache 2.4 This installs Apache and its dependencies. 
Enable Apache use sysrc to update services to be started at boot time, Command below adds "apache24enable="YES" to the /etc/rc.conf file. For sysrc commands please read
```sysrc apache24enable=yes
Start Apache
service apache24 start```
Visit web address by accessing your server's public IP address in your web browser 
How To find Your Server's Public IP Address
If you do not know what your server's public IP address is, there are a number of ways that you can find it. Usually, this is the address you use to connect to your server through SSH.
ifconfig vtnet0 | grep "inet " | awk '{ print $2 }'
Now that you have the public IP address, you may use it in your web browser's address bar to access your web server.
Install MySQL
Now that we have our web server up and running, it is time to install MySQL, the relational database management system. The MySQL server will organize and provide access to databases where our server can store information. Install MySQL 5.7 using pkg by typing
pkg install mysql57-server
Enter y at the confirmation prompt. This installs the MySQL server and client packages.
To enable MySQL server as a service, add mysqlenable="YES" to the /etc/rc.conf file. This sysrc command will do just that
```sysrc mysqlenable=yes
Now start the MySQL server
service mysql-server start
Now run the security script that will remove some dangerous defaults and slightly restrict access to your database system.
mysqlsecureinstallation```
Answer all questions to secure your newly installed MySQL database. Enter current password for root (enter for none): [RETURN]
Your database system is now set up and we can move on.
Install PHP5 or PHP70
pkg search php70
Install PHP70 you would do the following by typing
pkg install php70-mysqli mod_php70
Note: In these instructions we are using php5.7 not php7.0. We will be coming out with php7.0 instructions with FPM.
PHP is the component of our setup that will process code to display dynamic content. It can run scripts, connect to MySQL databases to get information, and hand the processed content over to the web server to display. We're going to install the modphp, php-mysql, and php-mysqli packages. To install PHP 5.7 with pkg, run this command
```pkg install modphp56 php56-mysql php56-mysqli
Copy sample PHP configuration file into place.
cp /usr/local/etc/php.ini-production /usr/local/etc/php.ini
Regenerate the system's cached information about your installed executable files
rehash```
Before using PHP, you must configure it to work with Apache.
Install PHP Modules (Optional)
To enhance the functionality of PHP, we can optionally install some additional modules. To see the available options for PHP 5.6 modules and libraries, you can type this into your system
pkg search php56
Get more information about each module you can look at the long description of the package by typing
pkg search -f apache24
Optional Install Example
pkg install php56-calendar
Configure Apache to Use PHP Module
Open the Apache configuration file
vim /usr/local/etc/apache24/Includes/php.conf


    DirectoryIndex index.php index.html
Next, we will configure Apache to process requested PHP files with the PHP processor. Add these lines to the end of the file:
    
        SetHandler application/x-httpd-php
    
    
        SetHandler application/x-httpd-php-source
    
 

Now restart Apache to put the changes into effect
service apache24 restart
Test PHP Processing
By default, the DocumentRoot is set to /usr/local/www/apache24/data. We can create the info.php file under that location by typing
vim /usr/local/www/apache24/data/info.php
Add following line to info.php and save it.

 

Details on info.php
info.php file gives you information about your server from the perspective of PHP. It' useful for debugging and to ensure that your settings are being applied correctly.
If this was successful, then your PHP is working as expected.
You probably want to remove info.php after testing because it could actually give information about your server to unauthorized users. Remove file by typing
rm /usr/local/www/apache24/data/info.php
Note: Make sure Apache / meaning the root of Apache is owned by user which should have been created during the Apache install is the owner of the /usr/local/www structure.
That explains FAMP on FreeBSD.
IXsystems
IXsystems TrueNAS X10 Torture Test &amp;amp; Fail Over Systems In Action with the ZFS File System (https://www.youtube.com/watch?v=GG_NvKuh530)
How Netflix works: what happens every time you hit Play (https://medium.com/refraction-tech-everything/how-netflix-works-the-hugely-simplified-complex-stuff-that-happens-every-time-you-hit-play-3a40c9be254b)
Not long ago, House of Cards came back for the fifth season, finally ending a long wait for binge watchers across the world who are interested in an American politician’s ruthless ascendance to presidency. For them, kicking off a marathon is as simple as reaching out for your device or remote, opening the Netflix app and hitting Play. Simple, fast and instantly gratifying. What isn’t as simple is what goes into running Netflix, a service that streams around 250 million hours of video per day to around 98 million paying subscribers in 190 countries. At this scale, providing quality entertainment in a matter of a few seconds to every user is no joke. And as much as it means building top-notch infrastructure at a scale no other Internet service has done before, it also means that a lot of participants in the experience have to be negotiated with and kept satiated?—?from production companies supplying the content, to internet providers dealing with the network traffic Netflix brings upon them.
This is, in short and in the most layman terms, how Netflix works.
Let us just try to understand how Netflix is structured on the technological side with a simple example.
Netflix literally ushered in a revolution around ten years ago by rewriting the applications that run the entire service to fit into a microservices architecture?—?which means that each application, or microservice’s code and resources are its very own. It will not share any of it with any other app by nature. And when two applications do need to talk to each other, they use an application programming interface (API)?—?a tightly-controlled set of rules that both programs can handle. Developers can now make many changes, small or huge, to each application as long as they ensure that it plays well with the API. And since the one program knows the other’s API properly, no change will break the exchange of information.
Netflix estimates that it uses around 700 microservices to control each of the many parts of what makes up the entire Netflix service: one microservice stores what all shows you watched, one deducts the monthly fee from your credit card, one provides your device with the correct video files that it can play, one takes a look at your watching history and uses algorithms to guess a list of movies that you will like, and one will provide the names and images of these movies to be shown in a list on the main menu. And that’s the tip of the iceberg. Netflix engineers can make changes to any part of the application and can introduce new changes rapidly while ensuring that nothing else in the entire service breaks down.
They made a courageous decision to get rid of maintaining their own servers and move all of their stuff to the cloud?—?i.e. run everything on the servers of someone else who dealt with maintaining the hardware while Netflix engineers wrote hundreds of programs and deployed it on the servers rapidly. The someone else they chose for their cloud-based infrastructure is Amazon Web Services (AWS).
Netflix works on thousands of devices, and each of them play a different format of video and sound files. Another set of AWS servers take this original film file, and convert it into hundreds of files, each meant to play the entire show or film on a particular type of device and a particular screen size or video quality. One file will work exclusively on the iPad, one on a full HD Android phone, one on a Sony TV that can play 4K video and Dolby sound, one on a Windows computer, and so on. Even more of these files can be made with varying video qualities so that they are easier to load on a poor network connection. This is a process known as transcoding. A special piece of code is also added to these files to lock them with what is called digital rights management or DRM?—?a technological measure which prevents piracy of films.
The Netflix app or website determines what particular device you are using to watch, and fetches the exact file for that show meant to specially play on your particular device, with a particular video quality based on how fast your internet is at that moment.
Here, instead of relying on AWS servers, they install their very own around the world. But it has only one purpose?—?to store content smartly and deliver it to users. Netflix strikes deals with internet service providers and provides them the red box you saw above at no cost. ISPs install these along with their servers. These Open Connect boxes download the Netflix library for their region from the main servers in the US?—?if there are multiple of them, each will rather store content that is more popular with Netflix users in a region to prioritise speed. So a rarely watched film might take time to load more than a Stranger Things episode. Now, when you will connect to Netflix, the closest Open Connect box to you will deliver the content you need, thus videos load faster than if your Netflix app tried to load it from the main servers in the US.
In a nutshell… This is what happens when you hit that Play button:
Hundreds of microservices, or tiny independent programs, work together to make one large Netflix service.
Content legally acquired or licensed is converted into a size that fits your screen, and protected from being copied.
Servers across the world make a copy of it and store it so that the closest one to you delivers it at max quality and speed.
When you select a show, your Netflix app cherry picks which of these servers will it load the video from&amp;gt;
You are now gripped by Frank Underwood’s chilling tactics, given depression by BoJack Horseman’s rollercoaster life, tickled by Dev in Master of None and made phobic to the future of technology by the stories in Black Mirror. And your lifespan decreases as your binge watching turns you into a couch potato.
It looked so simple before, right?
News Roundup
Moving FreshPorts (http://dan.langille.org/2017/11/15/moving-freshports/)
Today I moved the FreshPorts website from one server to another. My goal is for nobody to notice.
In preparation for this move, I have:
DNS TTL reduced to 60s
Posted to Twitter
Updated the status page
Put the website put in offline mode:
What was missed
I turned off commit processing on the new server, but I did not do this on the old server. I should have:

sudo svc -d /var/service/freshports

That stops processing of incoming commits. No data is lost, but it keeps the two databases at the same spot in history. Commit processing could continue during the database dumping, but that does not affect the dump, which will be consistent regardless.
The offline code
Here is the basic stuff I used to put the website into offline mode. The main points are:
header(“HTTP/1.1 503 Service Unavailable”);
ErrorDocument 404 /index.php
I move the DocumentRoot to a new directory, containing only index.php. Every error invokes index.php, which returns a 503 code.
The dump
The database dump just started (Sun Nov 5 17:07:22 UTC 2017).

root@pg96:~ # /usr/bin/time pg_dump -h 206.127.23.226 -Fc -U dan freshports.org &amp;gt; freshports.org.9.6.dump

That should take about 30 minutes. I have set a timer to remind me. Total time was:

1464.82 real      1324.96 user        37.22 sys

The MD5 is:
MD5 (freshports.org.9.6.dump) = 5249b45a93332b8344c9ce01245a05d5
It is now: Sun Nov 5 17:34:07 UTC 2017
 The rsync
The rsync should take about 10-20 minutes. I have already done an rsync of yesterday’s dump file. The rsync today should copy over only the deltas (i.e. differences).  The rsync started at about Sun Nov 5 17:36:05 UTC 2017 That took 2m9.091s The MD5 matches.
The restore
The restore should take about 30 minutes. I ran this test yesterday. It is now Sun Nov 5 17:40:03 UTC 2017.
$ createdb -T template0 -E SQL_ASCII freshports.testing
$ time pg_restore -j 16 -d freshports.testing freshports.org.9.6.dump

Done.
real    25m21.108s
user    1m57.508s
sys     0m15.172s

It is now Sun Nov 5 18:06:22 UTC 2017.
Insert break here
About here, I took a 30 minute break to run an errand. It was worth it.
Changing DNS
I’m ready to change DNS now. It is Sun Nov 5 19:49:20 EST 2017 Done. And nearly immediately, traffic started.
How many misses?
 During this process, XXXXX requests were declined:

$ grep -c '" 503 ' /usr/websites/log/freshports.org-access.log
XXXXX

That’s it, we’re done
Total elapsed time: 1 hour 48 minutes. There are still a number of things to follow up on, but that was the transfers.
The new FreshPorts Server (http://dan.langille.org/2017/11/17/x8dtu-3/)
***
Using bhyve on top of CEPH (https://lists.freebsd.org/pipermail/freebsd-virtualization/2017-November/005876.html)
Hi,
Just an info point.
I'm preparing for a lecture tomorrow, and thought why not do an actual demo.... Like to be friends with Murphy :)
So after I started the cluster:
  5 jails with 7 OSDs
This what I manually needed to do to boot a memory stick
Start een Bhyve instance
rbd --dest-pool rbddata --no-progress import memstick.img memstick
rbd-ggate map rbddata/memstick
ggate-devvice is available on /dev/ggate1
kldload vmm
kldload nmdm
kldload iftap
kldload ifbridge
kldload cpuctl
sysctl net.link.tap.uponopen=1
ifconfig bridge0 create
ifconfig bridge0 addm em0 up
ifconfig
ifconfig tap11 create
ifconfig bridge0 addm tap11
ifconfig tap11 up
load the GGate disk in bhyve
bhyveload -c /dev/nmdm11A -m 2G -d /dev/ggate1 FB11
and boot a single from it.
bhyve -H -P -A -c 1 -m 2G -l com1,/dev/nmdm11A -s 0:0,hostbridge -s 
1:0,lpc -s 2:0,virtio-net,tap11 -s 4,ahci-hd,/dev/ggate1 FB11 &amp;amp;
bhyvectl --vm=FB11 --get-stats
Connect to the VM
cu -l /dev/nmdm11B
And that'll give you a bhyve VM running on an RBD image over ggate.
In the installer I tested reading from the bootdisk:
root@:/ # dd if=/dev/ada0 of=/dev/null bs=32M
21+1 records in
21+1 records out
734077952 bytes transferred in 5.306260 secs (138341865 bytes/sec)
which is a nice 138Mb/sec.
Hope the demonstration does work out tomorrow.
--WjW
***
Donald Knuth - The Patron Saint of Yak Shaves (http://yakshav.es/the-patron-saint-of-yakshaves/)
Excerpts:
In 2015, I gave a talk in which I called Donald Knuth the Patron Saint of Yak Shaves. The reason is that Donald Knuth achieved the most perfect and long-running yak shave: TeX. I figured this is worth repeating.
How to achieve the ultimate Yak Shave
The ultimate yak shave is the combination of improbable circumstance, the privilege to be able to shave at your hearts will and the will to follow things through to the end. Here’s the way it was achieved with TeX. The recount is purely mine, inaccurate and obviously there for fun. I’ll avoid the most boring facts that everyone always tells, such as why Knuth’s checks have their own Wikipedia page.
Community Shaving is Best Shaving
Since the release of TeX, the community has been busy working on using it as a platform. If you ever downloaded the full TeX distribution, please bear in mind that you are downloading the amassed work of over 40 years, to make sure that each and every TeX document ever written builds. We’re talking about documents here.
But mostly, two big projects sprung out of that. The first is LaTeX by Leslie Lamport. Lamport is a very productive researcher, famous for research in formal methods through TLA+ and also known laying groundwork for many distributed algorithms. LaTeX is based on the idea of separating presentation and content. It is based around the idea of document classes, which then describe the way a certain document is laid out. Think Markdown, just much more complex. The second is ConTeXt, which is far more focused on fine grained layout control.
The Moral of the Story
Whenever you feel like “can’t we just replace this whole thing, it can’t be so hard” when handling TeX, don’t forget how many years of work and especially knowledge were poured into that system. Typesetting isn’t the most popular knowledge around programmers. Especially see it in the context of the space it is in: they can’t remove legacy. Ever. That would break documents.
TeX is also not a programming language. It might resemble one, but mostly, it should be approached as a typesetting system first. A lot of it's confusing lingo gets much better then. It’s not programming lingo. By approaching TeX with an understanding for its history, a lot of things can be learned from it. And yes, a replacement would be great, but it would take ages.
In any case, I hope I thoroughly convinced you why Donald Knuth is the Patron Saint of Yak Shaves.
Extra Credits
This comes out of a enjoyable discussion with [Arne from Lambda Island](https://lambdaisland.com/https://lambdaisland.com/, who listened and said “you should totally turn this into a talk”.
Vincent’s trip to EuroBSDCon 2017 (http://www.vincentdelft.be/post/post_20171016)
My euroBSDCon 2017
Posted on 2017-10-16 09:43:00 from Vincent in Open Bsd
Let me just share my feedback on those 2 days spent in Paris for the EuroBSDCon. My 1st BSDCon. I'm not a developer, contributor, ... Do not expect to improve your skills with OpenBSD with this text :-) I know, we are on October 16th, and the EuroBSDCon of Paris was 3 weeks ago :( I'm not quick !!! Sorry for that
Arrival at 10h, I'm too late for the start of the key note.  The few persons behind a desk welcome me by talking in Dutch, mainly because of my name. Indeed, Delft is a city in Netherlands, but also a well known university. I inform them that I'm from Belgium, and the discussion moves to the fact the Fosdem is located in Brussels. I receive my nice T-shirt white and blue, a bit like the marine T-shirts, but with the nice EuroBSDCon logo. I'm asking where are the different rooms reserved for the BSD event. We have 1 big on the 1st floor, 1 medium 1 level below, and 2 smalls 1 level above. All are really easy to access.  In this entrance we have 4 or 5 tables with some persons representing their company. Those are mainly the big sponsors of the event providing details about their activity and business. I discuss a little bit with StormShield and Gandi.  On other tables people are selling BSD t-shirts, and they will quickly be sold.
"Is it done yet ?" The never ending story of pkg tools
In the last Fosdem, I've already hear Antoine and Baptiste presenting the OpenBSD and FreeBSD battle, I decide to listen Marc Espie in the medium room called Karnak. Marc explains that he has rewritten completely the pkg_add command. He explains that, at contrario with other elements of OpenBSD, the packages tools must be backward compatible and stable on a longer period than 12 months (the support period for OpenBSD).  On the funny side, he explains that he has his best idea inside his bath. Hackathons are also used to validate some ideas with other OpenBSD developers. All in all, he explains that the most time consuming part is to imagine a good solution. Coding it is quite straightforward. He adds that better an idea is, shorter the implementation will be.
A Tale of six motherboards, three BSDs and coreboot
After the lunch I decide to listen the talk about Coreboot. Indeed, 1 or 2 years ago I had listened the Libreboot project at Fosdem. Since they did several references to Coreboot, it's a perfect occasion to listen more carefully to this project. Piotr and Katazyba Kubaj explains us how to boot a machine without the native Bios. Indeed Coreboot can replace the bios, and de facto avoid several binaries imposed by the vendor. They explain that some motherboards are supporting their code. But they also show how difficult it is to flash a Bios and replace it by Coreboot. They even have destroyed a motherboard during the installation. Apparently because the power supply they were using was not stable enough with the 3v. It's really amazing to see that open source developers can go, by themselves, to such deep technical level.
State of the DragonFly's graphics stack
After this Coreboot talk, I decide to stay in the room to follow the presentation of Fran?ois Tigeot. Fran?ois is now one of the core developer of DrangonflyBSD, an amazing BSD system having his own filesystem called Hammer. Hammer offers several amazing features like snapshots, checksum data integrity, deduplication, ... Francois has spent his last years to integrate the video drivers developed for Linux inside DrangonflyBSD. 
He explains that instead of adapting this code for the video card to the kernel API of DrangonflyBSD, he has "simply" build an intermediate layer between the kernel of DragonflyBSD and the video drivers. This is not said in the talk, but this effort is very impressive. Indeed, this is more or less a linux emulator inside DragonflyBSD.  Francois explains that he has started with Intel video driver (drm/i915), but now he is able to run drm/radeon quite well, but also drm/amdgpu and drm/nouveau.
Discovering OpenBSD on AWS
Then I move to the small room at the upper level to follow a presentation made by Laurent Bernaille on OpenBSD and AWS. First Laurent explains that he is re-using the work done by Antoine Jacoutot concerning the integration of OpenBSD inside AWS. But on top of that he has integrated several other Open Source solutions allowing him to build OpenBSD machines very quickly with one command. Moreover those machines will have the network config, the required packages, ... On top of the slides presented, he shows us, in a real demo, how this system works. Amazing presentation which shows that, by putting the correct tools together, a machine builds and configure other machines in one go. 
OpenBSD Testing Infrastructure Behind bluhm.genua.de
Here Jan Klemkow explains us that he has setup a lab where he is able to run different OpenBSD architectures. The system has been designed to be able to install, on demand, a certain version of OpenBSD on the different available machines. On top of that a regression test script can be triggered. This provides reports showing what is working and what is not more working on the different machines.  If I've well understood, Jan is willing to provide such lab to the core developers of OpenBSD in order to allow them to validate easily and quickly their code.  Some more effort is needed to reach this goal, but with what exists today, Jan and his colleague are quite close. Since his company is using OpenBSD business, to his eyes this system is a "tit for tat" to the OpenBSD community.
French story on cybercrime
Then comes the second keynote of the day in the big auditorium. This talk is performed by the colonel of french gendarmerie. Mr Freyssinet, who is head of the Cyber crimes unit inside the Gendarmerie.  Mr Freyssinet explains that the "bad guys" are more and more volatile across countries, and more and more organized. The small hacker in his room, alone, is no more the reality. As a consequence the different national police investigators are collaborating more inside an organization called Interpol.  What is amazing in his talk is that Mr Freyssinet talks about "Crime as a service". Indeed, more and more hackers are selling their services to some "bad and temporary organizations". 
Social event
It's now time for the famous social event on the river: la Seine.  The organizers ask us to go, by small groups, to a station. There is a walk of 15 minutes inside Paris. Hopefully the weather is perfect. To identify them clearly several organizers takes a "beastie fork" in their hands and walk on the sidewalk generating some amazing reactions from some citizens and toursits. Some of them recognize the Freebsd logo and ask us some details. Amazing :-)
We walk on small and big sidewalks until a small stair going under the street. There, we have a train station a bit like a metro station. 3 stations later they ask us to go out. We walk few minutes and come in front of a boat having a double deck: one inside, with nice tables and chairs and one on the roof. But the crew ask us to go up, on the second deck. There, we are welcome with a glass of wine. The tour Eiffel is just at few 100 meters from us. Every hour the Eiffel tower is blinking for 5 minutes with thousands of small lights. Brilliant :-) 
We see also the "statue de la libertee" (the small one) which is on a small island in the middle of the river.  During the whole night the bar will be open with drinks and some appetizers, snacks, ...  Such walking diner is perfect to talk with many different persons.  I've discussed with several persons just using BSD, they are not, like me, deep and specialized developers. One was from Switzerland, another one from Austria, and another one from Netherlands. But I've also followed a discussion with Theo de Raadt, several persons of the FreeBSD foundation. Some are very technical guys, other just users, like me. But all with the same passion for one of the BSD system. Amazing evening.
OpenBSD's small steps towards DTrace (a tale about DDB and CTF)
On the second day, I decide to sleep enough in order to have enough resources to drive back to my home (3 hours by car). So I miss the 1st presentations, and arrive at the event around 10h30. Lot of persons are already present. Some faces are less "fresh" than others.
I decide to listen to Dtrace in OpenBSD. After 10 minutes I am so lost into those too technical explainations, that I decide to open and look at my PC. My OpenBSD laptop is rarely leaving my home, so I've never had the need to have a screen locking system. In a crowded environment, this is better. So I was looking for a simple solution. I've looked at how to use xlock. I've combined it with the /ets/apm/suspend script, ... Always very easy to use OpenBSD :-)
The OpenBSD web stack
Then I decide to follow the presentation of Michael W Lucas. Well know person for his different books about "Absolute OpenBSD", Relayd", ...  Michael talks about the httpd daemon inside OpenBSD. But he also present his integration with Carp, Relayd, PF, FastCGI, the rules based on LUA regexp (opposed to perl regexp), ... For sure he emphasis on the security aspect of those tools: privilege separation, chroot, ...
OpenSMTPD, current state of affairs
Then I follow the presentation of Gilles Chehade about the OpenSMTPD project.  Amazing presentation that, on top of the technical challenges, shows how to manage such project across the years. Gilles is working on OpenSMTPD since 2007, thus 10 years !!!.  He explains the different decisions they took to make the software as simple as possible to use, but as secure as possible, too: privilege separation, chroot, pledge, random malloc, ? . The development starts on BSD systems, but once quite well known they received lot of contributions from Linux developers. 
Hoisting: lessons learned integrating pledge into 500 programs
After a small break, I decide to listen to Theo de Raadt, the founder of OpenBSD. In his own style, with trekking boots, shorts, backpack.  Theo starts by saying that Pledge is the outcome of nightmares. Theo explains that the book called "Hacking blind" presenting the BROP has worried him since few years.  That's why he developed Pledge as a tool killing a process as soon as possible when there is an unforeseen behavior of this program. For example, with Pledge a program which can only write to disk will be immediately killed if he tries to reach network.  By implementing Pledge in the +-500 programs present in the "base", OpenBSD is becoming more secured and more robust.
Conclusion
My first EuroBSDCon was a great, interesting and cool event. I've discussed with several BSD enthusiasts. I'm using OpenBSD since 2010, but I'm not a developer, so I was worried to be "lost" in the middle of experts. In fact it was not the case. At EuroBSDCon you have many different type of enthusiasts BSD's users. What is nice with the EuroBSDCon is that the organizers foresee everything for you. You just have to sit and listen. They foresee even how to spend, in a funny and very cool attitude, the evening of Saturday. &amp;gt; The small draw back is that all of this has a cost. In my case the whole weekend cost me a bit more than 500euro. Based on what I've learned, what I've saw this is very acceptable price. Nearly all presentations I saw give me a valuable input for my daily job.  For sure, the total price is also linked to my personal choice: hotel, parking.  And I'm surely biased because I'm used to go to the Fosdem in Brussels which cost nothing (entrance) and is approximately 45 minutes of my home. But Fosdem is not the same atmosphere and presentations are less linked to my daily job.
I do not regret my trip to EuroBSDCon and will surely plan other ones.
Beastie Bits
Important munitions lawyering (https://www.jwz.org/blog/2017/10/important-munitions-lawyering/)
AsiaBSDCon 2018 CFP is now open, until December 15th (https://2018.asiabsdcon.org/)
ZSTD Compression for ZFS by Allan Jude (https://www.youtube.com/watch?v=hWnWEitDPlM&amp;amp;feature=share)
NetBSD on Allwinner SoCs Update (https://blog.netbsd.org/tnf/entry/netbsd_on_allwinner_socs_update)
***
Feedback/Questions
Tim - Creating Multi Boot USB sticks (http://dpaste.com/0FKTJK3#wrap)
Nomen - ZFS Questions (http://dpaste.com/1HY5MFB)
JJ - Questions (http://dpaste.com/3ZGNSK9#wrap)
Lars - Hardening Diffie-Hellman (http://dpaste.com/3TRXXN4)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We take a look at two-faced Oracle, cover a FAMP installation, how Netflix works the complex stuff, and show you who the patron of yak shaving is.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.theregister.co.uk/2017/10/12/oracle_must_grow_up_on_open_source/" rel="nofollow">Why is Oracle so two-faced over open source?</a></h3>

<ul>
<li>Oracle loves open source. </li>
</ul>

<blockquote>
<p>Except when the database giant hates open source. Which, according to its recent lobbying of the US federal government, seems to be &quot;most of the time&quot;. Yes, Oracle has recently joined the Cloud Native Computing Foundation (CNCF) to up its support for open-source Kubernetes and, yes, it has long supported (and contributed to) Linux. And, yes, Oracle has even gone so far as to (finally) open up Java development by putting it under a foundation&#39;s stewardship. Yet this same, seemingly open Oracle has actively hammered the US government to consider that &quot;there is no math that can justify open source from a cost perspective as the cost of support plus the opportunity cost of forgoing features, functions, automation and security overwhelm any presumed cost savings.&quot; That punch to the face was delivered in a letter to Christopher Liddell, a former Microsoft CFO and now director of Trump&#39;s American Technology Council, by Kenneth Glueck, Oracle senior vice president.<br>
The US government had courted input on its IT modernisation programme. Others writing back to Liddell included AT&amp;T, Cisco, Microsoft and VMware.<br>
In other words, based on its letter, what Oracle wants us to believe is that open source leads to greater costs and poorly secured, limply featured software. Nor is Oracle content to leave it there, also arguing that open source is exactly how the private sector does not function, seemingly forgetting that most of the leading infrastructure, big data, and mobile software today is open source.<br>
Details! Rather than take this counterproductive detour into self-serving silliness, Oracle would do better to follow Microsoft&#39;s path. Microsoft, too, used to Janus-face its way through open source, simultaneously supporting and bashing it. Only under chief executive Satya Nadella&#39;s reign did Microsoft realise it&#39;s OK to fully embrace open source, and its financial results have loved the commitment. Oracle has much to learn, and emulate, in Microsoft&#39;s approach.</p>
</blockquote>

<ul>
<li>I love you, you&#39;re perfect. </li>
</ul>

<blockquote>
<p>Now change Oracle has never been particularly warm and fuzzy about open source. As founder Larry Ellison might put it, Oracle is a profit-seeking corporation, not a peace-loving charity. To the extent that Oracle embraces open source, therefore it does so for financial reward, just like every other corporation. Few, however, are as blunt as Oracle about this fact of corporate open-source life. As Ellison told the Financial Times back in 2006: &quot;If an open-source product gets good enough, we&#39;ll simply take it. So the great thing about open source is nobody owns it  a company like Oracle is free to take it for nothing, include it in our products and charge for support, and that&#39;s what we&#39;ll do. &quot;So it is not disruptive at all  you have to find places to add value. Once open source gets good enough, competing with it would be insane... We don&#39;t have to fight open source, we have to exploit open source.&quot; &quot;Exploit&quot; sounds about right. While Oracle doesn&#39;t crack the top-10 corporate contributors to the Linux kernel, it does register a respectable number 12, which helps it influence the platform enough to feel comfortable building its IaaS offering on Linux (and Xen for virtualisation). Oracle has also managed to continue growing MySQL&#39;s clout in the industry while improving it as a product and business. As for Kubernetes, Oracle&#39;s decision to join the CNCF also came with P&amp;L strings attached. &quot;CNCF technologies such as Kubernetes, Prometheus, gRPC and OpenTracing are critical parts of both our own and our customers&#39; development toolchains,&quot; said Mark Cavage, vice president of software development at Oracle. One can argue that Oracle has figured out the exploitation angle reasonably well. This, however, refers to the right kind of exploitation, the kind that even free software activist Richard Stallman can love (or, at least, tolerate). But when it comes to government lobbying, Oracle looks a lot more like Mr Hyde than Dr Jekyll.</p>
</blockquote>

<ul>
<li>Lies, damned lies, and Oracle lobbying</li>
</ul>

<blockquote>
<p>The current US president has many problems (OK, many, many problems), but his decision to follow the Obama administration&#39;s support for IT modernisation is commendable. Most recently, the Trump White House asked for feedback on how best to continue improving government IT. Oracle&#39;s response is high comedy in many respects. As TechDirt&#39;s Mike Masnick summarises, Oracle&#39;s &quot;latest crusade is against open-source technology being used by the federal government  and against the government hiring people out of Silicon Valley to help create more modern systems. Instead, Oracle would apparently prefer the government just give it lots of money.&quot; Oracle is very good at making lots of money. As such, its request for even more isn&#39;t too surprising. What is surprising is the brazenness of its position. As Masnick opines: &quot;The sheer contempt found in Oracle&#39;s submission on IT modernization is pretty stunning.&quot; Why? Because Oracle contradicts much that it publicly states in other forums about open source and innovation. More than this, Oracle contradicts much of what we now know is essential to competitive differentiation in an increasingly software and data-driven world.<br>
Take, for example, Oracle&#39;s contention that &quot;significant IT development expertise is not... central to successful modernization efforts&quot;. What? In our &quot;software is eating the world&quot; existence Oracle clearly believes that CIOs are buyers, not doers: &quot;The most important skill set of CIOs today is to critically compete and evaluate commercial alternatives to capture the benefits of innovation conducted at scale, and then to manage the implementation of those technologies efficiently.&quot; While there is some truth to Oracle&#39;s claim  every project shouldn&#39;t be a custom one-off that must be supported forever  it&#39;s crazy to think that a CIO  government or otherwise  is doing their job effectively by simply shovelling cash into vendors&#39; bank accounts.<br>
Indeed, as Masnick points out: &quot;If it weren&#39;t for Oracle&#39;s failures, there might not even be a USDS [the US Digital Service created in 2014 to modernise federal IT]. USDS really grew out of the emergency hiring of some top-notch internet engineers in response to the Healthcare.gov rollout debacle. And if you don&#39;t recall, a big part of that debacle was blamed on Oracle&#39;s technology.&quot; In short, blindly giving money to Oracle and other big vendors is the opposite of IT modernisation.<br>
In its letter to Liddell, Oracle proceeded to make the fantastic (by which I mean &quot;silly and false&quot;) claim that &quot;the fact is that the use of open-source software has been declining rapidly in the private sector&quot;. What?!? This is so incredibly untrue that Oracle should score points for being willing to say it out loud. Take a stroll through the most prominent software in big data (Hadoop, Spark, Kafka, etc.), mobile (Android), application development (Kubernetes, Docker), machine learning/AI (TensorFlow, MxNet), and compare it to Oracle&#39;s statement. One conclusion must be that Oracle believes its CIO audience is incredibly stupid. Oracle then tells a half-truth by declaring: &quot;There is no math that can justify open source from a cost perspective.&quot; How so? Because &quot;the cost of support plus the opportunity cost of forgoing features, functions, automation and security overwhelm any presumed cost savings.&quot; Which I guess is why Oracle doesn&#39;t use any open source like Linux, Kubernetes, etc. in its services.<br>
Oops.</p>
</blockquote>

<ul>
<li>The Vendor Formerly Known As Satan</li>
</ul>

<blockquote>
<p>The thing is, Oracle doesn&#39;t need to do this and, for its own good, shouldn&#39;t do this. After all, we already know how this plays out. We need only look at what happened with Microsoft. Remember when Microsoft wanted us to &quot;get the facts&quot; about Linux? Now it&#39;s a big-time contributor to Linux. Remember when it told us open source was anti-American and a cancer? Now it aggressively contributes to a huge variety of open-source projects, some of them homegrown in Redmond, and tells the world that &quot;Microsoft loves open source.&quot; Of course, Microsoft loves open source for the same reason any corporation does: it drives revenue as developers look to build applications filled with open-source components on Azure. There&#39;s nothing wrong with that. <br>
Would Microsoft prefer government IT to purchase SQL Server instead of open-source-licensed PostgreSQL? Sure. But look for a single line in its response to the Trump executive order that signals &quot;open source is bad&quot;. You won&#39;t find it. Why? Because Microsoft understands that open source is a friend, not foe, and has learned how to monetise it. Microsoft, in short, is no longer conflicted about open source. It can compete at the product level while embracing open source at the project level, which helps fuel its overall product and business strategy. Oracle isn&#39;t there yet, and is still stuck where Microsoft was a decade ago.<br>
It&#39;s time to grow up, Oracle. For a company that builds great software and understands that it increasingly needs to depend on open source to build that software, it&#39;s disingenuous at best to lobby the US government to put the freeze on open source. Oracle needs to learn from Microsoft, stop worrying and love the open-source bomb. It was a key ingredient in Microsoft&#39;s resurgence. Maybe it could help Oracle get a cloud clue, too.  </p>

<hr>
</blockquote>

<h3><a href="https://www.linuxsecrets.com/home/3164-install-famp-on-freebsd" rel="nofollow">Install FAMP on FreeBSD</a></h3>

<ul>
<li>The acronym FAMP refers to a set of free open source applications which are commonly used in Web server environments called Apache, MySQL and PHP on the FreeBSD operating system, which provides a server stack that provides web services, database and PHP.</li>
<li>Prerequisites

<ul>
<li>sudo Installed and working - Please read</li>
<li>Apache</li>
<li>PHP5 or PHP7 </li>
<li>MySQL or MariaDB</li>
<li>Install your favorite editor, ours is vi</li>
</ul></li>
</ul>

<blockquote>
<p>Note: You don&#39;t need to upgrade FreeBSD but make sure all patches have been installed and your port tree is up-2-date if you plan to update by ports.</p>
</blockquote>

<ul>
<li>Install Ports</li>
</ul>

<blockquote>
<p><code>portsnap fetch</code><br>
You must use sudo for each indivdual command during installations. Please see link above for installing sudo.<br>
Searching Available Apache Versions to Install<br>
<code>pkg search apache</code></p>
</blockquote>

<ul>
<li>Install Apache</li>
</ul>

<blockquote>
<p>To install Apache 2.4 using pkg. The apache 2.4 user account managing Apache is www in FreeBSD.<br>
<code>pkg install apache24</code><br>
Confirmation yes prompt and hit y for yes to install Apache 2.4 This installs Apache and its dependencies. <br>
Enable Apache use sysrc to update services to be started at boot time, Command below adds &quot;apache24_enable=&quot;YES&quot; to the /etc/rc.conf file. For sysrc commands please read<br>
<code>sysrc apache24_enable=yes</code><br>
Start Apache<br>
<code>service apache24 start</code><br>
Visit web address by accessing your server&#39;s public IP address in your web browser </p>
</blockquote>

<ul>
<li>How To find Your Server&#39;s Public IP Address</li>
</ul>

<blockquote>
<p>If you do not know what your server&#39;s public IP address is, there are a number of ways that you can find it. Usually, this is the address you use to connect to your server through SSH.<br>
<code>ifconfig vtnet0 | grep &quot;inet &quot; | awk &#39;{ print $2 }&#39;</code><br>
Now that you have the public IP address, you may use it in your web browser&#39;s address bar to access your web server.</p>
</blockquote>

<ul>
<li>Install MySQL</li>
</ul>

<blockquote>
<p>Now that we have our web server up and running, it is time to install MySQL, the relational database management system. The MySQL server will organize and provide access to databases where our server can store information. Install MySQL 5.7 using pkg by typing<br>
<code>pkg install mysql57-server</code><br>
Enter y at the confirmation prompt. This installs the MySQL server and client packages.<br>
To enable MySQL server as a service, add mysql_enable=&quot;YES&quot; to the /etc/rc.conf file. This sysrc command will do just that<br>
<code>sysrc mysql_enable=yes</code><br>
Now start the MySQL server<br>
<code>service mysql-server start</code><br>
Now run the security script that will remove some dangerous defaults and slightly restrict access to your database system.</p>

<pre><code class="mysql_secure_installation```">Answer all questions to secure your newly installed MySQL database. Enter current password for root (enter for none): [RETURN]
Your database system is now set up and we can move on.
</code></pre>
</blockquote>

<ul>
<li>Install PHP5 or PHP70</li>
</ul>

<blockquote>
<p><code>pkg search php70</code><br>
Install PHP70 you would do the following by typing<br>
<code>pkg install php70-mysqli mod_php70</code></p>
</blockquote>

<ul>
<li>Note: In these instructions we are using php5.7 not php7.0. We will be coming out with php7.0 instructions with FPM.</li>
</ul>

<blockquote>
<p>PHP is the component of our setup that will process code to display dynamic content. It can run scripts, connect to MySQL databases to get information, and hand the processed content over to the web server to display. We&#39;re going to install the mod_php, php-mysql, and php-mysqli packages. To install PHP 5.7 with pkg, run this command<br>
<code>pkg install mod_php56 php56-mysql php56-mysqli</code><br>
Copy sample PHP configuration file into place.<br>
<code>cp /usr/local/etc/php.ini-production /usr/local/etc/php.ini</code><br>
Regenerate the system&#39;s cached information about your installed executable files</p>

<pre><code class="rehash```">Before using PHP, you must configure it to work with Apache.
</code></pre>
</blockquote>

<ul>
<li>Install PHP Modules (Optional)</li>
</ul>

<blockquote>
<p>To enhance the functionality of PHP, we can optionally install some additional modules. To see the available options for PHP 5.6 modules and libraries, you can type this into your system<br>
<code>pkg search php56</code><br>
Get more information about each module you can look at the long description of the package by typing<br>
<code>pkg search -f apache24</code></p>
</blockquote>

<ul>
<li>Optional Install Example</li>
</ul>

<blockquote>
<p><code>pkg install php56-calendar</code><br>
Configure Apache to Use PHP Module<br>
Open the Apache configuration file<br>
<code>vim /usr/local/etc/apache24/Includes/php.conf</code></p>

<pre><code>&lt;IfModule dir_module&gt;
    DirectoryIndex index.php index.html
Next, we will configure Apache to process requested PHP files with the PHP processor. Add these lines to the end of the file:
    &lt;FilesMatch &quot;\.php$&quot;&gt;
        SetHandler application/x-httpd-php
    &lt;/FilesMatch&gt;
    &lt;FilesMatch &quot;\.phps$&quot;&gt;
        SetHandler application/x-httpd-php-source
    &lt;/FilesMatch&gt;
&lt;/IfModule&gt; 
</code></pre>

<p>Now restart Apache to put the changes into effect<br>
<code>service apache24 restart</code></p>
</blockquote>

<ul>
<li>Test PHP Processing</li>
</ul>

<blockquote>
<p>By default, the DocumentRoot is set to /usr/local/www/apache24/data. We can create the info.php file under that location by typing<br>
<code>vim /usr/local/www/apache24/data/info.php</code><br>
Add following line to info.php and save it.</p>

<pre><code>&lt;?php phpinfo(); ?&gt; 
</code></pre>
</blockquote>

<ul>
<li>Details on info.php</li>
</ul>

<blockquote>
<p>info.php file gives you information about your server from the perspective of PHP. It&#39; useful for debugging and to ensure that your settings are being applied correctly.<br>
If this was successful, then your PHP is working as expected.<br>
You probably want to remove info.php after testing because it could actually give information about your server to unauthorized users. Remove file by typing<br>
<code>rm /usr/local/www/apache24/data/info.php</code><br>
Note: Make sure Apache / meaning the root of Apache is owned by user which should have been created during the Apache install is the owner of the /usr/local/www structure.<br>
That explains FAMP on FreeBSD.</p>

<hr>
</blockquote>

<h3>IXsystems</h3>

<ul>
<li><a href="https://www.youtube.com/watch?v=GG_NvKuh530" rel="nofollow">IXsystems TrueNAS X10 Torture Test &amp; Fail Over Systems In Action with the ZFS File System</a></li>
</ul>

<h3><a href="https://medium.com/refraction-tech-everything/how-netflix-works-the-hugely-simplified-complex-stuff-that-happens-every-time-you-hit-play-3a40c9be254b" rel="nofollow">How Netflix works: what happens every time you hit Play</a></h3>

<blockquote>
<p>Not long ago, House of Cards came back for the fifth season, finally ending a long wait for binge watchers across the world who are interested in an American politicians ruthless ascendance to presidency. For them, kicking off a marathon is as simple as reaching out for your device or remote, opening the Netflix app and hitting Play. Simple, fast and instantly gratifying. What isnt as simple is what goes into running Netflix, a service that streams around 250 million hours of video per day to around 98 million paying subscribers in 190 countries. At this scale, providing quality entertainment in a matter of a few seconds to every user is no joke. And as much as it means building top-notch infrastructure at a scale no other Internet service has done before, it also means that a lot of participants in the experience have to be negotiated with and kept satiated??from production companies supplying the content, to internet providers dealing with the network traffic Netflix brings upon them.<br>
This is, in short and in the most layman terms, how Netflix works.<br>
Let us just try to understand how Netflix is structured on the technological side with a simple example.<br>
Netflix literally ushered in a revolution around ten years ago by rewriting the applications that run the entire service to fit into a microservices architecture??which means that each application, or microservices code and resources are its very own. It will not share any of it with any other app by nature. And when two applications do need to talk to each other, they use an application programming interface (API)??a tightly-controlled set of rules that both programs can handle. Developers can now make many changes, small or huge, to each application as long as they ensure that it plays well with the API. And since the one program knows the others API properly, no change will break the exchange of information.<br>
Netflix estimates that it uses around 700 microservices to control each of the many parts of what makes up the entire Netflix service: one microservice stores what all shows you watched, one deducts the monthly fee from your credit card, one provides your device with the correct video files that it can play, one takes a look at your watching history and uses algorithms to guess a list of movies that you will like, and one will provide the names and images of these movies to be shown in a list on the main menu. And thats the tip of the iceberg. Netflix engineers can make changes to any part of the application and can introduce new changes rapidly while ensuring that nothing else in the entire service breaks down.<br>
They made a courageous decision to get rid of maintaining their own servers and move all of their stuff to the cloud??i.e. run everything on the servers of someone else who dealt with maintaining the hardware while Netflix engineers wrote hundreds of programs and deployed it on the servers rapidly. The someone else they chose for their cloud-based infrastructure is Amazon Web Services (AWS).<br>
Netflix works on thousands of devices, and each of them play a different format of video and sound files. Another set of AWS servers take this original film file, and convert it into hundreds of files, each meant to play the entire show or film on a particular type of device and a particular screen size or video quality. One file will work exclusively on the iPad, one on a full HD Android phone, one on a Sony TV that can play 4K video and Dolby sound, one on a Windows computer, and so on. Even more of these files can be made with varying video qualities so that they are easier to load on a poor network connection. This is a process known as transcoding. A special piece of code is also added to these files to lock them with what is called digital rights management or DRM??a technological measure which prevents piracy of films.<br>
The Netflix app or website determines what particular device you are using to watch, and fetches the exact file for that show meant to specially play on your particular device, with a particular video quality based on how fast your internet is at that moment.<br>
Here, instead of relying on AWS servers, they install their very own around the world. But it has only one purpose??to store content smartly and deliver it to users. Netflix strikes deals with internet service providers and provides them the red box you saw above at no cost. ISPs install these along with their servers. These Open Connect boxes download the Netflix library for their region from the main servers in the US??if there are multiple of them, each will rather store content that is more popular with Netflix users in a region to prioritise speed. So a rarely watched film might take time to load more than a Stranger Things episode. Now, when you will connect to Netflix, the closest Open Connect box to you will deliver the content you need, thus videos load faster than if your Netflix app tried to load it from the main servers in the US.</p>
</blockquote>

<ul>
<li>In a nutshell This is what happens when you hit that Play button:

<ul>
<li>Hundreds of microservices, or tiny independent programs, work together to make one large Netflix service.</li>
<li>Content legally acquired or licensed is converted into a size that fits your screen, and protected from being copied.</li>
<li>Servers across the world make a copy of it and store it so that the closest one to you delivers it at max quality and speed.</li>
<li>When you select a show, your Netflix app cherry picks which of these servers will it load the video from&gt;</li>
<li>You are now gripped by Frank Underwoods chilling tactics, given depression by BoJack Horsemans rollercoaster life, tickled by Dev in Master of None and made phobic to the future of technology by the stories in Black Mirror. And your lifespan decreases as your binge watching turns you into a couch potato.</li>
</ul></li>
</ul>

<blockquote>
<p>It looked so simple before, right?</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="http://dan.langille.org/2017/11/15/moving-freshports/" rel="nofollow">Moving FreshPorts</a></h3>

<blockquote>
<p>Today I moved the FreshPorts website from one server to another. My goal is for nobody to notice.</p>
</blockquote>

<ul>
<li>In preparation for this move, I have:

<ul>
<li>DNS TTL reduced to 60s</li>
<li>Posted to Twitter</li>
<li>Updated the status page</li>
<li>Put the website put in offline mode:</li>
</ul></li>
<li>What was missed</li>
</ul>

<blockquote>
<p>I turned off commit processing on the new server, but I did not do this on the old server. I should have:</p>

<pre><code>sudo svc -d /var/service/freshports
</code></pre>

<p>That stops processing of incoming commits. No data is lost, but it keeps the two databases at the same spot in history. Commit processing could continue during the database dumping, but that does not affect the dump, which will be consistent regardless.</p>
</blockquote>

<ul>
<li>The offline code</li>
</ul>

<blockquote>
<p>Here is the basic stuff I used to put the website into offline mode. The main points are:</p>
</blockquote>

<ul>
<li>header(HTTP/1.1 503 Service Unavailable);</li>
<li>ErrorDocument 404 /index.php</li>
</ul>

<blockquote>
<p>I move the DocumentRoot to a new directory, containing only index.php. Every error invokes index.php, which returns a 503 code.</p>
</blockquote>

<ul>
<li>The dump</li>
</ul>

<blockquote>
<p>The database dump just started (Sun Nov 5 17:07:22 UTC 2017).</p>

<pre><code>root@pg96:~ # /usr/bin/time pg_dump -h 206.127.23.226 -Fc -U dan freshports.org &gt; freshports.org.9.6.dump
</code></pre>

<p>That should take about 30 minutes. I have set a timer to remind me. Total time was:</p>

<pre><code>1464.82 real      1324.96 user        37.22 sys
</code></pre>

<p>The MD5 is:<br>
<code>MD5 (freshports.org.9.6.dump) = 5249b45a93332b8344c9ce01245a05d5</code><br>
It is now: Sun Nov 5 17:34:07 UTC 2017</p>
</blockquote>

<ul>
<li> The rsync</li>
</ul>

<blockquote>
<p>The rsync should take about 10-20 minutes. I have already done an rsync of yesterdays dump file. The rsync today should copy over only the deltas (i.e. differences).  The rsync started at about Sun Nov 5 17:36:05 UTC 2017 That took 2m9.091s The MD5 matches.</p>
</blockquote>

<ul>
<li>The restore</li>
</ul>

<blockquote>
<p>The restore should take about 30 minutes. I ran this test yesterday. It is now Sun Nov 5 17:40:03 UTC 2017.</p>

<p>```$ createdb -T template0 -E SQL_ASCII freshports.testing<br>
$ time pg_restore -j 16 -d freshports.testing freshports.org.9.6.dump</p>

<pre><code>Done.

```real    25m21.108s
user    1m57.508s
sys     0m15.172s
</code></pre>

<p>It is now Sun Nov 5 18:06:22 UTC 2017.</p>
</blockquote>

<ul>
<li>Insert break here</li>
</ul>

<blockquote>
<p>About here, I took a 30 minute break to run an errand. It was worth it.</p>
</blockquote>

<ul>
<li>Changing DNS</li>
</ul>

<blockquote>
<p>Im ready to change DNS now. It is Sun Nov 5 19:49:20 EST 2017 Done. And nearly immediately, traffic started.</p>
</blockquote>

<ul>
<li>How many misses?</li>
</ul>

<blockquote>
<p>During this process, XXXXX requests were declined:</p>

<pre><code>$ grep -c &#39;&quot; 503 &#39; /usr/websites/log/freshports.org-access.log
XXXXX
</code></pre>
</blockquote>

<ul>
<li>Thats it, were done</li>
</ul>

<blockquote>
<p>Total elapsed time: 1 hour 48 minutes. There are still a number of things to follow up on, but that was the transfers.</p>
</blockquote>

<ul>
<li><a href="http://dan.langille.org/2017/11/17/x8dtu-3/" rel="nofollow">The new FreshPorts Server</a>
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2017-November/005876.html" rel="nofollow">Using bhyve on top of CEPH</a></h3>

<ul>
<li>Hi,</li>
<li>Just an info point.</li>
<li>I&#39;m preparing for a lecture tomorrow, and thought why not do an actual demo.... Like to be friends with Murphy :)</li>
<li>So after I started the cluster:</li>
<li><p>5 jails with 7 OSDs</p></li>
<li><p>This what I manually needed to do to boot a memory stick</p></li>
<li><p>Start een Bhyve instance</p></li>
</ul>

<blockquote>
<p>rbd --dest-pool rbd_data --no-progress import memstick.img memstick<br>
rbd-ggate map rbd_data/memstick</p>
</blockquote>

<ul>
<li>ggate-devvice is available on /dev/ggate1</li>
</ul>

<blockquote>
<p>kldload vmm<br>
kldload nmdm<br>
kldload if_tap<br>
kldload if_bridge<br>
kldload cpuctl<br>
sysctl net.link.tap.up_on_open=1<br>
ifconfig bridge0 create<br>
ifconfig bridge0 addm em0 up<br>
ifconfig<br>
ifconfig tap11 create<br>
ifconfig bridge0 addm tap11<br>
ifconfig tap11 up</p>
</blockquote>

<ul>
<li>load the GGate disk in bhyve</li>
</ul>

<blockquote>
<p>bhyveload -c /dev/nmdm11A -m 2G -d /dev/ggate1 FB11</p>
</blockquote>

<ul>
<li>and boot a single from it.</li>
</ul>

<blockquote>
<p>bhyve -H -P -A -c 1 -m 2G -l com1,/dev/nmdm11A -s 0:0,hostbridge -s <br>
1:0,lpc -s 2:0,virtio-net,tap11 -s 4,ahci-hd,/dev/ggate1 FB11 &amp;<br>
bhyvectl --vm=FB11 --get-stats</p>
</blockquote>

<ul>
<li>Connect to the VM</li>
</ul>

<blockquote>
<p>cu -l /dev/nmdm11B</p>
</blockquote>

<ul>
<li>And that&#39;ll give you a bhyve VM running on an RBD image over ggate.</li>
<li>In the installer I tested reading from the bootdisk:</li>
</ul>

<blockquote>
<p>root@:/ # dd if=/dev/ada0 of=/dev/null bs=32M<br>
21+1 records in<br>
21+1 records out<br>
734077952 bytes transferred in 5.306260 secs (138341865 bytes/sec)</p>
</blockquote>

<ul>
<li>which is a nice 138Mb/sec.</li>
<li>Hope the demonstration does work out tomorrow.</li>
<li>--WjW
***</li>
</ul>

<h3><a href="http://yakshav.es/the-patron-saint-of-yakshaves/" rel="nofollow">Donald Knuth - The Patron Saint of Yak Shaves</a></h3>

<ul>
<li>Excerpts:</li>
</ul>

<blockquote>
<p>In 2015, I gave a talk in which I called Donald Knuth the Patron Saint of Yak Shaves. The reason is that Donald Knuth achieved the most perfect and long-running yak shave: TeX. I figured this is worth repeating.</p>
</blockquote>

<ul>
<li>How to achieve the ultimate Yak Shave</li>
</ul>

<blockquote>
<p>The ultimate yak shave is the combination of improbable circumstance, the privilege to be able to shave at your hearts will and the will to follow things through to the end. Heres the way it was achieved with TeX. The recount is purely mine, inaccurate and obviously there for fun. Ill avoid the most boring facts that everyone always tells, such as why Knuths checks have their own Wikipedia page.</p>
</blockquote>

<ul>
<li>Community Shaving is Best Shaving</li>
</ul>

<blockquote>
<p>Since the release of TeX, the community has been busy working on using it as a platform. If you ever downloaded the full TeX distribution, please bear in mind that you are downloading the amassed work of over 40 years, to make sure that each and every TeX document ever written builds. Were talking about documents here.<br>
But mostly, two big projects sprung out of that. The first is LaTeX by Leslie Lamport. Lamport is a very productive researcher, famous for research in formal methods through TLA+ and also known laying groundwork for many distributed algorithms. LaTeX is based on the idea of separating presentation and content. It is based around the idea of document classes, which then describe the way a certain document is laid out. Think Markdown, just much more complex. The second is ConTeXt, which is far more focused on fine grained layout control.</p>
</blockquote>

<ul>
<li>The Moral of the Story</li>
</ul>

<blockquote>
<p>Whenever you feel like cant we just replace this whole thing, it cant be so hard when handling TeX, dont forget how many years of work and especially knowledge were poured into that system. Typesetting isnt the most popular knowledge around programmers. Especially see it in the context of the space it is in: they cant remove legacy. Ever. That would break documents.<br>
TeX is also not a programming language. It might resemble one, but mostly, it should be approached as a typesetting system first. A lot of it&#39;s confusing lingo gets much better then. Its not programming lingo. By approaching TeX with an understanding for its history, a lot of things can be learned from it. And yes, a replacement would be great, but it would take ages.<br>
In any case, I hope I thoroughly convinced you why Donald Knuth is the Patron Saint of Yak Shaves.</p>
</blockquote>

<ul>
<li>Extra Credits</li>
</ul>

<blockquote>
<p>This comes out of a enjoyable discussion with [Arne from Lambda Island](<a href="https://lambdaisland.com/https://lambdaisland.com/" rel="nofollow">https://lambdaisland.com/https://lambdaisland.com/</a>, who listened and said you should totally turn this into a talk.</p>

<hr>
</blockquote>

<h3><a href="http://www.vincentdelft.be/post/post_20171016" rel="nofollow">Vincents trip to EuroBSDCon 2017</a></h3>

<ul>
<li>My euroBSDCon 2017</li>
<li>Posted on 2017-10-16 09:43:00 from Vincent in Open Bsd</li>
</ul>

<blockquote>
<p>Let me just share my feedback on those 2 days spent in Paris for the EuroBSDCon. My 1st BSDCon. I&#39;m not a developer, contributor, ... Do not expect to improve your skills with OpenBSD with this text :-) I know, we are on October 16th, and the EuroBSDCon of Paris was 3 weeks ago :( I&#39;m not quick !!! Sorry for that<br>
Arrival at 10h, I&#39;m too late for the start of the key note.  The few persons behind a desk welcome me by talking in Dutch, mainly because of my name. Indeed, Delft is a city in Netherlands, but also a well known university. I inform them that I&#39;m from Belgium, and the discussion moves to the fact the Fosdem is located in Brussels. I receive my nice T-shirt white and blue, a bit like the marine T-shirts, but with the nice EuroBSDCon logo. I&#39;m asking where are the different rooms reserved for the BSD event. We have 1 big on the 1st floor, 1 medium 1 level below, and 2 smalls 1 level above. All are really easy to access.  In this entrance we have 4 or 5 tables with some persons representing their company. Those are mainly the big sponsors of the event providing details about their activity and business. I discuss a little bit with StormShield and Gandi.  On other tables people are selling BSD t-shirts, and they will quickly be sold.</p>
</blockquote>

<ul>
<li>&quot;Is it done yet ?&quot; The never ending story of pkg tools</li>
</ul>

<blockquote>
<p>In the last Fosdem, I&#39;ve already hear Antoine and Baptiste presenting the OpenBSD and FreeBSD battle, I decide to listen Marc Espie in the medium room called Karnak. Marc explains that he has rewritten completely the pkg_add command. He explains that, at contrario with other elements of OpenBSD, the packages tools must be backward compatible and stable on a longer period than 12 months (the support period for OpenBSD).  On the funny side, he explains that he has his best idea inside his bath. Hackathons are also used to validate some ideas with other OpenBSD developers. All in all, he explains that the most time consuming part is to imagine a good solution. Coding it is quite straightforward. He adds that better an idea is, shorter the implementation will be.</p>
</blockquote>

<ul>
<li>A Tale of six motherboards, three BSDs and coreboot</li>
</ul>

<blockquote>
<p>After the lunch I decide to listen the talk about Coreboot. Indeed, 1 or 2 years ago I had listened the Libreboot project at Fosdem. Since they did several references to Coreboot, it&#39;s a perfect occasion to listen more carefully to this project. Piotr and Katazyba Kubaj explains us how to boot a machine without the native Bios. Indeed Coreboot can replace the bios, and de facto avoid several binaries imposed by the vendor. They explain that some motherboards are supporting their code. But they also show how difficult it is to flash a Bios and replace it by Coreboot. They even have destroyed a motherboard during the installation. Apparently because the power supply they were using was not stable enough with the 3v. It&#39;s really amazing to see that open source developers can go, by themselves, to such deep technical level.</p>
</blockquote>

<ul>
<li>State of the DragonFly&#39;s graphics stack</li>
</ul>

<blockquote>
<p>After this Coreboot talk, I decide to stay in the room to follow the presentation of Fran?ois Tigeot. Fran?ois is now one of the core developer of DrangonflyBSD, an amazing BSD system having his own filesystem called Hammer. Hammer offers several amazing features like snapshots, checksum data integrity, deduplication, ... Francois has spent his last years to integrate the video drivers developed for Linux inside DrangonflyBSD. <br>
He explains that instead of adapting this code for the video card to the kernel API of DrangonflyBSD, he has &quot;simply&quot; build an intermediate layer between the kernel of DragonflyBSD and the video drivers. This is not said in the talk, but this effort is very impressive. Indeed, this is more or less a linux emulator inside DragonflyBSD.  Francois explains that he has started with Intel video driver (drm/i915), but now he is able to run drm/radeon quite well, but also drm/amdgpu and drm/nouveau.</p>
</blockquote>

<ul>
<li>Discovering OpenBSD on AWS</li>
</ul>

<blockquote>
<p>Then I move to the small room at the upper level to follow a presentation made by Laurent Bernaille on OpenBSD and AWS. First Laurent explains that he is re-using the work done by Antoine Jacoutot concerning the integration of OpenBSD inside AWS. But on top of that he has integrated several other Open Source solutions allowing him to build OpenBSD machines very quickly with one command. Moreover those machines will have the network config, the required packages, ... On top of the slides presented, he shows us, in a real demo, how this system works. Amazing presentation which shows that, by putting the correct tools together, a machine builds and configure other machines in one go. </p>
</blockquote>

<ul>
<li>OpenBSD Testing Infrastructure Behind bluhm.genua.de</li>
</ul>

<blockquote>
<p>Here Jan Klemkow explains us that he has setup a lab where he is able to run different OpenBSD architectures. The system has been designed to be able to install, on demand, a certain version of OpenBSD on the different available machines. On top of that a regression test script can be triggered. This provides reports showing what is working and what is not more working on the different machines.  If I&#39;ve well understood, Jan is willing to provide such lab to the core developers of OpenBSD in order to allow them to validate easily and quickly their code.  Some more effort is needed to reach this goal, but with what exists today, Jan and his colleague are quite close. Since his company is using OpenBSD business, to his eyes this system is a &quot;tit for tat&quot; to the OpenBSD community.</p>
</blockquote>

<ul>
<li>French story on cybercrime</li>
</ul>

<blockquote>
<p>Then comes the second keynote of the day in the big auditorium. This talk is performed by the colonel of french gendarmerie. Mr Freyssinet, who is head of the Cyber crimes unit inside the Gendarmerie.  Mr Freyssinet explains that the &quot;bad guys&quot; are more and more volatile across countries, and more and more organized. The small hacker in his room, alone, is no more the reality. As a consequence the different national police investigators are collaborating more inside an organization called Interpol.  What is amazing in his talk is that Mr Freyssinet talks about &quot;Crime as a service&quot;. Indeed, more and more hackers are selling their services to some &quot;bad and temporary organizations&quot;. </p>
</blockquote>

<ul>
<li>Social event</li>
</ul>

<blockquote>
<p>It&#39;s now time for the famous social event on the river: la Seine.  The organizers ask us to go, by small groups, to a station. There is a walk of 15 minutes inside Paris. Hopefully the weather is perfect. To identify them clearly several organizers takes a &quot;beastie fork&quot; in their hands and walk on the sidewalk generating some amazing reactions from some citizens and toursits. Some of them recognize the Freebsd logo and ask us some details. Amazing :-)<br>
We walk on small and big sidewalks until a small stair going under the street. There, we have a train station a bit like a metro station. 3 stations later they ask us to go out. We walk few minutes and come in front of a boat having a double deck: one inside, with nice tables and chairs and one on the roof. But the crew ask us to go up, on the second deck. There, we are welcome with a glass of wine. The tour Eiffel is just at few 100 meters from us. Every hour the Eiffel tower is blinking for 5 minutes with thousands of small lights. Brilliant :-) <br>
We see also the &quot;statue de la libertee&quot; (the small one) which is on a small island in the middle of the river.  During the whole night the bar will be open with drinks and some appetizers, snacks, ...  Such walking diner is perfect to talk with many different persons.  I&#39;ve discussed with several persons just using BSD, they are not, like me, deep and specialized developers. One was from Switzerland, another one from Austria, and another one from Netherlands. But I&#39;ve also followed a discussion with Theo de Raadt, several persons of the FreeBSD foundation. Some are very technical guys, other just users, like me. But all with the same passion for one of the BSD system. Amazing evening.</p>
</blockquote>

<ul>
<li>OpenBSD&#39;s small steps towards DTrace (a tale about DDB and CTF)</li>
</ul>

<blockquote>
<p>On the second day, I decide to sleep enough in order to have enough resources to drive back to my home (3 hours by car). So I miss the 1st presentations, and arrive at the event around 10h30. Lot of persons are already present. Some faces are less &quot;fresh&quot; than others.<br>
I decide to listen to Dtrace in OpenBSD. After 10 minutes I am so lost into those too technical explainations, that I decide to open and look at my PC. My OpenBSD laptop is rarely leaving my home, so I&#39;ve never had the need to have a screen locking system. In a crowded environment, this is better. So I was looking for a simple solution. I&#39;ve looked at how to use xlock. I&#39;ve combined it with the /ets/apm/suspend script, ... Always very easy to use OpenBSD :-)</p>
</blockquote>

<ul>
<li>The OpenBSD web stack</li>
</ul>

<blockquote>
<p>Then I decide to follow the presentation of Michael W Lucas. Well know person for his different books about &quot;Absolute OpenBSD&quot;, Relayd&quot;, ...  Michael talks about the httpd daemon inside OpenBSD. But he also present his integration with Carp, Relayd, PF, FastCGI, the rules based on LUA regexp (opposed to perl regexp), ... For sure he emphasis on the security aspect of those tools: privilege separation, chroot, ...</p>
</blockquote>

<ul>
<li>OpenSMTPD, current state of affairs</li>
</ul>

<blockquote>
<p>Then I follow the presentation of Gilles Chehade about the OpenSMTPD project.  Amazing presentation that, on top of the technical challenges, shows how to manage such project across the years. Gilles is working on OpenSMTPD since 2007, thus 10 years !!!.  He explains the different decisions they took to make the software as simple as possible to use, but as secure as possible, too: privilege separation, chroot, pledge, random malloc, ? . The development starts on BSD systems, but once quite well known they received lot of contributions from Linux developers. </p>
</blockquote>

<ul>
<li>Hoisting: lessons learned integrating pledge into 500 programs</li>
</ul>

<blockquote>
<p>After a small break, I decide to listen to Theo de Raadt, the founder of OpenBSD. In his own style, with trekking boots, shorts, backpack.  Theo starts by saying that Pledge is the outcome of nightmares. Theo explains that the book called &quot;Hacking blind&quot; presenting the BROP has worried him since few years.  That&#39;s why he developed Pledge as a tool killing a process as soon as possible when there is an unforeseen behavior of this program. For example, with Pledge a program which can only write to disk will be immediately killed if he tries to reach network.  By implementing Pledge in the +-500 programs present in the &quot;base&quot;, OpenBSD is becoming more secured and more robust.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>My first EuroBSDCon was a great, interesting and cool event. I&#39;ve discussed with several BSD enthusiasts. I&#39;m using OpenBSD since 2010, but I&#39;m not a developer, so I was worried to be &quot;lost&quot; in the middle of experts. In fact it was not the case. At EuroBSDCon you have many different type of enthusiasts BSD&#39;s users. What is nice with the EuroBSDCon is that the organizers foresee everything for you. You just have to sit and listen. They foresee even how to spend, in a funny and very cool attitude, the evening of Saturday. &gt; The small draw back is that all of this has a cost. In my case the whole weekend cost me a bit more than 500euro. Based on what I&#39;ve learned, what I&#39;ve saw this is very acceptable price. Nearly all presentations I saw give me a valuable input for my daily job.  For sure, the total price is also linked to my personal choice: hotel, parking.  And I&#39;m surely biased because I&#39;m used to go to the Fosdem in Brussels which cost nothing (entrance) and is approximately 45 minutes of my home. But Fosdem is not the same atmosphere and presentations are less linked to my daily job.<br>
I do not regret my trip to EuroBSDCon and will surely plan other ones.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.jwz.org/blog/2017/10/important-munitions-lawyering/" rel="nofollow">Important munitions lawyering</a></li>
<li><a href="https://2018.asiabsdcon.org/" rel="nofollow">AsiaBSDCon 2018 CFP is now open, until December 15th</a></li>
<li><a href="https://www.youtube.com/watch?v=hWnWEitDPlM&feature=share" rel="nofollow">ZSTD Compression for ZFS by Allan Jude</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/netbsd_on_allwinner_socs_update" rel="nofollow">NetBSD on Allwinner SoCs Update</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/0FKTJK3#wrap" rel="nofollow">Tim - Creating Multi Boot USB sticks</a></li>
<li><a href="http://dpaste.com/1HY5MFB" rel="nofollow">Nomen - ZFS Questions</a></li>
<li><a href="http://dpaste.com/3ZGNSK9#wrap" rel="nofollow">JJ - Questions</a></li>
<li><a href="http://dpaste.com/3TRXXN4" rel="nofollow">Lars - Hardening Diffie-Hellman</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We take a look at two-faced Oracle, cover a FAMP installation, how Netflix works the complex stuff, and show you who the patron of yak shaving is.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.theregister.co.uk/2017/10/12/oracle_must_grow_up_on_open_source/" rel="nofollow">Why is Oracle so two-faced over open source?</a></h3>

<ul>
<li>Oracle loves open source. </li>
</ul>

<blockquote>
<p>Except when the database giant hates open source. Which, according to its recent lobbying of the US federal government, seems to be &quot;most of the time&quot;. Yes, Oracle has recently joined the Cloud Native Computing Foundation (CNCF) to up its support for open-source Kubernetes and, yes, it has long supported (and contributed to) Linux. And, yes, Oracle has even gone so far as to (finally) open up Java development by putting it under a foundation&#39;s stewardship. Yet this same, seemingly open Oracle has actively hammered the US government to consider that &quot;there is no math that can justify open source from a cost perspective as the cost of support plus the opportunity cost of forgoing features, functions, automation and security overwhelm any presumed cost savings.&quot; That punch to the face was delivered in a letter to Christopher Liddell, a former Microsoft CFO and now director of Trump&#39;s American Technology Council, by Kenneth Glueck, Oracle senior vice president.<br>
The US government had courted input on its IT modernisation programme. Others writing back to Liddell included AT&amp;T, Cisco, Microsoft and VMware.<br>
In other words, based on its letter, what Oracle wants us to believe is that open source leads to greater costs and poorly secured, limply featured software. Nor is Oracle content to leave it there, also arguing that open source is exactly how the private sector does not function, seemingly forgetting that most of the leading infrastructure, big data, and mobile software today is open source.<br>
Details! Rather than take this counterproductive detour into self-serving silliness, Oracle would do better to follow Microsoft&#39;s path. Microsoft, too, used to Janus-face its way through open source, simultaneously supporting and bashing it. Only under chief executive Satya Nadella&#39;s reign did Microsoft realise it&#39;s OK to fully embrace open source, and its financial results have loved the commitment. Oracle has much to learn, and emulate, in Microsoft&#39;s approach.</p>
</blockquote>

<ul>
<li>I love you, you&#39;re perfect. </li>
</ul>

<blockquote>
<p>Now change Oracle has never been particularly warm and fuzzy about open source. As founder Larry Ellison might put it, Oracle is a profit-seeking corporation, not a peace-loving charity. To the extent that Oracle embraces open source, therefore it does so for financial reward, just like every other corporation. Few, however, are as blunt as Oracle about this fact of corporate open-source life. As Ellison told the Financial Times back in 2006: &quot;If an open-source product gets good enough, we&#39;ll simply take it. So the great thing about open source is nobody owns it  a company like Oracle is free to take it for nothing, include it in our products and charge for support, and that&#39;s what we&#39;ll do. &quot;So it is not disruptive at all  you have to find places to add value. Once open source gets good enough, competing with it would be insane... We don&#39;t have to fight open source, we have to exploit open source.&quot; &quot;Exploit&quot; sounds about right. While Oracle doesn&#39;t crack the top-10 corporate contributors to the Linux kernel, it does register a respectable number 12, which helps it influence the platform enough to feel comfortable building its IaaS offering on Linux (and Xen for virtualisation). Oracle has also managed to continue growing MySQL&#39;s clout in the industry while improving it as a product and business. As for Kubernetes, Oracle&#39;s decision to join the CNCF also came with P&amp;L strings attached. &quot;CNCF technologies such as Kubernetes, Prometheus, gRPC and OpenTracing are critical parts of both our own and our customers&#39; development toolchains,&quot; said Mark Cavage, vice president of software development at Oracle. One can argue that Oracle has figured out the exploitation angle reasonably well. This, however, refers to the right kind of exploitation, the kind that even free software activist Richard Stallman can love (or, at least, tolerate). But when it comes to government lobbying, Oracle looks a lot more like Mr Hyde than Dr Jekyll.</p>
</blockquote>

<ul>
<li>Lies, damned lies, and Oracle lobbying</li>
</ul>

<blockquote>
<p>The current US president has many problems (OK, many, many problems), but his decision to follow the Obama administration&#39;s support for IT modernisation is commendable. Most recently, the Trump White House asked for feedback on how best to continue improving government IT. Oracle&#39;s response is high comedy in many respects. As TechDirt&#39;s Mike Masnick summarises, Oracle&#39;s &quot;latest crusade is against open-source technology being used by the federal government  and against the government hiring people out of Silicon Valley to help create more modern systems. Instead, Oracle would apparently prefer the government just give it lots of money.&quot; Oracle is very good at making lots of money. As such, its request for even more isn&#39;t too surprising. What is surprising is the brazenness of its position. As Masnick opines: &quot;The sheer contempt found in Oracle&#39;s submission on IT modernization is pretty stunning.&quot; Why? Because Oracle contradicts much that it publicly states in other forums about open source and innovation. More than this, Oracle contradicts much of what we now know is essential to competitive differentiation in an increasingly software and data-driven world.<br>
Take, for example, Oracle&#39;s contention that &quot;significant IT development expertise is not... central to successful modernization efforts&quot;. What? In our &quot;software is eating the world&quot; existence Oracle clearly believes that CIOs are buyers, not doers: &quot;The most important skill set of CIOs today is to critically compete and evaluate commercial alternatives to capture the benefits of innovation conducted at scale, and then to manage the implementation of those technologies efficiently.&quot; While there is some truth to Oracle&#39;s claim  every project shouldn&#39;t be a custom one-off that must be supported forever  it&#39;s crazy to think that a CIO  government or otherwise  is doing their job effectively by simply shovelling cash into vendors&#39; bank accounts.<br>
Indeed, as Masnick points out: &quot;If it weren&#39;t for Oracle&#39;s failures, there might not even be a USDS [the US Digital Service created in 2014 to modernise federal IT]. USDS really grew out of the emergency hiring of some top-notch internet engineers in response to the Healthcare.gov rollout debacle. And if you don&#39;t recall, a big part of that debacle was blamed on Oracle&#39;s technology.&quot; In short, blindly giving money to Oracle and other big vendors is the opposite of IT modernisation.<br>
In its letter to Liddell, Oracle proceeded to make the fantastic (by which I mean &quot;silly and false&quot;) claim that &quot;the fact is that the use of open-source software has been declining rapidly in the private sector&quot;. What?!? This is so incredibly untrue that Oracle should score points for being willing to say it out loud. Take a stroll through the most prominent software in big data (Hadoop, Spark, Kafka, etc.), mobile (Android), application development (Kubernetes, Docker), machine learning/AI (TensorFlow, MxNet), and compare it to Oracle&#39;s statement. One conclusion must be that Oracle believes its CIO audience is incredibly stupid. Oracle then tells a half-truth by declaring: &quot;There is no math that can justify open source from a cost perspective.&quot; How so? Because &quot;the cost of support plus the opportunity cost of forgoing features, functions, automation and security overwhelm any presumed cost savings.&quot; Which I guess is why Oracle doesn&#39;t use any open source like Linux, Kubernetes, etc. in its services.<br>
Oops.</p>
</blockquote>

<ul>
<li>The Vendor Formerly Known As Satan</li>
</ul>

<blockquote>
<p>The thing is, Oracle doesn&#39;t need to do this and, for its own good, shouldn&#39;t do this. After all, we already know how this plays out. We need only look at what happened with Microsoft. Remember when Microsoft wanted us to &quot;get the facts&quot; about Linux? Now it&#39;s a big-time contributor to Linux. Remember when it told us open source was anti-American and a cancer? Now it aggressively contributes to a huge variety of open-source projects, some of them homegrown in Redmond, and tells the world that &quot;Microsoft loves open source.&quot; Of course, Microsoft loves open source for the same reason any corporation does: it drives revenue as developers look to build applications filled with open-source components on Azure. There&#39;s nothing wrong with that. <br>
Would Microsoft prefer government IT to purchase SQL Server instead of open-source-licensed PostgreSQL? Sure. But look for a single line in its response to the Trump executive order that signals &quot;open source is bad&quot;. You won&#39;t find it. Why? Because Microsoft understands that open source is a friend, not foe, and has learned how to monetise it. Microsoft, in short, is no longer conflicted about open source. It can compete at the product level while embracing open source at the project level, which helps fuel its overall product and business strategy. Oracle isn&#39;t there yet, and is still stuck where Microsoft was a decade ago.<br>
It&#39;s time to grow up, Oracle. For a company that builds great software and understands that it increasingly needs to depend on open source to build that software, it&#39;s disingenuous at best to lobby the US government to put the freeze on open source. Oracle needs to learn from Microsoft, stop worrying and love the open-source bomb. It was a key ingredient in Microsoft&#39;s resurgence. Maybe it could help Oracle get a cloud clue, too.  </p>

<hr>
</blockquote>

<h3><a href="https://www.linuxsecrets.com/home/3164-install-famp-on-freebsd" rel="nofollow">Install FAMP on FreeBSD</a></h3>

<ul>
<li>The acronym FAMP refers to a set of free open source applications which are commonly used in Web server environments called Apache, MySQL and PHP on the FreeBSD operating system, which provides a server stack that provides web services, database and PHP.</li>
<li>Prerequisites

<ul>
<li>sudo Installed and working - Please read</li>
<li>Apache</li>
<li>PHP5 or PHP7 </li>
<li>MySQL or MariaDB</li>
<li>Install your favorite editor, ours is vi</li>
</ul></li>
</ul>

<blockquote>
<p>Note: You don&#39;t need to upgrade FreeBSD but make sure all patches have been installed and your port tree is up-2-date if you plan to update by ports.</p>
</blockquote>

<ul>
<li>Install Ports</li>
</ul>

<blockquote>
<p><code>portsnap fetch</code><br>
You must use sudo for each indivdual command during installations. Please see link above for installing sudo.<br>
Searching Available Apache Versions to Install<br>
<code>pkg search apache</code></p>
</blockquote>

<ul>
<li>Install Apache</li>
</ul>

<blockquote>
<p>To install Apache 2.4 using pkg. The apache 2.4 user account managing Apache is www in FreeBSD.<br>
<code>pkg install apache24</code><br>
Confirmation yes prompt and hit y for yes to install Apache 2.4 This installs Apache and its dependencies. <br>
Enable Apache use sysrc to update services to be started at boot time, Command below adds &quot;apache24_enable=&quot;YES&quot; to the /etc/rc.conf file. For sysrc commands please read<br>
<code>sysrc apache24_enable=yes</code><br>
Start Apache<br>
<code>service apache24 start</code><br>
Visit web address by accessing your server&#39;s public IP address in your web browser </p>
</blockquote>

<ul>
<li>How To find Your Server&#39;s Public IP Address</li>
</ul>

<blockquote>
<p>If you do not know what your server&#39;s public IP address is, there are a number of ways that you can find it. Usually, this is the address you use to connect to your server through SSH.<br>
<code>ifconfig vtnet0 | grep &quot;inet &quot; | awk &#39;{ print $2 }&#39;</code><br>
Now that you have the public IP address, you may use it in your web browser&#39;s address bar to access your web server.</p>
</blockquote>

<ul>
<li>Install MySQL</li>
</ul>

<blockquote>
<p>Now that we have our web server up and running, it is time to install MySQL, the relational database management system. The MySQL server will organize and provide access to databases where our server can store information. Install MySQL 5.7 using pkg by typing<br>
<code>pkg install mysql57-server</code><br>
Enter y at the confirmation prompt. This installs the MySQL server and client packages.<br>
To enable MySQL server as a service, add mysql_enable=&quot;YES&quot; to the /etc/rc.conf file. This sysrc command will do just that<br>
<code>sysrc mysql_enable=yes</code><br>
Now start the MySQL server<br>
<code>service mysql-server start</code><br>
Now run the security script that will remove some dangerous defaults and slightly restrict access to your database system.</p>

<pre><code class="mysql_secure_installation```">Answer all questions to secure your newly installed MySQL database. Enter current password for root (enter for none): [RETURN]
Your database system is now set up and we can move on.
</code></pre>
</blockquote>

<ul>
<li>Install PHP5 or PHP70</li>
</ul>

<blockquote>
<p><code>pkg search php70</code><br>
Install PHP70 you would do the following by typing<br>
<code>pkg install php70-mysqli mod_php70</code></p>
</blockquote>

<ul>
<li>Note: In these instructions we are using php5.7 not php7.0. We will be coming out with php7.0 instructions with FPM.</li>
</ul>

<blockquote>
<p>PHP is the component of our setup that will process code to display dynamic content. It can run scripts, connect to MySQL databases to get information, and hand the processed content over to the web server to display. We&#39;re going to install the mod_php, php-mysql, and php-mysqli packages. To install PHP 5.7 with pkg, run this command<br>
<code>pkg install mod_php56 php56-mysql php56-mysqli</code><br>
Copy sample PHP configuration file into place.<br>
<code>cp /usr/local/etc/php.ini-production /usr/local/etc/php.ini</code><br>
Regenerate the system&#39;s cached information about your installed executable files</p>

<pre><code class="rehash```">Before using PHP, you must configure it to work with Apache.
</code></pre>
</blockquote>

<ul>
<li>Install PHP Modules (Optional)</li>
</ul>

<blockquote>
<p>To enhance the functionality of PHP, we can optionally install some additional modules. To see the available options for PHP 5.6 modules and libraries, you can type this into your system<br>
<code>pkg search php56</code><br>
Get more information about each module you can look at the long description of the package by typing<br>
<code>pkg search -f apache24</code></p>
</blockquote>

<ul>
<li>Optional Install Example</li>
</ul>

<blockquote>
<p><code>pkg install php56-calendar</code><br>
Configure Apache to Use PHP Module<br>
Open the Apache configuration file<br>
<code>vim /usr/local/etc/apache24/Includes/php.conf</code></p>

<pre><code>&lt;IfModule dir_module&gt;
    DirectoryIndex index.php index.html
Next, we will configure Apache to process requested PHP files with the PHP processor. Add these lines to the end of the file:
    &lt;FilesMatch &quot;\.php$&quot;&gt;
        SetHandler application/x-httpd-php
    &lt;/FilesMatch&gt;
    &lt;FilesMatch &quot;\.phps$&quot;&gt;
        SetHandler application/x-httpd-php-source
    &lt;/FilesMatch&gt;
&lt;/IfModule&gt; 
</code></pre>

<p>Now restart Apache to put the changes into effect<br>
<code>service apache24 restart</code></p>
</blockquote>

<ul>
<li>Test PHP Processing</li>
</ul>

<blockquote>
<p>By default, the DocumentRoot is set to /usr/local/www/apache24/data. We can create the info.php file under that location by typing<br>
<code>vim /usr/local/www/apache24/data/info.php</code><br>
Add following line to info.php and save it.</p>

<pre><code>&lt;?php phpinfo(); ?&gt; 
</code></pre>
</blockquote>

<ul>
<li>Details on info.php</li>
</ul>

<blockquote>
<p>info.php file gives you information about your server from the perspective of PHP. It&#39; useful for debugging and to ensure that your settings are being applied correctly.<br>
If this was successful, then your PHP is working as expected.<br>
You probably want to remove info.php after testing because it could actually give information about your server to unauthorized users. Remove file by typing<br>
<code>rm /usr/local/www/apache24/data/info.php</code><br>
Note: Make sure Apache / meaning the root of Apache is owned by user which should have been created during the Apache install is the owner of the /usr/local/www structure.<br>
That explains FAMP on FreeBSD.</p>

<hr>
</blockquote>

<h3>IXsystems</h3>

<ul>
<li><a href="https://www.youtube.com/watch?v=GG_NvKuh530" rel="nofollow">IXsystems TrueNAS X10 Torture Test &amp; Fail Over Systems In Action with the ZFS File System</a></li>
</ul>

<h3><a href="https://medium.com/refraction-tech-everything/how-netflix-works-the-hugely-simplified-complex-stuff-that-happens-every-time-you-hit-play-3a40c9be254b" rel="nofollow">How Netflix works: what happens every time you hit Play</a></h3>

<blockquote>
<p>Not long ago, House of Cards came back for the fifth season, finally ending a long wait for binge watchers across the world who are interested in an American politicians ruthless ascendance to presidency. For them, kicking off a marathon is as simple as reaching out for your device or remote, opening the Netflix app and hitting Play. Simple, fast and instantly gratifying. What isnt as simple is what goes into running Netflix, a service that streams around 250 million hours of video per day to around 98 million paying subscribers in 190 countries. At this scale, providing quality entertainment in a matter of a few seconds to every user is no joke. And as much as it means building top-notch infrastructure at a scale no other Internet service has done before, it also means that a lot of participants in the experience have to be negotiated with and kept satiated??from production companies supplying the content, to internet providers dealing with the network traffic Netflix brings upon them.<br>
This is, in short and in the most layman terms, how Netflix works.<br>
Let us just try to understand how Netflix is structured on the technological side with a simple example.<br>
Netflix literally ushered in a revolution around ten years ago by rewriting the applications that run the entire service to fit into a microservices architecture??which means that each application, or microservices code and resources are its very own. It will not share any of it with any other app by nature. And when two applications do need to talk to each other, they use an application programming interface (API)??a tightly-controlled set of rules that both programs can handle. Developers can now make many changes, small or huge, to each application as long as they ensure that it plays well with the API. And since the one program knows the others API properly, no change will break the exchange of information.<br>
Netflix estimates that it uses around 700 microservices to control each of the many parts of what makes up the entire Netflix service: one microservice stores what all shows you watched, one deducts the monthly fee from your credit card, one provides your device with the correct video files that it can play, one takes a look at your watching history and uses algorithms to guess a list of movies that you will like, and one will provide the names and images of these movies to be shown in a list on the main menu. And thats the tip of the iceberg. Netflix engineers can make changes to any part of the application and can introduce new changes rapidly while ensuring that nothing else in the entire service breaks down.<br>
They made a courageous decision to get rid of maintaining their own servers and move all of their stuff to the cloud??i.e. run everything on the servers of someone else who dealt with maintaining the hardware while Netflix engineers wrote hundreds of programs and deployed it on the servers rapidly. The someone else they chose for their cloud-based infrastructure is Amazon Web Services (AWS).<br>
Netflix works on thousands of devices, and each of them play a different format of video and sound files. Another set of AWS servers take this original film file, and convert it into hundreds of files, each meant to play the entire show or film on a particular type of device and a particular screen size or video quality. One file will work exclusively on the iPad, one on a full HD Android phone, one on a Sony TV that can play 4K video and Dolby sound, one on a Windows computer, and so on. Even more of these files can be made with varying video qualities so that they are easier to load on a poor network connection. This is a process known as transcoding. A special piece of code is also added to these files to lock them with what is called digital rights management or DRM??a technological measure which prevents piracy of films.<br>
The Netflix app or website determines what particular device you are using to watch, and fetches the exact file for that show meant to specially play on your particular device, with a particular video quality based on how fast your internet is at that moment.<br>
Here, instead of relying on AWS servers, they install their very own around the world. But it has only one purpose??to store content smartly and deliver it to users. Netflix strikes deals with internet service providers and provides them the red box you saw above at no cost. ISPs install these along with their servers. These Open Connect boxes download the Netflix library for their region from the main servers in the US??if there are multiple of them, each will rather store content that is more popular with Netflix users in a region to prioritise speed. So a rarely watched film might take time to load more than a Stranger Things episode. Now, when you will connect to Netflix, the closest Open Connect box to you will deliver the content you need, thus videos load faster than if your Netflix app tried to load it from the main servers in the US.</p>
</blockquote>

<ul>
<li>In a nutshell This is what happens when you hit that Play button:

<ul>
<li>Hundreds of microservices, or tiny independent programs, work together to make one large Netflix service.</li>
<li>Content legally acquired or licensed is converted into a size that fits your screen, and protected from being copied.</li>
<li>Servers across the world make a copy of it and store it so that the closest one to you delivers it at max quality and speed.</li>
<li>When you select a show, your Netflix app cherry picks which of these servers will it load the video from&gt;</li>
<li>You are now gripped by Frank Underwoods chilling tactics, given depression by BoJack Horsemans rollercoaster life, tickled by Dev in Master of None and made phobic to the future of technology by the stories in Black Mirror. And your lifespan decreases as your binge watching turns you into a couch potato.</li>
</ul></li>
</ul>

<blockquote>
<p>It looked so simple before, right?</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="http://dan.langille.org/2017/11/15/moving-freshports/" rel="nofollow">Moving FreshPorts</a></h3>

<blockquote>
<p>Today I moved the FreshPorts website from one server to another. My goal is for nobody to notice.</p>
</blockquote>

<ul>
<li>In preparation for this move, I have:

<ul>
<li>DNS TTL reduced to 60s</li>
<li>Posted to Twitter</li>
<li>Updated the status page</li>
<li>Put the website put in offline mode:</li>
</ul></li>
<li>What was missed</li>
</ul>

<blockquote>
<p>I turned off commit processing on the new server, but I did not do this on the old server. I should have:</p>

<pre><code>sudo svc -d /var/service/freshports
</code></pre>

<p>That stops processing of incoming commits. No data is lost, but it keeps the two databases at the same spot in history. Commit processing could continue during the database dumping, but that does not affect the dump, which will be consistent regardless.</p>
</blockquote>

<ul>
<li>The offline code</li>
</ul>

<blockquote>
<p>Here is the basic stuff I used to put the website into offline mode. The main points are:</p>
</blockquote>

<ul>
<li>header(HTTP/1.1 503 Service Unavailable);</li>
<li>ErrorDocument 404 /index.php</li>
</ul>

<blockquote>
<p>I move the DocumentRoot to a new directory, containing only index.php. Every error invokes index.php, which returns a 503 code.</p>
</blockquote>

<ul>
<li>The dump</li>
</ul>

<blockquote>
<p>The database dump just started (Sun Nov 5 17:07:22 UTC 2017).</p>

<pre><code>root@pg96:~ # /usr/bin/time pg_dump -h 206.127.23.226 -Fc -U dan freshports.org &gt; freshports.org.9.6.dump
</code></pre>

<p>That should take about 30 minutes. I have set a timer to remind me. Total time was:</p>

<pre><code>1464.82 real      1324.96 user        37.22 sys
</code></pre>

<p>The MD5 is:<br>
<code>MD5 (freshports.org.9.6.dump) = 5249b45a93332b8344c9ce01245a05d5</code><br>
It is now: Sun Nov 5 17:34:07 UTC 2017</p>
</blockquote>

<ul>
<li> The rsync</li>
</ul>

<blockquote>
<p>The rsync should take about 10-20 minutes. I have already done an rsync of yesterdays dump file. The rsync today should copy over only the deltas (i.e. differences).  The rsync started at about Sun Nov 5 17:36:05 UTC 2017 That took 2m9.091s The MD5 matches.</p>
</blockquote>

<ul>
<li>The restore</li>
</ul>

<blockquote>
<p>The restore should take about 30 minutes. I ran this test yesterday. It is now Sun Nov 5 17:40:03 UTC 2017.</p>

<p>```$ createdb -T template0 -E SQL_ASCII freshports.testing<br>
$ time pg_restore -j 16 -d freshports.testing freshports.org.9.6.dump</p>

<pre><code>Done.

```real    25m21.108s
user    1m57.508s
sys     0m15.172s
</code></pre>

<p>It is now Sun Nov 5 18:06:22 UTC 2017.</p>
</blockquote>

<ul>
<li>Insert break here</li>
</ul>

<blockquote>
<p>About here, I took a 30 minute break to run an errand. It was worth it.</p>
</blockquote>

<ul>
<li>Changing DNS</li>
</ul>

<blockquote>
<p>Im ready to change DNS now. It is Sun Nov 5 19:49:20 EST 2017 Done. And nearly immediately, traffic started.</p>
</blockquote>

<ul>
<li>How many misses?</li>
</ul>

<blockquote>
<p>During this process, XXXXX requests were declined:</p>

<pre><code>$ grep -c &#39;&quot; 503 &#39; /usr/websites/log/freshports.org-access.log
XXXXX
</code></pre>
</blockquote>

<ul>
<li>Thats it, were done</li>
</ul>

<blockquote>
<p>Total elapsed time: 1 hour 48 minutes. There are still a number of things to follow up on, but that was the transfers.</p>
</blockquote>

<ul>
<li><a href="http://dan.langille.org/2017/11/17/x8dtu-3/" rel="nofollow">The new FreshPorts Server</a>
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2017-November/005876.html" rel="nofollow">Using bhyve on top of CEPH</a></h3>

<ul>
<li>Hi,</li>
<li>Just an info point.</li>
<li>I&#39;m preparing for a lecture tomorrow, and thought why not do an actual demo.... Like to be friends with Murphy :)</li>
<li>So after I started the cluster:</li>
<li><p>5 jails with 7 OSDs</p></li>
<li><p>This what I manually needed to do to boot a memory stick</p></li>
<li><p>Start een Bhyve instance</p></li>
</ul>

<blockquote>
<p>rbd --dest-pool rbd_data --no-progress import memstick.img memstick<br>
rbd-ggate map rbd_data/memstick</p>
</blockquote>

<ul>
<li>ggate-devvice is available on /dev/ggate1</li>
</ul>

<blockquote>
<p>kldload vmm<br>
kldload nmdm<br>
kldload if_tap<br>
kldload if_bridge<br>
kldload cpuctl<br>
sysctl net.link.tap.up_on_open=1<br>
ifconfig bridge0 create<br>
ifconfig bridge0 addm em0 up<br>
ifconfig<br>
ifconfig tap11 create<br>
ifconfig bridge0 addm tap11<br>
ifconfig tap11 up</p>
</blockquote>

<ul>
<li>load the GGate disk in bhyve</li>
</ul>

<blockquote>
<p>bhyveload -c /dev/nmdm11A -m 2G -d /dev/ggate1 FB11</p>
</blockquote>

<ul>
<li>and boot a single from it.</li>
</ul>

<blockquote>
<p>bhyve -H -P -A -c 1 -m 2G -l com1,/dev/nmdm11A -s 0:0,hostbridge -s <br>
1:0,lpc -s 2:0,virtio-net,tap11 -s 4,ahci-hd,/dev/ggate1 FB11 &amp;<br>
bhyvectl --vm=FB11 --get-stats</p>
</blockquote>

<ul>
<li>Connect to the VM</li>
</ul>

<blockquote>
<p>cu -l /dev/nmdm11B</p>
</blockquote>

<ul>
<li>And that&#39;ll give you a bhyve VM running on an RBD image over ggate.</li>
<li>In the installer I tested reading from the bootdisk:</li>
</ul>

<blockquote>
<p>root@:/ # dd if=/dev/ada0 of=/dev/null bs=32M<br>
21+1 records in<br>
21+1 records out<br>
734077952 bytes transferred in 5.306260 secs (138341865 bytes/sec)</p>
</blockquote>

<ul>
<li>which is a nice 138Mb/sec.</li>
<li>Hope the demonstration does work out tomorrow.</li>
<li>--WjW
***</li>
</ul>

<h3><a href="http://yakshav.es/the-patron-saint-of-yakshaves/" rel="nofollow">Donald Knuth - The Patron Saint of Yak Shaves</a></h3>

<ul>
<li>Excerpts:</li>
</ul>

<blockquote>
<p>In 2015, I gave a talk in which I called Donald Knuth the Patron Saint of Yak Shaves. The reason is that Donald Knuth achieved the most perfect and long-running yak shave: TeX. I figured this is worth repeating.</p>
</blockquote>

<ul>
<li>How to achieve the ultimate Yak Shave</li>
</ul>

<blockquote>
<p>The ultimate yak shave is the combination of improbable circumstance, the privilege to be able to shave at your hearts will and the will to follow things through to the end. Heres the way it was achieved with TeX. The recount is purely mine, inaccurate and obviously there for fun. Ill avoid the most boring facts that everyone always tells, such as why Knuths checks have their own Wikipedia page.</p>
</blockquote>

<ul>
<li>Community Shaving is Best Shaving</li>
</ul>

<blockquote>
<p>Since the release of TeX, the community has been busy working on using it as a platform. If you ever downloaded the full TeX distribution, please bear in mind that you are downloading the amassed work of over 40 years, to make sure that each and every TeX document ever written builds. Were talking about documents here.<br>
But mostly, two big projects sprung out of that. The first is LaTeX by Leslie Lamport. Lamport is a very productive researcher, famous for research in formal methods through TLA+ and also known laying groundwork for many distributed algorithms. LaTeX is based on the idea of separating presentation and content. It is based around the idea of document classes, which then describe the way a certain document is laid out. Think Markdown, just much more complex. The second is ConTeXt, which is far more focused on fine grained layout control.</p>
</blockquote>

<ul>
<li>The Moral of the Story</li>
</ul>

<blockquote>
<p>Whenever you feel like cant we just replace this whole thing, it cant be so hard when handling TeX, dont forget how many years of work and especially knowledge were poured into that system. Typesetting isnt the most popular knowledge around programmers. Especially see it in the context of the space it is in: they cant remove legacy. Ever. That would break documents.<br>
TeX is also not a programming language. It might resemble one, but mostly, it should be approached as a typesetting system first. A lot of it&#39;s confusing lingo gets much better then. Its not programming lingo. By approaching TeX with an understanding for its history, a lot of things can be learned from it. And yes, a replacement would be great, but it would take ages.<br>
In any case, I hope I thoroughly convinced you why Donald Knuth is the Patron Saint of Yak Shaves.</p>
</blockquote>

<ul>
<li>Extra Credits</li>
</ul>

<blockquote>
<p>This comes out of a enjoyable discussion with [Arne from Lambda Island](<a href="https://lambdaisland.com/https://lambdaisland.com/" rel="nofollow">https://lambdaisland.com/https://lambdaisland.com/</a>, who listened and said you should totally turn this into a talk.</p>

<hr>
</blockquote>

<h3><a href="http://www.vincentdelft.be/post/post_20171016" rel="nofollow">Vincents trip to EuroBSDCon 2017</a></h3>

<ul>
<li>My euroBSDCon 2017</li>
<li>Posted on 2017-10-16 09:43:00 from Vincent in Open Bsd</li>
</ul>

<blockquote>
<p>Let me just share my feedback on those 2 days spent in Paris for the EuroBSDCon. My 1st BSDCon. I&#39;m not a developer, contributor, ... Do not expect to improve your skills with OpenBSD with this text :-) I know, we are on October 16th, and the EuroBSDCon of Paris was 3 weeks ago :( I&#39;m not quick !!! Sorry for that<br>
Arrival at 10h, I&#39;m too late for the start of the key note.  The few persons behind a desk welcome me by talking in Dutch, mainly because of my name. Indeed, Delft is a city in Netherlands, but also a well known university. I inform them that I&#39;m from Belgium, and the discussion moves to the fact the Fosdem is located in Brussels. I receive my nice T-shirt white and blue, a bit like the marine T-shirts, but with the nice EuroBSDCon logo. I&#39;m asking where are the different rooms reserved for the BSD event. We have 1 big on the 1st floor, 1 medium 1 level below, and 2 smalls 1 level above. All are really easy to access.  In this entrance we have 4 or 5 tables with some persons representing their company. Those are mainly the big sponsors of the event providing details about their activity and business. I discuss a little bit with StormShield and Gandi.  On other tables people are selling BSD t-shirts, and they will quickly be sold.</p>
</blockquote>

<ul>
<li>&quot;Is it done yet ?&quot; The never ending story of pkg tools</li>
</ul>

<blockquote>
<p>In the last Fosdem, I&#39;ve already hear Antoine and Baptiste presenting the OpenBSD and FreeBSD battle, I decide to listen Marc Espie in the medium room called Karnak. Marc explains that he has rewritten completely the pkg_add command. He explains that, at contrario with other elements of OpenBSD, the packages tools must be backward compatible and stable on a longer period than 12 months (the support period for OpenBSD).  On the funny side, he explains that he has his best idea inside his bath. Hackathons are also used to validate some ideas with other OpenBSD developers. All in all, he explains that the most time consuming part is to imagine a good solution. Coding it is quite straightforward. He adds that better an idea is, shorter the implementation will be.</p>
</blockquote>

<ul>
<li>A Tale of six motherboards, three BSDs and coreboot</li>
</ul>

<blockquote>
<p>After the lunch I decide to listen the talk about Coreboot. Indeed, 1 or 2 years ago I had listened the Libreboot project at Fosdem. Since they did several references to Coreboot, it&#39;s a perfect occasion to listen more carefully to this project. Piotr and Katazyba Kubaj explains us how to boot a machine without the native Bios. Indeed Coreboot can replace the bios, and de facto avoid several binaries imposed by the vendor. They explain that some motherboards are supporting their code. But they also show how difficult it is to flash a Bios and replace it by Coreboot. They even have destroyed a motherboard during the installation. Apparently because the power supply they were using was not stable enough with the 3v. It&#39;s really amazing to see that open source developers can go, by themselves, to such deep technical level.</p>
</blockquote>

<ul>
<li>State of the DragonFly&#39;s graphics stack</li>
</ul>

<blockquote>
<p>After this Coreboot talk, I decide to stay in the room to follow the presentation of Fran?ois Tigeot. Fran?ois is now one of the core developer of DrangonflyBSD, an amazing BSD system having his own filesystem called Hammer. Hammer offers several amazing features like snapshots, checksum data integrity, deduplication, ... Francois has spent his last years to integrate the video drivers developed for Linux inside DrangonflyBSD. <br>
He explains that instead of adapting this code for the video card to the kernel API of DrangonflyBSD, he has &quot;simply&quot; build an intermediate layer between the kernel of DragonflyBSD and the video drivers. This is not said in the talk, but this effort is very impressive. Indeed, this is more or less a linux emulator inside DragonflyBSD.  Francois explains that he has started with Intel video driver (drm/i915), but now he is able to run drm/radeon quite well, but also drm/amdgpu and drm/nouveau.</p>
</blockquote>

<ul>
<li>Discovering OpenBSD on AWS</li>
</ul>

<blockquote>
<p>Then I move to the small room at the upper level to follow a presentation made by Laurent Bernaille on OpenBSD and AWS. First Laurent explains that he is re-using the work done by Antoine Jacoutot concerning the integration of OpenBSD inside AWS. But on top of that he has integrated several other Open Source solutions allowing him to build OpenBSD machines very quickly with one command. Moreover those machines will have the network config, the required packages, ... On top of the slides presented, he shows us, in a real demo, how this system works. Amazing presentation which shows that, by putting the correct tools together, a machine builds and configure other machines in one go. </p>
</blockquote>

<ul>
<li>OpenBSD Testing Infrastructure Behind bluhm.genua.de</li>
</ul>

<blockquote>
<p>Here Jan Klemkow explains us that he has setup a lab where he is able to run different OpenBSD architectures. The system has been designed to be able to install, on demand, a certain version of OpenBSD on the different available machines. On top of that a regression test script can be triggered. This provides reports showing what is working and what is not more working on the different machines.  If I&#39;ve well understood, Jan is willing to provide such lab to the core developers of OpenBSD in order to allow them to validate easily and quickly their code.  Some more effort is needed to reach this goal, but with what exists today, Jan and his colleague are quite close. Since his company is using OpenBSD business, to his eyes this system is a &quot;tit for tat&quot; to the OpenBSD community.</p>
</blockquote>

<ul>
<li>French story on cybercrime</li>
</ul>

<blockquote>
<p>Then comes the second keynote of the day in the big auditorium. This talk is performed by the colonel of french gendarmerie. Mr Freyssinet, who is head of the Cyber crimes unit inside the Gendarmerie.  Mr Freyssinet explains that the &quot;bad guys&quot; are more and more volatile across countries, and more and more organized. The small hacker in his room, alone, is no more the reality. As a consequence the different national police investigators are collaborating more inside an organization called Interpol.  What is amazing in his talk is that Mr Freyssinet talks about &quot;Crime as a service&quot;. Indeed, more and more hackers are selling their services to some &quot;bad and temporary organizations&quot;. </p>
</blockquote>

<ul>
<li>Social event</li>
</ul>

<blockquote>
<p>It&#39;s now time for the famous social event on the river: la Seine.  The organizers ask us to go, by small groups, to a station. There is a walk of 15 minutes inside Paris. Hopefully the weather is perfect. To identify them clearly several organizers takes a &quot;beastie fork&quot; in their hands and walk on the sidewalk generating some amazing reactions from some citizens and toursits. Some of them recognize the Freebsd logo and ask us some details. Amazing :-)<br>
We walk on small and big sidewalks until a small stair going under the street. There, we have a train station a bit like a metro station. 3 stations later they ask us to go out. We walk few minutes and come in front of a boat having a double deck: one inside, with nice tables and chairs and one on the roof. But the crew ask us to go up, on the second deck. There, we are welcome with a glass of wine. The tour Eiffel is just at few 100 meters from us. Every hour the Eiffel tower is blinking for 5 minutes with thousands of small lights. Brilliant :-) <br>
We see also the &quot;statue de la libertee&quot; (the small one) which is on a small island in the middle of the river.  During the whole night the bar will be open with drinks and some appetizers, snacks, ...  Such walking diner is perfect to talk with many different persons.  I&#39;ve discussed with several persons just using BSD, they are not, like me, deep and specialized developers. One was from Switzerland, another one from Austria, and another one from Netherlands. But I&#39;ve also followed a discussion with Theo de Raadt, several persons of the FreeBSD foundation. Some are very technical guys, other just users, like me. But all with the same passion for one of the BSD system. Amazing evening.</p>
</blockquote>

<ul>
<li>OpenBSD&#39;s small steps towards DTrace (a tale about DDB and CTF)</li>
</ul>

<blockquote>
<p>On the second day, I decide to sleep enough in order to have enough resources to drive back to my home (3 hours by car). So I miss the 1st presentations, and arrive at the event around 10h30. Lot of persons are already present. Some faces are less &quot;fresh&quot; than others.<br>
I decide to listen to Dtrace in OpenBSD. After 10 minutes I am so lost into those too technical explainations, that I decide to open and look at my PC. My OpenBSD laptop is rarely leaving my home, so I&#39;ve never had the need to have a screen locking system. In a crowded environment, this is better. So I was looking for a simple solution. I&#39;ve looked at how to use xlock. I&#39;ve combined it with the /ets/apm/suspend script, ... Always very easy to use OpenBSD :-)</p>
</blockquote>

<ul>
<li>The OpenBSD web stack</li>
</ul>

<blockquote>
<p>Then I decide to follow the presentation of Michael W Lucas. Well know person for his different books about &quot;Absolute OpenBSD&quot;, Relayd&quot;, ...  Michael talks about the httpd daemon inside OpenBSD. But he also present his integration with Carp, Relayd, PF, FastCGI, the rules based on LUA regexp (opposed to perl regexp), ... For sure he emphasis on the security aspect of those tools: privilege separation, chroot, ...</p>
</blockquote>

<ul>
<li>OpenSMTPD, current state of affairs</li>
</ul>

<blockquote>
<p>Then I follow the presentation of Gilles Chehade about the OpenSMTPD project.  Amazing presentation that, on top of the technical challenges, shows how to manage such project across the years. Gilles is working on OpenSMTPD since 2007, thus 10 years !!!.  He explains the different decisions they took to make the software as simple as possible to use, but as secure as possible, too: privilege separation, chroot, pledge, random malloc, ? . The development starts on BSD systems, but once quite well known they received lot of contributions from Linux developers. </p>
</blockquote>

<ul>
<li>Hoisting: lessons learned integrating pledge into 500 programs</li>
</ul>

<blockquote>
<p>After a small break, I decide to listen to Theo de Raadt, the founder of OpenBSD. In his own style, with trekking boots, shorts, backpack.  Theo starts by saying that Pledge is the outcome of nightmares. Theo explains that the book called &quot;Hacking blind&quot; presenting the BROP has worried him since few years.  That&#39;s why he developed Pledge as a tool killing a process as soon as possible when there is an unforeseen behavior of this program. For example, with Pledge a program which can only write to disk will be immediately killed if he tries to reach network.  By implementing Pledge in the +-500 programs present in the &quot;base&quot;, OpenBSD is becoming more secured and more robust.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>My first EuroBSDCon was a great, interesting and cool event. I&#39;ve discussed with several BSD enthusiasts. I&#39;m using OpenBSD since 2010, but I&#39;m not a developer, so I was worried to be &quot;lost&quot; in the middle of experts. In fact it was not the case. At EuroBSDCon you have many different type of enthusiasts BSD&#39;s users. What is nice with the EuroBSDCon is that the organizers foresee everything for you. You just have to sit and listen. They foresee even how to spend, in a funny and very cool attitude, the evening of Saturday. &gt; The small draw back is that all of this has a cost. In my case the whole weekend cost me a bit more than 500euro. Based on what I&#39;ve learned, what I&#39;ve saw this is very acceptable price. Nearly all presentations I saw give me a valuable input for my daily job.  For sure, the total price is also linked to my personal choice: hotel, parking.  And I&#39;m surely biased because I&#39;m used to go to the Fosdem in Brussels which cost nothing (entrance) and is approximately 45 minutes of my home. But Fosdem is not the same atmosphere and presentations are less linked to my daily job.<br>
I do not regret my trip to EuroBSDCon and will surely plan other ones.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.jwz.org/blog/2017/10/important-munitions-lawyering/" rel="nofollow">Important munitions lawyering</a></li>
<li><a href="https://2018.asiabsdcon.org/" rel="nofollow">AsiaBSDCon 2018 CFP is now open, until December 15th</a></li>
<li><a href="https://www.youtube.com/watch?v=hWnWEitDPlM&feature=share" rel="nofollow">ZSTD Compression for ZFS by Allan Jude</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/netbsd_on_allwinner_socs_update" rel="nofollow">NetBSD on Allwinner SoCs Update</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/0FKTJK3#wrap" rel="nofollow">Tim - Creating Multi Boot USB sticks</a></li>
<li><a href="http://dpaste.com/1HY5MFB" rel="nofollow">Nomen - ZFS Questions</a></li>
<li><a href="http://dpaste.com/3ZGNSK9#wrap" rel="nofollow">JJ - Questions</a></li>
<li><a href="http://dpaste.com/3TRXXN4" rel="nofollow">Lars - Hardening Diffie-Hellman</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>221: BSD in Taiwan</title>
  <link>https://www.bsdnow.tv/221</link>
  <guid isPermaLink="false">c223b460-2a15-4458-87f8-0f1b7e5947db</guid>
  <pubDate>Wed, 22 Nov 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c223b460-2a15-4458-87f8-0f1b7e5947db.mp3" length="84011764" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Allan reports on his trip to BSD Taiwan, new versions of Lumina and GhostBSD are here, a bunch of OpenBSD p2k17 hackathon reports.</itunes:subtitle>
  <itunes:duration>1:56:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Allan reports on his trip to BSD Taiwan, new versions of Lumina and GhostBSD are here, a bunch of OpenBSD p2k17 hackathon reports.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Allan’s Trip Report from BSD Taiwan (https://bsdtw.org/)
BSD TW and Taiwan in general was a fun and interesting experience
I arrived Thursday night and took the high speed train to Taipei main station, and then got on the Red line subway to the venue. The dorm rooms were on par with BSDCan, except the mattress was better.
I spent Friday with a number of other FreeBSD developers doing touristy things. We went to Taipei 101, the world’s tallest building from 2004 - 2010. It also features the world’s fastest elevator (2004 - 2016), traveling at 60.6 km/h and transporting passengers from the 5th to 89th floor in 37 seconds.
We also got to see the “tuned mass damper”, a 660 tonne steel pendulum suspended between the 92nd and 87th floors. This device resists the swaying of the building caused by high winds. There are interesting videos on display beside the damper, of its reaction during recent typhoons and earthquakes. The Taipei 101 building sits just 200 meters from a major fault line.
Then we had excellent dumplings for lunch
After walking around the city for a few more hours, we retired to a pub to escape the heat of the sunny Friday afternoon.
Then came the best part of each day in Taipei, dinner!
We continued our efforts to cause a nation wide shortage of dumplings
Special thanks to Scott Tsai (https://twitter.com/scottttw) who took detailed notes for each of the presentations
Saturday marked the start of the conference:
Arun Thomas provided background and then a rundown of what is happening with the RISC-V architecture. Notes (https://docs.google.com/document/d/1yrnhNTHaMDr4DG-iviXN0O9NES9Lmlc7sWVQhnios6g/edit#heading=h.kcm1n3yzl35q)
George Neville-Neil talked about using DTrace in distributed systems as an in-depth auditing system (who did what to whom and when). Notes (https://docs.google.com/document/d/1qut6tMVF8NesrGHd6bydLDN-aKBdXMgHx8Vp3_iGKjQ/edit#heading=h.qdghsgk1bgtl)
Baptiste Daroussin presented Poudrière image, an extension of everyone’s favourite package building system, to build custom images of FreeBSD. There was discussion of making this generate ZFS based images as well, making it mesh very well with my talk the next day. Notes (https://docs.google.com/document/d/1LceXj8IWJeTRHp9KzOYy8tpM00Fzt7fSN0Gw83B9COE/edit#heading=h.incfzi6bnzxr)
Brooks Davis presented his work on an API design for a replacement for mmap. It started with a history of address space management in the BSD family of operating systems going all the way back to the beginning. This overview of the feature and how it evolved filled in many gaps for me, and showed why the newer work would be beneficial. The motivation for the work includes further extensions to support the CHERI hardware platform. Notes (https://docs.google.com/document/d/1LceXj8IWJeTRHp9KzOYy8tpM00Fzt7fSN0Gw83B9COE/edit#heading=h.incfzi6bnzxr)
Johannes M Dieterich gave an interesting presentation about using FreeBSD and GPU acceleration for high performance computing. One of the slides showed that amd64 has taken almost the entire market for the top 500 super computers, and that linux dominates the list, with only a few remaining non-linux systems. Sadly, at the supercomputing conference the next week, it was announced that linux has achieved 100% saturation of the top 500 super computers list. Johannes detailed the available tools, what ports are missing, what changes should be made to the base system (mostly OpenMP), and generally what FreeBSD needs to do to become a player in the supercomputer OS market. Johannes’ perspective is interesting, as he is a computational chemist, not a computer scientist. Those interested in improving the numerical libraries and GPU acceleration frameworks on FreeBSD should join the ports team. Notes (https://docs.google.com/document/d/1uaJiqtPk8WetST6_GnQwIV49bj790qx7ToY2BHC9zO4/edit#heading=h.nvsz1n6w3gyq)
The final talk of the day was Peter Grehan, who spoke about how graphics support in bhyve came to be. He provided a history of how the feature evolved, and where it stands today. Notes (https://docs.google.com/document/d/1LqJQJUwdUwWZ0n5KwCH1vNI8jiWGJlI1j0It3mERN80/edit#heading=h.sgeixwgz7bjs)
Afterwards, we traveled as a group to a large restaurant for dinner. There was even Mongolian Vodka, provided by Ganbold Tsagaankhuu of the FreeBSD project.
Sunday:
The first talk of the day Sunday was mine. I presented “ZFS: Advanced Integration”, mostly talking about how boot environments work, and the new libbe and be(1) tools that my GSoC student Kyle Kneitinger created to manage them. I talked about how they can be used for laptop and developer systems, but also how boot environments can be used to replace nanobsd for appliances (as already done in FreeNAS and pfSense). I also presented about zfsbootcfg (zfs nextboot), and some future extensions to it to make it even more useful in appliance type workloads. I also provided a rundown of new developments out of the ZFS developer summit, two weeks previous. Notes (https://docs.google.com/document/d/1Blh3Dulf0O91A0mwv34UnIgxRZaS_0FU2lZ41KRQoOU/edit#heading=h.gypim387e8hy)
Theo de Raadt presented “Mitigations and other real Security Features”, and made his case for changing to a ‘fail closed’ mode of interoperability. Computer’s cannot actually self heal, so lets stop pretending that they can. Notes (https://docs.google.com/document/d/1fFHzlxJjbHPsV9t_Uh3PXZnXmkapAK5RkJsfaHki7kc/edit#heading=h.192e4lmbl70c)
Ruslan Bukin talked about doing the port of FreeBSD for RISC-V and writing the Device Drivers. Ruslan walked through the process step by step, leading members of the audience to suggest he turn it into a developer’s handbook article, explaining how to do the initial bringup on new hardware. Ruslan also showed off a FreeBSD/MIPS board he designed himself and had manufactured in China.  Notes (https://docs.google.com/document/d/1kRhRr3O3lQ-0dS0kYF0oh_S0_zFufEwrdFjG1QLyk8Y/edit#heading=h.293mameym7w1)
Mariusz Zaborski presented Case studies on sandboxing the base system with Capsicum. He discussed the challenges encountered as existing programs are modified to sandbox them, and recent advancements in the debugging tools available during that process. Mariusz also discussed the Casper service at length, including the features that are planned for 2018 and onwards. Notes (https://docs.google.com/document/d/1_0BpAE1jGr94taUlgLfSWlJOYU5II9o7Y3ol0ym1eZQ/edit#heading=h.xm9mh7dh6bay)
The final presentation of the day was Mark Johnston on Memory Management Improvements in FreeBSD 12.0. This talk provided a very nice overview of the memory management system in FreeBSD, and then detailed some of the recent improvements.  Notes (https://docs.google.com/document/d/1gFQXxsHM66GQGMO4-yoeFRTcmOP4NK_ujVFHIQJi82U/edit#heading=h.uirc9jyyti7w)
The conference wrapped up with the Work-in-Progress session, including updates on: multi-device-at-once GELI attach, MP-safe networking on NetBSD, pkgsrc, NetBSD in general, BSD on Microsoft Azure, Mothra (send-pr for bugzilla), BSDMizer a machine learning compiler optimizer, Hyperledger Sawtooth (blockchain), and finally VIMAGE and pf testing on FreeBSD.
Notes (https://docs.google.com/document/d/1miHZEPrqrpCTh8JONmUKWDPYUmTuG2lbsVrWDtekvLc/edit#heading=h.orhedpjis5po)
Group Photo (https://pbs.twimg.com/media/DOh1txnVoAAFKAa.jpg:large)
BSDTW was a great conference. They are still considering if it should be an annual thing, trade off every 2nd year with AsiaBSDCon, or something else. In order to continue, BSD Taiwan requires more organizers and volunteers. They have regular meetups in Taipei if you are interested in getting involved.
***
Lumina 1.4.0 released (https://lumina-desktop.org/version-1-4-0-released/)
The Lumina Theme Engine (and associated configuration utility)
The Lumina theme engine is a new component of the “core” desktop, and provides enhanced theming capabilities for the desktop as well as all Qt5 applications. While it started out life as a fork of the “qt5ct” utility, it quickly grew all sorts of new features and functionality such as system-defined color profiles, modular theme components, and built-in editors/creators for all components. The backend of this engine is a standardized theme plugin for the Qt5 toolkit, so that all Qt5 applications will now present a unified appearance (if the application does not enforce a specific appearance/theme of it’s own). Users of the Lumina desktop will automatically have this plugin enabled: no special action is required.
Please note that the older desktop theme system for Lumina has been rendered obsolete by the new engine, but a settings-conversion path has already been implemented which should transition your current settings to the new engine the first time you login to Lumina 1.4.0. Custom themes for the older system may not be converted though, but it is trivial to copy/paste any custom stylesheets from the old system into the editor for the new theme engine to register/re-apply them as desired.
Lumina-Themes Repository
I also want to give a shout-out to the trueos/lumina-themes github repository contributors. All of the wallpapers in the 1.4.0 screenshots I posted come from that package, and they are working on making more wallpapers, color palettes, and desktop styles for use with the Lumina Theme Engine. If your operating system does not currently provide a package for lumina-themes, I highly recommend that you make one as soon as possible!
The Lumina PDF Viewer (lumina-pdf)
This is a new, stand-alone desktop utility for viewing/printing/presenting PDF documents. It uses the poppler-qt5 library in the backend for rendering the document, but uses multi-threading in many ways (such as to speed up the loading of pages) to give the user a nice, streamlined utility for viewing PDF documents. There is also built-in presentation functionality which allows users to easily cast the document to a separate screen without mucking about in system menus or configuration utilities.
Lumina PDF Viewer (1.4.0)
Important Packaging Changes
One significant change of note for people who are packaging Lumina for their particular operating system is that the minimum supported versions of Qt for Lumina have been changed with this release:

lumina-core: Qt 5.4+
lumina-mediaplayer: Qt 5.7+
Everything else: Qt 5.2+

Of course, using the latest version of the Qt5 libraries is always recommended.
When packaging for Linux distributions, the theme engine also requires the availability of some of the “-dev” packages for Qt itself when compiling the theme plugin. For additional information (specifically regarding Ubuntu builds), please take a look at a recent ticket on the Lumina repository.
+ The new lumina-pdf utility requires the availability of the “poppler-qt5” library. The includes for this library on Ubuntu 17.10 were found to be installed outside of the normal include directories, so a special rule for it was added to our OS-Detect file in the Lumina source tree. If your particular operating system also places the the poppler include files in a non-standard place, please patch that file or send us the information and we can add more special rules for your particular OS.
Other Changes of Note (in no particular order)
lumina-config:
Add a new page for changing audio theme (login, logout, low battery)
Add option to replace fluxbox with some other WM (with appropriate warnings)
Have the “themes” page redirect to launching the Lumina theme engine configuration utility.
start-lumina-desktop:
Auto-detect the active X11 displays and create a new display for the Lumina session (prevent conflict with prior graphical sessions).
Add a process-failure counter &amp;amp; restart mechanism. This is particularly useful for restarting Fluxbox from time to time (such as after any monitor addition/removal)
lumina-xconfig:
Restart fluxbox after making any monitor changes with xrandr. This ensures a more reliable session.
Implement a  new 2D monitor layout mechanism. This allows for the placement of monitors anywhere in the X/Y plane, with simplification buttons for auto-tiling the monitors in each dimension based on their current location.
Add the ability to save/load monitor profiles.
Distinguish between the “default” monitor arrangement and the “current” monitor arrangement. Allow the user to set the current arrangement as the new default.
lumina-desktop:
Completely revamp the icon loading mechanisms so it should auto-update when the theme changes.
Speed up the initialization of the desktop quite a bit.
Prevent loading/probing files in the “/net/” path for existence (assume they exist in the interest of providing shortcuts). On FreeBSD, these are special paths that actually pause the calling process in order to mount/load a network share before resuming the process, and can cause significant “hangs” in the desktop process.
Add the ability to take a directory as a target for the wallpaper. This will open/probe the directory for any existing image files that it can use as a wallpaper and randomly select one.
Remove the popup dialog prompting about system updates, and replace it with new “Restart (with updates)” buttons on the appropriate menus/windows instead.
If no wallpapers selection is provided, try to use the “lumina-nature” wallpaper directory as the default, otherwise fall back on the original default wallpaper if the “lumina-themes” package is not installed.
lumina-open:
Make the *.desktop parsing a bit more flexible regarding quoted strings where there should not be any.
If selecting which application to use, only overwrite the user-default app if the option is explicitly selected.
lumina-fileinfo:
Significant cleanup of this utility. Now it can be reliably used for creating/registering XDG application shortcuts.
Add a whole host of new ZFS integrations:
If a ZFS dataset is being examined, show all the ZFS properties for that dataset.
If the file being examined exists within ZFS snapshots, show all the snapshots of the file
lumina-fm:
Significant use of additional multi-threading. Makes the loading of directories much faster (particularly ones with image files which need thumbnails)
Add detection/warning when running as root user. Also add an option to launch a new instance of lumina-fm as the root user.
[FreeBSD/TrueOS] Fix up the detection of the “External Devices” list to also list available devices for the autofs system.
Fix up some drag and drop functionality.
Expose the creation, extraction, and insertion of files into archives (requires lumina-archiver at runtime)
Expand the “Open With” option into a menu of application suggestions in addition to the “Other” option which runs “lumina-open” to find an application.
Provide an option to set the desktop wallpaper to the selected image file(s). (If the running desktop session is Lumina).
lumina-mediaplayer:
Enable the ability to playback local video files. (NOTE: If Qt5 is set to use the gstreamer multimedia backend, make sure you have the “GL” plugin installed for smooth video playback).
lumina-archiver:
Add CLI flags for auto-archive and auto-extract. This allows for programmatic/scriptable interactions with archives.
That is not mentioning all of the little bugfixes, performance tweaks, and more that are also included in this release.
***
The strongest KASLR, ever? (https://blog.netbsd.org/tnf/entry/the_strongest_kaslr_ever)
Re: amd64: kernel aslr support (https://mail-index.netbsd.org/tech-kern/2017/11/14/msg022594.html)
So, I did it. Now the kernel sections are split in sub-blocks, and are all randomized independently. See my drawing [1]. What it means in practice, is that Kernel ASLR is much more difficult to defeat: a cache attack will at most allow you to know that a given range is mapped as executable for example, but you don't know which sub-block of .text it is; a kernel pointer leak will at most allow you to reconstruct the layout of one sub-block, but you don't know the layout and address of the remaining blocks, and there can be many.
The size and number of these blocks is controlled by the split-by-file parameter in Makefile.amd64. Right now it is set to 2MB, which produces a kernel with ~23 allocatable (ie useful at runtime) sections, which is a third of the total number supported (BTSPACENSEGS = 64). I will probably reduce this parameter a bit in the future, to 1.5MB, or even 1MB.
All of that leaves us with about the most advanced KASLR implementation available out there. There are ways to improve it even more, but you'll have to wait a few weeks for that.
 If you want to try it out you need to make sure you have the latest versions of GENERICKASLR / prekern / bootloader. The instructions are still here, and haven't changed.
Initial design
As I said in the previous episode, I added in October a Kernel ASLR implementation in NetBSD for 64bit x86 CPUs. This implementation would randomize the location of the kernel in virtual memory as one block: a random VA would be chosen, and the kernel ELF sections would be mapped contiguously starting from there.
This design had several drawbacks: one leak, or one successful cache attack, could be enough to reconstruct the layout of the entire kernel and defeat KASLR.
NetBSD’s new KASLR design significantly improves this situation.
New design
In the new design, each kernel ELF section is randomized independently. That is to say, the base addresses of .text, .rodata, .data and .bss are not correlated. KASLR is already at this stage more difficult to defeat, since you would need a leak or cache attack on each of the kernel sections in order to reconstruct the in-memory kernel layout.
Then, starting from there, several techniques are used to strengthen the implementation even more.
Sub-blocks
The kernel ELF sections are themselves split in sub-blocks of approximately 1MB. The kernel therefore goes from having:

    { .text .rodata .data .bss }

to having

    { .text .text.0 .text.1 ... .text.i .rodata .rodata.0 ... .rodata.j ... .data ...etc }

As of today, this produces a kernel with ~33 sections, each of which is mapped at a random address and in a random order.
This implies that there can be dozens of .text segments. Therefore, even if you are able to conduct a cache attack and determine that a given range of memory is mapped as executable, you don’t know which sub-block of .text it is. If you manage to obtain a kernel pointer via a leak, you can at most guess the address of the section it finds itself in, but you don’t know the layout of the remaining 32 sections. In other words, defeating this KASLR implementation is much more complicated than in the initial design.
Higher entropy
Each section is put in a 2MB-sized physical memory chunk. Given that the sections are 1MB in size, this leaves half of the 2MB chunk unused. Once in control, the prekern shifts the section within the chunk using a random offset, aligned to the ELF alignment constraint. This offset has a maximum value of 1MB, so that once shifted the section still resides in its initial 2MB chunk:
The prekern then maps these 2MB physical chunks at random virtual addresses; but addresses aligned to 2MB. For example, the two sections in Fig. A will be mapped at two distinct VAs:
There is a reason the sections are shifted in memory: it offers higher entropy. If we consider a .text.i section with a 64byte ELF alignment constraint, and give a look at the number of possibilities for the location of the section in memory:
The prekern shifts the 1MB section in its 2MB chunk, with an offset aligned to 64 bytes. So there are (2MB-1MB)/(64B)=214 possibilities for the offset.
Then, the prekern uses a 2MB-sized 2MB-aligned range of VA, chosen in a 2GB window. So there are (2GB-2MB)/(2MB)=210-1 possibilities for the VA.
Therefore, there are 214x(210-1)˜224 possible locations for the section. As a comparison with other systems:

OS  # of possibilities
Linux   2^6
MacOS   2^8
Windows 2^13
NetBSD  2^24

Of course, we are talking about one .text.i section here; the sections that will be mapped afterwards will have fewer location possibilities because some slots will be already occupied. However, this does not alter the fact that the resulting entropy is still higher than that of the other implementations. Note also that several sections have an alignment constraint smaller than 64 bytes, and that in such cases the entropy is even higher.
Large pages
There is also a reason we chose to use 2MB-aligned 2MB-sized ranges of VAs: when the kernel is in control and initializes itself, it can now use large pages to map the physical 2MB chunks. This greatly improves memory access performance at the CPU level.
Countermeasures against TLB cache attacks
With the memory shift explained above, randomness is therefore enforced at both the physical and virtual levels: the address of the first page of a section does not equal the address of the section itself anymore.
It has, as a side effect, an interesting property: it can mostly mitigate TLB cache attacks. Such attacks operate at the virtual-page level; they will allow you to know that a given large page is mapped as executable, but you don’t know where exactly within that page the section actually begins.
Strong?
This KASLR implementation, which splits the kernel in dozens of sub-blocks, randomizes them independently, while at the same time allowing for higher entropy in a way that offers large page support and some countermeasures against TLB cache attacks, appears to be the most advanced KASLR implementation available publicly as of today. 
Feel free to prove me wrong, I would be happy to know!
WIP
Even if it is in a functional state, this implementation is still a work in progress, and some of the issues mentioned in the previous blog post haven't been addressed yet. But feel free to test it and report any issue you encounter. Instructions on how to use this implementation can still be found in the previous blog post, and haven’t changed since.
See you in the next episode!
News Roundup
GhostBSD 11.1 Finally Ready and Available! (http://www.ghostbsd.org/11.1_release_announcement)
Screenshots (https://imgur.com/a/Mu8xk)
After a year of development, testing, debugging and working on our software package repository, we are pleased to announce the release of GhostBSD 11.1 is now available on 64-bit(amd64) architecture with MATE and XFCE Desktop on direct and torrent download. With 11.1 we drop 32-bit i386 supports, and we currently maintain our software packages repository for more stability.
What's new on GhostBSD 11.1
GhostBSD software repository
Support VMware Workstation Guest Features
New UFS full disk mirroring option on the installer
New UFS full disk MBR and GPT option on the installer
New UFS full disk swap size option on the installer
Whisker Menu as default Application menu on XFCE
All software developed by GhostBSD is now getting updated
ZFS configuration for disk
What has been fixed on 11.1?
Fix XFCE sound plugin
Installer ZFS configuration file setting
Installer ZFS setup appears to be incomplete
The installer was not listing ZFS disk correctly.
The installer The partition list was not deleted when pressing back
XFCE and MATE shutdown/suspend/hibernate randomly missing
Clicking 'GhostBSD Bugs' item in the Main menu -&amp;gt; 'System Tools' brings up 'Server not found' page
XFCE installation - incorrect keyboard layout
Locale setting not filling correctly
Update Station tray icon
The image checksum's, hybrid ISO(DVD, USB) images are available at GhostBSD (http://www.ghostbsd.org/download).
***
p2k17 Hackathon Reports
p2k17 Hackathon Report: Matthias Kilian on xpdf, haskell, and more (https://undeadly.org/cgi?action=article;sid=20171107034258)
p2k17 Hackathon Report: Herzliche grusse vom Berlin (espie@ on mandoc, misc packages progress) (https://undeadly.org/cgi?action=article;sid=20171107185122)
p2k17 Hackathon Report: Paul Irofti (pirofti@) on hotplugd(8), math ports, xhci(4) and other kernel advancements (https://undeadly.org/cgi?action=article;sid=20171107225258)
p2k17 Hackathon report: Jeremy Evans on ruby progress, postgresql and webdriver work (https://undeadly.org/cgi?action=article;sid=20171108072117)
p2k17 Hackathon report: Christian Weisgerber on random devices, build failures and gettext (https://undeadly.org/cgi?action=article;sid=20171109171447)
p2k17 Hackathon report: Sebastian Reitenbach on Puppet progress (https://undeadly.org/cgi?action=article;sid=20171110124645)
p2k17 Hackathon Report: Anthony J. Bentley on firmware, games and securing pkg_add runs (https://undeadly.org/cgi?action=article;sid=20171110124656)
p2k17 Hackathon Report: Landry Breuil on Mozilla things and much more (https://undeadly.org/cgi?action=article;sid=20171113091807)
p2k17 Hackathon report: Florian Obser on network stack progress, kernel relinking and more (https://undeadly.org/cgi?action=article;sid=20171113235334)
p2k17 Hackathon report: Antoine Jacoutot on ports+packages progress (https://undeadly.org/cgi?action=article;sid=20171120075903)
***
TrueOS Talks
Tech and Open Source at Pellissippi State (https://www.trueos.org/blog/trueos-talks-tech-open-source-pellissippi-state/)
Ken Moore of the TrueOS project presented a talk to the AITP group at Pellissippi State today entitled “It’s A Unix(-like) system? An Introduction to TrueOS and Open source”. Joshua Smith of the TrueOS project was also in attendance. 
We were happy to see a good attendance of about 40 individuals that came to hear more about TrueOS and how we continue to innovate along with the FreeBSD project. Many good questions were raised about development, snapshots, cryptocurrency, and cyber-security. We’ve included a copy of the slides if you’d like to have a look at the talk on open source. We’d like to offer a sincere thanks to everyone who attended and offer an extended invitation for you to join us at our KnoxBUG group on October 30th @ the iXsystems offices! We hope to see you soon!
Open Source Talk – Slideshare PDF (https://web.trueos.org/wp-content/uploads/2017/10/Open-Source-Talk.pdf)
KnoxBug - Lumina Rising : Challenging Desktop Orthodoxy (http://knoxbug.org/content/octobers-talk-available-youtube)
Ken gave his talk about the new Lumina 2.0 Window Manager that he gave at Ohio LinuxFest 2017
KnoxBUG October 2017 (https://youtu.be/w3ZrqxLTnIU)
(OLF 2017) Lumina Rising: Challenging Desktop Orthodoxy (https://www.slideshare.net/beanpole135/olf-2017-lumina-rising-challenging-desktop-orthodoxy)
***
Official OpenBSD 6.2 CD set - the only one to be made! (https://undeadly.org/cgi?action=article;sid=20171118190325)
Our dear friend Bob Beck (beck@) writes:
So, again this release the tradition of making Theo do art has continued!
Up for sale by auction to the highest bidder on Ebay is the only OpenBSD 6.2 CD set to be produced.
The case and CD's feature the 6.2 artwork, custom drawn and signed by Theo.
All proceeds to support OpenBSD
Go have a look at the auction
As with previous OpenBSD auctions, if you are not the successful bidder, we would like to encourage you to donate the equivalent of you highest bid to the project.
The Auction (https://www.ebay.ca/itm/Official-OpenBSD-6-2-CD-Set/253265944606)
***
Beastie Bits
HAMMER2 userspace on Linux (http://lists.dragonflybsd.org/pipermail/users/2017-October/313646.html)
OpenBSD Porting Workshop (now changed to January 3, 2018) (http://www.nycbug.org/index.cgi?action=view&amp;amp;id=10655)
Matt Ahrens on when Native Encryption for ZFS will land (https://twitter.com/mahrens1/status/921204908094775296)
The first successful build of OpenBSD base system (http://nanxiao.me/en/the-first-successful-build-of-openbsd-base-system/)
KnoxBug November Meeting (https://www.meetup.com/KnoxBUG-BSD-Linux-and-FOSS-Users-Unite/events/245291204/)
Absolute FreeBSD, 3rd Edition, pre-orders available (https://www.michaelwlucas.com/os/af3e)
Feedback/Questions
Jon - Jails and Networking (http://dpaste.com/2BEW0HB#wrap)
Nathan - bhyve Provisioning (http://dpaste.com/1GHSYJS#wrap)
Lian - OpenSSL jumping the Shark (http://dpaste.com/18P8D8C#wrap)
Kim - Suggestions (http://dpaste.com/1VE0K9E#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Allan reports on his trip to BSD Taiwan, new versions of Lumina and GhostBSD are here, a bunch of OpenBSD p2k17 hackathon reports.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://bsdtw.org/" rel="nofollow">Allans Trip Report from BSD Taiwan</a></h3>

<ul>
<li>BSD TW and Taiwan in general was a fun and interesting experience</li>
<li>I arrived Thursday night and took the high speed train to Taipei main station, and then got on the Red line subway to the venue. The dorm rooms were on par with BSDCan, except the mattress was better.</li>
<li>I spent Friday with a number of other FreeBSD developers doing touristy things. We went to Taipei 101, the worlds tallest building from 2004 - 2010. It also features the worlds fastest elevator (2004 - 2016), traveling at 60.6 km/h and transporting passengers from the 5th to 89th floor in 37 seconds.</li>
<li>We also got to see the tuned mass damper, a 660 tonne steel pendulum suspended between the 92nd and 87th floors. This device resists the swaying of the building caused by high winds. There are interesting videos on display beside the damper, of its reaction during recent typhoons and earthquakes. The Taipei 101 building sits just 200 meters from a major fault line.</li>
<li>Then we had excellent dumplings for lunch</li>
<li>After walking around the city for a few more hours, we retired to a pub to escape the heat of the sunny Friday afternoon.</li>
<li>Then came the best part of each day in Taipei, dinner!</li>
<li>We continued our efforts to cause a nation wide shortage of dumplings</li>
<li>Special thanks to <a href="https://twitter.com/scottttw" rel="nofollow">Scott Tsai</a> who took detailed notes for each of the presentations</li>
<li>Saturday marked the start of the conference:

<ul>
<li>Arun Thomas provided background and then a rundown of what is happening with the RISC-V architecture. <a href="https://docs.google.com/document/d/1yrnhNTHaMDr4DG-iviXN0O9NES9Lmlc7sWVQhnios6g/edit#heading=h.kcm1n3yzl35q" rel="nofollow">Notes</a></li>
<li>George Neville-Neil talked about using DTrace in distributed systems as an in-depth auditing system (who did what to whom and when). <a href="https://docs.google.com/document/d/1qut6tMVF8NesrGHd6bydLDN-aKBdXMgHx8Vp3_iGKjQ/edit#heading=h.qdghsgk1bgtl" rel="nofollow">Notes</a></li>
<li>Baptiste Daroussin presented Poudrière image, an extension of everyones favourite package building system, to build custom images of FreeBSD. There was discussion of making this generate ZFS based images as well, making it mesh very well with my talk the next day. <a href="https://docs.google.com/document/d/1LceXj8IWJeTRHp9KzOYy8tpM00Fzt7fSN0Gw83B9COE/edit#heading=h.incfzi6bnzxr" rel="nofollow">Notes</a></li>
<li>Brooks Davis presented his work on an API design for a replacement for mmap. It started with a history of address space management in the BSD family of operating systems going all the way back to the beginning. This overview of the feature and how it evolved filled in many gaps for me, and showed why the newer work would be beneficial. The motivation for the work includes further extensions to support the CHERI hardware platform. <a href="https://docs.google.com/document/d/1LceXj8IWJeTRHp9KzOYy8tpM00Fzt7fSN0Gw83B9COE/edit#heading=h.incfzi6bnzxr" rel="nofollow">Notes</a></li>
<li>Johannes M Dieterich gave an interesting presentation about using FreeBSD and GPU acceleration for high performance computing. One of the slides showed that amd64 has taken almost the entire market for the top 500 super computers, and that linux dominates the list, with only a few remaining non-linux systems. Sadly, at the supercomputing conference the next week, it was announced that linux has achieved 100% saturation of the top 500 super computers list. Johannes detailed the available tools, what ports are missing, what changes should be made to the base system (mostly OpenMP), and generally what FreeBSD needs to do to become a player in the supercomputer OS market. Johannes perspective is interesting, as he is a computational chemist, not a computer scientist. Those interested in improving the numerical libraries and GPU acceleration frameworks on FreeBSD should join the ports team. <a href="https://docs.google.com/document/d/1uaJiqtPk8WetST6_GnQwIV49bj790qx7ToY2BHC9zO4/edit#heading=h.nvsz1n6w3gyq" rel="nofollow">Notes</a></li>
<li>The final talk of the day was Peter Grehan, who spoke about how graphics support in bhyve came to be. He provided a history of how the feature evolved, and where it stands today. <a href="https://docs.google.com/document/d/1LqJQJUwdUwWZ0n5KwCH1vNI8jiWGJlI1j0It3mERN80/edit#heading=h.sgeixwgz7bjs" rel="nofollow">Notes</a></li>
</ul></li>
<li>Afterwards, we traveled as a group to a large restaurant for dinner. There was even Mongolian Vodka, provided by Ganbold Tsagaankhuu of the FreeBSD project.</li>
<li>Sunday:

<ul>
<li>The first talk of the day Sunday was mine. I presented ZFS: Advanced Integration, mostly talking about how boot environments work, and the new libbe and be(1) tools that my GSoC student Kyle Kneitinger created to manage them. I talked about how they can be used for laptop and developer systems, but also how boot environments can be used to replace nanobsd for appliances (as already done in FreeNAS and pfSense). I also presented about zfsbootcfg (zfs nextboot), and some future extensions to it to make it even more useful in appliance type workloads. I also provided a rundown of new developments out of the ZFS developer summit, two weeks previous. <a href="https://docs.google.com/document/d/1Blh3Dulf0O91A0mwv34UnIgxRZaS_0FU2lZ41KRQoOU/edit#heading=h.gypim387e8hy" rel="nofollow">Notes</a></li>
<li>Theo de Raadt presented Mitigations and other real Security Features, and made his case for changing to a fail closed mode of interoperability. Computers cannot actually self heal, so lets stop pretending that they can. <a href="https://docs.google.com/document/d/1fFHzlxJjbHPsV9t_Uh3PXZnXmkapAK5RkJsfaHki7kc/edit#heading=h.192e4lmbl70c" rel="nofollow">Notes</a></li>
<li>Ruslan Bukin talked about doing the port of FreeBSD for RISC-V and writing the Device Drivers. Ruslan walked through the process step by step, leading members of the audience to suggest he turn it into a developers handbook article, explaining how to do the initial bringup on new hardware. Ruslan also showed off a FreeBSD/MIPS board he designed himself and had manufactured in China.  <a href="https://docs.google.com/document/d/1kRhRr3O3lQ-0dS0kYF0oh_S0_zFufEwrdFjG1QLyk8Y/edit#heading=h.293mameym7w1" rel="nofollow">Notes</a></li>
<li>Mariusz Zaborski presented Case studies on sandboxing the base system with Capsicum. He discussed the challenges encountered as existing programs are modified to sandbox them, and recent advancements in the debugging tools available during that process. Mariusz also discussed the Casper service at length, including the features that are planned for 2018 and onwards. <a href="https://docs.google.com/document/d/1_0BpAE1jGr94taUlgLfSWlJOYU5II9o7Y3ol0ym1eZQ/edit#heading=h.xm9mh7dh6bay" rel="nofollow">Notes</a></li>
<li>The final presentation of the day was Mark Johnston on Memory Management Improvements in FreeBSD 12.0. This talk provided a very nice overview of the memory management system in FreeBSD, and then detailed some of the recent improvements.  <a href="https://docs.google.com/document/d/1gFQXxsHM66GQGMO4-yoeFRTcmOP4NK_ujVFHIQJi82U/edit#heading=h.uirc9jyyti7w" rel="nofollow">Notes</a></li>
<li>The conference wrapped up with the Work-in-Progress session, including updates on: multi-device-at-once GELI attach, MP-safe networking on NetBSD, pkgsrc, NetBSD in general, BSD on Microsoft Azure, Mothra (send-pr for bugzilla), BSDMizer a machine learning compiler optimizer, Hyperledger Sawtooth (blockchain), and finally VIMAGE and pf testing on FreeBSD.
<a href="https://docs.google.com/document/d/1miHZEPrqrpCTh8JONmUKWDPYUmTuG2lbsVrWDtekvLc/edit#heading=h.orhedpjis5po" rel="nofollow">Notes</a></li>
</ul></li>
<li><a href="https://pbs.twimg.com/media/DOh1txnVoAAFKAa.jpg:large" rel="nofollow">Group Photo</a></li>
<li>BSDTW was a great conference. They are still considering if it should be an annual thing, trade off every 2nd year with AsiaBSDCon, or something else. In order to continue, BSD Taiwan requires more organizers and volunteers. They have regular meetups in Taipei if you are interested in getting involved.
***</li>
</ul>

<h3><a href="https://lumina-desktop.org/version-1-4-0-released/" rel="nofollow">Lumina 1.4.0 released</a></h3>

<ul>
<li>The Lumina Theme Engine (and associated configuration utility)</li>
<li>The Lumina theme engine is a new component of the core desktop, and provides enhanced theming capabilities for the desktop as well as all Qt5 applications. While it started out life as a fork of the qt5ct utility, it quickly grew all sorts of new features and functionality such as system-defined color profiles, modular theme components, and built-in editors/creators for all components. The backend of this engine is a standardized theme plugin for the Qt5 toolkit, so that all Qt5 applications will now present a unified appearance (if the application does not enforce a specific appearance/theme of its own). Users of the Lumina desktop will automatically have this plugin enabled: no special action is required.

<ul>
<li>Please note that the older desktop theme system for Lumina has been rendered obsolete by the new engine, but a settings-conversion path has already been implemented which should transition your current settings to the new engine the first time you login to Lumina 1.4.0. Custom themes for the older system may not be converted though, but it is trivial to copy/paste any custom stylesheets from the old system into the editor for the new theme engine to register/re-apply them as desired.</li>
</ul></li>
<li>Lumina-Themes Repository</li>
</ul>

<blockquote>
<p>I also want to give a shout-out to the trueos/lumina-themes github repository contributors. All of the wallpapers in the 1.4.0 screenshots I posted come from that package, and they are working on making more wallpapers, color palettes, and desktop styles for use with the Lumina Theme Engine. If your operating system does not currently provide a package for lumina-themes, I highly recommend that you make one as soon as possible!</p>
</blockquote>

<ul>
<li><p>The Lumina PDF Viewer (lumina-pdf)</p>

<ul>
<li>This is a new, stand-alone desktop utility for viewing/printing/presenting PDF documents. It uses the poppler-qt5 library in the backend for rendering the document, but uses multi-threading in many ways (such as to speed up the loading of pages) to give the user a nice, streamlined utility for viewing PDF documents. There is also built-in presentation functionality which allows users to easily cast the document to a separate screen without mucking about in system menus or configuration utilities.</li>
</ul></li>
<li><p>Lumina PDF Viewer (1.4.0)</p>

<ul>
<li>Important Packaging Changes</li>
</ul></li>
</ul>

<blockquote>
<p>One significant change of note for people who are packaging Lumina for their particular operating system is that the minimum supported versions of Qt for Lumina have been changed with this release:</p>

<pre><code>lumina-core: Qt 5.4+
lumina-mediaplayer: Qt 5.7+
Everything else: Qt 5.2+
</code></pre>

<p>Of course, using the latest version of the Qt5 libraries is always recommended.<br>
When packaging for Linux distributions, the theme engine also requires the availability of some of the -dev packages for Qt itself when compiling the theme plugin. For additional information (specifically regarding Ubuntu builds), please take a look at a recent ticket on the Lumina repository.</p>

<ul>
<li>The new lumina-pdf utility requires the availability of the poppler-qt5 library. The includes for this library on Ubuntu 17.10 were found to be installed outside of the normal include directories, so a special rule for it was added to our OS-Detect file in the Lumina source tree. If your particular operating system also places the the poppler include files in a non-standard place, please patch that file or send us the information and we can add more special rules for your particular OS.</li>
</ul>
</blockquote>

<ul>
<li>Other Changes of Note (in no particular order)

<ul>
<li>lumina-config:</li>
<li>Add a new page for changing audio theme (login, logout, low battery)</li>
<li>Add option to replace fluxbox with some other WM (with appropriate warnings)</li>
<li>Have the themes page redirect to launching the Lumina theme engine configuration utility.</li>
<li>start-lumina-desktop:</li>
<li>Auto-detect the active X11 displays and create a new display for the Lumina session (prevent conflict with prior graphical sessions).</li>
<li>Add a process-failure counter &amp; restart mechanism. This is particularly useful for restarting Fluxbox from time to time (such as after any monitor addition/removal)</li>
<li>lumina-xconfig:</li>
<li>Restart fluxbox after making any monitor changes with xrandr. This ensures a more reliable session.</li>
<li>Implement a  new 2D monitor layout mechanism. This allows for the placement of monitors anywhere in the X/Y plane, with simplification buttons for auto-tiling the monitors in each dimension based on their current location.</li>
<li>Add the ability to save/load monitor profiles.</li>
<li>Distinguish between the default monitor arrangement and the current monitor arrangement. Allow the user to set the current arrangement as the new default.</li>
<li>lumina-desktop:</li>
<li>Completely revamp the icon loading mechanisms so it should auto-update when the theme changes.</li>
<li>Speed up the initialization of the desktop quite a bit.</li>
<li>Prevent loading/probing files in the /net/ path for existence (assume they exist in the interest of providing shortcuts). On FreeBSD, these are special paths that actually pause the calling process in order to mount/load a network share before resuming the process, and can cause significant hangs in the desktop process.</li>
<li>Add the ability to take a directory as a target for the wallpaper. This will open/probe the directory for any existing image files that it can use as a wallpaper and randomly select one.</li>
<li>Remove the popup dialog prompting about system updates, and replace it with new Restart (with updates) buttons on the appropriate menus/windows instead.</li>
<li>If no wallpapers selection is provided, try to use the lumina-nature wallpaper directory as the default, otherwise fall back on the original default wallpaper if the lumina-themes package is not installed.</li>
<li>lumina-open:</li>
<li>Make the *.desktop parsing a bit more flexible regarding quoted strings where there should not be any.</li>
<li>If selecting which application to use, only overwrite the user-default app if the option is explicitly selected.</li>
<li>lumina-fileinfo:</li>
<li>Significant cleanup of this utility. Now it can be reliably used for creating/registering XDG application shortcuts.</li>
<li>Add a whole host of new ZFS integrations:</li>
<li>If a ZFS dataset is being examined, show all the ZFS properties for that dataset.</li>
<li>If the file being examined exists within ZFS snapshots, show all the snapshots of the file</li>
</ul></li>
<li>lumina-fm:

<ul>
<li>Significant use of additional multi-threading. Makes the loading of directories much faster (particularly ones with image files which need thumbnails)</li>
<li>Add detection/warning when running as root user. Also add an option to launch a new instance of lumina-fm as the root user.</li>
<li>[FreeBSD/TrueOS] Fix up the detection of the External Devices list to also list available devices for the autofs system.</li>
<li>Fix up some drag and drop functionality.</li>
<li>Expose the creation, extraction, and insertion of files into archives (requires lumina-archiver at runtime)</li>
<li>Expand the Open With option into a menu of application suggestions in addition to the Other option which runs lumina-open to find an application.</li>
<li>Provide an option to set the desktop wallpaper to the selected image file(s). (If the running desktop session is Lumina).</li>
</ul></li>
<li>lumina-mediaplayer:

<ul>
<li>Enable the ability to playback local video files. (NOTE: If Qt5 is set to use the gstreamer multimedia backend, make sure you have the GL plugin installed for smooth video playback).</li>
</ul></li>
<li>lumina-archiver:

<ul>
<li>Add CLI flags for auto-archive and auto-extract. This allows for programmatic/scriptable interactions with archives.</li>
<li>That is not mentioning all of the little bugfixes, performance tweaks, and more that are also included in this release.
***</li>
</ul></li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/the_strongest_kaslr_ever" rel="nofollow">The strongest KASLR, ever?</a></h3>

<ul>
<li><a href="https://mail-index.netbsd.org/tech-kern/2017/11/14/msg022594.html" rel="nofollow">Re: amd64: kernel aslr support</a></li>
</ul>

<blockquote>
<p>So, I did it. Now the kernel sections are split in sub-blocks, and are all randomized independently. See my drawing [1]. What it means in practice, is that Kernel ASLR is much more difficult to defeat: a cache attack will at most allow you to know that a given range is mapped as executable for example, but you don&#39;t know which sub-block of .text it is; a kernel pointer leak will at most allow you to reconstruct the layout of one sub-block, but you don&#39;t know the layout and address of the remaining blocks, and there can be many.<br>
The size and number of these blocks is controlled by the split-by-file parameter in Makefile.amd64. Right now it is set to 2MB, which produces a kernel with ~23 allocatable (ie useful at runtime) sections, which is a third of the total number supported (BTSPACE_NSEGS = 64). I will probably reduce this parameter a bit in the future, to 1.5MB, or even 1MB.<br>
All of that leaves us with about the most advanced KASLR implementation available out there. There are ways to improve it even more, but you&#39;ll have to wait a few weeks for that.<br>
 If you want to try it out you need to make sure you have the latest versions of GENERIC_KASLR / prekern / bootloader. The instructions are still here, and haven&#39;t changed.</p>
</blockquote>

<ul>
<li>Initial design</li>
</ul>

<blockquote>
<p>As I said in the previous episode, I added in October a Kernel ASLR implementation in NetBSD for 64bit x86 CPUs. This implementation would randomize the location of the kernel in virtual memory as one block: a random VA would be chosen, and the kernel ELF sections would be mapped contiguously starting from there.<br>
This design had several drawbacks: one leak, or one successful cache attack, could be enough to reconstruct the layout of the entire kernel and defeat KASLR.<br>
NetBSDs new KASLR design significantly improves this situation.</p>
</blockquote>

<ul>
<li>New design</li>
</ul>

<blockquote>
<p>In the new design, each kernel ELF section is randomized independently. That is to say, the base addresses of .text, .rodata, .data and .bss are not correlated. KASLR is already at this stage more difficult to defeat, since you would need a leak or cache attack on each of the kernel sections in order to reconstruct the in-memory kernel layout.<br>
Then, starting from there, several techniques are used to strengthen the implementation even more.</p>
</blockquote>

<ul>
<li>Sub-blocks</li>
</ul>

<blockquote>
<p>The kernel ELF sections are themselves split in sub-blocks of approximately 1MB. The kernel therefore goes from having:</p>

<pre><code>    { .text .rodata .data .bss }
</code></pre>

<p>to having</p>

<pre><code>    { .text .text.0 .text.1 ... .text.i .rodata .rodata.0 ... .rodata.j ... .data ...etc }
</code></pre>

<p>As of today, this produces a kernel with ~33 sections, each of which is mapped at a random address and in a random order.<br>
This implies that there can be dozens of .text segments. Therefore, even if you are able to conduct a cache attack and determine that a given range of memory is mapped as executable, you dont know which sub-block of .text it is. If you manage to obtain a kernel pointer via a leak, you can at most guess the address of the section it finds itself in, but you dont know the layout of the remaining 32 sections. In other words, defeating this KASLR implementation is much more complicated than in the initial design.</p>
</blockquote>

<ul>
<li>Higher entropy</li>
</ul>

<blockquote>
<p>Each section is put in a 2MB-sized physical memory chunk. Given that the sections are 1MB in size, this leaves half of the 2MB chunk unused. Once in control, the prekern shifts the section within the chunk using a random offset, aligned to the ELF alignment constraint. This offset has a maximum value of 1MB, so that once shifted the section still resides in its initial 2MB chunk:<br>
The prekern then maps these 2MB physical chunks at random virtual addresses; but addresses aligned to 2MB. For example, the two sections in Fig. A will be mapped at two distinct VAs:<br>
There is a reason the sections are shifted in memory: it offers higher entropy. If we consider a .text.i section with a 64byte ELF alignment constraint, and give a look at the number of possibilities for the location of the section in memory:<br>
The prekern shifts the 1MB section in its 2MB chunk, with an offset aligned to 64 bytes. So there are (2MB-1MB)/(64B)=214 possibilities for the offset.<br>
Then, the prekern uses a 2MB-sized 2MB-aligned range of VA, chosen in a 2GB window. So there are (2GB-2MB)/(2MB)=210-1 possibilities for the VA.<br>
Therefore, there are 214x(210-1)224 possible locations for the section. As a comparison with other systems:</p>

<pre><code>OS  # of possibilities
Linux   2^6
MacOS   2^8
Windows 2^13
NetBSD  2^24
</code></pre>

<p>Of course, we are talking about one .text.i section here; the sections that will be mapped afterwards will have fewer location possibilities because some slots will be already occupied. However, this does not alter the fact that the resulting entropy is still higher than that of the other implementations. Note also that several sections have an alignment constraint smaller than 64 bytes, and that in such cases the entropy is even higher.</p>
</blockquote>

<ul>
<li>Large pages</li>
</ul>

<blockquote>
<p>There is also a reason we chose to use 2MB-aligned 2MB-sized ranges of VAs: when the kernel is in control and initializes itself, it can now use large pages to map the physical 2MB chunks. This greatly improves memory access performance at the CPU level.</p>
</blockquote>

<ul>
<li>Countermeasures against TLB cache attacks</li>
</ul>

<blockquote>
<p>With the memory shift explained above, randomness is therefore enforced at both the physical and virtual levels: the address of the first page of a section does not equal the address of the section itself anymore.<br>
It has, as a side effect, an interesting property: it can mostly mitigate TLB cache attacks. Such attacks operate at the virtual-page level; they will allow you to know that a given large page is mapped as executable, but you dont know where exactly within that page the section actually begins.</p>
</blockquote>

<ul>
<li>Strong?</li>
</ul>

<blockquote>
<p>This KASLR implementation, which splits the kernel in dozens of sub-blocks, randomizes them independently, while at the same time allowing for higher entropy in a way that offers large page support and some countermeasures against TLB cache attacks, appears to be the most advanced KASLR implementation available publicly as of today. <br>
Feel free to prove me wrong, I would be happy to know!</p>
</blockquote>

<ul>
<li>WIP</li>
</ul>

<blockquote>
<p>Even if it is in a functional state, this implementation is still a work in progress, and some of the issues mentioned in the previous blog post haven&#39;t been addressed yet. But feel free to test it and report any issue you encounter. Instructions on how to use this implementation can still be found in the previous blog post, and havent changed since.<br>
See you in the next episode!</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="http://www.ghostbsd.org/11.1_release_announcement" rel="nofollow">GhostBSD 11.1 Finally Ready and Available!</a></h3>

<ul>
<li><a href="https://imgur.com/a/Mu8xk" rel="nofollow">Screenshots</a></li>
</ul>

<blockquote>
<p>After a year of development, testing, debugging and working on our software package repository, we are pleased to announce the release of GhostBSD 11.1 is now available on 64-bit(amd64) architecture with MATE and XFCE Desktop on direct and torrent download. With 11.1 we drop 32-bit i386 supports, and we currently maintain our software packages repository for more stability.</p>
</blockquote>

<ul>
<li>What&#39;s new on GhostBSD 11.1

<ul>
<li>GhostBSD software repository</li>
<li>Support VMware Workstation Guest Features</li>
<li>New UFS full disk mirroring option on the installer</li>
<li>New UFS full disk MBR and GPT option on the installer</li>
<li>New UFS full disk swap size option on the installer</li>
<li>Whisker Menu as default Application menu on XFCE</li>
<li>All software developed by GhostBSD is now getting updated</li>
<li>ZFS configuration for disk</li>
</ul></li>
<li>What has been fixed on 11.1?

<ul>
<li>Fix XFCE sound plugin</li>
<li>Installer ZFS configuration file setting</li>
<li>Installer ZFS setup appears to be incomplete</li>
<li>The installer was not listing ZFS disk correctly.</li>
<li>The installer The partition list was not deleted when pressing back</li>
<li>XFCE and MATE shutdown/suspend/hibernate randomly missing</li>
<li>Clicking &#39;GhostBSD Bugs&#39; item in the Main menu -&gt; &#39;System Tools&#39; brings up &#39;Server not found&#39; page</li>
<li>XFCE installation - incorrect keyboard layout</li>
<li>Locale setting not filling correctly</li>
<li>Update Station tray icon</li>
</ul></li>
<li>The image checksum&#39;s, hybrid ISO(DVD, USB) images are available at <a href="http://www.ghostbsd.org/download" rel="nofollow">GhostBSD</a>.
***</li>
</ul>

<h3>p2k17 Hackathon Reports</h3>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171107034258" rel="nofollow">p2k17 Hackathon Report: Matthias Kilian on xpdf, haskell, and more</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171107185122" rel="nofollow">p2k17 Hackathon Report: Herzliche grusse vom Berlin (espie@ on mandoc, misc packages progress)</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171107225258" rel="nofollow">p2k17 Hackathon Report: Paul Irofti (pirofti@) on hotplugd(8), math ports, xhci(4) and other kernel advancements</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171108072117" rel="nofollow">p2k17 Hackathon report: Jeremy Evans on ruby progress, postgresql and webdriver work</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171109171447" rel="nofollow">p2k17 Hackathon report: Christian Weisgerber on random devices, build failures and gettext</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171110124645" rel="nofollow">p2k17 Hackathon report: Sebastian Reitenbach on Puppet progress</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171110124656" rel="nofollow">p2k17 Hackathon Report: Anthony J. Bentley on firmware, games and securing pkg_add runs</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171113091807" rel="nofollow">p2k17 Hackathon Report: Landry Breuil on Mozilla things and much more</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171113235334" rel="nofollow">p2k17 Hackathon report: Florian Obser on network stack progress, kernel relinking and more</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171120075903" rel="nofollow">p2k17 Hackathon report: Antoine Jacoutot on ports+packages progress</a>
***</li>
</ul>

<h3>TrueOS Talks</h3>

<ul>
<li><a href="https://www.trueos.org/blog/trueos-talks-tech-open-source-pellissippi-state/" rel="nofollow">Tech and Open Source at Pellissippi State</a></li>
</ul>

<blockquote>
<p>Ken Moore of the TrueOS project presented a talk to the AITP group at Pellissippi State today entitled Its A Unix(-like) system? An Introduction to TrueOS and Open source. Joshua Smith of the TrueOS project was also in attendance. <br>
We were happy to see a good attendance of about 40 individuals that came to hear more about TrueOS and how we continue to innovate along with the FreeBSD project. Many good questions were raised about development, snapshots, cryptocurrency, and cyber-security. Weve included a copy of the slides if youd like to have a look at the talk on open source. Wed like to offer a sincere thanks to everyone who attended and offer an extended invitation for you to join us at our KnoxBUG group on October 30th @ the iXsystems offices! We hope to see you soon!</p>
</blockquote>

<ul>
<li><a href="https://web.trueos.org/wp-content/uploads/2017/10/Open-Source-Talk.pdf" rel="nofollow">Open Source Talk  Slideshare PDF</a>
<a href="http://knoxbug.org/content/octobers-talk-available-youtube" rel="nofollow">KnoxBug - Lumina Rising : Challenging Desktop Orthodoxy</a></li>
<li>Ken gave his talk about the new Lumina 2.0 Window Manager that he gave at Ohio LinuxFest 2017</li>
<li><a href="https://youtu.be/w3ZrqxLTnIU" rel="nofollow">KnoxBUG October 2017</a></li>
<li><a href="https://www.slideshare.net/beanpole135/olf-2017-lumina-rising-challenging-desktop-orthodoxy" rel="nofollow">(OLF 2017) Lumina Rising: Challenging Desktop Orthodoxy</a>
***</li>
</ul>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20171118190325" rel="nofollow">Official OpenBSD 6.2 CD set - the only one to be made!</a></h3>

<ul>
<li>Our dear friend Bob Beck (beck@) writes:</li>
</ul>

<blockquote>
<p>So, again this release the tradition of making Theo do art has continued!<br>
Up for sale by auction to the highest bidder on Ebay is the only OpenBSD 6.2 CD set to be produced.<br>
The case and CD&#39;s feature the 6.2 artwork, custom drawn and signed by Theo.<br>
All proceeds to support OpenBSD<br>
Go have a look at the auction</p>
</blockquote>

<ul>
<li>As with previous OpenBSD auctions, if you are not the successful bidder, we would like to encourage you to donate the equivalent of you highest bid to the project.</li>
<li><a href="https://www.ebay.ca/itm/Official-OpenBSD-6-2-CD-Set/253265944606" rel="nofollow">The Auction</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2017-October/313646.html" rel="nofollow">HAMMER2 userspace on Linux</a></li>
<li><a href="http://www.nycbug.org/index.cgi?action=view&id=10655" rel="nofollow">OpenBSD Porting Workshop (now changed to January 3, 2018)</a></li>
<li><a href="https://twitter.com/mahrens1/status/921204908094775296" rel="nofollow">Matt Ahrens on when Native Encryption for ZFS will land</a></li>
<li><a href="http://nanxiao.me/en/the-first-successful-build-of-openbsd-base-system/" rel="nofollow">The first successful build of OpenBSD base system</a></li>
<li><a href="https://www.meetup.com/KnoxBUG-BSD-Linux-and-FOSS-Users-Unite/events/245291204/" rel="nofollow">KnoxBug November Meeting</a></li>
<li><a href="https://www.michaelwlucas.com/os/af3e" rel="nofollow">Absolute FreeBSD, 3rd Edition, pre-orders available</a></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Jon - <a href="http://dpaste.com/2BEW0HB#wrap" rel="nofollow">Jails and Networking</a></li>
<li>Nathan - <a href="http://dpaste.com/1GHSYJS#wrap" rel="nofollow">bhyve Provisioning</a></li>
<li>Lian - <a href="http://dpaste.com/18P8D8C#wrap" rel="nofollow">OpenSSL jumping the Shark</a></li>
<li>Kim - <a href="http://dpaste.com/1VE0K9E#wrap" rel="nofollow">Suggestions</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Allan reports on his trip to BSD Taiwan, new versions of Lumina and GhostBSD are here, a bunch of OpenBSD p2k17 hackathon reports.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://bsdtw.org/" rel="nofollow">Allans Trip Report from BSD Taiwan</a></h3>

<ul>
<li>BSD TW and Taiwan in general was a fun and interesting experience</li>
<li>I arrived Thursday night and took the high speed train to Taipei main station, and then got on the Red line subway to the venue. The dorm rooms were on par with BSDCan, except the mattress was better.</li>
<li>I spent Friday with a number of other FreeBSD developers doing touristy things. We went to Taipei 101, the worlds tallest building from 2004 - 2010. It also features the worlds fastest elevator (2004 - 2016), traveling at 60.6 km/h and transporting passengers from the 5th to 89th floor in 37 seconds.</li>
<li>We also got to see the tuned mass damper, a 660 tonne steel pendulum suspended between the 92nd and 87th floors. This device resists the swaying of the building caused by high winds. There are interesting videos on display beside the damper, of its reaction during recent typhoons and earthquakes. The Taipei 101 building sits just 200 meters from a major fault line.</li>
<li>Then we had excellent dumplings for lunch</li>
<li>After walking around the city for a few more hours, we retired to a pub to escape the heat of the sunny Friday afternoon.</li>
<li>Then came the best part of each day in Taipei, dinner!</li>
<li>We continued our efforts to cause a nation wide shortage of dumplings</li>
<li>Special thanks to <a href="https://twitter.com/scottttw" rel="nofollow">Scott Tsai</a> who took detailed notes for each of the presentations</li>
<li>Saturday marked the start of the conference:

<ul>
<li>Arun Thomas provided background and then a rundown of what is happening with the RISC-V architecture. <a href="https://docs.google.com/document/d/1yrnhNTHaMDr4DG-iviXN0O9NES9Lmlc7sWVQhnios6g/edit#heading=h.kcm1n3yzl35q" rel="nofollow">Notes</a></li>
<li>George Neville-Neil talked about using DTrace in distributed systems as an in-depth auditing system (who did what to whom and when). <a href="https://docs.google.com/document/d/1qut6tMVF8NesrGHd6bydLDN-aKBdXMgHx8Vp3_iGKjQ/edit#heading=h.qdghsgk1bgtl" rel="nofollow">Notes</a></li>
<li>Baptiste Daroussin presented Poudrière image, an extension of everyones favourite package building system, to build custom images of FreeBSD. There was discussion of making this generate ZFS based images as well, making it mesh very well with my talk the next day. <a href="https://docs.google.com/document/d/1LceXj8IWJeTRHp9KzOYy8tpM00Fzt7fSN0Gw83B9COE/edit#heading=h.incfzi6bnzxr" rel="nofollow">Notes</a></li>
<li>Brooks Davis presented his work on an API design for a replacement for mmap. It started with a history of address space management in the BSD family of operating systems going all the way back to the beginning. This overview of the feature and how it evolved filled in many gaps for me, and showed why the newer work would be beneficial. The motivation for the work includes further extensions to support the CHERI hardware platform. <a href="https://docs.google.com/document/d/1LceXj8IWJeTRHp9KzOYy8tpM00Fzt7fSN0Gw83B9COE/edit#heading=h.incfzi6bnzxr" rel="nofollow">Notes</a></li>
<li>Johannes M Dieterich gave an interesting presentation about using FreeBSD and GPU acceleration for high performance computing. One of the slides showed that amd64 has taken almost the entire market for the top 500 super computers, and that linux dominates the list, with only a few remaining non-linux systems. Sadly, at the supercomputing conference the next week, it was announced that linux has achieved 100% saturation of the top 500 super computers list. Johannes detailed the available tools, what ports are missing, what changes should be made to the base system (mostly OpenMP), and generally what FreeBSD needs to do to become a player in the supercomputer OS market. Johannes perspective is interesting, as he is a computational chemist, not a computer scientist. Those interested in improving the numerical libraries and GPU acceleration frameworks on FreeBSD should join the ports team. <a href="https://docs.google.com/document/d/1uaJiqtPk8WetST6_GnQwIV49bj790qx7ToY2BHC9zO4/edit#heading=h.nvsz1n6w3gyq" rel="nofollow">Notes</a></li>
<li>The final talk of the day was Peter Grehan, who spoke about how graphics support in bhyve came to be. He provided a history of how the feature evolved, and where it stands today. <a href="https://docs.google.com/document/d/1LqJQJUwdUwWZ0n5KwCH1vNI8jiWGJlI1j0It3mERN80/edit#heading=h.sgeixwgz7bjs" rel="nofollow">Notes</a></li>
</ul></li>
<li>Afterwards, we traveled as a group to a large restaurant for dinner. There was even Mongolian Vodka, provided by Ganbold Tsagaankhuu of the FreeBSD project.</li>
<li>Sunday:

<ul>
<li>The first talk of the day Sunday was mine. I presented ZFS: Advanced Integration, mostly talking about how boot environments work, and the new libbe and be(1) tools that my GSoC student Kyle Kneitinger created to manage them. I talked about how they can be used for laptop and developer systems, but also how boot environments can be used to replace nanobsd for appliances (as already done in FreeNAS and pfSense). I also presented about zfsbootcfg (zfs nextboot), and some future extensions to it to make it even more useful in appliance type workloads. I also provided a rundown of new developments out of the ZFS developer summit, two weeks previous. <a href="https://docs.google.com/document/d/1Blh3Dulf0O91A0mwv34UnIgxRZaS_0FU2lZ41KRQoOU/edit#heading=h.gypim387e8hy" rel="nofollow">Notes</a></li>
<li>Theo de Raadt presented Mitigations and other real Security Features, and made his case for changing to a fail closed mode of interoperability. Computers cannot actually self heal, so lets stop pretending that they can. <a href="https://docs.google.com/document/d/1fFHzlxJjbHPsV9t_Uh3PXZnXmkapAK5RkJsfaHki7kc/edit#heading=h.192e4lmbl70c" rel="nofollow">Notes</a></li>
<li>Ruslan Bukin talked about doing the port of FreeBSD for RISC-V and writing the Device Drivers. Ruslan walked through the process step by step, leading members of the audience to suggest he turn it into a developers handbook article, explaining how to do the initial bringup on new hardware. Ruslan also showed off a FreeBSD/MIPS board he designed himself and had manufactured in China.  <a href="https://docs.google.com/document/d/1kRhRr3O3lQ-0dS0kYF0oh_S0_zFufEwrdFjG1QLyk8Y/edit#heading=h.293mameym7w1" rel="nofollow">Notes</a></li>
<li>Mariusz Zaborski presented Case studies on sandboxing the base system with Capsicum. He discussed the challenges encountered as existing programs are modified to sandbox them, and recent advancements in the debugging tools available during that process. Mariusz also discussed the Casper service at length, including the features that are planned for 2018 and onwards. <a href="https://docs.google.com/document/d/1_0BpAE1jGr94taUlgLfSWlJOYU5II9o7Y3ol0ym1eZQ/edit#heading=h.xm9mh7dh6bay" rel="nofollow">Notes</a></li>
<li>The final presentation of the day was Mark Johnston on Memory Management Improvements in FreeBSD 12.0. This talk provided a very nice overview of the memory management system in FreeBSD, and then detailed some of the recent improvements.  <a href="https://docs.google.com/document/d/1gFQXxsHM66GQGMO4-yoeFRTcmOP4NK_ujVFHIQJi82U/edit#heading=h.uirc9jyyti7w" rel="nofollow">Notes</a></li>
<li>The conference wrapped up with the Work-in-Progress session, including updates on: multi-device-at-once GELI attach, MP-safe networking on NetBSD, pkgsrc, NetBSD in general, BSD on Microsoft Azure, Mothra (send-pr for bugzilla), BSDMizer a machine learning compiler optimizer, Hyperledger Sawtooth (blockchain), and finally VIMAGE and pf testing on FreeBSD.
<a href="https://docs.google.com/document/d/1miHZEPrqrpCTh8JONmUKWDPYUmTuG2lbsVrWDtekvLc/edit#heading=h.orhedpjis5po" rel="nofollow">Notes</a></li>
</ul></li>
<li><a href="https://pbs.twimg.com/media/DOh1txnVoAAFKAa.jpg:large" rel="nofollow">Group Photo</a></li>
<li>BSDTW was a great conference. They are still considering if it should be an annual thing, trade off every 2nd year with AsiaBSDCon, or something else. In order to continue, BSD Taiwan requires more organizers and volunteers. They have regular meetups in Taipei if you are interested in getting involved.
***</li>
</ul>

<h3><a href="https://lumina-desktop.org/version-1-4-0-released/" rel="nofollow">Lumina 1.4.0 released</a></h3>

<ul>
<li>The Lumina Theme Engine (and associated configuration utility)</li>
<li>The Lumina theme engine is a new component of the core desktop, and provides enhanced theming capabilities for the desktop as well as all Qt5 applications. While it started out life as a fork of the qt5ct utility, it quickly grew all sorts of new features and functionality such as system-defined color profiles, modular theme components, and built-in editors/creators for all components. The backend of this engine is a standardized theme plugin for the Qt5 toolkit, so that all Qt5 applications will now present a unified appearance (if the application does not enforce a specific appearance/theme of its own). Users of the Lumina desktop will automatically have this plugin enabled: no special action is required.

<ul>
<li>Please note that the older desktop theme system for Lumina has been rendered obsolete by the new engine, but a settings-conversion path has already been implemented which should transition your current settings to the new engine the first time you login to Lumina 1.4.0. Custom themes for the older system may not be converted though, but it is trivial to copy/paste any custom stylesheets from the old system into the editor for the new theme engine to register/re-apply them as desired.</li>
</ul></li>
<li>Lumina-Themes Repository</li>
</ul>

<blockquote>
<p>I also want to give a shout-out to the trueos/lumina-themes github repository contributors. All of the wallpapers in the 1.4.0 screenshots I posted come from that package, and they are working on making more wallpapers, color palettes, and desktop styles for use with the Lumina Theme Engine. If your operating system does not currently provide a package for lumina-themes, I highly recommend that you make one as soon as possible!</p>
</blockquote>

<ul>
<li><p>The Lumina PDF Viewer (lumina-pdf)</p>

<ul>
<li>This is a new, stand-alone desktop utility for viewing/printing/presenting PDF documents. It uses the poppler-qt5 library in the backend for rendering the document, but uses multi-threading in many ways (such as to speed up the loading of pages) to give the user a nice, streamlined utility for viewing PDF documents. There is also built-in presentation functionality which allows users to easily cast the document to a separate screen without mucking about in system menus or configuration utilities.</li>
</ul></li>
<li><p>Lumina PDF Viewer (1.4.0)</p>

<ul>
<li>Important Packaging Changes</li>
</ul></li>
</ul>

<blockquote>
<p>One significant change of note for people who are packaging Lumina for their particular operating system is that the minimum supported versions of Qt for Lumina have been changed with this release:</p>

<pre><code>lumina-core: Qt 5.4+
lumina-mediaplayer: Qt 5.7+
Everything else: Qt 5.2+
</code></pre>

<p>Of course, using the latest version of the Qt5 libraries is always recommended.<br>
When packaging for Linux distributions, the theme engine also requires the availability of some of the -dev packages for Qt itself when compiling the theme plugin. For additional information (specifically regarding Ubuntu builds), please take a look at a recent ticket on the Lumina repository.</p>

<ul>
<li>The new lumina-pdf utility requires the availability of the poppler-qt5 library. The includes for this library on Ubuntu 17.10 were found to be installed outside of the normal include directories, so a special rule for it was added to our OS-Detect file in the Lumina source tree. If your particular operating system also places the the poppler include files in a non-standard place, please patch that file or send us the information and we can add more special rules for your particular OS.</li>
</ul>
</blockquote>

<ul>
<li>Other Changes of Note (in no particular order)

<ul>
<li>lumina-config:</li>
<li>Add a new page for changing audio theme (login, logout, low battery)</li>
<li>Add option to replace fluxbox with some other WM (with appropriate warnings)</li>
<li>Have the themes page redirect to launching the Lumina theme engine configuration utility.</li>
<li>start-lumina-desktop:</li>
<li>Auto-detect the active X11 displays and create a new display for the Lumina session (prevent conflict with prior graphical sessions).</li>
<li>Add a process-failure counter &amp; restart mechanism. This is particularly useful for restarting Fluxbox from time to time (such as after any monitor addition/removal)</li>
<li>lumina-xconfig:</li>
<li>Restart fluxbox after making any monitor changes with xrandr. This ensures a more reliable session.</li>
<li>Implement a  new 2D monitor layout mechanism. This allows for the placement of monitors anywhere in the X/Y plane, with simplification buttons for auto-tiling the monitors in each dimension based on their current location.</li>
<li>Add the ability to save/load monitor profiles.</li>
<li>Distinguish between the default monitor arrangement and the current monitor arrangement. Allow the user to set the current arrangement as the new default.</li>
<li>lumina-desktop:</li>
<li>Completely revamp the icon loading mechanisms so it should auto-update when the theme changes.</li>
<li>Speed up the initialization of the desktop quite a bit.</li>
<li>Prevent loading/probing files in the /net/ path for existence (assume they exist in the interest of providing shortcuts). On FreeBSD, these are special paths that actually pause the calling process in order to mount/load a network share before resuming the process, and can cause significant hangs in the desktop process.</li>
<li>Add the ability to take a directory as a target for the wallpaper. This will open/probe the directory for any existing image files that it can use as a wallpaper and randomly select one.</li>
<li>Remove the popup dialog prompting about system updates, and replace it with new Restart (with updates) buttons on the appropriate menus/windows instead.</li>
<li>If no wallpapers selection is provided, try to use the lumina-nature wallpaper directory as the default, otherwise fall back on the original default wallpaper if the lumina-themes package is not installed.</li>
<li>lumina-open:</li>
<li>Make the *.desktop parsing a bit more flexible regarding quoted strings where there should not be any.</li>
<li>If selecting which application to use, only overwrite the user-default app if the option is explicitly selected.</li>
<li>lumina-fileinfo:</li>
<li>Significant cleanup of this utility. Now it can be reliably used for creating/registering XDG application shortcuts.</li>
<li>Add a whole host of new ZFS integrations:</li>
<li>If a ZFS dataset is being examined, show all the ZFS properties for that dataset.</li>
<li>If the file being examined exists within ZFS snapshots, show all the snapshots of the file</li>
</ul></li>
<li>lumina-fm:

<ul>
<li>Significant use of additional multi-threading. Makes the loading of directories much faster (particularly ones with image files which need thumbnails)</li>
<li>Add detection/warning when running as root user. Also add an option to launch a new instance of lumina-fm as the root user.</li>
<li>[FreeBSD/TrueOS] Fix up the detection of the External Devices list to also list available devices for the autofs system.</li>
<li>Fix up some drag and drop functionality.</li>
<li>Expose the creation, extraction, and insertion of files into archives (requires lumina-archiver at runtime)</li>
<li>Expand the Open With option into a menu of application suggestions in addition to the Other option which runs lumina-open to find an application.</li>
<li>Provide an option to set the desktop wallpaper to the selected image file(s). (If the running desktop session is Lumina).</li>
</ul></li>
<li>lumina-mediaplayer:

<ul>
<li>Enable the ability to playback local video files. (NOTE: If Qt5 is set to use the gstreamer multimedia backend, make sure you have the GL plugin installed for smooth video playback).</li>
</ul></li>
<li>lumina-archiver:

<ul>
<li>Add CLI flags for auto-archive and auto-extract. This allows for programmatic/scriptable interactions with archives.</li>
<li>That is not mentioning all of the little bugfixes, performance tweaks, and more that are also included in this release.
***</li>
</ul></li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/the_strongest_kaslr_ever" rel="nofollow">The strongest KASLR, ever?</a></h3>

<ul>
<li><a href="https://mail-index.netbsd.org/tech-kern/2017/11/14/msg022594.html" rel="nofollow">Re: amd64: kernel aslr support</a></li>
</ul>

<blockquote>
<p>So, I did it. Now the kernel sections are split in sub-blocks, and are all randomized independently. See my drawing [1]. What it means in practice, is that Kernel ASLR is much more difficult to defeat: a cache attack will at most allow you to know that a given range is mapped as executable for example, but you don&#39;t know which sub-block of .text it is; a kernel pointer leak will at most allow you to reconstruct the layout of one sub-block, but you don&#39;t know the layout and address of the remaining blocks, and there can be many.<br>
The size and number of these blocks is controlled by the split-by-file parameter in Makefile.amd64. Right now it is set to 2MB, which produces a kernel with ~23 allocatable (ie useful at runtime) sections, which is a third of the total number supported (BTSPACE_NSEGS = 64). I will probably reduce this parameter a bit in the future, to 1.5MB, or even 1MB.<br>
All of that leaves us with about the most advanced KASLR implementation available out there. There are ways to improve it even more, but you&#39;ll have to wait a few weeks for that.<br>
 If you want to try it out you need to make sure you have the latest versions of GENERIC_KASLR / prekern / bootloader. The instructions are still here, and haven&#39;t changed.</p>
</blockquote>

<ul>
<li>Initial design</li>
</ul>

<blockquote>
<p>As I said in the previous episode, I added in October a Kernel ASLR implementation in NetBSD for 64bit x86 CPUs. This implementation would randomize the location of the kernel in virtual memory as one block: a random VA would be chosen, and the kernel ELF sections would be mapped contiguously starting from there.<br>
This design had several drawbacks: one leak, or one successful cache attack, could be enough to reconstruct the layout of the entire kernel and defeat KASLR.<br>
NetBSDs new KASLR design significantly improves this situation.</p>
</blockquote>

<ul>
<li>New design</li>
</ul>

<blockquote>
<p>In the new design, each kernel ELF section is randomized independently. That is to say, the base addresses of .text, .rodata, .data and .bss are not correlated. KASLR is already at this stage more difficult to defeat, since you would need a leak or cache attack on each of the kernel sections in order to reconstruct the in-memory kernel layout.<br>
Then, starting from there, several techniques are used to strengthen the implementation even more.</p>
</blockquote>

<ul>
<li>Sub-blocks</li>
</ul>

<blockquote>
<p>The kernel ELF sections are themselves split in sub-blocks of approximately 1MB. The kernel therefore goes from having:</p>

<pre><code>    { .text .rodata .data .bss }
</code></pre>

<p>to having</p>

<pre><code>    { .text .text.0 .text.1 ... .text.i .rodata .rodata.0 ... .rodata.j ... .data ...etc }
</code></pre>

<p>As of today, this produces a kernel with ~33 sections, each of which is mapped at a random address and in a random order.<br>
This implies that there can be dozens of .text segments. Therefore, even if you are able to conduct a cache attack and determine that a given range of memory is mapped as executable, you dont know which sub-block of .text it is. If you manage to obtain a kernel pointer via a leak, you can at most guess the address of the section it finds itself in, but you dont know the layout of the remaining 32 sections. In other words, defeating this KASLR implementation is much more complicated than in the initial design.</p>
</blockquote>

<ul>
<li>Higher entropy</li>
</ul>

<blockquote>
<p>Each section is put in a 2MB-sized physical memory chunk. Given that the sections are 1MB in size, this leaves half of the 2MB chunk unused. Once in control, the prekern shifts the section within the chunk using a random offset, aligned to the ELF alignment constraint. This offset has a maximum value of 1MB, so that once shifted the section still resides in its initial 2MB chunk:<br>
The prekern then maps these 2MB physical chunks at random virtual addresses; but addresses aligned to 2MB. For example, the two sections in Fig. A will be mapped at two distinct VAs:<br>
There is a reason the sections are shifted in memory: it offers higher entropy. If we consider a .text.i section with a 64byte ELF alignment constraint, and give a look at the number of possibilities for the location of the section in memory:<br>
The prekern shifts the 1MB section in its 2MB chunk, with an offset aligned to 64 bytes. So there are (2MB-1MB)/(64B)=214 possibilities for the offset.<br>
Then, the prekern uses a 2MB-sized 2MB-aligned range of VA, chosen in a 2GB window. So there are (2GB-2MB)/(2MB)=210-1 possibilities for the VA.<br>
Therefore, there are 214x(210-1)224 possible locations for the section. As a comparison with other systems:</p>

<pre><code>OS  # of possibilities
Linux   2^6
MacOS   2^8
Windows 2^13
NetBSD  2^24
</code></pre>

<p>Of course, we are talking about one .text.i section here; the sections that will be mapped afterwards will have fewer location possibilities because some slots will be already occupied. However, this does not alter the fact that the resulting entropy is still higher than that of the other implementations. Note also that several sections have an alignment constraint smaller than 64 bytes, and that in such cases the entropy is even higher.</p>
</blockquote>

<ul>
<li>Large pages</li>
</ul>

<blockquote>
<p>There is also a reason we chose to use 2MB-aligned 2MB-sized ranges of VAs: when the kernel is in control and initializes itself, it can now use large pages to map the physical 2MB chunks. This greatly improves memory access performance at the CPU level.</p>
</blockquote>

<ul>
<li>Countermeasures against TLB cache attacks</li>
</ul>

<blockquote>
<p>With the memory shift explained above, randomness is therefore enforced at both the physical and virtual levels: the address of the first page of a section does not equal the address of the section itself anymore.<br>
It has, as a side effect, an interesting property: it can mostly mitigate TLB cache attacks. Such attacks operate at the virtual-page level; they will allow you to know that a given large page is mapped as executable, but you dont know where exactly within that page the section actually begins.</p>
</blockquote>

<ul>
<li>Strong?</li>
</ul>

<blockquote>
<p>This KASLR implementation, which splits the kernel in dozens of sub-blocks, randomizes them independently, while at the same time allowing for higher entropy in a way that offers large page support and some countermeasures against TLB cache attacks, appears to be the most advanced KASLR implementation available publicly as of today. <br>
Feel free to prove me wrong, I would be happy to know!</p>
</blockquote>

<ul>
<li>WIP</li>
</ul>

<blockquote>
<p>Even if it is in a functional state, this implementation is still a work in progress, and some of the issues mentioned in the previous blog post haven&#39;t been addressed yet. But feel free to test it and report any issue you encounter. Instructions on how to use this implementation can still be found in the previous blog post, and havent changed since.<br>
See you in the next episode!</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="http://www.ghostbsd.org/11.1_release_announcement" rel="nofollow">GhostBSD 11.1 Finally Ready and Available!</a></h3>

<ul>
<li><a href="https://imgur.com/a/Mu8xk" rel="nofollow">Screenshots</a></li>
</ul>

<blockquote>
<p>After a year of development, testing, debugging and working on our software package repository, we are pleased to announce the release of GhostBSD 11.1 is now available on 64-bit(amd64) architecture with MATE and XFCE Desktop on direct and torrent download. With 11.1 we drop 32-bit i386 supports, and we currently maintain our software packages repository for more stability.</p>
</blockquote>

<ul>
<li>What&#39;s new on GhostBSD 11.1

<ul>
<li>GhostBSD software repository</li>
<li>Support VMware Workstation Guest Features</li>
<li>New UFS full disk mirroring option on the installer</li>
<li>New UFS full disk MBR and GPT option on the installer</li>
<li>New UFS full disk swap size option on the installer</li>
<li>Whisker Menu as default Application menu on XFCE</li>
<li>All software developed by GhostBSD is now getting updated</li>
<li>ZFS configuration for disk</li>
</ul></li>
<li>What has been fixed on 11.1?

<ul>
<li>Fix XFCE sound plugin</li>
<li>Installer ZFS configuration file setting</li>
<li>Installer ZFS setup appears to be incomplete</li>
<li>The installer was not listing ZFS disk correctly.</li>
<li>The installer The partition list was not deleted when pressing back</li>
<li>XFCE and MATE shutdown/suspend/hibernate randomly missing</li>
<li>Clicking &#39;GhostBSD Bugs&#39; item in the Main menu -&gt; &#39;System Tools&#39; brings up &#39;Server not found&#39; page</li>
<li>XFCE installation - incorrect keyboard layout</li>
<li>Locale setting not filling correctly</li>
<li>Update Station tray icon</li>
</ul></li>
<li>The image checksum&#39;s, hybrid ISO(DVD, USB) images are available at <a href="http://www.ghostbsd.org/download" rel="nofollow">GhostBSD</a>.
***</li>
</ul>

<h3>p2k17 Hackathon Reports</h3>

<ul>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171107034258" rel="nofollow">p2k17 Hackathon Report: Matthias Kilian on xpdf, haskell, and more</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171107185122" rel="nofollow">p2k17 Hackathon Report: Herzliche grusse vom Berlin (espie@ on mandoc, misc packages progress)</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171107225258" rel="nofollow">p2k17 Hackathon Report: Paul Irofti (pirofti@) on hotplugd(8), math ports, xhci(4) and other kernel advancements</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171108072117" rel="nofollow">p2k17 Hackathon report: Jeremy Evans on ruby progress, postgresql and webdriver work</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171109171447" rel="nofollow">p2k17 Hackathon report: Christian Weisgerber on random devices, build failures and gettext</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171110124645" rel="nofollow">p2k17 Hackathon report: Sebastian Reitenbach on Puppet progress</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171110124656" rel="nofollow">p2k17 Hackathon Report: Anthony J. Bentley on firmware, games and securing pkg_add runs</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171113091807" rel="nofollow">p2k17 Hackathon Report: Landry Breuil on Mozilla things and much more</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171113235334" rel="nofollow">p2k17 Hackathon report: Florian Obser on network stack progress, kernel relinking and more</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20171120075903" rel="nofollow">p2k17 Hackathon report: Antoine Jacoutot on ports+packages progress</a>
***</li>
</ul>

<h3>TrueOS Talks</h3>

<ul>
<li><a href="https://www.trueos.org/blog/trueos-talks-tech-open-source-pellissippi-state/" rel="nofollow">Tech and Open Source at Pellissippi State</a></li>
</ul>

<blockquote>
<p>Ken Moore of the TrueOS project presented a talk to the AITP group at Pellissippi State today entitled Its A Unix(-like) system? An Introduction to TrueOS and Open source. Joshua Smith of the TrueOS project was also in attendance. <br>
We were happy to see a good attendance of about 40 individuals that came to hear more about TrueOS and how we continue to innovate along with the FreeBSD project. Many good questions were raised about development, snapshots, cryptocurrency, and cyber-security. Weve included a copy of the slides if youd like to have a look at the talk on open source. Wed like to offer a sincere thanks to everyone who attended and offer an extended invitation for you to join us at our KnoxBUG group on October 30th @ the iXsystems offices! We hope to see you soon!</p>
</blockquote>

<ul>
<li><a href="https://web.trueos.org/wp-content/uploads/2017/10/Open-Source-Talk.pdf" rel="nofollow">Open Source Talk  Slideshare PDF</a>
<a href="http://knoxbug.org/content/octobers-talk-available-youtube" rel="nofollow">KnoxBug - Lumina Rising : Challenging Desktop Orthodoxy</a></li>
<li>Ken gave his talk about the new Lumina 2.0 Window Manager that he gave at Ohio LinuxFest 2017</li>
<li><a href="https://youtu.be/w3ZrqxLTnIU" rel="nofollow">KnoxBUG October 2017</a></li>
<li><a href="https://www.slideshare.net/beanpole135/olf-2017-lumina-rising-challenging-desktop-orthodoxy" rel="nofollow">(OLF 2017) Lumina Rising: Challenging Desktop Orthodoxy</a>
***</li>
</ul>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20171118190325" rel="nofollow">Official OpenBSD 6.2 CD set - the only one to be made!</a></h3>

<ul>
<li>Our dear friend Bob Beck (beck@) writes:</li>
</ul>

<blockquote>
<p>So, again this release the tradition of making Theo do art has continued!<br>
Up for sale by auction to the highest bidder on Ebay is the only OpenBSD 6.2 CD set to be produced.<br>
The case and CD&#39;s feature the 6.2 artwork, custom drawn and signed by Theo.<br>
All proceeds to support OpenBSD<br>
Go have a look at the auction</p>
</blockquote>

<ul>
<li>As with previous OpenBSD auctions, if you are not the successful bidder, we would like to encourage you to donate the equivalent of you highest bid to the project.</li>
<li><a href="https://www.ebay.ca/itm/Official-OpenBSD-6-2-CD-Set/253265944606" rel="nofollow">The Auction</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2017-October/313646.html" rel="nofollow">HAMMER2 userspace on Linux</a></li>
<li><a href="http://www.nycbug.org/index.cgi?action=view&id=10655" rel="nofollow">OpenBSD Porting Workshop (now changed to January 3, 2018)</a></li>
<li><a href="https://twitter.com/mahrens1/status/921204908094775296" rel="nofollow">Matt Ahrens on when Native Encryption for ZFS will land</a></li>
<li><a href="http://nanxiao.me/en/the-first-successful-build-of-openbsd-base-system/" rel="nofollow">The first successful build of OpenBSD base system</a></li>
<li><a href="https://www.meetup.com/KnoxBUG-BSD-Linux-and-FOSS-Users-Unite/events/245291204/" rel="nofollow">KnoxBug November Meeting</a></li>
<li><a href="https://www.michaelwlucas.com/os/af3e" rel="nofollow">Absolute FreeBSD, 3rd Edition, pre-orders available</a></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Jon - <a href="http://dpaste.com/2BEW0HB#wrap" rel="nofollow">Jails and Networking</a></li>
<li>Nathan - <a href="http://dpaste.com/1GHSYJS#wrap" rel="nofollow">bhyve Provisioning</a></li>
<li>Lian - <a href="http://dpaste.com/18P8D8C#wrap" rel="nofollow">OpenSSL jumping the Shark</a></li>
<li>Kim - <a href="http://dpaste.com/1VE0K9E#wrap" rel="nofollow">Suggestions</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>220: Opening ZFS in 2017</title>
  <link>https://www.bsdnow.tv/220</link>
  <guid isPermaLink="false">317534a9-acaf-4d19-8857-2a02ad303297</guid>
  <pubDate>Wed, 15 Nov 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/317534a9-acaf-4d19-8857-2a02ad303297.mp3" length="82521652" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We have a first PS4 kernel exploit, the long awaited OpenZFS devsummit report by Allan, DragonflyBSD 5.0 is out, we show you vmadm to manage jails, and parallel processing with Unix tools.</itunes:subtitle>
  <itunes:duration>1:54:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We have a first PS4 kernel exploit, the long awaited OpenZFS devsummit report by Allan, DragonflyBSD 5.0 is out, we show you vmadm to manage jails, and parallel processing with Unix tools.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
The First PS4 Kernel Exploit: Adieu (https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/)
The First PS4 Kernel Exploit: Adieu
Plenty of time has passed since we first demonstrated Linux running on the PS4.  Now we will step back a bit and explain how we managed to jump from the browser process into the kernel such that ps4-kexec et al. are usable.  Over time, ps4 firmware revisions have progressively added many mitigations and in general tried to lock down the system. This post will mainly touch on vulnerabilities and issues which are not present on the latest releases, but should still be useful for people wanting to investigate ps4 security.
Vulnerability Discovery
As previously explained, we were able to get a dump of the ps4 firmware 1.01 kernel via a PCIe man-in-the-middle attack. Like all FreeBSD kernels, this image included “export symbols” - symbols which are required to perform kernel and module initialization processes. However, the ps4 1.01 kernel also included full ELF symbols (obviously an oversight as they have been removed in later firmware versions). This oversight was beneficial to the reverse engineering process, although of course not a true prerequisite. Indeed, we began exploring the kernel by examining built-in metadata in the form of the syscall handler table - focusing on the ps4-specific entries.
Each process object in the kernel contains its own “idt” (ID Table) object. As can be inferred from the snippet above, the hash table essentially just stores pointers to opaque data blobs, along with a given kind and name. Entries may be accessed (and thus “locked”) with either read or write intent. Note that IDTTYPE is not a bitfield consisting of only unique powers of 2. This means that if we can control the kind of an identry, we may be able to cause a type confusion to occur (it is assumed that we may control name).
Exploitation
To an exploiter without ps4 background, it might seem that the easiest way to exploit this bug would be to take advantage of the write off the end of the malloc’d namedobjusrt object. However, this turns out to be impossible (as far as I know) because of a side effect of the ps4 page size being changed to 0x4000 bytes (from the normal of 0x1000). It appears that in order to change the page size globally, the ps4 kernel developers opted to directly change the related macros. One of the many changes resulting from this is that the smallest actual amount of memory which malloc may give back to a caller becomes 0x40 bytes. While this also results in tons of memory being completely wasted, it does serve to nullify certain exploitation techniques (likely completely by accident…).
Adieu
The namedobj exploit was present and exploitable (albeit using a slightly different method than described here) until it was fixed in firmware version 4.06. This vulnerability was also found and exploited by (at least) Chaitin Tech, so props to them! Taking a quick look at the 4.07 kernel, we can see a straightforward fix (4.06 is assumed to be identical - only had 4.07 on hand while writing this post):

int sys_namedobj_create(struct thread *td, void *args) {
  // ...
  rv = EINVAL;
  kind = *((_DWORD *)args + 4)
  if ( !(kind &amp;amp; 0x4000) &amp;amp;&amp;amp; *(_QWORD *)args ) {
    // ... (unchanged)
  }
  return rv;
}

And so we say goodbye to a nice exploit. I hope you enjoyed this blast from the past :) Keep hacking!
OpenZFS Developer Summit 2017 Recap (https://www.ixsystems.com/blog/openzfs-devsummit-2017/)
The 5th annual OpenZFS Developer Summit was held in San Francisco on October 24-25. Hosted by Delphix at the Children’s Creativity Museum in San Francisco, over a hundred OpenZFS contributors from a wide variety of companies attended and collaborated during the conference and developer summit. iXsystems was a Gold sponsor and several iXsystems employees attended the conference, including the entire Technical Documentation Team, the Director of Engineering, the Senior Analyst, a Tier 3 Support Engineer, and a Tier 2 QA Engineer.
Day 1 of the conference had 9 highly detailed, informative, and interactive technical presentations from companies which use or contribute to OpenZFS. The presentations highlighted improvements to OpenZFS developed “in-house” at each of these companies, with most improvements looking to be made available to the entire OpenZFS community in the near to long term. There’s a lot of exciting stuff happening in the OpenZFS community and this post provides an overview of the presented features and proof-of-concepts.
The keynote was delivered by Mark Maybee who spoke about the past, present, and future of ZFS at Oracle. An original ZFS developer, he outlined the history of closed-source ZFS development after Oracle’s acquisition of Sun. ZFS has a fascinating history, as the project has evolved over the last decade in both open and closed source forms, independent of one another. While Oracle’s proprietary internal version of ZFS has diverged from OpenZFS, it has implemented many of the same features. Mark was very proud of the work his team had accomplished over the years, claiming Oracle’s ZFS products have accounted for over a billion dollars in sales and are used in the vast majority of Fortune 100 companies. However, with Oracle aggressively moving into cloud storage, the future of closed source ZFS is uncertain. Mark presented a few ideas to transform ZFS into a mainstream and standard file system, including adding more robust support for Linux.
Allan Jude from ScaleEngine talked about ZStandard, a new compression method he is developing in collaboration with Facebook. It offers compression comparable to gzip, but at speeds fast enough to keep up with hard drive bandwidth. According to early testing, it improves both the speed and compression efficiency over the current LZ4 compression algorithm. It also offers a new “dictionary” feature for improving image compression, which is of particular interest to Facebook. In addition, when using ZFS send and receive, it will adapt the compression ratio to make the most efficient use of the network bandwidth.
Currently, deleting a clone on ZFS is a time-consuming process, especially when dealing with large datasets that have diverged over time. Sara Hartse from Delphix described how “clone fast delete” speeds up clone deletion. Rather than traversing the entire dataset during clone deletion, changes to the clone are tracked in a “live list” which the delete process uses to determine which blocks to free.  In addition, rather than having to wait for the clone to finish, the delete process backgrounds the task so you can keep working without any interruptions. Sara shared the findings of a test they ran on a clone with 500MB of data, which took 45 minutes to delete with the old method, and under a minute using the live list. This behavior is an optional property as it may not be appropriate for long-lived clones where deletion times are not a concern. At this time, it does not support promoted clones.
Olaf Faaland from Lawrence Livermore National Labs demonstrated the progress his team has made to improve ZFS pool imports with MMP (Multi-Modifier Protection), a watchdog system to make sure that ZFS pools in clustered High Availability environments are not imported by more than one host at a time.  MMP uses uberblocks and other low-level ZFS features to monitor pool import status and otherwise safeguard the import process. MMP adds fields to on-disk metadata so it does not depend on hardware, such as SAS. It supports multi-node HA configs and does not affect non-HA systems. However, it does have issues with long I/O delays so existing HA software is recommended as an additional fallback.
Jörgen Lundman of GMO Internet gave an entertaining talk on the trials and tribulations of porting ZFS to OS X.  As a bonus, he talked about porting ZFS to Windows, and showed a working demo.  While not yet in a usable state, it demonstrated a proof-of-concept of ZFS support for other platforms.
Serapheim Dimitropoulos from Delphix discussed Faster Allocation with the Log Spacemap as a means of optimizing ZFS allocation performance. He began with an in-depth overview of metaslabs and how log spacemaps are used to track allocated and freed blocks. Since blocks are only allocated from loaded metaslabs but freed blocks may apply to any metaslab, over time logging the freed blocks to each appropriate metaslab with every txg becomes less efficient. Their solution is to create a pool-wide metaslab for unflushed entries.
Shailendra Tripathi from Tegile presented iFlash: Dynamic Adaptive L2ARC Caching. This was an interesting talk on what is required to allow very different classes of resources to share the same flash device–in their case, ZIL, L2ARC, and metadata. To achieve this, they needed to address the following differences for each class: queue priority, metaslab load policy, allocation, and data protection (as cache has no redundancy).
Isaac Huang of Intel introduced DRAID, or parity declustered RAID. Once available, this will provide the same levels of redundancy as traditional RAIDZ, providing the administrator doubles the amount of options for providing redundancy for their use case. The goals of DRAID are to address slow resilvering times and the write throughput of a single replacement drive being a bottleneck. This solution skips block pointer tree traversal when rebuilding the pool after drive failure, which is the cause of long resilver times. This means that redundancy is restored quickly, mitigating the risk of losing additional drives before the resilver completes, but it does require a scrub afterwards to confirm data integrity. This solution supports logical spares, which must be defined at vdev creation time, which are used to quickly restore the array.
Prakash Surya of Delphix described how ZIL commits currently occur in batches, where waiting threads have to wait for the batch to complete. His proposed solution was to replace batch commits and to instead notify the waiting thread after its ZIL commit in order to greatly increase throughput.  A new tunable for the log write block timeout can also be used to log write blocks more efficiently.
Overall, the quality of the presentations at the 2017 OpenZFS conference was high. While quite technical, they clearly explained the scope of the problems being addressed and how the proposed solutions worked. We look forward to seeing the described features integrated into OpenZFS. The videos and slides for the presentations should be made available over the next month or so at the OpenZFS website.
OpenZFS Photo Album (https://photos.google.com/share/AF1QipNxYQuOm5RDxRgRQ4P8BhtoLDpyCuORKWiLPT0WlvUmZYDdrX3334zu5lvY_sxRBA?key=MW5fR05MdUdPaXFKVDliQVJEb3N3Uy1uMVFFdVdR)
DragonflyBSD 5.0 (https://www.dragonflybsd.org/release50/)
DragonFly version 5.0 brings the first bootable release of HAMMER2, DragonFly's next generation file system.
HAMMER2
Preliminary HAMMER2 support has been released into the wild as-of the 5.0 release. This support is considered EXPERIMENTAL and should generally not yet be used for production machines and important data. The boot loader will support both UFS and HAMMER2 /boot. The installer will still use a UFS /boot even for a HAMMER2 installation because the /boot partition is typically very small and HAMMER2, like HAMMER1, does not instantly free space when files are deleted or replaced.
DragonFly 5.0 has single-image HAMMER2 support, with live dedup (for cp's), compression, fast recovery, snapshot, and boot support. HAMMER2 does not yet support multi-volume or clustering, though commands for it exist. Please use non-clustered single images for now.
ipfw Updates
IPFW has gone through a number of updates in DragonFly and now offers better performance. pf and ipfw3 are also still supported.
Improved graphics support
The i915 driver has been brought up to match what's in the Linux 4.7.10 kernel. Intel GPUs are supported up to the Kabylake generation.
vga_switcheroo(4) module added, allowing the use of Intel GPUs on hybrid-graphics systems.
The new apple_gmux driver enables switching to the Intel video chipset on dual Intel/NVIDIA and Intel/Radeon Macbook computers.
Other user-affecting changes
efisetup(8) added.
DragonFly can now support over 900,000 processes on a single machine.
Client-side SSH by default does not try password authentication, which is the default behavior in newer versions of OpenSSH. Pass an explicit '-o PasswordAuthentication=yes' or change /etc/ssh/ssh_config if you need the old behavior. Public key users are unaffected.
Clang status
A starting framework has been added for using clang as the alternate base compiler in DragonFly, to replace gcc 4.7. It's not yet complete. Clang can of course be added as a package.
Package updates
Many package updates but I think most notably we need to point to chrome60 finally getting into dports with accelerated video and graphics support.
64-bit status
Note that DragonFly is a 64-bit-only operating system as of 4.6, and will not run on 32-bit hardware.
AMD Ryzen is supported and DragonFly 5.0 has a workaround for a hardware bug (http://lists.dragonflybsd.org/pipermail/commits/2017-August/626190.html).
DragonFly quickly released a v5.0.1 with a few patches Download link (https://www.dragonflybsd.org/download/)
News Roundup
(r)vmadm – managing FreeBSD jails (https://blog.project-fifo.net/rvmadm-managing-freebsd-jails/)
We are releasing the first version (0.1.0) of our clone of vmadm for FreeBSD jails today. It is not done or feature complete, but it does provides basic functionality.  At this point, we think it would be helpful to get it out there and get some feedback. As of today, it allows basic management of datasets, as well as creating, starting, stopping, and destroying jails.
Why another tool to manage jails
However, before we go into details let’s talk why we build yet another jail manager? It is not the frequent NIH syndrome, actually quite the opposite. In FiFo 0.9.2 we experimented with iocage as a way to control jails. While iocage is a useful tool when used as a CLI utility it has some issues when used programmatically.
When managing jails automatically and not via a CLI tool things like performance, or a machine parsable interface matter. While on a CLI it is acceptable if a call takes a second or two, for automatically consuming a tool this delay is problematic.
Another reason for the decision was that vmadm is an excellent tool. It is very well designed. SmartOs uses vmadm for years now. Given all that, we opted for adopting a proven interface rather than trying to create a new one. Since we already interface with it on SmartOS, we can reuse a majority of our management code between SmartOS and FreeBSD.
What can we do
Today we can manage datasets, which are jail templates in the form of ZFS volumes. We can list and serve them from a dataset-server, and fetch those we like want. At this point, we provide datasets for FreeBSD 10.0 to 11.1, but it is very likely that the list will grow. As an idea here is a community-driven list of datasets (https://datasets.at/) that exist for SmartOS today. Moreover, while those datasets will not work, we hope to see the same for BSD jails.
After fetching the dataset, we can define jails by using a JSON file. This file is compatible with the zone description used on SmartOS. It does not provide all the same features but a subset. Resources such as CPU and memory can be defined, networking configured, a dataset selected and necessary settings like hostname set.
With the jail created, vmadm allows managing its lifetime, starting, stopping it, accessing the console and finally destroying it. Updates to jails are supported to however as of today they are only taken into account after restarting the jail. However, this is in large parts not a technical impossibility but rather wasn’t high up on the TODO list.
It is worth mentioning that vmadm will not pick up jails created in other tools or manually. Only using vmadm created jails was a conscious decision to prevent it interfering with existing setups or other utilities. While conventional tools can manage jails set up with vmadm just fine we use some special tricks like nested jails to allow for restrictions required for multi-tenancy that are hard or impossible to achieve otherwise.
Whats next
First and foremost we hope to get some feedback and perhaps community engagement. In the meantime, as announced earlier this year (https://blog.project-fifo.net/fifo-in-2017/), we are hard at work integrating FreeBSD hypervisors in FiFo, and as of writing this, the core actions work quite well.
Right now only the barebone functions are supported, some of the output is not as clear as we would like. We hope to eventually add support for behyve to vmadm the same way that it supports KVM on SmartOS. Moreover, the groundwork for this already exists in the nested jail techniques we are using.
Other than that we are exploring ways to allow for PCI pass through in jails, something not possible in SmartOS zones right now that would be beneficial for some users.
In general, we want to improve compatibility with SmartOS as much as possible and features that we add over time should make the specifications invalid for SmartOS.
You can get the tool from github (https://github.com/project-fifo/r-vmadm).
***
Parallel processing with unix tools (http://www.pixelbeat.org/docs/unix-parallel-tools.html)
There are various ways to use parallel processing in UNIX:
piping
An often under appreciated idea in the unix pipe model is that the components of the pipe run in parallel. This is a key advantage leveraged when combining simple commands that do "one thing well"
split -n, xargs -P, parallel
Note programs that are invoked in parallel by these, need to output atomically for each item processed, which the GNU coreutils are careful to do for factor and sha*sum, etc. Generally commands that use stdio for output can be wrapped with the stdbuf -oL command to avoid intermixing lines from parallel invocations
make -j
Most implementations of make(1) now support the -j option to process targets in parallel. make(1) is generally a higher level tool designed to process disparate tasks and avoid reprocessing already generated targets. For example it is used very effictively when testing coreutils where about 700 tests can be processed in 13 seconds on a 40 core machine.
implicit threading
This goes against the unix model somewhat and definitely adds internal complexity to those tools. The advantages can be less data copying overhead, and simpler usage, though its use needs to be carefully considered. A disadvantage is that one loses the ability to easily distribute commands to separate systems. Examples are GNU sort(1) and turbo-linecount
The example provided counts lines in parallel:
The examples below will compare the above methods for implementing multi-processing, for the function of counting lines in a file. First of all let's generate some test data. We use both long and short lines to compare the overhead of the various methods compared to the core cost of the function being performed:
$ seq 100000000 &amp;gt; lines.txt  # 100M lines
$ yes $(yes longline | head -n9) | head -n10000000 &amp;gt; long-lines.txt  # 10M lines
We'll also define the add() { paste -d+ -s | bc; } helper function to add a list of numbers.
Note the following runs were done against cached files, and thus not I/O bound. Therefore we limit the number of processes in parallel to $(nproc), though you would generally benefit to raising that if your jobs are waiting on network or disk etc.
+ We'll use this command to count lines for most methods, so here is the base non multi-processing performance for comparison:
$ time wc -l lines.txt
$ time wc -l long-lines.txt
split -n
Note using -n alone is not enough to parallelize. For example this will run serially with each chunk, because since --filter may write files, the -n pertains to the number of files to split into rather than the number to process in parallel.
$ time split -n$(nproc) --filter='wc -l' lines.txt | add
You can either run multiple invocations of split in parallel on separate portions of the file like:
$ time for i in $(seq $(nproc)); do
       split -n$i/$(nproc) lines.txt | wc -l&amp;amp;
  done | add
Or split can do parallel mode using round robin on each line, but that's huge overhead in this case. (Note also the -u option significant with -nr):
$ time split -nr/$(nproc) --filter='wc -l' lines.txt | add
Round robin would only be useful when the processing per item is significant.
Parallel isn't well suited to processing a large single file, rather focusing on distributing multiple files to commands. It can't efficiently split to lightweight processing if reading sequentially from pipe:
$ time parallel --will-cite --block=200M --pipe 'wc -l' &amp;lt; lines.txt | add
Like parallel, xargs is designed to distribute separate files to commands, and with the -P option can do so in parallel. If you have a large file then it may be beneficial to presplit it, which could also help with I/O bottlenecks if the pieces were placed on separate devices:
split -d -n l/$(nproc) lines.txt l.
Those pieces can then be processed in parallel like:
$ time find -maxdepth 1 -name 'l.*' |
xargs -P$(nproc) -n1 wc -l | cut -f1 -d' ' | add
If your file sizes are unrelated to the number of processors then you will probably want to adjust -n1 to batch together more files to reduce the number of processes run in total. Note you should always specify -n with -P to avoid xargs accumulating too many input items, thus impacting the parallelism of the processes it runs.
make(1) is generally used to process disparate tasks, though can be leveraged to provide low level parallel processing on a bunch of files. Note also the make -O option which avoids the need for commands to output their data atomically, letting make do the synchronization. We'll process the presplit files as generated for the xargs example above, and to support that we'll use the following Makefile:
%: FORCE     # Always run the command
  @wc -l &amp;lt; $@
FORCE: ;
Makefile: ;  # Don't include Makefile itself
One could generate this and pass to make(1) with the -f option, though we'll keep it as a separate Makefile here for simplicity. This performs very well and matches the performance of xargs.
$ time find -name 'l.*' -exec make -j$(nproc) {} + | add
Note we use the POSIX specified "find ... -exec ... {} +" construct, rather than conflating the example with xargs. This construct like xargs will pass as many files to make as possible, which make(1) will then process in parallel.
OpenBSD gives a hint on forgetting unlock mutex (http://nanxiao.me/en/openbsd-gives-a-hint-on-forgetting-unlock-mutex/)
OpenBSD gives a hint on forgetting unlock mutex
Check following simple C++ program:
&amp;gt; ```
#include 
int main(void)
{
    std::mutex m;
    m.lock();
return 0;
}
```
The mutex m forgot unlock itself before exiting main function:

m.unlock();

Test it on GNU/Linux, and I chose ArchLinux as the testbed:

$ uname -a
Linux fujitsu-i 4.13.7-1-ARCH #1 SMP PREEMPT Sat Oct 14 20:13:26 CEST 2017 x86_64 GNU/Linux
$ clang++ -g -pthread -std=c++11 test_mutex.cpp
$ ./a.out
$

The process exited normally, and no more words was given. Build and run it on OpenBSD 6.2:

clang++ -g -pthread -std=c++11 test_mutex.cpp
./a.out
pthread_mutex_destroy on mutex with waiters!

The OpenBSD prompts “pthreadmutexdestroy on mutex with waiters!“. Interesting!
***
Beastie Bits
Updates to the NetBSD operating system since OSHUG #57 &amp;amp; #58 (http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2017-October/014148.html)
Creating a jail with FiFo and Digital Ocean (https://blog.project-fifo.net/fifo-jails-digital-ocean/)
I'm thinking about OpenBSD again (http://stevenrosenberg.net/blog/bsd/openbsd/2017_0924_openbsd)
Kernel ASLR on amd64 (https://blog.netbsd.org/tnf/entry/kernel_aslr_on_amd64)
Call for Participation - BSD Devroom at FOSDEM (https://people.freebsd.org/~rodrigo/fosdem18/)
BSD Stockholm Meetup (https://www.meetup.com/BSD-Users-Stockholm/)
***
Feedback/Questions
architect - vBSDCon (http://dpaste.com/15D5SM4#wrap)
Brad - Packages and package dependencies (http://dpaste.com/3MENN0X#wrap)
Lars - dpb (http://dpaste.com/2SVS18Y)
Alex re: PS4 Network Throttling (http://dpaste.com/028BCFA#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We have a first PS4 kernel exploit, the long awaited OpenZFS devsummit report by Allan, DragonflyBSD 5.0 is out, we show you vmadm to manage jails, and parallel processing with Unix tools.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/" rel="nofollow">The First PS4 Kernel Exploit: Adieu</a></h3>

<ul>
<li>The First PS4 Kernel Exploit: Adieu</li>
</ul>

<blockquote>
<p>Plenty of time has passed since we first demonstrated Linux running on the PS4.  Now we will step back a bit and explain how we managed to jump from the browser process into the kernel such that ps4-kexec et al. are usable.  Over time, ps4 firmware revisions have progressively added many mitigations and in general tried to lock down the system. This post will mainly touch on vulnerabilities and issues which are not present on the latest releases, but should still be useful for people wanting to investigate ps4 security.</p>
</blockquote>

<ul>
<li>Vulnerability Discovery</li>
</ul>

<blockquote>
<p>As previously explained, we were able to get a dump of the ps4 firmware 1.01 kernel via a PCIe man-in-the-middle attack. Like all FreeBSD kernels, this image included export symbols - symbols which are required to perform kernel and module initialization processes. However, the ps4 1.01 kernel also included full ELF symbols (obviously an oversight as they have been removed in later firmware versions). This oversight was beneficial to the reverse engineering process, although of course not a true prerequisite. Indeed, we began exploring the kernel by examining built-in metadata in the form of the syscall handler table - focusing on the ps4-specific entries.<br>
Each process object in the kernel contains its own idt (ID Table) object. As can be inferred from the snippet above, the hash table essentially just stores pointers to opaque data blobs, along with a given kind and name. Entries may be accessed (and thus locked) with either read or write intent. Note that IDT_TYPE is not a bitfield consisting of only unique powers of 2. This means that if we can control the kind of an id_entry, we may be able to cause a type confusion to occur (it is assumed that we may control name).</p>
</blockquote>

<ul>
<li>Exploitation</li>
</ul>

<blockquote>
<p>To an exploiter without ps4 background, it might seem that the easiest way to exploit this bug would be to take advantage of the write off the end of the mallocd namedobj_usr_t object. However, this turns out to be impossible (as far as I know) because of a side effect of the ps4 page size being changed to 0x4000 bytes (from the normal of 0x1000). It appears that in order to change the page size globally, the ps4 kernel developers opted to directly change the related macros. One of the many changes resulting from this is that the smallest actual amount of memory which malloc may give back to a caller becomes 0x40 bytes. While this also results in tons of memory being completely wasted, it does serve to nullify certain exploitation techniques (likely completely by accident).</p>
</blockquote>

<ul>
<li>Adieu</li>
</ul>

<blockquote>
<p>The namedobj exploit was present and exploitable (albeit using a slightly different method than described here) until it was fixed in firmware version 4.06. This vulnerability was also found and exploited by (at least) Chaitin Tech, so props to them! Taking a quick look at the 4.07 kernel, we can see a straightforward fix (4.06 is assumed to be identical - only had 4.07 on hand while writing this post):</p>

<pre><code>int sys_namedobj_create(struct thread *td, void *args) {
  // ...
  rv = EINVAL;
  kind = *((_DWORD *)args + 4)
  if ( !(kind &amp; 0x4000) &amp;&amp; *(_QWORD *)args ) {
    // ... (unchanged)
  }
  return rv;
}
</code></pre>

<p>And so we say goodbye to a nice exploit. I hope you enjoyed this blast from the past :) Keep hacking!</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/openzfs-devsummit-2017/" rel="nofollow">OpenZFS Developer Summit 2017 Recap</a></h3>

<blockquote>
<p>The 5th annual OpenZFS Developer Summit was held in San Francisco on October 24-25. Hosted by Delphix at the Childrens Creativity Museum in San Francisco, over a hundred OpenZFS contributors from a wide variety of companies attended and collaborated during the conference and developer summit. iXsystems was a Gold sponsor and several iXsystems employees attended the conference, including the entire Technical Documentation Team, the Director of Engineering, the Senior Analyst, a Tier 3 Support Engineer, and a Tier 2 QA Engineer.<br>
Day 1 of the conference had 9 highly detailed, informative, and interactive technical presentations from companies which use or contribute to OpenZFS. The presentations highlighted improvements to OpenZFS developed in-house at each of these companies, with most improvements looking to be made available to the entire OpenZFS community in the near to long term. Theres a lot of exciting stuff happening in the OpenZFS community and this post provides an overview of the presented features and proof-of-concepts.<br>
The keynote was delivered by Mark Maybee who spoke about the past, present, and future of ZFS at Oracle. An original ZFS developer, he outlined the history of closed-source ZFS development after Oracles acquisition of Sun. ZFS has a fascinating history, as the project has evolved over the last decade in both open and closed source forms, independent of one another. While Oracles proprietary internal version of ZFS has diverged from OpenZFS, it has implemented many of the same features. Mark was very proud of the work his team had accomplished over the years, claiming Oracles ZFS products have accounted for over a billion dollars in sales and are used in the vast majority of Fortune 100 companies. However, with Oracle aggressively moving into cloud storage, the future of closed source ZFS is uncertain. Mark presented a few ideas to transform ZFS into a mainstream and standard file system, including adding more robust support for Linux.<br>
Allan Jude from ScaleEngine talked about ZStandard, a new compression method he is developing in collaboration with Facebook. It offers compression comparable to gzip, but at speeds fast enough to keep up with hard drive bandwidth. According to early testing, it improves both the speed and compression efficiency over the current LZ4 compression algorithm. It also offers a new dictionary feature for improving image compression, which is of particular interest to Facebook. In addition, when using ZFS send and receive, it will adapt the compression ratio to make the most efficient use of the network bandwidth.<br>
Currently, deleting a clone on ZFS is a time-consuming process, especially when dealing with large datasets that have diverged over time. Sara Hartse from Delphix described how clone fast delete speeds up clone deletion. Rather than traversing the entire dataset during clone deletion, changes to the clone are tracked in a live list which the delete process uses to determine which blocks to free.  In addition, rather than having to wait for the clone to finish, the delete process backgrounds the task so you can keep working without any interruptions. Sara shared the findings of a test they ran on a clone with 500MB of data, which took 45 minutes to delete with the old method, and under a minute using the live list. This behavior is an optional property as it may not be appropriate for long-lived clones where deletion times are not a concern. At this time, it does not support promoted clones.<br>
Olaf Faaland from Lawrence Livermore National Labs demonstrated the progress his team has made to improve ZFS pool imports with MMP (Multi-Modifier Protection), a watchdog system to make sure that ZFS pools in clustered High Availability environments are not imported by more than one host at a time.  MMP uses uberblocks and other low-level ZFS features to monitor pool import status and otherwise safeguard the import process. MMP adds fields to on-disk metadata so it does not depend on hardware, such as SAS. It supports multi-node HA configs and does not affect non-HA systems. However, it does have issues with long I/O delays so existing HA software is recommended as an additional fallback.<br>
Jörgen Lundman of GMO Internet gave an entertaining talk on the trials and tribulations of porting ZFS to OS X.  As a bonus, he talked about porting ZFS to Windows, and showed a working demo.  While not yet in a usable state, it demonstrated a proof-of-concept of ZFS support for other platforms.<br>
Serapheim Dimitropoulos from Delphix discussed Faster Allocation with the Log Spacemap as a means of optimizing ZFS allocation performance. He began with an in-depth overview of metaslabs and how log spacemaps are used to track allocated and freed blocks. Since blocks are only allocated from loaded metaslabs but freed blocks may apply to any metaslab, over time logging the freed blocks to each appropriate metaslab with every txg becomes less efficient. Their solution is to create a pool-wide metaslab for unflushed entries.<br>
Shailendra Tripathi from Tegile presented iFlash: Dynamic Adaptive L2ARC Caching. This was an interesting talk on what is required to allow very different classes of resources to share the same flash devicein their case, ZIL, L2ARC, and metadata. To achieve this, they needed to address the following differences for each class: queue priority, metaslab load policy, allocation, and data protection (as cache has no redundancy).<br>
Isaac Huang of Intel introduced DRAID, or parity declustered RAID. Once available, this will provide the same levels of redundancy as traditional RAIDZ, providing the administrator doubles the amount of options for providing redundancy for their use case. The goals of DRAID are to address slow resilvering times and the write throughput of a single replacement drive being a bottleneck. This solution skips block pointer tree traversal when rebuilding the pool after drive failure, which is the cause of long resilver times. This means that redundancy is restored quickly, mitigating the risk of losing additional drives before the resilver completes, but it does require a scrub afterwards to confirm data integrity. This solution supports logical spares, which must be defined at vdev creation time, which are used to quickly restore the array.<br>
Prakash Surya of Delphix described how ZIL commits currently occur in batches, where waiting threads have to wait for the batch to complete. His proposed solution was to replace batch commits and to instead notify the waiting thread after its ZIL commit in order to greatly increase throughput.  A new tunable for the log write block timeout can also be used to log write blocks more efficiently.<br>
Overall, the quality of the presentations at the 2017 OpenZFS conference was high. While quite technical, they clearly explained the scope of the problems being addressed and how the proposed solutions worked. We look forward to seeing the described features integrated into OpenZFS. The videos and slides for the presentations should be made available over the next month or so at the OpenZFS website.</p>
</blockquote>

<ul>
<li><a href="https://photos.google.com/share/AF1QipNxYQuOm5RDxRgRQ4P8BhtoLDpyCuORKWiLPT0WlvUmZYDdrX3334zu5lvY_sxRBA?key=MW5fR05MdUdPaXFKVDliQVJEb3N3Uy1uMVFFdVdR" rel="nofollow">OpenZFS Photo Album</a></li>
</ul>

<hr>

<h3><a href="https://www.dragonflybsd.org/release50/" rel="nofollow">DragonflyBSD 5.0</a></h3>

<ul>
<li>DragonFly version 5.0 brings the first bootable release of HAMMER2, DragonFly&#39;s next generation file system.</li>
<li>HAMMER2

<ul>
<li>Preliminary HAMMER2 support has been released into the wild as-of the 5.0 release. This support is considered EXPERIMENTAL and should generally not yet be used for production machines and important data. The boot loader will support both UFS and HAMMER2 /boot. The installer will still use a UFS /boot even for a HAMMER2 installation because the /boot partition is typically very small and HAMMER2, like HAMMER1, does not instantly free space when files are deleted or replaced.</li>
<li>DragonFly 5.0 has single-image HAMMER2 support, with live dedup (for cp&#39;s), compression, fast recovery, snapshot, and boot support. HAMMER2 does not yet support multi-volume or clustering, though commands for it exist. Please use non-clustered single images for now.</li>
</ul></li>
<li>ipfw Updates

<ul>
<li>IPFW has gone through a number of updates in DragonFly and now offers better performance. pf and ipfw3 are also still supported.</li>
</ul></li>
<li>Improved graphics support

<ul>
<li>The i915 driver has been brought up to match what&#39;s in the Linux 4.7.10 kernel. Intel GPUs are supported up to the Kabylake generation.</li>
<li>vga_switcheroo(4) module added, allowing the use of Intel GPUs on hybrid-graphics systems.</li>
<li>The new apple_gmux driver enables switching to the Intel video chipset on dual Intel/NVIDIA and Intel/Radeon Macbook computers.</li>
</ul></li>
<li>Other user-affecting changes

<ul>
<li>efisetup(8) added.</li>
<li>DragonFly can now support over 900,000 processes on a single machine.</li>
<li>Client-side SSH by default does not try password authentication, which is the default behavior in newer versions of OpenSSH. Pass an explicit &#39;-o PasswordAuthentication=yes&#39; or change /etc/ssh/ssh_config if you need the old behavior. Public key users are unaffected.</li>
</ul></li>
<li>Clang status

<ul>
<li>A starting framework has been added for using clang as the alternate base compiler in DragonFly, to replace gcc 4.7. It&#39;s not yet complete. Clang can of course be added as a package.</li>
</ul></li>
<li>Package updates

<ul>
<li>Many package updates but I think most notably we need to point to chrome60 finally getting into dports with accelerated video and graphics support.</li>
</ul></li>
<li>64-bit status

<ul>
<li>Note that DragonFly is a 64-bit-only operating system as of 4.6, and will not run on 32-bit hardware.</li>
<li>AMD Ryzen is supported and DragonFly 5.0 has a workaround for a <a href="http://lists.dragonflybsd.org/pipermail/commits/2017-August/626190.html" rel="nofollow">hardware bug</a>.</li>
</ul></li>
<li>DragonFly quickly released a v5.0.1 with a few patches <a href="https://www.dragonflybsd.org/download/" rel="nofollow">Download link</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.project-fifo.net/rvmadm-managing-freebsd-jails/" rel="nofollow">(r)vmadm  managing FreeBSD jails</a></h3>

<blockquote>
<p>We are releasing the first version (0.1.0) of our clone of vmadm for FreeBSD jails today. It is not done or feature complete, but it does provides basic functionality.  At this point, we think it would be helpful to get it out there and get some feedback. As of today, it allows basic management of datasets, as well as creating, starting, stopping, and destroying jails.</p>
</blockquote>

<ul>
<li>Why another tool to manage jails</li>
</ul>

<blockquote>
<p>However, before we go into details lets talk why we build yet another jail manager? It is not the frequent NIH syndrome, actually quite the opposite. In FiFo 0.9.2 we experimented with iocage as a way to control jails. While iocage is a useful tool when used as a CLI utility it has some issues when used programmatically.<br>
When managing jails automatically and not via a CLI tool things like performance, or a machine parsable interface matter. While on a CLI it is acceptable if a call takes a second or two, for automatically consuming a tool this delay is problematic.<br>
Another reason for the decision was that vmadm is an excellent tool. It is very well designed. SmartOs uses vmadm for years now. Given all that, we opted for adopting a proven interface rather than trying to create a new one. Since we already interface with it on SmartOS, we can reuse a majority of our management code between SmartOS and FreeBSD.</p>
</blockquote>

<ul>
<li>What can we do</li>
</ul>

<blockquote>
<p>Today we can manage datasets, which are jail templates in the form of ZFS volumes. We can list and serve them from a dataset-server, and fetch those we like want. At this point, we provide datasets for FreeBSD 10.0 to 11.1, but it is very likely that the list will grow. As an idea <a href="https://datasets.at/" rel="nofollow">here is a community-driven list of datasets</a> that exist for SmartOS today. Moreover, while those datasets will not work, we hope to see the same for BSD jails.<br>
After fetching the dataset, we can define jails by using a JSON file. This file is compatible with the zone description used on SmartOS. It does not provide all the same features but a subset. Resources such as CPU and memory can be defined, networking configured, a dataset selected and necessary settings like hostname set.<br>
With the jail created, vmadm allows managing its lifetime, starting, stopping it, accessing the console and finally destroying it. Updates to jails are supported to however as of today they are only taken into account after restarting the jail. However, this is in large parts not a technical impossibility but rather wasnt high up on the TODO list.<br>
It is worth mentioning that vmadm will not pick up jails created in other tools or manually. Only using vmadm created jails was a conscious decision to prevent it interfering with existing setups or other utilities. While conventional tools can manage jails set up with vmadm just fine we use some special tricks like nested jails to allow for restrictions required for multi-tenancy that are hard or impossible to achieve otherwise.</p>
</blockquote>

<ul>
<li>Whats next</li>
</ul>

<blockquote>
<p>First and foremost we hope to get some feedback and perhaps community engagement. In the meantime, as <a href="https://blog.project-fifo.net/fifo-in-2017/" rel="nofollow">announced earlier this year</a>, we are hard at work integrating FreeBSD hypervisors in FiFo, and as of writing this, the core actions work quite well.<br>
Right now only the barebone functions are supported, some of the output is not as clear as we would like. We hope to eventually add support for behyve to vmadm the same way that it supports KVM on SmartOS. Moreover, the groundwork for this already exists in the nested jail techniques we are using.<br>
Other than that we are exploring ways to allow for PCI pass through in jails, something not possible in SmartOS zones right now that would be beneficial for some users.<br>
In general, we want to improve compatibility with SmartOS as much as possible and features that we add over time should make the specifications invalid for SmartOS.</p>
</blockquote>

<ul>
<li>You can get the tool <a href="https://github.com/project-fifo/r-vmadm" rel="nofollow">from github</a>.
***</li>
</ul>

<h3><a href="http://www.pixelbeat.org/docs/unix-parallel-tools.html" rel="nofollow">Parallel processing with unix tools</a></h3>

<ul>
<li>There are various ways to use parallel processing in UNIX:</li>
</ul>

<blockquote>
<p>piping<br>
An often under appreciated idea in the unix pipe model is that the components of the pipe run in parallel. This is a key advantage leveraged when combining simple commands that do &quot;one thing well&quot;<br>
split -n, xargs -P, parallel<br>
Note programs that are invoked in parallel by these, need to output atomically for each item processed, which the GNU coreutils are careful to do for factor and sha*sum, etc. Generally commands that use stdio for output can be wrapped with the <code>stdbuf -oL</code> command to avoid intermixing lines from parallel invocations<br>
make -j<br>
Most implementations of make(1) now support the -j option to process targets in parallel. make(1) is generally a higher level tool designed to process disparate tasks and avoid reprocessing already generated targets. For example it is used very effictively when testing coreutils where about 700 tests can be processed in 13 seconds on a 40 core machine.<br>
implicit threading<br>
This goes against the unix model somewhat and definitely adds internal complexity to those tools. The advantages can be less data copying overhead, and simpler usage, though its use needs to be carefully considered. A disadvantage is that one loses the ability to easily distribute commands to separate systems. Examples are GNU sort(1) and turbo-linecount</p>
</blockquote>

<ul>
<li>The example provided counts lines in parallel:</li>
</ul>

<blockquote>
<p>The examples below will compare the above methods for implementing multi-processing, for the function of counting lines in a file. First of all let&#39;s generate some test data. We use both long and short lines to compare the overhead of the various methods compared to the core cost of the function being performed:<br>
$ seq 100000000 &gt; lines.txt  # 100M lines<br>
$ yes $(yes longline | head -n9) | head -n10000000 &gt; long-lines.txt  # 10M lines</p>

<p>We&#39;ll also define the add() { paste -d+ -s | bc; } helper function to add a list of numbers.<br>
Note the following runs were done against cached files, and thus not I/O bound. Therefore we limit the number of processes in parallel to $(nproc), though you would generally benefit to raising that if your jobs are waiting on network or disk etc.</p>

<ul>
<li>We&#39;ll use this command to count lines for most methods, so here is the base non multi-processing performance for comparison:
$ time wc -l lines.txt
$ time wc -l long-lines.txt
split -n
Note using -n alone is not enough to parallelize. For example this will run serially with each chunk, because since --filter may write files, the -n pertains to the number of files to split into rather than the number to process in parallel.
$ time split -n$(nproc) --filter=&#39;wc -l&#39; lines.txt | add</li>
</ul>
</blockquote>

<ul>
<li>You can either run multiple invocations of split in parallel on separate portions of the file like:</li>
</ul>

<blockquote>
<p>$ time for i in $(seq $(nproc)); do<br>
       split -n$i/$(nproc) lines.txt | wc -l&amp;<br>
  done | add</p>
</blockquote>

<ul>
<li>Or split can do parallel mode using round robin on each line, but that&#39;s huge overhead in this case. (Note also the -u option significant with -nr):</li>
</ul>

<blockquote>
<p>$ time split -nr/$(nproc) --filter=&#39;wc -l&#39; lines.txt | add</p>
</blockquote>

<ul>
<li>Round robin would only be useful when the processing per item is significant.</li>
<li>Parallel isn&#39;t well suited to processing a large single file, rather focusing on distributing multiple files to commands. It can&#39;t efficiently split to lightweight processing if reading sequentially from pipe:</li>
</ul>

<blockquote>
<p>$ time parallel --will-cite --block=200M --pipe &#39;wc -l&#39; &lt; lines.txt | add</p>
</blockquote>

<ul>
<li>Like parallel, xargs is designed to distribute separate files to commands, and with the -P option can do so in parallel. If you have a large file then it may be beneficial to presplit it, which could also help with I/O bottlenecks if the pieces were placed on separate devices:</li>
</ul>

<blockquote>
<p>split -d -n l/$(nproc) lines.txt l.<br>
Those pieces can then be processed in parallel like:<br>
$ time find -maxdepth 1 -name &#39;l.*&#39; |<br>
xargs -P$(nproc) -n1 wc -l | cut -f1 -d&#39; &#39; | add</p>
</blockquote>

<ul>
<li>If your file sizes are unrelated to the number of processors then you will probably want to adjust -n1 to batch together more files to reduce the number of processes run in total. Note you should always specify -n with -P to avoid xargs accumulating too many input items, thus impacting the parallelism of the processes it runs.</li>
<li>make(1) is generally used to process disparate tasks, though can be leveraged to provide low level parallel processing on a bunch of files. Note also the make -O option which avoids the need for commands to output their data atomically, letting make do the synchronization. We&#39;ll process the presplit files as generated for the xargs example above, and to support that we&#39;ll use the following Makefile:</li>
</ul>

<blockquote>
<p>%: FORCE     # Always run the command<br>
  @wc -l &lt; $@<br>
FORCE: ;<br>
Makefile: ;  # Don&#39;t include Makefile itself</p>
</blockquote>

<ul>
<li>One could generate this and pass to make(1) with the -f option, though we&#39;ll keep it as a separate Makefile here for simplicity. This performs very well and matches the performance of xargs.</li>
</ul>

<blockquote>
<p>$ time find -name &#39;l.*&#39; -exec make -j$(nproc) {} + | add<br>
Note we use the POSIX specified &quot;find ... -exec ... {} +&quot; construct, rather than conflating the example with xargs. This construct like xargs will pass as many files to make as possible, which make(1) will then process in parallel.</p>

<hr>
</blockquote>

<h3><a href="http://nanxiao.me/en/openbsd-gives-a-hint-on-forgetting-unlock-mutex/" rel="nofollow">OpenBSD gives a hint on forgetting unlock mutex</a></h3>

<ul>
<li>OpenBSD gives a hint on forgetting unlock mutex</li>
<li>Check following simple C++ program:
&gt; ```
#include <mutex></li>
</ul>

<p>int main(void)<br>
{<br>
    std::mutex m;<br>
    m.lock();</p>

<pre><code>return 0;
</code></pre>

<p>}</p>

<pre><code>
+ The mutex m forgot unlock itself before exiting main function:

&gt; ```
m.unlock();
</code></pre>

<ul>
<li>Test it on GNU/Linux, and I chose ArchLinux as the testbed:</li>
</ul>

<blockquote>
<pre><code>$ uname -a
Linux fujitsu-i 4.13.7-1-ARCH #1 SMP PREEMPT Sat Oct 14 20:13:26 CEST 2017 x86_64 GNU/Linux
$ clang++ -g -pthread -std=c++11 test_mutex.cpp
$ ./a.out
$
</code></pre>
</blockquote>

<ul>
<li>The process exited normally, and no more words was given. Build and run it on OpenBSD 6.2:</li>
</ul>

<blockquote>
<pre><code>clang++ -g -pthread -std=c++11 test_mutex.cpp
./a.out
pthread_mutex_destroy on mutex with waiters!
</code></pre>
</blockquote>

<ul>
<li>The OpenBSD prompts pthread_mutex_destroy on mutex with waiters!. Interesting!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2017-October/014148.html" rel="nofollow">Updates to the NetBSD operating system since OSHUG #57 &amp; #58</a></li>
<li><a href="https://blog.project-fifo.net/fifo-jails-digital-ocean/" rel="nofollow">Creating a jail with FiFo and Digital Ocean</a></li>
<li><a href="http://stevenrosenberg.net/blog/bsd/openbsd/2017_0924_openbsd" rel="nofollow">I&#39;m thinking about OpenBSD again</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/kernel_aslr_on_amd64" rel="nofollow">Kernel ASLR on amd64</a></li>
<li><a href="https://people.freebsd.org/%7Erodrigo/fosdem18/" rel="nofollow">Call for Participation - BSD Devroom at FOSDEM</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/" rel="nofollow">BSD Stockholm Meetup</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>architect - <a href="http://dpaste.com/15D5SM4#wrap" rel="nofollow">vBSDCon</a></li>
<li>Brad - <a href="http://dpaste.com/3MENN0X#wrap" rel="nofollow">Packages and package dependencies</a></li>
<li>Lars - <a href="http://dpaste.com/2SVS18Y" rel="nofollow">dpb</a></li>
<li>Alex <a href="http://dpaste.com/028BCFA#wrap" rel="nofollow">re: PS4 Network Throttling</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We have a first PS4 kernel exploit, the long awaited OpenZFS devsummit report by Allan, DragonflyBSD 5.0 is out, we show you vmadm to manage jails, and parallel processing with Unix tools.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/" rel="nofollow">The First PS4 Kernel Exploit: Adieu</a></h3>

<ul>
<li>The First PS4 Kernel Exploit: Adieu</li>
</ul>

<blockquote>
<p>Plenty of time has passed since we first demonstrated Linux running on the PS4.  Now we will step back a bit and explain how we managed to jump from the browser process into the kernel such that ps4-kexec et al. are usable.  Over time, ps4 firmware revisions have progressively added many mitigations and in general tried to lock down the system. This post will mainly touch on vulnerabilities and issues which are not present on the latest releases, but should still be useful for people wanting to investigate ps4 security.</p>
</blockquote>

<ul>
<li>Vulnerability Discovery</li>
</ul>

<blockquote>
<p>As previously explained, we were able to get a dump of the ps4 firmware 1.01 kernel via a PCIe man-in-the-middle attack. Like all FreeBSD kernels, this image included export symbols - symbols which are required to perform kernel and module initialization processes. However, the ps4 1.01 kernel also included full ELF symbols (obviously an oversight as they have been removed in later firmware versions). This oversight was beneficial to the reverse engineering process, although of course not a true prerequisite. Indeed, we began exploring the kernel by examining built-in metadata in the form of the syscall handler table - focusing on the ps4-specific entries.<br>
Each process object in the kernel contains its own idt (ID Table) object. As can be inferred from the snippet above, the hash table essentially just stores pointers to opaque data blobs, along with a given kind and name. Entries may be accessed (and thus locked) with either read or write intent. Note that IDT_TYPE is not a bitfield consisting of only unique powers of 2. This means that if we can control the kind of an id_entry, we may be able to cause a type confusion to occur (it is assumed that we may control name).</p>
</blockquote>

<ul>
<li>Exploitation</li>
</ul>

<blockquote>
<p>To an exploiter without ps4 background, it might seem that the easiest way to exploit this bug would be to take advantage of the write off the end of the mallocd namedobj_usr_t object. However, this turns out to be impossible (as far as I know) because of a side effect of the ps4 page size being changed to 0x4000 bytes (from the normal of 0x1000). It appears that in order to change the page size globally, the ps4 kernel developers opted to directly change the related macros. One of the many changes resulting from this is that the smallest actual amount of memory which malloc may give back to a caller becomes 0x40 bytes. While this also results in tons of memory being completely wasted, it does serve to nullify certain exploitation techniques (likely completely by accident).</p>
</blockquote>

<ul>
<li>Adieu</li>
</ul>

<blockquote>
<p>The namedobj exploit was present and exploitable (albeit using a slightly different method than described here) until it was fixed in firmware version 4.06. This vulnerability was also found and exploited by (at least) Chaitin Tech, so props to them! Taking a quick look at the 4.07 kernel, we can see a straightforward fix (4.06 is assumed to be identical - only had 4.07 on hand while writing this post):</p>

<pre><code>int sys_namedobj_create(struct thread *td, void *args) {
  // ...
  rv = EINVAL;
  kind = *((_DWORD *)args + 4)
  if ( !(kind &amp; 0x4000) &amp;&amp; *(_QWORD *)args ) {
    // ... (unchanged)
  }
  return rv;
}
</code></pre>

<p>And so we say goodbye to a nice exploit. I hope you enjoyed this blast from the past :) Keep hacking!</p>
</blockquote>

<hr>

<h3><a href="https://www.ixsystems.com/blog/openzfs-devsummit-2017/" rel="nofollow">OpenZFS Developer Summit 2017 Recap</a></h3>

<blockquote>
<p>The 5th annual OpenZFS Developer Summit was held in San Francisco on October 24-25. Hosted by Delphix at the Childrens Creativity Museum in San Francisco, over a hundred OpenZFS contributors from a wide variety of companies attended and collaborated during the conference and developer summit. iXsystems was a Gold sponsor and several iXsystems employees attended the conference, including the entire Technical Documentation Team, the Director of Engineering, the Senior Analyst, a Tier 3 Support Engineer, and a Tier 2 QA Engineer.<br>
Day 1 of the conference had 9 highly detailed, informative, and interactive technical presentations from companies which use or contribute to OpenZFS. The presentations highlighted improvements to OpenZFS developed in-house at each of these companies, with most improvements looking to be made available to the entire OpenZFS community in the near to long term. Theres a lot of exciting stuff happening in the OpenZFS community and this post provides an overview of the presented features and proof-of-concepts.<br>
The keynote was delivered by Mark Maybee who spoke about the past, present, and future of ZFS at Oracle. An original ZFS developer, he outlined the history of closed-source ZFS development after Oracles acquisition of Sun. ZFS has a fascinating history, as the project has evolved over the last decade in both open and closed source forms, independent of one another. While Oracles proprietary internal version of ZFS has diverged from OpenZFS, it has implemented many of the same features. Mark was very proud of the work his team had accomplished over the years, claiming Oracles ZFS products have accounted for over a billion dollars in sales and are used in the vast majority of Fortune 100 companies. However, with Oracle aggressively moving into cloud storage, the future of closed source ZFS is uncertain. Mark presented a few ideas to transform ZFS into a mainstream and standard file system, including adding more robust support for Linux.<br>
Allan Jude from ScaleEngine talked about ZStandard, a new compression method he is developing in collaboration with Facebook. It offers compression comparable to gzip, but at speeds fast enough to keep up with hard drive bandwidth. According to early testing, it improves both the speed and compression efficiency over the current LZ4 compression algorithm. It also offers a new dictionary feature for improving image compression, which is of particular interest to Facebook. In addition, when using ZFS send and receive, it will adapt the compression ratio to make the most efficient use of the network bandwidth.<br>
Currently, deleting a clone on ZFS is a time-consuming process, especially when dealing with large datasets that have diverged over time. Sara Hartse from Delphix described how clone fast delete speeds up clone deletion. Rather than traversing the entire dataset during clone deletion, changes to the clone are tracked in a live list which the delete process uses to determine which blocks to free.  In addition, rather than having to wait for the clone to finish, the delete process backgrounds the task so you can keep working without any interruptions. Sara shared the findings of a test they ran on a clone with 500MB of data, which took 45 minutes to delete with the old method, and under a minute using the live list. This behavior is an optional property as it may not be appropriate for long-lived clones where deletion times are not a concern. At this time, it does not support promoted clones.<br>
Olaf Faaland from Lawrence Livermore National Labs demonstrated the progress his team has made to improve ZFS pool imports with MMP (Multi-Modifier Protection), a watchdog system to make sure that ZFS pools in clustered High Availability environments are not imported by more than one host at a time.  MMP uses uberblocks and other low-level ZFS features to monitor pool import status and otherwise safeguard the import process. MMP adds fields to on-disk metadata so it does not depend on hardware, such as SAS. It supports multi-node HA configs and does not affect non-HA systems. However, it does have issues with long I/O delays so existing HA software is recommended as an additional fallback.<br>
Jörgen Lundman of GMO Internet gave an entertaining talk on the trials and tribulations of porting ZFS to OS X.  As a bonus, he talked about porting ZFS to Windows, and showed a working demo.  While not yet in a usable state, it demonstrated a proof-of-concept of ZFS support for other platforms.<br>
Serapheim Dimitropoulos from Delphix discussed Faster Allocation with the Log Spacemap as a means of optimizing ZFS allocation performance. He began with an in-depth overview of metaslabs and how log spacemaps are used to track allocated and freed blocks. Since blocks are only allocated from loaded metaslabs but freed blocks may apply to any metaslab, over time logging the freed blocks to each appropriate metaslab with every txg becomes less efficient. Their solution is to create a pool-wide metaslab for unflushed entries.<br>
Shailendra Tripathi from Tegile presented iFlash: Dynamic Adaptive L2ARC Caching. This was an interesting talk on what is required to allow very different classes of resources to share the same flash devicein their case, ZIL, L2ARC, and metadata. To achieve this, they needed to address the following differences for each class: queue priority, metaslab load policy, allocation, and data protection (as cache has no redundancy).<br>
Isaac Huang of Intel introduced DRAID, or parity declustered RAID. Once available, this will provide the same levels of redundancy as traditional RAIDZ, providing the administrator doubles the amount of options for providing redundancy for their use case. The goals of DRAID are to address slow resilvering times and the write throughput of a single replacement drive being a bottleneck. This solution skips block pointer tree traversal when rebuilding the pool after drive failure, which is the cause of long resilver times. This means that redundancy is restored quickly, mitigating the risk of losing additional drives before the resilver completes, but it does require a scrub afterwards to confirm data integrity. This solution supports logical spares, which must be defined at vdev creation time, which are used to quickly restore the array.<br>
Prakash Surya of Delphix described how ZIL commits currently occur in batches, where waiting threads have to wait for the batch to complete. His proposed solution was to replace batch commits and to instead notify the waiting thread after its ZIL commit in order to greatly increase throughput.  A new tunable for the log write block timeout can also be used to log write blocks more efficiently.<br>
Overall, the quality of the presentations at the 2017 OpenZFS conference was high. While quite technical, they clearly explained the scope of the problems being addressed and how the proposed solutions worked. We look forward to seeing the described features integrated into OpenZFS. The videos and slides for the presentations should be made available over the next month or so at the OpenZFS website.</p>
</blockquote>

<ul>
<li><a href="https://photos.google.com/share/AF1QipNxYQuOm5RDxRgRQ4P8BhtoLDpyCuORKWiLPT0WlvUmZYDdrX3334zu5lvY_sxRBA?key=MW5fR05MdUdPaXFKVDliQVJEb3N3Uy1uMVFFdVdR" rel="nofollow">OpenZFS Photo Album</a></li>
</ul>

<hr>

<h3><a href="https://www.dragonflybsd.org/release50/" rel="nofollow">DragonflyBSD 5.0</a></h3>

<ul>
<li>DragonFly version 5.0 brings the first bootable release of HAMMER2, DragonFly&#39;s next generation file system.</li>
<li>HAMMER2

<ul>
<li>Preliminary HAMMER2 support has been released into the wild as-of the 5.0 release. This support is considered EXPERIMENTAL and should generally not yet be used for production machines and important data. The boot loader will support both UFS and HAMMER2 /boot. The installer will still use a UFS /boot even for a HAMMER2 installation because the /boot partition is typically very small and HAMMER2, like HAMMER1, does not instantly free space when files are deleted or replaced.</li>
<li>DragonFly 5.0 has single-image HAMMER2 support, with live dedup (for cp&#39;s), compression, fast recovery, snapshot, and boot support. HAMMER2 does not yet support multi-volume or clustering, though commands for it exist. Please use non-clustered single images for now.</li>
</ul></li>
<li>ipfw Updates

<ul>
<li>IPFW has gone through a number of updates in DragonFly and now offers better performance. pf and ipfw3 are also still supported.</li>
</ul></li>
<li>Improved graphics support

<ul>
<li>The i915 driver has been brought up to match what&#39;s in the Linux 4.7.10 kernel. Intel GPUs are supported up to the Kabylake generation.</li>
<li>vga_switcheroo(4) module added, allowing the use of Intel GPUs on hybrid-graphics systems.</li>
<li>The new apple_gmux driver enables switching to the Intel video chipset on dual Intel/NVIDIA and Intel/Radeon Macbook computers.</li>
</ul></li>
<li>Other user-affecting changes

<ul>
<li>efisetup(8) added.</li>
<li>DragonFly can now support over 900,000 processes on a single machine.</li>
<li>Client-side SSH by default does not try password authentication, which is the default behavior in newer versions of OpenSSH. Pass an explicit &#39;-o PasswordAuthentication=yes&#39; or change /etc/ssh/ssh_config if you need the old behavior. Public key users are unaffected.</li>
</ul></li>
<li>Clang status

<ul>
<li>A starting framework has been added for using clang as the alternate base compiler in DragonFly, to replace gcc 4.7. It&#39;s not yet complete. Clang can of course be added as a package.</li>
</ul></li>
<li>Package updates

<ul>
<li>Many package updates but I think most notably we need to point to chrome60 finally getting into dports with accelerated video and graphics support.</li>
</ul></li>
<li>64-bit status

<ul>
<li>Note that DragonFly is a 64-bit-only operating system as of 4.6, and will not run on 32-bit hardware.</li>
<li>AMD Ryzen is supported and DragonFly 5.0 has a workaround for a <a href="http://lists.dragonflybsd.org/pipermail/commits/2017-August/626190.html" rel="nofollow">hardware bug</a>.</li>
</ul></li>
<li>DragonFly quickly released a v5.0.1 with a few patches <a href="https://www.dragonflybsd.org/download/" rel="nofollow">Download link</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.project-fifo.net/rvmadm-managing-freebsd-jails/" rel="nofollow">(r)vmadm  managing FreeBSD jails</a></h3>

<blockquote>
<p>We are releasing the first version (0.1.0) of our clone of vmadm for FreeBSD jails today. It is not done or feature complete, but it does provides basic functionality.  At this point, we think it would be helpful to get it out there and get some feedback. As of today, it allows basic management of datasets, as well as creating, starting, stopping, and destroying jails.</p>
</blockquote>

<ul>
<li>Why another tool to manage jails</li>
</ul>

<blockquote>
<p>However, before we go into details lets talk why we build yet another jail manager? It is not the frequent NIH syndrome, actually quite the opposite. In FiFo 0.9.2 we experimented with iocage as a way to control jails. While iocage is a useful tool when used as a CLI utility it has some issues when used programmatically.<br>
When managing jails automatically and not via a CLI tool things like performance, or a machine parsable interface matter. While on a CLI it is acceptable if a call takes a second or two, for automatically consuming a tool this delay is problematic.<br>
Another reason for the decision was that vmadm is an excellent tool. It is very well designed. SmartOs uses vmadm for years now. Given all that, we opted for adopting a proven interface rather than trying to create a new one. Since we already interface with it on SmartOS, we can reuse a majority of our management code between SmartOS and FreeBSD.</p>
</blockquote>

<ul>
<li>What can we do</li>
</ul>

<blockquote>
<p>Today we can manage datasets, which are jail templates in the form of ZFS volumes. We can list and serve them from a dataset-server, and fetch those we like want. At this point, we provide datasets for FreeBSD 10.0 to 11.1, but it is very likely that the list will grow. As an idea <a href="https://datasets.at/" rel="nofollow">here is a community-driven list of datasets</a> that exist for SmartOS today. Moreover, while those datasets will not work, we hope to see the same for BSD jails.<br>
After fetching the dataset, we can define jails by using a JSON file. This file is compatible with the zone description used on SmartOS. It does not provide all the same features but a subset. Resources such as CPU and memory can be defined, networking configured, a dataset selected and necessary settings like hostname set.<br>
With the jail created, vmadm allows managing its lifetime, starting, stopping it, accessing the console and finally destroying it. Updates to jails are supported to however as of today they are only taken into account after restarting the jail. However, this is in large parts not a technical impossibility but rather wasnt high up on the TODO list.<br>
It is worth mentioning that vmadm will not pick up jails created in other tools or manually. Only using vmadm created jails was a conscious decision to prevent it interfering with existing setups or other utilities. While conventional tools can manage jails set up with vmadm just fine we use some special tricks like nested jails to allow for restrictions required for multi-tenancy that are hard or impossible to achieve otherwise.</p>
</blockquote>

<ul>
<li>Whats next</li>
</ul>

<blockquote>
<p>First and foremost we hope to get some feedback and perhaps community engagement. In the meantime, as <a href="https://blog.project-fifo.net/fifo-in-2017/" rel="nofollow">announced earlier this year</a>, we are hard at work integrating FreeBSD hypervisors in FiFo, and as of writing this, the core actions work quite well.<br>
Right now only the barebone functions are supported, some of the output is not as clear as we would like. We hope to eventually add support for behyve to vmadm the same way that it supports KVM on SmartOS. Moreover, the groundwork for this already exists in the nested jail techniques we are using.<br>
Other than that we are exploring ways to allow for PCI pass through in jails, something not possible in SmartOS zones right now that would be beneficial for some users.<br>
In general, we want to improve compatibility with SmartOS as much as possible and features that we add over time should make the specifications invalid for SmartOS.</p>
</blockquote>

<ul>
<li>You can get the tool <a href="https://github.com/project-fifo/r-vmadm" rel="nofollow">from github</a>.
***</li>
</ul>

<h3><a href="http://www.pixelbeat.org/docs/unix-parallel-tools.html" rel="nofollow">Parallel processing with unix tools</a></h3>

<ul>
<li>There are various ways to use parallel processing in UNIX:</li>
</ul>

<blockquote>
<p>piping<br>
An often under appreciated idea in the unix pipe model is that the components of the pipe run in parallel. This is a key advantage leveraged when combining simple commands that do &quot;one thing well&quot;<br>
split -n, xargs -P, parallel<br>
Note programs that are invoked in parallel by these, need to output atomically for each item processed, which the GNU coreutils are careful to do for factor and sha*sum, etc. Generally commands that use stdio for output can be wrapped with the <code>stdbuf -oL</code> command to avoid intermixing lines from parallel invocations<br>
make -j<br>
Most implementations of make(1) now support the -j option to process targets in parallel. make(1) is generally a higher level tool designed to process disparate tasks and avoid reprocessing already generated targets. For example it is used very effictively when testing coreutils where about 700 tests can be processed in 13 seconds on a 40 core machine.<br>
implicit threading<br>
This goes against the unix model somewhat and definitely adds internal complexity to those tools. The advantages can be less data copying overhead, and simpler usage, though its use needs to be carefully considered. A disadvantage is that one loses the ability to easily distribute commands to separate systems. Examples are GNU sort(1) and turbo-linecount</p>
</blockquote>

<ul>
<li>The example provided counts lines in parallel:</li>
</ul>

<blockquote>
<p>The examples below will compare the above methods for implementing multi-processing, for the function of counting lines in a file. First of all let&#39;s generate some test data. We use both long and short lines to compare the overhead of the various methods compared to the core cost of the function being performed:<br>
$ seq 100000000 &gt; lines.txt  # 100M lines<br>
$ yes $(yes longline | head -n9) | head -n10000000 &gt; long-lines.txt  # 10M lines</p>

<p>We&#39;ll also define the add() { paste -d+ -s | bc; } helper function to add a list of numbers.<br>
Note the following runs were done against cached files, and thus not I/O bound. Therefore we limit the number of processes in parallel to $(nproc), though you would generally benefit to raising that if your jobs are waiting on network or disk etc.</p>

<ul>
<li>We&#39;ll use this command to count lines for most methods, so here is the base non multi-processing performance for comparison:
$ time wc -l lines.txt
$ time wc -l long-lines.txt
split -n
Note using -n alone is not enough to parallelize. For example this will run serially with each chunk, because since --filter may write files, the -n pertains to the number of files to split into rather than the number to process in parallel.
$ time split -n$(nproc) --filter=&#39;wc -l&#39; lines.txt | add</li>
</ul>
</blockquote>

<ul>
<li>You can either run multiple invocations of split in parallel on separate portions of the file like:</li>
</ul>

<blockquote>
<p>$ time for i in $(seq $(nproc)); do<br>
       split -n$i/$(nproc) lines.txt | wc -l&amp;<br>
  done | add</p>
</blockquote>

<ul>
<li>Or split can do parallel mode using round robin on each line, but that&#39;s huge overhead in this case. (Note also the -u option significant with -nr):</li>
</ul>

<blockquote>
<p>$ time split -nr/$(nproc) --filter=&#39;wc -l&#39; lines.txt | add</p>
</blockquote>

<ul>
<li>Round robin would only be useful when the processing per item is significant.</li>
<li>Parallel isn&#39;t well suited to processing a large single file, rather focusing on distributing multiple files to commands. It can&#39;t efficiently split to lightweight processing if reading sequentially from pipe:</li>
</ul>

<blockquote>
<p>$ time parallel --will-cite --block=200M --pipe &#39;wc -l&#39; &lt; lines.txt | add</p>
</blockquote>

<ul>
<li>Like parallel, xargs is designed to distribute separate files to commands, and with the -P option can do so in parallel. If you have a large file then it may be beneficial to presplit it, which could also help with I/O bottlenecks if the pieces were placed on separate devices:</li>
</ul>

<blockquote>
<p>split -d -n l/$(nproc) lines.txt l.<br>
Those pieces can then be processed in parallel like:<br>
$ time find -maxdepth 1 -name &#39;l.*&#39; |<br>
xargs -P$(nproc) -n1 wc -l | cut -f1 -d&#39; &#39; | add</p>
</blockquote>

<ul>
<li>If your file sizes are unrelated to the number of processors then you will probably want to adjust -n1 to batch together more files to reduce the number of processes run in total. Note you should always specify -n with -P to avoid xargs accumulating too many input items, thus impacting the parallelism of the processes it runs.</li>
<li>make(1) is generally used to process disparate tasks, though can be leveraged to provide low level parallel processing on a bunch of files. Note also the make -O option which avoids the need for commands to output their data atomically, letting make do the synchronization. We&#39;ll process the presplit files as generated for the xargs example above, and to support that we&#39;ll use the following Makefile:</li>
</ul>

<blockquote>
<p>%: FORCE     # Always run the command<br>
  @wc -l &lt; $@<br>
FORCE: ;<br>
Makefile: ;  # Don&#39;t include Makefile itself</p>
</blockquote>

<ul>
<li>One could generate this and pass to make(1) with the -f option, though we&#39;ll keep it as a separate Makefile here for simplicity. This performs very well and matches the performance of xargs.</li>
</ul>

<blockquote>
<p>$ time find -name &#39;l.*&#39; -exec make -j$(nproc) {} + | add<br>
Note we use the POSIX specified &quot;find ... -exec ... {} +&quot; construct, rather than conflating the example with xargs. This construct like xargs will pass as many files to make as possible, which make(1) will then process in parallel.</p>

<hr>
</blockquote>

<h3><a href="http://nanxiao.me/en/openbsd-gives-a-hint-on-forgetting-unlock-mutex/" rel="nofollow">OpenBSD gives a hint on forgetting unlock mutex</a></h3>

<ul>
<li>OpenBSD gives a hint on forgetting unlock mutex</li>
<li>Check following simple C++ program:
&gt; ```
#include <mutex></li>
</ul>

<p>int main(void)<br>
{<br>
    std::mutex m;<br>
    m.lock();</p>

<pre><code>return 0;
</code></pre>

<p>}</p>

<pre><code>
+ The mutex m forgot unlock itself before exiting main function:

&gt; ```
m.unlock();
</code></pre>

<ul>
<li>Test it on GNU/Linux, and I chose ArchLinux as the testbed:</li>
</ul>

<blockquote>
<pre><code>$ uname -a
Linux fujitsu-i 4.13.7-1-ARCH #1 SMP PREEMPT Sat Oct 14 20:13:26 CEST 2017 x86_64 GNU/Linux
$ clang++ -g -pthread -std=c++11 test_mutex.cpp
$ ./a.out
$
</code></pre>
</blockquote>

<ul>
<li>The process exited normally, and no more words was given. Build and run it on OpenBSD 6.2:</li>
</ul>

<blockquote>
<pre><code>clang++ -g -pthread -std=c++11 test_mutex.cpp
./a.out
pthread_mutex_destroy on mutex with waiters!
</code></pre>
</blockquote>

<ul>
<li>The OpenBSD prompts pthread_mutex_destroy on mutex with waiters!. Interesting!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2017-October/014148.html" rel="nofollow">Updates to the NetBSD operating system since OSHUG #57 &amp; #58</a></li>
<li><a href="https://blog.project-fifo.net/fifo-jails-digital-ocean/" rel="nofollow">Creating a jail with FiFo and Digital Ocean</a></li>
<li><a href="http://stevenrosenberg.net/blog/bsd/openbsd/2017_0924_openbsd" rel="nofollow">I&#39;m thinking about OpenBSD again</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/kernel_aslr_on_amd64" rel="nofollow">Kernel ASLR on amd64</a></li>
<li><a href="https://people.freebsd.org/%7Erodrigo/fosdem18/" rel="nofollow">Call for Participation - BSD Devroom at FOSDEM</a></li>
<li><a href="https://www.meetup.com/BSD-Users-Stockholm/" rel="nofollow">BSD Stockholm Meetup</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>architect - <a href="http://dpaste.com/15D5SM4#wrap" rel="nofollow">vBSDCon</a></li>
<li>Brad - <a href="http://dpaste.com/3MENN0X#wrap" rel="nofollow">Packages and package dependencies</a></li>
<li>Lars - <a href="http://dpaste.com/2SVS18Y" rel="nofollow">dpb</a></li>
<li>Alex <a href="http://dpaste.com/028BCFA#wrap" rel="nofollow">re: PS4 Network Throttling</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>219: We love the ARC</title>
  <link>https://www.bsdnow.tv/219</link>
  <guid isPermaLink="false">00179d62-cc7f-42f5-ae1e-732013948a80</guid>
  <pubDate>Wed, 08 Nov 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/00179d62-cc7f-42f5-ae1e-732013948a80.mp3" length="93957844" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Papers we love: ARC by Bryan Cantrill, SSD caching adventures with ZFS, OpenBSD full disk encryption setup, and a Perl5 Slack Syslog BSD daemon.</itunes:subtitle>
  <itunes:duration>2:10:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Papers we love: ARC by Bryan Cantrill, SSD caching adventures with ZFS, OpenBSD full disk encryption setup, and a Perl5 Slack Syslog BSD daemon.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Papers We Love: ARC: A Self-Tuning, Low Overhead Replacement Cache (https://www.youtube.com/watch?v=F8sZRBdmqc0&amp;amp;feature=youtu.be)
Ever wondered how the ZFS ARC (Adaptive Replacement Cache) works?
How about if Bryan Cantrill presented the original paper on its design?
Today is that day.
Slides (https://www.slideshare.net/bcantrill/papers-we-love-arc-after-dark)
It starts by looking back at a fundamental paper from the 40s where the architecture of general-purpose computers are first laid out
The main is the description of memory hierarchies, where you have a small amount of very fast memory, then the next level is slower but larger, and on and on. As we look at the various L1, L2, and L3 caches on a CPU, then RAM, then flash, then spinning disks, this still holds true today.
The paper then does a survey of the existing caching policies and tries to explain the issues with each. This includes ‘MIN’, which is the theoretically optimal policy, which requires future knowledge, but is useful for setting the upper bound, what is the best we could possibly do.
The paper ends up showing that the ARC can end up being better than manually trying to pick the best number for the workload, because it adapts as the workload changes
At about 1:25 into the video, Bryan start talking about the practical implementation of the ARC in ZFS, and some challenges they have run into recently at Joyent.
A great discussion about some of the problems when ZFS needs to shrink the ARC. Not all of it applies 1:1 to FreeBSD because the kernel and the kmem implementation are different in a number of ways
There were some interesting questions asked at the end as well
***
How do I use man pages to learn how to use commands? (https://unix.stackexchange.com/a/193837)
nwildner on StackExchange has a very thorough answer to the question how to interpret man pages to understand complicated commands (xargs in this case, but not specifically).
Have in mind what you want to do.
When doing your research about xargs you did it for a purpose, right? You had a specific need that was reading standard output and executing commands based on that output.
But, when I don't know which command I want?
Use man -k or apropos (they are equivalent). If I don't know how to find a file: man -k file | grep search. Read the descriptions and find one that will better fit your needs.
Apropos works with regular expressions by default, (man apropos, read the description and find out what -r does), and on this example I'm looking for every manpage where the description starts with "report".
Always read the DESCRIPTION before starting
Take a time and read the description. By just reading the description of the xargs command we will learn that:
xargs reads from STDIN and executes the command needed. This also means that you will need to have some knowledge of how standard input works, and how to manipulate it through pipes to chain commands
The default behavior is to act like /bin/echo. This gives you a little tip that if you need to chain more than one xargs, you don't need to use echo to print.
We have also learned that unix filenames can contain blank and newlines, that this could be a problem and the argument -0 is a way to prevent things explode by using null character separators. The description warns you that the command being used as input needs to support this feature too, and that GNU find support it. Great. We use a lot of find with xargs.
xargs will stop if exit status 255 is reached.
Some descriptions are very short and that is generally because the software works on a very simple way. Don't even think of skipping this part of the manpage ;)
Other things to pay attention...
You know that you can search for files using find. There is a ton of options and if you only look at the SYNOPSIS, you will get overwhelmed by those. It's just the tip of the iceberg. Excluding NAME, SYNOPSIS, and DESCRIPTION, you will have the following sections:
When this method will not work so well...
+ Tips that apply to all commands
Some options, mnemonics and "syntax style" travel through all commands making you buy some time by not having to open the manpage at all. Those are learned by practice and the most common are:
Generally, -v means verbose. -vvv is a variation "very very verbose" on some software.
Following the POSIX standard, generally one dash arguments can be stacked. Example: tar -xzvf,  cp -Rv.
Generally -R and/or -r means recursive.
Almost all commands have a brief help with the --help option.
--version shows the version of a software.
-p, on copy or move utilities means "preserve permissions".
-y means YES, or "proceed without confirmation" in most cases.
Default values of commands.
At the pager chunk of this answer, we saw that less -is is the pager of man. The default behavior of commands are not always shown at a separated section on manpages, or at the section that is most top placed.
You will have to read the options to find out defaults, or if you are lucky, typing /pager will lead you to that info. This also requires you to know the concept of the pager(software that scrolls the manpage), and this is a thing you will only acquire after reading lots of manpages.
And what about the SYNOPSIS syntax?
After getting all the information needed to execute the command, you can combine options, option-arguments and operands inline to make your job done. Overview of concepts:
Options are the switches that dictates a command behavior. "Do this" "don't do this" or "act this way". Often called switches.
Check out the full answer and see if it helps you better grasp the meaning of a man page and thus the command.
***
My adventure into SSD caching with ZFS (Home NAS) (https://robertputt.co.uk/my-adventure-into-ssd-caching-with-zfs-home-nas.html)
Robert Putt as written about his adventure using SSDs for caching with ZFS on his home NAS.
Recently I decided to throw away my old defunct 2009 MacBook Pro which was rotting in my cupboard and I decided to retrieve the only useful part before doing so, the 80GB Intel SSD I had installed a few years earlier. Initially I thought about simply adding it to my desktop as a bit of extra space but in 2017 80GB really wasn’t worth it and then I had a brainwave… Lets see if we can squeeze some additional performance out of my HP Microserver Gen8 NAS running ZFS by installing it as a cache disk.
I installed the SSD to the cdrom tray of the Microserver using a floppy disk power to SATA power converter and a SATA cable, unfortunately it seems the CD ROM SATA port on the motherboard is only a 3gbps port although this didn’t matter so much as it was an older 3gbps SSD anyway. Next I booted up the machine and to my suprise the disk was not found in my FreeBSD install, then I realised that the SATA port for the CD drive is actually provided by the RAID controller, so I rebooted into intelligent provisioning and added an additional RAID0 array with just the 1 disk to act as my cache, in fact all of the disks in this machine are individual RAID0 arrays so it looks like just a bunch of disks (JBOD) as ZFS offers additional functionality over normal RAID (mainly scrubbing, deduplication and compression).
Configuration
Lets have a look at the zpool before adding the cache drive to make sure there are no errors or uglyness:
Now lets prep the drive for use in the zpool using gpart. I want to split the SSD into two seperate partitions, one for L2ARC (read caching) and one for ZIL (write caching). I have decided to split the disk into 20GB for ZIL and 50GB for L2ARC. Be warned using 1 SSD like this is considered unsafe because it is a single point of failure in terms of delayed writes (a redundant configuration with 2 SSDs would be more appropriate) and the heavy write cycles on the SSD from the ZIL is likely to kill it over time.
Now it’s time to see if adding the cache has made much of a difference. I suspect not as my Home NAS sucks, it is a HP Microserver Gen8 with the crappy Celeron CPU and only 4GB RAM, anyway, lets test it and find out. First off lets throw fio at the mount point for this zpool and see what happens both with the ZIL and L2ARC enabled and disabled.
Observations
Ok, so the initial result is a little dissapointing, but hardly unexpected, my NAS sucks and there are lots of bottle necks, CPU, memory and the fact only 2 of the SATA ports are 6gbps. There is no real difference performance wise in comparison between the results, the IOPS, bandwidth and latency appear very similar. However lets bare in mind fio is a pretty hardcore disk benchmark utility, how about some real world use cases?
Next I decided to test a few typical file transactions that this NAS is used for, Samba shares to my workstation. For the first test I wanted to test reading a 3GB file over the network with both the cache enabled and disabled, I would run this multiple times to ensure the data is hot in the L2ARC and to ensure the test is somewhat repeatable, the network itself is an uncongested 1gbit link and I am copying onto the secondary SSD in my workstation. The dataset for these tests has compression and deduplication disabled.
Samba Read Test
Not bad once the data becomes hot in the L2ARC cache reads appear to gain a decent advantage compared to reading from the disk directly. How does it perform when writing the same file back accross the network using the ZIL vs no ZIL.
Samba Write Test
Another good result in the real world test, this certainately helps the write transfer speed however I do wonder what would happen if you filled the ZIL transferring a very large file, however this is unlikely with my use case as I typically only deal with a couple of files of several hundred megabytes at any given time so a 20GB ZIL should suit me reasonably well.
Is ZIL and L2ARC worth it?
I would imagine with a big beefy ZFS server running in a company somewhere with a large disk pool and lots of users with multiple enterprise level SSD ZIL and L2ARC would be well worth the investment, however at home I am not so sure. Yes I did see an increase in read speeds with cached data and a general increase in write speeds however it is use case dependant. In my use case I rarely access the same file frequently, my NAS primarily serves as a backup and for archived data, and although the write speeds are cool I am not sure its a deal breaker. If I built a new home NAS today I’d probably concentrate the budget on a better CPU, more RAM (for ARC cache) and more disks. However if I had a use case where I frequently accessed the same files and needed to do so in a faster fashion then yes, I’d probably invest in an SSD for caching. I think if you have a spare SSD lying around and you want something fun todo with it, sure chuck it in your ZFS based NAS as a cache mechanism. If you were planning on buying an SSD for caching then I’d really consider your needs and decide if the money can be spent on alternative stuff which would improve your experience with your NAS. I know my NAS would benefit more from an extra stick of RAM and a more powerful CPU, but as a quick evening project with some parts I had hanging around adding some SSD cache was worth a go.
More Viewer Interview Questions for Allan
News Roundup
Setup OpenBSD 6.2 with Full Disk Encryption (https://blog.cagedmonster.net/setup-openbsd-with-full-disk-encryption/)
Here is a quick way to setup (in 7 steps) OpenBSD 6.2 with the encryption of the filesystem.
First step: Boot and start the installation:
(I)nstall: I
Keyboard Layout: ENTER (I'm french so in my case I took the FR layout)
Leave the installer with: !
Second step: Prepare your disk for encryption.
Using a SSD, my disk is named : sd0, the name may vary, for example : wd0.
Initiating the disk:
Configure your volume:
Now we'll use bioctl to encrypt the partition we created, in this case : sd0a (disk sd0 + partition « a »).
Enter your passphrase.
Third step:
Let's resume the OpenBSD's installer. We follow the install procedure
Fourth step: Partitioning of the encrypted volume.
We select our new volume, in this case: sd1
The whole disk will be used: W(hole)
Let's create our partitions:
NB: You are more than welcome to create multiple partitions for your system.
Fifth step: System installation
It's time to choose how we'll install our system (network install by http in my case)
Sixth step: Finalize the installation.
Last step: Reboot and start your system.
Put your passphrase. Welcome to OpenBSD 6.2 with a full encrypted file system.
Optional: Disable the swap encryption.
The swap is actually part of the encrypted filesystem, we don't need OpenBSD to encrypt it. Sysctl is giving us this possibility.
Step-by-Step FreeBSD installation with ZFS and Full Disk Encryption (https://blog.cagedmonster.net/step-by-step-freebsd-installation-with-full-disk-encryption/)
1. What do I need?
For this tutorial, the installation has been made on a Intel Core i7 - AMD64 architecture.
On a USB key, you would probably use this link : ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-mini-memstick.img
If you can't do a network installation, you'd better use this image : ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-memstick.img
You can write the image file on your USB device (replace XXXX with the name of your device) using dd : # dd if=FreeBSD-11.1-RELEASE-amd64-mini-memstick.img of=/dev/XXXX bs=1m
2. Boot and install: Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F1.png)
3. Configure your keyboard layout: Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F2.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F3.png)
4. Hostname and system components configuration : 
Set the name of your machine: [Screenshot](https://blog.cagedmonster.net/content/images/2017/09/F4.png_
What components do you want to install? Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F5.png)
5. Network configuration:
Select the network interface you want to configure. Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F6.png)
First, we configure our IPv4 network. I used a static adress so you can see how it works, but you can use DHCP for an automated configuration, it depends of what you want to do with your system (desktop/server) Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F7.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F7-1.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F8.png)
IPv6 network configuration. Same as for IPv4, you can use SLAAC for an automated configuration. Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F9.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F10-1.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F10-2.png)
Here, you can configure your DNS servers, I used the Google DNS servers so you can use them too if needed. Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F11.png)
6. Select the server you want to use for the installation:
I always use the IPv6 mirror to ensure that my IPv6 network configuration is good.Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F12.png) 
7. Disk configuration:
As we want to do an easy full disk encryption, we'll use ZFS. Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F13.png)
Make sure to select the disk encryption :Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F14.png)
Launch the disk configuration :Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F15.png)
Here everything is normal, you have to select the disk you'll use :Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F16.png)
I have only one SSD disk named da0 :Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F17.png)
Last chance before erasing your disk :Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F18.png)
Time to choose the password you'll use to start your system : Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F19.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F20.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F21.png) 
8. Last steps to finish the installation:
The installer will download what you need and what you selected previously (ports, src, etc.) to create your system: Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F22.png)
8.1. Root password:
Enter your root password: Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F22-1.png)
8.2. Time and date:
Set your timezone, in my case: Europe/France Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F22-2.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F23.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F23-1.png)
Make sure the date and time are good, or you can change them :Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F24.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F25.png)
8.3. Services:
Select the services you'll use at system startup depending again of what you want to do. In many cases powerd and ntpd will be useful, sshd if you're planning on using FreeBSD as a server. Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F26.png)
8.4. Security:
Security options you want to enable. You'll still be able to change them after the installation with sysctl. Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F26-1.png)
8.5. Additionnal user:
Create an unprivileged system user: Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F26-2.png)
Make sure your user is in the wheel group so he can use the su command. Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F26-3.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F26-4.png)
8.6. The end:
End of your configuration, you can still do some modifications if you want : Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F26-5.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F26-6.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F26-7.png)
9. First boot:
Enter the passphrase you have chosen previously : Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F27.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F28.png) &amp;amp; Screenshot (https://blog.cagedmonster.net/content/images/2017/09/F29.png)
Welcome to Freebsd 11.1 with full disk encryption!
***
The anatomy of ldd program on OpenBSD (http://nanxiao.me/en/the-anatomy-of-ldd-program-on-openbsd/)
In the past week, I read the ldd (https://github.com/openbsd/src/blob/master/libexec/ld.so/ldd/ldd.c) source code on OpenBSD to get a better understanding of how it works. And this post should also be a reference for other*NIX OSs.
The ELF (https://en.wikipedia.org/wiki/Executable_and_Linkable_Format) file is divided into 4 categories: relocatable, executable, shared, and core. Only the executable and shared object files may have dynamic object dependencies, so the ldd only check these 2 kinds of ELF file:
(1) Executable. ldd leverages the LD_TRACE_LOADED_OBJECTS environment variable in fact, and the code is as following:

if (setenv("LD_TRACE_LOADED_OBJECTS", "true", 1) &amp;lt; 0)
err(1, "setenv(LD_TRACE_LOADED_OBJECTS)");

When LDTRACELOADED_OBJECTS is set to 1 or true, running executable file will show shared objects needed instead of running it, so you even not needldd to check executable file. See the following outputs:

$ /usr/bin/ldd
usage: ldd program ...
$ LD_TRACE_LOADED_OBJECTS=1 /usr/bin/ldd
        Start            End              Type Open Ref GrpRef Name
        00000b6ac6e00000 00000b6ac7003000 exe  1    0   0      /usr/bin/ldd
        00000b6dbc96c000 00000b6dbcc38000 rlib 0    1   0      /usr/lib/libc.so.89.3
        00000b6d6ad00000 00000b6d6ad00000 rtld 0    1   0      /usr/libexec/ld.so  

(2) Shared object. The code to print dependencies of shared object is as following:

if (ehdr.e_type == ET_DYN &amp;amp;&amp;amp; !interp) {
    if (realpath(name, buf) == NULL) {
        printf("realpath(%s): %s", name,
            strerror(errno));
        fflush(stdout);
        _exit(1);
    }
    dlhandle = dlopen(buf, RTLD_TRACE);
    if (dlhandle == NULL) {
        printf("%s\n", dlerror());
        fflush(stdout);
        _exit(1);
    }
    _exit(0);
}

Why the condition of checking a ELF file is shared object or not is like this:

if (ehdr.e_type == ET_DYN &amp;amp;&amp;amp; !interp) {
    ......
}

That’s because the file type of position-independent executable (PIE) is the same as shared object, but normally PIE contains a interpreter program header since it needs dynamic linker to load it while shared object lacks (refer this article). So the above condition will filter PIE file.
The dlopen(buf, RTLD_TRACE) is used to print dynamic object information. And the actual code is like this:

if (_dl_traceld) {
    _dl_show_objects();
    _dl_unload_shlib(object);
    _dl_exit(0);
}

In fact, you can also implement a simple application which outputs dynamic object information for shared object yourself:

# include 
int main(int argc, char **argv)
{
    dlopen(argv[1], RTLD_TRACE);
    return 0;
}

Compile and use it to analyze /usr/lib/libssl.so.43.2:

$ cc lddshared.c
$ ./a.out /usr/lib/libssl.so.43.2
    Start            End              Type Open Ref GrpRef Name
    000010e2df1c5000 000010e2df41a000 dlib 1    0   0      /usr/lib/libssl.so.43.2
    000010e311e3f000 000010e312209000 rlib 0    1   0      /usr/lib/libcrypto.so.41.1

The same as using ldd directly:

$ ldd /usr/lib/libssl.so.43.2
/usr/lib/libssl.so.43.2:
    Start            End              Type Open Ref GrpRef Name
    00001d9ffef08000 00001d9fff15d000 dlib 1    0   0      /usr/lib/libssl.so.43.2
    00001d9ff1431000 00001d9ff17fb000 rlib 0    1   0      /usr/lib/libcrypto.so.41.1

Through the studying of ldd source code, I also get many by-products: such as knowledge of ELF file, linking and loading, etc. So diving into code is a really good method to learn *NIX deeper!
Perl5 Slack Syslog BSD daemon (https://clinetworking.wordpress.com/2017/10/13/perl5-slack-syslog-bsd-daemon/)
So I have been working on my little Perl daemon for a week now.
It is a simple syslog daemon that listens on port 514 for incoming messages. It listens on a port so it can process log messages from my consumer Linux router as well as the messages from my server.  Messages that are above alert are sent, as are messages that match the regex of SSH or DHCP (I want to keep track of new connections to my wifi). The rest of the messages are not sent to slack but appended to a log file. This is very handy as I can get access to info like failed ssh logins, disk failures, and new devices connecting to the network all on my Android phone when I am not home.
Screenshot (https://clinetworking.files.wordpress.com/2017/10/screenshot_2017-10-13-23-00-26.png)
The situation arose today that the internet went down and I thought to myself what would happen to all my important syslog messages when they couldn’t be sent?  Before the script only ran an eval block on the botsend() function. The error was returned, handled, but nothing was done and the unsent message was discarded. So I added a function that appended unsent messengers to an array that are later sent when the server is not busy sending messages to slack.
Slack has a limit of one message per second. The new addition works well and means that if the internet fails my server will store these messages in memory and resend them at a rate of one message per second when the internet connectivity returns. It currently sends the newest ones first but I am not sure if this is a bug or a feature at this point! It currently works with my Linux based WiFi router and my FreeBSD server. It is easy to scale as all you need to do is send messages to syslog to get them sent to slack. You could sent CPU temp, logged in users etc.
There is a github page: https://github.com/wilyarti/slackbot
Lscpu for OpenBSD/FreeBSD (http://nanxiao.me/en/lscpu-for-openbsdfreebsd/)
Github Link (https://github.com/NanXiao/lscpu)
There is a neat command, lscpu, which is very handy to display CPU information on GNU/Linux OS:

$ lscpu
Architecture:        x86_64
CPU op-mode(s):      32-bit, 64-bit
Byte Order:          Little Endian
CPU(s):              32
On-line CPU(s) list: 0-31
Thread(s) per core:  2
Core(s) per socket:  8
Socket(s):           2

But unfortunately, the BSD OSs lack this command, maybe one reason is lscpu relies heavily on /proc file system which BSD don’t provide, :-). TakeOpenBSD as an example, if I want to know CPU information, dmesg should be one choice:

$ dmesg | grep -i cpu
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz, 2527.35 MHz
cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,
PBE,SSE3,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,XSAVE,NXE,LONG,LAHF,PERF,SENSOR
cpu0: 3MB 64b/line 8-way L2 cache
cpu0: apic clock running at 266MHz
cpu0: mwait min=64, max=64, C-substates=0.2.2.2.2.1.3, IBE

But the output makes me feeling messy, not very clear. As for dmidecode, it used to be another option, but now can’t work out-of-box because it will access /dev/mem which for security reason, OpenBSD doesn’t allow by default (You can refer this discussion):

$ ./dmidecode
$ dmidecode 3.1
Scanning /dev/mem for entry point.
/dev/mem: Operation not permitted

Based on above situation, I want a specified command for showing CPU information for my BSD box. So in the past 2 weeks, I developed a lscpu program for OpenBSD/FreeBSD, or more accurately, OpenBSD/FreeBSD on x86 architecture since I only have some Intel processors at hand. The application getsCPU metrics from 2 sources:
(1) sysctl functions.  The BSD OSs provide sysctl interface which I can use to get general CPU particulars, such as how many CPUs the system contains, the byte-order of CPU, etc.
(2) CPUID instruction. For x86 architecture, CPUID instruction can obtain very detail information of CPU. This coding work is a little tedious and error-prone, not only because I need to reference both Intel and AMD specifications since these 2 vendors have minor distinctions, but also I need to parse the bits of register values.
The code is here (https://github.com/NanXiao/lscpu), and if you run OpenBSD/FreeBSD on x86 processors, please try it. It will be better you can give some feedback or report the issues, and I appreciate it very much. In the future if I have other CPUs resource, such as ARM or SPARC64, maybe I will enrich this small program.
***
Beastie Bits
OpenBSD Porting Workshop - Brian Callahan will be running an OpenBSD porting workshop in NYC for NYC*BUG on December 6, 2017. (http://daemonforums.org/showthread.php?t=10429)
Learn to tame OpenBSD quickly (http://www.openbsdjumpstart.org/#/)
Detect the operating system using UDP stack corner cases (https://gist.github.com/sortie/94b302dd383df19237d1a04969f1a42b)
***
Feedback/Questions
Awesome Mike - ZFS Questions (http://dpaste.com/1H22BND#wrap)
Michael - Expanding a file server with only one hard drive with ZFS (http://dpaste.com/1JRJ6T9) - information based on Allan's IRC response (http://dpaste.com/36M7M3E)
Brian - Optimizing ZFS for a single disk (http://dpaste.com/3X0GXJR#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Papers we love: ARC by Bryan Cantrill, SSD caching adventures with ZFS, OpenBSD full disk encryption setup, and a Perl5 Slack Syslog BSD daemon.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.youtube.com/watch?v=F8sZRBdmqc0&feature=youtu.be" rel="nofollow">Papers We Love: ARC: A Self-Tuning, Low Overhead Replacement Cache</a></h3>

<ul>
<li>Ever wondered how the ZFS ARC (Adaptive Replacement Cache) works?</li>
<li>How about if Bryan Cantrill presented the original paper on its design?</li>
<li>Today is that day.</li>
<li><a href="https://www.slideshare.net/bcantrill/papers-we-love-arc-after-dark" rel="nofollow">Slides</a></li>
<li>It starts by looking back at a fundamental paper from the 40s where the architecture of general-purpose computers are first laid out</li>
<li>The main is the description of memory hierarchies, where you have a small amount of very fast memory, then the next level is slower but larger, and on and on. As we look at the various L1, L2, and L3 caches on a CPU, then RAM, then flash, then spinning disks, this still holds true today.</li>
<li>The paper then does a survey of the existing caching policies and tries to explain the issues with each. This includes MIN, which is the theoretically optimal policy, which requires future knowledge, but is useful for setting the upper bound, what is the best we could possibly do.</li>
<li>The paper ends up showing that the ARC can end up being better than manually trying to pick the best number for the workload, because it adapts as the workload changes</li>
<li>At about 1:25 into the video, Bryan start talking about the practical implementation of the ARC in ZFS, and some challenges they have run into recently at Joyent.</li>
<li>A great discussion about some of the problems when ZFS needs to shrink the ARC. Not all of it applies 1:1 to FreeBSD because the kernel and the kmem implementation are different in a number of ways</li>
<li>There were some interesting questions asked at the end as well
***</li>
</ul>

<h3><a href="https://unix.stackexchange.com/a/193837" rel="nofollow">How do I use man pages to learn how to use commands?</a></h3>

<ul>
<li>nwildner on StackExchange has a very thorough answer to the question how to interpret man pages to understand complicated commands (xargs in this case, but not specifically).</li>
<li>Have in mind what you want to do.</li>
</ul>

<blockquote>
<p>When doing your research about xargs you did it for a purpose, right? You had a specific need that was reading standard output and executing commands based on that output.</p>
</blockquote>

<ul>
<li>But, when I don&#39;t know which command I want?</li>
</ul>

<blockquote>
<p>Use man -k or apropos (they are equivalent). If I don&#39;t know how to find a file: man -k file | grep search. Read the descriptions and find one that will better fit your needs.</p>
</blockquote>

<ul>
<li>Apropos works with regular expressions by default, (man apropos, read the description and find out what -r does), and on this example I&#39;m looking for every manpage where the description starts with &quot;report&quot;.</li>
<li><p>Always read the DESCRIPTION before starting</p></li>
<li><p>Take a time and read the description. By just reading the description of the xargs command we will learn that:</p></li>
</ul>

<blockquote>
<p>xargs reads from STDIN and executes the command needed. This also means that you will need to have some knowledge of how standard input works, and how to manipulate it through pipes to chain commands<br>
The default behavior is to act like /bin/echo. This gives you a little tip that if you need to chain more than one xargs, you don&#39;t need to use echo to print.<br>
We have also learned that unix filenames can contain blank and newlines, that this could be a problem and the argument -0 is a way to prevent things explode by using null character separators. The description warns you that the command being used as input needs to support this feature too, and that GNU find support it. Great. We use a lot of find with xargs.<br>
xargs will stop if exit status 255 is reached.</p>
</blockquote>

<ul>
<li>Some descriptions are very short and that is generally because the software works on a very simple way. Don&#39;t even think of skipping this part of the manpage ;)</li>
<li><p>Other things to pay attention...</p></li>
<li><p>You know that you can search for files using find. There is a ton of options and if you only look at the SYNOPSIS, you will get overwhelmed by those. It&#39;s just the tip of the iceberg. Excluding NAME, SYNOPSIS, and DESCRIPTION, you will have the following sections:</p></li>
</ul>

<blockquote>
<p>When this method will not work so well...</p>

<ul>
<li>Tips that apply to all commands</li>
</ul>
</blockquote>

<ul>
<li>Some options, mnemonics and &quot;syntax style&quot; travel through all commands making you buy some time by not having to open the manpage at all. Those are learned by practice and the most common are:</li>
</ul>

<blockquote>
<p>Generally, -v means verbose. -vvv is a variation &quot;very very verbose&quot; on some software.<br>
Following the POSIX standard, generally one dash arguments can be stacked. Example: tar -xzvf,  cp -Rv.<br>
Generally -R and/or -r means recursive.<br>
Almost all commands have a brief help with the --help option.<br>
--version shows the version of a software.<br>
-p, on copy or move utilities means &quot;preserve permissions&quot;.<br>
-y means YES, or &quot;proceed without confirmation&quot; in most cases.</p>
</blockquote>

<ul>
<li>Default values of commands.</li>
</ul>

<blockquote>
<p>At the pager chunk of this answer, we saw that less -is is the pager of man. The default behavior of commands are not always shown at a separated section on manpages, or at the section that is most top placed.<br>
You will have to read the options to find out defaults, or if you are lucky, typing /pager will lead you to that info. This also requires you to know the concept of the pager(software that scrolls the manpage), and this is a thing you will only acquire after reading lots of manpages.</p>
</blockquote>

<ul>
<li>And what about the SYNOPSIS syntax?</li>
</ul>

<blockquote>
<p>After getting all the information needed to execute the command, you can combine options, option-arguments and operands inline to make your job done. Overview of concepts:<br>
Options are the switches that dictates a command behavior. &quot;Do this&quot; &quot;don&#39;t do this&quot; or &quot;act this way&quot;. Often called switches.</p>
</blockquote>

<ul>
<li>Check out the full answer and see if it helps you better grasp the meaning of a man page and thus the command.
***</li>
</ul>

<h3><a href="https://robertputt.co.uk/my-adventure-into-ssd-caching-with-zfs-home-nas.html" rel="nofollow">My adventure into SSD caching with ZFS (Home NAS)</a></h3>

<ul>
<li>Robert Putt as written about his adventure using SSDs for caching with ZFS on his home NAS.</li>
</ul>

<blockquote>
<p>Recently I decided to throw away my old defunct 2009 MacBook Pro which was rotting in my cupboard and I decided to retrieve the only useful part before doing so, the 80GB Intel SSD I had installed a few years earlier. Initially I thought about simply adding it to my desktop as a bit of extra space but in 2017 80GB really wasnt worth it and then I had a brainwave Lets see if we can squeeze some additional performance out of my HP Microserver Gen8 NAS running ZFS by installing it as a cache disk.<br>
I installed the SSD to the cdrom tray of the Microserver using a floppy disk power to SATA power converter and a SATA cable, unfortunately it seems the CD ROM SATA port on the motherboard is only a 3gbps port although this didnt matter so much as it was an older 3gbps SSD anyway. Next I booted up the machine and to my suprise the disk was not found in my FreeBSD install, then I realised that the SATA port for the CD drive is actually provided by the RAID controller, so I rebooted into intelligent provisioning and added an additional RAID0 array with just the 1 disk to act as my cache, in fact all of the disks in this machine are individual RAID0 arrays so it looks like just a bunch of disks (JBOD) as ZFS offers additional functionality over normal RAID (mainly scrubbing, deduplication and compression).</p>
</blockquote>

<ul>
<li><p>Configuration</p></li>
<li><p>Lets have a look at the zpool before adding the cache drive to make sure there are no errors or uglyness:</p></li>
</ul>

<blockquote>
<p>Now lets prep the drive for use in the zpool using gpart. I want to split the SSD into two seperate partitions, one for L2ARC (read caching) and one for ZIL (write caching). I have decided to split the disk into 20GB for ZIL and 50GB for L2ARC. Be warned using 1 SSD like this is considered unsafe because it is a single point of failure in terms of delayed writes (a redundant configuration with 2 SSDs would be more appropriate) and the heavy write cycles on the SSD from the ZIL is likely to kill it over time.<br>
Now its time to see if adding the cache has made much of a difference. I suspect not as my Home NAS sucks, it is a HP Microserver Gen8 with the crappy Celeron CPU and only 4GB RAM, anyway, lets test it and find out. First off lets throw fio at the mount point for this zpool and see what happens both with the ZIL and L2ARC enabled and disabled.</p>
</blockquote>

<ul>
<li>Observations</li>
</ul>

<blockquote>
<p>Ok, so the initial result is a little dissapointing, but hardly unexpected, my NAS sucks and there are lots of bottle necks, CPU, memory and the fact only 2 of the SATA ports are 6gbps. There is no real difference performance wise in comparison between the results, the IOPS, bandwidth and latency appear very similar. However lets bare in mind fio is a pretty hardcore disk benchmark utility, how about some real world use cases?<br>
Next I decided to test a few typical file transactions that this NAS is used for, Samba shares to my workstation. For the first test I wanted to test reading a 3GB file over the network with both the cache enabled and disabled, I would run this multiple times to ensure the data is hot in the L2ARC and to ensure the test is somewhat repeatable, the network itself is an uncongested 1gbit link and I am copying onto the secondary SSD in my workstation. The dataset for these tests has compression and deduplication disabled.</p>
</blockquote>

<ul>
<li>Samba Read Test</li>
</ul>

<blockquote>
<p>Not bad once the data becomes hot in the L2ARC cache reads appear to gain a decent advantage compared to reading from the disk directly. How does it perform when writing the same file back accross the network using the ZIL vs no ZIL.</p>
</blockquote>

<ul>
<li>Samba Write Test</li>
</ul>

<blockquote>
<p>Another good result in the real world test, this certainately helps the write transfer speed however I do wonder what would happen if you filled the ZIL transferring a very large file, however this is unlikely with my use case as I typically only deal with a couple of files of several hundred megabytes at any given time so a 20GB ZIL should suit me reasonably well.</p>
</blockquote>

<ul>
<li>Is ZIL and L2ARC worth it?</li>
</ul>

<blockquote>
<p>I would imagine with a big beefy ZFS server running in a company somewhere with a large disk pool and lots of users with multiple enterprise level SSD ZIL and L2ARC would be well worth the investment, however at home I am not so sure. Yes I did see an increase in read speeds with cached data and a general increase in write speeds however it is use case dependant. In my use case I rarely access the same file frequently, my NAS primarily serves as a backup and for archived data, and although the write speeds are cool I am not sure its a deal breaker. If I built a new home NAS today Id probably concentrate the budget on a better CPU, more RAM (for ARC cache) and more disks. However if I had a use case where I frequently accessed the same files and needed to do so in a faster fashion then yes, Id probably invest in an SSD for caching. I think if you have a spare SSD lying around and you want something fun todo with it, sure chuck it in your ZFS based NAS as a cache mechanism. If you were planning on buying an SSD for caching then Id really consider your needs and decide if the money can be spent on alternative stuff which would improve your experience with your NAS. I know my NAS would benefit more from an extra stick of RAM and a more powerful CPU, but as a quick evening project with some parts I had hanging around adding some SSD cache was worth a go.</p>

<hr>
</blockquote>

<h2>More Viewer Interview Questions for Allan</h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.cagedmonster.net/setup-openbsd-with-full-disk-encryption/" rel="nofollow">Setup OpenBSD 6.2 with Full Disk Encryption</a></h3>

<ul>
<li><p>Here is a quick way to setup (in 7 steps) OpenBSD 6.2 with the encryption of the filesystem.</p></li>
<li><p>First step: Boot and start the installation:</p></li>
</ul>

<blockquote>
<p>(I)nstall: I<br>
Keyboard Layout: ENTER (I&#39;m french so in my case I took the FR layout)<br>
Leave the installer with: !</p>
</blockquote>

<ul>
<li>Second step: Prepare your disk for encryption.</li>
</ul>

<blockquote>
<p>Using a SSD, my disk is named : sd0, the name may vary, for example : wd0.<br>
Initiating the disk:<br>
Configure your volume:<br>
Now we&#39;ll use bioctl to encrypt the partition we created, in this case : sd0a (disk sd0 + partition « a »).<br>
Enter your passphrase.</p>
</blockquote>

<ul>
<li>Third step:</li>
</ul>

<blockquote>
<p>Let&#39;s resume the OpenBSD&#39;s installer. We follow the install procedure</p>
</blockquote>

<ul>
<li>Fourth step: Partitioning of the encrypted volume.</li>
</ul>

<blockquote>
<p>We select our new volume, in this case: sd1<br>
The whole disk will be used: W(hole)<br>
Let&#39;s create our partitions:<br>
NB: You are more than welcome to create multiple partitions for your system.</p>
</blockquote>

<ul>
<li>Fifth step: System installation</li>
</ul>

<blockquote>
<p>It&#39;s time to choose how we&#39;ll install our system (network install by http in my case)</p>
</blockquote>

<ul>
<li><p>Sixth step: Finalize the installation.</p></li>
<li><p>Last step: Reboot and start your system.</p></li>
</ul>

<blockquote>
<p>Put your passphrase. Welcome to OpenBSD 6.2 with a full encrypted file system.</p>
</blockquote>

<ul>
<li>Optional: Disable the swap encryption.</li>
</ul>

<blockquote>
<p>The swap is actually part of the encrypted filesystem, we don&#39;t need OpenBSD to encrypt it. Sysctl is giving us this possibility.</p>
</blockquote>

<hr>

<h3><a href="https://blog.cagedmonster.net/step-by-step-freebsd-installation-with-full-disk-encryption/" rel="nofollow">Step-by-Step FreeBSD installation with ZFS and Full Disk Encryption</a></h3>

<ul>
<li>1. What do I need?

<ul>
<li>For this tutorial, the installation has been made on a Intel Core i7 - AMD64 architecture.</li>
<li>On a USB key, you would probably use this link : <a href="ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-mini-memstick.img" rel="nofollow">ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-mini-memstick.img</a></li>
<li>If you can&#39;t do a network installation, you&#39;d better use this image : <a href="ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-memstick.img" rel="nofollow">ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-memstick.img</a></li>
<li>You can write the image file on your USB device (replace XXXX with the name of your device) using dd : <code># dd if=FreeBSD-11.1-RELEASE-amd64-mini-memstick.img of=/dev/XXXX bs=1m</code></li>
</ul></li>
<li>2. Boot and install: <a href="https://blog.cagedmonster.net/content/images/2017/09/F1.png" rel="nofollow">Screenshot</a></li>
<li>3. Configure your keyboard layout: <a href="https://blog.cagedmonster.net/content/images/2017/09/F2.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F3.png" rel="nofollow">Screenshot</a></li>
<li>4. Hostname and system components configuration : 

<ul>
<li>Set the name of your machine: [Screenshot](<a href="https://blog.cagedmonster.net/content/images/2017/09/F4.png_" rel="nofollow">https://blog.cagedmonster.net/content/images/2017/09/F4.png_</a></li>
<li>What components do you want to install? <a href="https://blog.cagedmonster.net/content/images/2017/09/F5.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>5. Network configuration:

<ul>
<li>Select the network interface you want to configure. <a href="https://blog.cagedmonster.net/content/images/2017/09/F6.png" rel="nofollow">Screenshot</a></li>
<li>First, we configure our IPv4 network. I used a static adress so you can see how it works, but you can use DHCP for an automated configuration, it depends of what you want to do with your system (desktop/server) <a href="https://blog.cagedmonster.net/content/images/2017/09/F7.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F7-1.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F8.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>IPv6 network configuration. Same as for IPv4, you can use SLAAC for an automated configuration. <a href="https://blog.cagedmonster.net/content/images/2017/09/F9.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F10-1.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F10-2.png" rel="nofollow">Screenshot</a>

<ul>
<li>Here, you can configure your DNS servers, I used the Google DNS servers so you can use them too if needed. <a href="https://blog.cagedmonster.net/content/images/2017/09/F11.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>6. Select the server you want to use for the installation:

<ul>
<li>I always use the IPv6 mirror to ensure that my IPv6 network configuration is good.<a href="https://blog.cagedmonster.net/content/images/2017/09/F12.png" rel="nofollow">Screenshot</a> </li>
</ul></li>
<li>7. Disk configuration:

<ul>
<li>As we want to do an easy full disk encryption, we&#39;ll use ZFS. <a href="https://blog.cagedmonster.net/content/images/2017/09/F13.png" rel="nofollow">Screenshot</a></li>
<li>Make sure to select the disk encryption :<a href="https://blog.cagedmonster.net/content/images/2017/09/F14.png" rel="nofollow">Screenshot</a></li>
<li>Launch the disk configuration :<a href="https://blog.cagedmonster.net/content/images/2017/09/F15.png" rel="nofollow">Screenshot</a></li>
<li>Here everything is normal, you have to select the disk you&#39;ll use :<a href="https://blog.cagedmonster.net/content/images/2017/09/F16.png" rel="nofollow">Screenshot</a></li>
<li>I have only one SSD disk named da0 :<a href="https://blog.cagedmonster.net/content/images/2017/09/F17.png" rel="nofollow">Screenshot</a></li>
<li>Last chance before erasing your disk :<a href="https://blog.cagedmonster.net/content/images/2017/09/F18.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>Time to choose the password you&#39;ll use to start your system : <a href="https://blog.cagedmonster.net/content/images/2017/09/F19.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F20.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F21.png" rel="nofollow">Screenshot</a> </li>
<li>8. Last steps to finish the installation:

<ul>
<li>The installer will download what you need and what you selected previously (ports, src, etc.) to create your system: <a href="https://blog.cagedmonster.net/content/images/2017/09/F22.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.1. Root password:

<ul>
<li>Enter your root password: <a href="https://blog.cagedmonster.net/content/images/2017/09/F22-1.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.2. Time and date:

<ul>
<li>Set your timezone, in my case: Europe/France <a href="https://blog.cagedmonster.net/content/images/2017/09/F22-2.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F23.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F23-1.png" rel="nofollow">Screenshot</a></li>
<li>Make sure the date and time are good, or you can change them :<a href="https://blog.cagedmonster.net/content/images/2017/09/F24.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F25.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.3. Services:

<ul>
<li>Select the services you&#39;ll use at system startup depending again of what you want to do. In many cases powerd and ntpd will be useful, sshd if you&#39;re planning on using FreeBSD as a server. <a href="https://blog.cagedmonster.net/content/images/2017/09/F26.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.4. Security:

<ul>
<li>Security options you want to enable. You&#39;ll still be able to change them after the installation with sysctl. <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-1.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.5. Additionnal user:

<ul>
<li>Create an unprivileged system user: <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-2.png" rel="nofollow">Screenshot</a></li>
<li>Make sure your user is in the wheel group so he can use the su command. <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-3.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-4.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.6. The end:
End of your configuration, you can still do some modifications if you want : <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-5.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-6.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-7.png" rel="nofollow">Screenshot</a></li>
<li>9. First boot:

<ul>
<li>Enter the passphrase you have chosen previously : <a href="https://blog.cagedmonster.net/content/images/2017/09/F27.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F28.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F29.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>Welcome to Freebsd 11.1 with full disk encryption!
***</li>
</ul>

<h3><a href="http://nanxiao.me/en/the-anatomy-of-ldd-program-on-openbsd/" rel="nofollow">The anatomy of ldd program on OpenBSD</a></h3>

<blockquote>
<p>In the past week, I read the <a href="https://github.com/openbsd/src/blob/master/libexec/ld.so/ldd/ldd.c" rel="nofollow">ldd</a> source code on OpenBSD to get a better understanding of how it works. And this post should also be a reference for other*NIX OSs.</p>
</blockquote>

<ul>
<li>The <a href="https://en.wikipedia.org/wiki/Executable_and_Linkable_Format" rel="nofollow">ELF</a> file is divided into 4 categories: relocatable, executable, shared, and core. Only the executable and shared object files may have dynamic object dependencies, so the ldd only check these 2 kinds of ELF file:</li>
<li>(1) Executable. <code>ldd</code> leverages the <code>LD_TRACE_LOADED_OBJECTS</code> environment variable in fact, and the code is as following:</li>
</ul>

<blockquote>
<pre><code>if (setenv(&quot;LD_TRACE_LOADED_OBJECTS&quot;, &quot;true&quot;, 1) &lt; 0)
err(1, &quot;setenv(LD_TRACE_LOADED_OBJECTS)&quot;);
</code></pre>

<p>When LD_TRACE_LOADED_OBJECTS is set to 1 or true, running executable file will show shared objects needed instead of running it, so you even not needldd to check executable file. See the following outputs:</p>

<pre><code>$ /usr/bin/ldd
usage: ldd program ...
$ LD_TRACE_LOADED_OBJECTS=1 /usr/bin/ldd
        Start            End              Type Open Ref GrpRef Name
        00000b6ac6e00000 00000b6ac7003000 exe  1    0   0      /usr/bin/ldd
        00000b6dbc96c000 00000b6dbcc38000 rlib 0    1   0      /usr/lib/libc.so.89.3
        00000b6d6ad00000 00000b6d6ad00000 rtld 0    1   0      /usr/libexec/ld.so  
</code></pre>
</blockquote>

<ul>
<li>(2) Shared object. The code to print dependencies of shared object is as following:</li>
</ul>

<blockquote>
<pre><code>if (ehdr.e_type == ET_DYN &amp;&amp; !interp) {
    if (realpath(name, buf) == NULL) {
        printf(&quot;realpath(%s): %s&quot;, name,
            strerror(errno));
        fflush(stdout);
        _exit(1);
    }
    dlhandle = dlopen(buf, RTLD_TRACE);
    if (dlhandle == NULL) {
        printf(&quot;%s\n&quot;, dlerror());
        fflush(stdout);
        _exit(1);
    }
    _exit(0);
}
</code></pre>

<p>Why the condition of checking a ELF file is shared object or not is like this:</p>

<pre><code>if (ehdr.e_type == ET_DYN &amp;&amp; !interp) {
    ......
}
</code></pre>

<p>Thats because the file type of position-independent executable (PIE) is the same as shared object, but normally PIE contains a interpreter program header since it needs dynamic linker to load it while shared object lacks (refer this article). So the above condition will filter PIE file.<br>
The dlopen(buf, RTLD_TRACE) is used to print dynamic object information. And the actual code is like this:</p>

<pre><code>if (_dl_traceld) {
    _dl_show_objects();
    _dl_unload_shlib(object);
    _dl_exit(0);
}
</code></pre>

<p>In fact, you can also implement a simple application which outputs dynamic object information for shared object yourself:</p>

<pre><code>&amp;#35; include &lt;dlfcn.h&gt;
int main(int argc, char **argv)
{
    dlopen(argv[1], RTLD_TRACE);
    return 0;
}
</code></pre>

<p>Compile and use it to analyze /usr/lib/libssl.so.43.2:</p>

<pre><code>$ cc lddshared.c
$ ./a.out /usr/lib/libssl.so.43.2
    Start            End              Type Open Ref GrpRef Name
    000010e2df1c5000 000010e2df41a000 dlib 1    0   0      /usr/lib/libssl.so.43.2
    000010e311e3f000 000010e312209000 rlib 0    1   0      /usr/lib/libcrypto.so.41.1
</code></pre>

<p>The same as using ldd directly:</p>

<pre><code>$ ldd /usr/lib/libssl.so.43.2
/usr/lib/libssl.so.43.2:
    Start            End              Type Open Ref GrpRef Name
    00001d9ffef08000 00001d9fff15d000 dlib 1    0   0      /usr/lib/libssl.so.43.2
    00001d9ff1431000 00001d9ff17fb000 rlib 0    1   0      /usr/lib/libcrypto.so.41.1
</code></pre>

<p>Through the studying of ldd source code, I also get many by-products: such as knowledge of ELF file, linking and loading, etc. So diving into code is a really good method to learn *NIX deeper!</p>

<hr>
</blockquote>

<h3><a href="https://clinetworking.wordpress.com/2017/10/13/perl5-slack-syslog-bsd-daemon/" rel="nofollow">Perl5 Slack Syslog BSD daemon</a></h3>

<blockquote>
<p>So I have been working on my little Perl daemon for a week now.<br>
It is a simple syslog daemon that listens on port 514 for incoming messages. It listens on a port so it can process log messages from my consumer Linux router as well as the messages from my server.  Messages that are above alert are sent, as are messages that match the regex of SSH or DHCP (I want to keep track of new connections to my wifi). The rest of the messages are not sent to slack but appended to a log file. This is very handy as I can get access to info like failed ssh logins, disk failures, and new devices connecting to the network all on my Android phone when I am not home.</p>
</blockquote>

<ul>
<li><a href="https://clinetworking.files.wordpress.com/2017/10/screenshot_2017-10-13-23-00-26.png" rel="nofollow">Screenshot</a></li>
</ul>

<blockquote>
<p>The situation arose today that the internet went down and I thought to myself what would happen to all my important syslog messages when they couldnt be sent?  Before the script only ran an eval block on the botsend() function. The error was returned, handled, but nothing was done and the unsent message was discarded. So I added a function that appended unsent messengers to an array that are later sent when the server is not busy sending messages to slack.<br>
Slack has a limit of one message per second. The new addition works well and means that if the internet fails my server will store these messages in memory and resend them at a rate of one message per second when the internet connectivity returns. It currently sends the newest ones first but I am not sure if this is a bug or a feature at this point! It currently works with my Linux based WiFi router and my FreeBSD server. It is easy to scale as all you need to do is send messages to syslog to get them sent to slack. You could sent CPU temp, logged in users etc.</p>
</blockquote>

<ul>
<li>There is a github page: <a href="https://github.com/wilyarti/slackbot" rel="nofollow">https://github.com/wilyarti/slackbot</a></li>
</ul>

<hr>

<h3><a href="http://nanxiao.me/en/lscpu-for-openbsdfreebsd/" rel="nofollow">Lscpu for OpenBSD/FreeBSD</a></h3>

<ul>
<li><a href="https://github.com/NanXiao/lscpu" rel="nofollow">Github Link</a></li>
</ul>

<blockquote>
<p>There is a neat command, lscpu, which is very handy to display CPU information on GNU/Linux OS:</p>

<pre><code>$ lscpu
Architecture:        x86_64
CPU op-mode(s):      32-bit, 64-bit
Byte Order:          Little Endian
CPU(s):              32
On-line CPU(s) list: 0-31
Thread(s) per core:  2
Core(s) per socket:  8
Socket(s):           2
</code></pre>

<p>But unfortunately, the BSD OSs lack this command, maybe one reason is lscpu relies heavily on /proc file system which BSD dont provide, :-). TakeOpenBSD as an example, if I want to know CPU information, dmesg should be one choice:</p>

<pre><code>$ dmesg | grep -i cpu
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz, 2527.35 MHz
cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,
PBE,SSE3,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,XSAVE,NXE,LONG,LAHF,PERF,SENSOR
cpu0: 3MB 64b/line 8-way L2 cache
cpu0: apic clock running at 266MHz
cpu0: mwait min=64, max=64, C-substates=0.2.2.2.2.1.3, IBE
</code></pre>

<p>But the output makes me feeling messy, not very clear. As for dmidecode, it used to be another option, but now cant work out-of-box because it will access /dev/mem which for security reason, OpenBSD doesnt allow by default (You can refer this discussion):</p>

<pre><code>$ ./dmidecode
$ dmidecode 3.1
Scanning /dev/mem for entry point.
/dev/mem: Operation not permitted
</code></pre>

<p>Based on above situation, I want a specified command for showing CPU information for my BSD box. So in the past 2 weeks, I developed a lscpu program for OpenBSD/FreeBSD, or more accurately, OpenBSD/FreeBSD on x86 architecture since I only have some Intel processors at hand. The application getsCPU metrics from 2 sources:</p>
</blockquote>

<ul>
<li>(1) <code>sysctl</code> functions.  The BSD OSs provide sysctl interface which I can use to get general CPU particulars, such as how many CPUs the system contains, the byte-order of CPU, etc.</li>
<li>(2) <code>CPUID</code> instruction. For x86 architecture, CPUID instruction can obtain very detail information of CPU. This coding work is a little tedious and error-prone, not only because I need to reference both Intel and AMD specifications since these 2 vendors have minor distinctions, but also I need to parse the bits of register values.</li>
<li>The code is <a href="https://github.com/NanXiao/lscpu" rel="nofollow">here</a>, and if you run OpenBSD/FreeBSD on x86 processors, please try it. It will be better you can give some feedback or report the issues, and I appreciate it very much. In the future if I have other CPUs resource, such as ARM or SPARC64, maybe I will enrich this small program.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://daemonforums.org/showthread.php?t=10429" rel="nofollow">OpenBSD Porting Workshop - Brian Callahan will be running an OpenBSD porting workshop in NYC for NYC*BUG on December 6, 2017.</a></li>
<li><a href="http://www.openbsdjumpstart.org/#/" rel="nofollow">Learn to tame OpenBSD quickly</a></li>
<li><a href="https://gist.github.com/sortie/94b302dd383df19237d1a04969f1a42b" rel="nofollow">Detect the operating system using UDP stack corner cases</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Awesome Mike - <a href="http://dpaste.com/1H22BND#wrap" rel="nofollow">ZFS Questions</a></li>
<li>Michael - <a href="http://dpaste.com/1JRJ6T9" rel="nofollow">Expanding a file server with only one hard drive with ZFS</a> - <a href="http://dpaste.com/36M7M3E" rel="nofollow">information based on Allan&#39;s IRC response</a></li>
<li>Brian - <a href="http://dpaste.com/3X0GXJR#wrap" rel="nofollow">Optimizing ZFS for a single disk</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Papers we love: ARC by Bryan Cantrill, SSD caching adventures with ZFS, OpenBSD full disk encryption setup, and a Perl5 Slack Syslog BSD daemon.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.youtube.com/watch?v=F8sZRBdmqc0&feature=youtu.be" rel="nofollow">Papers We Love: ARC: A Self-Tuning, Low Overhead Replacement Cache</a></h3>

<ul>
<li>Ever wondered how the ZFS ARC (Adaptive Replacement Cache) works?</li>
<li>How about if Bryan Cantrill presented the original paper on its design?</li>
<li>Today is that day.</li>
<li><a href="https://www.slideshare.net/bcantrill/papers-we-love-arc-after-dark" rel="nofollow">Slides</a></li>
<li>It starts by looking back at a fundamental paper from the 40s where the architecture of general-purpose computers are first laid out</li>
<li>The main is the description of memory hierarchies, where you have a small amount of very fast memory, then the next level is slower but larger, and on and on. As we look at the various L1, L2, and L3 caches on a CPU, then RAM, then flash, then spinning disks, this still holds true today.</li>
<li>The paper then does a survey of the existing caching policies and tries to explain the issues with each. This includes MIN, which is the theoretically optimal policy, which requires future knowledge, but is useful for setting the upper bound, what is the best we could possibly do.</li>
<li>The paper ends up showing that the ARC can end up being better than manually trying to pick the best number for the workload, because it adapts as the workload changes</li>
<li>At about 1:25 into the video, Bryan start talking about the practical implementation of the ARC in ZFS, and some challenges they have run into recently at Joyent.</li>
<li>A great discussion about some of the problems when ZFS needs to shrink the ARC. Not all of it applies 1:1 to FreeBSD because the kernel and the kmem implementation are different in a number of ways</li>
<li>There were some interesting questions asked at the end as well
***</li>
</ul>

<h3><a href="https://unix.stackexchange.com/a/193837" rel="nofollow">How do I use man pages to learn how to use commands?</a></h3>

<ul>
<li>nwildner on StackExchange has a very thorough answer to the question how to interpret man pages to understand complicated commands (xargs in this case, but not specifically).</li>
<li>Have in mind what you want to do.</li>
</ul>

<blockquote>
<p>When doing your research about xargs you did it for a purpose, right? You had a specific need that was reading standard output and executing commands based on that output.</p>
</blockquote>

<ul>
<li>But, when I don&#39;t know which command I want?</li>
</ul>

<blockquote>
<p>Use man -k or apropos (they are equivalent). If I don&#39;t know how to find a file: man -k file | grep search. Read the descriptions and find one that will better fit your needs.</p>
</blockquote>

<ul>
<li>Apropos works with regular expressions by default, (man apropos, read the description and find out what -r does), and on this example I&#39;m looking for every manpage where the description starts with &quot;report&quot;.</li>
<li><p>Always read the DESCRIPTION before starting</p></li>
<li><p>Take a time and read the description. By just reading the description of the xargs command we will learn that:</p></li>
</ul>

<blockquote>
<p>xargs reads from STDIN and executes the command needed. This also means that you will need to have some knowledge of how standard input works, and how to manipulate it through pipes to chain commands<br>
The default behavior is to act like /bin/echo. This gives you a little tip that if you need to chain more than one xargs, you don&#39;t need to use echo to print.<br>
We have also learned that unix filenames can contain blank and newlines, that this could be a problem and the argument -0 is a way to prevent things explode by using null character separators. The description warns you that the command being used as input needs to support this feature too, and that GNU find support it. Great. We use a lot of find with xargs.<br>
xargs will stop if exit status 255 is reached.</p>
</blockquote>

<ul>
<li>Some descriptions are very short and that is generally because the software works on a very simple way. Don&#39;t even think of skipping this part of the manpage ;)</li>
<li><p>Other things to pay attention...</p></li>
<li><p>You know that you can search for files using find. There is a ton of options and if you only look at the SYNOPSIS, you will get overwhelmed by those. It&#39;s just the tip of the iceberg. Excluding NAME, SYNOPSIS, and DESCRIPTION, you will have the following sections:</p></li>
</ul>

<blockquote>
<p>When this method will not work so well...</p>

<ul>
<li>Tips that apply to all commands</li>
</ul>
</blockquote>

<ul>
<li>Some options, mnemonics and &quot;syntax style&quot; travel through all commands making you buy some time by not having to open the manpage at all. Those are learned by practice and the most common are:</li>
</ul>

<blockquote>
<p>Generally, -v means verbose. -vvv is a variation &quot;very very verbose&quot; on some software.<br>
Following the POSIX standard, generally one dash arguments can be stacked. Example: tar -xzvf,  cp -Rv.<br>
Generally -R and/or -r means recursive.<br>
Almost all commands have a brief help with the --help option.<br>
--version shows the version of a software.<br>
-p, on copy or move utilities means &quot;preserve permissions&quot;.<br>
-y means YES, or &quot;proceed without confirmation&quot; in most cases.</p>
</blockquote>

<ul>
<li>Default values of commands.</li>
</ul>

<blockquote>
<p>At the pager chunk of this answer, we saw that less -is is the pager of man. The default behavior of commands are not always shown at a separated section on manpages, or at the section that is most top placed.<br>
You will have to read the options to find out defaults, or if you are lucky, typing /pager will lead you to that info. This also requires you to know the concept of the pager(software that scrolls the manpage), and this is a thing you will only acquire after reading lots of manpages.</p>
</blockquote>

<ul>
<li>And what about the SYNOPSIS syntax?</li>
</ul>

<blockquote>
<p>After getting all the information needed to execute the command, you can combine options, option-arguments and operands inline to make your job done. Overview of concepts:<br>
Options are the switches that dictates a command behavior. &quot;Do this&quot; &quot;don&#39;t do this&quot; or &quot;act this way&quot;. Often called switches.</p>
</blockquote>

<ul>
<li>Check out the full answer and see if it helps you better grasp the meaning of a man page and thus the command.
***</li>
</ul>

<h3><a href="https://robertputt.co.uk/my-adventure-into-ssd-caching-with-zfs-home-nas.html" rel="nofollow">My adventure into SSD caching with ZFS (Home NAS)</a></h3>

<ul>
<li>Robert Putt as written about his adventure using SSDs for caching with ZFS on his home NAS.</li>
</ul>

<blockquote>
<p>Recently I decided to throw away my old defunct 2009 MacBook Pro which was rotting in my cupboard and I decided to retrieve the only useful part before doing so, the 80GB Intel SSD I had installed a few years earlier. Initially I thought about simply adding it to my desktop as a bit of extra space but in 2017 80GB really wasnt worth it and then I had a brainwave Lets see if we can squeeze some additional performance out of my HP Microserver Gen8 NAS running ZFS by installing it as a cache disk.<br>
I installed the SSD to the cdrom tray of the Microserver using a floppy disk power to SATA power converter and a SATA cable, unfortunately it seems the CD ROM SATA port on the motherboard is only a 3gbps port although this didnt matter so much as it was an older 3gbps SSD anyway. Next I booted up the machine and to my suprise the disk was not found in my FreeBSD install, then I realised that the SATA port for the CD drive is actually provided by the RAID controller, so I rebooted into intelligent provisioning and added an additional RAID0 array with just the 1 disk to act as my cache, in fact all of the disks in this machine are individual RAID0 arrays so it looks like just a bunch of disks (JBOD) as ZFS offers additional functionality over normal RAID (mainly scrubbing, deduplication and compression).</p>
</blockquote>

<ul>
<li><p>Configuration</p></li>
<li><p>Lets have a look at the zpool before adding the cache drive to make sure there are no errors or uglyness:</p></li>
</ul>

<blockquote>
<p>Now lets prep the drive for use in the zpool using gpart. I want to split the SSD into two seperate partitions, one for L2ARC (read caching) and one for ZIL (write caching). I have decided to split the disk into 20GB for ZIL and 50GB for L2ARC. Be warned using 1 SSD like this is considered unsafe because it is a single point of failure in terms of delayed writes (a redundant configuration with 2 SSDs would be more appropriate) and the heavy write cycles on the SSD from the ZIL is likely to kill it over time.<br>
Now its time to see if adding the cache has made much of a difference. I suspect not as my Home NAS sucks, it is a HP Microserver Gen8 with the crappy Celeron CPU and only 4GB RAM, anyway, lets test it and find out. First off lets throw fio at the mount point for this zpool and see what happens both with the ZIL and L2ARC enabled and disabled.</p>
</blockquote>

<ul>
<li>Observations</li>
</ul>

<blockquote>
<p>Ok, so the initial result is a little dissapointing, but hardly unexpected, my NAS sucks and there are lots of bottle necks, CPU, memory and the fact only 2 of the SATA ports are 6gbps. There is no real difference performance wise in comparison between the results, the IOPS, bandwidth and latency appear very similar. However lets bare in mind fio is a pretty hardcore disk benchmark utility, how about some real world use cases?<br>
Next I decided to test a few typical file transactions that this NAS is used for, Samba shares to my workstation. For the first test I wanted to test reading a 3GB file over the network with both the cache enabled and disabled, I would run this multiple times to ensure the data is hot in the L2ARC and to ensure the test is somewhat repeatable, the network itself is an uncongested 1gbit link and I am copying onto the secondary SSD in my workstation. The dataset for these tests has compression and deduplication disabled.</p>
</blockquote>

<ul>
<li>Samba Read Test</li>
</ul>

<blockquote>
<p>Not bad once the data becomes hot in the L2ARC cache reads appear to gain a decent advantage compared to reading from the disk directly. How does it perform when writing the same file back accross the network using the ZIL vs no ZIL.</p>
</blockquote>

<ul>
<li>Samba Write Test</li>
</ul>

<blockquote>
<p>Another good result in the real world test, this certainately helps the write transfer speed however I do wonder what would happen if you filled the ZIL transferring a very large file, however this is unlikely with my use case as I typically only deal with a couple of files of several hundred megabytes at any given time so a 20GB ZIL should suit me reasonably well.</p>
</blockquote>

<ul>
<li>Is ZIL and L2ARC worth it?</li>
</ul>

<blockquote>
<p>I would imagine with a big beefy ZFS server running in a company somewhere with a large disk pool and lots of users with multiple enterprise level SSD ZIL and L2ARC would be well worth the investment, however at home I am not so sure. Yes I did see an increase in read speeds with cached data and a general increase in write speeds however it is use case dependant. In my use case I rarely access the same file frequently, my NAS primarily serves as a backup and for archived data, and although the write speeds are cool I am not sure its a deal breaker. If I built a new home NAS today Id probably concentrate the budget on a better CPU, more RAM (for ARC cache) and more disks. However if I had a use case where I frequently accessed the same files and needed to do so in a faster fashion then yes, Id probably invest in an SSD for caching. I think if you have a spare SSD lying around and you want something fun todo with it, sure chuck it in your ZFS based NAS as a cache mechanism. If you were planning on buying an SSD for caching then Id really consider your needs and decide if the money can be spent on alternative stuff which would improve your experience with your NAS. I know my NAS would benefit more from an extra stick of RAM and a more powerful CPU, but as a quick evening project with some parts I had hanging around adding some SSD cache was worth a go.</p>

<hr>
</blockquote>

<h2>More Viewer Interview Questions for Allan</h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.cagedmonster.net/setup-openbsd-with-full-disk-encryption/" rel="nofollow">Setup OpenBSD 6.2 with Full Disk Encryption</a></h3>

<ul>
<li><p>Here is a quick way to setup (in 7 steps) OpenBSD 6.2 with the encryption of the filesystem.</p></li>
<li><p>First step: Boot and start the installation:</p></li>
</ul>

<blockquote>
<p>(I)nstall: I<br>
Keyboard Layout: ENTER (I&#39;m french so in my case I took the FR layout)<br>
Leave the installer with: !</p>
</blockquote>

<ul>
<li>Second step: Prepare your disk for encryption.</li>
</ul>

<blockquote>
<p>Using a SSD, my disk is named : sd0, the name may vary, for example : wd0.<br>
Initiating the disk:<br>
Configure your volume:<br>
Now we&#39;ll use bioctl to encrypt the partition we created, in this case : sd0a (disk sd0 + partition « a »).<br>
Enter your passphrase.</p>
</blockquote>

<ul>
<li>Third step:</li>
</ul>

<blockquote>
<p>Let&#39;s resume the OpenBSD&#39;s installer. We follow the install procedure</p>
</blockquote>

<ul>
<li>Fourth step: Partitioning of the encrypted volume.</li>
</ul>

<blockquote>
<p>We select our new volume, in this case: sd1<br>
The whole disk will be used: W(hole)<br>
Let&#39;s create our partitions:<br>
NB: You are more than welcome to create multiple partitions for your system.</p>
</blockquote>

<ul>
<li>Fifth step: System installation</li>
</ul>

<blockquote>
<p>It&#39;s time to choose how we&#39;ll install our system (network install by http in my case)</p>
</blockquote>

<ul>
<li><p>Sixth step: Finalize the installation.</p></li>
<li><p>Last step: Reboot and start your system.</p></li>
</ul>

<blockquote>
<p>Put your passphrase. Welcome to OpenBSD 6.2 with a full encrypted file system.</p>
</blockquote>

<ul>
<li>Optional: Disable the swap encryption.</li>
</ul>

<blockquote>
<p>The swap is actually part of the encrypted filesystem, we don&#39;t need OpenBSD to encrypt it. Sysctl is giving us this possibility.</p>
</blockquote>

<hr>

<h3><a href="https://blog.cagedmonster.net/step-by-step-freebsd-installation-with-full-disk-encryption/" rel="nofollow">Step-by-Step FreeBSD installation with ZFS and Full Disk Encryption</a></h3>

<ul>
<li>1. What do I need?

<ul>
<li>For this tutorial, the installation has been made on a Intel Core i7 - AMD64 architecture.</li>
<li>On a USB key, you would probably use this link : <a href="ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-mini-memstick.img" rel="nofollow">ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-mini-memstick.img</a></li>
<li>If you can&#39;t do a network installation, you&#39;d better use this image : <a href="ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-memstick.img" rel="nofollow">ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-memstick.img</a></li>
<li>You can write the image file on your USB device (replace XXXX with the name of your device) using dd : <code># dd if=FreeBSD-11.1-RELEASE-amd64-mini-memstick.img of=/dev/XXXX bs=1m</code></li>
</ul></li>
<li>2. Boot and install: <a href="https://blog.cagedmonster.net/content/images/2017/09/F1.png" rel="nofollow">Screenshot</a></li>
<li>3. Configure your keyboard layout: <a href="https://blog.cagedmonster.net/content/images/2017/09/F2.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F3.png" rel="nofollow">Screenshot</a></li>
<li>4. Hostname and system components configuration : 

<ul>
<li>Set the name of your machine: [Screenshot](<a href="https://blog.cagedmonster.net/content/images/2017/09/F4.png_" rel="nofollow">https://blog.cagedmonster.net/content/images/2017/09/F4.png_</a></li>
<li>What components do you want to install? <a href="https://blog.cagedmonster.net/content/images/2017/09/F5.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>5. Network configuration:

<ul>
<li>Select the network interface you want to configure. <a href="https://blog.cagedmonster.net/content/images/2017/09/F6.png" rel="nofollow">Screenshot</a></li>
<li>First, we configure our IPv4 network. I used a static adress so you can see how it works, but you can use DHCP for an automated configuration, it depends of what you want to do with your system (desktop/server) <a href="https://blog.cagedmonster.net/content/images/2017/09/F7.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F7-1.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F8.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>IPv6 network configuration. Same as for IPv4, you can use SLAAC for an automated configuration. <a href="https://blog.cagedmonster.net/content/images/2017/09/F9.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F10-1.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F10-2.png" rel="nofollow">Screenshot</a>

<ul>
<li>Here, you can configure your DNS servers, I used the Google DNS servers so you can use them too if needed. <a href="https://blog.cagedmonster.net/content/images/2017/09/F11.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>6. Select the server you want to use for the installation:

<ul>
<li>I always use the IPv6 mirror to ensure that my IPv6 network configuration is good.<a href="https://blog.cagedmonster.net/content/images/2017/09/F12.png" rel="nofollow">Screenshot</a> </li>
</ul></li>
<li>7. Disk configuration:

<ul>
<li>As we want to do an easy full disk encryption, we&#39;ll use ZFS. <a href="https://blog.cagedmonster.net/content/images/2017/09/F13.png" rel="nofollow">Screenshot</a></li>
<li>Make sure to select the disk encryption :<a href="https://blog.cagedmonster.net/content/images/2017/09/F14.png" rel="nofollow">Screenshot</a></li>
<li>Launch the disk configuration :<a href="https://blog.cagedmonster.net/content/images/2017/09/F15.png" rel="nofollow">Screenshot</a></li>
<li>Here everything is normal, you have to select the disk you&#39;ll use :<a href="https://blog.cagedmonster.net/content/images/2017/09/F16.png" rel="nofollow">Screenshot</a></li>
<li>I have only one SSD disk named da0 :<a href="https://blog.cagedmonster.net/content/images/2017/09/F17.png" rel="nofollow">Screenshot</a></li>
<li>Last chance before erasing your disk :<a href="https://blog.cagedmonster.net/content/images/2017/09/F18.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>Time to choose the password you&#39;ll use to start your system : <a href="https://blog.cagedmonster.net/content/images/2017/09/F19.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F20.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F21.png" rel="nofollow">Screenshot</a> </li>
<li>8. Last steps to finish the installation:

<ul>
<li>The installer will download what you need and what you selected previously (ports, src, etc.) to create your system: <a href="https://blog.cagedmonster.net/content/images/2017/09/F22.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.1. Root password:

<ul>
<li>Enter your root password: <a href="https://blog.cagedmonster.net/content/images/2017/09/F22-1.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.2. Time and date:

<ul>
<li>Set your timezone, in my case: Europe/France <a href="https://blog.cagedmonster.net/content/images/2017/09/F22-2.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F23.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F23-1.png" rel="nofollow">Screenshot</a></li>
<li>Make sure the date and time are good, or you can change them :<a href="https://blog.cagedmonster.net/content/images/2017/09/F24.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F25.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.3. Services:

<ul>
<li>Select the services you&#39;ll use at system startup depending again of what you want to do. In many cases powerd and ntpd will be useful, sshd if you&#39;re planning on using FreeBSD as a server. <a href="https://blog.cagedmonster.net/content/images/2017/09/F26.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.4. Security:

<ul>
<li>Security options you want to enable. You&#39;ll still be able to change them after the installation with sysctl. <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-1.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.5. Additionnal user:

<ul>
<li>Create an unprivileged system user: <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-2.png" rel="nofollow">Screenshot</a></li>
<li>Make sure your user is in the wheel group so he can use the su command. <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-3.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-4.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>8.6. The end:
End of your configuration, you can still do some modifications if you want : <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-5.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-6.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F26-7.png" rel="nofollow">Screenshot</a></li>
<li>9. First boot:

<ul>
<li>Enter the passphrase you have chosen previously : <a href="https://blog.cagedmonster.net/content/images/2017/09/F27.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F28.png" rel="nofollow">Screenshot</a> &amp; <a href="https://blog.cagedmonster.net/content/images/2017/09/F29.png" rel="nofollow">Screenshot</a></li>
</ul></li>
<li>Welcome to Freebsd 11.1 with full disk encryption!
***</li>
</ul>

<h3><a href="http://nanxiao.me/en/the-anatomy-of-ldd-program-on-openbsd/" rel="nofollow">The anatomy of ldd program on OpenBSD</a></h3>

<blockquote>
<p>In the past week, I read the <a href="https://github.com/openbsd/src/blob/master/libexec/ld.so/ldd/ldd.c" rel="nofollow">ldd</a> source code on OpenBSD to get a better understanding of how it works. And this post should also be a reference for other*NIX OSs.</p>
</blockquote>

<ul>
<li>The <a href="https://en.wikipedia.org/wiki/Executable_and_Linkable_Format" rel="nofollow">ELF</a> file is divided into 4 categories: relocatable, executable, shared, and core. Only the executable and shared object files may have dynamic object dependencies, so the ldd only check these 2 kinds of ELF file:</li>
<li>(1) Executable. <code>ldd</code> leverages the <code>LD_TRACE_LOADED_OBJECTS</code> environment variable in fact, and the code is as following:</li>
</ul>

<blockquote>
<pre><code>if (setenv(&quot;LD_TRACE_LOADED_OBJECTS&quot;, &quot;true&quot;, 1) &lt; 0)
err(1, &quot;setenv(LD_TRACE_LOADED_OBJECTS)&quot;);
</code></pre>

<p>When LD_TRACE_LOADED_OBJECTS is set to 1 or true, running executable file will show shared objects needed instead of running it, so you even not needldd to check executable file. See the following outputs:</p>

<pre><code>$ /usr/bin/ldd
usage: ldd program ...
$ LD_TRACE_LOADED_OBJECTS=1 /usr/bin/ldd
        Start            End              Type Open Ref GrpRef Name
        00000b6ac6e00000 00000b6ac7003000 exe  1    0   0      /usr/bin/ldd
        00000b6dbc96c000 00000b6dbcc38000 rlib 0    1   0      /usr/lib/libc.so.89.3
        00000b6d6ad00000 00000b6d6ad00000 rtld 0    1   0      /usr/libexec/ld.so  
</code></pre>
</blockquote>

<ul>
<li>(2) Shared object. The code to print dependencies of shared object is as following:</li>
</ul>

<blockquote>
<pre><code>if (ehdr.e_type == ET_DYN &amp;&amp; !interp) {
    if (realpath(name, buf) == NULL) {
        printf(&quot;realpath(%s): %s&quot;, name,
            strerror(errno));
        fflush(stdout);
        _exit(1);
    }
    dlhandle = dlopen(buf, RTLD_TRACE);
    if (dlhandle == NULL) {
        printf(&quot;%s\n&quot;, dlerror());
        fflush(stdout);
        _exit(1);
    }
    _exit(0);
}
</code></pre>

<p>Why the condition of checking a ELF file is shared object or not is like this:</p>

<pre><code>if (ehdr.e_type == ET_DYN &amp;&amp; !interp) {
    ......
}
</code></pre>

<p>Thats because the file type of position-independent executable (PIE) is the same as shared object, but normally PIE contains a interpreter program header since it needs dynamic linker to load it while shared object lacks (refer this article). So the above condition will filter PIE file.<br>
The dlopen(buf, RTLD_TRACE) is used to print dynamic object information. And the actual code is like this:</p>

<pre><code>if (_dl_traceld) {
    _dl_show_objects();
    _dl_unload_shlib(object);
    _dl_exit(0);
}
</code></pre>

<p>In fact, you can also implement a simple application which outputs dynamic object information for shared object yourself:</p>

<pre><code>&amp;#35; include &lt;dlfcn.h&gt;
int main(int argc, char **argv)
{
    dlopen(argv[1], RTLD_TRACE);
    return 0;
}
</code></pre>

<p>Compile and use it to analyze /usr/lib/libssl.so.43.2:</p>

<pre><code>$ cc lddshared.c
$ ./a.out /usr/lib/libssl.so.43.2
    Start            End              Type Open Ref GrpRef Name
    000010e2df1c5000 000010e2df41a000 dlib 1    0   0      /usr/lib/libssl.so.43.2
    000010e311e3f000 000010e312209000 rlib 0    1   0      /usr/lib/libcrypto.so.41.1
</code></pre>

<p>The same as using ldd directly:</p>

<pre><code>$ ldd /usr/lib/libssl.so.43.2
/usr/lib/libssl.so.43.2:
    Start            End              Type Open Ref GrpRef Name
    00001d9ffef08000 00001d9fff15d000 dlib 1    0   0      /usr/lib/libssl.so.43.2
    00001d9ff1431000 00001d9ff17fb000 rlib 0    1   0      /usr/lib/libcrypto.so.41.1
</code></pre>

<p>Through the studying of ldd source code, I also get many by-products: such as knowledge of ELF file, linking and loading, etc. So diving into code is a really good method to learn *NIX deeper!</p>

<hr>
</blockquote>

<h3><a href="https://clinetworking.wordpress.com/2017/10/13/perl5-slack-syslog-bsd-daemon/" rel="nofollow">Perl5 Slack Syslog BSD daemon</a></h3>

<blockquote>
<p>So I have been working on my little Perl daemon for a week now.<br>
It is a simple syslog daemon that listens on port 514 for incoming messages. It listens on a port so it can process log messages from my consumer Linux router as well as the messages from my server.  Messages that are above alert are sent, as are messages that match the regex of SSH or DHCP (I want to keep track of new connections to my wifi). The rest of the messages are not sent to slack but appended to a log file. This is very handy as I can get access to info like failed ssh logins, disk failures, and new devices connecting to the network all on my Android phone when I am not home.</p>
</blockquote>

<ul>
<li><a href="https://clinetworking.files.wordpress.com/2017/10/screenshot_2017-10-13-23-00-26.png" rel="nofollow">Screenshot</a></li>
</ul>

<blockquote>
<p>The situation arose today that the internet went down and I thought to myself what would happen to all my important syslog messages when they couldnt be sent?  Before the script only ran an eval block on the botsend() function. The error was returned, handled, but nothing was done and the unsent message was discarded. So I added a function that appended unsent messengers to an array that are later sent when the server is not busy sending messages to slack.<br>
Slack has a limit of one message per second. The new addition works well and means that if the internet fails my server will store these messages in memory and resend them at a rate of one message per second when the internet connectivity returns. It currently sends the newest ones first but I am not sure if this is a bug or a feature at this point! It currently works with my Linux based WiFi router and my FreeBSD server. It is easy to scale as all you need to do is send messages to syslog to get them sent to slack. You could sent CPU temp, logged in users etc.</p>
</blockquote>

<ul>
<li>There is a github page: <a href="https://github.com/wilyarti/slackbot" rel="nofollow">https://github.com/wilyarti/slackbot</a></li>
</ul>

<hr>

<h3><a href="http://nanxiao.me/en/lscpu-for-openbsdfreebsd/" rel="nofollow">Lscpu for OpenBSD/FreeBSD</a></h3>

<ul>
<li><a href="https://github.com/NanXiao/lscpu" rel="nofollow">Github Link</a></li>
</ul>

<blockquote>
<p>There is a neat command, lscpu, which is very handy to display CPU information on GNU/Linux OS:</p>

<pre><code>$ lscpu
Architecture:        x86_64
CPU op-mode(s):      32-bit, 64-bit
Byte Order:          Little Endian
CPU(s):              32
On-line CPU(s) list: 0-31
Thread(s) per core:  2
Core(s) per socket:  8
Socket(s):           2
</code></pre>

<p>But unfortunately, the BSD OSs lack this command, maybe one reason is lscpu relies heavily on /proc file system which BSD dont provide, :-). TakeOpenBSD as an example, if I want to know CPU information, dmesg should be one choice:</p>

<pre><code>$ dmesg | grep -i cpu
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz, 2527.35 MHz
cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,
PBE,SSE3,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,XSAVE,NXE,LONG,LAHF,PERF,SENSOR
cpu0: 3MB 64b/line 8-way L2 cache
cpu0: apic clock running at 266MHz
cpu0: mwait min=64, max=64, C-substates=0.2.2.2.2.1.3, IBE
</code></pre>

<p>But the output makes me feeling messy, not very clear. As for dmidecode, it used to be another option, but now cant work out-of-box because it will access /dev/mem which for security reason, OpenBSD doesnt allow by default (You can refer this discussion):</p>

<pre><code>$ ./dmidecode
$ dmidecode 3.1
Scanning /dev/mem for entry point.
/dev/mem: Operation not permitted
</code></pre>

<p>Based on above situation, I want a specified command for showing CPU information for my BSD box. So in the past 2 weeks, I developed a lscpu program for OpenBSD/FreeBSD, or more accurately, OpenBSD/FreeBSD on x86 architecture since I only have some Intel processors at hand. The application getsCPU metrics from 2 sources:</p>
</blockquote>

<ul>
<li>(1) <code>sysctl</code> functions.  The BSD OSs provide sysctl interface which I can use to get general CPU particulars, such as how many CPUs the system contains, the byte-order of CPU, etc.</li>
<li>(2) <code>CPUID</code> instruction. For x86 architecture, CPUID instruction can obtain very detail information of CPU. This coding work is a little tedious and error-prone, not only because I need to reference both Intel and AMD specifications since these 2 vendors have minor distinctions, but also I need to parse the bits of register values.</li>
<li>The code is <a href="https://github.com/NanXiao/lscpu" rel="nofollow">here</a>, and if you run OpenBSD/FreeBSD on x86 processors, please try it. It will be better you can give some feedback or report the issues, and I appreciate it very much. In the future if I have other CPUs resource, such as ARM or SPARC64, maybe I will enrich this small program.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://daemonforums.org/showthread.php?t=10429" rel="nofollow">OpenBSD Porting Workshop - Brian Callahan will be running an OpenBSD porting workshop in NYC for NYC*BUG on December 6, 2017.</a></li>
<li><a href="http://www.openbsdjumpstart.org/#/" rel="nofollow">Learn to tame OpenBSD quickly</a></li>
<li><a href="https://gist.github.com/sortie/94b302dd383df19237d1a04969f1a42b" rel="nofollow">Detect the operating system using UDP stack corner cases</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Awesome Mike - <a href="http://dpaste.com/1H22BND#wrap" rel="nofollow">ZFS Questions</a></li>
<li>Michael - <a href="http://dpaste.com/1JRJ6T9" rel="nofollow">Expanding a file server with only one hard drive with ZFS</a> - <a href="http://dpaste.com/36M7M3E" rel="nofollow">information based on Allan&#39;s IRC response</a></li>
<li>Brian - <a href="http://dpaste.com/3X0GXJR#wrap" rel="nofollow">Optimizing ZFS for a single disk</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>218: A KRACK in the WiFi</title>
  <link>https://www.bsdnow.tv/218</link>
  <guid isPermaLink="false">e0a5ad39-7410-48c8-b0f4-a879c27cf354</guid>
  <pubDate>Wed, 01 Nov 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e0a5ad39-7410-48c8-b0f4-a879c27cf354.mp3" length="53638132" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 10.4-RELEASE is here, more EuroBSDcon travel notes, the KRACK attack, ZFS and DTrace on NetBSD, and pfsense 2.4.</itunes:subtitle>
  <itunes:duration>1:14:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 10.4-RELEASE is here, more EuroBSDcon travel notes, the KRACK attack, ZFS and DTrace on NetBSD, and pfsense 2.4.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD 10.4-RELEASE Available (https://www.freebsd.org/releases/10.4R/announce.html)
FreeBSD 10.4-RELEASE is out. The FreeBSD Project dedicates the FreeBSD 10.4-RELEASE to the memory of Andrey A. Chernov.
Some of the highlights:
10.4-RELEASE is the first FreeBSD release to feature full support for eMMC storage, including eMMC partitions, TRIM and bus speed modes up to HS400. Please note, though, that availability of especially the DDR52, HS200 and HS400 modes requires support in the actual sdhci(4) front-end as well as by the hardware used. Also note, that the SDHCI controller part of Intel® Apollo Lake chipsets is affected by several severe silicon bugs. Apparently, it depends on the particular Apollo Lake platform whether the workarounds in place so far are sufficient to avoid timeouts on attaching sdhci(4) there.
Also in case a GPT disk label is used, the fsckffs(8) utility now is able to find alternate superblocks.
The aesni(4) driver now no longer shares a single FPU context across multiple sessions in multiple threads, addressing problems seen when employing aesni(4) for accelerating ipsec(4).
Support for the Kaby Lake generation of Intel® i219(4)/ i219(5) devices has been added to the em(4) driver.
The em(4) driver is now capable of enabling Wake On LAN (WOL) also for Intel® i217, i218 and i219 chips. Note that stale interface configurations from previous unsuccessful attempts to enable WOL for these devices now will actually take effect. For example, an ifconfig em0 wol activates all WOL variants including wolmcast, which might be undesirable.
Support for WOL has been added to the igb(4) driver, which was not able to activate this feature on any device before. The same remark regarding stale WOL configurations as for the em(4) driver applies.
Userland coredumps can now trigger events such as generating a human readable crash report via devd(8). This feature is off by default.
The firmware shipping with the qlxgbe(4) driver has been updated to version 5.4.66. Additionally, this driver has received some TSO and locking fixes, performance optimizations as well as SYSCTLs providing MAC, RX and TX statistics.
Mellanox® ConnectX-4 series adapters are now supported by the newly added mlx5ib(4) driver.
OpenSSH received an update to version 7.3p1.
GNOME has been updated to version 3.18.
Xorg-Server has been updated to version 1.18.4.
Check out the full release notes and upgrade your systems to 10.4-RELEASE. Thanks to the FreeBSD Release Engineering Team for their efforts. 
***
EuroBSDcon 2017: "travel notes" after the conference (https://blog.netbsd.org/tnf/entry/eurobsdcon_2017_travel_notes_after)
Leonardo Taccari posted in the NetBSD blog about his experiences at EuroBSDcon 2017:
Let me tell you about my experience at EuroBSDcon 2017 in Paris, France. We will see what was presented during the NetBSD developer summit on Friday and then we will give a look to all of the NetBSD and pkgsrc presentations given during the conference session on Saturday and Sunday. Of course, a lot of fun also happened on the "hall track", the several breaks during the conference and the dinners we had together with other *BSD developers and community! This is difficult to describe and I will try to just share some part of that with photographs that we have taken. I can just say that it was a really beautiful experience, I had a great time with others and, after coming back home... ...I miss all of that! :) So, if you have never been in any BSD conferences I strongly suggest you to go to the next ones, so please stay tuned via NetBSD Events. Being there this is probably the only way to understand these feelings!
Thursday (21/09): NetBSD developers dinner
Arriving in Paris via a night train from Italy I literally sleep-walked through Paris getting lost again and again. After getting in touch with other developers we had a dinner together and went sightseeing for a^Wseveral beers!
Friday (22/09): NetBSD developers summit
On Friday morning we met for the NetBSD developers summit kindly hosted by Arolla.
NetBSD on Google Compute Engine -- Benny Siegert (bsiegert)
Scripting DDB with Forth -- Valery Ushakov (uwe)
News from the version control front -- Jörg Sonnenberger (joerg)
Afternoon discussions and dinner
After the lunch we had several non-scheduled discussions, some time for hacking, etc.
We then had a nice dinner together (it was in a restaurant with a very nice waiter who always shouted after every order or after accidentally dropping and crashing dishes!, yeah! That's probably a bit weird but I liked that attitude! :)) and then did some sightseeing and had a beer together.
Saturday (23/09): First day of conference session and Social Event
A Modern Replacement for BSD spell(1) -- Abhinav Upadhyay (abhinav)
Portable Hotplugging: NetBSD's uvm_hotplug(9) API development -- Cherry G.
Mathew (cherry)
Hardening pkgsrc -- Pierre Pronchery (khorben)
Reproducible builds on NetBSD -- Christos Zoulas (christos)
Social event
The social event on Saturday evening took place on a boat that cruised on the Seine river.
It was a very nice and different way to sightsee Paris, eat and enjoy some drinks and socialize and discuss with other developers and community.
+ Sunday (24/09): Second day of conference session
The school of hard knocks - PT1 -- Sevan Janiyan (sevan)
The LLDB Debugger on NetBSD -- Kamil Rytarowski (kamil)
What's in store for NetBSD 8.0? -- Alistair Crooks (agc)
Sunday dinner
After the conference we did some sightseeing in Paris, had a dinner together and then enjoyed some beers!
Conclusion
It was a very nice weekend and conference. It is worth to mention that EuroBSDcon 2017 was the biggest BSD conference (more than 300 people attended it!).
I would like to thank the entire EuroBSDcon organising committee (Baptiste Daroussin, Antoine Jacoutot, Jean-Sébastien Pédron and Jean-Yves Migeon), EuroBSDcon programme committee (Antoine Jacoutot, Lars Engels, Ollivier Robert, Sevan Janiyan, Jörg Sonnenberger, Jasper Lievisse Adriaanse and Janne Johansson) and EuroBSDcon Foundation for organizing such a wonderful conference!
I also would like to thank the speakers for presenting very interesting talks, all developers and community that attended the NetBSD devsummit and conference, in particular Jean-Yves and Jörg, for organizing and moderating the devsummit and Arolla that kindly hosted us for the NetBSD devsummit!
A special thanks also to Abhinav (abhinav) and Martin (martin) for photographs and locals Jean-Yves (jym) and Stoned (seb) for helping us in not get lost in Paris' rues! :)
Thank you!
***
WiFi Vulnerability in WPA2: KRACK (https://www.krackattacks.com/)
“We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.”
“Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks. For more information about specific products, consult the database of CERT/CC, or contact your vendor.”
FreeBSD Advisory  (https://www.freebsd.org/security/advisories/FreeBSD-SA-17:07.wpa.asc)
As of the date of this recording, a few weeks ahead of when this episode will air, the issue is fixed in FreeBSD 11.0 and 11.1, and a workaround has been provided for 10.3 and 10.4 (install newer wpa_supplicant from ports). A fix for 10.3 and 10.4 is expected soon. They will more than likely be out by time you are watching this.
The fix for 10.3 and 10.4 is more complicated because the version of wpasupplicant included in the base system is 2.0, from January 2013, so is nearly 5 years old, so the patches do not apply cleanly. The security team is still considering if it will try to patch 2.0, or just replace the version of wpasupplicant with 2.5 from FreeBSD 11.x.
OpenBSD was unwilling to wait when the embargo was extended on this vulnerability and stealth fixed the issue on Aug 30th (https://marc.info/?l=openbsd-cvs&amp;amp;m=150410571407760&amp;amp;w=2)
stsp@openbsd.org ‘s Mastodon post (https://mastodon.social/@stsp/98837563531323569)
Lobste.rs conversation about flaw and OpenBSD’s reaction (https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbhnfz)
“What happened is that he told me on July 15, and gave a 6 weeks embargo until end of August. We already complained back then that this was way too long and leaving people exposed. Then he got CERT (and, thus, US gov agencies) involved and had to extend the embargo even further until today. At that point we already had the ball rolling and decided to stick to the original agreement with him, and he gave us an agreeing nod towards that as well.”
“In this situation, a request for keeping the problem and fix secret is a request to leave our users at risk and exposed to insiders who will potentially use the bug to exploit our users. And we have no idea who the other insiders are. We have to assume that information of this kind leaks and dissipates pretty fast in the security “community”.”
“We chose to serve the needs of our users who are the vulnerable people in this drama. I stand by that choice.”
As a result of this:
“To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.”
NetBSD: “patches for the WPA issues in KRACK Attacks were committed Oct 16th to HEAD &amp;amp; are pending pullup to 6/7/8 branches” (http://mail-index.netbsd.org/source-changes/2017/10/16/msg088877.html)
As of this recording, Dragonfly appears to use wpa_supplicant 2.1 which they imported in 2014 and has not been touched in over a year (https://github.com/DragonFlyBSD/DragonFlyBSD/commits/master/contrib/wpa_supplicant)
***
News Roundup
NetBSD - dtrace and ZFS update (https://mail-index.netbsd.org/tech-kern/2017/10/13/msg022436.html)
Chuck Silvers writes to the tech-kern mailing list of NetBSD:
I've been working on updating netbsd's copy of the dtrace and zfs code to rebase from the existing ancient opensolaris version to a recent freebsd version. most of the freebsd changes are pretty close to what netbsd needs, so that seems like a more useful upstream for us.  I have things working well enough now that I want to share the code in preparation for committing.
this update improves upon our existing dtrace/zfs code in several ways:
picks up all the upstream zfs fixes and enhancements from the last decade
zfs now supports mmap on netbsd, so you can run executables stored in zfs
dtrace fbt probes can now be used in kernel modules (such as zfs)
A patch is provided here: http://ftp.netbsd.org/pub/NetBSD/misc/chs/diff.cddl.20171012 which needs to be applied using “patch -E” as it adds and removes files.
He provides the following summary for the diff:
 freebsd's dtrace/zfs code as of r315983 (2017-03-26), adapted for netbsd.
a few updates to our copy of freebsd's libproc.
build system support for using -fno-omit-frame-pointer everywhere and disabling other compiler optimizations that confuse dtrace.
sample kernel config changes for a couple evbarm configs (the ones I tested).
module/ksyms enhancements for dtrace integration.
genfs API enhancements to support zfs.
an option to have mutexes not become no-ops during a panic.
uvm_aobj API change to support 64-bit aobj sizes (eg. for tmpfs).
Known issues with the patch include:
unloading the zfs module fails even with no zpools imported if you've done much with zfs since it was loaded. there's some refcounting problem that I haven't tracked down yet.
the module refcounting for active fbt probes is bogus. currently module refcounting is protected by kernconfig_lock(), but taking that lock down in the bowels of dtrace seems likely to create deadlocks.  I plan to do something fancier but haven't gotten to it yet.
the dtrace uregs[] stuff is probably still wrong.
the CTF typeid overflow problem is still there (more on this below).
Unsupported features include:
the ".zfs" virtual directory, eg. ".zfs/snapshot/foo@bar"
zvols
ZFS ACLs (aka. NFSv4 ACLs)
NFS exporting a ZFS file system
setting dtrace probes in application code
using ZFS as the root fs
new crypto hashes SHA512_256, skein, and edonr (the last one is not in freebsd yet either)
zio delay injection (used for testing zfs)
dtrace support for platforms other than x86 and arm
A more detailed description of the CTF typeid overflow is also provided. Check out the full thread with followups and try out the patch if you’re on NetBSD.
***
pfSense 2.4.0-RELEASE Now Available! (https://www.netgate.com/blog/pfsense-2-4-0-release-now-available.html)
Jim Pingle writes about the new release:
We are excited to announce the release of pfSense® software version 2.4, now available for new installations and upgrades!
pfSense software version 2.4.0 was a herculean effort! It is the culmination of 18 months of hard work by Netgate and community contributors, with over 290 items resolved. According to git, 671 files were changed with a total 1651680 lines added, and 185727 lines deleted. Most of those added lines are from translated strings for multiple language support!
+ Highlights
FreeBSD 11.1-RELEASE as the base Operating System
New pfSense installer based on bsdinstall, with support for ZFS, UEFI, and multiple types of partition layouts (e.g. GPT, BIOS)
Support for Netgate ARM devices such as the SG-1000
OpenVPN 2.4.x support, which brings features like AES-GCM ciphers, speed improvements, Negotiable Crypto Parameters (NCP), TLS encryption, and dual stack/multihome
Translation of the GUI into 13 different languages! For more information on contributing to the translation effort, read our previous blog post and visit the project on Zanata
WebGUI improvements, such as a new login page, improved GET/POST CSRF handling, significant improvements to the Dashboard and its AJAX handling
Certificate Management improvements including CSR signing and international character support
Captive Portal has been rewritten to work without multiple instances of ipfw
Important Information:
32-bit x86 and NanoBSD have been deprecated and are not supported on pfSense 2.4.
Read the full release notes and let them know how you like the new release. 
***
OpenBSD changes of note 629 (https://www.tedunangst.com/flak/post/openbsd-changes-of-note-629)
Use getrusage to measure CPU time in md5 benchmarking.
Add guard pages at the end of kernel stacks so overflows don’t run into important stuff.
This would be useful in FreeBSD, even just to detect the condition. I had all kinds of strange crashes when I was accidently overflowing the stack when working on the initial version of the ZSTD patches before ZSTD gained a working heap mode.
Add dwxe driver for ethernet found on Allwinner A64, H3 and H5 SoCs.
Fix a regression caused by removal of SIGIO from some devices.
In malloc, always delay freeing chunks and change ‘F’ option to perform a more extensive check for double free.
Change sendsyslog prototype to take a string, since there’s little point logging not strings.
The config program tries to modify zero initialized variables. Previous versions of gcc were patched to place these in the data segment, instead of the bss, but clang has no such patches. Long long ago, this was the default behavior for compilers, which is why gcc was patched to maintain that existing behavior, but now we want a slightly less unusual toolchain. Fix the underlying issue for now by annotating such variables with a data section attribute.
***
t2k17 Hackathon Report: Philip Guenther: locking and libc (https://undeadly.org/cgi?action=article;sid=20170824080132)
Next up in our series of t2k17 hackathon reports is this one from Philip Guenther:
I showed up at t2k17 with a couple hold-over diffs from e2k17 that weren't stable then and hadn't gotten much better since, so after a red-eye through Chicago I arrived in the hackroom, fired up my laptop and synced trees.
Meanwhile, people trickled in and the best part of hackathons, the conversations and "what do you think about this?" chats started. Theo introduced me to Todd Mortimer (mortimer@), who's been hacking on clang to implement RETGUARD for C programs. Over the hackathon we discussed a few loose ends that cropped up and what the correct behavior should be for them as well as the mechanics of avoiding 0xc3 bytes (the RET opcode) embedded in the middle of other multi-byte x86 machine code. Fun stuff.
Martin (mpi@) and I had a conversation about the desirability of being able to sleep while holding netlock and pretty much came down on "oof, the scheduler does need work before the underlying issue driving this question can be resolved enough to answer it". :-(
After some final hammering I got in an enhancement to pool(9) to let a pool use (sleeping) rwlocks instead of (spinning) mutexes and then immediately used that for the per-CPU pool cache pool as well as the futex pool. Further pools are likely to be converted as well kernel upper-level locking changes are made.
Speaking of, a larger diff I had been working on for said upper-level locking was still suffering deadlock issues so I took a stab at narrowing it down to just a lock for the process tree, mostly mirroring the FreeBSD proctreelock. That appears to be holding up much better and I just have some code arrangement issues around sysptrace() before that'll go out for final review.
Then most of the way through the week, Bob (beck@) vocally complained that life would be easier for libressl if we had some version of pthread_once() and the pthread mutex routines in libc. This would make some other stuff easier too (c.f. /usr/X11R6/lib/libpthread-stubs.*) and the TIB work over the last couple years has basically eliminated the runtime costs of doing so, so I spent most the rest of the hackathon finding the right place to draw a line through libpthread and move everything on the one side of the line into libc. That code seems pretty stable and the xenocara and ports people seem to like—or at least accept—the effects, so it will almost certainly go in with the next libc bump.
Lots of other random conversations, hacking, meals, and beer. Many thanks to Ken (krw@) and local conspirators for another excellent Toronto hackathon!
Beastie Bits
2017 NetBSD Foundation Officers (https://blog.netbsd.org/tnf/entry/2017_netbsd_foundation_officers)
New BSDMag is out - Military Grade Data Wiping in FreeBSD with BCWipe (https://bsdmag.org/download/military-grade-data-wiping-freebsd-bcwipe/)
LibertyBSD 6.1 released (http://libertybsd.net/)
***
Feedback/Questions
Eddy - EuroBSDCon 2017 video and some help (http://dpaste.com/3WDNV05#wrap)
Eric - ZFS monitoring (http://dpaste.com/2RP0S60#wrap)
Tom - BSD Hosting (http://dpaste.com/31DGH3J#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 10.4-RELEASE is here, more EuroBSDcon travel notes, the KRACK attack, ZFS and DTrace on NetBSD, and pfsense 2.4.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/10.4R/announce.html" rel="nofollow">FreeBSD 10.4-RELEASE Available</a></h3>

<ul>
<li>FreeBSD 10.4-RELEASE is out. The FreeBSD Project dedicates the FreeBSD 10.4-RELEASE to the memory of Andrey A. Chernov.</li>
<li>Some of the highlights:</li>
</ul>

<blockquote>
<p>10.4-RELEASE is the first FreeBSD release to feature full support for eMMC storage, including eMMC partitions, TRIM and bus speed modes up to HS400. Please note, though, that availability of especially the DDR52, HS200 and HS400 modes requires support in the actual sdhci(4) front-end as well as by the hardware used. Also note, that the SDHCI controller part of Intel® Apollo Lake chipsets is affected by several severe silicon bugs. Apparently, it depends on the particular Apollo Lake platform whether the workarounds in place so far are sufficient to avoid timeouts on attaching sdhci(4) there.<br>
Also in case a GPT disk label is used, the fsck_ffs(8) utility now is able to find alternate superblocks.<br>
The aesni(4) driver now no longer shares a single FPU context across multiple sessions in multiple threads, addressing problems seen when employing aesni(4) for accelerating ipsec(4).<br>
Support for the Kaby Lake generation of Intel® i219(4)/ i219(5) devices has been added to the em(4) driver.<br>
The em(4) driver is now capable of enabling Wake On LAN (WOL) also for Intel® i217, i218 and i219 chips. Note that stale interface configurations from previous unsuccessful attempts to enable WOL for these devices now will actually take effect. For example, an <code>ifconfig em0 wol</code> activates all WOL variants including wol_mcast, which might be undesirable.<br>
Support for WOL has been added to the igb(4) driver, which was not able to activate this feature on any device before. The same remark regarding stale WOL configurations as for the em(4) driver applies.<br>
Userland coredumps can now trigger events such as generating a human readable crash report via devd(8). This feature is off by default.<br>
The firmware shipping with the qlxgbe(4) driver has been updated to version 5.4.66. Additionally, this driver has received some TSO and locking fixes, performance optimizations as well as SYSCTLs providing MAC, RX and TX statistics.<br>
Mellanox® ConnectX-4 series adapters are now supported by the newly added mlx5ib(4) driver.<br>
OpenSSH received an update to version 7.3p1.<br>
GNOME has been updated to version 3.18.<br>
Xorg-Server has been updated to version 1.18.4.</p>
</blockquote>

<ul>
<li>Check out the full release notes and upgrade your systems to 10.4-RELEASE. Thanks to the FreeBSD Release Engineering Team for their efforts. 
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/eurobsdcon_2017_travel_notes_after" rel="nofollow">EuroBSDcon 2017: &quot;travel notes&quot; after the conference</a></h3>

<ul>
<li>Leonardo Taccari posted in the NetBSD blog about his experiences at EuroBSDcon 2017:</li>
</ul>

<blockquote>
<p>Let me tell you about my experience at EuroBSDcon 2017 in Paris, France. We will see what was presented during the NetBSD developer summit on Friday and then we will give a look to all of the NetBSD and pkgsrc presentations given during the conference session on Saturday and Sunday. Of course, a lot of fun also happened on the &quot;hall track&quot;, the several breaks during the conference and the dinners we had together with other *BSD developers and community! This is difficult to describe and I will try to just share some part of that with photographs that we have taken. I can just say that it was a really beautiful experience, I had a great time with others and, after coming back home... ...I miss all of that! :) So, if you have never been in any BSD conferences I strongly suggest you to go to the next ones, so please stay tuned via NetBSD Events. Being there this is probably the only way to understand these feelings!</p>
</blockquote>

<ul>
<li>Thursday (21/09): NetBSD developers dinner</li>
</ul>

<blockquote>
<p>Arriving in Paris via a night train from Italy I literally sleep-walked through Paris getting lost again and again. After getting in touch with other developers we had a dinner together and went sightseeing for a<sup>Wseveral</sup> beers!<br>
Friday (22/09): NetBSD developers summit<br>
On Friday morning we met for the NetBSD developers summit kindly hosted by Arolla.<br>
NetBSD on Google Compute Engine -- Benny Siegert (bsiegert)<br>
Scripting DDB with Forth -- Valery Ushakov (uwe)<br>
News from the version control front -- Jörg Sonnenberger (joerg)<br>
Afternoon discussions and dinner<br>
After the lunch we had several non-scheduled discussions, some time for hacking, etc.<br>
We then had a nice dinner together (it was in a restaurant with a very nice waiter who always shouted after every order or after accidentally dropping and crashing dishes!, yeah! That&#39;s probably a bit weird but I liked that attitude! :)) and then did some sightseeing and had a beer together.</p>
</blockquote>

<ul>
<li>Saturday (23/09): First day of conference session and Social Event</li>
</ul>

<blockquote>
<p>A Modern Replacement for BSD spell(1) -- Abhinav Upadhyay (abhinav)<br>
Portable Hotplugging: NetBSD&#39;s uvm_hotplug(9) API development -- Cherry G.<br>
Mathew (cherry)<br>
Hardening pkgsrc -- Pierre Pronchery (khorben)<br>
Reproducible builds on NetBSD -- Christos Zoulas (christos)</p>
</blockquote>

<ul>
<li>Social event</li>
</ul>

<blockquote>
<p>The social event on Saturday evening took place on a boat that cruised on the Seine river.<br>
It was a very nice and different way to sightsee Paris, eat and enjoy some drinks and socialize and discuss with other developers and community.</p>

<ul>
<li>Sunday (24/09): Second day of conference session
The school of hard knocks - PT1 -- Sevan Janiyan (sevan)
The LLDB Debugger on NetBSD -- Kamil Rytarowski (kamil)
What&#39;s in store for NetBSD 8.0? -- Alistair Crooks (agc)</li>
</ul>
</blockquote>

<ul>
<li>Sunday dinner</li>
</ul>

<blockquote>
<p>After the conference we did some sightseeing in Paris, had a dinner together and then enjoyed some beers!</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>It was a very nice weekend and conference. It is worth to mention that EuroBSDcon 2017 was the biggest BSD conference (more than 300 people attended it!).<br>
I would like to thank the entire EuroBSDcon organising committee (Baptiste Daroussin, Antoine Jacoutot, Jean-Sébastien Pédron and Jean-Yves Migeon), EuroBSDcon programme committee (Antoine Jacoutot, Lars Engels, Ollivier Robert, Sevan Janiyan, Jörg Sonnenberger, Jasper Lievisse Adriaanse and Janne Johansson) and EuroBSDcon Foundation for organizing such a wonderful conference!<br>
I also would like to thank the speakers for presenting very interesting talks, all developers and community that attended the NetBSD devsummit and conference, in particular Jean-Yves and Jörg, for organizing and moderating the devsummit and Arolla that kindly hosted us for the NetBSD devsummit!<br>
A special thanks also to Abhinav (abhinav) and Martin (martin) for photographs and locals Jean-Yves (jym) and Stoned (seb) for helping us in not get lost in Paris&#39; rues! :)</p>
</blockquote>

<ul>
<li>Thank you!
***</li>
</ul>

<h3><a href="https://www.krackattacks.com/" rel="nofollow">WiFi Vulnerability in WPA2: KRACK</a></h3>

<blockquote>
<p>We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.<br>
Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks. For more information about specific products, consult the database of CERT/CC, or contact your vendor.</p>
</blockquote>

<ul>
<li><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-17:07.wpa.asc" rel="nofollow">FreeBSD Advisory </a></li>
<li>As of the date of this recording, a few weeks ahead of when this episode will air, the issue is fixed in FreeBSD 11.0 and 11.1, and a workaround has been provided for 10.3 and 10.4 (install newer wpa_supplicant from ports). A fix for 10.3 and 10.4 is expected soon. They will more than likely be out by time you are watching this.</li>
<li>The fix for 10.3 and 10.4 is more complicated because the version of wpa_supplicant included in the base system is 2.0, from January 2013, so is nearly 5 years old, so the patches do not apply cleanly. The security team is still considering if it will try to patch 2.0, or just replace the version of wpa_supplicant with 2.5 from FreeBSD 11.x.</li>
<li>OpenBSD was unwilling to wait when the embargo was extended on this vulnerability and stealth fixed the issue on <a href="https://marc.info/?l=openbsd-cvs&m=150410571407760&w=2" rel="nofollow">Aug 30th</a></li>
<li><a href="https://mastodon.social/@stsp/98837563531323569" rel="nofollow">stsp@openbsd.org s Mastodon post</a></li>
<li><a href="https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbhnfz" rel="nofollow">Lobste.rs conversation about flaw and OpenBSDs reaction</a></li>
</ul>

<blockquote>
<p>What happened is that he told me on July 15, and gave a 6 weeks embargo until end of August. We already complained back then that this was way too long and leaving people exposed. Then he got CERT (and, thus, US gov agencies) involved and had to extend the embargo even further until today. At that point we already had the ball rolling and decided to stick to the original agreement with him, and he gave us an agreeing nod towards that as well.<br>
In this situation, a request for keeping the problem and fix secret is a request to leave our users at risk and exposed to insiders who will potentially use the bug to exploit our users. And we have no idea who the other insiders are. We have to assume that information of this kind leaks and dissipates pretty fast in the security community.<br>
We chose to serve the needs of our users who are the vulnerable people in this drama. I stand by that choice.</p>
</blockquote>

<ul>
<li>As a result of this:</li>
</ul>

<blockquote>
<p>To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.</p>
</blockquote>

<ul>
<li>NetBSD: <a href="http://mail-index.netbsd.org/source-changes/2017/10/16/msg088877.html" rel="nofollow">patches for the WPA issues in KRACK Attacks were committed Oct 16th to HEAD &amp; are pending pullup to 6/7/8 branches</a></li>
<li>As of this recording, Dragonfly appears to use wpa_supplicant 2.1 which they imported in 2014 and has <a href="https://github.com/DragonFlyBSD/DragonFlyBSD/commits/master/contrib/wpa_supplicant" rel="nofollow">not been touched in over a year</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/tech-kern/2017/10/13/msg022436.html" rel="nofollow">NetBSD - dtrace and ZFS update</a></h3>

<ul>
<li>Chuck Silvers writes to the tech-kern mailing list of NetBSD:</li>
</ul>

<blockquote>
<p>I&#39;ve been working on updating netbsd&#39;s copy of the dtrace and zfs code to rebase from the existing ancient opensolaris version to a recent freebsd version. most of the freebsd changes are pretty close to what netbsd needs, so that seems like a more useful upstream for us.  I have things working well enough now that I want to share the code in preparation for committing.</p>
</blockquote>

<ul>
<li>this update improves upon our existing dtrace/zfs code in several ways:</li>
</ul>

<blockquote>
<p>picks up all the upstream zfs fixes and enhancements from the last decade<br>
zfs now supports mmap on netbsd, so you can run executables stored in zfs<br>
dtrace fbt probes can now be used in kernel modules (such as zfs)</p>
</blockquote>

<ul>
<li>A patch is provided here: <a href="http://ftp.netbsd.org/pub/NetBSD/misc/chs/diff.cddl.20171012" rel="nofollow">http://ftp.netbsd.org/pub/NetBSD/misc/chs/diff.cddl.20171012</a> which needs to be applied using patch -E as it adds and removes files.</li>
<li>He provides the following summary for the diff:</li>
</ul>

<blockquote>
<p>freebsd&#39;s dtrace/zfs code as of r315983 (2017-03-26), adapted for netbsd.<br>
a few updates to our copy of freebsd&#39;s libproc.<br>
build system support for using -fno-omit-frame-pointer everywhere and disabling other compiler optimizations that confuse dtrace.<br>
sample kernel config changes for a couple evbarm configs (the ones I tested).<br>
module/ksyms enhancements for dtrace integration.<br>
genfs API enhancements to support zfs.<br>
an option to have mutexes not become no-ops during a panic.<br>
uvm_aobj API change to support 64-bit aobj sizes (eg. for tmpfs).</p>
</blockquote>

<ul>
<li>Known issues with the patch include:</li>
</ul>

<blockquote>
<p>unloading the zfs module fails even with no zpools imported if you&#39;ve done much with zfs since it was loaded. there&#39;s some refcounting problem that I haven&#39;t tracked down yet.<br>
the module refcounting for active fbt probes is bogus. currently module refcounting is protected by kernconfig_lock(), but taking that lock down in the bowels of dtrace seems likely to create deadlocks.  I plan to do something fancier but haven&#39;t gotten to it yet.<br>
the dtrace uregs[] stuff is probably still wrong.<br>
the CTF typeid overflow problem is still there (more on this below).</p>
</blockquote>

<ul>
<li>Unsupported features include:</li>
</ul>

<blockquote>
<p>the &quot;.zfs&quot; virtual directory, eg. &quot;.zfs/snapshot/foo@bar&quot;<br>
zvols<br>
ZFS ACLs (aka. NFSv4 ACLs)<br>
NFS exporting a ZFS file system<br>
setting dtrace probes in application code<br>
using ZFS as the root fs<br>
new crypto hashes SHA512_256, skein, and edonr (the last one is not in freebsd yet either)<br>
zio delay injection (used for testing zfs)<br>
dtrace support for platforms other than x86 and arm</p>
</blockquote>

<ul>
<li>A more detailed description of the CTF typeid overflow is also provided. Check out the full thread with followups and try out the patch if youre on NetBSD.
***</li>
</ul>

<h3><a href="https://www.netgate.com/blog/pfsense-2-4-0-release-now-available.html" rel="nofollow">pfSense 2.4.0-RELEASE Now Available!</a></h3>

<ul>
<li>Jim Pingle writes about the new release:</li>
</ul>

<blockquote>
<p>We are excited to announce the release of pfSense® software version 2.4, now available for new installations and upgrades!<br>
pfSense software version 2.4.0 was a herculean effort! It is the culmination of 18 months of hard work by Netgate and community contributors, with over 290 items resolved. According to git, 671 files were changed with a total 1651680 lines added, and 185727 lines deleted. Most of those added lines are from translated strings for multiple language support!</p>

<ul>
<li>Highlights</li>
</ul>

<p>FreeBSD 11.1-RELEASE as the base Operating System<br>
New pfSense installer based on bsdinstall, with support for ZFS, UEFI, and multiple types of partition layouts (e.g. GPT, BIOS)<br>
Support for Netgate ARM devices such as the SG-1000<br>
OpenVPN 2.4.x support, which brings features like AES-GCM ciphers, speed improvements, Negotiable Crypto Parameters (NCP), TLS encryption, and dual stack/multihome<br>
Translation of the GUI into 13 different languages! For more information on contributing to the translation effort, read our previous blog post and visit the project on Zanata<br>
WebGUI improvements, such as a new login page, improved GET/POST CSRF handling, significant improvements to the Dashboard and its AJAX handling<br>
Certificate Management improvements including CSR signing and international character support<br>
Captive Portal has been rewritten to work without multiple instances of ipfw</p>
</blockquote>

<ul>
<li>Important Information:</li>
</ul>

<blockquote>
<p>32-bit x86 and NanoBSD have been deprecated and are not supported on pfSense 2.4.</p>
</blockquote>

<ul>
<li>Read the full release notes and let them know how you like the new release. 
***</li>
</ul>

<h3><a href="https://www.tedunangst.com/flak/post/openbsd-changes-of-note-629" rel="nofollow">OpenBSD changes of note 629</a></h3>

<ul>
<li>Use getrusage to measure CPU time in md5 benchmarking.</li>
<li>Add guard pages at the end of kernel stacks so overflows dont run into important stuff.

<ul>
<li>This would be useful in FreeBSD, even just to detect the condition. I had all kinds of strange crashes when I was accidently overflowing the stack when working on the initial version of the ZSTD patches before ZSTD gained a working heap mode.</li>
</ul></li>
<li>Add dwxe driver for ethernet found on Allwinner A64, H3 and H5 SoCs.</li>
<li>Fix a regression caused by removal of SIGIO from some devices.</li>
<li>In malloc, always delay freeing chunks and change F option to perform a more extensive check for double free.</li>
<li>Change sendsyslog prototype to take a string, since theres little point logging not strings.</li>
<li>The config program tries to modify zero initialized variables. Previous versions of gcc were patched to place these in the data segment, instead of the bss, but clang has no such patches. Long long ago, this was the default behavior for compilers, which is why gcc was patched to maintain that existing behavior, but now we want a slightly less unusual toolchain. Fix the underlying issue for now by annotating such variables with a data section attribute.
***</li>
</ul>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20170824080132" rel="nofollow">t2k17 Hackathon Report: Philip Guenther: locking and libc</a></h3>

<ul>
<li>Next up in our series of t2k17 hackathon reports is this one from Philip Guenther:</li>
</ul>

<blockquote>
<p>I showed up at t2k17 with a couple hold-over diffs from e2k17 that weren&#39;t stable then and hadn&#39;t gotten much better since, so after a red-eye through Chicago I arrived in the hackroom, fired up my laptop and synced trees.<br>
Meanwhile, people trickled in and the best part of hackathons, the conversations and &quot;what do you think about this?&quot; chats started. Theo introduced me to Todd Mortimer (mortimer@), who&#39;s been hacking on clang to implement RETGUARD for C programs. Over the hackathon we discussed a few loose ends that cropped up and what the correct behavior should be for them as well as the mechanics of avoiding 0xc3 bytes (the RET opcode) embedded in the middle of other multi-byte x86 machine code. Fun stuff.<br>
Martin (mpi@) and I had a conversation about the desirability of being able to sleep while holding netlock and pretty much came down on &quot;oof, the scheduler does need work before the underlying issue driving this question can be resolved enough to answer it&quot;. :-(<br>
After some final hammering I got in an enhancement to pool(9) to let a pool use (sleeping) rwlocks instead of (spinning) mutexes and then immediately used that for the per-CPU pool cache pool as well as the futex pool. Further pools are likely to be converted as well kernel upper-level locking changes are made.<br>
Speaking of, a larger diff I had been working on for said upper-level locking was still suffering deadlock issues so I took a stab at narrowing it down to just a lock for the process tree, mostly mirroring the FreeBSD proctree_lock. That appears to be holding up much better and I just have some code arrangement issues around sys_ptrace() before that&#39;ll go out for final review.<br>
Then most of the way through the week, Bob (beck@) vocally complained that life would be easier for libressl if we had some version of pthread_once() and the pthread mutex routines in libc. This would make some other stuff easier too (c.f. /usr/X11R6/lib/libpthread-stubs.*) and the TIB work over the last couple years has basically eliminated the runtime costs of doing so, so I spent most the rest of the hackathon finding the right place to draw a line through libpthread and move everything on the one side of the line into libc. That code seems pretty stable and the xenocara and ports people seem to likeor at least acceptthe effects, so it will almost certainly go in with the next libc bump.<br>
Lots of other random conversations, hacking, meals, and beer. Many thanks to Ken (krw@) and local conspirators for another excellent Toronto hackathon!</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/2017_netbsd_foundation_officers" rel="nofollow">2017 NetBSD Foundation Officers</a></li>
<li><a href="https://bsdmag.org/download/military-grade-data-wiping-freebsd-bcwipe/" rel="nofollow">New BSDMag is out - Military Grade Data Wiping in FreeBSD with BCWipe</a></li>
<li><a href="http://libertybsd.net/" rel="nofollow">LibertyBSD 6.1 released</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Eddy - <a href="http://dpaste.com/3WDNV05#wrap" rel="nofollow">EuroBSDCon 2017 video and some help</a></li>
<li>Eric - <a href="http://dpaste.com/2RP0S60#wrap" rel="nofollow">ZFS monitoring</a></li>
<li>Tom - <a href="http://dpaste.com/31DGH3J#wrap" rel="nofollow">BSD Hosting</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 10.4-RELEASE is here, more EuroBSDcon travel notes, the KRACK attack, ZFS and DTrace on NetBSD, and pfsense 2.4.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/10.4R/announce.html" rel="nofollow">FreeBSD 10.4-RELEASE Available</a></h3>

<ul>
<li>FreeBSD 10.4-RELEASE is out. The FreeBSD Project dedicates the FreeBSD 10.4-RELEASE to the memory of Andrey A. Chernov.</li>
<li>Some of the highlights:</li>
</ul>

<blockquote>
<p>10.4-RELEASE is the first FreeBSD release to feature full support for eMMC storage, including eMMC partitions, TRIM and bus speed modes up to HS400. Please note, though, that availability of especially the DDR52, HS200 and HS400 modes requires support in the actual sdhci(4) front-end as well as by the hardware used. Also note, that the SDHCI controller part of Intel® Apollo Lake chipsets is affected by several severe silicon bugs. Apparently, it depends on the particular Apollo Lake platform whether the workarounds in place so far are sufficient to avoid timeouts on attaching sdhci(4) there.<br>
Also in case a GPT disk label is used, the fsck_ffs(8) utility now is able to find alternate superblocks.<br>
The aesni(4) driver now no longer shares a single FPU context across multiple sessions in multiple threads, addressing problems seen when employing aesni(4) for accelerating ipsec(4).<br>
Support for the Kaby Lake generation of Intel® i219(4)/ i219(5) devices has been added to the em(4) driver.<br>
The em(4) driver is now capable of enabling Wake On LAN (WOL) also for Intel® i217, i218 and i219 chips. Note that stale interface configurations from previous unsuccessful attempts to enable WOL for these devices now will actually take effect. For example, an <code>ifconfig em0 wol</code> activates all WOL variants including wol_mcast, which might be undesirable.<br>
Support for WOL has been added to the igb(4) driver, which was not able to activate this feature on any device before. The same remark regarding stale WOL configurations as for the em(4) driver applies.<br>
Userland coredumps can now trigger events such as generating a human readable crash report via devd(8). This feature is off by default.<br>
The firmware shipping with the qlxgbe(4) driver has been updated to version 5.4.66. Additionally, this driver has received some TSO and locking fixes, performance optimizations as well as SYSCTLs providing MAC, RX and TX statistics.<br>
Mellanox® ConnectX-4 series adapters are now supported by the newly added mlx5ib(4) driver.<br>
OpenSSH received an update to version 7.3p1.<br>
GNOME has been updated to version 3.18.<br>
Xorg-Server has been updated to version 1.18.4.</p>
</blockquote>

<ul>
<li>Check out the full release notes and upgrade your systems to 10.4-RELEASE. Thanks to the FreeBSD Release Engineering Team for their efforts. 
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/eurobsdcon_2017_travel_notes_after" rel="nofollow">EuroBSDcon 2017: &quot;travel notes&quot; after the conference</a></h3>

<ul>
<li>Leonardo Taccari posted in the NetBSD blog about his experiences at EuroBSDcon 2017:</li>
</ul>

<blockquote>
<p>Let me tell you about my experience at EuroBSDcon 2017 in Paris, France. We will see what was presented during the NetBSD developer summit on Friday and then we will give a look to all of the NetBSD and pkgsrc presentations given during the conference session on Saturday and Sunday. Of course, a lot of fun also happened on the &quot;hall track&quot;, the several breaks during the conference and the dinners we had together with other *BSD developers and community! This is difficult to describe and I will try to just share some part of that with photographs that we have taken. I can just say that it was a really beautiful experience, I had a great time with others and, after coming back home... ...I miss all of that! :) So, if you have never been in any BSD conferences I strongly suggest you to go to the next ones, so please stay tuned via NetBSD Events. Being there this is probably the only way to understand these feelings!</p>
</blockquote>

<ul>
<li>Thursday (21/09): NetBSD developers dinner</li>
</ul>

<blockquote>
<p>Arriving in Paris via a night train from Italy I literally sleep-walked through Paris getting lost again and again. After getting in touch with other developers we had a dinner together and went sightseeing for a<sup>Wseveral</sup> beers!<br>
Friday (22/09): NetBSD developers summit<br>
On Friday morning we met for the NetBSD developers summit kindly hosted by Arolla.<br>
NetBSD on Google Compute Engine -- Benny Siegert (bsiegert)<br>
Scripting DDB with Forth -- Valery Ushakov (uwe)<br>
News from the version control front -- Jörg Sonnenberger (joerg)<br>
Afternoon discussions and dinner<br>
After the lunch we had several non-scheduled discussions, some time for hacking, etc.<br>
We then had a nice dinner together (it was in a restaurant with a very nice waiter who always shouted after every order or after accidentally dropping and crashing dishes!, yeah! That&#39;s probably a bit weird but I liked that attitude! :)) and then did some sightseeing and had a beer together.</p>
</blockquote>

<ul>
<li>Saturday (23/09): First day of conference session and Social Event</li>
</ul>

<blockquote>
<p>A Modern Replacement for BSD spell(1) -- Abhinav Upadhyay (abhinav)<br>
Portable Hotplugging: NetBSD&#39;s uvm_hotplug(9) API development -- Cherry G.<br>
Mathew (cherry)<br>
Hardening pkgsrc -- Pierre Pronchery (khorben)<br>
Reproducible builds on NetBSD -- Christos Zoulas (christos)</p>
</blockquote>

<ul>
<li>Social event</li>
</ul>

<blockquote>
<p>The social event on Saturday evening took place on a boat that cruised on the Seine river.<br>
It was a very nice and different way to sightsee Paris, eat and enjoy some drinks and socialize and discuss with other developers and community.</p>

<ul>
<li>Sunday (24/09): Second day of conference session
The school of hard knocks - PT1 -- Sevan Janiyan (sevan)
The LLDB Debugger on NetBSD -- Kamil Rytarowski (kamil)
What&#39;s in store for NetBSD 8.0? -- Alistair Crooks (agc)</li>
</ul>
</blockquote>

<ul>
<li>Sunday dinner</li>
</ul>

<blockquote>
<p>After the conference we did some sightseeing in Paris, had a dinner together and then enjoyed some beers!</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>It was a very nice weekend and conference. It is worth to mention that EuroBSDcon 2017 was the biggest BSD conference (more than 300 people attended it!).<br>
I would like to thank the entire EuroBSDcon organising committee (Baptiste Daroussin, Antoine Jacoutot, Jean-Sébastien Pédron and Jean-Yves Migeon), EuroBSDcon programme committee (Antoine Jacoutot, Lars Engels, Ollivier Robert, Sevan Janiyan, Jörg Sonnenberger, Jasper Lievisse Adriaanse and Janne Johansson) and EuroBSDcon Foundation for organizing such a wonderful conference!<br>
I also would like to thank the speakers for presenting very interesting talks, all developers and community that attended the NetBSD devsummit and conference, in particular Jean-Yves and Jörg, for organizing and moderating the devsummit and Arolla that kindly hosted us for the NetBSD devsummit!<br>
A special thanks also to Abhinav (abhinav) and Martin (martin) for photographs and locals Jean-Yves (jym) and Stoned (seb) for helping us in not get lost in Paris&#39; rues! :)</p>
</blockquote>

<ul>
<li>Thank you!
***</li>
</ul>

<h3><a href="https://www.krackattacks.com/" rel="nofollow">WiFi Vulnerability in WPA2: KRACK</a></h3>

<blockquote>
<p>We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted. This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites.<br>
Note that if your device supports Wi-Fi, it is most likely affected. During our initial research, we discovered ourselves that Android, Linux, Apple, Windows, OpenBSD, MediaTek, Linksys, and others, are all affected by some variant of the attacks. For more information about specific products, consult the database of CERT/CC, or contact your vendor.</p>
</blockquote>

<ul>
<li><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-17:07.wpa.asc" rel="nofollow">FreeBSD Advisory </a></li>
<li>As of the date of this recording, a few weeks ahead of when this episode will air, the issue is fixed in FreeBSD 11.0 and 11.1, and a workaround has been provided for 10.3 and 10.4 (install newer wpa_supplicant from ports). A fix for 10.3 and 10.4 is expected soon. They will more than likely be out by time you are watching this.</li>
<li>The fix for 10.3 and 10.4 is more complicated because the version of wpa_supplicant included in the base system is 2.0, from January 2013, so is nearly 5 years old, so the patches do not apply cleanly. The security team is still considering if it will try to patch 2.0, or just replace the version of wpa_supplicant with 2.5 from FreeBSD 11.x.</li>
<li>OpenBSD was unwilling to wait when the embargo was extended on this vulnerability and stealth fixed the issue on <a href="https://marc.info/?l=openbsd-cvs&m=150410571407760&w=2" rel="nofollow">Aug 30th</a></li>
<li><a href="https://mastodon.social/@stsp/98837563531323569" rel="nofollow">stsp@openbsd.org s Mastodon post</a></li>
<li><a href="https://lobste.rs/s/dwzplh/krack_attacks_breaking_wpa2#c_pbhnfz" rel="nofollow">Lobste.rs conversation about flaw and OpenBSDs reaction</a></li>
</ul>

<blockquote>
<p>What happened is that he told me on July 15, and gave a 6 weeks embargo until end of August. We already complained back then that this was way too long and leaving people exposed. Then he got CERT (and, thus, US gov agencies) involved and had to extend the embargo even further until today. At that point we already had the ball rolling and decided to stick to the original agreement with him, and he gave us an agreeing nod towards that as well.<br>
In this situation, a request for keeping the problem and fix secret is a request to leave our users at risk and exposed to insiders who will potentially use the bug to exploit our users. And we have no idea who the other insiders are. We have to assume that information of this kind leaks and dissipates pretty fast in the security community.<br>
We chose to serve the needs of our users who are the vulnerable people in this drama. I stand by that choice.</p>
</blockquote>

<ul>
<li>As a result of this:</li>
</ul>

<blockquote>
<p>To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.</p>
</blockquote>

<ul>
<li>NetBSD: <a href="http://mail-index.netbsd.org/source-changes/2017/10/16/msg088877.html" rel="nofollow">patches for the WPA issues in KRACK Attacks were committed Oct 16th to HEAD &amp; are pending pullup to 6/7/8 branches</a></li>
<li>As of this recording, Dragonfly appears to use wpa_supplicant 2.1 which they imported in 2014 and has <a href="https://github.com/DragonFlyBSD/DragonFlyBSD/commits/master/contrib/wpa_supplicant" rel="nofollow">not been touched in over a year</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/tech-kern/2017/10/13/msg022436.html" rel="nofollow">NetBSD - dtrace and ZFS update</a></h3>

<ul>
<li>Chuck Silvers writes to the tech-kern mailing list of NetBSD:</li>
</ul>

<blockquote>
<p>I&#39;ve been working on updating netbsd&#39;s copy of the dtrace and zfs code to rebase from the existing ancient opensolaris version to a recent freebsd version. most of the freebsd changes are pretty close to what netbsd needs, so that seems like a more useful upstream for us.  I have things working well enough now that I want to share the code in preparation for committing.</p>
</blockquote>

<ul>
<li>this update improves upon our existing dtrace/zfs code in several ways:</li>
</ul>

<blockquote>
<p>picks up all the upstream zfs fixes and enhancements from the last decade<br>
zfs now supports mmap on netbsd, so you can run executables stored in zfs<br>
dtrace fbt probes can now be used in kernel modules (such as zfs)</p>
</blockquote>

<ul>
<li>A patch is provided here: <a href="http://ftp.netbsd.org/pub/NetBSD/misc/chs/diff.cddl.20171012" rel="nofollow">http://ftp.netbsd.org/pub/NetBSD/misc/chs/diff.cddl.20171012</a> which needs to be applied using patch -E as it adds and removes files.</li>
<li>He provides the following summary for the diff:</li>
</ul>

<blockquote>
<p>freebsd&#39;s dtrace/zfs code as of r315983 (2017-03-26), adapted for netbsd.<br>
a few updates to our copy of freebsd&#39;s libproc.<br>
build system support for using -fno-omit-frame-pointer everywhere and disabling other compiler optimizations that confuse dtrace.<br>
sample kernel config changes for a couple evbarm configs (the ones I tested).<br>
module/ksyms enhancements for dtrace integration.<br>
genfs API enhancements to support zfs.<br>
an option to have mutexes not become no-ops during a panic.<br>
uvm_aobj API change to support 64-bit aobj sizes (eg. for tmpfs).</p>
</blockquote>

<ul>
<li>Known issues with the patch include:</li>
</ul>

<blockquote>
<p>unloading the zfs module fails even with no zpools imported if you&#39;ve done much with zfs since it was loaded. there&#39;s some refcounting problem that I haven&#39;t tracked down yet.<br>
the module refcounting for active fbt probes is bogus. currently module refcounting is protected by kernconfig_lock(), but taking that lock down in the bowels of dtrace seems likely to create deadlocks.  I plan to do something fancier but haven&#39;t gotten to it yet.<br>
the dtrace uregs[] stuff is probably still wrong.<br>
the CTF typeid overflow problem is still there (more on this below).</p>
</blockquote>

<ul>
<li>Unsupported features include:</li>
</ul>

<blockquote>
<p>the &quot;.zfs&quot; virtual directory, eg. &quot;.zfs/snapshot/foo@bar&quot;<br>
zvols<br>
ZFS ACLs (aka. NFSv4 ACLs)<br>
NFS exporting a ZFS file system<br>
setting dtrace probes in application code<br>
using ZFS as the root fs<br>
new crypto hashes SHA512_256, skein, and edonr (the last one is not in freebsd yet either)<br>
zio delay injection (used for testing zfs)<br>
dtrace support for platforms other than x86 and arm</p>
</blockquote>

<ul>
<li>A more detailed description of the CTF typeid overflow is also provided. Check out the full thread with followups and try out the patch if youre on NetBSD.
***</li>
</ul>

<h3><a href="https://www.netgate.com/blog/pfsense-2-4-0-release-now-available.html" rel="nofollow">pfSense 2.4.0-RELEASE Now Available!</a></h3>

<ul>
<li>Jim Pingle writes about the new release:</li>
</ul>

<blockquote>
<p>We are excited to announce the release of pfSense® software version 2.4, now available for new installations and upgrades!<br>
pfSense software version 2.4.0 was a herculean effort! It is the culmination of 18 months of hard work by Netgate and community contributors, with over 290 items resolved. According to git, 671 files were changed with a total 1651680 lines added, and 185727 lines deleted. Most of those added lines are from translated strings for multiple language support!</p>

<ul>
<li>Highlights</li>
</ul>

<p>FreeBSD 11.1-RELEASE as the base Operating System<br>
New pfSense installer based on bsdinstall, with support for ZFS, UEFI, and multiple types of partition layouts (e.g. GPT, BIOS)<br>
Support for Netgate ARM devices such as the SG-1000<br>
OpenVPN 2.4.x support, which brings features like AES-GCM ciphers, speed improvements, Negotiable Crypto Parameters (NCP), TLS encryption, and dual stack/multihome<br>
Translation of the GUI into 13 different languages! For more information on contributing to the translation effort, read our previous blog post and visit the project on Zanata<br>
WebGUI improvements, such as a new login page, improved GET/POST CSRF handling, significant improvements to the Dashboard and its AJAX handling<br>
Certificate Management improvements including CSR signing and international character support<br>
Captive Portal has been rewritten to work without multiple instances of ipfw</p>
</blockquote>

<ul>
<li>Important Information:</li>
</ul>

<blockquote>
<p>32-bit x86 and NanoBSD have been deprecated and are not supported on pfSense 2.4.</p>
</blockquote>

<ul>
<li>Read the full release notes and let them know how you like the new release. 
***</li>
</ul>

<h3><a href="https://www.tedunangst.com/flak/post/openbsd-changes-of-note-629" rel="nofollow">OpenBSD changes of note 629</a></h3>

<ul>
<li>Use getrusage to measure CPU time in md5 benchmarking.</li>
<li>Add guard pages at the end of kernel stacks so overflows dont run into important stuff.

<ul>
<li>This would be useful in FreeBSD, even just to detect the condition. I had all kinds of strange crashes when I was accidently overflowing the stack when working on the initial version of the ZSTD patches before ZSTD gained a working heap mode.</li>
</ul></li>
<li>Add dwxe driver for ethernet found on Allwinner A64, H3 and H5 SoCs.</li>
<li>Fix a regression caused by removal of SIGIO from some devices.</li>
<li>In malloc, always delay freeing chunks and change F option to perform a more extensive check for double free.</li>
<li>Change sendsyslog prototype to take a string, since theres little point logging not strings.</li>
<li>The config program tries to modify zero initialized variables. Previous versions of gcc were patched to place these in the data segment, instead of the bss, but clang has no such patches. Long long ago, this was the default behavior for compilers, which is why gcc was patched to maintain that existing behavior, but now we want a slightly less unusual toolchain. Fix the underlying issue for now by annotating such variables with a data section attribute.
***</li>
</ul>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20170824080132" rel="nofollow">t2k17 Hackathon Report: Philip Guenther: locking and libc</a></h3>

<ul>
<li>Next up in our series of t2k17 hackathon reports is this one from Philip Guenther:</li>
</ul>

<blockquote>
<p>I showed up at t2k17 with a couple hold-over diffs from e2k17 that weren&#39;t stable then and hadn&#39;t gotten much better since, so after a red-eye through Chicago I arrived in the hackroom, fired up my laptop and synced trees.<br>
Meanwhile, people trickled in and the best part of hackathons, the conversations and &quot;what do you think about this?&quot; chats started. Theo introduced me to Todd Mortimer (mortimer@), who&#39;s been hacking on clang to implement RETGUARD for C programs. Over the hackathon we discussed a few loose ends that cropped up and what the correct behavior should be for them as well as the mechanics of avoiding 0xc3 bytes (the RET opcode) embedded in the middle of other multi-byte x86 machine code. Fun stuff.<br>
Martin (mpi@) and I had a conversation about the desirability of being able to sleep while holding netlock and pretty much came down on &quot;oof, the scheduler does need work before the underlying issue driving this question can be resolved enough to answer it&quot;. :-(<br>
After some final hammering I got in an enhancement to pool(9) to let a pool use (sleeping) rwlocks instead of (spinning) mutexes and then immediately used that for the per-CPU pool cache pool as well as the futex pool. Further pools are likely to be converted as well kernel upper-level locking changes are made.<br>
Speaking of, a larger diff I had been working on for said upper-level locking was still suffering deadlock issues so I took a stab at narrowing it down to just a lock for the process tree, mostly mirroring the FreeBSD proctree_lock. That appears to be holding up much better and I just have some code arrangement issues around sys_ptrace() before that&#39;ll go out for final review.<br>
Then most of the way through the week, Bob (beck@) vocally complained that life would be easier for libressl if we had some version of pthread_once() and the pthread mutex routines in libc. This would make some other stuff easier too (c.f. /usr/X11R6/lib/libpthread-stubs.*) and the TIB work over the last couple years has basically eliminated the runtime costs of doing so, so I spent most the rest of the hackathon finding the right place to draw a line through libpthread and move everything on the one side of the line into libc. That code seems pretty stable and the xenocara and ports people seem to likeor at least acceptthe effects, so it will almost certainly go in with the next libc bump.<br>
Lots of other random conversations, hacking, meals, and beer. Many thanks to Ken (krw@) and local conspirators for another excellent Toronto hackathon!</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.netbsd.org/tnf/entry/2017_netbsd_foundation_officers" rel="nofollow">2017 NetBSD Foundation Officers</a></li>
<li><a href="https://bsdmag.org/download/military-grade-data-wiping-freebsd-bcwipe/" rel="nofollow">New BSDMag is out - Military Grade Data Wiping in FreeBSD with BCWipe</a></li>
<li><a href="http://libertybsd.net/" rel="nofollow">LibertyBSD 6.1 released</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Eddy - <a href="http://dpaste.com/3WDNV05#wrap" rel="nofollow">EuroBSDCon 2017 video and some help</a></li>
<li>Eric - <a href="http://dpaste.com/2RP0S60#wrap" rel="nofollow">ZFS monitoring</a></li>
<li>Tom - <a href="http://dpaste.com/31DGH3J#wrap" rel="nofollow">BSD Hosting</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>217: Your questions, part II</title>
  <link>https://www.bsdnow.tv/217</link>
  <guid isPermaLink="false">88994206-f8e5-4c4f-a6c4-798f4bac15c3</guid>
  <pubDate>Wed, 25 Oct 2017 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/88994206-f8e5-4c4f-a6c4-798f4bac15c3.mp3" length="73969492" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>OpenBSD 6.2 is here, style arguments, a second round of viewer interview questions, how to set CPU affinity for FreeBSD jails, containers on FreeNAS &amp; more!
</itunes:subtitle>
  <itunes:duration>1:42:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>OpenBSD 6.2 is here, style arguments, a second round of viewer interview questions, how to set CPU affinity for FreeBSD jails, containers on FreeNAS &amp;amp; more!
Headlines
OpenBSD 6.2 Released (https://www.openbsd.org/62.html)
OpenBSD continues their six month release cadence with the release of 6.2, the 44th release
On a disappointing note, the song for 6.2 will not be released until December
Highlights:
Improved hardware support on modern platforms including ARM64/ARMv7 and octeon, while amd64 users will appreciate additional support for the Intel Kaby Lake video cards.
Network stack improvements include extensive SMPization improvements and a new FQ-CoDel queueing discipline, as well as enhanced WiFi support in general and improvements to iwn(4), iwm(4) and anthn(4) drivers.
Improvements in vmm(4)/vmd include VM migration, as well as various compatibility and performance improvements.
Security enhancements including a new freezero(3) function, further pledge(2)ing of base system programs and conversion of several daemons to the fork+exec model.
Trapsleds, KARL, and random linking for libcrypto and ld.so, dramatically increase security by making it harder to find helpful ROP gadgets, and by creating a unique order of objects per-boot.
A unique kernel is now created by the installer to boot from after install/upgrade. 
The base system compiler on the amd64 and i386 platforms has switched to clang(1).
New versions of OpenSSH, OpenSMTPd, LibreSSL and mandoc are also included.
The kernel no longer handles IPv6 Stateless Address Autoconfiguration (RFC 4862), allowing cleanup and simplification of the IPv6 network stack. 
Improved IPv6 checks for IPsec policies and made them consistent with IPv4.
Enabled the use of per-CPU caches in the network packet allocators.
Improved UTF-8 line editing support for ksh(1) Emacs and Vi input mode.
breaking change for nvme(4) users with GPT: If you are booting from an nvme(4) drive with a GPT disk layout, you are affected by an off-by-one in the driver with the consequence that the sector count in your partition table may be incorrect. The only way to fix this is to re-initialize the partition table. Backup your data to another disk before you upgrade. In the new bsd.rd, drop to a shell and re-initialize the GPT:
fdisk -iy -g -b 960 sdN
Why we argue: style (https://www.sandimetz.com/blog/2017/6/1/why-we-argue-style)
I've been thinking about why we argue about code, and how we might transform vehement differences of opinion into active forces for good.
My thoughts spring from a very specific context. Ten or twelve times a year I go to an arbitrary business and spend three or more days teaching a course in object-oriented design. I'm an outsider, but for a few days these business let me in on their secrets.
Here's what I've noticed. In some places, folks are generally happy. Programmers get along. They feel as if they are all "in this together." At businesses like this I spend most of my time actually teaching object-oriented design.
Other places, folks are surprisingly miserable. There's a lot of discord, and the programmers have devolved into competing "camps." In these situations the course rapidly morphs away from OO Design and into wide-ranging group discussions about how to resolve deeply embedded conflicts.
Tolstoy famously said that "Happy families are all alike; every unhappy family is unhappy in its own way." This is known as the Anna Karenina Principle, and describes situations in which success depends on meeting all of a number of criteria. The only way to be happy is to succeed at every one of them. Unhappiness, unfortunately, can be achieved by any combination of failure. Thus, all happy businesses are similar, but unhappy ones appear unique in their misery.
Today I'm interested in choices of syntax, i.e whether or not your shop has agreed upon and follows a style guide. If you're surprised that I'm starting with this apparently mundane issue, consider yourself lucky in your choice of workplace. If you're shaking your head in rueful agreement about the importance of this topic, I feel your pain.
I firmly believe that all of the code that I personally have to examine should come to me in a consistent format. Code is read many more times than it is written, which means that the ultimate cost of code is in its reading. It therefore follows that code should be optimized for readability, which in turn dictates that an application's code should all follow the same style.
This is why FreeBSD, and most other open source projects, have a preferred style. Some projects are less specific and less strict about it.
Most programmers agree with the prior paragraph, but here's where things begin to break down. As far as I'm concerned, my personal formatting style is clearly the best. However, I'm quite sure that you feel the same. It's easy for a group of programmers to agree that all code should follow a common style, but surprisingly difficult to get them to agree on just what that common style should be.
Avoid appointing a human "style cop", which just forces someone to be an increasingly ill-tempered nag. Instead, supply programmers with the information they need to remedy their own transgressions. By the time a pull request is submitted, mis-stylings should long since have been put right. Pull request conversations ought to be about what code does rather than how code looks.
What about old code? Ignore it. You don't have to re-style all existing code, just do better from this day forward. Defer updating old code until you touch it for other reasons. Following this strategy means that the code you most often work on will gradually take on a common style. It also means that some of your existing code might never get updated, but if you never look at it, who cares?
If you choose to re-style code that you otherwise have no need to touch, you're declaring that changing the look of this old code has more value to your business than delivering the next item on the backlog. The opportunity cost of making a purely aesthetic change includes losing the benefit of what you could have done instead. The rule-of-thumb is: Don't bother updating the styling of stable, existing code unless not doing so costs you money.
Most open source projects also avoid reformatting code just to change the style, because of the merge conflicts this will cause for downstream consumers
If you disagree with the style guide upon which your team agrees, you have only two honorable options:
First, you can obey the guide despite your aversion. As with me in the Elm story above, this act is likely to change your thinking so that over time you come to prefer the new style. It's possible that if you follow the guide you'll begin to like it.
Alternatively, you can decide you will not obey the style guide. Making this decision demands that you leave your current project and find some other project whose guide matches your preferred style. Go there and follow that one.
Notice that both of these choices have you following a guide. This part is not optional.
The moral of this story? It's more important for all code to be formatted the same than it is for any one of us to get our own way. Commit to agreeing upon and following a style guide. And if you find that your team cannot come to an agreement, step away from this problem and start a discussion about power.
There have been many arguments about style, and it can often be one of the first complaints of people new to any open source project
This article covers it fairly well from both sides, a) you should follow the style guide of the project you are contributing to, b) the project should review your actual code, then comment on the style after, and provide gentle guidance towards the right style, and avoid being “style cops”
***
Interview - The BSDNow Crew, Part II
News Roundup
Building FreeBSD for the Onion Omega 2 (https://github.com/sysadminmike/freebsd-onion-omega2-build)
I got my Onion Omega 2 devices in the mail quite a while ago, but I had never gotten around to trying to install FreeBSD on them. They are a different MIPS SoC than the Onion Omega 1, so it would not work out of the box at the time. Now, the SoC is supported!
This guide provides the steps to build an image for the Omega 2 using the freebsd-wifi-build infrastructure
First some config files are modified to make the image small enough for the Omega 2’s flash chip
The DTS (Device Tree Source) files are not yet included in FreeBSD, so they are fetched from github
Then the build for the ralink SoC is run, with the provided DTS file and the MT7628_FDT kernel config
Once the build is complete, you’ll have a tftp image file. Then that image is compressed, and bundled into a uboot image
Write the files to a USB stick, and plug it into the Omega’s dock
Turn it on while holding the reset button with console open
Press 1 to get into the command line.
You will need to reset the usb:
usb reset
Then load the kernel boot image:
fatload usb 0:1 0x80800000 kernel.MT7628_FDT.lzma.uImage
And boot it:
bootm 0x80800000
At this point FreeBSD should boot
Mount a userland, and you should end up in multi-user mode
Hopefully this will get even easier in the next few weeks, and we’ll end up with a more streamlined process to tftp boot the device, then write FreeBSD into the onboard flash so it boots automatically.
***
Setting the CPU Affinity on FreeBSD Jails with ezjail (https://www.neelc.org/setting-the-cpu-affinity-on-freebsd-jails-with-ezjail/)
While there are more advanced resource controls available for FreeBSD jails, one of the most basic ways to control CPU usage is to limit the subset of CPUs that each jail can use. This can make sure that every jail has access to some dedicated resources, while at the same time doesn’t have the ability to entirely dominate the machine
I just got a new home server: a HP ProLiant ML110 G6. Being a FreeBSD person myself, it was natural that I used it on my server instead of Linux
I chose to use ezjail to manage the jails on my ProLiant, with the initial one being a Tor middle node. Despite the fact that where my ML110 is, the upstream is only 35mbps (which is pretty good for cable), I did not want to give my Tor jail access to all four cores.
Setting the CPU Affinity would let you choose a specific CPU core (or a range of cores) you want to use. However, it does not just let you pick the number of CPU cores you want and make FreeBSD choose the core running your jail. Going forward, I assumed that you have already created a jail using ezjail-admin. I also do not cover limiting a jail to a certain percentage of CPU usage.
ezjail-admin config -c [CORENUMBERFIRST]-[CORENUMBERLAST] [JAIL_NAME]
or
ezjail-admin config -c [CORENUMBERFIRST],[CORENUMBERSECOND],...,[CORENUMBERN] [JAILNAME]
And hopefully, you should have your ezjail-managed FreeBSD jail limited to the CPU cores you want. While I did not cover a CPU percentage or RAM usage, this can be done with rctl
I'll admit: it doesn't really matter which CPU a jail runs on, but it might matter if you don't want a jail to have access to all the CPU cores available and only want [JAILNAME] to use one core. Since it's not really possible just specify the number of CPU cores with ezjail (or even iocell), a fallback would be to use CPU affinity, and that requires you to specify an exact CPU core. I know it's not the best solution (it would be better if we could let the scheduler choose provided a jail only runs on one core), but it's what works.
We use this at work on high core count machines. When we have multiple databases colocated on the same machine, we make sure each one has a few cores to itself, while it shares other cores with the rest of the machine. We often reserve a core or two for the base system as well.
***
A practical guide to containers on FreeNAS for a depraved psychopath. (https://medium.com/@andoriyu/a-practical-guide-to-containers-on-freenas-for-a-depraved-psychopath-c212203c0394)
If you are interested in playing with Docker, this guide sets up a Linux VM running on FreeBSD or FreeNAS under bhyve, then runs linux docker containers on top of it
You know that jails are dope and I know that jails are dope, yet no one else knows it. So here we are stuck with docker. Two years ago I would be the last person to recommend using docker, but a whole lot of things has changes past years…
This tutorial uses iohyve to manage the VMs on the FreeBSD or FreeNAS
There are many Linux variants you can choose from — RancherOS, CoreOS are the most popular for docker-only hosts. We going to use RancherOS because it’s more lightweight out of the box.
Navigate to RancherOS website and grab link to latest version
sudo iohyve setup pool=zpool kmod=1 net=em0
sudo iohyve fetch https://releases.rancher.com/os/latest/rancheros.iso
sudo iohyve renameiso rancheros.iso rancheros-v1.0.4.iso
sudo pkg install grub2-bhyve
sudo iohyve create rancher 32G
sudo iohyve set rancher loader=grub-bhyve ram=8G cpu=8 con=nmdm0 os=debian
sudo iohyve install rancher rancheros-v1.0.4.iso
sudo iohyve console rancher
Then the tutorial does some basic configuration of RancherOS, and some house keeping in iohyve to make RancherOS come up unattended at boot
The whole point of this guide is to reduce pain, and using the docker CLI is still painful. There are a lot of Web UIs to control docker. Most of them include a lot of orchestrating services, so it’s just overkill. Portainer is very lightweight and can be run even on Raspberry Pi
Create a config file as described
After reboot you will be able to access WebUI on 9000 port. Setup is very easy, so I won’t go over it
The docker tools for FreeBSD are still being worked on. Eventually you will be able to host native FreeBSD docker containers on FreeBSD jails, but we are not quite there yet
In the meantime, you can install sysutils/docker and use it to manage the docker instances running on a remote machine, or in this case, the RancherOS VM running in bhyve
***
Beastie Bits
The Ghost of Invention: A Visit to Bell Labs, excerpt from the forthcoming book: “Kitten Clone: Inside Alcatel-Lucent”  (https://www.wired.com/2014/09/coupland-bell-labs/)
OpenBSD Cookbook (set of Ansible playbooks) (https://github.com/ligurio/openbsd-cookbooks)
15 useful sockstat commands to find open ports on FreeBSD  (https://www.tecmint.com/sockstat-command-examples-to-find-open-ports-in-freebsd/)
A prehistory of Slashdot (https://medium.freecodecamp.org/a-pre-history-of-slashdot-6403341dabae)
Using ed, the unix line editor  (https://medium.com/@claudio.santos.ribeiro/using-ed-the-unix-line-editor-557ed6466660)
***
Feedback/Questions
Malcolm - ZFS snapshots (http://dpaste.com/16EB3ZA#wrap)
Darryn - Zones (http://dpaste.com/1DGHQJP#wrap)
Mohammad - SSH Keys (http://dpaste.com/08G3VTB#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>OpenBSD 6.2 is here, style arguments, a second round of viewer interview questions, how to set CPU affinity for FreeBSD jails, containers on FreeNAS &amp; more!</p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/62.html" rel="nofollow">OpenBSD 6.2 Released</a></h3>

<ul>
<li>OpenBSD continues their six month release cadence with the release of 6.2, the 44th release</li>
<li>On a disappointing note, the song for 6.2 will not be released until December</li>
<li>Highlights:</li>
</ul>

<blockquote>
<p>Improved hardware support on modern platforms including ARM64/ARMv7 and octeon, while amd64 users will appreciate additional support for the Intel Kaby Lake video cards.<br>
Network stack improvements include extensive SMPization improvements and a new FQ-CoDel queueing discipline, as well as enhanced WiFi support in general and improvements to iwn(4), iwm(4) and anthn(4) drivers.<br>
Improvements in vmm(4)/vmd include VM migration, as well as various compatibility and performance improvements.<br>
Security enhancements including a new freezero(3) function, further pledge(2)ing of base system programs and conversion of several daemons to the fork+exec model.<br>
Trapsleds, KARL, and random linking for libcrypto and ld.so, dramatically increase security by making it harder to find helpful ROP gadgets, and by creating a unique order of objects per-boot.<br>
A unique kernel is now created by the installer to boot from after install/upgrade. <br>
The base system compiler on the amd64 and i386 platforms has switched to clang(1).<br>
New versions of OpenSSH, OpenSMTPd, LibreSSL and mandoc are also included.<br>
The kernel no longer handles IPv6 Stateless Address Autoconfiguration (RFC 4862), allowing cleanup and simplification of the IPv6 network stack. <br>
Improved IPv6 checks for IPsec policies and made them consistent with IPv4.<br>
Enabled the use of per-CPU caches in the network packet allocators.<br>
Improved UTF-8 line editing support for ksh(1) Emacs and Vi input mode.<br>
<em>breaking change for nvme(4) users with GPT</em>: If you are booting from an nvme(4) drive with a GPT disk layout, you are affected by an off-by-one in the driver with the consequence that the sector count in your partition table may be incorrect. The only way to fix this is to re-initialize the partition table. Backup your data to another disk before you upgrade. In the new bsd.rd, drop to a shell and re-initialize the GPT:<br>
<strong>fdisk -iy -g -b 960 sdN</strong></p>

<hr>
</blockquote>

<h3><a href="https://www.sandimetz.com/blog/2017/6/1/why-we-argue-style" rel="nofollow">Why we argue: style</a></h3>

<blockquote>
<p>I&#39;ve been thinking about why we argue about code, and how we might transform vehement differences of opinion into active forces for good.<br>
My thoughts spring from a very specific context. Ten or twelve times a year I go to an arbitrary business and spend three or more days teaching a course in object-oriented design. I&#39;m an outsider, but for a few days these business let me in on their secrets.<br>
Here&#39;s what I&#39;ve noticed. In some places, folks are generally happy. Programmers get along. They feel as if they are all &quot;in this together.&quot; At businesses like this I spend most of my time actually teaching object-oriented design.<br>
Other places, folks are surprisingly miserable. There&#39;s a lot of discord, and the programmers have devolved into competing &quot;camps.&quot; In these situations the course rapidly morphs away from OO Design and into wide-ranging group discussions about how to resolve deeply embedded conflicts.<br>
Tolstoy famously said that &quot;Happy families are all alike; every unhappy family is unhappy in its own way.&quot; This is known as the Anna Karenina Principle, and describes situations in which success depends on meeting all of a number of criteria. The only way to be happy is to succeed at every one of them. Unhappiness, unfortunately, can be achieved by any combination of failure. Thus, all happy businesses are similar, but unhappy ones appear unique in their misery.<br>
Today I&#39;m interested in choices of syntax, i.e whether or not your shop has agreed upon and follows a style guide. If you&#39;re surprised that I&#39;m starting with this apparently mundane issue, consider yourself lucky in your choice of workplace. If you&#39;re shaking your head in rueful agreement about the importance of this topic, I feel your pain.<br>
I firmly believe that all of the code that I personally have to examine should come to me in a consistent format. Code is read many more times than it is written, which means that the ultimate cost of code is in its reading. It therefore follows that code should be optimized for readability, which in turn dictates that an application&#39;s code should all follow the same style.</p>
</blockquote>

<ul>
<li>This is why FreeBSD, and most other open source projects, have a preferred style. Some projects are less specific and less strict about it.</li>
</ul>

<blockquote>
<p>Most programmers agree with the prior paragraph, but here&#39;s where things begin to break down. As far as I&#39;m concerned, my personal formatting style is clearly the best. However, I&#39;m quite sure that you feel the same. It&#39;s easy for a group of programmers to agree that all code should follow a common style, but surprisingly difficult to get them to agree on just what that common style should be.<br>
Avoid appointing a human &quot;style cop&quot;, which just forces someone to be an increasingly ill-tempered nag. Instead, supply programmers with the information they need to remedy their own transgressions. By the time a pull request is submitted, mis-stylings should long since have been put right. Pull request conversations ought to be about what code does rather than how code looks.<br>
What about old code? Ignore it. You don&#39;t have to re-style all existing code, just do better from this day forward. Defer updating old code until you touch it for other reasons. Following this strategy means that the code you most often work on will gradually take on a common style. It also means that some of your existing code might never get updated, but if you never look at it, who cares?<br>
If you choose to re-style code that you otherwise have no need to touch, you&#39;re declaring that changing the look of this old code has more value to your business than delivering the next item on the backlog. The opportunity cost of making a purely aesthetic change includes losing the benefit of what you could have done instead. The rule-of-thumb is: Don&#39;t bother updating the styling of stable, existing code unless not doing so costs you money.</p>
</blockquote>

<ul>
<li>Most open source projects also avoid reformatting code just to change the style, because of the merge conflicts this will cause for downstream consumers</li>
</ul>

<blockquote>
<p>If you disagree with the style guide upon which your team agrees, you have only two honorable options:<br>
First, you can obey the guide despite your aversion. As with me in the Elm story above, this act is likely to change your thinking so that over time you come to prefer the new style. It&#39;s possible that if you follow the guide you&#39;ll begin to like it.<br>
Alternatively, you can decide you will not obey the style guide. Making this decision demands that you leave your current project and find some other project whose guide matches your preferred style. Go there and follow that one.<br>
Notice that both of these choices have you following a guide. This part is not optional.<br>
The moral of this story? It&#39;s more important for all code to be formatted the same than it is for any one of us to get our own way. Commit to agreeing upon and following a style guide. And if you find that your team cannot come to an agreement, step away from this problem and start a discussion about power.</p>
</blockquote>

<ul>
<li>There have been many arguments about style, and it can often be one of the first complaints of people new to any open source project</li>
<li>This article covers it fairly well from both sides, a) you should follow the style guide of the project you are contributing to, b) the project should review your actual code, then comment on the style after, and provide gentle guidance towards the right style, and avoid being “style cops”
***</li>
</ul>

<h2>Interview - The BSDNow Crew, Part II</h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/sysadminmike/freebsd-onion-omega2-build" rel="nofollow">Building FreeBSD for the Onion Omega 2</a></h3>

<ul>
<li>I got my Onion Omega 2 devices in the mail quite a while ago, but I had never gotten around to trying to install FreeBSD on them. They are a different MIPS SoC than the Onion Omega 1, so it would not work out of the box at the time. Now, the SoC is supported!</li>
<li>This guide provides the steps to build an image for the Omega 2 using the freebsd-wifi-build infrastructure</li>
<li>First some config files are modified to make the image small enough for the Omega 2’s flash chip</li>
<li>The DTS (Device Tree Source) files are not yet included in FreeBSD, so they are fetched from github</li>
<li>Then the build for the ralink SoC is run, with the provided DTS file and the MT7628_FDT kernel config</li>
<li>Once the build is complete, you’ll have a tftp image file. Then that image is compressed, and bundled into a uboot image</li>
<li>Write the files to a USB stick, and plug it into the Omega’s dock</li>
<li>Turn it on while holding the reset button with console open</li>
</ul>

<blockquote>
<p>Press 1 to get into the command line.</p>
</blockquote>

<ul>
<li>You will need to reset the usb:</li>
</ul>

<blockquote>
<p>usb reset</p>
</blockquote>

<ul>
<li>Then load the kernel boot image:</li>
</ul>

<blockquote>
<p>fatload usb 0:1 0x80800000 kernel.MT7628_FDT.lzma.uImage</p>
</blockquote>

<ul>
<li>And boot it:</li>
</ul>

<blockquote>
<p>bootm 0x80800000</p>
</blockquote>

<ul>
<li>At this point FreeBSD should boot</li>
<li>Mount a userland, and you should end up in multi-user mode</li>
<li>Hopefully this will get even easier in the next few weeks, and we’ll end up with a more streamlined process to tftp boot the device, then write FreeBSD into the onboard flash so it boots automatically.
***</li>
</ul>

<h3><a href="https://www.neelc.org/setting-the-cpu-affinity-on-freebsd-jails-with-ezjail/" rel="nofollow">Setting the CPU Affinity on FreeBSD Jails with ezjail</a></h3>

<ul>
<li>While there are more advanced resource controls available for FreeBSD jails, one of the most basic ways to control CPU usage is to limit the subset of CPUs that each jail can use. This can make sure that every jail has access to some dedicated resources, while at the same time doesn’t have the ability to entirely dominate the machine</li>
</ul>

<blockquote>
<p>I just got a new home server: a HP ProLiant ML110 G6. Being a FreeBSD person myself, it was natural that I used it on my server instead of Linux<br>
I chose to use ezjail to manage the jails on my ProLiant, with the initial one being a Tor middle node. Despite the fact that where my ML110 is, the upstream is only 35mbps (which is pretty good for cable), I did not want to give my Tor jail access to all four cores.<br>
Setting the CPU Affinity would let you choose a specific CPU core (or a range of cores) you want to use. However, it does not just let you pick the number of CPU cores you want and make FreeBSD choose the core running your jail. Going forward, I assumed that you have already created a jail using ezjail-admin. I also do not cover limiting a jail to a certain percentage of CPU usage.<br>
ezjail-admin config -c [CORE_NUMBER_FIRST]-[CORE_NUMBER_LAST] [JAIL_NAME]</p>
</blockquote>

<ul>
<li>or</li>
</ul>

<blockquote>
<p>ezjail-admin config -c [CORE_NUMBER_FIRST],[CORE_NUMBER_SECOND],...,[CORE_NUMBER_N] [JAIL_NAME]<br>
And hopefully, you should have your ezjail-managed FreeBSD jail limited to the CPU cores you want. While I did not cover a CPU percentage or RAM usage, this can be done with rctl<br>
I&#39;ll admit: it doesn&#39;t really matter which CPU a jail runs on, but it might matter if you don&#39;t want a jail to have access to all the CPU cores available and only want [JAIL_NAME] to use one core. Since it&#39;s not really possible just specify the number of CPU cores with ezjail (or even iocell), a fallback would be to use CPU affinity, and that requires you to specify an exact CPU core. I know it&#39;s not the best solution (it would be better if we could let the scheduler choose provided a jail only runs on one core), but it&#39;s what works.</p>
</blockquote>

<ul>
<li>We use this at work on high core count machines. When we have multiple databases colocated on the same machine, we make sure each one has a few cores to itself, while it shares other cores with the rest of the machine. We often reserve a core or two for the base system as well.
***</li>
</ul>

<h3><a href="https://medium.com/@andoriyu/a-practical-guide-to-containers-on-freenas-for-a-depraved-psychopath-c212203c0394" rel="nofollow">A practical guide to containers on FreeNAS for a depraved psychopath.</a></h3>

<ul>
<li>If you are interested in playing with Docker, this guide sets up a Linux VM running on FreeBSD or FreeNAS under bhyve, then runs linux docker containers on top of it</li>
</ul>

<blockquote>
<p>You know that jails are dope and I know that jails are dope, yet no one else knows it. So here we are stuck with docker. Two years ago I would be the last person to recommend using docker, but a whole lot of things has changes past years…</p>
</blockquote>

<ul>
<li>This tutorial uses iohyve to manage the VMs on the FreeBSD or FreeNAS</li>
</ul>

<blockquote>
<p>There are many Linux variants you can choose from — RancherOS, CoreOS are the most popular for docker-only hosts. We going to use RancherOS because it’s more lightweight out of the box.</p>
</blockquote>

<ul>
<li>Navigate to RancherOS website and grab link to latest version</li>
</ul>

<blockquote>
<p>sudo iohyve setup pool=zpool kmod=1 net=em0<br>
sudo iohyve fetch <a href="https://releases.rancher.com/os/latest/rancheros.iso" rel="nofollow">https://releases.rancher.com/os/latest/rancheros.iso</a><br>
sudo iohyve renameiso rancheros.iso rancheros-v1.0.4.iso<br>
sudo pkg install grub2-bhyve<br>
sudo iohyve create rancher 32G<br>
sudo iohyve set rancher loader=grub-bhyve ram=8G cpu=8 con=nmdm0 os=debian<br>
sudo iohyve install rancher rancheros-v1.0.4.iso<br>
sudo iohyve console rancher</p>
</blockquote>

<ul>
<li>Then the tutorial does some basic configuration of RancherOS, and some house keeping in iohyve to make RancherOS come up unattended at boot</li>
</ul>

<blockquote>
<p>The whole point of this guide is to reduce pain, and using the docker CLI is still painful. There are a lot of Web UIs to control docker. Most of them include a lot of orchestrating services, so it’s just overkill. Portainer is very lightweight and can be run even on Raspberry Pi</p>
</blockquote>

<ul>
<li>Create a config file as described</li>
</ul>

<blockquote>
<p>After reboot you will be able to access WebUI on 9000 port. Setup is very easy, so I won’t go over it</p>
</blockquote>

<ul>
<li>The docker tools for FreeBSD are still being worked on. Eventually you will be able to host native FreeBSD docker containers on FreeBSD jails, but we are not quite there yet</li>
<li>In the meantime, you can install sysutils/docker and use it to manage the docker instances running on a remote machine, or in this case, the RancherOS VM running in bhyve
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.wired.com/2014/09/coupland-bell-labs/" rel="nofollow">The Ghost of Invention: A Visit to Bell Labs, excerpt from the forthcoming book: “Kitten Clone: Inside Alcatel-Lucent” </a></li>
<li><a href="https://github.com/ligurio/openbsd-cookbooks" rel="nofollow">OpenBSD Cookbook (set of Ansible playbooks)</a></li>
<li><a href="https://www.tecmint.com/sockstat-command-examples-to-find-open-ports-in-freebsd/" rel="nofollow">15 useful sockstat commands to find open ports on FreeBSD </a></li>
<li><a href="https://medium.freecodecamp.org/a-pre-history-of-slashdot-6403341dabae" rel="nofollow">A prehistory of Slashdot</a></li>
<li><a href="https://medium.com/@claudio.santos.ribeiro/using-ed-the-unix-line-editor-557ed6466660" rel="nofollow">Using ed, the unix line editor </a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Malcolm - <a href="http://dpaste.com/16EB3ZA#wrap" rel="nofollow">ZFS snapshots</a></li>
<li>Darryn - <a href="http://dpaste.com/1DGHQJP#wrap" rel="nofollow">Zones</a></li>
<li><p>Mohammad - <a href="http://dpaste.com/08G3VTB#wrap" rel="nofollow">SSH Keys</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>OpenBSD 6.2 is here, style arguments, a second round of viewer interview questions, how to set CPU affinity for FreeBSD jails, containers on FreeNAS &amp; more!</p>

<h2>Headlines</h2>

<h3><a href="https://www.openbsd.org/62.html" rel="nofollow">OpenBSD 6.2 Released</a></h3>

<ul>
<li>OpenBSD continues their six month release cadence with the release of 6.2, the 44th release</li>
<li>On a disappointing note, the song for 6.2 will not be released until December</li>
<li>Highlights:</li>
</ul>

<blockquote>
<p>Improved hardware support on modern platforms including ARM64/ARMv7 and octeon, while amd64 users will appreciate additional support for the Intel Kaby Lake video cards.<br>
Network stack improvements include extensive SMPization improvements and a new FQ-CoDel queueing discipline, as well as enhanced WiFi support in general and improvements to iwn(4), iwm(4) and anthn(4) drivers.<br>
Improvements in vmm(4)/vmd include VM migration, as well as various compatibility and performance improvements.<br>
Security enhancements including a new freezero(3) function, further pledge(2)ing of base system programs and conversion of several daemons to the fork+exec model.<br>
Trapsleds, KARL, and random linking for libcrypto and ld.so, dramatically increase security by making it harder to find helpful ROP gadgets, and by creating a unique order of objects per-boot.<br>
A unique kernel is now created by the installer to boot from after install/upgrade. <br>
The base system compiler on the amd64 and i386 platforms has switched to clang(1).<br>
New versions of OpenSSH, OpenSMTPd, LibreSSL and mandoc are also included.<br>
The kernel no longer handles IPv6 Stateless Address Autoconfiguration (RFC 4862), allowing cleanup and simplification of the IPv6 network stack. <br>
Improved IPv6 checks for IPsec policies and made them consistent with IPv4.<br>
Enabled the use of per-CPU caches in the network packet allocators.<br>
Improved UTF-8 line editing support for ksh(1) Emacs and Vi input mode.<br>
<em>breaking change for nvme(4) users with GPT</em>: If you are booting from an nvme(4) drive with a GPT disk layout, you are affected by an off-by-one in the driver with the consequence that the sector count in your partition table may be incorrect. The only way to fix this is to re-initialize the partition table. Backup your data to another disk before you upgrade. In the new bsd.rd, drop to a shell and re-initialize the GPT:<br>
<strong>fdisk -iy -g -b 960 sdN</strong></p>

<hr>
</blockquote>

<h3><a href="https://www.sandimetz.com/blog/2017/6/1/why-we-argue-style" rel="nofollow">Why we argue: style</a></h3>

<blockquote>
<p>I&#39;ve been thinking about why we argue about code, and how we might transform vehement differences of opinion into active forces for good.<br>
My thoughts spring from a very specific context. Ten or twelve times a year I go to an arbitrary business and spend three or more days teaching a course in object-oriented design. I&#39;m an outsider, but for a few days these business let me in on their secrets.<br>
Here&#39;s what I&#39;ve noticed. In some places, folks are generally happy. Programmers get along. They feel as if they are all &quot;in this together.&quot; At businesses like this I spend most of my time actually teaching object-oriented design.<br>
Other places, folks are surprisingly miserable. There&#39;s a lot of discord, and the programmers have devolved into competing &quot;camps.&quot; In these situations the course rapidly morphs away from OO Design and into wide-ranging group discussions about how to resolve deeply embedded conflicts.<br>
Tolstoy famously said that &quot;Happy families are all alike; every unhappy family is unhappy in its own way.&quot; This is known as the Anna Karenina Principle, and describes situations in which success depends on meeting all of a number of criteria. The only way to be happy is to succeed at every one of them. Unhappiness, unfortunately, can be achieved by any combination of failure. Thus, all happy businesses are similar, but unhappy ones appear unique in their misery.<br>
Today I&#39;m interested in choices of syntax, i.e whether or not your shop has agreed upon and follows a style guide. If you&#39;re surprised that I&#39;m starting with this apparently mundane issue, consider yourself lucky in your choice of workplace. If you&#39;re shaking your head in rueful agreement about the importance of this topic, I feel your pain.<br>
I firmly believe that all of the code that I personally have to examine should come to me in a consistent format. Code is read many more times than it is written, which means that the ultimate cost of code is in its reading. It therefore follows that code should be optimized for readability, which in turn dictates that an application&#39;s code should all follow the same style.</p>
</blockquote>

<ul>
<li>This is why FreeBSD, and most other open source projects, have a preferred style. Some projects are less specific and less strict about it.</li>
</ul>

<blockquote>
<p>Most programmers agree with the prior paragraph, but here&#39;s where things begin to break down. As far as I&#39;m concerned, my personal formatting style is clearly the best. However, I&#39;m quite sure that you feel the same. It&#39;s easy for a group of programmers to agree that all code should follow a common style, but surprisingly difficult to get them to agree on just what that common style should be.<br>
Avoid appointing a human &quot;style cop&quot;, which just forces someone to be an increasingly ill-tempered nag. Instead, supply programmers with the information they need to remedy their own transgressions. By the time a pull request is submitted, mis-stylings should long since have been put right. Pull request conversations ought to be about what code does rather than how code looks.<br>
What about old code? Ignore it. You don&#39;t have to re-style all existing code, just do better from this day forward. Defer updating old code until you touch it for other reasons. Following this strategy means that the code you most often work on will gradually take on a common style. It also means that some of your existing code might never get updated, but if you never look at it, who cares?<br>
If you choose to re-style code that you otherwise have no need to touch, you&#39;re declaring that changing the look of this old code has more value to your business than delivering the next item on the backlog. The opportunity cost of making a purely aesthetic change includes losing the benefit of what you could have done instead. The rule-of-thumb is: Don&#39;t bother updating the styling of stable, existing code unless not doing so costs you money.</p>
</blockquote>

<ul>
<li>Most open source projects also avoid reformatting code just to change the style, because of the merge conflicts this will cause for downstream consumers</li>
</ul>

<blockquote>
<p>If you disagree with the style guide upon which your team agrees, you have only two honorable options:<br>
First, you can obey the guide despite your aversion. As with me in the Elm story above, this act is likely to change your thinking so that over time you come to prefer the new style. It&#39;s possible that if you follow the guide you&#39;ll begin to like it.<br>
Alternatively, you can decide you will not obey the style guide. Making this decision demands that you leave your current project and find some other project whose guide matches your preferred style. Go there and follow that one.<br>
Notice that both of these choices have you following a guide. This part is not optional.<br>
The moral of this story? It&#39;s more important for all code to be formatted the same than it is for any one of us to get our own way. Commit to agreeing upon and following a style guide. And if you find that your team cannot come to an agreement, step away from this problem and start a discussion about power.</p>
</blockquote>

<ul>
<li>There have been many arguments about style, and it can often be one of the first complaints of people new to any open source project</li>
<li>This article covers it fairly well from both sides, a) you should follow the style guide of the project you are contributing to, b) the project should review your actual code, then comment on the style after, and provide gentle guidance towards the right style, and avoid being “style cops”
***</li>
</ul>

<h2>Interview - The BSDNow Crew, Part II</h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/sysadminmike/freebsd-onion-omega2-build" rel="nofollow">Building FreeBSD for the Onion Omega 2</a></h3>

<ul>
<li>I got my Onion Omega 2 devices in the mail quite a while ago, but I had never gotten around to trying to install FreeBSD on them. They are a different MIPS SoC than the Onion Omega 1, so it would not work out of the box at the time. Now, the SoC is supported!</li>
<li>This guide provides the steps to build an image for the Omega 2 using the freebsd-wifi-build infrastructure</li>
<li>First some config files are modified to make the image small enough for the Omega 2’s flash chip</li>
<li>The DTS (Device Tree Source) files are not yet included in FreeBSD, so they are fetched from github</li>
<li>Then the build for the ralink SoC is run, with the provided DTS file and the MT7628_FDT kernel config</li>
<li>Once the build is complete, you’ll have a tftp image file. Then that image is compressed, and bundled into a uboot image</li>
<li>Write the files to a USB stick, and plug it into the Omega’s dock</li>
<li>Turn it on while holding the reset button with console open</li>
</ul>

<blockquote>
<p>Press 1 to get into the command line.</p>
</blockquote>

<ul>
<li>You will need to reset the usb:</li>
</ul>

<blockquote>
<p>usb reset</p>
</blockquote>

<ul>
<li>Then load the kernel boot image:</li>
</ul>

<blockquote>
<p>fatload usb 0:1 0x80800000 kernel.MT7628_FDT.lzma.uImage</p>
</blockquote>

<ul>
<li>And boot it:</li>
</ul>

<blockquote>
<p>bootm 0x80800000</p>
</blockquote>

<ul>
<li>At this point FreeBSD should boot</li>
<li>Mount a userland, and you should end up in multi-user mode</li>
<li>Hopefully this will get even easier in the next few weeks, and we’ll end up with a more streamlined process to tftp boot the device, then write FreeBSD into the onboard flash so it boots automatically.
***</li>
</ul>

<h3><a href="https://www.neelc.org/setting-the-cpu-affinity-on-freebsd-jails-with-ezjail/" rel="nofollow">Setting the CPU Affinity on FreeBSD Jails with ezjail</a></h3>

<ul>
<li>While there are more advanced resource controls available for FreeBSD jails, one of the most basic ways to control CPU usage is to limit the subset of CPUs that each jail can use. This can make sure that every jail has access to some dedicated resources, while at the same time doesn’t have the ability to entirely dominate the machine</li>
</ul>

<blockquote>
<p>I just got a new home server: a HP ProLiant ML110 G6. Being a FreeBSD person myself, it was natural that I used it on my server instead of Linux<br>
I chose to use ezjail to manage the jails on my ProLiant, with the initial one being a Tor middle node. Despite the fact that where my ML110 is, the upstream is only 35mbps (which is pretty good for cable), I did not want to give my Tor jail access to all four cores.<br>
Setting the CPU Affinity would let you choose a specific CPU core (or a range of cores) you want to use. However, it does not just let you pick the number of CPU cores you want and make FreeBSD choose the core running your jail. Going forward, I assumed that you have already created a jail using ezjail-admin. I also do not cover limiting a jail to a certain percentage of CPU usage.<br>
ezjail-admin config -c [CORE_NUMBER_FIRST]-[CORE_NUMBER_LAST] [JAIL_NAME]</p>
</blockquote>

<ul>
<li>or</li>
</ul>

<blockquote>
<p>ezjail-admin config -c [CORE_NUMBER_FIRST],[CORE_NUMBER_SECOND],...,[CORE_NUMBER_N] [JAIL_NAME]<br>
And hopefully, you should have your ezjail-managed FreeBSD jail limited to the CPU cores you want. While I did not cover a CPU percentage or RAM usage, this can be done with rctl<br>
I&#39;ll admit: it doesn&#39;t really matter which CPU a jail runs on, but it might matter if you don&#39;t want a jail to have access to all the CPU cores available and only want [JAIL_NAME] to use one core. Since it&#39;s not really possible just specify the number of CPU cores with ezjail (or even iocell), a fallback would be to use CPU affinity, and that requires you to specify an exact CPU core. I know it&#39;s not the best solution (it would be better if we could let the scheduler choose provided a jail only runs on one core), but it&#39;s what works.</p>
</blockquote>

<ul>
<li>We use this at work on high core count machines. When we have multiple databases colocated on the same machine, we make sure each one has a few cores to itself, while it shares other cores with the rest of the machine. We often reserve a core or two for the base system as well.
***</li>
</ul>

<h3><a href="https://medium.com/@andoriyu/a-practical-guide-to-containers-on-freenas-for-a-depraved-psychopath-c212203c0394" rel="nofollow">A practical guide to containers on FreeNAS for a depraved psychopath.</a></h3>

<ul>
<li>If you are interested in playing with Docker, this guide sets up a Linux VM running on FreeBSD or FreeNAS under bhyve, then runs linux docker containers on top of it</li>
</ul>

<blockquote>
<p>You know that jails are dope and I know that jails are dope, yet no one else knows it. So here we are stuck with docker. Two years ago I would be the last person to recommend using docker, but a whole lot of things has changes past years…</p>
</blockquote>

<ul>
<li>This tutorial uses iohyve to manage the VMs on the FreeBSD or FreeNAS</li>
</ul>

<blockquote>
<p>There are many Linux variants you can choose from — RancherOS, CoreOS are the most popular for docker-only hosts. We going to use RancherOS because it’s more lightweight out of the box.</p>
</blockquote>

<ul>
<li>Navigate to RancherOS website and grab link to latest version</li>
</ul>

<blockquote>
<p>sudo iohyve setup pool=zpool kmod=1 net=em0<br>
sudo iohyve fetch <a href="https://releases.rancher.com/os/latest/rancheros.iso" rel="nofollow">https://releases.rancher.com/os/latest/rancheros.iso</a><br>
sudo iohyve renameiso rancheros.iso rancheros-v1.0.4.iso<br>
sudo pkg install grub2-bhyve<br>
sudo iohyve create rancher 32G<br>
sudo iohyve set rancher loader=grub-bhyve ram=8G cpu=8 con=nmdm0 os=debian<br>
sudo iohyve install rancher rancheros-v1.0.4.iso<br>
sudo iohyve console rancher</p>
</blockquote>

<ul>
<li>Then the tutorial does some basic configuration of RancherOS, and some house keeping in iohyve to make RancherOS come up unattended at boot</li>
</ul>

<blockquote>
<p>The whole point of this guide is to reduce pain, and using the docker CLI is still painful. There are a lot of Web UIs to control docker. Most of them include a lot of orchestrating services, so it’s just overkill. Portainer is very lightweight and can be run even on Raspberry Pi</p>
</blockquote>

<ul>
<li>Create a config file as described</li>
</ul>

<blockquote>
<p>After reboot you will be able to access WebUI on 9000 port. Setup is very easy, so I won’t go over it</p>
</blockquote>

<ul>
<li>The docker tools for FreeBSD are still being worked on. Eventually you will be able to host native FreeBSD docker containers on FreeBSD jails, but we are not quite there yet</li>
<li>In the meantime, you can install sysutils/docker and use it to manage the docker instances running on a remote machine, or in this case, the RancherOS VM running in bhyve
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.wired.com/2014/09/coupland-bell-labs/" rel="nofollow">The Ghost of Invention: A Visit to Bell Labs, excerpt from the forthcoming book: “Kitten Clone: Inside Alcatel-Lucent” </a></li>
<li><a href="https://github.com/ligurio/openbsd-cookbooks" rel="nofollow">OpenBSD Cookbook (set of Ansible playbooks)</a></li>
<li><a href="https://www.tecmint.com/sockstat-command-examples-to-find-open-ports-in-freebsd/" rel="nofollow">15 useful sockstat commands to find open ports on FreeBSD </a></li>
<li><a href="https://medium.freecodecamp.org/a-pre-history-of-slashdot-6403341dabae" rel="nofollow">A prehistory of Slashdot</a></li>
<li><a href="https://medium.com/@claudio.santos.ribeiro/using-ed-the-unix-line-editor-557ed6466660" rel="nofollow">Using ed, the unix line editor </a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Malcolm - <a href="http://dpaste.com/16EB3ZA#wrap" rel="nofollow">ZFS snapshots</a></li>
<li>Darryn - <a href="http://dpaste.com/1DGHQJP#wrap" rel="nofollow">Zones</a></li>
<li><p>Mohammad - <a href="http://dpaste.com/08G3VTB#wrap" rel="nofollow">SSH Keys</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>216: Software is storytelling</title>
  <link>https://www.bsdnow.tv/216</link>
  <guid isPermaLink="false">06744f64-a9ca-4e0e-832e-34f53a663933</guid>
  <pubDate>Wed, 18 Oct 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/06744f64-a9ca-4e0e-832e-34f53a663933.mp3" length="78743956" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>EuroBSDcon trip report, how to secure OpenBSD’s LDAP server, ZFS channel programs in FreeBSD HEAD and why software is storytelling.</itunes:subtitle>
  <itunes:duration>1:49:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>EuroBSDcon trip report, how to secure OpenBSD’s LDAP server, ZFS channel programs in FreeBSD HEAD and why software is storytelling.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
EuroBSDcon Trip Report
This is from Frank Moore, who has been supplying us with collections of links for the show and who we met at EuroBSDcon in Paris for the first time. Here is his trip report.
My attendance at the EuroBSDCon 2017 conference in Paris was sprinkled with 
several 'firsts'. My first visit to Paris, my first time travelling on a EuroTunnel Shuttle train and my first time at any BSD conference. Hopefully, none of these will turn out to be 'lasts'.
I arrived on the Wednesday afternoon before the conference started on Thursday morning. My hotel was conveniently located close to the conference centre in Paris' 3rd arrondissement. This area is well-known as a buzzy enclave of hip cafes, eateries, independent shops, markets, modern galleries and museums. It certainly lived up to its reputation. Even better, the weather held over the course of the conference, only raining once, with the rest of the time being both warm and sunny.
The first two days were taken up with attending Dr Kirk McKusick's excellent tutorial 'An Introduction to the FreeBSD Open-Source Operating System'. This is training "straight from the horse's mouth". Kirk has worked extensively on The FreeBSD operating system since the 1980's, helping to design the original BSD filesystem (FFS) and later working on UFS as well. Not only is Kirk an engaging speaker, making what could be a dry topic very interesting, he also 
sprinkles liberal doses of history and war stories throughout his lectures. Want to know why a protocol was designed the way that it was? Or why a system flag has a particular value or position in a record? Kirk was there and has the first-hand answer. He reminisces about his meetings and work with other Unix and BSD luminaries and debunks and confirms common myths in equal measure.
Kirk's teaching style and knowledge are impressive. Every section starts with an overview and a big picture diagram before drilling down into the nitty-gritty detail. Nothing feels superfluous, and everything fits together logically. It's easy to tell that the material and its delivery have been honed over many years, but without feeling stale. Topics covered included the kernel, processes, virtual memory, threads, I/O, devices, FFS, ZFS, and networking. 
The slides were just as impressive, with additional notes written by a previous student and every slide containing a reference back to the relevant page(s) in the 2nd edition of Kirk's operating system book. As well as a hard copy for those that requested it, Kirk also helpfully supplied soft copies of all the training materials.
The breaks in between lectures were useful for meeting the students from the other tutorials and for recovering from the inevitable information overload.
It's not often that you can get to hear someone as renowned as Dr McKusick give a lecture on something as important as the FreeBSD operating system. If you have any interest in FreeBSD, Unix history, or operating systems in general, I would urge you to grab the opportunity to attend one of his lectures. You won't be disappointed.
The last two days of the conference consisted of various hour-long talks by members of each of the main BSD systems. All of them were fairly evenly represented except Dragonfly BSD which unfortunately only had one talk. With three talks going on at any one time, it was often difficult to pick which one to go to. At other times there might be nothing to pique the interest. Attendance at a talk is not mandatory, so for those times when no talks looked inviting, just hanging out in one of the lobby areas with other attendees was often just as interesting and informative. 
The conference centre itself was certainly memorable with the interior design of an Egyptian temple or pyramid. All the classrooms were more than adequate while the main auditorium was first-class and easily held the 300+ attendees comfortably. All in all, the facilities, catering and organisation were excellent. Kudos to the EuroBSDCon team, especially Bapt and Antoine for all their hard work and hospitality.
As a long-time watcher and occasional contributor to the BSD Now podcast it was good to meet both Allan and Benedict in the flesh. And having done some proofreading for Michael Lucas previously, it was nice to finally meet him as well.
My one suggestion to the organisers of the next conference would be to provide more 
hand-holding for newbies. As a first-time attendee at a BSD conference it would have been nice to have been formally introduced to various people within the projects as the goto people for their areas. I could do this myself, but it's not always easy finding the right person and wrangling an introduction. I also think it was a missed opportunity for each project to recruit new developers to their cause. Apparently, this is already in place at BSDCan, but should probably be rolled out across all BSD conferences.
Having said all that, my aims for the conference were to take Dr McKusick's course, meet a few BSD people and make contacts within one of the BSD projects to start contributing. I was successful on all these fronts, so for me this was mission accomplished. Another first!
autoconf/clang (No) Fun and Games (https://undeadly.org/cgi?action=article;sid=20170930133438)
Robert Nagy (robert@) wrote in with a fascinating story of hunting down a recent problem with ports:
You might have been noticing the amount of commits to ports regarding autoconf and nested functions and asking yourself… what the hell is this all about?
I was hanging out at my friend Antoine (ajacoutot@)'s place just before EuroBSDCon 2017 started and we were having drinks and he told me that there is this weird bug where Gnome hangs completely after just a couple of seconds of usage and the gnome-shell process just sits in the fsleep state. This started to happen at the time when inteldrm(4) was updated, the default compiler was switched to clang(1) and futexes were turned on by default.
The next day we started to have a look at the issue and since the process was hanging in fsleep, it seemed clear that the cause must be futexes, so we had to start bisecting the base system, which resulted in random success and failure. In the end we figured out that it is neither futex nor inteldrm(4) related, so the only thing that was left is the switch to clang.
Now the problem is that we have to figure out what part of the system needs to be build with clang to trigger this issue, so we kept on going and systematically recompiled the base system with gcc until everything was ruled out … and it kept on hanging.
We were drunk and angry that now we have to go and check hundreds of ports because gnome is not a small standalone port, so between two bottles of wine a build VM was fired up to do a package build with gcc, because manually building all the dependencies would just take too long and we had spent almost two days on this already.
Next day ~200 packages were available to bisect and figure out what's going on. After a couple of tries it turned out that the hang is being caused by the gtk+3 package, which is bad since almost everything is using gtk+3. Now it was time to figure out what file the gtk+3 source being built by clang is causing the issue. (Compiler optimizations were ruled out already at this point.) So another set of bisecting happened, building each subdirectory of gtk+3 with clang and waiting for the hang to manifest … and it did not. What the $f?
Okay so something else is going on and maybe the configure script of gtk+3 is doing something weird with different compilers, so I quickly did two configure runs with gcc and clang and simply diff'd the two directories. Snippets from the diff:
-GDKHIDDENVISIBILITYCFLAGS = -fvisibility=hidden
GDKHIDDENVISIBILITYCFLAGS = 
-ltcvprogcompilerrttiexceptions=no
ltcvprogcompilerrttiexceptions=yes
-#define GDKEXTERN attribute((visibility("default"))) extern
-ltprogcompilernobuiltinflag=' -fno-builtin'
+ltprogcompilernobuiltinflag=' -fno-builtin -fno-rtti -fno-exceptions'
Okay, okay that's something, but wait … clang has symbol visibility support so what is going on again? Let's take a peek at config.log:
configure:29137: checking for -fvisibility=hidden compiler flag
configure:29150: cc -c -fvisibility=hidden  -I/usr/local/include -I/usr/X11R6/include conftest.c &amp;gt;&amp;amp;5
conftest.c:82:17: error: function definition is not allowed here
int main (void) { return 0; }
              ^
1 error generated.
Okay that's clearly an error but why exactly? autoconf basically generates a huge shell script that will check for whatever you throw at it by creating a file called conftest.c and putting chunks of code into it and then trying to compile it. In this case the relevant part of the code was:
| int
| main ()
| {
| int main (void) { return 0; }
|   ;
|   return 0;
| }
That is a nested function declaration which is a GNU extension and it is not supported by clang, but that's okay, the question is why the hell would you use nested functions to check for simple compiler flags. The next step was to go and check what is going on in configure.ac to see how the configure script is generated. In the gtk+3 case the following snippet is used:
AC_MSG_CHECKING([for -fvisibility=hidden compiler flag])
   ACTRYCOMPILE([], [int main (void) { return 0; }],
                  ACMSGRESULT(yes)
                  enablefvisibilityhidden=yes,
                  ACMSGRESULT(no)
                  enablefvisibilityhidden=no)
According to the autoconf manual the ACTRYCOMPILE macro accepts the following parameters:
That clearly states that a function body has to be specified because the function definition is already provided automatically, so doing ACTRYCOMPILE([], [int main (void) { return 0;}], instead of ACTRYCOMPILE([],[] will result in a nested function declaration, which will work just fine with gcc, even though the autoconf usage is wrong.
After fixing the autoconf macro in gtk+3 and rebuilding the complete port from scratch with clang, the hang completely went away as the proper CFLAGS and LDFLAGS were picked up by autoconf for the build.
At this point we realized that most of the ports tree uses autoconf so this issue might be a lot bigger than we thought, so I asked sthen@ to do a grep on the ports object directory and just search for "function definition is not allowed here", which resulted in about ~60 additional ports affected.
Out of the list of ports there were only two false positive matches. These were actually trying to test whether the compiler supports nested functions. The rest were a combination of several autoconf macros used in a wrong way, e.g: ACTRYCOMPILE, ACTRYLINK. Most of them were fixable by just removing the extra function declaration or by switching to other autoconf macros like ACLANGSOURCE where you can actually declare your own functions if need be.
The conclusion is that this issue was a combination of people not reading documentation and just copy/pasting autoconf snippets, instead of reading their documentation and using the macros in the way they were intended, and the fact that switching to a new compiler is never easy and bugs or undefined behaviour are always lurking in the dark.
Thanks to everyone who helped fixing all the ports up this quickly! Hopefully all of the changes can be merged upstream, so that others can benefit as well. 
Interview - David Carlier - @devnexen (https://twitter.com/devnexen)
Software Engineer at Afilias
***
News Roundup
Setting up OpenBSD's LDAP Server (ldapd) with StartTLS and SASL (http://blog.databasepatterns.com/2017/08/setting-up-openbsds-ldap-server-ldapd.html)
A tutorial on setting up OpenBSD’s native LDAP server with TLS encryption and SASL authentication
OpenBSD has its own LDAP server, ldapd. Here's how to configure it for use with StartTLS and SASL authentication
Create a certificate (acme-client anyone?)
Create a basic config file
listen on em0 tls certificate ldapserver
This will listen on the em0 interface with tls using the certificate called ldapserver.crt / ldapserver.key
Validate the configuration:
/usr/sbin/ldapd -n
Enable and start the service:
rcctl enable ldapd
rcctl start ldapd
On the client machine:
pkg_add openldap-client
Copy the certificate to /etc/ssl/trusted.crt
Add this line to /etc/openldap/ldap.conf
TLS_CACERT    /etc/ssl/trusted.crt
Enable and start the service
rcctl enable saslauthd
rcctl start saslauthd
Connect to ldapd (-ZZ means force TLS, use -H to specify URI): 
ldapsearch -H ldap://ldapserver -ZZ
FreeBSD Picks Up Support for ZFS Channel Programs in -current (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=324163)
ZFS channel programs (ZCP) adds support for performing compound ZFS administrative actions via Lua scripts in a sandboxed environment (with time and memory limits).
This initial commit includes both base support for running ZCP scripts, and a small initial library of API calls which support getting properties and listing, destroying, and promoting datasets.
Testing: in addition to the included unit tests, channel programs have been in use at Delphix for several months for batch destroying filesystems.
Take a simple task as an example: Create a snapshot, then set a property on that snapshot. In the traditional system for this, when you issue the snapshot command, that closes the currently open transaction group (say #100), and opens a new one, #101. While #100 is being written to disk, other writes are accumulated in #101. Once #100 is flushed to disk, the ‘zfs snapshot’ command returns. You can then issue the ‘zfs set’ command. This actually ends up going into transaction group #102. Each administrative action needs to wait for the transaction group to flush, which under heavy loads could take multiple seconds. Now if you want to create AND set, you need to wait for two or three transaction groups. Meanwhile, during transaction group #101, the snapshot existed without the property set, which could cause all kinds of side effects.
ZFS Channel programs solves this by allowing you to perform a small scripted set of actions as a single atomic operation.
In Delphix’s appliance, they often needed to do as many as 15 operations together, which might take multiple minutes. Now with channel programs it is much faster, far safer, and has fewer chances of side effects
BSDCan 2017 - Matt Ahrens: Building products based on OpenZFS, using channel programs -- Video Soon (http://www.bsdcan.org/2017/schedule/events/854.en.html)
Software Is About Storytelling (http://bravenewgeek.com/software-is-about-storytelling/)
Tyler Treat writes on the brave new geek blog:
Software engineering is more a practice in archeology than it is in building. As an industry, we undervalue storytelling and focus too much on artifacts and tools and deliverables. How many times have you been left scratching your head while looking at a piece of code, system, or process? It’s the story, the legacy left behind by that artifact, that is just as important—if not more—than the artifact itself.
And I don’t mean what’s in the version control history—that’s often useless. I mean the real, human story behind something. Artifacts, whether that’s code or tools or something else entirely, are not just snapshots in time. They’re the result of a series of decisions, discussions, mistakes, corrections, problems, constraints, and so on.  They’re the product of the engineering process, but the problem is they usually don’t capture that process in its entirety. They rarely capture it at all. They commonly end up being nothing but a snapshot in time.
It’s often the sign of an inexperienced engineer when someone looks at something and says, “this is stupid” or “why are they using X instead of Y?” They’re ignoring the context, the fact that circumstances may have been different. There is a story that led up to that point, a reason for why things are the way they are. If you’re lucky, the people involved are still around. Unfortunately, this is not typically the case. And so it’s not necessarily the poor engineer’s fault for wondering these things. Their predecessors haven’t done enough to make that story discoverable and share that context.
I worked at a company that built a homegrown container PaaS on ECS. Doing that today would be insane with the plethora of container solutions available now. “Why aren’t you using Kubernetes?” Well, four years ago when we started, Kubernetes didn’t exist. Even Docker was just in its infancy. And it’s not exactly a flick of a switch to move multiple production environments to a new container runtime, not to mention the politicking with leadership to convince them it’s worth it to not ship any new code for the next quarter as we rearchitect our entire platform. Oh, and now the people behind the original solution are no longer with the company. Good luck! And this is on the timescale of about five years. That’s maybe like one generation of engineers at the company at most—nothing compared to the decades or more software usually lives (an interesting observation is that timescale, I think, is proportional to the size of an organization). Don’t underestimate momentum, but also don’t underestimate changing circumstances, even on a small time horizon.
The point is, stop looking at technology in a vacuum. There are many facets to consider. Likewise, decisions are not made in a vacuum. Part of this is just being an empathetic engineer. The corollary to this is you don’t need to adopt every bleeding-edge tech that comes out to be successful, but the bigger point is software is about storytelling. The question you should be asking is how does your organization tell those stories? Are you deliberate or is it left to tribal knowledge and hearsay? Is it something you truly value and prioritize or simply a byproduct?
Documentation is good, but the trouble with documentation is it’s usually haphazard and stagnant. It’s also usually documentation of how and not why. Documenting intent can go a long way, and understanding the why is a good way to develop empathy. Code survives us. There’s a fantastic talk by Bryan Cantrill on oral tradition in software engineering (https://youtu.be/4PaWFYm0kEw) where he talks about this. People care about intent. Specifically, when you write software, people care what you think. As Bryan puts it, future generations of programmers want to understand your intent so they can abide by it, so we need to tell them what our intent was. We need to broadcast it. Good code comments are an example of this. They give you a narrative of not only what’s going on, but why. When we write software, we write it for future generations, and that’s the most underestimated thing in all of software. Documenting intent also allows you to document your values, and that allows the people who come after you to continue to uphold them.
Storytelling in software is important. Without it, software archeology is simply the study of puzzles created by time and neglect. When an organization doesn’t record its history, it’s bound to repeat the same mistakes. A company’s memory is comprised of its people, but the fact is people churn. Knowing how you got here often helps you with getting to where you want to be. Storytelling is how we transcend generational gaps and the inevitable changing of the old guard to the new guard in a maturing engineering organization. The same is true when we expand that to the entire industry. We’re too memoryless—shipping code and not looking back, discovering everything old that is new again, and simply not appreciating our lineage.
Beastie Bits
1st BSD Users Stockholm Meetup (https://www.meetup.com/en-US/BSD-Users-Stockholm/)
Absolute FreeBSD, 3rd Edition draft completed  (https://blather.michaelwlucas.com/archives/3020)
Absolute FreeBSD, 3rd Edition Table of Contents (https://blather.michaelwlucas.com/archives/2995)
t2k17 Hackathon Report: My first time (Aaron Bieber) (https://undeadly.org/cgi?action=article;sid=20170824193521)
The release of pfSense 2.4.0 will be slightly delayed to apply patches for vulnerabilities in 3rd party packages that are part of pfSense (https://www.netgate.com/blog/no-plan-survives-contact-with-the-internet.html)
Feedback/Questions
Ben writes in that zrepl is in ports now (http://dpaste.com/1XMJYMH#wrap)
Peter asks us about Netflix on BSD (http://dpaste.com/334WY4T#wrap)
meka writes in about dhclient exiting (http://dpaste.com/3GSGKD3#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>EuroBSDcon trip report, how to secure OpenBSDs LDAP server, ZFS channel programs in FreeBSD HEAD and why software is storytelling.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>EuroBSDcon Trip Report</h3>

<ul>
<li>This is from Frank Moore, who has been supplying us with collections of links for the show and who we met at EuroBSDcon in Paris for the first time. Here is his trip report.</li>
</ul>

<blockquote>
<p>My attendance at the EuroBSDCon 2017 conference in Paris was sprinkled with <br>
several &#39;firsts&#39;. My first visit to Paris, my first time travelling on a EuroTunnel Shuttle train and my first time at any BSD conference. Hopefully, none of these will turn out to be &#39;lasts&#39;.<br>
I arrived on the Wednesday afternoon before the conference started on Thursday morning. My hotel was conveniently located close to the conference centre in Paris&#39; 3rd arrondissement. This area is well-known as a buzzy enclave of hip cafes, eateries, independent shops, markets, modern galleries and museums. It certainly lived up to its reputation. Even better, the weather held over the course of the conference, only raining once, with the rest of the time being both warm and sunny.<br>
The first two days were taken up with attending Dr Kirk McKusick&#39;s excellent tutorial &#39;An Introduction to the FreeBSD Open-Source Operating System&#39;. This is training &quot;straight from the horse&#39;s mouth&quot;. Kirk has worked extensively on The FreeBSD operating system since the 1980&#39;s, helping to design the original BSD filesystem (FFS) and later working on UFS as well. Not only is Kirk an engaging speaker, making what could be a dry topic very interesting, he also <br>
sprinkles liberal doses of history and war stories throughout his lectures. Want to know why a protocol was designed the way that it was? Or why a system flag has a particular value or position in a record? Kirk was there and has the first-hand answer. He reminisces about his meetings and work with other Unix and BSD luminaries and debunks and confirms common myths in equal measure.<br>
Kirk&#39;s teaching style and knowledge are impressive. Every section starts with an overview and a big picture diagram before drilling down into the nitty-gritty detail. Nothing feels superfluous, and everything fits together logically. It&#39;s easy to tell that the material and its delivery have been honed over many years, but without feeling stale. Topics covered included the kernel, processes, virtual memory, threads, I/O, devices, FFS, ZFS, and networking. <br>
The slides were just as impressive, with additional notes written by a previous student and every slide containing a reference back to the relevant page(s) in the 2nd edition of Kirk&#39;s operating system book. As well as a hard copy for those that requested it, Kirk also helpfully supplied soft copies of all the training materials.<br>
The breaks in between lectures were useful for meeting the students from the other tutorials and for recovering from the inevitable information overload.<br>
It&#39;s not often that you can get to hear someone as renowned as Dr McKusick give a lecture on something as important as the FreeBSD operating system. If you have any interest in FreeBSD, Unix history, or operating systems in general, I would urge you to grab the opportunity to attend one of his lectures. You won&#39;t be disappointed.<br>
The last two days of the conference consisted of various hour-long talks by members of each of the main BSD systems. All of them were fairly evenly represented except Dragonfly BSD which unfortunately only had one talk. With three talks going on at any one time, it was often difficult to pick which one to go to. At other times there might be nothing to pique the interest. Attendance at a talk is not mandatory, so for those times when no talks looked inviting, just hanging out in one of the lobby areas with other attendees was often just as interesting and informative. <br>
The conference centre itself was certainly memorable with the interior design of an Egyptian temple or pyramid. All the classrooms were more than adequate while the main auditorium was first-class and easily held the 300+ attendees comfortably. All in all, the facilities, catering and organisation were excellent. Kudos to the EuroBSDCon team, especially Bapt and Antoine for all their hard work and hospitality.<br>
As a long-time watcher and occasional contributor to the BSD Now podcast it was good to meet both Allan and Benedict in the flesh. And having done some proofreading for Michael Lucas previously, it was nice to finally meet him as well.<br>
My one suggestion to the organisers of the next conference would be to provide more <br>
hand-holding for newbies. As a first-time attendee at a BSD conference it would have been nice to have been formally introduced to various people within the projects as the goto people for their areas. I could do this myself, but it&#39;s not always easy finding the right person and wrangling an introduction. I also think it was a missed opportunity for each project to recruit new developers to their cause. Apparently, this is already in place at BSDCan, but should probably be rolled out across all BSD conferences.<br>
Having said all that, my aims for the conference were to take Dr McKusick&#39;s course, meet a few BSD people and make contacts within one of the BSD projects to start contributing. I was successful on all these fronts, so for me this was mission accomplished. Another first!</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20170930133438" rel="nofollow">autoconf/clang (No) Fun and Games</a></h3>

<ul>
<li>Robert Nagy (robert@) wrote in with a fascinating story of hunting down a recent problem with ports:</li>
</ul>

<blockquote>
<p>You might have been noticing the amount of commits to ports regarding autoconf and nested functions and asking yourself what the hell is this all about?<br>
I was hanging out at my friend Antoine (ajacoutot@)&#39;s place just before EuroBSDCon 2017 started and we were having drinks and he told me that there is this weird bug where Gnome hangs completely after just a couple of seconds of usage and the gnome-shell process just sits in the fsleep state. This started to happen at the time when inteldrm(4) was updated, the default compiler was switched to clang(1) and futexes were turned on by default.<br>
The next day we started to have a look at the issue and since the process was hanging in fsleep, it seemed clear that the cause must be futexes, so we had to start bisecting the base system, which resulted in random success and failure. In the end we figured out that it is neither futex nor inteldrm(4) related, so the only thing that was left is the switch to clang.<br>
Now the problem is that we have to figure out what part of the system needs to be build with clang to trigger this issue, so we kept on going and systematically recompiled the base system with gcc until everything was ruled out  and it kept on hanging.<br>
We were drunk and angry that now we have to go and check hundreds of ports because gnome is not a small standalone port, so between two bottles of wine a build VM was fired up to do a package build with gcc, because manually building all the dependencies would just take too long and we had spent almost two days on this already.<br>
Next day ~200 packages were available to bisect and figure out what&#39;s going on. After a couple of tries it turned out that the hang is being caused by the gtk+3 package, which is bad since almost everything is using gtk+3. Now it was time to figure out what file the gtk+3 source being built by clang is causing the issue. (Compiler optimizations were ruled out already at this point.) So another set of bisecting happened, building each subdirectory of gtk+3 with clang and waiting for the hang to manifest  and it did not. What the $f?<br>
Okay so something else is going on and maybe the configure script of gtk+3 is doing something weird with different compilers, so I quickly did two configure runs with gcc and clang and simply diff&#39;d the two directories. Snippets from the diff:</p>

<p>-GDK_HIDDEN_VISIBILITY_CFLAGS = -fvisibility=hidden<br>
GDK_HIDDEN_VISIBILITY_CFLAGS = </p>

<p>-lt_cv_prog_compiler_rtti_exceptions=no<br>
lt_cv_prog_compiler_rtti_exceptions=yes</p>

<p>-#define <em>GDK_EXTERN __attribute</em>_((visibility(&quot;default&quot;))) extern</p>

<p>-lt_prog_compiler_no_builtin_flag=&#39; -fno-builtin&#39;<br>
+lt_prog_compiler_no_builtin_flag=&#39; -fno-builtin -fno-rtti -fno-exceptions&#39;<br>
Okay, okay that&#39;s something, but wait  clang has symbol visibility support so what is going on again? Let&#39;s take a peek at config.log:</p>

<p>configure:29137: checking for -fvisibility=hidden compiler flag</p>

<p>configure:29150: cc -c -fvisibility=hidden  -I/usr/local/include -I/usr/X11R6/include conftest.c &gt;&amp;5<br>
conftest.c:82:17: error: function definition is not allowed here</p>

<p>int main (void) { return 0; }<br>
              ^<br>
1 error generated.</p>

<p>Okay that&#39;s clearly an error but why exactly? autoconf basically generates a huge shell script that will check for whatever you throw at it by creating a file called conftest.c and putting chunks of code into it and then trying to compile it. In this case the relevant part of the code was:</p>

<blockquote>
<p>| int<br>
| main ()<br>
| {<br>
| int main (void) { return 0; }<br>
|   ;<br>
|   return 0;<br>
| }</p>
</blockquote>

<p>That is a nested function declaration which is a GNU extension and it is not supported by clang, but that&#39;s okay, the question is why the hell would you use nested functions to check for simple compiler flags. The next step was to go and check what is going on in configure.ac to see how the configure script is generated. In the gtk+3 case the following snippet is used:</p>

<pre><code>AC_MSG_CHECKING([for -fvisibility=hidden compiler flag])
</code></pre>

<p>AC_TRY_COMPILE([], [int main (void) { return 0; }],<br>
                  AC_MSG_RESULT(yes)<br>
                  enable_fvisibility_hidden=yes,<br>
                  AC_MSG_RESULT(no)<br>
                  enable_fvisibility_hidden=no)</p>

<p>According to the autoconf manual the AC_TRY_COMPILE macro accepts the following parameters:<br>
That clearly states that a function body has to be specified because the function definition is already provided automatically, so doing AC_TRY_COMPILE([], [int main (void) { return 0;}], instead of AC_TRY_COMPILE([],[] will result in a nested function declaration, which will work just fine with gcc, even though the autoconf usage is wrong.<br>
After fixing the autoconf macro in gtk+3 and rebuilding the complete port from scratch with clang, the hang completely went away as the proper CFLAGS and LDFLAGS were picked up by autoconf for the build.<br>
At this point we realized that most of the ports tree uses autoconf so this issue might be a lot bigger than we thought, so I asked sthen@ to do a grep on the ports object directory and just search for &quot;function definition is not allowed here&quot;, which resulted in about ~60 additional ports affected.<br>
Out of the list of ports there were only two false positive matches. These were actually trying to test whether the compiler supports nested functions. The rest were a combination of several autoconf macros used in a wrong way, e.g: AC_TRY_COMPILE, AC_TRY_LINK. Most of them were fixable by just removing the extra function declaration or by switching to other autoconf macros like AC_LANG_SOURCE where you can actually declare your own functions if need be.<br>
The conclusion is that this issue was a combination of people not reading documentation and just copy/pasting autoconf snippets, instead of reading their documentation and using the macros in the way they were intended, and the fact that switching to a new compiler is never easy and bugs or undefined behaviour are always lurking in the dark.<br>
Thanks to everyone who helped fixing all the ports up this quickly! Hopefully all of the changes can be merged upstream, so that others can benefit as well. </p>

<hr>
</blockquote>

<h2>Interview - David Carlier - <a href="https://twitter.com/devnexen" rel="nofollow">@devnexen</a></h2>

<ul>
<li>Software Engineer at Afilias
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://blog.databasepatterns.com/2017/08/setting-up-openbsds-ldap-server-ldapd.html" rel="nofollow">Setting up OpenBSD&#39;s LDAP Server (ldapd) with StartTLS and SASL</a></h3>

<ul>
<li>A tutorial on setting up OpenBSDs native LDAP server with TLS encryption and SASL authentication</li>
</ul>

<blockquote>
<p>OpenBSD has its own LDAP server, ldapd. Here&#39;s how to configure it for use with StartTLS and SASL authentication<br>
Create a certificate (acme-client anyone?)<br>
Create a basic config file<br>
listen on em0 tls certificate ldapserver</p>
</blockquote>

<ul>
<li>This will listen on the em0 interface with tls using the certificate called ldapserver.crt / ldapserver.key</li>
<li>Validate the configuration:</li>
</ul>

<blockquote>
<p>/usr/sbin/ldapd -n</p>
</blockquote>

<ul>
<li>Enable and start the service:</li>
</ul>

<blockquote>
<p>rcctl enable ldapd<br>
rcctl start ldapd</p>
</blockquote>

<ul>
<li>On the client machine:</li>
</ul>

<blockquote>
<h1>pkg_add openldap-client</h1>
</blockquote>

<ul>
<li>Copy the certificate to /etc/ssl/trusted.crt</li>
<li>Add this line to /etc/openldap/ldap.conf</li>
</ul>

<blockquote>
<p>TLS_CACERT    /etc/ssl/trusted.crt</p>
</blockquote>

<ul>
<li>Enable and start the service</li>
</ul>

<blockquote>
<p>rcctl enable saslauthd<br>
rcctl start saslauthd</p>
</blockquote>

<ul>
<li>Connect to ldapd (-ZZ means force TLS, use -H to specify URI): </li>
</ul>

<blockquote>
<p>ldapsearch -H ldap://ldapserver -ZZ</p>

<hr>
</blockquote>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=324163" rel="nofollow">FreeBSD Picks Up Support for ZFS Channel Programs in -current</a></h3>

<blockquote>
<p>ZFS channel programs (ZCP) adds support for performing compound ZFS administrative actions via Lua scripts in a sandboxed environment (with time and memory limits).<br>
This initial commit includes both base support for running ZCP scripts, and a small initial library of API calls which support getting properties and listing, destroying, and promoting datasets.<br>
Testing: in addition to the included unit tests, channel programs have been in use at Delphix for several months for batch destroying filesystems.</p>
</blockquote>

<ul>
<li><p>Take a simple task as an example: Create a snapshot, then set a property on that snapshot. In the traditional system for this, when you issue the snapshot command, that closes the currently open transaction group (say #100), and opens a new one, #101. While #100 is being written to disk, other writes are accumulated in #101. Once #100 is flushed to disk, the zfs snapshot command returns. You can then issue the zfs set command. This actually ends up going into transaction group #102. Each administrative action needs to wait for the transaction group to flush, which under heavy loads could take multiple seconds. Now if you want to create AND set, you need to wait for two or three transaction groups. Meanwhile, during transaction group #101, the snapshot existed without the property set, which could cause all kinds of side effects.</p></li>
<li><p>ZFS Channel programs solves this by allowing you to perform a small scripted set of actions as a single atomic operation.</p></li>
<li><p>In Delphixs appliance, they often needed to do as many as 15 operations together, which might take multiple minutes. Now with channel programs it is much faster, far safer, and has fewer chances of side effects</p></li>
<li><p><a href="http://www.bsdcan.org/2017/schedule/events/854.en.html" rel="nofollow">BSDCan 2017 - Matt Ahrens: Building products based on OpenZFS, using channel programs -- Video Soon</a></p>

<hr></li>
</ul>

<h3><a href="http://bravenewgeek.com/software-is-about-storytelling/" rel="nofollow">Software Is About Storytelling</a></h3>

<ul>
<li>Tyler Treat writes on the brave new geek blog:</li>
</ul>

<blockquote>
<p>Software engineering is more a practice in archeology than it is in building. As an industry, we undervalue storytelling and focus too much on artifacts and tools and deliverables. How many times have you been left scratching your head while looking at a piece of code, system, or process? Its the story, the legacy left behind by that artifact, that is just as importantif not morethan the artifact itself.<br>
And I dont mean whats in the version control historythats often useless. I mean the real, human story behind something. Artifacts, whether thats code or tools or something else entirely, are not just snapshots in time. Theyre the result of a series of decisions, discussions, mistakes, corrections, problems, constraints, and so on.  Theyre the product of the engineering process, but the problem is they usually dont capture that process in its entirety. They rarely capture it at all. They commonly end up being nothing but a snapshot in time.<br>
Its often the sign of an inexperienced engineer when someone looks at something and says, this is stupid or why are they using X instead of Y? Theyre ignoring the context, the fact that circumstances may have been different. There is a story that led up to that point, a reason for why things are the way they are. If youre lucky, the people involved are still around. Unfortunately, this is not typically the case. And so its not necessarily the poor engineers fault for wondering these things. Their predecessors havent done enough to make that story discoverable and share that context.<br>
I worked at a company that built a homegrown container PaaS on ECS. Doing that today would be insane with the plethora of container solutions available now. Why arent you using Kubernetes? Well, four years ago when we started, Kubernetes didnt exist. Even Docker was just in its infancy. And its not exactly a flick of a switch to move multiple production environments to a new container runtime, not to mention the politicking with leadership to convince them its worth it to not ship any new code for the next quarter as we rearchitect our entire platform. Oh, and now the people behind the original solution are no longer with the company. Good luck! And this is on the timescale of about five years. Thats maybe like one generation of engineers at the company at mostnothing compared to the decades or more software usually lives (an interesting observation is that timescale, I think, is proportional to the size of an organization). Dont underestimate momentum, but also dont underestimate changing circumstances, even on a small time horizon.<br>
The point is, stop looking at technology in a vacuum. There are many facets to consider. Likewise, decisions are not made in a vacuum. Part of this is just being an empathetic engineer. The corollary to this is you dont need to adopt every bleeding-edge tech that comes out to be successful, but the bigger point is software is about storytelling. The question you should be asking is how does your organization tell those stories? Are you deliberate or is it left to tribal knowledge and hearsay? Is it something you truly value and prioritize or simply a byproduct?<br>
Documentation is good, but the trouble with documentation is its usually haphazard and stagnant. Its also usually documentation of how and not why. Documenting intent can go a long way, and understanding the why is a good way to develop empathy. Code survives us. Theres a fantastic talk by Bryan Cantrill on <a href="https://youtu.be/4PaWFYm0kEw" rel="nofollow">oral tradition in software engineering</a> where he talks about this. People care about intent. Specifically, when you write software, people care what you think. As Bryan puts it, future generations of programmers want to understand your intent so they can abide by it, so we need to tell them what our intent was. We need to broadcast it. Good code comments are an example of this. They give you a narrative of not only whats going on, but why. When we write software, we write it for future generations, and thats the most underestimated thing in all of software. Documenting intent also allows you to document your values, and that allows the people who come after you to continue to uphold them.<br>
Storytelling in software is important. Without it, software archeology is simply the study of puzzles created by time and neglect. When an organization doesnt record its history, its bound to repeat the same mistakes. A companys memory is comprised of its people, but the fact is people churn. Knowing how you got here often helps you with getting to where you want to be. Storytelling is how we transcend generational gaps and the inevitable changing of the old guard to the new guard in a maturing engineering organization. The same is true when we expand that to the entire industry. Were too memorylessshipping code and not looking back, discovering everything old that is new again, and simply not appreciating our lineage.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.meetup.com/en-US/BSD-Users-Stockholm/" rel="nofollow">1st BSD Users Stockholm Meetup</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3020" rel="nofollow">Absolute FreeBSD, 3rd Edition draft completed </a></li>
<li><a href="https://blather.michaelwlucas.com/archives/2995" rel="nofollow">Absolute FreeBSD, 3rd Edition Table of Contents</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20170824193521" rel="nofollow">t2k17 Hackathon Report: My first time (Aaron Bieber)</a></li>
<li><a href="https://www.netgate.com/blog/no-plan-survives-contact-with-the-internet.html" rel="nofollow">The release of pfSense 2.4.0 will be slightly delayed to apply patches for vulnerabilities in 3rd party packages that are part of pfSense</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/1XMJYMH#wrap" rel="nofollow">Ben writes in that zrepl is in ports now</a></li>
<li><a href="http://dpaste.com/334WY4T#wrap" rel="nofollow">Peter asks us about Netflix on BSD</a></li>
<li><a href="http://dpaste.com/3GSGKD3#wrap" rel="nofollow">meka writes in about dhclient exiting</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>EuroBSDcon trip report, how to secure OpenBSDs LDAP server, ZFS channel programs in FreeBSD HEAD and why software is storytelling.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>EuroBSDcon Trip Report</h3>

<ul>
<li>This is from Frank Moore, who has been supplying us with collections of links for the show and who we met at EuroBSDcon in Paris for the first time. Here is his trip report.</li>
</ul>

<blockquote>
<p>My attendance at the EuroBSDCon 2017 conference in Paris was sprinkled with <br>
several &#39;firsts&#39;. My first visit to Paris, my first time travelling on a EuroTunnel Shuttle train and my first time at any BSD conference. Hopefully, none of these will turn out to be &#39;lasts&#39;.<br>
I arrived on the Wednesday afternoon before the conference started on Thursday morning. My hotel was conveniently located close to the conference centre in Paris&#39; 3rd arrondissement. This area is well-known as a buzzy enclave of hip cafes, eateries, independent shops, markets, modern galleries and museums. It certainly lived up to its reputation. Even better, the weather held over the course of the conference, only raining once, with the rest of the time being both warm and sunny.<br>
The first two days were taken up with attending Dr Kirk McKusick&#39;s excellent tutorial &#39;An Introduction to the FreeBSD Open-Source Operating System&#39;. This is training &quot;straight from the horse&#39;s mouth&quot;. Kirk has worked extensively on The FreeBSD operating system since the 1980&#39;s, helping to design the original BSD filesystem (FFS) and later working on UFS as well. Not only is Kirk an engaging speaker, making what could be a dry topic very interesting, he also <br>
sprinkles liberal doses of history and war stories throughout his lectures. Want to know why a protocol was designed the way that it was? Or why a system flag has a particular value or position in a record? Kirk was there and has the first-hand answer. He reminisces about his meetings and work with other Unix and BSD luminaries and debunks and confirms common myths in equal measure.<br>
Kirk&#39;s teaching style and knowledge are impressive. Every section starts with an overview and a big picture diagram before drilling down into the nitty-gritty detail. Nothing feels superfluous, and everything fits together logically. It&#39;s easy to tell that the material and its delivery have been honed over many years, but without feeling stale. Topics covered included the kernel, processes, virtual memory, threads, I/O, devices, FFS, ZFS, and networking. <br>
The slides were just as impressive, with additional notes written by a previous student and every slide containing a reference back to the relevant page(s) in the 2nd edition of Kirk&#39;s operating system book. As well as a hard copy for those that requested it, Kirk also helpfully supplied soft copies of all the training materials.<br>
The breaks in between lectures were useful for meeting the students from the other tutorials and for recovering from the inevitable information overload.<br>
It&#39;s not often that you can get to hear someone as renowned as Dr McKusick give a lecture on something as important as the FreeBSD operating system. If you have any interest in FreeBSD, Unix history, or operating systems in general, I would urge you to grab the opportunity to attend one of his lectures. You won&#39;t be disappointed.<br>
The last two days of the conference consisted of various hour-long talks by members of each of the main BSD systems. All of them were fairly evenly represented except Dragonfly BSD which unfortunately only had one talk. With three talks going on at any one time, it was often difficult to pick which one to go to. At other times there might be nothing to pique the interest. Attendance at a talk is not mandatory, so for those times when no talks looked inviting, just hanging out in one of the lobby areas with other attendees was often just as interesting and informative. <br>
The conference centre itself was certainly memorable with the interior design of an Egyptian temple or pyramid. All the classrooms were more than adequate while the main auditorium was first-class and easily held the 300+ attendees comfortably. All in all, the facilities, catering and organisation were excellent. Kudos to the EuroBSDCon team, especially Bapt and Antoine for all their hard work and hospitality.<br>
As a long-time watcher and occasional contributor to the BSD Now podcast it was good to meet both Allan and Benedict in the flesh. And having done some proofreading for Michael Lucas previously, it was nice to finally meet him as well.<br>
My one suggestion to the organisers of the next conference would be to provide more <br>
hand-holding for newbies. As a first-time attendee at a BSD conference it would have been nice to have been formally introduced to various people within the projects as the goto people for their areas. I could do this myself, but it&#39;s not always easy finding the right person and wrangling an introduction. I also think it was a missed opportunity for each project to recruit new developers to their cause. Apparently, this is already in place at BSDCan, but should probably be rolled out across all BSD conferences.<br>
Having said all that, my aims for the conference were to take Dr McKusick&#39;s course, meet a few BSD people and make contacts within one of the BSD projects to start contributing. I was successful on all these fronts, so for me this was mission accomplished. Another first!</p>

<hr>
</blockquote>

<h3><a href="https://undeadly.org/cgi?action=article;sid=20170930133438" rel="nofollow">autoconf/clang (No) Fun and Games</a></h3>

<ul>
<li>Robert Nagy (robert@) wrote in with a fascinating story of hunting down a recent problem with ports:</li>
</ul>

<blockquote>
<p>You might have been noticing the amount of commits to ports regarding autoconf and nested functions and asking yourself what the hell is this all about?<br>
I was hanging out at my friend Antoine (ajacoutot@)&#39;s place just before EuroBSDCon 2017 started and we were having drinks and he told me that there is this weird bug where Gnome hangs completely after just a couple of seconds of usage and the gnome-shell process just sits in the fsleep state. This started to happen at the time when inteldrm(4) was updated, the default compiler was switched to clang(1) and futexes were turned on by default.<br>
The next day we started to have a look at the issue and since the process was hanging in fsleep, it seemed clear that the cause must be futexes, so we had to start bisecting the base system, which resulted in random success and failure. In the end we figured out that it is neither futex nor inteldrm(4) related, so the only thing that was left is the switch to clang.<br>
Now the problem is that we have to figure out what part of the system needs to be build with clang to trigger this issue, so we kept on going and systematically recompiled the base system with gcc until everything was ruled out  and it kept on hanging.<br>
We were drunk and angry that now we have to go and check hundreds of ports because gnome is not a small standalone port, so between two bottles of wine a build VM was fired up to do a package build with gcc, because manually building all the dependencies would just take too long and we had spent almost two days on this already.<br>
Next day ~200 packages were available to bisect and figure out what&#39;s going on. After a couple of tries it turned out that the hang is being caused by the gtk+3 package, which is bad since almost everything is using gtk+3. Now it was time to figure out what file the gtk+3 source being built by clang is causing the issue. (Compiler optimizations were ruled out already at this point.) So another set of bisecting happened, building each subdirectory of gtk+3 with clang and waiting for the hang to manifest  and it did not. What the $f?<br>
Okay so something else is going on and maybe the configure script of gtk+3 is doing something weird with different compilers, so I quickly did two configure runs with gcc and clang and simply diff&#39;d the two directories. Snippets from the diff:</p>

<p>-GDK_HIDDEN_VISIBILITY_CFLAGS = -fvisibility=hidden<br>
GDK_HIDDEN_VISIBILITY_CFLAGS = </p>

<p>-lt_cv_prog_compiler_rtti_exceptions=no<br>
lt_cv_prog_compiler_rtti_exceptions=yes</p>

<p>-#define <em>GDK_EXTERN __attribute</em>_((visibility(&quot;default&quot;))) extern</p>

<p>-lt_prog_compiler_no_builtin_flag=&#39; -fno-builtin&#39;<br>
+lt_prog_compiler_no_builtin_flag=&#39; -fno-builtin -fno-rtti -fno-exceptions&#39;<br>
Okay, okay that&#39;s something, but wait  clang has symbol visibility support so what is going on again? Let&#39;s take a peek at config.log:</p>

<p>configure:29137: checking for -fvisibility=hidden compiler flag</p>

<p>configure:29150: cc -c -fvisibility=hidden  -I/usr/local/include -I/usr/X11R6/include conftest.c &gt;&amp;5<br>
conftest.c:82:17: error: function definition is not allowed here</p>

<p>int main (void) { return 0; }<br>
              ^<br>
1 error generated.</p>

<p>Okay that&#39;s clearly an error but why exactly? autoconf basically generates a huge shell script that will check for whatever you throw at it by creating a file called conftest.c and putting chunks of code into it and then trying to compile it. In this case the relevant part of the code was:</p>

<blockquote>
<p>| int<br>
| main ()<br>
| {<br>
| int main (void) { return 0; }<br>
|   ;<br>
|   return 0;<br>
| }</p>
</blockquote>

<p>That is a nested function declaration which is a GNU extension and it is not supported by clang, but that&#39;s okay, the question is why the hell would you use nested functions to check for simple compiler flags. The next step was to go and check what is going on in configure.ac to see how the configure script is generated. In the gtk+3 case the following snippet is used:</p>

<pre><code>AC_MSG_CHECKING([for -fvisibility=hidden compiler flag])
</code></pre>

<p>AC_TRY_COMPILE([], [int main (void) { return 0; }],<br>
                  AC_MSG_RESULT(yes)<br>
                  enable_fvisibility_hidden=yes,<br>
                  AC_MSG_RESULT(no)<br>
                  enable_fvisibility_hidden=no)</p>

<p>According to the autoconf manual the AC_TRY_COMPILE macro accepts the following parameters:<br>
That clearly states that a function body has to be specified because the function definition is already provided automatically, so doing AC_TRY_COMPILE([], [int main (void) { return 0;}], instead of AC_TRY_COMPILE([],[] will result in a nested function declaration, which will work just fine with gcc, even though the autoconf usage is wrong.<br>
After fixing the autoconf macro in gtk+3 and rebuilding the complete port from scratch with clang, the hang completely went away as the proper CFLAGS and LDFLAGS were picked up by autoconf for the build.<br>
At this point we realized that most of the ports tree uses autoconf so this issue might be a lot bigger than we thought, so I asked sthen@ to do a grep on the ports object directory and just search for &quot;function definition is not allowed here&quot;, which resulted in about ~60 additional ports affected.<br>
Out of the list of ports there were only two false positive matches. These were actually trying to test whether the compiler supports nested functions. The rest were a combination of several autoconf macros used in a wrong way, e.g: AC_TRY_COMPILE, AC_TRY_LINK. Most of them were fixable by just removing the extra function declaration or by switching to other autoconf macros like AC_LANG_SOURCE where you can actually declare your own functions if need be.<br>
The conclusion is that this issue was a combination of people not reading documentation and just copy/pasting autoconf snippets, instead of reading their documentation and using the macros in the way they were intended, and the fact that switching to a new compiler is never easy and bugs or undefined behaviour are always lurking in the dark.<br>
Thanks to everyone who helped fixing all the ports up this quickly! Hopefully all of the changes can be merged upstream, so that others can benefit as well. </p>

<hr>
</blockquote>

<h2>Interview - David Carlier - <a href="https://twitter.com/devnexen" rel="nofollow">@devnexen</a></h2>

<ul>
<li>Software Engineer at Afilias
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://blog.databasepatterns.com/2017/08/setting-up-openbsds-ldap-server-ldapd.html" rel="nofollow">Setting up OpenBSD&#39;s LDAP Server (ldapd) with StartTLS and SASL</a></h3>

<ul>
<li>A tutorial on setting up OpenBSDs native LDAP server with TLS encryption and SASL authentication</li>
</ul>

<blockquote>
<p>OpenBSD has its own LDAP server, ldapd. Here&#39;s how to configure it for use with StartTLS and SASL authentication<br>
Create a certificate (acme-client anyone?)<br>
Create a basic config file<br>
listen on em0 tls certificate ldapserver</p>
</blockquote>

<ul>
<li>This will listen on the em0 interface with tls using the certificate called ldapserver.crt / ldapserver.key</li>
<li>Validate the configuration:</li>
</ul>

<blockquote>
<p>/usr/sbin/ldapd -n</p>
</blockquote>

<ul>
<li>Enable and start the service:</li>
</ul>

<blockquote>
<p>rcctl enable ldapd<br>
rcctl start ldapd</p>
</blockquote>

<ul>
<li>On the client machine:</li>
</ul>

<blockquote>
<h1>pkg_add openldap-client</h1>
</blockquote>

<ul>
<li>Copy the certificate to /etc/ssl/trusted.crt</li>
<li>Add this line to /etc/openldap/ldap.conf</li>
</ul>

<blockquote>
<p>TLS_CACERT    /etc/ssl/trusted.crt</p>
</blockquote>

<ul>
<li>Enable and start the service</li>
</ul>

<blockquote>
<p>rcctl enable saslauthd<br>
rcctl start saslauthd</p>
</blockquote>

<ul>
<li>Connect to ldapd (-ZZ means force TLS, use -H to specify URI): </li>
</ul>

<blockquote>
<p>ldapsearch -H ldap://ldapserver -ZZ</p>

<hr>
</blockquote>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=324163" rel="nofollow">FreeBSD Picks Up Support for ZFS Channel Programs in -current</a></h3>

<blockquote>
<p>ZFS channel programs (ZCP) adds support for performing compound ZFS administrative actions via Lua scripts in a sandboxed environment (with time and memory limits).<br>
This initial commit includes both base support for running ZCP scripts, and a small initial library of API calls which support getting properties and listing, destroying, and promoting datasets.<br>
Testing: in addition to the included unit tests, channel programs have been in use at Delphix for several months for batch destroying filesystems.</p>
</blockquote>

<ul>
<li><p>Take a simple task as an example: Create a snapshot, then set a property on that snapshot. In the traditional system for this, when you issue the snapshot command, that closes the currently open transaction group (say #100), and opens a new one, #101. While #100 is being written to disk, other writes are accumulated in #101. Once #100 is flushed to disk, the zfs snapshot command returns. You can then issue the zfs set command. This actually ends up going into transaction group #102. Each administrative action needs to wait for the transaction group to flush, which under heavy loads could take multiple seconds. Now if you want to create AND set, you need to wait for two or three transaction groups. Meanwhile, during transaction group #101, the snapshot existed without the property set, which could cause all kinds of side effects.</p></li>
<li><p>ZFS Channel programs solves this by allowing you to perform a small scripted set of actions as a single atomic operation.</p></li>
<li><p>In Delphixs appliance, they often needed to do as many as 15 operations together, which might take multiple minutes. Now with channel programs it is much faster, far safer, and has fewer chances of side effects</p></li>
<li><p><a href="http://www.bsdcan.org/2017/schedule/events/854.en.html" rel="nofollow">BSDCan 2017 - Matt Ahrens: Building products based on OpenZFS, using channel programs -- Video Soon</a></p>

<hr></li>
</ul>

<h3><a href="http://bravenewgeek.com/software-is-about-storytelling/" rel="nofollow">Software Is About Storytelling</a></h3>

<ul>
<li>Tyler Treat writes on the brave new geek blog:</li>
</ul>

<blockquote>
<p>Software engineering is more a practice in archeology than it is in building. As an industry, we undervalue storytelling and focus too much on artifacts and tools and deliverables. How many times have you been left scratching your head while looking at a piece of code, system, or process? Its the story, the legacy left behind by that artifact, that is just as importantif not morethan the artifact itself.<br>
And I dont mean whats in the version control historythats often useless. I mean the real, human story behind something. Artifacts, whether thats code or tools or something else entirely, are not just snapshots in time. Theyre the result of a series of decisions, discussions, mistakes, corrections, problems, constraints, and so on.  Theyre the product of the engineering process, but the problem is they usually dont capture that process in its entirety. They rarely capture it at all. They commonly end up being nothing but a snapshot in time.<br>
Its often the sign of an inexperienced engineer when someone looks at something and says, this is stupid or why are they using X instead of Y? Theyre ignoring the context, the fact that circumstances may have been different. There is a story that led up to that point, a reason for why things are the way they are. If youre lucky, the people involved are still around. Unfortunately, this is not typically the case. And so its not necessarily the poor engineers fault for wondering these things. Their predecessors havent done enough to make that story discoverable and share that context.<br>
I worked at a company that built a homegrown container PaaS on ECS. Doing that today would be insane with the plethora of container solutions available now. Why arent you using Kubernetes? Well, four years ago when we started, Kubernetes didnt exist. Even Docker was just in its infancy. And its not exactly a flick of a switch to move multiple production environments to a new container runtime, not to mention the politicking with leadership to convince them its worth it to not ship any new code for the next quarter as we rearchitect our entire platform. Oh, and now the people behind the original solution are no longer with the company. Good luck! And this is on the timescale of about five years. Thats maybe like one generation of engineers at the company at mostnothing compared to the decades or more software usually lives (an interesting observation is that timescale, I think, is proportional to the size of an organization). Dont underestimate momentum, but also dont underestimate changing circumstances, even on a small time horizon.<br>
The point is, stop looking at technology in a vacuum. There are many facets to consider. Likewise, decisions are not made in a vacuum. Part of this is just being an empathetic engineer. The corollary to this is you dont need to adopt every bleeding-edge tech that comes out to be successful, but the bigger point is software is about storytelling. The question you should be asking is how does your organization tell those stories? Are you deliberate or is it left to tribal knowledge and hearsay? Is it something you truly value and prioritize or simply a byproduct?<br>
Documentation is good, but the trouble with documentation is its usually haphazard and stagnant. Its also usually documentation of how and not why. Documenting intent can go a long way, and understanding the why is a good way to develop empathy. Code survives us. Theres a fantastic talk by Bryan Cantrill on <a href="https://youtu.be/4PaWFYm0kEw" rel="nofollow">oral tradition in software engineering</a> where he talks about this. People care about intent. Specifically, when you write software, people care what you think. As Bryan puts it, future generations of programmers want to understand your intent so they can abide by it, so we need to tell them what our intent was. We need to broadcast it. Good code comments are an example of this. They give you a narrative of not only whats going on, but why. When we write software, we write it for future generations, and thats the most underestimated thing in all of software. Documenting intent also allows you to document your values, and that allows the people who come after you to continue to uphold them.<br>
Storytelling in software is important. Without it, software archeology is simply the study of puzzles created by time and neglect. When an organization doesnt record its history, its bound to repeat the same mistakes. A companys memory is comprised of its people, but the fact is people churn. Knowing how you got here often helps you with getting to where you want to be. Storytelling is how we transcend generational gaps and the inevitable changing of the old guard to the new guard in a maturing engineering organization. The same is true when we expand that to the entire industry. Were too memorylessshipping code and not looking back, discovering everything old that is new again, and simply not appreciating our lineage.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.meetup.com/en-US/BSD-Users-Stockholm/" rel="nofollow">1st BSD Users Stockholm Meetup</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/3020" rel="nofollow">Absolute FreeBSD, 3rd Edition draft completed </a></li>
<li><a href="https://blather.michaelwlucas.com/archives/2995" rel="nofollow">Absolute FreeBSD, 3rd Edition Table of Contents</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20170824193521" rel="nofollow">t2k17 Hackathon Report: My first time (Aaron Bieber)</a></li>
<li><a href="https://www.netgate.com/blog/no-plan-survives-contact-with-the-internet.html" rel="nofollow">The release of pfSense 2.4.0 will be slightly delayed to apply patches for vulnerabilities in 3rd party packages that are part of pfSense</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/1XMJYMH#wrap" rel="nofollow">Ben writes in that zrepl is in ports now</a></li>
<li><a href="http://dpaste.com/334WY4T#wrap" rel="nofollow">Peter asks us about Netflix on BSD</a></li>
<li><a href="http://dpaste.com/3GSGKD3#wrap" rel="nofollow">meka writes in about dhclient exiting</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>215: Turning FreeBSD up to 100 Gbps</title>
  <link>https://www.bsdnow.tv/215</link>
  <guid isPermaLink="false">6b1d62bd-687d-46b1-afc8-3934b133d075</guid>
  <pubDate>Wed, 11 Oct 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6b1d62bd-687d-46b1-afc8-3934b133d075.mp3" length="67385524" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We look at how Netflix serves 100 Gbps from an Open Connect Appliance, read through the 2nd quarter FreeBSD status report, show you a freebsd-update speedup via nginx reverse proxy, and customize your OpenBSD default shell.</itunes:subtitle>
  <itunes:duration>1:33:35</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We look at how Netflix serves 100 Gbps from an Open Connect Appliance, read through the 2nd quarter FreeBSD status report, show you a freebsd-update speedup via nginx reverse proxy, and customize your OpenBSD default shell.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Serving 100 Gbps from an Open Connect Appliance (https://medium.com/netflix-techblog/serving-100-gbps-from-an-open-connect-appliance-cdb51dda3b99)
In the summer of 2015, the Netflix Open Connect CDN team decided to take on an ambitious project. The goal was to leverage the new 100GbE network interface technology just coming to market in order to be able to serve at 100 Gbps from a single FreeBSD-based Open Connect Appliance (OCA) using NVM Express (NVMe)-based storage.
At the time, the bulk of our flash storage-based appliances were close to being CPU limited serving at 40 Gbps using single-socket Xeon E5–2697v2. The first step was to find the CPU bottlenecks in the existing platform while we waited for newer CPUs from Intel, newer motherboards with PCIe Gen3 x16 slots that could run the new Mellanox 100GbE NICs at full speed, and for systems with NVMe drives.
Fake NUMA
Normally, most of an OCA’s content is served from disk, with only 10–20% of the most popular titles being served from memory (see our previous blog, Content Popularity for Open Connect (https://medium.com/@NetflixTechBlog/content-popularity-for-open-connect-b86d56f613b) for details). However, our early pre-NVMe prototypes were limited by disk bandwidth. So we set up a contrived experiment where we served only the very most popular content on a test server. This allowed all content to fit in RAM and therefore avoid the temporary disk bottleneck. Surprisingly, the performance actually dropped from being CPU limited at 40 Gbps to being CPU limited at only 22 Gbps!
The ultimate solution we came up with is what we call “Fake NUMA”. This approach takes advantage of the fact that there is one set of page queues per NUMA domain. All we had to do was to lie to the system and tell it that we have one Fake NUMA domain for every 2 CPUs. After we did this, our lock contention nearly disappeared and we were able to serve at 52 Gbps (limited by the PCIe Gen3 x8 slot) with substantial CPU idle time.
After we had newer prototype machines, with an Intel Xeon E5 2697v3 CPU, PCIe Gen3 x16 slots for 100GbE NIC, and more disk storage (4 NVMe or 44 SATA SSD drives), we hit another bottleneck, also related to a lock on a global list. We were stuck at around 60 Gbps on this new hardware, and we were constrained by pbufs.
Our first problem was that the list was too small. We were spending a lot of time waiting for pbufs. This was easily fixed by increasing the number of pbufs allocated at boot time by increasing the kern.nswbuf tunable. However, this update revealed the next problem, which was lock contention on the global pbuf mutex. To solve this, we changed the vnode pager (which handles paging to files, rather than the swap partition, and hence handles all sendfile() I/O) to use the normal kernel zone allocator. This change removed the lock contention, and boosted our performance into the 70 Gbps range.
As noted above, we make heavy use of the VM page queues, especially the inactive queue. Eventually, the system runs short of memory and these queues need to be scanned by the page daemon to free up memory. At full load, this was happening roughly twice per minute. When this happened, all NGINX processes would go to sleep in vm_wait() and the system would stop serving traffic while the pageout daemon worked to scan pages, often for several seconds. This problem is actually made progressively worse as one adds NUMA domains, because there is one pageout daemon per NUMA domain, but the page deficit that it is trying to clear is calculated globally. So if the vm pageout daemon decides to clean, say 1GB of memory and there are 16 domains, each of the 16 pageout daemons will individually attempt to clean 1GB of memory.
To solve this problem, we decided to proactively scan the VM page queues. In the sendfile path, when allocating a page for I/O, we run the pageout code several times per second on each VM domain. The pageout code is run in its lightest-weight mode in the context of one unlucky NGINX process. Other NGINX processes continue to run and serve traffic while this is happening, so we can avoid bursts of pager activity that blocks traffic serving. Proactive scanning allowed us to serve at roughly 80 Gbps on the prototype hardware.
Hans Petter Selasky, Mellanox’s 100GbE driver developer, came up with an innovative solution to our problem. Most modern NICs will supply an Receive Side Scaling (RSS) hash result to the host. RSS is a standard developed by Microsoft wherein TCP/IP traffic is hashed by source and destination IP address and/or TCP source and destination ports. The RSS hash result will almost always uniquely identify a TCP connection. Hans’ idea was that rather than just passing the packets to the LRO engine as they arrive from the network, we should hold the packets in a large batch, and then sort the batch of packets by RSS hash result (and original time of arrival, to keep them in order). After the packets are sorted, packets from the same connection are adjacent even when they arrive widely separated in time. Therefore, when the packets are passed to the FreeBSD LRO routine, it can aggregate them.
With this new LRO code, we were able to achieve an LRO aggregation rate of over 2 packets per aggregation, and were able to serve at well over 90 Gbps for the first time on our prototype hardware for mostly unencrypted traffic. So the job was done. Or was it? The next goal was to achieve 100 Gbps while serving only TLS-encrypted streams. By this point, we were using hardware which closely resembles today’s 100GbE flash storage-based OCAs: four NVMe PCIe Gen3 x4 drives, 100GbE ethernet, Xeon E5v4 2697A CPU. With the improvements described in the Protecting Netflix Viewing Privacy at Scale blog entry, we were able to serve TLS-only traffic at roughly 58 Gbps.
In the lock contention problems we’d observed above, the cause of any increased CPU use was relatively apparent from normal system level tools like flame graphs, DTrace, or lockstat. The 58 Gbps limit was comparatively strange. As before, the CPU use would increase linearly as we approached the 58 Gbps limit, but then as we neared the limit, the CPU use would increase almost exponentially. Flame graphs just showed everything taking longer, with no apparent hotspots. We finally had a hunch that we were limited by our system’s memory bandwidth. We used the Intel® Performance Counter Monitor Tools to measure the memory bandwidth we were consuming at peak load. We then wrote a simple memory thrashing benchmark that used one thread per core to copy between large memory chunks that did not fit into cache. According to the PCM tools, this benchmark consumed the same amount of memory bandwidth as our OCA’s TLS-serving workload. So it was clear that we were memory limited. At this point, we became focused on reducing memory bandwidth usage. To assist with this, we began using the Intel VTune profiling tools to identify memory loads and stores, and to identify cache misses.
Because we are using sendfile() to serve data, encryption is done from the virtual memory page cache into connection-specific encryption buffers. This preserves the normal FreeBSD page cache in order to allow serving of hot data from memory to many connections. One of the first things that stood out to us was that the ISA-L encryption library was using half again as much memory bandwidth for memory reads as it was for memory writes. From looking at VTune profiling information, we saw that ISA-L was somehow reading both the source and destination buffers, rather than just writing to the destination buffer. We realized that this was because the AVX instructions used by ISA-L for encryption on our CPUs worked on 256-bit (32-byte) quantities, whereas the cache line size was 512-bits (64 bytes)?—?thus triggering the system to do read-modify-writes when data was written. The problem is that the the CPU will normally access the memory system in 64 byte cache line-sized chunks, reading an entire 64 bytes to access even just a single byte. After a quick email exchange with the ISA-L team, they provided us with a new version of the library that used non-temporal instructions when storing encryption results. Non-temporals bypass the cache, and allow the CPU direct access to memory. This meant that the CPU was no longer reading from the destination buffers, and so this increased our bandwidth from 58 Gbps to 65 Gbps.
At 100 Gbps, we’re moving about 12.5 GB/s of 4K pages through our system unencrypted. Adding encryption doubles that to 25 GB/s worth of 4K pages. That’s about 6.25 Million mbufs per second. When you add in the extra 2 mbufs used by the crypto code for TLS metadata at the beginning and end of each TLS record, that works out to another 1.6M mbufs/sec, for a total of about 8M mbufs/second. With roughly 2 cache line accesses per mbuf, that’s 128 bytes * 8M, which is 1 GB/s (8 Gbps) of data that is accessed at multiple layers of the stack (alloc, free, crypto, TCP, socket buffers, drivers, etc).
At this point, we’re able to serve 100% TLS traffic comfortably at 90 Gbps using the default FreeBSD TCP stack. However, the goalposts keep moving. We’ve found that when we use more advanced TCP algorithms, such as RACK and BBR, we are still a bit short of our goal. We have several ideas that we are currently pursuing, which range from optimizing the new TCP code to increasing the efficiency of LRO to trying to do encryption closer to the transfer of the data (either from the disk, or to the NIC) so as to take better advantage of Intel’s DDIO and save memory bandwidth.
FreeBSD April to June 2017 Status Report (https://www.freebsd.org/news/status/report-2017-04-2017-06.html)
&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-Team-Reports"&gt;FreeBSD Team Reports&lt;/a&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-Release-Engineering-Team"&gt;FreeBSD Release Engineering Team&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Ports-Collection"&gt;Ports Collection&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#The-FreeBSD-Core-Team"&gt;The FreeBSD Core Team&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#The-FreeBSD-Foundation"&gt;The FreeBSD Foundation&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#The-Postmaster-Team"&gt;The Postmaster Team&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Projects"&gt;Projects&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#64-bit-Inode-Numbers"&gt;64-bit Inode Numbers&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Capability-Based-Network-Communication-for-Capsicum/CloudABI"&gt;Capability-Based Network Communication for Capsicum/CloudABI&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Ceph-on-FreeBSD"&gt;Ceph on FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#DTS-Updates"&gt;DTS Updates&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Kernel"&gt;Kernel&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Coda-revival"&gt;Coda revival&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-Driver-for-the-Annapurna-Labs-ENA"&gt;FreeBSD Driver for the Annapurna Labs ENA&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Intel-10G-Driver-Update"&gt;Intel 10G Driver Update&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#pNFS-Server-Plan-B"&gt;pNFS Server Plan B&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Architectures"&gt;Architectures&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-on-Marvell-Armada38x"&gt;FreeBSD on Marvell Armada38x&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD/arm64"&gt;FreeBSD/arm64&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Userland-Programs"&gt;Userland Programs&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#DTC"&gt;DTC&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Using-LLVM's-LLD-Linker-as-FreeBSD's-System-Linker"&gt;Using LLVM's LLD Linker as FreeBSD's System Linker&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Ports"&gt;Ports&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#A-New-USES-Macro-for-Porting-Cargo-Based-Rust-Applications"&gt;A New USES Macro for Porting Cargo-Based Rust Applications&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#GCC-(GNU-Compiler-Collection)"&gt;GCC (GNU Compiler Collection)&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#GNOME-on-FreeBSD"&gt;GNOME on FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#KDE-on-FreeBSD"&gt;KDE on FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#New-Port:-FRRouting"&gt;New Port: FRRouting&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#PHP-Ports:-Help-Improving-QA"&gt;PHP Ports: Help Improving QA&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Rust"&gt;Rust&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#sndio-Support-in-the-FreeBSD-Ports-Collection"&gt;sndio Support in the FreeBSD Ports Collection&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#TensorFlow"&gt;TensorFlow&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Updating-Port-Metadata-for-non-x86-Architectures"&gt;Updating Port Metadata for non-x86 Architectures&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Xfce-on-FreeBSD"&gt;Xfce on FreeBSD&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Documentation"&gt;Documentation&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Absolute-FreeBSD,-3rd-Edition"&gt;Absolute FreeBSD, 3rd Edition&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Doc-Version-Strings-Improved-by-Their-Absence"&gt;Doc Version Strings Improved by Their Absence&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#New-Xen-Handbook-Section"&gt;New Xen Handbook Section&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Miscellaneous"&gt;Miscellaneous&lt;/a&gt;&lt;/h3&gt;
&lt;ul&gt;&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#BSD-Meetups-at-Rennes-(France)"&gt;BSD Meetups at Rennes (France)&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;
&lt;h3&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.htmlThird-Party-Projects"&gt;Third-Party Projects&lt;/a&gt;&lt;/h3&gt;
&lt;ul&gt;&lt;li&gt;&lt;a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#HardenedBSD"&gt;HardenedBSD&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;
DPDK, VPP, and the future of pfSense @ the DPDK Summit (https://www.pscp.tv/DPDKProject/1dRKZnleWbmKB?t=5h1m0s)
The DPDK (Data Plane Development Kit) conference included a short update from the pfSense project
The video starts with a quick introduction to pfSense and the company behind it
It covers the issues they ran into trying to scale to 10gbps and beyond, and some of the solutions they tried: libuinet, netmap, packet-journey
Then they discovered VPP (Vector Packet Processing)
The video then covers the architecture of the new pfSense
pfSense has launched of EC2, on Azure soon, and will launch support for the new Atom C3000 and Xeon hardware with built-in QAT (Quick-Assist crypto offload) in November
The future: 100gbps, MPLS, VXLANs, and ARM64 hardware support
***
News Roundup
Local nginx reverse proxy cache for freebsd-update (https://wiki.freebsd.org/VladimirKrstulja/Guides/FreeBSDUpdateReverseProxy)
Vladimir Krstulja has created this interesting tutorial on the FreeBSD wiki about a freebsd-update reverse proxy cache
Either because you're a good netizen and don't want to repeatedly hammer the FreeBSD mirrors to upgrade all your systems, or you want to benefit from the speed of having a local "mirror" (cache, more precisely), running a freebsd update reverse proxy cache with, say, nginx is dead simple.
1. Install nginx somewhere
2. Configure nginx for a subdomain, say, freebsd-update.example.com
3. On all your hosts, in all your jails, configure /etc/freebsd-update.conf for new ServerName
And... that's it. Running freebsd-update will use the ServerName domain which is your reverse nginx proxy. Note the comment about using a "nearby" server is not quite true. FreeBSD update mirrors are frequently slow and running such a reverse proxy cache significantly speeds things up.
Caveats: This is a simple cache. That means it doesn't consider the files as a whole repository, which in turn means updates to your cache are not atomic. It'd be advised to nuke your cache before your update run, as its point is only to retain the files in a local cache for some short period of time required for all your machines to be updated.
ClonOS is a free, open-source FreeBSD-based platform for virtual environment creation and management (https://clonos.tekroutine.com/)
The operating system uses FreeBSD's development branch (12.0-CURRENT) as its base. ClonOS uses ZFS as the default file system and includes web-based administration tools for managing virtual machines and jails. The project's website also mentions the availability of templates for quickly setting up new containers and web-based VNC access to jails. Puppet, we are told, can be used for configuration management.
ClonOS can be downloaded as a disk image file (IMG) or as an optical media image (ISO). I downloaded the ISO file which is 1.6GB in size. Booting from ClonOS's media displays a text console asking us to select the type of text terminal we are using. There are four options and most people can probably safely take the default, xterm, option.
The operating system, on the surface, appears to be a full installation of FreeBSD 12. The usual collection of FreeBSD packages are available, including manual pages, a compiler and the typical selection of UNIX command line utilities. The operating system uses ZFS as its file system and uses approximately 3.3GB of disk space. ClonOS requires about 50MB of active memory and 143MB of wired memory before any services or jails are created.
Most of the key features of ClonOS, the parts which set it apart from vanilla FreeBSD, can be accessed through a web-based control panel. When we connect to this control panel, over a plain HTTP connection, using our web browser, we are not prompted for an account name or password. The web-based interface has a straight forward layout. Down the left side of the browser window we find categories of options and controls. Over on the right side of the window are the specific options or controls available in the selected category. At the top of the page there is a drop-down menu where we can toggle the displayed language between English and Russian, with English being the default.
There are twelve option screens we can access in the ClonOS interface and I want to quickly give a summary of each one:
Overview - this page shows a top-level status summary. The page lists the number of jails and nodes in the system. We are also shown the number of available CPU cores and available RAM on the system.
Jail containers - this page allows us to create and delete jails. We can also change some basic jail settings on this page, adjusting the network configuration and hostname. Plus we can click a button to open a VNC window that allows us to access the jail's command line interface.
Template for jails - provides a list of available jail templates. Each template is listed with its name and a brief description. For example, we have a Wordpress template and a bittorrent template. We can click a listed template to create a new jail with a vanilla installation of the selected software included. We cannot download or create new templates from this page.
Bhyve VMs - this page is very much like the Jails containers page, but concerns the creation of new virtual machines and managing them.
Virtual Private Network - allows for the management of subnets
Authkeys - upload security keys for something, but it is not clear for what these keys will be used.
Storage media - upload ISO files that will be used when creating virtual machines and installing an operating system in the new virtual environment.
FreeBSD Bases - I think this page downloads and builds source code for alternative versions of FreeBSD, but I am unsure and could not find any associated documentation for this page.
FreeBSD Sources - download source code for various versions of FreeBSD.
TaskLog - browse logs of events, particularly actions concerning jails.
SQLite admin - this page says it will open an interface for managing a SQLite database. Clicking link on the page gives a file not found error.
Settings - this page simply displays a message saying the settings page has not been implemented yet.
While playing with ClonOS, I wanted to perform a couple of simple tasks. I wanted to use the Wordpress template to set up a blog inside a jail. I wanted a generic, empty jail in which I could play and run commands without harming the rest of the operating system. I also wanted to try installing an operating system other than FreeBSD inside a Bhyve virtual environment. I thought this would give me a pretty good idea of how quick and easy ClonOS would make common tasks.
Conclusions
ClonOS appears to be in its early stages of development, more of a feature preview or proof-of-concept than a polished product. A few of the settings pages have not been finished yet, the web-based controls for jails are unable to create jails that connect to the network and I was unable to upload even small ISO files to create virtual machines.
The project's website mentions working with Puppet to handle system configuration, but I did not encounter any Puppet options. There also does not appear to be any documentation on using Puppet on the ClonOS platform.
One of the biggest concerns I had was the lack of security on ClonOS. The web-based control panel and terminal both automatically login as the root user. Passwords we create for our accounts are ignored and we cannot logout of the local terminal. This means anyone with physical access to the server automatically gains root access and, in addition, anyone on our local network gets access to the web-based admin panel. As it stands, it would not be safe to install ClonOS on a shared network.
Some of the ideas present are good ones. I like the idea of jail templates and have used them on other systems. The graphical Bhyve tools could be useful too, if the limitations of the ISO manager are sorted out. But right now, ClonOS still has a way to go before it is likely to be safe or practical to use.
Customize ksh display for OpenBSD (http://nanxiao.me/en/customize-ksh-display-for-openbsd/)
The default shell for OpenBSD is ksh, and it looks a little monotonous.
To make its user-experience more friendly, I need to do some customizations:
(1) Modify the “Prompt String” to display the user name and current directory:
PS1='$USER:$PWD# '
(2) Install colorls package:
pkg_add colorls
Use it to replace the shipped ls command:
alias ls='colorls -G'
(3) Change LSCOLORS environmental variable to make your favorite color. For example, I don’t want the directory is displayed in default blue, change it to magenta:
LSCOLORS=fxexcxdxbxegedabagacad
For detailed explanation of LSCOLORS, please refer manual of colorls.
This is my final modification of .profile:
PS1='$USER:$PWD# '
export PS1
LSCOLORS=fxexcxdxbxegedabagacad
export LSCOLORS
alias ls='colorls -G'
DragonFly 5 release candidate (https://www.dragonflydigest.com/2017/10/02/20295.html)
Commit (http://lists.dragonflybsd.org/pipermail/commits/2017-September/626463.html)
I tagged DragonFly 5.0 (commit message list in that link) over the weekend, and there’s a 5.0 release candidate for download (http://mirror-master.dragonflybsd.org/iso-images/).
It’s RC2 because the recent Radeon changes had to be taken out. (http://lists.dragonflybsd.org/pipermail/commits/2017-September/626476.html)
Beastie Bits
Faster forwarding (http://www.grenadille.net/post/2017/08/21/Faster-forwarding)
DRM-Next-Kmod hits the ports tree (http://www.freshports.org/graphics/drm-next-kmod/)
OpenBSD Community Goes Platinum (https://undeadly.org/cgi?action=article;sid=20170829025446)
Setting up iSCSI on TrueOS and FreeBSD12 (https://www.youtube.com/watch?v=4myESLZPXBU)
***
Feedback/Questions
Christopher - Virtualizing FreeNAS (http://dpaste.com/38G99CK#wrap)
Van - Tar Question (http://dpaste.com/3MEPD3S#wrap)
Joe - Book Reviews (http://dpaste.com/0T623Z6#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We look at how Netflix serves 100 Gbps from an Open Connect Appliance, read through the 2nd quarter FreeBSD status report, show you a freebsd-update speedup via nginx reverse proxy, and customize your OpenBSD default shell.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://medium.com/netflix-techblog/serving-100-gbps-from-an-open-connect-appliance-cdb51dda3b99" rel="nofollow">Serving 100 Gbps from an Open Connect Appliance</a></h3>

<blockquote>
<p>In the summer of 2015, the Netflix Open Connect CDN team decided to take on an ambitious project. The goal was to leverage the new 100GbE network interface technology just coming to market in order to be able to serve at 100 Gbps from a single FreeBSD-based Open Connect Appliance (OCA) using NVM Express (NVMe)-based storage.<br>
At the time, the bulk of our flash storage-based appliances were close to being CPU limited serving at 40 Gbps using single-socket Xeon E52697v2. The first step was to find the CPU bottlenecks in the existing platform while we waited for newer CPUs from Intel, newer motherboards with PCIe Gen3 x16 slots that could run the new Mellanox 100GbE NICs at full speed, and for systems with NVMe drives.</p>
</blockquote>

<ul>
<li>Fake NUMA</li>
</ul>

<blockquote>
<p>Normally, most of an OCAs content is served from disk, with only 1020% of the most popular titles being served from memory (see our previous blog, <a href="https://medium.com/@NetflixTechBlog/content-popularity-for-open-connect-b86d56f613b" rel="nofollow">Content Popularity for Open Connect</a> for details). However, our early pre-NVMe prototypes were limited by disk bandwidth. So we set up a contrived experiment where we served only the very most popular content on a test server. This allowed all content to fit in RAM and therefore avoid the temporary disk bottleneck. Surprisingly, the performance actually dropped from being CPU limited at 40 Gbps to being CPU limited at only 22 Gbps!<br>
The ultimate solution we came up with is what we call Fake NUMA. This approach takes advantage of the fact that there is one set of page queues per NUMA domain. All we had to do was to lie to the system and tell it that we have one Fake NUMA domain for every 2 CPUs. After we did this, our lock contention nearly disappeared and we were able to serve at 52 Gbps (limited by the PCIe Gen3 x8 slot) with substantial CPU idle time.<br>
After we had newer prototype machines, with an Intel Xeon E5 2697v3 CPU, PCIe Gen3 x16 slots for 100GbE NIC, and more disk storage (4 NVMe or 44 SATA SSD drives), we hit another bottleneck, also related to a lock on a global list. We were stuck at around 60 Gbps on this new hardware, and we were constrained by pbufs.<br>
Our first problem was that the list was too small. We were spending a lot of time waiting for pbufs. This was easily fixed by increasing the number of pbufs allocated at boot time by increasing the kern.nswbuf tunable. However, this update revealed the next problem, which was lock contention on the global pbuf mutex. To solve this, we changed the vnode pager (which handles paging to files, rather than the swap partition, and hence handles all sendfile() I/O) to use the normal kernel zone allocator. This change removed the lock contention, and boosted our performance into the 70 Gbps range.<br>
As noted above, we make heavy use of the VM page queues, especially the inactive queue. Eventually, the system runs short of memory and these queues need to be scanned by the page daemon to free up memory. At full load, this was happening roughly twice per minute. When this happened, all NGINX processes would go to sleep in vm_wait() and the system would stop serving traffic while the pageout daemon worked to scan pages, often for several seconds. This problem is actually made progressively worse as one adds NUMA domains, because there is one pageout daemon per NUMA domain, but the page deficit that it is trying to clear is calculated globally. So if the vm pageout daemon decides to clean, say 1GB of memory and there are 16 domains, each of the 16 pageout daemons will individually attempt to clean 1GB of memory.<br>
To solve this problem, we decided to proactively scan the VM page queues. In the sendfile path, when allocating a page for I/O, we run the pageout code several times per second on each VM domain. The pageout code is run in its lightest-weight mode in the context of one unlucky NGINX process. Other NGINX processes continue to run and serve traffic while this is happening, so we can avoid bursts of pager activity that blocks traffic serving. Proactive scanning allowed us to serve at roughly 80 Gbps on the prototype hardware.<br>
Hans Petter Selasky, Mellanoxs 100GbE driver developer, came up with an innovative solution to our problem. Most modern NICs will supply an Receive Side Scaling (RSS) hash result to the host. RSS is a standard developed by Microsoft wherein TCP/IP traffic is hashed by source and destination IP address and/or TCP source and destination ports. The RSS hash result will almost always uniquely identify a TCP connection. Hans idea was that rather than just passing the packets to the LRO engine as they arrive from the network, we should hold the packets in a large batch, and then sort the batch of packets by RSS hash result (and original time of arrival, to keep them in order). After the packets are sorted, packets from the same connection are adjacent even when they arrive widely separated in time. Therefore, when the packets are passed to the FreeBSD LRO routine, it can aggregate them.<br>
With this new LRO code, we were able to achieve an LRO aggregation rate of over 2 packets per aggregation, and were able to serve at well over 90 Gbps for the first time on our prototype hardware for mostly unencrypted traffic. So the job was done. Or was it? The next goal was to achieve 100 Gbps while serving only TLS-encrypted streams. By this point, we were using hardware which closely resembles todays 100GbE flash storage-based OCAs: four NVMe PCIe Gen3 x4 drives, 100GbE ethernet, Xeon E5v4 2697A CPU. With the improvements described in the Protecting Netflix Viewing Privacy at Scale blog entry, we were able to serve TLS-only traffic at roughly 58 Gbps.<br>
In the lock contention problems wed observed above, the cause of any increased CPU use was relatively apparent from normal system level tools like flame graphs, DTrace, or lockstat. The 58 Gbps limit was comparatively strange. As before, the CPU use would increase linearly as we approached the 58 Gbps limit, but then as we neared the limit, the CPU use would increase almost exponentially. Flame graphs just showed everything taking longer, with no apparent hotspots. We finally had a hunch that we were limited by our systems memory bandwidth. We used the Intel® Performance Counter Monitor Tools to measure the memory bandwidth we were consuming at peak load. We then wrote a simple memory thrashing benchmark that used one thread per core to copy between large memory chunks that did not fit into cache. According to the PCM tools, this benchmark consumed the same amount of memory bandwidth as our OCAs TLS-serving workload. So it was clear that we were memory limited. At this point, we became focused on reducing memory bandwidth usage. To assist with this, we began using the Intel VTune profiling tools to identify memory loads and stores, and to identify cache misses.<br>
Because we are using sendfile() to serve data, encryption is done from the virtual memory page cache into connection-specific encryption buffers. This preserves the normal FreeBSD page cache in order to allow serving of hot data from memory to many connections. One of the first things that stood out to us was that the ISA-L encryption library was using half again as much memory bandwidth for memory reads as it was for memory writes. From looking at VTune profiling information, we saw that ISA-L was somehow reading both the source and destination buffers, rather than just writing to the destination buffer. We realized that this was because the AVX instructions used by ISA-L for encryption on our CPUs worked on 256-bit (32-byte) quantities, whereas the cache line size was 512-bits (64 bytes)??thus triggering the system to do read-modify-writes when data was written. The problem is that the the CPU will normally access the memory system in 64 byte cache line-sized chunks, reading an entire 64 bytes to access even just a single byte. After a quick email exchange with the ISA-L team, they provided us with a new version of the library that used non-temporal instructions when storing encryption results. Non-temporals bypass the cache, and allow the CPU direct access to memory. This meant that the CPU was no longer reading from the destination buffers, and so this increased our bandwidth from 58 Gbps to 65 Gbps.<br>
At 100 Gbps, were moving about 12.5 GB/s of 4K pages through our system unencrypted. Adding encryption doubles that to 25 GB/s worth of 4K pages. Thats about 6.25 Million mbufs per second. When you add in the extra 2 mbufs used by the crypto code for TLS metadata at the beginning and end of each TLS record, that works out to another 1.6M mbufs/sec, for a total of about 8M mbufs/second. With roughly 2 cache line accesses per mbuf, thats 128 bytes * 8M, which is 1 GB/s (8 Gbps) of data that is accessed at multiple layers of the stack (alloc, free, crypto, TCP, socket buffers, drivers, etc).<br>
At this point, were able to serve 100% TLS traffic comfortably at 90 Gbps using the default FreeBSD TCP stack. However, the goalposts keep moving. Weve found that when we use more advanced TCP algorithms, such as RACK and BBR, we are still a bit short of our goal. We have several ideas that we are currently pursuing, which range from optimizing the new TCP code to increasing the efficiency of LRO to trying to do encryption closer to the transfer of the data (either from the disk, or to the NIC) so as to take better advantage of Intels DDIO and save memory bandwidth.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html" rel="nofollow">FreeBSD April to June 2017 Status Report</a></h3>

<p><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-Team-Reports">FreeBSD Team Reports</a><br>
</h3><ul><li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-Release-Engineering-Team">FreeBSD Release Engineering Team</a></li><br>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Ports-Collection">Ports Collection</a></li><br>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#The-FreeBSD-Core-Team">The FreeBSD Core Team</a></li><br>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#The-FreeBSD-Foundation">The FreeBSD Foundation</a></li><br>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#The-Postmaster-Team">The Postmaster Team</a></li></ul></p>

<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Projects">Projects</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#64-bit-Inode-Numbers">64-bit Inode Numbers</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Capability-Based-Network-Communication-for-Capsicum/CloudABI">Capability-Based Network Communication for Capsicum/CloudABI</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Ceph-on-FreeBSD">Ceph on FreeBSD</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#DTS-Updates">DTS Updates</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Kernel">Kernel</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Coda-revival">Coda revival</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-Driver-for-the-Annapurna-Labs-ENA">FreeBSD Driver for the Annapurna Labs ENA</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Intel-10G-Driver-Update">Intel 10G Driver Update</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#pNFS-Server-Plan-B">pNFS Server Plan B</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Architectures">Architectures</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-on-Marvell-Armada38x">FreeBSD on Marvell Armada38x</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD/arm64">FreeBSD/arm64</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Userland-Programs">Userland Programs</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#DTC">DTC</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Using-LLVM's-LLD-Linker-as-FreeBSD's-System-Linker">Using LLVM's LLD Linker as FreeBSD's System Linker</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Ports">Ports</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#A-New-USES-Macro-for-Porting-Cargo-Based-Rust-Applications">A New USES Macro for Porting Cargo-Based Rust Applications</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#GCC-(GNU-Compiler-Collection)">GCC (GNU Compiler Collection)</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#GNOME-on-FreeBSD">GNOME on FreeBSD</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#KDE-on-FreeBSD">KDE on FreeBSD</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#New-Port:-FRRouting">New Port: FRRouting</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#PHP-Ports:-Help-Improving-QA">PHP Ports: Help Improving QA</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Rust">Rust</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#sndio-Support-in-the-FreeBSD-Ports-Collection">sndio Support in the FreeBSD Ports Collection</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#TensorFlow">TensorFlow</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Updating-Port-Metadata-for-non-x86-Architectures">Updating Port Metadata for non-x86 Architectures</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Xfce-on-FreeBSD">Xfce on FreeBSD</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Documentation">Documentation</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Absolute-FreeBSD,-3rd-Edition">Absolute FreeBSD, 3rd Edition</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Doc-Version-Strings-Improved-by-Their-Absence">Doc Version Strings Improved by Their Absence</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#New-Xen-Handbook-Section">New Xen Handbook Section</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Miscellaneous">Miscellaneous</a></h3>

<ul><li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#BSD-Meetups-at-Rennes-(France)">BSD Meetups at Rennes (France)</a></li></ul>

<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.htmlThird-Party-Projects">Third-Party Projects</a></h3>

<ul><li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#HardenedBSD">HardenedBSD</a></li></ul>

<hr>

<h3><a href="https://www.pscp.tv/DPDKProject/1dRKZnleWbmKB?t=5h1m0s" rel="nofollow">DPDK, VPP, and the future of pfSense @ the DPDK Summit</a></h3>

<ul>
<li>The DPDK (Data Plane Development Kit) conference included a short update from the pfSense project</li>
<li>The video starts with a quick introduction to pfSense and the company behind it</li>
<li>It covers the issues they ran into trying to scale to 10gbps and beyond, and some of the solutions they tried: libuinet, netmap, packet-journey</li>
<li>Then they discovered VPP (Vector Packet Processing)</li>
<li>The video then covers the architecture of the new pfSense</li>
<li>pfSense has launched of EC2, on Azure soon, and will launch support for the new Atom C3000 and Xeon hardware with built-in QAT (Quick-Assist crypto offload) in November</li>
<li>The future: 100gbps, MPLS, VXLANs, and ARM64 hardware support
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://wiki.freebsd.org/VladimirKrstulja/Guides/FreeBSDUpdateReverseProxy" rel="nofollow">Local nginx reverse proxy cache for freebsd-update</a></h3>

<ul>
<li>Vladimir Krstulja has created this interesting tutorial on the FreeBSD wiki about a freebsd-update reverse proxy cache</li>
</ul>

<blockquote>
<p>Either because you&#39;re a good netizen and don&#39;t want to repeatedly hammer the FreeBSD mirrors to upgrade all your systems, or you want to benefit from the speed of having a local &quot;mirror&quot; (cache, more precisely), running a freebsd update reverse proxy cache with, say, nginx is dead simple.</p>

<ol>
<li>Install nginx somewhere</li>
<li>Configure nginx for a subdomain, say, freebsd-update.example.com</li>
<li>On all your hosts, in all your jails, configure /etc/freebsd-update.conf for new ServerName
And... that&#39;s it. Running freebsd-update will use the ServerName domain which is your reverse nginx proxy. Note the comment about using a &quot;nearby&quot; server is not quite true. FreeBSD update mirrors are frequently slow and running such a reverse proxy cache significantly speeds things up.
Caveats: This is a simple cache. That means it doesn&#39;t consider the files as a whole repository, which in turn means updates to your cache are not atomic. It&#39;d be advised to nuke your cache before your update run, as its point is only to retain the files in a local cache for some short period of time required for all your machines to be updated.
***</li>
</ol>
</blockquote>

<h3><a href="https://clonos.tekroutine.com/" rel="nofollow">ClonOS is a free, open-source FreeBSD-based platform for virtual environment creation and management</a></h3>

<blockquote>
<p>The operating system uses FreeBSD&#39;s development branch (12.0-CURRENT) as its base. ClonOS uses ZFS as the default file system and includes web-based administration tools for managing virtual machines and jails. The project&#39;s website also mentions the availability of templates for quickly setting up new containers and web-based VNC access to jails. Puppet, we are told, can be used for configuration management.<br>
ClonOS can be downloaded as a disk image file (IMG) or as an optical media image (ISO). I downloaded the ISO file which is 1.6GB in size. Booting from ClonOS&#39;s media displays a text console asking us to select the type of text terminal we are using. There are four options and most people can probably safely take the default, xterm, option.<br>
The operating system, on the surface, appears to be a full installation of FreeBSD 12. The usual collection of FreeBSD packages are available, including manual pages, a compiler and the typical selection of UNIX command line utilities. The operating system uses ZFS as its file system and uses approximately 3.3GB of disk space. ClonOS requires about 50MB of active memory and 143MB of wired memory before any services or jails are created.<br>
Most of the key features of ClonOS, the parts which set it apart from vanilla FreeBSD, can be accessed through a web-based control panel. When we connect to this control panel, over a plain HTTP connection, using our web browser, we are not prompted for an account name or password. The web-based interface has a straight forward layout. Down the left side of the browser window we find categories of options and controls. Over on the right side of the window are the specific options or controls available in the selected category. At the top of the page there is a drop-down menu where we can toggle the displayed language between English and Russian, with English being the default.<br>
There are twelve option screens we can access in the ClonOS interface and I want to quickly give a summary of each one:</p>
</blockquote>

<ul>
<li>Overview - this page shows a top-level status summary. The page lists the number of jails and nodes in the system. We are also shown the number of available CPU cores and available RAM on the system.</li>
<li>Jail containers - this page allows us to create and delete jails. We can also change some basic jail settings on this page, adjusting the network configuration and hostname. Plus we can click a button to open a VNC window that allows us to access the jail&#39;s command line interface.</li>
<li>Template for jails - provides a list of available jail templates. Each template is listed with its name and a brief description. For example, we have a Wordpress template and a bittorrent template. We can click a listed template to create a new jail with a vanilla installation of the selected software included. We cannot download or create new templates from this page.</li>
<li>Bhyve VMs - this page is very much like the Jails containers page, but concerns the creation of new virtual machines and managing them.</li>
<li>Virtual Private Network - allows for the management of subnets</li>
<li>Authkeys - upload security keys for something, but it is not clear for what these keys will be used.</li>
<li>Storage media - upload ISO files that will be used when creating virtual machines and installing an operating system in the new virtual environment.</li>
<li>FreeBSD Bases - I think this page downloads and builds source code for alternative versions of FreeBSD, but I am unsure and could not find any associated documentation for this page.</li>
<li>FreeBSD Sources - download source code for various versions of FreeBSD.</li>
<li>TaskLog - browse logs of events, particularly actions concerning jails.</li>
<li>SQLite admin - this page says it will open an interface for managing a SQLite database. Clicking link on the page gives a file not found error.</li>
<li>Settings - this page simply displays a message saying the settings page has not been implemented yet.</li>
</ul>

<blockquote>
<p>While playing with ClonOS, I wanted to perform a couple of simple tasks. I wanted to use the Wordpress template to set up a blog inside a jail. I wanted a generic, empty jail in which I could play and run commands without harming the rest of the operating system. I also wanted to try installing an operating system other than FreeBSD inside a Bhyve virtual environment. I thought this would give me a pretty good idea of how quick and easy ClonOS would make common tasks.</p>
</blockquote>

<ul>
<li>Conclusions</li>
</ul>

<blockquote>
<p>ClonOS appears to be in its early stages of development, more of a feature preview or proof-of-concept than a polished product. A few of the settings pages have not been finished yet, the web-based controls for jails are unable to create jails that connect to the network and I was unable to upload even small ISO files to create virtual machines.<br>
The project&#39;s website mentions working with Puppet to handle system configuration, but I did not encounter any Puppet options. There also does not appear to be any documentation on using Puppet on the ClonOS platform.<br>
One of the biggest concerns I had was the lack of security on ClonOS. The web-based control panel and terminal both automatically login as the root user. Passwords we create for our accounts are ignored and we cannot logout of the local terminal. This means anyone with physical access to the server automatically gains root access and, in addition, anyone on our local network gets access to the web-based admin panel. As it stands, it would not be safe to install ClonOS on a shared network.<br>
Some of the ideas present are good ones. I like the idea of jail templates and have used them on other systems. The graphical Bhyve tools could be useful too, if the limitations of the ISO manager are sorted out. But right now, ClonOS still has a way to go before it is likely to be safe or practical to use.</p>

<hr>
</blockquote>

<h3><a href="http://nanxiao.me/en/customize-ksh-display-for-openbsd/" rel="nofollow">Customize ksh display for OpenBSD</a></h3>

<blockquote>
<p>The default shell for OpenBSD is ksh, and it looks a little monotonous.<br>
To make its user-experience more friendly, I need to do some customizations:<br>
(1) Modify the Prompt String to display the user name and current directory:<br>
PS1=&#39;$USER:$PWD# &#39;<br>
(2) Install colorls package:<br>
pkg_add colorls<br>
Use it to replace the shipped ls command:<br>
alias ls=&#39;colorls -G&#39;<br>
(3) Change LSCOLORS environmental variable to make your favorite color. For example, I dont want the directory is displayed in default blue, change it to magenta:<br>
LSCOLORS=fxexcxdxbxegedabagacad<br>
For detailed explanation of LSCOLORS, please refer manual of colorls.<br>
This is my final modification of .profile:<br>
PS1=&#39;$USER:$PWD# &#39;<br>
export PS1<br>
LSCOLORS=fxexcxdxbxegedabagacad<br>
export LSCOLORS<br>
alias ls=&#39;colorls -G&#39;</p>

<hr>
</blockquote>

<h3><a href="https://www.dragonflydigest.com/2017/10/02/20295.html" rel="nofollow">DragonFly 5 release candidate</a></h3>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2017-September/626463.html" rel="nofollow">Commit</a></li>
</ul>

<blockquote>
<p>I tagged DragonFly 5.0 (commit message list in that link) over the weekend, and theres a <a href="http://mirror-master.dragonflybsd.org/iso-images/" rel="nofollow">5.0 release candidate for download</a>.<br>
Its RC2 because the recent Radeon changes <a href="http://lists.dragonflybsd.org/pipermail/commits/2017-September/626476.html" rel="nofollow">had to be taken out.</a></p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.grenadille.net/post/2017/08/21/Faster-forwarding" rel="nofollow">Faster forwarding</a></li>
<li><a href="http://www.freshports.org/graphics/drm-next-kmod/" rel="nofollow">DRM-Next-Kmod hits the ports tree</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20170829025446" rel="nofollow">OpenBSD Community Goes Platinum</a></li>
<li><a href="https://www.youtube.com/watch?v=4myESLZPXBU" rel="nofollow">Setting up iSCSI on TrueOS and FreeBSD12</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Christopher - <a href="http://dpaste.com/38G99CK#wrap" rel="nofollow">Virtualizing FreeNAS</a></li>
<li>Van - <a href="http://dpaste.com/3MEPD3S#wrap" rel="nofollow">Tar Question</a></li>
<li>Joe - <a href="http://dpaste.com/0T623Z6#wrap" rel="nofollow">Book Reviews</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We look at how Netflix serves 100 Gbps from an Open Connect Appliance, read through the 2nd quarter FreeBSD status report, show you a freebsd-update speedup via nginx reverse proxy, and customize your OpenBSD default shell.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://medium.com/netflix-techblog/serving-100-gbps-from-an-open-connect-appliance-cdb51dda3b99" rel="nofollow">Serving 100 Gbps from an Open Connect Appliance</a></h3>

<blockquote>
<p>In the summer of 2015, the Netflix Open Connect CDN team decided to take on an ambitious project. The goal was to leverage the new 100GbE network interface technology just coming to market in order to be able to serve at 100 Gbps from a single FreeBSD-based Open Connect Appliance (OCA) using NVM Express (NVMe)-based storage.<br>
At the time, the bulk of our flash storage-based appliances were close to being CPU limited serving at 40 Gbps using single-socket Xeon E52697v2. The first step was to find the CPU bottlenecks in the existing platform while we waited for newer CPUs from Intel, newer motherboards with PCIe Gen3 x16 slots that could run the new Mellanox 100GbE NICs at full speed, and for systems with NVMe drives.</p>
</blockquote>

<ul>
<li>Fake NUMA</li>
</ul>

<blockquote>
<p>Normally, most of an OCAs content is served from disk, with only 1020% of the most popular titles being served from memory (see our previous blog, <a href="https://medium.com/@NetflixTechBlog/content-popularity-for-open-connect-b86d56f613b" rel="nofollow">Content Popularity for Open Connect</a> for details). However, our early pre-NVMe prototypes were limited by disk bandwidth. So we set up a contrived experiment where we served only the very most popular content on a test server. This allowed all content to fit in RAM and therefore avoid the temporary disk bottleneck. Surprisingly, the performance actually dropped from being CPU limited at 40 Gbps to being CPU limited at only 22 Gbps!<br>
The ultimate solution we came up with is what we call Fake NUMA. This approach takes advantage of the fact that there is one set of page queues per NUMA domain. All we had to do was to lie to the system and tell it that we have one Fake NUMA domain for every 2 CPUs. After we did this, our lock contention nearly disappeared and we were able to serve at 52 Gbps (limited by the PCIe Gen3 x8 slot) with substantial CPU idle time.<br>
After we had newer prototype machines, with an Intel Xeon E5 2697v3 CPU, PCIe Gen3 x16 slots for 100GbE NIC, and more disk storage (4 NVMe or 44 SATA SSD drives), we hit another bottleneck, also related to a lock on a global list. We were stuck at around 60 Gbps on this new hardware, and we were constrained by pbufs.<br>
Our first problem was that the list was too small. We were spending a lot of time waiting for pbufs. This was easily fixed by increasing the number of pbufs allocated at boot time by increasing the kern.nswbuf tunable. However, this update revealed the next problem, which was lock contention on the global pbuf mutex. To solve this, we changed the vnode pager (which handles paging to files, rather than the swap partition, and hence handles all sendfile() I/O) to use the normal kernel zone allocator. This change removed the lock contention, and boosted our performance into the 70 Gbps range.<br>
As noted above, we make heavy use of the VM page queues, especially the inactive queue. Eventually, the system runs short of memory and these queues need to be scanned by the page daemon to free up memory. At full load, this was happening roughly twice per minute. When this happened, all NGINX processes would go to sleep in vm_wait() and the system would stop serving traffic while the pageout daemon worked to scan pages, often for several seconds. This problem is actually made progressively worse as one adds NUMA domains, because there is one pageout daemon per NUMA domain, but the page deficit that it is trying to clear is calculated globally. So if the vm pageout daemon decides to clean, say 1GB of memory and there are 16 domains, each of the 16 pageout daemons will individually attempt to clean 1GB of memory.<br>
To solve this problem, we decided to proactively scan the VM page queues. In the sendfile path, when allocating a page for I/O, we run the pageout code several times per second on each VM domain. The pageout code is run in its lightest-weight mode in the context of one unlucky NGINX process. Other NGINX processes continue to run and serve traffic while this is happening, so we can avoid bursts of pager activity that blocks traffic serving. Proactive scanning allowed us to serve at roughly 80 Gbps on the prototype hardware.<br>
Hans Petter Selasky, Mellanoxs 100GbE driver developer, came up with an innovative solution to our problem. Most modern NICs will supply an Receive Side Scaling (RSS) hash result to the host. RSS is a standard developed by Microsoft wherein TCP/IP traffic is hashed by source and destination IP address and/or TCP source and destination ports. The RSS hash result will almost always uniquely identify a TCP connection. Hans idea was that rather than just passing the packets to the LRO engine as they arrive from the network, we should hold the packets in a large batch, and then sort the batch of packets by RSS hash result (and original time of arrival, to keep them in order). After the packets are sorted, packets from the same connection are adjacent even when they arrive widely separated in time. Therefore, when the packets are passed to the FreeBSD LRO routine, it can aggregate them.<br>
With this new LRO code, we were able to achieve an LRO aggregation rate of over 2 packets per aggregation, and were able to serve at well over 90 Gbps for the first time on our prototype hardware for mostly unencrypted traffic. So the job was done. Or was it? The next goal was to achieve 100 Gbps while serving only TLS-encrypted streams. By this point, we were using hardware which closely resembles todays 100GbE flash storage-based OCAs: four NVMe PCIe Gen3 x4 drives, 100GbE ethernet, Xeon E5v4 2697A CPU. With the improvements described in the Protecting Netflix Viewing Privacy at Scale blog entry, we were able to serve TLS-only traffic at roughly 58 Gbps.<br>
In the lock contention problems wed observed above, the cause of any increased CPU use was relatively apparent from normal system level tools like flame graphs, DTrace, or lockstat. The 58 Gbps limit was comparatively strange. As before, the CPU use would increase linearly as we approached the 58 Gbps limit, but then as we neared the limit, the CPU use would increase almost exponentially. Flame graphs just showed everything taking longer, with no apparent hotspots. We finally had a hunch that we were limited by our systems memory bandwidth. We used the Intel® Performance Counter Monitor Tools to measure the memory bandwidth we were consuming at peak load. We then wrote a simple memory thrashing benchmark that used one thread per core to copy between large memory chunks that did not fit into cache. According to the PCM tools, this benchmark consumed the same amount of memory bandwidth as our OCAs TLS-serving workload. So it was clear that we were memory limited. At this point, we became focused on reducing memory bandwidth usage. To assist with this, we began using the Intel VTune profiling tools to identify memory loads and stores, and to identify cache misses.<br>
Because we are using sendfile() to serve data, encryption is done from the virtual memory page cache into connection-specific encryption buffers. This preserves the normal FreeBSD page cache in order to allow serving of hot data from memory to many connections. One of the first things that stood out to us was that the ISA-L encryption library was using half again as much memory bandwidth for memory reads as it was for memory writes. From looking at VTune profiling information, we saw that ISA-L was somehow reading both the source and destination buffers, rather than just writing to the destination buffer. We realized that this was because the AVX instructions used by ISA-L for encryption on our CPUs worked on 256-bit (32-byte) quantities, whereas the cache line size was 512-bits (64 bytes)??thus triggering the system to do read-modify-writes when data was written. The problem is that the the CPU will normally access the memory system in 64 byte cache line-sized chunks, reading an entire 64 bytes to access even just a single byte. After a quick email exchange with the ISA-L team, they provided us with a new version of the library that used non-temporal instructions when storing encryption results. Non-temporals bypass the cache, and allow the CPU direct access to memory. This meant that the CPU was no longer reading from the destination buffers, and so this increased our bandwidth from 58 Gbps to 65 Gbps.<br>
At 100 Gbps, were moving about 12.5 GB/s of 4K pages through our system unencrypted. Adding encryption doubles that to 25 GB/s worth of 4K pages. Thats about 6.25 Million mbufs per second. When you add in the extra 2 mbufs used by the crypto code for TLS metadata at the beginning and end of each TLS record, that works out to another 1.6M mbufs/sec, for a total of about 8M mbufs/second. With roughly 2 cache line accesses per mbuf, thats 128 bytes * 8M, which is 1 GB/s (8 Gbps) of data that is accessed at multiple layers of the stack (alloc, free, crypto, TCP, socket buffers, drivers, etc).<br>
At this point, were able to serve 100% TLS traffic comfortably at 90 Gbps using the default FreeBSD TCP stack. However, the goalposts keep moving. Weve found that when we use more advanced TCP algorithms, such as RACK and BBR, we are still a bit short of our goal. We have several ideas that we are currently pursuing, which range from optimizing the new TCP code to increasing the efficiency of LRO to trying to do encryption closer to the transfer of the data (either from the disk, or to the NIC) so as to take better advantage of Intels DDIO and save memory bandwidth.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html" rel="nofollow">FreeBSD April to June 2017 Status Report</a></h3>

<p><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-Team-Reports">FreeBSD Team Reports</a><br>
</h3><ul><li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-Release-Engineering-Team">FreeBSD Release Engineering Team</a></li><br>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Ports-Collection">Ports Collection</a></li><br>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#The-FreeBSD-Core-Team">The FreeBSD Core Team</a></li><br>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#The-FreeBSD-Foundation">The FreeBSD Foundation</a></li><br>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#The-Postmaster-Team">The Postmaster Team</a></li></ul></p>

<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Projects">Projects</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#64-bit-Inode-Numbers">64-bit Inode Numbers</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Capability-Based-Network-Communication-for-Capsicum/CloudABI">Capability-Based Network Communication for Capsicum/CloudABI</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Ceph-on-FreeBSD">Ceph on FreeBSD</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#DTS-Updates">DTS Updates</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Kernel">Kernel</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Coda-revival">Coda revival</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-Driver-for-the-Annapurna-Labs-ENA">FreeBSD Driver for the Annapurna Labs ENA</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Intel-10G-Driver-Update">Intel 10G Driver Update</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#pNFS-Server-Plan-B">pNFS Server Plan B</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Architectures">Architectures</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD-on-Marvell-Armada38x">FreeBSD on Marvell Armada38x</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#FreeBSD/arm64">FreeBSD/arm64</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Userland-Programs">Userland Programs</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#DTC">DTC</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Using-LLVM's-LLD-Linker-as-FreeBSD's-System-Linker">Using LLVM's LLD Linker as FreeBSD's System Linker</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Ports">Ports</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#A-New-USES-Macro-for-Porting-Cargo-Based-Rust-Applications">A New USES Macro for Porting Cargo-Based Rust Applications</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#GCC-(GNU-Compiler-Collection)">GCC (GNU Compiler Collection)</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#GNOME-on-FreeBSD">GNOME on FreeBSD</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#KDE-on-FreeBSD">KDE on FreeBSD</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#New-Port:-FRRouting">New Port: FRRouting</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#PHP-Ports:-Help-Improving-QA">PHP Ports: Help Improving QA</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Rust">Rust</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#sndio-Support-in-the-FreeBSD-Ports-Collection">sndio Support in the FreeBSD Ports Collection</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#TensorFlow">TensorFlow</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Updating-Port-Metadata-for-non-x86-Architectures">Updating Port Metadata for non-x86 Architectures</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Xfce-on-FreeBSD">Xfce on FreeBSD</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Documentation">Documentation</a></h3><ul>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Absolute-FreeBSD,-3rd-Edition">Absolute FreeBSD, 3rd Edition</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Doc-Version-Strings-Improved-by-Their-Absence">Doc Version Strings Improved by Their Absence</a></li>
<li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#New-Xen-Handbook-Section">New Xen Handbook Section</a></li></ul>
<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#Miscellaneous">Miscellaneous</a></h3>

<ul><li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#BSD-Meetups-at-Rennes-(France)">BSD Meetups at Rennes (France)</a></li></ul>

<h3><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.htmlThird-Party-Projects">Third-Party Projects</a></h3>

<ul><li><a href="https://www.freebsd.org/news/status/report-2017-04-2017-06.html#HardenedBSD">HardenedBSD</a></li></ul>

<hr>

<h3><a href="https://www.pscp.tv/DPDKProject/1dRKZnleWbmKB?t=5h1m0s" rel="nofollow">DPDK, VPP, and the future of pfSense @ the DPDK Summit</a></h3>

<ul>
<li>The DPDK (Data Plane Development Kit) conference included a short update from the pfSense project</li>
<li>The video starts with a quick introduction to pfSense and the company behind it</li>
<li>It covers the issues they ran into trying to scale to 10gbps and beyond, and some of the solutions they tried: libuinet, netmap, packet-journey</li>
<li>Then they discovered VPP (Vector Packet Processing)</li>
<li>The video then covers the architecture of the new pfSense</li>
<li>pfSense has launched of EC2, on Azure soon, and will launch support for the new Atom C3000 and Xeon hardware with built-in QAT (Quick-Assist crypto offload) in November</li>
<li>The future: 100gbps, MPLS, VXLANs, and ARM64 hardware support
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://wiki.freebsd.org/VladimirKrstulja/Guides/FreeBSDUpdateReverseProxy" rel="nofollow">Local nginx reverse proxy cache for freebsd-update</a></h3>

<ul>
<li>Vladimir Krstulja has created this interesting tutorial on the FreeBSD wiki about a freebsd-update reverse proxy cache</li>
</ul>

<blockquote>
<p>Either because you&#39;re a good netizen and don&#39;t want to repeatedly hammer the FreeBSD mirrors to upgrade all your systems, or you want to benefit from the speed of having a local &quot;mirror&quot; (cache, more precisely), running a freebsd update reverse proxy cache with, say, nginx is dead simple.</p>

<ol>
<li>Install nginx somewhere</li>
<li>Configure nginx for a subdomain, say, freebsd-update.example.com</li>
<li>On all your hosts, in all your jails, configure /etc/freebsd-update.conf for new ServerName
And... that&#39;s it. Running freebsd-update will use the ServerName domain which is your reverse nginx proxy. Note the comment about using a &quot;nearby&quot; server is not quite true. FreeBSD update mirrors are frequently slow and running such a reverse proxy cache significantly speeds things up.
Caveats: This is a simple cache. That means it doesn&#39;t consider the files as a whole repository, which in turn means updates to your cache are not atomic. It&#39;d be advised to nuke your cache before your update run, as its point is only to retain the files in a local cache for some short period of time required for all your machines to be updated.
***</li>
</ol>
</blockquote>

<h3><a href="https://clonos.tekroutine.com/" rel="nofollow">ClonOS is a free, open-source FreeBSD-based platform for virtual environment creation and management</a></h3>

<blockquote>
<p>The operating system uses FreeBSD&#39;s development branch (12.0-CURRENT) as its base. ClonOS uses ZFS as the default file system and includes web-based administration tools for managing virtual machines and jails. The project&#39;s website also mentions the availability of templates for quickly setting up new containers and web-based VNC access to jails. Puppet, we are told, can be used for configuration management.<br>
ClonOS can be downloaded as a disk image file (IMG) or as an optical media image (ISO). I downloaded the ISO file which is 1.6GB in size. Booting from ClonOS&#39;s media displays a text console asking us to select the type of text terminal we are using. There are four options and most people can probably safely take the default, xterm, option.<br>
The operating system, on the surface, appears to be a full installation of FreeBSD 12. The usual collection of FreeBSD packages are available, including manual pages, a compiler and the typical selection of UNIX command line utilities. The operating system uses ZFS as its file system and uses approximately 3.3GB of disk space. ClonOS requires about 50MB of active memory and 143MB of wired memory before any services or jails are created.<br>
Most of the key features of ClonOS, the parts which set it apart from vanilla FreeBSD, can be accessed through a web-based control panel. When we connect to this control panel, over a plain HTTP connection, using our web browser, we are not prompted for an account name or password. The web-based interface has a straight forward layout. Down the left side of the browser window we find categories of options and controls. Over on the right side of the window are the specific options or controls available in the selected category. At the top of the page there is a drop-down menu where we can toggle the displayed language between English and Russian, with English being the default.<br>
There are twelve option screens we can access in the ClonOS interface and I want to quickly give a summary of each one:</p>
</blockquote>

<ul>
<li>Overview - this page shows a top-level status summary. The page lists the number of jails and nodes in the system. We are also shown the number of available CPU cores and available RAM on the system.</li>
<li>Jail containers - this page allows us to create and delete jails. We can also change some basic jail settings on this page, adjusting the network configuration and hostname. Plus we can click a button to open a VNC window that allows us to access the jail&#39;s command line interface.</li>
<li>Template for jails - provides a list of available jail templates. Each template is listed with its name and a brief description. For example, we have a Wordpress template and a bittorrent template. We can click a listed template to create a new jail with a vanilla installation of the selected software included. We cannot download or create new templates from this page.</li>
<li>Bhyve VMs - this page is very much like the Jails containers page, but concerns the creation of new virtual machines and managing them.</li>
<li>Virtual Private Network - allows for the management of subnets</li>
<li>Authkeys - upload security keys for something, but it is not clear for what these keys will be used.</li>
<li>Storage media - upload ISO files that will be used when creating virtual machines and installing an operating system in the new virtual environment.</li>
<li>FreeBSD Bases - I think this page downloads and builds source code for alternative versions of FreeBSD, but I am unsure and could not find any associated documentation for this page.</li>
<li>FreeBSD Sources - download source code for various versions of FreeBSD.</li>
<li>TaskLog - browse logs of events, particularly actions concerning jails.</li>
<li>SQLite admin - this page says it will open an interface for managing a SQLite database. Clicking link on the page gives a file not found error.</li>
<li>Settings - this page simply displays a message saying the settings page has not been implemented yet.</li>
</ul>

<blockquote>
<p>While playing with ClonOS, I wanted to perform a couple of simple tasks. I wanted to use the Wordpress template to set up a blog inside a jail. I wanted a generic, empty jail in which I could play and run commands without harming the rest of the operating system. I also wanted to try installing an operating system other than FreeBSD inside a Bhyve virtual environment. I thought this would give me a pretty good idea of how quick and easy ClonOS would make common tasks.</p>
</blockquote>

<ul>
<li>Conclusions</li>
</ul>

<blockquote>
<p>ClonOS appears to be in its early stages of development, more of a feature preview or proof-of-concept than a polished product. A few of the settings pages have not been finished yet, the web-based controls for jails are unable to create jails that connect to the network and I was unable to upload even small ISO files to create virtual machines.<br>
The project&#39;s website mentions working with Puppet to handle system configuration, but I did not encounter any Puppet options. There also does not appear to be any documentation on using Puppet on the ClonOS platform.<br>
One of the biggest concerns I had was the lack of security on ClonOS. The web-based control panel and terminal both automatically login as the root user. Passwords we create for our accounts are ignored and we cannot logout of the local terminal. This means anyone with physical access to the server automatically gains root access and, in addition, anyone on our local network gets access to the web-based admin panel. As it stands, it would not be safe to install ClonOS on a shared network.<br>
Some of the ideas present are good ones. I like the idea of jail templates and have used them on other systems. The graphical Bhyve tools could be useful too, if the limitations of the ISO manager are sorted out. But right now, ClonOS still has a way to go before it is likely to be safe or practical to use.</p>

<hr>
</blockquote>

<h3><a href="http://nanxiao.me/en/customize-ksh-display-for-openbsd/" rel="nofollow">Customize ksh display for OpenBSD</a></h3>

<blockquote>
<p>The default shell for OpenBSD is ksh, and it looks a little monotonous.<br>
To make its user-experience more friendly, I need to do some customizations:<br>
(1) Modify the Prompt String to display the user name and current directory:<br>
PS1=&#39;$USER:$PWD# &#39;<br>
(2) Install colorls package:<br>
pkg_add colorls<br>
Use it to replace the shipped ls command:<br>
alias ls=&#39;colorls -G&#39;<br>
(3) Change LSCOLORS environmental variable to make your favorite color. For example, I dont want the directory is displayed in default blue, change it to magenta:<br>
LSCOLORS=fxexcxdxbxegedabagacad<br>
For detailed explanation of LSCOLORS, please refer manual of colorls.<br>
This is my final modification of .profile:<br>
PS1=&#39;$USER:$PWD# &#39;<br>
export PS1<br>
LSCOLORS=fxexcxdxbxegedabagacad<br>
export LSCOLORS<br>
alias ls=&#39;colorls -G&#39;</p>

<hr>
</blockquote>

<h3><a href="https://www.dragonflydigest.com/2017/10/02/20295.html" rel="nofollow">DragonFly 5 release candidate</a></h3>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2017-September/626463.html" rel="nofollow">Commit</a></li>
</ul>

<blockquote>
<p>I tagged DragonFly 5.0 (commit message list in that link) over the weekend, and theres a <a href="http://mirror-master.dragonflybsd.org/iso-images/" rel="nofollow">5.0 release candidate for download</a>.<br>
Its RC2 because the recent Radeon changes <a href="http://lists.dragonflybsd.org/pipermail/commits/2017-September/626476.html" rel="nofollow">had to be taken out.</a></p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.grenadille.net/post/2017/08/21/Faster-forwarding" rel="nofollow">Faster forwarding</a></li>
<li><a href="http://www.freshports.org/graphics/drm-next-kmod/" rel="nofollow">DRM-Next-Kmod hits the ports tree</a></li>
<li><a href="https://undeadly.org/cgi?action=article;sid=20170829025446" rel="nofollow">OpenBSD Community Goes Platinum</a></li>
<li><a href="https://www.youtube.com/watch?v=4myESLZPXBU" rel="nofollow">Setting up iSCSI on TrueOS and FreeBSD12</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Christopher - <a href="http://dpaste.com/38G99CK#wrap" rel="nofollow">Virtualizing FreeNAS</a></li>
<li>Van - <a href="http://dpaste.com/3MEPD3S#wrap" rel="nofollow">Tar Question</a></li>
<li>Joe - <a href="http://dpaste.com/0T623Z6#wrap" rel="nofollow">Book Reviews</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>214: The history of man, kind</title>
  <link>https://www.bsdnow.tv/214</link>
  <guid isPermaLink="false">207dad42-9da7-47e3-a6d7-4fd257905cf1</guid>
  <pubDate>Wed, 04 Oct 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/207dad42-9da7-47e3-a6d7-4fd257905cf1.mp3" length="65043220" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The costs of open sourcing a project are explored, we discover why PS4 downloads are so slow, delve into the history of UNIX man pages, and more.</itunes:subtitle>
  <itunes:duration>1:30:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The costs of open sourcing a project are explored, we discover why PS4 downloads are so slow, delve into the history of UNIX man pages, and more.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
The Cost Of Open Sourcing Your Project (https://meshedinsights.com/2016/09/20/open-source-unlikely-to-be-abandonware/)
Accusing a company of “dumping” their project as open source is probably misplaced – it’s an expensive business no-one would do frivolously.
If you see an active move to change software licensing or governance, it’s likely someone is paying for it and thus could justify the expense to an executive.
A Little History
Some case study cameos may help. From 2004 onwards, Sun Microsystems had a policy of all its software moving to open source. The company migrated almost all products to open source licenses, and had varying degrees of success engaging communities around the various projects, largely related to the outlooks of the product management and Sun developers for the project.
Sun occasionally received requests to make older, retired products open source. For example, Sun acquired a company called Lighthouse Design which created a respected suite of office productivity software for Steve Jobs’ NeXT platform. Strategy changes meant that software headed for the vault (while Jonathan Schwartz, a founder of Lighthouse, headed for the executive suite). Members of the public asked if Sun would open source some of this software, but these requests were declined because there was no business unit willing to fund the move.
When Sun was later bought by Oracle, a number of those projects that had been made open source were abandoned. “Abandoning” software doesn’t mean leaving it for others; it means simply walking away from wherever you left it. In the case of Sun’s popular identity middleware products, that meant Oracle let the staff go and tried to migrate customers to other products, while remaining silent in public on the future of the project. But the code was already open source, so the user community was able to pick up the pieces and carry on, with help from Forgerock.
It costs a lot of money to open source a mature piece of commercial software, even if all you are doing is “throwing a tarball over the wall”. That’s why companies abandoning software they no longer care about so rarely make it open source, and those abandoning open source projects rarely move them to new homes that benefit others.
If all you have thought about is the eventual outcome, you may be surprised how expensive it is to get there. Costs include: For throwing a tarball over the wall:
Legal clearance.
Having the right to use the software is not the same as giving everyone in the world an unrestricted right to use it and create derivatives. Checking every line of code to make sure you have the rights necessary to release under an OSI-approved license is a big task requiring high-value employees on the “liberation team”. That includes both developers and lawyers; neither come cheap.
Repackaging.
To pass it to others, a self-contained package containing all necessary source code, build scripts and non-public source and tool dependencies has to be created since it is quite unlikely to exist internally. Again, the liberation team will need your best developers.
Preserving provenance.
Just because you have confidence that you have the rights to the code, that doesn’t mean anyone else will. The version control system probably contains much of the information that gives confidence about who wrote which code, so the repackaging needs to also include a way to migrate the commit information.
Code cleaning.
The file headers will hopefully include origin information but the liberation team had better check. They also need to check the comments for libel and profanities, not to mention trade secrets (especially those from third parties) and other IP issues.
For a sustainable project, all the above plus:
Compliance with host governance.
It is a fantastic idea to move your project to a host like Apache, Conservancy, Public Software and so on. But doing so requires preparatory work. As a minimum you will need to negotiate with the new host organisation, and they may well need you to satisfy their process requirements. Paperwork obviously, but also the code may need conforming copyright statements and more. That’s more work for your liberation team.
Migration of rights.
Your code has an existing community who will need to migrate to your new host. That includes your staff – they are community too! They will need commit rights, governance rights, social media rights and more. Your liberation team will need your community manager, obviously, but may also need HR input.
Endowment.
Keeping your project alive will take money. It’s all been coming from you up to this point, but if you simply walk away before the financial burden has been accepted by the new community and hosts there may be a problem. You should consider making an endowment to your new host to pay for their migration costs plus the cost of hosting the community for at least a year.
Marketing.
Explaining the move you are making, the reasons why you are making it and the benefits for you and the community is important. If you don’t do it, there are plenty of trolls around who will do it for you. Creating a news blog post and an FAQ — the minimum effort necessary — really does take someone experienced and you’ll want to add such a person to your liberation team.
Motivations
There has to be some commercial reason that makes the time, effort and thus expense worth incurring. Some examples of motivations include:
Market Strategy.
An increasing number of companies are choosing to create substantial, openly-governed open source communities around software that contributes to their business. An open multi-stakeholder co-developer community is an excellent vehicle for innovation at the lowest cost to all involved. As long as your market strategy doesn’t require creating artificial scarcity.
Contract with a third party.
While the owner of the code may no longer be interested, there may be one or more parties to which they owe a contractual responsibility. Rather than breaching that contract, or buying it out, a move to open source may be better. Some sources suggest a contractual obligation to IBM was the reason Oracle abandoned OpenOffice.org by moving it over to the Apache Software Foundation for example.
Larger dependent ecosystem.
You may have no further use for the code itself, but you may well have other parts of your business which depend on it. If they are willing to collectively fund development you might consider an “inner source” strategy which will save you many of the costs above. But the best way to proceed may well be to open the code so your teams and those in other companies can fund the code.
Internal politics.
From the outside, corporations look monolithic, but from the inside it becomes clear they are a microcosm of the market in which they exist. As a result, they have political machinations that may be addressed by open source. One of Oracle’s motivations for moving NetBeans to Apache seems to have been political. Despite multiple internal groups needing it to exist, the code was not generating enough direct revenue to satisfy successive executive owners, who allegedly tried to abandon it on more than one occasion. Donating it to Apache meant that couldn’t happen again.
None of this is to say a move to open source guarantees the success of a project. A “Field of Dreams” strategy only works in the movies, after all. But while it may be tempting to look at a failed corporate liberation and describe it as “abandonware”, chances are it was intended as nothing of the kind.
Why PS4 downloads are so slow (https://www.snellman.net/blog/archive/2017-08-19-slow-ps4-downloads/)
From the blog that brought us “The origins of XXX as FIXME (https://www.snellman.net/blog/archive/2017-04-17-xxx-fixme/)” and “The mystery of the hanging S3 downloads (https://www.snellman.net/blog/archive/2017-07-20-s3-mystery/)”, this week it is: “Why are PS4 downloads so slow?”
Game downloads on PS4 have a reputation of being very slow, with many people reporting downloads being an order of magnitude faster on Steam or Xbox. This had long been on my list of things to look into, but at a pretty low priority. After all, the PS4 operating system is based on a reasonably modern FreeBSD (9.0), so there should not be any crippling issues in the TCP stack.
The implication is that the problem is something boring, like an inadequately dimensioned CDN. But then I heard that people were successfully using local HTTP proxies as a workaround. It should be pretty rare for that to actually help with download speeds, which made this sound like a much more interesting problem.
Before running any experiments, it's good to have a mental model of how the thing we're testing works, and where the problems might be. If nothing else, it will guide the initial experiment design.
 The speed of a steady-state TCP connection is basically defined by three numbers. The amount of data the client is will to receive on a single round-trip (TCP receive window), the amount of data the server is willing to send on a single round-trip (TCP congestion window), and the round trip latency between the client and the server (RTT). To a first approximation, the connection speed will be:
  &lt;code&gt; speed = min(rwin, cwin) / RTT &lt;/code&gt;
With this model, how could a proxy speed up the connection?
The speed through the proxy should be the minimum of the speed between the client and proxy, and the proxy and server. It should only possibly be slower
With a local proxy the client-proxy RTT will be very low; that connection is almost guaranteed to be the faster one. The improvement will have to be from the server-proxy connection being somehow better than the direct client-server one. The RTT will not change, so there are just two options: either the client has a much smaller receive window than the proxy, or the client is somehow causing the server's congestion window to decrease. (E.g. the client is randomly dropping received packets, while the proxy isn't).
After setting up a test rig, where the PS4’s connection was bridged through a linux box so packets could be captured, and artificial latency could be added, some interested results came up:
The differences in receive windows at different times are striking. And more important, the changes in the receive windows correspond very well to specific things I did on the PS4
When the download was started, the game Styx: Shards of Darkness was running in the background (just idling in the title screen). The download was limited by a receive window of under 7kB. This is an incredibly low value; it's basically going to cause the downloads to take 100 times longer than they should. And this was not a coincidence, whenever that game was running, the receive window would be that low.
Having an app running (e.g. Netflix, Spotify) limited the receive window to 128kB, for about a 5x reduction in potential download speed.
Moving apps, games, or the download window to the foreground or background didn't have any effect on the receive window.
Playing an online match in a networked game (Dreadnought) caused the receive window to be artificially limited to 7kB.
I ran a speedtest at a time when downloads were limited to 7kB receive window. It got a decent receive window of over 400kB; the conclusion is that the artificial receive window limit appears to only apply to PSN downloads.
When a game was started (causing the previously running game to be stopped automatically), the receive window could increase to 650kB for a very brief period of time. Basically it appears that the receive window gets unclamped when the old game stops, and then clamped again a few seconds later when the new game actually starts up.
I did a few more test runs, and all of them seemed to support the above findings. The only additional information from that testing is that the rest mode behavior was dependent on the PS4 settings. Originally I had it set up to suspend apps when in rest mode. If that setting was disabled, the apps would be closed when entering in rest mode, and the downloads would proceed at full speed.
The PS4 doesn't make it very obvious exactly what programs are running. For games, the interaction model is that opening a new game closes the previously running one. This is not how other apps work; they remain in the background indefinitely until you explicitly close them.
So, FreeBSD and its network stack are not to blame
Sony used a poor method to try to keep downloads from interfering with your gameplay
The impact of changing the receive window is highly dependant upon RTT, so it doesn’t work as evenly as actual traffic shaping or queueing would.
An interesting deep dive, it is well worth reading the full article and checking out the graphs
***
OpenSSH 7.6 Released (http://www.openssh.com/releasenotes.html#7.6)
From the release notes:
This release includes a number of changes that may affect existing
configurations:
ssh(1): delete SSH protocol version 1 support, associated
   configuration options and documentation.
 ssh(1)/sshd(8): remove support for the hmac-ripemd160 MAC.
 ssh(1)/sshd(8): remove support for the arcfour, blowfish and CAST
Refuse RSA keys &amp;lt;1024 bits in length and improve reporting for keys that do not meet 
this requirement.
ssh(1): do not offer CBC ciphers by default.
Changes since OpenSSH 7.5
This is primarily a bugfix release. It also contains substantial internal refactoring.
Security: sftp-server(8): in read-only mode, sftp-server was incorrectly permitting creation of zero-length files. Reported by Michal Zalewski.
New features: 
ssh(1): add RemoteCommand option to specify a command in the ssh config file instead of giving it on the client's command line. This allows the configuration file to specify the command that will be executed on the remote host.
sshd(8): add ExposeAuthInfo option that enables writing details of the authentication methods used (including public keys where applicable) to a file that is exposed via a $SSHUSERAUTH environment variable in the subsequent session.
ssh(1): add support for reverse dynamic forwarding. In this mode, ssh will act as a SOCKS4/5 proxy and forward connections to destinations requested by the remote SOCKS client. This mode is requested using extended syntax for the -R and RemoteForward options and, because it is implemented solely at the client, does not require the server be updated to be supported.
sshd(8): allow LogLevel directive in sshd_config Match blocks;
ssh-keygen(1): allow inclusion of arbitrary string or flag certificate extensions and critical options.
ssh-keygen(1): allow ssh-keygen to use a key held in ssh-agent as a CA when signing certificates.
 ssh(1)/sshd(8): allow IPQoS=none in ssh/sshd to not set an explicit ToS/DSCP value and just use the operating system default.
ssh-add(1): added -q option to make ssh-add quiet on success.
ssh(1): expand the StrictHostKeyChecking option with two new settings. The first "accept-new" will automatically accept hitherto-unseen keys but will refuse connections for changed or invalid hostkeys. This is a safer subset of the current behaviour of StrictHostKeyChecking=no. The second setting "off", is a synonym for the current behaviour of StrictHostKeyChecking=no: accept new host keys, and continue connection for hosts with incorrect hostkeys. A future release will change the meaning of StrictHostKeyChecking=no to the behaviour of "accept-new".
ssh(1): add SyslogFacility option to ssh(1) matching the equivalent option in sshd(8).
Check out the bugfixes and portability sections, too. 
***
News Roundup
FreeBSD comes to FiFo 0.9.3 with vmadm (https://blog.project-fifo.net/freebsd-in-fifo-0-9-3/)
What is Project FiFo? It’s an Open Source SmartOS Cloud Management and orchestration software. FiFo can be installed on SmartOS zones, running on standard compute nodes. There is no need for dedicated hardware or server roles.
FiFo 0.9.3 has been in the works for a while, and it comes with quite a few new features. With our last release, we started experimenting with FreeBSD support. Since then much work has gone into improving this. We also did something rather exciting with the mystery box! However, more on that in a later post.
The stable release of 0.9.3 will land within a few days with only packaging and documentation tasks left to do. Part of this means that we’ll have packages for all major components that work natively on BSD. There is no more need for a SmartOS box to run the components!
When we introduced FreeBSD support last version we marked it as an experimental feature. We needed to try out and experiment what works and what does not. Understand the way FreeBSD does things, what tools exist, and how those align with our workflow. Bottomline we were not even sure BSD support was a thing in the future.
We are happy to announce that with 0.9.3 we are now sure BSD support is a thing, and it is here to remain. That said it was good that we experimented in the last release, we did some significant changes to what we have now. When first looking at FreeBSD we went ahead and used existing tooling, namely iocage, to manage jails. It turns out the tooling around jails is not on par with what exists on illumos and especially SmartOS. The goodness of vmadm as a CLI for managing zones is just unparalleled. So we do what every (in)sane person would do!
So with 0.9.3, we did what every (in)sane person would do! We implemented a version of vmadm that would work with FreeBSD and jails and keep the same CLI. Our clone works completely stand alone; vmadm is a compiled binary, written in rust which is blazing fast! The design takes up lessons learned from both zoneadm and vmadm in illumos/SmartOS for how things work instead of trying to reinvent the wheel. Moreover, while we love giving the FreeBSD community a tool we learned to love on SmartOS this also makes things a lot easier for us. FiFo now can use the same logic on SmartOS and FreeBSD as the differences are abstracted away inside of vmadm. That said there are a few notable differences.
First of all, vmadm uses datasets the same way it does on SmartOS. However, there is no separate imgadm tool. Instead, we encapsulate the commands under vmadm images. To make this work we also provide a dataset server with base images for FreeBSD that used the same API as SmartOS dataset servers. Second, we needed to work around some limitations in VNET to make jails capable of being fully utilized in multi-tenancy environments.
Nested vnet jails on freebsd While on illumos a virtual nic can be bound to an IP that can not be changed from inside the zone, VNET does not support this. Preventing tenants from messing with IP settings is crucial from a security standpoint!
To work around that each jail created by vmadm are two jails: a minimal outer jail with nothing but a VNET interface, no IP or anything and an internal one that runs the user code. This outer jail then creates an inner jail with an inherited NIC that gets a fixed IP, combining both the security of a VNET jail as well as the security of a fixed IP interface.
The nested jail layout resembles the way that SmartOS handles KVM machines, running KVM inside a zone. So in addition to working around VNET limitations, this already paves the way for bhyve nested in jails that might come in a future release. We hope to leverage the same two-step with just a different executable started in the outer jail instead of the jail command itself.
History of UNIX Manpages (https://manpages.bsd.lv/history.html)
Where do UNIX manpages come from? Who introduced the section-based layout of NAME, SYNOPSIS, and so on? And for manpage source writers and readers: where were those economical two- and three-letter instructions developed? The many accounts available on the Internet lack citations and are at times inconsistent.
In this article, I reconstruct the history of the UNIX manpage based on source code, manuals, and first-hand accounts.
Special thanks to Paul Pierce for his CTSS source archive; Bernard Nivelet for the Multics Internet Server; the UNIX Heritage Society for their research UNIX source reconstruction; Gunnar Ritter for the Heirloom Project sources; Alcatel-Lucent Bell Labs for the Plan 9 sources; BitSavers for their historical archive; and last but not least, Rudd Canaday, James Clarke, Brian Kernighan, Douglas McIlroy, Nils-Peter Nelson, Jerome Saltzer, Henry Spencer, Ken Thompson, and Tom Van Vleck for their valuable contributions.
Please see the Copyright section if you plan on reproducing parts of this work.
People:
Abell, Vic
Canaday, Rudd
Capps, Dennis
Clarke, James
Dzonsons, Kristaps
Kernighan, Brian
Madnick, Stuart
McIlroy, Douglas
Morris, Robert
Ossanna, Joseph F.
Ritchie, Dennis
Ritter, Gunnar
Saltzer, Jerome H.
Spencer, Henry
Thompson, Ken
***
BSDCam 2017 Trip Report: Mathieu Arnold (https://www.freebsdfoundation.org/blog/bsdcam-2017-trip-report-mathieu-arnold/)
It seems that every time I try to go to England using the Eurostar, it gets delayed between 30 minutes and 2 hours. This year, it got my 45 minute layover down to 10 minutes. Luckily, King’s Cross is literally across the street from Saint Pancras, and I managed to get into my second train just in time.
I arrived in Cambridge on Tuesday right on time for tea. A quick walk from the station got me to St Catharine’s College. This year, we were in a different building for the rooms, so I listened to the convoluted explanation the porter gave me to get to my room, I managed to get there without getting lost more than once. That evening was almost organized as we got together for dinner at the usual pub, the Maypole.
Wednesday:
The weather is lovely, and it is a good thing as there is a 25-30 minute walk from the College to the Computer Laboratory where the devsummit happens. The first morning is for deciding what we are going to talk about for the rest of the week, so we all go in turn introducing ourselves and voicing about what we would like to talk about. There are a few subjects that are of interest to me, so I listen to the toolchain discussions while writing new bits for the Porter’s Handbook.
Thursday:
I spent most of the day writing documentation, and talked a bit with a couple of DocEng members about joining the team as I would like to give some love to the build framework that has not been touched in a long time. At the end of the afternoon is a packaging session, we talked about the status of package in base, which is not really going anywhere right now. On the ports side, three aspects that are making good progress include, package flavors, sub packages, and migrating some base libraries to private libraries, which is a nightmare because of openssl, and kerberos, and pam. That evening, we had the formal diner at St John’s College, I love those old buildings that reminds me of Hogwarts. (I am sure there is a quidditch pitch somewhere nearby.)
Friday:
Last day. I continued to write documentation, while listening to a provisioning session. It would be great to have bhyve support in existing orchestration tools like vagrant, openstack, or maybe ganeti. We end the day, and the devsummit with short talks, some very interesting, some going way over my head.
The weekend is here. I spent most of Saturday strolling in some of the numerous Cambridge parks, gardens, greens, fens… and I worked on a knitting pattern in the evening. On Sunday, I ate my last full gargantuan english breakfast of the year, and then back in a train to King’s Cross, and a Eurostar (this one on time) back to Paris.
I would like to thank the FreeBSD Foundation for making this trip possible for me.
GSoC 2017 Reports: Add SUBPACKAGES support to pkgsrc, part 1 (https://blog.netbsd.org/tnf/entry/gsoc_2017_reports_add_code)
Introduction
SUBPACKAGES (on some package systems they are known as multi-packages, but this term for pkgsrc is already used by packages that can be built against several versions (e.g. Python, PHP, Ruby packages)) consist in generating multiple binary packages from a single pkgsrc package. For example, from a pkgsrc package - local/frobnitzem - we will see how to generate three separate binary packages: frobnitzem-foo, frobnitzem-bar and frobnitzem-baz.
This can be useful to separate several components of binary packages (and avoid to run the extract and configure phase two times!), for debugpkgs (so that all *.debug files containing debug symbols are contained in a separate -debugpkg package that can be installed only when it is needed), etc..
An high-level look at how SUBPACKAGES support is implemented
Most of the changes needed are in mk/pkgformat/pkg/ hierarchy (previously known as mk/flavour and then renamed and generalized to other package formats during Anton Panev's Google Summer of Code 2011).
The code in mk/pkgformat/${PKGFORMAT}/ handle the interaction of pkgsrc with the particular ${PKGFORMAT}, e.g. for pkg populate meta-data files used by pkgcreate(1), install/delete packages via pkgadd(1), and pkg_delete(1), etc.
Conclusion
In this first part of this blog post series we have seen what are SUBPACKAGES, when and why they can be useful.
We have then seen a practical example of them taking a very trivial package and learned how to "subpackage-ify" it.
Then we have described - from an high-level perspective - the changes needed to the pkgsrc infrastructure for the SUBPACKAGES features that we have used. If you are more interested in them please give a look to the pkgsrc debugpkg branch that contains all work done described in this blog post.
In the next part we will see how to handle DEPENDS and buildlink3 inclusion for subpackages.
**
Beastie Bits
First partial boot of FreeBSD on Power8 (http://dmesgd.nycbug.org/index.cgi?do=view&amp;amp;id=3329)
The new TNF Board of Directors are installed and patched for 2017. (https://blog.netbsd.org/tnf/entry/the_new_tnf_board_of)
Open Source Summit 2017 October 23-26, 2017, Prague, Czech Republic Giovanni Bechis will give a talk about seccomp(2) vs pledge(2) (https://osseu17.sched.com/event/BxJw/seccomp2-vs-pledge2-giovanni-bechis-snb-srl)
My first patch to OpenBSD (http://nanxiao.me/en/my-first-patch-to-openbsd/)
Feedback/Questions
Brian - OPNSense Facebook Group (http://dpaste.com/35WA42Z#wrap)
Mark Felder - ZFS Health via SNMP (http://dpaste.com/0B8QH2W)
Matt - Cantrill Presentation (http://dpaste.com/1D9WTHV#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The costs of open sourcing a project are explored, we discover why PS4 downloads are so slow, delve into the history of UNIX man pages, and more.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://meshedinsights.com/2016/09/20/open-source-unlikely-to-be-abandonware/" rel="nofollow">The Cost Of Open Sourcing Your Project</a></h3>

<blockquote>
<p>Accusing a company of dumping their project as open source is probably misplaced  its an expensive business no-one would do frivolously.<br>
If you see an active move to change software licensing or governance, its likely someone is paying for it and thus could justify the expense to an executive.</p>
</blockquote>

<ul>
<li>A Little History</li>
</ul>

<blockquote>
<p>Some case study cameos may help. From 2004 onwards, Sun Microsystems had a policy of all its software moving to open source. The company migrated almost all products to open source licenses, and had varying degrees of success engaging communities around the various projects, largely related to the outlooks of the product management and Sun developers for the project.<br>
Sun occasionally received requests to make older, retired products open source. For example, Sun acquired a company called Lighthouse Design which created a respected suite of office productivity software for Steve Jobs NeXT platform. Strategy changes meant that software headed for the vault (while Jonathan Schwartz, a founder of Lighthouse, headed for the executive suite). Members of the public asked if Sun would open source some of this software, but these requests were declined because there was no business unit willing to fund the move.<br>
When Sun was later bought by Oracle, a number of those projects that had been made open source were abandoned. Abandoning software doesnt mean leaving it for others; it means simply walking away from wherever you left it. In the case of Suns popular identity middleware products, that meant Oracle let the staff go and tried to migrate customers to other products, while remaining silent in public on the future of the project. But the code was already open source, so the user community was able to pick up the pieces and carry on, with help from Forgerock.<br>
It costs a lot of money to open source a mature piece of commercial software, even if all you are doing is throwing a tarball over the wall. Thats why companies abandoning software they no longer care about so rarely make it open source, and those abandoning open source projects rarely move them to new homes that benefit others.</p>
</blockquote>

<ul>
<li>If all you have thought about is the eventual outcome, you may be surprised how expensive it is to get there. Costs include: For throwing a tarball over the wall:</li>
<li>Legal clearance.</li>
</ul>

<blockquote>
<p>Having the right to use the software is not the same as giving everyone in the world an unrestricted right to use it and create derivatives. Checking every line of code to make sure you have the rights necessary to release under an OSI-approved license is a big task requiring high-value employees on the liberation team. That includes both developers and lawyers; neither come cheap.</p>
</blockquote>

<ul>
<li>Repackaging.</li>
</ul>

<blockquote>
<p>To pass it to others, a self-contained package containing all necessary source code, build scripts and non-public source and tool dependencies has to be created since it is quite unlikely to exist internally. Again, the liberation team will need your best developers.</p>
</blockquote>

<ul>
<li>Preserving provenance.</li>
</ul>

<blockquote>
<p>Just because you have confidence that you have the rights to the code, that doesnt mean anyone else will. The version control system probably contains much of the information that gives confidence about who wrote which code, so the repackaging needs to also include a way to migrate the commit information.</p>
</blockquote>

<ul>
<li>Code cleaning.</li>
</ul>

<blockquote>
<p>The file headers will hopefully include origin information but the liberation team had better check. They also need to check the comments for libel and profanities, not to mention trade secrets (especially those from third parties) and other IP issues.</p>
</blockquote>

<ul>
<li>For a sustainable project, all the above plus:</li>
<li>Compliance with host governance.</li>
</ul>

<blockquote>
<p>It is a fantastic idea to move your project to a host like Apache, Conservancy, Public Software and so on. But doing so requires preparatory work. As a minimum you will need to negotiate with the new host organisation, and they may well need you to satisfy their process requirements. Paperwork obviously, but also the code may need conforming copyright statements and more. Thats more work for your liberation team.</p>
</blockquote>

<ul>
<li>Migration of rights.</li>
</ul>

<blockquote>
<p>Your code has an existing community who will need to migrate to your new host. That includes your staff  they are community too! They will need commit rights, governance rights, social media rights and more. Your liberation team will need your community manager, obviously, but may also need HR input.</p>
</blockquote>

<ul>
<li>Endowment.</li>
</ul>

<blockquote>
<p>Keeping your project alive will take money. Its all been coming from you up to this point, but if you simply walk away before the financial burden has been accepted by the new community and hosts there may be a problem. You should consider making an endowment to your new host to pay for their migration costs plus the cost of hosting the community for at least a year.</p>
</blockquote>

<ul>
<li>Marketing.</li>
</ul>

<blockquote>
<p>Explaining the move you are making, the reasons why you are making it and the benefits for you and the community is important. If you dont do it, there are plenty of trolls around who will do it for you. Creating a news blog post and an FAQ  the minimum effort necessary  really does take someone experienced and youll want to add such a person to your liberation team.</p>
</blockquote>

<ul>
<li>Motivations</li>
<li>There has to be some commercial reason that makes the time, effort and thus expense worth incurring. Some examples of motivations include:</li>
<li>Market Strategy.</li>
</ul>

<blockquote>
<p>An increasing number of companies are choosing to create substantial, openly-governed open source communities around software that contributes to their business. An open multi-stakeholder co-developer community is an excellent vehicle for innovation at the lowest cost to all involved. As long as your market strategy doesnt require creating artificial scarcity.</p>
</blockquote>

<ul>
<li>Contract with a third party.</li>
</ul>

<blockquote>
<p>While the owner of the code may no longer be interested, there may be one or more parties to which they owe a contractual responsibility. Rather than breaching that contract, or buying it out, a move to open source may be better. Some sources suggest a contractual obligation to IBM was the reason Oracle abandoned OpenOffice.org by moving it over to the Apache Software Foundation for example.</p>
</blockquote>

<ul>
<li>Larger dependent ecosystem.</li>
</ul>

<blockquote>
<p>You may have no further use for the code itself, but you may well have other parts of your business which depend on it. If they are willing to collectively fund development you might consider an inner source strategy which will save you many of the costs above. But the best way to proceed may well be to open the code so your teams and those in other companies can fund the code.</p>
</blockquote>

<ul>
<li>Internal politics.</li>
</ul>

<blockquote>
<p>From the outside, corporations look monolithic, but from the inside it becomes clear they are a microcosm of the market in which they exist. As a result, they have political machinations that may be addressed by open source. One of Oracles motivations for moving NetBeans to Apache seems to have been political. Despite multiple internal groups needing it to exist, the code was not generating enough direct revenue to satisfy successive executive owners, who allegedly tried to abandon it on more than one occasion. Donating it to Apache meant that couldnt happen again.</p>

<p>None of this is to say a move to open source guarantees the success of a project. A Field of Dreams strategy only works in the movies, after all. But while it may be tempting to look at a failed corporate liberation and describe it as abandonware, chances are it was intended as nothing of the kind.</p>
</blockquote>

<hr>

<h3><a href="https://www.snellman.net/blog/archive/2017-08-19-slow-ps4-downloads/" rel="nofollow">Why PS4 downloads are so slow</a></h3>

<ul>
<li>From the blog that brought us <a href="https://www.snellman.net/blog/archive/2017-04-17-xxx-fixme/" rel="nofollow">The origins of XXX as FIXME</a> and <a href="https://www.snellman.net/blog/archive/2017-07-20-s3-mystery/" rel="nofollow">The mystery of the hanging S3 downloads</a>, this week it is: Why are PS4 downloads so slow?</li>
</ul>

<blockquote>
<p>Game downloads on PS4 have a reputation of being very slow, with many people reporting downloads being an order of magnitude faster on Steam or Xbox. This had long been on my list of things to look into, but at a pretty low priority. After all, the PS4 operating system is based on a reasonably modern FreeBSD (9.0), so there should not be any crippling issues in the TCP stack.<br>
The implication is that the problem is something boring, like an inadequately dimensioned CDN. But then I heard that people were successfully using local HTTP proxies as a workaround. It should be pretty rare for that to actually help with download speeds, which made this sound like a much more interesting problem.<br>
Before running any experiments, it&#39;s good to have a mental model of how the thing we&#39;re testing works, and where the problems might be. If nothing else, it will guide the initial experiment design.<br>
 The speed of a steady-state TCP connection is basically defined by three numbers. The amount of data the client is will to receive on a single round-trip (TCP receive window), the amount of data the server is willing to send on a single round-trip (TCP congestion window), and the round trip latency between the client and the server (RTT). To a first approximation, the connection speed will be:<br>
  <code> speed = min(rwin, cwin) / RTT </code><br>
With this model, how could a proxy speed up the connection?</p>
</blockquote>

<ul>
<li>The speed through the proxy should be the minimum of the speed between the client and proxy, and the proxy and server. It should only possibly be slower</li>
</ul>

<blockquote>
<p>With a local proxy the client-proxy RTT will be very low; that connection is almost guaranteed to be the faster one. The improvement will have to be from the server-proxy connection being somehow better than the direct client-server one. The RTT will not change, so there are just two options: either the client has a much smaller receive window than the proxy, or the client is somehow causing the server&#39;s congestion window to decrease. (E.g. the client is randomly dropping received packets, while the proxy isn&#39;t).</p>
</blockquote>

<ul>
<li>After setting up a test rig, where the PS4s connection was bridged through a linux box so packets could be captured, and artificial latency could be added, some interested results came up:</li>
</ul>

<blockquote>
<p>The differences in receive windows at different times are striking. And more important, the changes in the receive windows correspond very well to specific things I did on the PS4<br>
When the download was started, the game Styx: Shards of Darkness was running in the background (just idling in the title screen). The download was limited by a receive window of under 7kB. This is an incredibly low value; it&#39;s basically going to cause the downloads to take 100 times longer than they should. And this was not a coincidence, whenever that game was running, the receive window would be that low.<br>
Having an app running (e.g. Netflix, Spotify) limited the receive window to 128kB, for about a 5x reduction in potential download speed.<br>
Moving apps, games, or the download window to the foreground or background didn&#39;t have any effect on the receive window.<br>
Playing an online match in a networked game (Dreadnought) caused the receive window to be artificially limited to 7kB.<br>
I ran a speedtest at a time when downloads were limited to 7kB receive window. It got a decent receive window of over 400kB; the conclusion is that the artificial receive window limit appears to only apply to PSN downloads.<br>
When a game was started (causing the previously running game to be stopped automatically), the receive window could increase to 650kB for a very brief period of time. Basically it appears that the receive window gets unclamped when the old game stops, and then clamped again a few seconds later when the new game actually starts up.<br>
I did a few more test runs, and all of them seemed to support the above findings. The only additional information from that testing is that the rest mode behavior was dependent on the PS4 settings. Originally I had it set up to suspend apps when in rest mode. If that setting was disabled, the apps would be closed when entering in rest mode, and the downloads would proceed at full speed.<br>
The PS4 doesn&#39;t make it very obvious exactly what programs are running. For games, the interaction model is that opening a new game closes the previously running one. This is not how other apps work; they remain in the background indefinitely until you explicitly close them.</p>
</blockquote>

<ul>
<li>So, FreeBSD and its network stack are not to blame</li>
<li>Sony used a poor method to try to keep downloads from interfering with your gameplay</li>
<li>The impact of changing the receive window is highly dependant upon RTT, so it doesnt work as evenly as actual traffic shaping or queueing would.</li>
<li>An interesting deep dive, it is well worth reading the full article and checking out the graphs
***</li>
</ul>

<h3><a href="http://www.openssh.com/releasenotes.html#7.6" rel="nofollow">OpenSSH 7.6 Released</a></h3>

<ul>
<li>From the release notes:</li>
</ul>

<blockquote>
<p>This release includes a number of changes that may affect existing<br>
configurations:<br>
ssh(1): delete SSH protocol version 1 support, associated<br>
   configuration options and documentation.<br>
 ssh(1)/sshd(8): remove support for the hmac-ripemd160 MAC.<br>
 ssh(1)/sshd(8): remove support for the arcfour, blowfish and CAST<br>
Refuse RSA keys &lt;1024 bits in length and improve reporting for keys that do not meet <br>
this requirement.<br>
ssh(1): do not offer CBC ciphers by default.</p>
</blockquote>

<ul>
<li>Changes since OpenSSH 7.5</li>
<li>This is primarily a bugfix release. It also contains substantial internal refactoring.</li>
</ul>

<blockquote>
<p>Security: sftp-server(8): in read-only mode, sftp-server was incorrectly permitting creation of zero-length files. Reported by Michal Zalewski.</p>
</blockquote>

<ul>
<li>New features: </li>
</ul>

<blockquote>
<p>ssh(1): add RemoteCommand option to specify a command in the ssh config file instead of giving it on the client&#39;s command line. This allows the configuration file to specify the command that will be executed on the remote host.<br>
sshd(8): add ExposeAuthInfo option that enables writing details of the authentication methods used (including public keys where applicable) to a file that is exposed via a $SSH_USER_AUTH environment variable in the subsequent session.<br>
ssh(1): add support for reverse dynamic forwarding. In this mode, ssh will act as a SOCKS4/5 proxy and forward connections to destinations requested by the remote SOCKS client. This mode is requested using extended syntax for the -R and RemoteForward options and, because it is implemented solely at the client, does not require the server be updated to be supported.<br>
sshd(8): allow LogLevel directive in sshd_config Match blocks;<br>
ssh-keygen(1): allow inclusion of arbitrary string or flag certificate extensions and critical options.<br>
ssh-keygen(1): allow ssh-keygen to use a key held in ssh-agent as a CA when signing certificates.<br>
 ssh(1)/sshd(8): allow IPQoS=none in ssh/sshd to not set an explicit ToS/DSCP value and just use the operating system default.<br>
ssh-add(1): added -q option to make ssh-add quiet on success.<br>
ssh(1): expand the StrictHostKeyChecking option with two new settings. The first &quot;accept-new&quot; will automatically accept hitherto-unseen keys but will refuse connections for changed or invalid hostkeys. This is a safer subset of the current behaviour of StrictHostKeyChecking=no. The second setting &quot;off&quot;, is a synonym for the current behaviour of StrictHostKeyChecking=no: accept new host keys, and continue connection for hosts with incorrect hostkeys. A future release will change the meaning of StrictHostKeyChecking=no to the behaviour of &quot;accept-new&quot;.<br>
ssh(1): add SyslogFacility option to ssh(1) matching the equivalent option in sshd(8).</p>
</blockquote>

<ul>
<li>Check out the bugfixes and portability sections, too. 
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://blog.project-fifo.net/freebsd-in-fifo-0-9-3/" rel="nofollow">FreeBSD comes to FiFo 0.9.3 with vmadm</a></h3>

<ul>
<li>What is Project FiFo? Its an Open Source SmartOS Cloud Management and orchestration software. FiFo can be installed on SmartOS zones, running on standard compute nodes. There is no need for dedicated hardware or server roles.</li>
</ul>

<blockquote>
<p>FiFo 0.9.3 has been in the works for a while, and it comes with quite a few new features. With our last release, we started experimenting with FreeBSD support. Since then much work has gone into improving this. We also did something rather exciting with the mystery box! However, more on that in a later post.<br>
The stable release of 0.9.3 will land within a few days with only packaging and documentation tasks left to do. Part of this means that well have packages for all major components that work natively on BSD. There is no more need for a SmartOS box to run the components!<br>
When we introduced FreeBSD support last version we marked it as an experimental feature. We needed to try out and experiment what works and what does not. Understand the way FreeBSD does things, what tools exist, and how those align with our workflow. Bottomline we were not even sure BSD support was a thing in the future.<br>
We are happy to announce that with 0.9.3 we are now sure BSD support is a thing, and it is here to remain. That said it was good that we experimented in the last release, we did some significant changes to what we have now. When first looking at FreeBSD we went ahead and used existing tooling, namely iocage, to manage jails. It turns out the tooling around jails is not on par with what exists on illumos and especially SmartOS. The goodness of vmadm as a CLI for managing zones is just unparalleled. So we do what every (in)sane person would do!<br>
So with 0.9.3, we did what every (in)sane person would do! We implemented a version of vmadm that would work with FreeBSD and jails and keep the same CLI. Our clone works completely stand alone; vmadm is a compiled binary, written in rust which is blazing fast! The design takes up lessons learned from both zoneadm and vmadm in illumos/SmartOS for how things work instead of trying to reinvent the wheel. Moreover, while we love giving the FreeBSD community a tool we learned to love on SmartOS this also makes things a lot easier for us. FiFo now can use the same logic on SmartOS and FreeBSD as the differences are abstracted away inside of vmadm. That said there are a few notable differences.<br>
First of all, vmadm uses datasets the same way it does on SmartOS. However, there is no separate imgadm tool. Instead, we encapsulate the commands under vmadm images. To make this work we also provide a dataset server with base images for FreeBSD that used the same API as SmartOS dataset servers. Second, we needed to work around some limitations in VNET to make jails capable of being fully utilized in multi-tenancy environments.<br>
Nested vnet jails on freebsd While on illumos a virtual nic can be bound to an IP that can not be changed from inside the zone, VNET does not support this. Preventing tenants from messing with IP settings is crucial from a security standpoint!<br>
To work around that each jail created by vmadm are two jails: a minimal outer jail with nothing but a VNET interface, no IP or anything and an internal one that runs the user code. This outer jail then creates an inner jail with an inherited NIC that gets a fixed IP, combining both the security of a VNET jail as well as the security of a fixed IP interface.<br>
The nested jail layout resembles the way that SmartOS handles KVM machines, running KVM inside a zone. So in addition to working around VNET limitations, this already paves the way for bhyve nested in jails that might come in a future release. We hope to leverage the same two-step with just a different executable started in the outer jail instead of the jail command itself.</p>

<hr>
</blockquote>

<h3><a href="https://manpages.bsd.lv/history.html" rel="nofollow">History of UNIX Manpages</a></h3>

<blockquote>
<p>Where do UNIX manpages come from? Who introduced the section-based layout of NAME, SYNOPSIS, and so on? And for manpage source writers and readers: where were those economical two- and three-letter instructions developed? The many accounts available on the Internet lack citations and are at times inconsistent.<br>
In this article, I reconstruct the history of the UNIX manpage based on source code, manuals, and first-hand accounts.<br>
Special thanks to Paul Pierce for his CTSS source archive; Bernard Nivelet for the Multics Internet Server; the UNIX Heritage Society for their research UNIX source reconstruction; Gunnar Ritter for the Heirloom Project sources; Alcatel-Lucent Bell Labs for the Plan 9 sources; BitSavers for their historical archive; and last but not least, Rudd Canaday, James Clarke, Brian Kernighan, Douglas McIlroy, Nils-Peter Nelson, Jerome Saltzer, Henry Spencer, Ken Thompson, and Tom Van Vleck for their valuable contributions.</p>

<p>Please see the Copyright section if you plan on reproducing parts of this work.</p>
</blockquote>

<ul>
<li>People:

<ul>
<li>Abell, Vic</li>
<li>Canaday, Rudd</li>
<li>Capps, Dennis</li>
<li>Clarke, James</li>
<li>Dzonsons, Kristaps</li>
<li>Kernighan, Brian</li>
<li>Madnick, Stuart</li>
<li>McIlroy, Douglas</li>
<li>Morris, Robert</li>
<li>Ossanna, Joseph F.</li>
<li>Ritchie, Dennis</li>
<li>Ritter, Gunnar</li>
<li>Saltzer, Jerome H.</li>
<li>Spencer, Henry</li>
<li>Thompson, Ken
***</li>
</ul></li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/blog/bsdcam-2017-trip-report-mathieu-arnold/" rel="nofollow">BSDCam 2017 Trip Report: Mathieu Arnold</a></h3>

<blockquote>
<p>It seems that every time I try to go to England using the Eurostar, it gets delayed between 30 minutes and 2 hours. This year, it got my 45 minute layover down to 10 minutes. Luckily, Kings Cross is literally across the street from Saint Pancras, and I managed to get into my second train just in time.<br>
I arrived in Cambridge on Tuesday right on time for tea. A quick walk from the station got me to St Catharines College. This year, we were in a different building for the rooms, so I listened to the convoluted explanation the porter gave me to get to my room, I managed to get there without getting lost more than once. That evening was almost organized as we got together for dinner at the usual pub, the Maypole.</p>
</blockquote>

<ul>
<li>Wednesday:</li>
</ul>

<blockquote>
<p>The weather is lovely, and it is a good thing as there is a 25-30 minute walk from the College to the Computer Laboratory where the devsummit happens. The first morning is for deciding what we are going to talk about for the rest of the week, so we all go in turn introducing ourselves and voicing about what we would like to talk about. There are a few subjects that are of interest to me, so I listen to the toolchain discussions while writing new bits for the Porters Handbook.</p>
</blockquote>

<ul>
<li>Thursday:</li>
</ul>

<blockquote>
<p>I spent most of the day writing documentation, and talked a bit with a couple of DocEng members about joining the team as I would like to give some love to the build framework that has not been touched in a long time. At the end of the afternoon is a packaging session, we talked about the status of package in base, which is not really going anywhere right now. On the ports side, three aspects that are making good progress include, package flavors, sub packages, and migrating some base libraries to private libraries, which is a nightmare because of openssl, and kerberos, and pam. That evening, we had the formal diner at St Johns College, I love those old buildings that reminds me of Hogwarts. (I am sure there is a quidditch pitch somewhere nearby.)</p>
</blockquote>

<ul>
<li>Friday:</li>
</ul>

<blockquote>
<p>Last day. I continued to write documentation, while listening to a provisioning session. It would be great to have bhyve support in existing orchestration tools like vagrant, openstack, or maybe ganeti. We end the day, and the devsummit with short talks, some very interesting, some going way over my head.<br>
The weekend is here. I spent most of Saturday strolling in some of the numerous Cambridge parks, gardens, greens, fens and I worked on a knitting pattern in the evening. On Sunday, I ate my last full gargantuan english breakfast of the year, and then back in a train to Kings Cross, and a Eurostar (this one on time) back to Paris.<br>
I would like to thank the FreeBSD Foundation for making this trip possible for me.</p>

<hr>
</blockquote>

<h3><a href="https://blog.netbsd.org/tnf/entry/gsoc_2017_reports_add_code" rel="nofollow">GSoC 2017 Reports: Add SUBPACKAGES support to pkgsrc, part 1</a></h3>

<ul>
<li>Introduction</li>
<li>SUBPACKAGES (on some package systems they are known as multi-packages, but this term for pkgsrc is already used by packages that can be built against several versions (e.g. Python, PHP, Ruby packages)) consist in generating multiple binary packages from a single pkgsrc package. For example, from a pkgsrc package - local/frobnitzem - we will see how to generate three separate binary packages: frobnitzem-foo, frobnitzem-bar and frobnitzem-baz.</li>
<li>This can be useful to separate several components of binary packages (and avoid to run the extract and configure phase two times!), for debugpkgs (so that all *.debug files containing debug symbols are contained in a separate -debugpkg package that can be installed only when it is needed), etc..</li>
<li>An high-level look at how SUBPACKAGES support is implemented</li>
<li>Most of the changes needed are in mk/pkgformat/pkg/ hierarchy (previously known as mk/flavour and then renamed and generalized to other package formats during Anton Panev&#39;s Google Summer of Code 2011).</li>
<li>The code in mk/pkgformat/${PKG_FORMAT}/ handle the interaction of pkgsrc with the particular ${PKG_FORMAT}, e.g. for pkg populate meta-data files used by pkg_create(1), install/delete packages via pkg_add(1), and pkg_delete(1), etc.</li>
<li>Conclusion</li>
<li>In this first part of this blog post series we have seen what are SUBPACKAGES, when and why they can be useful.</li>
<li>We have then seen a practical example of them taking a very trivial package and learned how to &quot;subpackage-ify&quot; it.</li>
<li>Then we have described - from an high-level perspective - the changes needed to the pkgsrc infrastructure for the SUBPACKAGES features that we have used. If you are more interested in them please give a look to the pkgsrc debugpkg branch that contains all work done described in this blog post.</li>
<li>In the next part we will see how to handle <em>DEPENDS and buildlink3 inclusion for subpackages.
*</em>*</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://dmesgd.nycbug.org/index.cgi?do=view&id=3329" rel="nofollow">First partial boot of FreeBSD on Power8</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/the_new_tnf_board_of" rel="nofollow">The new TNF Board of Directors are installed and patched for 2017.</a></li>
<li><a href="https://osseu17.sched.com/event/BxJw/seccomp2-vs-pledge2-giovanni-bechis-snb-srl" rel="nofollow">Open Source Summit 2017 October 23-26, 2017, Prague, Czech Republic Giovanni Bechis will give a talk about seccomp(2) vs pledge(2)</a></li>
<li><a href="http://nanxiao.me/en/my-first-patch-to-openbsd/" rel="nofollow">My first patch to OpenBSD</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Brian - <a href="http://dpaste.com/35WA42Z#wrap" rel="nofollow">OPNSense Facebook Group</a></li>
<li>Mark Felder - <a href="http://dpaste.com/0B8QH2W" rel="nofollow">ZFS Health via SNMP</a></li>
<li>Matt - <a href="http://dpaste.com/1D9WTHV#wrap" rel="nofollow">Cantrill Presentation</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The costs of open sourcing a project are explored, we discover why PS4 downloads are so slow, delve into the history of UNIX man pages, and more.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://meshedinsights.com/2016/09/20/open-source-unlikely-to-be-abandonware/" rel="nofollow">The Cost Of Open Sourcing Your Project</a></h3>

<blockquote>
<p>Accusing a company of dumping their project as open source is probably misplaced  its an expensive business no-one would do frivolously.<br>
If you see an active move to change software licensing or governance, its likely someone is paying for it and thus could justify the expense to an executive.</p>
</blockquote>

<ul>
<li>A Little History</li>
</ul>

<blockquote>
<p>Some case study cameos may help. From 2004 onwards, Sun Microsystems had a policy of all its software moving to open source. The company migrated almost all products to open source licenses, and had varying degrees of success engaging communities around the various projects, largely related to the outlooks of the product management and Sun developers for the project.<br>
Sun occasionally received requests to make older, retired products open source. For example, Sun acquired a company called Lighthouse Design which created a respected suite of office productivity software for Steve Jobs NeXT platform. Strategy changes meant that software headed for the vault (while Jonathan Schwartz, a founder of Lighthouse, headed for the executive suite). Members of the public asked if Sun would open source some of this software, but these requests were declined because there was no business unit willing to fund the move.<br>
When Sun was later bought by Oracle, a number of those projects that had been made open source were abandoned. Abandoning software doesnt mean leaving it for others; it means simply walking away from wherever you left it. In the case of Suns popular identity middleware products, that meant Oracle let the staff go and tried to migrate customers to other products, while remaining silent in public on the future of the project. But the code was already open source, so the user community was able to pick up the pieces and carry on, with help from Forgerock.<br>
It costs a lot of money to open source a mature piece of commercial software, even if all you are doing is throwing a tarball over the wall. Thats why companies abandoning software they no longer care about so rarely make it open source, and those abandoning open source projects rarely move them to new homes that benefit others.</p>
</blockquote>

<ul>
<li>If all you have thought about is the eventual outcome, you may be surprised how expensive it is to get there. Costs include: For throwing a tarball over the wall:</li>
<li>Legal clearance.</li>
</ul>

<blockquote>
<p>Having the right to use the software is not the same as giving everyone in the world an unrestricted right to use it and create derivatives. Checking every line of code to make sure you have the rights necessary to release under an OSI-approved license is a big task requiring high-value employees on the liberation team. That includes both developers and lawyers; neither come cheap.</p>
</blockquote>

<ul>
<li>Repackaging.</li>
</ul>

<blockquote>
<p>To pass it to others, a self-contained package containing all necessary source code, build scripts and non-public source and tool dependencies has to be created since it is quite unlikely to exist internally. Again, the liberation team will need your best developers.</p>
</blockquote>

<ul>
<li>Preserving provenance.</li>
</ul>

<blockquote>
<p>Just because you have confidence that you have the rights to the code, that doesnt mean anyone else will. The version control system probably contains much of the information that gives confidence about who wrote which code, so the repackaging needs to also include a way to migrate the commit information.</p>
</blockquote>

<ul>
<li>Code cleaning.</li>
</ul>

<blockquote>
<p>The file headers will hopefully include origin information but the liberation team had better check. They also need to check the comments for libel and profanities, not to mention trade secrets (especially those from third parties) and other IP issues.</p>
</blockquote>

<ul>
<li>For a sustainable project, all the above plus:</li>
<li>Compliance with host governance.</li>
</ul>

<blockquote>
<p>It is a fantastic idea to move your project to a host like Apache, Conservancy, Public Software and so on. But doing so requires preparatory work. As a minimum you will need to negotiate with the new host organisation, and they may well need you to satisfy their process requirements. Paperwork obviously, but also the code may need conforming copyright statements and more. Thats more work for your liberation team.</p>
</blockquote>

<ul>
<li>Migration of rights.</li>
</ul>

<blockquote>
<p>Your code has an existing community who will need to migrate to your new host. That includes your staff  they are community too! They will need commit rights, governance rights, social media rights and more. Your liberation team will need your community manager, obviously, but may also need HR input.</p>
</blockquote>

<ul>
<li>Endowment.</li>
</ul>

<blockquote>
<p>Keeping your project alive will take money. Its all been coming from you up to this point, but if you simply walk away before the financial burden has been accepted by the new community and hosts there may be a problem. You should consider making an endowment to your new host to pay for their migration costs plus the cost of hosting the community for at least a year.</p>
</blockquote>

<ul>
<li>Marketing.</li>
</ul>

<blockquote>
<p>Explaining the move you are making, the reasons why you are making it and the benefits for you and the community is important. If you dont do it, there are plenty of trolls around who will do it for you. Creating a news blog post and an FAQ  the minimum effort necessary  really does take someone experienced and youll want to add such a person to your liberation team.</p>
</blockquote>

<ul>
<li>Motivations</li>
<li>There has to be some commercial reason that makes the time, effort and thus expense worth incurring. Some examples of motivations include:</li>
<li>Market Strategy.</li>
</ul>

<blockquote>
<p>An increasing number of companies are choosing to create substantial, openly-governed open source communities around software that contributes to their business. An open multi-stakeholder co-developer community is an excellent vehicle for innovation at the lowest cost to all involved. As long as your market strategy doesnt require creating artificial scarcity.</p>
</blockquote>

<ul>
<li>Contract with a third party.</li>
</ul>

<blockquote>
<p>While the owner of the code may no longer be interested, there may be one or more parties to which they owe a contractual responsibility. Rather than breaching that contract, or buying it out, a move to open source may be better. Some sources suggest a contractual obligation to IBM was the reason Oracle abandoned OpenOffice.org by moving it over to the Apache Software Foundation for example.</p>
</blockquote>

<ul>
<li>Larger dependent ecosystem.</li>
</ul>

<blockquote>
<p>You may have no further use for the code itself, but you may well have other parts of your business which depend on it. If they are willing to collectively fund development you might consider an inner source strategy which will save you many of the costs above. But the best way to proceed may well be to open the code so your teams and those in other companies can fund the code.</p>
</blockquote>

<ul>
<li>Internal politics.</li>
</ul>

<blockquote>
<p>From the outside, corporations look monolithic, but from the inside it becomes clear they are a microcosm of the market in which they exist. As a result, they have political machinations that may be addressed by open source. One of Oracles motivations for moving NetBeans to Apache seems to have been political. Despite multiple internal groups needing it to exist, the code was not generating enough direct revenue to satisfy successive executive owners, who allegedly tried to abandon it on more than one occasion. Donating it to Apache meant that couldnt happen again.</p>

<p>None of this is to say a move to open source guarantees the success of a project. A Field of Dreams strategy only works in the movies, after all. But while it may be tempting to look at a failed corporate liberation and describe it as abandonware, chances are it was intended as nothing of the kind.</p>
</blockquote>

<hr>

<h3><a href="https://www.snellman.net/blog/archive/2017-08-19-slow-ps4-downloads/" rel="nofollow">Why PS4 downloads are so slow</a></h3>

<ul>
<li>From the blog that brought us <a href="https://www.snellman.net/blog/archive/2017-04-17-xxx-fixme/" rel="nofollow">The origins of XXX as FIXME</a> and <a href="https://www.snellman.net/blog/archive/2017-07-20-s3-mystery/" rel="nofollow">The mystery of the hanging S3 downloads</a>, this week it is: Why are PS4 downloads so slow?</li>
</ul>

<blockquote>
<p>Game downloads on PS4 have a reputation of being very slow, with many people reporting downloads being an order of magnitude faster on Steam or Xbox. This had long been on my list of things to look into, but at a pretty low priority. After all, the PS4 operating system is based on a reasonably modern FreeBSD (9.0), so there should not be any crippling issues in the TCP stack.<br>
The implication is that the problem is something boring, like an inadequately dimensioned CDN. But then I heard that people were successfully using local HTTP proxies as a workaround. It should be pretty rare for that to actually help with download speeds, which made this sound like a much more interesting problem.<br>
Before running any experiments, it&#39;s good to have a mental model of how the thing we&#39;re testing works, and where the problems might be. If nothing else, it will guide the initial experiment design.<br>
 The speed of a steady-state TCP connection is basically defined by three numbers. The amount of data the client is will to receive on a single round-trip (TCP receive window), the amount of data the server is willing to send on a single round-trip (TCP congestion window), and the round trip latency between the client and the server (RTT). To a first approximation, the connection speed will be:<br>
  <code> speed = min(rwin, cwin) / RTT </code><br>
With this model, how could a proxy speed up the connection?</p>
</blockquote>

<ul>
<li>The speed through the proxy should be the minimum of the speed between the client and proxy, and the proxy and server. It should only possibly be slower</li>
</ul>

<blockquote>
<p>With a local proxy the client-proxy RTT will be very low; that connection is almost guaranteed to be the faster one. The improvement will have to be from the server-proxy connection being somehow better than the direct client-server one. The RTT will not change, so there are just two options: either the client has a much smaller receive window than the proxy, or the client is somehow causing the server&#39;s congestion window to decrease. (E.g. the client is randomly dropping received packets, while the proxy isn&#39;t).</p>
</blockquote>

<ul>
<li>After setting up a test rig, where the PS4s connection was bridged through a linux box so packets could be captured, and artificial latency could be added, some interested results came up:</li>
</ul>

<blockquote>
<p>The differences in receive windows at different times are striking. And more important, the changes in the receive windows correspond very well to specific things I did on the PS4<br>
When the download was started, the game Styx: Shards of Darkness was running in the background (just idling in the title screen). The download was limited by a receive window of under 7kB. This is an incredibly low value; it&#39;s basically going to cause the downloads to take 100 times longer than they should. And this was not a coincidence, whenever that game was running, the receive window would be that low.<br>
Having an app running (e.g. Netflix, Spotify) limited the receive window to 128kB, for about a 5x reduction in potential download speed.<br>
Moving apps, games, or the download window to the foreground or background didn&#39;t have any effect on the receive window.<br>
Playing an online match in a networked game (Dreadnought) caused the receive window to be artificially limited to 7kB.<br>
I ran a speedtest at a time when downloads were limited to 7kB receive window. It got a decent receive window of over 400kB; the conclusion is that the artificial receive window limit appears to only apply to PSN downloads.<br>
When a game was started (causing the previously running game to be stopped automatically), the receive window could increase to 650kB for a very brief period of time. Basically it appears that the receive window gets unclamped when the old game stops, and then clamped again a few seconds later when the new game actually starts up.<br>
I did a few more test runs, and all of them seemed to support the above findings. The only additional information from that testing is that the rest mode behavior was dependent on the PS4 settings. Originally I had it set up to suspend apps when in rest mode. If that setting was disabled, the apps would be closed when entering in rest mode, and the downloads would proceed at full speed.<br>
The PS4 doesn&#39;t make it very obvious exactly what programs are running. For games, the interaction model is that opening a new game closes the previously running one. This is not how other apps work; they remain in the background indefinitely until you explicitly close them.</p>
</blockquote>

<ul>
<li>So, FreeBSD and its network stack are not to blame</li>
<li>Sony used a poor method to try to keep downloads from interfering with your gameplay</li>
<li>The impact of changing the receive window is highly dependant upon RTT, so it doesnt work as evenly as actual traffic shaping or queueing would.</li>
<li>An interesting deep dive, it is well worth reading the full article and checking out the graphs
***</li>
</ul>

<h3><a href="http://www.openssh.com/releasenotes.html#7.6" rel="nofollow">OpenSSH 7.6 Released</a></h3>

<ul>
<li>From the release notes:</li>
</ul>

<blockquote>
<p>This release includes a number of changes that may affect existing<br>
configurations:<br>
ssh(1): delete SSH protocol version 1 support, associated<br>
   configuration options and documentation.<br>
 ssh(1)/sshd(8): remove support for the hmac-ripemd160 MAC.<br>
 ssh(1)/sshd(8): remove support for the arcfour, blowfish and CAST<br>
Refuse RSA keys &lt;1024 bits in length and improve reporting for keys that do not meet <br>
this requirement.<br>
ssh(1): do not offer CBC ciphers by default.</p>
</blockquote>

<ul>
<li>Changes since OpenSSH 7.5</li>
<li>This is primarily a bugfix release. It also contains substantial internal refactoring.</li>
</ul>

<blockquote>
<p>Security: sftp-server(8): in read-only mode, sftp-server was incorrectly permitting creation of zero-length files. Reported by Michal Zalewski.</p>
</blockquote>

<ul>
<li>New features: </li>
</ul>

<blockquote>
<p>ssh(1): add RemoteCommand option to specify a command in the ssh config file instead of giving it on the client&#39;s command line. This allows the configuration file to specify the command that will be executed on the remote host.<br>
sshd(8): add ExposeAuthInfo option that enables writing details of the authentication methods used (including public keys where applicable) to a file that is exposed via a $SSH_USER_AUTH environment variable in the subsequent session.<br>
ssh(1): add support for reverse dynamic forwarding. In this mode, ssh will act as a SOCKS4/5 proxy and forward connections to destinations requested by the remote SOCKS client. This mode is requested using extended syntax for the -R and RemoteForward options and, because it is implemented solely at the client, does not require the server be updated to be supported.<br>
sshd(8): allow LogLevel directive in sshd_config Match blocks;<br>
ssh-keygen(1): allow inclusion of arbitrary string or flag certificate extensions and critical options.<br>
ssh-keygen(1): allow ssh-keygen to use a key held in ssh-agent as a CA when signing certificates.<br>
 ssh(1)/sshd(8): allow IPQoS=none in ssh/sshd to not set an explicit ToS/DSCP value and just use the operating system default.<br>
ssh-add(1): added -q option to make ssh-add quiet on success.<br>
ssh(1): expand the StrictHostKeyChecking option with two new settings. The first &quot;accept-new&quot; will automatically accept hitherto-unseen keys but will refuse connections for changed or invalid hostkeys. This is a safer subset of the current behaviour of StrictHostKeyChecking=no. The second setting &quot;off&quot;, is a synonym for the current behaviour of StrictHostKeyChecking=no: accept new host keys, and continue connection for hosts with incorrect hostkeys. A future release will change the meaning of StrictHostKeyChecking=no to the behaviour of &quot;accept-new&quot;.<br>
ssh(1): add SyslogFacility option to ssh(1) matching the equivalent option in sshd(8).</p>
</blockquote>

<ul>
<li>Check out the bugfixes and portability sections, too. 
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://blog.project-fifo.net/freebsd-in-fifo-0-9-3/" rel="nofollow">FreeBSD comes to FiFo 0.9.3 with vmadm</a></h3>

<ul>
<li>What is Project FiFo? Its an Open Source SmartOS Cloud Management and orchestration software. FiFo can be installed on SmartOS zones, running on standard compute nodes. There is no need for dedicated hardware or server roles.</li>
</ul>

<blockquote>
<p>FiFo 0.9.3 has been in the works for a while, and it comes with quite a few new features. With our last release, we started experimenting with FreeBSD support. Since then much work has gone into improving this. We also did something rather exciting with the mystery box! However, more on that in a later post.<br>
The stable release of 0.9.3 will land within a few days with only packaging and documentation tasks left to do. Part of this means that well have packages for all major components that work natively on BSD. There is no more need for a SmartOS box to run the components!<br>
When we introduced FreeBSD support last version we marked it as an experimental feature. We needed to try out and experiment what works and what does not. Understand the way FreeBSD does things, what tools exist, and how those align with our workflow. Bottomline we were not even sure BSD support was a thing in the future.<br>
We are happy to announce that with 0.9.3 we are now sure BSD support is a thing, and it is here to remain. That said it was good that we experimented in the last release, we did some significant changes to what we have now. When first looking at FreeBSD we went ahead and used existing tooling, namely iocage, to manage jails. It turns out the tooling around jails is not on par with what exists on illumos and especially SmartOS. The goodness of vmadm as a CLI for managing zones is just unparalleled. So we do what every (in)sane person would do!<br>
So with 0.9.3, we did what every (in)sane person would do! We implemented a version of vmadm that would work with FreeBSD and jails and keep the same CLI. Our clone works completely stand alone; vmadm is a compiled binary, written in rust which is blazing fast! The design takes up lessons learned from both zoneadm and vmadm in illumos/SmartOS for how things work instead of trying to reinvent the wheel. Moreover, while we love giving the FreeBSD community a tool we learned to love on SmartOS this also makes things a lot easier for us. FiFo now can use the same logic on SmartOS and FreeBSD as the differences are abstracted away inside of vmadm. That said there are a few notable differences.<br>
First of all, vmadm uses datasets the same way it does on SmartOS. However, there is no separate imgadm tool. Instead, we encapsulate the commands under vmadm images. To make this work we also provide a dataset server with base images for FreeBSD that used the same API as SmartOS dataset servers. Second, we needed to work around some limitations in VNET to make jails capable of being fully utilized in multi-tenancy environments.<br>
Nested vnet jails on freebsd While on illumos a virtual nic can be bound to an IP that can not be changed from inside the zone, VNET does not support this. Preventing tenants from messing with IP settings is crucial from a security standpoint!<br>
To work around that each jail created by vmadm are two jails: a minimal outer jail with nothing but a VNET interface, no IP or anything and an internal one that runs the user code. This outer jail then creates an inner jail with an inherited NIC that gets a fixed IP, combining both the security of a VNET jail as well as the security of a fixed IP interface.<br>
The nested jail layout resembles the way that SmartOS handles KVM machines, running KVM inside a zone. So in addition to working around VNET limitations, this already paves the way for bhyve nested in jails that might come in a future release. We hope to leverage the same two-step with just a different executable started in the outer jail instead of the jail command itself.</p>

<hr>
</blockquote>

<h3><a href="https://manpages.bsd.lv/history.html" rel="nofollow">History of UNIX Manpages</a></h3>

<blockquote>
<p>Where do UNIX manpages come from? Who introduced the section-based layout of NAME, SYNOPSIS, and so on? And for manpage source writers and readers: where were those economical two- and three-letter instructions developed? The many accounts available on the Internet lack citations and are at times inconsistent.<br>
In this article, I reconstruct the history of the UNIX manpage based on source code, manuals, and first-hand accounts.<br>
Special thanks to Paul Pierce for his CTSS source archive; Bernard Nivelet for the Multics Internet Server; the UNIX Heritage Society for their research UNIX source reconstruction; Gunnar Ritter for the Heirloom Project sources; Alcatel-Lucent Bell Labs for the Plan 9 sources; BitSavers for their historical archive; and last but not least, Rudd Canaday, James Clarke, Brian Kernighan, Douglas McIlroy, Nils-Peter Nelson, Jerome Saltzer, Henry Spencer, Ken Thompson, and Tom Van Vleck for their valuable contributions.</p>

<p>Please see the Copyright section if you plan on reproducing parts of this work.</p>
</blockquote>

<ul>
<li>People:

<ul>
<li>Abell, Vic</li>
<li>Canaday, Rudd</li>
<li>Capps, Dennis</li>
<li>Clarke, James</li>
<li>Dzonsons, Kristaps</li>
<li>Kernighan, Brian</li>
<li>Madnick, Stuart</li>
<li>McIlroy, Douglas</li>
<li>Morris, Robert</li>
<li>Ossanna, Joseph F.</li>
<li>Ritchie, Dennis</li>
<li>Ritter, Gunnar</li>
<li>Saltzer, Jerome H.</li>
<li>Spencer, Henry</li>
<li>Thompson, Ken
***</li>
</ul></li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/blog/bsdcam-2017-trip-report-mathieu-arnold/" rel="nofollow">BSDCam 2017 Trip Report: Mathieu Arnold</a></h3>

<blockquote>
<p>It seems that every time I try to go to England using the Eurostar, it gets delayed between 30 minutes and 2 hours. This year, it got my 45 minute layover down to 10 minutes. Luckily, Kings Cross is literally across the street from Saint Pancras, and I managed to get into my second train just in time.<br>
I arrived in Cambridge on Tuesday right on time for tea. A quick walk from the station got me to St Catharines College. This year, we were in a different building for the rooms, so I listened to the convoluted explanation the porter gave me to get to my room, I managed to get there without getting lost more than once. That evening was almost organized as we got together for dinner at the usual pub, the Maypole.</p>
</blockquote>

<ul>
<li>Wednesday:</li>
</ul>

<blockquote>
<p>The weather is lovely, and it is a good thing as there is a 25-30 minute walk from the College to the Computer Laboratory where the devsummit happens. The first morning is for deciding what we are going to talk about for the rest of the week, so we all go in turn introducing ourselves and voicing about what we would like to talk about. There are a few subjects that are of interest to me, so I listen to the toolchain discussions while writing new bits for the Porters Handbook.</p>
</blockquote>

<ul>
<li>Thursday:</li>
</ul>

<blockquote>
<p>I spent most of the day writing documentation, and talked a bit with a couple of DocEng members about joining the team as I would like to give some love to the build framework that has not been touched in a long time. At the end of the afternoon is a packaging session, we talked about the status of package in base, which is not really going anywhere right now. On the ports side, three aspects that are making good progress include, package flavors, sub packages, and migrating some base libraries to private libraries, which is a nightmare because of openssl, and kerberos, and pam. That evening, we had the formal diner at St Johns College, I love those old buildings that reminds me of Hogwarts. (I am sure there is a quidditch pitch somewhere nearby.)</p>
</blockquote>

<ul>
<li>Friday:</li>
</ul>

<blockquote>
<p>Last day. I continued to write documentation, while listening to a provisioning session. It would be great to have bhyve support in existing orchestration tools like vagrant, openstack, or maybe ganeti. We end the day, and the devsummit with short talks, some very interesting, some going way over my head.<br>
The weekend is here. I spent most of Saturday strolling in some of the numerous Cambridge parks, gardens, greens, fens and I worked on a knitting pattern in the evening. On Sunday, I ate my last full gargantuan english breakfast of the year, and then back in a train to Kings Cross, and a Eurostar (this one on time) back to Paris.<br>
I would like to thank the FreeBSD Foundation for making this trip possible for me.</p>

<hr>
</blockquote>

<h3><a href="https://blog.netbsd.org/tnf/entry/gsoc_2017_reports_add_code" rel="nofollow">GSoC 2017 Reports: Add SUBPACKAGES support to pkgsrc, part 1</a></h3>

<ul>
<li>Introduction</li>
<li>SUBPACKAGES (on some package systems they are known as multi-packages, but this term for pkgsrc is already used by packages that can be built against several versions (e.g. Python, PHP, Ruby packages)) consist in generating multiple binary packages from a single pkgsrc package. For example, from a pkgsrc package - local/frobnitzem - we will see how to generate three separate binary packages: frobnitzem-foo, frobnitzem-bar and frobnitzem-baz.</li>
<li>This can be useful to separate several components of binary packages (and avoid to run the extract and configure phase two times!), for debugpkgs (so that all *.debug files containing debug symbols are contained in a separate -debugpkg package that can be installed only when it is needed), etc..</li>
<li>An high-level look at how SUBPACKAGES support is implemented</li>
<li>Most of the changes needed are in mk/pkgformat/pkg/ hierarchy (previously known as mk/flavour and then renamed and generalized to other package formats during Anton Panev&#39;s Google Summer of Code 2011).</li>
<li>The code in mk/pkgformat/${PKG_FORMAT}/ handle the interaction of pkgsrc with the particular ${PKG_FORMAT}, e.g. for pkg populate meta-data files used by pkg_create(1), install/delete packages via pkg_add(1), and pkg_delete(1), etc.</li>
<li>Conclusion</li>
<li>In this first part of this blog post series we have seen what are SUBPACKAGES, when and why they can be useful.</li>
<li>We have then seen a practical example of them taking a very trivial package and learned how to &quot;subpackage-ify&quot; it.</li>
<li>Then we have described - from an high-level perspective - the changes needed to the pkgsrc infrastructure for the SUBPACKAGES features that we have used. If you are more interested in them please give a look to the pkgsrc debugpkg branch that contains all work done described in this blog post.</li>
<li>In the next part we will see how to handle <em>DEPENDS and buildlink3 inclusion for subpackages.
*</em>*</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://dmesgd.nycbug.org/index.cgi?do=view&id=3329" rel="nofollow">First partial boot of FreeBSD on Power8</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/the_new_tnf_board_of" rel="nofollow">The new TNF Board of Directors are installed and patched for 2017.</a></li>
<li><a href="https://osseu17.sched.com/event/BxJw/seccomp2-vs-pledge2-giovanni-bechis-snb-srl" rel="nofollow">Open Source Summit 2017 October 23-26, 2017, Prague, Czech Republic Giovanni Bechis will give a talk about seccomp(2) vs pledge(2)</a></li>
<li><a href="http://nanxiao.me/en/my-first-patch-to-openbsd/" rel="nofollow">My first patch to OpenBSD</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li>Brian - <a href="http://dpaste.com/35WA42Z#wrap" rel="nofollow">OPNSense Facebook Group</a></li>
<li>Mark Felder - <a href="http://dpaste.com/0B8QH2W" rel="nofollow">ZFS Health via SNMP</a></li>
<li>Matt - <a href="http://dpaste.com/1D9WTHV#wrap" rel="nofollow">Cantrill Presentation</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>213: The French CONnection</title>
  <link>https://www.bsdnow.tv/213</link>
  <guid isPermaLink="false">1e3907b4-e886-4922-ae37-e2fa5e898d3e</guid>
  <pubDate>Wed, 27 Sep 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1e3907b4-e886-4922-ae37-e2fa5e898d3e.mp3" length="65524180" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We recap EuroBSDcon in Paris, tell the story behind a pf PR, and show you how to do screencasting with OpenBSD.</itunes:subtitle>
  <itunes:duration>1:31:00</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We recap EuroBSDcon in Paris, tell the story behind a pf PR, and show you how to do screencasting with OpenBSD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Recap of EuroBSDcon 2017 in Paris, France (https://2017.eurobsdcon.org)
EuroBSDcon was held in Paris, France this year, which drew record numbers this year.
With over 300 attendees, it was the largest BSD event I have ever attended, and I was encouraged by the higher than expected number of first time attendees.
The FreeBSD Foundation held a board meeting on Wednesday afternoon with the members who were in Paris. Topics included future conferences (including a conference kit we can mail to people who want to represent FreeBSD) and planning for next year.
The FreeBSD Devsummit started on Thursday at the beautiful Mozilla Office in Paris. After registering and picking up our conference bag, everyone gathered for a morning coffee with lots of handshaking and greeting. We then gathered in the next room which had a podium with microphone, screens as well as tables and chairs. After developers sat down, Benedict opened the devsummit with a small quiz about France for developers to win a Mogics Power Bagel (https://www.mogics.com/?page_id=3824). 45 developers participated and DES won the item in the end. After introductions and collecting topics of interest from everyone, we started with the Work in Progress (WIP) session.
The WIP session had different people present a topic they are working on in 7 minute timeslots. Topics ranged from FreeBSD Forwarding Performance, fast booting options, and a GELI patch under review to attach multiple providers. See their slides on the FreeBSD wiki (https://wiki.freebsd.org/DevSummit/201709).
After lunch, the FreeBSD Foundation gave a general update on staff and funding, as well as a more focused presentation about our partnership with Intel. People were interested to hear what was done so far and asked a few questions to the Intel representative Glenn Weinberg.
After lunch, developers worked quietly on their own projects. The mic remained open and occasionally, people would step forward and gave a short talk without slides or motivated a discussion of common interest. The day concluded with a dinner at a nice restaurant in Paris, which allowed to continue the discussions of the day.
The second day of the devsummit began with a talk about the CAM-based SDIO stack by Ilya Bakulin. His work would allow access to wifi cards/modules on embedded boards like the Raspberry Pi Zero W and similar devices as many of these are using SDIO for data transfers.
Next up was a discussion and Q&amp;amp;A session with the FreeBSD core team members who were there (missing only Benno Rice, Kris Moore, John Baldwin, and Baptiste Daroussin, the latter being busy with conference preparations). The new FCP (FreeBSD community proposals) were introduced for those who were not at BSDCan this year and the hows and whys about it. Allan and I were asked to describe our experiences as new members of core and we encouraged people to run for core when the next election happens. After a short break, Scott Long gave an overview of the work that’s been started on NUMA (Non-Uniform Memory Architecture), what the goals of the project are and who is working on it.
Before lunch, Christian Schwarz presented his work on zrepl, a new ZFS replication solution he developed using Go. This sparked interest in developers, a port was started (https://reviews.freebsd.org/D12462) and people suggested to Christian that he should submit his talk to AsiaBSDcon and BSDCan next year. Benedict had to leave before lunch was done to teach his Ansible tutorial (which was well attended) at the conference venue.
There were organized dinners, for those two nights, quite a feat of organization to fit over 100 people into a restaurant and serve them quickly.
On Saturday, there was a social event, a river cruise down the Seine. This took the form of a ‘standing’ dinner, with a wide selection of appetizer type dishes, designed to get people to walk around and converse with many different people, rather than sit at a table with the same 6-8 people. I talked to a much larger group of people than I had managed to at the other dinners.
I like having both dinner formats.
We would also like to thank all of the BSDNow viewers who attended the conference and made the point of introducing themselves to us. It was nice to meet you all.
The recordings of the live video stream from the conference are available immediately, so you can watch the raw versions of the talks now:
Auditorium
Keynote 1: Software Development in the Age of Heroes (https://youtu.be/4iR8g9-39LM?t=179) by Thomas Pornin (https://twitter.com/BearSSLnews)
Tuning FreeBSD for routing and firewalling (https://youtu.be/4iR8g9-39LM?t=1660) by Olivier Cochard-Labbé (https://twitter.com/ocochardlabbe)
My BSD sucks less than yours, Act I (https://youtu.be/4iR8g9-39LM?t=7040) by Antoine Jacoutot (https://twitter.com/ajacoutot) and Baptiste Daroussin (https://twitter.com/_bapt_)
My BSD sucks less than yours, Act II (https://youtu.be/4iR8g9-39LM?t=14254) by Antoine Jacoutot (https://twitter.com/ajacoutot) and Baptiste Daroussin (https://twitter.com/_bapt_)
Reproducible builds on NetBSD (https://youtu.be/4iR8g9-39LM?t=23351) by Christos Zoulas
Your scheduler is not the problem (https://youtu.be/4iR8g9-39LM?t=26845) by Martin Pieuchot
Keynote 2: A French story on cybercrime (https://youtu.be/4iR8g9-39LM?t=30540) by Éric Freyssinet (https://twitter.com/ericfreyss)
Case studies of sandboxing base system with Capsicum (https://youtu.be/jqdHYEH_BQY?t=731) by Mariusz Zaborski (https://twitter.com/oshogbovx)
OpenBSD’s small steps towards DTrace (a tale about DDB and CTF) (https://youtu.be/jqdHYEH_BQY?t=6030) by Jasper Lievisse Adriaanse
The Realities of DTrace on FreeBSD (https://youtu.be/jqdHYEH_BQY?t=13096) by George Neville-Neil (https://twitter.com/gvnn3)
OpenSMTPD, current state of affairs (https://youtu.be/jqdHYEH_BQY?t=16818) by Gilles Chehade (https://twitter.com/PoolpOrg)
Hoisting: lessons learned integrating pledge into 500 programs (https://youtu.be/jqdHYEH_BQY?t=21764) by Theo de Raadt
Keynote 3: System Performance Analysis Methodologies (https://youtu.be/jqdHYEH_BQY?t=25463) by Brendan Gregg (https://twitter.com/brendangregg)
Closing Session (https://youtu.be/jqdHYEH_BQY?t=29355)
Karnak
“Is it done yet ?” The never ending story of pkg tools (https://youtu.be/1hjzleqGRYk?t=71) by Marc Espie (https://twitter.com/espie_openbsd)
A Tale of six motherboards, three BSDs and coreboot (https://youtu.be/1hjzleqGRYk?t=7498) by Piotr Kubaj and Katarzyna Kubaj
State of the DragonFly’s graphics stack (https://youtu.be/1hjzleqGRYk?t=11475) by François Tigeot
From NanoBSD to ZFS and Jails – FreeBSD as a Hosting Platform, Revisited (https://youtu.be/1hjzleqGRYk?t=16227) by Patrick M. Hausen
Bacula – nobody ever regretted making a backup (https://youtu.be/1hjzleqGRYk?t=20069) by Dan Langille (https://twitter.com/DLangille)
Never Lose a Syslog Message (https://youtu.be/qX0BS4P65cQ?t=325) by Alexander Bluhm
Running CloudABI applications on a FreeBSD-based Kubernetes cluster (https://youtu.be/qX0BS4P65cQ?t=5647) by Ed Schouten (https://twitter.com/EdSchouten)
The OpenBSD web stack (https://youtu.be/qX0BS4P65cQ?t=13255) by Michael W. Lucas (https://twitter.com/mwlauthor)
The LLDB Debugger on NetBSD (https://youtu.be/qX0BS4P65cQ?t=16835) by Kamil Rytarowski
What’s in store for NetBSD 8.0? (https://youtu.be/qX0BS4P65cQ?t=21583) by Alistair Crooks
Louxor
A Modern Replacement for BSD spell(1) (https://youtu.be/6Nen6a1Xl7I?t=156) by Abhinav Upadhyay (https://twitter.com/abhi9u)
Portable Hotplugging: NetBSD’s uvm_hotplug(9) API development (https://youtu.be/6Nen6a1Xl7I?t=5874) by Cherry G. Mathew
Hardening pkgsrc (https://youtu.be/6Nen6a1Xl7I?t=9343) by Pierre Pronchery (https://twitter.com/khorben)
Discovering OpenBSD on AWS (https://youtu.be/6Nen6a1Xl7I?t=14874) by Laurent Bernaille (https://twitter.com/lbernail)
OpenBSD Testing Infrastructure Behind bluhm.genua.de (https://youtu.be/6Nen6a1Xl7I?t=18639) by Jan Klemkow
The school of hard knocks – PT1 (https://youtu.be/8wuW8lfsVGc?t=276) by Sevan Janiyan (https://twitter.com/sevanjaniyan)
7 years of maintaining firefox, and still looking ahead (https://youtu.be/8wuW8lfsVGc?t=5321) by Landry Breuil
Branch VPN solution based on OpenBSD, OSPF, RDomains and Ansible (https://youtu.be/8wuW8lfsVGc?t=12385) by Remi Locherer
Running BSD on AWS (https://youtu.be/8wuW8lfsVGc?t=15983) by Julien Simon and Nicolas David
Getting started with OpenBSD device driver development (https://youtu.be/8wuW8lfsVGc?t=21491) by Stefan Sperling
A huge thanks to the organizers, program committee, and sponsors of EuroBSDCon. Next year, EuroBSDcon will be in Bucharest, Romania.
***
The story of PR 219251 (https://www.sigsegv.be//blog/freebsd/PR219251)
The actual story I wanted Kristof to tell, the pf bug he fixed at the Essen Hackathon earlier this summer.
As I threatened to do in my previous post, I'm going to talk about PR 219251 for a bit. The bug report dates from only a few months ago, but the first report (that I can remeber) actually came from Shawn Webb on Twitter, of all places
Despite there being a stacktrace it took quite a while (nearly 6 months in fact) before I figured this one out.
It took Reshad Patuck managing to distill the problem down to a small-ish test script to make real progress on this. His testcase meant that I could get core dumps and experiment. It also provided valuable clues because it could be tweaked to see what elements were required to trigger the panic.
This test script starts a (vnet) jail, adds an epair interface to it, sets up pf in the jail, and then reloads the pf rules on the host. Interestingly the panic does not seem to occur if that last step is not included.
Obviously not the desired behaviour, but it seems strange. The instances of pf in the jails are supposed to be separate.
We try to fetch a counter value here, but instead we dereference a bad pointer. There's two here, so already we need more information. Inspection of the core dump reveals that the state pointer is valid, and contains sane information. The rule pointer (rule.ptr) points to a sensible location, but the data is mostly 0xdeadc0de. This is the memory allocator being helpful (in debug mode) and writing garbage over freed memory, to make use-after-free bugs like this one easier to find.
In other words: the rule has been free()d while there was still a state pointing to it. Somehow we have a state (describing a connection pf knows about) which points to a rule which no longer exists. The core dump also shows that the problem always occurs with states and rules in the default vnet (i.e. the host pf instance), not one of the pf instances in one of the vnet jails. That matches with the observation that the test script does not trigger the panic unless we also reload the rules on the host.
Great, we know what's wrong, but now we need to work out how we can get into this state. At this point we're going to have to learn something about how rules and states get cleaned up in pf. Don't worry if you had no idea, because before this bug I didn't either.
The states keep a pointer to the rule they match, so when rules are changed (or removed) we can't just delete them. States get cleaned up when connections are closed or they time out. This means we have to keep old rules around until the states that use them expire.
 When rules are removed pfunlinkrule() adds then to the Vpfunlinkedrules list (more on that funny V prefix later). From time to time the pf purge thread will run over all states and mark the rules that are used by a state. Once that's done for all states we know that all rules that are not marked as in-use can be removed (because none of the states use it). That can be a lot of work if we've got a lot of states, so pfpurgethread() breaks that up into smaller chuncks, iterating only part of the state table on every run.
We iterate over all of our virtual pf instances (VNETFOREACH()), check if it's active (for FreeBSD-EN-17.08, where we've seen this code before) and then check the expired states with pfpurgeexpiredstates(). We start at state 'idx' and only process a certain number (determined by the PFTMINTERVAL setting) states. The pfpurgeexpiredstates() function returns a new idx value to tell us how far we got.
So, remember when I mentioned the odd V_ prefix? Those are per-vnet variables. They work a bit like thread-local variables. Each vnet (virtual network stack) keeps its state separate from the others, and the V_ variables use a pointer that's changed whenever we change the currently active vnet (say with CURVNETSET() or CURVNETRESTORE()). That's tracked in the 'curvnet' variable. In other words: there are as many Vpfvnetactive variables as there are vnets: number of vnet jails plus one (for the host system).
Why is that relevant here? Note that idx is not a per-vnet variable, but we handle multiple pf instances here. We run through all of them in fact. That means that we end up checking the first X states in the first vnet, then check the second X states in the second vnet, the third X states in the third and so on and so on.
That of course means that we think we've run through all of the states in a vnet while we really only checked some of them. So when pfpurgeunlinkedrules() runs it can end up free()ing rules that actually are still in use because pfpurgethread() skipped over the state(s) that actually used the rule. The problem only happened if we reloaded rules in the host, because the active ruleset is never free()d, even if there are no states pointing to the rule.
That explains the panic, and the fix is actually quite straightforward: idx needs to be a per-vnet variable, Vpfpurge_idx, and then the problem is gone. As is often the case, the solution to a fairly hard problem turns out to be really simple.
As you might expect, finding the problem takes a lot more work that fixing it
Thanks to Kristof for writing up this detailed post explaining how the problem was found, and what caused it.
***
vBSDcon 2017: BSD at Work (https://www.ixsystems.com/blog/vbsdcon-2017-dexter/)
The third biennial vBSDcon hosted by Verisign took place September 7th through 9th with the FreeBSD Developer Summit taking place the first day. vBSDcon and iXsystems’ MeetBSD event have been alternating between the East and West coasts of the U.S.A. and these two events play vital roles in reaching Washington, DC-area and Bay Area/Silicon Valley audiences. Where MeetBSD serves many BSD Vendors, vBSDcon attracts a unique government and security industry demographic that isn’t found anywhere else. Conference time and travel budgets are always limited and bringing these events to their attendees is a much-appreciated service provided by their hosts.
The vBSDcon FreeBSD DevSummit had a strong focus on OpenZFS, the build system and networking with the FreeBSD 12 wish list of features in mind. How to best incorporate the steady flow of new OpenZFS features into FreeBSD such as dataset-level encryption was of particular interest. This feature from a GNU/Linux-based storage vendor is tribute to the growth of the OpenZFS community which is vital in light of the recent “Death of Solaris and ZFS” at Oracle. There has never been more demand for OpenZFS on FreeBSD and the Oracle news further confirms our collective responsibility to meet that demand.
The official conference opened with my talk on “Isolated BSD Build Environments” in which I explained how the bhyve hypervisor can be used to effortlessly tour FreeBSD 5.0-onward and build specific source releases on demand to trace regressions to their offending commit. I was followed by a FreeNAS user who made the good point that FreeNAS is an exemplary “entry vector” into Unix and Enterprise Storage fundamentals, given that many of the vectors our generation had are gone. Where many of us discovered Unix and the Internet via console terminals at school or work, smart phones are only delivering the Internet without the Unix. With some irony, both iOS and Android are Unix-based yet offer few opportunities for their users to learn and leverage their Unix environments.
The next two talks were The History and Future of Core Dumps in FreeBSD by Sam Gwydir and Using pkgsrc for multi-platform deployments in heterogeneous environments by G. Clifford Williams. I strongly recommend that anyone wanting to speak at AsiaBSDCon read Sam’s accompanying paper on core dumps because I consider it the perfect AsiaBSDCon topic and his execution is excellent. Core dumps are one of those things you rarely think about until they are a DROP EVERYTHING! priority. G. Clifford’s talk was about what I consider a near-perfect BSD project: pkgsrc, the portable BSD package manager. I put it up there with OpenSSH and mandoc as projects that have provided significant value to other Open Source operating systems. G. Clifford’s real-world experiences are perfectly inline with vBSDcon’s goal to be more production-oriented than other BSDCons.
Of the other talks, any and all Dtrace talks are always appreciated and George Neville-Neil’s did not disappoint. He based it on his experiences with the Teach BSD project which is bringing FreeBSD-based computer science education to schools around the world. The security-related talks by John-Mark Gurney, Dean Freeman and Michael Shirk also represented vBSDcon’s consideration of the local community and made a convincing point that the BSDs should make concerted efforts to qualify for Common Criteria, FIPS, and other Government security requirements. While some security experts will scoff at these, they are critical to the adoption of BSD-based products by government agencies.
BSD Now hosts Allan Jude and Benedict Reuschling hosted an OpenZFS BoF and Ansible talk respectively and I hosted a bhyve hypervisor BoF. The Hallway Track and food at vBSDcon were excellent and both culminated with an after-dinner dramatic reading of Michael W. Lucas’ latest book that raised money for the FreeBSD Foundation. A great time was had by all and it was wonderful to see everyone!
News Roundup
FreeBSD 10.4-RC2 Available (https://lists.freebsd.org/pipermail/freebsd-stable/2017-September/087848.html)
FreeBSD 10.4 will be released soon, this is the last chance to find bugs before the official release is cut.
Noteworthy Changes Since 10.4-RC1:
Given that the amd64 disc1 image was overflowing, more of the base components installed into the disc1 (live) file systems had to be disabled.  Most notably, this removed the compiler toolchain from the disc1 images.  All disabled tools are still available with the dvd1 images, though.
The aesni(4) driver now no longer shares a single FPU context across multiple sessions in multiple threads, addressing problems seen when employing aesni(4) for ipsec(4).
Support for netmap(4) by the ixgbe(4) driver has been brought into line with the netmap(4) API present in stable/10.  Also, ixgbe(4) now correctly handles VFs in its netmap(4) support again instead of treating these as PFs.
During the creation of amd64 and i386 VM images, etcupdate(8) and mergemaster(8) databases now are bootstrapped, akin to what happens along the extraction of base.txz as part of a new installation via bsdinstall(8).  This change allows for both of these tools to work out-of-box on the VM images and avoids errors seen when upgrading these images via freebsd-update(8).
If you are still on the stable/10 branch, you should test upgrading to 10.4, and make sure there are no problems with your workload
Additional testing specifically of the features that have changed since 10.4-BETA1 would also be most helpful
This will be the last release from the stable/10 branch
***
OpenBSD changes of note 628 (https://www.tedunangst.com/flak/post/openbsd-changes-of-note-628)
EuroBSDCon in two weeks. Be sure to attend early and often.
Many and various documentation improvements for libcrypto. New man pages, rewrites, expanded bugs sections, and more.
Only allow upward migration in vmd.
There’s a README for the syspatch build system if you want to run your own.
Move the kernel relinking code from /etc/rc into a seperate script usable by syspatch. Kernel patches can now be reduced to just the necessary files.
Make the callers of sogetopt() responsible for allocating memory. Now allocation and free occur in the same place.
Use waitpid() instead of wait() in most programs to avoid accidentally collecting the wrong child.
Have cu call isatty() before making assumptions.
Switch mandoc rendering of mathematical symbols and greek letters from trying to imitate the characters’ graphical shapes, which resulted in unintelligible renderings in many cases, to transliterations conveying the characters’ meanings.
Update libexpat to 2.2.4. Fix copying partial UTF-8 characters.
Sigh, here we go again. 
Work around bug in F5’s handling of the supported elliptic curves extension. RFC 4492 only defines elliptic_curves for ClientHello. However, F5 is sending it in ServerHello. We need to skip over it since our TLS extension parsing code is now more strict.
After a first install, run syspatch -c to check for patches.
If SMAP is present, clear PSL_AC on kernel entry and interrupt so that only the code in copy{in,out}* that need it run with it set. Panic if it’s set on entry to trap() or syscall(). Prompted by Maxime Villard’s NetBSD work. Errata.
New drivers for arm: rktemp, mvpinctrl, mvmpic, mvneta, mvmdio, mvpxa, rkiic, rkpmic.
No need to exec rm from within mandoc. We know there’s exactly one file and directory to remove. Similarly with running cmp.
Revert to Mesa 13.0.6 to hopefully address rendering issues a handful of people have reported with xpdf/fvwm on ivy bridge with modesetting driver.
Rewrite ALPN extension using CBB/CBS and the new extension framework. Rewrite SRTP extension using CBB/CBS and the new extension framework.
Revisit 2q queue sizes. Limit the hot queue to 1/20th the cache size up to a max of 4096 pages. Limit the warm and cold queues to half the cache. This allows us to more effectively notice re-interest in buffers instead of losing it in a large hot queue.
Add glass console support for arm64. Probably not yet for your machine, though.
Replace heaps of hand-written syscall stubs in ld.so with a simpler framework.
65535 is a valid port to listen on.
When xinit starts an X server that listens only on UNIX socket, prefer DISPLAY=unix:0 rather than DISPLAY=:0. This will prevent applications from ever falling back to TCP if the UNIX socket connection fails (such as when the X server crashes). Reverted.
Add -z and -Z options to apmd to auto suspend or hibernate when low on battery.
Remove the original (pre-IETF) chacha20-poly1305 cipher suites.
Add urng(4) which supports various USB RNG devices. Instead of adding one driver per device, start bundling them into a single driver.
Remove old deactivated pledge path code. A replacement mechanism is being brewed.
Fix a bug from the extension parsing rewrite. Always parse ALPN even if no callback has been installed to prevent leaving unprocessed data which leads to a decode error.
Clarify what is meant by syslog priorities being ordered, since the numbers and priorities are backwards.
Remove a stray setlocale() from ksh, eliminating a lot of extra statically linked code.
Unremove some NPN symbols from libssl because ports software thinks they should be there for reasons.
Fix saved stack location after resume. Somehow clang changed it. Resume works again on i386.
Improve error messages in vmd and vmctl to be more informative.
Stop building the miniroot installer for OMAP3 Beagleboards. It hasn’t worked in over a year and nobody noticed.
Have the callers of sosetopt() free the mbuf for symmetry.
On octeon, let the kernel use the hardware FPU even if emulation is compiled in. It’s faster.
Fix support for 486DX CPUs by not calling cpuid. I used to own a 486. Now I don’t.
Merge some drm fixes from linux.
Defer probing of floppy drives, eliminating delays during boot.
Better handling of probes and beacons and timeouts and scans in wifi stack to avoid disconnects.
Move mutex, condvar, and thread-specific data routes, pthreadonce, and pthreadexit from libpthread to libc, along with low-level bits to support them. Let’s thread aware (but not actually threaded) code work with just libc.
New POSIX xlocale implementation. Complete as long as you only use ASCII and UTF-8, as you should.
Round and round it goes; when 6.2 stops, nobody knows. A peak at the future?
***
Screencasting with OpenBSD (http://eradman.com/posts/screencasting.html)
USB Audio
Any USB microphone should appear as a new audio device. Here is the dmesg for my mic by ART:

uaudio0 at uhub0 port 2 configuration 1 interface 0 "M-One USB" rev 1.10/0.01 addr 2
uaudio0: audio rev 1.00, 8 mixer controls
audio1 at uaudio0

audioctl can read off all of the specific characterisitcs of this device

$ audioctl -f /dev/audio1 | grep record
mode=play,record
record.rate=48000
record.channels=1
record.precision=16
record.bps=2
record.msb=1
record.encoding=slinear_le
record.pause=0
record.active=0
record.block_size=1960
record.bytes=0
record.errors=0

Now test the recording from the second audio device using aucat(1)

aucat -f rsnd/1 -o file.wav

If the device also has a headset audio can be played through the same device.

aucat -f rsnd/1 -i file.wav

Screen Capture using Xvfb
The rate at which a framebuffer for your video card is a feature of the hardware and software your using, and it's often very slow. x11vnc will print an estimate of the banwidth for the system your running.

x11vnc
...
09/05/2012 22:23:45 fb read rate: 7 MB/sec

This is about 4fps. We can do much better by using a virtual framebuffer. Here I'm setting up a new screen, setting the background color, starting cwm and an instance of xterm

Xvfb :1 -screen 0 720x540x16 &amp;amp;
DISPLAY=:1 xsetroot -solid steelblue &amp;amp;
DISPLAY=:1 cwm &amp;amp;
DISPLAY=:1 xterm +sb -fa Hermit -fs 14 &amp;amp;

Much better! Now we're up around 20fps.

x11vnc -display :1  &amp;amp;
...
11/05/2012 18:04:07 fb read rate: 168 MB/sec

Make a connection to this virtual screen using raw encoding to eliminate time wasted on compression.

vncviewer localhost -encodings raw

A test recording with sound then looks like this

ffmpeg -f sndio -i snd/1 -y -f x11grab -r 12 -s 800x600 -i :1.0 -vcodec ffv1 ~/out.avi

Note: always stop the recording and playback using q, not Ctrl-C so that audio inputs are shut down properly.
Screen Capture using Xephyr
Xephyr is perhaps the easiest way to run X with a shadow framebuffer. This solution also avoids reading from the video card's RAM, so it's reasonably fast.

Xephyr -ac -br -noreset -screen 800x600 :1 &amp;amp;
DISPLAY=:1 xsetroot -solid steelblue &amp;amp;
DISPLAY=:1 cwm &amp;amp;
DISPLAY=:1 xrdb -load ~/.Xdefaults &amp;amp;
DISPLAY=:1 xterm +sb -fa "Hermit" -fs 14 &amp;amp;

Capture works in exactally the same way. This command tries to maintain 12fps.

ffmpeg -f sndio -i snd/1 -y -f x11grab -r 12 -s 800x600 -i :1.0 -vcodec ffv1 -acodec copy ~/out.avi
To capture keyboard and mouse input press Ctrl then Shift. This is very handy for using navigating a window manager in the nested X session.

Arranging Windows
I have sometimes found it helpful to launch applications and arrange them in a specific way. This will open up a web browser listing the current directory and position windows using xdotool

DISPLAY=:1 midori "file:///pwd" &amp;amp;
sleep 2
DISPLAY=:1 xdotool search --name "xterm" windowmove 0 0
DISPLAY=:1 xdotool search --class "midori" windowmove 400 0
DISPLAY=:1 xdotool search --class "midori" windowsize 400 576

This will position the window precisely so that it appears to be in a tmux window on the right.
Audio/Video Sync
If you find that the audio is way out of sync with the video, you can ajust the start using the -ss before the audio input to specify the number of seconds to delay. My final recording command line, that delays the audio by 0.5 seconds, writing 12fps

ffmpeg -ss 0.5 -f sndio -i snd/1 -y -f x11grab -r 12 -s 800x600 -i :1.0 -vcodec ffv1  -acodec copy ~/out.avi

Sharing a Terminal with tmux
If you're trying to record a terminal session, tmux is able to share a session. In this way a recording of an X framebuffer can be taken without even using the screen. Start by creating the session.

tmux -2 -S /tmp/tmux0

Then on the remote side connect on the same socket

tmux -2 -S /tmp/tmux0 attach

Taking Screenshots
Grabbing a screenshots on Xvfb server is easily accomplished with ImageMagick's import command

DISPLAY=:1 import -window root screenshot.png

Audio Processing and Video Transcoding
The first step is to ensure that the clip begins and ends where you'd like it to. The following will make a copy of the recording starting at time 00:00 and ending at 09:45

ffmpeg -i interactive-sql.avi \
    -vcodec copy -acodec copy
    -ss 00:00:00 -t 00:09:45
    interactive-sql-trimmed.avi
mv interactive-sql-trimmed.avi interactive-sql.avi

Setting the gain correctly is very important with an analog mixer, but if you're using a USB mic there may not be a gain option; simply record using it's built-in settings and then adjust the levels afterwards using a utility such as normalize. First extact the audio as a raw PCM file and then run normalize

ffmpeg -i interactive-sql.avi -c:a copy -vn audio.wav
normalize audio.wav

Next merge the audio back in again

ffmpeg -i interactive-sql.avi -i audio.wav \
    -map 0:0 -map 1:0 -c copy interactive-sql-normalized.avi

The final step is to compress the screencast for distribution. Encoding to VP8/Vorbis is easy:

ffmpeg -i interactive-sql-normalized.avi -c:v libvpx -b:v 1M
    -c:a libvorbis -q:a 6 interactive-sql.webm

H.264/AAC is tricky. For most video players the color space needs to be set to yuv420p. The -movflags puts the index data at the beginning of the file to enable streaming/partial content requests over HTTP:

ffmpeg -y -i interactive-sql-normalized.avi -c:v libx264 \
    -preset slow -crf 14 -pix_fmt yuv420p -movflags +faststart \
    -c:a aac -q:a 6 interactive-sql.mp4

TrueOS @ Ohio Linuxfest ’17! (https://www.trueos.org/blog/trueos-ohio-linuxfest-17/)
Dru Lavigne and Ken Moore are both giving presentations on Saturday the 30th. Sit in and hear about new developments for the Lumina and FreeNAS projects.
Ken is offering Lumina Rising: Challenging Desktop Orthodoxy at 10:15 am in Franklin A. Hear his thoughts about the ideas propelling desktop environment development and how Lumina, especially Lumina 2, is seeking to offer a new model of desktop architecture. Elements discussed include session security, application dependencies, message handling, and operating system integration.
Dru is talking about What’s New in FreeNAS 11 at 2:00 pm in Franklin D. She’ll be providing an overview of some of the new features added in FreeNAS 11.0, including:
Alert Services
Starting specific services at boot time
AD Monitoring to ensure the AD service restarts if disconnected
A preview of the new user interface
support for S3-compatible storage and the bhyve hypervisor
She’s also giving a sneak peek of FreeNAS 11.1, which has some neat features:
A complete rewrite of the Jails/Plugins system as FreeNAS moves from warden to iocage
Writing new plugins with just a few lines of code
A brand new asynchronous middleware API 
Who’s going? Attending this year are:
Dru Lavigne (dlavigne): Dru leads the technical documentation team at iX, and contributes heavily to open source documentation projects like FreeBSD, FreeNAS, and TrueOS.
Ken Moore (beanpole134): Ken is the lead developer of Lumina and a core contributor to TrueOS. He also works on a number of other Qt5 projects for iXsystems.
J.T. Pennington (q5sys): Some of you may be familiar with his work on BSDNow, but J.T. also contributes to the TrueOS, Lumina, and SysAdm projects, helping out with development and general bug squashing.
***
Beastie Bits
Lumina Development Preview: Theme Engine (https://www.trueos.org/blog/lumina-development-preview-theme-engine/)
It's happening! Official retro Thinkpad lappy spotted in the wild (https://www.theregister.co.uk/2017/09/04/retro_thinkpad_spotted_in_the_wild/)
LLVM libFuzzer and SafeStack ported to NetBSD (https://blog.netbsd.org/tnf/entry/llvm_libfuzzer_and_safestack_ported)
Remaining 2017 FreeBSD Events (https://www.freebsdfoundation.org/news-and-events/event-calendar/2017-openzfs-developer-summit/)
***
Feedback/Questions
Andrew - BSD Teaching Material (http://dpaste.com/0YTT0VP)
Seth - Switching to Tarsnap after Crashplan becomes no more (http://dpaste.com/1SK92ZX#wrap)
Thomas - Native encryption in ZFS (http://dpaste.com/02KD5FX#wrap)
Coding Cowboy - Coding Cowboy - Passwords and clipboards (http://dpaste.com/31K0E40#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We recap EuroBSDcon in Paris, tell the story behind a pf PR, and show you how to do screencasting with OpenBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://2017.eurobsdcon.org" rel="nofollow">Recap of EuroBSDcon 2017 in Paris, France</a></h3>

<ul>
<li>EuroBSDcon was held in Paris, France this year, which drew record numbers this year.</li>
<li>With over 300 attendees, it was the largest BSD event I have ever attended, and I was encouraged by the higher than expected number of first time attendees.</li>
<li>The FreeBSD Foundation held a board meeting on Wednesday afternoon with the members who were in Paris. Topics included future conferences (including a conference kit we can mail to people who want to represent FreeBSD) and planning for next year.</li>
<li>The FreeBSD Devsummit started on Thursday at the beautiful Mozilla Office in Paris. After registering and picking up our conference bag, everyone gathered for a morning coffee with lots of handshaking and greeting. We then gathered in the next room which had a podium with microphone, screens as well as tables and chairs. After developers sat down, Benedict opened the devsummit with a small quiz about France for developers to win a <a href="https://www.mogics.com/?page_id=3824" rel="nofollow">Mogics Power Bagel</a>. 45 developers participated and DES won the item in the end. After introductions and collecting topics of interest from everyone, we started with the Work in Progress (WIP) session.</li>
<li>The WIP session had different people present a topic they are working on in 7 minute timeslots. Topics ranged from FreeBSD Forwarding Performance, fast booting options, and a GELI patch under review to attach multiple providers. See their <a href="https://wiki.freebsd.org/DevSummit/201709" rel="nofollow">slides on the FreeBSD wiki</a>.</li>
<li>After lunch, the FreeBSD Foundation gave a general update on staff and funding, as well as a more focused presentation about our partnership with Intel. People were interested to hear what was done so far and asked a few questions to the Intel representative Glenn Weinberg.</li>
<li>After lunch, developers worked quietly on their own projects. The mic remained open and occasionally, people would step forward and gave a short talk without slides or motivated a discussion of common interest. The day concluded with a dinner at a nice restaurant in Paris, which allowed to continue the discussions of the day.</li>
<li>The second day of the devsummit began with a talk about the CAM-based SDIO stack by Ilya Bakulin. His work would allow access to wifi cards/modules on embedded boards like the Raspberry Pi Zero W and similar devices as many of these are using SDIO for data transfers.</li>
<li>Next up was a discussion and Q&amp;A session with the FreeBSD core team members who were there (missing only Benno Rice, Kris Moore, John Baldwin, and Baptiste Daroussin, the latter being busy with conference preparations). The new FCP (FreeBSD community proposals) were introduced for those who were not at BSDCan this year and the hows and whys about it. Allan and I were asked to describe our experiences as new members of core and we encouraged people to run for core when the next election happens. After a short break, Scott Long gave an overview of the work that’s been started on NUMA (Non-Uniform Memory Architecture), what the goals of the project are and who is working on it.</li>
<li>Before lunch, Christian Schwarz presented his work on zrepl, a new ZFS replication solution he developed using Go. This sparked interest in developers, <a href="https://reviews.freebsd.org/D12462" rel="nofollow">a port was started</a> and people suggested to Christian that he should submit his talk to AsiaBSDcon and BSDCan next year. Benedict had to leave before lunch was done to teach his Ansible tutorial (which was well attended) at the conference venue.</li>
<li>There were organized dinners, for those two nights, quite a feat of organization to fit over 100 people into a restaurant and serve them quickly.</li>
<li>On Saturday, there was a social event, a river cruise down the Seine. This took the form of a ‘standing’ dinner, with a wide selection of appetizer type dishes, designed to get people to walk around and converse with many different people, rather than sit at a table with the same 6-8 people. I talked to a much larger group of people than I had managed to at the other dinners.</li>
<li>I like having both dinner formats.</li>
<li>We would also like to thank all of the BSDNow viewers who attended the conference and made the point of introducing themselves to us. It was nice to meet you all.</li>
<li>The recordings of the live video stream from the conference are available immediately, so you can watch the raw versions of the talks now:</li>
<li>Auditorium

<ul>
<li><a href="https://youtu.be/4iR8g9-39LM?t=179" rel="nofollow">Keynote 1: Software Development in the Age of Heroes</a> by <a href="https://twitter.com/BearSSLnews" rel="nofollow">Thomas Pornin</a></li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=1660" rel="nofollow">Tuning FreeBSD for routing and firewalling</a> by <a href="https://twitter.com/ocochardlabbe" rel="nofollow">Olivier Cochard-Labbé</a></li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=7040" rel="nofollow">My BSD sucks less than yours, Act I</a> by <a href="https://twitter.com/ajacoutot" rel="nofollow">Antoine Jacoutot</a> and <a href="https://twitter.com/_bapt_" rel="nofollow">Baptiste Daroussin</a></li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=14254" rel="nofollow">My BSD sucks less than yours, Act II</a> by <a href="https://twitter.com/ajacoutot" rel="nofollow">Antoine Jacoutot</a> and <a href="https://twitter.com/_bapt_" rel="nofollow">Baptiste Daroussin</a></li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=23351" rel="nofollow">Reproducible builds on NetBSD</a> by Christos Zoulas</li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=26845" rel="nofollow">Your scheduler is not the problem</a> by Martin Pieuchot</li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=30540" rel="nofollow">Keynote 2: A French story on cybercrime</a> by <a href="https://twitter.com/ericfreyss" rel="nofollow">Éric Freyssinet</a></li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=731" rel="nofollow">Case studies of sandboxing base system with Capsicum</a> by <a href="https://twitter.com/oshogbovx" rel="nofollow">Mariusz Zaborski</a></li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=6030" rel="nofollow">OpenBSD’s small steps towards DTrace (a tale about DDB and CTF)</a> by Jasper Lievisse Adriaanse</li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=13096" rel="nofollow">The Realities of DTrace on FreeBSD</a> by <a href="https://twitter.com/gvnn3" rel="nofollow">George Neville-Neil</a></li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=16818" rel="nofollow">OpenSMTPD, current state of affairs</a> by <a href="https://twitter.com/PoolpOrg" rel="nofollow">Gilles Chehade</a></li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=21764" rel="nofollow">Hoisting: lessons learned integrating pledge into 500 programs</a> by Theo de Raadt</li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=25463" rel="nofollow">Keynote 3: System Performance Analysis Methodologies</a> by <a href="https://twitter.com/brendangregg" rel="nofollow">Brendan Gregg</a></li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=29355" rel="nofollow">Closing Session</a></li>
</ul></li>
<li>Karnak

<ul>
<li><a href="https://youtu.be/1hjzleqGRYk?t=71" rel="nofollow">“Is it done yet ?” The never ending story of pkg tools</a> by <a href="https://twitter.com/espie_openbsd" rel="nofollow">Marc Espie</a></li>
<li><a href="https://youtu.be/1hjzleqGRYk?t=7498" rel="nofollow">A Tale of six motherboards, three BSDs and coreboot</a> by Piotr Kubaj and Katarzyna Kubaj</li>
<li><a href="https://youtu.be/1hjzleqGRYk?t=11475" rel="nofollow">State of the DragonFly’s graphics stack</a> by François Tigeot</li>
<li><a href="https://youtu.be/1hjzleqGRYk?t=16227" rel="nofollow">From NanoBSD to ZFS and Jails – FreeBSD as a Hosting Platform, Revisited</a> by Patrick M. Hausen</li>
<li><a href="https://youtu.be/1hjzleqGRYk?t=20069" rel="nofollow">Bacula – nobody ever regretted making a backup</a> by <a href="https://twitter.com/DLangille" rel="nofollow">Dan Langille</a></li>
<li><a href="https://youtu.be/qX0BS4P65cQ?t=325" rel="nofollow">Never Lose a Syslog Message</a> by Alexander Bluhm</li>
<li><a href="https://youtu.be/qX0BS4P65cQ?t=5647" rel="nofollow">Running CloudABI applications on a FreeBSD-based Kubernetes cluster</a> by <a href="https://twitter.com/EdSchouten" rel="nofollow">Ed Schouten</a></li>
<li><a href="https://youtu.be/qX0BS4P65cQ?t=13255" rel="nofollow">The OpenBSD web stack</a> by <a href="https://twitter.com/mwlauthor" rel="nofollow">Michael W. Lucas</a></li>
<li><a href="https://youtu.be/qX0BS4P65cQ?t=16835" rel="nofollow">The LLDB Debugger on NetBSD</a> by Kamil Rytarowski</li>
<li><a href="https://youtu.be/qX0BS4P65cQ?t=21583" rel="nofollow">What’s in store for NetBSD 8.0?</a> by Alistair Crooks</li>
</ul></li>
<li>Louxor

<ul>
<li><a href="https://youtu.be/6Nen6a1Xl7I?t=156" rel="nofollow">A Modern Replacement for BSD spell(1)</a> by <a href="https://twitter.com/abhi9u" rel="nofollow">Abhinav Upadhyay</a></li>
<li><a href="https://youtu.be/6Nen6a1Xl7I?t=5874" rel="nofollow">Portable Hotplugging: NetBSD’s uvm_hotplug(9) API development</a> by Cherry G. Mathew</li>
<li><a href="https://youtu.be/6Nen6a1Xl7I?t=9343" rel="nofollow">Hardening pkgsrc</a> by <a href="https://twitter.com/khorben" rel="nofollow">Pierre Pronchery</a></li>
<li><a href="https://youtu.be/6Nen6a1Xl7I?t=14874" rel="nofollow">Discovering OpenBSD on AWS</a> by <a href="https://twitter.com/lbernail" rel="nofollow">Laurent Bernaille</a></li>
<li><a href="https://youtu.be/6Nen6a1Xl7I?t=18639" rel="nofollow">OpenBSD Testing Infrastructure Behind bluhm.genua.de</a> by Jan Klemkow</li>
<li><a href="https://youtu.be/8wuW8lfsVGc?t=276" rel="nofollow">The school of hard knocks – PT1</a> by <a href="https://twitter.com/sevanjaniyan" rel="nofollow">Sevan Janiyan</a></li>
<li><a href="https://youtu.be/8wuW8lfsVGc?t=5321" rel="nofollow">7 years of maintaining firefox, and still looking ahead</a> by Landry Breuil</li>
<li><a href="https://youtu.be/8wuW8lfsVGc?t=12385" rel="nofollow">Branch VPN solution based on OpenBSD, OSPF, RDomains and Ansible</a> by Remi Locherer</li>
<li><a href="https://youtu.be/8wuW8lfsVGc?t=15983" rel="nofollow">Running BSD on AWS</a> by Julien Simon and Nicolas David</li>
<li><a href="https://youtu.be/8wuW8lfsVGc?t=21491" rel="nofollow">Getting started with OpenBSD device driver development</a> by Stefan Sperling</li>
</ul></li>
<li>A huge thanks to the organizers, program committee, and sponsors of EuroBSDCon. Next year, EuroBSDcon will be in Bucharest, Romania.
***</li>
</ul>

<h3><a href="https://www.sigsegv.be//blog/freebsd/PR219251" rel="nofollow">The story of PR 219251</a></h3>

<ul>
<li>The actual story I wanted Kristof to tell, the pf bug he fixed at the Essen Hackathon earlier this summer.</li>
</ul>

<blockquote>
<p>As I threatened to do in my previous post, I&#39;m going to talk about PR 219251 for a bit. The bug report dates from only a few months ago, but the first report (that I can remeber) actually came from Shawn Webb on Twitter, of all places<br>
Despite there being a stacktrace it took quite a while (nearly 6 months in fact) before I figured this one out.<br>
It took Reshad Patuck managing to distill the problem down to a small-ish test script to make real progress on this. His testcase meant that I could get core dumps and experiment. It also provided valuable clues because it could be tweaked to see what elements were required to trigger the panic.<br>
This test script starts a (vnet) jail, adds an epair interface to it, sets up pf in the jail, and then reloads the pf rules on the host. Interestingly the panic does not seem to occur if that last step is not included.</p>
</blockquote>

<ul>
<li>Obviously not the desired behaviour, but it seems strange. The instances of pf in the jails are supposed to be separate.</li>
</ul>

<blockquote>
<p>We try to fetch a counter value here, but instead we dereference a bad pointer. There&#39;s two here, so already we need more information. Inspection of the core dump reveals that the state pointer is valid, and contains sane information. The rule pointer (rule.ptr) points to a sensible location, but the data is mostly 0xdeadc0de. This is the memory allocator being helpful (in debug mode) and writing garbage over freed memory, to make use-after-free bugs like this one easier to find.<br>
In other words: the rule has been free()d while there was still a state pointing to it. Somehow we have a state (describing a connection pf knows about) which points to a rule which no longer exists. The core dump also shows that the problem always occurs with states and rules in the default vnet (i.e. the host pf instance), not one of the pf instances in one of the vnet jails. That matches with the observation that the test script does not trigger the panic unless we also reload the rules on the host.<br>
Great, we know what&#39;s wrong, but now we need to work out how we can get into this state. At this point we&#39;re going to have to learn something about how rules and states get cleaned up in pf. Don&#39;t worry if you had no idea, because before this bug I didn&#39;t either.<br>
The states keep a pointer to the rule they match, so when rules are changed (or removed) we can&#39;t just delete them. States get cleaned up when connections are closed or they time out. This means we have to keep old rules around until the states that use them expire.<br>
 When rules are removed pf_unlink_rule() adds then to the V_pf_unlinked_rules list (more on that funny V_ prefix later). From time to time the pf purge thread will run over all states and mark the rules that are used by a state. Once that&#39;s done for all states we know that all rules that are not marked as in-use can be removed (because none of the states use it). That can be a lot of work if we&#39;ve got a lot of states, so pf_purge_thread() breaks that up into smaller chuncks, iterating only part of the state table on every run.<br>
We iterate over all of our virtual pf instances (VNET_FOREACH()), check if it&#39;s active (for FreeBSD-EN-17.08, where we&#39;ve seen this code before) and then check the expired states with pf_purge_expired_states(). We start at state &#39;idx&#39; and only process a certain number (determined by the PFTM_INTERVAL setting) states. The pf_purge_expired_states() function returns a new idx value to tell us how far we got.<br>
So, remember when I mentioned the odd V_ prefix? Those are per-vnet variables. They work a bit like thread-local variables. Each vnet (virtual network stack) keeps its state separate from the others, and the V_ variables use a pointer that&#39;s changed whenever we change the currently active vnet (say with CURVNET_SET() or CURVNET_RESTORE()). That&#39;s tracked in the &#39;curvnet&#39; variable. In other words: there are as many V_pf_vnet_active variables as there are vnets: number of vnet jails plus one (for the host system).<br>
Why is that relevant here? Note that idx is not a per-vnet variable, but we handle multiple pf instances here. We run through all of them in fact. That means that we end up checking the first X states in the first vnet, then check the second X states in the second vnet, the third X states in the third and so on and so on.<br>
That of course means that we think we&#39;ve run through all of the states in a vnet while we really only checked some of them. So when pf_purge_unlinked_rules() runs it can end up free()ing rules that actually are still in use because pf_purge_thread() skipped over the state(s) that actually used the rule. The problem only happened if we reloaded rules in the host, because the active ruleset is never free()d, even if there are no states pointing to the rule.<br>
That explains the panic, and the fix is actually quite straightforward: idx needs to be a per-vnet variable, V_pf_purge_idx, and then the problem is gone. As is often the case, the solution to a fairly hard problem turns out to be really simple.</p>
</blockquote>

<ul>
<li>As you might expect, finding the problem takes a lot more work that fixing it</li>
<li>Thanks to Kristof for writing up this detailed post explaining how the problem was found, and what caused it.
***</li>
</ul>

<h3><a href="https://www.ixsystems.com/blog/vbsdcon-2017-dexter/" rel="nofollow">vBSDcon 2017: BSD at Work</a></h3>

<blockquote>
<p>The third biennial vBSDcon hosted by Verisign took place September 7th through 9th with the FreeBSD Developer Summit taking place the first day. vBSDcon and iXsystems’ MeetBSD event have been alternating between the East and West coasts of the U.S.A. and these two events play vital roles in reaching Washington, DC-area and Bay Area/Silicon Valley audiences. Where MeetBSD serves many BSD Vendors, vBSDcon attracts a unique government and security industry demographic that isn’t found anywhere else. Conference time and travel budgets are always limited and bringing these events to their attendees is a much-appreciated service provided by their hosts.<br>
The vBSDcon FreeBSD DevSummit had a strong focus on OpenZFS, the build system and networking with the FreeBSD 12 wish list of features in mind. How to best incorporate the steady flow of new OpenZFS features into FreeBSD such as dataset-level encryption was of particular interest. This feature from a GNU/Linux-based storage vendor is tribute to the growth of the OpenZFS community which is vital in light of the recent “Death of Solaris and ZFS” at Oracle. There has never been more demand for OpenZFS on FreeBSD and the Oracle news further confirms our collective responsibility to meet that demand.<br>
The official conference opened with my talk on “Isolated BSD Build Environments” in which I explained how the bhyve hypervisor can be used to effortlessly tour FreeBSD 5.0-onward and build specific source releases on demand to trace regressions to their offending commit. I was followed by a FreeNAS user who made the good point that FreeNAS is an exemplary “entry vector” into Unix and Enterprise Storage fundamentals, given that many of the vectors our generation had are gone. Where many of us discovered Unix and the Internet via console terminals at school or work, smart phones are only delivering the Internet without the Unix. With some irony, both iOS and Android are Unix-based yet offer few opportunities for their users to learn and leverage their Unix environments.<br>
The next two talks were The History and Future of Core Dumps in FreeBSD by Sam Gwydir and Using pkgsrc for multi-platform deployments in heterogeneous environments by G. Clifford Williams. I strongly recommend that anyone wanting to speak at AsiaBSDCon read Sam’s accompanying paper on core dumps because I consider it the perfect AsiaBSDCon topic and his execution is excellent. Core dumps are one of those things you rarely think about until they are a DROP EVERYTHING! priority. G. Clifford’s talk was about what I consider a near-perfect BSD project: pkgsrc, the portable BSD package manager. I put it up there with OpenSSH and mandoc as projects that have provided significant value to other Open Source operating systems. G. Clifford’s real-world experiences are perfectly inline with vBSDcon’s goal to be more production-oriented than other BSDCons.<br>
Of the other talks, any and all Dtrace talks are always appreciated and George Neville-Neil’s did not disappoint. He based it on his experiences with the Teach BSD project which is bringing FreeBSD-based computer science education to schools around the world. The security-related talks by John-Mark Gurney, Dean Freeman and Michael Shirk also represented vBSDcon’s consideration of the local community and made a convincing point that the BSDs should make concerted efforts to qualify for Common Criteria, FIPS, and other Government security requirements. While some security experts will scoff at these, they are critical to the adoption of BSD-based products by government agencies.<br>
BSD Now hosts Allan Jude and Benedict Reuschling hosted an OpenZFS BoF and Ansible talk respectively and I hosted a bhyve hypervisor BoF. The Hallway Track and food at vBSDcon were excellent and both culminated with an after-dinner dramatic reading of Michael W. Lucas’ latest book that raised money for the FreeBSD Foundation. A great time was had by all and it was wonderful to see everyone!</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2017-September/087848.html" rel="nofollow">FreeBSD 10.4-RC2 Available</a></h3>

<ul>
<li>FreeBSD 10.4 will be released soon, this is the last chance to find bugs before the official release is cut.</li>
<li>Noteworthy Changes Since 10.4-RC1:

<ul>
<li>Given that the amd64 disc1 image was overflowing, more of the base components installed into the disc1 (live) file systems had to be disabled.  Most notably, this removed the compiler toolchain from the disc1 images.  All disabled tools are still available with the dvd1 images, though.</li>
<li>The aesni(4) driver now no longer shares a single FPU context across multiple sessions in multiple threads, addressing problems seen when employing aesni(4) for ipsec(4).</li>
<li>Support for netmap(4) by the ixgbe(4) driver has been brought into line with the netmap(4) API present in stable/10.  Also, ixgbe(4) now correctly handles VFs in its netmap(4) support again instead of treating these as PFs.</li>
<li>During the creation of amd64 and i386 VM images, etcupdate(8) and mergemaster(8) databases now are bootstrapped, akin to what happens along the extraction of base.txz as part of a new installation via bsdinstall(8).  This change allows for both of these tools to work out-of-box on the VM images and avoids errors seen when upgrading these images via freebsd-update(8).</li>
</ul></li>
<li>If you are still on the stable/10 branch, you should test upgrading to 10.4, and make sure there are no problems with your workload</li>
<li>Additional testing specifically of the features that have changed since 10.4-BETA1 would also be most helpful</li>
<li>This will be the last release from the stable/10 branch
***</li>
</ul>

<h3><a href="https://www.tedunangst.com/flak/post/openbsd-changes-of-note-628" rel="nofollow">OpenBSD changes of note 628</a></h3>

<blockquote>
<p>EuroBSDCon in two weeks. Be sure to attend early and often.</p>
</blockquote>

<ul>
<li>Many and various documentation improvements for libcrypto. New man pages, rewrites, expanded bugs sections, and more.</li>
<li>Only allow upward migration in vmd.</li>
</ul>

<blockquote>
<p>There’s a README for the syspatch build system if you want to run your own.</p>
</blockquote>

<ul>
<li>Move the kernel relinking code from /etc/rc into a seperate script usable by syspatch. Kernel patches can now be reduced to just the necessary files.</li>
<li>Make the callers of sogetopt() responsible for allocating memory. Now allocation and free occur in the same place.</li>
<li>Use waitpid() instead of wait() in most programs to avoid accidentally collecting the wrong child.</li>
<li>Have cu call isatty() before making assumptions.</li>
<li>Switch mandoc rendering of mathematical symbols and greek letters from trying to imitate the characters’ graphical shapes, which resulted in unintelligible renderings in many cases, to transliterations conveying the characters’ meanings.</li>
<li>Update libexpat to 2.2.4. Fix copying partial UTF-8 characters.</li>
</ul>

<blockquote>
<p>Sigh, here we go again. </p>
</blockquote>

<ul>
<li>Work around bug in F5’s handling of the supported elliptic curves extension. RFC 4492 only defines elliptic_curves for ClientHello. However, F5 is sending it in ServerHello. We need to skip over it since our TLS extension parsing code is now more strict.</li>
<li>After a first install, run syspatch -c to check for patches.</li>
<li>If SMAP is present, clear PSL_AC on kernel entry and interrupt so that only the code in copy{in,out}* that need it run with it set. Panic if it’s set on entry to trap() or syscall(). Prompted by Maxime Villard’s NetBSD work. Errata.</li>
<li>New drivers for arm: rktemp, mvpinctrl, mvmpic, mvneta, mvmdio, mvpxa, rkiic, rkpmic.</li>
<li>No need to exec rm from within mandoc. We know there’s exactly one file and directory to remove. Similarly with running cmp.</li>
<li>Revert to Mesa 13.0.6 to hopefully address rendering issues a handful of people have reported with xpdf/fvwm on ivy bridge with modesetting driver.</li>
<li>Rewrite ALPN extension using CBB/CBS and the new extension framework. Rewrite SRTP extension using CBB/CBS and the new extension framework.</li>
<li>Revisit 2q queue sizes. Limit the hot queue to 1/20th the cache size up to a max of 4096 pages. Limit the warm and cold queues to half the cache. This allows us to more effectively notice re-interest in buffers instead of losing it in a large hot queue.</li>
<li>Add glass console support for arm64. Probably not yet for your machine, though.</li>
<li>Replace heaps of hand-written syscall stubs in ld.so with a simpler framework.</li>
<li>65535 is a valid port to listen on.</li>
<li>When xinit starts an X server that listens only on UNIX socket, prefer DISPLAY=unix:0 rather than DISPLAY=:0. This will prevent applications from ever falling back to TCP if the UNIX socket connection fails (such as when the X server crashes). Reverted.</li>
<li>Add -z and -Z options to apmd to auto suspend or hibernate when low on battery.</li>
<li>Remove the original (pre-IETF) chacha20-poly1305 cipher suites.</li>
<li>Add urng(4) which supports various USB RNG devices. Instead of adding one driver per device, start bundling them into a single driver.</li>
<li>Remove old deactivated pledge path code. A replacement mechanism is being brewed.</li>
<li>Fix a bug from the extension parsing rewrite. Always parse ALPN even if no callback has been installed to prevent leaving unprocessed data which leads to a decode error.</li>
<li>Clarify what is meant by syslog priorities being ordered, since the numbers and priorities are backwards.</li>
<li>Remove a stray setlocale() from ksh, eliminating a lot of extra statically linked code.</li>
<li>Unremove some NPN symbols from libssl because ports software thinks they should be there for reasons.</li>
<li>Fix saved stack location after resume. Somehow clang changed it. Resume works again on i386.</li>
<li>Improve error messages in vmd and vmctl to be more informative.</li>
<li>Stop building the miniroot installer for OMAP3 Beagleboards. It hasn’t worked in over a year and nobody noticed.</li>
<li>Have the callers of sosetopt() free the mbuf for symmetry.</li>
<li>On octeon, let the kernel use the hardware FPU even if emulation is compiled in. It’s faster.</li>
<li>Fix support for 486DX CPUs by not calling cpuid. I used to own a 486. Now I don’t.</li>
<li>Merge some drm fixes from linux.</li>
<li>Defer probing of floppy drives, eliminating delays during boot.</li>
<li>Better handling of probes and beacons and timeouts and scans in wifi stack to avoid disconnects.</li>
<li>Move mutex, condvar, and thread-specific data routes, pthread_once, and pthread_exit from libpthread to libc, along with low-level bits to support them. Let’s thread aware (but not actually threaded) code work with just libc.</li>
<li>New POSIX xlocale implementation. Complete as long as you only use ASCII and UTF-8, as you should.</li>
<li>Round and round it goes; when 6.2 stops, nobody knows. A peak at the future?
***</li>
</ul>

<h3><a href="http://eradman.com/posts/screencasting.html" rel="nofollow">Screencasting with OpenBSD</a></h3>

<ul>
<li>USB Audio</li>
</ul>

<blockquote>
<p>Any USB microphone should appear as a new audio device. Here is the dmesg for my mic by ART:</p>
</blockquote>

<p><code><br>
uaudio0 at uhub0 port 2 configuration 1 interface 0 &quot;M-One USB&quot; rev 1.10/0.01 addr 2<br>
uaudio0: audio rev 1.00, 8 mixer controls<br>
audio1 at uaudio0<br>
</code></p>

<blockquote>
<p>audioctl can read off all of the specific characterisitcs of this device</p>
</blockquote>

<p><code><br>
$ audioctl -f /dev/audio1 | grep record<br>
mode=play,record<br>
record.rate=48000<br>
record.channels=1<br>
record.precision=16<br>
record.bps=2<br>
record.msb=1<br>
record.encoding=slinear_le<br>
record.pause=0<br>
record.active=0<br>
record.block_size=1960<br>
record.bytes=0<br>
record.errors=0<br>
</code></p>

<blockquote>
<p>Now test the recording from the second audio device using aucat(1)</p>
</blockquote>

<p><code><br>
aucat -f rsnd/1 -o file.wav<br>
</code></p>

<blockquote>
<p>If the device also has a headset audio can be played through the same device.</p>
</blockquote>

<p><code><br>
aucat -f rsnd/1 -i file.wav<br>
</code></p>

<ul>
<li>Screen Capture using Xvfb</li>
</ul>

<blockquote>
<p>The rate at which a framebuffer for your video card is a feature of the hardware and software your using, and it&#39;s often very slow. x11vnc will print an estimate of the banwidth for the system your running.</p>
</blockquote>

<p><code><br>
x11vnc<br>
...<br>
09/05/2012 22:23:45 fb read rate: 7 MB/sec<br>
</code></p>

<blockquote>
<p>This is about 4fps. We can do much better by using a virtual framebuffer. Here I&#39;m setting up a new screen, setting the background color, starting cwm and an instance of xterm</p>
</blockquote>

<p><code><br>
Xvfb :1 -screen 0 720x540x16 &amp;<br>
DISPLAY=:1 xsetroot -solid steelblue &amp;<br>
DISPLAY=:1 cwm &amp;<br>
DISPLAY=:1 xterm +sb -fa Hermit -fs 14 &amp;<br>
</code></p>

<blockquote>
<p>Much better! Now we&#39;re up around 20fps.</p>
</blockquote>

<p><code><br>
x11vnc -display :1  &amp;<br>
...<br>
11/05/2012 18:04:07 fb read rate: 168 MB/sec<br>
</code></p>

<blockquote>
<p>Make a connection to this virtual screen using raw encoding to eliminate time wasted on compression.</p>
</blockquote>

<p><code><br>
vncviewer localhost -encodings raw<br>
</code></p>

<blockquote>
<p>A test recording with sound then looks like this</p>
</blockquote>

<p><code><br>
ffmpeg -f sndio -i snd/1 -y -f x11grab -r 12 -s 800x600 -i :1.0 -vcodec ffv1 ~/out.avi<br>
</code></p>

<blockquote>
<p>Note: always stop the recording and playback using q, not Ctrl-C so that audio inputs are shut down properly.</p>
</blockquote>

<ul>
<li>Screen Capture using Xephyr</li>
</ul>

<blockquote>
<p>Xephyr is perhaps the easiest way to run X with a shadow framebuffer. This solution also avoids reading from the video card&#39;s RAM, so it&#39;s reasonably fast.</p>
</blockquote>

<p><code><br>
Xephyr -ac -br -noreset -screen 800x600 :1 &amp;<br>
DISPLAY=:1 xsetroot -solid steelblue &amp;<br>
DISPLAY=:1 cwm &amp;<br>
DISPLAY=:1 xrdb -load ~/.Xdefaults &amp;<br>
DISPLAY=:1 xterm +sb -fa &quot;Hermit&quot; -fs 14 &amp;<br>
</code></p>

<blockquote>
<p>Capture works in exactally the same way. This command tries to maintain 12fps.</p>
</blockquote>

<p><code><br>
ffmpeg -f sndio -i snd/1 -y -f x11grab -r 12 -s 800x600 -i :1.0 -vcodec ffv1 -acodec copy ~/out.avi<br>
To capture keyboard and mouse input press Ctrl then Shift. This is very handy for using navigating a window manager in the nested X session.<br>
</code></p>

<ul>
<li>Arranging Windows</li>
</ul>

<blockquote>
<p>I have sometimes found it helpful to launch applications and arrange them in a specific way. This will open up a web browser listing the current directory and position windows using xdotool</p>
</blockquote>

<p><code><br>
DISPLAY=:1 midori &quot;file:///</code>pwd<code>&quot; &amp;<br>
sleep 2<br>
DISPLAY=:1 xdotool search --name &quot;xterm&quot; windowmove 0 0<br>
DISPLAY=:1 xdotool search --class &quot;midori&quot; windowmove 400 0<br>
DISPLAY=:1 xdotool search --class &quot;midori&quot; windowsize 400 576<br>
</code></p>

<blockquote>
<p>This will position the window precisely so that it appears to be in a tmux window on the right.</p>
</blockquote>

<ul>
<li>Audio/Video Sync</li>
</ul>

<blockquote>
<p>If you find that the audio is way out of sync with the video, you can ajust the start using the -ss before the audio input to specify the number of seconds to delay. My final recording command line, that delays the audio by 0.5 seconds, writing 12fps</p>
</blockquote>

<p><code><br>
ffmpeg -ss 0.5 -f sndio -i snd/1 -y -f x11grab -r 12 -s 800x600 -i :1.0 -vcodec ffv1  -acodec copy ~/out.avi<br>
</code></p>

<ul>
<li>Sharing a Terminal with tmux</li>
</ul>

<blockquote>
<p>If you&#39;re trying to record a terminal session, tmux is able to share a session. In this way a recording of an X framebuffer can be taken without even using the screen. Start by creating the session.</p>
</blockquote>

<p><code><br>
tmux -2 -S /tmp/tmux0<br>
</code></p>

<blockquote>
<p>Then on the remote side connect on the same socket</p>
</blockquote>

<p><code><br>
tmux -2 -S /tmp/tmux0 attach<br>
</code></p>

<ul>
<li>Taking Screenshots</li>
</ul>

<blockquote>
<p>Grabbing a screenshots on Xvfb server is easily accomplished with ImageMagick&#39;s import command</p>
</blockquote>

<p><code><br>
DISPLAY=:1 import -window root screenshot.png<br>
</code></p>

<ul>
<li>Audio Processing and Video Transcoding</li>
</ul>

<blockquote>
<p>The first step is to ensure that the clip begins and ends where you&#39;d like it to. The following will make a copy of the recording starting at time 00:00 and ending at 09:45</p>
</blockquote>

<p><code><br>
ffmpeg -i interactive-sql.avi \<br>
    -vcodec copy -acodec copy<br>
    -ss 00:00:00 -t 00:09:45<br>
    interactive-sql-trimmed.avi<br>
mv interactive-sql-trimmed.avi interactive-sql.avi<br>
</code></p>

<blockquote>
<p>Setting the gain correctly is very important with an analog mixer, but if you&#39;re using a USB mic there may not be a gain option; simply record using it&#39;s built-in settings and then adjust the levels afterwards using a utility such as normalize. First extact the audio as a raw PCM file and then run normalize</p>
</blockquote>

<p><code><br>
ffmpeg -i interactive-sql.avi -c:a copy -vn audio.wav<br>
normalize audio.wav<br>
</code></p>

<blockquote>
<p>Next merge the audio back in again</p>
</blockquote>

<p><code><br>
ffmpeg -i interactive-sql.avi -i audio.wav \<br>
    -map 0:0 -map 1:0 -c copy interactive-sql-normalized.avi<br>
</code></p>

<blockquote>
<p>The final step is to compress the screencast for distribution. Encoding to VP8/Vorbis is easy:</p>
</blockquote>

<p><code><br>
ffmpeg -i interactive-sql-normalized.avi -c:v libvpx -b:v 1M<br>
    -c:a libvorbis -q:a 6 interactive-sql.webm<br>
</code></p>

<blockquote>
<p>H.264/AAC is tricky. For most video players the color space needs to be set to yuv420p. The -movflags puts the index data at the beginning of the file to enable streaming/partial content requests over HTTP:</p>
</blockquote>

<p><code><br>
ffmpeg -y -i interactive-sql-normalized.avi -c:v libx264 \<br>
    -preset slow -crf 14 -pix_fmt yuv420p -movflags +faststart \<br>
    -c:a aac -q:a 6 interactive-sql.mp4<br>
</code></p>

<hr>

<h3><a href="https://www.trueos.org/blog/trueos-ohio-linuxfest-17/" rel="nofollow">TrueOS @ Ohio Linuxfest ’17!</a></h3>

<ul>
<li>Dru Lavigne and Ken Moore are both giving presentations on Saturday the 30th. Sit in and hear about new developments for the Lumina and FreeNAS projects.</li>
<li>Ken is offering Lumina Rising: Challenging Desktop Orthodoxy at 10:15 am in Franklin A. Hear his thoughts about the ideas propelling desktop environment development and how Lumina, especially Lumina 2, is seeking to offer a new model of desktop architecture. Elements discussed include session security, application dependencies, message handling, and operating system integration.</li>
<li>Dru is talking about What’s New in FreeNAS 11 at 2:00 pm in Franklin D. She’ll be providing an overview of some of the new features added in FreeNAS 11.0, including:

<ul>
<li>Alert Services</li>
<li>Starting specific services at boot time</li>
<li>AD Monitoring to ensure the AD service restarts if disconnected</li>
<li>A preview of the new user interface</li>
<li>support for S3-compatible storage and the bhyve hypervisor</li>
</ul></li>
<li>She’s also giving a sneak peek of FreeNAS 11.1, which has some neat features:

<ul>
<li>A complete rewrite of the Jails/Plugins system as FreeNAS moves from warden to iocage</li>
<li>Writing new plugins with just a few lines of code</li>
<li>A brand new asynchronous middleware API </li>
</ul></li>
<li>Who’s going? Attending this year are:

<ul>
<li>Dru Lavigne (dlavigne): Dru leads the technical documentation team at iX, and contributes heavily to open source documentation projects like FreeBSD, FreeNAS, and TrueOS.</li>
<li>Ken Moore (beanpole134): Ken is the lead developer of Lumina and a core contributor to TrueOS. He also works on a number of other Qt5 projects for iXsystems.</li>
<li>J.T. Pennington (q5sys): Some of you may be familiar with his work on BSDNow, but J.T. also contributes to the TrueOS, Lumina, and SysAdm projects, helping out with development and general bug squashing.
***</li>
</ul></li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.trueos.org/blog/lumina-development-preview-theme-engine/" rel="nofollow">Lumina Development Preview: Theme Engine</a></li>
<li><a href="https://www.theregister.co.uk/2017/09/04/retro_thinkpad_spotted_in_the_wild/" rel="nofollow">It&#39;s happening! Official retro Thinkpad lappy spotted in the wild</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/llvm_libfuzzer_and_safestack_ported" rel="nofollow">LLVM libFuzzer and SafeStack ported to NetBSD</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/event-calendar/2017-openzfs-developer-summit/" rel="nofollow">Remaining 2017 FreeBSD Events</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Andrew - <a href="http://dpaste.com/0YTT0VP" rel="nofollow">BSD Teaching Material</a></li>
<li>Seth - <a href="http://dpaste.com/1SK92ZX#wrap" rel="nofollow">Switching to Tarsnap after Crashplan becomes no more</a></li>
<li>Thomas - <a href="http://dpaste.com/02KD5FX#wrap" rel="nofollow">Native encryption in ZFS</a></li>
<li>Coding Cowboy - <a href="http://dpaste.com/31K0E40#wrap" rel="nofollow">Coding Cowboy - Passwords and clipboards</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We recap EuroBSDcon in Paris, tell the story behind a pf PR, and show you how to do screencasting with OpenBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://2017.eurobsdcon.org" rel="nofollow">Recap of EuroBSDcon 2017 in Paris, France</a></h3>

<ul>
<li>EuroBSDcon was held in Paris, France this year, which drew record numbers this year.</li>
<li>With over 300 attendees, it was the largest BSD event I have ever attended, and I was encouraged by the higher than expected number of first time attendees.</li>
<li>The FreeBSD Foundation held a board meeting on Wednesday afternoon with the members who were in Paris. Topics included future conferences (including a conference kit we can mail to people who want to represent FreeBSD) and planning for next year.</li>
<li>The FreeBSD Devsummit started on Thursday at the beautiful Mozilla Office in Paris. After registering and picking up our conference bag, everyone gathered for a morning coffee with lots of handshaking and greeting. We then gathered in the next room which had a podium with microphone, screens as well as tables and chairs. After developers sat down, Benedict opened the devsummit with a small quiz about France for developers to win a <a href="https://www.mogics.com/?page_id=3824" rel="nofollow">Mogics Power Bagel</a>. 45 developers participated and DES won the item in the end. After introductions and collecting topics of interest from everyone, we started with the Work in Progress (WIP) session.</li>
<li>The WIP session had different people present a topic they are working on in 7 minute timeslots. Topics ranged from FreeBSD Forwarding Performance, fast booting options, and a GELI patch under review to attach multiple providers. See their <a href="https://wiki.freebsd.org/DevSummit/201709" rel="nofollow">slides on the FreeBSD wiki</a>.</li>
<li>After lunch, the FreeBSD Foundation gave a general update on staff and funding, as well as a more focused presentation about our partnership with Intel. People were interested to hear what was done so far and asked a few questions to the Intel representative Glenn Weinberg.</li>
<li>After lunch, developers worked quietly on their own projects. The mic remained open and occasionally, people would step forward and gave a short talk without slides or motivated a discussion of common interest. The day concluded with a dinner at a nice restaurant in Paris, which allowed to continue the discussions of the day.</li>
<li>The second day of the devsummit began with a talk about the CAM-based SDIO stack by Ilya Bakulin. His work would allow access to wifi cards/modules on embedded boards like the Raspberry Pi Zero W and similar devices as many of these are using SDIO for data transfers.</li>
<li>Next up was a discussion and Q&amp;A session with the FreeBSD core team members who were there (missing only Benno Rice, Kris Moore, John Baldwin, and Baptiste Daroussin, the latter being busy with conference preparations). The new FCP (FreeBSD community proposals) were introduced for those who were not at BSDCan this year and the hows and whys about it. Allan and I were asked to describe our experiences as new members of core and we encouraged people to run for core when the next election happens. After a short break, Scott Long gave an overview of the work that’s been started on NUMA (Non-Uniform Memory Architecture), what the goals of the project are and who is working on it.</li>
<li>Before lunch, Christian Schwarz presented his work on zrepl, a new ZFS replication solution he developed using Go. This sparked interest in developers, <a href="https://reviews.freebsd.org/D12462" rel="nofollow">a port was started</a> and people suggested to Christian that he should submit his talk to AsiaBSDcon and BSDCan next year. Benedict had to leave before lunch was done to teach his Ansible tutorial (which was well attended) at the conference venue.</li>
<li>There were organized dinners, for those two nights, quite a feat of organization to fit over 100 people into a restaurant and serve them quickly.</li>
<li>On Saturday, there was a social event, a river cruise down the Seine. This took the form of a ‘standing’ dinner, with a wide selection of appetizer type dishes, designed to get people to walk around and converse with many different people, rather than sit at a table with the same 6-8 people. I talked to a much larger group of people than I had managed to at the other dinners.</li>
<li>I like having both dinner formats.</li>
<li>We would also like to thank all of the BSDNow viewers who attended the conference and made the point of introducing themselves to us. It was nice to meet you all.</li>
<li>The recordings of the live video stream from the conference are available immediately, so you can watch the raw versions of the talks now:</li>
<li>Auditorium

<ul>
<li><a href="https://youtu.be/4iR8g9-39LM?t=179" rel="nofollow">Keynote 1: Software Development in the Age of Heroes</a> by <a href="https://twitter.com/BearSSLnews" rel="nofollow">Thomas Pornin</a></li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=1660" rel="nofollow">Tuning FreeBSD for routing and firewalling</a> by <a href="https://twitter.com/ocochardlabbe" rel="nofollow">Olivier Cochard-Labbé</a></li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=7040" rel="nofollow">My BSD sucks less than yours, Act I</a> by <a href="https://twitter.com/ajacoutot" rel="nofollow">Antoine Jacoutot</a> and <a href="https://twitter.com/_bapt_" rel="nofollow">Baptiste Daroussin</a></li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=14254" rel="nofollow">My BSD sucks less than yours, Act II</a> by <a href="https://twitter.com/ajacoutot" rel="nofollow">Antoine Jacoutot</a> and <a href="https://twitter.com/_bapt_" rel="nofollow">Baptiste Daroussin</a></li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=23351" rel="nofollow">Reproducible builds on NetBSD</a> by Christos Zoulas</li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=26845" rel="nofollow">Your scheduler is not the problem</a> by Martin Pieuchot</li>
<li><a href="https://youtu.be/4iR8g9-39LM?t=30540" rel="nofollow">Keynote 2: A French story on cybercrime</a> by <a href="https://twitter.com/ericfreyss" rel="nofollow">Éric Freyssinet</a></li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=731" rel="nofollow">Case studies of sandboxing base system with Capsicum</a> by <a href="https://twitter.com/oshogbovx" rel="nofollow">Mariusz Zaborski</a></li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=6030" rel="nofollow">OpenBSD’s small steps towards DTrace (a tale about DDB and CTF)</a> by Jasper Lievisse Adriaanse</li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=13096" rel="nofollow">The Realities of DTrace on FreeBSD</a> by <a href="https://twitter.com/gvnn3" rel="nofollow">George Neville-Neil</a></li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=16818" rel="nofollow">OpenSMTPD, current state of affairs</a> by <a href="https://twitter.com/PoolpOrg" rel="nofollow">Gilles Chehade</a></li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=21764" rel="nofollow">Hoisting: lessons learned integrating pledge into 500 programs</a> by Theo de Raadt</li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=25463" rel="nofollow">Keynote 3: System Performance Analysis Methodologies</a> by <a href="https://twitter.com/brendangregg" rel="nofollow">Brendan Gregg</a></li>
<li><a href="https://youtu.be/jqdHYEH_BQY?t=29355" rel="nofollow">Closing Session</a></li>
</ul></li>
<li>Karnak

<ul>
<li><a href="https://youtu.be/1hjzleqGRYk?t=71" rel="nofollow">“Is it done yet ?” The never ending story of pkg tools</a> by <a href="https://twitter.com/espie_openbsd" rel="nofollow">Marc Espie</a></li>
<li><a href="https://youtu.be/1hjzleqGRYk?t=7498" rel="nofollow">A Tale of six motherboards, three BSDs and coreboot</a> by Piotr Kubaj and Katarzyna Kubaj</li>
<li><a href="https://youtu.be/1hjzleqGRYk?t=11475" rel="nofollow">State of the DragonFly’s graphics stack</a> by François Tigeot</li>
<li><a href="https://youtu.be/1hjzleqGRYk?t=16227" rel="nofollow">From NanoBSD to ZFS and Jails – FreeBSD as a Hosting Platform, Revisited</a> by Patrick M. Hausen</li>
<li><a href="https://youtu.be/1hjzleqGRYk?t=20069" rel="nofollow">Bacula – nobody ever regretted making a backup</a> by <a href="https://twitter.com/DLangille" rel="nofollow">Dan Langille</a></li>
<li><a href="https://youtu.be/qX0BS4P65cQ?t=325" rel="nofollow">Never Lose a Syslog Message</a> by Alexander Bluhm</li>
<li><a href="https://youtu.be/qX0BS4P65cQ?t=5647" rel="nofollow">Running CloudABI applications on a FreeBSD-based Kubernetes cluster</a> by <a href="https://twitter.com/EdSchouten" rel="nofollow">Ed Schouten</a></li>
<li><a href="https://youtu.be/qX0BS4P65cQ?t=13255" rel="nofollow">The OpenBSD web stack</a> by <a href="https://twitter.com/mwlauthor" rel="nofollow">Michael W. Lucas</a></li>
<li><a href="https://youtu.be/qX0BS4P65cQ?t=16835" rel="nofollow">The LLDB Debugger on NetBSD</a> by Kamil Rytarowski</li>
<li><a href="https://youtu.be/qX0BS4P65cQ?t=21583" rel="nofollow">What’s in store for NetBSD 8.0?</a> by Alistair Crooks</li>
</ul></li>
<li>Louxor

<ul>
<li><a href="https://youtu.be/6Nen6a1Xl7I?t=156" rel="nofollow">A Modern Replacement for BSD spell(1)</a> by <a href="https://twitter.com/abhi9u" rel="nofollow">Abhinav Upadhyay</a></li>
<li><a href="https://youtu.be/6Nen6a1Xl7I?t=5874" rel="nofollow">Portable Hotplugging: NetBSD’s uvm_hotplug(9) API development</a> by Cherry G. Mathew</li>
<li><a href="https://youtu.be/6Nen6a1Xl7I?t=9343" rel="nofollow">Hardening pkgsrc</a> by <a href="https://twitter.com/khorben" rel="nofollow">Pierre Pronchery</a></li>
<li><a href="https://youtu.be/6Nen6a1Xl7I?t=14874" rel="nofollow">Discovering OpenBSD on AWS</a> by <a href="https://twitter.com/lbernail" rel="nofollow">Laurent Bernaille</a></li>
<li><a href="https://youtu.be/6Nen6a1Xl7I?t=18639" rel="nofollow">OpenBSD Testing Infrastructure Behind bluhm.genua.de</a> by Jan Klemkow</li>
<li><a href="https://youtu.be/8wuW8lfsVGc?t=276" rel="nofollow">The school of hard knocks – PT1</a> by <a href="https://twitter.com/sevanjaniyan" rel="nofollow">Sevan Janiyan</a></li>
<li><a href="https://youtu.be/8wuW8lfsVGc?t=5321" rel="nofollow">7 years of maintaining firefox, and still looking ahead</a> by Landry Breuil</li>
<li><a href="https://youtu.be/8wuW8lfsVGc?t=12385" rel="nofollow">Branch VPN solution based on OpenBSD, OSPF, RDomains and Ansible</a> by Remi Locherer</li>
<li><a href="https://youtu.be/8wuW8lfsVGc?t=15983" rel="nofollow">Running BSD on AWS</a> by Julien Simon and Nicolas David</li>
<li><a href="https://youtu.be/8wuW8lfsVGc?t=21491" rel="nofollow">Getting started with OpenBSD device driver development</a> by Stefan Sperling</li>
</ul></li>
<li>A huge thanks to the organizers, program committee, and sponsors of EuroBSDCon. Next year, EuroBSDcon will be in Bucharest, Romania.
***</li>
</ul>

<h3><a href="https://www.sigsegv.be//blog/freebsd/PR219251" rel="nofollow">The story of PR 219251</a></h3>

<ul>
<li>The actual story I wanted Kristof to tell, the pf bug he fixed at the Essen Hackathon earlier this summer.</li>
</ul>

<blockquote>
<p>As I threatened to do in my previous post, I&#39;m going to talk about PR 219251 for a bit. The bug report dates from only a few months ago, but the first report (that I can remeber) actually came from Shawn Webb on Twitter, of all places<br>
Despite there being a stacktrace it took quite a while (nearly 6 months in fact) before I figured this one out.<br>
It took Reshad Patuck managing to distill the problem down to a small-ish test script to make real progress on this. His testcase meant that I could get core dumps and experiment. It also provided valuable clues because it could be tweaked to see what elements were required to trigger the panic.<br>
This test script starts a (vnet) jail, adds an epair interface to it, sets up pf in the jail, and then reloads the pf rules on the host. Interestingly the panic does not seem to occur if that last step is not included.</p>
</blockquote>

<ul>
<li>Obviously not the desired behaviour, but it seems strange. The instances of pf in the jails are supposed to be separate.</li>
</ul>

<blockquote>
<p>We try to fetch a counter value here, but instead we dereference a bad pointer. There&#39;s two here, so already we need more information. Inspection of the core dump reveals that the state pointer is valid, and contains sane information. The rule pointer (rule.ptr) points to a sensible location, but the data is mostly 0xdeadc0de. This is the memory allocator being helpful (in debug mode) and writing garbage over freed memory, to make use-after-free bugs like this one easier to find.<br>
In other words: the rule has been free()d while there was still a state pointing to it. Somehow we have a state (describing a connection pf knows about) which points to a rule which no longer exists. The core dump also shows that the problem always occurs with states and rules in the default vnet (i.e. the host pf instance), not one of the pf instances in one of the vnet jails. That matches with the observation that the test script does not trigger the panic unless we also reload the rules on the host.<br>
Great, we know what&#39;s wrong, but now we need to work out how we can get into this state. At this point we&#39;re going to have to learn something about how rules and states get cleaned up in pf. Don&#39;t worry if you had no idea, because before this bug I didn&#39;t either.<br>
The states keep a pointer to the rule they match, so when rules are changed (or removed) we can&#39;t just delete them. States get cleaned up when connections are closed or they time out. This means we have to keep old rules around until the states that use them expire.<br>
 When rules are removed pf_unlink_rule() adds then to the V_pf_unlinked_rules list (more on that funny V_ prefix later). From time to time the pf purge thread will run over all states and mark the rules that are used by a state. Once that&#39;s done for all states we know that all rules that are not marked as in-use can be removed (because none of the states use it). That can be a lot of work if we&#39;ve got a lot of states, so pf_purge_thread() breaks that up into smaller chuncks, iterating only part of the state table on every run.<br>
We iterate over all of our virtual pf instances (VNET_FOREACH()), check if it&#39;s active (for FreeBSD-EN-17.08, where we&#39;ve seen this code before) and then check the expired states with pf_purge_expired_states(). We start at state &#39;idx&#39; and only process a certain number (determined by the PFTM_INTERVAL setting) states. The pf_purge_expired_states() function returns a new idx value to tell us how far we got.<br>
So, remember when I mentioned the odd V_ prefix? Those are per-vnet variables. They work a bit like thread-local variables. Each vnet (virtual network stack) keeps its state separate from the others, and the V_ variables use a pointer that&#39;s changed whenever we change the currently active vnet (say with CURVNET_SET() or CURVNET_RESTORE()). That&#39;s tracked in the &#39;curvnet&#39; variable. In other words: there are as many V_pf_vnet_active variables as there are vnets: number of vnet jails plus one (for the host system).<br>
Why is that relevant here? Note that idx is not a per-vnet variable, but we handle multiple pf instances here. We run through all of them in fact. That means that we end up checking the first X states in the first vnet, then check the second X states in the second vnet, the third X states in the third and so on and so on.<br>
That of course means that we think we&#39;ve run through all of the states in a vnet while we really only checked some of them. So when pf_purge_unlinked_rules() runs it can end up free()ing rules that actually are still in use because pf_purge_thread() skipped over the state(s) that actually used the rule. The problem only happened if we reloaded rules in the host, because the active ruleset is never free()d, even if there are no states pointing to the rule.<br>
That explains the panic, and the fix is actually quite straightforward: idx needs to be a per-vnet variable, V_pf_purge_idx, and then the problem is gone. As is often the case, the solution to a fairly hard problem turns out to be really simple.</p>
</blockquote>

<ul>
<li>As you might expect, finding the problem takes a lot more work that fixing it</li>
<li>Thanks to Kristof for writing up this detailed post explaining how the problem was found, and what caused it.
***</li>
</ul>

<h3><a href="https://www.ixsystems.com/blog/vbsdcon-2017-dexter/" rel="nofollow">vBSDcon 2017: BSD at Work</a></h3>

<blockquote>
<p>The third biennial vBSDcon hosted by Verisign took place September 7th through 9th with the FreeBSD Developer Summit taking place the first day. vBSDcon and iXsystems’ MeetBSD event have been alternating between the East and West coasts of the U.S.A. and these two events play vital roles in reaching Washington, DC-area and Bay Area/Silicon Valley audiences. Where MeetBSD serves many BSD Vendors, vBSDcon attracts a unique government and security industry demographic that isn’t found anywhere else. Conference time and travel budgets are always limited and bringing these events to their attendees is a much-appreciated service provided by their hosts.<br>
The vBSDcon FreeBSD DevSummit had a strong focus on OpenZFS, the build system and networking with the FreeBSD 12 wish list of features in mind. How to best incorporate the steady flow of new OpenZFS features into FreeBSD such as dataset-level encryption was of particular interest. This feature from a GNU/Linux-based storage vendor is tribute to the growth of the OpenZFS community which is vital in light of the recent “Death of Solaris and ZFS” at Oracle. There has never been more demand for OpenZFS on FreeBSD and the Oracle news further confirms our collective responsibility to meet that demand.<br>
The official conference opened with my talk on “Isolated BSD Build Environments” in which I explained how the bhyve hypervisor can be used to effortlessly tour FreeBSD 5.0-onward and build specific source releases on demand to trace regressions to their offending commit. I was followed by a FreeNAS user who made the good point that FreeNAS is an exemplary “entry vector” into Unix and Enterprise Storage fundamentals, given that many of the vectors our generation had are gone. Where many of us discovered Unix and the Internet via console terminals at school or work, smart phones are only delivering the Internet without the Unix. With some irony, both iOS and Android are Unix-based yet offer few opportunities for their users to learn and leverage their Unix environments.<br>
The next two talks were The History and Future of Core Dumps in FreeBSD by Sam Gwydir and Using pkgsrc for multi-platform deployments in heterogeneous environments by G. Clifford Williams. I strongly recommend that anyone wanting to speak at AsiaBSDCon read Sam’s accompanying paper on core dumps because I consider it the perfect AsiaBSDCon topic and his execution is excellent. Core dumps are one of those things you rarely think about until they are a DROP EVERYTHING! priority. G. Clifford’s talk was about what I consider a near-perfect BSD project: pkgsrc, the portable BSD package manager. I put it up there with OpenSSH and mandoc as projects that have provided significant value to other Open Source operating systems. G. Clifford’s real-world experiences are perfectly inline with vBSDcon’s goal to be more production-oriented than other BSDCons.<br>
Of the other talks, any and all Dtrace talks are always appreciated and George Neville-Neil’s did not disappoint. He based it on his experiences with the Teach BSD project which is bringing FreeBSD-based computer science education to schools around the world. The security-related talks by John-Mark Gurney, Dean Freeman and Michael Shirk also represented vBSDcon’s consideration of the local community and made a convincing point that the BSDs should make concerted efforts to qualify for Common Criteria, FIPS, and other Government security requirements. While some security experts will scoff at these, they are critical to the adoption of BSD-based products by government agencies.<br>
BSD Now hosts Allan Jude and Benedict Reuschling hosted an OpenZFS BoF and Ansible talk respectively and I hosted a bhyve hypervisor BoF. The Hallway Track and food at vBSDcon were excellent and both culminated with an after-dinner dramatic reading of Michael W. Lucas’ latest book that raised money for the FreeBSD Foundation. A great time was had by all and it was wonderful to see everyone!</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2017-September/087848.html" rel="nofollow">FreeBSD 10.4-RC2 Available</a></h3>

<ul>
<li>FreeBSD 10.4 will be released soon, this is the last chance to find bugs before the official release is cut.</li>
<li>Noteworthy Changes Since 10.4-RC1:

<ul>
<li>Given that the amd64 disc1 image was overflowing, more of the base components installed into the disc1 (live) file systems had to be disabled.  Most notably, this removed the compiler toolchain from the disc1 images.  All disabled tools are still available with the dvd1 images, though.</li>
<li>The aesni(4) driver now no longer shares a single FPU context across multiple sessions in multiple threads, addressing problems seen when employing aesni(4) for ipsec(4).</li>
<li>Support for netmap(4) by the ixgbe(4) driver has been brought into line with the netmap(4) API present in stable/10.  Also, ixgbe(4) now correctly handles VFs in its netmap(4) support again instead of treating these as PFs.</li>
<li>During the creation of amd64 and i386 VM images, etcupdate(8) and mergemaster(8) databases now are bootstrapped, akin to what happens along the extraction of base.txz as part of a new installation via bsdinstall(8).  This change allows for both of these tools to work out-of-box on the VM images and avoids errors seen when upgrading these images via freebsd-update(8).</li>
</ul></li>
<li>If you are still on the stable/10 branch, you should test upgrading to 10.4, and make sure there are no problems with your workload</li>
<li>Additional testing specifically of the features that have changed since 10.4-BETA1 would also be most helpful</li>
<li>This will be the last release from the stable/10 branch
***</li>
</ul>

<h3><a href="https://www.tedunangst.com/flak/post/openbsd-changes-of-note-628" rel="nofollow">OpenBSD changes of note 628</a></h3>

<blockquote>
<p>EuroBSDCon in two weeks. Be sure to attend early and often.</p>
</blockquote>

<ul>
<li>Many and various documentation improvements for libcrypto. New man pages, rewrites, expanded bugs sections, and more.</li>
<li>Only allow upward migration in vmd.</li>
</ul>

<blockquote>
<p>There’s a README for the syspatch build system if you want to run your own.</p>
</blockquote>

<ul>
<li>Move the kernel relinking code from /etc/rc into a seperate script usable by syspatch. Kernel patches can now be reduced to just the necessary files.</li>
<li>Make the callers of sogetopt() responsible for allocating memory. Now allocation and free occur in the same place.</li>
<li>Use waitpid() instead of wait() in most programs to avoid accidentally collecting the wrong child.</li>
<li>Have cu call isatty() before making assumptions.</li>
<li>Switch mandoc rendering of mathematical symbols and greek letters from trying to imitate the characters’ graphical shapes, which resulted in unintelligible renderings in many cases, to transliterations conveying the characters’ meanings.</li>
<li>Update libexpat to 2.2.4. Fix copying partial UTF-8 characters.</li>
</ul>

<blockquote>
<p>Sigh, here we go again. </p>
</blockquote>

<ul>
<li>Work around bug in F5’s handling of the supported elliptic curves extension. RFC 4492 only defines elliptic_curves for ClientHello. However, F5 is sending it in ServerHello. We need to skip over it since our TLS extension parsing code is now more strict.</li>
<li>After a first install, run syspatch -c to check for patches.</li>
<li>If SMAP is present, clear PSL_AC on kernel entry and interrupt so that only the code in copy{in,out}* that need it run with it set. Panic if it’s set on entry to trap() or syscall(). Prompted by Maxime Villard’s NetBSD work. Errata.</li>
<li>New drivers for arm: rktemp, mvpinctrl, mvmpic, mvneta, mvmdio, mvpxa, rkiic, rkpmic.</li>
<li>No need to exec rm from within mandoc. We know there’s exactly one file and directory to remove. Similarly with running cmp.</li>
<li>Revert to Mesa 13.0.6 to hopefully address rendering issues a handful of people have reported with xpdf/fvwm on ivy bridge with modesetting driver.</li>
<li>Rewrite ALPN extension using CBB/CBS and the new extension framework. Rewrite SRTP extension using CBB/CBS and the new extension framework.</li>
<li>Revisit 2q queue sizes. Limit the hot queue to 1/20th the cache size up to a max of 4096 pages. Limit the warm and cold queues to half the cache. This allows us to more effectively notice re-interest in buffers instead of losing it in a large hot queue.</li>
<li>Add glass console support for arm64. Probably not yet for your machine, though.</li>
<li>Replace heaps of hand-written syscall stubs in ld.so with a simpler framework.</li>
<li>65535 is a valid port to listen on.</li>
<li>When xinit starts an X server that listens only on UNIX socket, prefer DISPLAY=unix:0 rather than DISPLAY=:0. This will prevent applications from ever falling back to TCP if the UNIX socket connection fails (such as when the X server crashes). Reverted.</li>
<li>Add -z and -Z options to apmd to auto suspend or hibernate when low on battery.</li>
<li>Remove the original (pre-IETF) chacha20-poly1305 cipher suites.</li>
<li>Add urng(4) which supports various USB RNG devices. Instead of adding one driver per device, start bundling them into a single driver.</li>
<li>Remove old deactivated pledge path code. A replacement mechanism is being brewed.</li>
<li>Fix a bug from the extension parsing rewrite. Always parse ALPN even if no callback has been installed to prevent leaving unprocessed data which leads to a decode error.</li>
<li>Clarify what is meant by syslog priorities being ordered, since the numbers and priorities are backwards.</li>
<li>Remove a stray setlocale() from ksh, eliminating a lot of extra statically linked code.</li>
<li>Unremove some NPN symbols from libssl because ports software thinks they should be there for reasons.</li>
<li>Fix saved stack location after resume. Somehow clang changed it. Resume works again on i386.</li>
<li>Improve error messages in vmd and vmctl to be more informative.</li>
<li>Stop building the miniroot installer for OMAP3 Beagleboards. It hasn’t worked in over a year and nobody noticed.</li>
<li>Have the callers of sosetopt() free the mbuf for symmetry.</li>
<li>On octeon, let the kernel use the hardware FPU even if emulation is compiled in. It’s faster.</li>
<li>Fix support for 486DX CPUs by not calling cpuid. I used to own a 486. Now I don’t.</li>
<li>Merge some drm fixes from linux.</li>
<li>Defer probing of floppy drives, eliminating delays during boot.</li>
<li>Better handling of probes and beacons and timeouts and scans in wifi stack to avoid disconnects.</li>
<li>Move mutex, condvar, and thread-specific data routes, pthread_once, and pthread_exit from libpthread to libc, along with low-level bits to support them. Let’s thread aware (but not actually threaded) code work with just libc.</li>
<li>New POSIX xlocale implementation. Complete as long as you only use ASCII and UTF-8, as you should.</li>
<li>Round and round it goes; when 6.2 stops, nobody knows. A peak at the future?
***</li>
</ul>

<h3><a href="http://eradman.com/posts/screencasting.html" rel="nofollow">Screencasting with OpenBSD</a></h3>

<ul>
<li>USB Audio</li>
</ul>

<blockquote>
<p>Any USB microphone should appear as a new audio device. Here is the dmesg for my mic by ART:</p>
</blockquote>

<p><code><br>
uaudio0 at uhub0 port 2 configuration 1 interface 0 &quot;M-One USB&quot; rev 1.10/0.01 addr 2<br>
uaudio0: audio rev 1.00, 8 mixer controls<br>
audio1 at uaudio0<br>
</code></p>

<blockquote>
<p>audioctl can read off all of the specific characterisitcs of this device</p>
</blockquote>

<p><code><br>
$ audioctl -f /dev/audio1 | grep record<br>
mode=play,record<br>
record.rate=48000<br>
record.channels=1<br>
record.precision=16<br>
record.bps=2<br>
record.msb=1<br>
record.encoding=slinear_le<br>
record.pause=0<br>
record.active=0<br>
record.block_size=1960<br>
record.bytes=0<br>
record.errors=0<br>
</code></p>

<blockquote>
<p>Now test the recording from the second audio device using aucat(1)</p>
</blockquote>

<p><code><br>
aucat -f rsnd/1 -o file.wav<br>
</code></p>

<blockquote>
<p>If the device also has a headset audio can be played through the same device.</p>
</blockquote>

<p><code><br>
aucat -f rsnd/1 -i file.wav<br>
</code></p>

<ul>
<li>Screen Capture using Xvfb</li>
</ul>

<blockquote>
<p>The rate at which a framebuffer for your video card is a feature of the hardware and software your using, and it&#39;s often very slow. x11vnc will print an estimate of the banwidth for the system your running.</p>
</blockquote>

<p><code><br>
x11vnc<br>
...<br>
09/05/2012 22:23:45 fb read rate: 7 MB/sec<br>
</code></p>

<blockquote>
<p>This is about 4fps. We can do much better by using a virtual framebuffer. Here I&#39;m setting up a new screen, setting the background color, starting cwm and an instance of xterm</p>
</blockquote>

<p><code><br>
Xvfb :1 -screen 0 720x540x16 &amp;<br>
DISPLAY=:1 xsetroot -solid steelblue &amp;<br>
DISPLAY=:1 cwm &amp;<br>
DISPLAY=:1 xterm +sb -fa Hermit -fs 14 &amp;<br>
</code></p>

<blockquote>
<p>Much better! Now we&#39;re up around 20fps.</p>
</blockquote>

<p><code><br>
x11vnc -display :1  &amp;<br>
...<br>
11/05/2012 18:04:07 fb read rate: 168 MB/sec<br>
</code></p>

<blockquote>
<p>Make a connection to this virtual screen using raw encoding to eliminate time wasted on compression.</p>
</blockquote>

<p><code><br>
vncviewer localhost -encodings raw<br>
</code></p>

<blockquote>
<p>A test recording with sound then looks like this</p>
</blockquote>

<p><code><br>
ffmpeg -f sndio -i snd/1 -y -f x11grab -r 12 -s 800x600 -i :1.0 -vcodec ffv1 ~/out.avi<br>
</code></p>

<blockquote>
<p>Note: always stop the recording and playback using q, not Ctrl-C so that audio inputs are shut down properly.</p>
</blockquote>

<ul>
<li>Screen Capture using Xephyr</li>
</ul>

<blockquote>
<p>Xephyr is perhaps the easiest way to run X with a shadow framebuffer. This solution also avoids reading from the video card&#39;s RAM, so it&#39;s reasonably fast.</p>
</blockquote>

<p><code><br>
Xephyr -ac -br -noreset -screen 800x600 :1 &amp;<br>
DISPLAY=:1 xsetroot -solid steelblue &amp;<br>
DISPLAY=:1 cwm &amp;<br>
DISPLAY=:1 xrdb -load ~/.Xdefaults &amp;<br>
DISPLAY=:1 xterm +sb -fa &quot;Hermit&quot; -fs 14 &amp;<br>
</code></p>

<blockquote>
<p>Capture works in exactally the same way. This command tries to maintain 12fps.</p>
</blockquote>

<p><code><br>
ffmpeg -f sndio -i snd/1 -y -f x11grab -r 12 -s 800x600 -i :1.0 -vcodec ffv1 -acodec copy ~/out.avi<br>
To capture keyboard and mouse input press Ctrl then Shift. This is very handy for using navigating a window manager in the nested X session.<br>
</code></p>

<ul>
<li>Arranging Windows</li>
</ul>

<blockquote>
<p>I have sometimes found it helpful to launch applications and arrange them in a specific way. This will open up a web browser listing the current directory and position windows using xdotool</p>
</blockquote>

<p><code><br>
DISPLAY=:1 midori &quot;file:///</code>pwd<code>&quot; &amp;<br>
sleep 2<br>
DISPLAY=:1 xdotool search --name &quot;xterm&quot; windowmove 0 0<br>
DISPLAY=:1 xdotool search --class &quot;midori&quot; windowmove 400 0<br>
DISPLAY=:1 xdotool search --class &quot;midori&quot; windowsize 400 576<br>
</code></p>

<blockquote>
<p>This will position the window precisely so that it appears to be in a tmux window on the right.</p>
</blockquote>

<ul>
<li>Audio/Video Sync</li>
</ul>

<blockquote>
<p>If you find that the audio is way out of sync with the video, you can ajust the start using the -ss before the audio input to specify the number of seconds to delay. My final recording command line, that delays the audio by 0.5 seconds, writing 12fps</p>
</blockquote>

<p><code><br>
ffmpeg -ss 0.5 -f sndio -i snd/1 -y -f x11grab -r 12 -s 800x600 -i :1.0 -vcodec ffv1  -acodec copy ~/out.avi<br>
</code></p>

<ul>
<li>Sharing a Terminal with tmux</li>
</ul>

<blockquote>
<p>If you&#39;re trying to record a terminal session, tmux is able to share a session. In this way a recording of an X framebuffer can be taken without even using the screen. Start by creating the session.</p>
</blockquote>

<p><code><br>
tmux -2 -S /tmp/tmux0<br>
</code></p>

<blockquote>
<p>Then on the remote side connect on the same socket</p>
</blockquote>

<p><code><br>
tmux -2 -S /tmp/tmux0 attach<br>
</code></p>

<ul>
<li>Taking Screenshots</li>
</ul>

<blockquote>
<p>Grabbing a screenshots on Xvfb server is easily accomplished with ImageMagick&#39;s import command</p>
</blockquote>

<p><code><br>
DISPLAY=:1 import -window root screenshot.png<br>
</code></p>

<ul>
<li>Audio Processing and Video Transcoding</li>
</ul>

<blockquote>
<p>The first step is to ensure that the clip begins and ends where you&#39;d like it to. The following will make a copy of the recording starting at time 00:00 and ending at 09:45</p>
</blockquote>

<p><code><br>
ffmpeg -i interactive-sql.avi \<br>
    -vcodec copy -acodec copy<br>
    -ss 00:00:00 -t 00:09:45<br>
    interactive-sql-trimmed.avi<br>
mv interactive-sql-trimmed.avi interactive-sql.avi<br>
</code></p>

<blockquote>
<p>Setting the gain correctly is very important with an analog mixer, but if you&#39;re using a USB mic there may not be a gain option; simply record using it&#39;s built-in settings and then adjust the levels afterwards using a utility such as normalize. First extact the audio as a raw PCM file and then run normalize</p>
</blockquote>

<p><code><br>
ffmpeg -i interactive-sql.avi -c:a copy -vn audio.wav<br>
normalize audio.wav<br>
</code></p>

<blockquote>
<p>Next merge the audio back in again</p>
</blockquote>

<p><code><br>
ffmpeg -i interactive-sql.avi -i audio.wav \<br>
    -map 0:0 -map 1:0 -c copy interactive-sql-normalized.avi<br>
</code></p>

<blockquote>
<p>The final step is to compress the screencast for distribution. Encoding to VP8/Vorbis is easy:</p>
</blockquote>

<p><code><br>
ffmpeg -i interactive-sql-normalized.avi -c:v libvpx -b:v 1M<br>
    -c:a libvorbis -q:a 6 interactive-sql.webm<br>
</code></p>

<blockquote>
<p>H.264/AAC is tricky. For most video players the color space needs to be set to yuv420p. The -movflags puts the index data at the beginning of the file to enable streaming/partial content requests over HTTP:</p>
</blockquote>

<p><code><br>
ffmpeg -y -i interactive-sql-normalized.avi -c:v libx264 \<br>
    -preset slow -crf 14 -pix_fmt yuv420p -movflags +faststart \<br>
    -c:a aac -q:a 6 interactive-sql.mp4<br>
</code></p>

<hr>

<h3><a href="https://www.trueos.org/blog/trueos-ohio-linuxfest-17/" rel="nofollow">TrueOS @ Ohio Linuxfest ’17!</a></h3>

<ul>
<li>Dru Lavigne and Ken Moore are both giving presentations on Saturday the 30th. Sit in and hear about new developments for the Lumina and FreeNAS projects.</li>
<li>Ken is offering Lumina Rising: Challenging Desktop Orthodoxy at 10:15 am in Franklin A. Hear his thoughts about the ideas propelling desktop environment development and how Lumina, especially Lumina 2, is seeking to offer a new model of desktop architecture. Elements discussed include session security, application dependencies, message handling, and operating system integration.</li>
<li>Dru is talking about What’s New in FreeNAS 11 at 2:00 pm in Franklin D. She’ll be providing an overview of some of the new features added in FreeNAS 11.0, including:

<ul>
<li>Alert Services</li>
<li>Starting specific services at boot time</li>
<li>AD Monitoring to ensure the AD service restarts if disconnected</li>
<li>A preview of the new user interface</li>
<li>support for S3-compatible storage and the bhyve hypervisor</li>
</ul></li>
<li>She’s also giving a sneak peek of FreeNAS 11.1, which has some neat features:

<ul>
<li>A complete rewrite of the Jails/Plugins system as FreeNAS moves from warden to iocage</li>
<li>Writing new plugins with just a few lines of code</li>
<li>A brand new asynchronous middleware API </li>
</ul></li>
<li>Who’s going? Attending this year are:

<ul>
<li>Dru Lavigne (dlavigne): Dru leads the technical documentation team at iX, and contributes heavily to open source documentation projects like FreeBSD, FreeNAS, and TrueOS.</li>
<li>Ken Moore (beanpole134): Ken is the lead developer of Lumina and a core contributor to TrueOS. He also works on a number of other Qt5 projects for iXsystems.</li>
<li>J.T. Pennington (q5sys): Some of you may be familiar with his work on BSDNow, but J.T. also contributes to the TrueOS, Lumina, and SysAdm projects, helping out with development and general bug squashing.
***</li>
</ul></li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.trueos.org/blog/lumina-development-preview-theme-engine/" rel="nofollow">Lumina Development Preview: Theme Engine</a></li>
<li><a href="https://www.theregister.co.uk/2017/09/04/retro_thinkpad_spotted_in_the_wild/" rel="nofollow">It&#39;s happening! Official retro Thinkpad lappy spotted in the wild</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/llvm_libfuzzer_and_safestack_ported" rel="nofollow">LLVM libFuzzer and SafeStack ported to NetBSD</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/event-calendar/2017-openzfs-developer-summit/" rel="nofollow">Remaining 2017 FreeBSD Events</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Andrew - <a href="http://dpaste.com/0YTT0VP" rel="nofollow">BSD Teaching Material</a></li>
<li>Seth - <a href="http://dpaste.com/1SK92ZX#wrap" rel="nofollow">Switching to Tarsnap after Crashplan becomes no more</a></li>
<li>Thomas - <a href="http://dpaste.com/02KD5FX#wrap" rel="nofollow">Native encryption in ZFS</a></li>
<li>Coding Cowboy - <a href="http://dpaste.com/31K0E40#wrap" rel="nofollow">Coding Cowboy - Passwords and clipboards</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>212: The Solaris Eclipse</title>
  <link>https://www.bsdnow.tv/212</link>
  <guid isPermaLink="false">79738da3-b250-4193-a0fe-9184876562bf</guid>
  <pubDate>Wed, 20 Sep 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/79738da3-b250-4193-a0fe-9184876562bf.mp3" length="72690196" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We recap vBSDcon, give you the story behind a PF EN, reminisce in Solaris memories, and show you how to configure different DEs on FreeBSD.</itunes:subtitle>
  <itunes:duration>1:40:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We recap vBSDcon, give you the story behind a PF EN, reminisce in Solaris memories, and show you how to configure different DEs on FreeBSD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
[vBSDCon]
vBSDCon was held September 7 - 9th. We recorded this only a few days after getting home from this great event.
Things started on Wednesday night, as attendees of the thursday developer summit arrived and broke into smallish groups for disorganized dinner and drinks.
We then held an unofficial hacker lounge in a medium sized seating area, working and talking until we all decided that the developer summit started awfully early tomorrow.
The developer summit started with a light breakfast and then then we dove right in
Ed Maste started us off, and then Glen Barber gave a presentation about lessons learned from the 11.1-RELEASE cycle, and comparing it to previous releases. 11.1 was released on time, and was one of the best releases so far. The slides are linked on the DevSummit wiki page (https://wiki.freebsd.org/DevSummit/20170907).
The group then jumped into hackmd.io a collaborative note taking application, and listed of various works in progress and upstreaming efforts. Then we listed wants and needs for the 12.0 release.
After lunch we broke into pairs of working groups, with additional space for smaller meetings. The first pair were, ZFS and Toolchain, followed by a break and then a discussion of IFLIB and network drivers in general. After another break, the last groups of the day met, pkgbase and secure boot.
Then it was time for the vBSDCon reception dinner. This standing dinner was a great way to meet new people, and for attendees to mingle and socialize.
The official hacking lounge Thursday night was busy, and included some great storytelling, along with a bunch of work getting done.
It was very encouraging to watch a struggling new developer getting help from a seasoned veteran. Watching the new developers eyes light up as the new information filled in gaps and they now understood so much more than just a few minutes before, and they raced off to continue working, was inspirational, and reminded me why these conferences are so important.
The hacker lounge shut down relatively early by BSD conference standards, but, the conference proper started at 8:45 sharp the next morning, so it made sense.
Friday saw a string of good presentations, I think my favourite was Jonathan Anderson’s talk on Oblivious sandboxing. Jonathan is a very energetic speaker, and was able to keep everyone focused even during relatively complicated explanations.
Friday night I went for dinner at ‘Big Bowl’, a stir-fry bar, with a largish group of developers and users of both FreeBSD and OpenBSD. The discussions were interesting and varied, and the food was excellent. Benedict had dinner with JT and some other folks from iXsystems.
Friday night the hacker lounge was so large we took over a bigger room (it had better WiFi too).
Saturday featured more great talks. The talk I was most interested in was from Eric McCorkle, who did the EFI version of my GELIBoot work. I had reviewed some of the work, but it was interesting to hear the story of how it happened, and to see the parallels with my own story.
My favourite speaker was Paul Vixie, who gave a very interesting talk about the gets() function in libc. gets() was declared unsafe before the FreeBSD project even started. The original import of the CSRG code into FreeBSD includes the compile time, and run-time warnings against using gets(). OpenBSD removed gets() in version 5.6, in 2014. Following Paul’s presentation, various patches were raised, to either cause use of gets() to crash the program, or to remove gets() entirely, causing such programs to fail to link.
The last talk before the closing was Benedict’s BSD Systems Management with Ansible (https://people.freebsd.org/~bcr/talks/vBSDcon2017_Ansible.pdf).
Shortly after, Allan won a MacBook Pro by correctly guessing the number of components in a jar that was standing next to the registration desk (Benedict was way off, but had a good laugh about the unlikely future Apple user).
Saturday night ended with the Conference Social, and excellent dinner with more great conversations
On Sunday morning, a number of us went to the Smithsonian Air and Space Museum site near the airport, and saw a Concorde, an SR-71, and the space shuttle Discovery, among many other exhibits.
Check out the full photo album by JT (https://t.co/KRmSNzUSus), our producer.
Thanks to all the sponsors for vBSDcon and all the organizers from Verisign, who made it such a great event.
***
The story behind FreeBSD-EN-17.08.pf (https://www.sigsegv.be//blog/freebsd/FreeBSD-EN-17.08.pf)
After our previous deep dive on a bug in episode 209, Kristof Provost, the maintainer of pf on FreeBSD (he is going to hate me for saying that) has written the story behind a recent ERRATA notice for FreeBSD
First things first, so I have to point out that I think Allan misremembered things. The heroic debugging story is PR 219251, which I'll try to write about later. 
FreeBSD-EN-17:08.pf is an issue that affected some FreeBSD 11.x systems, where FreeBSD would panic at startup. There were no reports for CURRENT.
There's very little to go on here, but we do know the cause of the panic ("integer divide fault"), and that the current process was "pf purge". The pf purge thread is part of the pf housekeeping infrastructure. It's a housekeeping kernel thread which cleans up things like old states and expired fragments.
The lack of mention of pf functions in the backtrace is a hint unto itself. It suggests that the error is probably directly in pfpurgethread(). It might also be in one of the static functions it calls, because compilers often just inline those so they don't generate stack frames. 
Remember that the problem is an "integer divide fault". How can integer divisions be a problem? Well, you can try to divide by zero. The most obvious suspect for this is this code:
  idx = pfpurgeexpiredstates(idx, pfhashmask / (Vpfdefaultrule.timeout[PFTMINTERVAL] * 10));
However, this variable is both correctly initialised (in pfattachvnet()) and can only be modified through the DIOCSETTIMEOUT ioctl() call and that one checks for zero. 
At that point I had no idea how this could happen, but because the problem did not affect CURRENT I looked at the commit history and found this commit from Luiz Otavio O Souza:
  Do not run the pf purge thread while the VNET variables are not initialized, this can cause a divide by zero (if the VNET initialization takes to long to complete).
  Obtained from:  pfSense
  Sponsored by:   Rubicon Communications, LLC (Netgate)
That sounds very familiar, and indeed, applying the patch fixed the problem. Luiz explained it well: it's possible to use Vpfdefaultrule.timeout before it's initialised, which caused this panic. 
To me, this reaffirms the importance of writing good commit messages: because Luiz mentioned both the pf purge thread and the division by zero I was easily able to find the relevant commit. If I hadn't found it this fix would have taken a lot longer. 
Next week we’ll look at the more interesting story I was interested in, which I managed to nag Kristof into writing
***
The sudden death and eternal life of Solaris (http://dtrace.org/blogs/bmc/2017/09/04/the-sudden-death-and-eternal-life-of-solaris/)
A blog post from Bryan Cantrill about the death of Solaris
As had been rumored for a while, Oracle effectively killed Solaris. When I first saw this, I had assumed that this was merely a deep cut, but in talking to Solaris engineers still at Oracle, it is clearly much more than that. It is a cut so deep as to be fatal: the core Solaris engineering organization lost on the order of 90% of its people, including essentially all management.
Of note, among the engineers I have spoken with, I heard two things repeatedly: “this is the end” and (from those who managed to survive Friday) “I wish I had been laid off.” Gone is any of the optimism (however tepid) that I have heard over the years — and embarrassed apologies for Oracle’s behavior have been replaced with dismay about the clumsiness, ineptitude and callousness with which this final cut was handled. In particular, that employees who had given their careers to the company were told of their termination via a pre-recorded call — “robo-RIF’d” in the words of one employee — is both despicable and cowardly. To their credit, the engineers affected saw themselves as Sun to the end: they stayed to solve hard, interesting problems and out of allegiance to one another — not out of any loyalty to the broader Oracle. Oracle didn’t deserve them and now it doesn’t have them — they have been liberated, if in a depraved act of corporate violence.
Assuming that this is indeed the end of Solaris (and it certainly looks that way), it offers a time for reflection. Certainly, the demise of Solaris is at one level not surprising, but on the other hand, its very suddenness highlights the degree to which proprietary software can suffer by the vicissitudes of corporate capriciousness. Vulnerable to executive whims, shareholder demands, and a fickle public, organizations can simply change direction by fiat. And because — in the words of the late, great Roger Faulkner — “it is easier to destroy than to create,” these changes in direction can have lasting effect when they mean stopping (or even suspending!) work on a project. Indeed, any engineer in any domain with sufficient longevity will have one (or many!) stories of exciting projects being cancelled by foolhardy and myopic management. For software, though, these cancellations can be particularly gutting because (in the proprietary world, anyway) so many of the details of software are carefully hidden from the users of the product — and much of the innovation of a cancelled software project will likely die with the project, living only in the oral tradition of the engineers who knew it. Worse, in the long run — to paraphrase Keynes — proprietary software projects are all dead. However ubiquitous at their height, this lonely fate awaits all proprietary software. 
There is, of course, another way — and befitting its idiosyncratic life and death, Solaris shows us this path too: software can be open source. In stark contrast to proprietary software, open source does not — cannot, even — die. Yes, it can be disused or rusty or fusty, but as long as anyone is interested in it at all, it lives and breathes. Even should the interest wane to nothing, open source software survives still: its life as machine may be suspended, but it becomes as literature, waiting to be discovered by a future generation. That is, while proprietary software can die in an instant, open source software perpetually endures by its nature — and thrives by the strength of its communities. Just as the existence of proprietary software can be surprisingly brittle, open source communities can be crazily robust: they can survive neglect, derision, dissent — even sabotage.
In this regard, I speak from experience: from when Solaris was open sourced in 2005, the OpenSolaris community survived all of these things. By the time Oracle bought Sun five years later in 2010, the community had decided that it needed true independence — illumos was born. And, it turns out, illumos was born at exactly the right moment: shortly after illumos was announced, Oracle — in what remains to me a singularly loathsome and cowardly act — silently re-proprietarized Solaris on August 13, 2010. We in illumos were indisputably on our own, and while many outsiders gave us no chance of survival, we ourselves had reason for confidence: after all, open source communities are robust because they are often united not only by circumstance, but by values, and in our case, we as a community never lost our belief in ZFS, Zones, DTrace and myriad other technologies like MDB, FMA and Crossbow.
Indeed, since 2010, illumos has thrived; illumos is not only the repository of record for technologies that have become cross-platform like OpenZFS, but we have also advanced our core technologies considerably, while still maintaining highest standards of quality. Learning some of the mistakes of OpenSolaris, we have a model that allows for downstream innovation, experimentation and differentiation. For example, Joyent’s SmartOS has always been focused on our need for a cloud hypervisor (causing us to develop big features like hardware virtualization and Linux binary compatibility), and it is now at the heart of a massive buildout for Samsung (who acquired Joyent a little over a year ago). For us at Joyent, the Solaris/illumos/SmartOS saga has been formative in that we have seen both the ill effects of proprietary software and the amazing resilience of open source software — and it very much informed our decision to open source our entire stack in 2014.
Judging merely by its tombstone, the life of Solaris can be viewed as tragic: born out of wedlock between Sun and AT&amp;amp;T and dying at the hands of a remorseless corporate sociopath a quarter century later. And even that may be overstating its longevity: Solaris may not have been truly born until it was made open source, and — certainly to me, anyway — it died the moment it was again made proprietary. But in that shorter life, Solaris achieved the singular: immortality for its revolutionary technologies. So while we can mourn the loss of the proprietary embodiment of Solaris (and we can certainly lament the coarse way in which its technologists were treated!), we can rejoice in the eternal life of its technologies — in illumos and beyond!
News Roundup
OpenBSD on the Lenovo Thinkpad X1 Carbon (5th Gen) (https://jcs.org/2017/09/01/thinkpad_x1c)
Joshua Stein writes about his experiences running OpenBSD on the 5th generation Lenovo Thinkpad X1 Carbon:
ThinkPads have sort of a cult following among OpenBSD developers and users because the hardware is basic and well supported, and the keyboards are great to type on. While no stranger to ThinkPads myself, most of my OpenBSD laptops in recent years have been from various vendors with brand new hardware components that OpenBSD does not yet support. As satisfying as it is to write new kernel drivers or extend existing ones to make that hardware work, it usually leaves me with a laptop that doesn't work very well for a period of months.
After exhausting efforts trying to debug the I2C touchpad interrupts on the Huawei MateBook X (and other 100-Series Intel chipset laptops), I decided to take a break and use something with better OpenBSD support out of the box: the fifth generation Lenovo ThinkPad X1 Carbon.
Hardware
Like most ThinkPads, the X1 Carbon is available in a myriad of different internal configurations. I went with the non-vPro Core i7-7500U (it was the same price as the Core i5 that I normally opt for), 16Gb of RAM, a 256Gb NVMe SSD, and a WQHD display.
This generation of X1 Carbon finally brings a thinner screen bezel, allowing the entire footprint of the laptop to be smaller which is welcome on something with a 14" screen. The X1 now measures 12.7" wide, 8.5" deep, and 0.6" thick, and weighs just 2.6 pounds. While not available at initial launch, Lenovo is now offering a WQHD IPS screen option giving a resolution of 2560x1440. Perhaps more importantly, this display also has much better brightness than the FHD version, something ThinkPads have always struggled with.
On the left side of the laptop are two USB-C ports, a USB-A port, a full-size HDMI port, and a port for the ethernet dongle which, despite some reviews stating otherwise, is not included with the laptop. On the right side is another USB-A port and a headphone jack, along with a fan exhaust grille. On the back is a tray for the micro-SIM card for the optional WWAN device, which also covers the Realtek microSD card reader. The tray requires a paperclip to eject which makes it inconvenient to remove, so I think this microSD card slot is designed to house a card semi-permanently as a backup disk or something.
On the bottom are the two speakers towards the front and an exhaust grille near the center. The four rubber feet are rather plastic feeling, which allows the laptop to slide around on a desk a bit too much for my liking. I wish they were a bit softer to be stickier.
Charging can be done via either of the two USB-C ports on the left, though I wish more vendors would do as Google did on the Chromebook Pixel and provide a port on both sides. This makes it much more convenient to charge when not at one's desk, rather than having to route a cable around to one specific side. The X1 Carbon includes a 65W USB-C PD with a fixed USB-C cable and removable country-specific power cable, which is not very convenient due to its large footprint. I am using an Apple 61W USB-C charger and an Anker cable which charge the X1 fine (unlike HP laptops which only work with HP USB-C chargers).
Wireless connectivity is provided by a removable Intel 8265 802.11a/b/g/n/ac WiFi and Bluetooth 4.1 card. An Intel I219-V chip provides ethernet connectivity and requires an external dongle for the physical cable connection.
The screen hinge is rather tight, making it difficult to open with one hand. The tradeoff is that the screen does not wobble in the least bit when typing.
The fan is silent at idle, and there is no coil whine even under heavy load. During a make -j4 build, the fan noise is reasonable and medium-pitched, rather than a high-pitched whine like on some laptops. The palm rest and keyboard area remain cool during high CPU utilization.
The full-sized keyboard is backlit and offers two levels of adjustment. The keys have a soft surface and a somewhat clicky feel, providing very quiet typing except for certain keys like Enter, Backspace, and Escape. The keyboard has a reported key travel of 1.5mm and there are dedicated Page Up and Page Down keys above the Left and Right arrow keys. Dedicated Home, End, Insert, and Delete keys are along the top row. The Fn key is placed to the left of Control, which some people hate (although Lenovo does provide a BIOS option to swap it), but it's in the same position on Apple keyboards so I'm used to it. However, since there are dedicated Page Up, Page Down, Home, and End keys, I don't really have a use for the Fn key anyway.
Firmware
The X1 Carbon has a very detailed BIOS/firmware menu which can be entered with the F1 key at boot. F12 can be used to temporarily select a different boot device.
A neat feature of the Lenovo BIOS is that it supports showing a custom boot logo instead of the big red Lenovo logo. From Windows, download the latest BIOS Update Utility for the X1 Carbon (my model was 20HR). Run it and it'll extract everything to C:\drivers\flash(some random string). Drop a logo.gif file in that directory and run winuptp.exe. If a logo file is present, it'll ask whether to use it and then write the new BIOS to its staging area, then reboot to actually flash it.
+ OpenBSD support
Secure Boot has to be disabled in the BIOS menu, and the "CSM Support" option must be enabled, even when "UEFI/Legacy Boot" is left on "UEFI Only". Otherwise the screen will just go black after the OpenBSD kernel loads into memory.
Based on this component list, it seems like everything but the fingerprint sensor works fine on OpenBSD.
***
Configuring 5 different desktop environments on FreeBSD (https://www.linuxsecrets.com/en/entry/51-freebsd/2017/09/04/2942-configure-5-freebsd-x-environments)
This fairly quick tutorial over at LinuxSecrets.com is a great start if you are new to FreeBSD, especially if you are coming from Linux and miss your favourite desktop environment
It just goes to show how easy it is to build the desktop you want on modern FreeBSD
The tutorial covers: GNOME, KDE, Xfce, Mate, and Cinnamon
The instructions for each boil down to some variation of:
Install the desktop environment and a login manager if it is not included:
&amp;gt; sudo pkg install gnome3
Enable the login manager, and usually dbus and hald:
&amp;gt; sudo sysrc dbusenable="YES" haldenable="YES" gdmenable="YES" gnomeenable="YES"?
If using a generic login manager, add the DE startup command to your .xinitrc:
&amp;gt; echo "exec cinnamon" &amp;gt; ~/.xinitrc 
And that is about it. 
The tutorial goes into more detail on other configuration you can do to get your desktop just the way you like it.
To install Lumina:
&amp;gt; sudo pkg install lumina pcbsd-utils-qt5
This will install Lumina and the pcbsd utilities package which includes pcdm, the login manager. In the near future we hear the login manager and some of the other utilities will be split into separate packages, making it easier to use them on vanilla FreeBSD.
&amp;gt; sudo sysrc pcdmenable=”YES” dbusenable="YES" hald_enable="YES" 
Reboot, and you should be greeted with the graphical login screen
***
A return-oriented programming defense from OpenBSD (https://lwn.net/Articles/732201/)
We talked a bit about RETGUARD last week, presenting Theo’s email announcing the new feature
Linux Weekly News has a nice breakdown on just how it works
Stack-smashing attacks have a long history; they featured, for example, as a core part of the Morris worm back in 1988. Restrictions on executing code on the stack have, to a great extent, put an end to such simple attacks, but that does not mean that stack-smashing attacks are no longer a threat. Return-oriented programming (ROP) has become a common technique for compromising systems via a stack-smashing vulnerability. There are various schemes out there for defeating ROP attacks, but a mechanism called "RETGUARD" that is being implemented in OpenBSD is notable for its relative simplicity.
In a classic stack-smashing attack, the attack code would be written directly to the stack and executed there. Most modern systems do not allow execution of on-stack code, though, so this kind of attack will be ineffective. The stack does affect code execution, though, in that the call chain is stored there; when a function executes a "return" instruction, the address to return to is taken from the stack. An attacker who can overwrite the stack can, thus, force a function to "return" to an arbitrary location.
That alone can be enough to carry out some types of attacks, but ROP adds another level of sophistication. A search through a body of binary code will turn up a great many short sequences of instructions ending in a return instruction. These sequences are termed "gadgets"; a large program contains enough gadgets to carry out almost any desired task — if they can be strung together into a chain. ROP works by locating these gadgets, then building a series of stack frames so that each gadget "returns" to the next.
There is, of course, a significant limitation here: a ROP chain made up of exclusively polymorphic gadgets will still work, since those gadgets were not (intentionally) created by the compiler and do not contain the return-address-mangling code. De Raadt acknowledged this limitation, but said: "we believe once standard-RET is solved those concerns become easier to address separately in the future. In any case a substantial reduction of gadgets is powerful".
Using the compiler to insert the hardening code greatly eases the task of applying RETGUARD to both the OpenBSD kernel and its user-space code. At least, that is true for code written in a high-level language. Any code written in assembly must be changed by hand, though, which is a fair amount of work. De Raadt and company have done that work; he reports that: "We are at the point where userland and base are fully working without regressions, and the remaining impacts are in a few larger ports which directly access the return address (for a variety of reasons)". It can be expected that, once these final issues are dealt with, OpenBSD will ship with this hardening enabled.
The article wonders about applying the same to Linux, but notes it would be difficult because the Linux kernel cannot currently be compiled using LLVM
If any benchmarks have been run to determine the cost of using RETGUARD, they have not been publicly posted. The extra code will make the kernel a little bigger, and the extra overhead on every function is likely to add up in the end. But if this technique can make the kernel that much harder to exploit, it may well justify the extra execution overhead that it brings with it. All that's needed is somebody to actually do the work and try it out.
Videos from BSDCan have started to appear! (https://www.youtube.com/playlist?list=PLeF8ZihVdpFfVEsCxNWGDmcATJfRZacHv)
Henning Brauer: tcp synfloods - BSDCan 2017 (https://www.youtube.com/watch?v=KuHepyI0_KY)
Benno Rice: The Trouble with FreeBSD - BSDCan 2017 (https://www.youtube.com/watch?v=1DM5SwoXWSU)
Li-Wen Hsu: Continuous Integration of The FreeBSD Project - BSDCan 2017 (https://www.youtube.com/watch?v=SCLfKWaUGa8)
Andrew Turner: GENERIC ARM - BSDCan 2017 (https://www.youtube.com/watch?v=gkYjvrFvPJ0)
Bjoern A. Zeeb: From the outside - BSDCan 2017 (https://www.youtube.com/watch?v=sYmW_H6FrWo)
Rodney W. Grimes: FreeBSD as a Service - BSDCan 2017 (https://www.youtube.com/watch?v=Zf9tDJhoVbA)
Reyk Floeter: The OpenBSD virtual machine daemon - BSDCan 2017 (https://www.youtube.com/watch?v=Os9L_sOiTH0)
Brian Kidney: The Realities of DTrace on FreeBSD - BSDCan 2017 (https://www.youtube.com/watch?v=NMUf6VGK2fI)
The rest will continue to trickle out, likely not until after EuroBSDCon
***
Beastie Bits
Oracle has killed sun (https://meshedinsights.com/2017/09/03/oracle-finally-killed-sun/)
Configure Thunderbird to send patch friendly (http://nanxiao.me/en/configure-thunderbird-to-send-patch-friendly/)
FreeBSD 10.4-BETA4 Available (https://www.freebsd.org/news/newsflash.html#event20170909:01)
iXsystems looking to hire kernel and zfs developers (especially Sun/Oracle Refugees) (https://www.facebook.com/ixsystems/posts/10155403417921508)
Speaking of job postings, UnitedBSD.com has few job postings related to BSD (https://unitedbsd.com/)
Call for papers
USENIX FAST ‘18 - February 12-15, 2018, Due: September 28 2017 (https://www.freebsdfoundation.org/news-and-events/call-for-papers/usenix-fast-18-call-for-papers/)
Scale 16x - March 8-11, 2018, Due: October 31, 2017  (https://www.freebsdfoundation.org/news-and-events/call-for-papers/scale-16x-call-for-participation/)
FOSDEM ‘18 - February 3-4, 2018, Due: November 3 2017  (https://www.freebsdfoundation.org/news-and-events/call-for-papers/fosdem-18-call-for-participation/)
Feedback/Questions
Jason asks about cheap router hardware (http://dpaste.com/340KRHG)
Prashant asks about latest kernels with freebsd-update (http://dpaste.com/2J7DQQ6)
Matt wants know about VM Performance &amp;amp; CPU Steal Time (http://dpaste.com/1H5SZ81)
John has config questions regarding Dell precision 7720, FreeBSD, NVME, and ZFS (http://dpaste.com/0X770SY)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We recap vBSDcon, give you the story behind a PF EN, reminisce in Solaris memories, and show you how to configure different DEs on FreeBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>[vBSDCon]</h3>

<ul>
<li>vBSDCon was held September 7 - 9th. We recorded this only a few days after getting home from this great event.</li>
<li>Things started on Wednesday night, as attendees of the thursday developer summit arrived and broke into smallish groups for disorganized dinner and drinks.</li>
<li>We then held an unofficial hacker lounge in a medium sized seating area, working and talking until we all decided that the developer summit started awfully early tomorrow.</li>
<li>The developer summit started with a light breakfast and then then we dove right in</li>
<li>Ed Maste started us off, and then Glen Barber gave a presentation about lessons learned from the 11.1-RELEASE cycle, and comparing it to previous releases. 11.1 was released on time, and was one of the best releases so far. The slides are linked on the <a href="https://wiki.freebsd.org/DevSummit/20170907" rel="nofollow">DevSummit wiki page</a>.</li>
<li>The group then jumped into hackmd.io a collaborative note taking application, and listed of various works in progress and upstreaming efforts. Then we listed wants and needs for the 12.0 release.</li>
<li>After lunch we broke into pairs of working groups, with additional space for smaller meetings. The first pair were, ZFS and Toolchain, followed by a break and then a discussion of IFLIB and network drivers in general. After another break, the last groups of the day met, pkgbase and secure boot.</li>
<li>Then it was time for the vBSDCon reception dinner. This standing dinner was a great way to meet new people, and for attendees to mingle and socialize.</li>
<li>The official hacking lounge Thursday night was busy, and included some great storytelling, along with a bunch of work getting done.</li>
<li>It was very encouraging to watch a struggling new developer getting help from a seasoned veteran. Watching the new developers eyes light up as the new information filled in gaps and they now understood so much more than just a few minutes before, and they raced off to continue working, was inspirational, and reminded me why these conferences are so important.</li>
<li>The hacker lounge shut down relatively early by BSD conference standards, but, the conference proper started at 8:45 sharp the next morning, so it made sense.</li>
<li>Friday saw a string of good presentations, I think my favourite was Jonathan Andersons talk on Oblivious sandboxing. Jonathan is a very energetic speaker, and was able to keep everyone focused even during relatively complicated explanations.</li>
<li>Friday night I went for dinner at Big Bowl, a stir-fry bar, with a largish group of developers and users of both FreeBSD and OpenBSD. The discussions were interesting and varied, and the food was excellent. Benedict had dinner with JT and some other folks from iXsystems.</li>
<li>Friday night the hacker lounge was so large we took over a bigger room (it had better WiFi too).</li>
<li>Saturday featured more great talks. The talk I was most interested in was from Eric McCorkle, who did the EFI version of my GELIBoot work. I had reviewed some of the work, but it was interesting to hear the story of how it happened, and to see the parallels with my own story.</li>
<li>My favourite speaker was Paul Vixie, who gave a very interesting talk about the gets() function in libc. gets() was declared unsafe before the FreeBSD project even started. The original import of the CSRG code into FreeBSD includes the compile time, and run-time warnings against using gets(). OpenBSD removed gets() in version 5.6, in 2014. Following Pauls presentation, various patches were raised, to either cause use of gets() to crash the program, or to remove gets() entirely, causing such programs to fail to link.</li>
<li>The last talk before the closing was Benedicts <a href="https://people.freebsd.org/%7Ebcr/talks/vBSDcon2017_Ansible.pdf" rel="nofollow">BSD Systems Management with Ansible</a>.</li>
<li>Shortly after, Allan won a MacBook Pro by correctly guessing the number of components in a jar that was standing next to the registration desk (Benedict was way off, but had a good laugh about the unlikely future Apple user).</li>
<li>Saturday night ended with the Conference Social, and excellent dinner with more great conversations</li>
<li>On Sunday morning, a number of us went to the Smithsonian Air and Space Museum site near the airport, and saw a Concorde, an SR-71, and the space shuttle Discovery, among many other exhibits.</li>
<li>Check out the <a href="https://t.co/KRmSNzUSus" rel="nofollow">full photo album by JT</a>, our producer.</li>
<li>Thanks to all the sponsors for vBSDcon and all the organizers from Verisign, who made it such a great event.
***</li>
</ul>

<h3><a href="https://www.sigsegv.be//blog/freebsd/FreeBSD-EN-17.08.pf" rel="nofollow">The story behind FreeBSD-EN-17.08.pf</a></h3>

<ul>
<li>After our previous deep dive on a bug in episode 209, Kristof Provost, the maintainer of pf on FreeBSD (he is going to hate me for saying that) has written the story behind a recent ERRATA notice for FreeBSD</li>
</ul>

<blockquote>
<p>First things first, so I have to point out that I think Allan misremembered things. The heroic debugging story is PR 219251, which I&#39;ll try to write about later. <br>
FreeBSD-EN-17:08.pf is an issue that affected some FreeBSD 11.x systems, where FreeBSD would panic at startup. There were no reports for CURRENT.<br>
There&#39;s very little to go on here, but we do know the cause of the panic (&quot;integer divide fault&quot;), and that the current process was &quot;pf purge&quot;. The pf purge thread is part of the pf housekeeping infrastructure. It&#39;s a housekeeping kernel thread which cleans up things like old states and expired fragments.<br>
The lack of mention of pf functions in the backtrace is a hint unto itself. It suggests that the error is probably directly in pf_purge_thread(). It might also be in one of the static functions it calls, because compilers often just inline those so they don&#39;t generate stack frames. <br>
Remember that the problem is an &quot;integer divide fault&quot;. How can integer divisions be a problem? Well, you can try to divide by zero. The most obvious suspect for this is this code:<br>
  idx = pf_purge_expired_states(idx, pf_hashmask / (V_pf_default_rule.timeout[PFTM_INTERVAL] * 10));<br>
However, this variable is both correctly initialised (in pfattach_vnet()) and can only be modified through the DIOCSETTIMEOUT ioctl() call and that one checks for zero. <br>
At that point I had no idea how this could happen, but because the problem did not affect CURRENT I looked at the commit history and found this commit from Luiz Otavio O Souza:<br>
  Do not run the pf purge thread while the VNET variables are not initialized, this can cause a divide by zero (if the VNET initialization takes to long to complete).<br>
  Obtained from:  pfSense<br>
  Sponsored by:   Rubicon Communications, LLC (Netgate)<br>
That sounds very familiar, and indeed, applying the patch fixed the problem. Luiz explained it well: it&#39;s possible to use V_pf_default_rule.timeout before it&#39;s initialised, which caused this panic. <br>
To me, this reaffirms the importance of writing good commit messages: because Luiz mentioned both the pf purge thread and the division by zero I was easily able to find the relevant commit. If I hadn&#39;t found it this fix would have taken a lot longer. </p>
</blockquote>

<ul>
<li>Next week well look at the more interesting story I was interested in, which I managed to nag Kristof into writing
***</li>
</ul>

<h3><a href="http://dtrace.org/blogs/bmc/2017/09/04/the-sudden-death-and-eternal-life-of-solaris/" rel="nofollow">The sudden death and eternal life of Solaris</a></h3>

<ul>
<li>A blog post from Bryan Cantrill about the death of Solaris</li>
</ul>

<blockquote>
<p>As had been rumored for a while, Oracle effectively killed Solaris. When I first saw this, I had assumed that this was merely a deep cut, but in talking to Solaris engineers still at Oracle, it is clearly much more than that. It is a cut so deep as to be fatal: the core Solaris engineering organization lost on the order of 90% of its people, including essentially all management.<br>
Of note, among the engineers I have spoken with, I heard two things repeatedly: this is the end and (from those who managed to survive Friday) I wish I had been laid off. Gone is any of the optimism (however tepid) that I have heard over the years  and embarrassed apologies for Oracles behavior have been replaced with dismay about the clumsiness, ineptitude and callousness with which this final cut was handled. In particular, that employees who had given their careers to the company were told of their termination via a pre-recorded call  robo-RIFd in the words of one employee  is both despicable and cowardly. To their credit, the engineers affected saw themselves as Sun to the end: they stayed to solve hard, interesting problems and out of allegiance to one another  not out of any loyalty to the broader Oracle. Oracle didnt deserve them and now it doesnt have them  they have been liberated, if in a depraved act of corporate violence.<br>
Assuming that this is indeed the end of Solaris (and it certainly looks that way), it offers a time for reflection. Certainly, the demise of Solaris is at one level not surprising, but on the other hand, its very suddenness highlights the degree to which proprietary software can suffer by the vicissitudes of corporate capriciousness. Vulnerable to executive whims, shareholder demands, and a fickle public, organizations can simply change direction by fiat. And because  in the words of the late, great Roger Faulkner  it is easier to destroy than to create, these changes in direction can have lasting effect when they mean stopping (or even suspending!) work on a project. Indeed, any engineer in any domain with sufficient longevity will have one (or many!) stories of exciting projects being cancelled by foolhardy and myopic management. For software, though, these cancellations can be particularly gutting because (in the proprietary world, anyway) so many of the details of software are carefully hidden from the users of the product  and much of the innovation of a cancelled software project will likely die with the project, living only in the oral tradition of the engineers who knew it. Worse, in the long run  to paraphrase Keynes  proprietary software projects are all dead. However ubiquitous at their height, this lonely fate awaits all proprietary software. <br>
There is, of course, another way  and befitting its idiosyncratic life and death, Solaris shows us this path too: software can be open source. In stark contrast to proprietary software, open source does not  cannot, even  die. Yes, it can be disused or rusty or fusty, but as long as anyone is interested in it at all, it lives and breathes. Even should the interest wane to nothing, open source software survives still: its life as machine may be suspended, but it becomes as literature, waiting to be discovered by a future generation. That is, while proprietary software can die in an instant, open source software perpetually endures by its nature  and thrives by the strength of its communities. Just as the existence of proprietary software can be surprisingly brittle, open source communities can be crazily robust: they can survive neglect, derision, dissent  even sabotage.<br>
In this regard, I speak from experience: from when Solaris was open sourced in 2005, the OpenSolaris community survived all of these things. By the time Oracle bought Sun five years later in 2010, the community had decided that it needed true independence  illumos was born. And, it turns out, illumos was born at exactly the right moment: shortly after illumos was announced, Oracle  in what remains to me a singularly loathsome and cowardly act  silently re-proprietarized Solaris on August 13, 2010. We in illumos were indisputably on our own, and while many outsiders gave us no chance of survival, we ourselves had reason for confidence: after all, open source communities are robust because they are often united not only by circumstance, but by values, and in our case, we as a community never lost our belief in ZFS, Zones, DTrace and myriad other technologies like MDB, FMA and Crossbow.<br>
Indeed, since 2010, illumos has thrived; illumos is not only the repository of record for technologies that have become cross-platform like OpenZFS, but we have also advanced our core technologies considerably, while still maintaining highest standards of quality. Learning some of the mistakes of OpenSolaris, we have a model that allows for downstream innovation, experimentation and differentiation. For example, Joyents SmartOS has always been focused on our need for a cloud hypervisor (causing us to develop big features like hardware virtualization and Linux binary compatibility), and it is now at the heart of a massive buildout for Samsung (who acquired Joyent a little over a year ago). For us at Joyent, the Solaris/illumos/SmartOS saga has been formative in that we have seen both the ill effects of proprietary software and the amazing resilience of open source software  and it very much informed our decision to open source our entire stack in 2014.<br>
Judging merely by its tombstone, the life of Solaris can be viewed as tragic: born out of wedlock between Sun and AT&amp;T and dying at the hands of a remorseless corporate sociopath a quarter century later. And even that may be overstating its longevity: Solaris may not have been truly born until it was made open source, and  certainly to me, anyway  it died the moment it was again made proprietary. But in that shorter life, Solaris achieved the singular: immortality for its revolutionary technologies. So while we can mourn the loss of the proprietary embodiment of Solaris (and we can certainly lament the coarse way in which its technologists were treated!), we can rejoice in the eternal life of its technologies  in illumos and beyond!</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2017/09/01/thinkpad_x1c" rel="nofollow">OpenBSD on the Lenovo Thinkpad X1 Carbon (5th Gen)</a></h3>

<ul>
<li>Joshua Stein writes about his experiences running OpenBSD on the 5th generation Lenovo Thinkpad X1 Carbon:</li>
</ul>

<blockquote>
<p>ThinkPads have sort of a cult following among OpenBSD developers and users because the hardware is basic and well supported, and the keyboards are great to type on. While no stranger to ThinkPads myself, most of my OpenBSD laptops in recent years have been from various vendors with brand new hardware components that OpenBSD does not yet support. As satisfying as it is to write new kernel drivers or extend existing ones to make that hardware work, it usually leaves me with a laptop that doesn&#39;t work very well for a period of months.<br>
After exhausting efforts trying to debug the I2C touchpad interrupts on the Huawei MateBook X (and other 100-Series Intel chipset laptops), I decided to take a break and use something with better OpenBSD support out of the box: the fifth generation Lenovo ThinkPad X1 Carbon.</p>
</blockquote>

<ul>
<li>Hardware</li>
</ul>

<blockquote>
<p>Like most ThinkPads, the X1 Carbon is available in a myriad of different internal configurations. I went with the non-vPro Core i7-7500U (it was the same price as the Core i5 that I normally opt for), 16Gb of RAM, a 256Gb NVMe SSD, and a WQHD display.<br>
This generation of X1 Carbon finally brings a thinner screen bezel, allowing the entire footprint of the laptop to be smaller which is welcome on something with a 14&quot; screen. The X1 now measures 12.7&quot; wide, 8.5&quot; deep, and 0.6&quot; thick, and weighs just 2.6 pounds. While not available at initial launch, Lenovo is now offering a WQHD IPS screen option giving a resolution of 2560x1440. Perhaps more importantly, this display also has much better brightness than the FHD version, something ThinkPads have always struggled with.<br>
On the left side of the laptop are two USB-C ports, a USB-A port, a full-size HDMI port, and a port for the ethernet dongle which, despite some reviews stating otherwise, is not included with the laptop. On the right side is another USB-A port and a headphone jack, along with a fan exhaust grille. On the back is a tray for the micro-SIM card for the optional WWAN device, which also covers the Realtek microSD card reader. The tray requires a paperclip to eject which makes it inconvenient to remove, so I think this microSD card slot is designed to house a card semi-permanently as a backup disk or something.<br>
On the bottom are the two speakers towards the front and an exhaust grille near the center. The four rubber feet are rather plastic feeling, which allows the laptop to slide around on a desk a bit too much for my liking. I wish they were a bit softer to be stickier.<br>
Charging can be done via either of the two USB-C ports on the left, though I wish more vendors would do as Google did on the Chromebook Pixel and provide a port on both sides. This makes it much more convenient to charge when not at one&#39;s desk, rather than having to route a cable around to one specific side. The X1 Carbon includes a 65W USB-C PD with a fixed USB-C cable and removable country-specific power cable, which is not very convenient due to its large footprint. I am using an Apple 61W USB-C charger and an Anker cable which charge the X1 fine (unlike HP laptops which only work with HP USB-C chargers).<br>
Wireless connectivity is provided by a removable Intel 8265 802.11a/b/g/n/ac WiFi and Bluetooth 4.1 card. An Intel I219-V chip provides ethernet connectivity and requires an external dongle for the physical cable connection.<br>
The screen hinge is rather tight, making it difficult to open with one hand. The tradeoff is that the screen does not wobble in the least bit when typing.<br>
The fan is silent at idle, and there is no coil whine even under heavy load. During a make -j4 build, the fan noise is reasonable and medium-pitched, rather than a high-pitched whine like on some laptops. The palm rest and keyboard area remain cool during high CPU utilization.<br>
The full-sized keyboard is backlit and offers two levels of adjustment. The keys have a soft surface and a somewhat clicky feel, providing very quiet typing except for certain keys like Enter, Backspace, and Escape. The keyboard has a reported key travel of 1.5mm and there are dedicated Page Up and Page Down keys above the Left and Right arrow keys. Dedicated Home, End, Insert, and Delete keys are along the top row. The Fn key is placed to the left of Control, which some people hate (although Lenovo does provide a BIOS option to swap it), but it&#39;s in the same position on Apple keyboards so I&#39;m used to it. However, since there are dedicated Page Up, Page Down, Home, and End keys, I don&#39;t really have a use for the Fn key anyway.</p>
</blockquote>

<ul>
<li>Firmware</li>
</ul>

<blockquote>
<p>The X1 Carbon has a very detailed BIOS/firmware menu which can be entered with the F1 key at boot. F12 can be used to temporarily select a different boot device.<br>
A neat feature of the Lenovo BIOS is that it supports showing a custom boot logo instead of the big red Lenovo logo. From Windows, download the latest BIOS Update Utility for the X1 Carbon (my model was 20HR). Run it and it&#39;ll extract everything to C:\drivers\flash(some random string). Drop a logo.gif file in that directory and run winuptp.exe. If a logo file is present, it&#39;ll ask whether to use it and then write the new BIOS to its staging area, then reboot to actually flash it.</p>

<ul>
<li>OpenBSD support</li>
</ul>

<p>Secure Boot has to be disabled in the BIOS menu, and the &quot;CSM Support&quot; option must be enabled, even when &quot;UEFI/Legacy Boot&quot; is left on &quot;UEFI Only&quot;. Otherwise the screen will just go black after the OpenBSD kernel loads into memory.</p>
</blockquote>

<ul>
<li>Based on this component list, it seems like everything but the fingerprint sensor works fine on OpenBSD.
***</li>
</ul>

<h3><a href="https://www.linuxsecrets.com/en/entry/51-freebsd/2017/09/04/2942-configure-5-freebsd-x-environments" rel="nofollow">Configuring 5 different desktop environments on FreeBSD</a></h3>

<ul>
<li>This fairly quick tutorial over at LinuxSecrets.com is a great start if you are new to FreeBSD, especially if you are coming from Linux and miss your favourite desktop environment</li>
<li>It just goes to show how easy it is to build the desktop you want on modern FreeBSD</li>
<li>The tutorial covers: GNOME, KDE, Xfce, Mate, and Cinnamon</li>
<li>The instructions for each boil down to some variation of:</li>
<li>Install the desktop environment and a login manager if it is not included:
&gt; sudo pkg install gnome3</li>
<li>Enable the login manager, and usually dbus and hald:
&gt; sudo sysrc dbus_enable=&quot;YES&quot; hald_enable=&quot;YES&quot; gdm_enable=&quot;YES&quot; gnome_enable=&quot;YES&quot;?</li>
<li>If using a generic login manager, add the DE startup command to your .xinitrc:
&gt; echo &quot;exec cinnamon&quot; &gt; ~/.xinitrc </li>
<li>And that is about it. </li>
<li>The tutorial goes into more detail on other configuration you can do to get your desktop just the way you like it.</li>
<li>To install Lumina:
&gt; sudo pkg install lumina pcbsd-utils-qt5</li>
<li>This will install Lumina and the pcbsd utilities package which includes pcdm, the login manager. In the near future we hear the login manager and some of the other utilities will be split into separate packages, making it easier to use them on vanilla FreeBSD.
&gt; sudo sysrc pcdm_enable=YES dbus_enable=&quot;YES&quot; hald_enable=&quot;YES&quot; </li>
<li>Reboot, and you should be greeted with the graphical login screen
***</li>
</ul>

<h3><a href="https://lwn.net/Articles/732201/" rel="nofollow">A return-oriented programming defense from OpenBSD</a></h3>

<ul>
<li>We talked a bit about RETGUARD last week, presenting Theos email announcing the new feature</li>
<li>Linux Weekly News has a nice breakdown on just how it works</li>
</ul>

<blockquote>
<p>Stack-smashing attacks have a long history; they featured, for example, as a core part of the Morris worm back in 1988. Restrictions on executing code on the stack have, to a great extent, put an end to such simple attacks, but that does not mean that stack-smashing attacks are no longer a threat. Return-oriented programming (ROP) has become a common technique for compromising systems via a stack-smashing vulnerability. There are various schemes out there for defeating ROP attacks, but a mechanism called &quot;RETGUARD&quot; that is being implemented in OpenBSD is notable for its relative simplicity.<br>
In a classic stack-smashing attack, the attack code would be written directly to the stack and executed there. Most modern systems do not allow execution of on-stack code, though, so this kind of attack will be ineffective. The stack does affect code execution, though, in that the call chain is stored there; when a function executes a &quot;return&quot; instruction, the address to return to is taken from the stack. An attacker who can overwrite the stack can, thus, force a function to &quot;return&quot; to an arbitrary location.<br>
That alone can be enough to carry out some types of attacks, but ROP adds another level of sophistication. A search through a body of binary code will turn up a great many short sequences of instructions ending in a return instruction. These sequences are termed &quot;gadgets&quot;; a large program contains enough gadgets to carry out almost any desired task  if they can be strung together into a chain. ROP works by locating these gadgets, then building a series of stack frames so that each gadget &quot;returns&quot; to the next.<br>
There is, of course, a significant limitation here: a ROP chain made up of exclusively polymorphic gadgets will still work, since those gadgets were not (intentionally) created by the compiler and do not contain the return-address-mangling code. De Raadt acknowledged this limitation, but said: &quot;we believe once standard-RET is solved those concerns become easier to address separately in the future. In any case a substantial reduction of gadgets is powerful&quot;.<br>
Using the compiler to insert the hardening code greatly eases the task of applying RETGUARD to both the OpenBSD kernel and its user-space code. At least, that is true for code written in a high-level language. Any code written in assembly must be changed by hand, though, which is a fair amount of work. De Raadt and company have done that work; he reports that: &quot;We are at the point where userland and base are fully working without regressions, and the remaining impacts are in a few larger ports which directly access the return address (for a variety of reasons)&quot;. It can be expected that, once these final issues are dealt with, OpenBSD will ship with this hardening enabled.</p>
</blockquote>

<ul>
<li>The article wonders about applying the same to Linux, but notes it would be difficult because the Linux kernel cannot currently be compiled using LLVM</li>
</ul>

<blockquote>
<p>If any benchmarks have been run to determine the cost of using RETGUARD, they have not been publicly posted. The extra code will make the kernel a little bigger, and the extra overhead on every function is likely to add up in the end. But if this technique can make the kernel that much harder to exploit, it may well justify the extra execution overhead that it brings with it. All that&#39;s needed is somebody to actually do the work and try it out.</p>

<hr>
</blockquote>

<h3><a href="https://www.youtube.com/playlist?list=PLeF8ZihVdpFfVEsCxNWGDmcATJfRZacHv" rel="nofollow">Videos from BSDCan have started to appear!</a></h3>

<ul>
<li><a href="https://www.youtube.com/watch?v=KuHepyI0_KY" rel="nofollow">Henning Brauer: tcp synfloods - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=1DM5SwoXWSU" rel="nofollow">Benno Rice: The Trouble with FreeBSD - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=SCLfKWaUGa8" rel="nofollow">Li-Wen Hsu: Continuous Integration of The FreeBSD Project - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=gkYjvrFvPJ0" rel="nofollow">Andrew Turner: GENERIC ARM - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=sYmW_H6FrWo" rel="nofollow">Bjoern A. Zeeb: From the outside - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=Zf9tDJhoVbA" rel="nofollow">Rodney W. Grimes: FreeBSD as a Service - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=Os9L_sOiTH0" rel="nofollow">Reyk Floeter: The OpenBSD virtual machine daemon - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=NMUf6VGK2fI" rel="nofollow">Brian Kidney: The Realities of DTrace on FreeBSD - BSDCan 2017</a></li>
<li>The rest will continue to trickle out, likely not until after EuroBSDCon
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://meshedinsights.com/2017/09/03/oracle-finally-killed-sun/" rel="nofollow">Oracle has killed sun</a></li>
<li><a href="http://nanxiao.me/en/configure-thunderbird-to-send-patch-friendly/" rel="nofollow">Configure Thunderbird to send patch friendly</a></li>
<li><a href="https://www.freebsd.org/news/newsflash.html#event20170909:01" rel="nofollow">FreeBSD 10.4-BETA4 Available</a></li>
<li><a href="https://www.facebook.com/ixsystems/posts/10155403417921508" rel="nofollow">iXsystems looking to hire kernel and zfs developers (especially Sun/Oracle Refugees)</a></li>
<li><a href="https://unitedbsd.com/" rel="nofollow">Speaking of job postings, UnitedBSD.com has few job postings related to BSD</a></li>
</ul>

<h2>Call for papers</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/usenix-fast-18-call-for-papers/" rel="nofollow">USENIX FAST 18 - February 12-15, 2018, Due: September 28 2017</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/scale-16x-call-for-participation/" rel="nofollow">Scale 16x - March 8-11, 2018, Due: October 31, 2017 </a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/fosdem-18-call-for-participation/" rel="nofollow">FOSDEM 18 - February 3-4, 2018, Due: November 3 2017 </a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/340KRHG" rel="nofollow">Jason asks about cheap router hardware</a></li>
<li><a href="http://dpaste.com/2J7DQQ6" rel="nofollow">Prashant asks about latest kernels with freebsd-update</a></li>
<li><a href="http://dpaste.com/1H5SZ81" rel="nofollow">Matt wants know about VM Performance &amp; CPU Steal Time</a></li>
<li><a href="http://dpaste.com/0X770SY" rel="nofollow">John has config questions regarding Dell precision 7720, FreeBSD, NVME, and ZFS</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We recap vBSDcon, give you the story behind a PF EN, reminisce in Solaris memories, and show you how to configure different DEs on FreeBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>[vBSDCon]</h3>

<ul>
<li>vBSDCon was held September 7 - 9th. We recorded this only a few days after getting home from this great event.</li>
<li>Things started on Wednesday night, as attendees of the thursday developer summit arrived and broke into smallish groups for disorganized dinner and drinks.</li>
<li>We then held an unofficial hacker lounge in a medium sized seating area, working and talking until we all decided that the developer summit started awfully early tomorrow.</li>
<li>The developer summit started with a light breakfast and then then we dove right in</li>
<li>Ed Maste started us off, and then Glen Barber gave a presentation about lessons learned from the 11.1-RELEASE cycle, and comparing it to previous releases. 11.1 was released on time, and was one of the best releases so far. The slides are linked on the <a href="https://wiki.freebsd.org/DevSummit/20170907" rel="nofollow">DevSummit wiki page</a>.</li>
<li>The group then jumped into hackmd.io a collaborative note taking application, and listed of various works in progress and upstreaming efforts. Then we listed wants and needs for the 12.0 release.</li>
<li>After lunch we broke into pairs of working groups, with additional space for smaller meetings. The first pair were, ZFS and Toolchain, followed by a break and then a discussion of IFLIB and network drivers in general. After another break, the last groups of the day met, pkgbase and secure boot.</li>
<li>Then it was time for the vBSDCon reception dinner. This standing dinner was a great way to meet new people, and for attendees to mingle and socialize.</li>
<li>The official hacking lounge Thursday night was busy, and included some great storytelling, along with a bunch of work getting done.</li>
<li>It was very encouraging to watch a struggling new developer getting help from a seasoned veteran. Watching the new developers eyes light up as the new information filled in gaps and they now understood so much more than just a few minutes before, and they raced off to continue working, was inspirational, and reminded me why these conferences are so important.</li>
<li>The hacker lounge shut down relatively early by BSD conference standards, but, the conference proper started at 8:45 sharp the next morning, so it made sense.</li>
<li>Friday saw a string of good presentations, I think my favourite was Jonathan Andersons talk on Oblivious sandboxing. Jonathan is a very energetic speaker, and was able to keep everyone focused even during relatively complicated explanations.</li>
<li>Friday night I went for dinner at Big Bowl, a stir-fry bar, with a largish group of developers and users of both FreeBSD and OpenBSD. The discussions were interesting and varied, and the food was excellent. Benedict had dinner with JT and some other folks from iXsystems.</li>
<li>Friday night the hacker lounge was so large we took over a bigger room (it had better WiFi too).</li>
<li>Saturday featured more great talks. The talk I was most interested in was from Eric McCorkle, who did the EFI version of my GELIBoot work. I had reviewed some of the work, but it was interesting to hear the story of how it happened, and to see the parallels with my own story.</li>
<li>My favourite speaker was Paul Vixie, who gave a very interesting talk about the gets() function in libc. gets() was declared unsafe before the FreeBSD project even started. The original import of the CSRG code into FreeBSD includes the compile time, and run-time warnings against using gets(). OpenBSD removed gets() in version 5.6, in 2014. Following Pauls presentation, various patches were raised, to either cause use of gets() to crash the program, or to remove gets() entirely, causing such programs to fail to link.</li>
<li>The last talk before the closing was Benedicts <a href="https://people.freebsd.org/%7Ebcr/talks/vBSDcon2017_Ansible.pdf" rel="nofollow">BSD Systems Management with Ansible</a>.</li>
<li>Shortly after, Allan won a MacBook Pro by correctly guessing the number of components in a jar that was standing next to the registration desk (Benedict was way off, but had a good laugh about the unlikely future Apple user).</li>
<li>Saturday night ended with the Conference Social, and excellent dinner with more great conversations</li>
<li>On Sunday morning, a number of us went to the Smithsonian Air and Space Museum site near the airport, and saw a Concorde, an SR-71, and the space shuttle Discovery, among many other exhibits.</li>
<li>Check out the <a href="https://t.co/KRmSNzUSus" rel="nofollow">full photo album by JT</a>, our producer.</li>
<li>Thanks to all the sponsors for vBSDcon and all the organizers from Verisign, who made it such a great event.
***</li>
</ul>

<h3><a href="https://www.sigsegv.be//blog/freebsd/FreeBSD-EN-17.08.pf" rel="nofollow">The story behind FreeBSD-EN-17.08.pf</a></h3>

<ul>
<li>After our previous deep dive on a bug in episode 209, Kristof Provost, the maintainer of pf on FreeBSD (he is going to hate me for saying that) has written the story behind a recent ERRATA notice for FreeBSD</li>
</ul>

<blockquote>
<p>First things first, so I have to point out that I think Allan misremembered things. The heroic debugging story is PR 219251, which I&#39;ll try to write about later. <br>
FreeBSD-EN-17:08.pf is an issue that affected some FreeBSD 11.x systems, where FreeBSD would panic at startup. There were no reports for CURRENT.<br>
There&#39;s very little to go on here, but we do know the cause of the panic (&quot;integer divide fault&quot;), and that the current process was &quot;pf purge&quot;. The pf purge thread is part of the pf housekeeping infrastructure. It&#39;s a housekeeping kernel thread which cleans up things like old states and expired fragments.<br>
The lack of mention of pf functions in the backtrace is a hint unto itself. It suggests that the error is probably directly in pf_purge_thread(). It might also be in one of the static functions it calls, because compilers often just inline those so they don&#39;t generate stack frames. <br>
Remember that the problem is an &quot;integer divide fault&quot;. How can integer divisions be a problem? Well, you can try to divide by zero. The most obvious suspect for this is this code:<br>
  idx = pf_purge_expired_states(idx, pf_hashmask / (V_pf_default_rule.timeout[PFTM_INTERVAL] * 10));<br>
However, this variable is both correctly initialised (in pfattach_vnet()) and can only be modified through the DIOCSETTIMEOUT ioctl() call and that one checks for zero. <br>
At that point I had no idea how this could happen, but because the problem did not affect CURRENT I looked at the commit history and found this commit from Luiz Otavio O Souza:<br>
  Do not run the pf purge thread while the VNET variables are not initialized, this can cause a divide by zero (if the VNET initialization takes to long to complete).<br>
  Obtained from:  pfSense<br>
  Sponsored by:   Rubicon Communications, LLC (Netgate)<br>
That sounds very familiar, and indeed, applying the patch fixed the problem. Luiz explained it well: it&#39;s possible to use V_pf_default_rule.timeout before it&#39;s initialised, which caused this panic. <br>
To me, this reaffirms the importance of writing good commit messages: because Luiz mentioned both the pf purge thread and the division by zero I was easily able to find the relevant commit. If I hadn&#39;t found it this fix would have taken a lot longer. </p>
</blockquote>

<ul>
<li>Next week well look at the more interesting story I was interested in, which I managed to nag Kristof into writing
***</li>
</ul>

<h3><a href="http://dtrace.org/blogs/bmc/2017/09/04/the-sudden-death-and-eternal-life-of-solaris/" rel="nofollow">The sudden death and eternal life of Solaris</a></h3>

<ul>
<li>A blog post from Bryan Cantrill about the death of Solaris</li>
</ul>

<blockquote>
<p>As had been rumored for a while, Oracle effectively killed Solaris. When I first saw this, I had assumed that this was merely a deep cut, but in talking to Solaris engineers still at Oracle, it is clearly much more than that. It is a cut so deep as to be fatal: the core Solaris engineering organization lost on the order of 90% of its people, including essentially all management.<br>
Of note, among the engineers I have spoken with, I heard two things repeatedly: this is the end and (from those who managed to survive Friday) I wish I had been laid off. Gone is any of the optimism (however tepid) that I have heard over the years  and embarrassed apologies for Oracles behavior have been replaced with dismay about the clumsiness, ineptitude and callousness with which this final cut was handled. In particular, that employees who had given their careers to the company were told of their termination via a pre-recorded call  robo-RIFd in the words of one employee  is both despicable and cowardly. To their credit, the engineers affected saw themselves as Sun to the end: they stayed to solve hard, interesting problems and out of allegiance to one another  not out of any loyalty to the broader Oracle. Oracle didnt deserve them and now it doesnt have them  they have been liberated, if in a depraved act of corporate violence.<br>
Assuming that this is indeed the end of Solaris (and it certainly looks that way), it offers a time for reflection. Certainly, the demise of Solaris is at one level not surprising, but on the other hand, its very suddenness highlights the degree to which proprietary software can suffer by the vicissitudes of corporate capriciousness. Vulnerable to executive whims, shareholder demands, and a fickle public, organizations can simply change direction by fiat. And because  in the words of the late, great Roger Faulkner  it is easier to destroy than to create, these changes in direction can have lasting effect when they mean stopping (or even suspending!) work on a project. Indeed, any engineer in any domain with sufficient longevity will have one (or many!) stories of exciting projects being cancelled by foolhardy and myopic management. For software, though, these cancellations can be particularly gutting because (in the proprietary world, anyway) so many of the details of software are carefully hidden from the users of the product  and much of the innovation of a cancelled software project will likely die with the project, living only in the oral tradition of the engineers who knew it. Worse, in the long run  to paraphrase Keynes  proprietary software projects are all dead. However ubiquitous at their height, this lonely fate awaits all proprietary software. <br>
There is, of course, another way  and befitting its idiosyncratic life and death, Solaris shows us this path too: software can be open source. In stark contrast to proprietary software, open source does not  cannot, even  die. Yes, it can be disused or rusty or fusty, but as long as anyone is interested in it at all, it lives and breathes. Even should the interest wane to nothing, open source software survives still: its life as machine may be suspended, but it becomes as literature, waiting to be discovered by a future generation. That is, while proprietary software can die in an instant, open source software perpetually endures by its nature  and thrives by the strength of its communities. Just as the existence of proprietary software can be surprisingly brittle, open source communities can be crazily robust: they can survive neglect, derision, dissent  even sabotage.<br>
In this regard, I speak from experience: from when Solaris was open sourced in 2005, the OpenSolaris community survived all of these things. By the time Oracle bought Sun five years later in 2010, the community had decided that it needed true independence  illumos was born. And, it turns out, illumos was born at exactly the right moment: shortly after illumos was announced, Oracle  in what remains to me a singularly loathsome and cowardly act  silently re-proprietarized Solaris on August 13, 2010. We in illumos were indisputably on our own, and while many outsiders gave us no chance of survival, we ourselves had reason for confidence: after all, open source communities are robust because they are often united not only by circumstance, but by values, and in our case, we as a community never lost our belief in ZFS, Zones, DTrace and myriad other technologies like MDB, FMA and Crossbow.<br>
Indeed, since 2010, illumos has thrived; illumos is not only the repository of record for technologies that have become cross-platform like OpenZFS, but we have also advanced our core technologies considerably, while still maintaining highest standards of quality. Learning some of the mistakes of OpenSolaris, we have a model that allows for downstream innovation, experimentation and differentiation. For example, Joyents SmartOS has always been focused on our need for a cloud hypervisor (causing us to develop big features like hardware virtualization and Linux binary compatibility), and it is now at the heart of a massive buildout for Samsung (who acquired Joyent a little over a year ago). For us at Joyent, the Solaris/illumos/SmartOS saga has been formative in that we have seen both the ill effects of proprietary software and the amazing resilience of open source software  and it very much informed our decision to open source our entire stack in 2014.<br>
Judging merely by its tombstone, the life of Solaris can be viewed as tragic: born out of wedlock between Sun and AT&amp;T and dying at the hands of a remorseless corporate sociopath a quarter century later. And even that may be overstating its longevity: Solaris may not have been truly born until it was made open source, and  certainly to me, anyway  it died the moment it was again made proprietary. But in that shorter life, Solaris achieved the singular: immortality for its revolutionary technologies. So while we can mourn the loss of the proprietary embodiment of Solaris (and we can certainly lament the coarse way in which its technologists were treated!), we can rejoice in the eternal life of its technologies  in illumos and beyond!</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/2017/09/01/thinkpad_x1c" rel="nofollow">OpenBSD on the Lenovo Thinkpad X1 Carbon (5th Gen)</a></h3>

<ul>
<li>Joshua Stein writes about his experiences running OpenBSD on the 5th generation Lenovo Thinkpad X1 Carbon:</li>
</ul>

<blockquote>
<p>ThinkPads have sort of a cult following among OpenBSD developers and users because the hardware is basic and well supported, and the keyboards are great to type on. While no stranger to ThinkPads myself, most of my OpenBSD laptops in recent years have been from various vendors with brand new hardware components that OpenBSD does not yet support. As satisfying as it is to write new kernel drivers or extend existing ones to make that hardware work, it usually leaves me with a laptop that doesn&#39;t work very well for a period of months.<br>
After exhausting efforts trying to debug the I2C touchpad interrupts on the Huawei MateBook X (and other 100-Series Intel chipset laptops), I decided to take a break and use something with better OpenBSD support out of the box: the fifth generation Lenovo ThinkPad X1 Carbon.</p>
</blockquote>

<ul>
<li>Hardware</li>
</ul>

<blockquote>
<p>Like most ThinkPads, the X1 Carbon is available in a myriad of different internal configurations. I went with the non-vPro Core i7-7500U (it was the same price as the Core i5 that I normally opt for), 16Gb of RAM, a 256Gb NVMe SSD, and a WQHD display.<br>
This generation of X1 Carbon finally brings a thinner screen bezel, allowing the entire footprint of the laptop to be smaller which is welcome on something with a 14&quot; screen. The X1 now measures 12.7&quot; wide, 8.5&quot; deep, and 0.6&quot; thick, and weighs just 2.6 pounds. While not available at initial launch, Lenovo is now offering a WQHD IPS screen option giving a resolution of 2560x1440. Perhaps more importantly, this display also has much better brightness than the FHD version, something ThinkPads have always struggled with.<br>
On the left side of the laptop are two USB-C ports, a USB-A port, a full-size HDMI port, and a port for the ethernet dongle which, despite some reviews stating otherwise, is not included with the laptop. On the right side is another USB-A port and a headphone jack, along with a fan exhaust grille. On the back is a tray for the micro-SIM card for the optional WWAN device, which also covers the Realtek microSD card reader. The tray requires a paperclip to eject which makes it inconvenient to remove, so I think this microSD card slot is designed to house a card semi-permanently as a backup disk or something.<br>
On the bottom are the two speakers towards the front and an exhaust grille near the center. The four rubber feet are rather plastic feeling, which allows the laptop to slide around on a desk a bit too much for my liking. I wish they were a bit softer to be stickier.<br>
Charging can be done via either of the two USB-C ports on the left, though I wish more vendors would do as Google did on the Chromebook Pixel and provide a port on both sides. This makes it much more convenient to charge when not at one&#39;s desk, rather than having to route a cable around to one specific side. The X1 Carbon includes a 65W USB-C PD with a fixed USB-C cable and removable country-specific power cable, which is not very convenient due to its large footprint. I am using an Apple 61W USB-C charger and an Anker cable which charge the X1 fine (unlike HP laptops which only work with HP USB-C chargers).<br>
Wireless connectivity is provided by a removable Intel 8265 802.11a/b/g/n/ac WiFi and Bluetooth 4.1 card. An Intel I219-V chip provides ethernet connectivity and requires an external dongle for the physical cable connection.<br>
The screen hinge is rather tight, making it difficult to open with one hand. The tradeoff is that the screen does not wobble in the least bit when typing.<br>
The fan is silent at idle, and there is no coil whine even under heavy load. During a make -j4 build, the fan noise is reasonable and medium-pitched, rather than a high-pitched whine like on some laptops. The palm rest and keyboard area remain cool during high CPU utilization.<br>
The full-sized keyboard is backlit and offers two levels of adjustment. The keys have a soft surface and a somewhat clicky feel, providing very quiet typing except for certain keys like Enter, Backspace, and Escape. The keyboard has a reported key travel of 1.5mm and there are dedicated Page Up and Page Down keys above the Left and Right arrow keys. Dedicated Home, End, Insert, and Delete keys are along the top row. The Fn key is placed to the left of Control, which some people hate (although Lenovo does provide a BIOS option to swap it), but it&#39;s in the same position on Apple keyboards so I&#39;m used to it. However, since there are dedicated Page Up, Page Down, Home, and End keys, I don&#39;t really have a use for the Fn key anyway.</p>
</blockquote>

<ul>
<li>Firmware</li>
</ul>

<blockquote>
<p>The X1 Carbon has a very detailed BIOS/firmware menu which can be entered with the F1 key at boot. F12 can be used to temporarily select a different boot device.<br>
A neat feature of the Lenovo BIOS is that it supports showing a custom boot logo instead of the big red Lenovo logo. From Windows, download the latest BIOS Update Utility for the X1 Carbon (my model was 20HR). Run it and it&#39;ll extract everything to C:\drivers\flash(some random string). Drop a logo.gif file in that directory and run winuptp.exe. If a logo file is present, it&#39;ll ask whether to use it and then write the new BIOS to its staging area, then reboot to actually flash it.</p>

<ul>
<li>OpenBSD support</li>
</ul>

<p>Secure Boot has to be disabled in the BIOS menu, and the &quot;CSM Support&quot; option must be enabled, even when &quot;UEFI/Legacy Boot&quot; is left on &quot;UEFI Only&quot;. Otherwise the screen will just go black after the OpenBSD kernel loads into memory.</p>
</blockquote>

<ul>
<li>Based on this component list, it seems like everything but the fingerprint sensor works fine on OpenBSD.
***</li>
</ul>

<h3><a href="https://www.linuxsecrets.com/en/entry/51-freebsd/2017/09/04/2942-configure-5-freebsd-x-environments" rel="nofollow">Configuring 5 different desktop environments on FreeBSD</a></h3>

<ul>
<li>This fairly quick tutorial over at LinuxSecrets.com is a great start if you are new to FreeBSD, especially if you are coming from Linux and miss your favourite desktop environment</li>
<li>It just goes to show how easy it is to build the desktop you want on modern FreeBSD</li>
<li>The tutorial covers: GNOME, KDE, Xfce, Mate, and Cinnamon</li>
<li>The instructions for each boil down to some variation of:</li>
<li>Install the desktop environment and a login manager if it is not included:
&gt; sudo pkg install gnome3</li>
<li>Enable the login manager, and usually dbus and hald:
&gt; sudo sysrc dbus_enable=&quot;YES&quot; hald_enable=&quot;YES&quot; gdm_enable=&quot;YES&quot; gnome_enable=&quot;YES&quot;?</li>
<li>If using a generic login manager, add the DE startup command to your .xinitrc:
&gt; echo &quot;exec cinnamon&quot; &gt; ~/.xinitrc </li>
<li>And that is about it. </li>
<li>The tutorial goes into more detail on other configuration you can do to get your desktop just the way you like it.</li>
<li>To install Lumina:
&gt; sudo pkg install lumina pcbsd-utils-qt5</li>
<li>This will install Lumina and the pcbsd utilities package which includes pcdm, the login manager. In the near future we hear the login manager and some of the other utilities will be split into separate packages, making it easier to use them on vanilla FreeBSD.
&gt; sudo sysrc pcdm_enable=YES dbus_enable=&quot;YES&quot; hald_enable=&quot;YES&quot; </li>
<li>Reboot, and you should be greeted with the graphical login screen
***</li>
</ul>

<h3><a href="https://lwn.net/Articles/732201/" rel="nofollow">A return-oriented programming defense from OpenBSD</a></h3>

<ul>
<li>We talked a bit about RETGUARD last week, presenting Theos email announcing the new feature</li>
<li>Linux Weekly News has a nice breakdown on just how it works</li>
</ul>

<blockquote>
<p>Stack-smashing attacks have a long history; they featured, for example, as a core part of the Morris worm back in 1988. Restrictions on executing code on the stack have, to a great extent, put an end to such simple attacks, but that does not mean that stack-smashing attacks are no longer a threat. Return-oriented programming (ROP) has become a common technique for compromising systems via a stack-smashing vulnerability. There are various schemes out there for defeating ROP attacks, but a mechanism called &quot;RETGUARD&quot; that is being implemented in OpenBSD is notable for its relative simplicity.<br>
In a classic stack-smashing attack, the attack code would be written directly to the stack and executed there. Most modern systems do not allow execution of on-stack code, though, so this kind of attack will be ineffective. The stack does affect code execution, though, in that the call chain is stored there; when a function executes a &quot;return&quot; instruction, the address to return to is taken from the stack. An attacker who can overwrite the stack can, thus, force a function to &quot;return&quot; to an arbitrary location.<br>
That alone can be enough to carry out some types of attacks, but ROP adds another level of sophistication. A search through a body of binary code will turn up a great many short sequences of instructions ending in a return instruction. These sequences are termed &quot;gadgets&quot;; a large program contains enough gadgets to carry out almost any desired task  if they can be strung together into a chain. ROP works by locating these gadgets, then building a series of stack frames so that each gadget &quot;returns&quot; to the next.<br>
There is, of course, a significant limitation here: a ROP chain made up of exclusively polymorphic gadgets will still work, since those gadgets were not (intentionally) created by the compiler and do not contain the return-address-mangling code. De Raadt acknowledged this limitation, but said: &quot;we believe once standard-RET is solved those concerns become easier to address separately in the future. In any case a substantial reduction of gadgets is powerful&quot;.<br>
Using the compiler to insert the hardening code greatly eases the task of applying RETGUARD to both the OpenBSD kernel and its user-space code. At least, that is true for code written in a high-level language. Any code written in assembly must be changed by hand, though, which is a fair amount of work. De Raadt and company have done that work; he reports that: &quot;We are at the point where userland and base are fully working without regressions, and the remaining impacts are in a few larger ports which directly access the return address (for a variety of reasons)&quot;. It can be expected that, once these final issues are dealt with, OpenBSD will ship with this hardening enabled.</p>
</blockquote>

<ul>
<li>The article wonders about applying the same to Linux, but notes it would be difficult because the Linux kernel cannot currently be compiled using LLVM</li>
</ul>

<blockquote>
<p>If any benchmarks have been run to determine the cost of using RETGUARD, they have not been publicly posted. The extra code will make the kernel a little bigger, and the extra overhead on every function is likely to add up in the end. But if this technique can make the kernel that much harder to exploit, it may well justify the extra execution overhead that it brings with it. All that&#39;s needed is somebody to actually do the work and try it out.</p>

<hr>
</blockquote>

<h3><a href="https://www.youtube.com/playlist?list=PLeF8ZihVdpFfVEsCxNWGDmcATJfRZacHv" rel="nofollow">Videos from BSDCan have started to appear!</a></h3>

<ul>
<li><a href="https://www.youtube.com/watch?v=KuHepyI0_KY" rel="nofollow">Henning Brauer: tcp synfloods - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=1DM5SwoXWSU" rel="nofollow">Benno Rice: The Trouble with FreeBSD - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=SCLfKWaUGa8" rel="nofollow">Li-Wen Hsu: Continuous Integration of The FreeBSD Project - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=gkYjvrFvPJ0" rel="nofollow">Andrew Turner: GENERIC ARM - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=sYmW_H6FrWo" rel="nofollow">Bjoern A. Zeeb: From the outside - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=Zf9tDJhoVbA" rel="nofollow">Rodney W. Grimes: FreeBSD as a Service - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=Os9L_sOiTH0" rel="nofollow">Reyk Floeter: The OpenBSD virtual machine daemon - BSDCan 2017</a></li>
<li><a href="https://www.youtube.com/watch?v=NMUf6VGK2fI" rel="nofollow">Brian Kidney: The Realities of DTrace on FreeBSD - BSDCan 2017</a></li>
<li>The rest will continue to trickle out, likely not until after EuroBSDCon
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://meshedinsights.com/2017/09/03/oracle-finally-killed-sun/" rel="nofollow">Oracle has killed sun</a></li>
<li><a href="http://nanxiao.me/en/configure-thunderbird-to-send-patch-friendly/" rel="nofollow">Configure Thunderbird to send patch friendly</a></li>
<li><a href="https://www.freebsd.org/news/newsflash.html#event20170909:01" rel="nofollow">FreeBSD 10.4-BETA4 Available</a></li>
<li><a href="https://www.facebook.com/ixsystems/posts/10155403417921508" rel="nofollow">iXsystems looking to hire kernel and zfs developers (especially Sun/Oracle Refugees)</a></li>
<li><a href="https://unitedbsd.com/" rel="nofollow">Speaking of job postings, UnitedBSD.com has few job postings related to BSD</a></li>
</ul>

<h2>Call for papers</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/usenix-fast-18-call-for-papers/" rel="nofollow">USENIX FAST 18 - February 12-15, 2018, Due: September 28 2017</a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/scale-16x-call-for-participation/" rel="nofollow">Scale 16x - March 8-11, 2018, Due: October 31, 2017 </a></li>
<li><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/fosdem-18-call-for-participation/" rel="nofollow">FOSDEM 18 - February 3-4, 2018, Due: November 3 2017 </a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/340KRHG" rel="nofollow">Jason asks about cheap router hardware</a></li>
<li><a href="http://dpaste.com/2J7DQQ6" rel="nofollow">Prashant asks about latest kernels with freebsd-update</a></li>
<li><a href="http://dpaste.com/1H5SZ81" rel="nofollow">Matt wants know about VM Performance &amp; CPU Steal Time</a></li>
<li><a href="http://dpaste.com/0X770SY" rel="nofollow">John has config questions regarding Dell precision 7720, FreeBSD, NVME, and ZFS</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>211: It's HAMMER2 Time!</title>
  <link>https://www.bsdnow.tv/211</link>
  <guid isPermaLink="false">ad97fd5d-79ef-479e-bdc4-e4510ca8e241</guid>
  <pubDate>Wed, 13 Sep 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ad97fd5d-79ef-479e-bdc4-e4510ca8e241.mp3" length="88353364" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We explore whether a BSD can replicate Cisco router performance; RETGUARD, OpenBSDs new exploit mitigation technology, Dragonfly’s HAMMER2 filesystem implementation &amp; more!</itunes:subtitle>
  <itunes:duration>2:02:42</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We explore whether a BSD can replicate Cisco router performance; RETGUARD, OpenBSDs new exploit mitigation technology, Dragonfly’s HAMMER2 filesystem implementation &amp;amp; more!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Can a BSD system replicate the performance of a Cisco router? (https://www.reddit.com/r/networking/comments/6upchy/can_a_bsd_system_replicate_the_performance_of/)
Short Answer: No, but it might be good enough for what you need
Traditionally routers were built with a tightly coupled data plane and control plane. Back in the 80s and 90s the data plane was running in software on commodity CPUs with proprietary software. As the needs and desires for more speeds and feeds grew, the data plane had to be implemented in ASICs and FPGAs with custom memories and TCAMs. While these were still programmable in a sense, they certainly weren't programmable by anyone but a small handful of people who developed the hardware platform. The data plane was often layered, where features not handled by the hardware data plane were punted to a software only data path running on a more general CPU. The performance difference between the two were typically an order or two of magnitude. source (https://fd.io/wp-content/uploads/sites/34/2017/07/FDioVPPwhitepaperJuly2017.pdf)
Except for encryption (e.g. IPsec) or IDS/IPS, the true measure of router performance is packets forwarded per unit time. This is normally expressed as Packets-per-second, or PPS. To 'line-rate' forward on a 1gbps interface, you must be able to forward packets at 1.488 million pps (Mpps). To forward at "line-rate" between 10Gbps interfaces, you must be able to forward at 14.88Mpps.
Even on large hardware, kernel-forwarding is limited to speeds that top out below 2Mpps. George Neville-Neil and I did a couple papers on this back in 2014/2015. You can read the papers (https://github.com/freebsd-net/netperf/blob/master/Documentation/Papers/ABSDCon2015Paper.pdf) for the results.
However, once you export the code from the kernel, things start to improve. There are a few open source code bases that show the potential of kernel-bypass networking for building a software-based router. The first of these is netmap-fwd which is the FreeBSD ip_forward() code hosted on top of netmap, a kernel-bypass technology present in FreeBSD (and available for linux). Full-disclosure, netmap-fwd was done at my company, Netgate. netmap-fwd will l3 forward around 5 Mpps per core. slides (https://github.com/Netgate/netmap-fwd/blob/master/netmap-fwd.pdf)
The first of these is netmap-fwd (https://github.com/Netgate/netmap-fwd) which is the FreeBSD ip_forward() code hosted on top of netmap (https://github.com/luigirizzo/netmap), a kernel-bypass technology present in FreeBSD (and available for linux). Full-disclosure, netmap-fwd was done at my company, Netgate. (And by "my company" I mean that I co-own it with my spouse.). netmap-fwd will l3 forward around 5 Mpps per core. slides (https://github.com/Netgate/netmap-fwd/blob/master/netmap-fwd.pdf)
Nanako Momiyama of the Keio Univ Tokuda Lab presented on IP Forwarding Fastpath (https://www.bsdcan.org/2017/schedule/events/823.en.html) at BSDCan this past May. She got about 5.6Mpps (roughly 10% faster than netmap-fwd) using a similar approach where the ip_foward() function was rewritten as a module for VALE (the netmap-based in-kernel switch). Slides (https://2016.eurobsdcon.org/PresentationSlides/NanakoMomiyama_TowardsFastIPForwarding.pdf) from her previous talk at EuroBSDCon 2016 are available. (Speed at the time was 2.8Mpps.). Also a paper (https://www.ht.sfc.keio.ac.jp/~nanako/conext17-sw.pdf) from that effort, if you want to read it. Of note: They were showing around 1.6Mpps even after replacing the in-kernel routing lookup algorithm with DXR. (DXR was written by Luigi Rizzo, who is also the primary author of netmap.)
Not too long after netmap-fwd was open sourced, Ghandi announced packet-journey, an application based on drivers and libraries and from DPDK. Packet-journey is also an L3 router. The GitHub page for packet-journey lists performance as 21,773.47 mbps (so 21.77Gbps) for 64-byte UDP frames with 50 ACLs and 500,000 routes. Since they're using 64-byte frames, this translates to roughly 32.4Mpps.
Finally, there is recent work in FreeBSD (which is part of 11.1-RELEASE) that gets performance up to 2x the level of netmap-fwd or the work by Nanako Momiyama. 10 million PPS: Here (http://blog.cochard.me/2015/09/receipt-for-building-10mpps-freebsd.html) is a decent introduction.
But of course, even as FreeBSD gets up to being able to do 10gbps at line-rate, 40 and 100 gigabits are not uncommon now
Even with the fastest modern CPUs, this is very little time to do any kind of meaningful packet processing. At 10Gbps, your total budget per packet, to receive (Rx) the packet, process the packet, and transmit (Tx) the packet is 67.2 ns. Complicating the task is the simple fact that main memory (RAM) is 70 ns away. The simple conclusion here is that, even at 10Gbps, if you have to hit RAM, you can't generate the PPS required for line-rate forwarding.
There is some detail about design tradeoffs in the Ryzen architecture and how that might impact using those machines as routers
Anyway... those are all interesting, but the natural winner here is FD.io's Vector Packet Processing (VPP). Read this (http://blogs.cisco.com/sp/a-bigger-helping-of-internet-please)
VPP is an efficient, flexible open source data plane. It consists of a set of forwarding nodes arranged in a directed graph and a supporting framework. The framework has all the basic data structures, timers, drivers (and interfaces to both DPDK and netmap), a scheduler which allocates the CPU time between the graph nodes, performance and debugging tools, like counters and built-in packet trace. The latter allows you to capture the paths taken by the packets within the graph with high timestamp granularity, giving full insight into the processing on a per-packet level.
The net result here is that Cisco (again, Cisco) has shown the ability to route packets at 1 Tb/s using VPP on a four socket Purley system
There is also much discussion of the future of pfSense, as they transition to using VPP
This is a very lengthy write up which deserves a full read, plus there are some comments from other people
***
RETGUARD, the OpenBSD next level in exploit mitigation, is about to debut (https://marc.info/?l=openbsd-tech&amp;amp;m=150317547021396&amp;amp;w=2)
This year I went to BSDCAN in Ottawa.  I spent much of it in the 'hallway track', and had an extended conversation with various people regarding our existing security mitigations and hopes for new ones in the future.  I spoke a lot with Todd Mortimer.  Apparently I told him that I felt return-address protection was impossible, so a few weeks later he sent a clang diff to address that issue...
The first diff is for amd64 and i386 only -- in theory RISC architectures can follow this approach soon.
The mechanism is like a userland 'stackghost' in the function prologue and epilogue.  The preamble XOR's the return address at top of stack with the stack pointer value itself.  This perturbs by introducing bits from ASLR.  The function epilogue undoes the transform immediately before the RET instruction.  ROP attack methods are impacted because existing gadgets are transformed to consist of "  RET".  That pivots the return sequence off the ROP chain in a highly unpredictable and inconvenient fashion.
The compiler diff handles this for all the C code, but the assembly functions have to be done by hand.  I did this work first for amd64, and more recently for i386.  I've fixed most of the functions and only a handful of complex ones remain.
For those who know about polymorphism and pop/jmp or JOP, we believe once standard-RET is solved those concerns become easier to address seperately in the future.  In any case a substantial reduction of gadgets is powerful.
For those worried about introducing worse polymorphism with these "xor; ret" epilogues themselves, the nested gadgets for 64bit and 32bit variations are +1 "xor %esp,(%rsp); ret", +2 "and $0x24,%al; ret" and +3 "and $0xc3,%al; int3".  Not bad.
Over the last two weeks, we have received help and advice to ensure debuggers (gdb, egdb, ddb, lldb) can still handle these transformed callframes.  Also in the kernel, we discovered we must use a smaller XOR, because otherwise userland addresses are generated, and cannot rely on SMEP as it is really new feature of the architecture.  There were also issues with pthreads and dlsym, which leads to a series of uplifts around _builtinreturn_address and DWARF CFI.
Application of this diff doesn't require anything special, a system can simply be built twice.  Or shortcut by building &amp;amp; installing gnu/usr.bin/clang first, then a full build.
We are at the point where userland and base are fully working without regressions, and the remaining impacts are in a few larger ports which directly access the return address (for a variety of reasons).
So work needs to continue with handling the RET-addr swizzle in those ports, and then we can move forward.
You can find the full message with the diff here (https://marc.info/?l=openbsd-tech&amp;amp;m=150317547021396&amp;amp;w=2)
***
Interview - Ed Maste, Charlie &amp;amp; Siva - @ed_maste (https://twitter.com/ed_maste), @yzgyyang (https://twitter.com/yzgyyang) &amp;amp; @svmhdvn (https://twitter.com/svmhdvn)
Co-op Students for the FreeBSD Foundation
***
News Roundup
Next DFly release will have an initial HAMMER2 implementation (http://lists.dragonflybsd.org/pipermail/users/2017-August/313558.html)
The next DragonFly release (probably in September some time) will have an initial HAMMER2 implementation.  It WILL be considered experimental and won't be an installer option yet.  This initial release will only have single-image support operational plus basic features.  It will have live dedup (for cp's), compression, fast recovery, snapshot, and boot support out of the gate.
This first H2 release will not have clustering or multi-volume support, so don't expect those features to work.  I may be able to get bulk dedup and basic mirroring operational by release time, but it won't be very efficient.  Also, right now, sync operations are fairly expensive and will stall modifying operations to some degree during the flush, and there is no reblocking (yet).  The allocator has a 16KB granularity (on HAMMER1 it was 2MB), so for testing purposes it will still work fairly well even without reblocking.
The design is in a good place.  I'm quite happy with how the physical layout turned out.  Allocations down to 1KB are supported.  The freemap has a 16KB granularity with a linear counter (one counter per 512KB) for packing smaller allocations.  INodes are 1KB and can directly embed 512 bytes of file data for files &amp;lt;= 512 bytes, or have four top-level blockrefs for files &amp;gt; 512 bytes.  The freemap is also zoned by type for I/O locality.
The blockrefs are 'fat' at 128 bytes but enormously powerful.  That will allow us to ultimately support up to a 512-bit crypto hash and blind dedup using said hash.  Not on release, but that's the plan.
I came up with an excellent solution for directory entries.  The 1KB allocation granularity was a bit high but I didn't want to reduce it. However, because blockrefs are now 128 byte entities, and directory entries are hashed just like in H1, I was able to code them such that a directory entry is embedded in the blockref itself and does not require a separate data reference or allocation beyond that.  Filenames up to 64 bytes long can be accomodated in the blockref using the check-code area of the blockref.  Longer filenames will use an additional data reference hanging off the blockref to accomodate up to 255 char filenames.  Of course, a minimum of 1KB will have to be allocated in that case, but filenames are &amp;lt;= 64 bytes in the vast majority of use cases so it just isn't an issue.
This gives directory entries optimal packing and indexing and is a huge win in terms of performance since blockrefs are arrayed in 16KB and 64KB blocks.  In addition, since inodes can embed up to four blockrefs, the directory entries for 'small' directories with &amp;lt;= 4 entries ('.' and '..' don't count) can actually be embedded in the directory inode itself.
So, generally speaking, the physical layout is in a very happy place.  The basics are solid on my test boxes so it's now a matter of implementing as many of the more sophisticated features as I can before release, and continuing to work on the rest after the release.
Removing Some Code (https://www.openssl.org/blog/blog/2017/06/17/code-removal/)
This is another update on our effort to re-license the OpenSSL software. Our previous post in March was about the launch of our effort to reach all contributors, with the hope that they would support this change.
So far, about 40% of the people have responded. For a project that is as old as OpenSSL (including its predecessor, SSLeay, it’s around 20 years) that’s not bad. We’ll be continuing our efforts over the next couple of months to contact everyone.
Of those people responding, the vast majority have been in favor of the license change – less then a dozen objected. This post describes what we’re doing about those and how we came to our conclusions. The goal is to be very transparent and open with our processes.
First, we want to mention that we respect their decision. While it is inconvenient to us, we acknowledge their rights to keep their code under the terms that they originally agreed to. We are asking permission to change the license terms, and it is fully within their rights to say no.
The license website is driven by scripts that are freely available in the license section of our tools repository on GitHub. When we started, we imported every single git commit, looked for anything that resembled an email address, and created tables for each commit, each user we found, and a log that connects users to commits. This did find false positives: sometimes email Message-ID’s showed up, and there were often mentions of folks just as a passing side-comment, or because they were in the context diff. (That script is also in the tools repository, of course.)
The user table also has columns to record approval or rejection of the license change, and comments. Most of the comments have been supportive, and (a bit surprisingly) only one or two were obscene.
The whattoremove script finds the users who refused, and all commits they were named in. We then examined each commit – there were 86 in all – and filtered out those that were cherry-picks to other releases. We are planning on only changing the license for the master branch, so the other releases branches aren’t applicable. There were also some obvious false positives. At the end of this step, we had 43 commits to review.
We then re-read every single commit, looking for what we could safely ignore as not relevant. We found the following:
Nine of them showed up only because the person was mentioned in a comment.
Sixteen of them were changes to the OpenBSD configuration data. The OpenSSL team had completely rewritten this, refactoring all BSD configurations into a common hierarchy, and the config stuff changed a great deal for 1.1.0.
Seven were not copyrightable as because they were minimal changes (e.g., fixing a typo in a comment).
One was a false positive.
This left us with 10 commits. Two of them them were about the CryptoDev engine. We are removing that engine, as can be seen in this PR, but we expect to have a replacement soon (for at least Linux and FreeBSD). As for the other commits, we are removing that code, as can be seen in this first PR. and this second PR. Fortunately, none of them are particularly complex.
Copyright, however, is a complex thing – at times it makes debugging look simple. If there is only one way to write something, then that content isn’t copyrightable. If the work is very small, such as a one-line patch, then it isn’t copyrightable. We aren’t lawyers, and have no wish to become such, but those viewpoints are valid. It is not official legal advice, however.
For the next step, we hope that we will be able to “put back” the code that we removed. We are looking to the community for help, and encourage you to create the appropriate GitHub pull requests. We ask the community to look at that second PR and provide fixes.
And finally, we ask everyone to look at the list of authors and see if their name, or the name of anyone they know, is listed. If so please email us.
deraadt@ moves us to 6.2-beta! (http://undeadly.org/cgi?action=article&amp;amp;sid=20170821133453)
Theo has just committed the diff that marks the end of the development cycle and the beginning of the testing phase for the upcoming 6.2 release:
`
CVSROOT:        /cvs                                                                                      
Module name:    src                                                                                       
Changes by:     deraadt@cvs.openbsd.org 2017/08/20 10:56:43                                               
Modified files:                                                                                           
        etc/root       : root.mail                                                                        
        share/mk       : sys.mk                                                                           
        sys/arch/macppc/stand/tbxidata: bsd.tbxi                                                          
        sys/conf       : newvers.sh                                                                       
        sys/sys        : param.h                                                                                                                                                                                    
Log message:                                                                                              
crank to 6.2-beta                                                                                         
`
You all know what this means: get to testing! Find whatever hardware you have and install the latest snapshots, stress the upgrade procedure, play your favorite games, build your own code - whatever you use OpenBSD for, try it in the new snaps and report any problems you find. Your testing efforts will help make sure 6.2 is another great release!
Beastie Bits
64 Hijacked ARMs (https://www.soldierx.com/news/64-Hijacked-ARMs)
Smartisan Makes Another Iridium Donation to the OpenBSD Foundation (http://undeadly.org/cgi?action=article&amp;amp;sid=20170817195416)
Andrey A. Chernov (ache), long-time FreeBSD core team member and dev, has passed away (https://twitter.com/Keltounet/status/898092662657560576)
OpenBSD hacker Mickey Shalayeff has passed away (https://twitter.com/dugsong/status/897338038212276224)
FreeBSD 10.4-BETA1 Available (https://www.freebsd.org/news/newsflash.html#event20170819:01)
vmadm in action, from getting a dataset to running a jail w/ vnet networking in just a few commands (https://asciinema.org/a/M8sjN0FC64JPBWZqjKIG5sx2q)
Interview with Patrick Wildt (from t2k17 OpenBSD Hackathon) (https://garbage.fm/episodes/41)
***
Feedback/Questions
Seth - Switching to tarsnap (http://dpaste.com/0F2382X)
Johnny - memcmp (http://dpaste.com/1F576QS)
Thomas - Drives and NAS (http://dpaste.com/0F9QSZZ)
Ben - Nvidia (http://dpaste.com/1Z6CFWE)
David - ZFS performance variations over nfs (http://dpaste.com/0B23QZB)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We explore whether a BSD can replicate Cisco router performance; RETGUARD, OpenBSDs new exploit mitigation technology, Dragonflys HAMMER2 filesystem implementation &amp; more!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.reddit.com/r/networking/comments/6upchy/can_a_bsd_system_replicate_the_performance_of/" rel="nofollow">Can a BSD system replicate the performance of a Cisco router?</a></h3>

<ul>
<li>Short Answer: No, but it might be good enough for what you need</li>
</ul>

<blockquote>
<p>Traditionally routers were built with a tightly coupled data plane and control plane. Back in the 80s and 90s the data plane was running in software on commodity CPUs with proprietary software. As the needs and desires for more speeds and feeds grew, the data plane had to be implemented in ASICs and FPGAs with custom memories and TCAMs. While these were still programmable in a sense, they certainly weren&#39;t programmable by anyone but a small handful of people who developed the hardware platform. The data plane was often layered, where features not handled by the hardware data plane were punted to a software only data path running on a more general CPU. The performance difference between the two were typically an order or two of magnitude. <a href="https://fd.io/wp-content/uploads/sites/34/2017/07/FDioVPPwhitepaperJuly2017.pdf" rel="nofollow">source</a></p>

<p>Except for encryption (e.g. IPsec) or IDS/IPS, the true measure of router performance is packets forwarded per unit time. This is normally expressed as Packets-per-second, or PPS. To &#39;line-rate&#39; forward on a 1gbps interface, you must be able to forward packets at 1.488 million pps (Mpps). To forward at &quot;line-rate&quot; between 10Gbps interfaces, you must be able to forward at 14.88Mpps.<br>
Even on large hardware, kernel-forwarding is limited to speeds that top out below 2Mpps. George Neville-Neil and I did a couple papers on this back in 2014/2015. You can read <a href="https://github.com/freebsd-net/netperf/blob/master/Documentation/Papers/ABSDCon2015Paper.pdf" rel="nofollow">the papers</a> for the results.</p>

<p>However, once you export the code from the kernel, things start to improve. There are a few open source code bases that show the potential of kernel-bypass networking for building a software-based router. The first of these is netmap-fwd which is the FreeBSD ip_forward() code hosted on top of netmap, a kernel-bypass technology present in FreeBSD (and available for linux). Full-disclosure, netmap-fwd was done at my company, Netgate. netmap-fwd will l3 forward around 5 Mpps per core. <a href="https://github.com/Netgate/netmap-fwd/blob/master/netmap-fwd.pdf" rel="nofollow">slides</a></p>

<p>The first of these is <a href="https://github.com/Netgate/netmap-fwd" rel="nofollow">netmap-fwd</a> which is the FreeBSD ip_forward() code hosted on top of <a href="https://github.com/luigirizzo/netmap" rel="nofollow">netmap</a>, a kernel-bypass technology present in FreeBSD (and available for linux). Full-disclosure, netmap-fwd was done at my company, Netgate. (And by &quot;my company&quot; I mean that I co-own it with my spouse.). netmap-fwd will l3 forward around 5 Mpps per core. <a href="https://github.com/Netgate/netmap-fwd/blob/master/netmap-fwd.pdf" rel="nofollow">slides</a></p>

<p>Nanako Momiyama of the Keio Univ Tokuda Lab presented on <a href="https://www.bsdcan.org/2017/schedule/events/823.en.html" rel="nofollow">IP Forwarding Fastpath</a> at BSDCan this past May. She got about 5.6Mpps (roughly 10% faster than netmap-fwd) using a similar approach where the ip_foward() function was rewritten as a module for VALE (the netmap-based in-kernel switch). <a href="https://2016.eurobsdcon.org/PresentationSlides/NanakoMomiyama_TowardsFastIPForwarding.pdf" rel="nofollow">Slides</a> from her previous talk at EuroBSDCon 2016 are available. (Speed at the time was 2.8Mpps.). Also a <a href="https://www.ht.sfc.keio.ac.jp/%7Enanako/conext17-sw.pdf" rel="nofollow">paper</a> from that effort, if you want to read it. Of note: They were showing around 1.6Mpps even after replacing the in-kernel routing lookup algorithm with DXR. (DXR was written by Luigi Rizzo, who is also the primary author of netmap.)</p>

<p>Not too long after netmap-fwd was open sourced, Ghandi announced packet-journey, an application based on drivers and libraries and from DPDK. Packet-journey is also an L3 router. The GitHub page for packet-journey lists performance as 21,773.47 mbps (so 21.77Gbps) for 64-byte UDP frames with 50 ACLs and 500,000 routes. Since they&#39;re using 64-byte frames, this translates to roughly 32.4Mpps.<br>
Finally, there is recent work in FreeBSD (which is part of 11.1-RELEASE) that gets performance up to 2x the level of netmap-fwd or the work by Nanako Momiyama. 10 million PPS: <a href="http://blog.cochard.me/2015/09/receipt-for-building-10mpps-freebsd.html" rel="nofollow">Here</a> is a decent introduction.</p>
</blockquote>

<ul>
<li>But of course, even as FreeBSD gets up to being able to do 10gbps at line-rate, 40 and 100 gigabits are not uncommon now</li>
</ul>

<blockquote>
<p>Even with the fastest modern CPUs, this is very little time to do any kind of meaningful packet processing. At 10Gbps, your total budget per packet, to receive (Rx) the packet, process the packet, and transmit (Tx) the packet is 67.2 ns. Complicating the task is the simple fact that main memory (RAM) is 70 ns away. The simple conclusion here is that, even at 10Gbps, if you have to hit RAM, you can&#39;t generate the PPS required for line-rate forwarding.</p>
</blockquote>

<ul>
<li>There is some detail about design tradeoffs in the Ryzen architecture and how that might impact using those machines as routers</li>
</ul>

<blockquote>
<p>Anyway... those are all interesting, but the natural winner here is FD.io&#39;s Vector Packet Processing (VPP). <a href="http://blogs.cisco.com/sp/a-bigger-helping-of-internet-please" rel="nofollow">Read this</a><br>
VPP is an efficient, flexible open source data plane. It consists of a set of forwarding nodes arranged in a directed graph and a supporting framework. The framework has all the basic data structures, timers, drivers (and interfaces to both DPDK and netmap), a scheduler which allocates the CPU time between the graph nodes, performance and debugging tools, like counters and built-in packet trace. The latter allows you to capture the paths taken by the packets within the graph with high timestamp granularity, giving full insight into the processing on a per-packet level.<br>
The net result here is that Cisco (again, Cisco) has shown the ability to route packets at 1 Tb/s using VPP on a four socket Purley system</p>
</blockquote>

<ul>
<li>There is also much discussion of the future of pfSense, as they transition to using VPP</li>
<li>This is a very lengthy write up which deserves a full read, plus there are some comments from other people
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-tech&m=150317547021396&w=2" rel="nofollow">RETGUARD, the OpenBSD next level in exploit mitigation, is about to debut</a></h3>

<blockquote>
<p>This year I went to BSDCAN in Ottawa.  I spent much of it in the &#39;hallway track&#39;, and had an extended conversation with various people regarding our existing security mitigations and hopes for new ones in the future.  I spoke a lot with Todd Mortimer.  Apparently I told him that I felt return-address protection was impossible, so a few weeks later he sent a clang diff to address that issue...<br>
The first diff is for amd64 and i386 only -- in theory RISC architectures can follow this approach soon.<br>
The mechanism is like a userland &#39;stackghost&#39; in the function prologue and epilogue.  The preamble XOR&#39;s the return address at top of stack with the stack pointer value itself.  This perturbs by introducing bits from ASLR.  The function epilogue undoes the transform immediately before the RET instruction.  ROP attack methods are impacted because existing gadgets are transformed to consist of &quot;<gadget artifacts> <mangle ret address> RET&quot;.  That pivots the return sequence off the ROP chain in a highly unpredictable and inconvenient fashion.<br>
The compiler diff handles this for all the C code, but the assembly functions have to be done by hand.  I did this work first for amd64, and more recently for i386.  I&#39;ve fixed most of the functions and only a handful of complex ones remain.<br>
For those who know about polymorphism and pop/jmp or JOP, we believe once standard-RET is solved those concerns become easier to address seperately in the future.  In any case a substantial reduction of gadgets is powerful.<br>
For those worried about introducing worse polymorphism with these &quot;xor; ret&quot; epilogues themselves, the nested gadgets for 64bit and 32bit variations are +1 &quot;xor %esp,(%rsp); ret&quot;, +2 &quot;and $0x24,%al; ret&quot; and +3 &quot;and $0xc3,%al; int3&quot;.  Not bad.<br>
Over the last two weeks, we have received help and advice to ensure debuggers (gdb, egdb, ddb, lldb) can still handle these transformed callframes.  Also in the kernel, we discovered we must use a smaller XOR, because otherwise userland addresses are generated, and cannot rely on SMEP as it is really new feature of the architecture.  There were also issues with pthreads and dlsym, which leads to a series of uplifts around __builtin_return_address and DWARF CFI.<br>
Application of this diff doesn&#39;t require anything special, a system can simply be built twice.  Or shortcut by building &amp; installing gnu/usr.bin/clang first, then a full build.<br>
We are at the point where userland and base are fully working without regressions, and the remaining impacts are in a few larger ports which directly access the return address (for a variety of reasons).<br>
So work needs to continue with handling the RET-addr swizzle in those ports, and then we can move forward.</p>
</blockquote>

<ul>
<li>You can find the full message with the diff <a href="https://marc.info/?l=openbsd-tech&m=150317547021396&w=2" rel="nofollow">here</a>
***</li>
</ul>

<h2>Interview - Ed Maste, Charlie &amp; Siva - <a href="https://twitter.com/ed_maste" rel="nofollow">@ed_maste</a>, <a href="https://twitter.com/yzgyyang" rel="nofollow">@yzgyyang</a> &amp; <a href="https://twitter.com/svmhdvn" rel="nofollow">@svmhdvn</a></h2>

<ul>
<li>Co-op Students for the FreeBSD Foundation
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2017-August/313558.html" rel="nofollow">Next DFly release will have an initial HAMMER2 implementation</a></h3>

<blockquote>
<p>The next DragonFly release (probably in September some time) will have an initial HAMMER2 implementation.  It WILL be considered experimental and won&#39;t be an installer option yet.  This initial release will only have single-image support operational plus basic features.  It will have live dedup (for cp&#39;s), compression, fast recovery, snapshot, and boot support out of the gate.<br>
This first H2 release will not have clustering or multi-volume support, so don&#39;t expect those features to work.  I may be able to get bulk dedup and basic mirroring operational by release time, but it won&#39;t be very efficient.  Also, right now, sync operations are fairly expensive and will stall modifying operations to some degree during the flush, and there is no reblocking (yet).  The allocator has a 16KB granularity (on HAMMER1 it was 2MB), so for testing purposes it will still work fairly well even without reblocking.<br>
The design is in a good place.  I&#39;m quite happy with how the physical layout turned out.  Allocations down to 1KB are supported.  The freemap has a 16KB granularity with a linear counter (one counter per 512KB) for packing smaller allocations.  INodes are 1KB and can directly embed 512 bytes of file data for files &lt;= 512 bytes, or have four top-level blockrefs for files &gt; 512 bytes.  The freemap is also zoned by type for I/O locality.<br>
The blockrefs are &#39;fat&#39; at 128 bytes but enormously powerful.  That will allow us to ultimately support up to a 512-bit crypto hash and blind dedup using said hash.  Not on release, but that&#39;s the plan.<br>
I came up with an excellent solution for directory entries.  The 1KB allocation granularity was a bit high but I didn&#39;t want to reduce it. However, because blockrefs are now 128 byte entities, and directory entries are hashed just like in H1, I was able to code them such that a directory entry is embedded in the blockref itself and does not require a separate data reference or allocation beyond that.  Filenames up to 64 bytes long can be accomodated in the blockref using the check-code area of the blockref.  Longer filenames will use an additional data reference hanging off the blockref to accomodate up to 255 char filenames.  Of course, a minimum of 1KB will have to be allocated in that case, but filenames are &lt;= 64 bytes in the vast majority of use cases so it just isn&#39;t an issue.<br>
This gives directory entries optimal packing and indexing and is a huge win in terms of performance since blockrefs are arrayed in 16KB and 64KB blocks.  In addition, since inodes can embed up to four blockrefs, the directory entries for &#39;small&#39; directories with &lt;= 4 entries (&#39;.&#39; and &#39;..&#39; don&#39;t count) can actually be embedded in the directory inode itself.<br>
So, generally speaking, the physical layout is in a very happy place.  The basics are solid on my test boxes so it&#39;s now a matter of implementing as many of the more sophisticated features as I can before release, and continuing to work on the rest after the release.</p>

<hr>
</blockquote>

<h3><a href="https://www.openssl.org/blog/blog/2017/06/17/code-removal/" rel="nofollow">Removing Some Code</a></h3>

<blockquote>
<p>This is another update on our effort to re-license the OpenSSL software. Our previous post in March was about the launch of our effort to reach all contributors, with the hope that they would support this change.<br>
So far, about 40% of the people have responded. For a project that is as old as OpenSSL (including its predecessor, SSLeay, its around 20 years) thats not bad. Well be continuing our efforts over the next couple of months to contact everyone.<br>
Of those people responding, the vast majority have been in favor of the license change  less then a dozen objected. This post describes what were doing about those and how we came to our conclusions. The goal is to be very transparent and open with our processes.<br>
First, we want to mention that we respect their decision. While it is inconvenient to us, we acknowledge their rights to keep their code under the terms that they originally agreed to. We are asking permission to change the license terms, and it is fully within their rights to say no.<br>
The license website is driven by scripts that are freely available in the license section of our tools repository on GitHub. When we started, we imported every single git commit, looked for anything that resembled an email address, and created tables for each commit, each user we found, and a log that connects users to commits. This did find false positives: sometimes email Message-IDs showed up, and there were often mentions of folks just as a passing side-comment, or because they were in the context diff. (That script is also in the tools repository, of course.)<br>
The user table also has columns to record approval or rejection of the license change, and comments. Most of the comments have been supportive, and (a bit surprisingly) only one or two were obscene.<br>
The whattoremove script finds the users who refused, and all commits they were named in. We then examined each commit  there were 86 in all  and filtered out those that were cherry-picks to other releases. We are planning on only changing the license for the master branch, so the other releases branches arent applicable. There were also some obvious false positives. At the end of this step, we had 43 commits to review.<br>
We then re-read every single commit, looking for what we could safely ignore as not relevant. We found the following:<br>
Nine of them showed up only because the person was mentioned in a comment.<br>
Sixteen of them were changes to the OpenBSD configuration data. The OpenSSL team had completely rewritten this, refactoring all BSD configurations into a common hierarchy, and the config stuff changed a great deal for 1.1.0.<br>
Seven were not copyrightable as because they were minimal changes (e.g., fixing a typo in a comment).<br>
One was a false positive.<br>
This left us with 10 commits. Two of them them were about the CryptoDev engine. We are removing that engine, as can be seen in this PR, but we expect to have a replacement soon (for at least Linux and FreeBSD). As for the other commits, we are removing that code, as can be seen in this first PR. and this second PR. Fortunately, none of them are particularly complex.<br>
Copyright, however, is a complex thing  at times it makes debugging look simple. If there is only one way to write something, then that content isnt copyrightable. If the work is very small, such as a one-line patch, then it isnt copyrightable. We arent lawyers, and have no wish to become such, but those viewpoints are valid. It is not official legal advice, however.<br>
For the next step, we hope that we will be able to put back the code that we removed. We are looking to the community for help, and encourage you to create the appropriate GitHub pull requests. We ask the community to look at that second PR and provide fixes.<br>
And finally, we ask everyone to look at the list of authors and see if their name, or the name of anyone they know, is listed. If so please email us.</p>

<hr>
</blockquote>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170821133453" rel="nofollow">deraadt@ moves us to 6.2-beta!</a></h3>

<blockquote>
<p>Theo has just committed the diff that marks the end of the development cycle and the beginning of the testing phase for the upcoming 6.2 release:</p>
</blockquote>

<p>`<br>
CVSROOT:        /cvs<br><br>
Module name:    src<br><br>
Changes by:     <a href="mailto:deraadt@cvs.openbsd.org" rel="nofollow">deraadt@cvs.openbsd.org</a> 2017/08/20 10:56:43                                               </p>

<p>Modified files:<br><br>
        etc/root       : root.mail<br><br>
        share/mk       : sys.mk<br><br>
        sys/arch/macppc/stand/tbxidata: bsd.tbxi<br><br>
        sys/conf       : newvers.sh<br><br>
        sys/sys        : param.h<br><br>
Log message:<br><br>
crank to 6.2-beta<br><br>
`</p>

<blockquote>
<p>You all know what this means: get to testing! Find whatever hardware you have and install the latest snapshots, stress the upgrade procedure, play your favorite games, build your own code - whatever you use OpenBSD for, try it in the new snaps and report any problems you find. Your testing efforts will help make sure 6.2 is another great release!</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.soldierx.com/news/64-Hijacked-ARMs" rel="nofollow">64 Hijacked ARMs</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170817195416" rel="nofollow">Smartisan Makes Another Iridium Donation to the OpenBSD Foundation</a></li>
<li><a href="https://twitter.com/Keltounet/status/898092662657560576" rel="nofollow">Andrey A. Chernov (ache), long-time FreeBSD core team member and dev, has passed away</a></li>
<li><a href="https://twitter.com/dugsong/status/897338038212276224" rel="nofollow">OpenBSD hacker Mickey Shalayeff has passed away</a></li>
<li><a href="https://www.freebsd.org/news/newsflash.html#event20170819:01" rel="nofollow">FreeBSD 10.4-BETA1 Available</a></li>
<li><a href="https://asciinema.org/a/M8sjN0FC64JPBWZqjKIG5sx2q" rel="nofollow">vmadm in action, from getting a dataset to running a jail w/ vnet networking in just a few commands</a></li>
<li><a href="https://garbage.fm/episodes/41" rel="nofollow">Interview with Patrick Wildt (from t2k17 OpenBSD Hackathon)</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Seth - <a href="http://dpaste.com/0F2382X" rel="nofollow">Switching to tarsnap</a></li>
<li>Johnny - <a href="http://dpaste.com/1F576QS" rel="nofollow">memcmp</a></li>
<li>Thomas - <a href="http://dpaste.com/0F9QSZZ" rel="nofollow">Drives and NAS</a></li>
<li>Ben - <a href="http://dpaste.com/1Z6CFWE" rel="nofollow">Nvidia</a></li>
<li>David - <a href="http://dpaste.com/0B23QZB" rel="nofollow">ZFS performance variations over nfs</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We explore whether a BSD can replicate Cisco router performance; RETGUARD, OpenBSDs new exploit mitigation technology, Dragonflys HAMMER2 filesystem implementation &amp; more!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.reddit.com/r/networking/comments/6upchy/can_a_bsd_system_replicate_the_performance_of/" rel="nofollow">Can a BSD system replicate the performance of a Cisco router?</a></h3>

<ul>
<li>Short Answer: No, but it might be good enough for what you need</li>
</ul>

<blockquote>
<p>Traditionally routers were built with a tightly coupled data plane and control plane. Back in the 80s and 90s the data plane was running in software on commodity CPUs with proprietary software. As the needs and desires for more speeds and feeds grew, the data plane had to be implemented in ASICs and FPGAs with custom memories and TCAMs. While these were still programmable in a sense, they certainly weren&#39;t programmable by anyone but a small handful of people who developed the hardware platform. The data plane was often layered, where features not handled by the hardware data plane were punted to a software only data path running on a more general CPU. The performance difference between the two were typically an order or two of magnitude. <a href="https://fd.io/wp-content/uploads/sites/34/2017/07/FDioVPPwhitepaperJuly2017.pdf" rel="nofollow">source</a></p>

<p>Except for encryption (e.g. IPsec) or IDS/IPS, the true measure of router performance is packets forwarded per unit time. This is normally expressed as Packets-per-second, or PPS. To &#39;line-rate&#39; forward on a 1gbps interface, you must be able to forward packets at 1.488 million pps (Mpps). To forward at &quot;line-rate&quot; between 10Gbps interfaces, you must be able to forward at 14.88Mpps.<br>
Even on large hardware, kernel-forwarding is limited to speeds that top out below 2Mpps. George Neville-Neil and I did a couple papers on this back in 2014/2015. You can read <a href="https://github.com/freebsd-net/netperf/blob/master/Documentation/Papers/ABSDCon2015Paper.pdf" rel="nofollow">the papers</a> for the results.</p>

<p>However, once you export the code from the kernel, things start to improve. There are a few open source code bases that show the potential of kernel-bypass networking for building a software-based router. The first of these is netmap-fwd which is the FreeBSD ip_forward() code hosted on top of netmap, a kernel-bypass technology present in FreeBSD (and available for linux). Full-disclosure, netmap-fwd was done at my company, Netgate. netmap-fwd will l3 forward around 5 Mpps per core. <a href="https://github.com/Netgate/netmap-fwd/blob/master/netmap-fwd.pdf" rel="nofollow">slides</a></p>

<p>The first of these is <a href="https://github.com/Netgate/netmap-fwd" rel="nofollow">netmap-fwd</a> which is the FreeBSD ip_forward() code hosted on top of <a href="https://github.com/luigirizzo/netmap" rel="nofollow">netmap</a>, a kernel-bypass technology present in FreeBSD (and available for linux). Full-disclosure, netmap-fwd was done at my company, Netgate. (And by &quot;my company&quot; I mean that I co-own it with my spouse.). netmap-fwd will l3 forward around 5 Mpps per core. <a href="https://github.com/Netgate/netmap-fwd/blob/master/netmap-fwd.pdf" rel="nofollow">slides</a></p>

<p>Nanako Momiyama of the Keio Univ Tokuda Lab presented on <a href="https://www.bsdcan.org/2017/schedule/events/823.en.html" rel="nofollow">IP Forwarding Fastpath</a> at BSDCan this past May. She got about 5.6Mpps (roughly 10% faster than netmap-fwd) using a similar approach where the ip_foward() function was rewritten as a module for VALE (the netmap-based in-kernel switch). <a href="https://2016.eurobsdcon.org/PresentationSlides/NanakoMomiyama_TowardsFastIPForwarding.pdf" rel="nofollow">Slides</a> from her previous talk at EuroBSDCon 2016 are available. (Speed at the time was 2.8Mpps.). Also a <a href="https://www.ht.sfc.keio.ac.jp/%7Enanako/conext17-sw.pdf" rel="nofollow">paper</a> from that effort, if you want to read it. Of note: They were showing around 1.6Mpps even after replacing the in-kernel routing lookup algorithm with DXR. (DXR was written by Luigi Rizzo, who is also the primary author of netmap.)</p>

<p>Not too long after netmap-fwd was open sourced, Ghandi announced packet-journey, an application based on drivers and libraries and from DPDK. Packet-journey is also an L3 router. The GitHub page for packet-journey lists performance as 21,773.47 mbps (so 21.77Gbps) for 64-byte UDP frames with 50 ACLs and 500,000 routes. Since they&#39;re using 64-byte frames, this translates to roughly 32.4Mpps.<br>
Finally, there is recent work in FreeBSD (which is part of 11.1-RELEASE) that gets performance up to 2x the level of netmap-fwd or the work by Nanako Momiyama. 10 million PPS: <a href="http://blog.cochard.me/2015/09/receipt-for-building-10mpps-freebsd.html" rel="nofollow">Here</a> is a decent introduction.</p>
</blockquote>

<ul>
<li>But of course, even as FreeBSD gets up to being able to do 10gbps at line-rate, 40 and 100 gigabits are not uncommon now</li>
</ul>

<blockquote>
<p>Even with the fastest modern CPUs, this is very little time to do any kind of meaningful packet processing. At 10Gbps, your total budget per packet, to receive (Rx) the packet, process the packet, and transmit (Tx) the packet is 67.2 ns. Complicating the task is the simple fact that main memory (RAM) is 70 ns away. The simple conclusion here is that, even at 10Gbps, if you have to hit RAM, you can&#39;t generate the PPS required for line-rate forwarding.</p>
</blockquote>

<ul>
<li>There is some detail about design tradeoffs in the Ryzen architecture and how that might impact using those machines as routers</li>
</ul>

<blockquote>
<p>Anyway... those are all interesting, but the natural winner here is FD.io&#39;s Vector Packet Processing (VPP). <a href="http://blogs.cisco.com/sp/a-bigger-helping-of-internet-please" rel="nofollow">Read this</a><br>
VPP is an efficient, flexible open source data plane. It consists of a set of forwarding nodes arranged in a directed graph and a supporting framework. The framework has all the basic data structures, timers, drivers (and interfaces to both DPDK and netmap), a scheduler which allocates the CPU time between the graph nodes, performance and debugging tools, like counters and built-in packet trace. The latter allows you to capture the paths taken by the packets within the graph with high timestamp granularity, giving full insight into the processing on a per-packet level.<br>
The net result here is that Cisco (again, Cisco) has shown the ability to route packets at 1 Tb/s using VPP on a four socket Purley system</p>
</blockquote>

<ul>
<li>There is also much discussion of the future of pfSense, as they transition to using VPP</li>
<li>This is a very lengthy write up which deserves a full read, plus there are some comments from other people
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-tech&m=150317547021396&w=2" rel="nofollow">RETGUARD, the OpenBSD next level in exploit mitigation, is about to debut</a></h3>

<blockquote>
<p>This year I went to BSDCAN in Ottawa.  I spent much of it in the &#39;hallway track&#39;, and had an extended conversation with various people regarding our existing security mitigations and hopes for new ones in the future.  I spoke a lot with Todd Mortimer.  Apparently I told him that I felt return-address protection was impossible, so a few weeks later he sent a clang diff to address that issue...<br>
The first diff is for amd64 and i386 only -- in theory RISC architectures can follow this approach soon.<br>
The mechanism is like a userland &#39;stackghost&#39; in the function prologue and epilogue.  The preamble XOR&#39;s the return address at top of stack with the stack pointer value itself.  This perturbs by introducing bits from ASLR.  The function epilogue undoes the transform immediately before the RET instruction.  ROP attack methods are impacted because existing gadgets are transformed to consist of &quot;<gadget artifacts> <mangle ret address> RET&quot;.  That pivots the return sequence off the ROP chain in a highly unpredictable and inconvenient fashion.<br>
The compiler diff handles this for all the C code, but the assembly functions have to be done by hand.  I did this work first for amd64, and more recently for i386.  I&#39;ve fixed most of the functions and only a handful of complex ones remain.<br>
For those who know about polymorphism and pop/jmp or JOP, we believe once standard-RET is solved those concerns become easier to address seperately in the future.  In any case a substantial reduction of gadgets is powerful.<br>
For those worried about introducing worse polymorphism with these &quot;xor; ret&quot; epilogues themselves, the nested gadgets for 64bit and 32bit variations are +1 &quot;xor %esp,(%rsp); ret&quot;, +2 &quot;and $0x24,%al; ret&quot; and +3 &quot;and $0xc3,%al; int3&quot;.  Not bad.<br>
Over the last two weeks, we have received help and advice to ensure debuggers (gdb, egdb, ddb, lldb) can still handle these transformed callframes.  Also in the kernel, we discovered we must use a smaller XOR, because otherwise userland addresses are generated, and cannot rely on SMEP as it is really new feature of the architecture.  There were also issues with pthreads and dlsym, which leads to a series of uplifts around __builtin_return_address and DWARF CFI.<br>
Application of this diff doesn&#39;t require anything special, a system can simply be built twice.  Or shortcut by building &amp; installing gnu/usr.bin/clang first, then a full build.<br>
We are at the point where userland and base are fully working without regressions, and the remaining impacts are in a few larger ports which directly access the return address (for a variety of reasons).<br>
So work needs to continue with handling the RET-addr swizzle in those ports, and then we can move forward.</p>
</blockquote>

<ul>
<li>You can find the full message with the diff <a href="https://marc.info/?l=openbsd-tech&m=150317547021396&w=2" rel="nofollow">here</a>
***</li>
</ul>

<h2>Interview - Ed Maste, Charlie &amp; Siva - <a href="https://twitter.com/ed_maste" rel="nofollow">@ed_maste</a>, <a href="https://twitter.com/yzgyyang" rel="nofollow">@yzgyyang</a> &amp; <a href="https://twitter.com/svmhdvn" rel="nofollow">@svmhdvn</a></h2>

<ul>
<li>Co-op Students for the FreeBSD Foundation
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2017-August/313558.html" rel="nofollow">Next DFly release will have an initial HAMMER2 implementation</a></h3>

<blockquote>
<p>The next DragonFly release (probably in September some time) will have an initial HAMMER2 implementation.  It WILL be considered experimental and won&#39;t be an installer option yet.  This initial release will only have single-image support operational plus basic features.  It will have live dedup (for cp&#39;s), compression, fast recovery, snapshot, and boot support out of the gate.<br>
This first H2 release will not have clustering or multi-volume support, so don&#39;t expect those features to work.  I may be able to get bulk dedup and basic mirroring operational by release time, but it won&#39;t be very efficient.  Also, right now, sync operations are fairly expensive and will stall modifying operations to some degree during the flush, and there is no reblocking (yet).  The allocator has a 16KB granularity (on HAMMER1 it was 2MB), so for testing purposes it will still work fairly well even without reblocking.<br>
The design is in a good place.  I&#39;m quite happy with how the physical layout turned out.  Allocations down to 1KB are supported.  The freemap has a 16KB granularity with a linear counter (one counter per 512KB) for packing smaller allocations.  INodes are 1KB and can directly embed 512 bytes of file data for files &lt;= 512 bytes, or have four top-level blockrefs for files &gt; 512 bytes.  The freemap is also zoned by type for I/O locality.<br>
The blockrefs are &#39;fat&#39; at 128 bytes but enormously powerful.  That will allow us to ultimately support up to a 512-bit crypto hash and blind dedup using said hash.  Not on release, but that&#39;s the plan.<br>
I came up with an excellent solution for directory entries.  The 1KB allocation granularity was a bit high but I didn&#39;t want to reduce it. However, because blockrefs are now 128 byte entities, and directory entries are hashed just like in H1, I was able to code them such that a directory entry is embedded in the blockref itself and does not require a separate data reference or allocation beyond that.  Filenames up to 64 bytes long can be accomodated in the blockref using the check-code area of the blockref.  Longer filenames will use an additional data reference hanging off the blockref to accomodate up to 255 char filenames.  Of course, a minimum of 1KB will have to be allocated in that case, but filenames are &lt;= 64 bytes in the vast majority of use cases so it just isn&#39;t an issue.<br>
This gives directory entries optimal packing and indexing and is a huge win in terms of performance since blockrefs are arrayed in 16KB and 64KB blocks.  In addition, since inodes can embed up to four blockrefs, the directory entries for &#39;small&#39; directories with &lt;= 4 entries (&#39;.&#39; and &#39;..&#39; don&#39;t count) can actually be embedded in the directory inode itself.<br>
So, generally speaking, the physical layout is in a very happy place.  The basics are solid on my test boxes so it&#39;s now a matter of implementing as many of the more sophisticated features as I can before release, and continuing to work on the rest after the release.</p>

<hr>
</blockquote>

<h3><a href="https://www.openssl.org/blog/blog/2017/06/17/code-removal/" rel="nofollow">Removing Some Code</a></h3>

<blockquote>
<p>This is another update on our effort to re-license the OpenSSL software. Our previous post in March was about the launch of our effort to reach all contributors, with the hope that they would support this change.<br>
So far, about 40% of the people have responded. For a project that is as old as OpenSSL (including its predecessor, SSLeay, its around 20 years) thats not bad. Well be continuing our efforts over the next couple of months to contact everyone.<br>
Of those people responding, the vast majority have been in favor of the license change  less then a dozen objected. This post describes what were doing about those and how we came to our conclusions. The goal is to be very transparent and open with our processes.<br>
First, we want to mention that we respect their decision. While it is inconvenient to us, we acknowledge their rights to keep their code under the terms that they originally agreed to. We are asking permission to change the license terms, and it is fully within their rights to say no.<br>
The license website is driven by scripts that are freely available in the license section of our tools repository on GitHub. When we started, we imported every single git commit, looked for anything that resembled an email address, and created tables for each commit, each user we found, and a log that connects users to commits. This did find false positives: sometimes email Message-IDs showed up, and there were often mentions of folks just as a passing side-comment, or because they were in the context diff. (That script is also in the tools repository, of course.)<br>
The user table also has columns to record approval or rejection of the license change, and comments. Most of the comments have been supportive, and (a bit surprisingly) only one or two were obscene.<br>
The whattoremove script finds the users who refused, and all commits they were named in. We then examined each commit  there were 86 in all  and filtered out those that were cherry-picks to other releases. We are planning on only changing the license for the master branch, so the other releases branches arent applicable. There were also some obvious false positives. At the end of this step, we had 43 commits to review.<br>
We then re-read every single commit, looking for what we could safely ignore as not relevant. We found the following:<br>
Nine of them showed up only because the person was mentioned in a comment.<br>
Sixteen of them were changes to the OpenBSD configuration data. The OpenSSL team had completely rewritten this, refactoring all BSD configurations into a common hierarchy, and the config stuff changed a great deal for 1.1.0.<br>
Seven were not copyrightable as because they were minimal changes (e.g., fixing a typo in a comment).<br>
One was a false positive.<br>
This left us with 10 commits. Two of them them were about the CryptoDev engine. We are removing that engine, as can be seen in this PR, but we expect to have a replacement soon (for at least Linux and FreeBSD). As for the other commits, we are removing that code, as can be seen in this first PR. and this second PR. Fortunately, none of them are particularly complex.<br>
Copyright, however, is a complex thing  at times it makes debugging look simple. If there is only one way to write something, then that content isnt copyrightable. If the work is very small, such as a one-line patch, then it isnt copyrightable. We arent lawyers, and have no wish to become such, but those viewpoints are valid. It is not official legal advice, however.<br>
For the next step, we hope that we will be able to put back the code that we removed. We are looking to the community for help, and encourage you to create the appropriate GitHub pull requests. We ask the community to look at that second PR and provide fixes.<br>
And finally, we ask everyone to look at the list of authors and see if their name, or the name of anyone they know, is listed. If so please email us.</p>

<hr>
</blockquote>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170821133453" rel="nofollow">deraadt@ moves us to 6.2-beta!</a></h3>

<blockquote>
<p>Theo has just committed the diff that marks the end of the development cycle and the beginning of the testing phase for the upcoming 6.2 release:</p>
</blockquote>

<p>`<br>
CVSROOT:        /cvs<br><br>
Module name:    src<br><br>
Changes by:     <a href="mailto:deraadt@cvs.openbsd.org" rel="nofollow">deraadt@cvs.openbsd.org</a> 2017/08/20 10:56:43                                               </p>

<p>Modified files:<br><br>
        etc/root       : root.mail<br><br>
        share/mk       : sys.mk<br><br>
        sys/arch/macppc/stand/tbxidata: bsd.tbxi<br><br>
        sys/conf       : newvers.sh<br><br>
        sys/sys        : param.h<br><br>
Log message:<br><br>
crank to 6.2-beta<br><br>
`</p>

<blockquote>
<p>You all know what this means: get to testing! Find whatever hardware you have and install the latest snapshots, stress the upgrade procedure, play your favorite games, build your own code - whatever you use OpenBSD for, try it in the new snaps and report any problems you find. Your testing efforts will help make sure 6.2 is another great release!</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.soldierx.com/news/64-Hijacked-ARMs" rel="nofollow">64 Hijacked ARMs</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170817195416" rel="nofollow">Smartisan Makes Another Iridium Donation to the OpenBSD Foundation</a></li>
<li><a href="https://twitter.com/Keltounet/status/898092662657560576" rel="nofollow">Andrey A. Chernov (ache), long-time FreeBSD core team member and dev, has passed away</a></li>
<li><a href="https://twitter.com/dugsong/status/897338038212276224" rel="nofollow">OpenBSD hacker Mickey Shalayeff has passed away</a></li>
<li><a href="https://www.freebsd.org/news/newsflash.html#event20170819:01" rel="nofollow">FreeBSD 10.4-BETA1 Available</a></li>
<li><a href="https://asciinema.org/a/M8sjN0FC64JPBWZqjKIG5sx2q" rel="nofollow">vmadm in action, from getting a dataset to running a jail w/ vnet networking in just a few commands</a></li>
<li><a href="https://garbage.fm/episodes/41" rel="nofollow">Interview with Patrick Wildt (from t2k17 OpenBSD Hackathon)</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Seth - <a href="http://dpaste.com/0F2382X" rel="nofollow">Switching to tarsnap</a></li>
<li>Johnny - <a href="http://dpaste.com/1F576QS" rel="nofollow">memcmp</a></li>
<li>Thomas - <a href="http://dpaste.com/0F9QSZZ" rel="nofollow">Drives and NAS</a></li>
<li>Ben - <a href="http://dpaste.com/1Z6CFWE" rel="nofollow">Nvidia</a></li>
<li>David - <a href="http://dpaste.com/0B23QZB" rel="nofollow">ZFS performance variations over nfs</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>210: Your questions, part I</title>
  <link>https://www.bsdnow.tv/210</link>
  <guid isPermaLink="false">be8706fd-d9f3-488b-89a2-a1d3243560a9</guid>
  <pubDate>Wed, 06 Sep 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/be8706fd-d9f3-488b-89a2-a1d3243560a9.mp3" length="84270964" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this episode, we take a look at the reimplementation of NetBSD using a Microkernel, check out what makes DHCP faster, and see what high-process count support for DragonflyBSD has to offer, and we answer the questions you’ve always wanted to ask us.</itunes:subtitle>
  <itunes:duration>1:57:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this episode, we take a look at the reimplementation of NetBSD using a Microkernel, check out what makes DHCP faster, and see what high-process count support for DragonflyBSD has to offer, and we answer the questions you’ve always wanted to ask us.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
A Reimplementation Of Netbsd Using a Microkernel (http://theembeddedboard.review/a-reimplementation-of-netbsd-using-a-microkernel-part-1-of-2/)
Minix author Andy Tanenbaum writes in Part 1 of a-reimplementation-of-netbsd-using-a-microkernel (http://theembeddedboard.review/a-reimplementation-of-netbsd-using-a-microkernel-part-1-of-2/)
 Based on the MINIX 3 microkernel, we have constructed a system that to the user looks a great deal like NetBSD. It uses pkgsrc, NetBSD headers and libraries, and passes over 80% of the KYUA tests). However, inside, the system is completely different. At the bottom is a small (about 13,000 lines of code) microkernel that handles interrupts, message passing, low-level scheduling, and hardware related details. Nearly all of the actual operating system, including memory management, the file system(s), paging, and all the device drivers run as user-mode processes protected by the MMU. As a consequence, failures or security issues in one component cannot spread to other ones. In some cases a failed component can be replaced automatically and on the fly, while the system is running, and without user processes noticing it. The talk will discuss the history, goals, technology, and status of the project.
 Research at the Vrije Universiteit has resulted in a reimplementation of NetBSD using a microkernel instead of the traditional monolithic kernel. To the user, the system looks a great deal like NetBSD (it passes over 80% of the KYUA tests). However, inside, the system is completely different. At the bottom is a small (about 13,000 lines of code) microkernel that handles interrupts, message passing, low-level scheduling, and hardware related details. Nearly all of the actual operating system, including memory management, the file system(s), paging, and all the device drivers run as user-mode processes protected by the MMU. As a consequence, failures or security issues in one component cannot spread to other ones. In some cases a failed component can be replaced automatically and on the fly, while the system is running.
 The latest work has been adding live update, making it possible to upgrade to a new version of the operating system WITHOUT a reboot and without running processes even noticing. No other operating system can do this.
 The system is built on MINIX 3, a derivative of the original MINIX system, which was intended for education. However, after the original author, Andrew Tanenbaum, received a 2 million euro grant from the Royal Netherlands Academy of Arts and Sciences and a 2.5 million euro grant from the European Research Council, the focus changed to building a highly reliable, secure, fault tolerant operating system, with an emphasis on embedded systems. The code is open source and can be downloaded from www.minix3.org. It runs on the x86 and ARM Cortex V8 (e.g., BeagleBones). Since 2007, the Website has been visited over 3 million times and the bootable image file has been downloaded over 600,000 times. The talk will discuss the history, goals, technology, and status of the project.
Part 2 (http://theembeddedboard.review/a-reimplementation-of-netbsd-using-a-microkernel-part-2-of-2/) is also available.
***
Rapid DHCP: Or, how do Macs get on the network so fast? (https://cafbit.com/post/rapid_dhcp_or_how_do/)
One of life's minor annoyances is having to wait on my devices to connect to the network after I wake them from sleep. All too often, I'll open the lid on my EeePC netbook, enter a web address, and get the dreaded "This webpage is not available" message because the machine is still working on connecting to my Wi-Fi network. On some occasions, I have to twiddle my thumbs for as long as 10-15 seconds before the network is ready to be used. The frustrating thing is that I know it doesn't have to be this way. I know this because I have a Mac. When I open the lid of my MacBook Pro, it connects to the network nearly instantaneously. In fact, no matter how fast I am, the network comes up before I can even try to load a web page. My curiosity got the better of me, and I set out to investigate how Macs are able to connect to the network so quickly, and how the network connect time in other operating systems could be improved.
 I figure there are three main categories of time-consuming activities that occur during network initialization:
Link establishment. This is the activity of establishing communication with the network's link layer. In the case of Wi-Fi, the radio must be powered on, the access point detected, and the optional encryption layer (e.g. WPA) established. After link establishment, the device is able to send and receive Ethernet frames on the network.
Dynamic Host Configuration Protocol (DHCP). Through DHCP handshaking, the device negotiates an IP address for its use on the local IP network. A DHCP server is responsible for managing the IP addresses available for use on the network.
Miscellaneous overhead. The operating system may perform any number of mundane tasks during the process of network initialization, including running scripts, looking up preconfigured network settings in a local database, launching programs, etc.
 My investigation thus far is primarily concerned with the DHCP phase, although the other two categories would be interesting to study in the future. I set up a packet capture environment with a spare wireless access point, and observed the network activity of a number of devices as they initialized their network connection. For a worst-case scenario, let's look at the network activity captured while an Android tablet is connecting:
 This tablet, presumably in the interest of "optimization", is initially skipping the DHCP discovery phase and immediately requesting its previous IP address. The only problem is this is a different network, so the DHCP server ignores these requests. After about 4.5 seconds, the tablet stubbornly tries again to request its old IP address. After another 4.5 seconds, it resigns itself to starting from scratch, and performs the DHCP discovery needed to obtain an IP address on the new network.
 In all fairness, this delay wouldn't be so bad if the device was connecting to the same network as it was previously using. However, notice that the tablet waits a full 1.13 seconds after link establishment to even think about starting the DHCP process. Engineering snappiness usually means finding lots of small opportunities to save a few milliseconds here and there, and someone definitely dropped the ball here.
 In contrast, let's look at the packet dump from the machine with the lightning-fast network initialization, and see if we can uncover the magic that is happening under the hood:
 The key to understanding the magic is the first three unicast ARP requests. It looks like Mac OS remembers certain information about not only the last connected network, but the last several networks. In particular, it must at least persist the following tuple for each of these networks:
    &amp;gt; 1. The Ethernet address of the DHCP server
    &amp;gt; 2. The IP address of the DHCP server
    &amp;gt; 3. Its own IP address, as assigned by the DHCP server
 During network initialization, the Mac transmits carefully crafted unicast ARP requests with this stored information. For each network in its memory, it attempts to send a request to the specific Ethernet address of the DHCP server for that network, in which it asks about the server's IP address, and requests that the server reply to the IP address which the Mac was formerly using on that network. Unless network hosts have been radically shuffled around, at most only one of these ARP requests will result in a response—the request corresponding to the current network, if the current network happens to be one of the remembered networks.
 This network recognition technique allows the Mac to very rapidly discover if it is connected to a known network. If the network is recognized (and presumably if the Mac knows that the DHCP lease is still active), it immediately and presumptuously configures its IP interface with the address it knows is good for this network. (Well, it does perform a self-ARP for good measure, but doesn't seem to wait more than 13ms for a response.) The DHCP handshaking process begins in the background by sending a DHCP request for its assumed IP address, but the network interface is available for use during the handshaking process. If the network was not recognized, I assume the Mac would know to begin the DHCP discovery phase, instead of sending blind requests for a former IP address as the Galaxy Tab does.
 The Mac's rapid network initialization can be credited to more than just the network recognition scheme. Judging by the use of ARP (which can be problematic to deal with in user-space) and the unusually regular transmission intervals (a reliable 1.0ms delay between each packet sent), I'm guessing that the Mac's DHCP client system is entirely implemented as tight kernel-mode code. The Mac began the IP interface initialization process a mere 10ms after link establishment, which is far faster than any other device I tested. Android devices such as the Galaxy Tab rely on the user-mode dhclient system (part of the dhcpcd package) dhcpcd program, which no doubt brings a lot of additional overhead such as loading the program, context switching, and perhaps even running scripts.
 The next step for some daring kernel hacker is to implement a similarly aggressive DHCP client system in the Linux kernel, so that I can enjoy fast sign-on speeds on my Android tablet, Android phone, and Ubuntu netbook. There already exists a minimal DHCP client implementation in the Linux kernel, but it lacks certain features such as configuring the DNS nameservers. Perhaps it wouldn't be too much work to extend this code to support network recognition and interface with a user-mode daemon to handle such auxillary configuration information received via DHCP. If I ever get a few spare cycles, maybe I'll even take a stab at it.
You can also find other ways of optimizing the dhclient program and how it works in the dhclient tutorial on Calomel.org (https://calomel.org/dhclient.html).
***
BSDCam Trip Report (https://www.freebsdfoundation.org/blog/bsdcam-2017-trip-report-michael-lucas/)
Over the decades, FreeBSD development and coordination has shifted from being purely on-line to involving more and more in-person coordination and cooperation. The FreeBSD Foundation sponsors a devsummit right before BSDCan, EuroBSDCon, and AsiaBSDCon, so that developers traveling to the con can leverage their airfare and hammer out some problems. Yes, the Internet is great for coordination, but nothing beats a group of developers spending ten minutes together to sketch on a whiteboard and figuring out exactly how to make something bulletproof.
In addition to the coordination efforts, though, conference devsummits are hierarchical. There’s a rigid schedule, with topics decided in advance. Someone leads the session. Sessions can be highly informative, passionate arguments, or anything in between.
BSDCam is… a little different. It’s an invaluable part of the FreeBSD ecosystem. However, it’s something that I wouldn’t normally attend.
But right now, is not normal. I’m writing a new edition of Absolute FreeBSD. To my astonishment, people have come to rely on this book when planning their deployments and operations. While I find this satisfying, it also increases the pressure on me to get things correct. When I wrote my first FreeBSD book back in 2000, a dozen mailing lists provided authoritative information on FreeBSD development. One person could read every one of those lists. Today, that’s not possible—and the mailing lists are only one narrow aspect of the FreeBSD social system.
Don’t get me wrong—it’s pretty easy to find out what people are doing and how the system works. But it’s not that easy to find out what people will be doing and how the system will work. If this book is going to be future-proof, I needed to leave my cozy nest and venture into the wilds of Cambridge, England. Sadly, the BSDCam chair agreed with my logic, so I boarded an aluminum deathtrap—sorry, a “commercial airliner”—and found myself hurtled from Detroit to Heathrow.
And one Wednesday morning, I made it to the William Gates building of Cambridge University, consciousness nailed to my body by a thankfully infinite stream of proper British tea.
BSDCam attendance is invitation only, and the facilities can only handle fifty folks or so. You need to be actively working on FreeBSD to wrangle an invite. Developers attend from all over the world. Yet, there’s no agenda. Robert Watson is the chair, but he doesn’t decide on the conference topics. He goes around the room and asks everyone to introduce themselves, say what they’re working on, and declare what they want to discuss during the conference. The topics of interest are tallied. The most popular topics get assigned time slots and one of the two big rooms. Folks interested in less popular topics are invited to claim one of the small breakout rooms.
Then the real fun begins. I started by eavesdropping in the virtualization workshop. For two hours, people discussed FreeBSD’s virtualization needs, strengths, and weaknesses. What needs help? What should this interface look like? What compatibility is important, and what isn’t? By the end of the session, the couple dozen people had developed a reasonable consensus and, most importantly, some folks had added items to their to-do lists.
Repeat for a dozen more topics. I got a good grip on what’s really happening with security mitigation techniques, FreeBSD’s cloud support, TCP/IP improvements, advances in teaching FreeBSD, and more. A BSDCan devsummit presentation on packaging the base system is informative, but eavesdropping on two dozen highly educated engineers arguing about how to nail down the final tidbits needed to make that a real thing is far more educational.
To my surprise, I was able to provide useful feedback for some sessions. I speak at a lot of events outside of the FreeBSD world, and was able to share much of what I hear at Linux conferences. A tool that works well for an experienced developer doesn’t necessarily work well for everyone.
Every year, I leave BSDCan tired. I left BSDCam entirely exhausted. These intense, focused discussions stretched my brain.
But, I have a really good idea where key parts of FreeBSD development are actually headed. This should help future-proof the new Absolute FreeBSD, as much as any computer book can be future-proof.
Plus, BSDCam throws the most glorious conference dinner I’ve ever seen.
I want to thank Robert Watson for his kind invitation, and the FreeBSD Foundation for helping defray the cost of this trip
Interview - The BSDNow Crew
As a kid, what did you dream of to become as an adult?
JT: An Astronaut
BR: I wanted to be a private detective, because of all the crime novels that I read back
then. I didn’t get far with it. However, I think the structured analysis skills (who did what, when, and such) help me in debugging and sysadmin work.
AJ: Didn’t think about it much
How do you manage to stay organized day to day with so much things you're actively doing each day? (Day job, wife/girlfriend, conferences, hobbies, friends, etc.)
JT: Who said I was organized?
BR: A lot of stuff in my calendar as reminders, open browser tabs as “to read later” list. A few things like task switching when getting stuck helps. Also, focus on a single goal for the day, even though there will be distractions. Slowly, but steadily chip away at the things you’re working on. Rather than to procrastinate and put things back to review later, get started early with easy things for a big task and then tackle the hard part. Often, things look totally chaotic and unmanageable, until you start working on them. 
AJ: I barely manage. Lots of Google Calendar reminders, and the entire wall of my office is covered in whiteboard sheet todo lists. I use pinboard.in to deal with finding and organizing bookmarks. Write things down, don’t trust your memory.
What hobbies outside of IT do you have?
JT: I love photography, but I do that Professional part time, so I’m not sure if that counts as a hobby anymore.  I guess it’d have to be working in the garage on my cars.
BR: I do Tai Chi to relax once a week in a group, but can also do it alone, pretty much everywhere. Way too much Youtube watching and browsing the web. I did play some games before studying at the university and I’m still proud that I could control it to the bare minimum not to impact my studies. A few “lapses” from time to time, revisiting the old classics since the newer stuff won’t run on my machines anyway. Holiday time is pretty much spent for BSD conferences and events, this is where I can relax and talk with like-minded people from around the world, which is fascinating. Plus, it gets me to various places and countries I never would have dared to visit on my own.
AJ: I play a few video games, and I like to ski, although I don’t go very often as most of my vacation time is spent hanging out with my BSD friends at various conferences
How do you relax?
JT: What is this word ‘relax’ and what does it mean?
BR: My Tai Chi plays a big part in it I guess. I really calms you and the constant stream of thoughts for a while. It also gives you better clarity of what’s important in life. Watching movies, sleeping long.
AJ: Usually watching TV or Movies. Although I have taken to doing most of my TV watching on my exercise bike now, but it is still mentally relaxing
If FreeBSD didn't exist,  which BSD flavour would you use? Why?
JT: I use TrueOS, but if FreeBSD didn’t exist, that project might not either… so…  My other choice would be HardenedBSD, but since it’s also based on FreeBSD I’m in the same dillema.  
BR: I once installed NetBSD to see what It can do. If FreeBSD wouldn’t exist, I would probably try my luck with it. OpenBSD is also appealing, but I’ve never installed it.
AJ: When I started using FreeBSD in 2000, the only other BSD I had heard of at the time was OpenBSD. If FreeBSD wasn’t around, I don’t think the world would look like it does, so it is hard to speculate.
If any of the BSD's weren't around and you had to use Linux, which camp would belong to? (Redhat, SUSE, Debian, Ubuntu, Gentoo?)
JT: I learned Linux in the mid 90s using Slackware, which I used consistently up until the mid 2000s, when I joined the PuppyLinux community and eventually became a developer (FYI, Puppy was/is/can be based on Slackware -- its complicated).  So I’d go back to using either Slackware or PuppyLinux.
BR: I tried various Linux distributions until I landed at Debian. I used is pretty extensively as my desktop OS at home, building custom kernels and packages to install them until I discovered FreeBSD. I ran both side by side for a few months for learning until one day I figured out that I had not booted Debian in a while, so I switched completely. 
AJ: The first Linux I played with was Slackware, and it is the most BSD like, but the bits of Linux I learned in school were Redhat and so I can somewhat wrap my head around it, although now that they are changing everything to systemd, all of that old knowledge is more harmful than useful.
Are you still finding yourself in need to use Windows/Mac OS? Why?
JT: I work part time as a professional Photographer, so I do use Windows for my photography work.  While I can do everything I need to do in Linux, it comes down to being pragmatic about my time.  What takes me several hours to accomplish in Linux I can accomplish in 20 minutes on Windows.
BR: I was a long time Windows-only user before my Unix days. But back when Vista was about to come out and I needed a new laptop, my choice was basically learning to cope with Vistas awful features or learn MacOS X. I did the latter, it increased my productivity since it’s really a good Unix desktop experience (at least, back then). I only have to use Windows at work from time to time as I manage our Windows Terminal server, which keeps the exposure low enough and I only connect to it to use a certain app not available for the Mac or the BSDs.
AJ: I still use Windows to play games, for a lot of video conferencing, and to produce BSD Now. Some of it could be done on BSD but not as easily. I have promised myself that I will switch to 100% BSD rather than upgrade to Windows 10, so we’ll see how that goes.
Please describe your home networking setup.  Router type, router OS, router hardware, network segmentation, wifi apparatus(es), other devices connected, and anything else that might be interesting about your home network.
BR: Very simple and boring: Apple Airport Express base station and an AVM FritzBox  for DNS, DHCP, and the link to my provider. A long network cable to my desktop machine. That I use less and less often. I just bought an RPI 3 for some home use in the future to replace it. Mostly my brother’s and my Macbook Pro’s are connected, our phones and the iPad of my mother.  
AJ: I have a E3-1220 v3 (dual 3.1ghz + HT) with 8 GB of ram, and 4x Intel gigabit server NICs as my router, and it runs vanilla FreeBSD (usually some snapshot of -current). I have 4 different VLANs, Home, Office, DMZ, and Guest WiFi. WiFi is served via a tiny USB powered device I bought in Tokyo years ago, it serves 3 different SSIDs, one for each VLAN except the DMZ. There are ethernet jacks in every room wired for 10 gigabit, although the only machines with 10 gigabit are my main workstation, file server, and some machines in the server rack. There are 3 switches, one for the house (in the laundry room), one for the rack, and one for 10gig stuff. There is a rack in the basement spare bedroom, it has 7 servers in it, mostly storage for live replicas of customer data for my company.
How do guys manage to get your work done on FreeBSD desktops? What do you do when you need to a Linux or Windows app that isn't ported, or working? I've made several attempts to switch to FreeBSD, but each attempt failed because of tools not being available (e.g. Zoom, Dropbox, TeamViewer, Crashplan) or broken (e.g. VirtualBox).
BR: I use VIrtualBox for everything that is not natively available or Windows-only. Unfortunately, that means no modern games. I mostly do work in the shell when I’m on FreeBSD and when it has to be a graphical application, then I use Fluxbox as the DE. I want to get work done, not look at fancy eye-candy that get’s boring after a while. Deactivated the same stuff on my mac due to the same reason. I look for alternative software online, but my needs are relatively easy to satisfy as I’m not doing video editing/rendering and such.
AJ: I generally find that I don’t need these apps. I use Firefox, Thunderbird, OpenSSH, Quassel, KomodoEdit, and a few other apps, so my needs are not very demanding. It is annoying when packages are broken, but I usually work around this with boot environments, and being able to just roll back to a version that worked for a few days until the problem is solved. I do still have access to a windows machine for the odd time I need specific VPN software or access to Dell/HP etc out-of-band management tools.
Which desktop environments are your favorite, and why? For example, I like i3, Xfce, and I'm drawn to Lumina's ethos, but so far always seem to end up back on Xfc because of its ease of use, flexibility, and dashing good looks.
JT: As a Lumina Desktop developer, I think my preference is obvious. ;)  I am also a long 
timeOpenBox user, so I have a soft place in my heart for that as well.  
BR: I use Fluxbox when I need to work with a lot of windows or an application demands X11. KDE and others are too memory heavy for me and I rarely use even 20% of the features they provide.
AJ: I was a long time KDE user, but I have adopted Lumina. I find it fast, and that it gets out of my way and lets me do what I want. It had some annoyances early on, but I’ve nagged the developers into making it work for me.
Which command-line shells do you prefer, why, and how (if at all) have you customised the environment or prompt?
BR: I use zsh, but without all the fancy stuff you can find online. It might make you more productive, yes. But again, I try to keep things simple. I’m slowly learning tmux and want to work more in it in the future. I sometimes look at other BSD people’s laptops and am amazed at what they do with window-management in tmux. My prompt looks like this:

bcr@Voyager:~&amp;gt;                             20:20 17-08-17
Put this in your .zshrc to get the same result:
PROMPT='%n@%m:%~&amp;gt;'
RPROMPT='%T %D'

AJ: I started using tcsh early on, because it was the shell on the first box I had access to, and because one of the first things I read in “BSD Hacks” was how to enable ‘typo correction”, which made my life a lot better especially on dial up in the early days. My shell prompt looks like this: allan@CA-TOR1-02:/usr/home/allan%
What is one thing (or more) missing in FreeBSD you would import from another project or community? Could be tech, process, etc.
JT: AUFS from Linux
BR: Nohup from Illumos where you can detach an already running process and put it in the background. I often forget that and I’m not in tmux when that happens, so I can see myself use that feature a lot.
AJ: Zones (more complete Jails) from IllumOS
how do you manage your time to learn about and work on FreeBSD?  Does your  work/employment enable what you do, or are your contributions mainly done in private time?
JT: These days I’m mostly learning things I need for work, so it just falls into something I’m doing while working on work projects.
BR: We have a lot of time during the semester holidays to learn on our own, it’s part of the idea of being in a university to keep yourself updated, at least for me. Especially in the fast moving world of IT. I also read a lot in my free time. My interests can shift sometimes, but then I devour everything I can find on the topic. Can be a bit excessive, but has gotten me where I am now and I still need a lot to learn (and want to). Since I work with FreeBSD at work (my owndoing), I can try out many things there.
AJ: My work means a spend a lot of time working with FreeBSD, but not that much time working ON it. My contributions are mostly done outside of work, but as I own the company I do get more flexibility to take time off for conferences and other FreeBSD related stuff.
we know we can bribe Michael W Lucas with gelato (good gelato that is), but what can we use to bribe you guys? Like when I want to have Allan to work on fixing a bug which prevents me from running ZFS on this fancy rock64 board?
BR: Desserts of various kinds. 
AJ: I am probably not the right person to look at your rock64 board. Most people in the project have taken to bribing me with chocolate. In general, my todo list is so long, the best way is a trade, you take this task and I’ll take that task.
Is your daily mobile device iOS, Android, Windows Mobile, or other? Why?
JT: These days I’m using Android on my Blackberry Priv, but until recently I was still a heavy user of Sailfish OS.  I would use SailfishOS everyday, if I could find a phone with a keyboard that I could run it on.
BR: iOS on the iPhone 7 currently. Never used an Android phone, saw it on other people’s devices and what they can do with it (much more). But the infrequent security updates (if any at all) keep me away from it.
AJ: I have a Google Nexus 6 (Android 7.1). I wanted the ‘pure’ Android experience, and I had been happy with my previous Nexus S. I don’t run a custom OS/ROM or anything because I use the phone to verify that video streams work on an ‘average users device’. I am displeased that support for my device will end soon. I am not sure what device I will get next, but it definitely won’t be an iPhone.
News Roundup
Beta Update - Request for (more) Testing (http://undeadly.org/cgi?action=article&amp;amp;sid=20170808065718&amp;amp;mode=flat&amp;amp;count=30)
 https://beta.undeadly.org/ has received an update. The most significant changes include:
The site has been given a less antiquated "look". (As the topic icons have been eliminated, we are no longer seeking help with those graphics.)
The site now uses a moderate amount of semantic HTML5.
Several bugs in the HTML fragment validator (used for submissions and comments) have been fixed.
To avoid generating invalid HTML, submission content which fails validation is no longer displayed in submission/comment previews.
Plain text submissions are converted to HTML in a more useful fashion. (Instead of just converting each EOL to &lt;br&gt;, the converter now generates proper paragraphs and interprets two or more consecutive EOLs as indicating a paragraph break.)
 The redevelopment remains a work-in-progress. Many thanks to those who have contributed!
 As before, constructive feedback would be appreciated. Of particular interest are reports of bugs in behaviour (for example, in the HTML validator or in authentication) that would preclude the adoption of the current code for the main site.
High-process-count support added to master (http://lists.dragonflybsd.org/pipermail/users/2017-August/313552.html)
 We've fixed a number of bottlenecks that can develop when the number of user processes runs into the tens of thousands or higher.  One thing led to another and I said to myself, "gee, we have a 6-digit PID, might as well make it work to a million!".  With the commits made today, master can support at least 900,000 processes with just a kern.maxproc setting in
/boot/loader.conf, assuming the machine has the memory to handle it.
 And, in fact, as today's machines start to ratchet up there in both memory capacity and core count, with fast storage (NVMe) and fast networking (10GigE and higher), even in consumer boxes, this is actually something that one might want to do.  With AMD's threadripper and EPYC chips now out, the Intel&amp;lt;-&amp;gt;AMD cpu wars are back on!   Boasting up to 32 cores (64 threads) per socket and two sockets on EPYC, terabytes of ram, and motherboards with dual 10GigE built-in, the reality is that these numbers are already achievable in a useful manner.
 In anycase, I've tested these changes on a dual-socket xeon.  I can in-fact start 900,000 processes.  They don't get a whole lot of cpu and running 'ps' would be painful, but it works and the system is still responsive from the shell with all of that going on.
 xeon126# uptime
 1:42PM  up 9 mins, 3 users, load averages: 890407.00, 549381.40, 254199.55
 In fact, judging from the memory use, these minimal test processes only eat around 60KB each.  900,000 of them ate only 55GB on a 128GB machine.  So even a million processes is not out of the question, depending on the cpu requirements for those processes.  Today's modern machines can be stuffed with enormous amounts of memory.
 Of course, our PIDs are currently limited to 6 digits, so a million is kinda the upper limit in terms of discrete user processes (verses pthreads which are less restricted).  I'd rather not go to 7 digits (yet).
CFT: Driver for generic MS Windows 7/8/10 - compatible USB HID multi-touch touchscreens (https://lists.freebsd.org/pipermail/freebsd-current/2017-August/066783.html)
Following patch [1] adds support for generic MS Windows 7/8/10 - compatible USB HID multi-touch touchscreens via evdev protocol. It is intended to be a native replacement of hid-multitouch.c driver found in Linux distributions and multimedia/webcamd port.
Patch is made for 12-CURRENT and most probably can be applied to recent 11-STABLE and 11.1-RELEASE (not tested)
How to test"

1. Apply patch [1]
2. To compile this driver into the kernel, place the following lines 
into your kernel configuration file:
       device wmt
       device usb
       device evdev
    Alternatively, to load the driver as a module at boot time, place the 
following line in loader.conf(5):
       wmt_load="YES"
3. Install x11-drivers/xf86-input-evdev or 
x11-drivers/xf86-input-libinput port
4. Tell XOrg to use evdev or libinput driver for the device:

```
Section "ServerLayout"
     InputDevice    "TouchScreen0" "SendCoreEvents"
EndSection
Section "InputDevice"
     Identifier  "TouchScreen0"
     Driver      "evdev"
#   Driver      "libinput"
     Option      "Device" "/dev/input/eventXXX"
EndSection
```
Exact value of "/dev/input/eventXXX" can be obtained with evemu-record utility from devel/evemu.
Note1: Currently, driver does not support pens or touchpads.
Note2: wmt.ko should be kld-loaded before uhid driver to take precedence over it! Otherwise uhid can be kld-unloaded after loading of wmt.
wmt review: https://reviews.freebsd.org/D12017
Raw diff: https://reviews.freebsd.org/D12017.diff
***
Beastie Bits
BSDMag Programing Languages Infographic (https://bsdmag.org/programm_history/)
t2k17 Hackathon Report: Bob Beck on buffer cache tweaks, libressl and pledge progress (http://undeadly.org/cgi?action=article&amp;amp;sid=20170815171854)
New FreeBSD Journal (https://www.freebsdfoundation.org/past-issues/resource-control/)
NetBSD machines at Open Source Conference 2017 Kyoto (http://mail-index.netbsd.org/netbsd-advocacy/2017/08/10/msg000744.html)
***
Feedback/Questions
Dan - HDD question (http://dpaste.com/3H6TDJV)
Benjamin - scrub of death (http://dpaste.com/10F086V)
Jason - Router Opinion (http://dpaste.com/2D9102K) 
Sohrab - Thanks (http://dpaste.com/1XYYTWF)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this episode, we take a look at the reimplementation of NetBSD using a Microkernel, check out what makes DHCP faster, and see what high-process count support for DragonflyBSD has to offer, and we answer the questions you’ve always wanted to ask us.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://theembeddedboard.review/a-reimplementation-of-netbsd-using-a-microkernel-part-1-of-2/" rel="nofollow">A Reimplementation Of Netbsd Using a Microkernel</a></h3>

<ul>
<li>Minix author Andy Tanenbaum writes in <a href="http://theembeddedboard.review/a-reimplementation-of-netbsd-using-a-microkernel-part-1-of-2/" rel="nofollow">Part 1 of a-reimplementation-of-netbsd-using-a-microkernel</a></li>
</ul>

<blockquote>
<p>Based on the MINIX 3 microkernel, we have constructed a system that to the user looks a great deal like NetBSD. It uses pkgsrc, NetBSD headers and libraries, and passes over 80% of the KYUA tests). However, inside, the system is completely different. At the bottom is a small (about 13,000 lines of code) microkernel that handles interrupts, message passing, low-level scheduling, and hardware related details. Nearly all of the actual operating system, including memory management, the file system(s), paging, and all the device drivers run as user-mode processes protected by the MMU. As a consequence, failures or security issues in one component cannot spread to other ones. In some cases a failed component can be replaced automatically and on the fly, while the system is running, and without user processes noticing it. The talk will discuss the history, goals, technology, and status of the project.<br>
 Research at the Vrije Universiteit has resulted in a reimplementation of NetBSD using a microkernel instead of the traditional monolithic kernel. To the user, the system looks a great deal like NetBSD (it passes over 80% of the KYUA tests). However, inside, the system is completely different. At the bottom is a small (about 13,000 lines of code) microkernel that handles interrupts, message passing, low-level scheduling, and hardware related details. Nearly all of the actual operating system, including memory management, the file system(s), paging, and all the device drivers run as user-mode processes protected by the MMU. As a consequence, failures or security issues in one component cannot spread to other ones. In some cases a failed component can be replaced automatically and on the fly, while the system is running.<br>
 The latest work has been adding live update, making it possible to upgrade to a new version of the operating system WITHOUT a reboot and without running processes even noticing. No other operating system can do this.<br>
 The system is built on MINIX 3, a derivative of the original MINIX system, which was intended for education. However, after the original author, Andrew Tanenbaum, received a 2 million euro grant from the Royal Netherlands Academy of Arts and Sciences and a 2.5 million euro grant from the European Research Council, the focus changed to building a highly reliable, secure, fault tolerant operating system, with an emphasis on embedded systems. The code is open source and can be downloaded from <a href="http://www.minix3.org" rel="nofollow">www.minix3.org</a>. It runs on the x86 and ARM Cortex V8 (e.g., BeagleBones). Since 2007, the Website has been visited over 3 million times and the bootable image file has been downloaded over 600,000 times. The talk will discuss the history, goals, technology, and status of the project.</p>
</blockquote>

<ul>
<li><a href="http://theembeddedboard.review/a-reimplementation-of-netbsd-using-a-microkernel-part-2-of-2/" rel="nofollow">Part 2</a> is also available.
***</li>
</ul>

<h3><a href="https://cafbit.com/post/rapid_dhcp_or_how_do/" rel="nofollow">Rapid DHCP: Or, how do Macs get on the network so fast?</a></h3>

<ul>
<li>One of life&#39;s minor annoyances is having to wait on my devices to connect to the network after I wake them from sleep. All too often, I&#39;ll open the lid on my EeePC netbook, enter a web address, and get the dreaded &quot;This webpage is not available&quot; message because the machine is still working on connecting to my Wi-Fi network. On some occasions, I have to twiddle my thumbs for as long as 10-15 seconds before the network is ready to be used. The frustrating thing is that I know it doesn&#39;t have to be this way. I know this because I have a Mac. When I open the lid of my MacBook Pro, it connects to the network nearly instantaneously. In fact, no matter how fast I am, the network comes up before I can even try to load a web page. My curiosity got the better of me, and I set out to investigate how Macs are able to connect to the network so quickly, and how the network connect time in other operating systems could be improved.</li>
</ul>

<blockquote>
<p>I figure there are three main categories of time-consuming activities that occur during network initialization:<br>
Link establishment. This is the activity of establishing communication with the network&#39;s link layer. In the case of Wi-Fi, the radio must be powered on, the access point detected, and the optional encryption layer (e.g. WPA) established. After link establishment, the device is able to send and receive Ethernet frames on the network.<br>
Dynamic Host Configuration Protocol (DHCP). Through DHCP handshaking, the device negotiates an IP address for its use on the local IP network. A DHCP server is responsible for managing the IP addresses available for use on the network.<br>
Miscellaneous overhead. The operating system may perform any number of mundane tasks during the process of network initialization, including running scripts, looking up preconfigured network settings in a local database, launching programs, etc.<br>
 My investigation thus far is primarily concerned with the DHCP phase, although the other two categories would be interesting to study in the future. I set up a packet capture environment with a spare wireless access point, and observed the network activity of a number of devices as they initialized their network connection. For a worst-case scenario, let&#39;s look at the network activity captured while an Android tablet is connecting:<br>
 This tablet, presumably in the interest of &quot;optimization&quot;, is initially skipping the DHCP discovery phase and immediately requesting its previous IP address. The only problem is this is a different network, so the DHCP server ignores these requests. After about 4.5 seconds, the tablet stubbornly tries again to request its old IP address. After another 4.5 seconds, it resigns itself to starting from scratch, and performs the DHCP discovery needed to obtain an IP address on the new network.<br>
 In all fairness, this delay wouldn&#39;t be so bad if the device was connecting to the same network as it was previously using. However, notice that the tablet waits a full 1.13 seconds after link establishment to even think about starting the DHCP process. Engineering snappiness usually means finding lots of small opportunities to save a few milliseconds here and there, and someone definitely dropped the ball here.<br>
 In contrast, let&#39;s look at the packet dump from the machine with the lightning-fast network initialization, and see if we can uncover the magic that is happening under the hood:<br>
 The key to understanding the magic is the first three unicast ARP requests. It looks like Mac OS remembers certain information about not only the last connected network, but the last several networks. In particular, it must at least persist the following tuple for each of these networks:<br>
    &gt; 1. The Ethernet address of the DHCP server<br>
    &gt; 2. The IP address of the DHCP server<br>
    &gt; 3. Its own IP address, as assigned by the DHCP server<br>
 During network initialization, the Mac transmits carefully crafted unicast ARP requests with this stored information. For each network in its memory, it attempts to send a request to the specific Ethernet address of the DHCP server for that network, in which it asks about the server&#39;s IP address, and requests that the server reply to the IP address which the Mac was formerly using on that network. Unless network hosts have been radically shuffled around, at most only one of these ARP requests will result in a response—the request corresponding to the current network, if the current network happens to be one of the remembered networks.<br>
 This network recognition technique allows the Mac to very rapidly discover if it is connected to a known network. If the network is recognized (and presumably if the Mac knows that the DHCP lease is still active), it immediately and presumptuously configures its IP interface with the address it knows is good for this network. (Well, it does perform a self-ARP for good measure, but doesn&#39;t seem to wait more than 13ms for a response.) The DHCP handshaking process begins in the background by sending a DHCP request for its assumed IP address, but the network interface is available for use during the handshaking process. If the network was not recognized, I assume the Mac would know to begin the DHCP discovery phase, instead of sending blind requests for a former IP address as the Galaxy Tab does.<br>
 The Mac&#39;s rapid network initialization can be credited to more than just the network recognition scheme. Judging by the use of ARP (which can be problematic to deal with in user-space) and the unusually regular transmission intervals (a reliable 1.0ms delay between each packet sent), I&#39;m guessing that the Mac&#39;s DHCP client system is entirely implemented as tight kernel-mode code. The Mac began the IP interface initialization process a mere 10ms after link establishment, which is far faster than any other device I tested. Android devices such as the Galaxy Tab rely on the user-mode dhclient system (part of the dhcpcd package) dhcpcd program, which no doubt brings a lot of additional overhead such as loading the program, context switching, and perhaps even running scripts.<br>
 The next step for some daring kernel hacker is to implement a similarly aggressive DHCP client system in the Linux kernel, so that I can enjoy fast sign-on speeds on my Android tablet, Android phone, and Ubuntu netbook. There already exists a minimal DHCP client implementation in the Linux kernel, but it lacks certain features such as configuring the DNS nameservers. Perhaps it wouldn&#39;t be too much work to extend this code to support network recognition and interface with a user-mode daemon to handle such auxillary configuration information received via DHCP. If I ever get a few spare cycles, maybe I&#39;ll even take a stab at it.</p>
</blockquote>

<ul>
<li>You can also find other ways of optimizing the dhclient program and how it works in the <a href="https://calomel.org/dhclient.html" rel="nofollow">dhclient tutorial on Calomel.org</a>.
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/blog/bsdcam-2017-trip-report-michael-lucas/" rel="nofollow">BSDCam Trip Report</a></h3>

<blockquote>
<p>Over the decades, FreeBSD development and coordination has shifted from being purely on-line to involving more and more in-person coordination and cooperation. The FreeBSD Foundation sponsors a devsummit right before BSDCan, EuroBSDCon, and AsiaBSDCon, so that developers traveling to the con can leverage their airfare and hammer out some problems. Yes, the Internet is great for coordination, but nothing beats a group of developers spending ten minutes together to sketch on a whiteboard and figuring out exactly how to make something bulletproof.<br>
In addition to the coordination efforts, though, conference devsummits are hierarchical. There’s a rigid schedule, with topics decided in advance. Someone leads the session. Sessions can be highly informative, passionate arguments, or anything in between.<br>
BSDCam is… a little different. It’s an invaluable part of the FreeBSD ecosystem. However, it’s something that I wouldn’t normally attend.<br>
But right now, is not normal. I’m writing a new edition of Absolute FreeBSD. To my astonishment, people have come to rely on this book when planning their deployments and operations. While I find this satisfying, it also increases the pressure on me to get things correct. When I wrote my first FreeBSD book back in 2000, a dozen mailing lists provided authoritative information on FreeBSD development. One person could read every one of those lists. Today, that’s not possible—and the mailing lists are only one narrow aspect of the FreeBSD social system.<br>
Don’t get me wrong—it’s pretty easy to find out what people are doing and how the system works. But it’s not that easy to find out what people will be doing and how the system will work. If this book is going to be future-proof, I needed to leave my cozy nest and venture into the wilds of Cambridge, England. Sadly, the BSDCam chair agreed with my logic, so I boarded an aluminum deathtrap—sorry, a “commercial airliner”—and found myself hurtled from Detroit to Heathrow.<br>
And one Wednesday morning, I made it to the William Gates building of Cambridge University, consciousness nailed to my body by a thankfully infinite stream of proper British tea.<br>
BSDCam attendance is invitation only, and the facilities can only handle fifty folks or so. You need to be actively working on FreeBSD to wrangle an invite. Developers attend from all over the world. Yet, there’s no agenda. Robert Watson is the chair, but he doesn’t decide on the conference topics. He goes around the room and asks everyone to introduce themselves, say what they’re working on, and declare what they want to discuss during the conference. The topics of interest are tallied. The most popular topics get assigned time slots and one of the two big rooms. Folks interested in less popular topics are invited to claim one of the small breakout rooms.<br>
Then the real fun begins. I started by eavesdropping in the virtualization workshop. For two hours, people discussed FreeBSD’s virtualization needs, strengths, and weaknesses. What needs help? What should this interface look like? What compatibility is important, and what isn’t? By the end of the session, the couple dozen people had developed a reasonable consensus and, most importantly, some folks had added items to their to-do lists.<br>
Repeat for a dozen more topics. I got a good grip on what’s really happening with security mitigation techniques, FreeBSD’s cloud support, TCP/IP improvements, advances in teaching FreeBSD, and more. A BSDCan devsummit presentation on packaging the base system is informative, but eavesdropping on two dozen highly educated engineers arguing about how to nail down the final tidbits needed to make that a real thing is far more educational.<br>
To my surprise, I was able to provide useful feedback for some sessions. I speak at a lot of events outside of the FreeBSD world, and was able to share much of what I hear at Linux conferences. A tool that works well for an experienced developer doesn’t necessarily work well for everyone.<br>
Every year, I leave BSDCan tired. I left BSDCam entirely exhausted. These intense, focused discussions stretched my brain.<br>
But, I have a really good idea where key parts of FreeBSD development are actually headed. This should help future-proof the new Absolute FreeBSD, as much as any computer book can be future-proof.<br>
Plus, BSDCam throws the most glorious conference dinner I’ve ever seen.<br>
I want to thank Robert Watson for his kind invitation, and the FreeBSD Foundation for helping defray the cost of this trip</p>

<hr>
</blockquote>

<h2>Interview - The BSDNow Crew</h2>

<ul>
<li>As a kid, what did you dream of to become as an adult?</li>
</ul>

<blockquote>
<p>JT: An Astronaut<br>
BR: I wanted to be a private detective, because of all the crime novels that I read back<br>
then. I didn’t get far with it. However, I think the structured analysis skills (who did what, when, and such) help me in debugging and sysadmin work.<br>
AJ: Didn’t think about it much</p>
</blockquote>

<ul>
<li>How do you manage to stay organized day to day with so much things you&#39;re actively doing each day? (Day job, wife/girlfriend, conferences, hobbies, friends, etc.)</li>
</ul>

<blockquote>
<p>JT: Who said I was organized?<br>
BR: A lot of stuff in my calendar as reminders, open browser tabs as “to read later” list. A few things like task switching when getting stuck helps. Also, focus on a single goal for the day, even though there will be distractions. Slowly, but steadily chip away at the things you’re working on. Rather than to procrastinate and put things back to review later, get started early with easy things for a big task and then tackle the hard part. Often, things look totally chaotic and unmanageable, until you start working on them. <br>
AJ: I barely manage. Lots of Google Calendar reminders, and the entire wall of my office is covered in whiteboard sheet todo lists. I use pinboard.in to deal with finding and organizing bookmarks. Write things down, don’t trust your memory.</p>
</blockquote>

<ul>
<li>What hobbies outside of IT do you have?</li>
</ul>

<blockquote>
<p>JT: I love photography, but I do that Professional part time, so I’m not sure if that counts as a hobby anymore.  I guess it’d have to be working in the garage on my cars.<br>
BR: I do Tai Chi to relax once a week in a group, but can also do it alone, pretty much everywhere. Way too much Youtube watching and browsing the web. I did play some games before studying at the university and I’m still proud that I could control it to the bare minimum not to impact my studies. A few “lapses” from time to time, revisiting the old classics since the newer stuff won’t run on my machines anyway. Holiday time is pretty much spent for BSD conferences and events, this is where I can relax and talk with like-minded people from around the world, which is fascinating. Plus, it gets me to various places and countries I never would have dared to visit on my own.<br>
AJ: I play a few video games, and I like to ski, although I don’t go very often as most of my vacation time is spent hanging out with my BSD friends at various conferences</p>
</blockquote>

<ul>
<li>How do you relax?</li>
</ul>

<blockquote>
<p>JT: What is this word ‘relax’ and what does it mean?<br>
BR: My Tai Chi plays a big part in it I guess. I really calms you and the constant stream of thoughts for a while. It also gives you better clarity of what’s important in life. Watching movies, sleeping long.<br>
AJ: Usually watching TV or Movies. Although I have taken to doing most of my TV watching on my exercise bike now, but it is still mentally relaxing</p>
</blockquote>

<ul>
<li>If FreeBSD didn&#39;t exist,  which BSD flavour would you use? Why?</li>
</ul>

<blockquote>
<p>JT: I use TrueOS, but if FreeBSD didn’t exist, that project might not either… so…  My other choice would be HardenedBSD, but since it’s also based on FreeBSD I’m in the same dillema.<br><br>
BR: I once installed NetBSD to see what It can do. If FreeBSD wouldn’t exist, I would probably try my luck with it. OpenBSD is also appealing, but I’ve never installed it.<br>
AJ: When I started using FreeBSD in 2000, the only other BSD I had heard of at the time was OpenBSD. If FreeBSD wasn’t around, I don’t think the world would look like it does, so it is hard to speculate.</p>
</blockquote>

<ul>
<li>If any of the BSD&#39;s weren&#39;t around and you had to use Linux, which camp would belong to? (Redhat, SUSE, Debian, Ubuntu, Gentoo?)</li>
</ul>

<blockquote>
<p>JT: I learned Linux in the mid 90s using Slackware, which I used consistently up until the mid 2000s, when I joined the PuppyLinux community and eventually became a developer (FYI, Puppy was/is/can be based on Slackware -- its complicated).  So I’d go back to using either Slackware or PuppyLinux.<br>
BR: I tried various Linux distributions until I landed at Debian. I used is pretty extensively as my desktop OS at home, building custom kernels and packages to install them until I discovered FreeBSD. I ran both side by side for a few months for learning until one day I figured out that I had not booted Debian in a while, so I switched completely. <br>
AJ: The first Linux I played with was Slackware, and it is the most BSD like, but the bits of Linux I learned in school were Redhat and so I can somewhat wrap my head around it, although now that they are changing everything to systemd, all of that old knowledge is more harmful than useful.</p>
</blockquote>

<ul>
<li>Are you still finding yourself in need to use Windows/Mac OS? Why?</li>
</ul>

<blockquote>
<p>JT: I work part time as a professional Photographer, so I do use Windows for my photography work.  While I can do everything I need to do in Linux, it comes down to being pragmatic about my time.  What takes me several hours to accomplish in Linux I can accomplish in 20 minutes on Windows.<br>
BR: I was a long time Windows-only user before my Unix days. But back when Vista was about to come out and I needed a new laptop, my choice was basically learning to cope with Vistas awful features or learn MacOS X. I did the latter, it increased my productivity since it’s really a good Unix desktop experience (at least, back then). I only have to use Windows at work from time to time as I manage our Windows Terminal server, which keeps the exposure low enough and I only connect to it to use a certain app not available for the Mac or the BSDs.<br>
AJ: I still use Windows to play games, for a lot of video conferencing, and to produce BSD Now. Some of it could be done on BSD but not as easily. I have promised myself that I will switch to 100% BSD rather than upgrade to Windows 10, so we’ll see how that goes.</p>
</blockquote>

<ul>
<li>Please describe your home networking setup.  Router type, router OS, router hardware, network segmentation, wifi apparatus(es), other devices connected, and anything else that might be interesting about your home network.</li>
</ul>

<blockquote>
<p>BR: Very simple and boring: Apple Airport Express base station and an AVM FritzBox  for DNS, DHCP, and the link to my provider. A long network cable to my desktop machine. That I use less and less often. I just bought an RPI 3 for some home use in the future to replace it. Mostly my brother’s and my Macbook Pro’s are connected, our phones and the iPad of my mother.  </p>

<p>AJ: I have a E3-1220 v3 (dual 3.1ghz + HT) with 8 GB of ram, and 4x Intel gigabit server NICs as my router, and it runs vanilla FreeBSD (usually some snapshot of -current). I have 4 different VLANs, Home, Office, DMZ, and Guest WiFi. WiFi is served via a tiny USB powered device I bought in Tokyo years ago, it serves 3 different SSIDs, one for each VLAN except the DMZ. There are ethernet jacks in every room wired for 10 gigabit, although the only machines with 10 gigabit are my main workstation, file server, and some machines in the server rack. There are 3 switches, one for the house (in the laundry room), one for the rack, and one for 10gig stuff. There is a rack in the basement spare bedroom, it has 7 servers in it, mostly storage for live replicas of customer data for my company.</p>
</blockquote>

<ul>
<li>How do guys manage to get your work done on FreeBSD desktops? What do you do when you need to a Linux or Windows app that isn&#39;t ported, or working? I&#39;ve made several attempts to switch to FreeBSD, but each attempt failed because of tools not being available (e.g. Zoom, Dropbox, TeamViewer, Crashplan) or broken (e.g. VirtualBox).</li>
</ul>

<blockquote>
<p>BR: I use VIrtualBox for everything that is not natively available or Windows-only. Unfortunately, that means no modern games. I mostly do work in the shell when I’m on FreeBSD and when it has to be a graphical application, then I use Fluxbox as the DE. I want to get work done, not look at fancy eye-candy that get’s boring after a while. Deactivated the same stuff on my mac due to the same reason. I look for alternative software online, but my needs are relatively easy to satisfy as I’m not doing video editing/rendering and such.</p>

<p>AJ: I generally find that I don’t need these apps. I use Firefox, Thunderbird, OpenSSH, Quassel, KomodoEdit, and a few other apps, so my needs are not very demanding. It is annoying when packages are broken, but I usually work around this with boot environments, and being able to just roll back to a version that worked for a few days until the problem is solved. I do still have access to a windows machine for the odd time I need specific VPN software or access to Dell/HP etc out-of-band management tools.</p>
</blockquote>

<ul>
<li>Which desktop environments are your favorite, and why? For example, I like i3, Xfce, and I&#39;m drawn to Lumina&#39;s ethos, but so far always seem to end up back on Xfc because of its ease of use, flexibility, and dashing good looks.</li>
</ul>

<blockquote>
<p>JT: As a Lumina Desktop developer, I think my preference is obvious. ;)  I am also a long <br>
timeOpenBox user, so I have a soft place in my heart for that as well.  </p>

<p>BR: I use Fluxbox when I need to work with a lot of windows or an application demands X11. KDE and others are too memory heavy for me and I rarely use even 20% of the features they provide.<br>
AJ: I was a long time KDE user, but I have adopted Lumina. I find it fast, and that it gets out of my way and lets me do what I want. It had some annoyances early on, but I’ve nagged the developers into making it work for me.</p>
</blockquote>

<ul>
<li>Which command-line shells do you prefer, why, and how (if at all) have you customised the environment or prompt?</li>
</ul>

<blockquote>
<p>BR: I use zsh, but without all the fancy stuff you can find online. It might make you more productive, yes. But again, I try to keep things simple. I’m slowly learning tmux and want to work more in it in the future. I sometimes look at other BSD people’s laptops and am amazed at what they do with window-management in tmux. My prompt looks like this:</p>

<pre><code>bcr@Voyager:~&gt;                             20:20 17-08-17
Put this in your .zshrc to get the same result:
PROMPT=&#39;%n@%m:%~&gt;&#39;
RPROMPT=&#39;%T %D&#39;
</code></pre>

<p>AJ: I started using tcsh early on, because it was the shell on the first box I had access to, and because one of the first things I read in “BSD Hacks” was how to enable ‘typo correction”, which made my life a lot better especially on dial up in the early days. My shell prompt looks like this: allan@CA-TOR1-02:/usr/home/allan%</p>
</blockquote>

<ul>
<li>What is one thing (or more) missing in FreeBSD you would import from another project or community? Could be tech, process, etc.</li>
</ul>

<blockquote>
<p>JT: AUFS from Linux</p>

<p>BR: Nohup from Illumos where you can detach an already running process and put it in the background. I often forget that and I’m not in tmux when that happens, so I can see myself use that feature a lot.</p>

<p>AJ: Zones (more complete Jails) from IllumOS</p>
</blockquote>

<ul>
<li>how do you manage your time to learn about and work on FreeBSD?  Does your  work/employment enable what you do, or are your contributions mainly done in private time?</li>
</ul>

<blockquote>
<p>JT: These days I’m mostly learning things I need for work, so it just falls into something I’m doing while working on work projects.</p>

<p>BR: We have a lot of time during the semester holidays to learn on our own, it’s part of the idea of being in a university to keep yourself updated, at least for me. Especially in the fast moving world of IT. I also read a lot in my free time. My interests can shift sometimes, but then I devour everything I can find on the topic. Can be a bit excessive, but has gotten me where I am now and I still need a lot to learn (and want to). Since I work with FreeBSD at work (my owndoing), I can try out many things there.</p>

<p>AJ: My work means a spend a lot of time working with FreeBSD, but not that much time working ON it. My contributions are mostly done outside of work, but as I own the company I do get more flexibility to take time off for conferences and other FreeBSD related stuff.</p>
</blockquote>

<ul>
<li>we know we can bribe Michael W Lucas with gelato (<em>good</em> gelato that is), but what can we use to bribe <em>you</em> guys? Like when I want to have Allan to work on fixing a bug which prevents me from running ZFS on this fancy rock64 board?</li>
</ul>

<blockquote>
<p>BR: Desserts of various kinds. </p>

<p>AJ: I am probably not the right person to look at your rock64 board. Most people in the project have taken to bribing me with chocolate. In general, my todo list is so long, the best way is a trade, you take this task and I’ll take that task.</p>
</blockquote>

<ul>
<li>Is your daily mobile device iOS, Android, Windows Mobile, or other? Why?</li>
</ul>

<blockquote>
<p>JT: These days I’m using Android on my Blackberry Priv, but until recently I was still a heavy user of Sailfish OS.  I would use SailfishOS everyday, if I could find a phone with a keyboard that I could run it on.</p>

<p>BR: iOS on the iPhone 7 currently. Never used an Android phone, saw it on other people’s devices and what they can do with it (much more). But the infrequent security updates (if any at all) keep me away from it.</p>

<p>AJ: I have a Google Nexus 6 (Android 7.1). I wanted the ‘pure’ Android experience, and I had been happy with my previous Nexus S. I don’t run a custom OS/ROM or anything because I use the phone to verify that video streams work on an ‘average users device’. I am displeased that support for my device will end soon. I am not sure what device I will get next, but it definitely won’t be an iPhone.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170808065718&mode=flat&count=30" rel="nofollow">Beta Update - Request for (more) Testing</a></h3>

<ul>
<li> <a href="https://beta.undeadly.org/" rel="nofollow">https://beta.undeadly.org/</a> has received an update. The most significant changes include:</li>
</ul>

<blockquote>
<p>The site has been given a less antiquated &quot;look&quot;. (As the topic icons have been eliminated, we are no longer seeking help with those graphics.)<br>
The site now uses a moderate amount of semantic HTML5.<br>
Several bugs in the HTML fragment validator (used for submissions and comments) have been fixed.<br>
To avoid generating invalid HTML, submission content which fails validation is no longer displayed in submission/comment previews.<br>
Plain text submissions are converted to HTML in a more useful fashion. (Instead of just converting each EOL to <br>, the converter now generates proper paragraphs and interprets two or more consecutive EOLs as indicating a paragraph break.)</p>
</blockquote>

<ul>
<li> The redevelopment remains a work-in-progress. Many thanks to those who have contributed!</li>
</ul>

<blockquote>
<p>As before, constructive feedback would be appreciated. Of particular interest are reports of bugs in behaviour (for example, in the HTML validator or in authentication) that would preclude the adoption of the current code for the main site.</p>

<hr>
</blockquote>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2017-August/313552.html" rel="nofollow">High-process-count support added to master</a></h3>

<blockquote>
<p>We&#39;ve fixed a number of bottlenecks that can develop when the number of user processes runs into the tens of thousands or higher.  One thing led to another and I said to myself, &quot;gee, we have a 6-digit PID, might as well make it work to a million!&quot;.  With the commits made today, master can support at least 900,000 processes with just a kern.maxproc setting in<br>
/boot/loader.conf, assuming the machine has the memory to handle it.<br>
 And, in fact, as today&#39;s machines start to ratchet up there in both memory capacity and core count, with fast storage (NVMe) and fast networking (10GigE and higher), even in consumer boxes, this is actually something that one might want to do.  With AMD&#39;s threadripper and EPYC chips now out, the Intel&lt;-&gt;AMD cpu wars are back on!   Boasting up to 32 cores (64 threads) per socket and two sockets on EPYC, terabytes of ram, and motherboards with dual 10GigE built-in, the reality is that these numbers are already achievable in a useful manner.<br>
 In anycase, I&#39;ve tested these changes on a dual-socket xeon.  I can in-fact start 900,000 processes.  They don&#39;t get a whole lot of cpu and running &#39;ps&#39; would be painful, but it works and the system is still responsive from the shell with all of that going on.<br>
 xeon126# uptime<br>
 1:42PM  up 9 mins, 3 users, load averages: 890407.00, 549381.40, 254199.55<br>
 In fact, judging from the memory use, these minimal test processes only eat around 60KB each.  900,000 of them ate only 55GB on a 128GB machine.  So even a million processes is not out of the question, depending on the cpu requirements for those processes.  Today&#39;s modern machines can be stuffed with enormous amounts of memory.<br>
 Of course, our PIDs are currently limited to 6 digits, so a million is kinda the upper limit in terms of discrete user processes (verses pthreads which are less restricted).  I&#39;d rather not go to 7 digits (yet).</p>

<hr>
</blockquote>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2017-August/066783.html" rel="nofollow">CFT: Driver for generic MS Windows 7/8/10 - compatible USB HID multi-touch touchscreens</a></h3>

<ul>
<li>Following patch [1] adds support for generic MS Windows 7/8/10 - compatible USB HID multi-touch touchscreens via evdev protocol. It is intended to be a native replacement of hid-multitouch.c driver found in Linux distributions and multimedia/webcamd port.</li>
<li>Patch is made for 12-CURRENT and most probably can be applied to recent 11-STABLE and 11.1-RELEASE (not tested)</li>
<li>How to test&quot;</li>
</ul>

<pre><code>1. Apply patch [1]
2. To compile this driver into the kernel, place the following lines 
into your kernel configuration file:
       device wmt
       device usb
       device evdev
    Alternatively, to load the driver as a module at boot time, place the 
following line in loader.conf(5):
       wmt_load=&quot;YES&quot;
3. Install x11-drivers/xf86-input-evdev or 
x11-drivers/xf86-input-libinput port
4. Tell XOrg to use evdev or libinput driver for the device:
</code></pre>

<pre><code>Section &quot;ServerLayout&quot;
     InputDevice    &quot;TouchScreen0&quot; &quot;SendCoreEvents&quot;
EndSection


Section &quot;InputDevice&quot;
     Identifier  &quot;TouchScreen0&quot;
     Driver      &quot;evdev&quot;
&amp;#35;   Driver      &quot;libinput&quot;
     Option      &quot;Device&quot; &quot;/dev/input/eventXXX&quot;
EndSection
</code></pre>

<ul>
<li>Exact value of &quot;/dev/input/eventXXX&quot; can be obtained with evemu-record utility from devel/evemu.</li>
<li>Note1: Currently, driver does not support pens or touchpads.</li>
<li>Note2: wmt.ko should be kld-loaded before uhid driver to take precedence over it! Otherwise uhid can be kld-unloaded after loading of wmt.</li>
<li>wmt review: <a href="https://reviews.freebsd.org/D12017" rel="nofollow">https://reviews.freebsd.org/D12017</a></li>
<li>Raw diff: <a href="https://reviews.freebsd.org/D12017.diff" rel="nofollow">https://reviews.freebsd.org/D12017.diff</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://bsdmag.org/programm_history/" rel="nofollow">BSDMag Programing Languages Infographic</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170815171854" rel="nofollow">t2k17 Hackathon Report: Bob Beck on buffer cache tweaks, libressl and pledge progress</a></li>
<li><a href="https://www.freebsdfoundation.org/past-issues/resource-control/" rel="nofollow">New FreeBSD Journal</a></li>
<li><a href="http://mail-index.netbsd.org/netbsd-advocacy/2017/08/10/msg000744.html" rel="nofollow">NetBSD machines at Open Source Conference 2017 Kyoto</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/3H6TDJV" rel="nofollow">Dan - HDD question</a></li>
<li><a href="http://dpaste.com/10F086V" rel="nofollow">Benjamin - scrub of death</a></li>
<li><a href="http://dpaste.com/2D9102K" rel="nofollow">Jason - Router Opinion</a> </li>
<li><a href="http://dpaste.com/1XYYTWF" rel="nofollow">Sohrab - Thanks</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this episode, we take a look at the reimplementation of NetBSD using a Microkernel, check out what makes DHCP faster, and see what high-process count support for DragonflyBSD has to offer, and we answer the questions you’ve always wanted to ask us.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://theembeddedboard.review/a-reimplementation-of-netbsd-using-a-microkernel-part-1-of-2/" rel="nofollow">A Reimplementation Of Netbsd Using a Microkernel</a></h3>

<ul>
<li>Minix author Andy Tanenbaum writes in <a href="http://theembeddedboard.review/a-reimplementation-of-netbsd-using-a-microkernel-part-1-of-2/" rel="nofollow">Part 1 of a-reimplementation-of-netbsd-using-a-microkernel</a></li>
</ul>

<blockquote>
<p>Based on the MINIX 3 microkernel, we have constructed a system that to the user looks a great deal like NetBSD. It uses pkgsrc, NetBSD headers and libraries, and passes over 80% of the KYUA tests). However, inside, the system is completely different. At the bottom is a small (about 13,000 lines of code) microkernel that handles interrupts, message passing, low-level scheduling, and hardware related details. Nearly all of the actual operating system, including memory management, the file system(s), paging, and all the device drivers run as user-mode processes protected by the MMU. As a consequence, failures or security issues in one component cannot spread to other ones. In some cases a failed component can be replaced automatically and on the fly, while the system is running, and without user processes noticing it. The talk will discuss the history, goals, technology, and status of the project.<br>
 Research at the Vrije Universiteit has resulted in a reimplementation of NetBSD using a microkernel instead of the traditional monolithic kernel. To the user, the system looks a great deal like NetBSD (it passes over 80% of the KYUA tests). However, inside, the system is completely different. At the bottom is a small (about 13,000 lines of code) microkernel that handles interrupts, message passing, low-level scheduling, and hardware related details. Nearly all of the actual operating system, including memory management, the file system(s), paging, and all the device drivers run as user-mode processes protected by the MMU. As a consequence, failures or security issues in one component cannot spread to other ones. In some cases a failed component can be replaced automatically and on the fly, while the system is running.<br>
 The latest work has been adding live update, making it possible to upgrade to a new version of the operating system WITHOUT a reboot and without running processes even noticing. No other operating system can do this.<br>
 The system is built on MINIX 3, a derivative of the original MINIX system, which was intended for education. However, after the original author, Andrew Tanenbaum, received a 2 million euro grant from the Royal Netherlands Academy of Arts and Sciences and a 2.5 million euro grant from the European Research Council, the focus changed to building a highly reliable, secure, fault tolerant operating system, with an emphasis on embedded systems. The code is open source and can be downloaded from <a href="http://www.minix3.org" rel="nofollow">www.minix3.org</a>. It runs on the x86 and ARM Cortex V8 (e.g., BeagleBones). Since 2007, the Website has been visited over 3 million times and the bootable image file has been downloaded over 600,000 times. The talk will discuss the history, goals, technology, and status of the project.</p>
</blockquote>

<ul>
<li><a href="http://theembeddedboard.review/a-reimplementation-of-netbsd-using-a-microkernel-part-2-of-2/" rel="nofollow">Part 2</a> is also available.
***</li>
</ul>

<h3><a href="https://cafbit.com/post/rapid_dhcp_or_how_do/" rel="nofollow">Rapid DHCP: Or, how do Macs get on the network so fast?</a></h3>

<ul>
<li>One of life&#39;s minor annoyances is having to wait on my devices to connect to the network after I wake them from sleep. All too often, I&#39;ll open the lid on my EeePC netbook, enter a web address, and get the dreaded &quot;This webpage is not available&quot; message because the machine is still working on connecting to my Wi-Fi network. On some occasions, I have to twiddle my thumbs for as long as 10-15 seconds before the network is ready to be used. The frustrating thing is that I know it doesn&#39;t have to be this way. I know this because I have a Mac. When I open the lid of my MacBook Pro, it connects to the network nearly instantaneously. In fact, no matter how fast I am, the network comes up before I can even try to load a web page. My curiosity got the better of me, and I set out to investigate how Macs are able to connect to the network so quickly, and how the network connect time in other operating systems could be improved.</li>
</ul>

<blockquote>
<p>I figure there are three main categories of time-consuming activities that occur during network initialization:<br>
Link establishment. This is the activity of establishing communication with the network&#39;s link layer. In the case of Wi-Fi, the radio must be powered on, the access point detected, and the optional encryption layer (e.g. WPA) established. After link establishment, the device is able to send and receive Ethernet frames on the network.<br>
Dynamic Host Configuration Protocol (DHCP). Through DHCP handshaking, the device negotiates an IP address for its use on the local IP network. A DHCP server is responsible for managing the IP addresses available for use on the network.<br>
Miscellaneous overhead. The operating system may perform any number of mundane tasks during the process of network initialization, including running scripts, looking up preconfigured network settings in a local database, launching programs, etc.<br>
 My investigation thus far is primarily concerned with the DHCP phase, although the other two categories would be interesting to study in the future. I set up a packet capture environment with a spare wireless access point, and observed the network activity of a number of devices as they initialized their network connection. For a worst-case scenario, let&#39;s look at the network activity captured while an Android tablet is connecting:<br>
 This tablet, presumably in the interest of &quot;optimization&quot;, is initially skipping the DHCP discovery phase and immediately requesting its previous IP address. The only problem is this is a different network, so the DHCP server ignores these requests. After about 4.5 seconds, the tablet stubbornly tries again to request its old IP address. After another 4.5 seconds, it resigns itself to starting from scratch, and performs the DHCP discovery needed to obtain an IP address on the new network.<br>
 In all fairness, this delay wouldn&#39;t be so bad if the device was connecting to the same network as it was previously using. However, notice that the tablet waits a full 1.13 seconds after link establishment to even think about starting the DHCP process. Engineering snappiness usually means finding lots of small opportunities to save a few milliseconds here and there, and someone definitely dropped the ball here.<br>
 In contrast, let&#39;s look at the packet dump from the machine with the lightning-fast network initialization, and see if we can uncover the magic that is happening under the hood:<br>
 The key to understanding the magic is the first three unicast ARP requests. It looks like Mac OS remembers certain information about not only the last connected network, but the last several networks. In particular, it must at least persist the following tuple for each of these networks:<br>
    &gt; 1. The Ethernet address of the DHCP server<br>
    &gt; 2. The IP address of the DHCP server<br>
    &gt; 3. Its own IP address, as assigned by the DHCP server<br>
 During network initialization, the Mac transmits carefully crafted unicast ARP requests with this stored information. For each network in its memory, it attempts to send a request to the specific Ethernet address of the DHCP server for that network, in which it asks about the server&#39;s IP address, and requests that the server reply to the IP address which the Mac was formerly using on that network. Unless network hosts have been radically shuffled around, at most only one of these ARP requests will result in a response—the request corresponding to the current network, if the current network happens to be one of the remembered networks.<br>
 This network recognition technique allows the Mac to very rapidly discover if it is connected to a known network. If the network is recognized (and presumably if the Mac knows that the DHCP lease is still active), it immediately and presumptuously configures its IP interface with the address it knows is good for this network. (Well, it does perform a self-ARP for good measure, but doesn&#39;t seem to wait more than 13ms for a response.) The DHCP handshaking process begins in the background by sending a DHCP request for its assumed IP address, but the network interface is available for use during the handshaking process. If the network was not recognized, I assume the Mac would know to begin the DHCP discovery phase, instead of sending blind requests for a former IP address as the Galaxy Tab does.<br>
 The Mac&#39;s rapid network initialization can be credited to more than just the network recognition scheme. Judging by the use of ARP (which can be problematic to deal with in user-space) and the unusually regular transmission intervals (a reliable 1.0ms delay between each packet sent), I&#39;m guessing that the Mac&#39;s DHCP client system is entirely implemented as tight kernel-mode code. The Mac began the IP interface initialization process a mere 10ms after link establishment, which is far faster than any other device I tested. Android devices such as the Galaxy Tab rely on the user-mode dhclient system (part of the dhcpcd package) dhcpcd program, which no doubt brings a lot of additional overhead such as loading the program, context switching, and perhaps even running scripts.<br>
 The next step for some daring kernel hacker is to implement a similarly aggressive DHCP client system in the Linux kernel, so that I can enjoy fast sign-on speeds on my Android tablet, Android phone, and Ubuntu netbook. There already exists a minimal DHCP client implementation in the Linux kernel, but it lacks certain features such as configuring the DNS nameservers. Perhaps it wouldn&#39;t be too much work to extend this code to support network recognition and interface with a user-mode daemon to handle such auxillary configuration information received via DHCP. If I ever get a few spare cycles, maybe I&#39;ll even take a stab at it.</p>
</blockquote>

<ul>
<li>You can also find other ways of optimizing the dhclient program and how it works in the <a href="https://calomel.org/dhclient.html" rel="nofollow">dhclient tutorial on Calomel.org</a>.
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/blog/bsdcam-2017-trip-report-michael-lucas/" rel="nofollow">BSDCam Trip Report</a></h3>

<blockquote>
<p>Over the decades, FreeBSD development and coordination has shifted from being purely on-line to involving more and more in-person coordination and cooperation. The FreeBSD Foundation sponsors a devsummit right before BSDCan, EuroBSDCon, and AsiaBSDCon, so that developers traveling to the con can leverage their airfare and hammer out some problems. Yes, the Internet is great for coordination, but nothing beats a group of developers spending ten minutes together to sketch on a whiteboard and figuring out exactly how to make something bulletproof.<br>
In addition to the coordination efforts, though, conference devsummits are hierarchical. There’s a rigid schedule, with topics decided in advance. Someone leads the session. Sessions can be highly informative, passionate arguments, or anything in between.<br>
BSDCam is… a little different. It’s an invaluable part of the FreeBSD ecosystem. However, it’s something that I wouldn’t normally attend.<br>
But right now, is not normal. I’m writing a new edition of Absolute FreeBSD. To my astonishment, people have come to rely on this book when planning their deployments and operations. While I find this satisfying, it also increases the pressure on me to get things correct. When I wrote my first FreeBSD book back in 2000, a dozen mailing lists provided authoritative information on FreeBSD development. One person could read every one of those lists. Today, that’s not possible—and the mailing lists are only one narrow aspect of the FreeBSD social system.<br>
Don’t get me wrong—it’s pretty easy to find out what people are doing and how the system works. But it’s not that easy to find out what people will be doing and how the system will work. If this book is going to be future-proof, I needed to leave my cozy nest and venture into the wilds of Cambridge, England. Sadly, the BSDCam chair agreed with my logic, so I boarded an aluminum deathtrap—sorry, a “commercial airliner”—and found myself hurtled from Detroit to Heathrow.<br>
And one Wednesday morning, I made it to the William Gates building of Cambridge University, consciousness nailed to my body by a thankfully infinite stream of proper British tea.<br>
BSDCam attendance is invitation only, and the facilities can only handle fifty folks or so. You need to be actively working on FreeBSD to wrangle an invite. Developers attend from all over the world. Yet, there’s no agenda. Robert Watson is the chair, but he doesn’t decide on the conference topics. He goes around the room and asks everyone to introduce themselves, say what they’re working on, and declare what they want to discuss during the conference. The topics of interest are tallied. The most popular topics get assigned time slots and one of the two big rooms. Folks interested in less popular topics are invited to claim one of the small breakout rooms.<br>
Then the real fun begins. I started by eavesdropping in the virtualization workshop. For two hours, people discussed FreeBSD’s virtualization needs, strengths, and weaknesses. What needs help? What should this interface look like? What compatibility is important, and what isn’t? By the end of the session, the couple dozen people had developed a reasonable consensus and, most importantly, some folks had added items to their to-do lists.<br>
Repeat for a dozen more topics. I got a good grip on what’s really happening with security mitigation techniques, FreeBSD’s cloud support, TCP/IP improvements, advances in teaching FreeBSD, and more. A BSDCan devsummit presentation on packaging the base system is informative, but eavesdropping on two dozen highly educated engineers arguing about how to nail down the final tidbits needed to make that a real thing is far more educational.<br>
To my surprise, I was able to provide useful feedback for some sessions. I speak at a lot of events outside of the FreeBSD world, and was able to share much of what I hear at Linux conferences. A tool that works well for an experienced developer doesn’t necessarily work well for everyone.<br>
Every year, I leave BSDCan tired. I left BSDCam entirely exhausted. These intense, focused discussions stretched my brain.<br>
But, I have a really good idea where key parts of FreeBSD development are actually headed. This should help future-proof the new Absolute FreeBSD, as much as any computer book can be future-proof.<br>
Plus, BSDCam throws the most glorious conference dinner I’ve ever seen.<br>
I want to thank Robert Watson for his kind invitation, and the FreeBSD Foundation for helping defray the cost of this trip</p>

<hr>
</blockquote>

<h2>Interview - The BSDNow Crew</h2>

<ul>
<li>As a kid, what did you dream of to become as an adult?</li>
</ul>

<blockquote>
<p>JT: An Astronaut<br>
BR: I wanted to be a private detective, because of all the crime novels that I read back<br>
then. I didn’t get far with it. However, I think the structured analysis skills (who did what, when, and such) help me in debugging and sysadmin work.<br>
AJ: Didn’t think about it much</p>
</blockquote>

<ul>
<li>How do you manage to stay organized day to day with so much things you&#39;re actively doing each day? (Day job, wife/girlfriend, conferences, hobbies, friends, etc.)</li>
</ul>

<blockquote>
<p>JT: Who said I was organized?<br>
BR: A lot of stuff in my calendar as reminders, open browser tabs as “to read later” list. A few things like task switching when getting stuck helps. Also, focus on a single goal for the day, even though there will be distractions. Slowly, but steadily chip away at the things you’re working on. Rather than to procrastinate and put things back to review later, get started early with easy things for a big task and then tackle the hard part. Often, things look totally chaotic and unmanageable, until you start working on them. <br>
AJ: I barely manage. Lots of Google Calendar reminders, and the entire wall of my office is covered in whiteboard sheet todo lists. I use pinboard.in to deal with finding and organizing bookmarks. Write things down, don’t trust your memory.</p>
</blockquote>

<ul>
<li>What hobbies outside of IT do you have?</li>
</ul>

<blockquote>
<p>JT: I love photography, but I do that Professional part time, so I’m not sure if that counts as a hobby anymore.  I guess it’d have to be working in the garage on my cars.<br>
BR: I do Tai Chi to relax once a week in a group, but can also do it alone, pretty much everywhere. Way too much Youtube watching and browsing the web. I did play some games before studying at the university and I’m still proud that I could control it to the bare minimum not to impact my studies. A few “lapses” from time to time, revisiting the old classics since the newer stuff won’t run on my machines anyway. Holiday time is pretty much spent for BSD conferences and events, this is where I can relax and talk with like-minded people from around the world, which is fascinating. Plus, it gets me to various places and countries I never would have dared to visit on my own.<br>
AJ: I play a few video games, and I like to ski, although I don’t go very often as most of my vacation time is spent hanging out with my BSD friends at various conferences</p>
</blockquote>

<ul>
<li>How do you relax?</li>
</ul>

<blockquote>
<p>JT: What is this word ‘relax’ and what does it mean?<br>
BR: My Tai Chi plays a big part in it I guess. I really calms you and the constant stream of thoughts for a while. It also gives you better clarity of what’s important in life. Watching movies, sleeping long.<br>
AJ: Usually watching TV or Movies. Although I have taken to doing most of my TV watching on my exercise bike now, but it is still mentally relaxing</p>
</blockquote>

<ul>
<li>If FreeBSD didn&#39;t exist,  which BSD flavour would you use? Why?</li>
</ul>

<blockquote>
<p>JT: I use TrueOS, but if FreeBSD didn’t exist, that project might not either… so…  My other choice would be HardenedBSD, but since it’s also based on FreeBSD I’m in the same dillema.<br><br>
BR: I once installed NetBSD to see what It can do. If FreeBSD wouldn’t exist, I would probably try my luck with it. OpenBSD is also appealing, but I’ve never installed it.<br>
AJ: When I started using FreeBSD in 2000, the only other BSD I had heard of at the time was OpenBSD. If FreeBSD wasn’t around, I don’t think the world would look like it does, so it is hard to speculate.</p>
</blockquote>

<ul>
<li>If any of the BSD&#39;s weren&#39;t around and you had to use Linux, which camp would belong to? (Redhat, SUSE, Debian, Ubuntu, Gentoo?)</li>
</ul>

<blockquote>
<p>JT: I learned Linux in the mid 90s using Slackware, which I used consistently up until the mid 2000s, when I joined the PuppyLinux community and eventually became a developer (FYI, Puppy was/is/can be based on Slackware -- its complicated).  So I’d go back to using either Slackware or PuppyLinux.<br>
BR: I tried various Linux distributions until I landed at Debian. I used is pretty extensively as my desktop OS at home, building custom kernels and packages to install them until I discovered FreeBSD. I ran both side by side for a few months for learning until one day I figured out that I had not booted Debian in a while, so I switched completely. <br>
AJ: The first Linux I played with was Slackware, and it is the most BSD like, but the bits of Linux I learned in school were Redhat and so I can somewhat wrap my head around it, although now that they are changing everything to systemd, all of that old knowledge is more harmful than useful.</p>
</blockquote>

<ul>
<li>Are you still finding yourself in need to use Windows/Mac OS? Why?</li>
</ul>

<blockquote>
<p>JT: I work part time as a professional Photographer, so I do use Windows for my photography work.  While I can do everything I need to do in Linux, it comes down to being pragmatic about my time.  What takes me several hours to accomplish in Linux I can accomplish in 20 minutes on Windows.<br>
BR: I was a long time Windows-only user before my Unix days. But back when Vista was about to come out and I needed a new laptop, my choice was basically learning to cope with Vistas awful features or learn MacOS X. I did the latter, it increased my productivity since it’s really a good Unix desktop experience (at least, back then). I only have to use Windows at work from time to time as I manage our Windows Terminal server, which keeps the exposure low enough and I only connect to it to use a certain app not available for the Mac or the BSDs.<br>
AJ: I still use Windows to play games, for a lot of video conferencing, and to produce BSD Now. Some of it could be done on BSD but not as easily. I have promised myself that I will switch to 100% BSD rather than upgrade to Windows 10, so we’ll see how that goes.</p>
</blockquote>

<ul>
<li>Please describe your home networking setup.  Router type, router OS, router hardware, network segmentation, wifi apparatus(es), other devices connected, and anything else that might be interesting about your home network.</li>
</ul>

<blockquote>
<p>BR: Very simple and boring: Apple Airport Express base station and an AVM FritzBox  for DNS, DHCP, and the link to my provider. A long network cable to my desktop machine. That I use less and less often. I just bought an RPI 3 for some home use in the future to replace it. Mostly my brother’s and my Macbook Pro’s are connected, our phones and the iPad of my mother.  </p>

<p>AJ: I have a E3-1220 v3 (dual 3.1ghz + HT) with 8 GB of ram, and 4x Intel gigabit server NICs as my router, and it runs vanilla FreeBSD (usually some snapshot of -current). I have 4 different VLANs, Home, Office, DMZ, and Guest WiFi. WiFi is served via a tiny USB powered device I bought in Tokyo years ago, it serves 3 different SSIDs, one for each VLAN except the DMZ. There are ethernet jacks in every room wired for 10 gigabit, although the only machines with 10 gigabit are my main workstation, file server, and some machines in the server rack. There are 3 switches, one for the house (in the laundry room), one for the rack, and one for 10gig stuff. There is a rack in the basement spare bedroom, it has 7 servers in it, mostly storage for live replicas of customer data for my company.</p>
</blockquote>

<ul>
<li>How do guys manage to get your work done on FreeBSD desktops? What do you do when you need to a Linux or Windows app that isn&#39;t ported, or working? I&#39;ve made several attempts to switch to FreeBSD, but each attempt failed because of tools not being available (e.g. Zoom, Dropbox, TeamViewer, Crashplan) or broken (e.g. VirtualBox).</li>
</ul>

<blockquote>
<p>BR: I use VIrtualBox for everything that is not natively available or Windows-only. Unfortunately, that means no modern games. I mostly do work in the shell when I’m on FreeBSD and when it has to be a graphical application, then I use Fluxbox as the DE. I want to get work done, not look at fancy eye-candy that get’s boring after a while. Deactivated the same stuff on my mac due to the same reason. I look for alternative software online, but my needs are relatively easy to satisfy as I’m not doing video editing/rendering and such.</p>

<p>AJ: I generally find that I don’t need these apps. I use Firefox, Thunderbird, OpenSSH, Quassel, KomodoEdit, and a few other apps, so my needs are not very demanding. It is annoying when packages are broken, but I usually work around this with boot environments, and being able to just roll back to a version that worked for a few days until the problem is solved. I do still have access to a windows machine for the odd time I need specific VPN software or access to Dell/HP etc out-of-band management tools.</p>
</blockquote>

<ul>
<li>Which desktop environments are your favorite, and why? For example, I like i3, Xfce, and I&#39;m drawn to Lumina&#39;s ethos, but so far always seem to end up back on Xfc because of its ease of use, flexibility, and dashing good looks.</li>
</ul>

<blockquote>
<p>JT: As a Lumina Desktop developer, I think my preference is obvious. ;)  I am also a long <br>
timeOpenBox user, so I have a soft place in my heart for that as well.  </p>

<p>BR: I use Fluxbox when I need to work with a lot of windows or an application demands X11. KDE and others are too memory heavy for me and I rarely use even 20% of the features they provide.<br>
AJ: I was a long time KDE user, but I have adopted Lumina. I find it fast, and that it gets out of my way and lets me do what I want. It had some annoyances early on, but I’ve nagged the developers into making it work for me.</p>
</blockquote>

<ul>
<li>Which command-line shells do you prefer, why, and how (if at all) have you customised the environment or prompt?</li>
</ul>

<blockquote>
<p>BR: I use zsh, but without all the fancy stuff you can find online. It might make you more productive, yes. But again, I try to keep things simple. I’m slowly learning tmux and want to work more in it in the future. I sometimes look at other BSD people’s laptops and am amazed at what they do with window-management in tmux. My prompt looks like this:</p>

<pre><code>bcr@Voyager:~&gt;                             20:20 17-08-17
Put this in your .zshrc to get the same result:
PROMPT=&#39;%n@%m:%~&gt;&#39;
RPROMPT=&#39;%T %D&#39;
</code></pre>

<p>AJ: I started using tcsh early on, because it was the shell on the first box I had access to, and because one of the first things I read in “BSD Hacks” was how to enable ‘typo correction”, which made my life a lot better especially on dial up in the early days. My shell prompt looks like this: allan@CA-TOR1-02:/usr/home/allan%</p>
</blockquote>

<ul>
<li>What is one thing (or more) missing in FreeBSD you would import from another project or community? Could be tech, process, etc.</li>
</ul>

<blockquote>
<p>JT: AUFS from Linux</p>

<p>BR: Nohup from Illumos where you can detach an already running process and put it in the background. I often forget that and I’m not in tmux when that happens, so I can see myself use that feature a lot.</p>

<p>AJ: Zones (more complete Jails) from IllumOS</p>
</blockquote>

<ul>
<li>how do you manage your time to learn about and work on FreeBSD?  Does your  work/employment enable what you do, or are your contributions mainly done in private time?</li>
</ul>

<blockquote>
<p>JT: These days I’m mostly learning things I need for work, so it just falls into something I’m doing while working on work projects.</p>

<p>BR: We have a lot of time during the semester holidays to learn on our own, it’s part of the idea of being in a university to keep yourself updated, at least for me. Especially in the fast moving world of IT. I also read a lot in my free time. My interests can shift sometimes, but then I devour everything I can find on the topic. Can be a bit excessive, but has gotten me where I am now and I still need a lot to learn (and want to). Since I work with FreeBSD at work (my owndoing), I can try out many things there.</p>

<p>AJ: My work means a spend a lot of time working with FreeBSD, but not that much time working ON it. My contributions are mostly done outside of work, but as I own the company I do get more flexibility to take time off for conferences and other FreeBSD related stuff.</p>
</blockquote>

<ul>
<li>we know we can bribe Michael W Lucas with gelato (<em>good</em> gelato that is), but what can we use to bribe <em>you</em> guys? Like when I want to have Allan to work on fixing a bug which prevents me from running ZFS on this fancy rock64 board?</li>
</ul>

<blockquote>
<p>BR: Desserts of various kinds. </p>

<p>AJ: I am probably not the right person to look at your rock64 board. Most people in the project have taken to bribing me with chocolate. In general, my todo list is so long, the best way is a trade, you take this task and I’ll take that task.</p>
</blockquote>

<ul>
<li>Is your daily mobile device iOS, Android, Windows Mobile, or other? Why?</li>
</ul>

<blockquote>
<p>JT: These days I’m using Android on my Blackberry Priv, but until recently I was still a heavy user of Sailfish OS.  I would use SailfishOS everyday, if I could find a phone with a keyboard that I could run it on.</p>

<p>BR: iOS on the iPhone 7 currently. Never used an Android phone, saw it on other people’s devices and what they can do with it (much more). But the infrequent security updates (if any at all) keep me away from it.</p>

<p>AJ: I have a Google Nexus 6 (Android 7.1). I wanted the ‘pure’ Android experience, and I had been happy with my previous Nexus S. I don’t run a custom OS/ROM or anything because I use the phone to verify that video streams work on an ‘average users device’. I am displeased that support for my device will end soon. I am not sure what device I will get next, but it definitely won’t be an iPhone.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170808065718&mode=flat&count=30" rel="nofollow">Beta Update - Request for (more) Testing</a></h3>

<ul>
<li> <a href="https://beta.undeadly.org/" rel="nofollow">https://beta.undeadly.org/</a> has received an update. The most significant changes include:</li>
</ul>

<blockquote>
<p>The site has been given a less antiquated &quot;look&quot;. (As the topic icons have been eliminated, we are no longer seeking help with those graphics.)<br>
The site now uses a moderate amount of semantic HTML5.<br>
Several bugs in the HTML fragment validator (used for submissions and comments) have been fixed.<br>
To avoid generating invalid HTML, submission content which fails validation is no longer displayed in submission/comment previews.<br>
Plain text submissions are converted to HTML in a more useful fashion. (Instead of just converting each EOL to <br>, the converter now generates proper paragraphs and interprets two or more consecutive EOLs as indicating a paragraph break.)</p>
</blockquote>

<ul>
<li> The redevelopment remains a work-in-progress. Many thanks to those who have contributed!</li>
</ul>

<blockquote>
<p>As before, constructive feedback would be appreciated. Of particular interest are reports of bugs in behaviour (for example, in the HTML validator or in authentication) that would preclude the adoption of the current code for the main site.</p>

<hr>
</blockquote>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2017-August/313552.html" rel="nofollow">High-process-count support added to master</a></h3>

<blockquote>
<p>We&#39;ve fixed a number of bottlenecks that can develop when the number of user processes runs into the tens of thousands or higher.  One thing led to another and I said to myself, &quot;gee, we have a 6-digit PID, might as well make it work to a million!&quot;.  With the commits made today, master can support at least 900,000 processes with just a kern.maxproc setting in<br>
/boot/loader.conf, assuming the machine has the memory to handle it.<br>
 And, in fact, as today&#39;s machines start to ratchet up there in both memory capacity and core count, with fast storage (NVMe) and fast networking (10GigE and higher), even in consumer boxes, this is actually something that one might want to do.  With AMD&#39;s threadripper and EPYC chips now out, the Intel&lt;-&gt;AMD cpu wars are back on!   Boasting up to 32 cores (64 threads) per socket and two sockets on EPYC, terabytes of ram, and motherboards with dual 10GigE built-in, the reality is that these numbers are already achievable in a useful manner.<br>
 In anycase, I&#39;ve tested these changes on a dual-socket xeon.  I can in-fact start 900,000 processes.  They don&#39;t get a whole lot of cpu and running &#39;ps&#39; would be painful, but it works and the system is still responsive from the shell with all of that going on.<br>
 xeon126# uptime<br>
 1:42PM  up 9 mins, 3 users, load averages: 890407.00, 549381.40, 254199.55<br>
 In fact, judging from the memory use, these minimal test processes only eat around 60KB each.  900,000 of them ate only 55GB on a 128GB machine.  So even a million processes is not out of the question, depending on the cpu requirements for those processes.  Today&#39;s modern machines can be stuffed with enormous amounts of memory.<br>
 Of course, our PIDs are currently limited to 6 digits, so a million is kinda the upper limit in terms of discrete user processes (verses pthreads which are less restricted).  I&#39;d rather not go to 7 digits (yet).</p>

<hr>
</blockquote>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2017-August/066783.html" rel="nofollow">CFT: Driver for generic MS Windows 7/8/10 - compatible USB HID multi-touch touchscreens</a></h3>

<ul>
<li>Following patch [1] adds support for generic MS Windows 7/8/10 - compatible USB HID multi-touch touchscreens via evdev protocol. It is intended to be a native replacement of hid-multitouch.c driver found in Linux distributions and multimedia/webcamd port.</li>
<li>Patch is made for 12-CURRENT and most probably can be applied to recent 11-STABLE and 11.1-RELEASE (not tested)</li>
<li>How to test&quot;</li>
</ul>

<pre><code>1. Apply patch [1]
2. To compile this driver into the kernel, place the following lines 
into your kernel configuration file:
       device wmt
       device usb
       device evdev
    Alternatively, to load the driver as a module at boot time, place the 
following line in loader.conf(5):
       wmt_load=&quot;YES&quot;
3. Install x11-drivers/xf86-input-evdev or 
x11-drivers/xf86-input-libinput port
4. Tell XOrg to use evdev or libinput driver for the device:
</code></pre>

<pre><code>Section &quot;ServerLayout&quot;
     InputDevice    &quot;TouchScreen0&quot; &quot;SendCoreEvents&quot;
EndSection


Section &quot;InputDevice&quot;
     Identifier  &quot;TouchScreen0&quot;
     Driver      &quot;evdev&quot;
&amp;#35;   Driver      &quot;libinput&quot;
     Option      &quot;Device&quot; &quot;/dev/input/eventXXX&quot;
EndSection
</code></pre>

<ul>
<li>Exact value of &quot;/dev/input/eventXXX&quot; can be obtained with evemu-record utility from devel/evemu.</li>
<li>Note1: Currently, driver does not support pens or touchpads.</li>
<li>Note2: wmt.ko should be kld-loaded before uhid driver to take precedence over it! Otherwise uhid can be kld-unloaded after loading of wmt.</li>
<li>wmt review: <a href="https://reviews.freebsd.org/D12017" rel="nofollow">https://reviews.freebsd.org/D12017</a></li>
<li>Raw diff: <a href="https://reviews.freebsd.org/D12017.diff" rel="nofollow">https://reviews.freebsd.org/D12017.diff</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://bsdmag.org/programm_history/" rel="nofollow">BSDMag Programing Languages Infographic</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170815171854" rel="nofollow">t2k17 Hackathon Report: Bob Beck on buffer cache tweaks, libressl and pledge progress</a></li>
<li><a href="https://www.freebsdfoundation.org/past-issues/resource-control/" rel="nofollow">New FreeBSD Journal</a></li>
<li><a href="http://mail-index.netbsd.org/netbsd-advocacy/2017/08/10/msg000744.html" rel="nofollow">NetBSD machines at Open Source Conference 2017 Kyoto</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/3H6TDJV" rel="nofollow">Dan - HDD question</a></li>
<li><a href="http://dpaste.com/10F086V" rel="nofollow">Benjamin - scrub of death</a></li>
<li><a href="http://dpaste.com/2D9102K" rel="nofollow">Jason - Router Opinion</a> </li>
<li><a href="http://dpaste.com/1XYYTWF" rel="nofollow">Sohrab - Thanks</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>209: Signals: gotta catch ‘em all</title>
  <link>https://www.bsdnow.tv/209</link>
  <guid isPermaLink="false">9fc2e90e-3bb7-4ff5-a3e1-c559838b6710</guid>
  <pubDate>Wed, 30 Aug 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9fc2e90e-3bb7-4ff5-a3e1-c559838b6710.mp3" length="66406612" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We read a trip report about FreeBSD in China, look at how Unix deals with Signals, a stats collector in DragonFlyBSD &amp; much more!</itunes:subtitle>
  <itunes:duration>1:32:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We read a trip report about FreeBSD in China, look at how Unix deals with Signals, a stats collector in DragonFlyBSD &amp;amp; much more!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Trip Report: FreeBSD in China at COPU and LinuxCon (https://www.freebsdfoundation.org/blog/trip-report-freebsd-in-china-at-copu-and-linuxcon/)
This trip report is from Deb Goodkin, the Executive Director of the FreeBSD Foundation. She travelled to China in May 2017 to promote FreeBSD, meet with companies, and participate in discussions around Open Source.
&amp;gt; In May of 2017, we were invited to give a talk about FreeBSD at COPU’s (China Open Source Promotional Unit) Open Source China, Open Source World Summit, which took place June 21-22, in Beijing. This was a tremendous opportunity to talk about the advantages of FreeBSD to the open source leaders and organizations interested in open source. I was honored to represent the Project and Foundation and give the presentation “FreeBSD Advantages and Applications”.
&amp;gt; Since I was already going to be in Beijing, and LinuxCon China was being held right before the COPU event, Microsoft invited me to be part of a women-in-tech panel they were sponsoring. There were six of us on the panel including two from Microsoft, one from the Linux Foundation, one from Accenture of China, and one from Women Who Code. Two of us spoke in English, with everyone else speaking Chinese. It was disappointing that we didn’t have translators, because I would have loved hearing everyone’s answers. We had excellent questions from the audience at the end. I also had a chance to talk with a journalist from Beijing, where I emphasized how contributing to an open source project, like FreeBSD, is a wonderful way to get experience to boost your resume for a job.
&amp;gt; The first day of LinuxCon also happened to be FreeBSD Day. I had my posters with me and was thrilled to have the Honorary Chairman of COPU (also known as the “Father of Open Source in China”) hold one up for a photo op. Unfortunately, I haven’t been able to get a copy of that photo for proof (I’m still working on it!). We spent a long time discussing the strengths of FreeBSD. He believes there are many applications in China that could benefit from FreeBSD, especially for embedded devices, university research, and open source education. We had more time throughout the week to discuss FreeBSD in more detail.
&amp;gt; Since I was at LinuxCon, I had a chance to meet with people from the Linux Foundation, other open source projects, and some of our donors. With LinuxCon changing its name to Open Source Summit, I discussed how important it is to include minority voices like ours to contribute to improving the open source ecosystem. The people I talked to within the Linux Foundation agreed and suggested that we get someone from the Project to give a talk at the Open Source Summit in Prague this October. Jim Zemlin, the Linux Foundation Executive Director, suggested having a BSD track at the summits. We did miss the call for proposals for that conference, but we need to get people to consider submitting proposals for the Open Source Summits in 2018.
&amp;gt; I talked to a CTO from a company that donates to us and he brought up his belief that FreeBSD is much easier to get started on as a contributor. He talked about the steep path in Linux to getting contributions accepted due to having over 10,000 developers and the hierarchy of decision makers, from Linus to his main lieutenants to the layers beneath him. It can take 6 months to get your changes in!
&amp;gt; On Tuesday, Kylie and I met with a representative from Huawei, who we’ve been meeting over the phone with over the past few months. Huawei has a FreeBSD contributor and is looking to add more. We were thrilled to hear they decided to donate this year. We look forward to helping them get up to speed with FreeBSD and collaborate with the Project.
&amp;gt; Wednesday marked the beginning of COPU and the reason I flew all the way to Beijing! We started the summit with having a group photo of all the speakers:The honorary chairman, Professor Lu in the front middle.
&amp;gt; My presentation was called “FreeBSD Advantages and Applications”. A lot of the material came from Foundation Board President, George-Neville-Neil’s presentation, “FreeBSD is not a Linux Distribution”, which is a wonderful introduction to FreeBSD and includes the history of FreeBSD, who uses it and why, and which features stand out. My presentation went well, with Professor Lu and others engaged through the translators. Afterwards, I was invited to a VIP dinner, which I was thrilled about.
&amp;gt; The only hitch was that Kylie and I were running a FreeBSD meetup that evening, and both were important! Beijing during rush hour is crazy, even trying to go only a couple of miles is challenging. We made plans that I would go to the meetup and give the same presentation, and then head back to the dinner. Amazingly, it worked out.
Check out the rest of her trip report and stay tuned for more news from the region as this is one of the focus areas of the Foundation. 
***
Unix: Dealing with signals (http://www.networkworld.com/article/3211296/linux/unix-dealing-with-signals.html)
Signals on Unix systems are critical to the way processes live and die. This article looks at how they're generated, how they work, and how processes receive or block them
On Unix systems, there are several ways to send signals to processes—with a kill command, with a keyboard sequence (like control-C), or through a program
Signals are also generated by hardware exceptions such as segmentation faults and illegal instructions, timers and child process termination.
But how do you know what signals a process will react to? After all, what a process is programmed to do and able to ignore is another issue.
Fortunately, the /proc file system makes information about how processes handle signals (and which they block or ignore) accessible with commands like the one shown below. In this command, we’re looking at information related to the login shell for the current user, the "$$" representing the current process.
On FreeBSD, you can use procstat -i PID to get that and even more information, and easier to digest form
        P  if signal is pending in the global process queue
        I  if signal delivery disposition is SIGIGN
        C  if signal delivery is to catch it
Catching a signal requires that a signal handling function exists in the process to handle a given signal. The SIGKILL (9) and SIGSTOP (#) signals cannot be ignored or caught. For example, if you wanted to tell the kernel that ctrl-C's are to be ignored, you would include something like this in your source code:
signal(SIGINT, SIGIGN);
To ensure that the default action for a signal is taken, you would do something like this instead:
signal(SIGSEGV, SIGDFL);
+ The article then shows some ways to send signals from the command line, for example to send SIGHUP to a process with pid 1234:
kill -HUP 1234
+ You can get a list of the different signals by running
kill -l
On Unix systems, signals are used to send all kinds of information to running processes, and they come from user commands, other processes, and the kernel itself. Through /proc, information about how processes are handling signals is now easily accessible and, with just a little manipulation of the data, easy to understand.
links owned by NGZ erroneously marked as on loan (https://smartos.org/bugview/OS-6274)
NGZ (Non-Global Zone), is IllumOS speak for their equivalent to a jail
&amp;gt; As reported by user brianewell in smartos-live#737, NGZ ip tunnels stopped persisting across zone reboot. This behavior appeared in the 20170202 PI and was not present in previous releases. After much spelunking I determined that this was caused by a regression introduced in commit 33df115 (part of the OS-5363 work). The regression was a one-line change to link_activate() which marks NGZ links as on loan when they are in fact not loaned because the NGZ created and owns the link.
“On loan” means the interface belongs to the host (GZ, Global Zone), and has been loaned to the NGZ (Jail)
This regression was easy to introduce because of the subtle nature of this code and lack of comments. I'm going to remove the regressive line, add clarifying comments, and also add some asserts.
The following is a detailed analysis of the issue, how I debugged it, and why my one-line change caused the regression:
To start I verified that PI 20170119 work as expected:
    booted 20170119
   created iptun (named v4sys76) inside of a native NGZ (names sos-zone)
   performed a reboot of sos-zone
   zlogin to sos-zone and verify iptun still exists after reboot
Then I booted the GZ into PI 20170202 and verified the iptun did not show up
   booted 20170202
   started sos-zone
   zlogin and verified the iptun was missing
At this point I thought I would recreate the iptun and see if I could monitor the zone halt/boot process for the culprit, but instead I received an error from dladm: "object already exists".
I didn't expect this. So I used mdb to inspect the dlmgmtd state. Sure enough the iptun exists in dlmgmtd.
Okay, so if the link already exists, why doesn't it show up (in either the GZ or the NGZ)?
If a link is not marked as active then it won't show up when you query dladm. When booting the zone on 20170119 the llflags for the iptun contained the value 0x3. So the problem is the link is not marked as active on the 20170202 PI.
The linkactivate() function is responsible for marking a link as active. I used dtrace to verify this function was called on the 20170202 PI and that the dlmgmtlinkt had the correct llflags value.
So the iptun link structure has the correct llflags when linkactivate() returns but when I inspect the same structure with mdb afterwards the value has changed.
Sometime after linkactivate() completes some other process changed the llflags value. My next question was: where is linkactivate() called and what comes after it that might affect the llflags? I did another trace and got this stack.
The dlmgmtupid() function calls dlmgmtwritedbentry() after linkactivate() and that can change the flags. But dtrace proved the llflags value was still 0x3 after returning from this function.
With no obvious questions left I then asked cscope to show me all places where llflags is modified. As I walked through the list I used dtrace to eliminate candidates one at a time -- until I reached dlmgmtdestroycommon(). I would not have expected this function to show up during zone boot but sure enough it was being called somehow, and by someone. Who?
Since there is no easy way to track door calls it was at this point I decided to go nuclear and use the dtrace stop action to stop dlmgmtd when it hits dlmgmtdestroycommon(). Then I used mdb -k to inspect the door info for the dlmgmtd threads and look for my culprit.
The culprit is doupiptun() caused by the dladm up-iptun call. Using ptree I then realized this was happening as part of the zone boot under the network/iptun svc startup. At this point it was a matter of doing a zlogin to sos-zone and running truss on dladm up-iptun to find the real reason why dladmdestroydatalinkid() is called.
So the link is marked as inactive because dladmgetsnapconf() fails with DLADMSTATUSDENIED which is mapped to EACCESS. Looking at the dladmgetsnapconf() code I see the following
“The caller is in a non-global zone and the persistent configuration belongs to the global zone.”
What this is saying is that if a link is marked "on loan" (meaning it's technically owned/created by the GZ but assigned/loaned to the NGZ) and the zone calling dladmgetsnapconf() is an NGZ then return EACCESS because the configuration of the link is up to the GZ, not the NGZ. This code is correct and should be enforced, but why is it tripping in PI 20170202 and not 20170119? It comes back to my earlier observation that in the 20170202 PI we marked the iptun as "on loan" but not in the older one. Why?
Well as it turns out while fixing OS-5363 I fixed what I thought was a bug in linkactivate()
When I first read this code it was my understanding that anytime we added a link to a zone's datalink list, by calling zoneadddatalink(), that link was then considered "on loan". My understanding was incorrect. The linkactivate() code has a subtleness that eluded me. There are two cases in linkactivate():
1. The link is under an NGZ's datalink list but it's lllinkid doesn't reflect that (e.g., the link is found under zoneid 3 but lllinkid is 0). In this case the link is owned by the GZ but is being loaned to an NGZ and the link state should be updated accordingly. We get in this situation when dlmgmtd is restated for some reason (it must resync it's in-memory state with the state of the system).
2. The link is NOT under any NGZ's (zonecheckdatalink() is only concerned with NGZs) datalink list but its llzoneid holds the value of an NGZ. This indicates that the link is owned by an NGZ but for whatever reason is not currently under the NGZ's datalink list (e.g., because we are booting the zone and we now need to assign the link to its list).
So the fix is to revert that one line change as well as add some clarifying comments and also some asserts to prevent further confusion in the future.
+ A nice breakdown by Ryan Zezeski of how he accidently introduced a regression, and how he tracked it down using dtrace and mdb
New experimental statistics collector in master (http://dpaste.com/2YP0X9C)
Master now has an in-kernel statistics collector which is enabled by default, and a (still primitive) user land program to access it.  This recorder samples the state of the machine once every 10 seconds and records it in a large FIFO, all in-kernel.  The FIFO typically contains 8192 entries, or around the last 23 hours worth of data.
Statistics recorded include current load, user/sys/idle cpu use, swap use, VM fault rate, VM memory statistics, and counters for syscalls, path lookups, and various interrupt types.  A few more useful counters will probably be added... I'd like to tie cpu temperature, fork rate, and exec rate in at some point, as well as network and disk traffic.
The statistics gathering takes essentially no real overhead and is always on, so any user at the spur of the moment with no prior intent can query the last 23 hours worth of data.
There is a user frontend to the data called 'kcollect' (its tied into the buildworld now).  Currently still primitive.  Ultimately my intention is to integrate it with a dbm database for long-term statistical data retention (if desired) using an occasional (like once-an-hour) cron-job to soak up anything new, with plenty of wiggle room due to the amount of time the kernel keeps itself.  This is better and less invasive than having a userland statistics gathering script running every few minutes from cron and has the advantage of giving you a lot of data on the spur of the moment without having to ask for it before-hand.
If you have gnuplot installed (pkg install gnuplot), kcollect can generate some useful graphs based on the in-kernel data.  Well, it will be boring if the machine isn't doing anything :-).  There are options to use gnuplot to generate a plot window in X or a .jpg or .png file, and other options to set the width and height and such.  At the moment the gnuplot output uses a subset of statically defined fields to plot but ultimately the field list it uses will be specifiable.
Sample image generated during a synth run (http://apollo.backplane.com/DFlyMisc/kcollect03.jpg)
News Roundup
openbsd changes of note 626 (https://www.tedunangst.com/flak/post/openbsd-changes-of-note-626)
Hackerthon is imminent.
There are two signals one can receive after accessing invalid memory, SIGBUS and SIGSEGV. Nobody seems to know what the difference is or should be, although some theories have been unearthed. Make some attempt to be slightly more consistent and predictable in OpenBSD.
Introduces jiffies in an effort to appease our penguin oppressors.
Clarify that IP.OF.UPSTREAM.RESOLVER is not actually the hostname of a server you can use.
Switch acpibat to use _BIX before _BIF, which means you might see discharge cycle counts, too.
Assorted clang compatibility. clang uses -Oz to mean optimize for size and -Os for something else, so make gcc accept -Oz so all makefiles can be the same. Adjust some hardlinks. Make sure we build gcc with gcc. 
The SSLcheckprivate_key function is a lie.
Switch the amd64 and i386 compiler to clang and see what happens.
We are moving towards using wscons (wstpad) as the driver for touchpads.
Dancing with the stars, er, NET_LOCK().
clang emits lots of warnings. Fix some of them. Turn off a bunch of clang builtins because we have a strong preference that code use our libc versions. Some other changes because clang is not gcc.
Among other curiosities, static variables in the special .openbsd.randomdata are sometimes assumed to be all zero, leading the clang optimizer to eliminate reads of such variables.
Some more pledge rules for sed. If the script doesn’t require opening new files, don’t let it.
Backport a bajillion fixes to stable. Release errata.
RFC 1885 was obsoleted nearly 20 years ago by RFC 2463 which was obsoleted over 10 years ago by RFC 4443. We are probably not going back.
Update libexpat to 2.2.3.
vmm: support more than 3855MB guest memory.
Merge libdrm 2.4.82.
Disable SSE optimizations on i386/amd64 for SlowBcopy. It is supposed to be slow. Prevents crashes when talking to memory mapped video memory in a hypervisor.
The $25 “FREEDOM Laptop!” (https://functionallyparanoid.com/2017/08/08/the-25-freedom-laptop/)
Time to get back to the original intent of this blog – talking about my paranoid obsession with information security!  So break out your tinfoil hats my friends because this will be a fun ride.  I’m looking for the most open source / freedom respecting portable computing experience I can possibly find and I’m going to document my work in real-time so you will get to experience the ups (and possibly the downs) of that path through the universe.  With that said, let’s get rolling.
When I built my OpenBSD router using the APU2 board, I discovered that there are some amd64 systems that use open source BIOS.  This one used Coreboot and after some investigation I discovered that there was an even more paranoid open source BIOS called Libreboot out there.  That started to feel like it might scratch my itch.  
Well, after playing around with some lower-powered systems like my APU2 board, my Thinkpad x230 and my SPARC64 boxes, I thought, if it runs amd64 code and I can run an open source operating system on it, the thing should be powerful enough for me to do most (if not all) of what I need it to do.  At this point, I started looking for a viable machine.  From a performance perspective, it looked like the Thinkpad x200, T400, T500 and W500 were all viable candidates.  After paying attention on eBay for a while, I saw something that was either going to be a sweet deal, or a throwaway piece of garbage!
I found a listing for a Thinkpad T500 that said it didn’t come with a power adapter and was 100% untested.  From looking at the photos, it seemed like there was nothing that had been molested about it.  Obviously, nobody was jumping on something this risky so I thought, “what the heck” and dropped a bit at the opening price of $24.99.  Well, guess what.  I won the auction.  Now to see what I got.
When the laptop showed up, I discovered it was minus its hard drive (but the outside plastic cover was still in place).  I plugged in my x230’s power adapter and hit the button.  I got lights and was dropped to the BIOS screen.  To my eternal joy, I discovered that the machine I had purchased for $25 was 100% functional and included the T9400 2.54 GHz Core 2 Duo CPU and the 1680×1050 display panel.  W00t!
First things first, I need to get this machine a hard drive and get the RAM upgraded from the 2GB that it showed up with to 8GB.  Good news is that these two purchases only totaled $50 for the pair.  An aftermarket 9-cell replacement battery was another $20. Throw in a supported WiFi card that doesn’t require a non-free blob from Libreboot at $5.99 off of eBay and $5 for a hard drive caddy and I’m looking at about $65 in additional parts bringing the total cost of the laptop, fully loaded up at just over $100.  Not bad at all…
Once all of the parts arrived and were installed, now for the fun part.  Disassembling the entire thing down to the motherboard so we can re-flash the BIOS with Libreboot.  The guide looks particularly challenging for this but hey, I have a nice set of screwdrivers from iFixit and a remarkable lack of fear when it comes to disassembling things.  Should be fun!
Well, fun didn’t even come close.  I wish I had shot some pictures along the way because at one point I had a heap of parts in one corner of my “workbench” (the dining room table) and just the bare motherboard, minus the CPU sitting in front of me.  With the help of a clip and a bunch of whoops wires (patch cables), I connected my Beaglebone Black to the BIOS chip on the bare motherboard and attempted to read the chip.  #fail
I figured out after doing some more digging that you need to use the connector on the left side of the BBB if you hold it with the power connector facing away from you.  In addition, you should probably read the entire process through instead of stopping at the exciting pinout connector diagram because I missed the bit about the 3.3v power supply need to have ground connected to pin 2 of the BIOS chip.
Speaking of that infamous 3.3v power supply, I managed to bend a paperclip into a U shape and jam it into the connector of an old ATX power supply I had in a closet and source power from that.  I felt like MacGyver for that one!
I was able to successfully read the original Thinkpad BIOS and then flash the Libreboot + Grub2 VESA framebuffer image onto the laptop!  I gulped loudly and started the reassembly process.  Other than having some cable routing difficulties because the replacement WiFi card didn’t have a 5Ghz antenna, it all went back together.  Now for the moment of truth!  I hit the power button and everything worked!!!
At this point I happily scurried to download the latest snapshot of OpenBSD – current and install it.  Well, things got a little weird here.  Looks like I have to use GRUB to boot this machine now and GRUB won’t boot an OpenBSD machine with Full Disk Encryption.  That was a bit of a bummer for me.  I tilted against that windmill for several days and then finally admitted defeat.  So now what to do?  Install Arch?
Well, here’s where I think the crazy caught up to me.  I decided to be an utter sell out and install Ubuntu Gnome Edition 17.04 (since that will be the default DE going forward) with full disk encryption.  I figured I could have fun playing around in a foreign land and try to harden the heck out of that operating system.  I called Ubuntu “grandma’s Linux” because a friend of mine installed it on his mom’s laptop for her but I figured what the heck – let’s see how the other half live!
At this point, while I didn’t have what I originally set out to do – build a laptop with Libreboot and OpenBSD, I did have a nice compromise that is as well hardened as I can possibly make it and very functional in terms of being able to do what I need to do on a day to day basis.  Do I wish it was more portable?  Of course.  This thing is like a six or seven pounder.  However, I feel much more secure in knowing that the vast majority of the code running on this machine is open source and has all the eyes of the community on it, versus something that comes from a vendor that we cannot inspect.  My hope is that someone with the talent (unfortunately I lack those skills) takes an interest in getting FDE working with Libreboot on OpenBSD and I will most happily nuke and repave this “ancient of days” machine to run that!
FreeBSD Programmers Report Ryzen SMT Bug That Hangs Or Resets Machines (https://hothardware.com/news/freebsd-programmers-report-ryzen-smt-bug-that-hangs-or-resets-machines)
It's starting to look like there's an inherent bug with AMD's Zen-based chips that is causing issues on Unix-based operating systems, with both Linux and FreeBSD confirmed. The bug doesn't just affect Ryzen desktop chips, but also AMD's enterprise EPYC chips. It seems safe to assume that Threadripper will bundle it in, as well.
It's not entirely clear what is causing the issue, but it's related to the CPU being maxed out in operations, thus causing data to get shifted around in memory, ultimately resulting in unstable software. If the bug is exercised a certain way, it can even cause machines to reset.
The revelation about the issue on FreeBSD was posted to the official repository, where the issue is said to happen when threads can lock up, and then cause the system to become unstable. Getting rid of the issue seems as simple as disabling SMT, but that would then negate the benefits provided by having so many threads at-the-ready.
On the Linux side of the Unix fence, Phoronix reports on similar issues, where stressing Zen chips with intensive benchmarks can cause one segmentation fault after another. The issue is so profound, that Phoronix Test Suite developer Michael Larabel introduced a special test that can be run to act as a bit of a proof-of-concept. To test another way, PTS can be run with this command:
PTS_CONCURRENT_TEST_RUNS=4 TOTAL_LOOP_TIME=60 phoronix-test-suite stress-run build-linux-kernel build-php build-apache build-imagemagick
Running this command will compile four different software projects at once, over and over, for an hour. Before long, segfaults should begin to appear (as seen in the shot above).
It's not entirely clear if both sets of issues here are related, but seeing as both involve stressing the CPU to its limit, it seems likely. Whether or not this could be patched on a kernel or EFI level is something yet to be seen.
TrueOS - UNSTABLE update: 8/7/17 (https://www.trueos.org/blog/unstable-update-8717/)
A new UNSTABLE update for TrueOS is available!  Released regularly, UNSTABLE updates are the full “rolling release” of TrueOS. UNSTABLE includes experimental features, bugfixes, and other CURRENT FreeBSD work. It is meant to be used by those users interested in using the latest TrueOS and FreeBSD developments to help test and improve these projects.
WARNING: UNSTABLE updates are released primarily for TrueOS and FreeBSD testing/experimentation purposes. Update and run UNSTABLE “at your own risk”.
Note: There was a CDN issue over the weekend that caused issues for early updaters. Everything appears to be resolved and the update is fully available again. If you encountered instability or package issues from updating on 8/6 or 8/5, roll back to a previous boot environment and run the update again.
Changes:
UNSTABLE .iso and .img files beginning with TrueOS-2017-08-3-x64 will be available to download from http://download.trueos.org/unstable/amd64/. Due to CDN issues, these are not quite available, look for them later today or tomorrow (8/8/17). This update resyncs all ports with FreeBSD as of 8.1.2017. This includes: New/updated FreeBSD Kernel and World &amp;amp; New DRM (Direct Rendering Manager) next.
Experimental patch for libhyve-remote: (From htps://github.com/trueos/freebsd/commit/a67a73e49538448629ea27, thanks araujobsd)
The libhyve-remote aims to abstract functionalities from other third party libraries like libvncserver, freerdp, and spice to be used in hypervisor implementation. With a basic data structure it is easy to implement any remote desktop protocol without digging into the protocol specification or third part libraries – check some of our examples.We don’t statically link any third party library, instead we use a dynamic linker and load only the functionality necessary to launch the service.Our target is to abstract functionalities from libvncserver, freerdp and spice. Right now, libhyve-remote only supports libvncserver. It is possible to launch a VNC server with different screen resolution as well as with authentication.With this patch we implement support for bhyve to use libhyve-remote that basically abstract some functionalities from libvncserver.  We can: Enable wait state, Enable authentication, Enable different resolutions&amp;lt; Have a better compression.  Also, we add a new -s flag for vncserver, if the libhyve-remote library is not present in the system, we fallback to bhyve RFB implementation. For example:
-s 2,fbuf,tcp=0.0.0.0:5937,w=800,h=600,password=1234567,vncserver,wait
New SysAdm Client pages under the System Management category: 
System Control: This is an interface to browse all the sysctl’s on the system.
Devices: This lists all known information about devices on the designated system.
Lumina Theming: Lumina is testing new theming functionality! By default (in UNSTABLE), a heavily customized version of the Qt5ct engine is included and enabled. This is intended to allow users to quickly adjust themes/icon packs without needing to log out and back in. This also fixes a bug in Insight with different icons loading for the side and primary windows. Look for more information about this new functionality to be discussed on the Lumina Website.
Update to Iridium Web Browser: Iridium is a Chromium based browser built with user privacy and security as the primary concern, but still maintaining the speed and usability of Chromium. It is now up to date – give it a try and let us know what you think (search for iridium-browser in AppCafe).
Beastie Bits
GhostBSD 11.1 Alpha1 is ready (http://www.ghostbsd.org/11.1-ALPHA1)
A Special CharmBUG announcement (https://www.meetup.com/CharmBUG/events/242563414/)
Byhve Obfuscation Part 1 of Many (https://github.com/HardenedBSD/hardenedBSD/commit/59eabffdca53275086493836f732f24195f3a91d)
New BSDMag is out (https://bsdmag.org/download/bsd-magazine-overriding-libc-functions/)
git: kernel - Lower VMMAXUSER_ADDRESS to finalize work-around for Ryzen bug (http://lists.dragonflybsd.org/pipermail/commits/2017-August/626190.html)
Ken Thompson corrects one of his biggest regrets (https://twitter.com/_rsc/status/897555509141794817)
***
Feedback/Questions
Hans - zxfer (http://dpaste.com/2SQYQV2)
Harza - Google Summer of Code (http://dpaste.com/2175GEB)
tadslot - Microphones, Proprietary software, and feedback (http://dpaste.com/154MY1H)
Florian - ZFS/Jail (http://dpaste.com/2V9VFAC)
Modifying a ZFS root system to a beadm layout (http://dan.langille.org/2015/03/11/modifying-a-zfs-root-system-to-a-beadm-layout/)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We read a trip report about FreeBSD in China, look at how Unix deals with Signals, a stats collector in DragonFlyBSD &amp; much more!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/trip-report-freebsd-in-china-at-copu-and-linuxcon/" rel="nofollow">Trip Report: FreeBSD in China at COPU and LinuxCon</a></h3>

<ul>
<li>This trip report is from Deb Goodkin, the Executive Director of the FreeBSD Foundation. She travelled to China in May 2017 to promote FreeBSD, meet with companies, and participate in discussions around Open Source.</li>
<li>&gt; In May of 2017, we were invited to give a talk about FreeBSD at COPU’s (China Open Source Promotional Unit) Open Source China, Open Source World Summit, which took place June 21-22, in Beijing. This was a tremendous opportunity to talk about the advantages of FreeBSD to the open source leaders and organizations interested in open source. I was honored to represent the Project and Foundation and give the presentation “FreeBSD Advantages and Applications”.</li>
<li>&gt; Since I was already going to be in Beijing, and LinuxCon China was being held right before the COPU event, Microsoft invited me to be part of a women-in-tech panel they were sponsoring. There were six of us on the panel including two from Microsoft, one from the Linux Foundation, one from Accenture of China, and one from Women Who Code. Two of us spoke in English, with everyone else speaking Chinese. It was disappointing that we didn’t have translators, because I would have loved hearing everyone’s answers. We had excellent questions from the audience at the end. I also had a chance to talk with a journalist from Beijing, where I emphasized how contributing to an open source project, like FreeBSD, is a wonderful way to get experience to boost your resume for a job.</li>
<li>&gt; The first day of LinuxCon also happened to be FreeBSD Day. I had my posters with me and was thrilled to have the Honorary Chairman of COPU (also known as the “Father of Open Source in China”) hold one up for a photo op. Unfortunately, I haven’t been able to get a copy of that photo for proof (I’m still working on it!). We spent a long time discussing the strengths of FreeBSD. He believes there are many applications in China that could benefit from FreeBSD, especially for embedded devices, university research, and open source education. We had more time throughout the week to discuss FreeBSD in more detail.</li>
<li>&gt; Since I was at LinuxCon, I had a chance to meet with people from the Linux Foundation, other open source projects, and some of our donors. With LinuxCon changing its name to Open Source Summit, I discussed how important it is to include minority voices like ours to contribute to improving the open source ecosystem. The people I talked to within the Linux Foundation agreed and suggested that we get someone from the Project to give a talk at the Open Source Summit in Prague this October. Jim Zemlin, the Linux Foundation Executive Director, suggested having a BSD track at the summits. We did miss the call for proposals for that conference, but we need to get people to consider submitting proposals for the Open Source Summits in 2018.</li>
<li>&gt; I talked to a CTO from a company that donates to us and he brought up his belief that FreeBSD is much easier to get started on as a contributor. He talked about the steep path in Linux to getting contributions accepted due to having over 10,000 developers and the hierarchy of decision makers, from Linus to his main lieutenants to the layers beneath him. It can take 6 months to get your changes in!</li>
<li>&gt; On Tuesday, Kylie and I met with a representative from Huawei, who we’ve been meeting over the phone with over the past few months. Huawei has a FreeBSD contributor and is looking to add more. We were thrilled to hear they decided to donate this year. We look forward to helping them get up to speed with FreeBSD and collaborate with the Project.</li>
<li>&gt; Wednesday marked the beginning of COPU and the reason I flew all the way to Beijing! We started the summit with having a group photo of all the speakers:The honorary chairman, Professor Lu in the front middle.</li>
<li>&gt; My presentation was called “FreeBSD Advantages and Applications”. A lot of the material came from Foundation Board President, George-Neville-Neil’s presentation, “FreeBSD is not a Linux Distribution”, which is a wonderful introduction to FreeBSD and includes the history of FreeBSD, who uses it and why, and which features stand out. My presentation went well, with Professor Lu and others engaged through the translators. Afterwards, I was invited to a VIP dinner, which I was thrilled about.</li>
<li>&gt; The only hitch was that Kylie and I were running a FreeBSD meetup that evening, and both were important! Beijing during rush hour is crazy, even trying to go only a couple of miles is challenging. We made plans that I would go to the meetup and give the same presentation, and then head back to the dinner. Amazingly, it worked out.</li>
<li>Check out the rest of her trip report and stay tuned for more news from the region as this is one of the focus areas of the Foundation. 
***</li>
</ul>

<h3><a href="http://www.networkworld.com/article/3211296/linux/unix-dealing-with-signals.html" rel="nofollow">Unix: Dealing with signals</a></h3>

<blockquote>
<p>Signals on Unix systems are critical to the way processes live and die. This article looks at how they&#39;re generated, how they work, and how processes receive or block them<br>
On Unix systems, there are several ways to send signals to processes—with a kill command, with a keyboard sequence (like control-C), or through a program<br>
Signals are also generated by hardware exceptions such as segmentation faults and illegal instructions, timers and child process termination.<br>
But how do you know what signals a process will react to? After all, what a process is programmed to do and able to ignore is another issue.<br>
Fortunately, the /proc file system makes information about how processes handle signals (and which they block or ignore) accessible with commands like the one shown below. In this command, we’re looking at information related to the login shell for the current user, the &quot;$$&quot; representing the current process.</p>
</blockquote>

<ul>
<li>On FreeBSD, you can use <em>procstat -i PID</em> to get that and even more information, and easier to digest form</li>
</ul>

<blockquote>
<blockquote>
<pre><code>        P  if signal is pending in the global process queue
        I  if signal delivery disposition is SIGIGN
        C  if signal delivery is to catch it
</code></pre>

<p>Catching a signal requires that a signal handling function exists in the process to handle a given signal. The SIGKILL (9) and SIGSTOP (#) signals cannot be ignored or caught. For example, if you wanted to tell the kernel that ctrl-C&#39;s are to be ignored, you would include something like this in your source code:<br>
signal(SIGINT, SIG_IGN);<br>
To ensure that the default action for a signal is taken, you would do something like this instead:<br>
signal(SIGSEGV, SIG_DFL);</p>

<ul>
<li>The article then shows some ways to send signals from the command line, for example to send SIGHUP to a process with pid 1234:
kill -HUP 1234</li>
<li>You can get a list of the different signals by running
kill -l
On Unix systems, signals are used to send all kinds of information to running processes, and they come from user commands, other processes, and the kernel itself. Through /proc, information about how processes are handling signals is now easily accessible and, with just a little manipulation of the data, easy to understand.
***</li>
</ul>
</blockquote>
</blockquote>

<h3><a href="https://smartos.org/bugview/OS-6274" rel="nofollow">links owned by NGZ erroneously marked as on loan</a></h3>

<ul>
<li>NGZ (Non-Global Zone), is IllumOS speak for their equivalent to a jail
&gt; As reported by user brianewell in smartos-live#737, NGZ ip tunnels stopped persisting across zone reboot. This behavior appeared in the 20170202 PI and was not present in previous releases. After much spelunking I determined that this was caused by a regression introduced in commit 33df115 (part of the OS-5363 work). The regression was a one-line change to link_activate() which marks NGZ links as on loan when they are in fact not loaned because the NGZ created and owns the link.</li>
<li>“On loan” means the interface belongs to the host (GZ, Global Zone), and has been loaned to the NGZ (Jail)</li>
</ul>

<blockquote>
<p>This regression was easy to introduce because of the subtle nature of this code and lack of comments. I&#39;m going to remove the regressive line, add clarifying comments, and also add some asserts.<br>
The following is a detailed analysis of the issue, how I debugged it, and why my one-line change caused the regression:<br>
To start I verified that PI 20170119 work as expected:<br>
    booted 20170119<br>
   created iptun (named v4_sys76) inside of a native NGZ (names sos-zone)<br>
   performed a reboot of sos-zone<br>
   zlogin to sos-zone and verify iptun still exists after reboot<br>
Then I booted the GZ into PI 20170202 and verified the iptun did not show up<br>
   booted 20170202<br>
   started sos-zone<br>
   zlogin and verified the iptun was missing<br>
At this point I thought I would recreate the iptun and see if I could monitor the zone halt/boot process for the culprit, but instead I received an error from dladm: &quot;object already exists&quot;.<br>
I didn&#39;t expect this. So I used mdb to inspect the dlmgmtd state. Sure enough the iptun exists in dlmgmtd.<br>
Okay, so if the link already exists, why doesn&#39;t it show up (in either the GZ or the NGZ)?<br>
If a link is not marked as active then it won&#39;t show up when you query dladm. When booting the zone on 20170119 the ll_flags for the iptun contained the value 0x3. So the problem is the link is not marked as active on the 20170202 PI.<br>
The link_activate() function is responsible for marking a link as active. I used dtrace to verify this function was called on the 20170202 PI and that the dlmgmt_link_t had the correct ll_flags value.<br>
So the iptun link structure has the correct ll_flags when link_activate() returns but when I inspect the same structure with mdb afterwards the value has changed.<br>
Sometime after link_activate() completes some other process changed the ll_flags value. My next question was: where is link_activate() called and what comes after it that might affect the ll_flags? I did another trace and got this stack.<br>
The dlmgmt_upid() function calls dlmgmt_write_db_entry() after link_activate() and that can change the flags. But dtrace proved the ll_flags value was still 0x3 after returning from this function.<br>
With no obvious questions left I then asked cscope to show me all places where ll_flags is modified. As I walked through the list I used dtrace to eliminate candidates one at a time -- until I reached dlmgmt_destroy_common(). I would not have expected this function to show up during zone boot but sure enough it was being called somehow, and by someone. Who?<br>
Since there is no easy way to track door calls it was at this point I decided to go nuclear and use the dtrace stop action to stop dlmgmtd when it hits dlmgmt_destroy_common(). Then I used mdb -k to inspect the door info for the dlmgmtd threads and look for my culprit.<br>
The culprit is do_up_iptun() caused by the dladm up-iptun call. Using ptree I then realized this was happening as part of the zone boot under the network/iptun svc startup. At this point it was a matter of doing a zlogin to sos-zone and running truss on dladm up-iptun to find the real reason why dladm_destroy_datalink_id() is called.<br>
So the link is marked as inactive because dladm_getsnap_conf() fails with DLADM_STATUS_DENIED which is mapped to EACCESS. Looking at the dladm_getsnap_conf() code I see the following</p>
</blockquote>

<ul>
<li>“The caller is in a non-global zone and the persistent configuration belongs to the global zone.”</li>
</ul>

<blockquote>
<p>What this is saying is that if a link is marked &quot;on loan&quot; (meaning it&#39;s technically owned/created by the GZ but assigned/loaned to the NGZ) and the zone calling dladm_getsnap_conf() is an NGZ then return EACCESS because the configuration of the link is up to the GZ, not the NGZ. This code is correct and should be enforced, but why is it tripping in PI 20170202 and not 20170119? It comes back to my earlier observation that in the 20170202 PI we marked the iptun as &quot;on loan&quot; but not in the older one. Why?<br>
Well as it turns out while fixing OS-5363 I fixed what I thought was a bug in link_activate()<br>
When I first read this code it was my understanding that anytime we added a link to a zone&#39;s datalink list, by calling zone_add_datalink(), that link was then considered &quot;on loan&quot;. My understanding was incorrect. The link_activate() code has a subtleness that eluded me. There are two cases in link_activate():</p>

<ol>
<li>The link is under an NGZ&#39;s datalink list but it&#39;s ll_linkid doesn&#39;t reflect that (e.g., the link is found under zoneid 3 but ll_linkid is 0). In this case the link is owned by the GZ but is being loaned to an NGZ and the link state should be updated accordingly. We get in this situation when dlmgmtd is restated for some reason (it must resync it&#39;s in-memory state with the state of the system).</li>
<li>The link is NOT under any NGZ&#39;s (zone_check_datalink() is only concerned with NGZs) datalink list but its ll_zoneid holds the value of an NGZ. This indicates that the link is owned by an NGZ but for whatever reason is not currently under the NGZ&#39;s datalink list (e.g., because we are booting the zone and we now need to assign the link to its list).
So the fix is to revert that one line change as well as add some clarifying comments and also some asserts to prevent further confusion in the future.</li>
<li>A nice breakdown by Ryan Zezeski of how he accidently introduced a regression, and how he tracked it down using dtrace and mdb
***</li>
</ol>
</blockquote>

<h3><a href="http://dpaste.com/2YP0X9C" rel="nofollow">New experimental statistics collector in master</a></h3>

<blockquote>
<p>Master now has an in-kernel statistics collector which is enabled by default, and a (still primitive) user land program to access it.  This recorder samples the state of the machine once every 10 seconds and records it in a large FIFO, all in-kernel.  The FIFO typically contains 8192 entries, or around the last 23 hours worth of data.<br>
Statistics recorded include current load, user/sys/idle cpu use, swap use, VM fault rate, VM memory statistics, and counters for syscalls, path lookups, and various interrupt types.  A few more useful counters will probably be added... I&#39;d like to tie cpu temperature, fork rate, and exec rate in at some point, as well as network and disk traffic.<br>
The statistics gathering takes essentially no real overhead and is always on, so any user at the spur of the moment with no prior intent can query the last 23 hours worth of data.<br>
There is a user frontend to the data called &#39;kcollect&#39; (its tied into the buildworld now).  Currently still primitive.  Ultimately my intention is to integrate it with a dbm database for long-term statistical data retention (if desired) using an occasional (like once-an-hour) cron-job to soak up anything new, with plenty of wiggle room due to the amount of time the kernel keeps itself.  This is better and less invasive than having a userland statistics gathering script running every few minutes from cron and has the advantage of giving you a lot of data on the spur of the moment without having to ask for it before-hand.<br>
If you have gnuplot installed (pkg install gnuplot), kcollect can generate some useful graphs based on the in-kernel data.  Well, it will be boring if the machine isn&#39;t doing anything :-).  There are options to use gnuplot to generate a plot window in X or a .jpg or .png file, and other options to set the width and height and such.  At the moment the gnuplot output uses a subset of statically defined fields to plot but ultimately the field list it uses will be specifiable.</p>
</blockquote>

<ul>
<li><a href="http://apollo.backplane.com/DFlyMisc/kcollect03.jpg" rel="nofollow">Sample image generated during a synth run</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.tedunangst.com/flak/post/openbsd-changes-of-note-626" rel="nofollow">openbsd changes of note 626</a></h3>

<ul>
<li>Hackerthon is imminent.</li>
<li>There are two signals one can receive after accessing invalid memory, SIGBUS and SIGSEGV. Nobody seems to know what the difference is or should be, although some theories have been unearthed. Make some attempt to be slightly more consistent and predictable in OpenBSD.</li>
<li>Introduces jiffies in an effort to appease our penguin oppressors.</li>
<li>Clarify that IP.OF.UPSTREAM.RESOLVER is not actually the hostname of a server you can use.</li>
<li>Switch acpibat to use _BIX before _BIF, which means you might see discharge cycle counts, too.</li>
<li>Assorted clang compatibility. clang uses -Oz to mean optimize for size and -Os for something else, so make gcc accept -Oz so all makefiles can be the same. Adjust some hardlinks. Make sure we build gcc with gcc. </li>
<li>The SSL_check_private_key function is a lie.</li>
<li>Switch the amd64 and i386 compiler to clang and see what happens.</li>
<li>We are moving towards using wscons (wstpad) as the driver for touchpads.</li>
<li>Dancing with the stars, er, NET_LOCK().</li>
<li>clang emits lots of warnings. Fix some of them. Turn off a bunch of clang builtins because we have a strong preference that code use our libc versions. Some other changes because clang is not gcc.</li>
<li>Among other curiosities, static variables in the special .openbsd.randomdata are sometimes assumed to be all zero, leading the clang optimizer to eliminate reads of such variables.</li>
<li>Some more pledge rules for sed. If the script doesn’t require opening new files, don’t let it.</li>
<li>Backport a bajillion fixes to stable. Release errata.</li>
<li>RFC 1885 was obsoleted nearly 20 years ago by RFC 2463 which was obsoleted over 10 years ago by RFC 4443. We are probably not going back.</li>
<li>Update libexpat to 2.2.3.</li>
<li>vmm: support more than 3855MB guest memory.</li>
<li>Merge libdrm 2.4.82.</li>
<li>Disable SSE optimizations on i386/amd64 for SlowBcopy. It is supposed to be slow. Prevents crashes when talking to memory mapped video memory in a hypervisor.</li>
</ul>

<hr>

<h3><a href="https://functionallyparanoid.com/2017/08/08/the-25-freedom-laptop/" rel="nofollow">The $25 “FREEDOM Laptop!”</a></h3>

<blockquote>
<p>Time to get back to the original intent of this blog – talking about my paranoid obsession with information security!  So break out your tinfoil hats my friends because this will be a fun ride.  I’m looking for the most open source / freedom respecting portable computing experience I can possibly find and I’m going to document my work in real-time so you will get to experience the ups (and possibly the downs) of that path through the universe.  With that said, let’s get rolling.<br>
When I built my OpenBSD router using the APU2 board, I discovered that there are some amd64 systems that use open source BIOS.  This one used Coreboot and after some investigation I discovered that there was an even more paranoid open source BIOS called Libreboot out there.  That started to feel like it might scratch my itch.<br><br>
Well, after playing around with some lower-powered systems like my APU2 board, my Thinkpad x230 and my SPARC64 boxes, I thought, if it runs amd64 code and I can run an open source operating system on it, the thing should be powerful enough for me to do most (if not all) of what I need it to do.  At this point, I started looking for a viable machine.  From a performance perspective, it looked like the Thinkpad x200, T400, T500 and W500 were all viable candidates.  After paying attention on eBay for a while, I saw something that was either going to be a sweet deal, or a throwaway piece of garbage!<br>
I found a listing for a Thinkpad T500 that said it didn’t come with a power adapter and was 100% untested.  From looking at the photos, it seemed like there was nothing that had been molested about it.  Obviously, nobody was jumping on something this risky so I thought, “what the heck” and dropped a bit at the opening price of $24.99.  Well, guess what.  I won the auction.  Now to see what I got.<br>
When the laptop showed up, I discovered it was minus its hard drive (but the outside plastic cover was still in place).  I plugged in my x230’s power adapter and hit the button.  I got lights and was dropped to the BIOS screen.  To my eternal joy, I discovered that the machine I had purchased for $25 was 100% functional and included the T9400 2.54 GHz Core 2 Duo CPU and the 1680×1050 display panel.  W00t!<br>
First things first, I need to get this machine a hard drive and get the RAM upgraded from the 2GB that it showed up with to 8GB.  Good news is that these two purchases only totaled $50 for the pair.  An aftermarket 9-cell replacement battery was another $20. Throw in a supported WiFi card that doesn’t require a non-free blob from Libreboot at $5.99 off of eBay and $5 for a hard drive caddy and I’m looking at about $65 in additional parts bringing the total cost of the laptop, fully loaded up at just over $100.  Not bad at all…<br>
Once all of the parts arrived and were installed, now for the fun part.  Disassembling the entire thing down to the motherboard so we can re-flash the BIOS with Libreboot.  The guide looks particularly challenging for this but hey, I have a nice set of screwdrivers from iFixit and a remarkable lack of fear when it comes to disassembling things.  Should be fun!<br>
Well, fun didn’t even come close.  I wish I had shot some pictures along the way because at one point I had a heap of parts in one corner of my “workbench” (the dining room table) and just the bare motherboard, minus the CPU sitting in front of me.  With the help of a clip and a bunch of whoops wires (patch cables), I connected my Beaglebone Black to the BIOS chip on the bare motherboard and attempted to read the chip.  #fail<br>
I figured out after doing some more digging that you need to use the connector on the left side of the BBB if you hold it with the power connector facing away from you.  In addition, you should probably read the entire process through instead of stopping at the exciting pinout connector diagram because I missed the bit about the 3.3v power supply need to have ground connected to pin 2 of the BIOS chip.<br>
Speaking of that infamous 3.3v power supply, I managed to bend a paperclip into a U shape and jam it into the connector of an old ATX power supply I had in a closet and source power from that.  I felt like MacGyver for that one!<br>
I was able to successfully read the original Thinkpad BIOS and then flash the Libreboot + Grub2 VESA framebuffer image onto the laptop!  I gulped loudly and started the reassembly process.  Other than having some cable routing difficulties because the replacement WiFi card didn’t have a 5Ghz antenna, it all went back together.  Now for the moment of truth!  I hit the power button and everything worked!!!<br>
At this point I happily scurried to download the latest snapshot of OpenBSD – current and install it.  Well, things got a little weird here.  Looks like I have to use GRUB to boot this machine now and GRUB won’t boot an OpenBSD machine with Full Disk Encryption.  That was a bit of a bummer for me.  I tilted against that windmill for several days and then finally admitted defeat.  So now what to do?  Install Arch?<br>
Well, here’s where I think the crazy caught up to me.  I decided to be an utter sell out and install Ubuntu Gnome Edition 17.04 (since that will be the default DE going forward) with full disk encryption.  I figured I could have fun playing around in a foreign land and try to harden the heck out of that operating system.  I called Ubuntu “grandma’s Linux” because a friend of mine installed it on his mom’s laptop for her but I figured what the heck – let’s see how the other half live!<br>
At this point, while I didn’t have what I originally set out to do – build a laptop with Libreboot and OpenBSD, I did have a nice compromise that is as well hardened as I can possibly make it and very functional in terms of being able to do what I need to do on a day to day basis.  Do I wish it was more portable?  Of course.  This thing is like a six or seven pounder.  However, I feel much more secure in knowing that the vast majority of the code running on this machine is open source and has all the eyes of the community on it, versus something that comes from a vendor that we cannot inspect.  My hope is that someone with the talent (unfortunately I lack those skills) takes an interest in getting FDE working with Libreboot on OpenBSD and I will most happily nuke and repave this “ancient of days” machine to run that!</p>

<hr>
</blockquote>

<h3><a href="https://hothardware.com/news/freebsd-programmers-report-ryzen-smt-bug-that-hangs-or-resets-machines" rel="nofollow">FreeBSD Programmers Report Ryzen SMT Bug That Hangs Or Resets Machines</a></h3>

<blockquote>
<p>It&#39;s starting to look like there&#39;s an inherent bug with AMD&#39;s Zen-based chips that is causing issues on Unix-based operating systems, with both Linux and FreeBSD confirmed. The bug doesn&#39;t just affect Ryzen desktop chips, but also AMD&#39;s enterprise EPYC chips. It seems safe to assume that Threadripper will bundle it in, as well.<br>
It&#39;s not entirely clear what is causing the issue, but it&#39;s related to the CPU being maxed out in operations, thus causing data to get shifted around in memory, ultimately resulting in unstable software. If the bug is exercised a certain way, it can even cause machines to reset.<br>
The revelation about the issue on FreeBSD was posted to the official repository, where the issue is said to happen when threads can lock up, and then cause the system to become unstable. Getting rid of the issue seems as simple as disabling SMT, but that would then negate the benefits provided by having so many threads at-the-ready.<br>
On the Linux side of the Unix fence, Phoronix reports on similar issues, where stressing Zen chips with intensive benchmarks can cause one segmentation fault after another. The issue is so profound, that Phoronix Test Suite developer Michael Larabel introduced a special test that can be run to act as a bit of a proof-of-concept. To test another way, PTS can be run with this command:<br>
<code>PTS_CONCURRENT_TEST_RUNS=4 TOTAL_LOOP_TIME=60 phoronix-test-suite stress-run build-linux-kernel build-php build-apache build-imagemagick</code><br>
Running this command will compile four different software projects at once, over and over, for an hour. Before long, segfaults should begin to appear (as seen in the shot above).<br>
It&#39;s not entirely clear if both sets of issues here are related, but seeing as both involve stressing the CPU to its limit, it seems likely. Whether or not this could be patched on a kernel or EFI level is something yet to be seen.</p>

<hr>
</blockquote>

<h3><a href="https://www.trueos.org/blog/unstable-update-8717/" rel="nofollow">TrueOS - UNSTABLE update: 8/7/17</a></h3>

<ul>
<li><p>A new UNSTABLE update for TrueOS is available!  Released regularly, UNSTABLE updates are the full “rolling release” of TrueOS. UNSTABLE includes experimental features, bugfixes, and other CURRENT FreeBSD work. It is meant to be used by those users interested in using the latest TrueOS and FreeBSD developments to help test and improve these projects.</p>

<blockquote>
<p>WARNING: UNSTABLE updates are released primarily for TrueOS and FreeBSD testing/experimentation purposes. Update and run UNSTABLE “at your own risk”.<br>
Note: There was a CDN issue over the weekend that caused issues for early updaters. Everything appears to be resolved and the update is fully available again. If you encountered instability or package issues from updating on 8/6 or 8/5, roll back to a previous boot environment and run the update again.</p>
</blockquote></li>
<li><p>Changes:</p>

<ul>
<li>UNSTABLE .iso and .img files beginning with TrueOS-2017-08-3-x64 will be available to download from <a href="http://download.trueos.org/unstable/amd64/" rel="nofollow">http://download.trueos.org/unstable/amd64/</a>. Due to CDN issues, these are not quite available, look for them later today or tomorrow (8/8/17). This update resyncs all ports with FreeBSD as of 8.1.2017. This includes: New/updated FreeBSD Kernel and World &amp; New DRM (Direct Rendering Manager) next.</li>
<li>Experimental patch for libhyve-remote: (From htps://github.com/trueos/freebsd/commit/a67a73e49538448629ea27, thanks araujobsd)</li>
</ul></li>
</ul>

<blockquote>
<p>The libhyve-remote aims to abstract functionalities from other third party libraries like libvncserver, freerdp, and spice to be used in hypervisor implementation. With a basic data structure it is easy to implement any remote desktop protocol without digging into the protocol specification or third part libraries – check some of our examples.We don’t statically link any third party library, instead we use a dynamic linker and load only the functionality necessary to launch the service.Our target is to abstract functionalities from libvncserver, freerdp and spice. Right now, libhyve-remote only supports libvncserver. It is possible to launch a VNC server with different screen resolution as well as with authentication.With this patch we implement support for bhyve to use libhyve-remote that basically abstract some functionalities from libvncserver.  We can: Enable wait state, Enable authentication, Enable different resolutions&lt; Have a better compression.  Also, we add a new -s flag for vncserver, if the libhyve-remote library is not present in the system, we fallback to bhyve RFB implementation. For example:<br>
<code>-s 2,fbuf,tcp=0.0.0.0:5937,w=800,h=600,password=1234567,vncserver,wait</code></p>
</blockquote>

<ul>
<li>New SysAdm Client pages under the System Management category: 

<ul>
<li>System Control: This is an interface to browse all the sysctl’s on the system.</li>
<li>Devices: This lists all known information about devices on the designated system.</li>
</ul></li>
<li>Lumina Theming: Lumina is testing new theming functionality! By default (in UNSTABLE), a heavily customized version of the Qt5ct engine is included and enabled. This is intended to allow users to quickly adjust themes/icon packs without needing to log out and back in. This also fixes a bug in Insight with different icons loading for the side and primary windows. Look for more information about this new functionality to be discussed on the Lumina Website.</li>
<li>Update to Iridium Web Browser: Iridium is a Chromium based browser built with user privacy and security as the primary concern, but still maintaining the speed and usability of Chromium. It is now up to date – give it a try and let us know what you think (search for iridium-browser in AppCafe).</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.ghostbsd.org/11.1-ALPHA1" rel="nofollow">GhostBSD 11.1 Alpha1 is ready</a></li>
<li><a href="https://www.meetup.com/CharmBUG/events/242563414/" rel="nofollow">A Special CharmBUG announcement</a></li>
<li><a href="https://github.com/HardenedBSD/hardenedBSD/commit/59eabffdca53275086493836f732f24195f3a91d" rel="nofollow">Byhve Obfuscation Part 1 of Many</a></li>
<li><a href="https://bsdmag.org/download/bsd-magazine-overriding-libc-functions/" rel="nofollow">New BSDMag is out</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2017-August/626190.html" rel="nofollow">git: kernel - Lower VM_MAX_USER_ADDRESS to finalize work-around for Ryzen bug</a></li>
<li><a href="https://twitter.com/_rsc/status/897555509141794817" rel="nofollow">Ken Thompson corrects one of his biggest regrets</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2SQYQV2" rel="nofollow">Hans - zxfer</a></li>
<li><a href="http://dpaste.com/2175GEB" rel="nofollow">Harza - Google Summer of Code</a></li>
<li><a href="http://dpaste.com/154MY1H" rel="nofollow">tadslot - Microphones, Proprietary software, and feedback</a></li>
<li><a href="http://dpaste.com/2V9VFAC" rel="nofollow">Florian - ZFS/Jail</a>

<ul>
<li><a href="http://dan.langille.org/2015/03/11/modifying-a-zfs-root-system-to-a-beadm-layout/" rel="nofollow">Modifying a ZFS root system to a beadm layout</a>
***</li>
</ul></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We read a trip report about FreeBSD in China, look at how Unix deals with Signals, a stats collector in DragonFlyBSD &amp; much more!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/trip-report-freebsd-in-china-at-copu-and-linuxcon/" rel="nofollow">Trip Report: FreeBSD in China at COPU and LinuxCon</a></h3>

<ul>
<li>This trip report is from Deb Goodkin, the Executive Director of the FreeBSD Foundation. She travelled to China in May 2017 to promote FreeBSD, meet with companies, and participate in discussions around Open Source.</li>
<li>&gt; In May of 2017, we were invited to give a talk about FreeBSD at COPU’s (China Open Source Promotional Unit) Open Source China, Open Source World Summit, which took place June 21-22, in Beijing. This was a tremendous opportunity to talk about the advantages of FreeBSD to the open source leaders and organizations interested in open source. I was honored to represent the Project and Foundation and give the presentation “FreeBSD Advantages and Applications”.</li>
<li>&gt; Since I was already going to be in Beijing, and LinuxCon China was being held right before the COPU event, Microsoft invited me to be part of a women-in-tech panel they were sponsoring. There were six of us on the panel including two from Microsoft, one from the Linux Foundation, one from Accenture of China, and one from Women Who Code. Two of us spoke in English, with everyone else speaking Chinese. It was disappointing that we didn’t have translators, because I would have loved hearing everyone’s answers. We had excellent questions from the audience at the end. I also had a chance to talk with a journalist from Beijing, where I emphasized how contributing to an open source project, like FreeBSD, is a wonderful way to get experience to boost your resume for a job.</li>
<li>&gt; The first day of LinuxCon also happened to be FreeBSD Day. I had my posters with me and was thrilled to have the Honorary Chairman of COPU (also known as the “Father of Open Source in China”) hold one up for a photo op. Unfortunately, I haven’t been able to get a copy of that photo for proof (I’m still working on it!). We spent a long time discussing the strengths of FreeBSD. He believes there are many applications in China that could benefit from FreeBSD, especially for embedded devices, university research, and open source education. We had more time throughout the week to discuss FreeBSD in more detail.</li>
<li>&gt; Since I was at LinuxCon, I had a chance to meet with people from the Linux Foundation, other open source projects, and some of our donors. With LinuxCon changing its name to Open Source Summit, I discussed how important it is to include minority voices like ours to contribute to improving the open source ecosystem. The people I talked to within the Linux Foundation agreed and suggested that we get someone from the Project to give a talk at the Open Source Summit in Prague this October. Jim Zemlin, the Linux Foundation Executive Director, suggested having a BSD track at the summits. We did miss the call for proposals for that conference, but we need to get people to consider submitting proposals for the Open Source Summits in 2018.</li>
<li>&gt; I talked to a CTO from a company that donates to us and he brought up his belief that FreeBSD is much easier to get started on as a contributor. He talked about the steep path in Linux to getting contributions accepted due to having over 10,000 developers and the hierarchy of decision makers, from Linus to his main lieutenants to the layers beneath him. It can take 6 months to get your changes in!</li>
<li>&gt; On Tuesday, Kylie and I met with a representative from Huawei, who we’ve been meeting over the phone with over the past few months. Huawei has a FreeBSD contributor and is looking to add more. We were thrilled to hear they decided to donate this year. We look forward to helping them get up to speed with FreeBSD and collaborate with the Project.</li>
<li>&gt; Wednesday marked the beginning of COPU and the reason I flew all the way to Beijing! We started the summit with having a group photo of all the speakers:The honorary chairman, Professor Lu in the front middle.</li>
<li>&gt; My presentation was called “FreeBSD Advantages and Applications”. A lot of the material came from Foundation Board President, George-Neville-Neil’s presentation, “FreeBSD is not a Linux Distribution”, which is a wonderful introduction to FreeBSD and includes the history of FreeBSD, who uses it and why, and which features stand out. My presentation went well, with Professor Lu and others engaged through the translators. Afterwards, I was invited to a VIP dinner, which I was thrilled about.</li>
<li>&gt; The only hitch was that Kylie and I were running a FreeBSD meetup that evening, and both were important! Beijing during rush hour is crazy, even trying to go only a couple of miles is challenging. We made plans that I would go to the meetup and give the same presentation, and then head back to the dinner. Amazingly, it worked out.</li>
<li>Check out the rest of her trip report and stay tuned for more news from the region as this is one of the focus areas of the Foundation. 
***</li>
</ul>

<h3><a href="http://www.networkworld.com/article/3211296/linux/unix-dealing-with-signals.html" rel="nofollow">Unix: Dealing with signals</a></h3>

<blockquote>
<p>Signals on Unix systems are critical to the way processes live and die. This article looks at how they&#39;re generated, how they work, and how processes receive or block them<br>
On Unix systems, there are several ways to send signals to processes—with a kill command, with a keyboard sequence (like control-C), or through a program<br>
Signals are also generated by hardware exceptions such as segmentation faults and illegal instructions, timers and child process termination.<br>
But how do you know what signals a process will react to? After all, what a process is programmed to do and able to ignore is another issue.<br>
Fortunately, the /proc file system makes information about how processes handle signals (and which they block or ignore) accessible with commands like the one shown below. In this command, we’re looking at information related to the login shell for the current user, the &quot;$$&quot; representing the current process.</p>
</blockquote>

<ul>
<li>On FreeBSD, you can use <em>procstat -i PID</em> to get that and even more information, and easier to digest form</li>
</ul>

<blockquote>
<blockquote>
<pre><code>        P  if signal is pending in the global process queue
        I  if signal delivery disposition is SIGIGN
        C  if signal delivery is to catch it
</code></pre>

<p>Catching a signal requires that a signal handling function exists in the process to handle a given signal. The SIGKILL (9) and SIGSTOP (#) signals cannot be ignored or caught. For example, if you wanted to tell the kernel that ctrl-C&#39;s are to be ignored, you would include something like this in your source code:<br>
signal(SIGINT, SIG_IGN);<br>
To ensure that the default action for a signal is taken, you would do something like this instead:<br>
signal(SIGSEGV, SIG_DFL);</p>

<ul>
<li>The article then shows some ways to send signals from the command line, for example to send SIGHUP to a process with pid 1234:
kill -HUP 1234</li>
<li>You can get a list of the different signals by running
kill -l
On Unix systems, signals are used to send all kinds of information to running processes, and they come from user commands, other processes, and the kernel itself. Through /proc, information about how processes are handling signals is now easily accessible and, with just a little manipulation of the data, easy to understand.
***</li>
</ul>
</blockquote>
</blockquote>

<h3><a href="https://smartos.org/bugview/OS-6274" rel="nofollow">links owned by NGZ erroneously marked as on loan</a></h3>

<ul>
<li>NGZ (Non-Global Zone), is IllumOS speak for their equivalent to a jail
&gt; As reported by user brianewell in smartos-live#737, NGZ ip tunnels stopped persisting across zone reboot. This behavior appeared in the 20170202 PI and was not present in previous releases. After much spelunking I determined that this was caused by a regression introduced in commit 33df115 (part of the OS-5363 work). The regression was a one-line change to link_activate() which marks NGZ links as on loan when they are in fact not loaned because the NGZ created and owns the link.</li>
<li>“On loan” means the interface belongs to the host (GZ, Global Zone), and has been loaned to the NGZ (Jail)</li>
</ul>

<blockquote>
<p>This regression was easy to introduce because of the subtle nature of this code and lack of comments. I&#39;m going to remove the regressive line, add clarifying comments, and also add some asserts.<br>
The following is a detailed analysis of the issue, how I debugged it, and why my one-line change caused the regression:<br>
To start I verified that PI 20170119 work as expected:<br>
    booted 20170119<br>
   created iptun (named v4_sys76) inside of a native NGZ (names sos-zone)<br>
   performed a reboot of sos-zone<br>
   zlogin to sos-zone and verify iptun still exists after reboot<br>
Then I booted the GZ into PI 20170202 and verified the iptun did not show up<br>
   booted 20170202<br>
   started sos-zone<br>
   zlogin and verified the iptun was missing<br>
At this point I thought I would recreate the iptun and see if I could monitor the zone halt/boot process for the culprit, but instead I received an error from dladm: &quot;object already exists&quot;.<br>
I didn&#39;t expect this. So I used mdb to inspect the dlmgmtd state. Sure enough the iptun exists in dlmgmtd.<br>
Okay, so if the link already exists, why doesn&#39;t it show up (in either the GZ or the NGZ)?<br>
If a link is not marked as active then it won&#39;t show up when you query dladm. When booting the zone on 20170119 the ll_flags for the iptun contained the value 0x3. So the problem is the link is not marked as active on the 20170202 PI.<br>
The link_activate() function is responsible for marking a link as active. I used dtrace to verify this function was called on the 20170202 PI and that the dlmgmt_link_t had the correct ll_flags value.<br>
So the iptun link structure has the correct ll_flags when link_activate() returns but when I inspect the same structure with mdb afterwards the value has changed.<br>
Sometime after link_activate() completes some other process changed the ll_flags value. My next question was: where is link_activate() called and what comes after it that might affect the ll_flags? I did another trace and got this stack.<br>
The dlmgmt_upid() function calls dlmgmt_write_db_entry() after link_activate() and that can change the flags. But dtrace proved the ll_flags value was still 0x3 after returning from this function.<br>
With no obvious questions left I then asked cscope to show me all places where ll_flags is modified. As I walked through the list I used dtrace to eliminate candidates one at a time -- until I reached dlmgmt_destroy_common(). I would not have expected this function to show up during zone boot but sure enough it was being called somehow, and by someone. Who?<br>
Since there is no easy way to track door calls it was at this point I decided to go nuclear and use the dtrace stop action to stop dlmgmtd when it hits dlmgmt_destroy_common(). Then I used mdb -k to inspect the door info for the dlmgmtd threads and look for my culprit.<br>
The culprit is do_up_iptun() caused by the dladm up-iptun call. Using ptree I then realized this was happening as part of the zone boot under the network/iptun svc startup. At this point it was a matter of doing a zlogin to sos-zone and running truss on dladm up-iptun to find the real reason why dladm_destroy_datalink_id() is called.<br>
So the link is marked as inactive because dladm_getsnap_conf() fails with DLADM_STATUS_DENIED which is mapped to EACCESS. Looking at the dladm_getsnap_conf() code I see the following</p>
</blockquote>

<ul>
<li>“The caller is in a non-global zone and the persistent configuration belongs to the global zone.”</li>
</ul>

<blockquote>
<p>What this is saying is that if a link is marked &quot;on loan&quot; (meaning it&#39;s technically owned/created by the GZ but assigned/loaned to the NGZ) and the zone calling dladm_getsnap_conf() is an NGZ then return EACCESS because the configuration of the link is up to the GZ, not the NGZ. This code is correct and should be enforced, but why is it tripping in PI 20170202 and not 20170119? It comes back to my earlier observation that in the 20170202 PI we marked the iptun as &quot;on loan&quot; but not in the older one. Why?<br>
Well as it turns out while fixing OS-5363 I fixed what I thought was a bug in link_activate()<br>
When I first read this code it was my understanding that anytime we added a link to a zone&#39;s datalink list, by calling zone_add_datalink(), that link was then considered &quot;on loan&quot;. My understanding was incorrect. The link_activate() code has a subtleness that eluded me. There are two cases in link_activate():</p>

<ol>
<li>The link is under an NGZ&#39;s datalink list but it&#39;s ll_linkid doesn&#39;t reflect that (e.g., the link is found under zoneid 3 but ll_linkid is 0). In this case the link is owned by the GZ but is being loaned to an NGZ and the link state should be updated accordingly. We get in this situation when dlmgmtd is restated for some reason (it must resync it&#39;s in-memory state with the state of the system).</li>
<li>The link is NOT under any NGZ&#39;s (zone_check_datalink() is only concerned with NGZs) datalink list but its ll_zoneid holds the value of an NGZ. This indicates that the link is owned by an NGZ but for whatever reason is not currently under the NGZ&#39;s datalink list (e.g., because we are booting the zone and we now need to assign the link to its list).
So the fix is to revert that one line change as well as add some clarifying comments and also some asserts to prevent further confusion in the future.</li>
<li>A nice breakdown by Ryan Zezeski of how he accidently introduced a regression, and how he tracked it down using dtrace and mdb
***</li>
</ol>
</blockquote>

<h3><a href="http://dpaste.com/2YP0X9C" rel="nofollow">New experimental statistics collector in master</a></h3>

<blockquote>
<p>Master now has an in-kernel statistics collector which is enabled by default, and a (still primitive) user land program to access it.  This recorder samples the state of the machine once every 10 seconds and records it in a large FIFO, all in-kernel.  The FIFO typically contains 8192 entries, or around the last 23 hours worth of data.<br>
Statistics recorded include current load, user/sys/idle cpu use, swap use, VM fault rate, VM memory statistics, and counters for syscalls, path lookups, and various interrupt types.  A few more useful counters will probably be added... I&#39;d like to tie cpu temperature, fork rate, and exec rate in at some point, as well as network and disk traffic.<br>
The statistics gathering takes essentially no real overhead and is always on, so any user at the spur of the moment with no prior intent can query the last 23 hours worth of data.<br>
There is a user frontend to the data called &#39;kcollect&#39; (its tied into the buildworld now).  Currently still primitive.  Ultimately my intention is to integrate it with a dbm database for long-term statistical data retention (if desired) using an occasional (like once-an-hour) cron-job to soak up anything new, with plenty of wiggle room due to the amount of time the kernel keeps itself.  This is better and less invasive than having a userland statistics gathering script running every few minutes from cron and has the advantage of giving you a lot of data on the spur of the moment without having to ask for it before-hand.<br>
If you have gnuplot installed (pkg install gnuplot), kcollect can generate some useful graphs based on the in-kernel data.  Well, it will be boring if the machine isn&#39;t doing anything :-).  There are options to use gnuplot to generate a plot window in X or a .jpg or .png file, and other options to set the width and height and such.  At the moment the gnuplot output uses a subset of statically defined fields to plot but ultimately the field list it uses will be specifiable.</p>
</blockquote>

<ul>
<li><a href="http://apollo.backplane.com/DFlyMisc/kcollect03.jpg" rel="nofollow">Sample image generated during a synth run</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.tedunangst.com/flak/post/openbsd-changes-of-note-626" rel="nofollow">openbsd changes of note 626</a></h3>

<ul>
<li>Hackerthon is imminent.</li>
<li>There are two signals one can receive after accessing invalid memory, SIGBUS and SIGSEGV. Nobody seems to know what the difference is or should be, although some theories have been unearthed. Make some attempt to be slightly more consistent and predictable in OpenBSD.</li>
<li>Introduces jiffies in an effort to appease our penguin oppressors.</li>
<li>Clarify that IP.OF.UPSTREAM.RESOLVER is not actually the hostname of a server you can use.</li>
<li>Switch acpibat to use _BIX before _BIF, which means you might see discharge cycle counts, too.</li>
<li>Assorted clang compatibility. clang uses -Oz to mean optimize for size and -Os for something else, so make gcc accept -Oz so all makefiles can be the same. Adjust some hardlinks. Make sure we build gcc with gcc. </li>
<li>The SSL_check_private_key function is a lie.</li>
<li>Switch the amd64 and i386 compiler to clang and see what happens.</li>
<li>We are moving towards using wscons (wstpad) as the driver for touchpads.</li>
<li>Dancing with the stars, er, NET_LOCK().</li>
<li>clang emits lots of warnings. Fix some of them. Turn off a bunch of clang builtins because we have a strong preference that code use our libc versions. Some other changes because clang is not gcc.</li>
<li>Among other curiosities, static variables in the special .openbsd.randomdata are sometimes assumed to be all zero, leading the clang optimizer to eliminate reads of such variables.</li>
<li>Some more pledge rules for sed. If the script doesn’t require opening new files, don’t let it.</li>
<li>Backport a bajillion fixes to stable. Release errata.</li>
<li>RFC 1885 was obsoleted nearly 20 years ago by RFC 2463 which was obsoleted over 10 years ago by RFC 4443. We are probably not going back.</li>
<li>Update libexpat to 2.2.3.</li>
<li>vmm: support more than 3855MB guest memory.</li>
<li>Merge libdrm 2.4.82.</li>
<li>Disable SSE optimizations on i386/amd64 for SlowBcopy. It is supposed to be slow. Prevents crashes when talking to memory mapped video memory in a hypervisor.</li>
</ul>

<hr>

<h3><a href="https://functionallyparanoid.com/2017/08/08/the-25-freedom-laptop/" rel="nofollow">The $25 “FREEDOM Laptop!”</a></h3>

<blockquote>
<p>Time to get back to the original intent of this blog – talking about my paranoid obsession with information security!  So break out your tinfoil hats my friends because this will be a fun ride.  I’m looking for the most open source / freedom respecting portable computing experience I can possibly find and I’m going to document my work in real-time so you will get to experience the ups (and possibly the downs) of that path through the universe.  With that said, let’s get rolling.<br>
When I built my OpenBSD router using the APU2 board, I discovered that there are some amd64 systems that use open source BIOS.  This one used Coreboot and after some investigation I discovered that there was an even more paranoid open source BIOS called Libreboot out there.  That started to feel like it might scratch my itch.<br><br>
Well, after playing around with some lower-powered systems like my APU2 board, my Thinkpad x230 and my SPARC64 boxes, I thought, if it runs amd64 code and I can run an open source operating system on it, the thing should be powerful enough for me to do most (if not all) of what I need it to do.  At this point, I started looking for a viable machine.  From a performance perspective, it looked like the Thinkpad x200, T400, T500 and W500 were all viable candidates.  After paying attention on eBay for a while, I saw something that was either going to be a sweet deal, or a throwaway piece of garbage!<br>
I found a listing for a Thinkpad T500 that said it didn’t come with a power adapter and was 100% untested.  From looking at the photos, it seemed like there was nothing that had been molested about it.  Obviously, nobody was jumping on something this risky so I thought, “what the heck” and dropped a bit at the opening price of $24.99.  Well, guess what.  I won the auction.  Now to see what I got.<br>
When the laptop showed up, I discovered it was minus its hard drive (but the outside plastic cover was still in place).  I plugged in my x230’s power adapter and hit the button.  I got lights and was dropped to the BIOS screen.  To my eternal joy, I discovered that the machine I had purchased for $25 was 100% functional and included the T9400 2.54 GHz Core 2 Duo CPU and the 1680×1050 display panel.  W00t!<br>
First things first, I need to get this machine a hard drive and get the RAM upgraded from the 2GB that it showed up with to 8GB.  Good news is that these two purchases only totaled $50 for the pair.  An aftermarket 9-cell replacement battery was another $20. Throw in a supported WiFi card that doesn’t require a non-free blob from Libreboot at $5.99 off of eBay and $5 for a hard drive caddy and I’m looking at about $65 in additional parts bringing the total cost of the laptop, fully loaded up at just over $100.  Not bad at all…<br>
Once all of the parts arrived and were installed, now for the fun part.  Disassembling the entire thing down to the motherboard so we can re-flash the BIOS with Libreboot.  The guide looks particularly challenging for this but hey, I have a nice set of screwdrivers from iFixit and a remarkable lack of fear when it comes to disassembling things.  Should be fun!<br>
Well, fun didn’t even come close.  I wish I had shot some pictures along the way because at one point I had a heap of parts in one corner of my “workbench” (the dining room table) and just the bare motherboard, minus the CPU sitting in front of me.  With the help of a clip and a bunch of whoops wires (patch cables), I connected my Beaglebone Black to the BIOS chip on the bare motherboard and attempted to read the chip.  #fail<br>
I figured out after doing some more digging that you need to use the connector on the left side of the BBB if you hold it with the power connector facing away from you.  In addition, you should probably read the entire process through instead of stopping at the exciting pinout connector diagram because I missed the bit about the 3.3v power supply need to have ground connected to pin 2 of the BIOS chip.<br>
Speaking of that infamous 3.3v power supply, I managed to bend a paperclip into a U shape and jam it into the connector of an old ATX power supply I had in a closet and source power from that.  I felt like MacGyver for that one!<br>
I was able to successfully read the original Thinkpad BIOS and then flash the Libreboot + Grub2 VESA framebuffer image onto the laptop!  I gulped loudly and started the reassembly process.  Other than having some cable routing difficulties because the replacement WiFi card didn’t have a 5Ghz antenna, it all went back together.  Now for the moment of truth!  I hit the power button and everything worked!!!<br>
At this point I happily scurried to download the latest snapshot of OpenBSD – current and install it.  Well, things got a little weird here.  Looks like I have to use GRUB to boot this machine now and GRUB won’t boot an OpenBSD machine with Full Disk Encryption.  That was a bit of a bummer for me.  I tilted against that windmill for several days and then finally admitted defeat.  So now what to do?  Install Arch?<br>
Well, here’s where I think the crazy caught up to me.  I decided to be an utter sell out and install Ubuntu Gnome Edition 17.04 (since that will be the default DE going forward) with full disk encryption.  I figured I could have fun playing around in a foreign land and try to harden the heck out of that operating system.  I called Ubuntu “grandma’s Linux” because a friend of mine installed it on his mom’s laptop for her but I figured what the heck – let’s see how the other half live!<br>
At this point, while I didn’t have what I originally set out to do – build a laptop with Libreboot and OpenBSD, I did have a nice compromise that is as well hardened as I can possibly make it and very functional in terms of being able to do what I need to do on a day to day basis.  Do I wish it was more portable?  Of course.  This thing is like a six or seven pounder.  However, I feel much more secure in knowing that the vast majority of the code running on this machine is open source and has all the eyes of the community on it, versus something that comes from a vendor that we cannot inspect.  My hope is that someone with the talent (unfortunately I lack those skills) takes an interest in getting FDE working with Libreboot on OpenBSD and I will most happily nuke and repave this “ancient of days” machine to run that!</p>

<hr>
</blockquote>

<h3><a href="https://hothardware.com/news/freebsd-programmers-report-ryzen-smt-bug-that-hangs-or-resets-machines" rel="nofollow">FreeBSD Programmers Report Ryzen SMT Bug That Hangs Or Resets Machines</a></h3>

<blockquote>
<p>It&#39;s starting to look like there&#39;s an inherent bug with AMD&#39;s Zen-based chips that is causing issues on Unix-based operating systems, with both Linux and FreeBSD confirmed. The bug doesn&#39;t just affect Ryzen desktop chips, but also AMD&#39;s enterprise EPYC chips. It seems safe to assume that Threadripper will bundle it in, as well.<br>
It&#39;s not entirely clear what is causing the issue, but it&#39;s related to the CPU being maxed out in operations, thus causing data to get shifted around in memory, ultimately resulting in unstable software. If the bug is exercised a certain way, it can even cause machines to reset.<br>
The revelation about the issue on FreeBSD was posted to the official repository, where the issue is said to happen when threads can lock up, and then cause the system to become unstable. Getting rid of the issue seems as simple as disabling SMT, but that would then negate the benefits provided by having so many threads at-the-ready.<br>
On the Linux side of the Unix fence, Phoronix reports on similar issues, where stressing Zen chips with intensive benchmarks can cause one segmentation fault after another. The issue is so profound, that Phoronix Test Suite developer Michael Larabel introduced a special test that can be run to act as a bit of a proof-of-concept. To test another way, PTS can be run with this command:<br>
<code>PTS_CONCURRENT_TEST_RUNS=4 TOTAL_LOOP_TIME=60 phoronix-test-suite stress-run build-linux-kernel build-php build-apache build-imagemagick</code><br>
Running this command will compile four different software projects at once, over and over, for an hour. Before long, segfaults should begin to appear (as seen in the shot above).<br>
It&#39;s not entirely clear if both sets of issues here are related, but seeing as both involve stressing the CPU to its limit, it seems likely. Whether or not this could be patched on a kernel or EFI level is something yet to be seen.</p>

<hr>
</blockquote>

<h3><a href="https://www.trueos.org/blog/unstable-update-8717/" rel="nofollow">TrueOS - UNSTABLE update: 8/7/17</a></h3>

<ul>
<li><p>A new UNSTABLE update for TrueOS is available!  Released regularly, UNSTABLE updates are the full “rolling release” of TrueOS. UNSTABLE includes experimental features, bugfixes, and other CURRENT FreeBSD work. It is meant to be used by those users interested in using the latest TrueOS and FreeBSD developments to help test and improve these projects.</p>

<blockquote>
<p>WARNING: UNSTABLE updates are released primarily for TrueOS and FreeBSD testing/experimentation purposes. Update and run UNSTABLE “at your own risk”.<br>
Note: There was a CDN issue over the weekend that caused issues for early updaters. Everything appears to be resolved and the update is fully available again. If you encountered instability or package issues from updating on 8/6 or 8/5, roll back to a previous boot environment and run the update again.</p>
</blockquote></li>
<li><p>Changes:</p>

<ul>
<li>UNSTABLE .iso and .img files beginning with TrueOS-2017-08-3-x64 will be available to download from <a href="http://download.trueos.org/unstable/amd64/" rel="nofollow">http://download.trueos.org/unstable/amd64/</a>. Due to CDN issues, these are not quite available, look for them later today or tomorrow (8/8/17). This update resyncs all ports with FreeBSD as of 8.1.2017. This includes: New/updated FreeBSD Kernel and World &amp; New DRM (Direct Rendering Manager) next.</li>
<li>Experimental patch for libhyve-remote: (From htps://github.com/trueos/freebsd/commit/a67a73e49538448629ea27, thanks araujobsd)</li>
</ul></li>
</ul>

<blockquote>
<p>The libhyve-remote aims to abstract functionalities from other third party libraries like libvncserver, freerdp, and spice to be used in hypervisor implementation. With a basic data structure it is easy to implement any remote desktop protocol without digging into the protocol specification or third part libraries – check some of our examples.We don’t statically link any third party library, instead we use a dynamic linker and load only the functionality necessary to launch the service.Our target is to abstract functionalities from libvncserver, freerdp and spice. Right now, libhyve-remote only supports libvncserver. It is possible to launch a VNC server with different screen resolution as well as with authentication.With this patch we implement support for bhyve to use libhyve-remote that basically abstract some functionalities from libvncserver.  We can: Enable wait state, Enable authentication, Enable different resolutions&lt; Have a better compression.  Also, we add a new -s flag for vncserver, if the libhyve-remote library is not present in the system, we fallback to bhyve RFB implementation. For example:<br>
<code>-s 2,fbuf,tcp=0.0.0.0:5937,w=800,h=600,password=1234567,vncserver,wait</code></p>
</blockquote>

<ul>
<li>New SysAdm Client pages under the System Management category: 

<ul>
<li>System Control: This is an interface to browse all the sysctl’s on the system.</li>
<li>Devices: This lists all known information about devices on the designated system.</li>
</ul></li>
<li>Lumina Theming: Lumina is testing new theming functionality! By default (in UNSTABLE), a heavily customized version of the Qt5ct engine is included and enabled. This is intended to allow users to quickly adjust themes/icon packs without needing to log out and back in. This also fixes a bug in Insight with different icons loading for the side and primary windows. Look for more information about this new functionality to be discussed on the Lumina Website.</li>
<li>Update to Iridium Web Browser: Iridium is a Chromium based browser built with user privacy and security as the primary concern, but still maintaining the speed and usability of Chromium. It is now up to date – give it a try and let us know what you think (search for iridium-browser in AppCafe).</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.ghostbsd.org/11.1-ALPHA1" rel="nofollow">GhostBSD 11.1 Alpha1 is ready</a></li>
<li><a href="https://www.meetup.com/CharmBUG/events/242563414/" rel="nofollow">A Special CharmBUG announcement</a></li>
<li><a href="https://github.com/HardenedBSD/hardenedBSD/commit/59eabffdca53275086493836f732f24195f3a91d" rel="nofollow">Byhve Obfuscation Part 1 of Many</a></li>
<li><a href="https://bsdmag.org/download/bsd-magazine-overriding-libc-functions/" rel="nofollow">New BSDMag is out</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2017-August/626190.html" rel="nofollow">git: kernel - Lower VM_MAX_USER_ADDRESS to finalize work-around for Ryzen bug</a></li>
<li><a href="https://twitter.com/_rsc/status/897555509141794817" rel="nofollow">Ken Thompson corrects one of his biggest regrets</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2SQYQV2" rel="nofollow">Hans - zxfer</a></li>
<li><a href="http://dpaste.com/2175GEB" rel="nofollow">Harza - Google Summer of Code</a></li>
<li><a href="http://dpaste.com/154MY1H" rel="nofollow">tadslot - Microphones, Proprietary software, and feedback</a></li>
<li><a href="http://dpaste.com/2V9VFAC" rel="nofollow">Florian - ZFS/Jail</a>

<ul>
<li><a href="http://dan.langille.org/2015/03/11/modifying-a-zfs-root-system-to-a-beadm-layout/" rel="nofollow">Modifying a ZFS root system to a beadm layout</a>
***</li>
</ul></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>208: Faces of Open Source</title>
  <link>https://www.bsdnow.tv/208</link>
  <guid isPermaLink="false">a6ed38b0-4c78-4bf0-98ca-10b38ac0ff3f</guid>
  <pubDate>Wed, 23 Aug 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a6ed38b0-4c78-4bf0-98ca-10b38ac0ff3f.mp3" length="60847636" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>DragonflyBSD 4.8.1 has been released, we explore how the X11 clipboard works, and look at OpenBSD gaming resources.</itunes:subtitle>
  <itunes:duration>1:24:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>DragonflyBSD 4.8.1 has been released, we explore how the X11 clipboard works, and look at OpenBSD gaming resources.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
LLVM, Clang and compiler-rt support enhancements (https://blog.netbsd.org/tnf/entry/llvm_clang_and_compiler_rt)
In the last month I started with upstream of the code for sanitizers: the common layer and ubsan. I worked also on the elimination of unexpected failures in LLVM and Clang. I've managed to achieve, with a pile of local patches, the number of 0 unexpected bugs within LLVM (check-llvm) and 3 unexpected bugs within Clang (check-clang) (however these ones were caused by hardcoded environment -lstdc++ vs -lc++). The number of failures in sanitizers (check-sanitizer) is also low, it's close to zero.
LLVM
In order to achieve the goals of testability concerning the LLVM projects, I had to prepare a new pkgsrc-wip package called llvm-all-in-one that contains 12 active LLVM projects within one tree. The set of these projects is composed of: llvm, clang, compiler-rt, libcxx, libcxxabi, libunwind, test-suite, openmp, llgo, lld, lldb, clang-tools-extra. These were required to build and execute test-suites in the LLVM's projects. Ideally the tests should work in standalone packages - built out-of-LLVM-sources - and with GCC/Clang, however the real life is less bright and this forced me to use Clang as the system compiler an all-in-one package in order to develop the work environment with the ability to build and execute unit tests.
There were four threads within LLVM:
Broken std::callonce with libstdc++. This is an old and well-known bug, which was usually worked around with a homegrown implementation llvm::callonce. I've discovered that the llvm::callonce workaround isn't sufficient for the whole LLVM functionality, as std::callonce can be called internally inside the libstdc++ libraries - like within the C++11 futures interface. This bug has been solved by Joerg Sonnenberger in the ELF dynamic linker.
Unportable shell construct hardcoded in tests "&amp;gt;&amp;amp;". This has been fixed upstream.
LLVM JIT. The LLVM Memory generic allocator (or page mapper) was designed to freely map pages with any combination of the protection bits: R,W,X. This approach breaks on NetBSD with PaX MPROTECT and requires redesign of the interfaces. This is the continuation of the past month AllocateRWX and ReleaseRWX compatibility with NetBSD improvements. I've prepared few variations of local patches addressing these issues and it's still open for discussion with upstream. My personal preference is to remove the current API entirely and introduce a newer one with narrowed down functionality to swap between readable (R--), writable (RW-) and executable (R-X) memory pages. This would effectively enforce W^X.
Sanitizers support. Right now, I keep the patches locally in order to upstream the common sanitizer code in compiler-rt.
The LLVM JIT API is the last cause of unexpected failures in check-llvm. This breaks MCJIT, ORCJIT and ExecutionEngine libraries and causes around 200 unexpected failures within tests.
Clang
I've upstreamed a patch that enables ubsan and asan on Clang's frontend for NetBSD/amd64. This support isn't complete, and requires sanitizers' support code upstreamed to compiler-rt.
compiler-rt
The current compiler-rt tasks can be divided into:
upstream sanitizer common code shared with POSIX platforms
upstream sanitizer common code shared with Linux and FreeBSD
upstream sanitizer common code shared with FreeBSD
upstream sanitizer common code specific to NetBSD
build, execute and pass tests for sanitizer common code in check-santizer
This means that ubsan, asan and the rest of the specific sanitizers wait in queue.
All the mentioned tasks are being worked on simultaneously, with a soft goal to finish them one after another from the first to the last one.
The last point with check-sanitizer unveiled so far two generic bugs on NetBSD: 
Return errno EFAULT instead of EACCES on memory fault with read(2)/write(2)-like syscalls.
Honor PTHREADDESTRUCTORITERATIONS in libpthread.
These bugs are not strictly real bugs, but they were introducing needless differences with other modern POSIX systems. The fixes were introduced by Christos Zoulas and backported to NetBSD-8.
Plan for the next milestone
I have decided not to open new issues in with the coming month and focus on upstreaming the remaining LLVM code. The roadmap for the next month is to continue working on the goals of the previous months. std::call_once is an example that every delayed bug keeps biting again and again in future.
LLVM 5.0.0 is planned to be released this month (August) and there is a joint motivation with the upstream maintainer to push compatibility fixes for LLVM JIT. There is an option to submit a workaround now and introduce refactoring for the trunk and next version (6.0.0).
This work was sponsored by The NetBSD Foundation.
The NetBSD Foundation is a non-profit organization and welcomes any donations to help us continue funding projects and services to the open-source community. Please consider visiting the following URL, and chip in what you can: http://netbsd.org/donations/#how-to-donate
***
DragonFly BSD 4.8.1 released (http://lists.dragonflybsd.org/pipermail/commits/2017-August/626150.html)
+Updates by dev:
+ Antonio Huete Jimenez (1):
 + libc/gmon: Replace sbrk() with mmap()
+ Francois Tigeot (3):
 + drm: bring in Linux compability changes from master
 + drm/linux: make flushwork() more robust
 + drm/i915: Update to Linux 4.7.10
+ Imre VadÃ¡sz (4):
 + drm - Fix hrtimer, don't reset timer-&amp;gt;function to NULL in timeout handler.
 + sound - Delete devfs clone handler for /dev/dsp and /dev/mixer on unload.
 + ifvtnet - Allocate struct vtnettxheader entries from a queue.
 + Make sure that cam(4)'s dashutdown handler runs before DEVICESHUTDOWN().
+ Matthew Dillon (24):
 + kernel - MFC b48dd28447fc (sigtramp workaround)
 + kernel - Fix deadlock in sound system
 + kernel - Fix broken wakeup in crypto code
 + kernel - Add KERNPROCSIGTRAMP
 + gcc - Adjust the unwind code to use the new sigtramp probe sysctl
 + kernel - Implement NX
 + kernel - Implement NX (2)
 + kernel - Implement machdep.pmapnxenable TUNABLE
 + kernel - Implement NX (3) - cleanup
 + kernel - Temporarily set the default machdep.pmapnxenable to 0
 + param - Change _DragonFlyversion to 400801
 + kernel - Fix i915 deadlock
 + pthreads - Change PTHREADSTACKMIN
 + libc - Fix bug in rcmdsh()
 + ppp - Fix minor overflow in protocol search
 + libtelnet - Fix improper statement construction (not a bug in the binary)
 + libdevstat - Limit sscanf field, fix redundant condition
 + openssh - Fix a broken assignment
 + window - Fix Graphics capability enable test
 + kernel - Fix event preset
 + mfiutil - Fix static buffer overflow
 + mixer - Fix sscanf() overflow
 + gcore - fix overflow in sscanf
 + kernel - Fix improper parens
+ Sascha Wildner (17):
 + libkvm: Fix char pointer dereference.
 + Fix some cases where an index was used before its limits check.
 + Really ensure that our world/kernel are built under POSIX locale ("C").
 + zoneinfo: Create a /usr/share/zoneinfo/UTC link.
 + kernel/cam: Add CAMSCSIITNEXUSLOST (in preparation for virtioscsi(4)).
 + kernel: Add FreeBSD's virtioscsi(4) driver.
 + ccdconfig(8): Add missing free().
 + libpuffs: Fix two asserts.
 + kernel/acpi: Untangle the wakecode generation during buildkernel.
 + kernel/acpica: Better check AcpiOsPredefinedOverride()'s InitVal argument
 + kernel/acpica: ACPITHREADID is unsigned.
 + kernel/acpica: Return curthread as thread id from AcpiOsGetThreadId().
 + kernel/acpica: Remove no longer needed #include.
 + kernel/acpi: Call AcpiInitializeSubsystem() before AcpiInitializeTables().
 + kernel/urtwn: Add missing braces.
 + kernel/ieee80211: Add missing braces.
 + libthreadxu: Fix checking of pthreadbarrierinit()'s count argument.
+ Sepherosa Ziehau (7):
 + sound/hda: Sync device ID table with FreeBSD
 + inet6: Restore mbuf hash after defragmentation.
 + pf: Normalized, i.e. defragged, packets requiring rehash.
 + em: Enable MSI by default on devices has PCI advanced features capability.
 + sched: Change CPU_SETSIZE to signed int, same as FreeBSD/Linux.
 + usched: Allow process to change self cpu affinity
 + ix: Fixup TX/RX ring settings for X550, which supports 64/64 TX/RX rings.
+ zrj (1):
 + Revert "Always use unix line endings"
Porting Unix to the 386: A Practical Approach (http://www.informatica.co.cr/unix-source-code/research/1991/0101.html)
The University of California's Berkeley Software Distribution (BSD) has been the catalyst for much of the innovative work done with the UNIX operating system in both the research and commercial sectors. Encompassing over 150 Mbytes (and growing) of cutting-edge operating systems, networking, and applications software, BSD is a fully functional and nonproprietary complete operating systems software distribution (see Figure 1). In fact, every version of UNIX available from every vendor contains at least some Berkeley UNIX code, particularly in the areas of filesystems and networking technologies. However, unless one could pay the high cost of site licenses and equipment, access to this software was simply not within the means of most individual programmers and smaller research groups.
The 386BSD project was established in the summer of 1989 for the specific purpose of porting BSD to the Intel 80386 microprocessor platform so that the tools this software offers can be made available to any programmer or research group with a 386 PC. In coordination with the Computer Systems Research Group (CSRG) at the University of California at Berkeley, we successively ported a basic research system to a common AT class machine (see, Figure 2), with the result that approximately 65 percent of all 32-bit systems could immediately make use of this new definition of UNIX. We have been refining and improving this base port ever since.
By providing the base 386BSD port to CSRG, our hope is to foster new interest in Berkeley UNIX technology and to speed its acceptance and use worldwide. We hope to see those interested in this technology build on it in both commercial and noncommercial ventures.
In this and following articles, we will examine the key aspects of software, strategy, and experience that encompassed a project of this magnitude. We intend to explore the process of the 386BSD port, while learning to effectively exploit features of the 386 architecture for use with an advanced operating system. We also intend to outline some of the tradeoffs in implementation goals which must be periodically reexamined. Finally, we will highlight extensions which remain for future work, perhaps to be done by some of you reading this article today. Note that we are assuming familiarity with UNIX, its concepts and structures, and the basic functions of the 386, so we will not present exhaustive coverage of these areas.
In this installment, we discuss the beginning of our project and the initial framework that guided our efforts, in particular, the development of the 386BSD specification. Future articles will address specific topics of interest and actual nonproprietary code fragments used in 386BSD. Among the future areas to be covered are:
386BSD process context switching
Executing the first 386BSD process on the PC
386BSD kernel interrupt and exception handling
386BSD INTERNET networking
ISA device drivers and system support
386BSD bootstrap process
***
X11: How does “the” clipboard work (https://www.uninformativ.de/blog/postings/2017-04-02/0/POSTING-en.html)
&amp;gt; If you have used another operating system before you switched to something that runs X11, you will have noticed that there is more than one clipboard:
&amp;gt; Sometimes, you can use the mouse to select some text, switch to another window, and then hit the middle mouse button to paste text.
&amp;gt; Sometimes, you can select text, then hit some hotkey, e.g. Ctrl+C, switch to another window, hit another hotkey, e.g. Ctrl+V, and paste said text.
&amp;gt; Sometimes, you can do both.
&amp;gt; Selections as a form of IPC
First things first, in X11 land, “clipboards” are called “selections”.
Yes, there is more than one selection and they all work independently. In fact, you can use as many selections as you wish. In theory, that is. When using selections, you make different clients communicate with each other. This means that those clients have to agree on which selections to use. You can’t just invent your own selection and then expect Firefox to be compatible with it.
How are selections identified?
There are three “standard” selection names:
PRIMARY: The “middle mouse clipboard”
SECONDARY: Virtually unused these days
CLIPBOARD: The “Ctrl+C clipboard”
Program 1: Query selection owners
Content type and conversion
Program 2: Get clipboard as UTF-8
Program 3: Owning a selection
Program 4: Content type TARGETS
Handling binary data using xclip
Large amounts of data
Clipboard managers
Summary
News Roundup
TrueOS Documentation: A great way to give back! (https://www.trueos.org/blog/trueos-documentation-great-way-give-back/)
The TrueOS project is always looking for community contribution. Documentation changes are a great way for users to not only make a solid contribution to the project, but learn more about it too! Over the last few months, many users have asked for both simple and detailed instructions on making documentation changes. These are now added to the TrueOS handbook in the Contributing to TrueOS section.
If interested in making a small alteration to the TrueOS handbook, here are some instructions for submitting a patch through the GitHub website. These instructions are also applicable to the Lumina and SysAdm handbooks. Lumina documentation is in the the lumina-docs repository, and SysAdm guides are in sysadm-docs.
Make a Doc change!
A GitHub account is required to submit patches to the TrueOS docs. Open a web browser and sign in to GitHub or make a new account. When making a new account, be sure to use an often checked email address, as all communication regarding patches and pull requests are sent to this address. Navigate to the trueos-docs GitHub repository. Click on the trueos-handbook directory to view all the documentation files. Open the .rst file corresponding to the chapter needing an update. The chapter names are reflected in the title of the .rst files. For example, open install.rst to fix an error spotted in handbook chapter 3: “Install”. This first image shows the trueos-docs repository and the contents of the trueos-handbook directory
Open the desired chapter file by clicking its entry in the list. The trueos.rst file is an index file and should be ignored. Begin editing the file by clicking the Pencil icon in the upper right corner above the file’s text. The file moves to edit mode, where it is now possible to make changes, as the next image shows.
Editing install.rst with GitHub
When making a simple change, it is recommended to avoid adjusting the specific formatting elements and instead work within or around them. Once satisfied, scroll to the bottom of the page and write a detailed commit summary of the new changes. Click Propose file change (green button), then Create pull request to submit the changes to the project. GitHub then does an automated merge check. Click Create pull request again to submit the change to the repository. In the final step, a developer or project committer reviews the changes, merging them into the project or asking for more changes as necessary.
Learn more about TrueOS documentation
To learn more about the underlying structure of TrueOS documentation like the Sphinx Documentation Generator and reStructuredText markup, browse the Advanced Documentation Changes section of the TrueOS handbook. This section also contains instructions for forking the repository and configuring a local clone, build testing, updating the translation files, and other useful information. The Sphinx website is also a valuable resource.
libHijack Revival (https://www.soldierx.com/news/Hijack-Revival)
Over a decade ago, while standing naked and vulnerable in the comfort of my steaming hot shower, I gathered my thoughts as humans typically attempt to do in the wee hours of the morning. Thoughts of a post-exploitation exercise raced in my mind, the same thoughts that made sleeping the night before difficult. If only I could inject into Apache some code that would allow me to hook into its parsing engine without requiring persistance. Putting a file-backed entry into /proc/pid/maps would tip off the security team to a compromise.
The end-goal was to be able to send Apache a special string and have Apache perform a unique action based on the special string.
FelineMenace's Binary Protection Schemes whitepaper provided inspiration. Silvio Cesare paved the way into PLT/GOT redirection attacks. Various Phrack articles selflessly contributed to the direction I was to head.
Alas, in the aforementioned shower, an epiphany struck me. I jumped as an awkward stereotypical geek does: like an elaborate Elaine Benes dance rehearsal in the air. If I used PTrace, ELF, and the PLT/GOT to my advantage, I could cause the victim application to allocate anonymous memory mappings arbitrarily. In the newly-created memory mapping, I could inject arbitrary code. Since a typical operating system treats debuggers as God-like applications, the memory mapping could be mapped without write access, but as read and execute only. Thus enabling the stealth that I sought.
The project took a few years to develop in my spare time. I ended up creating several iterations, taking a rough draft/Proof-of-Concept style code and rewriting it to be more efficient and effective.
I had toyed with FreeBSD off-and-on for over a decade by this point, but by-and-large I was still mostly using Linux. FreeBSD gained DTrace and ZFS support, winning me over from the Linux camp. I ported libhijack to FreeBSD, giving it support for both Linux and FreeBSD simultaneously.
In 2013, I started work on helping Oliver Pinter with his ASLR implementation, which was originally destined to be upstreamed to FreeBSD. It took a lot of work, and my interest in libhijack faded. As a natural consequence, I handed libhijack over to SoldierX, asking the community to take it and enhance it.
Over four years went by without a single commit. The project was essentially abandoned. My little baby was dead.
This past week, I wondered if libhijack could even compile on FreeBSD anymore. Given that four years have passed by and major changes have happened in those four years, I thought libhijack would need a major overhaul just to compile, let alone function. Imagine my surprise when libhijack needed only a few fixups to account for changes in FreeBSD's RTLD.
Today, I'm announcing the revival of libhijack. No longer is it dead, but very much alive. In order to develop the project faster, I've decided to remove support for Linux, focusing instead on FreeBSD. I've removed hundreds of lines of code over the past few days. Supporting both FreeBSD and Linux meant some code had to be ugly. Now the beautification process has begun.
I'm announcing the availability of libhijack 0.7.0 today. The ABI and API should be considered unstable as they may change without notice.
Note that HardenedBSD fully mitigates libhijack from working with two security features: setting security.bsd.unprivilegedprocdebug to 0 by default and the implementation of PaX NOEXEC.
The security.bsd.unprivilegedprocdebug sysctl node prevents PTrace access for applications the debugger itself did not fork+execve for unprivileged (non-root) users. Privileged users (the root account) can use PTrace to its fullest extent.
HardenedBSD's implementation of PaX NOEXEC prevents the creation of memory mappings that are both writable and executable. It also prevents using mprotect to toggle between writable and executable. In libhijack's case, FreeBSD grants libhijack the ability to write to memory mappings that are not marked writable. Debuggers do this to set breakpoints. HardenedBSD behaves differently due to PaX NOEXEC.
Each memory mapping has a notion of a maximum protection level. When a memory mapping is created, if the write bit is set, then HardenedBSD drops the execute bit from the maximum protection level. When the execute bit is set at memory mapping creation time, then the write bit is dropped from the maximum protection level. If both the write and execute bits are set, then the execute bit is silently dropped from both the mapping creation request and the maximum protection level. 
The maximum protection level is always obeyed, even for debuggers. Thus we see that PaX NOEXEC is 100% effective in preventing libhijack from injecting code into a process. Here is a screenshot showing PaX NOEXEC preventing libhijack from injecting shellcode into a newly-created memory mapping.
What's next for libhijack? Here's what we have planned, in no particular order:
Python bindings
Port to arm64
This requires logic for handling machine-dependent code. High priority.
Finish anonymous shared object injection. 
This requires implementing a custom RTLD from within libhijack. 
More cleanups. Adhere to style(9).
libhijack can be found on GitHub @ https://github.com/SoldierX/libhijack
***
Contributing to FreeBSD (https://blather.michaelwlucas.com/archives/2988)
I’ve talked to a whole bunch of folks who say things like “I’m a junior programmer. I’m looking for a way to help. I have no specific expertise, but I’m willing to learn.” Today, I present such junior programmers with an opportunity. An opportunity for you to learn skills that will be incredibly valuable to your career, and will simultaneously expand your career opportunities.
For decades, FreeBSD has relied on its users for testing. They expect users to install pre-release versions of the OS and exercise them to identify regressions. That’s necessary, but it’s nowhere near enough.
The FreeBSD Testing Project is building an automated test suite for the entire operating system. They have a whole mess of work to do. There’s only four people on the team, so each additional person that contributes can have a serious impact. They have tutorials on how to write tests, and sample tests.
There’s a whole bunch of tests left to be written. You have an almost open field. They need tests for everything from ls(1) to bhyve. (Yes, ls(1) broke at one point in the last few years.) Everything needs testing. Learning to write, submit, and commit small tests is valuable experience for developing the big tests.
What’s more, learning to write tests for a system means learning the system. Developing tests will transform you into a FreeBSD expert. Once you’ve demonstrated your competence, worth, and ability to work within the project, other FreeBSD teams will solicit your help and advice. The Project will suck you in.
Testing is perhaps the most valuable contribution anyone can make to an open source project. And this door into the FreeBSD Project is standing wide, wide open.
OpenBSD Gaming Resource (https://mrsatterly.com/openbsd_games.html)
&amp;gt; What isn't there to love about playing video games on your favorite operating system? OpenBSD and video games feels like a natural combination to me. My resource has software lists, links to free games not in ports, lists of nonfree games, and recommendations.
The Table of Contents has these high-level items for you:
&amp;gt; General Resources
&amp;gt; OpenBSD Exclusive
&amp;gt; Ports
&amp;gt; Network Clients
&amp;gt; Browser Games
&amp;gt; Game Engines
&amp;gt; Multiple Game Engines
&amp;gt; Multiple System Emulation
&amp;gt; Computer Emulation
&amp;gt; Game Console Emulation
&amp;gt; Live Media Emulation
&amp;gt; Operating System Emulation
&amp;gt; Games in Other Software
Have fun with these games!
***
Beastie Bits
Dragonfly introduces kcollect(8) (https://www.dragonflydigest.com/2017/08/07/20061.html)
The Faces of Open Source (http://facesofopensource.com/unix/)
Edgemesh CEO, Jake Loveless and Joyent CTO, Bryan Cantrill join together for a fireside chat to discuss distributed caching at scale, Docker, Node.js, Mystery Science Theater 3000, and more! (https://www.joyent.com/blog/joyent-edgemesh-cache-me-if-you-can)
UFS: Place the information needed to find alternate superblocks to the end of the area reserved for the boot block (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=322297)
Let ‘localhost’ be localhost (https://tools.ietf.org/html/draft-west-let-localhost-be-localhost-04)
Hurry up and register for vBSDCon September 7-9 (http://www.verisign.com/en_US/internet-technology-news/verisign-events/vbsdcon/index.xhtml?dmn=vBSDcon.com) and EuroBSDCon September 21-24 (https://2017.eurobsdcon.org/)
***
Feedback/Questions
Morgan - btrfs deprecated (http://dpaste.com/0JEYE1K)
Ben - UEFI, GELI, BEADM, and more (http://dpaste.com/2TP90HD)
Brad - Hostname Clarification (http://dpaste.com/1MQH1BD)
M Rod - BSD Laptop (http://dpaste.com/39C6PGN)
Jeremy - Contributing to BSDs (http://dpaste.com/3SVP5SF)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>DragonflyBSD 4.8.1 has been released, we explore how the X11 clipboard works, and look at OpenBSD gaming resources.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/llvm_clang_and_compiler_rt" rel="nofollow">LLVM, Clang and compiler-rt support enhancements</a></h3>

<blockquote>
<p>In the last month I started with upstream of the code for sanitizers: the common layer and ubsan. I worked also on the elimination of unexpected failures in LLVM and Clang. I&#39;ve managed to achieve, with a pile of local patches, the number of 0 unexpected bugs within LLVM (check-llvm) and 3 unexpected bugs within Clang (check-clang) (however these ones were caused by hardcoded environment -lstdc++ vs -lc++). The number of failures in sanitizers (check-sanitizer) is also low, it&#39;s close to zero.</p>
</blockquote>

<ul>
<li>LLVM</li>
</ul>

<blockquote>
<p>In order to achieve the goals of testability concerning the LLVM projects, I had to prepare a new pkgsrc-wip package called llvm-all-in-one that contains 12 active LLVM projects within one tree. The set of these projects is composed of: llvm, clang, compiler-rt, libcxx, libcxxabi, libunwind, test-suite, openmp, llgo, lld, lldb, clang-tools-extra. These were required to build and execute test-suites in the LLVM&#39;s projects. Ideally the tests should work in standalone packages - built out-of-LLVM-sources - and with GCC/Clang, however the real life is less bright and this forced me to use Clang as the system compiler an all-in-one package in order to develop the work environment with the ability to build and execute unit tests.<br>
There were four threads within LLVM:</p>
</blockquote>

<ul>
<li>Broken std::call_once with libstdc++. This is an old and well-known bug, which was usually worked around with a homegrown implementation llvm::call_once. I&#39;ve discovered that the llvm::call_once workaround isn&#39;t sufficient for the whole LLVM functionality, as std::call_once can be called internally inside the libstdc++ libraries - like within the C++11 futures interface. This bug has been solved by Joerg Sonnenberger in the ELF dynamic linker.</li>
<li>Unportable shell construct hardcoded in tests &quot;&gt;&amp;&quot;. This has been fixed upstream.</li>
<li>LLVM JIT. The LLVM Memory generic allocator (or page mapper) was designed to freely map pages with any combination of the protection bits: R,W,X. This approach breaks on NetBSD with PaX MPROTECT and requires redesign of the interfaces. This is the continuation of the past month AllocateRWX and ReleaseRWX compatibility with NetBSD improvements. I&#39;ve prepared few variations of local patches addressing these issues and it&#39;s still open for discussion with upstream. My personal preference is to remove the current API entirely and introduce a newer one with narrowed down functionality to swap between readable (R--), writable (RW-) and executable (R-X) memory pages. This would effectively enforce W<sup>X.</sup></li>
<li>Sanitizers support. Right now, I keep the patches locally in order to upstream the common sanitizer code in compiler-rt.</li>
</ul>

<blockquote>
<p>The LLVM JIT API is the last cause of unexpected failures in check-llvm. This breaks MCJIT, ORCJIT and ExecutionEngine libraries and causes around 200 unexpected failures within tests.</p>
</blockquote>

<ul>
<li>Clang</li>
</ul>

<blockquote>
<p>I&#39;ve upstreamed a patch that enables ubsan and asan on Clang&#39;s frontend for NetBSD/amd64. This support isn&#39;t complete, and requires sanitizers&#39; support code upstreamed to compiler-rt.</p>
</blockquote>

<ul>
<li>compiler-rt

<ul>
<li>The current compiler-rt tasks can be divided into:</li>
<li>upstream sanitizer common code shared with POSIX platforms</li>
<li>upstream sanitizer common code shared with Linux and FreeBSD</li>
<li>upstream sanitizer common code shared with FreeBSD</li>
<li>upstream sanitizer common code specific to NetBSD</li>
<li>build, execute and pass tests for sanitizer common code in check-santizer</li>
</ul></li>
</ul>

<blockquote>
<p>This means that ubsan, asan and the rest of the specific sanitizers wait in queue.<br>
All the mentioned tasks are being worked on simultaneously, with a soft goal to finish them one after another from the first to the last one.<br>
The last point with check-sanitizer unveiled so far two generic bugs on NetBSD: </p>
</blockquote>

<ul>
<li>Return errno EFAULT instead of EACCES on memory fault with read(2)/write(2)-like syscalls.</li>
<li>Honor PTHREAD_DESTRUCTOR_ITERATIONS in libpthread.</li>
</ul>

<blockquote>
<p>These bugs are not strictly real bugs, but they were introducing needless differences with other modern POSIX systems. The fixes were introduced by Christos Zoulas and backported to NetBSD-8.</p>
</blockquote>

<ul>
<li>Plan for the next milestone</li>
</ul>

<blockquote>
<p>I have decided not to open new issues in with the coming month and focus on upstreaming the remaining LLVM code. The roadmap for the next month is to continue working on the goals of the previous months. std::call_once is an example that every delayed bug keeps biting again and again in future.<br>
LLVM 5.0.0 is planned to be released this month (August) and there is a joint motivation with the upstream maintainer to push compatibility fixes for LLVM JIT. There is an option to submit a workaround now and introduce refactoring for the trunk and next version (6.0.0).</p>
</blockquote>

<ul>
<li>This work was sponsored by The NetBSD Foundation.</li>
<li>The NetBSD Foundation is a non-profit organization and welcomes any donations to help us continue funding projects and services to the open-source community. Please consider visiting the following URL, and chip in what you can: <a href="http://netbsd.org/donations/#how-to-donate" rel="nofollow">http://netbsd.org/donations/#how-to-donate</a>
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2017-August/626150.html" rel="nofollow">DragonFly BSD 4.8.1 released</a></h3>

<p>+Updates by dev:</p>

<ul>
<li>Antonio Huete Jimenez (1):

<ul>
<li>libc/gmon: Replace sbrk() with mmap()</li>
</ul></li>
<li>Francois Tigeot (3):

<ul>
<li>drm: bring in Linux compability changes from master</li>
<li>drm/linux: make flush_work() more robust</li>
<li>drm/i915: Update to Linux 4.7.10</li>
</ul></li>
<li>Imre VadÃ¡sz (4):

<ul>
<li>drm - Fix hrtimer, don&#39;t reset timer-&gt;function to NULL in timeout handler.</li>
<li>sound - Delete devfs clone handler for /dev/dsp and /dev/mixer on unload.</li>
<li>if_vtnet - Allocate struct vtnet_tx_header entries from a queue.</li>
<li>Make sure that cam(4)&#39;s dashutdown handler runs before DEVICE_SHUTDOWN().</li>
</ul></li>
<li>Matthew Dillon (24):

<ul>
<li>kernel - MFC b48dd28447fc (sigtramp workaround)</li>
<li>kernel - Fix deadlock in sound system</li>
<li>kernel - Fix broken wakeup in crypto code</li>
<li>kernel - Add KERN_PROC_SIGTRAMP</li>
<li>gcc - Adjust the unwind code to use the new sigtramp probe sysctl</li>
<li>kernel - Implement NX</li>
<li>kernel - Implement NX (2)</li>
<li>kernel - Implement machdep.pmap_nx_enable TUNABLE</li>
<li>kernel - Implement NX (3) - cleanup</li>
<li>kernel - Temporarily set the default machdep.pmap_nx_enable to 0</li>
<li>param - Change __DragonFly_version to 400801</li>
<li>kernel - Fix i915 deadlock</li>
<li>pthreads - Change PTHREAD_STACK_MIN</li>
<li>libc - Fix bug in rcmdsh()</li>
<li>ppp - Fix minor overflow in protocol search</li>
<li>libtelnet - Fix improper statement construction (not a bug in the binary)</li>
<li>libdevstat - Limit sscanf field, fix redundant condition</li>
<li>openssh - Fix a broken assignment</li>
<li>window - Fix Graphics capability enable test</li>
<li>kernel - Fix event preset</li>
<li>mfiutil - Fix static buffer overflow</li>
<li>mixer - Fix sscanf() overflow</li>
<li>gcore - fix overflow in sscanf</li>
<li>kernel - Fix improper parens</li>
</ul></li>
<li>Sascha Wildner (17):

<ul>
<li>libkvm: Fix char pointer dereference.</li>
<li>Fix some cases where an index was used before its limits check.</li>
<li>Really ensure that our world/kernel are built under POSIX locale (&quot;C&quot;).</li>
<li>zoneinfo: Create a /usr/share/zoneinfo/UTC link.</li>
<li>kernel/cam: Add CAM_SCSI_IT_NEXUS_LOST (in preparation for virtio_scsi(4)).</li>
<li>kernel: Add FreeBSD&#39;s virtio_scsi(4) driver.</li>
<li>ccdconfig(8): Add missing free().</li>
<li>libpuffs: Fix two asserts.</li>
<li>kernel/acpi: Untangle the wakecode generation during buildkernel.</li>
<li>kernel/acpica: Better check AcpiOsPredefinedOverride()&#39;s InitVal argument</li>
<li>kernel/acpica: ACPI_THREAD_ID is unsigned.</li>
<li>kernel/acpica: Return curthread as thread id from AcpiOsGetThreadId().</li>
<li>kernel/acpica: Remove no longer needed #include.</li>
<li>kernel/acpi: Call AcpiInitializeSubsystem() before AcpiInitializeTables().</li>
<li>kernel/urtwn: Add missing braces.</li>
<li>kernel/ieee80211: Add missing braces.</li>
<li>libthread_xu: Fix checking of pthread_barrier_init()&#39;s count argument.</li>
</ul></li>
<li>Sepherosa Ziehau (7):

<ul>
<li>sound/hda: Sync device ID table with FreeBSD</li>
<li>inet6: Restore mbuf hash after defragmentation.</li>
<li>pf: Normalized, i.e. defragged, packets requiring rehash.</li>
<li>em: Enable MSI by default on devices has PCI advanced features capability.</li>
<li>sched: Change CPU_SETSIZE to signed int, same as FreeBSD/Linux.</li>
<li>usched: Allow process to change self cpu affinity</li>
<li>ix: Fixup TX/RX ring settings for X550, which supports 64/64 TX/RX rings.</li>
</ul></li>
<li>zrj (1):

<ul>
<li>Revert &quot;Always use unix line endings&quot;
***</li>
</ul></li>
</ul>

<h3><a href="http://www.informatica.co.cr/unix-source-code/research/1991/0101.html" rel="nofollow">Porting Unix to the 386: A Practical Approach</a></h3>

<blockquote>
<p>The University of California&#39;s Berkeley Software Distribution (BSD) has been the catalyst for much of the innovative work done with the UNIX operating system in both the research and commercial sectors. Encompassing over 150 Mbytes (and growing) of cutting-edge operating systems, networking, and applications software, BSD is a fully functional and nonproprietary complete operating systems software distribution (see Figure 1). In fact, every version of UNIX available from every vendor contains at least some Berkeley UNIX code, particularly in the areas of filesystems and networking technologies. However, unless one could pay the high cost of site licenses and equipment, access to this software was simply not within the means of most individual programmers and smaller research groups.<br>
The 386BSD project was established in the summer of 1989 for the specific purpose of porting BSD to the Intel 80386 microprocessor platform so that the tools this software offers can be made available to any programmer or research group with a 386 PC. In coordination with the Computer Systems Research Group (CSRG) at the University of California at Berkeley, we successively ported a basic research system to a common AT class machine (see, Figure 2), with the result that approximately 65 percent of all 32-bit systems could immediately make use of this new definition of UNIX. We have been refining and improving this base port ever since.<br>
By providing the base 386BSD port to CSRG, our hope is to foster new interest in Berkeley UNIX technology and to speed its acceptance and use worldwide. We hope to see those interested in this technology build on it in both commercial and noncommercial ventures.<br>
In this and following articles, we will examine the key aspects of software, strategy, and experience that encompassed a project of this magnitude. We intend to explore the process of the 386BSD port, while learning to effectively exploit features of the 386 architecture for use with an advanced operating system. We also intend to outline some of the tradeoffs in implementation goals which must be periodically reexamined. Finally, we will highlight extensions which remain for future work, perhaps to be done by some of you reading this article today. Note that we are assuming familiarity with UNIX, its concepts and structures, and the basic functions of the 386, so we will not present exhaustive coverage of these areas.<br>
In this installment, we discuss the beginning of our project and the initial framework that guided our efforts, in particular, the development of the 386BSD specification. Future articles will address specific topics of interest and actual nonproprietary code fragments used in 386BSD. Among the future areas to be covered are:</p>
</blockquote>

<ul>
<li>386BSD process context switching</li>
<li>Executing the first 386BSD process on the PC</li>
<li>386BSD kernel interrupt and exception handling</li>
<li>386BSD INTERNET networking</li>
<li>ISA device drivers and system support</li>
<li>386BSD bootstrap process
***</li>
</ul>

<h3><a href="https://www.uninformativ.de/blog/postings/2017-04-02/0/POSTING-en.html" rel="nofollow">X11: How does “the” clipboard work</a></h3>

<ul>
<li>&gt; If you have used another operating system before you switched to something that runs X11, you will have noticed that there is more than one clipboard:
&gt; Sometimes, you can use the mouse to select some text, switch to another window, and then hit the middle mouse button to paste text.
&gt; Sometimes, you can select text, then hit some hotkey, e.g. Ctrl+C, switch to another window, hit another hotkey, e.g. Ctrl+V, and paste said text.
&gt; Sometimes, you can do both.</li>
<li>&gt; Selections as a form of IPC</li>
<li><blockquote>
<p>First things first, in X11 land, “clipboards” are called “selections”.<br>
Yes, there is more than one selection and they all work independently. In fact, you can use as many selections as you wish. In theory, that is. When using selections, you make different clients communicate with each other. This means that those clients have to agree on which selections to use. You can’t just invent your own selection and then expect Firefox to be compatible with it.</p>
</blockquote></li>
<li><blockquote>
<p>How are selections identified?</p>
</blockquote></li>
<li><blockquote>
<p>There are three “standard” selection names:<br>
PRIMARY: The “middle mouse clipboard”<br>
SECONDARY: Virtually unused these days<br>
CLIPBOARD: The “Ctrl+C clipboard”</p>
</blockquote></li>
<li><blockquote>
<p>Program 1: Query selection owners</p>
</blockquote></li>
<li><blockquote>
<p>Content type and conversion</p>
</blockquote></li>
<li><blockquote>
<p>Program 2: Get clipboard as UTF-8</p>
</blockquote></li>
<li><blockquote>
<p>Program 3: Owning a selection</p>
</blockquote></li>
<li><blockquote>
<p>Program 4: Content type TARGETS</p>
</blockquote></li>
<li><blockquote>
<p>Handling binary data using xclip</p>
</blockquote></li>
<li><blockquote>
<p>Large amounts of data</p>
</blockquote></li>
<li><blockquote>
<p>Clipboard managers</p>
</blockquote></li>
<li><blockquote>
<p>Summary</p>
</blockquote></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.trueos.org/blog/trueos-documentation-great-way-give-back/" rel="nofollow">TrueOS Documentation: A great way to give back!</a></h3>

<blockquote>
<p>The TrueOS project is always looking for community contribution. Documentation changes are a great way for users to not only make a solid contribution to the project, but learn more about it too! Over the last few months, many users have asked for both simple and detailed instructions on making documentation changes. These are now added to the TrueOS handbook in the Contributing to TrueOS section.<br>
If interested in making a small alteration to the TrueOS handbook, here are some instructions for submitting a patch through the GitHub website. These instructions are also applicable to the Lumina and SysAdm handbooks. Lumina documentation is in the the lumina-docs repository, and SysAdm guides are in sysadm-docs.</p>
</blockquote>

<ul>
<li>Make a Doc change!</li>
</ul>

<blockquote>
<p>A GitHub account is required to submit patches to the TrueOS docs. Open a web browser and sign in to GitHub or make a new account. When making a new account, be sure to use an often checked email address, as all communication regarding patches and pull requests are sent to this address. Navigate to the trueos-docs GitHub repository. Click on the trueos-handbook directory to view all the documentation files. Open the .rst file corresponding to the chapter needing an update. The chapter names are reflected in the title of the .rst files. For example, open install.rst to fix an error spotted in handbook chapter 3: “Install”. This first image shows the trueos-docs repository and the contents of the trueos-handbook directory<br>
Open the desired chapter file by clicking its entry in the list. The trueos.rst file is an index file and should be ignored. Begin editing the file by clicking the Pencil icon in the upper right corner above the file’s text. The file moves to edit mode, where it is now possible to make changes, as the next image shows.</p>
</blockquote>

<ul>
<li>Editing install.rst with GitHub</li>
</ul>

<blockquote>
<p>When making a simple change, it is recommended to avoid adjusting the specific formatting elements and instead work within or around them. Once satisfied, scroll to the bottom of the page and write a detailed commit summary of the new changes. Click Propose file change (green button), then Create pull request to submit the changes to the project. GitHub then does an automated merge check. Click Create pull request again to submit the change to the repository. In the final step, a developer or project committer reviews the changes, merging them into the project or asking for more changes as necessary.</p>
</blockquote>

<ul>
<li>Learn more about TrueOS documentation</li>
</ul>

<blockquote>
<p>To learn more about the underlying structure of TrueOS documentation like the Sphinx Documentation Generator and reStructuredText markup, browse the Advanced Documentation Changes section of the TrueOS handbook. This section also contains instructions for forking the repository and configuring a local clone, build testing, updating the translation files, and other useful information. The Sphinx website is also a valuable resource.</p>

<hr>
</blockquote>

<h3><a href="https://www.soldierx.com/news/Hijack-Revival" rel="nofollow">libHijack Revival</a></h3>

<blockquote>
<p>Over a decade ago, while standing naked and vulnerable in the comfort of my steaming hot shower, I gathered my thoughts as humans typically attempt to do in the wee hours of the morning. Thoughts of a post-exploitation exercise raced in my mind, the same thoughts that made sleeping the night before difficult. If only I could inject into Apache some code that would allow me to hook into its parsing engine without requiring persistance. Putting a file-backed entry into /proc/pid/maps would tip off the security team to a compromise.<br>
The end-goal was to be able to send Apache a special string and have Apache perform a unique action based on the special string.<br>
FelineMenace&#39;s Binary Protection Schemes whitepaper provided inspiration. Silvio Cesare paved the way into PLT/GOT redirection attacks. Various Phrack articles selflessly contributed to the direction I was to head.<br>
Alas, in the aforementioned shower, an epiphany struck me. I jumped as an awkward stereotypical geek does: like an elaborate Elaine Benes dance rehearsal in the air. If I used PTrace, ELF, and the PLT/GOT to my advantage, I could cause the victim application to allocate anonymous memory mappings arbitrarily. In the newly-created memory mapping, I could inject arbitrary code. Since a typical operating system treats debuggers as God-like applications, the memory mapping could be mapped without write access, but as read and execute only. Thus enabling the stealth that I sought.<br>
The project took a few years to develop in my spare time. I ended up creating several iterations, taking a rough draft/Proof-of-Concept style code and rewriting it to be more efficient and effective.<br>
I had toyed with FreeBSD off-and-on for over a decade by this point, but by-and-large I was still mostly using Linux. FreeBSD gained DTrace and ZFS support, winning me over from the Linux camp. I ported libhijack to FreeBSD, giving it support for both Linux and FreeBSD simultaneously.<br>
In 2013, I started work on helping Oliver Pinter with his ASLR implementation, which was originally destined to be upstreamed to FreeBSD. It took a lot of work, and my interest in libhijack faded. As a natural consequence, I handed libhijack over to SoldierX, asking the community to take it and enhance it.<br>
Over four years went by without a single commit. The project was essentially abandoned. My little baby was dead.<br>
This past week, I wondered if libhijack could even compile on FreeBSD anymore. Given that four years have passed by and major changes have happened in those four years, I thought libhijack would need a major overhaul just to compile, let alone function. Imagine my surprise when libhijack needed only a few fixups to account for changes in FreeBSD&#39;s RTLD.<br>
Today, I&#39;m announcing the revival of libhijack. No longer is it dead, but very much alive. In order to develop the project faster, I&#39;ve decided to remove support for Linux, focusing instead on FreeBSD. I&#39;ve removed hundreds of lines of code over the past few days. Supporting both FreeBSD and Linux meant some code had to be ugly. Now the beautification process has begun.<br>
I&#39;m announcing the availability of libhijack 0.7.0 today. The ABI and API should be considered unstable as they may change without notice.<br>
Note that HardenedBSD fully mitigates libhijack from working with two security features: setting security.bsd.unprivileged_proc_debug to 0 by default and the implementation of PaX NOEXEC.<br>
The security.bsd.unprivileged_proc_debug sysctl node prevents PTrace access for applications the debugger itself did not fork+execve for unprivileged (non-root) users. Privileged users (the root account) can use PTrace to its fullest extent.<br>
HardenedBSD&#39;s implementation of PaX NOEXEC prevents the creation of memory mappings that are both writable and executable. It also prevents using mprotect to toggle between writable and executable. In libhijack&#39;s case, FreeBSD grants libhijack the ability to write to memory mappings that are not marked writable. Debuggers do this to set breakpoints. HardenedBSD behaves differently due to PaX NOEXEC.<br>
Each memory mapping has a notion of a maximum protection level. When a memory mapping is created, if the write bit is set, then HardenedBSD drops the execute bit from the maximum protection level. When the execute bit is set at memory mapping creation time, then the write bit is dropped from the maximum protection level. If both the write and execute bits are set, then the execute bit is silently dropped from both the mapping creation request and the maximum protection level. <br>
The maximum protection level is always obeyed, even for debuggers. Thus we see that PaX NOEXEC is 100% effective in preventing libhijack from injecting code into a process. Here is a screenshot showing PaX NOEXEC preventing libhijack from injecting shellcode into a newly-created memory mapping.</p>
</blockquote>

<ul>
<li>What&#39;s next for libhijack? Here&#39;s what we have planned, in no particular order:

<ul>
<li>Python bindings</li>
<li>Port to arm64</li>
<li>This requires logic for handling machine-dependent code. High priority.</li>
<li>Finish anonymous shared object injection. </li>
<li>This requires implementing a custom RTLD from within libhijack. </li>
<li>More cleanups. Adhere to style(9).</li>
</ul></li>
<li>libhijack can be found on GitHub @ <a href="https://github.com/SoldierX/libhijack" rel="nofollow">https://github.com/SoldierX/libhijack</a>
***</li>
</ul>

<h3><a href="https://blather.michaelwlucas.com/archives/2988" rel="nofollow">Contributing to FreeBSD</a></h3>

<blockquote>
<p>I’ve talked to a whole bunch of folks who say things like “I’m a junior programmer. I’m looking for a way to help. I have no specific expertise, but I’m willing to learn.” Today, I present such junior programmers with an opportunity. An opportunity for you to learn skills that will be incredibly valuable to your career, and will simultaneously expand your career opportunities.<br>
For decades, FreeBSD has relied on its users for testing. They expect users to install pre-release versions of the OS and exercise them to identify regressions. That’s necessary, but it’s nowhere near enough.<br>
The FreeBSD Testing Project is building an automated test suite for the entire operating system. They have a whole mess of work to do. There’s only four people on the team, so each additional person that contributes can have a serious impact. They have tutorials on how to write tests, and sample tests.<br>
There’s a whole bunch of tests left to be written. You have an almost open field. They need tests for everything from ls(1) to bhyve. (Yes, ls(1) broke at one point in the last few years.) Everything needs testing. Learning to write, submit, and commit small tests is valuable experience for developing the big tests.<br>
What’s more, learning to write tests for a system means learning the system. Developing tests will transform you into a FreeBSD expert. Once you’ve demonstrated your competence, worth, and ability to work within the project, other FreeBSD teams will solicit your help and advice. The Project will suck you in.<br>
Testing is perhaps the most valuable contribution anyone can make to an open source project. And this door into the FreeBSD Project is standing wide, wide open.</p>

<hr>
</blockquote>

<h3><a href="https://mrsatterly.com/openbsd_games.html" rel="nofollow">OpenBSD Gaming Resource</a></h3>

<ul>
<li>&gt; What isn&#39;t there to love about playing video games on your favorite operating system? OpenBSD and video games feels like a natural combination to me. My resource has software lists, links to free games not in ports, lists of nonfree games, and recommendations.</li>
<li>The Table of Contents has these high-level items for you:</li>
<li>&gt; General Resources</li>
<li>&gt; OpenBSD Exclusive</li>
<li>&gt; Ports</li>
<li>&gt; Network Clients</li>
<li>&gt; Browser Games</li>
<li>&gt; Game Engines</li>
<li>&gt; Multiple Game Engines</li>
<li>&gt; Multiple System Emulation</li>
<li>&gt; Computer Emulation</li>
<li>&gt; Game Console Emulation</li>
<li>&gt; Live Media Emulation</li>
<li>&gt; Operating System Emulation</li>
<li>&gt; Games in Other Software</li>
<li>Have fun with these games!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2017/08/07/20061.html" rel="nofollow">Dragonfly introduces kcollect(8)</a></li>
<li><a href="http://facesofopensource.com/unix/" rel="nofollow">The Faces of Open Source</a></li>
<li><a href="https://www.joyent.com/blog/joyent-edgemesh-cache-me-if-you-can" rel="nofollow">Edgemesh CEO, Jake Loveless and Joyent CTO, Bryan Cantrill join together for a fireside chat to discuss distributed caching at scale, Docker, Node.js, Mystery Science Theater 3000, and more!</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=322297" rel="nofollow">UFS: Place the information needed to find alternate superblocks to the end of the area reserved for the boot block</a></li>
<li><a href="https://tools.ietf.org/html/draft-west-let-localhost-be-localhost-04" rel="nofollow">Let ‘localhost’ be localhost</a></li>
<li>Hurry up and register for <a href="http://www.verisign.com/en_US/internet-technology-news/verisign-events/vbsdcon/index.xhtml?dmn=vBSDcon.com" rel="nofollow">vBSDCon September 7-9</a> and <a href="https://2017.eurobsdcon.org/" rel="nofollow">EuroBSDCon September 21-24</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Morgan - <a href="http://dpaste.com/0JEYE1K" rel="nofollow">btrfs deprecated</a></li>
<li>Ben - <a href="http://dpaste.com/2TP90HD" rel="nofollow">UEFI, GELI, BEADM, and more</a></li>
<li>Brad - <a href="http://dpaste.com/1MQH1BD" rel="nofollow">Hostname Clarification</a></li>
<li>M Rod - <a href="http://dpaste.com/39C6PGN" rel="nofollow">BSD Laptop</a></li>
<li>Jeremy - <a href="http://dpaste.com/3SVP5SF" rel="nofollow">Contributing to BSDs</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>DragonflyBSD 4.8.1 has been released, we explore how the X11 clipboard works, and look at OpenBSD gaming resources.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/llvm_clang_and_compiler_rt" rel="nofollow">LLVM, Clang and compiler-rt support enhancements</a></h3>

<blockquote>
<p>In the last month I started with upstream of the code for sanitizers: the common layer and ubsan. I worked also on the elimination of unexpected failures in LLVM and Clang. I&#39;ve managed to achieve, with a pile of local patches, the number of 0 unexpected bugs within LLVM (check-llvm) and 3 unexpected bugs within Clang (check-clang) (however these ones were caused by hardcoded environment -lstdc++ vs -lc++). The number of failures in sanitizers (check-sanitizer) is also low, it&#39;s close to zero.</p>
</blockquote>

<ul>
<li>LLVM</li>
</ul>

<blockquote>
<p>In order to achieve the goals of testability concerning the LLVM projects, I had to prepare a new pkgsrc-wip package called llvm-all-in-one that contains 12 active LLVM projects within one tree. The set of these projects is composed of: llvm, clang, compiler-rt, libcxx, libcxxabi, libunwind, test-suite, openmp, llgo, lld, lldb, clang-tools-extra. These were required to build and execute test-suites in the LLVM&#39;s projects. Ideally the tests should work in standalone packages - built out-of-LLVM-sources - and with GCC/Clang, however the real life is less bright and this forced me to use Clang as the system compiler an all-in-one package in order to develop the work environment with the ability to build and execute unit tests.<br>
There were four threads within LLVM:</p>
</blockquote>

<ul>
<li>Broken std::call_once with libstdc++. This is an old and well-known bug, which was usually worked around with a homegrown implementation llvm::call_once. I&#39;ve discovered that the llvm::call_once workaround isn&#39;t sufficient for the whole LLVM functionality, as std::call_once can be called internally inside the libstdc++ libraries - like within the C++11 futures interface. This bug has been solved by Joerg Sonnenberger in the ELF dynamic linker.</li>
<li>Unportable shell construct hardcoded in tests &quot;&gt;&amp;&quot;. This has been fixed upstream.</li>
<li>LLVM JIT. The LLVM Memory generic allocator (or page mapper) was designed to freely map pages with any combination of the protection bits: R,W,X. This approach breaks on NetBSD with PaX MPROTECT and requires redesign of the interfaces. This is the continuation of the past month AllocateRWX and ReleaseRWX compatibility with NetBSD improvements. I&#39;ve prepared few variations of local patches addressing these issues and it&#39;s still open for discussion with upstream. My personal preference is to remove the current API entirely and introduce a newer one with narrowed down functionality to swap between readable (R--), writable (RW-) and executable (R-X) memory pages. This would effectively enforce W<sup>X.</sup></li>
<li>Sanitizers support. Right now, I keep the patches locally in order to upstream the common sanitizer code in compiler-rt.</li>
</ul>

<blockquote>
<p>The LLVM JIT API is the last cause of unexpected failures in check-llvm. This breaks MCJIT, ORCJIT and ExecutionEngine libraries and causes around 200 unexpected failures within tests.</p>
</blockquote>

<ul>
<li>Clang</li>
</ul>

<blockquote>
<p>I&#39;ve upstreamed a patch that enables ubsan and asan on Clang&#39;s frontend for NetBSD/amd64. This support isn&#39;t complete, and requires sanitizers&#39; support code upstreamed to compiler-rt.</p>
</blockquote>

<ul>
<li>compiler-rt

<ul>
<li>The current compiler-rt tasks can be divided into:</li>
<li>upstream sanitizer common code shared with POSIX platforms</li>
<li>upstream sanitizer common code shared with Linux and FreeBSD</li>
<li>upstream sanitizer common code shared with FreeBSD</li>
<li>upstream sanitizer common code specific to NetBSD</li>
<li>build, execute and pass tests for sanitizer common code in check-santizer</li>
</ul></li>
</ul>

<blockquote>
<p>This means that ubsan, asan and the rest of the specific sanitizers wait in queue.<br>
All the mentioned tasks are being worked on simultaneously, with a soft goal to finish them one after another from the first to the last one.<br>
The last point with check-sanitizer unveiled so far two generic bugs on NetBSD: </p>
</blockquote>

<ul>
<li>Return errno EFAULT instead of EACCES on memory fault with read(2)/write(2)-like syscalls.</li>
<li>Honor PTHREAD_DESTRUCTOR_ITERATIONS in libpthread.</li>
</ul>

<blockquote>
<p>These bugs are not strictly real bugs, but they were introducing needless differences with other modern POSIX systems. The fixes were introduced by Christos Zoulas and backported to NetBSD-8.</p>
</blockquote>

<ul>
<li>Plan for the next milestone</li>
</ul>

<blockquote>
<p>I have decided not to open new issues in with the coming month and focus on upstreaming the remaining LLVM code. The roadmap for the next month is to continue working on the goals of the previous months. std::call_once is an example that every delayed bug keeps biting again and again in future.<br>
LLVM 5.0.0 is planned to be released this month (August) and there is a joint motivation with the upstream maintainer to push compatibility fixes for LLVM JIT. There is an option to submit a workaround now and introduce refactoring for the trunk and next version (6.0.0).</p>
</blockquote>

<ul>
<li>This work was sponsored by The NetBSD Foundation.</li>
<li>The NetBSD Foundation is a non-profit organization and welcomes any donations to help us continue funding projects and services to the open-source community. Please consider visiting the following URL, and chip in what you can: <a href="http://netbsd.org/donations/#how-to-donate" rel="nofollow">http://netbsd.org/donations/#how-to-donate</a>
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2017-August/626150.html" rel="nofollow">DragonFly BSD 4.8.1 released</a></h3>

<p>+Updates by dev:</p>

<ul>
<li>Antonio Huete Jimenez (1):

<ul>
<li>libc/gmon: Replace sbrk() with mmap()</li>
</ul></li>
<li>Francois Tigeot (3):

<ul>
<li>drm: bring in Linux compability changes from master</li>
<li>drm/linux: make flush_work() more robust</li>
<li>drm/i915: Update to Linux 4.7.10</li>
</ul></li>
<li>Imre VadÃ¡sz (4):

<ul>
<li>drm - Fix hrtimer, don&#39;t reset timer-&gt;function to NULL in timeout handler.</li>
<li>sound - Delete devfs clone handler for /dev/dsp and /dev/mixer on unload.</li>
<li>if_vtnet - Allocate struct vtnet_tx_header entries from a queue.</li>
<li>Make sure that cam(4)&#39;s dashutdown handler runs before DEVICE_SHUTDOWN().</li>
</ul></li>
<li>Matthew Dillon (24):

<ul>
<li>kernel - MFC b48dd28447fc (sigtramp workaround)</li>
<li>kernel - Fix deadlock in sound system</li>
<li>kernel - Fix broken wakeup in crypto code</li>
<li>kernel - Add KERN_PROC_SIGTRAMP</li>
<li>gcc - Adjust the unwind code to use the new sigtramp probe sysctl</li>
<li>kernel - Implement NX</li>
<li>kernel - Implement NX (2)</li>
<li>kernel - Implement machdep.pmap_nx_enable TUNABLE</li>
<li>kernel - Implement NX (3) - cleanup</li>
<li>kernel - Temporarily set the default machdep.pmap_nx_enable to 0</li>
<li>param - Change __DragonFly_version to 400801</li>
<li>kernel - Fix i915 deadlock</li>
<li>pthreads - Change PTHREAD_STACK_MIN</li>
<li>libc - Fix bug in rcmdsh()</li>
<li>ppp - Fix minor overflow in protocol search</li>
<li>libtelnet - Fix improper statement construction (not a bug in the binary)</li>
<li>libdevstat - Limit sscanf field, fix redundant condition</li>
<li>openssh - Fix a broken assignment</li>
<li>window - Fix Graphics capability enable test</li>
<li>kernel - Fix event preset</li>
<li>mfiutil - Fix static buffer overflow</li>
<li>mixer - Fix sscanf() overflow</li>
<li>gcore - fix overflow in sscanf</li>
<li>kernel - Fix improper parens</li>
</ul></li>
<li>Sascha Wildner (17):

<ul>
<li>libkvm: Fix char pointer dereference.</li>
<li>Fix some cases where an index was used before its limits check.</li>
<li>Really ensure that our world/kernel are built under POSIX locale (&quot;C&quot;).</li>
<li>zoneinfo: Create a /usr/share/zoneinfo/UTC link.</li>
<li>kernel/cam: Add CAM_SCSI_IT_NEXUS_LOST (in preparation for virtio_scsi(4)).</li>
<li>kernel: Add FreeBSD&#39;s virtio_scsi(4) driver.</li>
<li>ccdconfig(8): Add missing free().</li>
<li>libpuffs: Fix two asserts.</li>
<li>kernel/acpi: Untangle the wakecode generation during buildkernel.</li>
<li>kernel/acpica: Better check AcpiOsPredefinedOverride()&#39;s InitVal argument</li>
<li>kernel/acpica: ACPI_THREAD_ID is unsigned.</li>
<li>kernel/acpica: Return curthread as thread id from AcpiOsGetThreadId().</li>
<li>kernel/acpica: Remove no longer needed #include.</li>
<li>kernel/acpi: Call AcpiInitializeSubsystem() before AcpiInitializeTables().</li>
<li>kernel/urtwn: Add missing braces.</li>
<li>kernel/ieee80211: Add missing braces.</li>
<li>libthread_xu: Fix checking of pthread_barrier_init()&#39;s count argument.</li>
</ul></li>
<li>Sepherosa Ziehau (7):

<ul>
<li>sound/hda: Sync device ID table with FreeBSD</li>
<li>inet6: Restore mbuf hash after defragmentation.</li>
<li>pf: Normalized, i.e. defragged, packets requiring rehash.</li>
<li>em: Enable MSI by default on devices has PCI advanced features capability.</li>
<li>sched: Change CPU_SETSIZE to signed int, same as FreeBSD/Linux.</li>
<li>usched: Allow process to change self cpu affinity</li>
<li>ix: Fixup TX/RX ring settings for X550, which supports 64/64 TX/RX rings.</li>
</ul></li>
<li>zrj (1):

<ul>
<li>Revert &quot;Always use unix line endings&quot;
***</li>
</ul></li>
</ul>

<h3><a href="http://www.informatica.co.cr/unix-source-code/research/1991/0101.html" rel="nofollow">Porting Unix to the 386: A Practical Approach</a></h3>

<blockquote>
<p>The University of California&#39;s Berkeley Software Distribution (BSD) has been the catalyst for much of the innovative work done with the UNIX operating system in both the research and commercial sectors. Encompassing over 150 Mbytes (and growing) of cutting-edge operating systems, networking, and applications software, BSD is a fully functional and nonproprietary complete operating systems software distribution (see Figure 1). In fact, every version of UNIX available from every vendor contains at least some Berkeley UNIX code, particularly in the areas of filesystems and networking technologies. However, unless one could pay the high cost of site licenses and equipment, access to this software was simply not within the means of most individual programmers and smaller research groups.<br>
The 386BSD project was established in the summer of 1989 for the specific purpose of porting BSD to the Intel 80386 microprocessor platform so that the tools this software offers can be made available to any programmer or research group with a 386 PC. In coordination with the Computer Systems Research Group (CSRG) at the University of California at Berkeley, we successively ported a basic research system to a common AT class machine (see, Figure 2), with the result that approximately 65 percent of all 32-bit systems could immediately make use of this new definition of UNIX. We have been refining and improving this base port ever since.<br>
By providing the base 386BSD port to CSRG, our hope is to foster new interest in Berkeley UNIX technology and to speed its acceptance and use worldwide. We hope to see those interested in this technology build on it in both commercial and noncommercial ventures.<br>
In this and following articles, we will examine the key aspects of software, strategy, and experience that encompassed a project of this magnitude. We intend to explore the process of the 386BSD port, while learning to effectively exploit features of the 386 architecture for use with an advanced operating system. We also intend to outline some of the tradeoffs in implementation goals which must be periodically reexamined. Finally, we will highlight extensions which remain for future work, perhaps to be done by some of you reading this article today. Note that we are assuming familiarity with UNIX, its concepts and structures, and the basic functions of the 386, so we will not present exhaustive coverage of these areas.<br>
In this installment, we discuss the beginning of our project and the initial framework that guided our efforts, in particular, the development of the 386BSD specification. Future articles will address specific topics of interest and actual nonproprietary code fragments used in 386BSD. Among the future areas to be covered are:</p>
</blockquote>

<ul>
<li>386BSD process context switching</li>
<li>Executing the first 386BSD process on the PC</li>
<li>386BSD kernel interrupt and exception handling</li>
<li>386BSD INTERNET networking</li>
<li>ISA device drivers and system support</li>
<li>386BSD bootstrap process
***</li>
</ul>

<h3><a href="https://www.uninformativ.de/blog/postings/2017-04-02/0/POSTING-en.html" rel="nofollow">X11: How does “the” clipboard work</a></h3>

<ul>
<li>&gt; If you have used another operating system before you switched to something that runs X11, you will have noticed that there is more than one clipboard:
&gt; Sometimes, you can use the mouse to select some text, switch to another window, and then hit the middle mouse button to paste text.
&gt; Sometimes, you can select text, then hit some hotkey, e.g. Ctrl+C, switch to another window, hit another hotkey, e.g. Ctrl+V, and paste said text.
&gt; Sometimes, you can do both.</li>
<li>&gt; Selections as a form of IPC</li>
<li><blockquote>
<p>First things first, in X11 land, “clipboards” are called “selections”.<br>
Yes, there is more than one selection and they all work independently. In fact, you can use as many selections as you wish. In theory, that is. When using selections, you make different clients communicate with each other. This means that those clients have to agree on which selections to use. You can’t just invent your own selection and then expect Firefox to be compatible with it.</p>
</blockquote></li>
<li><blockquote>
<p>How are selections identified?</p>
</blockquote></li>
<li><blockquote>
<p>There are three “standard” selection names:<br>
PRIMARY: The “middle mouse clipboard”<br>
SECONDARY: Virtually unused these days<br>
CLIPBOARD: The “Ctrl+C clipboard”</p>
</blockquote></li>
<li><blockquote>
<p>Program 1: Query selection owners</p>
</blockquote></li>
<li><blockquote>
<p>Content type and conversion</p>
</blockquote></li>
<li><blockquote>
<p>Program 2: Get clipboard as UTF-8</p>
</blockquote></li>
<li><blockquote>
<p>Program 3: Owning a selection</p>
</blockquote></li>
<li><blockquote>
<p>Program 4: Content type TARGETS</p>
</blockquote></li>
<li><blockquote>
<p>Handling binary data using xclip</p>
</blockquote></li>
<li><blockquote>
<p>Large amounts of data</p>
</blockquote></li>
<li><blockquote>
<p>Clipboard managers</p>
</blockquote></li>
<li><blockquote>
<p>Summary</p>
</blockquote></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.trueos.org/blog/trueos-documentation-great-way-give-back/" rel="nofollow">TrueOS Documentation: A great way to give back!</a></h3>

<blockquote>
<p>The TrueOS project is always looking for community contribution. Documentation changes are a great way for users to not only make a solid contribution to the project, but learn more about it too! Over the last few months, many users have asked for both simple and detailed instructions on making documentation changes. These are now added to the TrueOS handbook in the Contributing to TrueOS section.<br>
If interested in making a small alteration to the TrueOS handbook, here are some instructions for submitting a patch through the GitHub website. These instructions are also applicable to the Lumina and SysAdm handbooks. Lumina documentation is in the the lumina-docs repository, and SysAdm guides are in sysadm-docs.</p>
</blockquote>

<ul>
<li>Make a Doc change!</li>
</ul>

<blockquote>
<p>A GitHub account is required to submit patches to the TrueOS docs. Open a web browser and sign in to GitHub or make a new account. When making a new account, be sure to use an often checked email address, as all communication regarding patches and pull requests are sent to this address. Navigate to the trueos-docs GitHub repository. Click on the trueos-handbook directory to view all the documentation files. Open the .rst file corresponding to the chapter needing an update. The chapter names are reflected in the title of the .rst files. For example, open install.rst to fix an error spotted in handbook chapter 3: “Install”. This first image shows the trueos-docs repository and the contents of the trueos-handbook directory<br>
Open the desired chapter file by clicking its entry in the list. The trueos.rst file is an index file and should be ignored. Begin editing the file by clicking the Pencil icon in the upper right corner above the file’s text. The file moves to edit mode, where it is now possible to make changes, as the next image shows.</p>
</blockquote>

<ul>
<li>Editing install.rst with GitHub</li>
</ul>

<blockquote>
<p>When making a simple change, it is recommended to avoid adjusting the specific formatting elements and instead work within or around them. Once satisfied, scroll to the bottom of the page and write a detailed commit summary of the new changes. Click Propose file change (green button), then Create pull request to submit the changes to the project. GitHub then does an automated merge check. Click Create pull request again to submit the change to the repository. In the final step, a developer or project committer reviews the changes, merging them into the project or asking for more changes as necessary.</p>
</blockquote>

<ul>
<li>Learn more about TrueOS documentation</li>
</ul>

<blockquote>
<p>To learn more about the underlying structure of TrueOS documentation like the Sphinx Documentation Generator and reStructuredText markup, browse the Advanced Documentation Changes section of the TrueOS handbook. This section also contains instructions for forking the repository and configuring a local clone, build testing, updating the translation files, and other useful information. The Sphinx website is also a valuable resource.</p>

<hr>
</blockquote>

<h3><a href="https://www.soldierx.com/news/Hijack-Revival" rel="nofollow">libHijack Revival</a></h3>

<blockquote>
<p>Over a decade ago, while standing naked and vulnerable in the comfort of my steaming hot shower, I gathered my thoughts as humans typically attempt to do in the wee hours of the morning. Thoughts of a post-exploitation exercise raced in my mind, the same thoughts that made sleeping the night before difficult. If only I could inject into Apache some code that would allow me to hook into its parsing engine without requiring persistance. Putting a file-backed entry into /proc/pid/maps would tip off the security team to a compromise.<br>
The end-goal was to be able to send Apache a special string and have Apache perform a unique action based on the special string.<br>
FelineMenace&#39;s Binary Protection Schemes whitepaper provided inspiration. Silvio Cesare paved the way into PLT/GOT redirection attacks. Various Phrack articles selflessly contributed to the direction I was to head.<br>
Alas, in the aforementioned shower, an epiphany struck me. I jumped as an awkward stereotypical geek does: like an elaborate Elaine Benes dance rehearsal in the air. If I used PTrace, ELF, and the PLT/GOT to my advantage, I could cause the victim application to allocate anonymous memory mappings arbitrarily. In the newly-created memory mapping, I could inject arbitrary code. Since a typical operating system treats debuggers as God-like applications, the memory mapping could be mapped without write access, but as read and execute only. Thus enabling the stealth that I sought.<br>
The project took a few years to develop in my spare time. I ended up creating several iterations, taking a rough draft/Proof-of-Concept style code and rewriting it to be more efficient and effective.<br>
I had toyed with FreeBSD off-and-on for over a decade by this point, but by-and-large I was still mostly using Linux. FreeBSD gained DTrace and ZFS support, winning me over from the Linux camp. I ported libhijack to FreeBSD, giving it support for both Linux and FreeBSD simultaneously.<br>
In 2013, I started work on helping Oliver Pinter with his ASLR implementation, which was originally destined to be upstreamed to FreeBSD. It took a lot of work, and my interest in libhijack faded. As a natural consequence, I handed libhijack over to SoldierX, asking the community to take it and enhance it.<br>
Over four years went by without a single commit. The project was essentially abandoned. My little baby was dead.<br>
This past week, I wondered if libhijack could even compile on FreeBSD anymore. Given that four years have passed by and major changes have happened in those four years, I thought libhijack would need a major overhaul just to compile, let alone function. Imagine my surprise when libhijack needed only a few fixups to account for changes in FreeBSD&#39;s RTLD.<br>
Today, I&#39;m announcing the revival of libhijack. No longer is it dead, but very much alive. In order to develop the project faster, I&#39;ve decided to remove support for Linux, focusing instead on FreeBSD. I&#39;ve removed hundreds of lines of code over the past few days. Supporting both FreeBSD and Linux meant some code had to be ugly. Now the beautification process has begun.<br>
I&#39;m announcing the availability of libhijack 0.7.0 today. The ABI and API should be considered unstable as they may change without notice.<br>
Note that HardenedBSD fully mitigates libhijack from working with two security features: setting security.bsd.unprivileged_proc_debug to 0 by default and the implementation of PaX NOEXEC.<br>
The security.bsd.unprivileged_proc_debug sysctl node prevents PTrace access for applications the debugger itself did not fork+execve for unprivileged (non-root) users. Privileged users (the root account) can use PTrace to its fullest extent.<br>
HardenedBSD&#39;s implementation of PaX NOEXEC prevents the creation of memory mappings that are both writable and executable. It also prevents using mprotect to toggle between writable and executable. In libhijack&#39;s case, FreeBSD grants libhijack the ability to write to memory mappings that are not marked writable. Debuggers do this to set breakpoints. HardenedBSD behaves differently due to PaX NOEXEC.<br>
Each memory mapping has a notion of a maximum protection level. When a memory mapping is created, if the write bit is set, then HardenedBSD drops the execute bit from the maximum protection level. When the execute bit is set at memory mapping creation time, then the write bit is dropped from the maximum protection level. If both the write and execute bits are set, then the execute bit is silently dropped from both the mapping creation request and the maximum protection level. <br>
The maximum protection level is always obeyed, even for debuggers. Thus we see that PaX NOEXEC is 100% effective in preventing libhijack from injecting code into a process. Here is a screenshot showing PaX NOEXEC preventing libhijack from injecting shellcode into a newly-created memory mapping.</p>
</blockquote>

<ul>
<li>What&#39;s next for libhijack? Here&#39;s what we have planned, in no particular order:

<ul>
<li>Python bindings</li>
<li>Port to arm64</li>
<li>This requires logic for handling machine-dependent code. High priority.</li>
<li>Finish anonymous shared object injection. </li>
<li>This requires implementing a custom RTLD from within libhijack. </li>
<li>More cleanups. Adhere to style(9).</li>
</ul></li>
<li>libhijack can be found on GitHub @ <a href="https://github.com/SoldierX/libhijack" rel="nofollow">https://github.com/SoldierX/libhijack</a>
***</li>
</ul>

<h3><a href="https://blather.michaelwlucas.com/archives/2988" rel="nofollow">Contributing to FreeBSD</a></h3>

<blockquote>
<p>I’ve talked to a whole bunch of folks who say things like “I’m a junior programmer. I’m looking for a way to help. I have no specific expertise, but I’m willing to learn.” Today, I present such junior programmers with an opportunity. An opportunity for you to learn skills that will be incredibly valuable to your career, and will simultaneously expand your career opportunities.<br>
For decades, FreeBSD has relied on its users for testing. They expect users to install pre-release versions of the OS and exercise them to identify regressions. That’s necessary, but it’s nowhere near enough.<br>
The FreeBSD Testing Project is building an automated test suite for the entire operating system. They have a whole mess of work to do. There’s only four people on the team, so each additional person that contributes can have a serious impact. They have tutorials on how to write tests, and sample tests.<br>
There’s a whole bunch of tests left to be written. You have an almost open field. They need tests for everything from ls(1) to bhyve. (Yes, ls(1) broke at one point in the last few years.) Everything needs testing. Learning to write, submit, and commit small tests is valuable experience for developing the big tests.<br>
What’s more, learning to write tests for a system means learning the system. Developing tests will transform you into a FreeBSD expert. Once you’ve demonstrated your competence, worth, and ability to work within the project, other FreeBSD teams will solicit your help and advice. The Project will suck you in.<br>
Testing is perhaps the most valuable contribution anyone can make to an open source project. And this door into the FreeBSD Project is standing wide, wide open.</p>

<hr>
</blockquote>

<h3><a href="https://mrsatterly.com/openbsd_games.html" rel="nofollow">OpenBSD Gaming Resource</a></h3>

<ul>
<li>&gt; What isn&#39;t there to love about playing video games on your favorite operating system? OpenBSD and video games feels like a natural combination to me. My resource has software lists, links to free games not in ports, lists of nonfree games, and recommendations.</li>
<li>The Table of Contents has these high-level items for you:</li>
<li>&gt; General Resources</li>
<li>&gt; OpenBSD Exclusive</li>
<li>&gt; Ports</li>
<li>&gt; Network Clients</li>
<li>&gt; Browser Games</li>
<li>&gt; Game Engines</li>
<li>&gt; Multiple Game Engines</li>
<li>&gt; Multiple System Emulation</li>
<li>&gt; Computer Emulation</li>
<li>&gt; Game Console Emulation</li>
<li>&gt; Live Media Emulation</li>
<li>&gt; Operating System Emulation</li>
<li>&gt; Games in Other Software</li>
<li>Have fun with these games!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.dragonflydigest.com/2017/08/07/20061.html" rel="nofollow">Dragonfly introduces kcollect(8)</a></li>
<li><a href="http://facesofopensource.com/unix/" rel="nofollow">The Faces of Open Source</a></li>
<li><a href="https://www.joyent.com/blog/joyent-edgemesh-cache-me-if-you-can" rel="nofollow">Edgemesh CEO, Jake Loveless and Joyent CTO, Bryan Cantrill join together for a fireside chat to discuss distributed caching at scale, Docker, Node.js, Mystery Science Theater 3000, and more!</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=322297" rel="nofollow">UFS: Place the information needed to find alternate superblocks to the end of the area reserved for the boot block</a></li>
<li><a href="https://tools.ietf.org/html/draft-west-let-localhost-be-localhost-04" rel="nofollow">Let ‘localhost’ be localhost</a></li>
<li>Hurry up and register for <a href="http://www.verisign.com/en_US/internet-technology-news/verisign-events/vbsdcon/index.xhtml?dmn=vBSDcon.com" rel="nofollow">vBSDCon September 7-9</a> and <a href="https://2017.eurobsdcon.org/" rel="nofollow">EuroBSDCon September 21-24</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Morgan - <a href="http://dpaste.com/0JEYE1K" rel="nofollow">btrfs deprecated</a></li>
<li>Ben - <a href="http://dpaste.com/2TP90HD" rel="nofollow">UEFI, GELI, BEADM, and more</a></li>
<li>Brad - <a href="http://dpaste.com/1MQH1BD" rel="nofollow">Hostname Clarification</a></li>
<li>M Rod - <a href="http://dpaste.com/39C6PGN" rel="nofollow">BSD Laptop</a></li>
<li>Jeremy - <a href="http://dpaste.com/3SVP5SF" rel="nofollow">Contributing to BSDs</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>207: Bridge over the river Cam</title>
  <link>https://www.bsdnow.tv/207</link>
  <guid isPermaLink="false">700ab007-00c0-4527-8cf8-1cfd03b3f2ca</guid>
  <pubDate>Wed, 16 Aug 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/700ab007-00c0-4527-8cf8-1cfd03b3f2ca.mp3" length="74300980" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We recap our devsummit experiences at BSDCambridge, share why memcmp is more complicated than expected, explore Docker on FreeBSD, and we look at a retro terminal.</itunes:subtitle>
  <itunes:duration>1:43:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We recap our devsummit experiences at BSDCambridge, share why memcmp is more complicated than expected, explore Docker on FreeBSD, and we look at a retro terminal.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
BSDCam recap (https://wiki.freebsd.org/DevSummit/201708)
The 2017 Cambridge DevSummit took place from 2-4 August 2017. The event took place over three days including a formal dinner at St John's College, and was attended by 55 registered developers and guests.
Prior to the start of the conference, we had a doc hacking lounge, the computer lab provided a room where we could meet and try to spend some time on documentation. Sevan walked two interested people through the process of creating a documentation patch and submitting it for the first time. In the process, found ways to improve the documentation on how to write documentation.
The event is run "un-conference style" in that we brainstorm the actual session schedule on the first morning, with a focus on interactive topics that reflect the interests and exploit the knowledge of the attendees.
The idea is to maximize the amount of discussion and decisions that can be made while we are all in the same room
The first morning, we all gather in the slightly too small, and even more slightly under air conditioned FW11 classroom. We go around the room introducing ourselves, and listing a few topics we would be interested in discussing. Eventually the whiteboard is full of topics, with various numbers of ticks beside them to indicate the number of interested people
There are breakout rooms of all sizes, so even topics with only a small group of interested folks can get a lot accomplished
The most difficult is trying to schedule the sessions, as there is much overlap and people usually want to be in concurrent sessions, or someone's schedule means they won’t be available that day, etc.
This years working groups:
Toolchain (Compilers, Linkers, External Toolchain, Static analysis and sanitizers)
Virtualization (bhyve, xen, jails, docker)
Transport (TCP) and Network Performance
Security and mitigations (W^X, noexec stack, CFI, ASLR, KASLR, Safe Stack, etc)
Testing (Status, What to test, How to test, QA for releases)
Capsicum (Automation with LLVM etc, Casper, Namespacing, “Services”, capsh)
Desktop / WiFi (drm-next, drivers, resume, power, installer, desktop, OOB Experience)
Tracing (Blackbox, DTrace, KTR, ptrace, truss, hardware tracing)
Packaging and Packaged Base (Sets, Kernels, Ports &amp;amp; flavours, sub-packages, privlib)
Architectural Security Features (CPU Features: SGX, PXN/PAN, Pointer Authentication, AMD Memory Encryption, Libcrunch, RISC-V, CheriABI)
Architectures and Embedded systems (RISC-V, ARM, ARM64, MIPS(64), SPARC64)
Teaching (Audiences, Objectives, Targets, Material, future directions)
Provisioning and Management Tools (CfgMgmt tools, Image building, VM/bhyve orchestration, Preconfigured VMs for testing, Wishlist)
Storage (ZFS status update, ZFS encryption infrastructure, ZFS Zero Copy / Sendfile, Acceleration of checksums and raidz parity calculations, sesutil, mpsutil)
And that wasn’t everything. We then had a series of short talklets:
Enhancing and replacing mmap()
SDIO support
eBPF support for FreeBSD
Tracing + Virtualization
Practical DMA Attack Protection
On Thursday night there was a special dinner at St John's College
Overall it was a great DevSummit, and I even managed to get some of the work assigned to me finished. Shortly I will commit an update to the boot loader menu that will automatically populate the kernel selection menu with the automatically detected list of installed kernels. The list is also properly refreshed when you switch boot environments.
***
Hosts/BSD – for when you need to run your BSD inside a penguin (https://wiki.qemu.org/index.php/Hosts/BSD)
This wiki provides details on how to run each of the various BSDs under QEMU
The target audience is Linux developers looking to test their apps etc under BSD
The wiki is in need of some love, there are some option questions, and it lacks some polish
There are instructions on building qemu from source, but it should likely mention the qemu-devel port
There should probably also be instructions on using other architectures, like ARM/MIPS etc
If you have used QEMU, or would like to spend the time to learn how, please help update this wiki
***
memcmp -- more complicated than you might expect (http://trust-in-soft.com/memcmp-requires-pointers-to-fully-valid-buffers/)
“A suspicious pattern in open-source software”
One bug recently found by John using tis-interpreter on a widely used open-source library involved the comparison of strings with memcmp. The unexpected condition was that memcmp was, in one case, called with a pointer to a buffer shorter than the length passed as third argument, breaking one of the two symmetrical pre-conditions in the function’s ACSL contract
A reason that may have made this use of memcmp look okay to the developer is that the buffers being passed to it always differed before the end of the buffers were reached.
a memcmp implementation based on stopping as soon as a difference is found, would not have caused any out-of-bounds read access
The first question raised was whether the pattern memcmp("a", "bc", 3) was problematic according to the letter of the C standard. If it was, the second question was whether the busy maintainer of one of the Open Source packages that make the Internet tick should be bothered with a bug report.
I would like to be able to say that memcmp’s ACSL contract was the product of careful deliberation, but unfortunately this is not the case: many standard function contracts were written quickly in order to get most of the standard library covered, and have not been tested by time. Anyway, upon proofreading the relevant clause in the C11 standard, my feeling was that the ACSL formalization was, in this particular case, right, and that it was undefined behavior to pass as memcmp argument a buffer that wasn’t fully valid, even if the implementation sort-of needs to read the buffer’s characters in order for the purpose of finding the first mismatch.
The post then goes on to look at the memcmp code in glibc
There are two distinct optimizations for long buffers, one that applies when both buffers start at the same offset modulo the word size, memcmpcommonalignment, and one that applies when they don’t, memcmpnotcommonalignment.
The function memcmpcommonalignment is relatively well-behaved: it reads from the two buffers aligned word by aligned word, and thus reads the entire words that contain differing bytes. If the caller passed buffers that aren’t valid after the differing byte, this amounts to reading out of bounds, but this sort of out-of-bounds access is not detected by the typical MMU, which works at the scale of the page.
The “notcommon_alignment” case, however, tells a different story. When passed the carefully (mis-)aligned buffers t1 and (char*)t2+1, although these buffers differ in the 8th byte, Glibc’s implementation of memcmp reads 8 bytes beyond the end of t1. By making the 16th byte differ instead of the 8th one, it is also possible to make Glibc’s implementation of memcmp read 16 bytes beyond the end of t1.
In conclusion, yes, some implementations of memcmp will crash when invoked with buffers that aren’t valid for the full length, even if they differ early. The circumstances are rare (probably the reason this bug was still there to be found in a library that had already been tested with all the available techniques) but outside the programmer’s control. The pattern described in this post should be reported as a bug when found.
It is interesting to read the detailed analysis of a bug in such a basic libc feature
***
News Roundup
Docker on FreeBSD (http://daemon-notes.com/articles/network/docker)
There are two approaches to running Docker on FreeBSD. First one was created back in 2015 and it was a native port of Docker engine to FreeBSD. It was an ambitious project but nobody stepped forward to continuously port the never-ending flow of upstream code to FreeBSD. So the port still exists (sysutils/docker-freebsd) but it wasn't updated since 2015 and it is Docker v1 (it is v17 as of 2017).
The other approach is to use official way of running Docker on platforms other than Linux. Well, somewhat official as Docker still does not support FreeBSD as a host officially. This is docker-machine tool which in turn will use VirtualBox to run a virtual machine with Linux and Docker engine. docker utility on the host will communicate with the engine inside VB where all the work will be done. This article describes what needs to be done to start using it.
Before we begin you need VirtualBox installed. Do not skip adding /boot/loader.conf and /etc/rc.conf lines mentioned on that page. You won't need user inteface or anything, docker-machine will do all the work, just make sure VirtualBox is present and ready to be used.
`pkg install docker docker-machine docker-compose’
Docker will store its stuff in ~/.docker. You might not want the virtual machine image files to live in your home, in this case just create a symlink:
mkdir ~/.docker
ln -s /storage/docker ~/.docker/machine
docker-machine create --driver virtualbox \
   --virtualbox-memory 2048 \
   --virtualbox-cpu-count 2 \
   --virtualbox-disk-size 102400 \
   --virtualbox-hostonly-cidr "10.2.1.1/24" \
   docker1
Here's the example. We are creating machine named docker1. It is using VirtualBox driver, the vm has 2G of memory, 2 cores and 100G of disk space. docker-machine setups VirtualBox to use host-only network adapter (it will create vboxnet0 interface on the host automatically) and we are instructing it to use 10.2.1.1/24 as the address of this adapter — change it to what suits your needs or omit this flag (default is 192.168.99.1/24).
And basically that is all. Check if it is running:
docker-machine ls
If you do open VirtualBox interface you will find a virtual machine named docker1 running. You can start/stop/whatever your machine using docker-machine utility.
Here’s how you can connect to the machine:
docker utility by default tries to talk to Docker engine running on the same host. However with specific environment variables you can instruct it to talk to other host. docker-machine can export these variables for you.
eval docker-machine env docker1
docker run hello-world
There was quite a bit of discussion about docker at the FreeBSD developers summit in Cambridge during the first week of August. Two docker developers who had worked on the Mac OS X port, one of whom is an OpenBSD advocate, explained how docker has evolved, and the linux-isms have been abstracted away such that a truly native docker solution for FreeBSD can be built and maintained with a lot less headache than before
I look forward to seeing if we can’t make that happen
***
The POSIX Shell And Utilities (http://shellhaters.org/)
The POSIX Shell And Utilities
Compiled for The Shell Hater's Handbook
***
PostgreSQL – logging to a file (http://dan.langille.org/2017/07/31/postgresql-logging-to-a-file/)
These steps were carried out on FreeBSD 11.0 with PostgreSQL 9.6 (two of my favorite tools).
I like logging. I like logging PostgreSQL. With logs, you can see what happened. Without, you can only guess.
Setting up logging for PostgreSQL involves several parts, each of which must be completed or else I don’t get what I want. This is not a criticism of PostgreSQL. It’s a feature.
I am documenting this because each time I configure a new PostgreSQL instance, it takes me more than one iteration to get it working. The goal: this post lets both you and me get it right the first time.
The parts include:
+ Telling PostgreSQL to log via syslog
+ Telling FreeBSD to local postgres to /var/log/postgres.log (my preference).
+ Telling PostgreSQL the things you want logged.
+ Changes to postgresql.conf
The file location varies with the version installed. For PostgreSQL 9.6 on FreeBSD, the file is /var/db/postgres/data96/postgresql.conf (adjust 96 according to the version installed).
I made these changes to that file.

log_destination = 'syslog'
log_min_messages = notice
log_min_error_statement = notice
log_checkpoints = on
log_lock_waits = on
log_timezone = 'UTC'

By default, PostgreSQL logs to the local0 facility and is controlled by the syslog_facility in postgresql.conf. This will be used in syslog.conf (see the next section of this post).
The above mentioned changes require a reload: 
service postgresql reload
Changes to /etc/syslog.conf
Now that we have PostgreSQL logging to syslog, we want to tell syslog where to put those messages.
I changed this line in /etc/syslog.conf:*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err  /var/log/messages
With .notice pulling in some local0 messages, adding local0.none to the line will free the messages up for later use in the configuration file. Otherwise, the PostgreSQL messages will be in /var/log/messages.
The changed line is:
`.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err;local0.none   /var/log/messages
Then, to get the messages into my preferred location, I added this to the file:
local0.*     /var/log/postgresql.log`
Log file rotation
For rotating my log file, I added a new file: /usr/local/etc/newsyslog.conf.d/postgresql96

/var/log/postgresql.log     pgsql:wheel  640  7     *    $D0   GB  /var/db/postgres/data96/postmaster.pid 30

Before restarting syslog, I did this, so the destination file existed. This isn’t always/strictly necessary, but because the ownership is not chown root:wheel, I do it to get that part set.

touch /var/log/postgresql.log
chown pgsql:wheel

Restarting syslog:

sudo kill -HUP `sudo cat /var/run/syslog.pid `

That’s it Now you should see PostgreSQL logging in /var/log/postgresql.log.
mandoc-1.14.2 released (http://undeadly.org/cgi?action=article&amp;amp;sid=20170729122350)
i just released portable mandoc-1.14.2. It is available now from http://mandoc.bsd.lv/ (http://mandoc.bsd.lv/).
```From: Ingo Schwarze schwarze@usta.de
Date: Fri, 28 Jul 2017 20:12:44 +0200
To: discuss@mandoc.bsd.lv
Subject: mandoc-1.14.2 released
Hi,
i just released portable mandoc-1.14.2.
It is available now from http://mandoc.bsd.lv/ .
All downstream maintainers are encouraged to update their ports
and packages from 1.14.1 to 1.14.2.
Mandoc 1.14.2 is a feature release introducing:
a new -Tmarkdown output mode
anchors for deep linking into -Thtml manual pages
a superset of the functionality of the former mdoclint(1) utility
a new -Wstyle message level with several new messages
automatic line breaking inside individual tbl(7) cells
a rewrite of the eqn(7) lexer, and some eqn(7) rendering improvements
support for many additional low-level roff(7) features
and various smaller features and bug fixes.
For more details, see: http://mandoc.bsd.lv/NEWS
With the improved mandoc features, only twenty-five out of the
ten thousand software packages in the OpenBSD ports tree still
need groff to format their manual pages.
Since the project has been called "mandoc" rather than "mdocml"
for several years now, the website, the distribution tarball,
and the source extraction directory are now also called "mandoc"
rather than "mdocml".
The release was tested on the following systems:
+ OpenBSD-current and OpenBSD-stable
+ NetBSD-current
+ illumos
+ Debian Linux
+ Void Linux x86_64 glibc and musl
+ Crux Linux
+ SunOS 5.11.2, 5.10, and 5.9
As before, catman(8) and the regression suite cannot be used on
SunOS 5.10 and SunOS 5.9.
A big thanks to everybody who provided patches, bug reports,
feature suggestions, advice, and help with testing!
Yours,
  Ingo```
Beastie Bits
A good looking terminal emulator which mimics the old cathode display. Available in x11/cool-retro-terminal (https://github.com/Swordfish90/cool-retro-term)
Milestone Complete! OpenRC conversion (https://www.trueos.org/blog/milestone-complete-openrc-conversion/)
Healthy developer interaction between FreeBSD and IllumOS re: mdb (https://illumos.topicbox.com/groups/developer/discussions/T5eae6079331c4df4)
Large Batch of Kernel Errata Patches Released (http://undeadly.org/cgi?action=article&amp;amp;sid=20170804053102)
opnsense 17.7 released (https://opnsense.org/opnsense-17-7-released/)
Twitter Co-Founder and CEO states “FreeBSD rules them all” (https://twitter.com/jack/status/892605692317650944)
Hurry up and register for vBSDCon September 7-9 (http://www.verisign.com/en_US/internet-technology-news/verisign-events/vbsdcon/index.xhtml?dmn=vBSDcon.com) and EuroBSDCon September 21-24 (https://2017.eurobsdcon.org/)
***
Feedback/Questions
Dominik - Monitoring Software (http://dpaste.com/08971FQ)
Darren - Wonderful Awk (http://dpaste.com/0YCS4DN)
Andrew - Thanks (http://dpaste.com/0ZREKTV)
Jens - Migration Questions (http://dpaste.com/1GVZNWN)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We recap our devsummit experiences at BSDCambridge, share why memcmp is more complicated than expected, explore Docker on FreeBSD, and we look at a retro terminal.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://wiki.freebsd.org/DevSummit/201708" rel="nofollow">BSDCam recap</a></h3>

<blockquote>
<p>The 2017 Cambridge DevSummit took place from 2-4 August 2017. The event took place over three days including a formal dinner at St John&#39;s College, and was attended by 55 registered developers and guests.</p>
</blockquote>

<ul>
<li>Prior to the start of the conference, we had a doc hacking lounge, the computer lab provided a room where we could meet and try to spend some time on documentation. Sevan walked two interested people through the process of creating a documentation patch and submitting it for the first time. In the process, found ways to improve the documentation on how to write documentation.</li>
</ul>

<blockquote>
<p>The event is run &quot;un-conference style&quot; in that we brainstorm the actual session schedule on the first morning, with a focus on interactive topics that reflect the interests and exploit the knowledge of the attendees.</p>
</blockquote>

<ul>
<li>The idea is to maximize the amount of discussion and decisions that can be made while we are all in the same room</li>
<li>The first morning, we all gather in the slightly too small, and even more slightly under air conditioned FW11 classroom. We go around the room introducing ourselves, and listing a few topics we would be interested in discussing. Eventually the whiteboard is full of topics, with various numbers of ticks beside them to indicate the number of interested people</li>
<li>There are breakout rooms of all sizes, so even topics with only a small group of interested folks can get a lot accomplished</li>
<li>The most difficult is trying to schedule the sessions, as there is much overlap and people usually want to be in concurrent sessions, or someone&#39;s schedule means they won’t be available that day, etc.</li>
<li>This years working groups:

<ul>
<li>Toolchain (Compilers, Linkers, External Toolchain, Static analysis and sanitizers)</li>
<li>Virtualization (bhyve, xen, jails, docker)</li>
<li>Transport (TCP) and Network Performance</li>
<li>Security and mitigations (W<sup>X,</sup> noexec stack, CFI, ASLR, KASLR, Safe Stack, etc)</li>
<li>Testing (Status, What to test, How to test, QA for releases)</li>
<li>Capsicum (Automation with LLVM etc, Casper, Namespacing, “Services”, capsh)</li>
<li>Desktop / WiFi (drm-next, drivers, resume, power, installer, desktop, OOB Experience)</li>
<li>Tracing (Blackbox, DTrace, KTR, ptrace, truss, hardware tracing)</li>
<li>Packaging and Packaged Base (Sets, Kernels, Ports &amp; flavours, sub-packages, privlib)</li>
<li>Architectural Security Features (CPU Features: SGX, PXN/PAN, Pointer Authentication, AMD Memory Encryption, Libcrunch, RISC-V, CheriABI)</li>
<li>Architectures and Embedded systems (RISC-V, ARM, ARM64, MIPS(64), SPARC64)</li>
<li>Teaching (Audiences, Objectives, Targets, Material, future directions)</li>
<li>Provisioning and Management Tools (CfgMgmt tools, Image building, VM/bhyve orchestration, Preconfigured VMs for testing, Wishlist)</li>
<li>Storage (ZFS status update, ZFS encryption infrastructure, ZFS Zero Copy / Sendfile, Acceleration of checksums and raidz parity calculations, sesutil, mpsutil)</li>
</ul></li>
<li>And that wasn’t everything. We then had a series of short talklets:

<ul>
<li>Enhancing and replacing mmap()</li>
<li>SDIO support</li>
<li>eBPF support for FreeBSD</li>
<li>Tracing + Virtualization</li>
<li>Practical DMA Attack Protection</li>
</ul></li>
<li>On Thursday night there was a special dinner at St John&#39;s College</li>
<li>Overall it was a great DevSummit, and I even managed to get some of the work assigned to me finished. Shortly I will commit an update to the boot loader menu that will automatically populate the kernel selection menu with the automatically detected list of installed kernels. The list is also properly refreshed when you switch boot environments.
***</li>
</ul>

<h3><a href="https://wiki.qemu.org/index.php/Hosts/BSD" rel="nofollow">Hosts/BSD – for when you need to run your BSD inside a penguin</a></h3>

<ul>
<li>This wiki provides details on how to run each of the various BSDs under QEMU</li>
<li>The target audience is Linux developers looking to test their apps etc under BSD</li>
<li>The wiki is in need of some love, there are some option questions, and it lacks some polish</li>
<li>There are instructions on building qemu from source, but it should likely mention the qemu-devel port</li>
<li>There should probably also be instructions on using other architectures, like ARM/MIPS etc</li>
<li>If you have used QEMU, or would like to spend the time to learn how, please help update this wiki
***</li>
</ul>

<h3><a href="http://trust-in-soft.com/memcmp-requires-pointers-to-fully-valid-buffers/" rel="nofollow">memcmp -- more complicated than you might expect</a></h3>

<blockquote>
<p>“A suspicious pattern in open-source software”<br>
One bug recently found by John using tis-interpreter on a widely used open-source library involved the comparison of strings with memcmp. The unexpected condition was that memcmp was, in one case, called with a pointer to a buffer shorter than the length passed as third argument, breaking one of the two symmetrical pre-conditions in the function’s ACSL contract<br>
A reason that may have made this use of memcmp look okay to the developer is that the buffers being passed to it always differed before the end of the buffers were reached.<br>
a memcmp implementation based on stopping as soon as a difference is found, would not have caused any out-of-bounds read access<br>
The first question raised was whether the pattern memcmp(&quot;a&quot;, &quot;bc&quot;, 3) was problematic according to the letter of the C standard. If it was, the second question was whether the busy maintainer of one of the Open Source packages that make the Internet tick should be bothered with a bug report.<br>
I would like to be able to say that memcmp’s ACSL contract was the product of careful deliberation, but unfortunately this is not the case: many standard function contracts were written quickly in order to get most of the standard library covered, and have not been tested by time. Anyway, upon proofreading the relevant clause in the C11 standard, my feeling was that the ACSL formalization was, in this particular case, right, and that it was undefined behavior to pass as memcmp argument a buffer that wasn’t fully valid, even if the implementation sort-of needs to read the buffer’s characters in order for the purpose of finding the first mismatch.</p>
</blockquote>

<ul>
<li>The post then goes on to look at the memcmp code in glibc</li>
</ul>

<blockquote>
<p>There are two distinct optimizations for long buffers, one that applies when both buffers start at the same offset modulo the word size, memcmp_common_alignment, and one that applies when they don’t, memcmp_not_common_alignment.<br>
The function memcmp_common_alignment is relatively well-behaved: it reads from the two buffers aligned word by aligned word, and thus reads the entire words that contain differing bytes. If the caller passed buffers that aren’t valid after the differing byte, this amounts to reading out of bounds, but this sort of out-of-bounds access is not detected by the typical MMU, which works at the scale of the page.<br>
The “not_common_alignment” case, however, tells a different story. When passed the carefully (mis-)aligned buffers t1 and (char*)t2+1, although these buffers differ in the 8th byte, Glibc’s implementation of memcmp reads 8 bytes beyond the end of t1. By making the 16th byte differ instead of the 8th one, it is also possible to make Glibc’s implementation of memcmp read 16 bytes beyond the end of t1.<br>
In conclusion, yes, some implementations of memcmp will crash when invoked with buffers that aren’t valid for the full length, even if they differ early. The circumstances are rare (probably the reason this bug was still there to be found in a library that had already been tested with all the available techniques) but outside the programmer’s control. The pattern described in this post should be reported as a bug when found.</p>
</blockquote>

<ul>
<li>It is interesting to read the detailed analysis of a bug in such a basic libc feature
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://daemon-notes.com/articles/network/docker" rel="nofollow">Docker on FreeBSD</a></h3>

<blockquote>
<p>There are two approaches to running Docker on FreeBSD. First one was created back in 2015 and it was a native port of Docker engine to FreeBSD. It was an ambitious project but nobody stepped forward to continuously port the never-ending flow of upstream code to FreeBSD. So the port still exists (sysutils/docker-freebsd) but it wasn&#39;t updated since 2015 and it is Docker v1 (it is v17 as of 2017).<br>
The other approach is to use official way of running Docker on platforms other than Linux. Well, somewhat official as Docker still does not support FreeBSD as a host officially. This is docker-machine tool which in turn will use VirtualBox to run a virtual machine with Linux and Docker engine. docker utility on the host will communicate with the engine inside VB where all the work will be done. This article describes what needs to be done to start using it.<br>
Before we begin you need VirtualBox installed. Do not skip adding /boot/loader.conf and /etc/rc.conf lines mentioned on that page. You won&#39;t need user inteface or anything, docker-machine will do all the work, just make sure VirtualBox is present and ready to be used.<br>
`pkg install docker docker-machine docker-compose’<br>
Docker will store its stuff in ~/.docker. You might not want the virtual machine image files to live in your home, in this case just create a symlink:<br>
mkdir ~/.docker<br>
ln -s /storage/docker ~/.docker/machine<br>
docker-machine create --driver virtualbox \<br>
   --virtualbox-memory 2048 \<br>
   --virtualbox-cpu-count 2 \<br>
   --virtualbox-disk-size 102400 \<br>
   --virtualbox-hostonly-cidr &quot;10.2.1.1/24&quot; \<br>
   docker1<br>
Here&#39;s the example. We are creating machine named docker1. It is using VirtualBox driver, the vm has 2G of memory, 2 cores and 100G of disk space. docker-machine setups VirtualBox to use host-only network adapter (it will create vboxnet0 interface on the host automatically) and we are instructing it to use 10.2.1.1/24 as the address of this adapter — change it to what suits your needs or omit this flag (default is 192.168.99.1/24).<br>
And basically that is all. Check if it is running:<br>
docker-machine ls<br>
If you do open VirtualBox interface you will find a virtual machine named docker1 running. You can start/stop/whatever your machine using docker-machine utility.</p>
</blockquote>

<ul>
<li>Here’s how you can connect to the machine:</li>
</ul>

<blockquote>
<p>docker utility by default tries to talk to Docker engine running on the same host. However with specific environment variables you can instruct it to talk to other host. docker-machine can export these variables for you.<br>
eval <code>docker-machine env docker1</code><br>
docker run hello-world</p>
</blockquote>

<ul>
<li>There was quite a bit of discussion about docker at the FreeBSD developers summit in Cambridge during the first week of August. Two docker developers who had worked on the Mac OS X port, one of whom is an OpenBSD advocate, explained how docker has evolved, and the linux-isms have been abstracted away such that a truly native docker solution for FreeBSD can be built and maintained with a lot less headache than before</li>
<li>I look forward to seeing if we can’t make that happen
***</li>
</ul>

<h3><a href="http://shellhaters.org/" rel="nofollow">The POSIX Shell And Utilities</a></h3>

<ul>
<li>The POSIX Shell And Utilities</li>
<li>Compiled for The Shell Hater&#39;s Handbook
***</li>
</ul>

<h3><a href="http://dan.langille.org/2017/07/31/postgresql-logging-to-a-file/" rel="nofollow">PostgreSQL – logging to a file</a></h3>

<blockquote>
<p>These steps were carried out on FreeBSD 11.0 with PostgreSQL 9.6 (two of my favorite tools).<br>
I like logging. I like logging PostgreSQL. With logs, you can see what happened. Without, you can only guess.<br>
Setting up logging for PostgreSQL involves several parts, each of which must be completed or else I don’t get what I want. This is not a criticism of PostgreSQL. It’s a feature.<br>
I am documenting this because each time I configure a new PostgreSQL instance, it takes me more than one iteration to get it working. The goal: this post lets both you and me get it right the first time.<br>
The parts include:</p>

<ul>
<li>Telling PostgreSQL to log via syslog</li>
<li>Telling FreeBSD to local postgres to /var/log/postgres.log (my preference).</li>
<li>Telling PostgreSQL the things you want logged.</li>
<li>Changes to postgresql.conf
The file location varies with the version installed. For PostgreSQL 9.6 on FreeBSD, the file is /var/db/postgres/data96/postgresql.conf (adjust 96 according to the version installed).
I made these changes to that file.
<code>
log_destination = &#39;syslog&#39;
log_min_messages = notice
log_min_error_statement = notice
log_checkpoints = on
log_lock_waits = on
log_timezone = &#39;UTC&#39;
</code>
By default, PostgreSQL logs to the local0 facility and is controlled by the syslog_facility in postgresql.conf. This will be used in syslog.conf (see the next section of this post).
The above mentioned changes require a reload: 
<code>service postgresql reload</code></li>
</ul>
</blockquote>

<ul>
<li>Changes to /etc/syslog.conf</li>
</ul>

<blockquote>
<p>Now that we have PostgreSQL logging to syslog, we want to tell syslog where to put those messages.<br>
I changed this line in /etc/syslog.conf:<code>*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err  /var/log/messages</code><br>
With <em>.notice pulling in some local0 messages, adding local0.none to the line will free the messages up for later use in the configuration file. Otherwise, the PostgreSQL messages will be in /var/log/messages.<br>
The changed line is:<br>
`</em>.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err;local0.none   /var/log/messages<code><br>
Then, to get the messages into my preferred location, I added this to the file:<br>
</code>local0.*     /var/log/postgresql.log`</p>
</blockquote>

<ul>
<li>Log file rotation</li>
</ul>

<blockquote>
<p>For rotating my log file, I added a new file: /usr/local/etc/newsyslog.conf.d/postgresql96</p>

<pre><code>/var/log/postgresql.log     pgsql:wheel  640  7     *    $D0   GB  /var/db/postgres/data96/postmaster.pid 30
</code></pre>

<p>Before restarting syslog, I did this, so the destination file existed. This isn’t always/strictly necessary, but because the ownership is not chown root:wheel, I do it to get that part set.</p>

<pre><code>touch /var/log/postgresql.log
chown pgsql:wheel
</code></pre>

<p>Restarting syslog:</p>

<pre><code>sudo kill -HUP `sudo cat /var/run/syslog.pid `
</code></pre>

<p>That’s it Now you should see PostgreSQL logging in /var/log/postgresql.log.</p>
</blockquote>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170729122350" rel="nofollow">mandoc-1.14.2 released</a></h3>

<blockquote>
<p>i just released portable mandoc-1.14.2. It is available now from <a href="http://mandoc.bsd.lv/" rel="nofollow">http://mandoc.bsd.lv/</a>.</p>
</blockquote>

<p>```From: Ingo Schwarze <a href="mailto:schwarze@usta.de" rel="nofollow">schwarze@usta.de</a><br>
Date: Fri, 28 Jul 2017 20:12:44 +0200<br>
To: <a href="mailto:discuss@mandoc.bsd.lv" rel="nofollow">discuss@mandoc.bsd.lv</a><br>
Subject: mandoc-1.14.2 released</p>

<p>Hi,</p>

<p>i just released portable mandoc-1.14.2.<br>
It is available now from <a href="http://mandoc.bsd.lv/" rel="nofollow">http://mandoc.bsd.lv/</a> .</p>

<p>All downstream maintainers are encouraged to update their ports<br>
and packages from 1.14.1 to 1.14.2.</p>

<p>Mandoc 1.14.2 is a feature release introducing:</p>

<ul>
<li>a new -Tmarkdown output mode</li>
<li>anchors for deep linking into -Thtml manual pages</li>
<li>a superset of the functionality of the former mdoclint(1) utility</li>
<li>a new -Wstyle message level with several new messages</li>
<li>automatic line breaking inside individual tbl(7) cells</li>
<li>a rewrite of the eqn(7) lexer, and some eqn(7) rendering improvements</li>
<li>support for many additional low-level roff(7) features</li>
<li>and various smaller features and bug fixes.</li>
</ul>

<p>For more details, see: <a href="http://mandoc.bsd.lv/NEWS" rel="nofollow">http://mandoc.bsd.lv/NEWS</a></p>

<p>With the improved mandoc features, only twenty-five out of the<br>
ten thousand software packages in the OpenBSD ports tree still<br>
need groff to format their manual pages.</p>

<p>Since the project has been called &quot;mandoc&quot; rather than &quot;mdocml&quot;<br>
for several years now, the website, the distribution tarball,<br>
and the source extraction directory are now also called &quot;mandoc&quot;<br>
rather than &quot;mdocml&quot;.</p>

<p>The release was tested on the following systems:</p>

<ul>
<li>OpenBSD-current and OpenBSD-stable</li>
<li>NetBSD-current</li>
<li>illumos</li>
<li>Debian Linux</li>
<li>Void Linux x86_64 glibc and musl</li>
<li>Crux Linux</li>
<li>SunOS 5.11.2, 5.10, and 5.9</li>
</ul>

<p>As before, catman(8) and the regression suite cannot be used on<br>
SunOS 5.10 and SunOS 5.9.<br>
A big thanks to everybody who provided patches, bug reports,<br>
feature suggestions, advice, and help with testing!<br>
Yours,<br>
  Ingo```</p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://github.com/Swordfish90/cool-retro-term" rel="nofollow">A good looking terminal emulator which mimics the old cathode display. Available in x11/cool-retro-terminal</a></li>
<li><a href="https://www.trueos.org/blog/milestone-complete-openrc-conversion/" rel="nofollow">Milestone Complete! OpenRC conversion</a></li>
<li><a href="https://illumos.topicbox.com/groups/developer/discussions/T5eae6079331c4df4" rel="nofollow">Healthy developer interaction between FreeBSD and IllumOS re: mdb</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170804053102" rel="nofollow">Large Batch of Kernel Errata Patches Released</a></li>
<li><a href="https://opnsense.org/opnsense-17-7-released/" rel="nofollow">opnsense 17.7 released</a></li>
<li><a href="https://twitter.com/jack/status/892605692317650944" rel="nofollow">Twitter Co-Founder and CEO states “FreeBSD rules them all”</a></li>
<li>Hurry up and register for <a href="http://www.verisign.com/en_US/internet-technology-news/verisign-events/vbsdcon/index.xhtml?dmn=vBSDcon.com" rel="nofollow">vBSDCon September 7-9</a> and <a href="https://2017.eurobsdcon.org/" rel="nofollow">EuroBSDCon September 21-24</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Dominik - <a href="http://dpaste.com/08971FQ" rel="nofollow">Monitoring Software</a></li>
<li>Darren - <a href="http://dpaste.com/0YCS4DN" rel="nofollow">Wonderful Awk</a></li>
<li>Andrew - <a href="http://dpaste.com/0ZREKTV" rel="nofollow">Thanks</a></li>
<li>Jens - <a href="http://dpaste.com/1GVZNWN" rel="nofollow">Migration Questions</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We recap our devsummit experiences at BSDCambridge, share why memcmp is more complicated than expected, explore Docker on FreeBSD, and we look at a retro terminal.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://wiki.freebsd.org/DevSummit/201708" rel="nofollow">BSDCam recap</a></h3>

<blockquote>
<p>The 2017 Cambridge DevSummit took place from 2-4 August 2017. The event took place over three days including a formal dinner at St John&#39;s College, and was attended by 55 registered developers and guests.</p>
</blockquote>

<ul>
<li>Prior to the start of the conference, we had a doc hacking lounge, the computer lab provided a room where we could meet and try to spend some time on documentation. Sevan walked two interested people through the process of creating a documentation patch and submitting it for the first time. In the process, found ways to improve the documentation on how to write documentation.</li>
</ul>

<blockquote>
<p>The event is run &quot;un-conference style&quot; in that we brainstorm the actual session schedule on the first morning, with a focus on interactive topics that reflect the interests and exploit the knowledge of the attendees.</p>
</blockquote>

<ul>
<li>The idea is to maximize the amount of discussion and decisions that can be made while we are all in the same room</li>
<li>The first morning, we all gather in the slightly too small, and even more slightly under air conditioned FW11 classroom. We go around the room introducing ourselves, and listing a few topics we would be interested in discussing. Eventually the whiteboard is full of topics, with various numbers of ticks beside them to indicate the number of interested people</li>
<li>There are breakout rooms of all sizes, so even topics with only a small group of interested folks can get a lot accomplished</li>
<li>The most difficult is trying to schedule the sessions, as there is much overlap and people usually want to be in concurrent sessions, or someone&#39;s schedule means they won’t be available that day, etc.</li>
<li>This years working groups:

<ul>
<li>Toolchain (Compilers, Linkers, External Toolchain, Static analysis and sanitizers)</li>
<li>Virtualization (bhyve, xen, jails, docker)</li>
<li>Transport (TCP) and Network Performance</li>
<li>Security and mitigations (W<sup>X,</sup> noexec stack, CFI, ASLR, KASLR, Safe Stack, etc)</li>
<li>Testing (Status, What to test, How to test, QA for releases)</li>
<li>Capsicum (Automation with LLVM etc, Casper, Namespacing, “Services”, capsh)</li>
<li>Desktop / WiFi (drm-next, drivers, resume, power, installer, desktop, OOB Experience)</li>
<li>Tracing (Blackbox, DTrace, KTR, ptrace, truss, hardware tracing)</li>
<li>Packaging and Packaged Base (Sets, Kernels, Ports &amp; flavours, sub-packages, privlib)</li>
<li>Architectural Security Features (CPU Features: SGX, PXN/PAN, Pointer Authentication, AMD Memory Encryption, Libcrunch, RISC-V, CheriABI)</li>
<li>Architectures and Embedded systems (RISC-V, ARM, ARM64, MIPS(64), SPARC64)</li>
<li>Teaching (Audiences, Objectives, Targets, Material, future directions)</li>
<li>Provisioning and Management Tools (CfgMgmt tools, Image building, VM/bhyve orchestration, Preconfigured VMs for testing, Wishlist)</li>
<li>Storage (ZFS status update, ZFS encryption infrastructure, ZFS Zero Copy / Sendfile, Acceleration of checksums and raidz parity calculations, sesutil, mpsutil)</li>
</ul></li>
<li>And that wasn’t everything. We then had a series of short talklets:

<ul>
<li>Enhancing and replacing mmap()</li>
<li>SDIO support</li>
<li>eBPF support for FreeBSD</li>
<li>Tracing + Virtualization</li>
<li>Practical DMA Attack Protection</li>
</ul></li>
<li>On Thursday night there was a special dinner at St John&#39;s College</li>
<li>Overall it was a great DevSummit, and I even managed to get some of the work assigned to me finished. Shortly I will commit an update to the boot loader menu that will automatically populate the kernel selection menu with the automatically detected list of installed kernels. The list is also properly refreshed when you switch boot environments.
***</li>
</ul>

<h3><a href="https://wiki.qemu.org/index.php/Hosts/BSD" rel="nofollow">Hosts/BSD – for when you need to run your BSD inside a penguin</a></h3>

<ul>
<li>This wiki provides details on how to run each of the various BSDs under QEMU</li>
<li>The target audience is Linux developers looking to test their apps etc under BSD</li>
<li>The wiki is in need of some love, there are some option questions, and it lacks some polish</li>
<li>There are instructions on building qemu from source, but it should likely mention the qemu-devel port</li>
<li>There should probably also be instructions on using other architectures, like ARM/MIPS etc</li>
<li>If you have used QEMU, or would like to spend the time to learn how, please help update this wiki
***</li>
</ul>

<h3><a href="http://trust-in-soft.com/memcmp-requires-pointers-to-fully-valid-buffers/" rel="nofollow">memcmp -- more complicated than you might expect</a></h3>

<blockquote>
<p>“A suspicious pattern in open-source software”<br>
One bug recently found by John using tis-interpreter on a widely used open-source library involved the comparison of strings with memcmp. The unexpected condition was that memcmp was, in one case, called with a pointer to a buffer shorter than the length passed as third argument, breaking one of the two symmetrical pre-conditions in the function’s ACSL contract<br>
A reason that may have made this use of memcmp look okay to the developer is that the buffers being passed to it always differed before the end of the buffers were reached.<br>
a memcmp implementation based on stopping as soon as a difference is found, would not have caused any out-of-bounds read access<br>
The first question raised was whether the pattern memcmp(&quot;a&quot;, &quot;bc&quot;, 3) was problematic according to the letter of the C standard. If it was, the second question was whether the busy maintainer of one of the Open Source packages that make the Internet tick should be bothered with a bug report.<br>
I would like to be able to say that memcmp’s ACSL contract was the product of careful deliberation, but unfortunately this is not the case: many standard function contracts were written quickly in order to get most of the standard library covered, and have not been tested by time. Anyway, upon proofreading the relevant clause in the C11 standard, my feeling was that the ACSL formalization was, in this particular case, right, and that it was undefined behavior to pass as memcmp argument a buffer that wasn’t fully valid, even if the implementation sort-of needs to read the buffer’s characters in order for the purpose of finding the first mismatch.</p>
</blockquote>

<ul>
<li>The post then goes on to look at the memcmp code in glibc</li>
</ul>

<blockquote>
<p>There are two distinct optimizations for long buffers, one that applies when both buffers start at the same offset modulo the word size, memcmp_common_alignment, and one that applies when they don’t, memcmp_not_common_alignment.<br>
The function memcmp_common_alignment is relatively well-behaved: it reads from the two buffers aligned word by aligned word, and thus reads the entire words that contain differing bytes. If the caller passed buffers that aren’t valid after the differing byte, this amounts to reading out of bounds, but this sort of out-of-bounds access is not detected by the typical MMU, which works at the scale of the page.<br>
The “not_common_alignment” case, however, tells a different story. When passed the carefully (mis-)aligned buffers t1 and (char*)t2+1, although these buffers differ in the 8th byte, Glibc’s implementation of memcmp reads 8 bytes beyond the end of t1. By making the 16th byte differ instead of the 8th one, it is also possible to make Glibc’s implementation of memcmp read 16 bytes beyond the end of t1.<br>
In conclusion, yes, some implementations of memcmp will crash when invoked with buffers that aren’t valid for the full length, even if they differ early. The circumstances are rare (probably the reason this bug was still there to be found in a library that had already been tested with all the available techniques) but outside the programmer’s control. The pattern described in this post should be reported as a bug when found.</p>
</blockquote>

<ul>
<li>It is interesting to read the detailed analysis of a bug in such a basic libc feature
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://daemon-notes.com/articles/network/docker" rel="nofollow">Docker on FreeBSD</a></h3>

<blockquote>
<p>There are two approaches to running Docker on FreeBSD. First one was created back in 2015 and it was a native port of Docker engine to FreeBSD. It was an ambitious project but nobody stepped forward to continuously port the never-ending flow of upstream code to FreeBSD. So the port still exists (sysutils/docker-freebsd) but it wasn&#39;t updated since 2015 and it is Docker v1 (it is v17 as of 2017).<br>
The other approach is to use official way of running Docker on platforms other than Linux. Well, somewhat official as Docker still does not support FreeBSD as a host officially. This is docker-machine tool which in turn will use VirtualBox to run a virtual machine with Linux and Docker engine. docker utility on the host will communicate with the engine inside VB where all the work will be done. This article describes what needs to be done to start using it.<br>
Before we begin you need VirtualBox installed. Do not skip adding /boot/loader.conf and /etc/rc.conf lines mentioned on that page. You won&#39;t need user inteface or anything, docker-machine will do all the work, just make sure VirtualBox is present and ready to be used.<br>
`pkg install docker docker-machine docker-compose’<br>
Docker will store its stuff in ~/.docker. You might not want the virtual machine image files to live in your home, in this case just create a symlink:<br>
mkdir ~/.docker<br>
ln -s /storage/docker ~/.docker/machine<br>
docker-machine create --driver virtualbox \<br>
   --virtualbox-memory 2048 \<br>
   --virtualbox-cpu-count 2 \<br>
   --virtualbox-disk-size 102400 \<br>
   --virtualbox-hostonly-cidr &quot;10.2.1.1/24&quot; \<br>
   docker1<br>
Here&#39;s the example. We are creating machine named docker1. It is using VirtualBox driver, the vm has 2G of memory, 2 cores and 100G of disk space. docker-machine setups VirtualBox to use host-only network adapter (it will create vboxnet0 interface on the host automatically) and we are instructing it to use 10.2.1.1/24 as the address of this adapter — change it to what suits your needs or omit this flag (default is 192.168.99.1/24).<br>
And basically that is all. Check if it is running:<br>
docker-machine ls<br>
If you do open VirtualBox interface you will find a virtual machine named docker1 running. You can start/stop/whatever your machine using docker-machine utility.</p>
</blockquote>

<ul>
<li>Here’s how you can connect to the machine:</li>
</ul>

<blockquote>
<p>docker utility by default tries to talk to Docker engine running on the same host. However with specific environment variables you can instruct it to talk to other host. docker-machine can export these variables for you.<br>
eval <code>docker-machine env docker1</code><br>
docker run hello-world</p>
</blockquote>

<ul>
<li>There was quite a bit of discussion about docker at the FreeBSD developers summit in Cambridge during the first week of August. Two docker developers who had worked on the Mac OS X port, one of whom is an OpenBSD advocate, explained how docker has evolved, and the linux-isms have been abstracted away such that a truly native docker solution for FreeBSD can be built and maintained with a lot less headache than before</li>
<li>I look forward to seeing if we can’t make that happen
***</li>
</ul>

<h3><a href="http://shellhaters.org/" rel="nofollow">The POSIX Shell And Utilities</a></h3>

<ul>
<li>The POSIX Shell And Utilities</li>
<li>Compiled for The Shell Hater&#39;s Handbook
***</li>
</ul>

<h3><a href="http://dan.langille.org/2017/07/31/postgresql-logging-to-a-file/" rel="nofollow">PostgreSQL – logging to a file</a></h3>

<blockquote>
<p>These steps were carried out on FreeBSD 11.0 with PostgreSQL 9.6 (two of my favorite tools).<br>
I like logging. I like logging PostgreSQL. With logs, you can see what happened. Without, you can only guess.<br>
Setting up logging for PostgreSQL involves several parts, each of which must be completed or else I don’t get what I want. This is not a criticism of PostgreSQL. It’s a feature.<br>
I am documenting this because each time I configure a new PostgreSQL instance, it takes me more than one iteration to get it working. The goal: this post lets both you and me get it right the first time.<br>
The parts include:</p>

<ul>
<li>Telling PostgreSQL to log via syslog</li>
<li>Telling FreeBSD to local postgres to /var/log/postgres.log (my preference).</li>
<li>Telling PostgreSQL the things you want logged.</li>
<li>Changes to postgresql.conf
The file location varies with the version installed. For PostgreSQL 9.6 on FreeBSD, the file is /var/db/postgres/data96/postgresql.conf (adjust 96 according to the version installed).
I made these changes to that file.
<code>
log_destination = &#39;syslog&#39;
log_min_messages = notice
log_min_error_statement = notice
log_checkpoints = on
log_lock_waits = on
log_timezone = &#39;UTC&#39;
</code>
By default, PostgreSQL logs to the local0 facility and is controlled by the syslog_facility in postgresql.conf. This will be used in syslog.conf (see the next section of this post).
The above mentioned changes require a reload: 
<code>service postgresql reload</code></li>
</ul>
</blockquote>

<ul>
<li>Changes to /etc/syslog.conf</li>
</ul>

<blockquote>
<p>Now that we have PostgreSQL logging to syslog, we want to tell syslog where to put those messages.<br>
I changed this line in /etc/syslog.conf:<code>*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err  /var/log/messages</code><br>
With <em>.notice pulling in some local0 messages, adding local0.none to the line will free the messages up for later use in the configuration file. Otherwise, the PostgreSQL messages will be in /var/log/messages.<br>
The changed line is:<br>
`</em>.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err;local0.none   /var/log/messages<code><br>
Then, to get the messages into my preferred location, I added this to the file:<br>
</code>local0.*     /var/log/postgresql.log`</p>
</blockquote>

<ul>
<li>Log file rotation</li>
</ul>

<blockquote>
<p>For rotating my log file, I added a new file: /usr/local/etc/newsyslog.conf.d/postgresql96</p>

<pre><code>/var/log/postgresql.log     pgsql:wheel  640  7     *    $D0   GB  /var/db/postgres/data96/postmaster.pid 30
</code></pre>

<p>Before restarting syslog, I did this, so the destination file existed. This isn’t always/strictly necessary, but because the ownership is not chown root:wheel, I do it to get that part set.</p>

<pre><code>touch /var/log/postgresql.log
chown pgsql:wheel
</code></pre>

<p>Restarting syslog:</p>

<pre><code>sudo kill -HUP `sudo cat /var/run/syslog.pid `
</code></pre>

<p>That’s it Now you should see PostgreSQL logging in /var/log/postgresql.log.</p>
</blockquote>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170729122350" rel="nofollow">mandoc-1.14.2 released</a></h3>

<blockquote>
<p>i just released portable mandoc-1.14.2. It is available now from <a href="http://mandoc.bsd.lv/" rel="nofollow">http://mandoc.bsd.lv/</a>.</p>
</blockquote>

<p>```From: Ingo Schwarze <a href="mailto:schwarze@usta.de" rel="nofollow">schwarze@usta.de</a><br>
Date: Fri, 28 Jul 2017 20:12:44 +0200<br>
To: <a href="mailto:discuss@mandoc.bsd.lv" rel="nofollow">discuss@mandoc.bsd.lv</a><br>
Subject: mandoc-1.14.2 released</p>

<p>Hi,</p>

<p>i just released portable mandoc-1.14.2.<br>
It is available now from <a href="http://mandoc.bsd.lv/" rel="nofollow">http://mandoc.bsd.lv/</a> .</p>

<p>All downstream maintainers are encouraged to update their ports<br>
and packages from 1.14.1 to 1.14.2.</p>

<p>Mandoc 1.14.2 is a feature release introducing:</p>

<ul>
<li>a new -Tmarkdown output mode</li>
<li>anchors for deep linking into -Thtml manual pages</li>
<li>a superset of the functionality of the former mdoclint(1) utility</li>
<li>a new -Wstyle message level with several new messages</li>
<li>automatic line breaking inside individual tbl(7) cells</li>
<li>a rewrite of the eqn(7) lexer, and some eqn(7) rendering improvements</li>
<li>support for many additional low-level roff(7) features</li>
<li>and various smaller features and bug fixes.</li>
</ul>

<p>For more details, see: <a href="http://mandoc.bsd.lv/NEWS" rel="nofollow">http://mandoc.bsd.lv/NEWS</a></p>

<p>With the improved mandoc features, only twenty-five out of the<br>
ten thousand software packages in the OpenBSD ports tree still<br>
need groff to format their manual pages.</p>

<p>Since the project has been called &quot;mandoc&quot; rather than &quot;mdocml&quot;<br>
for several years now, the website, the distribution tarball,<br>
and the source extraction directory are now also called &quot;mandoc&quot;<br>
rather than &quot;mdocml&quot;.</p>

<p>The release was tested on the following systems:</p>

<ul>
<li>OpenBSD-current and OpenBSD-stable</li>
<li>NetBSD-current</li>
<li>illumos</li>
<li>Debian Linux</li>
<li>Void Linux x86_64 glibc and musl</li>
<li>Crux Linux</li>
<li>SunOS 5.11.2, 5.10, and 5.9</li>
</ul>

<p>As before, catman(8) and the regression suite cannot be used on<br>
SunOS 5.10 and SunOS 5.9.<br>
A big thanks to everybody who provided patches, bug reports,<br>
feature suggestions, advice, and help with testing!<br>
Yours,<br>
  Ingo```</p>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://github.com/Swordfish90/cool-retro-term" rel="nofollow">A good looking terminal emulator which mimics the old cathode display. Available in x11/cool-retro-terminal</a></li>
<li><a href="https://www.trueos.org/blog/milestone-complete-openrc-conversion/" rel="nofollow">Milestone Complete! OpenRC conversion</a></li>
<li><a href="https://illumos.topicbox.com/groups/developer/discussions/T5eae6079331c4df4" rel="nofollow">Healthy developer interaction between FreeBSD and IllumOS re: mdb</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170804053102" rel="nofollow">Large Batch of Kernel Errata Patches Released</a></li>
<li><a href="https://opnsense.org/opnsense-17-7-released/" rel="nofollow">opnsense 17.7 released</a></li>
<li><a href="https://twitter.com/jack/status/892605692317650944" rel="nofollow">Twitter Co-Founder and CEO states “FreeBSD rules them all”</a></li>
<li>Hurry up and register for <a href="http://www.verisign.com/en_US/internet-technology-news/verisign-events/vbsdcon/index.xhtml?dmn=vBSDcon.com" rel="nofollow">vBSDCon September 7-9</a> and <a href="https://2017.eurobsdcon.org/" rel="nofollow">EuroBSDCon September 21-24</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Dominik - <a href="http://dpaste.com/08971FQ" rel="nofollow">Monitoring Software</a></li>
<li>Darren - <a href="http://dpaste.com/0YCS4DN" rel="nofollow">Wonderful Awk</a></li>
<li>Andrew - <a href="http://dpaste.com/0ZREKTV" rel="nofollow">Thanks</a></li>
<li>Jens - <a href="http://dpaste.com/1GVZNWN" rel="nofollow">Migration Questions</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>206: To hier is UNIX</title>
  <link>https://www.bsdnow.tv/206</link>
  <guid isPermaLink="false">f5800a25-4b1e-4593-aa7d-eb70bac3bd73</guid>
  <pubDate>Wed, 09 Aug 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f5800a25-4b1e-4593-aa7d-eb70bac3bd73.mp3" length="65122708" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Lumina Desktop 1.3 is out, we show you a Plasma 5 on FreeBSD tutorial, explore randomness, and more.</itunes:subtitle>
  <itunes:duration>1:30:26</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Lumina Desktop 1.3 is out, we show you a Plasma 5 on FreeBSD tutorial, explore randomness, and more.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Lumina Desktop v1.3 released (https://lumina-desktop.org/version-1-3-0-released/)
Notable Changes:
New Utility: lumina-mediaplayer. Lumina Media Player is a graphic interface for the Qt QMediaPlayer Class, with Pandora internet radio streaming integration. Lumina Media Player supports many audio formats, including .ogg, .mp3, .mp4, .flac, and .wmv. It is also possible to increase the number of playable formats by installing gstreamer-plugins. This utility is found in the Applications → Utilities section, or opened by typing lumina-mediaplayer in a command line.
New Utility: lumina-xdg-entry. This is another simple utility designed to help users create .desktop entries and shortcuts. Find it in the Utilities application category, or open it by typing lumina-xdg-entry in a command line. 
Lumina Desktop:
Desktop folders are integrated, and can now be manipulated directly from the desktop.
Added the automatic settings migration of a desktop monitor (single monitor only, for now).
Numerous speed and performance improvements with how icons load and the system interacts with the desktop.
Lumina-FM:
Now fully integrated with lumina-archiver.
A “System directory” tree pane is available. Options to enable/disable it are being added later, as it is on by default.
Numerous speed improvements with caching and loading icons.
Lumina Texteditor:
There is a new json manifest file format for syntax highlighting support. Users can open this file, customize their highlighting options, and immediately see their changes without rebuilding the utility.
The text editor now supports more than 10 different file formats.
Added options for file-wide preferences in syntax files. Options include: word wrap, character per line limits, excess whitespace highlighting, font style restrictions, and tab-width settings.
LTE supports tabs with detach, drag’n’drop, and location customization with the View menu option.
Add checkable menu option to show the “unsaved changes” dialogue box on close.
Lumina Screenshot:
Adjustments to the lumina-screenshot interface.
Add an adjustable warning to lumina-screenshot when closing with an unsaved image.
Add functionality to select a specific area of the screen for screenshots.
Lumina Archiver:
Functionality improvements.
Bug fixes.
Interface changes.
General Improvements:
Permission checks for settings files (all utilities). When launched with sudo, all tools use or create a root-permissioned copy of the user’s settings file. This prevents a settings file being locked by root.
UI text reworks to help re-unify style.
Add hooks to update the desktop with icons for the /media directory when a system uses USB automounting functionality.
Fix Fluxbox bug with windows workspace assignments.
Work on new utility lumina-notify (not fully functional yet).
Fix panel reporting error crashing lumina-config.
Bug fix for dbus-send calls for Gentoo.
Clean up automatic DPI scaling support.
Bug fix for the panel clock.
Compton compositor is now disabled by default (but can be manually enabled).
Translation file updates.
Documentation updates.
***
FreeBSD 11.0 and Plasma 5 HowTo (https://euroquis.nl/bobulate/?p=1609)
Here’s a step-by-step guide to getting a machine with FreeBSD 11 in it, running X, and KDE Plasma 5 Desktop and KDE Applications. It’s the latest thing! (Except that 11-STABLE is in the middle of the pack of what’s supported .. but the KDE bits are fresh. I run 10.3 with KDE4 or Plasma 5 on my physical machines, myself, so the FreeBSD version isn’t that important except that packages are readily available for 11-STABLE, not for 10-STABLE.)
We skip the part about installing FreeBSD (it’s in there if you need it) and get right to the important parts that you need: 
An X Server and a backup X11 environment (ancient):
pkg install xorg xterm twm
Desktop technologies (modern):
pkg install hal dbus
echo haldenable=YES &amp;gt;&amp;gt; /etc/rc.conf
echo dbusenable=YES &amp;gt;&amp;gt; /etc/rc.conf
Next up, test whether the X server works by running startx and exiting out of twm.
If running with ZFS, it’s a good idea to snapshot now, just so you can easily roll back to the it-works-with-basic-X11 setup you have now.
zfs snapshot -r zroot@x11
Now swap out the default FreeBSD package repository, for the KDE-FreeBSD community one. This is documented also on the Area51 page (https://community.kde.org/FreeBSD/Setup/Area51).
mkdir -p /usr/local/etc/pkg/repos
cd /usr/local/etc/pkg/repos
cat &amp;gt; FreeBSD.conf &amp;lt; Area51.conf &amp;lt;&amp;gt; /boot/loader.conf
echo webcamdenable=YES &amp;gt;&amp;gt; /etc/rc.conf
Log in as your test user, and set up .xinitrc to start Plasma 5:
cat &amp;gt; .xinitrc &amp;lt;</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Lumina Desktop 1.3 is out, we show you a Plasma 5 on FreeBSD tutorial, explore randomness, and more.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lumina-desktop.org/version-1-3-0-released/" rel="nofollow">Lumina Desktop v1.3 released</a></h3>

<ul>
<li>Notable Changes:</li>
<li>New Utility: lumina-mediaplayer. Lumina Media Player is a graphic interface for the Qt QMediaPlayer Class, with Pandora internet radio streaming integration. Lumina Media Player supports many audio formats, including .ogg, .mp3, .mp4, .flac, and .wmv. It is also possible to increase the number of playable formats by installing gstreamer-plugins. This utility is found in the Applications → Utilities section, or opened by typing lumina-mediaplayer in a command line.

<ul>
<li>New Utility: lumina-xdg-entry. This is another simple utility designed to help users create .desktop entries and shortcuts. Find it in the Utilities application category, or open it by typing lumina-xdg-entry in a command line. </li>
</ul></li>
<li>Lumina Desktop:

<ul>
<li>Desktop folders are integrated, and can now be manipulated directly from the desktop.</li>
<li>Added the automatic settings migration of a desktop monitor (single monitor only, for now).</li>
<li>Numerous speed and performance improvements with how icons load and the system interacts with the desktop.</li>
</ul></li>
<li>Lumina-FM:

<ul>
<li>Now fully integrated with lumina-archiver.</li>
<li>A “System directory” tree pane is available. Options to enable/disable it are being added later, as it is on by default.</li>
<li>Numerous speed improvements with caching and loading icons.</li>
</ul></li>
<li>Lumina Texteditor:

<ul>
<li>There is a new json manifest file format for syntax highlighting support. Users can open this file, customize their highlighting options, and immediately see their changes without rebuilding the utility.</li>
<li>The text editor now supports more than 10 different file formats.</li>
<li>Added options for file-wide preferences in syntax files. Options include: word wrap, character per line limits, excess whitespace highlighting, font style restrictions, and tab-width settings.</li>
<li>LTE supports tabs with detach, drag’n’drop, and location customization with the View menu option.</li>
<li>Add checkable menu option to show the “unsaved changes” dialogue box on close.</li>
</ul></li>
<li>Lumina Screenshot:

<ul>
<li>Adjustments to the lumina-screenshot interface.</li>
<li>Add an adjustable warning to lumina-screenshot when closing with an unsaved image.</li>
<li>Add functionality to select a specific area of the screen for screenshots.</li>
</ul></li>
<li>Lumina Archiver:

<ul>
<li>Functionality improvements.</li>
<li>Bug fixes.</li>
<li>Interface changes.</li>
</ul></li>
<li>General Improvements:

<ul>
<li>Permission checks for settings files (all utilities). When launched with sudo, all tools use or create a root-permissioned copy of the user’s settings file. This prevents a settings file being locked by root.</li>
<li>UI text reworks to help re-unify style.</li>
<li>Add hooks to update the desktop with icons for the /media directory when a system uses USB automounting functionality.</li>
<li>Fix Fluxbox bug with windows workspace assignments.</li>
<li>Work on new utility lumina-notify (not fully functional yet).</li>
<li>Fix panel reporting error crashing lumina-config.</li>
<li>Bug fix for dbus-send calls for Gentoo.</li>
<li>Clean up automatic DPI scaling support.</li>
<li>Bug fix for the panel clock.</li>
<li>Compton compositor is now disabled by default (but can be manually enabled).</li>
<li>Translation file updates.</li>
<li>Documentation updates.
***</li>
</ul></li>
</ul>

<h3><a href="https://euroquis.nl/bobulate/?p=1609" rel="nofollow">FreeBSD 11.0 and Plasma 5 HowTo</a></h3>

<blockquote>
<p>Here’s a step-by-step guide to getting a machine with FreeBSD 11 in it, running X, and KDE Plasma 5 Desktop and KDE Applications. It’s the latest thing! (Except that 11-STABLE is in the middle of the pack of what’s supported .. but the KDE bits are fresh. I run 10.3 with KDE4 or Plasma 5 on my physical machines, myself, so the FreeBSD version isn’t that important except that packages are readily available for 11-STABLE, not for 10-STABLE.)</p>
</blockquote>

<ul>
<li>We skip the part about installing FreeBSD (it’s in there if you need it) and get right to the important parts that you need: </li>
<li>An X Server and a backup X11 environment (ancient):</li>
</ul>

<blockquote>
<p>pkg install xorg xterm twm</p>
</blockquote>

<ul>
<li>Desktop technologies (modern):</li>
</ul>

<blockquote>
<p>pkg install hal dbus<br>
echo hald_enable=YES &gt;&gt; /etc/rc.conf<br>
echo dbus_enable=YES &gt;&gt; /etc/rc.conf</p>
</blockquote>

<ul>
<li>Next up, test whether the X server works by running startx and exiting out of twm.</li>
</ul>

<blockquote>
<p>If running with ZFS, it’s a good idea to snapshot now, just so you can easily roll back to the it-works-with-basic-X11 setup you have now.<br>
zfs snapshot -r zroot@x11</p>
</blockquote>

<ul>
<li>Now swap out the default FreeBSD package repository, for the KDE-FreeBSD community one. This is documented also on the <a href="https://community.kde.org/FreeBSD/Setup/Area51" rel="nofollow">Area51 page</a>.</li>
</ul>

<blockquote>
<p>mkdir -p /usr/local/etc/pkg/repos<br>
cd /usr/local/etc/pkg/repos<br>
cat &gt; FreeBSD.conf &lt;<EOF<br>
FreeBSD: { enabled: no }<br>
EOF<br>
cat > Area51.conf &lt;&lt;EOF<br>
Area51: {<br>
url: &quot;<a href="http://meatwad.mouf.net/rubick/poudriere/packages/110-amd64-kde/" rel="nofollow">http://meatwad.mouf.net/rubick/poudriere/packages/110-amd64-kde/</a>&quot;,<br>
priority: 2,<br>
enabled: yes<br>
}<br>
EOF</p>
</blockquote>

<ul>
<li>Tell pkg(8) to refresh itself (it may install a newer pkg, too), then install something nicer than xterm + twm, and then do some post-install configuration:</li>
</ul>

<blockquote>
<p>pkg update<br>
pkg install konsole plasma5-plasma-desktop<br>
echo cuse_load=YES &gt;&gt; /boot/loader.conf<br>
echo webcamd_enable=YES &gt;&gt; /etc/rc.conf</p>
</blockquote>

<ul>
<li>Log in as your test user, and set up .xinitrc to start Plasma 5:</li>
</ul>

<blockquote>
<p>cat &gt; .xinitrc &lt;&lt;EOF<br>
&#35;&#33; /bin/sh<br>
/usr/local/bin/xterm -geometry +0+0 &amp;<br>
KDE=/usr/local/bin/startkde<br>
test -x $KDE &amp;&amp; exec /usr/local/bin/ck-launch-session $KDE<br>
exec /usr/local/bin/twm<br>
EOF<br>
chmod 755 .xinitrc</p>
</blockquote>

<ul>
<li>If you really want, you can run startx, but this isn’t the complete Plasma 5 desktop experience... and KDE Applications are not installed, either. So you get a bare xterm (useful to kill X or start konsole) and kwin and not much else. Good thing that getting the rest of KDE Plasma 5 Desktop and KDE Applications is pretty easy (and we could have skipped the intermediate step with konsole and gone straight to the finish:</li>
</ul>

<blockquote>
<p>pkg install kde</p>
</blockquote>

<ul>
<li>This metaport will pull in another 2GiB of stuff, for all the KDE Applications and a complete Plasma desktop. There are intermediate metaports for slightly-less-heavy installations, but this one is easy to remember and will almost certainly get you what you want. So it really comes down to installing X, dbus, hal, and then the kde package. Voila!
***</li>
</ul>

<h3><a href="https://blog.cagedmonster.net/setup-full-server-with-freebsd-on-raspberrypi/" rel="nofollow">Full FreeBSD Server on a Raspberry Pi</a></h3>

<ul>
<li>Disclaimer :

<ul>
<li>The Raspberry PI is a such a great device. You can do a really huge amount of fun things with this little board... </li>
<li>The goal of this paper is to show how you can build a full personal server on your Raspberry PI, using FreeBSD and it&#39;s packages. </li>
</ul></li>
<li>Here&#39;s how we&#39;ll proceed :

<ul>
<li>Get FreeBSD</li>
<li>Configure FreeBSD</li>
<li>Install and configure sudo</li>
<li>Configure your Wifi with a static IPv4 and IPv6 address</li>
<li>Install and start Packet Filter</li>
<li>Install and configure nginx with &quot;let&#39;s encrypt&quot; SSL / PHP / MySQL</li>
<li>Install and configure OpenSMTPd and SPAMd</li>
<li>Install and configure Netdata with nginx to monitor your system</li>
<li>Avoid OS detection
***</li>
</ul></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2017-06-27/introducing-openntpd-base" rel="nofollow">HardenedBSD, now has openntpd in base</a></h3>

<ul>
<li>Over the past few months, Bernard Spil has been hard at work importing OpenNTPd 6.0p1 in HardenedBSD base. Starting with 12-CURRENT, HardenedBSD will ship with OpenNTPd by default. Just like with LibreSSL in base, HardenedBSD users have a choice when building world of which NTP daemon to use. Users who want to use the legacy NTPd can set WITHOUT_OPENNTPD and WITH_NTP in src.conf(5). Bernard will continue maintaining LibreSSL and OpenNTPd in HardenedBSD base.</li>
<li><p>Users who are upgrading from an existing 12-CURRENT system from source and who use the legacy NTP daemon in base will need to perform the following actions:</p>

<ul>
<li>Install new world</li>
<li>Run mergemaster or etcupdate</li>
<li>sysrc ntpd_enable=&quot;NO&quot;</li>
<li>sysrc local_openntpd_enable=&quot;YES&quot;</li>
</ul></li>
<li><p>A binary update will be published within the next 24 hours that contains OpenNTPd in base. Those who use hbsd-update will only need to perform steps 3 and 4 above.</p>

<hr></li>
</ul>

<h3><a href="http://www.networkworld.com/article/3208389/linux/unix-how-random-is-random.html" rel="nofollow">Unix: How random is random</a></h3>

<ul>
<li>Sandra Henry-Stocker writes on Networkworld: </li>
</ul>

<blockquote>
<p>On Unix systems, random numbers are generated in a number of ways and random data can serve many purposes. From simple commands to fairly complex processes, the question “How random is random?” is worth asking.<br>
EZ random numbers<br>
If all you need is a casual list of random numbers, the RANDOM variable is an easy choice. Type &quot;echo $RANDOM&quot; and you&#39;ll get a number between 0 and 32,767 (the largest number that two bytes can hold).</p>
</blockquote>

<ul>
<li>Note: this only works in bash, and is generally a silly thing to do</li>
</ul>

<blockquote>
<p>Of course, this process is actually providing a &quot;pseudo-random&quot; number. As anyone who thinks about random numbers very often might tell you, numbers generated by a program have a limitation. Programs follow carefully crafted steps, and those steps aren’t even close to being truly random. You can increase the randomness of RANDOM&#39;s value by seeding it (i.e., setting the variable to some initial value). Some just use the current process ID (via $$) for that. Note that for any particular starting point, the subsequent values that $RANDOM provides are quite predictable.</p>
</blockquote>

<ul>
<li>More complex random data</li>
</ul>

<blockquote>
<p>For more serious requirements for random data, such as its use in encryption, some more truly random data comes into play. The /dev/random and /dev/urandom files get beyond the predictability of programming by making use of environmental noise gathered from device drivers and other system sources and stored it in an “entropy pool”.</p>
</blockquote>

<ul>
<li>Examining entropy</li>
<li>Randomness vs. entropy</li>
<li>Generating files with random data</li>
<li>Generating random numbers</li>
<li>Beyond /dev/urandom
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/kernel/2017-July/239413.html" rel="nofollow">Moving firmware to userland</a></h3>

<ul>
<li>This is a post from the DragonFlyBSD mailinglist:</li>
</ul>

<blockquote>
<p>I would like to introduce a few ideas about the new firmware subsystem.  I assume that it should not require adding a new system tools or modifying boot process.<br>
Simplification is the first. It would be good to remove parent-child relationship and corresponding functionality. It would significantly simplify firmware handling. Its only practical use is when there are multiple images in one loadable kernel module. The module can be  unloaded when all children are not in use. Usage of the children images is tracked through the counter for the parent image. If images will not be placed inside loadable kernel modules, the parent-child mechanism won&#39;t have any practical meaning. I think, currently the mechanism is not used anywhere in the DragonFly system and if it was, it could be easily replaced by putting every child image in its own module without modifying drivers.<br>
There are two use cases according to who will provide firmware images to <br>
the system:</p>

<ul>
<li>developers of DragonFly BSD (they can modify and rebuild the system)</li>
<li>third-parties (they should not be required to modify and rebuild the system)</li>
</ul>

<p>All firmware images needs to have some information attached (at least, <br>
if ack with a license is needed) which should be d) stored persistently.<br>
The question is where to save the information for non-built-in images. </p>
</blockquote>

<ul>
<li>Various solutions are proposed that meet some -- but not all -- of the mentioned requirements, along with pros and cons.</li>
<li>It closes with:</li>
</ul>

<blockquote>
<p>There would be two firmware sources: kernel and filesystem. In case of the same image names, user could have a choice by setting a kernel environment variable, firmware from which source has higher priority and will be provided to consumer.</p>

<hr>
</blockquote>

<h3><a href="https://www.tedunangst.com/flak/post/openbsd-changes-of-note-625" rel="nofollow">OpenBSD changes of note 625</a></h3>

<ul>
<li>Continue with some cleanup and improvement of the depend step of building. Lots of little things to support lex and yacc better as well.</li>
<li>Intel Optane parts are leaking into the wild, some driver fixes to support them.</li>
<li>Add support for pattern substitution to variables in ksh using a common syntax borrowed from ksh93. Or not, reverted.</li>
<li>Deprecate fgetln.</li>
<li>Add detection for missing X sets to syspatch.</li>
<li>Refinement of the inteldrm code, including better backlight support.</li>
<li>A special edition of slaacd for the installer.</li>
<li>After much wailing and gnashing of teeth, fix strtol to parse strings like “0xridiculous”.</li>
<li>A fix for malloc and zero sized allocations when using canaries.</li>
<li>Add the ability to pause and unpause VMs in vmd.</li>
<li>Remove “listen secure” syntax from smtpd.conf. It’s broken since a couple of months and noone complained.</li>
<li>Remove sending of router solicitations and processing of router advertisements from the kernel.</li>
<li>The lidsuspend sysctl has been fully replaced by lidaction.</li>
<li>Fix fortune to filter out unprintable characters. Convert the fortune files to using UTF-8 instead of archaic overprinting. Fortunes with unprintable words may still be obtained with the -o option.</li>
<li>Introduce some quirks to the IDE and ATA code to prevent drives from attaching twice on hyper-v.</li>
<li>Add vmctl send and receive as well.</li>
<li>Update to xterm 330.</li>
<li>Remove some magic cleanup from dhclient. It will not deliberately attempt to interfere with other operations on the same interface.</li>
<li>Update libexpat to 2.2.2. Fixes NULL parser dereference.</li>
<li>Ilja Van Sprundel found a whole mess of kernel bugs in this and that. Some info leaks, some erroneous signal handling, some unbounded malloc calls. Lions, tigers, bears. Try to fix them.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://lud.cc/programming/man-hier/" rel="nofollow">Heir - description of the file system hierarchy</a></li>
<li><a href="https://www.freebsd.org/cgi/man.cgi?query=hier&format=html" rel="nofollow">FreeBSD hier(7)</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2017-July/626020.html" rel="nofollow">sshlockout and your logs</a></li>
<li><a href="https://svnweb.freebsd.org/ports?view=revision&revision=446144" rel="nofollow">net-mgmt/netdata can now monitor ZFS pools</a></li>
<li><a href="https://www.tedunangst.com/flak/post/books-chapter-five" rel="nofollow">Ted Unangst is reviewing some books, chapter by chapter. “Coders at Work”, “Founders at Work”, “the Mythical Man-Month”, “The Pragmatic Programmer”, and “Code: The Hidden Language of Computer Hardware and Software”. This is chapter 5, look for the bookreview tag on the site to find the previous ones</a></li>
<li><a href="https://www.netgate.com/blog/pfsense-2-3-4-p1-release-now-available.html" rel="nofollow">pfSense 2.3.4-p1 release now available</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/0V84RN7" rel="nofollow">Ben - Thanks</a></li>
<li><a href="http://dpaste.com/3KRWRS0" rel="nofollow">Jay - ZFS and Speed</a></li>
<li><a href="http://dpaste.com/0M9STNX" rel="nofollow">Patrick - Portalfs removed?</a></li>
<li><a href="http://dpaste.com/2H0Y3R5" rel="nofollow">Sir l33tname - ZFS pool question</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Lumina Desktop 1.3 is out, we show you a Plasma 5 on FreeBSD tutorial, explore randomness, and more.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lumina-desktop.org/version-1-3-0-released/" rel="nofollow">Lumina Desktop v1.3 released</a></h3>

<ul>
<li>Notable Changes:</li>
<li>New Utility: lumina-mediaplayer. Lumina Media Player is a graphic interface for the Qt QMediaPlayer Class, with Pandora internet radio streaming integration. Lumina Media Player supports many audio formats, including .ogg, .mp3, .mp4, .flac, and .wmv. It is also possible to increase the number of playable formats by installing gstreamer-plugins. This utility is found in the Applications → Utilities section, or opened by typing lumina-mediaplayer in a command line.

<ul>
<li>New Utility: lumina-xdg-entry. This is another simple utility designed to help users create .desktop entries and shortcuts. Find it in the Utilities application category, or open it by typing lumina-xdg-entry in a command line. </li>
</ul></li>
<li>Lumina Desktop:

<ul>
<li>Desktop folders are integrated, and can now be manipulated directly from the desktop.</li>
<li>Added the automatic settings migration of a desktop monitor (single monitor only, for now).</li>
<li>Numerous speed and performance improvements with how icons load and the system interacts with the desktop.</li>
</ul></li>
<li>Lumina-FM:

<ul>
<li>Now fully integrated with lumina-archiver.</li>
<li>A “System directory” tree pane is available. Options to enable/disable it are being added later, as it is on by default.</li>
<li>Numerous speed improvements with caching and loading icons.</li>
</ul></li>
<li>Lumina Texteditor:

<ul>
<li>There is a new json manifest file format for syntax highlighting support. Users can open this file, customize their highlighting options, and immediately see their changes without rebuilding the utility.</li>
<li>The text editor now supports more than 10 different file formats.</li>
<li>Added options for file-wide preferences in syntax files. Options include: word wrap, character per line limits, excess whitespace highlighting, font style restrictions, and tab-width settings.</li>
<li>LTE supports tabs with detach, drag’n’drop, and location customization with the View menu option.</li>
<li>Add checkable menu option to show the “unsaved changes” dialogue box on close.</li>
</ul></li>
<li>Lumina Screenshot:

<ul>
<li>Adjustments to the lumina-screenshot interface.</li>
<li>Add an adjustable warning to lumina-screenshot when closing with an unsaved image.</li>
<li>Add functionality to select a specific area of the screen for screenshots.</li>
</ul></li>
<li>Lumina Archiver:

<ul>
<li>Functionality improvements.</li>
<li>Bug fixes.</li>
<li>Interface changes.</li>
</ul></li>
<li>General Improvements:

<ul>
<li>Permission checks for settings files (all utilities). When launched with sudo, all tools use or create a root-permissioned copy of the user’s settings file. This prevents a settings file being locked by root.</li>
<li>UI text reworks to help re-unify style.</li>
<li>Add hooks to update the desktop with icons for the /media directory when a system uses USB automounting functionality.</li>
<li>Fix Fluxbox bug with windows workspace assignments.</li>
<li>Work on new utility lumina-notify (not fully functional yet).</li>
<li>Fix panel reporting error crashing lumina-config.</li>
<li>Bug fix for dbus-send calls for Gentoo.</li>
<li>Clean up automatic DPI scaling support.</li>
<li>Bug fix for the panel clock.</li>
<li>Compton compositor is now disabled by default (but can be manually enabled).</li>
<li>Translation file updates.</li>
<li>Documentation updates.
***</li>
</ul></li>
</ul>

<h3><a href="https://euroquis.nl/bobulate/?p=1609" rel="nofollow">FreeBSD 11.0 and Plasma 5 HowTo</a></h3>

<blockquote>
<p>Here’s a step-by-step guide to getting a machine with FreeBSD 11 in it, running X, and KDE Plasma 5 Desktop and KDE Applications. It’s the latest thing! (Except that 11-STABLE is in the middle of the pack of what’s supported .. but the KDE bits are fresh. I run 10.3 with KDE4 or Plasma 5 on my physical machines, myself, so the FreeBSD version isn’t that important except that packages are readily available for 11-STABLE, not for 10-STABLE.)</p>
</blockquote>

<ul>
<li>We skip the part about installing FreeBSD (it’s in there if you need it) and get right to the important parts that you need: </li>
<li>An X Server and a backup X11 environment (ancient):</li>
</ul>

<blockquote>
<p>pkg install xorg xterm twm</p>
</blockquote>

<ul>
<li>Desktop technologies (modern):</li>
</ul>

<blockquote>
<p>pkg install hal dbus<br>
echo hald_enable=YES &gt;&gt; /etc/rc.conf<br>
echo dbus_enable=YES &gt;&gt; /etc/rc.conf</p>
</blockquote>

<ul>
<li>Next up, test whether the X server works by running startx and exiting out of twm.</li>
</ul>

<blockquote>
<p>If running with ZFS, it’s a good idea to snapshot now, just so you can easily roll back to the it-works-with-basic-X11 setup you have now.<br>
zfs snapshot -r zroot@x11</p>
</blockquote>

<ul>
<li>Now swap out the default FreeBSD package repository, for the KDE-FreeBSD community one. This is documented also on the <a href="https://community.kde.org/FreeBSD/Setup/Area51" rel="nofollow">Area51 page</a>.</li>
</ul>

<blockquote>
<p>mkdir -p /usr/local/etc/pkg/repos<br>
cd /usr/local/etc/pkg/repos<br>
cat &gt; FreeBSD.conf &lt;<EOF<br>
FreeBSD: { enabled: no }<br>
EOF<br>
cat > Area51.conf &lt;&lt;EOF<br>
Area51: {<br>
url: &quot;<a href="http://meatwad.mouf.net/rubick/poudriere/packages/110-amd64-kde/" rel="nofollow">http://meatwad.mouf.net/rubick/poudriere/packages/110-amd64-kde/</a>&quot;,<br>
priority: 2,<br>
enabled: yes<br>
}<br>
EOF</p>
</blockquote>

<ul>
<li>Tell pkg(8) to refresh itself (it may install a newer pkg, too), then install something nicer than xterm + twm, and then do some post-install configuration:</li>
</ul>

<blockquote>
<p>pkg update<br>
pkg install konsole plasma5-plasma-desktop<br>
echo cuse_load=YES &gt;&gt; /boot/loader.conf<br>
echo webcamd_enable=YES &gt;&gt; /etc/rc.conf</p>
</blockquote>

<ul>
<li>Log in as your test user, and set up .xinitrc to start Plasma 5:</li>
</ul>

<blockquote>
<p>cat &gt; .xinitrc &lt;&lt;EOF<br>
&#35;&#33; /bin/sh<br>
/usr/local/bin/xterm -geometry +0+0 &amp;<br>
KDE=/usr/local/bin/startkde<br>
test -x $KDE &amp;&amp; exec /usr/local/bin/ck-launch-session $KDE<br>
exec /usr/local/bin/twm<br>
EOF<br>
chmod 755 .xinitrc</p>
</blockquote>

<ul>
<li>If you really want, you can run startx, but this isn’t the complete Plasma 5 desktop experience... and KDE Applications are not installed, either. So you get a bare xterm (useful to kill X or start konsole) and kwin and not much else. Good thing that getting the rest of KDE Plasma 5 Desktop and KDE Applications is pretty easy (and we could have skipped the intermediate step with konsole and gone straight to the finish:</li>
</ul>

<blockquote>
<p>pkg install kde</p>
</blockquote>

<ul>
<li>This metaport will pull in another 2GiB of stuff, for all the KDE Applications and a complete Plasma desktop. There are intermediate metaports for slightly-less-heavy installations, but this one is easy to remember and will almost certainly get you what you want. So it really comes down to installing X, dbus, hal, and then the kde package. Voila!
***</li>
</ul>

<h3><a href="https://blog.cagedmonster.net/setup-full-server-with-freebsd-on-raspberrypi/" rel="nofollow">Full FreeBSD Server on a Raspberry Pi</a></h3>

<ul>
<li>Disclaimer :

<ul>
<li>The Raspberry PI is a such a great device. You can do a really huge amount of fun things with this little board... </li>
<li>The goal of this paper is to show how you can build a full personal server on your Raspberry PI, using FreeBSD and it&#39;s packages. </li>
</ul></li>
<li>Here&#39;s how we&#39;ll proceed :

<ul>
<li>Get FreeBSD</li>
<li>Configure FreeBSD</li>
<li>Install and configure sudo</li>
<li>Configure your Wifi with a static IPv4 and IPv6 address</li>
<li>Install and start Packet Filter</li>
<li>Install and configure nginx with &quot;let&#39;s encrypt&quot; SSL / PHP / MySQL</li>
<li>Install and configure OpenSMTPd and SPAMd</li>
<li>Install and configure Netdata with nginx to monitor your system</li>
<li>Avoid OS detection
***</li>
</ul></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2017-06-27/introducing-openntpd-base" rel="nofollow">HardenedBSD, now has openntpd in base</a></h3>

<ul>
<li>Over the past few months, Bernard Spil has been hard at work importing OpenNTPd 6.0p1 in HardenedBSD base. Starting with 12-CURRENT, HardenedBSD will ship with OpenNTPd by default. Just like with LibreSSL in base, HardenedBSD users have a choice when building world of which NTP daemon to use. Users who want to use the legacy NTPd can set WITHOUT_OPENNTPD and WITH_NTP in src.conf(5). Bernard will continue maintaining LibreSSL and OpenNTPd in HardenedBSD base.</li>
<li><p>Users who are upgrading from an existing 12-CURRENT system from source and who use the legacy NTP daemon in base will need to perform the following actions:</p>

<ul>
<li>Install new world</li>
<li>Run mergemaster or etcupdate</li>
<li>sysrc ntpd_enable=&quot;NO&quot;</li>
<li>sysrc local_openntpd_enable=&quot;YES&quot;</li>
</ul></li>
<li><p>A binary update will be published within the next 24 hours that contains OpenNTPd in base. Those who use hbsd-update will only need to perform steps 3 and 4 above.</p>

<hr></li>
</ul>

<h3><a href="http://www.networkworld.com/article/3208389/linux/unix-how-random-is-random.html" rel="nofollow">Unix: How random is random</a></h3>

<ul>
<li>Sandra Henry-Stocker writes on Networkworld: </li>
</ul>

<blockquote>
<p>On Unix systems, random numbers are generated in a number of ways and random data can serve many purposes. From simple commands to fairly complex processes, the question “How random is random?” is worth asking.<br>
EZ random numbers<br>
If all you need is a casual list of random numbers, the RANDOM variable is an easy choice. Type &quot;echo $RANDOM&quot; and you&#39;ll get a number between 0 and 32,767 (the largest number that two bytes can hold).</p>
</blockquote>

<ul>
<li>Note: this only works in bash, and is generally a silly thing to do</li>
</ul>

<blockquote>
<p>Of course, this process is actually providing a &quot;pseudo-random&quot; number. As anyone who thinks about random numbers very often might tell you, numbers generated by a program have a limitation. Programs follow carefully crafted steps, and those steps aren’t even close to being truly random. You can increase the randomness of RANDOM&#39;s value by seeding it (i.e., setting the variable to some initial value). Some just use the current process ID (via $$) for that. Note that for any particular starting point, the subsequent values that $RANDOM provides are quite predictable.</p>
</blockquote>

<ul>
<li>More complex random data</li>
</ul>

<blockquote>
<p>For more serious requirements for random data, such as its use in encryption, some more truly random data comes into play. The /dev/random and /dev/urandom files get beyond the predictability of programming by making use of environmental noise gathered from device drivers and other system sources and stored it in an “entropy pool”.</p>
</blockquote>

<ul>
<li>Examining entropy</li>
<li>Randomness vs. entropy</li>
<li>Generating files with random data</li>
<li>Generating random numbers</li>
<li>Beyond /dev/urandom
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/kernel/2017-July/239413.html" rel="nofollow">Moving firmware to userland</a></h3>

<ul>
<li>This is a post from the DragonFlyBSD mailinglist:</li>
</ul>

<blockquote>
<p>I would like to introduce a few ideas about the new firmware subsystem.  I assume that it should not require adding a new system tools or modifying boot process.<br>
Simplification is the first. It would be good to remove parent-child relationship and corresponding functionality. It would significantly simplify firmware handling. Its only practical use is when there are multiple images in one loadable kernel module. The module can be  unloaded when all children are not in use. Usage of the children images is tracked through the counter for the parent image. If images will not be placed inside loadable kernel modules, the parent-child mechanism won&#39;t have any practical meaning. I think, currently the mechanism is not used anywhere in the DragonFly system and if it was, it could be easily replaced by putting every child image in its own module without modifying drivers.<br>
There are two use cases according to who will provide firmware images to <br>
the system:</p>

<ul>
<li>developers of DragonFly BSD (they can modify and rebuild the system)</li>
<li>third-parties (they should not be required to modify and rebuild the system)</li>
</ul>

<p>All firmware images needs to have some information attached (at least, <br>
if ack with a license is needed) which should be d) stored persistently.<br>
The question is where to save the information for non-built-in images. </p>
</blockquote>

<ul>
<li>Various solutions are proposed that meet some -- but not all -- of the mentioned requirements, along with pros and cons.</li>
<li>It closes with:</li>
</ul>

<blockquote>
<p>There would be two firmware sources: kernel and filesystem. In case of the same image names, user could have a choice by setting a kernel environment variable, firmware from which source has higher priority and will be provided to consumer.</p>

<hr>
</blockquote>

<h3><a href="https://www.tedunangst.com/flak/post/openbsd-changes-of-note-625" rel="nofollow">OpenBSD changes of note 625</a></h3>

<ul>
<li>Continue with some cleanup and improvement of the depend step of building. Lots of little things to support lex and yacc better as well.</li>
<li>Intel Optane parts are leaking into the wild, some driver fixes to support them.</li>
<li>Add support for pattern substitution to variables in ksh using a common syntax borrowed from ksh93. Or not, reverted.</li>
<li>Deprecate fgetln.</li>
<li>Add detection for missing X sets to syspatch.</li>
<li>Refinement of the inteldrm code, including better backlight support.</li>
<li>A special edition of slaacd for the installer.</li>
<li>After much wailing and gnashing of teeth, fix strtol to parse strings like “0xridiculous”.</li>
<li>A fix for malloc and zero sized allocations when using canaries.</li>
<li>Add the ability to pause and unpause VMs in vmd.</li>
<li>Remove “listen secure” syntax from smtpd.conf. It’s broken since a couple of months and noone complained.</li>
<li>Remove sending of router solicitations and processing of router advertisements from the kernel.</li>
<li>The lidsuspend sysctl has been fully replaced by lidaction.</li>
<li>Fix fortune to filter out unprintable characters. Convert the fortune files to using UTF-8 instead of archaic overprinting. Fortunes with unprintable words may still be obtained with the -o option.</li>
<li>Introduce some quirks to the IDE and ATA code to prevent drives from attaching twice on hyper-v.</li>
<li>Add vmctl send and receive as well.</li>
<li>Update to xterm 330.</li>
<li>Remove some magic cleanup from dhclient. It will not deliberately attempt to interfere with other operations on the same interface.</li>
<li>Update libexpat to 2.2.2. Fixes NULL parser dereference.</li>
<li>Ilja Van Sprundel found a whole mess of kernel bugs in this and that. Some info leaks, some erroneous signal handling, some unbounded malloc calls. Lions, tigers, bears. Try to fix them.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://lud.cc/programming/man-hier/" rel="nofollow">Heir - description of the file system hierarchy</a></li>
<li><a href="https://www.freebsd.org/cgi/man.cgi?query=hier&format=html" rel="nofollow">FreeBSD hier(7)</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2017-July/626020.html" rel="nofollow">sshlockout and your logs</a></li>
<li><a href="https://svnweb.freebsd.org/ports?view=revision&revision=446144" rel="nofollow">net-mgmt/netdata can now monitor ZFS pools</a></li>
<li><a href="https://www.tedunangst.com/flak/post/books-chapter-five" rel="nofollow">Ted Unangst is reviewing some books, chapter by chapter. “Coders at Work”, “Founders at Work”, “the Mythical Man-Month”, “The Pragmatic Programmer”, and “Code: The Hidden Language of Computer Hardware and Software”. This is chapter 5, look for the bookreview tag on the site to find the previous ones</a></li>
<li><a href="https://www.netgate.com/blog/pfsense-2-3-4-p1-release-now-available.html" rel="nofollow">pfSense 2.3.4-p1 release now available</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/0V84RN7" rel="nofollow">Ben - Thanks</a></li>
<li><a href="http://dpaste.com/3KRWRS0" rel="nofollow">Jay - ZFS and Speed</a></li>
<li><a href="http://dpaste.com/0M9STNX" rel="nofollow">Patrick - Portalfs removed?</a></li>
<li><a href="http://dpaste.com/2H0Y3R5" rel="nofollow">Sir l33tname - ZFS pool question</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>205: FreeBSD Turning it up to 11.1</title>
  <link>https://www.bsdnow.tv/205</link>
  <guid isPermaLink="false">6923958e-7e04-4d74-9642-e10ec45fa15c</guid>
  <pubDate>Wed, 02 Aug 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6923958e-7e04-4d74-9642-e10ec45fa15c.mp3" length="53017780" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 11.1-RELEASE is out, we look at building at BSD home router, how to be your own OpenBSD VPN provider, and find that glob matching can be simple and fast.</itunes:subtitle>
  <itunes:duration>1:13:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 11.1-RELEASE is out, we look at building at BSD home router, how to be your own OpenBSD VPN provider, and find that glob matching can be simple and fast.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD 11.1-RELEASE (https://www.freebsd.org/releases/11.1R/relnotes.html)
FreeBSD 11.1 was released on July 26th (https://www.freebsd.org/releases/11.1R/announce.asc)
You can download it as an ISO or USB image, a prebuilt VM Image (vmdk, vhd, qcow2, or raw), and it is available as a cloud image (Amazon EC2, Microsoft Azure, Google Compute Engine, Vagrant)
Thanks to everyone, including the release engineering team who put so much time and effort into managing this release and making sure it came out on schedule, all of the FreeBSD developers who contributed the features, the companies that sponsored that development, and the users who tested the betas and release candidates.
Support for blacklistd(8) has been added to OpenSSH
The cron(8) utility has been updated to add support for including files within /etc/cron.d and /usr/local/etc/cron.d by default.
The syslogd(8) utility has been updated to add the include keyword which allows specifying     a directory containing configuration files to be included in addition to syslog.conf(5). The default     syslog.conf(5) has been updated to include /etc/syslog.d and /usr/local/etc/syslog.d by default.
The zfsbootcfg(8) utility has been added, providing one-time boot.config(5)-style options
The efivar(8) utility has been added, providing an interface to manage UEFI variables.
The ipsec and tcpmd5 kernel modules have been added, these can now be loaded without having to recompile the kernel
A number of new IPFW modules including Network Prefix Translation for IPv6 as defined in RFC 6296, stateless and stateful NAT64, and a module to modify the TCP-MSS of packets
A huge array of driver updates and additions
The NFS client now supports the Amazon® Elastic File System™ (EFS)
The new ZFS Compressed ARC feature was added, and is enabled by default
The EFI loader has been updated to support TFTPFS, providing netboot support without requiring an NFS server
For a complete list of new features and known problems, please see the online release notes and errata list, available at:
FreeBSD 11.1-RELEASE Release Notes (https://www.freebsd.org/releases/11.1R/relnotes.html)
FreeBSD 11.1-RELEASE Errata (https://www.freebsd.org/releases/11.1R/errata.html)
For more information about FreeBSD release engineering activities, please see: Release Engineering Information (https://www.freebsd.org/releng/)
Availability
FreeBSD 11.1-RELEASE is now available for the amd64, i386, powerpc, powerpc64, sparc64, armv6, and aarch64 architectures.
FreeBSD 11.1-RELEASE can be installed from bootable ISO images or over the network. Some architectures also support installing from a USB memory stick. The required files can be downloaded as described in the section below.
SHA512 and SHA256 hashes for the release ISO, memory stick, and SD card images are included at the bottom of this message.
PGP-signed checksums for the release images are also available at: FreeBSD 11.1 Release Checksum Signatures (https://www.freebsd.org/releases/11.1R/signatures.html)
A PGP-signed version of this announcement is available at: FreeBSD 11.1-RELEASE Announcement (https://www.FreeBSD.org/releases/11.1R/announce.asc)
***
Building a BSD home router  - ZFS and Jails (https://eerielinux.wordpress.com/2017/07/15/building-a-bsd-home-router-pt-8-zfs-and-jails/)
Part of a series of posts about building a router:
Part 1 (https://eerielinux.wordpress.com/2017/05/30/building-a-bsd-home-router-pt-1-hardware-pc-engines-apu2/) -- discussing why you want to build your own router and how to assemble the APU2
Part 2 (https://eerielinux.wordpress.com/2017/06/03/building-a-bsd-home-router-pt-2-the-serial-console-excursion) -- some Unix history explanation of what a serial console is
Part 3 (https://eerielinux.wordpress.com/2017/06/10/building-a-bsd-home-router-pt-3-serial-access-and-flashing-the-firmware/) -- demonstrating serial access to the APU and covering firmware update
Part 4 (https://eerielinux.wordpress.com/2017/06/15/building-a-bsd-home-router-pt-4-installing-pfsense/) -- installing pfSense
Part 5 (https://eerielinux.wordpress.com/2017/06/20/building-a-bsd-home-router-pt-5-installing-opnsense/) -- installing OPNsense instead
Part 6 (https://eerielinux.wordpress.com/2017/06/30/building-a-bsd-home-router-pt-7-advanced-opnsense-setup/) -- Comparison of pfSense and OPNsense
Part 7 (https://eerielinux.wordpress.com/2017/06/30/building-a-bsd-home-router-pt-7-advanced-opnsense-installation/) -- Advanced installation of OPNsense
After the advanced installation in part 7, the tutorials covers converting an unused partition into swap space, and converting the system to ZFS
After creating a new pool using the set aside partition, some datasets are created, and the log files, ports, and obj ZFS datasets are mounted
The tutorial then goes on to cover how to download the ports tree, and install additional software on the router
I wonder what part 9 will be about.
***
Be your own VPN provider with OpenBSD (v2) (https://networkfilter.blogspot.com/2017/04/be-your-own-vpn-provider-with-openbsd-v2.htm)
This article covers how to build your own VPN server with some advanced features including:
Full Disk Encryption (FDE)
Separate CA/signing machine (optional)
Multiple DNSCrypt proxy instances for failover
OpenVPN: Certificate Revocation List/CRL (optional)
OpenVPN: TLS 1.2 only
OpenVPN: TLS cipher based on AES-256-GCM only
OpenVPN: HMAC-SHA512 instead of HMAC-SHA1
OpenVPN: TLS encryption of control channel (makes it harder to identify OpenVPN traffic)
The article starts with an explanation of the differences between OpenVPN and IPSEC.
In the end the author chose OpenVPN because you can select the port it runs on, and it has a better chance of working from hotel or coffee shop WiFi.
The guide them walks through doing an installation on an encrypted disk, with a caution about the limitations of encrypted disk with virtual machines hosted by other parties.
The guide then locks down the newly installed system, configuring SSH for keys only, adding some PF rules, and configuring doas
Then networking is configured, including enabling IP forwarding since this machine is going to act as the VPN gateway
Then a large set of firewall rules are created that NAT the VPN traffic out of the gateway, except for DNS requests that are redirected to the gateways local unbound
Then some python scripts are provided to block brute force attempts
We will use DNSCrypt to make our DNS requests encrypted, and Unbound to have a local DNS cache. This will allow us to avoid using our VPS provider DNS servers, and will also be useful to your future VPN clients which will be able to use your VPN server as their DNS server too
Before configuring Unbound, which is the local DNS cache which will make requests to dnscrypt_proxy, we can configure an additional dnscrypt instance, as explained in the pkg readme. Indeed, dnscrypt DNS servers being public ones, they often goes into maintenance, become offline or temporarily unreachable. To address this issue, it is possible to setup multiple dnscrypt instances. Below are the steps to follow to add one, but you can add more if you wish
Then a CA and Certificate are created for OpenVPN
OpenVPN is installed and configured as a server
Configuration is also provided for a client, and a mobile client
Thanks to the author for this great tutorial
You might also want to check out this section from their 2015 version of this post: Security vs Anonymity (https://networkfilter.blogspot.nl/2015/01/be-your-own-vpn-provider-with-openbsd.html#security_anonymity)
***
Essen Hackathon Trip - Benedict Reuschling (https://www.freebsdfoundation.org/blog/2017-essen-hackathon-trip-report-benedict-reuschling/)
Over on the FreeBSD Foundation Blog, Benedict provides a detailed overview of the Essen Hackathon we were at a few weeks ago.
Head over there and give it a read, and get a feel for what these smaller type of community events are like. Hopefully you can attend, or better yet, organize, a similar event in your area.
News Roundup
Blog about my self-hosted httpd blog (https://reykfloeter.com/posts/blog-about-my-blog)
I really like Twitter because it allows me to share short messages, we have a great community, and 140 characters are enough for everybody.
And this statement was exactly 140 characters, but sometimes I want to say more than that. And that's why I finally created this new blog. I was never really into blogging because I barely had time or the audience to write long articles. I sometimes wrote short stories for sites like undeadly.org, I collected some of them here, but my own blog was hosted on tumblr and never saw any activity.
I want to try it again, and this time I decided to create a self-hosted blog. Something that runs on my own server and with httpd, the web server that I wrote for OpenBSD. So I was looking for potential blogging tools that I could use to run my own blog. Besides the popular and heavyweight ones such as WordPress, there are countless other options: I looked at blogs from fellow developers, such as Ted Unangst's flak (I like the fact that it is written in Lua but the implementation is a bit over my head), or Pelican that is used by Peter Hessler for bad.network (but, sorry, I don't like Python), and finally Kristaps Dzonsons' sblg that is used for all of his projects and blogs. I decided to use sblg.
Kristaps keeps on releasing very useful free software. Most well-known is mandoc, at least everyone is using it for manpages these days, but there is is also his BCHS (beaches) web stack which strongly advertises OpenBSD's httpd. Great. I also use kcgi whenever I have to write small CGIs. So sblg seemed like the right choice to me.
Let me quickly iterate over my current Makefile. I keep on tweaking this file, so it might have been changed by the time you are reading this article. Please note that the Makefile is written for OpenBSD's make, a distant derivative of pmake which is not like GNU make.
I'm not a designer or web developer, but I appreciate good looking web pages. I wanted to have something that is responsive, works on desktops and mobiles, looks somewhat modern, works without JavaScript, but doesn't disqualify me for all the eye candy from a geek point of view.
I bootstrapped the theme by creating a simple grid layout with a fairly typical blog style: banner, top menu, middle text, sidebar. In 2017, bootstrap is probably a vintage (or retro) framework but it makes it very easy to create responsive pages with a proper layout and without caring about all the CSS and HTML5 madness too much. I also use Font Awesome because it is awesome, provides some fancy icons, and was suggested in sblg's example templates (let's blame Kristaps for it). I do not include any JavaScript which prevents me from using bootstrap's responsive hamburger menu.
I have to admit that "reykfloeter" is not an ideal name for a blog. My actual name is "Reyk Flöter", and I normally just use my first name "reyk" as a user- and nickname, but it was taken when I registered my Twitter account and the related domain. So I picked reykfloeter in a few places.
I'm aware that my German last name is nearly unpronounceable for others, so "reykfloeter" appears like a random concatenation of letters. As most of us, I own a number of domains and maybe I should move the blog to bsd.plumbing (which is used as a home for relayd and httpd), arc4random.com (but I intended to use it as a fine OpenBSD-powered Entropy-as-a-Service for poor Linuxers), or even copper.coffee?
In addition to the domain, I also need a good blog name or tag line. A very memorable example in the BSD world is Peter Hansteen's THAT GRUMPY BSD GUY blog. So what should I use?
Reyk Flöter's blog
OpenBSD hacker. Coffee nerd. Founder.
Ask Reyk (imaginary how-tos and 10 step guides)
Sewage, Drainage and BSD Plumbing (bsd.plumbing/blog)
A Replacement Call for Random (arc4random.com)
Coffee with Reyk (copper.coffee)
For now it will just be reykfloeter - blog
iXsystems releases the X10 (https://www.ixsystems.com/blog/serverenvy-truenas-x10/)
 TrueNAS X10 is the the 3rd generation of the TrueNAS unified storage line. The X10 is the first of a new TrueNAS series, and will be expandable to up to 360TB with the TrueNAS ES12 expansion shelf.
The X10 is cost effective, at a 30% lower price point than the Z20, making it an effective addition to your backup/DR infrastructure. The street price of a 20TB non-HA model falls under $10K. It’s designed to move with six predefined configurations that match common use cases. The dual controllers for high availability are an optional upgrade to ensure business continuity and avoid downtime.
The X10 boasts 36 hot swap SAS using two expansion shelves, for up to 360TB of storage, allowing you to backup thousands of VMs or share tens of thousands of files. One of the use cases for TrueNAS X10 is for backup, so users can upgrade the X10 to two ports of blazing 10GigE connectivity. The 20TB non-HA model enables you to backup over 7,000 VDI VMs for under $3.00 per VM. Overall, the X10 is a greener solution than the TrueNAS Z product line, with the non-HA version boasting only 138 watts of power and taking up only 2U of space.
Best of all, the TrueNAS X10 starts at $5,500 street. You can purchase a 120TB configuration today for under $20K street.
Glob Matching Can Be Simple And Fast Too (https://research.swtch.com/glob)
Here’s a straightforward benchmark. Time how long it takes to run ls (a)nb in a directory with a single file named a100, compared to running ls | grep (a.)nb. Superscripts denote string repetition and parentheses are for grouping only, so that when n is 3, we’re running ls aaab in a directory containing the single file aaa…aaa (100 a’s), compared against ls | grep a.a.a.b in the same directory.
The exception seems to be the original Berkeley csh, which runs in linear time (more precisely, time linear in n). Looking at the source code, it doesn’t attempt to perform glob expansion itself. Instead it calls the C library implementation glob(3), which runs in linear time, at least on this Linux system. So maybe we should look at programming language implementations too.
Most programming languages provide some kind of glob expansion, like C’s glob. Let’s repeat the experiment in a variety of different programming languages:
Perhaps the most interesting fact evident in the graph is that GNU glibc, the C library used on Linux systems, has a linear-time glob implementation, but BSD libc, the C library used on BSD and macOS systems, has an exponential-time implementation.
PHP is not shown in the graph, because its glob function simply invokes the host C library’s glob(3), so that it runs in linear time on Linux and in exponential time on non-Linux systems. (I have not tested what happens on Windows.) All the languages shown in the graph, however, implement glob matching without using the host C library, so the results should not vary by host operating system.
The netkit ftpd runs quickly on Linux because it relies on the host C library’s glob function. If run on BSD, the netkit ftpd would take exponential time. ProFTPD ships a copy of the glibc glob, so it should run quickly even on BSD systems. Ironically, Pure-FTPd and tnftpd take exponential time on Linux because they ship a copy of the BSD glob function. Presumably they do this to avoid assuming that the host C library is bug-free, but, at least in this one case, the host C library is better than the one they ship.
Additional Reading
This post is an elaboration of an informal 2012 Google+ post showing that most shells used exponential-time glob expansion. At the time, Tom Duff, the author of Plan 9’s rc shell, commented that, “I can confirm that rc gets it wrong. My excuse, feeble as it is, is that doing it that way meant that the code took 10 minutes to write, but it took 20 years for someone to notice the problem. (That’s 10 ‘programmer minutes’, i.e. less than a day.)” I agree that’s a reasonable decision for a shell. In contrast, a language library routine, not to mention a network server, today needs to be robust against worst-case inputs that might be controlled by remote attackers, but nearly all of the code in question predates that kind of concern. I didn’t realize the connection to FTP servers until I started doing additional research for this post and came across a reference to CVE-2010-2632 in FreeBSD’s glob implementation.
BSD VPS Providers Needed (https://torbsd.github.io/blog.html#bsd-vps)
One of TDP’s recent projects is accumulating a list of virtual private server services (VPS) that provide a BSD option.
VPS’s are generally inexpensive services that enable the user to only concern themselves with software configuration, and not be bothered with hardware or basic operating system setup. In the pre-Cloud era, VPS providers were the “other people’s computers” that users outsourced their systems to.
The same shortcomings of cloud services apply to VPS providers. You don’t control the hardware. Your files are likely viewable by users up the directory hierarchy. The entropy source or pool is a single source for multiple systems. The same time drift applies to all time-keeping services.
Nevertheless, VPS services are often cheap and provide a good spread in terms of geography. All a provider really needs is a few server-grade computers and a decent network connection. VPS’s are still a gateway drug to bare-metal servers, although it seems more and more of these gateway users stop at stage one.
Cheap systems with a public IP are also a great way to tinker with a new operating system.
For this reason, TDP created this list of BSD VPS providers. Some explicitly deny running Tor as a server. Some just reference vague “proxy services.” Others don’t mention Tor or proxies at all.
The list is a start with currently just under 70 VPS providers listed. Input through various channels already started, and TDP intends to update the list over the coming months. A first draft email and open letter addressed to the providers were drafted, and we are looking to speak directly to at least some of the better-known BSD VPS providers.
We may be able to convince a few to allow public Tor relays, or at least published bridges. These providers could be new BSD users’ gateway drug into the world of BSD Tor nodes. Running a Tor relay shouldn’t be considered a particularly risky activity. Maybe we can adjust that perception.
Let us know any input via email or GitHub, and we’ll be glad to make updates.
Beastie Bits
Avoid OS Detection with OpenBSD (https://blog.cagedmonster.net/avoid-os-detection-openbsd/)
TrueOS update to fix updating (https://www.trueos.org/blog/update-fix-updating/)
MidnightBSD 0.8.5 VirtualBox Install (https://www.youtube.com/watch?v=I08__ZWaJ0w)
BSD Pizza Night in Portland (http://calagator.org/events/tag/BSD)
***
Feedback/Questions
Andrew - BSDCan videos? (http://dpaste.com/08E90PX)
Marc - The Rock64 Board (http://dpaste.com/08KE40G)
Jason - Follow up on UEFI and Bhyve (http://dpaste.com/2EP7BFC)
Patrick - EFI booting (http://dpaste.com/34Z9SFM)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 11.1-RELEASE is out, we look at building at BSD home router, how to be your own OpenBSD VPN provider, and find that glob matching can be simple and fast.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/11.1R/relnotes.html" rel="nofollow">FreeBSD 11.1-RELEASE</a></h3>

<ul>
<li><a href="https://www.freebsd.org/releases/11.1R/announce.asc" rel="nofollow">FreeBSD 11.1 was released on July 26th</a></li>
<li>You can download it as an ISO or USB image, a prebuilt VM Image (vmdk, vhd, qcow2, or raw), and it is available as a cloud image (Amazon EC2, Microsoft Azure, Google Compute Engine, Vagrant)</li>
<li>Thanks to everyone, including the release engineering team who put so much time and effort into managing this release and making sure it came out on schedule, all of the FreeBSD developers who contributed the features, the companies that sponsored that development, and the users who tested the betas and release candidates.</li>
<li>Support for blacklistd(8) has been added to OpenSSH</li>
<li>The cron(8) utility has been updated to add support for including files within /etc/cron.d and /usr/local/etc/cron.d by default.</li>
<li>The syslogd(8) utility has been updated to add the include keyword which allows specifying     a directory containing configuration files to be included in addition to syslog.conf(5). The default     syslog.conf(5) has been updated to include /etc/syslog.d and /usr/local/etc/syslog.d by default.</li>
<li>The zfsbootcfg(8) utility has been added, providing one-time boot.config(5)-style options</li>
<li>The efivar(8) utility has been added, providing an interface to manage UEFI variables.</li>
<li>The ipsec and tcpmd5 kernel modules have been added, these can now be loaded without having to recompile the kernel</li>
<li>A number of new IPFW modules including Network Prefix Translation for IPv6 as defined in RFC 6296, stateless and stateful NAT64, and a module to modify the TCP-MSS of packets</li>
<li>A huge array of driver updates and additions</li>
<li>The NFS client now supports the Amazon® Elastic File System™ (EFS)</li>
<li>The new ZFS Compressed ARC feature was added, and is enabled by default</li>
<li>The EFI loader has been updated to support TFTPFS, providing netboot support without requiring an NFS server</li>
<li>For a complete list of new features and known problems, please see the online release notes and errata list, available at:

<ul>
<li><a href="https://www.freebsd.org/releases/11.1R/relnotes.html" rel="nofollow">FreeBSD 11.1-RELEASE Release Notes</a></li>
<li><a href="https://www.freebsd.org/releases/11.1R/errata.html" rel="nofollow">FreeBSD 11.1-RELEASE Errata</a></li>
<li>For more information about FreeBSD release engineering activities, please see: <a href="https://www.freebsd.org/releng/" rel="nofollow">Release Engineering Information</a></li>
</ul></li>
<li>Availability

<ul>
<li>FreeBSD 11.1-RELEASE is now available for the amd64, i386, powerpc, powerpc64, sparc64, armv6, and aarch64 architectures.</li>
<li>FreeBSD 11.1-RELEASE can be installed from bootable ISO images or over the network. Some architectures also support installing from a USB memory stick. The required files can be downloaded as described in the section below.</li>
<li>SHA512 and SHA256 hashes for the release ISO, memory stick, and SD card images are included at the bottom of this message.</li>
<li>PGP-signed checksums for the release images are also available at: <a href="https://www.freebsd.org/releases/11.1R/signatures.html" rel="nofollow">FreeBSD 11.1 Release Checksum Signatures</a></li>
<li>A PGP-signed version of this announcement is available at: <a href="https://www.FreeBSD.org/releases/11.1R/announce.asc" rel="nofollow">FreeBSD 11.1-RELEASE Announcement</a>
***</li>
</ul></li>
</ul>

<h3><a href="https://eerielinux.wordpress.com/2017/07/15/building-a-bsd-home-router-pt-8-zfs-and-jails/" rel="nofollow">Building a BSD home router  - ZFS and Jails</a></h3>

<ul>
<li>Part of a series of posts about building a router:

<ul>
<li><a href="https://eerielinux.wordpress.com/2017/05/30/building-a-bsd-home-router-pt-1-hardware-pc-engines-apu2/" rel="nofollow">Part 1</a> -- discussing why you want to build your own router and how to assemble the APU2</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/03/building-a-bsd-home-router-pt-2-the-serial-console-excursion" rel="nofollow">Part 2</a> -- some Unix history explanation of what a serial console is</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/10/building-a-bsd-home-router-pt-3-serial-access-and-flashing-the-firmware/" rel="nofollow">Part 3</a> -- demonstrating serial access to the APU and covering firmware update</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/15/building-a-bsd-home-router-pt-4-installing-pfsense/" rel="nofollow">Part 4</a> -- installing pfSense</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/20/building-a-bsd-home-router-pt-5-installing-opnsense/" rel="nofollow">Part 5</a> -- installing OPNsense instead</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/30/building-a-bsd-home-router-pt-7-advanced-opnsense-setup/" rel="nofollow">Part 6</a> -- Comparison of pfSense and OPNsense</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/30/building-a-bsd-home-router-pt-7-advanced-opnsense-installation/" rel="nofollow">Part 7</a> -- Advanced installation of OPNsense</li>
</ul></li>
<li>After the advanced installation in part 7, the tutorials covers converting an unused partition into swap space, and converting the system to ZFS</li>
<li>After creating a new pool using the set aside partition, some datasets are created, and the log files, ports, and obj ZFS datasets are mounted</li>
<li>The tutorial then goes on to cover how to download the ports tree, and install additional software on the router</li>
<li>I wonder what part 9 will be about.
***</li>
</ul>

<h3><a href="https://networkfilter.blogspot.com/2017/04/be-your-own-vpn-provider-with-openbsd-v2.htm" rel="nofollow">Be your own VPN provider with OpenBSD (v2)</a></h3>

<ul>
<li>This article covers how to build your own VPN server with some advanced features including:

<ul>
<li>Full Disk Encryption (FDE)</li>
<li>Separate CA/signing machine (optional)</li>
<li>Multiple DNSCrypt proxy instances for failover</li>
<li>OpenVPN: Certificate Revocation List/CRL (optional)</li>
<li>OpenVPN: TLS 1.2 only</li>
<li>OpenVPN: TLS cipher based on AES-256-GCM only</li>
<li>OpenVPN: HMAC-SHA512 instead of HMAC-SHA1</li>
<li>OpenVPN: TLS encryption of control channel (makes it harder to identify OpenVPN traffic)</li>
</ul></li>
<li>The article starts with an explanation of the differences between OpenVPN and IPSEC.</li>
<li>In the end the author chose OpenVPN because you can select the port it runs on, and it has a better chance of working from hotel or coffee shop WiFi.</li>
<li>The guide them walks through doing an installation on an encrypted disk, with a caution about the limitations of encrypted disk with virtual machines hosted by other parties.</li>
<li>The guide then locks down the newly installed system, configuring SSH for keys only, adding some PF rules, and configuring doas</li>
<li>Then networking is configured, including enabling IP forwarding since this machine is going to act as the VPN gateway</li>
<li>Then a large set of firewall rules are created that NAT the VPN traffic out of the gateway, except for DNS requests that are redirected to the gateways local unbound</li>
<li>Then some python scripts are provided to block brute force attempts</li>
</ul>

<blockquote>
<p>We will use DNSCrypt to make our DNS requests encrypted, and Unbound to have a local DNS cache. This will allow us to avoid using our VPS provider DNS servers, and will also be useful to your future VPN clients which will be able to use your VPN server as their DNS server too<br>
Before configuring Unbound, which is the local DNS cache which will make requests to dnscrypt_proxy, we can configure an additional dnscrypt instance, as explained in the pkg readme. Indeed, dnscrypt DNS servers being public ones, they often goes into maintenance, become offline or temporarily unreachable. To address this issue, it is possible to setup multiple dnscrypt instances. Below are the steps to follow to add one, but you can add more if you wish</p>
</blockquote>

<ul>
<li>Then a CA and Certificate are created for OpenVPN</li>
<li>OpenVPN is installed and configured as a server</li>
<li>Configuration is also provided for a client, and a mobile client</li>
<li>Thanks to the author for this great tutorial</li>
<li>You might also want to check out this section from their 2015 version of this post: <a href="https://networkfilter.blogspot.nl/2015/01/be-your-own-vpn-provider-with-openbsd.html#security_anonymity" rel="nofollow">Security vs Anonymity</a>
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/blog/2017-essen-hackathon-trip-report-benedict-reuschling/" rel="nofollow">Essen Hackathon Trip - Benedict Reuschling</a></h3>

<ul>
<li>Over on the FreeBSD Foundation Blog, Benedict provides a detailed overview of the Essen Hackathon we were at a few weeks ago.</li>
<li>Head over there and give it a read, and get a feel for what these smaller type of community events are like. Hopefully you can attend, or better yet, organize, a similar event in your area.</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://reykfloeter.com/posts/blog-about-my-blog" rel="nofollow">Blog about my self-hosted httpd blog</a></h3>

<blockquote>
<p>I really like Twitter because it allows me to share short messages, we have a great community, and 140 characters are enough for everybody.<br>
And this statement was exactly 140 characters, but sometimes I want to say more than that. And that&#39;s why I finally created this new blog. I was never really into blogging because I barely had time or the audience to write long articles. I sometimes wrote short stories for sites like undeadly.org, I collected some of them here, but my own blog was hosted on tumblr and never saw any activity.<br>
I want to try it again, and this time I decided to create a self-hosted blog. Something that runs on my own server and with httpd, the web server that I wrote for OpenBSD. So I was looking for potential blogging tools that I could use to run my own blog. Besides the popular and heavyweight ones such as WordPress, there are countless other options: I looked at blogs from fellow developers, such as Ted Unangst&#39;s flak (I like the fact that it is written in Lua but the implementation is a bit over my head), or Pelican that is used by Peter Hessler for bad.network (but, sorry, I don&#39;t like Python), and finally Kristaps Dzonsons&#39; sblg that is used for all of his projects and blogs. I decided to use sblg.<br>
Kristaps keeps on releasing very useful free software. Most well-known is mandoc, at least everyone is using it for manpages these days, but there is is also his BCHS (beaches) web stack which strongly advertises OpenBSD&#39;s httpd. Great. I also use kcgi whenever I have to write small CGIs. So sblg seemed like the right choice to me.<br>
Let me quickly iterate over my current Makefile. I keep on tweaking this file, so it might have been changed by the time you are reading this article. Please note that the Makefile is written for OpenBSD&#39;s make, a distant derivative of pmake which is not like GNU make.<br>
I&#39;m not a designer or web developer, but I appreciate good looking web pages. I wanted to have something that is responsive, works on desktops and mobiles, looks somewhat modern, works without JavaScript, but doesn&#39;t disqualify me for all the eye candy from a geek point of view.<br>
I bootstrapped the theme by creating a simple grid layout with a fairly typical blog style: banner, top menu, middle text, sidebar. In 2017, bootstrap is probably a vintage (or retro) framework but it makes it very easy to create responsive pages with a proper layout and without caring about all the CSS and HTML5 madness too much. I also use Font Awesome because it is awesome, provides some fancy icons, and was suggested in sblg&#39;s example templates (let&#39;s blame Kristaps for it). I do not include any JavaScript which prevents me from using bootstrap&#39;s responsive hamburger menu.<br>
I have to admit that &quot;reykfloeter&quot; is not an ideal name for a blog. My actual name is &quot;Reyk Flöter&quot;, and I normally just use my first name &quot;reyk&quot; as a user- and nickname, but it was taken when I registered my Twitter account and the related domain. So I picked reykfloeter in a few places.<br>
I&#39;m aware that my German last name is nearly unpronounceable for others, so &quot;reykfloeter&quot; appears like a random concatenation of letters. As most of us, I own a number of domains and maybe I should move the blog to bsd.plumbing (which is used as a home for relayd and httpd), arc4random.com (but I intended to use it as a fine OpenBSD-powered Entropy-as-a-Service for poor Linuxers), or even copper.coffee?<br>
In addition to the domain, I also need a good blog name or tag line. A very memorable example in the BSD world is Peter Hansteen&#39;s THAT GRUMPY BSD GUY blog. So what should I use?</p>
</blockquote>

<ul>
<li>Reyk Flöter&#39;s blog

<ul>
<li>OpenBSD hacker. Coffee nerd. Founder.</li>
<li>Ask Reyk (imaginary how-tos and 10 step guides)</li>
<li>[Sewage, Drainage and BSD Plumbing](bsd.plumbing/blog)</li>
<li>[A Replacement Call for Random](arc4random.com)</li>
<li>[Coffee with Reyk](copper.coffee)</li>
</ul></li>
</ul>

<blockquote>
<p>For now it will just be reykfloeter - blog</p>

<hr>
</blockquote>

<h3><a href="https://www.ixsystems.com/blog/serverenvy-truenas-x10/" rel="nofollow">iXsystems releases the X10</a></h3>

<ul>
<li> TrueNAS X10 is the the 3rd generation of the TrueNAS unified storage line. The X10 is the first of a new TrueNAS series, and will be expandable to up to 360TB with the TrueNAS ES12 expansion shelf.</li>
<li>The X10 is cost effective, at a 30% lower price point than the Z20, making it an effective addition to your backup/DR infrastructure. The street price of a 20TB non-HA model falls under $10K. It’s designed to move with six predefined configurations that match common use cases. The dual controllers for high availability are an optional upgrade to ensure business continuity and avoid downtime.</li>
<li>The X10 boasts 36 hot swap SAS using two expansion shelves, for up to 360TB of storage, allowing you to backup thousands of VMs or share tens of thousands of files. One of the use cases for TrueNAS X10 is for backup, so users can upgrade the X10 to two ports of blazing 10GigE connectivity. The 20TB non-HA model enables you to backup over 7,000 VDI VMs for under $3.00 per VM. Overall, the X10 is a greener solution than the TrueNAS Z product line, with the non-HA version boasting only 138 watts of power and taking up only 2U of space.</li>
<li>Best of all, the TrueNAS X10 starts at $5,500 street. You can purchase a 120TB configuration today for under $20K street.</li>
</ul>

<h3><a href="https://research.swtch.com/glob" rel="nofollow">Glob Matching Can Be Simple And Fast Too</a></h3>

<blockquote>
<p>Here’s a straightforward benchmark. Time how long it takes to run ls (a*)nb in a directory with a single file named a100, compared to running ls | grep (a.*)nb. Superscripts denote string repetition and parentheses are for grouping only, so that when n is 3, we’re running ls a*a*a*b in a directory containing the single file aaa…aaa (100 a’s), compared against ls | grep a.*a.*a.*b in the same directory.<br>
The exception seems to be the original Berkeley csh, which runs in linear time (more precisely, time linear in n). Looking at the source code, it doesn’t attempt to perform glob expansion itself. Instead it calls the C library implementation glob(3), which runs in linear time, at least on this Linux system. So maybe we should look at programming language implementations too.<br>
Most programming languages provide some kind of glob expansion, like C’s glob. Let’s repeat the experiment in a variety of different programming languages:<br>
Perhaps the most interesting fact evident in the graph is that GNU glibc, the C library used on Linux systems, has a linear-time glob implementation, but BSD libc, the C library used on BSD and macOS systems, has an exponential-time implementation.<br>
PHP is not shown in the graph, because its glob function simply invokes the host C library’s glob(3), so that it runs in linear time on Linux and in exponential time on non-Linux systems. (I have not tested what happens on Windows.) All the languages shown in the graph, however, implement glob matching without using the host C library, so the results should not vary by host operating system.<br>
The netkit ftpd runs quickly on Linux because it relies on the host C library’s glob function. If run on BSD, the netkit ftpd would take exponential time. ProFTPD ships a copy of the glibc glob, so it should run quickly even on BSD systems. Ironically, Pure-FTPd and tnftpd take exponential time on Linux because they ship a copy of the BSD glob function. Presumably they do this to avoid assuming that the host C library is bug-free, but, at least in this one case, the host C library is better than the one they ship.</p>
</blockquote>

<ul>
<li>Additional Reading</li>
</ul>

<blockquote>
<p>This post is an elaboration of an informal 2012 Google+ post showing that most shells used exponential-time glob expansion. At the time, Tom Duff, the author of Plan 9’s rc shell, commented that, “I can confirm that rc gets it wrong. My excuse, feeble as it is, is that doing it that way meant that the code took 10 minutes to write, but it took 20 years for someone to notice the problem. (That’s 10 ‘programmer minutes’, i.e. less than a day.)” I agree that’s a reasonable decision for a shell. In contrast, a language library routine, not to mention a network server, today needs to be robust against worst-case inputs that might be controlled by remote attackers, but nearly all of the code in question predates that kind of concern. I didn’t realize the connection to FTP servers until I started doing additional research for this post and came across a reference to CVE-2010-2632 in FreeBSD’s glob implementation.</p>
</blockquote>

<hr>

<h3><a href="https://torbsd.github.io/blog.html#bsd-vps" rel="nofollow">BSD VPS Providers Needed</a></h3>

<blockquote>
<p>One of TDP’s recent projects is accumulating a list of virtual private server services (VPS) that provide a BSD option.<br>
VPS’s are generally inexpensive services that enable the user to only concern themselves with software configuration, and not be bothered with hardware or basic operating system setup. In the pre-Cloud era, VPS providers were the “other people’s computers” that users outsourced their systems to.<br>
The same shortcomings of cloud services apply to VPS providers. You don’t control the hardware. Your files are likely viewable by users up the directory hierarchy. The entropy source or pool is a single source for multiple systems. The same time drift applies to all time-keeping services.<br>
Nevertheless, VPS services are often cheap and provide a good spread in terms of geography. All a provider really needs is a few server-grade computers and a decent network connection. VPS’s are still a gateway drug to bare-metal servers, although it seems more and more of these gateway users stop at stage one.<br>
Cheap systems with a public IP are also a great way to tinker with a new operating system.<br>
For this reason, TDP created this list of BSD VPS providers. Some explicitly deny running Tor as a server. Some just reference vague “proxy services.” Others don’t mention Tor or proxies at all.<br>
The list is a start with currently just under 70 VPS providers listed. Input through various channels already started, and TDP intends to update the list over the coming months. A first draft email and open letter addressed to the providers were drafted, and we are looking to speak directly to at least some of the better-known BSD VPS providers.<br>
We may be able to convince a few to allow public Tor relays, or at least published bridges. These providers could be new BSD users’ gateway drug into the world of BSD Tor nodes. Running a Tor relay shouldn’t be considered a particularly risky activity. Maybe we can adjust that perception.<br>
Let us know any input via email or GitHub, and we’ll be glad to make updates.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.cagedmonster.net/avoid-os-detection-openbsd/" rel="nofollow">Avoid OS Detection with OpenBSD</a></li>
<li><a href="https://www.trueos.org/blog/update-fix-updating/" rel="nofollow">TrueOS update to fix updating</a></li>
<li><a href="https://www.youtube.com/watch?v=I08__ZWaJ0w" rel="nofollow">MidnightBSD 0.8.5 VirtualBox Install</a></li>
<li><a href="http://calagator.org/events/tag/BSD" rel="nofollow">BSD Pizza Night in Portland</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Andrew - <a href="http://dpaste.com/08E90PX" rel="nofollow">BSDCan videos?</a></li>
<li>Marc - <a href="http://dpaste.com/08KE40G" rel="nofollow">The Rock64 Board</a></li>
<li>Jason - <a href="http://dpaste.com/2EP7BFC" rel="nofollow">Follow up on UEFI and Bhyve</a></li>
<li>Patrick - <a href="http://dpaste.com/34Z9SFM" rel="nofollow">EFI booting</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 11.1-RELEASE is out, we look at building at BSD home router, how to be your own OpenBSD VPN provider, and find that glob matching can be simple and fast.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/11.1R/relnotes.html" rel="nofollow">FreeBSD 11.1-RELEASE</a></h3>

<ul>
<li><a href="https://www.freebsd.org/releases/11.1R/announce.asc" rel="nofollow">FreeBSD 11.1 was released on July 26th</a></li>
<li>You can download it as an ISO or USB image, a prebuilt VM Image (vmdk, vhd, qcow2, or raw), and it is available as a cloud image (Amazon EC2, Microsoft Azure, Google Compute Engine, Vagrant)</li>
<li>Thanks to everyone, including the release engineering team who put so much time and effort into managing this release and making sure it came out on schedule, all of the FreeBSD developers who contributed the features, the companies that sponsored that development, and the users who tested the betas and release candidates.</li>
<li>Support for blacklistd(8) has been added to OpenSSH</li>
<li>The cron(8) utility has been updated to add support for including files within /etc/cron.d and /usr/local/etc/cron.d by default.</li>
<li>The syslogd(8) utility has been updated to add the include keyword which allows specifying     a directory containing configuration files to be included in addition to syslog.conf(5). The default     syslog.conf(5) has been updated to include /etc/syslog.d and /usr/local/etc/syslog.d by default.</li>
<li>The zfsbootcfg(8) utility has been added, providing one-time boot.config(5)-style options</li>
<li>The efivar(8) utility has been added, providing an interface to manage UEFI variables.</li>
<li>The ipsec and tcpmd5 kernel modules have been added, these can now be loaded without having to recompile the kernel</li>
<li>A number of new IPFW modules including Network Prefix Translation for IPv6 as defined in RFC 6296, stateless and stateful NAT64, and a module to modify the TCP-MSS of packets</li>
<li>A huge array of driver updates and additions</li>
<li>The NFS client now supports the Amazon® Elastic File System™ (EFS)</li>
<li>The new ZFS Compressed ARC feature was added, and is enabled by default</li>
<li>The EFI loader has been updated to support TFTPFS, providing netboot support without requiring an NFS server</li>
<li>For a complete list of new features and known problems, please see the online release notes and errata list, available at:

<ul>
<li><a href="https://www.freebsd.org/releases/11.1R/relnotes.html" rel="nofollow">FreeBSD 11.1-RELEASE Release Notes</a></li>
<li><a href="https://www.freebsd.org/releases/11.1R/errata.html" rel="nofollow">FreeBSD 11.1-RELEASE Errata</a></li>
<li>For more information about FreeBSD release engineering activities, please see: <a href="https://www.freebsd.org/releng/" rel="nofollow">Release Engineering Information</a></li>
</ul></li>
<li>Availability

<ul>
<li>FreeBSD 11.1-RELEASE is now available for the amd64, i386, powerpc, powerpc64, sparc64, armv6, and aarch64 architectures.</li>
<li>FreeBSD 11.1-RELEASE can be installed from bootable ISO images or over the network. Some architectures also support installing from a USB memory stick. The required files can be downloaded as described in the section below.</li>
<li>SHA512 and SHA256 hashes for the release ISO, memory stick, and SD card images are included at the bottom of this message.</li>
<li>PGP-signed checksums for the release images are also available at: <a href="https://www.freebsd.org/releases/11.1R/signatures.html" rel="nofollow">FreeBSD 11.1 Release Checksum Signatures</a></li>
<li>A PGP-signed version of this announcement is available at: <a href="https://www.FreeBSD.org/releases/11.1R/announce.asc" rel="nofollow">FreeBSD 11.1-RELEASE Announcement</a>
***</li>
</ul></li>
</ul>

<h3><a href="https://eerielinux.wordpress.com/2017/07/15/building-a-bsd-home-router-pt-8-zfs-and-jails/" rel="nofollow">Building a BSD home router  - ZFS and Jails</a></h3>

<ul>
<li>Part of a series of posts about building a router:

<ul>
<li><a href="https://eerielinux.wordpress.com/2017/05/30/building-a-bsd-home-router-pt-1-hardware-pc-engines-apu2/" rel="nofollow">Part 1</a> -- discussing why you want to build your own router and how to assemble the APU2</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/03/building-a-bsd-home-router-pt-2-the-serial-console-excursion" rel="nofollow">Part 2</a> -- some Unix history explanation of what a serial console is</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/10/building-a-bsd-home-router-pt-3-serial-access-and-flashing-the-firmware/" rel="nofollow">Part 3</a> -- demonstrating serial access to the APU and covering firmware update</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/15/building-a-bsd-home-router-pt-4-installing-pfsense/" rel="nofollow">Part 4</a> -- installing pfSense</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/20/building-a-bsd-home-router-pt-5-installing-opnsense/" rel="nofollow">Part 5</a> -- installing OPNsense instead</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/30/building-a-bsd-home-router-pt-7-advanced-opnsense-setup/" rel="nofollow">Part 6</a> -- Comparison of pfSense and OPNsense</li>
<li><a href="https://eerielinux.wordpress.com/2017/06/30/building-a-bsd-home-router-pt-7-advanced-opnsense-installation/" rel="nofollow">Part 7</a> -- Advanced installation of OPNsense</li>
</ul></li>
<li>After the advanced installation in part 7, the tutorials covers converting an unused partition into swap space, and converting the system to ZFS</li>
<li>After creating a new pool using the set aside partition, some datasets are created, and the log files, ports, and obj ZFS datasets are mounted</li>
<li>The tutorial then goes on to cover how to download the ports tree, and install additional software on the router</li>
<li>I wonder what part 9 will be about.
***</li>
</ul>

<h3><a href="https://networkfilter.blogspot.com/2017/04/be-your-own-vpn-provider-with-openbsd-v2.htm" rel="nofollow">Be your own VPN provider with OpenBSD (v2)</a></h3>

<ul>
<li>This article covers how to build your own VPN server with some advanced features including:

<ul>
<li>Full Disk Encryption (FDE)</li>
<li>Separate CA/signing machine (optional)</li>
<li>Multiple DNSCrypt proxy instances for failover</li>
<li>OpenVPN: Certificate Revocation List/CRL (optional)</li>
<li>OpenVPN: TLS 1.2 only</li>
<li>OpenVPN: TLS cipher based on AES-256-GCM only</li>
<li>OpenVPN: HMAC-SHA512 instead of HMAC-SHA1</li>
<li>OpenVPN: TLS encryption of control channel (makes it harder to identify OpenVPN traffic)</li>
</ul></li>
<li>The article starts with an explanation of the differences between OpenVPN and IPSEC.</li>
<li>In the end the author chose OpenVPN because you can select the port it runs on, and it has a better chance of working from hotel or coffee shop WiFi.</li>
<li>The guide them walks through doing an installation on an encrypted disk, with a caution about the limitations of encrypted disk with virtual machines hosted by other parties.</li>
<li>The guide then locks down the newly installed system, configuring SSH for keys only, adding some PF rules, and configuring doas</li>
<li>Then networking is configured, including enabling IP forwarding since this machine is going to act as the VPN gateway</li>
<li>Then a large set of firewall rules are created that NAT the VPN traffic out of the gateway, except for DNS requests that are redirected to the gateways local unbound</li>
<li>Then some python scripts are provided to block brute force attempts</li>
</ul>

<blockquote>
<p>We will use DNSCrypt to make our DNS requests encrypted, and Unbound to have a local DNS cache. This will allow us to avoid using our VPS provider DNS servers, and will also be useful to your future VPN clients which will be able to use your VPN server as their DNS server too<br>
Before configuring Unbound, which is the local DNS cache which will make requests to dnscrypt_proxy, we can configure an additional dnscrypt instance, as explained in the pkg readme. Indeed, dnscrypt DNS servers being public ones, they often goes into maintenance, become offline or temporarily unreachable. To address this issue, it is possible to setup multiple dnscrypt instances. Below are the steps to follow to add one, but you can add more if you wish</p>
</blockquote>

<ul>
<li>Then a CA and Certificate are created for OpenVPN</li>
<li>OpenVPN is installed and configured as a server</li>
<li>Configuration is also provided for a client, and a mobile client</li>
<li>Thanks to the author for this great tutorial</li>
<li>You might also want to check out this section from their 2015 version of this post: <a href="https://networkfilter.blogspot.nl/2015/01/be-your-own-vpn-provider-with-openbsd.html#security_anonymity" rel="nofollow">Security vs Anonymity</a>
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/blog/2017-essen-hackathon-trip-report-benedict-reuschling/" rel="nofollow">Essen Hackathon Trip - Benedict Reuschling</a></h3>

<ul>
<li>Over on the FreeBSD Foundation Blog, Benedict provides a detailed overview of the Essen Hackathon we were at a few weeks ago.</li>
<li>Head over there and give it a read, and get a feel for what these smaller type of community events are like. Hopefully you can attend, or better yet, organize, a similar event in your area.</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://reykfloeter.com/posts/blog-about-my-blog" rel="nofollow">Blog about my self-hosted httpd blog</a></h3>

<blockquote>
<p>I really like Twitter because it allows me to share short messages, we have a great community, and 140 characters are enough for everybody.<br>
And this statement was exactly 140 characters, but sometimes I want to say more than that. And that&#39;s why I finally created this new blog. I was never really into blogging because I barely had time or the audience to write long articles. I sometimes wrote short stories for sites like undeadly.org, I collected some of them here, but my own blog was hosted on tumblr and never saw any activity.<br>
I want to try it again, and this time I decided to create a self-hosted blog. Something that runs on my own server and with httpd, the web server that I wrote for OpenBSD. So I was looking for potential blogging tools that I could use to run my own blog. Besides the popular and heavyweight ones such as WordPress, there are countless other options: I looked at blogs from fellow developers, such as Ted Unangst&#39;s flak (I like the fact that it is written in Lua but the implementation is a bit over my head), or Pelican that is used by Peter Hessler for bad.network (but, sorry, I don&#39;t like Python), and finally Kristaps Dzonsons&#39; sblg that is used for all of his projects and blogs. I decided to use sblg.<br>
Kristaps keeps on releasing very useful free software. Most well-known is mandoc, at least everyone is using it for manpages these days, but there is is also his BCHS (beaches) web stack which strongly advertises OpenBSD&#39;s httpd. Great. I also use kcgi whenever I have to write small CGIs. So sblg seemed like the right choice to me.<br>
Let me quickly iterate over my current Makefile. I keep on tweaking this file, so it might have been changed by the time you are reading this article. Please note that the Makefile is written for OpenBSD&#39;s make, a distant derivative of pmake which is not like GNU make.<br>
I&#39;m not a designer or web developer, but I appreciate good looking web pages. I wanted to have something that is responsive, works on desktops and mobiles, looks somewhat modern, works without JavaScript, but doesn&#39;t disqualify me for all the eye candy from a geek point of view.<br>
I bootstrapped the theme by creating a simple grid layout with a fairly typical blog style: banner, top menu, middle text, sidebar. In 2017, bootstrap is probably a vintage (or retro) framework but it makes it very easy to create responsive pages with a proper layout and without caring about all the CSS and HTML5 madness too much. I also use Font Awesome because it is awesome, provides some fancy icons, and was suggested in sblg&#39;s example templates (let&#39;s blame Kristaps for it). I do not include any JavaScript which prevents me from using bootstrap&#39;s responsive hamburger menu.<br>
I have to admit that &quot;reykfloeter&quot; is not an ideal name for a blog. My actual name is &quot;Reyk Flöter&quot;, and I normally just use my first name &quot;reyk&quot; as a user- and nickname, but it was taken when I registered my Twitter account and the related domain. So I picked reykfloeter in a few places.<br>
I&#39;m aware that my German last name is nearly unpronounceable for others, so &quot;reykfloeter&quot; appears like a random concatenation of letters. As most of us, I own a number of domains and maybe I should move the blog to bsd.plumbing (which is used as a home for relayd and httpd), arc4random.com (but I intended to use it as a fine OpenBSD-powered Entropy-as-a-Service for poor Linuxers), or even copper.coffee?<br>
In addition to the domain, I also need a good blog name or tag line. A very memorable example in the BSD world is Peter Hansteen&#39;s THAT GRUMPY BSD GUY blog. So what should I use?</p>
</blockquote>

<ul>
<li>Reyk Flöter&#39;s blog

<ul>
<li>OpenBSD hacker. Coffee nerd. Founder.</li>
<li>Ask Reyk (imaginary how-tos and 10 step guides)</li>
<li>[Sewage, Drainage and BSD Plumbing](bsd.plumbing/blog)</li>
<li>[A Replacement Call for Random](arc4random.com)</li>
<li>[Coffee with Reyk](copper.coffee)</li>
</ul></li>
</ul>

<blockquote>
<p>For now it will just be reykfloeter - blog</p>

<hr>
</blockquote>

<h3><a href="https://www.ixsystems.com/blog/serverenvy-truenas-x10/" rel="nofollow">iXsystems releases the X10</a></h3>

<ul>
<li> TrueNAS X10 is the the 3rd generation of the TrueNAS unified storage line. The X10 is the first of a new TrueNAS series, and will be expandable to up to 360TB with the TrueNAS ES12 expansion shelf.</li>
<li>The X10 is cost effective, at a 30% lower price point than the Z20, making it an effective addition to your backup/DR infrastructure. The street price of a 20TB non-HA model falls under $10K. It’s designed to move with six predefined configurations that match common use cases. The dual controllers for high availability are an optional upgrade to ensure business continuity and avoid downtime.</li>
<li>The X10 boasts 36 hot swap SAS using two expansion shelves, for up to 360TB of storage, allowing you to backup thousands of VMs or share tens of thousands of files. One of the use cases for TrueNAS X10 is for backup, so users can upgrade the X10 to two ports of blazing 10GigE connectivity. The 20TB non-HA model enables you to backup over 7,000 VDI VMs for under $3.00 per VM. Overall, the X10 is a greener solution than the TrueNAS Z product line, with the non-HA version boasting only 138 watts of power and taking up only 2U of space.</li>
<li>Best of all, the TrueNAS X10 starts at $5,500 street. You can purchase a 120TB configuration today for under $20K street.</li>
</ul>

<h3><a href="https://research.swtch.com/glob" rel="nofollow">Glob Matching Can Be Simple And Fast Too</a></h3>

<blockquote>
<p>Here’s a straightforward benchmark. Time how long it takes to run ls (a*)nb in a directory with a single file named a100, compared to running ls | grep (a.*)nb. Superscripts denote string repetition and parentheses are for grouping only, so that when n is 3, we’re running ls a*a*a*b in a directory containing the single file aaa…aaa (100 a’s), compared against ls | grep a.*a.*a.*b in the same directory.<br>
The exception seems to be the original Berkeley csh, which runs in linear time (more precisely, time linear in n). Looking at the source code, it doesn’t attempt to perform glob expansion itself. Instead it calls the C library implementation glob(3), which runs in linear time, at least on this Linux system. So maybe we should look at programming language implementations too.<br>
Most programming languages provide some kind of glob expansion, like C’s glob. Let’s repeat the experiment in a variety of different programming languages:<br>
Perhaps the most interesting fact evident in the graph is that GNU glibc, the C library used on Linux systems, has a linear-time glob implementation, but BSD libc, the C library used on BSD and macOS systems, has an exponential-time implementation.<br>
PHP is not shown in the graph, because its glob function simply invokes the host C library’s glob(3), so that it runs in linear time on Linux and in exponential time on non-Linux systems. (I have not tested what happens on Windows.) All the languages shown in the graph, however, implement glob matching without using the host C library, so the results should not vary by host operating system.<br>
The netkit ftpd runs quickly on Linux because it relies on the host C library’s glob function. If run on BSD, the netkit ftpd would take exponential time. ProFTPD ships a copy of the glibc glob, so it should run quickly even on BSD systems. Ironically, Pure-FTPd and tnftpd take exponential time on Linux because they ship a copy of the BSD glob function. Presumably they do this to avoid assuming that the host C library is bug-free, but, at least in this one case, the host C library is better than the one they ship.</p>
</blockquote>

<ul>
<li>Additional Reading</li>
</ul>

<blockquote>
<p>This post is an elaboration of an informal 2012 Google+ post showing that most shells used exponential-time glob expansion. At the time, Tom Duff, the author of Plan 9’s rc shell, commented that, “I can confirm that rc gets it wrong. My excuse, feeble as it is, is that doing it that way meant that the code took 10 minutes to write, but it took 20 years for someone to notice the problem. (That’s 10 ‘programmer minutes’, i.e. less than a day.)” I agree that’s a reasonable decision for a shell. In contrast, a language library routine, not to mention a network server, today needs to be robust against worst-case inputs that might be controlled by remote attackers, but nearly all of the code in question predates that kind of concern. I didn’t realize the connection to FTP servers until I started doing additional research for this post and came across a reference to CVE-2010-2632 in FreeBSD’s glob implementation.</p>
</blockquote>

<hr>

<h3><a href="https://torbsd.github.io/blog.html#bsd-vps" rel="nofollow">BSD VPS Providers Needed</a></h3>

<blockquote>
<p>One of TDP’s recent projects is accumulating a list of virtual private server services (VPS) that provide a BSD option.<br>
VPS’s are generally inexpensive services that enable the user to only concern themselves with software configuration, and not be bothered with hardware or basic operating system setup. In the pre-Cloud era, VPS providers were the “other people’s computers” that users outsourced their systems to.<br>
The same shortcomings of cloud services apply to VPS providers. You don’t control the hardware. Your files are likely viewable by users up the directory hierarchy. The entropy source or pool is a single source for multiple systems. The same time drift applies to all time-keeping services.<br>
Nevertheless, VPS services are often cheap and provide a good spread in terms of geography. All a provider really needs is a few server-grade computers and a decent network connection. VPS’s are still a gateway drug to bare-metal servers, although it seems more and more of these gateway users stop at stage one.<br>
Cheap systems with a public IP are also a great way to tinker with a new operating system.<br>
For this reason, TDP created this list of BSD VPS providers. Some explicitly deny running Tor as a server. Some just reference vague “proxy services.” Others don’t mention Tor or proxies at all.<br>
The list is a start with currently just under 70 VPS providers listed. Input through various channels already started, and TDP intends to update the list over the coming months. A first draft email and open letter addressed to the providers were drafted, and we are looking to speak directly to at least some of the better-known BSD VPS providers.<br>
We may be able to convince a few to allow public Tor relays, or at least published bridges. These providers could be new BSD users’ gateway drug into the world of BSD Tor nodes. Running a Tor relay shouldn’t be considered a particularly risky activity. Maybe we can adjust that perception.<br>
Let us know any input via email or GitHub, and we’ll be glad to make updates.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://blog.cagedmonster.net/avoid-os-detection-openbsd/" rel="nofollow">Avoid OS Detection with OpenBSD</a></li>
<li><a href="https://www.trueos.org/blog/update-fix-updating/" rel="nofollow">TrueOS update to fix updating</a></li>
<li><a href="https://www.youtube.com/watch?v=I08__ZWaJ0w" rel="nofollow">MidnightBSD 0.8.5 VirtualBox Install</a></li>
<li><a href="http://calagator.org/events/tag/BSD" rel="nofollow">BSD Pizza Night in Portland</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>Andrew - <a href="http://dpaste.com/08E90PX" rel="nofollow">BSDCan videos?</a></li>
<li>Marc - <a href="http://dpaste.com/08KE40G" rel="nofollow">The Rock64 Board</a></li>
<li>Jason - <a href="http://dpaste.com/2EP7BFC" rel="nofollow">Follow up on UEFI and Bhyve</a></li>
<li>Patrick - <a href="http://dpaste.com/34Z9SFM" rel="nofollow">EFI booting</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>204: WWF - Wayland, Weston, and FreeBSD</title>
  <link>https://www.bsdnow.tv/204</link>
  <guid isPermaLink="false">4e71ddba-a23a-4036-a89e-ce7d0efe1940</guid>
  <pubDate>Wed, 26 Jul 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4e71ddba-a23a-4036-a89e-ce7d0efe1940.mp3" length="58443124" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In this episode, we clear up the myth about scrub of death, look at Wayland and Weston on FreeBSD, Intel QuickAssist is here, and we check out OpenSMTP on OpenBSD.</itunes:subtitle>
  <itunes:duration>1:21:10</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In this episode, we clear up the myth about scrub of death, look at Wayland and Weston on FreeBSD, Intel QuickAssist is here, and we check out OpenSMTP on OpenBSD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Matt Ahrens answers questions about the “Scrub of Death”
In working on the breakdown of that ZFS article last week, Matt Ahrens contacted me and provided some answers he has given to questions in the past, allowing me to answer them using HIS exact words.
“ZFS has an operation, called SCRUB, that is used to check all data in the pool and recover any data that is incorrect. However, if a bug which make errors on the pool persist (for example, a system with bad non-ecc RAM) then SCRUB can cause damage to a pool instead of recover it. I heard it called the “SCRUB of death” somewhere. Therefore, as far as I understand, using SCRUB without ECC memory is dangerous.”
&amp;gt; I don't believe that is accurate.  What is the proposed mechanism by which scrub can corrupt a lot of data, with non-ECC memory?
&amp;gt; ZFS repairs bad data by writing known good data to the bad location on disk.  The checksum of the data has to verify correctly for it to be considered "good".  An undetected memory error could change the in-memory checksum or data, causing ZFS to incorrectly think that the data on disk doesn’t match the checksum.  In that case, ZFS would attempt to repair the data by first re-reading the same offset on disk, and then reading from any other available copies of the data (e.g. mirrors, ditto blocks, or RAIDZ reconstruction).  If any of these attempts results in data that matches the checksum, then the data will be written on top of the (supposed) bad data.  If the data was actually good, then overwriting it with the same good data doesn’t hurt anything.
&amp;gt; Let's look at what will happen with 3 types of errors with non-ECC memory:
&amp;gt; 1. Rare, random errors (e.g. particle strikes - say, less than one error per GB per second). If ZFS finds data that matches the checksum, then we know that we have the correct data (at least at that point in time, with probability 1-1/2^256).  If there are a lot of memory errors happening at a high rate, or if the in-memory checksum was corrupt, then ZFS won’t be able to find a good copy of the data , so it won’t do a repair write.  It’s possible that the correctly-checksummed data is later corrupted in memory, before the repair write.  However, the window of vulnerability is very very small - on the order of milliseconds between when the checksum is verified, and when the write to disk completes.  It is implausible that this tiny window of memory vulnerability would be hit repeatedly.
&amp;gt; 2. Memory that pretty much never does the right thing. (e.g. huge rate of particle strikes, all memory always reads 0, etc). In this case, critical parts of kernel memory (e.g. instructions) will be immediately corrupted, causing the system to panic and not be able to boot again.
&amp;gt; 3. One or a few memory locations have "stuck bits", which always read 0 (or always read 1). This is the scenario discussed in the message which (I believe) originally started the "Scrub of Death" myth: https://forums.freenas.org/index.php?threads/ecc-vs-non-ecc-ram-and-zfs.15449/  This assumes that we read in some data from disk to a memory location with a stuck bit, "correct" that same bad memory location by overwriting the memory with the correct data, and then we write the bad memory location to disk.  However, ZFS doesn't do that.  (It seems the author thinks that ZFS uses parity, which it only does when using RAID-Z.  Even with RAID-Z, we also verify the checksum, and we don't overwrite the bad memory location.)
&amp;gt; Here's what ZFS will actually do in this scenario: If ZFS reads data from disk into a memory location with a stuck bit, it will detect a checksum mismatch and try to find a good copy of the data to repair the "bad" disk. ZFS will allocate a new, different memory location to read a 2nd copy of the data, e.g. from the other side of a mirror (this happens near the end of dslscanscrub_cb()).  If the new memory location also has a stuck bit, then its checksum will also fail, so we won't use it to repair the "bad" disk.  If the checksum of the 2nd copy of the data is correct, then we will write it to the "bad" disk.  This write is unnecessary, because the "bad" disk is not really bad, but it is overwriting the good data with the same good data.
&amp;gt; I believe that this misunderstanding stems from the idea that ZFS fixes bad data by overwriting it in place with good data.  In reality, ZFS overwrites the location on disk, using a different memory location for each read from disk.  The "Scrub of Death" myth assumes that ZFS overwrites the location in memory, which it doesn't do.
&amp;gt; In summary, there's no plausible scenario where ZFS would amplify a small number of memory errors, causing a "scrub of death".  Additionally, compared to other filesystems, ZFS checksums provide some additional protection against bad memory.
 “Is it true that ZFS verifies the checksum of every block on every read from disk?”
&amp;gt; Yes
“And if that block is incorrect, that ZFS will repair it?”
&amp;gt; Yes
“If yes, is it possible set options or flag for change that behavior? For example, I would like for ZFS to verify checksums during any read, but not change anything and only report about issues if it appears. Is it possible?”
&amp;gt; There isn't any built-in flag for doing that.  It wouldn't be hard to add one though.
If you just wanted to verify data, without attempting to correct it, you could read or scan the data with the pool was imported read-only
“If using a mirror, when a file is read, is it fully read and verified from both sides of the mirror?”
&amp;gt; No, for performance purposes, each block is read from only one side of the mirror (assuming there is no checksum error).
“What is the difference between a scrub and copying every file to /dev/null?”
&amp;gt; That won't check all copies of the file (e.g. it won't check both sides of the mirror).
***
Wayland, and Weston, and FreeBSD - Oh My! (https://euroquis.nl/bobulate/?p=1617)
KDE’s CI system for FreeBSD (that is, what upstream runs to continuously test KDE git code on the FreeBSD platform) is missing some bits and failing some tests because of Wayland. Or rather, because FreeBSD now has Wayland, but not Qt5-Wayland, and no Weston either (the reference implementation of a Wayland compositor).
Today I went hunting for the bits and pieces needed to make that happen. Fortunately, all the heavy lifting has already been done: there is a Weston port prepared and there was a Qt5-Wayland port well-hidden in the Area51 plasma5/ branch.
I have taken the liberty of pulling them into the Area51 repository as branch qtwayland. That way we can nudge Weston forward, and/or push Qt5-Wayland in separately. Nicest from a testing perspective is probably doing both at the same time.
I picked a random “Hello World” Wayland tutorial and also built a minimal Qt program (using QMessageBox::question, my favorite function to hate right now, because of its i18n characteristics). Then, setting XDGRUNTIMEDIR to /tmp/xdg, I could start Weston (as an X11 client), wayland-hello (as a Wayland client, displaying in Weston) and qt-hello (as either an X11 client, or as a Wayland client).
So this gives users of Area51 (while shuffling branches, granted) a modern desktop and modern display capabilities. Oh my!
It will take a few days for this to trickle up and/or down so that the CI can benefit and we can make sure that KWin’s tests all work on FreeBSD, but it’s another good step towards tight CI and another small step towards KDE Plasma 5 on the desktop on FreeBSD.
pkgsrcCon 2017 report (https://blog.netbsd.org/tnf/entry/pkgsrccon_2017_report)
This years pkgsrcCon returned to London once again. It was last held in London back in 2014. The 2014 con was the first pkgsrcCon I attended, I had been working on Darwin/PowerPC fixes for some months and presented on the progress I'd made with a 12" G4 PowerBook. I took away a G4 Mac Mini that day to help spare the PowerBook for use and dedicate a machine for build and testing. The offer of PowerPC hardware donations was repeated at this years con, thanks to jperkin@ who showed up with a backpack full of Mac Minis (more on that later).
Since 2014 we have held cons in Berlin (2015) &amp;amp; Krakow (2016). In Krakow we had talks about a wide range of projects over 2 days, from Haiku Ports to Common Lisp to midipix (building native PE binaries for Windows) and back to the BSDs. I was very pleased to continue the theme of a diverse program this year.
Aside from pkgsrc and NetBSD, we had talks about FreeBSD, OpenBSD, Slackware Linux, and Plan 9. Things began with a pub gathering on the Friday for the pre-con social, we hung out and chatted till almost midnight on a wide range of topics, such as supporting a system using NFS on MS-DOS, the origins of pdksh, corporate IT, culture and many other topics.
On parting I was asked about the starting time on Saturday as there was some conflicting information. I learnt that the registration email had stated a later start than I had scheduled for &amp;amp; advertised on the website, by 30 minutes. Lesson learnt: register for your own event! Not a problem, I still needed to setup a webpage for the live video stream, I could do both when I got back. With some trimming here and there I had a new schedule, I posted that to the pkgsrcCon website and moved to trying to setup a basic web page which contained a snippet of javascript to play a live video stream from Scale Engine.  2+ hours later, it was pointed out that the XSS protection headers on pkgsrc.org breaks the functionality. Thanks to jmcneill@ for debugging and providing a working page.
Saturday started off with Giovanni Bechis speaking about pledge in OpenBSD and adding support to various packages in their ports tree, alnsn@ then spoke about installing packages from a repo hosted on the Tor network.
After a quick coffee break we were back to hear Charles Forsyth speak about how Plan 9 and Inferno dealt with portability, building software and the problem which are avoided by the environment there. This was followed by a very energetic rant by David Spencer from the Slackbuilds project on packaging 3rd party software. Slackbuilds is a packaging system for Slackware Linux, which was inspired by FreeBSD ports.
For the first slot after lunch, agc@ gave a talk on the early history of pkgsrc followed by Thomas Merkel on using vagrant to test pkgsrc changes with ease, locally, using vagrant. khorben@ covered his work on adding security to pkgsrc and bsiegert@ covered the benefits of performing our bulk builds in the cloud and the challenges we currently face.
My talk was about some topics and ideas which had inspired me or caught my attention, and how it could maybe apply to my work.The title of the talk was taken from the name of Andrew Weatherall's Saint Etienne remix, possibly referring to two different styles of track (dub &amp;amp; vocal) merged into one or something else. I meant it in terms of applicability of thoughts and ideas. After me, agc@ gave a second talk on the evolution of the Netflix Open Connect appliance which runs FreeBSD and Vsevolod Stakhov wrapped up the day with a talk about the technical implementation details of the successor to pkgtools in FreeBSD, called pkg, and how it could be of benefit for pkgsrc.
For day 2 we gathered for a hack day at the London Hack Space.
I had burn't some some CD of the most recent macppc builds of NetBSD 8.0BETA and -current to install and upgrade Mac Minis. I setup the donated G4 minis for everyone in a dual-boot configuration and moved on to taking apart my MacBook Air to inspect the wifi adapter as I wanted to replace it with something which works on FreeBSD. It was not clear from the ifixit teardown photos of cards size, it seemed like a normal mini-PCIe card but it turned out to be far smaller. Thomas had also had the same card in his and we are not alone. Thomas has started putting together a driver for the Broadcom card, the project is still in its early days and lacks support for encrypted networks but hopefully it will appear on review.freebsd.org in the future.
weidi@ worked on fixing SunOS bugs in various packages and later in the night we setup a NetBSD/macppc bulk build environment together on his Mac Mini.
Thomas setup an OpenGrock instance to index the source code of all the software available for packaging in pkgsrc. This helps make the evaluation of changes easier and the scope of impact a little quicker without having to run through a potentially lengthy bulk build with a change in mind to realise the impact. bsiegert@ cleared his ticket and email backlog for pkgsrc and alnsn@ got NetBSD/evbmips64-eb booting on his EdgeRouter Lite.
On Monday we reconvened at the Hack Space again and worked some more. I started putting together the talks page with the details from Saturday and the the slides which I had received, in preparation for the videos which would come later in the week. By 3pm pkgsrcCon was over. I was pretty exhausted but really pleased to have had a few days of techie fun.
Many thanks to The NetBSD Foundation for purchasing a camera to use for streaming the event and a speedy response all round by the board. The Open Source Specialist Group at BCS, The Chartered Institute for IT and the London Hack Space for hosting us. Scale Engine for providing streaming facility. weidi@ for hosting the recorded videos. Allan Jude for pointers, Jared McNeill for debugging, NYCBUG and Patrick McEvoy for tips on streaming, the attendees and speakers. This year we had speakers from USA, Italy, Germany and London E2. Looking forward to pkgsrcCon 2018!
The videos and slides are available here (http://www.pkgsrc.org/pkgsrcCon/2017/talks.html) and the Internet Archive (http://archive.org/details/pkgsrcCon-2017).
News Roundup
QuickAssist Driver for FreeBSD is here and pfSense Support Coming (https://www.servethehome.com/quickassist-driver-freebsd-pfsupport-coming/)
This week we have something that STH readers will be excited about. Before I started writing for STH, I was a reader and had been longing for QuickAssist support ever since STH’s first Rangeley article over three and a half years ago. It was clear from the get-go that Rangeley was going to be the preeminent firewall appliance platform of its day. The scope of products that were impacted by the Intel Atom C2000 series bug showed us it was indeed. For my personal firewalls, I use pfSense on that Rangeley platform so I have been waiting to use QuickAssist with my hardware for almost an entire product generation.
+ New Hardware and QuickAssist Incoming to pfSense (Finally)
pfSense (and a few other firewalls) are based on FreeBSD. FreeBSD tends to lag driver support behind mainstream Linux but it is popular for embedded security appliances. While STH is the only site to have done QuickAssist benchmarks for OpenSSL and IPSec VPNs pre-Skylake, we expect more platforms to use it now that the new Intel Xeon Scalable Processor Family is out. With the Xeon Scalable platforms, the “Lewisburg” PCH has QuickAssist options of up to 100Gbps, or 2.5x faster than the previous generation add-in cards we tested (40Gbps.) We now have more and better hardware for QAT, but we were still devoid of a viable FreeBSD QAT driver from Intel. That has changed.
Our Intel Xeon Scalable Processor Family (Skylake-SP) Launch Coverage Central has been the focus of the STH team’s attention this week. There was another important update from Intel that got buried, a publicly available Intel QuickAssist driver for FreeBSD. You can find the driver on 01.org here dated July 12, 2017.
Drivers are great, but we still need support to be enabled in the OS and at the application layer. Patrick forwarded me this tweet from Jim Thompson (lead at Netgate the company behind pfSense):
The Netgate team has been a key company pushing QuickAssist appliances in the market, usually based on Linux. To see that QAT is coming to FreeBSD and that they were working to integrate into “pfSense soon” is more than welcome.
For STH readers, get ready. It appears to be actually and finally happening. QuickAssist on FreeBSD and pfSense
OpenBSD on the Huawei MateBook X (https://jcs.org/2017/07/14/matebook)
The Huawei MateBook X is a high-quality 13" ultra-thin laptop with a fanless Core i5 processor. It is obviously biting the design of the Apple 12" MacBook, but it does have some notable improvements such as a slightly larger screen, a more usable keyboard with adequate key travel, and 2 USB-C ports.
It also uses more standard PC components than the MacBook, such as a PS/2-connected keyboard, removable m.2 WiFi card, etc., so its OpenBSD compatibility is quite good.
In contrast to the Xiaomi Mi Air, the MateBook is actually sold (2) in the US and comes with a full warranty and much higher build quality (though at twice the price). It is offered in the US in a "space gray" color for the Core i5 model and a gold color for the Core i7.
The fanless Core i5 processor feels snappy and doesn't get warm during normal usage on OpenBSD. Doing a make -j4 build at full CPU speed does cause the laptop to get warm, though the palmrest maintains a usable temperature.
The chassis is all aluminum and has excellent rigidity in the keyboard area. The 13.0" 2160x1440 glossy IPS "Gorilla glass" screen has a very small bezel and its hinge is properly weighted to allow opening the lid with one hand. There is no wobble in the screen when open, even when jostling the desk that the laptop sits on. It has a reported brightness of 350 nits.
I did not experience any of the UEFI boot variable problems that I did with the Xiaomi, and the MateBook booted quickly into OpenBSD after re-initializing the GPT table during installation.
OpenSMTPD under OpenBSD with SSL/VirtualUsers/Dovecot (https://blog.cagedmonster.net/opensmtpd-under-openbsd-with-ssl-virtualusers-dovecot/)
During the 2013 AsiaBSDCon, the team of OpenBSD presented its mail solution named OpenSMTPD. 
Developed by the OpenBSD team, we find the so much appreciated philosophy of its developers : security, simplicity / clarity and advanced features.
Basic configuration : OpenSMTPD is installed by default, we can immediately start with a simple configuration.
&amp;gt; We listen on our interfaces, we specify the path of our aliases file so we can manage redirections. 
&amp;gt; Mails will be delivered for the domain cagedmonster.net to mbox (the local users mailbox), same for the aliases. 
&amp;gt; Finally, we accept to relay local mails exclusively.
&amp;gt; We can now enable smtpd at system startup and start the daemon.
Advanced configuration including TLS :
You can use SSL with : A self-signed certificate (which will not be trusted) or a certificate generated by a trusted authority. LetsEncrypt uses Certbot to generated your certificate. You can check this page for further informations. Let's focus on the first.
Generation of the certificate :
We fix the permissions :
We edit the config file :
&amp;gt; We have a mail server with SSL, it's time to configure our IMAP server, Dovecot, and manage the creation of virtual users.
Dovecot setup, and creation of Virtual Users : We will use the package system of OpenBSD, so please check the configuration of your /etc/pkg.conf file.
Enable the service at system startup :
Setup the Virtual Users structure :
Adding the passwd table for smtpd :
Modification of the OpenSMTPD configuration :
We declare the files used for our Virtual Accounts, we include SSL, and we configure mails delivery via the Dovecot lmtp socket.
We'll create our user lina@cagedmonster.net and set its password.
Configure SSL
Configure dovecot.conf
Configure mail.con
Configure login.conf : Make sure that the value of openfiles-cur in /etc/login.conf is equal or superior of 1000 !
Starting Dovecot
***
OpenSMTPD and Dovecot under OpenBSD with MySQL support and SPAMD (https://blog.cagedmonster.net/opensmtpd-and-dovecot-under-openbsd-with-mysql-support-and-spamd/)
This article is the continuation of my previous tutorial OpenSMTPD under OpenBSD with SSL/VirtualUsers/Dovecot. We'll use the same configuration and add some features so we can :
Use our domains, aliases, virtual users with a MySQL database (MariaDB under OpenBSD).
Deploy SPAMD with OpenSMTPD for a strong antispam solution.
+ Setup of the MySQL support for OpenSMTPD &amp;amp; Dovecot
+ We create our SQL database named « smtpd » 
+ We create our SQL user « opensmtpd » we give him the privileges on our SQL database and we set its password 
+ We create the structure of our SQL database
+ We generate our password with Blowfish (remember it's OpenBSD !) for our users
+ We create our tables and we include our datas
+ We push everything to our database
+ Time to configure OpenSMTPD
+ We create our mysql.conf file and configure it 
+ Configuration of Dovecot.conf
+ Configuration of auth-sql.conf.ext
+ Configuration of dovecot-sql.conf.ext
+ Restart our services
OpenSMTPD &amp;amp; SPAMD :
SPAMD is a service simulating a fake SMTP server and relying on strict compliance with RFC to determine whether the server delivering a mail is a spammer or not. 
+ Configuration of SPAMD :
+ Enable SPAMD &amp;amp; SPAMLOGD at system startup :
+ Configuration of SPAMD flags 
+ Configuration of PacketFilter
+ Configuration of SPAMD 
+ Start SPAMD &amp;amp; SPAMLOGD 
Running a TOR relay on FreeBSD (https://networkingbsdblog.wordpress.com/2017/07/14/freebsd-tor-relay-using-priveledge-seperation/)
There are 2 main steps to getting a TOR relay working on FreeBSD:
Installing and configuring Tor
Using an edge router to do port translation
In my case I wanted TOR to run it’s services on ports 80 and 443 but any port under 1024 requires root access in UNIX systems.
+So I used port mapping on my router to map the ports.
+Begin by installing TOR and ARM from:

/usr/ports/security/tor/
/usr/ports/security/arm/

Arm is the Anonymizing Relay Monitor: https://www.torproject.org/projects/arm.html.en
It provides useful monitoring graph and can be used to configure the torrc file.
Next step edit the torrc file (see Blog article for the edit)
It is handy to add the following lines to /etc/services so you can more easily modify your pf configuration.

torproxy 9050/tcp #torsocks
torOR 9090/tcp #torOR
torDIR 9099/tcp #torDIR

To allow TOR services my pf.conf has the following lines:

# interfaces
lan_if=”re0″
wifi_if=”wlan0″
interfaces=”{wlan0,re0}”
tcp_services = “{   ssh torproxy torOR torDIR  }”
# options
set block-policy drop
set loginterface $lan_if
# pass on lo
set skip on lo
scrub in on $lan_if all fragment reassemble
# NAT
nat on $lan_if from $wifi_if:network to !($lan_if) -&amp;gt; ($lan_if)
block all
antispoof for $interfaces
#In NAT
pass in log on $wifi_if inet
pass out all keep state
#ICMP
pass out log inet proto icmp from any to any keep state
pass in log quick inet proto icmp from any to any keep state
#SSH
pass in inet proto tcp to $lan_if port ssh
pass in inet proto tcp to $wifi_if port ssh
#TCP Services on Server
pass in inet proto tcp to $interfaces port $tcp_services keep state

The finally part is mapping the ports as follows:

TOR directory port: LANIP:9099 —&amp;gt; WANIP:80
TOR router port: LANIP:9090 —-&amp;gt; WANIP:443

Now enable TOR:
$ sudo echo “tor_enable=YES” &amp;gt;&amp;gt; /etc/rc.conf
Start TOR:
$ sudo service tor start
***
Beastie Bits
OpenBSD as a “Desktop” (Laptop) (http://unixseclab.com/index.php/2017/06/12/openbsd-as-a-desktop-laptop/)
Sascha Wildner has updated ACPICA in DragonFly to Intel’s version 20170629 (http://lists.dragonflybsd.org/pipermail/commits/2017-July/625997.html)
Dport, Rust, and updates for DragonFlyBSD (https://www.dragonflydigest.com/2017/07/18/19991.html)
OPNsense 17.7 RC1 released (https://opnsense.org/opnsense-17-7-rc1/)
Unix’s mysterious &amp;amp;&amp;amp; and || (http://www.networkworld.com/article/3205148/linux/unix-s-mysterious-andand-and.html#tk.rss_unixasasecondlanguage)
The Commute Deck : A Homebrew Unix terminal for tight places (http://boingboing.net/2017/06/16/cyberspace-is-everting.html)
FreeBSD 11.1-RC3 now available (https://lists.freebsd.org/pipermail/freebsd-stable/2017-July/087407.html)
Installing DragonFlyBSD with ORCA when you’re totally blind (http://lists.dragonflybsd.org/pipermail/users/2017-July/313528.html)
Who says FreeBSD can’t look good (http://imgur.com/gallery/dc1pu)
Pratik Vyas adds the ability to do paused VM migrations for VMM (http://undeadly.org/cgi?action=article&amp;amp;sid=20170716160129)
Feedback/Questions
Hrvoje - OpenBSD MP Networking (http://dpaste.com/0EXV173#wrap)
Goran - debuggers (http://dpaste.com/1N853NG#wrap)
Abhinav - man-k (http://dpaste.com/1JXQY5E#wrap)
Liam - university setup (http://dpaste.com/01ERMEQ#wrap)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In this episode, we clear up the myth about scrub of death, look at Wayland and Weston on FreeBSD, Intel QuickAssist is here, and we check out OpenSMTP on OpenBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>Matt Ahrens answers questions about the “Scrub of Death”</h3>

<ul>
<li>In working on the breakdown of that ZFS article last week, Matt Ahrens contacted me and provided some answers he has given to questions in the past, allowing me to answer them using HIS exact words.</li>
<li>“ZFS has an operation, called SCRUB, that is used to check all data in the pool and recover any data that is incorrect. However, if a bug which make errors on the pool persist (for example, a system with bad non-ecc RAM) then SCRUB can cause damage to a pool instead of recover it. I heard it called the “SCRUB of death” somewhere. Therefore, as far as I understand, using SCRUB without ECC memory is dangerous.”
&gt; I don&#39;t believe that is accurate.  What is the proposed mechanism by which scrub can corrupt a lot of data, with non-ECC memory?
&gt; ZFS repairs bad data by writing known good data to the bad location on disk.  The checksum of the data has to verify correctly for it to be considered &quot;good&quot;.  An undetected memory error could change the in-memory checksum or data, causing ZFS to incorrectly think that the data on disk doesn’t match the checksum.  In that case, ZFS would attempt to repair the data by first re-reading the same offset on disk, and then reading from any other available copies of the data (e.g. mirrors, ditto blocks, or RAIDZ reconstruction).  If any of these attempts results in data that matches the checksum, then the data will be written on top of the (supposed) bad data.  If the data was actually good, then overwriting it with the same good data doesn’t hurt anything.
&gt; Let&#39;s look at what will happen with 3 types of errors with non-ECC memory:
&gt; 1. Rare, random errors (e.g. particle strikes - say, less than one error per GB per second). If ZFS finds data that matches the checksum, then we know that we have the correct data (at least at that point in time, with probability 1-1/2<sup>256).</sup>  If there are a lot of memory errors happening at a high rate, or if the in-memory checksum was corrupt, then ZFS won’t be able to find a good copy of the data , so it won’t do a repair write.  It’s possible that the correctly-checksummed data is later corrupted in memory, before the repair write.  However, the window of vulnerability is very very small - on the order of milliseconds between when the checksum is verified, and when the write to disk completes.  It is implausible that this tiny window of memory vulnerability would be hit repeatedly.
&gt; 2. Memory that pretty much never does the right thing. (e.g. huge rate of particle strikes, all memory always reads 0, etc). In this case, critical parts of kernel memory (e.g. instructions) will be immediately corrupted, causing the system to panic and not be able to boot again.
&gt; 3. One or a few memory locations have &quot;stuck bits&quot;, which always read 0 (or always read 1). This is the scenario discussed in the message which (I believe) originally started the &quot;Scrub of Death&quot; myth: <a href="https://forums.freenas.org/index.php?threads/ecc-vs-non-ecc-ram-and-zfs.15449/" rel="nofollow">https://forums.freenas.org/index.php?threads/ecc-vs-non-ecc-ram-and-zfs.15449/</a>  This assumes that we read in some data from disk to a memory location with a stuck bit, &quot;correct&quot; that same bad memory location by overwriting the memory with the correct data, and then we write the bad memory location to disk.  However, ZFS doesn&#39;t do that.  (It seems the author thinks that ZFS uses parity, which it only does when using RAID-Z.  Even with RAID-Z, we also verify the checksum, and we don&#39;t overwrite the bad memory location.)
&gt; Here&#39;s what ZFS will actually do in this scenario: If ZFS reads data from disk into a memory location with a stuck bit, it will detect a checksum mismatch and try to find a good copy of the data to repair the &quot;bad&quot; disk. ZFS will allocate a new, different memory location to read a 2nd copy of the data, e.g. from the other side of a mirror (this happens near the end of dsl_scan_scrub_cb()).  If the new memory location also has a stuck bit, then its checksum will also fail, so we won&#39;t use it to repair the &quot;bad&quot; disk.  If the checksum of the 2nd copy of the data is correct, then we will write it to the &quot;bad&quot; disk.  This write is unnecessary, because the &quot;bad&quot; disk is not really bad, but it is overwriting the good data with the same good data.
&gt; I believe that this misunderstanding stems from the idea that ZFS fixes bad data by overwriting it in place with good data.  In reality, ZFS overwrites the location on disk, using a different memory location for each read from disk.  The &quot;Scrub of Death&quot; myth assumes that ZFS overwrites the location <em>in memory</em>, which it doesn&#39;t do.
&gt; In summary, there&#39;s no plausible scenario where ZFS would amplify a small number of memory errors, causing a &quot;scrub of death&quot;.  Additionally, compared to other filesystems, ZFS checksums provide some additional protection against bad memory.</li>
<li> “Is it true that ZFS verifies the checksum of every block on every read from disk?”
&gt; Yes</li>
<li>“And if that block is incorrect, that ZFS will repair it?”
&gt; Yes</li>
<li>“If yes, is it possible set options or flag for change that behavior? For example, I would like for ZFS to verify checksums during any read, but not change anything and only report about issues if it appears. Is it possible?”
&gt; There isn&#39;t any built-in flag for doing that.  It wouldn&#39;t be hard to add one though.</li>
<li>If you just wanted to verify data, without attempting to correct it, you could read or scan the data with the pool was imported read-only</li>
<li>“If using a mirror, when a file is read, is it fully read and verified from both sides of the mirror?”
&gt; No, for performance purposes, each block is read from only one side of the mirror (assuming there is no checksum error).</li>
<li>“What is the difference between a scrub and copying every file to /dev/null?”
&gt; That won&#39;t check all copies of the file (e.g. it won&#39;t check both sides of the mirror).
***</li>
</ul>

<h3><a href="https://euroquis.nl/bobulate/?p=1617" rel="nofollow">Wayland, and Weston, and FreeBSD - Oh My!</a></h3>

<blockquote>
<p>KDE’s CI system for FreeBSD (that is, what upstream runs to continuously test KDE git code on the FreeBSD platform) is missing some bits and failing some tests because of Wayland. Or rather, because FreeBSD now has Wayland, but not Qt5-Wayland, and no Weston either (the reference implementation of a Wayland compositor).<br>
Today I went hunting for the bits and pieces needed to make that happen. Fortunately, all the heavy lifting has already been done: there is a Weston port prepared and there was a Qt5-Wayland port well-hidden in the Area51 plasma5/ branch.<br>
I have taken the liberty of pulling them into the Area51 repository as branch qtwayland. That way we can nudge Weston forward, and/or push Qt5-Wayland in separately. Nicest from a testing perspective is probably doing both at the same time.<br>
I picked a random “Hello World” Wayland tutorial and also built a minimal Qt program (using QMessageBox::question, my favorite function to hate right now, because of its i18n characteristics). Then, setting XDG_RUNTIME_DIR to /tmp/xdg, I could start Weston (as an X11 client), wayland-hello (as a Wayland client, displaying in Weston) and qt-hello (as either an X11 client, or as a Wayland client).<br>
So this gives users of Area51 (while shuffling branches, granted) a modern desktop and modern display capabilities. Oh my!<br>
It will take a few days for this to trickle up and/or down so that the CI can benefit and we can make sure that KWin’s tests all work on FreeBSD, but it’s another good step towards tight CI and another small step towards KDE Plasma 5 on the desktop on FreeBSD.</p>

<hr>
</blockquote>

<h3><a href="https://blog.netbsd.org/tnf/entry/pkgsrccon_2017_report" rel="nofollow">pkgsrcCon 2017 report</a></h3>

<blockquote>
<p>This years pkgsrcCon returned to London once again. It was last held in London back in 2014. The 2014 con was the first pkgsrcCon I attended, I had been working on Darwin/PowerPC fixes for some months and presented on the progress I&#39;d made with a 12&quot; G4 PowerBook. I took away a G4 Mac Mini that day to help spare the PowerBook for use and dedicate a machine for build and testing. The offer of PowerPC hardware donations was repeated at this years con, thanks to jperkin@ who showed up with a backpack full of Mac Minis (more on that later).<br>
Since 2014 we have held cons in Berlin (2015) &amp; Krakow (2016). In Krakow we had talks about a wide range of projects over 2 days, from Haiku Ports to Common Lisp to midipix (building native PE binaries for Windows) and back to the BSDs. I was very pleased to continue the theme of a diverse program this year.<br>
Aside from pkgsrc and NetBSD, we had talks about FreeBSD, OpenBSD, Slackware Linux, and Plan 9. Things began with a pub gathering on the Friday for the pre-con social, we hung out and chatted till almost midnight on a wide range of topics, such as supporting a system using NFS on MS-DOS, the origins of pdksh, corporate IT, culture and many other topics.<br>
On parting I was asked about the starting time on Saturday as there was some conflicting information. I learnt that the registration email had stated a later start than I had scheduled for &amp; advertised on the website, by 30 minutes. Lesson learnt: register for your own event! Not a problem, I still needed to setup a webpage for the live video stream, I could do both when I got back. With some trimming here and there I had a new schedule, I posted that to the pkgsrcCon website and moved to trying to setup a basic web page which contained a snippet of javascript to play a live video stream from Scale Engine.  2+ hours later, it was pointed out that the XSS protection headers on pkgsrc.org breaks the functionality. Thanks to jmcneill@ for debugging and providing a working page.<br>
Saturday started off with Giovanni Bechis speaking about pledge in OpenBSD and adding support to various packages in their ports tree, alnsn@ then spoke about installing packages from a repo hosted on the Tor network.<br>
After a quick coffee break we were back to hear Charles Forsyth speak about how Plan 9 and Inferno dealt with portability, building software and the problem which are avoided by the environment there. This was followed by a very energetic rant by David Spencer from the Slackbuilds project on packaging 3rd party software. Slackbuilds is a packaging system for Slackware Linux, which was inspired by FreeBSD ports.<br>
For the first slot after lunch, agc@ gave a talk on the early history of pkgsrc followed by Thomas Merkel on using vagrant to test pkgsrc changes with ease, locally, using vagrant. khorben@ covered his work on adding security to pkgsrc and bsiegert@ covered the benefits of performing our bulk builds in the cloud and the challenges we currently face.<br>
My talk was about some topics and ideas which had inspired me or caught my attention, and how it could maybe apply to my work.The title of the talk was taken from the name of Andrew Weatherall&#39;s Saint Etienne remix, possibly referring to two different styles of track (dub &amp; vocal) merged into one or something else. I meant it in terms of applicability of thoughts and ideas. After me, agc@ gave a second talk on the evolution of the Netflix Open Connect appliance which runs FreeBSD and Vsevolod Stakhov wrapped up the day with a talk about the technical implementation details of the successor to pkg_tools in FreeBSD, called pkg, and how it could be of benefit for pkgsrc.<br>
For day 2 we gathered for a hack day at the London Hack Space.<br>
I had burn&#39;t some some CD of the most recent macppc builds of NetBSD 8.0_BETA and -current to install and upgrade Mac Minis. I setup the donated G4 minis for everyone in a dual-boot configuration and moved on to taking apart my MacBook Air to inspect the wifi adapter as I wanted to replace it with something which works on FreeBSD. It was not clear from the ifixit teardown photos of cards size, it seemed like a normal mini-PCIe card but it turned out to be far smaller. Thomas had also had the same card in his and we are not alone. Thomas has started putting together a driver for the Broadcom card, the project is still in its early days and lacks support for encrypted networks but hopefully it will appear on review.freebsd.org in the future.<br>
weidi@ worked on fixing SunOS bugs in various packages and later in the night we setup a NetBSD/macppc bulk build environment together on his Mac Mini.<br>
Thomas setup an OpenGrock instance to index the source code of all the software available for packaging in pkgsrc. This helps make the evaluation of changes easier and the scope of impact a little quicker without having to run through a potentially lengthy bulk build with a change in mind to realise the impact. bsiegert@ cleared his ticket and email backlog for pkgsrc and alnsn@ got NetBSD/evbmips64-eb booting on his EdgeRouter Lite.<br>
On Monday we reconvened at the Hack Space again and worked some more. I started putting together the talks page with the details from Saturday and the the slides which I had received, in preparation for the videos which would come later in the week. By 3pm pkgsrcCon was over. I was pretty exhausted but really pleased to have had a few days of techie fun.<br>
Many thanks to The NetBSD Foundation for purchasing a camera to use for streaming the event and a speedy response all round by the board. The Open Source Specialist Group at BCS, The Chartered Institute for IT and the London Hack Space for hosting us. Scale Engine for providing streaming facility. weidi@ for hosting the recorded videos. Allan Jude for pointers, Jared McNeill for debugging, NYCBUG and Patrick McEvoy for tips on streaming, the attendees and speakers. This year we had speakers from USA, Italy, Germany and London E2. Looking forward to pkgsrcCon 2018!<br>
The videos and slides are available <a href="http://www.pkgsrc.org/pkgsrcCon/2017/talks.html" rel="nofollow">here</a> and the <a href="http://archive.org/details/pkgsrcCon-2017" rel="nofollow">Internet Archive</a>.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://www.servethehome.com/quickassist-driver-freebsd-pfsupport-coming/" rel="nofollow">QuickAssist Driver for FreeBSD is here and pfSense Support Coming</a></h3>

<blockquote>
<p>This week we have something that STH readers will be excited about. Before I started writing for STH, I was a reader and had been longing for QuickAssist support ever since STH’s first Rangeley article over three and a half years ago. It was clear from the get-go that Rangeley was going to be the preeminent firewall appliance platform of its day. The scope of products that were impacted by the Intel Atom C2000 series bug showed us it was indeed. For my personal firewalls, I use pfSense on that Rangeley platform so I have been waiting to use QuickAssist with my hardware for almost an entire product generation.</p>

<ul>
<li>New Hardware and QuickAssist Incoming to pfSense (Finally)
pfSense (and a few other firewalls) are based on FreeBSD. FreeBSD tends to lag driver support behind mainstream Linux but it is popular for embedded security appliances. While STH is the only site to have done QuickAssist benchmarks for OpenSSL and IPSec VPNs pre-Skylake, we expect more platforms to use it now that the new Intel Xeon Scalable Processor Family is out. With the Xeon Scalable platforms, the “Lewisburg” PCH has QuickAssist options of up to 100Gbps, or 2.5x faster than the previous generation add-in cards we tested (40Gbps.) We now have more and better hardware for QAT, but we were still devoid of a viable FreeBSD QAT driver from Intel. That has changed.
Our Intel Xeon Scalable Processor Family (Skylake-SP) Launch Coverage Central has been the focus of the STH team’s attention this week. There was another important update from Intel that got buried, a publicly available Intel QuickAssist driver for FreeBSD. You can find the driver on 01.org here dated July 12, 2017.
Drivers are great, but we still need support to be enabled in the OS and at the application layer. Patrick forwarded me this tweet from Jim Thompson (lead at Netgate the company behind pfSense):
The Netgate team has been a key company pushing QuickAssist appliances in the market, usually based on Linux. To see that QAT is coming to FreeBSD and that they were working to integrate into “pfSense soon” is more than welcome.
For STH readers, get ready. It appears to be actually and finally happening. QuickAssist on FreeBSD and pfSense
***</li>
</ul>
</blockquote>

<h3><a href="https://jcs.org/2017/07/14/matebook" rel="nofollow">OpenBSD on the Huawei MateBook X</a></h3>

<blockquote>
<p>The Huawei MateBook X is a high-quality 13&quot; ultra-thin laptop with a fanless Core i5 processor. It is obviously biting the design of the Apple 12&quot; MacBook, but it does have some notable improvements such as a slightly larger screen, a more usable keyboard with adequate key travel, and 2 USB-C ports.<br>
It also uses more standard PC components than the MacBook, such as a PS/2-connected keyboard, removable m.2 WiFi card, etc., so its OpenBSD compatibility is quite good.<br>
In contrast to the Xiaomi Mi Air, the MateBook is actually sold (2) in the US and comes with a full warranty and much higher build quality (though at twice the price). It is offered in the US in a &quot;space gray&quot; color for the Core i5 model and a gold color for the Core i7.<br>
The fanless Core i5 processor feels snappy and doesn&#39;t get warm during normal usage on OpenBSD. Doing a make -j4 build at full CPU speed does cause the laptop to get warm, though the palmrest maintains a usable temperature.<br>
The chassis is all aluminum and has excellent rigidity in the keyboard area. The 13.0&quot; 2160x1440 glossy IPS &quot;Gorilla glass&quot; screen has a very small bezel and its hinge is properly weighted to allow opening the lid with one hand. There is no wobble in the screen when open, even when jostling the desk that the laptop sits on. It has a reported brightness of 350 nits.<br>
I did not experience any of the UEFI boot variable problems that I did with the Xiaomi, and the MateBook booted quickly into OpenBSD after re-initializing the GPT table during installation.</p>

<hr>
</blockquote>

<h3><a href="https://blog.cagedmonster.net/opensmtpd-under-openbsd-with-ssl-virtualusers-dovecot/" rel="nofollow">OpenSMTPD under OpenBSD with SSL/VirtualUsers/Dovecot</a></h3>

<ul>
<li>During the 2013 AsiaBSDCon, the team of OpenBSD presented its mail solution named OpenSMTPD. </li>
<li>Developed by the OpenBSD team, we find the so much appreciated philosophy of its developers : security, simplicity / clarity and advanced features.</li>
<li>Basic configuration : OpenSMTPD is installed by default, we can immediately start with a simple configuration.
&gt; We listen on our interfaces, we specify the path of our aliases file so we can manage redirections. 
&gt; Mails will be delivered for the domain cagedmonster.net to mbox (the local users mailbox), same for the aliases. 
&gt; Finally, we accept to relay local mails exclusively.
&gt; We can now enable smtpd at system startup and start the daemon.</li>
<li>Advanced configuration including TLS :

<ul>
<li>You can use SSL with : A self-signed certificate (which will not be trusted) or a certificate generated by a trusted authority. LetsEncrypt uses Certbot to generated your certificate. You can check this page for further informations. Let&#39;s focus on the first.</li>
<li>Generation of the certificate :</li>
<li>We fix the permissions :</li>
<li>We edit the config file :
&gt; We have a mail server with SSL, it&#39;s time to configure our IMAP server, Dovecot, and manage the creation of virtual users.</li>
</ul></li>
<li>Dovecot setup, and creation of Virtual Users : We will use the package system of OpenBSD, so please check the configuration of your /etc/pkg.conf file.

<ul>
<li>Enable the service at system startup :</li>
<li>Setup the Virtual Users structure :</li>
<li>Adding the passwd table for smtpd :</li>
<li>Modification of the OpenSMTPD configuration :</li>
<li>We declare the files used for our Virtual Accounts, we include SSL, and we configure mails delivery via the Dovecot lmtp socket.</li>
<li>We&#39;ll create our user <a href="mailto:lina@cagedmonster.net" rel="nofollow">lina@cagedmonster.net</a> and set its password.</li>
<li>Configure SSL</li>
<li>Configure dovecot.conf</li>
<li>Configure mail.con</li>
<li>Configure login.conf : Make sure that the value of openfiles-cur in /etc/login.conf is equal or superior of 1000 !</li>
<li>Starting Dovecot
***</li>
</ul></li>
</ul>

<h3><a href="https://blog.cagedmonster.net/opensmtpd-and-dovecot-under-openbsd-with-mysql-support-and-spamd/" rel="nofollow">OpenSMTPD and Dovecot under OpenBSD with MySQL support and SPAMD</a></h3>

<blockquote>
<p>This article is the continuation of my previous tutorial OpenSMTPD under OpenBSD with SSL/VirtualUsers/Dovecot. We&#39;ll use the same configuration and add some features so we can :<br>
Use our domains, aliases, virtual users with a MySQL database (MariaDB under OpenBSD).<br>
Deploy SPAMD with OpenSMTPD for a strong antispam solution.</p>

<ul>
<li>Setup of the MySQL support for OpenSMTPD &amp; Dovecot</li>
<li>We create our SQL database named « smtpd » </li>
<li>We create our SQL user « opensmtpd » we give him the privileges on our SQL database and we set its password </li>
<li>We create the structure of our SQL database</li>
<li>We generate our password with Blowfish (remember it&#39;s OpenBSD !) for our users</li>
<li>We create our tables and we include our datas</li>
<li>We push everything to our database</li>
<li>Time to configure OpenSMTPD</li>
<li>We create our mysql.conf file and configure it </li>
<li>Configuration of Dovecot.conf</li>
<li>Configuration of auth-sql.conf.ext</li>
<li>Configuration of dovecot-sql.conf.ext</li>
<li>Restart our services
OpenSMTPD &amp; SPAMD :
SPAMD is a service simulating a fake SMTP server and relying on strict compliance with RFC to determine whether the server delivering a mail is a spammer or not. </li>
<li>Configuration of SPAMD :</li>
<li>Enable SPAMD &amp; SPAMLOGD at system startup :</li>
<li>Configuration of SPAMD flags </li>
<li>Configuration of PacketFilter</li>
<li>Configuration of SPAMD </li>
<li>Start SPAMD &amp; SPAMLOGD 
***
###<a href="https://networkingbsdblog.wordpress.com/2017/07/14/freebsd-tor-relay-using-priveledge-seperation/" rel="nofollow">Running a TOR relay on FreeBSD</a></li>
<li>There are 2 main steps to getting a TOR relay working on FreeBSD:

<ul>
<li>Installing and configuring Tor</li>
<li>Using an edge router to do port translation</li>
<li>In my case I wanted TOR to run it’s services on ports 80 and 443 but any port under 1024 requires root access in UNIX systems.
+So I used port mapping on my router to map the ports.
+Begin by installing TOR and ARM from:
<code>
/usr/ports/security/tor/
/usr/ports/security/arm/
</code></li>
</ul></li>
<li>Arm is the Anonymizing Relay Monitor: <a href="https://www.torproject.org/projects/arm.html.en" rel="nofollow">https://www.torproject.org/projects/arm.html.en</a></li>
<li>It provides useful monitoring graph and can be used to configure the torrc file.</li>
<li>Next step edit the torrc file (see Blog article for the edit)</li>
<li>It is handy to add the following lines to /etc/services so you can more easily modify your pf configuration.
<code>
torproxy 9050/tcp #torsocks
torOR 9090/tcp #torOR
torDIR 9099/tcp #torDIR
</code></li>
<li>To allow TOR services my pf.conf has the following lines:
<code>
# interfaces
lan_if=”re0″
wifi_if=”wlan0″
interfaces=”{wlan0,re0}”
tcp_services = “{   ssh torproxy torOR torDIR  }”
# options
set block-policy drop
set loginterface $lan_if
# pass on lo
set skip on lo
scrub in on $lan_if all fragment reassemble
# NAT
nat on $lan_if from $wifi_if:network to !($lan_if) -&gt; ($lan_if)
block all
antispoof for $interfaces
#In NAT
pass in log on $wifi_if inet
pass out all keep state
#ICMP
pass out log inet proto icmp from any to any keep state
pass in log quick inet proto icmp from any to any keep state
#SSH
pass in inet proto tcp to $lan_if port ssh
pass in inet proto tcp to $wifi_if port ssh
#TCP Services on Server
pass in inet proto tcp to $interfaces port $tcp_services keep state
</code></li>
<li>The finally part is mapping the ports as follows:
<code>
TOR directory port: LANIP:9099 —&gt; WANIP:80
TOR router port: LANIP:9090 —-&gt; WANIP:443
</code></li>
<li>Now enable TOR:
<code>$ sudo echo “tor_enable=YES” &gt;&gt; /etc/rc.conf</code></li>
<li>Start TOR:
<code>$ sudo service tor start</code>
***</li>
</ul>
</blockquote>

<h2>Beastie Bits</h2>

<p><a href="http://unixseclab.com/index.php/2017/06/12/openbsd-as-a-desktop-laptop/" rel="nofollow">OpenBSD as a “Desktop” (Laptop)</a><br>
<a href="http://lists.dragonflybsd.org/pipermail/commits/2017-July/625997.html" rel="nofollow">Sascha Wildner has updated ACPICA in DragonFly to Intel’s version 20170629</a><br>
<a href="https://www.dragonflydigest.com/2017/07/18/19991.html" rel="nofollow">Dport, Rust, and updates for DragonFlyBSD</a><br>
<a href="https://opnsense.org/opnsense-17-7-rc1/" rel="nofollow">OPNsense 17.7 RC1 released</a><br>
<a href="http://www.networkworld.com/article/3205148/linux/unix-s-mysterious-andand-and.html#tk.rss_unixasasecondlanguage" rel="nofollow">Unix’s mysterious &amp;&amp; and ||</a><br>
<a href="http://boingboing.net/2017/06/16/cyberspace-is-everting.html" rel="nofollow">The Commute Deck : A Homebrew Unix terminal for tight places</a><br>
<a href="https://lists.freebsd.org/pipermail/freebsd-stable/2017-July/087407.html" rel="nofollow">FreeBSD 11.1-RC3 now available</a><br>
<a href="http://lists.dragonflybsd.org/pipermail/users/2017-July/313528.html" rel="nofollow">Installing DragonFlyBSD with ORCA when you’re totally blind</a><br>
<a href="http://imgur.com/gallery/dc1pu" rel="nofollow">Who says FreeBSD can’t look good</a><br>
<a href="http://undeadly.org/cgi?action=article&sid=20170716160129" rel="nofollow">Pratik Vyas adds the ability to do paused VM migrations for VMM</a></p>

<hr>

<h2>Feedback/Questions</h2>

<p><a href="http://dpaste.com/0EXV173#wrap" rel="nofollow">Hrvoje - OpenBSD MP Networking</a><br>
<a href="http://dpaste.com/1N853NG#wrap" rel="nofollow">Goran - debuggers</a><br>
<a href="http://dpaste.com/1JXQY5E#wrap" rel="nofollow">Abhinav - man-k</a><br>
<a href="http://dpaste.com/01ERMEQ#wrap" rel="nofollow">Liam - university setup</a></p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In this episode, we clear up the myth about scrub of death, look at Wayland and Weston on FreeBSD, Intel QuickAssist is here, and we check out OpenSMTP on OpenBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>Matt Ahrens answers questions about the “Scrub of Death”</h3>

<ul>
<li>In working on the breakdown of that ZFS article last week, Matt Ahrens contacted me and provided some answers he has given to questions in the past, allowing me to answer them using HIS exact words.</li>
<li>“ZFS has an operation, called SCRUB, that is used to check all data in the pool and recover any data that is incorrect. However, if a bug which make errors on the pool persist (for example, a system with bad non-ecc RAM) then SCRUB can cause damage to a pool instead of recover it. I heard it called the “SCRUB of death” somewhere. Therefore, as far as I understand, using SCRUB without ECC memory is dangerous.”
&gt; I don&#39;t believe that is accurate.  What is the proposed mechanism by which scrub can corrupt a lot of data, with non-ECC memory?
&gt; ZFS repairs bad data by writing known good data to the bad location on disk.  The checksum of the data has to verify correctly for it to be considered &quot;good&quot;.  An undetected memory error could change the in-memory checksum or data, causing ZFS to incorrectly think that the data on disk doesn’t match the checksum.  In that case, ZFS would attempt to repair the data by first re-reading the same offset on disk, and then reading from any other available copies of the data (e.g. mirrors, ditto blocks, or RAIDZ reconstruction).  If any of these attempts results in data that matches the checksum, then the data will be written on top of the (supposed) bad data.  If the data was actually good, then overwriting it with the same good data doesn’t hurt anything.
&gt; Let&#39;s look at what will happen with 3 types of errors with non-ECC memory:
&gt; 1. Rare, random errors (e.g. particle strikes - say, less than one error per GB per second). If ZFS finds data that matches the checksum, then we know that we have the correct data (at least at that point in time, with probability 1-1/2<sup>256).</sup>  If there are a lot of memory errors happening at a high rate, or if the in-memory checksum was corrupt, then ZFS won’t be able to find a good copy of the data , so it won’t do a repair write.  It’s possible that the correctly-checksummed data is later corrupted in memory, before the repair write.  However, the window of vulnerability is very very small - on the order of milliseconds between when the checksum is verified, and when the write to disk completes.  It is implausible that this tiny window of memory vulnerability would be hit repeatedly.
&gt; 2. Memory that pretty much never does the right thing. (e.g. huge rate of particle strikes, all memory always reads 0, etc). In this case, critical parts of kernel memory (e.g. instructions) will be immediately corrupted, causing the system to panic and not be able to boot again.
&gt; 3. One or a few memory locations have &quot;stuck bits&quot;, which always read 0 (or always read 1). This is the scenario discussed in the message which (I believe) originally started the &quot;Scrub of Death&quot; myth: <a href="https://forums.freenas.org/index.php?threads/ecc-vs-non-ecc-ram-and-zfs.15449/" rel="nofollow">https://forums.freenas.org/index.php?threads/ecc-vs-non-ecc-ram-and-zfs.15449/</a>  This assumes that we read in some data from disk to a memory location with a stuck bit, &quot;correct&quot; that same bad memory location by overwriting the memory with the correct data, and then we write the bad memory location to disk.  However, ZFS doesn&#39;t do that.  (It seems the author thinks that ZFS uses parity, which it only does when using RAID-Z.  Even with RAID-Z, we also verify the checksum, and we don&#39;t overwrite the bad memory location.)
&gt; Here&#39;s what ZFS will actually do in this scenario: If ZFS reads data from disk into a memory location with a stuck bit, it will detect a checksum mismatch and try to find a good copy of the data to repair the &quot;bad&quot; disk. ZFS will allocate a new, different memory location to read a 2nd copy of the data, e.g. from the other side of a mirror (this happens near the end of dsl_scan_scrub_cb()).  If the new memory location also has a stuck bit, then its checksum will also fail, so we won&#39;t use it to repair the &quot;bad&quot; disk.  If the checksum of the 2nd copy of the data is correct, then we will write it to the &quot;bad&quot; disk.  This write is unnecessary, because the &quot;bad&quot; disk is not really bad, but it is overwriting the good data with the same good data.
&gt; I believe that this misunderstanding stems from the idea that ZFS fixes bad data by overwriting it in place with good data.  In reality, ZFS overwrites the location on disk, using a different memory location for each read from disk.  The &quot;Scrub of Death&quot; myth assumes that ZFS overwrites the location <em>in memory</em>, which it doesn&#39;t do.
&gt; In summary, there&#39;s no plausible scenario where ZFS would amplify a small number of memory errors, causing a &quot;scrub of death&quot;.  Additionally, compared to other filesystems, ZFS checksums provide some additional protection against bad memory.</li>
<li> “Is it true that ZFS verifies the checksum of every block on every read from disk?”
&gt; Yes</li>
<li>“And if that block is incorrect, that ZFS will repair it?”
&gt; Yes</li>
<li>“If yes, is it possible set options or flag for change that behavior? For example, I would like for ZFS to verify checksums during any read, but not change anything and only report about issues if it appears. Is it possible?”
&gt; There isn&#39;t any built-in flag for doing that.  It wouldn&#39;t be hard to add one though.</li>
<li>If you just wanted to verify data, without attempting to correct it, you could read or scan the data with the pool was imported read-only</li>
<li>“If using a mirror, when a file is read, is it fully read and verified from both sides of the mirror?”
&gt; No, for performance purposes, each block is read from only one side of the mirror (assuming there is no checksum error).</li>
<li>“What is the difference between a scrub and copying every file to /dev/null?”
&gt; That won&#39;t check all copies of the file (e.g. it won&#39;t check both sides of the mirror).
***</li>
</ul>

<h3><a href="https://euroquis.nl/bobulate/?p=1617" rel="nofollow">Wayland, and Weston, and FreeBSD - Oh My!</a></h3>

<blockquote>
<p>KDE’s CI system for FreeBSD (that is, what upstream runs to continuously test KDE git code on the FreeBSD platform) is missing some bits and failing some tests because of Wayland. Or rather, because FreeBSD now has Wayland, but not Qt5-Wayland, and no Weston either (the reference implementation of a Wayland compositor).<br>
Today I went hunting for the bits and pieces needed to make that happen. Fortunately, all the heavy lifting has already been done: there is a Weston port prepared and there was a Qt5-Wayland port well-hidden in the Area51 plasma5/ branch.<br>
I have taken the liberty of pulling them into the Area51 repository as branch qtwayland. That way we can nudge Weston forward, and/or push Qt5-Wayland in separately. Nicest from a testing perspective is probably doing both at the same time.<br>
I picked a random “Hello World” Wayland tutorial and also built a minimal Qt program (using QMessageBox::question, my favorite function to hate right now, because of its i18n characteristics). Then, setting XDG_RUNTIME_DIR to /tmp/xdg, I could start Weston (as an X11 client), wayland-hello (as a Wayland client, displaying in Weston) and qt-hello (as either an X11 client, or as a Wayland client).<br>
So this gives users of Area51 (while shuffling branches, granted) a modern desktop and modern display capabilities. Oh my!<br>
It will take a few days for this to trickle up and/or down so that the CI can benefit and we can make sure that KWin’s tests all work on FreeBSD, but it’s another good step towards tight CI and another small step towards KDE Plasma 5 on the desktop on FreeBSD.</p>

<hr>
</blockquote>

<h3><a href="https://blog.netbsd.org/tnf/entry/pkgsrccon_2017_report" rel="nofollow">pkgsrcCon 2017 report</a></h3>

<blockquote>
<p>This years pkgsrcCon returned to London once again. It was last held in London back in 2014. The 2014 con was the first pkgsrcCon I attended, I had been working on Darwin/PowerPC fixes for some months and presented on the progress I&#39;d made with a 12&quot; G4 PowerBook. I took away a G4 Mac Mini that day to help spare the PowerBook for use and dedicate a machine for build and testing. The offer of PowerPC hardware donations was repeated at this years con, thanks to jperkin@ who showed up with a backpack full of Mac Minis (more on that later).<br>
Since 2014 we have held cons in Berlin (2015) &amp; Krakow (2016). In Krakow we had talks about a wide range of projects over 2 days, from Haiku Ports to Common Lisp to midipix (building native PE binaries for Windows) and back to the BSDs. I was very pleased to continue the theme of a diverse program this year.<br>
Aside from pkgsrc and NetBSD, we had talks about FreeBSD, OpenBSD, Slackware Linux, and Plan 9. Things began with a pub gathering on the Friday for the pre-con social, we hung out and chatted till almost midnight on a wide range of topics, such as supporting a system using NFS on MS-DOS, the origins of pdksh, corporate IT, culture and many other topics.<br>
On parting I was asked about the starting time on Saturday as there was some conflicting information. I learnt that the registration email had stated a later start than I had scheduled for &amp; advertised on the website, by 30 minutes. Lesson learnt: register for your own event! Not a problem, I still needed to setup a webpage for the live video stream, I could do both when I got back. With some trimming here and there I had a new schedule, I posted that to the pkgsrcCon website and moved to trying to setup a basic web page which contained a snippet of javascript to play a live video stream from Scale Engine.  2+ hours later, it was pointed out that the XSS protection headers on pkgsrc.org breaks the functionality. Thanks to jmcneill@ for debugging and providing a working page.<br>
Saturday started off with Giovanni Bechis speaking about pledge in OpenBSD and adding support to various packages in their ports tree, alnsn@ then spoke about installing packages from a repo hosted on the Tor network.<br>
After a quick coffee break we were back to hear Charles Forsyth speak about how Plan 9 and Inferno dealt with portability, building software and the problem which are avoided by the environment there. This was followed by a very energetic rant by David Spencer from the Slackbuilds project on packaging 3rd party software. Slackbuilds is a packaging system for Slackware Linux, which was inspired by FreeBSD ports.<br>
For the first slot after lunch, agc@ gave a talk on the early history of pkgsrc followed by Thomas Merkel on using vagrant to test pkgsrc changes with ease, locally, using vagrant. khorben@ covered his work on adding security to pkgsrc and bsiegert@ covered the benefits of performing our bulk builds in the cloud and the challenges we currently face.<br>
My talk was about some topics and ideas which had inspired me or caught my attention, and how it could maybe apply to my work.The title of the talk was taken from the name of Andrew Weatherall&#39;s Saint Etienne remix, possibly referring to two different styles of track (dub &amp; vocal) merged into one or something else. I meant it in terms of applicability of thoughts and ideas. After me, agc@ gave a second talk on the evolution of the Netflix Open Connect appliance which runs FreeBSD and Vsevolod Stakhov wrapped up the day with a talk about the technical implementation details of the successor to pkg_tools in FreeBSD, called pkg, and how it could be of benefit for pkgsrc.<br>
For day 2 we gathered for a hack day at the London Hack Space.<br>
I had burn&#39;t some some CD of the most recent macppc builds of NetBSD 8.0_BETA and -current to install and upgrade Mac Minis. I setup the donated G4 minis for everyone in a dual-boot configuration and moved on to taking apart my MacBook Air to inspect the wifi adapter as I wanted to replace it with something which works on FreeBSD. It was not clear from the ifixit teardown photos of cards size, it seemed like a normal mini-PCIe card but it turned out to be far smaller. Thomas had also had the same card in his and we are not alone. Thomas has started putting together a driver for the Broadcom card, the project is still in its early days and lacks support for encrypted networks but hopefully it will appear on review.freebsd.org in the future.<br>
weidi@ worked on fixing SunOS bugs in various packages and later in the night we setup a NetBSD/macppc bulk build environment together on his Mac Mini.<br>
Thomas setup an OpenGrock instance to index the source code of all the software available for packaging in pkgsrc. This helps make the evaluation of changes easier and the scope of impact a little quicker without having to run through a potentially lengthy bulk build with a change in mind to realise the impact. bsiegert@ cleared his ticket and email backlog for pkgsrc and alnsn@ got NetBSD/evbmips64-eb booting on his EdgeRouter Lite.<br>
On Monday we reconvened at the Hack Space again and worked some more. I started putting together the talks page with the details from Saturday and the the slides which I had received, in preparation for the videos which would come later in the week. By 3pm pkgsrcCon was over. I was pretty exhausted but really pleased to have had a few days of techie fun.<br>
Many thanks to The NetBSD Foundation for purchasing a camera to use for streaming the event and a speedy response all round by the board. The Open Source Specialist Group at BCS, The Chartered Institute for IT and the London Hack Space for hosting us. Scale Engine for providing streaming facility. weidi@ for hosting the recorded videos. Allan Jude for pointers, Jared McNeill for debugging, NYCBUG and Patrick McEvoy for tips on streaming, the attendees and speakers. This year we had speakers from USA, Italy, Germany and London E2. Looking forward to pkgsrcCon 2018!<br>
The videos and slides are available <a href="http://www.pkgsrc.org/pkgsrcCon/2017/talks.html" rel="nofollow">here</a> and the <a href="http://archive.org/details/pkgsrcCon-2017" rel="nofollow">Internet Archive</a>.</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://www.servethehome.com/quickassist-driver-freebsd-pfsupport-coming/" rel="nofollow">QuickAssist Driver for FreeBSD is here and pfSense Support Coming</a></h3>

<blockquote>
<p>This week we have something that STH readers will be excited about. Before I started writing for STH, I was a reader and had been longing for QuickAssist support ever since STH’s first Rangeley article over three and a half years ago. It was clear from the get-go that Rangeley was going to be the preeminent firewall appliance platform of its day. The scope of products that were impacted by the Intel Atom C2000 series bug showed us it was indeed. For my personal firewalls, I use pfSense on that Rangeley platform so I have been waiting to use QuickAssist with my hardware for almost an entire product generation.</p>

<ul>
<li>New Hardware and QuickAssist Incoming to pfSense (Finally)
pfSense (and a few other firewalls) are based on FreeBSD. FreeBSD tends to lag driver support behind mainstream Linux but it is popular for embedded security appliances. While STH is the only site to have done QuickAssist benchmarks for OpenSSL and IPSec VPNs pre-Skylake, we expect more platforms to use it now that the new Intel Xeon Scalable Processor Family is out. With the Xeon Scalable platforms, the “Lewisburg” PCH has QuickAssist options of up to 100Gbps, or 2.5x faster than the previous generation add-in cards we tested (40Gbps.) We now have more and better hardware for QAT, but we were still devoid of a viable FreeBSD QAT driver from Intel. That has changed.
Our Intel Xeon Scalable Processor Family (Skylake-SP) Launch Coverage Central has been the focus of the STH team’s attention this week. There was another important update from Intel that got buried, a publicly available Intel QuickAssist driver for FreeBSD. You can find the driver on 01.org here dated July 12, 2017.
Drivers are great, but we still need support to be enabled in the OS and at the application layer. Patrick forwarded me this tweet from Jim Thompson (lead at Netgate the company behind pfSense):
The Netgate team has been a key company pushing QuickAssist appliances in the market, usually based on Linux. To see that QAT is coming to FreeBSD and that they were working to integrate into “pfSense soon” is more than welcome.
For STH readers, get ready. It appears to be actually and finally happening. QuickAssist on FreeBSD and pfSense
***</li>
</ul>
</blockquote>

<h3><a href="https://jcs.org/2017/07/14/matebook" rel="nofollow">OpenBSD on the Huawei MateBook X</a></h3>

<blockquote>
<p>The Huawei MateBook X is a high-quality 13&quot; ultra-thin laptop with a fanless Core i5 processor. It is obviously biting the design of the Apple 12&quot; MacBook, but it does have some notable improvements such as a slightly larger screen, a more usable keyboard with adequate key travel, and 2 USB-C ports.<br>
It also uses more standard PC components than the MacBook, such as a PS/2-connected keyboard, removable m.2 WiFi card, etc., so its OpenBSD compatibility is quite good.<br>
In contrast to the Xiaomi Mi Air, the MateBook is actually sold (2) in the US and comes with a full warranty and much higher build quality (though at twice the price). It is offered in the US in a &quot;space gray&quot; color for the Core i5 model and a gold color for the Core i7.<br>
The fanless Core i5 processor feels snappy and doesn&#39;t get warm during normal usage on OpenBSD. Doing a make -j4 build at full CPU speed does cause the laptop to get warm, though the palmrest maintains a usable temperature.<br>
The chassis is all aluminum and has excellent rigidity in the keyboard area. The 13.0&quot; 2160x1440 glossy IPS &quot;Gorilla glass&quot; screen has a very small bezel and its hinge is properly weighted to allow opening the lid with one hand. There is no wobble in the screen when open, even when jostling the desk that the laptop sits on. It has a reported brightness of 350 nits.<br>
I did not experience any of the UEFI boot variable problems that I did with the Xiaomi, and the MateBook booted quickly into OpenBSD after re-initializing the GPT table during installation.</p>

<hr>
</blockquote>

<h3><a href="https://blog.cagedmonster.net/opensmtpd-under-openbsd-with-ssl-virtualusers-dovecot/" rel="nofollow">OpenSMTPD under OpenBSD with SSL/VirtualUsers/Dovecot</a></h3>

<ul>
<li>During the 2013 AsiaBSDCon, the team of OpenBSD presented its mail solution named OpenSMTPD. </li>
<li>Developed by the OpenBSD team, we find the so much appreciated philosophy of its developers : security, simplicity / clarity and advanced features.</li>
<li>Basic configuration : OpenSMTPD is installed by default, we can immediately start with a simple configuration.
&gt; We listen on our interfaces, we specify the path of our aliases file so we can manage redirections. 
&gt; Mails will be delivered for the domain cagedmonster.net to mbox (the local users mailbox), same for the aliases. 
&gt; Finally, we accept to relay local mails exclusively.
&gt; We can now enable smtpd at system startup and start the daemon.</li>
<li>Advanced configuration including TLS :

<ul>
<li>You can use SSL with : A self-signed certificate (which will not be trusted) or a certificate generated by a trusted authority. LetsEncrypt uses Certbot to generated your certificate. You can check this page for further informations. Let&#39;s focus on the first.</li>
<li>Generation of the certificate :</li>
<li>We fix the permissions :</li>
<li>We edit the config file :
&gt; We have a mail server with SSL, it&#39;s time to configure our IMAP server, Dovecot, and manage the creation of virtual users.</li>
</ul></li>
<li>Dovecot setup, and creation of Virtual Users : We will use the package system of OpenBSD, so please check the configuration of your /etc/pkg.conf file.

<ul>
<li>Enable the service at system startup :</li>
<li>Setup the Virtual Users structure :</li>
<li>Adding the passwd table for smtpd :</li>
<li>Modification of the OpenSMTPD configuration :</li>
<li>We declare the files used for our Virtual Accounts, we include SSL, and we configure mails delivery via the Dovecot lmtp socket.</li>
<li>We&#39;ll create our user <a href="mailto:lina@cagedmonster.net" rel="nofollow">lina@cagedmonster.net</a> and set its password.</li>
<li>Configure SSL</li>
<li>Configure dovecot.conf</li>
<li>Configure mail.con</li>
<li>Configure login.conf : Make sure that the value of openfiles-cur in /etc/login.conf is equal or superior of 1000 !</li>
<li>Starting Dovecot
***</li>
</ul></li>
</ul>

<h3><a href="https://blog.cagedmonster.net/opensmtpd-and-dovecot-under-openbsd-with-mysql-support-and-spamd/" rel="nofollow">OpenSMTPD and Dovecot under OpenBSD with MySQL support and SPAMD</a></h3>

<blockquote>
<p>This article is the continuation of my previous tutorial OpenSMTPD under OpenBSD with SSL/VirtualUsers/Dovecot. We&#39;ll use the same configuration and add some features so we can :<br>
Use our domains, aliases, virtual users with a MySQL database (MariaDB under OpenBSD).<br>
Deploy SPAMD with OpenSMTPD for a strong antispam solution.</p>

<ul>
<li>Setup of the MySQL support for OpenSMTPD &amp; Dovecot</li>
<li>We create our SQL database named « smtpd » </li>
<li>We create our SQL user « opensmtpd » we give him the privileges on our SQL database and we set its password </li>
<li>We create the structure of our SQL database</li>
<li>We generate our password with Blowfish (remember it&#39;s OpenBSD !) for our users</li>
<li>We create our tables and we include our datas</li>
<li>We push everything to our database</li>
<li>Time to configure OpenSMTPD</li>
<li>We create our mysql.conf file and configure it </li>
<li>Configuration of Dovecot.conf</li>
<li>Configuration of auth-sql.conf.ext</li>
<li>Configuration of dovecot-sql.conf.ext</li>
<li>Restart our services
OpenSMTPD &amp; SPAMD :
SPAMD is a service simulating a fake SMTP server and relying on strict compliance with RFC to determine whether the server delivering a mail is a spammer or not. </li>
<li>Configuration of SPAMD :</li>
<li>Enable SPAMD &amp; SPAMLOGD at system startup :</li>
<li>Configuration of SPAMD flags </li>
<li>Configuration of PacketFilter</li>
<li>Configuration of SPAMD </li>
<li>Start SPAMD &amp; SPAMLOGD 
***
###<a href="https://networkingbsdblog.wordpress.com/2017/07/14/freebsd-tor-relay-using-priveledge-seperation/" rel="nofollow">Running a TOR relay on FreeBSD</a></li>
<li>There are 2 main steps to getting a TOR relay working on FreeBSD:

<ul>
<li>Installing and configuring Tor</li>
<li>Using an edge router to do port translation</li>
<li>In my case I wanted TOR to run it’s services on ports 80 and 443 but any port under 1024 requires root access in UNIX systems.
+So I used port mapping on my router to map the ports.
+Begin by installing TOR and ARM from:
<code>
/usr/ports/security/tor/
/usr/ports/security/arm/
</code></li>
</ul></li>
<li>Arm is the Anonymizing Relay Monitor: <a href="https://www.torproject.org/projects/arm.html.en" rel="nofollow">https://www.torproject.org/projects/arm.html.en</a></li>
<li>It provides useful monitoring graph and can be used to configure the torrc file.</li>
<li>Next step edit the torrc file (see Blog article for the edit)</li>
<li>It is handy to add the following lines to /etc/services so you can more easily modify your pf configuration.
<code>
torproxy 9050/tcp #torsocks
torOR 9090/tcp #torOR
torDIR 9099/tcp #torDIR
</code></li>
<li>To allow TOR services my pf.conf has the following lines:
<code>
# interfaces
lan_if=”re0″
wifi_if=”wlan0″
interfaces=”{wlan0,re0}”
tcp_services = “{   ssh torproxy torOR torDIR  }”
# options
set block-policy drop
set loginterface $lan_if
# pass on lo
set skip on lo
scrub in on $lan_if all fragment reassemble
# NAT
nat on $lan_if from $wifi_if:network to !($lan_if) -&gt; ($lan_if)
block all
antispoof for $interfaces
#In NAT
pass in log on $wifi_if inet
pass out all keep state
#ICMP
pass out log inet proto icmp from any to any keep state
pass in log quick inet proto icmp from any to any keep state
#SSH
pass in inet proto tcp to $lan_if port ssh
pass in inet proto tcp to $wifi_if port ssh
#TCP Services on Server
pass in inet proto tcp to $interfaces port $tcp_services keep state
</code></li>
<li>The finally part is mapping the ports as follows:
<code>
TOR directory port: LANIP:9099 —&gt; WANIP:80
TOR router port: LANIP:9090 —-&gt; WANIP:443
</code></li>
<li>Now enable TOR:
<code>$ sudo echo “tor_enable=YES” &gt;&gt; /etc/rc.conf</code></li>
<li>Start TOR:
<code>$ sudo service tor start</code>
***</li>
</ul>
</blockquote>

<h2>Beastie Bits</h2>

<p><a href="http://unixseclab.com/index.php/2017/06/12/openbsd-as-a-desktop-laptop/" rel="nofollow">OpenBSD as a “Desktop” (Laptop)</a><br>
<a href="http://lists.dragonflybsd.org/pipermail/commits/2017-July/625997.html" rel="nofollow">Sascha Wildner has updated ACPICA in DragonFly to Intel’s version 20170629</a><br>
<a href="https://www.dragonflydigest.com/2017/07/18/19991.html" rel="nofollow">Dport, Rust, and updates for DragonFlyBSD</a><br>
<a href="https://opnsense.org/opnsense-17-7-rc1/" rel="nofollow">OPNsense 17.7 RC1 released</a><br>
<a href="http://www.networkworld.com/article/3205148/linux/unix-s-mysterious-andand-and.html#tk.rss_unixasasecondlanguage" rel="nofollow">Unix’s mysterious &amp;&amp; and ||</a><br>
<a href="http://boingboing.net/2017/06/16/cyberspace-is-everting.html" rel="nofollow">The Commute Deck : A Homebrew Unix terminal for tight places</a><br>
<a href="https://lists.freebsd.org/pipermail/freebsd-stable/2017-July/087407.html" rel="nofollow">FreeBSD 11.1-RC3 now available</a><br>
<a href="http://lists.dragonflybsd.org/pipermail/users/2017-July/313528.html" rel="nofollow">Installing DragonFlyBSD with ORCA when you’re totally blind</a><br>
<a href="http://imgur.com/gallery/dc1pu" rel="nofollow">Who says FreeBSD can’t look good</a><br>
<a href="http://undeadly.org/cgi?action=article&sid=20170716160129" rel="nofollow">Pratik Vyas adds the ability to do paused VM migrations for VMM</a></p>

<hr>

<h2>Feedback/Questions</h2>

<p><a href="http://dpaste.com/0EXV173#wrap" rel="nofollow">Hrvoje - OpenBSD MP Networking</a><br>
<a href="http://dpaste.com/1N853NG#wrap" rel="nofollow">Goran - debuggers</a><br>
<a href="http://dpaste.com/1JXQY5E#wrap" rel="nofollow">Abhinav - man-k</a><br>
<a href="http://dpaste.com/01ERMEQ#wrap" rel="nofollow">Liam - university setup</a></p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>203: For the love of ZFS</title>
  <link>https://www.bsdnow.tv/203</link>
  <guid isPermaLink="false">f352fe58-6e6c-4354-80fa-35e2224efc5f</guid>
  <pubDate>Wed, 19 Jul 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f352fe58-6e6c-4354-80fa-35e2224efc5f.mp3" length="84263188" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSD Now, we clear up some ZFS FUD, show you how to write a NetBSD kernel module, and cover DragonflyBSD on the desktop.</itunes:subtitle>
  <itunes:duration>1:57:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSD Now, we clear up some ZFS FUD, show you how to write a NetBSD kernel module, and cover DragonflyBSD on the desktop.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
ZFS is the best file system (for now) (http://blog.fosketts.net/2017/07/10/zfs-best-filesystem-now/)
In my ongoing effort to fight misinformation and FUD about ZFS, I would like to go through this post in detail and share my thoughts on the current state and future of OpenZFS.
The post starts with:
ZFS should have been great, but I kind of hate it: ZFS seems to be trapped in the past, before it was sidelined it as the cool storage project of choice; it’s inflexible; it lacks modern flash integration; and it’s not directly supported by most operating systems. But I put all my valuable data on ZFS because it simply offers the best level of data protection in a small office/home office (SOHO) environment. Here’s why.
When ZFS first appeared in 2005, it was absolutely with the times, but it’s remained stuck there ever since. The ZFS engineers did a lot right when they combined the best features of a volume manager with a “zettabyte-scale” filesystem in Solaris 10
The skies first darkened in 2007, as NetApp sued Sun, claiming that their WAFL patents were infringed by ZFS. Sun counter-sued later that year, and the legal issues dragged on.
The lawsuit was resolved, and it didn’t really impede ZFS. Some say it is the reason that Apple didn’t go with ZFS, but there are other theories too.
By then, Sun was hitting hard times and Oracle swooped in to purchase the company. This sowed further doubt about the future of ZFS, since Oracle did not enjoy wide support from open source advocates.
Yes, Oracle taking over Sun and closing the source for ZFS definitely seemed like a setback at the time, but the OpenZFS project was started and active development has continued as an ever increasing pace. As of today, more than half of the code in OpenZFS has been written since the fork from the last open version of Oracle ZFS.
the CDDL license Sun applied to the ZFS code was https://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/ (judged incompatible) with the GPLv2 that covers Linux, making it a non-starter for inclusion in the world’s server operating system.
That hasn’t stopped the ZFS-on-Linux project, or Ubuntu…
Although OpenSolaris continued after the Oracle acquisition, and FreeBSD embraced ZFS, this was pretty much the extent of its impact outside the enterprise. Sure, NexentaStor and http://blog.fosketts.net/2008/09/15/greenbytes-embraces-extends-zfs/ (GreenBytes) helped push ZFS forward in the enterprise, but Oracle’s lackluster commitment to Sun in the datacenter started having an impact.
Lots of companies have adopted OpenZFS for their products. Before OpenZFS, there were very few non-Sun appliances that used ZFS, now there are plenty.
OpenZFS Wiki: Companies with products based on OpenZFS (http://open-zfs.org/wiki/Companies)
OpenZFS remains little-changed from what we had a decade ago.
Other than the fact that half of the current code did not exist a decade ago…
Many remain skeptical of deduplication, which hogs expensive RAM in the best-case scenario.
This is one of the weaker points in ZFS. As it turns out, the demand for deduplication is actually not that strong. Most of the win can be had with transparent compression.
However, there are a number of suggested designs to work around the dedup problems:
Dedup Ceiling: Set a limit on the side of the DDT and just stop deduping new unique blocks when this limit is reached.
Allocation Classes: A feature being developed by Intel for a supercomputer, will allow different types of data to be classified, and dedicated vdevs (or even metaslabs within a vdev), to be dedicated to that class of data. This could be extended to having the DDT live on a fast device like an PCIe NVMe, combined with the Dedup Ceiling when the device is full.
DDT Pruning: Matt Ahrens described a design where items in the DDT with only a single reference, would be expired in an LRU type fashion, to allow newer blocks to live in the DDT in hopes that they would end up with more than a single reference. This doesn’t cause bookkeeping problems since when a block is about to be freed, if it is NOT listed in the DDT, ZFS knows it was never deduplicated, so the current block must be the only reference, and it can safely be freed. This provides a best case scenario compared to Dedup Ceiling, since blocks that will deduplicate well, are likely to be written relatively close together, whereas the chance to a dedup match on a very old block is much lower.
And I do mean expensive: Pretty much every ZFS FAQ flatly declares that ECC RAM is a must-have and 8 GB is the bare minimum. In my own experience with FreeNAS, 32 GB is a nice amount for an active small ZFS server, and this costs $200-$300 even at today’s prices.
As we talked about a few weeks ago, ECC is best, but it is not required. If you want your server to stay up for a long time, to be highly available, you’ll put ECC in it. Don’t let a lack of ECC stop you from using ZFS, you are just putting your data at more risk. The scrub of death is a myth.
ZFS does not ‘require’ lots of ram. Your NAS will work happily with 8 GB instead of 32 GB of RAM. Its cache hit ratio will be much lower, so performance will be worse. It won’t be able to buffer as many writes, so performance will be worse.
Copy-on-Write has some drawbacks, data tends to get scattered and fragmented across the drives when it is written gradually. The ARC (RAM Cache) lessens the pain of this, and allows ZFS to batch incoming writes up into nice contiguous writes. ZFS purposely alternates between reading and writing, since both are faster when the other is not happening. So writes are batched up until there is too much dirty data, or the timeout expires. Then reads are held off while the bulk linear write finishes as quickly as possible, and reads are resumed.
Obviously all of this works better and more efficiently in larger batches, which you can do if you have more RAM.
ZFS can be tuned to use less RAM, and if you do not have a lot of RAM, or you have a lot of other demand on your RAM, you should do that tuning.
And ZFS never really adapted to today’s world of widely-available flash storage: Although flash can be used to support the ZIL and L2ARC caches, these are of dubious value in a system with sufficient RAM, and ZFS has no true hybrid storage capability. It’s laughable that the ZFS documentation obsesses over a few GB of SLC flash when multi-TB 3D NAND drives are on the market. And no one is talking about NVMe even though it’s everywhere in performance PC’s.
Make up your mind, is 32GB of ram too expensive or not…
the L2ARC exists specifically for the case where it is not possible to just install more RAM. Be it because there are no more slots, of limits of the processor, or limits of your budget.
The SLOG is optional, but it never needs to be very big. A number of GBs of SLC flash is all you need, it is only holding writes that have not been flushed to the regular storage devices yet. The reason the documentation talks about SLC specifically is because your SLOG needs a very high write endurance, something never the newest NVMe devices cannot yet provide. 
Of course you can use NVMe devices with ZFS, lots of people do. All flash ZFS arrays are for sale right now. Other than maybe a little tuning of the device queue depths, ZFS just works and there is nothing to think about.
However, to say there is nothing happening in this space is woefully inaccurate.
The previously mentioned allocation classes code can be used to allocate metadata (4 KB blocks) on SSD or NVMe, while allocating bulk storage data (up to 16 MB blocks) on spinning disks. Extended a bit beyond what Intel is building for their super computer, this will basically create hybrid storage for ZFS.
With the metaslab classes feature, it will even be possible to mix classes on the same device, grouping small allocations and large allocations in different areas, decreasing fragmentation.
Then there’s the question of flexibility, or lack thereof. Once you build a ZFS volume, it’s pretty much fixed for life. There are only three ways to expand a storage pool:
Replace each and every drive in the pool with a larger one (which is great but limiting and expensive)
It depends on your pool layout. If you design with this in mind using ZFS Mirrors, it can be quite useful
Add a stripe on another set of drives (which can lead to imbalanced performance and redundancy and a whole world of potential stupid stuff)
The unbalanced LUNs performance issues were sorted out in 2013-2016. 
2014: OpenZFS Allocation Performance  (http://open-zfs.org/w/images/3/31/Performance-George_Wilson.pdf)
2016: OpenZFS space allocation: doubling performance on large and fragmented pools (http://www.bsdcan.org/2016/schedule/events/710.en.html)
These also mostly solved the performance issues when a pool gets full, you can run a lot closer to the edge now
Build a new pool and “zfs send” your datasets to it (which is what I do, even though it’s kind of tricky)
This is one way to do it, yes.
There is another way coming, but I can’t talk about it just yet. Look for big news later this year.
Apart from option 3 above, you can’t shrink a ZFS pool.
Device removal is arriving now. It will not work for RAIDZ*, but for Mirrors and Stripes you will be able to remove a device.
I’ve probably made ZFS sound pretty unappealing right about now. It was revolutionary but now it’s startlingly limiting and out of touch with the present solid-state-dominated storage world.
I don’t feel like ZFS is out of touch with solid state. Lots of people are running SSD only pools. I will admit the tiered storage options in ZFS are a bit limited still, but there is a lot of work being done to overcome this.
After all, reliably storing data is the only thing a storage system really has to do. All my important data goes on ZFS, from photos to music and movies to office files. It’s going to be a long time before I trust anything other than ZFS!
+ I agree.
+ ZFS has a great track record of doing its most important job, keeping your data safe.
+ Work is ongoing to make ZFS more performance, and more flexible. The import thing is that this work is never allowed to compromise job #1, keeping your data safe.
+ Hybrid/tiered storage features, re-RAID-ing, are coming
+ There is a lot going on with OpenZFS, check out the notes from the last two OpenZFS Developer Summits just to get an idea of what some of those things are: 
2015 (http://open-zfs.org/wiki/OpenZFS_Developer_Summit_2015) &amp;amp; 2016 (http://open-zfs.org/wiki/OpenZFS_Developer_Summit_2016)
Some highlights:
Compressed ARC
Compressed send/recv
ABD (arc buf scatter/gather)
ZFS Native Encryption (scrub/resilver, send/recv, etc without encryption keys loaded)
Channel Programs (do many administrative operations as one atomic transaction)
Device Removal
Redacted send/recv
ZStandard Compression
TRIM Support (FreeBSD has its own, but this will be more performant and universal)
Faster Scrub/Resilver (https://youtu.be/SZFwv8BdBj4)
Declustered RAID (https://youtu.be/MxKohtFSB4M)
Allocation Classes (https://youtu.be/28fKiTWb2oM)
Multi-mount protection (for Active/Passive failover)
Zpool Checkpoint (undo almost anything)
Even more Improved Allocator Performance
vdev spacemap log
ZIL performance improvements (w/ or w/o SLOG)
Persistent L2ARC
What I don’t think the author of this article understands is how far behind every other filesystem is. 100s of Engineer years have gone into OpenZFS, and the pace is accelerating. I don’t see how BtrFS can ever catch up, without a huge cash infusion.
Writing a NetBSD kernel module (https://saurvs.github.io/post/writing-netbsd-kern-mod/)
Kernel modules are object files used to extend an operating system’s kernel functionality at run time.
In this post, we’ll look at implementing a simple character device driver as a kernel module in NetBSD. Once it is loaded, userspace processes will be able to write an arbitrary byte string to the device, and on every successive read expect a cryptographically-secure pseudorandom permutation of the original byte string.
You will need the NetBSD Source Code.
This doc (https://www.netbsd.org/docs/guide/en/chap-fetch.html) will explain how you can get it.
The article gives an easy line by line walkthrough which is easy to follow and understand.
The driver implements the bare minimum: open, close, read, and write, plus the module initialization function
It explains the differences in how memory is allocated and freed in the kernel
It also describes the process of using UIO to copy data back and forth between userspace and the kernel
Create a Makefile, and compile the kernel module
Then, create a simple userspace program to use the character device that the kernel module creates
All the code is available here (https://github.com/saurvs/rperm-netbsd)
***
DragonFlyBSD Desktop! (https://functionallyparanoid.com/2017/07/11/dragonflybsd-desktop/)
If you read my last post (https://functionallyparanoid.com/2017/06/30/boot-all-the-things/), you know that I set up a machine (Thinkpad x230) with UEFI and four operating systems on it.  One, I had no experience with – DragonFlyBSD (other than using Matthew Dillon’s C compiler for the Amiga back in the day!) and so it was uncharted territory for me.  After getting the install working, I started playing around inside of DragonFlyBSD and discovered to my delight that it was a great operating system with some really unique features – all with that BSD commitment to good documentation and a solid coupling of kernel and userland that doesn’t exist (by design) in Linux.
So my goal for my DragonFlyBSD desktop experience was to be as BSD as I possibly could.  Given that (and since I’m the maintainer of the port on OpenBSD ), I went with Lumina as the desktop environment and XDM as the graphical login manager.  I have to confess that I really like the xfce terminal application so I wanted to make sure I had that as well.  Toss in Firefox, libreOffice and ownCloud sync client and I’m good to go!
OK.  So where to start.  First, we need to get WiFi and wired networking happening for the console at login.  To do that, I added the following to /etc/rc.conf:

wlans_iwn0=”wlan0″
ifconfig_wlan0=”WPA DHCP”
ifconfig_em0=”DHCP”

I then edited /etc/wpa_supplicant.conf to put in the details of my WiFi network:

network={
ssid=”MY-NETWORK-NAME”
psk=”my-super-secret-password”
}

A quick reboot showed that both wired and wireless networking were functional and automatically were assigned IP addresses via DHCP.  Next up is to try getting into X with whatever DragonFlyBSD uses for its default window manager.  A straight up “startx” met with, shall we say, less than stellar results.  Therefore, I used the following command to generate a simple /etc/X11/xorg.conf file:

# Xorg -configure
# cp /root/xorg.conf.new /etc/X11/xorg.conf

With that file in place, I could get into the default window manager, but I had no mouse.  After some searching and pinging folks on the mailing list, I was able to figure out what I needed to do.  I added the following to my /etc/rc.conf file:

moused_enable=”YES”
moused_type=”auto”
moused_port=”/dev/psm0″

I rebooted (I’m sure there is an easier way to get the changes but I don’t know it… yet) and was able to get into a basic X session and have a functional mouse.  Next up, installing and configuring Lumina!  To do that, I went through the incredibly torturous process of installing Lumina:
# pkg install lumina
Wow!  That was really, really hard.  I might need to pause here to catch my breath. 🙂
Next up, jumping into Lumina from the console.  To do that, I created a .xinitrc file in my home directory with the following:
exec start-lumina-desktop
From there, I could “startx” until my heart was content and bounce into Lumina.  That wasn’t good enough though!  I want a graphical login (specifically xdm).  To do that, I had to do a little research.  The trick on DragonFlyBSD is not to add anything to /etc/rc.conf like you do in other BSDs, it’s a bit more old school.  Basically you need to edit the /etc/ttys file and update ttyv8 to turn on the xdm daemon:
ttyv8    “/usr/X11R6/bin/xdm -nodaemon”    xterm    on    secure
The other thing you need to do is set it up to use your desktop environment of choice.  In my case, that’s Lumina.  To do that, I needed to edit /usr/local/lib/X11/xdm/Xsession and change the next to the last line in the file to launch Lumina:
exec /usr/local/bin/start-lumina-desktop
I then crossed my fingers, rebooted and lo and behold had a graphical login that, when I actually didn’t fat finger my password from excitement, put me into the Lumina desktop environment!
Next up – I need a cool desktop wallpaper.  Of course that’s way more important that installing application or other stuff!  After some searching, I found this one that met my needs.  I downloaded it to a local ~/Pictures directory and then used the Lumina wallpaper preference application to add the directory containing the picture and set it to automatic layout.  Voila!  I had a cool DragonFlyBSD wallpaper.
Next I installed the xfce4 terminal program by doing:
# pkg install xfce4-terminal
I then went into the Lumina “All Desktop Settings” preferences, found the applet for the “Menu” under “Interface Configuration” and swapped out “terminal” for “Xfce Terminal”.  I then configured Lumina further to have a 26 pixel thick, 99% length bottom center panel with the following gadgets in it (in this order):

Start Menu
Task Manager (No Groups)
Spacer
System Tray
Time/Date
Battery Monitor

I then went into my Appearance | Window Manager gadget and set my Window Theme to “bora_blue” (my favorite out of the defaults supplied).  I then installed my remaining applications that I needed in order to have a functioning desktop:
# pkg install owncloudclient qtkeychain evolution evolution-ews firefox libreoffice
After that, I really had a nicely functioning desktop environment!  By the way, the performance of DragonFlyBSD is pretty impressive in terms of its day to day usage.  Keep in mind I’m not doing any official benchmarking or anything, but it sure feels to me to be just as fast (if not faster) than OpenBSD and FreeBSD.  I know that the kernel team has done a lot to unlock things (which FreeBSD has done and we are starting to do on OpenBSD) so perhaps I can attribute the “snappiness” to that?
As you can see, although there isn’t as much documentation on the Internet for this BSD, you can get a really nice, functional desktop out of it with some simple (and intuitive) configuration.  I’m really looking forward to living in this system for a while and learning about it.  Probably the first thing I’ll do is ring up the port maintainer for Lumina and see if we can’t collaborate on getting Lumina 1.3 moved over to it!  Give this one a try – I think you’ll find that its a very nice operating system with some very cool features (the HAMMER filesystem for one!).
News Roundup
Porting NetBSD to Alwinner H3 SoCs (http://blog.netbsd.org/tnf/entry/porting_netbsd_to_allwinner_h3)
Jared McNeill writes on the the NetBSD blog:
A new SUNXI evbarm kernel has appeared recently in NetBSD -current with support for boards based on the Allwinner H3 system on a chip (SoC). The H3 SoC is a quad-core Cortex-A7 SoC designed primarily for set-top boxes, but has managed to find its way into many single-board computers (SBC). This is one of the first evbarm ports built from the ground up with device tree support, which helps us to use a single kernel config to support many different boards.
To get these boards up and running, first we need to deal with low-level startup code. For the SUNXI kernel this currently lives in sys/arch/evbarm/sunxi/. The purpose of this code is fairly simple; initialize the boot CPU and initialize the MMU so we can jump to the kernel. The initial MMU configuration needs to cover a few things -- early on we need to be able to access the kernel, UART debug console, and the device tree blob (DTB) passed in from U-Boot. We wrap the kernel in a U-Boot header that claims to be a Linux kernel; this is no accident! This tells U-Boot to use the Linux boot protocol when loading the kernel, which ensures that the DTB (loaded by U-Boot) is processed and passed to us in r2.
Once the CPU and MMU are ready, we jump to the generic ARM FDT implementation of initarm in sys/arch/evbarm/fdt/fdtmachdep.c. The first thing this code does is validate and relocate the DTB data. After it has been relocated, we compare the compatible property of the root node in the device tree with the list of ARM platforms compiled into the kernel. The Allwinner sunxi platform code lives in sys/arch/arm/sunxi/sunxiplatform.c. The sunxi platform code provides SoC-specific versions of code needed early at boot. We need to know how to initialize the debug console, spin up application CPUs, reset the board, etc.
With a bit of luck, we're now booting and enumerating devices. Apart from a few devices, almost nothing works yet as we are missing a driver for the CCU. The CCU in the Allwinner H3 SoC controls PLLs and most of the clock generation, division, muxing, and gating. Since there are many similarities between Allwinner SoCs, I opted to write generic CCU code and then SoC-specific frontends. The resulting code lives in sys/arch/arm/sunxi/; generic code as sunxiccu.c and H3-specific code in sun8ih3_ccu.c.
Jared has more information about porting and also provides a boot log.
***
TrueOS Community Spotlight: Reset ZFS Replication using the command line (https://www.trueos.org/blog/community-spotlight/)
We’d like to spotlight TrueOS community member Brad Alexander for documenting his experience repairing ZFS dataset replication with TrueOS. Thank you! His notes are posted here, and they’ve been added to the TrueOS handbook Troubleshooting section for later reference.
Original indications
The SysAdm Client tray icon was pulsing red. Right-clicking on the icon and clicking Messages would show the message:
 FAILED replication task on NCC74602 -&amp;gt; 192.168.47.20: LOGFILE: /var/log/lpreserver/lpreserver_failed.log
/var/log/lpreserver/lastrep-send.log shows very little information:

send from @auto-2017-07-12-01-00-00 to NCC74602/ROOT/12.0-CURRENT-up-20170623_120331@auto-2017-07-14-01-00-00
total estimated size is 0
TIME        SENT    SNAPSHOT

And no useful errors were being written to the lpreserver_failed.log.
Repairing replication
First attempt:
The first approach I tried was to use the Sysadm Client:
I clicked on the dataset in question, then clicked Initialize. After waiting a few minutes, I clicked Start. I was immediately rewarded with a pulsing red icon in the system tray and received the same messages as above.
Second attempt:
I was working with, and want to specially thank @RodMyers and @NorwegianRockCat. They suggested I use the lpreserver command line. So I issued these commands:

sudo lpreserver replicate init NCC74602 192.168.47.20
sudo lpreserver replicate run NCC74602 192.168.47.20

Unfortunately, the replication failed again. I got these messages in the logs:

Fri Jul 14 09:03:34 EDT 2017: Removing NX80101/archive/yukon.sonsofthunder.nanobit.org/ROOT - re-created locally
cannot unmount '/mnt/NX80101/archive/yukon.sonsofthunder.nanobit.org/ROOT': Operation not permitted
Failed creating remote dataset!
cannot create 'NX80101/archive/yukon.sonsofthunder.nanobit.org/ROOT': dataset already exists

It turned out there were a number of children. I logged into luna (the FreeNAS) and issued this command as root: 
zfs destroy -r NX80101/archive/defiant.sonsofthunder.nanobit.org
I then ran the replicate init and replicate run commands again from the TrueOS host, and replication worked! It has continued to work too, at least until the next fiddly bit breaks.
Kernel relinking status from Theo de Raadt (http://undeadly.org/cgi?action=article&amp;amp;sid=20170701170044)
As you may have heard (and as was mentioned in an earlier article), on recent OpenBSD snapshots we have KARL, which means that the kernel is relinked so each boot comes with a new kernel where all .o files are linked in random order and with random offsets. Theo de Raadt summarized the status in a message to the tech@ mailing list, subject kernel relinking as follows:
5 weeks ago at d2k17 I started work on randomized kernels. I've been having conversations with other developers for nearly 5 years on the topic... but never got off to a good start, probably because I was trying to pawn the work off on others.
Having done this, I really had no idea we'd end up where we are today.
Here are the behaviours:
The base set has grown, it now includes a link-kit
At install time, a unique kernel is built from this link-kit
At upgrade time, a unique kernel is built
At boot time, a unique kernel is built and installed for the next boot
If someone compiles their own kernel and uses 'make install', the link-kit is also updated, so that the next boot can do the work
If a developer cp's a kernel to /, the mechanism dis-engages until a 'make install" or upgrade is performed in the future. That may help debugging.
A unique kernel is linked such that the startup assembly code is kept in the same place, followed by randomly-sized gapping, followed by all the other .o files randomly re-organized. As a result the distances between functions and variables are entirely new. An info leak of a pointer will not disclose other pointers or objects. This may also help reduce gadgets on variable-sized architectures, because polymorphism in the instruction stream is damaged by nested offsets changing.
At runtime, the kernel can unmap it's startup code. On architectures where an unmap isn't possible due to large-PTE use, the code can be trashed instead.
I did most of the kernel work on amd64 first, then i386. I explained what needed to be done to visa and patrick, who handled the arm and mips platforms. Then I completed all the rest of the architectures. Some architecture are missing the unmap/trashing of startup code, that's a step we need to get back to.
The next part was tricky and I received assistance from tb and rpe. We had to script the behaviours at build time, snapshot time, relink time, boot time, and later on install/upgrade time also.
While they helped, I also worked to create the "gap.o" file without use of a C compiler so that relinks can occur without the "comp" set installed. This uses the linkscript feature of ld. I don't think anyone has done this before. It is little bit fragile, and the various linkers may need to receive some fixes due to what I've encountered.
To ensure this security feature works great in the 6.2 release, please test snapshots. By working well, I mean it should work invisibly, without any glitch such as a broken kernel or anything. If there are ugly glitches we would like to know before the release.
You heard the man, now is the time to test and get a preview of the new awsomeness that will be in OpenBSD 6.2.
Beastie Bits
Beta Undeadly call for testing (http://undeadly.org/cgi?action=article&amp;amp;sid=20170704122507)
Absolute FreeBSD 3rd Edition Update (https://blather.michaelwlucas.com/archives/2972)
New home for the NetBSD repository conversion (http://mail-index.netbsd.org/tech-repository/2017/06/10/msg000637.html)
TrueOS unstable Update: 7/14/17 (https://www.trueos.org/blog/trueos-unstable-update-71417/)
Interview with George Neville-Neil - President of the FreeBSD Foundation (https://www.mappingthejourney.com/single-post/2017/07/06/Episode-4-Interview-with-George-Neville-Neil-President-of-FreeBSD)
LibreSSL 2.5.5, 2.6.0 released (https://marc.info/?l=openbsd-announce&amp;amp;m=149993703415746)
***
Feedback/Questions
Jason - Byhve VM UEFI woes (http://dpaste.com/30EY7GZ#wrap)
Donald - Several Questions (http://dpaste.com/39X6YSQ#wrap)
Dan - Several Questions (http://dpaste.com/3B50ZRV#wrap)
Bryson - Jails (http://dpaste.com/08C43XN#wrap)
***
Final Note
We’ve decided to do something different for a change of pace and let you the audience interview Allan and Benedict.
Getting our entire audience live when we record would be a challenge, so instead we want you to send in your questions for Allan and Benedict.
This interview is not going to be like our typical support feedback questions.  This is a chance for you, our audience, to ask Allan and Benedict any questions that you’ve been wondering over the years.
Questions like… “Of all the conferences you've gone to, what was your favorite and why?”
We will answer the questions during a random week during the month of September.  Send all your questions to feedback@bsdnow.tv with the subject of “viewer interview questions”
We reserve the right to not answer questions which we feel are inappropriate or trolling.
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSD Now, we clear up some ZFS FUD, show you how to write a NetBSD kernel module, and cover DragonflyBSD on the desktop.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.fosketts.net/2017/07/10/zfs-best-filesystem-now/" rel="nofollow">ZFS is the best file system (for now)</a></h3>

<ul>
<li>In my ongoing effort to fight misinformation and FUD about ZFS, I would like to go through this post in detail and share my thoughts on the current state and future of OpenZFS.</li>
<li>The post starts with:</li>
</ul>

<blockquote>
<p>ZFS should have been great, but I kind of hate it: ZFS seems to be trapped in the past, before it was sidelined it as the cool storage project of choice; it’s inflexible; it lacks modern flash integration; and it’s not directly supported by most operating systems. But I put all my valuable data on ZFS because it simply offers the best level of data protection in a small office/home office (SOHO) environment. Here’s why.<br>
When ZFS first appeared in 2005, it was absolutely with the times, but it’s remained stuck there ever since. The ZFS engineers did a lot right when they combined the best features of a volume manager with a “zettabyte-scale” filesystem in Solaris 10<br>
The skies first darkened in 2007, as NetApp sued Sun, claiming that their WAFL patents were infringed by ZFS. Sun counter-sued later that year, and the legal issues dragged on.</p>
</blockquote>

<ul>
<li>The lawsuit was resolved, and it didn’t really impede ZFS. Some say it is the reason that Apple didn’t go with ZFS, but there are other theories too.</li>
</ul>

<blockquote>
<p>By then, Sun was hitting hard times and Oracle swooped in to purchase the company. This sowed further doubt about the future of ZFS, since Oracle did not enjoy wide support from open source advocates.</p>
</blockquote>

<ul>
<li>Yes, Oracle taking over Sun and closing the source for ZFS definitely seemed like a setback at the time, but the OpenZFS project was started and active development has continued as an ever increasing pace. As of today, more than half of the code in OpenZFS has been written since the fork from the last open version of Oracle ZFS.</li>
</ul>

<blockquote>
<p>the CDDL license Sun applied to the ZFS code was [<a href="https://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/%5D(judged" rel="nofollow">https://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/](judged</a> incompatible) with the GPLv2 that covers Linux, making it a non-starter for inclusion in the world’s server operating system.</p>
</blockquote>

<ul>
<li>That hasn’t stopped the ZFS-on-Linux project, or Ubuntu…</li>
</ul>

<blockquote>
<p>Although OpenSolaris continued after the Oracle acquisition, and FreeBSD embraced ZFS, this was pretty much the extent of its impact outside the enterprise. Sure, NexentaStor and [<a href="http://blog.fosketts.net/2008/09/15/greenbytes-embraces-extends-zfs/%5D(GreenBytes)" rel="nofollow">http://blog.fosketts.net/2008/09/15/greenbytes-embraces-extends-zfs/](GreenBytes)</a> helped push ZFS forward in the enterprise, but Oracle’s lackluster commitment to Sun in the datacenter started having an impact.</p>
</blockquote>

<ul>
<li>Lots of companies have adopted OpenZFS for their products. Before OpenZFS, there were very few non-Sun appliances that used ZFS, now there are plenty.</li>
<li><a href="http://open-zfs.org/wiki/Companies" rel="nofollow">OpenZFS Wiki: Companies with products based on OpenZFS</a></li>
</ul>

<blockquote>
<p>OpenZFS remains little-changed from what we had a decade ago.</p>
</blockquote>

<ul>
<li>Other than the fact that half of the current code did not exist a decade ago…</li>
</ul>

<blockquote>
<p>Many remain skeptical of deduplication, which hogs expensive RAM in the best-case scenario.</p>
</blockquote>

<ul>
<li>This is one of the weaker points in ZFS. As it turns out, the demand for deduplication is actually not that strong. Most of the win can be had with transparent compression.</li>
<li>However, there are a number of suggested designs to work around the dedup problems:

<ul>
<li>Dedup Ceiling: Set a limit on the side of the DDT and just stop deduping new unique blocks when this limit is reached.</li>
<li>Allocation Classes: A feature being developed by Intel for a supercomputer, will allow different types of data to be classified, and dedicated vdevs (or even metaslabs within a vdev), to be dedicated to that class of data. This could be extended to having the DDT live on a fast device like an PCIe NVMe, combined with the Dedup Ceiling when the device is full.</li>
<li>DDT Pruning: Matt Ahrens described a design where items in the DDT with only a single reference, would be expired in an LRU type fashion, to allow newer blocks to live in the DDT in hopes that they would end up with more than a single reference. This doesn’t cause bookkeeping problems since when a block is about to be freed, if it is NOT listed in the DDT, ZFS knows it was never deduplicated, so the current block must be the only reference, and it can safely be freed. This provides a best case scenario compared to Dedup Ceiling, since blocks that will deduplicate well, are likely to be written relatively close together, whereas the chance to a dedup match on a very old block is much lower.</li>
</ul></li>
</ul>

<blockquote>
<p>And I do mean expensive: Pretty much every ZFS FAQ flatly declares that ECC RAM is a must-have and 8 GB is the bare minimum. In my own experience with FreeNAS, 32 GB is a nice amount for an active small ZFS server, and this costs $200-$300 even at today’s prices.</p>
</blockquote>

<ul>
<li>As we talked about a few weeks ago, ECC is best, but it is not required. If you want your server to stay up for a long time, to be highly available, you’ll put ECC in it. Don’t let a lack of ECC stop you from using ZFS, you are just putting your data at more risk. The scrub of death is a myth.</li>
<li>ZFS does not ‘require’ lots of ram. Your NAS will work happily with 8 GB instead of 32 GB of RAM. Its cache hit ratio will be much lower, so performance will be worse. It won’t be able to buffer as many writes, so performance will be worse.</li>
<li>Copy-on-Write has some drawbacks, data tends to get scattered and fragmented across the drives when it is written gradually. The ARC (RAM Cache) lessens the pain of this, and allows ZFS to batch incoming writes up into nice contiguous writes. ZFS purposely alternates between reading and writing, since both are faster when the other is not happening. So writes are batched up until there is too much dirty data, or the timeout expires. Then reads are held off while the bulk linear write finishes as quickly as possible, and reads are resumed.</li>
<li>Obviously all of this works better and more efficiently in larger batches, which you can do if you have more RAM.</li>
<li>ZFS can be tuned to use less RAM, and if you do not have a lot of RAM, or you have a lot of other demand on your RAM, you should do that tuning.</li>
</ul>

<blockquote>
<p>And ZFS never really adapted to today’s world of widely-available flash storage: Although flash can be used to support the ZIL and L2ARC caches, these are of dubious value in a system with sufficient RAM, and ZFS has no true hybrid storage capability. It’s laughable that the ZFS documentation obsesses over a few GB of SLC flash when multi-TB 3D NAND drives are on the market. And no one is talking about NVMe even though it’s everywhere in performance PC’s.</p>
</blockquote>

<ul>
<li>Make up your mind, is 32GB of ram too expensive or not…</li>
<li>the L2ARC exists specifically for the case where it is not possible to just install more RAM. Be it because there are no more slots, of limits of the processor, or limits of your budget.</li>
<li>The SLOG is optional, but it never needs to be very big. A number of GBs of SLC flash is all you need, it is only holding writes that have not been flushed to the regular storage devices yet. The reason the documentation talks about SLC specifically is because your SLOG needs a very high write endurance, something never the newest NVMe devices cannot yet provide. </li>
<li>Of course you can use NVMe devices with ZFS, lots of people do. All flash ZFS arrays are for sale right now. Other than maybe a little tuning of the device queue depths, ZFS just works and there is nothing to think about.</li>
<li>However, to say there is nothing happening in this space is woefully inaccurate.</li>
<li>The previously mentioned allocation classes code can be used to allocate metadata (4 KB blocks) on SSD or NVMe, while allocating bulk storage data (up to 16 MB blocks) on spinning disks. Extended a bit beyond what Intel is building for their super computer, this will basically create hybrid storage for ZFS.</li>
<li>With the metaslab classes feature, it will even be possible to mix classes on the same device, grouping small allocations and large allocations in different areas, decreasing fragmentation.</li>
</ul>

<blockquote>
<p>Then there’s the question of flexibility, or lack thereof. Once you build a ZFS volume, it’s pretty much fixed for life. There are only three ways to expand a storage pool:</p>

<ol>
<li>Replace each and every drive in the pool with a larger one (which is great but limiting and expensive)</li>
</ol>
</blockquote>

<ul>
<li>It depends on your pool layout. If you design with this in mind using ZFS Mirrors, it can be quite useful</li>
</ul>

<blockquote>
<ol>
<li>Add a stripe on another set of drives (which can lead to imbalanced performance and redundancy and a whole world of potential stupid stuff)</li>
</ol>
</blockquote>

<ul>
<li>The unbalanced LUNs performance issues were sorted out in 2013-2016. </li>
<li><a href="http://open-zfs.org/w/images/3/31/Performance-George_Wilson.pdf" rel="nofollow">2014: OpenZFS Allocation Performance </a></li>
<li><a href="http://www.bsdcan.org/2016/schedule/events/710.en.html" rel="nofollow">2016: OpenZFS space allocation: doubling performance on large and fragmented pools</a></li>
<li>These also mostly solved the performance issues when a pool gets full, you can run a lot closer to the edge now</li>
</ul>

<blockquote>
<ol>
<li>Build a new pool and “zfs send” your datasets to it (which is what I do, even though it’s kind of tricky)</li>
</ol>
</blockquote>

<ul>
<li>This is one way to do it, yes.</li>
<li>There is another way coming, but I can’t talk about it just yet. Look for big news later this year.</li>
</ul>

<blockquote>
<p>Apart from option 3 above, you can’t shrink a ZFS pool.</p>
</blockquote>

<ul>
<li>Device removal is arriving now. It will not work for RAIDZ*, but for Mirrors and Stripes you will be able to remove a device.</li>
</ul>

<blockquote>
<p>I’ve probably made ZFS sound pretty unappealing right about now. It was revolutionary but now it’s startlingly limiting and out of touch with the present solid-state-dominated storage world.</p>
</blockquote>

<ul>
<li>I don’t feel like ZFS is out of touch with solid state. Lots of people are running SSD only pools. I will admit the tiered storage options in ZFS are a bit limited still, but there is a lot of work being done to overcome this.</li>
</ul>

<blockquote>
<p>After all, reliably storing data is the only thing a storage system really has to do. All my important data goes on ZFS, from photos to music and movies to office files. It’s going to be a long time before I trust anything other than ZFS!</p>

<ul>
<li>I agree.</li>
<li>ZFS has a great track record of doing its most important job, keeping your data safe.</li>
<li>Work is ongoing to make ZFS more performance, and more flexible. The import thing is that this work is never allowed to compromise job #1, keeping your data safe.</li>
<li>Hybrid/tiered storage features, re-RAID-ing, are coming</li>
<li>There is a lot going on with OpenZFS, check out the notes from the last two OpenZFS Developer Summits just to get an idea of what some of those things are: </li>
</ul>
</blockquote>

<p><a href="http://open-zfs.org/wiki/OpenZFS_Developer_Summit_2015" rel="nofollow">2015</a> &amp; <a href="http://open-zfs.org/wiki/OpenZFS_Developer_Summit_2016" rel="nofollow">2016</a></p>

<ul>
<li><p>Some highlights:</p>

<ul>
<li>Compressed ARC</li>
<li>Compressed send/recv</li>
<li>ABD (arc buf scatter/gather)</li>
<li>ZFS Native Encryption (scrub/resilver, send/recv, etc without encryption keys loaded)</li>
<li>Channel Programs (do many administrative operations as one atomic transaction)</li>
<li>Device Removal</li>
<li>Redacted send/recv</li>
<li>ZStandard Compression</li>
<li>TRIM Support (FreeBSD has its own, but this will be more performant and universal)</li>
<li><a href="https://youtu.be/SZFwv8BdBj4" rel="nofollow">Faster Scrub/Resilver</a></li>
<li><a href="https://youtu.be/MxKohtFSB4M" rel="nofollow">Declustered RAID</a></li>
<li><a href="https://youtu.be/28fKiTWb2oM" rel="nofollow">Allocation Classes</a></li>
<li>Multi-mount protection (for Active/Passive failover)</li>
<li>Zpool Checkpoint (undo almost anything)</li>
<li>Even more Improved Allocator Performance</li>
<li>vdev spacemap log</li>
<li>ZIL performance improvements (w/ or w/o SLOG)</li>
<li>Persistent L2ARC</li>
</ul></li>
<li><p>What I don’t think the author of this article understands is how far behind every other filesystem is. 100s of Engineer years have gone into OpenZFS, and the pace is accelerating. I don’t see how BtrFS can ever catch up, without a huge cash infusion.</p>

<hr></li>
</ul>

<h3><a href="https://saurvs.github.io/post/writing-netbsd-kern-mod/" rel="nofollow">Writing a NetBSD kernel module</a></h3>

<blockquote>
<p>Kernel modules are object files used to extend an operating system’s kernel functionality at run time.<br>
In this post, we’ll look at implementing a simple character device driver as a kernel module in NetBSD. Once it is loaded, userspace processes will be able to write an arbitrary byte string to the device, and on every successive read expect a cryptographically-secure pseudorandom permutation of the original byte string.</p>
</blockquote>

<ul>
<li>You will need the NetBSD Source Code.

<ul>
<li><a href="https://www.netbsd.org/docs/guide/en/chap-fetch.html" rel="nofollow">This doc</a> will explain how you can get it.</li>
</ul></li>
<li>The article gives an easy line by line walkthrough which is easy to follow and understand.</li>
<li>The driver implements the bare minimum: open, close, read, and write, plus the module initialization function</li>
<li>It explains the differences in how memory is allocated and freed in the kernel</li>
<li>It also describes the process of using UIO to copy data back and forth between userspace and the kernel</li>
<li>Create a Makefile, and compile the kernel module</li>
<li>Then, create a simple userspace program to use the character device that the kernel module creates</li>
<li><a href="https://github.com/saurvs/rperm-netbsd" rel="nofollow">All the code is available here</a>
***</li>
</ul>

<h3><a href="https://functionallyparanoid.com/2017/07/11/dragonflybsd-desktop/" rel="nofollow">DragonFlyBSD Desktop!</a></h3>

<blockquote>
<p>If you read my <a href="https://functionallyparanoid.com/2017/06/30/boot-all-the-things/" rel="nofollow">last post</a>, you know that I set up a machine (Thinkpad x230) with UEFI and four operating systems on it.  One, I had no experience with – DragonFlyBSD (other than using Matthew Dillon’s C compiler for the Amiga back in the day!) and so it was uncharted territory for me.  After getting the install working, I started playing around inside of DragonFlyBSD and discovered to my delight that it was a great operating system with some really unique features – all with that BSD commitment to good documentation and a solid coupling of kernel and userland that doesn’t exist (by design) in Linux.<br>
So my goal for my DragonFlyBSD desktop experience was to be as BSD as I possibly could.  Given that (and since I’m the maintainer of the port on OpenBSD <grin>), I went with Lumina as the desktop environment and XDM as the graphical login manager.  I have to confess that I really like the xfce terminal application so I wanted to make sure I had that as well.  Toss in Firefox, libreOffice and ownCloud sync client and I’m good to go!<br>
OK.  So where to start.  First, we need to get WiFi and wired networking happening for the console at login.  To do that, I added the following to /etc/rc.conf:</p>

<pre><code>wlans_iwn0=”wlan0″
ifconfig_wlan0=”WPA DHCP”
ifconfig_em0=”DHCP”
</code></pre>

<p>I then edited /etc/wpa_supplicant.conf to put in the details of my WiFi network:</p>

<pre><code>network={
ssid=”MY-NETWORK-NAME”
psk=”my-super-secret-password”
}
</code></pre>

<p>A quick reboot showed that both wired and wireless networking were functional and automatically were assigned IP addresses via DHCP.  Next up is to try getting into X with whatever DragonFlyBSD uses for its default window manager.  A straight up “startx” met with, shall we say, less than stellar results.  Therefore, I used the following command to generate a simple /etc/X11/xorg.conf file:</p>

<pre><code>&amp;#35; Xorg -configure
&amp;#35; cp /root/xorg.conf.new /etc/X11/xorg.conf
</code></pre>

<p>With that file in place, I could get into the default window manager, but I had no mouse.  After some searching and pinging folks on the mailing list, I was able to figure out what I needed to do.  I added the following to my /etc/rc.conf file:</p>

<pre><code>moused_enable=”YES”
moused_type=”auto”
moused_port=”/dev/psm0″
</code></pre>

<p>I rebooted (I’m sure there is an easier way to get the changes but I don’t know it… yet) and was able to get into a basic X session and have a functional mouse.  Next up, installing and configuring Lumina!  To do that, I went through the incredibly torturous process of installing Lumina:</p>
</blockquote>

<p><code># pkg install lumina</code></p>

<blockquote>
<p>Wow!  That was really, really hard.  I might need to pause here to catch my breath. 🙂</p>

<p>Next up, jumping into Lumina from the console.  To do that, I created a .xinitrc file in my home directory with the following:</p>
</blockquote>

<p><code>exec start-lumina-desktop</code></p>

<blockquote>
<p>From there, I could “startx” until my heart was content and bounce into Lumina.  That wasn’t good enough though!  I want a graphical login (specifically xdm).  To do that, I had to do a little research.  The trick on DragonFlyBSD is not to add anything to /etc/rc.conf like you do in other BSDs, it’s a bit more old school.  Basically you need to edit the /etc/ttys file and update ttyv8 to turn on the xdm daemon:</p>
</blockquote>

<p><code>ttyv8    “/usr/X11R6/bin/xdm -nodaemon”    xterm    on    secure</code></p>

<blockquote>
<p>The other thing you need to do is set it up to use your desktop environment of choice.  In my case, that’s Lumina.  To do that, I needed to edit /usr/local/lib/X11/xdm/Xsession and change the next to the last line in the file to launch Lumina:</p>
</blockquote>

<p><code>exec /usr/local/bin/start-lumina-desktop</code></p>

<blockquote>
<p>I then crossed my fingers, rebooted and lo and behold had a graphical login that, when I actually didn’t fat finger my password from excitement, put me into the Lumina desktop environment!<br>
Next up – I need a cool desktop wallpaper.  Of course that’s way more important that installing application or other stuff!  After some searching, I found this one that met my needs.  I downloaded it to a local ~/Pictures directory and then used the Lumina wallpaper preference application to add the directory containing the picture and set it to automatic layout.  Voila!  I had a cool DragonFlyBSD wallpaper.<br>
Next I installed the xfce4 terminal program by doing:</p>
</blockquote>

<p><code># pkg install xfce4-terminal</code></p>

<blockquote>
<p>I then went into the Lumina “All Desktop Settings” preferences, found the applet for the “Menu” under “Interface Configuration” and swapped out “terminal” for “Xfce Terminal”.  I then configured Lumina further to have a 26 pixel thick, 99% length bottom center panel with the following gadgets in it (in this order):</p>

<pre><code>Start Menu
Task Manager (No Groups)
Spacer
System Tray
Time/Date
Battery Monitor
</code></pre>

<p>I then went into my Appearance | Window Manager gadget and set my Window Theme to “bora_blue” (my favorite out of the defaults supplied).  I then installed my remaining applications that I needed in order to have a functioning desktop:</p>
</blockquote>

<p><code># pkg install owncloudclient qtkeychain evolution evolution-ews firefox libreoffice</code></p>

<blockquote>
<p>After that, I really had a nicely functioning desktop environment!  By the way, the performance of DragonFlyBSD is pretty impressive in terms of its day to day usage.  Keep in mind I’m not doing any official benchmarking or anything, but it sure feels to me to be just as fast (if not faster) than OpenBSD and FreeBSD.  I know that the kernel team has done a lot to unlock things (which FreeBSD has done and we are starting to do on OpenBSD) so perhaps I can attribute the “snappiness” to that?<br>
As you can see, although there isn’t as much documentation on the Internet for this BSD, you can get a really nice, functional desktop out of it with some simple (and intuitive) configuration.  I’m really looking forward to living in this system for a while and learning about it.  Probably the first thing I’ll do is ring up the port maintainer for Lumina and see if we can’t collaborate on getting Lumina 1.3 moved over to it!  Give this one a try – I think you’ll find that its a very nice operating system with some very cool features (the HAMMER filesystem for one!).</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/porting_netbsd_to_allwinner_h3" rel="nofollow">Porting NetBSD to Alwinner H3 SoCs</a></h3>

<ul>
<li>Jared McNeill writes on the the NetBSD blog:</li>
</ul>

<blockquote>
<p>A new SUNXI evbarm kernel has appeared recently in NetBSD -current with support for boards based on the Allwinner H3 system on a chip (SoC). The H3 SoC is a quad-core Cortex-A7 SoC designed primarily for set-top boxes, but has managed to find its way into many single-board computers (SBC). This is one of the first evbarm ports built from the ground up with device tree support, which helps us to use a single kernel config to support many different boards.<br>
To get these boards up and running, first we need to deal with low-level startup code. For the SUNXI kernel this currently lives in sys/arch/evbarm/sunxi/. The purpose of this code is fairly simple; initialize the boot CPU and initialize the MMU so we can jump to the kernel. The initial MMU configuration needs to cover a few things -- early on we need to be able to access the kernel, UART debug console, and the device tree blob (DTB) passed in from U-Boot. We wrap the kernel in a U-Boot header that claims to be a Linux kernel; this is no accident! This tells U-Boot to use the Linux boot protocol when loading the kernel, which ensures that the DTB (loaded by U-Boot) is processed and passed to us in r2.<br>
Once the CPU and MMU are ready, we jump to the generic ARM FDT implementation of initarm in sys/arch/evbarm/fdt/fdt_machdep.c. The first thing this code does is validate and relocate the DTB data. After it has been relocated, we compare the compatible property of the root node in the device tree with the list of ARM platforms compiled into the kernel. The Allwinner sunxi platform code lives in sys/arch/arm/sunxi/sunxi_platform.c. The sunxi platform code provides SoC-specific versions of code needed early at boot. We need to know how to initialize the debug console, spin up application CPUs, reset the board, etc.<br>
With a bit of luck, we&#39;re now booting and enumerating devices. Apart from a few devices, almost nothing works yet as we are missing a driver for the CCU. The CCU in the Allwinner H3 SoC controls PLLs and most of the clock generation, division, muxing, and gating. Since there are many similarities between Allwinner SoCs, I opted to write generic CCU code and then SoC-specific frontends. The resulting code lives in sys/arch/arm/sunxi/; generic code as sunxi_ccu.c and H3-specific code in sun8i_h3_ccu.c.</p>
</blockquote>

<ul>
<li>Jared has more information about porting and also provides a boot log.
***</li>
</ul>

<h3><a href="https://www.trueos.org/blog/community-spotlight/" rel="nofollow">TrueOS Community Spotlight: Reset ZFS Replication using the command line</a></h3>

<blockquote>
<p>We’d like to spotlight TrueOS community member Brad Alexander for documenting his experience repairing ZFS dataset replication with TrueOS. Thank you! His notes are posted here, and they’ve been added to the TrueOS handbook Troubleshooting section for later reference.</p>
</blockquote>

<ul>
<li>Original indications</li>
</ul>

<blockquote>
<p>The SysAdm Client tray icon was pulsing red. Right-clicking on the icon and clicking Messages would show the message:</p>
</blockquote>

<p><code>FAILED replication task on NCC74602 -&gt; 192.168.47.20: LOGFILE: /var/log/lpreserver/lpreserver_failed.log</code></p>

<blockquote>
<p>/var/log/lpreserver/lastrep-send.log shows very little information:</p>

<pre><code>send from @auto-2017-07-12-01-00-00 to NCC74602/ROOT/12.0-CURRENT-up-20170623_120331@auto-2017-07-14-01-00-00
total estimated size is 0
TIME        SENT    SNAPSHOT
</code></pre>

<p>And no useful errors were being written to the lpreserver_failed.log.</p>
</blockquote>

<ul>
<li>Repairing replication

<ul>
<li>First attempt:</li>
</ul></li>
</ul>

<blockquote>
<p>The first approach I tried was to use the Sysadm Client:<br>
I clicked on the dataset in question, then clicked Initialize. After waiting a few minutes, I clicked Start. I was immediately rewarded with a pulsing red icon in the system tray and received the same messages as above.</p>
</blockquote>

<ul>
<li>Second attempt:</li>
</ul>

<blockquote>
<p>I was working with, and want to specially thank @RodMyers and @NorwegianRockCat. They suggested I use the lpreserver command line. So I issued these commands:</p>

<pre><code>sudo lpreserver replicate init NCC74602 192.168.47.20
sudo lpreserver replicate run NCC74602 192.168.47.20
</code></pre>

<p>Unfortunately, the replication failed again. I got these messages in the logs:</p>

<pre><code>Fri Jul 14 09:03:34 EDT 2017: Removing NX80101/archive/yukon.sonsofthunder.nanobit.org/ROOT - re-created locally
cannot unmount &#39;/mnt/NX80101/archive/yukon.sonsofthunder.nanobit.org/ROOT&#39;: Operation not permitted
Failed creating remote dataset!
cannot create &#39;NX80101/archive/yukon.sonsofthunder.nanobit.org/ROOT&#39;: dataset already exists
</code></pre>

<p>It turned out there were a number of children. I logged into luna (the FreeNAS) and issued this command as root: </p>
</blockquote>

<p><code>zfs destroy -r NX80101/archive/defiant.sonsofthunder.nanobit.org</code></p>

<blockquote>
<p>I then ran the replicate init and replicate run commands again from the TrueOS host, and replication worked! It has continued to work too, at least until the next fiddly bit breaks.</p>

<hr>
</blockquote>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170701170044" rel="nofollow">Kernel relinking status from Theo de Raadt</a></h3>

<blockquote>
<p>As you may have heard (and as was mentioned in an earlier article), on recent OpenBSD snapshots we have KARL, which means that the kernel is relinked so each boot comes with a new kernel where all .o files are linked in random order and with random offsets. Theo de Raadt summarized the status in a message to the tech@ mailing list, subject kernel relinking as follows:</p>

<p>5 weeks ago at d2k17 I started work on randomized kernels. I&#39;ve been having conversations with other developers for nearly 5 years on the topic... but never got off to a good start, probably because I was trying to pawn the work off on others.<br>
Having done this, I really had no idea we&#39;d end up where we are today.<br>
Here are the behaviours:<br>
The base set has grown, it now includes a link-kit<br>
At install time, a unique kernel is built from this link-kit<br>
At upgrade time, a unique kernel is built<br>
At boot time, a unique kernel is built and installed for the next boot<br>
If someone compiles their own kernel and uses &#39;make install&#39;, the link-kit is also updated, so that the next boot can do the work<br>
If a developer cp&#39;s a kernel to /, the mechanism dis-engages until a &#39;make install&quot; or upgrade is performed in the future. That may help debugging.<br>
A unique kernel is linked such that the startup assembly code is kept in the same place, followed by randomly-sized gapping, followed by all the other .o files randomly re-organized. As a result the distances between functions and variables are entirely new. An info leak of a pointer will not disclose other pointers or objects. This may also help reduce gadgets on variable-sized architectures, because polymorphism in the instruction stream is damaged by nested offsets changing.<br>
At runtime, the kernel can unmap it&#39;s startup code. On architectures where an unmap isn&#39;t possible due to large-PTE use, the code can be trashed instead.<br>
I did most of the kernel work on amd64 first, then i386. I explained what needed to be done to visa and patrick, who handled the arm and mips platforms. Then I completed all the rest of the architectures. Some architecture are missing the unmap/trashing of startup code, that&#39;s a step we need to get back to.<br>
The next part was tricky and I received assistance from tb and rpe. We had to script the behaviours at build time, snapshot time, relink time, boot time, and later on install/upgrade time also.<br>
While they helped, I also worked to create the &quot;gap.o&quot; file without use of a C compiler so that relinks can occur without the &quot;comp&quot; set installed. This uses the linkscript feature of ld. I don&#39;t think anyone has done this before. It is little bit fragile, and the various linkers may need to receive some fixes due to what I&#39;ve encountered.<br>
To ensure this security feature works great in the 6.2 release, please test snapshots. By working well, I mean it should work invisibly, without any glitch such as a broken kernel or anything. If there are ugly glitches we would like to know before the release.</p>

<p>You heard the man, now is the time to test and get a preview of the new awsomeness that will be in OpenBSD 6.2.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170704122507" rel="nofollow">Beta Undeadly call for testing</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/2972" rel="nofollow">Absolute FreeBSD 3rd Edition Update</a></li>
<li><a href="http://mail-index.netbsd.org/tech-repository/2017/06/10/msg000637.html" rel="nofollow">New home for the NetBSD repository conversion</a></li>
<li><a href="https://www.trueos.org/blog/trueos-unstable-update-71417/" rel="nofollow">TrueOS unstable Update: 7/14/17</a></li>
<li><a href="https://www.mappingthejourney.com/single-post/2017/07/06/Episode-4-Interview-with-George-Neville-Neil-President-of-FreeBSD" rel="nofollow">Interview with George Neville-Neil - President of the FreeBSD Foundation</a></li>
<li><a href="https://marc.info/?l=openbsd-announce&m=149993703415746" rel="nofollow">LibreSSL 2.5.5, 2.6.0 released</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/30EY7GZ#wrap" rel="nofollow">Jason - Byhve VM UEFI woes</a></li>
<li><a href="http://dpaste.com/39X6YSQ#wrap" rel="nofollow">Donald - Several Questions</a></li>
<li><a href="http://dpaste.com/3B50ZRV#wrap" rel="nofollow">Dan - Several Questions</a></li>
<li><a href="http://dpaste.com/08C43XN#wrap" rel="nofollow">Bryson - Jails</a>
***</li>
</ul>

<h2>Final Note</h2>

<ul>
<li>We’ve decided to do something different for a change of pace and let you the audience interview Allan and Benedict.</li>
<li>Getting our entire audience live when we record would be a challenge, so instead we want you to send in your questions for Allan and Benedict.</li>
<li>This interview is not going to be like our typical support feedback questions.  This is a chance for you, our audience, to ask Allan and Benedict any questions that you’ve been wondering over the years.</li>
<li>Questions like… “Of all the conferences you&#39;ve gone to, what was your favorite and why?”</li>
<li>We will answer the questions during a random week during the month of September.  Send all your questions to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> with the subject of “viewer interview questions”</li>
<li>We reserve the right to not answer questions which we feel are inappropriate or trolling.
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSD Now, we clear up some ZFS FUD, show you how to write a NetBSD kernel module, and cover DragonflyBSD on the desktop.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.fosketts.net/2017/07/10/zfs-best-filesystem-now/" rel="nofollow">ZFS is the best file system (for now)</a></h3>

<ul>
<li>In my ongoing effort to fight misinformation and FUD about ZFS, I would like to go through this post in detail and share my thoughts on the current state and future of OpenZFS.</li>
<li>The post starts with:</li>
</ul>

<blockquote>
<p>ZFS should have been great, but I kind of hate it: ZFS seems to be trapped in the past, before it was sidelined it as the cool storage project of choice; it’s inflexible; it lacks modern flash integration; and it’s not directly supported by most operating systems. But I put all my valuable data on ZFS because it simply offers the best level of data protection in a small office/home office (SOHO) environment. Here’s why.<br>
When ZFS first appeared in 2005, it was absolutely with the times, but it’s remained stuck there ever since. The ZFS engineers did a lot right when they combined the best features of a volume manager with a “zettabyte-scale” filesystem in Solaris 10<br>
The skies first darkened in 2007, as NetApp sued Sun, claiming that their WAFL patents were infringed by ZFS. Sun counter-sued later that year, and the legal issues dragged on.</p>
</blockquote>

<ul>
<li>The lawsuit was resolved, and it didn’t really impede ZFS. Some say it is the reason that Apple didn’t go with ZFS, but there are other theories too.</li>
</ul>

<blockquote>
<p>By then, Sun was hitting hard times and Oracle swooped in to purchase the company. This sowed further doubt about the future of ZFS, since Oracle did not enjoy wide support from open source advocates.</p>
</blockquote>

<ul>
<li>Yes, Oracle taking over Sun and closing the source for ZFS definitely seemed like a setback at the time, but the OpenZFS project was started and active development has continued as an ever increasing pace. As of today, more than half of the code in OpenZFS has been written since the fork from the last open version of Oracle ZFS.</li>
</ul>

<blockquote>
<p>the CDDL license Sun applied to the ZFS code was [<a href="https://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/%5D(judged" rel="nofollow">https://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/](judged</a> incompatible) with the GPLv2 that covers Linux, making it a non-starter for inclusion in the world’s server operating system.</p>
</blockquote>

<ul>
<li>That hasn’t stopped the ZFS-on-Linux project, or Ubuntu…</li>
</ul>

<blockquote>
<p>Although OpenSolaris continued after the Oracle acquisition, and FreeBSD embraced ZFS, this was pretty much the extent of its impact outside the enterprise. Sure, NexentaStor and [<a href="http://blog.fosketts.net/2008/09/15/greenbytes-embraces-extends-zfs/%5D(GreenBytes)" rel="nofollow">http://blog.fosketts.net/2008/09/15/greenbytes-embraces-extends-zfs/](GreenBytes)</a> helped push ZFS forward in the enterprise, but Oracle’s lackluster commitment to Sun in the datacenter started having an impact.</p>
</blockquote>

<ul>
<li>Lots of companies have adopted OpenZFS for their products. Before OpenZFS, there were very few non-Sun appliances that used ZFS, now there are plenty.</li>
<li><a href="http://open-zfs.org/wiki/Companies" rel="nofollow">OpenZFS Wiki: Companies with products based on OpenZFS</a></li>
</ul>

<blockquote>
<p>OpenZFS remains little-changed from what we had a decade ago.</p>
</blockquote>

<ul>
<li>Other than the fact that half of the current code did not exist a decade ago…</li>
</ul>

<blockquote>
<p>Many remain skeptical of deduplication, which hogs expensive RAM in the best-case scenario.</p>
</blockquote>

<ul>
<li>This is one of the weaker points in ZFS. As it turns out, the demand for deduplication is actually not that strong. Most of the win can be had with transparent compression.</li>
<li>However, there are a number of suggested designs to work around the dedup problems:

<ul>
<li>Dedup Ceiling: Set a limit on the side of the DDT and just stop deduping new unique blocks when this limit is reached.</li>
<li>Allocation Classes: A feature being developed by Intel for a supercomputer, will allow different types of data to be classified, and dedicated vdevs (or even metaslabs within a vdev), to be dedicated to that class of data. This could be extended to having the DDT live on a fast device like an PCIe NVMe, combined with the Dedup Ceiling when the device is full.</li>
<li>DDT Pruning: Matt Ahrens described a design where items in the DDT with only a single reference, would be expired in an LRU type fashion, to allow newer blocks to live in the DDT in hopes that they would end up with more than a single reference. This doesn’t cause bookkeeping problems since when a block is about to be freed, if it is NOT listed in the DDT, ZFS knows it was never deduplicated, so the current block must be the only reference, and it can safely be freed. This provides a best case scenario compared to Dedup Ceiling, since blocks that will deduplicate well, are likely to be written relatively close together, whereas the chance to a dedup match on a very old block is much lower.</li>
</ul></li>
</ul>

<blockquote>
<p>And I do mean expensive: Pretty much every ZFS FAQ flatly declares that ECC RAM is a must-have and 8 GB is the bare minimum. In my own experience with FreeNAS, 32 GB is a nice amount for an active small ZFS server, and this costs $200-$300 even at today’s prices.</p>
</blockquote>

<ul>
<li>As we talked about a few weeks ago, ECC is best, but it is not required. If you want your server to stay up for a long time, to be highly available, you’ll put ECC in it. Don’t let a lack of ECC stop you from using ZFS, you are just putting your data at more risk. The scrub of death is a myth.</li>
<li>ZFS does not ‘require’ lots of ram. Your NAS will work happily with 8 GB instead of 32 GB of RAM. Its cache hit ratio will be much lower, so performance will be worse. It won’t be able to buffer as many writes, so performance will be worse.</li>
<li>Copy-on-Write has some drawbacks, data tends to get scattered and fragmented across the drives when it is written gradually. The ARC (RAM Cache) lessens the pain of this, and allows ZFS to batch incoming writes up into nice contiguous writes. ZFS purposely alternates between reading and writing, since both are faster when the other is not happening. So writes are batched up until there is too much dirty data, or the timeout expires. Then reads are held off while the bulk linear write finishes as quickly as possible, and reads are resumed.</li>
<li>Obviously all of this works better and more efficiently in larger batches, which you can do if you have more RAM.</li>
<li>ZFS can be tuned to use less RAM, and if you do not have a lot of RAM, or you have a lot of other demand on your RAM, you should do that tuning.</li>
</ul>

<blockquote>
<p>And ZFS never really adapted to today’s world of widely-available flash storage: Although flash can be used to support the ZIL and L2ARC caches, these are of dubious value in a system with sufficient RAM, and ZFS has no true hybrid storage capability. It’s laughable that the ZFS documentation obsesses over a few GB of SLC flash when multi-TB 3D NAND drives are on the market. And no one is talking about NVMe even though it’s everywhere in performance PC’s.</p>
</blockquote>

<ul>
<li>Make up your mind, is 32GB of ram too expensive or not…</li>
<li>the L2ARC exists specifically for the case where it is not possible to just install more RAM. Be it because there are no more slots, of limits of the processor, or limits of your budget.</li>
<li>The SLOG is optional, but it never needs to be very big. A number of GBs of SLC flash is all you need, it is only holding writes that have not been flushed to the regular storage devices yet. The reason the documentation talks about SLC specifically is because your SLOG needs a very high write endurance, something never the newest NVMe devices cannot yet provide. </li>
<li>Of course you can use NVMe devices with ZFS, lots of people do. All flash ZFS arrays are for sale right now. Other than maybe a little tuning of the device queue depths, ZFS just works and there is nothing to think about.</li>
<li>However, to say there is nothing happening in this space is woefully inaccurate.</li>
<li>The previously mentioned allocation classes code can be used to allocate metadata (4 KB blocks) on SSD or NVMe, while allocating bulk storage data (up to 16 MB blocks) on spinning disks. Extended a bit beyond what Intel is building for their super computer, this will basically create hybrid storage for ZFS.</li>
<li>With the metaslab classes feature, it will even be possible to mix classes on the same device, grouping small allocations and large allocations in different areas, decreasing fragmentation.</li>
</ul>

<blockquote>
<p>Then there’s the question of flexibility, or lack thereof. Once you build a ZFS volume, it’s pretty much fixed for life. There are only three ways to expand a storage pool:</p>

<ol>
<li>Replace each and every drive in the pool with a larger one (which is great but limiting and expensive)</li>
</ol>
</blockquote>

<ul>
<li>It depends on your pool layout. If you design with this in mind using ZFS Mirrors, it can be quite useful</li>
</ul>

<blockquote>
<ol>
<li>Add a stripe on another set of drives (which can lead to imbalanced performance and redundancy and a whole world of potential stupid stuff)</li>
</ol>
</blockquote>

<ul>
<li>The unbalanced LUNs performance issues were sorted out in 2013-2016. </li>
<li><a href="http://open-zfs.org/w/images/3/31/Performance-George_Wilson.pdf" rel="nofollow">2014: OpenZFS Allocation Performance </a></li>
<li><a href="http://www.bsdcan.org/2016/schedule/events/710.en.html" rel="nofollow">2016: OpenZFS space allocation: doubling performance on large and fragmented pools</a></li>
<li>These also mostly solved the performance issues when a pool gets full, you can run a lot closer to the edge now</li>
</ul>

<blockquote>
<ol>
<li>Build a new pool and “zfs send” your datasets to it (which is what I do, even though it’s kind of tricky)</li>
</ol>
</blockquote>

<ul>
<li>This is one way to do it, yes.</li>
<li>There is another way coming, but I can’t talk about it just yet. Look for big news later this year.</li>
</ul>

<blockquote>
<p>Apart from option 3 above, you can’t shrink a ZFS pool.</p>
</blockquote>

<ul>
<li>Device removal is arriving now. It will not work for RAIDZ*, but for Mirrors and Stripes you will be able to remove a device.</li>
</ul>

<blockquote>
<p>I’ve probably made ZFS sound pretty unappealing right about now. It was revolutionary but now it’s startlingly limiting and out of touch with the present solid-state-dominated storage world.</p>
</blockquote>

<ul>
<li>I don’t feel like ZFS is out of touch with solid state. Lots of people are running SSD only pools. I will admit the tiered storage options in ZFS are a bit limited still, but there is a lot of work being done to overcome this.</li>
</ul>

<blockquote>
<p>After all, reliably storing data is the only thing a storage system really has to do. All my important data goes on ZFS, from photos to music and movies to office files. It’s going to be a long time before I trust anything other than ZFS!</p>

<ul>
<li>I agree.</li>
<li>ZFS has a great track record of doing its most important job, keeping your data safe.</li>
<li>Work is ongoing to make ZFS more performance, and more flexible. The import thing is that this work is never allowed to compromise job #1, keeping your data safe.</li>
<li>Hybrid/tiered storage features, re-RAID-ing, are coming</li>
<li>There is a lot going on with OpenZFS, check out the notes from the last two OpenZFS Developer Summits just to get an idea of what some of those things are: </li>
</ul>
</blockquote>

<p><a href="http://open-zfs.org/wiki/OpenZFS_Developer_Summit_2015" rel="nofollow">2015</a> &amp; <a href="http://open-zfs.org/wiki/OpenZFS_Developer_Summit_2016" rel="nofollow">2016</a></p>

<ul>
<li><p>Some highlights:</p>

<ul>
<li>Compressed ARC</li>
<li>Compressed send/recv</li>
<li>ABD (arc buf scatter/gather)</li>
<li>ZFS Native Encryption (scrub/resilver, send/recv, etc without encryption keys loaded)</li>
<li>Channel Programs (do many administrative operations as one atomic transaction)</li>
<li>Device Removal</li>
<li>Redacted send/recv</li>
<li>ZStandard Compression</li>
<li>TRIM Support (FreeBSD has its own, but this will be more performant and universal)</li>
<li><a href="https://youtu.be/SZFwv8BdBj4" rel="nofollow">Faster Scrub/Resilver</a></li>
<li><a href="https://youtu.be/MxKohtFSB4M" rel="nofollow">Declustered RAID</a></li>
<li><a href="https://youtu.be/28fKiTWb2oM" rel="nofollow">Allocation Classes</a></li>
<li>Multi-mount protection (for Active/Passive failover)</li>
<li>Zpool Checkpoint (undo almost anything)</li>
<li>Even more Improved Allocator Performance</li>
<li>vdev spacemap log</li>
<li>ZIL performance improvements (w/ or w/o SLOG)</li>
<li>Persistent L2ARC</li>
</ul></li>
<li><p>What I don’t think the author of this article understands is how far behind every other filesystem is. 100s of Engineer years have gone into OpenZFS, and the pace is accelerating. I don’t see how BtrFS can ever catch up, without a huge cash infusion.</p>

<hr></li>
</ul>

<h3><a href="https://saurvs.github.io/post/writing-netbsd-kern-mod/" rel="nofollow">Writing a NetBSD kernel module</a></h3>

<blockquote>
<p>Kernel modules are object files used to extend an operating system’s kernel functionality at run time.<br>
In this post, we’ll look at implementing a simple character device driver as a kernel module in NetBSD. Once it is loaded, userspace processes will be able to write an arbitrary byte string to the device, and on every successive read expect a cryptographically-secure pseudorandom permutation of the original byte string.</p>
</blockquote>

<ul>
<li>You will need the NetBSD Source Code.

<ul>
<li><a href="https://www.netbsd.org/docs/guide/en/chap-fetch.html" rel="nofollow">This doc</a> will explain how you can get it.</li>
</ul></li>
<li>The article gives an easy line by line walkthrough which is easy to follow and understand.</li>
<li>The driver implements the bare minimum: open, close, read, and write, plus the module initialization function</li>
<li>It explains the differences in how memory is allocated and freed in the kernel</li>
<li>It also describes the process of using UIO to copy data back and forth between userspace and the kernel</li>
<li>Create a Makefile, and compile the kernel module</li>
<li>Then, create a simple userspace program to use the character device that the kernel module creates</li>
<li><a href="https://github.com/saurvs/rperm-netbsd" rel="nofollow">All the code is available here</a>
***</li>
</ul>

<h3><a href="https://functionallyparanoid.com/2017/07/11/dragonflybsd-desktop/" rel="nofollow">DragonFlyBSD Desktop!</a></h3>

<blockquote>
<p>If you read my <a href="https://functionallyparanoid.com/2017/06/30/boot-all-the-things/" rel="nofollow">last post</a>, you know that I set up a machine (Thinkpad x230) with UEFI and four operating systems on it.  One, I had no experience with – DragonFlyBSD (other than using Matthew Dillon’s C compiler for the Amiga back in the day!) and so it was uncharted territory for me.  After getting the install working, I started playing around inside of DragonFlyBSD and discovered to my delight that it was a great operating system with some really unique features – all with that BSD commitment to good documentation and a solid coupling of kernel and userland that doesn’t exist (by design) in Linux.<br>
So my goal for my DragonFlyBSD desktop experience was to be as BSD as I possibly could.  Given that (and since I’m the maintainer of the port on OpenBSD <grin>), I went with Lumina as the desktop environment and XDM as the graphical login manager.  I have to confess that I really like the xfce terminal application so I wanted to make sure I had that as well.  Toss in Firefox, libreOffice and ownCloud sync client and I’m good to go!<br>
OK.  So where to start.  First, we need to get WiFi and wired networking happening for the console at login.  To do that, I added the following to /etc/rc.conf:</p>

<pre><code>wlans_iwn0=”wlan0″
ifconfig_wlan0=”WPA DHCP”
ifconfig_em0=”DHCP”
</code></pre>

<p>I then edited /etc/wpa_supplicant.conf to put in the details of my WiFi network:</p>

<pre><code>network={
ssid=”MY-NETWORK-NAME”
psk=”my-super-secret-password”
}
</code></pre>

<p>A quick reboot showed that both wired and wireless networking were functional and automatically were assigned IP addresses via DHCP.  Next up is to try getting into X with whatever DragonFlyBSD uses for its default window manager.  A straight up “startx” met with, shall we say, less than stellar results.  Therefore, I used the following command to generate a simple /etc/X11/xorg.conf file:</p>

<pre><code>&amp;#35; Xorg -configure
&amp;#35; cp /root/xorg.conf.new /etc/X11/xorg.conf
</code></pre>

<p>With that file in place, I could get into the default window manager, but I had no mouse.  After some searching and pinging folks on the mailing list, I was able to figure out what I needed to do.  I added the following to my /etc/rc.conf file:</p>

<pre><code>moused_enable=”YES”
moused_type=”auto”
moused_port=”/dev/psm0″
</code></pre>

<p>I rebooted (I’m sure there is an easier way to get the changes but I don’t know it… yet) and was able to get into a basic X session and have a functional mouse.  Next up, installing and configuring Lumina!  To do that, I went through the incredibly torturous process of installing Lumina:</p>
</blockquote>

<p><code># pkg install lumina</code></p>

<blockquote>
<p>Wow!  That was really, really hard.  I might need to pause here to catch my breath. 🙂</p>

<p>Next up, jumping into Lumina from the console.  To do that, I created a .xinitrc file in my home directory with the following:</p>
</blockquote>

<p><code>exec start-lumina-desktop</code></p>

<blockquote>
<p>From there, I could “startx” until my heart was content and bounce into Lumina.  That wasn’t good enough though!  I want a graphical login (specifically xdm).  To do that, I had to do a little research.  The trick on DragonFlyBSD is not to add anything to /etc/rc.conf like you do in other BSDs, it’s a bit more old school.  Basically you need to edit the /etc/ttys file and update ttyv8 to turn on the xdm daemon:</p>
</blockquote>

<p><code>ttyv8    “/usr/X11R6/bin/xdm -nodaemon”    xterm    on    secure</code></p>

<blockquote>
<p>The other thing you need to do is set it up to use your desktop environment of choice.  In my case, that’s Lumina.  To do that, I needed to edit /usr/local/lib/X11/xdm/Xsession and change the next to the last line in the file to launch Lumina:</p>
</blockquote>

<p><code>exec /usr/local/bin/start-lumina-desktop</code></p>

<blockquote>
<p>I then crossed my fingers, rebooted and lo and behold had a graphical login that, when I actually didn’t fat finger my password from excitement, put me into the Lumina desktop environment!<br>
Next up – I need a cool desktop wallpaper.  Of course that’s way more important that installing application or other stuff!  After some searching, I found this one that met my needs.  I downloaded it to a local ~/Pictures directory and then used the Lumina wallpaper preference application to add the directory containing the picture and set it to automatic layout.  Voila!  I had a cool DragonFlyBSD wallpaper.<br>
Next I installed the xfce4 terminal program by doing:</p>
</blockquote>

<p><code># pkg install xfce4-terminal</code></p>

<blockquote>
<p>I then went into the Lumina “All Desktop Settings” preferences, found the applet for the “Menu” under “Interface Configuration” and swapped out “terminal” for “Xfce Terminal”.  I then configured Lumina further to have a 26 pixel thick, 99% length bottom center panel with the following gadgets in it (in this order):</p>

<pre><code>Start Menu
Task Manager (No Groups)
Spacer
System Tray
Time/Date
Battery Monitor
</code></pre>

<p>I then went into my Appearance | Window Manager gadget and set my Window Theme to “bora_blue” (my favorite out of the defaults supplied).  I then installed my remaining applications that I needed in order to have a functioning desktop:</p>
</blockquote>

<p><code># pkg install owncloudclient qtkeychain evolution evolution-ews firefox libreoffice</code></p>

<blockquote>
<p>After that, I really had a nicely functioning desktop environment!  By the way, the performance of DragonFlyBSD is pretty impressive in terms of its day to day usage.  Keep in mind I’m not doing any official benchmarking or anything, but it sure feels to me to be just as fast (if not faster) than OpenBSD and FreeBSD.  I know that the kernel team has done a lot to unlock things (which FreeBSD has done and we are starting to do on OpenBSD) so perhaps I can attribute the “snappiness” to that?<br>
As you can see, although there isn’t as much documentation on the Internet for this BSD, you can get a really nice, functional desktop out of it with some simple (and intuitive) configuration.  I’m really looking forward to living in this system for a while and learning about it.  Probably the first thing I’ll do is ring up the port maintainer for Lumina and see if we can’t collaborate on getting Lumina 1.3 moved over to it!  Give this one a try – I think you’ll find that its a very nice operating system with some very cool features (the HAMMER filesystem for one!).</p>

<hr>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="http://blog.netbsd.org/tnf/entry/porting_netbsd_to_allwinner_h3" rel="nofollow">Porting NetBSD to Alwinner H3 SoCs</a></h3>

<ul>
<li>Jared McNeill writes on the the NetBSD blog:</li>
</ul>

<blockquote>
<p>A new SUNXI evbarm kernel has appeared recently in NetBSD -current with support for boards based on the Allwinner H3 system on a chip (SoC). The H3 SoC is a quad-core Cortex-A7 SoC designed primarily for set-top boxes, but has managed to find its way into many single-board computers (SBC). This is one of the first evbarm ports built from the ground up with device tree support, which helps us to use a single kernel config to support many different boards.<br>
To get these boards up and running, first we need to deal with low-level startup code. For the SUNXI kernel this currently lives in sys/arch/evbarm/sunxi/. The purpose of this code is fairly simple; initialize the boot CPU and initialize the MMU so we can jump to the kernel. The initial MMU configuration needs to cover a few things -- early on we need to be able to access the kernel, UART debug console, and the device tree blob (DTB) passed in from U-Boot. We wrap the kernel in a U-Boot header that claims to be a Linux kernel; this is no accident! This tells U-Boot to use the Linux boot protocol when loading the kernel, which ensures that the DTB (loaded by U-Boot) is processed and passed to us in r2.<br>
Once the CPU and MMU are ready, we jump to the generic ARM FDT implementation of initarm in sys/arch/evbarm/fdt/fdt_machdep.c. The first thing this code does is validate and relocate the DTB data. After it has been relocated, we compare the compatible property of the root node in the device tree with the list of ARM platforms compiled into the kernel. The Allwinner sunxi platform code lives in sys/arch/arm/sunxi/sunxi_platform.c. The sunxi platform code provides SoC-specific versions of code needed early at boot. We need to know how to initialize the debug console, spin up application CPUs, reset the board, etc.<br>
With a bit of luck, we&#39;re now booting and enumerating devices. Apart from a few devices, almost nothing works yet as we are missing a driver for the CCU. The CCU in the Allwinner H3 SoC controls PLLs and most of the clock generation, division, muxing, and gating. Since there are many similarities between Allwinner SoCs, I opted to write generic CCU code and then SoC-specific frontends. The resulting code lives in sys/arch/arm/sunxi/; generic code as sunxi_ccu.c and H3-specific code in sun8i_h3_ccu.c.</p>
</blockquote>

<ul>
<li>Jared has more information about porting and also provides a boot log.
***</li>
</ul>

<h3><a href="https://www.trueos.org/blog/community-spotlight/" rel="nofollow">TrueOS Community Spotlight: Reset ZFS Replication using the command line</a></h3>

<blockquote>
<p>We’d like to spotlight TrueOS community member Brad Alexander for documenting his experience repairing ZFS dataset replication with TrueOS. Thank you! His notes are posted here, and they’ve been added to the TrueOS handbook Troubleshooting section for later reference.</p>
</blockquote>

<ul>
<li>Original indications</li>
</ul>

<blockquote>
<p>The SysAdm Client tray icon was pulsing red. Right-clicking on the icon and clicking Messages would show the message:</p>
</blockquote>

<p><code>FAILED replication task on NCC74602 -&gt; 192.168.47.20: LOGFILE: /var/log/lpreserver/lpreserver_failed.log</code></p>

<blockquote>
<p>/var/log/lpreserver/lastrep-send.log shows very little information:</p>

<pre><code>send from @auto-2017-07-12-01-00-00 to NCC74602/ROOT/12.0-CURRENT-up-20170623_120331@auto-2017-07-14-01-00-00
total estimated size is 0
TIME        SENT    SNAPSHOT
</code></pre>

<p>And no useful errors were being written to the lpreserver_failed.log.</p>
</blockquote>

<ul>
<li>Repairing replication

<ul>
<li>First attempt:</li>
</ul></li>
</ul>

<blockquote>
<p>The first approach I tried was to use the Sysadm Client:<br>
I clicked on the dataset in question, then clicked Initialize. After waiting a few minutes, I clicked Start. I was immediately rewarded with a pulsing red icon in the system tray and received the same messages as above.</p>
</blockquote>

<ul>
<li>Second attempt:</li>
</ul>

<blockquote>
<p>I was working with, and want to specially thank @RodMyers and @NorwegianRockCat. They suggested I use the lpreserver command line. So I issued these commands:</p>

<pre><code>sudo lpreserver replicate init NCC74602 192.168.47.20
sudo lpreserver replicate run NCC74602 192.168.47.20
</code></pre>

<p>Unfortunately, the replication failed again. I got these messages in the logs:</p>

<pre><code>Fri Jul 14 09:03:34 EDT 2017: Removing NX80101/archive/yukon.sonsofthunder.nanobit.org/ROOT - re-created locally
cannot unmount &#39;/mnt/NX80101/archive/yukon.sonsofthunder.nanobit.org/ROOT&#39;: Operation not permitted
Failed creating remote dataset!
cannot create &#39;NX80101/archive/yukon.sonsofthunder.nanobit.org/ROOT&#39;: dataset already exists
</code></pre>

<p>It turned out there were a number of children. I logged into luna (the FreeNAS) and issued this command as root: </p>
</blockquote>

<p><code>zfs destroy -r NX80101/archive/defiant.sonsofthunder.nanobit.org</code></p>

<blockquote>
<p>I then ran the replicate init and replicate run commands again from the TrueOS host, and replication worked! It has continued to work too, at least until the next fiddly bit breaks.</p>

<hr>
</blockquote>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170701170044" rel="nofollow">Kernel relinking status from Theo de Raadt</a></h3>

<blockquote>
<p>As you may have heard (and as was mentioned in an earlier article), on recent OpenBSD snapshots we have KARL, which means that the kernel is relinked so each boot comes with a new kernel where all .o files are linked in random order and with random offsets. Theo de Raadt summarized the status in a message to the tech@ mailing list, subject kernel relinking as follows:</p>

<p>5 weeks ago at d2k17 I started work on randomized kernels. I&#39;ve been having conversations with other developers for nearly 5 years on the topic... but never got off to a good start, probably because I was trying to pawn the work off on others.<br>
Having done this, I really had no idea we&#39;d end up where we are today.<br>
Here are the behaviours:<br>
The base set has grown, it now includes a link-kit<br>
At install time, a unique kernel is built from this link-kit<br>
At upgrade time, a unique kernel is built<br>
At boot time, a unique kernel is built and installed for the next boot<br>
If someone compiles their own kernel and uses &#39;make install&#39;, the link-kit is also updated, so that the next boot can do the work<br>
If a developer cp&#39;s a kernel to /, the mechanism dis-engages until a &#39;make install&quot; or upgrade is performed in the future. That may help debugging.<br>
A unique kernel is linked such that the startup assembly code is kept in the same place, followed by randomly-sized gapping, followed by all the other .o files randomly re-organized. As a result the distances between functions and variables are entirely new. An info leak of a pointer will not disclose other pointers or objects. This may also help reduce gadgets on variable-sized architectures, because polymorphism in the instruction stream is damaged by nested offsets changing.<br>
At runtime, the kernel can unmap it&#39;s startup code. On architectures where an unmap isn&#39;t possible due to large-PTE use, the code can be trashed instead.<br>
I did most of the kernel work on amd64 first, then i386. I explained what needed to be done to visa and patrick, who handled the arm and mips platforms. Then I completed all the rest of the architectures. Some architecture are missing the unmap/trashing of startup code, that&#39;s a step we need to get back to.<br>
The next part was tricky and I received assistance from tb and rpe. We had to script the behaviours at build time, snapshot time, relink time, boot time, and later on install/upgrade time also.<br>
While they helped, I also worked to create the &quot;gap.o&quot; file without use of a C compiler so that relinks can occur without the &quot;comp&quot; set installed. This uses the linkscript feature of ld. I don&#39;t think anyone has done this before. It is little bit fragile, and the various linkers may need to receive some fixes due to what I&#39;ve encountered.<br>
To ensure this security feature works great in the 6.2 release, please test snapshots. By working well, I mean it should work invisibly, without any glitch such as a broken kernel or anything. If there are ugly glitches we would like to know before the release.</p>

<p>You heard the man, now is the time to test and get a preview of the new awsomeness that will be in OpenBSD 6.2.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170704122507" rel="nofollow">Beta Undeadly call for testing</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/2972" rel="nofollow">Absolute FreeBSD 3rd Edition Update</a></li>
<li><a href="http://mail-index.netbsd.org/tech-repository/2017/06/10/msg000637.html" rel="nofollow">New home for the NetBSD repository conversion</a></li>
<li><a href="https://www.trueos.org/blog/trueos-unstable-update-71417/" rel="nofollow">TrueOS unstable Update: 7/14/17</a></li>
<li><a href="https://www.mappingthejourney.com/single-post/2017/07/06/Episode-4-Interview-with-George-Neville-Neil-President-of-FreeBSD" rel="nofollow">Interview with George Neville-Neil - President of the FreeBSD Foundation</a></li>
<li><a href="https://marc.info/?l=openbsd-announce&m=149993703415746" rel="nofollow">LibreSSL 2.5.5, 2.6.0 released</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/30EY7GZ#wrap" rel="nofollow">Jason - Byhve VM UEFI woes</a></li>
<li><a href="http://dpaste.com/39X6YSQ#wrap" rel="nofollow">Donald - Several Questions</a></li>
<li><a href="http://dpaste.com/3B50ZRV#wrap" rel="nofollow">Dan - Several Questions</a></li>
<li><a href="http://dpaste.com/08C43XN#wrap" rel="nofollow">Bryson - Jails</a>
***</li>
</ul>

<h2>Final Note</h2>

<ul>
<li>We’ve decided to do something different for a change of pace and let you the audience interview Allan and Benedict.</li>
<li>Getting our entire audience live when we record would be a challenge, so instead we want you to send in your questions for Allan and Benedict.</li>
<li>This interview is not going to be like our typical support feedback questions.  This is a chance for you, our audience, to ask Allan and Benedict any questions that you’ve been wondering over the years.</li>
<li>Questions like… “Of all the conferences you&#39;ve gone to, what was your favorite and why?”</li>
<li>We will answer the questions during a random week during the month of September.  Send all your questions to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> with the subject of “viewer interview questions”</li>
<li>We reserve the right to not answer questions which we feel are inappropriate or trolling.
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>202: Brokering Bind</title>
  <link>https://www.bsdnow.tv/202</link>
  <guid isPermaLink="false">9e615fd7-665a-44b7-af45-95315901cc96</guid>
  <pubDate>Wed, 12 Jul 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9e615fd7-665a-44b7-af45-95315901cc96.mp3" length="55418836" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We look at an OpenBSD setup on a new laptop, revel in BSDCan trip reports, and visit daemons and friendly ninjas.</itunes:subtitle>
  <itunes:duration>1:16:58</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We look at an OpenBSD setup on a new laptop, revel in BSDCan trip reports, and visit daemons and friendly ninjas.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenBSD and the modern laptop (http://bsdly.blogspot.de/2017/07/openbsd-and-modern-laptop.html)
Peter Hansteen has a new blog post about OpenBSD (http://www.openbsd.org/) on laptops:
Did you think that OpenBSD is suitable only for firewalls and high-security servers? Think again. Here are my steps to transform a modern mid to high range laptop into a useful Unix workstation with OpenBSD.
One thing that never ceases to amaze me is that whenever I'm out and about with my primary laptop at conferences and elsewhere geeks gather, a significant subset of the people I meet have a hard time believing that my laptop runs OpenBSD, and that it's the only system installed.
and then it takes a bit of demonstrating that yes, the graphics runs with the best available resolution the hardware can offer, the wireless network is functional, suspend and resume does work, and so forth. And of course, yes, I do use that system when writing books and articles too. Apparently heavy users of other free operating systems do not always run them on their primary workstations.
Peter goes on to describe the laptops he’s had over the years (all running OpenBSD) and after BSDCan 2017, he needed a new one due to cracks in the display.
So the time came to shop around for a replacement. After a bit of shopping around I came back to Multicom, a small computers and parts supplier outfit in rural Åmli in southern Norway, the same place I had sourced the previous one.
One of the things that attracted me to that particular shop and their own-branded offerings is that they will let you buy those computers with no operating system installed. That is of course what you want to do when you source your operating system separately, as we OpenBSD users tend to do.
The last time around I had gone for a "Thin and lightweight" 14 inch model (Thickness 20mm, weight 2.0kg) with 16GB RAM, 240GB SSD for system disk and 1TB HD for /home (since swapped out for a same-size SSD, as the dmesg will show). 
Three years later, the rough equivalent with some added oomph for me to stay comfortable for some years to come ended me with a 13.3 inch model, 18mm and advertised as 1.3kg (but actually weighing in at 1.5kg, possibly due to extra components), 32GB RAM, 512GB SSD and 2TB harddisk. For now the specification can be viewed online here (https://www.multicom.no/systemconfigurator.aspx?q=st:10637291;c:100559;fl:0#4091-10500502-1;4086-10637290-1;4087-8562157-2;4088-9101982-1;4089-9101991-1) (the site language is Norwegian, but product names and units of measure are not in fact different).
The OpenBSD installer is a wonder of straightforward, no-nonsense simplicity that simply gets the job done. Even so, if you are not yet familiar with OpenBSD, it is worth spending some time reading the OpenBSD FAQ's installation guidelines and the INSTALL.platform file (in our case, INSTALL.amd64) to familiarize yourself with the procedure. If you're following this article to the letter and will be installing a snapshot, it is worth reading the notes on following -current too.
The main hurdle back when I was installing the 2014-vintage 14" model was getting the system to consider the SSD which showed up as sd1 the automatic choice for booting (I solved that by removing the MBR, setting the size of the MBR on the hard drive that showed up as sd0 to 0 and enlarging the OpenBSD part to fill the entire drive).
+ He goes on to explain the choices he made in the installer and settings made after the reboot to set up his work environment. Peter closes with:
If you have any questions on running OpenBSD as a primary working environment, I'm generally happy to answer but in almost all cases I would prefer that you use the mailing lists such as misc@openbsd.org or the OpenBSD Facebook (https://www.facebook.com/groups/2210554563/) group so the question and hopefully useful answers become available to the general public. Browsing the slides for my recent OpenBSD and you (https://home.nuug.no/~peter/openbsd_and_you/) user group talk might be beneficial if you're not yet familiar with the system. And of course, comments on this article are welcome.
BSDCan 2017 Trip Report: Roller Angel (https://www.freebsdfoundation.org/blog/2017-bsdcan-trip-report-roller-angel/)
We could put this into next week’s show, because we have another trip report already that’s quite long.
After dropping off my luggage, I headed straight over to the Goat BoF which took place at The Royal Oak. There were already a number of people there engaged in conversation with food and drink. I sat down at a table and was delighted that the people sitting with me were also into the BSD’s and were happy to talk about it the whole time. I felt right at home from the start as people were very nice to me, and were interested in what I was working on. I honestly didn’t know that I would fit in so well.
I had a preconceived notion that people may be a bit hard to approach as they are famous and so technically advanced. At first, people seemed to only be working in smaller circles. Once you get more familiar with the faces, you realize that these circles don’t always contain the same people and that they are just people talking about specific topics. I found that it was easy to participate in the conversation and also found out that people are happy to get your feedback on the subject as well.
I was actually surprised how easily I got along with everyone and how included I felt in the activities. I volunteered to help wherever possible and got to work on the video crew that recorded the audio and slides of the talks. The people at BSDCan are incredibly easy to talk to, are actually interested in what you’re doing with BSD, and what they can do to help. It’s nice to feel welcome in the community. It’s like going home. Dan mentioned in his welcome on the first day of BSDCan that the conference is like home for many in the community.
The trip report is very detailed and chronicles the two days of the developer summit, and the two days of the conference
There was some discussion about a new code of conduct by Benno Rice who mentioned that people are welcome to join a body of people that is forming that helps work out issues related to code of conduct and forwards their recommendations on to core. Next, Allan introduced the idea of creating a process for formally discussing big project changes or similar discussions that is going to be known as FCP or FreeBSD Community Proposal. In Python we have the Python Enhancement Proposal or PEP which is very similar to the idea of FCP. I thought this idea is a great step for FreeBSD to be implementing as it has been a great thing for Python to have.
There was some discussion about taking non-code contributions from people and how to recognize those people in the project. There was a suggestion to have a FreeBSD Member status created that can be given to people whose non-code contributions are valuable to the project. This idea seemed to be on a lot of people’s minds as something that should be in place soon. The junior jobs on the FreeBSD Wiki were also brought up as a great place to look for ideas on how to get involved in contributing to FreeBSD.
Roller wasted no time, and started contributing to EdgeBSD at the conference.
On the first day of BSDCan I arrived at the conference early to coordinate with the team that records the talks. We selected the rooms that each of us would be in to do the recording and set up a group chat via WhatsApp for coordination.
Thanks to Roller, Patrick McAvoy, Calvin Hendryx-Parker, and all of the others who volunteered their time to run the video and streaming production at BSDCan, as well as all others who volunteered, even if it was just to carry a box. BSDCan couldn’t happen without the army of volunteers.
After the doc lounge, I visited the Hacker Lounge. There were already several tables full of people talking and working on various projects. In fact, there was a larger group of people who were collaborating on the new libtrue library that seemed to be having a great time. I did a little socializing and then got on my laptop and did some more work on the documentation using my new skills. I really enjoyed having a hacker lounge to go to at night.
I want to give a big thank you to the FreeBSD Foundation for approving my travel grant. It was a great experience to meet the community and participate in discussions. I’m very grateful that I was able to attend my first BSDCan. After visiting the doc lounge a few times, I managed to get comfortable using the tools required to edit the documentation. By the end of the conference, I had submitted two documentation patches to the FreeBSD Bugzilla with several patches still in progress. Prior to the conference I expected that I would be spending a lot of time working on my Onion Omega and Edge Router Lite projects that I had with me, but I actually found that there was always something fun going on that I would rather do or work on. I can always work on those projects at home anyway. I had a good time working with the FreeBSD community and will continue working with them by editing the documentation and working with Bugzilla.
One of the things I enjoy about these trip reports is when they help convince other people to make the trip to their first conference. Hopefully by sharing their experience, it will convince you to come to the next conference:
vBSDCon in Virginia, USA: Sept 7-9
EuroBSDCon in Paris, France: Sept 21-24
BSDTW in Taipei, Taiwan: November 11-12 (CFP ends July 31st)
***
BSDCan 2017 - Trip report double-p (http://undeadly.org/cgi?action=article&amp;amp;sid=20170629150641)
Prologue
Most overheard in Tokyo was "see you in Ottawaaaaah", so with additional "personal item" being Groff I returned home to plan the trip to BSDCan.
Dan was very helpful with getting all the preparations (immigration handling), thanks for that. Before I could start, I had to fix something: the handling of the goat. With a nicely created harness, I could just hang it along my backpack.
Done that it went to the airport of Hamburg and check-in for an itinerary of HAM-MUC-YUL. While the feeder leg was a common thing, boarding to YUL was great - cabin-crew likes Groff :)
Arriving in Montreal was like entering a Monsoon zone or something, sad! After the night the weather was still rain-ish but improving and i shuttled to Dorval VIARail station to take me to Ottawa (ever avoid AirCanada, right?). Train was late, but the conductor (or so) was nice to talk to - and wanted to know about Groff's facebook page :-P.
Picking a cab in Ottawa to take me to "Residence" was easy at first - just that it was the wrong one. Actually my fault and so I had a "nice, short" walk to the actual one in the rain with wrong directions. Eventually I made it and after unpacking, refreshment it was time to hit the Goat BOF!
Day 1
Since this was my first BSDCan I didnt exactly knew what to expect from this BOF. But it was like, we (Keeper, Dan, Allan, ..) would talk about "who's next" and things like that. How mistaken I was :). Besides the sheer amount of BSD people entering the not-so-yuuge Oak some Dexter sneaked in camouflage. The name-giver got a proper position to oversee the mess and I was glad I did not leave him behind after almost too many Creemores.
Day 2
Something happened it's crystal blue on the "roof" and sun is trying its best to wake me up. To start the day, I pick breakfast at 'Father+Sons' - I can really recommend that. Very nice home made fries (almost hashbrowns) and fast delivery! Stuffed up I trott along to get to phessler's tutorial about BGP-for-sysadmins-and-developers.
Peter did a great job, but the "lab" couldn't happen, since - oh surprise - the wifi was sluggish as hell. Must love the first day on a conference every time.
Went to Hackroom in U90 afterwards, just to fix stuff "at home". IPsec giving pains again.
Time to pick food+beer afterwards and since it's so easy to reach, we went to the Oak again. Having a nice backyard patio experience it was about time to meet new people. Cheers to Tom, Aaron, Nick, Philip and some more, we'd an awesome night there. I also invited some not-really-computer local I know by other means who was completly overwhelmed by what kind of "nerds" gather around BSD. He planned to stay "a beer" - and it was rather some more and six hours. Looks like "we" made some impression on him :).
Day 3
Easy day, no tutorials at hand, so first picking up breakfast at F+S again and moving to hackroom in U90. Since I promised phessler to help with an localized lab-setup, I started to hack on a quick vagrant/ansible setup to mimic his BGP-lab and went quickly through most of it. Plus some more IPsec debugging and finally fixing it, we went early in the general direction of the Red Lion to pick our registration pack.
But before that could happen it was called to have shawarma at 3brothers along. Given a tight hangover it wasn't the brightest idea to order a poutine m-(. Might be great the other day, it wasn't for me at the very time and had to throw away most of it :(. Eventually passing on to the Red Lion I made the next failure with just running into the pub - please stay at the front desk until "seated". I never get used to this concept.
So after being "properly" seated, we take our beers and the registration can commence after we had half of it. So I register myself; btw it's a great idea to grant "not needed" stuff to charity. So dont pick "just because", think about it if you really need this or that gadget.
Then I register Groff - he really needs badges - just to have Dru coming back to me some minutes later one to hand me the badge for Henning. That's just "amazing"; I dont know IF i want to break this vicious circle the other day, since it's so funny.
Talked to Theo about the ongoing IPsec problems and he taught me about utrace(2) which looks "complicated" but might be an end of the story the other day. Also had a nice talk to Peter (H.) about some other ideas along books.
BTW, did I pay for ongoing beers? I think Tom did - what a guy :).
Arriving at the Residence, I had to find my bathroom door locked (special thing).. crazy thing is they dont have a master key at the venue, but to have to call in one from elsewhere.
Short night shortened by another 30minutes :(.
Day 4
Weather is improving into beach+sun levels - and it's Conference Day! The opening keynote from Geist was very interesting ("citation needed"). Afterwards I went to zfs-over-ssh, nothing really new (sorry Allan). But then Jason had a super interesting talk on how about to apply BSD for the health-care system in Australia. I hope I can help him with the last bits (rdomain!) in the end.
While lunch I tried to recall my memories about utrace(2) while talking to Theo.
Then it was about to present my talk and I think it was well perceipted. One "not so good" feedback was about not taking the audience more into account. I think I was asking every other five slides or so - but, well. The general feedback (in spoken terms) was quite good. I was a bit "confused" and I did likely a better job in Tokyo, but well.
Happened we ended up in the Oak again.. thanks to mwl, shirkdog, sng, pitrh, kurtm for having me there :)
Day 5
While the weather had to decide "what next", I rushed to the venue just to gather Reyk's talk about vmd(8). Afterwards it was MSTP from Paeps which was very interesting and we (OpenBSD) should look into it. Then happened BUG BOF and I invite all "coastal Germans" to cbug.de :)
I had to run off for other reasons and came back to Dave's talk which was AWESOME.
Following was Rod's talk.. well. While I see his case, that was very poor.
The auction into closing was awesome again, and I spend $50 on a Tshirt. :)
+ Epilogue
I totally got the exit dates wrong. So first cancel a booking of an Hotel and then rebook the train to YUL. So I have plenty of time "in the morning" to get breakfast with the local guy. After that he drives me to VIARail station and I dig into "business" cussions.
Well, see you in Ottawa - or how about Paris, Taipei?
Bind Broker (http://www.tedunangst.com/flak/post/bind-broker)
Ted Unangst writes about an interesting idea he has
He has a single big server, and lots of users who would like to share it, many want to run web servers.
This would be great, but alas, archaic decisions made long ago mean that network sockets aren’t really files and there’s this weird concept of privileged ports. Maybe we could assign each user a virtual machine and let them do whatever they want, but that seems wasteful. Think of the megabytes! Maybe we could setup nginx.conf to proxy all incoming connections to a process of the user’s choosing, but that only works for web sites and we want to be protocol neutral. Maybe we could use iptables, but nobody wants to do that. 
What we need is a bind broker. At some level, there needs to be some kind of broker that assigns IPs to users and resolves conflicts. It should be possible to build something of this nature given just the existing unix tools we have, instead of changing system design. Then we can deploy our broker to existing systems without upgrading or disrupting their ongoing operation. The bind broker watches a directory for the creation, by users, of unix domain sockets. Then it binds to the TCP port of the same name, and transfers traffic between them.
A more complete problem specification is as follows. A top level directory, which contains subdirectories named after IP addresses. Each user is assigned a subdirectory, which they have write permission to. Inside each subdirectory, the user may create unix sockets named according to the port they wish to bind to. We might assign user alice the IP 10.0.0.5 and the user bob the IP 10.0.0.10. Then alice could run a webserver by binding to net/10.0.0.5/80 and bob could run a mail server by binding to net/10.0.0.10/25. This maps IP ownership (which doesn’t really exist in unix) to the filesystem namespace (which does have working permissions).
So this will be a bit different than jails. The idea is to use filesystem permissions to control which users can bind to which IP addresses and ports
The broker is responsible for watching each directory. As new sockets are created, it should respond by binding to the appropriate port. When a socket is deleted, the network side socket should be closed as well. Whenever a connection is accepted on the network side, a matching connection is made on the unix side, and then traffic is copied across.
A full set of example code is provided
There’s no completely portable way to watch a directory for changes. I’m using a kevent extension. Otherwise we might consider a timeout and polling with fstat, or another system specific interface (or an abstraction layer over such an interface). Otherwise, if one of our mappings is ready to read (accept), we have a new connection to handle. 
The first half is straightforward. We accept the connection and make a matching connect call to the unix side. Then I broke out the big cheat stick and just spliced the sockets together. In reality, we’d have to set up a read/copy/write loop for each end to copy traffic between them. That’s not very interesting to read though. 
The full code, below, comes in at 232 lines according to wc. Minus includes, blank lines, and lines consisting of nothing but braces, it’s 148 lines of stuff that actually gets executed by the computer. Add some error handling, and working read/write code, and 200 lines seems about right. 
A very interesting idea. I wonder about creating a virtual file system that would implement this and maybe do a bit more to fully flesh out this idea.
What do you think?
***
News Roundup
Daemons and friendly Ninjas (https://euroquis.nl/bobulate/?p=1600)
There’s quite a lot of software that uses CMake as a (meta-)buildsystem. A quick count in the FreeBSD ports tree shows me 1110 ports (over a thousand) that use it. CMake generates buildsystem files which then direct the actual build — it doesn’t do building itself.
There are multiple buildsystem-backends available: in regular usage, CMake generates Makefiles (and does a reasonable job of producing Makefiles that work for GNU Make and for BSD Make). But it can generate Ninja, or Visual Studio, and other buildsystem files. It’s quite flexible in this regard.
Recently, the KDE-FreeBSD team has been working on Qt WebEngine, which is horrible. It contains a complete Chromium and who knows what else. Rebuilding it takes forever.
But Tobias (KDE-FreeBSD) and Koos (GNOME-FreeBSD) noticed that building things with the Ninja backend was considerably faster for some packages (e.g. Qt WebEngine, and Evolution data-thingy). Tobias wanted to try to extend the build-time improvements to all of the CMake-based ports in FreeBSD, and over the past few days, this has been a success.
Ports builds using CMake now default to using Ninja as buildsystem-backend.
Here’s a bitty table of build-times. These are one-off build times, so hardly scientifically accurate — but suggestive of a slight improvement in build time.

Name        Size        GMake    Ninja
liblxt        50kB        0:32    0:31
llvm38        1655kB    *    19:43
musescore    47590kB    4:00    3:54
webkit2-gtk3    14652kB    44:29    37:40

Or here’s a much more thorough table of results from tcberner@, who did 5 builds of each with and without ninja. I’ve cut out the raw data, here are just the average-of-five results, showing usually a slight improvement in build time with Ninja.

Name        av make    av ninj    Delta    D/Awo
compiler-rt    00:08        00:07    -00:01    -14%
openjpeg    00:06        00:07    +00:01    +17%
marble        01:57        01:43    -00:14    -11%
uhd        01:49        01:34    -00:15    -13%
opencacscade    04:08        03:23    -00:45    -18%
avidemux    03:01        02:49    -00:12    – 6%
kdevelop    01:43        01:33    -00:10    – 9%
ring-libclient    00:58        00:53    -00:05    – 8%

Not everything builds properly with Ninja. This is usually due to missing dependencies that CMake does not discover; this shows up when foo depends on bar but no rule is generated for it. Depending on build order and speed, bar may be there already by the time foo gets around to being built. Doxygen showed this, where builds on 1 CPU core were all fine, but 8 cores would blow up occasionally.
In many cases, we’ve gone and fixed the missing implicit dependencies in ports and upstreams. But some things are intractable, or just really need GNU Make. For this, the FreeBSD ports infrastructure now has a knob attached to CMake for switching a port build to GNU Make.
Normal: USES=cmake
Out-of-source: USES=cmake:outsource
GNU Make: USES=cmake:noninja gmake
OoS, GMake: USES=cmake:outsource,noninja gmake
Bad: USES=cmake gmake
For the majority of users, this has no effect, but for our package-building clusters, and for KDE-FreeBSD developers who build a lot of CMake-buildsystem software in a day it may add up to an extra coffee break. So I’ll raise a shot of espresso to friendship between daemons and ninjas.
Announcing the pkgsrc-2017Q2 release (http://mail-index.netbsd.org/pkgsrc-users/2017/07/10/msg025237.html)
For the 2017Q2 release we welcome the following notable package additions and changes to the pkgsrc collection:
Firefox 54
GCC 7.1
MATE 1.18
Ruby 2.4
Ruby on Rails 4.2
TeX Live 2017
Thunderbird 52.1
Xen 4.8
We say goodbye to:
Ruby 1.8
Ruby 2.1
The following infrastructure changes were introduced:
Implement optional new pkgtasks and init infrastructure for pkginstall. 
Various enhancements and fixes for building with ccache.
Add support to USE_LANGUAGES for newer C++ standards.
Enhanced support for SSP, FORTIFY, and RELRO.
The GitHub mirror has migrated to https://github.com/NetBSD/pkgsrc
In total, 210 packages were added, 43 packages were removed, and 1,780 package updates were processed since the pkgsrc-2017Q1 release.
***
OpenBSD changes of note 624 (http://www.tedunangst.com/flak/post/openbsd-changes-of-note-624)
There are a bunch, but here are a few that jump out:
Start plugging some leaks. Compile kernels with umask 007. Install them minus read permissions.
Pure preprocessor implementation of the roff .ec and .eo requests, though you are warned that very bad things will happen to anybody trying to use these macros in OpenBSD manuals.
Random linking for arm64. And octeon. And alpha. And hppa. There’s some variation by platform, because every architecture has the kernel loaded with different flavors of initial physical and virtual mappings. And landisk. And loongson. And sgi. And macppc. And a gap file for sparc64, but nobody yet dares split locore. And arm7.
Errata for perl File::Path race condition.
Some fixes for potential link attacks against cron.
Add pledge violations to acct reporting.
Take random linking to the next stage. More about KARL - kernel address randomized link. As noted, a few difficulties with hibernate and such, but the plan is coming together. Add a new function reorder_kernel() that relinks and installs the new kernel in the background on system startup. Add support for the bootblocks to detect hibernate and boot the previous kernel.
Remove the poorly described “stuff” from ksh.
Replace usage of TIOCSTI in csh using a more common IO loop. Kind of like the stuff in ksh, but part of the default command line editing and parsing code, csh would read too many characters, then send the ones it didn’t like back into the terminal. Which is weird, right? Also, more importantly, eliminating the code that uses TIOCSTI to inject characters into ttys means that maybe TIOCSTI can be removed.
Revamp some of the authentication logging in ssh.
Add a verbose flag to rm so you can panic immediately upon seeing it delete the wrong file instead of waiting to discover your mistake after the fact.
Update libexpat to version 2.2.1 which has some security fixes. Never trust an expat, that’s my motto.
Update inteldrm to code based on Linux 4.4.70. This brings us support for Skylake and Cherryview and better support for Broadwell and Valleyview. Also adds MST support. Fun times for people with newish laptops.
***
OPNsense 17.1.9 released (https://opnsense.org/opnsense-17-1-9-released/)
firewall: move gateway switching from system to firewall advanced settings
firewall: keep category selection when changing tabs
firewall: do not skip gateway switch parsing too early (contributed by Stephane Lesimple)
interfaces: show VLAN description during edit
firmware: opnsense-revert can now handle multiple packages at once
firmware: opnsense-patch can now handle permission changes from patches
dnsmasq: use canned –bogus-priv for noprivatereverse
dnsmasq: separate log file, ACL and menu entries
dynamic dns: fix update for IPv6 (contributed by Alexander Leisentritt)
dynamic dns: remove usage of CURLAUTH_ANY (contributed by Alexander Leisentritt)
intrusion detection: suppress “fast mode available” boot warning in PCAP mode
openvpn: plugin framework adaption
unbound: add local-zone type transparent for PTR zone (contributed by Davide Gerhard)
unbound: separate log file, ACL and menu entries
wizard: remove HTML from description strings
mvc: group relation to something other than uuid if needed
mvc: rework “item in” for our Volt templates
lang: Czech to 100% translated (contributed by Pavel Borecki)
plugins: zabbix-agent 1.1 (contributed by Frank Wall)
plugins: haproxy 1.16 (contributed by Frank Wall)
plugins: acme-client 1.8 (contributed by Frank Wall)
plugins: tinc fix for switch mode (contributed by Johan Grip)
plugins: monit 1.3 (contributed by Frank Brendel)
src: support dhclient supersede statement for option 54 (contributed by Fabian Kurtz)
src: add Intel Atom Cherryview SOC HSUART support
src: add the ID for the Huawei ME909S LTE modem
src: HardenedBSD Stack Clash mitigations[1]
ports: sqlite 3.19.3[2]
ports: openvpn 2.4.3[3]
ports: sudo 1.8.20p2[4]
ports: dnsmasq 2.77[5]
ports: openldap 2.4.45[6]
ports: php 7.0.20[7]
ports: suricata 3.2.2[8]
ports: squid 3.5.26[9]
ports: carootnss 3.31
ports: bind 9.11.1-P2[10]
ports: unbound 1.6.3[11]
ports: curl 7.54.1[12]
***
Beastie Bits
Thinkpad x230 - trying to get TrackPoint / Touchpad working in X (http://lists.dragonflybsd.org/pipermail/users/2017-July/313519.html)
FreeBSD deprecates all r-cmds (rcp, rlogin, etc.) (http://marc.info/?l=freebsd-commits-all&amp;amp;m=149918307723723&amp;amp;w=2)
Bashfill - art for your terminal (https://max.io/bash.html)
Go 1.9 release notes: NetBSD support is broken, please help (https://github.com/golang/go/commit/32002079083e533e11209824bd9e3a797169d1c4)
Jest, A ReST api for creating and managing FreeBSD jails written in Go (https://github.com/altsrc-io/Jest)
***
Feedback/Questions
John - zfs send/receive (http://dpaste.com/3ANETHW#wrap)
Callum - laptops (http://dpaste.com/11TV0BJ) &amp;amp; An update (http://dpaste.com/3A14BQ6#wrap)
Lars - Snapshot of VM datadisk (http://dpaste.com/0MM37NA#wrap)
Daryl - Jail managers (http://dpaste.com/0CDQ9EK#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We look at an OpenBSD setup on a new laptop, revel in BSDCan trip reports, and visit daemons and friendly ninjas.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://bsdly.blogspot.de/2017/07/openbsd-and-modern-laptop.html" rel="nofollow">OpenBSD and the modern laptop</a></h3>

<ul>
<li>Peter Hansteen has a new blog post about <a href="http://www.openbsd.org/" rel="nofollow">OpenBSD</a> on laptops:</li>
</ul>

<blockquote>
<p>Did you think that OpenBSD is suitable only for firewalls and high-security servers? Think again. Here are my steps to transform a modern mid to high range laptop into a useful Unix workstation with OpenBSD.<br>
One thing that never ceases to amaze me is that whenever I&#39;m out and about with my primary laptop at conferences and elsewhere geeks gather, a significant subset of the people I meet have a hard time believing that my laptop runs OpenBSD, and that it&#39;s the only system installed.<br>
and then it takes a bit of demonstrating that yes, the graphics runs with the best available resolution the hardware can offer, the wireless network is functional, suspend and resume does work, and so forth. And of course, yes, I do use that system when writing books and articles too. Apparently heavy users of other free operating systems do not always run them on their primary workstations.</p>
</blockquote>

<ul>
<li>Peter goes on to describe the laptops he’s had over the years (all running OpenBSD) and after BSDCan 2017, he needed a new one due to cracks in the display.</li>
</ul>

<blockquote>
<p>So the time came to shop around for a replacement. After a bit of shopping around I came back to Multicom, a small computers and parts supplier outfit in rural Åmli in southern Norway, the same place I had sourced the previous one.<br>
One of the things that attracted me to that particular shop and their own-branded offerings is that they will let you buy those computers with no operating system installed. That is of course what you want to do when you source your operating system separately, as we OpenBSD users tend to do.<br>
The last time around I had gone for a &quot;Thin and lightweight&quot; 14 inch model (Thickness 20mm, weight 2.0kg) with 16GB RAM, 240GB SSD for system disk and 1TB HD for /home (since swapped out for a same-size SSD, as the dmesg will show). <br>
Three years later, the rough equivalent with some added oomph for me to stay comfortable for some years to come ended me with a 13.3 inch model, 18mm and advertised as 1.3kg (but actually weighing in at 1.5kg, possibly due to extra components), 32GB RAM, 512GB SSD and 2TB harddisk. For now the specification can be viewed online <a href="https://www.multicom.no/systemconfigurator.aspx?q=st:10637291;c:100559;fl:0#4091-10500502-1;4086-10637290-1;4087-8562157-2;4088-9101982-1;4089-9101991-1" rel="nofollow">here</a> (the site language is Norwegian, but product names and units of measure are not in fact different).<br>
The OpenBSD installer is a wonder of straightforward, no-nonsense simplicity that simply gets the job done. Even so, if you are not yet familiar with OpenBSD, it is worth spending some time reading the OpenBSD FAQ&#39;s installation guidelines and the INSTALL.platform file (in our case, INSTALL.amd64) to familiarize yourself with the procedure. If you&#39;re following this article to the letter and will be installing a snapshot, it is worth reading the notes on following -current too.<br>
The main hurdle back when I was installing the 2014-vintage 14&quot; model was getting the system to consider the SSD which showed up as sd1 the automatic choice for booting (I solved that by removing the MBR, setting the size of the MBR on the hard drive that showed up as sd0 to 0 and enlarging the OpenBSD part to fill the entire drive).</p>

<ul>
<li>He goes on to explain the choices he made in the installer and settings made after the reboot to set up his work environment. Peter closes with:
If you have any questions on running OpenBSD as a primary working environment, I&#39;m generally happy to answer but in almost all cases I would prefer that you use the mailing lists such as <a href="mailto:misc@openbsd.org" rel="nofollow">misc@openbsd.org</a> or the <a href="https://www.facebook.com/groups/2210554563/" rel="nofollow">OpenBSD Facebook</a> group so the question and hopefully useful answers become available to the general public. Browsing the slides for my recent <a href="https://home.nuug.no/%7Epeter/openbsd_and_you/" rel="nofollow">OpenBSD and you</a> user group talk might be beneficial if you&#39;re not yet familiar with the system. And of course, comments on this article are welcome.
***</li>
</ul>
</blockquote>

<h3><a href="https://www.freebsdfoundation.org/blog/2017-bsdcan-trip-report-roller-angel/" rel="nofollow">BSDCan 2017 Trip Report: Roller Angel</a></h3>

<ul>
<li>We could put this into next week’s show, because we have another trip report already that’s quite long.</li>
</ul>

<blockquote>
<p>After dropping off my luggage, I headed straight over to the Goat BoF which took place at The Royal Oak. There were already a number of people there engaged in conversation with food and drink. I sat down at a table and was delighted that the people sitting with me were also into the BSD’s and were happy to talk about it the whole time. I felt right at home from the start as people were very nice to me, and were interested in what I was working on. I honestly didn’t know that I would fit in so well.<br>
I had a preconceived notion that people may be a bit hard to approach as they are famous and so technically advanced. At first, people seemed to only be working in smaller circles. Once you get more familiar with the faces, you realize that these circles don’t always contain the same people and that they are just people talking about specific topics. I found that it was easy to participate in the conversation and also found out that people are happy to get your feedback on the subject as well.<br>
I was actually surprised how easily I got along with everyone and how included I felt in the activities. I volunteered to help wherever possible and got to work on the video crew that recorded the audio and slides of the talks. The people at BSDCan are incredibly easy to talk to, are actually interested in what you’re doing with BSD, and what they can do to help. It’s nice to feel welcome in the community. It’s like going home. Dan mentioned in his welcome on the first day of BSDCan that the conference is like home for many in the community.</p>
</blockquote>

<ul>
<li>The trip report is very detailed and chronicles the two days of the developer summit, and the two days of the conference</li>
</ul>

<blockquote>
<p>There was some discussion about a new code of conduct by Benno Rice who mentioned that people are welcome to join a body of people that is forming that helps work out issues related to code of conduct and forwards their recommendations on to core. Next, Allan introduced the idea of creating a process for formally discussing big project changes or similar discussions that is going to be known as FCP or FreeBSD Community Proposal. In Python we have the Python Enhancement Proposal or PEP which is very similar to the idea of FCP. I thought this idea is a great step for FreeBSD to be implementing as it has been a great thing for Python to have.<br>
There was some discussion about taking non-code contributions from people and how to recognize those people in the project. There was a suggestion to have a FreeBSD Member status created that can be given to people whose non-code contributions are valuable to the project. This idea seemed to be on a lot of people’s minds as something that should be in place soon. The junior jobs on the FreeBSD Wiki were also brought up as a great place to look for ideas on how to get involved in contributing to FreeBSD.</p>
</blockquote>

<ul>
<li>Roller wasted no time, and started contributing to EdgeBSD at the conference.</li>
</ul>

<blockquote>
<p>On the first day of BSDCan I arrived at the conference early to coordinate with the team that records the talks. We selected the rooms that each of us would be in to do the recording and set up a group chat via WhatsApp for coordination.</p>
</blockquote>

<ul>
<li>Thanks to Roller, Patrick McAvoy, Calvin Hendryx-Parker, and all of the others who volunteered their time to run the video and streaming production at BSDCan, as well as all others who volunteered, even if it was just to carry a box. BSDCan couldn’t happen without the army of volunteers.</li>
</ul>

<blockquote>
<p>After the doc lounge, I visited the Hacker Lounge. There were already several tables full of people talking and working on various projects. In fact, there was a larger group of people who were collaborating on the new libtrue library that seemed to be having a great time. I did a little socializing and then got on my laptop and did some more work on the documentation using my new skills. I really enjoyed having a hacker lounge to go to at night.<br>
I want to give a big thank you to the FreeBSD Foundation for approving my travel grant. It was a great experience to meet the community and participate in discussions. I’m very grateful that I was able to attend my first BSDCan. After visiting the doc lounge a few times, I managed to get comfortable using the tools required to edit the documentation. By the end of the conference, I had submitted two documentation patches to the FreeBSD Bugzilla with several patches still in progress. Prior to the conference I expected that I would be spending a lot of time working on my Onion Omega and Edge Router Lite projects that I had with me, but I actually found that there was always something fun going on that I would rather do or work on. I can always work on those projects at home anyway. I had a good time working with the FreeBSD community and will continue working with them by editing the documentation and working with Bugzilla.</p>
</blockquote>

<ul>
<li>One of the things I enjoy about these trip reports is when they help convince other people to make the trip to their first conference. Hopefully by sharing their experience, it will convince you to come to the next conference:

<ul>
<li>vBSDCon in Virginia, USA: Sept 7-9</li>
<li>EuroBSDCon in Paris, France: Sept 21-24</li>
<li>BSDTW in Taipei, Taiwan: November 11-12 (CFP ends July 31st)
***</li>
</ul></li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170629150641" rel="nofollow">BSDCan 2017 - Trip report double-p</a></h3>

<ul>
<li>Prologue</li>
</ul>

<blockquote>
<p>Most overheard in Tokyo was &quot;see you in Ottawaaaaah&quot;, so with additional &quot;personal item&quot; being Groff I returned home to plan the trip to BSDCan.<br>
Dan was very helpful with getting all the preparations (immigration handling), thanks for that. Before I could start, I had to fix something: the handling of the goat. With a nicely created harness, I could just hang it along my backpack.<br>
Done that it went to the airport of Hamburg and check-in for an itinerary of HAM-MUC-YUL. While the feeder leg was a common thing, boarding to YUL was great - cabin-crew likes Groff :)<br>
Arriving in Montreal was like entering a Monsoon zone or something, sad! After the night the weather was still rain-ish but improving and i shuttled to Dorval VIARail station to take me to Ottawa (ever avoid AirCanada, right?). Train was late, but the conductor (or so) was nice to talk to - and wanted to know about Groff&#39;s facebook page :-P.<br>
Picking a cab in Ottawa to take me to &quot;Residence&quot; was easy at first - just that it was the wrong one. Actually my fault and so I had a &quot;nice, short&quot; walk to the actual one in the rain with wrong directions. Eventually I made it and after unpacking, refreshment it was time to hit the Goat BOF!</p>
</blockquote>

<ul>
<li>Day 1</li>
</ul>

<blockquote>
<p>Since this was my first BSDCan I didnt exactly knew what to expect from this BOF. But it was like, we (Keeper, Dan, Allan, ..) would talk about &quot;who&#39;s next&quot; and things like that. How mistaken I was :). Besides the sheer amount of BSD people entering the not-so-yuuge Oak some Dexter sneaked in camouflage. The name-giver got a proper position to oversee the mess and I was glad I did not leave him behind after almost too many Creemores.</p>
</blockquote>

<ul>
<li>Day 2</li>
</ul>

<blockquote>
<p>Something happened it&#39;s crystal blue on the &quot;roof&quot; and sun is trying its best to wake me up. To start the day, I pick breakfast at &#39;Father+Sons&#39; - I can really recommend that. Very nice home made fries (almost hashbrowns) and fast delivery! Stuffed up I trott along to get to phessler&#39;s tutorial about BGP-for-sysadmins-and-developers.<br>
Peter did a great job, but the &quot;lab&quot; couldn&#39;t happen, since - oh surprise - the wifi was sluggish as hell. Must love the first day on a conference every time.<br>
Went to Hackroom in U90 afterwards, just to fix stuff &quot;at home&quot;. IPsec giving pains again.<br>
Time to pick food+beer afterwards and since it&#39;s so easy to reach, we went to the Oak again. Having a nice backyard patio experience it was about time to meet new people. Cheers to Tom, Aaron, Nick, Philip and some more, we&#39;d an awesome night there. I also invited some not-really-computer local I know by other means who was completly overwhelmed by what kind of &quot;nerds&quot; gather around BSD. He planned to stay &quot;a beer&quot; - and it was rather some more and six hours. Looks like &quot;we&quot; made some impression on him :).</p>
</blockquote>

<ul>
<li>Day 3</li>
</ul>

<blockquote>
<p>Easy day, no tutorials at hand, so first picking up breakfast at F+S again and moving to hackroom in U90. Since I promised phessler to help with an localized lab-setup, I started to hack on a quick vagrant/ansible setup to mimic his BGP-lab and went quickly through most of it. Plus some more IPsec debugging and finally fixing it, we went early in the general direction of the Red Lion to pick our registration pack.<br>
But before that could happen it was called to have shawarma at 3brothers along. Given a tight hangover it wasn&#39;t the brightest idea to order a poutine m-(. Might be great the other day, it wasn&#39;t for me at the very time and had to throw away most of it :(. Eventually passing on to the Red Lion I made the next failure with just running into the pub - please stay at the front desk until &quot;seated&quot;. I never get used to this concept.<br>
So after being &quot;properly&quot; seated, we take our beers and the registration can commence after we had half of it. So I register myself; btw it&#39;s a great idea to grant &quot;not needed&quot; stuff to charity. So dont pick &quot;just because&quot;, think about it if you really need this or that gadget.<br>
Then I register Groff - he really needs badges - just to have Dru coming back to me some minutes later one to hand me the badge for Henning. That&#39;s just &quot;amazing&quot;; I dont know IF i want to break this vicious circle the other day, since it&#39;s so funny.<br>
Talked to Theo about the ongoing IPsec problems and he taught me about utrace(2) which looks &quot;complicated&quot; but might be an end of the story the other day. Also had a nice talk to Peter (H.) about some other ideas along books.<br>
BTW, did I pay for ongoing beers? I think Tom did - what a guy :).<br>
Arriving at the Residence, I had to find my bathroom door locked (special thing).. crazy thing is they dont have a master key at the venue, but to have to call in one from elsewhere.<br>
Short night shortened by another 30minutes :(.</p>
</blockquote>

<ul>
<li>Day 4</li>
</ul>

<blockquote>
<p>Weather is improving into beach+sun levels - and it&#39;s Conference Day! The opening keynote from Geist was very interesting (&quot;citation needed&quot;). Afterwards I went to zfs-over-ssh, nothing really new (sorry Allan). But then Jason had a super interesting talk on how about to apply BSD for the health-care system in Australia. I hope I can help him with the last bits (rdomain!) in the end.<br>
While lunch I tried to recall my memories about utrace(2) while talking to Theo.<br>
Then it was about to present my talk and I think it was well perceipted. One &quot;not so good&quot; feedback was about not taking the audience more into account. I think I was asking every other five slides or so - but, well. The general feedback (in spoken terms) was quite good. I was a bit &quot;confused&quot; and I did likely a better job in Tokyo, but well.<br>
Happened we ended up in the Oak again.. thanks to mwl, shirkdog, sng, pitrh, kurtm for having me there :)</p>
</blockquote>

<ul>
<li>Day 5</li>
</ul>

<blockquote>
<p>While the weather had to decide &quot;what next&quot;, I rushed to the venue just to gather Reyk&#39;s talk about vmd(8). Afterwards it was MSTP from Paeps which was very interesting and we (OpenBSD) should look into it. Then happened BUG BOF and I invite all &quot;coastal Germans&quot; to cbug.de :)<br>
I had to run off for other reasons and came back to Dave&#39;s talk which was AWESOME.<br>
Following was Rod&#39;s talk.. well. While I see his case, that was very poor.<br>
The auction into closing was awesome again, and I spend $50 on a Tshirt. :)</p>

<ul>
<li>Epilogue
I <em>totally</em> got the exit dates wrong. So first cancel a booking of an Hotel and then rebook the train to YUL. So I have plenty of time &quot;in the morning&quot; to get breakfast with the local guy. After that he drives me to VIARail station and I dig into &quot;business&quot; cussions.
Well, see you in Ottawa - or how about Paris, Taipei?
***</li>
</ul>
</blockquote>

<h3><a href="http://www.tedunangst.com/flak/post/bind-broker" rel="nofollow">Bind Broker</a></h3>

<ul>
<li>Ted Unangst writes about an interesting idea he has</li>
<li>He has a single big server, and lots of users who would like to share it, many want to run web servers.</li>
</ul>

<blockquote>
<p>This would be great, but alas, archaic decisions made long ago mean that network sockets aren’t really files and there’s this weird concept of privileged ports. Maybe we could assign each user a virtual machine and let them do whatever they want, but that seems wasteful. Think of the megabytes! Maybe we could setup nginx.conf to proxy all incoming connections to a process of the user’s choosing, but that only works for web sites and we want to be protocol neutral. Maybe we could use iptables, but nobody wants to do that. <br>
What we need is a bind broker. At some level, there needs to be some kind of broker that assigns IPs to users and resolves conflicts. It should be possible to build something of this nature given just the existing unix tools we have, instead of changing system design. Then we can deploy our broker to existing systems without upgrading or disrupting their ongoing operation. The bind broker watches a directory for the creation, by users, of unix domain sockets. Then it binds to the TCP port of the same name, and transfers traffic between them.<br>
A more complete problem specification is as follows. A top level directory, which contains subdirectories named after IP addresses. Each user is assigned a subdirectory, which they have write permission to. Inside each subdirectory, the user may create unix sockets named according to the port they wish to bind to. We might assign user alice the IP 10.0.0.5 and the user bob the IP 10.0.0.10. Then alice could run a webserver by binding to net/10.0.0.5/80 and bob could run a mail server by binding to net/10.0.0.10/25. This maps IP ownership (which doesn’t really exist in unix) to the filesystem namespace (which does have working permissions).</p>
</blockquote>

<ul>
<li>So this will be a bit different than jails. The idea is to use filesystem permissions to control which users can bind to which IP addresses and ports</li>
</ul>

<blockquote>
<p>The broker is responsible for watching each directory. As new sockets are created, it should respond by binding to the appropriate port. When a socket is deleted, the network side socket should be closed as well. Whenever a connection is accepted on the network side, a matching connection is made on the unix side, and then traffic is copied across.</p>
</blockquote>

<ul>
<li>A full set of example code is provided</li>
</ul>

<blockquote>
<p>There’s no completely portable way to watch a directory for changes. I’m using a kevent extension. Otherwise we might consider a timeout and polling with fstat, or another system specific interface (or an abstraction layer over such an interface). Otherwise, if one of our mappings is ready to read (accept), we have a new connection to handle. <br>
The first half is straightforward. We accept the connection and make a matching connect call to the unix side. Then I broke out the big cheat stick and just spliced the sockets together. In reality, we’d have to set up a read/copy/write loop for each end to copy traffic between them. That’s not very interesting to read though. <br>
The full code, below, comes in at 232 lines according to wc. Minus includes, blank lines, and lines consisting of nothing but braces, it’s 148 lines of stuff that actually gets executed by the computer. Add some error handling, and working read/write code, and 200 lines seems about right. </p>
</blockquote>

<ul>
<li>A very interesting idea. I wonder about creating a virtual file system that would implement this and maybe do a bit more to fully flesh out this idea.</li>
<li>What do you think?
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://euroquis.nl/bobulate/?p=1600" rel="nofollow">Daemons and friendly Ninjas</a></h3>

<blockquote>
<p>There’s quite a lot of software that uses CMake as a (meta-)buildsystem. A quick count in the FreeBSD ports tree shows me 1110 ports (over a thousand) that use it. CMake generates buildsystem files which then direct the actual build — it doesn’t do building itself.<br>
There are multiple buildsystem-backends available: in regular usage, CMake generates Makefiles (and does a reasonable job of producing Makefiles that work for GNU Make and for BSD Make). But it can generate Ninja, or Visual Studio, and other buildsystem files. It’s quite flexible in this regard.<br>
Recently, the KDE-FreeBSD team has been working on Qt WebEngine, which is horrible. It contains a complete Chromium and who knows what else. Rebuilding it takes forever.<br>
But Tobias (KDE-FreeBSD) and Koos (GNOME-FreeBSD) noticed that building things with the Ninja backend was considerably faster for some packages (e.g. Qt WebEngine, and Evolution data-thingy). Tobias wanted to try to extend the build-time improvements to all of the CMake-based ports in FreeBSD, and over the past few days, this has been a success.<br>
Ports builds using CMake now default to using Ninja as buildsystem-backend.<br>
Here’s a bitty table of build-times. These are one-off build times, so hardly scientifically accurate — but suggestive of a slight improvement in build time.</p>
</blockquote>

<pre><code>Name        Size        GMake    Ninja
liblxt        50kB        0:32    0:31
llvm38        1655kB    *    19:43
musescore    47590kB    4:00    3:54
webkit2-gtk3    14652kB    44:29    37:40
</code></pre>

<blockquote>
<p>Or here’s a much more thorough table of results from tcberner@, who did 5 builds of each with and without ninja. I’ve cut out the raw data, here are just the average-of-five results, showing usually a slight improvement in build time with Ninja.</p>
</blockquote>

<pre><code>Name        av make    av ninj    Delta    D/Awo
compiler-rt    00:08        00:07    -00:01    -14%
openjpeg    00:06        00:07    +00:01    +17%
marble        01:57        01:43    -00:14    -11%
uhd        01:49        01:34    -00:15    -13%
opencacscade    04:08        03:23    -00:45    -18%
avidemux    03:01        02:49    -00:12    – 6%
kdevelop    01:43        01:33    -00:10    – 9%
ring-libclient    00:58        00:53    -00:05    – 8%
</code></pre>

<blockquote>
<p>Not everything builds properly with Ninja. This is usually due to missing dependencies that CMake does not discover; this shows up when foo depends on bar but no rule is generated for it. Depending on build order and speed, bar may be there already by the time foo gets around to being built. Doxygen showed this, where builds on 1 CPU core were all fine, but 8 cores would blow up occasionally.<br>
In many cases, we’ve gone and fixed the missing implicit dependencies in ports and upstreams. But some things are intractable, or just really need GNU Make. For this, the FreeBSD ports infrastructure now has a knob attached to CMake for switching a port build to GNU Make.</p>

<p>Normal: USES=cmake<br>
Out-of-source: USES=cmake:outsource<br>
GNU Make: USES=cmake:noninja gmake<br>
OoS, GMake: USES=cmake:outsource,noninja gmake<br>
Bad: USES=cmake gmake</p>

<p>For the majority of users, this has no effect, but for our package-building clusters, and for KDE-FreeBSD developers who build a lot of CMake-buildsystem software in a day it may add up to an extra coffee break. So I’ll raise a shot of espresso to friendship between daemons and ninjas.</p>

<hr>
</blockquote>

<h3><a href="http://mail-index.netbsd.org/pkgsrc-users/2017/07/10/msg025237.html" rel="nofollow">Announcing the pkgsrc-2017Q2 release</a></h3>

<ul>
<li>For the 2017Q2 release we welcome the following notable package additions and changes to the pkgsrc collection:

<ul>
<li>Firefox 54</li>
<li>GCC 7.1</li>
<li>MATE 1.18</li>
<li>Ruby 2.4</li>
<li>Ruby on Rails 4.2</li>
<li>TeX Live 2017</li>
<li>Thunderbird 52.1</li>
<li>Xen 4.8</li>
</ul></li>
<li>We say goodbye to:

<ul>
<li>Ruby 1.8</li>
<li>Ruby 2.1</li>
</ul></li>
<li>The following infrastructure changes were introduced:

<ul>
<li>Implement optional new pkgtasks and init infrastructure for pkginstall. </li>
<li>Various enhancements and fixes for building with ccache.</li>
<li>Add support to USE_LANGUAGES for newer C++ standards.</li>
<li>Enhanced support for SSP, FORTIFY, and RELRO.</li>
<li>The GitHub mirror has migrated to <a href="https://github.com/NetBSD/pkgsrc" rel="nofollow">https://github.com/NetBSD/pkgsrc</a></li>
<li>In total, 210 packages were added, 43 packages were removed, and 1,780 package updates were processed since the pkgsrc-2017Q1 release.
***</li>
</ul></li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/openbsd-changes-of-note-624" rel="nofollow">OpenBSD changes of note 624</a></h3>

<ul>
<li><p>There are a bunch, but here are a few that jump out:</p>

<ul>
<li>Start plugging some leaks. Compile kernels with umask 007. Install them minus read permissions.</li>
<li>Pure preprocessor implementation of the roff .ec and .eo requests, though you are warned that very bad things will happen to anybody trying to use these macros in OpenBSD manuals.</li>
<li>Random linking for arm64. And octeon. And alpha. And hppa. There’s some variation by platform, because every architecture has the kernel loaded with different flavors of initial physical and virtual mappings. And landisk. And loongson. And sgi. And macppc. And a gap file for sparc64, but nobody yet dares split locore. And arm7.</li>
<li>Errata for perl File::Path race condition.</li>
<li>Some fixes for potential link attacks against cron.</li>
<li>Add pledge violations to acct reporting.</li>
<li>Take random linking to the next stage. More about KARL - kernel address randomized link. As noted, a few difficulties with hibernate and such, but the plan is coming together. Add a new function reorder_kernel() that relinks and installs the new kernel in the background on system startup. Add support for the bootblocks to detect hibernate and boot the previous kernel.</li>
<li>Remove the poorly described “stuff” from ksh.</li>
<li>Replace usage of TIOCSTI in csh using a more common IO loop. Kind of like the stuff in ksh, but part of the default command line editing and parsing code, csh would read too many characters, then send the ones it didn’t like back into the terminal. Which is weird, right? Also, more importantly, eliminating the code that uses TIOCSTI to inject characters into ttys means that maybe TIOCSTI can be removed.</li>
<li>Revamp some of the authentication logging in ssh.</li>
<li>Add a verbose flag to rm so you can panic immediately upon seeing it delete the wrong file instead of waiting to discover your mistake after the fact.</li>
<li>Update libexpat to version 2.2.1 which has some security fixes. Never trust an expat, that’s my motto.</li>
<li>Update inteldrm to code based on Linux 4.4.70. This brings us support for Skylake and Cherryview and better support for Broadwell and Valleyview. Also adds MST support. Fun times for people with newish laptops.
***</li>
</ul></li>
</ul>

<h3><a href="https://opnsense.org/opnsense-17-1-9-released/" rel="nofollow">OPNsense 17.1.9 released</a></h3>

<ul>
<li>firewall: move gateway switching from system to firewall advanced settings</li>
<li>firewall: keep category selection when changing tabs</li>
<li>firewall: do not skip gateway switch parsing too early (contributed by Stephane Lesimple)</li>
<li>interfaces: show VLAN description during edit</li>
<li>firmware: opnsense-revert can now handle multiple packages at once</li>
<li>firmware: opnsense-patch can now handle permission changes from patches</li>
<li>dnsmasq: use canned –bogus-priv for no_private_reverse</li>
<li>dnsmasq: separate log file, ACL and menu entries</li>
<li>dynamic dns: fix update for IPv6 (contributed by Alexander Leisentritt)</li>
<li>dynamic dns: remove usage of CURLAUTH_ANY (contributed by Alexander Leisentritt)</li>
<li>intrusion detection: suppress “fast mode available” boot warning in PCAP mode</li>
<li>openvpn: plugin framework adaption</li>
<li>unbound: add local-zone type transparent for PTR zone (contributed by Davide Gerhard)</li>
<li>unbound: separate log file, ACL and menu entries</li>
<li>wizard: remove HTML from description strings</li>
<li>mvc: group relation to something other than uuid if needed</li>
<li>mvc: rework “item in” for our Volt templates</li>
<li>lang: Czech to 100% translated (contributed by Pavel Borecki)</li>
<li>plugins: zabbix-agent 1.1 (contributed by Frank Wall)</li>
<li>plugins: haproxy 1.16 (contributed by Frank Wall)</li>
<li>plugins: acme-client 1.8 (contributed by Frank Wall)</li>
<li>plugins: tinc fix for switch mode (contributed by Johan Grip)</li>
<li>plugins: monit 1.3 (contributed by Frank Brendel)</li>
<li>src: support dhclient supersede statement for option 54 (contributed by Fabian Kurtz)</li>
<li>src: add Intel Atom Cherryview SOC HSUART support</li>
<li>src: add the ID for the Huawei ME909S LTE modem</li>
<li>src: HardenedBSD Stack Clash mitigations[1]</li>
<li>ports: sqlite 3.19.3[2]</li>
<li>ports: openvpn 2.4.3[3]</li>
<li>ports: sudo 1.8.20p2[4]</li>
<li>ports: dnsmasq 2.77[5]</li>
<li>ports: openldap 2.4.45[6]</li>
<li>ports: php 7.0.20[7]</li>
<li>ports: suricata 3.2.2[8]</li>
<li>ports: squid 3.5.26[9]</li>
<li>ports: ca_root_nss 3.31</li>
<li>ports: bind 9.11.1-P2[10]</li>
<li>ports: unbound 1.6.3[11]</li>
<li>ports: curl 7.54.1[12]
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2017-July/313519.html" rel="nofollow">Thinkpad x230 - trying to get TrackPoint / Touchpad working in X</a></li>
<li><a href="http://marc.info/?l=freebsd-commits-all&m=149918307723723&w=2" rel="nofollow">FreeBSD deprecates all r-cmds (rcp, rlogin, etc.)</a></li>
<li><a href="https://max.io/bash.html" rel="nofollow">Bashfill - art for your terminal</a></li>
<li><a href="https://github.com/golang/go/commit/32002079083e533e11209824bd9e3a797169d1c4" rel="nofollow">Go 1.9 release notes: NetBSD support is broken, please help</a></li>
<li><a href="https://github.com/altsrc-io/Jest" rel="nofollow">Jest, A ReST api for creating and managing FreeBSD jails written in Go</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/3ANETHW#wrap" rel="nofollow">John - zfs send/receive</a></li>
<li><a href="http://dpaste.com/11TV0BJ" rel="nofollow">Callum - laptops</a> &amp; <a href="http://dpaste.com/3A14BQ6#wrap" rel="nofollow">An update</a></li>
<li><a href="http://dpaste.com/0MM37NA#wrap" rel="nofollow">Lars - Snapshot of VM datadisk</a></li>
<li><a href="http://dpaste.com/0CDQ9EK#wrap" rel="nofollow">Daryl - Jail managers</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We look at an OpenBSD setup on a new laptop, revel in BSDCan trip reports, and visit daemons and friendly ninjas.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://bsdly.blogspot.de/2017/07/openbsd-and-modern-laptop.html" rel="nofollow">OpenBSD and the modern laptop</a></h3>

<ul>
<li>Peter Hansteen has a new blog post about <a href="http://www.openbsd.org/" rel="nofollow">OpenBSD</a> on laptops:</li>
</ul>

<blockquote>
<p>Did you think that OpenBSD is suitable only for firewalls and high-security servers? Think again. Here are my steps to transform a modern mid to high range laptop into a useful Unix workstation with OpenBSD.<br>
One thing that never ceases to amaze me is that whenever I&#39;m out and about with my primary laptop at conferences and elsewhere geeks gather, a significant subset of the people I meet have a hard time believing that my laptop runs OpenBSD, and that it&#39;s the only system installed.<br>
and then it takes a bit of demonstrating that yes, the graphics runs with the best available resolution the hardware can offer, the wireless network is functional, suspend and resume does work, and so forth. And of course, yes, I do use that system when writing books and articles too. Apparently heavy users of other free operating systems do not always run them on their primary workstations.</p>
</blockquote>

<ul>
<li>Peter goes on to describe the laptops he’s had over the years (all running OpenBSD) and after BSDCan 2017, he needed a new one due to cracks in the display.</li>
</ul>

<blockquote>
<p>So the time came to shop around for a replacement. After a bit of shopping around I came back to Multicom, a small computers and parts supplier outfit in rural Åmli in southern Norway, the same place I had sourced the previous one.<br>
One of the things that attracted me to that particular shop and their own-branded offerings is that they will let you buy those computers with no operating system installed. That is of course what you want to do when you source your operating system separately, as we OpenBSD users tend to do.<br>
The last time around I had gone for a &quot;Thin and lightweight&quot; 14 inch model (Thickness 20mm, weight 2.0kg) with 16GB RAM, 240GB SSD for system disk and 1TB HD for /home (since swapped out for a same-size SSD, as the dmesg will show). <br>
Three years later, the rough equivalent with some added oomph for me to stay comfortable for some years to come ended me with a 13.3 inch model, 18mm and advertised as 1.3kg (but actually weighing in at 1.5kg, possibly due to extra components), 32GB RAM, 512GB SSD and 2TB harddisk. For now the specification can be viewed online <a href="https://www.multicom.no/systemconfigurator.aspx?q=st:10637291;c:100559;fl:0#4091-10500502-1;4086-10637290-1;4087-8562157-2;4088-9101982-1;4089-9101991-1" rel="nofollow">here</a> (the site language is Norwegian, but product names and units of measure are not in fact different).<br>
The OpenBSD installer is a wonder of straightforward, no-nonsense simplicity that simply gets the job done. Even so, if you are not yet familiar with OpenBSD, it is worth spending some time reading the OpenBSD FAQ&#39;s installation guidelines and the INSTALL.platform file (in our case, INSTALL.amd64) to familiarize yourself with the procedure. If you&#39;re following this article to the letter and will be installing a snapshot, it is worth reading the notes on following -current too.<br>
The main hurdle back when I was installing the 2014-vintage 14&quot; model was getting the system to consider the SSD which showed up as sd1 the automatic choice for booting (I solved that by removing the MBR, setting the size of the MBR on the hard drive that showed up as sd0 to 0 and enlarging the OpenBSD part to fill the entire drive).</p>

<ul>
<li>He goes on to explain the choices he made in the installer and settings made after the reboot to set up his work environment. Peter closes with:
If you have any questions on running OpenBSD as a primary working environment, I&#39;m generally happy to answer but in almost all cases I would prefer that you use the mailing lists such as <a href="mailto:misc@openbsd.org" rel="nofollow">misc@openbsd.org</a> or the <a href="https://www.facebook.com/groups/2210554563/" rel="nofollow">OpenBSD Facebook</a> group so the question and hopefully useful answers become available to the general public. Browsing the slides for my recent <a href="https://home.nuug.no/%7Epeter/openbsd_and_you/" rel="nofollow">OpenBSD and you</a> user group talk might be beneficial if you&#39;re not yet familiar with the system. And of course, comments on this article are welcome.
***</li>
</ul>
</blockquote>

<h3><a href="https://www.freebsdfoundation.org/blog/2017-bsdcan-trip-report-roller-angel/" rel="nofollow">BSDCan 2017 Trip Report: Roller Angel</a></h3>

<ul>
<li>We could put this into next week’s show, because we have another trip report already that’s quite long.</li>
</ul>

<blockquote>
<p>After dropping off my luggage, I headed straight over to the Goat BoF which took place at The Royal Oak. There were already a number of people there engaged in conversation with food and drink. I sat down at a table and was delighted that the people sitting with me were also into the BSD’s and were happy to talk about it the whole time. I felt right at home from the start as people were very nice to me, and were interested in what I was working on. I honestly didn’t know that I would fit in so well.<br>
I had a preconceived notion that people may be a bit hard to approach as they are famous and so technically advanced. At first, people seemed to only be working in smaller circles. Once you get more familiar with the faces, you realize that these circles don’t always contain the same people and that they are just people talking about specific topics. I found that it was easy to participate in the conversation and also found out that people are happy to get your feedback on the subject as well.<br>
I was actually surprised how easily I got along with everyone and how included I felt in the activities. I volunteered to help wherever possible and got to work on the video crew that recorded the audio and slides of the talks. The people at BSDCan are incredibly easy to talk to, are actually interested in what you’re doing with BSD, and what they can do to help. It’s nice to feel welcome in the community. It’s like going home. Dan mentioned in his welcome on the first day of BSDCan that the conference is like home for many in the community.</p>
</blockquote>

<ul>
<li>The trip report is very detailed and chronicles the two days of the developer summit, and the two days of the conference</li>
</ul>

<blockquote>
<p>There was some discussion about a new code of conduct by Benno Rice who mentioned that people are welcome to join a body of people that is forming that helps work out issues related to code of conduct and forwards their recommendations on to core. Next, Allan introduced the idea of creating a process for formally discussing big project changes or similar discussions that is going to be known as FCP or FreeBSD Community Proposal. In Python we have the Python Enhancement Proposal or PEP which is very similar to the idea of FCP. I thought this idea is a great step for FreeBSD to be implementing as it has been a great thing for Python to have.<br>
There was some discussion about taking non-code contributions from people and how to recognize those people in the project. There was a suggestion to have a FreeBSD Member status created that can be given to people whose non-code contributions are valuable to the project. This idea seemed to be on a lot of people’s minds as something that should be in place soon. The junior jobs on the FreeBSD Wiki were also brought up as a great place to look for ideas on how to get involved in contributing to FreeBSD.</p>
</blockquote>

<ul>
<li>Roller wasted no time, and started contributing to EdgeBSD at the conference.</li>
</ul>

<blockquote>
<p>On the first day of BSDCan I arrived at the conference early to coordinate with the team that records the talks. We selected the rooms that each of us would be in to do the recording and set up a group chat via WhatsApp for coordination.</p>
</blockquote>

<ul>
<li>Thanks to Roller, Patrick McAvoy, Calvin Hendryx-Parker, and all of the others who volunteered their time to run the video and streaming production at BSDCan, as well as all others who volunteered, even if it was just to carry a box. BSDCan couldn’t happen without the army of volunteers.</li>
</ul>

<blockquote>
<p>After the doc lounge, I visited the Hacker Lounge. There were already several tables full of people talking and working on various projects. In fact, there was a larger group of people who were collaborating on the new libtrue library that seemed to be having a great time. I did a little socializing and then got on my laptop and did some more work on the documentation using my new skills. I really enjoyed having a hacker lounge to go to at night.<br>
I want to give a big thank you to the FreeBSD Foundation for approving my travel grant. It was a great experience to meet the community and participate in discussions. I’m very grateful that I was able to attend my first BSDCan. After visiting the doc lounge a few times, I managed to get comfortable using the tools required to edit the documentation. By the end of the conference, I had submitted two documentation patches to the FreeBSD Bugzilla with several patches still in progress. Prior to the conference I expected that I would be spending a lot of time working on my Onion Omega and Edge Router Lite projects that I had with me, but I actually found that there was always something fun going on that I would rather do or work on. I can always work on those projects at home anyway. I had a good time working with the FreeBSD community and will continue working with them by editing the documentation and working with Bugzilla.</p>
</blockquote>

<ul>
<li>One of the things I enjoy about these trip reports is when they help convince other people to make the trip to their first conference. Hopefully by sharing their experience, it will convince you to come to the next conference:

<ul>
<li>vBSDCon in Virginia, USA: Sept 7-9</li>
<li>EuroBSDCon in Paris, France: Sept 21-24</li>
<li>BSDTW in Taipei, Taiwan: November 11-12 (CFP ends July 31st)
***</li>
</ul></li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170629150641" rel="nofollow">BSDCan 2017 - Trip report double-p</a></h3>

<ul>
<li>Prologue</li>
</ul>

<blockquote>
<p>Most overheard in Tokyo was &quot;see you in Ottawaaaaah&quot;, so with additional &quot;personal item&quot; being Groff I returned home to plan the trip to BSDCan.<br>
Dan was very helpful with getting all the preparations (immigration handling), thanks for that. Before I could start, I had to fix something: the handling of the goat. With a nicely created harness, I could just hang it along my backpack.<br>
Done that it went to the airport of Hamburg and check-in for an itinerary of HAM-MUC-YUL. While the feeder leg was a common thing, boarding to YUL was great - cabin-crew likes Groff :)<br>
Arriving in Montreal was like entering a Monsoon zone or something, sad! After the night the weather was still rain-ish but improving and i shuttled to Dorval VIARail station to take me to Ottawa (ever avoid AirCanada, right?). Train was late, but the conductor (or so) was nice to talk to - and wanted to know about Groff&#39;s facebook page :-P.<br>
Picking a cab in Ottawa to take me to &quot;Residence&quot; was easy at first - just that it was the wrong one. Actually my fault and so I had a &quot;nice, short&quot; walk to the actual one in the rain with wrong directions. Eventually I made it and after unpacking, refreshment it was time to hit the Goat BOF!</p>
</blockquote>

<ul>
<li>Day 1</li>
</ul>

<blockquote>
<p>Since this was my first BSDCan I didnt exactly knew what to expect from this BOF. But it was like, we (Keeper, Dan, Allan, ..) would talk about &quot;who&#39;s next&quot; and things like that. How mistaken I was :). Besides the sheer amount of BSD people entering the not-so-yuuge Oak some Dexter sneaked in camouflage. The name-giver got a proper position to oversee the mess and I was glad I did not leave him behind after almost too many Creemores.</p>
</blockquote>

<ul>
<li>Day 2</li>
</ul>

<blockquote>
<p>Something happened it&#39;s crystal blue on the &quot;roof&quot; and sun is trying its best to wake me up. To start the day, I pick breakfast at &#39;Father+Sons&#39; - I can really recommend that. Very nice home made fries (almost hashbrowns) and fast delivery! Stuffed up I trott along to get to phessler&#39;s tutorial about BGP-for-sysadmins-and-developers.<br>
Peter did a great job, but the &quot;lab&quot; couldn&#39;t happen, since - oh surprise - the wifi was sluggish as hell. Must love the first day on a conference every time.<br>
Went to Hackroom in U90 afterwards, just to fix stuff &quot;at home&quot;. IPsec giving pains again.<br>
Time to pick food+beer afterwards and since it&#39;s so easy to reach, we went to the Oak again. Having a nice backyard patio experience it was about time to meet new people. Cheers to Tom, Aaron, Nick, Philip and some more, we&#39;d an awesome night there. I also invited some not-really-computer local I know by other means who was completly overwhelmed by what kind of &quot;nerds&quot; gather around BSD. He planned to stay &quot;a beer&quot; - and it was rather some more and six hours. Looks like &quot;we&quot; made some impression on him :).</p>
</blockquote>

<ul>
<li>Day 3</li>
</ul>

<blockquote>
<p>Easy day, no tutorials at hand, so first picking up breakfast at F+S again and moving to hackroom in U90. Since I promised phessler to help with an localized lab-setup, I started to hack on a quick vagrant/ansible setup to mimic his BGP-lab and went quickly through most of it. Plus some more IPsec debugging and finally fixing it, we went early in the general direction of the Red Lion to pick our registration pack.<br>
But before that could happen it was called to have shawarma at 3brothers along. Given a tight hangover it wasn&#39;t the brightest idea to order a poutine m-(. Might be great the other day, it wasn&#39;t for me at the very time and had to throw away most of it :(. Eventually passing on to the Red Lion I made the next failure with just running into the pub - please stay at the front desk until &quot;seated&quot;. I never get used to this concept.<br>
So after being &quot;properly&quot; seated, we take our beers and the registration can commence after we had half of it. So I register myself; btw it&#39;s a great idea to grant &quot;not needed&quot; stuff to charity. So dont pick &quot;just because&quot;, think about it if you really need this or that gadget.<br>
Then I register Groff - he really needs badges - just to have Dru coming back to me some minutes later one to hand me the badge for Henning. That&#39;s just &quot;amazing&quot;; I dont know IF i want to break this vicious circle the other day, since it&#39;s so funny.<br>
Talked to Theo about the ongoing IPsec problems and he taught me about utrace(2) which looks &quot;complicated&quot; but might be an end of the story the other day. Also had a nice talk to Peter (H.) about some other ideas along books.<br>
BTW, did I pay for ongoing beers? I think Tom did - what a guy :).<br>
Arriving at the Residence, I had to find my bathroom door locked (special thing).. crazy thing is they dont have a master key at the venue, but to have to call in one from elsewhere.<br>
Short night shortened by another 30minutes :(.</p>
</blockquote>

<ul>
<li>Day 4</li>
</ul>

<blockquote>
<p>Weather is improving into beach+sun levels - and it&#39;s Conference Day! The opening keynote from Geist was very interesting (&quot;citation needed&quot;). Afterwards I went to zfs-over-ssh, nothing really new (sorry Allan). But then Jason had a super interesting talk on how about to apply BSD for the health-care system in Australia. I hope I can help him with the last bits (rdomain!) in the end.<br>
While lunch I tried to recall my memories about utrace(2) while talking to Theo.<br>
Then it was about to present my talk and I think it was well perceipted. One &quot;not so good&quot; feedback was about not taking the audience more into account. I think I was asking every other five slides or so - but, well. The general feedback (in spoken terms) was quite good. I was a bit &quot;confused&quot; and I did likely a better job in Tokyo, but well.<br>
Happened we ended up in the Oak again.. thanks to mwl, shirkdog, sng, pitrh, kurtm for having me there :)</p>
</blockquote>

<ul>
<li>Day 5</li>
</ul>

<blockquote>
<p>While the weather had to decide &quot;what next&quot;, I rushed to the venue just to gather Reyk&#39;s talk about vmd(8). Afterwards it was MSTP from Paeps which was very interesting and we (OpenBSD) should look into it. Then happened BUG BOF and I invite all &quot;coastal Germans&quot; to cbug.de :)<br>
I had to run off for other reasons and came back to Dave&#39;s talk which was AWESOME.<br>
Following was Rod&#39;s talk.. well. While I see his case, that was very poor.<br>
The auction into closing was awesome again, and I spend $50 on a Tshirt. :)</p>

<ul>
<li>Epilogue
I <em>totally</em> got the exit dates wrong. So first cancel a booking of an Hotel and then rebook the train to YUL. So I have plenty of time &quot;in the morning&quot; to get breakfast with the local guy. After that he drives me to VIARail station and I dig into &quot;business&quot; cussions.
Well, see you in Ottawa - or how about Paris, Taipei?
***</li>
</ul>
</blockquote>

<h3><a href="http://www.tedunangst.com/flak/post/bind-broker" rel="nofollow">Bind Broker</a></h3>

<ul>
<li>Ted Unangst writes about an interesting idea he has</li>
<li>He has a single big server, and lots of users who would like to share it, many want to run web servers.</li>
</ul>

<blockquote>
<p>This would be great, but alas, archaic decisions made long ago mean that network sockets aren’t really files and there’s this weird concept of privileged ports. Maybe we could assign each user a virtual machine and let them do whatever they want, but that seems wasteful. Think of the megabytes! Maybe we could setup nginx.conf to proxy all incoming connections to a process of the user’s choosing, but that only works for web sites and we want to be protocol neutral. Maybe we could use iptables, but nobody wants to do that. <br>
What we need is a bind broker. At some level, there needs to be some kind of broker that assigns IPs to users and resolves conflicts. It should be possible to build something of this nature given just the existing unix tools we have, instead of changing system design. Then we can deploy our broker to existing systems without upgrading or disrupting their ongoing operation. The bind broker watches a directory for the creation, by users, of unix domain sockets. Then it binds to the TCP port of the same name, and transfers traffic between them.<br>
A more complete problem specification is as follows. A top level directory, which contains subdirectories named after IP addresses. Each user is assigned a subdirectory, which they have write permission to. Inside each subdirectory, the user may create unix sockets named according to the port they wish to bind to. We might assign user alice the IP 10.0.0.5 and the user bob the IP 10.0.0.10. Then alice could run a webserver by binding to net/10.0.0.5/80 and bob could run a mail server by binding to net/10.0.0.10/25. This maps IP ownership (which doesn’t really exist in unix) to the filesystem namespace (which does have working permissions).</p>
</blockquote>

<ul>
<li>So this will be a bit different than jails. The idea is to use filesystem permissions to control which users can bind to which IP addresses and ports</li>
</ul>

<blockquote>
<p>The broker is responsible for watching each directory. As new sockets are created, it should respond by binding to the appropriate port. When a socket is deleted, the network side socket should be closed as well. Whenever a connection is accepted on the network side, a matching connection is made on the unix side, and then traffic is copied across.</p>
</blockquote>

<ul>
<li>A full set of example code is provided</li>
</ul>

<blockquote>
<p>There’s no completely portable way to watch a directory for changes. I’m using a kevent extension. Otherwise we might consider a timeout and polling with fstat, or another system specific interface (or an abstraction layer over such an interface). Otherwise, if one of our mappings is ready to read (accept), we have a new connection to handle. <br>
The first half is straightforward. We accept the connection and make a matching connect call to the unix side. Then I broke out the big cheat stick and just spliced the sockets together. In reality, we’d have to set up a read/copy/write loop for each end to copy traffic between them. That’s not very interesting to read though. <br>
The full code, below, comes in at 232 lines according to wc. Minus includes, blank lines, and lines consisting of nothing but braces, it’s 148 lines of stuff that actually gets executed by the computer. Add some error handling, and working read/write code, and 200 lines seems about right. </p>
</blockquote>

<ul>
<li>A very interesting idea. I wonder about creating a virtual file system that would implement this and maybe do a bit more to fully flesh out this idea.</li>
<li>What do you think?
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://euroquis.nl/bobulate/?p=1600" rel="nofollow">Daemons and friendly Ninjas</a></h3>

<blockquote>
<p>There’s quite a lot of software that uses CMake as a (meta-)buildsystem. A quick count in the FreeBSD ports tree shows me 1110 ports (over a thousand) that use it. CMake generates buildsystem files which then direct the actual build — it doesn’t do building itself.<br>
There are multiple buildsystem-backends available: in regular usage, CMake generates Makefiles (and does a reasonable job of producing Makefiles that work for GNU Make and for BSD Make). But it can generate Ninja, or Visual Studio, and other buildsystem files. It’s quite flexible in this regard.<br>
Recently, the KDE-FreeBSD team has been working on Qt WebEngine, which is horrible. It contains a complete Chromium and who knows what else. Rebuilding it takes forever.<br>
But Tobias (KDE-FreeBSD) and Koos (GNOME-FreeBSD) noticed that building things with the Ninja backend was considerably faster for some packages (e.g. Qt WebEngine, and Evolution data-thingy). Tobias wanted to try to extend the build-time improvements to all of the CMake-based ports in FreeBSD, and over the past few days, this has been a success.<br>
Ports builds using CMake now default to using Ninja as buildsystem-backend.<br>
Here’s a bitty table of build-times. These are one-off build times, so hardly scientifically accurate — but suggestive of a slight improvement in build time.</p>
</blockquote>

<pre><code>Name        Size        GMake    Ninja
liblxt        50kB        0:32    0:31
llvm38        1655kB    *    19:43
musescore    47590kB    4:00    3:54
webkit2-gtk3    14652kB    44:29    37:40
</code></pre>

<blockquote>
<p>Or here’s a much more thorough table of results from tcberner@, who did 5 builds of each with and without ninja. I’ve cut out the raw data, here are just the average-of-five results, showing usually a slight improvement in build time with Ninja.</p>
</blockquote>

<pre><code>Name        av make    av ninj    Delta    D/Awo
compiler-rt    00:08        00:07    -00:01    -14%
openjpeg    00:06        00:07    +00:01    +17%
marble        01:57        01:43    -00:14    -11%
uhd        01:49        01:34    -00:15    -13%
opencacscade    04:08        03:23    -00:45    -18%
avidemux    03:01        02:49    -00:12    – 6%
kdevelop    01:43        01:33    -00:10    – 9%
ring-libclient    00:58        00:53    -00:05    – 8%
</code></pre>

<blockquote>
<p>Not everything builds properly with Ninja. This is usually due to missing dependencies that CMake does not discover; this shows up when foo depends on bar but no rule is generated for it. Depending on build order and speed, bar may be there already by the time foo gets around to being built. Doxygen showed this, where builds on 1 CPU core were all fine, but 8 cores would blow up occasionally.<br>
In many cases, we’ve gone and fixed the missing implicit dependencies in ports and upstreams. But some things are intractable, or just really need GNU Make. For this, the FreeBSD ports infrastructure now has a knob attached to CMake for switching a port build to GNU Make.</p>

<p>Normal: USES=cmake<br>
Out-of-source: USES=cmake:outsource<br>
GNU Make: USES=cmake:noninja gmake<br>
OoS, GMake: USES=cmake:outsource,noninja gmake<br>
Bad: USES=cmake gmake</p>

<p>For the majority of users, this has no effect, but for our package-building clusters, and for KDE-FreeBSD developers who build a lot of CMake-buildsystem software in a day it may add up to an extra coffee break. So I’ll raise a shot of espresso to friendship between daemons and ninjas.</p>

<hr>
</blockquote>

<h3><a href="http://mail-index.netbsd.org/pkgsrc-users/2017/07/10/msg025237.html" rel="nofollow">Announcing the pkgsrc-2017Q2 release</a></h3>

<ul>
<li>For the 2017Q2 release we welcome the following notable package additions and changes to the pkgsrc collection:

<ul>
<li>Firefox 54</li>
<li>GCC 7.1</li>
<li>MATE 1.18</li>
<li>Ruby 2.4</li>
<li>Ruby on Rails 4.2</li>
<li>TeX Live 2017</li>
<li>Thunderbird 52.1</li>
<li>Xen 4.8</li>
</ul></li>
<li>We say goodbye to:

<ul>
<li>Ruby 1.8</li>
<li>Ruby 2.1</li>
</ul></li>
<li>The following infrastructure changes were introduced:

<ul>
<li>Implement optional new pkgtasks and init infrastructure for pkginstall. </li>
<li>Various enhancements and fixes for building with ccache.</li>
<li>Add support to USE_LANGUAGES for newer C++ standards.</li>
<li>Enhanced support for SSP, FORTIFY, and RELRO.</li>
<li>The GitHub mirror has migrated to <a href="https://github.com/NetBSD/pkgsrc" rel="nofollow">https://github.com/NetBSD/pkgsrc</a></li>
<li>In total, 210 packages were added, 43 packages were removed, and 1,780 package updates were processed since the pkgsrc-2017Q1 release.
***</li>
</ul></li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/openbsd-changes-of-note-624" rel="nofollow">OpenBSD changes of note 624</a></h3>

<ul>
<li><p>There are a bunch, but here are a few that jump out:</p>

<ul>
<li>Start plugging some leaks. Compile kernels with umask 007. Install them minus read permissions.</li>
<li>Pure preprocessor implementation of the roff .ec and .eo requests, though you are warned that very bad things will happen to anybody trying to use these macros in OpenBSD manuals.</li>
<li>Random linking for arm64. And octeon. And alpha. And hppa. There’s some variation by platform, because every architecture has the kernel loaded with different flavors of initial physical and virtual mappings. And landisk. And loongson. And sgi. And macppc. And a gap file for sparc64, but nobody yet dares split locore. And arm7.</li>
<li>Errata for perl File::Path race condition.</li>
<li>Some fixes for potential link attacks against cron.</li>
<li>Add pledge violations to acct reporting.</li>
<li>Take random linking to the next stage. More about KARL - kernel address randomized link. As noted, a few difficulties with hibernate and such, but the plan is coming together. Add a new function reorder_kernel() that relinks and installs the new kernel in the background on system startup. Add support for the bootblocks to detect hibernate and boot the previous kernel.</li>
<li>Remove the poorly described “stuff” from ksh.</li>
<li>Replace usage of TIOCSTI in csh using a more common IO loop. Kind of like the stuff in ksh, but part of the default command line editing and parsing code, csh would read too many characters, then send the ones it didn’t like back into the terminal. Which is weird, right? Also, more importantly, eliminating the code that uses TIOCSTI to inject characters into ttys means that maybe TIOCSTI can be removed.</li>
<li>Revamp some of the authentication logging in ssh.</li>
<li>Add a verbose flag to rm so you can panic immediately upon seeing it delete the wrong file instead of waiting to discover your mistake after the fact.</li>
<li>Update libexpat to version 2.2.1 which has some security fixes. Never trust an expat, that’s my motto.</li>
<li>Update inteldrm to code based on Linux 4.4.70. This brings us support for Skylake and Cherryview and better support for Broadwell and Valleyview. Also adds MST support. Fun times for people with newish laptops.
***</li>
</ul></li>
</ul>

<h3><a href="https://opnsense.org/opnsense-17-1-9-released/" rel="nofollow">OPNsense 17.1.9 released</a></h3>

<ul>
<li>firewall: move gateway switching from system to firewall advanced settings</li>
<li>firewall: keep category selection when changing tabs</li>
<li>firewall: do not skip gateway switch parsing too early (contributed by Stephane Lesimple)</li>
<li>interfaces: show VLAN description during edit</li>
<li>firmware: opnsense-revert can now handle multiple packages at once</li>
<li>firmware: opnsense-patch can now handle permission changes from patches</li>
<li>dnsmasq: use canned –bogus-priv for no_private_reverse</li>
<li>dnsmasq: separate log file, ACL and menu entries</li>
<li>dynamic dns: fix update for IPv6 (contributed by Alexander Leisentritt)</li>
<li>dynamic dns: remove usage of CURLAUTH_ANY (contributed by Alexander Leisentritt)</li>
<li>intrusion detection: suppress “fast mode available” boot warning in PCAP mode</li>
<li>openvpn: plugin framework adaption</li>
<li>unbound: add local-zone type transparent for PTR zone (contributed by Davide Gerhard)</li>
<li>unbound: separate log file, ACL and menu entries</li>
<li>wizard: remove HTML from description strings</li>
<li>mvc: group relation to something other than uuid if needed</li>
<li>mvc: rework “item in” for our Volt templates</li>
<li>lang: Czech to 100% translated (contributed by Pavel Borecki)</li>
<li>plugins: zabbix-agent 1.1 (contributed by Frank Wall)</li>
<li>plugins: haproxy 1.16 (contributed by Frank Wall)</li>
<li>plugins: acme-client 1.8 (contributed by Frank Wall)</li>
<li>plugins: tinc fix for switch mode (contributed by Johan Grip)</li>
<li>plugins: monit 1.3 (contributed by Frank Brendel)</li>
<li>src: support dhclient supersede statement for option 54 (contributed by Fabian Kurtz)</li>
<li>src: add Intel Atom Cherryview SOC HSUART support</li>
<li>src: add the ID for the Huawei ME909S LTE modem</li>
<li>src: HardenedBSD Stack Clash mitigations[1]</li>
<li>ports: sqlite 3.19.3[2]</li>
<li>ports: openvpn 2.4.3[3]</li>
<li>ports: sudo 1.8.20p2[4]</li>
<li>ports: dnsmasq 2.77[5]</li>
<li>ports: openldap 2.4.45[6]</li>
<li>ports: php 7.0.20[7]</li>
<li>ports: suricata 3.2.2[8]</li>
<li>ports: squid 3.5.26[9]</li>
<li>ports: ca_root_nss 3.31</li>
<li>ports: bind 9.11.1-P2[10]</li>
<li>ports: unbound 1.6.3[11]</li>
<li>ports: curl 7.54.1[12]
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2017-July/313519.html" rel="nofollow">Thinkpad x230 - trying to get TrackPoint / Touchpad working in X</a></li>
<li><a href="http://marc.info/?l=freebsd-commits-all&m=149918307723723&w=2" rel="nofollow">FreeBSD deprecates all r-cmds (rcp, rlogin, etc.)</a></li>
<li><a href="https://max.io/bash.html" rel="nofollow">Bashfill - art for your terminal</a></li>
<li><a href="https://github.com/golang/go/commit/32002079083e533e11209824bd9e3a797169d1c4" rel="nofollow">Go 1.9 release notes: NetBSD support is broken, please help</a></li>
<li><a href="https://github.com/altsrc-io/Jest" rel="nofollow">Jest, A ReST api for creating and managing FreeBSD jails written in Go</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/3ANETHW#wrap" rel="nofollow">John - zfs send/receive</a></li>
<li><a href="http://dpaste.com/11TV0BJ" rel="nofollow">Callum - laptops</a> &amp; <a href="http://dpaste.com/3A14BQ6#wrap" rel="nofollow">An update</a></li>
<li><a href="http://dpaste.com/0MM37NA#wrap" rel="nofollow">Lars - Snapshot of VM datadisk</a></li>
<li><a href="http://dpaste.com/0CDQ9EK#wrap" rel="nofollow">Daryl - Jail managers</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>201: Skip grep, use awk</title>
  <link>https://www.bsdnow.tv/201</link>
  <guid isPermaLink="false">afc8dee0-e9f1-42d9-9274-32788bd7b848</guid>
  <pubDate>Wed, 05 Jul 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/afc8dee0-e9f1-42d9-9274-32788bd7b848.mp3" length="85876228" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>In which we interview a unicorn, FreeNAS 11.0 is out, show you how to run Nextcloud in a FreeBSD jail, and talk about the connection between oil changes and software patches.</itunes:subtitle>
  <itunes:duration>2:23:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>In which we interview a unicorn, FreeNAS 11.0 is out, show you how to run Nextcloud in a FreeBSD jail, and talk about the connection between oil changes and software patches.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeNAS 11.0 is Now Here (http://www.freenas.org/blog/freenas-11-0/)
The FreeNAS blog informs us:
After several FreeNAS Release Candidates, FreeNAS 11.0 was released today. This version brings new virtualization and object storage features to the World’s Most Popular Open Source Storage Operating System. FreeNAS 11.0 adds bhyve virtual machines to its popular SAN/NAS, jails, and plugins, letting you use host web-scale VMs on your FreeNAS box. It also gives users S3-compatible object storage services, which turns your FreeNAS box into an S3-compatible server, letting you avoid reliance on the cloud.
FreeNAS 11.0 also introduces the beta version of a new administration GUI. The new GUI is based on the popular Angular framework and the FreeNAS team expects the GUI to be themeable and feature complete by 11.1. The new GUI follows the same flow as the existing GUI, but looks better. For now, the FreeNAS team has released it in beta form to get input from the FreeNAS community. The new GUI, as well as the classic GUI, are selectable from the login screen.
Also new in FreeNAS 11 is an Alert Service page which configures the system to send critical alerts from FreeNAS to other applications and services such as Slack, PagerDuty, AWS, Hipchat, InfluxDB, Mattermost, OpsGenie, and VictorOps. FreeNAS 11.0 has an improved Services menu that adds the ability to manage which services and applications are started at boot.
The FreeNAS community is large and vibrant. We invite you to join us on the FreeNAS forum (https://forums.freenas.org/index.php) and the #freenas IRC channel on Freenode. To download FreeNAS and sign-up for the FreeNAS Newsletter, visit freenas.org/download (http://www.freenas.org/download/).
Building an IPsec Gateway With OpenBSD (https://www.exoscale.ch/syslog/2017/06/26/building-an-ipsec-gateway-with-openbsd/)
Pierre-Yves Ritschard wrote the following blog article:
With private networks just released on Exoscale, there are now more options to implement secure access to Exoscale cloud infrastructure. While we still recommend the bastion approach, as detailed in this article (https://www.exoscale.ch/syslog/2016/01/15/secure-your-cloud-computing-architecture-with-a-bastion/), there are applications or systems which do not lend themselves well to working this way.
In these cases, the next best thing is building IPsec gateways. IPsec is a protocol which works directly at layer 3. It uses its configuration to determine which network flows should be sent encrypted on the wire. Once IPsec is correctly configured, selected network flows are transparently encrypted and applications do not need to modify anything to benefit from secured traffic.
In addition to encryption, IPSec also authenticates the end points, so you can be sure you are exchanging packets with a trusted host
For the purposes of this article we will work under the following assumptions: We want a host to network setup, providing access to cloud-hosted infrastructure from a desktop environment.
Only stock tooling should be used on desktop environment, no additional VPN client should be needed.
In this case, to ensure no additional software is needed on the client, we will configure an L2TP/IPsec gateway. This article will use OpenBSD as the operating system to implement the gateway. While this choice may sound surprising, OpenBSD excels at building gateways of all sorts thanks to its simple configuration formats and inclusion of all necessary software and documentation to do so in the base system.
The tutorial assumes you have setup a local network between the hosts in the cloud, and walks through the configuration of an OpenBSD host as a IPsec gateway
On the OpenBSD host, all necessary software is already installed. We will configure the system, as well as pf, npppd, and ipsec
+ Configure L2TP
+ Configure IPsec
+ Configure NAT
+ Enabled services: ipsec isakmpd npppd
The tutorial then walks through configuring a OS X client, but other desktops will be very similar
***
Running Nextcloud in a jail on FreeBSD (https://ramsdenj.com/2017/06/05/nextcloud-in-a-jail-on-freebsd.html)
I recently setup Nextcloud 12 inside a FreeBSD jail in order to allow me access to files i might need while at University. I figured this would be a optimal solution for files that I might need access to unexpectedly, on computers where I am not in complete control. My Nextcloud instance is externally accessible, and yet if someone were to get inside my Jail, I could rest easy knowing they still didn’t have access to the rest of my host server. I chronicled the setup process including jail setup using iocage, https with Lets Encrypt, and full setup of the web stack.
Nextcloud has a variety of features such as calendar synchronization, email, collaborative editing, and even video conferencing. I haven’t had time to play with all these different offerings and have only utilized the file synchronization, but even if file sync is not needed, Nextcloud has many offerings that make it worth setting up.
MariaDB, PHP 7.0, and Apache 2.4
To manage my jails I’m using iocage. In terms of jail managers it’s a fairly new player in the game of jail management and is being very actively developed. It just had a full rewrite in Python, and while the code in the background might be different, the actual user interface has stayed the same.
Iocage makes use of ZFS clones in order to create “base jails”, which allow for sharing of one set of system packages between multiple jails, reducing the amount of resources necessary. Alternatively, jails can be completely independent from each other; however, using a base jail makes it easier to update multiple jails as well.
+ pkg install iocage
+ sysrc iocageenable=YES
+ iocage fetch -r 11.0-RELEASE
+ iocage create tag="stratus" jailzfs=on vnet=off boot=on ip4_addr="sge0|172.20.0.100/32" -r 11.0-RELEASE
+ iocage start stratus
+ iocage console stratus
I have chosen to provide storage to the Nextcloud Jail by mounting a dataset over NFS on my host box. This means my server can focus on serving Nextcloud and my storage box can focus on housing the data. The Nextcloud Jail is not even aware of this since the NFS Mount is simply mounted by the host server into the jail. The other benefit of this is the Nextcloud jail doesn’t need to be able to see my storage server, nor the ability to mount the NFS share itself.
Using a separate server for storage isn’t necessary and if the storage for my Nextcloud server was being stored on the same server I would have created a ZFS dataset on the host and mounted it into the jail.
Next I set up a dataset for the database and delegated it into the jail. Using a separate dataset allows me to specify certain properties that are better for a database, it also makes migration easier in case I ever need to move or backup the database.
With most of the requirements in place it was time to start setting up Nextcloud. The requirements for Nextcloud include your basic web stack of a web server, database, and PHP.
Also covers the setup of acme.sh for LetsEncrypt. This is now available as a package, and doesn’t need to be manually fetched
Install a few more packages, and do a bit of configuration, and you have a NextCloud server
***
Historical: My first OpenBSD Hackathon (http://bad.network/historical-my-first-openbsd-hackathon.html)
This is a blog post by our friend, and OpenBSD developer: Peter Hessler
This is a story about encouragement. Every time I use the word "I", you should think "I as in me, not I as in the author". 
In 2003, I was invited to my first OpenBSD Hackathon. Way before I was into networking, I was porting software to my favourite OS. Specifically, I was porting games.
On the first night most of the hackathon attendees end up at the bar for food and beer, and I'm sitting next to Theo de Raadt, the founder of OpenBSD. At some point during the evening, he's telling me about all of these "crazy" ideas he has about randomizing libraries, and protections that can be done in ld.so. (ld.so is the part of the OS that loads the libraries your program needs. It's, uh, kinda important.) Theo is encouraging me to help implement some of these ideas! At some point I tell Theo "I'm just a porter, I don't know C."
Theo responds with "It isn't hard, I'll have Dale (Rahn) show you how ld.so works, and you can do it." I was hoping that all of this would be forgotten by the next day, but sure enough Dale comes by. "Hey, are you Peter? Theo wanted me to show you how ld.so works" Dale spends an hour or two showing me how it works, the code structure, and how to recover in case of failure.
At first I had lots of failures. Then more failures. And even more failures. Once, I broke my machine so badly I had to reinstall it. I learned a lot about how an OS works during this. But, I eventually started doing changes without it breaking. And some even did what I wanted! By the end of the hackathon I had came up with a useful patch, that was committed as part of a larger change.
I was a nobody. With some encouragement, enough liquid courage to override my imposter syndrome, and a few hours of mentoring, I'm now doing big projects. The next time you're sitting at a table with someone new to your field, ask yourself: how can you encourage them? You just might make the world better.
Thank you Dale. And thank you Theo.
Everyone has to start somewhere.
One of the things that sets the BSDs apart from certain other open source operating systems, is the welcoming community, and the tradition of mentorship.
Sure, someone else in the OpenBSD project could have done the bits that Peter did, likely a lot more quickly, but then OpenBSD wouldn’t have gained a new committer.
So, if you are interested in working on one of the BSDs, reach out, and we’ll try to help you find a mentor.
What part of the system do you want to work on?
***
Interview - Dan McDonald - allcoms@gmail.com (mailto:allcoms@gmail.com) (danboid)
News Roundup
FreeBSD 11.1-RC1 Available (https://lists.freebsd.org/pipermail/freebsd-stable/2017-July/087340.html)
11.1-RC1 Installation images are available for:
amd64, i386
powerpc, powerpc64
sparc64
armv6 BANANAPI, BEAGLEBONE, CUBIEBOARD, CUBIEBOARD2, CUBOX-HUMMINGBOARD, GUMSTIX, RPI-B, RPI2, PANDABOARD, WANDBOARD
aarch64 (aka arm64), including the RPI3, Pine64, OverDrive 1000, and Cavium Server
A summary of changes since BETA3 includes:
Several build toolchain related fixes.
A use-after-free in RPC client code has been corrected.
The ntpd(8) leap-seconds file has been updated.
Various VM subsystem fixes.
The '_' character is now allowed in newfs(8) labels.
A potential sleep while holding a mutex has been corrected in the sa(4) driver.
A memory leak in an ioctl handler has been fixed in the ses(4) driver.
Virtual Machine Disk Images are available for the amd64 and i386 architectures.
Amazon EC2 AMI Images of FreeBSD/amd64 EC2 AMIs are available
The freebsd-update(8) utility supports binary upgrades of amd64 and i386 systems running earlier FreeBSD releases.  Systems running earlier FreeBSD releases can upgrade as follows:
freebsd-update upgrade -r 11.1-RC1
During this process, freebsd-update(8) may ask the user to help by merging some configuration files or by confirming that the automatically performed merging was done correctly.
freebsd-update install
The system must be rebooted with the newly installed kernel before continuing.
shutdown -r now
After rebooting, freebsd-update needs to be run again to install the new userland components:
freebsd-update install
It is recommended to rebuild and install all applications if possible, especially if upgrading from an earlier FreeBSD release, for example, FreeBSD 10.x.  Alternatively, the user can install misc/compat10x and other compatibility libraries, afterwards the system must be rebooted into the new userland:
shutdown -r now
Finally, after rebooting, freebsd-update needs to be run again to remove stale files:
freebsd-update install
Oil changes, safety recalls, and software patches (http://www.daemonology.net/blog/2017-06-14-oil-changes-safety-recalls-software-patches.html)
Every few months I get an email from my local mechanic reminding me that it's time to get my car's oil changed. I generally ignore these emails; it costs time and money to get this done (I'm sure I could do it myself, but the time it would cost is worth more than the money it would save) and I drive little enough — about 2000 km/year — that I'm not too worried about the consequences of going for a bit longer than nominally advised between oil changes. I do get oil changes done... but typically once every 8-12 months, rather than the recommended 4-6 months. From what I've seen, I don't think I'm alone in taking a somewhat lackadaisical approach to routine oil changes. 
On the other hand, there's another type of notification which elicits more prompt attention: Safety recalls. There are two good reasons for this: First, whether for vehicles, food, or other products, the risk of ignoring a safety recall is not merely that the product will break, but rather that the product will be actively unsafe; and second, when there's a safety recall you don't have to pay for the replacement or fix — the cost is covered by the manufacturer. 
I started thinking about this distinction — and more specifically the difference in user behaviour — in the aftermath of the "WannaCry" malware. While WannaCry attracted widespread attention for its "ransomware" nature, the more concerning aspect of this incident is how it propagated: By exploiting a vulnerability in SMB for which Microsoft issued patches two months earlier. As someone who works in computer security, I find this horrifying — and I was particularly concerned when I heard that the NHS was postponing surgeries because they couldn't access patient records. Think about it: If the NHS couldn't access patient records due to WannaCry, it suggests WannaCry infiltrated systems used to access patient records — meaning that someone else exploiting the same vulnerabilities could have accessed those records. The SMB subsystem in Windows was not merely broken; until patches were applied, it was actively unsafe. 
I imagine that most people in my industry would agree that security patches should be treated in the same vein as safety recalls — unless you're certain that you're not affected, take care of them as a matter of urgency — but it seems that far more users instead treat security patches more like oil changes: something to be taken care of when convenient... or not at all, if not convenient. It's easy to say that such users are wrong; but as an industry it's time that we think about why they are wrong rather than merely blaming them for their problems. 
There are a few factors which I think are major contributors to this problem. First, the number of updates: When critical patches occur frequently enough to become routine, alarm fatigue sets in and people cease to give the attention updates deserve, even if on a conscious level they still recognize the importance of applying updates.
Colin also talks about his time as the FreeBSD Security Officer, and the problems in ensuring the patches are correct and do not break the system when installed
He also points out the problem of systems like Windows Update, the combines optional updates, and things like its license checking tool, in the same interface that delivers important updates. Or my recent machines, that gets constant popups about how some security updates will not be delivered because my processor is too new.
My bank sends me special offers in the mail but phones if my credit card usage trips fraud alarms; this is the sort of distinction in intrusiveness we should see for different types of software updates
Finally, I think there is a problem with the mental model most people have of computer security. Movies portray attackers as geniuses who can break into any system in minutes; journalists routinely warn people that "nobody is safe"; and insurance companies offer insurance against "cyberattacks" in much the same way as they offer insurance against tornados. Faced with this wall of misinformation, it's not surprising that people get confused between 400 pound hackers sitting on beds and actual advanced persistent threats. Yes, if the NSA wants to break into your computer, they can probably do it — but most attackers are not the NSA, just like most burglars are not Ethan Hunt. You lock your front door, not because you think it will protect you from the most determined thieves, but because it's an easy step which dramatically reduces your risk from opportunistic attack; but users don't see applying security updates as the equivalent of locking their front door when they leave home.
SKIP grep, use AWK (http://blog.jpalardy.com/posts/skip-grep-use-awk/)
This is a tip from Jonathan Palardy in a series of blog posts about awk. It is especially helpful for people who write a lot of shell scripts or are using a lot of pipes with awk and grep. 
Over the years, I’ve seen many people use this pattern (filter-map):
$ [data is generated] | grep something | awk '{print $2}'
but it can be shortened to:
$ [data is generated] | awk '/something/ {print $2}'
AWK can take a regular expression (the part between the slashes) and matches that to the input. Anything that matches is being passed to the print $2 action (to print the second column). 
Why would I do this?
I can think of 4 reasons:
*it’s shorter to type
*it spawns one less process
*awk uses modern (read “Perl”) regular expressions, by default – like grep -E
*it’s ready to “augment” with more awk
How about matching the inverse (search for patterns that do NOT match)?
But “grep -v” is OK…
Many people have pointed out that “grep -v” can be done more concisely with:
$ [data is generated] | awk '! /something/'
See if you have such combinations of grep piped to awk and fix those in your shell scripts. It saves you one process and makes your scripts much more readable. Also, check out the other intro links on the blog if you are new to awk.
***
vim Adventures (https://vim-adventures.com)
This website, created by Doron Linder, will playfully teach you how to use vim.
Hit any key to get started and follow the instructions on the playing field by moving the cursor around.
There is also a menu in the bottom left corner to save your game.
Try it out, increase your vim-fu, and learn how to use a powerful text editor more efficiently.
***
Beastie Bits
Slides from PkgSrcCon (http://pkgsrc.org/pkgsrcCon/2017/talks.html)
OpenBSD’s doas adds systemd compat shim (http://marc.info/?l=openbsd-tech&amp;amp;m=149902196520920&amp;amp;w=2)
Deadlock Empire -- “Each challenge below is a computer program of two or more threads. You take the role of the Scheduler - and a cunning one! Your objective is to exploit flaws in the programs to make them crash or otherwise malfunction.” (https://deadlockempire.github.io/)
EuroBSDcon 2017 Travel Grant Application Now Open (https://www.freebsdfoundation.org/blog/eurobsdcon-2017-travel-grant-application-now-open/)
Registration for vBSDCon is open  (http://www.vbsdcon.com/) - Registration is only $100 if you register before July 31. Discount hotel rooms arranged at the Hyatt for only $100/night while supplies last.
BSD Taiwan call for papers opens, closes July 31st (https://bsdtw.org/)Windows Application Versand
***
Feedback/Questions
Joseph - Server Monitoring (http://dpaste.com/2AM6C2H#wrap)
Paulo - Updating Jails (http://dpaste.com/1Z4FBE2#wrap)
Kevin - openvpn server (http://dpaste.com/2MNM9GJ#wrap)
Todd - several questions (http://dpaste.com/17BVBJ3#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>In which we interview a unicorn, FreeNAS 11.0 is out, show you how to run Nextcloud in a FreeBSD jail, and talk about the connection between oil changes and software patches.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.freenas.org/blog/freenas-11-0/" rel="nofollow">FreeNAS 11.0 is Now Here</a></h3>

<ul>
<li>The FreeNAS blog informs us:</li>
</ul>

<blockquote>
<p>After several FreeNAS Release Candidates, FreeNAS 11.0 was released today. This version brings new virtualization and object storage features to the Worlds Most Popular Open Source Storage Operating System. FreeNAS 11.0 adds bhyve virtual machines to its popular SAN/NAS, jails, and plugins, letting you use host web-scale VMs on your FreeNAS box. It also gives users S3-compatible object storage services, which turns your FreeNAS box into an S3-compatible server, letting you avoid reliance on the cloud.<br>
FreeNAS 11.0 also introduces the beta version of a new administration GUI. The new GUI is based on the popular Angular framework and the FreeNAS team expects the GUI to be themeable and feature complete by 11.1. The new GUI follows the same flow as the existing GUI, but looks better. For now, the FreeNAS team has released it in beta form to get input from the FreeNAS community. The new GUI, as well as the classic GUI, are selectable from the login screen.<br>
Also new in FreeNAS 11 is an Alert Service page which configures the system to send critical alerts from FreeNAS to other applications and services such as Slack, PagerDuty, AWS, Hipchat, InfluxDB, Mattermost, OpsGenie, and VictorOps. FreeNAS 11.0 has an improved Services menu that adds the ability to manage which services and applications are started at boot.<br>
The FreeNAS community is large and vibrant. We invite you to join us on the <a href="https://forums.freenas.org/index.php" rel="nofollow">FreeNAS forum</a> and the #freenas IRC channel on Freenode. To download FreeNAS and sign-up for the FreeNAS Newsletter, visit <a href="http://www.freenas.org/download/" rel="nofollow">freenas.org/download</a>.</p>
</blockquote>

<hr>

<h3><a href="https://www.exoscale.ch/syslog/2017/06/26/building-an-ipsec-gateway-with-openbsd/" rel="nofollow">Building an IPsec Gateway With OpenBSD</a></h3>

<ul>
<li>Pierre-Yves Ritschard wrote the following blog article:</li>
</ul>

<blockquote>
<p>With private networks just released on Exoscale, there are now more options to implement secure access to Exoscale cloud infrastructure. While we still recommend the bastion approach, as detailed in <a href="https://www.exoscale.ch/syslog/2016/01/15/secure-your-cloud-computing-architecture-with-a-bastion/" rel="nofollow">this article</a>, there are applications or systems which do not lend themselves well to working this way.<br>
In these cases, the next best thing is building IPsec gateways. IPsec is a protocol which works directly at layer 3. It uses its configuration to determine which network flows should be sent encrypted on the wire. Once IPsec is correctly configured, selected network flows are transparently encrypted and applications do not need to modify anything to benefit from secured traffic.</p>
</blockquote>

<ul>
<li>In addition to encryption, IPSec also authenticates the end points, so you can be sure you are exchanging packets with a trusted host</li>
</ul>

<blockquote>
<p>For the purposes of this article we will work under the following assumptions: We want a host to network setup, providing access to cloud-hosted infrastructure from a desktop environment.<br>
Only stock tooling should be used on desktop environment, no additional VPN client should be needed.<br>
In this case, to ensure no additional software is needed on the client, we will configure an L2TP/IPsec gateway. This article will use OpenBSD as the operating system to implement the gateway. While this choice may sound surprising, OpenBSD excels at building gateways of all sorts thanks to its simple configuration formats and inclusion of all necessary software and documentation to do so in the base system.</p>
</blockquote>

<ul>
<li>The tutorial assumes you have setup a local network between the hosts in the cloud, and walks through the configuration of an OpenBSD host as a IPsec gateway</li>
</ul>

<blockquote>
<p>On the OpenBSD host, all necessary software is already installed. We will configure the system, as well as pf, npppd, and ipsec</p>

<ul>
<li>Configure L2TP</li>
<li>Configure IPsec</li>
<li>Configure NAT</li>
<li>Enabled services: ipsec isakmpd npppd</li>
</ul>
</blockquote>

<ul>
<li>The tutorial then walks through configuring a OS X client, but other desktops will be very similar
***</li>
</ul>

<h3><a href="https://ramsdenj.com/2017/06/05/nextcloud-in-a-jail-on-freebsd.html" rel="nofollow">Running Nextcloud in a jail on FreeBSD</a></h3>

<blockquote>
<p>I recently setup Nextcloud 12 inside a FreeBSD jail in order to allow me access to files i might need while at University. I figured this would be a optimal solution for files that I might need access to unexpectedly, on computers where I am not in complete control. My Nextcloud instance is externally accessible, and yet if someone were to get inside my Jail, I could rest easy knowing they still didnt have access to the rest of my host server. I chronicled the setup process including jail setup using iocage, https with Lets Encrypt, and full setup of the web stack.<br>
Nextcloud has a variety of features such as calendar synchronization, email, collaborative editing, and even video conferencing. I havent had time to play with all these different offerings and have only utilized the file synchronization, but even if file sync is not needed, Nextcloud has many offerings that make it worth setting up.</p>
</blockquote>

<ul>
<li>MariaDB, PHP 7.0, and Apache 2.4</li>
</ul>

<blockquote>
<p>To manage my jails Im using iocage. In terms of jail managers its a fairly new player in the game of jail management and is being very actively developed. It just had a full rewrite in Python, and while the code in the background might be different, the actual user interface has stayed the same.<br>
Iocage makes use of ZFS clones in order to create base jails, which allow for sharing of one set of system packages between multiple jails, reducing the amount of resources necessary. Alternatively, jails can be completely independent from each other; however, using a base jail makes it easier to update multiple jails as well.</p>

<ul>
<li>pkg install iocage</li>
<li>sysrc iocage_enable=YES</li>
<li>iocage fetch -r 11.0-RELEASE</li>
<li>iocage create tag=&quot;stratus&quot; jail_zfs=on vnet=off boot=on ip4_addr=&quot;sge0|172.20.0.100/32&quot; -r 11.0-RELEASE</li>
<li>iocage start stratus</li>
<li>iocage console stratus</li>
</ul>

<p>I have chosen to provide storage to the Nextcloud Jail by mounting a dataset over NFS on my host box. This means my server can focus on serving Nextcloud and my storage box can focus on housing the data. The Nextcloud Jail is not even aware of this since the NFS Mount is simply mounted by the host server into the jail. The other benefit of this is the Nextcloud jail doesnt need to be able to see my storage server, nor the ability to mount the NFS share itself.<br>
Using a separate server for storage isnt necessary and if the storage for my Nextcloud server was being stored on the same server I would have created a ZFS dataset on the host and mounted it into the jail.<br>
Next I set up a dataset for the database and delegated it into the jail. Using a separate dataset allows me to specify certain properties that are better for a database, it also makes migration easier in case I ever need to move or backup the database.<br>
With most of the requirements in place it was time to start setting up Nextcloud. The requirements for Nextcloud include your basic web stack of a web server, database, and PHP.</p>
</blockquote>

<ul>
<li>Also covers the setup of acme.sh for LetsEncrypt. This is now available as a package, and doesnt need to be manually fetched</li>
<li>Install a few more packages, and do a bit of configuration, and you have a NextCloud server
***</li>
</ul>

<h3><a href="http://bad.network/historical-my-first-openbsd-hackathon.html" rel="nofollow">Historical: My first OpenBSD Hackathon</a></h3>

<ul>
<li>This is a blog post by our friend, and OpenBSD developer: Peter Hessler</li>
</ul>

<blockquote>
<p>This is a story about encouragement. Every time I use the word &quot;I&quot;, you should think &quot;I as in me, not I as in the author&quot;. <br>
In 2003, I was invited to my first OpenBSD Hackathon. Way before I was into networking, I was porting software to my favourite OS. Specifically, I was porting games.<br>
On the first night most of the hackathon attendees end up at the bar for food and beer, and I&#39;m sitting next to Theo de Raadt, the founder of OpenBSD. At some point during the evening, he&#39;s telling me about all of these &quot;crazy&quot; ideas he has about randomizing libraries, and protections that can be done in ld.so. (ld.so is the part of the OS that loads the libraries your program needs. It&#39;s, uh, kinda important.) Theo is encouraging me to help implement some of these ideas! At some point I tell Theo &quot;I&#39;m just a porter, I don&#39;t know C.&quot;<br>
Theo responds with &quot;It isn&#39;t hard, I&#39;ll have Dale (Rahn) show you how ld.so works, and you can do it.&quot; I was hoping that all of this would be forgotten by the next day, but sure enough Dale comes by. &quot;Hey, are you Peter? Theo wanted me to show you how ld.so works&quot; Dale spends an hour or two showing me how it works, the code structure, and how to recover in case of failure.<br>
At first I had lots of failures. Then more failures. And even more failures. Once, I broke my machine so badly I had to reinstall it. I learned a lot about how an OS works during this. But, I eventually started doing changes without it breaking. And some even did what I wanted! By the end of the hackathon I had came up with a useful patch, that was committed as part of a larger change.<br>
I was a nobody. With some encouragement, enough liquid courage to override my imposter syndrome, and a few hours of mentoring, I&#39;m now doing big projects. The next time you&#39;re sitting at a table with someone new to your field, ask yourself: how can you encourage them? You just might make the world better.<br>
Thank you Dale. And thank you Theo.</p>
</blockquote>

<ul>
<li>Everyone has to start somewhere.</li>
<li>One of the things that sets the BSDs apart from certain other open source operating systems, is the welcoming community, and the tradition of mentorship.</li>
<li>Sure, someone else in the OpenBSD project could have done the bits that Peter did, likely a lot more quickly, but then OpenBSD wouldnt have gained a new committer.</li>
<li>So, if you are interested in working on one of the BSDs, reach out, and well try to help you find a mentor.</li>
<li>What part of the system do you want to work on?
***</li>
</ul>

<h4>Interview - Dan McDonald - <a href="mailto:allcoms@gmail.com" rel="nofollow">allcoms@gmail.com</a> (danboid)</h4>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2017-July/087340.html" rel="nofollow">FreeBSD 11.1-RC1 Available</a></h3>

<ul>
<li>11.1-RC1 Installation images are available for:

<ul>
<li>amd64, i386</li>
<li>powerpc, powerpc64</li>
<li>sparc64</li>
<li>armv6 BANANAPI, BEAGLEBONE, CUBIEBOARD, CUBIEBOARD2, CUBOX-HUMMINGBOARD, GUMSTIX, RPI-B, RPI2, PANDABOARD, WANDBOARD</li>
<li>aarch64 (aka arm64), including the RPI3, Pine64, OverDrive 1000, and Cavium Server</li>
</ul></li>
<li>A summary of changes since BETA3 includes:

<ul>
<li>Several build toolchain related fixes.</li>
<li>A use-after-free in RPC client code has been corrected.</li>
<li>The ntpd(8) leap-seconds file has been updated.</li>
<li>Various VM subsystem fixes.</li>
<li>The &#39;_&#39; character is now allowed in newfs(8) labels.</li>
<li>A potential sleep while holding a mutex has been corrected in the sa(4) driver.</li>
<li>A memory leak in an ioctl handler has been fixed in the ses(4) driver.</li>
</ul></li>
<li>Virtual Machine Disk Images are available for the amd64 and i386 architectures.</li>
<li>Amazon EC2 AMI Images of FreeBSD/amd64 EC2 AMIs are available

<ul>
<li>The freebsd-update(8) utility supports binary upgrades of amd64 and i386 systems running earlier FreeBSD releases.  Systems running earlier FreeBSD releases can upgrade as follows:</li>
</ul></li>
</ul>

<blockquote>
<p>freebsd-update upgrade -r 11.1-RC1</p>
</blockquote>

<ul>
<li>During this process, freebsd-update(8) may ask the user to help by merging some configuration files or by confirming that the automatically performed merging was done correctly.</li>
</ul>

<blockquote>
<p>freebsd-update install</p>
</blockquote>

<ul>
<li>The system must be rebooted with the newly installed kernel before continuing.</li>
</ul>

<blockquote>
<p>shutdown -r now</p>
</blockquote>

<ul>
<li>After rebooting, freebsd-update needs to be run again to install the new userland components:</li>
</ul>

<blockquote>
<p>freebsd-update install</p>
</blockquote>

<ul>
<li>It is recommended to rebuild and install all applications if possible, especially if upgrading from an earlier FreeBSD release, for example, FreeBSD 10.x.  Alternatively, the user can install misc/compat10x and other compatibility libraries, afterwards the system must be rebooted into the new userland:</li>
</ul>

<blockquote>
<p>shutdown -r now</p>
</blockquote>

<ul>
<li>Finally, after rebooting, freebsd-update needs to be run again to remove stale files:</li>
</ul>

<blockquote>
<p>freebsd-update install</p>

<hr>
</blockquote>

<h3><a href="http://www.daemonology.net/blog/2017-06-14-oil-changes-safety-recalls-software-patches.html" rel="nofollow">Oil changes, safety recalls, and software patches</a></h3>

<blockquote>
<p>Every few months I get an email from my local mechanic reminding me that it&#39;s time to get my car&#39;s oil changed. I generally ignore these emails; it costs time and money to get this done (I&#39;m sure I could do it myself, but the time it would cost is worth more than the money it would save) and I drive little enough  about 2000 km/year  that I&#39;m not too worried about the consequences of going for a bit longer than nominally advised between oil changes. I do get oil changes done... but typically once every 8-12 months, rather than the recommended 4-6 months. From what I&#39;ve seen, I don&#39;t think I&#39;m alone in taking a somewhat lackadaisical approach to routine oil changes. <br>
On the other hand, there&#39;s another type of notification which elicits more prompt attention: Safety recalls. There are two good reasons for this: First, whether for vehicles, food, or other products, the risk of ignoring a safety recall is not merely that the product will break, but rather that the product will be actively unsafe; and second, when there&#39;s a safety recall you don&#39;t have to pay for the replacement or fix  the cost is covered by the manufacturer. <br>
I started thinking about this distinction  and more specifically the difference in user behaviour  in the aftermath of the &quot;WannaCry&quot; malware. While WannaCry attracted widespread attention for its &quot;ransomware&quot; nature, the more concerning aspect of this incident is how it propagated: By exploiting a vulnerability in SMB for which Microsoft issued patches two months earlier. As someone who works in computer security, I find this horrifying  and I was particularly concerned when I heard that the NHS was postponing surgeries because they couldn&#39;t access patient records. Think about it: If the NHS couldn&#39;t access patient records due to WannaCry, it suggests WannaCry infiltrated systems used to access patient records  meaning that someone else exploiting the same vulnerabilities could have accessed those records. The SMB subsystem in Windows was not merely broken; until patches were applied, it was actively unsafe. <br>
I imagine that most people in my industry would agree that security patches should be treated in the same vein as safety recalls  unless you&#39;re certain that you&#39;re not affected, take care of them as a matter of urgency  but it seems that far more users instead treat security patches more like oil changes: something to be taken care of when convenient... or not at all, if not convenient. It&#39;s easy to say that such users are wrong; but as an industry it&#39;s time that we think about why they are wrong rather than merely blaming them for their problems. <br>
There are a few factors which I think are major contributors to this problem. First, the number of updates: When critical patches occur frequently enough to become routine, alarm fatigue sets in and people cease to give the attention updates deserve, even if on a conscious level they still recognize the importance of applying updates.</p>
</blockquote>

<ul>
<li>Colin also talks about his time as the FreeBSD Security Officer, and the problems in ensuring the patches are correct and do not break the system when installed</li>
<li>He also points out the problem of systems like Windows Update, the combines optional updates, and things like its license checking tool, in the same interface that delivers important updates. Or my recent machines, that gets constant popups about how some security updates will not be delivered because my processor is too new.</li>
</ul>

<blockquote>
<p>My bank sends me special offers in the mail but phones if my credit card usage trips fraud alarms; this is the sort of distinction in intrusiveness we should see for different types of software updates<br>
Finally, I think there is a problem with the mental model most people have of computer security. Movies portray attackers as geniuses who can break into any system in minutes; journalists routinely warn people that &quot;nobody is safe&quot;; and insurance companies offer insurance against &quot;cyberattacks&quot; in much the same way as they offer insurance against tornados. Faced with this wall of misinformation, it&#39;s not surprising that people get confused between 400 pound hackers sitting on beds and actual advanced persistent threats. Yes, if the NSA wants to break into your computer, they can probably do it  but most attackers are not the NSA, just like most burglars are not Ethan Hunt. You lock your front door, not because you think it will protect you from the most determined thieves, but because it&#39;s an easy step which dramatically reduces your risk from opportunistic attack; but users don&#39;t see applying security updates as the equivalent of locking their front door when they leave home.</p>

<hr>
</blockquote>

<h3><a href="http://blog.jpalardy.com/posts/skip-grep-use-awk/" rel="nofollow">SKIP grep, use AWK</a></h3>

<ul>
<li>This is a tip from Jonathan Palardy in a series of blog posts about awk. It is especially helpful for people who write a lot of shell scripts or are using a lot of pipes with awk and grep. </li>
</ul>

<blockquote>
<p>Over the years, Ive seen many people use this pattern (filter-map):</p>

<p>$ [data is generated] | grep something | awk &#39;{print $2}&#39;</p>

<p>but it can be shortened to:</p>

<p>$ [data is generated] | awk &#39;/something/ {print $2}&#39;</p>
</blockquote>

<ul>
<li>AWK can take a regular expression (the part between the slashes) and matches that to the input. Anything that matches is being passed to the print $2 action (to print the second column). </li>
</ul>

<blockquote>
<p>Why would I do this?</p>

<p>I can think of 4 reasons:<br>
*its shorter to type<br>
*it spawns one less process<br>
*awk uses modern (read Perl) regular expressions, by default  like grep -E<br>
*its ready to augment with more awk</p>
</blockquote>

<ul>
<li>How about matching the inverse (search for patterns that do NOT match)?</li>
</ul>

<blockquote>
<p>But grep -v is OK<br>
Many people have pointed out that grep -v can be done more concisely with:</p>

<p>$ [data is generated] | awk &#39;! /something/&#39;</p>
</blockquote>

<ul>
<li>See if you have such combinations of grep piped to awk and fix those in your shell scripts. It saves you one process and makes your scripts much more readable. Also, check out the other intro links on the blog if you are new to awk.
***</li>
</ul>

<h3><a href="https://vim-adventures.com" rel="nofollow">vim Adventures</a></h3>

<ul>
<li>This website, created by Doron Linder, will playfully teach you how to use vim.</li>
<li>Hit any key to get started and follow the instructions on the playing field by moving the cursor around.</li>
<li>There is also a menu in the bottom left corner to save your game.</li>
<li>Try it out, increase your vim-fu, and learn how to use a powerful text editor more efficiently.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://pkgsrc.org/pkgsrcCon/2017/talks.html" rel="nofollow">Slides from PkgSrcCon</a></li>
<li><a href="http://marc.info/?l=openbsd-tech&m=149902196520920&w=2" rel="nofollow">OpenBSDs doas adds systemd compat shim</a></li>
<li><a href="https://deadlockempire.github.io/" rel="nofollow">Deadlock Empire -- Each challenge below is a computer program of two or more threads. You take the role of the Scheduler - and a cunning one! Your objective is to exploit flaws in the programs to make them crash or otherwise malfunction.</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/eurobsdcon-2017-travel-grant-application-now-open/" rel="nofollow">EuroBSDcon 2017 Travel Grant Application Now Open</a></li>
<li><a href="http://www.vbsdcon.com/" rel="nofollow">Registration for vBSDCon is open </a> - Registration is only $100 if you register before July 31. Discount hotel rooms arranged at the Hyatt for only $100/night while supplies last.</li>
<li><a href="https://bsdtw.org/" rel="nofollow">BSD Taiwan call for papers opens, closes July 31st</a>Windows Application Versand
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2AM6C2H#wrap" rel="nofollow">Joseph - Server Monitoring</a></li>
<li><a href="http://dpaste.com/1Z4FBE2#wrap" rel="nofollow">Paulo - Updating Jails</a></li>
<li><a href="http://dpaste.com/2MNM9GJ#wrap" rel="nofollow">Kevin - openvpn server</a></li>
<li><a href="http://dpaste.com/17BVBJ3#wrap" rel="nofollow">Todd - several questions</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>In which we interview a unicorn, FreeNAS 11.0 is out, show you how to run Nextcloud in a FreeBSD jail, and talk about the connection between oil changes and software patches.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.freenas.org/blog/freenas-11-0/" rel="nofollow">FreeNAS 11.0 is Now Here</a></h3>

<ul>
<li>The FreeNAS blog informs us:</li>
</ul>

<blockquote>
<p>After several FreeNAS Release Candidates, FreeNAS 11.0 was released today. This version brings new virtualization and object storage features to the Worlds Most Popular Open Source Storage Operating System. FreeNAS 11.0 adds bhyve virtual machines to its popular SAN/NAS, jails, and plugins, letting you use host web-scale VMs on your FreeNAS box. It also gives users S3-compatible object storage services, which turns your FreeNAS box into an S3-compatible server, letting you avoid reliance on the cloud.<br>
FreeNAS 11.0 also introduces the beta version of a new administration GUI. The new GUI is based on the popular Angular framework and the FreeNAS team expects the GUI to be themeable and feature complete by 11.1. The new GUI follows the same flow as the existing GUI, but looks better. For now, the FreeNAS team has released it in beta form to get input from the FreeNAS community. The new GUI, as well as the classic GUI, are selectable from the login screen.<br>
Also new in FreeNAS 11 is an Alert Service page which configures the system to send critical alerts from FreeNAS to other applications and services such as Slack, PagerDuty, AWS, Hipchat, InfluxDB, Mattermost, OpsGenie, and VictorOps. FreeNAS 11.0 has an improved Services menu that adds the ability to manage which services and applications are started at boot.<br>
The FreeNAS community is large and vibrant. We invite you to join us on the <a href="https://forums.freenas.org/index.php" rel="nofollow">FreeNAS forum</a> and the #freenas IRC channel on Freenode. To download FreeNAS and sign-up for the FreeNAS Newsletter, visit <a href="http://www.freenas.org/download/" rel="nofollow">freenas.org/download</a>.</p>
</blockquote>

<hr>

<h3><a href="https://www.exoscale.ch/syslog/2017/06/26/building-an-ipsec-gateway-with-openbsd/" rel="nofollow">Building an IPsec Gateway With OpenBSD</a></h3>

<ul>
<li>Pierre-Yves Ritschard wrote the following blog article:</li>
</ul>

<blockquote>
<p>With private networks just released on Exoscale, there are now more options to implement secure access to Exoscale cloud infrastructure. While we still recommend the bastion approach, as detailed in <a href="https://www.exoscale.ch/syslog/2016/01/15/secure-your-cloud-computing-architecture-with-a-bastion/" rel="nofollow">this article</a>, there are applications or systems which do not lend themselves well to working this way.<br>
In these cases, the next best thing is building IPsec gateways. IPsec is a protocol which works directly at layer 3. It uses its configuration to determine which network flows should be sent encrypted on the wire. Once IPsec is correctly configured, selected network flows are transparently encrypted and applications do not need to modify anything to benefit from secured traffic.</p>
</blockquote>

<ul>
<li>In addition to encryption, IPSec also authenticates the end points, so you can be sure you are exchanging packets with a trusted host</li>
</ul>

<blockquote>
<p>For the purposes of this article we will work under the following assumptions: We want a host to network setup, providing access to cloud-hosted infrastructure from a desktop environment.<br>
Only stock tooling should be used on desktop environment, no additional VPN client should be needed.<br>
In this case, to ensure no additional software is needed on the client, we will configure an L2TP/IPsec gateway. This article will use OpenBSD as the operating system to implement the gateway. While this choice may sound surprising, OpenBSD excels at building gateways of all sorts thanks to its simple configuration formats and inclusion of all necessary software and documentation to do so in the base system.</p>
</blockquote>

<ul>
<li>The tutorial assumes you have setup a local network between the hosts in the cloud, and walks through the configuration of an OpenBSD host as a IPsec gateway</li>
</ul>

<blockquote>
<p>On the OpenBSD host, all necessary software is already installed. We will configure the system, as well as pf, npppd, and ipsec</p>

<ul>
<li>Configure L2TP</li>
<li>Configure IPsec</li>
<li>Configure NAT</li>
<li>Enabled services: ipsec isakmpd npppd</li>
</ul>
</blockquote>

<ul>
<li>The tutorial then walks through configuring a OS X client, but other desktops will be very similar
***</li>
</ul>

<h3><a href="https://ramsdenj.com/2017/06/05/nextcloud-in-a-jail-on-freebsd.html" rel="nofollow">Running Nextcloud in a jail on FreeBSD</a></h3>

<blockquote>
<p>I recently setup Nextcloud 12 inside a FreeBSD jail in order to allow me access to files i might need while at University. I figured this would be a optimal solution for files that I might need access to unexpectedly, on computers where I am not in complete control. My Nextcloud instance is externally accessible, and yet if someone were to get inside my Jail, I could rest easy knowing they still didnt have access to the rest of my host server. I chronicled the setup process including jail setup using iocage, https with Lets Encrypt, and full setup of the web stack.<br>
Nextcloud has a variety of features such as calendar synchronization, email, collaborative editing, and even video conferencing. I havent had time to play with all these different offerings and have only utilized the file synchronization, but even if file sync is not needed, Nextcloud has many offerings that make it worth setting up.</p>
</blockquote>

<ul>
<li>MariaDB, PHP 7.0, and Apache 2.4</li>
</ul>

<blockquote>
<p>To manage my jails Im using iocage. In terms of jail managers its a fairly new player in the game of jail management and is being very actively developed. It just had a full rewrite in Python, and while the code in the background might be different, the actual user interface has stayed the same.<br>
Iocage makes use of ZFS clones in order to create base jails, which allow for sharing of one set of system packages between multiple jails, reducing the amount of resources necessary. Alternatively, jails can be completely independent from each other; however, using a base jail makes it easier to update multiple jails as well.</p>

<ul>
<li>pkg install iocage</li>
<li>sysrc iocage_enable=YES</li>
<li>iocage fetch -r 11.0-RELEASE</li>
<li>iocage create tag=&quot;stratus&quot; jail_zfs=on vnet=off boot=on ip4_addr=&quot;sge0|172.20.0.100/32&quot; -r 11.0-RELEASE</li>
<li>iocage start stratus</li>
<li>iocage console stratus</li>
</ul>

<p>I have chosen to provide storage to the Nextcloud Jail by mounting a dataset over NFS on my host box. This means my server can focus on serving Nextcloud and my storage box can focus on housing the data. The Nextcloud Jail is not even aware of this since the NFS Mount is simply mounted by the host server into the jail. The other benefit of this is the Nextcloud jail doesnt need to be able to see my storage server, nor the ability to mount the NFS share itself.<br>
Using a separate server for storage isnt necessary and if the storage for my Nextcloud server was being stored on the same server I would have created a ZFS dataset on the host and mounted it into the jail.<br>
Next I set up a dataset for the database and delegated it into the jail. Using a separate dataset allows me to specify certain properties that are better for a database, it also makes migration easier in case I ever need to move or backup the database.<br>
With most of the requirements in place it was time to start setting up Nextcloud. The requirements for Nextcloud include your basic web stack of a web server, database, and PHP.</p>
</blockquote>

<ul>
<li>Also covers the setup of acme.sh for LetsEncrypt. This is now available as a package, and doesnt need to be manually fetched</li>
<li>Install a few more packages, and do a bit of configuration, and you have a NextCloud server
***</li>
</ul>

<h3><a href="http://bad.network/historical-my-first-openbsd-hackathon.html" rel="nofollow">Historical: My first OpenBSD Hackathon</a></h3>

<ul>
<li>This is a blog post by our friend, and OpenBSD developer: Peter Hessler</li>
</ul>

<blockquote>
<p>This is a story about encouragement. Every time I use the word &quot;I&quot;, you should think &quot;I as in me, not I as in the author&quot;. <br>
In 2003, I was invited to my first OpenBSD Hackathon. Way before I was into networking, I was porting software to my favourite OS. Specifically, I was porting games.<br>
On the first night most of the hackathon attendees end up at the bar for food and beer, and I&#39;m sitting next to Theo de Raadt, the founder of OpenBSD. At some point during the evening, he&#39;s telling me about all of these &quot;crazy&quot; ideas he has about randomizing libraries, and protections that can be done in ld.so. (ld.so is the part of the OS that loads the libraries your program needs. It&#39;s, uh, kinda important.) Theo is encouraging me to help implement some of these ideas! At some point I tell Theo &quot;I&#39;m just a porter, I don&#39;t know C.&quot;<br>
Theo responds with &quot;It isn&#39;t hard, I&#39;ll have Dale (Rahn) show you how ld.so works, and you can do it.&quot; I was hoping that all of this would be forgotten by the next day, but sure enough Dale comes by. &quot;Hey, are you Peter? Theo wanted me to show you how ld.so works&quot; Dale spends an hour or two showing me how it works, the code structure, and how to recover in case of failure.<br>
At first I had lots of failures. Then more failures. And even more failures. Once, I broke my machine so badly I had to reinstall it. I learned a lot about how an OS works during this. But, I eventually started doing changes without it breaking. And some even did what I wanted! By the end of the hackathon I had came up with a useful patch, that was committed as part of a larger change.<br>
I was a nobody. With some encouragement, enough liquid courage to override my imposter syndrome, and a few hours of mentoring, I&#39;m now doing big projects. The next time you&#39;re sitting at a table with someone new to your field, ask yourself: how can you encourage them? You just might make the world better.<br>
Thank you Dale. And thank you Theo.</p>
</blockquote>

<ul>
<li>Everyone has to start somewhere.</li>
<li>One of the things that sets the BSDs apart from certain other open source operating systems, is the welcoming community, and the tradition of mentorship.</li>
<li>Sure, someone else in the OpenBSD project could have done the bits that Peter did, likely a lot more quickly, but then OpenBSD wouldnt have gained a new committer.</li>
<li>So, if you are interested in working on one of the BSDs, reach out, and well try to help you find a mentor.</li>
<li>What part of the system do you want to work on?
***</li>
</ul>

<h4>Interview - Dan McDonald - <a href="mailto:allcoms@gmail.com" rel="nofollow">allcoms@gmail.com</a> (danboid)</h4>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2017-July/087340.html" rel="nofollow">FreeBSD 11.1-RC1 Available</a></h3>

<ul>
<li>11.1-RC1 Installation images are available for:

<ul>
<li>amd64, i386</li>
<li>powerpc, powerpc64</li>
<li>sparc64</li>
<li>armv6 BANANAPI, BEAGLEBONE, CUBIEBOARD, CUBIEBOARD2, CUBOX-HUMMINGBOARD, GUMSTIX, RPI-B, RPI2, PANDABOARD, WANDBOARD</li>
<li>aarch64 (aka arm64), including the RPI3, Pine64, OverDrive 1000, and Cavium Server</li>
</ul></li>
<li>A summary of changes since BETA3 includes:

<ul>
<li>Several build toolchain related fixes.</li>
<li>A use-after-free in RPC client code has been corrected.</li>
<li>The ntpd(8) leap-seconds file has been updated.</li>
<li>Various VM subsystem fixes.</li>
<li>The &#39;_&#39; character is now allowed in newfs(8) labels.</li>
<li>A potential sleep while holding a mutex has been corrected in the sa(4) driver.</li>
<li>A memory leak in an ioctl handler has been fixed in the ses(4) driver.</li>
</ul></li>
<li>Virtual Machine Disk Images are available for the amd64 and i386 architectures.</li>
<li>Amazon EC2 AMI Images of FreeBSD/amd64 EC2 AMIs are available

<ul>
<li>The freebsd-update(8) utility supports binary upgrades of amd64 and i386 systems running earlier FreeBSD releases.  Systems running earlier FreeBSD releases can upgrade as follows:</li>
</ul></li>
</ul>

<blockquote>
<p>freebsd-update upgrade -r 11.1-RC1</p>
</blockquote>

<ul>
<li>During this process, freebsd-update(8) may ask the user to help by merging some configuration files or by confirming that the automatically performed merging was done correctly.</li>
</ul>

<blockquote>
<p>freebsd-update install</p>
</blockquote>

<ul>
<li>The system must be rebooted with the newly installed kernel before continuing.</li>
</ul>

<blockquote>
<p>shutdown -r now</p>
</blockquote>

<ul>
<li>After rebooting, freebsd-update needs to be run again to install the new userland components:</li>
</ul>

<blockquote>
<p>freebsd-update install</p>
</blockquote>

<ul>
<li>It is recommended to rebuild and install all applications if possible, especially if upgrading from an earlier FreeBSD release, for example, FreeBSD 10.x.  Alternatively, the user can install misc/compat10x and other compatibility libraries, afterwards the system must be rebooted into the new userland:</li>
</ul>

<blockquote>
<p>shutdown -r now</p>
</blockquote>

<ul>
<li>Finally, after rebooting, freebsd-update needs to be run again to remove stale files:</li>
</ul>

<blockquote>
<p>freebsd-update install</p>

<hr>
</blockquote>

<h3><a href="http://www.daemonology.net/blog/2017-06-14-oil-changes-safety-recalls-software-patches.html" rel="nofollow">Oil changes, safety recalls, and software patches</a></h3>

<blockquote>
<p>Every few months I get an email from my local mechanic reminding me that it&#39;s time to get my car&#39;s oil changed. I generally ignore these emails; it costs time and money to get this done (I&#39;m sure I could do it myself, but the time it would cost is worth more than the money it would save) and I drive little enough  about 2000 km/year  that I&#39;m not too worried about the consequences of going for a bit longer than nominally advised between oil changes. I do get oil changes done... but typically once every 8-12 months, rather than the recommended 4-6 months. From what I&#39;ve seen, I don&#39;t think I&#39;m alone in taking a somewhat lackadaisical approach to routine oil changes. <br>
On the other hand, there&#39;s another type of notification which elicits more prompt attention: Safety recalls. There are two good reasons for this: First, whether for vehicles, food, or other products, the risk of ignoring a safety recall is not merely that the product will break, but rather that the product will be actively unsafe; and second, when there&#39;s a safety recall you don&#39;t have to pay for the replacement or fix  the cost is covered by the manufacturer. <br>
I started thinking about this distinction  and more specifically the difference in user behaviour  in the aftermath of the &quot;WannaCry&quot; malware. While WannaCry attracted widespread attention for its &quot;ransomware&quot; nature, the more concerning aspect of this incident is how it propagated: By exploiting a vulnerability in SMB for which Microsoft issued patches two months earlier. As someone who works in computer security, I find this horrifying  and I was particularly concerned when I heard that the NHS was postponing surgeries because they couldn&#39;t access patient records. Think about it: If the NHS couldn&#39;t access patient records due to WannaCry, it suggests WannaCry infiltrated systems used to access patient records  meaning that someone else exploiting the same vulnerabilities could have accessed those records. The SMB subsystem in Windows was not merely broken; until patches were applied, it was actively unsafe. <br>
I imagine that most people in my industry would agree that security patches should be treated in the same vein as safety recalls  unless you&#39;re certain that you&#39;re not affected, take care of them as a matter of urgency  but it seems that far more users instead treat security patches more like oil changes: something to be taken care of when convenient... or not at all, if not convenient. It&#39;s easy to say that such users are wrong; but as an industry it&#39;s time that we think about why they are wrong rather than merely blaming them for their problems. <br>
There are a few factors which I think are major contributors to this problem. First, the number of updates: When critical patches occur frequently enough to become routine, alarm fatigue sets in and people cease to give the attention updates deserve, even if on a conscious level they still recognize the importance of applying updates.</p>
</blockquote>

<ul>
<li>Colin also talks about his time as the FreeBSD Security Officer, and the problems in ensuring the patches are correct and do not break the system when installed</li>
<li>He also points out the problem of systems like Windows Update, the combines optional updates, and things like its license checking tool, in the same interface that delivers important updates. Or my recent machines, that gets constant popups about how some security updates will not be delivered because my processor is too new.</li>
</ul>

<blockquote>
<p>My bank sends me special offers in the mail but phones if my credit card usage trips fraud alarms; this is the sort of distinction in intrusiveness we should see for different types of software updates<br>
Finally, I think there is a problem with the mental model most people have of computer security. Movies portray attackers as geniuses who can break into any system in minutes; journalists routinely warn people that &quot;nobody is safe&quot;; and insurance companies offer insurance against &quot;cyberattacks&quot; in much the same way as they offer insurance against tornados. Faced with this wall of misinformation, it&#39;s not surprising that people get confused between 400 pound hackers sitting on beds and actual advanced persistent threats. Yes, if the NSA wants to break into your computer, they can probably do it  but most attackers are not the NSA, just like most burglars are not Ethan Hunt. You lock your front door, not because you think it will protect you from the most determined thieves, but because it&#39;s an easy step which dramatically reduces your risk from opportunistic attack; but users don&#39;t see applying security updates as the equivalent of locking their front door when they leave home.</p>

<hr>
</blockquote>

<h3><a href="http://blog.jpalardy.com/posts/skip-grep-use-awk/" rel="nofollow">SKIP grep, use AWK</a></h3>

<ul>
<li>This is a tip from Jonathan Palardy in a series of blog posts about awk. It is especially helpful for people who write a lot of shell scripts or are using a lot of pipes with awk and grep. </li>
</ul>

<blockquote>
<p>Over the years, Ive seen many people use this pattern (filter-map):</p>

<p>$ [data is generated] | grep something | awk &#39;{print $2}&#39;</p>

<p>but it can be shortened to:</p>

<p>$ [data is generated] | awk &#39;/something/ {print $2}&#39;</p>
</blockquote>

<ul>
<li>AWK can take a regular expression (the part between the slashes) and matches that to the input. Anything that matches is being passed to the print $2 action (to print the second column). </li>
</ul>

<blockquote>
<p>Why would I do this?</p>

<p>I can think of 4 reasons:<br>
*its shorter to type<br>
*it spawns one less process<br>
*awk uses modern (read Perl) regular expressions, by default  like grep -E<br>
*its ready to augment with more awk</p>
</blockquote>

<ul>
<li>How about matching the inverse (search for patterns that do NOT match)?</li>
</ul>

<blockquote>
<p>But grep -v is OK<br>
Many people have pointed out that grep -v can be done more concisely with:</p>

<p>$ [data is generated] | awk &#39;! /something/&#39;</p>
</blockquote>

<ul>
<li>See if you have such combinations of grep piped to awk and fix those in your shell scripts. It saves you one process and makes your scripts much more readable. Also, check out the other intro links on the blog if you are new to awk.
***</li>
</ul>

<h3><a href="https://vim-adventures.com" rel="nofollow">vim Adventures</a></h3>

<ul>
<li>This website, created by Doron Linder, will playfully teach you how to use vim.</li>
<li>Hit any key to get started and follow the instructions on the playing field by moving the cursor around.</li>
<li>There is also a menu in the bottom left corner to save your game.</li>
<li>Try it out, increase your vim-fu, and learn how to use a powerful text editor more efficiently.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://pkgsrc.org/pkgsrcCon/2017/talks.html" rel="nofollow">Slides from PkgSrcCon</a></li>
<li><a href="http://marc.info/?l=openbsd-tech&m=149902196520920&w=2" rel="nofollow">OpenBSDs doas adds systemd compat shim</a></li>
<li><a href="https://deadlockempire.github.io/" rel="nofollow">Deadlock Empire -- Each challenge below is a computer program of two or more threads. You take the role of the Scheduler - and a cunning one! Your objective is to exploit flaws in the programs to make them crash or otherwise malfunction.</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/eurobsdcon-2017-travel-grant-application-now-open/" rel="nofollow">EuroBSDcon 2017 Travel Grant Application Now Open</a></li>
<li><a href="http://www.vbsdcon.com/" rel="nofollow">Registration for vBSDCon is open </a> - Registration is only $100 if you register before July 31. Discount hotel rooms arranged at the Hyatt for only $100/night while supplies last.</li>
<li><a href="https://bsdtw.org/" rel="nofollow">BSD Taiwan call for papers opens, closes July 31st</a>Windows Application Versand
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2AM6C2H#wrap" rel="nofollow">Joseph - Server Monitoring</a></li>
<li><a href="http://dpaste.com/1Z4FBE2#wrap" rel="nofollow">Paulo - Updating Jails</a></li>
<li><a href="http://dpaste.com/2MNM9GJ#wrap" rel="nofollow">Kevin - openvpn server</a></li>
<li><a href="http://dpaste.com/17BVBJ3#wrap" rel="nofollow">Todd - several questions</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>200: Getting Scrubbed to Death</title>
  <link>https://www.bsdnow.tv/200</link>
  <guid isPermaLink="false">8c580651-dcfa-454a-801a-f074597cf4a0</guid>
  <pubDate>Wed, 28 Jun 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8c580651-dcfa-454a-801a-f074597cf4a0.mp3" length="68369620" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The NetBSD 8.0 release process is underway, we try to measure the weight of an electron, and look at stack clashing.</itunes:subtitle>
  <itunes:duration>1:34:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The NetBSD 8.0 release process is underway, we try to measure the weight of an electron, and look at stack clashing.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
NetBSD 8.0 release process underway (https://mail-index.netbsd.org/netbsd-announce/2017/06/06/msg000267.html)
Soren Jacobsen writes on NetBSD-announce:
If you've been reading source-changes@, you likely noticed the recent creation of the netbsd-8 branch.  If you haven't been reading source-changes@, here's some news: the netbsd-8 branch has been created, signaling the beginning of the release process for NetBSD 8.0.
We don't have a strict timeline for the 8.0 release, but things are looking pretty good at the moment, and we expect this release to happen in a shorter amount of time than the last couple major releases did.
At this point, we would love for folks to test out netbsd-8 and let us know how it goes.  A couple of major improvements since 7.0 are the addition of USB 3 support and an overhaul of the audio subsystem, including an in-kernel mixer.  Feedback about these areas is particularly desired.
To download the latest binaries built from the netbsd-8 branch, head to
[http://daily-builds.NetBSD.org/pub/NetBSD-daily/netbsd-8/(]http://daily-builds.NetBSD.org/pub/NetBSD-daily/netbsd-8/)
Thanks in advance for helping make NetBSD 8.0 a stellar release!
OpenIndiana Hipster 2017.04 is here (https://www.openindiana.org/2017/05/03/openindiana-hipster-2017-04-is-here/)
Desktop software and libraries
Xorg was updated to 1.18.4, xorg libraries and drivers were updated.
Mate was updated to 1.16
Intel video driver was updated, the list of supported hardware has significantly extended (https://wiki.openindiana.org/oi/Intel+KMS+driver)
libsmb was updated to 4.4.6
gvfs was updated to 1.26.0
gtk3 was updated to 3.18.9
Major text editors were updated (we ship vim 8.0.104, joe 4.4, emacs 25.2, nano 2.7.5
pulseaudio was updated to 10.0
firefox was updated to 45.9.0
thunderbird was updated to 45.8.0
critical issue in enlightenment was fixed, now it's operational again
privoxy was updated to 3.0.26
Mesa was updated to 13.0.6
Nvidia driver was updated to 340.102
Development tools and libraries
GCC 6 was added. Patches necessary to compile illumos-gate with GCC 6 were added (note, compiling illumos-gate with version other than illumos-gcc-4.4.4 is not supported)
GCC 7.1 added to Hipster (https://www.openindiana.org/2017/05/05/gcc-7-1-added-the-hipster-and-rolling-forward/)
Bison was updated to 3.0.4
Groovy 2.4 was added
Ruby 1.9 was removed, Ruby 2.3 is the default Ruby now
Perl 5.16 was removed. 64-bit Perl 5.24 is shipped.
64-bit OpenJDK 8 is the default OpenJDK version now.
Mercurial was updated to 4.1.3
Git was updated to 2.12.2
ccache was updated to 3.3.3
QT 5.8.0 was added
Valgrind was updated to 3.12.0
Server software
PostgreSQL 9.6 was added, PostgreSQL 9.3-9.5 were updated to latest minor versions
MongoDB 3.4 was added
MariaDB 10.1 was added
NodeJS 7 was added
Percona Server 5.5/5.6/5.7 and MariaDB 5.5 were updated to latest minor versions
OpenVPN was updated to 2.4.1
ISC Bind was updated to 9.10.4-P8
Squid was updated to 3.5.25
Nginx was updated to 1.12.0
Apache 2.4 was updated to 2.4.25. Apache 2.4 is the default Apache server now. Apache 2.2 will be removed before the next snapshot.
ISC ntpd was updated to 4.2.8p10
OpenSSH was updated to 7.4p1 
Samba was updated to 4.4.12
Tcpdump was updated to 4.9.0
Snort was updated to 2.9.9.0
Puppet was updated to 3.8.6
A lot of other bug fixes and minor software updates included.
***
PKGSRC at The University of Wisconsin–Milwaukee (https://uwm.edu/hpc/software-management/)
This piece is from the University of Wisconsin, Milwaukee
Why Use Package Managers?
Why Pkgsrc?
Portability
Flexibility
Modernity
Quality and Security
Collaboration
Convenience
Growth
Binary Packages for Research Computing
The University of Wisconsin — Milwaukee provides binary pkgsrc packages for selected operating systems as a service to the research computing community.
Unlike most package repositories, which have a fixed prefix and frequently upgraded packages, these packages are available for multiple prefixes and remain unchanged for a given prefix.  Additional packages may be added and existing packages may be patched to fix bugs or security issues, but the software versions will not be changed.  This allows researchers to keep older software in-place indefinitely for long-term studies while deploying newer software in later snapshots.
Contributing to Pkgsrc
Building Your Own Binary Packages
Check out the full article and consider using pkgsrc for your own research purposes. 
PKGSrc Con is this weekend! (http://www.pkgsrc.org/pkgsrcCon/2017/)
***
Measuring the weight of an electron (https://deftly.net/posts/2017-06-01-measuring-the-weight-of-an-electron.html)
An interesting story of the struggles of one person, aided only by their pet Canary, porting Electron to OpenBSD.
This is a long rant. A rant intended to document lunacy, hopefully aid others in the future and make myself feel better about something I think is crazy. It may seem like I am making an enemy of electron, but keep in mind that isn’t my intention! The enemy here, is complexity! My friend Henry, a canary, is coming along for the ride!
Getting the tools
At first glance Electron seems like a pretty solid app, it has decent docs, it’s consolidated in a single repository, has a lot of visibility, porting it shouldn’t be a big deal, right?
After cloning the repo, trouble starts:
Reading through the doc, right off the bat there are a few interesting things: At least 25GB disk space. Huh, OK, some how this ~47M repository is going to blow up to 25G?
Continuing along with the build, I know I have two versions of clang installed on OpenBSD, one from ports and one in base. Hopefully I will be able to tell the build to use one of these versions.
Next, it’s time to tell the bootstrap that OpenBSD exists as a platform. After that is fixed, the build-script runs.
Even though cloning another git repo fails, the build happily continues.
Wait. Another repository failed to clone? At least this time the build failed after trying to clone boto.. again. I am guessing it tried twice because something might have changed between now and the last clone? Off in the distance we catch a familiar tune, it almost sounds like Gnarls Barkley’s song Crazy, can’t tell for sure.
As it turns out, if you are using git-fsck, you are unable to clone boto and requests. Obviously the proper fix for his is to not care about the validity of the git objects! So we die a little inside and comment out fsckobjects in our ~/.gitconfig.
Next up, chromium-58 is downloaded…
Out of curiosity we look at vendor/libchromiumcontent/script/update, it seems its purpose is to download / extract chromium clang and node, good thing we already specified --clang_dir or it might try to build clang again!
544 dots and 45 minutes later, we have an error! The chromium-58.0.3029.110.tar.xz file is mysteriously not there anymore.. Interesting. Wut. “Updating Clang…”. Didn’t I explicitly say not to build clang? At this point we have to shift projects, no longer are we working on Electron.. It’s libchromiumcontent that needs our attention.
Fixing sub-tools
Ahh, our old friends the dots! This is the second time waiting 45+ minutes for a 500+ MB file to download. We are fairly confident it will fail, delete the file out from under itself and hinder the process even further, so we add an explicit exit to the update script. This way we can copy the file somewhere safe!
Another 45 minute chrome build and saving the downloaded executable to a save space seems in order. Fixing another 50 occurrences of error conditions let’s the build continue - to another clang build.
We remove the call to update_clang, because.. well.. we have two copies of it already and the Electron doc said everything would be fine if we had &amp;gt;= clang 3.4!
More re-builds and updates of clang and chromium are being commented out, just to get somewhere close to the actual electron build.
Fixing sub-sub-tools
Ninja needs to be build and the script for that needs to be told to ignore this “unsupported OS” to continue.
No luck. At this point we are faced with a complex web of python scripts that execute gn on GN files to produce ninja files… which then build the various components and somewhere in that cluster, something doesn’t know about OpenBSD…
I look at Henry, he is looking a photo of his wife and kids. They are sitting on a telephone wire, the morning sun illuminating their beautiful faces. Henry looks back at me and says “It’s    not worth it.” We slam the laptop shut and go outside.
Interview - Dan McDonald - allcoms@gmail.com (mailto:allcoms@gmail.com) (danboid)
News Roundup
g4u 2.6 (ghosting for unix) released 18th birthday (https://mail-index.netbsd.org/netbsd-users/2017/06/08/msg019625.html)
Hubert Feyrer writes in his mail to netbsd-users:
After a five-year period for beta-testing and updating, I have finally released g4u 2.6. With its origins in 1999, I'd like to say: Happy 18th Birthday, g4u!
About g4u:
g4u ("ghosting for unix") is a NetBSD-based bootfloppy/CD-ROM that allows easy cloning of PC harddisks to deploy a common setup on a number of PCs using FTP. The floppy/CD offers two functions. The first is to upload the compressed image of a local harddisk to a FTP server, the other is to restore that image via FTP, uncompress it and write it back to disk. Network configuration is fetched via DHCP. As the harddisk is processed as an image, any filesystem and operating system can be deployed using g4u. Easy cloning of local disks as well as partitions is also supported.
The past:
When I started g4u, I had the task to install a number of lab machines with a dual-boot of Windows NT and NetBSD. The hype was about Microsoft's "Zero Administration Kit" (ZAK) then, but that did barely work for the Windows part - file transfers were slow, depended on the clients' hardware a lot (requiring fiddling with MS DOS network driver disks), and on the ZAK server the files for installing happened do disappear for no good reason every now and then. Not working well, and leaving out NetBSD (and everything else), I created g4u. This gave me the (relative) pain of getting things working once, but with the option to easily add network drivers as they appeared in NetBSD (and oh they did!), plus allowed me to install any operating system.
The present:
We've used g4u successfully in our labs then, booting from CDROM. I also got many donations from public and private institutions plus companies from many sectors, indicating that g4u does make a difference.
In the meantime, the world has changed, and CDROMs aren't used that much any more. Network boot and USB sticks are today's devices of choice, cloning of a full disk without knowing its structure has both advantages but also disadvantages, and g4u's user interface is still command-line based with not much space for automation. For storage, FTP servers are nice and fast, but alternatives like SSH/SFTP, NFS, iSCSI and SMB for remote storage plus local storage (back to fun with filesystems, anyone? avoiding this was why g4u was created in the first place!) should be considered these days. Further aspects include integrity (checksums), confidentiality (encryption). This leaves a number of open points to address either by future releases, or by other products.
The future:
At this point, my time budget for g4u is very limited. I welcome people to contribute to g4u - g4u is Open Source for a reason. Feel free to get back to me for any changes that you want to contribute!
The changes:
Major changes in g4u 2.6 include:
Make this build with NetBSD-current sources as of 2017-04-17 (shortly before netbsd-8 release branch), binaries were cross-compiled from Mac OS X 10.10
Many new drivers, bugfixes and improvements from NetBSD-current (see beta1 and beta2 announcements)
Go back to keeping the disk image inside the kernel as ramdisk, do not load it as separate module. Less error prone, and allows to boot the g4u (NetBSD) kernel from a single file e.g. via PXE (Testing and documentation updates welcome!)
Actually DO provide the g4u (NetBSD) kernel with the embedded g4u disk image from now on, as separate file, g4u-kernel.gz
In addition to MD5, add SHA512 checksums
Congratulation, g4u. Check out the g4u website (http://fehu.org/~feyrer/g4u/) and support the project if you are using it.
***
Fixing FreeBSD Networking on Digital Ocean (https://wycd.net/posts/2017-05-19-fixing-freebsd-networking-on-digital-ocean.html)
Most cloud/VPS providers use some form of semi-automated address assignment, rather than just regular static address configuration, so that newly created virtual machines can configure themselves.
Sometimes, especially during the upgrade process, this can break. This is the story of one such user:
I decided it was time to update my FreeBSD Digital Ocean droplet from the end-of-life version 10.1 (shame on me) to the modern version 10.3 (good until April 2018), and maybe even version 11 (good until 2021). There were no sensitive files on the VM, so I had put it off.
Additionally, cloud providers tend to have shoddy support for BSDs, so breakages after messing with the kernel or init system are rampant, and I had been skirting that risk.
The last straw for me was a broken pkg: /usr/local/lib/libpkg.so.3: Undefined symbol "openat"
So the user fires up freebsd-update and upgrades to FreeBSD 10.3
I rebooted, and of course, it happened: no ssh access after 30 seconds, 1 minute, 2 minutes…I logged into my Digital Ocean account and saw green status lights for the instance, but something was definitely wrong.
Fortunately, Digital Ocean provides console access (albeit slow, buggy, and crashes my browser every time I run ping). ifconfig revealed that the interfaces vtnet0 (public) and vtnet1 (private) haven’t been configured with IP addresses.
Combing through files in /etc/rc.*, I found a file called /etc/rc.digitalocean.d/${DROPLETID}.conf containing static network settings for this droplet (${DROPLETID} was something like 1234567).
It seemed that FreeBSD wasn’t picking up the Digital Ocean network settings config file. The quick and dirty way would have been to messily append the contents of this file to /etc/rc.conf, but I wanted a nicer way. Reading the script in /etc/rc.d/digitalocean told me that /etc/rc.digitalocean.d/${DROPLET_ID}.conf was supposed to have a symlink at /etc/rc.digitalocean.d/droplet.conf. It was broken and pointed to /etc/rc.digitalocean.d/.conf, which could happen when the curl command in /etc/rc.d/digitalocean fails
Maybe the curl binary was also in need for an upgrade so failed to fetch the droplet ID
Using grep to fish for files containing droplet.conf, I discovered that it was hacked into the init system via loadrcconfig() in /etc/rc.subr
I would prefer if Digital Ocean had not customized the version of FreeBSD they ship quite so much
I could fix that symlink and restart the services:
set DROPLET_ID=$(curl -s http://169.254.169.254/metadata/v1/id)
ln -s -f /etc/rc.digitalocean.d/${DROPLET_ID}.conf /etc/rc.digitalocean.d/droplet.conf
/etc/rc.d/netif restart
/etc/rc.d/routing restart
Networking was working again, and I could then ssh into my server and run the following to finish the upgrade:
freebsd-update install
At this point, I decided that I didn’t want to deal with this mess again until at least 2021, so I decided to go for 11.0-RELEASE
freebsd-update -r 11.0-RELEASE update
freebsd-update install
reboot
freebsd-update install
pkg-static install -f pkg
pkg update
pkg upgrade
uname -a
FreeBSD hostname 11.0-RELEASE-p9 FreeBSD 11.0-RELEASE-p9
pkg -v
1.10.1
The problem was solved correctly, and my /etc/rc.conf remains free of generated cruft.
The Digital Ocean team can make our lives easier by having their init scripts do more thorough system checking, e.g., catching broken symlinks and bad network addresses. I’m hopeful that collaboration of the FreeBSD team and cloud providers will one day result in automatic fixing of these situations, or at least a correct status indicator.
The Digital Ocean team didn’t really know many FreeBSD people when they made the first 10.1 images, they have improved a lot, but they of course could always use more feedback from BSD users
**
Stack Clash (https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt)
A 12-year-old question: "If the heap grows up, and the stack grows down, what happens when they clash? Is it exploitable? How?
In 2005, Gael Delalleau presented "Large memory management vulnerabilities" and the first stack-clash exploit in user-space (against mod_php 4.3.0 on Apache 2.0.53) (http://cansecwest.com/core05/memory_vulns_delalleau.pdf)
In 2010, Rafal Wojtczuk published "Exploiting large memory management vulnerabilities in Xorg server running on Linux", the second stack-clash exploit in user-space (CVE-2010-2240) (http://www.invisiblethingslab.com/resources/misc-2010/xorg-large-memory-attacks.pdf)
Since 2010, security researchers have exploited several stack-clashes in the kernel-space, In user-space, however, this problem has been greatly underestimated; the only public exploits are Gael Delalleau's and Rafal Wojtczuk's, and they were written before Linux introduced a protection against stack-clashes (a "guard-page" mapped below the stack) (https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2240)
In this advisory, we show that stack-clashes are widespread in user-space, and exploitable despite the stack guard-page; we discovered multiple vulnerabilities in guard-page implementations, and devised general methods for:
"Clashing" the stack with another memory region: we allocate memory until the stack reaches another memory region, or until another memory region reaches the stack;
"Jumping" over the stack guard-page: we move the stack-pointer from the stack and into the other memory region, without accessing the stack guard-page;
"Smashing" the stack, or the other memory region: we overwrite the stack with the other memory region, or the other memory region with the stack.
So this advisory itself, is not a security vulnerability. It is novel research showing ways to work around the mitigations against generic vulnerability types that are implemented on various operating systems.
While this issue with the mitigation feature has been fixed, even without the fix, successful exploitation requires another application with its own vulnerability in order to be exploited. Those vulnerabilities outside of the OS need to be fixed on their own.
FreeBSD-Security post (https://lists.freebsd.org/pipermail/freebsd-security/2017-June/009335.html)
The issue under discussion is a limitation in a vulnerability mitigation technique. Changes to improve the way FreeBSD manages stack growth, and mitigate the issue demonstrated by Qualys' proof-of-concept code, are in progress by FreeBSD developers knowledgeable in the VM subsystem.
FreeBSD address space guards (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=320317)
HardenedBSD Proof of Concept for FreeBSD (https://github.com/lattera/exploits/blob/master/FreeBSD/StackClash/001-stackclash.c)
HardenedBSD implementation: https://github.com/HardenedBSD/hardenedBSD/compare/de8124d3bf83d774b66f62d11aee0162d0cd1031...91104ed152d57cde0292b2dc09489fd1f69ea77c &amp;amp; https://github.com/HardenedBSD/hardenedBSD/commit/00ad1fb6b53f63d6e9ba539b8f251b5cf4d40261
Qualys PoC: freebsd_cve-2017-fgpu.c (https://www.qualys.com/2017/06/19/stack-clash/freebsd_cve-2017-fgpu.c)
Qualys PoC: freebsd_cve-2017-fgpe.c (https://www.qualys.com/2017/06/19/stack-clash/freebsd_cve-2017-fgpe.c)
Qualys PoC: freebsd_cve-2017-1085.c (https://www.qualys.com/2017/06/19/stack-clash/freebsd_cve-2017-1085.c)
Qualys PoC: OpenBSD (https://www.qualys.com/2017/06/19/stack-clash/openbsd_at.c)
Qualys PoC: NetBSD (https://www.qualys.com/2017/06/19/stack-clash/netbsd_cve-2017-1000375.c)
***
Will ZFS and non-ECC RAM kill your data?  (http://jrs-s.net/2015/02/03/will-zfs-and-non-ecc-ram-kill-your-data/)
TL;DR: ECC is good, but even without, having ZFS is better than not having ZFS.
What’s ECC RAM? Is it a good idea?
What’s ZFS? Is it a good idea?
Is ZFS and non-ECC worse than not-ZFS and non-ECC?
What about the Scrub of Death?
The article walks through ZFS folk lore, and talks about what can really go wrong, and what is just the over-active imagination of people on the FreeNAS forums
But would using any other filesystem that isn’t ZFS have protected that data? ‘Cause remember, nobody’s arguing that you can lose data to evil RAM – the argument is about whether evil RAM is more dangerous with ZFS than it would be without it.
I really, really want to use the Scrub Of Death in a movie or TV show. How can I make it happen?
I don’t care about your logic! I wish to appeal to authority!
OK. “Authority” in this case doesn’t get much better than Matthew Ahrens, one of the cofounders of ZFS at Sun Microsystems and current ZFS developer at Delphix. In the comments to one of my filesystem articles on Ars Technica, Matthew said “There’s nothing special about ZFS that requires/encourages the use of ECC RAM more so than any other filesystem.”
Beastie Bits
EuroBSDcon 2017 Travel Grant Application Now Open (https://www.freebsdfoundation.org/blog/eurobsdcon-2017-travel-grant-application-now-open/)
FreeBSD 11.1-BETA3 is out, please give it a test (https://lists.freebsd.org/pipermail/freebsd-stable/2017-June/087303.html)
Allan and Lacey let us know the video to the Postgresql/ZFS talk is online (http://dpaste.com/1FE80FJ)
Trapsleds (https://marc.info/?l=openbsd-tech&amp;amp;m=149792179514439&amp;amp;w=2)
BSD User group in North Rhine-Westphalia, Germany (https://bsd.nrw/)
***
Feedback/Questions
Joe - Home Server Suggestions (http://dpaste.com/2Z5BJCR#wrap)
Stephen - general BSD (http://dpaste.com/1VRQYAM#wrap)
Eduardo - ZFS Encryption (http://dpaste.com/2TWADQ8#wrap)
Joseph - BGP Kernel Error (http://dpaste.com/0SC0GAC#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The NetBSD 8.0 release process is underway, we try to measure the weight of an electron, and look at stack clashing.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-announce/2017/06/06/msg000267.html" rel="nofollow">NetBSD 8.0 release process underway</a></h3>

<ul>
<li>Soren Jacobsen writes on NetBSD-announce:</li>
</ul>

<blockquote>
<p>If you&#39;ve been reading source-changes@, you likely noticed the recent creation of the netbsd-8 branch.  If you haven&#39;t been reading source-changes@, here&#39;s some news: the netbsd-8 branch has been created, signaling the beginning of the release process for NetBSD 8.0.<br>
We don&#39;t have a strict timeline for the 8.0 release, but things are looking pretty good at the moment, and we expect this release to happen in a shorter amount of time than the last couple major releases did.<br>
At this point, we would love for folks to test out netbsd-8 and let us know how it goes.  A couple of major improvements since 7.0 are the addition of USB 3 support and an overhaul of the audio subsystem, including an in-kernel mixer.  Feedback about these areas is particularly desired.<br>
To download the latest binaries built from the netbsd-8 branch, head to<br>
[<a href="http://daily-builds.NetBSD.org/pub/NetBSD-daily/netbsd-8/(%5Dhttp://daily-builds.NetBSD.org/pub/NetBSD-daily/netbsd-8/)" rel="nofollow">http://daily-builds.NetBSD.org/pub/NetBSD-daily/netbsd-8/(]http://daily-builds.NetBSD.org/pub/NetBSD-daily/netbsd-8/)</a><br>
Thanks in advance for helping make NetBSD 8.0 a stellar release!</p>
</blockquote>

<hr>

<h3><a href="https://www.openindiana.org/2017/05/03/openindiana-hipster-2017-04-is-here/" rel="nofollow">OpenIndiana Hipster 2017.04 is here</a></h3>

<ul>
<li>Desktop software and libraries

<ul>
<li>Xorg was updated to 1.18.4, xorg libraries and drivers were updated.</li>
<li>Mate was updated to 1.16</li>
<li><a href="https://wiki.openindiana.org/oi/Intel+KMS+driver" rel="nofollow">Intel video driver was updated, the list of supported hardware has significantly extended</a></li>
<li>libsmb was updated to 4.4.6</li>
<li>gvfs was updated to 1.26.0</li>
<li>gtk3 was updated to 3.18.9</li>
<li>Major text editors were updated (we ship vim 8.0.104, joe 4.4, emacs 25.2, nano 2.7.5</li>
<li>pulseaudio was updated to 10.0</li>
<li>firefox was updated to 45.9.0</li>
<li>thunderbird was updated to 45.8.0</li>
<li>critical issue in enlightenment was fixed, now it&#39;s operational again</li>
<li>privoxy was updated to 3.0.26</li>
<li>Mesa was updated to 13.0.6</li>
<li>Nvidia driver was updated to 340.102</li>
</ul></li>
<li>Development tools and libraries

<ul>
<li>GCC 6 was added. Patches necessary to compile illumos-gate with GCC 6 were added (note, compiling illumos-gate with version other than illumos-gcc-4.4.4 is not supported)</li>
<li><a href="https://www.openindiana.org/2017/05/05/gcc-7-1-added-the-hipster-and-rolling-forward/" rel="nofollow">GCC 7.1 added to Hipster</a></li>
<li>Bison was updated to 3.0.4</li>
<li>Groovy 2.4 was added</li>
<li>Ruby 1.9 was removed, Ruby 2.3 is the default Ruby now</li>
<li>Perl 5.16 was removed. 64-bit Perl 5.24 is shipped.</li>
<li>64-bit OpenJDK 8 is the default OpenJDK version now.</li>
<li>Mercurial was updated to 4.1.3</li>
<li>Git was updated to 2.12.2</li>
<li>ccache was updated to 3.3.3</li>
<li>QT 5.8.0 was added</li>
<li>Valgrind was updated to 3.12.0</li>
</ul></li>
<li>Server software

<ul>
<li>PostgreSQL 9.6 was added, PostgreSQL 9.3-9.5 were updated to latest minor versions</li>
<li>MongoDB 3.4 was added</li>
<li>MariaDB 10.1 was added</li>
<li>NodeJS 7 was added</li>
<li>Percona Server 5.5/5.6/5.7 and MariaDB 5.5 were updated to latest minor versions</li>
<li>OpenVPN was updated to 2.4.1</li>
<li>ISC Bind was updated to 9.10.4-P8</li>
<li>Squid was updated to 3.5.25</li>
<li>Nginx was updated to 1.12.0</li>
<li>Apache 2.4 was updated to 2.4.25. Apache 2.4 is the default Apache server now. Apache 2.2 will be removed before the next snapshot.</li>
<li>ISC ntpd was updated to 4.2.8p10</li>
<li>OpenSSH was updated to 7.4p1 </li>
<li>Samba was updated to 4.4.12</li>
<li>Tcpdump was updated to 4.9.0</li>
<li>Snort was updated to 2.9.9.0</li>
<li>Puppet was updated to 3.8.6</li>
</ul></li>
<li>A lot of other bug fixes and minor software updates included.
***</li>
</ul>

<h3><a href="https://uwm.edu/hpc/software-management/" rel="nofollow">PKGSRC at The University of WisconsinMilwaukee</a></h3>

<ul>
<li>This piece is from the University of Wisconsin, Milwaukee</li>
</ul>

<blockquote>
<p>Why Use Package Managers?<br>
Why Pkgsrc?</p>

<p>Portability<br>
Flexibility<br>
Modernity<br>
Quality and Security<br>
Collaboration<br>
Convenience<br>
Growth</p>

<p>Binary Packages for Research Computing<br>
The University of Wisconsin  Milwaukee provides binary pkgsrc packages for selected operating systems as a service to the research computing community.<br>
Unlike most package repositories, which have a fixed prefix and frequently upgraded packages, these packages are available for multiple prefixes and remain unchanged for a given prefix.  Additional packages may be added and existing packages may be patched to fix bugs or security issues, but the software versions will not be changed.  This allows researchers to keep older software in-place indefinitely for long-term studies while deploying newer software in later snapshots.<br>
Contributing to Pkgsrc<br>
Building Your Own Binary Packages</p>
</blockquote>

<ul>
<li>Check out the full article and consider using pkgsrc for your own research purposes. </li>
<li><a href="http://www.pkgsrc.org/pkgsrcCon/2017/" rel="nofollow">PKGSrc Con is this weekend!</a>
***</li>
</ul>

<h3><a href="https://deftly.net/posts/2017-06-01-measuring-the-weight-of-an-electron.html" rel="nofollow">Measuring the weight of an electron</a></h3>

<ul>
<li>An interesting story of the struggles of one person, aided only by their pet Canary, porting Electron to OpenBSD.</li>
</ul>

<blockquote>
<p>This is a long rant. A rant intended to document lunacy, hopefully aid others in the future and make myself feel better about something I think is crazy. It may seem like I am making an enemy of electron, but keep in mind that isnt my intention! The enemy here, is complexity! My friend Henry, a canary, is coming along for the ride!</p>
</blockquote>

<ul>
<li>Getting the tools</li>
</ul>

<blockquote>
<p>At first glance Electron seems like a pretty solid app, it has decent docs, its consolidated in a single repository, has a lot of visibility, porting it shouldnt be a big deal, right?</p>
</blockquote>

<ul>
<li>After cloning the repo, trouble starts:</li>
</ul>

<blockquote>
<p>Reading through the doc, right off the bat there are a few interesting things: At least 25GB disk space. Huh, OK, some how this ~47M repository is going to blow up to 25G?<br>
Continuing along with the build, I know I have two versions of clang installed on OpenBSD, one from ports and one in base. Hopefully I will be able to tell the build to use one of these versions.</p>
</blockquote>

<ul>
<li><p>Next, its time to tell the bootstrap that OpenBSD exists as a platform. After that is fixed, the build-script runs.</p></li>
<li><p>Even though cloning another git repo fails, the build happily continues.</p></li>
</ul>

<blockquote>
<p>Wait. Another repository failed to clone? At least this time the build failed after trying to clone boto.. again. I am guessing it tried twice because something might have changed between now and the last clone? Off in the distance we catch a familiar tune, it almost sounds like Gnarls Barkleys song Crazy, cant tell for sure.<br>
As it turns out, if you are using git-fsck, you are unable to clone boto and requests. Obviously the proper fix for his is to not care about the validity of the git objects! So we die a little inside and comment out fsckobjects in our ~/.gitconfig.</p>
</blockquote>

<ul>
<li>Next up, chromium-58 is downloaded</li>
</ul>

<blockquote>
<p>Out of curiosity we look at vendor/libchromiumcontent/script/update, it seems its purpose is to download / extract chromium clang and node, good thing we already specified --clang_dir or it might try to build clang again!<br>
544 dots and 45 minutes later, we have an error! The chromium-58.0.3029.110.tar.xz file is mysteriously not there anymore.. Interesting. Wut. Updating Clang. Didnt I explicitly say not to build clang? At this point we have to shift projects, no longer are we working on Electron.. Its libchromiumcontent that needs our attention.</p>
</blockquote>

<ul>
<li>Fixing sub-tools</li>
</ul>

<blockquote>
<p>Ahh, our old friends the dots! This is the second time waiting 45+ minutes for a 500+ MB file to download. We are fairly confident it will fail, delete the file out from under itself and hinder the process even further, so we add an explicit exit to the update script. This way we can copy the file somewhere safe!</p>
</blockquote>

<ul>
<li>Another 45 minute chrome build and saving the downloaded executable to a save space seems in order. Fixing another 50 occurrences of error conditions lets the build continue - to another clang build.</li>
</ul>

<blockquote>
<p>We remove the call to update_clang, because.. well.. we have two copies of it already and the Electron doc said everything would be fine if we had &gt;= clang 3.4!</p>
</blockquote>

<ul>
<li><p>More re-builds and updates of clang and chromium are being commented out, just to get somewhere close to the actual electron build.</p></li>
<li><p>Fixing sub-sub-tools</p></li>
<li><p>Ninja needs to be build and the script for that needs to be told to ignore this unsupported OS to continue.</p></li>
</ul>

<blockquote>
<p>No luck. At this point we are faced with a complex web of python scripts that execute gn on GN files to produce ninja files which then build the various components and somewhere in that cluster, something doesnt know about OpenBSD<br>
I look at Henry, he is looking a photo of his wife and kids. They are sitting on a telephone wire, the morning sun illuminating their beautiful faces. Henry looks back at me and says Its    not worth it. We slam the laptop shut and go outside.</p>
</blockquote>

<hr>

<h2>Interview - Dan McDonald - <a href="mailto:allcoms@gmail.com" rel="nofollow">allcoms@gmail.com</a> (danboid)</h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-users/2017/06/08/msg019625.html" rel="nofollow">g4u 2.6 (ghosting for unix) released 18th birthday</a></h3>

<ul>
<li>Hubert Feyrer writes in his mail to netbsd-users:</li>
</ul>

<blockquote>
<p>After a five-year period for beta-testing and updating, I have finally released g4u 2.6. With its origins in 1999, I&#39;d like to say: Happy 18th Birthday, g4u!</p>
</blockquote>

<ul>
<li>About g4u:</li>
</ul>

<blockquote>
<p>g4u (&quot;ghosting for unix&quot;) is a NetBSD-based bootfloppy/CD-ROM that allows easy cloning of PC harddisks to deploy a common setup on a number of PCs using FTP. The floppy/CD offers two functions. The first is to upload the compressed image of a local harddisk to a FTP server, the other is to restore that image via FTP, uncompress it and write it back to disk. Network configuration is fetched via DHCP. As the harddisk is processed as an image, any filesystem and operating system can be deployed using g4u. Easy cloning of local disks as well as partitions is also supported.</p>
</blockquote>

<ul>
<li>The past:</li>
</ul>

<blockquote>
<p>When I started g4u, I had the task to install a number of lab machines with a dual-boot of Windows NT and NetBSD. The hype was about Microsoft&#39;s &quot;Zero Administration Kit&quot; (ZAK) then, but that did barely work for the Windows part - file transfers were slow, depended on the clients&#39; hardware a lot (requiring fiddling with MS DOS network driver disks), and on the ZAK server the files for installing happened do disappear for no good reason every now and then. Not working well, and leaving out NetBSD (and everything else), I created g4u. This gave me the (relative) pain of getting things working once, but with the option to easily add network drivers as they appeared in NetBSD (and oh they did!), plus allowed me to install any operating system.</p>
</blockquote>

<ul>
<li>The present:</li>
</ul>

<blockquote>
<p>We&#39;ve used g4u successfully in our labs then, booting from CDROM. I also got many donations from public and private institutions plus companies from many sectors, indicating that g4u does make a difference.</p>

<p>In the meantime, the world has changed, and CDROMs aren&#39;t used that much any more. Network boot and USB sticks are today&#39;s devices of choice, cloning of a full disk without knowing its structure has both advantages but also disadvantages, and g4u&#39;s user interface is still command-line based with not much space for automation. For storage, FTP servers are nice and fast, but alternatives like SSH/SFTP, NFS, iSCSI and SMB for remote storage plus local storage (back to fun with filesystems, anyone? avoiding this was why g4u was created in the first place!) should be considered these days. Further aspects include integrity (checksums), confidentiality (encryption). This leaves a number of open points to address either by future releases, or by other products.</p>
</blockquote>

<ul>
<li>The future:</li>
</ul>

<blockquote>
<p>At this point, my time budget for g4u is very limited. I welcome people to contribute to g4u - g4u is Open Source for a reason. Feel free to get back to me for any changes that you want to contribute!</p>
</blockquote>

<ul>
<li>The changes:</li>
</ul>

<blockquote>
<p>Major changes in g4u 2.6 include:</p>
</blockquote>

<ul>
<li>Make this build with NetBSD-current sources as of 2017-04-17 (shortly before netbsd-8 release branch), binaries were cross-compiled from Mac OS X 10.10</li>
<li>Many new drivers, bugfixes and improvements from NetBSD-current (see beta1 and beta2 announcements)</li>
<li>Go back to keeping the disk image inside the kernel as ramdisk, do not load it as separate module. Less error prone, and allows to boot the g4u (NetBSD) kernel from a single file e.g. via PXE (Testing and documentation updates welcome!)</li>
<li>Actually DO provide the g4u (NetBSD) kernel with the embedded g4u disk image from now on, as separate file, g4u-kernel.gz</li>
<li><p>In addition to MD5, add SHA512 checksums</p>

<ul>
<li>Congratulation, g4u. Check out the <a href="http://fehu.org/%7Efeyrer/g4u/" rel="nofollow">g4u website</a> and support the project if you are using it.
***</li>
</ul></li>
</ul>

<h3><a href="https://wycd.net/posts/2017-05-19-fixing-freebsd-networking-on-digital-ocean.html" rel="nofollow">Fixing FreeBSD Networking on Digital Ocean</a></h3>

<ul>
<li>Most cloud/VPS providers use some form of semi-automated address assignment, rather than just regular static address configuration, so that newly created virtual machines can configure themselves.</li>
<li>Sometimes, especially during the upgrade process, this can break. This is the story of one such user:</li>
</ul>

<blockquote>
<p>I decided it was time to update my FreeBSD Digital Ocean droplet from the end-of-life version 10.1 (shame on me) to the modern version 10.3 (good until April 2018), and maybe even version 11 (good until 2021). There were no sensitive files on the VM, so I had put it off.<br>
Additionally, cloud providers tend to have shoddy support for BSDs, so breakages after messing with the kernel or init system are rampant, and I had been skirting that risk.<br>
The last straw for me was a broken pkg: /usr/local/lib/libpkg.so.3: Undefined symbol &quot;openat&quot;</p>
</blockquote>

<ul>
<li>So the user fires up freebsd-update and upgrades to FreeBSD 10.3</li>
</ul>

<blockquote>
<p>I rebooted, and of course, it happened: no ssh access after 30 seconds, 1 minute, 2 minutesI logged into my Digital Ocean account and saw green status lights for the instance, but something was definitely wrong.<br>
Fortunately, Digital Ocean provides console access (albeit slow, buggy, and crashes my browser every time I run ping). ifconfig revealed that the interfaces vtnet0 (public) and vtnet1 (private) havent been configured with IP addresses.<br>
Combing through files in /etc/rc.*, I found a file called /etc/rc.digitalocean.d/${DROPLET_ID}.conf containing static network settings for this droplet (${DROPLET_ID} was something like 1234567).<br>
It seemed that FreeBSD wasnt picking up the Digital Ocean network settings config file. The quick and dirty way would have been to messily append the contents of this file to /etc/rc.conf, but I wanted a nicer way. Reading the script in /etc/rc.d/digitalocean told me that /etc/rc.digitalocean.d/${DROPLET_ID}.conf was supposed to have a symlink at /etc/rc.digitalocean.d/droplet.conf. It was broken and pointed to /etc/rc.digitalocean.d/.conf, which could happen when the curl command in /etc/rc.d/digitalocean fails</p>
</blockquote>

<ul>
<li>Maybe the curl binary was also in need for an upgrade so failed to fetch the droplet ID</li>
</ul>

<blockquote>
<p>Using grep to fish for files containing droplet.conf, I discovered that it was hacked into the init system via load_rc_config() in /etc/rc.subr</p>
</blockquote>

<ul>
<li><p>I would prefer if Digital Ocean had not customized the version of FreeBSD they ship quite so much</p></li>
<li><p>I could fix that symlink and restart the services:</p></li>
</ul>

<blockquote>
<h1>set DROPLET_ID=$(curl -s <a href="http://169.254.169.254/metadata/v1/id" rel="nofollow">http://169.254.169.254/metadata/v1/id</a>)</h1>

<h1>ln -s -f /etc/rc.digitalocean.d/${DROPLET_ID}.conf /etc/rc.digitalocean.d/droplet.conf</h1>

<h1>/etc/rc.d/netif restart</h1>

<h1>/etc/rc.d/routing restart</h1>

<p>Networking was working again, and I could then ssh into my server and run the following to finish the upgrade:</p>

<h1>freebsd-update install</h1>

<p>At this point, I decided that I didnt want to deal with this mess again until at least 2021, so I decided to go for 11.0-RELEASE</p>

<h1>freebsd-update -r 11.0-RELEASE update</h1>

<h1>freebsd-update install</h1>

<h1>reboot</h1>

<h1>freebsd-update install</h1>

<h1>pkg-static install -f pkg</h1>

<h1>pkg update</h1>

<h1>pkg upgrade</h1>

<h1>uname -a</h1>

<p>FreeBSD hostname 11.0-RELEASE-p9 FreeBSD 11.0-RELEASE-p9</p>

<h1>pkg -v</h1>

<p>1.10.1<br>
The problem was solved correctly, and my /etc/rc.conf remains free of generated cruft.<br>
The Digital Ocean team can make our lives easier by having their init scripts do more thorough system checking, e.g., catching broken symlinks and bad network addresses. Im hopeful that collaboration of the FreeBSD team and cloud providers will one day result in automatic fixing of these situations, or at least a correct status indicator.</p>
</blockquote>

<ul>
<li>The Digital Ocean team didnt really know many FreeBSD people when they made the first 10.1 images, they have improved a lot, but they of course could always use more feedback from <em>BSD users
*</em>*</li>
</ul>

<h3><a href="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt" rel="nofollow">Stack Clash</a></h3>

<blockquote>
<p>A 12-year-old question: &quot;If the heap grows up, and the stack grows down, what happens when they clash? Is it exploitable? How?<br>
<a href="http://cansecwest.com/core05/memory_vulns_delalleau.pdf" rel="nofollow">In 2005, Gael Delalleau presented &quot;Large memory management vulnerabilities&quot; and the first stack-clash exploit in user-space (against mod_php 4.3.0 on Apache 2.0.53)</a><br>
<a href="http://www.invisiblethingslab.com/resources/misc-2010/xorg-large-memory-attacks.pdf" rel="nofollow">In 2010, Rafal Wojtczuk published &quot;Exploiting large memory management vulnerabilities in Xorg server running on Linux&quot;, the second stack-clash exploit in user-space (CVE-2010-2240)</a><br>
Since 2010, security researchers have exploited several stack-clashes in the kernel-space, In user-space, however, this problem has been greatly underestimated; the only public exploits are Gael Delalleau&#39;s and Rafal Wojtczuk&#39;s, and <a href="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2240" rel="nofollow">they were written before Linux introduced a protection against stack-clashes (a &quot;guard-page&quot; mapped below the stack)</a><br>
In this advisory, we show that stack-clashes are widespread in user-space, and exploitable despite the stack guard-page; we discovered multiple vulnerabilities in guard-page implementations, and devised general methods for:<br>
&quot;Clashing&quot; the stack with another memory region: we allocate memory until the stack reaches another memory region, or until another memory region reaches the stack;<br>
&quot;Jumping&quot; over the stack guard-page: we move the stack-pointer from the stack and into the other memory region, without accessing the stack guard-page;<br>
&quot;Smashing&quot; the stack, or the other memory region: we overwrite the stack with the other memory region, or the other memory region with the stack.</p>
</blockquote>

<ul>
<li>So this advisory itself, is not a security vulnerability. It is novel research showing ways to work around the mitigations against generic vulnerability types that are implemented on various operating systems.</li>
<li>While this issue with the mitigation feature has been fixed, even without the fix, successful exploitation requires another application with its own vulnerability in order to be exploited. Those vulnerabilities outside of the OS need to be fixed on their own.</li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-security/2017-June/009335.html" rel="nofollow">FreeBSD-Security post</a></li>
</ul>

<blockquote>
<p>The issue under discussion is a limitation in a vulnerability mitigation technique. Changes to improve the way FreeBSD manages stack growth, and mitigate the issue demonstrated by Qualys&#39; proof-of-concept code, are in progress by FreeBSD developers knowledgeable in the VM subsystem.</p>
</blockquote>

<ul>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=320317" rel="nofollow">FreeBSD address space guards</a></li>
<li><a href="https://github.com/lattera/exploits/blob/master/FreeBSD/StackClash/001-stackclash.c" rel="nofollow">HardenedBSD Proof of Concept for FreeBSD</a></li>
<li>HardenedBSD implementation: <a href="https://github.com/HardenedBSD/hardenedBSD/compare/de8124d3bf83d774b66f62d11aee0162d0cd1031...91104ed152d57cde0292b2dc09489fd1f69ea77c" rel="nofollow">https://github.com/HardenedBSD/hardenedBSD/compare/de8124d3bf83d774b66f62d11aee0162d0cd1031...91104ed152d57cde0292b2dc09489fd1f69ea77c</a> &amp; <a href="https://github.com/HardenedBSD/hardenedBSD/commit/00ad1fb6b53f63d6e9ba539b8f251b5cf4d40261" rel="nofollow">https://github.com/HardenedBSD/hardenedBSD/commit/00ad1fb6b53f63d6e9ba539b8f251b5cf4d40261</a></li>
<li><a href="https://www.qualys.com/2017/06/19/stack-clash/freebsd_cve-2017-fgpu.c" rel="nofollow">Qualys PoC: freebsd_cve-2017-fgpu.c</a></li>
<li><a href="https://www.qualys.com/2017/06/19/stack-clash/freebsd_cve-2017-fgpe.c" rel="nofollow">Qualys PoC: freebsd_cve-2017-fgpe.c</a></li>
<li><a href="https://www.qualys.com/2017/06/19/stack-clash/freebsd_cve-2017-1085.c" rel="nofollow">Qualys PoC: freebsd_cve-2017-1085.c</a></li>
<li><a href="https://www.qualys.com/2017/06/19/stack-clash/openbsd_at.c" rel="nofollow">Qualys PoC: OpenBSD</a></li>
<li><a href="https://www.qualys.com/2017/06/19/stack-clash/netbsd_cve-2017-1000375.c" rel="nofollow">Qualys PoC: NetBSD</a>
***</li>
</ul>

<h3><a href="http://jrs-s.net/2015/02/03/will-zfs-and-non-ecc-ram-kill-your-data/" rel="nofollow">Will ZFS and non-ECC RAM kill your data? </a></h3>

<ul>
<li>TL;DR: ECC is good, but even without, having ZFS is better than not having ZFS.</li>
</ul>

<blockquote>
<p>Whats ECC RAM? Is it a good idea?<br>
Whats ZFS? Is it a good idea?<br>
Is ZFS and non-ECC worse than not-ZFS and non-ECC?<br>
What about the Scrub of Death?</p>
</blockquote>

<ul>
<li>The article walks through ZFS folk lore, and talks about what can really go wrong, and what is just the over-active imagination of people on the FreeNAS forums</li>
</ul>

<blockquote>
<p>But would using any other filesystem that isnt ZFS have protected that data? Cause remember, nobodys arguing that you can lose data to evil RAM  the argument is about whether evil RAM is more dangerous with ZFS than it would be without it.<br>
I really, really want to use the Scrub Of Death in a movie or TV show. How can I make it happen?<br>
I dont care about your logic! I wish to appeal to authority!<br>
OK. Authority in this case doesnt get much better than Matthew Ahrens, one of the cofounders of ZFS at Sun Microsystems and current ZFS developer at Delphix. In the comments to one of my filesystem articles on Ars Technica, Matthew said Theres nothing special about ZFS that requires/encourages the use of ECC RAM more so than any other filesystem.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/eurobsdcon-2017-travel-grant-application-now-open/" rel="nofollow">EuroBSDcon 2017 Travel Grant Application Now Open</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2017-June/087303.html" rel="nofollow">FreeBSD 11.1-BETA3 is out, please give it a test</a></li>
<li><a href="http://dpaste.com/1FE80FJ" rel="nofollow">Allan and Lacey let us know the video to the Postgresql/ZFS talk is online</a></li>
<li><a href="https://marc.info/?l=openbsd-tech&m=149792179514439&w=2" rel="nofollow">Trapsleds</a></li>
<li><a href="https://bsd.nrw/" rel="nofollow">BSD User group in North Rhine-Westphalia, Germany</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2Z5BJCR#wrap" rel="nofollow">Joe - Home Server Suggestions</a></li>
<li><a href="http://dpaste.com/1VRQYAM#wrap" rel="nofollow">Stephen - general BSD</a></li>
<li><a href="http://dpaste.com/2TWADQ8#wrap" rel="nofollow">Eduardo - ZFS Encryption</a></li>
<li><a href="http://dpaste.com/0SC0GAC#wrap" rel="nofollow">Joseph - BGP Kernel Error</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The NetBSD 8.0 release process is underway, we try to measure the weight of an electron, and look at stack clashing.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-announce/2017/06/06/msg000267.html" rel="nofollow">NetBSD 8.0 release process underway</a></h3>

<ul>
<li>Soren Jacobsen writes on NetBSD-announce:</li>
</ul>

<blockquote>
<p>If you&#39;ve been reading source-changes@, you likely noticed the recent creation of the netbsd-8 branch.  If you haven&#39;t been reading source-changes@, here&#39;s some news: the netbsd-8 branch has been created, signaling the beginning of the release process for NetBSD 8.0.<br>
We don&#39;t have a strict timeline for the 8.0 release, but things are looking pretty good at the moment, and we expect this release to happen in a shorter amount of time than the last couple major releases did.<br>
At this point, we would love for folks to test out netbsd-8 and let us know how it goes.  A couple of major improvements since 7.0 are the addition of USB 3 support and an overhaul of the audio subsystem, including an in-kernel mixer.  Feedback about these areas is particularly desired.<br>
To download the latest binaries built from the netbsd-8 branch, head to<br>
[<a href="http://daily-builds.NetBSD.org/pub/NetBSD-daily/netbsd-8/(%5Dhttp://daily-builds.NetBSD.org/pub/NetBSD-daily/netbsd-8/)" rel="nofollow">http://daily-builds.NetBSD.org/pub/NetBSD-daily/netbsd-8/(]http://daily-builds.NetBSD.org/pub/NetBSD-daily/netbsd-8/)</a><br>
Thanks in advance for helping make NetBSD 8.0 a stellar release!</p>
</blockquote>

<hr>

<h3><a href="https://www.openindiana.org/2017/05/03/openindiana-hipster-2017-04-is-here/" rel="nofollow">OpenIndiana Hipster 2017.04 is here</a></h3>

<ul>
<li>Desktop software and libraries

<ul>
<li>Xorg was updated to 1.18.4, xorg libraries and drivers were updated.</li>
<li>Mate was updated to 1.16</li>
<li><a href="https://wiki.openindiana.org/oi/Intel+KMS+driver" rel="nofollow">Intel video driver was updated, the list of supported hardware has significantly extended</a></li>
<li>libsmb was updated to 4.4.6</li>
<li>gvfs was updated to 1.26.0</li>
<li>gtk3 was updated to 3.18.9</li>
<li>Major text editors were updated (we ship vim 8.0.104, joe 4.4, emacs 25.2, nano 2.7.5</li>
<li>pulseaudio was updated to 10.0</li>
<li>firefox was updated to 45.9.0</li>
<li>thunderbird was updated to 45.8.0</li>
<li>critical issue in enlightenment was fixed, now it&#39;s operational again</li>
<li>privoxy was updated to 3.0.26</li>
<li>Mesa was updated to 13.0.6</li>
<li>Nvidia driver was updated to 340.102</li>
</ul></li>
<li>Development tools and libraries

<ul>
<li>GCC 6 was added. Patches necessary to compile illumos-gate with GCC 6 were added (note, compiling illumos-gate with version other than illumos-gcc-4.4.4 is not supported)</li>
<li><a href="https://www.openindiana.org/2017/05/05/gcc-7-1-added-the-hipster-and-rolling-forward/" rel="nofollow">GCC 7.1 added to Hipster</a></li>
<li>Bison was updated to 3.0.4</li>
<li>Groovy 2.4 was added</li>
<li>Ruby 1.9 was removed, Ruby 2.3 is the default Ruby now</li>
<li>Perl 5.16 was removed. 64-bit Perl 5.24 is shipped.</li>
<li>64-bit OpenJDK 8 is the default OpenJDK version now.</li>
<li>Mercurial was updated to 4.1.3</li>
<li>Git was updated to 2.12.2</li>
<li>ccache was updated to 3.3.3</li>
<li>QT 5.8.0 was added</li>
<li>Valgrind was updated to 3.12.0</li>
</ul></li>
<li>Server software

<ul>
<li>PostgreSQL 9.6 was added, PostgreSQL 9.3-9.5 were updated to latest minor versions</li>
<li>MongoDB 3.4 was added</li>
<li>MariaDB 10.1 was added</li>
<li>NodeJS 7 was added</li>
<li>Percona Server 5.5/5.6/5.7 and MariaDB 5.5 were updated to latest minor versions</li>
<li>OpenVPN was updated to 2.4.1</li>
<li>ISC Bind was updated to 9.10.4-P8</li>
<li>Squid was updated to 3.5.25</li>
<li>Nginx was updated to 1.12.0</li>
<li>Apache 2.4 was updated to 2.4.25. Apache 2.4 is the default Apache server now. Apache 2.2 will be removed before the next snapshot.</li>
<li>ISC ntpd was updated to 4.2.8p10</li>
<li>OpenSSH was updated to 7.4p1 </li>
<li>Samba was updated to 4.4.12</li>
<li>Tcpdump was updated to 4.9.0</li>
<li>Snort was updated to 2.9.9.0</li>
<li>Puppet was updated to 3.8.6</li>
</ul></li>
<li>A lot of other bug fixes and minor software updates included.
***</li>
</ul>

<h3><a href="https://uwm.edu/hpc/software-management/" rel="nofollow">PKGSRC at The University of WisconsinMilwaukee</a></h3>

<ul>
<li>This piece is from the University of Wisconsin, Milwaukee</li>
</ul>

<blockquote>
<p>Why Use Package Managers?<br>
Why Pkgsrc?</p>

<p>Portability<br>
Flexibility<br>
Modernity<br>
Quality and Security<br>
Collaboration<br>
Convenience<br>
Growth</p>

<p>Binary Packages for Research Computing<br>
The University of Wisconsin  Milwaukee provides binary pkgsrc packages for selected operating systems as a service to the research computing community.<br>
Unlike most package repositories, which have a fixed prefix and frequently upgraded packages, these packages are available for multiple prefixes and remain unchanged for a given prefix.  Additional packages may be added and existing packages may be patched to fix bugs or security issues, but the software versions will not be changed.  This allows researchers to keep older software in-place indefinitely for long-term studies while deploying newer software in later snapshots.<br>
Contributing to Pkgsrc<br>
Building Your Own Binary Packages</p>
</blockquote>

<ul>
<li>Check out the full article and consider using pkgsrc for your own research purposes. </li>
<li><a href="http://www.pkgsrc.org/pkgsrcCon/2017/" rel="nofollow">PKGSrc Con is this weekend!</a>
***</li>
</ul>

<h3><a href="https://deftly.net/posts/2017-06-01-measuring-the-weight-of-an-electron.html" rel="nofollow">Measuring the weight of an electron</a></h3>

<ul>
<li>An interesting story of the struggles of one person, aided only by their pet Canary, porting Electron to OpenBSD.</li>
</ul>

<blockquote>
<p>This is a long rant. A rant intended to document lunacy, hopefully aid others in the future and make myself feel better about something I think is crazy. It may seem like I am making an enemy of electron, but keep in mind that isnt my intention! The enemy here, is complexity! My friend Henry, a canary, is coming along for the ride!</p>
</blockquote>

<ul>
<li>Getting the tools</li>
</ul>

<blockquote>
<p>At first glance Electron seems like a pretty solid app, it has decent docs, its consolidated in a single repository, has a lot of visibility, porting it shouldnt be a big deal, right?</p>
</blockquote>

<ul>
<li>After cloning the repo, trouble starts:</li>
</ul>

<blockquote>
<p>Reading through the doc, right off the bat there are a few interesting things: At least 25GB disk space. Huh, OK, some how this ~47M repository is going to blow up to 25G?<br>
Continuing along with the build, I know I have two versions of clang installed on OpenBSD, one from ports and one in base. Hopefully I will be able to tell the build to use one of these versions.</p>
</blockquote>

<ul>
<li><p>Next, its time to tell the bootstrap that OpenBSD exists as a platform. After that is fixed, the build-script runs.</p></li>
<li><p>Even though cloning another git repo fails, the build happily continues.</p></li>
</ul>

<blockquote>
<p>Wait. Another repository failed to clone? At least this time the build failed after trying to clone boto.. again. I am guessing it tried twice because something might have changed between now and the last clone? Off in the distance we catch a familiar tune, it almost sounds like Gnarls Barkleys song Crazy, cant tell for sure.<br>
As it turns out, if you are using git-fsck, you are unable to clone boto and requests. Obviously the proper fix for his is to not care about the validity of the git objects! So we die a little inside and comment out fsckobjects in our ~/.gitconfig.</p>
</blockquote>

<ul>
<li>Next up, chromium-58 is downloaded</li>
</ul>

<blockquote>
<p>Out of curiosity we look at vendor/libchromiumcontent/script/update, it seems its purpose is to download / extract chromium clang and node, good thing we already specified --clang_dir or it might try to build clang again!<br>
544 dots and 45 minutes later, we have an error! The chromium-58.0.3029.110.tar.xz file is mysteriously not there anymore.. Interesting. Wut. Updating Clang. Didnt I explicitly say not to build clang? At this point we have to shift projects, no longer are we working on Electron.. Its libchromiumcontent that needs our attention.</p>
</blockquote>

<ul>
<li>Fixing sub-tools</li>
</ul>

<blockquote>
<p>Ahh, our old friends the dots! This is the second time waiting 45+ minutes for a 500+ MB file to download. We are fairly confident it will fail, delete the file out from under itself and hinder the process even further, so we add an explicit exit to the update script. This way we can copy the file somewhere safe!</p>
</blockquote>

<ul>
<li>Another 45 minute chrome build and saving the downloaded executable to a save space seems in order. Fixing another 50 occurrences of error conditions lets the build continue - to another clang build.</li>
</ul>

<blockquote>
<p>We remove the call to update_clang, because.. well.. we have two copies of it already and the Electron doc said everything would be fine if we had &gt;= clang 3.4!</p>
</blockquote>

<ul>
<li><p>More re-builds and updates of clang and chromium are being commented out, just to get somewhere close to the actual electron build.</p></li>
<li><p>Fixing sub-sub-tools</p></li>
<li><p>Ninja needs to be build and the script for that needs to be told to ignore this unsupported OS to continue.</p></li>
</ul>

<blockquote>
<p>No luck. At this point we are faced with a complex web of python scripts that execute gn on GN files to produce ninja files which then build the various components and somewhere in that cluster, something doesnt know about OpenBSD<br>
I look at Henry, he is looking a photo of his wife and kids. They are sitting on a telephone wire, the morning sun illuminating their beautiful faces. Henry looks back at me and says Its    not worth it. We slam the laptop shut and go outside.</p>
</blockquote>

<hr>

<h2>Interview - Dan McDonald - <a href="mailto:allcoms@gmail.com" rel="nofollow">allcoms@gmail.com</a> (danboid)</h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-users/2017/06/08/msg019625.html" rel="nofollow">g4u 2.6 (ghosting for unix) released 18th birthday</a></h3>

<ul>
<li>Hubert Feyrer writes in his mail to netbsd-users:</li>
</ul>

<blockquote>
<p>After a five-year period for beta-testing and updating, I have finally released g4u 2.6. With its origins in 1999, I&#39;d like to say: Happy 18th Birthday, g4u!</p>
</blockquote>

<ul>
<li>About g4u:</li>
</ul>

<blockquote>
<p>g4u (&quot;ghosting for unix&quot;) is a NetBSD-based bootfloppy/CD-ROM that allows easy cloning of PC harddisks to deploy a common setup on a number of PCs using FTP. The floppy/CD offers two functions. The first is to upload the compressed image of a local harddisk to a FTP server, the other is to restore that image via FTP, uncompress it and write it back to disk. Network configuration is fetched via DHCP. As the harddisk is processed as an image, any filesystem and operating system can be deployed using g4u. Easy cloning of local disks as well as partitions is also supported.</p>
</blockquote>

<ul>
<li>The past:</li>
</ul>

<blockquote>
<p>When I started g4u, I had the task to install a number of lab machines with a dual-boot of Windows NT and NetBSD. The hype was about Microsoft&#39;s &quot;Zero Administration Kit&quot; (ZAK) then, but that did barely work for the Windows part - file transfers were slow, depended on the clients&#39; hardware a lot (requiring fiddling with MS DOS network driver disks), and on the ZAK server the files for installing happened do disappear for no good reason every now and then. Not working well, and leaving out NetBSD (and everything else), I created g4u. This gave me the (relative) pain of getting things working once, but with the option to easily add network drivers as they appeared in NetBSD (and oh they did!), plus allowed me to install any operating system.</p>
</blockquote>

<ul>
<li>The present:</li>
</ul>

<blockquote>
<p>We&#39;ve used g4u successfully in our labs then, booting from CDROM. I also got many donations from public and private institutions plus companies from many sectors, indicating that g4u does make a difference.</p>

<p>In the meantime, the world has changed, and CDROMs aren&#39;t used that much any more. Network boot and USB sticks are today&#39;s devices of choice, cloning of a full disk without knowing its structure has both advantages but also disadvantages, and g4u&#39;s user interface is still command-line based with not much space for automation. For storage, FTP servers are nice and fast, but alternatives like SSH/SFTP, NFS, iSCSI and SMB for remote storage plus local storage (back to fun with filesystems, anyone? avoiding this was why g4u was created in the first place!) should be considered these days. Further aspects include integrity (checksums), confidentiality (encryption). This leaves a number of open points to address either by future releases, or by other products.</p>
</blockquote>

<ul>
<li>The future:</li>
</ul>

<blockquote>
<p>At this point, my time budget for g4u is very limited. I welcome people to contribute to g4u - g4u is Open Source for a reason. Feel free to get back to me for any changes that you want to contribute!</p>
</blockquote>

<ul>
<li>The changes:</li>
</ul>

<blockquote>
<p>Major changes in g4u 2.6 include:</p>
</blockquote>

<ul>
<li>Make this build with NetBSD-current sources as of 2017-04-17 (shortly before netbsd-8 release branch), binaries were cross-compiled from Mac OS X 10.10</li>
<li>Many new drivers, bugfixes and improvements from NetBSD-current (see beta1 and beta2 announcements)</li>
<li>Go back to keeping the disk image inside the kernel as ramdisk, do not load it as separate module. Less error prone, and allows to boot the g4u (NetBSD) kernel from a single file e.g. via PXE (Testing and documentation updates welcome!)</li>
<li>Actually DO provide the g4u (NetBSD) kernel with the embedded g4u disk image from now on, as separate file, g4u-kernel.gz</li>
<li><p>In addition to MD5, add SHA512 checksums</p>

<ul>
<li>Congratulation, g4u. Check out the <a href="http://fehu.org/%7Efeyrer/g4u/" rel="nofollow">g4u website</a> and support the project if you are using it.
***</li>
</ul></li>
</ul>

<h3><a href="https://wycd.net/posts/2017-05-19-fixing-freebsd-networking-on-digital-ocean.html" rel="nofollow">Fixing FreeBSD Networking on Digital Ocean</a></h3>

<ul>
<li>Most cloud/VPS providers use some form of semi-automated address assignment, rather than just regular static address configuration, so that newly created virtual machines can configure themselves.</li>
<li>Sometimes, especially during the upgrade process, this can break. This is the story of one such user:</li>
</ul>

<blockquote>
<p>I decided it was time to update my FreeBSD Digital Ocean droplet from the end-of-life version 10.1 (shame on me) to the modern version 10.3 (good until April 2018), and maybe even version 11 (good until 2021). There were no sensitive files on the VM, so I had put it off.<br>
Additionally, cloud providers tend to have shoddy support for BSDs, so breakages after messing with the kernel or init system are rampant, and I had been skirting that risk.<br>
The last straw for me was a broken pkg: /usr/local/lib/libpkg.so.3: Undefined symbol &quot;openat&quot;</p>
</blockquote>

<ul>
<li>So the user fires up freebsd-update and upgrades to FreeBSD 10.3</li>
</ul>

<blockquote>
<p>I rebooted, and of course, it happened: no ssh access after 30 seconds, 1 minute, 2 minutesI logged into my Digital Ocean account and saw green status lights for the instance, but something was definitely wrong.<br>
Fortunately, Digital Ocean provides console access (albeit slow, buggy, and crashes my browser every time I run ping). ifconfig revealed that the interfaces vtnet0 (public) and vtnet1 (private) havent been configured with IP addresses.<br>
Combing through files in /etc/rc.*, I found a file called /etc/rc.digitalocean.d/${DROPLET_ID}.conf containing static network settings for this droplet (${DROPLET_ID} was something like 1234567).<br>
It seemed that FreeBSD wasnt picking up the Digital Ocean network settings config file. The quick and dirty way would have been to messily append the contents of this file to /etc/rc.conf, but I wanted a nicer way. Reading the script in /etc/rc.d/digitalocean told me that /etc/rc.digitalocean.d/${DROPLET_ID}.conf was supposed to have a symlink at /etc/rc.digitalocean.d/droplet.conf. It was broken and pointed to /etc/rc.digitalocean.d/.conf, which could happen when the curl command in /etc/rc.d/digitalocean fails</p>
</blockquote>

<ul>
<li>Maybe the curl binary was also in need for an upgrade so failed to fetch the droplet ID</li>
</ul>

<blockquote>
<p>Using grep to fish for files containing droplet.conf, I discovered that it was hacked into the init system via load_rc_config() in /etc/rc.subr</p>
</blockquote>

<ul>
<li><p>I would prefer if Digital Ocean had not customized the version of FreeBSD they ship quite so much</p></li>
<li><p>I could fix that symlink and restart the services:</p></li>
</ul>

<blockquote>
<h1>set DROPLET_ID=$(curl -s <a href="http://169.254.169.254/metadata/v1/id" rel="nofollow">http://169.254.169.254/metadata/v1/id</a>)</h1>

<h1>ln -s -f /etc/rc.digitalocean.d/${DROPLET_ID}.conf /etc/rc.digitalocean.d/droplet.conf</h1>

<h1>/etc/rc.d/netif restart</h1>

<h1>/etc/rc.d/routing restart</h1>

<p>Networking was working again, and I could then ssh into my server and run the following to finish the upgrade:</p>

<h1>freebsd-update install</h1>

<p>At this point, I decided that I didnt want to deal with this mess again until at least 2021, so I decided to go for 11.0-RELEASE</p>

<h1>freebsd-update -r 11.0-RELEASE update</h1>

<h1>freebsd-update install</h1>

<h1>reboot</h1>

<h1>freebsd-update install</h1>

<h1>pkg-static install -f pkg</h1>

<h1>pkg update</h1>

<h1>pkg upgrade</h1>

<h1>uname -a</h1>

<p>FreeBSD hostname 11.0-RELEASE-p9 FreeBSD 11.0-RELEASE-p9</p>

<h1>pkg -v</h1>

<p>1.10.1<br>
The problem was solved correctly, and my /etc/rc.conf remains free of generated cruft.<br>
The Digital Ocean team can make our lives easier by having their init scripts do more thorough system checking, e.g., catching broken symlinks and bad network addresses. Im hopeful that collaboration of the FreeBSD team and cloud providers will one day result in automatic fixing of these situations, or at least a correct status indicator.</p>
</blockquote>

<ul>
<li>The Digital Ocean team didnt really know many FreeBSD people when they made the first 10.1 images, they have improved a lot, but they of course could always use more feedback from <em>BSD users
*</em>*</li>
</ul>

<h3><a href="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt" rel="nofollow">Stack Clash</a></h3>

<blockquote>
<p>A 12-year-old question: &quot;If the heap grows up, and the stack grows down, what happens when they clash? Is it exploitable? How?<br>
<a href="http://cansecwest.com/core05/memory_vulns_delalleau.pdf" rel="nofollow">In 2005, Gael Delalleau presented &quot;Large memory management vulnerabilities&quot; and the first stack-clash exploit in user-space (against mod_php 4.3.0 on Apache 2.0.53)</a><br>
<a href="http://www.invisiblethingslab.com/resources/misc-2010/xorg-large-memory-attacks.pdf" rel="nofollow">In 2010, Rafal Wojtczuk published &quot;Exploiting large memory management vulnerabilities in Xorg server running on Linux&quot;, the second stack-clash exploit in user-space (CVE-2010-2240)</a><br>
Since 2010, security researchers have exploited several stack-clashes in the kernel-space, In user-space, however, this problem has been greatly underestimated; the only public exploits are Gael Delalleau&#39;s and Rafal Wojtczuk&#39;s, and <a href="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2240" rel="nofollow">they were written before Linux introduced a protection against stack-clashes (a &quot;guard-page&quot; mapped below the stack)</a><br>
In this advisory, we show that stack-clashes are widespread in user-space, and exploitable despite the stack guard-page; we discovered multiple vulnerabilities in guard-page implementations, and devised general methods for:<br>
&quot;Clashing&quot; the stack with another memory region: we allocate memory until the stack reaches another memory region, or until another memory region reaches the stack;<br>
&quot;Jumping&quot; over the stack guard-page: we move the stack-pointer from the stack and into the other memory region, without accessing the stack guard-page;<br>
&quot;Smashing&quot; the stack, or the other memory region: we overwrite the stack with the other memory region, or the other memory region with the stack.</p>
</blockquote>

<ul>
<li>So this advisory itself, is not a security vulnerability. It is novel research showing ways to work around the mitigations against generic vulnerability types that are implemented on various operating systems.</li>
<li>While this issue with the mitigation feature has been fixed, even without the fix, successful exploitation requires another application with its own vulnerability in order to be exploited. Those vulnerabilities outside of the OS need to be fixed on their own.</li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-security/2017-June/009335.html" rel="nofollow">FreeBSD-Security post</a></li>
</ul>

<blockquote>
<p>The issue under discussion is a limitation in a vulnerability mitigation technique. Changes to improve the way FreeBSD manages stack growth, and mitigate the issue demonstrated by Qualys&#39; proof-of-concept code, are in progress by FreeBSD developers knowledgeable in the VM subsystem.</p>
</blockquote>

<ul>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=320317" rel="nofollow">FreeBSD address space guards</a></li>
<li><a href="https://github.com/lattera/exploits/blob/master/FreeBSD/StackClash/001-stackclash.c" rel="nofollow">HardenedBSD Proof of Concept for FreeBSD</a></li>
<li>HardenedBSD implementation: <a href="https://github.com/HardenedBSD/hardenedBSD/compare/de8124d3bf83d774b66f62d11aee0162d0cd1031...91104ed152d57cde0292b2dc09489fd1f69ea77c" rel="nofollow">https://github.com/HardenedBSD/hardenedBSD/compare/de8124d3bf83d774b66f62d11aee0162d0cd1031...91104ed152d57cde0292b2dc09489fd1f69ea77c</a> &amp; <a href="https://github.com/HardenedBSD/hardenedBSD/commit/00ad1fb6b53f63d6e9ba539b8f251b5cf4d40261" rel="nofollow">https://github.com/HardenedBSD/hardenedBSD/commit/00ad1fb6b53f63d6e9ba539b8f251b5cf4d40261</a></li>
<li><a href="https://www.qualys.com/2017/06/19/stack-clash/freebsd_cve-2017-fgpu.c" rel="nofollow">Qualys PoC: freebsd_cve-2017-fgpu.c</a></li>
<li><a href="https://www.qualys.com/2017/06/19/stack-clash/freebsd_cve-2017-fgpe.c" rel="nofollow">Qualys PoC: freebsd_cve-2017-fgpe.c</a></li>
<li><a href="https://www.qualys.com/2017/06/19/stack-clash/freebsd_cve-2017-1085.c" rel="nofollow">Qualys PoC: freebsd_cve-2017-1085.c</a></li>
<li><a href="https://www.qualys.com/2017/06/19/stack-clash/openbsd_at.c" rel="nofollow">Qualys PoC: OpenBSD</a></li>
<li><a href="https://www.qualys.com/2017/06/19/stack-clash/netbsd_cve-2017-1000375.c" rel="nofollow">Qualys PoC: NetBSD</a>
***</li>
</ul>

<h3><a href="http://jrs-s.net/2015/02/03/will-zfs-and-non-ecc-ram-kill-your-data/" rel="nofollow">Will ZFS and non-ECC RAM kill your data? </a></h3>

<ul>
<li>TL;DR: ECC is good, but even without, having ZFS is better than not having ZFS.</li>
</ul>

<blockquote>
<p>Whats ECC RAM? Is it a good idea?<br>
Whats ZFS? Is it a good idea?<br>
Is ZFS and non-ECC worse than not-ZFS and non-ECC?<br>
What about the Scrub of Death?</p>
</blockquote>

<ul>
<li>The article walks through ZFS folk lore, and talks about what can really go wrong, and what is just the over-active imagination of people on the FreeNAS forums</li>
</ul>

<blockquote>
<p>But would using any other filesystem that isnt ZFS have protected that data? Cause remember, nobodys arguing that you can lose data to evil RAM  the argument is about whether evil RAM is more dangerous with ZFS than it would be without it.<br>
I really, really want to use the Scrub Of Death in a movie or TV show. How can I make it happen?<br>
I dont care about your logic! I wish to appeal to authority!<br>
OK. Authority in this case doesnt get much better than Matthew Ahrens, one of the cofounders of ZFS at Sun Microsystems and current ZFS developer at Delphix. In the comments to one of my filesystem articles on Ars Technica, Matthew said Theres nothing special about ZFS that requires/encourages the use of ECC RAM more so than any other filesystem.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/eurobsdcon-2017-travel-grant-application-now-open/" rel="nofollow">EuroBSDcon 2017 Travel Grant Application Now Open</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2017-June/087303.html" rel="nofollow">FreeBSD 11.1-BETA3 is out, please give it a test</a></li>
<li><a href="http://dpaste.com/1FE80FJ" rel="nofollow">Allan and Lacey let us know the video to the Postgresql/ZFS talk is online</a></li>
<li><a href="https://marc.info/?l=openbsd-tech&m=149792179514439&w=2" rel="nofollow">Trapsleds</a></li>
<li><a href="https://bsd.nrw/" rel="nofollow">BSD User group in North Rhine-Westphalia, Germany</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2Z5BJCR#wrap" rel="nofollow">Joe - Home Server Suggestions</a></li>
<li><a href="http://dpaste.com/1VRQYAM#wrap" rel="nofollow">Stephen - general BSD</a></li>
<li><a href="http://dpaste.com/2TWADQ8#wrap" rel="nofollow">Eduardo - ZFS Encryption</a></li>
<li><a href="http://dpaste.com/0SC0GAC#wrap" rel="nofollow">Joseph - BGP Kernel Error</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>199: Read the source, KARL</title>
  <link>https://www.bsdnow.tv/199</link>
  <guid isPermaLink="false">09be4191-2b92-4ab8-b530-f934ac4697f3</guid>
  <pubDate>Wed, 21 Jun 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/09be4191-2b92-4ab8-b530-f934ac4697f3.mp3" length="59176660" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>FreeBSD 11.1-Beta1 is out, we discuss Kernel address randomized link (KARL), and explore the benefits of daily OpenBSD source code reading</itunes:subtitle>
  <itunes:duration>1:22:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>FreeBSD 11.1-Beta1 is out, we discuss Kernel address randomized link (KARL), and explore the benefits of daily OpenBSD source code reading
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD 11.1-Beta1 now available (https://lists.freebsd.org/pipermail/freebsd-stable/2017-June/087242.html)
Glen Barber, of the FreeBSD release engineering team has announced that FreeBSD 11.1-Beta1 is now available for the following architectures:
11.1-BETA1 amd64 GENERIC
11.1-BETA1 i386 GENERIC
11.1-BETA1 powerpc GENERIC
11.1-BETA1 powerpc64 GENERIC64
11.1-BETA1 sparc64 GENERIC
11.1-BETA1 armv6 BANANAPI
11.1-BETA1 armv6 BEAGLEBONE
11.1-BETA1 armv6 CUBIEBOARD
11.1-BETA1 armv6 CUBIEBOARD2
11.1-BETA1 armv6 CUBOX-HUMMINGBOARD
11.1-BETA1 armv6 GUMSTIX
11.1-BETA1 armv6 RPI-B
11.1-BETA1 armv6 RPI2
11.1-BETA1 armv6 PANDABOARD
11.1-BETA1 armv6 WANDBOARD
11.1-BETA1 aarch64 GENERIC
Note regarding arm/armv6 images: For convenience for those without console access to the system, a freebsd user with a password of freebsd is available by default for ssh(1) access.  Additionally, the root user password is set to root.  It is strongly recommended to change the password for both users after gaining access to the system.
The full schedule (https://www.freebsd.org/releases/11.1R/schedule.html) for 11.1-RELEASE is here, the final release is expected at the end of July
It was also announced there will be a 10.4-RELEASE scheduled for October (https://www.freebsd.org/releases/10.4R/schedule.html)
***
KARL – kernel address randomized link (https://marc.info/?l=openbsd-tech&amp;amp;m=149732026405941&amp;amp;w=2)
Over the last three weeks I've been working on a new randomization feature which will protect the kernel.
The situation today is that many people install a kernel binary from OpenBSD, and then run that same kernel binary for 6 months or more. We have substantial randomization for the memory allocations made by the kernel, and for userland also of course.
Previously, the kernel assembly language bootstrap/runtime locore.S was compiled and linked with all the other .c files of the kernel in a deterministic fashion. locore.o was always first, then the .c files order specified by our config(8) utility and some helper files.
In the new world order, locore is split into two files: One chunk is bootstrap, that is left at the beginning. The assembly language runtime and all other files are linked in random fashion. There are some other pieces to try to improve the randomness of the layout.
As a result, every new kernel is unique. The relative offsets between functions and data are unique.
It still loads at the same location in KVA. This is not kernel ASLR! ASLR is a concept where the base address of a module is biased to a random location, for position-independent execution. In this case, the module itself is perturbed but it lands at the same location, and
does not need to use position-independent execution modes.
LLDB: Sanitizing the debugger's runtime (https://blog.netbsd.org/tnf/entry/lldb_sanitizing_the_debugger_s)
The good
Besides the greater enhancements this month I performed a cleanup in the ATF ptrace(2) tests again. Additionally I have managed to unbreak the LLDB Debug build and to eliminate compiler warnings in the NetBSD Native Process Plugin. It is worth noting that LLVM can run tests on NetBSD again, the patch in gtest/LLVM has been installed by Joerg Sonnenberg and a more generic one has been submitted to the upstream googletest repository. There was also an improvement in ftruncate(2) on the LLVM side (authored by Joerg).
Since LLD (the LLVM linker) is advancing rapidly, it improved support for NetBSD and it can link a functional executable on NetBSD. I submitted a patch to stop crashing it on startup anymore. It was nearly used for linking LLDB/NetBSD and it spotted a real linking error... however there are further issues that need to be addressed in the future. Currently LLD is not part of the mainline LLDB tasks - it's part of improving the work environment. This linker should reduce the linking time - compared to GNU linkers - of LLDB by a factor of 3x-10x and save precious developer time. As of now LLDB linking can take minutes on a modern amd64 machine designed for performance.
Kernel correctness
I have researched (in pkgsrc-wip) initial support for multiple threads in the NetBSD Native Process Plugin. This code revealed - when running the LLDB regression test-suite - new kernel bugs. This unfortunately affects the usability of a debugger in a multithread environment in general and explains why GDB was never doing its job properly in such circumstances. One of the first errors was asserting kernel panic with PT*STEP, when a debuggee has more than a single thread. I have narrowed it down to lock primitives misuse in the doptrace() kernel code. The fix has been committed.
The bad
Unfortunately this is not the full story and there is further mandatory work.
LLDB acceleration
The EV_SET() bug broke upstream LLDB over a month ago, and during this period the debugger was significantly accelerated and parallelized. It is difficult to declare it definitely, but it might be the reason why the tracer's runtime broke due to threading desynchronization. LLDB behaves differently when run standalone, under ktruss(1) and under gdb(1) - the shared bug is that it always fails in one way or another, which isn't trivial to debug.
The ugly
There are also unpleasant issues at the core of the Operating System.
Kernel troubles
Another bug with single-step functions that affects another aspect of correctness - this time with reliable execution of a program - is that processes die in non-deterministic ways when single-stepped. My current impression is that there is no appropriate translation between process and thread (LWP) states under a debugger. These issues are sibling problems to unreliable PTRESUME and PTSUSPEND.
In order to be able to appropriately address this, I have diligently studied this month the Solaris Internals book to get a better image of the design of the NetBSD kernel multiprocessing, which was modeled after this commercial UNIX.
Plan for the next milestone
The current troubles can be summarized as data races in the kernel and at the same time in LLDB. I have decided to port the LLVM sanitizers, as I require the Thread Sanitizer (tsan). Temporarily I have removed the code for tracing processes with multiple threads to hide the known kernel bugs and focus on the LLDB races.
Unfortunately LLDB is not easily bisectable (build time of the LLVM+Clang+LLDB stack, number of revisions), therefore the debugging has to be performed on the most recent code from upstream trunk.
d2K17 Hackathon Reports
d2k17 Hackathon Report: Ken Westerback on XSNOCCB removal and dhclient link detection (http://undeadly.org/cgi?action=article&amp;amp;sid=20170605225415)
d2k17 Hackathon Report: Antoine Jacoutot on rc.d, syspatch, and more (http://undeadly.org/cgi?action=article&amp;amp;sid=20170608074033)
d2k17 Hackathon Report: Florian Obser on slaacd(8) (http://undeadly.org/cgi?action=article&amp;amp;sid=20170609013548)
d2k17 Hackathon Report: Stefan Sperling on USB audio, WiFi Progress (http://undeadly.org/cgi?action=article&amp;amp;sid=20170602014048)
News Roundup
Multi-tenant router or firewall with FreeBSD (https://bsdrp.net/documentation/examples/multi-tenant_router_and_firewall)
Setting-up a virtual lab
Downloading BSD Router Project images
Download BSDRP serial image (prevent to have to use an X display) on Sourceforge.
Download Lab scripts
More information on these BSDRP lab scripts available on How to build a BSDRP router lab (https://bsdrp.net/documentation/examples/how_to_build_a_bsdrp_router_lab).
Start the lab with full-meshed 5 routers and one shared LAN, on this example using bhyve lab script on FreeBSD:
[root@FreeBSD]~# tools/BSDRP-lab-bhyve.sh -i BSDRP-1.71-full-amd64-serial.img.xz -n 5 -l 1
Configuration
Router 4 (R4) hosts the 3 routers/firewalls for each 3 customers.
Router 1 (R1) belongs to customer 1, router 2 (R2) to customer 2 and router 3 (R3) to customer 3.
Router 5 (R5) simulates a simple Internet host
Using pf firewall in place of ipfw
pf need a little more configuration because by default /dev/pf is hidden from jail. Then, on the host we need to:
In place of loading the ipfw/ipfw-nat modules we need to load the pf module (but still disabling pf on our host for this example)
Modify default devd rules for allowing jails to see /dev/pf (if you want to use tcpdump inside your jail, you should use bpf device too)
Replacing nojail tag by nojailvnet tag into /etc/rc.d/pf (already done into BSDRP (https://github.com/ocochard/BSDRP/blob/master/BSDRP/patches/freebsd.pf.rc.jail.patch))
Under the hood: jails-on-nanobsd
BSDRP's tenant shell script (https://github.com/ocochard/BSDRP/blob/master/BSDRP/Files/usr/local/sbin/tenant) creates jail configuration compliant with a host running nanobsd. Then these jails need to be configured for a nanobsd:
Being nullfs based for being hosted on a read-only root filesystem
Have their /etc and /var into tmpfs disks (then we need to populate these directory before each start)
Configuration changes need to be saved with nanobsd configuration tools, like “config save” on BSDRP
And on the host:
autosave daemon (https://github.com/ocochard/BSDRP/blob/master/BSDRP/Files/usr/local/sbin/autosave) need to be enabled: Each time a customer will issue a “config save” inside a jail, his configuration diffs will be save into host's /etc/jails/. And this directory is a RAM disk too, then we need to automatically save hosts configuration on changes.
***
OpenBSD Daily Source Reading (https://blog.tintagel.pl/2017/06/09/openbsd-daily.html)
Adam Wołk writes:
I made a new year's resolution to read at least one C source file from OpenBSD daily. The goal was to both get better at C and to contribute more to the base system and userland development. I have to admit that initially I wasn’t consistent with it at all. In the first quarter of the year I read the code of a few small base utilities and nothing else. Still, every bit counts and it’s never too late to get better.
Around the end of May, I really started reading code daily - no days skipped. It usually takes anywhere between ten minutes (for small base utils) and one and a half hour (for targeted reads). I’m pretty happy with the results so far. Exploring the system on a daily basis, looking up things in the code that I don’t understand and digging as deep as possible made me learn a lot more both about C and the system than I initially expected.
There’s also one more side effect of reading code daily - diffs. It’s easy to spot inconsistencies, outdated code or an incorrect man page. This results in opportunities for contributing to the project. With time it also becomes less opportunitstic and more goal oriented. You might start with a https://marc.info/?l=openbsd-tech&amp;amp;m=149591302814638&amp;amp;w=2 (drive by diff to kill) optional compilation of an old compatibility option in chown that has been compiled in by default since 1995.
Soon the contributions become more targeted, for example using a new API for encrypting passwords in the htpasswd utility after reading the code of the utility and the code for htpasswd handling in httpd. Similarly it can take you from discussing a doas feature idea with a friend to implementing it after reading the code.
I was having a lot of fun reading code daily and started to recommend it to people in general discussions. There was one particular twitter thread that ended up starting something new.
This is still a new thing and the format is not yet solidified. Generally I make a lot of notes reading code, instead of slapping them inside a local file I drop the notes on the IRC channel as I go. Everyone on the channel is encouraged to do the same or share his notes in any way he/she seems feasable.
Check out the logs from the IRC discussions.
Start reading code from other BSD projects and see whether you can replicate their results!
***
Become FreeBSD User: Find Useful Tools (https://bsdmag.org/become-freebsd-user-find-useful-tools/)
BSD Mag has the following article by David Carlier:
If you’re usually programming on Linux and you consider a potential switch to FreeBSD, this article will give you an overview of the possibilities.
How to Install the Dependencies
FreeBSD comes with either applications from binary packages or compiled from sources (ports). They are arranged according to software types (programming languages mainly in lang (or java specifically for Java), libraries in devel, web servers in www …) and the main tool for modern FreeBSD versions is pkg, similar to Debian apt tools suite. Hence, most of the time if you are looking for a specific application/library, simply
pkg search 
without necessarily knowing the fully qualified name of the package. It is somehow sufficient. For example pkg search php7 will display php7 itself and the modules. Furthermore, php70 specific version and so on.
Web Development
Basically, this is the easiest area to migrate to. Most  Web languages do not use  specific platform features. Thus, most of the time, your existing projects might just be “drop-in” use cases.
If your language of choice is PHP, you are lucky as this scripting language is workable on various operating systems, on most  Unixes and Windows. In the case of FreeBSD, you have even many different ports or binary package versions (5.6 to 7.1). In this case, you may need some specific PHP modules enabled, luckily they are available atomically, or if the port is the way you chose, it is via the www/php70-extensions’s one.
Of course developing with Apache (both 2.2 and 2.4 series are available, respectively www/apache22 and www/apache24 packages), or even better with Nginx (the last stable or the latest development versions could be used, respectively www/nginx and www/nginx-devel packages) via php-fpm is possible.
In terms of databases, we have the regular RDMBS like MySQL and PostgreSQL (client and server are distinct packages … databases/(mysql/portgresql)-client, and databases/(mysql/postgresql)-server). Additionally, a more modern concept of NoSQL with CouchDB, for example (databases/couchdb), MongoDB (databases/mongodb), and Cassandra (databases/cassandra), to name but a few.
Low-level Development
The BSDs are shipped with C and C++ compilers in the base. In the case of FreeBSD 11.0, it is clang 3.8.0 (in x86 architectures) otherwise, modern versions of gcc exist for developing with C++11. Examples are of course available too (lang/gcc … until gcc 7.0 devel).
Numerous libraries for various topics are also present, web services SOAP with gsoap through User Interfaces with GTK (x11-toolkits/gtk), QT4 or QT 5 (devel/qt), malware libraries with Yara (security/yara), etc.
Android / Mobile Development
To be able to do Android development, to a certain degree, the Linux’s compatibility layer (aka linuxulator) needs to be enabled. Also, x11-toolkits/swt and linux-f10-gtk2 port/package need to be installed (note that libswt-gtk-3550.so and libswt-pi-gtk-3550.so are necessary. The current package is versioned as 3557 and can be solved using symlinks). In the worst case scenario, remember that bhyve (or Virtualbox) is available, and can run any Linux distribution efficiently.
Source Control Management
FreeBSD comes in base with a version of subversion. As FreeBSD source is in a subversion repository, a prefixed svnlite command prevents conflicts with the package/port.
Additionally, Git is present but via the package/port system with various options (with or without a user interface, subversion support).
Conclusion
FreeBSD has made tremendous improvements over the years to fill the gap created by Linux. FreeBSD still maintains its interesting specificities; hence there will not be too much blockers if your projects are reasonably sized to allow a migration to FreeBSD.
Notes from project Aeronix, part 10 (https://martin.kopta.eu/blog/#2017-06-11-16-07-26)
Prologue
It is almost two years since I finished building Aeronix and it has served me well during that time. Only thing that ever broke was Noctua CPU fan, which I have replaced with the same model. However, for long time, I wanted to run Aeronix on OpenBSD instead of GNU/Linux Debian.
Preparation
I first experimented with RAID1 OpenBSD setup in VirtualBox, plugging and unplugging drives and learned that OpenBSD RAID1 is really smooth. When I finally got the courage, I copied all the data on two drives outside of Aeronix. One external HDD I regulary use to backup Aeronix and second internal drive in my desktop computer. Copying the data took about two afternoons. Aeronix usually has higher temperatures (somewhere around 55°C or 65°C depending on time of the year), and when stressed, it can go really high (around 75°C). During full speed copy over NFS and to external drive it went as high as 85°C, which made me a bit nervous. After the data were copied, I temporarily un-configured computers on local network to not touch Aeronix, plugged keyboard, display and OpenBSD 6.1 thumb drive. Installing OpenBSD 6.1 on full disk RAID1 was super easy.
Configuring NFS
Aeronix serves primarily as NAS, which means NFS and SMB. NFS is used by computers in local network with persistent connection (via Ethernet). SMB is used by other devices in local network with volatile connection (via WiFi). When configuring NFS, I expected similar configuration to what I had in Debian, but on OpenBSD, it is very different. However, after reading through exports(5), it was really easy to put it together.
Putting the data back
Copying from the external drive took few days, since the transfer speed was something around 5MB/s. I didn't really mind. It was sort of a good thing, because Aeronix wasn't overheating that way. I guess I need to figure new backup strategy though.
One interesting thing happened with one of my local desktops. It was connecting Aeronix with default NFS mount options (on Archlinux) and had really big troubles with reading anything. Basically it behaved as if the network drive had horrible access times. After changing the default mount options, it started working perfectly.
Conclusion
Migrating to OpenBSD was way easier than I anticipated. There are various benefits like more security, realiable RAID1 setup (which I know how will work when drive dies), better documentation and much more. However, the true benefit for me is just the fact I like OpenBSD and makes me happy to have one more OpenBSD machine. On to the next two years of service!
Beastie Bits
Running OpenBSD on Azure (http://undeadly.org/cgi?action=article&amp;amp;sid=20170609121413&amp;amp;mode=expanded&amp;amp;count=0)
Mondieu - portable alternative for freebsd-update (https://github.com/skoef/mondieu)
Plan9-9k: 64-bit Plan 9 (https://bitbucket.org/forsyth/plan9-9k)
Installing OpenBSD 6.1 on your laptop is really hard (not) (http://sohcahtoa.org.uk/openbsd.html)
UbuntuBSD is dead (http://www.ubuntubsd.org/)
OPNsense 17.1.8 released (https://opnsense.org/opnsense-17-1-8-released/)
***
Feedback/Questions
Patrick - Operating System Textbooks (http://dpaste.com/2DKXA0T#wrap)
Brian - snapshot retention (http://dpaste.com/3CJGW22#wrap)
Randy - FreeNAS to FreeBSD (http://dpaste.com/2X3X6NR#wrap)
Florian - Bootloader Resolution (http://dpaste.com/1AE2SPS#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>FreeBSD 11.1-Beta1 is out, we discuss Kernel address randomized link (KARL), and explore the benefits of daily OpenBSD source code reading</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2017-June/087242.html" rel="nofollow">FreeBSD 11.1-Beta1 now available</a></h3>

<ul>
<li>Glen Barber, of the FreeBSD release engineering team has announced that FreeBSD 11.1-Beta1 is now available for the following architectures:</li>
</ul>

<blockquote>
<p>11.1-BETA1 amd64 GENERIC<br>
11.1-BETA1 i386 GENERIC<br>
11.1-BETA1 powerpc GENERIC<br>
11.1-BETA1 powerpc64 GENERIC64<br>
11.1-BETA1 sparc64 GENERIC<br>
11.1-BETA1 armv6 BANANAPI<br>
11.1-BETA1 armv6 BEAGLEBONE<br>
11.1-BETA1 armv6 CUBIEBOARD<br>
11.1-BETA1 armv6 CUBIEBOARD2<br>
11.1-BETA1 armv6 CUBOX-HUMMINGBOARD<br>
11.1-BETA1 armv6 GUMSTIX<br>
11.1-BETA1 armv6 RPI-B<br>
11.1-BETA1 armv6 RPI2<br>
11.1-BETA1 armv6 PANDABOARD<br>
11.1-BETA1 armv6 WANDBOARD<br>
11.1-BETA1 aarch64 GENERIC<br>
Note regarding arm/armv6 images: For convenience for those without console access to the system, a freebsd user with a password of freebsd is available by default for ssh(1) access.  Additionally, the root user password is set to root.  It is strongly recommended to change the password for both users after gaining access to the system.</p>
</blockquote>

<ul>
<li>The <a href="https://www.freebsd.org/releases/11.1R/schedule.html" rel="nofollow">full schedule</a> for 11.1-RELEASE is here, the final release is expected at the end of July</li>
<li>It was also announced there will be a 10.4-RELEASE <a href="https://www.freebsd.org/releases/10.4R/schedule.html" rel="nofollow">scheduled for October</a>
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-tech&m=149732026405941&w=2" rel="nofollow">KARL – kernel address randomized link</a></h3>

<blockquote>
<p>Over the last three weeks I&#39;ve been working on a new randomization feature which will protect the kernel.<br>
The situation today is that many people install a kernel binary from OpenBSD, and then run that same kernel binary for 6 months or more. We have substantial randomization for the memory allocations made by the kernel, and for userland also of course.<br>
Previously, the kernel assembly language bootstrap/runtime locore.S was compiled and linked with all the other .c files of the kernel in a deterministic fashion. locore.o was always first, then the .c files order specified by our config(8) utility and some helper files.<br>
In the new world order, locore is split into two files: One chunk is bootstrap, that is left at the beginning. The assembly language runtime and all other files are linked in random fashion. There are some other pieces to try to improve the randomness of the layout.<br>
As a result, every new kernel is unique. The relative offsets between functions and data are unique.<br>
It still loads at the same location in KVA. This is not kernel ASLR! ASLR is a concept where the base address of a module is biased to a random location, for position-independent execution. In this case, the module itself is perturbed but it lands at the same location, and<br>
does not need to use position-independent execution modes.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/lldb_sanitizing_the_debugger_s" rel="nofollow">LLDB: Sanitizing the debugger&#39;s runtime</a></h3>

<ul>
<li>The good</li>
</ul>

<blockquote>
<p>Besides the greater enhancements this month I performed a cleanup in the ATF ptrace(2) tests again. Additionally I have managed to unbreak the LLDB Debug build and to eliminate compiler warnings in the NetBSD Native Process Plugin. It is worth noting that LLVM can run tests on NetBSD again, the patch in gtest/LLVM has been installed by Joerg Sonnenberg and a more generic one has been submitted to the upstream googletest repository. There was also an improvement in ftruncate(2) on the LLVM side (authored by Joerg).<br>
Since LLD (the LLVM linker) is advancing rapidly, it improved support for NetBSD and it can link a functional executable on NetBSD. I submitted a patch to stop crashing it on startup anymore. It was nearly used for linking LLDB/NetBSD and it spotted a real linking error... however there are further issues that need to be addressed in the future. Currently LLD is not part of the mainline LLDB tasks - it&#39;s part of improving the work environment. This linker should reduce the linking time - compared to GNU linkers - of LLDB by a factor of 3x-10x and save precious developer time. As of now LLDB linking can take minutes on a modern amd64 machine designed for performance.</p>
</blockquote>

<ul>
<li>Kernel correctness</li>
</ul>

<blockquote>
<p>I have researched (in pkgsrc-wip) initial support for multiple threads in the NetBSD Native Process Plugin. This code revealed - when running the LLDB regression test-suite - new kernel bugs. This unfortunately affects the usability of a debugger in a multithread environment in general and explains why GDB was never doing its job properly in such circumstances. One of the first errors was asserting kernel panic with PT_*STEP, when a debuggee has more than a single thread. I have narrowed it down to lock primitives misuse in the do_ptrace() kernel code. The fix has been committed.</p>
</blockquote>

<ul>
<li>The bad</li>
</ul>

<blockquote>
<p>Unfortunately this is not the full story and there is further mandatory work.<br>
LLDB acceleration<br>
The EV_SET() bug broke upstream LLDB over a month ago, and during this period the debugger was significantly accelerated and parallelized. It is difficult to declare it definitely, but it might be the reason why the tracer&#39;s runtime broke due to threading desynchronization. LLDB behaves differently when run standalone, under ktruss(1) and under gdb(1) - the shared bug is that it always fails in one way or another, which isn&#39;t trivial to debug.</p>
</blockquote>

<ul>
<li>The ugly</li>
</ul>

<blockquote>
<p>There are also unpleasant issues at the core of the Operating System.<br>
Kernel troubles<br>
Another bug with single-step functions that affects another aspect of correctness - this time with reliable execution of a program - is that processes die in non-deterministic ways when single-stepped. My current impression is that there is no appropriate translation between process and thread (LWP) states under a debugger. These issues are sibling problems to unreliable PT_RESUME and PT_SUSPEND.<br>
In order to be able to appropriately address this, I have diligently studied this month the Solaris Internals book to get a better image of the design of the NetBSD kernel multiprocessing, which was modeled after this commercial UNIX.</p>
</blockquote>

<ul>
<li>Plan for the next milestone</li>
</ul>

<blockquote>
<p>The current troubles can be summarized as data races in the kernel and at the same time in LLDB. I have decided to port the LLVM sanitizers, as I require the Thread Sanitizer (tsan). Temporarily I have removed the code for tracing processes with multiple threads to hide the known kernel bugs and focus on the LLDB races.<br>
Unfortunately LLDB is not easily bisectable (build time of the LLVM+Clang+LLDB stack, number of revisions), therefore the debugging has to be performed on the most recent code from upstream trunk.</p>
</blockquote>

<hr>

<h3>d2K17 Hackathon Reports</h3>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170605225415" rel="nofollow">d2k17 Hackathon Report: Ken Westerback on XS_NO_CCB removal and dhclient link detection</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170608074033" rel="nofollow">d2k17 Hackathon Report: Antoine Jacoutot on rc.d, syspatch, and more</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170609013548" rel="nofollow">d2k17 Hackathon Report: Florian Obser on slaacd(8)</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170602014048" rel="nofollow">d2k17 Hackathon Report: Stefan Sperling on USB audio, WiFi Progress</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://bsdrp.net/documentation/examples/multi-tenant_router_and_firewall" rel="nofollow">Multi-tenant router or firewall with FreeBSD</a></h3>

<ul>
<li>Setting-up a virtual lab</li>
<li>Downloading BSD Router Project images</li>
<li>Download BSDRP serial image (prevent to have to use an X display) on Sourceforge.</li>
<li>Download Lab scripts</li>
</ul>

<blockquote>
<p>More information on these BSDRP lab scripts available on <a href="https://bsdrp.net/documentation/examples/how_to_build_a_bsdrp_router_lab" rel="nofollow">How to build a BSDRP router lab</a>.</p>
</blockquote>

<ul>
<li>Start the lab with full-meshed 5 routers and one shared LAN, on this example using bhyve lab script on FreeBSD:</li>
</ul>

<p><code>[root@FreeBSD]~# tools/BSDRP-lab-bhyve.sh -i BSDRP-1.71-full-amd64-serial.img.xz -n 5 -l 1</code></p>

<ul>
<li><strong>Configuration</strong></li>
<li>Router 4 (R4) hosts the 3 routers/firewalls for each 3 customers.</li>
<li>Router 1 (R1) belongs to customer 1, router 2 (R2) to customer 2 and router 3 (R3) to customer 3.</li>
<li>Router 5 (R5) simulates a simple Internet host</li>
<li>Using pf firewall in place of ipfw</li>
</ul>

<blockquote>
<p>pf need a little more configuration because by default /dev/pf is hidden from jail. Then, on the host we need to:</p>
</blockquote>

<ul>
<li>In place of loading the ipfw/ipfw-nat modules we need to load the pf module (but still disabling pf on our host for this example)</li>
<li>Modify default devd rules for allowing jails to see /dev/pf (if you want to use tcpdump inside your jail, you should use bpf device too)</li>
<li>Replacing nojail tag by nojailvnet tag into /etc/rc.d/pf (<a href="https://github.com/ocochard/BSDRP/blob/master/BSDRP/patches/freebsd.pf.rc.jail.patch" rel="nofollow">already done into BSDRP</a>)</li>
<li>Under the hood: jails-on-nanobsd</li>
<li><a href="https://github.com/ocochard/BSDRP/blob/master/BSDRP/Files/usr/local/sbin/tenant" rel="nofollow">BSDRP&#39;s tenant shell script</a> creates jail configuration compliant with a host running nanobsd. Then these jails need to be configured for a nanobsd:</li>
<li>Being nullfs based for being hosted on a read-only root filesystem</li>
<li>Have their /etc and /var into tmpfs disks (then we need to populate these directory before each start)</li>
<li>Configuration changes need to be saved with nanobsd configuration tools, like “config save” on BSDRP</li>
<li>And on the host:</li>
<li><a href="https://github.com/ocochard/BSDRP/blob/master/BSDRP/Files/usr/local/sbin/autosave" rel="nofollow">autosave daemon</a> need to be enabled: Each time a customer will issue a “config save” inside a jail, his configuration diffs will be save into host&#39;s /etc/jails/. And this directory is a RAM disk too, then we need to automatically save hosts configuration on changes.
***</li>
</ul>

<h3><a href="https://blog.tintagel.pl/2017/06/09/openbsd-daily.html" rel="nofollow">OpenBSD Daily Source Reading</a></h3>

<ul>
<li>Adam Wołk writes:</li>
</ul>

<blockquote>
<p>I made a new year&#39;s resolution to read at least one C source file from OpenBSD daily. The goal was to both get better at C and to contribute more to the base system and userland development. I have to admit that initially I wasn’t consistent with it at all. In the first quarter of the year I read the code of a few small base utilities and nothing else. Still, every bit counts and it’s never too late to get better.<br>
Around the end of May, I really started reading code daily - no days skipped. It usually takes anywhere between ten minutes (for small base utils) and one and a half hour (for targeted reads). I’m pretty happy with the results so far. Exploring the system on a daily basis, looking up things in the code that I don’t understand and digging as deep as possible made me learn a lot more both about C and the system than I initially expected.<br>
There’s also one more side effect of reading code daily - diffs. It’s easy to spot inconsistencies, outdated code or an incorrect man page. This results in opportunities for contributing to the project. With time it also becomes less opportunitstic and more goal oriented. You might start with a [<a href="https://marc.info/?l=openbsd-tech&m=149591302814638&w=2%5D(drive" rel="nofollow">https://marc.info/?l=openbsd-tech&amp;m=149591302814638&amp;w=2](drive</a> by diff to kill) optional compilation of an old compatibility option in chown that has been compiled in by default since 1995.<br>
Soon the contributions become more targeted, for example using a new API for encrypting passwords in the htpasswd utility after reading the code of the utility and the code for htpasswd handling in httpd. Similarly it can take you from discussing a doas feature idea with a friend to implementing it after reading the code.<br>
I was having a lot of fun reading code daily and started to recommend it to people in general discussions. There was one particular twitter thread that ended up starting something new.<br>
This is still a new thing and the format is not yet solidified. Generally I make a lot of notes reading code, instead of slapping them inside a local file I drop the notes on the IRC channel as I go. Everyone on the channel is encouraged to do the same or share his notes in any way he/she seems feasable.</p>
</blockquote>

<ul>
<li>Check out the logs from the IRC discussions.</li>
<li>Start reading code from other BSD projects and see whether you can replicate their results!
***</li>
</ul>

<h3><a href="https://bsdmag.org/become-freebsd-user-find-useful-tools/" rel="nofollow">Become FreeBSD User: Find Useful Tools</a></h3>

<ul>
<li>BSD Mag has the following article by David Carlier:</li>
</ul>

<blockquote>
<p>If you’re usually programming on Linux and you consider a potential switch to FreeBSD, this article will give you an overview of the possibilities.</p>
</blockquote>

<ul>
<li>How to Install the Dependencies</li>
</ul>

<blockquote>
<p>FreeBSD comes with either applications from binary packages or compiled from sources (ports). They are arranged according to software types (programming languages mainly in lang (or java specifically for Java), libraries in devel, web servers in www …) and the main tool for modern FreeBSD versions is pkg, similar to Debian apt tools suite. Hence, most of the time if you are looking for a specific application/library, simply</p>

<p><code>pkg search &lt;name&gt;</code></p>

<p>without necessarily knowing the fully qualified name of the package. It is somehow sufficient. For example pkg search php7 will display php7 itself and the modules. Furthermore, php70 specific version and so on.</p>
</blockquote>

<ul>
<li>Web Development</li>
</ul>

<blockquote>
<p>Basically, this is the easiest area to migrate to. Most  Web languages do not use  specific platform features. Thus, most of the time, your existing projects might just be “drop-in” use cases.<br>
If your language of choice is PHP, you are lucky as this scripting language is workable on various operating systems, on most  Unixes and Windows. In the case of FreeBSD, you have even many different ports or binary package versions (5.6 to 7.1). In this case, you may need some specific PHP modules enabled, luckily they are available atomically, or if the port is the way you chose, it is via the www/php70-extensions’s one.<br>
Of course developing with Apache (both 2.2 and 2.4 series are available, respectively www/apache22 and www/apache24 packages), or even better with Nginx (the last stable or the latest development versions could be used, respectively www/nginx and www/nginx-devel packages) via php-fpm is possible.<br>
In terms of databases, we have the regular RDMBS like MySQL and PostgreSQL (client and server are distinct packages … databases/(mysql/portgresql)<version>-client, and databases/(mysql/postgresql)<version>-server). Additionally, a more modern concept of NoSQL with CouchDB, for example (databases/couchdb), MongoDB (databases/mongodb), and Cassandra (databases/cassandra), to name but a few.</p>
</blockquote>

<ul>
<li>Low-level Development</li>
</ul>

<blockquote>
<p>The BSDs are shipped with C and C++ compilers in the base. In the case of FreeBSD 11.0, it is clang 3.8.0 (in x86 architectures) otherwise, modern versions of gcc exist for developing with C++11. Examples are of course available too (lang/gcc<version> … until gcc 7.0 devel).<br>
Numerous libraries for various topics are also present, web services SOAP with gsoap through User Interfaces with GTK (x11-toolkits/gtk<version>), QT4 or QT 5 (devel/qt<version>), malware libraries with Yara (security/yara), etc.</p>
</blockquote>

<ul>
<li>Android / Mobile Development</li>
</ul>

<blockquote>
<p>To be able to do Android development, to a certain degree, the Linux’s compatibility layer (aka linuxulator) needs to be enabled. Also, x11-toolkits/swt and linux-f10-gtk2 port/package need to be installed (note that libswt-gtk-3550.so and libswt-pi-gtk-3550.so are necessary. The current package is versioned as 3557 and can be solved using symlinks). In the worst case scenario, remember that bhyve (or Virtualbox) is available, and can run any Linux distribution efficiently.</p>
</blockquote>

<ul>
<li>Source Control Management</li>
</ul>

<blockquote>
<p>FreeBSD comes in base with a version of subversion. As FreeBSD source is in a subversion repository, a prefixed svnlite command prevents conflicts with the package/port.<br>
Additionally, Git is present but via the package/port system with various options (with or without a user interface, subversion support).</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>FreeBSD has made tremendous improvements over the years to fill the gap created by Linux. FreeBSD still maintains its interesting specificities; hence there will not be too much blockers if your projects are reasonably sized to allow a migration to FreeBSD.</p>

<hr>
</blockquote>

<h3><a href="https://martin.kopta.eu/blog/#2017-06-11-16-07-26" rel="nofollow">Notes from project Aeronix, part 10</a></h3>

<ul>
<li>Prologue</li>
</ul>

<blockquote>
<p>It is almost two years since I finished building Aeronix and it has served me well during that time. Only thing that ever broke was Noctua CPU fan, which I have replaced with the same model. However, for long time, I wanted to run Aeronix on OpenBSD instead of GNU/Linux Debian.</p>
</blockquote>

<ul>
<li>Preparation</li>
</ul>

<blockquote>
<p>I first experimented with RAID1 OpenBSD setup in VirtualBox, plugging and unplugging drives and learned that OpenBSD RAID1 is really smooth. When I finally got the courage, I copied all the data on two drives outside of Aeronix. One external HDD I regulary use to backup Aeronix and second internal drive in my desktop computer. Copying the data took about two afternoons. Aeronix usually has higher temperatures (somewhere around 55°C or 65°C depending on time of the year), and when stressed, it can go really high (around 75°C). During full speed copy over NFS and to external drive it went as high as 85°C, which made me a bit nervous. After the data were copied, I temporarily un-configured computers on local network to not touch Aeronix, plugged keyboard, display and OpenBSD 6.1 thumb drive. Installing OpenBSD 6.1 on full disk RAID1 was super easy.</p>
</blockquote>

<ul>
<li>Configuring NFS</li>
</ul>

<blockquote>
<p>Aeronix serves primarily as NAS, which means NFS and SMB. NFS is used by computers in local network with persistent connection (via Ethernet). SMB is used by other devices in local network with volatile connection (via WiFi). When configuring NFS, I expected similar configuration to what I had in Debian, but on OpenBSD, it is very different. However, after reading through exports(5), it was really easy to put it together.</p>
</blockquote>

<ul>
<li>Putting the data back</li>
</ul>

<blockquote>
<p>Copying from the external drive took few days, since the transfer speed was something around 5MB/s. I didn&#39;t really mind. It was sort of a good thing, because Aeronix wasn&#39;t overheating that way. I guess I need to figure new backup strategy though.<br>
One interesting thing happened with one of my local desktops. It was connecting Aeronix with default NFS mount options (on Archlinux) and had really big troubles with reading anything. Basically it behaved as if the network drive had horrible access times. After changing the default mount options, it started working perfectly.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>Migrating to OpenBSD was way easier than I anticipated. There are various benefits like more security, realiable RAID1 setup (which I know how will work when drive dies), better documentation and much more. However, the true benefit for me is just the fact I like OpenBSD and makes me happy to have one more OpenBSD machine. On to the next two years of service!</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170609121413&mode=expanded&count=0" rel="nofollow">Running OpenBSD on Azure</a></li>
<li><a href="https://github.com/skoef/mondieu" rel="nofollow">Mondieu - portable alternative for freebsd-update</a></li>
<li><a href="https://bitbucket.org/forsyth/plan9-9k" rel="nofollow">Plan9-9k: 64-bit Plan 9</a></li>
<li><a href="http://sohcahtoa.org.uk/openbsd.html" rel="nofollow">Installing OpenBSD 6.1 on your laptop is really hard (not)</a></li>
<li><a href="http://www.ubuntubsd.org/" rel="nofollow">UbuntuBSD is dead</a></li>
<li><a href="https://opnsense.org/opnsense-17-1-8-released/" rel="nofollow">OPNsense 17.1.8 released</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2DKXA0T#wrap" rel="nofollow">Patrick - Operating System Textbooks</a></li>
<li><a href="http://dpaste.com/3CJGW22#wrap" rel="nofollow">Brian - snapshot retention</a></li>
<li><a href="http://dpaste.com/2X3X6NR#wrap" rel="nofollow">Randy - FreeNAS to FreeBSD</a></li>
<li><a href="http://dpaste.com/1AE2SPS#wrap" rel="nofollow">Florian - Bootloader Resolution</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>FreeBSD 11.1-Beta1 is out, we discuss Kernel address randomized link (KARL), and explore the benefits of daily OpenBSD source code reading</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2017-June/087242.html" rel="nofollow">FreeBSD 11.1-Beta1 now available</a></h3>

<ul>
<li>Glen Barber, of the FreeBSD release engineering team has announced that FreeBSD 11.1-Beta1 is now available for the following architectures:</li>
</ul>

<blockquote>
<p>11.1-BETA1 amd64 GENERIC<br>
11.1-BETA1 i386 GENERIC<br>
11.1-BETA1 powerpc GENERIC<br>
11.1-BETA1 powerpc64 GENERIC64<br>
11.1-BETA1 sparc64 GENERIC<br>
11.1-BETA1 armv6 BANANAPI<br>
11.1-BETA1 armv6 BEAGLEBONE<br>
11.1-BETA1 armv6 CUBIEBOARD<br>
11.1-BETA1 armv6 CUBIEBOARD2<br>
11.1-BETA1 armv6 CUBOX-HUMMINGBOARD<br>
11.1-BETA1 armv6 GUMSTIX<br>
11.1-BETA1 armv6 RPI-B<br>
11.1-BETA1 armv6 RPI2<br>
11.1-BETA1 armv6 PANDABOARD<br>
11.1-BETA1 armv6 WANDBOARD<br>
11.1-BETA1 aarch64 GENERIC<br>
Note regarding arm/armv6 images: For convenience for those without console access to the system, a freebsd user with a password of freebsd is available by default for ssh(1) access.  Additionally, the root user password is set to root.  It is strongly recommended to change the password for both users after gaining access to the system.</p>
</blockquote>

<ul>
<li>The <a href="https://www.freebsd.org/releases/11.1R/schedule.html" rel="nofollow">full schedule</a> for 11.1-RELEASE is here, the final release is expected at the end of July</li>
<li>It was also announced there will be a 10.4-RELEASE <a href="https://www.freebsd.org/releases/10.4R/schedule.html" rel="nofollow">scheduled for October</a>
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-tech&m=149732026405941&w=2" rel="nofollow">KARL – kernel address randomized link</a></h3>

<blockquote>
<p>Over the last three weeks I&#39;ve been working on a new randomization feature which will protect the kernel.<br>
The situation today is that many people install a kernel binary from OpenBSD, and then run that same kernel binary for 6 months or more. We have substantial randomization for the memory allocations made by the kernel, and for userland also of course.<br>
Previously, the kernel assembly language bootstrap/runtime locore.S was compiled and linked with all the other .c files of the kernel in a deterministic fashion. locore.o was always first, then the .c files order specified by our config(8) utility and some helper files.<br>
In the new world order, locore is split into two files: One chunk is bootstrap, that is left at the beginning. The assembly language runtime and all other files are linked in random fashion. There are some other pieces to try to improve the randomness of the layout.<br>
As a result, every new kernel is unique. The relative offsets between functions and data are unique.<br>
It still loads at the same location in KVA. This is not kernel ASLR! ASLR is a concept where the base address of a module is biased to a random location, for position-independent execution. In this case, the module itself is perturbed but it lands at the same location, and<br>
does not need to use position-independent execution modes.</p>
</blockquote>

<hr>

<h3><a href="https://blog.netbsd.org/tnf/entry/lldb_sanitizing_the_debugger_s" rel="nofollow">LLDB: Sanitizing the debugger&#39;s runtime</a></h3>

<ul>
<li>The good</li>
</ul>

<blockquote>
<p>Besides the greater enhancements this month I performed a cleanup in the ATF ptrace(2) tests again. Additionally I have managed to unbreak the LLDB Debug build and to eliminate compiler warnings in the NetBSD Native Process Plugin. It is worth noting that LLVM can run tests on NetBSD again, the patch in gtest/LLVM has been installed by Joerg Sonnenberg and a more generic one has been submitted to the upstream googletest repository. There was also an improvement in ftruncate(2) on the LLVM side (authored by Joerg).<br>
Since LLD (the LLVM linker) is advancing rapidly, it improved support for NetBSD and it can link a functional executable on NetBSD. I submitted a patch to stop crashing it on startup anymore. It was nearly used for linking LLDB/NetBSD and it spotted a real linking error... however there are further issues that need to be addressed in the future. Currently LLD is not part of the mainline LLDB tasks - it&#39;s part of improving the work environment. This linker should reduce the linking time - compared to GNU linkers - of LLDB by a factor of 3x-10x and save precious developer time. As of now LLDB linking can take minutes on a modern amd64 machine designed for performance.</p>
</blockquote>

<ul>
<li>Kernel correctness</li>
</ul>

<blockquote>
<p>I have researched (in pkgsrc-wip) initial support for multiple threads in the NetBSD Native Process Plugin. This code revealed - when running the LLDB regression test-suite - new kernel bugs. This unfortunately affects the usability of a debugger in a multithread environment in general and explains why GDB was never doing its job properly in such circumstances. One of the first errors was asserting kernel panic with PT_*STEP, when a debuggee has more than a single thread. I have narrowed it down to lock primitives misuse in the do_ptrace() kernel code. The fix has been committed.</p>
</blockquote>

<ul>
<li>The bad</li>
</ul>

<blockquote>
<p>Unfortunately this is not the full story and there is further mandatory work.<br>
LLDB acceleration<br>
The EV_SET() bug broke upstream LLDB over a month ago, and during this period the debugger was significantly accelerated and parallelized. It is difficult to declare it definitely, but it might be the reason why the tracer&#39;s runtime broke due to threading desynchronization. LLDB behaves differently when run standalone, under ktruss(1) and under gdb(1) - the shared bug is that it always fails in one way or another, which isn&#39;t trivial to debug.</p>
</blockquote>

<ul>
<li>The ugly</li>
</ul>

<blockquote>
<p>There are also unpleasant issues at the core of the Operating System.<br>
Kernel troubles<br>
Another bug with single-step functions that affects another aspect of correctness - this time with reliable execution of a program - is that processes die in non-deterministic ways when single-stepped. My current impression is that there is no appropriate translation between process and thread (LWP) states under a debugger. These issues are sibling problems to unreliable PT_RESUME and PT_SUSPEND.<br>
In order to be able to appropriately address this, I have diligently studied this month the Solaris Internals book to get a better image of the design of the NetBSD kernel multiprocessing, which was modeled after this commercial UNIX.</p>
</blockquote>

<ul>
<li>Plan for the next milestone</li>
</ul>

<blockquote>
<p>The current troubles can be summarized as data races in the kernel and at the same time in LLDB. I have decided to port the LLVM sanitizers, as I require the Thread Sanitizer (tsan). Temporarily I have removed the code for tracing processes with multiple threads to hide the known kernel bugs and focus on the LLDB races.<br>
Unfortunately LLDB is not easily bisectable (build time of the LLVM+Clang+LLDB stack, number of revisions), therefore the debugging has to be performed on the most recent code from upstream trunk.</p>
</blockquote>

<hr>

<h3>d2K17 Hackathon Reports</h3>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170605225415" rel="nofollow">d2k17 Hackathon Report: Ken Westerback on XS_NO_CCB removal and dhclient link detection</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170608074033" rel="nofollow">d2k17 Hackathon Report: Antoine Jacoutot on rc.d, syspatch, and more</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170609013548" rel="nofollow">d2k17 Hackathon Report: Florian Obser on slaacd(8)</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170602014048" rel="nofollow">d2k17 Hackathon Report: Stefan Sperling on USB audio, WiFi Progress</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://bsdrp.net/documentation/examples/multi-tenant_router_and_firewall" rel="nofollow">Multi-tenant router or firewall with FreeBSD</a></h3>

<ul>
<li>Setting-up a virtual lab</li>
<li>Downloading BSD Router Project images</li>
<li>Download BSDRP serial image (prevent to have to use an X display) on Sourceforge.</li>
<li>Download Lab scripts</li>
</ul>

<blockquote>
<p>More information on these BSDRP lab scripts available on <a href="https://bsdrp.net/documentation/examples/how_to_build_a_bsdrp_router_lab" rel="nofollow">How to build a BSDRP router lab</a>.</p>
</blockquote>

<ul>
<li>Start the lab with full-meshed 5 routers and one shared LAN, on this example using bhyve lab script on FreeBSD:</li>
</ul>

<p><code>[root@FreeBSD]~# tools/BSDRP-lab-bhyve.sh -i BSDRP-1.71-full-amd64-serial.img.xz -n 5 -l 1</code></p>

<ul>
<li><strong>Configuration</strong></li>
<li>Router 4 (R4) hosts the 3 routers/firewalls for each 3 customers.</li>
<li>Router 1 (R1) belongs to customer 1, router 2 (R2) to customer 2 and router 3 (R3) to customer 3.</li>
<li>Router 5 (R5) simulates a simple Internet host</li>
<li>Using pf firewall in place of ipfw</li>
</ul>

<blockquote>
<p>pf need a little more configuration because by default /dev/pf is hidden from jail. Then, on the host we need to:</p>
</blockquote>

<ul>
<li>In place of loading the ipfw/ipfw-nat modules we need to load the pf module (but still disabling pf on our host for this example)</li>
<li>Modify default devd rules for allowing jails to see /dev/pf (if you want to use tcpdump inside your jail, you should use bpf device too)</li>
<li>Replacing nojail tag by nojailvnet tag into /etc/rc.d/pf (<a href="https://github.com/ocochard/BSDRP/blob/master/BSDRP/patches/freebsd.pf.rc.jail.patch" rel="nofollow">already done into BSDRP</a>)</li>
<li>Under the hood: jails-on-nanobsd</li>
<li><a href="https://github.com/ocochard/BSDRP/blob/master/BSDRP/Files/usr/local/sbin/tenant" rel="nofollow">BSDRP&#39;s tenant shell script</a> creates jail configuration compliant with a host running nanobsd. Then these jails need to be configured for a nanobsd:</li>
<li>Being nullfs based for being hosted on a read-only root filesystem</li>
<li>Have their /etc and /var into tmpfs disks (then we need to populate these directory before each start)</li>
<li>Configuration changes need to be saved with nanobsd configuration tools, like “config save” on BSDRP</li>
<li>And on the host:</li>
<li><a href="https://github.com/ocochard/BSDRP/blob/master/BSDRP/Files/usr/local/sbin/autosave" rel="nofollow">autosave daemon</a> need to be enabled: Each time a customer will issue a “config save” inside a jail, his configuration diffs will be save into host&#39;s /etc/jails/. And this directory is a RAM disk too, then we need to automatically save hosts configuration on changes.
***</li>
</ul>

<h3><a href="https://blog.tintagel.pl/2017/06/09/openbsd-daily.html" rel="nofollow">OpenBSD Daily Source Reading</a></h3>

<ul>
<li>Adam Wołk writes:</li>
</ul>

<blockquote>
<p>I made a new year&#39;s resolution to read at least one C source file from OpenBSD daily. The goal was to both get better at C and to contribute more to the base system and userland development. I have to admit that initially I wasn’t consistent with it at all. In the first quarter of the year I read the code of a few small base utilities and nothing else. Still, every bit counts and it’s never too late to get better.<br>
Around the end of May, I really started reading code daily - no days skipped. It usually takes anywhere between ten minutes (for small base utils) and one and a half hour (for targeted reads). I’m pretty happy with the results so far. Exploring the system on a daily basis, looking up things in the code that I don’t understand and digging as deep as possible made me learn a lot more both about C and the system than I initially expected.<br>
There’s also one more side effect of reading code daily - diffs. It’s easy to spot inconsistencies, outdated code or an incorrect man page. This results in opportunities for contributing to the project. With time it also becomes less opportunitstic and more goal oriented. You might start with a [<a href="https://marc.info/?l=openbsd-tech&m=149591302814638&w=2%5D(drive" rel="nofollow">https://marc.info/?l=openbsd-tech&amp;m=149591302814638&amp;w=2](drive</a> by diff to kill) optional compilation of an old compatibility option in chown that has been compiled in by default since 1995.<br>
Soon the contributions become more targeted, for example using a new API for encrypting passwords in the htpasswd utility after reading the code of the utility and the code for htpasswd handling in httpd. Similarly it can take you from discussing a doas feature idea with a friend to implementing it after reading the code.<br>
I was having a lot of fun reading code daily and started to recommend it to people in general discussions. There was one particular twitter thread that ended up starting something new.<br>
This is still a new thing and the format is not yet solidified. Generally I make a lot of notes reading code, instead of slapping them inside a local file I drop the notes on the IRC channel as I go. Everyone on the channel is encouraged to do the same or share his notes in any way he/she seems feasable.</p>
</blockquote>

<ul>
<li>Check out the logs from the IRC discussions.</li>
<li>Start reading code from other BSD projects and see whether you can replicate their results!
***</li>
</ul>

<h3><a href="https://bsdmag.org/become-freebsd-user-find-useful-tools/" rel="nofollow">Become FreeBSD User: Find Useful Tools</a></h3>

<ul>
<li>BSD Mag has the following article by David Carlier:</li>
</ul>

<blockquote>
<p>If you’re usually programming on Linux and you consider a potential switch to FreeBSD, this article will give you an overview of the possibilities.</p>
</blockquote>

<ul>
<li>How to Install the Dependencies</li>
</ul>

<blockquote>
<p>FreeBSD comes with either applications from binary packages or compiled from sources (ports). They are arranged according to software types (programming languages mainly in lang (or java specifically for Java), libraries in devel, web servers in www …) and the main tool for modern FreeBSD versions is pkg, similar to Debian apt tools suite. Hence, most of the time if you are looking for a specific application/library, simply</p>

<p><code>pkg search &lt;name&gt;</code></p>

<p>without necessarily knowing the fully qualified name of the package. It is somehow sufficient. For example pkg search php7 will display php7 itself and the modules. Furthermore, php70 specific version and so on.</p>
</blockquote>

<ul>
<li>Web Development</li>
</ul>

<blockquote>
<p>Basically, this is the easiest area to migrate to. Most  Web languages do not use  specific platform features. Thus, most of the time, your existing projects might just be “drop-in” use cases.<br>
If your language of choice is PHP, you are lucky as this scripting language is workable on various operating systems, on most  Unixes and Windows. In the case of FreeBSD, you have even many different ports or binary package versions (5.6 to 7.1). In this case, you may need some specific PHP modules enabled, luckily they are available atomically, or if the port is the way you chose, it is via the www/php70-extensions’s one.<br>
Of course developing with Apache (both 2.2 and 2.4 series are available, respectively www/apache22 and www/apache24 packages), or even better with Nginx (the last stable or the latest development versions could be used, respectively www/nginx and www/nginx-devel packages) via php-fpm is possible.<br>
In terms of databases, we have the regular RDMBS like MySQL and PostgreSQL (client and server are distinct packages … databases/(mysql/portgresql)<version>-client, and databases/(mysql/postgresql)<version>-server). Additionally, a more modern concept of NoSQL with CouchDB, for example (databases/couchdb), MongoDB (databases/mongodb), and Cassandra (databases/cassandra), to name but a few.</p>
</blockquote>

<ul>
<li>Low-level Development</li>
</ul>

<blockquote>
<p>The BSDs are shipped with C and C++ compilers in the base. In the case of FreeBSD 11.0, it is clang 3.8.0 (in x86 architectures) otherwise, modern versions of gcc exist for developing with C++11. Examples are of course available too (lang/gcc<version> … until gcc 7.0 devel).<br>
Numerous libraries for various topics are also present, web services SOAP with gsoap through User Interfaces with GTK (x11-toolkits/gtk<version>), QT4 or QT 5 (devel/qt<version>), malware libraries with Yara (security/yara), etc.</p>
</blockquote>

<ul>
<li>Android / Mobile Development</li>
</ul>

<blockquote>
<p>To be able to do Android development, to a certain degree, the Linux’s compatibility layer (aka linuxulator) needs to be enabled. Also, x11-toolkits/swt and linux-f10-gtk2 port/package need to be installed (note that libswt-gtk-3550.so and libswt-pi-gtk-3550.so are necessary. The current package is versioned as 3557 and can be solved using symlinks). In the worst case scenario, remember that bhyve (or Virtualbox) is available, and can run any Linux distribution efficiently.</p>
</blockquote>

<ul>
<li>Source Control Management</li>
</ul>

<blockquote>
<p>FreeBSD comes in base with a version of subversion. As FreeBSD source is in a subversion repository, a prefixed svnlite command prevents conflicts with the package/port.<br>
Additionally, Git is present but via the package/port system with various options (with or without a user interface, subversion support).</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>FreeBSD has made tremendous improvements over the years to fill the gap created by Linux. FreeBSD still maintains its interesting specificities; hence there will not be too much blockers if your projects are reasonably sized to allow a migration to FreeBSD.</p>

<hr>
</blockquote>

<h3><a href="https://martin.kopta.eu/blog/#2017-06-11-16-07-26" rel="nofollow">Notes from project Aeronix, part 10</a></h3>

<ul>
<li>Prologue</li>
</ul>

<blockquote>
<p>It is almost two years since I finished building Aeronix and it has served me well during that time. Only thing that ever broke was Noctua CPU fan, which I have replaced with the same model. However, for long time, I wanted to run Aeronix on OpenBSD instead of GNU/Linux Debian.</p>
</blockquote>

<ul>
<li>Preparation</li>
</ul>

<blockquote>
<p>I first experimented with RAID1 OpenBSD setup in VirtualBox, plugging and unplugging drives and learned that OpenBSD RAID1 is really smooth. When I finally got the courage, I copied all the data on two drives outside of Aeronix. One external HDD I regulary use to backup Aeronix and second internal drive in my desktop computer. Copying the data took about two afternoons. Aeronix usually has higher temperatures (somewhere around 55°C or 65°C depending on time of the year), and when stressed, it can go really high (around 75°C). During full speed copy over NFS and to external drive it went as high as 85°C, which made me a bit nervous. After the data were copied, I temporarily un-configured computers on local network to not touch Aeronix, plugged keyboard, display and OpenBSD 6.1 thumb drive. Installing OpenBSD 6.1 on full disk RAID1 was super easy.</p>
</blockquote>

<ul>
<li>Configuring NFS</li>
</ul>

<blockquote>
<p>Aeronix serves primarily as NAS, which means NFS and SMB. NFS is used by computers in local network with persistent connection (via Ethernet). SMB is used by other devices in local network with volatile connection (via WiFi). When configuring NFS, I expected similar configuration to what I had in Debian, but on OpenBSD, it is very different. However, after reading through exports(5), it was really easy to put it together.</p>
</blockquote>

<ul>
<li>Putting the data back</li>
</ul>

<blockquote>
<p>Copying from the external drive took few days, since the transfer speed was something around 5MB/s. I didn&#39;t really mind. It was sort of a good thing, because Aeronix wasn&#39;t overheating that way. I guess I need to figure new backup strategy though.<br>
One interesting thing happened with one of my local desktops. It was connecting Aeronix with default NFS mount options (on Archlinux) and had really big troubles with reading anything. Basically it behaved as if the network drive had horrible access times. After changing the default mount options, it started working perfectly.</p>
</blockquote>

<ul>
<li>Conclusion</li>
</ul>

<blockquote>
<p>Migrating to OpenBSD was way easier than I anticipated. There are various benefits like more security, realiable RAID1 setup (which I know how will work when drive dies), better documentation and much more. However, the true benefit for me is just the fact I like OpenBSD and makes me happy to have one more OpenBSD machine. On to the next two years of service!</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170609121413&mode=expanded&count=0" rel="nofollow">Running OpenBSD on Azure</a></li>
<li><a href="https://github.com/skoef/mondieu" rel="nofollow">Mondieu - portable alternative for freebsd-update</a></li>
<li><a href="https://bitbucket.org/forsyth/plan9-9k" rel="nofollow">Plan9-9k: 64-bit Plan 9</a></li>
<li><a href="http://sohcahtoa.org.uk/openbsd.html" rel="nofollow">Installing OpenBSD 6.1 on your laptop is really hard (not)</a></li>
<li><a href="http://www.ubuntubsd.org/" rel="nofollow">UbuntuBSD is dead</a></li>
<li><a href="https://opnsense.org/opnsense-17-1-8-released/" rel="nofollow">OPNsense 17.1.8 released</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2DKXA0T#wrap" rel="nofollow">Patrick - Operating System Textbooks</a></li>
<li><a href="http://dpaste.com/3CJGW22#wrap" rel="nofollow">Brian - snapshot retention</a></li>
<li><a href="http://dpaste.com/2X3X6NR#wrap" rel="nofollow">Randy - FreeNAS to FreeBSD</a></li>
<li><a href="http://dpaste.com/1AE2SPS#wrap" rel="nofollow">Florian - Bootloader Resolution</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>198: BSDNorth or You can’t handle the libtruth</title>
  <link>https://www.bsdnow.tv/198</link>
  <guid isPermaLink="false">0123153a-507e-46d5-b7d3-59fef8b731ae</guid>
  <pubDate>Wed, 14 Jun 2017 11:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0123153a-507e-46d5-b7d3-59fef8b731ae.mp3" length="96556756" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This episode gives you the full dose of BSDCan 2017 recap as well as a blog post on conference speaking advice.</itunes:subtitle>
  <itunes:duration>2:14:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This episode gives you the full dose of BSDCan 2017 recap as well as a blog post on conference speaking advice.
Headlines
Pre-conference activities: Goat BoF, FreeBSD Foundation Board Meeting, and FreeBSD Journal Editorial Board Meeting
The FreeBSD Foundation has a new President as Justin Gibbs is busy this year with building a house, so George Neville-Neil took up the task to serve as President, with Justin Gibbs as Secretary. Take a look at the updated Board of Directors (https://www.freebsdfoundation.org/about/board-of-directors/).  
We also have a new staff member (https://www.freebsdfoundation.org/about/staff/): Scott Lamons joined the Foundation team as senior program manager.
Scott’s work for the Foundation will focus on managing and evangelizing programs for advanced technologies in FreeBSD including preparing project plans, coordinating resources, and facilitating interactions between commercial vendors, the Foundation, and the FreeBSD community.
The Foundation also planned various future activities, visits of upcoming conferences, and finding new ways to support and engage the community.
The Foundation now has interns in the form of co-op students from the University of Waterloo, Canada. This is described further in the May 2017 Development Projects Update (https://www.freebsdfoundation.org/blog/may-2017-development-projects-update/). Both students (Siva and Charlie) were also the conference, helping out at the Foundation table, demonstrating the tinderbox dashboard. Follow the detailed instructions (https://www.freebsdfoundation.org/news-and-events/blog/blog-post/building-a-physical-freebsd-build-status-dashboard/) to build one of your own.
The Foundation put out a call for Project Proposal Solicitation for 2017 (https://www.freebsdfoundation.org/blog/freebsd-foundation-2017-project-proposal-solicitation/). If you think you have a good proposal for work relating to any of the major subsystems or infrastructure for FreeBSD, we’d be happy to review it.
Don’t miss the deadlines for travel grants to some of the upcoming conferences. You can find the necessary forms and deadlines at the Travel Grant page (https://www.freebsdfoundation.org/what-we-do/travel-grants/travel-grants/) on the Foundation website.
Pictures from the Goat BoF can be found on Keltia.net (https://assets.keltia.net/photos/BSDCan-2017/Royal%20Oak/index.html)
Overlapping with the GoatBoF, members of the FreeBSD Journal editorial board met in a conference room in the Novotel to plan the upcoming issues. Topics were found, authors identified, and new content was discussed to appeal to even more readers. Check out the FreeBSD Journal website (https://www.freebsdfoundation.org/journal/) and subscribe if you like to support the Foundation in that way.
FreeBSD Devsummit Day 1 &amp;amp; 2 (https://wiki.freebsd.org/DevSummit/201706)
The first day of the Devsummit began with introductory slides by Gordon Tetlow, who organized the devsummit very well.
Benno Rice of the FreeBSD core team presented the work done on the new Code of Conduct, which will become effective soon. A round of Q&amp;amp;A followed, with positive feedback from the other devsummit attendees supporting the new CoC.
After that, Allan Jude joined to talk about the new FreeBSD Community Proposal (FCP) (https://github.com/freebsd/fcp) process. Modelled after IETF RFCs, Joyent RFDs, and Python PEP, it is a new way for the project to reach consensus on the design or implementation of new features or processes. The FCP repo contains FCP#0 that describes the process, and a template for writing a proposal.
Then, the entire core team (except John Baldwin, who could not make it this year) and core secretary held a core Q&amp;amp;A session, Answering questions, gathering feedback and suggestions.  
After the coffee break, we had a presentation about Intel’s QAT integration in FreeBSD.
When the lunch was over, people spread out into working groups about BearSSL, Transport (TCP/IP), and OpenZFS.
OpenZFS working group (https://pbs.twimg.com/media/DBu_IMsWAAId2sN.jpg:large):
Matt Ahrens lead the group, and spent most of the first session providing a status update about what features have been recently committed, are out for review, on the horizon, or in the design phase.
Existing Features
Compressed ARC
Compressed Send/Recv
Recently Upstreamed
A recent commit improved RAID-Z write speeds by declaring writes to padding blocks to be optional, and to always write them if they can be aggregated with the next write. Mostly impacts large record sizes.
ABD (ARC buffer scatter/gather)
Upstreaming In Progress
Native Encryption
Channel Programs
Device Removal (Mirrors and Stripes)
Redacted Send/recv
Native TRIM Support (FreeBSD has its own, but this is better and applies to all ZFS implementations)
Faster (mostly sequential) scrub/resilver
DRAID (A great deal of time was spent explaining how this works, with diagrams on the chalk board)
vdev metadata classes (store metadata on SSDs with data is on HDDs, or similar setups. Could also be modified to do dedup to SSD)
Multi-mount protection (“safe import”, for dual-headed storage shelves)
zpool checkpoint (rollback an entire pool, including zfs rename and zfs destroy)
Further Out
Import improvements
Import with missing top-level vdevs (some blocks unreadable, but might let you get some data)
Improved allocator performance -- vdev spacemap log
ZIL performance
Persistent L2ARC
ZSTD Compression
Day 2
Day two started with the Have/Want/Need session for FreeBSD 12.0. A number of features that various people have or are in the process of building, were discussed with an eye towards upstreaming them. Features we want to have in time for 12.0 (early 2019) were also discussed.
After the break was the Vendor summit, which continued the discussion of how FreeBSD and its vendors can work together to make a better operating system, and better products based on it
After lunch, the group broke up into various working groups: Testing/CI, Containers, Hardening UFS, and GELI Improvements
Allan lead the GELI Improvements session. The main thrust of the discussions was fixing an outstanding bug in GELI when using both key slots with passphrases. To solve this, and make GELI more extensible, the metadata format will be extended to allow it to store more than 512 bytes of data (currently 511 bytes are used).
The new format will allow arbitrarily large metadata, defined at creation time by selecting the number of user key slots desired.
The new extended metadata format will contain mostly the same fields, except the userkey will no longer be a byte array of IV-key, Data-key, HMAC, but a struct that will contain all data about that key
This new format will store the number of pkcs5v2 iterations per key, instead of only having a single location to store this number for all keys (the source of the original bug)
A new set of flags per key, to control some aspects of the key (does it require a keyfile, etc), as well as possibly the role of the key.
An auxdata field related to the flags, this would allow a specific key with a specific flag set, to boot a different partition, rather than decrypt the main partition.
A URI to external key material is also stored per key, allowing GELI to uniquely identify the correct data to load to be able to use a specific decryption key
And the three original parts of the key are stored in separate fields now. The HMAC also has a type field, allowing for a different HMAC algorithm to be used in the future.
The main metadata is also extended to include a field to store the number of user keys, and to provide an overall HMAC of the metadata, so that it can be verified using the master key (provide any of the user keys)
Other topics discussed:
Ken Merry presented sedutil, a tool for managing Self Encrypting Drives, as may be required by certain governments and other specific use cases.
Creating a deniable version of GELI, where the metadata is also encrypted
The work to implemented GELI in the UEFI loader was discussed, and a number of developers volunteered to review and test the code
Following the end of the Dev Summit, the “Newcomers orientation and mentorship” session was run by Michael W. Lucas, which attempts to pair up first time attendees with oldtimers, to make sure they always know a few people they can ask if they have questions, or if they need help getting introduced to the right people.
News Roundup
Conference Day 1 (http://www.bsdcan.org/2017/schedule/day_2017-06-09.en.html)
The conference opened with some short remarks from Dan Langille, and then the opening keynote by Dr Michael Geist, a law professor at the University of Ottawa where he holds the Canada Research Chair in Internet and E-commerce Law. The keynote focused on what some of the currently issues are, and how the technical community needs to get involved at all levels. In Canada especially, contacting your representatives is quite effective, and when it does not happen, they only hear the other side of the story, and often end up spouting talking points from lobbyists as if they were facts.
The question period for the keynote ran well overtime because of the number of good questions the discussion raised, including how do we fight back against large telcos with teams of lawyers and piles of money.
Then the four tracks of talks started up for the day
The day wrapped up with the Work In Progress (WIP) session.
Allan Jude presented work on ZSTD compression in ZFS
Drew Gallatin presented about work at Netflix on larger mbufs, to avoid the need for chaining and to allow more data to be pushed at once. Results in an 8% CPU time reduction when pushing 90 gbps of TLS encrypted traffic
Dan Langille presented about letsencrypt (the acme.sh tool specifically), and bacula
Samy Al Bahra presented about Concurrency Kit
***
Conference Day 2 (http://www.bsdcan.org/2017/schedule/day_2017-06-10.en.html)
Because Dan is a merciful soul, BSDCan starts an hour later on the second day
Another great round of talks and BoF sessions over lunch
The hallway track was great as always, and I spent most of the afternoon just talking with people
Then the final set of talks started, and I was torn between all four of them
Then there was the auction, and the closing party
***
BSDCan 2017 Auction Swag (https://blather.michaelwlucas.com/archives/2962)
Groff Fundraiser Pins: During the conference, You could get a unique Groff pin, by donating more than the last person to either the FreeBSD or OpenBSD foundation
Michael W. Lucas and his wife Liz donated some interesting home made and local items to the infamous Charity Auction
I donated the last remaining copy of the “Canadian Edition” of “FreeBSD Mastery: Advanced ZedFS”, and a Pentium G4400 (Skylake) CPU (Supports ECC or non-ECC)
Peter Hessler donated his pen (Have you read “Git Commit Murder” yet?)
Theo De Raadt donated his autographed conference badge
David Maxwell donated a large print of the group photo from last years FreeBSD Developers Summit, which was purchased by Allan
There was also a FreeBSD Dev Summit T-Shirt (with the Slogan: What is Core doing about it?) autographed by all of the attending members of core, with a forged jhb@ signature.
Lastly, someone wrote “I &amp;lt;3 FreeBSD” on a left over conference t-shirt with magic marker, and the bidding began to make OpenBSD developer Henning Brauer wear it to the closing party. The top bid was $150 by Kristof Provost, the FreeBSD pf maintainer.
***
Henning Brauer loves FreeBSD (https://twitter.com/henningBrauer)
In addition to the $150 donation that resulted in Henning wearing the I love FreeBSD t-shirt, he also took selfies with people in exchange for an additional donation of $10. A total of over $500 was raised.
Michael W. Lucas (https://twitter.com/mwlauthor/status/874656462433386497)
Michael Dexter (https://twitter.com/michaeldexter/status/874344686885904384)
FreeBSD Foundation Interns + Ed Maste + Eric Joyner (https://twitter.com/yzgyyang/status/873714734343880705)
Pierre Ponchery (https://twitter.com/khorben/status/873673295903825925)
Nick Danger  (https://twitter.com/niqdanger/status/873697176513380353)
Michael Shirk  (https://twitter.com/shirkdog/status/873687910175866881)
Calvin Hendryx-Parker (https://twitter.com/calvinhp/status/873686591692255233)
Reyk Floeter (https://twitter.com/reykfloeter/status/873673717884346368)
Rod Grimes (https://twitter.com/akpoff/status/873673432751370240)
Jim Thompson (https://twitter.com/gonzopancho/status/873700951651233792)
Sean Chittenden and Sam Gwydir, Henning wearing Theo de Raadt’s badge (https://twitter.com/SeanChittenden/status/873750297113501697)
David Duncan (https://twitter.com/davdunc/status/873807305162334208)
***
libtrue (https://github.com/libtrue/libtrue)
At the hacker lounge, a joke email was sent to the FreeBSD developers list, making it look like a change to true(1)’s manpage had been committed to “document that true(1) supports libxo”
While the change was not actually made, as you might expect this started a discussion about if this was really necessary.
This spawned a new github repo
While this all started as a joke, it then became an example of how rapid collaboration can happen, and an example of implementing a number of modern technologies in FreeBSD, including libxo (json output), and capsicum (security sandboxing)
The project has an large number of open issues and enhancement suggestions, and a number of active pull requests including:
Add Vagrantfile and Ansible playbooks for VM
DTrace Support (Add the trueprov provider to allow tracing of true.
A Code of Conduct
libtrue.xyz website as a git submodule
a false binary
Python and Go bindings
***
On Conference Speaking (https://hynek.me/articles/speaking/)
Phase 1: Idea
Until now I’ve never had to sit down and ponder what I could speak about. Over the year, I run into at least one topic I know something about that appears to be interesting to the wider public. I’m positive that’s true for almost anyone if they keep their minds open and keep looking for it.
Phase 2: Call for Proposals
In the end I have to come up with a good pitch that speaks to as many people as possible and with a speculative outline. Since there are always many more submissions than talk slots, this is the first critical point. There are many reasons why a proposal can be refused, so put effort into not giving the program committee any additional, that are entirely avoidable.
Phase 3: Waiting for the CFP Result
...do passive research: if I see something relevant, I add it to my mind map. At this point my mind map looks atypical though: it has a lot of unordered root nodes. I just throw in everything that looks interesting and add some of my own thoughts to it. In the case of the reliability topic, I spend a lot of time to stay on top it anyway so a lot of material emerged.
Phase 4: The Road to an Outline
Once the talk is accepted, research intensifies. Books and articles I’ve written down for further research are read and topics extracted. In 2017, this started on January 23. But before I start writing, I get the mind map into a shape that makes sense and that will support me. This is the second critical point: I have to come up with a compelling story using the material I’ve collected. Just enumerating facts and wisdom a good talk doesn’t make. It has to have a good flow that makes sense and that keeps people engaged.
Phase 5: Slides
I have a very strong opinion on slides: use few, big words. Don’t make people read your slides unless it’s code samples. Otherwise they’ll be distracted from what you say. You’ll see me rarely use fonts smaller than 100pt (code ~40–60pt) which is readable from everywhere and forces me to be as brief as possible.
Phase 6: Polishing
I firmly believe that this phase makes or breaks a talk. Only by practicing again and again you’ll notice rough spots, weak transitions, and redundancies. Each iteration makes the talk a bit better both regarding the slides and my ability to present it. Each iteration adds impressions that my subconscious mind chews on and makes things fall in place and give me inspiration in unlikely moments.
Phase 7: Sneak Preview
In the past years I was blessed with the opportunity to test my talks in front of a smaller audiences. Interestingly, I’ve come to take smaller events more seriously than the big ones. If a small conference pays for my travels and gives me a prominent slot, I have both more responsibility and attention than if I paid my way to an event where I’m one of many speakers.
Phase 8: Refinement and More Polishing
The first session is always just going through all slides, reacquainting myself with my deck. Then it always takes quite a bit of willpower until I do a full practice run again: the first time always pretty brutal because I tend to forget pretty fast. On the other hand, it rather quickly comes back too. Which makes it even harder to motivate myself to start. Ideally I’d have access to a video recording from phase 7 to have a closer look at what work could be improved. But since it’s usually smaller conferences, I don’t.
Phase 9: Travel
Whenever I travel to conferences I bring everything I need for my talk and then some. To make sure I don’t forget anything essential, I have a packing list for my business trips (and vacations too – the differences are so minimal that I use a unified list). My epic packing list for business trips. I print it out the day before departure and cross stuff off as I pack. I highly recommend to anyone to emulate this since packing is a lot less stressful if you just follow a checklist.
Phase 10: Showtime!
So this is it. The moment everything else led to. People who suffer from fear of public speaking think this is the worst part. But if you scroll back you’ll realize: this is the payoff! This is what you worked toward. This is the fun, easy part. Once you stand in front of the audience, the work is done and you get to enjoy the ride.
Beastie Bits
Kris and Ken Moore - TrueOS Q&amp;amp;A (https://www.trueos.org/blog/discourse-trueos-qa-61617/)
New home for the repository conversions (NetBSD Git mirror is now on GitHub.com/NetBSD) (https://mail-index.netbsd.org/tech-repository/2017/06/10/msg000637.html)
Tab completion in OpenBSD's ksh (https://deftly.net/posts/2017-05-01-openbsd-ksh-tab-complete.html)
pkgsrcCon July 1&amp;amp;2 (http://pkgsrc.org/pkgsrcCon/2017/)
OpenBSD 6.1 syspatch installed SP kernel on MP system (https://www.mail-archive.com/misc@openbsd.org/msg153421.html)
KNOXBug meeting this Friday (http://knoxbug.org/content/join-us-freebsd-day)
***
Feedback/Questions
Rob - FreeNAS Corral (http://dpaste.com/2XEE9JA#wrap)
Brad - ZFS snapshot strategy (http://dpaste.com/27GSJK0#wrap)
Phil - ZFS Send via Snail Mail (http://dpaste.com/3D02RYZ#wrap)
Phillip - Network Limits for Public NTP Server (http://dpaste.com/0ZSMVWH#wrap)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This episode gives you the full dose of BSDCan 2017 recap as well as a blog post on conference speaking advice.</p>

<h2>Headlines</h2>

<h3>Pre-conference activities: Goat BoF, FreeBSD Foundation Board Meeting, and FreeBSD Journal Editorial Board Meeting</h3>

<ul>
<li>The FreeBSD Foundation has a new President as Justin Gibbs is busy this year with building a house, so George Neville-Neil took up the task to serve as President, with Justin Gibbs as Secretary. Take a look at the updated <a href="https://www.freebsdfoundation.org/about/board-of-directors/" rel="nofollow">Board of Directors</a>.<br></li>
<li>We also have a new <a href="https://www.freebsdfoundation.org/about/staff/" rel="nofollow">staff member</a>: Scott Lamons joined the Foundation team as senior program manager.</li>
</ul>

<blockquote>
<p>Scott’s work for the Foundation will focus on managing and evangelizing programs for advanced technologies in FreeBSD including preparing project plans, coordinating resources, and facilitating interactions between commercial vendors, the Foundation, and the FreeBSD community.</p>
</blockquote>

<ul>
<li>The Foundation also planned various future activities, visits of upcoming conferences, and finding new ways to support and engage the community.</li>
<li>The Foundation now has interns in the form of co-op students from the University of Waterloo, Canada. This is described further in the <a href="https://www.freebsdfoundation.org/blog/may-2017-development-projects-update/" rel="nofollow">May 2017 Development Projects Update</a>. Both students (Siva and Charlie) were also the conference, helping out at the Foundation table, demonstrating the tinderbox dashboard. Follow the <a href="https://www.freebsdfoundation.org/news-and-events/blog/blog-post/building-a-physical-freebsd-build-status-dashboard/" rel="nofollow">detailed instructions</a> to build one of your own.</li>
<li>The Foundation put out a <a href="https://www.freebsdfoundation.org/blog/freebsd-foundation-2017-project-proposal-solicitation/" rel="nofollow">call for Project Proposal Solicitation for 2017</a>. If you think you have a good proposal for work relating to any of the major subsystems or infrastructure for FreeBSD, we’d be happy to review it.</li>
<li><p>Don’t miss the deadlines for travel grants to some of the upcoming conferences. You can find the necessary forms and deadlines at the <a href="https://www.freebsdfoundation.org/what-we-do/travel-grants/travel-grants/" rel="nofollow">Travel Grant page</a> on the Foundation website.</p></li>
<li><p>Pictures from the Goat BoF can be found on <a href="https://assets.keltia.net/photos/BSDCan-2017/Royal%20Oak/index.html" rel="nofollow">Keltia.net</a></p></li>
<li><p>Overlapping with the GoatBoF, members of the FreeBSD Journal editorial board met in a conference room in the Novotel to plan the upcoming issues. Topics were found, authors identified, and new content was discussed to appeal to even more readers. Check out the <a href="https://www.freebsdfoundation.org/journal/" rel="nofollow">FreeBSD Journal website</a> and subscribe if you like to support the Foundation in that way.</p>

<hr></li>
</ul>

<h3><a href="https://wiki.freebsd.org/DevSummit/201706" rel="nofollow">FreeBSD Devsummit Day 1 &amp; 2</a></h3>

<ul>
<li>The first day of the Devsummit began with introductory slides by Gordon Tetlow, who organized the devsummit very well.</li>
<li>Benno Rice of the FreeBSD core team presented the work done on the new Code of Conduct, which will become effective soon. A round of Q&amp;A followed, with positive feedback from the other devsummit attendees supporting the new CoC.</li>
<li>After that, Allan Jude joined to talk about the new <a href="https://github.com/freebsd/fcp" rel="nofollow">FreeBSD Community Proposal (FCP)</a> process. Modelled after IETF RFCs, Joyent RFDs, and Python PEP, it is a new way for the project to reach consensus on the design or implementation of new features or processes. The FCP repo contains FCP#0 that describes the process, and a template for writing a proposal.</li>
<li>Then, the entire core team (except John Baldwin, who could not make it this year) and core secretary held a core Q&amp;A session, Answering questions, gathering feedback and suggestions.<br></li>
<li>After the coffee break, we had a presentation about Intel’s QAT integration in FreeBSD.</li>
<li>When the lunch was over, people spread out into working groups about BearSSL, Transport (TCP/IP), and OpenZFS.</li>
<li><a href="https://pbs.twimg.com/media/DBu_IMsWAAId2sN.jpg:large" rel="nofollow">OpenZFS working group</a>:

<ul>
<li>Matt Ahrens lead the group, and spent most of the first session providing a status update about what features have been recently committed, are out for review, on the horizon, or in the design phase.</li>
</ul></li>
<li><strong>Existing Features</strong>

<ul>
<li>Compressed ARC</li>
<li>Compressed Send/Recv</li>
<li><strong>Recently Upstreamed</strong></li>
<li>A recent commit improved RAID-Z write speeds by declaring writes to padding blocks to be optional, and to always write them if they can be aggregated with the next write. Mostly impacts large record sizes.</li>
<li>ABD (ARC buffer scatter/gather)</li>
</ul></li>
<li><strong>Upstreaming In Progress</strong>

<ul>
<li>Native Encryption</li>
<li>Channel Programs</li>
<li>Device Removal (Mirrors and Stripes)</li>
<li>Redacted Send/recv</li>
<li>Native TRIM Support (FreeBSD has its own, but this is better and applies to all ZFS implementations)</li>
<li>Faster (mostly sequential) scrub/resilver</li>
<li>DRAID (A great deal of time was spent explaining how this works, with diagrams on the chalk board)</li>
<li>vdev metadata classes (store metadata on SSDs with data is on HDDs, or similar setups. Could also be modified to do dedup to SSD)</li>
<li>Multi-mount protection (“safe import”, for dual-headed storage shelves)</li>
<li>zpool checkpoint (rollback an entire pool, including zfs rename and zfs destroy)</li>
</ul></li>
<li><strong>Further Out</strong>

<ul>
<li>Import improvements</li>
<li>Import with missing top-level vdevs (some blocks unreadable, but might let you get some data)</li>
<li>Improved allocator performance -- vdev spacemap log</li>
<li>ZIL performance</li>
<li>Persistent L2ARC</li>
<li>ZSTD Compression</li>
</ul></li>
<li>Day 2

<ul>
<li>Day two started with the Have/Want/Need session for FreeBSD 12.0. A number of features that various people have or are in the process of building, were discussed with an eye towards upstreaming them. Features we want to have in time for 12.0 (early 2019) were also discussed.</li>
<li>After the break was the Vendor summit, which continued the discussion of how FreeBSD and its vendors can work together to make a better operating system, and better products based on it</li>
<li>After lunch, the group broke up into various working groups: Testing/CI, Containers, Hardening UFS, and GELI Improvements</li>
<li>Allan lead the GELI Improvements session. The main thrust of the discussions was fixing an outstanding bug in GELI when using both key slots with passphrases. To solve this, and make GELI more extensible, the metadata format will be extended to allow it to store more than 512 bytes of data (currently 511 bytes are used).</li>
<li>The new format will allow arbitrarily large metadata, defined at creation time by selecting the number of user key slots desired.</li>
<li>The new extended metadata format will contain mostly the same fields, except the userkey will no longer be a byte array of IV-key, Data-key, HMAC, but a struct that will contain all data about that key</li>
<li>This new format will store the number of pkcs5v2 iterations per key, instead of only having a single location to store this number for all keys (the source of the original bug)</li>
<li>A new set of flags per key, to control some aspects of the key (does it require a keyfile, etc), as well as possibly the role of the key.</li>
<li>An auxdata field related to the flags, this would allow a specific key with a specific flag set, to boot a different partition, rather than decrypt the main partition.</li>
<li>A URI to external key material is also stored per key, allowing GELI to uniquely identify the correct data to load to be able to use a specific decryption key</li>
<li>And the three original parts of the key are stored in separate fields now. The HMAC also has a type field, allowing for a different HMAC algorithm to be used in the future.</li>
<li>The main metadata is also extended to include a field to store the number of user keys, and to provide an overall HMAC of the metadata, so that it can be verified using the master key (provide any of the user keys)</li>
</ul></li>
<li><p>Other topics discussed:</p>

<ul>
<li>Ken Merry presented sedutil, a tool for managing Self Encrypting Drives, as may be required by certain governments and other specific use cases.</li>
<li>Creating a deniable version of GELI, where the metadata is also encrypted</li>
<li>The work to implemented GELI in the UEFI loader was discussed, and a number of developers volunteered to review and test the code</li>
</ul></li>
<li><p>Following the end of the Dev Summit, the “Newcomers orientation and mentorship” session was run by Michael W. Lucas, which attempts to pair up first time attendees with oldtimers, to make sure they always know a few people they can ask if they have questions, or if they need help getting introduced to the right people.</p>

<hr></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.bsdcan.org/2017/schedule/day_2017-06-09.en.html" rel="nofollow">Conference Day 1</a></h3>

<ul>
<li>The conference opened with some short remarks from Dan Langille, and then the opening keynote by Dr Michael Geist, a law professor at the University of Ottawa where he holds the Canada Research Chair in Internet and E-commerce Law. The keynote focused on what some of the currently issues are, and how the technical community needs to get involved at all levels. In Canada especially, contacting your representatives is quite effective, and when it does not happen, they only hear the other side of the story, and often end up spouting talking points from lobbyists as if they were facts.</li>
<li>The question period for the keynote ran well overtime because of the number of good questions the discussion raised, including how do we fight back against large telcos with teams of lawyers and piles of money.</li>
<li>Then the four tracks of talks started up for the day</li>
<li>The day wrapped up with the Work In Progress (WIP) session.

<ul>
<li>Allan Jude presented work on ZSTD compression in ZFS</li>
<li>Drew Gallatin presented about work at Netflix on larger mbufs, to avoid the need for chaining and to allow more data to be pushed at once. Results in an 8% CPU time reduction when pushing 90 gbps of TLS encrypted traffic</li>
<li>Dan Langille presented about letsencrypt (the acme.sh tool specifically), and bacula</li>
<li>Samy Al Bahra presented about Concurrency Kit
***</li>
</ul></li>
</ul>

<h3><a href="http://www.bsdcan.org/2017/schedule/day_2017-06-10.en.html" rel="nofollow">Conference Day 2</a></h3>

<ul>
<li>Because Dan is a merciful soul, BSDCan starts an hour later on the second day</li>
<li>Another great round of talks and BoF sessions over lunch</li>
<li>The hallway track was great as always, and I spent most of the afternoon just talking with people</li>
<li>Then the final set of talks started, and I was torn between all four of them</li>
<li>Then there was the auction, and the closing party
***</li>
</ul>

<h3><a href="https://blather.michaelwlucas.com/archives/2962" rel="nofollow">BSDCan 2017 Auction Swag</a></h3>

<ul>
<li>Groff Fundraiser Pins: During the conference, You could get a unique Groff pin, by donating more than the last person to either the FreeBSD or OpenBSD foundation</li>
<li>Michael W. Lucas and his wife Liz donated some interesting home made and local items to the infamous Charity Auction</li>
<li>I donated the last remaining copy of the “Canadian Edition” of “FreeBSD Mastery: Advanced ZedFS”, and a Pentium G4400 (Skylake) CPU (Supports ECC or non-ECC)</li>
<li>Peter Hessler donated his pen (Have you read “Git Commit Murder” yet?)</li>
<li>Theo De Raadt donated his autographed conference badge</li>
<li>David Maxwell donated a large print of the group photo from last years FreeBSD Developers Summit, which was purchased by Allan</li>
<li>There was also a FreeBSD Dev Summit T-Shirt (with the Slogan: What is Core doing about it?) autographed by all of the attending members of core, with a forged jhb@ signature.</li>
<li>Lastly, someone wrote “I &lt;3 FreeBSD” on a left over conference t-shirt with magic marker, and the bidding began to make OpenBSD developer Henning Brauer wear it to the closing party. The top bid was $150 by Kristof Provost, the FreeBSD pf maintainer.
***</li>
</ul>

<h3><a href="https://twitter.com/henningBrauer" rel="nofollow">Henning Brauer loves FreeBSD</a></h3>

<ul>
<li>In addition to the $150 donation that resulted in Henning wearing the I love FreeBSD t-shirt, he also took selfies with people in exchange for an additional donation of $10. A total of over $500 was raised.</li>
<li><a href="https://twitter.com/mwlauthor/status/874656462433386497" rel="nofollow">Michael W. Lucas</a></li>
<li><a href="https://twitter.com/michaeldexter/status/874344686885904384" rel="nofollow">Michael Dexter</a></li>
<li><a href="https://twitter.com/yzgyyang/status/873714734343880705" rel="nofollow">FreeBSD Foundation Interns + Ed Maste + Eric Joyner</a></li>
<li><a href="https://twitter.com/khorben/status/873673295903825925" rel="nofollow">Pierre Ponchery</a></li>
<li><a href="https://twitter.com/niqdanger/status/873697176513380353" rel="nofollow">Nick Danger </a></li>
<li><a href="https://twitter.com/shirkdog/status/873687910175866881" rel="nofollow">Michael Shirk </a></li>
<li><a href="https://twitter.com/calvinhp/status/873686591692255233" rel="nofollow">Calvin Hendryx-Parker</a></li>
<li><a href="https://twitter.com/reykfloeter/status/873673717884346368" rel="nofollow">Reyk Floeter</a></li>
<li><a href="https://twitter.com/akpoff/status/873673432751370240" rel="nofollow">Rod Grimes</a></li>
<li><a href="https://twitter.com/gonzopancho/status/873700951651233792" rel="nofollow">Jim Thompson</a></li>
<li><a href="https://twitter.com/SeanChittenden/status/873750297113501697" rel="nofollow">Sean Chittenden and Sam Gwydir, Henning wearing Theo de Raadt’s badge</a></li>
<li><a href="https://twitter.com/davdunc/status/873807305162334208" rel="nofollow">David Duncan</a>
***</li>
</ul>

<h3><a href="https://github.com/libtrue/libtrue" rel="nofollow">libtrue</a></h3>

<ul>
<li>At the hacker lounge, a joke email was sent to the FreeBSD developers list, making it look like a change to true(1)’s manpage had been committed to “document that true(1) supports libxo”</li>
<li>While the change was not actually made, as you might expect this started a discussion about if this was really necessary.</li>
<li>This spawned a new github repo</li>
<li>While this all started as a joke, it then became an example of how rapid collaboration can happen, and an example of implementing a number of modern technologies in FreeBSD, including libxo (json output), and capsicum (security sandboxing)</li>
<li>The project has an large number of open issues and enhancement suggestions, and a number of active pull requests including:

<ul>
<li>Add Vagrantfile and Ansible playbooks for VM</li>
<li>DTrace Support (Add the trueprov provider to allow tracing of true.</li>
<li>A Code of Conduct</li>
<li>libtrue.xyz website as a git submodule</li>
<li>a false binary</li>
<li>Python and Go bindings
***</li>
</ul></li>
</ul>

<h3><a href="https://hynek.me/articles/speaking/" rel="nofollow">On Conference Speaking</a></h3>

<ul>
<li>Phase 1: Idea</li>
</ul>

<blockquote>
<p>Until now I’ve never had to sit down and ponder what I could speak about. Over the year, I run into at least one topic I know something about that appears to be interesting to the wider public. I’m positive that’s true for almost anyone if they keep their minds open and keep looking for it.</p>
</blockquote>

<ul>
<li>Phase 2: Call for Proposals</li>
</ul>

<blockquote>
<p>In the end I have to come up with a good pitch that speaks to as many people as possible and with a speculative outline. Since there are always many more submissions than talk slots, this is the first critical point. There are many reasons why a proposal can be refused, so put effort into not giving the program committee any additional, that are entirely avoidable.</p>
</blockquote>

<ul>
<li>Phase 3: Waiting for the CFP Result</li>
</ul>

<blockquote>
<p>...do passive research: if I see something relevant, I add it to my mind map. At this point my mind map looks atypical though: it has a lot of unordered root nodes. I just throw in everything that looks interesting and add some of my own thoughts to it. In the case of the reliability topic, I spend a lot of time to stay on top it anyway so a lot of material emerged.</p>
</blockquote>

<ul>
<li>Phase 4: The Road to an Outline</li>
</ul>

<blockquote>
<p>Once the talk is accepted, research intensifies. Books and articles I’ve written down for further research are read and topics extracted. In 2017, this started on January 23. But before I start writing, I get the mind map into a shape that makes sense and that will support me. This is the second critical point: I have to come up with a compelling story using the material I’ve collected. Just enumerating facts and wisdom a good talk doesn’t make. It has to have a good flow that makes sense and that keeps people engaged.</p>
</blockquote>

<ul>
<li>Phase 5: Slides</li>
</ul>

<blockquote>
<p>I have a very strong opinion on slides: use few, big words. Don’t make people read your slides unless it’s code samples. Otherwise they’ll be distracted from what you say. You’ll see me rarely use fonts smaller than 100pt (code ~40–60pt) which is readable from everywhere and forces me to be as brief as possible.</p>
</blockquote>

<ul>
<li>Phase 6: Polishing</li>
</ul>

<blockquote>
<p>I firmly believe that this phase makes or breaks a talk. Only by practicing again and again you’ll notice rough spots, weak transitions, and redundancies. Each iteration makes the talk a bit better both regarding the slides and my ability to present it. Each iteration adds impressions that my subconscious mind chews on and makes things fall in place and give me inspiration in unlikely moments.</p>
</blockquote>

<ul>
<li>Phase 7: Sneak Preview</li>
</ul>

<blockquote>
<p>In the past years I was blessed with the opportunity to test my talks in front of a smaller audiences. Interestingly, I’ve come to take smaller events more seriously than the big ones. If a small conference pays for my travels and gives me a prominent slot, I have both more responsibility and attention than if I paid my way to an event where I’m one of many speakers.</p>
</blockquote>

<ul>
<li>Phase 8: Refinement and More Polishing</li>
</ul>

<blockquote>
<p>The first session is always just going through all slides, reacquainting myself with my deck. Then it always takes quite a bit of willpower until I do a full practice run again: the first time always pretty brutal because I tend to forget pretty fast. On the other hand, it rather quickly comes back too. Which makes it even harder to motivate myself to start. Ideally I’d have access to a video recording from phase 7 to have a closer look at what work could be improved. But since it’s usually smaller conferences, I don’t.</p>
</blockquote>

<ul>
<li>Phase 9: Travel</li>
</ul>

<blockquote>
<p>Whenever I travel to conferences I bring everything I need for my talk and then some. To make sure I don’t forget anything essential, I have a packing list for my business trips (and vacations too – the differences are so minimal that I use a unified list). My epic packing list for business trips. I print it out the day before departure and cross stuff off as I pack. I highly recommend to anyone to emulate this since packing is a lot less stressful if you just follow a checklist.</p>
</blockquote>

<ul>
<li>Phase 10: Showtime!</li>
</ul>

<blockquote>
<p>So this is it. The moment everything else led to. People who suffer from fear of public speaking think this is the worst part. But if you scroll back you’ll realize: this is the payoff! This is what you worked toward. This is the fun, easy part. Once you stand in front of the audience, the work is done and you get to enjoy the ride.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.trueos.org/blog/discourse-trueos-qa-61617/" rel="nofollow">Kris and Ken Moore - TrueOS Q&amp;A</a></li>
<li><a href="https://mail-index.netbsd.org/tech-repository/2017/06/10/msg000637.html" rel="nofollow">New home for the repository conversions (NetBSD Git mirror is now on GitHub.com/NetBSD)</a></li>
<li><a href="https://deftly.net/posts/2017-05-01-openbsd-ksh-tab-complete.html" rel="nofollow">Tab completion in OpenBSD&#39;s ksh</a></li>
<li><a href="http://pkgsrc.org/pkgsrcCon/2017/" rel="nofollow">pkgsrcCon July 1&amp;2</a></li>
<li><a href="https://www.mail-archive.com/misc@openbsd.org/msg153421.html" rel="nofollow">OpenBSD 6.1 syspatch installed SP kernel on MP system</a></li>
<li><a href="http://knoxbug.org/content/join-us-freebsd-day" rel="nofollow">KNOXBug meeting this Friday</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2XEE9JA#wrap" rel="nofollow">Rob - FreeNAS Corral</a></li>
<li><a href="http://dpaste.com/27GSJK0#wrap" rel="nofollow">Brad - ZFS snapshot strategy</a></li>
<li><a href="http://dpaste.com/3D02RYZ#wrap" rel="nofollow">Phil - ZFS Send via Snail Mail</a></li>
<li><p><a href="http://dpaste.com/0ZSMVWH#wrap" rel="nofollow">Phillip - Network Limits for Public NTP Server</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This episode gives you the full dose of BSDCan 2017 recap as well as a blog post on conference speaking advice.</p>

<h2>Headlines</h2>

<h3>Pre-conference activities: Goat BoF, FreeBSD Foundation Board Meeting, and FreeBSD Journal Editorial Board Meeting</h3>

<ul>
<li>The FreeBSD Foundation has a new President as Justin Gibbs is busy this year with building a house, so George Neville-Neil took up the task to serve as President, with Justin Gibbs as Secretary. Take a look at the updated <a href="https://www.freebsdfoundation.org/about/board-of-directors/" rel="nofollow">Board of Directors</a>.<br></li>
<li>We also have a new <a href="https://www.freebsdfoundation.org/about/staff/" rel="nofollow">staff member</a>: Scott Lamons joined the Foundation team as senior program manager.</li>
</ul>

<blockquote>
<p>Scott’s work for the Foundation will focus on managing and evangelizing programs for advanced technologies in FreeBSD including preparing project plans, coordinating resources, and facilitating interactions between commercial vendors, the Foundation, and the FreeBSD community.</p>
</blockquote>

<ul>
<li>The Foundation also planned various future activities, visits of upcoming conferences, and finding new ways to support and engage the community.</li>
<li>The Foundation now has interns in the form of co-op students from the University of Waterloo, Canada. This is described further in the <a href="https://www.freebsdfoundation.org/blog/may-2017-development-projects-update/" rel="nofollow">May 2017 Development Projects Update</a>. Both students (Siva and Charlie) were also the conference, helping out at the Foundation table, demonstrating the tinderbox dashboard. Follow the <a href="https://www.freebsdfoundation.org/news-and-events/blog/blog-post/building-a-physical-freebsd-build-status-dashboard/" rel="nofollow">detailed instructions</a> to build one of your own.</li>
<li>The Foundation put out a <a href="https://www.freebsdfoundation.org/blog/freebsd-foundation-2017-project-proposal-solicitation/" rel="nofollow">call for Project Proposal Solicitation for 2017</a>. If you think you have a good proposal for work relating to any of the major subsystems or infrastructure for FreeBSD, we’d be happy to review it.</li>
<li><p>Don’t miss the deadlines for travel grants to some of the upcoming conferences. You can find the necessary forms and deadlines at the <a href="https://www.freebsdfoundation.org/what-we-do/travel-grants/travel-grants/" rel="nofollow">Travel Grant page</a> on the Foundation website.</p></li>
<li><p>Pictures from the Goat BoF can be found on <a href="https://assets.keltia.net/photos/BSDCan-2017/Royal%20Oak/index.html" rel="nofollow">Keltia.net</a></p></li>
<li><p>Overlapping with the GoatBoF, members of the FreeBSD Journal editorial board met in a conference room in the Novotel to plan the upcoming issues. Topics were found, authors identified, and new content was discussed to appeal to even more readers. Check out the <a href="https://www.freebsdfoundation.org/journal/" rel="nofollow">FreeBSD Journal website</a> and subscribe if you like to support the Foundation in that way.</p>

<hr></li>
</ul>

<h3><a href="https://wiki.freebsd.org/DevSummit/201706" rel="nofollow">FreeBSD Devsummit Day 1 &amp; 2</a></h3>

<ul>
<li>The first day of the Devsummit began with introductory slides by Gordon Tetlow, who organized the devsummit very well.</li>
<li>Benno Rice of the FreeBSD core team presented the work done on the new Code of Conduct, which will become effective soon. A round of Q&amp;A followed, with positive feedback from the other devsummit attendees supporting the new CoC.</li>
<li>After that, Allan Jude joined to talk about the new <a href="https://github.com/freebsd/fcp" rel="nofollow">FreeBSD Community Proposal (FCP)</a> process. Modelled after IETF RFCs, Joyent RFDs, and Python PEP, it is a new way for the project to reach consensus on the design or implementation of new features or processes. The FCP repo contains FCP#0 that describes the process, and a template for writing a proposal.</li>
<li>Then, the entire core team (except John Baldwin, who could not make it this year) and core secretary held a core Q&amp;A session, Answering questions, gathering feedback and suggestions.<br></li>
<li>After the coffee break, we had a presentation about Intel’s QAT integration in FreeBSD.</li>
<li>When the lunch was over, people spread out into working groups about BearSSL, Transport (TCP/IP), and OpenZFS.</li>
<li><a href="https://pbs.twimg.com/media/DBu_IMsWAAId2sN.jpg:large" rel="nofollow">OpenZFS working group</a>:

<ul>
<li>Matt Ahrens lead the group, and spent most of the first session providing a status update about what features have been recently committed, are out for review, on the horizon, or in the design phase.</li>
</ul></li>
<li><strong>Existing Features</strong>

<ul>
<li>Compressed ARC</li>
<li>Compressed Send/Recv</li>
<li><strong>Recently Upstreamed</strong></li>
<li>A recent commit improved RAID-Z write speeds by declaring writes to padding blocks to be optional, and to always write them if they can be aggregated with the next write. Mostly impacts large record sizes.</li>
<li>ABD (ARC buffer scatter/gather)</li>
</ul></li>
<li><strong>Upstreaming In Progress</strong>

<ul>
<li>Native Encryption</li>
<li>Channel Programs</li>
<li>Device Removal (Mirrors and Stripes)</li>
<li>Redacted Send/recv</li>
<li>Native TRIM Support (FreeBSD has its own, but this is better and applies to all ZFS implementations)</li>
<li>Faster (mostly sequential) scrub/resilver</li>
<li>DRAID (A great deal of time was spent explaining how this works, with diagrams on the chalk board)</li>
<li>vdev metadata classes (store metadata on SSDs with data is on HDDs, or similar setups. Could also be modified to do dedup to SSD)</li>
<li>Multi-mount protection (“safe import”, for dual-headed storage shelves)</li>
<li>zpool checkpoint (rollback an entire pool, including zfs rename and zfs destroy)</li>
</ul></li>
<li><strong>Further Out</strong>

<ul>
<li>Import improvements</li>
<li>Import with missing top-level vdevs (some blocks unreadable, but might let you get some data)</li>
<li>Improved allocator performance -- vdev spacemap log</li>
<li>ZIL performance</li>
<li>Persistent L2ARC</li>
<li>ZSTD Compression</li>
</ul></li>
<li>Day 2

<ul>
<li>Day two started with the Have/Want/Need session for FreeBSD 12.0. A number of features that various people have or are in the process of building, were discussed with an eye towards upstreaming them. Features we want to have in time for 12.0 (early 2019) were also discussed.</li>
<li>After the break was the Vendor summit, which continued the discussion of how FreeBSD and its vendors can work together to make a better operating system, and better products based on it</li>
<li>After lunch, the group broke up into various working groups: Testing/CI, Containers, Hardening UFS, and GELI Improvements</li>
<li>Allan lead the GELI Improvements session. The main thrust of the discussions was fixing an outstanding bug in GELI when using both key slots with passphrases. To solve this, and make GELI more extensible, the metadata format will be extended to allow it to store more than 512 bytes of data (currently 511 bytes are used).</li>
<li>The new format will allow arbitrarily large metadata, defined at creation time by selecting the number of user key slots desired.</li>
<li>The new extended metadata format will contain mostly the same fields, except the userkey will no longer be a byte array of IV-key, Data-key, HMAC, but a struct that will contain all data about that key</li>
<li>This new format will store the number of pkcs5v2 iterations per key, instead of only having a single location to store this number for all keys (the source of the original bug)</li>
<li>A new set of flags per key, to control some aspects of the key (does it require a keyfile, etc), as well as possibly the role of the key.</li>
<li>An auxdata field related to the flags, this would allow a specific key with a specific flag set, to boot a different partition, rather than decrypt the main partition.</li>
<li>A URI to external key material is also stored per key, allowing GELI to uniquely identify the correct data to load to be able to use a specific decryption key</li>
<li>And the three original parts of the key are stored in separate fields now. The HMAC also has a type field, allowing for a different HMAC algorithm to be used in the future.</li>
<li>The main metadata is also extended to include a field to store the number of user keys, and to provide an overall HMAC of the metadata, so that it can be verified using the master key (provide any of the user keys)</li>
</ul></li>
<li><p>Other topics discussed:</p>

<ul>
<li>Ken Merry presented sedutil, a tool for managing Self Encrypting Drives, as may be required by certain governments and other specific use cases.</li>
<li>Creating a deniable version of GELI, where the metadata is also encrypted</li>
<li>The work to implemented GELI in the UEFI loader was discussed, and a number of developers volunteered to review and test the code</li>
</ul></li>
<li><p>Following the end of the Dev Summit, the “Newcomers orientation and mentorship” session was run by Michael W. Lucas, which attempts to pair up first time attendees with oldtimers, to make sure they always know a few people they can ask if they have questions, or if they need help getting introduced to the right people.</p>

<hr></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.bsdcan.org/2017/schedule/day_2017-06-09.en.html" rel="nofollow">Conference Day 1</a></h3>

<ul>
<li>The conference opened with some short remarks from Dan Langille, and then the opening keynote by Dr Michael Geist, a law professor at the University of Ottawa where he holds the Canada Research Chair in Internet and E-commerce Law. The keynote focused on what some of the currently issues are, and how the technical community needs to get involved at all levels. In Canada especially, contacting your representatives is quite effective, and when it does not happen, they only hear the other side of the story, and often end up spouting talking points from lobbyists as if they were facts.</li>
<li>The question period for the keynote ran well overtime because of the number of good questions the discussion raised, including how do we fight back against large telcos with teams of lawyers and piles of money.</li>
<li>Then the four tracks of talks started up for the day</li>
<li>The day wrapped up with the Work In Progress (WIP) session.

<ul>
<li>Allan Jude presented work on ZSTD compression in ZFS</li>
<li>Drew Gallatin presented about work at Netflix on larger mbufs, to avoid the need for chaining and to allow more data to be pushed at once. Results in an 8% CPU time reduction when pushing 90 gbps of TLS encrypted traffic</li>
<li>Dan Langille presented about letsencrypt (the acme.sh tool specifically), and bacula</li>
<li>Samy Al Bahra presented about Concurrency Kit
***</li>
</ul></li>
</ul>

<h3><a href="http://www.bsdcan.org/2017/schedule/day_2017-06-10.en.html" rel="nofollow">Conference Day 2</a></h3>

<ul>
<li>Because Dan is a merciful soul, BSDCan starts an hour later on the second day</li>
<li>Another great round of talks and BoF sessions over lunch</li>
<li>The hallway track was great as always, and I spent most of the afternoon just talking with people</li>
<li>Then the final set of talks started, and I was torn between all four of them</li>
<li>Then there was the auction, and the closing party
***</li>
</ul>

<h3><a href="https://blather.michaelwlucas.com/archives/2962" rel="nofollow">BSDCan 2017 Auction Swag</a></h3>

<ul>
<li>Groff Fundraiser Pins: During the conference, You could get a unique Groff pin, by donating more than the last person to either the FreeBSD or OpenBSD foundation</li>
<li>Michael W. Lucas and his wife Liz donated some interesting home made and local items to the infamous Charity Auction</li>
<li>I donated the last remaining copy of the “Canadian Edition” of “FreeBSD Mastery: Advanced ZedFS”, and a Pentium G4400 (Skylake) CPU (Supports ECC or non-ECC)</li>
<li>Peter Hessler donated his pen (Have you read “Git Commit Murder” yet?)</li>
<li>Theo De Raadt donated his autographed conference badge</li>
<li>David Maxwell donated a large print of the group photo from last years FreeBSD Developers Summit, which was purchased by Allan</li>
<li>There was also a FreeBSD Dev Summit T-Shirt (with the Slogan: What is Core doing about it?) autographed by all of the attending members of core, with a forged jhb@ signature.</li>
<li>Lastly, someone wrote “I &lt;3 FreeBSD” on a left over conference t-shirt with magic marker, and the bidding began to make OpenBSD developer Henning Brauer wear it to the closing party. The top bid was $150 by Kristof Provost, the FreeBSD pf maintainer.
***</li>
</ul>

<h3><a href="https://twitter.com/henningBrauer" rel="nofollow">Henning Brauer loves FreeBSD</a></h3>

<ul>
<li>In addition to the $150 donation that resulted in Henning wearing the I love FreeBSD t-shirt, he also took selfies with people in exchange for an additional donation of $10. A total of over $500 was raised.</li>
<li><a href="https://twitter.com/mwlauthor/status/874656462433386497" rel="nofollow">Michael W. Lucas</a></li>
<li><a href="https://twitter.com/michaeldexter/status/874344686885904384" rel="nofollow">Michael Dexter</a></li>
<li><a href="https://twitter.com/yzgyyang/status/873714734343880705" rel="nofollow">FreeBSD Foundation Interns + Ed Maste + Eric Joyner</a></li>
<li><a href="https://twitter.com/khorben/status/873673295903825925" rel="nofollow">Pierre Ponchery</a></li>
<li><a href="https://twitter.com/niqdanger/status/873697176513380353" rel="nofollow">Nick Danger </a></li>
<li><a href="https://twitter.com/shirkdog/status/873687910175866881" rel="nofollow">Michael Shirk </a></li>
<li><a href="https://twitter.com/calvinhp/status/873686591692255233" rel="nofollow">Calvin Hendryx-Parker</a></li>
<li><a href="https://twitter.com/reykfloeter/status/873673717884346368" rel="nofollow">Reyk Floeter</a></li>
<li><a href="https://twitter.com/akpoff/status/873673432751370240" rel="nofollow">Rod Grimes</a></li>
<li><a href="https://twitter.com/gonzopancho/status/873700951651233792" rel="nofollow">Jim Thompson</a></li>
<li><a href="https://twitter.com/SeanChittenden/status/873750297113501697" rel="nofollow">Sean Chittenden and Sam Gwydir, Henning wearing Theo de Raadt’s badge</a></li>
<li><a href="https://twitter.com/davdunc/status/873807305162334208" rel="nofollow">David Duncan</a>
***</li>
</ul>

<h3><a href="https://github.com/libtrue/libtrue" rel="nofollow">libtrue</a></h3>

<ul>
<li>At the hacker lounge, a joke email was sent to the FreeBSD developers list, making it look like a change to true(1)’s manpage had been committed to “document that true(1) supports libxo”</li>
<li>While the change was not actually made, as you might expect this started a discussion about if this was really necessary.</li>
<li>This spawned a new github repo</li>
<li>While this all started as a joke, it then became an example of how rapid collaboration can happen, and an example of implementing a number of modern technologies in FreeBSD, including libxo (json output), and capsicum (security sandboxing)</li>
<li>The project has an large number of open issues and enhancement suggestions, and a number of active pull requests including:

<ul>
<li>Add Vagrantfile and Ansible playbooks for VM</li>
<li>DTrace Support (Add the trueprov provider to allow tracing of true.</li>
<li>A Code of Conduct</li>
<li>libtrue.xyz website as a git submodule</li>
<li>a false binary</li>
<li>Python and Go bindings
***</li>
</ul></li>
</ul>

<h3><a href="https://hynek.me/articles/speaking/" rel="nofollow">On Conference Speaking</a></h3>

<ul>
<li>Phase 1: Idea</li>
</ul>

<blockquote>
<p>Until now I’ve never had to sit down and ponder what I could speak about. Over the year, I run into at least one topic I know something about that appears to be interesting to the wider public. I’m positive that’s true for almost anyone if they keep their minds open and keep looking for it.</p>
</blockquote>

<ul>
<li>Phase 2: Call for Proposals</li>
</ul>

<blockquote>
<p>In the end I have to come up with a good pitch that speaks to as many people as possible and with a speculative outline. Since there are always many more submissions than talk slots, this is the first critical point. There are many reasons why a proposal can be refused, so put effort into not giving the program committee any additional, that are entirely avoidable.</p>
</blockquote>

<ul>
<li>Phase 3: Waiting for the CFP Result</li>
</ul>

<blockquote>
<p>...do passive research: if I see something relevant, I add it to my mind map. At this point my mind map looks atypical though: it has a lot of unordered root nodes. I just throw in everything that looks interesting and add some of my own thoughts to it. In the case of the reliability topic, I spend a lot of time to stay on top it anyway so a lot of material emerged.</p>
</blockquote>

<ul>
<li>Phase 4: The Road to an Outline</li>
</ul>

<blockquote>
<p>Once the talk is accepted, research intensifies. Books and articles I’ve written down for further research are read and topics extracted. In 2017, this started on January 23. But before I start writing, I get the mind map into a shape that makes sense and that will support me. This is the second critical point: I have to come up with a compelling story using the material I’ve collected. Just enumerating facts and wisdom a good talk doesn’t make. It has to have a good flow that makes sense and that keeps people engaged.</p>
</blockquote>

<ul>
<li>Phase 5: Slides</li>
</ul>

<blockquote>
<p>I have a very strong opinion on slides: use few, big words. Don’t make people read your slides unless it’s code samples. Otherwise they’ll be distracted from what you say. You’ll see me rarely use fonts smaller than 100pt (code ~40–60pt) which is readable from everywhere and forces me to be as brief as possible.</p>
</blockquote>

<ul>
<li>Phase 6: Polishing</li>
</ul>

<blockquote>
<p>I firmly believe that this phase makes or breaks a talk. Only by practicing again and again you’ll notice rough spots, weak transitions, and redundancies. Each iteration makes the talk a bit better both regarding the slides and my ability to present it. Each iteration adds impressions that my subconscious mind chews on and makes things fall in place and give me inspiration in unlikely moments.</p>
</blockquote>

<ul>
<li>Phase 7: Sneak Preview</li>
</ul>

<blockquote>
<p>In the past years I was blessed with the opportunity to test my talks in front of a smaller audiences. Interestingly, I’ve come to take smaller events more seriously than the big ones. If a small conference pays for my travels and gives me a prominent slot, I have both more responsibility and attention than if I paid my way to an event where I’m one of many speakers.</p>
</blockquote>

<ul>
<li>Phase 8: Refinement and More Polishing</li>
</ul>

<blockquote>
<p>The first session is always just going through all slides, reacquainting myself with my deck. Then it always takes quite a bit of willpower until I do a full practice run again: the first time always pretty brutal because I tend to forget pretty fast. On the other hand, it rather quickly comes back too. Which makes it even harder to motivate myself to start. Ideally I’d have access to a video recording from phase 7 to have a closer look at what work could be improved. But since it’s usually smaller conferences, I don’t.</p>
</blockquote>

<ul>
<li>Phase 9: Travel</li>
</ul>

<blockquote>
<p>Whenever I travel to conferences I bring everything I need for my talk and then some. To make sure I don’t forget anything essential, I have a packing list for my business trips (and vacations too – the differences are so minimal that I use a unified list). My epic packing list for business trips. I print it out the day before departure and cross stuff off as I pack. I highly recommend to anyone to emulate this since packing is a lot less stressful if you just follow a checklist.</p>
</blockquote>

<ul>
<li>Phase 10: Showtime!</li>
</ul>

<blockquote>
<p>So this is it. The moment everything else led to. People who suffer from fear of public speaking think this is the worst part. But if you scroll back you’ll realize: this is the payoff! This is what you worked toward. This is the fun, easy part. Once you stand in front of the audience, the work is done and you get to enjoy the ride.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.trueos.org/blog/discourse-trueos-qa-61617/" rel="nofollow">Kris and Ken Moore - TrueOS Q&amp;A</a></li>
<li><a href="https://mail-index.netbsd.org/tech-repository/2017/06/10/msg000637.html" rel="nofollow">New home for the repository conversions (NetBSD Git mirror is now on GitHub.com/NetBSD)</a></li>
<li><a href="https://deftly.net/posts/2017-05-01-openbsd-ksh-tab-complete.html" rel="nofollow">Tab completion in OpenBSD&#39;s ksh</a></li>
<li><a href="http://pkgsrc.org/pkgsrcCon/2017/" rel="nofollow">pkgsrcCon July 1&amp;2</a></li>
<li><a href="https://www.mail-archive.com/misc@openbsd.org/msg153421.html" rel="nofollow">OpenBSD 6.1 syspatch installed SP kernel on MP system</a></li>
<li><a href="http://knoxbug.org/content/join-us-freebsd-day" rel="nofollow">KNOXBug meeting this Friday</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2XEE9JA#wrap" rel="nofollow">Rob - FreeNAS Corral</a></li>
<li><a href="http://dpaste.com/27GSJK0#wrap" rel="nofollow">Brad - ZFS snapshot strategy</a></li>
<li><a href="http://dpaste.com/3D02RYZ#wrap" rel="nofollow">Phil - ZFS Send via Snail Mail</a></li>
<li><p><a href="http://dpaste.com/0ZSMVWH#wrap" rel="nofollow">Phillip - Network Limits for Public NTP Server</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>197: Relaying the good news</title>
  <link>https://www.bsdnow.tv/197</link>
  <guid isPermaLink="false">96c50ac2-eb84-4fbf-9a0b-d1cfe342bb11</guid>
  <pubDate>Wed, 07 Jun 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/96c50ac2-eb84-4fbf-9a0b-d1cfe342bb11.mp3" length="74289460" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We’re at BSDCan, but we have an interview with Michael W. Lucas which you don’t want to miss.</itunes:subtitle>
  <itunes:duration>1:43:10</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We’re at BSDCan, but we have an interview with Michael W. Lucas which you don’t want to miss.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
We are off to BSDCan but we have an interview and news roundup for you.
Interview - Michael W. Lucas - mwlucas@michaelwlucas.com (mailto:mwlucas@michaelwlucas.com) / @mwlauthor (https://twitter.com/mwlauthor)
Books, conferences &amp;amp; how these two combine
***
News Roundup
In The Name Of Sane Email: Setting Up OpenBSD's spamd(8) With Secondary MXes In Play (http://bsdly.blogspot.no/2012/05/in-name-of-sane-email-setting-up-spamd.html)
“The Grumpy BSD Guy”, Peter Hansteen is at it again, they have produced an updated version of a full recipe for OpenBSD’s spamd for your primary AND secondary mail servers
Recipes in our field are all too often offered with little or no commentary to help the user understand the underlying principles of how a specific configuration works. To counter the trend and offer some free advice on a common configuration, here is my recipe for a sane mail setup.
Mailing lists can be fun. Most of the time the discussions on lists like openbsd-misc are useful, entertaining or both. But when your battle with spam fighting technology ends up blocking your source of information and entertainment (like in the case of the recent thread titled "spamd greylisting: false positives" - starting with this message), frustration levels can run high, and in the process it emerged that some readers out there place way too much trust in a certain site offering barely commented recipes (named after a rare chemical compound Cl-Hg-Hg-Cl).
4 easy steps:
Make sure your MXes (both primary and secondary) are able to receive mail for your domains
Set set up content filtering for all MXes, since some spambots actually speak SMTP
Set up spamd in front of all MXes
Set up synchronization between your spamds
These are the basic steps. If you want to go even further, you can supplement your greylisting and publicly available blacklists with your own greytrapping, but greytrapping is by no means required.
Once you have made sure that your mail exchangers will accept mail for your domains (checking that secondaries do receive and spool mail when you stop the SMTP service on the primary), it's time to start setting up the content filtering.
The post provides links if you need help getting the basic mail server functionality going
At this point you will more likely than not discover that any differences in filtering setups between the hosts that accept and deliver mail will let spam through via the weakest link. Tune accordingly, or at least until you are satisfied that you have a fairly functional configuration.
As you will have read by now in the various sources I cited earlier, you need to set up rules to redirect traffic to your spamd as appropriate. Now let's take a peek at what I have running at my primary site's gateway.
The articles provides a few different sets of rules
The setup includes running all outgoing mail through spamd to auto-populate the whitelists, allowing replies to your emails to get through without greylisting
At this point, you have seen how to set up two spamds, each running in front of a mail exchanger. You can choose to run with the default spamd.conf, or you can edit in your own customizations.
There is also a link to Peter’s spamd.conf if you want to use “what works for me”
The fourth and final required step for a spamd setup with backup mail exchangers it to set up synchronization between the spamds. The synchronization keeps your greylists in sync and transfers information on any greytrapped entries to the partner spamds. As the spamd man page explains, the synchronization options -y and -Y are command line options to spamd. 
The articles steps through the process of configuring spamd to listen for synchronization, and to send synchronization messages to its peer
With these settings in place, you have more or less completed step four of our recipe.
The article also shows you how to configure spamd to log to a separate log file, to make the messages easier to find and consolidate between your mail servers
After noting the system load on your content filtering machines, restart your spamds. Then watch the system load values on the content filterers and take a note of them from time to time, say every 30 minutes or so
Step 4) is the last required step for building a multi-MX configuration. You may want to just leave the system running for a while and watch any messages that turn up in the spamd logs or the mail exchanger's logs
The final embellishment is to set up local greytrapping. The principle is simple: If you have one or more addresses in your domain that you know will never be valid, you add them to your list of trapping addresses
any host that tries to deliver mail to noreply@mydomain.nx will be added to the local blacklist spamd-greytrap to be stuttered at for as long as it takes.
Greytrapping can be fun, you can search for posts here tagged with the obvious keywords. To get you started, I offer up my published list of trap addresses, built mainly from logs of unsuccessful delivery attempts here, at The BSDly.net traplist page, while the raw list of trap email addresses is available here. If you want to use that list in a similar manner for your site, please do, only remember to replace the domain names with one or more that you will be receiving mail for.
Let us know how this affects your inbox
***
Beastie Bits
Status of FreeBSD’s capsicum on Linux (http://www.capsicum-linux.org/)
How to build a gateway, from 1979 (http://www.networksorcery.com/enp/ien/ien109.txt)
Linux escapee Hamza Sheikh on “Why FreeBSD?” (https://bsdmag.org/why_freebsd/)
UNIX is still as relevant as ever (https://blog.opengroup.org/2012/05/17/unix-is-still-as-relevant-as-ever/)
Upcoming Summer 2017 FreeBSD Foundation Events (https://www.freebsdfoundation.org/blog/upcoming-summer-2017-freebsd-foundation-events/)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We’re at BSDCan, but we have an interview with Michael W. Lucas which you don’t want to miss.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<p>We are off to BSDCan but we have an interview and news roundup for you.</p>

<hr>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com" rel="nofollow">mwlucas@michaelwlucas.com</a> / <a href="https://twitter.com/mwlauthor" rel="nofollow">@mwlauthor</a></h2>

<ul>
<li>Books, conferences &amp; how these two combine
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://bsdly.blogspot.no/2012/05/in-name-of-sane-email-setting-up-spamd.html" rel="nofollow">In The Name Of Sane Email: Setting Up OpenBSD&#39;s spamd(8) With Secondary MXes In Play</a></h3>

<ul>
<li>“The Grumpy BSD Guy”, Peter Hansteen is at it again, they have produced an updated version of a full recipe for OpenBSD’s spamd for your primary AND secondary mail servers</li>
</ul>

<blockquote>
<p>Recipes in our field are all too often offered with little or no commentary to help the user understand the underlying principles of how a specific configuration works. To counter the trend and offer some free advice on a common configuration, here is my recipe for a sane mail setup.<br>
Mailing lists can be fun. Most of the time the discussions on lists like openbsd-misc are useful, entertaining or both. But when your battle with spam fighting technology ends up blocking your source of information and entertainment (like in the case of the recent thread titled &quot;spamd greylisting: false positives&quot; - starting with this message), frustration levels can run high, and in the process it emerged that some readers out there place way too much trust in a certain site offering barely commented recipes (named after a rare chemical compound Cl-Hg-Hg-Cl).</p>
</blockquote>

<ul>
<li>4 easy steps:

<ul>
<li>Make sure your MXes (both primary and secondary) are able to receive mail for your domains</li>
<li>Set set up content filtering for all MXes, since some spambots actually speak SMTP</li>
<li>Set up spamd in front of all MXes</li>
<li>Set up synchronization between your spamds</li>
</ul></li>
</ul>

<blockquote>
<p>These are the basic steps. If you want to go even further, you can supplement your greylisting and publicly available blacklists with your own greytrapping, but greytrapping is by no means required.<br>
Once you have made sure that your mail exchangers will accept mail for your domains (checking that secondaries do receive and spool mail when you stop the SMTP service on the primary), it&#39;s time to start setting up the content filtering.</p>
</blockquote>

<ul>
<li>The post provides links if you need help getting the basic mail server functionality going</li>
</ul>

<blockquote>
<p>At this point you will more likely than not discover that any differences in filtering setups between the hosts that accept and deliver mail will let spam through via the weakest link. Tune accordingly, or at least until you are satisfied that you have a fairly functional configuration.<br>
As you will have read by now in the various sources I cited earlier, you need to set up rules to redirect traffic to your spamd as appropriate. Now let&#39;s take a peek at what I have running at my primary site&#39;s gateway.</p>
</blockquote>

<ul>
<li>The articles provides a few different sets of rules</li>
<li>The setup includes running all outgoing mail through spamd to auto-populate the whitelists, allowing replies to your emails to get through without greylisting</li>
</ul>

<blockquote>
<p>At this point, you have seen how to set up two spamds, each running in front of a mail exchanger. You can choose to run with the default spamd.conf, or you can edit in your own customizations.</p>
</blockquote>

<ul>
<li>There is also a link to Peter’s spamd.conf if you want to use “what works for me”</li>
</ul>

<blockquote>
<p>The fourth and final required step for a spamd setup with backup mail exchangers it to set up synchronization between the spamds. The synchronization keeps your greylists in sync and transfers information on any greytrapped entries to the partner spamds. As the spamd man page explains, the synchronization options -y and -Y are command line options to spamd. </p>
</blockquote>

<ul>
<li>The articles steps through the process of configuring spamd to listen for synchronization, and to send synchronization messages to its peer</li>
</ul>

<blockquote>
<p>With these settings in place, you have more or less completed step four of our recipe.</p>
</blockquote>

<ul>
<li>The article also shows you how to configure spamd to log to a separate log file, to make the messages easier to find and consolidate between your mail servers</li>
</ul>

<blockquote>
<p>After noting the system load on your content filtering machines, restart your spamds. Then watch the system load values on the content filterers and take a note of them from time to time, say every 30 minutes or so<br>
Step 4) is the last required step for building a multi-MX configuration. You may want to just leave the system running for a while and watch any messages that turn up in the spamd logs or the mail exchanger&#39;s logs<br>
The final embellishment is to set up local greytrapping. The principle is simple: If you have one or more addresses in your domain that you know will never be valid, you add them to your list of trapping addresses<br>
any host that tries to deliver mail to <a href="mailto:noreply@mydomain.nx" rel="nofollow">noreply@mydomain.nx</a> will be added to the local blacklist spamd-greytrap to be stuttered at for as long as it takes.<br>
Greytrapping can be fun, you can search for posts here tagged with the obvious keywords. To get you started, I offer up my published list of trap addresses, built mainly from logs of unsuccessful delivery attempts here, at The BSDly.net traplist page, while the raw list of trap email addresses is available here. If you want to use that list in a similar manner for your site, please do, only remember to replace the domain names with one or more that you will be receiving mail for.</p>
</blockquote>

<ul>
<li>Let us know how this affects your inbox
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.capsicum-linux.org/" rel="nofollow">Status of FreeBSD’s capsicum on Linux</a></li>
<li><a href="http://www.networksorcery.com/enp/ien/ien109.txt" rel="nofollow">How to build a gateway, from 1979</a></li>
<li><a href="https://bsdmag.org/why_freebsd/" rel="nofollow">Linux escapee Hamza Sheikh on “Why FreeBSD?”</a></li>
<li><a href="https://blog.opengroup.org/2012/05/17/unix-is-still-as-relevant-as-ever/" rel="nofollow">UNIX is still as relevant as ever</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/upcoming-summer-2017-freebsd-foundation-events/" rel="nofollow">Upcoming Summer 2017 FreeBSD Foundation Events</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We’re at BSDCan, but we have an interview with Michael W. Lucas which you don’t want to miss.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<p>We are off to BSDCan but we have an interview and news roundup for you.</p>

<hr>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com" rel="nofollow">mwlucas@michaelwlucas.com</a> / <a href="https://twitter.com/mwlauthor" rel="nofollow">@mwlauthor</a></h2>

<ul>
<li>Books, conferences &amp; how these two combine
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://bsdly.blogspot.no/2012/05/in-name-of-sane-email-setting-up-spamd.html" rel="nofollow">In The Name Of Sane Email: Setting Up OpenBSD&#39;s spamd(8) With Secondary MXes In Play</a></h3>

<ul>
<li>“The Grumpy BSD Guy”, Peter Hansteen is at it again, they have produced an updated version of a full recipe for OpenBSD’s spamd for your primary AND secondary mail servers</li>
</ul>

<blockquote>
<p>Recipes in our field are all too often offered with little or no commentary to help the user understand the underlying principles of how a specific configuration works. To counter the trend and offer some free advice on a common configuration, here is my recipe for a sane mail setup.<br>
Mailing lists can be fun. Most of the time the discussions on lists like openbsd-misc are useful, entertaining or both. But when your battle with spam fighting technology ends up blocking your source of information and entertainment (like in the case of the recent thread titled &quot;spamd greylisting: false positives&quot; - starting with this message), frustration levels can run high, and in the process it emerged that some readers out there place way too much trust in a certain site offering barely commented recipes (named after a rare chemical compound Cl-Hg-Hg-Cl).</p>
</blockquote>

<ul>
<li>4 easy steps:

<ul>
<li>Make sure your MXes (both primary and secondary) are able to receive mail for your domains</li>
<li>Set set up content filtering for all MXes, since some spambots actually speak SMTP</li>
<li>Set up spamd in front of all MXes</li>
<li>Set up synchronization between your spamds</li>
</ul></li>
</ul>

<blockquote>
<p>These are the basic steps. If you want to go even further, you can supplement your greylisting and publicly available blacklists with your own greytrapping, but greytrapping is by no means required.<br>
Once you have made sure that your mail exchangers will accept mail for your domains (checking that secondaries do receive and spool mail when you stop the SMTP service on the primary), it&#39;s time to start setting up the content filtering.</p>
</blockquote>

<ul>
<li>The post provides links if you need help getting the basic mail server functionality going</li>
</ul>

<blockquote>
<p>At this point you will more likely than not discover that any differences in filtering setups between the hosts that accept and deliver mail will let spam through via the weakest link. Tune accordingly, or at least until you are satisfied that you have a fairly functional configuration.<br>
As you will have read by now in the various sources I cited earlier, you need to set up rules to redirect traffic to your spamd as appropriate. Now let&#39;s take a peek at what I have running at my primary site&#39;s gateway.</p>
</blockquote>

<ul>
<li>The articles provides a few different sets of rules</li>
<li>The setup includes running all outgoing mail through spamd to auto-populate the whitelists, allowing replies to your emails to get through without greylisting</li>
</ul>

<blockquote>
<p>At this point, you have seen how to set up two spamds, each running in front of a mail exchanger. You can choose to run with the default spamd.conf, or you can edit in your own customizations.</p>
</blockquote>

<ul>
<li>There is also a link to Peter’s spamd.conf if you want to use “what works for me”</li>
</ul>

<blockquote>
<p>The fourth and final required step for a spamd setup with backup mail exchangers it to set up synchronization between the spamds. The synchronization keeps your greylists in sync and transfers information on any greytrapped entries to the partner spamds. As the spamd man page explains, the synchronization options -y and -Y are command line options to spamd. </p>
</blockquote>

<ul>
<li>The articles steps through the process of configuring spamd to listen for synchronization, and to send synchronization messages to its peer</li>
</ul>

<blockquote>
<p>With these settings in place, you have more or less completed step four of our recipe.</p>
</blockquote>

<ul>
<li>The article also shows you how to configure spamd to log to a separate log file, to make the messages easier to find and consolidate between your mail servers</li>
</ul>

<blockquote>
<p>After noting the system load on your content filtering machines, restart your spamds. Then watch the system load values on the content filterers and take a note of them from time to time, say every 30 minutes or so<br>
Step 4) is the last required step for building a multi-MX configuration. You may want to just leave the system running for a while and watch any messages that turn up in the spamd logs or the mail exchanger&#39;s logs<br>
The final embellishment is to set up local greytrapping. The principle is simple: If you have one or more addresses in your domain that you know will never be valid, you add them to your list of trapping addresses<br>
any host that tries to deliver mail to <a href="mailto:noreply@mydomain.nx" rel="nofollow">noreply@mydomain.nx</a> will be added to the local blacklist spamd-greytrap to be stuttered at for as long as it takes.<br>
Greytrapping can be fun, you can search for posts here tagged with the obvious keywords. To get you started, I offer up my published list of trap addresses, built mainly from logs of unsuccessful delivery attempts here, at The BSDly.net traplist page, while the raw list of trap email addresses is available here. If you want to use that list in a similar manner for your site, please do, only remember to replace the domain names with one or more that you will be receiving mail for.</p>
</blockquote>

<ul>
<li>Let us know how this affects your inbox
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.capsicum-linux.org/" rel="nofollow">Status of FreeBSD’s capsicum on Linux</a></li>
<li><a href="http://www.networksorcery.com/enp/ien/ien109.txt" rel="nofollow">How to build a gateway, from 1979</a></li>
<li><a href="https://bsdmag.org/why_freebsd/" rel="nofollow">Linux escapee Hamza Sheikh on “Why FreeBSD?”</a></li>
<li><a href="https://blog.opengroup.org/2012/05/17/unix-is-still-as-relevant-as-ever/" rel="nofollow">UNIX is still as relevant as ever</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/upcoming-summer-2017-freebsd-foundation-events/" rel="nofollow">Upcoming Summer 2017 FreeBSD Foundation Events</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>196: PostgreZFS</title>
  <link>https://www.bsdnow.tv/196</link>
  <guid isPermaLink="false">2ab6a51e-9952-4066-9b69-3eb9dfeff679</guid>
  <pubDate>Wed, 31 May 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2ab6a51e-9952-4066-9b69-3eb9dfeff679.mp3" length="76501012" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSD Now, we review the EuroBSDcon schedule, we explore the mysteries of Docker on OpenBSD, and show you how to run PostgreSQL on ZFS.</itunes:subtitle>
  <itunes:duration>1:46:15</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSD Now, we review the EuroBSDcon schedule, we explore the mysteries of Docker on OpenBSD, and show you how to run PostgreSQL on ZFS.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
EuroBSDcon 2017 - Talks &amp;amp; Schedule published (https://2017.eurobsdcon.org/2017/05/26/talks-schedule-published/)
The EuroBSDcon website was updated with the tutorial and talk schedule for the upcoming September conference in Paris, France.
Tutorials on the 1st day: Kirk McKusick - An Introduction to the FreeBSD Open-Source Operating System, George Neville-Neil - DTrace for Developers, Taylor R Campbell - How to untangle your threads from a giant lock in a multiprocessor system
Tutorials on the 2nd day: Kirk continues his Introduction lecture, Michael Lucas - Core concepts of ZFS (half day), Benedict Reuschling - Managing BSD systems with Ansible (half day), Peter Hessler - BGP for developers and sysadmins
Talks include 3 keynotes (2 on the first day, beginning and end), another one at the end of the second day by Brendan Gregg
Good mixture of talks of the various BSD projects
Also, a good amount of new names and faces
Check out the full talk schedule (https://2017.eurobsdcon.org/talks-schedule/).
Registration is not open yet, but will be soon.
***
OpenBSD on the Xiaomi Mi Air 12.5" (https://jcs.org/2017/05/22/xiaomiair)
The Xiaomi Mi Air 12.5" (https://xiaomi-mi.com/notebooks/xiaomi-mi-notebook-air-125-silver/) is a basic fanless 12.5" Ultrabook with good build quality and decent hardware specs, especially for the money: while it can usually be had for about $600, I got mine for $489 shipped to the US during a sale about a month ago.
Xiaomi offers this laptop in silver and gold. They also make a 13" version but it comes with an NVidia graphics chip. Since these laptops are only sold in China, they come with a Chinese language version of Windows 10 and only one or two distributors that carry them ship to the US. Unfortunately that also means they come with practically no warranty or support.
Hardware
&amp;gt; The Mi Air 12.5" has a fanless, 6th generation (Skylake) Intel Core m3 processor, 4Gb of soldered-on RAM, and a 128Gb SATA SSD (more on that later). It has a small footprint of 11.5" wide, 8" deep, and 0.5" thick, and weighs 2.3 pounds.
&amp;gt; A single USB-C port on the right-hand side is used to charge the laptop and provide USB connectivity. A USB-C ethernet adapter I tried worked fine in OpenBSD. Whether intentional or not, a particular design touch I appreciated was that the USB-C port is placed directly to the right of the power button on the keyboard, so you don't have to look or feel around for the port when plugging in the power cable.
&amp;gt; A single USB 3 type-A port is also available on the right side next to the USB-C port. A full-size HDMI port and a headphone jack are on the left-hand side. It has a soldered-on Intel 8260 wireless adapter and Bluetooth. The webcam in the screen bezel attaches internally over USB.
&amp;gt; The chassis is all aluminum and has sufficient rigidity in the keyboard area. The 12.5" 1920x1080 glossy IPS screen has a fairly small bezel and while its hinge is properly weighted to allow opening the lid with one hand (if you care about that kind of thing), the screen does have a bit of top-end wobble when open, especially when typing on another laptop on the same desk.
&amp;gt; The keyboard has a roomy layout and a nice clicky tactile with good travel. It is backlit, but with only one backlight level. When enabled via Fn+F10 (which is handled by the EC, so no OpenBSD support required), it will automatically shut off after not typing for a short while, automatically turning back once a key is pressed.
Upgrades
    &amp;gt; An interesting feature of the Mi Air is that it comes with a 128Gb SATA SSD but also includes an open PCI-e slot ready to accept an NVMe SSD.
    &amp;gt; I upgraded mine with a Samsung PM961 256Gb NVMe SSD (left), and while it is possible to run with both drives in at the same time, I removed the Samsung CM871a 128Gb SATA (right) drive to save power.
    &amp;gt; The bottom case can be removed by removing the seven visible screws, in addition to the one under the foot in the middle back of the case, which just pries off. A spudger tool is needed to release all of the plastic attachment clips along the entire edge of the bottom cover.
    &amp;gt; Unfortunately this upgrade proved to be quite time consuming due to the combination of the limited UEFI firmware on the Mi Air and a bug in OpenBSD.
A Detour into UEFI Firmware Variables
&amp;gt; Unlike a traditional BIOS where one can boot into a menu and configure the boot order as well as enabling and disabling options such as "USB Hard Drive", the InsydeH2O UEFI firmware on the Xiaomi Air only provides the ability to adjust the boot order of existing devices. Any change or addition of boot devices must be done from the operating system, which is not possible under OpenBSD.
&amp;gt; I booted to a USB key with OpenBSD on it and manually partitioned the new NVME SSD, then rsynced all of the data over from the old drive, but the laptop would not boot to the new NVME drive, instead showing an error message that there was no bootable OS.
&amp;gt; Eventually I figured out that the GPT table that OpenBSD created on the NVMe disk was wrong due to a [one-off bug in the nvme driver](https://github.com/openbsd/src/commit/dc8298f669ea2d7e18c8a8efea509eed200cb989) which was causing the GPT table to be one sector too large, causing the backup GPT table to be written in the wrong location (and other utilities under Linux to write it over the OpenBSD area). I'm guessing the UEFI firmware would fail to read the bad GPT table on the disk that the boot variable pointed to, then declare that disk as missing, and then remove any variables that pointed to that disk.
OpenBSD Support
&amp;gt; The Mi Air's soldered-on Intel 8260 wireless adapter is supported by OpenBSD's iwm driver, including 802.11n support. The Intel sound chip is recognized by the azalia driver.
&amp;gt; The Synaptics touchpad is connected via I2C, but is not yet supported. I am actively hacking on my dwiic driver to make this work and the touchpad will hopefully operate as a Windows Precision Touchpad via imt so I don't have to write an entirely new Synaptics driver.
&amp;gt; Unfortunately since OpenBSD's inteldrm support that is ported from Linux is lagging quite a bit behind, there is no kernel support for Skylake and Kaby Lake video chips. Xorg works at 1920x1080 through efifb so the machine is at least usable, but X is not very fast and there is a noticeable delay when doing certain redrawing operations in xterm. Screen backlight can be adjusted through my OpenBSD port of intel_backlight. Since there is no hardware graphics support, this also means that suspend and resume do not work because nothing is available to re-POST the video after resume. Having to use efifb also makes it impossible to adjust the screen gamma, so for me, I can't use redshift for comfortable night-time hacking.
Flaws
&amp;gt; Especially taking into account the cheap price of the laptop, it's hard to find faults with the design. One minor gripe is that the edges of the case along the bottom are quite sharp, so when carrying the closed laptop, it can feel uncomfortable in one's hands.
&amp;gt; While all of those things could be overlooked, unfortunately there is also a critical flaw in the rollover support in the keyboard/EC on the laptop. When typing certain combinations of keys quickly, such as holding Shift and typing "NULL", one's fingers may actually hold down the Shift, N, and U keys at the same time for a very brief moment before releasing N. Normally the keyboard/EC would recognize U being pressed after N is already down and send an interrupt for the U key. Unfortunately on this laptop, particular combinations of three keys do not interrupt for the third key at all until the second key is lifted, usually causing the third key not to register at all if typed quickly.
I've been able to reproduce this problem in OpenBSD, Linux, and Windows, with the combinations of at least Shift+N+U and Shift+D+F. Holding Shift and typing the two characters in sequence quickly enough will usually fail to register the final character. Trying the combinations without Shift, using Control or Alt instead of Shift, or other character pairs does not trigger the problem.
This might be a problem in the firmware on the Embedded Controller, or a defect in the keyboard circuitry itself. As I mentioned at the beginning, getting technical support for this machine is difficult because it's only sold in China.
Docker on OpenBSD 6.1-current (https://medium.com/@dave_voutila/docker-on-openbsd-6-1-current-c620513b8110)
Dave Voutila writes:
So here’s the thing. I’m normally a macOS user…all my hardware was designed in Cupertino, built in China. But I’m restless and have been toying with trying to switch my daily machine over to a non-macOS system sort of just for fun. I find Linux messy, FreeBSD not as Apple-laptop-friendly as it should be, and Windows a non-starter. Luckily, I found a friend in Puffy. Switching some of my Apple machines over to dual-boot OpenBSD left a gaping hole in my workflow. Luckily, all the hard work the OpenBSD team has done over the last year seems to have plugged it nicely!
OpenBSD’s hypervisor support officially made it into the 6.1 release, but after some experimentation it was rather time consuming and too fragile to get a Linux guest up and running (i.e. basically the per-requisite for Docker). Others had reported some success starting with QEMU and doing lots of tinkering, but after a wasted evening I figured I’d grab the latest OpenBSD snapshot and try what the openbsd-misc list suggested was improved Linux support in active development.
10 (11) Steps to docker are provided
Step 0 — Install the latest OpenBSD 6.1 snapshot (-current)
Step 1 — Configure VMM/VMD
Step 2 — Grab an Alpine Linux ISO
Step 3 — Make a new virtual disk image
Step 4 — Boot Alpine’s ISO
Step 5 — Inhale that fresh Alpine air
Step 6 — Boot Alpine for Reals
Step 7 — Install Docker
Step 8 — Make a User
Step 9 — Ditch the Serial Console
Step 10 — Test out your Docker instance
I haven’t done it yet, but I plan on installing docker-compose via Python’s pip package manager. I prefer defining containers in the compose files.
PostgreSQL + ZFS Best Practices and Standard Procedures (https://people.freebsd.org/~seanc/postgresql/scale15x-2017-postgresql_zfs_best_practices.pdf)
Slides from Sean Chittenden’s talk about PostgreSQL and ZFS at Scale 15x this spring
Slides start with a good overview of Postgres and ZFS, and how to use them together
To start, it walks through the basics of how PostgreSQL interacts with the filesystem (any filesystem)
Then it shows the steps to take a good backup of PostgreSQL, then how to do it even better with ZFS
Then an intro to ZFS, and how Copy-on-Write changes host PostgreSQL interacts with the filesystem
Overview of how ZFS works
ZFS Tuning tips: Compression, Recordsize, atime, when to use mostly ARC vs sharedbuffer, plus pgrepack
Followed by a discussion of the reliability of SSDs, and their Bit Error Rate (BER)
A good SSD has a 4%/year chance of returning the wrong data. A cheap SSD 34%
If you put 20 SSDs in a database server, that means 58% (Good SSDs) to 99.975% (Lowest quality commercially viable SSD) chance of an error per year
Luckily, ZFS can detect and correct these errors
This applies to all storage, not just SSDs, every device fails
More Advice:
Use quotas and reservations to avoid running out of space
Schedule Periodic Scrubs
One dataset per database
Backups: Live demo of rm -rf’ing the database and getting it back
Using clones to test upgrades on real data
Naming Conventions:
Use a short prefix not on the root filesystem (e.g. /db)
Encode the PostgreSQL major version into the dataset name
Give each PostgreSQL cluster its own dataset (e.g. pgdb01)
Optional but recommended: one database per cluster
Optional but recommended: one app per database
Optional but recommended: encode environment into DB name
Optional but recommended: encode environment into DB username
using ZFS Replication
Check out the full detailed PDF and implement a similar setup for your database needs
***
News Roundup
TrueOS Evolving Its "Stable" Release Cycle (https://www.trueos.org/blog/housekeeping-update-infrastructure-trueos-changes/)
TrueOS is reformulating its Stable branch based on feedback from users. The goal is to have a “release” of the stable branch every 6 months, for those who do not want to live on the edge with the rapid updates of the full rolling release
Most of the TrueOS developers work for iX Systems in their Tennessee office. Last month, the Tennessee office was moved to a different location across town. As part of the move, we need to move all our servers. We’re still getting some of the infrastructure sorted before moving the servers, so please bear with us as we continue this process.
As we’ve continued working on TrueOS, we’ve heard a significant portion of the community asking for a more stable “STABLE” release of TrueOS, maybe something akin to an old PC-BSD version release. In order to meet that need, we’re redefining the TrueOS STABLE branch a bit. STABLE releases are now expected to follow a six month schedule, with more testing and lots of polish between releases. This gives users the option to step back a little from the “cutting edge” of development, but still enjoy many of the benefits of the “rolling release” style and the useful elements of FreeBSD Current.
Critical updates like emergency patches and utility bug fixes are still expected to be pushed to STABLE on a case-by-case basis, but again with more testing and polish. This also applies to version updates of the Lumina and SysAdm projects. New, released work from those projects will be tested and added to STABLE outside the 6 month window as well.
The UNSTABLE branch continues to be our experimental “cutting edge” track, and users who want to follow along with our development and help us or FreeBSD test new features are still encouraged to follow the UNSTABLE track by checking that setting in their TrueOS Update Manager.
With boot environments, it will be easy to switch back and forth, so you can have the best of both worlds. Use the latest bleeding edge features, but knowing you can fall back to the stable branch with just a reboot
As TrueOS evolves, it is becoming clearer that one role of the system is to function as a “test platform” for FreeBSD. In order to better serve this role, TrueOS will support both OpenRC and the FreeBSD RC init systems, giving users the choice to use either system. While the full functionality isn’t quite ready for the next STABLE update, it is planned for addition after the last bit of work and testing is complete. Stay tuned for an upcoming blog post with all the details of this change, along with instructions how to switch between RC and OpenRC.
This is the most important change for me. I used TrueOS as an easy way to run the latest version of -CURRENT on my laptop, to use it as a user, but also to do development. When TrueOS deviates from FreeBSD too much, it lessens the power of my expertise, and complicates development and debugging.
Being able to switch back to RC, even if it takes another minute to boot, will bring TrueOS back to being FreeBSD + GUI and more by default, instead of a science project.
We need both of those things, so having the option, while more work for the TrueOS team, I think will be better for the entire community
***
Logical Domains on SunFire T2000 with OpenBSD/sparc64 (http://www.h-i-r.net/2017/05/logical-domains-on-sunfire-t2000-with.html)
A couple of years ago, I picked up a Sun Fire T2000. This is a 2U rack mount server. Mine came with four 146GB SAS drives, a 32-core UltraSPARC T1 CPU and 32GB of RAM.
Sun Microsystems incorporated Logical Domains (LDOMs) on this class of hardware. You don't often need 32 threads and 32GB of RAM in a single server. LDOMs are a kind of virtualization technology that's a bit closer to bare metal than vmm, Hyper-V, VirtualBox or even Xen. It works a bit like Xen, though. You can allocate processor, memory, storage and other resources to virtual servers on-board, with a blend of firmware that supports the hardware allocation, and some software in userland (on the so-called primary or control domain, similar to Xen DomU) to control it.
LDOMs are similar to what IBM calls Logical Partitions (LPARs) on its Mainframe and POWER series computers. My day job from 2006-2010 involved working with both of these virtualization technologies, and I've kind of missed it.
While upgrading OpenBSD to 6.1 on my T2000, I decided to delve into LDOM support under OpenBSD. This was pretty easy to do, but let's walk through it
Resources:
The ldomctl(8) man page (http://man.openbsd.org/OpenBSD-current/man8/sparc64/ldomctl.8)
tedu@'s write-up on Flak (for a different class of server) (http://www.tedunangst.com/flak/post/OpenBSD-on-a-Sun-T5120)
A Google+ post by bmercer@ (https://plus.google.com/101694200911870273983/posts/jWh4rMKVq97)
Once you get comfortable with the fact that there's a little-tiny computer (the ALOM) powered by VXWorks inside that's acting as the management system and console (there's no screen or keyboard/mouse input), Installing OpenBSD on the base server is pretty straightforward. The serial console is an RJ-45 jack, and, yes, the ubiquitous blue-colored serial console cables you find for certain kinds of popular routers will work fine.
OpenBSD installs quite easily, with the same installer you find on amd64 and i386. I chose to install to /dev/sd0, the first SAS drive only, leaving the others unused. It's possible to set them up in a hardware RAID configuration using tools available only under Solaris, or use softraid(4) on OpenBSD, but I didn't do this.
I set up the primary LDOM to use the first ethernet port, em0. I decided I wanted to bridge the logical domains to the second ethernet port. You could also use a bridge and vether interface, with pf and dhcpd to create a NAT environment, similar to how I networked the vmm(4) systems.
Create an LDOM configuration file. You can put this anywhere that's convenient. All of this stuff was in a "vm" subdirectory of my home. I called it ldom.conf:
   domain primary {
       vcpu 8
       memory 8G
   }
   domain puffy {
       vcpu 8
       memory 4G
       vdisk "/home/axon/vm/ldom1"
       vnet
   }
Make as many disk images as you want, and make as many additional domain clauses as you wish. Be mindful of system resources. I couldn't actually allocate a full 32GB of RAM across all the LDOMs
I eventually provisioned seven LDOMs (in addition to the primary) on the T2000, each with 3GB of RAM and 4 vcpu cores. If you get creative with use of network interfaces, virtual ethernet, bridges and pf rules, you can run a pretty complex environment on a single chassis, with services that are only exposed to other VMs, a DMZ segment, and the internal LAN.
A nice tutorial, and an interesting look at an alternative platform that was ahead of its time
***
documentation is thoroughly hard (http://www.tedunangst.com/flak/post/documentation-is-thoroughly-hard)
Ted Unangst has a new post this week about documentation:
Documentation is good, so therefore more documentation must be better, right? A few examples where things may have gotten out of control
A fine example is the old OpenBSD install instructions. Once you’ve installed OpenBSD once or twice, the process is quite simple, but you’d never know this based on reading the instructions. Compare the files for 4.8 INSTALL and 5.8 INSTALL. Both begin with a brief intro to the project. Then 4.8 has an enormous list of mirrors, which seems fairly redundant if you’ve already found the install file. Followed by an enormous list of every supported variant of every supported device. Including a table of IO port configurations for ISA devices. Finally, after 1600 lines of introduction we get to the actual installation instructions. (Compared to line 231 for 5.8.) This includes a full page of text about how to install from tape, which nobody ever does. It took some time to recognize that all this documentation was actually an impediment to new users. Attempting to answer every possible question floods the reader with information for questions they were never planning to ask.
Part of the problem is how the information is organized. Theoretically it makes sense to list supported hardware before instructions. After all, you can’t install anything if it’s not supported, right? I’m sure that was considered when the device list was originally inserted above the install instructions. But as a practical matter, consulting a device list is neither the easiest nor fastest way to determine what actually works.
In the FreeBSD docs tree, we have been doing a facelift project, trying to add ‘quick start’ sections to each chapter to let you get to the more important information first. It is also helpful to move data in the forms of lists and tables to appendices or similar, where they can easily be references, but are not blocking your way to the information you are actually hunting for
An example of nerdview signage (http://languagelog.ldc.upenn.edu/nll/?p=29866). “They have in effect provided a sign that will tell you exactly what the question is provided you can already supply the answer.”
That is, the logical minds of technical people often decide to order information in an order that makes sense to them, rather than in the order that will be most useful to the reader
In the end, I think “copy diskimage to USB and follow prompts” is all the instructions one should need, but it’s hard to overcome the unease of actually making the jump. What if somebody is confused or uncertain? Why is this paragraph more redundant than that paragraph? (And if we delete both, are we cutting too much?)
Sometimes we don’t need to delete the information. Just hide it. The instructions to upgrade to 4.8 and upgrade to 5.8 are very similar, with a few differences because every release is a little bit different. The pages look very different, however, because the not at all recommended kernel free procedure, which takes up half the page, has been hidden from view behind some javascript and only expanded on demand. A casual browser will find the page and figure the upgrade process will be easy, as opposed to some long ordeal.
This is important as well, it was my original motivation for working on the FreeBSD Handbook’s ZFS chapter. The very first section of the chapter was the custom kernel configuration required to run ZFS on i386. That scared many users away. I moved that to the very end, and started with why you might want to use ZFS. Much more approachable.
Sometimes it’s just a tiny detail that’s overspecified. The apmd manual used to explain exactly which CPU idle time thresholds were used to adjust frequency. Those parameters, and the algorithm itself, were adjusted occasionally in response to user feedback, but sometimes the man page lagged behind. The numbers are of no use to a user. They’re not adjustable without recompiling. Knowing that the frequency would be reduced at 85% idle vs 90% idle doesn’t really offer much guidance as to whether to enable auto scaling or not. Deleting this detail ensured the man page was always correct and spares the user the cognitive load of trying to solve an unnecessary math problem.
For fun:
For another humorous example, it was recently observed that the deja-dup package provides man page translations for Australia, Canada, and Great Britain. I checked, the pages are in fact not quite identical. Some contain typo fixes that didn’t propagate to other translations. Project idea: attempt to identify which country has the most users, or most fastidious users, by bug fixes to localized man pages.
lldb on BeagleBone Black (https://lists.freebsd.org/pipermail/freebsd-arm/2017-May/016260.html)
I reliably managed to build (lldb + clang/lld) from the svn trunk of LLVM 5.0.0 on my Beaglebone Black running the latest snapshot (May 20th) of FreeBSD 12.0-CURRENT, and the lldb is working very well, and this includes single stepping and ncurses-GUI mode, while single stepping with the latest lldb 4.0.1 from the ports does not work.
In order to reliably build LLVM 5.0.0 (svn), I set up a 1 GB swap partition for the BBB on a NFSv4 share on a FreeBSD fileserver in my network - I put a howto of the procedure on my BLog: https://obsigna.net/?p=659
The prerequesites on the Beaglebone are:
```
pkg install tmux
pkg install cmake
pkg install python
pkg install libxml2
pkg install swig30
pkg install ninja
pkg install subversion
```
On the FreeBSD fileserver:
```
/pathtothe/bbb_share
svn co http://llvm.org/svn/llvm-project/llvm/trunk llvm
cd llvm/tools
svn co http://llvm.org/svn/llvm-project/cfe/trunk clang
svn co http://llvm.org/svn/llvm-project/lld/trunk lld
svn co http://llvm.org/svn/llvm-project/lldb/trunk lldb
```
+ On the Beaglebone Black:

 # mount_nfs -o noatime,readahead=4,intr,soft,nfsv4 server:/path_to_the/bbb_share /mnt
 # cd /mnt
 # mkdir build
 # cmake -DLLVM_TARGETS_TO_BUILD="ARM" -DCMAKE_BUILD_TYPE="MinSizeRel" \
        -DLLVM_PARALLEL_COMPILE_JOBS="1" -DLLVM_PARALLEL_LINK_JOBS="1" -G Ninja ..

I execute the actual build command from within a tmux session, so I may disconnect during the quite long (40 h) build:
```
tmux new "ninja lldb install"
```
When debugging in GUI mode using the newly build lldb 5.0.0-svn, I see only a minor issue, namely UTF8 strings are not displayed correctly. This happens in the ncurses-GUI only, and this is an ARM issue, since it does not occur on x86 machines. Perhaps this might be related to the signed/unsigned char mismatch between ARM and x86.
Beastie Bits
Triangle BSD Meetup on June 27th (https://www.meetup.com/Triangle-BSD-Users-Group/events/240247251/)
Support for Controller Area Networks (CAN) in NetBSD (http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20170521_0113.html)
Notes from Monday's meeting (http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2017-May/014104.html)
RunBSD - A site about the BSD family of operating systems (http://runbsd.info/)
BSDCam(bridge) 2017 Travel Grant Application Now Open (https://www.freebsdfoundation.org/blog/bsdcam-2017-travel-grant-application-now-open/)
New BSDMag has been released (https://bsdmag.org/download/nearly-online-zpool-switching-two-freebsd-machines/)
***
Feedback/Questions
Philipp - A show about byhve (http://dpaste.com/390F9JN#wrap)
Jake - byhve Support on AMD (http://dpaste.com/0DYG5BD#wrap)
CY - Pledge and Capsicum (http://dpaste.com/1YVBT12#wrap)
CY - OpenSSL relicense Issue (http://dpaste.com/3RSYV23#wrap)
Andy - Laptops (http://dpaste.com/0MM09EX#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSD Now, we review the EuroBSDcon schedule, we explore the mysteries of Docker on OpenBSD, and show you how to run PostgreSQL on ZFS.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://2017.eurobsdcon.org/2017/05/26/talks-schedule-published/" rel="nofollow">EuroBSDcon 2017 - Talks &amp; Schedule published</a></h3>

<ul>
<li>The EuroBSDcon website was updated with the tutorial and talk schedule for the upcoming September conference in Paris, France.</li>
<li>Tutorials on the 1st day: Kirk McKusick - An Introduction to the FreeBSD Open-Source Operating System, George Neville-Neil - DTrace for Developers, Taylor R Campbell - How to untangle your threads from a giant lock in a multiprocessor system</li>
<li>Tutorials on the 2nd day: Kirk continues his Introduction lecture, Michael Lucas - Core concepts of ZFS (half day), Benedict Reuschling - Managing BSD systems with Ansible (half day), Peter Hessler - BGP for developers and sysadmins</li>
<li>Talks include 3 keynotes (2 on the first day, beginning and end), another one at the end of the second day by Brendan Gregg</li>
<li>Good mixture of talks of the various BSD projects</li>
<li>Also, a good amount of new names and faces</li>
<li>Check out the full <a href="https://2017.eurobsdcon.org/talks-schedule/" rel="nofollow">talk schedule</a>.</li>
<li>Registration is not open yet, but will be soon.
***</li>
</ul>

<h3><a href="https://jcs.org/2017/05/22/xiaomiair" rel="nofollow">OpenBSD on the Xiaomi Mi Air 12.5&quot;</a></h3>

<blockquote>
<p>The <a href="https://xiaomi-mi.com/notebooks/xiaomi-mi-notebook-air-125-silver/" rel="nofollow">Xiaomi Mi Air 12.5&quot;</a> is a basic fanless 12.5&quot; Ultrabook with good build quality and decent hardware specs, especially for the money: while it can usually be had for about $600, I got mine for $489 shipped to the US during a sale about a month ago.<br>
Xiaomi offers this laptop in silver and gold. They also make a 13&quot; version but it comes with an NVidia graphics chip. Since these laptops are only sold in China, they come with a Chinese language version of Windows 10 and only one or two distributors that carry them ship to the US. Unfortunately that also means they come with practically no warranty or support.<br>
Hardware</p>
</blockquote>

<pre><code>&gt; The Mi Air 12.5&quot; has a fanless, 6th generation (Skylake) Intel Core m3 processor, 4Gb of soldered-on RAM, and a 128Gb SATA SSD (more on that later). It has a small footprint of 11.5&quot; wide, 8&quot; deep, and 0.5&quot; thick, and weighs 2.3 pounds.
&gt; A single USB-C port on the right-hand side is used to charge the laptop and provide USB connectivity. A USB-C ethernet adapter I tried worked fine in OpenBSD. Whether intentional or not, a particular design touch I appreciated was that the USB-C port is placed directly to the right of the power button on the keyboard, so you don&#39;t have to look or feel around for the port when plugging in the power cable.
&gt; A single USB 3 type-A port is also available on the right side next to the USB-C port. A full-size HDMI port and a headphone jack are on the left-hand side. It has a soldered-on Intel 8260 wireless adapter and Bluetooth. The webcam in the screen bezel attaches internally over USB.
&gt; The chassis is all aluminum and has sufficient rigidity in the keyboard area. The 12.5&quot; 1920x1080 glossy IPS screen has a fairly small bezel and while its hinge is properly weighted to allow opening the lid with one hand (if you care about that kind of thing), the screen does have a bit of top-end wobble when open, especially when typing on another laptop on the same desk.
&gt; The keyboard has a roomy layout and a nice clicky tactile with good travel. It is backlit, but with only one backlight level. When enabled via Fn+F10 (which is handled by the EC, so no OpenBSD support required), it will automatically shut off after not typing for a short while, automatically turning back once a key is pressed.
</code></pre>

<blockquote>
<p>Upgrades<br>
    &gt; An interesting feature of the Mi Air is that it comes with a 128Gb SATA SSD but also includes an open PCI-e slot ready to accept an NVMe SSD.<br>
    &gt; I upgraded mine with a Samsung PM961 256Gb NVMe SSD (left), and while it is possible to run with both drives in at the same time, I removed the Samsung CM871a 128Gb SATA (right) drive to save power.<br>
    &gt; The bottom case can be removed by removing the seven visible screws, in addition to the one under the foot in the middle back of the case, which just pries off. A spudger tool is needed to release all of the plastic attachment clips along the entire edge of the bottom cover.<br>
    &gt; Unfortunately this upgrade proved to be quite time consuming due to the combination of the limited UEFI firmware on the Mi Air and a bug in OpenBSD.</p>

<p>A Detour into UEFI Firmware Variables</p>
</blockquote>

<pre><code>&gt; Unlike a traditional BIOS where one can boot into a menu and configure the boot order as well as enabling and disabling options such as &quot;USB Hard Drive&quot;, the InsydeH2O UEFI firmware on the Xiaomi Air only provides the ability to adjust the boot order of existing devices. Any change or addition of boot devices must be done from the operating system, which is not possible under OpenBSD.
&gt; I booted to a USB key with OpenBSD on it and manually partitioned the new NVME SSD, then rsynced all of the data over from the old drive, but the laptop would not boot to the new NVME drive, instead showing an error message that there was no bootable OS.
&gt; Eventually I figured out that the GPT table that OpenBSD created on the NVMe disk was wrong due to a [one-off bug in the nvme driver](https://github.com/openbsd/src/commit/dc8298f669ea2d7e18c8a8efea509eed200cb989) which was causing the GPT table to be one sector too large, causing the backup GPT table to be written in the wrong location (and other utilities under Linux to write it over the OpenBSD area). I&#39;m guessing the UEFI firmware would fail to read the bad GPT table on the disk that the boot variable pointed to, then declare that disk as missing, and then remove any variables that pointed to that disk.
</code></pre>

<blockquote>
<p>OpenBSD Support</p>
</blockquote>

<pre><code>&gt; The Mi Air&#39;s soldered-on Intel 8260 wireless adapter is supported by OpenBSD&#39;s iwm driver, including 802.11n support. The Intel sound chip is recognized by the azalia driver.
&gt; The Synaptics touchpad is connected via I2C, but is not yet supported. I am actively hacking on my dwiic driver to make this work and the touchpad will hopefully operate as a Windows Precision Touchpad via imt so I don&#39;t have to write an entirely new Synaptics driver.
&gt; Unfortunately since OpenBSD&#39;s inteldrm support that is ported from Linux is lagging quite a bit behind, there is no kernel support for Skylake and Kaby Lake video chips. Xorg works at 1920x1080 through efifb so the machine is at least usable, but X is not very fast and there is a noticeable delay when doing certain redrawing operations in xterm. Screen backlight can be adjusted through my OpenBSD port of intel_backlight. Since there is no hardware graphics support, this also means that suspend and resume do not work because nothing is available to re-POST the video after resume. Having to use efifb also makes it impossible to adjust the screen gamma, so for me, I can&#39;t use redshift for comfortable night-time hacking.
</code></pre>

<blockquote>
<p>Flaws</p>
</blockquote>

<pre><code>&gt; Especially taking into account the cheap price of the laptop, it&#39;s hard to find faults with the design. One minor gripe is that the edges of the case along the bottom are quite sharp, so when carrying the closed laptop, it can feel uncomfortable in one&#39;s hands.
&gt; While all of those things could be overlooked, unfortunately there is also a critical flaw in the rollover support in the keyboard/EC on the laptop. When typing certain combinations of keys quickly, such as holding Shift and typing &quot;NULL&quot;, one&#39;s fingers may actually hold down the Shift, N, and U keys at the same time for a very brief moment before releasing N. Normally the keyboard/EC would recognize U being pressed after N is already down and send an interrupt for the U key. Unfortunately on this laptop, particular combinations of three keys do not interrupt for the third key at all until the second key is lifted, usually causing the third key not to register at all if typed quickly.
</code></pre>

<blockquote>
<p>I&#39;ve been able to reproduce this problem in OpenBSD, Linux, and Windows, with the combinations of at least Shift+N+U and Shift+D+F. Holding Shift and typing the two characters in sequence quickly enough will usually fail to register the final character. Trying the combinations without Shift, using Control or Alt instead of Shift, or other character pairs does not trigger the problem.<br>
This might be a problem in the firmware on the Embedded Controller, or a defect in the keyboard circuitry itself. As I mentioned at the beginning, getting technical support for this machine is difficult because it&#39;s only sold in China.</p>

<hr>
</blockquote>

<h3><a href="https://medium.com/@dave_voutila/docker-on-openbsd-6-1-current-c620513b8110" rel="nofollow">Docker on OpenBSD 6.1-current</a></h3>

<ul>
<li>Dave Voutila writes:</li>
</ul>

<blockquote>
<p>So here’s the thing. I’m normally a macOS user…all my hardware was designed in Cupertino, built in China. But I’m restless and have been toying with trying to switch my daily machine over to a non-macOS system sort of just for fun. I find Linux messy, FreeBSD not as Apple-laptop-friendly as it should be, and Windows a non-starter. Luckily, I found a friend in Puffy. Switching some of my Apple machines over to dual-boot OpenBSD left a gaping hole in my workflow. Luckily, all the hard work the OpenBSD team has done over the last year seems to have plugged it nicely!<br>
OpenBSD’s hypervisor support officially made it into the 6.1 release, but after some experimentation it was rather time consuming and too fragile to get a Linux guest up and running (i.e. basically the per-requisite for Docker). Others had reported some success starting with QEMU and doing lots of tinkering, but after a wasted evening I figured I’d grab the latest OpenBSD snapshot and try what the openbsd-misc list suggested was improved Linux support in active development.</p>
</blockquote>

<ul>
<li>10 (11) Steps to docker are provided

<ul>
<li>Step 0 — Install the latest OpenBSD 6.1 snapshot (-current)</li>
<li>Step 1 — Configure VMM/VMD</li>
<li>Step 2 — Grab an Alpine Linux ISO</li>
<li>Step 3 — Make a new virtual disk image</li>
<li>Step 4 — Boot Alpine’s ISO</li>
<li>Step 5 — Inhale that fresh Alpine air</li>
<li>Step 6 — Boot Alpine for Reals</li>
<li>Step 7 — Install Docker</li>
<li>Step 8 — Make a User</li>
<li>Step 9 — Ditch the Serial Console</li>
<li>Step 10 — Test out your Docker instance</li>
</ul></li>
</ul>

<blockquote>
<p>I haven’t done it yet, but I plan on installing docker-compose via Python’s pip package manager. I prefer defining containers in the compose files.</p>

<hr>
</blockquote>

<h3><a href="https://people.freebsd.org/%7Eseanc/postgresql/scale15x-2017-postgresql_zfs_best_practices.pdf" rel="nofollow">PostgreSQL + ZFS Best Practices and Standard Procedures</a></h3>

<ul>
<li>Slides from Sean Chittenden’s talk about PostgreSQL and ZFS at Scale 15x this spring</li>
<li>Slides start with a good overview of Postgres and ZFS, and how to use them together</li>
<li>To start, it walks through the basics of how PostgreSQL interacts with the filesystem (any filesystem)</li>
<li>Then it shows the steps to take a good backup of PostgreSQL, then how to do it even better with ZFS</li>
<li>Then an intro to ZFS, and how Copy-on-Write changes host PostgreSQL interacts with the filesystem</li>
<li>Overview of how ZFS works</li>
<li>ZFS Tuning tips: Compression, Recordsize, atime, when to use mostly ARC vs shared_buffer, plus pg_repack</li>
<li>Followed by a discussion of the reliability of SSDs, and their Bit Error Rate (BER)</li>
<li>A good SSD has a 4%/year chance of returning the wrong data. A cheap SSD 34%</li>
<li>If you put 20 SSDs in a database server, that means 58% (Good SSDs) to 99.975% (Lowest quality commercially viable SSD) chance of an error per year</li>
<li>Luckily, ZFS can detect and correct these errors</li>
<li>This applies to all storage, not just SSDs, every device fails</li>
<li>More Advice:

<ul>
<li>Use quotas and reservations to avoid running out of space</li>
<li>Schedule Periodic Scrubs</li>
<li>One dataset per database</li>
</ul></li>
<li>Backups: Live demo of rm -rf’ing the database and getting it back</li>
<li>Using clones to test upgrades on real data</li>
<li>Naming Conventions:

<ul>
<li>Use a short prefix not on the root filesystem (e.g. /db)</li>
<li>Encode the PostgreSQL major version into the dataset name</li>
<li>Give each PostgreSQL cluster its own dataset (e.g. pgdb01)</li>
<li>Optional but recommended: one database per cluster</li>
<li>Optional but recommended: one app per database</li>
<li>Optional but recommended: encode environment into DB name</li>
<li>Optional but recommended: encode environment into DB username</li>
</ul></li>
<li>using ZFS Replication</li>
<li>Check out the full detailed PDF and implement a similar setup for your database needs
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.trueos.org/blog/housekeeping-update-infrastructure-trueos-changes/" rel="nofollow">TrueOS Evolving Its &quot;Stable&quot; Release Cycle</a></h3>

<ul>
<li>TrueOS is reformulating its Stable branch based on feedback from users. The goal is to have a “release” of the stable branch every 6 months, for those who do not want to live on the edge with the rapid updates of the full rolling release</li>
</ul>

<blockquote>
<p>Most of the TrueOS developers work for iX Systems in their Tennessee office. Last month, the Tennessee office was moved to a different location across town. As part of the move, we need to move all our servers. We’re still getting some of the infrastructure sorted before moving the servers, so please bear with us as we continue this process.<br>
As we’ve continued working on TrueOS, we’ve heard a significant portion of the community asking for a more stable “STABLE” release of TrueOS, maybe something akin to an old PC-BSD version release. In order to meet that need, we’re redefining the TrueOS STABLE branch a bit. STABLE releases are now expected to follow a six month schedule, with more testing and lots of polish between releases. This gives users the option to step back a little from the “cutting edge” of development, but still enjoy many of the benefits of the “rolling release” style and the useful elements of FreeBSD Current.<br>
Critical updates like emergency patches and utility bug fixes are still expected to be pushed to STABLE on a case-by-case basis, but again with more testing and polish. This also applies to version updates of the Lumina and SysAdm projects. New, released work from those projects will be tested and added to STABLE outside the 6 month window as well.<br>
The UNSTABLE branch continues to be our experimental “cutting edge” track, and users who want to follow along with our development and help us or FreeBSD test new features are still encouraged to follow the UNSTABLE track by checking that setting in their TrueOS Update Manager.</p>
</blockquote>

<ul>
<li>With boot environments, it will be easy to switch back and forth, so you can have the best of both worlds. Use the latest bleeding edge features, but knowing you can fall back to the stable branch with just a reboot</li>
</ul>

<blockquote>
<p>As TrueOS evolves, it is becoming clearer that one role of the system is to function as a “test platform” for FreeBSD. In order to better serve this role, TrueOS will support both OpenRC and the FreeBSD RC init systems, giving users the choice to use either system. While the full functionality isn’t quite ready for the next STABLE update, it is planned for addition after the last bit of work and testing is complete. Stay tuned for an upcoming blog post with all the details of this change, along with instructions how to switch between RC and OpenRC.</p>
</blockquote>

<ul>
<li>This is the most important change for me. I used TrueOS as an easy way to run the latest version of -CURRENT on my laptop, to use it as a user, but also to do development. When TrueOS deviates from FreeBSD too much, it lessens the power of my expertise, and complicates development and debugging.</li>
<li>Being able to switch back to RC, even if it takes another minute to boot, will bring TrueOS back to being FreeBSD + GUI and more by default, instead of a science project.</li>
<li>We need both of those things, so having the option, while more work for the TrueOS team, I think will be better for the entire community
***</li>
</ul>

<h3><a href="http://www.h-i-r.net/2017/05/logical-domains-on-sunfire-t2000-with.html" rel="nofollow">Logical Domains on SunFire T2000 with OpenBSD/sparc64</a></h3>

<blockquote>
<p>A couple of years ago, I picked up a Sun Fire T2000. This is a 2U rack mount server. Mine came with four 146GB SAS drives, a 32-core UltraSPARC T1 CPU and 32GB of RAM.<br>
Sun Microsystems incorporated Logical Domains (LDOMs) on this class of hardware. You don&#39;t often need 32 threads and 32GB of RAM in a single server. LDOMs are a kind of virtualization technology that&#39;s a bit closer to bare metal than vmm, Hyper-V, VirtualBox or even Xen. It works a bit like Xen, though. You can allocate processor, memory, storage and other resources to virtual servers on-board, with a blend of firmware that supports the hardware allocation, and some software in userland (on the so-called primary or control domain, similar to Xen DomU) to control it.<br>
LDOMs are similar to what IBM calls Logical Partitions (LPARs) on its Mainframe and POWER series computers. My day job from 2006-2010 involved working with both of these virtualization technologies, and I&#39;ve kind of missed it.<br>
While upgrading OpenBSD to 6.1 on my T2000, I decided to delve into LDOM support under OpenBSD. This was pretty easy to do, but let&#39;s walk through it</p>
</blockquote>

<ul>
<li>Resources:

<ul>
<li><a href="http://man.openbsd.org/OpenBSD-current/man8/sparc64/ldomctl.8" rel="nofollow">The ldomctl(8) man page</a></li>
<li><a href="http://www.tedunangst.com/flak/post/OpenBSD-on-a-Sun-T5120" rel="nofollow">tedu@&#39;s write-up on Flak (for a different class of server)</a></li>
<li><a href="https://plus.google.com/101694200911870273983/posts/jWh4rMKVq97" rel="nofollow">A Google+ post by bmercer@</a></li>
</ul></li>
</ul>

<blockquote>
<p>Once you get comfortable with the fact that there&#39;s a little-tiny computer (the ALOM) powered by VXWorks inside that&#39;s acting as the management system and console (there&#39;s no screen or keyboard/mouse input), Installing OpenBSD on the base server is pretty straightforward. The serial console is an RJ-45 jack, and, yes, the ubiquitous blue-colored serial console cables you find for certain kinds of popular routers will work fine.<br>
OpenBSD installs quite easily, with the same installer you find on amd64 and i386. I chose to install to /dev/sd0, the first SAS drive only, leaving the others unused. It&#39;s possible to set them up in a hardware RAID configuration using tools available only under Solaris, or use softraid(4) on OpenBSD, but I didn&#39;t do this.<br>
I set up the primary LDOM to use the first ethernet port, em0. I decided I wanted to bridge the logical domains to the second ethernet port. You could also use a bridge and vether interface, with pf and dhcpd to create a NAT environment, similar to how I networked the vmm(4) systems.<br>
Create an LDOM configuration file. You can put this anywhere that&#39;s convenient. All of this stuff was in a &quot;vm&quot; subdirectory of my home. I called it ldom.conf:<br>
   domain primary {<br>
       vcpu 8<br>
       memory 8G<br>
   }<br>
   domain puffy {<br>
       vcpu 8<br>
       memory 4G<br>
       vdisk &quot;/home/axon/vm/ldom1&quot;<br>
       vnet<br>
   }</p>

<p>Make as many disk images as you want, and make as many additional domain clauses as you wish. Be mindful of system resources. I couldn&#39;t actually allocate a full 32GB of RAM across all the LDOMs<br>
I eventually provisioned seven LDOMs (in addition to the primary) on the T2000, each with 3GB of RAM and 4 vcpu cores. If you get creative with use of network interfaces, virtual ethernet, bridges and pf rules, you can run a pretty complex environment on a single chassis, with services that are only exposed to other VMs, a DMZ segment, and the internal LAN.</p>
</blockquote>

<ul>
<li>A nice tutorial, and an interesting look at an alternative platform that was ahead of its time
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/documentation-is-thoroughly-hard" rel="nofollow">documentation is thoroughly hard</a></h3>

<ul>
<li>Ted Unangst has a new post this week about documentation:</li>
</ul>

<blockquote>
<p>Documentation is good, so therefore more documentation must be better, right? A few examples where things may have gotten out of control<br>
A fine example is the old OpenBSD install instructions. Once you’ve installed OpenBSD once or twice, the process is quite simple, but you’d never know this based on reading the instructions. Compare the files for 4.8 INSTALL and 5.8 INSTALL. Both begin with a brief intro to the project. Then 4.8 has an enormous list of mirrors, which seems fairly redundant if you’ve already found the install file. Followed by an enormous list of every supported variant of every supported device. Including a table of IO port configurations for ISA devices. Finally, after 1600 lines of introduction we get to the actual installation instructions. (Compared to line 231 for 5.8.) This includes a full page of text about how to install from tape, which nobody ever does. It took some time to recognize that all this documentation was actually an impediment to new users. Attempting to answer every possible question floods the reader with information for questions they were never planning to ask.<br>
Part of the problem is how the information is organized. Theoretically it makes sense to list supported hardware before instructions. After all, you can’t install anything if it’s not supported, right? I’m sure that was considered when the device list was originally inserted above the install instructions. But as a practical matter, consulting a device list is neither the easiest nor fastest way to determine what actually works.</p>
</blockquote>

<ul>
<li>In the FreeBSD docs tree, we have been doing a facelift project, trying to add ‘quick start’ sections to each chapter to let you get to the more important information first. It is also helpful to move data in the forms of lists and tables to appendices or similar, where they can easily be references, but are not blocking your way to the information you are actually hunting for</li>
</ul>

<blockquote>
<p>An example of <a href="http://languagelog.ldc.upenn.edu/nll/?p=29866" rel="nofollow">nerdview signage</a>. “They have in effect provided a sign that will tell you exactly what the question is provided you can already supply the answer.”</p>
</blockquote>

<ul>
<li>That is, the logical minds of technical people often decide to order information in an order that makes sense to them, rather than in the order that will be most useful to the reader</li>
</ul>

<blockquote>
<p>In the end, I think “copy diskimage to USB and follow prompts” is all the instructions one should need, but it’s hard to overcome the unease of actually making the jump. What if somebody is confused or uncertain? Why is this paragraph more redundant than that paragraph? (And if we delete both, are we cutting too much?)<br>
Sometimes we don’t need to delete the information. Just hide it. The instructions to upgrade to 4.8 and upgrade to 5.8 are very similar, with a few differences because every release is a little bit different. The pages look very different, however, because the not at all recommended kernel free procedure, which takes up half the page, has been hidden from view behind some javascript and only expanded on demand. A casual browser will find the page and figure the upgrade process will be easy, as opposed to some long ordeal.</p>
</blockquote>

<ul>
<li>This is important as well, it was my original motivation for working on the FreeBSD Handbook’s ZFS chapter. The very first section of the chapter was the custom kernel configuration required to run ZFS on i386. That scared many users away. I moved that to the very end, and started with why you might want to use ZFS. Much more approachable.</li>
</ul>

<blockquote>
<p>Sometimes it’s just a tiny detail that’s overspecified. The apmd manual used to explain exactly which CPU idle time thresholds were used to adjust frequency. Those parameters, and the algorithm itself, were adjusted occasionally in response to user feedback, but sometimes the man page lagged behind. The numbers are of no use to a user. They’re not adjustable without recompiling. Knowing that the frequency would be reduced at 85% idle vs 90% idle doesn’t really offer much guidance as to whether to enable auto scaling or not. Deleting this detail ensured the man page was always correct and spares the user the cognitive load of trying to solve an unnecessary math problem.</p>
</blockquote>

<ul>
<li>For fun:</li>
</ul>

<blockquote>
<p>For another humorous example, it was recently observed that the deja-dup package provides man page translations for Australia, Canada, and Great Britain. I checked, the pages are in fact not quite identical. Some contain typo fixes that didn’t propagate to other translations. Project idea: attempt to identify which country has the most users, or most fastidious users, by bug fixes to localized man pages.</p>

<hr>
</blockquote>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-arm/2017-May/016260.html" rel="nofollow">lldb on BeagleBone Black</a></h3>

<blockquote>
<p>I reliably managed to build (lldb + clang/lld) from the svn trunk of LLVM 5.0.0 on my Beaglebone Black running the latest snapshot (May 20th) of FreeBSD 12.0-CURRENT, and the lldb is working very well, and this includes single stepping and ncurses-GUI mode, while single stepping with the latest lldb 4.0.1 from the ports does not work.<br>
In order to reliably build LLVM 5.0.0 (svn), I set up a 1 GB swap partition for the BBB on a NFSv4 share on a FreeBSD fileserver in my network - I put a howto of the procedure on my BLog: <a href="https://obsigna.net/?p=659" rel="nofollow">https://obsigna.net/?p=659</a></p>
</blockquote>

<ul>
<li>The prerequesites on the Beaglebone are:</li>
</ul>

<pre><code># pkg install tmux
# pkg install cmake
# pkg install python
# pkg install libxml2
# pkg install swig30
# pkg install ninja
# pkg install subversion
</code></pre>

<ul>
<li>On the FreeBSD fileserver:</li>
</ul>

<pre><code># /path_to_the/bbb_share
# svn co http://llvm.org/svn/llvm-project/llvm/trunk llvm
# cd llvm/tools
# svn co http://llvm.org/svn/llvm-project/cfe/trunk clang
# svn co http://llvm.org/svn/llvm-project/lld/trunk lld
# svn co http://llvm.org/svn/llvm-project/lldb/trunk lldb

</code></pre>

<ul>
<li>On the Beaglebone Black:</li>
</ul>

<pre><code> # mount_nfs -o noatime,readahead=4,intr,soft,nfsv4 server:/path_to_the/bbb_share /mnt
 # cd /mnt
 # mkdir build
 # cmake -DLLVM_TARGETS_TO_BUILD=&quot;ARM&quot; -DCMAKE_BUILD_TYPE=&quot;MinSizeRel&quot; \
        -DLLVM_PARALLEL_COMPILE_JOBS=&quot;1&quot; -DLLVM_PARALLEL_LINK_JOBS=&quot;1&quot; -G Ninja ..
</code></pre>

<blockquote>
<p>I execute the actual build command from within a tmux session, so I may disconnect during the quite long (40 h) build:</p>
</blockquote>

<pre><code># tmux new &quot;ninja lldb install&quot; 
</code></pre>

<blockquote>
<p>When debugging in GUI mode using the newly build lldb 5.0.0-svn, I see only a minor issue, namely UTF8 strings are not displayed correctly. This happens in the ncurses-GUI only, and this is an ARM issue, since it does not occur on x86 machines. Perhaps this might be related to the signed/unsigned char mismatch between ARM and x86.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.meetup.com/Triangle-BSD-Users-Group/events/240247251/" rel="nofollow">Triangle BSD Meetup on June 27th</a></li>
<li><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20170521_0113.html" rel="nofollow">Support for Controller Area Networks (CAN) in NetBSD</a></li>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2017-May/014104.html" rel="nofollow">Notes from Monday&#39;s meeting</a></li>
<li><a href="http://runbsd.info/" rel="nofollow">RunBSD - A site about the BSD family of operating systems</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcam-2017-travel-grant-application-now-open/" rel="nofollow">BSDCam(bridge) 2017 Travel Grant Application Now Open</a></li>
<li><a href="https://bsdmag.org/download/nearly-online-zpool-switching-two-freebsd-machines/" rel="nofollow">New BSDMag has been released</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/390F9JN#wrap" rel="nofollow">Philipp - A show about byhve</a></li>
<li><a href="http://dpaste.com/0DYG5BD#wrap" rel="nofollow">Jake - byhve Support on AMD</a></li>
<li><a href="http://dpaste.com/1YVBT12#wrap" rel="nofollow">CY - Pledge and Capsicum</a></li>
<li><a href="http://dpaste.com/3RSYV23#wrap" rel="nofollow">CY - OpenSSL relicense Issue</a></li>
<li><a href="http://dpaste.com/0MM09EX#wrap" rel="nofollow">Andy - Laptops</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSD Now, we review the EuroBSDcon schedule, we explore the mysteries of Docker on OpenBSD, and show you how to run PostgreSQL on ZFS.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://2017.eurobsdcon.org/2017/05/26/talks-schedule-published/" rel="nofollow">EuroBSDcon 2017 - Talks &amp; Schedule published</a></h3>

<ul>
<li>The EuroBSDcon website was updated with the tutorial and talk schedule for the upcoming September conference in Paris, France.</li>
<li>Tutorials on the 1st day: Kirk McKusick - An Introduction to the FreeBSD Open-Source Operating System, George Neville-Neil - DTrace for Developers, Taylor R Campbell - How to untangle your threads from a giant lock in a multiprocessor system</li>
<li>Tutorials on the 2nd day: Kirk continues his Introduction lecture, Michael Lucas - Core concepts of ZFS (half day), Benedict Reuschling - Managing BSD systems with Ansible (half day), Peter Hessler - BGP for developers and sysadmins</li>
<li>Talks include 3 keynotes (2 on the first day, beginning and end), another one at the end of the second day by Brendan Gregg</li>
<li>Good mixture of talks of the various BSD projects</li>
<li>Also, a good amount of new names and faces</li>
<li>Check out the full <a href="https://2017.eurobsdcon.org/talks-schedule/" rel="nofollow">talk schedule</a>.</li>
<li>Registration is not open yet, but will be soon.
***</li>
</ul>

<h3><a href="https://jcs.org/2017/05/22/xiaomiair" rel="nofollow">OpenBSD on the Xiaomi Mi Air 12.5&quot;</a></h3>

<blockquote>
<p>The <a href="https://xiaomi-mi.com/notebooks/xiaomi-mi-notebook-air-125-silver/" rel="nofollow">Xiaomi Mi Air 12.5&quot;</a> is a basic fanless 12.5&quot; Ultrabook with good build quality and decent hardware specs, especially for the money: while it can usually be had for about $600, I got mine for $489 shipped to the US during a sale about a month ago.<br>
Xiaomi offers this laptop in silver and gold. They also make a 13&quot; version but it comes with an NVidia graphics chip. Since these laptops are only sold in China, they come with a Chinese language version of Windows 10 and only one or two distributors that carry them ship to the US. Unfortunately that also means they come with practically no warranty or support.<br>
Hardware</p>
</blockquote>

<pre><code>&gt; The Mi Air 12.5&quot; has a fanless, 6th generation (Skylake) Intel Core m3 processor, 4Gb of soldered-on RAM, and a 128Gb SATA SSD (more on that later). It has a small footprint of 11.5&quot; wide, 8&quot; deep, and 0.5&quot; thick, and weighs 2.3 pounds.
&gt; A single USB-C port on the right-hand side is used to charge the laptop and provide USB connectivity. A USB-C ethernet adapter I tried worked fine in OpenBSD. Whether intentional or not, a particular design touch I appreciated was that the USB-C port is placed directly to the right of the power button on the keyboard, so you don&#39;t have to look or feel around for the port when plugging in the power cable.
&gt; A single USB 3 type-A port is also available on the right side next to the USB-C port. A full-size HDMI port and a headphone jack are on the left-hand side. It has a soldered-on Intel 8260 wireless adapter and Bluetooth. The webcam in the screen bezel attaches internally over USB.
&gt; The chassis is all aluminum and has sufficient rigidity in the keyboard area. The 12.5&quot; 1920x1080 glossy IPS screen has a fairly small bezel and while its hinge is properly weighted to allow opening the lid with one hand (if you care about that kind of thing), the screen does have a bit of top-end wobble when open, especially when typing on another laptop on the same desk.
&gt; The keyboard has a roomy layout and a nice clicky tactile with good travel. It is backlit, but with only one backlight level. When enabled via Fn+F10 (which is handled by the EC, so no OpenBSD support required), it will automatically shut off after not typing for a short while, automatically turning back once a key is pressed.
</code></pre>

<blockquote>
<p>Upgrades<br>
    &gt; An interesting feature of the Mi Air is that it comes with a 128Gb SATA SSD but also includes an open PCI-e slot ready to accept an NVMe SSD.<br>
    &gt; I upgraded mine with a Samsung PM961 256Gb NVMe SSD (left), and while it is possible to run with both drives in at the same time, I removed the Samsung CM871a 128Gb SATA (right) drive to save power.<br>
    &gt; The bottom case can be removed by removing the seven visible screws, in addition to the one under the foot in the middle back of the case, which just pries off. A spudger tool is needed to release all of the plastic attachment clips along the entire edge of the bottom cover.<br>
    &gt; Unfortunately this upgrade proved to be quite time consuming due to the combination of the limited UEFI firmware on the Mi Air and a bug in OpenBSD.</p>

<p>A Detour into UEFI Firmware Variables</p>
</blockquote>

<pre><code>&gt; Unlike a traditional BIOS where one can boot into a menu and configure the boot order as well as enabling and disabling options such as &quot;USB Hard Drive&quot;, the InsydeH2O UEFI firmware on the Xiaomi Air only provides the ability to adjust the boot order of existing devices. Any change or addition of boot devices must be done from the operating system, which is not possible under OpenBSD.
&gt; I booted to a USB key with OpenBSD on it and manually partitioned the new NVME SSD, then rsynced all of the data over from the old drive, but the laptop would not boot to the new NVME drive, instead showing an error message that there was no bootable OS.
&gt; Eventually I figured out that the GPT table that OpenBSD created on the NVMe disk was wrong due to a [one-off bug in the nvme driver](https://github.com/openbsd/src/commit/dc8298f669ea2d7e18c8a8efea509eed200cb989) which was causing the GPT table to be one sector too large, causing the backup GPT table to be written in the wrong location (and other utilities under Linux to write it over the OpenBSD area). I&#39;m guessing the UEFI firmware would fail to read the bad GPT table on the disk that the boot variable pointed to, then declare that disk as missing, and then remove any variables that pointed to that disk.
</code></pre>

<blockquote>
<p>OpenBSD Support</p>
</blockquote>

<pre><code>&gt; The Mi Air&#39;s soldered-on Intel 8260 wireless adapter is supported by OpenBSD&#39;s iwm driver, including 802.11n support. The Intel sound chip is recognized by the azalia driver.
&gt; The Synaptics touchpad is connected via I2C, but is not yet supported. I am actively hacking on my dwiic driver to make this work and the touchpad will hopefully operate as a Windows Precision Touchpad via imt so I don&#39;t have to write an entirely new Synaptics driver.
&gt; Unfortunately since OpenBSD&#39;s inteldrm support that is ported from Linux is lagging quite a bit behind, there is no kernel support for Skylake and Kaby Lake video chips. Xorg works at 1920x1080 through efifb so the machine is at least usable, but X is not very fast and there is a noticeable delay when doing certain redrawing operations in xterm. Screen backlight can be adjusted through my OpenBSD port of intel_backlight. Since there is no hardware graphics support, this also means that suspend and resume do not work because nothing is available to re-POST the video after resume. Having to use efifb also makes it impossible to adjust the screen gamma, so for me, I can&#39;t use redshift for comfortable night-time hacking.
</code></pre>

<blockquote>
<p>Flaws</p>
</blockquote>

<pre><code>&gt; Especially taking into account the cheap price of the laptop, it&#39;s hard to find faults with the design. One minor gripe is that the edges of the case along the bottom are quite sharp, so when carrying the closed laptop, it can feel uncomfortable in one&#39;s hands.
&gt; While all of those things could be overlooked, unfortunately there is also a critical flaw in the rollover support in the keyboard/EC on the laptop. When typing certain combinations of keys quickly, such as holding Shift and typing &quot;NULL&quot;, one&#39;s fingers may actually hold down the Shift, N, and U keys at the same time for a very brief moment before releasing N. Normally the keyboard/EC would recognize U being pressed after N is already down and send an interrupt for the U key. Unfortunately on this laptop, particular combinations of three keys do not interrupt for the third key at all until the second key is lifted, usually causing the third key not to register at all if typed quickly.
</code></pre>

<blockquote>
<p>I&#39;ve been able to reproduce this problem in OpenBSD, Linux, and Windows, with the combinations of at least Shift+N+U and Shift+D+F. Holding Shift and typing the two characters in sequence quickly enough will usually fail to register the final character. Trying the combinations without Shift, using Control or Alt instead of Shift, or other character pairs does not trigger the problem.<br>
This might be a problem in the firmware on the Embedded Controller, or a defect in the keyboard circuitry itself. As I mentioned at the beginning, getting technical support for this machine is difficult because it&#39;s only sold in China.</p>

<hr>
</blockquote>

<h3><a href="https://medium.com/@dave_voutila/docker-on-openbsd-6-1-current-c620513b8110" rel="nofollow">Docker on OpenBSD 6.1-current</a></h3>

<ul>
<li>Dave Voutila writes:</li>
</ul>

<blockquote>
<p>So here’s the thing. I’m normally a macOS user…all my hardware was designed in Cupertino, built in China. But I’m restless and have been toying with trying to switch my daily machine over to a non-macOS system sort of just for fun. I find Linux messy, FreeBSD not as Apple-laptop-friendly as it should be, and Windows a non-starter. Luckily, I found a friend in Puffy. Switching some of my Apple machines over to dual-boot OpenBSD left a gaping hole in my workflow. Luckily, all the hard work the OpenBSD team has done over the last year seems to have plugged it nicely!<br>
OpenBSD’s hypervisor support officially made it into the 6.1 release, but after some experimentation it was rather time consuming and too fragile to get a Linux guest up and running (i.e. basically the per-requisite for Docker). Others had reported some success starting with QEMU and doing lots of tinkering, but after a wasted evening I figured I’d grab the latest OpenBSD snapshot and try what the openbsd-misc list suggested was improved Linux support in active development.</p>
</blockquote>

<ul>
<li>10 (11) Steps to docker are provided

<ul>
<li>Step 0 — Install the latest OpenBSD 6.1 snapshot (-current)</li>
<li>Step 1 — Configure VMM/VMD</li>
<li>Step 2 — Grab an Alpine Linux ISO</li>
<li>Step 3 — Make a new virtual disk image</li>
<li>Step 4 — Boot Alpine’s ISO</li>
<li>Step 5 — Inhale that fresh Alpine air</li>
<li>Step 6 — Boot Alpine for Reals</li>
<li>Step 7 — Install Docker</li>
<li>Step 8 — Make a User</li>
<li>Step 9 — Ditch the Serial Console</li>
<li>Step 10 — Test out your Docker instance</li>
</ul></li>
</ul>

<blockquote>
<p>I haven’t done it yet, but I plan on installing docker-compose via Python’s pip package manager. I prefer defining containers in the compose files.</p>

<hr>
</blockquote>

<h3><a href="https://people.freebsd.org/%7Eseanc/postgresql/scale15x-2017-postgresql_zfs_best_practices.pdf" rel="nofollow">PostgreSQL + ZFS Best Practices and Standard Procedures</a></h3>

<ul>
<li>Slides from Sean Chittenden’s talk about PostgreSQL and ZFS at Scale 15x this spring</li>
<li>Slides start with a good overview of Postgres and ZFS, and how to use them together</li>
<li>To start, it walks through the basics of how PostgreSQL interacts with the filesystem (any filesystem)</li>
<li>Then it shows the steps to take a good backup of PostgreSQL, then how to do it even better with ZFS</li>
<li>Then an intro to ZFS, and how Copy-on-Write changes host PostgreSQL interacts with the filesystem</li>
<li>Overview of how ZFS works</li>
<li>ZFS Tuning tips: Compression, Recordsize, atime, when to use mostly ARC vs shared_buffer, plus pg_repack</li>
<li>Followed by a discussion of the reliability of SSDs, and their Bit Error Rate (BER)</li>
<li>A good SSD has a 4%/year chance of returning the wrong data. A cheap SSD 34%</li>
<li>If you put 20 SSDs in a database server, that means 58% (Good SSDs) to 99.975% (Lowest quality commercially viable SSD) chance of an error per year</li>
<li>Luckily, ZFS can detect and correct these errors</li>
<li>This applies to all storage, not just SSDs, every device fails</li>
<li>More Advice:

<ul>
<li>Use quotas and reservations to avoid running out of space</li>
<li>Schedule Periodic Scrubs</li>
<li>One dataset per database</li>
</ul></li>
<li>Backups: Live demo of rm -rf’ing the database and getting it back</li>
<li>Using clones to test upgrades on real data</li>
<li>Naming Conventions:

<ul>
<li>Use a short prefix not on the root filesystem (e.g. /db)</li>
<li>Encode the PostgreSQL major version into the dataset name</li>
<li>Give each PostgreSQL cluster its own dataset (e.g. pgdb01)</li>
<li>Optional but recommended: one database per cluster</li>
<li>Optional but recommended: one app per database</li>
<li>Optional but recommended: encode environment into DB name</li>
<li>Optional but recommended: encode environment into DB username</li>
</ul></li>
<li>using ZFS Replication</li>
<li>Check out the full detailed PDF and implement a similar setup for your database needs
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.trueos.org/blog/housekeeping-update-infrastructure-trueos-changes/" rel="nofollow">TrueOS Evolving Its &quot;Stable&quot; Release Cycle</a></h3>

<ul>
<li>TrueOS is reformulating its Stable branch based on feedback from users. The goal is to have a “release” of the stable branch every 6 months, for those who do not want to live on the edge with the rapid updates of the full rolling release</li>
</ul>

<blockquote>
<p>Most of the TrueOS developers work for iX Systems in their Tennessee office. Last month, the Tennessee office was moved to a different location across town. As part of the move, we need to move all our servers. We’re still getting some of the infrastructure sorted before moving the servers, so please bear with us as we continue this process.<br>
As we’ve continued working on TrueOS, we’ve heard a significant portion of the community asking for a more stable “STABLE” release of TrueOS, maybe something akin to an old PC-BSD version release. In order to meet that need, we’re redefining the TrueOS STABLE branch a bit. STABLE releases are now expected to follow a six month schedule, with more testing and lots of polish between releases. This gives users the option to step back a little from the “cutting edge” of development, but still enjoy many of the benefits of the “rolling release” style and the useful elements of FreeBSD Current.<br>
Critical updates like emergency patches and utility bug fixes are still expected to be pushed to STABLE on a case-by-case basis, but again with more testing and polish. This also applies to version updates of the Lumina and SysAdm projects. New, released work from those projects will be tested and added to STABLE outside the 6 month window as well.<br>
The UNSTABLE branch continues to be our experimental “cutting edge” track, and users who want to follow along with our development and help us or FreeBSD test new features are still encouraged to follow the UNSTABLE track by checking that setting in their TrueOS Update Manager.</p>
</blockquote>

<ul>
<li>With boot environments, it will be easy to switch back and forth, so you can have the best of both worlds. Use the latest bleeding edge features, but knowing you can fall back to the stable branch with just a reboot</li>
</ul>

<blockquote>
<p>As TrueOS evolves, it is becoming clearer that one role of the system is to function as a “test platform” for FreeBSD. In order to better serve this role, TrueOS will support both OpenRC and the FreeBSD RC init systems, giving users the choice to use either system. While the full functionality isn’t quite ready for the next STABLE update, it is planned for addition after the last bit of work and testing is complete. Stay tuned for an upcoming blog post with all the details of this change, along with instructions how to switch between RC and OpenRC.</p>
</blockquote>

<ul>
<li>This is the most important change for me. I used TrueOS as an easy way to run the latest version of -CURRENT on my laptop, to use it as a user, but also to do development. When TrueOS deviates from FreeBSD too much, it lessens the power of my expertise, and complicates development and debugging.</li>
<li>Being able to switch back to RC, even if it takes another minute to boot, will bring TrueOS back to being FreeBSD + GUI and more by default, instead of a science project.</li>
<li>We need both of those things, so having the option, while more work for the TrueOS team, I think will be better for the entire community
***</li>
</ul>

<h3><a href="http://www.h-i-r.net/2017/05/logical-domains-on-sunfire-t2000-with.html" rel="nofollow">Logical Domains on SunFire T2000 with OpenBSD/sparc64</a></h3>

<blockquote>
<p>A couple of years ago, I picked up a Sun Fire T2000. This is a 2U rack mount server. Mine came with four 146GB SAS drives, a 32-core UltraSPARC T1 CPU and 32GB of RAM.<br>
Sun Microsystems incorporated Logical Domains (LDOMs) on this class of hardware. You don&#39;t often need 32 threads and 32GB of RAM in a single server. LDOMs are a kind of virtualization technology that&#39;s a bit closer to bare metal than vmm, Hyper-V, VirtualBox or even Xen. It works a bit like Xen, though. You can allocate processor, memory, storage and other resources to virtual servers on-board, with a blend of firmware that supports the hardware allocation, and some software in userland (on the so-called primary or control domain, similar to Xen DomU) to control it.<br>
LDOMs are similar to what IBM calls Logical Partitions (LPARs) on its Mainframe and POWER series computers. My day job from 2006-2010 involved working with both of these virtualization technologies, and I&#39;ve kind of missed it.<br>
While upgrading OpenBSD to 6.1 on my T2000, I decided to delve into LDOM support under OpenBSD. This was pretty easy to do, but let&#39;s walk through it</p>
</blockquote>

<ul>
<li>Resources:

<ul>
<li><a href="http://man.openbsd.org/OpenBSD-current/man8/sparc64/ldomctl.8" rel="nofollow">The ldomctl(8) man page</a></li>
<li><a href="http://www.tedunangst.com/flak/post/OpenBSD-on-a-Sun-T5120" rel="nofollow">tedu@&#39;s write-up on Flak (for a different class of server)</a></li>
<li><a href="https://plus.google.com/101694200911870273983/posts/jWh4rMKVq97" rel="nofollow">A Google+ post by bmercer@</a></li>
</ul></li>
</ul>

<blockquote>
<p>Once you get comfortable with the fact that there&#39;s a little-tiny computer (the ALOM) powered by VXWorks inside that&#39;s acting as the management system and console (there&#39;s no screen or keyboard/mouse input), Installing OpenBSD on the base server is pretty straightforward. The serial console is an RJ-45 jack, and, yes, the ubiquitous blue-colored serial console cables you find for certain kinds of popular routers will work fine.<br>
OpenBSD installs quite easily, with the same installer you find on amd64 and i386. I chose to install to /dev/sd0, the first SAS drive only, leaving the others unused. It&#39;s possible to set them up in a hardware RAID configuration using tools available only under Solaris, or use softraid(4) on OpenBSD, but I didn&#39;t do this.<br>
I set up the primary LDOM to use the first ethernet port, em0. I decided I wanted to bridge the logical domains to the second ethernet port. You could also use a bridge and vether interface, with pf and dhcpd to create a NAT environment, similar to how I networked the vmm(4) systems.<br>
Create an LDOM configuration file. You can put this anywhere that&#39;s convenient. All of this stuff was in a &quot;vm&quot; subdirectory of my home. I called it ldom.conf:<br>
   domain primary {<br>
       vcpu 8<br>
       memory 8G<br>
   }<br>
   domain puffy {<br>
       vcpu 8<br>
       memory 4G<br>
       vdisk &quot;/home/axon/vm/ldom1&quot;<br>
       vnet<br>
   }</p>

<p>Make as many disk images as you want, and make as many additional domain clauses as you wish. Be mindful of system resources. I couldn&#39;t actually allocate a full 32GB of RAM across all the LDOMs<br>
I eventually provisioned seven LDOMs (in addition to the primary) on the T2000, each with 3GB of RAM and 4 vcpu cores. If you get creative with use of network interfaces, virtual ethernet, bridges and pf rules, you can run a pretty complex environment on a single chassis, with services that are only exposed to other VMs, a DMZ segment, and the internal LAN.</p>
</blockquote>

<ul>
<li>A nice tutorial, and an interesting look at an alternative platform that was ahead of its time
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/documentation-is-thoroughly-hard" rel="nofollow">documentation is thoroughly hard</a></h3>

<ul>
<li>Ted Unangst has a new post this week about documentation:</li>
</ul>

<blockquote>
<p>Documentation is good, so therefore more documentation must be better, right? A few examples where things may have gotten out of control<br>
A fine example is the old OpenBSD install instructions. Once you’ve installed OpenBSD once or twice, the process is quite simple, but you’d never know this based on reading the instructions. Compare the files for 4.8 INSTALL and 5.8 INSTALL. Both begin with a brief intro to the project. Then 4.8 has an enormous list of mirrors, which seems fairly redundant if you’ve already found the install file. Followed by an enormous list of every supported variant of every supported device. Including a table of IO port configurations for ISA devices. Finally, after 1600 lines of introduction we get to the actual installation instructions. (Compared to line 231 for 5.8.) This includes a full page of text about how to install from tape, which nobody ever does. It took some time to recognize that all this documentation was actually an impediment to new users. Attempting to answer every possible question floods the reader with information for questions they were never planning to ask.<br>
Part of the problem is how the information is organized. Theoretically it makes sense to list supported hardware before instructions. After all, you can’t install anything if it’s not supported, right? I’m sure that was considered when the device list was originally inserted above the install instructions. But as a practical matter, consulting a device list is neither the easiest nor fastest way to determine what actually works.</p>
</blockquote>

<ul>
<li>In the FreeBSD docs tree, we have been doing a facelift project, trying to add ‘quick start’ sections to each chapter to let you get to the more important information first. It is also helpful to move data in the forms of lists and tables to appendices or similar, where they can easily be references, but are not blocking your way to the information you are actually hunting for</li>
</ul>

<blockquote>
<p>An example of <a href="http://languagelog.ldc.upenn.edu/nll/?p=29866" rel="nofollow">nerdview signage</a>. “They have in effect provided a sign that will tell you exactly what the question is provided you can already supply the answer.”</p>
</blockquote>

<ul>
<li>That is, the logical minds of technical people often decide to order information in an order that makes sense to them, rather than in the order that will be most useful to the reader</li>
</ul>

<blockquote>
<p>In the end, I think “copy diskimage to USB and follow prompts” is all the instructions one should need, but it’s hard to overcome the unease of actually making the jump. What if somebody is confused or uncertain? Why is this paragraph more redundant than that paragraph? (And if we delete both, are we cutting too much?)<br>
Sometimes we don’t need to delete the information. Just hide it. The instructions to upgrade to 4.8 and upgrade to 5.8 are very similar, with a few differences because every release is a little bit different. The pages look very different, however, because the not at all recommended kernel free procedure, which takes up half the page, has been hidden from view behind some javascript and only expanded on demand. A casual browser will find the page and figure the upgrade process will be easy, as opposed to some long ordeal.</p>
</blockquote>

<ul>
<li>This is important as well, it was my original motivation for working on the FreeBSD Handbook’s ZFS chapter. The very first section of the chapter was the custom kernel configuration required to run ZFS on i386. That scared many users away. I moved that to the very end, and started with why you might want to use ZFS. Much more approachable.</li>
</ul>

<blockquote>
<p>Sometimes it’s just a tiny detail that’s overspecified. The apmd manual used to explain exactly which CPU idle time thresholds were used to adjust frequency. Those parameters, and the algorithm itself, were adjusted occasionally in response to user feedback, but sometimes the man page lagged behind. The numbers are of no use to a user. They’re not adjustable without recompiling. Knowing that the frequency would be reduced at 85% idle vs 90% idle doesn’t really offer much guidance as to whether to enable auto scaling or not. Deleting this detail ensured the man page was always correct and spares the user the cognitive load of trying to solve an unnecessary math problem.</p>
</blockquote>

<ul>
<li>For fun:</li>
</ul>

<blockquote>
<p>For another humorous example, it was recently observed that the deja-dup package provides man page translations for Australia, Canada, and Great Britain. I checked, the pages are in fact not quite identical. Some contain typo fixes that didn’t propagate to other translations. Project idea: attempt to identify which country has the most users, or most fastidious users, by bug fixes to localized man pages.</p>

<hr>
</blockquote>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-arm/2017-May/016260.html" rel="nofollow">lldb on BeagleBone Black</a></h3>

<blockquote>
<p>I reliably managed to build (lldb + clang/lld) from the svn trunk of LLVM 5.0.0 on my Beaglebone Black running the latest snapshot (May 20th) of FreeBSD 12.0-CURRENT, and the lldb is working very well, and this includes single stepping and ncurses-GUI mode, while single stepping with the latest lldb 4.0.1 from the ports does not work.<br>
In order to reliably build LLVM 5.0.0 (svn), I set up a 1 GB swap partition for the BBB on a NFSv4 share on a FreeBSD fileserver in my network - I put a howto of the procedure on my BLog: <a href="https://obsigna.net/?p=659" rel="nofollow">https://obsigna.net/?p=659</a></p>
</blockquote>

<ul>
<li>The prerequesites on the Beaglebone are:</li>
</ul>

<pre><code># pkg install tmux
# pkg install cmake
# pkg install python
# pkg install libxml2
# pkg install swig30
# pkg install ninja
# pkg install subversion
</code></pre>

<ul>
<li>On the FreeBSD fileserver:</li>
</ul>

<pre><code># /path_to_the/bbb_share
# svn co http://llvm.org/svn/llvm-project/llvm/trunk llvm
# cd llvm/tools
# svn co http://llvm.org/svn/llvm-project/cfe/trunk clang
# svn co http://llvm.org/svn/llvm-project/lld/trunk lld
# svn co http://llvm.org/svn/llvm-project/lldb/trunk lldb

</code></pre>

<ul>
<li>On the Beaglebone Black:</li>
</ul>

<pre><code> # mount_nfs -o noatime,readahead=4,intr,soft,nfsv4 server:/path_to_the/bbb_share /mnt
 # cd /mnt
 # mkdir build
 # cmake -DLLVM_TARGETS_TO_BUILD=&quot;ARM&quot; -DCMAKE_BUILD_TYPE=&quot;MinSizeRel&quot; \
        -DLLVM_PARALLEL_COMPILE_JOBS=&quot;1&quot; -DLLVM_PARALLEL_LINK_JOBS=&quot;1&quot; -G Ninja ..
</code></pre>

<blockquote>
<p>I execute the actual build command from within a tmux session, so I may disconnect during the quite long (40 h) build:</p>
</blockquote>

<pre><code># tmux new &quot;ninja lldb install&quot; 
</code></pre>

<blockquote>
<p>When debugging in GUI mode using the newly build lldb 5.0.0-svn, I see only a minor issue, namely UTF8 strings are not displayed correctly. This happens in the ncurses-GUI only, and this is an ARM issue, since it does not occur on x86 machines. Perhaps this might be related to the signed/unsigned char mismatch between ARM and x86.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.meetup.com/Triangle-BSD-Users-Group/events/240247251/" rel="nofollow">Triangle BSD Meetup on June 27th</a></li>
<li><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20170521_0113.html" rel="nofollow">Support for Controller Area Networks (CAN) in NetBSD</a></li>
<li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2017-May/014104.html" rel="nofollow">Notes from Monday&#39;s meeting</a></li>
<li><a href="http://runbsd.info/" rel="nofollow">RunBSD - A site about the BSD family of operating systems</a></li>
<li><a href="https://www.freebsdfoundation.org/blog/bsdcam-2017-travel-grant-application-now-open/" rel="nofollow">BSDCam(bridge) 2017 Travel Grant Application Now Open</a></li>
<li><a href="https://bsdmag.org/download/nearly-online-zpool-switching-two-freebsd-machines/" rel="nofollow">New BSDMag has been released</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/390F9JN#wrap" rel="nofollow">Philipp - A show about byhve</a></li>
<li><a href="http://dpaste.com/0DYG5BD#wrap" rel="nofollow">Jake - byhve Support on AMD</a></li>
<li><a href="http://dpaste.com/1YVBT12#wrap" rel="nofollow">CY - Pledge and Capsicum</a></li>
<li><a href="http://dpaste.com/3RSYV23#wrap" rel="nofollow">CY - OpenSSL relicense Issue</a></li>
<li><a href="http://dpaste.com/0MM09EX#wrap" rel="nofollow">Andy - Laptops</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>195: I don’t WannaCry</title>
  <link>https://www.bsdnow.tv/195</link>
  <guid isPermaLink="false">f0dd8ba0-2788-4d18-aa36-6cb27f74de37</guid>
  <pubDate>Wed, 24 May 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f0dd8ba0-2788-4d18-aa36-6cb27f74de37.mp3" length="54181588" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A pledge of love to OpenBSD, combating ransomware like WannaCry with OpenZFS, and using PFsense to maximize your non-gigabit Internet connection</itunes:subtitle>
  <itunes:duration>1:15:15</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A pledge of love to OpenBSD, combating ransomware like WannaCry with OpenZFS, and using PFsense to maximize your non-gigabit Internet connection
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
ino64 project committed to FreeBSD 12-CURRENT (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=318736)
The ino64 project has been completed and merged into FreeBSD 12-CURRENT
Extend the inot, devt, nlinkt types to 64-bit ints.  Modify struct dirent layout to add doff, increase the size of dfileno to 64-bits, increase the size of dnamlen to 16-bits, and change the required alignment.  Increase struct statfs fmntfromname[] and fmntonname[] array length MNAMELEN to 1024
This means the length of a mount point (MNAMELEN) has been increased from 88 byte to 1024 bytes. This allows longer ZFS dataset names and more nesting, and generally improves the usefulness of nested jails
It also allow more than 4 billion files to be stored in a single file system (both UFS and ZFS). It also deals with a number of NFS problems, such as Amazon’s EFS (cloud NFS), which uses 64 bit IDs even with small numbers of files.
ABI breakage is mitigated by providing compatibility using versioned symbols, ingenious use of the existing padding in structures, and by employing other tricks.  Unfortunately, not everything can be fixed, especially outside the base system.  For instance, third-party APIs which pass struct stat around are broken in backward and forward incompatible ways.
A bug in poudriere that may cause some packages to not rebuild is being fixed. Many packages like perl will need to be rebuilt after this change
Update note: strictly follow the instructions in UPDATING.  Build and install the new kernel with COMPAT_FREEBSD11 option enabled, then reboot, and only then install new world.
So you need the new GENERIC kernel with the COMPAT_FREEBSD11 option, so that your old userland will work with the new kernel, and you need to build, install, and reboot onto the new kernel before attempting to install world. The usual process of installing both and then rebooting will NOT WORK
Credits: The 64-bit inode project, also known as ino64, started life many years ago as a project by Gleb Kurtsou (gleb).  Kirk McKusick (mckusick) then picked up and updated the patch, and acted as a flag-waver.  Feedback, suggestions, and discussions were carried by Ed Maste (emaste), John Baldwin (jhb), Jilles Tjoelker (jilles), and Rick Macklem (rmacklem).  Kris Moore (kmoore) performed an initial ports investigation followed by an exp-run by Antoine Brodin (antoine). Essential and all-embracing testing was done by Peter Holm (pho). The heavy lifting of coordinating all these efforts and bringing the project to completion were done by Konstantin Belousov (kib).
Sponsored by:    The FreeBSD Foundation (emaste, kib)
Why I love OpenBSD (https://medium.com/@h3artbl33d/why-i-love-openbsd-ca760cf53941)
Jeroen Janssen writes:
I do love open source software. Oh boy, I really do love open source software. It’s extendable, auditable, and customizable. What’s not to love?
I’m astonished by the idea that tens, hundreds, and sometimes even thousands of enthusiastic, passionate developers collaborate on an idea. Together, they make the world a better place, bit by bit.
And this leads me to one of my favorite open source projects: the 22-year-old OpenBSD operating system.
The origins of my love affair with OpenBSD
From Linux to *BSD
The advantages of OpenBSD
It’s extremely secure
It’s well documented
It’s open source
    &amp;gt; It’s neat and clean
My take on OpenBSD
** DO **
Combating WannaCry and Other Ransomware with OpenZFS Snapshots (https://www.ixsystems.com/blog/combating-ransomware/)
Ransomware attacks that hold your data hostage using unauthorized data encryption are spreading rapidly and are particularly nefarious because they do not require any special access privileges to your data. A ransomware attack may be launched via a sophisticated software exploit as was the case with the recent “WannaCry” ransomware, but there is nothing stopping you from downloading and executing a malicious program that encrypts every file you have access to. If you fail to pay the ransom, the result will be indistinguishable from your simply deleting every file on your system. To make matters worse, ransomware authors are expanding their attacks to include just about any storage you have access to. The list is long, but includes network shares, Cloud services like DropBox, and even “shadow copies” of data that allow you to open previous versions of files.
To make matters even worse, there is little that your operating system can do to prevent you or a program you run from encrypting files with ransomware just as it can’t prevent you from deleting the files you own. Frequent backups are touted as one of the few effective strategies for recovering from ransomware attacks but it is critical that any backup be isolated from the attack to be immune from the same attack. Simply copying your files to a mounted disk on your computer or in the Cloud makes the backup vulnerable to infection by virtue of the fact that you are backing up using your regular permissions. If you can write to it, the ransomware can encrypt it. Like medical workers wearing hazmat suits for isolation when combating an epidemic, you need to isolate your backups from ransomware.
OpenZFS snapshots to the rescue
OpenZFS is the powerful file system at the heart of every storage system that iXsystems sells and of its many features, snapshots can provide fast and effective recovery from ransomware attacks at both the individual user and enterprise level as I talked about in 2015. As a copy-on-write file system, OpenZFS provides efficient and consistent snapshots of your data at any given point in time. Each snapshot only includes the precise delta of changes between any two points in time and can be cloned to provide writable copies of any previous state without losing the original copy. Snapshots also provide the basis of OpenZFS replication or backing up of your data to local and remote systems. Because an OpenZFS snapshot takes place at the block level of the file system, it is immune to any file-level encryption by ransomware that occurs over it. A carefully-planned snapshot, replication, retention, and restoration strategy can provide the low-level isolation you need to enable your storage infrastructure to quickly recover from ransomware attacks.
OpenZFS snapshots in practice
While OpenZFS is available on a number of desktop operating systems such as TrueOS and macOS, the most effective way to bring the benefits of OpenZFS snapshots to the largest number of users is with a network of iXsystems TrueNAS, FreeNAS Certified and FreeNAS Mini unified NAS and SAN storage systems. All of these can provide OpenZFS-backed SMB, NFS, AFP, and iSCSI file and block storage to the smallest workgroups up through the largest enterprises and TrueNAS offers available Fibre Channel for enterprise deployments. By sharing your data to your users using these file and block protocols, you can provide them with a storage infrastructure that can quickly recover from any ransomware attack thrown at it. To mitigate ransomware attacks against individual workstations, TrueNAS and FreeNAS can provide snapshotted storage to your VDI or virtualization solution of choice. Best of all, every iXsystems TrueNAS, FreeNAS Certified, and FreeNAS Mini system includes a consistent user interface and the ability to replicate between one another. This means that any topology of individual offices and campuses can exchange backup data to quickly mitigate ransomware attacks on your organization at all levels.
Join us for a free webinar (http://www.onlinemeetingnow.com/register/?id=uegudsbc75) with iXsystems Co-Founder Matt Olander and learn more about why businesses everywhere are replacing their proprietary storage platforms with TrueNAS then email us at info@ixsystems.com or call 1-855-GREP-4-IX (1-855-473-7449), or 1-408-493-4100 (outside the US) to discuss your storage needs with one of our solutions architects.
Interview - Michael W. Lucas - mwlucas@michaelwlucas.com (mailto:mwlucas@michaelwlucas.com) / @twitter (https://twitter.com/mwlauthor)
Books, conferences, and how these two combine
+ BR: Welcome back. Tell us what you’ve been up to since the last time we interviewed you regarding books and such.
+ AJ: Tell us a little bit about relayd and what it can do.
+ BR: What other books do you have in the pipeline?
+ AJ: What are your criteria that qualifies a topic for a mastery book?
+ BR: Can you tell us a little bit about these writing workshops that you attend and what happens there?
+ AJ: Without spoiling too much: How did you come up with the idea for git commit murder?
+ BR: Speaking of BSDCan, can you tell the first timers about what to expect in the http://www.bsdcan.org/2017/schedule/events/890.en.html (Newcomers orientation and mentorship) session on Thursday?
+ AJ: Tell us about the new WIP session at BSDCan. Who had the idea and how much input did you get thus far?
+ BR: Have you ever thought about branching off into a new genre like children’s books or medieval fantasy novels?
+ AJ: Is there anything else before we let you go?
News Roundup
Using LLDP on FreeBSD (https://tetragir.com/freebsd/networking/using-lldp-on-freebsd.html)
LLDP, or Link Layer Discovery Protocol allows system administrators to easily map the network, eliminating the need to physically run the cables in a rack. LLDP is a protocol used to send and receive information about a neighboring device connected directly to a networking interface. It is similar to Cisco’s CDP, Foundry’s FDP, Nortel’s SONMP, etc. It is a stateless protocol, meaning that an LLDP-enabled device sends advertisements even if the other side cannot do anything with it. In this guide the installation and configuration of the LLDP daemon on FreeBSD as well as on a Cisco switch will be introduced.
If you are already familiar with Cisco’s CDP, LLDP won’t surprise you. It is built for the same purpose: to exchange device information between peers on a network. While CDP is a proprietary solution and can be used only on Cisco devices, LLDP is a standard: IEEE 802.3AB. Therefore it is implemented on many types of devices, such as switches, routers, various desktop operating systems, etc. LLDP helps a great deal in mapping the network topology, without spending hours in cabling cabinets to figure out which device is connected with which switchport. If LLDP is running on both the networking device and the server, it can show which port is connected where. Besides physical interfaces, LLDP can be used to exchange a lot more information, such as IP Address, hostname, etc.
In order to use LLDP on FreeBSD, net-mgmt/lldpd has to be installed. It can be installed from ports using portmaster: #portmaster net-mgmt/lldpd Or from packages: #pkg install net-mgmt/lldpd By default lldpd sends and receives all the information it can gather , so it is advisable to limit what we will communicate with the neighboring device.
The configuration file for lldpd is basically a list of commands as it is passed to lldpcli. Create a file named lldpd.conf under /usr/local/etc/ The following configuration gives an example of how lldpd can be configured. For a full list of options, see %man lldpcli
To check what is configured locally, run #lldpcli show chassis detail
To see the neighbors run #lldpcli show neighbors details
Check out the rest of the article about enabling LLDP on a Cisco switch
experiments with prepledge (http://www.tedunangst.com/flak/post/experiments-with-prepledge)
Ted Unangst takes a crack at a system similar to the one being designed for Capsicum, Oblivious Sandboxing (See the presentation at BSDCan), where the application doesn’t even know it is in the sandbox
MP3 is officially dead, so I figure I should listen to my collection one last time before it vanishes entirely. The provenance of some of these files is a little suspect however, and since I know one shouldn’t open files from strangers, I’d like to take some precautions against malicious malarkey. This would be a good use for pledge, perhaps, if we can get it working.
At the same time, an occasional feature request for pledge is the ability to specify restrictions before running a program. Given some untrusted program, wrap its execution in a pledge like environment. There are other system call sandbox mechanisms that can do this (systrace was one), but pledge is quite deliberately designed not to support this. But maybe we can bend it to our will.
Our pledge wrapper can’t be an external program. This leaves us with the option of injecting the wrapper into the target program via LD_PRELOAD. Before main even runs, we’ll initialize what needs initializing, then lock things down with a tight pledge set. Our eventual target will be ffplay, but hopefully the design will permit some flexibility and reuse.
So the new code is injected to override the open syscall, and reads a list of files from an environment variable. Those files are opened and the path and file descriptor are put into a linked list, and then pledge is used to restrict further access to the file system. The replacement open call now searches just that linked list, returning the already opened file descriptors.
So as long as your application only tries to open files that you have preopened, it can function without modification within the sandbox. Or at least that is the goal...
ffplay tries to dlopen() some things, and because of the way dlopen() works, it doesn’t go via the libc open() wrapper, so it doesn’t get overridden
ffplay also tries to call a few ioctl’s, not allowed
After stubbing both of those out, it still doesn’t work and it is just getting worse
Ted switches to a new strategy, using ffmpeg to convert the .mp3 to a .wav file and then just cat it to /dev/audio
A few more stubs for ffmpeg, including access(), and adding tty access to the list of pledges, and it finally works
This point has been made from the early days, but I think this exercise reinforces it, that pledge works best with programs where you understand what the program is doing. A generic pledge wrapper isn’t of much use because the program is going to do something unexpected and you’re going to have a hard time wrangling it into submission.
Software is too complex. What in the world is ffplay doing? Even if I were working with the source, how long would it take to rearrange the program into something that could be pledged? One can try using another program, but I would wager that as far as multiformat media players go, ffplay is actually on the lower end of the complexity spectrum. Most of the trouble comes from using SDL as an abstraction layer, which performs a bunch of console operations.
On the flip side, all of this early init code is probably the right design. Once SDL finally gets its screen handle setup, we could apply pledge and sandbox the actual media decoder. That would be the right way to things.
Is pledge too limiting? Perhaps, but that’s what I want. I could have just kept adding permissions until ffplay had full access to my X socket, but what kind of sandbox is that? I don’t want naughty MP3s scraping my screen and spying on my keystrokes. The sandbox I created had all the capabilities one needs to convert an MP3 to audible sound, but the tool I wanted to use wasn’t designed to work in that environment. And in its defense, these were new post hoc requirements. Other programs, even sed, suffer from less than ideal pledge sets as well. The best summary might be to say that pledge is designed for tomorrow’s programs, not yesterday’s (and vice versa).
There were a few things I could have done better. In particular, I gave up getting audio to work, even though there’s a nice description of how to work with pledge in the sio_open manual. Alas, even going back and with a bit more effort I still haven’t succeeded. The requirements to use libsndio are more permissive than I might prefer.
How I Maximized the Speed of My Non-Gigabit Internet Connection (https://medium.com/speedtest-by-ookla/engineer-maximizes-internet-speed-story-c3ec0e86f37a)
We have a new post from Brennen Smith, who is the Lead Systems Engineer at Ookla, the company that runs Speedtest.net, explaining how he used pfSense to maximize his internet connection
I spend my time wrangling servers and internet infrastructure. My daily goals range from designing high performance applications supporting millions of users and testing the fastest internet connections in the world, to squeezing microseconds from our stack —so at home, I strive to make sure that my personal internet performance is running as fast as possible.
I live in an area with a DOCSIS ISP that does not provide symmetrical gigabit internet — my download and upload speeds are not equal. Instead, I have an asymmetrical plan with 200 Mbps download and 10 Mbps upload — this nuance considerably impacted my network design because asymmetrical service can more easily lead to bufferbloat.
We will cover bufferbloat in a later article, but in a nutshell, it’s an issue that arises when an upstream network device’s buffers are saturated during an upload. This causes immense network congestion, latency to rise above 2,000 ms., and overall poor quality of internet. The solution is to shape the outbound traffic to a speed just under the sending maximum of the upstream device, so that its buffers don’t fill up. My ISP is notorious for having bufferbloat issues due to the low upload performance, and it’s an issue prevalent even on their provided routers.
They walk through a list of router devices you might consider, and what speeds they are capable of handling, but ultimately ended up using a generic low power x86 machine running pfSense 2.3
In my research and testing, I also evaluated IPCop, VyOS, OPNSense, Sophos UTM, RouterOS, OpenWRT x86, and Alpine Linux to serve as the base operating system, but none were as well supported and full featured as PFSense.
The main setting to look at is the traffic shaping of uploads, to keep the pipe from getting saturated and having a large buffer build up in the modem and further upstream. This build up is what increases the latency of the connection
As with any experiment, any conclusions need to be backed with data. To validate the network was performing smoothly under heavy load, I performed the following experiment:
+ Ran a ping6 against speedtest.net to measure latency.
+ Turned off QoS to simulate a “normal router”.
+ Started multiple simultaneous outbound TCP and UDP streams to saturate my outbound link.
+ Turned on QoS to the above settings and repeated steps 2 and 3.
As you can see from the plot below, without QoS, my connection latency increased by ~1,235%. However with QoS enabled, the connection stayed stable during the upload and I wasn’t able to determine a statistically significant delta.
That’s how I maximized the speed on my non-gigabit internet connection. What have you done with your network?
FreeBSD on 11″ MacBook Air (https://www.geeklan.co.uk/?p=2214)
Sevan Janiyan writes in his tech blog about his experiences running FreeBSD on an 11’’ MacBook Air
This tiny machine has been with me for a few years now, It has mostly run OS X though I have tried OpenBSD on it (https://www.geeklan.co.uk/?p=1283). Besides the screen resolution I’m still really happy with it, hardware wise. Software wise, not so much. I use an external disk containing a zpool with my data on it. Among this data are several source trees. CVS on a ZFS filesystem on OS X is painfully slow. I dislike that builds running inside Terminal.app are slow at the expense of a responsive UI. The system seems fragile, at the slightest push the machine will either hang or become unresponsive. Buggy serial drivers which do not implement the break signal and cause instability are frustrating.
Last week whilst working on Rump kernel (http://rumpkernel.org/) builds I introduced some new build issues in the process of fixing others, I needed to pick up new changes from CVS by updating my copy of the source tree and run builds to test if issues were still present.
I was let down on both counts, it took ages to update source and in the process of cross compiling a NetBSD/evbmips64-el release, the system locked hard. That was it, time to look what was possible elsewhere. While I have been using OS X for many years, I’m not tied to anything exclusive on it, maybe tweetbot, perhaps, but that’s it.
On the BSDnow podcast they’ve been covering changes coming in to TrueOS (formerly PC-BSD – a desktop focused distro based on FreeBSD), their experiments seemed interesting, the project now tracks FreeBSD-CURRENT, they’ve replaced rcng with OpenRC as the init system and it comes with a pre-configured desktop environment, using their own window manager (Lumina). Booting the USB flash image it made it to X11 without any issue. The dock has a widget which states the detected features, no wifi (Broadcom), sound card detected and screen resolution set to 1366×768. I planned to give it a try on the weekend. Friday, I made backups and wiped the system. TrueOS installed without issue, after a short while I had a working desktop, resuming from sleep worked out of the box. I didn’t spend long testing TrueOS, switching out NetBSD-HEAD only to realise that I really need ZFS so while I was testing things out, might as well give stock FreeBSD 11-STABLE a try (TrueOS was based on -CURRENT).
Turns out sleep doesn’t work yet but sound does work out of the box and with a few invocations of pkg(8) I had xorg, dwm, firefox, CVS and virtuabox-ose installed from binary packages. VirtualBox seems to cause the system to panic (bug 219276) but I should be able to survive without my virtual machines over the next few days as I settle in. I’m considering ditching VirtualBox and converting the vdi files to raw images so that they can be written to a new zvol for use with bhyve. As my default keyboard layout is Dvorak, OS X set the EFI settings to this layout. The first time I installed FreeBSD 11-STABLE, I opted for full disk encryption but ran into this odd issue where on boot the keyboard layout was Dvorak and password was accepted, the system would boot and as it went to mount the various filesystems it would switch back to QWERTY. I tried entering my password with both layout but wasn’t able to progress any further, no bug report yet as I haven’t ruled myself out as the problem.
Thunderbolt gigabit adapter –bge(4) (https://www.freebsd.org/cgi/man.cgi?query=bge) and DVI adapter both worked on FreeBSD though the gigabit adapter needs to be plugged in at boot to be detected. The trackpad bind to wsp(4) (https://www.freebsd.org/cgi/man.cgi?query=wsp), left, right and middle clicks are available through single, double and tripple finger tap. Sound card binds to snd_hda(4) (https://www.freebsd.org/cgi/man.cgi?query=snd_hda) and works out of the box.
For wifi I’m using a urtw(4) (https://www.freebsd.org/cgi/man.cgi?query=urtw) Alfa adapter which is a bit on the large side but works very reliably.  A copy of the dmesg (https://www.geeklan.co.uk/files/macbookair/freebsd-dmesg.txt) is here.
Beastie Bits
OPNsense - call-for-testing for SafeStack (https://forum.opnsense.org/index.php?topic=5200.0)
BSD 4.4: cat (https://www.rewritinghistorycasts.com/screencasts/bsd-4.4:-cat)
Continuous Unix commit history from 1970 until today (https://github.com/dspinellis/unix-history-repo)
Update on Unix Architecture Evolution Diagrams (https://www.spinellis.gr/blog/20170510/)
“Relayd and Httpd Mastery” is out! (https://blather.michaelwlucas.com/archives/2951)
Triangle BSD User Group Meeting -- libxo (https://www.meetup.com/Triangle-BSD-Users-Group/events/240247251/)
***
Feedback/Questions
Carlos - ASUS Tinkerboard (http://dpaste.com/1GJHPNY#wrap)
James - Firewall question (http://dpaste.com/0QCW933#wrap)
Adam - ZFS books (http://dpaste.com/0GMG5M2#wrap)
David - Managing zvols (http://dpaste.com/2GP8H1E#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A pledge of love to OpenBSD, combating ransomware like WannaCry with OpenZFS, and using PFsense to maximize your non-gigabit Internet connection</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=318736" rel="nofollow">ino64 project committed to FreeBSD 12-CURRENT</a></h3>

<ul>
<li>The ino64 project has been completed and merged into FreeBSD 12-CURRENT</li>
</ul>

<blockquote>
<p>Extend the ino_t, dev_t, nlink_t types to 64-bit ints.  Modify struct dirent layout to add d_off, increase the size of d_fileno to 64-bits, increase the size of d_namlen to 16-bits, and change the required alignment.  Increase struct statfs f_mntfromname[] and f_mntonname[] array length MNAMELEN to 1024</p>
</blockquote>

<ul>
<li>This means the length of a mount point (MNAMELEN) has been increased from 88 byte to 1024 bytes. This allows longer ZFS dataset names and more nesting, and generally improves the usefulness of nested jails</li>
<li>It also allow more than 4 billion files to be stored in a single file system (both UFS and ZFS). It also deals with a number of NFS problems, such as Amazon’s EFS (cloud NFS), which uses 64 bit IDs even with small numbers of files.</li>
</ul>

<blockquote>
<p>ABI breakage is mitigated by providing compatibility using versioned symbols, ingenious use of the existing padding in structures, and by employing other tricks.  Unfortunately, not everything can be fixed, especially outside the base system.  For instance, third-party APIs which pass struct stat around are broken in backward and forward incompatible ways.</p>
</blockquote>

<ul>
<li>A bug in poudriere that may cause some packages to not rebuild is being fixed. Many packages like perl will need to be rebuilt after this change</li>
</ul>

<blockquote>
<p>Update note: strictly follow the instructions in UPDATING.  Build and install the new kernel with COMPAT_FREEBSD11 option enabled, then reboot, and only then install new world.</p>
</blockquote>

<ul>
<li>So you need the new GENERIC kernel with the COMPAT_FREEBSD11 option, so that your old userland will work with the new kernel, and you need to build, install, and reboot onto the new kernel before attempting to install world. The usual process of installing both and then rebooting will NOT WORK</li>
</ul>

<blockquote>
<p>Credits: The 64-bit inode project, also known as ino64, started life many years ago as a project by Gleb Kurtsou (gleb).  Kirk McKusick (mckusick) then picked up and updated the patch, and acted as a flag-waver.  Feedback, suggestions, and discussions were carried by Ed Maste (emaste), John Baldwin (jhb), Jilles Tjoelker (jilles), and Rick Macklem (rmacklem).  Kris Moore (kmoore) performed an initial ports investigation followed by an exp-run by Antoine Brodin (antoine). Essential and all-embracing testing was done by Peter Holm (pho). The heavy lifting of coordinating all these efforts and bringing the project to completion were done by Konstantin Belousov (kib).</p>

<p>Sponsored by:    The FreeBSD Foundation (emaste, kib)</p>
</blockquote>

<hr>

<h3><a href="https://medium.com/@h3artbl33d/why-i-love-openbsd-ca760cf53941" rel="nofollow">Why I love OpenBSD</a></h3>

<ul>
<li>Jeroen Janssen writes:</li>
</ul>

<blockquote>
<p>I do love open source software. Oh boy, I really do love open source software. It’s extendable, auditable, and customizable. What’s not to love?<br>
I’m astonished by the idea that tens, hundreds, and sometimes even thousands of enthusiastic, passionate developers collaborate on an idea. Together, they make the world a better place, bit by bit.<br>
And this leads me to one of my favorite open source projects: the 22-year-old OpenBSD operating system.<br>
The origins of my love affair with OpenBSD<br>
From Linux to *BSD<br>
The advantages of OpenBSD</p>

<p>It’s extremely secure<br>
It’s well documented<br>
It’s open source<br>
    &gt; It’s neat and clean</p>

<p>My take on OpenBSD</p>
</blockquote>

<hr>

<p>** DO **</p>

<h3><a href="https://www.ixsystems.com/blog/combating-ransomware/" rel="nofollow">Combating WannaCry and Other Ransomware with OpenZFS Snapshots</a></h3>

<blockquote>
<p>Ransomware attacks that hold your data hostage using unauthorized data encryption are spreading rapidly and are particularly nefarious because they do not require any special access privileges to your data. A ransomware attack may be launched via a sophisticated software exploit as was the case with the recent “WannaCry” ransomware, but there is nothing stopping you from downloading and executing a malicious program that encrypts every file you have access to. If you fail to pay the ransom, the result will be indistinguishable from your simply deleting every file on your system. To make matters worse, ransomware authors are expanding their attacks to include just about any storage you have access to. The list is long, but includes network shares, Cloud services like DropBox, and even “shadow copies” of data that allow you to open previous versions of files.<br>
To make matters even worse, there is little that your operating system can do to prevent you or a program you run from encrypting files with ransomware just as it can’t prevent you from deleting the files you own. Frequent backups are touted as one of the few effective strategies for recovering from ransomware attacks but it is critical that any backup be isolated from the attack to be immune from the same attack. Simply copying your files to a mounted disk on your computer or in the Cloud makes the backup vulnerable to infection by virtue of the fact that you are backing up using your regular permissions. If you can write to it, the ransomware can encrypt it. Like medical workers wearing hazmat suits for isolation when combating an epidemic, you need to isolate your backups from ransomware.<br>
OpenZFS snapshots to the rescue<br>
OpenZFS is the powerful file system at the heart of every storage system that iXsystems sells and of its many features, snapshots can provide fast and effective recovery from ransomware attacks at both the individual user and enterprise level as I talked about in 2015. As a copy-on-write file system, OpenZFS provides efficient and consistent snapshots of your data at any given point in time. Each snapshot only includes the precise delta of changes between any two points in time and can be cloned to provide writable copies of any previous state without losing the original copy. Snapshots also provide the basis of OpenZFS replication or backing up of your data to local and remote systems. Because an OpenZFS snapshot takes place at the block level of the file system, it is immune to any file-level encryption by ransomware that occurs over it. A carefully-planned snapshot, replication, retention, and restoration strategy can provide the low-level isolation you need to enable your storage infrastructure to quickly recover from ransomware attacks.<br>
OpenZFS snapshots in practice<br>
While OpenZFS is available on a number of desktop operating systems such as TrueOS and macOS, the most effective way to bring the benefits of OpenZFS snapshots to the largest number of users is with a network of iXsystems TrueNAS, FreeNAS Certified and FreeNAS Mini unified NAS and SAN storage systems. All of these can provide OpenZFS-backed SMB, NFS, AFP, and iSCSI file and block storage to the smallest workgroups up through the largest enterprises and TrueNAS offers available Fibre Channel for enterprise deployments. By sharing your data to your users using these file and block protocols, you can provide them with a storage infrastructure that can quickly recover from any ransomware attack thrown at it. To mitigate ransomware attacks against individual workstations, TrueNAS and FreeNAS can provide snapshotted storage to your VDI or virtualization solution of choice. Best of all, every iXsystems TrueNAS, FreeNAS Certified, and FreeNAS Mini system includes a consistent user interface and the ability to replicate between one another. This means that any topology of individual offices and campuses can exchange backup data to quickly mitigate ransomware attacks on your organization at all levels.<br>
Join us for a <a href="http://www.onlinemeetingnow.com/register/?id=uegudsbc75" rel="nofollow">free webinar</a> with iXsystems Co-Founder Matt Olander and learn more about why businesses everywhere are replacing their proprietary storage platforms with TrueNAS then email us at <a href="mailto:info@ixsystems.com" rel="nofollow">info@ixsystems.com</a> or call 1-855-GREP-4-IX (1-855-473-7449), or 1-408-493-4100 (outside the US) to discuss your storage needs with one of our solutions architects.</p>
</blockquote>

<hr>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com" rel="nofollow">mwlucas@michaelwlucas.com</a> / <a href="https://twitter.com/mwlauthor" rel="nofollow">@twitter</a></h2>

<p>Books, conferences, and how these two combine</p>

<ul>
<li>BR: Welcome back. Tell us what you’ve been up to since the last time we interviewed you regarding books and such.</li>
<li>AJ: Tell us a little bit about relayd and what it can do.</li>
<li>BR: What other books do you have in the pipeline?</li>
<li>AJ: What are your criteria that qualifies a topic for a mastery book?</li>
<li>BR: Can you tell us a little bit about these writing workshops that you attend and what happens there?</li>
<li>AJ: Without spoiling too much: How did you come up with the idea for git commit murder?</li>
<li>BR: Speaking of BSDCan, can you tell the first timers about what to expect in the [<a href="http://www.bsdcan.org/2017/schedule/events/890.en.html%5D(Newcomers" rel="nofollow">http://www.bsdcan.org/2017/schedule/events/890.en.html](Newcomers</a> orientation and mentorship) session on Thursday?</li>
<li>AJ: Tell us about the new WIP session at BSDCan. Who had the idea and how much input did you get thus far?</li>
<li>BR: Have you ever thought about branching off into a new genre like children’s books or medieval fantasy novels?</li>
<li>AJ: Is there anything else before we let you go?
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://tetragir.com/freebsd/networking/using-lldp-on-freebsd.html" rel="nofollow">Using LLDP on FreeBSD</a></h3>

<blockquote>
<p>LLDP, or Link Layer Discovery Protocol allows system administrators to easily map the network, eliminating the need to physically run the cables in a rack. LLDP is a protocol used to send and receive information about a neighboring device connected directly to a networking interface. It is similar to Cisco’s CDP, Foundry’s FDP, Nortel’s SONMP, etc. It is a stateless protocol, meaning that an LLDP-enabled device sends advertisements even if the other side cannot do anything with it. In this guide the installation and configuration of the LLDP daemon on FreeBSD as well as on a Cisco switch will be introduced.<br>
If you are already familiar with Cisco’s CDP, LLDP won’t surprise you. It is built for the same purpose: to exchange device information between peers on a network. While CDP is a proprietary solution and can be used only on Cisco devices, LLDP is a standard: IEEE 802.3AB. Therefore it is implemented on many types of devices, such as switches, routers, various desktop operating systems, etc. LLDP helps a great deal in mapping the network topology, without spending hours in cabling cabinets to figure out which device is connected with which switchport. If LLDP is running on both the networking device and the server, it can show which port is connected where. Besides physical interfaces, LLDP can be used to exchange a lot more information, such as IP Address, hostname, etc.<br>
In order to use LLDP on FreeBSD, net-mgmt/lldpd has to be installed. It can be installed from ports using portmaster: #portmaster net-mgmt/lldpd Or from packages: #pkg install net-mgmt/lldpd By default lldpd sends and receives all the information it can gather , so it is advisable to limit what we will communicate with the neighboring device.<br>
The configuration file for lldpd is basically a list of commands as it is passed to lldpcli. Create a file named lldpd.conf under /usr/local/etc/ The following configuration gives an example of how lldpd can be configured. For a full list of options, see %man lldpcli<br>
To check what is configured locally, run #lldpcli show chassis detail<br>
To see the neighbors run #lldpcli show neighbors details</p>
</blockquote>

<ul>
<li>Check out the rest of the article about enabling LLDP on a Cisco switch</li>
</ul>

<hr>

<h3><a href="http://www.tedunangst.com/flak/post/experiments-with-prepledge" rel="nofollow">experiments with prepledge</a></h3>

<ul>
<li><p>Ted Unangst takes a crack at a system similar to the one being designed for Capsicum, Oblivious Sandboxing (See the presentation at BSDCan), where the application doesn’t even know it is in the sandbox</p>

<blockquote>
<p>MP3 is officially dead, so I figure I should listen to my collection one last time before it vanishes entirely. The provenance of some of these files is a little suspect however, and since I know one shouldn’t open files from strangers, I’d like to take some precautions against malicious malarkey. This would be a good use for pledge, perhaps, if we can get it working.<br>
At the same time, an occasional feature request for pledge is the ability to specify restrictions before running a program. Given some untrusted program, wrap its execution in a pledge like environment. There are other system call sandbox mechanisms that can do this (systrace was one), but pledge is quite deliberately designed not to support this. But maybe we can bend it to our will.<br>
Our pledge wrapper can’t be an external program. This leaves us with the option of injecting the wrapper into the target program via LD_PRELOAD. Before main even runs, we’ll initialize what needs initializing, then lock things down with a tight pledge set. Our eventual target will be ffplay, but hopefully the design will permit some flexibility and reuse.</p>
</blockquote></li>
<li><p>So the new code is injected to override the open syscall, and reads a list of files from an environment variable. Those files are opened and the path and file descriptor are put into a linked list, and then pledge is used to restrict further access to the file system. The replacement open call now searches just that linked list, returning the already opened file descriptors.</p></li>
<li><p>So as long as your application only tries to open files that you have preopened, it can function without modification within the sandbox. Or at least that is the goal...</p></li>
<li><p>ffplay tries to dlopen() some things, and because of the way dlopen() works, it doesn’t go via the libc open() wrapper, so it doesn’t get overridden</p></li>
<li><p>ffplay also tries to call a few ioctl’s, not allowed</p></li>
<li><p>After stubbing both of those out, it still doesn’t work and it is just getting worse</p></li>
<li><p>Ted switches to a new strategy, using ffmpeg to convert the .mp3 to a .wav file and then just cat it to /dev/audio</p></li>
<li><p>A few more stubs for ffmpeg, including access(), and adding tty access to the list of pledges, and it finally works</p></li>
</ul>

<blockquote>
<p>This point has been made from the early days, but I think this exercise reinforces it, that pledge works best with programs where you understand what the program is doing. A generic pledge wrapper isn’t of much use because the program is going to do something unexpected and you’re going to have a hard time wrangling it into submission.<br>
Software is too complex. What in the world is ffplay doing? Even if I were working with the source, how long would it take to rearrange the program into something that could be pledged? One can try using another program, but I would wager that as far as multiformat media players go, ffplay is actually on the lower end of the complexity spectrum. Most of the trouble comes from using SDL as an abstraction layer, which performs a bunch of console operations.<br>
On the flip side, all of this early init code is probably the right design. Once SDL finally gets its screen handle setup, we could apply pledge and sandbox the actual media decoder. That would be the right way to things.<br>
Is pledge too limiting? Perhaps, but that’s what I want. I could have just kept adding permissions until ffplay had full access to my X socket, but what kind of sandbox is that? I don’t want naughty MP3s scraping my screen and spying on my keystrokes. The sandbox I created had all the capabilities one needs to convert an MP3 to audible sound, but the tool I wanted to use wasn’t designed to work in that environment. And in its defense, these were new post hoc requirements. Other programs, even sed, suffer from less than ideal pledge sets as well. The best summary might be to say that pledge is designed for tomorrow’s programs, not yesterday’s (and vice versa).<br>
There were a few things I could have done better. In particular, I gave up getting audio to work, even though there’s a nice description of how to work with pledge in the sio_open manual. Alas, even going back and with a bit more effort I still haven’t succeeded. The requirements to use libsndio are more permissive than I might prefer.</p>

<hr>
</blockquote>

<h3><a href="https://medium.com/speedtest-by-ookla/engineer-maximizes-internet-speed-story-c3ec0e86f37a" rel="nofollow">How I Maximized the Speed of My Non-Gigabit Internet Connection</a></h3>

<ul>
<li>We have a new post from Brennen Smith, who is the Lead Systems Engineer at Ookla, the company that runs Speedtest.net, explaining how he used pfSense to maximize his internet connection</li>
</ul>

<blockquote>
<p>I spend my time wrangling servers and internet infrastructure. My daily goals range from designing high performance applications supporting millions of users and testing the fastest internet connections in the world, to squeezing microseconds from our stack —so at home, I strive to make sure that my personal internet performance is running as fast as possible.<br>
I live in an area with a DOCSIS ISP that does not provide symmetrical gigabit internet — my download and upload speeds are not equal. Instead, I have an asymmetrical plan with 200 Mbps download and 10 Mbps upload — this nuance considerably impacted my network design because asymmetrical service can more easily lead to bufferbloat.<br>
We will cover bufferbloat in a later article, but in a nutshell, it’s an issue that arises when an upstream network device’s buffers are saturated during an upload. This causes immense network congestion, latency to rise above 2,000 ms., and overall poor quality of internet. The solution is to shape the outbound traffic to a speed just under the sending maximum of the upstream device, so that its buffers don’t fill up. My ISP is notorious for having bufferbloat issues due to the low upload performance, and it’s an issue prevalent even on their provided routers.</p>
</blockquote>

<ul>
<li>They walk through a list of router devices you might consider, and what speeds they are capable of handling, but ultimately ended up using a generic low power x86 machine running pfSense 2.3</li>
</ul>

<blockquote>
<p>In my research and testing, I also evaluated IPCop, VyOS, OPNSense, Sophos UTM, RouterOS, OpenWRT x86, and Alpine Linux to serve as the base operating system, but none were as well supported and full featured as PFSense.</p>
</blockquote>

<ul>
<li>The main setting to look at is the traffic shaping of uploads, to keep the pipe from getting saturated and having a large buffer build up in the modem and further upstream. This build up is what increases the latency of the connection</li>
</ul>

<blockquote>
<p>As with any experiment, any conclusions need to be backed with data. To validate the network was performing smoothly under heavy load, I performed the following experiment:</p>

<ul>
<li>Ran a ping6 against speedtest.net to measure latency.</li>
<li>Turned off QoS to simulate a “normal router”.</li>
<li>Started multiple simultaneous outbound TCP and UDP streams to saturate my outbound link.</li>
<li>Turned on QoS to the above settings and repeated steps 2 and 3.</li>
</ul>

<p>As you can see from the plot below, without QoS, my connection latency increased by ~1,235%. However with QoS enabled, the connection stayed stable during the upload and I wasn’t able to determine a statistically significant delta.<br>
That’s how I maximized the speed on my non-gigabit internet connection. What have you done with your network?</p>
</blockquote>

<hr>

<h3><a href="https://www.geeklan.co.uk/?p=2214" rel="nofollow">FreeBSD on 11″ MacBook Air</a></h3>

<ul>
<li>Sevan Janiyan writes in his tech blog about his experiences running FreeBSD on an 11’’ MacBook Air</li>
</ul>

<blockquote>
<p>This tiny machine has been with me for a few years now, It has mostly run OS X though <a href="https://www.geeklan.co.uk/?p=1283" rel="nofollow">I have tried OpenBSD on it</a>. Besides the screen resolution I’m still really happy with it, hardware wise. Software wise, not so much. I use an external disk containing a zpool with my data on it. Among this data are several source trees. CVS on a ZFS filesystem on OS X is painfully slow. I dislike that builds running inside Terminal.app are slow at the expense of a responsive UI. The system seems fragile, at the slightest push the machine will either hang or become unresponsive. Buggy serial drivers which do not implement the break signal and cause instability are frustrating.<br>
Last week whilst working on <a href="http://rumpkernel.org/" rel="nofollow">Rump kernel</a> builds I introduced some new build issues in the process of fixing others, I needed to pick up new changes from CVS by updating my copy of the source tree and run builds to test if issues were still present.<br>
I was let down on both counts, it took ages to update source and in the process of cross compiling a NetBSD/evbmips64-el release, the system locked hard. That was it, time to look what was possible elsewhere. While I have been using OS X for many years, I’m not tied to anything exclusive on it, maybe tweetbot, perhaps, but that’s it.<br>
On the BSDnow podcast they’ve been covering changes coming in to TrueOS (formerly PC-BSD – a desktop focused distro based on FreeBSD), their experiments seemed interesting, the project now tracks FreeBSD-CURRENT, they’ve replaced rcng with OpenRC as the init system and it comes with a pre-configured desktop environment, using their own window manager (Lumina). Booting the USB flash image it made it to X11 without any issue. The dock has a widget which states the detected features, no wifi (Broadcom), sound card detected and screen resolution set to 1366×768. I planned to give it a try on the weekend. Friday, I made backups and wiped the system. TrueOS installed without issue, after a short while I had a working desktop, resuming from sleep worked out of the box. I didn’t spend long testing TrueOS, switching out NetBSD-HEAD only to realise that I really need ZFS so while I was testing things out, might as well give stock FreeBSD 11-STABLE a try (TrueOS was based on -CURRENT).<br>
Turns out sleep doesn’t work yet but sound does work out of the box and with a few invocations of pkg(8) I had xorg, dwm, firefox, CVS and virtuabox-ose installed from binary packages. VirtualBox seems to cause the system to panic (bug 219276) but I should be able to survive without my virtual machines over the next few days as I settle in. I’m considering ditching VirtualBox and converting the vdi files to raw images so that they can be written to a new zvol for use with bhyve. As my default keyboard layout is Dvorak, OS X set the EFI settings to this layout. The first time I installed FreeBSD 11-STABLE, I opted for full disk encryption but ran into this odd issue where on boot the keyboard layout was Dvorak and password was accepted, the system would boot and as it went to mount the various filesystems it would switch back to QWERTY. I tried entering my password with both layout but wasn’t able to progress any further, no bug report yet as I haven’t ruled myself out as the problem.<br>
Thunderbolt gigabit adapter –<a href="https://www.freebsd.org/cgi/man.cgi?query=bge" rel="nofollow">bge(4)</a> and DVI adapter both worked on FreeBSD though the gigabit adapter needs to be plugged in at boot to be detected. The trackpad bind to <a href="https://www.freebsd.org/cgi/man.cgi?query=wsp" rel="nofollow">wsp(4)</a>, left, right and middle clicks are available through single, double and tripple finger tap. Sound card binds to <a href="https://www.freebsd.org/cgi/man.cgi?query=snd_hda" rel="nofollow">snd_hda(4)</a> and works out of the box.<br>
For wifi I’m using a <a href="https://www.freebsd.org/cgi/man.cgi?query=urtw" rel="nofollow">urtw(4)</a> Alfa adapter which is a bit on the large side but works very reliably.  A copy of the <a href="https://www.geeklan.co.uk/files/macbookair/freebsd-dmesg.txt" rel="nofollow">dmesg</a> is here.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://forum.opnsense.org/index.php?topic=5200.0" rel="nofollow">OPNsense - call-for-testing for SafeStack</a></li>
<li><a href="https://www.rewritinghistorycasts.com/screencasts/bsd-4.4:-cat" rel="nofollow">BSD 4.4: cat</a></li>
<li><a href="https://github.com/dspinellis/unix-history-repo" rel="nofollow">Continuous Unix commit history from 1970 until today</a></li>
<li><a href="https://www.spinellis.gr/blog/20170510/" rel="nofollow">Update on Unix Architecture Evolution Diagrams</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/2951" rel="nofollow">“Relayd and Httpd Mastery” is out!</a></li>
<li><a href="https://www.meetup.com/Triangle-BSD-Users-Group/events/240247251/" rel="nofollow">Triangle BSD User Group Meeting -- libxo</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/1GJHPNY#wrap" rel="nofollow">Carlos - ASUS Tinkerboard</a></li>
<li><a href="http://dpaste.com/0QCW933#wrap" rel="nofollow">James - Firewall question</a></li>
<li><a href="http://dpaste.com/0GMG5M2#wrap" rel="nofollow">Adam - ZFS books</a></li>
<li><a href="http://dpaste.com/2GP8H1E#wrap" rel="nofollow">David - Managing zvols</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A pledge of love to OpenBSD, combating ransomware like WannaCry with OpenZFS, and using PFsense to maximize your non-gigabit Internet connection</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=318736" rel="nofollow">ino64 project committed to FreeBSD 12-CURRENT</a></h3>

<ul>
<li>The ino64 project has been completed and merged into FreeBSD 12-CURRENT</li>
</ul>

<blockquote>
<p>Extend the ino_t, dev_t, nlink_t types to 64-bit ints.  Modify struct dirent layout to add d_off, increase the size of d_fileno to 64-bits, increase the size of d_namlen to 16-bits, and change the required alignment.  Increase struct statfs f_mntfromname[] and f_mntonname[] array length MNAMELEN to 1024</p>
</blockquote>

<ul>
<li>This means the length of a mount point (MNAMELEN) has been increased from 88 byte to 1024 bytes. This allows longer ZFS dataset names and more nesting, and generally improves the usefulness of nested jails</li>
<li>It also allow more than 4 billion files to be stored in a single file system (both UFS and ZFS). It also deals with a number of NFS problems, such as Amazon’s EFS (cloud NFS), which uses 64 bit IDs even with small numbers of files.</li>
</ul>

<blockquote>
<p>ABI breakage is mitigated by providing compatibility using versioned symbols, ingenious use of the existing padding in structures, and by employing other tricks.  Unfortunately, not everything can be fixed, especially outside the base system.  For instance, third-party APIs which pass struct stat around are broken in backward and forward incompatible ways.</p>
</blockquote>

<ul>
<li>A bug in poudriere that may cause some packages to not rebuild is being fixed. Many packages like perl will need to be rebuilt after this change</li>
</ul>

<blockquote>
<p>Update note: strictly follow the instructions in UPDATING.  Build and install the new kernel with COMPAT_FREEBSD11 option enabled, then reboot, and only then install new world.</p>
</blockquote>

<ul>
<li>So you need the new GENERIC kernel with the COMPAT_FREEBSD11 option, so that your old userland will work with the new kernel, and you need to build, install, and reboot onto the new kernel before attempting to install world. The usual process of installing both and then rebooting will NOT WORK</li>
</ul>

<blockquote>
<p>Credits: The 64-bit inode project, also known as ino64, started life many years ago as a project by Gleb Kurtsou (gleb).  Kirk McKusick (mckusick) then picked up and updated the patch, and acted as a flag-waver.  Feedback, suggestions, and discussions were carried by Ed Maste (emaste), John Baldwin (jhb), Jilles Tjoelker (jilles), and Rick Macklem (rmacklem).  Kris Moore (kmoore) performed an initial ports investigation followed by an exp-run by Antoine Brodin (antoine). Essential and all-embracing testing was done by Peter Holm (pho). The heavy lifting of coordinating all these efforts and bringing the project to completion were done by Konstantin Belousov (kib).</p>

<p>Sponsored by:    The FreeBSD Foundation (emaste, kib)</p>
</blockquote>

<hr>

<h3><a href="https://medium.com/@h3artbl33d/why-i-love-openbsd-ca760cf53941" rel="nofollow">Why I love OpenBSD</a></h3>

<ul>
<li>Jeroen Janssen writes:</li>
</ul>

<blockquote>
<p>I do love open source software. Oh boy, I really do love open source software. It’s extendable, auditable, and customizable. What’s not to love?<br>
I’m astonished by the idea that tens, hundreds, and sometimes even thousands of enthusiastic, passionate developers collaborate on an idea. Together, they make the world a better place, bit by bit.<br>
And this leads me to one of my favorite open source projects: the 22-year-old OpenBSD operating system.<br>
The origins of my love affair with OpenBSD<br>
From Linux to *BSD<br>
The advantages of OpenBSD</p>

<p>It’s extremely secure<br>
It’s well documented<br>
It’s open source<br>
    &gt; It’s neat and clean</p>

<p>My take on OpenBSD</p>
</blockquote>

<hr>

<p>** DO **</p>

<h3><a href="https://www.ixsystems.com/blog/combating-ransomware/" rel="nofollow">Combating WannaCry and Other Ransomware with OpenZFS Snapshots</a></h3>

<blockquote>
<p>Ransomware attacks that hold your data hostage using unauthorized data encryption are spreading rapidly and are particularly nefarious because they do not require any special access privileges to your data. A ransomware attack may be launched via a sophisticated software exploit as was the case with the recent “WannaCry” ransomware, but there is nothing stopping you from downloading and executing a malicious program that encrypts every file you have access to. If you fail to pay the ransom, the result will be indistinguishable from your simply deleting every file on your system. To make matters worse, ransomware authors are expanding their attacks to include just about any storage you have access to. The list is long, but includes network shares, Cloud services like DropBox, and even “shadow copies” of data that allow you to open previous versions of files.<br>
To make matters even worse, there is little that your operating system can do to prevent you or a program you run from encrypting files with ransomware just as it can’t prevent you from deleting the files you own. Frequent backups are touted as one of the few effective strategies for recovering from ransomware attacks but it is critical that any backup be isolated from the attack to be immune from the same attack. Simply copying your files to a mounted disk on your computer or in the Cloud makes the backup vulnerable to infection by virtue of the fact that you are backing up using your regular permissions. If you can write to it, the ransomware can encrypt it. Like medical workers wearing hazmat suits for isolation when combating an epidemic, you need to isolate your backups from ransomware.<br>
OpenZFS snapshots to the rescue<br>
OpenZFS is the powerful file system at the heart of every storage system that iXsystems sells and of its many features, snapshots can provide fast and effective recovery from ransomware attacks at both the individual user and enterprise level as I talked about in 2015. As a copy-on-write file system, OpenZFS provides efficient and consistent snapshots of your data at any given point in time. Each snapshot only includes the precise delta of changes between any two points in time and can be cloned to provide writable copies of any previous state without losing the original copy. Snapshots also provide the basis of OpenZFS replication or backing up of your data to local and remote systems. Because an OpenZFS snapshot takes place at the block level of the file system, it is immune to any file-level encryption by ransomware that occurs over it. A carefully-planned snapshot, replication, retention, and restoration strategy can provide the low-level isolation you need to enable your storage infrastructure to quickly recover from ransomware attacks.<br>
OpenZFS snapshots in practice<br>
While OpenZFS is available on a number of desktop operating systems such as TrueOS and macOS, the most effective way to bring the benefits of OpenZFS snapshots to the largest number of users is with a network of iXsystems TrueNAS, FreeNAS Certified and FreeNAS Mini unified NAS and SAN storage systems. All of these can provide OpenZFS-backed SMB, NFS, AFP, and iSCSI file and block storage to the smallest workgroups up through the largest enterprises and TrueNAS offers available Fibre Channel for enterprise deployments. By sharing your data to your users using these file and block protocols, you can provide them with a storage infrastructure that can quickly recover from any ransomware attack thrown at it. To mitigate ransomware attacks against individual workstations, TrueNAS and FreeNAS can provide snapshotted storage to your VDI or virtualization solution of choice. Best of all, every iXsystems TrueNAS, FreeNAS Certified, and FreeNAS Mini system includes a consistent user interface and the ability to replicate between one another. This means that any topology of individual offices and campuses can exchange backup data to quickly mitigate ransomware attacks on your organization at all levels.<br>
Join us for a <a href="http://www.onlinemeetingnow.com/register/?id=uegudsbc75" rel="nofollow">free webinar</a> with iXsystems Co-Founder Matt Olander and learn more about why businesses everywhere are replacing their proprietary storage platforms with TrueNAS then email us at <a href="mailto:info@ixsystems.com" rel="nofollow">info@ixsystems.com</a> or call 1-855-GREP-4-IX (1-855-473-7449), or 1-408-493-4100 (outside the US) to discuss your storage needs with one of our solutions architects.</p>
</blockquote>

<hr>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com" rel="nofollow">mwlucas@michaelwlucas.com</a> / <a href="https://twitter.com/mwlauthor" rel="nofollow">@twitter</a></h2>

<p>Books, conferences, and how these two combine</p>

<ul>
<li>BR: Welcome back. Tell us what you’ve been up to since the last time we interviewed you regarding books and such.</li>
<li>AJ: Tell us a little bit about relayd and what it can do.</li>
<li>BR: What other books do you have in the pipeline?</li>
<li>AJ: What are your criteria that qualifies a topic for a mastery book?</li>
<li>BR: Can you tell us a little bit about these writing workshops that you attend and what happens there?</li>
<li>AJ: Without spoiling too much: How did you come up with the idea for git commit murder?</li>
<li>BR: Speaking of BSDCan, can you tell the first timers about what to expect in the [<a href="http://www.bsdcan.org/2017/schedule/events/890.en.html%5D(Newcomers" rel="nofollow">http://www.bsdcan.org/2017/schedule/events/890.en.html](Newcomers</a> orientation and mentorship) session on Thursday?</li>
<li>AJ: Tell us about the new WIP session at BSDCan. Who had the idea and how much input did you get thus far?</li>
<li>BR: Have you ever thought about branching off into a new genre like children’s books or medieval fantasy novels?</li>
<li>AJ: Is there anything else before we let you go?
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://tetragir.com/freebsd/networking/using-lldp-on-freebsd.html" rel="nofollow">Using LLDP on FreeBSD</a></h3>

<blockquote>
<p>LLDP, or Link Layer Discovery Protocol allows system administrators to easily map the network, eliminating the need to physically run the cables in a rack. LLDP is a protocol used to send and receive information about a neighboring device connected directly to a networking interface. It is similar to Cisco’s CDP, Foundry’s FDP, Nortel’s SONMP, etc. It is a stateless protocol, meaning that an LLDP-enabled device sends advertisements even if the other side cannot do anything with it. In this guide the installation and configuration of the LLDP daemon on FreeBSD as well as on a Cisco switch will be introduced.<br>
If you are already familiar with Cisco’s CDP, LLDP won’t surprise you. It is built for the same purpose: to exchange device information between peers on a network. While CDP is a proprietary solution and can be used only on Cisco devices, LLDP is a standard: IEEE 802.3AB. Therefore it is implemented on many types of devices, such as switches, routers, various desktop operating systems, etc. LLDP helps a great deal in mapping the network topology, without spending hours in cabling cabinets to figure out which device is connected with which switchport. If LLDP is running on both the networking device and the server, it can show which port is connected where. Besides physical interfaces, LLDP can be used to exchange a lot more information, such as IP Address, hostname, etc.<br>
In order to use LLDP on FreeBSD, net-mgmt/lldpd has to be installed. It can be installed from ports using portmaster: #portmaster net-mgmt/lldpd Or from packages: #pkg install net-mgmt/lldpd By default lldpd sends and receives all the information it can gather , so it is advisable to limit what we will communicate with the neighboring device.<br>
The configuration file for lldpd is basically a list of commands as it is passed to lldpcli. Create a file named lldpd.conf under /usr/local/etc/ The following configuration gives an example of how lldpd can be configured. For a full list of options, see %man lldpcli<br>
To check what is configured locally, run #lldpcli show chassis detail<br>
To see the neighbors run #lldpcli show neighbors details</p>
</blockquote>

<ul>
<li>Check out the rest of the article about enabling LLDP on a Cisco switch</li>
</ul>

<hr>

<h3><a href="http://www.tedunangst.com/flak/post/experiments-with-prepledge" rel="nofollow">experiments with prepledge</a></h3>

<ul>
<li><p>Ted Unangst takes a crack at a system similar to the one being designed for Capsicum, Oblivious Sandboxing (See the presentation at BSDCan), where the application doesn’t even know it is in the sandbox</p>

<blockquote>
<p>MP3 is officially dead, so I figure I should listen to my collection one last time before it vanishes entirely. The provenance of some of these files is a little suspect however, and since I know one shouldn’t open files from strangers, I’d like to take some precautions against malicious malarkey. This would be a good use for pledge, perhaps, if we can get it working.<br>
At the same time, an occasional feature request for pledge is the ability to specify restrictions before running a program. Given some untrusted program, wrap its execution in a pledge like environment. There are other system call sandbox mechanisms that can do this (systrace was one), but pledge is quite deliberately designed not to support this. But maybe we can bend it to our will.<br>
Our pledge wrapper can’t be an external program. This leaves us with the option of injecting the wrapper into the target program via LD_PRELOAD. Before main even runs, we’ll initialize what needs initializing, then lock things down with a tight pledge set. Our eventual target will be ffplay, but hopefully the design will permit some flexibility and reuse.</p>
</blockquote></li>
<li><p>So the new code is injected to override the open syscall, and reads a list of files from an environment variable. Those files are opened and the path and file descriptor are put into a linked list, and then pledge is used to restrict further access to the file system. The replacement open call now searches just that linked list, returning the already opened file descriptors.</p></li>
<li><p>So as long as your application only tries to open files that you have preopened, it can function without modification within the sandbox. Or at least that is the goal...</p></li>
<li><p>ffplay tries to dlopen() some things, and because of the way dlopen() works, it doesn’t go via the libc open() wrapper, so it doesn’t get overridden</p></li>
<li><p>ffplay also tries to call a few ioctl’s, not allowed</p></li>
<li><p>After stubbing both of those out, it still doesn’t work and it is just getting worse</p></li>
<li><p>Ted switches to a new strategy, using ffmpeg to convert the .mp3 to a .wav file and then just cat it to /dev/audio</p></li>
<li><p>A few more stubs for ffmpeg, including access(), and adding tty access to the list of pledges, and it finally works</p></li>
</ul>

<blockquote>
<p>This point has been made from the early days, but I think this exercise reinforces it, that pledge works best with programs where you understand what the program is doing. A generic pledge wrapper isn’t of much use because the program is going to do something unexpected and you’re going to have a hard time wrangling it into submission.<br>
Software is too complex. What in the world is ffplay doing? Even if I were working with the source, how long would it take to rearrange the program into something that could be pledged? One can try using another program, but I would wager that as far as multiformat media players go, ffplay is actually on the lower end of the complexity spectrum. Most of the trouble comes from using SDL as an abstraction layer, which performs a bunch of console operations.<br>
On the flip side, all of this early init code is probably the right design. Once SDL finally gets its screen handle setup, we could apply pledge and sandbox the actual media decoder. That would be the right way to things.<br>
Is pledge too limiting? Perhaps, but that’s what I want. I could have just kept adding permissions until ffplay had full access to my X socket, but what kind of sandbox is that? I don’t want naughty MP3s scraping my screen and spying on my keystrokes. The sandbox I created had all the capabilities one needs to convert an MP3 to audible sound, but the tool I wanted to use wasn’t designed to work in that environment. And in its defense, these were new post hoc requirements. Other programs, even sed, suffer from less than ideal pledge sets as well. The best summary might be to say that pledge is designed for tomorrow’s programs, not yesterday’s (and vice versa).<br>
There were a few things I could have done better. In particular, I gave up getting audio to work, even though there’s a nice description of how to work with pledge in the sio_open manual. Alas, even going back and with a bit more effort I still haven’t succeeded. The requirements to use libsndio are more permissive than I might prefer.</p>

<hr>
</blockquote>

<h3><a href="https://medium.com/speedtest-by-ookla/engineer-maximizes-internet-speed-story-c3ec0e86f37a" rel="nofollow">How I Maximized the Speed of My Non-Gigabit Internet Connection</a></h3>

<ul>
<li>We have a new post from Brennen Smith, who is the Lead Systems Engineer at Ookla, the company that runs Speedtest.net, explaining how he used pfSense to maximize his internet connection</li>
</ul>

<blockquote>
<p>I spend my time wrangling servers and internet infrastructure. My daily goals range from designing high performance applications supporting millions of users and testing the fastest internet connections in the world, to squeezing microseconds from our stack —so at home, I strive to make sure that my personal internet performance is running as fast as possible.<br>
I live in an area with a DOCSIS ISP that does not provide symmetrical gigabit internet — my download and upload speeds are not equal. Instead, I have an asymmetrical plan with 200 Mbps download and 10 Mbps upload — this nuance considerably impacted my network design because asymmetrical service can more easily lead to bufferbloat.<br>
We will cover bufferbloat in a later article, but in a nutshell, it’s an issue that arises when an upstream network device’s buffers are saturated during an upload. This causes immense network congestion, latency to rise above 2,000 ms., and overall poor quality of internet. The solution is to shape the outbound traffic to a speed just under the sending maximum of the upstream device, so that its buffers don’t fill up. My ISP is notorious for having bufferbloat issues due to the low upload performance, and it’s an issue prevalent even on their provided routers.</p>
</blockquote>

<ul>
<li>They walk through a list of router devices you might consider, and what speeds they are capable of handling, but ultimately ended up using a generic low power x86 machine running pfSense 2.3</li>
</ul>

<blockquote>
<p>In my research and testing, I also evaluated IPCop, VyOS, OPNSense, Sophos UTM, RouterOS, OpenWRT x86, and Alpine Linux to serve as the base operating system, but none were as well supported and full featured as PFSense.</p>
</blockquote>

<ul>
<li>The main setting to look at is the traffic shaping of uploads, to keep the pipe from getting saturated and having a large buffer build up in the modem and further upstream. This build up is what increases the latency of the connection</li>
</ul>

<blockquote>
<p>As with any experiment, any conclusions need to be backed with data. To validate the network was performing smoothly under heavy load, I performed the following experiment:</p>

<ul>
<li>Ran a ping6 against speedtest.net to measure latency.</li>
<li>Turned off QoS to simulate a “normal router”.</li>
<li>Started multiple simultaneous outbound TCP and UDP streams to saturate my outbound link.</li>
<li>Turned on QoS to the above settings and repeated steps 2 and 3.</li>
</ul>

<p>As you can see from the plot below, without QoS, my connection latency increased by ~1,235%. However with QoS enabled, the connection stayed stable during the upload and I wasn’t able to determine a statistically significant delta.<br>
That’s how I maximized the speed on my non-gigabit internet connection. What have you done with your network?</p>
</blockquote>

<hr>

<h3><a href="https://www.geeklan.co.uk/?p=2214" rel="nofollow">FreeBSD on 11″ MacBook Air</a></h3>

<ul>
<li>Sevan Janiyan writes in his tech blog about his experiences running FreeBSD on an 11’’ MacBook Air</li>
</ul>

<blockquote>
<p>This tiny machine has been with me for a few years now, It has mostly run OS X though <a href="https://www.geeklan.co.uk/?p=1283" rel="nofollow">I have tried OpenBSD on it</a>. Besides the screen resolution I’m still really happy with it, hardware wise. Software wise, not so much. I use an external disk containing a zpool with my data on it. Among this data are several source trees. CVS on a ZFS filesystem on OS X is painfully slow. I dislike that builds running inside Terminal.app are slow at the expense of a responsive UI. The system seems fragile, at the slightest push the machine will either hang or become unresponsive. Buggy serial drivers which do not implement the break signal and cause instability are frustrating.<br>
Last week whilst working on <a href="http://rumpkernel.org/" rel="nofollow">Rump kernel</a> builds I introduced some new build issues in the process of fixing others, I needed to pick up new changes from CVS by updating my copy of the source tree and run builds to test if issues were still present.<br>
I was let down on both counts, it took ages to update source and in the process of cross compiling a NetBSD/evbmips64-el release, the system locked hard. That was it, time to look what was possible elsewhere. While I have been using OS X for many years, I’m not tied to anything exclusive on it, maybe tweetbot, perhaps, but that’s it.<br>
On the BSDnow podcast they’ve been covering changes coming in to TrueOS (formerly PC-BSD – a desktop focused distro based on FreeBSD), their experiments seemed interesting, the project now tracks FreeBSD-CURRENT, they’ve replaced rcng with OpenRC as the init system and it comes with a pre-configured desktop environment, using their own window manager (Lumina). Booting the USB flash image it made it to X11 without any issue. The dock has a widget which states the detected features, no wifi (Broadcom), sound card detected and screen resolution set to 1366×768. I planned to give it a try on the weekend. Friday, I made backups and wiped the system. TrueOS installed without issue, after a short while I had a working desktop, resuming from sleep worked out of the box. I didn’t spend long testing TrueOS, switching out NetBSD-HEAD only to realise that I really need ZFS so while I was testing things out, might as well give stock FreeBSD 11-STABLE a try (TrueOS was based on -CURRENT).<br>
Turns out sleep doesn’t work yet but sound does work out of the box and with a few invocations of pkg(8) I had xorg, dwm, firefox, CVS and virtuabox-ose installed from binary packages. VirtualBox seems to cause the system to panic (bug 219276) but I should be able to survive without my virtual machines over the next few days as I settle in. I’m considering ditching VirtualBox and converting the vdi files to raw images so that they can be written to a new zvol for use with bhyve. As my default keyboard layout is Dvorak, OS X set the EFI settings to this layout. The first time I installed FreeBSD 11-STABLE, I opted for full disk encryption but ran into this odd issue where on boot the keyboard layout was Dvorak and password was accepted, the system would boot and as it went to mount the various filesystems it would switch back to QWERTY. I tried entering my password with both layout but wasn’t able to progress any further, no bug report yet as I haven’t ruled myself out as the problem.<br>
Thunderbolt gigabit adapter –<a href="https://www.freebsd.org/cgi/man.cgi?query=bge" rel="nofollow">bge(4)</a> and DVI adapter both worked on FreeBSD though the gigabit adapter needs to be plugged in at boot to be detected. The trackpad bind to <a href="https://www.freebsd.org/cgi/man.cgi?query=wsp" rel="nofollow">wsp(4)</a>, left, right and middle clicks are available through single, double and tripple finger tap. Sound card binds to <a href="https://www.freebsd.org/cgi/man.cgi?query=snd_hda" rel="nofollow">snd_hda(4)</a> and works out of the box.<br>
For wifi I’m using a <a href="https://www.freebsd.org/cgi/man.cgi?query=urtw" rel="nofollow">urtw(4)</a> Alfa adapter which is a bit on the large side but works very reliably.  A copy of the <a href="https://www.geeklan.co.uk/files/macbookair/freebsd-dmesg.txt" rel="nofollow">dmesg</a> is here.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://forum.opnsense.org/index.php?topic=5200.0" rel="nofollow">OPNsense - call-for-testing for SafeStack</a></li>
<li><a href="https://www.rewritinghistorycasts.com/screencasts/bsd-4.4:-cat" rel="nofollow">BSD 4.4: cat</a></li>
<li><a href="https://github.com/dspinellis/unix-history-repo" rel="nofollow">Continuous Unix commit history from 1970 until today</a></li>
<li><a href="https://www.spinellis.gr/blog/20170510/" rel="nofollow">Update on Unix Architecture Evolution Diagrams</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/2951" rel="nofollow">“Relayd and Httpd Mastery” is out!</a></li>
<li><a href="https://www.meetup.com/Triangle-BSD-Users-Group/events/240247251/" rel="nofollow">Triangle BSD User Group Meeting -- libxo</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/1GJHPNY#wrap" rel="nofollow">Carlos - ASUS Tinkerboard</a></li>
<li><a href="http://dpaste.com/0QCW933#wrap" rel="nofollow">James - Firewall question</a></li>
<li><a href="http://dpaste.com/0GMG5M2#wrap" rel="nofollow">Adam - ZFS books</a></li>
<li><a href="http://dpaste.com/2GP8H1E#wrap" rel="nofollow">David - Managing zvols</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>194: Daemonic plans</title>
  <link>https://www.bsdnow.tv/194</link>
  <guid isPermaLink="false">58753453-5f24-4697-a3a2-c39ef52c9b5b</guid>
  <pubDate>Wed, 17 May 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/58753453-5f24-4697-a3a2-c39ef52c9b5b.mp3" length="67381204" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSD Now we cover the latest FreeBSD Status Report, a plan for Open Source software development, centrally managing bhyve with Ansible, libvirt, and pkg-ssh, and a whole lot more.</itunes:subtitle>
  <itunes:duration>1:33:35</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSD Now we cover the latest FreeBSD Status Report, a plan for Open Source software development, centrally managing bhyve with Ansible, libvirt, and pkg-ssh, and a whole lot more.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD Project Status Report (January to March 2017) (https://www.freebsd.org/news/status/report-2017-01-2017-03.html)
While a few of these projects indicate they are a "plan B" or an "attempt III", many are still hewing to their original plans, and all have produced impressive results. Please enjoy this vibrant collection of reports, covering the first quarter of 2017.
The quarterly report opens with notes from Core, The FreeBSD Foundation, the Ports team, and Release Engineering
On the project front, the Ceph on FreeBSD project had made considerable advances, and is now usable as the net/ceph-devel port via the ceph-fuse module. Eventually they hope to have a kernel RADOS block device driver, so fuse is not required
CloudABI update, including news that the Bitcoin reference implementation is working on a port to CloudABI
eMMC Flash and SD card updates, allowing higher speeds (max speed changes from ~40 to ~80 MB/sec). As well, the MMC Stack can now also be backed by the CAM framework.
Improvements to the Linuxulator
More detail on the pNFS Server plan B that we discussed in a previous week
Snow B.V. is sponsoring a dutch translation of the FreeBSD Handbook using the new .po system
***
A plan for open source software maintainers (http://www.daemonology.net/blog/2017-05-11-plan-for-foss-maintainers.html)
Colin Percival describes in his blog “a plan for open source software maintainers”:
I've been writing open source software for about 15 years now; while I'm still wet behind the ears compared to FreeBSD greybeards like Kirk McKusick and Poul-Henning Kamp, I've been around for long enough to start noticing some patterns. In particular:
Free software is expensive. Software is expensive to begin with; but good quality open source software tends to be written by people who are recognized as experts in their fields (partly thanks to that very software) and can demand commensurate salaries.
While that expensive developer time is donated (either by the developers themselves or by their employers), this influences what their time is used for: Individual developers like doing things which are fun or high-status, while companies usually pay developers to work specifically on the features those companies need. Maintaining existing code is important, but it is neither fun nor high-status; and it tends to get underweighted by companies as well, since maintenance is inherently unlikely to be the most urgent issue at any given time.
Open source software is largely a "throw code over the fence and walk away" exercise. Over the past 15 years I've written freebsd-update, bsdiff, portsnap, scrypt, spiped, and kivaloo, and done a lot of work on the FreeBSD/EC2 platform. Of these, I know bsdiff and scrypt are very widely used and I suspect that kivaloo is not; but beyond that I have very little knowledge of how widely or where my work is being used. Anecdotally it seems that other developers are in similar positions: At conferences I've heard variations on "you're using my code? Wow, that's awesome; I had no idea" many times.
I have even less knowledge of what people are doing with my work or what problems or limitations they're running into. Occasionally I get bug reports or feature requests; but I know I only hear from a very small proportion of the users of my work. I have a long list of feature ideas which are sitting in limbo simply because I don't know if anyone would ever use them — I suspect the answer is yes, but I'm not going to spend time implementing these until I have some confirmation of that.
A lot of mid-size companies would like to be able to pay for support for the software they're using, but can't find anyone to provide it. For larger companies, it's often easier — they can simply hire the author of the software (and many developers who do ongoing maintenance work on open source software were in fact hired for this sort of "in-house expertise" role) — but there's very little available for a company which needs a few minutes per month of expertise. In many cases, the best support they can find is sending an email to the developer of the software they're using and not paying anything at all — we've all received "can you help me figure out how to use this" emails, and most of us are happy to help when we have time — but relying on developer generosity is not a good long-term solution.
Every few months, I receive email from people asking if there's any way for them to support my open source software contributions. (Usually I encourage them to donate to the FreeBSD Foundation.) Conversely, there are developers whose work I would like to support (e.g., people working on FreeBSD wifi and video drivers), but there isn't any straightforward way to do this. Patreon has demonstrated that there are a lot of people willing to pay to support what they see as worthwhile work, even if they don't get anything directly in exchange for their patronage.
It seems to me that this is a case where problems are in fact solutions to other problems. To wit:
Users of open source software want to be able to get help with their use cases; developers of open source software want to know how people are using their code.
Users of open source software want to support the the work they use; developers of open source software want to know which projects users care about.
Users of open source software want specific improvements; developers of open source software may be interested in making those specific changes, but don't want to spend the time until they know someone would use them.
Users of open source software have money; developers of open source software get day jobs writing other code because nobody is paying them to maintain their open source software.
I'd like to see this situation get fixed. As I envision it, a solution would look something like a cross between Patreon and Bugzilla: Users would be able sign up to "support" projects of their choosing, with a number of dollars per month (possibly arbitrary amounts, possibly specified tiers; maybe including $0/month), and would be able to open issues. These could be private (e.g., for "technical support" requests) or public (e.g., for bugs and feature requests); users would be able to indicate their interest in public issues created by other users. Developers would get to see the open issues, along with a nominal "value" computed based on allocating the incoming dollars of "support contracts" across the issues each user has expressed an interest in, allowing them to focus on issues with higher impact.
He poses three questions to users about whether or not people (users and software developers alike) would be interested in this and whether payment (giving and receiving, respectively) is interesting  
Check out the comments (and those on https://news.ycombinator.com/item?id=14313804 (reddit.com)) as well for some suggestions and discussion on the topic
***
OpenBSD vmm hypervisor: Part 2 (http://www.h-i-r.net/2017/04/openbsd-vmm-hypervisor-part-2.html)
We asked for people to write up their experience using OpenBSD’s VMM. This blog post is just that
This is going to be a (likely long-running, infrequently-appended) series of posts as I poke around in vmm.  A few months ago, I demonstrated some basic use of the vmm hypervisor as it existed in OpenBSD 6.0-CURRENT around late October, 2016. We'll call that video Part 1.
Quite a bit of development was done on vmm before 6.1-RELEASE, and it's worth noting that some new features made their way in. Work continues, of course, and I can only imagine the hypervisor technology will mature plenty for the next release. As it stands, this is the first release of OpenBSD with a native hypervisor shipped in the base install, and that's exciting news in and of itself
To get our virtual machines onto the network, we have to spend some time setting up a virtual ethernet interface. We'll run a DHCP server on that, and it'll be the default route for our virtual machines. We'll keep all the VMs on a private network segment, and use NAT to allow them to get to the network. There is a way to directly bridge VMs to the network in some situations, but I won't be covering that today.
Create an empty disk image for your new VM. I'd recommend 1.5GB to play with at first. You can do this without doas or root if you want your user account to be able to start the VM later. I made a "vmm" directory inside my home directory to store VM disk images in. You might have a different partition you wish to store these large files in.
Boot up a brand new vm instance. You'll have to do this as root or with doas. You can download a -CURRENT install kernel/ramdisk (bsd.rd) from an OpenBSD mirror, or you can simply use the one that's on your existing system (/bsd.rd) like I'll do here.
The command will start a VM named "test.vm", display the console at startup, use /bsd.rd (from our host environment) as the boot image, allocate 256MB of memory, attach the first network interface to the switch called "local" we defined earlier in /etc/vm.conf, and use the test image we just created as the first disk drive.
Now that the VM disk image file has a full installation of OpenBSD on it, build a VM configuration around it by adding the below block of configuration (with modifications as needed for owner, path and lladdr) to /etc/vm.conf
I've noticed that VMs with much less than 256MB of RAM allocated tend to be a little unstable for me. You'll also note that in the "interface" clause, I hard-coded the lladdr that was generated for it earlier. By specifying "disable" in vm.conf, the VM will show up in a stopped state that the owner of the VM (that's you!) can manually start without root access.
Let us know how VMM works for you
***
News Roundup
openbsd changes of note 621 (http://www.tedunangst.com/flak/post/openbsd-changes-of-note-621)
More stuff, more fun.
Fix script to not perform tty operations on things that aren’t ttys. Detected by pledge.
Merge libdrm 2.4.79.
After a forced unmount, also unmount any filesystems below that mount point.
Flip previously warm pages in the buffer cache to memory above the DMA region if uvm tells us it is available. Pages are not automatically promoted to upper memory. Instead it’s used as additional memory only for what the cache considers long term buffers. I/O still requires DMA memory, so writing to a buffer will pull it back down.
Makefile support for systems with both gcc and clang. Make i386 and amd64 so.
Take a more radical approach to disabling colours in clang.
When the data buffered for write in tmux exceeds a limit, discard it and redraw. Helps when a fast process is running inside tmux running inside a slow terminal.
Add a port of witness(4) lock validation tool from FreeBSD. Use it with mplock, rwlock, and mutex in the kernel.
Properly save and restore FPU context in vmm.
Remove KGDB. It neither compiles nor works.
Add a constant time AES implementation, from BearSSL.
Remove SSHv1 from ssh.
and more...
***
Digging into BSD's choice of Unix group for new directories and files (https://utcc.utoronto.ca/~cks/space/blog/unix/BSDDirectoryGroupChoice)
I have to eat some humble pie here. In comments on my entry on an interesting chmod failure, Greg A. Woods pointed out that FreeBSD's behavior of creating everything inside a directory with the group of the directory is actually traditional BSD behavior (it dates all the way back to the 1980s), not some odd new invention by FreeBSD. As traditional behavior it makes sense that it's explicitly allowed by the standards, but I've also come to think that it makes sense in context and in general. To see this, we need some background about the problem facing BSD.
In the beginning, two things were true in Unix: there was no mkdir() system call, and processes could only be in one group at a time. With processes being in only one group, the choice of the group for a newly created filesystem object was easy; it was your current group. This was felt to be sufficiently obvious behavior that the V7 creat(2) manpage doesn't even mention it.
Now things get interesting. 4.1c BSD seems to be where mkdir(2) is introduced and where creat() stops being a system call and becomes an option to open(2). It's also where processes can be in multiple groups for the first time. The 4.1c BSD open(2) manpage is silent about the group of newly created files, while the mkdir(2) manpage specifically claims that new directories will have your effective group (ie, the V7 behavior). This is actually wrong. In both mkdir() in sysdirectory.c and maknode() in ufssyscalls.c, the group of the newly created object is set to the group of the parent directory. Then finally in the 4.2 BSD mkdir(2) manpage the group of the new directory is correctly documented (the 4.2 BSD open(2) manpage continues to say nothing about this). So BSD's traditional behavior was introduced at the same time as processes being in multiple groups, and we can guess that it was introduced as part of that change.
When your process can only be in a single group, as in V7, it makes perfect sense to create new filesystem objects with that as their group. It's basically the same case as making new filesystem objects be owned by you; just as they get your UID, they also get your GID. When your process can be in multiple groups, things get less clear. A filesystem object can only be in one group, so which of your several groups should a new filesystem object be owned by, and how can you most conveniently change that choice?
One option is to have some notion of a 'primary group' and then provide ways to shuffle around which of your groups is the primary group.
Another option is the BSD choice of inheriting the group from context. By far the most common case is that you want your new files and directories to be created in the 'context', ie the group, of the surrounding directory.
If you fully embrace the idea of Unix processes being in multiple groups, not just having one primary group and then some number of secondary groups, then the BSD choice makes a lot of sense. And for all of its faults, BSD tended to relatively fully embrace its changes 
While it leads to some odd issues, such as the one I ran into, pretty much any choice here is going to have some oddities.
Centrally managed Bhyve infrastructure with Ansible, libvirt and pkg-ssh (http://www.shellguardians.com/2017/05/centrally-managed-bhyve-infrastructure.html)
At work we've been using Bhyve for a while to run non-critical systems.  It is a really nice and stable hypervisor even though we are using an earlier version available on FreeBSD 10.3. This means we lack Windows and VNC support among other things, but it is not a big deal.
After some iterations in our internal tools, we realised that the installation process was too slow and we always repeated the same steps. Of course,  any good sysadmin will scream "AUTOMATION!" and so did we. Therefore, we started looking for different ways to improve our deployments.
We had a look at existing frameworks that manage Bhyve, but none of them had a feature that we find really important: having a centralized repository of VM images. For instance, SmartOS applies this method successfully by having a backend server that stores a catalog of VMs and Zones, meaning that new instances can be deployed in a minute at most. This is a game changer if you are really busy in your day-to-day operations.
The following building blocks are used:
The ZFS snapshot of an existing VM. This will be our VM template.
A modified version of oneoff-pkg-create to package the ZFS snapshots.
pkg-ssh  and pkg-repo to host a local FreeBSD repo in a FreeBSD jail.
libvirt to manage our Bhyve VMs.
The ansible modules virt, virtnet and virtpool.
Once automated, the installation process needs 2 minutes at most, compared with the 30 minutes needed to manually install VM plus allowing us to deploy many guests in parallel.
NetBSD maintainer in the QEMU project (https://blog.netbsd.org/tnf/entry/netbsd_maintainer_in_the_qemu)
QEMU - the FAST! processor emulator - is a generic, Open Source, machine emulator and virtualizer. It defines state of the art in modern virtualization.
This software has been developed for multiplatform environments with support for NetBSD since virtually forever. It's the primary tool used by the NetBSD developers and release engineering team. It is run with continuous integration tests for daily commits and execute regression tests through the Automatic Test Framework (ATF).
The QEMU developers warned the Open Source community - with version 2.9 of the emulator - that they will eventually drop support for suboptimally supported hosts if nobody will step in and take the maintainership to refresh the support. This warning was directed to major BSDs, Solaris, AIX and Haiku.
Thankfully the NetBSD position has been filled - making NetBSD to restore official maintenance.
Beastie Bits
OpenBSD Community Goes Gold (http://undeadly.org/cgi?action=article&amp;amp;sid=20170510012526&amp;amp;mode=flat&amp;amp;count=0)
CharmBUG’s Tor Hack-a-thon has been pushed back to July due to scheduling difficulties (https://www.meetup.com/CharmBUG/events/238218840/)
Direct Rendering Manager (DRM) Driver for i915, from the Linux kernel to Haiku with the help of DragonflyBSD’s Linux Compatibility layer (https://www.haiku-os.org/blog/vivek/2017-05-05_[gsoc_2017]_3d_hardware_acceleration_in_haiku/)
TomTom lists OpenBSD in license (https://twitter.com/bsdlme/status/863488045449977864)
London Net BSD Meetup on May 22nd (https://mail-index.netbsd.org/regional-london/2017/05/02/msg000571.html)
KnoxBUG meeting May 30th, 2017 - Introduction to FreeNAS (http://knoxbug.org/2017-05-30)
***
Feedback/Questions
Felix - Home Firewall (http://dpaste.com/35EWVGZ#wrap)
David - Docker Recipes for Jails (http://dpaste.com/0H51NX2#wrap)
Don - GoLang &amp;amp; Rust (http://dpaste.com/2VZ7S8K#wrap)
George - OGG feed (http://dpaste.com/2A1FZF3#wrap)
Roller - BSDCan Tips (http://dpaste.com/3D2B6J3#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSD Now we cover the latest FreeBSD Status Report, a plan for Open Source software development, centrally managing bhyve with Ansible, libvirt, and pkg-ssh, and a whole lot more.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2017-01-2017-03.html" rel="nofollow">FreeBSD Project Status Report (January to March 2017)</a></h3>

<blockquote>
<p>While a few of these projects indicate they are a &quot;plan B&quot; or an &quot;attempt III&quot;, many are still hewing to their original plans, and all have produced impressive results. Please enjoy this vibrant collection of reports, covering the first quarter of 2017.</p>
</blockquote>

<ul>
<li>The quarterly report opens with notes from Core, The FreeBSD Foundation, the Ports team, and Release Engineering</li>
<li>On the project front, the Ceph on FreeBSD project had made considerable advances, and is now usable as the net/ceph-devel port via the ceph-fuse module. Eventually they hope to have a kernel RADOS block device driver, so fuse is not required</li>
<li>CloudABI update, including news that the Bitcoin reference implementation is working on a port to CloudABI</li>
<li>eMMC Flash and SD card updates, allowing higher speeds (max speed changes from ~40 to ~80 MB/sec). As well, the MMC Stack can now also be backed by the CAM framework.</li>
<li>Improvements to the Linuxulator</li>
<li>More detail on the pNFS Server plan B that we discussed in a previous week</li>
<li>Snow B.V. is sponsoring a dutch translation of the FreeBSD Handbook using the new .po system
***</li>
</ul>

<h3><a href="http://www.daemonology.net/blog/2017-05-11-plan-for-foss-maintainers.html" rel="nofollow">A plan for open source software maintainers</a></h3>

<ul>
<li>Colin Percival describes in his blog “a plan for open source software maintainers”:</li>
</ul>

<blockquote>
<p>I&#39;ve been writing open source software for about 15 years now; while I&#39;m still wet behind the ears compared to FreeBSD greybeards like Kirk McKusick and Poul-Henning Kamp, I&#39;ve been around for long enough to start noticing some patterns. In particular:<br>
Free software is expensive. Software is expensive to begin with; but good quality open source software tends to be written by people who are recognized as experts in their fields (partly thanks to that very software) and can demand commensurate salaries.<br>
While that expensive developer time is donated (either by the developers themselves or by their employers), this influences what their time is used for: Individual developers like doing things which are fun or high-status, while companies usually pay developers to work specifically on the features those companies need. Maintaining existing code is important, but it is neither fun nor high-status; and it tends to get underweighted by companies as well, since maintenance is inherently unlikely to be the most urgent issue at any given time.<br>
Open source software is largely a &quot;throw code over the fence and walk away&quot; exercise. Over the past 15 years I&#39;ve written freebsd-update, bsdiff, portsnap, scrypt, spiped, and kivaloo, and done a lot of work on the FreeBSD/EC2 platform. Of these, I know bsdiff and scrypt are very widely used and I suspect that kivaloo is not; but beyond that I have very little knowledge of how widely or where my work is being used. Anecdotally it seems that other developers are in similar positions: At conferences I&#39;ve heard variations on &quot;you&#39;re using my code? Wow, that&#39;s awesome; I had no idea&quot; many times.<br>
I have even less knowledge of what people are doing with my work or what problems or limitations they&#39;re running into. Occasionally I get bug reports or feature requests; but I know I only hear from a very small proportion of the users of my work. I have a long list of feature ideas which are sitting in limbo simply because I don&#39;t know if anyone would ever use them — I suspect the answer is yes, but I&#39;m not going to spend time implementing these until I have some confirmation of that.<br>
A lot of mid-size companies would like to be able to pay for support for the software they&#39;re using, but can&#39;t find anyone to provide it. For larger companies, it&#39;s often easier — they can simply hire the author of the software (and many developers who do ongoing maintenance work on open source software were in fact hired for this sort of &quot;in-house expertise&quot; role) — but there&#39;s very little available for a company which needs a few minutes per month of expertise. In many cases, the best support they can find is sending an email to the developer of the software they&#39;re using and not paying anything at all — we&#39;ve all received &quot;can you help me figure out how to use this&quot; emails, and most of us are happy to help when we have time — but relying on developer generosity is not a good long-term solution.<br>
Every few months, I receive email from people asking if there&#39;s any way for them to support my open source software contributions. (Usually I encourage them to donate to the FreeBSD Foundation.) Conversely, there are developers whose work I would like to support (e.g., people working on FreeBSD wifi and video drivers), but there isn&#39;t any straightforward way to do this. Patreon has demonstrated that there are a lot of people willing to pay to support what they see as worthwhile work, even if they don&#39;t get anything directly in exchange for their patronage.</p>

<p>It seems to me that this is a case where problems are in fact solutions to other problems. To wit:<br>
Users of open source software want to be able to get help with their use cases; developers of open source software want to know how people are using their code.<br>
Users of open source software want to support the the work they use; developers of open source software want to know which projects users care about.<br>
Users of open source software want specific improvements; developers of open source software may be interested in making those specific changes, but don&#39;t want to spend the time until they know someone would use them.<br>
Users of open source software have money; developers of open source software get day jobs writing other code because nobody is paying them to maintain their open source software.</p>

<p>I&#39;d like to see this situation get fixed. As I envision it, a solution would look something like a cross between Patreon and Bugzilla: Users would be able sign up to &quot;support&quot; projects of their choosing, with a number of dollars per month (possibly arbitrary amounts, possibly specified tiers; maybe including $0/month), and would be able to open issues. These could be private (e.g., for &quot;technical support&quot; requests) or public (e.g., for bugs and feature requests); users would be able to indicate their interest in public issues created by other users. Developers would get to see the open issues, along with a nominal &quot;value&quot; computed based on allocating the incoming dollars of &quot;support contracts&quot; across the issues each user has expressed an interest in, allowing them to focus on issues with higher impact.</p>
</blockquote>

<ul>
<li>He poses three questions to users about whether or not people (users and software developers alike) would be interested in this and whether payment (giving and receiving, respectively) is interesting<br></li>
<li>Check out the comments (and those on [<a href="https://news.ycombinator.com/item?id=14313804%5D(reddit.com)" rel="nofollow">https://news.ycombinator.com/item?id=14313804](reddit.com)</a>) as well for some suggestions and discussion on the topic
***</li>
</ul>

<h3><a href="http://www.h-i-r.net/2017/04/openbsd-vmm-hypervisor-part-2.html" rel="nofollow">OpenBSD vmm hypervisor: Part 2</a></h3>

<ul>
<li>We asked for people to write up their experience using OpenBSD’s VMM. This blog post is just that</li>
</ul>

<blockquote>
<p>This is going to be a (likely long-running, infrequently-appended) series of posts as I poke around in vmm.  A few months ago, I demonstrated some basic use of the vmm hypervisor as it existed in OpenBSD 6.0-CURRENT around late October, 2016. We&#39;ll call that video Part 1.<br>
Quite a bit of development was done on vmm before 6.1-RELEASE, and it&#39;s worth noting that some new features made their way in. Work continues, of course, and I can only imagine the hypervisor technology will mature plenty for the next release. As it stands, this is the first release of OpenBSD with a native hypervisor shipped in the base install, and that&#39;s exciting news in and of itself<br>
To get our virtual machines onto the network, we have to spend some time setting up a virtual ethernet interface. We&#39;ll run a DHCP server on that, and it&#39;ll be the default route for our virtual machines. We&#39;ll keep all the VMs on a private network segment, and use NAT to allow them to get to the network. There is a way to directly bridge VMs to the network in some situations, but I won&#39;t be covering that today.<br>
Create an empty disk image for your new VM. I&#39;d recommend 1.5GB to play with at first. You can do this without doas or root if you want your user account to be able to start the VM later. I made a &quot;vmm&quot; directory inside my home directory to store VM disk images in. You might have a different partition you wish to store these large files in.<br>
Boot up a brand new vm instance. You&#39;ll have to do this as root or with doas. You can download a -CURRENT install kernel/ramdisk (bsd.rd) from an OpenBSD mirror, or you can simply use the one that&#39;s on your existing system (/bsd.rd) like I&#39;ll do here.<br>
The command will start a VM named &quot;test.vm&quot;, display the console at startup, use /bsd.rd (from our host environment) as the boot image, allocate 256MB of memory, attach the first network interface to the switch called &quot;local&quot; we defined earlier in /etc/vm.conf, and use the test image we just created as the first disk drive.<br>
Now that the VM disk image file has a full installation of OpenBSD on it, build a VM configuration around it by adding the below block of configuration (with modifications as needed for owner, path and lladdr) to /etc/vm.conf<br>
I&#39;ve noticed that VMs with much less than 256MB of RAM allocated tend to be a little unstable for me. You&#39;ll also note that in the &quot;interface&quot; clause, I hard-coded the lladdr that was generated for it earlier. By specifying &quot;disable&quot; in vm.conf, the VM will show up in a stopped state that the owner of the VM (that&#39;s you!) can manually start without root access.</p>
</blockquote>

<ul>
<li>Let us know how VMM works for you
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.tedunangst.com/flak/post/openbsd-changes-of-note-621" rel="nofollow">openbsd changes of note 621</a></h3>

<ul>
<li>More stuff, more fun.</li>
<li>Fix script to not perform tty operations on things that aren’t ttys. Detected by pledge.</li>
<li>Merge libdrm 2.4.79.</li>
<li>After a forced unmount, also unmount any filesystems below that mount point.</li>
<li>Flip previously warm pages in the buffer cache to memory above the DMA region if uvm tells us it is available. Pages are not automatically promoted to upper memory. Instead it’s used as additional memory only for what the cache considers long term buffers. I/O still requires DMA memory, so writing to a buffer will pull it back down.</li>
<li>Makefile support for systems with both gcc and clang. Make i386 and amd64 so.</li>
<li>Take a more radical approach to disabling colours in clang.</li>
<li>When the data buffered for write in tmux exceeds a limit, discard it and redraw. Helps when a fast process is running inside tmux running inside a slow terminal.</li>
<li>Add a port of witness(4) lock validation tool from FreeBSD. Use it with mplock, rwlock, and mutex in the kernel.</li>
<li>Properly save and restore FPU context in vmm.</li>
<li>Remove KGDB. It neither compiles nor works.</li>
<li>Add a constant time AES implementation, from BearSSL.</li>
<li>Remove SSHv1 from ssh.</li>
<li>and more...
***</li>
</ul>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/BSDDirectoryGroupChoice" rel="nofollow">Digging into BSD&#39;s choice of Unix group for new directories and files</a></h3>

<blockquote>
<p>I have to eat some humble pie here. In comments on my entry on an interesting chmod failure, Greg A. Woods pointed out that FreeBSD&#39;s behavior of creating everything inside a directory with the group of the directory is actually traditional BSD behavior (it dates all the way back to the 1980s), not some odd new invention by FreeBSD. As traditional behavior it makes sense that it&#39;s explicitly allowed by the standards, but I&#39;ve also come to think that it makes sense in context and in general. To see this, we need some background about the problem facing BSD.<br>
In the beginning, two things were true in Unix: there was no mkdir() system call, and processes could only be in one group at a time. With processes being in only one group, the choice of the group for a newly created filesystem object was easy; it was your current group. This was felt to be sufficiently obvious behavior that the V7 creat(2) manpage doesn&#39;t even mention it.<br>
Now things get interesting. 4.1c BSD seems to be where mkdir(2) is introduced and where creat() stops being a system call and becomes an option to open(2). It&#39;s also where processes can be in multiple groups for the first time. The 4.1c BSD open(2) manpage is silent about the group of newly created files, while the mkdir(2) manpage specifically claims that new directories will have your effective group (ie, the V7 behavior). This is actually wrong. In both mkdir() in sys_directory.c and maknode() in ufs_syscalls.c, the group of the newly created object is set to the group of the parent directory. Then finally in the 4.2 BSD mkdir(2) manpage the group of the new directory is correctly documented (the 4.2 BSD open(2) manpage continues to say nothing about this). So BSD&#39;s traditional behavior was introduced at the same time as processes being in multiple groups, and we can guess that it was introduced as part of that change.<br>
When your process can only be in a single group, as in V7, it makes perfect sense to create new filesystem objects with that as their group. It&#39;s basically the same case as making new filesystem objects be owned by you; just as they get your UID, they also get your GID. When your process can be in multiple groups, things get less clear. A filesystem object can only be in one group, so which of your several groups should a new filesystem object be owned by, and how can you most conveniently change that choice?<br>
One option is to have some notion of a &#39;primary group&#39; and then provide ways to shuffle around which of your groups is the primary group.<br>
Another option is the BSD choice of inheriting the group from context. By far the most common case is that you want your new files and directories to be created in the &#39;context&#39;, ie the group, of the surrounding directory.<br>
If you fully embrace the idea of Unix processes being in multiple groups, not just having one primary group and then some number of secondary groups, then the BSD choice makes a lot of sense. And for all of its faults, BSD tended to relatively fully embrace its changes <br>
While it leads to some odd issues, such as the one I ran into, pretty much any choice here is going to have some oddities.</p>

<hr>
</blockquote>

<h3><a href="http://www.shellguardians.com/2017/05/centrally-managed-bhyve-infrastructure.html" rel="nofollow">Centrally managed Bhyve infrastructure with Ansible, libvirt and pkg-ssh</a></h3>

<blockquote>
<p>At work we&#39;ve been using Bhyve for a while to run non-critical systems.  It is a really nice and stable hypervisor even though we are using an earlier version available on FreeBSD 10.3. This means we lack Windows and VNC support among other things, but it is not a big deal.<br>
After some iterations in our internal tools, we realised that the installation process was too slow and we always repeated the same steps. Of course,  any good sysadmin will scream &quot;AUTOMATION!&quot; and so did we. Therefore, we started looking for different ways to improve our deployments.<br>
We had a look at existing frameworks that manage Bhyve, but none of them had a feature that we find really important: having a centralized repository of VM images. For instance, SmartOS applies this method successfully by having a backend server that stores a catalog of VMs and Zones, meaning that new instances can be deployed in a minute at most. This is a game changer if you are really busy in your day-to-day operations.</p>
</blockquote>

<ul>
<li>The following building blocks are used:

<ul>
<li>The ZFS snapshot of an existing VM. This will be our VM template.</li>
<li>A modified version of oneoff-pkg-create to package the ZFS snapshots.</li>
<li>pkg-ssh  and pkg-repo to host a local FreeBSD repo in a FreeBSD jail.</li>
<li>libvirt to manage our Bhyve VMs.</li>
<li>The ansible modules virt, virt_net and virt_pool.</li>
</ul></li>
</ul>

<blockquote>
<p>Once automated, the installation process needs 2 minutes at most, compared with the 30 minutes needed to manually install VM plus allowing us to deploy many guests in parallel.</p>

<hr>
</blockquote>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_maintainer_in_the_qemu" rel="nofollow">NetBSD maintainer in the QEMU project</a></h3>

<blockquote>
<p>QEMU - the FAST! processor emulator - is a generic, Open Source, machine emulator and virtualizer. It defines state of the art in modern virtualization.<br>
This software has been developed for multiplatform environments with support for NetBSD since virtually forever. It&#39;s the primary tool used by the NetBSD developers and release engineering team. It is run with continuous integration tests for daily commits and execute regression tests through the Automatic Test Framework (ATF).<br>
The QEMU developers warned the Open Source community - with version 2.9 of the emulator - that they will eventually drop support for suboptimally supported hosts if nobody will step in and take the maintainership to refresh the support. This warning was directed to major BSDs, Solaris, AIX and Haiku.<br>
Thankfully the NetBSD position has been filled - making NetBSD to restore official maintenance.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170510012526&mode=flat&count=0" rel="nofollow">OpenBSD Community Goes Gold</a></li>
<li><a href="https://www.meetup.com/CharmBUG/events/238218840/" rel="nofollow">CharmBUG’s Tor Hack-a-thon has been pushed back to July due to scheduling difficulties</a></li>
<li><a href="https://www.haiku-os.org/blog/vivek/2017-05-05_%5Bgsoc_2017%5D_3d_hardware_acceleration_in_haiku/" rel="nofollow">Direct Rendering Manager (DRM) Driver for i915, from the Linux kernel to Haiku with the help of DragonflyBSD’s Linux Compatibility layer</a></li>
<li><a href="https://twitter.com/bsdlme/status/863488045449977864" rel="nofollow">TomTom lists OpenBSD in license</a></li>
<li><a href="https://mail-index.netbsd.org/regional-london/2017/05/02/msg000571.html" rel="nofollow">London Net BSD Meetup on May 22nd</a></li>
<li><a href="http://knoxbug.org/2017-05-30" rel="nofollow">KnoxBUG meeting May 30th, 2017 - Introduction to FreeNAS</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/35EWVGZ#wrap" rel="nofollow">Felix - Home Firewall</a></li>
<li><a href="http://dpaste.com/0H51NX2#wrap" rel="nofollow">David - Docker Recipes for Jails</a></li>
<li><a href="http://dpaste.com/2VZ7S8K#wrap" rel="nofollow">Don - GoLang &amp; Rust</a></li>
<li><a href="http://dpaste.com/2A1FZF3#wrap" rel="nofollow">George - OGG feed</a></li>
<li><a href="http://dpaste.com/3D2B6J3#wrap" rel="nofollow">Roller - BSDCan Tips</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSD Now we cover the latest FreeBSD Status Report, a plan for Open Source software development, centrally managing bhyve with Ansible, libvirt, and pkg-ssh, and a whole lot more.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2017-01-2017-03.html" rel="nofollow">FreeBSD Project Status Report (January to March 2017)</a></h3>

<blockquote>
<p>While a few of these projects indicate they are a &quot;plan B&quot; or an &quot;attempt III&quot;, many are still hewing to their original plans, and all have produced impressive results. Please enjoy this vibrant collection of reports, covering the first quarter of 2017.</p>
</blockquote>

<ul>
<li>The quarterly report opens with notes from Core, The FreeBSD Foundation, the Ports team, and Release Engineering</li>
<li>On the project front, the Ceph on FreeBSD project had made considerable advances, and is now usable as the net/ceph-devel port via the ceph-fuse module. Eventually they hope to have a kernel RADOS block device driver, so fuse is not required</li>
<li>CloudABI update, including news that the Bitcoin reference implementation is working on a port to CloudABI</li>
<li>eMMC Flash and SD card updates, allowing higher speeds (max speed changes from ~40 to ~80 MB/sec). As well, the MMC Stack can now also be backed by the CAM framework.</li>
<li>Improvements to the Linuxulator</li>
<li>More detail on the pNFS Server plan B that we discussed in a previous week</li>
<li>Snow B.V. is sponsoring a dutch translation of the FreeBSD Handbook using the new .po system
***</li>
</ul>

<h3><a href="http://www.daemonology.net/blog/2017-05-11-plan-for-foss-maintainers.html" rel="nofollow">A plan for open source software maintainers</a></h3>

<ul>
<li>Colin Percival describes in his blog “a plan for open source software maintainers”:</li>
</ul>

<blockquote>
<p>I&#39;ve been writing open source software for about 15 years now; while I&#39;m still wet behind the ears compared to FreeBSD greybeards like Kirk McKusick and Poul-Henning Kamp, I&#39;ve been around for long enough to start noticing some patterns. In particular:<br>
Free software is expensive. Software is expensive to begin with; but good quality open source software tends to be written by people who are recognized as experts in their fields (partly thanks to that very software) and can demand commensurate salaries.<br>
While that expensive developer time is donated (either by the developers themselves or by their employers), this influences what their time is used for: Individual developers like doing things which are fun or high-status, while companies usually pay developers to work specifically on the features those companies need. Maintaining existing code is important, but it is neither fun nor high-status; and it tends to get underweighted by companies as well, since maintenance is inherently unlikely to be the most urgent issue at any given time.<br>
Open source software is largely a &quot;throw code over the fence and walk away&quot; exercise. Over the past 15 years I&#39;ve written freebsd-update, bsdiff, portsnap, scrypt, spiped, and kivaloo, and done a lot of work on the FreeBSD/EC2 platform. Of these, I know bsdiff and scrypt are very widely used and I suspect that kivaloo is not; but beyond that I have very little knowledge of how widely or where my work is being used. Anecdotally it seems that other developers are in similar positions: At conferences I&#39;ve heard variations on &quot;you&#39;re using my code? Wow, that&#39;s awesome; I had no idea&quot; many times.<br>
I have even less knowledge of what people are doing with my work or what problems or limitations they&#39;re running into. Occasionally I get bug reports or feature requests; but I know I only hear from a very small proportion of the users of my work. I have a long list of feature ideas which are sitting in limbo simply because I don&#39;t know if anyone would ever use them — I suspect the answer is yes, but I&#39;m not going to spend time implementing these until I have some confirmation of that.<br>
A lot of mid-size companies would like to be able to pay for support for the software they&#39;re using, but can&#39;t find anyone to provide it. For larger companies, it&#39;s often easier — they can simply hire the author of the software (and many developers who do ongoing maintenance work on open source software were in fact hired for this sort of &quot;in-house expertise&quot; role) — but there&#39;s very little available for a company which needs a few minutes per month of expertise. In many cases, the best support they can find is sending an email to the developer of the software they&#39;re using and not paying anything at all — we&#39;ve all received &quot;can you help me figure out how to use this&quot; emails, and most of us are happy to help when we have time — but relying on developer generosity is not a good long-term solution.<br>
Every few months, I receive email from people asking if there&#39;s any way for them to support my open source software contributions. (Usually I encourage them to donate to the FreeBSD Foundation.) Conversely, there are developers whose work I would like to support (e.g., people working on FreeBSD wifi and video drivers), but there isn&#39;t any straightforward way to do this. Patreon has demonstrated that there are a lot of people willing to pay to support what they see as worthwhile work, even if they don&#39;t get anything directly in exchange for their patronage.</p>

<p>It seems to me that this is a case where problems are in fact solutions to other problems. To wit:<br>
Users of open source software want to be able to get help with their use cases; developers of open source software want to know how people are using their code.<br>
Users of open source software want to support the the work they use; developers of open source software want to know which projects users care about.<br>
Users of open source software want specific improvements; developers of open source software may be interested in making those specific changes, but don&#39;t want to spend the time until they know someone would use them.<br>
Users of open source software have money; developers of open source software get day jobs writing other code because nobody is paying them to maintain their open source software.</p>

<p>I&#39;d like to see this situation get fixed. As I envision it, a solution would look something like a cross between Patreon and Bugzilla: Users would be able sign up to &quot;support&quot; projects of their choosing, with a number of dollars per month (possibly arbitrary amounts, possibly specified tiers; maybe including $0/month), and would be able to open issues. These could be private (e.g., for &quot;technical support&quot; requests) or public (e.g., for bugs and feature requests); users would be able to indicate their interest in public issues created by other users. Developers would get to see the open issues, along with a nominal &quot;value&quot; computed based on allocating the incoming dollars of &quot;support contracts&quot; across the issues each user has expressed an interest in, allowing them to focus on issues with higher impact.</p>
</blockquote>

<ul>
<li>He poses three questions to users about whether or not people (users and software developers alike) would be interested in this and whether payment (giving and receiving, respectively) is interesting<br></li>
<li>Check out the comments (and those on [<a href="https://news.ycombinator.com/item?id=14313804%5D(reddit.com)" rel="nofollow">https://news.ycombinator.com/item?id=14313804](reddit.com)</a>) as well for some suggestions and discussion on the topic
***</li>
</ul>

<h3><a href="http://www.h-i-r.net/2017/04/openbsd-vmm-hypervisor-part-2.html" rel="nofollow">OpenBSD vmm hypervisor: Part 2</a></h3>

<ul>
<li>We asked for people to write up their experience using OpenBSD’s VMM. This blog post is just that</li>
</ul>

<blockquote>
<p>This is going to be a (likely long-running, infrequently-appended) series of posts as I poke around in vmm.  A few months ago, I demonstrated some basic use of the vmm hypervisor as it existed in OpenBSD 6.0-CURRENT around late October, 2016. We&#39;ll call that video Part 1.<br>
Quite a bit of development was done on vmm before 6.1-RELEASE, and it&#39;s worth noting that some new features made their way in. Work continues, of course, and I can only imagine the hypervisor technology will mature plenty for the next release. As it stands, this is the first release of OpenBSD with a native hypervisor shipped in the base install, and that&#39;s exciting news in and of itself<br>
To get our virtual machines onto the network, we have to spend some time setting up a virtual ethernet interface. We&#39;ll run a DHCP server on that, and it&#39;ll be the default route for our virtual machines. We&#39;ll keep all the VMs on a private network segment, and use NAT to allow them to get to the network. There is a way to directly bridge VMs to the network in some situations, but I won&#39;t be covering that today.<br>
Create an empty disk image for your new VM. I&#39;d recommend 1.5GB to play with at first. You can do this without doas or root if you want your user account to be able to start the VM later. I made a &quot;vmm&quot; directory inside my home directory to store VM disk images in. You might have a different partition you wish to store these large files in.<br>
Boot up a brand new vm instance. You&#39;ll have to do this as root or with doas. You can download a -CURRENT install kernel/ramdisk (bsd.rd) from an OpenBSD mirror, or you can simply use the one that&#39;s on your existing system (/bsd.rd) like I&#39;ll do here.<br>
The command will start a VM named &quot;test.vm&quot;, display the console at startup, use /bsd.rd (from our host environment) as the boot image, allocate 256MB of memory, attach the first network interface to the switch called &quot;local&quot; we defined earlier in /etc/vm.conf, and use the test image we just created as the first disk drive.<br>
Now that the VM disk image file has a full installation of OpenBSD on it, build a VM configuration around it by adding the below block of configuration (with modifications as needed for owner, path and lladdr) to /etc/vm.conf<br>
I&#39;ve noticed that VMs with much less than 256MB of RAM allocated tend to be a little unstable for me. You&#39;ll also note that in the &quot;interface&quot; clause, I hard-coded the lladdr that was generated for it earlier. By specifying &quot;disable&quot; in vm.conf, the VM will show up in a stopped state that the owner of the VM (that&#39;s you!) can manually start without root access.</p>
</blockquote>

<ul>
<li>Let us know how VMM works for you
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.tedunangst.com/flak/post/openbsd-changes-of-note-621" rel="nofollow">openbsd changes of note 621</a></h3>

<ul>
<li>More stuff, more fun.</li>
<li>Fix script to not perform tty operations on things that aren’t ttys. Detected by pledge.</li>
<li>Merge libdrm 2.4.79.</li>
<li>After a forced unmount, also unmount any filesystems below that mount point.</li>
<li>Flip previously warm pages in the buffer cache to memory above the DMA region if uvm tells us it is available. Pages are not automatically promoted to upper memory. Instead it’s used as additional memory only for what the cache considers long term buffers. I/O still requires DMA memory, so writing to a buffer will pull it back down.</li>
<li>Makefile support for systems with both gcc and clang. Make i386 and amd64 so.</li>
<li>Take a more radical approach to disabling colours in clang.</li>
<li>When the data buffered for write in tmux exceeds a limit, discard it and redraw. Helps when a fast process is running inside tmux running inside a slow terminal.</li>
<li>Add a port of witness(4) lock validation tool from FreeBSD. Use it with mplock, rwlock, and mutex in the kernel.</li>
<li>Properly save and restore FPU context in vmm.</li>
<li>Remove KGDB. It neither compiles nor works.</li>
<li>Add a constant time AES implementation, from BearSSL.</li>
<li>Remove SSHv1 from ssh.</li>
<li>and more...
***</li>
</ul>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/BSDDirectoryGroupChoice" rel="nofollow">Digging into BSD&#39;s choice of Unix group for new directories and files</a></h3>

<blockquote>
<p>I have to eat some humble pie here. In comments on my entry on an interesting chmod failure, Greg A. Woods pointed out that FreeBSD&#39;s behavior of creating everything inside a directory with the group of the directory is actually traditional BSD behavior (it dates all the way back to the 1980s), not some odd new invention by FreeBSD. As traditional behavior it makes sense that it&#39;s explicitly allowed by the standards, but I&#39;ve also come to think that it makes sense in context and in general. To see this, we need some background about the problem facing BSD.<br>
In the beginning, two things were true in Unix: there was no mkdir() system call, and processes could only be in one group at a time. With processes being in only one group, the choice of the group for a newly created filesystem object was easy; it was your current group. This was felt to be sufficiently obvious behavior that the V7 creat(2) manpage doesn&#39;t even mention it.<br>
Now things get interesting. 4.1c BSD seems to be where mkdir(2) is introduced and where creat() stops being a system call and becomes an option to open(2). It&#39;s also where processes can be in multiple groups for the first time. The 4.1c BSD open(2) manpage is silent about the group of newly created files, while the mkdir(2) manpage specifically claims that new directories will have your effective group (ie, the V7 behavior). This is actually wrong. In both mkdir() in sys_directory.c and maknode() in ufs_syscalls.c, the group of the newly created object is set to the group of the parent directory. Then finally in the 4.2 BSD mkdir(2) manpage the group of the new directory is correctly documented (the 4.2 BSD open(2) manpage continues to say nothing about this). So BSD&#39;s traditional behavior was introduced at the same time as processes being in multiple groups, and we can guess that it was introduced as part of that change.<br>
When your process can only be in a single group, as in V7, it makes perfect sense to create new filesystem objects with that as their group. It&#39;s basically the same case as making new filesystem objects be owned by you; just as they get your UID, they also get your GID. When your process can be in multiple groups, things get less clear. A filesystem object can only be in one group, so which of your several groups should a new filesystem object be owned by, and how can you most conveniently change that choice?<br>
One option is to have some notion of a &#39;primary group&#39; and then provide ways to shuffle around which of your groups is the primary group.<br>
Another option is the BSD choice of inheriting the group from context. By far the most common case is that you want your new files and directories to be created in the &#39;context&#39;, ie the group, of the surrounding directory.<br>
If you fully embrace the idea of Unix processes being in multiple groups, not just having one primary group and then some number of secondary groups, then the BSD choice makes a lot of sense. And for all of its faults, BSD tended to relatively fully embrace its changes <br>
While it leads to some odd issues, such as the one I ran into, pretty much any choice here is going to have some oddities.</p>

<hr>
</blockquote>

<h3><a href="http://www.shellguardians.com/2017/05/centrally-managed-bhyve-infrastructure.html" rel="nofollow">Centrally managed Bhyve infrastructure with Ansible, libvirt and pkg-ssh</a></h3>

<blockquote>
<p>At work we&#39;ve been using Bhyve for a while to run non-critical systems.  It is a really nice and stable hypervisor even though we are using an earlier version available on FreeBSD 10.3. This means we lack Windows and VNC support among other things, but it is not a big deal.<br>
After some iterations in our internal tools, we realised that the installation process was too slow and we always repeated the same steps. Of course,  any good sysadmin will scream &quot;AUTOMATION!&quot; and so did we. Therefore, we started looking for different ways to improve our deployments.<br>
We had a look at existing frameworks that manage Bhyve, but none of them had a feature that we find really important: having a centralized repository of VM images. For instance, SmartOS applies this method successfully by having a backend server that stores a catalog of VMs and Zones, meaning that new instances can be deployed in a minute at most. This is a game changer if you are really busy in your day-to-day operations.</p>
</blockquote>

<ul>
<li>The following building blocks are used:

<ul>
<li>The ZFS snapshot of an existing VM. This will be our VM template.</li>
<li>A modified version of oneoff-pkg-create to package the ZFS snapshots.</li>
<li>pkg-ssh  and pkg-repo to host a local FreeBSD repo in a FreeBSD jail.</li>
<li>libvirt to manage our Bhyve VMs.</li>
<li>The ansible modules virt, virt_net and virt_pool.</li>
</ul></li>
</ul>

<blockquote>
<p>Once automated, the installation process needs 2 minutes at most, compared with the 30 minutes needed to manually install VM plus allowing us to deploy many guests in parallel.</p>

<hr>
</blockquote>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_maintainer_in_the_qemu" rel="nofollow">NetBSD maintainer in the QEMU project</a></h3>

<blockquote>
<p>QEMU - the FAST! processor emulator - is a generic, Open Source, machine emulator and virtualizer. It defines state of the art in modern virtualization.<br>
This software has been developed for multiplatform environments with support for NetBSD since virtually forever. It&#39;s the primary tool used by the NetBSD developers and release engineering team. It is run with continuous integration tests for daily commits and execute regression tests through the Automatic Test Framework (ATF).<br>
The QEMU developers warned the Open Source community - with version 2.9 of the emulator - that they will eventually drop support for suboptimally supported hosts if nobody will step in and take the maintainership to refresh the support. This warning was directed to major BSDs, Solaris, AIX and Haiku.<br>
Thankfully the NetBSD position has been filled - making NetBSD to restore official maintenance.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170510012526&mode=flat&count=0" rel="nofollow">OpenBSD Community Goes Gold</a></li>
<li><a href="https://www.meetup.com/CharmBUG/events/238218840/" rel="nofollow">CharmBUG’s Tor Hack-a-thon has been pushed back to July due to scheduling difficulties</a></li>
<li><a href="https://www.haiku-os.org/blog/vivek/2017-05-05_%5Bgsoc_2017%5D_3d_hardware_acceleration_in_haiku/" rel="nofollow">Direct Rendering Manager (DRM) Driver for i915, from the Linux kernel to Haiku with the help of DragonflyBSD’s Linux Compatibility layer</a></li>
<li><a href="https://twitter.com/bsdlme/status/863488045449977864" rel="nofollow">TomTom lists OpenBSD in license</a></li>
<li><a href="https://mail-index.netbsd.org/regional-london/2017/05/02/msg000571.html" rel="nofollow">London Net BSD Meetup on May 22nd</a></li>
<li><a href="http://knoxbug.org/2017-05-30" rel="nofollow">KnoxBUG meeting May 30th, 2017 - Introduction to FreeNAS</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/35EWVGZ#wrap" rel="nofollow">Felix - Home Firewall</a></li>
<li><a href="http://dpaste.com/0H51NX2#wrap" rel="nofollow">David - Docker Recipes for Jails</a></li>
<li><a href="http://dpaste.com/2VZ7S8K#wrap" rel="nofollow">Don - GoLang &amp; Rust</a></li>
<li><a href="http://dpaste.com/2A1FZF3#wrap" rel="nofollow">George - OGG feed</a></li>
<li><a href="http://dpaste.com/3D2B6J3#wrap" rel="nofollow">Roller - BSDCan Tips</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>193: Fire up the 802.11 AC</title>
  <link>https://www.bsdnow.tv/193</link>
  <guid isPermaLink="false">8cdacddb-11e3-4225-8039-b51eba86a375</guid>
  <pubDate>Wed, 10 May 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8cdacddb-11e3-4225-8039-b51eba86a375.mp3" length="90794164" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSD Now, Adrian Chadd on bringing up 802.11ac in FreeBSD, a PFsense and OpenVPN tutorial, and we talk about an interesting ZFS storage pool checkpoint project.</itunes:subtitle>
  <itunes:duration>2:06:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSD Now, Adrian Chadd on bringing up 802.11ac in FreeBSD, a PFsense and OpenVPN tutorial, and we talk about an interesting ZFS storage pool checkpoint project.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Bringing up 802.11ac on FreeBSD (http://adrianchadd.blogspot.com/2017/04/bringing-up-80211ac-on-freebsd.html)
Adrian Chadd has a new blog post about his work to bring 802.11ac support to FreeBSD
802.11ac allows for speeds up to 500mbps and total bandwidth into multiple gigabits
The FreeBSD net80211 stack has reasonably good 802.11n support, but no 802.11ac support. I decided a while ago to start adding basic 802.11ac support. It was a good exercise in figuring out what the minimum set of required features are and another excuse to go find some of the broken corner cases in net80211 that needed addressing.
802.11ac introduces a few new concepts that the stack needs to understand. I decided to use the QCA 802.11ac parts because (a) I know the firmware and general chip stuff from the first generation 11ac parts well, and (b) I know that it does a bunch of stuff (like rate control, packet scheduling, etc) so I don't have to do it. If I chose, say, the Intel 11ac parts then I'd have to implement a lot more of the fiddly stuff to get good behaviour.
Step one - adding VHT channels. I decided in the shorter term to cheat and just add VHT channels to the already very large ieee80211channel map. The linux way of there being a channel context rather than hundreds of static channels to choose from is better in the long run, but I wanted to get things up and running. So, that's what I did first - I added VHT flags for 20, 40, 80, 80+80 and 160MHz operating modes and I did the bare work required to populate the channel lists with VHT channels as well.
Then I needed to glue it into an 11ac driver. My ath10k port was far enough along to attempt this, so I added enough glue to say "I support VHT" to the iccaps field and propagated it to the driver for monitor mode configuration. And yes, after a bit of dancing, I managed to get a VHT channel to show up in ath10k in monitor mode and could capture 80MHz wide packets. Success!
By far the most fiddly was getting channel promotion to work. net80211 supports the concept of dumb NICs (like atheros 11abgn parts) very well, where you can have multiple virtual interfaces but the "driver" view of the right configuration is what's programmed into the hardware. For firmware NICs which do this themselves (like basically everything sold today) this isn't exactly all that helpful. So, for now, it's limited to a single VAP, and the VAP configuration is partially derived from the global state and partially derived from the negotiated state. It's annoying, but it is adding to the list of things I will have to fix later.
the QCA chips/firmware do 802.11 crypto offload. They actually pretend that there's no key - you don't include the IV, you don't include padding, or anything. You send commands to set the crypto keys and then you send unencrypted 802.11 frames (or 802.3 frames if you want to do ethernet only.) This means that I had to teach net80211 a few things:
+ frames decrypted by the hardware needed to have a "I'm decrypted" bit set, because the 802.11 header field saying "I'm decrypted!" is cleared
+ frames encrypted don't have the "i'm encrypted" bit set
+ frames encrypted/decrypted have no padding, so I needed to teach the input path and crypto paths to not validate those if the hardware said "we offload it all."
Now comes the hard bit of fixing the shortcomings before I can commit the driver. There are .. lots. The first one is the global state. The ath10k firmware allows what they call 'vdevs' (virtual devices) - for example, multiple SSID/BSSID support is implemented with multiple vdevs. STA+WDS is implemented with vdevs. STA+P2P is implemented with vdevs. So, technically speaking I should go and find all of the global state that should really be per-vdev and make it per-vdev. This is tricky though, because a lot of the state isn't kept per-VAP even though it should be.
 Anyway, so far so good. I need to do some of the above and land it in FreeBSD-HEAD so I can finish off the ath10k port and commit what I have to FreeBSD. There's a lot of stuff coming - including all of the wave-2 stuff (like multiuser MIMO / MU-MIMO) which I just plainly haven't talked about yet. Viva la FreeBSD wireless!
pfSense and OpenVPN Routing (http://www.terrafoundry.net/blog/2017/04/12/pfsense-openvpn/)
This article tries to be a simple guide on how to enable your home (or small office) https://www.pfsense.org/ (pfSense) setup to route some traffic via the vanilla Internet, and some via a VPN site that you’ve setup in a remote location.
Reasons to Setup a VPN:
Control
Security
Privacy
Fun
VPNs do not instantly guarantee privacy, they’re a layer, as with any other measure you might invoke. In this example I used a server that’s directly under my name. Sure, it was a country with strict privacy laws, but that doesn’t mean that the outgoing IP address wouldn’t be logged somewhere down the line.
There’s also no reason you have to use your own OpenVPN install, there are many, many personal providers out there, who can offer the same functionality, and a degree of anonymity. (If you and a hundred other people are all coming from one IP, it becomes extremely difficult to differentiate, some VPN providers even claim a ‘logless’ setup.)
VPNs can be slow. The reason I have a split-setup in this article, is because there are devices that I want to connect to the internet quickly, and that I’m never doing sensitive things on, like banking. I don’t mind if my Reddit-browsing and IRC messages are a bit slower, but my Nintendo Switch and PS4 should have a nippy connection.
Services like Netflix can and do block VPN traffic in some cases. This is more of an issue for wider VPN providers (I suspect, but have no proof, that they just blanket block known VPN IP addresses.)
If your VPN is in another country, search results and tracking can be skewed. This is arguable a good thing, who wants to be tracked? But it can also lead to frustration if your DuckDuckGo results are tailored to the middle of Paris, rather than your flat in Birmingham.
The tutorial walks through the basic setup: Labeling the interfaces, configuring DHCP, creating a VPN:
Now that we have our OpenVPN connection set up, we’ll double check that we’ve got our interfaces assigned
With any luck (after we’ve assigned our OPENVPN connection correctly, you should now see your new Virtual Interface on the pfSense Dashboard
We’re charging full steam towards the sections that start to lose people. Don’t be disheartened if you’ve had a few issues up to now, there is no “right” way to set up a VPN installation, and it may be that you have to tweak a few things and dive into a few man-pages before you’re set up.
NAT is tricky, and frankly it only exists because we stretched out IPv4 for much longer than we should have. That being said it’s a necessary evil in this day and age, so let’s set up our connection to work with it.
We need NAT here because we’re going to masque our machines on the LAN interface to show as coming from the OpenVPN client IP address, to the OpenVPN server.  Head over to Firewall -&amp;gt; NAT -&amp;gt; Outbound.
The first thing we need to do in this section, is to change the Outbound NAT Mode to something we can work with, in this case “Hybrid.”
Configure the LAN interface to be NAT’d to the OpenVPN address, and the INSECURE interface to use your regular ISP connection
Configure the firewall to allow traffic from the LAN network to reach the INSECURE network
Then add a second rule allowing traffic from the LAN network to any address, and set the gateway the the OPENVPN connection
And there you have it, traffic from the LAN is routed via the VPN, and traffic from the INSECURE network uses the naked internet connection
***
Switching to OpenBSD (https://mndrix.blogspot.co.uk/2017/05/switching-to-openbsd.html)
After 12 years, I switched from macOS to OpenBSD.  It's clean, focused, stable, consistent and lets me get my work done without any hassle.
When I first became interested in computers, I thought operating systems were fascinating. For years I would reinstall an operating system every other weekend just to try a different configuration: MS-DOS 3.3, Windows 3.0, Linux 1.0 (countless hours recompiling kernels).  In high school, I settled down and ran OS/2 for 5 years until I graduated college. I switched to Linux after college and used it exclusively for 5 years. I got tired of configuring Linux, so I switched to OS X for the next 12 years, where things just worked.
But Snow Leopard was 7 years ago. These days, OS X is like running a denial of service attack against myself.  macOS has a dozen apps I don't use but can't remove. Updating them requires a restart.  Frequent updates to the browser require a restart.  A minor XCode update requires me to download a 4.3 GB file.  My monitors frequently turn off and require a restart to fix.  A system's availability is a function (http://techthoughts.typepad.com/managing_computers/2007/11/availability-mt.html) of mean time between failure and mean time to repair.  For macOS, both numbers are heading in the wrong direction for me. I don't hold any hard feelings about it, but it's time for me to get off this OS and back to productive work.
I found OpenBSD very refreshing, so I created a bootable thumb drive and within an hour had it up and running on a two-year old laptop.  I've been using it for my daily work for the past two weeks and it's been great.  Simple, boring and productive.  Just the way I like it.  The documentation is fantastic.  I've been using Unix for years and have learned quite a bit just by reading their man pages.  OS releases come like clockwork every 6 months and are supported for 12.  Security and other updates seem relatively rare between releases (roughly one small patch per week during 6.0).  With syspatch in 6.1, installing them should be really easy too.
ZFS Storage Pool Checkpoint Project (https://sdimitro.github.io/post/zpool-checkpoint)
During the OpenZFS summit last year (2016), Dan Kimmel and I quickly hacked together the zpool checkpoint command in ZFS, which allows reverting an entire pool to a previous state. Since it was just for a hackathon, our design was bare bones and our implementation far from complete. Around a month later, we had a new and almost complete design within Delphix and I was able to start the implementation on my own. I completed the implementation last month, and we’re now running regression tests, so I decided to write this blog post explaining what a storage pool checkpoint is, why we need it within Delphix, and how to use it.
The Delphix product is basically a VM running DelphixOS (a derivative of illumos) with our application stack on top of it. During an upgrade, the VM reboots into the new OS bits and then runs some scripts that update the environment (directories, snapshots, open connections, etc.) for the new version of our app stack. Software being software, failures can happen at different points during the upgrade process. When an upgrade script that makes changes to ZFS fails, we have a corresponding rollback script that attempts to bring ZFS and our app stack back to their previous state. This is very tricky as we need to undo every single modification applied to ZFS (including dataset creation and renaming, or enabling new zpool features).
The idea of Storage Pool Checkpoint (aka zpool checkpoint) deals with exactly that. It can be thought of as a “pool-wide snapshot” (or a variation of extreme rewind that doesn’t corrupt your data). It remembers the entire state of the pool at the point that it was taken and the user can revert back to it later or discard it. Its generic use case is an administrator that is about to perform a set of destructive actions to ZFS as part of a critical procedure. She takes a checkpoint of the pool before performing the actions, then rewinds back to it if one of them fails or puts the pool into an unexpected state. Otherwise, she discards it. With the assumption that no one else is making modifications to ZFS, she basically wraps all these actions into a “high-level transaction”.
I definitely see value in this for the appliance use case
Some usage examples follow, along with some caveats.
One of the restrictions is that you cannot attach, detach, or remove a device while a checkpoint exists. However, the zpool add operation is still possible, however if you roll back to the checkpoint, the device will no longer be part of the pool. Rather than a shortcoming, this seems like a nice feature, a way to help users avoid the most common foot shooting (which I witnessed in person at Linux Fest), adding a new log or cache device, but missing a keyword and adding it is a storage vdev rather than a aux vdev. This operation could simply be undone if a checkpoint where taken before the device was added.
***
News Roundup
Review of TrueOS (https://distrowatch.com/weekly.php?issue=20170501#trueos)
TrueOS, which was formerly named PC-BSD, is a FreeBSD-based operating system. TrueOS is a rolling release platform which is based on FreeBSD's "CURRENT" branch, providing TrueOS with the latest drivers and features from FreeBSD. Apart from the name change, TrueOS has deviated from the old PC-BSD project in a number of ways. The system installer is now more streamlined (and I will touch on that later) and TrueOS is a rolling release platform while PC-BSD defaulted to point releases. Another change is PC-BSD used to allow the user to customize which software was installed at boot time, including the desktop environment. The TrueOS project now selects a minimal amount of software for the user and defaults to using the Lumina desktop environment.
From the conclusions:
What I took away from my time with TrueOS is that the project is different in a lot of ways from PC-BSD. Much more than just the name has changed. The system is now more focused on cutting edge software and features in FreeBSD's development branch. The install process has been streamlined and the user begins with a set of default software rather than selecting desired packages during the initial setup. The configuration tools, particularly the Control Panel and AppCafe, have changed a lot in the past year. The designs have a more flat, minimal look. It used to be that PC-BSD did not have a default desktop exactly, but there tended to be a focus on KDE. With TrueOS the project's in-house desktop, Lumina, serves as the default environment and I think it holds up fairly well.
In all, I think TrueOS offers a convenient way to experiment with new FreeBSD technologies and ZFS. I also think people who want to run FreeBSD on a desktop computer may want to look at TrueOS as it sets up a graphical environment automatically. However, people who want a stable desktop platform with lots of applications available out of the box may not find what they want with this project.
A simple guide to install Ubuntu on FreeBSD with byhve (https://www.davd.eu/install-ubuntu-on-freebsd-with-bhyve/)
David Prandzioch writes in his blog:
For some reasons I needed a Linux installation on my NAS. bhyve is a lightweight virtualization solution for FreeBSD that makes that easy and efficient. However, the CLI of bhyve is somewhat bulky and bare making it hard to use, especially for the first time. This is what vm-bhyve solves - it provides a simple CLI for working with virtual machines.
More details follow about what steps are needed to setup vm_bhyve on FreeBSD 
Also check out his other tutorials on his blog: https://www.davd.eu/freebsd/ (https://www.davd.eu/freebsd/)
***
Graphical Overview of the Architecture of FreeBSD  (https://dspinellis.github.io/unix-architecture/arch.pdf)
This diagram tries to show the different components that make up the FreeBSD Operating Systems
It breaks down the various utilities, libraries, and components into some categories and sub-categories:
User Commands:
Development (cc, ld, nm, as, etc)
File Management (ls, cp, cmp, mkdir)
Multiuser Commands (login, chown, su, who)
Number Processing (bc, dc, units, expr)
Text Processing (cut, grep, sort, uniq, wc)
User Messaging (mail, mesg, write, talk)
Little Languages (sed, awk, m4)
Network Clients (ftp, scp, fetch)
Document Preparation (*roff, eqn, tbl, refer)
Administrator and System Commands
Filesystem Management (fsck, newfs, gpart, mount, umount)
Networking (ifconfig, route, arp)
User Management (adduser, pw, vipw, sa, quota*)
Statistics (iostat, vmstat, pstat, gstat, top)
Network Servers (sshd, ftpd, ntpd, routed, rpc.*)
Scheduling (cron, periodic, rc.*, atrun)
Libraries (C Standard, Operating System, Peripheral Access, System File Access, Data Handling, Security, Internationalization, Threads)
System Call Interface (File I/O, Mountable Filesystems, File ACLs, File Permissions, Processes, Process Tracing, IPC, Memory Mapping, Shared Memory, Kernel Events, Memory Locking, Capsicum, Auditing, Jails)
Bootstrapping (Loaders, Configuration, Kernel Modules)
Kernel Utility Functions
Privilege Management (acl, mac, priv)
Multitasking (kproc, kthread, taskqueue, swi, ithread)
Memory Management (vmem, uma, pbuf, sbuf, mbuf, mbchain, malloc/free)
Generic (nvlist, osd, socket, mbuf_tags, bitset)
Virtualization (cpuset, crypto, device, devclass, driver)
Synchronization (lock, sx, sema, mutex, condvar_, atomic_*, signal)
Operations (sysctl, dtrace, watchdog, stack, alq, ktr, panic)
I/O Subsystem
Special Devices (line discipline, tty, raw character, raw disk)
Filesystems (UFS, FFS, NFS, CD9660, Ext2, UDF, ZFS, devfs, procfs)
Sockets
Network Protocols (TCP, UDP, UCMP, IPSec,  IP4, IP6)
Netgraph (50+ modules)
Drivers and Abstractions
Character Devices
CAM (ATA, SATA, SAS, SPI)
Network Interface Drivers (802.11, ifae, 100+, ifxl, NDIS)
GEOM
Storage (stripe, mirror, raid3, raid5, concat)
Encryption / Compression (eli, bde, shsec, uzip)
Filesystem (label, journal, cache, mbr, bsd)
Virtualization (md, nop, gate, virtstor)
Process Control Subsystems
Scheduler
Memory Management
Inter-process Communication
Debugging Support
***
Official OpenBSD 6.1 CD - There's only One! (http://undeadly.org/cgi?action=article&amp;amp;sid=20170503203426&amp;amp;mode=expanded)
Ebay auction Link (http://www.ebay.com/itm/The-only-Official-OpenBSD-6-1-CD-set-to-be-made-For-auction-for-the-project-/252910718452)
Now it turns out that in fact, exactly one CD set was made, and it can be yours if you are the successful bidder in the auction that ends on May 13, 2017 (About 3 days from when this episode was recorded).
The CD set is hand made and signed by Theo de Raadt.
Fun Fact: The winning bidder will have an OpenBSD CD set that even Theo doesn't have.
***
Beastie Bits
Hardware Wanted by OpenBSD developers (https://www.openbsd.org/want.html)
Donate hardware to FreeBSD developers (https://www.freebsd.org/donations/index.html#components)
Announcing NetBSD and the Google Summer of Code Projects 2017 (https://blog.netbsd.org/tnf/entry/announcing_netbsd_and_the_google)
Announcing FreeBSD GSoC 2017 Projects  (https://wiki.freebsd.org/SummerOfCode2017Projects)
LibreSSL 2.5.4 Released (https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.4-relnotes.txt)
CharmBUG Meeting - Tor Browser Bundle Hack-a-thon (https://www.meetup.com/CharmBUG/events/238218840/)
pkgsrcCon 2017 CFT (https://mail-index.netbsd.org/netbsd-advocacy/2017/05/01/msg000735.html)
Experimental Price Cuts (https://blather.michaelwlucas.com/archives/2931)
Linux Fest North West 2017: Three Generations of FreeNAS: The World’s most popular storage OS turns 12 (https://www.youtube.com/watch?v=x6VznQz3VEY)
***
Feedback/Questions
Don - Reproducible builds &amp;amp; gcc/clang (http://dpaste.com/2AXX75X#wrap)
architect - C development on BSD (http://dpaste.com/0FJ854X#wrap)
David - Linux ABI (http://dpaste.com/2CCK2WF#wrap)
Tom - ZFS (http://dpaste.com/2Z25FKJ#wrap)
RAIDZ Stripe Width Myth, Busted (https://www.delphix.com/blog/delphix-engineering/zfs-raidz-stripe-width-or-how-i-learned-stop-worrying-and-love-raidz)
Ivan - Jails (http://dpaste.com/1Z173WA#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSD Now, Adrian Chadd on bringing up 802.11ac in FreeBSD, a PFsense and OpenVPN tutorial, and we talk about an interesting ZFS storage pool checkpoint project.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://adrianchadd.blogspot.com/2017/04/bringing-up-80211ac-on-freebsd.html" rel="nofollow">Bringing up 802.11ac on FreeBSD</a></h3>

<ul>
<li>Adrian Chadd has a new blog post about his work to bring 802.11ac support to FreeBSD</li>
<li>802.11ac allows for speeds up to 500mbps and total bandwidth into multiple gigabits</li>
</ul>

<blockquote>
<p>The FreeBSD net80211 stack has reasonably good 802.11n support, but no 802.11ac support. I decided a while ago to start adding basic 802.11ac support. It was a good exercise in figuring out what the minimum set of required features are and another excuse to go find some of the broken corner cases in net80211 that needed addressing.<br>
802.11ac introduces a few new concepts that the stack needs to understand. I decided to use the QCA 802.11ac parts because (a) I know the firmware and general chip stuff from the first generation 11ac parts well, and (b) I know that it does a bunch of stuff (like rate control, packet scheduling, etc) so I don&#39;t have to do it. If I chose, say, the Intel 11ac parts then I&#39;d have to implement a lot more of the fiddly stuff to get good behaviour.<br>
Step one - adding VHT channels. I decided in the shorter term to cheat and just add VHT channels to the already very large ieee80211_channel map. The linux way of there being a channel context rather than hundreds of static channels to choose from is better in the long run, but I wanted to get things up and running. So, that&#39;s what I did first - I added VHT flags for 20, 40, 80, 80+80 and 160MHz operating modes and I did the bare work required to populate the channel lists with VHT channels as well.<br>
Then I needed to glue it into an 11ac driver. My ath10k port was far enough along to attempt this, so I added enough glue to say &quot;I support VHT&quot; to the ic_caps field and propagated it to the driver for monitor mode configuration. And yes, after a bit of dancing, I managed to get a VHT channel to show up in ath10k in monitor mode and could capture 80MHz wide packets. Success!</p>

<p>By far the most fiddly was getting channel promotion to work. net80211 supports the concept of dumb NICs (like atheros 11abgn parts) very well, where you can have multiple virtual interfaces but the &quot;driver&quot; view of the right configuration is what&#39;s programmed into the hardware. For firmware NICs which do this themselves (like basically everything sold today) this isn&#39;t exactly all that helpful. So, for now, it&#39;s limited to a single VAP, and the VAP configuration is partially derived from the global state and partially derived from the negotiated state. It&#39;s annoying, but it is adding to the list of things I will have to fix later.<br>
the QCA chips/firmware do 802.11 crypto offload. They actually pretend that there&#39;s no key - you don&#39;t include the IV, you don&#39;t include padding, or anything. You send commands to set the crypto keys and then you send unencrypted 802.11 frames (or 802.3 frames if you want to do ethernet only.) This means that I had to teach net80211 a few things:</p>

<ul>
<li>frames decrypted by the hardware needed to have a &quot;I&#39;m decrypted&quot; bit set, because the 802.11 header field saying &quot;I&#39;m decrypted!&quot; is cleared</li>
<li>frames encrypted don&#39;t have the &quot;i&#39;m encrypted&quot; bit set</li>
<li>frames encrypted/decrypted have no padding, so I needed to teach the input path and crypto paths to not validate those if the hardware said &quot;we offload it all.&quot;
Now comes the hard bit of fixing the shortcomings before I can commit the driver. There are .. lots. The first one is the global state. The ath10k firmware allows what they call &#39;vdevs&#39; (virtual devices) - for example, multiple SSID/BSSID support is implemented with multiple vdevs. STA+WDS is implemented with vdevs. STA+P2P is implemented with vdevs. So, technically speaking I should go and find all of the global state that should really be per-vdev and make it per-vdev. This is tricky though, because a lot of the state isn&#39;t kept per-VAP even though it should be.
Anyway, so far so good. I need to do some of the above and land it in FreeBSD-HEAD so I can finish off the ath10k port and commit what I have to FreeBSD. There&#39;s a lot of stuff coming - including all of the wave-2 stuff (like multiuser MIMO / MU-MIMO) which I just plainly haven&#39;t talked about yet. Viva la FreeBSD wireless!
***</li>
</ul>
</blockquote>

<h3><a href="http://www.terrafoundry.net/blog/2017/04/12/pfsense-openvpn/" rel="nofollow">pfSense and OpenVPN Routing</a></h3>

<blockquote>
<p>This article tries to be a simple guide on how to enable your home (or small office) [<a href="https://www.pfsense.org/%5D(pfSense)" rel="nofollow">https://www.pfsense.org/](pfSense)</a> setup to route some traffic via the vanilla Internet, and some via a VPN site that you’ve setup in a remote location.</p>
</blockquote>

<ul>
<li>Reasons to Setup a VPN:

<ul>
<li>Control</li>
<li>Security</li>
<li>Privacy</li>
<li>Fun</li>
</ul></li>
</ul>

<blockquote>
<p>VPNs do not instantly guarantee privacy, they’re a layer, as with any other measure you might invoke. In this example I used a server that’s directly under my name. Sure, it was a country with strict privacy laws, but that doesn’t mean that the outgoing IP address wouldn’t be logged somewhere down the line.<br>
There’s also no reason you have to use your own OpenVPN install, there are many, many personal providers out there, who can offer the same functionality, and a degree of anonymity. (If you and a hundred other people are all coming from one IP, it becomes extremely difficult to differentiate, some VPN providers even claim a ‘logless’ setup.)<br>
VPNs can be slow. The reason I have a split-setup in this article, is because there are devices that I want to connect to the internet quickly, and that I’m never doing sensitive things on, like banking. I don’t mind if my Reddit-browsing and IRC messages are a bit slower, but my Nintendo Switch and PS4 should have a nippy connection.<br>
Services like Netflix can and do block VPN traffic in some cases. This is more of an issue for wider VPN providers (I suspect, but have no proof, that they just blanket block known VPN IP addresses.)<br>
If your VPN is in another country, search results and tracking can be skewed. This is arguable a good thing, who wants to be tracked? But it can also lead to frustration if your DuckDuckGo results are tailored to the middle of Paris, rather than your flat in Birmingham.</p>
</blockquote>

<ul>
<li>The tutorial walks through the basic setup: Labeling the interfaces, configuring DHCP, creating a VPN:</li>
</ul>

<blockquote>
<p>Now that we have our OpenVPN connection set up, we’ll double check that we’ve got our interfaces assigned<br>
With any luck (after we’ve assigned our OPENVPN connection correctly, you should now see your new Virtual Interface on the pfSense Dashboard<br>
We’re charging full steam towards the sections that start to lose people. Don’t be disheartened if you’ve had a few issues up to now, there is no “right” way to set up a VPN installation, and it may be that you have to tweak a few things and dive into a few man-pages before you’re set up.<br>
NAT is tricky, and frankly it only exists because we stretched out IPv4 for much longer than we should have. That being said it’s a necessary evil in this day and age, so let’s set up our connection to work with it.<br>
We need NAT here because we’re going to masque our machines on the LAN interface to show as coming from the OpenVPN client IP address, to the OpenVPN server.  Head over to Firewall -&gt; NAT -&gt; Outbound.<br>
The first thing we need to do in this section, is to change the Outbound NAT Mode to something we can work with, in this case “Hybrid.”</p>
</blockquote>

<ul>
<li>Configure the LAN interface to be NAT’d to the OpenVPN address, and the INSECURE interface to use your regular ISP connection</li>
<li>Configure the firewall to allow traffic from the LAN network to reach the INSECURE network</li>
<li>Then add a second rule allowing traffic from the LAN network to any address, and set the gateway the the OPENVPN connection</li>
<li>And there you have it, traffic from the LAN is routed via the VPN, and traffic from the INSECURE network uses the naked internet connection
***</li>
</ul>

<h3><a href="https://mndrix.blogspot.co.uk/2017/05/switching-to-openbsd.html" rel="nofollow">Switching to OpenBSD</a></h3>

<blockquote>
<p>After 12 years, I switched from macOS to OpenBSD.  It&#39;s clean, focused, stable, consistent and lets me get my work done without any hassle.<br>
When I first became interested in computers, I thought operating systems were fascinating. For years I would reinstall an operating system every other weekend just to try a different configuration: MS-DOS 3.3, Windows 3.0, Linux 1.0 (countless hours recompiling kernels).  In high school, I settled down and ran OS/2 for 5 years until I graduated college. I switched to Linux after college and used it exclusively for 5 years. I got tired of configuring Linux, so I switched to OS X for the next 12 years, where things just worked.<br>
But Snow Leopard was 7 years ago. These days, OS X is like running a denial of service attack against myself.  macOS has a dozen apps I don&#39;t use but can&#39;t remove. Updating them requires a restart.  Frequent updates to the browser require a restart.  A minor XCode update requires me to download a 4.3 GB file.  My monitors frequently turn off and require a restart to fix.  A system&#39;s <a href="http://techthoughts.typepad.com/managing_computers/2007/11/availability-mt.html" rel="nofollow">availability is a function</a> of mean time between failure and mean time to repair.  For macOS, both numbers are heading in the wrong direction for me. I don&#39;t hold any hard feelings about it, but it&#39;s time for me to get off this OS and back to productive work.<br>
I found OpenBSD very refreshing, so I created a bootable thumb drive and within an hour had it up and running on a two-year old laptop.  I&#39;ve been using it for my daily work for the past two weeks and it&#39;s been great.  Simple, boring and productive.  Just the way I like it.  The documentation is fantastic.  I&#39;ve been using Unix for years and have learned quite a bit just by reading their man pages.  OS releases come like clockwork every 6 months and are supported for 12.  Security and other updates seem relatively rare between releases (roughly one small patch per week during 6.0).  With syspatch in 6.1, installing them should be really easy too.</p>

<hr>
</blockquote>

<h3><a href="https://sdimitro.github.io/post/zpool-checkpoint" rel="nofollow">ZFS Storage Pool Checkpoint Project</a></h3>

<blockquote>
<p>During the OpenZFS summit last year (2016), Dan Kimmel and I quickly hacked together the zpool checkpoint command in ZFS, which allows reverting an entire pool to a previous state. Since it was just for a hackathon, our design was bare bones and our implementation far from complete. Around a month later, we had a new and almost complete design within Delphix and I was able to start the implementation on my own. I completed the implementation last month, and we’re now running regression tests, so I decided to write this blog post explaining what a storage pool checkpoint is, why we need it within Delphix, and how to use it.<br>
The Delphix product is basically a VM running DelphixOS (a derivative of illumos) with our application stack on top of it. During an upgrade, the VM reboots into the new OS bits and then runs some scripts that update the environment (directories, snapshots, open connections, etc.) for the new version of our app stack. Software being software, failures can happen at different points during the upgrade process. When an upgrade script that makes changes to ZFS fails, we have a corresponding rollback script that attempts to bring ZFS and our app stack back to their previous state. This is very tricky as we need to undo every single modification applied to ZFS (including dataset creation and renaming, or enabling new zpool features).<br>
The idea of Storage Pool Checkpoint (aka zpool checkpoint) deals with exactly that. It can be thought of as a “pool-wide snapshot” (or a variation of extreme rewind that doesn’t corrupt your data). It remembers the entire state of the pool at the point that it was taken and the user can revert back to it later or discard it. Its generic use case is an administrator that is about to perform a set of destructive actions to ZFS as part of a critical procedure. She takes a checkpoint of the pool before performing the actions, then rewinds back to it if one of them fails or puts the pool into an unexpected state. Otherwise, she discards it. With the assumption that no one else is making modifications to ZFS, she basically wraps all these actions into a “high-level transaction”.</p>
</blockquote>

<ul>
<li>I definitely see value in this for the appliance use case</li>
<li>Some usage examples follow, along with some caveats.</li>
<li>One of the restrictions is that you cannot attach, detach, or remove a device while a checkpoint exists. However, the zpool add operation is still possible, however if you roll back to the checkpoint, the device will no longer be part of the pool. Rather than a shortcoming, this seems like a nice feature, a way to help users avoid the most common foot shooting (which I witnessed in person at Linux Fest), adding a new log or cache device, but missing a keyword and adding it is a storage vdev rather than a aux vdev. This operation could simply be undone if a checkpoint where taken before the device was added.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20170501#trueos" rel="nofollow">Review of TrueOS</a></h3>

<blockquote>
<p>TrueOS, which was formerly named PC-BSD, is a FreeBSD-based operating system. TrueOS is a rolling release platform which is based on FreeBSD&#39;s &quot;CURRENT&quot; branch, providing TrueOS with the latest drivers and features from FreeBSD. Apart from the name change, TrueOS has deviated from the old PC-BSD project in a number of ways. The system installer is now more streamlined (and I will touch on that later) and TrueOS is a rolling release platform while PC-BSD defaulted to point releases. Another change is PC-BSD used to allow the user to customize which software was installed at boot time, including the desktop environment. The TrueOS project now selects a minimal amount of software for the user and defaults to using the Lumina desktop environment.</p>
</blockquote>

<ul>
<li>From the conclusions:</li>
</ul>

<blockquote>
<p>What I took away from my time with TrueOS is that the project is different in a lot of ways from PC-BSD. Much more than just the name has changed. The system is now more focused on cutting edge software and features in FreeBSD&#39;s development branch. The install process has been streamlined and the user begins with a set of default software rather than selecting desired packages during the initial setup. The configuration tools, particularly the Control Panel and AppCafe, have changed a lot in the past year. The designs have a more flat, minimal look. It used to be that PC-BSD did not have a default desktop exactly, but there tended to be a focus on KDE. With TrueOS the project&#39;s in-house desktop, Lumina, serves as the default environment and I think it holds up fairly well.<br>
In all, I think TrueOS offers a convenient way to experiment with new FreeBSD technologies and ZFS. I also think people who want to run FreeBSD on a desktop computer may want to look at TrueOS as it sets up a graphical environment automatically. However, people who want a stable desktop platform with lots of applications available out of the box may not find what they want with this project.</p>

<hr>
</blockquote>

<h3><a href="https://www.davd.eu/install-ubuntu-on-freebsd-with-bhyve/" rel="nofollow">A simple guide to install Ubuntu on FreeBSD with byhve</a></h3>

<ul>
<li>David Prandzioch writes in his blog:</li>
</ul>

<blockquote>
<p>For some reasons I needed a Linux installation on my NAS. bhyve is a lightweight virtualization solution for FreeBSD that makes that easy and efficient. However, the CLI of bhyve is somewhat bulky and bare making it hard to use, especially for the first time. This is what vm-bhyve solves - it provides a simple CLI for working with virtual machines.</p>
</blockquote>

<ul>
<li>More details follow about what steps are needed to setup vm_bhyve on FreeBSD </li>
<li>Also check out his other tutorials on his blog: <a href="https://www.davd.eu/freebsd/" rel="nofollow">https://www.davd.eu/freebsd/</a>
***</li>
</ul>

<h3><a href="https://dspinellis.github.io/unix-architecture/arch.pdf" rel="nofollow">Graphical Overview of the Architecture of FreeBSD </a></h3>

<ul>
<li>This diagram tries to show the different components that make up the FreeBSD Operating Systems</li>
<li>It breaks down the various utilities, libraries, and components into some categories and sub-categories:</li>
<li>User Commands:

<ul>
<li>Development (cc, ld, nm, as, etc)</li>
<li>File Management (ls, cp, cmp, mkdir)</li>
<li>Multiuser Commands (login, chown, su, who)</li>
<li>Number Processing (bc, dc, units, expr)</li>
<li>Text Processing (cut, grep, sort, uniq, wc)</li>
<li>User Messaging (mail, mesg, write, talk)</li>
<li>Little Languages (sed, awk, m4)</li>
<li>Network Clients (ftp, scp, fetch)</li>
<li>Document Preparation (*roff, eqn, tbl, refer)</li>
</ul></li>
<li>Administrator and System Commands

<ul>
<li>Filesystem Management (fsck, newfs, gpart, mount, umount)</li>
<li>Networking (ifconfig, route, arp)</li>
<li>User Management (adduser, pw, vipw, sa, quota*)</li>
<li>Statistics (iostat, vmstat, pstat, gstat, top)</li>
<li>Network Servers (sshd, ftpd, ntpd, routed, rpc.*)</li>
<li>Scheduling (cron, periodic, rc.*, atrun)</li>
</ul></li>
<li>Libraries (C Standard, Operating System, Peripheral Access, System File Access, Data Handling, Security, Internationalization, Threads)</li>
<li>System Call Interface (File I/O, Mountable Filesystems, File ACLs, File Permissions, Processes, Process Tracing, IPC, Memory Mapping, Shared Memory, Kernel Events, Memory Locking, Capsicum, Auditing, Jails)</li>
<li>Bootstrapping (Loaders, Configuration, Kernel Modules)</li>
<li>Kernel Utility Functions

<ul>
<li>Privilege Management (acl, mac, priv)</li>
<li>Multitasking (kproc, kthread, taskqueue, swi, ithread)</li>
<li>Memory Management (vmem, uma, pbuf, sbuf, mbuf, mbchain, malloc/free)</li>
<li>Generic (nvlist, osd, socket, mbuf_tags, bitset)</li>
<li>Virtualization (cpuset, crypto, device, devclass, driver)</li>
<li>Synchronization (<em>lock, sx, sema, mutex, condvar_</em>, atomic_*, signal)</li>
<li>Operations (sysctl, dtrace, watchdog, stack, alq, ktr, panic)</li>
</ul></li>
<li>I/O Subsystem

<ul>
<li>Special Devices (line discipline, tty, raw character, raw disk)</li>
<li>Filesystems (UFS, FFS, NFS, CD9660, Ext2, UDF, ZFS, devfs, procfs)</li>
<li>Sockets</li>
<li>Network Protocols (TCP, UDP, UCMP, IPSec,  IP4, IP6)</li>
<li>Netgraph (50+ modules)</li>
</ul></li>
<li>Drivers and Abstractions

<ul>
<li>Character Devices</li>
<li>CAM (ATA, SATA, SAS, SPI)</li>
<li>Network Interface Drivers (802.11, if_ae, 100+, if_xl, NDIS)</li>
</ul></li>
<li>GEOM

<ul>
<li>Storage (stripe, mirror, raid3, raid5, concat)</li>
<li>Encryption / Compression (eli, bde, shsec, uzip)</li>
<li>Filesystem (label, journal, cache, mbr, bsd)</li>
<li>Virtualization (md, nop, gate, virtstor)</li>
</ul></li>
<li>Process Control Subsystems

<ul>
<li>Scheduler</li>
<li>Memory Management</li>
<li>Inter-process Communication</li>
<li>Debugging Support
***</li>
</ul></li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170503203426&mode=expanded" rel="nofollow">Official OpenBSD 6.1 CD - There&#39;s only One!</a></h3>

<ul>
<li><a href="http://www.ebay.com/itm/The-only-Official-OpenBSD-6-1-CD-set-to-be-made-For-auction-for-the-project-/252910718452" rel="nofollow">Ebay auction Link</a></li>
<li>Now it turns out that in fact, exactly one CD set was made, and it can be yours if you are the successful bidder in the auction that ends on May 13, 2017 (About 3 days from when this episode was recorded).</li>
<li>The CD set is hand made and signed by Theo de Raadt.</li>
<li>Fun Fact: The winning bidder will have an OpenBSD CD set that even Theo doesn&#39;t have.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.openbsd.org/want.html" rel="nofollow">Hardware Wanted by OpenBSD developers</a></li>
<li><a href="https://www.freebsd.org/donations/index.html#components" rel="nofollow">Donate hardware to FreeBSD developers</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/announcing_netbsd_and_the_google" rel="nofollow">Announcing NetBSD and the Google Summer of Code Projects 2017</a></li>
<li><a href="https://wiki.freebsd.org/SummerOfCode2017Projects" rel="nofollow">Announcing FreeBSD GSoC 2017 Projects </a></li>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.4-relnotes.txt" rel="nofollow">LibreSSL 2.5.4 Released</a></li>
<li><a href="https://www.meetup.com/CharmBUG/events/238218840/" rel="nofollow">CharmBUG Meeting - Tor Browser Bundle Hack-a-thon</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2017/05/01/msg000735.html" rel="nofollow">pkgsrcCon 2017 CFT</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/2931" rel="nofollow">Experimental Price Cuts</a></li>
<li><a href="https://www.youtube.com/watch?v=x6VznQz3VEY" rel="nofollow">Linux Fest North West 2017: Three Generations of FreeNAS: The World’s most popular storage OS turns 12</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2AXX75X#wrap" rel="nofollow">Don - Reproducible builds &amp; gcc/clang</a></li>
<li><a href="http://dpaste.com/0FJ854X#wrap" rel="nofollow">architect - C development on BSD</a></li>
<li><a href="http://dpaste.com/2CCK2WF#wrap" rel="nofollow">David - Linux ABI</a></li>
<li><a href="http://dpaste.com/2Z25FKJ#wrap" rel="nofollow">Tom - ZFS</a>

<ul>
<li><a href="https://www.delphix.com/blog/delphix-engineering/zfs-raidz-stripe-width-or-how-i-learned-stop-worrying-and-love-raidz" rel="nofollow">RAIDZ Stripe Width Myth, Busted</a></li>
</ul></li>
<li><a href="http://dpaste.com/1Z173WA#wrap" rel="nofollow">Ivan - Jails</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSD Now, Adrian Chadd on bringing up 802.11ac in FreeBSD, a PFsense and OpenVPN tutorial, and we talk about an interesting ZFS storage pool checkpoint project.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://adrianchadd.blogspot.com/2017/04/bringing-up-80211ac-on-freebsd.html" rel="nofollow">Bringing up 802.11ac on FreeBSD</a></h3>

<ul>
<li>Adrian Chadd has a new blog post about his work to bring 802.11ac support to FreeBSD</li>
<li>802.11ac allows for speeds up to 500mbps and total bandwidth into multiple gigabits</li>
</ul>

<blockquote>
<p>The FreeBSD net80211 stack has reasonably good 802.11n support, but no 802.11ac support. I decided a while ago to start adding basic 802.11ac support. It was a good exercise in figuring out what the minimum set of required features are and another excuse to go find some of the broken corner cases in net80211 that needed addressing.<br>
802.11ac introduces a few new concepts that the stack needs to understand. I decided to use the QCA 802.11ac parts because (a) I know the firmware and general chip stuff from the first generation 11ac parts well, and (b) I know that it does a bunch of stuff (like rate control, packet scheduling, etc) so I don&#39;t have to do it. If I chose, say, the Intel 11ac parts then I&#39;d have to implement a lot more of the fiddly stuff to get good behaviour.<br>
Step one - adding VHT channels. I decided in the shorter term to cheat and just add VHT channels to the already very large ieee80211_channel map. The linux way of there being a channel context rather than hundreds of static channels to choose from is better in the long run, but I wanted to get things up and running. So, that&#39;s what I did first - I added VHT flags for 20, 40, 80, 80+80 and 160MHz operating modes and I did the bare work required to populate the channel lists with VHT channels as well.<br>
Then I needed to glue it into an 11ac driver. My ath10k port was far enough along to attempt this, so I added enough glue to say &quot;I support VHT&quot; to the ic_caps field and propagated it to the driver for monitor mode configuration. And yes, after a bit of dancing, I managed to get a VHT channel to show up in ath10k in monitor mode and could capture 80MHz wide packets. Success!</p>

<p>By far the most fiddly was getting channel promotion to work. net80211 supports the concept of dumb NICs (like atheros 11abgn parts) very well, where you can have multiple virtual interfaces but the &quot;driver&quot; view of the right configuration is what&#39;s programmed into the hardware. For firmware NICs which do this themselves (like basically everything sold today) this isn&#39;t exactly all that helpful. So, for now, it&#39;s limited to a single VAP, and the VAP configuration is partially derived from the global state and partially derived from the negotiated state. It&#39;s annoying, but it is adding to the list of things I will have to fix later.<br>
the QCA chips/firmware do 802.11 crypto offload. They actually pretend that there&#39;s no key - you don&#39;t include the IV, you don&#39;t include padding, or anything. You send commands to set the crypto keys and then you send unencrypted 802.11 frames (or 802.3 frames if you want to do ethernet only.) This means that I had to teach net80211 a few things:</p>

<ul>
<li>frames decrypted by the hardware needed to have a &quot;I&#39;m decrypted&quot; bit set, because the 802.11 header field saying &quot;I&#39;m decrypted!&quot; is cleared</li>
<li>frames encrypted don&#39;t have the &quot;i&#39;m encrypted&quot; bit set</li>
<li>frames encrypted/decrypted have no padding, so I needed to teach the input path and crypto paths to not validate those if the hardware said &quot;we offload it all.&quot;
Now comes the hard bit of fixing the shortcomings before I can commit the driver. There are .. lots. The first one is the global state. The ath10k firmware allows what they call &#39;vdevs&#39; (virtual devices) - for example, multiple SSID/BSSID support is implemented with multiple vdevs. STA+WDS is implemented with vdevs. STA+P2P is implemented with vdevs. So, technically speaking I should go and find all of the global state that should really be per-vdev and make it per-vdev. This is tricky though, because a lot of the state isn&#39;t kept per-VAP even though it should be.
Anyway, so far so good. I need to do some of the above and land it in FreeBSD-HEAD so I can finish off the ath10k port and commit what I have to FreeBSD. There&#39;s a lot of stuff coming - including all of the wave-2 stuff (like multiuser MIMO / MU-MIMO) which I just plainly haven&#39;t talked about yet. Viva la FreeBSD wireless!
***</li>
</ul>
</blockquote>

<h3><a href="http://www.terrafoundry.net/blog/2017/04/12/pfsense-openvpn/" rel="nofollow">pfSense and OpenVPN Routing</a></h3>

<blockquote>
<p>This article tries to be a simple guide on how to enable your home (or small office) [<a href="https://www.pfsense.org/%5D(pfSense)" rel="nofollow">https://www.pfsense.org/](pfSense)</a> setup to route some traffic via the vanilla Internet, and some via a VPN site that you’ve setup in a remote location.</p>
</blockquote>

<ul>
<li>Reasons to Setup a VPN:

<ul>
<li>Control</li>
<li>Security</li>
<li>Privacy</li>
<li>Fun</li>
</ul></li>
</ul>

<blockquote>
<p>VPNs do not instantly guarantee privacy, they’re a layer, as with any other measure you might invoke. In this example I used a server that’s directly under my name. Sure, it was a country with strict privacy laws, but that doesn’t mean that the outgoing IP address wouldn’t be logged somewhere down the line.<br>
There’s also no reason you have to use your own OpenVPN install, there are many, many personal providers out there, who can offer the same functionality, and a degree of anonymity. (If you and a hundred other people are all coming from one IP, it becomes extremely difficult to differentiate, some VPN providers even claim a ‘logless’ setup.)<br>
VPNs can be slow. The reason I have a split-setup in this article, is because there are devices that I want to connect to the internet quickly, and that I’m never doing sensitive things on, like banking. I don’t mind if my Reddit-browsing and IRC messages are a bit slower, but my Nintendo Switch and PS4 should have a nippy connection.<br>
Services like Netflix can and do block VPN traffic in some cases. This is more of an issue for wider VPN providers (I suspect, but have no proof, that they just blanket block known VPN IP addresses.)<br>
If your VPN is in another country, search results and tracking can be skewed. This is arguable a good thing, who wants to be tracked? But it can also lead to frustration if your DuckDuckGo results are tailored to the middle of Paris, rather than your flat in Birmingham.</p>
</blockquote>

<ul>
<li>The tutorial walks through the basic setup: Labeling the interfaces, configuring DHCP, creating a VPN:</li>
</ul>

<blockquote>
<p>Now that we have our OpenVPN connection set up, we’ll double check that we’ve got our interfaces assigned<br>
With any luck (after we’ve assigned our OPENVPN connection correctly, you should now see your new Virtual Interface on the pfSense Dashboard<br>
We’re charging full steam towards the sections that start to lose people. Don’t be disheartened if you’ve had a few issues up to now, there is no “right” way to set up a VPN installation, and it may be that you have to tweak a few things and dive into a few man-pages before you’re set up.<br>
NAT is tricky, and frankly it only exists because we stretched out IPv4 for much longer than we should have. That being said it’s a necessary evil in this day and age, so let’s set up our connection to work with it.<br>
We need NAT here because we’re going to masque our machines on the LAN interface to show as coming from the OpenVPN client IP address, to the OpenVPN server.  Head over to Firewall -&gt; NAT -&gt; Outbound.<br>
The first thing we need to do in this section, is to change the Outbound NAT Mode to something we can work with, in this case “Hybrid.”</p>
</blockquote>

<ul>
<li>Configure the LAN interface to be NAT’d to the OpenVPN address, and the INSECURE interface to use your regular ISP connection</li>
<li>Configure the firewall to allow traffic from the LAN network to reach the INSECURE network</li>
<li>Then add a second rule allowing traffic from the LAN network to any address, and set the gateway the the OPENVPN connection</li>
<li>And there you have it, traffic from the LAN is routed via the VPN, and traffic from the INSECURE network uses the naked internet connection
***</li>
</ul>

<h3><a href="https://mndrix.blogspot.co.uk/2017/05/switching-to-openbsd.html" rel="nofollow">Switching to OpenBSD</a></h3>

<blockquote>
<p>After 12 years, I switched from macOS to OpenBSD.  It&#39;s clean, focused, stable, consistent and lets me get my work done without any hassle.<br>
When I first became interested in computers, I thought operating systems were fascinating. For years I would reinstall an operating system every other weekend just to try a different configuration: MS-DOS 3.3, Windows 3.0, Linux 1.0 (countless hours recompiling kernels).  In high school, I settled down and ran OS/2 for 5 years until I graduated college. I switched to Linux after college and used it exclusively for 5 years. I got tired of configuring Linux, so I switched to OS X for the next 12 years, where things just worked.<br>
But Snow Leopard was 7 years ago. These days, OS X is like running a denial of service attack against myself.  macOS has a dozen apps I don&#39;t use but can&#39;t remove. Updating them requires a restart.  Frequent updates to the browser require a restart.  A minor XCode update requires me to download a 4.3 GB file.  My monitors frequently turn off and require a restart to fix.  A system&#39;s <a href="http://techthoughts.typepad.com/managing_computers/2007/11/availability-mt.html" rel="nofollow">availability is a function</a> of mean time between failure and mean time to repair.  For macOS, both numbers are heading in the wrong direction for me. I don&#39;t hold any hard feelings about it, but it&#39;s time for me to get off this OS and back to productive work.<br>
I found OpenBSD very refreshing, so I created a bootable thumb drive and within an hour had it up and running on a two-year old laptop.  I&#39;ve been using it for my daily work for the past two weeks and it&#39;s been great.  Simple, boring and productive.  Just the way I like it.  The documentation is fantastic.  I&#39;ve been using Unix for years and have learned quite a bit just by reading their man pages.  OS releases come like clockwork every 6 months and are supported for 12.  Security and other updates seem relatively rare between releases (roughly one small patch per week during 6.0).  With syspatch in 6.1, installing them should be really easy too.</p>

<hr>
</blockquote>

<h3><a href="https://sdimitro.github.io/post/zpool-checkpoint" rel="nofollow">ZFS Storage Pool Checkpoint Project</a></h3>

<blockquote>
<p>During the OpenZFS summit last year (2016), Dan Kimmel and I quickly hacked together the zpool checkpoint command in ZFS, which allows reverting an entire pool to a previous state. Since it was just for a hackathon, our design was bare bones and our implementation far from complete. Around a month later, we had a new and almost complete design within Delphix and I was able to start the implementation on my own. I completed the implementation last month, and we’re now running regression tests, so I decided to write this blog post explaining what a storage pool checkpoint is, why we need it within Delphix, and how to use it.<br>
The Delphix product is basically a VM running DelphixOS (a derivative of illumos) with our application stack on top of it. During an upgrade, the VM reboots into the new OS bits and then runs some scripts that update the environment (directories, snapshots, open connections, etc.) for the new version of our app stack. Software being software, failures can happen at different points during the upgrade process. When an upgrade script that makes changes to ZFS fails, we have a corresponding rollback script that attempts to bring ZFS and our app stack back to their previous state. This is very tricky as we need to undo every single modification applied to ZFS (including dataset creation and renaming, or enabling new zpool features).<br>
The idea of Storage Pool Checkpoint (aka zpool checkpoint) deals with exactly that. It can be thought of as a “pool-wide snapshot” (or a variation of extreme rewind that doesn’t corrupt your data). It remembers the entire state of the pool at the point that it was taken and the user can revert back to it later or discard it. Its generic use case is an administrator that is about to perform a set of destructive actions to ZFS as part of a critical procedure. She takes a checkpoint of the pool before performing the actions, then rewinds back to it if one of them fails or puts the pool into an unexpected state. Otherwise, she discards it. With the assumption that no one else is making modifications to ZFS, she basically wraps all these actions into a “high-level transaction”.</p>
</blockquote>

<ul>
<li>I definitely see value in this for the appliance use case</li>
<li>Some usage examples follow, along with some caveats.</li>
<li>One of the restrictions is that you cannot attach, detach, or remove a device while a checkpoint exists. However, the zpool add operation is still possible, however if you roll back to the checkpoint, the device will no longer be part of the pool. Rather than a shortcoming, this seems like a nice feature, a way to help users avoid the most common foot shooting (which I witnessed in person at Linux Fest), adding a new log or cache device, but missing a keyword and adding it is a storage vdev rather than a aux vdev. This operation could simply be undone if a checkpoint where taken before the device was added.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20170501#trueos" rel="nofollow">Review of TrueOS</a></h3>

<blockquote>
<p>TrueOS, which was formerly named PC-BSD, is a FreeBSD-based operating system. TrueOS is a rolling release platform which is based on FreeBSD&#39;s &quot;CURRENT&quot; branch, providing TrueOS with the latest drivers and features from FreeBSD. Apart from the name change, TrueOS has deviated from the old PC-BSD project in a number of ways. The system installer is now more streamlined (and I will touch on that later) and TrueOS is a rolling release platform while PC-BSD defaulted to point releases. Another change is PC-BSD used to allow the user to customize which software was installed at boot time, including the desktop environment. The TrueOS project now selects a minimal amount of software for the user and defaults to using the Lumina desktop environment.</p>
</blockquote>

<ul>
<li>From the conclusions:</li>
</ul>

<blockquote>
<p>What I took away from my time with TrueOS is that the project is different in a lot of ways from PC-BSD. Much more than just the name has changed. The system is now more focused on cutting edge software and features in FreeBSD&#39;s development branch. The install process has been streamlined and the user begins with a set of default software rather than selecting desired packages during the initial setup. The configuration tools, particularly the Control Panel and AppCafe, have changed a lot in the past year. The designs have a more flat, minimal look. It used to be that PC-BSD did not have a default desktop exactly, but there tended to be a focus on KDE. With TrueOS the project&#39;s in-house desktop, Lumina, serves as the default environment and I think it holds up fairly well.<br>
In all, I think TrueOS offers a convenient way to experiment with new FreeBSD technologies and ZFS. I also think people who want to run FreeBSD on a desktop computer may want to look at TrueOS as it sets up a graphical environment automatically. However, people who want a stable desktop platform with lots of applications available out of the box may not find what they want with this project.</p>

<hr>
</blockquote>

<h3><a href="https://www.davd.eu/install-ubuntu-on-freebsd-with-bhyve/" rel="nofollow">A simple guide to install Ubuntu on FreeBSD with byhve</a></h3>

<ul>
<li>David Prandzioch writes in his blog:</li>
</ul>

<blockquote>
<p>For some reasons I needed a Linux installation on my NAS. bhyve is a lightweight virtualization solution for FreeBSD that makes that easy and efficient. However, the CLI of bhyve is somewhat bulky and bare making it hard to use, especially for the first time. This is what vm-bhyve solves - it provides a simple CLI for working with virtual machines.</p>
</blockquote>

<ul>
<li>More details follow about what steps are needed to setup vm_bhyve on FreeBSD </li>
<li>Also check out his other tutorials on his blog: <a href="https://www.davd.eu/freebsd/" rel="nofollow">https://www.davd.eu/freebsd/</a>
***</li>
</ul>

<h3><a href="https://dspinellis.github.io/unix-architecture/arch.pdf" rel="nofollow">Graphical Overview of the Architecture of FreeBSD </a></h3>

<ul>
<li>This diagram tries to show the different components that make up the FreeBSD Operating Systems</li>
<li>It breaks down the various utilities, libraries, and components into some categories and sub-categories:</li>
<li>User Commands:

<ul>
<li>Development (cc, ld, nm, as, etc)</li>
<li>File Management (ls, cp, cmp, mkdir)</li>
<li>Multiuser Commands (login, chown, su, who)</li>
<li>Number Processing (bc, dc, units, expr)</li>
<li>Text Processing (cut, grep, sort, uniq, wc)</li>
<li>User Messaging (mail, mesg, write, talk)</li>
<li>Little Languages (sed, awk, m4)</li>
<li>Network Clients (ftp, scp, fetch)</li>
<li>Document Preparation (*roff, eqn, tbl, refer)</li>
</ul></li>
<li>Administrator and System Commands

<ul>
<li>Filesystem Management (fsck, newfs, gpart, mount, umount)</li>
<li>Networking (ifconfig, route, arp)</li>
<li>User Management (adduser, pw, vipw, sa, quota*)</li>
<li>Statistics (iostat, vmstat, pstat, gstat, top)</li>
<li>Network Servers (sshd, ftpd, ntpd, routed, rpc.*)</li>
<li>Scheduling (cron, periodic, rc.*, atrun)</li>
</ul></li>
<li>Libraries (C Standard, Operating System, Peripheral Access, System File Access, Data Handling, Security, Internationalization, Threads)</li>
<li>System Call Interface (File I/O, Mountable Filesystems, File ACLs, File Permissions, Processes, Process Tracing, IPC, Memory Mapping, Shared Memory, Kernel Events, Memory Locking, Capsicum, Auditing, Jails)</li>
<li>Bootstrapping (Loaders, Configuration, Kernel Modules)</li>
<li>Kernel Utility Functions

<ul>
<li>Privilege Management (acl, mac, priv)</li>
<li>Multitasking (kproc, kthread, taskqueue, swi, ithread)</li>
<li>Memory Management (vmem, uma, pbuf, sbuf, mbuf, mbchain, malloc/free)</li>
<li>Generic (nvlist, osd, socket, mbuf_tags, bitset)</li>
<li>Virtualization (cpuset, crypto, device, devclass, driver)</li>
<li>Synchronization (<em>lock, sx, sema, mutex, condvar_</em>, atomic_*, signal)</li>
<li>Operations (sysctl, dtrace, watchdog, stack, alq, ktr, panic)</li>
</ul></li>
<li>I/O Subsystem

<ul>
<li>Special Devices (line discipline, tty, raw character, raw disk)</li>
<li>Filesystems (UFS, FFS, NFS, CD9660, Ext2, UDF, ZFS, devfs, procfs)</li>
<li>Sockets</li>
<li>Network Protocols (TCP, UDP, UCMP, IPSec,  IP4, IP6)</li>
<li>Netgraph (50+ modules)</li>
</ul></li>
<li>Drivers and Abstractions

<ul>
<li>Character Devices</li>
<li>CAM (ATA, SATA, SAS, SPI)</li>
<li>Network Interface Drivers (802.11, if_ae, 100+, if_xl, NDIS)</li>
</ul></li>
<li>GEOM

<ul>
<li>Storage (stripe, mirror, raid3, raid5, concat)</li>
<li>Encryption / Compression (eli, bde, shsec, uzip)</li>
<li>Filesystem (label, journal, cache, mbr, bsd)</li>
<li>Virtualization (md, nop, gate, virtstor)</li>
</ul></li>
<li>Process Control Subsystems

<ul>
<li>Scheduler</li>
<li>Memory Management</li>
<li>Inter-process Communication</li>
<li>Debugging Support
***</li>
</ul></li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170503203426&mode=expanded" rel="nofollow">Official OpenBSD 6.1 CD - There&#39;s only One!</a></h3>

<ul>
<li><a href="http://www.ebay.com/itm/The-only-Official-OpenBSD-6-1-CD-set-to-be-made-For-auction-for-the-project-/252910718452" rel="nofollow">Ebay auction Link</a></li>
<li>Now it turns out that in fact, exactly one CD set was made, and it can be yours if you are the successful bidder in the auction that ends on May 13, 2017 (About 3 days from when this episode was recorded).</li>
<li>The CD set is hand made and signed by Theo de Raadt.</li>
<li>Fun Fact: The winning bidder will have an OpenBSD CD set that even Theo doesn&#39;t have.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.openbsd.org/want.html" rel="nofollow">Hardware Wanted by OpenBSD developers</a></li>
<li><a href="https://www.freebsd.org/donations/index.html#components" rel="nofollow">Donate hardware to FreeBSD developers</a></li>
<li><a href="https://blog.netbsd.org/tnf/entry/announcing_netbsd_and_the_google" rel="nofollow">Announcing NetBSD and the Google Summer of Code Projects 2017</a></li>
<li><a href="https://wiki.freebsd.org/SummerOfCode2017Projects" rel="nofollow">Announcing FreeBSD GSoC 2017 Projects </a></li>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.4-relnotes.txt" rel="nofollow">LibreSSL 2.5.4 Released</a></li>
<li><a href="https://www.meetup.com/CharmBUG/events/238218840/" rel="nofollow">CharmBUG Meeting - Tor Browser Bundle Hack-a-thon</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2017/05/01/msg000735.html" rel="nofollow">pkgsrcCon 2017 CFT</a></li>
<li><a href="https://blather.michaelwlucas.com/archives/2931" rel="nofollow">Experimental Price Cuts</a></li>
<li><a href="https://www.youtube.com/watch?v=x6VznQz3VEY" rel="nofollow">Linux Fest North West 2017: Three Generations of FreeNAS: The World’s most popular storage OS turns 12</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2AXX75X#wrap" rel="nofollow">Don - Reproducible builds &amp; gcc/clang</a></li>
<li><a href="http://dpaste.com/0FJ854X#wrap" rel="nofollow">architect - C development on BSD</a></li>
<li><a href="http://dpaste.com/2CCK2WF#wrap" rel="nofollow">David - Linux ABI</a></li>
<li><a href="http://dpaste.com/2Z25FKJ#wrap" rel="nofollow">Tom - ZFS</a>

<ul>
<li><a href="https://www.delphix.com/blog/delphix-engineering/zfs-raidz-stripe-width-or-how-i-learned-stop-worrying-and-love-raidz" rel="nofollow">RAIDZ Stripe Width Myth, Busted</a></li>
</ul></li>
<li><a href="http://dpaste.com/1Z173WA#wrap" rel="nofollow">Ivan - Jails</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>192: SSHv1 Be Gone</title>
  <link>https://www.bsdnow.tv/192</link>
  <guid isPermaLink="false">1d2749a1-3e15-4109-9c6c-155dab78818c</guid>
  <pubDate>Wed, 03 May 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1d2749a1-3e15-4109-9c6c-155dab78818c.mp3" length="89446612" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week we have a FreeBSD Foundation development update, tell you about sprinkling in the TrueOS project, Dynamic WDS &amp; a whole lot more!</itunes:subtitle>
  <itunes:duration>2:04:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week we have a FreeBSD Foundation development update, tell you about sprinkling in the TrueOS project, Dynamic WDS &amp;amp; a whole lot more!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenSSH Removes SSHv1 Support (http://undeadly.org/cgi?action=article&amp;amp;sid=20170501005206)
In a series of commits starting here (http://marc.info/?l=openbsd-cvs&amp;amp;m=149359384905651&amp;amp;w=2) and ending with this one (http://marc.info/?l=openbsd-cvs&amp;amp;m=149359530105864&amp;amp;w=2), Damien Miller completed the removal of all support for the now-historic SSHv1 protocol from OpenSSH (https://www.openssh.com/).
The final commit message, for the commit that removes the SSHv1 related regression tests, reads:
Eliminate explicit specification of protocol in tests and loops over protocol. We only support SSHv2 now.
Dropping support for SSHv1 and associated ciphers that were either suspected to or known to be broken has been planned for several releases, and has been eagerly anticipated by many in the OpenBSD camp.
In practical terms this means that starting with OpenBSD-current and snapshots as they will be very soon (and further down the road OpenBSD 6.2 with OpenSSH 7.6), the arcane options you used with ssh (http://man.openbsd.org/ssh) to connect to some end-of-life gear in a derelict data centre you don't want to visit anymore will no longer work and you will be forced do the reasonable thing. Upgrade.
FreeBSD Foundation April 2017 Development Projects Update (https://www.freebsdfoundation.org/blog/april-2017-development-projects-update/)
FreeBSD runs on many embedded boards that provide a USB target or USB On-the-Go (OTG) interface. This allows the embedded target to act as a USB device, and present one or more interfaces (USB device classes) to a USB host. That host could be running FreeBSD, Linux, Mac OS, Windows, Android, or another operating system. USB device classes include audio input or output (e.g. headphones), mass storage (USB flash drives), human interface device (keyboards, mice), communications (Ethernet adapters), and many others.
The Foundation awarded a project grant to Edward Tomasz Napierała to develop a USB mass storage target driver, using the FreeBSD CAM Target Layer (CTL) as a backend. This project allows FreeBSD running on an embedded platform, such as a BeagleBone Black or Raspberry Pi Zero, to emulate a USB mass storage target, commonly known as a USB flash stick. The backing storage for the emulated mass storage target is on the embedded board’s own storage media. It can be configured at runtime using the standard CTL configuration mechanism – the ctladm(8) utility, or the ctl.conf(5) file.
The FreeBSD target can now present a mass storage interface, a serial interface (for a console on the embedded system), and an Ethernet interface for network access. A typical usage scenario for the mass storage interface is to provide users with documentation and drivers that can be accessed from their host system. This makes it easier for new users to interact with the embedded FreeBSD board, especially in cases where the host operating system may require drivers to access all of the functionality, as with Windows and OS X.
They provide instructions on how to configure a BeagleBone Black to act as a flash memory stick attached to a host computer.
+Check out the article, test, and report back your experiences with the new USB OTG interface. 
***
Spring cleaning: Hardware Update and Preview of upcoming TrueOS changes (https://www.trueos.org/blog/spring-cleaning-hardware-update-preview-upcoming-trueos-changes/)
The much-abused TrueOS build server is experiencing some technical difficulties, slowing down building new packages and releasing updates. After some investigation, one problem seemed to be a bug with the Poudriere port building software. After updating builders to the new version, some of the instability is resolved. Thankfully, we won’t have to rely on this server so much, because…
We’re getting new hardware!
A TrueOS/Lumina contributor is donating a new(ish) server to the project. Special thanks to TrueOS contributor/developer q5sys for the awesome new hardware!
Preview: UNSTABLE and Upcoming TrueOS STABLE update
A fresh UNSTABLE release is dropping today, with a few key changes:
Nvidia/graphics driver detection fixes.
Boot environment listing fix (FreeBSD boot-loader only)
Virtual box issues fixed on most systems. There appears to be a regression in VirtualBox 5.1 with some hardware.
New icon themes for Lumina (Preferences -&amp;gt; Appearance -&amp;gt; Theme).
Removal of legacy pc-diskmanager. It was broken and unmaintained, so it is time to remove it.
Installer/.iso Changes (Available with new STABLE Update):
The text installer has been removed. It was broken and unmaintained, so it is time to remove it.
There is now a single TrueOS install image. You can still choose to install as either a server or desktop, but both options live in a single install image now. This image is still available as either an .iso or .img file.
The size of the .iso and .img files is reduced about 500 Mb to around 2Gb total. We’ve removed Firefox and Thunderbird from the default desktop installation. These have been replaced with Qupzilla and Trojita. Note you can replace Qupzilla and Trojita with Firefox and Thunderbird via the SysAdm Appcafe after completing the TrueOS install.
Grub is no longer an installation option. Instead, the FreeBSD boot-loader is always used for the TrueOS partition. rEFInd is used as the master boot-loader for multi-booting; EFI partitioning is required.
Qpdfview is now preinstalled for pdf viewing.
Included a slideshow during the installation with tips and screenshots.
Interview - Patrick M. Hausen - hausen@punkt.de (mailto:hausen@punkt.de)
Founder of Punkt.de
HAST - Highly Available Storage (https://wiki.freebsd.org/HAST)
News Roundup
(finally) investigating how to get dynamic WDS (DWDS) working in FreeBSD! (http://adrianchadd.blogspot.com/2017/04/finally-investigating-how-to-get.html)
Adrian Chadd writes in his blog:
I sat down recently to figure out how to get dynamic WDS working on FreeBSD-HEAD. It's been in FreeBSD since forever, and it in theory should actually have just worked, but it's extremely not documented in any useful way. It's basically the same technology in earlier Apple Airports (before it grew into what the wireless tech world calls "Proxy-STA") and is what the "extender" technology on Qualcomm Atheros chipsets implement.
A common question I get from people is "why can't I bridge multiple virtual machines on my laptop and have them show up over wifi? It works on ethernet!" And my response is "when I make dynamic WDS work, you can just make this work on FreeBSD devices - but for now, use NAT." That always makes people sad.
+ Goes on to explain that normal station/access point setups have up to three addresses and depending on the packet type, these can vary. There are a couple of variations in the addresses, which is more than the number of address fields in a normal 802.11 frame.
The big note here is that there's not enough MAC addresses to say "please send this frame to a station MAC address, but then have them forward it to another MAC address attached behind it in a bridge." That would require 4 mac addresses in the 802.11 header, which we don't get.
.. except we do. There's a separate address format where from-DS and to-DS bits in the header set to 1, which means "this frame is coming from distribution system to a distribution system", and it has four mac addresses. The RA is then the AP you're sending to, and then a fourth field indicates the eventual destination address that may be an ethernet device connected behind said STA.
If you don't configure up WDS, then when you send frames from a station from a MAC address that isn't actually your 802.11 interface MAC address, the system would be confused. The STA wouldn't be able to transmit it easily, and the AP wouldn't know how to get back to your bridged ethernet addresses.
The original WDS was a statically configured thing. [...]  So for static configurations, this works great. You'd associate your extender AP as a station of the central AP, it'd use wpa_supplicant to setup encryption, then anything between that central AP and that extender AP (as a station) would be encrypted as normal station traffic (but, 4-address frame format.)
But that's not very convenient. You have to statically configure everything, including telling your central AP about all of your satellite extender APs. If you want to replace your central AP, you have to reprogram all of your extenders to use the new MAC addresses.
So, Sam Leffler came up with "dynamic WDS" - where you don't have to explicitly state the list of central/satellite APs. Instead, you configure a central AP as "dynamic WDS", and when a 4-address frame shows up from an associated station, it "promotes" it to a WDS peer for you. On the satellite AP, it will just find an AP to communicate to, and then assume it'll do WDS and start using 4-address frames. It's still a bit clunky (there's no beacon, probe request, etc IEs that say "I do dynamic WDS!" so you'd better make ALL your central APs a different SSID!) but it certainly is better than what we had.
Firstly, there are scripts in src/tools/tools/net80211/ - setup.wdsmain and setup.wdsrelay. These scripts are .. well, the almost complete documentation on a dynamic WDS setup. The manpage doesn't go into anywhere near enough information.
So I dug into it. It turns out that dynamic WDS uses a helper daemon - 'wlanwds' -  which listens for dynamic WDS configuration changes and will do things for you. This is what runs on the central AP side. Then it started making sense!
So far, so good. I followed that script, modified it a bit to use encryption, and .. well, it half worked. Association worked fine, but no traffic was passing.
A little more digging showed the actual problem - the dynamic WDS example scripts are for an open/unencrypted network. If you are using an encrypted network, the central AP side needs to enable privacy on the virtual interfaces so traffic gets encrypted with the parent interface encryption keys.
Now, I've only done enough testing to show that indeed it is working. I haven't done anything like pass lots of traffic via iperf, or have a mix of DWDS and normal STA peers, nor actually run it for longer than 5 minutes. I'm sure there will be issues to fix. However - I do need it at home, as I can't see the home AP from the upstairs room (and now you see why I care about DWDS!) and so when I start using it daily I'll fix whatever hilarity ensues.
Why don't schools teach debugging? (https://danluu.com/teach-debugging/)
A friend of mine and I couldn’t understand why some people were having so much trouble; the material seemed like common sense. The Feynman Method was the only tool we needed.
Write down the problem
Think real hard
Write down the solution
The Feynman Method failed us on the last project: the design of a divider, a real-world-scale project an order of magnitude more complex than anything we’d been asked to tackle before.
I understand now why half the class struggled with the earlier assignments. Without an explanation of how to systematically approach problems, anyone who didn’t intuitively grasp the correct solution was in for a semester of frustration. People who were, like me, above average but not great, skated through most of the class and either got lucky or wasted a huge chunk of time on the final project. I’ve even seen people talented enough to breeze through the entire degree without ever running into a problem too big to intuitively understand; those people have a very bad time when they run into a 10 million line codebase in the real world. The more talented the engineer, the more likely they are to hit a debugging wall outside of school.
It’s one of the most fundamental skills in engineering: start at the symptom of a problem and trace backwards to find the source. It takes, at most, half an hour to teach the absolute basics – and even that little bit would be enough to save a significant fraction of those who wash out and switch to non-STEM majors.
Why do we leave material out of classes and then fail students who can’t figure out that material for themselves? Why do we make the first couple years of an engineering major some kind of hazing ritual, instead of simply teaching people what they need to know to be good engineers? For all the high-level talk about how we need to plug the leaks in our STEM education pipeline, not only are we not plugging the holes, we’re proud of how fast the pipeline is leaking.
FreeBSD: pNFS server for testing (https://lists.freebsd.org/pipermail/freebsd-fs/2017-April/024702.html)
Rick Macklem has issued a call for testing his new pNFS server:
I now have a pNFS server that I think is ready for testing/evaluation. It is basically a patched FreeBSD-current kernel plus nfsd daemon.
If you are interested, some very basic notes on how it works and how to set it up are at:
http://people.freebsd.org/~rmacklem/pnfs-planb-setup.txt (http://people.freebsd.org/~rmacklem/pnfs-planb-setup.txt)
A Plan B pNFS service consists of a single MetaData Server (MDS) and K Data Servers (DS), all of which would be recent FreeBSD systems. Clients will mount the MDS as they would a single NFS server. When files are created, the MDS creates a file tree identical to what a single NFS server creates, except that all the regular (VREG) files will be empty. As such, if you look at the exported tree on the MDS directly on the MDS server (not via an NFS mount), the files will all be of size == 0. Each of these files will also have two extended attributes in the system attribute name space:
pnfsd.dsfile - This extended attrbute stores the information that the MDS needs to find the data storage file on a DS for this file.
pnfsd.dsattr - This extended attribute stores the Size, ModifyTime and Change attributes for the file.
For each regular (VREG) file, the MDS creates a data storage file on one of the K DSs, in one of the dsNN directories. The name of this file is the file handle of the file on the MDS in hexadecimal. The DSs use 20 subdirectories named "ds0" to "ds19" so that no one directory gets too large.
At this time, the MDS generates File Layout layouts to NFSv4.1 clients that know how to do pNFS.
For NFS clients that do not support NFSv4.1 pNFS, there will be a performance hit, since the IO RPCs will be proxied by the MDS for the DS server the data storage file resides on.
The current setup does not allow for redundant servers. If the MDS or any of the K DS servers fail, the entire pNFS service will be non-functional.
Looking at creating mirrored DS servers is planned, but it may be a year or more before that is implemented. I am planning on using the Flex File Layout for this, since it supports client side mirroring, where the client will write to all mirrors concurrently.
Beastie Bits
Openbsd changes of note 620 (http://www.tedunangst.com/flak/post/openbsd-changes-of-note-620)
Why Unix commands are short (http://www.catonmat.net/blog/why-unix-commands-are-short/)
OPNsense 17.1.5 released (https://opnsense.org/opnsense-17-1-5-released/)
Something for Apple dual-GPU users (http://lists.dragonflybsd.org/pipermail/commits/2017-April/625847.html)
pkgsrcCon 2017 CFT (https://mail-index.netbsd.org/netbsd-advocacy/2017/05/01/msg000735.html)
TrueOS/Lumina Dev Q&amp;amp;A: May 5th 2017 (https://discourse.trueos.org/t/trueos-lumina-dev-q-a-5-4-17/1347)
Feedback/Questions
Peter - Jails (http://dpaste.com/0J14HGJ#wrap)
Andrew - Languages and University Courses (http://dpaste.com/31AVFSF#wrap)
JuniorJobs  (https://wiki.freebsd.org/JuniorJobs)
Steve - TrueOS and Bootloader (http://dpaste.com/1BXVZSY#wrap)
Ben - ZFS questions (http://dpaste.com/0R7AW2T#wrap)
Steve - Linux Emulation (http://dpaste.com/3ZR7NCC#wrap)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week we have a FreeBSD Foundation development update, tell you about sprinkling in the TrueOS project, Dynamic WDS &amp; a whole lot more!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170501005206" rel="nofollow">OpenSSH Removes SSHv1 Support</a></h3>

<ul>
<li>In a series of commits starting <a href="http://marc.info/?l=openbsd-cvs&m=149359384905651&w=2" rel="nofollow">here</a> and ending with <a href="http://marc.info/?l=openbsd-cvs&m=149359530105864&w=2" rel="nofollow">this one</a>, Damien Miller completed the removal of all support for the now-historic SSHv1 protocol from <a href="https://www.openssh.com/" rel="nofollow">OpenSSH</a>.</li>
<li>The final commit message, for the commit that removes the SSHv1 related regression tests, reads:</li>
</ul>

<blockquote>
<p>Eliminate explicit specification of protocol in tests and loops over protocol. We only support SSHv2 now.<br>
Dropping support for SSHv1 and associated ciphers that were either suspected to or known to be broken has been planned for several releases, and has been eagerly anticipated by many in the OpenBSD camp.<br>
In practical terms this means that starting with OpenBSD-current and snapshots as they will be very soon (and further down the road OpenBSD 6.2 with OpenSSH 7.6), the arcane options you used with <a href="http://man.openbsd.org/ssh" rel="nofollow">ssh</a> to connect to some end-of-life gear in a derelict data centre you don&#39;t want to visit anymore will no longer work and you will be forced do the reasonable thing. Upgrade.</p>

<hr>
</blockquote>

<h3><a href="https://www.freebsdfoundation.org/blog/april-2017-development-projects-update/" rel="nofollow">FreeBSD Foundation April 2017 Development Projects Update</a></h3>

<blockquote>
<p>FreeBSD runs on many embedded boards that provide a USB target or USB On-the-Go (OTG) interface. This allows the embedded target to act as a USB device, and present one or more interfaces (USB device classes) to a USB host. That host could be running FreeBSD, Linux, Mac OS, Windows, Android, or another operating system. USB device classes include audio input or output (e.g. headphones), mass storage (USB flash drives), human interface device (keyboards, mice), communications (Ethernet adapters), and many others.</p>

<p>The Foundation awarded a project grant to Edward Tomasz Napierała to develop a USB mass storage target driver, using the FreeBSD CAM Target Layer (CTL) as a backend. This project allows FreeBSD running on an embedded platform, such as a BeagleBone Black or Raspberry Pi Zero, to emulate a USB mass storage target, commonly known as a USB flash stick. The backing storage for the emulated mass storage target is on the embedded board’s own storage media. It can be configured at runtime using the standard CTL configuration mechanism – the ctladm(8) utility, or the ctl.conf(5) file.</p>

<p>The FreeBSD target can now present a mass storage interface, a serial interface (for a console on the embedded system), and an Ethernet interface for network access. A typical usage scenario for the mass storage interface is to provide users with documentation and drivers that can be accessed from their host system. This makes it easier for new users to interact with the embedded FreeBSD board, especially in cases where the host operating system may require drivers to access all of the functionality, as with Windows and OS X.</p>
</blockquote>

<ul>
<li>They provide instructions on how to configure a BeagleBone Black to act as a flash memory stick attached to a host computer.
+Check out the article, test, and report back your experiences with the new USB OTG interface. 
***</li>
</ul>

<h3><a href="https://www.trueos.org/blog/spring-cleaning-hardware-update-preview-upcoming-trueos-changes/" rel="nofollow">Spring cleaning: Hardware Update and Preview of upcoming TrueOS changes</a></h3>

<blockquote>
<p>The much-abused TrueOS build server is experiencing some technical difficulties, slowing down building new packages and releasing updates. After some investigation, one problem seemed to be a bug with the Poudriere port building software. After updating builders to the new version, some of the instability is resolved. Thankfully, we won’t have to rely on this server so much, because…</p>
</blockquote>

<ul>
<li>We’re getting new hardware!</li>
<li><p>A TrueOS/Lumina contributor is donating a new(ish) server to the project. Special thanks to TrueOS contributor/developer q5sys for the awesome new hardware!</p></li>
<li><p>Preview: UNSTABLE and Upcoming TrueOS STABLE update</p></li>
<li><p>A fresh UNSTABLE release is dropping today, with a few key changes:</p></li>
</ul>

<blockquote>
<p>Nvidia/graphics driver detection fixes.<br>
Boot environment listing fix (FreeBSD boot-loader only)<br>
Virtual box issues fixed on most systems. There appears to be a regression in VirtualBox 5.1 with some hardware.<br>
New icon themes for Lumina (Preferences -&gt; Appearance -&gt; Theme).<br>
Removal of legacy pc-diskmanager. It was broken and unmaintained, so it is time to remove it.</p>
</blockquote>

<ul>
<li>Installer/.iso Changes (Available with new STABLE Update):</li>
</ul>

<blockquote>
<p>The text installer has been removed. It was broken and unmaintained, so it is time to remove it.<br>
There is now a single TrueOS install image. You can still choose to install as either a server or desktop, but both options live in a single install image now. This image is still available as either an .iso or .img file.<br>
The size of the .iso and .img files is reduced about 500 Mb to around 2Gb total. We’ve removed Firefox and Thunderbird from the default desktop installation. These have been replaced with Qupzilla and Trojita. Note you can replace Qupzilla and Trojita with Firefox and Thunderbird via the SysAdm Appcafe after completing the TrueOS install.<br>
Grub is no longer an installation option. Instead, the FreeBSD boot-loader is always used for the TrueOS partition. rEFInd is used as the master boot-loader for multi-booting; EFI partitioning is required.<br>
Qpdfview is now preinstalled for pdf viewing.<br>
Included a slideshow during the installation with tips and screenshots.</p>
</blockquote>

<hr>

<h2>Interview - Patrick M. Hausen - <a href="mailto:hausen@punkt.de" rel="nofollow">hausen@punkt.de</a></h2>

<ul>
<li>Founder of Punkt.de
<a href="https://wiki.freebsd.org/HAST" rel="nofollow">HAST - Highly Available Storage</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://adrianchadd.blogspot.com/2017/04/finally-investigating-how-to-get.html" rel="nofollow">(finally) investigating how to get dynamic WDS (DWDS) working in FreeBSD!</a></h3>

<ul>
<li>Adrian Chadd writes in his blog:</li>
</ul>

<blockquote>
<p>I sat down recently to figure out how to get dynamic WDS working on FreeBSD-HEAD. It&#39;s been in FreeBSD since forever, and it in theory should actually have just worked, but it&#39;s extremely not documented in any useful way. It&#39;s basically the same technology in earlier Apple Airports (before it grew into what the wireless tech world calls &quot;Proxy-STA&quot;) and is what the &quot;extender&quot; technology on Qualcomm Atheros chipsets implement.<br>
A common question I get from people is &quot;why can&#39;t I bridge multiple virtual machines on my laptop and have them show up over wifi? It works on ethernet!&quot; And my response is &quot;when I make dynamic WDS work, you can just make this work on FreeBSD devices - but for now, use NAT.&quot; That always makes people sad.</p>

<ul>
<li>Goes on to explain that normal station/access point setups have up to three addresses and depending on the packet type, these can vary. There are a couple of variations in the addresses, which is more than the number of address fields in a normal 802.11 frame.</li>
</ul>

<p>The big note here is that there&#39;s not enough MAC addresses to say &quot;please send this frame to a station MAC address, but then have them forward it to another MAC address attached behind it in a bridge.&quot; That would require 4 mac addresses in the 802.11 header, which we don&#39;t get.<br>
.. except we do. There&#39;s a separate address format where from-DS and to-DS bits in the header set to 1, which means &quot;this frame is coming from distribution system to a distribution system&quot;, and it has four mac addresses. The RA is then the AP you&#39;re sending to, and then a fourth field indicates the eventual destination address that may be an ethernet device connected behind said STA.<br>
If you don&#39;t configure up WDS, then when you send frames from a station from a MAC address that isn&#39;t actually your 802.11 interface MAC address, the system would be confused. The STA wouldn&#39;t be able to transmit it easily, and the AP wouldn&#39;t know how to get back to your bridged ethernet addresses.<br>
The original WDS was a statically configured thing. [...]  So for static configurations, this works great. You&#39;d associate your extender AP as a station of the central AP, it&#39;d use wpa_supplicant to setup encryption, then anything between that central AP and that extender AP (as a station) would be encrypted as normal station traffic (but, 4-address frame format.)<br>
But that&#39;s not very convenient. You have to statically configure everything, including telling your central AP about all of your satellite extender APs. If you want to replace your central AP, you have to reprogram all of your extenders to use the new MAC addresses.<br>
So, Sam Leffler came up with &quot;dynamic WDS&quot; - where you don&#39;t have to explicitly state the list of central/satellite APs. Instead, you configure a central AP as &quot;dynamic WDS&quot;, and when a 4-address frame shows up from an associated station, it &quot;promotes&quot; it to a WDS peer for you. On the satellite AP, it will just find an AP to communicate to, and then assume it&#39;ll do WDS and start using 4-address frames. It&#39;s still a bit clunky (there&#39;s no beacon, probe request, etc IEs that say &quot;I do dynamic WDS!&quot; so you&#39;d better make ALL your central APs a different SSID!) but it certainly is better than what we had.<br>
Firstly, there are scripts in src/tools/tools/net80211/ - setup.wdsmain and setup.wdsrelay. These scripts are .. well, the almost complete documentation on a dynamic WDS setup. The manpage doesn&#39;t go into anywhere near enough information.<br>
So I dug into it. It turns out that dynamic WDS uses a helper daemon - &#39;wlanwds&#39; -  which listens for dynamic WDS configuration changes and will do things for you. This is what runs on the central AP side. Then it started making sense!<br>
So far, so good. I followed that script, modified it a bit to use encryption, and .. well, it half worked. Association worked fine, but no traffic was passing.<br>
A little more digging showed the actual problem - the dynamic WDS example scripts are for an open/unencrypted network. If you are using an encrypted network, the central AP side needs to enable privacy on the virtual interfaces so traffic gets encrypted with the parent interface encryption keys.<br>
Now, I&#39;ve only done enough testing to show that indeed it is working. I haven&#39;t done anything like pass lots of traffic via iperf, or have a mix of DWDS and normal STA peers, nor actually run it for longer than 5 minutes. I&#39;m sure there will be issues to fix. However - I do need it at home, as I can&#39;t see the home AP from the upstairs room (and now you see why I care about DWDS!) and so when I start using it daily I&#39;ll fix whatever hilarity ensues.</p>

<hr>
</blockquote>

<h3><a href="https://danluu.com/teach-debugging/" rel="nofollow">Why don&#39;t schools teach debugging?</a></h3>

<blockquote>
<p>A friend of mine and I couldn’t understand why some people were having so much trouble; the material seemed like common sense. The Feynman Method was the only tool we needed.<br>
Write down the problem<br>
Think real hard<br>
Write down the solution</p>

<p>The Feynman Method failed us on the last project: the design of a divider, a real-world-scale project an order of magnitude more complex than anything we’d been asked to tackle before.</p>

<p>I understand now why half the class struggled with the earlier assignments. Without an explanation of how to systematically approach problems, anyone who didn’t intuitively grasp the correct solution was in for a semester of frustration. People who were, like me, above average but not great, skated through most of the class and either got lucky or wasted a huge chunk of time on the final project. I’ve even seen people talented enough to breeze through the entire degree without ever running into a problem too big to intuitively understand; those people have a very bad time when they run into a 10 million line codebase in the real world. The more talented the engineer, the more likely they are to hit a debugging wall outside of school.</p>

<p>It’s one of the most fundamental skills in engineering: start at the symptom of a problem and trace backwards to find the source. It takes, at most, half an hour to teach the absolute basics – and even that little bit would be enough to save a significant fraction of those who wash out and switch to non-STEM majors.</p>

<p>Why do we leave material out of classes and then fail students who can’t figure out that material for themselves? Why do we make the first couple years of an engineering major some kind of hazing ritual, instead of simply teaching people what they need to know to be good engineers? For all the high-level talk about how we need to plug the leaks in our STEM education pipeline, not only are we not plugging the holes, we’re proud of how fast the pipeline is leaking.</p>

<hr>
</blockquote>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-fs/2017-April/024702.html" rel="nofollow">FreeBSD: pNFS server for testing</a></h3>

<ul>
<li>Rick Macklem has issued a call for testing his new pNFS server:</li>
</ul>

<blockquote>
<p>I now have a pNFS server that I think is ready for testing/evaluation. It is basically a patched FreeBSD-current kernel plus nfsd daemon.<br>
If you are interested, some very basic notes on how it works and how to set it up are at:<br>
<a href="http://people.freebsd.org/%7Ermacklem/pnfs-planb-setup.txt" rel="nofollow">http://people.freebsd.org/~rmacklem/pnfs-planb-setup.txt</a></p>

<p>A Plan B pNFS service consists of a single MetaData Server (MDS) and K Data Servers (DS), all of which would be recent FreeBSD systems. Clients will mount the MDS as they would a single NFS server. When files are created, the MDS creates a file tree identical to what a single NFS server creates, except that all the regular (VREG) files will be empty. As such, if you look at the exported tree on the MDS directly on the MDS server (not via an NFS mount), the files will all be of size == 0. Each of these files will also have two extended attributes in the system attribute name space:<br>
pnfsd.dsfile - This extended attrbute stores the information that the MDS needs to find the data storage file on a DS for this file.<br>
pnfsd.dsattr - This extended attribute stores the Size, ModifyTime and Change attributes for the file.</p>

<p>For each regular (VREG) file, the MDS creates a data storage file on one of the K DSs, in one of the dsNN directories. The name of this file is the file handle of the file on the MDS in hexadecimal. The DSs use 20 subdirectories named &quot;ds0&quot; to &quot;ds19&quot; so that no one directory gets too large.<br>
At this time, the MDS generates File Layout layouts to NFSv4.1 clients that know how to do pNFS.<br>
For NFS clients that do not support NFSv4.1 pNFS, there will be a performance hit, since the IO RPCs will be proxied by the MDS for the DS server the data storage file resides on.<br>
The current setup does not allow for redundant servers. If the MDS or any of the K DS servers fail, the entire pNFS service will be non-functional.<br>
Looking at creating mirrored DS servers is planned, but it may be a year or more before that is implemented. I am planning on using the Flex File Layout for this, since it supports client side mirroring, where the client will write to all mirrors concurrently.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.tedunangst.com/flak/post/openbsd-changes-of-note-620" rel="nofollow">Openbsd changes of note 620</a></li>
<li><a href="http://www.catonmat.net/blog/why-unix-commands-are-short/" rel="nofollow">Why Unix commands are short</a></li>
<li><a href="https://opnsense.org/opnsense-17-1-5-released/" rel="nofollow">OPNsense 17.1.5 released</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2017-April/625847.html" rel="nofollow">Something for Apple dual-GPU users</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2017/05/01/msg000735.html" rel="nofollow">pkgsrcCon 2017 CFT</a></li>
<li><a href="https://discourse.trueos.org/t/trueos-lumina-dev-q-a-5-4-17/1347" rel="nofollow">TrueOS/Lumina Dev Q&amp;A: May 5th 2017</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="http://dpaste.com/0J14HGJ#wrap" rel="nofollow">Peter - Jails</a></p></li>
<li><p><a href="http://dpaste.com/31AVFSF#wrap" rel="nofollow">Andrew - Languages and University Courses</a></p>

<ul>
<li><a href="https://wiki.freebsd.org/JuniorJobs" rel="nofollow">JuniorJobs </a></li>
</ul></li>
<li><p><a href="http://dpaste.com/1BXVZSY#wrap" rel="nofollow">Steve - TrueOS and Bootloader</a></p></li>
<li><p><a href="http://dpaste.com/0R7AW2T#wrap" rel="nofollow">Ben - ZFS questions</a></p></li>
<li><p><a href="http://dpaste.com/3ZR7NCC#wrap" rel="nofollow">Steve - Linux Emulation</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week we have a FreeBSD Foundation development update, tell you about sprinkling in the TrueOS project, Dynamic WDS &amp; a whole lot more!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170501005206" rel="nofollow">OpenSSH Removes SSHv1 Support</a></h3>

<ul>
<li>In a series of commits starting <a href="http://marc.info/?l=openbsd-cvs&m=149359384905651&w=2" rel="nofollow">here</a> and ending with <a href="http://marc.info/?l=openbsd-cvs&m=149359530105864&w=2" rel="nofollow">this one</a>, Damien Miller completed the removal of all support for the now-historic SSHv1 protocol from <a href="https://www.openssh.com/" rel="nofollow">OpenSSH</a>.</li>
<li>The final commit message, for the commit that removes the SSHv1 related regression tests, reads:</li>
</ul>

<blockquote>
<p>Eliminate explicit specification of protocol in tests and loops over protocol. We only support SSHv2 now.<br>
Dropping support for SSHv1 and associated ciphers that were either suspected to or known to be broken has been planned for several releases, and has been eagerly anticipated by many in the OpenBSD camp.<br>
In practical terms this means that starting with OpenBSD-current and snapshots as they will be very soon (and further down the road OpenBSD 6.2 with OpenSSH 7.6), the arcane options you used with <a href="http://man.openbsd.org/ssh" rel="nofollow">ssh</a> to connect to some end-of-life gear in a derelict data centre you don&#39;t want to visit anymore will no longer work and you will be forced do the reasonable thing. Upgrade.</p>

<hr>
</blockquote>

<h3><a href="https://www.freebsdfoundation.org/blog/april-2017-development-projects-update/" rel="nofollow">FreeBSD Foundation April 2017 Development Projects Update</a></h3>

<blockquote>
<p>FreeBSD runs on many embedded boards that provide a USB target or USB On-the-Go (OTG) interface. This allows the embedded target to act as a USB device, and present one or more interfaces (USB device classes) to a USB host. That host could be running FreeBSD, Linux, Mac OS, Windows, Android, or another operating system. USB device classes include audio input or output (e.g. headphones), mass storage (USB flash drives), human interface device (keyboards, mice), communications (Ethernet adapters), and many others.</p>

<p>The Foundation awarded a project grant to Edward Tomasz Napierała to develop a USB mass storage target driver, using the FreeBSD CAM Target Layer (CTL) as a backend. This project allows FreeBSD running on an embedded platform, such as a BeagleBone Black or Raspberry Pi Zero, to emulate a USB mass storage target, commonly known as a USB flash stick. The backing storage for the emulated mass storage target is on the embedded board’s own storage media. It can be configured at runtime using the standard CTL configuration mechanism – the ctladm(8) utility, or the ctl.conf(5) file.</p>

<p>The FreeBSD target can now present a mass storage interface, a serial interface (for a console on the embedded system), and an Ethernet interface for network access. A typical usage scenario for the mass storage interface is to provide users with documentation and drivers that can be accessed from their host system. This makes it easier for new users to interact with the embedded FreeBSD board, especially in cases where the host operating system may require drivers to access all of the functionality, as with Windows and OS X.</p>
</blockquote>

<ul>
<li>They provide instructions on how to configure a BeagleBone Black to act as a flash memory stick attached to a host computer.
+Check out the article, test, and report back your experiences with the new USB OTG interface. 
***</li>
</ul>

<h3><a href="https://www.trueos.org/blog/spring-cleaning-hardware-update-preview-upcoming-trueos-changes/" rel="nofollow">Spring cleaning: Hardware Update and Preview of upcoming TrueOS changes</a></h3>

<blockquote>
<p>The much-abused TrueOS build server is experiencing some technical difficulties, slowing down building new packages and releasing updates. After some investigation, one problem seemed to be a bug with the Poudriere port building software. After updating builders to the new version, some of the instability is resolved. Thankfully, we won’t have to rely on this server so much, because…</p>
</blockquote>

<ul>
<li>We’re getting new hardware!</li>
<li><p>A TrueOS/Lumina contributor is donating a new(ish) server to the project. Special thanks to TrueOS contributor/developer q5sys for the awesome new hardware!</p></li>
<li><p>Preview: UNSTABLE and Upcoming TrueOS STABLE update</p></li>
<li><p>A fresh UNSTABLE release is dropping today, with a few key changes:</p></li>
</ul>

<blockquote>
<p>Nvidia/graphics driver detection fixes.<br>
Boot environment listing fix (FreeBSD boot-loader only)<br>
Virtual box issues fixed on most systems. There appears to be a regression in VirtualBox 5.1 with some hardware.<br>
New icon themes for Lumina (Preferences -&gt; Appearance -&gt; Theme).<br>
Removal of legacy pc-diskmanager. It was broken and unmaintained, so it is time to remove it.</p>
</blockquote>

<ul>
<li>Installer/.iso Changes (Available with new STABLE Update):</li>
</ul>

<blockquote>
<p>The text installer has been removed. It was broken and unmaintained, so it is time to remove it.<br>
There is now a single TrueOS install image. You can still choose to install as either a server or desktop, but both options live in a single install image now. This image is still available as either an .iso or .img file.<br>
The size of the .iso and .img files is reduced about 500 Mb to around 2Gb total. We’ve removed Firefox and Thunderbird from the default desktop installation. These have been replaced with Qupzilla and Trojita. Note you can replace Qupzilla and Trojita with Firefox and Thunderbird via the SysAdm Appcafe after completing the TrueOS install.<br>
Grub is no longer an installation option. Instead, the FreeBSD boot-loader is always used for the TrueOS partition. rEFInd is used as the master boot-loader for multi-booting; EFI partitioning is required.<br>
Qpdfview is now preinstalled for pdf viewing.<br>
Included a slideshow during the installation with tips and screenshots.</p>
</blockquote>

<hr>

<h2>Interview - Patrick M. Hausen - <a href="mailto:hausen@punkt.de" rel="nofollow">hausen@punkt.de</a></h2>

<ul>
<li>Founder of Punkt.de
<a href="https://wiki.freebsd.org/HAST" rel="nofollow">HAST - Highly Available Storage</a></li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://adrianchadd.blogspot.com/2017/04/finally-investigating-how-to-get.html" rel="nofollow">(finally) investigating how to get dynamic WDS (DWDS) working in FreeBSD!</a></h3>

<ul>
<li>Adrian Chadd writes in his blog:</li>
</ul>

<blockquote>
<p>I sat down recently to figure out how to get dynamic WDS working on FreeBSD-HEAD. It&#39;s been in FreeBSD since forever, and it in theory should actually have just worked, but it&#39;s extremely not documented in any useful way. It&#39;s basically the same technology in earlier Apple Airports (before it grew into what the wireless tech world calls &quot;Proxy-STA&quot;) and is what the &quot;extender&quot; technology on Qualcomm Atheros chipsets implement.<br>
A common question I get from people is &quot;why can&#39;t I bridge multiple virtual machines on my laptop and have them show up over wifi? It works on ethernet!&quot; And my response is &quot;when I make dynamic WDS work, you can just make this work on FreeBSD devices - but for now, use NAT.&quot; That always makes people sad.</p>

<ul>
<li>Goes on to explain that normal station/access point setups have up to three addresses and depending on the packet type, these can vary. There are a couple of variations in the addresses, which is more than the number of address fields in a normal 802.11 frame.</li>
</ul>

<p>The big note here is that there&#39;s not enough MAC addresses to say &quot;please send this frame to a station MAC address, but then have them forward it to another MAC address attached behind it in a bridge.&quot; That would require 4 mac addresses in the 802.11 header, which we don&#39;t get.<br>
.. except we do. There&#39;s a separate address format where from-DS and to-DS bits in the header set to 1, which means &quot;this frame is coming from distribution system to a distribution system&quot;, and it has four mac addresses. The RA is then the AP you&#39;re sending to, and then a fourth field indicates the eventual destination address that may be an ethernet device connected behind said STA.<br>
If you don&#39;t configure up WDS, then when you send frames from a station from a MAC address that isn&#39;t actually your 802.11 interface MAC address, the system would be confused. The STA wouldn&#39;t be able to transmit it easily, and the AP wouldn&#39;t know how to get back to your bridged ethernet addresses.<br>
The original WDS was a statically configured thing. [...]  So for static configurations, this works great. You&#39;d associate your extender AP as a station of the central AP, it&#39;d use wpa_supplicant to setup encryption, then anything between that central AP and that extender AP (as a station) would be encrypted as normal station traffic (but, 4-address frame format.)<br>
But that&#39;s not very convenient. You have to statically configure everything, including telling your central AP about all of your satellite extender APs. If you want to replace your central AP, you have to reprogram all of your extenders to use the new MAC addresses.<br>
So, Sam Leffler came up with &quot;dynamic WDS&quot; - where you don&#39;t have to explicitly state the list of central/satellite APs. Instead, you configure a central AP as &quot;dynamic WDS&quot;, and when a 4-address frame shows up from an associated station, it &quot;promotes&quot; it to a WDS peer for you. On the satellite AP, it will just find an AP to communicate to, and then assume it&#39;ll do WDS and start using 4-address frames. It&#39;s still a bit clunky (there&#39;s no beacon, probe request, etc IEs that say &quot;I do dynamic WDS!&quot; so you&#39;d better make ALL your central APs a different SSID!) but it certainly is better than what we had.<br>
Firstly, there are scripts in src/tools/tools/net80211/ - setup.wdsmain and setup.wdsrelay. These scripts are .. well, the almost complete documentation on a dynamic WDS setup. The manpage doesn&#39;t go into anywhere near enough information.<br>
So I dug into it. It turns out that dynamic WDS uses a helper daemon - &#39;wlanwds&#39; -  which listens for dynamic WDS configuration changes and will do things for you. This is what runs on the central AP side. Then it started making sense!<br>
So far, so good. I followed that script, modified it a bit to use encryption, and .. well, it half worked. Association worked fine, but no traffic was passing.<br>
A little more digging showed the actual problem - the dynamic WDS example scripts are for an open/unencrypted network. If you are using an encrypted network, the central AP side needs to enable privacy on the virtual interfaces so traffic gets encrypted with the parent interface encryption keys.<br>
Now, I&#39;ve only done enough testing to show that indeed it is working. I haven&#39;t done anything like pass lots of traffic via iperf, or have a mix of DWDS and normal STA peers, nor actually run it for longer than 5 minutes. I&#39;m sure there will be issues to fix. However - I do need it at home, as I can&#39;t see the home AP from the upstairs room (and now you see why I care about DWDS!) and so when I start using it daily I&#39;ll fix whatever hilarity ensues.</p>

<hr>
</blockquote>

<h3><a href="https://danluu.com/teach-debugging/" rel="nofollow">Why don&#39;t schools teach debugging?</a></h3>

<blockquote>
<p>A friend of mine and I couldn’t understand why some people were having so much trouble; the material seemed like common sense. The Feynman Method was the only tool we needed.<br>
Write down the problem<br>
Think real hard<br>
Write down the solution</p>

<p>The Feynman Method failed us on the last project: the design of a divider, a real-world-scale project an order of magnitude more complex than anything we’d been asked to tackle before.</p>

<p>I understand now why half the class struggled with the earlier assignments. Without an explanation of how to systematically approach problems, anyone who didn’t intuitively grasp the correct solution was in for a semester of frustration. People who were, like me, above average but not great, skated through most of the class and either got lucky or wasted a huge chunk of time on the final project. I’ve even seen people talented enough to breeze through the entire degree without ever running into a problem too big to intuitively understand; those people have a very bad time when they run into a 10 million line codebase in the real world. The more talented the engineer, the more likely they are to hit a debugging wall outside of school.</p>

<p>It’s one of the most fundamental skills in engineering: start at the symptom of a problem and trace backwards to find the source. It takes, at most, half an hour to teach the absolute basics – and even that little bit would be enough to save a significant fraction of those who wash out and switch to non-STEM majors.</p>

<p>Why do we leave material out of classes and then fail students who can’t figure out that material for themselves? Why do we make the first couple years of an engineering major some kind of hazing ritual, instead of simply teaching people what they need to know to be good engineers? For all the high-level talk about how we need to plug the leaks in our STEM education pipeline, not only are we not plugging the holes, we’re proud of how fast the pipeline is leaking.</p>

<hr>
</blockquote>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-fs/2017-April/024702.html" rel="nofollow">FreeBSD: pNFS server for testing</a></h3>

<ul>
<li>Rick Macklem has issued a call for testing his new pNFS server:</li>
</ul>

<blockquote>
<p>I now have a pNFS server that I think is ready for testing/evaluation. It is basically a patched FreeBSD-current kernel plus nfsd daemon.<br>
If you are interested, some very basic notes on how it works and how to set it up are at:<br>
<a href="http://people.freebsd.org/%7Ermacklem/pnfs-planb-setup.txt" rel="nofollow">http://people.freebsd.org/~rmacklem/pnfs-planb-setup.txt</a></p>

<p>A Plan B pNFS service consists of a single MetaData Server (MDS) and K Data Servers (DS), all of which would be recent FreeBSD systems. Clients will mount the MDS as they would a single NFS server. When files are created, the MDS creates a file tree identical to what a single NFS server creates, except that all the regular (VREG) files will be empty. As such, if you look at the exported tree on the MDS directly on the MDS server (not via an NFS mount), the files will all be of size == 0. Each of these files will also have two extended attributes in the system attribute name space:<br>
pnfsd.dsfile - This extended attrbute stores the information that the MDS needs to find the data storage file on a DS for this file.<br>
pnfsd.dsattr - This extended attribute stores the Size, ModifyTime and Change attributes for the file.</p>

<p>For each regular (VREG) file, the MDS creates a data storage file on one of the K DSs, in one of the dsNN directories. The name of this file is the file handle of the file on the MDS in hexadecimal. The DSs use 20 subdirectories named &quot;ds0&quot; to &quot;ds19&quot; so that no one directory gets too large.<br>
At this time, the MDS generates File Layout layouts to NFSv4.1 clients that know how to do pNFS.<br>
For NFS clients that do not support NFSv4.1 pNFS, there will be a performance hit, since the IO RPCs will be proxied by the MDS for the DS server the data storage file resides on.<br>
The current setup does not allow for redundant servers. If the MDS or any of the K DS servers fail, the entire pNFS service will be non-functional.<br>
Looking at creating mirrored DS servers is planned, but it may be a year or more before that is implemented. I am planning on using the Flex File Layout for this, since it supports client side mirroring, where the client will write to all mirrors concurrently.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.tedunangst.com/flak/post/openbsd-changes-of-note-620" rel="nofollow">Openbsd changes of note 620</a></li>
<li><a href="http://www.catonmat.net/blog/why-unix-commands-are-short/" rel="nofollow">Why Unix commands are short</a></li>
<li><a href="https://opnsense.org/opnsense-17-1-5-released/" rel="nofollow">OPNsense 17.1.5 released</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2017-April/625847.html" rel="nofollow">Something for Apple dual-GPU users</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-advocacy/2017/05/01/msg000735.html" rel="nofollow">pkgsrcCon 2017 CFT</a></li>
<li><a href="https://discourse.trueos.org/t/trueos-lumina-dev-q-a-5-4-17/1347" rel="nofollow">TrueOS/Lumina Dev Q&amp;A: May 5th 2017</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="http://dpaste.com/0J14HGJ#wrap" rel="nofollow">Peter - Jails</a></p></li>
<li><p><a href="http://dpaste.com/31AVFSF#wrap" rel="nofollow">Andrew - Languages and University Courses</a></p>

<ul>
<li><a href="https://wiki.freebsd.org/JuniorJobs" rel="nofollow">JuniorJobs </a></li>
</ul></li>
<li><p><a href="http://dpaste.com/1BXVZSY#wrap" rel="nofollow">Steve - TrueOS and Bootloader</a></p></li>
<li><p><a href="http://dpaste.com/0R7AW2T#wrap" rel="nofollow">Ben - ZFS questions</a></p></li>
<li><p><a href="http://dpaste.com/3ZR7NCC#wrap" rel="nofollow">Steve - Linux Emulation</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>191: I Know 64 &amp; A Bunch More</title>
  <link>https://www.bsdnow.tv/191</link>
  <guid isPermaLink="false">c2ced77d-4e0a-40af-8909-a75819362a4d</guid>
  <pubDate>Wed, 26 Apr 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c2ced77d-4e0a-40af-8909-a75819362a4d.mp3" length="91421140" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We cover TrueOS/Lumina working to be less dependent on Linux, How the IllumOS network stack works, Throttling the password gropers &amp; the 64 bit inode call for testing.</itunes:subtitle>
  <itunes:duration>2:06:58</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We cover TrueOS/Lumina working to be less dependent on Linux, How the IllumOS network stack works, Throttling the password gropers &amp;amp; the 64 bit inode call for testing.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
vBSDCon CFP closed April 29th (https://easychair.org/conferences/?conf=vbsdcon2017)
EuroBSDCon CFP closes April 30th (https://2017.eurobsdcon.org/2017/03/13/call-for-proposals/)
Developer Commentary: Philosophy, Evolution of TrueOS/Lumina, and Other Thoughts. (https://www.trueos.org/blog/developer-commentary-philosophy-evolution-trueoslumina-thoughts/)
Philosophy of Development
No project is an island. Every single project needs or uses some other external utility, library, communications format, standards compliance, and more in order to be useful.
A static project is typically a dead project. A project needs regular upkeep and maintenance to ensure it continues to build and run with the current ecosystem of libraries and utilities, even if the project has no considerable changes to the code base or feature set. “Upstream” decisions can have drastic consequences on your project.
Through no fault of yours, your project can be rendered obsolete or broken by changing standards in the global ecosystem that affect your project’s dependencies.
Operating system focus is key. What OS is the project originally designed for? This determines how the “upstream” dependencies list appears and which “heartbeat” to monitor.
Evolution of PC-BSD, Lumina, and TrueOS.  With these principles in mind – let's look at PC-BSD, Lumina, and TrueOS.
PC-BSD : PC-BSD was largely designed around KDE on FreeBSD. KDE/Plasma5 has been available for Linux OS’s for well over a year, but is still not generally available on FreeBSD. It is still tucked away in the experimental “area51” repository where people are trying to get it working first.
Lumina : As a developer with PC-BSD for a long time, and a tester from nearly the beginning of the project, I was keenly aware  the “winds of change” were blowing in the open-source ecosystem.
TrueOS : All of these ecosystem changes finally came to a head for us near the beginning of 2016. KDE4 was starting to deteriorate underneath us, and the FreeBSD “Release” branch would never allow us to compete with the rate of graphics driver or standards changes coming out of the Linux camp.
The Rename and Next Steps
With all of these changes and the lack of a clear “upgrade” path from PC-BSD to the new systems, we decided it was necessary to change the project itself (name and all). To us, this was the only way to ensure people were aware of the differences, and that TrueOS really is a different kind of project from PC-BSD. Note this was not a “hostile takeover” of the PC-BSD project by rabid FreeBSD fanatics. This was more a refocusing of the PC-BSD project into something that could ensure longevity and reliability for the foreseeable future.
&lt;blockquote&gt;
 Does TrueOS have bugs and issues? Of course! That is the nature of “rolling” with upstream changes all the time. Not only do you always get the latest version of something (a good thing), you also find yourself on the “front line” for finding and reporting bugs in those same applications (a bad thing if you like consistency or stability). What you are also seeing is just how much “churn” happens in the open-source ecosystem at any given time.
 We are devoted to providing our users (and ourselves – don’t forget we use TrueOS every day too!) a stable, reliable, and secure experience. Please be patient as we continue striving toward this goal in the best way possible, not just doing what works for the moment, but the project’s future too.
&lt;/blockquote&gt;

Robert Mustacchi: Excerpts from The Soft Ring Cycle #1 (https://www.youtube.com/watch?v=vnD10WQ2930)
The author of the “Turtles on the Wire” post we featured the other week, is back with a video.
Joyent has started a new series of lunchtime technical discussions to share information as they grow their engineering team
This video focuses on the network stack, how it works, and how it relates to virtualization and multi-tenancy
Basically, how the network stack on IllumOS works when you have virtual tenants, be they virtual machines or zones
The video describes the many layers of the network stack, how they work together, and how they can be made to work quickly
It also talks about the trade-offs between high throughput and low latency
How security is enforced, so virtual tenants cannot send packets into VLANs they are not members of, or receive traffic that they are not allowed to by the administrator
How incoming packets are classified, and eventually delivered to the intended destination
How the system decides if it has enough available resources to process the packet, or if it needs to be dropped
How interface polling works on IllumOS (a lot different than on FreeBSD)
Then the last 20 minutes are about how the qemu interface of the KVM hypervisor interfaces with the network stack
We look forward to seeing more of these videos as they come out
***
Forcing the password gropers through a smaller hole with OpenBSD's PF queues (http://bsdly.blogspot.com/2017/04/forcing-password-gropers-through.html)
While preparing material for the upcoming BSDCan PF and networking tutorial (http://www.bsdcan.org/2017/schedule/events/805.en.html), I realized that the pop3 gropers were actually not much fun to watch anymore. So I used the traffic shaping features of my OpenBSD firewall to let the miscreants inflict some pain on themselves. Watching logs became fun again.
The actual useful parts of this article follow - take this as a walkthrough of how to mitigate a wide range of threats and annoyances.
First, analyze the behavior that you want to defend against. In our case that's fairly obvious: We have a service that's getting a volume of unwanted traffic, and looking at our logs the attempts come fairly quickly with a number of repeated attempts from each source address.
I've written about the rapid-fire ssh bruteforce attacks and their mitigation before (and of course it's in The Book of PF) as well as the slower kind where those techniques actually come up short. The traditional approach to ssh bruteforcers has been to simply block their traffic, and the state-tracking features of PF let you set up overload criteria that add the source addresses to the table that holds the addresses you want to block.
For the system that runs our pop3 service, we also have a PF ruleset in place with queues for traffic shaping. For some odd reason that ruleset is fairly close to the HFSC traffic shaper example in The Book of PF, and it contains a queue that I set up mainly as an experiment to annoy spammers (as in, the ones that are already for one reason or the other blacklisted by our spamd).
The queue is defined like this:
&lt;blockquote&gt; 
 queue spamd parent rootq bandwidth 1K min 0K max 1K qlimit 300
&lt;/blockquote&gt;

yes, that's right. A queue with a maximum throughput of 1 kilobit per second. I have been warned that this is small enough that the code may be unable to strictly enforce that limit due to the timer resolution in the HFSC code. But that didn't keep me from trying.
Now a few small additions to the ruleset are needed for the good to put the evil to the task. We start with a table to hold the addresses we want to mess with. Actually, I'll add two, for reasons that will become clear later:
&lt;blockquote&gt;
   table  persist counters 
   table  persist counters 
&lt;/blockquote&gt;

The rules that use those tables are:
&lt;blockquote&gt;
   block drop log (all) quick from  

   pass in quick log (all) on egress proto tcp from  to port pop3 flags S/SA keep state \ 
   (max-src-conn 2, max-src-conn-rate 3/3, overload  flush global, pflow) set queue spamd 

   pass in log (all) on egress proto tcp to port pop3 flags S/SA keep state \ 
   (max-src-conn 5, max-src-conn-rate 6/3, overload  flush global, pflow) 
&lt;/blockquote&gt;

The last one lets anybody connect to the pop3 service, but any one source address can have only open five simultaneous connections and at a rate of six over three seconds.
The results were immediately visible. Monitoring the queues using pfctl -vvsq shows the tiny queue works as expected:
&lt;blockquote&gt;
   queue spamd parent rootq bandwidth 1K, max 1K qlimit 300
    [ pkts:     196136  bytes:   12157940  dropped pkts: 398350 bytes: 24692564 ]
    [ qlength: 300/300 ]
    [ measured:     2.0 packets/s, 999.13 b/s ]
&lt;/blockquote&gt;

and looking at the pop3 daemon's log entries, a typical encounter looks like this:
&lt;blockquote&gt;
   Apr 19 22:39:33 skapet spop3d[44875]: connect from 111.181.52.216
   Apr 19 22:39:33 skapet spop3d[75112]: connect from 111.181.52.216
   Apr 19 22:39:34 skapet spop3d[57116]: connect from 111.181.52.216
   Apr 19 22:39:34 skapet spop3d[65982]: connect from 111.181.52.216
   Apr 19 22:39:34 skapet spop3d[58964]: connect from 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[12410]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[63573]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[76113]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[23524]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[16916]: autologout time elapsed - 111.181.52.216
&lt;/blockquote&gt;

here the miscreant comes in way too fast and only manages to get five connections going before they're shunted to the tiny queue to fight it out with known spammers for a share of bandwidth.
One important takeaway from this, and possibly the most important point of this article, is that it does not take a lot of imagination to retool this setup to watch for and protect against undesirable activity directed at essentially any network service.
You pick the service and the ports it uses, then figure out what are the parameters that determine what is acceptable behavior. Once you have those parameters defined, you can choose to assign to a minimal queue like in this example, block outright, redirect to something unpleasant or even pass with a low probability.
64-bit inodes (ino64) Status Update and Call for Testing (https://lists.freebsd.org/pipermail/freebsd-fs/2017-April/024684.html)
Inodes are data structures corresponding to objects in a file system, such as files and directories. FreeBSD has historically used 32-bit values to identify inodes, which limits file systems to somewhat under 2^32 objects. Many modern file systems internally use 64-bit identifiers and FreeBSD needs to follow suit to properly and fully support these file systems.
The 64-bit inode project, also known as ino64, started life many years ago as a project by Gleb Kurtsou (gleb@).  After that time several people have had a hand in updating it and addressing regressions, after mckusick@ picked up and updated the patch, and acted as a flag-waver.
Overview : The ino64 branch extends the basic system types inot and devt from 32-bit to 64-bit, and nlink_t from 16-bit to 64-bit.
Motivation : The main risk of the ino64 change is the uncontrolled ABI breakage.
Quirks : We handled kinfo sysctl MIBs, but other MIBs which report structures depended on the changed type, are not handled in general.  It was considered that the breakage is either in the management interfaces, where we usually allow ABI slip, or is not important.
Testing procedure : The ino64 project can be tested by cloning the project branch from GitHub or by applying the patch  to a working tree.
New kernel, old world.
New kernel, new world, old third-party applications.
32bit compat.
Targeted tests.
NFS server and client test
Other filesystems
Test accounting
Ports Status with ino64 : A ports exp-run for ino64 is open in PR 218320.
5.1. LLVM : LLVM includes a component called Address Sanitizer or ASAN, which triesto intercept syscalls, and contains knowledge of the layout of many system structures.  Since stat and lstat syscalls were removed and several types and structures changed, this has to be reflected in the ASAN hacks.
5.2. lang/ghc : The ghc compiler and parts of the runtime are written in Haskell, which means that to compile ghc, you need a working Haskell compiler for bootstrap.
5.3. lang/rust Rustc has a similar structure to GHC, and same issue.  The same solution of patching the bootstrap was done.
Next Steps : The tentative schedule for the ino64 project:
2017-04-20 Post wide call for testing : Investigate and address port failures with maintainer support
2017-05-05 Request second exp-run with initial patches applied : Investigate and address port failures with maintainer support
2017-05-19 Commit to HEAD : Address post-commit failures where feasible
***
News Roundup
Sing, beastie, sing! (http://meka.rs/blog/2017/01/25/sing-beastie-sing/)
FreeBSD digital audio workstation, or DAW for short, is now possible. At this very moment it's not user friendly that much, but you'll manage. What I want to say is that I worked on porting some of the audio apps to FreeBSD, met some other people interested in porting audio stuff and became heavily involved with DrumGizmo - drum sampling engine. Let me start with the basic setup.
FreeBSD doesn't have hard real-time support, but it's pretty close. For the needs of audio, FreeBSD's implementation of real-time is sufficient and, in my opinion, superior to the one you can get on Linux with RT path (which is ugly, not supported by distributions and breaks apps like VirtualBox). As default install of FreeBSD is concerned with real-time too much, we have to tweak sysctl a bit, so append this to your /etc/sysctl.conf:
&lt;blockquote&gt;
   kern.timecounter.alloweddeviation=0
   hw.usb.uaudio.buffer_ms=2 # only on -STABLE for now
   hw.snd.latency=0
   kern.coredump=0
&lt;/blockquote&gt;

So let me go through the list. First item tells FreeBSD how many events it can aggregate (or wait for) before emitting them. The reason this is the default is because aggregating events saves power a bit, and currently more laptops are running FreeBSD than DAWs. Second one is the lowest possible buffer for USB audio driver. If you're not using USB audio, this won't change a thing. Third one has nothing to do with real-time, but dealing with programs that consume ~3GB of RAM, dumping cores around made a problem on my machine. Besides, core dumps are only useful if you know how to debug the problem, or someone is willing to do that for you. I like to not generate those files by default, but if some app is constantly crashing, I enable dumps, run the app, crash it, and disable dumps again. I lost 30GB in under a minute by examining 10 different drumkits of DrumGizmo and all of them gave me 3GB of core file, each.
More setup instructions follow, including jackd setup and PulseAudio using virtual_oss.
With this setup I can play OSS, JACK and PulseAudio sound all at the same time, which I was not able to do on Linux.
FreeBSD 11 Unbound DNS server (https://itso.dk/?p=499)
In FreeBSD, there is a built-in DNS server called Unbound.
So why would run a local DNS server? I am in a region where internet traffic is still a bit expensive, that also implies slow, and high response times. To speed that a up a little, you can use own DNS server. It will speed up because for every homepage you visit, there will be several hooks to other domains: commercials, site components, and links to other sites. These, will now all be cached locally on your new DNS server. In my case I use an old PC-Engine Alix board for my home DNS server, but you can use almost everything, Raspberry Pi, old laptop/desktop and others. As long as it runs FreeBSD.
Goes into more details about what commands to run and which services to start
Try it out if you are in a similar situation
***
Why it is important that documentation and tutorials be correct and carefully reviewed (https://arxiv.org/pdf/1704.02786.pdf)
A group of researchers found that a lot of online web programming tutorials contain serious security flaws. They decided to do a research project to see how this impacts software that is written possibly based on those tutorials.
They used a number of simple google search terms to make a list of tutorials, and manually audited them for common vulnerabilities. They then crawled GitHub to find projects with very similar code snippets that might have been taken from those tutorials.
The Web is replete with tutorial-style content on how to accomplish programming tasks. Unfortunately, even top-ranked tutorials suffer from severe security vulnerabilities, such as cross-site scripting (XSS), and SQL injection (SQLi). Assuming that these tutorials influence real-world software development, we hypothesize that code snippets from popular tutorials can be used to bootstrap vulnerability discovery at scale. To validate our hypothesis, we propose a semi-automated approach to find recurring vulnerabilities starting from a handful of top-ranked tutorials that contain vulnerable code snippets. We evaluate our approach by performing an analysis of tens of thousands of open-source web applications to check if vulnerabilities originating in the selected tutorials recur.
Our analysis framework has been running on a standard PC, analyzed 64,415 PHP codebases hosted on GitHub thus far, and found a total of 117 vulnerabilities that have a strong syntactic similarity to vulnerable code snippets present in popular tutorials. In addition to shedding light on the anecdotal belief that programmers reuse web tutorial code in an ad hoc manner, our study finds disconcerting evidence of insufficiently reviewed tutorials compromising the security of open-source projects.  Moreover, our findings testify to the feasibility of large-scale vulnerability discovery using poorly written tutorials as a starting point
The researchers found 117 vulnerabilities, of these, at least 8 appear to be nearly exact copy/pastes of the tutorials that were found to be vulnerable.
***
1.3.0 Development Preview: New icon themes (https://lumina-desktop.org/1-3-0-development-preview-new-icon-themes/)
As version 1.3.0 of the Lumina desktop starts getting closer to release, I want to take a couple weeks and give you all some sneak peaks at some of the changes/updates that we have been working on (and are in the process of finishing up). 
New icon theme (https://lumina-desktop.org/1-3-0-development-preview-new-icon-themes/)
Material Design Light/Dark 
There are a lot more icons available in the reference icon packs which we still have not gotten around to renaming yet, but this initial version satisfies all the XDG standards for an icon theme + all the extra icons needed for Lumina and it’s utilities + a large number of additional icons for application use.
This highlights one the big things that I love about Lumina: it gives you an interface that is custom-tailored to YOUR needs/wants – rather than expecting YOU to change your routines to accomodate how some random developer/designer across the world thinks everybody should use a computer.
Lumina Media Player (https://lumina-desktop.org/1-3-0-development-preview-lumina-mediaplayer/)
This is a small utility designed to provide the ability for the user to play audio and video files on the local system, as well as stream audio from online sources. For now, only the Pandora internet radio service is supported via the “pianobar” CLI utility, which is an optional runtime dependency. However, we hope to gradually add new streaming sources over time. 
For a long time I had been using another Pandora streaming client on my TrueOS desktop, but it was very fragile with respect to underlying changes: LibreSSL versions for example. The player would regularly stop functioning for a few update cycles until a version of LibreSSL which was “compatible” with the player was used. After enduring this for some time, I was finally frustrated enough to start looking for alternatives. 
A co-worker pointed me to a command-line utility called “pianobar“, which was also a small client for Pandora radio. After using pianobar for a couple weeks, I was impressed with how stable it was and how little “overhead” it required with regards to extra runtime dependencies. Of course, I started thinking “I could write a Qt5 GUI for that!”. Once I had a few free hours, I started writing what became lumina-mediaplayer. I started with the interface to pianobar itself to see how complicated it would be to interact with, but after a couple days of tinkering in my spare time, I realized I had a full client to Pandora radio basically finished.
Beastie Bits
vBSDCon CFP closes April 29th (https://easychair.org/conferences/?conf=vbsdcon2017)
EuroBSDCon CFP closes April 30th (https://2017.eurobsdcon.org/2017/03/13/call-for-proposals/)
clang(1) added to base on amd64 and i386 (http://undeadly.org/cgi?action=article&amp;amp;sid=20170421001933)
Theo: “Most things come to an end, sorry.” (https://marc.info/?l=openbsd-misc&amp;amp;m=149232307018311&amp;amp;w=2)
ASLR, PIE, NX, and other capital letters (https://www.dragonflydigest.com/2017/04/24/19609.html)
How SSH got port number 22 (https://www.ssh.com/ssh/port)
Netflix Serving 90Gb/s+ From Single Machines Using Tuned FreeBSD (https://news.ycombinator.com/item?id=14128637)
Compressed zfs send / receive lands in FreeBSD HEAD (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=317414)
***
Feedback/Questions
Steve - FreeBSD Jobs (http://dpaste.com/3QSMYEH#wrap)
Mike - CuBox i4Pro (http://dpaste.com/0NNYH22#wrap)
Steve - Year of the BSD Desktop? (http://dpaste.com/1QRZBPD#wrap)
Brad - Configuration Management (http://dpaste.com/2TFV8AJ#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We cover TrueOS/Lumina working to be less dependent on Linux, How the IllumOS network stack works, Throttling the password gropers &amp; the 64 bit inode call for testing.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://easychair.org/conferences/?conf=vbsdcon2017" rel="nofollow">vBSDCon CFP closed April 29th</a></h3>

<h3><a href="https://2017.eurobsdcon.org/2017/03/13/call-for-proposals/" rel="nofollow">EuroBSDCon CFP closes April 30th</a></h3>

<h3><a href="https://www.trueos.org/blog/developer-commentary-philosophy-evolution-trueoslumina-thoughts/" rel="nofollow">Developer Commentary: Philosophy, Evolution of TrueOS/Lumina, and Other Thoughts.</a></h3>

<ul>
<li>Philosophy of Development

<ul>
<li>No project is an island. Every single project needs or uses some other external utility, library, communications format, standards compliance, and more in order to be useful.</li>
<li>A static project is typically a dead project. A project needs regular upkeep and maintenance to ensure it continues to build and run with the current ecosystem of libraries and utilities, even if the project has no considerable changes to the code base or feature set. Upstream decisions can have drastic consequences on your project.</li>
<li>Through no fault of yours, your project can be rendered obsolete or broken by changing standards in the global ecosystem that affect your projects dependencies.</li>
</ul></li>
<li><p>Operating system focus is key. What OS is the project originally designed for? This determines how the upstream dependencies list appears and which heartbeat to monitor.</p></li>
<li><p>Evolution of PC-BSD, Lumina, and TrueOS.  With these principles in mind  let&#39;s look at PC-BSD, Lumina, and TrueOS.</p>

<ul>
<li>PC-BSD : PC-BSD was largely designed around KDE on FreeBSD. KDE/Plasma5 has been available for Linux OSs for well over a year, but is still not generally available on FreeBSD. It is still tucked away in the experimental area51 repository where people are trying to get it working first.</li>
<li>Lumina : As a developer with PC-BSD for a long time, and a tester from nearly the beginning of the project, I was keenly aware  the winds of change were blowing in the open-source ecosystem.</li>
<li>TrueOS : All of these ecosystem changes finally came to a head for us near the beginning of 2016. KDE4 was starting to deteriorate underneath us, and the FreeBSD Release branch would never allow us to compete with the rate of graphics driver or standards changes coming out of the Linux camp.</li>
</ul></li>
<li><p>The Rename and Next Steps</p></li>
</ul>

<blockquote>
<p>With all of these changes and the lack of a clear upgrade path from PC-BSD to the new systems, we decided it was necessary to change the project itself (name and all). To us, this was the only way to ensure people were aware of the differences, and that TrueOS really is a different kind of project from PC-BSD. Note this was not a hostile takeover of the PC-BSD project by rabid FreeBSD fanatics. This was more a refocusing of the PC-BSD project into something that could ensure longevity and reliability for the foreseeable future.</p>
</blockquote>

<blockquote>
 Does TrueOS have bugs and issues? Of course! That is the nature of rolling with upstream changes all the time. Not only do you always get the latest version of something (a good thing), you also find yourself on the front line for finding and reporting bugs in those same applications (a bad thing if you like consistency or stability). What you are also seeing is just how much churn happens in the open-source ecosystem at any given time.
 We are devoted to providing our users (and ourselves  dont forget we use TrueOS every day too!) a stable, reliable, and secure experience. Please be patient as we continue striving toward this goal in the best way possible, not just doing what works for the moment, but the projects future too.
</blockquote>

<hr>

<h3><a href="https://www.youtube.com/watch?v=vnD10WQ2930" rel="nofollow">Robert Mustacchi: Excerpts from The Soft Ring Cycle #1</a></h3>

<ul>
<li>The author of the Turtles on the Wire post we featured the other week, is back with a video.</li>
<li>Joyent has started a new series of lunchtime technical discussions to share information as they grow their engineering team</li>
<li>This video focuses on the network stack, how it works, and how it relates to virtualization and multi-tenancy</li>
<li>Basically, how the network stack on IllumOS works when you have virtual tenants, be they virtual machines or zones</li>
<li>The video describes the many layers of the network stack, how they work together, and how they can be made to work quickly</li>
<li>It also talks about the trade-offs between high throughput and low latency</li>
<li>How security is enforced, so virtual tenants cannot send packets into VLANs they are not members of, or receive traffic that they are not allowed to by the administrator</li>
<li>How incoming packets are classified, and eventually delivered to the intended destination</li>
<li>How the system decides if it has enough available resources to process the packet, or if it needs to be dropped</li>
<li>How interface polling works on IllumOS (a lot different than on FreeBSD)</li>
<li>Then the last 20 minutes are about how the qemu interface of the KVM hypervisor interfaces with the network stack</li>
<li>We look forward to seeing more of these videos as they come out
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2017/04/forcing-password-gropers-through.html" rel="nofollow">Forcing the password gropers through a smaller hole with OpenBSD&#39;s PF queues</a></h3>

<blockquote>
<p>While preparing material for the upcoming <a href="http://www.bsdcan.org/2017/schedule/events/805.en.html" rel="nofollow">BSDCan PF and networking tutorial</a>, I realized that the pop3 gropers were actually not much fun to watch anymore. So I used the traffic shaping features of my OpenBSD firewall to let the miscreants inflict some pain on themselves. Watching logs became fun again.<br>
The actual useful parts of this article follow - take this as a walkthrough of how to mitigate a wide range of threats and annoyances.<br>
First, analyze the behavior that you want to defend against. In our case that&#39;s fairly obvious: We have a service that&#39;s getting a volume of unwanted traffic, and looking at our logs the attempts come fairly quickly with a number of repeated attempts from each source address.<br>
I&#39;ve written about the rapid-fire ssh bruteforce attacks and their mitigation before (and of course it&#39;s in The Book of PF) as well as the slower kind where those techniques actually come up short. The traditional approach to ssh bruteforcers has been to simply block their traffic, and the state-tracking features of PF let you set up overload criteria that add the source addresses to the table that holds the addresses you want to block.<br>
For the system that runs our pop3 service, we also have a PF ruleset in place with queues for traffic shaping. For some odd reason that ruleset is fairly close to the HFSC traffic shaper example in The Book of PF, and it contains a queue that I set up mainly as an experiment to annoy spammers (as in, the ones that are already for one reason or the other blacklisted by our spamd).<br>
The queue is defined like this:</p>
</blockquote>

<blockquote> 
 queue spamd parent rootq bandwidth 1K min 0K max 1K qlimit 300
</blockquote>

<blockquote>
<p>yes, that&#39;s right. A queue with a maximum throughput of 1 kilobit per second. I have been warned that this is small enough that the code may be unable to strictly enforce that limit due to the timer resolution in the HFSC code. But that didn&#39;t keep me from trying.<br>
Now a few small additions to the ruleset are needed for the good to put the evil to the task. We start with a table to hold the addresses we want to mess with. Actually, I&#39;ll add two, for reasons that will become clear later:</p>
</blockquote>

<blockquote>
   table <longterm> persist counters 
   table <popflooders> persist counters 
</blockquote>

<blockquote>
<p>The rules that use those tables are:</p>
</blockquote>

<blockquote>
   block drop log (all) quick from <longterm> 

   pass in quick log (all) on egress proto tcp from <popflooders> to port pop3 flags S/SA keep state \ 
   (max-src-conn 2, max-src-conn-rate 3/3, overload <longterm> flush global, pflow) set queue spamd 

   pass in log (all) on egress proto tcp to port pop3 flags S/SA keep state \ 
   (max-src-conn 5, max-src-conn-rate 6/3, overload <popflooders> flush global, pflow) 
</blockquote>

<blockquote>
<p>The last one lets anybody connect to the pop3 service, but any one source address can have only open five simultaneous connections and at a rate of six over three seconds.</p>

<p>The results were immediately visible. Monitoring the queues using pfctl -vvsq shows the tiny queue works as expected:</p>
</blockquote>

<blockquote>
   queue spamd parent rootq bandwidth 1K, max 1K qlimit 300
    [ pkts:     196136  bytes:   12157940  dropped pkts: 398350 bytes: 24692564 ]
    [ qlength: 300/300 ]
    [ measured:     2.0 packets/s, 999.13 b/s ]
</blockquote>

<blockquote>
<p>and looking at the pop3 daemon&#39;s log entries, a typical encounter looks like this:</p>
</blockquote>

<blockquote>
   Apr 19 22:39:33 skapet spop3d[44875]: connect from 111.181.52.216
   Apr 19 22:39:33 skapet spop3d[75112]: connect from 111.181.52.216
   Apr 19 22:39:34 skapet spop3d[57116]: connect from 111.181.52.216
   Apr 19 22:39:34 skapet spop3d[65982]: connect from 111.181.52.216
   Apr 19 22:39:34 skapet spop3d[58964]: connect from 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[12410]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[63573]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[76113]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[23524]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[16916]: autologout time elapsed - 111.181.52.216
</blockquote>

<blockquote>
<p>here the miscreant comes in way too fast and only manages to get five connections going before they&#39;re shunted to the tiny queue to fight it out with known spammers for a share of bandwidth.<br>
One important takeaway from this, and possibly the most important point of this article, is that it does not take a lot of imagination to retool this setup to watch for and protect against undesirable activity directed at essentially any network service.<br>
You pick the service and the ports it uses, then figure out what are the parameters that determine what is acceptable behavior. Once you have those parameters defined, you can choose to assign to a minimal queue like in this example, block outright, redirect to something unpleasant or even pass with a low probability.</p>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-fs/2017-April/024684.html" rel="nofollow">64-bit inodes (ino64) Status Update and Call for Testing</a></h3>

<blockquote>
<p>Inodes are data structures corresponding to objects in a file system, such as files and directories. FreeBSD has historically used 32-bit values to identify inodes, which limits file systems to somewhat under 2<sup>32</sup> objects. Many modern file systems internally use 64-bit identifiers and FreeBSD needs to follow suit to properly and fully support these file systems.</p>

<p>The 64-bit inode project, also known as ino64, started life many years ago as a project by Gleb Kurtsou (gleb@).  After that time several people have had a hand in updating it and addressing regressions, after mckusick@ picked up and updated the patch, and acted as a flag-waver.</p>
</blockquote>

<ol>
<li>Overview : The ino64 branch extends the basic system types ino_t and dev_t from 32-bit to 64-bit, and nlink_t from 16-bit to 64-bit.</li>
<li>Motivation : The main risk of the ino64 change is the uncontrolled ABI breakage.</li>
<li>Quirks : We handled kinfo sysctl MIBs, but other MIBs which report structures depended on the changed type, are not handled in general.  It was considered that the breakage is either in the management interfaces, where we usually allow ABI slip, or is not important.</li>
<li>Testing procedure : The ino64 project can be tested by cloning the project branch from GitHub or by applying the patch <from the Phabricator review | locatedat URL | attached> to a working tree.

<ul>
<li>New kernel, old world.</li>
<li>New kernel, new world, old third-party applications.</li>
<li>32bit compat.</li>
<li>Targeted tests.</li>
<li>NFS server and client test</li>
<li>Other filesystems</li>
<li>Test accounting</li>
</ul></li>
<li>Ports Status with ino64 : A ports exp-run for ino64 is open in PR 218320.
5.1. LLVM : LLVM includes a component called Address Sanitizer or ASAN, which triesto intercept syscalls, and contains knowledge of the layout of many system structures.  Since stat and lstat syscalls were removed and several types and structures changed, this has to be reflected in the ASAN hacks.
5.2. lang/ghc : The ghc compiler and parts of the runtime are written in Haskell, which means that to compile ghc, you need a working Haskell compiler for bootstrap.
5.3. lang/rust Rustc has a similar structure to GHC, and same issue.  The same solution of patching the bootstrap was done.</li>
<li>Next Steps : The tentative schedule for the ino64 project:

<ul>
<li>2017-04-20 Post wide call for testing : Investigate and address port failures with maintainer support</li>
<li>2017-05-05 Request second exp-run with initial patches applied : Investigate and address port failures with maintainer support</li>
<li>2017-05-19 Commit to HEAD : Address post-commit failures where feasible
***</li>
</ul></li>
</ol>

<h2>News Roundup</h2>

<h3><a href="http://meka.rs/blog/2017/01/25/sing-beastie-sing/" rel="nofollow">Sing, beastie, sing!</a></h3>

<blockquote>
<p>FreeBSD digital audio workstation, or DAW for short, is now possible. At this very moment it&#39;s not user friendly that much, but you&#39;ll manage. What I want to say is that I worked on porting some of the audio apps to FreeBSD, met some other people interested in porting audio stuff and became heavily involved with DrumGizmo - drum sampling engine. Let me start with the basic setup.<br>
FreeBSD doesn&#39;t have hard real-time support, but it&#39;s pretty close. For the needs of audio, FreeBSD&#39;s implementation of real-time is sufficient and, in my opinion, superior to the one you can get on Linux with RT path (which is ugly, not supported by distributions and breaks apps like VirtualBox). As default install of FreeBSD is concerned with real-time too much, we have to tweak sysctl a bit, so append this to your /etc/sysctl.conf:</p>
</blockquote>

<blockquote>
   kern.timecounter.alloweddeviation=0
   hw.usb.uaudio.buffer_ms=2 # only on -STABLE for now
   hw.snd.latency=0
   kern.coredump=0
</blockquote>

<ul>
<li>So let me go through the list. First item tells FreeBSD how many events it can aggregate (or wait for) before emitting them. The reason this is the default is because aggregating events saves power a bit, and currently more laptops are running FreeBSD than DAWs. Second one is the lowest possible buffer for USB audio driver. If you&#39;re not using USB audio, this won&#39;t change a thing. Third one has nothing to do with real-time, but dealing with programs that consume ~3GB of RAM, dumping cores around made a problem on my machine. Besides, core dumps are only useful if you know how to debug the problem, or someone is willing to do that for you. I like to not generate those files by default, but if some app is constantly crashing, I enable dumps, run the app, crash it, and disable dumps again. I lost 30GB in under a minute by examining 10 different drumkits of DrumGizmo and all of them gave me 3GB of core file, each.</li>
<li>More setup instructions follow, including jackd setup and PulseAudio using virtual_oss.</li>
</ul>

<blockquote>
<p>With this setup I can play OSS, JACK and PulseAudio sound all at the same time, which I was not able to do on Linux.</p>

<hr>
</blockquote>

<h3><a href="https://itso.dk/?p=499" rel="nofollow">FreeBSD 11 Unbound DNS server</a></h3>

<blockquote>
<p>In FreeBSD, there is a built-in DNS server called Unbound.<br>
So why would run a local DNS server? I am in a region where internet traffic is still a bit expensive, that also implies slow, and high response times. To speed that a up a little, you can use own DNS server. It will speed up because for every homepage you visit, there will be several hooks to other domains: commercials, site components, and links to other sites. These, will now all be cached locally on your new DNS server. In my case I use an old PC-Engine Alix board for my home DNS server, but you can use almost everything, Raspberry Pi, old laptop/desktop and others. As long as it runs FreeBSD.</p>
</blockquote>

<ul>
<li>Goes into more details about what commands to run and which services to start</li>
<li>Try it out if you are in a similar situation
***</li>
</ul>

<h3><a href="https://arxiv.org/pdf/1704.02786.pdf" rel="nofollow">Why it is important that documentation and tutorials be correct and carefully reviewed</a></h3>

<ul>
<li>A group of researchers found that a lot of online web programming tutorials contain serious security flaws. They decided to do a research project to see how this impacts software that is written possibly based on those tutorials.</li>
<li>They used a number of simple google search terms to make a list of tutorials, and manually audited them for common vulnerabilities. They then crawled GitHub to find projects with very similar code snippets that might have been taken from those tutorials.</li>
</ul>

<blockquote>
<p>The Web is replete with tutorial-style content on how to accomplish programming tasks. Unfortunately, even top-ranked tutorials suffer from severe security vulnerabilities, such as cross-site scripting (XSS), and SQL injection (SQLi). Assuming that these tutorials influence real-world software development, we hypothesize that code snippets from popular tutorials can be used to bootstrap vulnerability discovery at scale. To validate our hypothesis, we propose a semi-automated approach to find recurring vulnerabilities starting from a handful of top-ranked tutorials that contain vulnerable code snippets. We evaluate our approach by performing an analysis of tens of thousands of open-source web applications to check if vulnerabilities originating in the selected tutorials recur.<br>
Our analysis framework has been running on a standard PC, analyzed 64,415 PHP codebases hosted on GitHub thus far, and found a total of 117 vulnerabilities that have a strong syntactic similarity to vulnerable code snippets present in popular tutorials. In addition to shedding light on the anecdotal belief that programmers reuse web tutorial code in an ad hoc manner, our study finds disconcerting evidence of insufficiently reviewed tutorials compromising the security of open-source projects.  Moreover, our findings testify to the feasibility of large-scale vulnerability discovery using poorly written tutorials as a starting point</p>
</blockquote>

<ul>
<li>The researchers found 117 vulnerabilities, of these, at least 8 appear to be nearly exact copy/pastes of the tutorials that were found to be vulnerable.
***</li>
</ul>

<h3><a href="https://lumina-desktop.org/1-3-0-development-preview-new-icon-themes/" rel="nofollow">1.3.0 Development Preview: New icon themes</a></h3>

<blockquote>
<p>As version 1.3.0 of the Lumina desktop starts getting closer to release, I want to take a couple weeks and give you all some sneak peaks at some of the changes/updates that we have been working on (and are in the process of finishing up). </p>
</blockquote>

<ul>
<li><a href="https://lumina-desktop.org/1-3-0-development-preview-new-icon-themes/" rel="nofollow">New icon theme</a>

<ul>
<li>Material Design Light/Dark </li>
<li>There are a lot more icons available in the reference icon packs which we still have not gotten around to renaming yet, but this initial version satisfies all the XDG standards for an icon theme + all the extra icons needed for Lumina and its utilities + a large number of additional icons for application use.</li>
</ul></li>
</ul>

<blockquote>
<p>This highlights one the big things that I love about Lumina: it gives you an interface that is custom-tailored to YOUR needs/wants  rather than expecting YOU to change your routines to accomodate how some random developer/designer across the world thinks everybody should use a computer.</p>
</blockquote>

<ul>
<li><a href="https://lumina-desktop.org/1-3-0-development-preview-lumina-mediaplayer/" rel="nofollow">Lumina Media Player</a></li>
</ul>

<blockquote>
<p>This is a small utility designed to provide the ability for the user to play audio and video files on the local system, as well as stream audio from online sources. For now, only the Pandora internet radio service is supported via the pianobar CLI utility, which is an optional runtime dependency. However, we hope to gradually add new streaming sources over time. <br>
For a long time I had been using another Pandora streaming client on my TrueOS desktop, but it was very fragile with respect to underlying changes: LibreSSL versions for example. The player would regularly stop functioning for a few update cycles until a version of LibreSSL which was compatible with the player was used. After enduring this for some time, I was finally frustrated enough to start looking for alternatives. <br>
A co-worker pointed me to a command-line utility called pianobar, which was also a small client for Pandora radio. After using pianobar for a couple weeks, I was impressed with how stable it was and how little overhead it required with regards to extra runtime dependencies. Of course, I started thinking I could write a Qt5 GUI for that!. Once I had a few free hours, I started writing what became lumina-mediaplayer. I started with the interface to pianobar itself to see how complicated it would be to interact with, but after a couple days of tinkering in my spare time, I realized I had a full client to Pandora radio basically finished.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://easychair.org/conferences/?conf=vbsdcon2017" rel="nofollow">vBSDCon CFP closes April 29th</a></li>
<li><a href="https://2017.eurobsdcon.org/2017/03/13/call-for-proposals/" rel="nofollow">EuroBSDCon CFP closes April 30th</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170421001933" rel="nofollow">clang(1) added to base on amd64 and i386</a></li>
<li><a href="https://marc.info/?l=openbsd-misc&m=149232307018311&w=2" rel="nofollow">Theo: Most things come to an end, sorry.</a></li>
<li><a href="https://www.dragonflydigest.com/2017/04/24/19609.html" rel="nofollow">ASLR, PIE, NX, and other capital letters</a></li>
<li><a href="https://www.ssh.com/ssh/port" rel="nofollow">How SSH got port number 22</a></li>
<li><a href="https://news.ycombinator.com/item?id=14128637" rel="nofollow">Netflix Serving 90Gb/s+ From Single Machines Using Tuned FreeBSD</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=317414" rel="nofollow">Compressed zfs send / receive lands in FreeBSD HEAD</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/3QSMYEH#wrap" rel="nofollow">Steve - FreeBSD Jobs</a></li>
<li><a href="http://dpaste.com/0NNYH22#wrap" rel="nofollow">Mike - CuBox i4Pro</a></li>
<li><a href="http://dpaste.com/1QRZBPD#wrap" rel="nofollow">Steve - Year of the BSD Desktop?</a></li>
<li><a href="http://dpaste.com/2TFV8AJ#wrap" rel="nofollow">Brad - Configuration Management</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We cover TrueOS/Lumina working to be less dependent on Linux, How the IllumOS network stack works, Throttling the password gropers &amp; the 64 bit inode call for testing.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://easychair.org/conferences/?conf=vbsdcon2017" rel="nofollow">vBSDCon CFP closed April 29th</a></h3>

<h3><a href="https://2017.eurobsdcon.org/2017/03/13/call-for-proposals/" rel="nofollow">EuroBSDCon CFP closes April 30th</a></h3>

<h3><a href="https://www.trueos.org/blog/developer-commentary-philosophy-evolution-trueoslumina-thoughts/" rel="nofollow">Developer Commentary: Philosophy, Evolution of TrueOS/Lumina, and Other Thoughts.</a></h3>

<ul>
<li>Philosophy of Development

<ul>
<li>No project is an island. Every single project needs or uses some other external utility, library, communications format, standards compliance, and more in order to be useful.</li>
<li>A static project is typically a dead project. A project needs regular upkeep and maintenance to ensure it continues to build and run with the current ecosystem of libraries and utilities, even if the project has no considerable changes to the code base or feature set. Upstream decisions can have drastic consequences on your project.</li>
<li>Through no fault of yours, your project can be rendered obsolete or broken by changing standards in the global ecosystem that affect your projects dependencies.</li>
</ul></li>
<li><p>Operating system focus is key. What OS is the project originally designed for? This determines how the upstream dependencies list appears and which heartbeat to monitor.</p></li>
<li><p>Evolution of PC-BSD, Lumina, and TrueOS.  With these principles in mind  let&#39;s look at PC-BSD, Lumina, and TrueOS.</p>

<ul>
<li>PC-BSD : PC-BSD was largely designed around KDE on FreeBSD. KDE/Plasma5 has been available for Linux OSs for well over a year, but is still not generally available on FreeBSD. It is still tucked away in the experimental area51 repository where people are trying to get it working first.</li>
<li>Lumina : As a developer with PC-BSD for a long time, and a tester from nearly the beginning of the project, I was keenly aware  the winds of change were blowing in the open-source ecosystem.</li>
<li>TrueOS : All of these ecosystem changes finally came to a head for us near the beginning of 2016. KDE4 was starting to deteriorate underneath us, and the FreeBSD Release branch would never allow us to compete with the rate of graphics driver or standards changes coming out of the Linux camp.</li>
</ul></li>
<li><p>The Rename and Next Steps</p></li>
</ul>

<blockquote>
<p>With all of these changes and the lack of a clear upgrade path from PC-BSD to the new systems, we decided it was necessary to change the project itself (name and all). To us, this was the only way to ensure people were aware of the differences, and that TrueOS really is a different kind of project from PC-BSD. Note this was not a hostile takeover of the PC-BSD project by rabid FreeBSD fanatics. This was more a refocusing of the PC-BSD project into something that could ensure longevity and reliability for the foreseeable future.</p>
</blockquote>

<blockquote>
 Does TrueOS have bugs and issues? Of course! That is the nature of rolling with upstream changes all the time. Not only do you always get the latest version of something (a good thing), you also find yourself on the front line for finding and reporting bugs in those same applications (a bad thing if you like consistency or stability). What you are also seeing is just how much churn happens in the open-source ecosystem at any given time.
 We are devoted to providing our users (and ourselves  dont forget we use TrueOS every day too!) a stable, reliable, and secure experience. Please be patient as we continue striving toward this goal in the best way possible, not just doing what works for the moment, but the projects future too.
</blockquote>

<hr>

<h3><a href="https://www.youtube.com/watch?v=vnD10WQ2930" rel="nofollow">Robert Mustacchi: Excerpts from The Soft Ring Cycle #1</a></h3>

<ul>
<li>The author of the Turtles on the Wire post we featured the other week, is back with a video.</li>
<li>Joyent has started a new series of lunchtime technical discussions to share information as they grow their engineering team</li>
<li>This video focuses on the network stack, how it works, and how it relates to virtualization and multi-tenancy</li>
<li>Basically, how the network stack on IllumOS works when you have virtual tenants, be they virtual machines or zones</li>
<li>The video describes the many layers of the network stack, how they work together, and how they can be made to work quickly</li>
<li>It also talks about the trade-offs between high throughput and low latency</li>
<li>How security is enforced, so virtual tenants cannot send packets into VLANs they are not members of, or receive traffic that they are not allowed to by the administrator</li>
<li>How incoming packets are classified, and eventually delivered to the intended destination</li>
<li>How the system decides if it has enough available resources to process the packet, or if it needs to be dropped</li>
<li>How interface polling works on IllumOS (a lot different than on FreeBSD)</li>
<li>Then the last 20 minutes are about how the qemu interface of the KVM hypervisor interfaces with the network stack</li>
<li>We look forward to seeing more of these videos as they come out
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2017/04/forcing-password-gropers-through.html" rel="nofollow">Forcing the password gropers through a smaller hole with OpenBSD&#39;s PF queues</a></h3>

<blockquote>
<p>While preparing material for the upcoming <a href="http://www.bsdcan.org/2017/schedule/events/805.en.html" rel="nofollow">BSDCan PF and networking tutorial</a>, I realized that the pop3 gropers were actually not much fun to watch anymore. So I used the traffic shaping features of my OpenBSD firewall to let the miscreants inflict some pain on themselves. Watching logs became fun again.<br>
The actual useful parts of this article follow - take this as a walkthrough of how to mitigate a wide range of threats and annoyances.<br>
First, analyze the behavior that you want to defend against. In our case that&#39;s fairly obvious: We have a service that&#39;s getting a volume of unwanted traffic, and looking at our logs the attempts come fairly quickly with a number of repeated attempts from each source address.<br>
I&#39;ve written about the rapid-fire ssh bruteforce attacks and their mitigation before (and of course it&#39;s in The Book of PF) as well as the slower kind where those techniques actually come up short. The traditional approach to ssh bruteforcers has been to simply block their traffic, and the state-tracking features of PF let you set up overload criteria that add the source addresses to the table that holds the addresses you want to block.<br>
For the system that runs our pop3 service, we also have a PF ruleset in place with queues for traffic shaping. For some odd reason that ruleset is fairly close to the HFSC traffic shaper example in The Book of PF, and it contains a queue that I set up mainly as an experiment to annoy spammers (as in, the ones that are already for one reason or the other blacklisted by our spamd).<br>
The queue is defined like this:</p>
</blockquote>

<blockquote> 
 queue spamd parent rootq bandwidth 1K min 0K max 1K qlimit 300
</blockquote>

<blockquote>
<p>yes, that&#39;s right. A queue with a maximum throughput of 1 kilobit per second. I have been warned that this is small enough that the code may be unable to strictly enforce that limit due to the timer resolution in the HFSC code. But that didn&#39;t keep me from trying.<br>
Now a few small additions to the ruleset are needed for the good to put the evil to the task. We start with a table to hold the addresses we want to mess with. Actually, I&#39;ll add two, for reasons that will become clear later:</p>
</blockquote>

<blockquote>
   table <longterm> persist counters 
   table <popflooders> persist counters 
</blockquote>

<blockquote>
<p>The rules that use those tables are:</p>
</blockquote>

<blockquote>
   block drop log (all) quick from <longterm> 

   pass in quick log (all) on egress proto tcp from <popflooders> to port pop3 flags S/SA keep state \ 
   (max-src-conn 2, max-src-conn-rate 3/3, overload <longterm> flush global, pflow) set queue spamd 

   pass in log (all) on egress proto tcp to port pop3 flags S/SA keep state \ 
   (max-src-conn 5, max-src-conn-rate 6/3, overload <popflooders> flush global, pflow) 
</blockquote>

<blockquote>
<p>The last one lets anybody connect to the pop3 service, but any one source address can have only open five simultaneous connections and at a rate of six over three seconds.</p>

<p>The results were immediately visible. Monitoring the queues using pfctl -vvsq shows the tiny queue works as expected:</p>
</blockquote>

<blockquote>
   queue spamd parent rootq bandwidth 1K, max 1K qlimit 300
    [ pkts:     196136  bytes:   12157940  dropped pkts: 398350 bytes: 24692564 ]
    [ qlength: 300/300 ]
    [ measured:     2.0 packets/s, 999.13 b/s ]
</blockquote>

<blockquote>
<p>and looking at the pop3 daemon&#39;s log entries, a typical encounter looks like this:</p>
</blockquote>

<blockquote>
   Apr 19 22:39:33 skapet spop3d[44875]: connect from 111.181.52.216
   Apr 19 22:39:33 skapet spop3d[75112]: connect from 111.181.52.216
   Apr 19 22:39:34 skapet spop3d[57116]: connect from 111.181.52.216
   Apr 19 22:39:34 skapet spop3d[65982]: connect from 111.181.52.216
   Apr 19 22:39:34 skapet spop3d[58964]: connect from 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[12410]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[63573]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[76113]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[23524]: autologout time elapsed - 111.181.52.216
   Apr 19 22:40:34 skapet spop3d[16916]: autologout time elapsed - 111.181.52.216
</blockquote>

<blockquote>
<p>here the miscreant comes in way too fast and only manages to get five connections going before they&#39;re shunted to the tiny queue to fight it out with known spammers for a share of bandwidth.<br>
One important takeaway from this, and possibly the most important point of this article, is that it does not take a lot of imagination to retool this setup to watch for and protect against undesirable activity directed at essentially any network service.<br>
You pick the service and the ports it uses, then figure out what are the parameters that determine what is acceptable behavior. Once you have those parameters defined, you can choose to assign to a minimal queue like in this example, block outright, redirect to something unpleasant or even pass with a low probability.</p>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-fs/2017-April/024684.html" rel="nofollow">64-bit inodes (ino64) Status Update and Call for Testing</a></h3>

<blockquote>
<p>Inodes are data structures corresponding to objects in a file system, such as files and directories. FreeBSD has historically used 32-bit values to identify inodes, which limits file systems to somewhat under 2<sup>32</sup> objects. Many modern file systems internally use 64-bit identifiers and FreeBSD needs to follow suit to properly and fully support these file systems.</p>

<p>The 64-bit inode project, also known as ino64, started life many years ago as a project by Gleb Kurtsou (gleb@).  After that time several people have had a hand in updating it and addressing regressions, after mckusick@ picked up and updated the patch, and acted as a flag-waver.</p>
</blockquote>

<ol>
<li>Overview : The ino64 branch extends the basic system types ino_t and dev_t from 32-bit to 64-bit, and nlink_t from 16-bit to 64-bit.</li>
<li>Motivation : The main risk of the ino64 change is the uncontrolled ABI breakage.</li>
<li>Quirks : We handled kinfo sysctl MIBs, but other MIBs which report structures depended on the changed type, are not handled in general.  It was considered that the breakage is either in the management interfaces, where we usually allow ABI slip, or is not important.</li>
<li>Testing procedure : The ino64 project can be tested by cloning the project branch from GitHub or by applying the patch <from the Phabricator review | locatedat URL | attached> to a working tree.

<ul>
<li>New kernel, old world.</li>
<li>New kernel, new world, old third-party applications.</li>
<li>32bit compat.</li>
<li>Targeted tests.</li>
<li>NFS server and client test</li>
<li>Other filesystems</li>
<li>Test accounting</li>
</ul></li>
<li>Ports Status with ino64 : A ports exp-run for ino64 is open in PR 218320.
5.1. LLVM : LLVM includes a component called Address Sanitizer or ASAN, which triesto intercept syscalls, and contains knowledge of the layout of many system structures.  Since stat and lstat syscalls were removed and several types and structures changed, this has to be reflected in the ASAN hacks.
5.2. lang/ghc : The ghc compiler and parts of the runtime are written in Haskell, which means that to compile ghc, you need a working Haskell compiler for bootstrap.
5.3. lang/rust Rustc has a similar structure to GHC, and same issue.  The same solution of patching the bootstrap was done.</li>
<li>Next Steps : The tentative schedule for the ino64 project:

<ul>
<li>2017-04-20 Post wide call for testing : Investigate and address port failures with maintainer support</li>
<li>2017-05-05 Request second exp-run with initial patches applied : Investigate and address port failures with maintainer support</li>
<li>2017-05-19 Commit to HEAD : Address post-commit failures where feasible
***</li>
</ul></li>
</ol>

<h2>News Roundup</h2>

<h3><a href="http://meka.rs/blog/2017/01/25/sing-beastie-sing/" rel="nofollow">Sing, beastie, sing!</a></h3>

<blockquote>
<p>FreeBSD digital audio workstation, or DAW for short, is now possible. At this very moment it&#39;s not user friendly that much, but you&#39;ll manage. What I want to say is that I worked on porting some of the audio apps to FreeBSD, met some other people interested in porting audio stuff and became heavily involved with DrumGizmo - drum sampling engine. Let me start with the basic setup.<br>
FreeBSD doesn&#39;t have hard real-time support, but it&#39;s pretty close. For the needs of audio, FreeBSD&#39;s implementation of real-time is sufficient and, in my opinion, superior to the one you can get on Linux with RT path (which is ugly, not supported by distributions and breaks apps like VirtualBox). As default install of FreeBSD is concerned with real-time too much, we have to tweak sysctl a bit, so append this to your /etc/sysctl.conf:</p>
</blockquote>

<blockquote>
   kern.timecounter.alloweddeviation=0
   hw.usb.uaudio.buffer_ms=2 # only on -STABLE for now
   hw.snd.latency=0
   kern.coredump=0
</blockquote>

<ul>
<li>So let me go through the list. First item tells FreeBSD how many events it can aggregate (or wait for) before emitting them. The reason this is the default is because aggregating events saves power a bit, and currently more laptops are running FreeBSD than DAWs. Second one is the lowest possible buffer for USB audio driver. If you&#39;re not using USB audio, this won&#39;t change a thing. Third one has nothing to do with real-time, but dealing with programs that consume ~3GB of RAM, dumping cores around made a problem on my machine. Besides, core dumps are only useful if you know how to debug the problem, or someone is willing to do that for you. I like to not generate those files by default, but if some app is constantly crashing, I enable dumps, run the app, crash it, and disable dumps again. I lost 30GB in under a minute by examining 10 different drumkits of DrumGizmo and all of them gave me 3GB of core file, each.</li>
<li>More setup instructions follow, including jackd setup and PulseAudio using virtual_oss.</li>
</ul>

<blockquote>
<p>With this setup I can play OSS, JACK and PulseAudio sound all at the same time, which I was not able to do on Linux.</p>

<hr>
</blockquote>

<h3><a href="https://itso.dk/?p=499" rel="nofollow">FreeBSD 11 Unbound DNS server</a></h3>

<blockquote>
<p>In FreeBSD, there is a built-in DNS server called Unbound.<br>
So why would run a local DNS server? I am in a region where internet traffic is still a bit expensive, that also implies slow, and high response times. To speed that a up a little, you can use own DNS server. It will speed up because for every homepage you visit, there will be several hooks to other domains: commercials, site components, and links to other sites. These, will now all be cached locally on your new DNS server. In my case I use an old PC-Engine Alix board for my home DNS server, but you can use almost everything, Raspberry Pi, old laptop/desktop and others. As long as it runs FreeBSD.</p>
</blockquote>

<ul>
<li>Goes into more details about what commands to run and which services to start</li>
<li>Try it out if you are in a similar situation
***</li>
</ul>

<h3><a href="https://arxiv.org/pdf/1704.02786.pdf" rel="nofollow">Why it is important that documentation and tutorials be correct and carefully reviewed</a></h3>

<ul>
<li>A group of researchers found that a lot of online web programming tutorials contain serious security flaws. They decided to do a research project to see how this impacts software that is written possibly based on those tutorials.</li>
<li>They used a number of simple google search terms to make a list of tutorials, and manually audited them for common vulnerabilities. They then crawled GitHub to find projects with very similar code snippets that might have been taken from those tutorials.</li>
</ul>

<blockquote>
<p>The Web is replete with tutorial-style content on how to accomplish programming tasks. Unfortunately, even top-ranked tutorials suffer from severe security vulnerabilities, such as cross-site scripting (XSS), and SQL injection (SQLi). Assuming that these tutorials influence real-world software development, we hypothesize that code snippets from popular tutorials can be used to bootstrap vulnerability discovery at scale. To validate our hypothesis, we propose a semi-automated approach to find recurring vulnerabilities starting from a handful of top-ranked tutorials that contain vulnerable code snippets. We evaluate our approach by performing an analysis of tens of thousands of open-source web applications to check if vulnerabilities originating in the selected tutorials recur.<br>
Our analysis framework has been running on a standard PC, analyzed 64,415 PHP codebases hosted on GitHub thus far, and found a total of 117 vulnerabilities that have a strong syntactic similarity to vulnerable code snippets present in popular tutorials. In addition to shedding light on the anecdotal belief that programmers reuse web tutorial code in an ad hoc manner, our study finds disconcerting evidence of insufficiently reviewed tutorials compromising the security of open-source projects.  Moreover, our findings testify to the feasibility of large-scale vulnerability discovery using poorly written tutorials as a starting point</p>
</blockquote>

<ul>
<li>The researchers found 117 vulnerabilities, of these, at least 8 appear to be nearly exact copy/pastes of the tutorials that were found to be vulnerable.
***</li>
</ul>

<h3><a href="https://lumina-desktop.org/1-3-0-development-preview-new-icon-themes/" rel="nofollow">1.3.0 Development Preview: New icon themes</a></h3>

<blockquote>
<p>As version 1.3.0 of the Lumina desktop starts getting closer to release, I want to take a couple weeks and give you all some sneak peaks at some of the changes/updates that we have been working on (and are in the process of finishing up). </p>
</blockquote>

<ul>
<li><a href="https://lumina-desktop.org/1-3-0-development-preview-new-icon-themes/" rel="nofollow">New icon theme</a>

<ul>
<li>Material Design Light/Dark </li>
<li>There are a lot more icons available in the reference icon packs which we still have not gotten around to renaming yet, but this initial version satisfies all the XDG standards for an icon theme + all the extra icons needed for Lumina and its utilities + a large number of additional icons for application use.</li>
</ul></li>
</ul>

<blockquote>
<p>This highlights one the big things that I love about Lumina: it gives you an interface that is custom-tailored to YOUR needs/wants  rather than expecting YOU to change your routines to accomodate how some random developer/designer across the world thinks everybody should use a computer.</p>
</blockquote>

<ul>
<li><a href="https://lumina-desktop.org/1-3-0-development-preview-lumina-mediaplayer/" rel="nofollow">Lumina Media Player</a></li>
</ul>

<blockquote>
<p>This is a small utility designed to provide the ability for the user to play audio and video files on the local system, as well as stream audio from online sources. For now, only the Pandora internet radio service is supported via the pianobar CLI utility, which is an optional runtime dependency. However, we hope to gradually add new streaming sources over time. <br>
For a long time I had been using another Pandora streaming client on my TrueOS desktop, but it was very fragile with respect to underlying changes: LibreSSL versions for example. The player would regularly stop functioning for a few update cycles until a version of LibreSSL which was compatible with the player was used. After enduring this for some time, I was finally frustrated enough to start looking for alternatives. <br>
A co-worker pointed me to a command-line utility called pianobar, which was also a small client for Pandora radio. After using pianobar for a couple weeks, I was impressed with how stable it was and how little overhead it required with regards to extra runtime dependencies. Of course, I started thinking I could write a Qt5 GUI for that!. Once I had a few free hours, I started writing what became lumina-mediaplayer. I started with the interface to pianobar itself to see how complicated it would be to interact with, but after a couple days of tinkering in my spare time, I realized I had a full client to Pandora radio basically finished.</p>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://easychair.org/conferences/?conf=vbsdcon2017" rel="nofollow">vBSDCon CFP closes April 29th</a></li>
<li><a href="https://2017.eurobsdcon.org/2017/03/13/call-for-proposals/" rel="nofollow">EuroBSDCon CFP closes April 30th</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170421001933" rel="nofollow">clang(1) added to base on amd64 and i386</a></li>
<li><a href="https://marc.info/?l=openbsd-misc&m=149232307018311&w=2" rel="nofollow">Theo: Most things come to an end, sorry.</a></li>
<li><a href="https://www.dragonflydigest.com/2017/04/24/19609.html" rel="nofollow">ASLR, PIE, NX, and other capital letters</a></li>
<li><a href="https://www.ssh.com/ssh/port" rel="nofollow">How SSH got port number 22</a></li>
<li><a href="https://news.ycombinator.com/item?id=14128637" rel="nofollow">Netflix Serving 90Gb/s+ From Single Machines Using Tuned FreeBSD</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=317414" rel="nofollow">Compressed zfs send / receive lands in FreeBSD HEAD</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/3QSMYEH#wrap" rel="nofollow">Steve - FreeBSD Jobs</a></li>
<li><a href="http://dpaste.com/0NNYH22#wrap" rel="nofollow">Mike - CuBox i4Pro</a></li>
<li><a href="http://dpaste.com/1QRZBPD#wrap" rel="nofollow">Steve - Year of the BSD Desktop?</a></li>
<li><a href="http://dpaste.com/2TFV8AJ#wrap" rel="nofollow">Brad - Configuration Management</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>190: The Moore You Know</title>
  <link>https://www.bsdnow.tv/190</link>
  <guid isPermaLink="false">919a0bc5-1fd4-4195-bb5d-5f587826c25e</guid>
  <pubDate>Wed, 19 Apr 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/919a0bc5-1fd4-4195-bb5d-5f587826c25e.mp3" length="94312372" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week, we look forward with the latest OpenBSD release, look back with Dennis Ritchie’s paper on the evolution of Unix Time Sharing, have an Interview with Kris</itunes:subtitle>
  <itunes:duration>2:10:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week, we look forward with the latest OpenBSD release, look back with Dennis Ritchie’s paper on the evolution of Unix Time Sharing, have an Interview with Kris
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
OpenBSD 6.1 RELEASED (http://undeadly.org/cgi?action=article&amp;amp;sid=20170411132956)
Mailing list post (https://marc.info/?l=openbsd-announce&amp;amp;m=149191716921690&amp;amp;w=2')
We are pleased to announce the official release of OpenBSD 6.1. This is our 42nd release.
New/extended platforms:
New arm64 platform, using clang(1) as the base system compiler.
The loongson platform now supports systems with Loongson 3A CPU and RS780E chipset.
The following platforms were retired: armish, sparc, zaurus
New vmm(4)/ vmd(8)
IEEE 802.11 wireless stack improvements
Generic network stack improvements
Installer improvements
Routing daemons and other userland network improvements
Security improvements
dhclient(8)/ dhcpd(8)/ dhcrelay(8) improvements
Assorted improvements
OpenSMTPD 6.0.0
OpenSSH 7.4
LibreSSL 2.5.3
mandoc 1.14.1
***
Fuzz Testing OpenSSH (http://vegardno.blogspot.ca/2017/03/fuzzing-openssh-daemon-using-afl.html)
Vegard Nossum writes a blog post explaining how to fuzz OpenSSH using AFL
It starts by compiling AFL and SSH with LLVM to get extra instrumentation to make the fuzzing process better, and faster
Sandboxing, PIE, and other features are disabled to increase debuggability, and to try to make breaking SSH easier
Privsep is also disabled, because when AFL does make SSH crash, the child process crashing causes the parent process to exit normally, and AFL then doesn’t realize that a crash has happened. A one-line patch disables the privsep feature for the purposes of testing
A few other features are disabled to make testing easier (disabling replay attack protection allows the same inputs to be reused many times), and faster:
the local arc4random_buf() is patched to return a buffer of zeros
disabling CRC checks
disabling MAC checks
disabling encryption (allow the NULL cipher for everything)
add a call to _AFLINIT(), to enable “deferred forkserver mode”
disabling closefrom()
“Skipping expensive DH/curve and key derivation operations”
Then, you can finally get around to writing some test cases
The steps are all described in detail
In one day of testing, the author found a few NULL dereferences that have since been fixed.
Maybe you can think of some other code paths through SSH that should be tested, or want to test another daemon
***
Getting OpenBSD running on Raspberry Pi 3 (http://undeadly.org/cgi?action=article&amp;amp;sid=20170409123528)
Ian Darwin writes in about his work deploying the arm64 platform and the Raspberry Pi 3
So I have this empty white birdhouse-like thing in the yard, open at the front. It was intended to house the wireless remote temperature sensor from a low-cost weather station, which had previously been mounted on a dark-colored wall of the house [...]. But when I put the sensor into the birdhouse, the signal is too weak for the weather station to receive it (the mounting post was put in place by a previous owner of our property, and is set deeply in concrete). So the next plan was to pop in a tiny OpenBSD computer with a uthum(4) temperature sensor and stream the temperature over WiFi.
The Raspberry Pi computers are interesting in their own way: intending to bring low-cost computing to everybody, they take shortcuts and omit things that you'd expect on a laptop or desktop. They aren't too bright on their own: there's very little smarts in the board compared to the "BIOS" and later firmwares on conventional systems. Some of the "smarts" are only available as binary files. This was part of the reason that our favorite OS never came to the Pi Party for the original rpi, and didn't quite arrive for the rpi2. With the rpi3, though, there is enough availability that our devs were able to make it boot. Some limitations remain, though: if you want to build your own full release, you have to install the dedicated raspberrypi-firmware package from the ports tree. And, the boot disks have to have several extra files on them - this is set up on the install sets, but you should be careful not to mess with these extra files until you know what you're doing!
But wait! Before you read on, please note that, as of April 1, 2017, this platform boots up but is not yet ready for prime time:
there's no driver for SD/MMC but that's the only thing the hardware can level-0 boot from, so you need both the uSD card and a USB disk, at least while getting started;
there is no support for the built-in WiFi (a Broadcom BCM43438 SDIO 802.11), so you have to use wired Ethernet or a USB WiFi dongle (for my project an old MSI that shows up as ural(4) seems to work fine);
the HDMI driver isn't used by the kernel (if a monitor is plugged in uBoot will display its messages there), so you need to set up cu with a 3V serial cable, at least for initial setup.
the ports tree isn't ready to cope with the base compiler being clang yet, so packages are "a thing of the future"
But wait - there's more! The "USB disk" can be a USB thumb drive, though they're generally slower than a "real" disk. My first forays used a Kingston DTSE9, the hardy little steel-cased version of the popular DataTraveler line. I was able to do the install, and boot it, once (when I captured the dmesg output shown below). After that, it failed - the boot process hung with the ever-unpopular "scanning usb for storage devices..." message. I tried the whole thing again with a second DTSE9, and with a 32GB plastic-cased DataTraveler. Same results. After considerable wasted time, I found a post on RPI's own site which dates back to the early days of the PI 3, in which they admit that they took shortcuts in developing the firmware, and it just can't be made to work with the Kingston DataTraveler! Not having any of the "approved" devices, and not living around the corner from a computer store, I switched to a Sabrent USB dock with a 320GB Western Digital disk, and it's been rock solid. Too big and energy-hungry for the final project, but enough to show that the rpi3 can be solid with the right (solid-state) disk. And fast enough to build a few simple ports - though a lot will not build yet. I then found and installed OpenBSD onto a “PNY” brand thumb drive and found it solid - in fact I populated it by dd’ing from one of the DataTraveller drives, so they’re not at fault.
Check out the full article for detailed setup instructions
***
Dennis M. Ritchie’s Paper: The Evolution of the Unix Time Sharing System (http://www.read.seas.harvard.edu/~kohler/class/aosref/ritchie84evolution.pdf)
From the abstract:
This paper presents a brief history of the early development of the Unix operating system. It concentrates on the evolution of the file system, the process-control mechanism, and the idea of pipelined commands. Some attention is paid to social conditions during the development of the system. 
During the past few years, the Unix operating system has come into wide use, so wide that its very name has become a trademark of Bell Laboratories. Its important characteristics have become known to many people. It has suffered much rewriting and tinkering since the first publication describing it in 1974 [1], but few fundamental changes. However, Unix was born in 1969 not 1974, and the account of its development makes a little-known and perhaps instructive story. This paper presents a technical and social history of the evolution of the system. 
High level document structure:
Origins
The PDP-7 Unix file system 
Process control
IO Redirection
The advent of the PDP-11
The first PDP-11 system
Pipes
High-level languages
Conclusion
One of the comforting things about old memories is their tendency to take on a rosy glow. The programming environment provided by the early versions of Unix seems, when described here, to be extremely harsh and primitive. I am sure that if forced back to the PDP-7 I would find it intolerably limiting and lacking in conveniences. Nevertheless, it did not seem so at the time; the memory fixes on what was good and what lasted, and on the joy of helping to create the improvements that made life better. In ten years, I hope we can look back with the same mixed impression of progress combined with continuity. 
Interview - Kris Moore - kris@trueos.org (mailto:kris@trueos.org) | @pcbsdkris (https://twitter.com/pcbsdkris)
Director of Engineering at iXSystems
FreeNAS 
News Roundup
Compressed zfs send / receive now in FreeBSD’s vendor area (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=316894)
Andriy Gapon committed a whole lot of ZFS updates to FreeBSD’s vendor area
This feature takes advantage of the new compressed ARC feature, which means blocks that are compressed on disk, remain compressed in ZFS’ RAM cache, to use the compressed blocks when using ZFS replication.
Previously, blocks were uncompressed, sent (usually over the network), then recompressed on the other side.
This is rather wasteful, and can make the process slower, not just because of the CPU time wasted decompressing/recompressing the data, but because it means more data has to be sent over the network.
This caused many users to end up doing: zfs send | xz -T0 | ssh unxz | zfs recv, or similar, to compress the data before sending it over the network.
With this new feature, zfs send with the new -c flag, will transmit the already compressed blocks instead.
This change also adds longopts versions of all of the zfs send flags, making them easier to understand when written in shell scripts.
A lot of fixes, man page updates, etc. from upstream OpenZFS 
Thanks to everyone who worked on these fixes and features!
We’ll announce when these have been committed to head for testing
***
Granting privileges using the FreeBSD MAC framework  (https://mysteriouscode.io/blog/granting-privileges-using-mac-framework/)
The MAC (Mandatory Access Control) framework allows finer grained permissions than the standard UNIX permissions that exist in the base system
FreeBSD’s kernel provides quite sophisticated privilege model that extends the traditional UNIX user-and-group one. Here I’ll show how to leverage it to grant access to specific privileges to group of non-root users.
mac(9) allows creating pluggable modules with policies that can extend existing base system security definitions. struct macpolicyops consist of many entry points that we can use to amend the behaviour.
This time, I wanted to grant a privilege to change realtime priority to a selected group. While Linux kernel lets you specify a named group, FreeBSD doesn’t have such ability, hence I created this very simple policy.
The privilege check can be extended using two user supplied functions: privcheck and privgrant. The first one can be used to further restrict existing privileges, i.e. you can disallow some specific priv to be used in jails, etc. The second one is used to explicitly grant extra privileges not available for the target in base configuration.
The core of the macrtprio module is dead simple. I defined sysctl tree for two oids: enable (on/off switch for the policy) and gid (the GID target has to be member of), then I specified our custom version of mpoprivgrant called rtprioprivgrant. Body of my granting function is even simpler. If the policy is disabled or the privilege that is being checked is not PRIVSCHED_RTPRIO, we simply skip and return EPERM. If the user is member of the designated group we return 0 that’ll allow the action – target would change realtime privileges.
Another useful thing the MAC framework can be used to grant to non-root users: PortACL: The ability to bind to TCP/UDP ports less than 1024, which is usually restricted to root.
Some other uses for the MAC framework are discussed in The FreeBSD Handbook (https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mac.html)
However, there are lots more, and we would really like to see more tutorials and documentation on using MAC to make more secure servers, but allowing the few specific things that normally require root access.
***
The Story of the PING Program (http://ftp.arl.army.mil/~mike/ping.html)
This is from the homepage of Mike Muuss:
Yes, it's true! I'm the author of ping for UNIX. Ping is a little thousand-line hack that I wrote in an evening which practically everyone seems to know about. :-)
I named it after the sound that a sonar makes, inspired by the whole principle of cho-location. In college I'd done a lot of modeling of sonar and radar systems, so the "Cyberspace" analogy seemed very apt. It's exactly the same paradigm applied to a new problem domain: ping uses timed IP/ICMP ECHOREQUEST and ECHOREPLY packets to probe the "distance" to the target machine.
My original impetus for writing PING for 4.2a BSD UNIX came from an offhand remark in July 1983 by Dr. Dave Mills while we were attending a DARPA meeting in Norway, in which he described some work that he had done on his "Fuzzball" LSI-11 systems to measure path latency using timed ICMP Echo packets.
In December of 1983 I encountered some odd behavior of the IP network at BRL. Recalling Dr. Mills' comments, I quickly coded up the PING program, which revolved around opening an ICMP style SOCKRAW AFINET Berkeley-style socket(). The code compiled just fine, but it didn't work -- there was no kernel support for raw ICMP sockets! Incensed, I coded up the kernel support and had everything working well before sunrise. Not surprisingly, Chuck Kennedy (aka "Kermit") had found and fixed the network hardware before I was able to launch my very first "ping" packet. But I've used it a few times since then. grin If I'd known then that it would be my most famous accomplishment in life, I might have worked on it another day or two and added some more options.
The folks at Berkeley eagerly took back my kernel modifications and the PING source code, and it's been a standard part of Berkeley UNIX ever since. Since it's free, it has been ported to many systems since then, including Microsoft Windows95 and WindowsNT.
In 1993, ten years after I wrote PING, the USENIX association presented me with a handsome scroll, pronouncing me a Joint recipient of The USENIX Association 1993 Lifetime Achievement Award presented to the Computer Systems Research Group, University of California at Berkeley 1979-1993. ``Presented to honor profound intellectual achievement and unparalleled service to our Community. At the behest of CSRG principals we hereby recognize the following individuals and organizations as CSRG participants, contributors and supporters.'' Wow!
The best ping story I've ever heard was told to me at a USENIX conference, where a network administrator with an intermittent Ethernet had linked the ping program to his vocoder program, in essence writing:
ping goodhost | sed -e 's/.*/ping/' | vocoder
He wired the vocoder's output into his office stereo and turned up the volume as loud as he could stand. The computer sat there shouting "Ping, ping, ping..." once a second, and he wandered through the building wiggling Ethernet connectors until the sound stopped. And that's how he found the intermittent failure.
FreeBSD: /usr/local/lib/libpkg.so.3: Undefined symbol "utimensat" (http://glasz.org/sheeplog/2017/02/freebsd-usrlocalliblibpkgso3-undefined-symbol-utimensat.html)
The internet will tell you that, of course, 10.2 is EOL, that packages are being built for 10.3 by now and to better upgrade to the latest version of FreeBSD. While all of this is true and running the latest versions is generally good advise, in most cases it is unfeasible to do an entire OS upgrade just to be able to install a package.
Points out the ABI variable being used in /usr/local/etc/pkg/repos/FreeBSD.conf
Now, if you have 10.2 installed and 10.3 is the current latest FreeBSD version, this url will point to packages built for 10.3 resulting in the problem that, when running pkg upgrade pkg it’ll go ahead and install the latest version of pkg build for 10.3 onto your 10.2 system. Yikes! FreeBSD 10.3 and pkgng broke the ABI by introducing new symbols, like utimensat.
The solution:
Have a look at the actual repo url http://pkg.FreeBSD.org/FreeBSD:10:amd64… there’s repo’s for each release! Instead of going through the tedious process of upgrading FreeBSD you just need to Use a repo url that fits your FreeBSD release:
Update the package cache: pkg update
Downgrade pkgng (in case you accidentally upgraded it already): pkg delete -f pkg
pkg install -y pkg
Install your package
There you go. Don’t fret. But upgrade your OS soon ;)
Beastie Bits
CPU temperature collectd report on NetBSD (https://imil.net/blog/2017/01/22/collectd_NetBSD_temperature/)
Booting FreeBSD 11 with NVMe and ZFS on AMD Ryzen (https://www.servethehome.com/booting-freebsd-11-nvme-zfs-amd-ryzen/)
BeagleBone Black Tor relay (https://torbsd.github.io/blog.html#busy-bbb)
FreeBSD - Disable in-tree GDB by default on x86, mips, and powerpc (https://reviews.freebsd.org/rS317094)
CharmBUG April Meetup (https://www.meetup.com/CharmBUG/events/238218742/)
The origins of XXX as FIXME (https://www.snellman.net/blog/archive/2017-04-17-xxx-fixme/)
***
Feedback/Questions
Felis - L2ARC (http://dpaste.com/2APJE4E#wrap)
Gabe - FreeBSD Server Install (http://dpaste.com/0BRJJ73#wrap)  
FEMP Script (http://dpaste.com/05EYNJ4#wrap)
Scott - FreeNAS &amp;amp; LAGG (http://dpaste.com/1CV323G#wrap)
Marko - Backups (http://dpaste.com/3486VQZ#wrap)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, freenas, unix, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week, we look forward with the latest OpenBSD release, look back with Dennis Ritchies paper on the evolution of Unix Time Sharing, have an Interview with Kris</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170411132956" rel="nofollow">OpenBSD 6.1 RELEASED</a></h3>

<ul>
<li><a href="https://marc.info/?l=openbsd-announce&m=149191716921690&w=2&#x27;" rel="nofollow">Mailing list post</a></li>
<li>We are pleased to announce the official release of OpenBSD 6.1. This is our 42nd release.</li>
<li>New/extended platforms:

<ul>
<li>New arm64 platform, using clang(1) as the base system compiler.</li>
<li>The loongson platform now supports systems with Loongson 3A CPU and RS780E chipset.</li>
<li>The following platforms were retired: armish, sparc, zaurus</li>
</ul></li>
<li>New vmm(4)/ vmd(8)</li>
<li>IEEE 802.11 wireless stack improvements</li>
<li>Generic network stack improvements</li>
<li>Installer improvements</li>
<li>Routing daemons and other userland network improvements</li>
<li>Security improvements</li>
<li>dhclient(8)/ dhcpd(8)/ dhcrelay(8) improvements</li>
<li>Assorted improvements</li>
<li>OpenSMTPD 6.0.0</li>
<li>OpenSSH 7.4</li>
<li>LibreSSL 2.5.3</li>
<li>mandoc 1.14.1
***</li>
</ul>

<h3><a href="http://vegardno.blogspot.ca/2017/03/fuzzing-openssh-daemon-using-afl.html" rel="nofollow">Fuzz Testing OpenSSH</a></h3>

<ul>
<li>Vegard Nossum writes a blog post explaining how to fuzz OpenSSH using AFL</li>
<li>It starts by compiling AFL and SSH with LLVM to get extra instrumentation to make the fuzzing process better, and faster</li>
<li>Sandboxing, PIE, and other features are disabled to increase debuggability, and to try to make breaking SSH easier</li>
<li>Privsep is also disabled, because when AFL does make SSH crash, the child process crashing causes the parent process to exit normally, and AFL then doesnt realize that a crash has happened. A one-line patch disables the privsep feature for the purposes of testing</li>
<li>A few other features are disabled to make testing easier (disabling replay attack protection allows the same inputs to be reused many times), and faster:

<ul>
<li>the local arc4random_buf() is patched to return a buffer of zeros</li>
<li>disabling CRC checks</li>
<li>disabling MAC checks</li>
<li>disabling encryption (allow the NULL cipher for everything)</li>
<li>add a call to __AFL_INIT(), to enable deferred forkserver mode</li>
<li>disabling closefrom()</li>
<li>Skipping expensive DH/curve and key derivation operations</li>
</ul></li>
<li>Then, you can finally get around to writing some test cases</li>
<li>The steps are all described in detail</li>
<li>In one day of testing, the author found a few NULL dereferences that have since been fixed.</li>
<li>Maybe you can think of some other code paths through SSH that should be tested, or want to test another daemon
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170409123528" rel="nofollow">Getting OpenBSD running on Raspberry Pi 3</a></h3>

<blockquote>
<p>Ian Darwin writes in about his work deploying the arm64 platform and the Raspberry Pi 3<br>
So I have this empty white birdhouse-like thing in the yard, open at the front. It was intended to house the wireless remote temperature sensor from a low-cost weather station, which had previously been mounted on a dark-colored wall of the house [...]. But when I put the sensor into the birdhouse, the signal is too weak for the weather station to receive it (the mounting post was put in place by a previous owner of our property, and is set deeply in concrete). So the next plan was to pop in a tiny OpenBSD computer with a uthum(4) temperature sensor and stream the temperature over WiFi.<br>
The Raspberry Pi computers are interesting in their own way: intending to bring low-cost computing to everybody, they take shortcuts and omit things that you&#39;d expect on a laptop or desktop. They aren&#39;t too bright on their own: there&#39;s very little smarts in the board compared to the &quot;BIOS&quot; and later firmwares on conventional systems. Some of the &quot;smarts&quot; are only available as binary files. This was part of the reason that our favorite OS never came to the Pi Party for the original rpi, and didn&#39;t quite arrive for the rpi2. With the rpi3, though, there is enough availability that our devs were able to make it boot. Some limitations remain, though: if you want to build your own full release, you have to install the dedicated raspberrypi-firmware package from the ports tree. And, the boot disks have to have several extra files on them - this is set up on the install sets, but you should be careful not to mess with these extra files until you know what you&#39;re doing!</p>

<p>But wait! Before you read on, please note that, as of April 1, 2017, this platform boots up but is not yet ready for prime time:</p>
</blockquote>

<ul>
<li>there&#39;s no driver for SD/MMC but that&#39;s the only thing the hardware can level-0 boot from, so you need both the uSD card and a USB disk, at least while getting started;</li>
<li>there is no support for the built-in WiFi (a Broadcom BCM43438 SDIO 802.11), so you have to use wired Ethernet or a USB WiFi dongle (for my project an old MSI that shows up as ural(4) seems to work fine);</li>
<li>the HDMI driver isn&#39;t used by the kernel (if a monitor is plugged in uBoot will display its messages there), so you need to set up cu with a 3V serial cable, at least for initial setup.</li>
<li>the ports tree isn&#39;t ready to cope with the base compiler being clang yet, so packages are &quot;a thing of the future&quot;</li>
</ul>

<blockquote>
<p>But wait - there&#39;s more! The &quot;USB disk&quot; can be a USB thumb drive, though they&#39;re generally slower than a &quot;real&quot; disk. My first forays used a Kingston DTSE9, the hardy little steel-cased version of the popular DataTraveler line. I was able to do the install, and boot it, once (when I captured the dmesg output shown below). After that, it failed - the boot process hung with the ever-unpopular &quot;scanning usb for storage devices...&quot; message. I tried the whole thing again with a second DTSE9, and with a 32GB plastic-cased DataTraveler. Same results. After considerable wasted time, I found a post on RPI&#39;s own site which dates back to the early days of the PI 3, in which they admit that they took shortcuts in developing the firmware, and it just can&#39;t be made to work with the Kingston DataTraveler! Not having any of the &quot;approved&quot; devices, and not living around the corner from a computer store, I switched to a Sabrent USB dock with a 320GB Western Digital disk, and it&#39;s been rock solid. Too big and energy-hungry for the final project, but enough to show that the rpi3 can be solid with the right (solid-state) disk. And fast enough to build a few simple ports - though a lot will not build yet. I then found and installed OpenBSD onto a PNY brand thumb drive and found it solid - in fact I populated it by dding from one of the DataTraveller drives, so theyre not at fault.</p>
</blockquote>

<ul>
<li>Check out the full article for detailed setup instructions
***</li>
</ul>

<h3><a href="http://www.read.seas.harvard.edu/%7Ekohler/class/aosref/ritchie84evolution.pdf" rel="nofollow">Dennis M. Ritchies Paper: The Evolution of the Unix Time Sharing System</a></h3>

<ul>
<li>From the abstract:</li>
</ul>

<blockquote>
<p>This paper presents a brief history of the early development of the Unix operating system. It concentrates on the evolution of the file system, the process-control mechanism, and the idea of pipelined commands. Some attention is paid to social conditions during the development of the system. <br>
During the past few years, the Unix operating system has come into wide use, so wide that its very name has become a trademark of Bell Laboratories. Its important characteristics have become known to many people. It has suffered much rewriting and tinkering since the first publication describing it in 1974 [1], but few fundamental changes. However, Unix was born in 1969 not 1974, and the account of its development makes a little-known and perhaps instructive story. This paper presents a technical and social history of the evolution of the system. </p>
</blockquote>

<ul>
<li>High level document structure:</li>
</ul>

<blockquote>
<p>Origins<br>
The PDP-7 Unix file system <br>
Process control<br>
IO Redirection<br>
The advent of the PDP-11<br>
The first PDP-11 system<br>
Pipes<br>
High-level languages<br>
Conclusion</p>

<p>One of the comforting things about old memories is their tendency to take on a rosy glow. The programming environment provided by the early versions of Unix seems, when described here, to be extremely harsh and primitive. I am sure that if forced back to the PDP-7 I would find it intolerably limiting and lacking in conveniences. Nevertheless, it did not seem so at the time; the memory fixes on what was good and what lasted, and on the joy of helping to create the improvements that made life better. In ten years, I hope we can look back with the same mixed impression of progress combined with continuity. </p>

<hr>
</blockquote>

<h2>Interview - Kris Moore - <a href="mailto:kris@trueos.org" rel="nofollow">kris@trueos.org</a> | <a href="https://twitter.com/pcbsdkris" rel="nofollow">@pcbsdkris</a></h2>

<ul>
<li>Director of Engineering at iXSystems</li>
<li>FreeNAS </li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=316894" rel="nofollow">Compressed zfs send / receive now in FreeBSDs vendor area</a></h3>

<ul>
<li>Andriy Gapon committed a whole lot of ZFS updates to FreeBSDs vendor area</li>
<li>This feature takes advantage of the new compressed ARC feature, which means blocks that are compressed on disk, remain compressed in ZFS RAM cache, to use the compressed blocks when using ZFS replication.</li>
<li>Previously, blocks were uncompressed, sent (usually over the network), then recompressed on the other side.</li>
<li>This is rather wasteful, and can make the process slower, not just because of the CPU time wasted decompressing/recompressing the data, but because it means more data has to be sent over the network.</li>
<li>This caused many users to end up doing: zfs send | xz -T0 | ssh unxz | zfs recv, or similar, to compress the data before sending it over the network.</li>
<li>With this new feature, zfs send with the new -c flag, will transmit the already compressed blocks instead.</li>
<li>This change also adds longopts versions of all of the zfs send flags, making them easier to understand when written in shell scripts.</li>
<li>A lot of fixes, man page updates, etc. from upstream OpenZFS </li>
<li>Thanks to everyone who worked on these fixes and features!</li>
<li>Well announce when these have been committed to head for testing
***</li>
</ul>

<h3><a href="https://mysteriouscode.io/blog/granting-privileges-using-mac-framework/" rel="nofollow">Granting privileges using the FreeBSD MAC framework </a></h3>

<ul>
<li>The MAC (Mandatory Access Control) framework allows finer grained permissions than the standard UNIX permissions that exist in the base system</li>
</ul>

<blockquote>
<p>FreeBSDs kernel provides quite sophisticated privilege model that extends the traditional UNIX user-and-group one. Here Ill show how to leverage it to grant access to specific privileges to group of non-root users.<br>
mac(9) allows creating pluggable modules with policies that can extend existing base system security definitions. struct mac_policy_ops consist of many entry points that we can use to amend the behaviour.<br>
This time, I wanted to grant a privilege to change realtime priority to a selected group. While Linux kernel lets you specify a named group, FreeBSD doesnt have such ability, hence I created this very simple policy.<br>
The privilege check can be extended using two user supplied functions: priv_check and priv_grant. The first one can be used to further restrict existing privileges, i.e. you can disallow some specific priv to be used in jails, etc. The second one is used to explicitly grant extra privileges not available for the target in base configuration.<br>
The core of the mac_rtprio module is dead simple. I defined sysctl tree for two oids: enable (on/off switch for the policy) and gid (the GID target has to be member of), then I specified our custom version of mpo_priv_grant called rtprio_priv_grant. Body of my granting function is even simpler. If the policy is disabled or the privilege that is being checked is not PRIV_SCHED_RTPRIO, we simply skip and return EPERM. If the user is member of the designated group we return 0 thatll allow the action  target would change realtime privileges.</p>
</blockquote>

<ul>
<li>Another useful thing the MAC framework can be used to grant to non-root users: PortACL: The ability to bind to TCP/UDP ports less than 1024, which is usually restricted to root.</li>
<li>Some other uses for the MAC framework are discussed in <a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mac.html" rel="nofollow">The FreeBSD Handbook</a></li>
<li>However, there are lots more, and we would really like to see more tutorials and documentation on using MAC to make more secure servers, but allowing the few specific things that normally require root access.
***</li>
</ul>

<h3><a href="http://ftp.arl.army.mil/%7Emike/ping.html" rel="nofollow">The Story of the PING Program</a></h3>

<ul>
<li>This is from the homepage of Mike Muuss:</li>
</ul>

<blockquote>
<p>Yes, it&#39;s true! I&#39;m the author of ping for UNIX. Ping is a little thousand-line hack that I wrote in an evening which practically everyone seems to know about. :-)<br>
I named it after the sound that a sonar makes, inspired by the whole principle of cho-location. In college I&#39;d done a lot of modeling of sonar and radar systems, so the &quot;Cyberspace&quot; analogy seemed very apt. It&#39;s exactly the same paradigm applied to a new problem domain: ping uses timed IP/ICMP ECHO_REQUEST and ECHO_REPLY packets to probe the &quot;distance&quot; to the target machine.<br>
My original impetus for writing PING for 4.2a BSD UNIX came from an offhand remark in July 1983 by Dr. Dave Mills while we were attending a DARPA meeting in Norway, in which he described some work that he had done on his &quot;Fuzzball&quot; LSI-11 systems to measure path latency using timed ICMP Echo packets.<br>
In December of 1983 I encountered some odd behavior of the IP network at BRL. Recalling Dr. Mills&#39; comments, I quickly coded up the PING program, which revolved around opening an ICMP style SOCK_RAW AF_INET Berkeley-style socket(). The code compiled just fine, but it didn&#39;t work -- there was no kernel support for raw ICMP sockets! Incensed, I coded up the kernel support and had everything working well before sunrise. Not surprisingly, Chuck Kennedy (aka &quot;Kermit&quot;) had found and fixed the network hardware before I was able to launch my very first &quot;ping&quot; packet. But I&#39;ve used it a few times since then. <em>grin</em> If I&#39;d known then that it would be my most famous accomplishment in life, I might have worked on it another day or two and added some more options.<br>
The folks at Berkeley eagerly took back my kernel modifications and the PING source code, and it&#39;s been a standard part of Berkeley UNIX ever since. Since it&#39;s free, it has been ported to many systems since then, including Microsoft Windows95 and WindowsNT.<br>
In 1993, ten years after I wrote PING, the USENIX association presented me with a handsome scroll, pronouncing me a Joint recipient of The USENIX Association 1993 Lifetime Achievement Award presented to the Computer Systems Research Group, University of California at Berkeley 1979-1993. ``Presented to honor profound intellectual achievement and unparalleled service to our Community. At the behest of CSRG principals we hereby recognize the following individuals and organizations as CSRG participants, contributors and supporters.&#39;&#39; Wow!<br>
The best ping story I&#39;ve ever heard was told to me at a USENIX conference, where a network administrator with an intermittent Ethernet had linked the ping program to his vocoder program, in essence writing:<br>
ping goodhost | sed -e &#39;s/.*/ping/&#39; | vocoder<br>
He wired the vocoder&#39;s output into his office stereo and turned up the volume as loud as he could stand. The computer sat there shouting &quot;Ping, ping, ping...&quot; once a second, and he wandered through the building wiggling Ethernet connectors until the sound stopped. And that&#39;s how he found the intermittent failure.</p>

<hr>
</blockquote>

<h3><a href="http://glasz.org/sheeplog/2017/02/freebsd-usrlocalliblibpkgso3-undefined-symbol-utimensat.html" rel="nofollow">FreeBSD: /usr/local/lib/libpkg.so.3: Undefined symbol &quot;utimensat&quot;</a></h3>

<blockquote>
<p>The internet will tell you that, of course, 10.2 is EOL, that packages are being built for 10.3 by now and to better upgrade to the latest version of FreeBSD. While all of this is true and running the latest versions is generally good advise, in most cases it is unfeasible to do an entire OS upgrade just to be able to install a package.</p>
</blockquote>

<ul>
<li>Points out the ABI variable being used in /usr/local/etc/pkg/repos/FreeBSD.conf</li>
</ul>

<blockquote>
<p>Now, if you have 10.2 installed and 10.3 is the current latest FreeBSD version, this url will point to packages built for 10.3 resulting in the problem that, when running pkg upgrade pkg itll go ahead and install the latest version of pkg build for 10.3 onto your 10.2 system. Yikes! FreeBSD 10.3 and pkgng broke the ABI by introducing new symbols, like utimensat.</p>
</blockquote>

<ul>
<li>The solution:</li>
</ul>

<blockquote>
<p>Have a look at the actual repo url <a href="http://pkg.FreeBSD.org/FreeBSD:10:amd64%C2%85" rel="nofollow">http://pkg.FreeBSD.org/FreeBSD:10:amd64</a> theres repos for each release! Instead of going through the tedious process of upgrading FreeBSD you just need to Use a repo url that fits your FreeBSD release:</p>

<p>Update the package cache: pkg update<br>
Downgrade pkgng (in case you accidentally upgraded it already): pkg delete -f pkg<br>
pkg install -y pkg<br>
Install your package<br>
There you go. Dont fret. But upgrade your OS soon ;)</p>

<hr>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://imil.net/blog/2017/01/22/collectd_NetBSD_temperature/" rel="nofollow">CPU temperature collectd report on NetBSD</a></li>
<li><a href="https://www.servethehome.com/booting-freebsd-11-nvme-zfs-amd-ryzen/" rel="nofollow">Booting FreeBSD 11 with NVMe and ZFS on AMD Ryzen</a></li>
<li><a href="https://torbsd.github.io/blog.html#busy-bbb" rel="nofollow">BeagleBone Black Tor relay</a></li>
<li><a href="https://reviews.freebsd.org/rS317094" rel="nofollow">FreeBSD - Disable in-tree GDB by default on x86, mips, and powerpc</a></li>
<li><a href="https://www.meetup.com/CharmBUG/events/238218742/" rel="nofollow">CharmBUG April Meetup</a></li>
<li><a href="https://www.snellman.net/blog/archive/2017-04-17-xxx-fixme/" rel="nofollow">The origins of XXX as FIXME</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2APJE4E#wrap" rel="nofollow">Felis - L2ARC</a></li>
<li><a href="http://dpaste.com/0BRJJ73#wrap" rel="nofollow">Gabe - FreeBSD Server Install</a><br></li>
<li><a href="http://dpaste.com/05EYNJ4#wrap" rel="nofollow">FEMP Script</a></li>
<li><a href="http://dpaste.com/1CV323G#wrap" rel="nofollow">Scott - FreeNAS &amp; LAGG</a></li>
<li><a href="http://dpaste.com/3486VQZ#wrap" rel="nofollow">Marko - Backups</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week, we look forward with the latest OpenBSD release, look back with Dennis Ritchies paper on the evolution of Unix Time Sharing, have an Interview with Kris</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170411132956" rel="nofollow">OpenBSD 6.1 RELEASED</a></h3>

<ul>
<li><a href="https://marc.info/?l=openbsd-announce&m=149191716921690&w=2&#x27;" rel="nofollow">Mailing list post</a></li>
<li>We are pleased to announce the official release of OpenBSD 6.1. This is our 42nd release.</li>
<li>New/extended platforms:

<ul>
<li>New arm64 platform, using clang(1) as the base system compiler.</li>
<li>The loongson platform now supports systems with Loongson 3A CPU and RS780E chipset.</li>
<li>The following platforms were retired: armish, sparc, zaurus</li>
</ul></li>
<li>New vmm(4)/ vmd(8)</li>
<li>IEEE 802.11 wireless stack improvements</li>
<li>Generic network stack improvements</li>
<li>Installer improvements</li>
<li>Routing daemons and other userland network improvements</li>
<li>Security improvements</li>
<li>dhclient(8)/ dhcpd(8)/ dhcrelay(8) improvements</li>
<li>Assorted improvements</li>
<li>OpenSMTPD 6.0.0</li>
<li>OpenSSH 7.4</li>
<li>LibreSSL 2.5.3</li>
<li>mandoc 1.14.1
***</li>
</ul>

<h3><a href="http://vegardno.blogspot.ca/2017/03/fuzzing-openssh-daemon-using-afl.html" rel="nofollow">Fuzz Testing OpenSSH</a></h3>

<ul>
<li>Vegard Nossum writes a blog post explaining how to fuzz OpenSSH using AFL</li>
<li>It starts by compiling AFL and SSH with LLVM to get extra instrumentation to make the fuzzing process better, and faster</li>
<li>Sandboxing, PIE, and other features are disabled to increase debuggability, and to try to make breaking SSH easier</li>
<li>Privsep is also disabled, because when AFL does make SSH crash, the child process crashing causes the parent process to exit normally, and AFL then doesnt realize that a crash has happened. A one-line patch disables the privsep feature for the purposes of testing</li>
<li>A few other features are disabled to make testing easier (disabling replay attack protection allows the same inputs to be reused many times), and faster:

<ul>
<li>the local arc4random_buf() is patched to return a buffer of zeros</li>
<li>disabling CRC checks</li>
<li>disabling MAC checks</li>
<li>disabling encryption (allow the NULL cipher for everything)</li>
<li>add a call to __AFL_INIT(), to enable deferred forkserver mode</li>
<li>disabling closefrom()</li>
<li>Skipping expensive DH/curve and key derivation operations</li>
</ul></li>
<li>Then, you can finally get around to writing some test cases</li>
<li>The steps are all described in detail</li>
<li>In one day of testing, the author found a few NULL dereferences that have since been fixed.</li>
<li>Maybe you can think of some other code paths through SSH that should be tested, or want to test another daemon
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170409123528" rel="nofollow">Getting OpenBSD running on Raspberry Pi 3</a></h3>

<blockquote>
<p>Ian Darwin writes in about his work deploying the arm64 platform and the Raspberry Pi 3<br>
So I have this empty white birdhouse-like thing in the yard, open at the front. It was intended to house the wireless remote temperature sensor from a low-cost weather station, which had previously been mounted on a dark-colored wall of the house [...]. But when I put the sensor into the birdhouse, the signal is too weak for the weather station to receive it (the mounting post was put in place by a previous owner of our property, and is set deeply in concrete). So the next plan was to pop in a tiny OpenBSD computer with a uthum(4) temperature sensor and stream the temperature over WiFi.<br>
The Raspberry Pi computers are interesting in their own way: intending to bring low-cost computing to everybody, they take shortcuts and omit things that you&#39;d expect on a laptop or desktop. They aren&#39;t too bright on their own: there&#39;s very little smarts in the board compared to the &quot;BIOS&quot; and later firmwares on conventional systems. Some of the &quot;smarts&quot; are only available as binary files. This was part of the reason that our favorite OS never came to the Pi Party for the original rpi, and didn&#39;t quite arrive for the rpi2. With the rpi3, though, there is enough availability that our devs were able to make it boot. Some limitations remain, though: if you want to build your own full release, you have to install the dedicated raspberrypi-firmware package from the ports tree. And, the boot disks have to have several extra files on them - this is set up on the install sets, but you should be careful not to mess with these extra files until you know what you&#39;re doing!</p>

<p>But wait! Before you read on, please note that, as of April 1, 2017, this platform boots up but is not yet ready for prime time:</p>
</blockquote>

<ul>
<li>there&#39;s no driver for SD/MMC but that&#39;s the only thing the hardware can level-0 boot from, so you need both the uSD card and a USB disk, at least while getting started;</li>
<li>there is no support for the built-in WiFi (a Broadcom BCM43438 SDIO 802.11), so you have to use wired Ethernet or a USB WiFi dongle (for my project an old MSI that shows up as ural(4) seems to work fine);</li>
<li>the HDMI driver isn&#39;t used by the kernel (if a monitor is plugged in uBoot will display its messages there), so you need to set up cu with a 3V serial cable, at least for initial setup.</li>
<li>the ports tree isn&#39;t ready to cope with the base compiler being clang yet, so packages are &quot;a thing of the future&quot;</li>
</ul>

<blockquote>
<p>But wait - there&#39;s more! The &quot;USB disk&quot; can be a USB thumb drive, though they&#39;re generally slower than a &quot;real&quot; disk. My first forays used a Kingston DTSE9, the hardy little steel-cased version of the popular DataTraveler line. I was able to do the install, and boot it, once (when I captured the dmesg output shown below). After that, it failed - the boot process hung with the ever-unpopular &quot;scanning usb for storage devices...&quot; message. I tried the whole thing again with a second DTSE9, and with a 32GB plastic-cased DataTraveler. Same results. After considerable wasted time, I found a post on RPI&#39;s own site which dates back to the early days of the PI 3, in which they admit that they took shortcuts in developing the firmware, and it just can&#39;t be made to work with the Kingston DataTraveler! Not having any of the &quot;approved&quot; devices, and not living around the corner from a computer store, I switched to a Sabrent USB dock with a 320GB Western Digital disk, and it&#39;s been rock solid. Too big and energy-hungry for the final project, but enough to show that the rpi3 can be solid with the right (solid-state) disk. And fast enough to build a few simple ports - though a lot will not build yet. I then found and installed OpenBSD onto a PNY brand thumb drive and found it solid - in fact I populated it by dding from one of the DataTraveller drives, so theyre not at fault.</p>
</blockquote>

<ul>
<li>Check out the full article for detailed setup instructions
***</li>
</ul>

<h3><a href="http://www.read.seas.harvard.edu/%7Ekohler/class/aosref/ritchie84evolution.pdf" rel="nofollow">Dennis M. Ritchies Paper: The Evolution of the Unix Time Sharing System</a></h3>

<ul>
<li>From the abstract:</li>
</ul>

<blockquote>
<p>This paper presents a brief history of the early development of the Unix operating system. It concentrates on the evolution of the file system, the process-control mechanism, and the idea of pipelined commands. Some attention is paid to social conditions during the development of the system. <br>
During the past few years, the Unix operating system has come into wide use, so wide that its very name has become a trademark of Bell Laboratories. Its important characteristics have become known to many people. It has suffered much rewriting and tinkering since the first publication describing it in 1974 [1], but few fundamental changes. However, Unix was born in 1969 not 1974, and the account of its development makes a little-known and perhaps instructive story. This paper presents a technical and social history of the evolution of the system. </p>
</blockquote>

<ul>
<li>High level document structure:</li>
</ul>

<blockquote>
<p>Origins<br>
The PDP-7 Unix file system <br>
Process control<br>
IO Redirection<br>
The advent of the PDP-11<br>
The first PDP-11 system<br>
Pipes<br>
High-level languages<br>
Conclusion</p>

<p>One of the comforting things about old memories is their tendency to take on a rosy glow. The programming environment provided by the early versions of Unix seems, when described here, to be extremely harsh and primitive. I am sure that if forced back to the PDP-7 I would find it intolerably limiting and lacking in conveniences. Nevertheless, it did not seem so at the time; the memory fixes on what was good and what lasted, and on the joy of helping to create the improvements that made life better. In ten years, I hope we can look back with the same mixed impression of progress combined with continuity. </p>

<hr>
</blockquote>

<h2>Interview - Kris Moore - <a href="mailto:kris@trueos.org" rel="nofollow">kris@trueos.org</a> | <a href="https://twitter.com/pcbsdkris" rel="nofollow">@pcbsdkris</a></h2>

<ul>
<li>Director of Engineering at iXSystems</li>
<li>FreeNAS </li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=316894" rel="nofollow">Compressed zfs send / receive now in FreeBSDs vendor area</a></h3>

<ul>
<li>Andriy Gapon committed a whole lot of ZFS updates to FreeBSDs vendor area</li>
<li>This feature takes advantage of the new compressed ARC feature, which means blocks that are compressed on disk, remain compressed in ZFS RAM cache, to use the compressed blocks when using ZFS replication.</li>
<li>Previously, blocks were uncompressed, sent (usually over the network), then recompressed on the other side.</li>
<li>This is rather wasteful, and can make the process slower, not just because of the CPU time wasted decompressing/recompressing the data, but because it means more data has to be sent over the network.</li>
<li>This caused many users to end up doing: zfs send | xz -T0 | ssh unxz | zfs recv, or similar, to compress the data before sending it over the network.</li>
<li>With this new feature, zfs send with the new -c flag, will transmit the already compressed blocks instead.</li>
<li>This change also adds longopts versions of all of the zfs send flags, making them easier to understand when written in shell scripts.</li>
<li>A lot of fixes, man page updates, etc. from upstream OpenZFS </li>
<li>Thanks to everyone who worked on these fixes and features!</li>
<li>Well announce when these have been committed to head for testing
***</li>
</ul>

<h3><a href="https://mysteriouscode.io/blog/granting-privileges-using-mac-framework/" rel="nofollow">Granting privileges using the FreeBSD MAC framework </a></h3>

<ul>
<li>The MAC (Mandatory Access Control) framework allows finer grained permissions than the standard UNIX permissions that exist in the base system</li>
</ul>

<blockquote>
<p>FreeBSDs kernel provides quite sophisticated privilege model that extends the traditional UNIX user-and-group one. Here Ill show how to leverage it to grant access to specific privileges to group of non-root users.<br>
mac(9) allows creating pluggable modules with policies that can extend existing base system security definitions. struct mac_policy_ops consist of many entry points that we can use to amend the behaviour.<br>
This time, I wanted to grant a privilege to change realtime priority to a selected group. While Linux kernel lets you specify a named group, FreeBSD doesnt have such ability, hence I created this very simple policy.<br>
The privilege check can be extended using two user supplied functions: priv_check and priv_grant. The first one can be used to further restrict existing privileges, i.e. you can disallow some specific priv to be used in jails, etc. The second one is used to explicitly grant extra privileges not available for the target in base configuration.<br>
The core of the mac_rtprio module is dead simple. I defined sysctl tree for two oids: enable (on/off switch for the policy) and gid (the GID target has to be member of), then I specified our custom version of mpo_priv_grant called rtprio_priv_grant. Body of my granting function is even simpler. If the policy is disabled or the privilege that is being checked is not PRIV_SCHED_RTPRIO, we simply skip and return EPERM. If the user is member of the designated group we return 0 thatll allow the action  target would change realtime privileges.</p>
</blockquote>

<ul>
<li>Another useful thing the MAC framework can be used to grant to non-root users: PortACL: The ability to bind to TCP/UDP ports less than 1024, which is usually restricted to root.</li>
<li>Some other uses for the MAC framework are discussed in <a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mac.html" rel="nofollow">The FreeBSD Handbook</a></li>
<li>However, there are lots more, and we would really like to see more tutorials and documentation on using MAC to make more secure servers, but allowing the few specific things that normally require root access.
***</li>
</ul>

<h3><a href="http://ftp.arl.army.mil/%7Emike/ping.html" rel="nofollow">The Story of the PING Program</a></h3>

<ul>
<li>This is from the homepage of Mike Muuss:</li>
</ul>

<blockquote>
<p>Yes, it&#39;s true! I&#39;m the author of ping for UNIX. Ping is a little thousand-line hack that I wrote in an evening which practically everyone seems to know about. :-)<br>
I named it after the sound that a sonar makes, inspired by the whole principle of cho-location. In college I&#39;d done a lot of modeling of sonar and radar systems, so the &quot;Cyberspace&quot; analogy seemed very apt. It&#39;s exactly the same paradigm applied to a new problem domain: ping uses timed IP/ICMP ECHO_REQUEST and ECHO_REPLY packets to probe the &quot;distance&quot; to the target machine.<br>
My original impetus for writing PING for 4.2a BSD UNIX came from an offhand remark in July 1983 by Dr. Dave Mills while we were attending a DARPA meeting in Norway, in which he described some work that he had done on his &quot;Fuzzball&quot; LSI-11 systems to measure path latency using timed ICMP Echo packets.<br>
In December of 1983 I encountered some odd behavior of the IP network at BRL. Recalling Dr. Mills&#39; comments, I quickly coded up the PING program, which revolved around opening an ICMP style SOCK_RAW AF_INET Berkeley-style socket(). The code compiled just fine, but it didn&#39;t work -- there was no kernel support for raw ICMP sockets! Incensed, I coded up the kernel support and had everything working well before sunrise. Not surprisingly, Chuck Kennedy (aka &quot;Kermit&quot;) had found and fixed the network hardware before I was able to launch my very first &quot;ping&quot; packet. But I&#39;ve used it a few times since then. <em>grin</em> If I&#39;d known then that it would be my most famous accomplishment in life, I might have worked on it another day or two and added some more options.<br>
The folks at Berkeley eagerly took back my kernel modifications and the PING source code, and it&#39;s been a standard part of Berkeley UNIX ever since. Since it&#39;s free, it has been ported to many systems since then, including Microsoft Windows95 and WindowsNT.<br>
In 1993, ten years after I wrote PING, the USENIX association presented me with a handsome scroll, pronouncing me a Joint recipient of The USENIX Association 1993 Lifetime Achievement Award presented to the Computer Systems Research Group, University of California at Berkeley 1979-1993. ``Presented to honor profound intellectual achievement and unparalleled service to our Community. At the behest of CSRG principals we hereby recognize the following individuals and organizations as CSRG participants, contributors and supporters.&#39;&#39; Wow!<br>
The best ping story I&#39;ve ever heard was told to me at a USENIX conference, where a network administrator with an intermittent Ethernet had linked the ping program to his vocoder program, in essence writing:<br>
ping goodhost | sed -e &#39;s/.*/ping/&#39; | vocoder<br>
He wired the vocoder&#39;s output into his office stereo and turned up the volume as loud as he could stand. The computer sat there shouting &quot;Ping, ping, ping...&quot; once a second, and he wandered through the building wiggling Ethernet connectors until the sound stopped. And that&#39;s how he found the intermittent failure.</p>

<hr>
</blockquote>

<h3><a href="http://glasz.org/sheeplog/2017/02/freebsd-usrlocalliblibpkgso3-undefined-symbol-utimensat.html" rel="nofollow">FreeBSD: /usr/local/lib/libpkg.so.3: Undefined symbol &quot;utimensat&quot;</a></h3>

<blockquote>
<p>The internet will tell you that, of course, 10.2 is EOL, that packages are being built for 10.3 by now and to better upgrade to the latest version of FreeBSD. While all of this is true and running the latest versions is generally good advise, in most cases it is unfeasible to do an entire OS upgrade just to be able to install a package.</p>
</blockquote>

<ul>
<li>Points out the ABI variable being used in /usr/local/etc/pkg/repos/FreeBSD.conf</li>
</ul>

<blockquote>
<p>Now, if you have 10.2 installed and 10.3 is the current latest FreeBSD version, this url will point to packages built for 10.3 resulting in the problem that, when running pkg upgrade pkg itll go ahead and install the latest version of pkg build for 10.3 onto your 10.2 system. Yikes! FreeBSD 10.3 and pkgng broke the ABI by introducing new symbols, like utimensat.</p>
</blockquote>

<ul>
<li>The solution:</li>
</ul>

<blockquote>
<p>Have a look at the actual repo url <a href="http://pkg.FreeBSD.org/FreeBSD:10:amd64%C2%85" rel="nofollow">http://pkg.FreeBSD.org/FreeBSD:10:amd64</a> theres repos for each release! Instead of going through the tedious process of upgrading FreeBSD you just need to Use a repo url that fits your FreeBSD release:</p>

<p>Update the package cache: pkg update<br>
Downgrade pkgng (in case you accidentally upgraded it already): pkg delete -f pkg<br>
pkg install -y pkg<br>
Install your package<br>
There you go. Dont fret. But upgrade your OS soon ;)</p>

<hr>
</blockquote>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://imil.net/blog/2017/01/22/collectd_NetBSD_temperature/" rel="nofollow">CPU temperature collectd report on NetBSD</a></li>
<li><a href="https://www.servethehome.com/booting-freebsd-11-nvme-zfs-amd-ryzen/" rel="nofollow">Booting FreeBSD 11 with NVMe and ZFS on AMD Ryzen</a></li>
<li><a href="https://torbsd.github.io/blog.html#busy-bbb" rel="nofollow">BeagleBone Black Tor relay</a></li>
<li><a href="https://reviews.freebsd.org/rS317094" rel="nofollow">FreeBSD - Disable in-tree GDB by default on x86, mips, and powerpc</a></li>
<li><a href="https://www.meetup.com/CharmBUG/events/238218742/" rel="nofollow">CharmBUG April Meetup</a></li>
<li><a href="https://www.snellman.net/blog/archive/2017-04-17-xxx-fixme/" rel="nofollow">The origins of XXX as FIXME</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://dpaste.com/2APJE4E#wrap" rel="nofollow">Felis - L2ARC</a></li>
<li><a href="http://dpaste.com/0BRJJ73#wrap" rel="nofollow">Gabe - FreeBSD Server Install</a><br></li>
<li><a href="http://dpaste.com/05EYNJ4#wrap" rel="nofollow">FEMP Script</a></li>
<li><a href="http://dpaste.com/1CV323G#wrap" rel="nofollow">Scott - FreeNAS &amp; LAGG</a></li>
<li><a href="http://dpaste.com/3486VQZ#wrap" rel="nofollow">Marko - Backups</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>189: Codified Summer</title>
  <link>https://www.bsdnow.tv/189</link>
  <guid isPermaLink="false">f479797b-02a4-4e79-b3f3-d11d954d578a</guid>
  <pubDate>Wed, 12 Apr 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f479797b-02a4-4e79-b3f3-d11d954d578a.mp3" length="92041828" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show we interview Wendell from Level1Techs, cover Google Summer of Code on the different BSD projects, cover YubiKey usage, dive into how NICs work &amp;</itunes:subtitle>
  <itunes:duration>2:33:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show we interview Wendell from Level1Techs, cover Google Summer of Code on the different BSD projects, cover YubiKey usage, dive into how NICs work &amp;amp;
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Google summer of code for BSDs
FreeBSD (https://www.freebsd.org/projects/summerofcode.html)
FreeBSD's existing list of GSoC Ideas for potential students (https://wiki.freebsd.org/SummerOfCodeIdeas) 
FreeBSD/Xen: import the grant-table bus_dma(9) handlers from OpenBSD
Add support for usbdump file-format to wireshark and vusb-analyzer
Write a new boot environment manager
Basic smoke test of all base utilities
Port OpenBSD's pf testing framework and tests
Userspace Address Space Annotation
zstandard integration in libstand
Replace mergesort implementation
Test Kload (kexec for FreeBSD)
Kernel fuzzing suite
Integrate MFSBSD into the release building tools
NVMe controller emulation for bhyve
Verification of bhyve's instruction emulation
VGA emulation improvements for bhyve
audit framework test suite
Add more FreeBSD testing to Xen osstest
Lua in bootloader
POSIX compliance testing framework
coreclr: add Microsoft's coreclr and corefx to the Ports tree.
NetBSD (https://wiki.netbsd.org/projects/gsoc/)
Kernel-level projects
Medium
ISDN NT support and Asterisk integration 
LED/LCD Generic API 
NetBSD/azure -- Bringing NetBSD to Microsoft Azure 
OpenCrypto swcrypto(4) enhancements 
Scalable entropy gathering 
Userland PCI drivers 
Hard
Real asynchronous I/O 
Parallelize page queues 
Tickless NetBSD with high-resolution timers 
 Userland projects
Easy
Inetd enhancements -- Add new features to inetd 
Curses library automated testing 
Medium
Make Anita support additional virtual machine systems 
Create an SQL backend and statistics/query page for ATF test results 
Light weight precision user level time reading 
Query optimizer for find(1) 
Port launchd 
Secure-PLT - supporting RELRO binaries 
Sysinst alternative interface 
Hard
Verification tool for NetBSD32 
pkgsrc projects
Easy
Version control config files 
Spawn support in pkgsrc tools 
Authentication server meta-package 
Medium
pkgin improvements 
Unify standard installation tasks 
Hard
Add dependency information to binary packages 
Tool to find dependencies precisely 
LLVM (http://llvm.org/OpenProjects.html#gsoc17)
Fuzzing the Bitcode reader 
Description of the project: The optimizer is 25-30% slower when debug info are enabled, it'd be nice to track all the places where we don't do a good job about ignoring them!
Extend clang AST to provide information for the type as written in template instantiations.
Description of the project: When instantiating a template, the template arguments are canonicalized before being substituted into the template pattern. Clang does not preserve type sugar when subsequently accessing members of the instantiation. Clang should "re-sugar" the type when performing member access on a class template specialization, based on the type sugar of the accessed specialization. 
Shell auto-completion support for clang.
Bash and other shells support typing a partial command and then automatically completing it for the user (or at least providing suggestions how to complete) when pressing the tab key. This is usually only supported for popular programs such as package managers (e.g. pressing tab after typing "apt-get install late" queries the APT package database and lists all packages that start with "late"). As of now clang's frontend isn't supported by any common shell. 
Clang-based C/C++ diff tool.
Description of the project: Every developer has to interact with diff tools daily. The algorithms are usually based on detecting "longest common subsequences", which is agnostic to the file type content. A tool that would understand the structure of the code may provide a better diff experience by being robust against, for example, clang-format changes.
Find dereference of pointers.
Description of the project: Find dereference of pointer before checking for nullptr.
Warn if virtual calls are made from constructors or destructors.
Description of the project: Implement a path-sensitive checker that warns if virtual calls are made from constructors and destructors, which is not valid in case of pure virtual calls and could be a sign of user error in non-pure calls. 
Improve Code Layout
Description of the project: The goal for the project is trying to improve the layout/performances of the generated executable. The primary object format considered for the project is ELF but this can be extended to other object formats. The project will touch both LLVM and lld.
Why Isn’t OpenBSD in Google Summer of Code 2017? (http://marc.info/?l=openbsd-misc&amp;amp;m=149119308705465&amp;amp;w=2)
Hacker News Discussion Thread (https://news.ycombinator.com/item?id=14020814)
Turtles on the Wire: Understanding How the OS Uses the Modern NIC (http://dtrace.org/blogs/rm/2016/09/15/turtles-on-the-wire-understanding-how-the-os-uses-the-modern-nic/)
The Simple NIC
MAC Address Filters and Promiscuous Mode
Problem: The Single Busy CPU
A Swing and a Miss
Nine Rings for Packets Doomed to be Hashed
Problem: Density, Density, Density
A Brief Aside: The Virtual NIC
Always Promiscuous?
The Classification Challenge
Problem: CPUs are too ‘slow’
Problem: The Interrupts are Coming in too Hot
Solution One: Do Less Work
Solution Two: Turn Off Interrupts
Recapping
Future Directions and More Reading
Make Dragonfly BSD great again! (http://akat1.pl/?id=3)
Recently I spent some time reading Dragonfly BSD code. While doing so I spotted a vulnerability in the sysvsem subsystem that let user to point to any piece of memory and write data through it (including the kernel space). This can be turned into execution of arbitrary code in the kernel context and by exploiting this, we're gonna make Dragonfly BSD great again!
Dragonfly BSD is a BSD system which originally comes from the FreeBSD project. In 2003 Matthew Dillon forked code from the 4.x branch of the FreeBSD and started a new flavour.
I thought of Dragonfly BSD as just another fork, but during EuroBSDCon 2015 I accidentally saw the talk about graphical stack in the Dragonfly BSD. I confused rooms, but it was too late to escape as I was sitting in the middle of a row, and the exit seemed light years away from me. :-) Anyway, this talk was a sign to me that it's not just a niche of a niche of a niche of a niche operating system. I recommend spending a few minutes of your precious time to check out the HAMMER file system, Dragonfly's approach to MP, process snapshots and other cool features that it offers. Wikipedia article is a good starter
With the exploit, they are able to change the name of the operating system back to FreeBSD, and escalate from an unprivileged user to root.
The Bug itself is located in the semctl(2) system call implementation. bcopy(3) in line 385 copies semid_ds structure to memory pointed by arg-&amp;gt;buf, this pointer is fully controlled by the user, as it's one of the syscall's arguments. So the bad thing here is that we can copy things to arbitrary address, but we have not idea what we copy yet. This code was introduced by wrongly merging code from the FreeBSD project, bah, bug happens.
Using this access, the example code shows how to overwrite the function pointers in the kernel used for the open() syscall, and how to overwrite the ostype global, changing the name of the operating system.
In the second example, the reference to the credentials of the user trying to open a file are used to overwrite that data, making the user root.
The bug was fixed in uber fast manner (within few hours!) by Matthew Dillon, version 4.6.1 released shortly after that seems to be safe. In case you care, you know what to do!
Thanks to Mateusz Kocielski for the detailed post, and finding the bug
***
Interview - Wendell - wendell@level1techs.com (mailto:wendell@level1techs.com) / @tekwendell (https://twitter.com/tekwendell)
Host of Level1Techs website, podcast and YouTube channel
News Roundup
Using yubikeys everywhere (http://www.tedunangst.com/flak/post/using-yubikeys-everywhere)
Ted Unangst is back, with an interesting post about YUBI Keys
Everybody is getting real excited about yubikeys recently, so I figured I should get excited, too. I have so far resisted two factor authorizing everything, but this seemed like another fun experiment. There’s a lot written about yubikeys and how you should use one, but nothing I’ve read answered a few of the specific questions I had
To begin with, I ordered two yubikeys. One regular sized 4 and one nano. I wanted to play with different form factors to see which is better for various uses, and I wanted to test having a key and a backup key. Everybody always talks about having one yubikey. And then if you lose it, terrible things happen. Can this problem be alleviated with two keys? I’m also very curious what happens when I try to login to a service with my phone after enabling U2F.
We’ve got three computers (and operating systems) in the mix, along with a number of (mostly web) services. Wherever possible, I want to use a yubikey both to login to the computer and to authorize myself to remote services.
I started my adventure on my chromebook. Ultimate goal would be to use the yubikey for local logins. Either as a second factor, or as an alternative factor. First things first and we need to get the yubikey into the account I use to sign into the chromebook. Alas, there is apparently no way to enroll only a security key for a Google account. Every time I tried, it would ask me for my phone number. That is not what I want. Zero stars.
Giving up on protecting the chromebook itself, at least maybe I can use it to enable U2F with some other sites. U2F is currently limited to Chrome, but it sounds like everything I want. Facebook signup using U2F was pretty easy. Go to account settings, security subheading, add the device. Tap the button when it glows. Key added. Note that it’s possible to add a key without actually enabling two factor auth, in which case you can still login with only a password, but no way to login with no password and only a USB key. Logged out to confirm it would check the key, and everything looked good, so I killed all my other active sessions. Now for the phone test. Not quite as smooth. Tried to login, the Facebook app then tells me it has sent me an SMS and to enter the code in the box. But I don’t have a phone number attached. I’m not getting an SMS code.
Meanwhile, on my laptop, I have a new notification about a login attempt. Follow the prompts to confirm it’s me and permit the login. This doesn’t have any effect on the phone, however. I have to tap back, return to the login screen, and enter my password again. This time the login succeeds. So everything works, but there are still some rough patches in the flow. Ideally, the phone would more accurately tell me to visit the desktop site, and then automatically proceed after I approve. (The messenger app crashed after telling me my session had expired, but upon restarting it was able to borrow the Facebook app credentials and I was immediately logged back in.)
Let’s configure Dropbox next. Dropbox won’t let you add a security key to an account until after you’ve already set up some other mobile authenticator. I already had the Duo app on my phone, so I picked that, and after a short QR scan, I’m ready to add the yubikey. So the key works to access Dropbox via Chrome. Accessing Dropbox via my phone or Firefox requires entering a six digit code. No way to use a yubikey in a three legged configuration
I don’t use Github, but I know they support two factors, so let’s try them next. Very similar to Dropbox. In order to set up a key, I must first set up an authenticator app. This time I went with Yubico’s own desktop authenticator. Instead of scanning the QR code, type in some giant number (on my Windows laptop), and it spits out an endless series of six digit numbers, but only while the yubikey is inserted. I guess this is kind of what I want, although a three pound yubikey is kind of unwieldy.
As part of my experiment, I noticed that Dropbox verifies passwords before even looking at the second auth. I have a feeling that they should be checked at the same time. No sense allowing my password guessing attack to proceed while I plot how to steal someone’s yubikey. In a sense, the yubikey should serve as a salt, preventing me from mounting such an attack until I have it, thus creating a race where the victim notices the key is gone and revokes access before I learn the password. If I know the password, the instant I grab the key I get access. Along similar lines, I was able to complete a password reset without entering any kind of secondary code.
Having my phone turn into a second factor is a big part of what I’m looking to avoid with the yubikey. I’d like to be able to take my phone with me, logged into some sites but not all, and unable to login to the rest. All these sites that require using my phone as mobile authenticator are making that difficult. I bought the yubikey because it was cheaper than buying another phone! Using the Yubico desktop authenticator seems the best way around that.
The article also provides instructions for configuring the Yubikey on OpenBSD
A few notes about OTP. As mentioned, the secret key is the real password. It’s stored on whatever laptop or server you login to. Meaning any of those machines can take the key and use it to login to any other machine. If you use the same yubikey to login to both your laptop and a remote server, your stolen laptop can trivially be used to login to the server without the key. Be mindful of that when setting up multiple machines. Also, the OTP counter isn’t synced between machines in this setup, which allows limited replay attacks.
Ted didn’t switch his SSH keys to the Yubikey, because it doesn’t support ED25519, and he just finished rotating all of his keys and doesn’t want to do it again.
I did most of my experimenting with the larger yubikey, since it was easier to move between machines. For operations involving logging into a web site, however, I’d prefer the nano. It’s very small, even smaller than the tiniest wireless mouse transcievers I’ve seen. So small, in fact, I had trouble removing it because I couldn’t find anything small enough to fit through the tiny loop. But probably a good thing. Most other micro USB gadgets stick out just enough to snag when pushing a laptop into a bag. Not the nano. You lose a port, but there’s really no reason to ever take it out. Just leave it in, and then tap it whenever you login to the tubes. It would not be a good choice for authenticating to the local machine, however. The larger device, sized to fit on a keychain, is much better for that. 
It is possible to use two keys as backups. Facebook and Dropbox allow adding two U2F keys. This is perhaps a little tiresome if there’s lots of sites, as I see no way to clone a key. You have to login to every service. For challenge response and OTP, however, the personalization tool makes it easy to generate lots of yubikeys with the same secrets. On the other hand, a single device supports an infinite number of U2F sites. The programmable interfaces like OTP are limited to only two slots, and the first is already used by the factory OTP setup.
What happened to my vlan (http://www.grenadille.net/post/2017/02/13/What-happened-to-my-vlan)
A long term goal of the effort I'm driving to unlock OpenBSD's Network Stack is obviously to increase performances. So I'd understand that you find confusing when some of our changes introduce performance regressions.
It is just really hard to do incremental changes without introducing temporary regressions. But as much as security is a process, improving performance is also a process. Recently markus@ told me that vlan(4) performances dropped in last releases. He had some ideas why but he couldn't provide evidences. So what really happened?
Hrvoje Popovski was kind enough to help me with some tests. He first confirmed that on his Xeon box (E5-2643 v2 @ 3.50GHz), forwarding performances without pf(4) dropped from 1.42Mpps to 880Kpps when using vlan(4) on both interfaces.
Together vlaninput() and vlanstart() represent 25% of the time CPU1 spends processing packets. This is not exactly between 33% and 50% but it is close enough. The assumption we made earlier is certainly too simple. If we compare the amount of work done in process context, represented by ifinputprocess() we clearly see that half of the CPU time is not spent in etherinput().
I'm not sure how this is related to the measured performance drop. It is actually hard to tell since packets are currently being processed in 3 different contexts. One of the arguments mikeb@ raised when we discussed moving everything in a single context, is that it is simpler to analyse and hopefully make it scale.
With some measurements, a couple of nice pictures, a bit of analysis and some educated guesses we are now in measure of saying that the performances impact observed with vlan(4) is certainly due to the pseudo-driver itself. A decrease of 30% to 50% is not what I would expect from such pseudo-driver.
I originally heard that the reason for this regression was the use of SRP but by looking at the profiling data it seems to me that the queuing API is the problem. In the graph above the CPU time spent in ifinput() and ifenqueue() from vlan(4) is impressive. Remember, in the case of vlan(4) these operations are done per packet!
When ifinput() has been introduced the queuing API did not exist and putting/taking a single packet on/from an interface queue was cheap. Now it requires a mutex per operation, which in the case of packets received and sent on vlan(4) means grabbing three mutexes per packets.
I still can't say if my analysis is correct or not, but at least it could explain the decrease observed by Hrvoje when testing multiple vlan(4) configurations. vlaninput() takes one mutex per packet, so it decreases the number of forwarded packets by ~100Kpps on this machine, while vlanstart() taking two mutexes decreases it by ~200Kpps.
An interesting analysis of the routing performance regression on OpenBSD
I have asked Olivier Cochard-Labbe about doing a similar comparison of routing performance on FreeBSD when a vlan pseudo interface is added to the forwarding path
***
NetBSD: the first BSD introducing a modern process plugin framework in LLDB (https://blog.netbsd.org/tnf/entry/netbsd_the_first_bsd_introducing)
Clean up in ptrace(2) ATF tests
We have created some maintanance burden for the current ptrace(2) regression tests. The main issues with them is code duplication and the splitting between generic (Machine Independent) and port-specific (Machine Dependent) test files. I've eliminated some of the ballast and merged tests into the appropriate directory tests/lib/libc/sys/. The old location (tests/kernel) was a violation of the tests/README recommendation
PTRACE_FORK on !x86 ports
Along with the motivation from Martin Husemann we have investigated the issue with PTRACE_FORK ATF regression tests. It was discovered that these tests aren't functional on evbarm, alpha, shark, sparc and sparc64 and likely on other non-x86 ports. We have discovered that there is a missing SIGTRAP emitted from the child, during the fork(2) handshake. The proper order of operations is as follows:
parent emits SIGTRAP with sicode=TRAPCHLD and pesetevent=pid of forkee
child emits SIGTRAP with sicode=TRAPCHLD and pesetevent=pid of forker
Only the x86 ports were emitting the second SIGTRAP signal.
PTSYSCALL and PTSYSCALLEMU
With the addition of PTSYSCALLEMU we can implement a virtual kernel syscall monitor. It means that we can fake syscalls within a debugger. In order to achieve this feature, we need to use the PTSYSCALL operation, catch SIGTRAP with sicode=TRAPSCE (syscall entry), call PTSYSCALLEMU and perform an emulated userspace syscall that would have been done by the kernel, followed by calling another PTSYSCALL with sicode=TRAPSCX.
What has been done in LLDB
A lot of work has been done with the goal to get breakpoints functional. This target penetrated bugs in the existing local patches and unveiled missing features required to be added. My initial test was tracing a dummy hello-world application in C. I have sniffed the GDB Remote Protocol packets and compared them between Linux and NetBSD. This helped to streamline both versions and bring the NetBSD support to the required Linux level.
Plan for the next milestone
I've listed the following goals for the next milestone.
watchpoints support
floating point registers support
enhance core(5) and make it work for multiple threads
introduce PTSETSTEP and PTCLEARSTEP in ptrace(2)
support threads in the NetBSD Process Plugin
research F_GETPATH in fcntl(2)
Beyond the next milestone is x86 32-bit support.
LibreSSL 2.5.2 released (https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.2-relnotes.txt)
Added the recallocarray(3) memory allocation function, and converted various places in the library to use it, such as CBB and BUFMEMgrow. recallocarray(3) is similar to reallocarray. Newly allocated memory is cleared similar to calloc(3). Memory that becomes unallocated while shrinking or moving existing allocations is explicitly discarded by unmapping or clearing to 0.
Added new root CAs from SECOM Trust Systems / Security Communication of Japan.
Added EVP interface for MD5+SHA1 hashes.
Fixed DTLS client failures when the server sends a certificate request.
Correct handling of padding when upgrading an SSLv2 challenge into an SSLv3/TLS connection.
Allow protocols and ciphers to be set on a TLS config object in libtls.
Improved nc(1) TLS handshake CPU usage and server-side error reporting.
Beastie Bits
HardenedBSD Stable v46.16 released (http://hardenedbsd.org/article/op/2017-03-30/stable-release-hardenedbsd-stable-11-stable-v4616)
KnoxBUG looking for OpenBSD people in Knoxville TN area (https://www.reddit.com/r/openbsd/comments/5vggn7/knoxbug_looking_for_openbsd_people_in_knoxville/)
KnoxBUG Tuesday, April 18, 2017 - 6:00pm : Caleb Cooper: Advanced BASH Scripting](http://knoxbug.org/2017-04-18)
e2k17 Nano hackathon report from Bob Beck (http://undeadly.org/cgi?action=article&amp;amp;sid=20170405110059)
Noah Chelliah, Host of the Linux Action Show calls Linux a ‘Bad Science Project’ and ditches Linux for TrueOS](https://youtu.be/yXB85_olYhQ?t=3238)
***
Feedback/Questions
James - ZFS Mounting (http://dpaste.com/1H43JGV#wrap)
Kevin - Virtualization (http://dpaste.com/18VNAJK#wrap)
Ben - Jails (http://dpaste.com/0R7CRZ7#wrap)
Florian - ZFS and Migrating Linux userlands (http://dpaste.com/2Z1P23T#wrap)
q5sys - question for the community (http://dpaste.com/26M453F#wrap)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, Wendell, Level1Techs, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show we interview Wendell from Level1Techs, cover Google Summer of Code on the different BSD projects, cover YubiKey usage, dive into how NICs work &amp;</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>Google summer of code for BSDs</h3>

<ul>
<li><p><a href="https://www.freebsd.org/projects/summerofcode.html" rel="nofollow">FreeBSD</a></p></li>
<li><p><a href="https://wiki.freebsd.org/SummerOfCodeIdeas" rel="nofollow">FreeBSD&#39;s existing list of GSoC Ideas for potential students</a> </p>

<ul>
<li>FreeBSD/Xen: import the grant-table bus_dma(9) handlers from OpenBSD</li>
<li>Add support for usbdump file-format to wireshark and vusb-analyzer</li>
<li>Write a new boot environment manager</li>
<li>Basic smoke test of all base utilities</li>
<li>Port OpenBSD&#39;s pf testing framework and tests</li>
<li>Userspace Address Space Annotation</li>
<li>zstandard integration in libstand</li>
<li>Replace mergesort implementation</li>
<li>Test Kload (kexec for FreeBSD)</li>
<li>Kernel fuzzing suite</li>
<li>Integrate MFSBSD into the release building tools</li>
<li>NVMe controller emulation for bhyve</li>
<li>Verification of bhyve&#39;s instruction emulation</li>
<li>VGA emulation improvements for bhyve</li>
<li>audit framework test suite</li>
<li>Add more FreeBSD testing to Xen osstest</li>
<li>Lua in bootloader</li>
<li>POSIX compliance testing framework</li>
<li>coreclr: add Microsoft&#39;s coreclr and corefx to the Ports tree.</li>
</ul></li>
<li><p><a href="https://wiki.netbsd.org/projects/gsoc/" rel="nofollow">NetBSD</a></p>

<ul>
<li>Kernel-level projects</li>
<li>Medium</li>
<li>ISDN NT support and Asterisk integration </li>
<li>LED/LCD Generic API </li>
<li>NetBSD/azure -- Bringing NetBSD to Microsoft Azure </li>
<li>OpenCrypto swcrypto(4) enhancements </li>
<li>Scalable entropy gathering </li>
<li>Userland PCI drivers </li>
<li>Hard</li>
<li>Real asynchronous I/O </li>
<li>Parallelize page queues </li>
<li>Tickless NetBSD with high-resolution timers </li>
<li> Userland projects</li>
<li>Easy</li>
<li>Inetd enhancements -- Add new features to inetd </li>
<li>Curses library automated testing </li>
<li>Medium</li>
<li>Make Anita support additional virtual machine systems </li>
<li>Create an SQL backend and statistics/query page for ATF test results </li>
<li>Light weight precision user level time reading </li>
<li>Query optimizer for find(1) </li>
<li>Port launchd </li>
<li>Secure-PLT - supporting RELRO binaries </li>
<li>Sysinst alternative interface </li>
<li>Hard</li>
<li>Verification tool for NetBSD32 </li>
<li>pkgsrc projects</li>
<li>Easy</li>
<li>Version control config files </li>
<li>Spawn support in pkgsrc tools </li>
<li>Authentication server meta-package </li>
<li>Medium</li>
<li>pkgin improvements </li>
<li>Unify standard installation tasks </li>
<li>Hard</li>
<li>Add dependency information to binary packages </li>
<li>Tool to find dependencies precisely </li>
</ul></li>
<li><p><a href="http://llvm.org/OpenProjects.html#gsoc17" rel="nofollow">LLVM</a></p>

<ul>
<li>Fuzzing the Bitcode reader </li>
</ul></li>
</ul>

<blockquote>
<p>Description of the project: The optimizer is 25-30% slower when debug info are enabled, it&#39;d be nice to track all the places where we don&#39;t do a good job about ignoring them!</p>
</blockquote>

<ul>
<li>Extend clang AST to provide information for the type as written in template instantiations.</li>
</ul>

<blockquote>
<p>Description of the project: When instantiating a template, the template arguments are canonicalized before being substituted into the template pattern. Clang does not preserve type sugar when subsequently accessing members of the instantiation. Clang should &quot;re-sugar&quot; the type when performing member access on a class template specialization, based on the type sugar of the accessed specialization. </p>
</blockquote>

<ul>
<li>Shell auto-completion support for clang.</li>
</ul>

<blockquote>
<p>Bash and other shells support typing a partial command and then automatically completing it for the user (or at least providing suggestions how to complete) when pressing the tab key. This is usually only supported for popular programs such as package managers (e.g. pressing tab after typing &quot;apt-get install late&quot; queries the APT package database and lists all packages that start with &quot;late&quot;). As of now clang&#39;s frontend isn&#39;t supported by any common shell. </p>
</blockquote>

<ul>
<li>Clang-based C/C++ diff tool.</li>
</ul>

<blockquote>
<p>Description of the project: Every developer has to interact with diff tools daily. The algorithms are usually based on detecting &quot;longest common subsequences&quot;, which is agnostic to the file type content. A tool that would understand the structure of the code may provide a better diff experience by being robust against, for example, clang-format changes.</p>
</blockquote>

<ul>
<li>Find dereference of pointers.</li>
</ul>

<blockquote>
<p>Description of the project: Find dereference of pointer before checking for nullptr.</p>
</blockquote>

<ul>
<li>Warn if virtual calls are made from constructors or destructors.</li>
</ul>

<blockquote>
<p>Description of the project: Implement a path-sensitive checker that warns if virtual calls are made from constructors and destructors, which is not valid in case of pure virtual calls and could be a sign of user error in non-pure calls. </p>
</blockquote>

<ul>
<li>Improve Code Layout</li>
</ul>

<blockquote>
<p>Description of the project: The goal for the project is trying to improve the layout/performances of the generated executable. The primary object format considered for the project is ELF but this can be extended to other object formats. The project will touch both LLVM and lld.</p>
</blockquote>

<ul>
<li><p><a href="http://marc.info/?l=openbsd-misc&m=149119308705465&w=2" rel="nofollow">Why Isnt OpenBSD in Google Summer of Code 2017?</a></p></li>
<li><p><a href="https://news.ycombinator.com/item?id=14020814" rel="nofollow">Hacker News Discussion Thread</a></p>

<hr></li>
</ul>

<h3><a href="http://dtrace.org/blogs/rm/2016/09/15/turtles-on-the-wire-understanding-how-the-os-uses-the-modern-nic/" rel="nofollow">Turtles on the Wire: Understanding How the OS Uses the Modern NIC</a></h3>

<ul>
<li>The Simple NIC</li>
<li>MAC Address Filters and Promiscuous Mode</li>
<li>Problem: The Single Busy CPU</li>
<li>A Swing and a Miss</li>
<li>Nine Rings for Packets Doomed to be Hashed</li>
<li>Problem: Density, Density, Density</li>
<li>A Brief Aside: The Virtual NIC</li>
<li>Always Promiscuous?</li>
<li>The Classification Challenge</li>
<li>Problem: CPUs are too slow</li>
<li>Problem: The Interrupts are Coming in too Hot</li>
<li>Solution One: Do Less Work</li>
<li>Solution Two: Turn Off Interrupts</li>
<li>Recapping</li>
<li>Future Directions and More Reading</li>
</ul>

<hr>

<h3><a href="http://akat1.pl/?id=3" rel="nofollow">Make Dragonfly BSD great again!</a></h3>

<blockquote>
<p>Recently I spent some time reading Dragonfly BSD code. While doing so I spotted a vulnerability in the sysvsem subsystem that let user to point to any piece of memory and write data through it (including the kernel space). This can be turned into execution of arbitrary code in the kernel context and by exploiting this, we&#39;re gonna make Dragonfly BSD great again!</p>

<p>Dragonfly BSD is a BSD system which originally comes from the FreeBSD project. In 2003 Matthew Dillon forked code from the 4.x branch of the FreeBSD and started a new flavour.<br>
I thought of Dragonfly BSD as just another fork, but during EuroBSDCon 2015 I accidentally saw the talk about graphical stack in the Dragonfly BSD. I confused rooms, but it was too late to escape as I was sitting in the middle of a row, and the exit seemed light years away from me. :-) Anyway, this talk was a sign to me that it&#39;s not just a niche of a niche of a niche of a niche operating system. I recommend spending a few minutes of your precious time to check out the HAMMER file system, Dragonfly&#39;s approach to MP, process snapshots and other cool features that it offers. Wikipedia article is a good starter</p>
</blockquote>

<ul>
<li>With the exploit, they are able to change the name of the operating system back to FreeBSD, and escalate from an unprivileged user to root.</li>
</ul>

<blockquote>
<p>The Bug itself is located in the semctl(2) system call implementation. bcopy(3) in line 385 copies semid_ds structure to memory pointed by arg-&gt;buf, this pointer is fully controlled by the user, as it&#39;s one of the syscall&#39;s arguments. So the bad thing here is that we can copy things to arbitrary address, but we have not idea what we copy yet. This code was introduced by wrongly merging code from the FreeBSD project, <em>bah</em>, bug happens.</p>
</blockquote>

<ul>
<li>Using this access, the example code shows how to overwrite the function pointers in the kernel used for the open() syscall, and how to overwrite the ostype global, changing the name of the operating system.</li>
<li>In the second example, the reference to the credentials of the user trying to open a file are used to overwrite that data, making the user root.</li>
</ul>

<blockquote>
<p>The bug was fixed in uber fast manner (within few hours!) by Matthew Dillon, version 4.6.1 released shortly after that seems to be safe. In case you care, you know what to do!</p>
</blockquote>

<ul>
<li>Thanks to Mateusz Kocielski for the detailed post, and finding the bug
***</li>
</ul>

<h2>Interview - Wendell - <a href="mailto:wendell@level1techs.com" rel="nofollow">wendell@level1techs.com</a> / <a href="https://twitter.com/tekwendell" rel="nofollow">@tekwendell</a></h2>

<ul>
<li>Host of Level1Techs website, podcast and YouTube channel</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.tedunangst.com/flak/post/using-yubikeys-everywhere" rel="nofollow">Using yubikeys everywhere</a></h3>

<ul>
<li>Ted Unangst is back, with an interesting post about YUBI Keys</li>
</ul>

<blockquote>
<p>Everybody is getting real excited about yubikeys recently, so I figured I should get excited, too. I have so far resisted two factor authorizing everything, but this seemed like another fun experiment. Theres a lot written about yubikeys and how you should use one, but nothing Ive read answered a few of the specific questions I had<br>
To begin with, I ordered two yubikeys. One regular sized 4 and one nano. I wanted to play with different form factors to see which is better for various uses, and I wanted to test having a key and a backup key. Everybody always talks about having one yubikey. And then if you lose it, terrible things happen. Can this problem be alleviated with two keys? Im also very curious what happens when I try to login to a service with my phone after enabling U2F.<br>
Weve got three computers (and operating systems) in the mix, along with a number of (mostly web) services. Wherever possible, I want to use a yubikey both to login to the computer and to authorize myself to remote services.<br>
I started my adventure on my chromebook. Ultimate goal would be to use the yubikey for local logins. Either as a second factor, or as an alternative factor. First things first and we need to get the yubikey into the account I use to sign into the chromebook. Alas, there is apparently no way to enroll only a security key for a Google account. Every time I tried, it would ask me for my phone number. That is not what I want. Zero stars.<br>
Giving up on protecting the chromebook itself, at least maybe I can use it to enable U2F with some other sites. U2F is currently limited to Chrome, but it sounds like everything I want. Facebook signup using U2F was pretty easy. Go to account settings, security subheading, add the device. Tap the button when it glows. Key added. Note that its possible to add a key without actually enabling two factor auth, in which case you can still login with only a password, but no way to login with no password and only a USB key. Logged out to confirm it would check the key, and everything looked good, so I killed all my other active sessions. Now for the phone test. Not quite as smooth. Tried to login, the Facebook app then tells me it has sent me an SMS and to enter the code in the box. But I dont have a phone number attached. Im not getting an SMS code.<br>
Meanwhile, on my laptop, I have a new notification about a login attempt. Follow the prompts to confirm its me and permit the login. This doesnt have any effect on the phone, however. I have to tap back, return to the login screen, and enter my password again. This time the login succeeds. So everything works, but there are still some rough patches in the flow. Ideally, the phone would more accurately tell me to visit the desktop site, and then automatically proceed after I approve. (The messenger app crashed after telling me my session had expired, but upon restarting it was able to borrow the Facebook app credentials and I was immediately logged back in.)<br>
Lets configure Dropbox next. Dropbox wont let you add a security key to an account until after youve already set up some other mobile authenticator. I already had the Duo app on my phone, so I picked that, and after a short QR scan, Im ready to add the yubikey. So the key works to access Dropbox via Chrome. Accessing Dropbox via my phone or Firefox requires entering a six digit code. No way to use a yubikey in a three legged configuration<br>
I dont use Github, but I know they support two factors, so lets try them next. Very similar to Dropbox. In order to set up a key, I must first set up an authenticator app. This time I went with Yubicos own desktop authenticator. Instead of scanning the QR code, type in some giant number (on my Windows laptop), and it spits out an endless series of six digit numbers, but only while the yubikey is inserted. I guess this is kind of what I want, although a three pound yubikey is kind of unwieldy.<br>
As part of my experiment, I noticed that Dropbox verifies passwords before even looking at the second auth. I have a feeling that they should be checked at the same time. No sense allowing my password guessing attack to proceed while I plot how to steal someones yubikey. In a sense, the yubikey should serve as a salt, preventing me from mounting such an attack until I have it, thus creating a race where the victim notices the key is gone and revokes access before I learn the password. If I know the password, the instant I grab the key I get access. Along similar lines, I was able to complete a password reset without entering any kind of secondary code.<br>
Having my phone turn into a second factor is a big part of what Im looking to avoid with the yubikey. Id like to be able to take my phone with me, logged into some sites but not all, and unable to login to the rest. All these sites that require using my phone as mobile authenticator are making that difficult. I bought the yubikey because it was cheaper than buying another phone! Using the Yubico desktop authenticator seems the best way around that.</p>
</blockquote>

<ul>
<li>The article also provides instructions for configuring the Yubikey on OpenBSD</li>
</ul>

<blockquote>
<p>A few notes about OTP. As mentioned, the secret key is the real password. Its stored on whatever laptop or server you login to. Meaning any of those machines can take the key and use it to login to any other machine. If you use the same yubikey to login to both your laptop and a remote server, your stolen laptop can trivially be used to login to the server without the key. Be mindful of that when setting up multiple machines. Also, the OTP counter isnt synced between machines in this setup, which allows limited replay attacks.</p>
</blockquote>

<ul>
<li>Ted didnt switch his SSH keys to the Yubikey, because it doesnt support ED25519, and he just finished rotating all of his keys and doesnt want to do it again.</li>
</ul>

<blockquote>
<p>I did most of my experimenting with the larger yubikey, since it was easier to move between machines. For operations involving logging into a web site, however, Id prefer the nano. Its very small, even smaller than the tiniest wireless mouse transcievers Ive seen. So small, in fact, I had trouble removing it because I couldnt find anything small enough to fit through the tiny loop. But probably a good thing. Most other micro USB gadgets stick out just enough to snag when pushing a laptop into a bag. Not the nano. You lose a port, but theres really no reason to ever take it out. Just leave it in, and then tap it whenever you login to the tubes. It would not be a good choice for authenticating to the local machine, however. The larger device, sized to fit on a keychain, is much better for that. <br>
It is possible to use two keys as backups. Facebook and Dropbox allow adding two U2F keys. This is perhaps a little tiresome if theres lots of sites, as I see no way to clone a key. You have to login to every service. For challenge response and OTP, however, the personalization tool makes it easy to generate lots of yubikeys with the same secrets. On the other hand, a single device supports an infinite number of U2F sites. The programmable interfaces like OTP are limited to only two slots, and the first is already used by the factory OTP setup.</p>

<hr>
</blockquote>

<h3><a href="http://www.grenadille.net/post/2017/02/13/What-happened-to-my-vlan" rel="nofollow">What happened to my vlan</a></h3>

<blockquote>
<p>A long term goal of the effort I&#39;m driving to unlock OpenBSD&#39;s Network Stack is obviously to increase performances. So I&#39;d understand that you find confusing when some of our changes introduce performance regressions.<br>
It is just really hard to do incremental changes without introducing temporary regressions. But as much as security is a process, improving performance is also a process. Recently markus@ told me that vlan(4) performances dropped in last releases. He had some ideas why but he couldn&#39;t provide evidences. So what really happened?<br>
Hrvoje Popovski was kind enough to help me with some tests. He first confirmed that on his Xeon box (E5-2643 v2 @ 3.50GHz), forwarding performances without pf(4) dropped from 1.42Mpps to 880Kpps when using vlan(4) on both interfaces.<br>
Together vlan_input() and vlan_start() represent 25% of the time CPU1 spends processing packets. This is not exactly between 33% and 50% but it is close enough. The assumption we made earlier is certainly too simple. If we compare the amount of work done in process context, represented by if_input_process() we clearly see that half of the CPU time is not spent in ether_input().<br>
I&#39;m not sure how this is related to the measured performance drop. It is actually hard to tell since packets are currently being processed in 3 different contexts. One of the arguments mikeb@ raised when we discussed moving everything in a single context, is that it is simpler to analyse and hopefully make it scale.<br>
With some measurements, a couple of nice pictures, a bit of analysis and some educated guesses we are now in measure of saying that the performances impact observed with vlan(4) is certainly due to the pseudo-driver itself. A decrease of 30% to 50% is not what I would expect from such pseudo-driver.<br>
I originally heard that the reason for this regression was the use of SRP but by looking at the profiling data it seems to me that the queuing API is the problem. In the graph above the CPU time spent in if_input() and if_enqueue() from vlan(4) is impressive. Remember, in the case of vlan(4) these operations are done per packet!<br>
When if_input() has been introduced the queuing API did not exist and putting/taking a single packet on/from an interface queue was cheap. Now it requires a mutex per operation, which in the case of packets received and sent on vlan(4) means grabbing three mutexes per packets.<br>
I still can&#39;t say if my analysis is correct or not, but at least it could explain the decrease observed by Hrvoje when testing multiple vlan(4) configurations. vlan_input() takes one mutex per packet, so it decreases the number of forwarded packets by ~100Kpps on this machine, while vlan_start() taking two mutexes decreases it by ~200Kpps.</p>
</blockquote>

<ul>
<li>An interesting analysis of the routing performance regression on OpenBSD</li>
<li>I have asked Olivier Cochard-Labbe about doing a similar comparison of routing performance on FreeBSD when a vlan pseudo interface is added to the forwarding path
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_the_first_bsd_introducing" rel="nofollow">NetBSD: the first BSD introducing a modern process plugin framework in LLDB</a></h3>

<ul>
<li>Clean up in ptrace(2) ATF tests</li>
</ul>

<blockquote>
<p>We have created some maintanance burden for the current ptrace(2) regression tests. The main issues with them is code duplication and the splitting between generic (Machine Independent) and port-specific (Machine Dependent) test files. I&#39;ve eliminated some of the ballast and merged tests into the appropriate directory tests/lib/libc/sys/. The old location (tests/kernel) was a violation of the tests/README recommendation</p>
</blockquote>

<ul>
<li>PTRACE_FORK on !x86 ports</li>
</ul>

<blockquote>
<p>Along with the motivation from Martin Husemann we have investigated the issue with PTRACE_FORK ATF regression tests. It was discovered that these tests aren&#39;t functional on evbarm, alpha, shark, sparc and sparc64 and likely on other non-x86 ports. We have discovered that there is a missing SIGTRAP emitted from the child, during the fork(2) handshake. The proper order of operations is as follows:</p>

<blockquote>
<p>parent emits SIGTRAP with si_code=TRAP_CHLD and pe_set_event=pid of forkee<br>
child emits SIGTRAP with si_code=TRAP_CHLD and pe_set_event=pid of forker</p>
</blockquote>

<p>Only the x86 ports were emitting the second SIGTRAP signal.</p>
</blockquote>

<ul>
<li>PT_SYSCALL and PT_SYSCALLEMU</li>
</ul>

<blockquote>
<p>With the addition of PT_SYSCALLEMU we can implement a virtual kernel syscall monitor. It means that we can fake syscalls within a debugger. In order to achieve this feature, we need to use the PT_SYSCALL operation, catch SIGTRAP with si_code=TRAP_SCE (syscall entry), call PT_SYSCALLEMU and perform an emulated userspace syscall that would have been done by the kernel, followed by calling another PT_SYSCALL with si_code=TRAP_SCX.</p>
</blockquote>

<ul>
<li>What has been done in LLDB</li>
</ul>

<blockquote>
<p>A lot of work has been done with the goal to get breakpoints functional. This target penetrated bugs in the existing local patches and unveiled missing features required to be added. My initial test was tracing a dummy hello-world application in C. I have sniffed the GDB Remote Protocol packets and compared them between Linux and NetBSD. This helped to streamline both versions and bring the NetBSD support to the required Linux level.</p>
</blockquote>

<ul>
<li>Plan for the next milestone</li>
</ul>

<blockquote>
<p>I&#39;ve listed the following goals for the next milestone.</p>
</blockquote>

<ul>
<li>watchpoints support</li>
<li>floating point registers support</li>
<li>enhance core(5) and make it work for multiple threads</li>
<li>introduce PT_SETSTEP and PT_CLEARSTEP in ptrace(2)</li>
<li>support threads in the NetBSD Process Plugin</li>
<li>research F_GETPATH in fcntl(2)</li>
<li>Beyond the next milestone is x86 32-bit support.</li>
</ul>

<h3><a href="https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.2-relnotes.txt" rel="nofollow">LibreSSL 2.5.2 released</a></h3>

<ul>
<li>Added the recallocarray(3) memory allocation function, and converted various places in the library to use it, such as CBB and BUF_MEM_grow. recallocarray(3) is similar to reallocarray. Newly allocated memory is cleared similar to calloc(3). Memory that becomes unallocated while shrinking or moving existing allocations is explicitly discarded by unmapping or clearing to 0.</li>
<li>Added new root CAs from SECOM Trust Systems / Security Communication of Japan.</li>
<li>Added EVP interface for MD5+SHA1 hashes.</li>
<li>Fixed DTLS client failures when the server sends a certificate request.</li>
<li>Correct handling of padding when upgrading an SSLv2 challenge into an SSLv3/TLS connection.</li>
<li>Allow protocols and ciphers to be set on a TLS config object in libtls.</li>
<li>Improved nc(1) TLS handshake CPU usage and server-side error reporting.</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://hardenedbsd.org/article/op/2017-03-30/stable-release-hardenedbsd-stable-11-stable-v4616" rel="nofollow">HardenedBSD Stable v46.16 released</a></li>
<li><a href="https://www.reddit.com/r/openbsd/comments/5vggn7/knoxbug_looking_for_openbsd_people_in_knoxville/" rel="nofollow">KnoxBUG looking for OpenBSD people in Knoxville TN area</a></li>
<li>KnoxBUG Tuesday, April 18, 2017 - 6:00pm : Caleb Cooper: Advanced BASH Scripting](<a href="http://knoxbug.org/2017-04-18" rel="nofollow">http://knoxbug.org/2017-04-18</a>)</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170405110059" rel="nofollow">e2k17 Nano hackathon report from Bob Beck</a></li>
<li>Noah Chelliah, Host of the Linux Action Show calls Linux a Bad Science Project and ditches Linux for TrueOS](<a href="https://youtu.be/yXB85_olYhQ?t=3238" rel="nofollow">https://youtu.be/yXB85_olYhQ?t=3238</a>)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="http://dpaste.com/1H43JGV#wrap" rel="nofollow">James - ZFS Mounting</a></p></li>
<li><p><a href="http://dpaste.com/18VNAJK#wrap" rel="nofollow">Kevin - Virtualization</a></p></li>
<li><p><a href="http://dpaste.com/0R7CRZ7#wrap" rel="nofollow">Ben - Jails</a></p></li>
<li><p><a href="http://dpaste.com/2Z1P23T#wrap" rel="nofollow">Florian - ZFS and Migrating Linux userlands</a></p></li>
<li><p><a href="http://dpaste.com/26M453F#wrap" rel="nofollow">q5sys - question for the community</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show we interview Wendell from Level1Techs, cover Google Summer of Code on the different BSD projects, cover YubiKey usage, dive into how NICs work &amp;</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>Google summer of code for BSDs</h3>

<ul>
<li><p><a href="https://www.freebsd.org/projects/summerofcode.html" rel="nofollow">FreeBSD</a></p></li>
<li><p><a href="https://wiki.freebsd.org/SummerOfCodeIdeas" rel="nofollow">FreeBSD&#39;s existing list of GSoC Ideas for potential students</a> </p>

<ul>
<li>FreeBSD/Xen: import the grant-table bus_dma(9) handlers from OpenBSD</li>
<li>Add support for usbdump file-format to wireshark and vusb-analyzer</li>
<li>Write a new boot environment manager</li>
<li>Basic smoke test of all base utilities</li>
<li>Port OpenBSD&#39;s pf testing framework and tests</li>
<li>Userspace Address Space Annotation</li>
<li>zstandard integration in libstand</li>
<li>Replace mergesort implementation</li>
<li>Test Kload (kexec for FreeBSD)</li>
<li>Kernel fuzzing suite</li>
<li>Integrate MFSBSD into the release building tools</li>
<li>NVMe controller emulation for bhyve</li>
<li>Verification of bhyve&#39;s instruction emulation</li>
<li>VGA emulation improvements for bhyve</li>
<li>audit framework test suite</li>
<li>Add more FreeBSD testing to Xen osstest</li>
<li>Lua in bootloader</li>
<li>POSIX compliance testing framework</li>
<li>coreclr: add Microsoft&#39;s coreclr and corefx to the Ports tree.</li>
</ul></li>
<li><p><a href="https://wiki.netbsd.org/projects/gsoc/" rel="nofollow">NetBSD</a></p>

<ul>
<li>Kernel-level projects</li>
<li>Medium</li>
<li>ISDN NT support and Asterisk integration </li>
<li>LED/LCD Generic API </li>
<li>NetBSD/azure -- Bringing NetBSD to Microsoft Azure </li>
<li>OpenCrypto swcrypto(4) enhancements </li>
<li>Scalable entropy gathering </li>
<li>Userland PCI drivers </li>
<li>Hard</li>
<li>Real asynchronous I/O </li>
<li>Parallelize page queues </li>
<li>Tickless NetBSD with high-resolution timers </li>
<li> Userland projects</li>
<li>Easy</li>
<li>Inetd enhancements -- Add new features to inetd </li>
<li>Curses library automated testing </li>
<li>Medium</li>
<li>Make Anita support additional virtual machine systems </li>
<li>Create an SQL backend and statistics/query page for ATF test results </li>
<li>Light weight precision user level time reading </li>
<li>Query optimizer for find(1) </li>
<li>Port launchd </li>
<li>Secure-PLT - supporting RELRO binaries </li>
<li>Sysinst alternative interface </li>
<li>Hard</li>
<li>Verification tool for NetBSD32 </li>
<li>pkgsrc projects</li>
<li>Easy</li>
<li>Version control config files </li>
<li>Spawn support in pkgsrc tools </li>
<li>Authentication server meta-package </li>
<li>Medium</li>
<li>pkgin improvements </li>
<li>Unify standard installation tasks </li>
<li>Hard</li>
<li>Add dependency information to binary packages </li>
<li>Tool to find dependencies precisely </li>
</ul></li>
<li><p><a href="http://llvm.org/OpenProjects.html#gsoc17" rel="nofollow">LLVM</a></p>

<ul>
<li>Fuzzing the Bitcode reader </li>
</ul></li>
</ul>

<blockquote>
<p>Description of the project: The optimizer is 25-30% slower when debug info are enabled, it&#39;d be nice to track all the places where we don&#39;t do a good job about ignoring them!</p>
</blockquote>

<ul>
<li>Extend clang AST to provide information for the type as written in template instantiations.</li>
</ul>

<blockquote>
<p>Description of the project: When instantiating a template, the template arguments are canonicalized before being substituted into the template pattern. Clang does not preserve type sugar when subsequently accessing members of the instantiation. Clang should &quot;re-sugar&quot; the type when performing member access on a class template specialization, based on the type sugar of the accessed specialization. </p>
</blockquote>

<ul>
<li>Shell auto-completion support for clang.</li>
</ul>

<blockquote>
<p>Bash and other shells support typing a partial command and then automatically completing it for the user (or at least providing suggestions how to complete) when pressing the tab key. This is usually only supported for popular programs such as package managers (e.g. pressing tab after typing &quot;apt-get install late&quot; queries the APT package database and lists all packages that start with &quot;late&quot;). As of now clang&#39;s frontend isn&#39;t supported by any common shell. </p>
</blockquote>

<ul>
<li>Clang-based C/C++ diff tool.</li>
</ul>

<blockquote>
<p>Description of the project: Every developer has to interact with diff tools daily. The algorithms are usually based on detecting &quot;longest common subsequences&quot;, which is agnostic to the file type content. A tool that would understand the structure of the code may provide a better diff experience by being robust against, for example, clang-format changes.</p>
</blockquote>

<ul>
<li>Find dereference of pointers.</li>
</ul>

<blockquote>
<p>Description of the project: Find dereference of pointer before checking for nullptr.</p>
</blockquote>

<ul>
<li>Warn if virtual calls are made from constructors or destructors.</li>
</ul>

<blockquote>
<p>Description of the project: Implement a path-sensitive checker that warns if virtual calls are made from constructors and destructors, which is not valid in case of pure virtual calls and could be a sign of user error in non-pure calls. </p>
</blockquote>

<ul>
<li>Improve Code Layout</li>
</ul>

<blockquote>
<p>Description of the project: The goal for the project is trying to improve the layout/performances of the generated executable. The primary object format considered for the project is ELF but this can be extended to other object formats. The project will touch both LLVM and lld.</p>
</blockquote>

<ul>
<li><p><a href="http://marc.info/?l=openbsd-misc&m=149119308705465&w=2" rel="nofollow">Why Isnt OpenBSD in Google Summer of Code 2017?</a></p></li>
<li><p><a href="https://news.ycombinator.com/item?id=14020814" rel="nofollow">Hacker News Discussion Thread</a></p>

<hr></li>
</ul>

<h3><a href="http://dtrace.org/blogs/rm/2016/09/15/turtles-on-the-wire-understanding-how-the-os-uses-the-modern-nic/" rel="nofollow">Turtles on the Wire: Understanding How the OS Uses the Modern NIC</a></h3>

<ul>
<li>The Simple NIC</li>
<li>MAC Address Filters and Promiscuous Mode</li>
<li>Problem: The Single Busy CPU</li>
<li>A Swing and a Miss</li>
<li>Nine Rings for Packets Doomed to be Hashed</li>
<li>Problem: Density, Density, Density</li>
<li>A Brief Aside: The Virtual NIC</li>
<li>Always Promiscuous?</li>
<li>The Classification Challenge</li>
<li>Problem: CPUs are too slow</li>
<li>Problem: The Interrupts are Coming in too Hot</li>
<li>Solution One: Do Less Work</li>
<li>Solution Two: Turn Off Interrupts</li>
<li>Recapping</li>
<li>Future Directions and More Reading</li>
</ul>

<hr>

<h3><a href="http://akat1.pl/?id=3" rel="nofollow">Make Dragonfly BSD great again!</a></h3>

<blockquote>
<p>Recently I spent some time reading Dragonfly BSD code. While doing so I spotted a vulnerability in the sysvsem subsystem that let user to point to any piece of memory and write data through it (including the kernel space). This can be turned into execution of arbitrary code in the kernel context and by exploiting this, we&#39;re gonna make Dragonfly BSD great again!</p>

<p>Dragonfly BSD is a BSD system which originally comes from the FreeBSD project. In 2003 Matthew Dillon forked code from the 4.x branch of the FreeBSD and started a new flavour.<br>
I thought of Dragonfly BSD as just another fork, but during EuroBSDCon 2015 I accidentally saw the talk about graphical stack in the Dragonfly BSD. I confused rooms, but it was too late to escape as I was sitting in the middle of a row, and the exit seemed light years away from me. :-) Anyway, this talk was a sign to me that it&#39;s not just a niche of a niche of a niche of a niche operating system. I recommend spending a few minutes of your precious time to check out the HAMMER file system, Dragonfly&#39;s approach to MP, process snapshots and other cool features that it offers. Wikipedia article is a good starter</p>
</blockquote>

<ul>
<li>With the exploit, they are able to change the name of the operating system back to FreeBSD, and escalate from an unprivileged user to root.</li>
</ul>

<blockquote>
<p>The Bug itself is located in the semctl(2) system call implementation. bcopy(3) in line 385 copies semid_ds structure to memory pointed by arg-&gt;buf, this pointer is fully controlled by the user, as it&#39;s one of the syscall&#39;s arguments. So the bad thing here is that we can copy things to arbitrary address, but we have not idea what we copy yet. This code was introduced by wrongly merging code from the FreeBSD project, <em>bah</em>, bug happens.</p>
</blockquote>

<ul>
<li>Using this access, the example code shows how to overwrite the function pointers in the kernel used for the open() syscall, and how to overwrite the ostype global, changing the name of the operating system.</li>
<li>In the second example, the reference to the credentials of the user trying to open a file are used to overwrite that data, making the user root.</li>
</ul>

<blockquote>
<p>The bug was fixed in uber fast manner (within few hours!) by Matthew Dillon, version 4.6.1 released shortly after that seems to be safe. In case you care, you know what to do!</p>
</blockquote>

<ul>
<li>Thanks to Mateusz Kocielski for the detailed post, and finding the bug
***</li>
</ul>

<h2>Interview - Wendell - <a href="mailto:wendell@level1techs.com" rel="nofollow">wendell@level1techs.com</a> / <a href="https://twitter.com/tekwendell" rel="nofollow">@tekwendell</a></h2>

<ul>
<li>Host of Level1Techs website, podcast and YouTube channel</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.tedunangst.com/flak/post/using-yubikeys-everywhere" rel="nofollow">Using yubikeys everywhere</a></h3>

<ul>
<li>Ted Unangst is back, with an interesting post about YUBI Keys</li>
</ul>

<blockquote>
<p>Everybody is getting real excited about yubikeys recently, so I figured I should get excited, too. I have so far resisted two factor authorizing everything, but this seemed like another fun experiment. Theres a lot written about yubikeys and how you should use one, but nothing Ive read answered a few of the specific questions I had<br>
To begin with, I ordered two yubikeys. One regular sized 4 and one nano. I wanted to play with different form factors to see which is better for various uses, and I wanted to test having a key and a backup key. Everybody always talks about having one yubikey. And then if you lose it, terrible things happen. Can this problem be alleviated with two keys? Im also very curious what happens when I try to login to a service with my phone after enabling U2F.<br>
Weve got three computers (and operating systems) in the mix, along with a number of (mostly web) services. Wherever possible, I want to use a yubikey both to login to the computer and to authorize myself to remote services.<br>
I started my adventure on my chromebook. Ultimate goal would be to use the yubikey for local logins. Either as a second factor, or as an alternative factor. First things first and we need to get the yubikey into the account I use to sign into the chromebook. Alas, there is apparently no way to enroll only a security key for a Google account. Every time I tried, it would ask me for my phone number. That is not what I want. Zero stars.<br>
Giving up on protecting the chromebook itself, at least maybe I can use it to enable U2F with some other sites. U2F is currently limited to Chrome, but it sounds like everything I want. Facebook signup using U2F was pretty easy. Go to account settings, security subheading, add the device. Tap the button when it glows. Key added. Note that its possible to add a key without actually enabling two factor auth, in which case you can still login with only a password, but no way to login with no password and only a USB key. Logged out to confirm it would check the key, and everything looked good, so I killed all my other active sessions. Now for the phone test. Not quite as smooth. Tried to login, the Facebook app then tells me it has sent me an SMS and to enter the code in the box. But I dont have a phone number attached. Im not getting an SMS code.<br>
Meanwhile, on my laptop, I have a new notification about a login attempt. Follow the prompts to confirm its me and permit the login. This doesnt have any effect on the phone, however. I have to tap back, return to the login screen, and enter my password again. This time the login succeeds. So everything works, but there are still some rough patches in the flow. Ideally, the phone would more accurately tell me to visit the desktop site, and then automatically proceed after I approve. (The messenger app crashed after telling me my session had expired, but upon restarting it was able to borrow the Facebook app credentials and I was immediately logged back in.)<br>
Lets configure Dropbox next. Dropbox wont let you add a security key to an account until after youve already set up some other mobile authenticator. I already had the Duo app on my phone, so I picked that, and after a short QR scan, Im ready to add the yubikey. So the key works to access Dropbox via Chrome. Accessing Dropbox via my phone or Firefox requires entering a six digit code. No way to use a yubikey in a three legged configuration<br>
I dont use Github, but I know they support two factors, so lets try them next. Very similar to Dropbox. In order to set up a key, I must first set up an authenticator app. This time I went with Yubicos own desktop authenticator. Instead of scanning the QR code, type in some giant number (on my Windows laptop), and it spits out an endless series of six digit numbers, but only while the yubikey is inserted. I guess this is kind of what I want, although a three pound yubikey is kind of unwieldy.<br>
As part of my experiment, I noticed that Dropbox verifies passwords before even looking at the second auth. I have a feeling that they should be checked at the same time. No sense allowing my password guessing attack to proceed while I plot how to steal someones yubikey. In a sense, the yubikey should serve as a salt, preventing me from mounting such an attack until I have it, thus creating a race where the victim notices the key is gone and revokes access before I learn the password. If I know the password, the instant I grab the key I get access. Along similar lines, I was able to complete a password reset without entering any kind of secondary code.<br>
Having my phone turn into a second factor is a big part of what Im looking to avoid with the yubikey. Id like to be able to take my phone with me, logged into some sites but not all, and unable to login to the rest. All these sites that require using my phone as mobile authenticator are making that difficult. I bought the yubikey because it was cheaper than buying another phone! Using the Yubico desktop authenticator seems the best way around that.</p>
</blockquote>

<ul>
<li>The article also provides instructions for configuring the Yubikey on OpenBSD</li>
</ul>

<blockquote>
<p>A few notes about OTP. As mentioned, the secret key is the real password. Its stored on whatever laptop or server you login to. Meaning any of those machines can take the key and use it to login to any other machine. If you use the same yubikey to login to both your laptop and a remote server, your stolen laptop can trivially be used to login to the server without the key. Be mindful of that when setting up multiple machines. Also, the OTP counter isnt synced between machines in this setup, which allows limited replay attacks.</p>
</blockquote>

<ul>
<li>Ted didnt switch his SSH keys to the Yubikey, because it doesnt support ED25519, and he just finished rotating all of his keys and doesnt want to do it again.</li>
</ul>

<blockquote>
<p>I did most of my experimenting with the larger yubikey, since it was easier to move between machines. For operations involving logging into a web site, however, Id prefer the nano. Its very small, even smaller than the tiniest wireless mouse transcievers Ive seen. So small, in fact, I had trouble removing it because I couldnt find anything small enough to fit through the tiny loop. But probably a good thing. Most other micro USB gadgets stick out just enough to snag when pushing a laptop into a bag. Not the nano. You lose a port, but theres really no reason to ever take it out. Just leave it in, and then tap it whenever you login to the tubes. It would not be a good choice for authenticating to the local machine, however. The larger device, sized to fit on a keychain, is much better for that. <br>
It is possible to use two keys as backups. Facebook and Dropbox allow adding two U2F keys. This is perhaps a little tiresome if theres lots of sites, as I see no way to clone a key. You have to login to every service. For challenge response and OTP, however, the personalization tool makes it easy to generate lots of yubikeys with the same secrets. On the other hand, a single device supports an infinite number of U2F sites. The programmable interfaces like OTP are limited to only two slots, and the first is already used by the factory OTP setup.</p>

<hr>
</blockquote>

<h3><a href="http://www.grenadille.net/post/2017/02/13/What-happened-to-my-vlan" rel="nofollow">What happened to my vlan</a></h3>

<blockquote>
<p>A long term goal of the effort I&#39;m driving to unlock OpenBSD&#39;s Network Stack is obviously to increase performances. So I&#39;d understand that you find confusing when some of our changes introduce performance regressions.<br>
It is just really hard to do incremental changes without introducing temporary regressions. But as much as security is a process, improving performance is also a process. Recently markus@ told me that vlan(4) performances dropped in last releases. He had some ideas why but he couldn&#39;t provide evidences. So what really happened?<br>
Hrvoje Popovski was kind enough to help me with some tests. He first confirmed that on his Xeon box (E5-2643 v2 @ 3.50GHz), forwarding performances without pf(4) dropped from 1.42Mpps to 880Kpps when using vlan(4) on both interfaces.<br>
Together vlan_input() and vlan_start() represent 25% of the time CPU1 spends processing packets. This is not exactly between 33% and 50% but it is close enough. The assumption we made earlier is certainly too simple. If we compare the amount of work done in process context, represented by if_input_process() we clearly see that half of the CPU time is not spent in ether_input().<br>
I&#39;m not sure how this is related to the measured performance drop. It is actually hard to tell since packets are currently being processed in 3 different contexts. One of the arguments mikeb@ raised when we discussed moving everything in a single context, is that it is simpler to analyse and hopefully make it scale.<br>
With some measurements, a couple of nice pictures, a bit of analysis and some educated guesses we are now in measure of saying that the performances impact observed with vlan(4) is certainly due to the pseudo-driver itself. A decrease of 30% to 50% is not what I would expect from such pseudo-driver.<br>
I originally heard that the reason for this regression was the use of SRP but by looking at the profiling data it seems to me that the queuing API is the problem. In the graph above the CPU time spent in if_input() and if_enqueue() from vlan(4) is impressive. Remember, in the case of vlan(4) these operations are done per packet!<br>
When if_input() has been introduced the queuing API did not exist and putting/taking a single packet on/from an interface queue was cheap. Now it requires a mutex per operation, which in the case of packets received and sent on vlan(4) means grabbing three mutexes per packets.<br>
I still can&#39;t say if my analysis is correct or not, but at least it could explain the decrease observed by Hrvoje when testing multiple vlan(4) configurations. vlan_input() takes one mutex per packet, so it decreases the number of forwarded packets by ~100Kpps on this machine, while vlan_start() taking two mutexes decreases it by ~200Kpps.</p>
</blockquote>

<ul>
<li>An interesting analysis of the routing performance regression on OpenBSD</li>
<li>I have asked Olivier Cochard-Labbe about doing a similar comparison of routing performance on FreeBSD when a vlan pseudo interface is added to the forwarding path
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_the_first_bsd_introducing" rel="nofollow">NetBSD: the first BSD introducing a modern process plugin framework in LLDB</a></h3>

<ul>
<li>Clean up in ptrace(2) ATF tests</li>
</ul>

<blockquote>
<p>We have created some maintanance burden for the current ptrace(2) regression tests. The main issues with them is code duplication and the splitting between generic (Machine Independent) and port-specific (Machine Dependent) test files. I&#39;ve eliminated some of the ballast and merged tests into the appropriate directory tests/lib/libc/sys/. The old location (tests/kernel) was a violation of the tests/README recommendation</p>
</blockquote>

<ul>
<li>PTRACE_FORK on !x86 ports</li>
</ul>

<blockquote>
<p>Along with the motivation from Martin Husemann we have investigated the issue with PTRACE_FORK ATF regression tests. It was discovered that these tests aren&#39;t functional on evbarm, alpha, shark, sparc and sparc64 and likely on other non-x86 ports. We have discovered that there is a missing SIGTRAP emitted from the child, during the fork(2) handshake. The proper order of operations is as follows:</p>

<blockquote>
<p>parent emits SIGTRAP with si_code=TRAP_CHLD and pe_set_event=pid of forkee<br>
child emits SIGTRAP with si_code=TRAP_CHLD and pe_set_event=pid of forker</p>
</blockquote>

<p>Only the x86 ports were emitting the second SIGTRAP signal.</p>
</blockquote>

<ul>
<li>PT_SYSCALL and PT_SYSCALLEMU</li>
</ul>

<blockquote>
<p>With the addition of PT_SYSCALLEMU we can implement a virtual kernel syscall monitor. It means that we can fake syscalls within a debugger. In order to achieve this feature, we need to use the PT_SYSCALL operation, catch SIGTRAP with si_code=TRAP_SCE (syscall entry), call PT_SYSCALLEMU and perform an emulated userspace syscall that would have been done by the kernel, followed by calling another PT_SYSCALL with si_code=TRAP_SCX.</p>
</blockquote>

<ul>
<li>What has been done in LLDB</li>
</ul>

<blockquote>
<p>A lot of work has been done with the goal to get breakpoints functional. This target penetrated bugs in the existing local patches and unveiled missing features required to be added. My initial test was tracing a dummy hello-world application in C. I have sniffed the GDB Remote Protocol packets and compared them between Linux and NetBSD. This helped to streamline both versions and bring the NetBSD support to the required Linux level.</p>
</blockquote>

<ul>
<li>Plan for the next milestone</li>
</ul>

<blockquote>
<p>I&#39;ve listed the following goals for the next milestone.</p>
</blockquote>

<ul>
<li>watchpoints support</li>
<li>floating point registers support</li>
<li>enhance core(5) and make it work for multiple threads</li>
<li>introduce PT_SETSTEP and PT_CLEARSTEP in ptrace(2)</li>
<li>support threads in the NetBSD Process Plugin</li>
<li>research F_GETPATH in fcntl(2)</li>
<li>Beyond the next milestone is x86 32-bit support.</li>
</ul>

<h3><a href="https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.2-relnotes.txt" rel="nofollow">LibreSSL 2.5.2 released</a></h3>

<ul>
<li>Added the recallocarray(3) memory allocation function, and converted various places in the library to use it, such as CBB and BUF_MEM_grow. recallocarray(3) is similar to reallocarray. Newly allocated memory is cleared similar to calloc(3). Memory that becomes unallocated while shrinking or moving existing allocations is explicitly discarded by unmapping or clearing to 0.</li>
<li>Added new root CAs from SECOM Trust Systems / Security Communication of Japan.</li>
<li>Added EVP interface for MD5+SHA1 hashes.</li>
<li>Fixed DTLS client failures when the server sends a certificate request.</li>
<li>Correct handling of padding when upgrading an SSLv2 challenge into an SSLv3/TLS connection.</li>
<li>Allow protocols and ciphers to be set on a TLS config object in libtls.</li>
<li>Improved nc(1) TLS handshake CPU usage and server-side error reporting.</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://hardenedbsd.org/article/op/2017-03-30/stable-release-hardenedbsd-stable-11-stable-v4616" rel="nofollow">HardenedBSD Stable v46.16 released</a></li>
<li><a href="https://www.reddit.com/r/openbsd/comments/5vggn7/knoxbug_looking_for_openbsd_people_in_knoxville/" rel="nofollow">KnoxBUG looking for OpenBSD people in Knoxville TN area</a></li>
<li>KnoxBUG Tuesday, April 18, 2017 - 6:00pm : Caleb Cooper: Advanced BASH Scripting](<a href="http://knoxbug.org/2017-04-18" rel="nofollow">http://knoxbug.org/2017-04-18</a>)</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170405110059" rel="nofollow">e2k17 Nano hackathon report from Bob Beck</a></li>
<li>Noah Chelliah, Host of the Linux Action Show calls Linux a Bad Science Project and ditches Linux for TrueOS](<a href="https://youtu.be/yXB85_olYhQ?t=3238" rel="nofollow">https://youtu.be/yXB85_olYhQ?t=3238</a>)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><p><a href="http://dpaste.com/1H43JGV#wrap" rel="nofollow">James - ZFS Mounting</a></p></li>
<li><p><a href="http://dpaste.com/18VNAJK#wrap" rel="nofollow">Kevin - Virtualization</a></p></li>
<li><p><a href="http://dpaste.com/0R7CRZ7#wrap" rel="nofollow">Ben - Jails</a></p></li>
<li><p><a href="http://dpaste.com/2Z1P23T#wrap" rel="nofollow">Florian - ZFS and Migrating Linux userlands</a></p></li>
<li><p><a href="http://dpaste.com/26M453F#wrap" rel="nofollow">q5sys - question for the community</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>188: And then the murders began</title>
  <link>https://www.bsdnow.tv/188</link>
  <guid isPermaLink="false">3f745bc2-94ef-484d-89a0-b716571c789c</guid>
  <pubDate>Wed, 05 Apr 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3f745bc2-94ef-484d-89a0-b716571c789c.mp3" length="60237652" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Today on BSD Now, the latest Dragonfly BSD release, RaidZ performance, another OpenSSL Vulnerability, and more; all this week on BSD Now.</itunes:subtitle>
  <itunes:duration>1:23:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Today on BSD Now, the latest Dragonfly BSD release, RaidZ performance, another OpenSSL Vulnerability, and more; all this week on BSD Now.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
DragonFly BSD 4.8 is released (https://www.dragonflybsd.org/release48/)
Improved kernel performance
This release further localizes cache lines and reduces/removes cache ping-ponging on globals. For bulk builds on many-cores or multi-socket systems, we have around a 5% improvement, and certain subsystems such as namecache lookups and exec()s see massive focused improvements. See the corresponding mailing list post with details.
Support for eMMC booting, and mobile and high-performance PCIe SSDs
This kernel release includes support for eMMC storage as the boot device. We also sport a brand new SMP-friendly, high-performance NVMe SSD driver (PCIe SSD storage). Initial device test results are available.
EFI support
The installer can now create an EFI or legacy installation. Numerous adjustments have been made to userland utilities and the kernel to support EFI as a mainstream boot environment. The /boot filesystem may now be placed either in its own GPT slice, or in a DragonFly disklabel inside a GPT slice.
DragonFly, by default, creates a GPT slice for all of DragonFly and places a DragonFly disklabel inside it with all the standard DFly partitions, such that the disk names are roughly the same as they would be in a legacy system.
Improved graphics support
The i915 driver has been updated to match the version found with the Linux 4.6 kernel. Broadwell and Skylake processor users will see improvements.
Other user-affecting changes
Kernel is now built using -O2.
VKernels now use COW, so multiple vkernels can share one disk image.
powerd() is now sensitive to time and temperature changes.
Non-boot-filesystem kernel modules can be loaded in rc.conf instead of loader.conf.
***
#8005 poor performance of 1MB writes on certain RAID-Z configurations (https://github.com/openzfs/openzfs/pull/321)
Matt Ahrens posts a new patch for OpenZFS
Background: RAID-Z requires that space be allocated in multiples of P+1 sectors,because this is the minimum size block that can have the required amount of parity. Thus blocks on RAIDZ1 must be allocated in a multiple of 2 sectors; on RAIDZ2 multiple of 3; and on RAIDZ3 multiple of 4. A sector is a unit of 2^ashift bytes, typically 512B or 4KB.
To satisfy this constraint, the allocation size is rounded up to the proper multiple, resulting in up to 3 "pad sectors" at the end of some blocks. The contents of these pad sectors are not used, so we do not need to read or write these sectors. However, some storage hardware performs much worse (around 1/2 as fast) on mostly-contiguous writes when there are small gaps of non-overwritten data between the writes. Therefore, ZFS creates "optional" zio's when writing RAID-Z blocks that include pad sectors. If writing a pad sector will fill the gap between two (required) writes, we will issue the optional zio, thus doubling performance. The gap-filling performance improvement was introduced in July 2009.
Writing the optional zio is done by the io aggregation code in vdevqueue.c. The problem is that it is also subject to the limit on the size of aggregate writes, zfsvdevaggregationlimit, which is by default 128KB. For a given block, if the amount of data plus padding written to a leaf device exceeds zfsvdevaggregation_limit, the optional zio will not be written, resulting in a ~2x performance degradation.
The solution is to aggregate optional zio's regardless of the aggregation size limit.
As you can see from the graphs, this can make a large difference in performance.
I encourage you to read the entire commit message, it is well written and very detailed.
***
Can you spot the OpenSSL vulnerability  (https://guidovranken.wordpress.com/2017/01/28/can-you-spot-the-vulnerability/)
This code was introduced in OpenSSL 1.1.0d, which was released a couple of days ago. This is in the server SSL code, ssl/statem/statemsrvr.c, sslbytestocipherlist()), and can easily be reached remotely. Can you spot the vulnerability?
So there is a loop, and within that loop we have an ‘if’ statement, that tests a number of conditions. If any of those conditions fail, OPENSSLfree(raw) is called. But raw isn’t the address that was allocated; raw is increment every loop. Hence, there is a remote invalid free vulnerability.
But not quite. None of those checks in the ‘if’ statement can actually fail; earlier on in the function, there is a check that verifies that the packet contains at least 1 byte, so PACKETget1 cannot fail. Furthermore, earlier in the function it is verified that the packet length is a multiple of 3, hence PACKETcopybytes and PACKET_forward cannot fail.
So, does the code do what the original author thought, or expected it to do?
But what about the next person that modifies that code, maybe changing or removing one of the earlier checks, allowing one of those if conditions to fail, and execute the bad code?
Nonetheless OpenSSL has acknowledged that the OPENSSL_free line needs a rewrite: Pull Request #2312 (https://github.com/openssl/openssl/pull/2312)
PS I’m not posting this to ridicule the OpenSSL project or their programming skills. I just like reading code and finding corner cases that impact security, which is an effort that ultimately works in everybody’s best interest, and I like to share what I find. Programming is a very difficult enterprise and everybody makes mistakes.
Thanks to Guido Vranken for the sharp eye and the blog post
***
Research Debt (http://distill.pub/2017/research-debt/)
I found this article interesting as it relates to not just research, but a lot of technical areas in general
Achieving a research-level understanding of most topics is like climbing a mountain. Aspiring researchers must struggle to understand vast bodies of work that came before them, to learn techniques, and to gain intuition. Upon reaching the top, the new researcher begins doing novel work, throwing new stones onto the top of the mountain and making it a little taller for whoever comes next. 
People expect the climb to be hard. It reflects the tremendous progress and cumulative effort that’s gone into the research. The climb is seen as an intellectual pilgrimage, the labor a rite of passage. But the climb could be massively easier. It’s entirely possible to build paths and staircases into these mountains. The climb isn’t something to be proud of. The climb isn’t progress: the climb is a mountain of debt.
Programmers talk about technical debt: there are ways to write software that are faster in the short run but problematic in the long run.
Poor Exposition – Often, there is no good explanation of important ideas and one has to struggle to understand them. This problem is so pervasive that we take it for granted and don’t appreciate how much better things could be.
Undigested Ideas – Most ideas start off rough and hard to understand. They become radically easier as we polish them, developing the right analogies, language, and ways of thinking.
Bad abstractions and notation – Abstractions and notation are the user interface of research, shaping how we think and communicate. Unfortunately, we often get stuck with the first formalisms to develop even when they’re bad. For example, an object with extra electrons is negative, and pi is wrong
Noise – Being a researcher is like standing in the middle of a construction site. Countless papers scream for your attention and there’s no easy way to filter or summarize them. We think noise is the main way experts experience research debt.
There’s a tradeoff between the energy put into explaining an idea, and the energy needed to understand it. On one extreme, the explainer can painstakingly craft a beautiful explanation, leading their audience to understanding without even realizing it could have been difficult. On the other extreme, the explainer can do the absolute minimum and abandon their audience to struggle. This energy is called interpretive labor
Research distillation is the opposite of research debt. It can be incredibly satisfying, combining deep scientific understanding, empathy, and design to do justice to our research and lay bare beautiful insights. Distillation is also hard. It’s tempting to think of explaining an idea as just putting a layer of polish on it, but good explanations often involve transforming the idea. This kind of refinement of an idea can take just as much effort and deep understanding as the initial discovery.
+ The distillation can often times require an entirely different set of skills than the original creation of the idea. Almost all of the BSD projects have some great ideas or subsystems that just need distillation into easy to understand and use platforms or tools.
Like the theoretician, the experimentalist or the research engineer, the research distiller is an integral role for a healthy research community. Right now, almost no one is filling it.
Anyway, if that bit piqued your interest, go read the full article and the suggested further reading.
***
News Roundup
And then the murders began. (https://blather.michaelwlucas.com/archives/2902)
A whole bunch of people have pointed me at articles like this one (http://thehookmag.com/2017/03/adding-murders-began-second-sentence-book-makes-instantly-better-125462/), which claim that you can improve almost any book by making the second sentence “And then the murders began.”
It’s entirely possible they’re correct. But let’s check, with a sampling of books. As different books come in different tenses and have different voices, I’ve made some minor changes.
“Welcome to Cisco Routers for the Desperate! And then the murders begin.” — Cisco Routers for the Desperate, 2nd ed
“Over the last ten years, OpenSSH has become the standard tool for remote management of Unix-like systems and many network devices. And then the murders began.” — SSH Mastery
“The Z File System, or ZFS, is a complicated beast, but it is also the most powerful tool in a sysadmin’s Batman-esque utility belt. And then the murders begin.” — FreeBSD Mastery: Advanced ZFS
“Blood shall rain from the sky, and great shall be the lamentation of the Linux fans. And then, the murders will begin.” — Absolute FreeBSD, 3rd Ed
Netdata now supports FreeBSD (https://github.com/firehol/netdata)
netdata is a system for distributed real-time performance and health monitoring. It provides unparalleled insights, in real-time, of everything happening on the system it runs (including applications such as web and database servers), using modern interactive web dashboards.
From the release notes: 
apps.plugin ported for FreeBSD
Check out their demo sites (https://github.com/firehol/netdata/wiki)
***
Distrowatch Weekly reviews RaspBSD (https://distrowatch.com/weekly.php?issue=20170220#raspbsd)
RaspBSD is a FreeBSD-based project which strives to create a custom build of FreeBSD for single board and hobbyist computers. RaspBSD takes a recent snapshot of FreeBSD and adds on additional components, such as the LXDE desktop and a few graphical applications. The RaspBSD project currently has live images for Raspberry Pi devices, the Banana Pi, Pine64 and BeagleBone Black &amp;amp; Green computers.
The default RaspBSD system is quite minimal, running a mere 16 processes when I was logged in. In the background the operating system runs cron, OpenSSH, syslog and the powerd power management service. Other than the user's shell and terminals, nothing else is running. This means RaspBSD uses little memory, requiring just 16MB of active memory and 31MB of wired or kernel memory.
I made note of a few practical differences between running RaspBSD on the Pi verses my usual Raspbian operating system. One minor difference is RaspBSD turns off the Pi's external power light after booting. Raspbian leaves the light on. This means it looks like the Pi is off when it is running RaspBSD, but it also saves a little electricity.
Conclusions: Apart from these little differences, running RaspBSD on the Pi was a very similar experience to running Raspbian and my time with the operating system was pleasantly trouble-free. Long-term, I think applying source updates to the base system might be tedious and SD disk operations were slow. However, the Pi usually is not utilized for its speed, but rather its low cost and low-energy usage. For people who are looking for a small home server or very minimal desktop box, RaspBSD running on the Pi should be suitable. 
Research UNIX V8, V9 and V10 made public by Alcatel-Lucent (https://media-bell-labs-com.s3.amazonaws.com/pages/20170327_1602/statement%20regarding%20Unix%203-7-17.pdf)
Alcatel-Lucent USA Inc. (“ALU-USA”), on behalf of itself and Nokia Bell Laboratories agrees, to the extent of its ability to do so, that it will not assert its copyright rights with respect to any non-commercial copying, distribution, performance, display or creation of derivative works of Research Unix®1 Editions 8, 9, and 10.
Research Unix is a term used to refer to versions of the Unix operating system for DEC PDP-7, PDP-11, VAX and Interdata 7/32 and 8/32 computers, developed in the Bell Labs Computing Science Research Center.  The version breakdown can be viewed on its Wikipedia page (https://en.wikipedia.org/wiki/Research_Unix)
It only took 30+ years, but now they’re public
You can grab them from here (http://www.tuhs.org/Archive/Distributions/Research/)
If you’re wondering what happened with Research Unix, After Version 10, Unix development at Bell Labs was stopped in favor of a successor system, Plan 9 (http://plan9.bell-labs.com/plan9/); which itself was succeeded by Inferno (http://www.vitanuova.com/inferno/).
***
Beastie Bits
The BSD Family Tree (https://github.com/freebsd/freebsd/blob/master/share/misc/bsd-family-tree)
Unix Permissions Calculator (http://permissions-calculator.org/)
NAS4Free release 11.0.0.4 now available (https://sourceforge.net/projects/nas4free/files/NAS4Free-11.0.0.4/11.0.0.4.4141/)
Another BSD Mag released for free downloads (https://bsdmag.org/download/simple-quorum-drive-freebsd-ctl-ha-beast-storage-system/)
OPNsense 17.1.4 released (https://forum.opnsense.org/index.php?topic=4898.msg19359)
***
Feedback/Questions
gozes asks via twitter about how get involved in FreeBSD (https://twitter.com/gozes/status/846779901738991620)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Today on BSD Now, the latest Dragonfly BSD release, RaidZ performance, another OpenSSL Vulnerability, and more; all this week on BSD Now.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.dragonflybsd.org/release48/" rel="nofollow">DragonFly BSD 4.8 is released</a></h3>

<ul>
<li>Improved kernel performance

<ul>
<li>This release further localizes cache lines and reduces/removes cache ping-ponging on globals. For bulk builds on many-cores or multi-socket systems, we have around a 5% improvement, and certain subsystems such as namecache lookups and exec()s see massive focused improvements. See the corresponding mailing list post with details.</li>
</ul></li>
<li>Support for eMMC booting, and mobile and high-performance PCIe SSDs

<ul>
<li>This kernel release includes support for eMMC storage as the boot device. We also sport a brand new SMP-friendly, high-performance NVMe SSD driver (PCIe SSD storage). Initial device test results are available.</li>
</ul></li>
<li>EFI support

<ul>
<li>The installer can now create an EFI or legacy installation. Numerous adjustments have been made to userland utilities and the kernel to support EFI as a mainstream boot environment. The /boot filesystem may now be placed either in its own GPT slice, or in a DragonFly disklabel inside a GPT slice.</li>
<li>DragonFly, by default, creates a GPT slice for all of DragonFly and places a DragonFly disklabel inside it with all the standard DFly partitions, such that the disk names are roughly the same as they would be in a legacy system.</li>
</ul></li>
<li>Improved graphics support

<ul>
<li>The i915 driver has been updated to match the version found with the Linux 4.6 kernel. Broadwell and Skylake processor users will see improvements.</li>
</ul></li>
<li>Other user-affecting changes

<ul>
<li>Kernel is now built using -O2.</li>
<li>VKernels now use COW, so multiple vkernels can share one disk image.</li>
<li>powerd() is now sensitive to time and temperature changes.</li>
<li>Non-boot-filesystem kernel modules can be loaded in rc.conf instead of loader.conf.
***</li>
</ul></li>
</ul>

<h3><a href="https://github.com/openzfs/openzfs/pull/321" rel="nofollow">#8005 poor performance of 1MB writes on certain RAID-Z configurations</a></h3>

<ul>
<li>Matt Ahrens posts a new patch for OpenZFS</li>
</ul>

<blockquote>
<p>Background: RAID-Z requires that space be allocated in multiples of P+1 sectors,because this is the minimum size block that can have the required amount of parity. Thus blocks on RAIDZ1 must be allocated in a multiple of 2 sectors; on RAIDZ2 multiple of 3; and on RAIDZ3 multiple of 4. A sector is a unit of 2<sup>ashift</sup> bytes, typically 512B or 4KB.<br>
To satisfy this constraint, the allocation size is rounded up to the proper multiple, resulting in up to 3 &quot;pad sectors&quot; at the end of some blocks. The contents of these pad sectors are not used, so we do not need to read or write these sectors. However, some storage hardware performs much worse (around 1/2 as fast) on mostly-contiguous writes when there are small gaps of non-overwritten data between the writes. Therefore, ZFS creates &quot;optional&quot; zio&#39;s when writing RAID-Z blocks that include pad sectors. If writing a pad sector will fill the gap between two (required) writes, we will issue the optional zio, thus doubling performance. The gap-filling performance improvement was introduced in July 2009.<br>
Writing the optional zio is done by the io aggregation code in vdev_queue.c. The problem is that it is also subject to the limit on the size of aggregate writes, zfs_vdev_aggregation_limit, which is by default 128KB. For a given block, if the amount of data plus padding written to a leaf device exceeds zfs_vdev_aggregation_limit, the optional zio will not be written, resulting in a ~2x performance degradation.<br>
The solution is to aggregate optional zio&#39;s regardless of the aggregation size limit.</p>
</blockquote>

<ul>
<li>As you can see from the graphs, this can make a large difference in performance.</li>
<li>I encourage you to read the entire commit message, it is well written and very detailed.
***</li>
</ul>

<h3><a href="https://guidovranken.wordpress.com/2017/01/28/can-you-spot-the-vulnerability/" rel="nofollow">Can you spot the OpenSSL vulnerability </a></h3>

<blockquote>
<p>This code was introduced in OpenSSL 1.1.0d, which was released a couple of days ago. This is in the server SSL code, ssl/statem/statem_srvr.c, ssl_bytes_to_cipher_list()), and can easily be reached remotely. Can you spot the vulnerability?<br>
So there is a loop, and within that loop we have an ‘if’ statement, that tests a number of conditions. If any of those conditions fail, OPENSSL_free(raw) is called. But raw isn’t the address that was allocated; raw is increment every loop. Hence, there is a remote invalid free vulnerability.<br>
But not quite. None of those checks in the ‘if’ statement can actually fail; earlier on in the function, there is a check that verifies that the packet contains at least 1 byte, so PACKET_get_1 cannot fail. Furthermore, earlier in the function it is verified that the packet length is a multiple of 3, hence PACKET_copy_bytes and PACKET_forward cannot fail.</p>
</blockquote>

<ul>
<li>So, does the code do what the original author thought, or expected it to do?</li>
<li>But what about the next person that modifies that code, maybe changing or removing one of the earlier checks, allowing one of those if conditions to fail, and execute the bad code?</li>
</ul>

<blockquote>
<p>Nonetheless OpenSSL has acknowledged that the OPENSSL_free line needs a rewrite: <a href="https://github.com/openssl/openssl/pull/2312" rel="nofollow">Pull Request #2312</a><br>
PS I’m not posting this to ridicule the OpenSSL project or their programming skills. I just like reading code and finding corner cases that impact security, which is an effort that ultimately works in everybody’s best interest, and I like to share what I find. Programming is a very difficult enterprise and everybody makes mistakes.</p>
</blockquote>

<ul>
<li>Thanks to Guido Vranken for the sharp eye and the blog post
***</li>
</ul>

<h3><a href="http://distill.pub/2017/research-debt/" rel="nofollow">Research Debt</a></h3>

<ul>
<li>I found this article interesting as it relates to not just research, but a lot of technical areas in general</li>
</ul>

<blockquote>
<p>Achieving a research-level understanding of most topics is like climbing a mountain. Aspiring researchers must struggle to understand vast bodies of work that came before them, to learn techniques, and to gain intuition. Upon reaching the top, the new researcher begins doing novel work, throwing new stones onto the top of the mountain and making it a little taller for whoever comes next. <br>
People expect the climb to be hard. It reflects the tremendous progress and cumulative effort that’s gone into the research. The climb is seen as an intellectual pilgrimage, the labor a rite of passage. But the climb could be massively easier. It’s entirely possible to build paths and staircases into these mountains. The climb isn’t something to be proud of. The climb isn’t progress: the climb is a mountain of debt.<br>
Programmers talk about technical debt: there are ways to write software that are faster in the short run but problematic in the long run.</p>

<p>Poor Exposition – Often, there is no good explanation of important ideas and one has to struggle to understand them. This problem is so pervasive that we take it for granted and don’t appreciate how much better things could be.</p>

<p>Undigested Ideas – Most ideas start off rough and hard to understand. They become radically easier as we polish them, developing the right analogies, language, and ways of thinking.</p>

<p>Bad abstractions and notation – Abstractions and notation are the user interface of research, shaping how we think and communicate. Unfortunately, we often get stuck with the first formalisms to develop even when they’re bad. For example, an object with extra electrons is negative, and pi is wrong</p>

<p>Noise – Being a researcher is like standing in the middle of a construction site. Countless papers scream for your attention and there’s no easy way to filter or summarize them. We think noise is the main way experts experience research debt.</p>

<p>There’s a tradeoff between the energy put into explaining an idea, and the energy needed to understand it. On one extreme, the explainer can painstakingly craft a beautiful explanation, leading their audience to understanding without even realizing it could have been difficult. On the other extreme, the explainer can do the absolute minimum and abandon their audience to struggle. This energy is called interpretive labor<br>
Research distillation is the opposite of research debt. It can be incredibly satisfying, combining deep scientific understanding, empathy, and design to do justice to our research and lay bare beautiful insights. Distillation is also hard. It’s tempting to think of explaining an idea as just putting a layer of polish on it, but good explanations often involve transforming the idea. This kind of refinement of an idea can take just as much effort and deep understanding as the initial discovery.</p>

<ul>
<li>The distillation can often times require an entirely different set of skills than the original creation of the idea. Almost all of the BSD projects have some great ideas or subsystems that just need distillation into easy to understand and use platforms or tools.
Like the theoretician, the experimentalist or the research engineer, the research distiller is an integral role for a healthy research community. Right now, almost no one is filling it.</li>
</ul>
</blockquote>

<ul>
<li>Anyway, if that bit piqued your interest, go read the full article and the suggested further reading.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://blather.michaelwlucas.com/archives/2902" rel="nofollow">And then the murders began.</a></h3>

<blockquote>
<p>A whole bunch of people have pointed me at articles like <a href="http://thehookmag.com/2017/03/adding-murders-began-second-sentence-book-makes-instantly-better-125462/" rel="nofollow">this one</a>, which claim that you can improve almost any book by making the second sentence “And then the murders began.”<br>
It’s entirely possible they’re correct. But let’s check, with a sampling of books. As different books come in different tenses and have different voices, I’ve made some minor changes.</p>

<p>“Welcome to Cisco Routers for the Desperate! And then the murders begin.” — Cisco Routers for the Desperate, 2nd ed</p>

<p>“Over the last ten years, OpenSSH has become the standard tool for remote management of Unix-like systems and many network devices. And then the murders began.” — SSH Mastery</p>

<p>“The Z File System, or ZFS, is a complicated beast, but it is also the most powerful tool in a sysadmin’s Batman-esque utility belt. And then the murders begin.” — FreeBSD Mastery: Advanced ZFS</p>

<p>“Blood shall rain from the sky, and great shall be the lamentation of the Linux fans. And then, the murders will begin.” — Absolute FreeBSD, 3rd Ed</p>
</blockquote>

<hr>

<h3><a href="https://github.com/firehol/netdata" rel="nofollow">Netdata now supports FreeBSD</a></h3>

<blockquote>
<p>netdata is a system for distributed real-time performance and health monitoring. It provides unparalleled insights, in real-time, of everything happening on the system it runs (including applications such as web and database servers), using modern interactive web dashboards.</p>
</blockquote>

<ul>
<li>From the release notes: </li>
</ul>

<blockquote>
<p>apps.plugin ported for FreeBSD</p>
</blockquote>

<ul>
<li><a href="https://github.com/firehol/netdata/wiki" rel="nofollow">Check out their demo sites</a>
***</li>
</ul>

<h3><a href="https://distrowatch.com/weekly.php?issue=20170220#raspbsd" rel="nofollow">Distrowatch Weekly reviews RaspBSD</a></h3>

<blockquote>
<p>RaspBSD is a FreeBSD-based project which strives to create a custom build of FreeBSD for single board and hobbyist computers. RaspBSD takes a recent snapshot of FreeBSD and adds on additional components, such as the LXDE desktop and a few graphical applications. The RaspBSD project currently has live images for Raspberry Pi devices, the Banana Pi, Pine64 and BeagleBone Black &amp; Green computers.</p>

<p>The default RaspBSD system is quite minimal, running a mere 16 processes when I was logged in. In the background the operating system runs cron, OpenSSH, syslog and the powerd power management service. Other than the user&#39;s shell and terminals, nothing else is running. This means RaspBSD uses little memory, requiring just 16MB of active memory and 31MB of wired or kernel memory.</p>

<p>I made note of a few practical differences between running RaspBSD on the Pi verses my usual Raspbian operating system. One minor difference is RaspBSD turns off the Pi&#39;s external power light after booting. Raspbian leaves the light on. This means it looks like the Pi is off when it is running RaspBSD, but it also saves a little electricity.</p>

<p>Conclusions: Apart from these little differences, running RaspBSD on the Pi was a very similar experience to running Raspbian and my time with the operating system was pleasantly trouble-free. Long-term, I think applying source updates to the base system might be tedious and SD disk operations were slow. However, the Pi usually is not utilized for its speed, but rather its low cost and low-energy usage. For people who are looking for a small home server or very minimal desktop box, RaspBSD running on the Pi should be suitable. </p>

<hr>
</blockquote>

<h3><a href="https://media-bell-labs-com.s3.amazonaws.com/pages/20170327_1602/statement%20regarding%20Unix%203-7-17.pdf" rel="nofollow">Research UNIX V8, V9 and V10 made public by Alcatel-Lucent</a></h3>

<ul>
<li>Alcatel-Lucent USA Inc. (“ALU-USA”), on behalf of itself and Nokia Bell Laboratories agrees, to the extent of its ability to do so, that it will not assert its copyright rights with respect to any non-commercial copying, distribution, performance, display or creation of derivative works of Research Unix®1 Editions 8, 9, and 10.</li>
<li>Research Unix is a term used to refer to versions of the Unix operating system for DEC PDP-7, PDP-11, VAX and Interdata 7/32 and 8/32 computers, developed in the Bell Labs Computing Science Research Center.  The version breakdown can be viewed on its <a href="https://en.wikipedia.org/wiki/Research_Unix" rel="nofollow">Wikipedia page</a></li>
<li>It only took 30+ years, but now they’re public</li>
<li>You can grab them from <a href="http://www.tuhs.org/Archive/Distributions/Research/" rel="nofollow">here</a></li>
<li>If you’re wondering what happened with Research Unix, After Version 10, Unix development at Bell Labs was stopped in favor of a successor system, <a href="http://plan9.bell-labs.com/plan9/" rel="nofollow">Plan 9</a>; which itself was succeeded by <a href="http://www.vitanuova.com/inferno/" rel="nofollow">Inferno</a>.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://github.com/freebsd/freebsd/blob/master/share/misc/bsd-family-tree" rel="nofollow">The BSD Family Tree</a></li>
<li><a href="http://permissions-calculator.org/" rel="nofollow">Unix Permissions Calculator</a></li>
<li><a href="https://sourceforge.net/projects/nas4free/files/NAS4Free-11.0.0.4/11.0.0.4.4141/" rel="nofollow">NAS4Free release 11.0.0.4 now available</a></li>
<li><a href="https://bsdmag.org/download/simple-quorum-drive-freebsd-ctl-ha-beast-storage-system/" rel="nofollow">Another BSD Mag released for free downloads</a></li>
<li><a href="https://forum.opnsense.org/index.php?topic=4898.msg19359" rel="nofollow">OPNsense 17.1.4 released</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://twitter.com/gozes/status/846779901738991620" rel="nofollow">gozes asks via twitter about how get involved in FreeBSD</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Today on BSD Now, the latest Dragonfly BSD release, RaidZ performance, another OpenSSL Vulnerability, and more; all this week on BSD Now.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.dragonflybsd.org/release48/" rel="nofollow">DragonFly BSD 4.8 is released</a></h3>

<ul>
<li>Improved kernel performance

<ul>
<li>This release further localizes cache lines and reduces/removes cache ping-ponging on globals. For bulk builds on many-cores or multi-socket systems, we have around a 5% improvement, and certain subsystems such as namecache lookups and exec()s see massive focused improvements. See the corresponding mailing list post with details.</li>
</ul></li>
<li>Support for eMMC booting, and mobile and high-performance PCIe SSDs

<ul>
<li>This kernel release includes support for eMMC storage as the boot device. We also sport a brand new SMP-friendly, high-performance NVMe SSD driver (PCIe SSD storage). Initial device test results are available.</li>
</ul></li>
<li>EFI support

<ul>
<li>The installer can now create an EFI or legacy installation. Numerous adjustments have been made to userland utilities and the kernel to support EFI as a mainstream boot environment. The /boot filesystem may now be placed either in its own GPT slice, or in a DragonFly disklabel inside a GPT slice.</li>
<li>DragonFly, by default, creates a GPT slice for all of DragonFly and places a DragonFly disklabel inside it with all the standard DFly partitions, such that the disk names are roughly the same as they would be in a legacy system.</li>
</ul></li>
<li>Improved graphics support

<ul>
<li>The i915 driver has been updated to match the version found with the Linux 4.6 kernel. Broadwell and Skylake processor users will see improvements.</li>
</ul></li>
<li>Other user-affecting changes

<ul>
<li>Kernel is now built using -O2.</li>
<li>VKernels now use COW, so multiple vkernels can share one disk image.</li>
<li>powerd() is now sensitive to time and temperature changes.</li>
<li>Non-boot-filesystem kernel modules can be loaded in rc.conf instead of loader.conf.
***</li>
</ul></li>
</ul>

<h3><a href="https://github.com/openzfs/openzfs/pull/321" rel="nofollow">#8005 poor performance of 1MB writes on certain RAID-Z configurations</a></h3>

<ul>
<li>Matt Ahrens posts a new patch for OpenZFS</li>
</ul>

<blockquote>
<p>Background: RAID-Z requires that space be allocated in multiples of P+1 sectors,because this is the minimum size block that can have the required amount of parity. Thus blocks on RAIDZ1 must be allocated in a multiple of 2 sectors; on RAIDZ2 multiple of 3; and on RAIDZ3 multiple of 4. A sector is a unit of 2<sup>ashift</sup> bytes, typically 512B or 4KB.<br>
To satisfy this constraint, the allocation size is rounded up to the proper multiple, resulting in up to 3 &quot;pad sectors&quot; at the end of some blocks. The contents of these pad sectors are not used, so we do not need to read or write these sectors. However, some storage hardware performs much worse (around 1/2 as fast) on mostly-contiguous writes when there are small gaps of non-overwritten data between the writes. Therefore, ZFS creates &quot;optional&quot; zio&#39;s when writing RAID-Z blocks that include pad sectors. If writing a pad sector will fill the gap between two (required) writes, we will issue the optional zio, thus doubling performance. The gap-filling performance improvement was introduced in July 2009.<br>
Writing the optional zio is done by the io aggregation code in vdev_queue.c. The problem is that it is also subject to the limit on the size of aggregate writes, zfs_vdev_aggregation_limit, which is by default 128KB. For a given block, if the amount of data plus padding written to a leaf device exceeds zfs_vdev_aggregation_limit, the optional zio will not be written, resulting in a ~2x performance degradation.<br>
The solution is to aggregate optional zio&#39;s regardless of the aggregation size limit.</p>
</blockquote>

<ul>
<li>As you can see from the graphs, this can make a large difference in performance.</li>
<li>I encourage you to read the entire commit message, it is well written and very detailed.
***</li>
</ul>

<h3><a href="https://guidovranken.wordpress.com/2017/01/28/can-you-spot-the-vulnerability/" rel="nofollow">Can you spot the OpenSSL vulnerability </a></h3>

<blockquote>
<p>This code was introduced in OpenSSL 1.1.0d, which was released a couple of days ago. This is in the server SSL code, ssl/statem/statem_srvr.c, ssl_bytes_to_cipher_list()), and can easily be reached remotely. Can you spot the vulnerability?<br>
So there is a loop, and within that loop we have an ‘if’ statement, that tests a number of conditions. If any of those conditions fail, OPENSSL_free(raw) is called. But raw isn’t the address that was allocated; raw is increment every loop. Hence, there is a remote invalid free vulnerability.<br>
But not quite. None of those checks in the ‘if’ statement can actually fail; earlier on in the function, there is a check that verifies that the packet contains at least 1 byte, so PACKET_get_1 cannot fail. Furthermore, earlier in the function it is verified that the packet length is a multiple of 3, hence PACKET_copy_bytes and PACKET_forward cannot fail.</p>
</blockquote>

<ul>
<li>So, does the code do what the original author thought, or expected it to do?</li>
<li>But what about the next person that modifies that code, maybe changing or removing one of the earlier checks, allowing one of those if conditions to fail, and execute the bad code?</li>
</ul>

<blockquote>
<p>Nonetheless OpenSSL has acknowledged that the OPENSSL_free line needs a rewrite: <a href="https://github.com/openssl/openssl/pull/2312" rel="nofollow">Pull Request #2312</a><br>
PS I’m not posting this to ridicule the OpenSSL project or their programming skills. I just like reading code and finding corner cases that impact security, which is an effort that ultimately works in everybody’s best interest, and I like to share what I find. Programming is a very difficult enterprise and everybody makes mistakes.</p>
</blockquote>

<ul>
<li>Thanks to Guido Vranken for the sharp eye and the blog post
***</li>
</ul>

<h3><a href="http://distill.pub/2017/research-debt/" rel="nofollow">Research Debt</a></h3>

<ul>
<li>I found this article interesting as it relates to not just research, but a lot of technical areas in general</li>
</ul>

<blockquote>
<p>Achieving a research-level understanding of most topics is like climbing a mountain. Aspiring researchers must struggle to understand vast bodies of work that came before them, to learn techniques, and to gain intuition. Upon reaching the top, the new researcher begins doing novel work, throwing new stones onto the top of the mountain and making it a little taller for whoever comes next. <br>
People expect the climb to be hard. It reflects the tremendous progress and cumulative effort that’s gone into the research. The climb is seen as an intellectual pilgrimage, the labor a rite of passage. But the climb could be massively easier. It’s entirely possible to build paths and staircases into these mountains. The climb isn’t something to be proud of. The climb isn’t progress: the climb is a mountain of debt.<br>
Programmers talk about technical debt: there are ways to write software that are faster in the short run but problematic in the long run.</p>

<p>Poor Exposition – Often, there is no good explanation of important ideas and one has to struggle to understand them. This problem is so pervasive that we take it for granted and don’t appreciate how much better things could be.</p>

<p>Undigested Ideas – Most ideas start off rough and hard to understand. They become radically easier as we polish them, developing the right analogies, language, and ways of thinking.</p>

<p>Bad abstractions and notation – Abstractions and notation are the user interface of research, shaping how we think and communicate. Unfortunately, we often get stuck with the first formalisms to develop even when they’re bad. For example, an object with extra electrons is negative, and pi is wrong</p>

<p>Noise – Being a researcher is like standing in the middle of a construction site. Countless papers scream for your attention and there’s no easy way to filter or summarize them. We think noise is the main way experts experience research debt.</p>

<p>There’s a tradeoff between the energy put into explaining an idea, and the energy needed to understand it. On one extreme, the explainer can painstakingly craft a beautiful explanation, leading their audience to understanding without even realizing it could have been difficult. On the other extreme, the explainer can do the absolute minimum and abandon their audience to struggle. This energy is called interpretive labor<br>
Research distillation is the opposite of research debt. It can be incredibly satisfying, combining deep scientific understanding, empathy, and design to do justice to our research and lay bare beautiful insights. Distillation is also hard. It’s tempting to think of explaining an idea as just putting a layer of polish on it, but good explanations often involve transforming the idea. This kind of refinement of an idea can take just as much effort and deep understanding as the initial discovery.</p>

<ul>
<li>The distillation can often times require an entirely different set of skills than the original creation of the idea. Almost all of the BSD projects have some great ideas or subsystems that just need distillation into easy to understand and use platforms or tools.
Like the theoretician, the experimentalist or the research engineer, the research distiller is an integral role for a healthy research community. Right now, almost no one is filling it.</li>
</ul>
</blockquote>

<ul>
<li>Anyway, if that bit piqued your interest, go read the full article and the suggested further reading.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://blather.michaelwlucas.com/archives/2902" rel="nofollow">And then the murders began.</a></h3>

<blockquote>
<p>A whole bunch of people have pointed me at articles like <a href="http://thehookmag.com/2017/03/adding-murders-began-second-sentence-book-makes-instantly-better-125462/" rel="nofollow">this one</a>, which claim that you can improve almost any book by making the second sentence “And then the murders began.”<br>
It’s entirely possible they’re correct. But let’s check, with a sampling of books. As different books come in different tenses and have different voices, I’ve made some minor changes.</p>

<p>“Welcome to Cisco Routers for the Desperate! And then the murders begin.” — Cisco Routers for the Desperate, 2nd ed</p>

<p>“Over the last ten years, OpenSSH has become the standard tool for remote management of Unix-like systems and many network devices. And then the murders began.” — SSH Mastery</p>

<p>“The Z File System, or ZFS, is a complicated beast, but it is also the most powerful tool in a sysadmin’s Batman-esque utility belt. And then the murders begin.” — FreeBSD Mastery: Advanced ZFS</p>

<p>“Blood shall rain from the sky, and great shall be the lamentation of the Linux fans. And then, the murders will begin.” — Absolute FreeBSD, 3rd Ed</p>
</blockquote>

<hr>

<h3><a href="https://github.com/firehol/netdata" rel="nofollow">Netdata now supports FreeBSD</a></h3>

<blockquote>
<p>netdata is a system for distributed real-time performance and health monitoring. It provides unparalleled insights, in real-time, of everything happening on the system it runs (including applications such as web and database servers), using modern interactive web dashboards.</p>
</blockquote>

<ul>
<li>From the release notes: </li>
</ul>

<blockquote>
<p>apps.plugin ported for FreeBSD</p>
</blockquote>

<ul>
<li><a href="https://github.com/firehol/netdata/wiki" rel="nofollow">Check out their demo sites</a>
***</li>
</ul>

<h3><a href="https://distrowatch.com/weekly.php?issue=20170220#raspbsd" rel="nofollow">Distrowatch Weekly reviews RaspBSD</a></h3>

<blockquote>
<p>RaspBSD is a FreeBSD-based project which strives to create a custom build of FreeBSD for single board and hobbyist computers. RaspBSD takes a recent snapshot of FreeBSD and adds on additional components, such as the LXDE desktop and a few graphical applications. The RaspBSD project currently has live images for Raspberry Pi devices, the Banana Pi, Pine64 and BeagleBone Black &amp; Green computers.</p>

<p>The default RaspBSD system is quite minimal, running a mere 16 processes when I was logged in. In the background the operating system runs cron, OpenSSH, syslog and the powerd power management service. Other than the user&#39;s shell and terminals, nothing else is running. This means RaspBSD uses little memory, requiring just 16MB of active memory and 31MB of wired or kernel memory.</p>

<p>I made note of a few practical differences between running RaspBSD on the Pi verses my usual Raspbian operating system. One minor difference is RaspBSD turns off the Pi&#39;s external power light after booting. Raspbian leaves the light on. This means it looks like the Pi is off when it is running RaspBSD, but it also saves a little electricity.</p>

<p>Conclusions: Apart from these little differences, running RaspBSD on the Pi was a very similar experience to running Raspbian and my time with the operating system was pleasantly trouble-free. Long-term, I think applying source updates to the base system might be tedious and SD disk operations were slow. However, the Pi usually is not utilized for its speed, but rather its low cost and low-energy usage. For people who are looking for a small home server or very minimal desktop box, RaspBSD running on the Pi should be suitable. </p>

<hr>
</blockquote>

<h3><a href="https://media-bell-labs-com.s3.amazonaws.com/pages/20170327_1602/statement%20regarding%20Unix%203-7-17.pdf" rel="nofollow">Research UNIX V8, V9 and V10 made public by Alcatel-Lucent</a></h3>

<ul>
<li>Alcatel-Lucent USA Inc. (“ALU-USA”), on behalf of itself and Nokia Bell Laboratories agrees, to the extent of its ability to do so, that it will not assert its copyright rights with respect to any non-commercial copying, distribution, performance, display or creation of derivative works of Research Unix®1 Editions 8, 9, and 10.</li>
<li>Research Unix is a term used to refer to versions of the Unix operating system for DEC PDP-7, PDP-11, VAX and Interdata 7/32 and 8/32 computers, developed in the Bell Labs Computing Science Research Center.  The version breakdown can be viewed on its <a href="https://en.wikipedia.org/wiki/Research_Unix" rel="nofollow">Wikipedia page</a></li>
<li>It only took 30+ years, but now they’re public</li>
<li>You can grab them from <a href="http://www.tuhs.org/Archive/Distributions/Research/" rel="nofollow">here</a></li>
<li>If you’re wondering what happened with Research Unix, After Version 10, Unix development at Bell Labs was stopped in favor of a successor system, <a href="http://plan9.bell-labs.com/plan9/" rel="nofollow">Plan 9</a>; which itself was succeeded by <a href="http://www.vitanuova.com/inferno/" rel="nofollow">Inferno</a>.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://github.com/freebsd/freebsd/blob/master/share/misc/bsd-family-tree" rel="nofollow">The BSD Family Tree</a></li>
<li><a href="http://permissions-calculator.org/" rel="nofollow">Unix Permissions Calculator</a></li>
<li><a href="https://sourceforge.net/projects/nas4free/files/NAS4Free-11.0.0.4/11.0.0.4.4141/" rel="nofollow">NAS4Free release 11.0.0.4 now available</a></li>
<li><a href="https://bsdmag.org/download/simple-quorum-drive-freebsd-ctl-ha-beast-storage-system/" rel="nofollow">Another BSD Mag released for free downloads</a></li>
<li><a href="https://forum.opnsense.org/index.php?topic=4898.msg19359" rel="nofollow">OPNsense 17.1.4 released</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://twitter.com/gozes/status/846779901738991620" rel="nofollow">gozes asks via twitter about how get involved in FreeBSD</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>187: Catching up to BSD</title>
  <link>https://www.bsdnow.tv/187</link>
  <guid isPermaLink="false">b7d43c1e-0c39-4060-af6a-29ab64c4945c</guid>
  <pubDate>Wed, 29 Mar 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b7d43c1e-0c39-4060-af6a-29ab64c4945c.mp3" length="54147316" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Catching up to BSD, news about the NetBSD project, a BSD Phone, and a bunch of OpenBSD and TrueOS News.</itunes:subtitle>
  <itunes:duration>1:15:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Catching up to BSD, news about the NetBSD project, a BSD Phone, and a bunch of OpenBSD and TrueOS News.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
NetBSD 7.1 released (http://www.netbsd.org/releases/formal-7/NetBSD-7.1.html)
This update represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.
Kernel
compat_linux(8) (http://netbsd.gw.com/cgi-bin/man-cgi?compat_linux+8.i386+NetBSD-7.1): Fully support schedsetaffinity and schedgetaffinity, fixing, e.g., the Intel Math Kernel Library.
DTrace:
Avoid redefined symbol errors when loading the module.
Fix module autoload.
IPFilter:
Fix matching of ICMP queries when NAT'd through IPF.
Fix lookup of original destination address when using a redirect rule. This is required for transparent proxying by squid, for example.
ipsec(4) (http://netbsd.gw.com/cgi-bin/man-cgi?ipsec+4.i386+NetBSD-7.1): Fix NAT-T issue with NetBSD being the host behind NAT.
Drivers
Add vioscsi driver for the Google Compute Engine disk.
ichsmb(4) (http://netbsd.gw.com/cgi-bin/man-cgi?ichsmb+4.i386+NetBSD-7.1): Add support for Braswell CPU and Intel 100 Series.
wm(4) (http://netbsd.gw.com/cgi-bin/man-cgi?wm+4.i386+NetBSD-7.1):
Add C2000 KX and 2.5G support.
Add Wake On Lan support.
Fixed a lot of bugs
Security Fixes
NetBSD-SA2017-001 (http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2017-001.txt.asc) Memory leak in the connect system call.
NetBSD-SA2017-002 (http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2017-002.txt.asc) Several vulnerabilities in ARP.
ARM related
Support for Raspberry Pi Zero.
ODROID-C1 Ethernet now works.
Summary of the preliminary LLDB support project (http://blog.netbsd.org/tnf/entry/summary_of_the_preliminary_lldb)
What has been done in NetBSD
Verified the full matrix of combinations of wait(2) and ptrace(2) in the following
GNU libstdc++ std::call_once bug investigation test-cases
Improving documentation and other minor system parts
Documentation of ptrace(2) and explanation how debuggers work
Introduction of new siginfo(2) codes for SIGTRAP
New ptrace(2) interfaces
What has been done in LLDB
Native Process NetBSD Plugin
The MonitorCallback function
Other LLDB code, out of the NativeProcessNetBSD Plugin
Automated LLDB Test Results Summary
Plan for the next milestone
fix conflict with system-wide py-six
add support for auxv read operation
switch resolution of pid -&amp;gt; path to executable from /proc to sysctl(7)
recognize Real-Time Signals (SIGRTMIN-SIGRTMAX)
upstream !NetBSDProcessPlugin code
switch std::callonce to llvm::callonce
add new ptrace(2) interface to lock and unlock threads from execution
switch the current PTWATCHPOINT interface to PTGETDBREGS and PT_SETDBREGS
Actually building a FreeBSD Phone  (https://hackaday.io/project/13145-bsd-based-secure-smartphone)
There have been a number of different projects that have proposed building a FreeBSD based smart phone
This project is a bit different, and I think that gives it a better chance to make progress
It uses off-the-shelf parts, so while not as neatly integrated as a regular smartphone device, it makes a much better prototype, and is more readily available.
Hardware overview: X86-based, long-lasting (user-replaceable) battery, WWAN Modem (w/LTE), 4-5" LCD Touchscreen (Preferably w/720p resolution, IPS), upgradable storage.
Currently targeting the UDOO Ultra platform. It features Intel Pentium N3710 (2.56GHz Quad-core, HD Graphics 405 [16 EUs @ 700MHz], VT-x, AES-NI), 2x4GB DDR3L RAM, 32GB eMMC storage built-in, further expansion w/M.2 SSD &amp;amp; MicroSD slot, lots of connectivity onboard.
Software: FreeBSD Hypervisor (bhyve or Xen) to run atop the hardware, hosting two separate hosts.
One will run an instance of pfSense, the "World's Most Popular Open Source Firewall" to handle the WWAN connection, routing, and Firewall (as well as Secure VPN if desired).
The other instance will run a slimmed down installation of FreeBSD. The UI will be tweaked to work best in this form factor &amp;amp; resources tuned for this platform. There will be a strong reliance on Google Chromium &amp;amp; Google's services (like Google Voice).
The project has a detailed log, and it looks like the hardware it is based on will ship in the next few weeks, so we expect to see more activity.
***
News Roundup
NVME M.2 card road tests (Matt Dillon) (http://lists.dragonflybsd.org/pipermail/users/2017-March/313261.html)
DragonFlyBSD’s Matt Dillon has posted a rundown of the various M.2 NVMe devices he has tested
SAMSUNG 951
SAMSUNG 960 EVO
TOSHIBA OCZ RD400
INTEL 600P
WD BLACK 256G
MYDIGITALSSD
PLEXTOR M8Pe
It is interesting to see the relative performance of each device, but also how they handle the workload and manage their temperature (or don’t in a few cases)
The link provides a lot of detail about different block sizes and overall performance
***
ZREP ZFS replication and failover (http://www.bolthole.com/solaris/zrep/)
"zrep", a robust yet easy to use ZFS based replication and failover solution. It can also serve as the conduit to create a simple backup hub.
The tool was originally written for Solaris, and is written in ksh
However, it seems people have used it on FreeBSD and even FreeNAS by installing the ksh93 port
Has anyone used this? How does it compare to tools like zxfer?
There is a FreeBSD port, but it is a few versions behind, someone should update it
We would be interested in hearing some feedback
***
Catching up on some TrueOS News
TrueOS Security and Wikileaks revelations (https://www.trueos.org/blog/trueos-security-wikileaks-revelations/)
New Jail management utilities (https://www.trueos.org/blog/new-jail-management-utilities/)
Ken Moore's talk about Sysadm from Linuxfest 2016 (https://www.youtube.com/watch?v=PyraePQyCGY)
The Basics of using ZFS with TrueOS (https://www.trueos.org/blog/community-spotlight-basics-using-zfs-trueos/)
***
Catching up on some OpenBSD News
OpenBSD 6.1 coming May 1 (https://www.openbsd.org/61.html)
OpenBSD Foundation 2016 Fundraising (goal: $250K actual: $573K) (http://undeadly.org/cgi?action=article&amp;amp;sid=20170223044255)
The OpenBSD Foundation 2017 Fundraising Campaign (http://www.openbsdfoundation.org/campaign2017.html)
OpenBSD MitM attack against WPA1/WPA2 (https://marc.info/?l=openbsd-announce&amp;amp;m=148839684520133&amp;amp;w=2)
OpenBSD vmm/vmd Update (https://www.openbsd.org/papers/asiabsdcon2017-vmm-slides.pdf)
***
Beastie Bits
HardenedBSD News: Introducing CFI (https://hardenedbsd.org/article/shawn-webb/2017-03-02/introducing-cfi) 
New version of Iocage (Python 3) on FreshPorts (https://www.freshports.org/sysutils/py3-iocage/)
DragonFly BSD Network performance comparison as of today (https://leaf.dragonflybsd.org/~sephe/perf_cmp.pdf)
KnoxBUG recap (http://knoxbug.org/content/knoxbug-wants-you)
***
Feedback/Questions
Noel asks about moving to bhyve/jails (https://pastebin.com/7B47nuC0)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Catching up to BSD, news about the NetBSD project, a BSD Phone, and a bunch of OpenBSD and TrueOS News.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.netbsd.org/releases/formal-7/NetBSD-7.1.html" rel="nofollow">NetBSD 7.1 released</a></h3>

<ul>
<li>This update represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</li>
<li><p>Kernel</p>

<ul>
<li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?compat_linux+8.i386+NetBSD-7.1" rel="nofollow">compat_linux(8)</a>: Fully support sched_setaffinity and sched_getaffinity, fixing, e.g., the Intel Math Kernel Library.</li>
</ul></li>
<li><p>DTrace:</p>

<ul>
<li>Avoid redefined symbol errors when loading the module.</li>
<li>Fix module autoload.</li>
</ul></li>
<li><p>IPFilter:</p>

<ul>
<li>Fix matching of ICMP queries when NAT&#39;d through IPF.</li>
<li>Fix lookup of original destination address when using a redirect rule. This is required for transparent proxying by squid, for example.</li>
<li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?ipsec+4.i386+NetBSD-7.1" rel="nofollow">ipsec(4)</a>: Fix NAT-T issue with NetBSD being the host behind NAT.</li>
</ul></li>
<li><p>Drivers</p>

<ul>
<li>Add vioscsi driver for the Google Compute Engine disk.</li>
<li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?ichsmb+4.i386+NetBSD-7.1" rel="nofollow">ichsmb(4)</a>: Add support for Braswell CPU and Intel 100 Series.</li>
<li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?wm+4.i386+NetBSD-7.1" rel="nofollow">wm(4)</a>:</li>
<li>Add C2000 KX and 2.5G support.</li>
<li>Add Wake On Lan support.</li>
<li>Fixed a lot of bugs</li>
</ul></li>
<li><p>Security Fixes</p>

<ul>
<li><a href="http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2017-001.txt.asc" rel="nofollow">NetBSD-SA2017-001</a> Memory leak in the connect system call.</li>
<li><a href="http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2017-002.txt.asc" rel="nofollow">NetBSD-SA2017-002</a> Several vulnerabilities in ARP.</li>
</ul></li>
<li><p>ARM related</p>

<ul>
<li>Support for Raspberry Pi Zero.</li>
<li>ODROID-C1 Ethernet now works.</li>
</ul></li>
</ul>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/summary_of_the_preliminary_lldb" rel="nofollow">Summary of the preliminary LLDB support project</a></h3>

<ul>
<li><p>What has been done in NetBSD</p>

<ul>
<li>Verified the full matrix of combinations of wait(2) and ptrace(2) in the following</li>
<li>GNU libstdc++ std::call_once bug investigation test-cases</li>
<li>Improving documentation and other minor system parts</li>
<li>Documentation of ptrace(2) and explanation how debuggers work</li>
<li>Introduction of new siginfo(2) codes for SIGTRAP</li>
<li>New ptrace(2) interfaces</li>
</ul></li>
<li><p>What has been done in LLDB</p></li>
<li><p>Native Process NetBSD Plugin</p></li>
<li><p>The MonitorCallback function</p></li>
<li><p>Other LLDB code, out of the NativeProcessNetBSD Plugin</p></li>
<li><p>Automated LLDB Test Results Summary</p></li>
<li><p>Plan for the next milestone</p>

<ul>
<li>fix conflict with system-wide py-six</li>
<li>add support for auxv read operation</li>
<li>switch resolution of pid -&gt; path to executable from /proc to sysctl(7)</li>
<li>recognize Real-Time Signals (SIGRTMIN-SIGRTMAX)</li>
<li>upstream !NetBSDProcessPlugin code</li>
<li>switch std::call_once to llvm::call_once</li>
<li>add new ptrace(2) interface to lock and unlock threads from execution</li>
<li>switch the current PT_WATCHPOINT interface to PT_GETDBREGS and PT_SETDBREGS</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://hackaday.io/project/13145-bsd-based-secure-smartphone" rel="nofollow">Actually building a FreeBSD Phone </a></h3>

<ul>
<li>There have been a number of different projects that have proposed building a FreeBSD based smart phone</li>
<li>This project is a bit different, and I think that gives it a better chance to make progress</li>
<li>It uses off-the-shelf parts, so while not as neatly integrated as a regular smartphone device, it makes a much better prototype, and is more readily available.</li>
<li>Hardware overview: X86-based, long-lasting (user-replaceable) battery, WWAN Modem (w/LTE), 4-5&quot; LCD Touchscreen (Preferably w/720p resolution, IPS), upgradable storage.</li>
<li>Currently targeting the UDOO Ultra platform. It features Intel Pentium N3710 (2.56GHz Quad-core, HD Graphics 405 [16 EUs @ 700MHz], VT-x, AES-NI), 2x4GB DDR3L RAM, 32GB eMMC storage built-in, further expansion w/M.2 SSD &amp; MicroSD slot, lots of connectivity onboard.</li>
<li>Software: FreeBSD Hypervisor (bhyve or Xen) to run atop the hardware, hosting two separate hosts.

<ul>
<li>One will run an instance of pfSense, the &quot;World&#39;s Most Popular Open Source Firewall&quot; to handle the WWAN connection, routing, and Firewall (as well as Secure VPN if desired).</li>
<li>The other instance will run a slimmed down installation of FreeBSD. The UI will be tweaked to work best in this form factor &amp; resources tuned for this platform. There will be a strong reliance on Google Chromium &amp; Google&#39;s services (like Google Voice).</li>
</ul></li>
<li>The project has a detailed log, and it looks like the hardware it is based on will ship in the next few weeks, so we expect to see more activity.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2017-March/313261.html" rel="nofollow">NVME M.2 card road tests (Matt Dillon)</a></h3>

<ul>
<li>DragonFlyBSD’s Matt Dillon has posted a rundown of the various M.2 NVMe devices he has tested

<ul>
<li>SAMSUNG 951</li>
<li>SAMSUNG 960 EVO</li>
<li>TOSHIBA OCZ RD400</li>
<li>INTEL 600P</li>
<li>WD BLACK 256G</li>
<li>MYDIGITALSSD</li>
<li>PLEXTOR M8Pe</li>
</ul></li>
<li>It is interesting to see the relative performance of each device, but also how they handle the workload and manage their temperature (or don’t in a few cases)</li>
<li>The link provides a lot of detail about different block sizes and overall performance
***</li>
</ul>

<h3><a href="http://www.bolthole.com/solaris/zrep/" rel="nofollow">ZREP ZFS replication and failover</a></h3>

<ul>
<li>&quot;zrep&quot;, a robust yet easy to use ZFS based replication and failover solution. It can also serve as the conduit to create a simple backup hub.</li>
<li>The tool was originally written for Solaris, and is written in ksh</li>
<li>However, it seems people have used it on FreeBSD and even FreeNAS by installing the ksh93 port</li>
<li>Has anyone used this? How does it compare to tools like zxfer?</li>
<li>There is a FreeBSD port, but it is a few versions behind, someone should update it</li>
<li>We would be interested in hearing some feedback
***</li>
</ul>

<h3>Catching up on some TrueOS News</h3>

<ul>
<li><a href="https://www.trueos.org/blog/trueos-security-wikileaks-revelations/" rel="nofollow">TrueOS Security and Wikileaks revelations</a></li>
<li><a href="https://www.trueos.org/blog/new-jail-management-utilities/" rel="nofollow">New Jail management utilities</a></li>
<li><a href="https://www.youtube.com/watch?v=PyraePQyCGY" rel="nofollow">Ken Moore&#39;s talk about Sysadm from Linuxfest 2016</a></li>
<li><a href="https://www.trueos.org/blog/community-spotlight-basics-using-zfs-trueos/" rel="nofollow">The Basics of using ZFS with TrueOS</a>
***</li>
</ul>

<h3>Catching up on some OpenBSD News</h3>

<ul>
<li><a href="https://www.openbsd.org/61.html" rel="nofollow">OpenBSD 6.1 coming May 1</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170223044255" rel="nofollow">OpenBSD Foundation 2016 Fundraising (goal: $250K actual: $573K)</a></li>
<li><a href="http://www.openbsdfoundation.org/campaign2017.html" rel="nofollow">The OpenBSD Foundation 2017 Fundraising Campaign</a></li>
<li><a href="https://marc.info/?l=openbsd-announce&m=148839684520133&w=2" rel="nofollow">OpenBSD MitM attack against WPA1/WPA2</a></li>
<li><a href="https://www.openbsd.org/papers/asiabsdcon2017-vmm-slides.pdf" rel="nofollow">OpenBSD vmm/vmd Update</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://hardenedbsd.org/article/shawn-webb/2017-03-02/introducing-cfi" rel="nofollow">HardenedBSD News: Introducing CFI</a> </li>
<li><a href="https://www.freshports.org/sysutils/py3-iocage/" rel="nofollow">New version of Iocage (Python 3) on FreshPorts</a></li>
<li><a href="https://leaf.dragonflybsd.org/%7Esephe/perf_cmp.pdf" rel="nofollow">DragonFly BSD Network performance comparison as of today</a></li>
<li><a href="http://knoxbug.org/content/knoxbug-wants-you" rel="nofollow">KnoxBUG recap</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://pastebin.com/7B47nuC0" rel="nofollow">Noel asks about moving to bhyve/jails</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Catching up to BSD, news about the NetBSD project, a BSD Phone, and a bunch of OpenBSD and TrueOS News.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.netbsd.org/releases/formal-7/NetBSD-7.1.html" rel="nofollow">NetBSD 7.1 released</a></h3>

<ul>
<li>This update represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</li>
<li><p>Kernel</p>

<ul>
<li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?compat_linux+8.i386+NetBSD-7.1" rel="nofollow">compat_linux(8)</a>: Fully support sched_setaffinity and sched_getaffinity, fixing, e.g., the Intel Math Kernel Library.</li>
</ul></li>
<li><p>DTrace:</p>

<ul>
<li>Avoid redefined symbol errors when loading the module.</li>
<li>Fix module autoload.</li>
</ul></li>
<li><p>IPFilter:</p>

<ul>
<li>Fix matching of ICMP queries when NAT&#39;d through IPF.</li>
<li>Fix lookup of original destination address when using a redirect rule. This is required for transparent proxying by squid, for example.</li>
<li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?ipsec+4.i386+NetBSD-7.1" rel="nofollow">ipsec(4)</a>: Fix NAT-T issue with NetBSD being the host behind NAT.</li>
</ul></li>
<li><p>Drivers</p>

<ul>
<li>Add vioscsi driver for the Google Compute Engine disk.</li>
<li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?ichsmb+4.i386+NetBSD-7.1" rel="nofollow">ichsmb(4)</a>: Add support for Braswell CPU and Intel 100 Series.</li>
<li><a href="http://netbsd.gw.com/cgi-bin/man-cgi?wm+4.i386+NetBSD-7.1" rel="nofollow">wm(4)</a>:</li>
<li>Add C2000 KX and 2.5G support.</li>
<li>Add Wake On Lan support.</li>
<li>Fixed a lot of bugs</li>
</ul></li>
<li><p>Security Fixes</p>

<ul>
<li><a href="http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2017-001.txt.asc" rel="nofollow">NetBSD-SA2017-001</a> Memory leak in the connect system call.</li>
<li><a href="http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2017-002.txt.asc" rel="nofollow">NetBSD-SA2017-002</a> Several vulnerabilities in ARP.</li>
</ul></li>
<li><p>ARM related</p>

<ul>
<li>Support for Raspberry Pi Zero.</li>
<li>ODROID-C1 Ethernet now works.</li>
</ul></li>
</ul>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/summary_of_the_preliminary_lldb" rel="nofollow">Summary of the preliminary LLDB support project</a></h3>

<ul>
<li><p>What has been done in NetBSD</p>

<ul>
<li>Verified the full matrix of combinations of wait(2) and ptrace(2) in the following</li>
<li>GNU libstdc++ std::call_once bug investigation test-cases</li>
<li>Improving documentation and other minor system parts</li>
<li>Documentation of ptrace(2) and explanation how debuggers work</li>
<li>Introduction of new siginfo(2) codes for SIGTRAP</li>
<li>New ptrace(2) interfaces</li>
</ul></li>
<li><p>What has been done in LLDB</p></li>
<li><p>Native Process NetBSD Plugin</p></li>
<li><p>The MonitorCallback function</p></li>
<li><p>Other LLDB code, out of the NativeProcessNetBSD Plugin</p></li>
<li><p>Automated LLDB Test Results Summary</p></li>
<li><p>Plan for the next milestone</p>

<ul>
<li>fix conflict with system-wide py-six</li>
<li>add support for auxv read operation</li>
<li>switch resolution of pid -&gt; path to executable from /proc to sysctl(7)</li>
<li>recognize Real-Time Signals (SIGRTMIN-SIGRTMAX)</li>
<li>upstream !NetBSDProcessPlugin code</li>
<li>switch std::call_once to llvm::call_once</li>
<li>add new ptrace(2) interface to lock and unlock threads from execution</li>
<li>switch the current PT_WATCHPOINT interface to PT_GETDBREGS and PT_SETDBREGS</li>
</ul></li>
</ul>

<hr>

<h3><a href="https://hackaday.io/project/13145-bsd-based-secure-smartphone" rel="nofollow">Actually building a FreeBSD Phone </a></h3>

<ul>
<li>There have been a number of different projects that have proposed building a FreeBSD based smart phone</li>
<li>This project is a bit different, and I think that gives it a better chance to make progress</li>
<li>It uses off-the-shelf parts, so while not as neatly integrated as a regular smartphone device, it makes a much better prototype, and is more readily available.</li>
<li>Hardware overview: X86-based, long-lasting (user-replaceable) battery, WWAN Modem (w/LTE), 4-5&quot; LCD Touchscreen (Preferably w/720p resolution, IPS), upgradable storage.</li>
<li>Currently targeting the UDOO Ultra platform. It features Intel Pentium N3710 (2.56GHz Quad-core, HD Graphics 405 [16 EUs @ 700MHz], VT-x, AES-NI), 2x4GB DDR3L RAM, 32GB eMMC storage built-in, further expansion w/M.2 SSD &amp; MicroSD slot, lots of connectivity onboard.</li>
<li>Software: FreeBSD Hypervisor (bhyve or Xen) to run atop the hardware, hosting two separate hosts.

<ul>
<li>One will run an instance of pfSense, the &quot;World&#39;s Most Popular Open Source Firewall&quot; to handle the WWAN connection, routing, and Firewall (as well as Secure VPN if desired).</li>
<li>The other instance will run a slimmed down installation of FreeBSD. The UI will be tweaked to work best in this form factor &amp; resources tuned for this platform. There will be a strong reliance on Google Chromium &amp; Google&#39;s services (like Google Voice).</li>
</ul></li>
<li>The project has a detailed log, and it looks like the hardware it is based on will ship in the next few weeks, so we expect to see more activity.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2017-March/313261.html" rel="nofollow">NVME M.2 card road tests (Matt Dillon)</a></h3>

<ul>
<li>DragonFlyBSD’s Matt Dillon has posted a rundown of the various M.2 NVMe devices he has tested

<ul>
<li>SAMSUNG 951</li>
<li>SAMSUNG 960 EVO</li>
<li>TOSHIBA OCZ RD400</li>
<li>INTEL 600P</li>
<li>WD BLACK 256G</li>
<li>MYDIGITALSSD</li>
<li>PLEXTOR M8Pe</li>
</ul></li>
<li>It is interesting to see the relative performance of each device, but also how they handle the workload and manage their temperature (or don’t in a few cases)</li>
<li>The link provides a lot of detail about different block sizes and overall performance
***</li>
</ul>

<h3><a href="http://www.bolthole.com/solaris/zrep/" rel="nofollow">ZREP ZFS replication and failover</a></h3>

<ul>
<li>&quot;zrep&quot;, a robust yet easy to use ZFS based replication and failover solution. It can also serve as the conduit to create a simple backup hub.</li>
<li>The tool was originally written for Solaris, and is written in ksh</li>
<li>However, it seems people have used it on FreeBSD and even FreeNAS by installing the ksh93 port</li>
<li>Has anyone used this? How does it compare to tools like zxfer?</li>
<li>There is a FreeBSD port, but it is a few versions behind, someone should update it</li>
<li>We would be interested in hearing some feedback
***</li>
</ul>

<h3>Catching up on some TrueOS News</h3>

<ul>
<li><a href="https://www.trueos.org/blog/trueos-security-wikileaks-revelations/" rel="nofollow">TrueOS Security and Wikileaks revelations</a></li>
<li><a href="https://www.trueos.org/blog/new-jail-management-utilities/" rel="nofollow">New Jail management utilities</a></li>
<li><a href="https://www.youtube.com/watch?v=PyraePQyCGY" rel="nofollow">Ken Moore&#39;s talk about Sysadm from Linuxfest 2016</a></li>
<li><a href="https://www.trueos.org/blog/community-spotlight-basics-using-zfs-trueos/" rel="nofollow">The Basics of using ZFS with TrueOS</a>
***</li>
</ul>

<h3>Catching up on some OpenBSD News</h3>

<ul>
<li><a href="https://www.openbsd.org/61.html" rel="nofollow">OpenBSD 6.1 coming May 1</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170223044255" rel="nofollow">OpenBSD Foundation 2016 Fundraising (goal: $250K actual: $573K)</a></li>
<li><a href="http://www.openbsdfoundation.org/campaign2017.html" rel="nofollow">The OpenBSD Foundation 2017 Fundraising Campaign</a></li>
<li><a href="https://marc.info/?l=openbsd-announce&m=148839684520133&w=2" rel="nofollow">OpenBSD MitM attack against WPA1/WPA2</a></li>
<li><a href="https://www.openbsd.org/papers/asiabsdcon2017-vmm-slides.pdf" rel="nofollow">OpenBSD vmm/vmd Update</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://hardenedbsd.org/article/shawn-webb/2017-03-02/introducing-cfi" rel="nofollow">HardenedBSD News: Introducing CFI</a> </li>
<li><a href="https://www.freshports.org/sysutils/py3-iocage/" rel="nofollow">New version of Iocage (Python 3) on FreshPorts</a></li>
<li><a href="https://leaf.dragonflybsd.org/%7Esephe/perf_cmp.pdf" rel="nofollow">DragonFly BSD Network performance comparison as of today</a></li>
<li><a href="http://knoxbug.org/content/knoxbug-wants-you" rel="nofollow">KnoxBUG recap</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="https://pastebin.com/7B47nuC0" rel="nofollow">Noel asks about moving to bhyve/jails</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>186: The Fast And the Firewall: Tokyo Drift</title>
  <link>https://www.bsdnow.tv/186</link>
  <guid isPermaLink="false">09c4e852-2672-45ab-8305-fc91d8b928e6</guid>
  <pubDate>Wed, 22 Mar 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/09c4e852-2672-45ab-8305-fc91d8b928e6.mp3" length="83580628" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, reports from AsiaBSDcon, TrueOS and FreeBSD news,  Optimizing IllumOS Kernel, your questions and more.</itunes:subtitle>
  <itunes:duration>2:54:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, reports from AsiaBSDcon, TrueOS and FreeBSD news,  Optimizing IllumOS Kernel, your questions and more.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
AsiaBSDcon Reports and Reviews ()
AsiaBSDcon schedule (https://2017.asiabsdcon.org/program.html.en)
Schedule and slides from the 4th bhyvecon (http://bhyvecon.org/)
Michael Dexter’s trip report on the iXsystems blog (https://www.ixsystems.com/blog/ixsystems-attends-asiabsdcon-2017)
NetBSD AsiaBSDcon booth report (http://mail-index.netbsd.org/netbsd-advocacy/2017/03/13/msg000729.html)
***
TrueOS Community Guidelines are here! (https://www.trueos.org/blog/trueos-community-guidelines/)
TrueOS has published its new Community Guidelines
The TrueOS Project has existed for over ten years. Until now, there was no formally defined process for interested individuals in the TrueOS community to earn contributor status as an active committer to this long-standing project. The current core TrueOS developers (Kris Moore, Ken Moore, and Joe Maloney) want to provide the community more opportunities to directly impact the TrueOS Project, and wish to formalize the process for interested people to gain full commit access to the TrueOS repositories.
These describe what is expected of community members and committers
They also describe the process of getting commit access to the TrueOS repo:
Previously, Kris directly handed out commit bits. Now, the Core developers have provided a small list of requirements for gaining a TrueOS commit bit:
Create five or more pull requests in a TrueOS Project repository within a single six month period. 
Stay active in the TrueOS community through at least one of the available community channels (Gitter, Discourse, IRC, etc.). 
Request commit access from the core developers via core@trueos.org OR Core developers contact you concerning commit access.
Pull requests can be any contribution to the project, from minor documentation tweaks to creating full utilities.
At the end of every month, the core developers review the commit logs, removing elements that break the Project or deviate too far from its intended purpose. Additionally, outstanding pull requests with no active dissension are immediately merged, if possible. For example, a user submits a pull request which adds a little-used OpenRC script. No one from the community comments on the request or otherwise argues against its inclusion, resulting in an automatic merge at the end of the month. In this manner, solid contributions are routinely added to the project and never left in a state of “limbo”.
The page also describes the perks of being a TrueOS committer:
Contributors to the TrueOS Project enjoy a number of benefits, including:
A personal TrueOS email alias: @trueos.org
Full access for managing TrueOS issues on GitHub.
Regular meetings with the core developers and other contributors.
Access to private chat channels with the core developers.
Recognition as part of an online Who’s Who of TrueOS developers.
The eternal gratitude of the core developers of TrueOS.
A warm, fuzzy feeling.
Intel Donates 250.000 $ to the FreeBSD Foundation (https://www.freebsdfoundation.org/news-and-events/latest-news/new-uranium-level-donation-and-collaborative-partnership-with-intel/)
More details about the deal: Systems Thinking: Intel and the FreeBSD Project (https://www.freebsdfoundation.org/blog/systems-thinking-intel-and-the-freebsd-project/) 
Intel will be more actively engaging with the FreeBSD Foundation and the FreeBSD Project to deliver more timely support for Intel products and technologies in FreeBSD.
Intel has contributed code to FreeBSD for individual device drivers (i.e. NICs) in the past, but is now seeking a more holistic “systems thinking” approach. 
Intel Blog Post  (https://01.org/blogs/imad/2017/intel-increases-support-freebsd-project)
We will work closely with the FreeBSD Foundation to ensure the drivers, tools, and applications needed on Intel® SSD-based storage appliances are available to the community. This collaboration will also provide timely support for future Intel® 3D XPoint™ products.
Thank you very much, Intel!
***
Applied FreeBSD: Basic iSCSI (https://globalengineer.wordpress.com/2017/03/05/applied-freebsd-basic-iscsi/)
iSCSI is often touted as a low-cost replacement for fibre-channel (FC) Storage Area Networks (SANs). Instead of having to setup a separate fibre-channel network for the SAN, or invest in the infrastructure to run Fibre-Channel over Ethernet (FCoE), iSCSI runs on top of standard TCP/IP. This means that the same network equipment used for routing user data on a network could be utilized for the storage as well.
This article will cover a very basic setup where a FreeBSD server is configured as an iSCSI Target, and another FreeBSD server is configured as the iSCSI Initiator. The iSCSI Target will export a single disk drive, and the initiator will create a filesystem on this disk and mount it locally. Advanced topics, such as multipath, ZFS storage pools, failover controllers, etc. are not covered.
The real magic is the /etc/ctl.conf file, which contains all of the information necessary for ctld to share disk drives on the network. Check out the man page for /etc/ctl.conf for more details; below is the configuration file that I created for this test setup. Note that on a system that has never had iSCSI configured, there will be no existing configuration file, so go ahead and create it.
Then, enable ctld and start it:
sysrc ctld_enable=”YES”
service ctld start
You can use the ctladm command to see what is going on:
root@bsdtarget:/dev # ctladm lunlist
(7:0:0/0):  Fixed Direct Access SPC-4 SCSI device
(7:0:1/1):  Fixed Direct Access SPC-4 SCSI device
root@bsdtarget:/dev # ctladm devlist
LUN Backend Size (Blocks) BS Serial Number Device ID
0 block 10485760 512 MYSERIAL 0 MYDEVID 0
1 block 10485760 512 MYSERIAL 1 MYDEVID 1
Now, let’s configure the client side:
In order for a FreeBSD host to become an iSCSI Initiator, the iscsd daemon needs to be started.
sysrc iscsid_enable=”YES”
service iscsid start
Next, the iSCSI Initiator can manually connect to the iSCSI target using the iscsictl tool. While setting up a new iSCSI session, this is probably the best option. Once you are sure the configuration is correct, add the configuration to the /etc/iscsi.conf file (see man page for this file). For iscsictl, pass the IP address of the target as well as the iSCSI IQN for the session:
+ iscsictl -A -p 192.168.22.128 -t iqn.2017-02.lab.testing:basictarget
You should now have a new device (check dmesg), in this case, da1
The guide them walks through partitioning the disk, and laying down a UFS file system, and mounting it
This it walks through how to disconnect iscsi, incase you don’t want it anymore
This all looked nice and easy, and it works very well. Now lets see what happens when you try to mount the iSCSI from Windows
Ok, that wasn’t so bad.
Now, instead of sharing an entire space disk on the host via iSCSI, share a zvol. Now your windows machine can be backed by ZFS. All of your problems are solved.
Interview - Philipp Buehler - pbuehler@sysfive.com (mailto:pbuehler@sysfive.com)
Technical Lead at SysFive, and Former OpenBSD Committer
News Roundup
Half a dozen new features in mandoc -T html (http://undeadly.org/cgi?action=article&amp;amp;sid=20170316080827)
mandoc (http://man.openbsd.org/mandoc.1)’s HTML output mode got some new features
Even though mdoc(7) is a semantic markup language, traditionally none of the semantic annotations were communicated to the reader. [...] Now, at least in -T html output mode, you can see the semantic function of marked-up words by hovering your mouse over them.
In terminal output modes, we have the ctags(1)-like internal search facility built around the less(1) tag jump (:t) feature for quite some time now. We now have a similar feature in -T html output mode. To jump to (almost) the same places in the text, go to the address bar of the browser, type a hash mark ('#') after the URI, then the name of the option, command, variable, error code etc. you want to jump to, and hit enter.
Check out the full report by Ingo Schwarze (schwarze@) and try out these new features
***
Optimizing IllumOS Kernel Crypto (http://zfs-create.blogspot.com/2014/05/optimizing-illumos-kernel-crypto.html)
Sašo Kiselkov, of ZFS fame, looked into the performance of the OpenSolaris kernel crypto framework and found it lacking.
The article also spends a few minutes on the different modes and how they work.
 Recently I've had some motivation to look into the KCF on Illumos and discovered that, unbeknownst to me, we already had an AES-NI implementation that was automatically enabled when running on Intel and AMD CPUs with AES-NI support. This work was done back in 2010 by Dan Anderson.This was great news, so I set out to test the performance in Illumos in a VM on my Mac with a Core i5 3210M (2.5GHz normal, 3.1GHz turbo).
The initial tests of “what the hardware can do” were done in OpenSSL
So now comes the test for the KCF. I wrote a quick'n'dirty crypto test module that just performed a bunch of encryption operations and timed the results.
KCF got around 100 MB/s for each algorithm, except half that for AES-GCM
OpenSSL had done over 3000 MB/s for CTR mode, 500 MB/s for CBC, and 1000 MB/s for GCM
What the hell is that?! This is just plain unacceptable. Obviously we must have hit some nasty performance snag somewhere, because this is comical. And sure enough, we did.
When looking around in the AES-NI implementation I came across this bit in aes_intel.s that performed the CLTS instruction.
This is a problem: 3.1.2 Instructions That Cause VM Exits ConditionallyCLTS. The CLTS instruction causes a VM exit if the bits in position 3 (corresponding to CR0.TS) are set in both the CR0 guest/host mask and the CR0 read shadow.
The CLTS instruction signals to the CPU that we're about to use FPU registers (which is needed for AES-NI), which in VMware causes an exit into the hypervisor. And we've been doing it for every single AES block! Needless to say, performing the equivalent of a very expensive context switch every 16 bytes is going to hurt encryption performance a bit. The reason why the kernel is issuing CLTS is because for performance reasons, the kernel doesn't save and restore FPU register state on kernel thread context switches. So whenever we need to use FPU registers inside the kernel, we must disable kernel thread preemption via a call to kpreemptdisable() and kpreemptenable() and save and restore FPU register state manually. During this time, we cannot be descheduled (because if we were, some other thread might clobber our FPU registers), so if a thread does this for too long, it can lead to unexpected latency bubbles
The solution was to restructure the AES and KCF block crypto implementations in such a way that we execute encryption in meaningfully small chunks. I opted for 32k bytes, for reasons which I'll explain below. Unfortunately, doing this restructuring work was a bit more complicated than one would imagine, since in the KCF the implementation of the AES encryption algorithm and the block cipher modes is separated into two separate modules that interact through an internal API, which wasn't really conducive to high performance (we'll get to that later). Anyway, having fixed the issue here and running the code at near native speed, this is what I get:
AES-128/CTR: 439 MB/s
AES-128/CBC: 483 MB/s
AES-128/GCM: 252 MB/s
Not disastrous anymore, but still, very, very bad. Of course, you've got keep in mind, the thing we're comparing it to, OpenSSL, is no slouch. It's got hand-written highly optimized inline assembly implementations of most of these encryption functions and their specific modes, for lots of platforms. That's a ton of code to maintain and optimize, but I'll be damned if I let this kind of performance gap persist.
Fixing this, however, is not so trivial anymore. It pertains to how the KCF's block cipher mode API interacts with the cipher algorithms. It is beautifully designed and implemented in a fashion that creates minimum code duplication, but this also means that it's inherently inefficient.
ECB, CBC and CTR gained the ability to pass an algorithm-specific "fastpath" implementation of the block cipher mode, because these functions benefit greatly from pipelining multiple cipher calls into a single place.
ECB, CTR and CBC decryption benefit enormously from being able to exploit the wide XMM register file on Intel to perform encryption/decryption operations on 8 blocks at the same time in a non-interlocking manner. The performance gains here are on the order of 5-8x.CBC encryption benefits from not having to copy the previously encrypted ciphertext blocks into memory and back into registers to XOR them with the subsequent plaintext blocks, though here the gains are more modest, around 1.3-1.5x.
After all of this work, this is how the results now look on Illumos, even inside of a VM:
Algorithm/Mode 128k ops
AES-128/CTR: 3121 MB/s
AES-128/CBC: 691 MB/s
AES-128/GCM: 1053 MB/s
So the CTR and GCM speeds have actually caught up to OpenSSL, and CBC is actually faster than OpenSSL.
On the decryption side of things, CBC decryption also jumped from 627 MB/s to 3011 MB/s. Seeing these performance numbers, you can see why I chose 32k for the operation size in between kernel preemption barriers. Even on the slowest hardware with AES-NI, we can expect at least 300-400 MB/s/core of throughput, so even in the worst case, we'll be hogging the CPU for at most ~0.1ms per run.
Overall, we're even a little bit faster than OpenSSL in some tests, though that's probably down to us encrypting 128k blocks vs 8k in the "openssl speed" utility. Anyway, having fixed this monstrous atrocity of a performance bug, I can now finally get some sleep.
To made these tests repeatable, and to ensure that the changes didn’t break the crypto algorithms, Saso created a crypto_test kernel module.
I have recently created a FreeBSD version of crypto_test.ko, for much the same purposes
Initial performance on FreeBSD is not as bad, if you have the aesni.ko module loaded, but it is not up to speed with OpenSSL. You cannot directly compare to the benchmarks Saso did, because the CPUs are vastly different.
Performance results (https://wiki.freebsd.org/OpenCryptoPerformance)
I hope to do some more tests on a range of different sized CPUs in order to determine how the algorithms scale across different clock speeds.
I also want to look at, or get help and have someone else look at, implementing some of the same optimizations that Saso did.
It currently seems like there isn’t a way to perform addition crypto operations in the same session without regenerating the key table. Processing additional buffers in an existing session might offer a number of optimizations for bulk operations, although in many cases, each block is encrypted with a different key and/or IV, so it might not be very useful.
***
Brendan Gregg’s special freeware tools for sysadmins (http://www.brendangregg.com/specials.html)
These tools need to be in every (not so) serious sysadmins toolbox. 
Triple ROT13 encryption algorithm (beware: export restrictions may apply)
/usr/bin/maybe, in case true and false don’t provide too little choice...
The bottom command lists you all the processes using the least CPU cycles.
Check out the rest of the tools. 
You wrote similar tools and want us to cover them in the show? Send us an email to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv) 
***
A look at 2038  (http://www.lieberbiber.de/2017/03/14/a-look-at-the-year-20362038-problems-and-time-proofness-in-various-systems/)
I remember the Y2K problem quite vividly. The world was going crazy for years, paying insane amounts of money to experts to fix critical legacy systems, and there was a neverending stream of predictions from the media on how it’s all going to fail. Most didn’t even understand what the problem was, and I remember one magazine writing something like the following:
Most systems store the current year as a two-digit value to save space. When the value rolls over on New Year’s Eve 1999, those two digits will be “00”, and “00” means “halt operation” in the machine language of many central processing units. If you’re in an elevator at this time, it will stop working and you may fall to your death.
I still don’t know why they thought a computer would suddenly interpret data as code, but people believed them. We could see a nearby hydropower plant from my parents’ house, and we expected it to go up in flames as soon as the clock passed midnight, while at least two airplanes crashed in our garden at the same time. Then nothing happened. I think one of the most “severe” problems was the police not being able to open their car garages the next day because their RFID tokens had both a start and end date for validity, and the system clock had actually rolled over to 1900, so the tokens were “not yet valid”.
That was 17 years ago. One of the reasons why Y2K wasn’t as bad as it could have been is that many systems had never used the “two-digit-year” representation internally, but use some form of “timestamp” relative to a fixed date (the “epoch”).
The actual problem with time and dates rolling over is that systems calculate timestamp differences all day. Since a timestamp derived from the system clock seemingly only increases with each query, it is very common to just calculate diff = now - before and never care about the fact that now could suddenly be lower than before because the system clock has rolled over. In this case diff is suddenly negative, and if other parts of the code make further use of the suddenly negative value, things can go horribly wrong.
A good example was a bug in the generator control units (GCUs) aboard Boeing 787 “Dreamliner” aircrafts, discovered in 2015. An internal timestamp counter would overflow roughly 248 days after the system had been powered on, triggering a shut down to “safe mode”. The aircraft has four generator units, but if all were powered up at the same time, they would all fail at the same time. This sounds like an overflow caused by a signed 32-bit counter counting the number of centiseconds since boot, overflowing after 248.55 days, and luckily no airline had been using their Boing 787 models for such a long time between maintenance intervals.
The “obvious” solution is to simply switch to 64-Bit values and call it day, which would push overflow dates far into the future (as long as you don’t do it like the IBM S/370 mentioned before). But as we’ve learned from the Y2K problem, you have to assume that computer systems, computer software and stored data (which often contains timestamps in some form) will stay with us for much longer than we might think. The years 2036 and 2038 might be far in the future, but we have to assume that many of the things we make and sell today are going to be used and supported for more than just 19 years. Also many systems have to store dates which are far in the future. A 30 year mortgage taken out in 2008 could have already triggered the bug, and for some banks it supposedly did.
sysgettimeofday() is one of the most used system calls on a generic Linux system and returns the current time in form of an UNIX timestamp (timet data type) plus fraction (susecondst data type). Many applications have to know the current time and date to do things, e.g. displaying it, using it in game timing loops, invalidating caches after their lifetime ends, perform an action after a specific moment has passed, etc. In a 32-Bit UNIX system, timet is usually defined as a signed 32-Bit Integer.
When kernel, libraries and applications are compiled, the compiler will turn this assumption machine code and all components later have to match each other. So a 32-Bit Linux application or library still expects the kernel to return a 32-Bit value even if the kernel is running on a 64-Bit architecture and has 32-Bit compatibility. The same holds true for applications calling into libraries. This is a major problem, because there will be a lot of legacy software running in 2038. Systems which used an unsigned 32-Bit Integer for timet push the problem back to 2106, but I don’t know about many of those.
The developers of the GNU C library (glibc), the default standard C library for many GNU/Linux systems, have come up with a design for year 2038 proofness for their library. Besides the timet data type itself, a number of other data structures have fields based on timet or the combined struct timespec and struct timeval types. Many methods beside those intended for setting and querying the current time use timestamps
32-Bit Windows applications, or Windows applications defining _USE32BITTIMET, can be hit by the year 2038 problem too if they use the timet data type. The _time64t data type had been available since Visual C 7.1, but only Visual C 8 (default with Visual Studio 2015) expanded timet to 64 bits by default. The change will only be effective after a recompilation, legacy applications will continue to be affected.
If you live in a 64-Bit world and use a 64-Bit kernel with 64-Bit only applications, you might think you can just ignore the problem. In such a constellation all instances of the standard time_t data type for system calls, libraries and applications are signed 64-Bit Integers which will overflow in around 292 billion years. But many data formats, file systems and network protocols still specify 32-Bit time fields, and you might have to read/write this data or talk to legacy systems after 2038. So solving the problem on your side alone is not enough.
Then the article goes on to describe how all of this will break your file systems. Not to mention your databases and other file formats.
Also see Theo De Raadt’s EuroBSDCon 2013 Presentation (https://www.openbsd.org/papers/eurobsdcon_2013_time_t/mgp00001.html)
***
Beastie Bits
Michael Lucas: Get your name in “Absolute FreeBSD 3rd Edition” (https://blather.michaelwlucas.com/archives/2895)
ZFS compressed ARC stats to top (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=r315435)
Matthew Dillon discovered HAMMER was repeating itself when writing to disk.  Fixing that issue doubled write speeds (https://www.dragonflydigest.com/2017/03/14/19452.html)
TedU on Meaningful Short Names  (http://www.tedunangst.com/flak/post/shrt-nms-fr-clrty)
vBSDcon and EuroBSDcon Call for Papers are open (https://www.freebsdfoundation.org/blog/submit-your-work-vbsdcon-and-eurobsdcon-cfps-now-open/)
Feedback/Questions
Craig asks about BSD server management (http://pastebin.com/NMshpZ7n)
Michael asks about jails as a router between networks (http://pastebin.com/UqRwMcRk)
Todd asks about connecting jails  (http://pastebin.com/i1ZD6eXN)
Dave writes in with an interesting link (http://pastebin.com/QzW5c9wV)
&amp;gt; applications crash more often due to errors than corruptions. In the case of corruption, a few applications (e.g., Log-Cabin, ZooKeeper) can use checksums and redundancy to recover, leading to a correct behavior; however, when the corruption is transformed into an error, these applications crash, resulting in reduced availability.
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, reports from AsiaBSDcon, TrueOS and FreeBSD news,  Optimizing IllumOS Kernel, your questions and more.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="" rel="nofollow">AsiaBSDcon Reports and Reviews</a></h3>

<ul>
<li><a href="https://2017.asiabsdcon.org/program.html.en" rel="nofollow">AsiaBSDcon schedule</a></li>
<li><a href="http://bhyvecon.org/" rel="nofollow">Schedule and slides from the 4th bhyvecon</a></li>
<li><a href="https://www.ixsystems.com/blog/ixsystems-attends-asiabsdcon-2017" rel="nofollow">Michael Dexter’s trip report on the iXsystems blog</a></li>
<li><a href="http://mail-index.netbsd.org/netbsd-advocacy/2017/03/13/msg000729.html" rel="nofollow">NetBSD AsiaBSDcon booth report</a>
***</li>
</ul>

<h3><a href="https://www.trueos.org/blog/trueos-community-guidelines/" rel="nofollow">TrueOS Community Guidelines are here!</a></h3>

<ul>
<li>TrueOS has published its new Community Guidelines</li>
<li>The TrueOS Project has existed for over ten years. Until now, there was no formally defined process for interested individuals in the TrueOS community to earn contributor status as an active committer to this long-standing project. The current core TrueOS developers (Kris Moore, Ken Moore, and Joe Maloney) want to provide the community more opportunities to directly impact the TrueOS Project, and wish to formalize the process for interested people to gain full commit access to the TrueOS repositories.</li>
<li>These describe what is expected of community members and committers</li>
<li>They also describe the process of getting commit access to the TrueOS repo:</li>
</ul>

<blockquote>
<p>Previously, Kris directly handed out commit bits. Now, the Core developers have provided a small list of requirements for gaining a TrueOS commit bit:</p>

<p>Create five or more pull requests in a TrueOS Project repository within a single six month period. </p>

<p>Stay active in the TrueOS community through at least one of the available community channels (Gitter, Discourse, IRC, etc.). </p>

<p>Request commit access from the core developers via <a href="mailto:core@trueos.org" rel="nofollow">core@trueos.org</a> OR Core developers contact you concerning commit access.</p>

<p>Pull requests can be any contribution to the project, from minor documentation tweaks to creating full utilities.</p>

<p>At the end of every month, the core developers review the commit logs, removing elements that break the Project or deviate too far from its intended purpose. Additionally, outstanding pull requests with no active dissension are immediately merged, if possible. For example, a user submits a pull request which adds a little-used OpenRC script. No one from the community comments on the request or otherwise argues against its inclusion, resulting in an automatic merge at the end of the month. In this manner, solid contributions are routinely added to the project and never left in a state of “limbo”.</p>
</blockquote>

<ul>
<li>The page also describes the perks of being a TrueOS committer:</li>
</ul>

<blockquote>
<p>Contributors to the TrueOS Project enjoy a number of benefits, including:</p>

<p>A personal TrueOS email alias: <youralias>@trueos.org</p>

<p>Full access for managing TrueOS issues on GitHub.</p>

<p>Regular meetings with the core developers and other contributors.</p>

<p>Access to private chat channels with the core developers.</p>

<p>Recognition as part of an online Who’s Who of TrueOS developers.</p>

<p>The eternal gratitude of the core developers of TrueOS.</p>

<p>A warm, fuzzy feeling.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsdfoundation.org/news-and-events/latest-news/new-uranium-level-donation-and-collaborative-partnership-with-intel/" rel="nofollow">Intel Donates 250.000 $ to the FreeBSD Foundation</a></h3>

<ul>
<li>More details about the deal: Systems Thinking: <a href="https://www.freebsdfoundation.org/blog/systems-thinking-intel-and-the-freebsd-project/" rel="nofollow">Intel and the FreeBSD Project</a> </li>
</ul>

<blockquote>
<p>Intel will be more actively engaging with the FreeBSD Foundation and the FreeBSD Project to deliver more timely support for Intel products and technologies in FreeBSD.</p>

<p>Intel has contributed code to FreeBSD for individual device drivers (i.e. NICs) in the past, but is now seeking a more holistic “systems thinking” approach. </p>
</blockquote>

<ul>
<li><a href="https://01.org/blogs/imad/2017/intel-increases-support-freebsd-project" rel="nofollow">Intel Blog Post </a></li>
</ul>

<blockquote>
<p>We will work closely with the FreeBSD Foundation to ensure the drivers, tools, and applications needed on Intel® SSD-based storage appliances are available to the community. This collaboration will also provide timely support for future Intel® 3D XPoint™ products.</p>
</blockquote>

<ul>
<li>Thank you very much, Intel!
***</li>
</ul>

<h3><a href="https://globalengineer.wordpress.com/2017/03/05/applied-freebsd-basic-iscsi/" rel="nofollow">Applied FreeBSD: Basic iSCSI</a></h3>

<blockquote>
<p>iSCSI is often touted as a low-cost replacement for fibre-channel (FC) Storage Area Networks (SANs). Instead of having to setup a separate fibre-channel network for the SAN, or invest in the infrastructure to run Fibre-Channel over Ethernet (FCoE), iSCSI runs on top of standard TCP/IP. This means that the same network equipment used for routing user data on a network could be utilized for the storage as well.</p>

<p>This article will cover a very basic setup where a FreeBSD server is configured as an iSCSI Target, and another FreeBSD server is configured as the iSCSI Initiator. The iSCSI Target will export a single disk drive, and the initiator will create a filesystem on this disk and mount it locally. Advanced topics, such as multipath, ZFS storage pools, failover controllers, etc. are not covered.</p>

<p>The real magic is the /etc/ctl.conf file, which contains all of the information necessary for ctld to share disk drives on the network. Check out the man page for /etc/ctl.conf for more details; below is the configuration file that I created for this test setup. Note that on a system that has never had iSCSI configured, there will be no existing configuration file, so go ahead and create it.</p>
</blockquote>

<ul>
<li><p>Then, enable ctld and start it:</p>

<ul>
<li>sysrc ctld_enable=”YES”</li>
<li>service ctld start</li>
</ul></li>
<li><p>You can use the ctladm command to see what is going on:</p></li>
</ul>

<p>root@bsdtarget:/dev # ctladm lunlist</p>

<p>(7:0:0/0): <FREEBSD CTLDISK 0001> Fixed Direct Access SPC-4 SCSI device</p>

<p>(7:0:1/1): <FREEBSD CTLDISK 0001> Fixed Direct Access SPC-4 SCSI device</p>

<p>root@bsdtarget:/dev # ctladm devlist</p>

<p>LUN Backend Size (Blocks) BS Serial Number Device ID</p>

<p>0 block 10485760 512 MYSERIAL 0 MYDEVID 0</p>

<p>1 block 10485760 512 MYSERIAL 1 MYDEVID 1</p>

<ul>
<li>Now, let’s configure the client side:</li>
</ul>

<blockquote>
<p>In order for a FreeBSD host to become an iSCSI Initiator, the iscsd daemon needs to be started.</p>
</blockquote>

<ul>
<li><p>sysrc iscsid_enable=”YES”</p></li>
<li><p>service iscsid start</p></li>
</ul>

<blockquote>
<p>Next, the iSCSI Initiator can manually connect to the iSCSI target using the iscsictl tool. While setting up a new iSCSI session, this is probably the best option. Once you are sure the configuration is correct, add the configuration to the /etc/iscsi.conf file (see man page for this file). For iscsictl, pass the IP address of the target as well as the iSCSI IQN for the session:</p>
</blockquote>

<pre><code>+ iscsictl -A -p 192.168.22.128 -t iqn.2017-02.lab.testing:basictarget
</code></pre>

<ul>
<li><p>You should now have a new device (check dmesg), in this case, da1</p></li>
<li><p>The guide them walks through partitioning the disk, and laying down a UFS file system, and mounting it</p></li>
<li><p>This it walks through how to disconnect iscsi, incase you don’t want it anymore</p></li>
<li><p>This all looked nice and easy, and it works very well. Now lets see what happens when you try to mount the iSCSI from Windows</p></li>
<li><p>Ok, that wasn’t so bad.</p></li>
<li><p>Now, instead of sharing an entire space disk on the host via iSCSI, share a zvol. Now your windows machine can be backed by ZFS. All of your problems are solved.</p></li>
</ul>

<hr>

<h2>Interview - Philipp Buehler - <a href="mailto:pbuehler@sysfive.com" rel="nofollow">pbuehler@sysfive.com</a></h2>

<p>Technical Lead at SysFive, and Former OpenBSD Committer</p>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170316080827" rel="nofollow">Half a dozen new features in mandoc -T html</a></h3>

<ul>
<li><a href="http://man.openbsd.org/mandoc.1" rel="nofollow">mandoc</a>’s HTML output mode got some new features</li>
</ul>

<blockquote>
<p>Even though mdoc(7) is a semantic markup language, traditionally none of the semantic annotations were communicated to the reader. [...] Now, at least in -T html output mode, you can see the semantic function of marked-up words by hovering your mouse over them.</p>

<p>In terminal output modes, we have the ctags(1)-like internal search facility built around the less(1) tag jump (:t) feature for quite some time now. We now have a similar feature in -T html output mode. To jump to (almost) the same places in the text, go to the address bar of the browser, type a hash mark (&#39;#&#39;) after the URI, then the name of the option, command, variable, error code etc. you want to jump to, and hit enter.</p>
</blockquote>

<ul>
<li>Check out the full report by Ingo Schwarze (schwarze@) and try out these new features
***</li>
</ul>

<h3><a href="http://zfs-create.blogspot.com/2014/05/optimizing-illumos-kernel-crypto.html" rel="nofollow">Optimizing IllumOS Kernel Crypto</a></h3>

<ul>
<li>Sašo Kiselkov, of ZFS fame, looked into the performance of the OpenSolaris kernel crypto framework and found it lacking.</li>
<li>The article also spends a few minutes on the different modes and how they work.</li>
</ul>

<blockquote>
<p>Recently I&#39;ve had some motivation to look into the KCF on Illumos and discovered that, unbeknownst to me, we already had an AES-NI implementation that was automatically enabled when running on Intel and AMD CPUs with AES-NI support. This work was done back in 2010 by Dan Anderson.This was great news, so I set out to test the performance in Illumos in a VM on my Mac with a Core i5 3210M (2.5GHz normal, 3.1GHz turbo).</p>
</blockquote>

<ul>
<li>The initial tests of “what the hardware can do” were done in OpenSSL</li>
</ul>

<blockquote>
<p>So now comes the test for the KCF. I wrote a quick&#39;n&#39;dirty crypto test module that just performed a bunch of encryption operations and timed the results.</p>
</blockquote>

<ul>
<li>KCF got around 100 MB/s for each algorithm, except half that for AES-GCM</li>
<li>OpenSSL had done over 3000 MB/s for CTR mode, 500 MB/s for CBC, and 1000 MB/s for GCM</li>
</ul>

<blockquote>
<p>What the hell is that?! This is just plain unacceptable. Obviously we must have hit some nasty performance snag somewhere, because this is comical. And sure enough, we did.</p>

<p>When looking around in the AES-NI implementation I came across this bit in aes_intel.s that performed the CLTS instruction.</p>

<p>This is a problem: 3.1.2 Instructions That Cause VM Exits ConditionallyCLTS. The CLTS instruction causes a VM exit if the bits in position 3 (corresponding to CR0.TS) are set in both the CR0 guest/host mask and the CR0 read shadow.</p>

<p>The CLTS instruction signals to the CPU that we&#39;re about to use FPU registers (which is needed for AES-NI), which in VMware causes an exit into the hypervisor. And we&#39;ve been doing it for every single AES block! Needless to say, performing the equivalent of a very expensive context switch every 16 bytes is going to hurt encryption performance a bit. The reason why the kernel is issuing CLTS is because for performance reasons, the kernel doesn&#39;t save and restore FPU register state on kernel thread context switches. So whenever we need to use FPU registers inside the kernel, we must disable kernel thread preemption via a call to kpreempt_disable() and kpreempt_enable() and save and restore FPU register state manually. During this time, we cannot be descheduled (because if we were, some other thread might clobber our FPU registers), so if a thread does this for too long, it can lead to unexpected latency bubbles</p>

<p>The solution was to restructure the AES and KCF block crypto implementations in such a way that we execute encryption in meaningfully small chunks. I opted for 32k bytes, for reasons which I&#39;ll explain below. Unfortunately, doing this restructuring work was a bit more complicated than one would imagine, since in the KCF the implementation of the AES encryption algorithm and the block cipher modes is separated into two separate modules that interact through an internal API, which wasn&#39;t really conducive to high performance (we&#39;ll get to that later). Anyway, having fixed the issue here and running the code at near native speed, this is what I get:</p>
</blockquote>

<p>AES-128/CTR: 439 MB/s</p>

<p>AES-128/CBC: 483 MB/s</p>

<p>AES-128/GCM: 252 MB/s</p>

<blockquote>
<p>Not disastrous anymore, but still, very, very bad. Of course, you&#39;ve got keep in mind, the thing we&#39;re comparing it to, OpenSSL, is no slouch. It&#39;s got hand-written highly optimized inline assembly implementations of most of these encryption functions and their specific modes, for lots of platforms. That&#39;s a ton of code to maintain and optimize, but I&#39;ll be damned if I let this kind of performance gap persist.</p>

<p>Fixing this, however, is not so trivial anymore. It pertains to how the KCF&#39;s block cipher mode API interacts with the cipher algorithms. It is beautifully designed and implemented in a fashion that creates minimum code duplication, but this also means that it&#39;s inherently inefficient.</p>

<p>ECB, CBC and CTR gained the ability to pass an algorithm-specific &quot;fastpath&quot; implementation of the block cipher mode, because these functions benefit greatly from pipelining multiple cipher calls into a single place.</p>

<p>ECB, CTR and CBC decryption benefit enormously from being able to exploit the wide XMM register file on Intel to perform encryption/decryption operations on 8 blocks at the same time in a non-interlocking manner. The performance gains here are on the order of 5-8x.CBC encryption benefits from not having to copy the previously encrypted ciphertext blocks into memory and back into registers to XOR them with the subsequent plaintext blocks, though here the gains are more modest, around 1.3-1.5x.</p>

<p>After all of this work, this is how the results now look on Illumos, even inside of a VM:</p>
</blockquote>

<p>Algorithm/Mode 128k ops</p>

<p>AES-128/CTR: 3121 MB/s</p>

<p>AES-128/CBC: 691 MB/s</p>

<p>AES-128/GCM: 1053 MB/s</p>

<ul>
<li>So the CTR and GCM speeds have actually caught up to OpenSSL, and CBC is actually faster than OpenSSL.</li>
</ul>

<blockquote>
<p>On the decryption side of things, CBC decryption also jumped from 627 MB/s to 3011 MB/s. Seeing these performance numbers, you can see why I chose 32k for the operation size in between kernel preemption barriers. Even on the slowest hardware with AES-NI, we can expect at least 300-400 MB/s/core of throughput, so even in the worst case, we&#39;ll be hogging the CPU for at most ~0.1ms per run.</p>

<p>Overall, we&#39;re even a little bit faster than OpenSSL in some tests, though that&#39;s probably down to us encrypting 128k blocks vs 8k in the &quot;openssl speed&quot; utility. Anyway, having fixed this monstrous atrocity of a performance bug, I can now finally get some sleep.</p>
</blockquote>

<ul>
<li>To made these tests repeatable, and to ensure that the changes didn’t break the crypto algorithms, Saso created a crypto_test kernel module.</li>
<li>I have recently created a FreeBSD version of crypto_test.ko, for much the same purposes</li>
<li>Initial performance on FreeBSD is not as bad, if you have the aesni.ko module loaded, but it is not up to speed with OpenSSL. You cannot directly compare to the benchmarks Saso did, because the CPUs are vastly different.</li>
<li><a href="https://wiki.freebsd.org/OpenCryptoPerformance" rel="nofollow">Performance results</a></li>
<li>I hope to do some more tests on a range of different sized CPUs in order to determine how the algorithms scale across different clock speeds.</li>
<li>I also want to look at, or get help and have someone else look at, implementing some of the same optimizations that Saso did.</li>
<li>It currently seems like there isn’t a way to perform addition crypto operations in the same session without regenerating the key table. Processing additional buffers in an existing session might offer a number of optimizations for bulk operations, although in many cases, each block is encrypted with a different key and/or IV, so it might not be very useful.
***</li>
</ul>

<h3><a href="http://www.brendangregg.com/specials.html" rel="nofollow">Brendan Gregg’s special freeware tools for sysadmins</a></h3>

<ul>
<li>These tools need to be in every (not so) serious sysadmins toolbox. </li>
<li>Triple ROT13 encryption algorithm (beware: export restrictions may apply)</li>
<li>/usr/bin/maybe, in case true and false don’t provide too little choice...</li>
<li>The bottom command lists you all the processes using the least CPU cycles.</li>
<li>Check out the rest of the tools. </li>
<li>You wrote similar tools and want us to cover them in the show? Send us an email to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> 
***</li>
</ul>

<h3><a href="http://www.lieberbiber.de/2017/03/14/a-look-at-the-year-20362038-problems-and-time-proofness-in-various-systems/" rel="nofollow">A look at 2038 </a></h3>

<blockquote>
<p>I remember the Y2K problem quite vividly. The world was going crazy for years, paying insane amounts of money to experts to fix critical legacy systems, and there was a neverending stream of predictions from the media on how it’s all going to fail. Most didn’t even understand what the problem was, and I remember one magazine writing something like the following:<br>
Most systems store the current year as a two-digit value to save space. When the value rolls over on New Year’s Eve 1999, those two digits will be “00”, and “00” means “halt operation” in the machine language of many central processing units. If you’re in an elevator at this time, it will stop working and you may fall to your death.<br>
I still don’t know why they thought a computer would suddenly interpret data as code, but people believed them. We could see a nearby hydropower plant from my parents’ house, and we expected it to go up in flames as soon as the clock passed midnight, while at least two airplanes crashed in our garden at the same time. Then nothing happened. I think one of the most “severe” problems was the police not being able to open their car garages the next day because their RFID tokens had both a start and end date for validity, and the system clock had actually rolled over to 1900, so the tokens were “not yet valid”.<br>
That was 17 years ago. One of the reasons why Y2K wasn’t as bad as it could have been is that many systems had never used the “two-digit-year” representation internally, but use some form of “timestamp” relative to a fixed date (the “epoch”).<br>
The actual problem with time and dates rolling over is that systems calculate timestamp differences all day. Since a timestamp derived from the system clock seemingly only increases with each query, it is very common to just calculate diff = now - before and never care about the fact that now could suddenly be lower than before because the system clock has rolled over. In this case diff is suddenly negative, and if other parts of the code make further use of the suddenly negative value, things can go horribly wrong.<br>
A good example was a bug in the generator control units (GCUs) aboard Boeing 787 “Dreamliner” aircrafts, discovered in 2015. An internal timestamp counter would overflow roughly 248 days after the system had been powered on, triggering a shut down to “safe mode”. The aircraft has four generator units, but if all were powered up at the same time, they would all fail at the same time. This sounds like an overflow caused by a signed 32-bit counter counting the number of centiseconds since boot, overflowing after 248.55 days, and luckily no airline had been using their Boing 787 models for such a long time between maintenance intervals.<br>
The “obvious” solution is to simply switch to 64-Bit values and call it day, which would push overflow dates far into the future (as long as you don’t do it like the IBM S/370 mentioned before). But as we’ve learned from the Y2K problem, you have to assume that computer systems, computer software and stored data (which often contains timestamps in some form) will stay with us for much longer than we might think. The years 2036 and 2038 might be far in the future, but we have to assume that many of the things we make and sell today are going to be used and supported for more than just 19 years. Also many systems have to store dates which are far in the future. A 30 year mortgage taken out in 2008 could have already triggered the bug, and for some banks it supposedly did.<br>
sys_gettimeofday() is one of the most used system calls on a generic Linux system and returns the current time in form of an UNIX timestamp (time_t data type) plus fraction (suseconds_t data type). Many applications have to know the current time and date to do things, e.g. displaying it, using it in game timing loops, invalidating caches after their lifetime ends, perform an action after a specific moment has passed, etc. In a 32-Bit UNIX system, time_t is usually defined as a signed 32-Bit Integer.<br>
When kernel, libraries and applications are compiled, the compiler will turn this assumption machine code and all components later have to match each other. So a 32-Bit Linux application or library still expects the kernel to return a 32-Bit value even if the kernel is running on a 64-Bit architecture and has 32-Bit compatibility. The same holds true for applications calling into libraries. This is a major problem, because there will be a lot of legacy software running in 2038. Systems which used an unsigned 32-Bit Integer for time_t push the problem back to 2106, but I don’t know about many of those.<br>
The developers of the GNU C library (glibc), the default standard C library for many GNU/Linux systems, have come up with a design for year 2038 proofness for their library. Besides the time_t data type itself, a number of other data structures have fields based on time_t or the combined struct timespec and struct timeval types. Many methods beside those intended for setting and querying the current time use timestamps<br>
32-Bit Windows applications, or Windows applications defining _USE_32BIT_TIME_T, can be hit by the year 2038 problem too if they use the time_t data type. The __time64_t data type had been available since Visual C 7.1, but only Visual C 8 (default with Visual Studio 2015) expanded time_t to 64 bits by default. The change will only be effective after a recompilation, legacy applications will continue to be affected.<br>
If you live in a 64-Bit world and use a 64-Bit kernel with 64-Bit only applications, you might think you can just ignore the problem. In such a constellation all instances of the standard time_t data type for system calls, libraries and applications are signed 64-Bit Integers which will overflow in around 292 billion years. But many data formats, file systems and network protocols still specify 32-Bit time fields, and you might have to read/write this data or talk to legacy systems after 2038. So solving the problem on your side alone is not enough.</p>
</blockquote>

<ul>
<li>Then the article goes on to describe how all of this will break your file systems. Not to mention your databases and other file formats.</li>
<li>Also see <a href="https://www.openbsd.org/papers/eurobsdcon_2013_time_t/mgp00001.html" rel="nofollow">Theo De Raadt’s EuroBSDCon 2013 Presentation</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://blather.michaelwlucas.com/archives/2895" rel="nofollow">Michael Lucas: Get your name in “Absolute FreeBSD 3rd Edition”</a></p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=r315435" rel="nofollow">ZFS compressed ARC stats to top</a></p></li>
<li><p><a href="https://www.dragonflydigest.com/2017/03/14/19452.html" rel="nofollow">Matthew Dillon discovered HAMMER was repeating itself when writing to disk.  Fixing that issue doubled write speeds</a></p></li>
<li><p><a href="http://www.tedunangst.com/flak/post/shrt-nms-fr-clrty" rel="nofollow">TedU on Meaningful Short Names </a></p></li>
<li><p><a href="https://www.freebsdfoundation.org/blog/submit-your-work-vbsdcon-and-eurobsdcon-cfps-now-open/" rel="nofollow">vBSDcon and EuroBSDcon Call for Papers are open</a></p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/NMshpZ7n" rel="nofollow">Craig asks about BSD server management</a></li>
<li><a href="http://pastebin.com/UqRwMcRk" rel="nofollow">Michael asks about jails as a router between networks</a></li>
<li><a href="http://pastebin.com/i1ZD6eXN" rel="nofollow">Todd asks about connecting jails </a></li>
<li><a href="http://pastebin.com/QzW5c9wV" rel="nofollow">Dave writes in with an interesting link</a>
&gt; applications crash more often due to errors than corruptions. In the case of corruption, a few applications (e.g., Log-Cabin, ZooKeeper) can use checksums and redundancy to recover, leading to a correct behavior; however, when the corruption is transformed into an error, these applications crash, resulting in reduced availability.
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, reports from AsiaBSDcon, TrueOS and FreeBSD news,  Optimizing IllumOS Kernel, your questions and more.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="" rel="nofollow">AsiaBSDcon Reports and Reviews</a></h3>

<ul>
<li><a href="https://2017.asiabsdcon.org/program.html.en" rel="nofollow">AsiaBSDcon schedule</a></li>
<li><a href="http://bhyvecon.org/" rel="nofollow">Schedule and slides from the 4th bhyvecon</a></li>
<li><a href="https://www.ixsystems.com/blog/ixsystems-attends-asiabsdcon-2017" rel="nofollow">Michael Dexter’s trip report on the iXsystems blog</a></li>
<li><a href="http://mail-index.netbsd.org/netbsd-advocacy/2017/03/13/msg000729.html" rel="nofollow">NetBSD AsiaBSDcon booth report</a>
***</li>
</ul>

<h3><a href="https://www.trueos.org/blog/trueos-community-guidelines/" rel="nofollow">TrueOS Community Guidelines are here!</a></h3>

<ul>
<li>TrueOS has published its new Community Guidelines</li>
<li>The TrueOS Project has existed for over ten years. Until now, there was no formally defined process for interested individuals in the TrueOS community to earn contributor status as an active committer to this long-standing project. The current core TrueOS developers (Kris Moore, Ken Moore, and Joe Maloney) want to provide the community more opportunities to directly impact the TrueOS Project, and wish to formalize the process for interested people to gain full commit access to the TrueOS repositories.</li>
<li>These describe what is expected of community members and committers</li>
<li>They also describe the process of getting commit access to the TrueOS repo:</li>
</ul>

<blockquote>
<p>Previously, Kris directly handed out commit bits. Now, the Core developers have provided a small list of requirements for gaining a TrueOS commit bit:</p>

<p>Create five or more pull requests in a TrueOS Project repository within a single six month period. </p>

<p>Stay active in the TrueOS community through at least one of the available community channels (Gitter, Discourse, IRC, etc.). </p>

<p>Request commit access from the core developers via <a href="mailto:core@trueos.org" rel="nofollow">core@trueos.org</a> OR Core developers contact you concerning commit access.</p>

<p>Pull requests can be any contribution to the project, from minor documentation tweaks to creating full utilities.</p>

<p>At the end of every month, the core developers review the commit logs, removing elements that break the Project or deviate too far from its intended purpose. Additionally, outstanding pull requests with no active dissension are immediately merged, if possible. For example, a user submits a pull request which adds a little-used OpenRC script. No one from the community comments on the request or otherwise argues against its inclusion, resulting in an automatic merge at the end of the month. In this manner, solid contributions are routinely added to the project and never left in a state of “limbo”.</p>
</blockquote>

<ul>
<li>The page also describes the perks of being a TrueOS committer:</li>
</ul>

<blockquote>
<p>Contributors to the TrueOS Project enjoy a number of benefits, including:</p>

<p>A personal TrueOS email alias: <youralias>@trueos.org</p>

<p>Full access for managing TrueOS issues on GitHub.</p>

<p>Regular meetings with the core developers and other contributors.</p>

<p>Access to private chat channels with the core developers.</p>

<p>Recognition as part of an online Who’s Who of TrueOS developers.</p>

<p>The eternal gratitude of the core developers of TrueOS.</p>

<p>A warm, fuzzy feeling.</p>
</blockquote>

<hr>

<h3><a href="https://www.freebsdfoundation.org/news-and-events/latest-news/new-uranium-level-donation-and-collaborative-partnership-with-intel/" rel="nofollow">Intel Donates 250.000 $ to the FreeBSD Foundation</a></h3>

<ul>
<li>More details about the deal: Systems Thinking: <a href="https://www.freebsdfoundation.org/blog/systems-thinking-intel-and-the-freebsd-project/" rel="nofollow">Intel and the FreeBSD Project</a> </li>
</ul>

<blockquote>
<p>Intel will be more actively engaging with the FreeBSD Foundation and the FreeBSD Project to deliver more timely support for Intel products and technologies in FreeBSD.</p>

<p>Intel has contributed code to FreeBSD for individual device drivers (i.e. NICs) in the past, but is now seeking a more holistic “systems thinking” approach. </p>
</blockquote>

<ul>
<li><a href="https://01.org/blogs/imad/2017/intel-increases-support-freebsd-project" rel="nofollow">Intel Blog Post </a></li>
</ul>

<blockquote>
<p>We will work closely with the FreeBSD Foundation to ensure the drivers, tools, and applications needed on Intel® SSD-based storage appliances are available to the community. This collaboration will also provide timely support for future Intel® 3D XPoint™ products.</p>
</blockquote>

<ul>
<li>Thank you very much, Intel!
***</li>
</ul>

<h3><a href="https://globalengineer.wordpress.com/2017/03/05/applied-freebsd-basic-iscsi/" rel="nofollow">Applied FreeBSD: Basic iSCSI</a></h3>

<blockquote>
<p>iSCSI is often touted as a low-cost replacement for fibre-channel (FC) Storage Area Networks (SANs). Instead of having to setup a separate fibre-channel network for the SAN, or invest in the infrastructure to run Fibre-Channel over Ethernet (FCoE), iSCSI runs on top of standard TCP/IP. This means that the same network equipment used for routing user data on a network could be utilized for the storage as well.</p>

<p>This article will cover a very basic setup where a FreeBSD server is configured as an iSCSI Target, and another FreeBSD server is configured as the iSCSI Initiator. The iSCSI Target will export a single disk drive, and the initiator will create a filesystem on this disk and mount it locally. Advanced topics, such as multipath, ZFS storage pools, failover controllers, etc. are not covered.</p>

<p>The real magic is the /etc/ctl.conf file, which contains all of the information necessary for ctld to share disk drives on the network. Check out the man page for /etc/ctl.conf for more details; below is the configuration file that I created for this test setup. Note that on a system that has never had iSCSI configured, there will be no existing configuration file, so go ahead and create it.</p>
</blockquote>

<ul>
<li><p>Then, enable ctld and start it:</p>

<ul>
<li>sysrc ctld_enable=”YES”</li>
<li>service ctld start</li>
</ul></li>
<li><p>You can use the ctladm command to see what is going on:</p></li>
</ul>

<p>root@bsdtarget:/dev # ctladm lunlist</p>

<p>(7:0:0/0): <FREEBSD CTLDISK 0001> Fixed Direct Access SPC-4 SCSI device</p>

<p>(7:0:1/1): <FREEBSD CTLDISK 0001> Fixed Direct Access SPC-4 SCSI device</p>

<p>root@bsdtarget:/dev # ctladm devlist</p>

<p>LUN Backend Size (Blocks) BS Serial Number Device ID</p>

<p>0 block 10485760 512 MYSERIAL 0 MYDEVID 0</p>

<p>1 block 10485760 512 MYSERIAL 1 MYDEVID 1</p>

<ul>
<li>Now, let’s configure the client side:</li>
</ul>

<blockquote>
<p>In order for a FreeBSD host to become an iSCSI Initiator, the iscsd daemon needs to be started.</p>
</blockquote>

<ul>
<li><p>sysrc iscsid_enable=”YES”</p></li>
<li><p>service iscsid start</p></li>
</ul>

<blockquote>
<p>Next, the iSCSI Initiator can manually connect to the iSCSI target using the iscsictl tool. While setting up a new iSCSI session, this is probably the best option. Once you are sure the configuration is correct, add the configuration to the /etc/iscsi.conf file (see man page for this file). For iscsictl, pass the IP address of the target as well as the iSCSI IQN for the session:</p>
</blockquote>

<pre><code>+ iscsictl -A -p 192.168.22.128 -t iqn.2017-02.lab.testing:basictarget
</code></pre>

<ul>
<li><p>You should now have a new device (check dmesg), in this case, da1</p></li>
<li><p>The guide them walks through partitioning the disk, and laying down a UFS file system, and mounting it</p></li>
<li><p>This it walks through how to disconnect iscsi, incase you don’t want it anymore</p></li>
<li><p>This all looked nice and easy, and it works very well. Now lets see what happens when you try to mount the iSCSI from Windows</p></li>
<li><p>Ok, that wasn’t so bad.</p></li>
<li><p>Now, instead of sharing an entire space disk on the host via iSCSI, share a zvol. Now your windows machine can be backed by ZFS. All of your problems are solved.</p></li>
</ul>

<hr>

<h2>Interview - Philipp Buehler - <a href="mailto:pbuehler@sysfive.com" rel="nofollow">pbuehler@sysfive.com</a></h2>

<p>Technical Lead at SysFive, and Former OpenBSD Committer</p>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170316080827" rel="nofollow">Half a dozen new features in mandoc -T html</a></h3>

<ul>
<li><a href="http://man.openbsd.org/mandoc.1" rel="nofollow">mandoc</a>’s HTML output mode got some new features</li>
</ul>

<blockquote>
<p>Even though mdoc(7) is a semantic markup language, traditionally none of the semantic annotations were communicated to the reader. [...] Now, at least in -T html output mode, you can see the semantic function of marked-up words by hovering your mouse over them.</p>

<p>In terminal output modes, we have the ctags(1)-like internal search facility built around the less(1) tag jump (:t) feature for quite some time now. We now have a similar feature in -T html output mode. To jump to (almost) the same places in the text, go to the address bar of the browser, type a hash mark (&#39;#&#39;) after the URI, then the name of the option, command, variable, error code etc. you want to jump to, and hit enter.</p>
</blockquote>

<ul>
<li>Check out the full report by Ingo Schwarze (schwarze@) and try out these new features
***</li>
</ul>

<h3><a href="http://zfs-create.blogspot.com/2014/05/optimizing-illumos-kernel-crypto.html" rel="nofollow">Optimizing IllumOS Kernel Crypto</a></h3>

<ul>
<li>Sašo Kiselkov, of ZFS fame, looked into the performance of the OpenSolaris kernel crypto framework and found it lacking.</li>
<li>The article also spends a few minutes on the different modes and how they work.</li>
</ul>

<blockquote>
<p>Recently I&#39;ve had some motivation to look into the KCF on Illumos and discovered that, unbeknownst to me, we already had an AES-NI implementation that was automatically enabled when running on Intel and AMD CPUs with AES-NI support. This work was done back in 2010 by Dan Anderson.This was great news, so I set out to test the performance in Illumos in a VM on my Mac with a Core i5 3210M (2.5GHz normal, 3.1GHz turbo).</p>
</blockquote>

<ul>
<li>The initial tests of “what the hardware can do” were done in OpenSSL</li>
</ul>

<blockquote>
<p>So now comes the test for the KCF. I wrote a quick&#39;n&#39;dirty crypto test module that just performed a bunch of encryption operations and timed the results.</p>
</blockquote>

<ul>
<li>KCF got around 100 MB/s for each algorithm, except half that for AES-GCM</li>
<li>OpenSSL had done over 3000 MB/s for CTR mode, 500 MB/s for CBC, and 1000 MB/s for GCM</li>
</ul>

<blockquote>
<p>What the hell is that?! This is just plain unacceptable. Obviously we must have hit some nasty performance snag somewhere, because this is comical. And sure enough, we did.</p>

<p>When looking around in the AES-NI implementation I came across this bit in aes_intel.s that performed the CLTS instruction.</p>

<p>This is a problem: 3.1.2 Instructions That Cause VM Exits ConditionallyCLTS. The CLTS instruction causes a VM exit if the bits in position 3 (corresponding to CR0.TS) are set in both the CR0 guest/host mask and the CR0 read shadow.</p>

<p>The CLTS instruction signals to the CPU that we&#39;re about to use FPU registers (which is needed for AES-NI), which in VMware causes an exit into the hypervisor. And we&#39;ve been doing it for every single AES block! Needless to say, performing the equivalent of a very expensive context switch every 16 bytes is going to hurt encryption performance a bit. The reason why the kernel is issuing CLTS is because for performance reasons, the kernel doesn&#39;t save and restore FPU register state on kernel thread context switches. So whenever we need to use FPU registers inside the kernel, we must disable kernel thread preemption via a call to kpreempt_disable() and kpreempt_enable() and save and restore FPU register state manually. During this time, we cannot be descheduled (because if we were, some other thread might clobber our FPU registers), so if a thread does this for too long, it can lead to unexpected latency bubbles</p>

<p>The solution was to restructure the AES and KCF block crypto implementations in such a way that we execute encryption in meaningfully small chunks. I opted for 32k bytes, for reasons which I&#39;ll explain below. Unfortunately, doing this restructuring work was a bit more complicated than one would imagine, since in the KCF the implementation of the AES encryption algorithm and the block cipher modes is separated into two separate modules that interact through an internal API, which wasn&#39;t really conducive to high performance (we&#39;ll get to that later). Anyway, having fixed the issue here and running the code at near native speed, this is what I get:</p>
</blockquote>

<p>AES-128/CTR: 439 MB/s</p>

<p>AES-128/CBC: 483 MB/s</p>

<p>AES-128/GCM: 252 MB/s</p>

<blockquote>
<p>Not disastrous anymore, but still, very, very bad. Of course, you&#39;ve got keep in mind, the thing we&#39;re comparing it to, OpenSSL, is no slouch. It&#39;s got hand-written highly optimized inline assembly implementations of most of these encryption functions and their specific modes, for lots of platforms. That&#39;s a ton of code to maintain and optimize, but I&#39;ll be damned if I let this kind of performance gap persist.</p>

<p>Fixing this, however, is not so trivial anymore. It pertains to how the KCF&#39;s block cipher mode API interacts with the cipher algorithms. It is beautifully designed and implemented in a fashion that creates minimum code duplication, but this also means that it&#39;s inherently inefficient.</p>

<p>ECB, CBC and CTR gained the ability to pass an algorithm-specific &quot;fastpath&quot; implementation of the block cipher mode, because these functions benefit greatly from pipelining multiple cipher calls into a single place.</p>

<p>ECB, CTR and CBC decryption benefit enormously from being able to exploit the wide XMM register file on Intel to perform encryption/decryption operations on 8 blocks at the same time in a non-interlocking manner. The performance gains here are on the order of 5-8x.CBC encryption benefits from not having to copy the previously encrypted ciphertext blocks into memory and back into registers to XOR them with the subsequent plaintext blocks, though here the gains are more modest, around 1.3-1.5x.</p>

<p>After all of this work, this is how the results now look on Illumos, even inside of a VM:</p>
</blockquote>

<p>Algorithm/Mode 128k ops</p>

<p>AES-128/CTR: 3121 MB/s</p>

<p>AES-128/CBC: 691 MB/s</p>

<p>AES-128/GCM: 1053 MB/s</p>

<ul>
<li>So the CTR and GCM speeds have actually caught up to OpenSSL, and CBC is actually faster than OpenSSL.</li>
</ul>

<blockquote>
<p>On the decryption side of things, CBC decryption also jumped from 627 MB/s to 3011 MB/s. Seeing these performance numbers, you can see why I chose 32k for the operation size in between kernel preemption barriers. Even on the slowest hardware with AES-NI, we can expect at least 300-400 MB/s/core of throughput, so even in the worst case, we&#39;ll be hogging the CPU for at most ~0.1ms per run.</p>

<p>Overall, we&#39;re even a little bit faster than OpenSSL in some tests, though that&#39;s probably down to us encrypting 128k blocks vs 8k in the &quot;openssl speed&quot; utility. Anyway, having fixed this monstrous atrocity of a performance bug, I can now finally get some sleep.</p>
</blockquote>

<ul>
<li>To made these tests repeatable, and to ensure that the changes didn’t break the crypto algorithms, Saso created a crypto_test kernel module.</li>
<li>I have recently created a FreeBSD version of crypto_test.ko, for much the same purposes</li>
<li>Initial performance on FreeBSD is not as bad, if you have the aesni.ko module loaded, but it is not up to speed with OpenSSL. You cannot directly compare to the benchmarks Saso did, because the CPUs are vastly different.</li>
<li><a href="https://wiki.freebsd.org/OpenCryptoPerformance" rel="nofollow">Performance results</a></li>
<li>I hope to do some more tests on a range of different sized CPUs in order to determine how the algorithms scale across different clock speeds.</li>
<li>I also want to look at, or get help and have someone else look at, implementing some of the same optimizations that Saso did.</li>
<li>It currently seems like there isn’t a way to perform addition crypto operations in the same session without regenerating the key table. Processing additional buffers in an existing session might offer a number of optimizations for bulk operations, although in many cases, each block is encrypted with a different key and/or IV, so it might not be very useful.
***</li>
</ul>

<h3><a href="http://www.brendangregg.com/specials.html" rel="nofollow">Brendan Gregg’s special freeware tools for sysadmins</a></h3>

<ul>
<li>These tools need to be in every (not so) serious sysadmins toolbox. </li>
<li>Triple ROT13 encryption algorithm (beware: export restrictions may apply)</li>
<li>/usr/bin/maybe, in case true and false don’t provide too little choice...</li>
<li>The bottom command lists you all the processes using the least CPU cycles.</li>
<li>Check out the rest of the tools. </li>
<li>You wrote similar tools and want us to cover them in the show? Send us an email to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> 
***</li>
</ul>

<h3><a href="http://www.lieberbiber.de/2017/03/14/a-look-at-the-year-20362038-problems-and-time-proofness-in-various-systems/" rel="nofollow">A look at 2038 </a></h3>

<blockquote>
<p>I remember the Y2K problem quite vividly. The world was going crazy for years, paying insane amounts of money to experts to fix critical legacy systems, and there was a neverending stream of predictions from the media on how it’s all going to fail. Most didn’t even understand what the problem was, and I remember one magazine writing something like the following:<br>
Most systems store the current year as a two-digit value to save space. When the value rolls over on New Year’s Eve 1999, those two digits will be “00”, and “00” means “halt operation” in the machine language of many central processing units. If you’re in an elevator at this time, it will stop working and you may fall to your death.<br>
I still don’t know why they thought a computer would suddenly interpret data as code, but people believed them. We could see a nearby hydropower plant from my parents’ house, and we expected it to go up in flames as soon as the clock passed midnight, while at least two airplanes crashed in our garden at the same time. Then nothing happened. I think one of the most “severe” problems was the police not being able to open their car garages the next day because their RFID tokens had both a start and end date for validity, and the system clock had actually rolled over to 1900, so the tokens were “not yet valid”.<br>
That was 17 years ago. One of the reasons why Y2K wasn’t as bad as it could have been is that many systems had never used the “two-digit-year” representation internally, but use some form of “timestamp” relative to a fixed date (the “epoch”).<br>
The actual problem with time and dates rolling over is that systems calculate timestamp differences all day. Since a timestamp derived from the system clock seemingly only increases with each query, it is very common to just calculate diff = now - before and never care about the fact that now could suddenly be lower than before because the system clock has rolled over. In this case diff is suddenly negative, and if other parts of the code make further use of the suddenly negative value, things can go horribly wrong.<br>
A good example was a bug in the generator control units (GCUs) aboard Boeing 787 “Dreamliner” aircrafts, discovered in 2015. An internal timestamp counter would overflow roughly 248 days after the system had been powered on, triggering a shut down to “safe mode”. The aircraft has four generator units, but if all were powered up at the same time, they would all fail at the same time. This sounds like an overflow caused by a signed 32-bit counter counting the number of centiseconds since boot, overflowing after 248.55 days, and luckily no airline had been using their Boing 787 models for such a long time between maintenance intervals.<br>
The “obvious” solution is to simply switch to 64-Bit values and call it day, which would push overflow dates far into the future (as long as you don’t do it like the IBM S/370 mentioned before). But as we’ve learned from the Y2K problem, you have to assume that computer systems, computer software and stored data (which often contains timestamps in some form) will stay with us for much longer than we might think. The years 2036 and 2038 might be far in the future, but we have to assume that many of the things we make and sell today are going to be used and supported for more than just 19 years. Also many systems have to store dates which are far in the future. A 30 year mortgage taken out in 2008 could have already triggered the bug, and for some banks it supposedly did.<br>
sys_gettimeofday() is one of the most used system calls on a generic Linux system and returns the current time in form of an UNIX timestamp (time_t data type) plus fraction (suseconds_t data type). Many applications have to know the current time and date to do things, e.g. displaying it, using it in game timing loops, invalidating caches after their lifetime ends, perform an action after a specific moment has passed, etc. In a 32-Bit UNIX system, time_t is usually defined as a signed 32-Bit Integer.<br>
When kernel, libraries and applications are compiled, the compiler will turn this assumption machine code and all components later have to match each other. So a 32-Bit Linux application or library still expects the kernel to return a 32-Bit value even if the kernel is running on a 64-Bit architecture and has 32-Bit compatibility. The same holds true for applications calling into libraries. This is a major problem, because there will be a lot of legacy software running in 2038. Systems which used an unsigned 32-Bit Integer for time_t push the problem back to 2106, but I don’t know about many of those.<br>
The developers of the GNU C library (glibc), the default standard C library for many GNU/Linux systems, have come up with a design for year 2038 proofness for their library. Besides the time_t data type itself, a number of other data structures have fields based on time_t or the combined struct timespec and struct timeval types. Many methods beside those intended for setting and querying the current time use timestamps<br>
32-Bit Windows applications, or Windows applications defining _USE_32BIT_TIME_T, can be hit by the year 2038 problem too if they use the time_t data type. The __time64_t data type had been available since Visual C 7.1, but only Visual C 8 (default with Visual Studio 2015) expanded time_t to 64 bits by default. The change will only be effective after a recompilation, legacy applications will continue to be affected.<br>
If you live in a 64-Bit world and use a 64-Bit kernel with 64-Bit only applications, you might think you can just ignore the problem. In such a constellation all instances of the standard time_t data type for system calls, libraries and applications are signed 64-Bit Integers which will overflow in around 292 billion years. But many data formats, file systems and network protocols still specify 32-Bit time fields, and you might have to read/write this data or talk to legacy systems after 2038. So solving the problem on your side alone is not enough.</p>
</blockquote>

<ul>
<li>Then the article goes on to describe how all of this will break your file systems. Not to mention your databases and other file formats.</li>
<li>Also see <a href="https://www.openbsd.org/papers/eurobsdcon_2013_time_t/mgp00001.html" rel="nofollow">Theo De Raadt’s EuroBSDCon 2013 Presentation</a>
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://blather.michaelwlucas.com/archives/2895" rel="nofollow">Michael Lucas: Get your name in “Absolute FreeBSD 3rd Edition”</a></p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=r315435" rel="nofollow">ZFS compressed ARC stats to top</a></p></li>
<li><p><a href="https://www.dragonflydigest.com/2017/03/14/19452.html" rel="nofollow">Matthew Dillon discovered HAMMER was repeating itself when writing to disk.  Fixing that issue doubled write speeds</a></p></li>
<li><p><a href="http://www.tedunangst.com/flak/post/shrt-nms-fr-clrty" rel="nofollow">TedU on Meaningful Short Names </a></p></li>
<li><p><a href="https://www.freebsdfoundation.org/blog/submit-your-work-vbsdcon-and-eurobsdcon-cfps-now-open/" rel="nofollow">vBSDcon and EuroBSDcon Call for Papers are open</a></p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/NMshpZ7n" rel="nofollow">Craig asks about BSD server management</a></li>
<li><a href="http://pastebin.com/UqRwMcRk" rel="nofollow">Michael asks about jails as a router between networks</a></li>
<li><a href="http://pastebin.com/i1ZD6eXN" rel="nofollow">Todd asks about connecting jails </a></li>
<li><a href="http://pastebin.com/QzW5c9wV" rel="nofollow">Dave writes in with an interesting link</a>
&gt; applications crash more often due to errors than corruptions. In the case of corruption, a few applications (e.g., Log-Cabin, ZooKeeper) can use checksums and redundancy to recover, leading to a correct behavior; however, when the corruption is transformed into an error, these applications crash, resulting in reduced availability.
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>185: Exit Interview</title>
  <link>https://www.bsdnow.tv/185</link>
  <guid isPermaLink="false">446a8257-5abe-44a0-848d-f0fa050eec68</guid>
  <pubDate>Thu, 16 Mar 2017 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/446a8257-5abe-44a0-848d-f0fa050eec68.mp3" length="39697780" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This is a very special BSD Now! New exciting changes are coming to the show and we’re gonna cover them, so stick around or you’ll miss it!</itunes:subtitle>
  <itunes:duration>55:08</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This is a very special BSD Now! New exciting changes are coming to the show and we’re gonna cover them, so stick around or you’ll miss it!
&lt;h2&gt;Interview – Kris Moore – &lt;a href="mailto:kris@trueos.org"&gt;kris@trueos.org&lt;/a&gt; / &lt;a href="https://twitter.com/pcbsdKris"&gt;@pcbsdKris&lt;/a&gt;
&lt;/h2&gt;&lt;ul&gt;&lt;li&gt;TrueOS founder, FreeNAS developer, BSD Now co-host&lt;/li&gt;&lt;/ul&gt;&lt;h2&gt;Benedict Reuschling – &lt;a href="mailto:bcr@freebsd.org"&gt;bcr@freebsd.org&lt;/a&gt; / &lt;a href="https://twitter.com/bsdbcr"&gt;@bsdbcr&lt;/a&gt;
&lt;/h2&gt;&lt;ul&gt;
&lt;li&gt;FreeBSD commiter &amp;amp; FreeBSD Foundation Vice President, BSD Now co-host&lt;/li&gt;
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
***
&lt;/ul&gt;</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This is a very special BSD Now! New exciting changes are coming to the show and we’re gonna cover them, so stick around or you’ll miss it!</p>

<p><h2>Interview – Kris Moore – <a href="mailto:kris@trueos.org"><a href="mailto:kris@trueos.org" rel="nofollow">kris@trueos.org</a></a> / <a href="https://twitter.com/pcbsdKris">@pcbsdKris</a></h2><ul><li>TrueOS founder, FreeNAS developer, BSD Now co-host</li></ul><h2>Benedict Reuschling – <a href="mailto:bcr@freebsd.org"><a href="mailto:bcr@freebsd.org" rel="nofollow">bcr@freebsd.org</a></a> / <a href="https://twitter.com/bsdbcr">@bsdbcr</a></h2><ul><li>FreeBSD commiter &amp; FreeBSD Foundation Vice President, BSD Now co-host</li></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This is a very special BSD Now! New exciting changes are coming to the show and we’re gonna cover them, so stick around or you’ll miss it!</p>

<p><h2>Interview – Kris Moore – <a href="mailto:kris@trueos.org"><a href="mailto:kris@trueos.org" rel="nofollow">kris@trueos.org</a></a> / <a href="https://twitter.com/pcbsdKris">@pcbsdKris</a></h2><ul><li>TrueOS founder, FreeNAS developer, BSD Now co-host</li></ul><h2>Benedict Reuschling – <a href="mailto:bcr@freebsd.org"><a href="mailto:bcr@freebsd.org" rel="nofollow">bcr@freebsd.org</a></a> / <a href="https://twitter.com/bsdbcr">@bsdbcr</a></h2><ul><li>FreeBSD commiter &amp; FreeBSD Foundation Vice President, BSD Now co-host</li></p>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>184: Tokyo Dreaming</title>
  <link>https://www.bsdnow.tv/184</link>
  <guid isPermaLink="false">5dde9785-effd-47e6-bcad-d71fe4690749</guid>
  <pubDate>Wed, 08 Mar 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5dde9785-effd-47e6-bcad-d71fe4690749.mp3" length="68369044" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, Allan and I are in Tokyo for AsiaBSDCon, but not to worry, we have a full episode lined up and ready to go. Hackathon reports</itunes:subtitle>
  <itunes:duration>1:34:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, Allan and I are in Tokyo for AsiaBSDCon, but not to worry, we have a full episode lined up and ready to go. Hackathon reports
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenBSD A2k17 hackathon reports
a2k17 hackathon report: Patrick Wildt on the arm64 port (http://undeadly.org/cgi?action=article&amp;amp;sid=20170131101827) 
a2k17 hackathon report: Antoine Jacoutot on syspatch, rc.d improvements and more (http://undeadly.org/cgi?action=article&amp;amp;sid=20170203232049) 
a2k17 hackathon report: Martin Pieuchot on NET_LOCK and much more  (http://undeadly.org/cgi?action=article&amp;amp;sid=20170127154356) 
a2k17 hackathon report: Kenneth Westerback on the hidden wonders of the build system, the network stack and more  (http://undeadly.org/cgi?action=article&amp;amp;sid=20170127031836) 
a2k17 hackathon report: Bob Beck on LibreSSL progress and more  (http://undeadly.org/cgi?action=article&amp;amp;sid=20170125225403) 
***
NetBSD is now reproducible  (https://blog.netbsd.org/tnf/entry/netbsd_fully_reproducible_builds)
Christos Zoulas posts to the NetBSD blog that he has completed his project to make fully reproducible NetBSD builds for amd64 and sparc64
I have been working on and off for almost a year trying to get reproducible builds (the same source tree always builds an identical cdrom) on NetBSD. I did not think at the time it would take as long or be so difficult, so I did not keep a log of all the changes I needed to make. I was also not the only one working on this. Other NetBSD developers have been making improvements for the past 6 years. I would like to acknowledge the NetBSD build system (aka build.sh) which is a fully portable cross-build system. This build system has given us a head-start in the reproducible builds work.
I would also like to acknowledge the work done by the Debian folks who have provided a platform to run, test and analyze reproducible builds. Special mention to the diffoscope tool that gives an excellent overview of what's different between binary files, by finding out what they are (and if they are containers what they contain) and then running the appropriate formatter and diff program to show what's different for each file.
Finally other developers who have started, motivated and did a lot of work getting us here like Joerg Sonnenberger and Thomas Klausner for their work on reproducible builds, and Todd Vierling and Luke Mewburn for their work on build.sh.
Some of the stumbling blocks that were overcome:
Timestamps
Date/time/author embedded in source files
Timezone sensitive code
Directory order / build order
Non-sanitized data stored in files
Symbolic links / paths
General tool inconsistencies: including gcc profiling, the fact that GPT partition tables, are by definition, globally unique each time they are created, and the iso9660 standard calls for a timestamp with a timezone.
Toolchain
Build information / tunables / environment. NetBSD now has a knob ‘MKREPRO’, if set to YES it sets a long list of variables to a consistent set of a values.
The post walks through how these problems where solves
Future Work:
Vary more parameters and find more inconsistencies
Verify that cross-building is reproducible
Verify that unprivileged builds are reproducible
Test on other platforms
***
Features are faults redux (http://www.tedunangst.com/flak/post/features-are-faults-redux)
From Ted Unangst
Last week I gave a talk for the security class at Notre Dame based on features are faults but with some various commentary added. It was an exciting trip, with the opportunity to meet and talk with the computer vision group as well. Some other highlights include the Indiana skillet I had for breakfast, which came with pickles and was amazing, and explaining the many wonders of cvs to the Linux users group over lunch. After that came the talk, which went a little something like this.
I got started with OpenBSD back about the same time I started college, although I had a slightly different perspective then. I was using OpenBSD because it included so many security features, therefore it must be the most secure system, right? For example, at some point I acquired a second computer. What’s the first thing anybody does when they get a second computer? That’s right, set up a kerberos domain. The idea that more is better was everywhere. This was also around the time that ipsec was getting its final touches, and everybody knew ipsec was going to be the most secure protocol ever because it had more options than any other secure transport. We’ll revisit this in a bit.
There’s been a partial attitude adjustment since then, with more people recognizing that layering complexity doesn’t result in more security. It’s not an additive process. There’s a whole talk there, about the perfect security that people can’t or won’t use. OpenBSD has definitely switched directions, including less code, not more. All the kerberos code was deleted a few years ago.
Let’s assume about one bug per 100 lines of code. That’s probably on the low end. Now say your operating system has 100 million lines of code. If I’ve done the math correctly, that’s literally a million bugs. So that’s one reason to avoid adding features. But that’s a solveable problem. If we pick the right language and the right compiler and the right tooling and with enough eyeballs and effort, we can fix all the bugs. We know how to build mostly correct software, we just don’t care.
As we add features to software, increasing its complexity, new unexpected behaviors start to emerge. What are the bounds? How many features can you add before craziness is inevitable? We can make some guesses. Less than a thousand for sure. Probably less than a hundred? Ten maybe? I’ll argue the answer is quite possibly two. Interesting corollary is that it’s impossible to have a program with exactly two features. Any program with two features has at least a third, but you don’t know what it is
My first example is a bug in the NetBSD ftp client. We had one feature, we added a second feature, and just like that we got a third misfeature (http://marc.info/?l=oss-security&amp;amp;m=141451507810253&amp;amp;w=2)
Our story begins long ago. The origins of this bug are probably older than I am. In the dark times before the web, FTP sites used to be a pretty popular way of publishing files. You run an ftp client, connect to a remote site, and then you can browse the remote server somewhat like a local filesystem. List files, change directories, get files. Typically there would be a README file telling you what’s what, but you don’t need to download a copy to keep. Instead we can pipe the output to a program like more. Right there in the ftp client. No need to disconnect.
Fast forward a few decades, and http is the new protocol of choice. http is a much less interactive protocol, but the ftp client has some handy features for batch downloads like progress bars, etc. So let’s add http support to ftp. This works pretty well. Lots of code reused.
http has one quirk however that ftp doesn’t have. Redirects. The server can redirect the client to a different file. So now you’re thinking, what happens if I download http://somefile and the server sends back 302 http://|reboot. ftp reconnects to the server, gets the 200, starts downloading and saves it to a file called |reboot. Except it doesn’t. The function that saves files looks at the first character of the name and if it’s a pipe, runs that command instead. And now you just rebooted your computer. Or worse.
It’s pretty obvious this is not the desired behavior, but where exactly did things go wrong? Arguably, all the pieces were working according to spec. In order to see this bug coming, you needed to know how the save function worked, you needed to know about redirects, and you needed to put all the implications together.
The post then goes into a lot more detail about other issues. We just don’t have time to cover it all today, but you should go read it, it is very enlightening
What do we do about this? That’s a tough question. It’s much easier to poke fun at all the people who got things wrong. But we can try. My attitudes are shaped by experiences with the OpenBSD project, and I think we are doing a decent job of containing the complexity. Keep paring away at dependencies and reducing interactions. As a developer, saying “no” to all feature requests is actually very productive. It’s so much faster than implementing the feature. Sometimes users complain, but I’ve often received later feedback from users that they’d come to appreciate the simplicity.
There was a question about which of these vulnerabilities were found by researchers, as opposed to troublemakers. The answer was most, if not all of them, but it made me realize one additional point I hadn’t mentioned. Unlike the prototypical buffer overflow vulnerability, exploiting features is very reliable. Exploiting something like shellshock or imagetragick requires no customized assembly and is independent of CPU, OS, version, stack alignment, malloc implementation, etc. Within about 24 hours of the initial release of shellshock, I had logs of people trying to exploit it. So unless you’re on about a 12 hour patch cycle, you’re going to have a bad time.
reimplement zfsctl (.zfs) support (https://svnweb.freebsd.org/changeset/base/314048)
avg@ (Andriy Gapon) has rewritten the .zfs support in FreeBSD
The current code is written on top of GFS, a library with the generic support for writing filesystems, which was ported from Illumos. Because of significant differences between illumos VFS and FreeBSD VFS models, both the GFS and zfsctl code were heavily modified to work on FreeBSD.  Nonetheless, they still contain quite a few ugly hacks and bugs.
This is a reimplementation of the zfsctl code where the VFS-specific bits are written from scratch and only the code that interacts with the rest of ZFS is reused.
Some ideas are picked from an independent work by Will (wca@)
This work improves the overall quality of the ZFS port to FreeBSD
The code that provides support for ZFS .zfs/ directory functionality has been reimplemented.  It is no longer possible to create a snapshot by mkdir under .zfs/snapshot/.  That should be the only user visible change.
TIL: On IllumOS, you can create, rename, and destroy snapshots, by manipulating the virtual directories in the .zfs/snapshots directory.
If enough people would find this feature useful, maybe it could be implemented (rm and rename have never existed on FreeBSD). At the same time, it seems like rather a lot of work, when the ZFS command line tools work so well. Although wca@ pointed out on IRC, it can be useful to be able to create a snapshot over NFS, or SMB.
Interview - Konrad Witaszczyk - def@freebsd.org (mailto:def@freebsd.org)
Encrypted Kernel Crash Dumps
***
News Roundup
PBKDF2 Performance improvements on FreeBSD (https://svnweb.freebsd.org/changeset/base/313962)
Joe Pixton did some research (https://jbp.io/2015/08/11/pbkdf2-performance-matters/) and found that, because of the way the spec is written, most PBKDF2 implementations are 2x slower than they need to be.
Since the PBKDF is used to derive a key, used for encryption, this poses a problem. The attacker can derive a key twice as fast as you can. On FreeBSD the PBKDF2 was configured to derive a SHA512-HMAC key that would take approximately 2 seconds to calculate. That is 2 seconds on one core. So an attacker can calculate the same key in 1 second, and use many cores.
Luckily, 1 second is still a long time for each brute force guess. On modern CPUs with the fast algorithm, you can do about 500,000 iterations of PBKDF per second (per core).
Until a recent change, OpenBSD used only 8192 iterations. It now uses a similar benchmark of ~2 seconds, and uses bcrypt instead of a SHA1-HMAC.
Joe’s research showed that the majority of implementations were done the ‘slow’ way. Calculating the initial part of the outer round each iteration, instead of reusing the initial calculation over and over for each round.
Joe submitted a match to FreeBSD to solve this problem. That patch was improved, and a test of tests were added by jmg@, but then work stalled
I picked up the work, and fixed some merge conflicts in the patch that had cropped up based on work I had done that moved the HMAC code to a separate file.
This work is now committed.
With this change, all newly generated GELI keys will be approximately 2x as strong. Previously generated keys will take half as long to calculate, resulting in faster mounting of encrypted volumes. Users may choose to rekey, to generate a new key with the larger default number of iterations using the geli(8) setkey command. Security of existing data is not compromised, as ~1 second per brute force attempt is still a very high threshold.
If you are interested in the topic, I recommend the video of Joe’s presentation from the Passwords15 conference in Las Vegas
***
Quick How-To: Updating a screenshot in the TrueOS Handbook (https://www.trueos.org/blog/quick-updating-screenshot-trueos-handbook/)
Docs writers, might be time to pay attention. This week we have a good walk-through of adding / updating new screenshots to the TrueOS Sphinx Documentation.
For those who have not looked in the past, TrueOS and FreeNAS both have fantastic docs by the team over at iXsystems using Sphinx as their doc engine. 
Often we get questions from users asking what “they can do to help” but don’t necessarily have programming skills to apply. 
The good news is that using Sphinx is relatively easy, and after learning some minio rst syntax you can easily help fix, or even contribute to new sections of the TrueOS (Or FreeNAS) documentation. 
In this example, Tim takes us through the process of replacing an old out of date screenshot in the handbook with the latest hotness. 
Starting with a .png file, he then locates the old screenshot name and adds the updated version “lumina-e.png” to “lumina-f.png”. With the file added to the tree, the relevant section of .rst code can be adjusted and the sphinx build run to verify the output HTML looks correct.
Using this method you can easily start to get involved with other aspects of documentation and next thing you know you’ll be writing boot-loaders like Allan!
***
Learn C Programming With 9 Excellent Open Source Books (https://www.ossblog.org/learn-c-programming-with-9-excellent-open-source-books/)
Now that you’ve easily mastered all your documentation skills, you may be ready to take on a new challenge. (Come on, that boot-loader isn’t going to write itself!)
We wanted to point out some excellent resources to get you started on your journey into writing C.
Before you think, “oh, more books to purchase”, wait there’s good news. These are the top-9 open-source books that you can download in digital form free of charge. Now I bet we got your attention.
We start the rundown with “The C Book”, by Mike Banahan, Declan Brady and Mark Doran, which will lay the groundwork with your introduction into the C language and concepts. 
Next up, if you are going to do anything, do it with style, so take a read through the “C Elements of Style” which will make you popular at all the parties. (We can’t vouch for that statement)
From here we have a book on using C to build your own minimal “lisp” interpreter, reference guides on GNU C and some other excellent introduction / mastery books to help round-out your programming skill set.
Your C adventure awaits, hopefully these books can not only teach you good C, but also make you feel confident when looking at bits of the FreeBSD world or kernel with a proper foundation to back it up.
***
Running a Linux VM on OpenBSD (http://eradman.com/posts/linuxvm-on-openbsd.html)
Over the past few years we’ve talked a lot about Virtualization, Bhyve or OpenBSD’s ‘vmm’, but qemu hasn’t gotten much attention.
Today we have a blog post with details on how to deploy qemu to run Linux on top of an OpenBSD host system.
The starts by showing us how to first provision the storage for qemu, using the handy ‘qemu-img’ command, which in this example only creates a 4GB disk, you’ll probably want more for real-world usage though.
Next up the qemu command will be run, pay attention to the particular flags for network and memory setup. You’ll probably want to bump it up past the recommended 256M of memory.
Networking is always the fun part, as the author describes his intended setup
I want OpenBSD and Debian to be able to obtain an IP via DHCP on their wired interfaces and I don't want external networking required for an NFS share to the VM. To accomplish this I need two interfaces since dhclient will erase any other IPv4 addresses already assigned. We can't assign an address directly to the bridge, but we can configure a virtual Ethernet device and add it.
The setup for this portion involves touching a few more files, but isn’t that painless. Some “pf” rules to enable NAT for and dhcpd setup to assign a “fixed” IP to the vm will get us going, along with some additional details on how to configure the networking for inside the debian VM.
Once those steps are completed you should be able to mount NFS and share data from the host to the VM painlessly. 
Beastie Bits
MacObserver: Interview with Open Source Developer &amp;amp; Former Apple Manager Jordan Hubbard  (https://www.macobserver.com/podcasts/background-mode-jordan-hubbard/) 
2016 Google Summer of Code Mentor Summit and MeetBSD Trip Report: Gavin Atkinson (https://www.freebsdfoundation.org/blog/2016-google-summer-of-code-mentor-summit-and-meetbsd-trip-report-gavin-atkinson/) 
Feedback/Questions
 Joe - BGP / Vultr Followup (http://pastebin.com/TNyHBYwT) 
 Ryan Moreno asks about Laptops  (http://pastebin.com/s4Ypezsz) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, Allan and I are in Tokyo for AsiaBSDCon, but not to worry, we have a full episode lined up and ready to go. Hackathon reports</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>OpenBSD A2k17 hackathon reports</h3>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170131101827" rel="nofollow">a2k17 hackathon report: Patrick Wildt on the arm64 port</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170203232049" rel="nofollow">a2k17 hackathon report: Antoine Jacoutot on syspatch, rc.d improvements and more</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170127154356" rel="nofollow">a2k17 hackathon report: Martin Pieuchot on NET_LOCK and much more </a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170127031836" rel="nofollow">a2k17 hackathon report: Kenneth Westerback on the hidden wonders of the build system, the network stack and more </a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170125225403" rel="nofollow">a2k17 hackathon report: Bob Beck on LibreSSL progress and more </a> 
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_fully_reproducible_builds" rel="nofollow">NetBSD is now reproducible </a></h3>

<ul>
<li>Christos Zoulas posts to the NetBSD blog that he has completed his project to make fully reproducible NetBSD builds for amd64 and sparc64</li>
</ul>

<blockquote>
<p>I have been working on and off for almost a year trying to get reproducible builds (the same source tree always builds an identical cdrom) on NetBSD. I did not think at the time it would take as long or be so difficult, so I did not keep a log of all the changes I needed to make. I was also not the only one working on this. Other NetBSD developers have been making improvements for the past 6 years. I would like to acknowledge the NetBSD build system (aka build.sh) which is a fully portable cross-build system. This build system has given us a head-start in the reproducible builds work.</p>

<p>I would also like to acknowledge the work done by the Debian folks who have provided a platform to run, test and analyze reproducible builds. Special mention to the diffoscope tool that gives an excellent overview of what&#39;s different between binary files, by finding out what they are (and if they are containers what they contain) and then running the appropriate formatter and diff program to show what&#39;s different for each file.</p>

<p>Finally other developers who have started, motivated and did a lot of work getting us here like Joerg Sonnenberger and Thomas Klausner for their work on reproducible builds, and Todd Vierling and Luke Mewburn for their work on build.sh.</p>
</blockquote>

<ul>
<li>Some of the stumbling blocks that were overcome:

<ul>
<li>Timestamps</li>
<li>Date/time/author embedded in source files</li>
<li>Timezone sensitive code</li>
<li>Directory order / build order</li>
<li>Non-sanitized data stored in files</li>
<li>Symbolic links / paths</li>
<li>General tool inconsistencies: including gcc profiling, the fact that GPT partition tables, are by definition, globally unique each time they are created, and the iso9660 standard calls for a timestamp with a timezone.</li>
<li>Toolchain</li>
<li>Build information / tunables / environment. NetBSD now has a knob ‘MKREPRO’, if set to YES it sets a long list of variables to a consistent set of a values.</li>
</ul></li>
<li>The post walks through how these problems where solves</li>
<li>Future Work:

<ul>
<li>Vary more parameters and find more inconsistencies</li>
<li>Verify that cross-building is reproducible</li>
<li>Verify that unprivileged builds are reproducible</li>
<li>Test on other platforms
***</li>
</ul></li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/features-are-faults-redux" rel="nofollow">Features are faults redux</a></h3>

<ul>
<li>From Ted Unangst</li>
</ul>

<blockquote>
<p>Last week I gave a talk for the security class at Notre Dame based on features are faults but with some various commentary added. It was an exciting trip, with the opportunity to meet and talk with the computer vision group as well. Some other highlights include the Indiana skillet I had for breakfast, which came with pickles and was amazing, and explaining the many wonders of cvs to the Linux users group over lunch. After that came the talk, which went a little something like this.</p>

<p>I got started with OpenBSD back about the same time I started college, although I had a slightly different perspective then. I was using OpenBSD because it included so many security features, therefore it must be the most secure system, right? For example, at some point I acquired a second computer. What’s the first thing anybody does when they get a second computer? That’s right, set up a kerberos domain. The idea that more is better was everywhere. This was also around the time that ipsec was getting its final touches, and everybody knew ipsec was going to be the most secure protocol ever because it had more options than any other secure transport. We’ll revisit this in a bit.</p>

<p>There’s been a partial attitude adjustment since then, with more people recognizing that layering complexity doesn’t result in more security. It’s not an additive process. There’s a whole talk there, about the perfect security that people can’t or won’t use. OpenBSD has definitely switched directions, including less code, not more. All the kerberos code was deleted a few years ago.</p>

<p>Let’s assume about one bug per 100 lines of code. That’s probably on the low end. Now say your operating system has 100 million lines of code. If I’ve done the math correctly, that’s literally a million bugs. So that’s one reason to avoid adding features. But that’s a solveable problem. If we pick the right language and the right compiler and the right tooling and with enough eyeballs and effort, we can fix all the bugs. We know how to build mostly correct software, we just don’t care.</p>

<p>As we add features to software, increasing its complexity, new unexpected behaviors start to emerge. What are the bounds? How many features can you add before craziness is inevitable? We can make some guesses. Less than a thousand for sure. Probably less than a hundred? Ten maybe? I’ll argue the answer is quite possibly two. Interesting corollary is that it’s impossible to have a program with exactly two features. Any program with two features has at least a third, but you don’t know what it is</p>

<p>My first example is a bug in the NetBSD ftp client. We had one feature, we added a second feature, and just like that we got a <a href="http://marc.info/?l=oss-security&m=141451507810253&w=2" rel="nofollow">third misfeature</a></p>

<p>Our story begins long ago. The origins of this bug are probably older than I am. In the dark times before the web, FTP sites used to be a pretty popular way of publishing files. You run an ftp client, connect to a remote site, and then you can browse the remote server somewhat like a local filesystem. List files, change directories, get files. Typically there would be a README file telling you what’s what, but you don’t need to download a copy to keep. Instead we can pipe the output to a program like more. Right there in the ftp client. No need to disconnect.</p>

<p>Fast forward a few decades, and http is the new protocol of choice. http is a much less interactive protocol, but the ftp client has some handy features for batch downloads like progress bars, etc. So let’s add http support to ftp. This works pretty well. Lots of code reused.</p>

<p>http has one quirk however that ftp doesn’t have. Redirects. The server can redirect the client to a different file. So now you’re thinking, what happens if I download <a href="http://somefile" rel="nofollow">http://somefile</a> and the server sends back 302 http://|reboot. ftp reconnects to the server, gets the 200, starts downloading and saves it to a file called |reboot. Except it doesn’t. The function that saves files looks at the first character of the name and if it’s a pipe, runs that command instead. And now you just rebooted your computer. Or worse.</p>

<p>It’s pretty obvious this is not the desired behavior, but where exactly did things go wrong? Arguably, all the pieces were working according to spec. In order to see this bug coming, you needed to know how the save function worked, you needed to know about redirects, and you needed to put all the implications together.</p>
</blockquote>

<ul>
<li>The post then goes into a lot more detail about other issues. We just don’t have time to cover it all today, but you should go read it, it is very enlightening</li>
</ul>

<blockquote>
<p>What do we do about this? That’s a tough question. It’s much easier to poke fun at all the people who got things wrong. But we can try. My attitudes are shaped by experiences with the OpenBSD project, and I think we are doing a decent job of containing the complexity. Keep paring away at dependencies and reducing interactions. As a developer, saying “no” to all feature requests is actually very productive. It’s so much faster than implementing the feature. Sometimes users complain, but I’ve often received later feedback from users that they’d come to appreciate the simplicity.</p>

<p>There was a question about which of these vulnerabilities were found by researchers, as opposed to troublemakers. The answer was most, if not all of them, but it made me realize one additional point I hadn’t mentioned. Unlike the prototypical buffer overflow vulnerability, exploiting features is very reliable. Exploiting something like shellshock or imagetragick requires no customized assembly and is independent of CPU, OS, version, stack alignment, malloc implementation, etc. Within about 24 hours of the initial release of shellshock, I had logs of people trying to exploit it. So unless you’re on about a 12 hour patch cycle, you’re going to have a bad time.</p>

<hr>
</blockquote>

<h3><a href="https://svnweb.freebsd.org/changeset/base/314048" rel="nofollow">reimplement zfsctl (.zfs) support</a></h3>

<ul>
<li>avg@ (Andriy Gapon) has rewritten the .zfs support in FreeBSD</li>
</ul>

<blockquote>
<p>The current code is written on top of GFS, a library with the generic support for writing filesystems, which was ported from Illumos. Because of significant differences between illumos VFS and FreeBSD VFS models, both the GFS and zfsctl code were heavily modified to work on FreeBSD.  Nonetheless, they still contain quite a few ugly hacks and bugs.</p>

<p>This is a reimplementation of the zfsctl code where the VFS-specific bits are written from scratch and only the code that interacts with the rest of ZFS is reused.</p>

<p>Some ideas are picked from an independent work by Will (wca@)</p>
</blockquote>

<ul>
<li>This work improves the overall quality of the ZFS port to FreeBSD</li>
</ul>

<blockquote>
<p>The code that provides support for ZFS .zfs/ directory functionality has been reimplemented.  It is no longer possible to create a snapshot by mkdir under .zfs/snapshot/.  That should be the only user visible change.</p>
</blockquote>

<ul>
<li><p>TIL: On IllumOS, you can create, rename, and destroy snapshots, by manipulating the virtual directories in the .zfs/snapshots directory.</p></li>
<li><p>If enough people would find this feature useful, maybe it could be implemented (rm and rename have never existed on FreeBSD). At the same time, it seems like rather a lot of work, when the ZFS command line tools work so well. Although wca@ pointed out on IRC, it can be useful to be able to create a snapshot over NFS, or SMB.</p>

<hr></li>
</ul>

<h2>Interview - Konrad Witaszczyk - <a href="mailto:def@freebsd.org" rel="nofollow">def@freebsd.org</a></h2>

<ul>
<li>Encrypted Kernel Crash Dumps
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/changeset/base/313962" rel="nofollow">PBKDF2 Performance improvements on FreeBSD</a></h3>

<ul>
<li><a href="https://jbp.io/2015/08/11/pbkdf2-performance-matters/" rel="nofollow">Joe Pixton did some research</a> and found that, because of the way the spec is written, most PBKDF2 implementations are 2x slower than they need to be.</li>
<li>Since the PBKDF is used to derive a key, used for encryption, this poses a problem. The attacker can derive a key twice as fast as you can. On FreeBSD the PBKDF2 was configured to derive a SHA512-HMAC key that would take approximately 2 seconds to calculate. That is 2 seconds on one core. So an attacker can calculate the same key in 1 second, and use many cores.</li>
<li>Luckily, 1 second is still a long time for each brute force guess. On modern CPUs with the fast algorithm, you can do about 500,000 iterations of PBKDF per second (per core).</li>
<li>Until a recent change, OpenBSD used only 8192 iterations. It now uses a similar benchmark of ~2 seconds, and uses bcrypt instead of a SHA1-HMAC.</li>
<li>Joe’s research showed that the majority of implementations were done the ‘slow’ way. Calculating the initial part of the outer round each iteration, instead of reusing the initial calculation over and over for each round.</li>
<li>Joe submitted a match to FreeBSD to solve this problem. That patch was improved, and a test of tests were added by jmg@, but then work stalled</li>
<li>I picked up the work, and fixed some merge conflicts in the patch that had cropped up based on work I had done that moved the HMAC code to a separate file.</li>
<li>This work is now committed.</li>
</ul>

<blockquote>
<p>With this change, all newly generated GELI keys will be approximately 2x as strong. Previously generated keys will take half as long to calculate, resulting in faster mounting of encrypted volumes. Users may choose to rekey, to generate a new key with the larger default number of iterations using the geli(8) setkey command. Security of existing data is not compromised, as ~1 second per brute force attempt is still a very high threshold.</p>
</blockquote>

<ul>
<li>If you are interested in the topic, I recommend the video of Joe’s presentation from the Passwords15 conference in Las Vegas
***</li>
</ul>

<h3><a href="https://www.trueos.org/blog/quick-updating-screenshot-trueos-handbook/" rel="nofollow">Quick How-To: Updating a screenshot in the TrueOS Handbook</a></h3>

<ul>
<li>Docs writers, might be time to pay attention. This week we have a good walk-through of adding / updating new screenshots to the TrueOS Sphinx Documentation.</li>
<li>For those who have not looked in the past, TrueOS and FreeNAS both have fantastic docs by the team over at iXsystems using Sphinx as their doc engine. </li>
<li>Often we get questions from users asking what “they can do to help” but don’t necessarily have programming skills to apply. </li>
<li>The good news is that using Sphinx is relatively easy, and after learning some minio rst syntax you can easily help fix, or even contribute to new sections of the TrueOS (Or FreeNAS) documentation. </li>
<li>In this example, Tim takes us through the process of replacing an old out of date screenshot in the handbook with the latest hotness. </li>
<li>Starting with a .png file, he then locates the old screenshot name and adds the updated version “lumina-e.png” to “lumina-f.png”. With the file added to the tree, the relevant section of .rst code can be adjusted and the sphinx build run to verify the output HTML looks correct.</li>
<li>Using this method you can easily start to get involved with other aspects of documentation and next thing you know you’ll be writing boot-loaders like Allan!
***</li>
</ul>

<h3><a href="https://www.ossblog.org/learn-c-programming-with-9-excellent-open-source-books/" rel="nofollow">Learn C Programming With 9 Excellent Open Source Books</a></h3>

<ul>
<li>Now that you’ve easily mastered all your documentation skills, you may be ready to take on a new challenge. (Come on, that boot-loader isn’t going to write itself!)</li>
<li>We wanted to point out some excellent resources to get you started on your journey into writing C.</li>
<li>Before you think, “oh, more books to purchase”, wait there’s good news. These are the top-9 open-source books that you can download in digital form free of charge. Now I bet we got your attention.</li>
<li>We start the rundown with “The C Book”, by Mike Banahan, Declan Brady and Mark Doran, which will lay the groundwork with your introduction into the C language and concepts. </li>
<li>Next up, if you are going to do anything, do it with style, so take a read through the “C Elements of Style” which will make you popular at all the parties. (We can’t vouch for that statement)</li>
<li>From here we have a book on using C to build your own minimal “lisp” interpreter, reference guides on GNU C and some other excellent introduction / mastery books to help round-out your programming skill set.</li>
<li>Your C adventure awaits, hopefully these books can not only teach you good C, but also make you feel confident when looking at bits of the FreeBSD world or kernel with a proper foundation to back it up.
***</li>
</ul>

<h3><a href="http://eradman.com/posts/linuxvm-on-openbsd.html" rel="nofollow">Running a Linux VM on OpenBSD</a></h3>

<ul>
<li>Over the past few years we’ve talked a lot about Virtualization, Bhyve or OpenBSD’s ‘vmm’, but qemu hasn’t gotten much attention.</li>
<li>Today we have a blog post with details on how to deploy qemu to run Linux on top of an OpenBSD host system.</li>
<li>The starts by showing us how to first provision the storage for qemu, using the handy ‘qemu-img’ command, which in this example only creates a 4GB disk, you’ll probably want more for real-world usage though.</li>
<li>Next up the qemu command will be run, pay attention to the particular flags for network and memory setup. You’ll probably want to bump it up past the recommended 256M of memory.</li>
<li>Networking is always the fun part, as the author describes his intended setup</li>
</ul>

<blockquote>
<p>I want OpenBSD and Debian to be able to obtain an IP via DHCP on their wired interfaces and I don&#39;t want external networking required for an NFS share to the VM. To accomplish this I need two interfaces since dhclient will erase any other IPv4 addresses already assigned. We can&#39;t assign an address directly to the bridge, but we can configure a virtual Ethernet device and add it.</p>
</blockquote>

<ul>
<li>The setup for this portion involves touching a few more files, but isn’t that painless. Some “pf” rules to enable NAT for and dhcpd setup to assign a “fixed” IP to the vm will get us going, along with some additional details on how to configure the networking for inside the debian VM.</li>
<li>Once those steps are completed you should be able to mount NFS and share data from the host to the VM painlessly. </li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.macobserver.com/podcasts/background-mode-jordan-hubbard/" rel="nofollow">MacObserver: Interview with Open Source Developer &amp; Former Apple Manager Jordan Hubbard </a> </p></li>
<li><p><a href="https://www.freebsdfoundation.org/blog/2016-google-summer-of-code-mentor-summit-and-meetbsd-trip-report-gavin-atkinson/" rel="nofollow">2016 Google Summer of Code Mentor Summit and MeetBSD Trip Report: Gavin Atkinson</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/TNyHBYwT" rel="nofollow"> Joe - BGP / Vultr Followup</a> </li>
<li><a href="http://pastebin.com/s4Ypezsz" rel="nofollow"> Ryan Moreno asks about Laptops </a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, Allan and I are in Tokyo for AsiaBSDCon, but not to worry, we have a full episode lined up and ready to go. Hackathon reports</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>OpenBSD A2k17 hackathon reports</h3>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170131101827" rel="nofollow">a2k17 hackathon report: Patrick Wildt on the arm64 port</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170203232049" rel="nofollow">a2k17 hackathon report: Antoine Jacoutot on syspatch, rc.d improvements and more</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170127154356" rel="nofollow">a2k17 hackathon report: Martin Pieuchot on NET_LOCK and much more </a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170127031836" rel="nofollow">a2k17 hackathon report: Kenneth Westerback on the hidden wonders of the build system, the network stack and more </a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20170125225403" rel="nofollow">a2k17 hackathon report: Bob Beck on LibreSSL progress and more </a> 
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_fully_reproducible_builds" rel="nofollow">NetBSD is now reproducible </a></h3>

<ul>
<li>Christos Zoulas posts to the NetBSD blog that he has completed his project to make fully reproducible NetBSD builds for amd64 and sparc64</li>
</ul>

<blockquote>
<p>I have been working on and off for almost a year trying to get reproducible builds (the same source tree always builds an identical cdrom) on NetBSD. I did not think at the time it would take as long or be so difficult, so I did not keep a log of all the changes I needed to make. I was also not the only one working on this. Other NetBSD developers have been making improvements for the past 6 years. I would like to acknowledge the NetBSD build system (aka build.sh) which is a fully portable cross-build system. This build system has given us a head-start in the reproducible builds work.</p>

<p>I would also like to acknowledge the work done by the Debian folks who have provided a platform to run, test and analyze reproducible builds. Special mention to the diffoscope tool that gives an excellent overview of what&#39;s different between binary files, by finding out what they are (and if they are containers what they contain) and then running the appropriate formatter and diff program to show what&#39;s different for each file.</p>

<p>Finally other developers who have started, motivated and did a lot of work getting us here like Joerg Sonnenberger and Thomas Klausner for their work on reproducible builds, and Todd Vierling and Luke Mewburn for their work on build.sh.</p>
</blockquote>

<ul>
<li>Some of the stumbling blocks that were overcome:

<ul>
<li>Timestamps</li>
<li>Date/time/author embedded in source files</li>
<li>Timezone sensitive code</li>
<li>Directory order / build order</li>
<li>Non-sanitized data stored in files</li>
<li>Symbolic links / paths</li>
<li>General tool inconsistencies: including gcc profiling, the fact that GPT partition tables, are by definition, globally unique each time they are created, and the iso9660 standard calls for a timestamp with a timezone.</li>
<li>Toolchain</li>
<li>Build information / tunables / environment. NetBSD now has a knob ‘MKREPRO’, if set to YES it sets a long list of variables to a consistent set of a values.</li>
</ul></li>
<li>The post walks through how these problems where solves</li>
<li>Future Work:

<ul>
<li>Vary more parameters and find more inconsistencies</li>
<li>Verify that cross-building is reproducible</li>
<li>Verify that unprivileged builds are reproducible</li>
<li>Test on other platforms
***</li>
</ul></li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/features-are-faults-redux" rel="nofollow">Features are faults redux</a></h3>

<ul>
<li>From Ted Unangst</li>
</ul>

<blockquote>
<p>Last week I gave a talk for the security class at Notre Dame based on features are faults but with some various commentary added. It was an exciting trip, with the opportunity to meet and talk with the computer vision group as well. Some other highlights include the Indiana skillet I had for breakfast, which came with pickles and was amazing, and explaining the many wonders of cvs to the Linux users group over lunch. After that came the talk, which went a little something like this.</p>

<p>I got started with OpenBSD back about the same time I started college, although I had a slightly different perspective then. I was using OpenBSD because it included so many security features, therefore it must be the most secure system, right? For example, at some point I acquired a second computer. What’s the first thing anybody does when they get a second computer? That’s right, set up a kerberos domain. The idea that more is better was everywhere. This was also around the time that ipsec was getting its final touches, and everybody knew ipsec was going to be the most secure protocol ever because it had more options than any other secure transport. We’ll revisit this in a bit.</p>

<p>There’s been a partial attitude adjustment since then, with more people recognizing that layering complexity doesn’t result in more security. It’s not an additive process. There’s a whole talk there, about the perfect security that people can’t or won’t use. OpenBSD has definitely switched directions, including less code, not more. All the kerberos code was deleted a few years ago.</p>

<p>Let’s assume about one bug per 100 lines of code. That’s probably on the low end. Now say your operating system has 100 million lines of code. If I’ve done the math correctly, that’s literally a million bugs. So that’s one reason to avoid adding features. But that’s a solveable problem. If we pick the right language and the right compiler and the right tooling and with enough eyeballs and effort, we can fix all the bugs. We know how to build mostly correct software, we just don’t care.</p>

<p>As we add features to software, increasing its complexity, new unexpected behaviors start to emerge. What are the bounds? How many features can you add before craziness is inevitable? We can make some guesses. Less than a thousand for sure. Probably less than a hundred? Ten maybe? I’ll argue the answer is quite possibly two. Interesting corollary is that it’s impossible to have a program with exactly two features. Any program with two features has at least a third, but you don’t know what it is</p>

<p>My first example is a bug in the NetBSD ftp client. We had one feature, we added a second feature, and just like that we got a <a href="http://marc.info/?l=oss-security&m=141451507810253&w=2" rel="nofollow">third misfeature</a></p>

<p>Our story begins long ago. The origins of this bug are probably older than I am. In the dark times before the web, FTP sites used to be a pretty popular way of publishing files. You run an ftp client, connect to a remote site, and then you can browse the remote server somewhat like a local filesystem. List files, change directories, get files. Typically there would be a README file telling you what’s what, but you don’t need to download a copy to keep. Instead we can pipe the output to a program like more. Right there in the ftp client. No need to disconnect.</p>

<p>Fast forward a few decades, and http is the new protocol of choice. http is a much less interactive protocol, but the ftp client has some handy features for batch downloads like progress bars, etc. So let’s add http support to ftp. This works pretty well. Lots of code reused.</p>

<p>http has one quirk however that ftp doesn’t have. Redirects. The server can redirect the client to a different file. So now you’re thinking, what happens if I download <a href="http://somefile" rel="nofollow">http://somefile</a> and the server sends back 302 http://|reboot. ftp reconnects to the server, gets the 200, starts downloading and saves it to a file called |reboot. Except it doesn’t. The function that saves files looks at the first character of the name and if it’s a pipe, runs that command instead. And now you just rebooted your computer. Or worse.</p>

<p>It’s pretty obvious this is not the desired behavior, but where exactly did things go wrong? Arguably, all the pieces were working according to spec. In order to see this bug coming, you needed to know how the save function worked, you needed to know about redirects, and you needed to put all the implications together.</p>
</blockquote>

<ul>
<li>The post then goes into a lot more detail about other issues. We just don’t have time to cover it all today, but you should go read it, it is very enlightening</li>
</ul>

<blockquote>
<p>What do we do about this? That’s a tough question. It’s much easier to poke fun at all the people who got things wrong. But we can try. My attitudes are shaped by experiences with the OpenBSD project, and I think we are doing a decent job of containing the complexity. Keep paring away at dependencies and reducing interactions. As a developer, saying “no” to all feature requests is actually very productive. It’s so much faster than implementing the feature. Sometimes users complain, but I’ve often received later feedback from users that they’d come to appreciate the simplicity.</p>

<p>There was a question about which of these vulnerabilities were found by researchers, as opposed to troublemakers. The answer was most, if not all of them, but it made me realize one additional point I hadn’t mentioned. Unlike the prototypical buffer overflow vulnerability, exploiting features is very reliable. Exploiting something like shellshock or imagetragick requires no customized assembly and is independent of CPU, OS, version, stack alignment, malloc implementation, etc. Within about 24 hours of the initial release of shellshock, I had logs of people trying to exploit it. So unless you’re on about a 12 hour patch cycle, you’re going to have a bad time.</p>

<hr>
</blockquote>

<h3><a href="https://svnweb.freebsd.org/changeset/base/314048" rel="nofollow">reimplement zfsctl (.zfs) support</a></h3>

<ul>
<li>avg@ (Andriy Gapon) has rewritten the .zfs support in FreeBSD</li>
</ul>

<blockquote>
<p>The current code is written on top of GFS, a library with the generic support for writing filesystems, which was ported from Illumos. Because of significant differences between illumos VFS and FreeBSD VFS models, both the GFS and zfsctl code were heavily modified to work on FreeBSD.  Nonetheless, they still contain quite a few ugly hacks and bugs.</p>

<p>This is a reimplementation of the zfsctl code where the VFS-specific bits are written from scratch and only the code that interacts with the rest of ZFS is reused.</p>

<p>Some ideas are picked from an independent work by Will (wca@)</p>
</blockquote>

<ul>
<li>This work improves the overall quality of the ZFS port to FreeBSD</li>
</ul>

<blockquote>
<p>The code that provides support for ZFS .zfs/ directory functionality has been reimplemented.  It is no longer possible to create a snapshot by mkdir under .zfs/snapshot/.  That should be the only user visible change.</p>
</blockquote>

<ul>
<li><p>TIL: On IllumOS, you can create, rename, and destroy snapshots, by manipulating the virtual directories in the .zfs/snapshots directory.</p></li>
<li><p>If enough people would find this feature useful, maybe it could be implemented (rm and rename have never existed on FreeBSD). At the same time, it seems like rather a lot of work, when the ZFS command line tools work so well. Although wca@ pointed out on IRC, it can be useful to be able to create a snapshot over NFS, or SMB.</p>

<hr></li>
</ul>

<h2>Interview - Konrad Witaszczyk - <a href="mailto:def@freebsd.org" rel="nofollow">def@freebsd.org</a></h2>

<ul>
<li>Encrypted Kernel Crash Dumps
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/changeset/base/313962" rel="nofollow">PBKDF2 Performance improvements on FreeBSD</a></h3>

<ul>
<li><a href="https://jbp.io/2015/08/11/pbkdf2-performance-matters/" rel="nofollow">Joe Pixton did some research</a> and found that, because of the way the spec is written, most PBKDF2 implementations are 2x slower than they need to be.</li>
<li>Since the PBKDF is used to derive a key, used for encryption, this poses a problem. The attacker can derive a key twice as fast as you can. On FreeBSD the PBKDF2 was configured to derive a SHA512-HMAC key that would take approximately 2 seconds to calculate. That is 2 seconds on one core. So an attacker can calculate the same key in 1 second, and use many cores.</li>
<li>Luckily, 1 second is still a long time for each brute force guess. On modern CPUs with the fast algorithm, you can do about 500,000 iterations of PBKDF per second (per core).</li>
<li>Until a recent change, OpenBSD used only 8192 iterations. It now uses a similar benchmark of ~2 seconds, and uses bcrypt instead of a SHA1-HMAC.</li>
<li>Joe’s research showed that the majority of implementations were done the ‘slow’ way. Calculating the initial part of the outer round each iteration, instead of reusing the initial calculation over and over for each round.</li>
<li>Joe submitted a match to FreeBSD to solve this problem. That patch was improved, and a test of tests were added by jmg@, but then work stalled</li>
<li>I picked up the work, and fixed some merge conflicts in the patch that had cropped up based on work I had done that moved the HMAC code to a separate file.</li>
<li>This work is now committed.</li>
</ul>

<blockquote>
<p>With this change, all newly generated GELI keys will be approximately 2x as strong. Previously generated keys will take half as long to calculate, resulting in faster mounting of encrypted volumes. Users may choose to rekey, to generate a new key with the larger default number of iterations using the geli(8) setkey command. Security of existing data is not compromised, as ~1 second per brute force attempt is still a very high threshold.</p>
</blockquote>

<ul>
<li>If you are interested in the topic, I recommend the video of Joe’s presentation from the Passwords15 conference in Las Vegas
***</li>
</ul>

<h3><a href="https://www.trueos.org/blog/quick-updating-screenshot-trueos-handbook/" rel="nofollow">Quick How-To: Updating a screenshot in the TrueOS Handbook</a></h3>

<ul>
<li>Docs writers, might be time to pay attention. This week we have a good walk-through of adding / updating new screenshots to the TrueOS Sphinx Documentation.</li>
<li>For those who have not looked in the past, TrueOS and FreeNAS both have fantastic docs by the team over at iXsystems using Sphinx as their doc engine. </li>
<li>Often we get questions from users asking what “they can do to help” but don’t necessarily have programming skills to apply. </li>
<li>The good news is that using Sphinx is relatively easy, and after learning some minio rst syntax you can easily help fix, or even contribute to new sections of the TrueOS (Or FreeNAS) documentation. </li>
<li>In this example, Tim takes us through the process of replacing an old out of date screenshot in the handbook with the latest hotness. </li>
<li>Starting with a .png file, he then locates the old screenshot name and adds the updated version “lumina-e.png” to “lumina-f.png”. With the file added to the tree, the relevant section of .rst code can be adjusted and the sphinx build run to verify the output HTML looks correct.</li>
<li>Using this method you can easily start to get involved with other aspects of documentation and next thing you know you’ll be writing boot-loaders like Allan!
***</li>
</ul>

<h3><a href="https://www.ossblog.org/learn-c-programming-with-9-excellent-open-source-books/" rel="nofollow">Learn C Programming With 9 Excellent Open Source Books</a></h3>

<ul>
<li>Now that you’ve easily mastered all your documentation skills, you may be ready to take on a new challenge. (Come on, that boot-loader isn’t going to write itself!)</li>
<li>We wanted to point out some excellent resources to get you started on your journey into writing C.</li>
<li>Before you think, “oh, more books to purchase”, wait there’s good news. These are the top-9 open-source books that you can download in digital form free of charge. Now I bet we got your attention.</li>
<li>We start the rundown with “The C Book”, by Mike Banahan, Declan Brady and Mark Doran, which will lay the groundwork with your introduction into the C language and concepts. </li>
<li>Next up, if you are going to do anything, do it with style, so take a read through the “C Elements of Style” which will make you popular at all the parties. (We can’t vouch for that statement)</li>
<li>From here we have a book on using C to build your own minimal “lisp” interpreter, reference guides on GNU C and some other excellent introduction / mastery books to help round-out your programming skill set.</li>
<li>Your C adventure awaits, hopefully these books can not only teach you good C, but also make you feel confident when looking at bits of the FreeBSD world or kernel with a proper foundation to back it up.
***</li>
</ul>

<h3><a href="http://eradman.com/posts/linuxvm-on-openbsd.html" rel="nofollow">Running a Linux VM on OpenBSD</a></h3>

<ul>
<li>Over the past few years we’ve talked a lot about Virtualization, Bhyve or OpenBSD’s ‘vmm’, but qemu hasn’t gotten much attention.</li>
<li>Today we have a blog post with details on how to deploy qemu to run Linux on top of an OpenBSD host system.</li>
<li>The starts by showing us how to first provision the storage for qemu, using the handy ‘qemu-img’ command, which in this example only creates a 4GB disk, you’ll probably want more for real-world usage though.</li>
<li>Next up the qemu command will be run, pay attention to the particular flags for network and memory setup. You’ll probably want to bump it up past the recommended 256M of memory.</li>
<li>Networking is always the fun part, as the author describes his intended setup</li>
</ul>

<blockquote>
<p>I want OpenBSD and Debian to be able to obtain an IP via DHCP on their wired interfaces and I don&#39;t want external networking required for an NFS share to the VM. To accomplish this I need two interfaces since dhclient will erase any other IPv4 addresses already assigned. We can&#39;t assign an address directly to the bridge, but we can configure a virtual Ethernet device and add it.</p>
</blockquote>

<ul>
<li>The setup for this portion involves touching a few more files, but isn’t that painless. Some “pf” rules to enable NAT for and dhcpd setup to assign a “fixed” IP to the vm will get us going, along with some additional details on how to configure the networking for inside the debian VM.</li>
<li>Once those steps are completed you should be able to mount NFS and share data from the host to the VM painlessly. </li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.macobserver.com/podcasts/background-mode-jordan-hubbard/" rel="nofollow">MacObserver: Interview with Open Source Developer &amp; Former Apple Manager Jordan Hubbard </a> </p></li>
<li><p><a href="https://www.freebsdfoundation.org/blog/2016-google-summer-of-code-mentor-summit-and-meetbsd-trip-report-gavin-atkinson/" rel="nofollow">2016 Google Summer of Code Mentor Summit and MeetBSD Trip Report: Gavin Atkinson</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/TNyHBYwT" rel="nofollow"> Joe - BGP / Vultr Followup</a> </li>
<li><a href="http://pastebin.com/s4Ypezsz" rel="nofollow"> Ryan Moreno asks about Laptops </a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>183: Getting Steamy Here</title>
  <link>https://www.bsdnow.tv/183</link>
  <guid isPermaLink="false">d02d2a1c-b37d-436b-b181-f2feb9af794d</guid>
  <pubDate>Wed, 01 Mar 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d02d2a1c-b37d-436b-b181-f2feb9af794d.mp3" length="51077524" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we have “Weird Unix Things”, “Is it getting Steamy in here?” and an Interview about BSD Sockets API. (Those</itunes:subtitle>
  <itunes:duration>1:10:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we have “Weird Unix Things”, “Is it getting Steamy in here?” and an Interview about BSD Sockets API. (Those
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
playonbsd with TrueOS: It’s Getting Steamy in Here and I’ve Had Too Much Wine (https://www.trueos.org/blog/playonbsd-trueos-getting-steamy-ive-much-wine/)
We’ve done a couple of tutorials in the past on using Steam and Wine with PC-BSD, but now with the addition of playonbsd to the AppCafe library, you have more options than ever before to game on your TrueOS system.  We’re going to have a look today at playonbsd, how it works with TrueOS, and what you can expect if you want to give it a try on your own system.  Let’s dive right in!
Once playonbsd is installed, go back to your blank desktop, right-click on the wallpaper, and select terminal.  Playonbsd does almost all the configuring for you, but there are still a couple of simple options you’ll want to configure to give yourself the best experience.  In your open terminal, type: playonbsd.  You can also find playonbsd by doing a fast search using Lumina’s built-in search function in the start menu after it’s been installed.  Once opened,  a graphical interface greets us with easy to navigate menus and even does most of the work for you.
A nice graphical UI that hides the complexity of setting up WINE and Steam, and lets you pick select the game you want, and get it setup
Start gaming quicker, without the headache
If you’re a PC gamer, you should definitely give playonbsd a try!  You may be surprised at how well it works.  If you want to know ahead of time if your games are well supported or not, head on over to WineHQ and do a search.  Many people have tested and provided feedback and even solutions for potential problems with a large variety of video games. This is a great resource if you run into a glitch or other problem.
Weird Unix thing: 'cd //' (https://jvns.ca/blog/2017/02/08/weird-unix-things-cd/)
So why can you do ‘cd //tmp’, and it isn’t the same as ‘cd /tmp’?
The spec says:
An implementation may further simplify curpath by removing any trailing  characters that are not also leading  characters, replacing multiple non-leading consecutive  characters with a single , and replacing three or more leading  characters with a single . If, as a result of this canonicalization, the curpath variable is null, no further steps shall be taken.
“So! We can replace “three or more leading / characters with a single slash”. That does not say anything about what to do when there are 2 / characters though, which presumably is why cd //tmp leaves you at //tmp.”
A pathname that begins with two successive slashes may be interpreted in an implementation-defined manner
So what is it for? Well, the blog did a bit of digging and came up with this stackoverflow answer (http://unix.stackexchange.com/questions/256497/on-what-systems-is-foo-bar-different-from-foo-bar/256569#256569)
In cygwin and some other systems // is treated as a unix-ified version of \, to access UNC windows file sharing paths like \server\share
Perforce, the vcs, uses // to denote a path relative to the depot
It seems to have been used in the path for a bunch of different network file systems, but also for myriad other things
Testing out snapshots in Apple’s next-generation APFS file system (https://arstechnica.com/apple/2017/02/testing-out-snapshots-in-apples-next-generation-apfs-file-system/)
Adam Leventhal takes his DTrace hammer to Apple’s new file system to see what is going on
Back in June, Apple announced its new upcoming file system: APFS, or Apple File System. There was no mention of it in the WWDC keynote, but devotees needed no encouragement. They picked over every scintilla of data from the documentation on Apple’s developer site, extrapolating, interpolating, eager for whatever was about to come. In the WWDC session hall, the crowd buzzed with a nervous energy, eager for the grand unveiling of APFS. I myself badge-swapped my way into the conference just to get that first glimpse of Apple’s first original filesystem in the 30+ years since HFS
Apple’s presentation didn’t disappoint the hungry crowd. We hoped for a modern filesystem, optimized for next generation hardware, rich with features that have become the norm for data centers and professionals. With APFS, Apple showed a path to meeting those expectations. Dominic Giampaolo and Eric Tamura, leaders of the APFS team, shared performance optimizations, data integrity design, volume management, efficient storage of copied data, and snapshots—arguably the feature of APFS most directly in the user’s control.
It’s 2017, and Apple already appears to be making good on its promise with the revelation that the forthcoming iOS 10.3 will use APFS. The number of APFS tinkerers using it for their personal data has instantly gone from a few hundred to a few million. Beta users of iOS 10.3 have already made the switch apparently without incident. They have even ascribed unscientifically-significant performance improvements to APFS.
Previously Adam had used DTrace to find a new syscall introduced in OS X, fs_snapshot, but he had not dug into how to use it. Now it seems, the time has come
Learning from XNU and making some educated guesses, I wrote my first C program to create an APFS snapshot. This section has a bit of code, which you can find in this Github repo (https://github.com/ahl/apfs)
That just returned “fs_snapshot: Operation not permitted”
So, being Adam, he used DTrace to figure out what the problem was
Running this DTrace script in one terminal while running the snapshot program in another shows the code flow through the kernel as the program executes
In the code flow, the privcheckcred() function jumps out as a good place to continue because of its name, the fact that fs_snapshot calls it directly, and the fact that it returns 1 which corresponds with EPERM, the error we were getting.
Turns out, it just requires some sudo
With a little more testing I wrote my own version of Apple's unreleased snapUtil command from the WWDC demo
We figured out the proper use of the fssnapshot system call and reconstructed the WWDC snapUtil. But all this time an equivalent utility has been lurking on macOS Sierra. If you look in /System/Library/Filesystems/apfs.fs/Contents/Resources/, Apple has included a number of APFS-related utilities, including apfssnapshot (and, tantalizingly, a tool called hfs_convert).
Snapshots let you preserve state to later peruse; we can also revert an APFS volume to a previous state to restore its contents. The current APFS semantics around rollback are a little odd. The revert operation succeeds, but it doesn't take effect until the APFS volume is next mounted
Another reason Apple may not have wanted people messing around with snapshots is that the feature appears to be incomplete. Winding yourself into a state where only a reboot can clear a mounted snapshot is easy, and using snapshots seems to break some of the diskutil APFS output
It is interesting to see what you can do with DTrace, as well as to see what a DTrace and ZFS developer things of APFS
***
Interview - Tom Jones - tj@enoti.me (mailto:tj@enoti.me)
Replacing the BSD Sockets API
***
News Roundup
FreeBSD rc.d script to map ethernet device names by MAC address (https://github.com/eborisch/ethname)
Self-contained FreeBSD rc.d script for re-naming devices based on their MAC address. I needed it due to USB Ethernet devices coming up in different orders across OS upgrades.
Copy ethname into /usr/local/etc/rc.d/
Add the following to rc.conf:
ethnameenable="YES"
ethnamedevices="em0 ue0 ue1" # Replace with desired devices to rename
Create /usr/local/etc/ifmap in the following format:  
01:23:45:67:89:ab eth0
01:23:45:67:89:ac eth1
&lt;br&gt;
That's it. Use ifconfig_="" settings in rc.conf with the new names.
I know MFSBSD has something like this, but a polished up hybrid of the two should likely be part of the base system if something is not already available
This would be a great “Junior Job”, if say, a viewer wanted to get started with their first FreeBSD patch
***
Mog: A different take on the Unix tool cat (https://github.com/witchard/mog)
Do you abuse cat to view files?
Did you know cat is meant for concatenating files, meaning: cat part1 part2 part3 &amp;gt; wholething.txt
mog is a tool for actually viewing files, and it adds quite a few nice features
Syntax highlight scripts
Print a hex dump of binary files
Show details of image files
Perform objdump on executables
List a directory
mog reads the $HOME/.mogrc config file which describes a series of operations it can do in an ordered manner. Each operation has a match command and an action command. For each file you give to mog it will test each match command in turn, when one matches it will perform the action. A reasonably useful config file is generated when you first run it.
How Unix erases things when you type a backspace while entering text (https://utcc.utoronto.ca/~cks/space/blog/unix/HowUnixBackspaces)
Yesterday I mentioned in passing that printing a DEL character doesn't actually erase anything. This raises an interesting question, because when you're typing something into a Unix system and hit your backspace key, Unix sure erases the last character that you entered. So how is it doing that?
The answer turns out to be basically what you'd expect, although the actual implementation rapidly gets complex. When you hit backspace, the kernel tty line discipline rubs out your previous character by printing (in the simple case) Ctrl-H, a space, and then another Ctrl-H.
Of course just backing up one character is not always the correct way of erasing input, and that's when it gets complicated for the kernel. To start with we have tabs, because when you (the user) backspace over a tab you want the cursor to jump all the way back, not just move back one space. The kernel has a certain amount of code to work out what column it thinks you're on and then back up an appropriate number of spaces with Ctrl-Hs.
Then we have the case when you quoted a control character while entering it, eg by typing Ctrl-V Ctrl-H; this causes the kernel to print the Ctrl-H instead of acting on it, and it prints it as the two character sequence ^H. When you hit backspace to erase that, of course you want both (printed) characters to be rubbed out, not just the 'H'. So the kernel needs to keep track of that and rub out two characters instead of just one.
Chris then provides an example, from IllumOS, of the kernel trying to deal with multibyte characters
FreeBSD also handles backspacing a space specially, because you don't need to actually rub that out with a '\b \b' sequence; you can just print a plain \b. Other kernels don't seem to bother with this optimization. The FreeBSD code for this is in sys/kern/ttyttydisc.c in the ttydiscrubchar function
PS: If you want to see the kernel's handling of backspace in action, you usually can't test it at your shell prompt, because you're almost certainly using a shell that supports command line editing and readline and so on. Command line editing requires taking over input processing from the kernel, and so such shells are handling everything themselves. My usual way to see what the kernel is doing is to run 'cat &amp;gt;/dev/null' and then type away.
And you thought the backspace key would be simple...
***
FreeBSD ports now have Wayland (http://www.freshports.org/graphics/wayland/)
We’ve discussed the pending Wayland work, but we wanted to point you today to the ports which are in mainline FreeBSD ports tree now.
First of all, (And I was wondering how they would deal with this) it has landed in the “graphics” category, since Wayland is the Anti-X11, putting it in x11/ didn’t make a lot of sense.
Couple of notes before you start installing new packages and expecting wayland to “just work”
First, this does require that you have working DRM from the kernel side. You’ll want to grab TrueOS or build from Matt Macy’s FreeBSD branches on GitHub before testing on any kind of modern Intel GPU. Nvidia with modesetting should be supported.
Next, not all desktops will “just work”. You may need to grab experimental Weston for compositor. KDE / Gnome (And Lumina) and friends will grow Wayland support in the future, so don’t expect to just fire up $whatever and have it all work out of box.
Feedback is needed! This is brand new functionality for FreeBSD, and the maintainers will want to hear your results. For us on the TrueOS side we are interested as well, since we want to port Lumina over to Wayland soon(ish)
Happy Experimenting!
***
Beastie Bits
Faces of FreeBSD 2017: Joseph Kong (https://www.freebsdfoundation.org/blog/faces-of-freebsd-2017-joseph-kong/) 
OPNsense 17.1  “Eclectic Eagle”, based on FreeBSD 11 Released (https://opnsense.org/opnsense-17-1-released/) 
Why you should start programming on UNIX (http://www.koszek.com/blog/2017/01/28/why-you-should-start-programming-on-unix/) 
OpenSMTPD Mail Filtering (http://eradman.com/posts/opensmtpd-filtering.html) 
Feedback/Questions
 Zane - Databases and Jails (http://pastebin.com/89AyGe5F) 
 Mohammad - USB Install (http://pastebin.com/Te8sz9id) 
 Chuck - Updating Jails (http://pastebin.com/G2SzahWL) 
 David - Lumina / LXQt (http://pastebin.com/71ExJLpL) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we have “Weird Unix Things”, “Is it getting Steamy in here?” and an Interview about BSD Sockets API. (Those</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.trueos.org/blog/playonbsd-trueos-getting-steamy-ive-much-wine/" rel="nofollow">playonbsd with TrueOS: It’s Getting Steamy in Here and I’ve Had Too Much Wine</a></h3>

<blockquote>
<p>We’ve done a couple of tutorials in the past on using Steam and Wine with PC-BSD, but now with the addition of playonbsd to the AppCafe library, you have more options than ever before to game on your TrueOS system.  We’re going to have a look today at playonbsd, how it works with TrueOS, and what you can expect if you want to give it a try on your own system.  Let’s dive right in!</p>

<p>Once playonbsd is installed, go back to your blank desktop, right-click on the wallpaper, and select terminal.  Playonbsd does almost all the configuring for you, but there are still a couple of simple options you’ll want to configure to give yourself the best experience.  In your open terminal, type: playonbsd.  You can also find playonbsd by doing a fast search using Lumina’s built-in search function in the start menu after it’s been installed.  Once opened,  a graphical interface greets us with easy to navigate menus and even does most of the work for you.</p>
</blockquote>

<ul>
<li>A nice graphical UI that hides the complexity of setting up WINE and Steam, and lets you pick select the game you want, and get it setup</li>
<li>Start gaming quicker, without the headache</li>
</ul>

<blockquote>
<p>If you’re a PC gamer, you should definitely give playonbsd a try!  You may be surprised at how well it works.  If you want to know ahead of time if your games are well supported or not, head on over to WineHQ and do a search.  Many people have tested and provided feedback and even solutions for potential problems with a large variety of video games. This is a great resource if you run into a glitch or other problem.</p>
</blockquote>

<hr>

<h3><a href="https://jvns.ca/blog/2017/02/08/weird-unix-things-cd/" rel="nofollow">Weird Unix thing: &#39;cd //&#39;</a></h3>

<ul>
<li>So why can you do ‘cd //tmp’, and it isn’t the same as ‘cd /tmp’?</li>
<li>The spec says:</li>
</ul>

<blockquote>
<p>An implementation may further simplify curpath by removing any trailing <slash> characters that are not also leading <slash> characters, replacing multiple non-leading consecutive <slash> characters with a single <slash>, and replacing three or more leading <slash> characters with a single <slash>. If, as a result of this canonicalization, the curpath variable is null, no further steps shall be taken.</p>
</blockquote>

<ul>
<li>“So! We can replace “three or more leading / characters with a single slash”. That does not say anything about what to do when there are 2 / characters though, which presumably is why cd //tmp leaves you at //tmp.”</li>
</ul>

<blockquote>
<p>A pathname that begins with two successive slashes may be interpreted in an implementation-defined manner</p>
</blockquote>

<ul>
<li>So what is it for? Well, the blog did a bit of digging and came up with <a href="http://unix.stackexchange.com/questions/256497/on-what-systems-is-foo-bar-different-from-foo-bar/256569#256569" rel="nofollow">this stackoverflow answer</a></li>
<li>In cygwin and some other systems // is treated as a unix-ified version of \, to access UNC windows file sharing paths like \server\share</li>
<li>Perforce, the vcs, uses // to denote a path relative to the depot</li>
<li>It seems to have been used in the path for a bunch of different network file systems, but also for myriad other things</li>
</ul>

<hr>

<h3><a href="https://arstechnica.com/apple/2017/02/testing-out-snapshots-in-apples-next-generation-apfs-file-system/" rel="nofollow">Testing out snapshots in Apple’s next-generation APFS file system</a></h3>

<ul>
<li>Adam Leventhal takes his DTrace hammer to Apple’s new file system to see what is going on</li>
</ul>

<blockquote>
<p>Back in June, Apple announced its new upcoming file system: APFS, or Apple File System. There was no mention of it in the WWDC keynote, but devotees needed no encouragement. They picked over every scintilla of data from the documentation on Apple’s developer site, extrapolating, interpolating, eager for whatever was about to come. In the WWDC session hall, the crowd buzzed with a nervous energy, eager for the grand unveiling of APFS. I myself badge-swapped my way into the conference just to get that first glimpse of Apple’s first original filesystem in the 30+ years since HFS</p>

<p>Apple’s presentation didn’t disappoint the hungry crowd. We hoped for a modern filesystem, optimized for next generation hardware, rich with features that have become the norm for data centers and professionals. With APFS, Apple showed a path to meeting those expectations. Dominic Giampaolo and Eric Tamura, leaders of the APFS team, shared performance optimizations, data integrity design, volume management, efficient storage of copied data, and snapshots—arguably the feature of APFS most directly in the user’s control.</p>

<p>It’s 2017, and Apple already appears to be making good on its promise with the revelation that the forthcoming iOS 10.3 will use APFS. The number of APFS tinkerers using it for their personal data has instantly gone from a few hundred to a few million. Beta users of iOS 10.3 have already made the switch apparently without incident. They have even ascribed unscientifically-significant performance improvements to APFS.</p>
</blockquote>

<ul>
<li>Previously Adam had used DTrace to find a new syscall introduced in OS X, fs_snapshot, but he had not dug into how to use it. Now it seems, the time has come</li>
</ul>

<blockquote>
<p>Learning from XNU and making some educated guesses, I wrote my first C program to create an APFS snapshot. This section has a bit of code, which you can find in <a href="https://github.com/ahl/apfs" rel="nofollow">this Github repo</a></p>
</blockquote>

<ul>
<li>That just returned “fs_snapshot: Operation not permitted”</li>
<li>So, being Adam, he used DTrace to figure out what the problem was</li>
</ul>

<blockquote>
<p>Running this DTrace script in one terminal while running the snapshot program in another shows the code flow through the kernel as the program executes</p>

<p>In the code flow, the priv_check_cred() function jumps out as a good place to continue because of its name, the fact that fs_snapshot calls it directly, and the fact that it returns 1 which corresponds with EPERM, the error we were getting.</p>
</blockquote>

<ul>
<li>Turns out, it just requires some sudo</li>
</ul>

<blockquote>
<p>With a little more testing I wrote my own version of Apple&#39;s unreleased snapUtil command from the WWDC demo</p>

<p>We figured out the proper use of the fs_snapshot system call and reconstructed the WWDC snapUtil. But all this time an equivalent utility has been lurking on macOS Sierra. If you look in /System/Library/Filesystems/apfs.fs/Contents/Resources/, Apple has included a number of APFS-related utilities, including apfs_snapshot (and, tantalizingly, a tool called hfs_convert).</p>

<p>Snapshots let you preserve state to later peruse; we can also revert an APFS volume to a previous state to restore its contents. The current APFS semantics around rollback are a little odd. The revert operation succeeds, but it doesn&#39;t take effect until the APFS volume is next mounted</p>

<p>Another reason Apple may not have wanted people messing around with snapshots is that the feature appears to be incomplete. Winding yourself into a state where only a reboot can clear a mounted snapshot is easy, and using snapshots seems to break some of the diskutil APFS output</p>
</blockquote>

<ul>
<li>It is interesting to see what you can do with DTrace, as well as to see what a DTrace and ZFS developer things of APFS
***</li>
</ul>

<h2>Interview - Tom Jones - <a href="mailto:tj@enoti.me" rel="nofollow">tj@enoti.me</a></h2>

<ul>
<li>Replacing the BSD Sockets API
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://github.com/eborisch/ethname" rel="nofollow">FreeBSD rc.d script to map ethernet device names by MAC address</a></h3>

<blockquote>
<p>Self-contained FreeBSD rc.d script for re-naming devices based on their MAC address. I needed it due to USB Ethernet devices coming up in different orders across OS upgrades.</p>
</blockquote>

<ul>
<li>Copy ethname into /usr/local/etc/rc.d/</li>
<li><p>Add the following to rc.conf:</p>

<blockquote>
<p>ethname_enable=&quot;YES&quot;<br>
ethname_devices=&quot;em0 ue0 ue1&quot; # Replace with desired devices to rename</p>
</blockquote></li>
<li><p>Create /usr/local/etc/ifmap in the following format: <MAC address (in lower case)> <Desired name></p>

<blockquote>
<p>01:23:45:67:89:ab eth0<br>
01:23:45:67:89:ac eth1</p>
</blockquote></li>
</ul>

<p><br></p>

<blockquote>
<p>That&#39;s it. Use ifconfig_<name>=&quot;&quot; settings in rc.conf with the new names.</p>
</blockquote>

<ul>
<li>I know MFSBSD has something like this, but a polished up hybrid of the two should likely be part of the base system if something is not already available</li>
<li>This would be a great “Junior Job”, if say, a viewer wanted to get started with their first FreeBSD patch
***</li>
</ul>

<h3><a href="https://github.com/witchard/mog" rel="nofollow">Mog: A different take on the Unix tool cat</a></h3>

<ul>
<li>Do you abuse cat to view files?</li>
<li>Did you know cat is meant for con*cat*enating files, meaning: cat part1 part2 part3 &gt; wholething.txt</li>
<li>mog is a tool for actually viewing files, and it adds quite a few nice features

<ul>
<li>Syntax highlight scripts</li>
<li>Print a hex dump of binary files</li>
<li>Show details of image files</li>
<li>Perform objdump on executables</li>
<li>List a directory</li>
</ul></li>
</ul>

<blockquote>
<p>mog reads the $HOME/.mogrc config file which describes a series of operations it can do in an ordered manner. Each operation has a match command and an action command. For each file you give to mog it will test each match command in turn, when one matches it will perform the action. A reasonably useful config file is generated when you first run it.</p>

<hr>
</blockquote>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/HowUnixBackspaces" rel="nofollow">How Unix erases things when you type a backspace while entering text</a></h3>

<blockquote>
<p>Yesterday I mentioned in passing that printing a DEL character doesn&#39;t actually erase anything. This raises an interesting question, because when you&#39;re typing something into a Unix system and hit your backspace key, Unix sure erases the last character that you entered. So how is it doing that?</p>

<p>The answer turns out to be basically what you&#39;d expect, although the actual implementation rapidly gets complex. When you hit backspace, the kernel tty line discipline rubs out your previous character by printing (in the simple case) Ctrl-H, a space, and then another Ctrl-H.</p>

<p>Of course just backing up one character is not always the correct way of erasing input, and that&#39;s when it gets complicated for the kernel. To start with we have tabs, because when you (the user) backspace over a tab you want the cursor to jump all the way back, not just move back one space. The kernel has a certain amount of code to work out what column it thinks you&#39;re on and then back up an appropriate number of spaces with Ctrl-Hs.</p>

<p>Then we have the case when you quoted a control character while entering it, eg by typing Ctrl-V Ctrl-H; this causes the kernel to print the Ctrl-H instead of acting on it, and it prints it as the two character sequence <sup>H.</sup> When you hit backspace to erase that, of course you want both (printed) characters to be rubbed out, not just the &#39;H&#39;. So the kernel needs to keep track of that and rub out two characters instead of just one.</p>
</blockquote>

<ul>
<li>Chris then provides an example, from IllumOS, of the kernel trying to deal with multibyte characters</li>
</ul>

<blockquote>
<p>FreeBSD also handles backspacing a space specially, because you don&#39;t need to actually rub that out with a &#39;\b \b&#39; sequence; you can just print a plain \b. Other kernels don&#39;t seem to bother with this optimization. The FreeBSD code for this is in sys/kern/tty_ttydisc.c in the ttydisc_rubchar function</p>

<p>PS: If you want to see the kernel&#39;s handling of backspace in action, you usually can&#39;t test it at your shell prompt, because you&#39;re almost certainly using a shell that supports command line editing and readline and so on. Command line editing requires taking over input processing from the kernel, and so such shells are handling everything themselves. My usual way to see what the kernel is doing is to run &#39;cat &gt;/dev/null&#39; and then type away.</p>
</blockquote>

<ul>
<li>And you thought the backspace key would be simple...
***</li>
</ul>

<h3><a href="http://www.freshports.org/graphics/wayland/" rel="nofollow">FreeBSD ports now have Wayland</a></h3>

<ul>
<li>We’ve discussed the pending Wayland work, but we wanted to point you today to the ports which are in mainline FreeBSD ports tree now.</li>
<li>First of all, (And I was wondering how they would deal with this) it has landed in the “graphics” category, since Wayland is the Anti-X11, putting it in x11/ didn’t make a lot of sense.</li>
<li>Couple of notes before you start installing new packages and expecting wayland to “just work”</li>
<li>First, this does require that you have working DRM from the kernel side. You’ll want to grab TrueOS or build from Matt Macy’s FreeBSD branches on GitHub before testing on any kind of modern Intel GPU. Nvidia with modesetting should be supported.</li>
<li>Next, not all desktops will “just work”. You may need to grab experimental Weston for compositor. KDE / Gnome (And Lumina) and friends will grow Wayland support in the future, so don’t expect to just fire up $whatever and have it all work out of box.</li>
<li>Feedback is needed! This is brand new functionality for FreeBSD, and the maintainers will want to hear your results. For us on the TrueOS side we are interested as well, since we want to port Lumina over to Wayland soon(ish)</li>
<li>Happy Experimenting!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.freebsdfoundation.org/blog/faces-of-freebsd-2017-joseph-kong/" rel="nofollow">Faces of FreeBSD 2017: Joseph Kong</a> </p></li>
<li><p><a href="https://opnsense.org/opnsense-17-1-released/" rel="nofollow">OPNsense 17.1  “Eclectic Eagle”, based on FreeBSD 11 Released</a> </p></li>
<li><p><a href="http://www.koszek.com/blog/2017/01/28/why-you-should-start-programming-on-unix/" rel="nofollow">Why you should start programming on UNIX</a> </p></li>
<li><p><a href="http://eradman.com/posts/opensmtpd-filtering.html" rel="nofollow">OpenSMTPD Mail Filtering</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/89AyGe5F" rel="nofollow"> Zane - Databases and Jails</a> </li>
<li><a href="http://pastebin.com/Te8sz9id" rel="nofollow"> Mohammad - USB Install</a> </li>
<li><a href="http://pastebin.com/G2SzahWL" rel="nofollow"> Chuck - Updating Jails</a> </li>
<li><a href="http://pastebin.com/71ExJLpL" rel="nofollow"> David - Lumina / LXQt</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we have “Weird Unix Things”, “Is it getting Steamy in here?” and an Interview about BSD Sockets API. (Those</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.trueos.org/blog/playonbsd-trueos-getting-steamy-ive-much-wine/" rel="nofollow">playonbsd with TrueOS: It’s Getting Steamy in Here and I’ve Had Too Much Wine</a></h3>

<blockquote>
<p>We’ve done a couple of tutorials in the past on using Steam and Wine with PC-BSD, but now with the addition of playonbsd to the AppCafe library, you have more options than ever before to game on your TrueOS system.  We’re going to have a look today at playonbsd, how it works with TrueOS, and what you can expect if you want to give it a try on your own system.  Let’s dive right in!</p>

<p>Once playonbsd is installed, go back to your blank desktop, right-click on the wallpaper, and select terminal.  Playonbsd does almost all the configuring for you, but there are still a couple of simple options you’ll want to configure to give yourself the best experience.  In your open terminal, type: playonbsd.  You can also find playonbsd by doing a fast search using Lumina’s built-in search function in the start menu after it’s been installed.  Once opened,  a graphical interface greets us with easy to navigate menus and even does most of the work for you.</p>
</blockquote>

<ul>
<li>A nice graphical UI that hides the complexity of setting up WINE and Steam, and lets you pick select the game you want, and get it setup</li>
<li>Start gaming quicker, without the headache</li>
</ul>

<blockquote>
<p>If you’re a PC gamer, you should definitely give playonbsd a try!  You may be surprised at how well it works.  If you want to know ahead of time if your games are well supported or not, head on over to WineHQ and do a search.  Many people have tested and provided feedback and even solutions for potential problems with a large variety of video games. This is a great resource if you run into a glitch or other problem.</p>
</blockquote>

<hr>

<h3><a href="https://jvns.ca/blog/2017/02/08/weird-unix-things-cd/" rel="nofollow">Weird Unix thing: &#39;cd //&#39;</a></h3>

<ul>
<li>So why can you do ‘cd //tmp’, and it isn’t the same as ‘cd /tmp’?</li>
<li>The spec says:</li>
</ul>

<blockquote>
<p>An implementation may further simplify curpath by removing any trailing <slash> characters that are not also leading <slash> characters, replacing multiple non-leading consecutive <slash> characters with a single <slash>, and replacing three or more leading <slash> characters with a single <slash>. If, as a result of this canonicalization, the curpath variable is null, no further steps shall be taken.</p>
</blockquote>

<ul>
<li>“So! We can replace “three or more leading / characters with a single slash”. That does not say anything about what to do when there are 2 / characters though, which presumably is why cd //tmp leaves you at //tmp.”</li>
</ul>

<blockquote>
<p>A pathname that begins with two successive slashes may be interpreted in an implementation-defined manner</p>
</blockquote>

<ul>
<li>So what is it for? Well, the blog did a bit of digging and came up with <a href="http://unix.stackexchange.com/questions/256497/on-what-systems-is-foo-bar-different-from-foo-bar/256569#256569" rel="nofollow">this stackoverflow answer</a></li>
<li>In cygwin and some other systems // is treated as a unix-ified version of \, to access UNC windows file sharing paths like \server\share</li>
<li>Perforce, the vcs, uses // to denote a path relative to the depot</li>
<li>It seems to have been used in the path for a bunch of different network file systems, but also for myriad other things</li>
</ul>

<hr>

<h3><a href="https://arstechnica.com/apple/2017/02/testing-out-snapshots-in-apples-next-generation-apfs-file-system/" rel="nofollow">Testing out snapshots in Apple’s next-generation APFS file system</a></h3>

<ul>
<li>Adam Leventhal takes his DTrace hammer to Apple’s new file system to see what is going on</li>
</ul>

<blockquote>
<p>Back in June, Apple announced its new upcoming file system: APFS, or Apple File System. There was no mention of it in the WWDC keynote, but devotees needed no encouragement. They picked over every scintilla of data from the documentation on Apple’s developer site, extrapolating, interpolating, eager for whatever was about to come. In the WWDC session hall, the crowd buzzed with a nervous energy, eager for the grand unveiling of APFS. I myself badge-swapped my way into the conference just to get that first glimpse of Apple’s first original filesystem in the 30+ years since HFS</p>

<p>Apple’s presentation didn’t disappoint the hungry crowd. We hoped for a modern filesystem, optimized for next generation hardware, rich with features that have become the norm for data centers and professionals. With APFS, Apple showed a path to meeting those expectations. Dominic Giampaolo and Eric Tamura, leaders of the APFS team, shared performance optimizations, data integrity design, volume management, efficient storage of copied data, and snapshots—arguably the feature of APFS most directly in the user’s control.</p>

<p>It’s 2017, and Apple already appears to be making good on its promise with the revelation that the forthcoming iOS 10.3 will use APFS. The number of APFS tinkerers using it for their personal data has instantly gone from a few hundred to a few million. Beta users of iOS 10.3 have already made the switch apparently without incident. They have even ascribed unscientifically-significant performance improvements to APFS.</p>
</blockquote>

<ul>
<li>Previously Adam had used DTrace to find a new syscall introduced in OS X, fs_snapshot, but he had not dug into how to use it. Now it seems, the time has come</li>
</ul>

<blockquote>
<p>Learning from XNU and making some educated guesses, I wrote my first C program to create an APFS snapshot. This section has a bit of code, which you can find in <a href="https://github.com/ahl/apfs" rel="nofollow">this Github repo</a></p>
</blockquote>

<ul>
<li>That just returned “fs_snapshot: Operation not permitted”</li>
<li>So, being Adam, he used DTrace to figure out what the problem was</li>
</ul>

<blockquote>
<p>Running this DTrace script in one terminal while running the snapshot program in another shows the code flow through the kernel as the program executes</p>

<p>In the code flow, the priv_check_cred() function jumps out as a good place to continue because of its name, the fact that fs_snapshot calls it directly, and the fact that it returns 1 which corresponds with EPERM, the error we were getting.</p>
</blockquote>

<ul>
<li>Turns out, it just requires some sudo</li>
</ul>

<blockquote>
<p>With a little more testing I wrote my own version of Apple&#39;s unreleased snapUtil command from the WWDC demo</p>

<p>We figured out the proper use of the fs_snapshot system call and reconstructed the WWDC snapUtil. But all this time an equivalent utility has been lurking on macOS Sierra. If you look in /System/Library/Filesystems/apfs.fs/Contents/Resources/, Apple has included a number of APFS-related utilities, including apfs_snapshot (and, tantalizingly, a tool called hfs_convert).</p>

<p>Snapshots let you preserve state to later peruse; we can also revert an APFS volume to a previous state to restore its contents. The current APFS semantics around rollback are a little odd. The revert operation succeeds, but it doesn&#39;t take effect until the APFS volume is next mounted</p>

<p>Another reason Apple may not have wanted people messing around with snapshots is that the feature appears to be incomplete. Winding yourself into a state where only a reboot can clear a mounted snapshot is easy, and using snapshots seems to break some of the diskutil APFS output</p>
</blockquote>

<ul>
<li>It is interesting to see what you can do with DTrace, as well as to see what a DTrace and ZFS developer things of APFS
***</li>
</ul>

<h2>Interview - Tom Jones - <a href="mailto:tj@enoti.me" rel="nofollow">tj@enoti.me</a></h2>

<ul>
<li>Replacing the BSD Sockets API
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://github.com/eborisch/ethname" rel="nofollow">FreeBSD rc.d script to map ethernet device names by MAC address</a></h3>

<blockquote>
<p>Self-contained FreeBSD rc.d script for re-naming devices based on their MAC address. I needed it due to USB Ethernet devices coming up in different orders across OS upgrades.</p>
</blockquote>

<ul>
<li>Copy ethname into /usr/local/etc/rc.d/</li>
<li><p>Add the following to rc.conf:</p>

<blockquote>
<p>ethname_enable=&quot;YES&quot;<br>
ethname_devices=&quot;em0 ue0 ue1&quot; # Replace with desired devices to rename</p>
</blockquote></li>
<li><p>Create /usr/local/etc/ifmap in the following format: <MAC address (in lower case)> <Desired name></p>

<blockquote>
<p>01:23:45:67:89:ab eth0<br>
01:23:45:67:89:ac eth1</p>
</blockquote></li>
</ul>

<p><br></p>

<blockquote>
<p>That&#39;s it. Use ifconfig_<name>=&quot;&quot; settings in rc.conf with the new names.</p>
</blockquote>

<ul>
<li>I know MFSBSD has something like this, but a polished up hybrid of the two should likely be part of the base system if something is not already available</li>
<li>This would be a great “Junior Job”, if say, a viewer wanted to get started with their first FreeBSD patch
***</li>
</ul>

<h3><a href="https://github.com/witchard/mog" rel="nofollow">Mog: A different take on the Unix tool cat</a></h3>

<ul>
<li>Do you abuse cat to view files?</li>
<li>Did you know cat is meant for con*cat*enating files, meaning: cat part1 part2 part3 &gt; wholething.txt</li>
<li>mog is a tool for actually viewing files, and it adds quite a few nice features

<ul>
<li>Syntax highlight scripts</li>
<li>Print a hex dump of binary files</li>
<li>Show details of image files</li>
<li>Perform objdump on executables</li>
<li>List a directory</li>
</ul></li>
</ul>

<blockquote>
<p>mog reads the $HOME/.mogrc config file which describes a series of operations it can do in an ordered manner. Each operation has a match command and an action command. For each file you give to mog it will test each match command in turn, when one matches it will perform the action. A reasonably useful config file is generated when you first run it.</p>

<hr>
</blockquote>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/HowUnixBackspaces" rel="nofollow">How Unix erases things when you type a backspace while entering text</a></h3>

<blockquote>
<p>Yesterday I mentioned in passing that printing a DEL character doesn&#39;t actually erase anything. This raises an interesting question, because when you&#39;re typing something into a Unix system and hit your backspace key, Unix sure erases the last character that you entered. So how is it doing that?</p>

<p>The answer turns out to be basically what you&#39;d expect, although the actual implementation rapidly gets complex. When you hit backspace, the kernel tty line discipline rubs out your previous character by printing (in the simple case) Ctrl-H, a space, and then another Ctrl-H.</p>

<p>Of course just backing up one character is not always the correct way of erasing input, and that&#39;s when it gets complicated for the kernel. To start with we have tabs, because when you (the user) backspace over a tab you want the cursor to jump all the way back, not just move back one space. The kernel has a certain amount of code to work out what column it thinks you&#39;re on and then back up an appropriate number of spaces with Ctrl-Hs.</p>

<p>Then we have the case when you quoted a control character while entering it, eg by typing Ctrl-V Ctrl-H; this causes the kernel to print the Ctrl-H instead of acting on it, and it prints it as the two character sequence <sup>H.</sup> When you hit backspace to erase that, of course you want both (printed) characters to be rubbed out, not just the &#39;H&#39;. So the kernel needs to keep track of that and rub out two characters instead of just one.</p>
</blockquote>

<ul>
<li>Chris then provides an example, from IllumOS, of the kernel trying to deal with multibyte characters</li>
</ul>

<blockquote>
<p>FreeBSD also handles backspacing a space specially, because you don&#39;t need to actually rub that out with a &#39;\b \b&#39; sequence; you can just print a plain \b. Other kernels don&#39;t seem to bother with this optimization. The FreeBSD code for this is in sys/kern/tty_ttydisc.c in the ttydisc_rubchar function</p>

<p>PS: If you want to see the kernel&#39;s handling of backspace in action, you usually can&#39;t test it at your shell prompt, because you&#39;re almost certainly using a shell that supports command line editing and readline and so on. Command line editing requires taking over input processing from the kernel, and so such shells are handling everything themselves. My usual way to see what the kernel is doing is to run &#39;cat &gt;/dev/null&#39; and then type away.</p>
</blockquote>

<ul>
<li>And you thought the backspace key would be simple...
***</li>
</ul>

<h3><a href="http://www.freshports.org/graphics/wayland/" rel="nofollow">FreeBSD ports now have Wayland</a></h3>

<ul>
<li>We’ve discussed the pending Wayland work, but we wanted to point you today to the ports which are in mainline FreeBSD ports tree now.</li>
<li>First of all, (And I was wondering how they would deal with this) it has landed in the “graphics” category, since Wayland is the Anti-X11, putting it in x11/ didn’t make a lot of sense.</li>
<li>Couple of notes before you start installing new packages and expecting wayland to “just work”</li>
<li>First, this does require that you have working DRM from the kernel side. You’ll want to grab TrueOS or build from Matt Macy’s FreeBSD branches on GitHub before testing on any kind of modern Intel GPU. Nvidia with modesetting should be supported.</li>
<li>Next, not all desktops will “just work”. You may need to grab experimental Weston for compositor. KDE / Gnome (And Lumina) and friends will grow Wayland support in the future, so don’t expect to just fire up $whatever and have it all work out of box.</li>
<li>Feedback is needed! This is brand new functionality for FreeBSD, and the maintainers will want to hear your results. For us on the TrueOS side we are interested as well, since we want to port Lumina over to Wayland soon(ish)</li>
<li>Happy Experimenting!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.freebsdfoundation.org/blog/faces-of-freebsd-2017-joseph-kong/" rel="nofollow">Faces of FreeBSD 2017: Joseph Kong</a> </p></li>
<li><p><a href="https://opnsense.org/opnsense-17-1-released/" rel="nofollow">OPNsense 17.1  “Eclectic Eagle”, based on FreeBSD 11 Released</a> </p></li>
<li><p><a href="http://www.koszek.com/blog/2017/01/28/why-you-should-start-programming-on-unix/" rel="nofollow">Why you should start programming on UNIX</a> </p></li>
<li><p><a href="http://eradman.com/posts/opensmtpd-filtering.html" rel="nofollow">OpenSMTPD Mail Filtering</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/89AyGe5F" rel="nofollow"> Zane - Databases and Jails</a> </li>
<li><a href="http://pastebin.com/Te8sz9id" rel="nofollow"> Mohammad - USB Install</a> </li>
<li><a href="http://pastebin.com/G2SzahWL" rel="nofollow"> Chuck - Updating Jails</a> </li>
<li><a href="http://pastebin.com/71ExJLpL" rel="nofollow"> David - Lumina / LXQt</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>182: Bloaty McBloatface</title>
  <link>https://www.bsdnow.tv/182</link>
  <guid isPermaLink="false">03a41594-1715-4d90-9b5e-594a358caefd</guid>
  <pubDate>Wed, 22 Feb 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/03a41594-1715-4d90-9b5e-594a358caefd.mp3" length="48221716" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we’ve got FreeBSD quarterly Status reports to discuss, OpenBSD changes to the installer, EC2 and IPv6 and more. Stay</itunes:subtitle>
  <itunes:duration>1:06:58</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we’ve got FreeBSD quarterly Status reports to discuss, OpenBSD changes to the installer, EC2 and IPv6 and more. Stay
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenBSD changes of note 6 (http://www.tedunangst.com/flak/post/openbsd-changes-of-note-6)
OpenBSD can now be cross built with clang. Work on this continues
Build ld.so with -fno-builtin because otherwise clang would optimize the local versions of functions like dlmemset into a call to memset, which doesn’t exist.
Add connection timeout for ftp (http). Mostly for the installer so it can error out and try something else.
Complete https support for the installer.
I wonder how they handle certificate verification. I need to look into this as I’d like to switch the FreeBSD installer to this as well
New ocspcheck utility to validate a certificate against its ocsp responder.
net lock here, net lock there, net lock not quite everywhere but more than before.
More per cpu counters in networking code as well.
Disable and lock Silicon Debug feature on modern Intel CPUs. 
Prevent wireless frame injection attack described at 33C3 in the talk titled “Predicting and Abusing WPA2/802.11 Group Keys” by Mathy Vanhoef.
Add support for multiple transmit ifqueues per network interface. Supported drivers include bge, bnx, em, myx, ix, hvn, xnf. 
pledge now tracks when a file as opened and uses this to permit or deny ioctl. 
Reimplement httpd’s support for byte ranges. Fixes a memory DOS. 
FreeBSD 2016Q4 Status Report (https://www.freebsd.org/news/status/report-2016-10-2016-12.html)
An overview of some of the work that happened in October - December 2016
The ports tree saw many updates and surpassed 27,000 ports
The core team was busy as usual, and the foundation attended and/or sponsored a record 24 events in 2016.
CEPH on FreeBSD seems to be coming along nicely. For those that do not know, CEPH is a distributed filesystem that can sit on top of another filesystem. That is, you can use it to create a clustered filesystem out of a bunch of ZFS servers. Would love to have some viewers give it a try and report back.
OpenBSM, the FreeBSD audit framework, got some updates
Ed Schouten committed a front end to export sysctl data in a format usable by Prometheus, the open source monitoring system. This is useful for other monitoring software too.
Lots of updates for various ARM boards
There is an update on Reproducible Builds in FreeBSD, “ It is now possible to build the FreeBSD base system (kernel and userland) completely reproducibly, although it currently requires a few non-default settings”, and the ports tree is at 80% reproducible
Lots of toolchain updates (gcc, lld, gdb)
Various updates from major ports teams
***
Amazon rolls out IPv6 support on EC2 (http://www.daemonology.net/blog/2017-01-26-IPv6-on-FreeBSD-EC2.html)
A few hours ago Amazon announced that they had rolled out IPv6 support in EC2 to 15 regions — everywhere except the Beijing region, apparently. This seems as good a time as any to write about using IPv6 in EC2 on FreeBSD instances.
First, the good news: Future FreeBSD releases will support IPv6 "out of the box" on EC2. I committed changes to HEAD last week, and merged them to the stable/11 branch moments ago, to have FreeBSD automatically use whatever IPv6 addresses EC2 makes available to it.
Next, the annoying news: To get IPv6 support in EC2 from existing FreeBSD releases (10.3, 11.0) you'll need to run a few simple commands. I consider this unfortunate but inevitable: While Amazon has been unusually helpful recently, there's nothing they could have done to get support for their IPv6 networking configuration into FreeBSD a year before they launched it.
You need the dual-dhclient port:
pkg install dual-dhclient
And the following lines in your /etc/rc.conf:
   ifconfigDEFAULT="SYNCDHCP acceptrtadv"
   ipv6activateallinterfaces="YES"
   dhclientprogram="/usr/local/sbin/dual-dhclient"
+ It is good to see FreeBSD being ready to use this feature on day 0, not something we would have had in the past
Finally, one important caveat: While EC2 is clearly the most important place to have IPv6 support, and one which many of us have been waiting a long time to get, this is not the only service where IPv6 support is important. Of particular concern to me, Application Load Balancer support for IPv6 is still missing in many regions, and Elastic Load Balancers in VPC don't support IPv6 at all — which matters to those of us who run non-HTTP services. Make sure that IPv6 support has been rolled out for all the services you need before you start migrating.
Colin’s blog also has the details on how to actually activate IPv6 from the Amazon side, if only it was as easy as configuring it on the FreeBSD side
***
FreeBSD’s George Neville-Neil tries valiantly for over an hour to convince a Linux fan of the error of their ways  (https://www.youtube.com/watch?v=cofKxtIO3Is)
In today's episode of the Lunduke Hour I talk to George Neville-Neil -- author and FreeBSD advocate. He tries to convince me, a Linux user, that FreeBSD is better.
+ They cover quite a few topics, including:
 + licensing, and the motivations behind it
 + vendor relations
 + community
 + development model
 + drivers and hardware support
+ George also talks about his work with the FreeBSD Foundation, and the book he co-authored, “The Design and Implementation of the FreeBSD Operating System, 2nd Edition”
News Roundup
An interactive script that makes it easy to install 50+ desktop environments following a base install of FreeBSD 11 (https://github.com/rosedovell/unixdesktops)
And I thought I was doing good when I wrote a patch for the installer that enables your choice of 3 desktop environments...
This is a collection of scripts meant to install desktop environments on unix-like operating systems following a base install. I call one of these 'complete' when it meets the following requirements:
 + A graphical logon manager is presented without user intervention after powering on the machine
 + Logging into that graphical logon manager takes the user into the specified desktop environment
 + The user can open a terminal emulator
I need to revive my patch, and add Lumina to it
***
Firefox 51 on sparc64 - we did not hit the wall yet (https://blog.netbsd.org/tnf/entry/firefox_51_on_sparc64_we)
A NetBSD developers tells the story of getting Firefox 51 running on their sparc64 machine
It turns out the bug impacted amd64 as well, so it was quickly fixed
They are a bit less hopeful about the future, since Firefox will soon require rust to compile, and rust is not working on sparc64 yet
Although there has been some activity on the rust on sparc64 front, so maybe there is hope
The post also look at a few alternative browsers, but it not hopeful
***
Introducing Bloaty McBloatface: a size profiler for binaries (http://blog.reverberate.org/2016/11/07/introducing-bloaty-mcbloatface.html)
I’m very excited to announce that today I’m open-sourcing a tool I’ve been working on for several months at Google. It’s called Bloaty McBloatface, and it lets you explore what’s taking up space in your .o, .a, .so, and executable binary files.
Bloaty is available under the Apache 2 license. All of the code is available on GitHub: github.com/google/bloaty. It is quick and easy to build, though it does require a somewhat recent compiler since it uses C++11 extensively. Bloaty primarily supports ELF files (Linux, BSD, etc) but there is some support for Mach-O files on OS X too. I’m interested in expanding Bloaty’s capabilities to more platforms if there is interest!
I need to try this one some of the boot code files, to see if there are places we can trim some fat
We’ve been using Bloaty a lot on the Protocol Buffers team at Google to evaluate the binary size impacts of our changes. If a change causes a size increase, where did it come from? What sections/symbols grew, and why? Bloaty has a diff mode for understanding changes in binary size
The diff mode looks especially interesting. It might be worth setting up some kind of CI testing that alerts if a change results in a significant size increase in a binary or library
***
A BSD licensed mdns responder (https://github.com/kristapsdz/mdnsd)
One of the things we just have to deal with in the modern world is service and system discovery. Many of us have fiddled with avahi or mdnsd and related “mdns” services.
For various reasons those often haven’t been the best-fit on BSD systems. 
Today we have a github project to point you at, which while a bit older, has recently been updated with pledge() support for OpenBSD. 
First of all, why do we need an alternative? They list their reasons:
This is an attempt to bring native mdns/dns-sd to OpenBSD. Mainly cause all the other options suck and proper network browsing is a nice feature these days.
Why not Apple's mdnsd ?
   1 - It sucks big time.
   2 - No BSD License (Apache-2).
   3 - Overcomplex API.
   4 - Not OpenBSD-like.
Why not Avahi ?
   1 - No BSD License (LGPL).
   2 - Overcomplex API.
   3 - Not OpenBSD-like
   4 - DBUS and lots of dependencies.
Those already sound like pretty compelling reasons. What makes this “new” information again is the pledge support, and perhaps it’s time for more BSD’s to start considering importing something like mdnsd into their base system to make system discovery more “automatic”
***
Beastie Bits
Benno Rice at Linux.Conf.Au: The Trouble with FreeBSD (https://www.youtube.com/watch?v=Ib7tFvw34DM) 
State of the Port of VMS to x86  (http://vmssoftware.com/pdfs/State_of_Port_20170105.pdf) 
Microsoft Azure now offers Patent Troll Protection (https://thestack.com/cloud/2017/02/08/microsoft-azure-now-offers-patent-troll-ip-protection/) 
FreeBSD Storage Summit 2017 (https://www.freebsdfoundation.org/news-and-events/event-calendar/freebsd-storage-summit-2017/)
If you are going to be in Tokyo, make sure you come to (http://bhyvecon.org/) 
Feedback/Questions
 Farhan - Laptops (http://pastebin.com/bVqsvM3r) 
 Hjalti - rclone (http://pastebin.com/7KWYX2Mg) 
 Ivan - Jails (http://pastebin.com/U5XyzMDR) 
 Jungle - Traffic Control (http://pastebin.com/sK7uEDpn) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we’ve got FreeBSD quarterly Status reports to discuss, OpenBSD changes to the installer, EC2 and IPv6 and more. Stay</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/openbsd-changes-of-note-6" rel="nofollow">OpenBSD changes of note 6</a></h3>

<ul>
<li>OpenBSD can now be cross built with clang. Work on this continues</li>
</ul>

<blockquote>
<p>Build ld.so with -fno-builtin because otherwise clang would optimize the local versions of functions like _dl_memset into a call to memset, which doesn’t exist.<br>
Add connection timeout for ftp (http). Mostly for the installer so it can error out and try something else.<br>
Complete https support for the installer.</p>
</blockquote>

<ul>
<li>I wonder how they handle certificate verification. I need to look into this as I’d like to switch the FreeBSD installer to this as well</li>
</ul>

<blockquote>
<p>New ocspcheck utility to validate a certificate against its ocsp responder.<br>
net lock here, net lock there, net lock not quite everywhere but more than before.<br>
More per cpu counters in networking code as well.<br>
Disable and lock Silicon Debug feature on modern Intel CPUs. <br>
Prevent wireless frame injection attack described at 33C3 in the talk titled “Predicting and Abusing WPA2/802.11 Group Keys” by Mathy Vanhoef.<br>
Add support for multiple transmit ifqueues per network interface. Supported drivers include bge, bnx, em, myx, ix, hvn, xnf. <br>
pledge now tracks when a file as opened and uses this to permit or deny ioctl. <br>
Reimplement httpd’s support for byte ranges. Fixes a memory DOS. </p>

<hr>
</blockquote>

<h3><a href="https://www.freebsd.org/news/status/report-2016-10-2016-12.html" rel="nofollow">FreeBSD 2016Q4 Status Report</a></h3>

<ul>
<li>An overview of some of the work that happened in October - December 2016</li>
<li>The ports tree saw many updates and surpassed 27,000 ports</li>
<li>The core team was busy as usual, and the foundation attended and/or sponsored a record 24 events in 2016.</li>
<li>CEPH on FreeBSD seems to be coming along nicely. For those that do not know, CEPH is a distributed filesystem that can sit on top of another filesystem. That is, you can use it to create a clustered filesystem out of a bunch of ZFS servers. Would love to have some viewers give it a try and report back.</li>
<li>OpenBSM, the FreeBSD audit framework, got some updates</li>
<li>Ed Schouten committed a front end to export sysctl data in a format usable by Prometheus, the open source monitoring system. This is useful for other monitoring software too.</li>
<li>Lots of updates for various ARM boards</li>
<li>There is an update on Reproducible Builds in FreeBSD, “ It is now possible to build the FreeBSD base system (kernel and userland) completely reproducibly, although it currently requires a few non-default settings”, and the ports tree is at 80% reproducible</li>
<li>Lots of toolchain updates (gcc, lld, gdb)</li>
<li>Various updates from major ports teams
***</li>
</ul>

<h3><a href="http://www.daemonology.net/blog/2017-01-26-IPv6-on-FreeBSD-EC2.html" rel="nofollow">Amazon rolls out IPv6 support on EC2</a></h3>

<blockquote>
<p>A few hours ago Amazon announced that they had rolled out IPv6 support in EC2 to 15 regions — everywhere except the Beijing region, apparently. This seems as good a time as any to write about using IPv6 in EC2 on FreeBSD instances.<br>
First, the good news: Future FreeBSD releases will support IPv6 &quot;out of the box&quot; on EC2. I committed changes to HEAD last week, and merged them to the stable/11 branch moments ago, to have FreeBSD automatically use whatever IPv6 addresses EC2 makes available to it.<br>
Next, the annoying news: To get IPv6 support in EC2 from existing FreeBSD releases (10.3, 11.0) you&#39;ll need to run a few simple commands. I consider this unfortunate but inevitable: While Amazon has been unusually helpful recently, there&#39;s nothing they could have done to get support for their IPv6 networking configuration into FreeBSD a year before they launched it.</p>
</blockquote>

<ul>
<li>You need the dual-dhclient port:</li>
</ul>

<blockquote>
<p>pkg install dual-dhclient</p>
</blockquote>

<ul>
<li>And the following lines in your /etc/rc.conf:</li>
</ul>

<blockquote>
<p>ifconfig_DEFAULT=&quot;SYNCDHCP accept_rtadv&quot;<br>
   ipv6_activate_all_interfaces=&quot;YES&quot;<br>
   dhclient_program=&quot;/usr/local/sbin/dual-dhclient&quot;</p>

<ul>
<li>It is good to see FreeBSD being ready to use this feature on day 0, not something we would have had in the past</li>
</ul>

<p>Finally, one important caveat: While EC2 is clearly the most important place to have IPv6 support, and one which many of us have been waiting a long time to get, this is not the only service where IPv6 support is important. Of particular concern to me, Application Load Balancer support for IPv6 is still missing in many regions, and Elastic Load Balancers in VPC don&#39;t support IPv6 at all — which matters to those of us who run non-HTTP services. Make sure that IPv6 support has been rolled out for all the services you need before you start migrating.</p>
</blockquote>

<ul>
<li>Colin’s blog also has the details on how to actually activate IPv6 from the Amazon side, if only it was as easy as configuring it on the FreeBSD side
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=cofKxtIO3Is" rel="nofollow">FreeBSD’s George Neville-Neil tries valiantly for over an hour to convince a Linux fan of the error of their ways </a></h3>

<blockquote>
<p>In today&#39;s episode of the Lunduke Hour I talk to George Neville-Neil -- author and FreeBSD advocate. He tries to convince me, a Linux user, that FreeBSD is better.</p>

<ul>
<li>They cover quite a few topics, including:

<ul>
<li>licensing, and the motivations behind it</li>
<li>vendor relations</li>
<li>community</li>
<li>development model</li>
<li>drivers and hardware support</li>
</ul></li>
<li>George also talks about his work with the FreeBSD Foundation, and the book he co-authored, “The Design and Implementation of the FreeBSD Operating System, 2nd Edition”
***</li>
</ul>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://github.com/rosedovell/unixdesktops" rel="nofollow">An interactive script that makes it easy to install 50+ desktop environments following a base install of FreeBSD 11</a></h3>

<ul>
<li>And I thought I was doing good when I wrote a patch for the installer that enables your choice of 3 desktop environments...</li>
</ul>

<blockquote>
<p>This is a collection of scripts meant to install desktop environments on unix-like operating systems following a base install. I call one of these &#39;complete&#39; when it meets the following requirements:</p>

<ul>
<li>A graphical logon manager is presented without user intervention after powering on the machine</li>
<li>Logging into that graphical logon manager takes the user into the specified desktop environment</li>
<li>The user can open a terminal emulator</li>
</ul>
</blockquote>

<ul>
<li>I need to revive my patch, and add Lumina to it
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/firefox_51_on_sparc64_we" rel="nofollow">Firefox 51 on sparc64 - we did not hit the wall yet</a></h3>

<ul>
<li>A NetBSD developers tells the story of getting Firefox 51 running on their sparc64 machine</li>
<li>It turns out the bug impacted amd64 as well, so it was quickly fixed</li>
<li>They are a bit less hopeful about the future, since Firefox will soon require rust to compile, and rust is not working on sparc64 yet</li>
<li>Although there has been some activity on the rust on sparc64 front, so maybe there is hope</li>
<li>The post also look at a few alternative browsers, but it not hopeful
***</li>
</ul>

<h3><a href="http://blog.reverberate.org/2016/11/07/introducing-bloaty-mcbloatface.html" rel="nofollow">Introducing Bloaty McBloatface: a size profiler for binaries</a></h3>

<blockquote>
<p>I’m very excited to announce that today I’m open-sourcing a tool I’ve been working on for several months at Google. It’s called Bloaty McBloatface, and it lets you explore what’s taking up space in your .o, .a, .so, and executable binary files.</p>

<p>Bloaty is available under the Apache 2 license. All of the code is available on GitHub: github.com/google/bloaty. It is quick and easy to build, though it does require a somewhat recent compiler since it uses C++11 extensively. Bloaty primarily supports ELF files (Linux, BSD, etc) but there is some support for Mach-O files on OS X too. I’m interested in expanding Bloaty’s capabilities to more platforms if there is interest!</p>
</blockquote>

<ul>
<li>I need to try this one some of the boot code files, to see if there are places we can trim some fat</li>
</ul>

<blockquote>
<p>We’ve been using Bloaty a lot on the Protocol Buffers team at Google to evaluate the binary size impacts of our changes. If a change causes a size increase, where did it come from? What sections/symbols grew, and why? Bloaty has a diff mode for understanding changes in binary size</p>
</blockquote>

<ul>
<li>The diff mode looks especially interesting. It might be worth setting up some kind of CI testing that alerts if a change results in a significant size increase in a binary or library
***</li>
</ul>

<h3><a href="https://github.com/kristapsdz/mdnsd" rel="nofollow">A BSD licensed mdns responder</a></h3>

<ul>
<li>One of the things we just have to deal with in the modern world is service and system discovery. Many of us have fiddled with avahi or mdnsd and related “mdns” services.</li>
<li>For various reasons those often haven’t been the best-fit on BSD systems. </li>
<li>Today we have a github project to point you at, which while a bit older, has recently been updated with pledge() support for OpenBSD. </li>
<li>First of all, why do we need an alternative? They list their reasons:</li>
</ul>

<blockquote>
<p>This is an attempt to bring native mdns/dns-sd to OpenBSD. Mainly cause all the other options suck and proper network browsing is a nice feature these days.</p>

<p>Why not Apple&#39;s mdnsd ?<br>
   1 - It sucks big time.<br>
   2 - No BSD License (Apache-2).<br>
   3 - Overcomplex API.<br>
   4 - Not OpenBSD-like.</p>

<p>Why not Avahi ?<br>
   1 - No BSD License (LGPL).<br>
   2 - Overcomplex API.<br>
   3 - Not OpenBSD-like<br>
   4 - DBUS and lots of dependencies.</p>
</blockquote>

<ul>
<li>Those already sound like pretty compelling reasons. What makes this “new” information again is the pledge support, and perhaps it’s time for more BSD’s to start considering importing something like mdnsd into their base system to make system discovery more “automatic”
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.youtube.com/watch?v=Ib7tFvw34DM" rel="nofollow">Benno Rice at Linux.Conf.Au: The Trouble with FreeBSD</a> </p></li>
<li><p><a href="http://vmssoftware.com/pdfs/State_of_Port_20170105.pdf" rel="nofollow">State of the Port of VMS to x86 </a> </p></li>
<li><p><a href="https://thestack.com/cloud/2017/02/08/microsoft-azure-now-offers-patent-troll-ip-protection/" rel="nofollow">Microsoft Azure now offers Patent Troll Protection</a> </p></li>
<li><p><a href="https://www.freebsdfoundation.org/news-and-events/event-calendar/freebsd-storage-summit-2017/" rel="nofollow">FreeBSD Storage Summit 2017</a></p></li>
<li><p><a href="http://bhyvecon.org/" rel="nofollow">If you are going to be in Tokyo, make sure you come to</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/bVqsvM3r" rel="nofollow"> Farhan - Laptops</a> </li>
<li><a href="http://pastebin.com/7KWYX2Mg" rel="nofollow"> Hjalti - rclone</a> </li>
<li><a href="http://pastebin.com/U5XyzMDR" rel="nofollow"> Ivan - Jails</a> </li>
<li><a href="http://pastebin.com/sK7uEDpn" rel="nofollow"> Jungle - Traffic Control</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we’ve got FreeBSD quarterly Status reports to discuss, OpenBSD changes to the installer, EC2 and IPv6 and more. Stay</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/openbsd-changes-of-note-6" rel="nofollow">OpenBSD changes of note 6</a></h3>

<ul>
<li>OpenBSD can now be cross built with clang. Work on this continues</li>
</ul>

<blockquote>
<p>Build ld.so with -fno-builtin because otherwise clang would optimize the local versions of functions like _dl_memset into a call to memset, which doesn’t exist.<br>
Add connection timeout for ftp (http). Mostly for the installer so it can error out and try something else.<br>
Complete https support for the installer.</p>
</blockquote>

<ul>
<li>I wonder how they handle certificate verification. I need to look into this as I’d like to switch the FreeBSD installer to this as well</li>
</ul>

<blockquote>
<p>New ocspcheck utility to validate a certificate against its ocsp responder.<br>
net lock here, net lock there, net lock not quite everywhere but more than before.<br>
More per cpu counters in networking code as well.<br>
Disable and lock Silicon Debug feature on modern Intel CPUs. <br>
Prevent wireless frame injection attack described at 33C3 in the talk titled “Predicting and Abusing WPA2/802.11 Group Keys” by Mathy Vanhoef.<br>
Add support for multiple transmit ifqueues per network interface. Supported drivers include bge, bnx, em, myx, ix, hvn, xnf. <br>
pledge now tracks when a file as opened and uses this to permit or deny ioctl. <br>
Reimplement httpd’s support for byte ranges. Fixes a memory DOS. </p>

<hr>
</blockquote>

<h3><a href="https://www.freebsd.org/news/status/report-2016-10-2016-12.html" rel="nofollow">FreeBSD 2016Q4 Status Report</a></h3>

<ul>
<li>An overview of some of the work that happened in October - December 2016</li>
<li>The ports tree saw many updates and surpassed 27,000 ports</li>
<li>The core team was busy as usual, and the foundation attended and/or sponsored a record 24 events in 2016.</li>
<li>CEPH on FreeBSD seems to be coming along nicely. For those that do not know, CEPH is a distributed filesystem that can sit on top of another filesystem. That is, you can use it to create a clustered filesystem out of a bunch of ZFS servers. Would love to have some viewers give it a try and report back.</li>
<li>OpenBSM, the FreeBSD audit framework, got some updates</li>
<li>Ed Schouten committed a front end to export sysctl data in a format usable by Prometheus, the open source monitoring system. This is useful for other monitoring software too.</li>
<li>Lots of updates for various ARM boards</li>
<li>There is an update on Reproducible Builds in FreeBSD, “ It is now possible to build the FreeBSD base system (kernel and userland) completely reproducibly, although it currently requires a few non-default settings”, and the ports tree is at 80% reproducible</li>
<li>Lots of toolchain updates (gcc, lld, gdb)</li>
<li>Various updates from major ports teams
***</li>
</ul>

<h3><a href="http://www.daemonology.net/blog/2017-01-26-IPv6-on-FreeBSD-EC2.html" rel="nofollow">Amazon rolls out IPv6 support on EC2</a></h3>

<blockquote>
<p>A few hours ago Amazon announced that they had rolled out IPv6 support in EC2 to 15 regions — everywhere except the Beijing region, apparently. This seems as good a time as any to write about using IPv6 in EC2 on FreeBSD instances.<br>
First, the good news: Future FreeBSD releases will support IPv6 &quot;out of the box&quot; on EC2. I committed changes to HEAD last week, and merged them to the stable/11 branch moments ago, to have FreeBSD automatically use whatever IPv6 addresses EC2 makes available to it.<br>
Next, the annoying news: To get IPv6 support in EC2 from existing FreeBSD releases (10.3, 11.0) you&#39;ll need to run a few simple commands. I consider this unfortunate but inevitable: While Amazon has been unusually helpful recently, there&#39;s nothing they could have done to get support for their IPv6 networking configuration into FreeBSD a year before they launched it.</p>
</blockquote>

<ul>
<li>You need the dual-dhclient port:</li>
</ul>

<blockquote>
<p>pkg install dual-dhclient</p>
</blockquote>

<ul>
<li>And the following lines in your /etc/rc.conf:</li>
</ul>

<blockquote>
<p>ifconfig_DEFAULT=&quot;SYNCDHCP accept_rtadv&quot;<br>
   ipv6_activate_all_interfaces=&quot;YES&quot;<br>
   dhclient_program=&quot;/usr/local/sbin/dual-dhclient&quot;</p>

<ul>
<li>It is good to see FreeBSD being ready to use this feature on day 0, not something we would have had in the past</li>
</ul>

<p>Finally, one important caveat: While EC2 is clearly the most important place to have IPv6 support, and one which many of us have been waiting a long time to get, this is not the only service where IPv6 support is important. Of particular concern to me, Application Load Balancer support for IPv6 is still missing in many regions, and Elastic Load Balancers in VPC don&#39;t support IPv6 at all — which matters to those of us who run non-HTTP services. Make sure that IPv6 support has been rolled out for all the services you need before you start migrating.</p>
</blockquote>

<ul>
<li>Colin’s blog also has the details on how to actually activate IPv6 from the Amazon side, if only it was as easy as configuring it on the FreeBSD side
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=cofKxtIO3Is" rel="nofollow">FreeBSD’s George Neville-Neil tries valiantly for over an hour to convince a Linux fan of the error of their ways </a></h3>

<blockquote>
<p>In today&#39;s episode of the Lunduke Hour I talk to George Neville-Neil -- author and FreeBSD advocate. He tries to convince me, a Linux user, that FreeBSD is better.</p>

<ul>
<li>They cover quite a few topics, including:

<ul>
<li>licensing, and the motivations behind it</li>
<li>vendor relations</li>
<li>community</li>
<li>development model</li>
<li>drivers and hardware support</li>
</ul></li>
<li>George also talks about his work with the FreeBSD Foundation, and the book he co-authored, “The Design and Implementation of the FreeBSD Operating System, 2nd Edition”
***</li>
</ul>
</blockquote>

<h2>News Roundup</h2>

<h3><a href="https://github.com/rosedovell/unixdesktops" rel="nofollow">An interactive script that makes it easy to install 50+ desktop environments following a base install of FreeBSD 11</a></h3>

<ul>
<li>And I thought I was doing good when I wrote a patch for the installer that enables your choice of 3 desktop environments...</li>
</ul>

<blockquote>
<p>This is a collection of scripts meant to install desktop environments on unix-like operating systems following a base install. I call one of these &#39;complete&#39; when it meets the following requirements:</p>

<ul>
<li>A graphical logon manager is presented without user intervention after powering on the machine</li>
<li>Logging into that graphical logon manager takes the user into the specified desktop environment</li>
<li>The user can open a terminal emulator</li>
</ul>
</blockquote>

<ul>
<li>I need to revive my patch, and add Lumina to it
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/firefox_51_on_sparc64_we" rel="nofollow">Firefox 51 on sparc64 - we did not hit the wall yet</a></h3>

<ul>
<li>A NetBSD developers tells the story of getting Firefox 51 running on their sparc64 machine</li>
<li>It turns out the bug impacted amd64 as well, so it was quickly fixed</li>
<li>They are a bit less hopeful about the future, since Firefox will soon require rust to compile, and rust is not working on sparc64 yet</li>
<li>Although there has been some activity on the rust on sparc64 front, so maybe there is hope</li>
<li>The post also look at a few alternative browsers, but it not hopeful
***</li>
</ul>

<h3><a href="http://blog.reverberate.org/2016/11/07/introducing-bloaty-mcbloatface.html" rel="nofollow">Introducing Bloaty McBloatface: a size profiler for binaries</a></h3>

<blockquote>
<p>I’m very excited to announce that today I’m open-sourcing a tool I’ve been working on for several months at Google. It’s called Bloaty McBloatface, and it lets you explore what’s taking up space in your .o, .a, .so, and executable binary files.</p>

<p>Bloaty is available under the Apache 2 license. All of the code is available on GitHub: github.com/google/bloaty. It is quick and easy to build, though it does require a somewhat recent compiler since it uses C++11 extensively. Bloaty primarily supports ELF files (Linux, BSD, etc) but there is some support for Mach-O files on OS X too. I’m interested in expanding Bloaty’s capabilities to more platforms if there is interest!</p>
</blockquote>

<ul>
<li>I need to try this one some of the boot code files, to see if there are places we can trim some fat</li>
</ul>

<blockquote>
<p>We’ve been using Bloaty a lot on the Protocol Buffers team at Google to evaluate the binary size impacts of our changes. If a change causes a size increase, where did it come from? What sections/symbols grew, and why? Bloaty has a diff mode for understanding changes in binary size</p>
</blockquote>

<ul>
<li>The diff mode looks especially interesting. It might be worth setting up some kind of CI testing that alerts if a change results in a significant size increase in a binary or library
***</li>
</ul>

<h3><a href="https://github.com/kristapsdz/mdnsd" rel="nofollow">A BSD licensed mdns responder</a></h3>

<ul>
<li>One of the things we just have to deal with in the modern world is service and system discovery. Many of us have fiddled with avahi or mdnsd and related “mdns” services.</li>
<li>For various reasons those often haven’t been the best-fit on BSD systems. </li>
<li>Today we have a github project to point you at, which while a bit older, has recently been updated with pledge() support for OpenBSD. </li>
<li>First of all, why do we need an alternative? They list their reasons:</li>
</ul>

<blockquote>
<p>This is an attempt to bring native mdns/dns-sd to OpenBSD. Mainly cause all the other options suck and proper network browsing is a nice feature these days.</p>

<p>Why not Apple&#39;s mdnsd ?<br>
   1 - It sucks big time.<br>
   2 - No BSD License (Apache-2).<br>
   3 - Overcomplex API.<br>
   4 - Not OpenBSD-like.</p>

<p>Why not Avahi ?<br>
   1 - No BSD License (LGPL).<br>
   2 - Overcomplex API.<br>
   3 - Not OpenBSD-like<br>
   4 - DBUS and lots of dependencies.</p>
</blockquote>

<ul>
<li>Those already sound like pretty compelling reasons. What makes this “new” information again is the pledge support, and perhaps it’s time for more BSD’s to start considering importing something like mdnsd into their base system to make system discovery more “automatic”
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.youtube.com/watch?v=Ib7tFvw34DM" rel="nofollow">Benno Rice at Linux.Conf.Au: The Trouble with FreeBSD</a> </p></li>
<li><p><a href="http://vmssoftware.com/pdfs/State_of_Port_20170105.pdf" rel="nofollow">State of the Port of VMS to x86 </a> </p></li>
<li><p><a href="https://thestack.com/cloud/2017/02/08/microsoft-azure-now-offers-patent-troll-ip-protection/" rel="nofollow">Microsoft Azure now offers Patent Troll Protection</a> </p></li>
<li><p><a href="https://www.freebsdfoundation.org/news-and-events/event-calendar/freebsd-storage-summit-2017/" rel="nofollow">FreeBSD Storage Summit 2017</a></p></li>
<li><p><a href="http://bhyvecon.org/" rel="nofollow">If you are going to be in Tokyo, make sure you come to</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/bVqsvM3r" rel="nofollow"> Farhan - Laptops</a> </li>
<li><a href="http://pastebin.com/7KWYX2Mg" rel="nofollow"> Hjalti - rclone</a> </li>
<li><a href="http://pastebin.com/U5XyzMDR" rel="nofollow"> Ivan - Jails</a> </li>
<li><a href="http://pastebin.com/sK7uEDpn" rel="nofollow"> Jungle - Traffic Control</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>181: The Cantrillogy (Not special edition)</title>
  <link>https://www.bsdnow.tv/181</link>
  <guid isPermaLink="false">6e425191-eb90-4cea-9104-7b4880f0c224</guid>
  <pubDate>Wed, 15 Feb 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6e425191-eb90-4cea-9104-7b4880f0c224.mp3" length="127909972" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow we have a cantrill special to bring you! All three interviews back to back in their original glory, you won’t want to miss</itunes:subtitle>
  <itunes:duration>4:26:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow we have a cantrill special to bring you! All three interviews back to back in their original glory, you won’t want to miss
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
&lt;h3&gt;– Show Notes: –&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;a href="https://fosdem.org/2017/schedule/track/bsd/"&gt;FOSDEM 2017 BSD Dev Room Videos &lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.jupiterbroadcasting.com/86662/ubuntu-slaughters-kittens-bsd-now-103/"&gt;Ubuntu Slaughters Kittens | BSD Now 103&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.jupiterbroadcasting.com/90811/the-cantrill-strikes-back-bsd-now-117/"&gt;The Cantrill Strikes Back | BSD Now 117&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.jupiterbroadcasting.com/103871/return-of-the-cantrill-bsd-now-163/"&gt;Return of the Cantrill | BSD Now 163&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt; 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow we have a cantrill special to bring you! All three interviews back to back in their original glory, you won’t want to miss</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<p><h3>– Show Notes: –</h3><ul><li><a href="https://fosdem.org/2017/schedule/track/bsd/">FOSDEM 2017 BSD Dev Room Videos </a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/86662/ubuntu-slaughters-kittens-bsd-now-103/">Ubuntu Slaughters Kittens | BSD Now 103</a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/90811/the-cantrill-strikes-back-bsd-now-117/">The Cantrill Strikes Back | BSD Now 117</a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/103871/return-of-the-cantrill-bsd-now-163/">Return of the Cantrill | BSD Now 163</a></li></ul></p>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow we have a cantrill special to bring you! All three interviews back to back in their original glory, you won’t want to miss</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<p><h3>– Show Notes: –</h3><ul><li><a href="https://fosdem.org/2017/schedule/track/bsd/">FOSDEM 2017 BSD Dev Room Videos </a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/86662/ubuntu-slaughters-kittens-bsd-now-103/">Ubuntu Slaughters Kittens | BSD Now 103</a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/90811/the-cantrill-strikes-back-bsd-now-117/">The Cantrill Strikes Back | BSD Now 117</a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/103871/return-of-the-cantrill-bsd-now-163/">Return of the Cantrill | BSD Now 163</a></li></ul></p>]]>
  </itunes:summary>
</item>
<item>
  <title>180: Illuminating the desktop</title>
  <link>https://www.bsdnow.tv/180</link>
  <guid isPermaLink="false">4ff28335-e7a4-434c-a0c3-3e17c4eaa5e8</guid>
  <pubDate>Wed, 08 Feb 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4ff28335-e7a4-434c-a0c3-3e17c4eaa5e8.mp3" length="37065748" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, I’m out of town but we have a great interview with Ken Moore (My brother) about the latest in BSD desktop computing and</itunes:subtitle>
  <itunes:duration>51:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, I’m out of town but we have a great interview with Ken Moore (My brother) about the latest in BSD desktop computing and
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Interview - Ken Moore - ken@trueos.org (mailto:ken@trueos.org)
TrueOS, Lumina, Sys Admin, The BSD Desktop Ecosystem
+ KM: Thank you for joining us again, can you believe it has been an entire year?
+ AJ: Let’s start by getting an update on Lumina, what has happened in the last year?
+ KM: What is the change you are most proud of in that time?
+ AJ: What do you think of the recent introduction of Wayland to the ports tree? Do you think this will impact Lumina? Do you have any plans?
+ KM: 
+ AJ: What has changed with SysAdm after a year of development?
+ KM: What plans do you have for the future of SysAdm?
+ AJ: How has it been working with the drm-next branch? Does it feel like that is progressing?
+ KM: Can you tell us about some of the other TrueOS work you have been doing?
+ AJ: What are your thoughts on how the BSD Desktop Ecosystem has changed over the last year? Do you think the future looks better or worse now?
+ KM: Do you think systemd is going to continue to make things work? Or does it seem like there is enough resistance to it that fewer projects are going to throw out support for anything not-systemd
+ AJ: Anything else you want to add?
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, I’m out of town but we have a great interview with Ken Moore (My brother) about the latest in BSD desktop computing and</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Ken Moore - <a href="mailto:ken@trueos.org" rel="nofollow">ken@trueos.org</a></h2>

<p>TrueOS, Lumina, Sys Admin, The BSD Desktop Ecosystem</p>

<ul>
<li>KM: Thank you for joining us again, can you believe it has been an entire year?</li>
<li>AJ: Let’s start by getting an update on Lumina, what has happened in the last year?</li>
<li>KM: What is the change you are most proud of in that time?</li>
<li>AJ: What do you think of the recent introduction of Wayland to the ports tree? Do you think this will impact Lumina? Do you have any plans?</li>
<li>KM: <followup></li>
<li>AJ: What has changed with SysAdm after a year of development?</li>
<li>KM: What plans do you have for the future of SysAdm?</li>
<li>AJ: How has it been working with the drm-next branch? Does it feel like that is progressing?</li>
<li>KM: Can you tell us about some of the other TrueOS work you have been doing?</li>
<li>AJ: What are your thoughts on how the BSD Desktop Ecosystem has changed over the last year? Do you think the future looks better or worse now?</li>
<li>KM: Do you think systemd is going to continue to make things work? Or does it seem like there is enough resistance to it that fewer projects are going to throw out support for anything not-systemd</li>
<li>AJ: Anything else you want to add?
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, I’m out of town but we have a great interview with Ken Moore (My brother) about the latest in BSD desktop computing and</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Ken Moore - <a href="mailto:ken@trueos.org" rel="nofollow">ken@trueos.org</a></h2>

<p>TrueOS, Lumina, Sys Admin, The BSD Desktop Ecosystem</p>

<ul>
<li>KM: Thank you for joining us again, can you believe it has been an entire year?</li>
<li>AJ: Let’s start by getting an update on Lumina, what has happened in the last year?</li>
<li>KM: What is the change you are most proud of in that time?</li>
<li>AJ: What do you think of the recent introduction of Wayland to the ports tree? Do you think this will impact Lumina? Do you have any plans?</li>
<li>KM: <followup></li>
<li>AJ: What has changed with SysAdm after a year of development?</li>
<li>KM: What plans do you have for the future of SysAdm?</li>
<li>AJ: How has it been working with the drm-next branch? Does it feel like that is progressing?</li>
<li>KM: Can you tell us about some of the other TrueOS work you have been doing?</li>
<li>AJ: What are your thoughts on how the BSD Desktop Ecosystem has changed over the last year? Do you think the future looks better or worse now?</li>
<li>KM: Do you think systemd is going to continue to make things work? Or does it seem like there is enough resistance to it that fewer projects are going to throw out support for anything not-systemd</li>
<li>AJ: Anything else you want to add?
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>179: The Wayland Machine</title>
  <link>https://www.bsdnow.tv/179</link>
  <guid isPermaLink="false">06b91bc7-f848-44c2-a5f9-1d1d40f61714</guid>
  <pubDate>Wed, 01 Feb 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/06b91bc7-f848-44c2-a5f9-1d1d40f61714.mp3" length="40976212" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we’re going to be leading off with the latest news about Wayland and Xorg support on FreeBSD, then a look at OpenBSD ARM64</itunes:subtitle>
  <itunes:duration>56:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we’re going to be leading off with the latest news about Wayland and Xorg support on FreeBSD, then a look at OpenBSD ARM64
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Wayland is now in the FreeBSD Ports tree (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=432406)
This commit brings Wayland, the new windowing system, into the FreeBSD ports tree
“This port was first created by Koop Mast (kwm@) then updated and improved by Johannes Lundberg”
“Wayland is intended as a simpler replacement for X, easier to develop and maintain. GNOME and KDE are expected to be ported to it.”
Wayland is designed for desktop and laptop use, rather than X, which was designed for use over the network, where clients were not powerful enough to run the applications locally.
“Wayland is a protocol for a compositor to talk to its clients as well as a C library implementation of that protocol. The compositor can be a standalone display server running on Linux kernel modesetting and evdev input devices, an X application, or a wayland client itself. The clients can be traditional applications, X servers (rootless or fullscreen) or other display servers.”
“Please report bugs to the FreeBSD bugtracker!”
It is good to see this project progressing, as it seems in a few generations, high performance graphics drivers may only be actively developed for Wayland.
***
Call For Testing: xorg 1.18.4 and newer intel/ati DDX  (https://lists.freebsd.org/pipermail/freebsd-x11/2017-January/018738.html)
Baptiste Daroussin, and the FreeBSD X11 team, have issued a call for testing for the upgrade to Xorg 1.18.4
Along with it comes newer ATI/AMD and Intel drivers
“Note that you will need to rebuild all the xf86-* packages to work with thatnewer xorg (hence the bump of the revision)”
“Do not expect newer gpu supported as this is not the kernel part”, it only provides the newer Xorg driver, not the kernel mode setting driver (this is a separate project)
“If you experience any issue with intel or radeon driver please try to use the new modesetting driver provided by xorg directly (note that fedora and debian recommend the use of the new driver instead of the ati/intel one)”
***
Error handling in C  (http://www.tedunangst.com/flak/post/to-errno-or-to-error)
“Unlike other languages which have one preferred means of signalling an error, C is a multi error paradigm language. Error handling styles in C can be organized into one of several distinct styles, such as popular or correct. Some examples of each.”
“One very popular option is the classic unix style. -1 is returned to indicate an error.”
“Another option seen in the standard C library is NULL for errors.”
“The latter has the advantage that NULL is a false value, which makes it easier to write logical conditions. File descriptor 0 is valid (stdin) but false, while -1 is invalid but true.”
“And of course, there’s the worst of both worlds approach requiring a special sentinel that you’ll probably forget to use”
“Other unix functions, those that don’t need to return a file descriptor, stick to just 0 and -1”
“Of course, none of these functions reveal anything about the nature of the error. For that, you need to consult the errno on the side”
The article goes on to describe different ways of dealing with the issue, and return values.
There is also coverage of more complex examples and involve a context that might contain the error message
It is really interesting to see the differences, and the pitfalls of each approach
***
Fixing POSIX Filenames (http://www.dwheeler.com/essays/fixing-unix-linux-filenames.html)
“Traditionally, Unix/Linux/POSIX pathnames and filenames can be almost any sequence of bytes. A pathname lets you select a particular file, and may 
include zero or more “/” characters. Each pathname component (separated by “/”) is a filename; filenames cannot contain “/”. Neither 
filenames nor pathnames can contain the ASCII NUL character (\0), because that is the terminator.”
“This lack of limitations is flexible, but it also creates a legion of unnecessary problems. In particular, this lack of limitations makes it 
unnecessarily difficult to write correct programs (enabling many security flaws). It also makes it impossible to consistently and accurately display filenames, 
causes portability problems, and confuses users.”
“This article will try to convince you that adding some tiny limitations on legal Unix/Linux/POSIX filenames would be an improvement. Many programs 
already presume these limitations, the POSIX standard already permits such limitations, and many Unix/Linux filesystems already embed such limitations — so 
it’d be better to make these (reasonable) assumptions true in the first place. This article will discuss, in particular, the three biggest problems: control 
characters in filenames (including newline, tab, and escape), leading dashes in filenames, and the lack of a standard character encoding scheme (instead of 
using UTF-8). These three problems impact programs written in any language on Unix/Linux/POSIX system. There are other problems, of course. Spaces in filenames 
can cause problems; it’s probably hopeless to ban them outright, but resolving some of the other issues will simplify handling spaces in filenames. For 
example, when using a Bourne shell, you can use an IFS trick (using IFS=printf '\n\t') to eliminate some problems with spaces. Similarly, special 
metacharacters in filenames cause some problems; I suspect few if any metacharacters could be forbidden on all POSIX systems, but it’d be great if 
administrators could locally configure systems so that they could prevent or escape such filenames when they want to. I then discuss some other tricks that can 
help.”
“After limiting filenames slightly, creating completely-correct programs is much easier, and some vulnerabilities in existing programs disappear. This 
article then notes some others’ opinions; I knew that some people wouldn’t agree with me, but I’m heartened that many do agree that something should 
be done. Finally, I briefly discuss some methods for solving this long-term; these include forbidding creation of such names (hiding them if they already exist 
on the underlying filesystem), implementing escaping mechanisms, or changing how tools work so that these are no longer problems (e.g., when globbing/scanning, 
have the libraries prefix “./” to any filename beginning with “-”). Solving this is not easy, and I suspect that several solutions will be 
needed. In fact, this paper became long over time because I kept finding new problems that needed explaining (new “worms under the rocks”). If I’ve 
convinced you that this needs improving, I’d like your help in figuring out how to best do it!”
“Filename problems affect programs written in any programming language. However, they can be especially tricky to deal with when using Bourne shells 
(including bash and dash). If you just want to write shell programs that can handle filenames correctly, you should see the short companion article Filenames 
and Pathnames in Shell: How to do it correctly (http://www.dwheeler.com/essays/filenames-in-shell.html).”
 Imagine that you don’t know Unix/Linux/POSIX (I presume you really do), and that you’re trying to do some simple tasks. For our purposes we will 
create simple scripts on the command line (using a Bourne shell) for these tasks, though many of the underlying problems affect any program. For example, 
let’s try to print out the contents of all files in the current directory, putting the contents into a file in the parent directory:
cat * &amp;gt; ../collection  # WRONG
cat ./* &amp;gt; ../collection  # CORRECT
cat find . -type f &amp;gt; ../collection  # WRONG
( set -f ; for file in find . -type f ; do  # WRONG
cat "$file"
done ) &amp;gt; ../collection
( find . -type f | xargs cat ) &amp;gt; ../collection # WRONG, WAY WRONG
Just think about trying to remove a file named: -rf /
***
News Roundup
OpenBSD ARM64 (https://www.openbsd.org/arm64.html)
A new page has appeared on the OpenBSD website, offering images for ARM64
“The current target platforms are the Pine64 and the Raspberry Pi 3.”
“OpenBSD/arm64 bundles various platforms sharing the 64-bit ARM architecture. Due to the fact that there are many System on a Chips (SoC) around, OpenBSD/arm64 differentiates between various SoCs and may have a different level of support between them”
The page contains a list of the devices that are supported, and which components have working drivers
At the time of recording, the link to download the snapshots did not work yet, but by time this airs a week from now, it should be working.
***
The design of Chacha20 (http://loup-vaillant.fr/tutorials/chacha20-design)
Seems like every few episodes we end up discussing Ciphers (With their o-so amusing naming) and today is no exception.
We have a great writeup on the D &amp;amp; I of the ‘chacha20’ cipher written by “Loup Vaillant”
First of all, is this story for you? Maybe the summary will help make that call:
“Quick summary: Chacha20 is ARX-based hash function, keyed, running in counter mode. It embodies the idea that one can use a hash function to encrypt data.”
If your eyes didn’t glaze over, then you are cleared to proceed. 
Chacha20 is built around stream ciphers:
While Chacha20 is mainly used for encryption, its core is a pseudo-random number generator. The cipher text is obtained by XOR'ing the plain text with a pseudo-random stream:
ciphertext = plaintext XOR chacha_stream(key, nonce)
Provided you never use the same nonce with the same key twice, you can treat that stream as a one time pad. This makes it very simple: unlike block ciphers, you don't have to worry about padding, and decryption is the same operation as encryption:
plaintext = ciphertext XOR chacha_stream(key, nonce)
Now we just have to get that stream.
The idea that the streams can mimic the concept of a one-time pad does make chacha20 very attractive, even to a non-crypto guy such as myself.
From here the article goes into depth on how the cipher scrambles 512bit blocks using the quarter-round method (A forth of a block or 4 32bit numbers)
Some ascii art is used here to help visualize how this done, in the quarter round-phase, then to the complete block as the 4 quarters are run in parallel over the entire 512 bit block.
From here the article goes more into depth, looking at the complete chacha block, and the importance of a seemingly unnecessary 32byte constant (Hint: it’s really important)
If crypto is something you find fascinating, you’ll want to make sure you give this one a full read-through.
***
CyberChef - Coming to a FreeBSD Ports tree near you (https://twitter.com/DLangille/status/823915729430913025)
Dan Langille tweets that he will be creating a port of GCHQ’s CyberChef tool
“CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include creating hexdumps, simple encoding like XOR or Base64, more complex encryption like AES, DES and Blowfish, data compression and decompression, calculating hashes and checksums, IPv6 and X.509 parsing, and much more.”
“The tool is designed to enable both technical and non-technical analysts to manipulate data in complex ways without having to deal with complex tools or algorithms. It was conceived, designed, built and incrementally improved by an analyst in their 10% innovation time over several years. Every effort has been made to structure the code in a readable and extendable format, however it should be noted that the analyst is not a professional developer and the code has not been peer-reviewed for compliance with a formal specification.”
Some handy functions, beyond stuff like base64 encoding:
Network Enumeration (CIDR to list of IPS)  (https://gchq.github.io/CyberChef/?recipe=%5B%7B%22op%22%3A%22Parse%20IP%20range%22%2C%22args%22%3A%5Btrue%2Ctrue%2Cfalse%5D%7D%5D&amp;amp;input=MTcyLjIxLjAuMzIvMjcK)
Browser User Agent Parser (what browser is that, based on your HTTP logs)
XOR Brute Force: enter some XOR’d text, and try every possible key to find plaintext. Optionally give it a regex of known plaintext to find the right key.
Calculate the “Shannon Entropy” of the input (how random is this data)
It also has a number of built in regular expressions for common things, very useful
The project is up on github if you want to play with the code
***
Building Electron and VSCode in FreeBSD11 (https://gist.github.com/prash-wghats/89be1ee069d2acf23c289e9c606616e1)
A patch and set of instructions for building Electron and VSCode on FreeBSD
“Visual Studio Code is a source code editor developed by Microsoft for Windows, Linux and macOS. It includes support for debugging, embedded Git control, syntax highlighting, intelligent code completion, snippets, and code refactoring. It is also customizable, so users can change the editor's theme, keyboard shortcuts, and preferences. It is free and open-source, although the official download is under a proprietary license.”
“Visual Studio Code is based on Electron, a framework which is used to deploy Node.js applications for the desktop running on the Blink layout engine. Although it uses the Electron framework, the software is not a fork of Atom, it is actually based on Visual Studio Online's editor (codename "Monaco")”
It would be interesting to see official support for VSCode on FreeBSD
Has anyone tried VSCode on the FreeBSD Code base?
***
Beastie Bits
Soft Label Keys (http://roy.marples.name/blog/blog/soft-label-keys) 
WPA1 (TKIP) disabled by default (OpenBSD) (https://www.mail-archive.com/source-changes@openbsd.org/msg84599.html)
Cool but obscure unix tools (https://kkovacs.eu/cool-but-obscure-unix-tools) 
KDE Frameworks and Plasma on FreeBSD (http://euroquis.nl/bobulate/?p=1521)
Initiative to migrate OpenBSD mirrors to HTTPS (https://www.mail-archive.com/source-changes@openbsd.org/msg84904.html)
That moment you realize FreeBSD has got some Star Wars fans (http://i.imgur.com/dC7c1y4.png)
Pagelink (https://wiki.freebsd.org/PortsSubversionPrimer)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we’re going to be leading off with the latest news about Wayland and Xorg support on FreeBSD, then a look at OpenBSD ARM64</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=432406" rel="nofollow">Wayland is now in the FreeBSD Ports tree</a></h3>

<ul>
<li>This commit brings Wayland, the new windowing system, into the FreeBSD ports tree</li>
<li>“This port was first created by Koop Mast (kwm@) then updated and improved by Johannes Lundberg”</li>
<li>“Wayland is intended as a simpler replacement for X, easier to develop and maintain. GNOME and KDE are expected to be ported to it.”</li>
<li>Wayland is designed for desktop and laptop use, rather than X, which was designed for use over the network, where clients were not powerful enough to run the applications locally.</li>
<li>“Wayland is a protocol for a compositor to talk to its clients as well as a C library implementation of that protocol. The compositor can be a standalone display server running on Linux kernel modesetting and evdev input devices, an X application, or a wayland client itself. The clients can be traditional applications, X servers (rootless or fullscreen) or other display servers.”</li>
<li>“Please report bugs to the FreeBSD bugtracker!”</li>
<li>It is good to see this project progressing, as it seems in a few generations, high performance graphics drivers may only be actively developed for Wayland.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-x11/2017-January/018738.html" rel="nofollow">Call For Testing: xorg 1.18.4 and newer intel/ati DDX </a></h3>

<ul>
<li>Baptiste Daroussin, and the FreeBSD X11 team, have issued a call for testing for the upgrade to Xorg 1.18.4</li>
<li>Along with it comes newer ATI/AMD and Intel drivers</li>
<li>“Note that you will need to rebuild all the xf86-* packages to work with thatnewer xorg (hence the bump of the revision)”</li>
<li>“Do not expect newer gpu supported as this is not the kernel part”, it only provides the newer Xorg driver, not the kernel mode setting driver (this is a separate project)</li>
<li>“If you experience any issue with intel or radeon driver please try to use the new modesetting driver provided by xorg directly (note that fedora and debian recommend the use of the new driver instead of the ati/intel one)”
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/to-errno-or-to-error" rel="nofollow">Error handling in C </a></h3>

<ul>
<li>“Unlike other languages which have one preferred means of signalling an error, C is a multi error paradigm language. Error handling styles in C can be organized into one of several distinct styles, such as popular or correct. Some examples of each.”

<ul>
<li>“One very popular option is the classic unix style. -1 is returned to indicate an error.”</li>
<li>“Another option seen in the standard C library is NULL for errors.”</li>
<li>“The latter has the advantage that NULL is a false value, which makes it easier to write logical conditions. File descriptor 0 is valid (stdin) but false, while -1 is invalid but true.”</li>
<li>“And of course, there’s the worst of both worlds approach requiring a special sentinel that you’ll probably forget to use”</li>
<li>“Other unix functions, those that don’t need to return a file descriptor, stick to just 0 and -1”</li>
<li>“Of course, none of these functions reveal anything about the nature of the error. For that, you need to consult the errno on the side”</li>
</ul></li>
<li>The article goes on to describe different ways of dealing with the issue, and return values.</li>
<li>There is also coverage of more complex examples and involve a context that might contain the error message</li>
<li>It is really interesting to see the differences, and the pitfalls of each approach
***</li>
</ul>

<h3><a href="http://www.dwheeler.com/essays/fixing-unix-linux-filenames.html" rel="nofollow">Fixing POSIX Filenames</a></h3>

<ul>
<li>“Traditionally, Unix/Linux/POSIX pathnames and filenames can be almost any sequence of bytes. A pathname lets you select a particular file, and may 
include zero or more “/” characters. Each pathname component (separated by “/”) is a filename; filenames cannot contain “/”. Neither 
filenames nor pathnames can contain the ASCII NUL character (\0), because that is the terminator.”</li>
<li>“This lack of limitations is flexible, but it also creates a legion of unnecessary problems. In particular, this lack of limitations makes it 
unnecessarily difficult to write correct programs (enabling many security flaws). It also makes it impossible to consistently and accurately display filenames, 
causes portability problems, and confuses users.”</li>
<li>“This article will try to convince you that adding some tiny limitations on legal Unix/Linux/POSIX filenames would be an improvement. Many programs 
already presume these limitations, the POSIX standard already permits such limitations, and many Unix/Linux filesystems already embed such limitations — so 
it’d be better to make these (reasonable) assumptions true in the first place. This article will discuss, in particular, the three biggest problems: control 
characters in filenames (including newline, tab, and escape), leading dashes in filenames, and the lack of a standard character encoding scheme (instead of 
using UTF-8). These three problems impact programs written in any language on Unix/Linux/POSIX system. There are other problems, of course. Spaces in filenames 
can cause problems; it’s probably hopeless to ban them outright, but resolving some of the other issues will simplify handling spaces in filenames. For 
example, when using a Bourne shell, you can use an IFS trick (using IFS=<code>printf &#39;\n\t&#39;</code>) to eliminate some problems with spaces. Similarly, special 
metacharacters in filenames cause some problems; I suspect few if any metacharacters could be forbidden on all POSIX systems, but it’d be great if 
administrators could locally configure systems so that they could prevent or escape such filenames when they want to. I then discuss some other tricks that can 
help.”</li>
<li>“After limiting filenames slightly, creating completely-correct programs is much easier, and some vulnerabilities in existing programs disappear. This 
article then notes some others’ opinions; I knew that some people wouldn’t agree with me, but I’m heartened that many do agree that something should 
be done. Finally, I briefly discuss some methods for solving this long-term; these include forbidding creation of such names (hiding them if they already exist 
on the underlying filesystem), implementing escaping mechanisms, or changing how tools work so that these are no longer problems (e.g., when globbing/scanning, 
have the libraries prefix “./” to any filename beginning with “-”). Solving this is not easy, and I suspect that several solutions will be 
needed. In fact, this paper became long over time because I kept finding new problems that needed explaining (new “worms under the rocks”). If I’ve 
convinced you that this needs improving, I’d like your help in figuring out how to best do it!”</li>
<li>“Filename problems affect programs written in any programming language. However, they can be especially tricky to deal with when using Bourne shells 
(including bash and dash). If you just want to write shell programs that can handle filenames correctly, you should see the short companion article <a href="http://www.dwheeler.com/essays/filenames-in-shell.html" rel="nofollow">Filenames 
and Pathnames in Shell: How to do it correctly</a>.”</li>
<li> Imagine that you don’t know Unix/Linux/POSIX (I presume you really do), and that you’re trying to do some simple tasks. For our purposes we will 
create simple scripts on the command line (using a Bourne shell) for these tasks, though many of the underlying problems affect any program. For example, 
let’s try to print out the contents of all files in the current directory, putting the contents into a file in the parent directory:

<ul>
<li>cat * &gt; ../collection  # WRONG</li>
<li>cat ./* &gt; ../collection  # CORRECT</li>
<li>cat <code>find . -type f</code> &gt; ../collection  # WRONG</li>
<li>( set -f ; for file in <code>find . -type f</code> ; do  # WRONG
cat &quot;$file&quot;
done ) &gt; ../collection</li>
<li>( find . -type f | xargs cat ) &gt; ../collection # WRONG, WAY WRONG</li>
</ul></li>
<li>Just think about trying to remove a file named: -rf /
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.openbsd.org/arm64.html" rel="nofollow">OpenBSD ARM64</a></h3>

<ul>
<li>A new page has appeared on the OpenBSD website, offering images for ARM64</li>
<li>“The current target platforms are the Pine64 and the Raspberry Pi 3.”</li>
<li>“OpenBSD/arm64 bundles various platforms sharing the 64-bit ARM architecture. Due to the fact that there are many System on a Chips (SoC) around, OpenBSD/arm64 differentiates between various SoCs and may have a different level of support between them”</li>
<li>The page contains a list of the devices that are supported, and which components have working drivers</li>
<li>At the time of recording, the link to download the snapshots did not work yet, but by time this airs a week from now, it should be working.
***</li>
</ul>

<h3><a href="http://loup-vaillant.fr/tutorials/chacha20-design" rel="nofollow">The design of Chacha20</a></h3>

<ul>
<li>Seems like every few episodes we end up discussing Ciphers (With their o-so amusing naming) and today is no exception.</li>
<li>We have a great writeup on the D &amp; I of the ‘chacha20’ cipher written by “Loup Vaillant”</li>
<li>First of all, is this story for you? Maybe the summary will help make that call:</li>
</ul>

<p>“Quick summary: Chacha20 is ARX-based hash function, keyed, running in counter mode. It embodies the idea that one can use a hash function to encrypt data.”</p>

<ul>
<li>If your eyes didn’t glaze over, then you are cleared to proceed. </li>
<li>Chacha20 is built around stream ciphers:</li>
</ul>

<blockquote>
<p>While Chacha20 is mainly used for encryption, its core is a pseudo-random number generator. The cipher text is obtained by XOR&#39;ing the plain text with a pseudo-random stream:<br>
cipher_text = plain_text XOR chacha_stream(key, nonce)</p>

<p>Provided you never use the same nonce with the same key twice, you can treat that stream as a one time pad. This makes it very simple: unlike block ciphers, you don&#39;t have to worry about padding, and decryption is the same operation as encryption:<br>
plain_text = cipher_text XOR chacha_stream(key, nonce)</p>

<p>Now we just have to get that stream.</p>
</blockquote>

<ul>
<li>The idea that the streams can mimic the concept of a one-time pad does make chacha20 very attractive, even to a non-crypto guy such as myself.</li>
<li>From here the article goes into depth on how the cipher scrambles 512bit blocks using the quarter-round method (A forth of a block or 4 32bit numbers)</li>
<li>Some ascii art is used here to help visualize how this done, in the quarter round-phase, then to the complete block as the 4 quarters are run in parallel over the entire 512 bit block.</li>
<li>From here the article goes more into depth, looking at the complete chacha block, and the importance of a seemingly unnecessary 32byte constant (Hint: it’s really important)</li>
<li>If crypto is something you find fascinating, you’ll want to make sure you give this one a full read-through.
***</li>
</ul>

<h3><a href="https://twitter.com/DLangille/status/823915729430913025" rel="nofollow">CyberChef - Coming to a FreeBSD Ports tree near you</a></h3>

<ul>
<li>Dan Langille tweets that he will be creating a port of GCHQ’s CyberChef tool</li>
<li>“CyberChef is a simple, intuitive web app for carrying out all manner of &quot;cyber&quot; operations within a web browser. These operations include creating hexdumps, simple encoding like XOR or Base64, more complex encryption like AES, DES and Blowfish, data compression and decompression, calculating hashes and checksums, IPv6 and X.509 parsing, and much more.”</li>
<li>“The tool is designed to enable both technical and non-technical analysts to manipulate data in complex ways without having to deal with complex tools or algorithms. It was conceived, designed, built and incrementally improved by an analyst in their 10% innovation time over several years. Every effort has been made to structure the code in a readable and extendable format, however it should be noted that the analyst is not a professional developer and the code has not been peer-reviewed for compliance with a formal specification.”</li>
<li>Some handy functions, beyond stuff like base64 encoding:</li>
<li><a href="https://gchq.github.io/CyberChef/?recipe=%5B%7B%22op%22%3A%22Parse%20IP%20range%22%2C%22args%22%3A%5Btrue%2Ctrue%2Cfalse%5D%7D%5D&input=MTcyLjIxLjAuMzIvMjcK" rel="nofollow">Network Enumeration (CIDR to list of IPS) </a></li>
<li>Browser User Agent Parser (what browser is that, based on your HTTP logs)</li>
<li>XOR Brute Force: enter some XOR’d text, and try every possible key to find plaintext. Optionally give it a regex of known plaintext to find the right key.</li>
<li>Calculate the “Shannon Entropy” of the input (how random is this data)</li>
<li>It also has a number of built in regular expressions for common things, very useful</li>
<li>The project is up on github if you want to play with the code
***</li>
</ul>

<h3><a href="https://gist.github.com/prash-wghats/89be1ee069d2acf23c289e9c606616e1" rel="nofollow">Building Electron and VSCode in FreeBSD11</a></h3>

<ul>
<li>A patch and set of instructions for building Electron and VSCode on FreeBSD</li>
<li>“Visual Studio Code is a source code editor developed by Microsoft for Windows, Linux and macOS. It includes support for debugging, embedded Git control, syntax highlighting, intelligent code completion, snippets, and code refactoring. It is also customizable, so users can change the editor&#39;s theme, keyboard shortcuts, and preferences. It is free and open-source, although the official download is under a proprietary license.”</li>
<li>“Visual Studio Code is based on Electron, a framework which is used to deploy Node.js applications for the desktop running on the Blink layout engine. Although it uses the Electron framework, the software is not a fork of Atom, it is actually based on Visual Studio Online&#39;s editor (codename &quot;Monaco&quot;)”</li>
<li>It would be interesting to see official support for VSCode on FreeBSD</li>
<li>Has anyone tried VSCode on the FreeBSD Code base?
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://roy.marples.name/blog/blog/soft-label-keys" rel="nofollow">Soft Label Keys</a> </p></li>
<li><p><a href="https://www.mail-archive.com/source-changes@openbsd.org/msg84599.html" rel="nofollow">WPA1 (TKIP) disabled by default (OpenBSD)</a></p></li>
<li><p><a href="https://kkovacs.eu/cool-but-obscure-unix-tools" rel="nofollow">Cool but obscure unix tools</a> </p></li>
<li><p><a href="http://euroquis.nl/bobulate/?p=1521" rel="nofollow">KDE Frameworks and Plasma on FreeBSD</a></p></li>
<li><p><a href="https://www.mail-archive.com/source-changes@openbsd.org/msg84904.html" rel="nofollow">Initiative to migrate OpenBSD mirrors to HTTPS</a></p></li>
<li><p><a href="http://i.imgur.com/dC7c1y4.png" rel="nofollow">That moment you realize FreeBSD has got some Star Wars fans</a></p></li>
<li><p><a href="https://wiki.freebsd.org/PortsSubversionPrimer" rel="nofollow">Pagelink</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we’re going to be leading off with the latest news about Wayland and Xorg support on FreeBSD, then a look at OpenBSD ARM64</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=432406" rel="nofollow">Wayland is now in the FreeBSD Ports tree</a></h3>

<ul>
<li>This commit brings Wayland, the new windowing system, into the FreeBSD ports tree</li>
<li>“This port was first created by Koop Mast (kwm@) then updated and improved by Johannes Lundberg”</li>
<li>“Wayland is intended as a simpler replacement for X, easier to develop and maintain. GNOME and KDE are expected to be ported to it.”</li>
<li>Wayland is designed for desktop and laptop use, rather than X, which was designed for use over the network, where clients were not powerful enough to run the applications locally.</li>
<li>“Wayland is a protocol for a compositor to talk to its clients as well as a C library implementation of that protocol. The compositor can be a standalone display server running on Linux kernel modesetting and evdev input devices, an X application, or a wayland client itself. The clients can be traditional applications, X servers (rootless or fullscreen) or other display servers.”</li>
<li>“Please report bugs to the FreeBSD bugtracker!”</li>
<li>It is good to see this project progressing, as it seems in a few generations, high performance graphics drivers may only be actively developed for Wayland.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-x11/2017-January/018738.html" rel="nofollow">Call For Testing: xorg 1.18.4 and newer intel/ati DDX </a></h3>

<ul>
<li>Baptiste Daroussin, and the FreeBSD X11 team, have issued a call for testing for the upgrade to Xorg 1.18.4</li>
<li>Along with it comes newer ATI/AMD and Intel drivers</li>
<li>“Note that you will need to rebuild all the xf86-* packages to work with thatnewer xorg (hence the bump of the revision)”</li>
<li>“Do not expect newer gpu supported as this is not the kernel part”, it only provides the newer Xorg driver, not the kernel mode setting driver (this is a separate project)</li>
<li>“If you experience any issue with intel or radeon driver please try to use the new modesetting driver provided by xorg directly (note that fedora and debian recommend the use of the new driver instead of the ati/intel one)”
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/to-errno-or-to-error" rel="nofollow">Error handling in C </a></h3>

<ul>
<li>“Unlike other languages which have one preferred means of signalling an error, C is a multi error paradigm language. Error handling styles in C can be organized into one of several distinct styles, such as popular or correct. Some examples of each.”

<ul>
<li>“One very popular option is the classic unix style. -1 is returned to indicate an error.”</li>
<li>“Another option seen in the standard C library is NULL for errors.”</li>
<li>“The latter has the advantage that NULL is a false value, which makes it easier to write logical conditions. File descriptor 0 is valid (stdin) but false, while -1 is invalid but true.”</li>
<li>“And of course, there’s the worst of both worlds approach requiring a special sentinel that you’ll probably forget to use”</li>
<li>“Other unix functions, those that don’t need to return a file descriptor, stick to just 0 and -1”</li>
<li>“Of course, none of these functions reveal anything about the nature of the error. For that, you need to consult the errno on the side”</li>
</ul></li>
<li>The article goes on to describe different ways of dealing with the issue, and return values.</li>
<li>There is also coverage of more complex examples and involve a context that might contain the error message</li>
<li>It is really interesting to see the differences, and the pitfalls of each approach
***</li>
</ul>

<h3><a href="http://www.dwheeler.com/essays/fixing-unix-linux-filenames.html" rel="nofollow">Fixing POSIX Filenames</a></h3>

<ul>
<li>“Traditionally, Unix/Linux/POSIX pathnames and filenames can be almost any sequence of bytes. A pathname lets you select a particular file, and may 
include zero or more “/” characters. Each pathname component (separated by “/”) is a filename; filenames cannot contain “/”. Neither 
filenames nor pathnames can contain the ASCII NUL character (\0), because that is the terminator.”</li>
<li>“This lack of limitations is flexible, but it also creates a legion of unnecessary problems. In particular, this lack of limitations makes it 
unnecessarily difficult to write correct programs (enabling many security flaws). It also makes it impossible to consistently and accurately display filenames, 
causes portability problems, and confuses users.”</li>
<li>“This article will try to convince you that adding some tiny limitations on legal Unix/Linux/POSIX filenames would be an improvement. Many programs 
already presume these limitations, the POSIX standard already permits such limitations, and many Unix/Linux filesystems already embed such limitations — so 
it’d be better to make these (reasonable) assumptions true in the first place. This article will discuss, in particular, the three biggest problems: control 
characters in filenames (including newline, tab, and escape), leading dashes in filenames, and the lack of a standard character encoding scheme (instead of 
using UTF-8). These three problems impact programs written in any language on Unix/Linux/POSIX system. There are other problems, of course. Spaces in filenames 
can cause problems; it’s probably hopeless to ban them outright, but resolving some of the other issues will simplify handling spaces in filenames. For 
example, when using a Bourne shell, you can use an IFS trick (using IFS=<code>printf &#39;\n\t&#39;</code>) to eliminate some problems with spaces. Similarly, special 
metacharacters in filenames cause some problems; I suspect few if any metacharacters could be forbidden on all POSIX systems, but it’d be great if 
administrators could locally configure systems so that they could prevent or escape such filenames when they want to. I then discuss some other tricks that can 
help.”</li>
<li>“After limiting filenames slightly, creating completely-correct programs is much easier, and some vulnerabilities in existing programs disappear. This 
article then notes some others’ opinions; I knew that some people wouldn’t agree with me, but I’m heartened that many do agree that something should 
be done. Finally, I briefly discuss some methods for solving this long-term; these include forbidding creation of such names (hiding them if they already exist 
on the underlying filesystem), implementing escaping mechanisms, or changing how tools work so that these are no longer problems (e.g., when globbing/scanning, 
have the libraries prefix “./” to any filename beginning with “-”). Solving this is not easy, and I suspect that several solutions will be 
needed. In fact, this paper became long over time because I kept finding new problems that needed explaining (new “worms under the rocks”). If I’ve 
convinced you that this needs improving, I’d like your help in figuring out how to best do it!”</li>
<li>“Filename problems affect programs written in any programming language. However, they can be especially tricky to deal with when using Bourne shells 
(including bash and dash). If you just want to write shell programs that can handle filenames correctly, you should see the short companion article <a href="http://www.dwheeler.com/essays/filenames-in-shell.html" rel="nofollow">Filenames 
and Pathnames in Shell: How to do it correctly</a>.”</li>
<li> Imagine that you don’t know Unix/Linux/POSIX (I presume you really do), and that you’re trying to do some simple tasks. For our purposes we will 
create simple scripts on the command line (using a Bourne shell) for these tasks, though many of the underlying problems affect any program. For example, 
let’s try to print out the contents of all files in the current directory, putting the contents into a file in the parent directory:

<ul>
<li>cat * &gt; ../collection  # WRONG</li>
<li>cat ./* &gt; ../collection  # CORRECT</li>
<li>cat <code>find . -type f</code> &gt; ../collection  # WRONG</li>
<li>( set -f ; for file in <code>find . -type f</code> ; do  # WRONG
cat &quot;$file&quot;
done ) &gt; ../collection</li>
<li>( find . -type f | xargs cat ) &gt; ../collection # WRONG, WAY WRONG</li>
</ul></li>
<li>Just think about trying to remove a file named: -rf /
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.openbsd.org/arm64.html" rel="nofollow">OpenBSD ARM64</a></h3>

<ul>
<li>A new page has appeared on the OpenBSD website, offering images for ARM64</li>
<li>“The current target platforms are the Pine64 and the Raspberry Pi 3.”</li>
<li>“OpenBSD/arm64 bundles various platforms sharing the 64-bit ARM architecture. Due to the fact that there are many System on a Chips (SoC) around, OpenBSD/arm64 differentiates between various SoCs and may have a different level of support between them”</li>
<li>The page contains a list of the devices that are supported, and which components have working drivers</li>
<li>At the time of recording, the link to download the snapshots did not work yet, but by time this airs a week from now, it should be working.
***</li>
</ul>

<h3><a href="http://loup-vaillant.fr/tutorials/chacha20-design" rel="nofollow">The design of Chacha20</a></h3>

<ul>
<li>Seems like every few episodes we end up discussing Ciphers (With their o-so amusing naming) and today is no exception.</li>
<li>We have a great writeup on the D &amp; I of the ‘chacha20’ cipher written by “Loup Vaillant”</li>
<li>First of all, is this story for you? Maybe the summary will help make that call:</li>
</ul>

<p>“Quick summary: Chacha20 is ARX-based hash function, keyed, running in counter mode. It embodies the idea that one can use a hash function to encrypt data.”</p>

<ul>
<li>If your eyes didn’t glaze over, then you are cleared to proceed. </li>
<li>Chacha20 is built around stream ciphers:</li>
</ul>

<blockquote>
<p>While Chacha20 is mainly used for encryption, its core is a pseudo-random number generator. The cipher text is obtained by XOR&#39;ing the plain text with a pseudo-random stream:<br>
cipher_text = plain_text XOR chacha_stream(key, nonce)</p>

<p>Provided you never use the same nonce with the same key twice, you can treat that stream as a one time pad. This makes it very simple: unlike block ciphers, you don&#39;t have to worry about padding, and decryption is the same operation as encryption:<br>
plain_text = cipher_text XOR chacha_stream(key, nonce)</p>

<p>Now we just have to get that stream.</p>
</blockquote>

<ul>
<li>The idea that the streams can mimic the concept of a one-time pad does make chacha20 very attractive, even to a non-crypto guy such as myself.</li>
<li>From here the article goes into depth on how the cipher scrambles 512bit blocks using the quarter-round method (A forth of a block or 4 32bit numbers)</li>
<li>Some ascii art is used here to help visualize how this done, in the quarter round-phase, then to the complete block as the 4 quarters are run in parallel over the entire 512 bit block.</li>
<li>From here the article goes more into depth, looking at the complete chacha block, and the importance of a seemingly unnecessary 32byte constant (Hint: it’s really important)</li>
<li>If crypto is something you find fascinating, you’ll want to make sure you give this one a full read-through.
***</li>
</ul>

<h3><a href="https://twitter.com/DLangille/status/823915729430913025" rel="nofollow">CyberChef - Coming to a FreeBSD Ports tree near you</a></h3>

<ul>
<li>Dan Langille tweets that he will be creating a port of GCHQ’s CyberChef tool</li>
<li>“CyberChef is a simple, intuitive web app for carrying out all manner of &quot;cyber&quot; operations within a web browser. These operations include creating hexdumps, simple encoding like XOR or Base64, more complex encryption like AES, DES and Blowfish, data compression and decompression, calculating hashes and checksums, IPv6 and X.509 parsing, and much more.”</li>
<li>“The tool is designed to enable both technical and non-technical analysts to manipulate data in complex ways without having to deal with complex tools or algorithms. It was conceived, designed, built and incrementally improved by an analyst in their 10% innovation time over several years. Every effort has been made to structure the code in a readable and extendable format, however it should be noted that the analyst is not a professional developer and the code has not been peer-reviewed for compliance with a formal specification.”</li>
<li>Some handy functions, beyond stuff like base64 encoding:</li>
<li><a href="https://gchq.github.io/CyberChef/?recipe=%5B%7B%22op%22%3A%22Parse%20IP%20range%22%2C%22args%22%3A%5Btrue%2Ctrue%2Cfalse%5D%7D%5D&input=MTcyLjIxLjAuMzIvMjcK" rel="nofollow">Network Enumeration (CIDR to list of IPS) </a></li>
<li>Browser User Agent Parser (what browser is that, based on your HTTP logs)</li>
<li>XOR Brute Force: enter some XOR’d text, and try every possible key to find plaintext. Optionally give it a regex of known plaintext to find the right key.</li>
<li>Calculate the “Shannon Entropy” of the input (how random is this data)</li>
<li>It also has a number of built in regular expressions for common things, very useful</li>
<li>The project is up on github if you want to play with the code
***</li>
</ul>

<h3><a href="https://gist.github.com/prash-wghats/89be1ee069d2acf23c289e9c606616e1" rel="nofollow">Building Electron and VSCode in FreeBSD11</a></h3>

<ul>
<li>A patch and set of instructions for building Electron and VSCode on FreeBSD</li>
<li>“Visual Studio Code is a source code editor developed by Microsoft for Windows, Linux and macOS. It includes support for debugging, embedded Git control, syntax highlighting, intelligent code completion, snippets, and code refactoring. It is also customizable, so users can change the editor&#39;s theme, keyboard shortcuts, and preferences. It is free and open-source, although the official download is under a proprietary license.”</li>
<li>“Visual Studio Code is based on Electron, a framework which is used to deploy Node.js applications for the desktop running on the Blink layout engine. Although it uses the Electron framework, the software is not a fork of Atom, it is actually based on Visual Studio Online&#39;s editor (codename &quot;Monaco&quot;)”</li>
<li>It would be interesting to see official support for VSCode on FreeBSD</li>
<li>Has anyone tried VSCode on the FreeBSD Code base?
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://roy.marples.name/blog/blog/soft-label-keys" rel="nofollow">Soft Label Keys</a> </p></li>
<li><p><a href="https://www.mail-archive.com/source-changes@openbsd.org/msg84599.html" rel="nofollow">WPA1 (TKIP) disabled by default (OpenBSD)</a></p></li>
<li><p><a href="https://kkovacs.eu/cool-but-obscure-unix-tools" rel="nofollow">Cool but obscure unix tools</a> </p></li>
<li><p><a href="http://euroquis.nl/bobulate/?p=1521" rel="nofollow">KDE Frameworks and Plasma on FreeBSD</a></p></li>
<li><p><a href="https://www.mail-archive.com/source-changes@openbsd.org/msg84904.html" rel="nofollow">Initiative to migrate OpenBSD mirrors to HTTPS</a></p></li>
<li><p><a href="http://i.imgur.com/dC7c1y4.png" rel="nofollow">That moment you realize FreeBSD has got some Star Wars fans</a></p></li>
<li><p><a href="https://wiki.freebsd.org/PortsSubversionPrimer" rel="nofollow">Pagelink</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>178: Enjoy the Silence</title>
  <link>https://www.bsdnow.tv/178</link>
  <guid isPermaLink="false">432eecad-cec1-4297-a8eb-87d5b5b088fd</guid>
  <pubDate>Wed, 25 Jan 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/432eecad-cec1-4297-a8eb-87d5b5b088fd.mp3" length="57001684" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSD Now, we will be discussing a wide variety of topics including Routers, Run-Controls, the “Rule” of silence and some</itunes:subtitle>
  <itunes:duration>1:19:10</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSD Now, we will be discussing a wide variety of topics including Routers, Run-Controls, the “Rule” of silence and some
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Ports no longer build on EOL FreeBSD versions (https://www.reddit.com/r/freebsd/comments/5ouvmp/ports_no_longer_build_on_eol_freebsd_versions/)
The FreeBSD ports tree has been updated to automatically fail if you try to compile ports on EOL versions of FreeBSD (any version of 9.x or earlier, 10.0 - 10.2, or 11 from before 11.0)
This is to prevent shooting yourself in the food, as the compatibility code for those older OSes has been removed now that they are no longer supported.
If you use pkg, you will also run into problems on old releases. Packages are always built on the oldest supported release in a branch. Until recently, this meant packages for 10.1, 10.2, and 10.3 were compiled on 10.1. Now that 10.1 and 10.2 are EOL, packages for 10.x are compiled on 10.3.
This matters because 10.3 supports the new openat() and various other *at() functions used by capsicum. Now that pkg and packages are built on a version that supports this new feature, they will not run on systems that do not support it. So pkg will exit with an error as soon as it tries to open a file.
You can work around this temporarily by using the pkg-static command, but you should upgrade to a supported release immediately.
***
Improving TrueOS: OpenRC (https://www.trueos.org/blog/improving-trueos-openrc/)
With TrueOS moving to a rolling-release model, we’ve decided to be a bit more proactive in sharing news about new features that are landing. 
This week we’ve posted an article talking about the transition to OpenRC
In past episodes you’ve heard me mention OpenRC, but hopefully today we can help answer any of those lingering questions you may still have about it
The first thing always asked, is “What is OpenRC?”
OpenRC is a dependency-based init system working with the system provided init program. It is used with several Linux distributions, including Gentoo and Alpine Linux. However, OpenRC was created by the NetBSD developer Roy Marples in one of those interesting intersections of Linux and BSD development. OpenRC’s development history, portability, and 2-clause BSD license make its integration into TrueOS an easy decision.
Now that we know a bit about what it is, how does it behave differently than traditional RC?
TrueOS now uses OpenRC to manage all system services, as opposed to FreeBSD’s RC. Instead of using rc.d for base system rc scripts, OpenRC uses init.d. Also, every service in OpenRC has its own user configuration file, located in /etc/conf.d/ for the base system and /usr/local/etc.conf.d/ for ports. Finally, OpenRC uses runlevels, as opposed to the FreeBSD single- or multi- user modes. You can view the services and their runlevels by typing $ rc-update show -v in a CLI. Also, TrueOS integrates OpenRC service management into SysAdm with the Service Manager tool
One of the prime benefits of OpenRC is much faster boot-times, which is important in a portable world of laptops (and desktops as well). But service monitoring and crash detection are also important parts of what make OpenRC a substantial upgrade for TrueOS.
Lastly people have asked us about migration, what is done, what isn’t? As of now almost all FreeBSD base system services have been migrated over. In addition most desktop-facing services required to run Lumina and the like are also ported. We are still going through the ports tree and converting legacy rc.d scripts to init.d, but the process takes time. Several new folks have begun contributing OpenRC scripts and we hope to have all the roughly 1k ports converted over this year. 
BSDRP Releases 1.70   (https://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.70/)
A new release of the BSD Router Project
This distro is designed to replace high end routers, like those from Cisco and Juniper, with FreeBSD running on regular off-the-shelf server.
Highlights:
Upgraded to FreeBSD 11.0-STABLE r312663 (skip 11.0 for massive performance improvement)
Re-Added: netmap-fwd (https://github.com/Netgate/netmap-fwd)
Add FIBsync patch to netmap-fwd from Zollner Robert 
netmap pkt-gen supports IPv6, thanks to Andrey V. Elsukov (ae@freebsd.org)
bird 1.6.3 (add BGP Large communities support)
OpenVPN 2.4.0 (adds the high speed AEAD GCM cipher)
All of the other packages have also been upgraded
A lot of great work has been done on BSDRP, and it has also generated a lot of great benchmarks and testing that have resulted in performance increases and improved understanding of how FreeBSD networking scales across different CPU types and speeds
***
DragonFlyBSD gets UEFI support (http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/7b1aa074fcd99442a1345fb8a695b62d01d9c7fd)
This commit adds support for UEFI to the Dragonfly Installer, allowing new systems to be installed to boot from UEFI
This script (http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/9d53bd00e9be53d6b893afd79111370ee0c053b0) provides a way to build a HAMMER filesystem that works with UEFI
There is also a UEFI man page (http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d195d5099328849c500d4a1b94d6915d3c72c71e) 
The install media (http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/5fa778d7b36ab0981ff9dcbd96c71ebf653a6a19) has also been updated to support booting from either UEFI or MBR, in the same way that the FreeBSD images work
***
News Roundup
The Rule of Silence (http://www.linfo.org/rule_of_silence.html)
“The rule of silence, also referred to as the silence is golden rule, is an important part of the Unix philosophy that states that when a program has nothing surprising, interesting or useful to say, it should say nothing. It means that well-behaved programs should treat their users' attention and concentration as being valuable and thus perform their tasks as unobtrusively as possible. That is, silence in itself is a virtue.”
This doesn’t mean a program cannot be verbose, it just means you have to ask it for the additional output, rather than having it by default
“There is no single, standardized statement of the Unix philosophy, but perhaps the simplest description would be: "Write programs that are small, simple and transparent. Write them so that they do only one thing, but do it well and can work together with other programs." That is, the philosophy centers around the concepts of smallness, simplicity, modularity, craftsmanship, transparency, economy, diversity, portability, flexibility and extensibility.”
“This philosophy has been fundamental to the the fact that Unix-like operating systems have been thriving for more than three decades, far longer than any other family of operating systems, and can be expected to see continued expansion of use in the years to come”
“The rule of silence is one of the oldest and most persistent design rules of such operating systems. As intuitive as this rule might seem to experienced users of such systems, it is frequently ignored by the developers of other types of operating systems and application programs for them. The result is often distraction, annoyance and frustration for users.”
“There are several very good reasons for the rule of silence: (1) One is to avoid cluttering the user's mind with information that might not be necessary or might not even be desired. That is, unnecessary information can be a distraction. Moreover, unnecessary messages generated by some operating systems and application programs are sometimes poorly worded, and can cause confusion or needless worry on the part of users.”
No news is good news. When there is bad news, error messages should be descriptive, and ideally tell the user what they might do about the error.
“A third reason is that command line programs (i.e., all-text mode programs) on Unix-like operating systems are designed to work together with pipes, i.e., the output from one program becomes the input of another program. This is a major feature of such systems, and it accounts for much of their power and flexibility. Consequently, it is important to have only the truly important information included in the output of each program, and thus in the input of the next program.”
Have you ever had to try to strip out useless output so you could feed that data into another program?
“The rule of silence originally applied to command line programs, because all programs were originally command line programs. However, it is just as applicable to GUI (graphical user interfaces) programs. That is, unnecessary and annoying information should be avoided regardless of the type of user interface.”
“A example is the useless and annoying dialog boxes (i.e., small windows) that pop up on the display screen with with surprising frequency on some operating systems and programs. These dialog boxes contain some obvious, cryptic or unnecessary message and require the user to click on them in order to close them and proceed with work. This is an interruption of concentration and a waste of time for most users. Such dialog boxes should be employed only in situations in which some unexpected result might occur or to protect important data.”
It goes on to make an analogy about Public Address systems. If too many unimportant messages, like advertisements, are sent over the PA system, people will start to ignore them, and miss the important announcements.
***
The Tao of tmux (https://leanpub.com/the-tao-of-tmux/read)
An interesting article floated across my news feed a few weeks back. It’s what essentially boils down to a book called the “Tao of tmux”, which immediately piqued my interest.
My story may be similar to many of yours. I was initially raised on using screen, and screen only for my terminal session and multiplexing needs.
Since then I’ve only had a passing interest in tmux, but its always been one of those utilities I felt was worthy of investing some more time into. (Especially when seeing some of the neat setups some of my peers have with it)
Needless to say, this article has been bookmarked, and I’ve started digesting some of it, but thought it would be good to share with anybody else who finds them-self in a similar situation.
The book starts off well, explaining in the simplest terms possible what Tmux really is, by comparing and contrasting it to something we are all familiar with, GUIS!
Helpfully they also include a chart which explains some of the terms we will be using frequently when discussing tmux (https://leanpub.com/the-tao-of-tmux/read#leanpub-auto-window-manager-for-the-terminal) 
One of the things the author does recommend is also making sure you are up to speed on your Terminal knowledge.
Before getting into tmux, a few fundamentals of the command line should be reviewed. Often, we’re so used to using these out of street smarts and muscle memory a great deal of us never see the relation of where these tools stand next to each other.
Seasoned developers are familiar with zsh, Bash, iTerm2, konsole, /dev/tty, shell scripting, and so on. If you use tmux, you’ll be around these all the time, regardless of whether you’re in a GUI on a local machine or SSH’ing into a remote server.
If you want to learn more about how processes and TTY’s work at the kernel level (data structures and all) the book The Design and Implementation of the FreeBSD Operating System (2nd Edition) by Marshall Kirk McKusick is nice. In particular, Chapter 4, Process Management and Section 8.6, Terminal Handling. The TTY demystified by Linus Åkesson (available online) dives into the TTY and is a good read as well.
We had to get that shout-out of Kirk’s book in here ;)
From here the boot/article takes us on a whirlwind journey of Sessions, Windows, Panes and more. Every control- command is covered, information on how to customize your statusbar, tips, tricks and the like. There’s far more here than we can cover in a single segment, but you are highly encouraged to bookmark this one and start your own adventure into the world of tmux.
***
SDF Celebrates 30 years of service in 2017 (https://sdf.org/)
HackerNews thread on SDF  (https://news.ycombinator.com/item?id=13453774)
“Super Dimension Fortress (SDF, also known as freeshell.org) is a non-profit public access UNIX shell provider on the Internet. It has been in continual operation since 1987 as a non-profit social club. The name is derived from the Japanese anime series The Super Dimension Fortress Macross; the original SDF server was a BBS for anime fans[1]. From its BBS roots, which have been well documented as part of the BBS: The Documentary project, SDF has grown into a feature-rich provider serving members around the world.”
A public access UNIX system, it was many people’s first access to a UNIX shell.
In the 90s, Virtual Machines were rare, the software to run them usually cost a lot of money and no one had very much memory to try to run two operating systems at the same time.
So for many people, these type of shell accounts were the only way they could access UNIX without having to replace the OS on their only computer
This is how I first started with UNIX, eventually moving to paying for access to bigger machines, and then buying my own servers and renting out shell accounts to host IRC servers and channel protection bots.
“On June 16th, 1987 Ted Uhlemann (handle: charmin, later iczer) connected his Apple ][e's 300 baud modem to the phone line his mother had just given him for his birthday. He had published the number the night before on as many BBSes around the Dallas Ft. Worth area that he could and he waited for the first caller. He had a copy of Magic Micro BBS which was written in Applesoft BASIC and he named the BBS "SDF-1" after his favorite Japanimation series ROBOTECH (Macross). He hoped to draw users who were interested in anime, industrial music and the Church of the Subgenius.”
I too started out in the world of BBSes before I had access to the internet. My parents got my a dedicated phone line for my birthday, so I wouldn’t tie up their line all the time. I quickly ended up running my own BBS, the Sudden Death BBS (Renegade (https://en.wikipedia.org/wiki/Renegade_(BBS)) on MS DOS)
I credit this early experience for my discovery of a passion for Systems Administration, that lead me to my current career
“Slowly, SDF has grown over all these years, never forgetting our past and unlike many sites on the internet, we actually have a past. Some people today may come here and see us as outdated and "retro". But if you get involved, you'll see it is quite alive with new ideas and a platform for opportunity to try many new things. The machines are often refreshed, the quotas are gone, the disk space is expanding as are the features (and user driven features at that) and our cabinets have plenty of space for expansion here in the USA and in Europe (Germany).”
“Think about ways you'd like to celebrate SDF's 30th and join us on the 'bboard' to discuss what we could do. I realize many of you have likely moved on yourselves, but I just wanted you to know we're still here and we'll keep doing new and exciting things with a foundation in the UNIX shell.”
***
Getting Minecraft to Run on NetBSD (https://www.reddit.com/r/NetBSD/comments/5mtsy1/getting_minecraft_to_run_on_netbsd/)
One thing that doesn’t come up often on BSDNow is the idea of gaming. I realize most of us are server folks, or perhaps don’t play games (The PC is for work, use your fancy-smanzy PS4 and get off my lawn you kids)
Today I thought it would be fun to highlight this post over at Reddit talking about running MineCraft on NetBSD
Now I realize this may not be news to some of you, but perhaps it is to others. For the record my kids have been playing Minecraft on PC-BSD / TrueOS for years. It's the primary reason they are more often booted into that instead of Windows. (Funny story behind that - Got sick of all the 3rd party mods, which more often than not came helpfully bundled with viruses and malware)
On NetBSD the process looks a bit different than on FreeBSD. First up, you’ll need to enable Linux Emulation and install Oracle JRE (Not OpenJDK, that path leads to sadness here)
The guide will then walk us through the process of fetching the Linux runtime packages, extracting and then enabling bits such as ‘procfs’ that is required to run the Linux binaries. 
Once that's done, minecraft is only a simple “oracle8-jre /path/to/minecraft.jar” command away from starting up, and you’ll be “crafting” in no time. (Does anybody even play survival anymore?)
***
Beastie Bits
UNIX on the Computer Chronicals  (https://youtu.be/g7P16mYDIJw) 
FreeBSD: Atheros AR9380 and later, maximum UDP TX goes from 250mbit to 355mbit.  (https://twitter.com/erikarn/status/823298416939659264) 
Capsicumizing traceroute with casper  (https://reviews.freebsd.org/D9303) 
Feedback/Questions
 Jason - TarSnap on Windows (http://pastebin.com/Sr1BTzVN) 
 Mike - OpenRC &amp;amp; DO (http://pastebin.com/zpHyhHQG) 
 Anonymous - Old Machines (http://pastebin.com/YnjkrDmk) 
 Matt - Iocage (http://pastebin.com/pBUXtFak) 
 Hjalti - Rclone &amp;amp; FreeNAS (http://pastebin.com/zNkK3epM) 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSD Now, we will be discussing a wide variety of topics including Routers, Run-Controls, the “Rule” of silence and some</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.reddit.com/r/freebsd/comments/5ouvmp/ports_no_longer_build_on_eol_freebsd_versions/" rel="nofollow">Ports no longer build on EOL FreeBSD versions</a></h3>

<ul>
<li>The FreeBSD ports tree has been updated to automatically fail if you try to compile ports on EOL versions of FreeBSD (any version of 9.x or earlier, 10.0 - 10.2, or 11 from before 11.0)</li>
<li>This is to prevent shooting yourself in the food, as the compatibility code for those older OSes has been removed now that they are no longer supported.</li>
<li>If you use pkg, you will also run into problems on old releases. Packages are always built on the oldest supported release in a branch. Until recently, this meant packages for 10.1, 10.2, and 10.3 were compiled on 10.1. Now that 10.1 and 10.2 are EOL, packages for 10.x are compiled on 10.3.</li>
<li>This matters because 10.3 supports the new openat() and various other *at() functions used by capsicum. Now that pkg and packages are built on a version that supports this new feature, they will not run on systems that do not support it. So pkg will exit with an error as soon as it tries to open a file.</li>
<li>You can work around this temporarily by using the pkg-static command, but you should upgrade to a supported release immediately.
***</li>
</ul>

<h3><a href="https://www.trueos.org/blog/improving-trueos-openrc/" rel="nofollow">Improving TrueOS: OpenRC</a></h3>

<ul>
<li>With TrueOS moving to a rolling-release model, we’ve decided to be a bit more proactive in sharing news about new features that are landing. </li>
<li>This week we’ve posted an article talking about the transition to OpenRC</li>
<li>In past episodes you’ve heard me mention OpenRC, but hopefully today we can help answer any of those lingering questions you may still have about it</li>
<li>The first thing always asked, is “What is OpenRC?”</li>
</ul>

<blockquote>
<p>OpenRC is a dependency-based init system working with the system provided init program. It is used with several Linux distributions, including Gentoo and Alpine Linux. However, OpenRC was created by the NetBSD developer Roy Marples in one of those interesting intersections of Linux and BSD development. OpenRC’s development history, portability, and 2-clause BSD license make its integration into TrueOS an easy decision.</p>
</blockquote>

<ul>
<li>Now that we know a bit about what it is, how does it behave differently than traditional RC?</li>
</ul>

<blockquote>
<p>TrueOS now uses OpenRC to manage all system services, as opposed to FreeBSD’s RC. Instead of using rc.d for base system rc scripts, OpenRC uses init.d. Also, every service in OpenRC has its own user configuration file, located in /etc/conf.d/ for the base system and /usr/local/etc.conf.d/ for ports. Finally, OpenRC uses runlevels, as opposed to the FreeBSD single- or multi- user modes. You can view the services and their runlevels by typing $ rc-update show -v in a CLI. Also, TrueOS integrates OpenRC service management into SysAdm with the Service Manager tool</p>
</blockquote>

<ul>
<li><p>One of the prime benefits of OpenRC is much faster boot-times, which is important in a portable world of laptops (and desktops as well). But service monitoring and crash detection are also important parts of what make OpenRC a substantial upgrade for TrueOS.</p></li>
<li><p>Lastly people have asked us about migration, what is done, what isn’t? As of now almost all FreeBSD base system services have been migrated over. In addition most desktop-facing services required to run Lumina and the like are also ported. We are still going through the ports tree and converting legacy rc.d scripts to init.d, but the process takes time. Several new folks have begun contributing OpenRC scripts and we hope to have all the roughly 1k ports converted over this year. </p>

<hr></li>
</ul>

<h3><a href="https://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.70/" rel="nofollow">BSDRP Releases 1.70  </a></h3>

<ul>
<li>A new release of the BSD Router Project</li>
<li>This distro is designed to replace high end routers, like those from Cisco and Juniper, with FreeBSD running on regular off-the-shelf server.</li>
<li>Highlights:

<ul>
<li>Upgraded to FreeBSD 11.0-STABLE r312663 (skip 11.0 for massive performance improvement)</li>
<li>Re-Added: netmap-fwd (<a href="https://github.com/Netgate/netmap-fwd" rel="nofollow">https://github.com/Netgate/netmap-fwd</a>)</li>
<li>Add FIBsync patch to netmap-fwd from Zollner Robert <wolfit_ro@yahoo.com></li>
<li>netmap pkt-gen supports IPv6, thanks to Andrey V. Elsukov (<a href="mailto:ae@freebsd.org" rel="nofollow">ae@freebsd.org</a>)</li>
<li>bird 1.6.3 (add BGP Large communities support)</li>
<li>OpenVPN 2.4.0 (adds the high speed AEAD GCM cipher)</li>
</ul></li>
<li>All of the other packages have also been upgraded</li>
<li>A lot of great work has been done on BSDRP, and it has also generated a lot of great benchmarks and testing that have resulted in performance increases and improved understanding of how FreeBSD networking scales across different CPU types and speeds
***</li>
</ul>

<h3><a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/7b1aa074fcd99442a1345fb8a695b62d01d9c7fd" rel="nofollow">DragonFlyBSD gets UEFI support</a></h3>

<ul>
<li>This commit adds support for UEFI to the Dragonfly Installer, allowing new systems to be installed to boot from UEFI</li>
<li><a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/9d53bd00e9be53d6b893afd79111370ee0c053b0" rel="nofollow">This script</a> provides a way to build a HAMMER filesystem that works with UEFI</li>
<li>There is also a <a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d195d5099328849c500d4a1b94d6915d3c72c71e" rel="nofollow">UEFI man page</a> </li>
<li>The <a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/5fa778d7b36ab0981ff9dcbd96c71ebf653a6a19" rel="nofollow">install media</a> has also been updated to support booting from either UEFI or MBR, in the same way that the FreeBSD images work
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.linfo.org/rule_of_silence.html" rel="nofollow">The Rule of Silence</a></h3>

<ul>
<li>“The rule of silence, also referred to as the silence is golden rule, is an important part of the Unix philosophy that states that when a program has nothing surprising, interesting or useful to say, it should say nothing. It means that well-behaved programs should treat their users&#39; attention and concentration as being valuable and thus perform their tasks as unobtrusively as possible. That is, silence in itself is a virtue.”</li>
<li>This doesn’t mean a program cannot be verbose, it just means you have to ask it for the additional output, rather than having it by default</li>
<li>“There is no single, standardized statement of the Unix philosophy, but perhaps the simplest description would be: &quot;Write programs that are small, simple and transparent. Write them so that they do only one thing, but do it well and can work together with other programs.&quot; That is, the philosophy centers around the concepts of smallness, simplicity, modularity, craftsmanship, transparency, economy, diversity, portability, flexibility and extensibility.”</li>
<li>“This philosophy has been fundamental to the the fact that Unix-like operating systems have been thriving for more than three decades, far longer than any other family of operating systems, and can be expected to see continued expansion of use in the years to come”</li>
<li>“The rule of silence is one of the oldest and most persistent design rules of such operating systems. As intuitive as this rule might seem to experienced users of such systems, it is frequently ignored by the developers of other types of operating systems and application programs for them. The result is often distraction, annoyance and frustration for users.”</li>
<li>“There are several very good reasons for the rule of silence: (1) One is to avoid cluttering the user&#39;s mind with information that might not be necessary or might not even be desired. That is, unnecessary information can be a distraction. Moreover, unnecessary messages generated by some operating systems and application programs are sometimes poorly worded, and can cause confusion or needless worry on the part of users.”</li>
<li>No news is good news. When there is bad news, error messages should be descriptive, and ideally tell the user what they might do about the error.</li>
<li>“A third reason is that command line programs (i.e., all-text mode programs) on Unix-like operating systems are designed to work together with pipes, i.e., the output from one program becomes the input of another program. This is a major feature of such systems, and it accounts for much of their power and flexibility. Consequently, it is important to have only the truly important information included in the output of each program, and thus in the input of the next program.”</li>
<li>Have you ever had to try to strip out useless output so you could feed that data into another program?</li>
<li>“The rule of silence originally applied to command line programs, because all programs were originally command line programs. However, it is just as applicable to GUI (graphical user interfaces) programs. That is, unnecessary and annoying information should be avoided regardless of the type of user interface.”</li>
<li>“A example is the useless and annoying dialog boxes (i.e., small windows) that pop up on the display screen with with surprising frequency on some operating systems and programs. These dialog boxes contain some obvious, cryptic or unnecessary message and require the user to click on them in order to close them and proceed with work. This is an interruption of concentration and a waste of time for most users. Such dialog boxes should be employed only in situations in which some unexpected result might occur or to protect important data.”</li>
<li>It goes on to make an analogy about Public Address systems. If too many unimportant messages, like advertisements, are sent over the PA system, people will start to ignore them, and miss the important announcements.
***</li>
</ul>

<h3><a href="https://leanpub.com/the-tao-of-tmux/read" rel="nofollow">The Tao of tmux</a></h3>

<ul>
<li>An interesting article floated across my news feed a few weeks back. It’s what essentially boils down to a book called the “Tao of tmux”, which immediately piqued my interest.</li>
<li>My story may be similar to many of yours. I was initially raised on using screen, and screen only for my terminal session and multiplexing needs.</li>
<li>Since then I’ve only had a passing interest in tmux, but its always been one of those utilities I felt was worthy of investing some more time into. (Especially when seeing some of the neat setups some of my peers have with it)</li>
<li>Needless to say, this article has been bookmarked, and I’ve started digesting some of it, but thought it would be good to share with anybody else who finds them-self in a similar situation.</li>
<li>The book starts off well, explaining in the simplest terms possible what Tmux really is, by comparing and contrasting it to something we are all familiar with, GUIS!</li>
<li>Helpfully they also include a chart which explains some of the terms we will be using frequently when discussing tmux (<a href="https://leanpub.com/the-tao-of-tmux/read#leanpub-auto-window-manager-for-the-terminal" rel="nofollow">https://leanpub.com/the-tao-of-tmux/read#leanpub-auto-window-manager-for-the-terminal</a>) </li>
<li>One of the things the author does recommend is also making sure you are up to speed on your Terminal knowledge.</li>
</ul>

<blockquote>
<p>Before getting into tmux, a few fundamentals of the command line should be reviewed. Often, we’re so used to using these out of street smarts and muscle memory a great deal of us never see the relation of where these tools stand next to each other.</p>

<p>Seasoned developers are familiar with zsh, Bash, iTerm2, konsole, /dev/tty, shell scripting, and so on. If you use tmux, you’ll be around these all the time, regardless of whether you’re in a GUI on a local machine or SSH’ing into a remote server.</p>

<p>If you want to learn more about how processes and TTY’s work at the kernel level (data structures and all) the book The Design and Implementation of the FreeBSD Operating System (2nd Edition) by Marshall Kirk McKusick is nice. In particular, Chapter 4, Process Management and Section 8.6, Terminal Handling. The TTY demystified by Linus Åkesson (available online) dives into the TTY and is a good read as well.</p>
</blockquote>

<ul>
<li>We had to get that shout-out of Kirk’s book in here ;)</li>
<li>From here the boot/article takes us on a whirlwind journey of Sessions, Windows, Panes and more. Every control-<X> command is covered, information on how to customize your statusbar, tips, tricks and the like. There’s far more here than we can cover in a single segment, but you are highly encouraged to bookmark this one and start your own adventure into the world of tmux.
***</li>
</ul>

<h3><a href="https://sdf.org/" rel="nofollow">SDF Celebrates 30 years of service in 2017</a></h3>

<ul>
<li><a href="https://news.ycombinator.com/item?id=13453774" rel="nofollow">HackerNews thread on SDF </a></li>
<li>“Super Dimension Fortress (SDF, also known as freeshell.org) is a non-profit public access UNIX shell provider on the Internet. It has been in continual operation since 1987 as a non-profit social club. The name is derived from the Japanese anime series The Super Dimension Fortress Macross; the original SDF server was a BBS for anime fans[1]. From its BBS roots, which have been well documented as part of the BBS: The Documentary project, SDF has grown into a feature-rich provider serving members around the world.”</li>
<li>A public access UNIX system, it was many people’s first access to a UNIX shell.</li>
<li>In the 90s, Virtual Machines were rare, the software to run them usually cost a lot of money and no one had very much memory to try to run two operating systems at the same time.</li>
<li>So for many people, these type of shell accounts were the only way they could access UNIX without having to replace the OS on their only computer</li>
<li>This is how I first started with UNIX, eventually moving to paying for access to bigger machines, and then buying my own servers and renting out shell accounts to host IRC servers and channel protection bots.</li>
<li>“On June 16th, 1987 Ted Uhlemann (handle: charmin, later iczer) connected his Apple ][e&#39;s 300 baud modem to the phone line his mother had just given him for his birthday. He had published the number the night before on as many BBSes around the Dallas Ft. Worth area that he could and he waited for the first caller. He had a copy of Magic Micro BBS which was written in Applesoft BASIC and he named the BBS &quot;SDF-1&quot; after his favorite Japanimation series ROBOTECH (Macross). He hoped to draw users who were interested in anime, industrial music and the Church of the Subgenius.”</li>
<li>I too started out in the world of BBSes before I had access to the internet. My parents got my a dedicated phone line for my birthday, so I wouldn’t tie up their line all the time. I quickly ended up running my own BBS, the Sudden Death BBS (<a href="https://en.wikipedia.org/wiki/Renegade_(BBS)" rel="nofollow">Renegade</a> on MS DOS)</li>
<li>I credit this early experience for my discovery of a passion for Systems Administration, that lead me to my current career</li>
<li>“Slowly, SDF has grown over all these years, never forgetting our past and unlike many sites on the internet, we actually have a past. Some people today may come here and see us as outdated and &quot;retro&quot;. But if you get involved, you&#39;ll see it is quite alive with new ideas and a platform for opportunity to try many new things. The machines are often refreshed, the quotas are gone, the disk space is expanding as are the features (and user driven features at that) and our cabinets have plenty of space for expansion here in the USA and in Europe (Germany).”</li>
<li>“Think about ways you&#39;d like to celebrate SDF&#39;s 30th and join us on the &#39;bboard&#39; to discuss what we could do. I realize many of you have likely moved on yourselves, but I just wanted you to know we&#39;re still here and we&#39;ll keep doing new and exciting things with a foundation in the UNIX shell.”
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/NetBSD/comments/5mtsy1/getting_minecraft_to_run_on_netbsd/" rel="nofollow">Getting Minecraft to Run on NetBSD</a></h3>

<ul>
<li>One thing that doesn’t come up often on BSDNow is the idea of gaming. I realize most of us are server folks, or perhaps don’t play games (The PC is for work, use your fancy-smanzy PS4 and get off my lawn you kids)</li>
<li>Today I thought it would be fun to highlight this post over at Reddit talking about running MineCraft on NetBSD</li>
<li>Now I realize this may not be news to some of you, but perhaps it is to others. For the record my kids have been playing Minecraft on PC-BSD / TrueOS for years. It&#39;s the primary reason they are more often booted into that instead of Windows. (Funny story behind that - Got sick of all the 3rd party mods, which more often than not came helpfully bundled with viruses and malware)</li>
<li>On NetBSD the process looks a bit different than on FreeBSD. First up, you’ll need to enable Linux Emulation and install Oracle JRE (Not OpenJDK, that path leads to sadness here)</li>
<li>The guide will then walk us through the process of fetching the Linux runtime packages, extracting and then enabling bits such as ‘procfs’ that is required to run the Linux binaries. </li>
<li>Once that&#39;s done, minecraft is only a simple “oracle8-jre /path/to/minecraft.jar” command away from starting up, and you’ll be “crafting” in no time. (Does anybody even play survival anymore?)
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://youtu.be/g7P16mYDIJw" rel="nofollow">UNIX on the Computer Chronicals </a> </p></li>
<li><p><a href="https://twitter.com/erikarn/status/823298416939659264" rel="nofollow">FreeBSD: Atheros AR9380 and later, maximum UDP TX goes from 250mbit to 355mbit. </a> </p></li>
<li><p><a href="https://reviews.freebsd.org/D9303" rel="nofollow">Capsicumizing traceroute with casper </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/Sr1BTzVN" rel="nofollow"> Jason - TarSnap on Windows</a> </li>
<li><a href="http://pastebin.com/zpHyhHQG" rel="nofollow"> Mike - OpenRC &amp; DO</a> </li>
<li><a href="http://pastebin.com/YnjkrDmk" rel="nofollow"> Anonymous - Old Machines</a> </li>
<li><a href="http://pastebin.com/pBUXtFak" rel="nofollow"> Matt - Iocage</a> </li>
<li><a href="http://pastebin.com/zNkK3epM" rel="nofollow"> Hjalti - Rclone &amp; FreeNAS</a> </li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSD Now, we will be discussing a wide variety of topics including Routers, Run-Controls, the “Rule” of silence and some</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.reddit.com/r/freebsd/comments/5ouvmp/ports_no_longer_build_on_eol_freebsd_versions/" rel="nofollow">Ports no longer build on EOL FreeBSD versions</a></h3>

<ul>
<li>The FreeBSD ports tree has been updated to automatically fail if you try to compile ports on EOL versions of FreeBSD (any version of 9.x or earlier, 10.0 - 10.2, or 11 from before 11.0)</li>
<li>This is to prevent shooting yourself in the food, as the compatibility code for those older OSes has been removed now that they are no longer supported.</li>
<li>If you use pkg, you will also run into problems on old releases. Packages are always built on the oldest supported release in a branch. Until recently, this meant packages for 10.1, 10.2, and 10.3 were compiled on 10.1. Now that 10.1 and 10.2 are EOL, packages for 10.x are compiled on 10.3.</li>
<li>This matters because 10.3 supports the new openat() and various other *at() functions used by capsicum. Now that pkg and packages are built on a version that supports this new feature, they will not run on systems that do not support it. So pkg will exit with an error as soon as it tries to open a file.</li>
<li>You can work around this temporarily by using the pkg-static command, but you should upgrade to a supported release immediately.
***</li>
</ul>

<h3><a href="https://www.trueos.org/blog/improving-trueos-openrc/" rel="nofollow">Improving TrueOS: OpenRC</a></h3>

<ul>
<li>With TrueOS moving to a rolling-release model, we’ve decided to be a bit more proactive in sharing news about new features that are landing. </li>
<li>This week we’ve posted an article talking about the transition to OpenRC</li>
<li>In past episodes you’ve heard me mention OpenRC, but hopefully today we can help answer any of those lingering questions you may still have about it</li>
<li>The first thing always asked, is “What is OpenRC?”</li>
</ul>

<blockquote>
<p>OpenRC is a dependency-based init system working with the system provided init program. It is used with several Linux distributions, including Gentoo and Alpine Linux. However, OpenRC was created by the NetBSD developer Roy Marples in one of those interesting intersections of Linux and BSD development. OpenRC’s development history, portability, and 2-clause BSD license make its integration into TrueOS an easy decision.</p>
</blockquote>

<ul>
<li>Now that we know a bit about what it is, how does it behave differently than traditional RC?</li>
</ul>

<blockquote>
<p>TrueOS now uses OpenRC to manage all system services, as opposed to FreeBSD’s RC. Instead of using rc.d for base system rc scripts, OpenRC uses init.d. Also, every service in OpenRC has its own user configuration file, located in /etc/conf.d/ for the base system and /usr/local/etc.conf.d/ for ports. Finally, OpenRC uses runlevels, as opposed to the FreeBSD single- or multi- user modes. You can view the services and their runlevels by typing $ rc-update show -v in a CLI. Also, TrueOS integrates OpenRC service management into SysAdm with the Service Manager tool</p>
</blockquote>

<ul>
<li><p>One of the prime benefits of OpenRC is much faster boot-times, which is important in a portable world of laptops (and desktops as well). But service monitoring and crash detection are also important parts of what make OpenRC a substantial upgrade for TrueOS.</p></li>
<li><p>Lastly people have asked us about migration, what is done, what isn’t? As of now almost all FreeBSD base system services have been migrated over. In addition most desktop-facing services required to run Lumina and the like are also ported. We are still going through the ports tree and converting legacy rc.d scripts to init.d, but the process takes time. Several new folks have begun contributing OpenRC scripts and we hope to have all the roughly 1k ports converted over this year. </p>

<hr></li>
</ul>

<h3><a href="https://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.70/" rel="nofollow">BSDRP Releases 1.70  </a></h3>

<ul>
<li>A new release of the BSD Router Project</li>
<li>This distro is designed to replace high end routers, like those from Cisco and Juniper, with FreeBSD running on regular off-the-shelf server.</li>
<li>Highlights:

<ul>
<li>Upgraded to FreeBSD 11.0-STABLE r312663 (skip 11.0 for massive performance improvement)</li>
<li>Re-Added: netmap-fwd (<a href="https://github.com/Netgate/netmap-fwd" rel="nofollow">https://github.com/Netgate/netmap-fwd</a>)</li>
<li>Add FIBsync patch to netmap-fwd from Zollner Robert <wolfit_ro@yahoo.com></li>
<li>netmap pkt-gen supports IPv6, thanks to Andrey V. Elsukov (<a href="mailto:ae@freebsd.org" rel="nofollow">ae@freebsd.org</a>)</li>
<li>bird 1.6.3 (add BGP Large communities support)</li>
<li>OpenVPN 2.4.0 (adds the high speed AEAD GCM cipher)</li>
</ul></li>
<li>All of the other packages have also been upgraded</li>
<li>A lot of great work has been done on BSDRP, and it has also generated a lot of great benchmarks and testing that have resulted in performance increases and improved understanding of how FreeBSD networking scales across different CPU types and speeds
***</li>
</ul>

<h3><a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/7b1aa074fcd99442a1345fb8a695b62d01d9c7fd" rel="nofollow">DragonFlyBSD gets UEFI support</a></h3>

<ul>
<li>This commit adds support for UEFI to the Dragonfly Installer, allowing new systems to be installed to boot from UEFI</li>
<li><a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/9d53bd00e9be53d6b893afd79111370ee0c053b0" rel="nofollow">This script</a> provides a way to build a HAMMER filesystem that works with UEFI</li>
<li>There is also a <a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d195d5099328849c500d4a1b94d6915d3c72c71e" rel="nofollow">UEFI man page</a> </li>
<li>The <a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/5fa778d7b36ab0981ff9dcbd96c71ebf653a6a19" rel="nofollow">install media</a> has also been updated to support booting from either UEFI or MBR, in the same way that the FreeBSD images work
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.linfo.org/rule_of_silence.html" rel="nofollow">The Rule of Silence</a></h3>

<ul>
<li>“The rule of silence, also referred to as the silence is golden rule, is an important part of the Unix philosophy that states that when a program has nothing surprising, interesting or useful to say, it should say nothing. It means that well-behaved programs should treat their users&#39; attention and concentration as being valuable and thus perform their tasks as unobtrusively as possible. That is, silence in itself is a virtue.”</li>
<li>This doesn’t mean a program cannot be verbose, it just means you have to ask it for the additional output, rather than having it by default</li>
<li>“There is no single, standardized statement of the Unix philosophy, but perhaps the simplest description would be: &quot;Write programs that are small, simple and transparent. Write them so that they do only one thing, but do it well and can work together with other programs.&quot; That is, the philosophy centers around the concepts of smallness, simplicity, modularity, craftsmanship, transparency, economy, diversity, portability, flexibility and extensibility.”</li>
<li>“This philosophy has been fundamental to the the fact that Unix-like operating systems have been thriving for more than three decades, far longer than any other family of operating systems, and can be expected to see continued expansion of use in the years to come”</li>
<li>“The rule of silence is one of the oldest and most persistent design rules of such operating systems. As intuitive as this rule might seem to experienced users of such systems, it is frequently ignored by the developers of other types of operating systems and application programs for them. The result is often distraction, annoyance and frustration for users.”</li>
<li>“There are several very good reasons for the rule of silence: (1) One is to avoid cluttering the user&#39;s mind with information that might not be necessary or might not even be desired. That is, unnecessary information can be a distraction. Moreover, unnecessary messages generated by some operating systems and application programs are sometimes poorly worded, and can cause confusion or needless worry on the part of users.”</li>
<li>No news is good news. When there is bad news, error messages should be descriptive, and ideally tell the user what they might do about the error.</li>
<li>“A third reason is that command line programs (i.e., all-text mode programs) on Unix-like operating systems are designed to work together with pipes, i.e., the output from one program becomes the input of another program. This is a major feature of such systems, and it accounts for much of their power and flexibility. Consequently, it is important to have only the truly important information included in the output of each program, and thus in the input of the next program.”</li>
<li>Have you ever had to try to strip out useless output so you could feed that data into another program?</li>
<li>“The rule of silence originally applied to command line programs, because all programs were originally command line programs. However, it is just as applicable to GUI (graphical user interfaces) programs. That is, unnecessary and annoying information should be avoided regardless of the type of user interface.”</li>
<li>“A example is the useless and annoying dialog boxes (i.e., small windows) that pop up on the display screen with with surprising frequency on some operating systems and programs. These dialog boxes contain some obvious, cryptic or unnecessary message and require the user to click on them in order to close them and proceed with work. This is an interruption of concentration and a waste of time for most users. Such dialog boxes should be employed only in situations in which some unexpected result might occur or to protect important data.”</li>
<li>It goes on to make an analogy about Public Address systems. If too many unimportant messages, like advertisements, are sent over the PA system, people will start to ignore them, and miss the important announcements.
***</li>
</ul>

<h3><a href="https://leanpub.com/the-tao-of-tmux/read" rel="nofollow">The Tao of tmux</a></h3>

<ul>
<li>An interesting article floated across my news feed a few weeks back. It’s what essentially boils down to a book called the “Tao of tmux”, which immediately piqued my interest.</li>
<li>My story may be similar to many of yours. I was initially raised on using screen, and screen only for my terminal session and multiplexing needs.</li>
<li>Since then I’ve only had a passing interest in tmux, but its always been one of those utilities I felt was worthy of investing some more time into. (Especially when seeing some of the neat setups some of my peers have with it)</li>
<li>Needless to say, this article has been bookmarked, and I’ve started digesting some of it, but thought it would be good to share with anybody else who finds them-self in a similar situation.</li>
<li>The book starts off well, explaining in the simplest terms possible what Tmux really is, by comparing and contrasting it to something we are all familiar with, GUIS!</li>
<li>Helpfully they also include a chart which explains some of the terms we will be using frequently when discussing tmux (<a href="https://leanpub.com/the-tao-of-tmux/read#leanpub-auto-window-manager-for-the-terminal" rel="nofollow">https://leanpub.com/the-tao-of-tmux/read#leanpub-auto-window-manager-for-the-terminal</a>) </li>
<li>One of the things the author does recommend is also making sure you are up to speed on your Terminal knowledge.</li>
</ul>

<blockquote>
<p>Before getting into tmux, a few fundamentals of the command line should be reviewed. Often, we’re so used to using these out of street smarts and muscle memory a great deal of us never see the relation of where these tools stand next to each other.</p>

<p>Seasoned developers are familiar with zsh, Bash, iTerm2, konsole, /dev/tty, shell scripting, and so on. If you use tmux, you’ll be around these all the time, regardless of whether you’re in a GUI on a local machine or SSH’ing into a remote server.</p>

<p>If you want to learn more about how processes and TTY’s work at the kernel level (data structures and all) the book The Design and Implementation of the FreeBSD Operating System (2nd Edition) by Marshall Kirk McKusick is nice. In particular, Chapter 4, Process Management and Section 8.6, Terminal Handling. The TTY demystified by Linus Åkesson (available online) dives into the TTY and is a good read as well.</p>
</blockquote>

<ul>
<li>We had to get that shout-out of Kirk’s book in here ;)</li>
<li>From here the boot/article takes us on a whirlwind journey of Sessions, Windows, Panes and more. Every control-<X> command is covered, information on how to customize your statusbar, tips, tricks and the like. There’s far more here than we can cover in a single segment, but you are highly encouraged to bookmark this one and start your own adventure into the world of tmux.
***</li>
</ul>

<h3><a href="https://sdf.org/" rel="nofollow">SDF Celebrates 30 years of service in 2017</a></h3>

<ul>
<li><a href="https://news.ycombinator.com/item?id=13453774" rel="nofollow">HackerNews thread on SDF </a></li>
<li>“Super Dimension Fortress (SDF, also known as freeshell.org) is a non-profit public access UNIX shell provider on the Internet. It has been in continual operation since 1987 as a non-profit social club. The name is derived from the Japanese anime series The Super Dimension Fortress Macross; the original SDF server was a BBS for anime fans[1]. From its BBS roots, which have been well documented as part of the BBS: The Documentary project, SDF has grown into a feature-rich provider serving members around the world.”</li>
<li>A public access UNIX system, it was many people’s first access to a UNIX shell.</li>
<li>In the 90s, Virtual Machines were rare, the software to run them usually cost a lot of money and no one had very much memory to try to run two operating systems at the same time.</li>
<li>So for many people, these type of shell accounts were the only way they could access UNIX without having to replace the OS on their only computer</li>
<li>This is how I first started with UNIX, eventually moving to paying for access to bigger machines, and then buying my own servers and renting out shell accounts to host IRC servers and channel protection bots.</li>
<li>“On June 16th, 1987 Ted Uhlemann (handle: charmin, later iczer) connected his Apple ][e&#39;s 300 baud modem to the phone line his mother had just given him for his birthday. He had published the number the night before on as many BBSes around the Dallas Ft. Worth area that he could and he waited for the first caller. He had a copy of Magic Micro BBS which was written in Applesoft BASIC and he named the BBS &quot;SDF-1&quot; after his favorite Japanimation series ROBOTECH (Macross). He hoped to draw users who were interested in anime, industrial music and the Church of the Subgenius.”</li>
<li>I too started out in the world of BBSes before I had access to the internet. My parents got my a dedicated phone line for my birthday, so I wouldn’t tie up their line all the time. I quickly ended up running my own BBS, the Sudden Death BBS (<a href="https://en.wikipedia.org/wiki/Renegade_(BBS)" rel="nofollow">Renegade</a> on MS DOS)</li>
<li>I credit this early experience for my discovery of a passion for Systems Administration, that lead me to my current career</li>
<li>“Slowly, SDF has grown over all these years, never forgetting our past and unlike many sites on the internet, we actually have a past. Some people today may come here and see us as outdated and &quot;retro&quot;. But if you get involved, you&#39;ll see it is quite alive with new ideas and a platform for opportunity to try many new things. The machines are often refreshed, the quotas are gone, the disk space is expanding as are the features (and user driven features at that) and our cabinets have plenty of space for expansion here in the USA and in Europe (Germany).”</li>
<li>“Think about ways you&#39;d like to celebrate SDF&#39;s 30th and join us on the &#39;bboard&#39; to discuss what we could do. I realize many of you have likely moved on yourselves, but I just wanted you to know we&#39;re still here and we&#39;ll keep doing new and exciting things with a foundation in the UNIX shell.”
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/NetBSD/comments/5mtsy1/getting_minecraft_to_run_on_netbsd/" rel="nofollow">Getting Minecraft to Run on NetBSD</a></h3>

<ul>
<li>One thing that doesn’t come up often on BSDNow is the idea of gaming. I realize most of us are server folks, or perhaps don’t play games (The PC is for work, use your fancy-smanzy PS4 and get off my lawn you kids)</li>
<li>Today I thought it would be fun to highlight this post over at Reddit talking about running MineCraft on NetBSD</li>
<li>Now I realize this may not be news to some of you, but perhaps it is to others. For the record my kids have been playing Minecraft on PC-BSD / TrueOS for years. It&#39;s the primary reason they are more often booted into that instead of Windows. (Funny story behind that - Got sick of all the 3rd party mods, which more often than not came helpfully bundled with viruses and malware)</li>
<li>On NetBSD the process looks a bit different than on FreeBSD. First up, you’ll need to enable Linux Emulation and install Oracle JRE (Not OpenJDK, that path leads to sadness here)</li>
<li>The guide will then walk us through the process of fetching the Linux runtime packages, extracting and then enabling bits such as ‘procfs’ that is required to run the Linux binaries. </li>
<li>Once that&#39;s done, minecraft is only a simple “oracle8-jre /path/to/minecraft.jar” command away from starting up, and you’ll be “crafting” in no time. (Does anybody even play survival anymore?)
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://youtu.be/g7P16mYDIJw" rel="nofollow">UNIX on the Computer Chronicals </a> </p></li>
<li><p><a href="https://twitter.com/erikarn/status/823298416939659264" rel="nofollow">FreeBSD: Atheros AR9380 and later, maximum UDP TX goes from 250mbit to 355mbit. </a> </p></li>
<li><p><a href="https://reviews.freebsd.org/D9303" rel="nofollow">Capsicumizing traceroute with casper </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/Sr1BTzVN" rel="nofollow"> Jason - TarSnap on Windows</a> </li>
<li><a href="http://pastebin.com/zpHyhHQG" rel="nofollow"> Mike - OpenRC &amp; DO</a> </li>
<li><a href="http://pastebin.com/YnjkrDmk" rel="nofollow"> Anonymous - Old Machines</a> </li>
<li><a href="http://pastebin.com/pBUXtFak" rel="nofollow"> Matt - Iocage</a> </li>
<li><a href="http://pastebin.com/zNkK3epM" rel="nofollow"> Hjalti - Rclone &amp; FreeNAS</a> </li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>177: Getting Pi on my Wifi</title>
  <link>https://www.bsdnow.tv/177</link>
  <guid isPermaLink="false">5a206fe8-bd5f-49b2-9eb2-31a50cafedc3</guid>
  <pubDate>Wed, 18 Jan 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5a206fe8-bd5f-49b2-9eb2-31a50cafedc3.mp3" length="56667604" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we’ve got Wifi galore, a new iocage and some RPi3 news and guides to share. Stay tuned for your place to B...SD!</itunes:subtitle>
  <itunes:duration>1:18:42</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we’ve got Wifi galore, a new iocage and some RPi3 news and guides to share. Stay tuned for your place to B...SD!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
WiFi: 11n hostap mode added to athn(4) driver, testers wanted (http://undeadly.org/cgi?action=article&amp;amp;sid=20170109213803)
“OpenBSD as WiFi access points look set to be making a comeback in the near future”
“Stefan Sperling added 802.11n hostap mode, with full support initially for the Atheros chips supported by the athn(4) driver.”
 “Hostap performance is not perfect yet but should be no worse than 11a/b/g modes in the same environment.”
“For Linux clients a fix for WME params is needed which I also posted to tech@”
“This diff does not modify the known-broken and disabled ar9003 code, apart from making sure it still builds.”
“I'm looking for both tests and OKs.”
There has also been a flurry of work (http://svnweb.freebsd.org/base/head/sys/net80211/?view=log)  in FreeBSD on the ath10k driver, which supports 802.11ac
Like this one (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=310147) and this one (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=311579)
The long-awaited iocage update has landed (https://github.com/iocage/iocage)
We’ve hinted at the new things happening behind the scenes with iocage, and this last week the code has made its first public debut. 
So what’s changed you may ask. The biggest is that iocage has undergone a complete overhaul, moving from its original shell-base to python.  
The story behind that is that the author (Brandon) works at iXsystems, and the plan is to move away from the legacy warden-based jail management which was also shell-based.  
This new python re-write will allow it to integrate into FreeNAS (and other projects) better by exposing an API for all jail management tasks. Thats right, no more ugly CLI output parsing just to wrangle jail options either at creation or runtime. 
But what about users who just run iocage manually from the CLI? No worries, the new iocage is almost identical to the original CLI usage, making the switch over very simple.
Just to re-cap, lets look at the new features list:
“FEATURES:
+ Ease of use
+ Rapid jail creation within seconds
+ Automatic package installation
+ Virtual networking stacks (vnet)
+ Shared IP based jails (non vnet)
+ Transparent ZFS snapshot management
+ Export and import
“
+ The new iocage is available now via ports and packages under sysutils/py-iocage, give it a spin and be sure to report issues back to the developer(s).
Reading DHT11 temperature sensors on a Raspberry Pi under FreeBSD  (https://smallhacks.wordpress.com/2017/01/14/reading-dht11-temperature-sensor-on-raspberry-pi-under-freebsd/)
“DHT-11 is a very cheap temperature/humidity sensor which is commonly used in the IoT devices. It is not very accurate, so for the accurate measurement i would recommend to use DHT21 instead. Anyway, i had DHT-11 in my tool box, so decided to start with it. DHT-11 using very simple 1 wire protocol – host is turning on chip by sending 18ms low signal to the data output and then reading 40 bytes of data.”
“To read data from the chip it should be connected to the power (5v) and gpio pin. I used pin 2 as VCC, 6 as GND and 11 as GPIO”
“There is no support for this device out of the box on FreeBSD. I found some sample code on the github, see lex/freebsd-gpio-dht11 (https://github.com/lex/freebsd-gpio-dht11) repository. This code was a good starting point, but soon i found 2 issues with it:
Results are very unreliable, probably due to gpio decoding algorithm.
Checksum is not validated, so sometime values are bogus.
“Initially i was thinking to fix this myself, but later found kernel module for this purpose, 1 wire over gpio (http://www.my-tour.ru/FreeBSD/1-wire_over_gpio/). This module contains DHT11 kernel driver (gpio_sw) which implements DHT-11 protocol in the kernel space and exporting /dev/sw0 for the userland. Driver compiles on FreeBSD11/ARM without any changes. Use make install to install the driver.”
The articles goes into how to install and configure the driver, including a set of devfs rules to allow non-root users to read from the sensor
“Final goal was to add this sensor to the domoticz software. It is using LUA scripting to extend it functionality, e.g. to obtain data from non-supported or non standard devices. So, i decided to read /dev/sw0 from the LUA.”
They ran into some trouble with LUA trying to read too much data at once, and had to work around it
In the end, they got the results and were able to use them in the monitoring tool
***
Tor-ified Home Network using HardenedBSD and a RPi3 (https://github.com/lattera/articles/blob/master/infosec/tor/2017-01-14_torified_home/article.md)
Shawn from HardendBSD has posted an article up on GitHub talking about his deployment of a new Tor relay on a RPi3
This particular method was attractive, since it allows running a Relay, but without it being on a machine which may have personal data, such as SSH keys, files, etc
While his setup is done on HardendBSD, the same applies to a traditional FreeBSD setup as well. 
First up, is the list of things needed for this project:
Raspberry Pi 3 Model B Rev 1.2 (aka, RPI3)
Serial console cable for the RPI3
Belkin F4U047 USB Ethernet Dongle
Insignia NS-CR2021 USB 2.0 SD/MMC Memory Card Reader
32GB SanDisk Ultra PLUS MicroSDHC
A separate system, running FreeBSD or HardenedBSD
HardenedBSD clang 4.0.0 image for the RPI3
An external drive to be formatted
A MicroUSB cable to power the RPI3
Two network cables
Optional: Edimax N150 EW-7811Un Wireless USB
Basic knowledge of vi
After getting HBSD running on the RPi3 and serial connection established, he then takes us through the process of installing and enabling the various services needed. (Don’t forget to growfs your sdcard first!)
Now the tricky part is that some of the packages needed to be compiled from ports, which is somewhat time-consuming on a RPi. He strongly recommends not compiling on the sdcard (it sounds like personal experience has taught him well) and to use iscsi or some external USB drive. 
With the compiling done, our package / software setup is nearly complete. Next up is firewalling the box, which he helpfully provides a full PF config setup that we can copy-n-paste here.
The last bits will be enabling the torrc configuration knobs, which if you follow his example again, will result in a tor public relay, and a local transparent proxy for you.
Bonus! Shawn helpfully provides DHCPD configurations, and even Wireless AP configurations, if you want to setup your RPi3 to proxy for devices that connect to 
it.
***
News Roundup
Unix Admin. Horror Story Summary, version 1.0 (http://www-uxsup.csx.cam.ac.uk/misc/horror.txt)
A great collection of stories, many of which will ring true with our viewers
The very first one, is about a user changing root’s shell to /usr/local/bin/tcsh but forgetting to make it executable, resulting in not being able to login as root.
I too have run into this issue, in a slightly different way. I had tcsh as my user shell (back before tcsh was in base), and after a major OS upgrade, but before I had a chance to recompile all of my ports. Now I couldn’t ssh in to the remote machine in order to recompile my shell. Now I always use a shell included in the base system, and test it before rebooting after an upgrade.
“Our operations group, a VMS group but trying to learn UNIX, was assigned account administration. They were cleaning up a few non-used accounts like they do on VMS - backup and purge. When they came across the account "sccs", which had never been accessed, away it went. The "deleteuser" utility from DEC asks if you would like to delete all the files in the account. Seems reasonable, huh? Well, the home directory for "sccs" is "/". Enough said :-(“
“I was working on a line printer spooler, which lived in /etc.  I wanted to remove it, and so issued the command "rm /etc/lpspl."  There was only one problem.  Out of habit, I typed "passwd" after "/etc/" and removed the password file.  Oops.”
I’ve done things like this as well. Finger memory can be dangerous
“I was happily churning along developing something on a Sun workstation, and was getting a number of annoying permission denieds from trying to write into a directory heirarchy that I didn't own.  Getting tired of that, I decided to set the permissions on that subtree to 777 while I was working, so I wouldn't have to worry about it.  Someone had recently told me that rather than using plain "su", it was good to use "su -", but the implications had not yet sunk in.  (You can probably see where this is going already, but I'll go to the bitter end.)  Anyway, I cd'd to where I wanted to be, the top of my subtree, and did su -.  Then I did chmod -R 777.  I then started to wonder why it was taking so damn long when there were only about 45 files in 20 directories under where I (thought) I was.  Well, needless to say, su - simulates a real login, and had put me into root's home directory, /, so I was proceeding to set file permissions for the whole system to wide open. I aborted it before it finished, realizing that something was wrong, but this took quite a while to straighten out.”
Where is a ZFS snapshot when you need it?
***
How individual contributors get stuck (https://medium.com/@skamille/how-do-individual-contributors-get-stuck-63102ba43516)
An interesting post looking at the common causes of people getting stuck when trying to create or contribute new code
Brainstorming/architecture: “I must have thought through all edge cases of all parts of everything before I can begin this project”
Researching possible solutions forever (often accompanied by desire to do a “bakeoff” where they build prototypes in different platforms/languages/etc)
Refactoring: “this code could be cleaner and everything would be just so much easier if we cleaned this up… and this up… and…”
Helping other people instead of doing their assigned tasks (this one isn’t a bad thing in an open source community)
Working on side projects instead of the main project (it is your time, it is up to you how to spend it)
Excessive testing (rare)
Excessive automation (rare)
Finish the last 10–20% of a project
Start a project completely from scratch
Do project planning (You need me to write what now? A roadmap?) (this is why FreeBSD has devsummits, some things you just need to whiteboard)
Work with unfamiliar code/libraries/systems
Work with other teams (please don’t make me go sit with data engineering!!)
Talk to other people
Ask for help (far beyond the point they realized they were stuck and needed help)
Deal with surprises or unexpected setbacks
Deal with vendors/external partners
Say no, because they can’t seem to just say no (instead of saying no they just go into avoidance mode, or worse, always say yes)
“Noticing how people get stuck is a super power, and one that many great tech leads (and yes, managers) rely on to get big things done. When you know how people get stuck, you can plan your projects to rely on people for their strengths and provide them help or even completely side-step their weaknesses. You know who is good to ask for which kinds of help, and who hates that particular challenge just as much as you do.”
“The secret is that all of us get stuck and sidetracked sometimes. There’s actually nothing particularly “bad” about this. Knowing the ways that you get hung up is good because you can choose to either a) get over the fears that are sticking you (lack of knowledge, skills, or confidence), b) avoid such tasks as much as possible, and/or c) be aware of your habits and use extra diligence when faced with tackling these areas.”
***
Make Docs! (http://www.mkdocs.org/)
“MkDocs is a fast, simple and downright gorgeous static site generator that's geared towards building project documentation. Documentation source files are written in Markdown, and configured with a single YAML configuration file.”
“MkDocs builds completely static HTML sites that you can host on GitHub pages, Amazon S3, or anywhere else you choose”
It is an easy to install python package
It includes a server mode that auto-refreshes the page as you write the docs, making it easy to preview your work before you post it online
Everything needs docs, and writing docs should be as simple as possible, so that more of them will get written
Go write some docs!
***
Experimental FreeNAS 11/12 builds (https://forums.freenas.org/index.php?threads/new-freenas-9-10-with-freebsd-11-12-for-testing.49696/#post-341941)
We know there’s a lot of FreeNAS users who listen to BSDNow, so I felt it was important to share this little tidbit.
I’ve posted something to the forums last night which includes links to brand-new spins of FreeNAS 9.10 based upon FreeBSD 11/stable and 12/current. 
These builds are updated nightly via our Jenkins infrastructure and hopefully will provide a new playground for technical folks and developers to experiment with FreeBSD features in their FreeNAS environment, long before they make it into a -STABLE release. 
As usual, the notes of caution do apply, these are nightlies, and as such bugs will abound. Do NOT use these with your production data, unless you are crazy, or just want an excuse to test your backup strategy
If you do run these builds, of course feedback is welcome via the usual channels, such as the bug tracker. 
The hope is that by testing FreeBSD code earlier, we can vet and determine what is safe / ready to go into mainline FreeNAS sooner rather than later.
***
Beastie Bits
An Explainer on Unix’s Most Notorious Code Comment (http://thenewstack.io/not-expected-understand-explainer/) 
turn your network inside out with one pf.conf trick (http://www.tedunangst.com/flak/post/turn-your-network-inside-out-with-one-pfconf-trick)
A story of if_get(9) (http://www.grenadille.net/post/2017/01/13/A-story-of-if_get%289%29)
Apple re-affirms its commitment to LLVM/Clang  (http://lists.llvm.org/pipermail/llvm-dev/2017-January/108953.html) 
python 3k17 (http://www.tedunangst.com/flak/post/python-3k17)
2017 presentation proposals (http://blather.michaelwlucas.com/archives/2848) 
NetBSD 7.1_RC1 available (http://mail-index.netbsd.org/netbsd-announce/2017/01/09/msg000259.html)
#define FSUFS2MAGIC 0x19540119 (Happy Birthday to Kirk McKusick tomorrow)
***
Feedback/Questions
 J - LetsEncrypt (http://pastebin.com/nnQ9ZgyN) 
 Mike - OpenRC (http://pastebin.com/EZ4tRiVb) 
 Timothy - ZFS Horror (http://pastebin.com/ZqDFTsnR) 
 Troels (http://pastebin.com/dhZEnREM) 
 Jason - Disk Label (http://pastebin.com/q4F95S6h) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we’ve got Wifi galore, a new iocage and some RPi3 news and guides to share. Stay tuned for your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170109213803" rel="nofollow">WiFi: 11n hostap mode added to athn(4) driver, testers wanted</a></h3>

<ul>
<li>“OpenBSD as WiFi access points look set to be making a comeback in the near future”</li>
<li>“Stefan Sperling added 802.11n hostap mode, with full support initially for the Atheros chips supported by the athn(4) driver.”</li>
<li> “Hostap performance is not perfect yet but should be no worse than 11a/b/g modes in the same environment.”</li>
<li>“For Linux clients a fix for WME params is needed which I also posted to tech@”</li>
<li>“This diff does not modify the known-broken and disabled ar9003 code, apart from making sure it still builds.”</li>
<li><p>“I&#39;m looking for both tests and OKs.”</p></li>
<li><p>There has also been a <a href="http://svnweb.freebsd.org/base/head/sys/net80211/?view=log" rel="nofollow">flurry of work</a>  in FreeBSD on the ath10k driver, which supports 802.11ac</p></li>
<li><p>Like <a href="https://svnweb.freebsd.org/base?view=revision&revision=310147" rel="nofollow">this one</a> and <a href="https://svnweb.freebsd.org/base?view=revision&revision=311579" rel="nofollow">this one</a></p>

<hr></li>
</ul>

<h3><a href="https://github.com/iocage/iocage" rel="nofollow">The long-awaited iocage update has landed</a></h3>

<ul>
<li>We’ve hinted at the new things happening behind the scenes with iocage, and this last week the code has made its first public debut. </li>
<li>So what’s changed you may ask. The biggest is that iocage has undergone a complete overhaul, moving from its original shell-base to python.<br></li>
<li>The story behind that is that the author (Brandon) works at iXsystems, and the plan is to move away from the legacy warden-based jail management which was also shell-based.<br></li>
<li>This new python re-write will allow it to integrate into FreeNAS (and other projects) better by exposing an API for all jail management tasks. Thats right, no more ugly CLI output parsing just to wrangle jail options either at creation or runtime. </li>
<li>But what about users who just run iocage manually from the CLI? No worries, the new iocage is almost identical to the original CLI usage, making the switch over very simple.</li>
<li>Just to re-cap, lets look at the new features list:</li>
</ul>

<p>“FEATURES:</p>

<ul>
<li>Ease of use</li>
<li>Rapid jail creation within seconds</li>
<li>Automatic package installation</li>
<li>Virtual networking stacks (vnet)</li>
<li>Shared IP based jails (non vnet)</li>
<li>Transparent ZFS snapshot management</li>
<li>Export and import
“</li>
<li>The new iocage is available now via ports and packages under sysutils/py-iocage, give it a spin and be sure to report issues back to the developer(s).
***</li>
</ul>

<h3><a href="https://smallhacks.wordpress.com/2017/01/14/reading-dht11-temperature-sensor-on-raspberry-pi-under-freebsd/" rel="nofollow">Reading DHT11 temperature sensors on a Raspberry Pi under FreeBSD </a></h3>

<ul>
<li>“DHT-11 is a very cheap temperature/humidity sensor which is commonly used in the IoT devices. It is not very accurate, so for the accurate measurement i would recommend to use DHT21 instead. Anyway, i had DHT-11 in my tool box, so decided to start with it. DHT-11 using very simple 1 wire protocol – host is turning on chip by sending 18ms low signal to the data output and then reading 40 bytes of data.”</li>
<li>“To read data from the chip it should be connected to the power (5v) and gpio pin. I used pin 2 as VCC, 6 as GND and 11 as GPIO”</li>
<li>“There is no support for this device out of the box on FreeBSD. I found some sample code on the github, see <a href="https://github.com/lex/freebsd-gpio-dht11" rel="nofollow">lex/freebsd-gpio-dht11</a> repository. This code was a good starting point, but soon i found 2 issues with it:

<ul>
<li>Results are very unreliable, probably due to gpio decoding algorithm.</li>
</ul></li>
<li>Checksum is not validated, so sometime values are bogus.</li>
<li>“Initially i was thinking to fix this myself, but later found kernel module for this purpose, <a href="http://www.my-tour.ru/FreeBSD/1-wire_over_gpio/" rel="nofollow">1 wire over gpio</a>. This module contains DHT11 kernel driver (gpio_sw) which implements DHT-11 protocol in the kernel space and exporting /dev/sw0 for the userland. Driver compiles on FreeBSD11/ARM without any changes. Use make install to install the driver.”</li>
<li>The articles goes into how to install and configure the driver, including a set of devfs rules to allow non-root users to read from the sensor</li>
<li>“Final goal was to add this sensor to the domoticz software. It is using LUA scripting to extend it functionality, e.g. to obtain data from non-supported or non standard devices. So, i decided to read /dev/sw0 from the LUA.”</li>
<li>They ran into some trouble with LUA trying to read too much data at once, and had to work around it</li>
<li>In the end, they got the results and were able to use them in the monitoring tool
***</li>
</ul>

<h3><a href="https://github.com/lattera/articles/blob/master/infosec/tor/2017-01-14_torified_home/article.md" rel="nofollow">Tor-ified Home Network using HardenedBSD and a RPi3</a></h3>

<ul>
<li>Shawn from HardendBSD has posted an article up on GitHub talking about his deployment of a new Tor relay on a RPi3</li>
<li>This particular method was attractive, since it allows running a Relay, but without it being on a machine which may have personal data, such as SSH keys, files, etc</li>
<li>While his setup is done on HardendBSD, the same applies to a traditional FreeBSD setup as well. </li>
<li>First up, is the list of things needed for this project:</li>
</ul>

<p>Raspberry Pi 3 Model B Rev 1.2 (aka, RPI3)<br>
Serial console cable for the RPI3<br>
Belkin F4U047 USB Ethernet Dongle<br>
Insignia NS-CR2021 USB 2.0 SD/MMC Memory Card Reader<br>
32GB SanDisk Ultra PLUS MicroSDHC<br>
A separate system, running FreeBSD or HardenedBSD<br>
HardenedBSD clang 4.0.0 image for the RPI3<br>
An external drive to be formatted<br>
A MicroUSB cable to power the RPI3<br>
Two network cables<br>
Optional: Edimax N150 EW-7811Un Wireless USB<br>
Basic knowledge of vi</p>

<ul>
<li>After getting HBSD running on the RPi3 and serial connection established, he then takes us through the process of installing and enabling the various services needed. (Don’t forget to growfs your sdcard first!)</li>
<li>Now the tricky part is that some of the packages needed to be compiled from ports, which is somewhat time-consuming on a RPi. He strongly recommends not compiling on the sdcard (it sounds like personal experience has taught him well) and to use iscsi or some external USB drive. </li>
<li>With the compiling done, our package / software setup is nearly complete. Next up is firewalling the box, which he helpfully provides a full PF config setup that we can copy-n-paste here.</li>
<li>The last bits will be enabling the torrc configuration knobs, which if you follow his example again, will result in a tor public relay, and a local transparent proxy for you.</li>
<li>Bonus! Shawn helpfully provides DHCPD configurations, and even Wireless AP configurations, if you want to setup your RPi3 to proxy for devices that connect to 
it.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www-uxsup.csx.cam.ac.uk/misc/horror.txt" rel="nofollow">Unix Admin. Horror Story Summary, version 1.0</a></h3>

<ul>
<li>A great collection of stories, many of which will ring true with our viewers</li>
<li>The very first one, is about a user changing root’s shell to /usr/local/bin/tcsh but forgetting to make it executable, resulting in not being able to login as root.</li>
<li>I too have run into this issue, in a slightly different way. I had tcsh as my user shell (back before tcsh was in base), and after a major OS upgrade, but before I had a chance to recompile all of my ports. Now I couldn’t ssh in to the remote machine in order to recompile my shell. Now I always use a shell included in the base system, and test it before rebooting after an upgrade.</li>
<li>“Our operations group, a VMS group but trying to learn UNIX, was assigned account administration. They were cleaning up a few non-used accounts like they do on VMS - backup and purge. When they came across the account &quot;sccs&quot;, which had never been accessed, away it went. The &quot;deleteuser&quot; utility from DEC asks if you would like to delete all the files in the account. Seems reasonable, huh? Well, the home directory for &quot;sccs&quot; is &quot;/&quot;. Enough said :-(“</li>
<li>“I was working on a line printer spooler, which lived in /etc.  I wanted to remove it, and so issued the command &quot;rm /etc/lpspl.&quot;  There was only one problem.  Out of habit, I typed &quot;passwd&quot; after &quot;/etc/&quot; and removed the password file.  Oops.”</li>
<li>I’ve done things like this as well. Finger memory can be dangerous</li>
<li>“I was happily churning along developing something on a Sun workstation, and was getting a number of annoying permission denieds from trying to write into a directory heirarchy that I didn&#39;t own.  Getting tired of that, I decided to set the permissions on that subtree to 777 while I was working, so I wouldn&#39;t have to worry about it.  Someone had recently told me that rather than using plain &quot;su&quot;, it was good to use &quot;su -&quot;, but the implications had not yet sunk in.  (You can probably see where this is going already, but I&#39;ll go to the bitter end.)  Anyway, I cd&#39;d to where I wanted to be, the top of my subtree, and did su -.  Then I did chmod -R 777.  I then started to wonder why it was taking so damn long when there were only about 45 files in 20 directories under where I (thought) I was.  Well, needless to say, su - simulates a real login, and had put me into root&#39;s home directory, /, so I was proceeding to set file permissions for the whole system to wide open. I aborted it before it finished, realizing that something was wrong, but this took quite a while to straighten out.”</li>
<li>Where is a ZFS snapshot when you need it?
***</li>
</ul>

<h3><a href="https://medium.com/@skamille/how-do-individual-contributors-get-stuck-63102ba43516" rel="nofollow">How individual contributors get stuck</a></h3>

<ul>
<li>An interesting post looking at the common causes of people getting stuck when trying to create or contribute new code

<ul>
<li>Brainstorming/architecture: “I must have thought through all edge cases of all parts of everything before I can begin this project”</li>
<li>Researching possible solutions forever (often accompanied by desire to do a “bakeoff” where they build prototypes in different platforms/languages/etc)</li>
<li>Refactoring: “this code could be cleaner and everything would be just so much easier if we cleaned this up… and this up… and…”</li>
<li>Helping other people instead of doing their assigned tasks (this one isn’t a bad thing in an open source community)</li>
<li>Working on side projects instead of the main project (it is your time, it is up to you how to spend it)</li>
<li>Excessive testing (rare)</li>
<li>Excessive automation (rare)</li>
<li>Finish the last 10–20% of a project</li>
<li>Start a project completely from scratch</li>
<li>Do project planning (You need me to write what now? A roadmap?) (this is why FreeBSD has devsummits, some things you just need to whiteboard)</li>
<li>Work with unfamiliar code/libraries/systems</li>
<li>Work with other teams (please don’t make me go sit with data engineering!!)</li>
<li>Talk to other people</li>
<li>Ask for help (far beyond the point they realized they were stuck and needed help)</li>
<li>Deal with surprises or unexpected setbacks</li>
<li>Deal with vendors/external partners</li>
<li>Say no, because they can’t seem to just say no (instead of saying no they just go into avoidance mode, or worse, always say yes)</li>
</ul></li>
<li>“Noticing how people get stuck is a super power, and one that many great tech leads (and yes, managers) rely on to get big things done. When you know how people get stuck, you can plan your projects to rely on people for their strengths and provide them help or even completely side-step their weaknesses. You know who is good to ask for which kinds of help, and who hates that particular challenge just as much as you do.”</li>
<li>“The secret is that all of us get stuck and sidetracked sometimes. There’s actually nothing particularly “bad” about this. Knowing the ways that you get hung up is good because you can choose to either a) get over the fears that are sticking you (lack of knowledge, skills, or confidence), b) avoid such tasks as much as possible, and/or c) be aware of your habits and use extra diligence when faced with tackling these areas.”
***</li>
</ul>

<h3><a href="http://www.mkdocs.org/" rel="nofollow">Make Docs!</a></h3>

<ul>
<li>“MkDocs is a fast, simple and downright gorgeous static site generator that&#39;s geared towards building project documentation. Documentation source files are written in Markdown, and configured with a single YAML configuration file.”</li>
<li>“MkDocs builds completely static HTML sites that you can host on GitHub pages, Amazon S3, or anywhere else you choose”</li>
<li>It is an easy to install python package</li>
<li>It includes a server mode that auto-refreshes the page as you write the docs, making it easy to preview your work before you post it online</li>
<li>Everything needs docs, and writing docs should be as simple as possible, so that more of them will get written</li>
<li>Go write some docs!
***</li>
</ul>

<h3><a href="https://forums.freenas.org/index.php?threads/new-freenas-9-10-with-freebsd-11-12-for-testing.49696/#post-341941" rel="nofollow">Experimental FreeNAS 11/12 builds</a></h3>

<ul>
<li>We know there’s a lot of FreeNAS users who listen to BSDNow, so I felt it was important to share this little tidbit.</li>
<li>I’ve posted something to the forums last night which includes links to brand-new spins of FreeNAS 9.10 based upon FreeBSD 11/stable and 12/current. </li>
<li>These builds are updated nightly via our Jenkins infrastructure and hopefully will provide a new playground for technical folks and developers to experiment with FreeBSD features in their FreeNAS environment, long before they make it into a -STABLE release. </li>
<li>As usual, the notes of caution do apply, these are nightlies, and as such bugs will abound. Do NOT use these with your production data, unless you are crazy, or just want an excuse to test your backup strategy</li>
<li>If you do run these builds, of course feedback is welcome via the usual channels, such as the bug tracker. </li>
<li>The hope is that by testing FreeBSD code earlier, we can vet and determine what is safe / ready to go into mainline FreeNAS sooner rather than later.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://thenewstack.io/not-expected-understand-explainer/" rel="nofollow">An Explainer on Unix’s Most Notorious Code Comment</a> </li>
<li><a href="http://www.tedunangst.com/flak/post/turn-your-network-inside-out-with-one-pfconf-trick" rel="nofollow">turn your network inside out with one pf.conf trick</a></li>
<li><a href="http://www.grenadille.net/post/2017/01/13/A-story-of-if_get%289%29" rel="nofollow">A story of if_get(9)</a></li>
<li><a href="http://lists.llvm.org/pipermail/llvm-dev/2017-January/108953.html" rel="nofollow">Apple re-affirms its commitment to LLVM/Clang </a> </li>
<li><a href="http://www.tedunangst.com/flak/post/python-3k17" rel="nofollow">python 3k17</a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2848" rel="nofollow">2017 presentation proposals</a> </li>
<li><a href="http://mail-index.netbsd.org/netbsd-announce/2017/01/09/msg000259.html" rel="nofollow">NetBSD 7.1_RC1 available</a></li>
<li>#define FS_UFS2_MAGIC 0x19540119 (Happy Birthday to Kirk McKusick tomorrow)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/nnQ9ZgyN" rel="nofollow"> J - LetsEncrypt</a> </li>
<li><a href="http://pastebin.com/EZ4tRiVb" rel="nofollow"> Mike - OpenRC</a> </li>
<li><a href="http://pastebin.com/ZqDFTsnR" rel="nofollow"> Timothy - ZFS Horror</a> </li>
<li><a href="http://pastebin.com/dhZEnREM" rel="nofollow"> Troels</a> </li>
<li><a href="http://pastebin.com/q4F95S6h" rel="nofollow"> Jason - Disk Label</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we’ve got Wifi galore, a new iocage and some RPi3 news and guides to share. Stay tuned for your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20170109213803" rel="nofollow">WiFi: 11n hostap mode added to athn(4) driver, testers wanted</a></h3>

<ul>
<li>“OpenBSD as WiFi access points look set to be making a comeback in the near future”</li>
<li>“Stefan Sperling added 802.11n hostap mode, with full support initially for the Atheros chips supported by the athn(4) driver.”</li>
<li> “Hostap performance is not perfect yet but should be no worse than 11a/b/g modes in the same environment.”</li>
<li>“For Linux clients a fix for WME params is needed which I also posted to tech@”</li>
<li>“This diff does not modify the known-broken and disabled ar9003 code, apart from making sure it still builds.”</li>
<li><p>“I&#39;m looking for both tests and OKs.”</p></li>
<li><p>There has also been a <a href="http://svnweb.freebsd.org/base/head/sys/net80211/?view=log" rel="nofollow">flurry of work</a>  in FreeBSD on the ath10k driver, which supports 802.11ac</p></li>
<li><p>Like <a href="https://svnweb.freebsd.org/base?view=revision&revision=310147" rel="nofollow">this one</a> and <a href="https://svnweb.freebsd.org/base?view=revision&revision=311579" rel="nofollow">this one</a></p>

<hr></li>
</ul>

<h3><a href="https://github.com/iocage/iocage" rel="nofollow">The long-awaited iocage update has landed</a></h3>

<ul>
<li>We’ve hinted at the new things happening behind the scenes with iocage, and this last week the code has made its first public debut. </li>
<li>So what’s changed you may ask. The biggest is that iocage has undergone a complete overhaul, moving from its original shell-base to python.<br></li>
<li>The story behind that is that the author (Brandon) works at iXsystems, and the plan is to move away from the legacy warden-based jail management which was also shell-based.<br></li>
<li>This new python re-write will allow it to integrate into FreeNAS (and other projects) better by exposing an API for all jail management tasks. Thats right, no more ugly CLI output parsing just to wrangle jail options either at creation or runtime. </li>
<li>But what about users who just run iocage manually from the CLI? No worries, the new iocage is almost identical to the original CLI usage, making the switch over very simple.</li>
<li>Just to re-cap, lets look at the new features list:</li>
</ul>

<p>“FEATURES:</p>

<ul>
<li>Ease of use</li>
<li>Rapid jail creation within seconds</li>
<li>Automatic package installation</li>
<li>Virtual networking stacks (vnet)</li>
<li>Shared IP based jails (non vnet)</li>
<li>Transparent ZFS snapshot management</li>
<li>Export and import
“</li>
<li>The new iocage is available now via ports and packages under sysutils/py-iocage, give it a spin and be sure to report issues back to the developer(s).
***</li>
</ul>

<h3><a href="https://smallhacks.wordpress.com/2017/01/14/reading-dht11-temperature-sensor-on-raspberry-pi-under-freebsd/" rel="nofollow">Reading DHT11 temperature sensors on a Raspberry Pi under FreeBSD </a></h3>

<ul>
<li>“DHT-11 is a very cheap temperature/humidity sensor which is commonly used in the IoT devices. It is not very accurate, so for the accurate measurement i would recommend to use DHT21 instead. Anyway, i had DHT-11 in my tool box, so decided to start with it. DHT-11 using very simple 1 wire protocol – host is turning on chip by sending 18ms low signal to the data output and then reading 40 bytes of data.”</li>
<li>“To read data from the chip it should be connected to the power (5v) and gpio pin. I used pin 2 as VCC, 6 as GND and 11 as GPIO”</li>
<li>“There is no support for this device out of the box on FreeBSD. I found some sample code on the github, see <a href="https://github.com/lex/freebsd-gpio-dht11" rel="nofollow">lex/freebsd-gpio-dht11</a> repository. This code was a good starting point, but soon i found 2 issues with it:

<ul>
<li>Results are very unreliable, probably due to gpio decoding algorithm.</li>
</ul></li>
<li>Checksum is not validated, so sometime values are bogus.</li>
<li>“Initially i was thinking to fix this myself, but later found kernel module for this purpose, <a href="http://www.my-tour.ru/FreeBSD/1-wire_over_gpio/" rel="nofollow">1 wire over gpio</a>. This module contains DHT11 kernel driver (gpio_sw) which implements DHT-11 protocol in the kernel space and exporting /dev/sw0 for the userland. Driver compiles on FreeBSD11/ARM without any changes. Use make install to install the driver.”</li>
<li>The articles goes into how to install and configure the driver, including a set of devfs rules to allow non-root users to read from the sensor</li>
<li>“Final goal was to add this sensor to the domoticz software. It is using LUA scripting to extend it functionality, e.g. to obtain data from non-supported or non standard devices. So, i decided to read /dev/sw0 from the LUA.”</li>
<li>They ran into some trouble with LUA trying to read too much data at once, and had to work around it</li>
<li>In the end, they got the results and were able to use them in the monitoring tool
***</li>
</ul>

<h3><a href="https://github.com/lattera/articles/blob/master/infosec/tor/2017-01-14_torified_home/article.md" rel="nofollow">Tor-ified Home Network using HardenedBSD and a RPi3</a></h3>

<ul>
<li>Shawn from HardendBSD has posted an article up on GitHub talking about his deployment of a new Tor relay on a RPi3</li>
<li>This particular method was attractive, since it allows running a Relay, but without it being on a machine which may have personal data, such as SSH keys, files, etc</li>
<li>While his setup is done on HardendBSD, the same applies to a traditional FreeBSD setup as well. </li>
<li>First up, is the list of things needed for this project:</li>
</ul>

<p>Raspberry Pi 3 Model B Rev 1.2 (aka, RPI3)<br>
Serial console cable for the RPI3<br>
Belkin F4U047 USB Ethernet Dongle<br>
Insignia NS-CR2021 USB 2.0 SD/MMC Memory Card Reader<br>
32GB SanDisk Ultra PLUS MicroSDHC<br>
A separate system, running FreeBSD or HardenedBSD<br>
HardenedBSD clang 4.0.0 image for the RPI3<br>
An external drive to be formatted<br>
A MicroUSB cable to power the RPI3<br>
Two network cables<br>
Optional: Edimax N150 EW-7811Un Wireless USB<br>
Basic knowledge of vi</p>

<ul>
<li>After getting HBSD running on the RPi3 and serial connection established, he then takes us through the process of installing and enabling the various services needed. (Don’t forget to growfs your sdcard first!)</li>
<li>Now the tricky part is that some of the packages needed to be compiled from ports, which is somewhat time-consuming on a RPi. He strongly recommends not compiling on the sdcard (it sounds like personal experience has taught him well) and to use iscsi or some external USB drive. </li>
<li>With the compiling done, our package / software setup is nearly complete. Next up is firewalling the box, which he helpfully provides a full PF config setup that we can copy-n-paste here.</li>
<li>The last bits will be enabling the torrc configuration knobs, which if you follow his example again, will result in a tor public relay, and a local transparent proxy for you.</li>
<li>Bonus! Shawn helpfully provides DHCPD configurations, and even Wireless AP configurations, if you want to setup your RPi3 to proxy for devices that connect to 
it.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www-uxsup.csx.cam.ac.uk/misc/horror.txt" rel="nofollow">Unix Admin. Horror Story Summary, version 1.0</a></h3>

<ul>
<li>A great collection of stories, many of which will ring true with our viewers</li>
<li>The very first one, is about a user changing root’s shell to /usr/local/bin/tcsh but forgetting to make it executable, resulting in not being able to login as root.</li>
<li>I too have run into this issue, in a slightly different way. I had tcsh as my user shell (back before tcsh was in base), and after a major OS upgrade, but before I had a chance to recompile all of my ports. Now I couldn’t ssh in to the remote machine in order to recompile my shell. Now I always use a shell included in the base system, and test it before rebooting after an upgrade.</li>
<li>“Our operations group, a VMS group but trying to learn UNIX, was assigned account administration. They were cleaning up a few non-used accounts like they do on VMS - backup and purge. When they came across the account &quot;sccs&quot;, which had never been accessed, away it went. The &quot;deleteuser&quot; utility from DEC asks if you would like to delete all the files in the account. Seems reasonable, huh? Well, the home directory for &quot;sccs&quot; is &quot;/&quot;. Enough said :-(“</li>
<li>“I was working on a line printer spooler, which lived in /etc.  I wanted to remove it, and so issued the command &quot;rm /etc/lpspl.&quot;  There was only one problem.  Out of habit, I typed &quot;passwd&quot; after &quot;/etc/&quot; and removed the password file.  Oops.”</li>
<li>I’ve done things like this as well. Finger memory can be dangerous</li>
<li>“I was happily churning along developing something on a Sun workstation, and was getting a number of annoying permission denieds from trying to write into a directory heirarchy that I didn&#39;t own.  Getting tired of that, I decided to set the permissions on that subtree to 777 while I was working, so I wouldn&#39;t have to worry about it.  Someone had recently told me that rather than using plain &quot;su&quot;, it was good to use &quot;su -&quot;, but the implications had not yet sunk in.  (You can probably see where this is going already, but I&#39;ll go to the bitter end.)  Anyway, I cd&#39;d to where I wanted to be, the top of my subtree, and did su -.  Then I did chmod -R 777.  I then started to wonder why it was taking so damn long when there were only about 45 files in 20 directories under where I (thought) I was.  Well, needless to say, su - simulates a real login, and had put me into root&#39;s home directory, /, so I was proceeding to set file permissions for the whole system to wide open. I aborted it before it finished, realizing that something was wrong, but this took quite a while to straighten out.”</li>
<li>Where is a ZFS snapshot when you need it?
***</li>
</ul>

<h3><a href="https://medium.com/@skamille/how-do-individual-contributors-get-stuck-63102ba43516" rel="nofollow">How individual contributors get stuck</a></h3>

<ul>
<li>An interesting post looking at the common causes of people getting stuck when trying to create or contribute new code

<ul>
<li>Brainstorming/architecture: “I must have thought through all edge cases of all parts of everything before I can begin this project”</li>
<li>Researching possible solutions forever (often accompanied by desire to do a “bakeoff” where they build prototypes in different platforms/languages/etc)</li>
<li>Refactoring: “this code could be cleaner and everything would be just so much easier if we cleaned this up… and this up… and…”</li>
<li>Helping other people instead of doing their assigned tasks (this one isn’t a bad thing in an open source community)</li>
<li>Working on side projects instead of the main project (it is your time, it is up to you how to spend it)</li>
<li>Excessive testing (rare)</li>
<li>Excessive automation (rare)</li>
<li>Finish the last 10–20% of a project</li>
<li>Start a project completely from scratch</li>
<li>Do project planning (You need me to write what now? A roadmap?) (this is why FreeBSD has devsummits, some things you just need to whiteboard)</li>
<li>Work with unfamiliar code/libraries/systems</li>
<li>Work with other teams (please don’t make me go sit with data engineering!!)</li>
<li>Talk to other people</li>
<li>Ask for help (far beyond the point they realized they were stuck and needed help)</li>
<li>Deal with surprises or unexpected setbacks</li>
<li>Deal with vendors/external partners</li>
<li>Say no, because they can’t seem to just say no (instead of saying no they just go into avoidance mode, or worse, always say yes)</li>
</ul></li>
<li>“Noticing how people get stuck is a super power, and one that many great tech leads (and yes, managers) rely on to get big things done. When you know how people get stuck, you can plan your projects to rely on people for their strengths and provide them help or even completely side-step their weaknesses. You know who is good to ask for which kinds of help, and who hates that particular challenge just as much as you do.”</li>
<li>“The secret is that all of us get stuck and sidetracked sometimes. There’s actually nothing particularly “bad” about this. Knowing the ways that you get hung up is good because you can choose to either a) get over the fears that are sticking you (lack of knowledge, skills, or confidence), b) avoid such tasks as much as possible, and/or c) be aware of your habits and use extra diligence when faced with tackling these areas.”
***</li>
</ul>

<h3><a href="http://www.mkdocs.org/" rel="nofollow">Make Docs!</a></h3>

<ul>
<li>“MkDocs is a fast, simple and downright gorgeous static site generator that&#39;s geared towards building project documentation. Documentation source files are written in Markdown, and configured with a single YAML configuration file.”</li>
<li>“MkDocs builds completely static HTML sites that you can host on GitHub pages, Amazon S3, or anywhere else you choose”</li>
<li>It is an easy to install python package</li>
<li>It includes a server mode that auto-refreshes the page as you write the docs, making it easy to preview your work before you post it online</li>
<li>Everything needs docs, and writing docs should be as simple as possible, so that more of them will get written</li>
<li>Go write some docs!
***</li>
</ul>

<h3><a href="https://forums.freenas.org/index.php?threads/new-freenas-9-10-with-freebsd-11-12-for-testing.49696/#post-341941" rel="nofollow">Experimental FreeNAS 11/12 builds</a></h3>

<ul>
<li>We know there’s a lot of FreeNAS users who listen to BSDNow, so I felt it was important to share this little tidbit.</li>
<li>I’ve posted something to the forums last night which includes links to brand-new spins of FreeNAS 9.10 based upon FreeBSD 11/stable and 12/current. </li>
<li>These builds are updated nightly via our Jenkins infrastructure and hopefully will provide a new playground for technical folks and developers to experiment with FreeBSD features in their FreeNAS environment, long before they make it into a -STABLE release. </li>
<li>As usual, the notes of caution do apply, these are nightlies, and as such bugs will abound. Do NOT use these with your production data, unless you are crazy, or just want an excuse to test your backup strategy</li>
<li>If you do run these builds, of course feedback is welcome via the usual channels, such as the bug tracker. </li>
<li>The hope is that by testing FreeBSD code earlier, we can vet and determine what is safe / ready to go into mainline FreeNAS sooner rather than later.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://thenewstack.io/not-expected-understand-explainer/" rel="nofollow">An Explainer on Unix’s Most Notorious Code Comment</a> </li>
<li><a href="http://www.tedunangst.com/flak/post/turn-your-network-inside-out-with-one-pfconf-trick" rel="nofollow">turn your network inside out with one pf.conf trick</a></li>
<li><a href="http://www.grenadille.net/post/2017/01/13/A-story-of-if_get%289%29" rel="nofollow">A story of if_get(9)</a></li>
<li><a href="http://lists.llvm.org/pipermail/llvm-dev/2017-January/108953.html" rel="nofollow">Apple re-affirms its commitment to LLVM/Clang </a> </li>
<li><a href="http://www.tedunangst.com/flak/post/python-3k17" rel="nofollow">python 3k17</a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2848" rel="nofollow">2017 presentation proposals</a> </li>
<li><a href="http://mail-index.netbsd.org/netbsd-announce/2017/01/09/msg000259.html" rel="nofollow">NetBSD 7.1_RC1 available</a></li>
<li>#define FS_UFS2_MAGIC 0x19540119 (Happy Birthday to Kirk McKusick tomorrow)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/nnQ9ZgyN" rel="nofollow"> J - LetsEncrypt</a> </li>
<li><a href="http://pastebin.com/EZ4tRiVb" rel="nofollow"> Mike - OpenRC</a> </li>
<li><a href="http://pastebin.com/ZqDFTsnR" rel="nofollow"> Timothy - ZFS Horror</a> </li>
<li><a href="http://pastebin.com/dhZEnREM" rel="nofollow"> Troels</a> </li>
<li><a href="http://pastebin.com/q4F95S6h" rel="nofollow"> Jason - Disk Label</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>176: Linking your world</title>
  <link>https://www.bsdnow.tv/176</link>
  <guid isPermaLink="false">5b103268-94e0-4140-8458-0c79f17e135e</guid>
  <pubDate>Wed, 11 Jan 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5b103268-94e0-4140-8458-0c79f17e135e.mp3" length="66539956" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Another exciting week on BSDNow, we are queued up with LLVM / Linking news, a look at NetBSD’s scheduler,</itunes:subtitle>
  <itunes:duration>1:32:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Another exciting week on BSDNow, we are queued up with LLVM / Linking news, a look at NetBSD’s scheduler,
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and 
Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD Kernel and World, and many Ports, can now be linked with lld (https://llvm.org/bugs/show_bug.cgi?id=23214#c40)
“With this change applied I can link the entirety of the FreeBSD/amd64 base system (userland world and kernel) with LLD.”
“Rafael's done an initial experimental Poudriere FreeBSD package build with lld head, and found almost 20K out of 26K ports built successfully. I'm now looking at getting CI running to test this on an ongoing basis. But, I think we're at the point where an experimental build makes sense.”
Such testing will become much easier once llvm 4.0 is imported into -current
“I suggest that during development we collect patches in a local git repo -- for example, I've started here for my Poudriere run https://github.com/emaste/freebsd-ports/commits/ports-lld” 
“It now looks like libtool is responsible for the majority of my failed / skipped ports. Unless we really think we'll add "not GNU" and other hacks to lld we're going to have to address libtool limitations upstream and in the FreeBSD tree. I did look into libtool a few weeks ago, but unfortunately haven't yet managed to produce a patch suitable for sending upstream.”
If you are interested in LLVM/Clang/LLD/LLDB etc, check out: A Tourist’s Guide to the LLVM Source Code  (http://blog.regehr.org/archives/1453) 
***
Documenting NetBSD's scheduler tweaks (http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20170109_2108.html)
A followup to our previous coverage of improvements to the scheduler in NetBSD
“NetBSD's scheduler was recently changed to better distribute load of long-running processes on multiple CPUs. So far, the associated sysctl tweaks were not documented, and this was changed now, documenting the kern.sched sysctls.”
kern.sched.cacheht_time (dynamic): Cache hotness time in which a LWP is kept on one particular CPU and not moved to another CPU. This reduces the overhead of flushing and reloading caches.  Defaults to 3ms.  Needs to be given in ``hz'' units, see mstohz(9).
kern.sched.balance_period (dynamic): Interval at which the CPU queues are checked for re-balancing.  Defaults to 300ms.
kern.sched.min_catch (dynamic): Minimum count of migratable (runable) threads for catching (stealing) from another CPU.  Defaults to 1 but can be increased to decrease chance of thread migration between CPUs.
It is important to have good documentation for these tunables, so that users can understand what it is they are adjusting
***
FreeBSD Network Gateway on EdgeRouter Lite (http://codeghar.com/blog/freebsd-network-gateway-on-edgerouter-lite.html)
“EdgeRouter Lite is a great device to run at the edge of a home network. It becomes even better when it's running FreeBSD. This guide documents how to setup such a gateway. There are accompanying git repos to somewhat automate the process as well.”
“Colin Percival has written a great blog post on the subject, titled FreeBSD on EdgeRouter Lite - no serial port required (http://www.daemonology.net/blog/2016-01-10-FreeBSD-EdgeRouter-Lite.html) . In it he provides and describes a shell script to build a bootable image of FreeBSD to be run on ERL, available from GitHub in the freebsd-ERL-build (https://github.com/cperciva/freebsd-ERL-build/)  repo. I have built a Vagrant-based workflow to automate the building of the drive image. It's available on GitHub in the freebsd-edgerouterlite-ansible (https://github.com/hamzasheikh/freebsd-edgerouterlite-ansible)  repo. It uses the build script Percival wrote.”
“Once you've built the disk image it's time to write it to a USB drive. There are two options: overwrite the original drive in the ERL or buy a new drive. I tried the second option first and wrote to a new Sandrive Ultra Fit 32GB USB 3.0 Flash Drive (SDCZ43-032G-GAM46). It did not work and I later found on some blog that those drives do not work. I have not tried another third party drive since.”
The tutorial covers all of the steps, and the configuration files, including rc.conf, IP configuration, DHCP (and v6), pf, and DNS (unbound)
“I'm pretty happy with ERL and FreeBSD. There is great community documentation on how to configure all the pieces of software that make a FreeBSD-based home network gateway possible. I can tweak things as needed and upgrade when newer versions become available.”
“My plan on upgrading the base OS is to get a third party USB drive that works, write a newer FreeBSD image to it, and replace the drive in the ERL enclosure. This way I can keep a bunch of drives in rotation. Upgrades to newer builds or reverts to last known good version are as easy as swapping USB drives.”
Although something more nanobsd style with 2 partitions on the one drive might be easier.
“Configuration with Ansible means I don't have to manually do things again and again. As the configs change they'll be tracked in git so I get version control as well. ERL is simply a great piece of network hardware. I'm tempted to try Ubiquiti's WiFi products instead of a mixture of DD-WRT and OpenWRT devices I have now. But that is for another day and perhaps another blog post.”
***
A highly portable build system targeting modern UNIX systems (https://github.com/michipili/bsdowl)
An exciting new/old project is up on GitHub that we wanted to bring your attention to.
BSD Owl is a highly portable build-system based around BSD Make that supports a variety of popular (and not so popular) languages, such as:
C programs, compiled for several targets
C libraries, static and shared, compiled for several targets
Shell scripts
Python scripts
OCaml programs
OCaml libraries, with ocamldoc documentation
OCaml plugins
TeX documents, prepared for several printing devices
METAPOST figures, with output as PDF, PS, SVG or PNG, either as part of a TeX document or as standalone documents
What about features you may ask? Well BSD Owl has plenty of those to go around:
Support of compilation profiles
Support of the parallel mode (at the directory level)
Support of separate trees for sources and objects
Support of architecture-dependant compilation options
Support GNU autoconf
Production of GPG-signed tarballs
Developer subshell, empowered with project-specific scripts
Literate programming using noweb
Preprocessing with m4
As far as platform support goes, BSD Owl is tested on OSX / Debian Jesse and FreeBSD &amp;gt; 9. Future support for OpenBSD and NetBSD is planned, once they update their respective BSD Make binaries to more modern versions
News Roundup
find -delete in OpenBSD. Thanks to tedu@ OpenBSD will have this very handy flag to in the future. (https://marc.info/?l=openbsd-tech&amp;amp;m=148342051832692&amp;amp;w=2)
OpenBSD’s find(1) utility will now support the -delete operation
“This option is not posix (not like that's stopped find accumulating a dozen extensions), but it is in gnu and freebsd (for 20 years). it's also somewhat popular among sysadmins and blogs, etc. and perhaps most importantly, it nicely solves one of the more troublesome caveats of find (which the man page actually covers twice because it's so common and easy to screw up). So I think it makes a good addition.”
The actual code was borrowed from FreeBSD
Using the -delete option is much more performant than forking rm once for each file, and safer because there is no risk of mangling path names
If you encounter a system without a -delete option, your best bet is to use the -print0 option of find, which will print each filename terminated by a null byte, and pipe that into xargs -0 rm
This avoids any ambiguity caused by files with spaces in the names
***
New version of the Lumina desktop released (https://lumina-desktop.org/version-1-2-0-released/)
Just in time to kickoff 2017 we have a new release of Lumina Desktop (1.2.0)
Some of the notable changes include fixes to make it easier to port to other platforms, and some features:
New Panel Plugins:
“audioplayer” (panel version of the desktop plugin with the same name): Allows the user to load/play audio files directly through the desktop itself.
“jsonmenu” (panel version of the menu plugin with the same name): Allows an external utility/script to be used to generate a menu/contents on demand.
New Menu Plugins:
“lockdesktop”: Menu option for instantly locking the desktop session.
New Utilities:
lumina-archiver: This is a pure Qt5 front-end to the “tar” utility for managing/creating archives. This can also use the dd utility to burn a “*.img” file to a USB device for booting.“
Looks like the news already made its rounds to a few different sites, with Phoronix and Softpedia picking it up as well
Phoronix (http://www.phoronix.com/scan.php?page=news_item&amp;amp;px=Lumina-1.2-Released)
Softpedia  (http://news.softpedia.com/news/lumina-1-2-desktop-environments-launches-for-trueos-with-various-enhancements-511495.shtml)
TrueOS users running the latest updates are already on the pre-release version of 1.2.1, so nothing has to be done there to get the latest and greatest.
dd is not a disk writing tool (http://www.vidarholen.net/contents/blog/?p=479)
“If you’ve ever used dd, you’ve probably used it to read or write disk images:”
&amp;gt; # Write myfile.iso to a USB drive
&amp;gt; dd if=myfile.iso of=/dev/sdb bs=1M
“Usage of dd in this context is so pervasive that it’s being hailed as the magic gatekeeper of raw devices. Want to read from a raw device? Use dd. Want to write to a raw device? Use dd. This belief can make simple tasks complicated. How do you combine dd with gzip? How do you use pv if the source is raw device? How do you dd over ssh?”
“The fact of the matter is, dd is not a disk writing tool. Neither “d” is for “disk”, “drive” or “device”. It does not support “low level” reading or writing. It has no special dominion over any kind of device whatsoever.”
Then a number of alternatives are discussed
“However, this does not mean that dd is useless! The reason why people started using it in the first place is that it does exactly what it’s told, no more and no less. If an alias specifies -a, cp might try to create a new block device rather than a copy of the file data. If using gzip without redirection, it may try to be helpful and skip the file for not being regular. Neither of them will write out a reassuring status during or after a copy.”
“dd, meanwhile, has one job*: copy data from one place to another. It doesn’t care about files, safeguards or user convenience. It will not try to second guess your intent, based on trailing slashes or types of files. When this is no longer a convenience, like when combining it with other tools that already read and write files, one should not feel guilty for leaving dd out entirely.”
“dd is the swiss army knife of the open, read, write and seek syscalls. It’s unique in its ability to issue seeks and reads of specific lengths, which enables a whole world of shell scripts that have no business being shell scripts. Want to simulate a lseek+execve? Use dd! Want to open a file with O_SYNC? Use dd! Want to read groups of three byte pixels from a PPM file? Use dd!”
“It’s a flexible, unique and useful tool, and I love it. My only issue is that, far too often, this great tool is being relegated to and inappropriately hailed for its most generic and least interesting capability: simply copying a file from start to finish.”
“dd actually has two jobs: Convert and Copy. Legend has it that the intended name, “cc”, was taken by the C compiler, so the letters were shifted by one to give “dd”. This is also why we ended up with a Window system called X.”
dd countdown (https://eriknstr.github.io/utils/dd-countdown.htm) 
***
Bhyve setup for tcp testing  (https://www.strugglingcoder.info/index.php/bhyve-setup-for-tcp-testing/)
FreeBSD Developer Hiren Panchasara writes about his setup to use bhyve to test changes to the TCP stack in FreeBSD
“Here is how I test simple FreeBSD tcp changes with dummynet on bhyve. I’ve already wrote down how I do dummynet (https://www.strugglingcoder.info/index.php/drop-a-packet/) so I’ll focus on bhyve part.”
“A few months back when I started looking into improving FreeBSD TCP’s response to packet loss, I looked around for traffic simulators which can do deterministic packet drop for me.”
“I had used dummynet(4) before so I thought of using it but the problem is that it only provided probabilistic drops. You can specify dropping 10% of the total packets”
So he wrote a quick hack, hopefully he’ll polish it up and get it committed
“Setup: I’ll create 3 bhyve guests: client, router and server” 
“Both client and server need their routing tables setup correctly so that they can reach each other. The Dummynet node is the router / traffic shaping node here. We need to enable forwarding between interfaces: sysctl net.inet.ip.forwarding=1”
“We need to setup links (called ‘pipes’) and their parameters on dummynet node”
“For simulations, I run a lighttpd web-server on the server which serves different sized objects and I request them via curl or wget from the client. I have tcpdump running on any/all of four interfaces involved to observe traffic and I can see specified packets getting dropped by dummynet. sysctl net.inet.ip.dummynet.iopktdrop is incremented with each packet that dummynet drops.”
“Here, 192.* addresses are for ssh and 10.* are for guests to be able to communicate within themselves.”
Create 2 tap interfaces for each end point, and 3 from the router. One each for SSH/control, and the others for the test flows. Then create 3 bridges, the first includes all of the control tap interfaces, and your hosts’ real interface. This allows the guests to reach the internet to download packages etc. The other two bridges form the connections between the three VMs
The creation and configuration of the VMs is documented in detail
I used a setup very similar to this for teaching the basics of how TCP works when I was teaching at a local community college
***
Beastie Bits
Plan9 on Bhyve (https://twitter.com/pr1ntf/status/817895393824382976)
Get your name in the relayd book (http://blather.michaelwlucas.com/archives/2832) 
Ted Unangst’s 2016 Computer Reviews  (http://www.tedunangst.com/flak/post/2016-computer-review) 
Bryan Cantrill on Developer On Fire podcast  (http://developeronfire.com/episode-198-bryan-cantrill-persistence-and-action) 
2016 in review: pf/ipfw's impact on forwarding performance over time, on 8 core Atom  (http://dev.bsdrp.net/benchs/2016.SM5018A-FTN4-Chelsio.png) 
#Wayland Weston with X and EGL clients, running on #FreeBSD in VBox with new scfb backend. More coming soon!  (https://twitter.com/johalun/status/819039940914778112) 
Feedback/Questions
 Eddy - TRIM Partitioning (http://pastebin.com/A0LSipCj) 
 Matt - Why FreeBSD? (http://pastebin.com/UE1k4Q99) 
 Shawn - ZFS Horror? (http://pastebin.com/TjTkqHA4) 
 Andrew - Bootloaders (http://pastebin.com/Baxd6Pjy) 
GELIBoot Paper  (http://allanjude.com/talks/AsiaBSDCon2016_geliboot_pdf1a.pdf)
FreeBSD Architecture Handbook (https://www.freebsd.org/doc/en_US.ISO8859-1/books/arch-handbook/boot.html)
 Bryan - ZFS Error (http://pastebin.com/NygwchFD) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Another exciting week on BSDNow, we are queued up with LLVM / Linking news, a look at NetBSD’s scheduler,</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" <br>
title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://llvm.org/bugs/show_bug.cgi?id=23214#c40" rel="nofollow">FreeBSD Kernel and World, and many Ports, can now be linked with lld</a></h3>

<ul>
<li>“With this change applied I can link the entirety of the FreeBSD/amd64 base system (userland world and kernel) with LLD.”</li>
<li>“Rafael&#39;s done an initial experimental Poudriere FreeBSD package build with lld head, and found almost 20K out of 26K ports built successfully. I&#39;m now looking at getting CI running to test this on an ongoing basis. But, I think we&#39;re at the point where an experimental build makes sense.”</li>
<li>Such testing will become much easier once llvm 4.0 is imported into -current</li>
<li>“I suggest that during development we collect patches in a local git repo -- for example, I&#39;ve started here for my Poudriere run <a href="https://github.com/emaste/freebsd-ports/commits/ports-lld%E2%80%9D" rel="nofollow">https://github.com/emaste/freebsd-ports/commits/ports-lld”</a> </li>
<li>“It now looks like libtool is responsible for the majority of my failed / skipped ports. Unless we really think we&#39;ll add &quot;not GNU&quot; and other hacks to lld we&#39;re going to have to address libtool limitations upstream and in the FreeBSD tree. I did look into libtool a few weeks ago, but unfortunately haven&#39;t yet managed to produce a patch suitable for sending upstream.”</li>
<li>If you are interested in LLVM/Clang/LLD/LLDB etc, check out: <a href="http://blog.regehr.org/archives/1453" rel="nofollow">A Tourist’s Guide to the LLVM Source Code </a> 
***</li>
</ul>

<h3><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20170109_2108.html" rel="nofollow">Documenting NetBSD&#39;s scheduler tweaks</a></h3>

<ul>
<li>A followup to our previous coverage of improvements to the scheduler in NetBSD</li>
<li>“NetBSD&#39;s scheduler was recently changed to better distribute load of long-running processes on multiple CPUs. So far, the associated sysctl tweaks were not documented, and this was changed now, documenting the kern.sched sysctls.”</li>
<li>kern.sched.cacheht_time (dynamic): Cache hotness time in which a LWP is kept on one particular CPU and not moved to another CPU. This reduces the overhead of flushing and reloading caches.  Defaults to 3ms.  Needs to be given in ``hz&#39;&#39; units, see mstohz(9).</li>
<li>kern.sched.balance_period (dynamic): Interval at which the CPU queues are checked for re-balancing.  Defaults to 300ms.</li>
<li>kern.sched.min_catch (dynamic): Minimum count of migratable (runable) threads for catching (stealing) from another CPU.  Defaults to 1 but can be increased to decrease chance of thread migration between CPUs.</li>
<li>It is important to have good documentation for these tunables, so that users can understand what it is they are adjusting
***</li>
</ul>

<h3><a href="http://codeghar.com/blog/freebsd-network-gateway-on-edgerouter-lite.html" rel="nofollow">FreeBSD Network Gateway on EdgeRouter Lite</a></h3>

<ul>
<li>“EdgeRouter Lite is a great device to run at the edge of a home network. It becomes even better when it&#39;s running FreeBSD. This guide documents how to setup such a gateway. There are accompanying git repos to somewhat automate the process as well.”</li>
<li>“Colin Percival has written a great blog post on the subject, titled <a href="http://www.daemonology.net/blog/2016-01-10-FreeBSD-EdgeRouter-Lite.html" rel="nofollow">FreeBSD on EdgeRouter Lite - no serial port required</a> . In it he provides and describes a shell script to build a bootable image of FreeBSD to be run on ERL, available from GitHub in the <a href="https://github.com/cperciva/freebsd-ERL-build/" rel="nofollow">freebsd-ERL-build</a>  repo. I have built a Vagrant-based workflow to automate the building of the drive image. It&#39;s available on GitHub in the <a href="https://github.com/hamzasheikh/freebsd-edgerouterlite-ansible" rel="nofollow">freebsd-edgerouterlite-ansible</a>  repo. It uses the build script Percival wrote.”</li>
<li>“Once you&#39;ve built the disk image it&#39;s time to write it to a USB drive. There are two options: overwrite the original drive in the ERL or buy a new drive. I tried the second option first and wrote to a new Sandrive Ultra Fit 32GB USB 3.0 Flash Drive (SDCZ43-032G-GAM46). It did not work and I later found on some blog that those drives do not work. I have not tried another third party drive since.”</li>
<li>The tutorial covers all of the steps, and the configuration files, including rc.conf, IP configuration, DHCP (and v6), pf, and DNS (unbound)</li>
<li>“I&#39;m pretty happy with ERL and FreeBSD. There is great community documentation on how to configure all the pieces of software that make a FreeBSD-based home network gateway possible. I can tweak things as needed and upgrade when newer versions become available.”</li>
<li>“My plan on upgrading the base OS is to get a third party USB drive that works, write a newer FreeBSD image to it, and replace the drive in the ERL enclosure. This way I can keep a bunch of drives in rotation. Upgrades to newer builds or reverts to last known good version are as easy as swapping USB drives.”</li>
<li>Although something more nanobsd style with 2 partitions on the one drive might be easier.</li>
<li>“Configuration with Ansible means I don&#39;t have to manually do things again and again. As the configs change they&#39;ll be tracked in git so I get version control as well. ERL is simply a great piece of network hardware. I&#39;m tempted to try Ubiquiti&#39;s WiFi products instead of a mixture of DD-WRT and OpenWRT devices I have now. But that is for another day and perhaps another blog post.”
***</li>
</ul>

<h3><a href="https://github.com/michipili/bsdowl" rel="nofollow">A highly portable build system targeting modern UNIX systems</a></h3>

<ul>
<li>An exciting new/old project is up on GitHub that we wanted to bring your attention to.</li>
<li><p>BSD Owl is a highly portable build-system based around BSD Make that supports a variety of popular (and not so popular) languages, such as:</p>

<ul>
<li>C programs, compiled for several targets</li>
<li>C libraries, static and shared, compiled for several targets</li>
<li>Shell scripts</li>
<li>Python scripts</li>
<li>OCaml programs</li>
<li>OCaml libraries, with ocamldoc documentation</li>
<li>OCaml plugins</li>
<li>TeX documents, prepared for several printing devices</li>
<li>METAPOST figures, with output as PDF, PS, SVG or PNG, either as part of a TeX document or as standalone documents</li>
</ul></li>
<li><p>What about features you may ask? Well BSD Owl has plenty of those to go around:</p>

<ul>
<li>Support of compilation profiles</li>
<li>Support of the parallel mode (at the directory level)</li>
<li>Support of separate trees for sources and objects</li>
<li>Support of architecture-dependant compilation options</li>
<li>Support GNU autoconf</li>
<li>Production of GPG-signed tarballs</li>
<li>Developer subshell, empowered with project-specific scripts</li>
<li>Literate programming using noweb</li>
<li>Preprocessing with m4</li>
</ul></li>
<li><p>As far as platform support goes, BSD Owl is tested on OSX / Debian Jesse and FreeBSD &gt; 9. Future support for OpenBSD and NetBSD is planned, once they update their respective BSD Make binaries to more modern versions</p>

<hr></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://marc.info/?l=openbsd-tech&m=148342051832692&w=2" rel="nofollow">find -delete in OpenBSD. Thanks to tedu@ OpenBSD will have this very handy flag to in the future.</a></h3>

<ul>
<li>OpenBSD’s find(1) utility will now support the -delete operation</li>
<li>“This option is not posix (not like that&#39;s stopped find accumulating a dozen extensions), but it is in gnu and freebsd (for 20 years). it&#39;s also somewhat popular among sysadmins and blogs, etc. and perhaps most importantly, it nicely solves one of the more troublesome caveats of find (which the man page actually covers twice because it&#39;s so common and easy to screw up). So I think it makes a good addition.”</li>
<li>The actual code was borrowed from FreeBSD</li>
<li>Using the -delete option is much more performant than forking rm once for each file, and safer because there is no risk of mangling path names</li>
<li>If you encounter a system without a -delete option, your best bet is to use the -print0 option of find, which will print each filename terminated by a null byte, and pipe that into xargs -0 rm</li>
<li>This avoids any ambiguity caused by files with spaces in the names
***</li>
</ul>

<h3><a href="https://lumina-desktop.org/version-1-2-0-released/" rel="nofollow">New version of the Lumina desktop released</a></h3>

<ul>
<li>Just in time to kickoff 2017 we have a new release of Lumina Desktop (1.2.0)</li>
<li><p>Some of the notable changes include fixes to make it easier to port to other platforms, and some features:</p></li>
<li><p>New Panel Plugins:</p>

<ul>
<li>“audioplayer” (panel version of the desktop plugin with the same name): Allows the user to load/play audio files directly through the desktop itself.</li>
<li>“jsonmenu” (panel version of the menu plugin with the same name): Allows an external utility/script to be used to generate a menu/contents on demand.</li>
</ul></li>
<li><p>New Menu Plugins:</p>

<ul>
<li>“lockdesktop”: Menu option for instantly locking the desktop session.</li>
</ul></li>
<li><p>New Utilities:</p>

<ul>
<li><code>lumina-archiver</code>: This is a pure Qt5 front-end to the “tar” utility for managing/creating archives. This can also use the <code>dd</code> utility to burn a “*.img” file to a USB device for booting.“</li>
</ul></li>
<li><p>Looks like the news already made its rounds to a few different sites, with Phoronix and Softpedia picking it up as well</p></li>
<li><p><a href="http://www.phoronix.com/scan.php?page=news_item&px=Lumina-1.2-Released" rel="nofollow">Phoronix</a></p></li>
<li><p><a href="http://news.softpedia.com/news/lumina-1-2-desktop-environments-launches-for-trueos-with-various-enhancements-511495.shtml" rel="nofollow">Softpedia </a></p></li>
<li><p>TrueOS users running the latest updates are already on the pre-release version of 1.2.1, so nothing has to be done there to get the latest and greatest.</p>

<hr></li>
</ul>

<h3><a href="http://www.vidarholen.net/contents/blog/?p=479" rel="nofollow">dd is not a disk writing tool</a></h3>

<ul>
<li>“If you’ve ever used dd, you’ve probably used it to read or write disk images:”
&gt; # Write myfile.iso to a USB drive
&gt; dd if=myfile.iso of=/dev/sdb bs=1M</li>
<li>“Usage of dd in this context is so pervasive that it’s being hailed as the magic gatekeeper of raw devices. Want to read from a raw device? Use dd. Want to write to a raw device? Use dd. This belief can make simple tasks complicated. How do you combine dd with gzip? How do you use pv if the source is raw device? How do you dd over ssh?”</li>
<li>“The fact of the matter is, dd is not a disk writing tool. Neither “d” is for “disk”, “drive” or “device”. It does not support “low level” reading or writing. It has no special dominion over any kind of device whatsoever.”</li>
<li>Then a number of alternatives are discussed</li>
<li>“However, this does not mean that dd is useless! The reason why people started using it in the first place is that it does exactly what it’s told, no more and no less. If an alias specifies -a, cp might try to create a new block device rather than a copy of the file data. If using gzip without redirection, it may try to be helpful and skip the file for not being regular. Neither of them will write out a reassuring status during or after a copy.”</li>
<li>“dd, meanwhile, has one job*: copy data from one place to another. It doesn’t care about files, safeguards or user convenience. It will not try to second guess your intent, based on trailing slashes or types of files. When this is no longer a convenience, like when combining it with other tools that already read and write files, one should not feel guilty for leaving dd out entirely.”</li>
<li>“dd is the swiss army knife of the open, read, write and seek syscalls. It’s unique in its ability to issue seeks and reads of specific lengths, which enables a whole world of shell scripts that have no business being shell scripts. Want to simulate a lseek+execve? Use dd! Want to open a file with O_SYNC? Use dd! Want to read groups of three byte pixels from a PPM file? Use dd!”</li>
<li>“It’s a flexible, unique and useful tool, and I love it. My only issue is that, far too often, this great tool is being relegated to and inappropriately hailed for its most generic and least interesting capability: simply copying a file from start to finish.”</li>
<li>“dd actually has two jobs: Convert and Copy. Legend has it that the intended name, “cc”, was taken by the C compiler, so the letters were shifted by one to give “dd”. This is also why we ended up with a Window system called X.”</li>
<li><a href="https://eriknstr.github.io/utils/dd-countdown.htm" rel="nofollow">dd countdown</a> 
***</li>
</ul>

<h3><a href="https://www.strugglingcoder.info/index.php/bhyve-setup-for-tcp-testing/" rel="nofollow">Bhyve setup for tcp testing </a></h3>

<ul>
<li>FreeBSD Developer Hiren Panchasara writes about his setup to use bhyve to test changes to the TCP stack in FreeBSD</li>
<li>“Here is how I test simple FreeBSD tcp changes with dummynet on bhyve. I’ve already wrote down <a href="https://www.strugglingcoder.info/index.php/drop-a-packet/" rel="nofollow">how I do dummynet</a> so I’ll focus on bhyve part.”</li>
<li>“A few months back when I started looking into improving FreeBSD TCP’s response to packet loss, I looked around for traffic simulators which can do deterministic packet drop for me.”</li>
<li>“I had used dummynet(4) before so I thought of using it but the problem is that it only provided probabilistic drops. You can specify dropping 10% of the total packets”</li>
<li>So he wrote a quick hack, hopefully he’ll polish it up and get it committed</li>
<li>“Setup: I’ll create 3 bhyve guests: client, router and server” </li>
<li>“Both client and server need their routing tables setup correctly so that they can reach each other. The Dummynet node is the router / traffic shaping node here. We need to enable forwarding between interfaces: sysctl net.inet.ip.forwarding=1”</li>
<li>“We need to setup links (called ‘pipes’) and their parameters on dummynet node”</li>
<li>“For simulations, I run a lighttpd web-server on the server which serves different sized objects and I request them via curl or wget from the client. I have tcpdump running on any/all of four interfaces involved to observe traffic and I can see specified packets getting dropped by dummynet. sysctl net.inet.ip.dummynet.io_pkt_drop is incremented with each packet that dummynet drops.”</li>
<li>“Here, 192.* addresses are for ssh and 10.* are for guests to be able to communicate within themselves.”</li>
<li>Create 2 tap interfaces for each end point, and 3 from the router. One each for SSH/control, and the others for the test flows. Then create 3 bridges, the first includes all of the control tap interfaces, and your hosts’ real interface. This allows the guests to reach the internet to download packages etc. The other two bridges form the connections between the three VMs</li>
<li>The creation and configuration of the VMs is documented in detail</li>
<li>I used a setup very similar to this for teaching the basics of how TCP works when I was teaching at a local community college
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://twitter.com/pr1ntf/status/817895393824382976" rel="nofollow">Plan9 on Bhyve</a></p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2832" rel="nofollow">Get your name in the relayd book</a> </p></li>
<li><p><a href="http://www.tedunangst.com/flak/post/2016-computer-review" rel="nofollow">Ted Unangst’s 2016 Computer Reviews </a> </p></li>
<li><p><a href="http://developeronfire.com/episode-198-bryan-cantrill-persistence-and-action" rel="nofollow">Bryan Cantrill on Developer On Fire podcast </a> </p></li>
<li><p><a href="http://dev.bsdrp.net/benchs/2016.SM5018A-FTN4-Chelsio.png" rel="nofollow">2016 in review: pf/ipfw&#39;s impact on forwarding performance over time, on 8 core Atom </a> </p></li>
<li><p><a href="https://twitter.com/johalun/status/819039940914778112" rel="nofollow">#Wayland Weston with X and EGL clients, running on #FreeBSD in VBox with new scfb backend. More coming soon! </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/A0LSipCj" rel="nofollow"> Eddy - TRIM Partitioning</a> </li>
<li><a href="http://pastebin.com/UE1k4Q99" rel="nofollow"> Matt - Why FreeBSD?</a> </li>
<li><a href="http://pastebin.com/TjTkqHA4" rel="nofollow"> Shawn - ZFS Horror?</a> </li>
<li><a href="http://pastebin.com/Baxd6Pjy" rel="nofollow"> Andrew - Bootloaders</a> 

<ul>
<li><a href="http://allanjude.com/talks/AsiaBSDCon2016_geliboot_pdf1a.pdf" rel="nofollow">GELIBoot Paper </a></li>
<li><a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/arch-handbook/boot.html" rel="nofollow">FreeBSD Architecture Handbook</a></li>
</ul></li>
<li><a href="http://pastebin.com/NygwchFD" rel="nofollow"> Bryan - ZFS Error</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Another exciting week on BSDNow, we are queued up with LLVM / Linking news, a look at NetBSD’s scheduler,</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" <br>
title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://llvm.org/bugs/show_bug.cgi?id=23214#c40" rel="nofollow">FreeBSD Kernel and World, and many Ports, can now be linked with lld</a></h3>

<ul>
<li>“With this change applied I can link the entirety of the FreeBSD/amd64 base system (userland world and kernel) with LLD.”</li>
<li>“Rafael&#39;s done an initial experimental Poudriere FreeBSD package build with lld head, and found almost 20K out of 26K ports built successfully. I&#39;m now looking at getting CI running to test this on an ongoing basis. But, I think we&#39;re at the point where an experimental build makes sense.”</li>
<li>Such testing will become much easier once llvm 4.0 is imported into -current</li>
<li>“I suggest that during development we collect patches in a local git repo -- for example, I&#39;ve started here for my Poudriere run <a href="https://github.com/emaste/freebsd-ports/commits/ports-lld%E2%80%9D" rel="nofollow">https://github.com/emaste/freebsd-ports/commits/ports-lld”</a> </li>
<li>“It now looks like libtool is responsible for the majority of my failed / skipped ports. Unless we really think we&#39;ll add &quot;not GNU&quot; and other hacks to lld we&#39;re going to have to address libtool limitations upstream and in the FreeBSD tree. I did look into libtool a few weeks ago, but unfortunately haven&#39;t yet managed to produce a patch suitable for sending upstream.”</li>
<li>If you are interested in LLVM/Clang/LLD/LLDB etc, check out: <a href="http://blog.regehr.org/archives/1453" rel="nofollow">A Tourist’s Guide to the LLVM Source Code </a> 
***</li>
</ul>

<h3><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20170109_2108.html" rel="nofollow">Documenting NetBSD&#39;s scheduler tweaks</a></h3>

<ul>
<li>A followup to our previous coverage of improvements to the scheduler in NetBSD</li>
<li>“NetBSD&#39;s scheduler was recently changed to better distribute load of long-running processes on multiple CPUs. So far, the associated sysctl tweaks were not documented, and this was changed now, documenting the kern.sched sysctls.”</li>
<li>kern.sched.cacheht_time (dynamic): Cache hotness time in which a LWP is kept on one particular CPU and not moved to another CPU. This reduces the overhead of flushing and reloading caches.  Defaults to 3ms.  Needs to be given in ``hz&#39;&#39; units, see mstohz(9).</li>
<li>kern.sched.balance_period (dynamic): Interval at which the CPU queues are checked for re-balancing.  Defaults to 300ms.</li>
<li>kern.sched.min_catch (dynamic): Minimum count of migratable (runable) threads for catching (stealing) from another CPU.  Defaults to 1 but can be increased to decrease chance of thread migration between CPUs.</li>
<li>It is important to have good documentation for these tunables, so that users can understand what it is they are adjusting
***</li>
</ul>

<h3><a href="http://codeghar.com/blog/freebsd-network-gateway-on-edgerouter-lite.html" rel="nofollow">FreeBSD Network Gateway on EdgeRouter Lite</a></h3>

<ul>
<li>“EdgeRouter Lite is a great device to run at the edge of a home network. It becomes even better when it&#39;s running FreeBSD. This guide documents how to setup such a gateway. There are accompanying git repos to somewhat automate the process as well.”</li>
<li>“Colin Percival has written a great blog post on the subject, titled <a href="http://www.daemonology.net/blog/2016-01-10-FreeBSD-EdgeRouter-Lite.html" rel="nofollow">FreeBSD on EdgeRouter Lite - no serial port required</a> . In it he provides and describes a shell script to build a bootable image of FreeBSD to be run on ERL, available from GitHub in the <a href="https://github.com/cperciva/freebsd-ERL-build/" rel="nofollow">freebsd-ERL-build</a>  repo. I have built a Vagrant-based workflow to automate the building of the drive image. It&#39;s available on GitHub in the <a href="https://github.com/hamzasheikh/freebsd-edgerouterlite-ansible" rel="nofollow">freebsd-edgerouterlite-ansible</a>  repo. It uses the build script Percival wrote.”</li>
<li>“Once you&#39;ve built the disk image it&#39;s time to write it to a USB drive. There are two options: overwrite the original drive in the ERL or buy a new drive. I tried the second option first and wrote to a new Sandrive Ultra Fit 32GB USB 3.0 Flash Drive (SDCZ43-032G-GAM46). It did not work and I later found on some blog that those drives do not work. I have not tried another third party drive since.”</li>
<li>The tutorial covers all of the steps, and the configuration files, including rc.conf, IP configuration, DHCP (and v6), pf, and DNS (unbound)</li>
<li>“I&#39;m pretty happy with ERL and FreeBSD. There is great community documentation on how to configure all the pieces of software that make a FreeBSD-based home network gateway possible. I can tweak things as needed and upgrade when newer versions become available.”</li>
<li>“My plan on upgrading the base OS is to get a third party USB drive that works, write a newer FreeBSD image to it, and replace the drive in the ERL enclosure. This way I can keep a bunch of drives in rotation. Upgrades to newer builds or reverts to last known good version are as easy as swapping USB drives.”</li>
<li>Although something more nanobsd style with 2 partitions on the one drive might be easier.</li>
<li>“Configuration with Ansible means I don&#39;t have to manually do things again and again. As the configs change they&#39;ll be tracked in git so I get version control as well. ERL is simply a great piece of network hardware. I&#39;m tempted to try Ubiquiti&#39;s WiFi products instead of a mixture of DD-WRT and OpenWRT devices I have now. But that is for another day and perhaps another blog post.”
***</li>
</ul>

<h3><a href="https://github.com/michipili/bsdowl" rel="nofollow">A highly portable build system targeting modern UNIX systems</a></h3>

<ul>
<li>An exciting new/old project is up on GitHub that we wanted to bring your attention to.</li>
<li><p>BSD Owl is a highly portable build-system based around BSD Make that supports a variety of popular (and not so popular) languages, such as:</p>

<ul>
<li>C programs, compiled for several targets</li>
<li>C libraries, static and shared, compiled for several targets</li>
<li>Shell scripts</li>
<li>Python scripts</li>
<li>OCaml programs</li>
<li>OCaml libraries, with ocamldoc documentation</li>
<li>OCaml plugins</li>
<li>TeX documents, prepared for several printing devices</li>
<li>METAPOST figures, with output as PDF, PS, SVG or PNG, either as part of a TeX document or as standalone documents</li>
</ul></li>
<li><p>What about features you may ask? Well BSD Owl has plenty of those to go around:</p>

<ul>
<li>Support of compilation profiles</li>
<li>Support of the parallel mode (at the directory level)</li>
<li>Support of separate trees for sources and objects</li>
<li>Support of architecture-dependant compilation options</li>
<li>Support GNU autoconf</li>
<li>Production of GPG-signed tarballs</li>
<li>Developer subshell, empowered with project-specific scripts</li>
<li>Literate programming using noweb</li>
<li>Preprocessing with m4</li>
</ul></li>
<li><p>As far as platform support goes, BSD Owl is tested on OSX / Debian Jesse and FreeBSD &gt; 9. Future support for OpenBSD and NetBSD is planned, once they update their respective BSD Make binaries to more modern versions</p>

<hr></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://marc.info/?l=openbsd-tech&m=148342051832692&w=2" rel="nofollow">find -delete in OpenBSD. Thanks to tedu@ OpenBSD will have this very handy flag to in the future.</a></h3>

<ul>
<li>OpenBSD’s find(1) utility will now support the -delete operation</li>
<li>“This option is not posix (not like that&#39;s stopped find accumulating a dozen extensions), but it is in gnu and freebsd (for 20 years). it&#39;s also somewhat popular among sysadmins and blogs, etc. and perhaps most importantly, it nicely solves one of the more troublesome caveats of find (which the man page actually covers twice because it&#39;s so common and easy to screw up). So I think it makes a good addition.”</li>
<li>The actual code was borrowed from FreeBSD</li>
<li>Using the -delete option is much more performant than forking rm once for each file, and safer because there is no risk of mangling path names</li>
<li>If you encounter a system without a -delete option, your best bet is to use the -print0 option of find, which will print each filename terminated by a null byte, and pipe that into xargs -0 rm</li>
<li>This avoids any ambiguity caused by files with spaces in the names
***</li>
</ul>

<h3><a href="https://lumina-desktop.org/version-1-2-0-released/" rel="nofollow">New version of the Lumina desktop released</a></h3>

<ul>
<li>Just in time to kickoff 2017 we have a new release of Lumina Desktop (1.2.0)</li>
<li><p>Some of the notable changes include fixes to make it easier to port to other platforms, and some features:</p></li>
<li><p>New Panel Plugins:</p>

<ul>
<li>“audioplayer” (panel version of the desktop plugin with the same name): Allows the user to load/play audio files directly through the desktop itself.</li>
<li>“jsonmenu” (panel version of the menu plugin with the same name): Allows an external utility/script to be used to generate a menu/contents on demand.</li>
</ul></li>
<li><p>New Menu Plugins:</p>

<ul>
<li>“lockdesktop”: Menu option for instantly locking the desktop session.</li>
</ul></li>
<li><p>New Utilities:</p>

<ul>
<li><code>lumina-archiver</code>: This is a pure Qt5 front-end to the “tar” utility for managing/creating archives. This can also use the <code>dd</code> utility to burn a “*.img” file to a USB device for booting.“</li>
</ul></li>
<li><p>Looks like the news already made its rounds to a few different sites, with Phoronix and Softpedia picking it up as well</p></li>
<li><p><a href="http://www.phoronix.com/scan.php?page=news_item&px=Lumina-1.2-Released" rel="nofollow">Phoronix</a></p></li>
<li><p><a href="http://news.softpedia.com/news/lumina-1-2-desktop-environments-launches-for-trueos-with-various-enhancements-511495.shtml" rel="nofollow">Softpedia </a></p></li>
<li><p>TrueOS users running the latest updates are already on the pre-release version of 1.2.1, so nothing has to be done there to get the latest and greatest.</p>

<hr></li>
</ul>

<h3><a href="http://www.vidarholen.net/contents/blog/?p=479" rel="nofollow">dd is not a disk writing tool</a></h3>

<ul>
<li>“If you’ve ever used dd, you’ve probably used it to read or write disk images:”
&gt; # Write myfile.iso to a USB drive
&gt; dd if=myfile.iso of=/dev/sdb bs=1M</li>
<li>“Usage of dd in this context is so pervasive that it’s being hailed as the magic gatekeeper of raw devices. Want to read from a raw device? Use dd. Want to write to a raw device? Use dd. This belief can make simple tasks complicated. How do you combine dd with gzip? How do you use pv if the source is raw device? How do you dd over ssh?”</li>
<li>“The fact of the matter is, dd is not a disk writing tool. Neither “d” is for “disk”, “drive” or “device”. It does not support “low level” reading or writing. It has no special dominion over any kind of device whatsoever.”</li>
<li>Then a number of alternatives are discussed</li>
<li>“However, this does not mean that dd is useless! The reason why people started using it in the first place is that it does exactly what it’s told, no more and no less. If an alias specifies -a, cp might try to create a new block device rather than a copy of the file data. If using gzip without redirection, it may try to be helpful and skip the file for not being regular. Neither of them will write out a reassuring status during or after a copy.”</li>
<li>“dd, meanwhile, has one job*: copy data from one place to another. It doesn’t care about files, safeguards or user convenience. It will not try to second guess your intent, based on trailing slashes or types of files. When this is no longer a convenience, like when combining it with other tools that already read and write files, one should not feel guilty for leaving dd out entirely.”</li>
<li>“dd is the swiss army knife of the open, read, write and seek syscalls. It’s unique in its ability to issue seeks and reads of specific lengths, which enables a whole world of shell scripts that have no business being shell scripts. Want to simulate a lseek+execve? Use dd! Want to open a file with O_SYNC? Use dd! Want to read groups of three byte pixels from a PPM file? Use dd!”</li>
<li>“It’s a flexible, unique and useful tool, and I love it. My only issue is that, far too often, this great tool is being relegated to and inappropriately hailed for its most generic and least interesting capability: simply copying a file from start to finish.”</li>
<li>“dd actually has two jobs: Convert and Copy. Legend has it that the intended name, “cc”, was taken by the C compiler, so the letters were shifted by one to give “dd”. This is also why we ended up with a Window system called X.”</li>
<li><a href="https://eriknstr.github.io/utils/dd-countdown.htm" rel="nofollow">dd countdown</a> 
***</li>
</ul>

<h3><a href="https://www.strugglingcoder.info/index.php/bhyve-setup-for-tcp-testing/" rel="nofollow">Bhyve setup for tcp testing </a></h3>

<ul>
<li>FreeBSD Developer Hiren Panchasara writes about his setup to use bhyve to test changes to the TCP stack in FreeBSD</li>
<li>“Here is how I test simple FreeBSD tcp changes with dummynet on bhyve. I’ve already wrote down <a href="https://www.strugglingcoder.info/index.php/drop-a-packet/" rel="nofollow">how I do dummynet</a> so I’ll focus on bhyve part.”</li>
<li>“A few months back when I started looking into improving FreeBSD TCP’s response to packet loss, I looked around for traffic simulators which can do deterministic packet drop for me.”</li>
<li>“I had used dummynet(4) before so I thought of using it but the problem is that it only provided probabilistic drops. You can specify dropping 10% of the total packets”</li>
<li>So he wrote a quick hack, hopefully he’ll polish it up and get it committed</li>
<li>“Setup: I’ll create 3 bhyve guests: client, router and server” </li>
<li>“Both client and server need their routing tables setup correctly so that they can reach each other. The Dummynet node is the router / traffic shaping node here. We need to enable forwarding between interfaces: sysctl net.inet.ip.forwarding=1”</li>
<li>“We need to setup links (called ‘pipes’) and their parameters on dummynet node”</li>
<li>“For simulations, I run a lighttpd web-server on the server which serves different sized objects and I request them via curl or wget from the client. I have tcpdump running on any/all of four interfaces involved to observe traffic and I can see specified packets getting dropped by dummynet. sysctl net.inet.ip.dummynet.io_pkt_drop is incremented with each packet that dummynet drops.”</li>
<li>“Here, 192.* addresses are for ssh and 10.* are for guests to be able to communicate within themselves.”</li>
<li>Create 2 tap interfaces for each end point, and 3 from the router. One each for SSH/control, and the others for the test flows. Then create 3 bridges, the first includes all of the control tap interfaces, and your hosts’ real interface. This allows the guests to reach the internet to download packages etc. The other two bridges form the connections between the three VMs</li>
<li>The creation and configuration of the VMs is documented in detail</li>
<li>I used a setup very similar to this for teaching the basics of how TCP works when I was teaching at a local community college
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://twitter.com/pr1ntf/status/817895393824382976" rel="nofollow">Plan9 on Bhyve</a></p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2832" rel="nofollow">Get your name in the relayd book</a> </p></li>
<li><p><a href="http://www.tedunangst.com/flak/post/2016-computer-review" rel="nofollow">Ted Unangst’s 2016 Computer Reviews </a> </p></li>
<li><p><a href="http://developeronfire.com/episode-198-bryan-cantrill-persistence-and-action" rel="nofollow">Bryan Cantrill on Developer On Fire podcast </a> </p></li>
<li><p><a href="http://dev.bsdrp.net/benchs/2016.SM5018A-FTN4-Chelsio.png" rel="nofollow">2016 in review: pf/ipfw&#39;s impact on forwarding performance over time, on 8 core Atom </a> </p></li>
<li><p><a href="https://twitter.com/johalun/status/819039940914778112" rel="nofollow">#Wayland Weston with X and EGL clients, running on #FreeBSD in VBox with new scfb backend. More coming soon! </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/A0LSipCj" rel="nofollow"> Eddy - TRIM Partitioning</a> </li>
<li><a href="http://pastebin.com/UE1k4Q99" rel="nofollow"> Matt - Why FreeBSD?</a> </li>
<li><a href="http://pastebin.com/TjTkqHA4" rel="nofollow"> Shawn - ZFS Horror?</a> </li>
<li><a href="http://pastebin.com/Baxd6Pjy" rel="nofollow"> Andrew - Bootloaders</a> 

<ul>
<li><a href="http://allanjude.com/talks/AsiaBSDCon2016_geliboot_pdf1a.pdf" rel="nofollow">GELIBoot Paper </a></li>
<li><a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/arch-handbook/boot.html" rel="nofollow">FreeBSD Architecture Handbook</a></li>
</ul></li>
<li><a href="http://pastebin.com/NygwchFD" rel="nofollow"> Bryan - ZFS Error</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>175: How the Dtrace saved Christmas</title>
  <link>https://www.bsdnow.tv/175</link>
  <guid isPermaLink="false">4c57b68b-aac0-41b5-b068-d8172ea3bfb7</guid>
  <pubDate>Wed, 04 Jan 2017 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4c57b68b-aac0-41b5-b068-d8172ea3bfb7.mp3" length="70191796" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we’ve got all sorts of post-holiday goodies to share. New OpenSSL APIs, Dtrace, OpenBSD</itunes:subtitle>
  <itunes:duration>1:37:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we’ve got all sorts of post-holiday goodies to share. New OpenSSL APIs, Dtrace, OpenBSD
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenSSL 1.1 API migration path, or the lack thereof (https://www.mail-archive.com/tech@openbsd.org/msg36437.html)
As many of you will already be aware, the OpenSSL 1.1.0 release intentionally introduced significant API changes from the previous release. In summary, a large number of data structures that were previously publically visible have been made opaque, with accessor functions being added in order to get and set some of the fields within these now opaque structs. It is worth noting that the use of opaque data structures is generally beneficial for libraries, since changes can be made to these data structures without breaking the ABI. As such, the overall direction of these changes is largely reasonable.
However, while API change is generally necessary for progression, in this case it would appear that there is NO transition plan and a complete disregard for the impact that these changes would have on the overall open source ecosystem.
So far it seems that the only approach is to place the migration burden onto each and every software project that uses OpenSSL, pushing significant code changes to each project that migrates to OpenSSL 1.1, while maintaining compatibility with the previous API. This is forcing each project to provide their own backwards compatibility shims, which is practically guaranteeing that there will be a proliferation of variable quality implementations; it is almost a certainty that some of these will contain bugs, potentially introducing security issues or memory leaks.
I think this will be a bigger issue for other operating systems that do not have the flexibility of the ports tree to deliver a newer version of OpenSSL. If a project switches from the old API to the new API, and the OS only provides the older branch of OpenSSL, how can the application work?
Of course, this leaves the issue, if application A wants OpenSSL 1.0, and application B only works with OpenSSL 1.1, how does that work?
Due to a number of factors, software projects that make use of OpenSSL cannot simply migrate to the 1.1 API and drop support for the 1.0 API - in most cases they will need to continue to support both. Firstly, I am not aware of any platform that has shipped a production release with OpenSSL 1.1 - any software that supported OpenSSL 1.1 only, would effectively be unusable on every platform for the time being. Secondly, the OpenSSL 1.0.2 release is supported until the 31st of December 2019, while OpenSSL 1.1.0 is only supported until the 31st of August 2018 - any LTS style release is clearly going to consider shipping with 1.0.2 as a result.
Platforms that are attempting to ship with OpenSSL 1.1 are already encountering significant challenges - for example, Debian currently has 257 packages (out of 518) that do not build against OpenSSL 1.1. There are also hidden gotchas for situations where different libraries are linked against different OpenSSL versions and then share OpenSSL data structures between them - many of these problems will be difficult to detect since they only fail at runtime.
It will be interesting to see what happens with OpenSSL, and LibreSSL
Hopefully, most projects will decide to switch to the cleaner APIs provided by s2n or libtls, although they do not provide the entire functionality of the OpenSSL API.
Hacker News comments (https://news.ycombinator.com/item?id=13284648)
***
exfiltration via receive timing (http://www.tedunangst.com/flak/post/exfiltration-via-receive-timing)
Another similar way to create a backchannel but without transmitting anything is to introduce delays in the receiver and measure throughput as observed by the sender. All we need is a protocol with transmission control. Hmmm. Actually, it’s easier (and more reliable) to code this up using a plain pipe, but the same principle applies to networked transmissions.
For every digit we want to “send” back, we sleep a few seconds, then drain the pipe. We don’t care about the data, although if this were a video file or an OS update, we could probably do something useful with it.
Continuously fill the pipe with junk data. If (when) we block, calculate the difference between before and after. This is a our secret backchannel data. (The reader and writer use different buffer sizes because on OpenBSD at least, a writer will stay blocked even after a read depending on the space that opens up. Even simple demos have real world considerations.)
In this simple example, the secret data (argv) is shared by the processes, but we can see that the writer isn’t printing them from its own address space. Nevertheless, it works.
Time to add random delays and buffering to firewalls? Probably not.
An interesting thought experiment that shows just how many ways there are to covertly convey a message
***
OpenBSD Desktop in about 30 Minutes (https://news.ycombinator.com/item?id=13223351)
Over at hackernews we have a very non-verbose, but handy guide to getting to a OpenBSD desktop in about 30 minutes!
First, the guide will assume you’ve already installed OpenBSD 6.0, so you’ll need to at least be at the shell prompt of your freshly installed system to begin.
With that, now its time to do some tuning. Editing some resource limits in login.conf will be our initial task, upping some datasize tunables to 2GB
Next up, we will edit some of the default “doas” settings to something a bit more workable for desktop computing
Another handy trick, editing your .profile to have your PKG_PATH variables set automatically will make
One thing some folks may overlook, but disabling atime can speed disk performance (which you probably don’t care about atime on your desktop anyway), so this guide will show you what knobs to tweak in /etc/fstab to do so
After some final WPA / Wifi configuration, we then drop to “mere mortal” mode and begin our package installations. In this particular guide, he will be setting up Lumina Desktop (Which yes, it is on OpenBSD)
A few small tweaks later for xscreensaver and your xinitrc file, then you are ready to run “startx” and begin your desktop session!
All in all, great guide which if you are fast can probably be done in even less than 30 minutes and will result in a rock-solid OpenBSD desktop rocking Lumina none-the-less.
***
How DTrace saved Christmas (https://hackernoon.com/dtrace-at-home-145ba773371e)
Adam Leventhal, one of the co-creators of DTrace, wrote up this post about how he uses DTrace at home, to save Christmas
I had been procrastinating making the family holiday card. It was a combination of having a lot on my plate and dreading the formulation of our annual note recapping the year; there were some great moments, but I’m glad I don’t have to do 2016 again. It was just before midnight and either I’d make the card that night or leave an empty space on our friends’ refrigerators.
Adobe Illustrator had other ideas: “Unable to set maximum number of files to be opened”
I’m not the first person to hit this. The problem seems to have existed since CS6 was released in 2016. None of the solutions were working for me, and — inspired by Sara Mauskopf’s excellent post (https://medium.com/startup-grind/how-to-start-a-company-with-no-free-time-b70fbe7b918a#.uujdblxc6) — I was rapidly running out of the time bounds for the project. Enough; I’d just DTrace it.
A colleague scoffed the other day, “I mean, how often do you actually use DTrace?” In his mind DTrace was for big systems, critical system, when dollars and lives were at stake. My reply: I use DTrace every day. I can’t imagine developing software without DTrace, and I use it when my laptop (not infrequently) does something inexplicable (I’m forever grateful to the Apple team that ported it to Mac OS X)
Illustrator is failing on setrlimit(2) and blowing up as result. Let’s confirm that it is in fact returning -1:$ sudo dtrace -n 'syscall::setrlimit:return/execname == "Adobe Illustrato"/{ printf("%d %d", arg1, errno); }'
   dtrace: description 'syscall::setrlimit:return' matched 1 probe
   CPU     ID                    FUNCTION:NAME
     0    532                 setrlimit:return -1 1
There it is. And setrlimit(2) is failing with errno 1 which is EPERM (value too high for non-root user). I already tuned up the files limit pretty high. Let’s confirm that it is in fact setting the files limit and check the value to which it’s being set. To write this script I looked at the documentation for setrlimit(2) (hooray for man pages!) to determine that the position of the resource parameter (arg0) and the type of the value parameter (struct rlimit). I needed the DTrace copyin() subroutine to grab the structure from the process’s address space:
$ sudo dtrace -n 'syscall::setrlimit:entry/execname == "Adobe Illustrato"/{ this-&amp;gt;r = *(struct rlimit *)copyin(arg1, sizeof (struct rlimit)); printf("%x %x %x", arg0, this-&amp;gt;r.rlimcur, this-&amp;gt;r.rlimmax);  }'
   dtrace: description 'syscall::setrlimit:entry' matched 1 probe
   CPU     ID                FUNCTION:NAME
     0    531              setrlimit:entry 1008 2800 7fffffffffffffff
Looking through /usr/include/sys/resource.h we can see that 1008 corresponds to the number of files (RLIMITNOFILE | 
_RLIMITPOSIX_FLAG)
The quickest solution was to use DTrace again to whack a smaller number into that struct rlimit. Easy:
$ sudo dtrace -w -n 'syscall::setrlimit:entry/execname == "Adobe Illustrato"/{ this-&amp;gt;i = (rlimt *)alloca(sizeof (rlimt)); *this-&amp;gt;i = 10000; copyout(this-&amp;gt;i, arg1 + sizeof (rlimt), sizeof (rlimt)); }'
   dtrace: description 'syscall::setrlimit:entry' matched 1 probe
   dtrace: could not enable tracing: Permission denied
Oh right. Thank you SIP (System Integrity Protection). This is a new laptop (at least a new motherboard due to some bizarre issue) which probably contributed to Illustrator not working when once it did. Because it’s new I haven’t yet disabled the part of SIP that prevents you from using DTrace on the kernel or in destructive mode (e.g. copyout()). It’s easy enough to disable, but I’m reboot-phobic — I hate having to restart my terminals — so I went to plan B: lldb
+ After using DTrace to get the address of the setrlimit function, Adam used lldb to change the result before it got back to the application:
   (lldb) break set -n _init
   Breakpoint 1: 47 locations.
   (lldb) run
   …
   (lldb) di -s 0x1006e5b72 -c 1
   0x1006e5b72: callq  0x1011628e0     ; symbol stub for: setrlimit
   (lldb) memory write 0x1006e5b72 0x31 0xc0 0x90 0x90 0x90
   (lldb) di -s 0x1006e5b72 -c 4
   0x1006e5b72: xorl   %eax, %eax
   0x1006e5b74: nop
   0x1006e5b75: nop
   0x1006e5b76: nop
Next I just did a process detach and got on with making that holiday card…
DTrace was designed for solving hard problems on critical systems, but the need to understand how systems behave exists in development and on consumer systems. Just because you didn’t write a program doesn’t mean you can’t fix it.
News Roundup
Say my Blog's name! (https://functionallyparanoid.com/2016/12/22/say-my-blogs-name/)
Brian Everly over at functionally paranoid has a treat for us today. Let us give you a moment to get the tin-foil hats on… Ok, done? Let’s begin!
He starts off with a look at physical security. He begins by listing your options:
BIOS passwords – Not something I’m typically impressed with.  Most can be avoided by opening up the machine, closing a jumper and powering it up to reset the NVRAM to factory defaults.  I don’t even bother with them.
Full disk encryption – This one really rings my bell in a positive way.  If you can kill power to the box (either because the bad actor has to physically steal it and they aren’t carrying around a pile of car batteries and an inverter or because you can interrupt power to it some other way), then the disk will be encrypted.  The other beauty of this is that if a drive fails (and they all do eventually) you don’t have to have any privacy concerns about chucking it into an electronics recycler (or if you are a bad, bad person, into a landfill) because that data is effectively gibberish without the key (or without a long time to brute force it).
Two factor auth for logins – I like this one as well.  I’m not a fan of biometrics because if your fingerprint is compromised (yes, it can happen – read (https://www.washingtonpost.com/news/federal-eye/wp/2015/07/09/hack-of-security-clearance-system-affected-21-5-million-people-federal-authorities-say/) about the department of defense background checks that were extracted by a bad agent – they included fingerprint images) you can’t exactly send off for a new finger.  Things like the YubiKey (https://www.yubico.com/) are pretty slick.  They require that you have the physical hardware key as well as the password so unless the bad actor lifted your physical key, they would have a much harder time with physical access to your hardware.
Out of those options, Brian mentions that he uses disk encryption and yubi-key for all his secure network systems.
Next up is network segmentation, in this case the first thing to do is change your admin password for any ISP supplied modem 
/ router. He goes on to scare us of javascript attacks being used not against your local machine, but instead non WAN exposed router admin interface. Scary Stuff!
For added security, naturally he firewalls the router by plugging in the LAN port to a OpenBSD box which does the 2nd layer of firewall / router protection.
What about privacy and browsing? Here’s some more of his tips:
I use Unbound as my DNS resolver on my local network (with all UDP port 53 traffic redirected to it by pf so I don’t have to configure anything on the clients) and then forward the traffic to DNSCrypt Proxy, caching the results in Unbound.  I notice ZERO performance penalty for this and it greatly enhances privacy.  This combination of Unbound and DNSCrypt Proxy works very well together.  You can even have redundancy by having multiple upstream resolvers running on different ports (basically run the DNSCrypt Proxy daemon multiple times pointing to different public resolvers).
I also use Firefox exclusively for my web browsing.  By leveraging the tips on this page (https://www.privacytools.io/), you can lock it down to do a great job of privacy protection.  The fact that your laptop’s battery drain rate can be used to fingerprint your browser completely trips me out but hey – that’s the world we live in.’
What about the cloud you may ask? Well Brian has a nice solution for that as well:
I recently decided I would try to live a cloud-free life and I’ll give you a bit of a synopsis on it.  I discovered a wonderful Open Source project called FreeNAS (http://www.freenas.org/).  What this little gem does is allow you to install a FreeBSD/zfs file server appliance on amd64 hardware and have a slick administrative web interface for managing it.  I picked up a nice SuperMicro motherboard and chassis that has 4 hot swap drive bays (and two internal bays that I used to mirror the boot volume on) and am rocking the zfs lifestyle!  (Thanks Alan Jude!)
One of the nicest features of the FreeNAS is that it provides the ability to leverage the FreeBSD jail functionality in an easy to use way.  It also has plugins but the security on those is a bit sketchy (old versions of libraries, etc.) so I decided to roll my own.  I created two jails – one to run OwnCloud (yeah, I know about NextCloud and might switch at some point) and the other to run a full SMTP/IMAP email server stack.  I used Lets Encrypt (https://letsencrypt.org/) to generate the SSL certificates and made sure I hit an A on SSLLabs (https://www.ssllabs.com/) before I did anything else.
His post then goes in to talk about Backups and IoT devices, something else you need to consider in this truely paranoid world we are forced to live in. We even get a nice shout-out near the end!
Enter TarSnap (http://www.tarsnap.com/) – a company that advertises itself as “Online Backups for the Truly Paranoid”.  It brings a tear to my eye – a kindred spirit!  :-)  Thanks again to Alan Jude and Kris Moore from the BSD Now podcast (http://www.bsdnow.tv/) for turning me onto this company.  It has a very easy command syntax (yes, it isn’t a GUI tool – suck it up buttercup, you wanted to learn the shell didn’t you?) and even allows you to compile the thing from source if you want to.”
We’ve only covered some of the highlights here, but you really should take a few moments of your time today and read this top to bottom. Lots of good tips here, already thinking how I can secure my home network better.
The open source book: “Producing Open Source Software” (http://producingoss.com/en/producingoss.pdf)
“How to Run a Successful Free Software Project” by Karl Fogel
9 chapters and over 200 pages of content, plus many appendices
Some interesting topics include:
Choosing a good name
version control
bug tracking
creating developer guidelines
setting up communications channels
choosing a license (although this guide leans heavily towards the GPL)
setting the tone of the project
joining or creating a Non-Profit Organization
the economics of open source
release engineering, packaging, nightly builds, etc
how to deal with forks
A lot of good information packaged into this ebook
This work is licensed under the Creative Commons Attribution-ShareAlike 4.0 International License
***
DTrace Flamegraphs for node.js on FreeBSD  (http://www.venshare.com/dtrace-flamegraphs-for-freebsd-and-node-js-2/)
One of the coolest tools built on top of DTrace is flamegraphs
They are a very accurate, and visual way to see where a program is spending its time, which can tell you why it is slow, or where it could be improved. Further enhancements include off-cpu flame graphs, which tell you when the program is doing nothing, which can also be very useful
&amp;gt; Recently BSD UNIXes are being acknowledged by the application development community as an interesting operating system to deploy to. This is not surprising given that FreeBSD had jails, the original container system, about 17 years ago and a lot of network focused businesses such as netflix see it as the best way to deliver content. This developer interest has led to hosting providers supporting FreeBSD. e.g. Amazon, Azure, Joyent and you can get a 2 months free instance at Digital Ocean.
DTrace is another vital feature for anyone who has had to deal with production issues and has been in FreeBSD since version 9. As of FreeBSD 11 the operating system now contains some great work by Fedor Indutny so you can profile node applications and create flamegraphs of node.js processes without any additional runtime flags or restarting of processes.
This is one of the most important things about DTrace. Many applications include some debugging functionality, but they require that you stop the application, and start it again in debugging mode. Some even require that you recompile the application in debugging mode.
Being able to attach DTrace to an application, while it is under load, while the problem is actively happening, can be critical to figuring out what is going on.
In order to configure your FreeBSD instance to utilize this feature make the following changes to the configuration of the server.
Load the DTrace module at boot
Increase some DTrace limits
Install node with the optional DTrace feature compiled in
Follow the generic node.js flamegraph tutorial (https://nodejs.org/en/blog/uncategorized/profiling-node-js/)
&amp;gt; I hope you find this article useful. The ability to look at a runtime in this manor has saved me twice this year and I hope it will save you in the future too. My next post on freeBSD and node.js will be looking at some scenarios on utilising the ZFS features.
Also check out Brendan Gregg’s ACM Queue Article (http://queue.acm.org/detail.cfm?id=2927301) “The Flame Graph: This visualization of software execution is a new necessity for performance profiling and debugging”
SSHGuard 2.0 Call for Testing (https://sourceforge.net/p/sshguard/mailman/message/35580961/)
SSHGuard is a tool for monitoring brute force attempts and blocking them
It has been a favourite of mine for a while because it runs as a pipe from syslogd, rather than reading the log files from the disk
A lot of work to get SSHGuard working with new log sources (journalctl, macOS log) and backends (firewalld, ipset) has happened in 2.0. The new version also uses a configuration file.
Most importantly, SSHGuard has been split into several processes piped into one another (sshg-logmon | sshg-parser | sshg-blocker | sshg-fw). sshg-parser can run with capsicum(4) and pledge(2). sshg-blocker can be sandboxed in its default configuration (without pid file, whitelist, blacklisting) and has not been tested sandboxed in other configurations.
Breaking the processes up so that the sensitive bits can be sandboxes is very nice to see
***
Beastie Bits
pjd’s 2007 paper from AsiaBSDCon: “Porting the ZFS file system to the FreeBSD operating system” (https://2007.asiabsdcon.org/papers/P16-paper.pdf) 
A Message From the FreeBSD Foundation (https://vimeo.com/user60888329) 
Remembering Roger Faulkner, Unix Champion (http://thenewstack.io/remembering-roger-faulkner/) and A few HN comments (including Bryan Cantrill) (https://news.ycombinator.com/item?id=13293596) 
Feedback/Questions
 Peter - TrueOS Network (http://pastebin.com/QtyJeHMk) 
 Chris - Remote Desktop (http://pastebin.com/ru726VTV) 
 Goetz - Geli on Serial (http://pastebin.com/LQZPgF5g) 
 Joe - BGP (http://pastebin.com/jFeL8zKX) 
 Alejandro - BSD Router (http://pastebin.com/Xq9cbmfn) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we’ve got all sorts of post-holiday goodies to share. New OpenSSL APIs, Dtrace, OpenBSD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.mail-archive.com/tech@openbsd.org/msg36437.html" rel="nofollow">OpenSSL 1.1 API migration path, or the lack thereof</a></h3>

<blockquote>
<p>As many of you will already be aware, the OpenSSL 1.1.0 release intentionally introduced significant API changes from the previous release. In summary, a large number of data structures that were previously publically visible have been made opaque, with accessor functions being added in order to get and set some of the fields within these now opaque structs. It is worth noting that the use of opaque data structures is generally beneficial for libraries, since changes can be made to these data structures without breaking the ABI. As such, the overall direction of these changes is largely reasonable.</p>

<p>However, while API change is generally necessary for progression, in this case it would appear that there is NO transition plan and a complete disregard for the impact that these changes would have on the overall open source ecosystem.</p>

<p>So far it seems that the only approach is to place the migration burden onto each and every software project that uses OpenSSL, pushing significant code changes to each project that migrates to OpenSSL 1.1, while maintaining compatibility with the previous API. This is forcing each project to provide their own backwards compatibility shims, which is practically guaranteeing that there will be a proliferation of variable quality implementations; it is almost a certainty that some of these will contain bugs, potentially introducing security issues or memory leaks.</p>
</blockquote>

<ul>
<li>I think this will be a bigger issue for other operating systems that do not have the flexibility of the ports tree to deliver a newer version of OpenSSL. If a project switches from the old API to the new API, and the OS only provides the older branch of OpenSSL, how can the application work?</li>
<li>Of course, this leaves the issue, if application A wants OpenSSL 1.0, and application B only works with OpenSSL 1.1, how does that work?</li>
</ul>

<blockquote>
<p>Due to a number of factors, software projects that make use of OpenSSL cannot simply migrate to the 1.1 API and drop support for the 1.0 API - in most cases they will need to continue to support both. Firstly, I am not aware of any platform that has shipped a production release with OpenSSL 1.1 - any software that supported OpenSSL 1.1 only, would effectively be unusable on every platform for the time being. Secondly, the OpenSSL 1.0.2 release is supported until the 31st of December 2019, while OpenSSL 1.1.0 is only supported until the 31st of August 2018 - any LTS style release is clearly going to consider shipping with 1.0.2 as a result.</p>

<p>Platforms that are attempting to ship with OpenSSL 1.1 are already encountering significant challenges - for example, Debian currently has 257 packages (out of 518) that do not build against OpenSSL 1.1. There are also hidden gotchas for situations where different libraries are linked against different OpenSSL versions and then share OpenSSL data structures between them - many of these problems will be difficult to detect since they only fail at runtime.</p>
</blockquote>

<ul>
<li>It will be interesting to see what happens with OpenSSL, and LibreSSL</li>
<li>Hopefully, most projects will decide to switch to the cleaner APIs provided by s2n or libtls, although they do not provide the entire functionality of the OpenSSL API.</li>
<li><a href="https://news.ycombinator.com/item?id=13284648" rel="nofollow">Hacker News comments</a>
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/exfiltration-via-receive-timing" rel="nofollow">exfiltration via receive timing</a></h3>

<blockquote>
<p>Another similar way to create a backchannel but without transmitting anything is to introduce delays in the receiver and measure throughput as observed by the sender. All we need is a protocol with transmission control. Hmmm. Actually, it’s easier (and more reliable) to code this up using a plain pipe, but the same principle applies to networked transmissions.</p>

<p>For every digit we want to “send” back, we sleep a few seconds, then drain the pipe. We don’t care about the data, although if this were a video file or an OS update, we could probably do something useful with it.</p>

<p>Continuously fill the pipe with junk data. If (when) we block, calculate the difference between before and after. This is a our secret backchannel data. (The reader and writer use different buffer sizes because on OpenBSD at least, a writer will stay blocked even after a read depending on the space that opens up. Even simple demos have real world considerations.)</p>

<p>In this simple example, the secret data (argv) is shared by the processes, but we can see that the writer isn’t printing them from its own address space. Nevertheless, it works.</p>

<p>Time to add random delays and buffering to firewalls? Probably not.</p>
</blockquote>

<ul>
<li>An interesting thought experiment that shows just how many ways there are to covertly convey a message
***</li>
</ul>

<h3><a href="https://news.ycombinator.com/item?id=13223351" rel="nofollow">OpenBSD Desktop in about 30 Minutes</a></h3>

<ul>
<li>Over at hackernews we have a very non-verbose, but handy guide to getting to a OpenBSD desktop in about 30 minutes!</li>
<li>First, the guide will assume you’ve already installed OpenBSD 6.0, so you’ll need to at least be at the shell prompt of your freshly installed system to begin.</li>
<li>With that, now its time to do some tuning. Editing some resource limits in login.conf will be our initial task, upping some datasize tunables to 2GB</li>
<li>Next up, we will edit some of the default “doas” settings to something a bit more workable for desktop computing</li>
<li>Another handy trick, editing your .profile to have your PKG_PATH variables set automatically will make</li>
<li>One thing some folks may overlook, but disabling atime can speed disk performance (which you probably don’t care about atime on your desktop anyway), so this guide will show you what knobs to tweak in /etc/fstab to do so</li>
<li>After some final WPA / Wifi configuration, we then drop to “mere mortal” mode and begin our package installations. In this particular guide, he will be setting up Lumina Desktop (Which yes, it is on OpenBSD)</li>
<li>A few small tweaks later for xscreensaver and your xinitrc file, then you are ready to run “startx” and begin your desktop session!</li>
<li>All in all, great guide which if you are fast can probably be done in even less than 30 minutes and will result in a rock-solid OpenBSD desktop rocking Lumina none-the-less.
***</li>
</ul>

<h3><a href="https://hackernoon.com/dtrace-at-home-145ba773371e" rel="nofollow">How DTrace saved Christmas</a></h3>

<ul>
<li>Adam Leventhal, one of the co-creators of DTrace, wrote up this post about how he uses DTrace at home, to save Christmas</li>
</ul>

<blockquote>
<p>I had been procrastinating making the family holiday card. It was a combination of having a lot on my plate and dreading the formulation of our annual note recapping the year; there were some great moments, but I’m glad I don’t have to do 2016 again. It was just before midnight and either I’d make the card that night or leave an empty space on our friends’ refrigerators.</p>
</blockquote>

<ul>
<li>Adobe Illustrator had other ideas: “Unable to set maximum number of files to be opened”</li>
</ul>

<blockquote>
<p>I’m not the first person to hit this. The problem seems to have existed since CS6 was released in 2016. None of the solutions were working for me, and — inspired by <a href="https://medium.com/startup-grind/how-to-start-a-company-with-no-free-time-b70fbe7b918a#.uujdblxc6" rel="nofollow">Sara Mauskopf’s excellent post</a> — I was rapidly running out of the time bounds for the project. Enough; I’d just DTrace it.</p>

<p>A colleague scoffed the other day, “I mean, how often do you actually use DTrace?” In his mind DTrace was for big systems, critical system, when dollars and lives were at stake. My reply: I use DTrace every day. I can’t imagine developing software without DTrace, and I use it when my laptop (not infrequently) does something inexplicable (I’m forever grateful to the Apple team that ported it to Mac OS X)</p>

<p>Illustrator is failing on setrlimit(2) and blowing up as result. Let’s confirm that it is in fact returning -1:$ sudo dtrace -n &#39;syscall::setrlimit:return/execname == &quot;Adobe Illustrato&quot;/{ printf(&quot;%d %d&quot;, arg1, errno); }&#39;<br>
   dtrace: description &#39;syscall::setrlimit:return&#39; matched 1 probe<br>
   CPU     ID                    FUNCTION:NAME<br>
     0    532                 setrlimit:return -1 1</p>

<p>There it is. And setrlimit(2) is failing with errno 1 which is EPERM (value too high for non-root user). I already tuned up the files limit pretty high. Let’s confirm that it is in fact setting the files limit and check the value to which it’s being set. To write this script I looked at the documentation for setrlimit(2) (hooray for man pages!) to determine that the position of the resource parameter (arg0) and the type of the value parameter (struct rlimit). I needed the DTrace copyin() subroutine to grab the structure from the process’s address space:<br>
$ sudo dtrace -n &#39;syscall::setrlimit:entry/execname == &quot;Adobe Illustrato&quot;/{ this-&gt;r = *(struct rlimit *)copyin(arg1, sizeof (struct rlimit)); printf(&quot;%x %x %x&quot;, arg0, this-&gt;r.rlim_cur, this-&gt;r.rlim_max);  }&#39;</p>

<p>dtrace: description &#39;syscall::setrlimit:entry&#39; matched 1 probe<br>
   CPU     ID                FUNCTION:NAME<br>
     0    531              setrlimit:entry 1008 2800 7fffffffffffffff<br>
Looking through /usr/include/sys/resource.h we can see that 1008 corresponds to the number of files (RLIMIT_NOFILE | <br>
_RLIMIT_POSIX_FLAG)</p>

<p>The quickest solution was to use DTrace again to whack a smaller number into that struct rlimit. Easy:<br>
$ sudo dtrace -w -n &#39;syscall::setrlimit:entry/execname == &quot;Adobe Illustrato&quot;/{ this-&gt;i = (rlim_t *)alloca(sizeof (rlim_t)); *this-&gt;i = 10000; copyout(this-&gt;i, arg1 + sizeof (rlim_t), sizeof (rlim_t)); }&#39;</p>

<p>dtrace: description &#39;syscall::setrlimit:entry&#39; matched 1 probe<br>
   dtrace: could not enable tracing: Permission denied</p>

<p>Oh right. Thank you SIP (System Integrity Protection). This is a new laptop (at least a new motherboard due to some bizarre issue) which probably contributed to Illustrator not working when once it did. Because it’s new I haven’t yet disabled the part of SIP that prevents you from using DTrace on the kernel or in destructive mode (e.g. copyout()). It’s easy enough to disable, but I’m reboot-phobic — I hate having to restart my terminals — so I went to plan B: lldb</p>

<ul>
<li>After using DTrace to get the address of the setrlimit function, Adam used lldb to change the result before it got back to the application:
(lldb) break set -n _init
Breakpoint 1: 47 locations.
(lldb) run
…
(lldb) di -s 0x1006e5b72 -c 1
0x1006e5b72: callq  0x1011628e0     ; symbol stub for: setrlimit
(lldb) memory write 0x1006e5b72 0x31 0xc0 0x90 0x90 0x90
(lldb) di -s 0x1006e5b72 -c 4
0x1006e5b72: xorl   %eax, %eax
0x1006e5b74: nop
0x1006e5b75: nop
0x1006e5b76: nop</li>
</ul>

<p>Next I just did a process detach and got on with making that holiday card…</p>

<p>DTrace was designed for solving hard problems on critical systems, but the need to understand how systems behave exists in development and on consumer systems. Just because you didn’t write a program doesn’t mean you can’t fix it.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://functionallyparanoid.com/2016/12/22/say-my-blogs-name/" rel="nofollow">Say my Blog&#39;s name!</a></h3>

<ul>
<li>Brian Everly over at functionally paranoid has a treat for us today. Let us give you a moment to get the tin-foil hats on… Ok, done? Let’s begin!</li>
<li><p>He starts off with a look at physical security. He begins by listing your options:</p>

<blockquote>
<ol>
<li>BIOS passwords – Not something I’m typically impressed with.  Most can be avoided by opening up the machine, closing a jumper and powering it up to reset the NVRAM to factory defaults.  I don’t even bother with them.</li>
<li>Full disk encryption – This one really rings my bell in a positive way.  If you can kill power to the box (either because the bad actor has to physically steal it and they aren’t carrying around a pile of car batteries and an inverter or because you can interrupt power to it some other way), then the disk will be encrypted.  The other beauty of this is that if a drive fails (and they all do eventually) you don’t have to have any privacy concerns about chucking it into an electronics recycler (or if you are a bad, bad person, into a landfill) because that data is effectively gibberish without the key (or without a long time to brute force it).</li>
<li>Two factor auth for logins – I like this one as well.  I’m not a fan of biometrics because if your fingerprint is compromised (yes, it can happen – <a href="https://www.washingtonpost.com/news/federal-eye/wp/2015/07/09/hack-of-security-clearance-system-affected-21-5-million-people-federal-authorities-say/" rel="nofollow">read</a> about the department of defense background checks that were extracted by a bad agent – they included fingerprint images) you can’t exactly send off for a new finger.  Things like the <a href="https://www.yubico.com/" rel="nofollow">YubiKey</a> are pretty slick.  They require that you have the physical hardware key as well as the password so unless the bad actor lifted your physical key, they would have a much harder time with physical access to your hardware.</li>
</ol>
</blockquote></li>
<li><p>Out of those options, Brian mentions that he uses disk encryption and yubi-key for all his secure network systems.</p></li>
<li><p>Next up is network segmentation, in this case the first thing to do is change your admin password for any ISP supplied modem <br>
/ router. He goes on to scare us of javascript attacks being used not against your local machine, but instead non WAN exposed router admin interface. Scary Stuff!</p></li>
<li><p>For added security, naturally he firewalls the router by plugging in the LAN port to a OpenBSD box which does the 2nd layer of firewall / router protection.</p></li>
<li><p>What about privacy and browsing? Here’s some more of his tips:</p></li>
</ul>

<blockquote>
<p>I use Unbound as my DNS resolver on my local network (with all UDP port 53 traffic redirected to it by pf so I don’t have to configure anything on the clients) and then forward the traffic to DNSCrypt Proxy, caching the results in Unbound.  I notice ZERO performance penalty for this and it greatly enhances privacy.  This combination of Unbound and DNSCrypt Proxy works very well together.  You can even have redundancy by having multiple upstream resolvers running on different ports (basically run the DNSCrypt Proxy daemon multiple times pointing to different public resolvers).</p>

<p>I also use Firefox exclusively for my web browsing.  By leveraging the tips on <a href="https://www.privacytools.io/" rel="nofollow">this page</a>, you can lock it down to do a great job of privacy protection.  The fact that your laptop’s battery drain rate can be used to fingerprint your browser completely trips me out but hey – that’s the world we live in.’</p>
</blockquote>

<ul>
<li>What about the cloud you may ask? Well Brian has a nice solution for that as well:</li>
</ul>

<blockquote>
<p>I recently decided I would try to live a cloud-free life and I’ll give you a bit of a synopsis on it.  I discovered a wonderful Open Source project called <a href="http://www.freenas.org/" rel="nofollow">FreeNAS</a>.  What this little gem does is allow you to install a FreeBSD/zfs file server appliance on amd64 hardware and have a slick administrative web interface for managing it.  I picked up a nice SuperMicro motherboard and chassis that has 4 hot swap drive bays (and two internal bays that I used to mirror the boot volume on) and am rocking the zfs lifestyle!  (Thanks Alan Jude!)</p>

<p>One of the nicest features of the FreeNAS is that it provides the ability to leverage the FreeBSD jail functionality in an easy to use way.  It also has plugins but the security on those is a bit sketchy (old versions of libraries, etc.) so I decided to roll my own.  I created two jails – one to run OwnCloud (yeah, I know about NextCloud and might switch at some point) and the other to run a full SMTP/IMAP email server stack.  I used <a href="https://letsencrypt.org/" rel="nofollow">Lets Encrypt</a> to generate the SSL certificates and made sure I hit an A on <a href="https://www.ssllabs.com/" rel="nofollow">SSLLabs</a> before I did anything else.</p>
</blockquote>

<ul>
<li>His post then goes in to talk about Backups and IoT devices, something else you need to consider in this truely paranoid world we are forced to live in. We even get a nice shout-out near the end!</li>
</ul>

<blockquote>
<p>Enter <a href="http://www.tarsnap.com/" rel="nofollow">TarSnap</a> – a company that advertises itself as “Online Backups for the Truly Paranoid”.  It brings a tear to my eye – a kindred spirit!  :-)  Thanks again to Alan Jude and Kris Moore from the <a href="http://www.bsdnow.tv/" rel="nofollow">BSD Now podcast</a> for turning me onto this company.  It has a very easy command syntax (yes, it isn’t a GUI tool – suck it up buttercup, you wanted to learn the shell didn’t you?) and even allows you to compile the thing from source if you want to.”</p>
</blockquote>

<ul>
<li>We’ve only covered some of the highlights here, but you really should take a few moments of your time today and read this top to bottom. Lots of good tips here, already thinking how I can secure my home network better.</li>
</ul>

<hr>

<h3><a href="http://producingoss.com/en/producingoss.pdf" rel="nofollow">The open source book: “Producing Open Source Software”</a></h3>

<ul>
<li>“How to Run a Successful Free Software Project” by Karl Fogel</li>
<li>9 chapters and over 200 pages of content, plus many appendices</li>
<li>Some interesting topics include:

<ul>
<li>Choosing a good name</li>
<li>version control</li>
<li>bug tracking</li>
<li>creating developer guidelines</li>
<li>setting up communications channels</li>
<li>choosing a license (although this guide leans heavily towards the GPL)</li>
<li>setting the tone of the project</li>
<li>joining or creating a Non-Profit Organization</li>
<li>the economics of open source</li>
<li>release engineering, packaging, nightly builds, etc</li>
<li>how to deal with forks</li>
</ul></li>
<li>A lot of good information packaged into this ebook</li>
<li>This work is licensed under the Creative Commons Attribution-ShareAlike 4.0 International License
***</li>
</ul>

<h3><a href="http://www.venshare.com/dtrace-flamegraphs-for-freebsd-and-node-js-2/" rel="nofollow">DTrace Flamegraphs for node.js on FreeBSD </a></h3>

<ul>
<li>One of the coolest tools built on top of DTrace is flamegraphs</li>
<li>They are a very accurate, and visual way to see where a program is spending its time, which can tell you why it is slow, or where it could be improved. Further enhancements include off-cpu flame graphs, which tell you when the program is doing nothing, which can also be very useful
&gt; Recently BSD UNIXes are being acknowledged by the application development community as an interesting operating system to deploy to. This is not surprising given that FreeBSD had jails, the original container system, about 17 years ago and a lot of network focused businesses such as netflix see it as the best way to deliver content. This developer interest has led to hosting providers supporting FreeBSD. e.g. Amazon, Azure, Joyent and you can get a 2 months free instance at Digital Ocean.</li>
</ul>

<blockquote>
<p>DTrace is another vital feature for anyone who has had to deal with production issues and has been in FreeBSD since version 9. As of FreeBSD 11 the operating system now contains some great work by Fedor Indutny so you can profile node applications and create flamegraphs of node.js processes without any additional runtime flags or restarting of processes.</p>
</blockquote>

<ul>
<li>This is one of the most important things about DTrace. Many applications include some debugging functionality, but they require that you stop the application, and start it again in debugging mode. Some even require that you recompile the application in debugging mode.</li>
<li>Being able to attach DTrace to an application, while it is under load, while the problem is actively happening, can be critical to figuring out what is going on.</li>
<li><p>In order to configure your FreeBSD instance to utilize this feature make the following changes to the configuration of the server.</p>

<ul>
<li>Load the DTrace module at boot</li>
<li>Increase some DTrace limits</li>
<li>Install node with the optional DTrace feature compiled in</li>
<li>Follow the generic <a href="https://nodejs.org/en/blog/uncategorized/profiling-node-js/" rel="nofollow">node.js flamegraph tutorial</a>
&gt; I hope you find this article useful. The ability to look at a runtime in this manor has saved me twice this year and I hope it will save you in the future too. My next post on freeBSD and node.js will be looking at some scenarios on utilising the ZFS features.</li>
</ul></li>
<li><p>Also check out Brendan Gregg’s <a href="http://queue.acm.org/detail.cfm?id=2927301" rel="nofollow">ACM Queue Article</a> “The Flame Graph: This visualization of software execution is a new necessity for performance profiling and debugging”</p>

<hr></li>
</ul>

<h3><a href="https://sourceforge.net/p/sshguard/mailman/message/35580961/" rel="nofollow">SSHGuard 2.0 Call for Testing</a></h3>

<ul>
<li>SSHGuard is a tool for monitoring brute force attempts and blocking them</li>
<li>It has been a favourite of mine for a while because it runs as a pipe from syslogd, rather than reading the log files from the disk</li>
</ul>

<blockquote>
<p>A lot of work to get SSHGuard working with new log sources (journalctl, macOS log) and backends (firewalld, ipset) has happened in 2.0. The new version also uses a configuration file.</p>

<p>Most importantly, SSHGuard has been split into several processes piped into one another (sshg-logmon | sshg-parser | sshg-blocker | sshg-fw). sshg-parser can run with capsicum(4) and pledge(2). sshg-blocker can be sandboxed in its default configuration (without pid file, whitelist, blacklisting) and has not been tested sandboxed in other configurations.</p>
</blockquote>

<ul>
<li>Breaking the processes up so that the sensitive bits can be sandboxes is very nice to see
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://2007.asiabsdcon.org/papers/P16-paper.pdf" rel="nofollow">pjd’s 2007 paper from AsiaBSDCon: “Porting the ZFS file system to the FreeBSD operating system”</a> </p></li>
<li><p><a href="https://vimeo.com/user60888329" rel="nofollow">A Message From the FreeBSD Foundation</a> </p></li>
<li><p><a href="http://thenewstack.io/remembering-roger-faulkner/" rel="nofollow">Remembering Roger Faulkner, Unix Champion</a> and <a href="https://news.ycombinator.com/item?id=13293596" rel="nofollow">A few HN comments (including Bryan Cantrill)</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/QtyJeHMk" rel="nofollow"> Peter - TrueOS Network</a> </li>
<li><a href="http://pastebin.com/ru726VTV" rel="nofollow"> Chris - Remote Desktop</a> </li>
<li><a href="http://pastebin.com/LQZPgF5g" rel="nofollow"> Goetz - Geli on Serial</a> </li>
<li><a href="http://pastebin.com/jFeL8zKX" rel="nofollow"> Joe - BGP</a> </li>
<li><a href="http://pastebin.com/Xq9cbmfn" rel="nofollow"> Alejandro - BSD Router</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we’ve got all sorts of post-holiday goodies to share. New OpenSSL APIs, Dtrace, OpenBSD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.mail-archive.com/tech@openbsd.org/msg36437.html" rel="nofollow">OpenSSL 1.1 API migration path, or the lack thereof</a></h3>

<blockquote>
<p>As many of you will already be aware, the OpenSSL 1.1.0 release intentionally introduced significant API changes from the previous release. In summary, a large number of data structures that were previously publically visible have been made opaque, with accessor functions being added in order to get and set some of the fields within these now opaque structs. It is worth noting that the use of opaque data structures is generally beneficial for libraries, since changes can be made to these data structures without breaking the ABI. As such, the overall direction of these changes is largely reasonable.</p>

<p>However, while API change is generally necessary for progression, in this case it would appear that there is NO transition plan and a complete disregard for the impact that these changes would have on the overall open source ecosystem.</p>

<p>So far it seems that the only approach is to place the migration burden onto each and every software project that uses OpenSSL, pushing significant code changes to each project that migrates to OpenSSL 1.1, while maintaining compatibility with the previous API. This is forcing each project to provide their own backwards compatibility shims, which is practically guaranteeing that there will be a proliferation of variable quality implementations; it is almost a certainty that some of these will contain bugs, potentially introducing security issues or memory leaks.</p>
</blockquote>

<ul>
<li>I think this will be a bigger issue for other operating systems that do not have the flexibility of the ports tree to deliver a newer version of OpenSSL. If a project switches from the old API to the new API, and the OS only provides the older branch of OpenSSL, how can the application work?</li>
<li>Of course, this leaves the issue, if application A wants OpenSSL 1.0, and application B only works with OpenSSL 1.1, how does that work?</li>
</ul>

<blockquote>
<p>Due to a number of factors, software projects that make use of OpenSSL cannot simply migrate to the 1.1 API and drop support for the 1.0 API - in most cases they will need to continue to support both. Firstly, I am not aware of any platform that has shipped a production release with OpenSSL 1.1 - any software that supported OpenSSL 1.1 only, would effectively be unusable on every platform for the time being. Secondly, the OpenSSL 1.0.2 release is supported until the 31st of December 2019, while OpenSSL 1.1.0 is only supported until the 31st of August 2018 - any LTS style release is clearly going to consider shipping with 1.0.2 as a result.</p>

<p>Platforms that are attempting to ship with OpenSSL 1.1 are already encountering significant challenges - for example, Debian currently has 257 packages (out of 518) that do not build against OpenSSL 1.1. There are also hidden gotchas for situations where different libraries are linked against different OpenSSL versions and then share OpenSSL data structures between them - many of these problems will be difficult to detect since they only fail at runtime.</p>
</blockquote>

<ul>
<li>It will be interesting to see what happens with OpenSSL, and LibreSSL</li>
<li>Hopefully, most projects will decide to switch to the cleaner APIs provided by s2n or libtls, although they do not provide the entire functionality of the OpenSSL API.</li>
<li><a href="https://news.ycombinator.com/item?id=13284648" rel="nofollow">Hacker News comments</a>
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/exfiltration-via-receive-timing" rel="nofollow">exfiltration via receive timing</a></h3>

<blockquote>
<p>Another similar way to create a backchannel but without transmitting anything is to introduce delays in the receiver and measure throughput as observed by the sender. All we need is a protocol with transmission control. Hmmm. Actually, it’s easier (and more reliable) to code this up using a plain pipe, but the same principle applies to networked transmissions.</p>

<p>For every digit we want to “send” back, we sleep a few seconds, then drain the pipe. We don’t care about the data, although if this were a video file or an OS update, we could probably do something useful with it.</p>

<p>Continuously fill the pipe with junk data. If (when) we block, calculate the difference between before and after. This is a our secret backchannel data. (The reader and writer use different buffer sizes because on OpenBSD at least, a writer will stay blocked even after a read depending on the space that opens up. Even simple demos have real world considerations.)</p>

<p>In this simple example, the secret data (argv) is shared by the processes, but we can see that the writer isn’t printing them from its own address space. Nevertheless, it works.</p>

<p>Time to add random delays and buffering to firewalls? Probably not.</p>
</blockquote>

<ul>
<li>An interesting thought experiment that shows just how many ways there are to covertly convey a message
***</li>
</ul>

<h3><a href="https://news.ycombinator.com/item?id=13223351" rel="nofollow">OpenBSD Desktop in about 30 Minutes</a></h3>

<ul>
<li>Over at hackernews we have a very non-verbose, but handy guide to getting to a OpenBSD desktop in about 30 minutes!</li>
<li>First, the guide will assume you’ve already installed OpenBSD 6.0, so you’ll need to at least be at the shell prompt of your freshly installed system to begin.</li>
<li>With that, now its time to do some tuning. Editing some resource limits in login.conf will be our initial task, upping some datasize tunables to 2GB</li>
<li>Next up, we will edit some of the default “doas” settings to something a bit more workable for desktop computing</li>
<li>Another handy trick, editing your .profile to have your PKG_PATH variables set automatically will make</li>
<li>One thing some folks may overlook, but disabling atime can speed disk performance (which you probably don’t care about atime on your desktop anyway), so this guide will show you what knobs to tweak in /etc/fstab to do so</li>
<li>After some final WPA / Wifi configuration, we then drop to “mere mortal” mode and begin our package installations. In this particular guide, he will be setting up Lumina Desktop (Which yes, it is on OpenBSD)</li>
<li>A few small tweaks later for xscreensaver and your xinitrc file, then you are ready to run “startx” and begin your desktop session!</li>
<li>All in all, great guide which if you are fast can probably be done in even less than 30 minutes and will result in a rock-solid OpenBSD desktop rocking Lumina none-the-less.
***</li>
</ul>

<h3><a href="https://hackernoon.com/dtrace-at-home-145ba773371e" rel="nofollow">How DTrace saved Christmas</a></h3>

<ul>
<li>Adam Leventhal, one of the co-creators of DTrace, wrote up this post about how he uses DTrace at home, to save Christmas</li>
</ul>

<blockquote>
<p>I had been procrastinating making the family holiday card. It was a combination of having a lot on my plate and dreading the formulation of our annual note recapping the year; there were some great moments, but I’m glad I don’t have to do 2016 again. It was just before midnight and either I’d make the card that night or leave an empty space on our friends’ refrigerators.</p>
</blockquote>

<ul>
<li>Adobe Illustrator had other ideas: “Unable to set maximum number of files to be opened”</li>
</ul>

<blockquote>
<p>I’m not the first person to hit this. The problem seems to have existed since CS6 was released in 2016. None of the solutions were working for me, and — inspired by <a href="https://medium.com/startup-grind/how-to-start-a-company-with-no-free-time-b70fbe7b918a#.uujdblxc6" rel="nofollow">Sara Mauskopf’s excellent post</a> — I was rapidly running out of the time bounds for the project. Enough; I’d just DTrace it.</p>

<p>A colleague scoffed the other day, “I mean, how often do you actually use DTrace?” In his mind DTrace was for big systems, critical system, when dollars and lives were at stake. My reply: I use DTrace every day. I can’t imagine developing software without DTrace, and I use it when my laptop (not infrequently) does something inexplicable (I’m forever grateful to the Apple team that ported it to Mac OS X)</p>

<p>Illustrator is failing on setrlimit(2) and blowing up as result. Let’s confirm that it is in fact returning -1:$ sudo dtrace -n &#39;syscall::setrlimit:return/execname == &quot;Adobe Illustrato&quot;/{ printf(&quot;%d %d&quot;, arg1, errno); }&#39;<br>
   dtrace: description &#39;syscall::setrlimit:return&#39; matched 1 probe<br>
   CPU     ID                    FUNCTION:NAME<br>
     0    532                 setrlimit:return -1 1</p>

<p>There it is. And setrlimit(2) is failing with errno 1 which is EPERM (value too high for non-root user). I already tuned up the files limit pretty high. Let’s confirm that it is in fact setting the files limit and check the value to which it’s being set. To write this script I looked at the documentation for setrlimit(2) (hooray for man pages!) to determine that the position of the resource parameter (arg0) and the type of the value parameter (struct rlimit). I needed the DTrace copyin() subroutine to grab the structure from the process’s address space:<br>
$ sudo dtrace -n &#39;syscall::setrlimit:entry/execname == &quot;Adobe Illustrato&quot;/{ this-&gt;r = *(struct rlimit *)copyin(arg1, sizeof (struct rlimit)); printf(&quot;%x %x %x&quot;, arg0, this-&gt;r.rlim_cur, this-&gt;r.rlim_max);  }&#39;</p>

<p>dtrace: description &#39;syscall::setrlimit:entry&#39; matched 1 probe<br>
   CPU     ID                FUNCTION:NAME<br>
     0    531              setrlimit:entry 1008 2800 7fffffffffffffff<br>
Looking through /usr/include/sys/resource.h we can see that 1008 corresponds to the number of files (RLIMIT_NOFILE | <br>
_RLIMIT_POSIX_FLAG)</p>

<p>The quickest solution was to use DTrace again to whack a smaller number into that struct rlimit. Easy:<br>
$ sudo dtrace -w -n &#39;syscall::setrlimit:entry/execname == &quot;Adobe Illustrato&quot;/{ this-&gt;i = (rlim_t *)alloca(sizeof (rlim_t)); *this-&gt;i = 10000; copyout(this-&gt;i, arg1 + sizeof (rlim_t), sizeof (rlim_t)); }&#39;</p>

<p>dtrace: description &#39;syscall::setrlimit:entry&#39; matched 1 probe<br>
   dtrace: could not enable tracing: Permission denied</p>

<p>Oh right. Thank you SIP (System Integrity Protection). This is a new laptop (at least a new motherboard due to some bizarre issue) which probably contributed to Illustrator not working when once it did. Because it’s new I haven’t yet disabled the part of SIP that prevents you from using DTrace on the kernel or in destructive mode (e.g. copyout()). It’s easy enough to disable, but I’m reboot-phobic — I hate having to restart my terminals — so I went to plan B: lldb</p>

<ul>
<li>After using DTrace to get the address of the setrlimit function, Adam used lldb to change the result before it got back to the application:
(lldb) break set -n _init
Breakpoint 1: 47 locations.
(lldb) run
…
(lldb) di -s 0x1006e5b72 -c 1
0x1006e5b72: callq  0x1011628e0     ; symbol stub for: setrlimit
(lldb) memory write 0x1006e5b72 0x31 0xc0 0x90 0x90 0x90
(lldb) di -s 0x1006e5b72 -c 4
0x1006e5b72: xorl   %eax, %eax
0x1006e5b74: nop
0x1006e5b75: nop
0x1006e5b76: nop</li>
</ul>

<p>Next I just did a process detach and got on with making that holiday card…</p>

<p>DTrace was designed for solving hard problems on critical systems, but the need to understand how systems behave exists in development and on consumer systems. Just because you didn’t write a program doesn’t mean you can’t fix it.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://functionallyparanoid.com/2016/12/22/say-my-blogs-name/" rel="nofollow">Say my Blog&#39;s name!</a></h3>

<ul>
<li>Brian Everly over at functionally paranoid has a treat for us today. Let us give you a moment to get the tin-foil hats on… Ok, done? Let’s begin!</li>
<li><p>He starts off with a look at physical security. He begins by listing your options:</p>

<blockquote>
<ol>
<li>BIOS passwords – Not something I’m typically impressed with.  Most can be avoided by opening up the machine, closing a jumper and powering it up to reset the NVRAM to factory defaults.  I don’t even bother with them.</li>
<li>Full disk encryption – This one really rings my bell in a positive way.  If you can kill power to the box (either because the bad actor has to physically steal it and they aren’t carrying around a pile of car batteries and an inverter or because you can interrupt power to it some other way), then the disk will be encrypted.  The other beauty of this is that if a drive fails (and they all do eventually) you don’t have to have any privacy concerns about chucking it into an electronics recycler (or if you are a bad, bad person, into a landfill) because that data is effectively gibberish without the key (or without a long time to brute force it).</li>
<li>Two factor auth for logins – I like this one as well.  I’m not a fan of biometrics because if your fingerprint is compromised (yes, it can happen – <a href="https://www.washingtonpost.com/news/federal-eye/wp/2015/07/09/hack-of-security-clearance-system-affected-21-5-million-people-federal-authorities-say/" rel="nofollow">read</a> about the department of defense background checks that were extracted by a bad agent – they included fingerprint images) you can’t exactly send off for a new finger.  Things like the <a href="https://www.yubico.com/" rel="nofollow">YubiKey</a> are pretty slick.  They require that you have the physical hardware key as well as the password so unless the bad actor lifted your physical key, they would have a much harder time with physical access to your hardware.</li>
</ol>
</blockquote></li>
<li><p>Out of those options, Brian mentions that he uses disk encryption and yubi-key for all his secure network systems.</p></li>
<li><p>Next up is network segmentation, in this case the first thing to do is change your admin password for any ISP supplied modem <br>
/ router. He goes on to scare us of javascript attacks being used not against your local machine, but instead non WAN exposed router admin interface. Scary Stuff!</p></li>
<li><p>For added security, naturally he firewalls the router by plugging in the LAN port to a OpenBSD box which does the 2nd layer of firewall / router protection.</p></li>
<li><p>What about privacy and browsing? Here’s some more of his tips:</p></li>
</ul>

<blockquote>
<p>I use Unbound as my DNS resolver on my local network (with all UDP port 53 traffic redirected to it by pf so I don’t have to configure anything on the clients) and then forward the traffic to DNSCrypt Proxy, caching the results in Unbound.  I notice ZERO performance penalty for this and it greatly enhances privacy.  This combination of Unbound and DNSCrypt Proxy works very well together.  You can even have redundancy by having multiple upstream resolvers running on different ports (basically run the DNSCrypt Proxy daemon multiple times pointing to different public resolvers).</p>

<p>I also use Firefox exclusively for my web browsing.  By leveraging the tips on <a href="https://www.privacytools.io/" rel="nofollow">this page</a>, you can lock it down to do a great job of privacy protection.  The fact that your laptop’s battery drain rate can be used to fingerprint your browser completely trips me out but hey – that’s the world we live in.’</p>
</blockquote>

<ul>
<li>What about the cloud you may ask? Well Brian has a nice solution for that as well:</li>
</ul>

<blockquote>
<p>I recently decided I would try to live a cloud-free life and I’ll give you a bit of a synopsis on it.  I discovered a wonderful Open Source project called <a href="http://www.freenas.org/" rel="nofollow">FreeNAS</a>.  What this little gem does is allow you to install a FreeBSD/zfs file server appliance on amd64 hardware and have a slick administrative web interface for managing it.  I picked up a nice SuperMicro motherboard and chassis that has 4 hot swap drive bays (and two internal bays that I used to mirror the boot volume on) and am rocking the zfs lifestyle!  (Thanks Alan Jude!)</p>

<p>One of the nicest features of the FreeNAS is that it provides the ability to leverage the FreeBSD jail functionality in an easy to use way.  It also has plugins but the security on those is a bit sketchy (old versions of libraries, etc.) so I decided to roll my own.  I created two jails – one to run OwnCloud (yeah, I know about NextCloud and might switch at some point) and the other to run a full SMTP/IMAP email server stack.  I used <a href="https://letsencrypt.org/" rel="nofollow">Lets Encrypt</a> to generate the SSL certificates and made sure I hit an A on <a href="https://www.ssllabs.com/" rel="nofollow">SSLLabs</a> before I did anything else.</p>
</blockquote>

<ul>
<li>His post then goes in to talk about Backups and IoT devices, something else you need to consider in this truely paranoid world we are forced to live in. We even get a nice shout-out near the end!</li>
</ul>

<blockquote>
<p>Enter <a href="http://www.tarsnap.com/" rel="nofollow">TarSnap</a> – a company that advertises itself as “Online Backups for the Truly Paranoid”.  It brings a tear to my eye – a kindred spirit!  :-)  Thanks again to Alan Jude and Kris Moore from the <a href="http://www.bsdnow.tv/" rel="nofollow">BSD Now podcast</a> for turning me onto this company.  It has a very easy command syntax (yes, it isn’t a GUI tool – suck it up buttercup, you wanted to learn the shell didn’t you?) and even allows you to compile the thing from source if you want to.”</p>
</blockquote>

<ul>
<li>We’ve only covered some of the highlights here, but you really should take a few moments of your time today and read this top to bottom. Lots of good tips here, already thinking how I can secure my home network better.</li>
</ul>

<hr>

<h3><a href="http://producingoss.com/en/producingoss.pdf" rel="nofollow">The open source book: “Producing Open Source Software”</a></h3>

<ul>
<li>“How to Run a Successful Free Software Project” by Karl Fogel</li>
<li>9 chapters and over 200 pages of content, plus many appendices</li>
<li>Some interesting topics include:

<ul>
<li>Choosing a good name</li>
<li>version control</li>
<li>bug tracking</li>
<li>creating developer guidelines</li>
<li>setting up communications channels</li>
<li>choosing a license (although this guide leans heavily towards the GPL)</li>
<li>setting the tone of the project</li>
<li>joining or creating a Non-Profit Organization</li>
<li>the economics of open source</li>
<li>release engineering, packaging, nightly builds, etc</li>
<li>how to deal with forks</li>
</ul></li>
<li>A lot of good information packaged into this ebook</li>
<li>This work is licensed under the Creative Commons Attribution-ShareAlike 4.0 International License
***</li>
</ul>

<h3><a href="http://www.venshare.com/dtrace-flamegraphs-for-freebsd-and-node-js-2/" rel="nofollow">DTrace Flamegraphs for node.js on FreeBSD </a></h3>

<ul>
<li>One of the coolest tools built on top of DTrace is flamegraphs</li>
<li>They are a very accurate, and visual way to see where a program is spending its time, which can tell you why it is slow, or where it could be improved. Further enhancements include off-cpu flame graphs, which tell you when the program is doing nothing, which can also be very useful
&gt; Recently BSD UNIXes are being acknowledged by the application development community as an interesting operating system to deploy to. This is not surprising given that FreeBSD had jails, the original container system, about 17 years ago and a lot of network focused businesses such as netflix see it as the best way to deliver content. This developer interest has led to hosting providers supporting FreeBSD. e.g. Amazon, Azure, Joyent and you can get a 2 months free instance at Digital Ocean.</li>
</ul>

<blockquote>
<p>DTrace is another vital feature for anyone who has had to deal with production issues and has been in FreeBSD since version 9. As of FreeBSD 11 the operating system now contains some great work by Fedor Indutny so you can profile node applications and create flamegraphs of node.js processes without any additional runtime flags or restarting of processes.</p>
</blockquote>

<ul>
<li>This is one of the most important things about DTrace. Many applications include some debugging functionality, but they require that you stop the application, and start it again in debugging mode. Some even require that you recompile the application in debugging mode.</li>
<li>Being able to attach DTrace to an application, while it is under load, while the problem is actively happening, can be critical to figuring out what is going on.</li>
<li><p>In order to configure your FreeBSD instance to utilize this feature make the following changes to the configuration of the server.</p>

<ul>
<li>Load the DTrace module at boot</li>
<li>Increase some DTrace limits</li>
<li>Install node with the optional DTrace feature compiled in</li>
<li>Follow the generic <a href="https://nodejs.org/en/blog/uncategorized/profiling-node-js/" rel="nofollow">node.js flamegraph tutorial</a>
&gt; I hope you find this article useful. The ability to look at a runtime in this manor has saved me twice this year and I hope it will save you in the future too. My next post on freeBSD and node.js will be looking at some scenarios on utilising the ZFS features.</li>
</ul></li>
<li><p>Also check out Brendan Gregg’s <a href="http://queue.acm.org/detail.cfm?id=2927301" rel="nofollow">ACM Queue Article</a> “The Flame Graph: This visualization of software execution is a new necessity for performance profiling and debugging”</p>

<hr></li>
</ul>

<h3><a href="https://sourceforge.net/p/sshguard/mailman/message/35580961/" rel="nofollow">SSHGuard 2.0 Call for Testing</a></h3>

<ul>
<li>SSHGuard is a tool for monitoring brute force attempts and blocking them</li>
<li>It has been a favourite of mine for a while because it runs as a pipe from syslogd, rather than reading the log files from the disk</li>
</ul>

<blockquote>
<p>A lot of work to get SSHGuard working with new log sources (journalctl, macOS log) and backends (firewalld, ipset) has happened in 2.0. The new version also uses a configuration file.</p>

<p>Most importantly, SSHGuard has been split into several processes piped into one another (sshg-logmon | sshg-parser | sshg-blocker | sshg-fw). sshg-parser can run with capsicum(4) and pledge(2). sshg-blocker can be sandboxed in its default configuration (without pid file, whitelist, blacklisting) and has not been tested sandboxed in other configurations.</p>
</blockquote>

<ul>
<li>Breaking the processes up so that the sensitive bits can be sandboxes is very nice to see
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://2007.asiabsdcon.org/papers/P16-paper.pdf" rel="nofollow">pjd’s 2007 paper from AsiaBSDCon: “Porting the ZFS file system to the FreeBSD operating system”</a> </p></li>
<li><p><a href="https://vimeo.com/user60888329" rel="nofollow">A Message From the FreeBSD Foundation</a> </p></li>
<li><p><a href="http://thenewstack.io/remembering-roger-faulkner/" rel="nofollow">Remembering Roger Faulkner, Unix Champion</a> and <a href="https://news.ycombinator.com/item?id=13293596" rel="nofollow">A few HN comments (including Bryan Cantrill)</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/QtyJeHMk" rel="nofollow"> Peter - TrueOS Network</a> </li>
<li><a href="http://pastebin.com/ru726VTV" rel="nofollow"> Chris - Remote Desktop</a> </li>
<li><a href="http://pastebin.com/LQZPgF5g" rel="nofollow"> Goetz - Geli on Serial</a> </li>
<li><a href="http://pastebin.com/jFeL8zKX" rel="nofollow"> Joe - BGP</a> </li>
<li><a href="http://pastebin.com/Xq9cbmfn" rel="nofollow"> Alejandro - BSD Router</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>174: 2016 Highlights</title>
  <link>https://www.bsdnow.tv/174</link>
  <guid isPermaLink="false">129f9ebc-cd7f-4fc5-b50f-51b8d71f7504</guid>
  <pubDate>Thu, 29 Dec 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/129f9ebc-cd7f-4fc5-b50f-51b8d71f7504.mp3" length="84274708" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>A look back at 2016</itunes:subtitle>
  <itunes:duration>2:55:34</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>A look back at 2016
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and 
Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
&lt;h3&gt;Links&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;a href="http://www.jupiterbroadcasting.com/92416/zfs-in-the-trenches-bsd-now-123/"&gt;ZFS in the trenches 
| BSD Now 123&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.jupiterbroadcasting.com/99991/one-small-step-for-drm-one-giant-leap-for-bsd-bsd-now-143/"&gt;One small step for 
DRM, one giant leap for BSD | BSD Now 143&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.jupiterbroadcasting.com/101501/the-laporte-has-landed-bsd-now-152/"&gt;The Laporte has landed! | BSD Now 
152&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.jupiterbroadcasting.com/102941/ham-radio-pie-oh-my-bsd-now-158/"&gt;Ham, Radio &amp;amp; Pie, Oh 
My! | BSD Now 158&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.jupiterbroadcasting.com/103626/the-foundation-of-netbsd-bsd-now-162/"&gt;The 
Foundation of NetBSD | BSD Now 162&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;
&lt;a href="http://www.jupiterbroadcasting.com/103871/return-of-the-cantrill-bsd-now-163/"&gt;Return of the Cantrill | BSD Now 163&lt;/a&gt;
&lt;/li&gt;
&lt;/ul&gt;</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A look back at 2016</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" <br>
title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<p><h3>Links</h3><ul><li><a href="http://www.jupiterbroadcasting.com/92416/zfs-in-the-trenches-bsd-now-123/">ZFS in the trenches <br>
| BSD Now 123</a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/99991/one-small-step-for-drm-one-giant-leap-for-bsd-bsd-now-143/">One small step for <br>
DRM, one giant leap for BSD | BSD Now 143</a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/101501/the-laporte-has-landed-bsd-now-152/">The Laporte has landed! | BSD Now <br>
152</a></li><li><a href="http://www.jupiterbroadcasting.com/102941/ham-radio-pie-oh-my-bsd-now-158/">Ham, Radio &amp; Pie, Oh <br>
My! | BSD Now 158</a></li><li><a href="http://www.jupiterbroadcasting.com/103626/the-foundation-of-netbsd-bsd-now-162/">The <br>
Foundation of NetBSD | BSD Now 162</a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/103871/return-of-the-cantrill-bsd-now-163/">Return of the Cantrill | BSD Now 163</a></p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A look back at 2016</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" <br>
title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<p><h3>Links</h3><ul><li><a href="http://www.jupiterbroadcasting.com/92416/zfs-in-the-trenches-bsd-now-123/">ZFS in the trenches <br>
| BSD Now 123</a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/99991/one-small-step-for-drm-one-giant-leap-for-bsd-bsd-now-143/">One small step for <br>
DRM, one giant leap for BSD | BSD Now 143</a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/101501/the-laporte-has-landed-bsd-now-152/">The Laporte has landed! | BSD Now <br>
152</a></li><li><a href="http://www.jupiterbroadcasting.com/102941/ham-radio-pie-oh-my-bsd-now-158/">Ham, Radio &amp; Pie, Oh <br>
My! | BSD Now 158</a></li><li><a href="http://www.jupiterbroadcasting.com/103626/the-foundation-of-netbsd-bsd-now-162/">The <br>
Foundation of NetBSD | BSD Now 162</a></li><li><a <br>
href="http://www.jupiterbroadcasting.com/103871/return-of-the-cantrill-bsd-now-163/">Return of the Cantrill | BSD Now 163</a></p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>173: Carry on my Wayland son</title>
  <link>https://www.bsdnow.tv/173</link>
  <guid isPermaLink="false">2a58c833-1f45-4da6-a9b8-fe475b5f00ea</guid>
  <pubDate>Wed, 21 Dec 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2a58c833-1f45-4da6-a9b8-fe475b5f00ea.mp3" length="53736628" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we’ve got some great stories to bring you, a look at the odder side of UNIX history</itunes:subtitle>
  <itunes:duration>1:14:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we’ve got some great stories to bring you, a look at the odder side of UNIX history
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and 
Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
syspatch in testing state (http://marc.info/?l=openbsd-tech&amp;amp;m=148058309126053&amp;amp;w=2)
Antoine Jacoutot ajacoutot@ openbsd has posted a call for testing for OpenBSD’s new syspatch tool
“syspatch(8), a "binary" patch system for -release is now ready for early testing. This does not use binary diffing to update the system, but regular signed tarballs containing the updated files (ala installer).”
“I would appreciate feedback on the tool. But please send it directly to me, there's no need to pollute the list. This is obviously WIP and the tool may or may not change in drastic ways.”
“These test binary patches are not endorsed by the OpenBSD project and should not be trusted, I am only providing them to get early feedback on the tool. If all goes as planned, I am hoping that syspatch will make it into the 6.1 release; but for it to happen, I need to know how it breaks your systems :-)”
Instructions (http://syspatch.openbsd.org/pub/OpenBSD/6.0/syspatch/amd64/README.txt)
If you test it, report back and let us know how it went
***
Weston working (https://lists.freebsd.org/pipermail/freebsd-current/2016-December/064198.html)
Over the past few years we’ve had some user-interest in the state of Wayland / Weston on FreeBSD. In the past day or so, Johannes Lundberg has sent in a progress report to the FreeBSD mailing lists.
Without further ADO:
We had some progress with Wayland that we'd like to share.
Wayland (v1.12.0)
  Working
Weston (v1.12.0)
  Working (Porting WIP)
Weston-clients (installed with wayland/weston port)
  Working
XWayland (run X11 apps in Wayland compositor)
  Works (maximized window only) if started manually but not when
  launching X11 app from Weston.  Most likely problem with Weston IPC.
Sway (i3-compatible Wayland compositor)
  Working
SDL20 (Wayland backend)
  games/stonesoup-sdl briefly tested.
  https://twitter.com/johalun/status/811334203358867456
GDM (with Wayland)
  Halted - depends on logind.
GTK3
  gtk3-demo runs fine on Weston (might have to set GDK_BACKEND=wayland
first.
  GTK3 apps working (gedit, gnumeric, xfce4-terminal tested, xfce desktop
(4.12) does not yet support GTK3)“
Johannes goes on to give instructions on how / where you can fetch their WiP and do your own testing. At the moment you’ll need Matt Macy’s newer Intel video work, as well as their ports tree which includes all the necessary software bits.
Before anybody asks, yes we are watching this for TrueOS!
***
Where the rubber meets the road (part two) (https://functionallyparanoid.com/2016/12/15/where-the-rubber-meets-the-road-part-two/)
Continuing with our story from Brian Everly from a week ago, we have an update today on the process to dual-boot OpenBSD with Arch Linux.
As we last left off, Arch was up and running on the laptop, but some quirks in the hardware meant OpenBSD would take a bit longer. 
With those issues resolved and the HD seen again, the next issue that reared its head was OpenBSD not seeing the partition tables on the disk. After much frustration, it was time to nuke and pave, starting with OpenBSD first this time.
After a successful GPT partitioning and install of OpenBSD, he went back to installing Arch, and then the story got more interesting. 
“I installed Arch as I detailed in my last post; however, when I fired up gdisk I got a weird error message:
“Warning! Disk size is smaller than the main header indicates! Loading secondary header from the last sector of the disk! You should use ‘v’ to verify disk integrity, and perhaps options on the expert’s menu to repair the disk.”
Immediately after this, I saw a second warning:
“Caution: Invalid backup GPT header, but valid main header; regenerating backup header from main header.”
And, not to be outdone, there was a third:
“Warning! Main and backup partition tables differ! Use the ‘c’ and ‘e’ options on the recovery &amp;amp; transformation menu to examine the two tables.”
Finally (not kidding), there was a fourth:
“Warning! One or more CRCs don’t match. You should repair the disk!”
Given all of that, I thought to myself, “This is probably why I couldn’t see the disk properly when I partitioned it under Linux on the OpenBSD side.  I’ll let it repair things and I should be good to go.”  I then followed the recommendation and repaired things, using the primary GPT table to recreate the backup one.  I then installed Arch and figured I was good to go.“
After confirming through several additional re-installs that the behavior was reproducible, he then decided to go full on crazy,and partition with MBR. That in and of itself was a challenge, since as he mentions, not many people dual-boot OpenBSD with Linux on MBR, especially using luks and lvm!
If you want to see the details on how that was done, check it out.
The story ends in success though! And better yet:
“Now that I have everything working, I’ll restore my config and data to Arch, configure OpenBSD the way I like it and get moving.  I’ll take some time and drop a note on the tech@ mailing list for OpenBSD to see if they can figure out what the GPT problem was I was running into.  Hopefully it will make that part of the code stronger to get an edge-case bug report like this.”
Take note here, if you run into issues like this with any OS, be sure to document in detail what happened so developers can explore solutions to the issue. 
***
FreeBSD and ZFS as a time capsule for OS X  (https://blog.feld.me/posts/2016/12/using-freebsd-as-a-time-capsule-for-osx/)
Do you have any Apple users in your life? Perhaps you run FreeBSD for ZFS somewhere else in the house or office. Well today we have a blog post from Mark Felder which shows how you can use FreeBSD as a time-capsule for your OSX systems.
The setup is quite simple, to get started you’ll need packages for netatalk3 and avahi-app for service discovery.
Next up will be your AFP configuration. He helpfully provides a nice example that you should be able to just cut-n-paste. Be sure to check the hosts allow lines and adjust to fit your network. Also of note will be the backup location and valid users to adjust.
A little easier should be the avahi setup, which can be a straight copy-n-paste from the site, which will perform the service advertisements.
The final piece is just enabling specific services in /etc/rc.conf and either starting them by hand, or rebooting. At this point your OSX systems should be able to discover the new time-capsule provider on the network and DTRT.
***
News Roundup
netbenches - FreeBSD network forwarding performance benchmark results (https://github.com/ocochard/netbenches)
Olivier Cochard-Labbé, original creator of FreeNAS, and leader of the BSD Router Project, has a github repo of network benchmarks
There are many interesting results, and all of the scripts, documentation, and configuration files to run the tests yourself
IPSec Performance on an Atom C2558, 12-head vs IPSec Performance Branch  (https://github.com/ocochard/netbenches/tree/master/Atom_C2558_4Cores-Intel_i350/ipsec/results/fbsd12.projects-ipsec.equilibrium) 
Compared to: Xeon L5630 2.13GHz  (https://github.com/ocochard/netbenches/tree/2f3bb1b3c51e454736f1fcc650c3328071834f8d/Xeon_L5630-4Cores-Intel_82599EB/ipsec/results/fbsd11.0) 
and IPSec with Authentication  (https://github.com/ocochard/netbenches/tree/305235114ba8a3748ad9681c629333f87f82613a/Atom_C2558_4Cores-Intel_i350/ipsec.ah/results/fbsd12.projects-ipsec.equilibrium) 
I look forward to seeing tests on even more hardware, as people with access to different configurations try out these benchmarks
***
A tcpdump Tutorial and Primer with Examples (https://danielmiessler.com/study/tcpdump/)
Most users will be familiar with the basics of using tcpdump, but this tutorial/primer is likely to fill in a lot of blanks, and advance many users understanding of tcpdump
“tcpdump is the premier network analysis tool for information security professionals. Having a solid grasp of this über-powerful application is mandatory for anyone desiring a thorough understanding of TCP/IP. Many prefer to use higher level analysis tools such as Wireshark, but I believe this to usually be a mistake.”
tcpdump is an important tool for any system or network administrator, it is not just for security. It is often the best way to figure out why the network is not behaving as expected.
“In a discipline so dependent on a true understanding of concepts vs. rote learning, it’s important to stay fluent in the underlying mechanics of the TCP/IP suite. A thorough grasp of these protocols allows one to troubleshoot at a level far beyond the average analyst, but mastery of the protocols is only possible through continued exposure to them.”
Not just that, but TCP/IP is a very interesting protocol, considering how little it has changed in its 40+ year history
“First off, I like to add a few options to the tcpdump command itself, depending on what I’m looking at. The first of these is -n, which requests that names are not resolved, resulting in the IPs themselves always being displayed. The second is -X, which displays both hex and ascii content within the packet.”
“It’s also important to note that tcpdump only takes the first 96 bytes of data from a packet by default. If you would like to look at more, add the -s number option to the mix, where number is the number of bytes you want to capture. I recommend using 0 (zero) for a snaplength, which gets everything.”
The page has a nice table of the most useful options
It also has a great primer on doing basic filtering
If you are relatively new to using tcpdump, I highly recommend you spend a few minutes reading through this article
***
How Unix made it to the top (http://minnie.tuhs.org/pipermail/tuhs/2016-December/007519.html)
Doug McIlroy gives us a nice background post on how “Unix made it to the top”
It’s fairly short / concise, so I felt it would be good to read in its entirety. 
“It has often been told how the Bell Labs law department became the first non-research department to use Unix, displacing a newly acquired stand-alone word-processing system that fell short of the department's hopes because it couldn't number the lines on patent applications, as USPTO required. When Joe Ossanna heard of this, he told them about roff and promised to give it line-numbering capability the next day. They tried it and were hooked. Patent secretaries became remote members of the fellowship of the Unix lab. In due time the law department got its own machine.
Less well known is how Unix made it into the head office of AT&amp;amp;T. It seems that the CEO, Charlie Brown, did not like to be seen wearing glasses when he read speeches. Somehow his PR assistant learned of the CAT phototypesetter in the Unix lab and asked whether it might be possible to use it to produce scripts in large type. Of course it was. As connections to the top never hurt, the CEO's office was welcomed as another ouside user. The cost--occasionally having to develop film for the final copy of a speech--was not onerous.
Having teethed on speeches, the head office realized that Unix could also be useful for things that didn't need phototypesetting. Other documents began to accumulate in their directory. By the time we became aware of it, the hoard came to include minutes of AT&amp;amp;T board meetings. It didn't seem like a very good idea for us to be keeping records from the inner sanctum of the corporation on a computer where most everybody had super-user privileges. A call to the PR guy convinced him of the wisdom of keeping such things on their own premises. And so the CEO's office bought a Unix system.
Just as one hears of cars chosen for their cupholders, so were theseusers converted to Unix for trivial reasons: line numbers and vanity.“
Odd Comments and Strange Doings in Unix (http://orkinos.cmpe.boun.edu.tr/~kosar/odd.html)
Everybody loves easter-eggs, and today we have some fun odd ones from the history throughout UNIX told by Dennis Ritchie.
First up, was a fun one where the “mv” command could sometimes print the following “values of b may give rise to dom!”

“Like most of the messages recorded in these compilations, this one was produced in some situation that we considered unlikely or as result of abuse; the details don't matter. I'm recording why the phrase was selected.
The very first use of Unix in the "real business" of Bell Labs was to type and produce patent applications, and for a while in the early 1970s we had three typists busily typing away in the grotty lab on the sixth floor. One day someone came in and observed on the paper sticking out of one of the Teletypes, displayed in magnificent isolation, this ominous phrase:    values of b may give rise to dom!
It was of course obvious that the typist had interrupted a printout (generating the "!" from the ed editor) and moved up the paper, and that the context must have been something like "varying values of beta may give rise to domain wall movement" or some other fragment of a physically plausible patent application.But the phrase itself was just so striking! Utterly meaningless, but it looks like what... a warning? What is "dom?"
At the same time, we were experimenting with text-to-voice software by Doug McIlroy and others, and of course the phrase was tried out with it. For whatever reason, its rendition of "give rise to dom!" accented the last word in a way that emphasized the phonetic similarity between "doom" and the first syllable of "dominance." It pronounced "beta" in the British style, "beeta." The entire occurrence became a small, shared treasure.The phrase had to be recorded somewhere, and it was, in the v6 source. Most likely it was Bob Morris who did the deed, but it could just as easily have been Ken. I hope that your browser reproduces the b as a Greek beta.“
Next up is one you might have heard before: 
/* You are not expected to understand this */&amp;gt; Every now and then on Usenet or elsewhere I run across a reference to a certain comment in the source code of the Sixth 
Edition Unix operating system.
I've even been given two sweatshirts that quote it.
Most probably just heard about it, but those who saw it in the flesh either had Sixth Edition Unix (ca. 1975) or read the annotated version of this system by John Lions (which was republished in 1996: ISBN 1-57298-013-7, Peer-to-Peer Communications).It's often quoted as a slur on the quantity or quality of the comments in the Bell Labs research releases of Unix. Not an unfair observation in general, I fear, but in this case unjustified. 
So we tried to explain what was going on. "You are not expected to understand this" was intended as a remark in the spirit of "This won't be on the exam," rather than as an impudent challenge. 
There’s a few other interesting stories as well, if the odd/fun side of UNIX history at all interests you, I would recommend checking it out.
Beastie Bits
With patches in review the #FreeBSD base system builds 100% reproducibly (https://twitter.com/ed_maste/status/811289279611682816)
BSDCan 2017 Call for Participation (https://www.freebsdfoundation.org/news-and-events/call-for-papers/bsdcan-2017/)
ioCell 2.0 released  (https://github.com/bartekrutkowski/iocell/releases) 
who even calls link_ntoa? (http://www.tedunangst.com/flak/post/who-even-calls-link-ntoa)
Booting Androidx86 under bhyve (https://twitter.com/pr1ntf/status/809528845673996288)
Feedback/Questions
 Chris - VNET (http://pastebin.com/016BfvU9) 
 Brian - Package Base (http://pastebin.com/8JJeHuRT) 
 Wim - TrueOS Desktop All-n-one (http://pastebin.com/VC0DPQUF) 
 Daniel - Long Boots (http://pastebin.com/q7pFu7pR) 
 Bryan - ZFS / FreeNAS (http://pastebin.com/xgUnbzr7) 
 Bryan - FreeNAS Security (http://pastebin.com/qqCvVTLB) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we’ve got some great stories to bring you, a look at the odder side of UNIX history</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" <br>
title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://marc.info/?l=openbsd-tech&m=148058309126053&w=2" rel="nofollow">syspatch in testing state</a></h3>

<ul>
<li>Antoine Jacoutot ajacoutot@ openbsd has posted a call for testing for OpenBSD’s new syspatch tool</li>
<li>“syspatch(8), a &quot;binary&quot; patch system for -release is now ready for early testing. This does not use binary diffing to update the system, but regular signed tarballs containing the updated files (ala installer).”</li>
<li>“I would appreciate feedback on the tool. But please send it directly to <em>me</em>, there&#39;s no need to pollute the list. This is obviously WIP and the tool may or may not change in drastic ways.”</li>
<li>“These test binary patches are <em>not</em> endorsed by the OpenBSD project and should not be trusted, I am only providing them to get early feedback on the tool. If all goes as planned, I am hoping that syspatch will make it into the 6.1 release; but for it to happen, I need to know how it breaks your systems :-)”</li>
<li><a href="http://syspatch.openbsd.org/pub/OpenBSD/6.0/syspatch/amd64/README.txt" rel="nofollow">Instructions</a></li>
<li>If you test it, report back and let us know how it went
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2016-December/064198.html" rel="nofollow">Weston working</a></h3>

<ul>
<li>Over the past few years we’ve had some user-interest in the state of Wayland / Weston on FreeBSD. In the past day or so, Johannes Lundberg has sent in a progress report to the FreeBSD mailing lists.</li>
<li>Without further ADO:</li>
</ul>

<blockquote>
<p>We had some progress with Wayland that we&#39;d like to share.</p>

<p>Wayland (v1.12.0)<br>
  Working</p>

<p>Weston (v1.12.0)<br>
  Working (Porting WIP)</p>

<p>Weston-clients (installed with wayland/weston port)<br>
  Working</p>

<p>XWayland (run X11 apps in Wayland compositor)<br>
  Works (maximized window only) if started manually but not when<br>
  launching X11 app from Weston.  Most likely problem with Weston IPC.</p>

<p>Sway (i3-compatible Wayland compositor)<br>
  Working</p>

<p>SDL20 (Wayland backend)<br>
  games/stonesoup-sdl briefly tested.<br>
  <a href="https://twitter.com/johalun/status/811334203358867456" rel="nofollow">https://twitter.com/johalun/status/811334203358867456</a></p>

<p>GDM (with Wayland)<br>
  Halted - depends on logind.</p>

<p>GTK3<br>
  gtk3-demo runs fine on Weston (might have to set GDK_BACKEND=wayland<br>
first.<br>
  GTK3 apps working (gedit, gnumeric, xfce4-terminal tested, xfce desktop<br>
(4.12) does not yet support GTK3)“</p>
</blockquote>

<ul>
<li>Johannes goes on to give instructions on how / where you can fetch their WiP and do your own testing. At the moment you’ll need Matt Macy’s newer Intel video work, as well as their ports tree which includes all the necessary software bits.</li>
<li>Before anybody asks, yes we are watching this for TrueOS!
***</li>
</ul>

<h3><a href="https://functionallyparanoid.com/2016/12/15/where-the-rubber-meets-the-road-part-two/" rel="nofollow">Where the rubber meets the road (part two)</a></h3>

<ul>
<li>Continuing with our story from Brian Everly from a week ago, we have an update today on the process to dual-boot OpenBSD with Arch Linux.</li>
<li>As we last left off, Arch was up and running on the laptop, but some quirks in the hardware meant OpenBSD would take a bit longer. </li>
<li>With those issues resolved and the HD seen again, the next issue that reared its head was OpenBSD not seeing the partition tables on the disk. After much frustration, it was time to nuke and pave, starting with OpenBSD first this time.</li>
<li>After a successful GPT partitioning and install of OpenBSD, he went back to installing Arch, and then the story got more interesting. </li>
</ul>

<blockquote>
<p>“I installed Arch as I detailed in my last post; however, when I fired up gdisk I got a weird error message:</p>

<p>“Warning! Disk size is smaller than the main header indicates! Loading secondary header from the last sector of the disk! You should use ‘v’ to verify disk integrity, and perhaps options on the expert’s menu to repair the disk.”</p>

<p>Immediately after this, I saw a second warning:</p>

<p>“Caution: Invalid backup GPT header, but valid main header; regenerating backup header from main header.”</p>

<p>And, not to be outdone, there was a third:</p>

<p>“Warning! Main and backup partition tables differ! Use the ‘c’ and ‘e’ options on the recovery &amp; transformation menu to examine the two tables.”</p>

<p>Finally (not kidding), there was a fourth:</p>

<p>“Warning! One or more CRCs don’t match. You should repair the disk!”</p>

<p>Given all of that, I thought to myself, “This is probably why I couldn’t see the disk properly when I partitioned it under Linux on the OpenBSD side.  I’ll let it repair things and I should be good to go.”  I then followed the recommendation and repaired things, using the primary GPT table to recreate the backup one.  I then installed Arch and figured I was good to go.“</p>
</blockquote>

<ul>
<li>After confirming through several additional re-installs that the behavior was reproducible, he then decided to go full on crazy,and partition with MBR. That in and of itself was a challenge, since as he mentions, not many people dual-boot OpenBSD with Linux on MBR, especially using luks and lvm!</li>
<li>If you want to see the details on how that was done, check it out.</li>
<li>The story ends in success though! And better yet:</li>
</ul>

<blockquote>
<p>“Now that I have everything working, I’ll restore my config and data to Arch, configure OpenBSD the way I like it and get moving.  I’ll take some time and drop a note on the tech@ mailing list for OpenBSD to see if they can figure out what the GPT problem was I was running into.  Hopefully it will make that part of the code stronger to get an edge-case bug report like this.”</p>
</blockquote>

<ul>
<li>Take note here, if you run into issues like this with any OS, be sure to document in detail what happened so developers can explore solutions to the issue. 
***</li>
</ul>

<h3><a href="https://blog.feld.me/posts/2016/12/using-freebsd-as-a-time-capsule-for-osx/" rel="nofollow">FreeBSD and ZFS as a time capsule for OS X </a></h3>

<ul>
<li>Do you have any Apple users in your life? Perhaps you run FreeBSD for ZFS somewhere else in the house or office. Well today we have a blog post from Mark Felder which shows how you can use FreeBSD as a time-capsule for your OSX systems.</li>
<li>The setup is quite simple, to get started you’ll need packages for netatalk3 and avahi-app for service discovery.</li>
<li>Next up will be your AFP configuration. He helpfully provides a nice example that you should be able to just cut-n-paste. Be sure to check the hosts allow lines and adjust to fit your network. Also of note will be the backup location and valid users to adjust.</li>
<li>A little easier should be the avahi setup, which can be a straight copy-n-paste from the site, which will perform the service advertisements.</li>
<li>The final piece is just enabling specific services in /etc/rc.conf and either starting them by hand, or rebooting. At this point your OSX systems should be able to discover the new time-capsule provider on the network and DTRT.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://github.com/ocochard/netbenches" rel="nofollow">netbenches - FreeBSD network forwarding performance benchmark results</a></h3>

<ul>
<li>Olivier Cochard-Labbé, original creator of FreeNAS, and leader of the BSD Router Project, has a github repo of network benchmarks</li>
<li>There are many interesting results, and all of the scripts, documentation, and configuration files to run the tests yourself</li>
<li><a href="https://github.com/ocochard/netbenches/tree/master/Atom_C2558_4Cores-Intel_i350/ipsec/results/fbsd12.projects-ipsec.equilibrium" rel="nofollow">IPSec Performance on an Atom C2558, 12-head vs IPSec Performance Branch </a> </li>
<li>Compared to: <a href="https://github.com/ocochard/netbenches/tree/2f3bb1b3c51e454736f1fcc650c3328071834f8d/Xeon_L5630-4Cores-Intel_82599EB/ipsec/results/fbsd11.0" rel="nofollow">Xeon L5630 2.13GHz </a> </li>
<li>and <a href="https://github.com/ocochard/netbenches/tree/305235114ba8a3748ad9681c629333f87f82613a/Atom_C2558_4Cores-Intel_i350/ipsec.ah/results/fbsd12.projects-ipsec.equilibrium" rel="nofollow">IPSec with Authentication </a> </li>
<li>I look forward to seeing tests on even more hardware, as people with access to different configurations try out these benchmarks
***</li>
</ul>

<h3><a href="https://danielmiessler.com/study/tcpdump/" rel="nofollow">A tcpdump Tutorial and Primer with Examples</a></h3>

<ul>
<li>Most users will be familiar with the basics of using tcpdump, but this tutorial/primer is likely to fill in a lot of blanks, and advance many users understanding of tcpdump</li>
<li>“tcpdump is the premier network analysis tool for information security professionals. Having a solid grasp of this über-powerful application is mandatory for anyone desiring a thorough understanding of TCP/IP. Many prefer to use higher level analysis tools such as Wireshark, but I believe this to usually be a mistake.”</li>
<li>tcpdump is an important tool for any system or network administrator, it is not just for security. It is often the best way to figure out why the network is not behaving as expected.</li>
<li>“In a discipline so dependent on a true understanding of concepts vs. rote learning, it’s important to stay fluent in the underlying mechanics of the TCP/IP suite. A thorough grasp of these protocols allows one to troubleshoot at a level far beyond the average analyst, but mastery of the protocols is only possible through continued exposure to them.”</li>
<li>Not just that, but TCP/IP is a very interesting protocol, considering how little it has changed in its 40+ year history</li>
<li>“First off, I like to add a few options to the tcpdump command itself, depending on what I’m looking at. The first of these is -n, which requests that names are not resolved, resulting in the IPs themselves always being displayed. The second is -X, which displays both hex and ascii content within the packet.”</li>
<li>“It’s also important to note that tcpdump only takes the first 96 bytes of data from a packet by default. If you would like to look at more, add the -s number option to the mix, where number is the number of bytes you want to capture. I recommend using 0 (zero) for a snaplength, which gets everything.”</li>
<li>The page has a nice table of the most useful options</li>
<li>It also has a great primer on doing basic filtering</li>
<li>If you are relatively new to using tcpdump, I highly recommend you spend a few minutes reading through this article
***</li>
</ul>

<h3><a href="http://minnie.tuhs.org/pipermail/tuhs/2016-December/007519.html" rel="nofollow">How Unix made it to the top</a></h3>

<ul>
<li>Doug McIlroy gives us a nice background post on how “Unix made it to the top”</li>
<li>It’s fairly short / concise, so I felt it would be good to read in its entirety. </li>
</ul>

<blockquote>
<p>“It has often been told how the Bell Labs law department became the first non-research department to use Unix, displacing a newly acquired stand-alone word-processing system that fell short of the department&#39;s hopes because it couldn&#39;t number the lines on patent applications, as USPTO required. When Joe Ossanna heard of this, he told them about roff and promised to give it line-numbering capability the next day. They tried it and were hooked. Patent secretaries became remote members of the fellowship of the Unix lab. In due time the law department got its own machine.</p>

<p>Less well known is how Unix made it into the head office of AT&amp;T. It seems that the CEO, Charlie Brown, did not like to be seen wearing glasses when he read speeches. Somehow his PR assistant learned of the CAT phototypesetter in the Unix lab and asked whether it might be possible to use it to produce scripts in large type. Of course it was. As connections to the top never hurt, the CEO&#39;s office was welcomed as another ouside user. The cost--occasionally having to develop film for the final copy of a speech--was not onerous.</p>

<p>Having teethed on speeches, the head office realized that Unix could also be useful for things that didn&#39;t need phototypesetting. Other documents began to accumulate in their directory. By the time we became aware of it, the hoard came to include minutes of AT&amp;T board meetings. It didn&#39;t seem like a very good idea for us to be keeping records from the inner sanctum of the corporation on a computer where most everybody had super-user privileges. A call to the PR guy convinced him of the wisdom of keeping such things on their own premises. And so the CEO&#39;s office bought a Unix system.</p>

<p>Just as one hears of cars chosen for their cupholders, so were theseusers converted to Unix for trivial reasons: line numbers and vanity.“</p>
</blockquote>

<hr>

<h3><a href="http://orkinos.cmpe.boun.edu.tr/%7Ekosar/odd.html" rel="nofollow">Odd Comments and Strange Doings in Unix</a></h3>

<ul>
<li>Everybody loves easter-eggs, and today we have some fun odd ones from the history throughout UNIX told by Dennis Ritchie.</li>
<li>First up, was a fun one where the “mv” command could sometimes print the following “values of b may give rise to dom!”</li>
<li></li>
</ul>

<blockquote>
<p>“Like most of the messages recorded in these compilations, this one was produced in some situation that we considered unlikely or as result of abuse; the details don&#39;t matter. I&#39;m recording why the phrase was selected.</p>

<p>The very first use of Unix in the &quot;real business&quot; of Bell Labs was to type and produce patent applications, and for a while in the early 1970s we had three typists busily typing away in the grotty lab on the sixth floor. One day someone came in and observed on the paper sticking out of one of the Teletypes, displayed in magnificent isolation, this ominous phrase:    values of b may give rise to dom!</p>

<p>It was of course obvious that the typist had interrupted a printout (generating the &quot;!&quot; from the ed editor) and moved up the paper, and that the context must have been something like &quot;varying values of beta may give rise to domain wall movement&quot; or some other fragment of a physically plausible patent application.But the phrase itself was just so striking! Utterly meaningless, but it looks like what... a warning? What is &quot;dom?&quot;</p>

<p>At the same time, we were experimenting with text-to-voice software by Doug McIlroy and others, and of course the phrase was tried out with it. For whatever reason, its rendition of &quot;give rise to dom!&quot; accented the last word in a way that emphasized the phonetic similarity between &quot;doom&quot; and the first syllable of &quot;dominance.&quot; It pronounced &quot;beta&quot; in the British style, &quot;beeta.&quot; The entire occurrence became a small, shared treasure.The phrase had to be recorded somewhere, and it was, in the v6 source. Most likely it was Bob Morris who did the deed, but it could just as easily have been Ken. I hope that your browser reproduces the b as a Greek beta.“</p>
</blockquote>

<ul>
<li>Next up is one you might have heard before: </li>
</ul>

<blockquote>
<p>/* You are not expected to understand this */&gt; Every now and then on Usenet or elsewhere I run across a reference to a certain comment in the source code of the Sixth <br>
Edition Unix operating system.</p>

<p>I&#39;ve even been given two sweatshirts that quote it.</p>

<p>Most probably just heard about it, but those who saw it in the flesh either had Sixth Edition Unix (ca. 1975) or read the annotated version of this system by John Lions (which was republished in 1996: ISBN 1-57298-013-7, Peer-to-Peer Communications).It&#39;s often quoted as a slur on the quantity or quality of the comments in the Bell Labs research releases of Unix. Not an unfair observation in general, I fear, but in this case unjustified. </p>

<p>So we tried to explain what was going on. &quot;You are not expected to understand this&quot; was intended as a remark in the spirit of &quot;This won&#39;t be on the exam,&quot; rather than as an impudent challenge. </p>
</blockquote>

<ul>
<li>There’s a few other interesting stories as well, if the odd/fun side of UNIX history at all interests you, I would recommend checking it out.</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://twitter.com/ed_maste/status/811289279611682816" rel="nofollow">With patches in review the #FreeBSD base system builds 100% reproducibly</a></p></li>
<li><p><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/bsdcan-2017/" rel="nofollow">BSDCan 2017 Call for Participation</a></p></li>
<li><p><a href="https://github.com/bartekrutkowski/iocell/releases" rel="nofollow">ioCell 2.0 released </a> </p></li>
<li><p><a href="http://www.tedunangst.com/flak/post/who-even-calls-link-ntoa" rel="nofollow">who even calls link_ntoa?</a></p></li>
<li><p><a href="https://twitter.com/pr1ntf/status/809528845673996288" rel="nofollow">Booting Androidx86 under bhyve</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/016BfvU9" rel="nofollow"> Chris - VNET</a> </li>
<li><a href="http://pastebin.com/8JJeHuRT" rel="nofollow"> Brian - Package Base</a> </li>
<li><a href="http://pastebin.com/VC0DPQUF" rel="nofollow"> Wim - TrueOS Desktop All-n-one</a> </li>
<li><a href="http://pastebin.com/q7pFu7pR" rel="nofollow"> Daniel - Long Boots</a> </li>
<li><a href="http://pastebin.com/xgUnbzr7" rel="nofollow"> Bryan - ZFS / FreeNAS</a> </li>
<li><a href="http://pastebin.com/qqCvVTLB" rel="nofollow"> Bryan - FreeNAS Security</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we’ve got some great stories to bring you, a look at the odder side of UNIX history</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" <br>
title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://marc.info/?l=openbsd-tech&m=148058309126053&w=2" rel="nofollow">syspatch in testing state</a></h3>

<ul>
<li>Antoine Jacoutot ajacoutot@ openbsd has posted a call for testing for OpenBSD’s new syspatch tool</li>
<li>“syspatch(8), a &quot;binary&quot; patch system for -release is now ready for early testing. This does not use binary diffing to update the system, but regular signed tarballs containing the updated files (ala installer).”</li>
<li>“I would appreciate feedback on the tool. But please send it directly to <em>me</em>, there&#39;s no need to pollute the list. This is obviously WIP and the tool may or may not change in drastic ways.”</li>
<li>“These test binary patches are <em>not</em> endorsed by the OpenBSD project and should not be trusted, I am only providing them to get early feedback on the tool. If all goes as planned, I am hoping that syspatch will make it into the 6.1 release; but for it to happen, I need to know how it breaks your systems :-)”</li>
<li><a href="http://syspatch.openbsd.org/pub/OpenBSD/6.0/syspatch/amd64/README.txt" rel="nofollow">Instructions</a></li>
<li>If you test it, report back and let us know how it went
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2016-December/064198.html" rel="nofollow">Weston working</a></h3>

<ul>
<li>Over the past few years we’ve had some user-interest in the state of Wayland / Weston on FreeBSD. In the past day or so, Johannes Lundberg has sent in a progress report to the FreeBSD mailing lists.</li>
<li>Without further ADO:</li>
</ul>

<blockquote>
<p>We had some progress with Wayland that we&#39;d like to share.</p>

<p>Wayland (v1.12.0)<br>
  Working</p>

<p>Weston (v1.12.0)<br>
  Working (Porting WIP)</p>

<p>Weston-clients (installed with wayland/weston port)<br>
  Working</p>

<p>XWayland (run X11 apps in Wayland compositor)<br>
  Works (maximized window only) if started manually but not when<br>
  launching X11 app from Weston.  Most likely problem with Weston IPC.</p>

<p>Sway (i3-compatible Wayland compositor)<br>
  Working</p>

<p>SDL20 (Wayland backend)<br>
  games/stonesoup-sdl briefly tested.<br>
  <a href="https://twitter.com/johalun/status/811334203358867456" rel="nofollow">https://twitter.com/johalun/status/811334203358867456</a></p>

<p>GDM (with Wayland)<br>
  Halted - depends on logind.</p>

<p>GTK3<br>
  gtk3-demo runs fine on Weston (might have to set GDK_BACKEND=wayland<br>
first.<br>
  GTK3 apps working (gedit, gnumeric, xfce4-terminal tested, xfce desktop<br>
(4.12) does not yet support GTK3)“</p>
</blockquote>

<ul>
<li>Johannes goes on to give instructions on how / where you can fetch their WiP and do your own testing. At the moment you’ll need Matt Macy’s newer Intel video work, as well as their ports tree which includes all the necessary software bits.</li>
<li>Before anybody asks, yes we are watching this for TrueOS!
***</li>
</ul>

<h3><a href="https://functionallyparanoid.com/2016/12/15/where-the-rubber-meets-the-road-part-two/" rel="nofollow">Where the rubber meets the road (part two)</a></h3>

<ul>
<li>Continuing with our story from Brian Everly from a week ago, we have an update today on the process to dual-boot OpenBSD with Arch Linux.</li>
<li>As we last left off, Arch was up and running on the laptop, but some quirks in the hardware meant OpenBSD would take a bit longer. </li>
<li>With those issues resolved and the HD seen again, the next issue that reared its head was OpenBSD not seeing the partition tables on the disk. After much frustration, it was time to nuke and pave, starting with OpenBSD first this time.</li>
<li>After a successful GPT partitioning and install of OpenBSD, he went back to installing Arch, and then the story got more interesting. </li>
</ul>

<blockquote>
<p>“I installed Arch as I detailed in my last post; however, when I fired up gdisk I got a weird error message:</p>

<p>“Warning! Disk size is smaller than the main header indicates! Loading secondary header from the last sector of the disk! You should use ‘v’ to verify disk integrity, and perhaps options on the expert’s menu to repair the disk.”</p>

<p>Immediately after this, I saw a second warning:</p>

<p>“Caution: Invalid backup GPT header, but valid main header; regenerating backup header from main header.”</p>

<p>And, not to be outdone, there was a third:</p>

<p>“Warning! Main and backup partition tables differ! Use the ‘c’ and ‘e’ options on the recovery &amp; transformation menu to examine the two tables.”</p>

<p>Finally (not kidding), there was a fourth:</p>

<p>“Warning! One or more CRCs don’t match. You should repair the disk!”</p>

<p>Given all of that, I thought to myself, “This is probably why I couldn’t see the disk properly when I partitioned it under Linux on the OpenBSD side.  I’ll let it repair things and I should be good to go.”  I then followed the recommendation and repaired things, using the primary GPT table to recreate the backup one.  I then installed Arch and figured I was good to go.“</p>
</blockquote>

<ul>
<li>After confirming through several additional re-installs that the behavior was reproducible, he then decided to go full on crazy,and partition with MBR. That in and of itself was a challenge, since as he mentions, not many people dual-boot OpenBSD with Linux on MBR, especially using luks and lvm!</li>
<li>If you want to see the details on how that was done, check it out.</li>
<li>The story ends in success though! And better yet:</li>
</ul>

<blockquote>
<p>“Now that I have everything working, I’ll restore my config and data to Arch, configure OpenBSD the way I like it and get moving.  I’ll take some time and drop a note on the tech@ mailing list for OpenBSD to see if they can figure out what the GPT problem was I was running into.  Hopefully it will make that part of the code stronger to get an edge-case bug report like this.”</p>
</blockquote>

<ul>
<li>Take note here, if you run into issues like this with any OS, be sure to document in detail what happened so developers can explore solutions to the issue. 
***</li>
</ul>

<h3><a href="https://blog.feld.me/posts/2016/12/using-freebsd-as-a-time-capsule-for-osx/" rel="nofollow">FreeBSD and ZFS as a time capsule for OS X </a></h3>

<ul>
<li>Do you have any Apple users in your life? Perhaps you run FreeBSD for ZFS somewhere else in the house or office. Well today we have a blog post from Mark Felder which shows how you can use FreeBSD as a time-capsule for your OSX systems.</li>
<li>The setup is quite simple, to get started you’ll need packages for netatalk3 and avahi-app for service discovery.</li>
<li>Next up will be your AFP configuration. He helpfully provides a nice example that you should be able to just cut-n-paste. Be sure to check the hosts allow lines and adjust to fit your network. Also of note will be the backup location and valid users to adjust.</li>
<li>A little easier should be the avahi setup, which can be a straight copy-n-paste from the site, which will perform the service advertisements.</li>
<li>The final piece is just enabling specific services in /etc/rc.conf and either starting them by hand, or rebooting. At this point your OSX systems should be able to discover the new time-capsule provider on the network and DTRT.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://github.com/ocochard/netbenches" rel="nofollow">netbenches - FreeBSD network forwarding performance benchmark results</a></h3>

<ul>
<li>Olivier Cochard-Labbé, original creator of FreeNAS, and leader of the BSD Router Project, has a github repo of network benchmarks</li>
<li>There are many interesting results, and all of the scripts, documentation, and configuration files to run the tests yourself</li>
<li><a href="https://github.com/ocochard/netbenches/tree/master/Atom_C2558_4Cores-Intel_i350/ipsec/results/fbsd12.projects-ipsec.equilibrium" rel="nofollow">IPSec Performance on an Atom C2558, 12-head vs IPSec Performance Branch </a> </li>
<li>Compared to: <a href="https://github.com/ocochard/netbenches/tree/2f3bb1b3c51e454736f1fcc650c3328071834f8d/Xeon_L5630-4Cores-Intel_82599EB/ipsec/results/fbsd11.0" rel="nofollow">Xeon L5630 2.13GHz </a> </li>
<li>and <a href="https://github.com/ocochard/netbenches/tree/305235114ba8a3748ad9681c629333f87f82613a/Atom_C2558_4Cores-Intel_i350/ipsec.ah/results/fbsd12.projects-ipsec.equilibrium" rel="nofollow">IPSec with Authentication </a> </li>
<li>I look forward to seeing tests on even more hardware, as people with access to different configurations try out these benchmarks
***</li>
</ul>

<h3><a href="https://danielmiessler.com/study/tcpdump/" rel="nofollow">A tcpdump Tutorial and Primer with Examples</a></h3>

<ul>
<li>Most users will be familiar with the basics of using tcpdump, but this tutorial/primer is likely to fill in a lot of blanks, and advance many users understanding of tcpdump</li>
<li>“tcpdump is the premier network analysis tool for information security professionals. Having a solid grasp of this über-powerful application is mandatory for anyone desiring a thorough understanding of TCP/IP. Many prefer to use higher level analysis tools such as Wireshark, but I believe this to usually be a mistake.”</li>
<li>tcpdump is an important tool for any system or network administrator, it is not just for security. It is often the best way to figure out why the network is not behaving as expected.</li>
<li>“In a discipline so dependent on a true understanding of concepts vs. rote learning, it’s important to stay fluent in the underlying mechanics of the TCP/IP suite. A thorough grasp of these protocols allows one to troubleshoot at a level far beyond the average analyst, but mastery of the protocols is only possible through continued exposure to them.”</li>
<li>Not just that, but TCP/IP is a very interesting protocol, considering how little it has changed in its 40+ year history</li>
<li>“First off, I like to add a few options to the tcpdump command itself, depending on what I’m looking at. The first of these is -n, which requests that names are not resolved, resulting in the IPs themselves always being displayed. The second is -X, which displays both hex and ascii content within the packet.”</li>
<li>“It’s also important to note that tcpdump only takes the first 96 bytes of data from a packet by default. If you would like to look at more, add the -s number option to the mix, where number is the number of bytes you want to capture. I recommend using 0 (zero) for a snaplength, which gets everything.”</li>
<li>The page has a nice table of the most useful options</li>
<li>It also has a great primer on doing basic filtering</li>
<li>If you are relatively new to using tcpdump, I highly recommend you spend a few minutes reading through this article
***</li>
</ul>

<h3><a href="http://minnie.tuhs.org/pipermail/tuhs/2016-December/007519.html" rel="nofollow">How Unix made it to the top</a></h3>

<ul>
<li>Doug McIlroy gives us a nice background post on how “Unix made it to the top”</li>
<li>It’s fairly short / concise, so I felt it would be good to read in its entirety. </li>
</ul>

<blockquote>
<p>“It has often been told how the Bell Labs law department became the first non-research department to use Unix, displacing a newly acquired stand-alone word-processing system that fell short of the department&#39;s hopes because it couldn&#39;t number the lines on patent applications, as USPTO required. When Joe Ossanna heard of this, he told them about roff and promised to give it line-numbering capability the next day. They tried it and were hooked. Patent secretaries became remote members of the fellowship of the Unix lab. In due time the law department got its own machine.</p>

<p>Less well known is how Unix made it into the head office of AT&amp;T. It seems that the CEO, Charlie Brown, did not like to be seen wearing glasses when he read speeches. Somehow his PR assistant learned of the CAT phototypesetter in the Unix lab and asked whether it might be possible to use it to produce scripts in large type. Of course it was. As connections to the top never hurt, the CEO&#39;s office was welcomed as another ouside user. The cost--occasionally having to develop film for the final copy of a speech--was not onerous.</p>

<p>Having teethed on speeches, the head office realized that Unix could also be useful for things that didn&#39;t need phototypesetting. Other documents began to accumulate in their directory. By the time we became aware of it, the hoard came to include minutes of AT&amp;T board meetings. It didn&#39;t seem like a very good idea for us to be keeping records from the inner sanctum of the corporation on a computer where most everybody had super-user privileges. A call to the PR guy convinced him of the wisdom of keeping such things on their own premises. And so the CEO&#39;s office bought a Unix system.</p>

<p>Just as one hears of cars chosen for their cupholders, so were theseusers converted to Unix for trivial reasons: line numbers and vanity.“</p>
</blockquote>

<hr>

<h3><a href="http://orkinos.cmpe.boun.edu.tr/%7Ekosar/odd.html" rel="nofollow">Odd Comments and Strange Doings in Unix</a></h3>

<ul>
<li>Everybody loves easter-eggs, and today we have some fun odd ones from the history throughout UNIX told by Dennis Ritchie.</li>
<li>First up, was a fun one where the “mv” command could sometimes print the following “values of b may give rise to dom!”</li>
<li></li>
</ul>

<blockquote>
<p>“Like most of the messages recorded in these compilations, this one was produced in some situation that we considered unlikely or as result of abuse; the details don&#39;t matter. I&#39;m recording why the phrase was selected.</p>

<p>The very first use of Unix in the &quot;real business&quot; of Bell Labs was to type and produce patent applications, and for a while in the early 1970s we had three typists busily typing away in the grotty lab on the sixth floor. One day someone came in and observed on the paper sticking out of one of the Teletypes, displayed in magnificent isolation, this ominous phrase:    values of b may give rise to dom!</p>

<p>It was of course obvious that the typist had interrupted a printout (generating the &quot;!&quot; from the ed editor) and moved up the paper, and that the context must have been something like &quot;varying values of beta may give rise to domain wall movement&quot; or some other fragment of a physically plausible patent application.But the phrase itself was just so striking! Utterly meaningless, but it looks like what... a warning? What is &quot;dom?&quot;</p>

<p>At the same time, we were experimenting with text-to-voice software by Doug McIlroy and others, and of course the phrase was tried out with it. For whatever reason, its rendition of &quot;give rise to dom!&quot; accented the last word in a way that emphasized the phonetic similarity between &quot;doom&quot; and the first syllable of &quot;dominance.&quot; It pronounced &quot;beta&quot; in the British style, &quot;beeta.&quot; The entire occurrence became a small, shared treasure.The phrase had to be recorded somewhere, and it was, in the v6 source. Most likely it was Bob Morris who did the deed, but it could just as easily have been Ken. I hope that your browser reproduces the b as a Greek beta.“</p>
</blockquote>

<ul>
<li>Next up is one you might have heard before: </li>
</ul>

<blockquote>
<p>/* You are not expected to understand this */&gt; Every now and then on Usenet or elsewhere I run across a reference to a certain comment in the source code of the Sixth <br>
Edition Unix operating system.</p>

<p>I&#39;ve even been given two sweatshirts that quote it.</p>

<p>Most probably just heard about it, but those who saw it in the flesh either had Sixth Edition Unix (ca. 1975) or read the annotated version of this system by John Lions (which was republished in 1996: ISBN 1-57298-013-7, Peer-to-Peer Communications).It&#39;s often quoted as a slur on the quantity or quality of the comments in the Bell Labs research releases of Unix. Not an unfair observation in general, I fear, but in this case unjustified. </p>

<p>So we tried to explain what was going on. &quot;You are not expected to understand this&quot; was intended as a remark in the spirit of &quot;This won&#39;t be on the exam,&quot; rather than as an impudent challenge. </p>
</blockquote>

<ul>
<li>There’s a few other interesting stories as well, if the odd/fun side of UNIX history at all interests you, I would recommend checking it out.</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://twitter.com/ed_maste/status/811289279611682816" rel="nofollow">With patches in review the #FreeBSD base system builds 100% reproducibly</a></p></li>
<li><p><a href="https://www.freebsdfoundation.org/news-and-events/call-for-papers/bsdcan-2017/" rel="nofollow">BSDCan 2017 Call for Participation</a></p></li>
<li><p><a href="https://github.com/bartekrutkowski/iocell/releases" rel="nofollow">ioCell 2.0 released </a> </p></li>
<li><p><a href="http://www.tedunangst.com/flak/post/who-even-calls-link-ntoa" rel="nofollow">who even calls link_ntoa?</a></p></li>
<li><p><a href="https://twitter.com/pr1ntf/status/809528845673996288" rel="nofollow">Booting Androidx86 under bhyve</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/016BfvU9" rel="nofollow"> Chris - VNET</a> </li>
<li><a href="http://pastebin.com/8JJeHuRT" rel="nofollow"> Brian - Package Base</a> </li>
<li><a href="http://pastebin.com/VC0DPQUF" rel="nofollow"> Wim - TrueOS Desktop All-n-one</a> </li>
<li><a href="http://pastebin.com/q7pFu7pR" rel="nofollow"> Daniel - Long Boots</a> </li>
<li><a href="http://pastebin.com/xgUnbzr7" rel="nofollow"> Bryan - ZFS / FreeNAS</a> </li>
<li><a href="http://pastebin.com/qqCvVTLB" rel="nofollow"> Bryan - FreeNAS Security</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>172: A tale of BSD from yore</title>
  <link>https://www.bsdnow.tv/172</link>
  <guid isPermaLink="false">7b623fbf-836c-4ffe-964a-39163d4439b2</guid>
  <pubDate>Wed, 14 Dec 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7b623fbf-836c-4ffe-964a-39163d4439b2.mp3" length="64918516" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we have a very special guest joining us to tell us a tale of the early days in BSD history. That plus some new OpenSSH goodness, shell scripting utilities and much more. Stay tuned for your place to B...SD!</itunes:subtitle>
  <itunes:duration>1:30:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we have a very special guest joining us to tell us a tale of the early days in BSD history. That plus some new OpenSSH goodness, shell scripting utilities and much more. Stay tuned for your place to B...SD!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Call For Testing: OpenSSH 7.4  (http://marc.info/?l=openssh-unix-dev&amp;amp;m=148167688911316&amp;amp;w=2)
Getting ready to head into the holidays for for the end of 2016 means some of us will have spare time on our hands. What a perfect time to get some call for testing work done!
Damien Miller has issued a public CFT for the upcoming OpenSSH 7.4 release, which considering how much we all rely on SSH I would expect will get some eager volunteers for testing.
What are some of the potential breakers?
“* This release removes server support for the SSH v.1 protocol.
ssh(1): Remove 3des-cbc from the client's default proposal. 64-bit
block ciphers are not safe in 2016 and we don't want to wait until
attacks like SWEET32 are extended to SSH. As 3des-cbc was the
only mandatory cipher in the SSH RFCs, this may cause problems
connecting to older devices using the default configuration,
but it's highly likely that such devices already need explicit
configuration for key exchange and hostkey algorithms already
anyway.
sshd(8): Remove support for pre-authentication compression.
Doing compression early in the protocol probably seemed reasonable
in the 1990s, but today it's clearly a bad idea in terms of both
cryptography (cf. multiple compression oracle attacks in TLS) and
attack surface. Pre-auth compression support has been disabled by
default for &amp;gt;10 years. Support remains in the client.
ssh-agent will refuse to load PKCS#11 modules outside a whitelist
of trusted paths by default. The path whitelist may be specified
at run-time.
sshd(8): When a forced-command appears in both a certificate and
an authorized keys/principals command= restriction, sshd will now
refuse to accept the certificate unless they are identical.
The previous (documented) behaviour of having the certificate
forced-command override the other could be a bit confusing and
error-prone.
sshd(8): Remove the UseLogin configuration directive and support
for having /bin/login manage login sessions.“
What about new features? 7.4 has some of those to wake you up also:
“* ssh(1): Add a proxy multiplexing mode to ssh(1) inspired by the
   version in PuTTY by Simon Tatham. This allows a multiplexing
   client to communicate with the master process using a subset of
   the SSH packet and channels protocol over a Unix-domain socket,
   with the main process acting as a proxy that translates channel
   IDs, etc.  This allows multiplexing mode to run on systems that
   lack file- descriptor passing (used by current multiplexing
   code) and potentially, in conjunction with Unix-domain socket
   forwarding, with the client and multiplexing master process on
   different machines. Multiplexing proxy mode may be invoked using
   "ssh -O proxy ..."
sshd(8): Add a sshdconfig DisableForwaring option that disables
X11, agent, TCP, tunnel and Unix domain socket forwarding, as well
as anything else we might implement in the future. Like the
'restrict' authorizedkeys flag, this is intended to be a simple
and future-proof way of restricting an account.
sshd(8), ssh(1): Support the "curve25519-sha256" key exchange
method. This is identical to the currently-support method named
"curve25519-sha256@libssh.org".
sshd(8): Improve handling of SIGHUP by checking to see if sshd is
already daemonised at startup and skipping the call to daemon(3)
if it is. This ensures that a SIGHUP restart of sshd(8) will
retain the same process-ID as the initial execution. sshd(8) will
also now unlink the PidFile prior to SIGHUP restart and re-create
it after a successful restart, rather than leaving a stale file in
the case of a configuration error. bz#2641
sshd(8): Allow ClientAliveInterval and ClientAliveCountMax
directives to appear in sshd_config Match blocks.
sshd(8): Add %-escapes to AuthorizedPrincipalsCommand to match
those supported by AuthorizedKeysCommand (key, key type,
fingerprint, etc.) and a few more to provide access to the
contents of the certificate being offered.
Added regression tests for string matching, address matching and
string sanitisation functions.
Improved the key exchange fuzzer harness.“
Get those tests done and be sure to send feedback, both positive and negative.
***
How My Printer Caused Excessive Syscalls &amp;amp; UDP Traffic (https://zinascii.com/2014/how-my-printer-caused-excessive-syscalls.html)
“3,000 syscalls a second, on an idle machine? That doesn’t seem right. I just booted this machine. The only processes running are those required to boot the SmartOS Global Zone, which is minimal.”
This is a story from 2014, about debugging a machine that was being slowed down by excessive syscalls and UDP traffic. It is also an excellent walkthrough of the basics of DTrace
“Well, at least I have DTrace. I can use this one-liner to figure out what syscalls are being made across the entire system.”
dtrace -n 'syscall:::entry { @[probefunc,probename] = count(); }'
“Wow! That is a lot of lwpsigmask calls. Now that I know what is being called, it’s time to find out who is doing the calling? I’ll use another one-liner to show me the most common user stacks invoking lwpsigmask.”
dtrace -n 'syscall::lwp_sigmask:entry { @[ustack()] = count(); }'
“Okay, so this mdnsd code is causing all the trouble. What is the distribution of syscalls for the mdnsd program?”
dtrace -n 'syscall:::entry /execname == "mdnsd"/ { @[probefunc] = count(); } tick-1s { exit(0); }'
“Lots of signal masking and polling. What the hell! Why is it doing this? What is mdnsd anyways? Is there a man page? Googling for mdns reveals that it is used for resolving host names in small networks, like my home network. It uses UDP, and requires zero configuration. Nothing obvious to explain why it’s flipping out. I feel helpless. I turn to the only thing I can trust, the code.”
“Woah boy, this is some messy looking code. This would not pass illumos cstyle checks. Turns out this is code from Darwin—the kernel of OSX.”
“Hmmm…an idea pops into my computer animal brain. I wonder…I wonder if my MacBook is also experiencing abnormal syscall rates? Nooo, that can’t be it. Why would both my SmartOS server and MacBook both have the same problem? There is no good technical reason to link these two. But, then again, I’m dealing with computers here, and I’ve seen a lot of strange things over the years—I switch to my laptop.”
sudo dtrace -n 'syscall::: { @[execname] = count(); } tick-1s { exit(0); }'
Same thing, except mdns is called discoverd on OS X
“I ask my friend Steve Vinoski to run the same DTrace one-liner on his OSX machines. He has both Yosemite and the older Mountain Lion. But, to my dismay, neither of his machines are exhibiting high syscall rates. My search continues.”
“Not sure what to do next, I open the OSX Activity Monitor. In desperation I click on the Network tab.”
“ HOLE—E—SHIT! Two-Hundred-and-Seventy Million packets received by discoveryd. Obviously, I need to stop looking at code and start looking at my network. I hop back onto my SmartOS machine and check network interface statistics.”
“Whatever is causing all this, it is sending about 200 packets a second. At this point, the only thing left to do is actually inspect some of these incoming packets. I run snoop(1M) to collect events on the e1000g0 interface, stopping at about 600 events. Then I view the first 15.”
“ A constant stream of mDNS packets arriving from IP 10.0.1.8. I know that this IP is not any of my computers. The only devices left are my iPhone, AppleTV, and Canon printer. Wait a minute! The printer! Two days earlier I heard some beeping noises…”
“I own a Canon PIXMA MG6120 printer. It has a touch interface with a small LCD at the top, used to set various options. Since it sits next to my desk I sometimes lay things on top of it like a book or maybe a plate after I’m done eating. If I lay things in the wrong place it will activate the touch interface and cause repeated pressing. Each press makes a beeping noise. If the object lays there long enough the printer locks up and I have to reboot it. Just such events occurred two days earlier.”
“I fire up dladm again to monitor incoming packets in realtime. Then I turn to the printer. I move all the crap off of it: two books, an empty plate, and the title for my Suzuki SV650 that I’ve been meaning to sell for the last year. I try to use the touch screen on top of the printer. It’s locked up, as expected. I cut power to the printer and whip my head back to my terminal.”
No more packet storm
“Giddy, I run DTrace again to count syscalls.”
“I’m not sure whether to laugh or cry. I laugh, because, LOL computers. There’s some new dumb shit you deal with everyday, better to roll with the punches and laugh. You live longer that way. At least I got to flex my DTrace muscles a bit. In fact, I felt a bit like Brendan Gregg when he was debugging why OSX was dropping keystrokes.”
“I didn’t bother to root cause why my printer turned into a UDP machine gun. I don’t intend to either. I have better things to do, and if rebooting solves the problem then I’m happy. Besides, I had to get back to what I was trying to do six hours before I started debugging this damn thing.”
There you go. The Internet of Terror has already been on your LAN for years.
Making Getaddrinfo Concurrent in Python on Mac OS and BSD (https://emptysqua.re/blog/getaddrinfo-cpython-mac-and-bsd/)
We have a very fun blog post today to pass along originally authored by “A. Jesse Jiryu Davis”. Specifically the tale of one man’s quest to unify the Getaddrinfo in Python with Mac OS and BSD.
To give you a small taste of this tale, let us pass along just the introduction
“Tell us about the time you made DNS resolution concurrent in Python on Mac and BSD.   No, no, you do not want to hear that story, my friends. It is nothing but old lore and #ifdefs.
But you made Python more scalable. The saga of Steve Jobs was sung to you by a mysterious wizard with a fanciful nickname! Tell us!
Gather round, then. I will tell you how I unearthed a lost secret, unbound Python from old shackles, and banished an ancient and horrible Mutex Troll. Let us begin at the beginning.“
Is your interest piqued? It should be. I’m not sure we could do this blog post justice trying to read it aloud here, but definetly recommend if you want to see how he managed to get this bit of code working cross platform. (And it’s highly entertaining as well)
“A long time ago, in the 1980s, a coven of Berkeley sorcerers crafted an operating system. They named it after themselves: the Berkeley Software Distribution, or BSD. For generations they nurtured it, growing it and adding features. One night, they conjured a powerful function that could resolve hostnames to IPv4 or IPv6 addresses. It was called getaddrinfo. The function was mighty, but in years to come it would grow dangerous, for the sorcerers had not made getaddrinfo thread-safe.”
“As ages passed, BSD spawned many offspring. There were FreeBSD, OpenBSD, NetBSD, and in time, Mac OS X. Each made its copy of getaddrinfo thread safe, at different times and different ways. Some operating systems retained scribes who recorded these events in the annals. Some did not.”
The story continues as our hero battles the Mutex Troll and quests for ancient knowledge
“Apple engineers are not like you and me — they are a shy and secretive folk. They publish only what code they must from Darwin. Their comings and goings are recorded in no bug tracker, their works in no changelog. To learn their secrets, one must delve deep.”
“There is a tiny coven of NYC BSD users who meet at the tavern called Stone Creek, near my dwelling. They are aged and fierce, but I made the Sign of the Trident and supplicated them humbly for advice, and they were kindly to me.”
Spoiler: “Without a word, the mercenary troll shouldered its axe and trudged off in search of other patrons on other platforms. Never again would it hold hostage the worthy smiths forging Python code on BSD.”
***
Using release(7) to create FreeBSD images for OpenStack  (https://diegocasati.com/2016/12/13/using-release7-to-create-freebsd-images-for-openstack-yes-you-can-do-it/)
Following a recent episode where we covered a walk through on how to create FreeBSD guest OpenStack images, we wondered if it would be possible to integrate this process into the FreeBSD release(7) process, so they images could be generated consistently and automatically
Being the awesome audience that you are, one of you responded by doing exactly that
“During a recent BSDNow podcast, Allan and Kris mentioned that it would be nice to have a tutorial on how to create a FreeBSD image for OpenStack using the official release(7) tools. With that, it came to me that: #1 I do have access to an OpenStack environment and #2 I am interested in having FreeBSD as a guest image in my environment. Looks like I was up for the challenge.”
“Previously, I’ve had success running FreeBSD 11.0-RELEASE on OpenStack but more could/should be done. For instance, as suggested by Allan,  wouldn’t be nice to deploy the latest code from FreeBSD ? Running -STABLE or even -CURRENT ? Yes, it would. Also, wouldn’t it be nice to customize these images for a specific need? I’d say ‘Yes’ for that as well.”
“After some research I found that the current openstack.conf file, located at /usr/src/release/tools/ could use some extra tweaks to get where I wanted. I’ve created and attached that to a bugzilla on the same topic. You can read about that here (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213396).”
Steps:
Fetch the FreeBSD source code and extract it under /usr/src
Once the code is in place, follow the regular process of build(7) and perform a make buildworld buildkernel
Change into the release directory (/usr/src/release) and perform a make cloudware
make cloudware-release WITH_CLOUDWARE=yes CLOUDWARE=OPENSTACK VMIMAGE=2G
“That’s it! This will generate a qcow2 image with 1.4G in size and a raw image of 2G. The entire process uses the release(7) toolchain to generate the image and should work with newer versions of FreeBSD.”
+ The patch has already been committed to FreeBSD  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=310047) 
Interview - Rod Grimes - rgrimes@freebsd.org (mailto:rgrimes@freebsd.org)
Want to help fund the development of GPU Passthru? Visit bhyve.org (http://bhyve.org/)
***
News Roundup
Configuring the FreeBSD automounter (http://blog.khubla.com/freebsd/configuring-the-freebsd-automounter)
Ever had to configure the FreeBSD auto-mounting daemon? Today we have a blog post that walks us through a few of the configuration knobs you have at your disposal.
First up, Tom shows us his /etc/fstab file, and the various UFS partitions he has setup with the ‘noauto’ flag so they are not mounted at system boot.
His amd.conf file is pretty basic, with just options enabled to restart mounts, and unmount on exit.
Where most users will most likely want to pay attention is in the crafting of an amd.map file
Within this file, we have the various command-foo which performs mounts and unmounts of targeted disks / file-systems on demand.
Pay special attention to all the special chars, since those all matter and a stray or missing ; could be a source of failure.
Lastly a few knobs in rc.conf will enable the various services and a reboot should confirm the functionality.
***
l2k16 hackathon report: LibreSSL manuals now in mdoc(7) (http://undeadly.org/cgi?action=article&amp;amp;sid=20161114174451)
Hackathon report by Ingo Schwarze
“Back in the spring two years ago, Kristaps Dzonsons started the pod2mdoc(1) conversion utility, and less than a month later, the LibreSSL project began. During the general summer hackathon in the same year, g2k14, Anthony Bentley started using pod2mdoc(1) for converting LibreSSL manuals to mdoc(7).”
“Back then, doing so still was a pain, because pod2mdoc(1) was still full of bugs and had gaping holes in functionality. For example, Anthony was forced to basically translate the SYNOPSIS sections by hand, and to fix up .Fn and .Xr in the body by hand as well. All the same, he speedily finished all of libssl, and in the autumn of the same year, he mustered the courage to commit his work.”
“Near the end of the following winter, i improved the pod2mdoc(1) tool to actually become convenient in practice and started work on libcrypto, converting about 50 out of the about 190 manuals. Max Fillinger also helped a bit, converting a handful of pages, but i fear i tarried too much checking and committing his work, so he quickly gave up on the task. After that, almost nothing happened for a full year.”
“Now i was finally fed up with the messy situation and decided to put an end to it. So i went to Toulouse and finished the conversion of the remaining 130 manual pages in libcrypto, such that you can now view the documentation of all functions”
Interactive Terminal Utility: smenu (https://github.com/p-gen/smenu)
Ok, I’ve made no secret of my love for shell scripting. Well today we have a new (somewhat new to us) tool to bring your way.
Have you ever needed to deal with large lists of data, perhaps as the result of a long specially crafted pipe?
What if you need to select a specific value from a range and then continue processing?
Enter ‘smenu’ which can help make your scripting life easier.
“smenu is a selection filter just like sed is an editing filter.
This simple tool reads words from the standard input, presents them in a cool interactive window after the current line on the terminal and writes the selected word, if any, on the standard output.
After having unsuccessfully searched the NET for what I wanted, I decided to try to write my own.
I have tried hard to made its usage as simple as possible. It should work, even when using an old vt100 terminal and is UTF-8 aware.“
What this means, is in your interactive scripts, you can much easier present the user with a cursor driven menu to select from a range of possible choices. (Without needing to craft a bunch of dialog flags)
Take a look, and hopefully you’ll be able to find creative uses for your shell scripts in the future.
***
Ubuntu still isn't free software (http://mjg59.dreamwidth.org/45939.html)
“Any redistribution of modified versions of Ubuntu must be approved, certified or provided by Canonical if you are going to associate it with the Trademarks. Otherwise you must remove and replace the Trademarks and will need to recompile the source code to create your own binaries. This does not affect your rights under any open source licence applicable to any of the components of Ubuntu. If you need us to approve, certify or provide modified versions for redistribution you will require a licence agreement from Canonical, for which you may be required to pay. For further information, please contact us”
“Mark Shuttleworth just blogged (http://insights.ubuntu.com/2016/12/01/taking-a-stand-against-unstable-risky-unofficial-ubuntu-images/) about their stance against unofficial Ubuntu images. The assertion is that a cloud hoster is providing unofficial and modified Ubuntu images, and that these images are meaningfully different from upstream Ubuntu in terms of their functionality and security. Users are attempting to make use of these images, are finding that they don't work properly and are assuming that Ubuntu is a shoddy product. This is an entirely legitimate concern, and if Canonical are acting to reduce user confusion then they should be commended for that.”
“The appropriate means to handle this kind of issue is trademark law. If someone claims that something is Ubuntu when it isn't, that's probably an infringement of the trademark and it's entirely reasonable for the trademark owner to take action to protect the value associated with their trademark. But Canonical's IP policy goes much further than that - it can be interpreted as meaning[1] that you can't distribute works based on Ubuntu without paying Canonical for the privilege, even if you call it something other than Ubuntu. [1]: And by "interpreted as meaning" I mean that's what it says and Canonical refuse to say otherwise”
“If you ask a copyright holder if you can give a copy of their work to someone else (assuming it doesn't infringe trademark law), and they say no or insist you need an additional contract, it's not free software. If they insist that you recompile source code before you can give copies to someone else, it's not free software. Asking that you remove trademarks that would otherwise infringe trademark law is fine, but if you can't use their trademarks in non-infringing ways, that's still not free software.”
“Canonical's IP policy continues to impose restrictions on all of these things, and therefore Ubuntu is not free software.”
Beastie Bits
OPNsense 16.7.10 released (https://opnsense.org/opnsense-16-7-10-released/)
OpenBSD Foundation Welcomes First Iridium Donor: Smartisan (http://undeadly.org/cgi?action=article&amp;amp;sid=20161123193708&amp;amp;mode=expanded&amp;amp;count=8)
Jan Koum donates $500,000 to FreeBSD (https://www.freebsdfoundation.org/blog/foundation-announces-new-uranium-donor/) 
The Soviet Russia, BSD makes you (https://en.wikipedia.org/wiki/DEMOS)
Feedback/Questions
 Jason - Value (http://pastebin.com/gRN4Lzy8) 
 Hamza - Shell Scripting (http://pastebin.com/GZYjRmSR) 
Blog link (http://aikchar.me/blog/unix-shell-programming-lessons-learned.html)
 Dave - Migrating to FreeBSD (http://pastebin.com/hEBu3Drp) 
 Dan - Which BSD? (http://pastebin.com/1HpKqCSt) 
 Zach - AMD Video (http://pastebin.com/4Aj5ebns) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we have a very special guest joining us to tell us a tale of the early days in BSD history. That plus some new OpenSSH goodness, shell scripting utilities and much more. Stay tuned for your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://marc.info/?l=openssh-unix-dev&m=148167688911316&w=2" rel="nofollow">Call For Testing: OpenSSH 7.4 </a></h3>

<ul>
<li>Getting ready to head into the holidays for for the end of 2016 means some of us will have spare time on our hands. What a perfect time to get some call for testing work done!</li>
<li>Damien Miller has issued a public CFT for the upcoming OpenSSH 7.4 release, which considering how much we all rely on SSH I would expect will get some eager volunteers for testing.</li>
<li>What are some of the potential breakers?</li>
</ul>

<blockquote>
<p>“* This release removes server support for the SSH v.1 protocol.</p>

<ul>
<li><p>ssh(1): Remove 3des-cbc from the client&#39;s default proposal. 64-bit<br>
block ciphers are not safe in 2016 and we don&#39;t want to wait until<br>
attacks like SWEET32 are extended to SSH. As 3des-cbc was the<br>
only mandatory cipher in the SSH RFCs, this may cause problems<br>
connecting to older devices using the default configuration,<br>
but it&#39;s highly likely that such devices already need explicit<br>
configuration for key exchange and hostkey algorithms already<br>
anyway.</p></li>
<li><p>sshd(8): Remove support for pre-authentication compression.<br>
Doing compression early in the protocol probably seemed reasonable<br>
in the 1990s, but today it&#39;s clearly a bad idea in terms of both<br>
cryptography (cf. multiple compression oracle attacks in TLS) and<br>
attack surface. Pre-auth compression support has been disabled by<br>
default for &gt;10 years. Support remains in the client.</p></li>
<li><p>ssh-agent will refuse to load PKCS#11 modules outside a whitelist<br>
of trusted paths by default. The path whitelist may be specified<br>
at run-time.</p></li>
<li><p>sshd(8): When a forced-command appears in both a certificate and<br>
an authorized keys/principals command= restriction, sshd will now<br>
refuse to accept the certificate unless they are identical.<br>
The previous (documented) behaviour of having the certificate<br>
forced-command override the other could be a bit confusing and<br>
error-prone.</p></li>
<li><p>sshd(8): Remove the UseLogin configuration directive and support<br>
for having /bin/login manage login sessions.“</p></li>
</ul>
</blockquote>

<ul>
<li>What about new features? 7.4 has some of those to wake you up also:</li>
</ul>

<blockquote>
<p>“* ssh(1): Add a proxy multiplexing mode to ssh(1) inspired by the<br>
   version in PuTTY by Simon Tatham. This allows a multiplexing<br>
   client to communicate with the master process using a subset of<br>
   the SSH packet and channels protocol over a Unix-domain socket,<br>
   with the main process acting as a proxy that translates channel<br>
   IDs, etc.  This allows multiplexing mode to run on systems that<br>
   lack file- descriptor passing (used by current multiplexing<br>
   code) and potentially, in conjunction with Unix-domain socket<br>
   forwarding, with the client and multiplexing master process on<br>
   different machines. Multiplexing proxy mode may be invoked using<br>
   &quot;ssh -O proxy ...&quot;</p>

<ul>
<li><p>sshd(8): Add a sshd_config DisableForwaring option that disables<br>
X11, agent, TCP, tunnel and Unix domain socket forwarding, as well<br>
as anything else we might implement in the future. Like the<br>
&#39;restrict&#39; authorized_keys flag, this is intended to be a simple<br>
and future-proof way of restricting an account.</p></li>
<li><p>sshd(8), ssh(1): Support the &quot;curve25519-sha256&quot; key exchange<br>
method. This is identical to the currently-support method named<br>
&quot;<a href="mailto:curve25519-sha256@libssh.org" rel="nofollow">curve25519-sha256@libssh.org</a>&quot;.</p></li>
<li><p>sshd(8): Improve handling of SIGHUP by checking to see if sshd is<br>
already daemonised at startup and skipping the call to daemon(3)<br>
if it is. This ensures that a SIGHUP restart of sshd(8) will<br>
retain the same process-ID as the initial execution. sshd(8) will<br>
also now unlink the PidFile prior to SIGHUP restart and re-create<br>
it after a successful restart, rather than leaving a stale file in<br>
the case of a configuration error. bz#2641</p></li>
<li><p>sshd(8): Allow ClientAliveInterval and ClientAliveCountMax<br>
directives to appear in sshd_config Match blocks.</p></li>
<li><p>sshd(8): Add %-escapes to AuthorizedPrincipalsCommand to match<br>
those supported by AuthorizedKeysCommand (key, key type,<br>
fingerprint, etc.) and a few more to provide access to the<br>
contents of the certificate being offered.</p></li>
<li><p>Added regression tests for string matching, address matching and<br>
string sanitisation functions.</p></li>
<li><p>Improved the key exchange fuzzer harness.“</p></li>
</ul>
</blockquote>

<ul>
<li>Get those tests done and be sure to send feedback, both positive and negative.
***</li>
</ul>

<h3><a href="https://zinascii.com/2014/how-my-printer-caused-excessive-syscalls.html" rel="nofollow">How My Printer Caused Excessive Syscalls &amp; UDP Traffic</a></h3>

<blockquote>
<p>“3,000 syscalls a second, on an idle machine? That doesn’t seem right. I just booted this machine. The only processes running are those required to boot the SmartOS Global Zone, which is minimal.”</p>

<p>This is a story from 2014, about debugging a machine that was being slowed down by excessive syscalls and UDP traffic. It is also an excellent walkthrough of the basics of DTrace</p>

<p>“Well, at least I have DTrace. I can use this one-liner to figure out what syscalls are being made across the entire system.”</p>

<p>dtrace -n &#39;syscall:::entry { @[probefunc,probename] = count(); }&#39;</p>

<p>“Wow! That is a lot of lwp_sigmask calls. Now that I know what is being called, it’s time to find out who is doing the calling? I’ll use another one-liner to show me the most common user stacks invoking lwp_sigmask.”</p>

<p>dtrace -n &#39;syscall::lwp_sigmask:entry { @[ustack()] = count(); }&#39;</p>

<p>“Okay, so this mdnsd code is causing all the trouble. What is the distribution of syscalls for the mdnsd program?”</p>

<p>dtrace -n &#39;syscall:::entry /execname == &quot;mdnsd&quot;/ { @[probefunc] = count(); } tick-1s { exit(0); }&#39;</p>

<p>“Lots of signal masking and polling. What the hell! Why is it doing this? What is mdnsd anyways? Is there a man page? Googling for mdns reveals that it is used for resolving host names in small networks, like my home network. It uses UDP, and requires zero configuration. Nothing obvious to explain why it’s flipping out. I feel helpless. I turn to the only thing I can trust, the code.”</p>

<p>“Woah boy, this is some messy looking code. This would not pass illumos cstyle checks. Turns out this is code from Darwin—the kernel of OSX.”</p>

<p>“Hmmm…an idea pops into my computer animal brain. I wonder…I wonder if my MacBook is also experiencing abnormal syscall rates? Nooo, that can’t be it. Why would both my SmartOS server and MacBook both have the same problem? There is no good technical reason to link these two. But, then again, I’m dealing with computers here, and I’ve seen a lot of strange things over the years—I switch to my laptop.”</p>

<p>sudo dtrace -n &#39;syscall::: { @[execname] = count(); } tick-1s { exit(0); }&#39;</p>

<p>Same thing, except mdns is called discoverd on OS X</p>

<p>“I ask my friend Steve Vinoski to run the same DTrace one-liner on his OSX machines. He has both Yosemite and the older Mountain Lion. But, to my dismay, neither of his machines are exhibiting high syscall rates. My search continues.”</p>

<p>“Not sure what to do next, I open the OSX Activity Monitor. In desperation I click on the Network tab.”</p>

<p>“ HOLE—E—SHIT! Two-Hundred-and-Seventy Million packets received by discoveryd. Obviously, I need to stop looking at code and start looking at my network. I hop back onto my SmartOS machine and check network interface statistics.”</p>

<p>“Whatever is causing all this, it is sending about 200 packets a second. At this point, the only thing left to do is actually inspect some of these incoming packets. I run snoop(1M) to collect events on the e1000g0 interface, stopping at about 600 events. Then I view the first 15.”</p>

<p>“ A constant stream of mDNS packets arriving from IP 10.0.1.8. I know that this IP is not any of my computers. The only devices left are my iPhone, AppleTV, and Canon printer. Wait a minute! The printer! Two days earlier I heard some beeping noises…”</p>

<p>“I own a Canon PIXMA MG6120 printer. It has a touch interface with a small LCD at the top, used to set various options. Since it sits next to my desk I sometimes lay things on top of it like a book or maybe a plate after I’m done eating. If I lay things in the wrong place it will activate the touch interface and cause repeated pressing. Each press makes a beeping noise. If the object lays there long enough the printer locks up and I have to reboot it. Just such events occurred two days earlier.”</p>

<p>“I fire up dladm again to monitor incoming packets in realtime. Then I turn to the printer. I move all the crap off of it: two books, an empty plate, and the title for my Suzuki SV650 that I’ve been meaning to sell for the last year. I try to use the touch screen on top of the printer. It’s locked up, as expected. I cut power to the printer and whip my head back to my terminal.”</p>

<p>No more packet storm</p>

<p>“Giddy, I run DTrace again to count syscalls.”</p>

<p>“I’m not sure whether to laugh or cry. I laugh, because, LOL computers. There’s some new dumb shit you deal with everyday, better to roll with the punches and laugh. You live longer that way. At least I got to flex my DTrace muscles a bit. In fact, I felt a bit like Brendan Gregg when he was debugging why OSX was dropping keystrokes.”</p>

<p>“I didn’t bother to root cause why my printer turned into a UDP machine gun. I don’t intend to either. I have better things to do, and if rebooting solves the problem then I’m happy. Besides, I had to get back to what I was trying to do six hours before I started debugging this damn thing.”</p>

<p>There you go. The Internet of Terror has already been on your LAN for years.</p>

<hr>
</blockquote>

<h3><a href="https://emptysqua.re/blog/getaddrinfo-cpython-mac-and-bsd/" rel="nofollow">Making Getaddrinfo Concurrent in Python on Mac OS and BSD</a></h3>

<ul>
<li>We have a very fun blog post today to pass along originally authored by “A. Jesse Jiryu Davis”. Specifically the tale of one man’s quest to unify the Getaddrinfo in Python with Mac OS and BSD.</li>
<li>To give you a small taste of this tale, let us pass along just the introduction</li>
</ul>

<blockquote>
<p>“Tell us about the time you made DNS resolution concurrent in Python on Mac and BSD.   No, no, you do not want to hear that story, my friends. It is nothing but old lore and #ifdefs.</p>

<p>But you made Python more scalable. The saga of Steve Jobs was sung to you by a mysterious wizard with a fanciful nickname! Tell us!</p>

<p>Gather round, then. I will tell you how I unearthed a lost secret, unbound Python from old shackles, and banished an ancient and horrible Mutex Troll. Let us begin at the beginning.“</p>
</blockquote>

<ul>
<li>Is your interest piqued? It should be. I’m not sure we could do this blog post justice trying to read it aloud here, but definetly recommend if you want to see how he managed to get this bit of code working cross platform. (And it’s highly entertaining as well)</li>
</ul>

<blockquote>
<p>“A long time ago, in the 1980s, a coven of Berkeley sorcerers crafted an operating system. They named it after themselves: the Berkeley Software Distribution, or BSD. For generations they nurtured it, growing it and adding features. One night, they conjured a powerful function that could resolve hostnames to IPv4 or IPv6 addresses. It was called getaddrinfo. The function was mighty, but in years to come it would grow dangerous, for the sorcerers had not made getaddrinfo thread-safe.”</p>

<p>“As ages passed, BSD spawned many offspring. There were FreeBSD, OpenBSD, NetBSD, and in time, Mac OS X. Each made its copy of getaddrinfo thread safe, at different times and different ways. Some operating systems retained scribes who recorded these events in the annals. Some did not.”</p>
</blockquote>

<ul>
<li>The story continues as our hero battles the Mutex Troll and quests for ancient knowledge</li>
</ul>

<blockquote>
<p>“Apple engineers are not like you and me — they are a shy and secretive folk. They publish only what code they must from Darwin. Their comings and goings are recorded in no bug tracker, their works in no changelog. To learn their secrets, one must delve deep.”</p>

<p>“There is a tiny coven of NYC BSD users who meet at the tavern called Stone Creek, near my dwelling. They are aged and fierce, but I made the Sign of the Trident and supplicated them humbly for advice, and they were kindly to me.”</p>
</blockquote>

<ul>
<li>Spoiler: “Without a word, the mercenary troll shouldered its axe and trudged off in search of other patrons on other platforms. Never again would it hold hostage the worthy smiths forging Python code on BSD.”
***</li>
</ul>

<h3><a href="https://diegocasati.com/2016/12/13/using-release7-to-create-freebsd-images-for-openstack-yes-you-can-do-it/" rel="nofollow">Using release(7) to create FreeBSD images for OpenStack </a></h3>

<ul>
<li>Following a recent episode where we covered a walk through on how to create FreeBSD guest OpenStack images, we wondered if it would be possible to integrate this process into the FreeBSD release(7) process, so they images could be generated consistently and automatically</li>
<li>Being the awesome audience that you are, one of you responded by doing exactly that</li>
</ul>

<blockquote>
<p>“During a recent BSDNow podcast, Allan and Kris mentioned that it would be nice to have a tutorial on how to create a FreeBSD image for OpenStack using the official release(7) tools. With that, it came to me that: #1 I do have access to an OpenStack environment and #2 I am interested in having FreeBSD as a guest image in my environment. Looks like I was up for the challenge.”</p>

<p>“Previously, I’ve had success running FreeBSD 11.0-RELEASE on OpenStack but more could/should be done. For instance, as suggested by Allan,  wouldn’t be nice to deploy the latest code from FreeBSD ? Running -STABLE or even -CURRENT ? Yes, it would. Also, wouldn’t it be nice to customize these images for a specific need? I’d say ‘Yes’ for that as well.”</p>

<p>“After some research I found that the current openstack.conf file, located at /usr/src/release/tools/ could use some extra tweaks to get where I wanted. I’ve created and attached that to a bugzilla on the same topic. You can read about that <a href="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213396" rel="nofollow">here</a>.”</p>
</blockquote>

<ul>
<li>Steps:

<ul>
<li>Fetch the FreeBSD source code and extract it under /usr/src</li>
<li>Once the code is in place, follow the regular process of build(7) and perform a <code>make buildworld buildkernel</code></li>
<li>Change into the release directory (/usr/src/release) and perform a make cloudware</li>
<li>make cloudware-release WITH_CLOUDWARE=yes CLOUDWARE=OPENSTACK VMIMAGE=2G</li>
</ul></li>
</ul>

<blockquote>
<p>“That’s it! This will generate a qcow2 image with 1.4G in size and a raw image of 2G. The entire process uses the release(7) toolchain to generate the image and should work with newer versions of FreeBSD.”</p>

<ul>
<li>The patch has already been <a href="https://svnweb.freebsd.org/base?view=revision&revision=310047" rel="nofollow">committed to FreeBSD </a> 
***</li>
</ul>
</blockquote>

<h2>Interview - Rod Grimes - <a href="mailto:rgrimes@freebsd.org" rel="nofollow">rgrimes@freebsd.org</a></h2>

<ul>
<li>Want to help fund the development of GPU Passthru? <a href="http://bhyve.org/" rel="nofollow">Visit bhyve.org</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://blog.khubla.com/freebsd/configuring-the-freebsd-automounter" rel="nofollow">Configuring the FreeBSD automounter</a></h3>

<ul>
<li>Ever had to configure the FreeBSD auto-mounting daemon? Today we have a blog post that walks us through a few of the configuration knobs you have at your disposal.</li>
<li>First up, Tom shows us his /etc/fstab file, and the various UFS partitions he has setup with the ‘noauto’ flag so they are not mounted at system boot.</li>
<li>His amd.conf file is pretty basic, with just options enabled to restart mounts, and unmount on exit.</li>
<li>Where most users will most likely want to pay attention is in the crafting of an amd.map file</li>
<li>Within this file, we have the various command-foo which performs mounts and unmounts of targeted disks / file-systems on demand.</li>
<li>Pay special attention to all the special chars, since those all matter and a stray or missing ; could be a source of failure.</li>
<li>Lastly a few knobs in rc.conf will enable the various services and a reboot should confirm the functionality.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20161114174451" rel="nofollow">l2k16 hackathon report: LibreSSL manuals now in mdoc(7)</a></h3>

<ul>
<li>Hackathon report by Ingo Schwarze</li>
</ul>

<blockquote>
<p>“Back in the spring two years ago, Kristaps Dzonsons started the pod2mdoc(1) conversion utility, and less than a month later, the LibreSSL project began. During the general summer hackathon in the same year, g2k14, Anthony Bentley started using pod2mdoc(1) for converting LibreSSL manuals to mdoc(7).”</p>

<p>“Back then, doing so still was a pain, because pod2mdoc(1) was still full of bugs and had gaping holes in functionality. For example, Anthony was forced to basically translate the SYNOPSIS sections by hand, and to fix up .Fn and .Xr in the body by hand as well. All the same, he speedily finished all of libssl, and in the autumn of the same year, he mustered the courage to commit his work.”</p>

<p>“Near the end of the following winter, i improved the pod2mdoc(1) tool to actually become convenient in practice and started work on libcrypto, converting about 50 out of the about 190 manuals. Max Fillinger also helped a bit, converting a handful of pages, but i fear i tarried too much checking and committing his work, so he quickly gave up on the task. After that, almost nothing happened for a full year.”</p>

<p>“Now i was finally fed up with the messy situation and decided to put an end to it. So i went to Toulouse and finished the conversion of the remaining 130 manual pages in libcrypto, such that you can now view the documentation of all functions”</p>

<hr>
</blockquote>

<h3><a href="https://github.com/p-gen/smenu" rel="nofollow">Interactive Terminal Utility: smenu</a></h3>

<ul>
<li>Ok, I’ve made no secret of my love for shell scripting. Well today we have a new (somewhat new to us) tool to bring your way.</li>
<li>Have you ever needed to deal with large lists of data, perhaps as the result of a long specially crafted pipe?</li>
<li>What if you need to select a specific value from a range and then continue processing?</li>
<li>Enter ‘smenu’ which can help make your scripting life easier.</li>
</ul>

<blockquote>
<p>“smenu is a selection filter just like sed is an editing filter.</p>

<p>This simple tool reads words from the standard input, presents them in a cool interactive window after the current line on the terminal and writes the selected word, if any, on the standard output.</p>

<p>After having unsuccessfully searched the NET for what I wanted, I decided to try to write my own.</p>

<p>I have tried hard to made its usage as simple as possible. It should work, even when using an old vt100 terminal and is UTF-8 aware.“</p>
</blockquote>

<ul>
<li>What this means, is in your interactive scripts, you can much easier present the user with a cursor driven menu to select from a range of possible choices. (Without needing to craft a bunch of dialog flags)</li>
<li>Take a look, and hopefully you’ll be able to find creative uses for your shell scripts in the future.
***</li>
</ul>

<h3><a href="http://mjg59.dreamwidth.org/45939.html" rel="nofollow">Ubuntu still isn&#39;t free software</a></h3>

<blockquote>
<p>“Any redistribution of modified versions of Ubuntu must be approved, certified or provided by Canonical if you are going to associate it with the Trademarks. Otherwise you must remove and replace the Trademarks and will need to recompile the source code to create your own binaries. This does not affect your rights under any open source licence applicable to any of the components of Ubuntu. If you need us to approve, certify or provide modified versions for redistribution you will require a licence agreement from Canonical, for which you may be required to pay. For further information, please contact us”</p>

<p>“Mark Shuttleworth <a href="http://insights.ubuntu.com/2016/12/01/taking-a-stand-against-unstable-risky-unofficial-ubuntu-images/" rel="nofollow">just blogged</a> about their stance against unofficial Ubuntu images. The assertion is that a cloud hoster is providing unofficial and modified Ubuntu images, and that these images are meaningfully different from upstream Ubuntu in terms of their functionality and security. Users are attempting to make use of these images, are finding that they don&#39;t work properly and are assuming that Ubuntu is a shoddy product. This is an entirely legitimate concern, and if Canonical are acting to reduce user confusion then they should be commended for that.”</p>

<p>“The appropriate means to handle this kind of issue is trademark law. If someone claims that something is Ubuntu when it isn&#39;t, that&#39;s probably an infringement of the trademark and it&#39;s entirely reasonable for the trademark owner to take action to protect the value associated with their trademark. But Canonical&#39;s IP policy goes much further than that - it can be interpreted as meaning[1] that you can&#39;t distribute works based on Ubuntu without paying Canonical for the privilege, even if you call it something other than Ubuntu. [1]: And by &quot;interpreted as meaning&quot; I mean that&#39;s what it says and Canonical refuse to say otherwise”</p>

<p>“If you ask a copyright holder if you can give a copy of their work to someone else (assuming it doesn&#39;t infringe trademark law), and they say no or insist you need an additional contract, it&#39;s not free software. If they insist that you recompile source code before you can give copies to someone else, it&#39;s not free software. Asking that you remove trademarks that would otherwise infringe trademark law is fine, but if you can&#39;t use their trademarks in non-infringing ways, that&#39;s still not free software.”</p>

<p>“Canonical&#39;s IP policy continues to impose restrictions on all of these things, and therefore Ubuntu is not free software.”</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://opnsense.org/opnsense-16-7-10-released/" rel="nofollow">OPNsense 16.7.10 released</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20161123193708&mode=expanded&count=8" rel="nofollow">OpenBSD Foundation Welcomes First Iridium Donor: Smartisan</a></p></li>
<li><p><a href="https://www.freebsdfoundation.org/blog/foundation-announces-new-uranium-donor/" rel="nofollow">Jan Koum donates $500,000 to FreeBSD</a> </p></li>
<li><p><a href="https://en.wikipedia.org/wiki/DEMOS" rel="nofollow">The Soviet Russia, BSD makes you</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/gRN4Lzy8" rel="nofollow"> Jason - Value</a> </li>
<li><a href="http://pastebin.com/GZYjRmSR" rel="nofollow"> Hamza - Shell Scripting</a> 

<ul>
<li><a href="http://aikchar.me/blog/unix-shell-programming-lessons-learned.html" rel="nofollow">Blog link</a></li>
</ul></li>
<li><a href="http://pastebin.com/hEBu3Drp" rel="nofollow"> Dave - Migrating to FreeBSD</a> </li>
<li><a href="http://pastebin.com/1HpKqCSt" rel="nofollow"> Dan - Which BSD?</a> </li>
<li><a href="http://pastebin.com/4Aj5ebns" rel="nofollow"> Zach - AMD Video</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we have a very special guest joining us to tell us a tale of the early days in BSD history. That plus some new OpenSSH goodness, shell scripting utilities and much more. Stay tuned for your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://marc.info/?l=openssh-unix-dev&m=148167688911316&w=2" rel="nofollow">Call For Testing: OpenSSH 7.4 </a></h3>

<ul>
<li>Getting ready to head into the holidays for for the end of 2016 means some of us will have spare time on our hands. What a perfect time to get some call for testing work done!</li>
<li>Damien Miller has issued a public CFT for the upcoming OpenSSH 7.4 release, which considering how much we all rely on SSH I would expect will get some eager volunteers for testing.</li>
<li>What are some of the potential breakers?</li>
</ul>

<blockquote>
<p>“* This release removes server support for the SSH v.1 protocol.</p>

<ul>
<li><p>ssh(1): Remove 3des-cbc from the client&#39;s default proposal. 64-bit<br>
block ciphers are not safe in 2016 and we don&#39;t want to wait until<br>
attacks like SWEET32 are extended to SSH. As 3des-cbc was the<br>
only mandatory cipher in the SSH RFCs, this may cause problems<br>
connecting to older devices using the default configuration,<br>
but it&#39;s highly likely that such devices already need explicit<br>
configuration for key exchange and hostkey algorithms already<br>
anyway.</p></li>
<li><p>sshd(8): Remove support for pre-authentication compression.<br>
Doing compression early in the protocol probably seemed reasonable<br>
in the 1990s, but today it&#39;s clearly a bad idea in terms of both<br>
cryptography (cf. multiple compression oracle attacks in TLS) and<br>
attack surface. Pre-auth compression support has been disabled by<br>
default for &gt;10 years. Support remains in the client.</p></li>
<li><p>ssh-agent will refuse to load PKCS#11 modules outside a whitelist<br>
of trusted paths by default. The path whitelist may be specified<br>
at run-time.</p></li>
<li><p>sshd(8): When a forced-command appears in both a certificate and<br>
an authorized keys/principals command= restriction, sshd will now<br>
refuse to accept the certificate unless they are identical.<br>
The previous (documented) behaviour of having the certificate<br>
forced-command override the other could be a bit confusing and<br>
error-prone.</p></li>
<li><p>sshd(8): Remove the UseLogin configuration directive and support<br>
for having /bin/login manage login sessions.“</p></li>
</ul>
</blockquote>

<ul>
<li>What about new features? 7.4 has some of those to wake you up also:</li>
</ul>

<blockquote>
<p>“* ssh(1): Add a proxy multiplexing mode to ssh(1) inspired by the<br>
   version in PuTTY by Simon Tatham. This allows a multiplexing<br>
   client to communicate with the master process using a subset of<br>
   the SSH packet and channels protocol over a Unix-domain socket,<br>
   with the main process acting as a proxy that translates channel<br>
   IDs, etc.  This allows multiplexing mode to run on systems that<br>
   lack file- descriptor passing (used by current multiplexing<br>
   code) and potentially, in conjunction with Unix-domain socket<br>
   forwarding, with the client and multiplexing master process on<br>
   different machines. Multiplexing proxy mode may be invoked using<br>
   &quot;ssh -O proxy ...&quot;</p>

<ul>
<li><p>sshd(8): Add a sshd_config DisableForwaring option that disables<br>
X11, agent, TCP, tunnel and Unix domain socket forwarding, as well<br>
as anything else we might implement in the future. Like the<br>
&#39;restrict&#39; authorized_keys flag, this is intended to be a simple<br>
and future-proof way of restricting an account.</p></li>
<li><p>sshd(8), ssh(1): Support the &quot;curve25519-sha256&quot; key exchange<br>
method. This is identical to the currently-support method named<br>
&quot;<a href="mailto:curve25519-sha256@libssh.org" rel="nofollow">curve25519-sha256@libssh.org</a>&quot;.</p></li>
<li><p>sshd(8): Improve handling of SIGHUP by checking to see if sshd is<br>
already daemonised at startup and skipping the call to daemon(3)<br>
if it is. This ensures that a SIGHUP restart of sshd(8) will<br>
retain the same process-ID as the initial execution. sshd(8) will<br>
also now unlink the PidFile prior to SIGHUP restart and re-create<br>
it after a successful restart, rather than leaving a stale file in<br>
the case of a configuration error. bz#2641</p></li>
<li><p>sshd(8): Allow ClientAliveInterval and ClientAliveCountMax<br>
directives to appear in sshd_config Match blocks.</p></li>
<li><p>sshd(8): Add %-escapes to AuthorizedPrincipalsCommand to match<br>
those supported by AuthorizedKeysCommand (key, key type,<br>
fingerprint, etc.) and a few more to provide access to the<br>
contents of the certificate being offered.</p></li>
<li><p>Added regression tests for string matching, address matching and<br>
string sanitisation functions.</p></li>
<li><p>Improved the key exchange fuzzer harness.“</p></li>
</ul>
</blockquote>

<ul>
<li>Get those tests done and be sure to send feedback, both positive and negative.
***</li>
</ul>

<h3><a href="https://zinascii.com/2014/how-my-printer-caused-excessive-syscalls.html" rel="nofollow">How My Printer Caused Excessive Syscalls &amp; UDP Traffic</a></h3>

<blockquote>
<p>“3,000 syscalls a second, on an idle machine? That doesn’t seem right. I just booted this machine. The only processes running are those required to boot the SmartOS Global Zone, which is minimal.”</p>

<p>This is a story from 2014, about debugging a machine that was being slowed down by excessive syscalls and UDP traffic. It is also an excellent walkthrough of the basics of DTrace</p>

<p>“Well, at least I have DTrace. I can use this one-liner to figure out what syscalls are being made across the entire system.”</p>

<p>dtrace -n &#39;syscall:::entry { @[probefunc,probename] = count(); }&#39;</p>

<p>“Wow! That is a lot of lwp_sigmask calls. Now that I know what is being called, it’s time to find out who is doing the calling? I’ll use another one-liner to show me the most common user stacks invoking lwp_sigmask.”</p>

<p>dtrace -n &#39;syscall::lwp_sigmask:entry { @[ustack()] = count(); }&#39;</p>

<p>“Okay, so this mdnsd code is causing all the trouble. What is the distribution of syscalls for the mdnsd program?”</p>

<p>dtrace -n &#39;syscall:::entry /execname == &quot;mdnsd&quot;/ { @[probefunc] = count(); } tick-1s { exit(0); }&#39;</p>

<p>“Lots of signal masking and polling. What the hell! Why is it doing this? What is mdnsd anyways? Is there a man page? Googling for mdns reveals that it is used for resolving host names in small networks, like my home network. It uses UDP, and requires zero configuration. Nothing obvious to explain why it’s flipping out. I feel helpless. I turn to the only thing I can trust, the code.”</p>

<p>“Woah boy, this is some messy looking code. This would not pass illumos cstyle checks. Turns out this is code from Darwin—the kernel of OSX.”</p>

<p>“Hmmm…an idea pops into my computer animal brain. I wonder…I wonder if my MacBook is also experiencing abnormal syscall rates? Nooo, that can’t be it. Why would both my SmartOS server and MacBook both have the same problem? There is no good technical reason to link these two. But, then again, I’m dealing with computers here, and I’ve seen a lot of strange things over the years—I switch to my laptop.”</p>

<p>sudo dtrace -n &#39;syscall::: { @[execname] = count(); } tick-1s { exit(0); }&#39;</p>

<p>Same thing, except mdns is called discoverd on OS X</p>

<p>“I ask my friend Steve Vinoski to run the same DTrace one-liner on his OSX machines. He has both Yosemite and the older Mountain Lion. But, to my dismay, neither of his machines are exhibiting high syscall rates. My search continues.”</p>

<p>“Not sure what to do next, I open the OSX Activity Monitor. In desperation I click on the Network tab.”</p>

<p>“ HOLE—E—SHIT! Two-Hundred-and-Seventy Million packets received by discoveryd. Obviously, I need to stop looking at code and start looking at my network. I hop back onto my SmartOS machine and check network interface statistics.”</p>

<p>“Whatever is causing all this, it is sending about 200 packets a second. At this point, the only thing left to do is actually inspect some of these incoming packets. I run snoop(1M) to collect events on the e1000g0 interface, stopping at about 600 events. Then I view the first 15.”</p>

<p>“ A constant stream of mDNS packets arriving from IP 10.0.1.8. I know that this IP is not any of my computers. The only devices left are my iPhone, AppleTV, and Canon printer. Wait a minute! The printer! Two days earlier I heard some beeping noises…”</p>

<p>“I own a Canon PIXMA MG6120 printer. It has a touch interface with a small LCD at the top, used to set various options. Since it sits next to my desk I sometimes lay things on top of it like a book or maybe a plate after I’m done eating. If I lay things in the wrong place it will activate the touch interface and cause repeated pressing. Each press makes a beeping noise. If the object lays there long enough the printer locks up and I have to reboot it. Just such events occurred two days earlier.”</p>

<p>“I fire up dladm again to monitor incoming packets in realtime. Then I turn to the printer. I move all the crap off of it: two books, an empty plate, and the title for my Suzuki SV650 that I’ve been meaning to sell for the last year. I try to use the touch screen on top of the printer. It’s locked up, as expected. I cut power to the printer and whip my head back to my terminal.”</p>

<p>No more packet storm</p>

<p>“Giddy, I run DTrace again to count syscalls.”</p>

<p>“I’m not sure whether to laugh or cry. I laugh, because, LOL computers. There’s some new dumb shit you deal with everyday, better to roll with the punches and laugh. You live longer that way. At least I got to flex my DTrace muscles a bit. In fact, I felt a bit like Brendan Gregg when he was debugging why OSX was dropping keystrokes.”</p>

<p>“I didn’t bother to root cause why my printer turned into a UDP machine gun. I don’t intend to either. I have better things to do, and if rebooting solves the problem then I’m happy. Besides, I had to get back to what I was trying to do six hours before I started debugging this damn thing.”</p>

<p>There you go. The Internet of Terror has already been on your LAN for years.</p>

<hr>
</blockquote>

<h3><a href="https://emptysqua.re/blog/getaddrinfo-cpython-mac-and-bsd/" rel="nofollow">Making Getaddrinfo Concurrent in Python on Mac OS and BSD</a></h3>

<ul>
<li>We have a very fun blog post today to pass along originally authored by “A. Jesse Jiryu Davis”. Specifically the tale of one man’s quest to unify the Getaddrinfo in Python with Mac OS and BSD.</li>
<li>To give you a small taste of this tale, let us pass along just the introduction</li>
</ul>

<blockquote>
<p>“Tell us about the time you made DNS resolution concurrent in Python on Mac and BSD.   No, no, you do not want to hear that story, my friends. It is nothing but old lore and #ifdefs.</p>

<p>But you made Python more scalable. The saga of Steve Jobs was sung to you by a mysterious wizard with a fanciful nickname! Tell us!</p>

<p>Gather round, then. I will tell you how I unearthed a lost secret, unbound Python from old shackles, and banished an ancient and horrible Mutex Troll. Let us begin at the beginning.“</p>
</blockquote>

<ul>
<li>Is your interest piqued? It should be. I’m not sure we could do this blog post justice trying to read it aloud here, but definetly recommend if you want to see how he managed to get this bit of code working cross platform. (And it’s highly entertaining as well)</li>
</ul>

<blockquote>
<p>“A long time ago, in the 1980s, a coven of Berkeley sorcerers crafted an operating system. They named it after themselves: the Berkeley Software Distribution, or BSD. For generations they nurtured it, growing it and adding features. One night, they conjured a powerful function that could resolve hostnames to IPv4 or IPv6 addresses. It was called getaddrinfo. The function was mighty, but in years to come it would grow dangerous, for the sorcerers had not made getaddrinfo thread-safe.”</p>

<p>“As ages passed, BSD spawned many offspring. There were FreeBSD, OpenBSD, NetBSD, and in time, Mac OS X. Each made its copy of getaddrinfo thread safe, at different times and different ways. Some operating systems retained scribes who recorded these events in the annals. Some did not.”</p>
</blockquote>

<ul>
<li>The story continues as our hero battles the Mutex Troll and quests for ancient knowledge</li>
</ul>

<blockquote>
<p>“Apple engineers are not like you and me — they are a shy and secretive folk. They publish only what code they must from Darwin. Their comings and goings are recorded in no bug tracker, their works in no changelog. To learn their secrets, one must delve deep.”</p>

<p>“There is a tiny coven of NYC BSD users who meet at the tavern called Stone Creek, near my dwelling. They are aged and fierce, but I made the Sign of the Trident and supplicated them humbly for advice, and they were kindly to me.”</p>
</blockquote>

<ul>
<li>Spoiler: “Without a word, the mercenary troll shouldered its axe and trudged off in search of other patrons on other platforms. Never again would it hold hostage the worthy smiths forging Python code on BSD.”
***</li>
</ul>

<h3><a href="https://diegocasati.com/2016/12/13/using-release7-to-create-freebsd-images-for-openstack-yes-you-can-do-it/" rel="nofollow">Using release(7) to create FreeBSD images for OpenStack </a></h3>

<ul>
<li>Following a recent episode where we covered a walk through on how to create FreeBSD guest OpenStack images, we wondered if it would be possible to integrate this process into the FreeBSD release(7) process, so they images could be generated consistently and automatically</li>
<li>Being the awesome audience that you are, one of you responded by doing exactly that</li>
</ul>

<blockquote>
<p>“During a recent BSDNow podcast, Allan and Kris mentioned that it would be nice to have a tutorial on how to create a FreeBSD image for OpenStack using the official release(7) tools. With that, it came to me that: #1 I do have access to an OpenStack environment and #2 I am interested in having FreeBSD as a guest image in my environment. Looks like I was up for the challenge.”</p>

<p>“Previously, I’ve had success running FreeBSD 11.0-RELEASE on OpenStack but more could/should be done. For instance, as suggested by Allan,  wouldn’t be nice to deploy the latest code from FreeBSD ? Running -STABLE or even -CURRENT ? Yes, it would. Also, wouldn’t it be nice to customize these images for a specific need? I’d say ‘Yes’ for that as well.”</p>

<p>“After some research I found that the current openstack.conf file, located at /usr/src/release/tools/ could use some extra tweaks to get where I wanted. I’ve created and attached that to a bugzilla on the same topic. You can read about that <a href="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213396" rel="nofollow">here</a>.”</p>
</blockquote>

<ul>
<li>Steps:

<ul>
<li>Fetch the FreeBSD source code and extract it under /usr/src</li>
<li>Once the code is in place, follow the regular process of build(7) and perform a <code>make buildworld buildkernel</code></li>
<li>Change into the release directory (/usr/src/release) and perform a make cloudware</li>
<li>make cloudware-release WITH_CLOUDWARE=yes CLOUDWARE=OPENSTACK VMIMAGE=2G</li>
</ul></li>
</ul>

<blockquote>
<p>“That’s it! This will generate a qcow2 image with 1.4G in size and a raw image of 2G. The entire process uses the release(7) toolchain to generate the image and should work with newer versions of FreeBSD.”</p>

<ul>
<li>The patch has already been <a href="https://svnweb.freebsd.org/base?view=revision&revision=310047" rel="nofollow">committed to FreeBSD </a> 
***</li>
</ul>
</blockquote>

<h2>Interview - Rod Grimes - <a href="mailto:rgrimes@freebsd.org" rel="nofollow">rgrimes@freebsd.org</a></h2>

<ul>
<li>Want to help fund the development of GPU Passthru? <a href="http://bhyve.org/" rel="nofollow">Visit bhyve.org</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://blog.khubla.com/freebsd/configuring-the-freebsd-automounter" rel="nofollow">Configuring the FreeBSD automounter</a></h3>

<ul>
<li>Ever had to configure the FreeBSD auto-mounting daemon? Today we have a blog post that walks us through a few of the configuration knobs you have at your disposal.</li>
<li>First up, Tom shows us his /etc/fstab file, and the various UFS partitions he has setup with the ‘noauto’ flag so they are not mounted at system boot.</li>
<li>His amd.conf file is pretty basic, with just options enabled to restart mounts, and unmount on exit.</li>
<li>Where most users will most likely want to pay attention is in the crafting of an amd.map file</li>
<li>Within this file, we have the various command-foo which performs mounts and unmounts of targeted disks / file-systems on demand.</li>
<li>Pay special attention to all the special chars, since those all matter and a stray or missing ; could be a source of failure.</li>
<li>Lastly a few knobs in rc.conf will enable the various services and a reboot should confirm the functionality.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20161114174451" rel="nofollow">l2k16 hackathon report: LibreSSL manuals now in mdoc(7)</a></h3>

<ul>
<li>Hackathon report by Ingo Schwarze</li>
</ul>

<blockquote>
<p>“Back in the spring two years ago, Kristaps Dzonsons started the pod2mdoc(1) conversion utility, and less than a month later, the LibreSSL project began. During the general summer hackathon in the same year, g2k14, Anthony Bentley started using pod2mdoc(1) for converting LibreSSL manuals to mdoc(7).”</p>

<p>“Back then, doing so still was a pain, because pod2mdoc(1) was still full of bugs and had gaping holes in functionality. For example, Anthony was forced to basically translate the SYNOPSIS sections by hand, and to fix up .Fn and .Xr in the body by hand as well. All the same, he speedily finished all of libssl, and in the autumn of the same year, he mustered the courage to commit his work.”</p>

<p>“Near the end of the following winter, i improved the pod2mdoc(1) tool to actually become convenient in practice and started work on libcrypto, converting about 50 out of the about 190 manuals. Max Fillinger also helped a bit, converting a handful of pages, but i fear i tarried too much checking and committing his work, so he quickly gave up on the task. After that, almost nothing happened for a full year.”</p>

<p>“Now i was finally fed up with the messy situation and decided to put an end to it. So i went to Toulouse and finished the conversion of the remaining 130 manual pages in libcrypto, such that you can now view the documentation of all functions”</p>

<hr>
</blockquote>

<h3><a href="https://github.com/p-gen/smenu" rel="nofollow">Interactive Terminal Utility: smenu</a></h3>

<ul>
<li>Ok, I’ve made no secret of my love for shell scripting. Well today we have a new (somewhat new to us) tool to bring your way.</li>
<li>Have you ever needed to deal with large lists of data, perhaps as the result of a long specially crafted pipe?</li>
<li>What if you need to select a specific value from a range and then continue processing?</li>
<li>Enter ‘smenu’ which can help make your scripting life easier.</li>
</ul>

<blockquote>
<p>“smenu is a selection filter just like sed is an editing filter.</p>

<p>This simple tool reads words from the standard input, presents them in a cool interactive window after the current line on the terminal and writes the selected word, if any, on the standard output.</p>

<p>After having unsuccessfully searched the NET for what I wanted, I decided to try to write my own.</p>

<p>I have tried hard to made its usage as simple as possible. It should work, even when using an old vt100 terminal and is UTF-8 aware.“</p>
</blockquote>

<ul>
<li>What this means, is in your interactive scripts, you can much easier present the user with a cursor driven menu to select from a range of possible choices. (Without needing to craft a bunch of dialog flags)</li>
<li>Take a look, and hopefully you’ll be able to find creative uses for your shell scripts in the future.
***</li>
</ul>

<h3><a href="http://mjg59.dreamwidth.org/45939.html" rel="nofollow">Ubuntu still isn&#39;t free software</a></h3>

<blockquote>
<p>“Any redistribution of modified versions of Ubuntu must be approved, certified or provided by Canonical if you are going to associate it with the Trademarks. Otherwise you must remove and replace the Trademarks and will need to recompile the source code to create your own binaries. This does not affect your rights under any open source licence applicable to any of the components of Ubuntu. If you need us to approve, certify or provide modified versions for redistribution you will require a licence agreement from Canonical, for which you may be required to pay. For further information, please contact us”</p>

<p>“Mark Shuttleworth <a href="http://insights.ubuntu.com/2016/12/01/taking-a-stand-against-unstable-risky-unofficial-ubuntu-images/" rel="nofollow">just blogged</a> about their stance against unofficial Ubuntu images. The assertion is that a cloud hoster is providing unofficial and modified Ubuntu images, and that these images are meaningfully different from upstream Ubuntu in terms of their functionality and security. Users are attempting to make use of these images, are finding that they don&#39;t work properly and are assuming that Ubuntu is a shoddy product. This is an entirely legitimate concern, and if Canonical are acting to reduce user confusion then they should be commended for that.”</p>

<p>“The appropriate means to handle this kind of issue is trademark law. If someone claims that something is Ubuntu when it isn&#39;t, that&#39;s probably an infringement of the trademark and it&#39;s entirely reasonable for the trademark owner to take action to protect the value associated with their trademark. But Canonical&#39;s IP policy goes much further than that - it can be interpreted as meaning[1] that you can&#39;t distribute works based on Ubuntu without paying Canonical for the privilege, even if you call it something other than Ubuntu. [1]: And by &quot;interpreted as meaning&quot; I mean that&#39;s what it says and Canonical refuse to say otherwise”</p>

<p>“If you ask a copyright holder if you can give a copy of their work to someone else (assuming it doesn&#39;t infringe trademark law), and they say no or insist you need an additional contract, it&#39;s not free software. If they insist that you recompile source code before you can give copies to someone else, it&#39;s not free software. Asking that you remove trademarks that would otherwise infringe trademark law is fine, but if you can&#39;t use their trademarks in non-infringing ways, that&#39;s still not free software.”</p>

<p>“Canonical&#39;s IP policy continues to impose restrictions on all of these things, and therefore Ubuntu is not free software.”</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://opnsense.org/opnsense-16-7-10-released/" rel="nofollow">OPNsense 16.7.10 released</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20161123193708&mode=expanded&count=8" rel="nofollow">OpenBSD Foundation Welcomes First Iridium Donor: Smartisan</a></p></li>
<li><p><a href="https://www.freebsdfoundation.org/blog/foundation-announces-new-uranium-donor/" rel="nofollow">Jan Koum donates $500,000 to FreeBSD</a> </p></li>
<li><p><a href="https://en.wikipedia.org/wiki/DEMOS" rel="nofollow">The Soviet Russia, BSD makes you</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/gRN4Lzy8" rel="nofollow"> Jason - Value</a> </li>
<li><a href="http://pastebin.com/GZYjRmSR" rel="nofollow"> Hamza - Shell Scripting</a> 

<ul>
<li><a href="http://aikchar.me/blog/unix-shell-programming-lessons-learned.html" rel="nofollow">Blog link</a></li>
</ul></li>
<li><a href="http://pastebin.com/hEBu3Drp" rel="nofollow"> Dave - Migrating to FreeBSD</a> </li>
<li><a href="http://pastebin.com/1HpKqCSt" rel="nofollow"> Dan - Which BSD?</a> </li>
<li><a href="http://pastebin.com/4Aj5ebns" rel="nofollow"> Zach - AMD Video</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>171: The APU - BSD Style!</title>
  <link>https://www.bsdnow.tv/171</link>
  <guid isPermaLink="false">a62aa20a-ad86-4e21-b547-cd53c38c6b46</guid>
  <pubDate>Wed, 07 Dec 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a62aa20a-ad86-4e21-b547-cd53c38c6b46.mp3" length="62802580" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Today on the show, we’ve got a look at running OpenBSD on a APU, some BSD in your Android, managing your own FreeBSD cloud service with ansible and much more. Keep it turned on your place to B...SD!</itunes:subtitle>
  <itunes:duration>1:27:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Today on the show, we’ve got a look at running OpenBSD on a APU, some BSD in your Android, managing your own FreeBSD cloud service with ansible and much more. Keep it turned on your place to B...SD!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenBSD on PC Engines APU2 (https://github.com/elad/openbsd-apu2)
A detailed walkthrough of building an OpenBSD firewall on a PC Engines APU2
It starts with a breakdown of the parts that were purchases, totally around $200
Then the reader is walked through configuring the serial console, flashing the ROM, and updating the BIOS
The next step is actually creating a custom OpenBSD install image, and pre-configuring its serial console. Starting with OpenBSD 6.0, this step is done automatically by the installer
Installation:
Power off the APU2
Insert the bootable OpenBSD installer USB flash drive to one of the USB slots on the APU2
Power on the APU2, press F10 to get to the boot menu, and choose to boot from USB (usually option number 1)
At the boot&amp;gt; prompt, remember the serial console settings (see above)
Also at the boot&amp;gt; prompt, press Enter to start the installer
Follow the installation instructions
The driver used for wireless networking is athn(4). It might not work properly out of the box. Once OpenBSD is installed, run fw_update with no arguments. It will figure out which firmware updates are required and will download and install them. When it finishes, reboot.
Where the rubber meets the road… (part one) (https://functionallyparanoid.com/2016/11/29/where-the-rubber-meets-the-road-part-one/)
A user describes their adventures installing OpenBSD and Arch Linux on a new Lenovo X1 Carbon (4th gen, skylake)
They also detail why they moved away from their beloved Macbook, which while long, does describe a journey away from Apple that we’ve heard elsewhere.
The journey begins with getting a new Windows laptop, shrinking the partition and creating space for a triple-boot install, of Windows / Arch / OpenBSD
Brian then details how he setup the partitioning and performed the initial Arch installation, getting it tuned to his specifications.
Next up was OpenBSD though, and that went sideways initially due to a new NVMe drive that wasn’t fully supported (yet)
The article is split into two parts (we will bring you the next installment at a future date), but he leaves us with the plan of attack to build a custom OpenBSD kernel with corrected PCI device identifiers.
We wish Brian luck, and look forward to the “rest of the story” soon.
***
Howto setup a FreeBSD jail server using iocage and ansible. (https://github.com/JoergFiedler/freebsd-ansible-demo)
Setting up a FreeBSD jail server can be a daunting task. However when a guide comes along which shows you how to do that, including not exposing a single (non-jailed) port to the outside world, you know we had a take a closer look.
This guide comes to us from GitHub, courtesy of Joerg Fielder. 
The project goals seem notable:
Ansible playbook that creates a FreeBSD server which hosts multiple jails.
Travis is used to run/test the playbook.
No service on the host is exposed externally.
All external connections terminate within a jail.
Roles can be reused using Ansible Galaxy.
Combine any of those roles to create FreeBSD server, which perfectly suits you.
To get started, you’ll need a machine with Ansible, Vagrant and VirtualBox, and your credentials to AWS if you want it to automatically create / destroy EC2 instances.
There’s already an impressive list of Anisible roles created for you to start with:
freebsd-build-server - Creates a FreeBSD poudriere build server
freebsd-jail-host - FreeBSD Jail host
freebsd-jailed - Provides a jail
freebsd-jailed-nginx - Provides a jailed nginx server
freebsd-jailed-php-fpm - Creates a php-fpm pool and a ZFS dataset which is used as web root by php-fpm
freebsd-jailed-sftp - Installs a SFTP server
freebsd-jailed-sshd - Provides a jailed sshd server.
freebsd-jailed-syslogd - Provides a jailed syslogd
freebsd-jailed-btsync - Provides a jailed btsync instance server
freebsd-jailed-joomla - Installs Joomla
freebsd-jailed-mariadb - Provides a jailed MariaDB server
freebsd-jailed-wordpress - Provides a jailed Wordpress server.
Since the machines have to be customized before starting, he mentions that cloud-init is used to do the following:
activate pf firewall
add a pass all keep state rule to pf to keep track of connection states, which in turn allows you to reload the pf service without losing the connection
install the following packages:
sudo
bash
python27
allow passwordless sudo for user ec2-user
“
From there it is pretty straight-forward, just a couple commands to spin up the VM’s either locally on your VirtualBox host, or in the cloud with AWS. Internally the VM’s are auto-configured with iocage to create jails, where all your actual services run.
A neat project, check it out today if you want a shake-n-bake type cloud + jail solution.
Colin Percival's bsdiff helps reduce Android apk bandwidth usage by 6 petabytes per day (http://android-developers.blogspot.ca/2016/12/saving-data-reducing-the-size-of-app-updates-by-65-percent.html)
A post on the official Android-Developers blog, talks about how they used bsdiff (and bspatch) to reduce the size of Android application updates by 65%
bsdiff was developed by FreeBSD’s Colin Percival
Earlier this year, we announced that we started using the bsdiff algorithm (by Colin Percival). Using bsdiff, we were able to reduce the size of app updates on average by 47% compared to the full APK size.
This post is actually about the second generation of the code.
Today, we're excited to share a new approach that goes further — File-by-File patching. App Updates using File-by-File patching are, on average, 65% smaller than the full app, and in some cases more than 90% smaller.
Android apps are packaged as APKs, which are ZIP files with special conventions. Most of the content within the ZIP files (and APKs) is compressed using a technology called Deflate. Deflate is really good at compressing data but it has a drawback: it makes identifying changes in the original (uncompressed) content really hard. Even a tiny change to the original content (like changing one word in a book) can make the compressed output of deflate look completely different. Describing the differences between the original content is easy, but describing the differences between the compressed content is so hard that it leads to inefficient patches.
So in the second generation of the code, they use bsdiff on each individual file, then package that, rather than diffing the original and new archives
bsdiff is used in a great many other places, including shrinking the updates for the Firefox and Chrome browsers
You can find out more about bsdiff here: http://www.daemonology.net/bsdiff/
A far more sophisticated algorithm, which typically provides roughly 20% smaller patches, is described in my doctoral thesis (http://www.daemonology.net/papers/thesis.pdf).
Considering the gains, it is interesting that no one has implemented Colin’s more sophisticated algorithm
Colin had an interesting observation (https://twitter.com/cperciva/status/806426180379230208) last night: “I just realized that bandwidth savings due to bsdiff are now roughly equal to what the total internet traffic was when I wrote it in 2003.”
***
News Roundup
Distrowatch does an in-depth review of NAS4Free (https://distrowatch.com/weekly.php?issue=20161114#nas4free)
Jesse Smith over at DistroWatch has done a pretty in-depth review of Nas4Free.
The review starts with mentioning that NAS4Free works on 3 platforms, ARM/i386/AMD64 and for the purposes of this review he would be using AMD64 builds.
After going through the initial install (doing typical disk management operations, such as GPT/MBR, etc) he was ready to begin using the product.
One concern originally observed was that the initial boot seemed rather slow. Investigation revealed this was due to it loading the entire OS image into memory, and the first (long) disk read did take some time, but once loaded was super responsive.
The next steps involved doing the initial configuration, which meant creating a new ZFS storage pool. After this process was done, he did find one puzzling UI option called “VM” which indicated it can be linked to VirtualBox in some way, but the Docs didn’t reveal its secrets of usage.
Additionally covered were some of the various “Access” methods, including traditional UNIX permissions, AD and LDAP, and then various Sharing services which are typical to a NAS, Such as NFS / Samba and others.
One neat feature was the built-in file-browser via the web-interface, which allows you another method of getting at your data when sometimes NFS / Samba or WebDav aren’t enough.
Jesse gives us a nice round-up conclusion as well
Most of the NAS operating systems I have used in the past were built around useful features. Some focused on making storage easy to set up and manage, others focused on services, such as making files available over multiple protocols or managing torrents. Some strive to be very easy to set up. NAS4Free does pretty well in each of the above categories. It may not be the easiest platform to set up, but it's probably a close second. It may not have the prettiest interface for managing settings, but it is quite easy to navigate. NAS4Free may not have the most add-on services and access protocols, but I suspect there are more than enough of both for most people.
Where NAS4Free does better than most other solutions I have looked at is security. I don't think the project's website or documentation particularly focuses on security as a feature, but there are plenty of little security features that I liked. NAS4Free makes it very easy to lock the text console, which is good because we do not all keep our NAS boxes behind locked doors. The system is fairly easy to upgrade and appears to publish regular security updates in the form of new firmware. NAS4Free makes it fairly easy to set up user accounts, handle permissions and manage home directories. It's also pretty straight forward to switch from HTTP to HTTPS and to block people not on the local network from accessing the NAS's web interface.
All in all, I like NAS4Free. It's a good, general purpose NAS operating system. While I did not feel the project did anything really amazing in any one category, nor did I run into any serious issues. The NAS ran as expected, was fairly straight forward to set up and easy to manage. This strikes me as an especially good platform for home or small business users who want an easy set up, some basic security and a solid collection of features.
Browsix: Unix in the browser tab (https://browsix.org/)
Browsix is a research project from the PLASMA lab at the University of Massachusetts, Amherst.
The goal: Run C, C++, Go and Node.js programs as processes in browsers, including LaTeX, GNU Make, Go HTTP servers, and POSIX shell scripts.
“Processes are built on top of Web Workers, letting applications run in parallel and spawn subprocesses. System calls include fork, spawn, exec, and wait.”
Pipes are supported with pipe(2) enabling developers to compose processes into pipelines.
Sockets include support for TCP socket servers and clients, making it possible to run applications like databases and HTTP servers together with their clients in the browser.
 Browsix comprises two core parts:
A kernel written in TypeScript that makes core Unix features (including pipes, concurrent processes, signals, sockets, and a shared file system) available to web applications.
Extended JavaScript runtimes for C, C++, Go, and Node.js that support running programs written in these languages as processes in the browser.
This seems like an interesting project, although I am not sure how it would be used as more than a toy
***
Book Review: PAM Mastery (https://www.cyberciti.biz/reviews/book-review-pam-mastery/)
nixCraft does a book review of Michael W. Lucas’ “Pam Mastery”
Linux, FreeBSD, and Unix-like systems are multi-user and need some way of authenticating individual users. Back in the old days, this was done in different ways. You need to change each Unix application to use different authentication scheme.
Before PAM, if you wanted to use an SQL database to authenticate users, you had to write specific support for that into each of your applications. Same for LDAP, etc.
So Open Group lead to the development of PAM for the Unix-like system. Today Linux, FreeBSD, MacOS X and many other Unix-like systems are configured to use a centralized authentication mechanism called Pluggable Authentication Modules (PAM). The book “PAM Mastery” deals with the black magic of PAM.
Of course, each OS chose to implement PAM a little bit differently
The book starts with the basic concepts about PAM and authentication. You learn about Multi-Factor Authentication and why use PAM instead of changing each program to authenticate the user. The author went into great details about why PAM is useful for developers and sysadmin for several reasons. The examples cover CentOS Linux (RHEL and clones), Debian Linux, and FreeBSD Unix system.
I like the way the author described PAM Configuration Files and Common Modules that covers everyday scenarios for the sysadmin. PAM configuration file format and PAM Module Interfaces are discussed in easy to understand language. Control flags in PAM can be very confusing for new sysadmins. Modules can be stacked in a particular order, and the control flags determine how important the success or failure of a particular module.
There is also a chapter about using one-time passwords (Google Authenticator) for your application.
The final chapter is all about enforcing good password policies for users and apps using PAM.
The sysadmin would find this book useful as it covers a common authentication scheme that can be used with a wide variety of applications on Unix. You will master PAM topics and take control over authentication for your organization IT infrastructure. If you are Linux or Unix sysadmin, I would highly recommend this book. Once again Michael W Lucas nailed it. The only book you may need for PAM deployment.
get “PAM Mastery”  (https://www.michaelwlucas.com/tools/pam)
***
Reflections on Trusting Trust - Ken Thompson, co-author of UNIX (http://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html)
Ken Thompson's "cc hack" - Presented in the journal, Communication of the ACM, Vol. 27, No. 8, August 1984, in a paper entitled "Reflections on Trusting Trust", Ken Thompson, co-author of UNIX, recounted a story of how he created a version of the C compiler that, when presented with the source code for the "login" program, would automatically compile in a backdoor to allow him entry to the system. This is only half the story, though. In order to hide this trojan horse, Ken also added to this version of "cc" the ability to recognize if it was recompiling itself to make sure that the newly compiled C compiler contained both the "login" backdoor, and the code to insert both trojans into a newly compiled C compiler. In this way, the source code for the C compiler would never show that these trojans existed.
The article starts off by talking about a content to write a program that produces its own source code as output. Or rather, a C program, that writes a C program, that produces its own source code as output.
The C compiler is written in C. What I am about to describe is one of many "chicken and egg" problems that arise when compilers are written in their own language. In this case, I will use a specific example from the C compiler.
Suppose we wish to alter the C compiler to include the sequence "\v" to represent the vertical tab character. The extension to Figure 2 is obvious and is presented in Figure 3. We then recompile the C compiler, but we get a diagnostic. Obviously, since the binary version of the compiler does not know about "\v," the source is not legal C. We must "train" the compiler. After it "knows" what "\v" means, then our new change will become legal C. We look up on an ASCII chart that a vertical tab is decimal 11. We alter our source to look like Figure 4. Now the old compiler accepts the new source. We install the resulting binary as the new official C compiler and now we can write the portable version the way we had it in Figure 3.
The actual bug I planted in the compiler would match code in the UNIX "login" command. The replacement code would miscompile the login command so that it would accept either the intended encrypted password or a particular known password. Thus if this code were installed in binary and the binary were used to compile the login command, I could log into that system as any user. Such blatant code would not go undetected for long. Even the most casual perusal of the source of the C compiler would raise suspicions.
Next “simply add a second Trojan horse to the one that already exists. The second pattern is aimed at the C compiler. The replacement code is a Stage I self-reproducing program that inserts both Trojan horses into the compiler. This requires a learning phase as in the Stage II example. First we compile the modified source with the normal C compiler to produce a bugged binary. We install this binary as the official C. We can now remove the bugs from the source of the compiler and the new binary will reinsert the bugs whenever it is compiled. Of course, the login command will remain bugged with no trace in source anywhere.
So now there is a trojan’d version of cc. If you compile a clean version of cc, using the bad cc, you will get a bad cc. If you use the bad cc to compile the login program, it will have a backdoor. The source code for both backdoors no longer exists on the system. You can audit the source code of cc and login all you want, they are trustworthy.
The compiler you use to compile your new compiler, is the untrustworthy bit, but you have no way to know it is untrustworthy, and no way to make a new compiler, without using the bad compiler.
The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect.
Acknowledgment: I first read of the possibility of such a Trojan horse in an Air Force critique of the security of an early implementation of Multics. I can- not find a more specific reference to this document. I would appreciate it if anyone who can supply this reference would let me know.
Beastie Bits
Custom made Beastie Stockings (https://www.etsy.com/listing/496638945/freebsd-beastie-christmas-stocking)
Migrating ZFS from mirrored pool to raidz1 pool (http://ximalas.info/2016/12/06/migrating-zfs-from-mirrored-pool-to-raidz1-pool/)
OpenBSD and you (https://home.nuug.no/~peter/blug2016/) 
Watson.org FreeBSD and Linux cross reference  (http://fxr.watson.org/) 
OpenGrok (http://bxr.su/) 
FreeBSD SA-16:37: libc (https://www.freebsd.org/security/advisories/FreeBSD-SA-16:37.libc.asc) -- A 26+ year old bug found in BSD’s libc, all BSDs likely affected -- A specially crafted argument can trigger a static buffer overflow in the library, with possibility to rewrite following static buffers that belong to other library functions.
HardenedBSD issues correction for libc patch  (https://github.com/HardenedBSD/hardenedBSD/commit/fb823297fbced336b6beeeb624e2dc65b67aa0eb) -- original patch improperly calculates how many bytes are remaining in the buffer.
From December the 27th until the 30th there the 33rd Chaos Communication Congress[0] is going to take place in Hamburg, Germany. Think of it as the yearly gathering of the european hackerscene and their overseas friends. I am one of the persons organizing the "BSD assembly (https://events.ccc.de/congress/2016/wiki/Assembly:BSD)" as a gathering place for BSD enthusiasts and waving the flag amidst the all the other projects / communities.
Feedback/Questions
 Chris - IPFW + Wifi (http://pastebin.com/WRiuW6nn) 
 Jason - bhyve pci (http://pastebin.com/JgerqZZP) 
 Al - pf errors (http://pastebin.com/3XY5MVca) 
 Zach - Xorg settings (http://pastebin.com/Kty0qYXM) 
 Bart - Wireless Support (http://pastebin.com/m3D81GBW) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Today on the show, we’ve got a look at running OpenBSD on a APU, some BSD in your Android, managing your own FreeBSD cloud service with ansible and much more. Keep it turned on your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://github.com/elad/openbsd-apu2" rel="nofollow">OpenBSD on PC Engines APU2</a></h3>

<ul>
<li>A detailed walkthrough of building an OpenBSD firewall on a PC Engines APU2</li>
<li>It starts with a breakdown of the parts that were purchases, totally around $200</li>
<li>Then the reader is walked through configuring the serial console, flashing the ROM, and updating the BIOS</li>
<li>The next step is actually creating a custom OpenBSD install image, and pre-configuring its serial console. Starting with OpenBSD 6.0, this step is done automatically by the installer</li>
<li>Installation:

<ul>
<li>Power off the APU2</li>
<li>Insert the bootable OpenBSD installer USB flash drive to one of the USB slots on the APU2</li>
<li>Power on the APU2, press F10 to get to the boot menu, and choose to boot from USB (usually option number 1)</li>
<li>At the boot&gt; prompt, remember the serial console settings (see above)</li>
<li>Also at the boot&gt; prompt, press Enter to start the installer</li>
<li>Follow the installation instructions</li>
</ul></li>
</ul>

<blockquote>
<p>The driver used for wireless networking is athn(4). It might not work properly out of the box. Once OpenBSD is installed, run fw_update with no arguments. It will figure out which firmware updates are required and will download and install them. When it finishes, reboot.</p>

<hr>
</blockquote>

<h3><a href="https://functionallyparanoid.com/2016/11/29/where-the-rubber-meets-the-road-part-one/" rel="nofollow">Where the rubber meets the road… (part one)</a></h3>

<ul>
<li>A user describes their adventures installing OpenBSD and Arch Linux on a new Lenovo X1 Carbon (4th gen, skylake)</li>
<li>They also detail why they moved away from their beloved Macbook, which while long, does describe a journey away from Apple that we’ve heard elsewhere.</li>
<li>The journey begins with getting a new Windows laptop, shrinking the partition and creating space for a triple-boot install, of Windows / Arch / OpenBSD</li>
<li>Brian then details how he setup the partitioning and performed the initial Arch installation, getting it tuned to his specifications.</li>
<li>Next up was OpenBSD though, and that went sideways initially due to a new NVMe drive that wasn’t fully supported (yet)</li>
<li>The article is split into two parts (we will bring you the next installment at a future date), but he leaves us with the plan of attack to build a custom OpenBSD kernel with corrected PCI device identifiers.</li>
<li>We wish Brian luck, and look forward to the “rest of the story” soon.
***</li>
</ul>

<h3><a href="https://github.com/JoergFiedler/freebsd-ansible-demo" rel="nofollow">Howto setup a FreeBSD jail server using iocage and ansible.</a></h3>

<ul>
<li>Setting up a FreeBSD jail server can be a daunting task. However when a guide comes along which shows you how to do that, including not exposing a single (non-jailed) port to the outside world, you know we had a take a closer look.</li>
<li>This guide comes to us from GitHub, courtesy of Joerg Fielder. </li>
<li><p>The project goals seem notable:</p></li>
<li><p>Ansible playbook that creates a FreeBSD server which hosts multiple jails.</p>

<ul>
<li>Travis is used to run/test the playbook.</li>
<li>No service on the host is exposed externally.</li>
<li>All external connections terminate within a jail.</li>
<li>Roles can be reused using Ansible Galaxy.</li>
<li>Combine any of those roles to create FreeBSD server, which perfectly suits you.</li>
</ul></li>
<li><p>To get started, you’ll need a machine with Ansible, Vagrant and VirtualBox, and your credentials to AWS if you want it to automatically create / destroy EC2 instances.</p></li>
<li><p>There’s already an impressive list of Anisible roles created for you to start with:</p>

<ul>
<li>freebsd-build-server - Creates a FreeBSD poudriere build server</li>
<li>freebsd-jail-host - FreeBSD Jail host</li>
<li>freebsd-jailed - Provides a jail</li>
<li>freebsd-jailed-nginx - Provides a jailed nginx server</li>
<li>freebsd-jailed-php-fpm - Creates a php-fpm pool and a ZFS dataset which is used as web root by php-fpm</li>
<li>freebsd-jailed-sftp - Installs a SFTP server</li>
<li>freebsd-jailed-sshd - Provides a jailed sshd server.</li>
<li>freebsd-jailed-syslogd - Provides a jailed syslogd</li>
<li>freebsd-jailed-btsync - Provides a jailed btsync instance server</li>
<li>freebsd-jailed-joomla - Installs Joomla</li>
<li>freebsd-jailed-mariadb - Provides a jailed MariaDB server</li>
<li>freebsd-jailed-wordpress - Provides a jailed Wordpress server.</li>
</ul></li>
<li><p>Since the machines have to be customized before starting, he mentions that cloud-init is used to do the following:</p></li>
<li><p>activate pf firewall</p></li>
<li><p>add a pass all keep state rule to pf to keep track of connection states, which in turn allows you to reload the pf service without losing the connection</p></li>
<li><p>install the following packages:</p>

<ul>
<li>sudo</li>
<li>bash</li>
<li>python27</li>
</ul></li>
<li><p>allow passwordless sudo for user ec2-user<br>
“</p></li>
<li><p>From there it is pretty straight-forward, just a couple commands to spin up the VM’s either locally on your VirtualBox host, or in the cloud with AWS. Internally the VM’s are auto-configured with iocage to create jails, where all your actual services run.</p></li>
<li><p>A neat project, check it out today if you want a shake-n-bake type cloud + jail solution.</p>

<hr></li>
</ul>

<h3><a href="http://android-developers.blogspot.ca/2016/12/saving-data-reducing-the-size-of-app-updates-by-65-percent.html" rel="nofollow">Colin Percival&#39;s bsdiff helps reduce Android apk bandwidth usage by 6 petabytes per day</a></h3>

<ul>
<li>A post on the official Android-Developers blog, talks about how they used bsdiff (and bspatch) to reduce the size of Android application updates by 65%</li>
<li>bsdiff was developed by FreeBSD’s Colin Percival</li>
</ul>

<blockquote>
<p>Earlier this year, we announced that we started using the bsdiff algorithm (by Colin Percival). Using bsdiff, we were able to reduce the size of app updates on average by 47% compared to the full APK size.</p>
</blockquote>

<ul>
<li>This post is actually about the second generation of the code.</li>
</ul>

<blockquote>
<p>Today, we&#39;re excited to share a new approach that goes further — File-by-File patching. App Updates using File-by-File patching are, on average, 65% smaller than the full app, and in some cases more than 90% smaller.<br>
Android apps are packaged as APKs, which are ZIP files with special conventions. Most of the content within the ZIP files (and APKs) is compressed using a technology called Deflate. Deflate is really good at compressing data but it has a drawback: it makes identifying changes in the original (uncompressed) content really hard. Even a tiny change to the original content (like changing one word in a book) can make the compressed output of deflate look completely different. Describing the differences between the original content is easy, but describing the differences between the compressed content is so hard that it leads to inefficient patches.</p>
</blockquote>

<ul>
<li>So in the second generation of the code, they use bsdiff on each individual file, then package that, rather than diffing the original and new archives</li>
<li>bsdiff is used in a great many other places, including shrinking the updates for the Firefox and Chrome browsers</li>
<li>You can find out more about bsdiff here: <a href="http://www.daemonology.net/bsdiff/" rel="nofollow">http://www.daemonology.net/bsdiff/</a></li>
</ul>

<blockquote>
<p>A far more sophisticated algorithm, which typically provides roughly 20% smaller patches, is described in my <a href="http://www.daemonology.net/papers/thesis.pdf" rel="nofollow">doctoral thesis</a>.</p>
</blockquote>

<ul>
<li>Considering the gains, it is interesting that no one has implemented Colin’s more sophisticated algorithm</li>
<li>Colin had an <a href="https://twitter.com/cperciva/status/806426180379230208" rel="nofollow">interesting observation</a> last night: “I just realized that bandwidth savings due to bsdiff are now roughly equal to what the <em>total internet traffic</em> was when I wrote it in 2003.”
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20161114#nas4free" rel="nofollow">Distrowatch does an in-depth review of NAS4Free</a></h3>

<ul>
<li>Jesse Smith over at DistroWatch has done a pretty in-depth review of Nas4Free.</li>
<li>The review starts with mentioning that NAS4Free works on 3 platforms, ARM/i386/AMD64 and for the purposes of this review he would be using AMD64 builds.</li>
<li>After going through the initial install (doing typical disk management operations, such as GPT/MBR, etc) he was ready to begin using the product.</li>
<li>One concern originally observed was that the initial boot seemed rather slow. Investigation revealed this was due to it loading the entire OS image into memory, and the first (long) disk read did take some time, but once loaded was super responsive.</li>
<li>The next steps involved doing the initial configuration, which meant creating a new ZFS storage pool. After this process was done, he did find one puzzling UI option called “VM” which indicated it can be linked to VirtualBox in some way, but the Docs didn’t reveal its secrets of usage.</li>
<li>Additionally covered were some of the various “Access” methods, including traditional UNIX permissions, AD and LDAP, and then various Sharing services which are typical to a NAS, Such as NFS / Samba and others.</li>
<li>One neat feature was the built-in file-browser via the web-interface, which allows you another method of getting at your data when sometimes NFS / Samba or WebDav aren’t enough.</li>
<li>Jesse gives us a nice round-up conclusion as well</li>
</ul>

<blockquote>
<p>Most of the NAS operating systems I have used in the past were built around useful features. Some focused on making storage easy to set up and manage, others focused on services, such as making files available over multiple protocols or managing torrents. Some strive to be very easy to set up. NAS4Free does pretty well in each of the above categories. It may not be the easiest platform to set up, but it&#39;s probably a close second. It may not have the prettiest interface for managing settings, but it is quite easy to navigate. NAS4Free may not have the most add-on services and access protocols, but I suspect there are more than enough of both for most people.</p>

<p>Where NAS4Free does better than most other solutions I have looked at is security. I don&#39;t think the project&#39;s website or documentation particularly focuses on security as a feature, but there are plenty of little security features that I liked. NAS4Free makes it very easy to lock the text console, which is good because we do not all keep our NAS boxes behind locked doors. The system is fairly easy to upgrade and appears to publish regular security updates in the form of new firmware. NAS4Free makes it fairly easy to set up user accounts, handle permissions and manage home directories. It&#39;s also pretty straight forward to switch from HTTP to HTTPS and to block people not on the local network from accessing the NAS&#39;s web interface.</p>

<p>All in all, I like NAS4Free. It&#39;s a good, general purpose NAS operating system. While I did not feel the project did anything really amazing in any one category, nor did I run into any serious issues. The NAS ran as expected, was fairly straight forward to set up and easy to manage. This strikes me as an especially good platform for home or small business users who want an easy set up, some basic security and a solid collection of features.</p>

<hr>
</blockquote>

<h3><a href="https://browsix.org/" rel="nofollow">Browsix: Unix in the browser tab</a></h3>

<ul>
<li>Browsix is a research project from the PLASMA lab at the University of Massachusetts, Amherst.</li>
<li>The goal: Run C, C++, Go and Node.js programs as processes in browsers, including LaTeX, GNU Make, Go HTTP servers, and POSIX shell scripts.</li>
<li>“Processes are built on top of Web Workers, letting applications run in parallel and spawn subprocesses. System calls include fork, spawn, exec, and wait.”</li>
</ul>

<blockquote>
<p>Pipes are supported with pipe(2) enabling developers to compose processes into pipelines.</p>

<p>Sockets include support for TCP socket servers and clients, making it possible to run applications like databases and HTTP servers together with their clients in the browser.</p>
</blockquote>

<ul>
<li> Browsix comprises two core parts:

<ul>
<li>A kernel written in TypeScript that makes core Unix features (including pipes, concurrent processes, signals, sockets, and a shared file system) available to web applications.</li>
<li>Extended JavaScript runtimes for C, C++, Go, and Node.js that support running programs written in these languages as processes in the browser.</li>
</ul></li>
<li>This seems like an interesting project, although I am not sure how it would be used as more than a toy
***</li>
</ul>

<h3><a href="https://www.cyberciti.biz/reviews/book-review-pam-mastery/" rel="nofollow">Book Review: PAM Mastery</a></h3>

<ul>
<li>nixCraft does a book review of Michael W. Lucas’ “Pam Mastery”</li>
</ul>

<blockquote>
<p>Linux, FreeBSD, and Unix-like systems are multi-user and need some way of authenticating individual users. Back in the old days, this was done in different ways. You need to change each Unix application to use different authentication scheme.</p>
</blockquote>

<ul>
<li>Before PAM, if you wanted to use an SQL database to authenticate users, you had to write specific support for that into each of your applications. Same for LDAP, etc.</li>
</ul>

<blockquote>
<p>So Open Group lead to the development of PAM for the Unix-like system. Today Linux, FreeBSD, MacOS X and many other Unix-like systems are configured to use a centralized authentication mechanism called Pluggable Authentication Modules (PAM). The book “PAM Mastery” deals with the black magic of PAM.</p>
</blockquote>

<ul>
<li>Of course, each OS chose to implement PAM a little bit differently</li>
</ul>

<blockquote>
<p>The book starts with the basic concepts about PAM and authentication. You learn about Multi-Factor Authentication and why use PAM instead of changing each program to authenticate the user. The author went into great details about why PAM is useful for developers and sysadmin for several reasons. The examples cover CentOS Linux (RHEL and clones), Debian Linux, and FreeBSD Unix system.</p>

<p>I like the way the author described PAM Configuration Files and Common Modules that covers everyday scenarios for the sysadmin. PAM configuration file format and PAM Module Interfaces are discussed in easy to understand language. Control flags in PAM can be very confusing for new sysadmins. Modules can be stacked in a particular order, and the control flags determine how important the success or failure of a particular module.</p>

<p>There is also a chapter about using one-time passwords (Google Authenticator) for your application.</p>

<p>The final chapter is all about enforcing good password policies for users and apps using PAM.</p>

<p>The sysadmin would find this book useful as it covers a common authentication scheme that can be used with a wide variety of applications on Unix. You will master PAM topics and take control over authentication for your organization IT infrastructure. If you are Linux or Unix sysadmin, I would highly recommend this book. Once again Michael W Lucas nailed it. The only book you may need for PAM deployment.</p>
</blockquote>

<ul>
<li><a href="https://www.michaelwlucas.com/tools/pam" rel="nofollow">get “PAM Mastery” </a>
***</li>
</ul>

<h3><a href="http://www.win.tue.nl/%7Eaeb/linux/hh/thompson/trust.html" rel="nofollow">Reflections on Trusting Trust - Ken Thompson, co-author of UNIX</a></h3>

<blockquote>
<p>Ken Thompson&#39;s &quot;cc hack&quot; - Presented in the journal, Communication of the ACM, Vol. 27, No. 8, August 1984, in a paper entitled &quot;Reflections on Trusting Trust&quot;, Ken Thompson, co-author of UNIX, recounted a story of how he created a version of the C compiler that, when presented with the source code for the &quot;login&quot; program, would automatically compile in a backdoor to allow him entry to the system. This is only half the story, though. In order to hide this trojan horse, Ken also added to this version of &quot;cc&quot; the ability to recognize if it was recompiling itself to make sure that the newly compiled C compiler contained both the &quot;login&quot; backdoor, and the code to insert both trojans into a newly compiled C compiler. In this way, the source code for the C compiler would never show that these trojans existed.</p>
</blockquote>

<ul>
<li>The article starts off by talking about a content to write a program that produces its own source code as output. Or rather, a C program, that writes a C program, that produces its own source code as output.</li>
</ul>

<blockquote>
<p>The C compiler is written in C. What I am about to describe is one of many &quot;chicken and egg&quot; problems that arise when compilers are written in their own language. In this case, I will use a specific example from the C compiler.</p>

<p>Suppose we wish to alter the C compiler to include the sequence &quot;\v&quot; to represent the vertical tab character. The extension to Figure 2 is obvious and is presented in Figure 3. We then recompile the C compiler, but we get a diagnostic. Obviously, since the binary version of the compiler does not know about &quot;\v,&quot; the source is not legal C. We must &quot;train&quot; the compiler. After it &quot;knows&quot; what &quot;\v&quot; means, then our new change will become legal C. We look up on an ASCII chart that a vertical tab is decimal 11. We alter our source to look like Figure 4. Now the old compiler accepts the new source. We install the resulting binary as the new official C compiler and now we can write the portable version the way we had it in Figure 3.</p>

<p>The actual bug I planted in the compiler would match code in the UNIX &quot;login&quot; command. The replacement code would miscompile the login command so that it would accept either the intended encrypted password or a particular known password. Thus if this code were installed in binary and the binary were used to compile the login command, I could log into that system as any user. Such blatant code would not go undetected for long. Even the most casual perusal of the source of the C compiler would raise suspicions.</p>

<p>Next “simply add a second Trojan horse to the one that already exists. The second pattern is aimed at the C compiler. The replacement code is a Stage I self-reproducing program that inserts both Trojan horses into the compiler. This requires a learning phase as in the Stage II example. First we compile the modified source with the normal C compiler to produce a bugged binary. We install this binary as the official C. We can now remove the bugs from the source of the compiler and the new binary will reinsert the bugs whenever it is compiled. Of course, the login command will remain bugged with no trace in source anywhere.</p>

<p>So now there is a trojan’d version of cc. If you compile a clean version of cc, using the bad cc, you will get a bad cc. If you use the bad cc to compile the login program, it will have a backdoor. The source code for both backdoors no longer exists on the system. You can audit the source code of cc and login all you want, they are trustworthy.</p>

<p>The compiler you use to compile your new compiler, is the untrustworthy bit, but you have no way to know it is untrustworthy, and no way to make a new compiler, without using the bad compiler.</p>

<p>The moral is obvious. You can&#39;t trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect.</p>

<p>Acknowledgment: I first read of the possibility of such a Trojan horse in an Air Force critique of the security of an early implementation of Multics. I can- not find a more specific reference to this document. I would appreciate it if anyone who can supply this reference would let me know.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.etsy.com/listing/496638945/freebsd-beastie-christmas-stocking" rel="nofollow">Custom made Beastie Stockings</a></p></li>
<li><p><a href="http://ximalas.info/2016/12/06/migrating-zfs-from-mirrored-pool-to-raidz1-pool/" rel="nofollow">Migrating ZFS from mirrored pool to raidz1 pool</a></p></li>
<li><p><a href="https://home.nuug.no/%7Epeter/blug2016/" rel="nofollow">OpenBSD and you</a> </p></li>
<li><p><a href="http://fxr.watson.org/" rel="nofollow">Watson.org FreeBSD and Linux cross reference </a> </p></li>
<li><p><a href="http://bxr.su/" rel="nofollow">OpenGrok</a> </p></li>
<li><p><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-16:37.libc.asc" rel="nofollow">FreeBSD SA-16:37: libc</a> -- A 26+ year old bug found in BSD’s libc, all BSDs likely affected -- A specially crafted argument can trigger a static buffer overflow in the library, with possibility to rewrite following static buffers that belong to other library functions.</p></li>
<li><p><a href="https://github.com/HardenedBSD/hardenedBSD/commit/fb823297fbced336b6beeeb624e2dc65b67aa0eb" rel="nofollow">HardenedBSD issues correction for libc patch </a> -- original patch improperly calculates how many bytes are remaining in the buffer.</p></li>
</ul>

<blockquote>
<p>From December the 27th until the 30th there the 33rd Chaos Communication Congress[0] is going to take place in Hamburg, Germany. Think of it as the yearly gathering of the european hackerscene and their overseas friends. I am one of the persons organizing the &quot;<a href="https://events.ccc.de/congress/2016/wiki/Assembly:BSD" rel="nofollow">BSD assembly</a>&quot; as a gathering place for BSD enthusiasts and waving the flag amidst the all the other projects / communities.</p>

<hr>
</blockquote>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/WRiuW6nn" rel="nofollow"> Chris - IPFW + Wifi</a> </li>
<li><a href="http://pastebin.com/JgerqZZP" rel="nofollow"> Jason - bhyve pci</a> </li>
<li><a href="http://pastebin.com/3XY5MVca" rel="nofollow"> Al - pf errors</a> </li>
<li><a href="http://pastebin.com/Kty0qYXM" rel="nofollow"> Zach - Xorg settings</a> </li>
<li><a href="http://pastebin.com/m3D81GBW" rel="nofollow"> Bart - Wireless Support</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Today on the show, we’ve got a look at running OpenBSD on a APU, some BSD in your Android, managing your own FreeBSD cloud service with ansible and much more. Keep it turned on your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://github.com/elad/openbsd-apu2" rel="nofollow">OpenBSD on PC Engines APU2</a></h3>

<ul>
<li>A detailed walkthrough of building an OpenBSD firewall on a PC Engines APU2</li>
<li>It starts with a breakdown of the parts that were purchases, totally around $200</li>
<li>Then the reader is walked through configuring the serial console, flashing the ROM, and updating the BIOS</li>
<li>The next step is actually creating a custom OpenBSD install image, and pre-configuring its serial console. Starting with OpenBSD 6.0, this step is done automatically by the installer</li>
<li>Installation:

<ul>
<li>Power off the APU2</li>
<li>Insert the bootable OpenBSD installer USB flash drive to one of the USB slots on the APU2</li>
<li>Power on the APU2, press F10 to get to the boot menu, and choose to boot from USB (usually option number 1)</li>
<li>At the boot&gt; prompt, remember the serial console settings (see above)</li>
<li>Also at the boot&gt; prompt, press Enter to start the installer</li>
<li>Follow the installation instructions</li>
</ul></li>
</ul>

<blockquote>
<p>The driver used for wireless networking is athn(4). It might not work properly out of the box. Once OpenBSD is installed, run fw_update with no arguments. It will figure out which firmware updates are required and will download and install them. When it finishes, reboot.</p>

<hr>
</blockquote>

<h3><a href="https://functionallyparanoid.com/2016/11/29/where-the-rubber-meets-the-road-part-one/" rel="nofollow">Where the rubber meets the road… (part one)</a></h3>

<ul>
<li>A user describes their adventures installing OpenBSD and Arch Linux on a new Lenovo X1 Carbon (4th gen, skylake)</li>
<li>They also detail why they moved away from their beloved Macbook, which while long, does describe a journey away from Apple that we’ve heard elsewhere.</li>
<li>The journey begins with getting a new Windows laptop, shrinking the partition and creating space for a triple-boot install, of Windows / Arch / OpenBSD</li>
<li>Brian then details how he setup the partitioning and performed the initial Arch installation, getting it tuned to his specifications.</li>
<li>Next up was OpenBSD though, and that went sideways initially due to a new NVMe drive that wasn’t fully supported (yet)</li>
<li>The article is split into two parts (we will bring you the next installment at a future date), but he leaves us with the plan of attack to build a custom OpenBSD kernel with corrected PCI device identifiers.</li>
<li>We wish Brian luck, and look forward to the “rest of the story” soon.
***</li>
</ul>

<h3><a href="https://github.com/JoergFiedler/freebsd-ansible-demo" rel="nofollow">Howto setup a FreeBSD jail server using iocage and ansible.</a></h3>

<ul>
<li>Setting up a FreeBSD jail server can be a daunting task. However when a guide comes along which shows you how to do that, including not exposing a single (non-jailed) port to the outside world, you know we had a take a closer look.</li>
<li>This guide comes to us from GitHub, courtesy of Joerg Fielder. </li>
<li><p>The project goals seem notable:</p></li>
<li><p>Ansible playbook that creates a FreeBSD server which hosts multiple jails.</p>

<ul>
<li>Travis is used to run/test the playbook.</li>
<li>No service on the host is exposed externally.</li>
<li>All external connections terminate within a jail.</li>
<li>Roles can be reused using Ansible Galaxy.</li>
<li>Combine any of those roles to create FreeBSD server, which perfectly suits you.</li>
</ul></li>
<li><p>To get started, you’ll need a machine with Ansible, Vagrant and VirtualBox, and your credentials to AWS if you want it to automatically create / destroy EC2 instances.</p></li>
<li><p>There’s already an impressive list of Anisible roles created for you to start with:</p>

<ul>
<li>freebsd-build-server - Creates a FreeBSD poudriere build server</li>
<li>freebsd-jail-host - FreeBSD Jail host</li>
<li>freebsd-jailed - Provides a jail</li>
<li>freebsd-jailed-nginx - Provides a jailed nginx server</li>
<li>freebsd-jailed-php-fpm - Creates a php-fpm pool and a ZFS dataset which is used as web root by php-fpm</li>
<li>freebsd-jailed-sftp - Installs a SFTP server</li>
<li>freebsd-jailed-sshd - Provides a jailed sshd server.</li>
<li>freebsd-jailed-syslogd - Provides a jailed syslogd</li>
<li>freebsd-jailed-btsync - Provides a jailed btsync instance server</li>
<li>freebsd-jailed-joomla - Installs Joomla</li>
<li>freebsd-jailed-mariadb - Provides a jailed MariaDB server</li>
<li>freebsd-jailed-wordpress - Provides a jailed Wordpress server.</li>
</ul></li>
<li><p>Since the machines have to be customized before starting, he mentions that cloud-init is used to do the following:</p></li>
<li><p>activate pf firewall</p></li>
<li><p>add a pass all keep state rule to pf to keep track of connection states, which in turn allows you to reload the pf service without losing the connection</p></li>
<li><p>install the following packages:</p>

<ul>
<li>sudo</li>
<li>bash</li>
<li>python27</li>
</ul></li>
<li><p>allow passwordless sudo for user ec2-user<br>
“</p></li>
<li><p>From there it is pretty straight-forward, just a couple commands to spin up the VM’s either locally on your VirtualBox host, or in the cloud with AWS. Internally the VM’s are auto-configured with iocage to create jails, where all your actual services run.</p></li>
<li><p>A neat project, check it out today if you want a shake-n-bake type cloud + jail solution.</p>

<hr></li>
</ul>

<h3><a href="http://android-developers.blogspot.ca/2016/12/saving-data-reducing-the-size-of-app-updates-by-65-percent.html" rel="nofollow">Colin Percival&#39;s bsdiff helps reduce Android apk bandwidth usage by 6 petabytes per day</a></h3>

<ul>
<li>A post on the official Android-Developers blog, talks about how they used bsdiff (and bspatch) to reduce the size of Android application updates by 65%</li>
<li>bsdiff was developed by FreeBSD’s Colin Percival</li>
</ul>

<blockquote>
<p>Earlier this year, we announced that we started using the bsdiff algorithm (by Colin Percival). Using bsdiff, we were able to reduce the size of app updates on average by 47% compared to the full APK size.</p>
</blockquote>

<ul>
<li>This post is actually about the second generation of the code.</li>
</ul>

<blockquote>
<p>Today, we&#39;re excited to share a new approach that goes further — File-by-File patching. App Updates using File-by-File patching are, on average, 65% smaller than the full app, and in some cases more than 90% smaller.<br>
Android apps are packaged as APKs, which are ZIP files with special conventions. Most of the content within the ZIP files (and APKs) is compressed using a technology called Deflate. Deflate is really good at compressing data but it has a drawback: it makes identifying changes in the original (uncompressed) content really hard. Even a tiny change to the original content (like changing one word in a book) can make the compressed output of deflate look completely different. Describing the differences between the original content is easy, but describing the differences between the compressed content is so hard that it leads to inefficient patches.</p>
</blockquote>

<ul>
<li>So in the second generation of the code, they use bsdiff on each individual file, then package that, rather than diffing the original and new archives</li>
<li>bsdiff is used in a great many other places, including shrinking the updates for the Firefox and Chrome browsers</li>
<li>You can find out more about bsdiff here: <a href="http://www.daemonology.net/bsdiff/" rel="nofollow">http://www.daemonology.net/bsdiff/</a></li>
</ul>

<blockquote>
<p>A far more sophisticated algorithm, which typically provides roughly 20% smaller patches, is described in my <a href="http://www.daemonology.net/papers/thesis.pdf" rel="nofollow">doctoral thesis</a>.</p>
</blockquote>

<ul>
<li>Considering the gains, it is interesting that no one has implemented Colin’s more sophisticated algorithm</li>
<li>Colin had an <a href="https://twitter.com/cperciva/status/806426180379230208" rel="nofollow">interesting observation</a> last night: “I just realized that bandwidth savings due to bsdiff are now roughly equal to what the <em>total internet traffic</em> was when I wrote it in 2003.”
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://distrowatch.com/weekly.php?issue=20161114#nas4free" rel="nofollow">Distrowatch does an in-depth review of NAS4Free</a></h3>

<ul>
<li>Jesse Smith over at DistroWatch has done a pretty in-depth review of Nas4Free.</li>
<li>The review starts with mentioning that NAS4Free works on 3 platforms, ARM/i386/AMD64 and for the purposes of this review he would be using AMD64 builds.</li>
<li>After going through the initial install (doing typical disk management operations, such as GPT/MBR, etc) he was ready to begin using the product.</li>
<li>One concern originally observed was that the initial boot seemed rather slow. Investigation revealed this was due to it loading the entire OS image into memory, and the first (long) disk read did take some time, but once loaded was super responsive.</li>
<li>The next steps involved doing the initial configuration, which meant creating a new ZFS storage pool. After this process was done, he did find one puzzling UI option called “VM” which indicated it can be linked to VirtualBox in some way, but the Docs didn’t reveal its secrets of usage.</li>
<li>Additionally covered were some of the various “Access” methods, including traditional UNIX permissions, AD and LDAP, and then various Sharing services which are typical to a NAS, Such as NFS / Samba and others.</li>
<li>One neat feature was the built-in file-browser via the web-interface, which allows you another method of getting at your data when sometimes NFS / Samba or WebDav aren’t enough.</li>
<li>Jesse gives us a nice round-up conclusion as well</li>
</ul>

<blockquote>
<p>Most of the NAS operating systems I have used in the past were built around useful features. Some focused on making storage easy to set up and manage, others focused on services, such as making files available over multiple protocols or managing torrents. Some strive to be very easy to set up. NAS4Free does pretty well in each of the above categories. It may not be the easiest platform to set up, but it&#39;s probably a close second. It may not have the prettiest interface for managing settings, but it is quite easy to navigate. NAS4Free may not have the most add-on services and access protocols, but I suspect there are more than enough of both for most people.</p>

<p>Where NAS4Free does better than most other solutions I have looked at is security. I don&#39;t think the project&#39;s website or documentation particularly focuses on security as a feature, but there are plenty of little security features that I liked. NAS4Free makes it very easy to lock the text console, which is good because we do not all keep our NAS boxes behind locked doors. The system is fairly easy to upgrade and appears to publish regular security updates in the form of new firmware. NAS4Free makes it fairly easy to set up user accounts, handle permissions and manage home directories. It&#39;s also pretty straight forward to switch from HTTP to HTTPS and to block people not on the local network from accessing the NAS&#39;s web interface.</p>

<p>All in all, I like NAS4Free. It&#39;s a good, general purpose NAS operating system. While I did not feel the project did anything really amazing in any one category, nor did I run into any serious issues. The NAS ran as expected, was fairly straight forward to set up and easy to manage. This strikes me as an especially good platform for home or small business users who want an easy set up, some basic security and a solid collection of features.</p>

<hr>
</blockquote>

<h3><a href="https://browsix.org/" rel="nofollow">Browsix: Unix in the browser tab</a></h3>

<ul>
<li>Browsix is a research project from the PLASMA lab at the University of Massachusetts, Amherst.</li>
<li>The goal: Run C, C++, Go and Node.js programs as processes in browsers, including LaTeX, GNU Make, Go HTTP servers, and POSIX shell scripts.</li>
<li>“Processes are built on top of Web Workers, letting applications run in parallel and spawn subprocesses. System calls include fork, spawn, exec, and wait.”</li>
</ul>

<blockquote>
<p>Pipes are supported with pipe(2) enabling developers to compose processes into pipelines.</p>

<p>Sockets include support for TCP socket servers and clients, making it possible to run applications like databases and HTTP servers together with their clients in the browser.</p>
</blockquote>

<ul>
<li> Browsix comprises two core parts:

<ul>
<li>A kernel written in TypeScript that makes core Unix features (including pipes, concurrent processes, signals, sockets, and a shared file system) available to web applications.</li>
<li>Extended JavaScript runtimes for C, C++, Go, and Node.js that support running programs written in these languages as processes in the browser.</li>
</ul></li>
<li>This seems like an interesting project, although I am not sure how it would be used as more than a toy
***</li>
</ul>

<h3><a href="https://www.cyberciti.biz/reviews/book-review-pam-mastery/" rel="nofollow">Book Review: PAM Mastery</a></h3>

<ul>
<li>nixCraft does a book review of Michael W. Lucas’ “Pam Mastery”</li>
</ul>

<blockquote>
<p>Linux, FreeBSD, and Unix-like systems are multi-user and need some way of authenticating individual users. Back in the old days, this was done in different ways. You need to change each Unix application to use different authentication scheme.</p>
</blockquote>

<ul>
<li>Before PAM, if you wanted to use an SQL database to authenticate users, you had to write specific support for that into each of your applications. Same for LDAP, etc.</li>
</ul>

<blockquote>
<p>So Open Group lead to the development of PAM for the Unix-like system. Today Linux, FreeBSD, MacOS X and many other Unix-like systems are configured to use a centralized authentication mechanism called Pluggable Authentication Modules (PAM). The book “PAM Mastery” deals with the black magic of PAM.</p>
</blockquote>

<ul>
<li>Of course, each OS chose to implement PAM a little bit differently</li>
</ul>

<blockquote>
<p>The book starts with the basic concepts about PAM and authentication. You learn about Multi-Factor Authentication and why use PAM instead of changing each program to authenticate the user. The author went into great details about why PAM is useful for developers and sysadmin for several reasons. The examples cover CentOS Linux (RHEL and clones), Debian Linux, and FreeBSD Unix system.</p>

<p>I like the way the author described PAM Configuration Files and Common Modules that covers everyday scenarios for the sysadmin. PAM configuration file format and PAM Module Interfaces are discussed in easy to understand language. Control flags in PAM can be very confusing for new sysadmins. Modules can be stacked in a particular order, and the control flags determine how important the success or failure of a particular module.</p>

<p>There is also a chapter about using one-time passwords (Google Authenticator) for your application.</p>

<p>The final chapter is all about enforcing good password policies for users and apps using PAM.</p>

<p>The sysadmin would find this book useful as it covers a common authentication scheme that can be used with a wide variety of applications on Unix. You will master PAM topics and take control over authentication for your organization IT infrastructure. If you are Linux or Unix sysadmin, I would highly recommend this book. Once again Michael W Lucas nailed it. The only book you may need for PAM deployment.</p>
</blockquote>

<ul>
<li><a href="https://www.michaelwlucas.com/tools/pam" rel="nofollow">get “PAM Mastery” </a>
***</li>
</ul>

<h3><a href="http://www.win.tue.nl/%7Eaeb/linux/hh/thompson/trust.html" rel="nofollow">Reflections on Trusting Trust - Ken Thompson, co-author of UNIX</a></h3>

<blockquote>
<p>Ken Thompson&#39;s &quot;cc hack&quot; - Presented in the journal, Communication of the ACM, Vol. 27, No. 8, August 1984, in a paper entitled &quot;Reflections on Trusting Trust&quot;, Ken Thompson, co-author of UNIX, recounted a story of how he created a version of the C compiler that, when presented with the source code for the &quot;login&quot; program, would automatically compile in a backdoor to allow him entry to the system. This is only half the story, though. In order to hide this trojan horse, Ken also added to this version of &quot;cc&quot; the ability to recognize if it was recompiling itself to make sure that the newly compiled C compiler contained both the &quot;login&quot; backdoor, and the code to insert both trojans into a newly compiled C compiler. In this way, the source code for the C compiler would never show that these trojans existed.</p>
</blockquote>

<ul>
<li>The article starts off by talking about a content to write a program that produces its own source code as output. Or rather, a C program, that writes a C program, that produces its own source code as output.</li>
</ul>

<blockquote>
<p>The C compiler is written in C. What I am about to describe is one of many &quot;chicken and egg&quot; problems that arise when compilers are written in their own language. In this case, I will use a specific example from the C compiler.</p>

<p>Suppose we wish to alter the C compiler to include the sequence &quot;\v&quot; to represent the vertical tab character. The extension to Figure 2 is obvious and is presented in Figure 3. We then recompile the C compiler, but we get a diagnostic. Obviously, since the binary version of the compiler does not know about &quot;\v,&quot; the source is not legal C. We must &quot;train&quot; the compiler. After it &quot;knows&quot; what &quot;\v&quot; means, then our new change will become legal C. We look up on an ASCII chart that a vertical tab is decimal 11. We alter our source to look like Figure 4. Now the old compiler accepts the new source. We install the resulting binary as the new official C compiler and now we can write the portable version the way we had it in Figure 3.</p>

<p>The actual bug I planted in the compiler would match code in the UNIX &quot;login&quot; command. The replacement code would miscompile the login command so that it would accept either the intended encrypted password or a particular known password. Thus if this code were installed in binary and the binary were used to compile the login command, I could log into that system as any user. Such blatant code would not go undetected for long. Even the most casual perusal of the source of the C compiler would raise suspicions.</p>

<p>Next “simply add a second Trojan horse to the one that already exists. The second pattern is aimed at the C compiler. The replacement code is a Stage I self-reproducing program that inserts both Trojan horses into the compiler. This requires a learning phase as in the Stage II example. First we compile the modified source with the normal C compiler to produce a bugged binary. We install this binary as the official C. We can now remove the bugs from the source of the compiler and the new binary will reinsert the bugs whenever it is compiled. Of course, the login command will remain bugged with no trace in source anywhere.</p>

<p>So now there is a trojan’d version of cc. If you compile a clean version of cc, using the bad cc, you will get a bad cc. If you use the bad cc to compile the login program, it will have a backdoor. The source code for both backdoors no longer exists on the system. You can audit the source code of cc and login all you want, they are trustworthy.</p>

<p>The compiler you use to compile your new compiler, is the untrustworthy bit, but you have no way to know it is untrustworthy, and no way to make a new compiler, without using the bad compiler.</p>

<p>The moral is obvious. You can&#39;t trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect.</p>

<p>Acknowledgment: I first read of the possibility of such a Trojan horse in an Air Force critique of the security of an early implementation of Multics. I can- not find a more specific reference to this document. I would appreciate it if anyone who can supply this reference would let me know.</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.etsy.com/listing/496638945/freebsd-beastie-christmas-stocking" rel="nofollow">Custom made Beastie Stockings</a></p></li>
<li><p><a href="http://ximalas.info/2016/12/06/migrating-zfs-from-mirrored-pool-to-raidz1-pool/" rel="nofollow">Migrating ZFS from mirrored pool to raidz1 pool</a></p></li>
<li><p><a href="https://home.nuug.no/%7Epeter/blug2016/" rel="nofollow">OpenBSD and you</a> </p></li>
<li><p><a href="http://fxr.watson.org/" rel="nofollow">Watson.org FreeBSD and Linux cross reference </a> </p></li>
<li><p><a href="http://bxr.su/" rel="nofollow">OpenGrok</a> </p></li>
<li><p><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-16:37.libc.asc" rel="nofollow">FreeBSD SA-16:37: libc</a> -- A 26+ year old bug found in BSD’s libc, all BSDs likely affected -- A specially crafted argument can trigger a static buffer overflow in the library, with possibility to rewrite following static buffers that belong to other library functions.</p></li>
<li><p><a href="https://github.com/HardenedBSD/hardenedBSD/commit/fb823297fbced336b6beeeb624e2dc65b67aa0eb" rel="nofollow">HardenedBSD issues correction for libc patch </a> -- original patch improperly calculates how many bytes are remaining in the buffer.</p></li>
</ul>

<blockquote>
<p>From December the 27th until the 30th there the 33rd Chaos Communication Congress[0] is going to take place in Hamburg, Germany. Think of it as the yearly gathering of the european hackerscene and their overseas friends. I am one of the persons organizing the &quot;<a href="https://events.ccc.de/congress/2016/wiki/Assembly:BSD" rel="nofollow">BSD assembly</a>&quot; as a gathering place for BSD enthusiasts and waving the flag amidst the all the other projects / communities.</p>

<hr>
</blockquote>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/WRiuW6nn" rel="nofollow"> Chris - IPFW + Wifi</a> </li>
<li><a href="http://pastebin.com/JgerqZZP" rel="nofollow"> Jason - bhyve pci</a> </li>
<li><a href="http://pastebin.com/3XY5MVca" rel="nofollow"> Al - pf errors</a> </li>
<li><a href="http://pastebin.com/Kty0qYXM" rel="nofollow"> Zach - Xorg settings</a> </li>
<li><a href="http://pastebin.com/m3D81GBW" rel="nofollow"> Bart - Wireless Support</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>170: Sandboxing Cohabitation</title>
  <link>https://www.bsdnow.tv/170</link>
  <guid isPermaLink="false">1eecd778-12f6-4789-a729-294313b152c8</guid>
  <pubDate>Wed, 30 Nov 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1eecd778-12f6-4789-a729-294313b152c8.mp3" length="55016500" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we’ve got some new info on the talks from EuroBSDCon, a look at sharing a single ZFS pool between Linux and BSD, Sandboxing and much more! Stay tuned for your place to B...SD!</itunes:subtitle>
  <itunes:duration>1:16:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we’ve got some new info on the talks from EuroBSDCon, a look at sharing a single ZFS pool between Linux and BSD, Sandboxing and much more! Stay tuned for your place to B...SD!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
EuroBSDcon 2016 Presentation Slides (https://2016.eurobsdcon.org/PresentationSlides/)
Due to circumstances beyond the control of the organizers of EuroBSDCon, there were not recordings of the talks given at the event.
However, they have collected the slide decks from each of the speakers and assembled them on this page for you
Also, we have some stuff from MeetBSD already:
Youtube Playlist  (https://www.youtube.com/playlist?list=PLb87fdKUIo8TAMC2HJLZ7H54edD2BeGWv) 
Not all of the sessions are posted yet, but the rest should appear shortly
MeetBSD 2016 Trip Report: Domagoj Stolfa (https://www.freebsdfoundation.org/blog/meetbsd-2016-trip-report-domagoj-stolfa/) 
***
Cohabiting FreeBSD and Gentoo Linux on a Common ZFS Volume (https://ericmccorkleblog.wordpress.com/2016/11/15/cohabiting-freebsd-and-gentoo-linux-on-a-common-zfs-volume/)
Eric McCorkle, who has contributed ZFS support to the FreeBSD EFI boot-loader code has posted an in-depth look at how he’s setup dual-boot with FreeBSD and Gentoo on the same ZFS volume.
He starts by giving us some background on how the layout is done. First up, GRUB is used as the boot-loader, allowing boot of both Linux and BSD
The next non-typical thing was using /etc/fstab to manage mount-points, instead of the typical ‘zfs mount’ usage, (apart from /home datasets)
data/home is mounted to /home, with all of its child datasets using the ZFS mountpoint system
data/freebsd and its child datasets house the FreeBSD system, and all have their mountpoints set to legacy
data/gentoo and its child datasets house the Gentoo system, and have their mountpoints set to legacy as well
So, how did he set this up? He helpfully provides an overview of the steps:
Use the FreeBSD installer to create the GPT and ZFS pool
Install and configure FreeBSD, with the native FreeBSD boot loader
Boot into FreeBSD, create the Gentoo Linux datasets, install GRUB
Boot into the Gentoo Linux installer, install Gentoo
Boot into Gentoo, finish any configuration tasks
The rest of the article walks us through the individual commands that make up each of those steps, as well as how to craft a GRUB config file capable of booting both systems.
Personally, since we are using EFI, I would have installed rEFInd, and chain-loaded each systems EFI boot code from there, allowing the use of the BSD loader, but to each their own!
HardenedBSD introduces Safestack into base (https://hardenedbsd.org/article/shawn-webb/2016-11-27/introducing-safestack)
HardenedBSD has integrated SafeStack into its base system and ports tree
SafeStack (http://clang.llvm.org/docs/SafeStack.html) is part of the Code Pointer Integrity (CPI) project within clang.
“SafeStack is an instrumentation pass that protects programs against attacks based on stack buffer overflows, without introducing any measurable performance overhead. It works by separating the program stack into two distinct regions: the safe stack and the unsafe stack. The safe stack stores return addresses, register spills, and local variables that are always accessed in a safe way, while the unsafe stack stores everything else. This separation ensures that buffer overflows on the unsafe stack cannot be used to overwrite anything on the safe stack.”
“As of 28 November 2016, with clang 3.9.0, SafeStack only supports being applied to applications and not shared libraries. Multiple patches have been submitted to clang by third parties to add support for shared libraries.”
SafeStack is only enabled on AMD64
***
pledge(2)… or, how I learned to love web application sandboxing (https://learnbchs.org/pledge.html)
We’ve talked about OpenBSD’s sandboxing mechanism pledge() in the past, but today we have a great article by Kristaps Dzonsons, about how he grew to love it for Web Sandboxing.
+First up, he gives us his opening argument that should make most of you sit up and listen:
I use application-level sandboxing a lot because I make mistakes a lot;                 and when writing web applications, the price of making mistakes is very dear.             
In the early 2000s, that meant using systrace(4) on OpenBSD and NetBSD.  Then it was seccomp(2) (followed by libseccomp(3)) on Linux.     Then there was capsicum(4) on FreeBSD and sandbox_init(3) on Mac OS X.                         
All of these systems are invoked differently; and for the most part, whenever it came     time to interface with one of them, I longed for sweet release from the nightmare.         Please, try reading seccomp(2). To the end. Aligning web application logic and security policy would require an arduous (and usually trial-and-error or worse, copy-and-paste) process. If there was any process at all — if the burden of writing a policy didn't cause me to abandon sandboxing at the start.                         
And then there was pledge(2).                         
This document is about pledge(2) and why you should use it and love it. “
+Not convinced yet? Maybe you should take his challenge:
Let's play a drinking game.     The challenge is to stay out of the hospital.             
1.Navigate to seccomp(2).                             
2. Read it to the end.                             
3. Drink every time you don't understand.                             
For capsicum(4), the    challenge is no less difficult.     To see these in action, navigate no further than OpenSSH, which interfaces with these sandboxes: sandbox-seccomp-filter.c or sandbox-capsicum.c.     (For a history lesson, you can even see sandbox-systrace.c.)         Keep in mind that these do little more than restrict resources to open descriptors and the     usual necessities of memory, signals, timing, etc. Keep that in mind and be horrified.     “
Now Kristaps has his theory on why these are so difficult (NS..), but perhaps there is a better way. He makes the case that pledge() sits right in that sweet-spot, being powerful enough to be useful, but easy enough to implement that developers might actually use it.
All in all, a nice read, check it out! Would love to hear other developer success stories using pledge() as well.
***
News Roundup
Unix history repository, now on GitHub (http://www.osnews.com/story/29513/Unix_history_repository_now_on_GitHub)
OS News has an interesting tidbit on their site today, about the entire commit history of Unix now being available online, starting all the way back in 1970 and bringing us forward to today. 
From the README
The history and evolution of the Unix operating system is made available as a revision management repository, covering the period from its inception in 1970 as a 2.5 thousand line kernel and 26 commands, to 2016 as a widely-used 27 million line system. The 1.1GB repository contains about half a million commits and more than two thousand merges. The repository employs Git system for its storage and is hosted on GitHub. It has been created by synthesizing with custom software 24 snapshots of systems developed at Bell Labs, the University of California at Berkeley, and the 386BSD team, two legacy repositories, and the modern repository of the open source FreeBSD system. In total, about one thousand individual contributors are identified, the early ones through primary research. The data set can be used for empirical research in software engineering, information systems, and software archaeology.
This is a fascinating find, especially will be of value to students and historians who wish to look back in time to see how UNIX evolved, and in this repo ultimately turned into modern FreeBSD.
***
Yandex commits improvements to FreeBSD network stack  (https://reviews.freebsd.org/D8526)
“Rework ip_tryforward() to use FIB4 KPI.”
This commit brings some code from the experimental routing branch into head
As you can see from the graphs, it offers some sizable improvements in forwarding and firewalled packets per second
commit  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=309257) 
***
The brief history of Unix socket multiplexing – select(2) system call (https://idea.popcount.org/2016-11-01-a-brief-history-of-select2/)
Ever wondered about the details of socket multiplexing, aka the history of select(2)?
Well Marek today gives a treat, with a quick look back at the history that made today’s modern multiplexing possible.
First, his article starts the way all good ones do, presenting the problem in silent-movie form:
In mid-1960's time sharing was still a recent invention. Compared to a previous paradigm - batch-processing - time sharing was truly revolutionary. It greatly reduced the time wasted between writing a program and getting its result. Batch-processing meant hours and hours of waiting often to only see a program error. See this film to better understand the problems of 1960's programmers: "The trials and tribulations of batch processing".
Enter the wild world of the 1970’s, and we’ve now reached the birth of UNIX which tried to solve the batch processing problem with time-sharing.
These days when a program was executed, it could "stall" (block) only on a couple of things1:
 + wait for CPU
 + wait for disk I/O
 + wait for user input (waiting for a shell command) or console (printing data too fast)“
Jump forward another dozen years or so, and the world changes yet again:
This all changed in 1983 with the release of 4.2BSD. This revision introduced an early implementation of a TCP/IP stack and most importantly - the BSD Sockets API.Although today we take the BSD sockets API for granted, it wasn't obvious it was the right API. STREAMS were a competing API design on System V Revision 3.
Coming in along with the sockets API was the select(2) call, which our very own Kirk McKusick gives us some background on:
Select was introduced to allow applications to multiplex their I/O.
Consider a simple application like a remote login. It has descriptors for reading from and writing to the terminal and a descriptor for the (bidirectional) socket. It needs to read from the terminal keyboard and write those characters to the socket. It also needs to read from the socket and write to the terminal. Reading from a descriptor that has nothing queued causes the application to block until data arrives. The application does not know whether to read from the terminal or the socket and if it guesses wrong will incorrectly block. So select was added to let it find out which descriptor had data ready to read. If neither, select blocks until data arrives on one descriptor and then awakens telling which descriptor has data to read.
[...] Non-blocking was added at the same time as select. But using non-blocking when reading descriptors does not work well. Do you go into an infinite loop trying to read each of your input descriptors? If not, do you pause after each pass and if so for how long to remain responsive to input? Select is just far more efficient.
Select also lets you create a single inetd daemon rather than having to have a separate daemon for every service.
The article then wraps up with an interesting conclusion:
&amp;gt; CSP = Communicating sequential processes
In this discussion I was afraid to phrase the core question. Were Unix processes intended to be CSP-style processes? Are file descriptors a CSP-derived "channels"? Is select equivalent to ALT statement?
I think: no. Even if there are design similarities, they are accidental. The file-descriptor abstractions were developed well before the original CSP paper.
It seems that an operating socket API's evolved totally disconnected from the userspace CSP-alike programming paradigms. It's a pity though. It would be interesting to see an operating system coherent with the programming paradigms of the user land programs.
A long (but good) read, and worth your time if you are interested in the history how modern multiplexing came to be.
***
How to start CLion on FreeBSD? (https://intellij-support.jetbrains.com/hc/en-us/articles/206525024-How-to-start-CLion-on-FreeBSD)
CLion (pronounced "sea lion") is a cross-platform C and C++ IDE
By default, the Linux version comes bundled with some binaries, which obviously won’t work with the native FreeBSD build
Rather than using Linux emulation, you can replace these components with native versions
pkg install openjdk8 cmake gdb
Edit clion-2016.3/bin/idea.properties and change run.processes.with.pty=false
Start CLion and open Settings | Build, Execution, Deployment | Toolchains
Specify CMake path: /usr/local/bin/cmake and GDB path: /usr/local/bin/gdb
Without a replacement for fsnotifier, you will get a warning that the IDE may be slow to detect changes to files on disk
But, someone has already written a version of fsnotifier that works on FreeBSD and OpenBSD
fsnotifier for OpenBSD and FreeBSD (https://github.com/idea4bsd/fsnotifier) -- The fsnotifier is used by IntelliJ for detecting file changes. This version supports FreeBSD and OpenBSD via libinotify and is a replacement for the bundled Linux-only version coming with the IntelliJ IDEA Community Edition.
***
Beastie Bits
TrueOS Pico – FreeBSD ARM/RPi Thin Clients (https://www.trueos.org/trueos-pico/) 
A Puppet package provider for FreeBSD's PkgNG package manager. (https://github.com/xaque208/puppet-pkgng)
Notes from November London *BSD meetup (http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2016-November/014059.html) 
SemiBug meeting on Dec 20th (http://lists.nycbug.org/pipermail/semibug/2016-November/000131.html)
Feedback/Questions
 Erno - SSH without password (http://pastebin.com/SMvxur9v) 
 Jonathan - Magical ZFS (http://pastebin.com/5ETL7nmj) 
 George - TrueOS (http://pastebin.com/tSVvaV9e) 
 Mohammad - Jails IP (http://pastebin.com/T8nUexd1) 
 Gibheer - BEs (http://pastebin.com/YssXXp70) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we’ve got some new info on the talks from EuroBSDCon, a look at sharing a single ZFS pool between Linux and BSD, Sandboxing and much more! Stay tuned for your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://2016.eurobsdcon.org/PresentationSlides/" rel="nofollow">EuroBSDcon 2016 Presentation Slides</a></h3>

<ul>
<li>Due to circumstances beyond the control of the organizers of EuroBSDCon, there were not recordings of the talks given at the event.</li>
<li>However, they have collected the slide decks from each of the speakers and assembled them on this page for you</li>
<li>Also, we have some stuff from MeetBSD already:</li>
<li><a href="https://www.youtube.com/playlist?list=PLb87fdKUIo8TAMC2HJLZ7H54edD2BeGWv" rel="nofollow">Youtube Playlist </a> </li>
<li>Not all of the sessions are posted yet, but the rest should appear shortly</li>
<li><a href="https://www.freebsdfoundation.org/blog/meetbsd-2016-trip-report-domagoj-stolfa/" rel="nofollow">MeetBSD 2016 Trip Report: Domagoj Stolfa</a> 
***</li>
</ul>

<h3><a href="https://ericmccorkleblog.wordpress.com/2016/11/15/cohabiting-freebsd-and-gentoo-linux-on-a-common-zfs-volume/" rel="nofollow">Cohabiting FreeBSD and Gentoo Linux on a Common ZFS Volume</a></h3>

<ul>
<li>Eric McCorkle, who has contributed ZFS support to the FreeBSD EFI boot-loader code has posted an in-depth look at how he’s setup dual-boot with FreeBSD and Gentoo on the same ZFS volume.</li>
<li>He starts by giving us some background on how the layout is done. First up, GRUB is used as the boot-loader, allowing boot of both Linux and BSD</li>
<li><p>The next non-typical thing was using /etc/fstab to manage mount-points, instead of the typical ‘zfs mount’ usage, (apart from /home datasets)</p></li>
<li><p>data/home is mounted to /home, with all of its child datasets using the ZFS mountpoint system</p></li>
<li><p>data/freebsd and its child datasets house the FreeBSD system, and all have their mountpoints set to legacy</p></li>
<li><p>data/gentoo and its child datasets house the Gentoo system, and have their mountpoints set to legacy as well</p></li>
<li><p>So, how did he set this up? He helpfully provides an overview of the steps:</p>

<ul>
<li>Use the FreeBSD installer to create the GPT and ZFS pool</li>
<li>Install and configure FreeBSD, with the native FreeBSD boot loader</li>
<li>Boot into FreeBSD, create the Gentoo Linux datasets, install GRUB</li>
<li>Boot into the Gentoo Linux installer, install Gentoo</li>
<li>Boot into Gentoo, finish any configuration tasks</li>
</ul></li>
<li><p>The rest of the article walks us through the individual commands that make up each of those steps, as well as how to craft a GRUB config file capable of booting both systems.</p></li>
<li><p>Personally, since we are using EFI, I would have installed rEFInd, and chain-loaded each systems EFI boot code from there, allowing the use of the BSD loader, but to each their own!</p>

<hr></li>
</ul>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2016-11-27/introducing-safestack" rel="nofollow">HardenedBSD introduces Safestack into base</a></h3>

<ul>
<li>HardenedBSD has integrated SafeStack into its base system and ports tree</li>
<li><a href="http://clang.llvm.org/docs/SafeStack.html" rel="nofollow">SafeStack</a> is part of the Code Pointer Integrity (CPI) project within clang.</li>
<li>“SafeStack is an instrumentation pass that protects programs against attacks based on stack buffer overflows, without introducing any measurable performance overhead. It works by separating the program stack into two distinct regions: the safe stack and the unsafe stack. The safe stack stores return addresses, register spills, and local variables that are always accessed in a safe way, while the unsafe stack stores everything else. This separation ensures that buffer overflows on the unsafe stack cannot be used to overwrite anything on the safe stack.”</li>
<li>“As of 28 November 2016, with clang 3.9.0, SafeStack only supports being applied to applications and not shared libraries. Multiple patches have been submitted to clang by third parties to add support for shared libraries.”</li>
<li>SafeStack is only enabled on AMD64
***</li>
</ul>

<h3><a href="https://learnbchs.org/pledge.html" rel="nofollow">pledge(2)… or, how I learned to love web application sandboxing</a></h3>

<ul>
<li>We’ve talked about OpenBSD’s sandboxing mechanism pledge() in the past, but today we have a great article by Kristaps Dzonsons, about how he grew to love it for Web Sandboxing.
+First up, he gives us his opening argument that should make most of you sit up and listen:</li>
</ul>

<blockquote>
<p>I use application-level sandboxing a lot because I make mistakes a lot;                 and when writing web applications, the price of making mistakes is very dear.             </p>

<p>In the early 2000s, that meant using systrace(4) on OpenBSD and NetBSD.  Then it was seccomp(2) (followed by libseccomp(3)) on Linux.     Then there was capsicum(4) on FreeBSD and sandbox_init(3) on Mac OS X.                         </p>

<p>All of these systems are invoked differently; and for the most part, whenever it came     time to interface with one of them, I longed for sweet release from the nightmare.         Please, try reading seccomp(2). To the end. Aligning web application logic and security policy would require an arduous (and usually trial-and-error or worse, copy-and-paste) process. If there was any process at all — if the burden of writing a policy didn&#39;t cause me to abandon sandboxing at the start.                         </p>

<p>And then there was pledge(2).                         </p>

<p>This document is about pledge(2) and why you should use it and love it. “</p>
</blockquote>

<p>+Not convinced yet? Maybe you should take his challenge:</p>

<blockquote>
<p>Let&#39;s play a drinking game.     The challenge is to stay out of the hospital.             </p>

<p>1.Navigate to seccomp(2).                             </p>

<ol>
<li>Read it to the end.<br></li>
<li>Drink every time you don&#39;t understand.<br></li>
</ol>

<p>For capsicum(4), the    challenge is no less difficult.     To see these in action, navigate no further than OpenSSH, which interfaces with these sandboxes: sandbox-seccomp-filter.c or sandbox-capsicum.c.     (For a history lesson, you can even see sandbox-systrace.c.)         Keep in mind that these do little more than restrict resources to open descriptors and the     usual necessities of memory, signals, timing, etc. Keep that in mind and be horrified.     “</p>
</blockquote>

<ul>
<li>Now Kristaps has his theory on why these are so difficult (NS..), but perhaps there is a better way. He makes the case that pledge() sits right in that sweet-spot, being powerful enough to be useful, but easy enough to implement that developers might actually use it.</li>
<li>All in all, a nice read, check it out! Would love to hear other developer success stories using pledge() as well.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.osnews.com/story/29513/Unix_history_repository_now_on_GitHub" rel="nofollow">Unix history repository, now on GitHub</a></h3>

<ul>
<li><p>OS News has an interesting tidbit on their site today, about the entire commit history of Unix now being available online, starting all the way back in 1970 and bringing us forward to today. </p></li>
<li><p>From the README</p></li>
</ul>

<blockquote>
<p>The history and evolution of the Unix operating system is made available as a revision management repository, covering the period from its inception in 1970 as a 2.5 thousand line kernel and 26 commands, to 2016 as a widely-used 27 million line system. The 1.1GB repository contains about half a million commits and more than two thousand merges. The repository employs Git system for its storage and is hosted on GitHub. It has been created by synthesizing with custom software 24 snapshots of systems developed at Bell Labs, the University of California at Berkeley, and the 386BSD team, two legacy repositories, and the modern repository of the open source FreeBSD system. In total, about one thousand individual contributors are identified, the early ones through primary research. The data set can be used for empirical research in software engineering, information systems, and software archaeology.</p>
</blockquote>

<ul>
<li>This is a fascinating find, especially will be of value to students and historians who wish to look back in time to see how UNIX evolved, and in this repo ultimately turned into modern FreeBSD.
***</li>
</ul>

<h3><a href="https://reviews.freebsd.org/D8526" rel="nofollow">Yandex commits improvements to FreeBSD network stack </a></h3>

<ul>
<li>“Rework ip_tryforward() to use FIB4 KPI.”</li>
<li>This commit brings some code from the experimental routing branch into head</li>
<li>As you can see from the graphs, it offers some sizable improvements in forwarding and firewalled packets per second</li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=309257" rel="nofollow">commit </a> 
***</li>
</ul>

<h3><a href="https://idea.popcount.org/2016-11-01-a-brief-history-of-select2/" rel="nofollow">The brief history of Unix socket multiplexing – select(2) system call</a></h3>

<ul>
<li>Ever wondered about the details of socket multiplexing, aka the history of select(2)?</li>
<li>Well Marek today gives a treat, with a quick look back at the history that made today’s modern multiplexing possible.</li>
<li>First, his article starts the way all good ones do, presenting the problem in silent-movie form:</li>
</ul>

<blockquote>
<p>In mid-1960&#39;s time sharing was still a recent invention. Compared to a previous paradigm - batch-processing - time sharing was truly revolutionary. It greatly reduced the time wasted between writing a program and getting its result. Batch-processing meant hours and hours of waiting often to only see a program error. See this film to better understand the problems of 1960&#39;s programmers: &quot;The trials and tribulations of batch processing&quot;.</p>
</blockquote>

<ul>
<li>Enter the wild world of the 1970’s, and we’ve now reached the birth of UNIX which tried to solve the batch processing problem with time-sharing.</li>
</ul>

<blockquote>
<p>These days when a program was executed, it could &quot;stall&quot; (block) only on a couple of things1:</p>

<ul>
<li>wait for CPU</li>
<li>wait for disk I/O</li>
<li>wait for user input (waiting for a shell command) or console (printing data too fast)“</li>
</ul>
</blockquote>

<ul>
<li>Jump forward another dozen years or so, and the world changes yet again:</li>
</ul>

<blockquote>
<p>This all changed in 1983 with the release of 4.2BSD. This revision introduced an early implementation of a TCP/IP stack and most importantly - the BSD Sockets API.Although today we take the BSD sockets API for granted, it wasn&#39;t obvious it was the right API. STREAMS were a competing API design on System V Revision 3.</p>
</blockquote>

<ul>
<li>Coming in along with the sockets API was the select(2) call, which our very own Kirk McKusick gives us some background on:</li>
</ul>

<blockquote>
<p>Select was introduced to allow applications to multiplex their I/O.</p>

<p>Consider a simple application like a remote login. It has descriptors for reading from and writing to the terminal and a descriptor for the (bidirectional) socket. It needs to read from the terminal keyboard and write those characters to the socket. It also needs to read from the socket and write to the terminal. Reading from a descriptor that has nothing queued causes the application to block until data arrives. The application does not know whether to read from the terminal or the socket and if it guesses wrong will incorrectly block. So select was added to let it find out which descriptor had data ready to read. If neither, select blocks until data arrives on one descriptor and then awakens telling which descriptor has data to read.</p>

<p>[...] Non-blocking was added at the same time as select. But using non-blocking when reading descriptors does not work well. Do you go into an infinite loop trying to read each of your input descriptors? If not, do you pause after each pass and if so for how long to remain responsive to input? Select is just far more efficient.</p>
</blockquote>

<p>Select also lets you create a single inetd daemon rather than having to have a separate daemon for every service.</p>

<ul>
<li>The article then wraps up with an interesting conclusion:
&gt; CSP = Communicating sequential processes</li>
</ul>

<blockquote>
<p>In this discussion I was afraid to phrase the core question. Were Unix processes intended to be CSP-style processes? Are file descriptors a CSP-derived &quot;channels&quot;? Is select equivalent to ALT statement?</p>

<p>I think: no. Even if there are design similarities, they are accidental. The file-descriptor abstractions were developed well before the original CSP paper.</p>

<p>It seems that an operating socket API&#39;s evolved totally disconnected from the userspace CSP-alike programming paradigms. It&#39;s a pity though. It would be interesting to see an operating system coherent with the programming paradigms of the user land programs.</p>
</blockquote>

<ul>
<li>A long (but good) read, and worth your time if you are interested in the history how modern multiplexing came to be.
***</li>
</ul>

<h3><a href="https://intellij-support.jetbrains.com/hc/en-us/articles/206525024-How-to-start-CLion-on-FreeBSD" rel="nofollow">How to start CLion on FreeBSD?</a></h3>

<ul>
<li>CLion (pronounced &quot;sea lion&quot;) is a cross-platform C and C++ IDE</li>
<li>By default, the Linux version comes bundled with some binaries, which obviously won’t work with the native FreeBSD build</li>
<li>Rather than using Linux emulation, you can replace these components with native versions

<ul>
<li>pkg install openjdk8 cmake gdb</li>
<li>Edit clion-2016.3/bin/idea.properties and change run.processes.with.pty=false</li>
<li>Start CLion and open Settings | Build, Execution, Deployment | Toolchains</li>
<li>Specify CMake path: /usr/local/bin/cmake and GDB path: /usr/local/bin/gdb</li>
</ul></li>
<li>Without a replacement for fsnotifier, you will get a warning that the IDE may be slow to detect changes to files on disk</li>
<li>But, someone has already written a version of fsnotifier that works on FreeBSD and OpenBSD</li>
<li><a href="https://github.com/idea4bsd/fsnotifier" rel="nofollow">fsnotifier for OpenBSD and FreeBSD</a> -- The fsnotifier is used by IntelliJ for detecting file changes. This version supports FreeBSD and OpenBSD via libinotify and is a replacement for the bundled Linux-only version coming with the IntelliJ IDEA Community Edition.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.trueos.org/trueos-pico/" rel="nofollow">TrueOS Pico – FreeBSD ARM/RPi Thin Clients</a> </p></li>
<li><p><a href="https://github.com/xaque208/puppet-pkgng" rel="nofollow">A Puppet package provider for FreeBSD&#39;s PkgNG package manager.</a></p></li>
<li><p><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2016-November/014059.html" rel="nofollow">Notes from November London *BSD meetup</a> </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/semibug/2016-November/000131.html" rel="nofollow">SemiBug meeting on Dec 20th</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/SMvxur9v" rel="nofollow"> Erno - SSH without password</a> </li>
<li><a href="http://pastebin.com/5ETL7nmj" rel="nofollow"> Jonathan - Magical ZFS</a> </li>
<li><a href="http://pastebin.com/tSVvaV9e" rel="nofollow"> George - TrueOS</a> </li>
<li><a href="http://pastebin.com/T8nUexd1" rel="nofollow"> Mohammad - Jails IP</a> </li>
<li><a href="http://pastebin.com/YssXXp70" rel="nofollow"> Gibheer - BEs</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we’ve got some new info on the talks from EuroBSDCon, a look at sharing a single ZFS pool between Linux and BSD, Sandboxing and much more! Stay tuned for your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://2016.eurobsdcon.org/PresentationSlides/" rel="nofollow">EuroBSDcon 2016 Presentation Slides</a></h3>

<ul>
<li>Due to circumstances beyond the control of the organizers of EuroBSDCon, there were not recordings of the talks given at the event.</li>
<li>However, they have collected the slide decks from each of the speakers and assembled them on this page for you</li>
<li>Also, we have some stuff from MeetBSD already:</li>
<li><a href="https://www.youtube.com/playlist?list=PLb87fdKUIo8TAMC2HJLZ7H54edD2BeGWv" rel="nofollow">Youtube Playlist </a> </li>
<li>Not all of the sessions are posted yet, but the rest should appear shortly</li>
<li><a href="https://www.freebsdfoundation.org/blog/meetbsd-2016-trip-report-domagoj-stolfa/" rel="nofollow">MeetBSD 2016 Trip Report: Domagoj Stolfa</a> 
***</li>
</ul>

<h3><a href="https://ericmccorkleblog.wordpress.com/2016/11/15/cohabiting-freebsd-and-gentoo-linux-on-a-common-zfs-volume/" rel="nofollow">Cohabiting FreeBSD and Gentoo Linux on a Common ZFS Volume</a></h3>

<ul>
<li>Eric McCorkle, who has contributed ZFS support to the FreeBSD EFI boot-loader code has posted an in-depth look at how he’s setup dual-boot with FreeBSD and Gentoo on the same ZFS volume.</li>
<li>He starts by giving us some background on how the layout is done. First up, GRUB is used as the boot-loader, allowing boot of both Linux and BSD</li>
<li><p>The next non-typical thing was using /etc/fstab to manage mount-points, instead of the typical ‘zfs mount’ usage, (apart from /home datasets)</p></li>
<li><p>data/home is mounted to /home, with all of its child datasets using the ZFS mountpoint system</p></li>
<li><p>data/freebsd and its child datasets house the FreeBSD system, and all have their mountpoints set to legacy</p></li>
<li><p>data/gentoo and its child datasets house the Gentoo system, and have their mountpoints set to legacy as well</p></li>
<li><p>So, how did he set this up? He helpfully provides an overview of the steps:</p>

<ul>
<li>Use the FreeBSD installer to create the GPT and ZFS pool</li>
<li>Install and configure FreeBSD, with the native FreeBSD boot loader</li>
<li>Boot into FreeBSD, create the Gentoo Linux datasets, install GRUB</li>
<li>Boot into the Gentoo Linux installer, install Gentoo</li>
<li>Boot into Gentoo, finish any configuration tasks</li>
</ul></li>
<li><p>The rest of the article walks us through the individual commands that make up each of those steps, as well as how to craft a GRUB config file capable of booting both systems.</p></li>
<li><p>Personally, since we are using EFI, I would have installed rEFInd, and chain-loaded each systems EFI boot code from there, allowing the use of the BSD loader, but to each their own!</p>

<hr></li>
</ul>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2016-11-27/introducing-safestack" rel="nofollow">HardenedBSD introduces Safestack into base</a></h3>

<ul>
<li>HardenedBSD has integrated SafeStack into its base system and ports tree</li>
<li><a href="http://clang.llvm.org/docs/SafeStack.html" rel="nofollow">SafeStack</a> is part of the Code Pointer Integrity (CPI) project within clang.</li>
<li>“SafeStack is an instrumentation pass that protects programs against attacks based on stack buffer overflows, without introducing any measurable performance overhead. It works by separating the program stack into two distinct regions: the safe stack and the unsafe stack. The safe stack stores return addresses, register spills, and local variables that are always accessed in a safe way, while the unsafe stack stores everything else. This separation ensures that buffer overflows on the unsafe stack cannot be used to overwrite anything on the safe stack.”</li>
<li>“As of 28 November 2016, with clang 3.9.0, SafeStack only supports being applied to applications and not shared libraries. Multiple patches have been submitted to clang by third parties to add support for shared libraries.”</li>
<li>SafeStack is only enabled on AMD64
***</li>
</ul>

<h3><a href="https://learnbchs.org/pledge.html" rel="nofollow">pledge(2)… or, how I learned to love web application sandboxing</a></h3>

<ul>
<li>We’ve talked about OpenBSD’s sandboxing mechanism pledge() in the past, but today we have a great article by Kristaps Dzonsons, about how he grew to love it for Web Sandboxing.
+First up, he gives us his opening argument that should make most of you sit up and listen:</li>
</ul>

<blockquote>
<p>I use application-level sandboxing a lot because I make mistakes a lot;                 and when writing web applications, the price of making mistakes is very dear.             </p>

<p>In the early 2000s, that meant using systrace(4) on OpenBSD and NetBSD.  Then it was seccomp(2) (followed by libseccomp(3)) on Linux.     Then there was capsicum(4) on FreeBSD and sandbox_init(3) on Mac OS X.                         </p>

<p>All of these systems are invoked differently; and for the most part, whenever it came     time to interface with one of them, I longed for sweet release from the nightmare.         Please, try reading seccomp(2). To the end. Aligning web application logic and security policy would require an arduous (and usually trial-and-error or worse, copy-and-paste) process. If there was any process at all — if the burden of writing a policy didn&#39;t cause me to abandon sandboxing at the start.                         </p>

<p>And then there was pledge(2).                         </p>

<p>This document is about pledge(2) and why you should use it and love it. “</p>
</blockquote>

<p>+Not convinced yet? Maybe you should take his challenge:</p>

<blockquote>
<p>Let&#39;s play a drinking game.     The challenge is to stay out of the hospital.             </p>

<p>1.Navigate to seccomp(2).                             </p>

<ol>
<li>Read it to the end.<br></li>
<li>Drink every time you don&#39;t understand.<br></li>
</ol>

<p>For capsicum(4), the    challenge is no less difficult.     To see these in action, navigate no further than OpenSSH, which interfaces with these sandboxes: sandbox-seccomp-filter.c or sandbox-capsicum.c.     (For a history lesson, you can even see sandbox-systrace.c.)         Keep in mind that these do little more than restrict resources to open descriptors and the     usual necessities of memory, signals, timing, etc. Keep that in mind and be horrified.     “</p>
</blockquote>

<ul>
<li>Now Kristaps has his theory on why these are so difficult (NS..), but perhaps there is a better way. He makes the case that pledge() sits right in that sweet-spot, being powerful enough to be useful, but easy enough to implement that developers might actually use it.</li>
<li>All in all, a nice read, check it out! Would love to hear other developer success stories using pledge() as well.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.osnews.com/story/29513/Unix_history_repository_now_on_GitHub" rel="nofollow">Unix history repository, now on GitHub</a></h3>

<ul>
<li><p>OS News has an interesting tidbit on their site today, about the entire commit history of Unix now being available online, starting all the way back in 1970 and bringing us forward to today. </p></li>
<li><p>From the README</p></li>
</ul>

<blockquote>
<p>The history and evolution of the Unix operating system is made available as a revision management repository, covering the period from its inception in 1970 as a 2.5 thousand line kernel and 26 commands, to 2016 as a widely-used 27 million line system. The 1.1GB repository contains about half a million commits and more than two thousand merges. The repository employs Git system for its storage and is hosted on GitHub. It has been created by synthesizing with custom software 24 snapshots of systems developed at Bell Labs, the University of California at Berkeley, and the 386BSD team, two legacy repositories, and the modern repository of the open source FreeBSD system. In total, about one thousand individual contributors are identified, the early ones through primary research. The data set can be used for empirical research in software engineering, information systems, and software archaeology.</p>
</blockquote>

<ul>
<li>This is a fascinating find, especially will be of value to students and historians who wish to look back in time to see how UNIX evolved, and in this repo ultimately turned into modern FreeBSD.
***</li>
</ul>

<h3><a href="https://reviews.freebsd.org/D8526" rel="nofollow">Yandex commits improvements to FreeBSD network stack </a></h3>

<ul>
<li>“Rework ip_tryforward() to use FIB4 KPI.”</li>
<li>This commit brings some code from the experimental routing branch into head</li>
<li>As you can see from the graphs, it offers some sizable improvements in forwarding and firewalled packets per second</li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=309257" rel="nofollow">commit </a> 
***</li>
</ul>

<h3><a href="https://idea.popcount.org/2016-11-01-a-brief-history-of-select2/" rel="nofollow">The brief history of Unix socket multiplexing – select(2) system call</a></h3>

<ul>
<li>Ever wondered about the details of socket multiplexing, aka the history of select(2)?</li>
<li>Well Marek today gives a treat, with a quick look back at the history that made today’s modern multiplexing possible.</li>
<li>First, his article starts the way all good ones do, presenting the problem in silent-movie form:</li>
</ul>

<blockquote>
<p>In mid-1960&#39;s time sharing was still a recent invention. Compared to a previous paradigm - batch-processing - time sharing was truly revolutionary. It greatly reduced the time wasted between writing a program and getting its result. Batch-processing meant hours and hours of waiting often to only see a program error. See this film to better understand the problems of 1960&#39;s programmers: &quot;The trials and tribulations of batch processing&quot;.</p>
</blockquote>

<ul>
<li>Enter the wild world of the 1970’s, and we’ve now reached the birth of UNIX which tried to solve the batch processing problem with time-sharing.</li>
</ul>

<blockquote>
<p>These days when a program was executed, it could &quot;stall&quot; (block) only on a couple of things1:</p>

<ul>
<li>wait for CPU</li>
<li>wait for disk I/O</li>
<li>wait for user input (waiting for a shell command) or console (printing data too fast)“</li>
</ul>
</blockquote>

<ul>
<li>Jump forward another dozen years or so, and the world changes yet again:</li>
</ul>

<blockquote>
<p>This all changed in 1983 with the release of 4.2BSD. This revision introduced an early implementation of a TCP/IP stack and most importantly - the BSD Sockets API.Although today we take the BSD sockets API for granted, it wasn&#39;t obvious it was the right API. STREAMS were a competing API design on System V Revision 3.</p>
</blockquote>

<ul>
<li>Coming in along with the sockets API was the select(2) call, which our very own Kirk McKusick gives us some background on:</li>
</ul>

<blockquote>
<p>Select was introduced to allow applications to multiplex their I/O.</p>

<p>Consider a simple application like a remote login. It has descriptors for reading from and writing to the terminal and a descriptor for the (bidirectional) socket. It needs to read from the terminal keyboard and write those characters to the socket. It also needs to read from the socket and write to the terminal. Reading from a descriptor that has nothing queued causes the application to block until data arrives. The application does not know whether to read from the terminal or the socket and if it guesses wrong will incorrectly block. So select was added to let it find out which descriptor had data ready to read. If neither, select blocks until data arrives on one descriptor and then awakens telling which descriptor has data to read.</p>

<p>[...] Non-blocking was added at the same time as select. But using non-blocking when reading descriptors does not work well. Do you go into an infinite loop trying to read each of your input descriptors? If not, do you pause after each pass and if so for how long to remain responsive to input? Select is just far more efficient.</p>
</blockquote>

<p>Select also lets you create a single inetd daemon rather than having to have a separate daemon for every service.</p>

<ul>
<li>The article then wraps up with an interesting conclusion:
&gt; CSP = Communicating sequential processes</li>
</ul>

<blockquote>
<p>In this discussion I was afraid to phrase the core question. Were Unix processes intended to be CSP-style processes? Are file descriptors a CSP-derived &quot;channels&quot;? Is select equivalent to ALT statement?</p>

<p>I think: no. Even if there are design similarities, they are accidental. The file-descriptor abstractions were developed well before the original CSP paper.</p>

<p>It seems that an operating socket API&#39;s evolved totally disconnected from the userspace CSP-alike programming paradigms. It&#39;s a pity though. It would be interesting to see an operating system coherent with the programming paradigms of the user land programs.</p>
</blockquote>

<ul>
<li>A long (but good) read, and worth your time if you are interested in the history how modern multiplexing came to be.
***</li>
</ul>

<h3><a href="https://intellij-support.jetbrains.com/hc/en-us/articles/206525024-How-to-start-CLion-on-FreeBSD" rel="nofollow">How to start CLion on FreeBSD?</a></h3>

<ul>
<li>CLion (pronounced &quot;sea lion&quot;) is a cross-platform C and C++ IDE</li>
<li>By default, the Linux version comes bundled with some binaries, which obviously won’t work with the native FreeBSD build</li>
<li>Rather than using Linux emulation, you can replace these components with native versions

<ul>
<li>pkg install openjdk8 cmake gdb</li>
<li>Edit clion-2016.3/bin/idea.properties and change run.processes.with.pty=false</li>
<li>Start CLion and open Settings | Build, Execution, Deployment | Toolchains</li>
<li>Specify CMake path: /usr/local/bin/cmake and GDB path: /usr/local/bin/gdb</li>
</ul></li>
<li>Without a replacement for fsnotifier, you will get a warning that the IDE may be slow to detect changes to files on disk</li>
<li>But, someone has already written a version of fsnotifier that works on FreeBSD and OpenBSD</li>
<li><a href="https://github.com/idea4bsd/fsnotifier" rel="nofollow">fsnotifier for OpenBSD and FreeBSD</a> -- The fsnotifier is used by IntelliJ for detecting file changes. This version supports FreeBSD and OpenBSD via libinotify and is a replacement for the bundled Linux-only version coming with the IntelliJ IDEA Community Edition.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.trueos.org/trueos-pico/" rel="nofollow">TrueOS Pico – FreeBSD ARM/RPi Thin Clients</a> </p></li>
<li><p><a href="https://github.com/xaque208/puppet-pkgng" rel="nofollow">A Puppet package provider for FreeBSD&#39;s PkgNG package manager.</a></p></li>
<li><p><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2016-November/014059.html" rel="nofollow">Notes from November London *BSD meetup</a> </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/semibug/2016-November/000131.html" rel="nofollow">SemiBug meeting on Dec 20th</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/SMvxur9v" rel="nofollow"> Erno - SSH without password</a> </li>
<li><a href="http://pastebin.com/5ETL7nmj" rel="nofollow"> Jonathan - Magical ZFS</a> </li>
<li><a href="http://pastebin.com/tSVvaV9e" rel="nofollow"> George - TrueOS</a> </li>
<li><a href="http://pastebin.com/T8nUexd1" rel="nofollow"> Mohammad - Jails IP</a> </li>
<li><a href="http://pastebin.com/YssXXp70" rel="nofollow"> Gibheer - BEs</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>169: Scheduling your NetBSD</title>
  <link>https://www.bsdnow.tv/169</link>
  <guid isPermaLink="false">4898747c-2845-49b3-9de1-94f72798e48c</guid>
  <pubDate>Wed, 23 Nov 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4898747c-2845-49b3-9de1-94f72798e48c.mp3" length="63095476" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>On today’s episode, we are loaded and ready to go. Lots of OpenBSD news, a look at LetsEncrypt usage, the NetBSD scheduler (oh my) and much more. Keep it tuned to your place to B...SD!</itunes:subtitle>
  <itunes:duration>1:27:37</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>On today’s episode, we are loaded and ready to go. Lots of OpenBSD news, a look at LetsEncrypt usage, the NetBSD scheduler (oh my) and much more. Keep it tuned to your place to B...SD!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Production ready (http://www.tedunangst.com/flak/post/production-ready)
Ted Unangst brings us a piece on what it means to be Production Ready
He tells the story of a project he worked on that picked a framework that was “production ready”
They tested time zones, and it all seemed to work
They tested the unicode support in english and various european languages, and it was all good
They sent some emails with it, and it just worked
The framework said “Production Ready” on the tin, and it passed all the tests. What is the worst that could happen?
Now, we built our product on top of this. Some of the bugs were caught internally. Others were discovered by customers, who were of course a little dismayed. Like, how could you possibly ship this? Indeed. We were doing testing, quite a bit really, but when every possible edge case has a bug, it’s hard to find them all.
A customer from Arizona, which does not observe Daylight Saving Time, crashed the app
Some less common unicode characters caused a buffer overflow
The email system did not properly escape a period on its own line, truncating the email
“Egregious performance because of a naive N^2 algorithm for growing a buffer.”
“Egregious performance on some platforms due to using the wrong threading primitives.”
“Bizarre database connection bugs for some queries that I can’t at all explain.”
“In short, everything was “works for me” quality. But is that really production quality?”
“There are some obvious contenders for the title of today’s most “production ready” software, but it’s a more general phenomenon. People who have success don’t know what they don’t know, what they didn’t test, what unused features will crash and burn.”
Using Let's Encrypt within FreeBSD.org (https://blog.crashed.org/letsencrypt-in-freebsd-org/)
I decided to give Let's Encrypt certificates a shot on my personal web servers earlier this year after a disaster with StartSSL. I'd like to share what I've learned.
The biggest gotcha is that people tend to develop bad habits when they only have to deal with certificates once a year or so. The beginning part of the process is manual and the deployment of certificates somehow never quite gets automated, or things get left out.
That all changes with Let's Encrypt certificates. Instead of 1-5 year lifetime certificates the Let's Encrypt certificates are only valid for 90 days. Most people will be wanting to renew every 60-80 days. This forces the issue - you really need to automate and make it robust.
The Let's Encrypt folks provide tools to do this for you for the common cases. You run it on the actual machine, it manages the certificates and adjusts the server configuration files for you. Their goal is to provide a baseline shake-n-bake solution. I was not willing to give that level of control to a third party tool for my own servers - and it was absolutely out of the question for for the FreeBSD.org cluster.
I should probably mention that we do things on the FreeBSD.org cluster that many people would find a bit strange. The biggest problem that we have to deal with is that the traditional model of a firewall/bastion between "us" and "them" does not apply. We design for the assumption that hostile users are already on the "inside" of the network. The cluster is spread over 8 distinct sites with naked internet and no vpn between them. There is actually very little trust between the systems in this network - eg: ssh is for people only - no headless users can ssh. There are no passwords. Sudo can't be used. The command and control systems use signing. We don't trust anything by IPv4/IPv6 address because we have to assume MITM is a thing. And so on. In general, things are constructed to be trigger / polling / pull based.
The downside is that this makes automation and integration of Let's Encrypt clients interesting. If server configuration files can't be modified; and replicated web infrastructure is literally read-only (via jails/nullfs); and DNS zone files are static; and headless users can't ssh and therefore cannot do commits, how do you do the verification tokens in an automated fashion? Interesting, indeed.
We wanted to be able to use certificates on things like ldap and smtp servers. You can't do http file verification on those so we had to use dns validation of domains.
First, a signing request is generated, and the acme-challenge is returned
Peter’s post then walks through how the script adds the required TXT record to prove control of the domain, regenerates the zone file, DNSSEC signs it, and waits for it to be published, then continues the letsencrypt process.
Letsencrypt then issues the actual certificate
We export the fullchain files into a publication location. There is another jail that can read the fullchain certificates via nullfs and they are published with our non-secrets update mechanism
Since we are using DNSSEC, here is a good opportunity to maintain signed TLSA fingerprints. The catch with TLSA record updates is managing the update event horizon. You are supposed to have both fingerprints listed across the update cycle. We use 'TLSA 3 1 1' records to avoid issues with propagation delays for now. TLSA 3 0 1 changes with every renewal, while 3 1 1 only changes when you generate a new private key.
The majority of TLS/SSL servers require a full restart to re-load the certificates if the filename is unchanged. I found out the hard way.
There is a great deal more detail in the blog post, I recommend you check it out
Learning more about the NetBSD scheduler (... than I wanted to know)
Part 1 (http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20161105_1754.html)
Part 2 (http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20161109_0059.html)
Part 3 (http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20161113_0122.html)
Today I had a need to do some number crunching using a home-brewn C program. In order to do some manual load balancing, I was firing up some Amazon AWS instances (which is Xen) with NetBSD 7.0. In this case, the system was assigned two CPUs I started two instances of my program, with the intent to have each one use one CPU. Which is not what happened! Here is what I observed, and how I fixed things for now.
~~
load averages:  2.14,  2.08,  1.83;               up 0+00:45:56        18:01:32
27 processes: 4 runnable, 21 sleeping, 2 on CPU
CPU0 states:  100% user,  0.0% nice,  0.0% system,  0.0% interrupt,  0.0% idle
CPU1 states:  0.0% user,  0.0% nice,  0.0% system,  0.0% interrupt,  100% idle
Memory: 119M Act, 7940K Exec, 101M File, 3546M Free
~~
~~
PID USERNAME PRI NICE   SIZE   RES STATE    TIME   WCPU CPU COMMAND
2791 root   25  0  8816K  964K RUN/0    16:10 54.20% 54.20% myprog
2845 root   26  0  8816K  964K RUN/0    17:10 47.90% 47.90% myprog
~~
I expected something like WCPU and CPU being around 100%, assuming that each process was bound to its own CPU. The values I actually saw (and listed above) suggested that both programs were fighting for the same CPU. Huh?! NetBSD allows to create "processor sets", assign CPU(s) to them and then assign processes to the processor sets. Let's have a look!
~~
  # psrset -c
    1
  # psrset -b 0 2791
  # psrset -b 1 2845
   load averages:  2.02,  2.05,  1.94;               up 0+00:59:32        18:15:08
    27 processes: 1 runnable, 24 sleeping, 2 on CPU
    CPU0 states:  100% user,  0.0% nice,  0.0% system,  0.0% interrupt,  0.0% idle
    CPU1 states:  100% user,  0.0% nice,  0.0% system,  0.0% interrupt,  0.0% idle
    Memory: 119M Act, 7940K Exec, 101M File, 3546M Free
  PID USERNAME PRI NICE   SIZE   RES STATE      TIME   WCPU    CPU COMMAND
 2845 root      25    0  8816K  964K CPU/1     26:14   100%   100% myprog
 2791 root      25    0  8816K  964K RUN/0     25:40   100%   100% myprog
~~
Things are as expected now, with each program being bound to its own CPU. Now why this didn't happen by default is left as an exercise to the reader.
I had another look at this today, and was able to reproduce the behaviour using VMWare Fusion with two CPU cores on both NetBSD 7.0_STABLE as well as -current
The one hint that I got so far was from Michael van Elst that there may be a rouding error in sched_balance(). Looking at the code, there is not much room for a rounding error. But I am not familiar enough (at all) with the code, so I cannot judge if crucial bits are dropped here, or how that function fits in the whole puzzle.
Pondering on the "rounding error", I've setup both VMs with 4 CPUs, and the behaviour shown there is that load is distributed to about 3 and a half CPU - three CPUs under full load, and one not reaching 100%. There's definitely something fishy in there.
With multiple CPUs, each CPU has a queue of processes that are either "on the CPU" (running) or waiting to be serviced (run) on that CPU. Those processes count as "migratable" in runqueue_t. Every now and then, the system checks all its run queues to see if a CPU is idle, and can thus "steal" (migrate) processes from a busy CPU. This is done in sched_balance().
Such "stealing" (migration) has the positive effect that the process doesn't have to wait for getting serviced on the CPU it's currently waiting on. On the other side, migrating the process has effects on CPU's data and instruction caches, so switching CPUs shouldn't be taken too easy.
All in all, I'd say the patch is a good step forward from the current situation, which does not properly distribute pure CPU hogs, at all.
Building Cost-Effective 100-Gbps Firewalls for HPC with FreeBSD (https://www.nas.nasa.gov/SC16/demos/demo9.html)
The continuous growth of the NASA Center for Climate Simulation (NCCS) requires providing high-performance security tools and enhancing the network capacity. In order to support the requirements of emerging services, including the Advanced Data Analytics Platform (ADAPT) private cloud, the NCCS security team has proposed an architecture to provide extremely cost-effective 100-gigabit-per-second (Gbps) firewalls.
The aim of this project is to create a commodity-based platform that can process enough packets per second (pps) to sustain a 100-Gbps workload within the NCCS computational environment. The test domain consists of several existing systems within the NCCS, including switches (Dell S4084), routers (Dell R530s), servers (Dell R420s, and C6100s), and host card adapters (10-Gbps Mellanox ConnectX2 and Intel 8259 x Ethernet cards).
Previous NCCS work testing the FreeBSD operating system for high-performance routing reached a maximum of 4 million pps. Building on this work, we are comparing FreeBSD-11.0 and FreeBSD-Current along with implementing the netmap-fwd Application Programming Interface (API) and tuning the 10-gigabit Ethernet cards. We used the tools iperf3, nuttcp, and netperf to monitor the performance of the maximum bandwidth through the cards. Additional testing has involved enabling the Common Address Redundancy Protocol (CARP) to achieve an active/active architecture.
The tests have shown that at the optimally tuned and configured FreeBSD system, it is possible to create a system that can manage the huge amounts of pps needed to create a 100-Gbps firewall with commodity components.
Some interesting findings: 
FreeBSD was able to send more pps as a client than Centos 6.
Netmap-fwd increased the pps rate significantly.
The choice of network card can have a significant impact on pps, tuning, and netmap support.
Further tests will continue verifying the above results with even more capable systems-such as 40-gigabit and 100-gigabit Ethernet cards-to achieve even higher performance. In addition to hardware improvements, updates to the network capabilities in the FreeBSD-Current version will be closely monitored and applied as appropriate. The final result will be a reference architecture with representative hardware and software that will enable the NCCS to build, deploy, and efficiently maintain extremely cost-effective 100-Gbps firewalls.
Netflix has already managed to saturate a 100 Gbps interface using only a single CPU Socket (rather than a dual socket server). Forwarding/routing is a bit different, but it is definitely on track to get there. Using a small number of commodity servers to firewall 100 Gbps of traffic just takes some careful planning and load balancing. Soon it will be possible using a single host.
News Roundup
iocell - A FreeBSD jail manager. (https://github.com/bartekrutkowski/iocell)
Another jail manager has arrived on the scene, iocell, which begins life as a fork of the “classic” iocage.
Due to its shared heritage, it offers much of the same functionality and flags as iocage users will be familiar with.
For those who aren’t up to speed with either products, some of those features include: 
Templates, clones, basejails, fully independent jails
Ease of use
Zero configuration files
Rapid thin provisioning within seconds
Automatic package installation
Virtual networking stacks (vnet)
Shared IP based jails (non vnet)
Resource limits (CPU, MEMORY, DISK I/O, etc.)
Filesystem quotas and reservations
Dedicated ZFS datasets inside jails
Transparent ZFS snapshot management
Binary updates
Differential jail packaging
Export and import
And many more!
The program makes extensive use of ZFS for performing jail operations, so a zpool will be required (But doesn’t have to be your boot-pool)
It still looks “very” fresh, even using original iocage filenames in the repo, so a safe guess is that you’ll be able to switch between iocage and iocell with relative ease.
Fail2ban on OpenBSD 6.0 (http://blog.gordonturner.ca/2016/11/20/fail2ban-on-openbsd-6-0/)
We’ve used Fail2Ban in PC-BSD before, due to it’s ability to detect and block brute force attempts against a variety of services, including SSH, mail, and others. It even can work to detect jail brute force attempts, blocking IPs on the hosts firewall. 
However what about OpenBSD users? Well, Gordon Turner comes to the rescue today with a great writeup on deploying Fail2Ban specifically for that platform.
Now, Fail2Ban is a python program, so you’ll need to pkg install Python first, then he provides instructions on how to manually grab the F2B sources and install on OpenBSD.
Helpfully Gordon gives us some handy links to scripts and modifications to get F2B running via RC as well, which is a bit different since F2B has both a server and client that must run together.
With the installation bits out of the way, we get to next hit the “fun” stuff, which comes in the way of SSH brute force detection.
Naturally we will be configuring F2B to use “pf” to do our actual blocking, but the examples shown give us full control over the knobs used to detect, and then ultimately call ‘pfctl’ to do our heavy lifting.
The last bits of the article give us a runthrough on how to “prime” pf with the correct block tables and performing basic administrative tasks to control F2B in production.
A great article, and if you run an OpenBSD box exposed to the internet, you may want to bookmark this one.
openbsd changes of note (http://www.tedunangst.com/flak/post/openbsd-changes-of-note)
Continuing with our OpenBSD news for the week, we have a new blog post by TedU, which gives us a bunch of notes on the things which have changed over there as of late:
Some of the notables include:
mcl2k2 pools and the em conversion. The details are in the commits, but the short story is that due to hardware limitations, a number of tradeoffs need to be made between performance and memory usage. The em chip can (mostly) only be programmed to write to 2k buffers. However, ethernet payloads are not nicely aligned. They’re two bytes off. Leading to a costly choice. Provide a 2k buffer, and then copy all the data after the fact, which is slow. Or allocate a larger than 2k buffer, and provide em with a pointer that’s 2 bytes offset. Previously, the next size up from 2k was 4k, which is quite wasteful. The new 2k2 buffer size still wastes a bit of memory, but much less.    
FreeType 2.7 is prettier than ever. 
vmm for i386. Improve security. vmm is still running with a phenomenal set of privileges, but perhaps some cross-VM attacks may be limited. On the other side of the world, hyperv support is getting better. 
Remove setlocale. setlocale was sprinkled all throughout the code base many years ago, even though it did nothing, in anticipation of a day when it would do something. We’ve since decided that day will never come, and so many setlocale calls can go. 
syspatch is coming. Lots of commits actually. Despite the name, it’s more like a system update, since it replaces entire binaries. Then again, replacing a few binaries in a system is like patching small parts of the whole. A syspatch update will be smaller than an entire release. 
There’s a new build system. It kind of works like before, but a lot of the details have changed to support less root. Actually, it’d be accurate to say the whole build privilege system has been flipped. Start as root, which drops down to the build user to do the heavy lifting, instead of starting as a user that can elevate to root at any time. This no longer requires the build user to be pseudo-root; in fact, the goal is that the build user can’t elevate. 
There’s several other items on this list, take a look for more details, and he also helpfully provides commit-links if you want to see more about any of these topics.
It came from Bell Labs (http://media.bemyapp.com/came-bell-labs/#)
A little late for a halloween episode, we have “It came from Bell Labs”, a fascinating article talking about the successor to UNIX, Plan9
There was once an operating system that was intended to be the successor to Unix. Plan 9 From Bell Labs was its name, and playing with it for five minutes is like visiting an alternate dimension where computers are done differently. It was so ahead of its time that it would be considered cutting edge, even today. Find out the weird and woolly history to Plan Nine’s inception and eventual consignment as a footnote of operating systems today.
So, if you’ve never heard of Plan 9, how did it exactly differ from the UNIX we know and love today?
Here’s just a few of the key features under Plan 9’s hood + 9P – The distributed file system protocol. Everything runs through this, there is no escaping it. Since everything runs on top of 9P, that makes everything running on a Plan 9 box distributed as well. This means, for example, you can import /dev/audio from another machine on the network to use its sound card when your own machine doesn’t have one. + ndb – The namespace server. In conjunction with 9P, it bosses all the programs around and forces them to comply to the Plan 9 way. + Instead of Unix sockets, all the networking just runs through 9P. Thus, everything from ethernet packets to network cards are all just one more kind of file. + While Unicode is implemented ad-hoc in other systems, it’s baked into Plan 9 from the first int main(). In fact, even users who don’t like Plan 9 have to admit that the character encoding support, together with the beautiful built-in rio font, makes every other operating system look primitive. + The system’s own internal programs are built to be a rounded set of user tools from the ground up. So, for instance, it comes with its own editor, acme, built to be its own weird morphing thing that plays nice with the 9P protocol.
Sounds neat, but how did it work in the real world?
The result was a mixture of both breathtaking efficiency and alienating other-worldliness. Trying out the system is like a visit to an alternate reality where time-traveling gremlins changed how computers are made and used. You can execute anycommand anywhere just by typing its name and middle-clicking on it, even in the middle of reading a file. You can type out your blog post in the middle of a man page and save it right there. Screenshots are made by pointing /dev/screen to a file. When you execute a program in a terminal, the terminal morphs into the program you launched instead of running in the background. The window manager, rio, can be invoked within rio to create an instance of itself running inside itself. You can just keep going like that, until, like Inception, you get lost in which layer you’re in. Get used to running Plan 9 long enough, and you will find yourself horribly ill-adapted for dealing with the normal world.
While system administrators can’t stop praising it, the average home user won’t see much benefit unless they happen to run about eight desktop machines scattered all over. But to quote legendary hacker tribal bard Eric S. Raymond: “…Plan 9 failed simply because it fell short of being a compelling enough improvement on Unix to displace its ancestor.”
A fascinating article, worth your time to read it through, even though we’ve pulled some of the best bits here. Nice look at the alternative dimension that could have been.
Beastie Bits
inks -- Basically Reddit or Hacker News, but without the disagreeable trolls and military industrial complex shills downvoting everything to hide the truth (http://www.tedunangst.com/flak/post/inks)
“PAM is Un-American” talk now online (https://youtu.be/Mc2p6sx2s7k)
Reddit advertising of “PAM Mastery” (http://blather.michaelwlucas.com/archives/2818)
MeetBSD 2016 Report by Michael Dexter (https://www.ixsystems.com/blog/meetbsd-2016-report-michael-dexter/)
Various CBSD Tutorials (https://www.bsdstore.ru/en/tutorial.html)
Feedback/Questions
Dylan - Kaltura Alt (http://pastebin.com/6B96pVcm)
Scott - ZFS in Low-Mem (http://pastebin.com/Hrp8qwkP)
J - Mixing Ports / Pkgs (http://pastebin.com/85q4Q3Xx) 
Trenton - Dtract &amp;amp; PC-BSD (http://pastebin.com/RFKY0ERs)
Ivan - ZFS Backups (http://pastebin.com/31uqW6vW)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>On today’s episode, we are loaded and ready to go. Lots of OpenBSD news, a look at LetsEncrypt usage, the NetBSD scheduler (oh my) and much more. Keep it tuned to your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/production-ready" rel="nofollow">Production ready</a></h3>

<ul>
<li>Ted Unangst brings us a piece on what it means to be Production Ready</li>
<li>He tells the story of a project he worked on that picked a framework that was “production ready”</li>
<li>They tested time zones, and it all seemed to work</li>
<li>They tested the unicode support in english and various european languages, and it was all good</li>
<li>They sent some emails with it, and it just worked</li>
<li>The framework said “Production Ready” on the tin, and it passed all the tests. What is the worst that could happen?</li>
</ul>

<blockquote>
<p>Now, we built our product on top of this. Some of the bugs were caught internally. Others were discovered by customers, who were of course a little dismayed. Like, how could you possibly ship this? Indeed. We were doing testing, quite a bit really, but when every possible edge case has a bug, it’s hard to find them all.</p>
</blockquote>

<ul>
<li>A customer from Arizona, which does not observe Daylight Saving Time, crashed the app</li>
<li>Some less common unicode characters caused a buffer overflow</li>
<li>The email system did not properly escape a period on its own line, truncating the email</li>
<li>“Egregious performance because of a naive N<sup>2</sup> algorithm for growing a buffer.”</li>
<li>“Egregious performance on some platforms due to using the wrong threading primitives.”</li>
<li>“Bizarre database connection bugs for some queries that I can’t at all explain.”</li>
<li>“In short, everything was “works for me” quality. But is that really production quality?”</li>
<li>“There are some obvious contenders for the title of today’s most “production ready” software, but it’s a more general phenomenon. People who have success don’t know what they don’t know, what they didn’t test, what unused features will crash and burn.”</li>
</ul>

<hr>

<h3><a href="https://blog.crashed.org/letsencrypt-in-freebsd-org/" rel="nofollow">Using Let&#39;s Encrypt within FreeBSD.org</a></h3>

<blockquote>
<p>I decided to give Let&#39;s Encrypt certificates a shot on my personal web servers earlier this year after a disaster with StartSSL. I&#39;d like to share what I&#39;ve learned.</p>

<p>The biggest gotcha is that people tend to develop bad habits when they only have to deal with certificates once a year or so. The beginning part of the process is manual and the deployment of certificates somehow never quite gets automated, or things get left out.</p>

<p>That all changes with Let&#39;s Encrypt certificates. Instead of 1-5 year lifetime certificates the Let&#39;s Encrypt certificates are only valid for 90 days. Most people will be wanting to renew every 60-80 days. This forces the issue - you really need to automate and make it robust.</p>

<p>The Let&#39;s Encrypt folks provide tools to do this for you for the common cases. You run it on the actual machine, it manages the certificates and adjusts the server configuration files for you. Their goal is to provide a baseline shake-n-bake solution. I was not willing to give that level of control to a third party tool for my own servers - and it was absolutely out of the question for for the FreeBSD.org cluster.</p>

<p>I should probably mention that we do things on the FreeBSD.org cluster that many people would find a bit strange. The biggest problem that we have to deal with is that the traditional model of a firewall/bastion between &quot;us&quot; and &quot;them&quot; does not apply. We design for the assumption that hostile users are already on the &quot;inside&quot; of the network. The cluster is spread over 8 distinct sites with naked internet and no vpn between them. There is actually very little trust between the systems in this network - eg: ssh is for people only - no headless users can ssh. There are no passwords. Sudo can&#39;t be used. The command and control systems use signing. We don&#39;t trust anything by IPv4/IPv6 address because we have to assume MITM is a thing. And so on. In general, things are constructed to be trigger / polling / pull based.</p>

<p>The downside is that this makes automation and integration of Let&#39;s Encrypt clients interesting. If server configuration files can&#39;t be modified; and replicated web infrastructure is literally read-only (via jails/nullfs); and DNS zone files are static; and headless users can&#39;t ssh and therefore cannot do commits, how do you do the verification tokens in an automated fashion? Interesting, indeed.</p>

<p>We wanted to be able to use certificates on things like ldap and smtp servers. You can&#39;t do http file verification on those so we had to use dns validation of domains.</p>
</blockquote>

<ul>
<li>First, a signing request is generated, and the acme-challenge is returned</li>
<li>Peter’s post then walks through how the script adds the required TXT record to prove control of the domain, regenerates the zone file, DNSSEC signs it, and waits for it to be published, then continues the letsencrypt process.</li>
<li>Letsencrypt then issues the actual certificate</li>
</ul>

<blockquote>
<p>We export the fullchain files into a publication location. There is another jail that can read the fullchain certificates via nullfs and they are published with our non-secrets update mechanism</p>

<p>Since we are using DNSSEC, here is a good opportunity to maintain signed TLSA fingerprints. The catch with TLSA record updates is managing the update event horizon. You are supposed to have both fingerprints listed across the update cycle. We use &#39;TLSA 3 1 1&#39; records to avoid issues with propagation delays for now. TLSA 3 0 1 changes with every renewal, while 3 1 1 only changes when you generate a new private key.</p>

<p>The majority of TLS/SSL servers require a full restart to re-load the certificates if the filename is unchanged. I found out the hard way.</p>
</blockquote>

<ul>
<li>There is a great deal more detail in the blog post, I recommend you check it out</li>
</ul>

<hr>

<h3>Learning more about the NetBSD scheduler (... than I wanted to know)</h3>

<ul>
<li><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20161105_1754.html" rel="nofollow">Part 1</a></li>
<li><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20161109_0059.html" rel="nofollow">Part 2</a></li>
<li><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20161113_0122.html" rel="nofollow">Part 3</a></li>
</ul>

<blockquote>
<p>Today I had a need to do some number crunching using a home-brewn C program. In order to do some manual load balancing, I was firing up some Amazon AWS instances (which is Xen) with NetBSD 7.0. In this case, the system was assigned two CPUs I started two instances of my program, with the intent to have each one use one CPU. Which is not what happened! Here is what I observed, and how I fixed things for now.</p>
</blockquote>

<p>~~<br>
load averages:  2.14,  2.08,  1.83;               up 0+00:45:56        18:01:32<br>
27 processes: 4 runnable, 21 sleeping, 2 on CPU<br>
CPU0 states:  100% user,  0.0% nice,  0.0% system,  0.0% interrupt,  0.0% idle<br>
CPU1 states:  0.0% user,  0.0% nice,  0.0% system,  0.0% interrupt,  100% idle<br>
Memory: 119M Act, 7940K Exec, 101M File, 3546M Free<br>
~~</p>

<p>~~<br>
PID USERNAME PRI NICE   SIZE   RES STATE    TIME   WCPU CPU COMMAND<br>
2791 root   25  0  8816K  964K RUN/0    16:10 54.20% 54.20% myprog<br>
2845 root   26  0  8816K  964K RUN/0    17:10 47.90% 47.90% myprog<br>
~~</p>

<blockquote>
<p>I expected something like WCPU and CPU being around 100%, assuming that each process was bound to its own CPU. The values I actually saw (and listed above) suggested that both programs were fighting for the same CPU. Huh?! NetBSD allows to create &quot;processor sets&quot;, assign CPU(s) to them and then assign processes to the processor sets. Let&#39;s have a look!</p>
</blockquote>

<p>~~<br>
  # psrset -c<br>
    1<br>
  # psrset -b 0 2791<br>
  # psrset -b 1 2845<br>
   load averages:  2.02,  2.05,  1.94;               up 0+00:59:32        18:15:08<br>
    27 processes: 1 runnable, 24 sleeping, 2 on CPU<br>
    CPU0 states:  100% user,  0.0% nice,  0.0% system,  0.0% interrupt,  0.0% idle<br>
    CPU1 states:  100% user,  0.0% nice,  0.0% system,  0.0% interrupt,  0.0% idle<br>
    Memory: 119M Act, 7940K Exec, 101M File, 3546M Free</p>

<pre><code>  PID USERNAME PRI NICE   SIZE   RES STATE      TIME   WCPU    CPU COMMAND
 2845 root      25    0  8816K  964K CPU/1     26:14   100%   100% myprog
 2791 root      25    0  8816K  964K RUN/0     25:40   100%   100% myprog
</code></pre>

<p>~~</p>

<blockquote>
<p>Things are as expected now, with each program being bound to its own CPU. Now why this didn&#39;t happen by default is left as an exercise to the reader.</p>

<p>I had another look at this today, and was able to reproduce the behaviour using VMWare Fusion with two CPU cores on both NetBSD 7.0_STABLE as well as -current</p>

<p>The one hint that I got so far was from Michael van Elst that there may be a rouding error in sched_balance(). Looking at the code, there is not much room for a rounding error. But I am not familiar enough (at all) with the code, so I cannot judge if crucial bits are dropped here, or how that function fits in the whole puzzle.</p>

<p>Pondering on the &quot;rounding error&quot;, I&#39;ve setup both VMs with 4 CPUs, and the behaviour shown there is that load is distributed to about 3 and a half CPU - three CPUs under full load, and one not reaching 100%. There&#39;s definitely something fishy in there.</p>

<p>With multiple CPUs, each CPU has a queue of processes that are either &quot;on the CPU&quot; (running) or waiting to be serviced (run) on that CPU. Those processes count as &quot;migratable&quot; in runqueue_t. Every now and then, the system checks all its run queues to see if a CPU is idle, and can thus &quot;steal&quot; (migrate) processes from a busy CPU. This is done in sched_balance().</p>

<p>Such &quot;stealing&quot; (migration) has the positive effect that the process doesn&#39;t have to wait for getting serviced on the CPU it&#39;s currently waiting on. On the other side, migrating the process has effects on CPU&#39;s data and instruction caches, so switching CPUs shouldn&#39;t be taken too easy.</p>

<p>All in all, I&#39;d say the patch is a good step forward from the current situation, which does not properly distribute pure CPU hogs, at all.</p>
</blockquote>

<hr>

<h3><a href="https://www.nas.nasa.gov/SC16/demos/demo9.html" rel="nofollow">Building Cost-Effective 100-Gbps Firewalls for HPC with FreeBSD</a></h3>

<blockquote>
<p>The continuous growth of the NASA Center for Climate Simulation (NCCS) requires providing high-performance security tools and enhancing the network capacity. In order to support the requirements of emerging services, including the Advanced Data Analytics Platform (ADAPT) private cloud, the NCCS security team has proposed an architecture to provide extremely cost-effective 100-gigabit-per-second (Gbps) firewalls.</p>

<p>The aim of this project is to create a commodity-based platform that can process enough packets per second (pps) to sustain a 100-Gbps workload within the NCCS computational environment. The test domain consists of several existing systems within the NCCS, including switches (Dell S4084), routers (Dell R530s), servers (Dell R420s, and C6100s), and host card adapters (10-Gbps Mellanox ConnectX2 and Intel 8259 x Ethernet cards).</p>

<p>Previous NCCS work testing the FreeBSD operating system for high-performance routing reached a maximum of 4 million pps. Building on this work, we are comparing FreeBSD-11.0 and FreeBSD-Current along with implementing the netmap-fwd Application Programming Interface (API) and tuning the 10-gigabit Ethernet cards. We used the tools iperf3, nuttcp, and netperf to monitor the performance of the maximum bandwidth through the cards. Additional testing has involved enabling the Common Address Redundancy Protocol (CARP) to achieve an active/active architecture.</p>

<p>The tests have shown that at the optimally tuned and configured FreeBSD system, it is possible to create a system that can manage the huge amounts of pps needed to create a 100-Gbps firewall with commodity components.</p>
</blockquote>

<ul>
<li>Some interesting findings: 

<ul>
<li>FreeBSD was able to send more pps as a client than Centos 6.</li>
<li>Netmap-fwd increased the pps rate significantly.</li>
<li>The choice of network card can have a significant impact on pps, tuning, and netmap support.</li>
</ul></li>
</ul>

<blockquote>
<p>Further tests will continue verifying the above results with even more capable systems-such as 40-gigabit and 100-gigabit Ethernet cards-to achieve even higher performance. In addition to hardware improvements, updates to the network capabilities in the FreeBSD-Current version will be closely monitored and applied as appropriate. The final result will be a reference architecture with representative hardware and software that will enable the NCCS to build, deploy, and efficiently maintain extremely cost-effective 100-Gbps firewalls.</p>

<p>Netflix has already managed to saturate a 100 Gbps interface using only a single CPU Socket (rather than a dual socket server). Forwarding/routing is a bit different, but it is definitely on track to get there. Using a small number of commodity servers to firewall 100 Gbps of traffic just takes some careful planning and load balancing. Soon it will be possible using a single host.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/bartekrutkowski/iocell" rel="nofollow">iocell - A FreeBSD jail manager.</a></h3>

<ul>
<li>Another jail manager has arrived on the scene, iocell, which begins life as a fork of the “classic” iocage.</li>
<li>Due to its shared heritage, it offers much of the same functionality and flags as iocage users will be familiar with.</li>
<li>For those who aren’t up to speed with either products, some of those features include: 

<ul>
<li>Templates, clones, basejails, fully independent jails</li>
<li>Ease of use</li>
<li>Zero configuration files</li>
<li>Rapid thin provisioning within seconds</li>
<li>Automatic package installation</li>
<li>Virtual networking stacks (vnet)</li>
<li>Shared IP based jails (non vnet)</li>
<li>Resource limits (CPU, MEMORY, DISK I/O, etc.)</li>
<li>Filesystem quotas and reservations</li>
<li>Dedicated ZFS datasets inside jails</li>
<li>Transparent ZFS snapshot management</li>
<li>Binary updates</li>
<li>Differential jail packaging</li>
<li>Export and import</li>
<li>And many more!</li>
</ul></li>
<li>The program makes extensive use of ZFS for performing jail operations, so a zpool will be required (But doesn’t have to be your boot-pool)</li>
<li>It still looks “very” fresh, even using original iocage filenames in the repo, so a safe guess is that you’ll be able to switch between iocage and iocell with relative ease.</li>
</ul>

<hr>

<h3><a href="http://blog.gordonturner.ca/2016/11/20/fail2ban-on-openbsd-6-0/" rel="nofollow">Fail2ban on OpenBSD 6.0</a></h3>

<ul>
<li>We’ve used Fail2Ban in PC-BSD before, due to it’s ability to detect and block brute force attempts against a variety of services, including SSH, mail, and others. It even can work to detect jail brute force attempts, blocking IPs on the hosts firewall. </li>
<li>However what about OpenBSD users? Well, Gordon Turner comes to the rescue today with a great writeup on deploying Fail2Ban specifically for that platform.</li>
<li>Now, Fail2Ban is a python program, so you’ll need to pkg install Python first, then he provides instructions on how to manually grab the F2B sources and install on OpenBSD.</li>
<li>Helpfully Gordon gives us some handy links to scripts and modifications to get F2B running via RC as well, which is a bit different since F2B has both a server and client that must run together.</li>
<li>With the installation bits out of the way, we get to next hit the “fun” stuff, which comes in the way of SSH brute force detection.</li>
<li>Naturally we will be configuring F2B to use “pf” to do our actual blocking, but the examples shown give us full control over the knobs used to detect, and then ultimately call ‘pfctl’ to do our heavy lifting.</li>
<li>The last bits of the article give us a runthrough on how to “prime” pf with the correct block tables and performing basic administrative tasks to control F2B in production.</li>
<li>A great article, and if you run an OpenBSD box exposed to the internet, you may want to bookmark this one.</li>
</ul>

<hr>

<h3><a href="http://www.tedunangst.com/flak/post/openbsd-changes-of-note" rel="nofollow">openbsd changes of note</a></h3>

<ul>
<li>Continuing with our OpenBSD news for the week, we have a new blog post by TedU, which gives us a bunch of notes on the things which have changed over there as of late:</li>
<li><p>Some of the notables include:</p>

<ul>
<li><em>mcl2k2 pools</em> and the <em>em conversion</em>. The details are in the commits, but the short story is that due to hardware limitations, a number of tradeoffs need to be made between performance and memory usage. The em chip can (mostly) only be programmed to write to 2k buffers. However, ethernet payloads are not nicely aligned. They’re two bytes off. Leading to a costly choice. Provide a 2k buffer, and then copy all the data after the fact, which is slow. Or allocate a larger than 2k buffer, and provide em with a pointer that’s 2 bytes offset. Previously, the next size up from 2k was 4k, which is quite wasteful. The new 2k2 buffer size still wastes a bit of memory, but much less.<br></li>
<li><em>FreeType 2.7 is prettier than ever</em>. </li>
<li><em>vmm for i386</em>. <em>Improve security</em>. vmm is still running with a phenomenal set of privileges, but perhaps some cross-VM attacks may be limited. On the other side of the world, <em>hyperv support is getting better</em>. </li>
<li><em>Remove setlocale</em>. setlocale was sprinkled all throughout the code base many years ago, even though it did nothing, in anticipation of a day when it would do something. We’ve since decided that day will never come, and so many setlocale calls can go. </li>
<li><em>syspatch is coming</em>. Lots of commits actually. Despite the name, it’s more like a system update, since it replaces entire binaries. Then again, replacing a few binaries in a system is like patching small parts of the whole. A syspatch update will be smaller than an entire release. </li>
<li><em>There’s a new build system</em>. It kind of works like before, but a lot of the details have changed to support less root. Actually, it’d be accurate to say the whole build privilege system has been flipped. Start as root, which drops down to the build user to do the heavy lifting, instead of starting as a user that can elevate to root at any time. This no longer requires the build user to be pseudo-root; in fact, the goal is that the build user can’t elevate. </li>
</ul></li>
<li><p>There’s several other items on this list, take a look for more details, and he also helpfully provides commit-links if you want to see more about any of these topics.</p></li>
</ul>

<hr>

<h3><a href="http://media.bemyapp.com/came-bell-labs/#" rel="nofollow">It came from Bell Labs</a></h3>

<ul>
<li>A little late for a halloween episode, we have “It came from Bell Labs”, a fascinating article talking about the successor to UNIX, Plan9</li>
</ul>

<blockquote>
<p>There was once an operating system that was intended to be the successor to Unix. Plan 9 From Bell Labs was its name, and playing with it for five minutes is like visiting an alternate dimension where computers are done differently. It was so ahead of its time that it would be considered cutting edge, even today. Find out the weird and woolly history to Plan Nine’s inception and eventual consignment as a footnote of operating systems today.</p>
</blockquote>

<ul>
<li>So, if you’ve never heard of Plan 9, how did it exactly differ from the UNIX we know and love today?</li>
</ul>

<blockquote>
<p>Here’s just a few of the key features under Plan 9’s hood + 9P – The distributed file system protocol. Everything runs through this, there is no escaping it. Since everything runs on top of 9P, that makes everything running on a Plan 9 box distributed as well. This means, for example, you can import /dev/audio from another machine on the network to use its sound card when your own machine doesn’t have one. + ndb – The namespace server. In conjunction with 9P, it bosses all the programs around and forces them to comply to the Plan 9 way. + Instead of Unix sockets, all the networking just runs through 9P. Thus, everything from ethernet packets to network cards are all just one more kind of file. + While Unicode is implemented ad-hoc in other systems, it’s baked into Plan 9 from the first int main(). In fact, even users who don’t like Plan 9 have to admit that the character encoding support, together with the beautiful built-in rio font, makes every other operating system look primitive. + The system’s own internal programs are built to be a rounded set of user tools from the ground up. So, for instance, it comes with its own editor, acme, built to be its own weird morphing thing that plays nice with the 9P protocol.</p>
</blockquote>

<ul>
<li>Sounds neat, but how did it work in the real world?</li>
</ul>

<blockquote>
<p>The result was a mixture of both breathtaking efficiency and alienating other-worldliness. Trying out the system is like a visit to an alternate reality where time-traveling gremlins changed how computers are made and used. You can execute anycommand anywhere just by typing its name and middle-clicking on it, even in the middle of reading a file. You can type out your blog post in the middle of a man page and save it right there. Screenshots are made by pointing /dev/screen to a file. When you execute a program in a terminal, the terminal morphs into the program you launched instead of running in the background. The window manager, rio, can be invoked within rio to create an instance of itself running inside itself. You can just keep going like that, until, like Inception, you get lost in which layer you’re in. Get used to running Plan 9 long enough, and you will find yourself horribly ill-adapted for dealing with the normal world.</p>

<p>While system administrators can’t stop praising it, the average home user won’t see much benefit unless they happen to run about eight desktop machines scattered all over. But to quote legendary hacker tribal bard Eric S. Raymond: “…Plan 9 failed simply because it fell short of being a compelling enough improvement on Unix to displace its ancestor.”</p>
</blockquote>

<ul>
<li>A fascinating article, worth your time to read it through, even though we’ve pulled some of the best bits here. Nice look at the alternative dimension that could have been.</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.tedunangst.com/flak/post/inks" rel="nofollow">inks -- Basically Reddit or Hacker News, but without the disagreeable trolls and military industrial complex shills downvoting everything to hide the truth</a></li>
<li><a href="https://youtu.be/Mc2p6sx2s7k" rel="nofollow">“PAM is Un-American” talk now online</a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2818" rel="nofollow">Reddit advertising of “PAM Mastery”</a></li>
<li><a href="https://www.ixsystems.com/blog/meetbsd-2016-report-michael-dexter/" rel="nofollow">MeetBSD 2016 Report by Michael Dexter</a></li>
<li><a href="https://www.bsdstore.ru/en/tutorial.html" rel="nofollow">Various CBSD Tutorials</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/6B96pVcm" rel="nofollow">Dylan - Kaltura Alt</a></li>
<li><a href="http://pastebin.com/Hrp8qwkP" rel="nofollow">Scott - ZFS in Low-Mem</a></li>
<li><a href="http://pastebin.com/85q4Q3Xx" rel="nofollow">J - Mixing Ports / Pkgs</a> </li>
<li><a href="http://pastebin.com/RFKY0ERs" rel="nofollow">Trenton - Dtract &amp; PC-BSD</a></li>
<li><a href="http://pastebin.com/31uqW6vW" rel="nofollow">Ivan - ZFS Backups</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>On today’s episode, we are loaded and ready to go. Lots of OpenBSD news, a look at LetsEncrypt usage, the NetBSD scheduler (oh my) and much more. Keep it tuned to your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/production-ready" rel="nofollow">Production ready</a></h3>

<ul>
<li>Ted Unangst brings us a piece on what it means to be Production Ready</li>
<li>He tells the story of a project he worked on that picked a framework that was “production ready”</li>
<li>They tested time zones, and it all seemed to work</li>
<li>They tested the unicode support in english and various european languages, and it was all good</li>
<li>They sent some emails with it, and it just worked</li>
<li>The framework said “Production Ready” on the tin, and it passed all the tests. What is the worst that could happen?</li>
</ul>

<blockquote>
<p>Now, we built our product on top of this. Some of the bugs were caught internally. Others were discovered by customers, who were of course a little dismayed. Like, how could you possibly ship this? Indeed. We were doing testing, quite a bit really, but when every possible edge case has a bug, it’s hard to find them all.</p>
</blockquote>

<ul>
<li>A customer from Arizona, which does not observe Daylight Saving Time, crashed the app</li>
<li>Some less common unicode characters caused a buffer overflow</li>
<li>The email system did not properly escape a period on its own line, truncating the email</li>
<li>“Egregious performance because of a naive N<sup>2</sup> algorithm for growing a buffer.”</li>
<li>“Egregious performance on some platforms due to using the wrong threading primitives.”</li>
<li>“Bizarre database connection bugs for some queries that I can’t at all explain.”</li>
<li>“In short, everything was “works for me” quality. But is that really production quality?”</li>
<li>“There are some obvious contenders for the title of today’s most “production ready” software, but it’s a more general phenomenon. People who have success don’t know what they don’t know, what they didn’t test, what unused features will crash and burn.”</li>
</ul>

<hr>

<h3><a href="https://blog.crashed.org/letsencrypt-in-freebsd-org/" rel="nofollow">Using Let&#39;s Encrypt within FreeBSD.org</a></h3>

<blockquote>
<p>I decided to give Let&#39;s Encrypt certificates a shot on my personal web servers earlier this year after a disaster with StartSSL. I&#39;d like to share what I&#39;ve learned.</p>

<p>The biggest gotcha is that people tend to develop bad habits when they only have to deal with certificates once a year or so. The beginning part of the process is manual and the deployment of certificates somehow never quite gets automated, or things get left out.</p>

<p>That all changes with Let&#39;s Encrypt certificates. Instead of 1-5 year lifetime certificates the Let&#39;s Encrypt certificates are only valid for 90 days. Most people will be wanting to renew every 60-80 days. This forces the issue - you really need to automate and make it robust.</p>

<p>The Let&#39;s Encrypt folks provide tools to do this for you for the common cases. You run it on the actual machine, it manages the certificates and adjusts the server configuration files for you. Their goal is to provide a baseline shake-n-bake solution. I was not willing to give that level of control to a third party tool for my own servers - and it was absolutely out of the question for for the FreeBSD.org cluster.</p>

<p>I should probably mention that we do things on the FreeBSD.org cluster that many people would find a bit strange. The biggest problem that we have to deal with is that the traditional model of a firewall/bastion between &quot;us&quot; and &quot;them&quot; does not apply. We design for the assumption that hostile users are already on the &quot;inside&quot; of the network. The cluster is spread over 8 distinct sites with naked internet and no vpn between them. There is actually very little trust between the systems in this network - eg: ssh is for people only - no headless users can ssh. There are no passwords. Sudo can&#39;t be used. The command and control systems use signing. We don&#39;t trust anything by IPv4/IPv6 address because we have to assume MITM is a thing. And so on. In general, things are constructed to be trigger / polling / pull based.</p>

<p>The downside is that this makes automation and integration of Let&#39;s Encrypt clients interesting. If server configuration files can&#39;t be modified; and replicated web infrastructure is literally read-only (via jails/nullfs); and DNS zone files are static; and headless users can&#39;t ssh and therefore cannot do commits, how do you do the verification tokens in an automated fashion? Interesting, indeed.</p>

<p>We wanted to be able to use certificates on things like ldap and smtp servers. You can&#39;t do http file verification on those so we had to use dns validation of domains.</p>
</blockquote>

<ul>
<li>First, a signing request is generated, and the acme-challenge is returned</li>
<li>Peter’s post then walks through how the script adds the required TXT record to prove control of the domain, regenerates the zone file, DNSSEC signs it, and waits for it to be published, then continues the letsencrypt process.</li>
<li>Letsencrypt then issues the actual certificate</li>
</ul>

<blockquote>
<p>We export the fullchain files into a publication location. There is another jail that can read the fullchain certificates via nullfs and they are published with our non-secrets update mechanism</p>

<p>Since we are using DNSSEC, here is a good opportunity to maintain signed TLSA fingerprints. The catch with TLSA record updates is managing the update event horizon. You are supposed to have both fingerprints listed across the update cycle. We use &#39;TLSA 3 1 1&#39; records to avoid issues with propagation delays for now. TLSA 3 0 1 changes with every renewal, while 3 1 1 only changes when you generate a new private key.</p>

<p>The majority of TLS/SSL servers require a full restart to re-load the certificates if the filename is unchanged. I found out the hard way.</p>
</blockquote>

<ul>
<li>There is a great deal more detail in the blog post, I recommend you check it out</li>
</ul>

<hr>

<h3>Learning more about the NetBSD scheduler (... than I wanted to know)</h3>

<ul>
<li><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20161105_1754.html" rel="nofollow">Part 1</a></li>
<li><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20161109_0059.html" rel="nofollow">Part 2</a></li>
<li><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20161113_0122.html" rel="nofollow">Part 3</a></li>
</ul>

<blockquote>
<p>Today I had a need to do some number crunching using a home-brewn C program. In order to do some manual load balancing, I was firing up some Amazon AWS instances (which is Xen) with NetBSD 7.0. In this case, the system was assigned two CPUs I started two instances of my program, with the intent to have each one use one CPU. Which is not what happened! Here is what I observed, and how I fixed things for now.</p>
</blockquote>

<p>~~<br>
load averages:  2.14,  2.08,  1.83;               up 0+00:45:56        18:01:32<br>
27 processes: 4 runnable, 21 sleeping, 2 on CPU<br>
CPU0 states:  100% user,  0.0% nice,  0.0% system,  0.0% interrupt,  0.0% idle<br>
CPU1 states:  0.0% user,  0.0% nice,  0.0% system,  0.0% interrupt,  100% idle<br>
Memory: 119M Act, 7940K Exec, 101M File, 3546M Free<br>
~~</p>

<p>~~<br>
PID USERNAME PRI NICE   SIZE   RES STATE    TIME   WCPU CPU COMMAND<br>
2791 root   25  0  8816K  964K RUN/0    16:10 54.20% 54.20% myprog<br>
2845 root   26  0  8816K  964K RUN/0    17:10 47.90% 47.90% myprog<br>
~~</p>

<blockquote>
<p>I expected something like WCPU and CPU being around 100%, assuming that each process was bound to its own CPU. The values I actually saw (and listed above) suggested that both programs were fighting for the same CPU. Huh?! NetBSD allows to create &quot;processor sets&quot;, assign CPU(s) to them and then assign processes to the processor sets. Let&#39;s have a look!</p>
</blockquote>

<p>~~<br>
  # psrset -c<br>
    1<br>
  # psrset -b 0 2791<br>
  # psrset -b 1 2845<br>
   load averages:  2.02,  2.05,  1.94;               up 0+00:59:32        18:15:08<br>
    27 processes: 1 runnable, 24 sleeping, 2 on CPU<br>
    CPU0 states:  100% user,  0.0% nice,  0.0% system,  0.0% interrupt,  0.0% idle<br>
    CPU1 states:  100% user,  0.0% nice,  0.0% system,  0.0% interrupt,  0.0% idle<br>
    Memory: 119M Act, 7940K Exec, 101M File, 3546M Free</p>

<pre><code>  PID USERNAME PRI NICE   SIZE   RES STATE      TIME   WCPU    CPU COMMAND
 2845 root      25    0  8816K  964K CPU/1     26:14   100%   100% myprog
 2791 root      25    0  8816K  964K RUN/0     25:40   100%   100% myprog
</code></pre>

<p>~~</p>

<blockquote>
<p>Things are as expected now, with each program being bound to its own CPU. Now why this didn&#39;t happen by default is left as an exercise to the reader.</p>

<p>I had another look at this today, and was able to reproduce the behaviour using VMWare Fusion with two CPU cores on both NetBSD 7.0_STABLE as well as -current</p>

<p>The one hint that I got so far was from Michael van Elst that there may be a rouding error in sched_balance(). Looking at the code, there is not much room for a rounding error. But I am not familiar enough (at all) with the code, so I cannot judge if crucial bits are dropped here, or how that function fits in the whole puzzle.</p>

<p>Pondering on the &quot;rounding error&quot;, I&#39;ve setup both VMs with 4 CPUs, and the behaviour shown there is that load is distributed to about 3 and a half CPU - three CPUs under full load, and one not reaching 100%. There&#39;s definitely something fishy in there.</p>

<p>With multiple CPUs, each CPU has a queue of processes that are either &quot;on the CPU&quot; (running) or waiting to be serviced (run) on that CPU. Those processes count as &quot;migratable&quot; in runqueue_t. Every now and then, the system checks all its run queues to see if a CPU is idle, and can thus &quot;steal&quot; (migrate) processes from a busy CPU. This is done in sched_balance().</p>

<p>Such &quot;stealing&quot; (migration) has the positive effect that the process doesn&#39;t have to wait for getting serviced on the CPU it&#39;s currently waiting on. On the other side, migrating the process has effects on CPU&#39;s data and instruction caches, so switching CPUs shouldn&#39;t be taken too easy.</p>

<p>All in all, I&#39;d say the patch is a good step forward from the current situation, which does not properly distribute pure CPU hogs, at all.</p>
</blockquote>

<hr>

<h3><a href="https://www.nas.nasa.gov/SC16/demos/demo9.html" rel="nofollow">Building Cost-Effective 100-Gbps Firewalls for HPC with FreeBSD</a></h3>

<blockquote>
<p>The continuous growth of the NASA Center for Climate Simulation (NCCS) requires providing high-performance security tools and enhancing the network capacity. In order to support the requirements of emerging services, including the Advanced Data Analytics Platform (ADAPT) private cloud, the NCCS security team has proposed an architecture to provide extremely cost-effective 100-gigabit-per-second (Gbps) firewalls.</p>

<p>The aim of this project is to create a commodity-based platform that can process enough packets per second (pps) to sustain a 100-Gbps workload within the NCCS computational environment. The test domain consists of several existing systems within the NCCS, including switches (Dell S4084), routers (Dell R530s), servers (Dell R420s, and C6100s), and host card adapters (10-Gbps Mellanox ConnectX2 and Intel 8259 x Ethernet cards).</p>

<p>Previous NCCS work testing the FreeBSD operating system for high-performance routing reached a maximum of 4 million pps. Building on this work, we are comparing FreeBSD-11.0 and FreeBSD-Current along with implementing the netmap-fwd Application Programming Interface (API) and tuning the 10-gigabit Ethernet cards. We used the tools iperf3, nuttcp, and netperf to monitor the performance of the maximum bandwidth through the cards. Additional testing has involved enabling the Common Address Redundancy Protocol (CARP) to achieve an active/active architecture.</p>

<p>The tests have shown that at the optimally tuned and configured FreeBSD system, it is possible to create a system that can manage the huge amounts of pps needed to create a 100-Gbps firewall with commodity components.</p>
</blockquote>

<ul>
<li>Some interesting findings: 

<ul>
<li>FreeBSD was able to send more pps as a client than Centos 6.</li>
<li>Netmap-fwd increased the pps rate significantly.</li>
<li>The choice of network card can have a significant impact on pps, tuning, and netmap support.</li>
</ul></li>
</ul>

<blockquote>
<p>Further tests will continue verifying the above results with even more capable systems-such as 40-gigabit and 100-gigabit Ethernet cards-to achieve even higher performance. In addition to hardware improvements, updates to the network capabilities in the FreeBSD-Current version will be closely monitored and applied as appropriate. The final result will be a reference architecture with representative hardware and software that will enable the NCCS to build, deploy, and efficiently maintain extremely cost-effective 100-Gbps firewalls.</p>

<p>Netflix has already managed to saturate a 100 Gbps interface using only a single CPU Socket (rather than a dual socket server). Forwarding/routing is a bit different, but it is definitely on track to get there. Using a small number of commodity servers to firewall 100 Gbps of traffic just takes some careful planning and load balancing. Soon it will be possible using a single host.</p>
</blockquote>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/bartekrutkowski/iocell" rel="nofollow">iocell - A FreeBSD jail manager.</a></h3>

<ul>
<li>Another jail manager has arrived on the scene, iocell, which begins life as a fork of the “classic” iocage.</li>
<li>Due to its shared heritage, it offers much of the same functionality and flags as iocage users will be familiar with.</li>
<li>For those who aren’t up to speed with either products, some of those features include: 

<ul>
<li>Templates, clones, basejails, fully independent jails</li>
<li>Ease of use</li>
<li>Zero configuration files</li>
<li>Rapid thin provisioning within seconds</li>
<li>Automatic package installation</li>
<li>Virtual networking stacks (vnet)</li>
<li>Shared IP based jails (non vnet)</li>
<li>Resource limits (CPU, MEMORY, DISK I/O, etc.)</li>
<li>Filesystem quotas and reservations</li>
<li>Dedicated ZFS datasets inside jails</li>
<li>Transparent ZFS snapshot management</li>
<li>Binary updates</li>
<li>Differential jail packaging</li>
<li>Export and import</li>
<li>And many more!</li>
</ul></li>
<li>The program makes extensive use of ZFS for performing jail operations, so a zpool will be required (But doesn’t have to be your boot-pool)</li>
<li>It still looks “very” fresh, even using original iocage filenames in the repo, so a safe guess is that you’ll be able to switch between iocage and iocell with relative ease.</li>
</ul>

<hr>

<h3><a href="http://blog.gordonturner.ca/2016/11/20/fail2ban-on-openbsd-6-0/" rel="nofollow">Fail2ban on OpenBSD 6.0</a></h3>

<ul>
<li>We’ve used Fail2Ban in PC-BSD before, due to it’s ability to detect and block brute force attempts against a variety of services, including SSH, mail, and others. It even can work to detect jail brute force attempts, blocking IPs on the hosts firewall. </li>
<li>However what about OpenBSD users? Well, Gordon Turner comes to the rescue today with a great writeup on deploying Fail2Ban specifically for that platform.</li>
<li>Now, Fail2Ban is a python program, so you’ll need to pkg install Python first, then he provides instructions on how to manually grab the F2B sources and install on OpenBSD.</li>
<li>Helpfully Gordon gives us some handy links to scripts and modifications to get F2B running via RC as well, which is a bit different since F2B has both a server and client that must run together.</li>
<li>With the installation bits out of the way, we get to next hit the “fun” stuff, which comes in the way of SSH brute force detection.</li>
<li>Naturally we will be configuring F2B to use “pf” to do our actual blocking, but the examples shown give us full control over the knobs used to detect, and then ultimately call ‘pfctl’ to do our heavy lifting.</li>
<li>The last bits of the article give us a runthrough on how to “prime” pf with the correct block tables and performing basic administrative tasks to control F2B in production.</li>
<li>A great article, and if you run an OpenBSD box exposed to the internet, you may want to bookmark this one.</li>
</ul>

<hr>

<h3><a href="http://www.tedunangst.com/flak/post/openbsd-changes-of-note" rel="nofollow">openbsd changes of note</a></h3>

<ul>
<li>Continuing with our OpenBSD news for the week, we have a new blog post by TedU, which gives us a bunch of notes on the things which have changed over there as of late:</li>
<li><p>Some of the notables include:</p>

<ul>
<li><em>mcl2k2 pools</em> and the <em>em conversion</em>. The details are in the commits, but the short story is that due to hardware limitations, a number of tradeoffs need to be made between performance and memory usage. The em chip can (mostly) only be programmed to write to 2k buffers. However, ethernet payloads are not nicely aligned. They’re two bytes off. Leading to a costly choice. Provide a 2k buffer, and then copy all the data after the fact, which is slow. Or allocate a larger than 2k buffer, and provide em with a pointer that’s 2 bytes offset. Previously, the next size up from 2k was 4k, which is quite wasteful. The new 2k2 buffer size still wastes a bit of memory, but much less.<br></li>
<li><em>FreeType 2.7 is prettier than ever</em>. </li>
<li><em>vmm for i386</em>. <em>Improve security</em>. vmm is still running with a phenomenal set of privileges, but perhaps some cross-VM attacks may be limited. On the other side of the world, <em>hyperv support is getting better</em>. </li>
<li><em>Remove setlocale</em>. setlocale was sprinkled all throughout the code base many years ago, even though it did nothing, in anticipation of a day when it would do something. We’ve since decided that day will never come, and so many setlocale calls can go. </li>
<li><em>syspatch is coming</em>. Lots of commits actually. Despite the name, it’s more like a system update, since it replaces entire binaries. Then again, replacing a few binaries in a system is like patching small parts of the whole. A syspatch update will be smaller than an entire release. </li>
<li><em>There’s a new build system</em>. It kind of works like before, but a lot of the details have changed to support less root. Actually, it’d be accurate to say the whole build privilege system has been flipped. Start as root, which drops down to the build user to do the heavy lifting, instead of starting as a user that can elevate to root at any time. This no longer requires the build user to be pseudo-root; in fact, the goal is that the build user can’t elevate. </li>
</ul></li>
<li><p>There’s several other items on this list, take a look for more details, and he also helpfully provides commit-links if you want to see more about any of these topics.</p></li>
</ul>

<hr>

<h3><a href="http://media.bemyapp.com/came-bell-labs/#" rel="nofollow">It came from Bell Labs</a></h3>

<ul>
<li>A little late for a halloween episode, we have “It came from Bell Labs”, a fascinating article talking about the successor to UNIX, Plan9</li>
</ul>

<blockquote>
<p>There was once an operating system that was intended to be the successor to Unix. Plan 9 From Bell Labs was its name, and playing with it for five minutes is like visiting an alternate dimension where computers are done differently. It was so ahead of its time that it would be considered cutting edge, even today. Find out the weird and woolly history to Plan Nine’s inception and eventual consignment as a footnote of operating systems today.</p>
</blockquote>

<ul>
<li>So, if you’ve never heard of Plan 9, how did it exactly differ from the UNIX we know and love today?</li>
</ul>

<blockquote>
<p>Here’s just a few of the key features under Plan 9’s hood + 9P – The distributed file system protocol. Everything runs through this, there is no escaping it. Since everything runs on top of 9P, that makes everything running on a Plan 9 box distributed as well. This means, for example, you can import /dev/audio from another machine on the network to use its sound card when your own machine doesn’t have one. + ndb – The namespace server. In conjunction with 9P, it bosses all the programs around and forces them to comply to the Plan 9 way. + Instead of Unix sockets, all the networking just runs through 9P. Thus, everything from ethernet packets to network cards are all just one more kind of file. + While Unicode is implemented ad-hoc in other systems, it’s baked into Plan 9 from the first int main(). In fact, even users who don’t like Plan 9 have to admit that the character encoding support, together with the beautiful built-in rio font, makes every other operating system look primitive. + The system’s own internal programs are built to be a rounded set of user tools from the ground up. So, for instance, it comes with its own editor, acme, built to be its own weird morphing thing that plays nice with the 9P protocol.</p>
</blockquote>

<ul>
<li>Sounds neat, but how did it work in the real world?</li>
</ul>

<blockquote>
<p>The result was a mixture of both breathtaking efficiency and alienating other-worldliness. Trying out the system is like a visit to an alternate reality where time-traveling gremlins changed how computers are made and used. You can execute anycommand anywhere just by typing its name and middle-clicking on it, even in the middle of reading a file. You can type out your blog post in the middle of a man page and save it right there. Screenshots are made by pointing /dev/screen to a file. When you execute a program in a terminal, the terminal morphs into the program you launched instead of running in the background. The window manager, rio, can be invoked within rio to create an instance of itself running inside itself. You can just keep going like that, until, like Inception, you get lost in which layer you’re in. Get used to running Plan 9 long enough, and you will find yourself horribly ill-adapted for dealing with the normal world.</p>

<p>While system administrators can’t stop praising it, the average home user won’t see much benefit unless they happen to run about eight desktop machines scattered all over. But to quote legendary hacker tribal bard Eric S. Raymond: “…Plan 9 failed simply because it fell short of being a compelling enough improvement on Unix to displace its ancestor.”</p>
</blockquote>

<ul>
<li>A fascinating article, worth your time to read it through, even though we’ve pulled some of the best bits here. Nice look at the alternative dimension that could have been.</li>
</ul>

<hr>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.tedunangst.com/flak/post/inks" rel="nofollow">inks -- Basically Reddit or Hacker News, but without the disagreeable trolls and military industrial complex shills downvoting everything to hide the truth</a></li>
<li><a href="https://youtu.be/Mc2p6sx2s7k" rel="nofollow">“PAM is Un-American” talk now online</a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2818" rel="nofollow">Reddit advertising of “PAM Mastery”</a></li>
<li><a href="https://www.ixsystems.com/blog/meetbsd-2016-report-michael-dexter/" rel="nofollow">MeetBSD 2016 Report by Michael Dexter</a></li>
<li><a href="https://www.bsdstore.ru/en/tutorial.html" rel="nofollow">Various CBSD Tutorials</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/6B96pVcm" rel="nofollow">Dylan - Kaltura Alt</a></li>
<li><a href="http://pastebin.com/Hrp8qwkP" rel="nofollow">Scott - ZFS in Low-Mem</a></li>
<li><a href="http://pastebin.com/85q4Q3Xx" rel="nofollow">J - Mixing Ports / Pkgs</a> </li>
<li><a href="http://pastebin.com/RFKY0ERs" rel="nofollow">Trenton - Dtract &amp; PC-BSD</a></li>
<li><a href="http://pastebin.com/31uqW6vW" rel="nofollow">Ivan - ZFS Backups</a></li>
</ul>

<hr>

<ul>
<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>168: The Post Show Show</title>
  <link>https://www.bsdnow.tv/168</link>
  <guid isPermaLink="false">776e1141-a95a-47ca-b5cd-308ad59d32f9</guid>
  <pubDate>Wed, 16 Nov 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/776e1141-a95a-47ca-b5cd-308ad59d32f9.mp3" length="60620116" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow. Allan and I are back from MeetBSD! A good time was had by all, lots to discuss, so let’s jump right into it on your place to B...SD!</itunes:subtitle>
  <itunes:duration>1:24:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow. Allan and I are back from MeetBSD! A good time was had by all, lots to discuss, so let’s jump right into it on your place to B...SD!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Build a FreeBSD 11.0-release Openstack Image with bsd-cloudinit (https://raymii.org/s/tutorials/FreeBSD_11.0-release_Openstack_Image.html)
We are going to prepare a FreeBSD image for Openstack deployment. We do this by creating a FreeBSD 11.0-RELEASE instance, installing it and converting it using bsd-cloudinit. We'll use the CloudVPS public Openstack cloud for this. Create an account there and install the Openstack command line tools, like nova, cinder and glance.
A FreeBSD image with Cloud Init will automatically resize the disk to the size of the flavor and it will add your SSH key right at boot. You can use Cloud Config to execute a script at first boot, for example, to bootstrap your system into Puppet or Ansible. If you use Ansible to manage OpenStack instances you can integrate it without manually logging in or doing anything manually.
Since FreeBSD 10.2-RELEASE there is an rc script which, when the file /firstboot exists, expands the root filesystem to the full disk. While bsd-cloudinit does this as well, if you don't need the whole cloudinit stack, (when you use a static ssh key for example), you can touch that file to make sure the disk is expanded at the first boot
A detailed tutorial that shows how to create customized cloud images using the FreeBSD install media
There is also the option of using the FreeBSD release tools to build custom cloud images in a more headless fashion
Someone should make a tutorial out of that
***
iXsystems Announces TrueOS Launch (https://www.ixsystems.com/blog/ixsystems-announces-trueos-launch/)
As loyal listeners to this show, you’ve no doubt heard by now that we are in the middle of undergoing a shift in moving PC-BSD -&amp;gt; TrueOS.
Last week during MeetBSD this was made “official” with iX issuing our press release and I was able to give a talk detailing many of the reasons and things going on with this change.
The talk should be available online here soon(ish), but for a quick recap:
TrueOS is moving to a rolling-release model based on FreeBSD -CURRENT
Lumina has become the default desktop for TrueOS
LibreSSL is enabled top to bottom
We are in the middle of working on conversion to OpenRC for run-control replacement
The TrueOS pico was announced, which is our “Thin-Client” solution, right now allowing you to use a TrueOS server pared with a RPI2 device. 
***
Running FreeBSD 11 on Raspberry Pi (https://vzaigrin.wordpress.com/2016/10/16/running-freebsd-11-on-raspberry-pi/)
This article covers some of the changes you will notice if you upgrade your RPI to FreeBSD 11.0
It covers some of the changes to WiFi in 11.0
Pro Tip: you can get a list of WiFi devices by doing: sysctl net.wlan.devices
There are official binary packages for ARM with 11.0, so you can just ‘pkg install’ your favourite apps
Many of the LEDs are exposed via the /dev/led/ interface, which you can just echo 0 or 1 to, or use morse(6) to send a message
gpioctl can be used to control the various GPIO pins
The post also covers how to setup the real-time clock on the Raspberry Pi
There is also limited support for adjusting the CPU frequency of the Pi
There are also tips on configuring a one-wire temperature sensor
***
void-zones-tools for FreeBSD (https://github.com/cyclaero/void-zones-tools)
Adblock has been in the news a bit recently, with some of the more popular browser plugins now accepting brib^...contributions to permit specific ads through.
Well today the ad-blockers strike back. We have a great tutorial up on GitHub which demonstrates one of the useful features of using Unbound in FreeBSD to do your own ad-blocking with void-zones.
Specifically, void-zones are a way to return NXDOMAIN when DNS requests are made to known malicious or spam sites.
Using void-zones-tools software will make managing this easy, by being able to pull in known lists of sites to block from several 3rd party curators.
When coupled with our past tutorials on setting up your own FreeBSD router, this may become very useful for a lot of folks who want to do ad-blocking ad at a lower level, allowing it to filter smart-phones or any other devices on a network.
***
News Roundup
BSD Socket API Revamp (https://raw.githubusercontent.com/sustrik/dsock/master/rfc/sock-api-revamp-01.txt)
Martin Sustrik has started a draft RFC to revamp the BSD Sockets API:
The progress in the area of network protocols is distinctively lagging behind.  While every hobbyist new to the art of programming writes and publishes their small JavaScript libraries, there's no such thing going on with network protocols.  Indeed, it looks like the field of network protocols is dominated by big companies and academia, just like programming as a whole used to be before the advent of personal computers.
the API proposed in this document doesn't try to virtualize all possible aspects of all possible protocols and provide a single set of functions to deal with all of them.  Instead, it acknowledges how varied the protocol landscape is and how much the requirements for individual protocols differ.  Therefore, it lets each protocol define its own API and asks only for bare minimum of standardised behaviour needed to implement protocol composability.
As a consequence, the new API is much more lightweight and flexible than BSD socket API and allows to decompose today's monolithic protocol monsters into small single-purpose microprotocols that can be easily combined together to achieve desired functionality.
The idea behind the new design is to allow the software author to define their own protocols via a generic interface, and easily stack them on top of the existing network protocols, be they the basic protocols like TCP/IP, or a layer 7 protocol like HTTP
   Example of creating a stack of four protocols:
~~
   int s1 = tcpconnect("192.168.0.111:5555");
   int s2 = foostart(s1, arg1, arg2, arg3);
   int s3 = barstart(s2);
   int s4 = bazstart(s3, arg4, arg5);
~~
It also allows applying generic transformations to the protocols:
~~
   int tcps = tcpconnect("192.168.0.111:80");
   /* Websockets is a connected protocol. */
   int ws = websockconnect(tcps);
   uint16t compressionalgoritm;
   mrecv(ws, &amp;amp;compressionalgorithm, 2, -1);
   /* Compression socket is unconnected. */
   int cs = compressstart(ws, compression_algorithm);
~~
***
Updated version of re(4) for DragonflyBSD (http://lists.dragonflybsd.org/pipermail/users/2016-November/313140.html)
Sephe over at the Dragonfly project has issued a CFT for a newer version of the “re” driver
For those who don’t know, that is for Realtek nics, specifically his updates add features:
I have made an updated version of re(4), which leverages Realtek driver's chip/PHY reset/initialization code.  I hope it can resolve all kinds of weirdness we encountered on this chip so far.
Testers, you know what to do! Give this a whirl and let him know if you run into any new issues, or better yet, give feedback if it fixes some long-standing problems you’ve run into in the past.
***
Hackathon reports from OpenBSD’s B2K16
b2k16 hackathon report: Jeremy Evans on ports cleaning, progress on postgres, nginx, ruby and more (http://undeadly.org/cgi?action=article&amp;amp;sid=20161112112023)
b2k16 hackathon report: Landry Breuil on various ports progress (http://undeadly.org/cgi?action=article&amp;amp;sid=20161112095902)
b2k16 hackathon report: Antoine Jacoutot on GNOME's path forward, various ports progress (http://undeadly.org/cgi?action=article&amp;amp;sid=20161109030623)
We have a trio of hackathon reports from OpenBSD’s B2K16 (Recently held in Budapest)
First up - Jeremy Evans give us his rundown which starts with sweeping some of the cruft out of the barn:
I started off b2k16 by channeling tedu@, and removing a lot of ports, including lang/ruby/2.0, lang/io, convertors/ruby-json, databases/dbic++, databases/ruby-swift, databases/ruby-jdbc-*, x11/ruby-profiligacy, and mail/ruby-mailfactory.
After that, he talks about improvements made to postgres, nginx and ruby ports, fixing things such as pg_upgrade support, breaking nginx down into sub-packages and a major ruby update to about 50% of the packages.
Next up - Landry Breuil tells us about his trip, which also started with some major ports pruning, including some stale XFCE bits and drupal6. 
One of the things he mentions is the Tor browser:
Found finally some time again to review properly the pending port for Tor Browser, even if i don't like the way it is developed (600+ patches against upstream firefox-esr !? even if relationship is improving..) nor will endorse its use, i feel that the time that was spent on porting it and updating it and maintaining it shouldn't be lost, and it should get commited - there are only some portswise minor tweaks to fix. Had a bit of discussions about that with other porters... 
Lastly, Antoine Jacoutot gives us a smaller update on his work:
First task of this hackathon was for Jasper and I to upgrade to GNOME 3.22.1 (version 3.22.2 hit the ports tree since). As usual I already updated the core libraries a few days before so that we could start with a nice set of fully updated packages. It ended up being the fastest GNOME update ever, it all went very smoothly. We're still debating the future of GNOME on OpenBSD though. More and more features require systemd interfaces and without a replacement it may not make sense to keep it around. Implementing these interfaces requires time which Jasper and I don't really have these days... Anyway, we'll see.
All-n-all, a good trip it sounds like with some much needed hacking taking place. Good to see the cruft getting cleaned up, along with some new exciting ports landing.
***
July to September 2016 Status Report (https://www.freebsd.org/news/status/report-2016-07-2016-09.html)
The latest FreeBSD quarterly status report is out
It includes the induction of the new Core team, and reports from all of the other teams, including Release Engineering, Port Manager, and the FreeBSD Foundation
Some other highlights:
Capsicum Update
The Graphics Stack on FreeBSD
Using lld, the LLVM Linker, to Link FreeBSD
VirtualBox Shared Folders Filesystem
evdev support (better mouse, keyboard, and multi-touch support)
ZFS Code Sync with Latest OpenZFS/Illumos
The ARC now mostly stores compressed data, the same as is stored on disk, decompressing them on demand.
The L2ARC now stores the same (compressed) data as the ARC without recompression, and its RAM usage was further reduced.
The largest size of indirect block possible has been increased from 16KB to 128KB, and speculative prefetching of indirect blocks is now performed.
Improved ordering of space allocation.
The SHA-512t256 and Skein hashing algorithms are now supported.
***
Beastie Bits
How to Host Your Own Private GitHub with Gogs (http://www.cs.cmu.edu/afs/cs/user/predragp/www/git.html)
Nvidia Adds Telemetry To Latest Drivers (https://yro.slashdot.org/story/16/11/07/1427257/nvidia-adds-telemetry-to-latest-drivers)
KnoxBUG Upcoming Meeting (http://knoxbug.org/2016-11-29) 
Feedback/Questions
 William - Show Music (http://pastebin.com/skvEgkLK) 
 Ray - Mounting a Cell Phone (http://pastebin.com/nMDeSFGM) 
 Ron - TrueOS + Radeon (http://pastebin.com/p5bC1jKU)  (Follow-up - He used nvidia card)
 Kurt - ZFS Migration (http://pastebin.com/ud9vEK2C) 
 Matt Dillon (Yes that Matt Dillon) - vkernels (http://pastebin.com/VPQfsUks) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow. Allan and I are back from MeetBSD! A good time was had by all, lots to discuss, so let’s jump right into it on your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://raymii.org/s/tutorials/FreeBSD_11.0-release_Openstack_Image.html" rel="nofollow">Build a FreeBSD 11.0-release Openstack Image with bsd-cloudinit</a></h3>

<blockquote>
<p>We are going to prepare a FreeBSD image for Openstack deployment. We do this by creating a FreeBSD 11.0-RELEASE instance, installing it and converting it using bsd-cloudinit. We&#39;ll use the CloudVPS public Openstack cloud for this. Create an account there and install the Openstack command line tools, like nova, cinder and glance.</p>

<p>A FreeBSD image with Cloud Init will automatically resize the disk to the size of the flavor and it will add your SSH key right at boot. You can use Cloud Config to execute a script at first boot, for example, to bootstrap your system into Puppet or Ansible. If you use Ansible to manage OpenStack instances you can integrate it without manually logging in or doing anything manually.</p>

<p>Since FreeBSD 10.2-RELEASE there is an rc script which, when the file /firstboot exists, expands the root filesystem to the full disk. While bsd-cloudinit does this as well, if you don&#39;t need the whole cloudinit stack, (when you use a static ssh key for example), you can touch that file to make sure the disk is expanded at the first boot</p>
</blockquote>

<ul>
<li>A detailed tutorial that shows how to create customized cloud images using the FreeBSD install media</li>
<li>There is also the option of using the FreeBSD release tools to build custom cloud images in a more headless fashion</li>
<li>Someone should make a tutorial out of that
***</li>
</ul>

<h3><a href="https://www.ixsystems.com/blog/ixsystems-announces-trueos-launch/" rel="nofollow">iXsystems Announces TrueOS Launch</a></h3>

<ul>
<li>As loyal listeners to this show, you’ve no doubt heard by now that we are in the middle of undergoing a shift in moving PC-BSD -&gt; TrueOS.</li>
<li>Last week during MeetBSD this was made “official” with iX issuing our press release and I was able to give a talk detailing many of the reasons and things going on with this change.</li>
<li>The talk should be available online here soon(ish), but for a quick recap:</li>
<li>TrueOS is moving to a rolling-release model based on FreeBSD -CURRENT</li>
<li>Lumina has become the default desktop for TrueOS</li>
<li>LibreSSL is enabled top to bottom</li>
<li>We are in the middle of working on conversion to OpenRC for run-control replacement</li>
<li>The TrueOS pico was announced, which is our “Thin-Client” solution, right now allowing you to use a TrueOS server pared with a RPI2 device. 
***</li>
</ul>

<h3><a href="https://vzaigrin.wordpress.com/2016/10/16/running-freebsd-11-on-raspberry-pi/" rel="nofollow">Running FreeBSD 11 on Raspberry Pi</a></h3>

<ul>
<li>This article covers some of the changes you will notice if you upgrade your RPI to FreeBSD 11.0</li>
<li>It covers some of the changes to WiFi in 11.0</li>
<li>Pro Tip: you can get a list of WiFi devices by doing: sysctl net.wlan.devices</li>
<li>There are official binary packages for ARM with 11.0, so you can just ‘pkg install’ your favourite apps</li>
<li>Many of the LEDs are exposed via the /dev/led/<name> interface, which you can just echo 0 or 1 to, or use morse(6) to send a message</li>
<li>gpioctl can be used to control the various GPIO pins</li>
<li>The post also covers how to setup the real-time clock on the Raspberry Pi</li>
<li>There is also limited support for adjusting the CPU frequency of the Pi</li>
<li>There are also tips on configuring a one-wire temperature sensor
***</li>
</ul>

<h3><a href="https://github.com/cyclaero/void-zones-tools" rel="nofollow">void-zones-tools for FreeBSD</a></h3>

<ul>
<li>Adblock has been in the news a bit recently, with some of the more popular browser plugins now accepting brib<sup>...contributions</sup> to permit specific ads through.</li>
<li>Well today the ad-blockers strike back. We have a great tutorial up on GitHub which demonstrates one of the useful features of using Unbound in FreeBSD to do your own ad-blocking with void-zones.</li>
<li>Specifically, void-zones are a way to return NXDOMAIN when DNS requests are made to known malicious or spam sites.</li>
<li>Using void-zones-tools software will make managing this easy, by being able to pull in known lists of sites to block from several 3rd party curators.</li>
<li>When coupled with our past tutorials on setting up your own FreeBSD router, this may become very useful for a lot of folks who want to do ad-blocking ad at a lower level, allowing it to filter smart-phones or any other devices on a network.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://raw.githubusercontent.com/sustrik/dsock/master/rfc/sock-api-revamp-01.txt" rel="nofollow">BSD Socket API Revamp</a></h3>

<ul>
<li>Martin Sustrik has started a draft RFC to revamp the BSD Sockets API:</li>
</ul>

<blockquote>
<p>The progress in the area of network protocols is distinctively lagging behind.  While every hobbyist new to the art of programming writes and publishes their small JavaScript libraries, there&#39;s no such thing going on with network protocols.  Indeed, it looks like the field of network protocols is dominated by big companies and academia, just like programming as a whole used to be before the advent of personal computers.</p>

<p>the API proposed in this document doesn&#39;t try to virtualize all possible aspects of all possible protocols and provide a single set of functions to deal with all of them.  Instead, it acknowledges how varied the protocol landscape is and how much the requirements for individual protocols differ.  Therefore, it lets each protocol define its own API and asks only for bare minimum of standardised behaviour needed to implement protocol composability.</p>

<p>As a consequence, the new API is much more lightweight and flexible than BSD socket API and allows to decompose today&#39;s monolithic protocol monsters into small single-purpose microprotocols that can be easily combined together to achieve desired functionality.</p>
</blockquote>

<ul>
<li>The idea behind the new design is to allow the software author to define their own protocols via a generic interface, and easily stack them on top of the existing network protocols, be they the basic protocols like TCP/IP, or a layer 7 protocol like HTTP</li>
<li>   Example of creating a stack of four protocols:
~~
   int s1 = tcp_connect(&quot;192.168.0.111:5555&quot;);
   int s2 = foo_start(s1, arg1, arg2, arg3);
   int s3 = bar_start(s2);
   int s4 = baz_start(s3, arg4, arg5);
~~</li>
<li>It also allows applying generic transformations to the protocols:
~~
   int tcps = tcp_connect(&quot;192.168.0.111:80&quot;);
   /* Websockets is a connected protocol. <em>/
   int ws = websock_connect(tcps);
   uint16_t compression_algoritm;
   mrecv(ws, &amp;compression_algorithm, 2, -1);
   /</em> Compression socket is unconnected. <em>/
   int cs = compress_start(ws, compression_algorithm);
~~
*</em>*</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2016-November/313140.html" rel="nofollow">Updated version of re(4) for DragonflyBSD</a></h3>

<ul>
<li>Sephe over at the Dragonfly project has issued a CFT for a newer version of the “re” driver</li>
<li>For those who don’t know, that is for Realtek nics, specifically his updates add features:</li>
</ul>

<blockquote>
<p>I have made an updated version of re(4), which leverages Realtek driver&#39;s chip/PHY reset/initialization code.  I hope it can resolve all kinds of weirdness we encountered on this chip so far.</p>
</blockquote>

<ul>
<li>Testers, you know what to do! Give this a whirl and let him know if you run into any new issues, or better yet, give feedback if it fixes some long-standing problems you’ve run into in the past.
***</li>
</ul>

<h3>Hackathon reports from OpenBSD’s B2K16</h3>

<ul>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20161112112023" rel="nofollow">b2k16 hackathon report: Jeremy Evans on ports cleaning, progress on postgres, nginx, ruby and more</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20161112095902" rel="nofollow">b2k16 hackathon report: Landry Breuil on various ports progress</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20161109030623" rel="nofollow">b2k16 hackathon report: Antoine Jacoutot on GNOME&#39;s path forward, various ports progress</a></p></li>
<li><p>We have a trio of hackathon reports from OpenBSD’s B2K16 (Recently held in Budapest)</p></li>
<li><p>First up - Jeremy Evans give us his rundown which starts with sweeping some of the cruft out of the barn:</p></li>
</ul>

<blockquote>
<p>I started off b2k16 by channeling tedu@, and removing a lot of ports, including lang/ruby/2.0, lang/io, convertors/ruby-json, databases/dbic++, databases/ruby-swift, databases/ruby-jdbc-*, x11/ruby-profiligacy, and mail/ruby-mailfactory.</p>
</blockquote>

<ul>
<li>After that, he talks about improvements made to postgres, nginx and ruby ports, fixing things such as pg_upgrade support, breaking nginx down into sub-packages and a major ruby update to about 50% of the packages.</li>
<li>Next up - Landry Breuil tells us about his trip, which also started with some major ports pruning, including some stale XFCE bits and drupal6. </li>
<li>One of the things he mentions is the Tor browser:</li>
</ul>

<blockquote>
<p>Found finally some time again to review properly the pending port for Tor Browser, even if i don&#39;t like the way it is developed (600+ patches against upstream firefox-esr !? even if relationship is improving..) nor will endorse its use, i feel that the time that was spent on porting it and updating it and maintaining it shouldn&#39;t be lost, and it should get commited - there are only some portswise minor tweaks to fix. Had a bit of discussions about that with other porters... </p>
</blockquote>

<ul>
<li>Lastly, Antoine Jacoutot gives us a smaller update on his work:</li>
</ul>

<blockquote>
<p>First task of this hackathon was for Jasper and I to upgrade to GNOME 3.22.1 (version 3.22.2 hit the ports tree since). As usual I already updated the core libraries a few days before so that we could start with a nice set of fully updated packages. It ended up being the fastest GNOME update ever, it all went very smoothly. We&#39;re still debating the future of GNOME on OpenBSD though. More and more features require systemd interfaces and without a replacement it may not make sense to keep it around. Implementing these interfaces requires time which Jasper and I don&#39;t really have these days... Anyway, we&#39;ll see.</p>
</blockquote>

<ul>
<li>All-n-all, a good trip it sounds like with some much needed hacking taking place. Good to see the cruft getting cleaned up, along with some new exciting ports landing.
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2016-07-2016-09.html" rel="nofollow">July to September 2016 Status Report</a></h3>

<ul>
<li>The latest FreeBSD quarterly status report is out</li>
<li>It includes the induction of the new Core team, and reports from all of the other teams, including Release Engineering, Port Manager, and the FreeBSD Foundation</li>
<li>Some other highlights:</li>
<li>Capsicum Update

<ul>
<li>The Graphics Stack on FreeBSD</li>
<li>Using lld, the LLVM Linker, to Link FreeBSD</li>
<li>VirtualBox Shared Folders Filesystem</li>
</ul></li>
<li>evdev support (better mouse, keyboard, and multi-touch support)

<ul>
<li>ZFS Code Sync with Latest OpenZFS/Illumos

<ul>
<li>The ARC now mostly stores compressed data, the same as is stored on disk, decompressing them on demand.</li>
<li>The L2ARC now stores the same (compressed) data as the ARC without recompression, and its RAM usage was further reduced.</li>
<li>The largest size of indirect block possible has been increased from 16KB to 128KB, and speculative prefetching of indirect blocks is now performed.</li>
</ul></li>
</ul></li>
<li>Improved ordering of space allocation.</li>
<li>The SHA-512t256 and Skein hashing algorithms are now supported.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.cs.cmu.edu/afs/cs/user/predragp/www/git.html" rel="nofollow">How to Host Your Own Private GitHub with Gogs</a></li>
<li><a href="https://yro.slashdot.org/story/16/11/07/1427257/nvidia-adds-telemetry-to-latest-drivers" rel="nofollow">Nvidia Adds Telemetry To Latest Drivers</a></li>
<li><a href="http://knoxbug.org/2016-11-29" rel="nofollow">KnoxBUG Upcoming Meeting</a> </li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/skvEgkLK" rel="nofollow"> William - Show Music</a> </li>
<li><a href="http://pastebin.com/nMDeSFGM" rel="nofollow"> Ray - Mounting a Cell Phone</a> </li>
<li><a href="http://pastebin.com/p5bC1jKU" rel="nofollow"> Ron - TrueOS + Radeon</a>  (Follow-up - He used nvidia card)</li>
<li><a href="http://pastebin.com/ud9vEK2C" rel="nofollow"> Kurt - ZFS Migration</a> </li>
<li><a href="http://pastebin.com/VPQfsUks" rel="nofollow"> Matt Dillon (Yes that Matt Dillon) - vkernels</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow. Allan and I are back from MeetBSD! A good time was had by all, lots to discuss, so let’s jump right into it on your place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://raymii.org/s/tutorials/FreeBSD_11.0-release_Openstack_Image.html" rel="nofollow">Build a FreeBSD 11.0-release Openstack Image with bsd-cloudinit</a></h3>

<blockquote>
<p>We are going to prepare a FreeBSD image for Openstack deployment. We do this by creating a FreeBSD 11.0-RELEASE instance, installing it and converting it using bsd-cloudinit. We&#39;ll use the CloudVPS public Openstack cloud for this. Create an account there and install the Openstack command line tools, like nova, cinder and glance.</p>

<p>A FreeBSD image with Cloud Init will automatically resize the disk to the size of the flavor and it will add your SSH key right at boot. You can use Cloud Config to execute a script at first boot, for example, to bootstrap your system into Puppet or Ansible. If you use Ansible to manage OpenStack instances you can integrate it without manually logging in or doing anything manually.</p>

<p>Since FreeBSD 10.2-RELEASE there is an rc script which, when the file /firstboot exists, expands the root filesystem to the full disk. While bsd-cloudinit does this as well, if you don&#39;t need the whole cloudinit stack, (when you use a static ssh key for example), you can touch that file to make sure the disk is expanded at the first boot</p>
</blockquote>

<ul>
<li>A detailed tutorial that shows how to create customized cloud images using the FreeBSD install media</li>
<li>There is also the option of using the FreeBSD release tools to build custom cloud images in a more headless fashion</li>
<li>Someone should make a tutorial out of that
***</li>
</ul>

<h3><a href="https://www.ixsystems.com/blog/ixsystems-announces-trueos-launch/" rel="nofollow">iXsystems Announces TrueOS Launch</a></h3>

<ul>
<li>As loyal listeners to this show, you’ve no doubt heard by now that we are in the middle of undergoing a shift in moving PC-BSD -&gt; TrueOS.</li>
<li>Last week during MeetBSD this was made “official” with iX issuing our press release and I was able to give a talk detailing many of the reasons and things going on with this change.</li>
<li>The talk should be available online here soon(ish), but for a quick recap:</li>
<li>TrueOS is moving to a rolling-release model based on FreeBSD -CURRENT</li>
<li>Lumina has become the default desktop for TrueOS</li>
<li>LibreSSL is enabled top to bottom</li>
<li>We are in the middle of working on conversion to OpenRC for run-control replacement</li>
<li>The TrueOS pico was announced, which is our “Thin-Client” solution, right now allowing you to use a TrueOS server pared with a RPI2 device. 
***</li>
</ul>

<h3><a href="https://vzaigrin.wordpress.com/2016/10/16/running-freebsd-11-on-raspberry-pi/" rel="nofollow">Running FreeBSD 11 on Raspberry Pi</a></h3>

<ul>
<li>This article covers some of the changes you will notice if you upgrade your RPI to FreeBSD 11.0</li>
<li>It covers some of the changes to WiFi in 11.0</li>
<li>Pro Tip: you can get a list of WiFi devices by doing: sysctl net.wlan.devices</li>
<li>There are official binary packages for ARM with 11.0, so you can just ‘pkg install’ your favourite apps</li>
<li>Many of the LEDs are exposed via the /dev/led/<name> interface, which you can just echo 0 or 1 to, or use morse(6) to send a message</li>
<li>gpioctl can be used to control the various GPIO pins</li>
<li>The post also covers how to setup the real-time clock on the Raspberry Pi</li>
<li>There is also limited support for adjusting the CPU frequency of the Pi</li>
<li>There are also tips on configuring a one-wire temperature sensor
***</li>
</ul>

<h3><a href="https://github.com/cyclaero/void-zones-tools" rel="nofollow">void-zones-tools for FreeBSD</a></h3>

<ul>
<li>Adblock has been in the news a bit recently, with some of the more popular browser plugins now accepting brib<sup>...contributions</sup> to permit specific ads through.</li>
<li>Well today the ad-blockers strike back. We have a great tutorial up on GitHub which demonstrates one of the useful features of using Unbound in FreeBSD to do your own ad-blocking with void-zones.</li>
<li>Specifically, void-zones are a way to return NXDOMAIN when DNS requests are made to known malicious or spam sites.</li>
<li>Using void-zones-tools software will make managing this easy, by being able to pull in known lists of sites to block from several 3rd party curators.</li>
<li>When coupled with our past tutorials on setting up your own FreeBSD router, this may become very useful for a lot of folks who want to do ad-blocking ad at a lower level, allowing it to filter smart-phones or any other devices on a network.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://raw.githubusercontent.com/sustrik/dsock/master/rfc/sock-api-revamp-01.txt" rel="nofollow">BSD Socket API Revamp</a></h3>

<ul>
<li>Martin Sustrik has started a draft RFC to revamp the BSD Sockets API:</li>
</ul>

<blockquote>
<p>The progress in the area of network protocols is distinctively lagging behind.  While every hobbyist new to the art of programming writes and publishes their small JavaScript libraries, there&#39;s no such thing going on with network protocols.  Indeed, it looks like the field of network protocols is dominated by big companies and academia, just like programming as a whole used to be before the advent of personal computers.</p>

<p>the API proposed in this document doesn&#39;t try to virtualize all possible aspects of all possible protocols and provide a single set of functions to deal with all of them.  Instead, it acknowledges how varied the protocol landscape is and how much the requirements for individual protocols differ.  Therefore, it lets each protocol define its own API and asks only for bare minimum of standardised behaviour needed to implement protocol composability.</p>

<p>As a consequence, the new API is much more lightweight and flexible than BSD socket API and allows to decompose today&#39;s monolithic protocol monsters into small single-purpose microprotocols that can be easily combined together to achieve desired functionality.</p>
</blockquote>

<ul>
<li>The idea behind the new design is to allow the software author to define their own protocols via a generic interface, and easily stack them on top of the existing network protocols, be they the basic protocols like TCP/IP, or a layer 7 protocol like HTTP</li>
<li>   Example of creating a stack of four protocols:
~~
   int s1 = tcp_connect(&quot;192.168.0.111:5555&quot;);
   int s2 = foo_start(s1, arg1, arg2, arg3);
   int s3 = bar_start(s2);
   int s4 = baz_start(s3, arg4, arg5);
~~</li>
<li>It also allows applying generic transformations to the protocols:
~~
   int tcps = tcp_connect(&quot;192.168.0.111:80&quot;);
   /* Websockets is a connected protocol. <em>/
   int ws = websock_connect(tcps);
   uint16_t compression_algoritm;
   mrecv(ws, &amp;compression_algorithm, 2, -1);
   /</em> Compression socket is unconnected. <em>/
   int cs = compress_start(ws, compression_algorithm);
~~
*</em>*</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2016-November/313140.html" rel="nofollow">Updated version of re(4) for DragonflyBSD</a></h3>

<ul>
<li>Sephe over at the Dragonfly project has issued a CFT for a newer version of the “re” driver</li>
<li>For those who don’t know, that is for Realtek nics, specifically his updates add features:</li>
</ul>

<blockquote>
<p>I have made an updated version of re(4), which leverages Realtek driver&#39;s chip/PHY reset/initialization code.  I hope it can resolve all kinds of weirdness we encountered on this chip so far.</p>
</blockquote>

<ul>
<li>Testers, you know what to do! Give this a whirl and let him know if you run into any new issues, or better yet, give feedback if it fixes some long-standing problems you’ve run into in the past.
***</li>
</ul>

<h3>Hackathon reports from OpenBSD’s B2K16</h3>

<ul>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20161112112023" rel="nofollow">b2k16 hackathon report: Jeremy Evans on ports cleaning, progress on postgres, nginx, ruby and more</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20161112095902" rel="nofollow">b2k16 hackathon report: Landry Breuil on various ports progress</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20161109030623" rel="nofollow">b2k16 hackathon report: Antoine Jacoutot on GNOME&#39;s path forward, various ports progress</a></p></li>
<li><p>We have a trio of hackathon reports from OpenBSD’s B2K16 (Recently held in Budapest)</p></li>
<li><p>First up - Jeremy Evans give us his rundown which starts with sweeping some of the cruft out of the barn:</p></li>
</ul>

<blockquote>
<p>I started off b2k16 by channeling tedu@, and removing a lot of ports, including lang/ruby/2.0, lang/io, convertors/ruby-json, databases/dbic++, databases/ruby-swift, databases/ruby-jdbc-*, x11/ruby-profiligacy, and mail/ruby-mailfactory.</p>
</blockquote>

<ul>
<li>After that, he talks about improvements made to postgres, nginx and ruby ports, fixing things such as pg_upgrade support, breaking nginx down into sub-packages and a major ruby update to about 50% of the packages.</li>
<li>Next up - Landry Breuil tells us about his trip, which also started with some major ports pruning, including some stale XFCE bits and drupal6. </li>
<li>One of the things he mentions is the Tor browser:</li>
</ul>

<blockquote>
<p>Found finally some time again to review properly the pending port for Tor Browser, even if i don&#39;t like the way it is developed (600+ patches against upstream firefox-esr !? even if relationship is improving..) nor will endorse its use, i feel that the time that was spent on porting it and updating it and maintaining it shouldn&#39;t be lost, and it should get commited - there are only some portswise minor tweaks to fix. Had a bit of discussions about that with other porters... </p>
</blockquote>

<ul>
<li>Lastly, Antoine Jacoutot gives us a smaller update on his work:</li>
</ul>

<blockquote>
<p>First task of this hackathon was for Jasper and I to upgrade to GNOME 3.22.1 (version 3.22.2 hit the ports tree since). As usual I already updated the core libraries a few days before so that we could start with a nice set of fully updated packages. It ended up being the fastest GNOME update ever, it all went very smoothly. We&#39;re still debating the future of GNOME on OpenBSD though. More and more features require systemd interfaces and without a replacement it may not make sense to keep it around. Implementing these interfaces requires time which Jasper and I don&#39;t really have these days... Anyway, we&#39;ll see.</p>
</blockquote>

<ul>
<li>All-n-all, a good trip it sounds like with some much needed hacking taking place. Good to see the cruft getting cleaned up, along with some new exciting ports landing.
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2016-07-2016-09.html" rel="nofollow">July to September 2016 Status Report</a></h3>

<ul>
<li>The latest FreeBSD quarterly status report is out</li>
<li>It includes the induction of the new Core team, and reports from all of the other teams, including Release Engineering, Port Manager, and the FreeBSD Foundation</li>
<li>Some other highlights:</li>
<li>Capsicum Update

<ul>
<li>The Graphics Stack on FreeBSD</li>
<li>Using lld, the LLVM Linker, to Link FreeBSD</li>
<li>VirtualBox Shared Folders Filesystem</li>
</ul></li>
<li>evdev support (better mouse, keyboard, and multi-touch support)

<ul>
<li>ZFS Code Sync with Latest OpenZFS/Illumos

<ul>
<li>The ARC now mostly stores compressed data, the same as is stored on disk, decompressing them on demand.</li>
<li>The L2ARC now stores the same (compressed) data as the ARC without recompression, and its RAM usage was further reduced.</li>
<li>The largest size of indirect block possible has been increased from 16KB to 128KB, and speculative prefetching of indirect blocks is now performed.</li>
</ul></li>
</ul></li>
<li>Improved ordering of space allocation.</li>
<li>The SHA-512t256 and Skein hashing algorithms are now supported.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://www.cs.cmu.edu/afs/cs/user/predragp/www/git.html" rel="nofollow">How to Host Your Own Private GitHub with Gogs</a></li>
<li><a href="https://yro.slashdot.org/story/16/11/07/1427257/nvidia-adds-telemetry-to-latest-drivers" rel="nofollow">Nvidia Adds Telemetry To Latest Drivers</a></li>
<li><a href="http://knoxbug.org/2016-11-29" rel="nofollow">KnoxBUG Upcoming Meeting</a> </li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/skvEgkLK" rel="nofollow"> William - Show Music</a> </li>
<li><a href="http://pastebin.com/nMDeSFGM" rel="nofollow"> Ray - Mounting a Cell Phone</a> </li>
<li><a href="http://pastebin.com/p5bC1jKU" rel="nofollow"> Ron - TrueOS + Radeon</a>  (Follow-up - He used nvidia card)</li>
<li><a href="http://pastebin.com/ud9vEK2C" rel="nofollow"> Kurt - ZFS Migration</a> </li>
<li><a href="http://pastebin.com/VPQfsUks" rel="nofollow"> Matt Dillon (Yes that Matt Dillon) - vkernels</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>167: Playing the Long Game</title>
  <link>https://www.bsdnow.tv/167</link>
  <guid isPermaLink="false">ebe3203d-b267-46aa-84af-9a1a3f861c02</guid>
  <pubDate>Wed, 09 Nov 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ebe3203d-b267-46aa-84af-9a1a3f861c02.mp3" length="34410964" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, Allan &amp; Kris are out at MeetBSD, but we never forget our loyal listeners. We have a great interview Allan did with Scott Long of Netflix &amp; FreeBSD fame, as well as your questions on the place to B...SD!</itunes:subtitle>
  <itunes:duration>47:47</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, Allan &amp;amp; Kris are out at MeetBSD, but we never forget our loyal listeners. We have a great interview Allan did with Scott Long of Netflix &amp;amp; FreeBSD fame, as well as your questions on the place to B...SD!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Interview - Scott Long - scottl@freebsd.org (mailto:scottl@freebsd.org)
FreeBSD &amp;amp; Netflix
***
Feedback/Questions
Zack - USB Config (http://pastebin.com/u77LE0Md) 
Jens - VMs, Jails and Containers (http://pastebin.com/8KwDK6ay) 
Ranko - Tarsnap Keys (http://pastebin.com/Kie3EcjN) 
Alex - OpenBSD in Hyper-V (http://pastebin.com/nRJQ7UPZ) 
Curt - Discussion Segment (http://pastebin.com/ndx25pQA) 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, Allan &amp; Kris are out at MeetBSD, but we never forget our loyal listeners. We have a great interview Allan did with Scott Long of Netflix &amp; FreeBSD fame, as well as your questions on the place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Scott Long - <a href="mailto:scottl@freebsd.org" rel="nofollow">scottl@freebsd.org</a></h2>

<ul>
<li>FreeBSD &amp; Netflix
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/u77LE0Md" rel="nofollow">Zack - USB Config</a> </li>
<li><a href="http://pastebin.com/8KwDK6ay" rel="nofollow">Jens - VMs, Jails and Containers</a> </li>
<li><a href="http://pastebin.com/Kie3EcjN" rel="nofollow">Ranko - Tarsnap Keys</a> </li>
<li><a href="http://pastebin.com/nRJQ7UPZ" rel="nofollow">Alex - OpenBSD in Hyper-V</a> </li>
<li><a href="http://pastebin.com/ndx25pQA" rel="nofollow">Curt - Discussion Segment</a> </li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, Allan &amp; Kris are out at MeetBSD, but we never forget our loyal listeners. We have a great interview Allan did with Scott Long of Netflix &amp; FreeBSD fame, as well as your questions on the place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Scott Long - <a href="mailto:scottl@freebsd.org" rel="nofollow">scottl@freebsd.org</a></h2>

<ul>
<li>FreeBSD &amp; Netflix
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/u77LE0Md" rel="nofollow">Zack - USB Config</a> </li>
<li><a href="http://pastebin.com/8KwDK6ay" rel="nofollow">Jens - VMs, Jails and Containers</a> </li>
<li><a href="http://pastebin.com/Kie3EcjN" rel="nofollow">Ranko - Tarsnap Keys</a> </li>
<li><a href="http://pastebin.com/nRJQ7UPZ" rel="nofollow">Alex - OpenBSD in Hyper-V</a> </li>
<li><a href="http://pastebin.com/ndx25pQA" rel="nofollow">Curt - Discussion Segment</a> </li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>166: Pass that UNIX Pipe</title>
  <link>https://www.bsdnow.tv/166</link>
  <guid isPermaLink="false">13a56673-8f9c-4198-9f01-4f28143ec2f9</guid>
  <pubDate>Wed, 02 Nov 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/13a56673-8f9c-4198-9f01-4f28143ec2f9.mp3" length="39795412" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we’re loaded up with great stories ranging from System call fuzzing, a history of UNIX Pipes, speeding up MySQL imports and more. Stay tuned, BSDNow is coming your way right now.</itunes:subtitle>
  <itunes:duration>55:16</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we’re loaded up with great stories ranging from System call fuzzing, a history of UNIX Pipes, speeding up MySQL imports and more. Stay tuned, BSDNow is coming your way right now.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
System call fuzzing of OpenBSD amd64 using TriforceAFL (i.e. AFL and QEMU) (https://github.com/nccgroup/TriforceOpenBSDFuzzer)
The NCCGroup did a series of fuzz testing against the OpenBSD syscall interface, during which they found a number of vulnerabilities, we covered this back in the early summer
What we didn’t notice, is that they also made the tools they used available.
A combination of AFL (American Fuzzy Lop), QEMU, OpenBSD’s FlashRD image generation tool, and the “Triforce” driver
The other requirement is “a Linux box as host to run the fuzzer (other fuzzer hosts may work as well, we've only run TriforceAFL from a Linux host, specifically Debian/Ubuntu”
It would be interesting to see if someone could get this to run from a BSD host
It would also be interesting to run the same tests against the other BSDs
***
On the Early History and Impact of Unix: the Introduction of Pipes (http://people.fas.harvard.edu/~lib113/reference/unix/unix2.html)
Pipes are something we just take for granted today, but there was a time before pipes (How did anything get done?)
Ronda Hauben writes up a great look back at the beginning of UNIX, and specifically at how pipes were born:
One of the important developments in Unix was the introduction of pipes. Pipes had been suggested by McIlroy during the early days of creating Unix. Ritchie explains how "the idea, explained one afternoon on a blackboard, intrigued us but failed to ignite any immediate action. There were several objections to the idea as put....What a failure of imagination," he admits.(35) McIlroy concurs, describing how the initial effort to add pipes to Unix occurred about the same time in 1969 that Ritchie, Thompson and Canaday were outlining ideas for a file system. "That was when," he writes, "the simple pipeline as a way to combine programs, with data notationally propagating along a chain of (not necessarily concurrent) filters was articulated."(36) However, pipes weren't implemented in Unix until 1972. 
We also have a great quote from McIlroy on the day pipes were first introduced:
Open Systems! Our Systems! How well those who were there remember the pipe-festooned garret where Unix took form. The excitement of creation drew people to work there amidst the whine of the computer's cool- ing fans, even though almost the same computer ac- cess, could be had from one's office or from home. Those raw quarters saw a procession of memorable events. The advent of software pipes precipitated a day-long orgy of one-liners....As people reveled in the power of functional composition in the large, which is even today unavailable to users of other systems.
The paper goes on to talk about the invention of other important tools, such as “grep”, “diff” and more. Well worth your time if you want a glimpse into the history of UNIX
***
Speeding up MySQL Import on FreeBSD (https://blog.feld.me/posts/2016/09/speeding-up-mysql-import-on-freebsd/)
Mark Felder writes a blog post explaining how to speed up MySQL bulk data imports
“I was recently tasked with rebuilding a readonly slave database server which only slaves a couple of the available databases. The backup/dump is straightforward and fast, but the restore was being excruciatingly slow. I didn't want to wait a week for this thing to finish, so I had to compile a list of optimizations that would speed up the process. This is the best way to do it on FreeBSD, assuming you're working with InnoDB. Additional optimizations may be required if you're using a different database engine.”
“Please note this is assuming no other databases are running on this MySQL instance. Some of these are rather dangerous and you wouldn't want to put other live data at risk.”
Most of the changes are meant to be temporary, used on a new server to import a dump of the database, then the settings are to be turned off.
Specifically:
sync_binlog = 0
innodbflushlogattrx_commit = 0
innodb-doublewrite = 0
He also prepends the following but of SQL before importing the data:
set sqllogbin=0; set autocommit=0; set uniquechecks=0; set foreignkey_checks=0;
You can also help yourself if your MySQL database lives on ZFS
zfs set recordsize=16k pool/var/db/mysql
zfs set redundant_metadata=most pool/var/db/mysql
Remember, this tuning is ONLY for the initial import, leaving these settings on long term risks losing 5-10 seconds of your data if the server reboots unexpectedly
zfs set sync=disabled pool/var/db/mysql
zfs set logbias=throughput pool/var/db/mysql
***
PostgreSQL and FreeBSD Quick Start (https://cwharton.com/blog/2016/10/postgresql-and-freebsd-quick-start/)
There’s lots of databases to choose from, but Postgres always has a special place on FreeBSD. Today we have a look at a ‘getting started’ guide for those taking the plunge and using it for the first time.
Naturally getting started will look familiar to many, a couple simple “pkg” and “sysrc” commands later, and you’ll be set.
After starting the service (With the “service” command) you’ll be ready to start setting up your postgres instance.
Next up you’ll need to create your initial user/password combo, and a database with access granted to this particular user.
If you plan to enable remote access to this DB server, you’ll need to make some adjustments to one of the .conf files, allowing other IP’s to connect. (If you are hosting something on the same system, this may not be needed)
Now yous should be good to go! Enjoy using your brand new Postgres database. If this is your first rodeo, maybe start with something easy, like Apache or Nginx + Wordpress to try it out.
***
News Roundup
OpenBSD vmm hypervisor test drive (https://www.youtube.com/watch?v=KE_7E1pXy5c)
As we asked for a week or two ago, someone has taken OpenBSD’s vmm for a test drive, and made a video of it
The command line interface for vmm, vmctl, looks quite easy to use. It takes an approach much closer to some of the bhyve management frameworks, rather than bhyve’s rather confusing set of switches
It also has a config file, the format of which looks very similar to what I designed for bhyveucl, and my first effort to integrate a config file into bhyve itself.
The video also looks at accessing the console, configuring the networking, and doing an OpenBSD install in a fresh VM
Currently vmm only supports running OpenBSD VMs
***
FreeBSD Foundation October 2016 Update (https://www.freebsdfoundation.org/wp-content/uploads/2016/10/FreeBSD-Foundation-October-2016-Update.pdf)
Wow, November is already upon us with the Holidays just around the corner. Before things get lost in the noise we wanted to highlight this update from the FreeBSD foundation.
Before getting into the stories, they helpfully provide a list of upcoming conferences for this fall/winter, which includes a couple of USENIX gatherings, and the Developer Summit / MeetBSD next week.
+The foundation gives us a quick hardware update initially, discussing some of the new ThunderX Cavium servers which are deployed (ARMv8 64Bit) and yes I’m drooling a bit. They also mention that work is ongoing for the RPi3 platform and PINE64.
GNN also has an article reprinted from the FreeBSD journal, talking about the achievement of making it to 11.0 over the span of 23 years now. Of course he mentions that the foundation is open to all, and welcomes donations to continue to keep up this tradition of good work being done.
Deb Goodkin gives us an update on the “Grace Hopper” convention that took place in Houston TX several weeks back. Roughly 14k women in Tech attended, which is a great turnout, and FreeBSD was well represented there.
Next we have a call to potential speakers, don’t forget that there are plenty of places you can help present about FreeBSD, not just at *BSD centered conferences, but the SCALES of the world as well.
We wrap up with a look at EuroBSDCon 2016, quite a nice writeup, again brought to us by Deb at the foundation, and includes a list of some of those recognized for their contributions to FreeBSD.
***
Adhokku – a toy PaaS powered by FreeBSD jails and Ansible (https://github.com/adhokku/adhokku)
Described as a toy Platform-as-a-Service, Adhokku is an ansible based automated jail creation framework
Based on the concept of Dokku, a single-host open source PaaS for Linux powered by Docker
When you deploy an application using Adhokku, Adhokku creates a new jail on the remote host and provisions it from a fixed clean state using the instructions in the Jailfile in your Git repository. All jails sit behind a reverse proxy that directs traffic to one of them based on the domain name or the IP address in the HTTP request. When a new jail has been provisioned for an application, Adhokku seamlessly reconfigures the reverse proxy to send traffic to it instead of the one currently active for that application.
The following instructions show how to get Adhokku and an example application running in a VM on your development machine using Vagrant. This process should require no FreeBSD-specific knowledge, through modifying the Jailfile to customize the application may.
This seems like an interesting project, and it is good to see people developing workflows so users familiar with docker etc, can easily use BSD instead
***
Installing OpenBSD 6.0 on your laptop is really hard (not) (http://sohcahtoa.org.uk/openbsd.html)
OpenBSD on a laptop? Difficult? Not hardly.
We have a great walkthrough by Keith Burnett, which demonstrates just how easy it can be to get up and running with an XFCE desktop from a fresh OpenBSD installation.
For those curious,this was all done with a Thinkpad X60 and 120GB SSD and OpenBSD 6.0.
He doesn’t really cover the install process itself, that is well covered by the link to the OpenBSD FAQ pages.
Once the system is up and running though, we start with the most important portion, getting working internet access (Via wifi)
Really just a few ‘ifconfig’ commands later and we are in business.
Step 2 was getting the package configuration going. (I’ve never understood why this is still a thing, but no fret, its easy enough to do)
With package repos available, now you can grab the binaries for XFCE and friends with just a few simple “pkg_add” commands
Steps 4-6 are some specific bits to enable XFCE services, and some handy things such as setting doas permissions to get USB mounting working (For graphical mount/unmount)
Lastly, keeping the system updated is important, so we have a nice tutorial on how to do that as well, using a handy “openup” script, which takes some of the guesswork out of it.
Bonus! Steps for doing FDE as also included, which isn’t for everyone, but you may want it
***
Beastie Bits
Pi-top with RPi-3 and FreeBSD HEAD (https://twitter.com/gvnn3/status/791475373380804608)
NetBSD 7.0.2 released (http://blog.netbsd.org/tnf/entry/netbsd_7_0_1_released1)
DragonflyBSD - git: kernel - Fix mmcsd read/write issues (http://lists.dragonflybsd.org/pipermail/commits/2016-October/624851.html)
A char device which implements an Enigma machine (FreeBSD &amp;amp; Linux) (https://github.com/rafael-santiago/dev-enigma)
***
Feedback/Questions
 Matt - System Monitoring (http://pastebin.com/ayzvCuaq) 
 Tony - LLVM License (http://pastebin.com/r5axPSE7) 
 Ben - Thanks (http://pastebin.com/MNxCvUtX) 
 David - Write Cache  (http://pastebin.com/RswFASqW) 
 Charles - Fonts (http://pastebin.com/e317a32f) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we’re loaded up with great stories ranging from System call fuzzing, a history of UNIX Pipes, speeding up MySQL imports and more. Stay tuned, BSDNow is coming your way right now.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://github.com/nccgroup/TriforceOpenBSDFuzzer" rel="nofollow">System call fuzzing of OpenBSD amd64 using TriforceAFL (i.e. AFL and QEMU)</a></h3>

<ul>
<li>The NCCGroup did a series of fuzz testing against the OpenBSD syscall interface, during which they found a number of vulnerabilities, we covered this back in the early summer</li>
<li>What we didn’t notice, is that they also made the tools they used available.</li>
<li>A combination of AFL (American Fuzzy Lop), QEMU, OpenBSD’s FlashRD image generation tool, and the “Triforce” driver</li>
<li>The other requirement is “a Linux box as host to run the fuzzer (other fuzzer hosts may work as well, we&#39;ve only run TriforceAFL from a Linux host, specifically Debian/Ubuntu”</li>
<li>It would be interesting to see if someone could get this to run from a BSD host</li>
<li>It would also be interesting to run the same tests against the other BSDs
***</li>
</ul>

<h3><a href="http://people.fas.harvard.edu/%7Elib113/reference/unix/unix2.html" rel="nofollow">On the Early History and Impact of Unix: the Introduction of Pipes</a></h3>

<ul>
<li>Pipes are something we just take for granted today, but there was a time before pipes (How did anything get done?)</li>
<li>Ronda Hauben writes up a great look back at the beginning of UNIX, and specifically at how pipes were born:</li>
</ul>

<blockquote>
<p>One of the important developments in Unix was the introduction of pipes. Pipes had been suggested by McIlroy during the early days of creating Unix. Ritchie explains how &quot;the idea, explained one afternoon on a blackboard, intrigued us but failed to ignite any immediate action. There were several objections to the idea as put....What a failure of imagination,&quot; he admits.(35) McIlroy concurs, describing how the initial effort to add pipes to Unix occurred about the same time in 1969 that Ritchie, Thompson and Canaday were outlining ideas for a file system. &quot;That was when,&quot; he writes, &quot;the simple pipeline as a way to combine programs, with data notationally propagating along a chain of (not necessarily concurrent) filters was articulated.&quot;(36) However, pipes weren&#39;t implemented in Unix until 1972. </p>
</blockquote>

<ul>
<li>We also have a great quote from McIlroy on the day pipes were first introduced:</li>
</ul>

<blockquote>
<p>Open Systems! Our Systems! How well those who were there remember the pipe-festooned garret where Unix took form. The excitement of creation drew people to work there amidst the whine of the computer&#39;s cool- ing fans, even though almost the same computer ac- cess, could be had from one&#39;s office or from home. Those raw quarters saw a procession of memorable events. The advent of software pipes precipitated a day-long orgy of one-liners....As people reveled in the power of functional composition in the large, which is even today unavailable to users of other systems.</p>
</blockquote>

<ul>
<li>The paper goes on to talk about the invention of other important tools, such as “grep”, “diff” and more. Well worth your time if you want a glimpse into the history of UNIX
***</li>
</ul>

<h3><a href="https://blog.feld.me/posts/2016/09/speeding-up-mysql-import-on-freebsd/" rel="nofollow">Speeding up MySQL Import on FreeBSD</a></h3>

<ul>
<li>Mark Felder writes a blog post explaining how to speed up MySQL bulk data imports</li>
<li>“I was recently tasked with rebuilding a readonly slave database server which only slaves a couple of the available databases. The backup/dump is straightforward and fast, but the restore was being excruciatingly slow. I didn&#39;t want to wait a week for this thing to finish, so I had to compile a list of optimizations that would speed up the process. This is the best way to do it on FreeBSD, assuming you&#39;re working with InnoDB. Additional optimizations may be required if you&#39;re using a different database engine.”</li>
<li>“Please note this is assuming no other databases are running on this MySQL instance. Some of these are rather dangerous and you wouldn&#39;t want to put other live data at risk.”</li>
<li>Most of the changes are meant to be temporary, used on a new server to import a dump of the database, then the settings are to be turned off.</li>
<li><p>Specifically:</p>

<ul>
<li>sync_binlog = 0</li>
<li>innodb_flush_log_at_trx_commit = 0</li>
<li>innodb-doublewrite = 0</li>
</ul></li>
<li><p>He also prepends the following but of SQL before importing the data:</p>

<ul>
<li>set sql_log_bin=0; set autocommit=0; set unique_checks=0; set foreign_key_checks=0;</li>
</ul></li>
<li><p>You can also help yourself if your MySQL database lives on ZFS</p>

<ul>
<li>zfs set recordsize=16k pool/var/db/mysql</li>
<li>zfs set redundant_metadata=most pool/var/db/mysql</li>
</ul></li>
<li><p>Remember, this tuning is ONLY for the initial import, leaving these settings on long term risks losing 5-10 seconds of your data if the server reboots unexpectedly</p>

<ul>
<li>zfs set sync=disabled pool/var/db/mysql</li>
<li>zfs set logbias=throughput pool/var/db/mysql
***</li>
</ul></li>
</ul>

<h3><a href="https://cwharton.com/blog/2016/10/postgresql-and-freebsd-quick-start/" rel="nofollow">PostgreSQL and FreeBSD Quick Start</a></h3>

<ul>
<li>There’s lots of databases to choose from, but Postgres always has a special place on FreeBSD. Today we have a look at a ‘getting started’ guide for those taking the plunge and using it for the first time.</li>
<li>Naturally getting started will look familiar to many, a couple simple “pkg” and “sysrc” commands later, and you’ll be set.</li>
<li>After starting the service (With the “service” command) you’ll be ready to start setting up your postgres instance.</li>
<li>Next up you’ll need to create your initial user/password combo, and a database with access granted to this particular user.</li>
<li>If you plan to enable remote access to this DB server, you’ll need to make some adjustments to one of the .conf files, allowing other IP’s to connect. (If you are hosting something on the same system, this may not be needed)</li>
<li>Now yous should be good to go! Enjoy using your brand new Postgres database. If this is your first rodeo, maybe start with something easy, like Apache or Nginx + Wordpress to try it out.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.youtube.com/watch?v=KE_7E1pXy5c" rel="nofollow">OpenBSD vmm hypervisor test drive</a></h3>

<ul>
<li>As we asked for a week or two ago, someone has taken OpenBSD’s vmm for a test drive, and made a video of it</li>
<li>The command line interface for vmm, vmctl, looks quite easy to use. It takes an approach much closer to some of the bhyve management frameworks, rather than bhyve’s rather confusing set of switches</li>
<li>It also has a config file, the format of which looks very similar to what I designed for bhyveucl, and my first effort to integrate a config file into bhyve itself.</li>
<li>The video also looks at accessing the console, configuring the networking, and doing an OpenBSD install in a fresh VM</li>
<li>Currently vmm only supports running OpenBSD VMs
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/wp-content/uploads/2016/10/FreeBSD-Foundation-October-2016-Update.pdf" rel="nofollow">FreeBSD Foundation October 2016 Update</a></h3>

<ul>
<li>Wow, November is already upon us with the Holidays just around the corner. Before things get lost in the noise we wanted to highlight this update from the FreeBSD foundation.</li>
<li>Before getting into the stories, they helpfully provide a list of upcoming conferences for this fall/winter, which includes a couple of USENIX gatherings, and the Developer Summit / MeetBSD next week.
+The foundation gives us a quick hardware update initially, discussing some of the new ThunderX Cavium servers which are deployed (ARMv8 64Bit) and yes I’m drooling a bit. They also mention that work is ongoing for the RPi3 platform and PINE64.</li>
<li>GNN also has an article reprinted from the FreeBSD journal, talking about the achievement of making it to 11.0 over the span of 23 years now. Of course he mentions that the foundation is open to all, and welcomes donations to continue to keep up this tradition of good work being done.</li>
<li>Deb Goodkin gives us an update on the “Grace Hopper” convention that took place in Houston TX several weeks back. Roughly 14k women in Tech attended, which is a great turnout, and FreeBSD was well represented there.</li>
<li>Next we have a call to potential speakers, don’t forget that there are plenty of places you can help present about FreeBSD, not just at *BSD centered conferences, but the SCALES of the world as well.</li>
<li>We wrap up with a look at EuroBSDCon 2016, quite a nice writeup, again brought to us by Deb at the foundation, and includes a list of some of those recognized for their contributions to FreeBSD.
***</li>
</ul>

<h3><a href="https://github.com/adhokku/adhokku" rel="nofollow">Adhokku – a toy PaaS powered by FreeBSD jails and Ansible</a></h3>

<ul>
<li>Described as a toy Platform-as-a-Service, Adhokku is an ansible based automated jail creation framework</li>
<li>Based on the concept of Dokku, a single-host open source PaaS for Linux powered by Docker</li>
</ul>

<blockquote>
<p>When you deploy an application using Adhokku, Adhokku creates a new jail on the remote host and provisions it from a fixed clean state using the instructions in the Jailfile in your Git repository. All jails sit behind a reverse proxy that directs traffic to one of them based on the domain name or the IP address in the HTTP request. When a new jail has been provisioned for an application, Adhokku seamlessly reconfigures the reverse proxy to send traffic to it instead of the one currently active for that application.</p>

<p>The following instructions show how to get Adhokku and an example application running in a VM on your development machine using Vagrant. This process should require no FreeBSD-specific knowledge, through modifying the Jailfile to customize the application may.</p>
</blockquote>

<ul>
<li>This seems like an interesting project, and it is good to see people developing workflows so users familiar with docker etc, can easily use BSD instead
***</li>
</ul>

<h3><a href="http://sohcahtoa.org.uk/openbsd.html" rel="nofollow">Installing OpenBSD 6.0 on your laptop is really hard (not)</a></h3>

<ul>
<li>OpenBSD on a laptop? Difficult? Not hardly.</li>
<li>We have a great walkthrough by Keith Burnett, which demonstrates just how easy it can be to get up and running with an XFCE desktop from a fresh OpenBSD installation.</li>
<li>For those curious,this was all done with a Thinkpad X60 and 120GB SSD and OpenBSD 6.0.</li>
<li>He doesn’t really cover the install process itself, that is well covered by the link to the OpenBSD FAQ pages.</li>
<li>Once the system is up and running though, we start with the most important portion, getting working internet access (Via wifi)</li>
<li>Really just a few ‘ifconfig’ commands later and we are in business.</li>
<li>Step 2 was getting the package configuration going. (I’ve never understood why this is still a thing, but no fret, its easy enough to do)</li>
<li>With package repos available, now you can grab the binaries for XFCE and friends with just a few simple “pkg_add” commands</li>
<li>Steps 4-6 are some specific bits to enable XFCE services, and some handy things such as setting doas permissions to get USB mounting working (For graphical mount/unmount)</li>
<li>Lastly, keeping the system updated is important, so we have a nice tutorial on how to do that as well, using a handy “openup” script, which takes some of the guesswork out of it.</li>
<li>Bonus! Steps for doing FDE as also included, which isn’t for everyone, but you may want it
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/gvnn3/status/791475373380804608" rel="nofollow">Pi-top with RPi-3 and FreeBSD HEAD</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/netbsd_7_0_1_released1" rel="nofollow">NetBSD 7.0.2 released</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-October/624851.html" rel="nofollow">DragonflyBSD - git: kernel - Fix mmcsd read/write issues</a></li>
<li><a href="https://github.com/rafael-santiago/dev-enigma" rel="nofollow">A char device which implements an Enigma machine (FreeBSD &amp; Linux)</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/ayzvCuaq" rel="nofollow"> Matt - System Monitoring</a> </li>
<li><a href="http://pastebin.com/r5axPSE7" rel="nofollow"> Tony - LLVM License</a> </li>
<li><a href="http://pastebin.com/MNxCvUtX" rel="nofollow"> Ben - Thanks</a> </li>
<li><a href="http://pastebin.com/RswFASqW" rel="nofollow"> David - Write Cache </a> </li>
<li><a href="http://pastebin.com/e317a32f" rel="nofollow"> Charles - Fonts</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we’re loaded up with great stories ranging from System call fuzzing, a history of UNIX Pipes, speeding up MySQL imports and more. Stay tuned, BSDNow is coming your way right now.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://github.com/nccgroup/TriforceOpenBSDFuzzer" rel="nofollow">System call fuzzing of OpenBSD amd64 using TriforceAFL (i.e. AFL and QEMU)</a></h3>

<ul>
<li>The NCCGroup did a series of fuzz testing against the OpenBSD syscall interface, during which they found a number of vulnerabilities, we covered this back in the early summer</li>
<li>What we didn’t notice, is that they also made the tools they used available.</li>
<li>A combination of AFL (American Fuzzy Lop), QEMU, OpenBSD’s FlashRD image generation tool, and the “Triforce” driver</li>
<li>The other requirement is “a Linux box as host to run the fuzzer (other fuzzer hosts may work as well, we&#39;ve only run TriforceAFL from a Linux host, specifically Debian/Ubuntu”</li>
<li>It would be interesting to see if someone could get this to run from a BSD host</li>
<li>It would also be interesting to run the same tests against the other BSDs
***</li>
</ul>

<h3><a href="http://people.fas.harvard.edu/%7Elib113/reference/unix/unix2.html" rel="nofollow">On the Early History and Impact of Unix: the Introduction of Pipes</a></h3>

<ul>
<li>Pipes are something we just take for granted today, but there was a time before pipes (How did anything get done?)</li>
<li>Ronda Hauben writes up a great look back at the beginning of UNIX, and specifically at how pipes were born:</li>
</ul>

<blockquote>
<p>One of the important developments in Unix was the introduction of pipes. Pipes had been suggested by McIlroy during the early days of creating Unix. Ritchie explains how &quot;the idea, explained one afternoon on a blackboard, intrigued us but failed to ignite any immediate action. There were several objections to the idea as put....What a failure of imagination,&quot; he admits.(35) McIlroy concurs, describing how the initial effort to add pipes to Unix occurred about the same time in 1969 that Ritchie, Thompson and Canaday were outlining ideas for a file system. &quot;That was when,&quot; he writes, &quot;the simple pipeline as a way to combine programs, with data notationally propagating along a chain of (not necessarily concurrent) filters was articulated.&quot;(36) However, pipes weren&#39;t implemented in Unix until 1972. </p>
</blockquote>

<ul>
<li>We also have a great quote from McIlroy on the day pipes were first introduced:</li>
</ul>

<blockquote>
<p>Open Systems! Our Systems! How well those who were there remember the pipe-festooned garret where Unix took form. The excitement of creation drew people to work there amidst the whine of the computer&#39;s cool- ing fans, even though almost the same computer ac- cess, could be had from one&#39;s office or from home. Those raw quarters saw a procession of memorable events. The advent of software pipes precipitated a day-long orgy of one-liners....As people reveled in the power of functional composition in the large, which is even today unavailable to users of other systems.</p>
</blockquote>

<ul>
<li>The paper goes on to talk about the invention of other important tools, such as “grep”, “diff” and more. Well worth your time if you want a glimpse into the history of UNIX
***</li>
</ul>

<h3><a href="https://blog.feld.me/posts/2016/09/speeding-up-mysql-import-on-freebsd/" rel="nofollow">Speeding up MySQL Import on FreeBSD</a></h3>

<ul>
<li>Mark Felder writes a blog post explaining how to speed up MySQL bulk data imports</li>
<li>“I was recently tasked with rebuilding a readonly slave database server which only slaves a couple of the available databases. The backup/dump is straightforward and fast, but the restore was being excruciatingly slow. I didn&#39;t want to wait a week for this thing to finish, so I had to compile a list of optimizations that would speed up the process. This is the best way to do it on FreeBSD, assuming you&#39;re working with InnoDB. Additional optimizations may be required if you&#39;re using a different database engine.”</li>
<li>“Please note this is assuming no other databases are running on this MySQL instance. Some of these are rather dangerous and you wouldn&#39;t want to put other live data at risk.”</li>
<li>Most of the changes are meant to be temporary, used on a new server to import a dump of the database, then the settings are to be turned off.</li>
<li><p>Specifically:</p>

<ul>
<li>sync_binlog = 0</li>
<li>innodb_flush_log_at_trx_commit = 0</li>
<li>innodb-doublewrite = 0</li>
</ul></li>
<li><p>He also prepends the following but of SQL before importing the data:</p>

<ul>
<li>set sql_log_bin=0; set autocommit=0; set unique_checks=0; set foreign_key_checks=0;</li>
</ul></li>
<li><p>You can also help yourself if your MySQL database lives on ZFS</p>

<ul>
<li>zfs set recordsize=16k pool/var/db/mysql</li>
<li>zfs set redundant_metadata=most pool/var/db/mysql</li>
</ul></li>
<li><p>Remember, this tuning is ONLY for the initial import, leaving these settings on long term risks losing 5-10 seconds of your data if the server reboots unexpectedly</p>

<ul>
<li>zfs set sync=disabled pool/var/db/mysql</li>
<li>zfs set logbias=throughput pool/var/db/mysql
***</li>
</ul></li>
</ul>

<h3><a href="https://cwharton.com/blog/2016/10/postgresql-and-freebsd-quick-start/" rel="nofollow">PostgreSQL and FreeBSD Quick Start</a></h3>

<ul>
<li>There’s lots of databases to choose from, but Postgres always has a special place on FreeBSD. Today we have a look at a ‘getting started’ guide for those taking the plunge and using it for the first time.</li>
<li>Naturally getting started will look familiar to many, a couple simple “pkg” and “sysrc” commands later, and you’ll be set.</li>
<li>After starting the service (With the “service” command) you’ll be ready to start setting up your postgres instance.</li>
<li>Next up you’ll need to create your initial user/password combo, and a database with access granted to this particular user.</li>
<li>If you plan to enable remote access to this DB server, you’ll need to make some adjustments to one of the .conf files, allowing other IP’s to connect. (If you are hosting something on the same system, this may not be needed)</li>
<li>Now yous should be good to go! Enjoy using your brand new Postgres database. If this is your first rodeo, maybe start with something easy, like Apache or Nginx + Wordpress to try it out.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.youtube.com/watch?v=KE_7E1pXy5c" rel="nofollow">OpenBSD vmm hypervisor test drive</a></h3>

<ul>
<li>As we asked for a week or two ago, someone has taken OpenBSD’s vmm for a test drive, and made a video of it</li>
<li>The command line interface for vmm, vmctl, looks quite easy to use. It takes an approach much closer to some of the bhyve management frameworks, rather than bhyve’s rather confusing set of switches</li>
<li>It also has a config file, the format of which looks very similar to what I designed for bhyveucl, and my first effort to integrate a config file into bhyve itself.</li>
<li>The video also looks at accessing the console, configuring the networking, and doing an OpenBSD install in a fresh VM</li>
<li>Currently vmm only supports running OpenBSD VMs
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/wp-content/uploads/2016/10/FreeBSD-Foundation-October-2016-Update.pdf" rel="nofollow">FreeBSD Foundation October 2016 Update</a></h3>

<ul>
<li>Wow, November is already upon us with the Holidays just around the corner. Before things get lost in the noise we wanted to highlight this update from the FreeBSD foundation.</li>
<li>Before getting into the stories, they helpfully provide a list of upcoming conferences for this fall/winter, which includes a couple of USENIX gatherings, and the Developer Summit / MeetBSD next week.
+The foundation gives us a quick hardware update initially, discussing some of the new ThunderX Cavium servers which are deployed (ARMv8 64Bit) and yes I’m drooling a bit. They also mention that work is ongoing for the RPi3 platform and PINE64.</li>
<li>GNN also has an article reprinted from the FreeBSD journal, talking about the achievement of making it to 11.0 over the span of 23 years now. Of course he mentions that the foundation is open to all, and welcomes donations to continue to keep up this tradition of good work being done.</li>
<li>Deb Goodkin gives us an update on the “Grace Hopper” convention that took place in Houston TX several weeks back. Roughly 14k women in Tech attended, which is a great turnout, and FreeBSD was well represented there.</li>
<li>Next we have a call to potential speakers, don’t forget that there are plenty of places you can help present about FreeBSD, not just at *BSD centered conferences, but the SCALES of the world as well.</li>
<li>We wrap up with a look at EuroBSDCon 2016, quite a nice writeup, again brought to us by Deb at the foundation, and includes a list of some of those recognized for their contributions to FreeBSD.
***</li>
</ul>

<h3><a href="https://github.com/adhokku/adhokku" rel="nofollow">Adhokku – a toy PaaS powered by FreeBSD jails and Ansible</a></h3>

<ul>
<li>Described as a toy Platform-as-a-Service, Adhokku is an ansible based automated jail creation framework</li>
<li>Based on the concept of Dokku, a single-host open source PaaS for Linux powered by Docker</li>
</ul>

<blockquote>
<p>When you deploy an application using Adhokku, Adhokku creates a new jail on the remote host and provisions it from a fixed clean state using the instructions in the Jailfile in your Git repository. All jails sit behind a reverse proxy that directs traffic to one of them based on the domain name or the IP address in the HTTP request. When a new jail has been provisioned for an application, Adhokku seamlessly reconfigures the reverse proxy to send traffic to it instead of the one currently active for that application.</p>

<p>The following instructions show how to get Adhokku and an example application running in a VM on your development machine using Vagrant. This process should require no FreeBSD-specific knowledge, through modifying the Jailfile to customize the application may.</p>
</blockquote>

<ul>
<li>This seems like an interesting project, and it is good to see people developing workflows so users familiar with docker etc, can easily use BSD instead
***</li>
</ul>

<h3><a href="http://sohcahtoa.org.uk/openbsd.html" rel="nofollow">Installing OpenBSD 6.0 on your laptop is really hard (not)</a></h3>

<ul>
<li>OpenBSD on a laptop? Difficult? Not hardly.</li>
<li>We have a great walkthrough by Keith Burnett, which demonstrates just how easy it can be to get up and running with an XFCE desktop from a fresh OpenBSD installation.</li>
<li>For those curious,this was all done with a Thinkpad X60 and 120GB SSD and OpenBSD 6.0.</li>
<li>He doesn’t really cover the install process itself, that is well covered by the link to the OpenBSD FAQ pages.</li>
<li>Once the system is up and running though, we start with the most important portion, getting working internet access (Via wifi)</li>
<li>Really just a few ‘ifconfig’ commands later and we are in business.</li>
<li>Step 2 was getting the package configuration going. (I’ve never understood why this is still a thing, but no fret, its easy enough to do)</li>
<li>With package repos available, now you can grab the binaries for XFCE and friends with just a few simple “pkg_add” commands</li>
<li>Steps 4-6 are some specific bits to enable XFCE services, and some handy things such as setting doas permissions to get USB mounting working (For graphical mount/unmount)</li>
<li>Lastly, keeping the system updated is important, so we have a nice tutorial on how to do that as well, using a handy “openup” script, which takes some of the guesswork out of it.</li>
<li>Bonus! Steps for doing FDE as also included, which isn’t for everyone, but you may want it
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://twitter.com/gvnn3/status/791475373380804608" rel="nofollow">Pi-top with RPi-3 and FreeBSD HEAD</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/netbsd_7_0_1_released1" rel="nofollow">NetBSD 7.0.2 released</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-October/624851.html" rel="nofollow">DragonflyBSD - git: kernel - Fix mmcsd read/write issues</a></li>
<li><a href="https://github.com/rafael-santiago/dev-enigma" rel="nofollow">A char device which implements an Enigma machine (FreeBSD &amp; Linux)</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/ayzvCuaq" rel="nofollow"> Matt - System Monitoring</a> </li>
<li><a href="http://pastebin.com/r5axPSE7" rel="nofollow"> Tony - LLVM License</a> </li>
<li><a href="http://pastebin.com/MNxCvUtX" rel="nofollow"> Ben - Thanks</a> </li>
<li><a href="http://pastebin.com/RswFASqW" rel="nofollow"> David - Write Cache </a> </li>
<li><a href="http://pastebin.com/e317a32f" rel="nofollow"> Charles - Fonts</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>165: Vote4BSD</title>
  <link>https://www.bsdnow.tv/165</link>
  <guid isPermaLink="false">9091a6e8-1975-46fa-b095-2894d40db0bb</guid>
  <pubDate>Wed, 26 Oct 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9091a6e8-1975-46fa-b095-2894d40db0bb.mp3" length="52474324" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we’ve got voting news for you (No not *that* election), a closer look at</itunes:subtitle>
  <itunes:duration>1:12:52</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we’ve got voting news for you (No not that election), a closer look at
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise 
Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the 
Truly Paranoid"&gt;&lt;/a&gt;
Headlines
ARIN 38 involvement, vote! (http://lists.nycbug.org/pipermail/talk/2016-October/016878.html)
Isaac (.Ike) Levy, one of our interview guests from earlier this year, is running for a seat on the 15 person ARIN Advisory Council
His goal is to represent the entire *BSD community at this important body that makes decisions about how IP addresses are allocated and managed
Biographies and statements for all of the candidates are available here (https://www.arin.net/participate/elections/candidate_bios.pdf)
The election ends Friday October 28th
If elected, Ike will be looking for input from the community
***
LibreSSL not just available but default (DragonFlyBSD) (https://www.dragonflydigest.com/2016/10/19/18794.html)
DragonFly has become the latest BSD to join the growing LibreSSL family. As mentioned a few weeks back, they were in the process of wiring it up as a replacement for OpenSSL.
With this latest commit, you can now build the entire base and OpenSSL isn’t built at all.
Congrats, and hopefully more BSDs (and Linux) jump on the bandwagon Compat_43 is gone (http://lists.dragonflybsd.org/pipermail/commits/2016-October/624734.html)
RiP 4.3 Compat support.. Well for DragonFly anyway.
This commit finally puts out to pasture the 4.3 support, which has been disabled by default in DragonFly for almost 5 years now. 
This is a nice cleanup of their tree, removing more than a thousand lines of code and some of the old cruft still lingering from 4.3.
***
Create your first FreeBSD kernel module (http://meltmes.kiloreux.me/create-your-first-freebsd-kernel-module/)
This is an interesting tutorial from Abdelhadi Khiati, who is currently a master's student in AI and robotics
I have been lucky enough to participate in Google Summer of Code with the FreeBSD foundation. I was amazed by the community surrounding it which was noob friendly and very helpful (Thank you FreeBSD &amp;lt;3)
I wanted to make a starting tutorial for people to write a simple module for kernel before diving inside more complicated kernel shizzle
The kernel module that we will be working on is a simple event handler for the kernel. It will be composed of 2 parts, the event handling function, and the module declaration
The module event handler is a function that handles different events for the module. Like the module being loaded, unloaded or on system shutdown
Now that we have the events handling function ready. We need to declare the moduledatat to be able to use it inside DECLAREMODULE macro and load it into the kernel. It has the module name and a pointer to the event handling function
Lastly, we need to declare the module using the DECLARE_MODULE macro. Which has the following structure:
~~
DECLAREMODULE(name, moduledatat data, sub, order);
~~
name: The module name that will be used in the SYSINIT() call to identify the module.
data: The moduledatat structure that we already presented.
sub : Since we are using a driver here so the value will be SISUBDRIVERS this argument specify the type of system startup interface.
order : Represents the order of initialization within the subsystem, we will us the SIORDER_MIDDLE value here.
 To compile the previous file you need to use a Makefile as following:
~~
KMOD=hello
SRCS=module.c
.include
~~
We look forward to a future post where more functionality is added to the kernel module
Installing Windows 10 Under the bhyve Hypervisor. (http://pr1ntf.xyz/windows10.html)
Looking for your Bhyve fix? If so, then Trent (Of iohyve fame) has a nice blog post today with a detailed look at how to get Windows 10 up and running in bhyve.
First up, Trent gives us a nice look back at how far we’ve come in only a single year. Just a year ago, initial support for UEFI was landing, there was no VNC option, leaving us to only serial console goodness. Fast-forward to today and Windows 10 + Bhyve + Vnc is a go.
He immediately jumps us into the good stuff, talking about what you’ll need to follow along. His tutorial was written on 12-CURRENT, but running 11.0-RELEASE should work as well.
Of course, he does mention that before starting on this quest, make sure to read the bhyve handbook, specifically check that your CPU is supported. If you are running something without the correct Vt extensions, then your journey will end prematurely in sadness.
Next up is some of the prep work needed to get your box ready to run VM’s. Loading the kernel module, creating “tap” devices for networking and such are detailed.
If you are lazy (like me) then you’ll want to copy-n-paste his handy scripts which automate this process for you.
With the system prepped, we get to the good stuff. You’ll need to install the bhyve-firmware package (which enables UEFI booting) and get your handy Windows 10 ISO.
From here Trent has helpfully again provided us with handy scripts to both do the bhyve startup, as well as enabling VNC support over a SSH tunnel.
At this point you are good to go, fire up your VNC client and you should be greeted with the typical Windows “Press any key to boot from CD” message. No, he doesn’t provide instructions on how to install / Use / Like Windows, but we’ll leave that up to you.
***
News Roundup
Lumina version 1.1.0 Released (https://lumina-desktop.org/version-1-1-0-released/)
A new version of Lumina has just landed! 1.1.0 brings with it some important fixes, as well as new utilities that make your desktop computing easier than ever.
First up, all i18n files have been re-worked, instead of needing to install another package, they are included with the build when WITH_I18N is set.
A handy new “start-lumina-desktop” command has been added, which makes it easy to get lumina running from your Login Manager or even manually in .xinitrc or the like.
A bunch of internals related to how it tracks installed Applications and start-menu entries has been re-worked, fixing some memory issues and speeding things up.
The default “Insight” file-manager has been given an overhaul, which includes some new features like “git” support.
A new Qt5 “lumina-calculator” has also joined the family, which means not needing to use kcalc or xcalc on TrueOS anymore.
A nice “TrueOS” specific option has also landed. Specifically now when System Updates are waiting to install at shutdown, Lumina will detect and prompt if you want to install or skip the update. Handy when on the road, or if you don’t have the time to wait for an update to complete.
***
OpenBGPD Large Communities support in –current (http://bad.network/openbgpd-large-communities.html)
A blog post from OpenBSD’s Peter Hessler:
On Friday, I committed support for Large Communities to OpenBGPD. This is a draft-RFC that I am pretty excited about.
Back in the early days of The Internet, when routers rode dinosaurs to work and nerds weren't cool, we wanted to signal to our network neighbours certain information about routes. To be fair, we still do. But, back then everyone had 16 bit ASNs, so there was a simple concept called 'communities'. This was a 32bit opaque value, that was traditionally split into two 16bit values. Conveniently, we were able to encode an "us" and a "them", and perform actions based on what our neighbours told us.
But, 16bits is pretty limiting. There could only be ~65'000 possible networks on The Internet total? Eeek. So, we created 32bit ASNs. 4 billion networks is seen as a quite reasonable limitation. However, you can't really encode a 32bit "us" and a 32bit "them" value into 32bits of total space. Something called "Extended Communities" was invented, but it tries to solve everything except the case of a 32bit ASN signalling to another 32bit ASN.
Enter Large Communities. This is 3 32bit values. The first one is the "owner" of the namespace. Normally, you would put in your own ASN, or the ASN that you wish to signal. The second two 32bit values are opaque and only have meaning from the originating operator, but normally people will use "myasn":"verb":"noun" Or "myasn":"noun":"verb". Either way, it fits very nicely.
Having previously ran a 32bit ASN, it became quickly obvious the lack of suitable communities was a critical problem. It was even the way to request an "old style" 16bit ASN from RIPE, "I need to use communities". Even the ability to say "do this to that ASN" was ugly, since you couldn't really communicate who the community was supposed to matter to. Clearly, we The Internet Community screwed up by not addressing this need earlier.
OpenBGPD in OpenBSD -current has support for Large Communities, and this will be available in the 6.1 release and later. This was based partially on a patch from Job Snijders, thanks!
First look at the renewed CTL High Availability implementation in FreeBSD (https://mezzantrop.files.wordpress.com/2016/10/first-look-at-the-renewed-ctl-high-availability-implementation-in-freebsd-v1-1.pdf)
Following up on a previous post about making a high availability dual head storage controller, the new post looks at using FreeBSD’s CTL HA implementation, and FreeBSD 11.0 to do that:
This enhancement looks extremely important for the BeaST storage system as implementation of high available native ALUA in FreeBSD can potentially replace the BeaST arbitration mechanism (“Arbitrator”), which is completely described in the papers on the BeaST project page
ALUA in storage world terminology means Asymmetric Logical Unit Assignment. In simple words this set of technologies allows a host to access any LUN via both controllers of a storage system
As I still do not have any real hardware drive-enclosures, we will use Oracle Virtual Box and iSCSI protocol. I have already deployed this environment for the BeaST development, so we can use the similar, yet more simplified template for the renewed CTL HA testing purpose.
If anyone has access to hardware of this nature (a storage shelf with 2 heads connected to it), that they could lend the author to help validate the design on real hardware, that would be most helpful.
&amp;gt; We will run two storage controllers (ctrl-a, ctrl-b) and a host (cln-1). A virtual SAS drive (da0) of 256 MB is configured as “shareable” in Virtual Media Manager and simultaneously connected with both storage controllers
The basic settings are applied to both controllers
One interesting setting is:
kern.cam.ctl.harole – configures default role for the node. So ctrl-a is set as 0 (primary node), ctrl-b – 1 (secondary node). The role also can be specified on per-LUN basis which allows to distribute LUNs over both controllers evenly.
Note, kern.cam.ctl.haid and kern.cam.ctl.ha_mode are read-only parameters and must be set only via the /boot/loader.conf file.
Once kern.cam.ctl.ha_peer is set, and the peers connect to each other, the log messages should reflect this:
CTL: HA link status changed from 0 to 1
CTL: HA link status changed from 1 to 2
The link states can be: 0 – not configured, 1 – configured but not established and 2 – established
Then ctld is configured to export /dev/da0 on each of the controllers
Then the client is booted, and uses iscsid to connect to each of the exposed targets
sysctl kern.iscsi.failondisconnection=1 on the client is needed to drop connection with one of the controllers in case of its failure
As we know that da0 and da1 on the client are the same drive, we can put them under multipathing control: gmultipath create -A HA /dev/da0 /dev/da1
The document them shows a file being copied continuously to simulate load. Because the multipath is configured in ‘active/active’ mode, the traffic is split between the two controllers
Then the secondary controller is turned off, and iscsi disconnects that path, and gmultipath adapts and sends all of the traffic over the primary path.
When the secondary node is brought back up, but the primary is taken down, traffic stops
The console on the client is filled with errors: “Logical unit not accessible, asymmetric access state transition”
The ctl(4) man page explains: 
&amp;gt; If there is no primary node (both nodes are secondary, or secondary node has no connection to primary one), secondary node(s) report Transitioning state.
&amp;gt; Therefore, it looks like a “normal” behavior of CTL HA cluster in a case of disaster and loss of the primary node. It also means that a very lucky administrator can restore the failed primary controller before timeouts are elapsed.
If the primary is down, the secondary needs to be promoted by some other process (CARP maybe?): sysctl kern.cam.ctl.ha_role=0
Then traffic follows again
This is a very interesting look at this new feature, and I hope to see more about it in the future
***
Is SPF Simply Too Hard for Application Developers? (http://bsdly.blogspot.com/2016/10/is-spf-simply-too-hard-for-application.html)
Peter Hansteen asks an interesting question:
The Sender Policy Framework (SPF) is unloved by some, because it conflicts with some long-established SMTP email use cases. But is it also just too hard to understand and to use correctly for application developers?
He tells a story about trying to file his Norwegian taxes, and running into a bug
Then in August 2016, I tried to report a bug via the contact form at Altinn.no, the main tax authorities web site.
The report in itself was fairly trivial: The SMS alert I had just received about an invoice for taxes due contained one date, which turned out to be my birth date rather than the invoice due date. Not a major issue, but potentially confusing to the recipient until you actually log in and download the invoice as PDF and read the actual due date and other specifics.
The next time I checked my mail at bsdly.net, I found this bounce:
support@altinn.no: SMTP error from remote mail server after RCPT TO:: host mx.isp.as2116.net [193.75.104.7]: 550 5.7.23 SPF validation failed    
which means that somebody, somewhere tried to send a message to support@altinn.no, but the message could not be delivered because the sending machine did not match the published SPF data for the sender domain.
What happened is actually quite clear even from the part quoted above: the host mx.isp.as2116.net [193.75.104.7] tried to deliver mail on my behalf (I received the bounce, remember), and since I have no agreement for mail delivery with the owners and operators of that host, it is not in bsdly.net's SPF record either, and the delivery fails.
After having a bunch of other problems, he finally gets a message back from the tax authority support staff:
It looks like you have Sender Policy Framework (SPF) enabled on your mailserver, It is a known weakness of our contact form that mailervers with SPF are not supported.
The obvious answer should be, as you will agree if you're still reading: The form's developer should place the user's email address in the Reply-To: field, and send the message as its own, valid local user. That would solve the problem.
Yes, I'm well aware that SPF also breaks traditional forwarding of the type generally used by mailing lists and a few other use cases. Just how afraid should we be when those same developers come to do battle with the followup specifications such as DKIM and (shudder) the full DMARC specification?
Beastie Bits
Looking for a very part-time SysAdmin (https://lists.freebsd.org/pipermail/freebsd-jobs/2016-October/000930.html)
If anyone wants to build the latest nodejs on OpenBSD... (https://twitter.com/qb1t/status/789610796380598272)
IBM considers donating Power8 servers to OpenBSD (https://marc.info/?l=openbsd-misc&amp;amp;m=147680858507662&amp;amp;w=2)
Install and configure DNS server in FreeBSD (https://galaxy.ansible.com/vbotka/freebsd-dns/)
bhyve vulnerability in FreeBSD 11.0  (https://www.freebsd.org/security/advisories/FreeBSD-SA-16:32.bhyve.asc) 
Feedback/Questions
 Larry - Pkg Issue (http://pastebin.com/8hwDVQjL) 
 Larry - Followup  (http://pastebin.com/3nswwk90) 
 Jason - TrueOS (http://pastebin.com/pjfYWdXs) 
 Matias - ZFS HALP! (http://pastebin.com/2tAmR5Wz) 
 Robroy - User/Group (http://pastebin.com/7vWvUr8K) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we’ve got voting news for you (No not <em>that</em> election), a closer look at</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise <br>
Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img <br>
src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the <br>
Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2016-October/016878.html" rel="nofollow">ARIN 38 involvement, vote!</a></h3>

<ul>
<li>Isaac (.Ike) Levy, one of our interview guests from earlier this year, is running for a seat on the 15 person ARIN Advisory Council</li>
<li>His goal is to represent the entire *BSD community at this important body that makes decisions about how IP addresses are allocated and managed</li>
<li>Biographies and statements for all of the candidates are <a href="https://www.arin.net/participate/elections/candidate_bios.pdf" rel="nofollow">available here</a></li>
<li>The election ends Friday October 28th</li>
<li>If elected, Ike will be looking for input from the community
***</li>
</ul>

<h3><a href="https://www.dragonflydigest.com/2016/10/19/18794.html" rel="nofollow">LibreSSL not just available but default (DragonFlyBSD)</a></h3>

<ul>
<li>DragonFly has become the latest BSD to join the growing LibreSSL family. As mentioned a few weeks back, they were in the process of wiring it up as a replacement for OpenSSL.</li>
<li>With this latest commit, you can now build the entire base and OpenSSL isn’t built at all.</li>
<li>Congrats, and hopefully more BSDs (and Linux) jump on the bandwagon <a href="http://lists.dragonflybsd.org/pipermail/commits/2016-October/624734.html" rel="nofollow">Compat_43 is gone</a></li>
<li>RiP 4.3 Compat support.. Well for DragonFly anyway.</li>
<li>This commit finally puts out to pasture the 4.3 support, which has been disabled by default in DragonFly for almost 5 years now. </li>
<li>This is a nice cleanup of their tree, removing more than a thousand lines of code and some of the old cruft still lingering from 4.3.
***</li>
</ul>

<h3><a href="http://meltmes.kiloreux.me/create-your-first-freebsd-kernel-module/" rel="nofollow">Create your first FreeBSD kernel module</a></h3>

<ul>
<li>This is an interesting tutorial from Abdelhadi Khiati, who is currently a master&#39;s student in AI and robotics</li>
</ul>

<blockquote>
<p>I have been lucky enough to participate in Google Summer of Code with the FreeBSD foundation. I was amazed by the community surrounding it which was noob friendly and very helpful (Thank you FreeBSD &lt;3)</p>

<p>I wanted to make a starting tutorial for people to write a simple module for kernel before diving inside more complicated kernel shizzle</p>

<p>The kernel module that we will be working on is a simple event handler for the kernel. It will be composed of 2 parts, the event handling function, and the module declaration</p>

<p>The module event handler is a function that handles different events for the module. Like the module being loaded, unloaded or on system shutdown</p>

<p>Now that we have the events handling function ready. We need to declare the moduledata_t to be able to use it inside DECLARE_MODULE macro and load it into the kernel. It has the module name and a pointer to the event handling function</p>

<p>Lastly, we need to declare the module using the DECLARE_MODULE macro. Which has the following structure:</p>
</blockquote>

<p>~~<br>
DECLARE_MODULE(name, moduledata_t data, sub, order);<br>
~~</p>

<blockquote>
<p>name: The module name that will be used in the SYSINIT() call to identify the module.<br>
data: The moduledata_t structure that we already presented.<br>
sub : Since we are using a driver here so the value will be SI_SUB_DRIVERS this argument specify the type of system startup interface.<br>
order : Represents the order of initialization within the subsystem, we will us the SI_ORDER_MIDDLE value here.</p>
</blockquote>

<ul>
<li><p>To compile the previous file you need to use a Makefile as following:<br>
~~<br>
KMOD=hello<br>
SRCS=module.c<br>
.include<bsd.kmod.mk><br>
~~</p></li>
<li><p>We look forward to a future post where more functionality is added to the kernel module</p>

<hr></li>
</ul>

<h3><a href="http://pr1ntf.xyz/windows10.html" rel="nofollow">Installing Windows 10 Under the bhyve Hypervisor.</a></h3>

<ul>
<li>Looking for your Bhyve fix? If so, then Trent (Of iohyve fame) has a nice blog post today with a detailed look at how to get Windows 10 up and running in bhyve.</li>
<li>First up, Trent gives us a nice look back at how far we’ve come in only a single year. Just a year ago, initial support for UEFI was landing, there was no VNC option, leaving us to only serial console goodness. Fast-forward to today and Windows 10 + Bhyve + Vnc is a go.</li>
<li>He immediately jumps us into the good stuff, talking about what you’ll need to follow along. His tutorial was written on 12-CURRENT, but running 11.0-RELEASE should work as well.</li>
<li>Of course, he does mention that before starting on this quest, make sure to read the bhyve handbook, specifically check that your CPU is supported. If you are running something without the correct Vt extensions, then your journey will end prematurely in sadness.</li>
<li>Next up is some of the prep work needed to get your box ready to run VM’s. Loading the kernel module, creating “tap” devices for networking and such are detailed.</li>
<li>If you are lazy (like me) then you’ll want to copy-n-paste his handy scripts which automate this process for you.</li>
<li>With the system prepped, we get to the good stuff. You’ll need to install the bhyve-firmware package (which enables UEFI booting) and get your handy Windows 10 ISO.</li>
<li>From here Trent has helpfully again provided us with handy scripts to both do the bhyve startup, as well as enabling VNC support over a SSH tunnel.</li>
<li>At this point you are good to go, fire up your VNC client and you should be greeted with the typical Windows “Press any key to boot from CD” message. No, he doesn’t provide instructions on how to install / Use / Like Windows, but we’ll leave that up to you.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://lumina-desktop.org/version-1-1-0-released/" rel="nofollow">Lumina version 1.1.0 Released</a></h3>

<ul>
<li>A new version of Lumina has just landed! 1.1.0 brings with it some important fixes, as well as new utilities that make your desktop computing easier than ever.</li>
<li>First up, all i18n files have been re-worked, instead of needing to install another package, they are included with the build when WITH_I18N is set.</li>
<li>A handy new “start-lumina-desktop” command has been added, which makes it easy to get lumina running from your Login Manager or even manually in .xinitrc or the like.</li>
<li>A bunch of internals related to how it tracks installed Applications and start-menu entries has been re-worked, fixing some memory issues and speeding things up.</li>
<li>The default “Insight” file-manager has been given an overhaul, which includes some new features like “git” support.</li>
<li>A new Qt5 “lumina-calculator” has also joined the family, which means not needing to use kcalc or xcalc on TrueOS anymore.</li>
<li>A nice “TrueOS” specific option has also landed. Specifically now when System Updates are waiting to install at shutdown, Lumina will detect and prompt if you want to install or skip the update. Handy when on the road, or if you don’t have the time to wait for an update to complete.
***</li>
</ul>

<h3><a href="http://bad.network/openbgpd-large-communities.html" rel="nofollow">OpenBGPD Large Communities support in –current</a></h3>

<ul>
<li>A blog post from OpenBSD’s Peter Hessler:</li>
</ul>

<blockquote>
<p>On Friday, I committed support for Large Communities to OpenBGPD. This is a draft-RFC that I am pretty excited about.</p>

<p>Back in the early days of The Internet, when routers rode dinosaurs to work and nerds weren&#39;t cool, we wanted to signal to our network neighbours certain information about routes. To be fair, we still do. But, back then everyone had 16 bit ASNs, so there was a simple concept called &#39;communities&#39;. This was a 32bit opaque value, that was traditionally split into two 16bit values. Conveniently, we were able to encode an &quot;us&quot; and a &quot;them&quot;, and perform actions based on what our neighbours told us.</p>

<p>But, 16bits is pretty limiting. There could only be ~65&#39;000 possible networks on The Internet total? Eeek. So, we created 32bit ASNs. 4 billion networks is seen as a quite reasonable limitation. However, you can&#39;t really encode a 32bit &quot;us&quot; and a 32bit &quot;them&quot; value into 32bits of total space. Something called &quot;Extended Communities&quot; was invented, but it tries to solve everything except the case of a 32bit ASN signalling to another 32bit ASN.</p>

<p>Enter Large Communities. This is 3 32bit values. The first one is the &quot;owner&quot; of the namespace. Normally, you would put in your own ASN, or the ASN that you wish to signal. The second two 32bit values are opaque and only have meaning from the originating operator, but normally people will use &quot;myasn&quot;:&quot;verb&quot;:&quot;noun&quot; Or &quot;myasn&quot;:&quot;noun&quot;:&quot;verb&quot;. Either way, it fits very nicely.</p>

<p>Having previously ran a 32bit ASN, it became quickly obvious the lack of suitable communities was a critical problem. It was even the way to request an &quot;old style&quot; 16bit ASN from RIPE, &quot;I need to use communities&quot;. Even the ability to say &quot;do this to that ASN&quot; was ugly, since you couldn&#39;t really communicate who the community was supposed to matter to. Clearly, we The Internet Community screwed up by not addressing this need earlier.</p>

<p>OpenBGPD in OpenBSD -current has support for Large Communities, and this will be available in the 6.1 release and later. This was based partially on a patch from Job Snijders, thanks!</p>

<hr>
</blockquote>

<h3><a href="https://mezzantrop.files.wordpress.com/2016/10/first-look-at-the-renewed-ctl-high-availability-implementation-in-freebsd-v1-1.pdf" rel="nofollow">First look at the renewed CTL High Availability implementation in FreeBSD</a></h3>

<ul>
<li>Following up on a previous post about making a high availability dual head storage controller, the new post looks at using FreeBSD’s CTL HA implementation, and FreeBSD 11.0 to do that:</li>
</ul>

<blockquote>
<p>This enhancement looks extremely important for the BeaST storage system as implementation of high available native ALUA in FreeBSD can potentially replace the BeaST arbitration mechanism (“Arbitrator”), which is completely described in the papers on the BeaST project page</p>

<p>ALUA in storage world terminology means Asymmetric Logical Unit Assignment. In simple words this set of technologies allows a host to access any LUN via both controllers of a storage system</p>

<p>As I still do not have any real hardware drive-enclosures, we will use Oracle Virtual Box and iSCSI protocol. I have already deployed this environment for the BeaST development, so we can use the similar, yet more simplified template for the renewed CTL HA testing purpose.</p>
</blockquote>

<ul>
<li>If anyone has access to hardware of this nature (a storage shelf with 2 heads connected to it), that they could lend the author to help validate the design on real hardware, that would be most helpful.
&gt; We will run two storage controllers (ctrl-a, ctrl-b) and a host (cln-1). A virtual SAS drive (da0) of 256 MB is configured as “shareable” in Virtual Media Manager and simultaneously connected with both storage controllers</li>
<li>The basic settings are applied to both controllers</li>
<li><p>One interesting setting is:</p>

<blockquote>
<p>kern.cam.ctl.ha_role – configures default role for the node. So ctrl-a is set as 0 (primary node), ctrl-b – 1 (secondary node). The role also can be specified on per-LUN basis which allows to distribute LUNs over both controllers evenly.<br>
Note, kern.cam.ctl.ha_id and kern.cam.ctl.ha_mode are read-only parameters and must be set only via the /boot/loader.conf file.</p>
</blockquote></li>
<li><p>Once kern.cam.ctl.ha_peer is set, and the peers connect to each other, the log messages should reflect this:</p>

<ul>
<li>CTL: HA link status changed from 0 to 1</li>
<li>CTL: HA link status changed from 1 to 2</li>
</ul></li>
</ul>

<blockquote>
<p>The link states can be: 0 – not configured, 1 – configured but not established and 2 – established</p>
</blockquote>

<ul>
<li>Then ctld is configured to export /dev/da0 on each of the controllers</li>
<li>Then the client is booted, and uses iscsid to connect to each of the exposed targets</li>
</ul>

<blockquote>
<p>sysctl kern.iscsi.fail_on_disconnection=1 on the client is needed to drop connection with one of the controllers in case of its failure</p>

<p>As we know that da0 and da1 on the client are the same drive, we can put them under multipathing control: gmultipath create -A HA /dev/da0 /dev/da1</p>
</blockquote>

<ul>
<li>The document them shows a file being copied continuously to simulate load. Because the multipath is configured in ‘active/active’ mode, the traffic is split between the two controllers</li>
<li>Then the secondary controller is turned off, and iscsi disconnects that path, and gmultipath adapts and sends all of the traffic over the primary path.</li>
<li>When the secondary node is brought back up, but the primary is taken down, traffic stops</li>
<li>The console on the client is filled with errors: “Logical unit not accessible, asymmetric access state transition”</li>
<li>The ctl(4) man page explains: 
&gt; If there is no primary node (both nodes are secondary, or secondary node has no connection to primary one), secondary node(s) report Transitioning state.
&gt; Therefore, it looks like a “normal” behavior of CTL HA cluster in a case of disaster and loss of the primary node. It also means that a very lucky administrator can restore the failed primary controller before timeouts are elapsed.</li>
<li>If the primary is down, the secondary needs to be promoted by some other process (CARP maybe?): sysctl kern.cam.ctl.ha_role=0</li>
<li>Then traffic follows again</li>
<li>This is a very interesting look at this new feature, and I hope to see more about it in the future
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2016/10/is-spf-simply-too-hard-for-application.html" rel="nofollow">Is SPF Simply Too Hard for Application Developers?</a></h3>

<ul>
<li>Peter Hansteen asks an interesting question:</li>
</ul>

<blockquote>
<p>The Sender Policy Framework (SPF) is unloved by some, because it conflicts with some long-established SMTP email use cases. But is it also just too hard to understand and to use correctly for application developers?</p>
</blockquote>

<ul>
<li>He tells a story about trying to file his Norwegian taxes, and running into a bug</li>
</ul>

<blockquote>
<p>Then in August 2016, I tried to report a bug via the contact form at Altinn.no, the main tax authorities web site.</p>

<p>The report in itself was fairly trivial: The SMS alert I had just received about an invoice for taxes due contained one date, which turned out to be my birth date rather than the invoice due date. Not a major issue, but potentially confusing to the recipient until you actually log in and download the invoice as PDF and read the actual due date and other specifics.</p>

<p>The next time I checked my mail at bsdly.net, I found this bounce:</p>

<p><a href="mailto:support@altinn.no" rel="nofollow">support@altinn.no</a>: SMTP error from remote mail server after RCPT TO:: host mx.isp.as2116.net [193.75.104.7]: 550 5.7.23 SPF validation failed    </p>

<p>which means that somebody, somewhere tried to send a message to <a href="mailto:support@altinn.no" rel="nofollow">support@altinn.no</a>, but the message could not be delivered because the sending machine did not match the published SPF data for the sender domain.</p>

<p>What happened is actually quite clear even from the part quoted above: the host mx.isp.as2116.net [193.75.104.7] tried to deliver mail on my behalf (I received the bounce, remember), and since I have no agreement for mail delivery with the owners and operators of that host, it is not in bsdly.net&#39;s SPF record either, and the delivery fails.</p>
</blockquote>

<ul>
<li>After having a bunch of other problems, he finally gets a message back from the tax authority support staff:</li>
</ul>

<blockquote>
<p>It looks like you have Sender Policy Framework (SPF) enabled on your mailserver, It is a known weakness of our contact form that mailervers with SPF are not supported.</p>

<p>The obvious answer should be, as you will agree if you&#39;re still reading: The form&#39;s developer should place the user&#39;s email address in the Reply-To: field, and send the message as its own, valid local user. That would solve the problem.</p>

<p>Yes, I&#39;m well aware that SPF also breaks traditional forwarding of the type generally used by mailing lists and a few other use cases. Just how afraid should we be when those same developers come to do battle with the followup specifications such as DKIM and (shudder) the full DMARC specification?</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2016-October/000930.html" rel="nofollow">Looking for a very part-time SysAdmin</a></p></li>
<li><p><a href="https://twitter.com/qb1t/status/789610796380598272" rel="nofollow">If anyone wants to build the latest nodejs on OpenBSD...</a></p></li>
<li><p><a href="https://marc.info/?l=openbsd-misc&m=147680858507662&w=2" rel="nofollow">IBM considers donating Power8 servers to OpenBSD</a></p></li>
<li><p><a href="https://galaxy.ansible.com/vbotka/freebsd-dns/" rel="nofollow">Install and configure DNS server in FreeBSD</a></p></li>
<li><p><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-16:32.bhyve.asc" rel="nofollow">bhyve vulnerability in FreeBSD 11.0 </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/8hwDVQjL" rel="nofollow"> Larry - Pkg Issue</a> </li>
<li><a href="http://pastebin.com/3nswwk90" rel="nofollow"> Larry - Followup </a> </li>
<li><a href="http://pastebin.com/pjfYWdXs" rel="nofollow"> Jason - TrueOS</a> </li>
<li><a href="http://pastebin.com/2tAmR5Wz" rel="nofollow"> Matias - ZFS HALP!</a> </li>
<li><a href="http://pastebin.com/7vWvUr8K" rel="nofollow"> Robroy - User/Group</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we’ve got voting news for you (No not <em>that</em> election), a closer look at</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise <br>
Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img <br>
src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the <br>
Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2016-October/016878.html" rel="nofollow">ARIN 38 involvement, vote!</a></h3>

<ul>
<li>Isaac (.Ike) Levy, one of our interview guests from earlier this year, is running for a seat on the 15 person ARIN Advisory Council</li>
<li>His goal is to represent the entire *BSD community at this important body that makes decisions about how IP addresses are allocated and managed</li>
<li>Biographies and statements for all of the candidates are <a href="https://www.arin.net/participate/elections/candidate_bios.pdf" rel="nofollow">available here</a></li>
<li>The election ends Friday October 28th</li>
<li>If elected, Ike will be looking for input from the community
***</li>
</ul>

<h3><a href="https://www.dragonflydigest.com/2016/10/19/18794.html" rel="nofollow">LibreSSL not just available but default (DragonFlyBSD)</a></h3>

<ul>
<li>DragonFly has become the latest BSD to join the growing LibreSSL family. As mentioned a few weeks back, they were in the process of wiring it up as a replacement for OpenSSL.</li>
<li>With this latest commit, you can now build the entire base and OpenSSL isn’t built at all.</li>
<li>Congrats, and hopefully more BSDs (and Linux) jump on the bandwagon <a href="http://lists.dragonflybsd.org/pipermail/commits/2016-October/624734.html" rel="nofollow">Compat_43 is gone</a></li>
<li>RiP 4.3 Compat support.. Well for DragonFly anyway.</li>
<li>This commit finally puts out to pasture the 4.3 support, which has been disabled by default in DragonFly for almost 5 years now. </li>
<li>This is a nice cleanup of their tree, removing more than a thousand lines of code and some of the old cruft still lingering from 4.3.
***</li>
</ul>

<h3><a href="http://meltmes.kiloreux.me/create-your-first-freebsd-kernel-module/" rel="nofollow">Create your first FreeBSD kernel module</a></h3>

<ul>
<li>This is an interesting tutorial from Abdelhadi Khiati, who is currently a master&#39;s student in AI and robotics</li>
</ul>

<blockquote>
<p>I have been lucky enough to participate in Google Summer of Code with the FreeBSD foundation. I was amazed by the community surrounding it which was noob friendly and very helpful (Thank you FreeBSD &lt;3)</p>

<p>I wanted to make a starting tutorial for people to write a simple module for kernel before diving inside more complicated kernel shizzle</p>

<p>The kernel module that we will be working on is a simple event handler for the kernel. It will be composed of 2 parts, the event handling function, and the module declaration</p>

<p>The module event handler is a function that handles different events for the module. Like the module being loaded, unloaded or on system shutdown</p>

<p>Now that we have the events handling function ready. We need to declare the moduledata_t to be able to use it inside DECLARE_MODULE macro and load it into the kernel. It has the module name and a pointer to the event handling function</p>

<p>Lastly, we need to declare the module using the DECLARE_MODULE macro. Which has the following structure:</p>
</blockquote>

<p>~~<br>
DECLARE_MODULE(name, moduledata_t data, sub, order);<br>
~~</p>

<blockquote>
<p>name: The module name that will be used in the SYSINIT() call to identify the module.<br>
data: The moduledata_t structure that we already presented.<br>
sub : Since we are using a driver here so the value will be SI_SUB_DRIVERS this argument specify the type of system startup interface.<br>
order : Represents the order of initialization within the subsystem, we will us the SI_ORDER_MIDDLE value here.</p>
</blockquote>

<ul>
<li><p>To compile the previous file you need to use a Makefile as following:<br>
~~<br>
KMOD=hello<br>
SRCS=module.c<br>
.include<bsd.kmod.mk><br>
~~</p></li>
<li><p>We look forward to a future post where more functionality is added to the kernel module</p>

<hr></li>
</ul>

<h3><a href="http://pr1ntf.xyz/windows10.html" rel="nofollow">Installing Windows 10 Under the bhyve Hypervisor.</a></h3>

<ul>
<li>Looking for your Bhyve fix? If so, then Trent (Of iohyve fame) has a nice blog post today with a detailed look at how to get Windows 10 up and running in bhyve.</li>
<li>First up, Trent gives us a nice look back at how far we’ve come in only a single year. Just a year ago, initial support for UEFI was landing, there was no VNC option, leaving us to only serial console goodness. Fast-forward to today and Windows 10 + Bhyve + Vnc is a go.</li>
<li>He immediately jumps us into the good stuff, talking about what you’ll need to follow along. His tutorial was written on 12-CURRENT, but running 11.0-RELEASE should work as well.</li>
<li>Of course, he does mention that before starting on this quest, make sure to read the bhyve handbook, specifically check that your CPU is supported. If you are running something without the correct Vt extensions, then your journey will end prematurely in sadness.</li>
<li>Next up is some of the prep work needed to get your box ready to run VM’s. Loading the kernel module, creating “tap” devices for networking and such are detailed.</li>
<li>If you are lazy (like me) then you’ll want to copy-n-paste his handy scripts which automate this process for you.</li>
<li>With the system prepped, we get to the good stuff. You’ll need to install the bhyve-firmware package (which enables UEFI booting) and get your handy Windows 10 ISO.</li>
<li>From here Trent has helpfully again provided us with handy scripts to both do the bhyve startup, as well as enabling VNC support over a SSH tunnel.</li>
<li>At this point you are good to go, fire up your VNC client and you should be greeted with the typical Windows “Press any key to boot from CD” message. No, he doesn’t provide instructions on how to install / Use / Like Windows, but we’ll leave that up to you.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://lumina-desktop.org/version-1-1-0-released/" rel="nofollow">Lumina version 1.1.0 Released</a></h3>

<ul>
<li>A new version of Lumina has just landed! 1.1.0 brings with it some important fixes, as well as new utilities that make your desktop computing easier than ever.</li>
<li>First up, all i18n files have been re-worked, instead of needing to install another package, they are included with the build when WITH_I18N is set.</li>
<li>A handy new “start-lumina-desktop” command has been added, which makes it easy to get lumina running from your Login Manager or even manually in .xinitrc or the like.</li>
<li>A bunch of internals related to how it tracks installed Applications and start-menu entries has been re-worked, fixing some memory issues and speeding things up.</li>
<li>The default “Insight” file-manager has been given an overhaul, which includes some new features like “git” support.</li>
<li>A new Qt5 “lumina-calculator” has also joined the family, which means not needing to use kcalc or xcalc on TrueOS anymore.</li>
<li>A nice “TrueOS” specific option has also landed. Specifically now when System Updates are waiting to install at shutdown, Lumina will detect and prompt if you want to install or skip the update. Handy when on the road, or if you don’t have the time to wait for an update to complete.
***</li>
</ul>

<h3><a href="http://bad.network/openbgpd-large-communities.html" rel="nofollow">OpenBGPD Large Communities support in –current</a></h3>

<ul>
<li>A blog post from OpenBSD’s Peter Hessler:</li>
</ul>

<blockquote>
<p>On Friday, I committed support for Large Communities to OpenBGPD. This is a draft-RFC that I am pretty excited about.</p>

<p>Back in the early days of The Internet, when routers rode dinosaurs to work and nerds weren&#39;t cool, we wanted to signal to our network neighbours certain information about routes. To be fair, we still do. But, back then everyone had 16 bit ASNs, so there was a simple concept called &#39;communities&#39;. This was a 32bit opaque value, that was traditionally split into two 16bit values. Conveniently, we were able to encode an &quot;us&quot; and a &quot;them&quot;, and perform actions based on what our neighbours told us.</p>

<p>But, 16bits is pretty limiting. There could only be ~65&#39;000 possible networks on The Internet total? Eeek. So, we created 32bit ASNs. 4 billion networks is seen as a quite reasonable limitation. However, you can&#39;t really encode a 32bit &quot;us&quot; and a 32bit &quot;them&quot; value into 32bits of total space. Something called &quot;Extended Communities&quot; was invented, but it tries to solve everything except the case of a 32bit ASN signalling to another 32bit ASN.</p>

<p>Enter Large Communities. This is 3 32bit values. The first one is the &quot;owner&quot; of the namespace. Normally, you would put in your own ASN, or the ASN that you wish to signal. The second two 32bit values are opaque and only have meaning from the originating operator, but normally people will use &quot;myasn&quot;:&quot;verb&quot;:&quot;noun&quot; Or &quot;myasn&quot;:&quot;noun&quot;:&quot;verb&quot;. Either way, it fits very nicely.</p>

<p>Having previously ran a 32bit ASN, it became quickly obvious the lack of suitable communities was a critical problem. It was even the way to request an &quot;old style&quot; 16bit ASN from RIPE, &quot;I need to use communities&quot;. Even the ability to say &quot;do this to that ASN&quot; was ugly, since you couldn&#39;t really communicate who the community was supposed to matter to. Clearly, we The Internet Community screwed up by not addressing this need earlier.</p>

<p>OpenBGPD in OpenBSD -current has support for Large Communities, and this will be available in the 6.1 release and later. This was based partially on a patch from Job Snijders, thanks!</p>

<hr>
</blockquote>

<h3><a href="https://mezzantrop.files.wordpress.com/2016/10/first-look-at-the-renewed-ctl-high-availability-implementation-in-freebsd-v1-1.pdf" rel="nofollow">First look at the renewed CTL High Availability implementation in FreeBSD</a></h3>

<ul>
<li>Following up on a previous post about making a high availability dual head storage controller, the new post looks at using FreeBSD’s CTL HA implementation, and FreeBSD 11.0 to do that:</li>
</ul>

<blockquote>
<p>This enhancement looks extremely important for the BeaST storage system as implementation of high available native ALUA in FreeBSD can potentially replace the BeaST arbitration mechanism (“Arbitrator”), which is completely described in the papers on the BeaST project page</p>

<p>ALUA in storage world terminology means Asymmetric Logical Unit Assignment. In simple words this set of technologies allows a host to access any LUN via both controllers of a storage system</p>

<p>As I still do not have any real hardware drive-enclosures, we will use Oracle Virtual Box and iSCSI protocol. I have already deployed this environment for the BeaST development, so we can use the similar, yet more simplified template for the renewed CTL HA testing purpose.</p>
</blockquote>

<ul>
<li>If anyone has access to hardware of this nature (a storage shelf with 2 heads connected to it), that they could lend the author to help validate the design on real hardware, that would be most helpful.
&gt; We will run two storage controllers (ctrl-a, ctrl-b) and a host (cln-1). A virtual SAS drive (da0) of 256 MB is configured as “shareable” in Virtual Media Manager and simultaneously connected with both storage controllers</li>
<li>The basic settings are applied to both controllers</li>
<li><p>One interesting setting is:</p>

<blockquote>
<p>kern.cam.ctl.ha_role – configures default role for the node. So ctrl-a is set as 0 (primary node), ctrl-b – 1 (secondary node). The role also can be specified on per-LUN basis which allows to distribute LUNs over both controllers evenly.<br>
Note, kern.cam.ctl.ha_id and kern.cam.ctl.ha_mode are read-only parameters and must be set only via the /boot/loader.conf file.</p>
</blockquote></li>
<li><p>Once kern.cam.ctl.ha_peer is set, and the peers connect to each other, the log messages should reflect this:</p>

<ul>
<li>CTL: HA link status changed from 0 to 1</li>
<li>CTL: HA link status changed from 1 to 2</li>
</ul></li>
</ul>

<blockquote>
<p>The link states can be: 0 – not configured, 1 – configured but not established and 2 – established</p>
</blockquote>

<ul>
<li>Then ctld is configured to export /dev/da0 on each of the controllers</li>
<li>Then the client is booted, and uses iscsid to connect to each of the exposed targets</li>
</ul>

<blockquote>
<p>sysctl kern.iscsi.fail_on_disconnection=1 on the client is needed to drop connection with one of the controllers in case of its failure</p>

<p>As we know that da0 and da1 on the client are the same drive, we can put them under multipathing control: gmultipath create -A HA /dev/da0 /dev/da1</p>
</blockquote>

<ul>
<li>The document them shows a file being copied continuously to simulate load. Because the multipath is configured in ‘active/active’ mode, the traffic is split between the two controllers</li>
<li>Then the secondary controller is turned off, and iscsi disconnects that path, and gmultipath adapts and sends all of the traffic over the primary path.</li>
<li>When the secondary node is brought back up, but the primary is taken down, traffic stops</li>
<li>The console on the client is filled with errors: “Logical unit not accessible, asymmetric access state transition”</li>
<li>The ctl(4) man page explains: 
&gt; If there is no primary node (both nodes are secondary, or secondary node has no connection to primary one), secondary node(s) report Transitioning state.
&gt; Therefore, it looks like a “normal” behavior of CTL HA cluster in a case of disaster and loss of the primary node. It also means that a very lucky administrator can restore the failed primary controller before timeouts are elapsed.</li>
<li>If the primary is down, the secondary needs to be promoted by some other process (CARP maybe?): sysctl kern.cam.ctl.ha_role=0</li>
<li>Then traffic follows again</li>
<li>This is a very interesting look at this new feature, and I hope to see more about it in the future
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2016/10/is-spf-simply-too-hard-for-application.html" rel="nofollow">Is SPF Simply Too Hard for Application Developers?</a></h3>

<ul>
<li>Peter Hansteen asks an interesting question:</li>
</ul>

<blockquote>
<p>The Sender Policy Framework (SPF) is unloved by some, because it conflicts with some long-established SMTP email use cases. But is it also just too hard to understand and to use correctly for application developers?</p>
</blockquote>

<ul>
<li>He tells a story about trying to file his Norwegian taxes, and running into a bug</li>
</ul>

<blockquote>
<p>Then in August 2016, I tried to report a bug via the contact form at Altinn.no, the main tax authorities web site.</p>

<p>The report in itself was fairly trivial: The SMS alert I had just received about an invoice for taxes due contained one date, which turned out to be my birth date rather than the invoice due date. Not a major issue, but potentially confusing to the recipient until you actually log in and download the invoice as PDF and read the actual due date and other specifics.</p>

<p>The next time I checked my mail at bsdly.net, I found this bounce:</p>

<p><a href="mailto:support@altinn.no" rel="nofollow">support@altinn.no</a>: SMTP error from remote mail server after RCPT TO:: host mx.isp.as2116.net [193.75.104.7]: 550 5.7.23 SPF validation failed    </p>

<p>which means that somebody, somewhere tried to send a message to <a href="mailto:support@altinn.no" rel="nofollow">support@altinn.no</a>, but the message could not be delivered because the sending machine did not match the published SPF data for the sender domain.</p>

<p>What happened is actually quite clear even from the part quoted above: the host mx.isp.as2116.net [193.75.104.7] tried to deliver mail on my behalf (I received the bounce, remember), and since I have no agreement for mail delivery with the owners and operators of that host, it is not in bsdly.net&#39;s SPF record either, and the delivery fails.</p>
</blockquote>

<ul>
<li>After having a bunch of other problems, he finally gets a message back from the tax authority support staff:</li>
</ul>

<blockquote>
<p>It looks like you have Sender Policy Framework (SPF) enabled on your mailserver, It is a known weakness of our contact form that mailervers with SPF are not supported.</p>

<p>The obvious answer should be, as you will agree if you&#39;re still reading: The form&#39;s developer should place the user&#39;s email address in the Reply-To: field, and send the message as its own, valid local user. That would solve the problem.</p>

<p>Yes, I&#39;m well aware that SPF also breaks traditional forwarding of the type generally used by mailing lists and a few other use cases. Just how afraid should we be when those same developers come to do battle with the followup specifications such as DKIM and (shudder) the full DMARC specification?</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://lists.freebsd.org/pipermail/freebsd-jobs/2016-October/000930.html" rel="nofollow">Looking for a very part-time SysAdmin</a></p></li>
<li><p><a href="https://twitter.com/qb1t/status/789610796380598272" rel="nofollow">If anyone wants to build the latest nodejs on OpenBSD...</a></p></li>
<li><p><a href="https://marc.info/?l=openbsd-misc&m=147680858507662&w=2" rel="nofollow">IBM considers donating Power8 servers to OpenBSD</a></p></li>
<li><p><a href="https://galaxy.ansible.com/vbotka/freebsd-dns/" rel="nofollow">Install and configure DNS server in FreeBSD</a></p></li>
<li><p><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-16:32.bhyve.asc" rel="nofollow">bhyve vulnerability in FreeBSD 11.0 </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/8hwDVQjL" rel="nofollow"> Larry - Pkg Issue</a> </li>
<li><a href="http://pastebin.com/3nswwk90" rel="nofollow"> Larry - Followup </a> </li>
<li><a href="http://pastebin.com/pjfYWdXs" rel="nofollow"> Jason - TrueOS</a> </li>
<li><a href="http://pastebin.com/2tAmR5Wz" rel="nofollow"> Matias - ZFS HALP!</a> </li>
<li><a href="http://pastebin.com/7vWvUr8K" rel="nofollow"> Robroy - User/Group</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>164: Virtualized COW / PI?</title>
  <link>https://www.bsdnow.tv/164</link>
  <guid isPermaLink="false">485bcb56-a447-4684-8af7-a5b0285230af</guid>
  <pubDate>Wed, 19 Oct 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/485bcb56-a447-4684-8af7-a5b0285230af.mp3" length="72447988" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we’ve got all sorts of goodies to discuss. Starting with, vmm, vkernels, raspberry pi and much more! Some iX folks are visiting from out of</itunes:subtitle>
  <itunes:duration>1:40:37</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we’ve got all sorts of goodies to discuss. Starting with, vmm, vkernels, raspberry pi and much more! Some iX folks are visiting from out of
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
vmm enabled  (http://undeadly.org/cgi?action=article&amp;amp;sid=20161012092516&amp;amp;mode=flat&amp;amp;count=15)
VMM, the OpenBSD hypervisor, has been imported into current
It has similar hardware requirements to bhyve, a Intel Nehalem or newer CPU with the hardware virtualization features enabled in the BIOS
AMD support has not been started yet
OpenBSD is the only supported guest
It would be interesting to hear from viewers that have tried it, and hear how it does, and what still needs more work
***
vkernels go COW (http://lists.dragonflybsd.org/pipermail/commits/2016-October/624675.html)
The DragonflyBSD feature, vkernels, has gained a new Copy-On-Write functionality
Disk images can now be mounted RO or RW, but changes will not be written back to the image file
This allows multiple vkernels to share the same disk image
“Note that when the vkernel operates on an image in this mode, modifications will eat up system memory and swap, so the user should be cognizant of the use-case.  Still, the flexibility of being able to mount the image R+W should not be underestimated.”
This is another feature we’d love to hear from viewers that have tried it out.
***
Basic support for the RPI3 has landed in FreeBSD-CURRENT (https://wiki.freebsd.org/arm64/rpi3)
The long awaited bits to allow FreeBSD to boot on the Raspberry Pi 3 have landed
There is still a bit of work to be done, some of the as mentioned in Oleksandr’s blog post:
Raspberry Pi support in HEAD (https://kernelnomicon.org/?p=690) 
“Raspberry Pi 3 limited support was committed to HEAD. Most of drivers should work with upstream dtb, RNG requires attention because callout mode seems to be broken and there is no IRQ in upstream device tree file. SMP is work in progress. There are some compatibility issue with VCHIQ driver due to some assumptions that are true only for ARM platform. “
This is exciting work. No HDMI support (yet), so if you plan on trying this out make sure you have your USB-&amp;gt;Serial adapter cables ready to go.
Full Instructions to get started with your RPI 3 can be found on the FreeBSD Wiki (https://wiki.freebsd.org/arm64/rpi3)
Relatively soon, I imagine there will be a RaspBSD build for the RPI3 to make it easier to get started
Eventually there will be official FreeBSD images as well
***
OpenBSD switches softraid crypto from PKCS5 PBKDF2 to bcrypt PBKDF. (https://github.com/openbsd/src/commit/2ba69c71e92471fe05f305bfa35aeac543ebec1f)
After the discussion a few weeks ago when a user wrote a tool to brute force their forgotten OpenBSD Full Disk Encryption password (from a password list of possible variations of their password), it was discovered that OpenBSD defaulted to using just 8192 iterations of PKCSv5 for the key derivation function with a SHA1-HMAC
The number of iterations can be manually controlled by the user when creating the softraid volume
By comparison, FreeBSDs GELI full disk encryption used a benchmark to pick a number of iterations that would take more than 2 seconds to complete, generally resulting in a number of iterations over 1 million on most modern hardware. The algorithm is based on a SHA512-HMAC
However, inefficiency in the implementation of PKCSv5 in GELI resulted in the implementation being 50% slower than some other implementations, meaning the effective security was only about 1 second per attempt, rather than the intended 2 seconds. The improved PKCSv5 implementation is out for review currently.
This commit to OpenBSD changes the default key derivation function to be based on bcrypt and a SHA512-HMAC instead.
OpenBSD also now uses a benchmark to pick a number of of iterations that will take approximately 1 second per attempt
“One weakness of PBKDF2 is that while its number of iterations can be adjusted to make it take an arbitrarily large amount of computing time, it can be implemented with a small circuit and very little RAM, which makes brute-force attacks using application-specific integrated circuits or graphics processing units relatively cheap. The bcrypt key derivation function requires a larger amount of RAM (but still not tunable separately, i. e. fixed for a given amount of CPU time) and is slightly stronger against such attacks, while the more modern scrypt key derivation function can use arbitrarily large amounts of memory and is therefore more resistant to ASIC and GPU attacks.”
The upgrade to the bcrypt, which has proven to be quite resistant to cracking by GPUs is a significant enhancement to OpenBSDs encrypted softraid feature
***
Interview - Josh Paetzel - email@email (mailto:email@email) / @bsdunix4ever (https://twitter.com/bsdunix4ever)
MeetBSD
ZFS Panel
FreeNAS - graceful network reload
Pxeboot
***
News Roundup
EC2's most dangerous feature (http://www.daemonology.net/blog/2016-10-09-EC2s-most-dangerous-feature.html)
Colin Percival, FreeBSD’s unofficial EC2 maintainer, has published a blog post about “EC2's most dangerous feature”
“As a FreeBSD developer — and someone who writes in C — I believe strongly in the idea of "tools, not policy". If you want to shoot yourself in the foot, I'll help you deliver the bullet to your foot as efficiently and reliably as possible. UNIX has always been built around the idea that systems administrators are better equipped to figure out what they want than the developers of the OS, and it's almost impossible to prevent foot-shooting without also limiting useful functionality. The most powerful tools are inevitably dangerous, and often the best solution is to simply ensure that they come with sufficient warning labels attached; but occasionally I see tools which not only lack important warning labels, but are also designed in a way which makes them far more dangerous than necessary. Such a case is IAM Roles for Amazon EC2.”
“A review for readers unfamiliar with this feature: Amazon IAM (Identity and Access Management) is a service which allows for the creation of access credentials which are limited in scope; for example, you can have keys which can read objects from Amazon S3 but cannot write any objects. IAM Roles for EC2 are a mechanism for automatically creating such credentials and distributing them to EC2 instances; you specify a policy and launch an EC2 instance with that Role attached, and magic happens making time-limited credentials available via the EC2 instance metadata. This simplifies the task of creating and distributing credentials and is very convenient; I use it in my FreeBSD AMI Builder AMI, for example. Despite being convenient, there are two rather scary problems with this feature which severely limit the situations where I'd recommend using it.”
“The first problem is one of configuration: The language used to specify IAM Policies is not sufficient to allow for EC2 instances to be properly limited in their powers. For example, suppose you want to allow EC2 instances to create, attach, detach, and delete Elastic Block Store volumes automatically — useful if you want to have filesystems automatically scaling up and down depending on the amount of data which they contain. The obvious way to do this is would be to "tag" the volumes belonging to an EC2 instance and provide a Role which can only act on volumes tagged to the instance where the Role was provided; while the second part of this (limiting actions to tagged volumes) seems to be possible, there is no way to require specific API call parameters on all permitted CreateVolume calls, as would be necessary to require that a tag is applied to any new volumes being created by the instance.”
“As problematic as the configuration is, a far larger problem with IAM Roles for Amazon EC2 is access control — or, to be more precise, the lack thereof. As I mentioned earlier, IAM Role credentials are exposed to EC2 instances via the EC2 instance metadata system: In other words, they're available from http://169.254.169.254/. (I presume that the "EC2ws" HTTP server which responds is running in another Xen domain on the same physical hardware, but that implementation detail is unimportant.) This makes the credentials easy for programs to obtain... unfortunately, too easy for programs to obtain. UNIX is designed as a multi-user operating system, with multiple users and groups and permission flags and often even more sophisticated ACLs — but there are very few systems which control the ability to make outgoing HTTP requests. We write software which relies on privilege separation to reduce the likelihood that a bug will result in a full system compromise; but if a process which is running as user nobody and chrooted into /var/empty is still able to fetch AWS keys which can read every one of the objects you have stored in S3, do you really have any meaningful privilege separation? To borrow a phrase from Ted Unangst, the way that IAM Roles expose credentials to EC2 instances makes them a very effective exploit mitigation mitigation technique.”
“To make it worse, exposing credentials — and other metadata, for that matter — via HTTP is completely unnecessary. EC2 runs on Xen, which already has a perfectly good key-value data store for conveying metadata between the host and guest instances. It would be absolutely trivial for Amazon to place EC2 metadata, including IAM credentials, into XenStore; and almost as trivial for EC2 instances to expose XenStore as a filesystem to which standard UNIX permissions could be applied, providing IAM Role credentials with the full range of access control functionality which UNIX affords to files stored on disk. Of course, there is a lot of code out there which relies on fetching EC2 instance metadata over HTTP, and trivial or not it would still take time to write code for pushing EC2 metadata into XenStore and exposing it via a filesystem inside instances; so even if someone at AWS reads this blog post and immediately says "hey, we should fix this", I'm sure we'll be stuck with the problems in IAM Roles for years to come.”
“So consider this a warning label: IAM Roles for EC2 may seem like a gun which you can use to efficiently and reliably shoot yourself in the foot; but in fact it's more like a gun which is difficult to aim and might be fired by someone on the other side of the room snapping his fingers. Handle with care!”
***
Open-source storage that doesn't suck? Our man tries to break TrueNAS (http://www.theregister.co.uk/2016/10/18/truenas_review/)
The storage reviewer over at TheRegister got their hands on a TrueNAS and gave it a try
“Data storage is difficult, and ZFS-based storage doubly so. There's a lot of money to be made if you can do storage right, so it's uncommon to see a storage company with an open-source model deliver storage that doesn't suck.”
“To become TrueNAS, FreeNAS's code is feature-frozen and tested rigorously. Bleeding-edge development continues with FreeNAS, and FreeNAS comes with far fewer guarantees than does TrueNAS.”
“iXsystems provided a Z20 hybrid storage array. The Z20 is a dual-controller, SAS-based, high-availability, hybrid storage array. The testing unit came with a 2x 10GbE NIC per controller and retails around US$24k. The unit shipped with 10x 300GB 10k RPM magnetic hard drives, an 8GB ZIL SSD and a 200GB L2ARC SSD. 50GiB of RAM was dedicated to the ARC by the system's autotune feature.”
The review tests the performance of the TrueNAS, which they found acceptable for spinning rust, but they also tested the HA features
While the look of the UI didn’t impress them, the functionality and built in help did
“The UI contains truly excellent mouseover tooltips that provide detailed information and rationale for almost every setting. An experienced sysadmin will be able to navigate the TrueNAS UI with ease. An experienced storage admin who knows what all the terms mean won't have to refer to a wiki or the more traditional help manual, but the same can't be said for the uninitiated.”
“After a lot of testing, I'd trust my data to the TrueNAS. I am convinced that it will ensure the availability of my data to within any reasonable test, and do so as a high availability solution. That's more than I can say for a lot of storage out there.”
“iXsystems produce a storage array that is decent enough to entice away some existing users of the likes of EMC, NetApp, Dell or HP. Honestly, that's not something I thought possible going into this review. It's a nice surprise.”
***
OpenBSD now officially on GitHub (https://github.com/openbsd)
Got a couple of new OpenBSD items to bring to your attention today.
First up, for those who didn’t know, OpenBSD development has (always?) taken place in CVS, similar to NetBSD and previously FreeBSD. 
However today, Git fans can rejoice, since there is now an “official” read-only github mirror of their sources for public consumption.
Since this is read-only, I will assume (unless told otherwise) that pull-requests and whatnot aren’t taken. But this will come in handy for the “git-enabled” among us who need an easier way to checkout OpenBSD sources.
There is also not yet a guarantee about the stability of the exporter. If you base a fork on the github branch, and something goes wrong with the exporter, the data may be reexported with different hashes, making it difficult to rebase your fork.
How to install LibertyBSD or OpenBSD on a libreboot system (https://libreboot.org/docs/bsd/openbsd.html)
For the second part of our OpenBSD stories, we have a pretty detailed document posted over at LibreBoot.org with details on how to boot-strap OpenBSD (Or LibertyBSD) using their open-source bios replacement.
We’ve covered blog posts and other tidbits about this process in the past, but this seems to be the definitive version  (so far)  to reference.
Some of the niceties include instructions on getting the USB image formatted not just on OpenBSD, but also FreeBSD, Linux and NetBSD.
Instructions on how to boot without full-disk-encryption are provided, with a mention that so far Libreboot + Grub does not support FDE (yet). I would imagine somebody will need to port over the openBSD FDE crypto support to GRUB, as was done with GELI at some point.
Lastly some instructions on how to configure grub, and troubleshoot if something goes wrong will help round-out this story. Give it a whirl, let us know if you run into issues.
Editorial Aside - Personally I find the libreboot stuff fascinating. It really is one of the last areas that we don’t have full control of our systems with open-source. With the growth of EFI, it seems we rely on a closed-source binary / mini-OS of sorts just to boot our Open Source solutions, which needs to be addressed. Hats off to the LibreBoot folks for taking on this important challenge.
***
FreeNAS 9.10 – LAGG &amp;amp; VLAN Overview (https://www.youtube.com/watch?v=wqSH_uQSArQ)
A video tutorial on FreeNAS’s official YouTube Channel
Covers the advanced networking features, Link Aggregation and VLANs
Covers what the features do, and in the case of LAGG, how each of the modes work and when you might want to use it
***
Beastie Bits
Remote BSD Developer Position is up for grabs (https://www.cybercoders.com/bsd-developer-remote-job-305206)
Isilon is hiring for a FreeBSD Security position  (https://twitter.com/jeamland/status/785965716717441024)
Google has ported the Networked real-time multi-player BSD game (https://github.com/google/web-bsd-hunt)
A bunch of OpenBSD Tips (http://www.vincentdelft.be)
The last OpenBSD 6.0 Limited Edition CD has sold (http://www.ebay.com/itm/-/332000602939)
Dan spots George Neville-Neil on TV at the Airport  (https://twitter.com/DLangille/status/788477000876892162) 
gnn on CNN (https://www.youtube.com/watch?v=h7zlxgtBA6o) 
SoloBSD releases v 6.0 built upon OpenBSD (http://solobsd.blogspot.com/2016/10/release-solobsd-60-openbsd-edition.html)
Upcoming KnoxBug looks at PacBSD - Oct 25th (http://knoxbug.org/content/2016-10-25) 
Feedback/Questions
 Morgan - Ports and Packages (http://pastebin.com/Kr9ykKTu) 
 Mat - ZFS Memory (http://pastebin.com/EwpTpp6D) 
 Thomas - FreeBSD Path Length (http://pastebin.com/HYMPtfjz) 
 Cy - OpenBSD and NetHogs (http://pastebin.com/vGxZHMWE) 
 Lars - Editors (http://pastebin.com/5FMz116T) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we’ve got all sorts of goodies to discuss. Starting with, vmm, vkernels, raspberry pi and much more! Some iX folks are visiting from out of</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20161012092516&mode=flat&count=15" rel="nofollow">vmm enabled </a></h3>

<ul>
<li>VMM, the OpenBSD hypervisor, has been imported into current</li>
<li>It has similar hardware requirements to bhyve, a Intel Nehalem or newer CPU with the hardware virtualization features enabled in the BIOS</li>
<li>AMD support has not been started yet</li>
<li>OpenBSD is the only supported guest</li>
<li>It would be interesting to hear from viewers that have tried it, and hear how it does, and what still needs more work
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-October/624675.html" rel="nofollow">vkernels go COW</a></h3>

<ul>
<li>The DragonflyBSD feature, vkernels, has gained a new Copy-On-Write functionality</li>
<li>Disk images can now be mounted RO or RW, but changes will not be written back to the image file</li>
<li>This allows multiple vkernels to share the same disk image</li>
<li>“Note that when the vkernel operates on an image in this mode, modifications will eat up system memory and swap, so the user should be cognizant of the use-case.  Still, the flexibility of being able to mount the image R+W should not be underestimated.”</li>
<li>This is another feature we’d love to hear from viewers that have tried it out.
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/arm64/rpi3" rel="nofollow">Basic support for the RPI3 has landed in FreeBSD-CURRENT</a></h3>

<ul>
<li>The long awaited bits to allow FreeBSD to boot on the Raspberry Pi 3 have landed</li>
<li>There is still a bit of work to be done, some of the as mentioned in Oleksandr’s blog post:</li>
<li><a href="https://kernelnomicon.org/?p=690" rel="nofollow">Raspberry Pi support in HEAD</a> </li>
</ul>

<blockquote>
<p>“Raspberry Pi 3 limited support was committed to HEAD. Most of drivers should work with upstream dtb, RNG requires attention because callout mode seems to be broken and there is no IRQ in upstream device tree file. SMP is work in progress. There are some compatibility issue with VCHIQ driver due to some assumptions that are true only for ARM platform. “</p>
</blockquote>

<ul>
<li>This is exciting work. No HDMI support (yet), so if you plan on trying this out make sure you have your USB-&gt;Serial adapter cables ready to go.</li>
<li>Full Instructions to get started with your RPI 3 can be found on the <a href="https://wiki.freebsd.org/arm64/rpi3" rel="nofollow">FreeBSD Wiki</a></li>
<li>Relatively soon, I imagine there will be a RaspBSD build for the RPI3 to make it easier to get started</li>
<li>Eventually there will be official FreeBSD images as well
***</li>
</ul>

<h3><a href="https://github.com/openbsd/src/commit/2ba69c71e92471fe05f305bfa35aeac543ebec1f" rel="nofollow">OpenBSD switches softraid crypto from PKCS5 PBKDF2 to bcrypt PBKDF.</a></h3>

<ul>
<li>After the discussion a few weeks ago when a user wrote a tool to brute force their forgotten OpenBSD Full Disk Encryption password (from a password list of possible variations of their password), it was discovered that OpenBSD defaulted to using just 8192 iterations of PKCSv5 for the key derivation function with a SHA1-HMAC</li>
<li>The number of iterations can be manually controlled by the user when creating the softraid volume</li>
<li>By comparison, FreeBSDs GELI full disk encryption used a benchmark to pick a number of iterations that would take more than 2 seconds to complete, generally resulting in a number of iterations over 1 million on most modern hardware. The algorithm is based on a SHA512-HMAC</li>
<li>However, inefficiency in the implementation of PKCSv5 in GELI resulted in the implementation being 50% slower than some other implementations, meaning the effective security was only about 1 second per attempt, rather than the intended 2 seconds. The improved PKCSv5 implementation is out for review currently.</li>
<li>This commit to OpenBSD changes the default key derivation function to be based on bcrypt and a SHA512-HMAC instead.</li>
<li>OpenBSD also now uses a benchmark to pick a number of of iterations that will take approximately 1 second per attempt</li>
<li>“One weakness of PBKDF2 is that while its number of iterations can be adjusted to make it take an arbitrarily large amount of computing time, it can be implemented with a small circuit and very little RAM, which makes brute-force attacks using application-specific integrated circuits or graphics processing units relatively cheap. The bcrypt key derivation function requires a larger amount of RAM (but still not tunable separately, i. e. fixed for a given amount of CPU time) and is slightly stronger against such attacks, while the more modern scrypt key derivation function can use arbitrarily large amounts of memory and is therefore more resistant to ASIC and GPU attacks.”</li>
<li>The upgrade to the bcrypt, which has proven to be quite resistant to cracking by GPUs is a significant enhancement to OpenBSDs encrypted softraid feature
***</li>
</ul>

<h2>Interview - Josh Paetzel - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/bsdunix4ever" rel="nofollow">@bsdunix4ever</a></h2>

<ul>
<li>MeetBSD</li>
<li>ZFS Panel</li>
<li>FreeNAS - graceful network reload</li>
<li>Pxeboot
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.daemonology.net/blog/2016-10-09-EC2s-most-dangerous-feature.html" rel="nofollow">EC2&#39;s most dangerous feature</a></h3>

<ul>
<li>Colin Percival, FreeBSD’s unofficial EC2 maintainer, has published a blog post about “EC2&#39;s most dangerous feature”</li>
<li>“As a FreeBSD developer — and someone who writes in C — I believe strongly in the idea of &quot;tools, not policy&quot;. If you want to shoot yourself in the foot, I&#39;ll help you deliver the bullet to your foot as efficiently and reliably as possible. UNIX has always been built around the idea that systems administrators are better equipped to figure out what they want than the developers of the OS, and it&#39;s almost impossible to prevent foot-shooting without also limiting useful functionality. The most powerful tools are inevitably dangerous, and often the best solution is to simply ensure that they come with sufficient warning labels attached; but occasionally I see tools which not only lack important warning labels, but are also designed in a way which makes them far more dangerous than necessary. Such a case is IAM Roles for Amazon EC2.”</li>
<li>“A review for readers unfamiliar with this feature: Amazon IAM (Identity and Access Management) is a service which allows for the creation of access credentials which are limited in scope; for example, you can have keys which can read objects from Amazon S3 but cannot write any objects. IAM Roles for EC2 are a mechanism for automatically creating such credentials and distributing them to EC2 instances; you specify a policy and launch an EC2 instance with that Role attached, and magic happens making time-limited credentials available via the EC2 instance metadata. This simplifies the task of creating and distributing credentials and is very convenient; I use it in my FreeBSD AMI Builder AMI, for example. Despite being convenient, there are two rather scary problems with this feature which severely limit the situations where I&#39;d recommend using it.”</li>
<li>“The first problem is one of configuration: The language used to specify IAM Policies is not sufficient to allow for EC2 instances to be properly limited in their powers. For example, suppose you want to allow EC2 instances to create, attach, detach, and delete Elastic Block Store volumes automatically — useful if you want to have filesystems automatically scaling up and down depending on the amount of data which they contain. The obvious way to do this is would be to &quot;tag&quot; the volumes belonging to an EC2 instance and provide a Role which can only act on volumes tagged to the instance where the Role was provided; while the second part of this (limiting actions to tagged volumes) seems to be possible, there is no way to require specific API call parameters on all permitted CreateVolume calls, as would be necessary to require that a tag is applied to any new volumes being created by the instance.”</li>
<li>“As problematic as the configuration is, a far larger problem with IAM Roles for Amazon EC2 is access control — or, to be more precise, the lack thereof. As I mentioned earlier, IAM Role credentials are exposed to EC2 instances via the EC2 instance metadata system: In other words, they&#39;re available from <a href="http://169.254.169.254/" rel="nofollow">http://169.254.169.254/</a>. (I presume that the &quot;EC2ws&quot; HTTP server which responds is running in another Xen domain on the same physical hardware, but that implementation detail is unimportant.) This makes the credentials easy for programs to obtain... unfortunately, too easy for programs to obtain. UNIX is designed as a multi-user operating system, with multiple users and groups and permission flags and often even more sophisticated ACLs — but there are very few systems which control the ability to make outgoing HTTP requests. We write software which relies on privilege separation to reduce the likelihood that a bug will result in a full system compromise; but if a process which is running as user nobody and chrooted into /var/empty is still able to fetch AWS keys which can read every one of the objects you have stored in S3, do you really have any meaningful privilege separation? To borrow a phrase from Ted Unangst, the way that IAM Roles expose credentials to EC2 instances makes them a very effective exploit mitigation mitigation technique.”</li>
<li>“To make it worse, exposing credentials — and other metadata, for that matter — via HTTP is completely unnecessary. EC2 runs on Xen, which already has a perfectly good key-value data store for conveying metadata between the host and guest instances. It would be absolutely trivial for Amazon to place EC2 metadata, including IAM credentials, into XenStore; and almost as trivial for EC2 instances to expose XenStore as a filesystem to which standard UNIX permissions could be applied, providing IAM Role credentials with the full range of access control functionality which UNIX affords to files stored on disk. Of course, there is a lot of code out there which relies on fetching EC2 instance metadata over HTTP, and trivial or not it would still take time to write code for pushing EC2 metadata into XenStore and exposing it via a filesystem inside instances; so even if someone at AWS reads this blog post and immediately says &quot;hey, we should fix this&quot;, I&#39;m sure we&#39;ll be stuck with the problems in IAM Roles for years to come.”</li>
<li>“So consider this a warning label: IAM Roles for EC2 may seem like a gun which you can use to efficiently and reliably shoot yourself in the foot; but in fact it&#39;s more like a gun which is difficult to aim and might be fired by someone on the other side of the room snapping his fingers. Handle with care!”
***</li>
</ul>

<h3><a href="http://www.theregister.co.uk/2016/10/18/truenas_review/" rel="nofollow">Open-source storage that doesn&#39;t suck? Our man tries to break TrueNAS</a></h3>

<ul>
<li>The storage reviewer over at TheRegister got their hands on a TrueNAS and gave it a try</li>
<li>“Data storage is difficult, and ZFS-based storage doubly so. There&#39;s a lot of money to be made if you can do storage right, so it&#39;s uncommon to see a storage company with an open-source model deliver storage that doesn&#39;t suck.”</li>
<li>“To become TrueNAS, FreeNAS&#39;s code is feature-frozen and tested rigorously. Bleeding-edge development continues with FreeNAS, and FreeNAS comes with far fewer guarantees than does TrueNAS.”</li>
<li>“iXsystems provided a Z20 hybrid storage array. The Z20 is a dual-controller, SAS-based, high-availability, hybrid storage array. The testing unit came with a 2x 10GbE NIC per controller and retails around US$24k. The unit shipped with 10x 300GB 10k RPM magnetic hard drives, an 8GB ZIL SSD and a 200GB L2ARC SSD. 50GiB of RAM was dedicated to the ARC by the system&#39;s autotune feature.”</li>
<li>The review tests the performance of the TrueNAS, which they found acceptable for spinning rust, but they also tested the HA features</li>
<li>While the look of the UI didn’t impress them, the functionality and built in help did</li>
<li>“The UI contains truly excellent mouseover tooltips that provide detailed information and rationale for almost every setting. An experienced sysadmin will be able to navigate the TrueNAS UI with ease. An experienced storage admin who knows what all the terms mean won&#39;t have to refer to a wiki or the more traditional help manual, but the same can&#39;t be said for the uninitiated.”</li>
<li>“After a lot of testing, I&#39;d trust my data to the TrueNAS. I am convinced that it will ensure the availability of my data to within any reasonable test, and do so as a high availability solution. That&#39;s more than I can say for a lot of storage out there.”</li>
<li>“iXsystems produce a storage array that is decent enough to entice away some existing users of the likes of EMC, NetApp, Dell or HP. Honestly, that&#39;s not something I thought possible going into this review. It&#39;s a nice surprise.”
***</li>
</ul>

<h3><a href="https://github.com/openbsd" rel="nofollow">OpenBSD now officially on GitHub</a></h3>

<ul>
<li>Got a couple of new OpenBSD items to bring to your attention today.</li>
<li>First up, for those who didn’t know, OpenBSD development has (always?) taken place in CVS, similar to NetBSD and previously FreeBSD. </li>
<li>However today, Git fans can rejoice, since there is now an “official” read-only github mirror of their sources for public consumption.</li>
<li>Since this is read-only, I will assume (unless told otherwise) that pull-requests and whatnot aren’t taken. But this will come in handy for the “git-enabled” among us who need an easier way to checkout OpenBSD sources.</li>
<li>There is also not yet a guarantee about the stability of the exporter. If you base a fork on the github branch, and something goes wrong with the exporter, the data may be reexported with different hashes, making it difficult to rebase your fork.</li>
</ul>

<h3><a href="https://libreboot.org/docs/bsd/openbsd.html" rel="nofollow">How to install LibertyBSD or OpenBSD on a libreboot system</a></h3>

<ul>
<li>For the second part of our OpenBSD stories, we have a pretty detailed document posted over at LibreBoot.org with details on how to boot-strap OpenBSD (Or LibertyBSD) using their open-source bios replacement.</li>
<li>We’ve covered blog posts and other tidbits about this process in the past, but this seems to be the definitive version  (so far)  to reference.</li>
<li>Some of the niceties include instructions on getting the USB image formatted not just on OpenBSD, but also FreeBSD, Linux and NetBSD.</li>
<li>Instructions on how to boot without full-disk-encryption are provided, with a mention that so far Libreboot + Grub does not support FDE (yet). I would imagine somebody will need to port over the openBSD FDE crypto support to GRUB, as was done with GELI at some point.</li>
<li>Lastly some instructions on how to configure grub, and troubleshoot if something goes wrong will help round-out this story. Give it a whirl, let us know if you run into issues.</li>
<li>Editorial Aside - Personally I find the libreboot stuff fascinating. It really is one of the last areas that we don’t have full control of our systems with open-source. With the growth of EFI, it seems we rely on a closed-source binary / mini-OS of sorts just to boot our Open Source solutions, which needs to be addressed. Hats off to the LibreBoot folks for taking on this important challenge.
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=wqSH_uQSArQ" rel="nofollow">FreeNAS 9.10 – LAGG &amp; VLAN Overview</a></h3>

<ul>
<li>A video tutorial on FreeNAS’s official YouTube Channel</li>
<li>Covers the advanced networking features, Link Aggregation and VLANs</li>
<li>Covers what the features do, and in the case of LAGG, how each of the modes work and when you might want to use it
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.cybercoders.com/bsd-developer-remote-job-305206" rel="nofollow">Remote BSD Developer Position is up for grabs</a></p></li>
<li><p><a href="https://twitter.com/jeamland/status/785965716717441024" rel="nofollow">Isilon is hiring for a FreeBSD Security position </a></p></li>
<li><p><a href="https://github.com/google/web-bsd-hunt" rel="nofollow">Google has ported the Networked real-time multi-player BSD game</a></p></li>
<li><p><a href="http://www.vincentdelft.be" rel="nofollow">A bunch of OpenBSD Tips</a></p></li>
<li><p><a href="http://www.ebay.com/itm/-/332000602939" rel="nofollow">The last OpenBSD 6.0 Limited Edition CD has sold</a></p></li>
<li><p><a href="https://twitter.com/DLangille/status/788477000876892162" rel="nofollow">Dan spots George Neville-Neil on TV at the Airport </a> </p></li>
<li><p><a href="https://www.youtube.com/watch?v=h7zlxgtBA6o" rel="nofollow">gnn on CNN</a> </p></li>
<li><p><a href="http://solobsd.blogspot.com/2016/10/release-solobsd-60-openbsd-edition.html" rel="nofollow">SoloBSD releases v 6.0 built upon OpenBSD</a></p></li>
<li><p><a href="http://knoxbug.org/content/2016-10-25" rel="nofollow">Upcoming KnoxBug looks at PacBSD - Oct 25th</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/Kr9ykKTu" rel="nofollow"> Morgan - Ports and Packages</a> </li>
<li><a href="http://pastebin.com/EwpTpp6D" rel="nofollow"> Mat - ZFS Memory</a> </li>
<li><a href="http://pastebin.com/HYMPtfjz" rel="nofollow"> Thomas - FreeBSD Path Length</a> </li>
<li><a href="http://pastebin.com/vGxZHMWE" rel="nofollow"> Cy - OpenBSD and NetHogs</a> </li>
<li><a href="http://pastebin.com/5FMz116T" rel="nofollow"> Lars - Editors</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we’ve got all sorts of goodies to discuss. Starting with, vmm, vkernels, raspberry pi and much more! Some iX folks are visiting from out of</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20161012092516&mode=flat&count=15" rel="nofollow">vmm enabled </a></h3>

<ul>
<li>VMM, the OpenBSD hypervisor, has been imported into current</li>
<li>It has similar hardware requirements to bhyve, a Intel Nehalem or newer CPU with the hardware virtualization features enabled in the BIOS</li>
<li>AMD support has not been started yet</li>
<li>OpenBSD is the only supported guest</li>
<li>It would be interesting to hear from viewers that have tried it, and hear how it does, and what still needs more work
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-October/624675.html" rel="nofollow">vkernels go COW</a></h3>

<ul>
<li>The DragonflyBSD feature, vkernels, has gained a new Copy-On-Write functionality</li>
<li>Disk images can now be mounted RO or RW, but changes will not be written back to the image file</li>
<li>This allows multiple vkernels to share the same disk image</li>
<li>“Note that when the vkernel operates on an image in this mode, modifications will eat up system memory and swap, so the user should be cognizant of the use-case.  Still, the flexibility of being able to mount the image R+W should not be underestimated.”</li>
<li>This is another feature we’d love to hear from viewers that have tried it out.
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/arm64/rpi3" rel="nofollow">Basic support for the RPI3 has landed in FreeBSD-CURRENT</a></h3>

<ul>
<li>The long awaited bits to allow FreeBSD to boot on the Raspberry Pi 3 have landed</li>
<li>There is still a bit of work to be done, some of the as mentioned in Oleksandr’s blog post:</li>
<li><a href="https://kernelnomicon.org/?p=690" rel="nofollow">Raspberry Pi support in HEAD</a> </li>
</ul>

<blockquote>
<p>“Raspberry Pi 3 limited support was committed to HEAD. Most of drivers should work with upstream dtb, RNG requires attention because callout mode seems to be broken and there is no IRQ in upstream device tree file. SMP is work in progress. There are some compatibility issue with VCHIQ driver due to some assumptions that are true only for ARM platform. “</p>
</blockquote>

<ul>
<li>This is exciting work. No HDMI support (yet), so if you plan on trying this out make sure you have your USB-&gt;Serial adapter cables ready to go.</li>
<li>Full Instructions to get started with your RPI 3 can be found on the <a href="https://wiki.freebsd.org/arm64/rpi3" rel="nofollow">FreeBSD Wiki</a></li>
<li>Relatively soon, I imagine there will be a RaspBSD build for the RPI3 to make it easier to get started</li>
<li>Eventually there will be official FreeBSD images as well
***</li>
</ul>

<h3><a href="https://github.com/openbsd/src/commit/2ba69c71e92471fe05f305bfa35aeac543ebec1f" rel="nofollow">OpenBSD switches softraid crypto from PKCS5 PBKDF2 to bcrypt PBKDF.</a></h3>

<ul>
<li>After the discussion a few weeks ago when a user wrote a tool to brute force their forgotten OpenBSD Full Disk Encryption password (from a password list of possible variations of their password), it was discovered that OpenBSD defaulted to using just 8192 iterations of PKCSv5 for the key derivation function with a SHA1-HMAC</li>
<li>The number of iterations can be manually controlled by the user when creating the softraid volume</li>
<li>By comparison, FreeBSDs GELI full disk encryption used a benchmark to pick a number of iterations that would take more than 2 seconds to complete, generally resulting in a number of iterations over 1 million on most modern hardware. The algorithm is based on a SHA512-HMAC</li>
<li>However, inefficiency in the implementation of PKCSv5 in GELI resulted in the implementation being 50% slower than some other implementations, meaning the effective security was only about 1 second per attempt, rather than the intended 2 seconds. The improved PKCSv5 implementation is out for review currently.</li>
<li>This commit to OpenBSD changes the default key derivation function to be based on bcrypt and a SHA512-HMAC instead.</li>
<li>OpenBSD also now uses a benchmark to pick a number of of iterations that will take approximately 1 second per attempt</li>
<li>“One weakness of PBKDF2 is that while its number of iterations can be adjusted to make it take an arbitrarily large amount of computing time, it can be implemented with a small circuit and very little RAM, which makes brute-force attacks using application-specific integrated circuits or graphics processing units relatively cheap. The bcrypt key derivation function requires a larger amount of RAM (but still not tunable separately, i. e. fixed for a given amount of CPU time) and is slightly stronger against such attacks, while the more modern scrypt key derivation function can use arbitrarily large amounts of memory and is therefore more resistant to ASIC and GPU attacks.”</li>
<li>The upgrade to the bcrypt, which has proven to be quite resistant to cracking by GPUs is a significant enhancement to OpenBSDs encrypted softraid feature
***</li>
</ul>

<h2>Interview - Josh Paetzel - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/bsdunix4ever" rel="nofollow">@bsdunix4ever</a></h2>

<ul>
<li>MeetBSD</li>
<li>ZFS Panel</li>
<li>FreeNAS - graceful network reload</li>
<li>Pxeboot
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.daemonology.net/blog/2016-10-09-EC2s-most-dangerous-feature.html" rel="nofollow">EC2&#39;s most dangerous feature</a></h3>

<ul>
<li>Colin Percival, FreeBSD’s unofficial EC2 maintainer, has published a blog post about “EC2&#39;s most dangerous feature”</li>
<li>“As a FreeBSD developer — and someone who writes in C — I believe strongly in the idea of &quot;tools, not policy&quot;. If you want to shoot yourself in the foot, I&#39;ll help you deliver the bullet to your foot as efficiently and reliably as possible. UNIX has always been built around the idea that systems administrators are better equipped to figure out what they want than the developers of the OS, and it&#39;s almost impossible to prevent foot-shooting without also limiting useful functionality. The most powerful tools are inevitably dangerous, and often the best solution is to simply ensure that they come with sufficient warning labels attached; but occasionally I see tools which not only lack important warning labels, but are also designed in a way which makes them far more dangerous than necessary. Such a case is IAM Roles for Amazon EC2.”</li>
<li>“A review for readers unfamiliar with this feature: Amazon IAM (Identity and Access Management) is a service which allows for the creation of access credentials which are limited in scope; for example, you can have keys which can read objects from Amazon S3 but cannot write any objects. IAM Roles for EC2 are a mechanism for automatically creating such credentials and distributing them to EC2 instances; you specify a policy and launch an EC2 instance with that Role attached, and magic happens making time-limited credentials available via the EC2 instance metadata. This simplifies the task of creating and distributing credentials and is very convenient; I use it in my FreeBSD AMI Builder AMI, for example. Despite being convenient, there are two rather scary problems with this feature which severely limit the situations where I&#39;d recommend using it.”</li>
<li>“The first problem is one of configuration: The language used to specify IAM Policies is not sufficient to allow for EC2 instances to be properly limited in their powers. For example, suppose you want to allow EC2 instances to create, attach, detach, and delete Elastic Block Store volumes automatically — useful if you want to have filesystems automatically scaling up and down depending on the amount of data which they contain. The obvious way to do this is would be to &quot;tag&quot; the volumes belonging to an EC2 instance and provide a Role which can only act on volumes tagged to the instance where the Role was provided; while the second part of this (limiting actions to tagged volumes) seems to be possible, there is no way to require specific API call parameters on all permitted CreateVolume calls, as would be necessary to require that a tag is applied to any new volumes being created by the instance.”</li>
<li>“As problematic as the configuration is, a far larger problem with IAM Roles for Amazon EC2 is access control — or, to be more precise, the lack thereof. As I mentioned earlier, IAM Role credentials are exposed to EC2 instances via the EC2 instance metadata system: In other words, they&#39;re available from <a href="http://169.254.169.254/" rel="nofollow">http://169.254.169.254/</a>. (I presume that the &quot;EC2ws&quot; HTTP server which responds is running in another Xen domain on the same physical hardware, but that implementation detail is unimportant.) This makes the credentials easy for programs to obtain... unfortunately, too easy for programs to obtain. UNIX is designed as a multi-user operating system, with multiple users and groups and permission flags and often even more sophisticated ACLs — but there are very few systems which control the ability to make outgoing HTTP requests. We write software which relies on privilege separation to reduce the likelihood that a bug will result in a full system compromise; but if a process which is running as user nobody and chrooted into /var/empty is still able to fetch AWS keys which can read every one of the objects you have stored in S3, do you really have any meaningful privilege separation? To borrow a phrase from Ted Unangst, the way that IAM Roles expose credentials to EC2 instances makes them a very effective exploit mitigation mitigation technique.”</li>
<li>“To make it worse, exposing credentials — and other metadata, for that matter — via HTTP is completely unnecessary. EC2 runs on Xen, which already has a perfectly good key-value data store for conveying metadata between the host and guest instances. It would be absolutely trivial for Amazon to place EC2 metadata, including IAM credentials, into XenStore; and almost as trivial for EC2 instances to expose XenStore as a filesystem to which standard UNIX permissions could be applied, providing IAM Role credentials with the full range of access control functionality which UNIX affords to files stored on disk. Of course, there is a lot of code out there which relies on fetching EC2 instance metadata over HTTP, and trivial or not it would still take time to write code for pushing EC2 metadata into XenStore and exposing it via a filesystem inside instances; so even if someone at AWS reads this blog post and immediately says &quot;hey, we should fix this&quot;, I&#39;m sure we&#39;ll be stuck with the problems in IAM Roles for years to come.”</li>
<li>“So consider this a warning label: IAM Roles for EC2 may seem like a gun which you can use to efficiently and reliably shoot yourself in the foot; but in fact it&#39;s more like a gun which is difficult to aim and might be fired by someone on the other side of the room snapping his fingers. Handle with care!”
***</li>
</ul>

<h3><a href="http://www.theregister.co.uk/2016/10/18/truenas_review/" rel="nofollow">Open-source storage that doesn&#39;t suck? Our man tries to break TrueNAS</a></h3>

<ul>
<li>The storage reviewer over at TheRegister got their hands on a TrueNAS and gave it a try</li>
<li>“Data storage is difficult, and ZFS-based storage doubly so. There&#39;s a lot of money to be made if you can do storage right, so it&#39;s uncommon to see a storage company with an open-source model deliver storage that doesn&#39;t suck.”</li>
<li>“To become TrueNAS, FreeNAS&#39;s code is feature-frozen and tested rigorously. Bleeding-edge development continues with FreeNAS, and FreeNAS comes with far fewer guarantees than does TrueNAS.”</li>
<li>“iXsystems provided a Z20 hybrid storage array. The Z20 is a dual-controller, SAS-based, high-availability, hybrid storage array. The testing unit came with a 2x 10GbE NIC per controller and retails around US$24k. The unit shipped with 10x 300GB 10k RPM magnetic hard drives, an 8GB ZIL SSD and a 200GB L2ARC SSD. 50GiB of RAM was dedicated to the ARC by the system&#39;s autotune feature.”</li>
<li>The review tests the performance of the TrueNAS, which they found acceptable for spinning rust, but they also tested the HA features</li>
<li>While the look of the UI didn’t impress them, the functionality and built in help did</li>
<li>“The UI contains truly excellent mouseover tooltips that provide detailed information and rationale for almost every setting. An experienced sysadmin will be able to navigate the TrueNAS UI with ease. An experienced storage admin who knows what all the terms mean won&#39;t have to refer to a wiki or the more traditional help manual, but the same can&#39;t be said for the uninitiated.”</li>
<li>“After a lot of testing, I&#39;d trust my data to the TrueNAS. I am convinced that it will ensure the availability of my data to within any reasonable test, and do so as a high availability solution. That&#39;s more than I can say for a lot of storage out there.”</li>
<li>“iXsystems produce a storage array that is decent enough to entice away some existing users of the likes of EMC, NetApp, Dell or HP. Honestly, that&#39;s not something I thought possible going into this review. It&#39;s a nice surprise.”
***</li>
</ul>

<h3><a href="https://github.com/openbsd" rel="nofollow">OpenBSD now officially on GitHub</a></h3>

<ul>
<li>Got a couple of new OpenBSD items to bring to your attention today.</li>
<li>First up, for those who didn’t know, OpenBSD development has (always?) taken place in CVS, similar to NetBSD and previously FreeBSD. </li>
<li>However today, Git fans can rejoice, since there is now an “official” read-only github mirror of their sources for public consumption.</li>
<li>Since this is read-only, I will assume (unless told otherwise) that pull-requests and whatnot aren’t taken. But this will come in handy for the “git-enabled” among us who need an easier way to checkout OpenBSD sources.</li>
<li>There is also not yet a guarantee about the stability of the exporter. If you base a fork on the github branch, and something goes wrong with the exporter, the data may be reexported with different hashes, making it difficult to rebase your fork.</li>
</ul>

<h3><a href="https://libreboot.org/docs/bsd/openbsd.html" rel="nofollow">How to install LibertyBSD or OpenBSD on a libreboot system</a></h3>

<ul>
<li>For the second part of our OpenBSD stories, we have a pretty detailed document posted over at LibreBoot.org with details on how to boot-strap OpenBSD (Or LibertyBSD) using their open-source bios replacement.</li>
<li>We’ve covered blog posts and other tidbits about this process in the past, but this seems to be the definitive version  (so far)  to reference.</li>
<li>Some of the niceties include instructions on getting the USB image formatted not just on OpenBSD, but also FreeBSD, Linux and NetBSD.</li>
<li>Instructions on how to boot without full-disk-encryption are provided, with a mention that so far Libreboot + Grub does not support FDE (yet). I would imagine somebody will need to port over the openBSD FDE crypto support to GRUB, as was done with GELI at some point.</li>
<li>Lastly some instructions on how to configure grub, and troubleshoot if something goes wrong will help round-out this story. Give it a whirl, let us know if you run into issues.</li>
<li>Editorial Aside - Personally I find the libreboot stuff fascinating. It really is one of the last areas that we don’t have full control of our systems with open-source. With the growth of EFI, it seems we rely on a closed-source binary / mini-OS of sorts just to boot our Open Source solutions, which needs to be addressed. Hats off to the LibreBoot folks for taking on this important challenge.
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=wqSH_uQSArQ" rel="nofollow">FreeNAS 9.10 – LAGG &amp; VLAN Overview</a></h3>

<ul>
<li>A video tutorial on FreeNAS’s official YouTube Channel</li>
<li>Covers the advanced networking features, Link Aggregation and VLANs</li>
<li>Covers what the features do, and in the case of LAGG, how each of the modes work and when you might want to use it
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.cybercoders.com/bsd-developer-remote-job-305206" rel="nofollow">Remote BSD Developer Position is up for grabs</a></p></li>
<li><p><a href="https://twitter.com/jeamland/status/785965716717441024" rel="nofollow">Isilon is hiring for a FreeBSD Security position </a></p></li>
<li><p><a href="https://github.com/google/web-bsd-hunt" rel="nofollow">Google has ported the Networked real-time multi-player BSD game</a></p></li>
<li><p><a href="http://www.vincentdelft.be" rel="nofollow">A bunch of OpenBSD Tips</a></p></li>
<li><p><a href="http://www.ebay.com/itm/-/332000602939" rel="nofollow">The last OpenBSD 6.0 Limited Edition CD has sold</a></p></li>
<li><p><a href="https://twitter.com/DLangille/status/788477000876892162" rel="nofollow">Dan spots George Neville-Neil on TV at the Airport </a> </p></li>
<li><p><a href="https://www.youtube.com/watch?v=h7zlxgtBA6o" rel="nofollow">gnn on CNN</a> </p></li>
<li><p><a href="http://solobsd.blogspot.com/2016/10/release-solobsd-60-openbsd-edition.html" rel="nofollow">SoloBSD releases v 6.0 built upon OpenBSD</a></p></li>
<li><p><a href="http://knoxbug.org/content/2016-10-25" rel="nofollow">Upcoming KnoxBug looks at PacBSD - Oct 25th</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/Kr9ykKTu" rel="nofollow"> Morgan - Ports and Packages</a> </li>
<li><a href="http://pastebin.com/EwpTpp6D" rel="nofollow"> Mat - ZFS Memory</a> </li>
<li><a href="http://pastebin.com/HYMPtfjz" rel="nofollow"> Thomas - FreeBSD Path Length</a> </li>
<li><a href="http://pastebin.com/vGxZHMWE" rel="nofollow"> Cy - OpenBSD and NetHogs</a> </li>
<li><a href="http://pastebin.com/5FMz116T" rel="nofollow"> Lars - Editors</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>163: Return of the Cantrill</title>
  <link>https://www.bsdnow.tv/163</link>
  <guid isPermaLink="false">da2fb252-95f1-407c-a537-6124802c6003</guid>
  <pubDate>Wed, 12 Oct 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/da2fb252-95f1-407c-a537-6124802c6003.mp3" length="94687348" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The wait is over, 11.0 of FreeBSD has (officially) launched. We’ll have coverage of this, plus a couple looks back at UNIX history, and a crowd-favorite guest today.</itunes:subtitle>
  <itunes:duration>2:11:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The wait is over, 11.0 of FreeBSD has (officially) launched. We’ll have coverage of this, plus a couple looks back at UNIX history, and a crowd-favorite guest today.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD 11.0-RELEASE Now Available (https://lists.freebsd.org/pipermail/freebsd-announce/2016-October/001760.html)
FreeBSD 11.0-RELEASE is now officially out.
A last minute reroll to pickup OpenSSL updates and a number of other security fixes meant the release was a little behind schedule, and shipped as 11.0-RELEASE-p1, but the release is better for it
Improved support for 802.11n and various wifi drivers
Support for the AArch64 (arm64) architecture has been added.
Native graphics support has been added to the bhyve(8) hypervisor.
A new flag, “onifconsole” has been added to /etc/ttys. This allows the system to provide a login prompt via serial console if the device is an active kernel console, otherwise it is equivalent to off.
The xz(1) utility has been updated to support multi-threaded compression.
A number of kernel panics related to VNET have been fixed
The IMAGACT_BINMISC kernel configuration option has been enabled by default, which enables application execution through emulators, such as QEMU via binmiscctl(8).
The GENERIC kernel configuration has been updated to include the IPSEC option by default.
The kern.osrelease and kern.osreldate are now configurable jail(8) parameters
A new sysctl(8), kern.racct.enable, has been added, which when set to a non-zero value allows using rctl(8) with the GENERIC kernel. A new kernel configuration option, RACCT_DISABLED has also been added.
The minimum (arcmin) and maximum (arcmax) values for the ZFS adaptive replacement cache can be modified at runtime.
Changes to watch out for:
OpenSSH DSA key generation has been disabled by default. It is important to update OpenSSH keys prior to upgrading. Additionally, Protocol 1 support has been removed.
By default, the ifconfig(8) utility will set the default regulatory domain to FCC on wireless interfaces. As a result, newly created wireless interfaces with default settings will have less chance to violate country-specific regulations.
An issue was discovered with Amazon® EC2™ images which would cause the virtual machine to hang during boot when upgrading from previous FreeBSD versions. New EC2™ installations are not affected, but existing installations running earlier releases are advised to wait until the issue is resolved in an Errata Notice before upgrading. An Errata Notice to address this is planned following the release.
***
process listing consistency (http://www.tedunangst.com/flak/post/process-listing-consistency)
Ted Unangst asks: how consistent is the output of ps(1)?
If processes are starting and exiting constantly, and you run ps(1), is the output guaranteed to reflect that exact moment in time, or might it include some processes that have gone away before ps(1) exited, and include some processes that did not exist when ps(1) was started?
Ted provides a little example chicken/egg program to try to create such an inconsistency, so you can test out your OS
On OpenBSD ps(1) was switched away from the reading kernel memory directly, and instead uses the KERNPROCALL sysctl
Thus sysctl can iterate over the entire process list, copying out information to ps(1), without blocking. If we prevent processes from forking or exiting during this time, we get a consistent snapshot. The snapshot may be stale, but it will never show us a viewpoint that never happened.
So, OpenBSD will always be consistent, or will it?
Is there a way to trick ps on OpenBSD? Not everything is consistent. There’s a separate sysctl, KERNPROCARGV, that reads the command line arguments for a process, but it only works on one process at a time. Processes can modify their own argv at any time.
A second test program changes the process title of both the chicken and the egg, and if you run ps(1), you can get back a result that never actually happened.
The argv of the first program is read by ps(1), and in the meantime, it changes to a different value. The second program also changes its value, so now when ps(1) reads it, it sees the new value, not the original value from when ps(1) was started.
So the output is not that consistent, but is it worth the effort to try to make it so?
DragonFlyBSD - if_iwm - Add basic powermanagement support via ifconfig wlan0 powersave (http://lists.dragonflybsd.org/pipermail/commits/2016-October/624673.html)
WiFi can often be one of the biggest drains on your laptop battery, so anything we can do to improve the situation should be embraced. 
Imre VadÃ¡sz over at the DragonFly project has done that, porting over a new set of power management support from Linux to the if_iwm driver. 
if_iwm - Add basic powermanagement support via ifconfig wlan0 powersave.
The DEVICEPOWERFLAGSCAMMSK flag was removed in the upstream iwlwifi in Linux commit ceef91c89480dd18bb3ac51e91280a233d0ca41f.
Add scpsdisabled flag to struct iwmsoftc, which corresponds to mvm-&amp;gt;psdisabled in struct iwl_mvm in Linux iwlwifi.
Adds a hw.iwm.powerscheme tunable which corresponds to the powerscheme module parameter in Linux iwlwifi. Set this to 1 for completely disabling power management, 2 (default) for balanced powermanagement, and 3 for lowerpower mode (which does dtim period skipping).
Imports the constants.h file from iwlwifi as ifiwmconstants.h.
This doesn't allow changing the powermanagement setting while connected,
also one can only choose between enabled and disabled powersaving with
ifconfig (so switching between balanced and low-power mode requires
rebooting to change the tunable).
After any changes to powermanagement (i.e. "ifconfig wlan0 powersave" to
enable powermanagement, or "ifconfig wlan0 -powersave" for disabling
powermanagement), one has to disconnect and reconnect to the accespoint
for the change to take effect.“
Good stuff! These positive changes need to happen more often and sooner, so we can all eek out every drop of power from our respective laptops.
***
Helping out an Internet Friend…Dual boot OpenBSD  (https://functionallyparanoid.com/2016/10/03/helping-out-an-internet-friend/)
Dual-booting OpenBSD and Linux, via UEFI. A year ago we wouldn’t be discussing this, but today we have an article where somebody has done exactly that.
This Journey was undertaken by Brian Everly (Indiana Bug), partly due to a friend who wanted to dual-boot his laptop which already has an existing UEFI install on it.
As a proof of concept, he began by replicating the setup in VMware with UEFI
He started by throwing Ubuntu into the VM, with some special attention paid to partitioning to ensure enough room left-over for OpenBSD later.
I created a 64MB EFI partition at the front of the disk. Next, I created a 20GB primary partition at the beginning of the space, mounted as the root (/) filesystem.
I then added a 4096MB swap partition for Ubuntu. Finally, I used the rest of the free space to create a Reserved BIOS Boot Area FAT32 partition that was not associated with a mount point – this is where I will be installing OpenBSD.
With that done, he wrapped up the Ubuntu installation and then turned over to to the OpenBSD side. Some manual partitioning was required to install to the “Reserved FAT32” partition.
I mashed through the defaults in the OpenBSD installer until I got to the disk partitioning.  Since I told VMWare to make my hard drive an IDE one, I knew I was playing around with wd0 and not sd0 (my USB key).  I dumped into fdisk by selecting to (E)dit the partition scheme and saw my setup from Linux.  First was the EFI partition (I am guessing I’ll have to copy my bootx64.efi file to that at some point), second was the Linux etx4 partition, third was my Linux swap partition and fourth was a weird looking one that is the “Reserved BIOS Boot” partition.  That’s the one I’ll fiddle with.
Issuing the command “edit 3” allowed me to fiddle with that partition #3 (remember, we start counting at zero).  I set it’s type to “A6” (OpenBSD) and then took the defaults with the exception of naming it “OpenBSD”.  A quick “write” followed by a “quit” allowed me to update my new partition and get back to the installer.
Once the installation was wrapped up (OpenBSD helpfully already created the /boot/EFI partition with the correct EFI loader installed) he was able to reboot and select between the two systems at the UEFI bios screen.
For kicks, he lastly went into Ubuntu and grabbed refind. Installing refind provided a fancy graphical selector between the two systems without too much trouble.
Next step will be to replicate this process on his friend’s laptop. Wishing you luck with that journey!
Interview - Bryan Cantrill - email@email (mailto:email@email) / @twitter (https://twitter.com/user)
CTO of Joyent
***
News Roundup
After 22 Years, 386BSD Gets An Update (https://bsd.slashdot.org/story/16/10/09/0230203/after-22-years-386bsd-gets-an-update)
Slashdot brings us an interesting mention this week, specifically that after 22 years, we now have an update to 386BSD.
386BSD was last released back in 1994 with a series of articles in Dr. Dobb's Journal -- but then developers for this BSD-based operating system started migrating to both FreeBSD and NetBSD. An anonymous Slashdot reader writes: The last known public release was version 0.1. Until Wednesday, when Lynne Jolitz, one of the co-authors of 386BSD, released the source code to version 1.0 as well as 2.0 on Github.
386BSD takes us back to the days when you could count every file in your Unix distribution and more importantly, read and understand all of your OS source code. 386BSD is also the missing link between BSD and Linux. One can find fragments of Linus Torvalds's math emulation code in the source code of 386BSD. To quote Linus: "If 386BSD had been available when I started on Linux, Linux would probably never had happened.”
Though it was designed for Intel 80386 microprocessors, there's already instructions for launching it on the hosted hardware virtualization service Qemu.
There you have it! Go grab the new hotness that is 386BSD and run it in 2016! Or perhaps you want FreeBSD 11, but to each their own.
***
Progress of the OpenBSD Limited Edition Signed CD set (http://undeadly.org/cgi?action=article&amp;amp;sid=20160929230557&amp;amp;mode=expanded)
An update from a story last week! We mentioned the “very” limited edition OpenBSD 6.0 signed CD sets that had gone up for Auction on Ebay. (With proceeds to support for Foundation)
As of today, here’s where we stand:
CD set #1 (Sep 29th + 5 days) sold for $4200 (http://www.ebay.com/itm/-/331985953783)
CD set #2 (Oct 4th + 3 days) sold for $3000 (http://www.ebay.com/itm/-/331990536246)
CD set #3 (Oct 8th + 3 days) sold for $817 (http://www.ebay.com/itm/-/331994217419)
CD set #4 (Oct 11th + 3 days) is currently up for bidding (http://www.ebay.com/itm/-/331997031152)
There you have it! The 4th set is almost wrapped up bidding, and the 5th and last set is not far behind. Be sure to grab your piece of BSD history before its gone!
PROTOTYPE FreeBSD Jail/ZFS based implementation of the Application Container Specification (https://github.com/3ofcoins/jetpack)
“Jetpack is an experimental and incomplete implementation of the App Container Specification for FreeBSD. It uses jails as isolation mechanism, and ZFS for layered storage.”
“This document uses some language used in Rocket, the reference implementation of the App Container Specification. While the documentation will be expanded in the future, currently you need to be familiar at least with Rocket's README to understand everything.”
+ A standard with multiple implementations, that allow substitution of components, such as FreeBSD Jails instead of docker/lxc etc, and ZFS instead of overlayfs etc, is very exciting
Microsoft’s Forgotten Unix-based Operating System (https://fossbytes.com/xenix-history-microsoft-unix-operating-system/)
Do you remember the good old days. You know, when Microsoft was the driving force behind UNIX? Wait, what did you say you may be thinking? It’s true, and lets sit back and let FossBytes tell us a tale of what once was reality.
The story begins sometime in the late 70’s:
Turning back the pages to the late 1970’s, Microsoft entered into an agreement with AT&amp;amp;T Corporation to license Unix from AT&amp;amp;T. While the company didn’t sell the OS to public, it licensed it to other OEM vendors like Intel, SCO, and Tandy.
As Microsoft had to face legal trouble due to “Unix” name, the company renamed it and came up with its own Unix distribution. So, AT&amp;amp;T licensed Unix to Redmond that was passed on to other OEMs as Xenix.
It’s interesting to recall a time when Microsoft enabled people to run Unix — an operating system originally designed for large and multiuser systems — on a microcomputer. Even though it came first, Unix was probably more powerful than MS-DOS.
So whatever happened to this microsoft-flavored UNIX you may ask? Sadly it was ditched for DOS due to $REASONS:
In early 1980’s, IBM was looking for an OS to power its PC. As IBM didn’t want to maintain any ties with the recently split AT&amp;amp;T, Xenix was automatically rejected. To fulfill, the tech giant’s demand, Microsoft bought 86-DOS from Seattle Computer Products and managed to convince IBM to use it in their systems.
Slowly, Microsoft started losing interest in Xenix and traded the full rights of Xenix with SCO, a Xenix partner company. The company filed bankruptcy in 2007 before taking the Xenix legacy to the 21st century in the form of Open Server, previously known as SCO Unix and SCO Open Desktop.
An interesting chapter in UNIX history to be sure, and funny enough may come full-circle someday with Microsoft beginning to show interest in UNIX and BSD once again.
***
Beastie Bits
Ohio LinuxFest 2016 wrap-up (http://blather.michaelwlucas.com/archives/2791)
Learn X in Y minutes Where X=zfs (https://learnxinyminutes.com/docs/zfs/)
Add touchscreen support for the official 7" RPi touch display  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=306430) 
64-bit U-Boot on Raspberry Pi 3  (https://kernelnomicon.org/?p=682)
SNIA SDC 2016 Recap: Michael Dexter (https://www.ixsystems.com/blog/snia-sdc-2016-recap-michael-dexter/)
OpenZFS: Stronger than ever (https://www.ixsystems.com/blog/openzfs-devsummit-2016/) 
Accurate, Traceable, and Verifiable Time Synchronization for World Financial Markets (http://nvlpubs.nist.gov/nistpubs/jres/121/jres.121.023.pdf) 
ON HOLY WARS AND A PLEA FOR PEACE (https://www.ietf.org/rfc/ien/ien137.txt) 
Feedback/Questions
 Morgan - Zero-Filling an VM (http://pastebin.com/CYcqmW7P) 
 Charlie - ZFS Bit-Rot (http://pastebin.com/12mNW57h) 
 Matias - TrueOS / Launchd (http://pastebin.com/NfYWt2cu) 
 Dale - DO Feedback (http://pastebin.com/UvKh2WcF) 
 James - DO / FreeBSD Locks? (http://pastebin.com/0cdMc88U) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The wait is over, 11.0 of FreeBSD has (officially) launched. We’ll have coverage of this, plus a couple looks back at UNIX history, and a crowd-favorite guest today.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2016-October/001760.html" rel="nofollow">FreeBSD 11.0-RELEASE Now Available</a></h3>

<ul>
<li>FreeBSD 11.0-RELEASE is now officially out.</li>
<li>A last minute reroll to pickup OpenSSL updates and a number of other security fixes meant the release was a little behind schedule, and shipped as 11.0-RELEASE-p1, but the release is better for it</li>
<li>Improved support for 802.11n and various wifi drivers</li>
<li>Support for the AArch64 (arm64) architecture has been added.</li>
<li>Native graphics support has been added to the bhyve(8) hypervisor.</li>
<li>A new flag, “onifconsole” has been added to /etc/ttys. This allows the system to provide a login prompt via serial console if the device is an active kernel console, otherwise it is equivalent to off.</li>
<li>The xz(1) utility has been updated to support multi-threaded compression.</li>
<li>A number of kernel panics related to VNET have been fixed</li>
<li>The IMAGACT_BINMISC kernel configuration option has been enabled by default, which enables application execution through emulators, such as QEMU via binmiscctl(8).</li>
<li>The GENERIC kernel configuration has been updated to include the IPSEC option by default.</li>
<li>The kern.osrelease and kern.osreldate are now configurable jail(8) parameters</li>
<li>A new sysctl(8), kern.racct.enable, has been added, which when set to a non-zero value allows using rctl(8) with the GENERIC kernel. A new kernel configuration option, RACCT_DISABLED has also been added.</li>
<li>The minimum (arc_min) and maximum (arc_max) values for the ZFS adaptive replacement cache can be modified at runtime.</li>
<li><strong>Changes to watch out for</strong>:

<ul>
<li>OpenSSH DSA key generation has been disabled by default. It is important to update OpenSSH keys prior to upgrading. Additionally, Protocol 1 support has been removed.</li>
<li>By default, the ifconfig(8) utility will set the default regulatory domain to FCC on wireless interfaces. As a result, newly created wireless interfaces with default settings will have less chance to violate country-specific regulations.</li>
<li>An issue was discovered with Amazon® EC2™ images which would cause the virtual machine to hang during boot when upgrading from previous FreeBSD versions. New EC2™ installations are not affected, but existing installations running earlier releases are advised to wait until the issue is resolved in an Errata Notice before upgrading. An Errata Notice to address this is planned following the release.
***</li>
</ul></li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/process-listing-consistency" rel="nofollow">process listing consistency</a></h3>

<ul>
<li>Ted Unangst asks: how consistent is the output of ps(1)?</li>
<li>If processes are starting and exiting constantly, and you run ps(1), is the output guaranteed to reflect that exact moment in time, or might it include some processes that have gone away before ps(1) exited, and include some processes that did not exist when ps(1) was started?</li>
<li>Ted provides a little example chicken/egg program to try to create such an inconsistency, so you can test out your OS</li>
<li>On OpenBSD ps(1) was switched away from the reading kernel memory directly, and instead uses the KERN_PROC_ALL sysctl</li>
</ul>

<blockquote>
<p>Thus sysctl can iterate over the entire process list, copying out information to ps(1), without blocking. If we prevent processes from forking or exiting during this time, we get a consistent snapshot. The snapshot may be stale, but it will never show us a viewpoint that never happened.</p>
</blockquote>

<ul>
<li>So, OpenBSD will always be consistent, or will it?</li>
</ul>

<blockquote>
<p>Is there a way to trick ps on OpenBSD? Not everything is consistent. There’s a separate sysctl, KERN_PROC_ARGV, that reads the command line arguments for a process, but it only works on one process at a time. Processes can modify their own argv at any time.</p>
</blockquote>

<ul>
<li><p>A second test program changes the process title of both the chicken and the egg, and if you run ps(1), you can get back a result that never actually happened.</p></li>
<li><p>The argv of the first program is read by ps(1), and in the meantime, it changes to a different value. The second program also changes its value, so now when ps(1) reads it, it sees the new value, not the original value from when ps(1) was started.</p></li>
<li><p>So the output is not that consistent, but is it worth the effort to try to make it so?</p>

<hr></li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-October/624673.html" rel="nofollow">DragonFlyBSD - if_iwm - Add basic powermanagement support via ifconfig wlan0 powersave</a></h3>

<ul>
<li>WiFi can often be one of the biggest drains on your laptop battery, so anything we can do to improve the situation should be embraced. </li>
<li>Imre VadÃ¡sz over at the DragonFly project has done that, porting over a new set of power management support from Linux to the if_iwm driver. </li>
</ul>

<blockquote>
<p>if_iwm - Add basic powermanagement support via ifconfig wlan0 powersave.</p>

<ul>
<li><p>The DEVICE_POWER_FLAGS_CAM_MSK flag was removed in the upstream iwlwifi in Linux commit ceef91c89480dd18bb3ac51e91280a233d0ca41f.</p></li>
<li><p>Add sc_ps_disabled flag to struct iwm_softc, which corresponds to mvm-&gt;ps_disabled in struct iwl_mvm in Linux iwlwifi.</p></li>
<li><p>Adds a hw.iwm.power_scheme tunable which corresponds to the power_scheme module parameter in Linux iwlwifi. Set this to 1 for completely disabling power management, 2 (default) for balanced powermanagement, and 3 for lowerpower mode (which does dtim period skipping).</p>

<ul>
<li>Imports the constants.h file from iwlwifi as if_iwm_constants.h.</li>
<li>This doesn&#39;t allow changing the powermanagement setting while connected,
also one can only choose between enabled and disabled powersaving with
ifconfig (so switching between balanced and low-power mode requires
rebooting to change the tunable).</li>
<li>After any changes to powermanagement (i.e. &quot;ifconfig wlan0 powersave&quot; to
enable powermanagement, or &quot;ifconfig wlan0 -powersave&quot; for disabling
powermanagement), one has to disconnect and reconnect to the accespoint
for the change to take effect.“</li>
</ul></li>
</ul>
</blockquote>

<ul>
<li>Good stuff! These positive changes need to happen more often and sooner, so we can all eek out every drop of power from our respective laptops.
***</li>
</ul>

<h3><a href="https://functionallyparanoid.com/2016/10/03/helping-out-an-internet-friend/" rel="nofollow">Helping out an Internet Friend…Dual boot OpenBSD </a></h3>

<ul>
<li>Dual-booting OpenBSD and Linux, via UEFI. A year ago we wouldn’t be discussing this, but today we have an article where somebody has done exactly that.</li>
<li>This Journey was undertaken by Brian Everly (Indiana Bug), partly due to a friend who wanted to dual-boot his laptop which already has an existing UEFI install on it.</li>
<li>As a proof of concept, he began by replicating the setup in VMware with UEFI</li>
<li>He started by throwing Ubuntu into the VM, with some special attention paid to partitioning to ensure enough room left-over for OpenBSD later.</li>
</ul>

<blockquote>
<p>I created a 64MB EFI partition at the front of the disk. Next, I created a 20GB primary partition at the beginning of the space, mounted as the root (/) filesystem.</p>

<p>I then added a 4096MB swap partition for Ubuntu. Finally, I used the rest of the free space to create a Reserved BIOS Boot Area FAT32 partition that was not associated with a mount point – this is where I will be installing OpenBSD.</p>
</blockquote>

<ul>
<li>With that done, he wrapped up the Ubuntu installation and then turned over to to the OpenBSD side. Some manual partitioning was required to install to the “Reserved FAT32” partition.</li>
</ul>

<blockquote>
<p>I mashed through the defaults in the OpenBSD installer until I got to the disk partitioning.  Since I told VMWare to make my hard drive an IDE one, I knew I was playing around with wd0 and not sd0 (my USB key).  I dumped into fdisk by selecting to (E)dit the partition scheme and saw my setup from Linux.  First was the EFI partition (I am guessing I’ll have to copy my bootx64.efi file to that at some point), second was the Linux etx4 partition, third was my Linux swap partition and fourth was a weird looking one that is the “Reserved BIOS Boot” partition.  That’s the one I’ll fiddle with.</p>

<p>Issuing the command “edit 3” allowed me to fiddle with that partition #3 (remember, we start counting at zero).  I set it’s type to “A6” (OpenBSD) and then took the defaults with the exception of naming it “OpenBSD”.  A quick “write” followed by a “quit” allowed me to update my new partition and get back to the installer.</p>
</blockquote>

<ul>
<li>Once the installation was wrapped up (OpenBSD helpfully already created the /boot/EFI partition with the correct EFI loader installed) he was able to reboot and select between the two systems at the UEFI bios screen.</li>
<li>For kicks, he lastly went into Ubuntu and grabbed refind. Installing refind provided a fancy graphical selector between the two systems without too much trouble.</li>
<li>Next step will be to replicate this process on his friend’s laptop. Wishing you luck with that journey!</li>
</ul>

<hr>

<h2>Interview - Bryan Cantrill - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/user" rel="nofollow">@twitter</a></h2>

<ul>
<li>CTO of Joyent
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://bsd.slashdot.org/story/16/10/09/0230203/after-22-years-386bsd-gets-an-update" rel="nofollow">After 22 Years, 386BSD Gets An Update</a></h3>

<ul>
<li>Slashdot brings us an interesting mention this week, specifically that after 22 years, we now have an update to 386BSD.</li>
</ul>

<blockquote>
<p>386BSD was last released back in 1994 with a series of articles in Dr. Dobb&#39;s Journal -- but then developers for this BSD-based operating system started migrating to both FreeBSD and NetBSD. An anonymous Slashdot reader writes: The last known public release was version 0.1. Until Wednesday, when Lynne Jolitz, one of the co-authors of 386BSD, released the source code to version 1.0 as well as 2.0 on Github.</p>

<p>386BSD takes us back to the days when you could count every file in your Unix distribution and more importantly, read and understand all of your OS source code. 386BSD is also the missing link between BSD and Linux. One can find fragments of Linus Torvalds&#39;s math emulation code in the source code of 386BSD. To quote Linus: &quot;If 386BSD had been available when I started on Linux, Linux would probably never had happened.”</p>

<p>Though it was designed for Intel 80386 microprocessors, there&#39;s already instructions for launching it on the hosted hardware virtualization service Qemu.</p>
</blockquote>

<ul>
<li>There you have it! Go grab the new hotness that is 386BSD and run it in 2016! Or perhaps you want FreeBSD 11, but to each their own.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160929230557&mode=expanded" rel="nofollow">Progress of the OpenBSD Limited Edition Signed CD set</a></h3>

<ul>
<li>An update from a story last week! We mentioned the “very” limited edition OpenBSD 6.0 signed CD sets that had gone up for Auction on Ebay. (With proceeds to support for Foundation)</li>
<li><p>As of today, here’s where we stand:</p>

<ul>
<li>CD set #1 (Sep 29th + 5 days) <a href="http://www.ebay.com/itm/-/331985953783" rel="nofollow">sold for $4200</a></li>
<li>CD set #2 (Oct 4th + 3 days) <a href="http://www.ebay.com/itm/-/331990536246" rel="nofollow">sold for $3000</a></li>
<li>CD set #3 (Oct 8th + 3 days) <a href="http://www.ebay.com/itm/-/331994217419" rel="nofollow">sold for $817</a></li>
<li>CD set #4 (Oct 11th + 3 days) is <a href="http://www.ebay.com/itm/-/331997031152" rel="nofollow">currently up for bidding</a></li>
</ul></li>
<li><p>There you have it! The 4th set is almost wrapped up bidding, and the 5th and last set is not far behind. Be sure to grab your piece of BSD history before its gone!</p>

<hr></li>
</ul>

<h3><a href="https://github.com/3ofcoins/jetpack" rel="nofollow"><strong>PROTOTYPE</strong> FreeBSD Jail/ZFS based implementation of the Application Container Specification</a></h3>

<blockquote>
<p>“Jetpack is an experimental and incomplete implementation of the App Container Specification for FreeBSD. It uses jails as isolation mechanism, and ZFS for layered storage.”<br>
“This document uses some language used in Rocket, the reference implementation of the App Container Specification. While the documentation will be expanded in the future, currently you need to be familiar at least with Rocket&#39;s README to understand everything.”</p>

<ul>
<li>A standard with multiple implementations, that allow substitution of components, such as FreeBSD Jails instead of docker/lxc etc, and ZFS instead of overlayfs etc, is very exciting
***</li>
</ul>
</blockquote>

<h3><a href="https://fossbytes.com/xenix-history-microsoft-unix-operating-system/" rel="nofollow">Microsoft’s Forgotten Unix-based Operating System</a></h3>

<ul>
<li>Do you remember the good old days. You know, when Microsoft was the driving force behind UNIX? Wait, what did you say you may be thinking? It’s true, and lets sit back and let FossBytes tell us a tale of what once was reality.</li>
<li>The story begins sometime in the late 70’s:</li>
</ul>

<blockquote>
<p>Turning back the pages to the late 1970’s, Microsoft entered into an agreement with AT&amp;T Corporation to license Unix from AT&amp;T. While the company didn’t sell the OS to public, it licensed it to other OEM vendors like Intel, SCO, and Tandy.</p>

<p>As Microsoft had to face legal trouble due to “Unix” name, the company renamed it and came up with its own Unix distribution. So, AT&amp;T licensed Unix to Redmond that was passed on to other OEMs as Xenix.</p>

<p>It’s interesting to recall a time when Microsoft enabled people to run Unix — an operating system originally designed for large and multiuser systems — on a microcomputer. Even though it came first, Unix was probably more powerful than MS-DOS.</p>
</blockquote>

<ul>
<li>So whatever happened to this microsoft-flavored UNIX you may ask? Sadly it was ditched for DOS due to $REASONS:</li>
</ul>

<blockquote>
<p>In early 1980’s, IBM was looking for an OS to power its PC. As IBM didn’t want to maintain any ties with the recently split AT&amp;T, Xenix was automatically rejected. To fulfill, the tech giant’s demand, Microsoft bought 86-DOS from Seattle Computer Products and managed to convince IBM to use it in their systems.</p>

<p>Slowly, Microsoft started losing interest in Xenix and traded the full rights of Xenix with SCO, a Xenix partner company. The company filed bankruptcy in 2007 before taking the Xenix legacy to the 21st century in the form of Open Server, previously known as SCO Unix and SCO Open Desktop.</p>
</blockquote>

<ul>
<li>An interesting chapter in UNIX history to be sure, and funny enough may come full-circle someday with Microsoft beginning to show interest in UNIX and BSD once again.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://blather.michaelwlucas.com/archives/2791" rel="nofollow">Ohio LinuxFest 2016 wrap-up</a></p></li>
<li><p><a href="https://learnxinyminutes.com/docs/zfs/" rel="nofollow">Learn X in Y minutes Where X=zfs</a></p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=306430" rel="nofollow">Add touchscreen support for the official 7&quot; RPi touch display </a> </p></li>
<li><p><a href="https://kernelnomicon.org/?p=682" rel="nofollow">64-bit U-Boot on Raspberry Pi 3 </a></p></li>
<li><p><a href="https://www.ixsystems.com/blog/snia-sdc-2016-recap-michael-dexter/" rel="nofollow">SNIA SDC 2016 Recap: Michael Dexter</a></p></li>
<li><p><a href="https://www.ixsystems.com/blog/openzfs-devsummit-2016/" rel="nofollow">OpenZFS: Stronger than ever</a> </p></li>
<li><p><a href="http://nvlpubs.nist.gov/nistpubs/jres/121/jres.121.023.pdf" rel="nofollow">Accurate, Traceable, and Verifiable Time Synchronization for World Financial Markets</a> </p></li>
<li><p><a href="https://www.ietf.org/rfc/ien/ien137.txt" rel="nofollow">ON HOLY WARS AND A PLEA FOR PEACE</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/CYcqmW7P" rel="nofollow"> Morgan - Zero-Filling an VM</a> </li>
<li><a href="http://pastebin.com/12mNW57h" rel="nofollow"> Charlie - ZFS Bit-Rot</a> </li>
<li><a href="http://pastebin.com/NfYWt2cu" rel="nofollow"> Matias - TrueOS / Launchd</a> </li>
<li><a href="http://pastebin.com/UvKh2WcF" rel="nofollow"> Dale - DO Feedback</a> </li>
<li><a href="http://pastebin.com/0cdMc88U" rel="nofollow"> James - DO / FreeBSD Locks?</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The wait is over, 11.0 of FreeBSD has (officially) launched. We’ll have coverage of this, plus a couple looks back at UNIX history, and a crowd-favorite guest today.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2016-October/001760.html" rel="nofollow">FreeBSD 11.0-RELEASE Now Available</a></h3>

<ul>
<li>FreeBSD 11.0-RELEASE is now officially out.</li>
<li>A last minute reroll to pickup OpenSSL updates and a number of other security fixes meant the release was a little behind schedule, and shipped as 11.0-RELEASE-p1, but the release is better for it</li>
<li>Improved support for 802.11n and various wifi drivers</li>
<li>Support for the AArch64 (arm64) architecture has been added.</li>
<li>Native graphics support has been added to the bhyve(8) hypervisor.</li>
<li>A new flag, “onifconsole” has been added to /etc/ttys. This allows the system to provide a login prompt via serial console if the device is an active kernel console, otherwise it is equivalent to off.</li>
<li>The xz(1) utility has been updated to support multi-threaded compression.</li>
<li>A number of kernel panics related to VNET have been fixed</li>
<li>The IMAGACT_BINMISC kernel configuration option has been enabled by default, which enables application execution through emulators, such as QEMU via binmiscctl(8).</li>
<li>The GENERIC kernel configuration has been updated to include the IPSEC option by default.</li>
<li>The kern.osrelease and kern.osreldate are now configurable jail(8) parameters</li>
<li>A new sysctl(8), kern.racct.enable, has been added, which when set to a non-zero value allows using rctl(8) with the GENERIC kernel. A new kernel configuration option, RACCT_DISABLED has also been added.</li>
<li>The minimum (arc_min) and maximum (arc_max) values for the ZFS adaptive replacement cache can be modified at runtime.</li>
<li><strong>Changes to watch out for</strong>:

<ul>
<li>OpenSSH DSA key generation has been disabled by default. It is important to update OpenSSH keys prior to upgrading. Additionally, Protocol 1 support has been removed.</li>
<li>By default, the ifconfig(8) utility will set the default regulatory domain to FCC on wireless interfaces. As a result, newly created wireless interfaces with default settings will have less chance to violate country-specific regulations.</li>
<li>An issue was discovered with Amazon® EC2™ images which would cause the virtual machine to hang during boot when upgrading from previous FreeBSD versions. New EC2™ installations are not affected, but existing installations running earlier releases are advised to wait until the issue is resolved in an Errata Notice before upgrading. An Errata Notice to address this is planned following the release.
***</li>
</ul></li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/process-listing-consistency" rel="nofollow">process listing consistency</a></h3>

<ul>
<li>Ted Unangst asks: how consistent is the output of ps(1)?</li>
<li>If processes are starting and exiting constantly, and you run ps(1), is the output guaranteed to reflect that exact moment in time, or might it include some processes that have gone away before ps(1) exited, and include some processes that did not exist when ps(1) was started?</li>
<li>Ted provides a little example chicken/egg program to try to create such an inconsistency, so you can test out your OS</li>
<li>On OpenBSD ps(1) was switched away from the reading kernel memory directly, and instead uses the KERN_PROC_ALL sysctl</li>
</ul>

<blockquote>
<p>Thus sysctl can iterate over the entire process list, copying out information to ps(1), without blocking. If we prevent processes from forking or exiting during this time, we get a consistent snapshot. The snapshot may be stale, but it will never show us a viewpoint that never happened.</p>
</blockquote>

<ul>
<li>So, OpenBSD will always be consistent, or will it?</li>
</ul>

<blockquote>
<p>Is there a way to trick ps on OpenBSD? Not everything is consistent. There’s a separate sysctl, KERN_PROC_ARGV, that reads the command line arguments for a process, but it only works on one process at a time. Processes can modify their own argv at any time.</p>
</blockquote>

<ul>
<li><p>A second test program changes the process title of both the chicken and the egg, and if you run ps(1), you can get back a result that never actually happened.</p></li>
<li><p>The argv of the first program is read by ps(1), and in the meantime, it changes to a different value. The second program also changes its value, so now when ps(1) reads it, it sees the new value, not the original value from when ps(1) was started.</p></li>
<li><p>So the output is not that consistent, but is it worth the effort to try to make it so?</p>

<hr></li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-October/624673.html" rel="nofollow">DragonFlyBSD - if_iwm - Add basic powermanagement support via ifconfig wlan0 powersave</a></h3>

<ul>
<li>WiFi can often be one of the biggest drains on your laptop battery, so anything we can do to improve the situation should be embraced. </li>
<li>Imre VadÃ¡sz over at the DragonFly project has done that, porting over a new set of power management support from Linux to the if_iwm driver. </li>
</ul>

<blockquote>
<p>if_iwm - Add basic powermanagement support via ifconfig wlan0 powersave.</p>

<ul>
<li><p>The DEVICE_POWER_FLAGS_CAM_MSK flag was removed in the upstream iwlwifi in Linux commit ceef91c89480dd18bb3ac51e91280a233d0ca41f.</p></li>
<li><p>Add sc_ps_disabled flag to struct iwm_softc, which corresponds to mvm-&gt;ps_disabled in struct iwl_mvm in Linux iwlwifi.</p></li>
<li><p>Adds a hw.iwm.power_scheme tunable which corresponds to the power_scheme module parameter in Linux iwlwifi. Set this to 1 for completely disabling power management, 2 (default) for balanced powermanagement, and 3 for lowerpower mode (which does dtim period skipping).</p>

<ul>
<li>Imports the constants.h file from iwlwifi as if_iwm_constants.h.</li>
<li>This doesn&#39;t allow changing the powermanagement setting while connected,
also one can only choose between enabled and disabled powersaving with
ifconfig (so switching between balanced and low-power mode requires
rebooting to change the tunable).</li>
<li>After any changes to powermanagement (i.e. &quot;ifconfig wlan0 powersave&quot; to
enable powermanagement, or &quot;ifconfig wlan0 -powersave&quot; for disabling
powermanagement), one has to disconnect and reconnect to the accespoint
for the change to take effect.“</li>
</ul></li>
</ul>
</blockquote>

<ul>
<li>Good stuff! These positive changes need to happen more often and sooner, so we can all eek out every drop of power from our respective laptops.
***</li>
</ul>

<h3><a href="https://functionallyparanoid.com/2016/10/03/helping-out-an-internet-friend/" rel="nofollow">Helping out an Internet Friend…Dual boot OpenBSD </a></h3>

<ul>
<li>Dual-booting OpenBSD and Linux, via UEFI. A year ago we wouldn’t be discussing this, but today we have an article where somebody has done exactly that.</li>
<li>This Journey was undertaken by Brian Everly (Indiana Bug), partly due to a friend who wanted to dual-boot his laptop which already has an existing UEFI install on it.</li>
<li>As a proof of concept, he began by replicating the setup in VMware with UEFI</li>
<li>He started by throwing Ubuntu into the VM, with some special attention paid to partitioning to ensure enough room left-over for OpenBSD later.</li>
</ul>

<blockquote>
<p>I created a 64MB EFI partition at the front of the disk. Next, I created a 20GB primary partition at the beginning of the space, mounted as the root (/) filesystem.</p>

<p>I then added a 4096MB swap partition for Ubuntu. Finally, I used the rest of the free space to create a Reserved BIOS Boot Area FAT32 partition that was not associated with a mount point – this is where I will be installing OpenBSD.</p>
</blockquote>

<ul>
<li>With that done, he wrapped up the Ubuntu installation and then turned over to to the OpenBSD side. Some manual partitioning was required to install to the “Reserved FAT32” partition.</li>
</ul>

<blockquote>
<p>I mashed through the defaults in the OpenBSD installer until I got to the disk partitioning.  Since I told VMWare to make my hard drive an IDE one, I knew I was playing around with wd0 and not sd0 (my USB key).  I dumped into fdisk by selecting to (E)dit the partition scheme and saw my setup from Linux.  First was the EFI partition (I am guessing I’ll have to copy my bootx64.efi file to that at some point), second was the Linux etx4 partition, third was my Linux swap partition and fourth was a weird looking one that is the “Reserved BIOS Boot” partition.  That’s the one I’ll fiddle with.</p>

<p>Issuing the command “edit 3” allowed me to fiddle with that partition #3 (remember, we start counting at zero).  I set it’s type to “A6” (OpenBSD) and then took the defaults with the exception of naming it “OpenBSD”.  A quick “write” followed by a “quit” allowed me to update my new partition and get back to the installer.</p>
</blockquote>

<ul>
<li>Once the installation was wrapped up (OpenBSD helpfully already created the /boot/EFI partition with the correct EFI loader installed) he was able to reboot and select between the two systems at the UEFI bios screen.</li>
<li>For kicks, he lastly went into Ubuntu and grabbed refind. Installing refind provided a fancy graphical selector between the two systems without too much trouble.</li>
<li>Next step will be to replicate this process on his friend’s laptop. Wishing you luck with that journey!</li>
</ul>

<hr>

<h2>Interview - Bryan Cantrill - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/user" rel="nofollow">@twitter</a></h2>

<ul>
<li>CTO of Joyent
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://bsd.slashdot.org/story/16/10/09/0230203/after-22-years-386bsd-gets-an-update" rel="nofollow">After 22 Years, 386BSD Gets An Update</a></h3>

<ul>
<li>Slashdot brings us an interesting mention this week, specifically that after 22 years, we now have an update to 386BSD.</li>
</ul>

<blockquote>
<p>386BSD was last released back in 1994 with a series of articles in Dr. Dobb&#39;s Journal -- but then developers for this BSD-based operating system started migrating to both FreeBSD and NetBSD. An anonymous Slashdot reader writes: The last known public release was version 0.1. Until Wednesday, when Lynne Jolitz, one of the co-authors of 386BSD, released the source code to version 1.0 as well as 2.0 on Github.</p>

<p>386BSD takes us back to the days when you could count every file in your Unix distribution and more importantly, read and understand all of your OS source code. 386BSD is also the missing link between BSD and Linux. One can find fragments of Linus Torvalds&#39;s math emulation code in the source code of 386BSD. To quote Linus: &quot;If 386BSD had been available when I started on Linux, Linux would probably never had happened.”</p>

<p>Though it was designed for Intel 80386 microprocessors, there&#39;s already instructions for launching it on the hosted hardware virtualization service Qemu.</p>
</blockquote>

<ul>
<li>There you have it! Go grab the new hotness that is 386BSD and run it in 2016! Or perhaps you want FreeBSD 11, but to each their own.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160929230557&mode=expanded" rel="nofollow">Progress of the OpenBSD Limited Edition Signed CD set</a></h3>

<ul>
<li>An update from a story last week! We mentioned the “very” limited edition OpenBSD 6.0 signed CD sets that had gone up for Auction on Ebay. (With proceeds to support for Foundation)</li>
<li><p>As of today, here’s where we stand:</p>

<ul>
<li>CD set #1 (Sep 29th + 5 days) <a href="http://www.ebay.com/itm/-/331985953783" rel="nofollow">sold for $4200</a></li>
<li>CD set #2 (Oct 4th + 3 days) <a href="http://www.ebay.com/itm/-/331990536246" rel="nofollow">sold for $3000</a></li>
<li>CD set #3 (Oct 8th + 3 days) <a href="http://www.ebay.com/itm/-/331994217419" rel="nofollow">sold for $817</a></li>
<li>CD set #4 (Oct 11th + 3 days) is <a href="http://www.ebay.com/itm/-/331997031152" rel="nofollow">currently up for bidding</a></li>
</ul></li>
<li><p>There you have it! The 4th set is almost wrapped up bidding, and the 5th and last set is not far behind. Be sure to grab your piece of BSD history before its gone!</p>

<hr></li>
</ul>

<h3><a href="https://github.com/3ofcoins/jetpack" rel="nofollow"><strong>PROTOTYPE</strong> FreeBSD Jail/ZFS based implementation of the Application Container Specification</a></h3>

<blockquote>
<p>“Jetpack is an experimental and incomplete implementation of the App Container Specification for FreeBSD. It uses jails as isolation mechanism, and ZFS for layered storage.”<br>
“This document uses some language used in Rocket, the reference implementation of the App Container Specification. While the documentation will be expanded in the future, currently you need to be familiar at least with Rocket&#39;s README to understand everything.”</p>

<ul>
<li>A standard with multiple implementations, that allow substitution of components, such as FreeBSD Jails instead of docker/lxc etc, and ZFS instead of overlayfs etc, is very exciting
***</li>
</ul>
</blockquote>

<h3><a href="https://fossbytes.com/xenix-history-microsoft-unix-operating-system/" rel="nofollow">Microsoft’s Forgotten Unix-based Operating System</a></h3>

<ul>
<li>Do you remember the good old days. You know, when Microsoft was the driving force behind UNIX? Wait, what did you say you may be thinking? It’s true, and lets sit back and let FossBytes tell us a tale of what once was reality.</li>
<li>The story begins sometime in the late 70’s:</li>
</ul>

<blockquote>
<p>Turning back the pages to the late 1970’s, Microsoft entered into an agreement with AT&amp;T Corporation to license Unix from AT&amp;T. While the company didn’t sell the OS to public, it licensed it to other OEM vendors like Intel, SCO, and Tandy.</p>

<p>As Microsoft had to face legal trouble due to “Unix” name, the company renamed it and came up with its own Unix distribution. So, AT&amp;T licensed Unix to Redmond that was passed on to other OEMs as Xenix.</p>

<p>It’s interesting to recall a time when Microsoft enabled people to run Unix — an operating system originally designed for large and multiuser systems — on a microcomputer. Even though it came first, Unix was probably more powerful than MS-DOS.</p>
</blockquote>

<ul>
<li>So whatever happened to this microsoft-flavored UNIX you may ask? Sadly it was ditched for DOS due to $REASONS:</li>
</ul>

<blockquote>
<p>In early 1980’s, IBM was looking for an OS to power its PC. As IBM didn’t want to maintain any ties with the recently split AT&amp;T, Xenix was automatically rejected. To fulfill, the tech giant’s demand, Microsoft bought 86-DOS from Seattle Computer Products and managed to convince IBM to use it in their systems.</p>

<p>Slowly, Microsoft started losing interest in Xenix and traded the full rights of Xenix with SCO, a Xenix partner company. The company filed bankruptcy in 2007 before taking the Xenix legacy to the 21st century in the form of Open Server, previously known as SCO Unix and SCO Open Desktop.</p>
</blockquote>

<ul>
<li>An interesting chapter in UNIX history to be sure, and funny enough may come full-circle someday with Microsoft beginning to show interest in UNIX and BSD once again.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://blather.michaelwlucas.com/archives/2791" rel="nofollow">Ohio LinuxFest 2016 wrap-up</a></p></li>
<li><p><a href="https://learnxinyminutes.com/docs/zfs/" rel="nofollow">Learn X in Y minutes Where X=zfs</a></p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=306430" rel="nofollow">Add touchscreen support for the official 7&quot; RPi touch display </a> </p></li>
<li><p><a href="https://kernelnomicon.org/?p=682" rel="nofollow">64-bit U-Boot on Raspberry Pi 3 </a></p></li>
<li><p><a href="https://www.ixsystems.com/blog/snia-sdc-2016-recap-michael-dexter/" rel="nofollow">SNIA SDC 2016 Recap: Michael Dexter</a></p></li>
<li><p><a href="https://www.ixsystems.com/blog/openzfs-devsummit-2016/" rel="nofollow">OpenZFS: Stronger than ever</a> </p></li>
<li><p><a href="http://nvlpubs.nist.gov/nistpubs/jres/121/jres.121.023.pdf" rel="nofollow">Accurate, Traceable, and Verifiable Time Synchronization for World Financial Markets</a> </p></li>
<li><p><a href="https://www.ietf.org/rfc/ien/ien137.txt" rel="nofollow">ON HOLY WARS AND A PLEA FOR PEACE</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/CYcqmW7P" rel="nofollow"> Morgan - Zero-Filling an VM</a> </li>
<li><a href="http://pastebin.com/12mNW57h" rel="nofollow"> Charlie - ZFS Bit-Rot</a> </li>
<li><a href="http://pastebin.com/NfYWt2cu" rel="nofollow"> Matias - TrueOS / Launchd</a> </li>
<li><a href="http://pastebin.com/UvKh2WcF" rel="nofollow"> Dale - DO Feedback</a> </li>
<li><a href="http://pastebin.com/0cdMc88U" rel="nofollow"> James - DO / FreeBSD Locks?</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>162: The Foundation of NetBSD</title>
  <link>https://www.bsdnow.tv/162</link>
  <guid isPermaLink="false">bb8662b1-5fa2-4df9-b2bc-c4caa37567b3</guid>
  <pubDate>Wed, 05 Oct 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/bb8662b1-5fa2-4df9-b2bc-c4caa37567b3.mp3" length="76463572" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we’ll be talking to Petra about the NetBSD foundation, about how they operate and assist NetBSD behind the scenes. That plus lots of news</itunes:subtitle>
  <itunes:duration>1:46:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we’ll be talking to Petra about the NetBSD foundation, about how they operate and assist NetBSD behind the scenes. That plus lots of news
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
What is new on EC2 for FreeBSD 11.0-RELEASE (http://www.daemonology.net/blog/2016-10-03-FreeBSD-EC2-11-0-RELEASE.html)
“FreeBSD 11.0-RELEASE is just around the corner, and it will be bringing a long list of new features and improvements — far too many for me to list here. I think there are 
some improvements in FreeBSD 11.0 which are particularly noteworthy for EC2 users.”
“First, the EC2 Console Screenshot functionality now works with FreeBSD. This provides a "VGA" output as opposed to the traditional "serial port" which EC2 has exposed as 
"console output" for the past decade, and is useful largely because the "VGA" output becomes available immediately whereas the "serial port" output can lag by several minutes. This 
improvement is a simple configuration change — older releases didn't waste time writing to a non-serial console because it didn't go anywhere until Amazon added support on their 
side — and can be enabled on older FreeBSD releases by changing the line console="comconsole" to boot_multicons="YES" in /boot/loader.conf.”
“The second notable change is support for EC2 "Enhanced Networking" using Intel 82599 hardware; on the C3, C4, R3, I2, D2, and M4 (excluding m4.16xlarge) families, this 
provides increased network throughput and reduced latency and jitter, since it allows FreeBSD to talk directly to the networking hardware rather than via a Xen paravirtual interface. 
Getting this working took much longer than I had hoped, but the final problem turned out not to be in FreeBSD at all — we were tickling an interrupt-routing bug in a version of 
Xen used in EC2. Unfortunately FreeBSD does not yet have support for the new "Elastic Network Adapter" enhanced networking used in P2 and X1 instance families and the m4.16xlarge 
instance type; I'm hoping that we'll have a driver for that before FreeBSD 11.1 arrives.”
“The third notable change is an improvement in EC2 disk throughput. This comes thanks to enabling indirect segment I/Os in FreeBSD's blkfront driver; while the support was 
present in 10.3, I had it turned off by default due to performance anomalies on some EC2 instances. (Those EC2 performance problems have been resolved, and disk I/O performance in 
EC2 on FreeBSD 10.3 can now be safely improved by removing the line hw.xbd.xbdenableindirect="0" from /boot/loader.conf.)”
“Finally, FreeBSD now supports all 128 CPUs in the x1.32xlarge instance type. This improvement comes thanks to two changes: The FreeBSD default kernel was modified in 2014 to 
support up to 256 CPUs (up from 64), but that resulted in a (fixed-size) section of preallocated memory being exhausted early in the boot process on systems with 92 or more CPUs; a 
few months ago I changed that value to tune automatically so that FreeBSD can now boot and not immediately panic with an out-of-the-box setup on such large systems.”
“I think FreeBSD/EC2 users will be very happy with FreeBSD 11.0-RELEASE; but I'd like to end with an important reminder: No matter what you might see on FTP servers, in EC2, or 
available via freebsd-update, the new release has not been released until you see a GPG-signed email from the release engineer. This is not just a theoretical point: In my time as a 
FreeBSD developer I've seen multiple instances of last-minute release re-rolls happening due to problems being discovered very late, so the fact that you can see bits doesn't 
necessarily mean that they are ready to be downloaded. I hope you're looking forward to 11.0-RELEASE, but please be patient.”
***
Upgrading Amazon EC2 instance from 10.3 to 11.0-PRERELEASE results in hang at boot  (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213196)
As if to underscore that last point, a last minute bug was found on sunday night
A user reported that they used freebsd-update to upgrade an EC2 instance from 10.3 to 11.0 and it started hanging during boot
After some quick investigation by Colin, the problem was reproduced
Since I had done a lot of work in the loader recently, I helped Colin build a version of the loader with a lot of the debugging enabled, and some more added to try to isolate where 
in the loader the freeze was happening
Colin and I worked late into the night, but eventually found the read from disk that was causing the hang
Unlike most of the other reads, that were going into the heap, this read was into a very low memory address, right near the 640kb border. This initially distracted us from the real 
cause of the problem
With more debugging added, it was determined that the problem was in the GELIBoot code, when reading the last sector of each partition to determine if it is encrypted. In cases 
where the partition is not 4k aligned, and butts up against the end of the disk, the formula used could result in a read past the end of the disk
The formula rounds the last sector byte address down to the nearest factor of 4096, then reads 4096 bytes. Then that buffer is examined to determine if the partition is encrypted. 
If it is a 512b sector drive, the metadata will be in the last 512 bytes of that 4096 byte buffer.
However, if the partition is not 4k aligned, the rounding will produce a value that is less than 4096 bytes from the end of the disk, and attempting to read 4096 bytes, will read 
past the end of the disk
Normally this isn’t that big of a problem, the BIOS will just return an error. The loader will retry up to three times, then give up and move on, continuing to boot normally.
Some BIOSes are buggy, and will initiate their own retries, and the combination might result in a stall of up to 30 seconds for each attempt to read past the end of the disk
But it seems that Amazon EC2 instances, (and possibly other virtual instances), will just hang in this case.
This bug has existed for 6 months, but was not caught because almost all installations are 4k aligned thanks to changes made to the installer over the last few years, and most 
hardware continues to boot with no sign of a problem
Even the EC2 snapshot images of 11.0 do not have the problem, as they use a newer disk layout that is 4k aligned by default now. The problem only seems to happen when older disk 
images are upgraded
The fix has been committed and will be merged the the branches over the next few days
An Errata notice will be issues, and the fix will be available via freebsd-update
It is recommended that EC2 users, and anyone who wants to be especially cautious, wait until this errata notice goes out before attempting to upgrade from FreeBSD 10.3 to 11.0
You can determine if your partitions are 4k aligned by running ‘gpart show’. If there is free space after your last partition, you won’t have any issues.
***
OpenBSD 6.0 Limited Edition CD set (signed by developers) (http://undeadly.org/cgi?action=article&amp;amp;sid=20160929230557&amp;amp;mode=expanded)
The first one went for .$4,200.00 (http://www.ebay.com/itm/-/331985953783) 
+ Looking for your piece of OpenBSD history? At the recent g2k16 hackathon in Cambridge UK, 40 OpenBSD developers put pen to paper and signed 5 copies of the new 6.0 release.
+ Each of these will be auctioned off on ebay, with the proceeds to benefit the OpenBSD foundation.
+ The first auction has already ended, and CD set went for a whopping $4200!
+ The next set only has 2 days left, and currently stands at $3000! (http://www.ebay.com/itm/-/331990536246) 
+ Get your bids in soon, these are VERY unique, the odds of getting the same 40 developers in a room together and signing a new .0 release may make this a once-in-a-lifetime 
opportunity.
+ Additionally, if you are just starting your OpenBSD collection, here’s a nice image to make you envious: A nice collection of OpenBSD CD Sets (http://i.imgur.com/OrE0Gsa.png) 
[What typing ^D really does on Unix
](https://utcc.utoronto.ca/~cks/space/blog/unix/TypingEOFEffects)
+ How often have you used a ^D to generate an EOF? Do you really know what that does?
+ Chris Siebenmann has posted a look at this on his blog, which might not be what you think
“Typing ^D causes the tty driver to immediately finish a read().”
He continues on:
Normally doing a read() from a terminal is line-buffered inside the tty driver; your program only wakes up when the tty driver sees the newline, at which point you get back the full 
line. (Note that this buffering is distinct from anything that your language's IO system may be doing.)
Typing ^D causes the tty driver to stop waiting for a newline and immediately return from the read() with however much of the line has been accumulated to date. If you haven't 
typed anything on the line yet, there is nothing accumulated and the read() will return 0 bytes, which is conveniently the signal for end of file. If you have typed something the 
program will get it; because it doesn't have a trailing newline, the program's own line-buffering may take over and keep read()ing to get the rest of the line.
(Other programs will immediately process the partial line with no buffering; cat is one example of this.)
Once you've typed ^D on a partial line, that portion of the line is immutable because it's already been given to the program. Most Unixes won't let you backspace over such partial 
lines; effectively they become output, not input.
(Note that modern shells are not good examples of this, because they don't do line-buffered input; to support command line editing, they switch terminal input into an uninterpreted 
mode. So they get the raw ^D and can do whatever they want with it, and they can let you edit as much of the pending line as they want.)
Fascinating stuff, and interesting to see behind the curtain at exactly what’s going on with your programs buffering and tty driver interaction.
Interview - Petra Zeidler - spz@netbsd.org (mailto:spz@netbsd.org)
NetBSD Foundation
***
News Roundup
Running FreeBSD in Travis-CI Thanks to KQEmu (http://erouault.blogspot.com/2016/09/running-freebsd-in-travis-ci.html)
Travis-CI is the most popular testing framework on Github, but it doesn’t support any of the BSDs
This didn’t discourage Even Rouault, who managed to run FreeBSD in KQEMU on the Linux instances provided by Travis-CI
“Travis-CI has a free offer for software having public repository at GitHub. Travis-CI provides cloud instances running Linux or Mac OS X. To increase portability tests of 
GDAL, I wondered if it was somehow possible to run another operating system with Travis-CI, for example FreeBSD. A search lead me to this 
question (https://github.com/travis-ci/travis-ci/issues/1818) in their bug tracker but the outcome seems to be that it is not possible, nor in their medium or long term plans.”
“One idea that came quickly to mind was to use the QEMU machine emulator that can simulate full machines, of several hardware architectures.”
They found an existing image of FreeBSD 9.2 and configured the Travis job to download it and fire it up in QEMU.
“Here we go: ./configure &amp;amp;&amp;amp; make ! That works, but 50 minutes later (the maximum length of a Travis-CI job), our job is killed with perhaps only 10% of the GDAL code base being 
compiled. The reason is that we used the pure software emulation mode of QEMU that involves on-the-fly disassembling of the code to be run and re-assembling.”
Travis-CI runs in Google Compute Engine, which does not allow nested virtualization, so hardware virtualization is not an option to speed up QEMU
“Here comes the time for good old memories and a bit of software archeology. QEMU was started by Fabrice Bellard. If you didn't know his name yet, F. Bellard created FFMPEG and 
QEMU, holds a world record for the number of decimals of Pi computed on a COTS PC, has ported QEMU in JavaScript to run the Linux kernel in your browser, devised BPG, a new 
compression based on HEVC, etc....”
“At the time where his interest was focused on QEMU, he created KQemu, a kernel module (for Linux, Windows, FreeBSD hosts), that could significantly enhance QEMU performance 
when the guest and hosts are x86/x86_64 and does not require (nor use) hardware virtualization instructions.”
“Running it on Travis-CI was successful too, with the compilation being done in 20 minutes, so probably half of the speed of bare metal, which is good enough.”
“I could also have potentially tried VirtualBox because, as mentioned above, it supports software virtualization with acceleration. But that is only for 32 bit guests (and I 
didn't find a ready-made FreeBSD 32bit image that you can directly ssh into). For 64 bit guests, VirtualBox require hardware virtualization to be available in the host. To the best 
of my knowledge, KQemu is (was) the only solution to enable acceleration of 64 bit guests without hardware requirements.”
It will be interesting to see if enough people do this hack, maybe Travis-CI will consider properly supporting FreeBSD
***
OpenBSD EuroBSDcon 2016 Papers are online (https://www.openbsd.org/events.html)
Slides from the OpenBSD talks at EuroBSDCon are online now
Landry Breuil, Building packages on exotic architectures (https://rhaalovely.net/~landry/eurobsdcon2016/)
Peter Hessler, Bidirectional Forwarding Detection (BFD) implementation and support in OpenBSD (https://www.openbsd.org/papers/eurobsdcon2016-bfd.pdf)
Ingo Schwarze, Why and how you ought to keep multibyte character support simple (https://www.openbsd.org/papers/eurobsdcon2016-utf8.pdf) (roff/mm/gpresent source 
code (https://www.openbsd.org/papers/eurobsdcon2016-utf8.roff))
Stefan Sperling, OpenBSD meets 802.11n (https://www.openbsd.org/papers/eurobsdcon2016-openbsd-11n.pdf)
Antoine Jacoutot, OpenBSD rc.d(8) (https://www.bsdfrog.org/pub/events/openbsd-rcd-EuroBSDcon2016.pdf)
Marc Espie, Retrofitting privsep into dpb and pkg_add (https://www.openbsd.org/papers/eurobsdcon2016-privsep.pdf)
Martin Pieuchot, Embracing the BSD routing table (https://www.openbsd.org/papers/eurobsdcon2016-embracingbsdrt.pdf)
I am working to build a similar website for the FreeBSD project, but there is still a lot of work to do
I also managed to find the slides from the keynotes:
Opening Keynote: George Neville-Neil: Looking Backwards: The coming decades of BSD  (https://papers.freebsd.org/2016/EuroBSDCon/LookingBackwards.pdf)
Closing Keynote: Gert Döring: Internet Attacks, Self-Governance, and the Consequences  (http://www.monobsd.com/files/16_ddos_and_consequences.pptx)
***
VirtualBox Shared Folders on FreeBSD: progress report (https://kernelnomicon.org/?p=650)
In the past month or so, VirtualBox in the FreeBSD ports tree got bumped to version 5, which while bringing new features, did cause a regression in Shared Folders.
FreeBSD developer gonzo@ (Oleksandr Tymoshenko) has been tackling this issue in recent days and provides us with a look behind the curtain at the challenges involved.
Specifically he started by implementing the various needed VOPs: “lookup, access, readdir, read, getattr, readlink, remove, rmdir, symlink, close, create, open, write.”
He then continues with details about how complete this is:
““Kind of implemented” means that I was able to mount directory, traverse it, read file, calculate md5 sums and compare with host’s md5sum, create/remove directories, 
unzip zip file, etc but I doubt it would survive stress-test. Locking is all wrong at the moment and read/write VOPs allocate buffers for every operation.”
The bigger issue faced is with the rename VOP though:
I hit a roadblock with rename VOP: it involves some non-trivial locking logic and also there is a problem with cached paths. VBox hypervisor operates on full paths so we cache them 
in vboxfs nodes, but if one of parent directories is renamed, all cached names should be modified accordingly. I am going to tackle these two problems once I have long enough stretch 
of time time sit and concentrate on task.
+ We wish him luck in getting those issues solved. I know quite a few of our users rely on shared folders as well.
FreeBSD News Issue #1 (http://support.rossw.net/FreeBSD-Issue1.pdf)
Issue #1 of FreeBSD News, from summer of 1997
Contains an article by Yahoo! co-founder David Filo about their early use of FreeBSD, on 100mhz Pentium machines with 64MB of ram
Java Development Kit 1.0.2 ported to FreeBSD
What is FreeBSD?
Running the world’s busiest FTP site (cdrom.com) on FreeBSD
Xi Graphics announces the release of CDE Business Desktop, the first and only integrated desktop for FreeBSD, on AcceleratedX, a fully supported commercial grade X display server
Get FreeBSD 2.2.2 Today!
***
Beastie Bits
Call for testing: newly MPSAFE nvme(4) (http://mail-index.netbsd.org/current-users/2016/09/21/msg030183.html) 
Thinking about starting a BUG in Indianapolis, IN USA (http://lists.dragonflybsd.org/pipermail/users/2016-September/313061.html)
The cost of forsaking C: Why students still need to learn C  (https://medium.com/bradfield-cs/the-cost-of-forsaking-c-113986438784#.o2m5gv8y7) 
OpenBSD (U)EFI bootloader howto (https://blog.jasper.la/openbsd-uefi-bootloader-howto/) 
Michael Lucas sets his eyes on OpenBSD's web stack for his next book (http://blather.michaelwlucas.com/archives/2780) 
LibreSSL 2.5.0 released (http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.0-relnotes.txt)
OPNsense 16.7.5 released (https://opnsense.org/opnsense-16-7-5-released/)
Feedback/Questions
 Jonas - ZFS on DO  (http://pastebin.com/XeJhK0AJ) 
 Ricardo - OpenBSD Encrypted Disk (http://pastebin.com/Z9JRjcvb) 
 WiskerTickle - Storage Benchmark  (http://pastebin.com/XAD0UevP) 
 Phil - Thanks (http://pastebin.com/N52JhYru) 
 Luis - Misc Questions (http://pastebin.com/57qS0wrx) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we’ll be talking to Petra about the NetBSD foundation, about how they operate and assist NetBSD behind the scenes. That plus lots of news</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.daemonology.net/blog/2016-10-03-FreeBSD-EC2-11-0-RELEASE.html" rel="nofollow">What is new on EC2 for FreeBSD 11.0-RELEASE</a></h3>

<ul>
<li>“FreeBSD 11.0-RELEASE is just around the corner, and it will be bringing a long list of new features and improvements — far too many for me to list here. I think there are 
some improvements in FreeBSD 11.0 which are particularly noteworthy for EC2 users.”</li>
<li>“First, the EC2 Console Screenshot functionality now works with FreeBSD. This provides a &quot;VGA&quot; output as opposed to the traditional &quot;serial port&quot; which EC2 has exposed as 
&quot;console output&quot; for the past decade, and is useful largely because the &quot;VGA&quot; output becomes available immediately whereas the &quot;serial port&quot; output can lag by several minutes. This 
improvement is a simple configuration change — older releases didn&#39;t waste time writing to a non-serial console because it didn&#39;t go anywhere until Amazon added support on their 
side — and can be enabled on older FreeBSD releases by changing the line console=&quot;comconsole&quot; to boot_multicons=&quot;YES&quot; in /boot/loader.conf.”</li>
<li>“The second notable change is support for EC2 &quot;Enhanced Networking&quot; using Intel 82599 hardware; on the C3, C4, R3, I2, D2, and M4 (excluding m4.16xlarge) families, this 
provides increased network throughput and reduced latency and jitter, since it allows FreeBSD to talk directly to the networking hardware rather than via a Xen paravirtual interface. 
Getting this working took much longer than I had hoped, but the final problem turned out not to be in FreeBSD at all — we were tickling an interrupt-routing bug in a version of 
Xen used in EC2. Unfortunately FreeBSD does not yet have support for the new &quot;Elastic Network Adapter&quot; enhanced networking used in P2 and X1 instance families and the m4.16xlarge 
instance type; I&#39;m hoping that we&#39;ll have a driver for that before FreeBSD 11.1 arrives.”</li>
<li>“The third notable change is an improvement in EC2 disk throughput. This comes thanks to enabling indirect segment I/Os in FreeBSD&#39;s blkfront driver; while the support was 
present in 10.3, I had it turned off by default due to performance anomalies on some EC2 instances. (Those EC2 performance problems have been resolved, and disk I/O performance in 
EC2 on FreeBSD 10.3 can now be safely improved by removing the line hw.xbd.xbd_enable_indirect=&quot;0&quot; from /boot/loader.conf.)”</li>
<li>“Finally, FreeBSD now supports all 128 CPUs in the x1.32xlarge instance type. This improvement comes thanks to two changes: The FreeBSD default kernel was modified in 2014 to 
support up to 256 CPUs (up from 64), but that resulted in a (fixed-size) section of preallocated memory being exhausted early in the boot process on systems with 92 or more CPUs; a 
few months ago I changed that value to tune automatically so that FreeBSD can now boot and not immediately panic with an out-of-the-box setup on such large systems.”</li>
<li>“I think FreeBSD/EC2 users will be very happy with FreeBSD 11.0-RELEASE; but I&#39;d like to end with an important reminder: No matter what you might see on FTP servers, in EC2, or 
available via freebsd-update, the new release has not been released until you see a GPG-signed email from the release engineer. This is not just a theoretical point: In my time as a 
FreeBSD developer I&#39;ve seen multiple instances of last-minute release re-rolls happening due to problems being discovered very late, so the fact that you can see bits doesn&#39;t 
necessarily mean that they are ready to be downloaded. I hope you&#39;re looking forward to 11.0-RELEASE, but please be patient.”
***</li>
</ul>

<h3><a href="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213196" rel="nofollow">Upgrading Amazon EC2 instance from 10.3 to 11.0-PRERELEASE results in hang at boot </a></h3>

<ul>
<li>As if to underscore that last point, a last minute bug was found on sunday night</li>
<li>A user reported that they used freebsd-update to upgrade an EC2 instance from 10.3 to 11.0 and it started hanging during boot</li>
<li>After some quick investigation by Colin, the problem was reproduced</li>
<li>Since I had done a lot of work in the loader recently, I helped Colin build a version of the loader with a lot of the debugging enabled, and some more added to try to isolate where 
in the loader the freeze was happening</li>
<li>Colin and I worked late into the night, but eventually found the read from disk that was causing the hang</li>
<li>Unlike most of the other reads, that were going into the heap, this read was into a very low memory address, right near the 640kb border. This initially distracted us from the real 
cause of the problem</li>
<li>With more debugging added, it was determined that the problem was in the GELIBoot code, when reading the last sector of each partition to determine if it is encrypted. In cases 
where the partition is not 4k aligned, and butts up against the end of the disk, the formula used could result in a read past the end of the disk</li>
<li>The formula rounds the last sector byte address down to the nearest factor of 4096, then reads 4096 bytes. Then that buffer is examined to determine if the partition is encrypted. 
If it is a 512b sector drive, the metadata will be in the last 512 bytes of that 4096 byte buffer.</li>
<li>However, if the partition is not 4k aligned, the rounding will produce a value that is less than 4096 bytes from the end of the disk, and attempting to read 4096 bytes, will read 
past the end of the disk</li>
<li>Normally this isn’t that big of a problem, the BIOS will just return an error. The loader will retry up to three times, then give up and move on, continuing to boot normally.</li>
<li>Some BIOSes are buggy, and will initiate their own retries, and the combination might result in a stall of up to 30 seconds for each attempt to read past the end of the disk</li>
<li>But it seems that Amazon EC2 instances, (and possibly other virtual instances), will just hang in this case.</li>
<li>This bug has existed for 6 months, but was not caught because almost all installations are 4k aligned thanks to changes made to the installer over the last few years, and most 
hardware continues to boot with no sign of a problem</li>
<li>Even the EC2 snapshot images of 11.0 do not have the problem, as they use a newer disk layout that is 4k aligned by default now. The problem only seems to happen when older disk 
images are upgraded</li>
<li>The fix has been committed and will be merged the the branches over the next few days</li>
<li>An Errata notice will be issues, and the fix will be available via freebsd-update</li>
<li>It is recommended that EC2 users, and anyone who wants to be especially cautious, wait until this errata notice goes out before attempting to upgrade from FreeBSD 10.3 to 11.0</li>
<li>You can determine if your partitions are 4k aligned by running ‘gpart show’. If there is free space after your last partition, you won’t have any issues.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160929230557&mode=expanded" rel="nofollow">OpenBSD 6.0 Limited Edition CD set (signed by developers)</a></h3>

<p><a href="http://www.ebay.com/itm/-/331985953783" rel="nofollow">The first one went for .$4,200.00</a> </p>

<ul>
<li>Looking for your piece of OpenBSD history? At the recent g2k16 hackathon in Cambridge UK, 40 OpenBSD developers put pen to paper and signed 5 copies of the new 6.0 release.</li>
<li>Each of these will be auctioned off on ebay, with the proceeds to benefit the OpenBSD foundation.</li>
<li>The first auction has already ended, and CD set went for a whopping $4200!</li>
<li>The next set only has 2 days left, and currently stands at $3000! (<a href="http://www.ebay.com/itm/-/331990536246" rel="nofollow">http://www.ebay.com/itm/-/331990536246</a>) </li>
<li>Get your bids in soon, these are VERY unique, the odds of getting the same 40 developers in a room together and signing a new .0 release may make this a once-in-a-lifetime 
opportunity.</li>
<li>Additionally, if you are just starting your OpenBSD collection, here’s a nice image to make you envious: <a href="http://i.imgur.com/OrE0Gsa.png" rel="nofollow">A nice collection of OpenBSD CD Sets</a> 
***</li>
</ul>

<h3>[What typing <sup>D</sup> really does on Unix</h3>

<p>](<a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/TypingEOFEffects" rel="nofollow">https://utcc.utoronto.ca/~cks/space/blog/unix/TypingEOFEffects</a>)</p>

<ul>
<li>How often have you used a <sup>D</sup> to generate an EOF? Do you really know what that does?</li>
<li>Chris Siebenmann has posted a look at this on his blog, which might not be what you think</li>
</ul>

<blockquote>
<p>“Typing <sup>D</sup> causes the tty driver to immediately finish a read().”</p>
</blockquote>

<ul>
<li>He continues on:</li>
</ul>

<blockquote>
<p>Normally doing a read() from a terminal is line-buffered inside the tty driver; your program only wakes up when the tty driver sees the newline, at which point you get back the full <br>
line. (Note that this buffering is distinct from anything that your language&#39;s IO system may be doing.)</p>

<p>Typing <sup>D</sup> causes the tty driver to stop waiting for a newline and immediately return from the read() with however much of the line has been accumulated to date. If you haven&#39;t <br>
typed anything on the line yet, there is nothing accumulated and the read() will return 0 bytes, which is conveniently the signal for end of file. If you have typed something the <br>
program will get it; because it doesn&#39;t have a trailing newline, the program&#39;s own line-buffering may take over and keep read()ing to get the rest of the line.</p>

<p>(Other programs will immediately process the partial line with no buffering; cat is one example of this.)</p>

<p>Once you&#39;ve typed <sup>D</sup> on a partial line, that portion of the line is immutable because it&#39;s already been given to the program. Most Unixes won&#39;t let you backspace over such partial <br>
lines; effectively they become output, not input.</p>

<p>(Note that modern shells are not good examples of this, because they don&#39;t do line-buffered input; to support command line editing, they switch terminal input into an uninterpreted <br>
mode. So they get the raw <sup>D</sup> and can do whatever they want with it, and they can let you edit as much of the pending line as they want.)</p>
</blockquote>

<ul>
<li>Fascinating stuff, and interesting to see behind the curtain at exactly what’s going on with your programs buffering and tty driver interaction.</li>
</ul>

<hr>

<h2>Interview - Petra Zeidler - <a href="mailto:spz@netbsd.org" rel="nofollow">spz@netbsd.org</a></h2>

<ul>
<li>NetBSD Foundation
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://erouault.blogspot.com/2016/09/running-freebsd-in-travis-ci.html" rel="nofollow">Running FreeBSD in Travis-CI Thanks to KQEmu</a></h3>

<ul>
<li>Travis-CI is the most popular testing framework on Github, but it doesn’t support any of the BSDs</li>
<li>This didn’t discourage Even Rouault, who managed to run FreeBSD in KQEMU on the Linux instances provided by Travis-CI</li>
<li>“Travis-CI has a free offer for software having public repository at GitHub. Travis-CI provides cloud instances running Linux or Mac OS X. To increase portability tests of 
GDAL, I wondered if it was somehow possible to run another operating system with Travis-CI, for example FreeBSD. A search lead me to this 
<a href="https://github.com/travis-ci/travis-ci/issues/1818" rel="nofollow">question</a> in their bug tracker but the outcome seems to be that it is not possible, nor in their medium or long term plans.”</li>
<li>“One idea that came quickly to mind was to use the QEMU machine emulator that can simulate full machines, of several hardware architectures.”</li>
<li>They found an existing image of FreeBSD 9.2 and configured the Travis job to download it and fire it up in QEMU.</li>
<li>“Here we go: ./configure &amp;&amp; make ! That works, but 50 minutes later (the maximum length of a Travis-CI job), our job is killed with perhaps only 10% of the GDAL code base being 
compiled. The reason is that we used the pure software emulation mode of QEMU that involves on-the-fly disassembling of the code to be run and re-assembling.”</li>
<li>Travis-CI runs in Google Compute Engine, which does not allow nested virtualization, so hardware virtualization is not an option to speed up QEMU</li>
<li>“Here comes the time for good old memories and a bit of software archeology. QEMU was started by Fabrice Bellard. If you didn&#39;t know his name yet, F. Bellard created FFMPEG and 
QEMU, holds a world record for the number of decimals of Pi computed on a COTS PC, has ported QEMU in JavaScript to run the Linux kernel in your browser, devised BPG, a new 
compression based on HEVC, etc....”</li>
<li>“At the time where his interest was focused on QEMU, he created KQemu, a kernel module (for Linux, Windows, FreeBSD hosts), that could significantly enhance QEMU performance 
when the guest and hosts are x86/x86_64 and does not require (nor use) hardware virtualization instructions.”</li>
<li>“Running it on Travis-CI was successful too, with the compilation being done in 20 minutes, so probably half of the speed of bare metal, which is good enough.”</li>
<li>“I could also have potentially tried VirtualBox because, as mentioned above, it supports software virtualization with acceleration. But that is only for 32 bit guests (and I 
didn&#39;t find a ready-made FreeBSD 32bit image that you can directly ssh into). For 64 bit guests, VirtualBox require hardware virtualization to be available in the host. To the best 
of my knowledge, KQemu is (was) the only solution to enable acceleration of 64 bit guests without hardware requirements.”</li>
<li>It will be interesting to see if enough people do this hack, maybe Travis-CI will consider properly supporting FreeBSD
***</li>
</ul>

<h3><a href="https://www.openbsd.org/events.html" rel="nofollow">OpenBSD EuroBSDcon 2016 Papers are online</a></h3>

<ul>
<li>Slides from the OpenBSD talks at EuroBSDCon are online now

<ul>
<li>Landry Breuil, <a href="https://rhaalovely.net/%7Elandry/eurobsdcon2016/" rel="nofollow">Building packages on exotic architectures</a></li>
<li>Peter Hessler, <a href="https://www.openbsd.org/papers/eurobsdcon2016-bfd.pdf" rel="nofollow">Bidirectional Forwarding Detection (BFD) implementation and support in OpenBSD</a></li>
<li>Ingo Schwarze, <a href="https://www.openbsd.org/papers/eurobsdcon2016-utf8.pdf" rel="nofollow">Why and how you ought to keep multibyte character support simple</a> (roff/mm/gpresent <a href="https://www.openbsd.org/papers/eurobsdcon2016-utf8.roff" rel="nofollow">source 
code</a>)</li>
<li>Stefan Sperling, <a href="https://www.openbsd.org/papers/eurobsdcon2016-openbsd-11n.pdf" rel="nofollow">OpenBSD meets 802.11n</a></li>
<li>Antoine Jacoutot, <a href="https://www.bsdfrog.org/pub/events/openbsd-rcd-EuroBSDcon2016.pdf" rel="nofollow">OpenBSD rc.d(8)</a></li>
<li>Marc Espie, <a href="https://www.openbsd.org/papers/eurobsdcon2016-privsep.pdf" rel="nofollow">Retrofitting privsep into dpb and pkg_add</a></li>
<li>Martin Pieuchot, <a href="https://www.openbsd.org/papers/eurobsdcon2016-embracingbsdrt.pdf" rel="nofollow">Embracing the BSD routing table</a></li>
</ul></li>
<li>I am working to build a similar website for the FreeBSD project, but there is still a lot of work to do</li>
<li>I also managed to find the slides from the keynotes:</li>
<li><a href="https://papers.freebsd.org/2016/EuroBSDCon/LookingBackwards.pdf" rel="nofollow">Opening Keynote: George Neville-Neil: Looking Backwards: The coming decades of BSD </a></li>
<li><a href="http://www.monobsd.com/files/16_ddos_and_consequences.pptx" rel="nofollow">Closing Keynote: Gert Döring: Internet Attacks, Self-Governance, and the Consequences </a>
***</li>
</ul>

<h3><a href="https://kernelnomicon.org/?p=650" rel="nofollow">VirtualBox Shared Folders on FreeBSD: progress report</a></h3>

<ul>
<li>In the past month or so, VirtualBox in the FreeBSD ports tree got bumped to version 5, which while bringing new features, did cause a regression in Shared Folders.</li>
<li>FreeBSD developer gonzo@ (Oleksandr Tymoshenko) has been tackling this issue in recent days and provides us with a look behind the curtain at the challenges involved.</li>
<li>Specifically he started by implementing the various needed VOPs: “lookup, access, readdir, read, getattr, readlink, remove, rmdir, symlink, close, create, open, write.”</li>
<li>He then continues with details about how complete this is:</li>
</ul>

<p>““Kind of implemented” means that I was able to mount directory, traverse it, read file, calculate md5 sums and compare with host’s md5sum, create/remove directories, <br>
unzip zip file, etc but I doubt it would survive stress-test. Locking is all wrong at the moment and read/write VOPs allocate buffers for every operation.”</p>

<ul>
<li>The bigger issue faced is with the rename VOP though:</li>
</ul>

<blockquote>
<p>I hit a roadblock with rename VOP: it involves some non-trivial locking logic and also there is a problem with cached paths. VBox hypervisor operates on full paths so we cache them <br>
in vboxfs nodes, but if one of parent directories is renamed, all cached names should be modified accordingly. I am going to tackle these two problems once I have long enough stretch <br>
of time time sit and concentrate on task.</p>

<ul>
<li>We wish him luck in getting those issues solved. I know quite a few of our users rely on shared folders as well.
***</li>
</ul>
</blockquote>

<h3><a href="http://support.rossw.net/FreeBSD-Issue1.pdf" rel="nofollow">FreeBSD News Issue #1</a></h3>

<ul>
<li>Issue #1 of FreeBSD News, from summer of 1997</li>
<li>Contains an article by Yahoo! co-founder David Filo about their early use of FreeBSD, on 100mhz Pentium machines with 64MB of ram</li>
<li>Java Development Kit 1.0.2 ported to FreeBSD</li>
<li>What is FreeBSD?</li>
<li>Running the world’s busiest FTP site (cdrom.com) on FreeBSD</li>
<li>Xi Graphics announces the release of CDE Business Desktop, the first and only integrated desktop for FreeBSD, on AcceleratedX, a fully supported commercial grade X display server</li>
<li>Get FreeBSD 2.2.2 Today!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://mail-index.netbsd.org/current-users/2016/09/21/msg030183.html" rel="nofollow">Call for testing: newly MPSAFE nvme(4)</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-September/313061.html" rel="nofollow">Thinking about starting a BUG in Indianapolis, IN USA</a></p></li>
<li><p><a href="https://medium.com/bradfield-cs/the-cost-of-forsaking-c-113986438784#.o2m5gv8y7" rel="nofollow">The cost of forsaking C: Why students still need to learn C </a> </p></li>
<li><p><a href="https://blog.jasper.la/openbsd-uefi-bootloader-howto/" rel="nofollow">OpenBSD (U)EFI bootloader howto</a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2780" rel="nofollow">Michael Lucas sets his eyes on OpenBSD&#39;s web stack for his next book</a> </p></li>
<li><p><a href="http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.0-relnotes.txt" rel="nofollow">LibreSSL 2.5.0 released</a></p></li>
<li><p><a href="https://opnsense.org/opnsense-16-7-5-released/" rel="nofollow">OPNsense 16.7.5 released</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/XeJhK0AJ" rel="nofollow"> Jonas - ZFS on DO </a> </li>
<li><a href="http://pastebin.com/Z9JRjcvb" rel="nofollow"> Ricardo - OpenBSD Encrypted Disk</a> </li>
<li><a href="http://pastebin.com/XAD0UevP" rel="nofollow"> WiskerTickle - Storage Benchmark </a> </li>
<li><a href="http://pastebin.com/N52JhYru" rel="nofollow"> Phil - Thanks</a> </li>
<li><a href="http://pastebin.com/57qS0wrx" rel="nofollow"> Luis - Misc Questions</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we’ll be talking to Petra about the NetBSD foundation, about how they operate and assist NetBSD behind the scenes. That plus lots of news</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.daemonology.net/blog/2016-10-03-FreeBSD-EC2-11-0-RELEASE.html" rel="nofollow">What is new on EC2 for FreeBSD 11.0-RELEASE</a></h3>

<ul>
<li>“FreeBSD 11.0-RELEASE is just around the corner, and it will be bringing a long list of new features and improvements — far too many for me to list here. I think there are 
some improvements in FreeBSD 11.0 which are particularly noteworthy for EC2 users.”</li>
<li>“First, the EC2 Console Screenshot functionality now works with FreeBSD. This provides a &quot;VGA&quot; output as opposed to the traditional &quot;serial port&quot; which EC2 has exposed as 
&quot;console output&quot; for the past decade, and is useful largely because the &quot;VGA&quot; output becomes available immediately whereas the &quot;serial port&quot; output can lag by several minutes. This 
improvement is a simple configuration change — older releases didn&#39;t waste time writing to a non-serial console because it didn&#39;t go anywhere until Amazon added support on their 
side — and can be enabled on older FreeBSD releases by changing the line console=&quot;comconsole&quot; to boot_multicons=&quot;YES&quot; in /boot/loader.conf.”</li>
<li>“The second notable change is support for EC2 &quot;Enhanced Networking&quot; using Intel 82599 hardware; on the C3, C4, R3, I2, D2, and M4 (excluding m4.16xlarge) families, this 
provides increased network throughput and reduced latency and jitter, since it allows FreeBSD to talk directly to the networking hardware rather than via a Xen paravirtual interface. 
Getting this working took much longer than I had hoped, but the final problem turned out not to be in FreeBSD at all — we were tickling an interrupt-routing bug in a version of 
Xen used in EC2. Unfortunately FreeBSD does not yet have support for the new &quot;Elastic Network Adapter&quot; enhanced networking used in P2 and X1 instance families and the m4.16xlarge 
instance type; I&#39;m hoping that we&#39;ll have a driver for that before FreeBSD 11.1 arrives.”</li>
<li>“The third notable change is an improvement in EC2 disk throughput. This comes thanks to enabling indirect segment I/Os in FreeBSD&#39;s blkfront driver; while the support was 
present in 10.3, I had it turned off by default due to performance anomalies on some EC2 instances. (Those EC2 performance problems have been resolved, and disk I/O performance in 
EC2 on FreeBSD 10.3 can now be safely improved by removing the line hw.xbd.xbd_enable_indirect=&quot;0&quot; from /boot/loader.conf.)”</li>
<li>“Finally, FreeBSD now supports all 128 CPUs in the x1.32xlarge instance type. This improvement comes thanks to two changes: The FreeBSD default kernel was modified in 2014 to 
support up to 256 CPUs (up from 64), but that resulted in a (fixed-size) section of preallocated memory being exhausted early in the boot process on systems with 92 or more CPUs; a 
few months ago I changed that value to tune automatically so that FreeBSD can now boot and not immediately panic with an out-of-the-box setup on such large systems.”</li>
<li>“I think FreeBSD/EC2 users will be very happy with FreeBSD 11.0-RELEASE; but I&#39;d like to end with an important reminder: No matter what you might see on FTP servers, in EC2, or 
available via freebsd-update, the new release has not been released until you see a GPG-signed email from the release engineer. This is not just a theoretical point: In my time as a 
FreeBSD developer I&#39;ve seen multiple instances of last-minute release re-rolls happening due to problems being discovered very late, so the fact that you can see bits doesn&#39;t 
necessarily mean that they are ready to be downloaded. I hope you&#39;re looking forward to 11.0-RELEASE, but please be patient.”
***</li>
</ul>

<h3><a href="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=213196" rel="nofollow">Upgrading Amazon EC2 instance from 10.3 to 11.0-PRERELEASE results in hang at boot </a></h3>

<ul>
<li>As if to underscore that last point, a last minute bug was found on sunday night</li>
<li>A user reported that they used freebsd-update to upgrade an EC2 instance from 10.3 to 11.0 and it started hanging during boot</li>
<li>After some quick investigation by Colin, the problem was reproduced</li>
<li>Since I had done a lot of work in the loader recently, I helped Colin build a version of the loader with a lot of the debugging enabled, and some more added to try to isolate where 
in the loader the freeze was happening</li>
<li>Colin and I worked late into the night, but eventually found the read from disk that was causing the hang</li>
<li>Unlike most of the other reads, that were going into the heap, this read was into a very low memory address, right near the 640kb border. This initially distracted us from the real 
cause of the problem</li>
<li>With more debugging added, it was determined that the problem was in the GELIBoot code, when reading the last sector of each partition to determine if it is encrypted. In cases 
where the partition is not 4k aligned, and butts up against the end of the disk, the formula used could result in a read past the end of the disk</li>
<li>The formula rounds the last sector byte address down to the nearest factor of 4096, then reads 4096 bytes. Then that buffer is examined to determine if the partition is encrypted. 
If it is a 512b sector drive, the metadata will be in the last 512 bytes of that 4096 byte buffer.</li>
<li>However, if the partition is not 4k aligned, the rounding will produce a value that is less than 4096 bytes from the end of the disk, and attempting to read 4096 bytes, will read 
past the end of the disk</li>
<li>Normally this isn’t that big of a problem, the BIOS will just return an error. The loader will retry up to three times, then give up and move on, continuing to boot normally.</li>
<li>Some BIOSes are buggy, and will initiate their own retries, and the combination might result in a stall of up to 30 seconds for each attempt to read past the end of the disk</li>
<li>But it seems that Amazon EC2 instances, (and possibly other virtual instances), will just hang in this case.</li>
<li>This bug has existed for 6 months, but was not caught because almost all installations are 4k aligned thanks to changes made to the installer over the last few years, and most 
hardware continues to boot with no sign of a problem</li>
<li>Even the EC2 snapshot images of 11.0 do not have the problem, as they use a newer disk layout that is 4k aligned by default now. The problem only seems to happen when older disk 
images are upgraded</li>
<li>The fix has been committed and will be merged the the branches over the next few days</li>
<li>An Errata notice will be issues, and the fix will be available via freebsd-update</li>
<li>It is recommended that EC2 users, and anyone who wants to be especially cautious, wait until this errata notice goes out before attempting to upgrade from FreeBSD 10.3 to 11.0</li>
<li>You can determine if your partitions are 4k aligned by running ‘gpart show’. If there is free space after your last partition, you won’t have any issues.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160929230557&mode=expanded" rel="nofollow">OpenBSD 6.0 Limited Edition CD set (signed by developers)</a></h3>

<p><a href="http://www.ebay.com/itm/-/331985953783" rel="nofollow">The first one went for .$4,200.00</a> </p>

<ul>
<li>Looking for your piece of OpenBSD history? At the recent g2k16 hackathon in Cambridge UK, 40 OpenBSD developers put pen to paper and signed 5 copies of the new 6.0 release.</li>
<li>Each of these will be auctioned off on ebay, with the proceeds to benefit the OpenBSD foundation.</li>
<li>The first auction has already ended, and CD set went for a whopping $4200!</li>
<li>The next set only has 2 days left, and currently stands at $3000! (<a href="http://www.ebay.com/itm/-/331990536246" rel="nofollow">http://www.ebay.com/itm/-/331990536246</a>) </li>
<li>Get your bids in soon, these are VERY unique, the odds of getting the same 40 developers in a room together and signing a new .0 release may make this a once-in-a-lifetime 
opportunity.</li>
<li>Additionally, if you are just starting your OpenBSD collection, here’s a nice image to make you envious: <a href="http://i.imgur.com/OrE0Gsa.png" rel="nofollow">A nice collection of OpenBSD CD Sets</a> 
***</li>
</ul>

<h3>[What typing <sup>D</sup> really does on Unix</h3>

<p>](<a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/TypingEOFEffects" rel="nofollow">https://utcc.utoronto.ca/~cks/space/blog/unix/TypingEOFEffects</a>)</p>

<ul>
<li>How often have you used a <sup>D</sup> to generate an EOF? Do you really know what that does?</li>
<li>Chris Siebenmann has posted a look at this on his blog, which might not be what you think</li>
</ul>

<blockquote>
<p>“Typing <sup>D</sup> causes the tty driver to immediately finish a read().”</p>
</blockquote>

<ul>
<li>He continues on:</li>
</ul>

<blockquote>
<p>Normally doing a read() from a terminal is line-buffered inside the tty driver; your program only wakes up when the tty driver sees the newline, at which point you get back the full <br>
line. (Note that this buffering is distinct from anything that your language&#39;s IO system may be doing.)</p>

<p>Typing <sup>D</sup> causes the tty driver to stop waiting for a newline and immediately return from the read() with however much of the line has been accumulated to date. If you haven&#39;t <br>
typed anything on the line yet, there is nothing accumulated and the read() will return 0 bytes, which is conveniently the signal for end of file. If you have typed something the <br>
program will get it; because it doesn&#39;t have a trailing newline, the program&#39;s own line-buffering may take over and keep read()ing to get the rest of the line.</p>

<p>(Other programs will immediately process the partial line with no buffering; cat is one example of this.)</p>

<p>Once you&#39;ve typed <sup>D</sup> on a partial line, that portion of the line is immutable because it&#39;s already been given to the program. Most Unixes won&#39;t let you backspace over such partial <br>
lines; effectively they become output, not input.</p>

<p>(Note that modern shells are not good examples of this, because they don&#39;t do line-buffered input; to support command line editing, they switch terminal input into an uninterpreted <br>
mode. So they get the raw <sup>D</sup> and can do whatever they want with it, and they can let you edit as much of the pending line as they want.)</p>
</blockquote>

<ul>
<li>Fascinating stuff, and interesting to see behind the curtain at exactly what’s going on with your programs buffering and tty driver interaction.</li>
</ul>

<hr>

<h2>Interview - Petra Zeidler - <a href="mailto:spz@netbsd.org" rel="nofollow">spz@netbsd.org</a></h2>

<ul>
<li>NetBSD Foundation
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://erouault.blogspot.com/2016/09/running-freebsd-in-travis-ci.html" rel="nofollow">Running FreeBSD in Travis-CI Thanks to KQEmu</a></h3>

<ul>
<li>Travis-CI is the most popular testing framework on Github, but it doesn’t support any of the BSDs</li>
<li>This didn’t discourage Even Rouault, who managed to run FreeBSD in KQEMU on the Linux instances provided by Travis-CI</li>
<li>“Travis-CI has a free offer for software having public repository at GitHub. Travis-CI provides cloud instances running Linux or Mac OS X. To increase portability tests of 
GDAL, I wondered if it was somehow possible to run another operating system with Travis-CI, for example FreeBSD. A search lead me to this 
<a href="https://github.com/travis-ci/travis-ci/issues/1818" rel="nofollow">question</a> in their bug tracker but the outcome seems to be that it is not possible, nor in their medium or long term plans.”</li>
<li>“One idea that came quickly to mind was to use the QEMU machine emulator that can simulate full machines, of several hardware architectures.”</li>
<li>They found an existing image of FreeBSD 9.2 and configured the Travis job to download it and fire it up in QEMU.</li>
<li>“Here we go: ./configure &amp;&amp; make ! That works, but 50 minutes later (the maximum length of a Travis-CI job), our job is killed with perhaps only 10% of the GDAL code base being 
compiled. The reason is that we used the pure software emulation mode of QEMU that involves on-the-fly disassembling of the code to be run and re-assembling.”</li>
<li>Travis-CI runs in Google Compute Engine, which does not allow nested virtualization, so hardware virtualization is not an option to speed up QEMU</li>
<li>“Here comes the time for good old memories and a bit of software archeology. QEMU was started by Fabrice Bellard. If you didn&#39;t know his name yet, F. Bellard created FFMPEG and 
QEMU, holds a world record for the number of decimals of Pi computed on a COTS PC, has ported QEMU in JavaScript to run the Linux kernel in your browser, devised BPG, a new 
compression based on HEVC, etc....”</li>
<li>“At the time where his interest was focused on QEMU, he created KQemu, a kernel module (for Linux, Windows, FreeBSD hosts), that could significantly enhance QEMU performance 
when the guest and hosts are x86/x86_64 and does not require (nor use) hardware virtualization instructions.”</li>
<li>“Running it on Travis-CI was successful too, with the compilation being done in 20 minutes, so probably half of the speed of bare metal, which is good enough.”</li>
<li>“I could also have potentially tried VirtualBox because, as mentioned above, it supports software virtualization with acceleration. But that is only for 32 bit guests (and I 
didn&#39;t find a ready-made FreeBSD 32bit image that you can directly ssh into). For 64 bit guests, VirtualBox require hardware virtualization to be available in the host. To the best 
of my knowledge, KQemu is (was) the only solution to enable acceleration of 64 bit guests without hardware requirements.”</li>
<li>It will be interesting to see if enough people do this hack, maybe Travis-CI will consider properly supporting FreeBSD
***</li>
</ul>

<h3><a href="https://www.openbsd.org/events.html" rel="nofollow">OpenBSD EuroBSDcon 2016 Papers are online</a></h3>

<ul>
<li>Slides from the OpenBSD talks at EuroBSDCon are online now

<ul>
<li>Landry Breuil, <a href="https://rhaalovely.net/%7Elandry/eurobsdcon2016/" rel="nofollow">Building packages on exotic architectures</a></li>
<li>Peter Hessler, <a href="https://www.openbsd.org/papers/eurobsdcon2016-bfd.pdf" rel="nofollow">Bidirectional Forwarding Detection (BFD) implementation and support in OpenBSD</a></li>
<li>Ingo Schwarze, <a href="https://www.openbsd.org/papers/eurobsdcon2016-utf8.pdf" rel="nofollow">Why and how you ought to keep multibyte character support simple</a> (roff/mm/gpresent <a href="https://www.openbsd.org/papers/eurobsdcon2016-utf8.roff" rel="nofollow">source 
code</a>)</li>
<li>Stefan Sperling, <a href="https://www.openbsd.org/papers/eurobsdcon2016-openbsd-11n.pdf" rel="nofollow">OpenBSD meets 802.11n</a></li>
<li>Antoine Jacoutot, <a href="https://www.bsdfrog.org/pub/events/openbsd-rcd-EuroBSDcon2016.pdf" rel="nofollow">OpenBSD rc.d(8)</a></li>
<li>Marc Espie, <a href="https://www.openbsd.org/papers/eurobsdcon2016-privsep.pdf" rel="nofollow">Retrofitting privsep into dpb and pkg_add</a></li>
<li>Martin Pieuchot, <a href="https://www.openbsd.org/papers/eurobsdcon2016-embracingbsdrt.pdf" rel="nofollow">Embracing the BSD routing table</a></li>
</ul></li>
<li>I am working to build a similar website for the FreeBSD project, but there is still a lot of work to do</li>
<li>I also managed to find the slides from the keynotes:</li>
<li><a href="https://papers.freebsd.org/2016/EuroBSDCon/LookingBackwards.pdf" rel="nofollow">Opening Keynote: George Neville-Neil: Looking Backwards: The coming decades of BSD </a></li>
<li><a href="http://www.monobsd.com/files/16_ddos_and_consequences.pptx" rel="nofollow">Closing Keynote: Gert Döring: Internet Attacks, Self-Governance, and the Consequences </a>
***</li>
</ul>

<h3><a href="https://kernelnomicon.org/?p=650" rel="nofollow">VirtualBox Shared Folders on FreeBSD: progress report</a></h3>

<ul>
<li>In the past month or so, VirtualBox in the FreeBSD ports tree got bumped to version 5, which while bringing new features, did cause a regression in Shared Folders.</li>
<li>FreeBSD developer gonzo@ (Oleksandr Tymoshenko) has been tackling this issue in recent days and provides us with a look behind the curtain at the challenges involved.</li>
<li>Specifically he started by implementing the various needed VOPs: “lookup, access, readdir, read, getattr, readlink, remove, rmdir, symlink, close, create, open, write.”</li>
<li>He then continues with details about how complete this is:</li>
</ul>

<p>““Kind of implemented” means that I was able to mount directory, traverse it, read file, calculate md5 sums and compare with host’s md5sum, create/remove directories, <br>
unzip zip file, etc but I doubt it would survive stress-test. Locking is all wrong at the moment and read/write VOPs allocate buffers for every operation.”</p>

<ul>
<li>The bigger issue faced is with the rename VOP though:</li>
</ul>

<blockquote>
<p>I hit a roadblock with rename VOP: it involves some non-trivial locking logic and also there is a problem with cached paths. VBox hypervisor operates on full paths so we cache them <br>
in vboxfs nodes, but if one of parent directories is renamed, all cached names should be modified accordingly. I am going to tackle these two problems once I have long enough stretch <br>
of time time sit and concentrate on task.</p>

<ul>
<li>We wish him luck in getting those issues solved. I know quite a few of our users rely on shared folders as well.
***</li>
</ul>
</blockquote>

<h3><a href="http://support.rossw.net/FreeBSD-Issue1.pdf" rel="nofollow">FreeBSD News Issue #1</a></h3>

<ul>
<li>Issue #1 of FreeBSD News, from summer of 1997</li>
<li>Contains an article by Yahoo! co-founder David Filo about their early use of FreeBSD, on 100mhz Pentium machines with 64MB of ram</li>
<li>Java Development Kit 1.0.2 ported to FreeBSD</li>
<li>What is FreeBSD?</li>
<li>Running the world’s busiest FTP site (cdrom.com) on FreeBSD</li>
<li>Xi Graphics announces the release of CDE Business Desktop, the first and only integrated desktop for FreeBSD, on AcceleratedX, a fully supported commercial grade X display server</li>
<li>Get FreeBSD 2.2.2 Today!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://mail-index.netbsd.org/current-users/2016/09/21/msg030183.html" rel="nofollow">Call for testing: newly MPSAFE nvme(4)</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-September/313061.html" rel="nofollow">Thinking about starting a BUG in Indianapolis, IN USA</a></p></li>
<li><p><a href="https://medium.com/bradfield-cs/the-cost-of-forsaking-c-113986438784#.o2m5gv8y7" rel="nofollow">The cost of forsaking C: Why students still need to learn C </a> </p></li>
<li><p><a href="https://blog.jasper.la/openbsd-uefi-bootloader-howto/" rel="nofollow">OpenBSD (U)EFI bootloader howto</a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2780" rel="nofollow">Michael Lucas sets his eyes on OpenBSD&#39;s web stack for his next book</a> </p></li>
<li><p><a href="http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.0-relnotes.txt" rel="nofollow">LibreSSL 2.5.0 released</a></p></li>
<li><p><a href="https://opnsense.org/opnsense-16-7-5-released/" rel="nofollow">OPNsense 16.7.5 released</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/XeJhK0AJ" rel="nofollow"> Jonas - ZFS on DO </a> </li>
<li><a href="http://pastebin.com/Z9JRjcvb" rel="nofollow"> Ricardo - OpenBSD Encrypted Disk</a> </li>
<li><a href="http://pastebin.com/XAD0UevP" rel="nofollow"> WiskerTickle - Storage Benchmark </a> </li>
<li><a href="http://pastebin.com/N52JhYru" rel="nofollow"> Phil - Thanks</a> </li>
<li><a href="http://pastebin.com/57qS0wrx" rel="nofollow"> Luis - Misc Questions</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>161: The BSD Bromance</title>
  <link>https://www.bsdnow.tv/161</link>
  <guid isPermaLink="false">36da27b4-412f-4eac-9d44-5ffb73ed18a4</guid>
  <pubDate>Wed, 28 Sep 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/36da27b4-412f-4eac-9d44-5ffb73ed18a4.mp3" length="72823828" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we’re going to be hearing about Allan’s trip to EuroBSDCon, plus an Interview about “Bro on BSD”! Stay tuned, for your place to</itunes:subtitle>
  <itunes:duration>1:41:08</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we’re going to be hearing about Allan’s trip to EuroBSDCon, plus an Interview about “Bro on BSD”! Stay tuned, for your place to
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
EuroBSDCon 2016 Wrapup
Ollivier Robert’s Photos from EuroBSDCon  (https://assets.keltia.net/photos/EuroBSDCon-2016/) 
Get your BSDNow die-cut stickers (http://www.jupiterbroadcasting.com/stickers/) 
NetBSD for newbies - Develop your own Power PC (http://discusscomputerx.blogspot.com/2016/09/netbsd-for-noobies-your-power-laptop.html)
We don’t get to feature too many stories on NetBSD being deployed as a Power PC (Not PowerPC, you know, a Powerful “PC”), so we jumped at this one.
Specifically it starts off with some of the pre-req’s that you’ll need to get started, such as NetBSD 7.0.1 / amd64, along with some information about which wireless nics you may be using. (NetBSD like other BSD’s will give a driver based device name for network interfaces)
From there, instructions on how to write your WPA_supplicant config are provided, in order for us to fetch the NetBSD sources and convert to their -STABLE branch.
After doing a CVS checkout of the sources, he then provides a walkthrough of doing a kernel compile / install, however it mentions changing the config, but doesn’t provide an example of what options were changed. Perhaps to remove drivers we don’t need?
At this point the rest of the “desktop” setup is pretty straight forward. Some packages are added such as openbox, lxappearance, firefox, etc.
To get working sound, firefox requires pulseaudio, which in turn needs dbus, so instructions on getting that service up and running are provided as well.
When it’s all said and done, you’ll end up with your shiny new NetBSD -STABLE desktop (or laptop), bragging rights achieved!
***
More about OpenSMTPD 6.0.0 (https://www.poolp.org/tech/posts/2016/09/12/opensmtpd-6-0-0-released/)
OpenSMTPd 6.0.0 has just been released “and it's quite different from former releases.”
“Unlike most of our releases, it comes out with almost no new feature.”, “Turns out most of the changes are not visible.”
Changelog:
new fork+reexec model so each process has its own randomized memory space
logging format has been reworked
a "multi-line response" bug in the LMTP delivery backend has been fixed
connections concurrency limits have been bumped
artificial delaying in remote sessions have been reduced
dhparams option has been removed
dhe option has been added, supporting auto and legacy modes
 smtp engine has been simplified
various cosmetic changes, code cleanup and documentation improvement
“The OpenSMTPD bootstrap process was quite simple: Upon executation, the parent process would read configuration, build a memory representation of it and would then create a bunch of socketpair() before fork()-ing all of its child processes.”
The problem is that this does not take advantage of the new address randomization feature. Each child will have the same memory layout, copied from the parent process
“So deraadt@ suggested that if OpenSMTPD would not just fork() children but instead fork() them and reexecute the smtpd binary, then each of the children would have its own randomized memory space.”
“The idea itself is neat, however not so trivial to implement because when we reexec the whole "inherit configuration and descriptors" part goes away. It's not just fork and exec, it's fork and exec and figure a way for the parent to pass back all the information and descriptors back to the new post-fork instance so it is the new instance that allocates memory and decides where the information goes.”
***
Upgrade a FreeBSD 10.3 Installation with ZFS on Root and Full Disk Encryption to 11.0 (http://ftfl.ca/blog/2016-09-17-zfs-fde-one-pool-conversion.html)
While FreeBSD 11.0 is not out yet, Joseph Mingrone has helped me work out and test the instructions for upgrading a FreeBSD 10.3 ZFS on full disk encryption setup (bootpool + zpool) to the new GELIBoot feature, which does not require any unencrypted partitions, just the 128kb bootcode
Note: Do not upgrade to FreeBSD 11.0 yet. While some images have landed on the FTP server, they do not contain the final openssl fix and are going to be recreated.
Currently, GELIBoot does not support key files, so the first step is to reencrypt the master key with only a passphrase.
Next, to avoid GELIBoot picking up encrypted partitions that it does not support, or partitions you do not want decrypted at boot, only partitions with the GELIBoot flag are decrypted, so set the flag on your root partition
Then, move the loader, kernel, and other files into /boot on the root filesystem, instead of them living on the bootpool. This allows the kernel to be versioned with boot environments, and is the main purpose of this work
Then, install the newer gptzfsboot, as this is required to support GELIBoot
The old 2gb bootpool partition is then purposely mislabeled as freebsd-vinum, so it is not picked up by the boot blocks. Later, if the upgrade is successful, this partition can be deleted, and used as addition swap or something
In order to boot correctly, you want all boot environments to have the ‘canmount’ ZFS property set to ‘noauto’
Thank you to Joseph for taking the time to prod me for the information required to write this up, and for testing it and finding all of the issues 
***
Interview - Michael Shirk - mshirk@daemon-security.com (mailto:mshirk@daemon-security.com) / @shirkdog (https://twitter.com/shirkdog)
Running Bro on BSD
***
News Roundup
FreeBSD based distro for virtual hosting platform and appliance (https://clonos.tekroutine.com/)
An interesting new FreeBSD-based project as shown up online, called “ClonOS”, which bills itself as a “free open-source FreeBSD-based platform for virtual environments creation and management”
It looks to be leveraging an impressive list of technologies, including Bhyve, Xen, Jails and CBSD / Puppet for management tasks.
Among its list of features:
ZFS features support;
VM cloning, export, import
Ethernet SoftSwitch for separated networking
jails for lightweight container
VNC terminal for VM/containers
Templates for VM/containers
Configuration management/helpers
Multi-node operation
Multi-Node? Color me intrigued! 
Right now it appears to be under heavy development, but we’ll reach out to the developer to see if we can get an interview lined up at some point!
The Raspberry PI Platform and The Challenges of Developing FreeBSD (https://bsdmag.org/oleksandr_rybalko/)
BSDMag recently did an interview with FreeBSD developer Olesandr Rybalko!
Oleksandr lives in the Ukraine, and while you may not have heard of him, he has worked on some cool projects for FreeBSD including the new “vt” console driver (Which a lot of people are using now), and ARM/MIPS support.
The interview covers some of the work he’s done to get the PI support working with FreeBSD:
I think, my main help here was a USB OTG driver, which I wrote before for another device (Ralink RT3052), then port it to R-Pi. But it was rewritten by Hans Peter Selasky. I do not know so much about USB as Hans knows.
Another useful part of my help is Xorg support. I did a simple Xorg video driver which uses framebuffer exported by virtual terminal subsystem. That is help to many guys to start use RPi as a simple desktop system.
He was also asked the question “Why would FreeBSD be good fit for ARM?”
FreeBSD is very powerful as a network server. All modern network features in one box, with very fast processing.
Another good side of FreeBSD is modularity. It is not required to write code to use some driver that was already written for another system, you can just define it in configuration files (kernel config, kernel hints, FDT). So if you want build a nice, R-Pi based, home server – use FreeBSD. If you want to play with devices attached to R-Pi’s GPIO – use FreeBSD.
He also discusses his work on the ZRouter project, which is a very light-weight platform for tiny routers / embedded devices. But lastly the RPI comes up again, specifically asking him how interested individuals can get involved. Specifically the wiki.freebsd.org is a great reference point for those intested in getting started with FreeBSD on embedded. The warm community is also a plus!
Trying out the FreeBSD powered TrueOS (http://www.phoronix.com/scan.php?page=news_item&amp;amp;px=TrueOS-First-Spin)
The folks over at Phoronix have done an early look at the new TrueOS desktop images and given some of their thoughts. 
First up he gives props to the installer, noting that:
The TrueOS desktop installer is basically the same as from the PC-BSD days, just re-branded. Still one of the easiest BSD graphical installers I've dealt with and makes it a breeze for setting up a FreeBSD-on-ZFS system by default. 
After that they took it for a minimal spin, and thing mostly seem to be working. He mentions some of the default apps (Such as qupzilla and trojita) aren’t their favorite, but Lumina has come quite a ways for 1.0, despite a few rough edges still. (We are in the process of changing those default e-mail / browser apps)
Lastly the article mentions that it’s time to do a more full BSD round-up to see the state of installation of them, which we happen to have next!
Trying out 8 BSDs on a modern PC (http://www.phoronix.com/scan.php?page=article&amp;amp;item=trying-8-bsds&amp;amp;num=1)
First up was TrueOS again, which no major changes there, easy install and done.
From there he tries out DragonFlyBSD, which he mentions that while the installer isn’t as easy, it is still one of his favorite BSD’s, working with all the hardware they’ve thrown at it.
Next up was GhostBSD, which also has an Easy-To-Use graphical installer similar to TrueOS that made it quick to get loaded and up to the Mate desktop.
Also tested was FreeBSD 11.0-RC2, which he mentions was easy to installed, and once done then ‘pkg’ could be used to easily get the setup he wanted setup.
Turning over to page two we get to the naughty list of BSD’s he had troubles with.
First up was OpenBSD which he tried 6.0. After installation and first boot, the display kept ‘disappearing’ which meant he couldn’t get IP information to try SSH’ing into the box. Perhaps a display driver error?
NetBSD 7 was up next, where the installer couldn’t get past a root device prompt. Most likely trouble finding the install media, which was the same story with MightnightBSD as well.
Also tested was “PacBSD” (Formerly ArchBSD) which he did manage to get installed, but not after major fighting with the process. After the process he ran into some issues getting packages up and running, but mentions it may have been bad timing due to them moving to a new server at the time.
***
IllumOS imports a modified FreeBSD boot loader to replace grub 0.97 (https://www.listbox.com/member/archive/182181/2016/09/sort/time_rev/page/1/entry/0:1/20160923124232:B7978ED4-81AC-11E6-A6DA-02E3F010038B/)
Toomas Soome’s work to port the FreeBSD boot loader to IllumOS has been merged into illumos-gate, the upstream repository for all IllumOS distributions
Toomas’ work has also resulted in a number of commits to FreeBSD, and code sharing in both directions
Toomas helped me a lot with the building of the ZFS boot environment listing menu, even though on IllumOS they use a configuration file to list the BEs, rather than interrogating the live zpool like we do in FreeBSD
Toomas’ work to improve msdosfs and the block cache to speed up booting IllumOS also greatly helped FreeBSD
This work means IllumOS can now boot from a RAID-Z (the old grub they used could not), and if the work Toomas has done on FreeBSD is any indication, support for almost all other zpool features is also on the way
This work also sets IllumOS on a path to eventually having UEFI boot as well
It is good to see this work happening, FreeBSD technology being reused elsewhere, but also the improvements being made for IllumOS are coming back to FreeBSD, often landing upstream first, to make merging them into IllumOS easier.
The mailing list post describes how to convert existing systems away from grub, as well as how to opt to remain on grub for a while longer.
Grub 0.97 is expected to be removed from IllumOS within a year.
***
Beastie Bits
A demo of booting CentOS and Windows 10 in FreeBSD Bhyve through VNC headless (https://www.youtube.com/watch?v=8YQQfXqtyaA)
This year’s anemic output (http://blather.michaelwlucas.com/archives/2762)
“PAM Mastery” ebook now out (http://blather.michaelwlucas.com/archives/2771)
How-to Install OpenBSD 6.0 plus XFCE desktop and basic applications (https://www.youtube.com/watch?v=oC5D9fenQBs)
***
Feedback/Questions
 Piotr - LibreBoot  (http://pastebin.com/yniniNpV) 
 Alan - FreeBSD and PC-BSD (http://pastebin.com/dCNX0yF7) 
 Eduardo - Newcomers (http://pastebin.com/LndNeAYb) 
 Greg - ZFS ACL’s (http://pastebin.com/F0y6L6NK) 
 Brian - Laptop Recs (http://pastebin.com/sqMPJGMM) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we’re going to be hearing about Allan’s trip to EuroBSDCon, plus an Interview about “Bro on BSD”! Stay tuned, for your place to</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>EuroBSDCon 2016 Wrapup</h3>

<ul>
<li><a href="https://assets.keltia.net/photos/EuroBSDCon-2016/" rel="nofollow">Ollivier Robert’s Photos from EuroBSDCon </a> </li>
<li><a href="http://www.jupiterbroadcasting.com/stickers/" rel="nofollow">Get your BSDNow die-cut stickers</a> </li>
</ul>

<h3><a href="http://discusscomputerx.blogspot.com/2016/09/netbsd-for-noobies-your-power-laptop.html" rel="nofollow">NetBSD for newbies - Develop your own Power PC</a></h3>

<ul>
<li>We don’t get to feature too many stories on NetBSD being deployed as a Power PC (Not PowerPC, you know, a Powerful “PC”), so we jumped at this one.</li>
<li>Specifically it starts off with some of the pre-req’s that you’ll need to get started, such as NetBSD 7.0.1 / amd64, along with some information about which wireless nics you may be using. (NetBSD like other BSD’s will give a driver based device name for network interfaces)</li>
<li>From there, instructions on how to write your WPA_supplicant config are provided, in order for us to fetch the NetBSD sources and convert to their -STABLE branch.</li>
<li>After doing a CVS checkout of the sources, he then provides a walkthrough of doing a kernel compile / install, however it mentions changing the config, but doesn’t provide an example of what options were changed. Perhaps to remove drivers we don’t need?</li>
<li>At this point the rest of the “desktop” setup is pretty straight forward. Some packages are added such as openbox, lxappearance, firefox, etc.</li>
<li>To get working sound, firefox requires pulseaudio, which in turn needs dbus, so instructions on getting that service up and running are provided as well.</li>
<li>When it’s all said and done, you’ll end up with your shiny new NetBSD -STABLE desktop (or laptop), bragging rights achieved!
***</li>
</ul>

<h3><a href="https://www.poolp.org/tech/posts/2016/09/12/opensmtpd-6-0-0-released/" rel="nofollow">More about OpenSMTPD 6.0.0</a></h3>

<ul>
<li>OpenSMTPd 6.0.0 has just been released “and it&#39;s quite different from former releases.”</li>
<li>“Unlike most of our releases, it comes out with almost no new feature.”, “Turns out most of the changes are not visible.”</li>
<li>Changelog:

<ul>
<li>new fork+reexec model so each process has its own randomized memory space</li>
<li>logging format has been reworked</li>
<li>a &quot;multi-line response&quot; bug in the LMTP delivery backend has been fixed</li>
<li>connections concurrency limits have been bumped</li>
<li>artificial delaying in remote sessions have been reduced</li>
<li>dhparams option has been removed</li>
<li>dhe option has been added, supporting auto and legacy modes</li>
<li> smtp engine has been simplified</li>
<li>various cosmetic changes, code cleanup and documentation improvement</li>
</ul></li>
<li>“The OpenSMTPD bootstrap process was quite simple: Upon executation, the parent process would read configuration, build a memory representation of it and would then create a bunch of socketpair() before fork()-ing all of its child processes.”</li>
<li>The problem is that this does not take advantage of the new address randomization feature. Each child will have the same memory layout, copied from the parent process</li>
<li>“So deraadt@ suggested that if OpenSMTPD would not just fork() children but instead fork() them and reexecute the smtpd binary, then each of the children would have its own randomized memory space.”</li>
<li>“The idea itself is neat, however not so trivial to implement because when we reexec the whole &quot;inherit configuration and descriptors&quot; part goes away. It&#39;s not just fork and exec, it&#39;s fork and exec and figure a way for the parent to pass back all the information and descriptors back to the new post-fork instance so it is the new instance that allocates memory and decides where the information goes.”
***</li>
</ul>

<h3><a href="http://ftfl.ca/blog/2016-09-17-zfs-fde-one-pool-conversion.html" rel="nofollow">Upgrade a FreeBSD 10.3 Installation with ZFS on Root and Full Disk Encryption to 11.0</a></h3>

<ul>
<li>While FreeBSD 11.0 is not out yet, Joseph Mingrone has helped me work out and test the instructions for upgrading a FreeBSD 10.3 ZFS on full disk encryption setup (bootpool + zpool) to the new GELIBoot feature, which does not require any unencrypted partitions, just the 128kb bootcode</li>
<li>Note: Do not upgrade to FreeBSD 11.0 yet. While some images have landed on the FTP server, they do not contain the final openssl fix and are going to be recreated.</li>
<li>Currently, GELIBoot does not support key files, so the first step is to reencrypt the master key with only a passphrase.</li>
<li>Next, to avoid GELIBoot picking up encrypted partitions that it does not support, or partitions you do not want decrypted at boot, only partitions with the GELIBoot flag are decrypted, so set the flag on your root partition</li>
<li>Then, move the loader, kernel, and other files into /boot on the root filesystem, instead of them living on the bootpool. This allows the kernel to be versioned with boot environments, and is the main purpose of this work</li>
<li>Then, install the newer gptzfsboot, as this is required to support GELIBoot</li>
<li>The old 2gb bootpool partition is then purposely mislabeled as freebsd-vinum, so it is not picked up by the boot blocks. Later, if the upgrade is successful, this partition can be deleted, and used as addition swap or something</li>
<li>In order to boot correctly, you want all boot environments to have the ‘canmount’ ZFS property set to ‘noauto’</li>
<li>Thank you to Joseph for taking the time to prod me for the information required to write this up, and for testing it and finding all of the issues 
***</li>
</ul>

<h2>Interview - Michael Shirk - <a href="mailto:mshirk@daemon-security.com" rel="nofollow">mshirk@daemon-security.com</a> / <a href="https://twitter.com/shirkdog" rel="nofollow">@shirkdog</a></h2>

<ul>
<li>Running Bro on BSD
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://clonos.tekroutine.com/" rel="nofollow">FreeBSD based distro for virtual hosting platform and appliance</a></h3>

<ul>
<li>An interesting new FreeBSD-based project as shown up online, called “ClonOS”, which bills itself as a “free open-source FreeBSD-based platform for virtual environments creation and management”</li>
<li>It looks to be leveraging an impressive list of technologies, including Bhyve, Xen, Jails and CBSD / Puppet for management tasks.</li>
<li><p>Among its list of features:</p>

<ul>
<li>ZFS features support;</li>
<li>VM cloning, export, import</li>
<li>Ethernet SoftSwitch for separated networking</li>
<li>jails for lightweight container</li>
<li>VNC terminal for VM/containers</li>
<li>Templates for VM/containers</li>
<li>Configuration management/helpers</li>
<li>Multi-node operation</li>
</ul></li>
<li><p>Multi-Node? Color me intrigued! </p></li>
<li><p>Right now it appears to be under heavy development, but we’ll reach out to the developer to see if we can get an interview lined up at some point!</p>

<hr></li>
</ul>

<h3><a href="https://bsdmag.org/oleksandr_rybalko/" rel="nofollow">The Raspberry PI Platform and The Challenges of Developing FreeBSD</a></h3>

<ul>
<li>BSDMag recently did an interview with FreeBSD developer Olesandr Rybalko!</li>
<li>Oleksandr lives in the Ukraine, and while you may not have heard of him, he has worked on some cool projects for FreeBSD including the new “vt” console driver (Which a lot of people are using now), and ARM/MIPS support.</li>
<li>The interview covers some of the work he’s done to get the PI support working with FreeBSD:</li>
</ul>

<blockquote>
<p>I think, my main help here was a USB OTG driver, which I wrote before for another device (Ralink RT3052), then port it to R-Pi. But it was rewritten by Hans Peter Selasky. I do not know so much about USB as Hans knows.</p>

<p>Another useful part of my help is Xorg support. I did a simple Xorg video driver which uses framebuffer exported by virtual terminal subsystem. That is help to many guys to start use RPi as a simple desktop system.</p>
</blockquote>

<ul>
<li>He was also asked the question “Why would FreeBSD be good fit for ARM?”</li>
</ul>

<blockquote>
<p>FreeBSD is very powerful as a network server. All modern network features in one box, with very fast processing.</p>

<p>Another good side of FreeBSD is modularity. It is not required to write code to use some driver that was already written for another system, you can just define it in configuration files (kernel config, kernel hints, FDT). So if you want build a nice, R-Pi based, home server – use FreeBSD. If you want to play with devices attached to R-Pi’s GPIO – use FreeBSD.</p>
</blockquote>

<ul>
<li>He also discusses his work on the ZRouter project, which is a very light-weight platform for tiny routers / embedded devices. But lastly the RPI comes up again, specifically asking him how interested individuals can get involved. Specifically the wiki.freebsd.org is a great reference point for those intested in getting started with FreeBSD on embedded. The warm community is also a plus!</li>
</ul>

<hr>

<h3><a href="http://www.phoronix.com/scan.php?page=news_item&px=TrueOS-First-Spin" rel="nofollow">Trying out the FreeBSD powered TrueOS</a></h3>

<ul>
<li>The folks over at Phoronix have done an early look at the new TrueOS desktop images and given some of their thoughts. </li>
<li>First up he gives props to the installer, noting that:</li>
</ul>

<blockquote>
<p>The TrueOS desktop installer is basically the same as from the PC-BSD days, just re-branded. Still one of the easiest BSD graphical installers I&#39;ve dealt with and makes it a breeze for setting up a FreeBSD-on-ZFS system by default. </p>
</blockquote>

<ul>
<li>After that they took it for a minimal spin, and thing mostly seem to be working. He mentions some of the default apps (Such as qupzilla and trojita) aren’t their favorite, but Lumina has come quite a ways for 1.0, despite a few rough edges still. (We are in the process of changing those default e-mail / browser apps)</li>
<li>Lastly the article mentions that it’s time to do a more full BSD round-up to see the state of installation of them, which we happen to have next!</li>
</ul>

<h3><a href="http://www.phoronix.com/scan.php?page=article&item=trying-8-bsds&num=1" rel="nofollow">Trying out 8 BSDs on a modern PC</a></h3>

<ul>
<li>First up was TrueOS again, which no major changes there, easy install and done.</li>
<li>From there he tries out DragonFlyBSD, which he mentions that while the installer isn’t as easy, it is still one of his favorite BSD’s, working with all the hardware they’ve thrown at it.</li>
<li>Next up was GhostBSD, which also has an Easy-To-Use graphical installer similar to TrueOS that made it quick to get loaded and up to the Mate desktop.</li>
<li>Also tested was FreeBSD 11.0-RC2, which he mentions was easy to installed, and once done then ‘pkg’ could be used to easily get the setup he wanted setup.</li>
<li>Turning over to page two we get to the naughty list of BSD’s he had troubles with.</li>
<li>First up was OpenBSD which he tried 6.0. After installation and first boot, the display kept ‘disappearing’ which meant he couldn’t get IP information to try SSH’ing into the box. Perhaps a display driver error?</li>
<li>NetBSD 7 was up next, where the installer couldn’t get past a root device prompt. Most likely trouble finding the install media, which was the same story with MightnightBSD as well.</li>
<li>Also tested was “PacBSD” (Formerly ArchBSD) which he did manage to get installed, but not after major fighting with the process. After the process he ran into some issues getting packages up and running, but mentions it may have been bad timing due to them moving to a new server at the time.
***</li>
</ul>

<h3><a href="https://www.listbox.com/member/archive/182181/2016/09/sort/time_rev/page/1/entry/0:1/20160923124232:B7978ED4-81AC-11E6-A6DA-02E3F010038B/" rel="nofollow">IllumOS imports a modified FreeBSD boot loader to replace grub 0.97</a></h3>

<ul>
<li>Toomas Soome’s work to port the FreeBSD boot loader to IllumOS has been merged into illumos-gate, the upstream repository for all IllumOS distributions</li>
<li>Toomas’ work has also resulted in a number of commits to FreeBSD, and code sharing in both directions</li>
<li>Toomas helped me a lot with the building of the ZFS boot environment listing menu, even though on IllumOS they use a configuration file to list the BEs, rather than interrogating the live zpool like we do in FreeBSD</li>
<li>Toomas’ work to improve msdosfs and the block cache to speed up booting IllumOS also greatly helped FreeBSD</li>
<li>This work means IllumOS can now boot from a RAID-Z (the old grub they used could not), and if the work Toomas has done on FreeBSD is any indication, support for almost all other zpool features is also on the way</li>
<li>This work also sets IllumOS on a path to eventually having UEFI boot as well</li>
<li>It is good to see this work happening, FreeBSD technology being reused elsewhere, but also the improvements being made for IllumOS are coming back to FreeBSD, often landing upstream first, to make merging them into IllumOS easier.</li>
<li>The mailing list post describes how to convert existing systems away from grub, as well as how to opt to remain on grub for a while longer.</li>
<li>Grub 0.97 is expected to be removed from IllumOS within a year.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=8YQQfXqtyaA" rel="nofollow">A demo of booting CentOS and Windows 10 in FreeBSD Bhyve through VNC headless</a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2762" rel="nofollow">This year’s anemic output</a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2771" rel="nofollow">“PAM Mastery” ebook now out</a></li>
<li><a href="https://www.youtube.com/watch?v=oC5D9fenQBs" rel="nofollow">How-to Install OpenBSD 6.0 plus XFCE desktop and basic applications</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/yniniNpV" rel="nofollow"> Piotr - LibreBoot </a> </li>
<li><a href="http://pastebin.com/dCNX0yF7" rel="nofollow"> Alan - FreeBSD and PC-BSD</a> </li>
<li><a href="http://pastebin.com/LndNeAYb" rel="nofollow"> Eduardo - Newcomers</a> </li>
<li><a href="http://pastebin.com/F0y6L6NK" rel="nofollow"> Greg - ZFS ACL’s</a> </li>
<li><a href="http://pastebin.com/sqMPJGMM" rel="nofollow"> Brian - Laptop Recs</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we’re going to be hearing about Allan’s trip to EuroBSDCon, plus an Interview about “Bro on BSD”! Stay tuned, for your place to</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>EuroBSDCon 2016 Wrapup</h3>

<ul>
<li><a href="https://assets.keltia.net/photos/EuroBSDCon-2016/" rel="nofollow">Ollivier Robert’s Photos from EuroBSDCon </a> </li>
<li><a href="http://www.jupiterbroadcasting.com/stickers/" rel="nofollow">Get your BSDNow die-cut stickers</a> </li>
</ul>

<h3><a href="http://discusscomputerx.blogspot.com/2016/09/netbsd-for-noobies-your-power-laptop.html" rel="nofollow">NetBSD for newbies - Develop your own Power PC</a></h3>

<ul>
<li>We don’t get to feature too many stories on NetBSD being deployed as a Power PC (Not PowerPC, you know, a Powerful “PC”), so we jumped at this one.</li>
<li>Specifically it starts off with some of the pre-req’s that you’ll need to get started, such as NetBSD 7.0.1 / amd64, along with some information about which wireless nics you may be using. (NetBSD like other BSD’s will give a driver based device name for network interfaces)</li>
<li>From there, instructions on how to write your WPA_supplicant config are provided, in order for us to fetch the NetBSD sources and convert to their -STABLE branch.</li>
<li>After doing a CVS checkout of the sources, he then provides a walkthrough of doing a kernel compile / install, however it mentions changing the config, but doesn’t provide an example of what options were changed. Perhaps to remove drivers we don’t need?</li>
<li>At this point the rest of the “desktop” setup is pretty straight forward. Some packages are added such as openbox, lxappearance, firefox, etc.</li>
<li>To get working sound, firefox requires pulseaudio, which in turn needs dbus, so instructions on getting that service up and running are provided as well.</li>
<li>When it’s all said and done, you’ll end up with your shiny new NetBSD -STABLE desktop (or laptop), bragging rights achieved!
***</li>
</ul>

<h3><a href="https://www.poolp.org/tech/posts/2016/09/12/opensmtpd-6-0-0-released/" rel="nofollow">More about OpenSMTPD 6.0.0</a></h3>

<ul>
<li>OpenSMTPd 6.0.0 has just been released “and it&#39;s quite different from former releases.”</li>
<li>“Unlike most of our releases, it comes out with almost no new feature.”, “Turns out most of the changes are not visible.”</li>
<li>Changelog:

<ul>
<li>new fork+reexec model so each process has its own randomized memory space</li>
<li>logging format has been reworked</li>
<li>a &quot;multi-line response&quot; bug in the LMTP delivery backend has been fixed</li>
<li>connections concurrency limits have been bumped</li>
<li>artificial delaying in remote sessions have been reduced</li>
<li>dhparams option has been removed</li>
<li>dhe option has been added, supporting auto and legacy modes</li>
<li> smtp engine has been simplified</li>
<li>various cosmetic changes, code cleanup and documentation improvement</li>
</ul></li>
<li>“The OpenSMTPD bootstrap process was quite simple: Upon executation, the parent process would read configuration, build a memory representation of it and would then create a bunch of socketpair() before fork()-ing all of its child processes.”</li>
<li>The problem is that this does not take advantage of the new address randomization feature. Each child will have the same memory layout, copied from the parent process</li>
<li>“So deraadt@ suggested that if OpenSMTPD would not just fork() children but instead fork() them and reexecute the smtpd binary, then each of the children would have its own randomized memory space.”</li>
<li>“The idea itself is neat, however not so trivial to implement because when we reexec the whole &quot;inherit configuration and descriptors&quot; part goes away. It&#39;s not just fork and exec, it&#39;s fork and exec and figure a way for the parent to pass back all the information and descriptors back to the new post-fork instance so it is the new instance that allocates memory and decides where the information goes.”
***</li>
</ul>

<h3><a href="http://ftfl.ca/blog/2016-09-17-zfs-fde-one-pool-conversion.html" rel="nofollow">Upgrade a FreeBSD 10.3 Installation with ZFS on Root and Full Disk Encryption to 11.0</a></h3>

<ul>
<li>While FreeBSD 11.0 is not out yet, Joseph Mingrone has helped me work out and test the instructions for upgrading a FreeBSD 10.3 ZFS on full disk encryption setup (bootpool + zpool) to the new GELIBoot feature, which does not require any unencrypted partitions, just the 128kb bootcode</li>
<li>Note: Do not upgrade to FreeBSD 11.0 yet. While some images have landed on the FTP server, they do not contain the final openssl fix and are going to be recreated.</li>
<li>Currently, GELIBoot does not support key files, so the first step is to reencrypt the master key with only a passphrase.</li>
<li>Next, to avoid GELIBoot picking up encrypted partitions that it does not support, or partitions you do not want decrypted at boot, only partitions with the GELIBoot flag are decrypted, so set the flag on your root partition</li>
<li>Then, move the loader, kernel, and other files into /boot on the root filesystem, instead of them living on the bootpool. This allows the kernel to be versioned with boot environments, and is the main purpose of this work</li>
<li>Then, install the newer gptzfsboot, as this is required to support GELIBoot</li>
<li>The old 2gb bootpool partition is then purposely mislabeled as freebsd-vinum, so it is not picked up by the boot blocks. Later, if the upgrade is successful, this partition can be deleted, and used as addition swap or something</li>
<li>In order to boot correctly, you want all boot environments to have the ‘canmount’ ZFS property set to ‘noauto’</li>
<li>Thank you to Joseph for taking the time to prod me for the information required to write this up, and for testing it and finding all of the issues 
***</li>
</ul>

<h2>Interview - Michael Shirk - <a href="mailto:mshirk@daemon-security.com" rel="nofollow">mshirk@daemon-security.com</a> / <a href="https://twitter.com/shirkdog" rel="nofollow">@shirkdog</a></h2>

<ul>
<li>Running Bro on BSD
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://clonos.tekroutine.com/" rel="nofollow">FreeBSD based distro for virtual hosting platform and appliance</a></h3>

<ul>
<li>An interesting new FreeBSD-based project as shown up online, called “ClonOS”, which bills itself as a “free open-source FreeBSD-based platform for virtual environments creation and management”</li>
<li>It looks to be leveraging an impressive list of technologies, including Bhyve, Xen, Jails and CBSD / Puppet for management tasks.</li>
<li><p>Among its list of features:</p>

<ul>
<li>ZFS features support;</li>
<li>VM cloning, export, import</li>
<li>Ethernet SoftSwitch for separated networking</li>
<li>jails for lightweight container</li>
<li>VNC terminal for VM/containers</li>
<li>Templates for VM/containers</li>
<li>Configuration management/helpers</li>
<li>Multi-node operation</li>
</ul></li>
<li><p>Multi-Node? Color me intrigued! </p></li>
<li><p>Right now it appears to be under heavy development, but we’ll reach out to the developer to see if we can get an interview lined up at some point!</p>

<hr></li>
</ul>

<h3><a href="https://bsdmag.org/oleksandr_rybalko/" rel="nofollow">The Raspberry PI Platform and The Challenges of Developing FreeBSD</a></h3>

<ul>
<li>BSDMag recently did an interview with FreeBSD developer Olesandr Rybalko!</li>
<li>Oleksandr lives in the Ukraine, and while you may not have heard of him, he has worked on some cool projects for FreeBSD including the new “vt” console driver (Which a lot of people are using now), and ARM/MIPS support.</li>
<li>The interview covers some of the work he’s done to get the PI support working with FreeBSD:</li>
</ul>

<blockquote>
<p>I think, my main help here was a USB OTG driver, which I wrote before for another device (Ralink RT3052), then port it to R-Pi. But it was rewritten by Hans Peter Selasky. I do not know so much about USB as Hans knows.</p>

<p>Another useful part of my help is Xorg support. I did a simple Xorg video driver which uses framebuffer exported by virtual terminal subsystem. That is help to many guys to start use RPi as a simple desktop system.</p>
</blockquote>

<ul>
<li>He was also asked the question “Why would FreeBSD be good fit for ARM?”</li>
</ul>

<blockquote>
<p>FreeBSD is very powerful as a network server. All modern network features in one box, with very fast processing.</p>

<p>Another good side of FreeBSD is modularity. It is not required to write code to use some driver that was already written for another system, you can just define it in configuration files (kernel config, kernel hints, FDT). So if you want build a nice, R-Pi based, home server – use FreeBSD. If you want to play with devices attached to R-Pi’s GPIO – use FreeBSD.</p>
</blockquote>

<ul>
<li>He also discusses his work on the ZRouter project, which is a very light-weight platform for tiny routers / embedded devices. But lastly the RPI comes up again, specifically asking him how interested individuals can get involved. Specifically the wiki.freebsd.org is a great reference point for those intested in getting started with FreeBSD on embedded. The warm community is also a plus!</li>
</ul>

<hr>

<h3><a href="http://www.phoronix.com/scan.php?page=news_item&px=TrueOS-First-Spin" rel="nofollow">Trying out the FreeBSD powered TrueOS</a></h3>

<ul>
<li>The folks over at Phoronix have done an early look at the new TrueOS desktop images and given some of their thoughts. </li>
<li>First up he gives props to the installer, noting that:</li>
</ul>

<blockquote>
<p>The TrueOS desktop installer is basically the same as from the PC-BSD days, just re-branded. Still one of the easiest BSD graphical installers I&#39;ve dealt with and makes it a breeze for setting up a FreeBSD-on-ZFS system by default. </p>
</blockquote>

<ul>
<li>After that they took it for a minimal spin, and thing mostly seem to be working. He mentions some of the default apps (Such as qupzilla and trojita) aren’t their favorite, but Lumina has come quite a ways for 1.0, despite a few rough edges still. (We are in the process of changing those default e-mail / browser apps)</li>
<li>Lastly the article mentions that it’s time to do a more full BSD round-up to see the state of installation of them, which we happen to have next!</li>
</ul>

<h3><a href="http://www.phoronix.com/scan.php?page=article&item=trying-8-bsds&num=1" rel="nofollow">Trying out 8 BSDs on a modern PC</a></h3>

<ul>
<li>First up was TrueOS again, which no major changes there, easy install and done.</li>
<li>From there he tries out DragonFlyBSD, which he mentions that while the installer isn’t as easy, it is still one of his favorite BSD’s, working with all the hardware they’ve thrown at it.</li>
<li>Next up was GhostBSD, which also has an Easy-To-Use graphical installer similar to TrueOS that made it quick to get loaded and up to the Mate desktop.</li>
<li>Also tested was FreeBSD 11.0-RC2, which he mentions was easy to installed, and once done then ‘pkg’ could be used to easily get the setup he wanted setup.</li>
<li>Turning over to page two we get to the naughty list of BSD’s he had troubles with.</li>
<li>First up was OpenBSD which he tried 6.0. After installation and first boot, the display kept ‘disappearing’ which meant he couldn’t get IP information to try SSH’ing into the box. Perhaps a display driver error?</li>
<li>NetBSD 7 was up next, where the installer couldn’t get past a root device prompt. Most likely trouble finding the install media, which was the same story with MightnightBSD as well.</li>
<li>Also tested was “PacBSD” (Formerly ArchBSD) which he did manage to get installed, but not after major fighting with the process. After the process he ran into some issues getting packages up and running, but mentions it may have been bad timing due to them moving to a new server at the time.
***</li>
</ul>

<h3><a href="https://www.listbox.com/member/archive/182181/2016/09/sort/time_rev/page/1/entry/0:1/20160923124232:B7978ED4-81AC-11E6-A6DA-02E3F010038B/" rel="nofollow">IllumOS imports a modified FreeBSD boot loader to replace grub 0.97</a></h3>

<ul>
<li>Toomas Soome’s work to port the FreeBSD boot loader to IllumOS has been merged into illumos-gate, the upstream repository for all IllumOS distributions</li>
<li>Toomas’ work has also resulted in a number of commits to FreeBSD, and code sharing in both directions</li>
<li>Toomas helped me a lot with the building of the ZFS boot environment listing menu, even though on IllumOS they use a configuration file to list the BEs, rather than interrogating the live zpool like we do in FreeBSD</li>
<li>Toomas’ work to improve msdosfs and the block cache to speed up booting IllumOS also greatly helped FreeBSD</li>
<li>This work means IllumOS can now boot from a RAID-Z (the old grub they used could not), and if the work Toomas has done on FreeBSD is any indication, support for almost all other zpool features is also on the way</li>
<li>This work also sets IllumOS on a path to eventually having UEFI boot as well</li>
<li>It is good to see this work happening, FreeBSD technology being reused elsewhere, but also the improvements being made for IllumOS are coming back to FreeBSD, often landing upstream first, to make merging them into IllumOS easier.</li>
<li>The mailing list post describes how to convert existing systems away from grub, as well as how to opt to remain on grub for a while longer.</li>
<li>Grub 0.97 is expected to be removed from IllumOS within a year.
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.youtube.com/watch?v=8YQQfXqtyaA" rel="nofollow">A demo of booting CentOS and Windows 10 in FreeBSD Bhyve through VNC headless</a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2762" rel="nofollow">This year’s anemic output</a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2771" rel="nofollow">“PAM Mastery” ebook now out</a></li>
<li><a href="https://www.youtube.com/watch?v=oC5D9fenQBs" rel="nofollow">How-to Install OpenBSD 6.0 plus XFCE desktop and basic applications</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/yniniNpV" rel="nofollow"> Piotr - LibreBoot </a> </li>
<li><a href="http://pastebin.com/dCNX0yF7" rel="nofollow"> Alan - FreeBSD and PC-BSD</a> </li>
<li><a href="http://pastebin.com/LndNeAYb" rel="nofollow"> Eduardo - Newcomers</a> </li>
<li><a href="http://pastebin.com/F0y6L6NK" rel="nofollow"> Greg - ZFS ACL’s</a> </li>
<li><a href="http://pastebin.com/sqMPJGMM" rel="nofollow"> Brian - Laptop Recs</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>160: EuroBSD-Dreamin</title>
  <link>https://www.bsdnow.tv/160</link>
  <guid isPermaLink="false">37c0aa7b-2dd0-4ec8-b6d5-7f21831c73a6</guid>
  <pubDate>Wed, 21 Sep 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/37c0aa7b-2dd0-4ec8-b6d5-7f21831c73a6.mp3" length="35557780" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, Allan is currently at EuroBSDCon! However due to the magic of video (or time travel), you still get a new episode. (You’re Welcome!). Stay tuned</itunes:subtitle>
  <itunes:duration>49:23</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, Allan is currently at EuroBSDCon! However due to the magic of video (or time travel), you still get a new episode. (You’re Welcome!). Stay tuned
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Performance Improvements for FreeBSD Kernel Debugging (http://backtrace.io/blog/blog/2016/08/25/improving-freebsd-kernel-debugging/)
“We previously explored FreeBSD userspace coredumps (http://backtrace.io/blog/blog/2015/10/03/whats-a-coredump). Backtrace’s debugging platform supports FreeBSD kernel coredumps too, and their traces share many features. They are constructed somewhat differently, and in the process of adding support for them, we found a way to improve performance for automated programs accessing them.”
“A kernel core is typically only generated in exceptional circumstances. Unlike userspace processes, kernel routines cannot fault without sacrificing the machine’s availability. This means things like page faults and illegal instructions inside the kernel stop the machine, instead of just one process. At that point, in most cases, it is only usable enough to inspect its state in a debugger, or to generate a core file.”
No one likes it when this happens. This is why backtrace.io is focused on being able to figure out why it is happening
“A FreeBSD kernel core file can be formatted in several different ways. This depends on which type of dump was performed. Full core dumps are ELF files, similar in structure to userspace core files. However, as RAM size grew, this became more difficult to manage. In 2006, FreeBSD introduced minidumps, which are much smaller without making the core file useless. This has been the default dump type since FreeBSD 6.0.”
The article goes into detail on the minidump format, and some basic debugging techniques
“Libkvm will first determine whether the virtual address lies within the kernel or direct maps. If it lies in the kernel map, libkvm will consult the page table pages to discover the corresponding physical address. If it lies in the direct map, it can simply mask off the direct map base address. If neither of these applies, the address is illegal. This process is encapsulated by vatopa, or “virtual address to physical address”. Once the physical address is determined, libkvm consults the core file’s bitmap to figure out where in the core file it is located.”
“minidumps include a sparse bitmap indicating the pages that are included. These pages are dumped sequentially in the last section. Because they are sparse in a not entirely predictable way, figuring the offset into the dump for a particular physical address cannot be reduced to a trivial formula.”
The article goes into detail about how lookups against this map are slow, and how they were improved
“For typical manual debugger use, the impact of this change isn’t noticeable, which is probably why the hash table implementation has been in use for 10 years. However, for any automated debugging process, the extra latency adds up quickly.”
“On a sample 8GB kernel core file (generated on a 128GB server), crashinfo improves from 44 seconds to 9 seconds, and uses 30% less memory”
“Backtrace began shipping a version of this performance improvement in ptrace in February 2016. This enables us to also offer significantly faster tracing of FreeBSD kernel cores to customers running current and older releases of FreeBSD. On July 17, 2016, our work improving libkvm scaling was committed to FreeBSD/head. It will ship with FreeBSD 12.0.”
***
OpenBSD gunzip pipeline tightening (https://www.mail-archive.com/tech@openbsd.org/msg34035.html)
OpenBSD has rethought the way they handle package signing
Changing from: 1/ fetch data -&amp;gt; 2/ uncompress it -&amp;gt; 3/ check signature -&amp;gt; 4/ process data
To: 1/ fetch data -&amp;gt; 2/ check signature -&amp;gt; 3/ uncompress -&amp;gt; 4/ process data
“The solution is to move the signature outside of the gzip header”
“Now, Since step 1/ is privsep, as long as step 2 is airtight, 3/ and 4/are no longer vulnerable”
Guidelines:
small, self-contained code to parse simple gzip headers
signify-style  signature in the gzip comment. Contains checksums of 64K blocks of the compressed archive
don't even think about passing the original gzip header through
use as a pipeline step: does not need to download full archive to use it, and never ever pass any data to the gunzip part before it's been verified.
“Note that afaik we haven't had any hole in our gunzipping process. Well… waiting for an accident to happen is not how we do things.  Hopefully, this should prevent future mishaps.”
***
OpenVPN On FreeBSD 10.3 (http://ramsdenj.com/2016/07/25/openvpn-on-freebsd-10_3.html)
“While trying to setup OpenVPN, I noticed there was no up-to-date information with correct instructions. OpenVPN uses EasyRSA to setup keys, it has recently been changed in version 3. As a result of this, the old steps to configure OpenVPN are no longer correct. I went through the process of setting up a VPN using OpenVPN on FreeBSD 10.3.”
I know FreeBSD developer Adrian Chadd complained about this exact problem when he was trying to setup a VPN before attending DEFCON
The tutorial walks through the basic steps:
Install the needed software
Configure EasyRSA
Create a CA
Generate keys and DH params
OpenVPN Server Config
OpenVPN Client Config
Starting the daemon
It even finishes off with bonus instructions on Port Forwarding, Firewalls, and Dynamic DNS
***
lsop (https://github.com/606u/lsop)
LSOP is the tool a bunch of users have been asking for
“a FreeBSD utility to list all processes running with outdated binaries or shared libraries”
How does it work? “lsop iterates over all running processes and looks through memory-mapped files with read + execute access; then it checks if those files are still available or have been modified/deleted.”
How would you use it? After installing an system update (that doesn’t require a reboot to update the kernel), or upgrade your packages, you still need to know which daemons need to be restarted to use the patched libraries and binaries
This tool gives you that list
Thanks to Bogdan Boyadzhiev for writing this much needed tool
***
News Roundup
OpenBSD 2016 Fundraising Campaign (http://www.openbsdfoundation.org/campaign2016.html)
The OpenBSD fund-raising campaign has given us a status update on the state of 2016.
They start by giving us a re-cap of previous years:
“2015 was a good year for the foundation financially, with one platinum, one gold, four silver and 3 bronze donors providing half of our total donations. 680 individuals making smaller contributions provided the other half. While the total was down significantly after 2014’s blockbuster year, we again exceeded our goal.”
As of Sept 5th, they were at approx $115k out of a total goal of 250k. 
If you are an OpenBSD user, remember to contribute before the end of the year. Small amounts help, and the money of course goes to great causes such as hackathons and running the OpenBSD infrastructure.
Update firewall Bad Countries (https://github.com/KaiLoi/update-fw-BC)
Network and Systems admins know, sometimes when all else fails you need to break out the HUGE ban-hammer. In this case sometimes entire countries get put on the excrement list until the attacks stop.
We have a handy GitHub project today, which will assist you in doing exactly that, enter update-fw-BC. (Update firewall by country)
This perl script may be your savior when dealing with instances that require major brute force. It specifically works with IPFW, PF and IPTABLES, which will allow it to run across a variety of BSD’s or even Linux.
It will ingest a list of IP’s that you feed it (perhaps from another tool such as sshguard) and determine what block the IP belongs to, and match according to country. 
Detailed setup instructions for the various firewalls are included, and some instructions for FreeBSD, although using it on OpenBSD or other $BSD should also be easy to adapt.
***
More utilities via moreutils (https://distrowatch.com/weekly.php?issue=20160822#tips)
In most BSDs, the “core” set of utilities and commands are just part of the base system, but on Linux, they are usually provided by the “coreutils” package.
However, on Linux and now FreeBSD, there is a “moreutils” package, that provides a number of interesting additional basic utilities, including:
chronic: Run a task via crontab, and only generate output if the task fails
combine: binary AND two text files together, only displaying lines that are in both files
errno: look up the text description of a specific error number
ifdata: parse out specific information from ifconfig
ifne: if-not-empty, only run a command if the output of the pipe is not blank
isutf8: determine if a file or stdin contains utf8
lckdo: execute a command with a lock held, to prevent a second copy from spawning
mispipe: return the exit code of the first command in a pipe chain, rather than the last
parallel: run multiple jobs at once
pee: tee standard input to multiple pipes
sponge: write standard input to a file, allows you to overwrite a file in place: sort file | sponge file
ts: add a timestamp to each line of standard input
vidir: edit a directory in vi, great for bulk renames
vipe: insert vi into a pipe, edit the content before it is passed to the next command
zrun: uncompress the arguments before passing them. Like gzless and friends, but for any command
Just goes to show the power of the original UNIX philosophy, chaining together a bunch of small useful tools to do really powerful things
***
OpenBSD: SNI support added to libtls, httpd in –current (http://undeadly.org/cgi?action=article&amp;amp;sid=20160823100144)
libtls, LibreSSL’s improved API to replace the OpenSSL standard, now has a set of functions to implement SNI (Server Name Indication) 
Until a few years ago, each different SSL/TLS enabled website required a unique IP address, because typical HTTP Virtual Hosting (differentiating which content to serve based on the Host header in the HTTP request), didn’t work because the request was encrypted.
Finally the TLS standard was updated to include the hostname of the site the user is requesting in the TLS handshake, so the server can return the corresponding certificate, and multiple TLS enabled websites can be hosted on a single IP address
The new API includes the ability to provide additional keypairs (via tlsconfigaddkeypair{file,mem}())
And allow the server to determine what servername the client requested viatlsconnservername()
This is much easier to use, and therefore safer and less error prone, than the OpenSSL API
The libtls API is used in a number of OpenBSD tools, including the httpd
***
Beastie Bits
Shawn Webb of HardenedBSD joins the OPNSense Core Team (https://opnsense.org/new-core-team-member/) 
How to install 2.11 BSD on a (simulated) PDP11 (http://vak.ru/doku.php/proj/pdp11/211bsd)
OpenBSD Puffy needlepoint pixelart (https://nemessica.tintagel.pl/blog/OpenBSD-Puffy/)  
PulseAudio has been removed from dports (DragonFly BSD) (http://lists.dragonflybsd.org/pipermail/users/2016-August/313010.html) 
pfSense 2.4 pre-alpha available for testing, based on FreeBSD 11.0  (https://blog.pfsense.org/?p=2118)
Call for Testing - Bhyve HDA Sound Emulation  (https://lists.freebsd.org/pipermail/freebsd-virtualization/2016-September/004700.html) 
***
Feedback/Questions
 Matthew - ZFS Hole Birth (http://pastebin.com/CrZiDAF0) 
 Hunter - systemd-mount  (http://pastebin.com/GztjY4wz) 
 Anonymous - Cool’n’quiet (http://pastebin.com/gG4j4RCi) 
 Nathan - Datacenter  (http://pastebin.com/9XgPzMM9) 
 Chuck - OpenBSD w/DO (http://pastebin.com/FM2xYcxh) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, Allan is currently at EuroBSDCon! However due to the magic of video (or time travel), you still get a new episode. (You’re Welcome!). Stay tuned</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://backtrace.io/blog/blog/2016/08/25/improving-freebsd-kernel-debugging/" rel="nofollow">Performance Improvements for FreeBSD Kernel Debugging</a></h3>

<ul>
<li>“We previously <a href="http://backtrace.io/blog/blog/2015/10/03/whats-a-coredump" rel="nofollow">explored FreeBSD userspace coredumps</a>. Backtrace’s debugging platform supports FreeBSD kernel coredumps too, and their traces share many features. They are constructed somewhat differently, and in the process of adding support for them, we found a way to improve performance for automated programs accessing them.”</li>
<li>“A kernel core is typically only generated in exceptional circumstances. Unlike userspace processes, kernel routines cannot fault without sacrificing the machine’s availability. This means things like page faults and illegal instructions inside the kernel stop the machine, instead of just one process. At that point, in most cases, it is only usable enough to inspect its state in a debugger, or to generate a core file.”</li>
<li>No one likes it when this happens. This is why backtrace.io is focused on being able to figure out why it is happening</li>
<li>“A FreeBSD kernel core file can be formatted in several different ways. This depends on which type of dump was performed. Full core dumps are ELF files, similar in structure to userspace core files. However, as RAM size grew, this became more difficult to manage. In 2006, FreeBSD introduced minidumps, which are much smaller without making the core file useless. This has been the default dump type since FreeBSD 6.0.”</li>
<li>The article goes into detail on the minidump format, and some basic debugging techniques</li>
<li>“Libkvm will first determine whether the virtual address lies within the kernel or direct maps. If it lies in the kernel map, libkvm will consult the page table pages to discover the corresponding physical address. If it lies in the direct map, it can simply mask off the direct map base address. If neither of these applies, the address is illegal. This process is encapsulated by va_to_pa, or “virtual address to physical address”. Once the physical address is determined, libkvm consults the core file’s bitmap to figure out where in the core file it is located.”</li>
<li>“minidumps include a sparse bitmap indicating the pages that are included. These pages are dumped sequentially in the last section. Because they are sparse in a not entirely predictable way, figuring the offset into the dump for a particular physical address cannot be reduced to a trivial formula.”</li>
<li>The article goes into detail about how lookups against this map are slow, and how they were improved</li>
<li>“For typical manual debugger use, the impact of this change isn’t noticeable, which is probably why the hash table implementation has been in use for 10 years. However, for any automated debugging process, the extra latency adds up quickly.”</li>
<li>“On a sample 8GB kernel core file (generated on a 128GB server), crashinfo improves from 44 seconds to 9 seconds, and uses 30% less memory”</li>
<li>“Backtrace began shipping a version of this performance improvement in ptrace in February 2016. This enables us to also offer significantly faster tracing of FreeBSD kernel cores to customers running current and older releases of FreeBSD. On July 17, 2016, our work improving libkvm scaling was committed to FreeBSD/head. It will ship with FreeBSD 12.0.”
***</li>
</ul>

<h3><a href="https://www.mail-archive.com/tech@openbsd.org/msg34035.html" rel="nofollow">OpenBSD gunzip pipeline tightening</a></h3>

<ul>
<li>OpenBSD has rethought the way they handle package signing</li>
<li>Changing from: 1/ fetch data -&gt; 2/ uncompress it -&gt; 3/ check signature -&gt; 4/ process data</li>
<li>To: 1/ fetch data -&gt; 2/ check signature -&gt; 3/ uncompress -&gt; 4/ process data</li>
<li>“The solution is to move the signature outside of the gzip header”</li>
<li>“Now, Since step 1/ is privsep, as long as step 2 is airtight, 3/ and 4/are no longer vulnerable”</li>
<li>Guidelines:

<ul>
<li>small, self-contained code to parse simple gzip headers</li>
<li>signify-style  signature in the gzip comment. Contains checksums of 64K blocks of the compressed archive</li>
<li>don&#39;t even think about passing the original gzip header through</li>
<li>use as a pipeline step: does not need to download full archive to use it, and never ever pass any data to the gunzip part before it&#39;s been verified.</li>
</ul></li>
<li>“Note that afaik we haven&#39;t had any hole in our gunzipping process. Well… waiting for an accident to happen is not how we do things.  Hopefully, this should prevent future mishaps.”
***</li>
</ul>

<h3><a href="http://ramsdenj.com/2016/07/25/openvpn-on-freebsd-10_3.html" rel="nofollow">OpenVPN On FreeBSD 10.3</a></h3>

<ul>
<li>“While trying to setup OpenVPN, I noticed there was no up-to-date information with correct instructions. OpenVPN uses EasyRSA to setup keys, it has recently been changed in version 3. As a result of this, the old steps to configure OpenVPN are no longer correct. I went through the process of setting up a VPN using OpenVPN on FreeBSD 10.3.”</li>
<li>I know FreeBSD developer Adrian Chadd complained about this exact problem when he was trying to setup a VPN before attending DEFCON</li>
<li>The tutorial walks through the basic steps:

<ul>
<li>Install the needed software</li>
<li>Configure EasyRSA</li>
<li>Create a CA</li>
<li>Generate keys and DH params</li>
<li>OpenVPN Server Config</li>
<li>OpenVPN Client Config</li>
<li>Starting the daemon</li>
</ul></li>
<li>It even finishes off with bonus instructions on Port Forwarding, Firewalls, and Dynamic DNS
***</li>
</ul>

<h3><a href="https://github.com/606u/lsop" rel="nofollow">lsop</a></h3>

<ul>
<li>LSOP is the tool a bunch of users have been asking for</li>
<li>“a FreeBSD utility to list all processes running with outdated binaries or shared libraries”</li>
<li>How does it work? “lsop iterates over all running processes and looks through memory-mapped files with read + execute access; then it checks if those files are still available or have been modified/deleted.”</li>
<li>How would you use it? After installing an system update (that doesn’t require a reboot to update the kernel), or upgrade your packages, you still need to know which daemons need to be restarted to use the patched libraries and binaries</li>
<li>This tool gives you that list</li>
<li>Thanks to Bogdan Boyadzhiev for writing this much needed tool
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.openbsdfoundation.org/campaign2016.html" rel="nofollow">OpenBSD 2016 Fundraising Campaign</a></h3>

<ul>
<li>The OpenBSD fund-raising campaign has given us a status update on the state of 2016.</li>
<li><p>They start by giving us a re-cap of previous years:<br>
“2015 was a good year for the foundation financially, with one platinum, one gold, four silver and 3 bronze donors providing half of our total donations. 680 individuals making smaller contributions provided the other half. While the total was down significantly after 2014’s blockbuster year, we again exceeded our goal.”</p></li>
<li><p>As of Sept 5th, they were at approx $115k out of a total goal of 250k. </p></li>
<li><p>If you are an OpenBSD user, remember to contribute before the end of the year. Small amounts help, and the money of course goes to great causes such as hackathons and running the OpenBSD infrastructure.</p>

<hr></li>
</ul>

<h3><a href="https://github.com/KaiLoi/update-fw-BC" rel="nofollow">Update firewall Bad Countries</a></h3>

<ul>
<li>Network and Systems admins know, sometimes when all else fails you need to break out the HUGE ban-hammer. In this case sometimes entire countries get put on the excrement list until the attacks stop.</li>
<li>We have a handy GitHub project today, which will assist you in doing exactly that, enter update-fw-BC. (Update firewall by country)</li>
<li>This perl script may be your savior when dealing with instances that require major brute force. It specifically works with IPFW, PF and IPTABLES, which will allow it to run across a variety of BSD’s or even Linux.</li>
<li>It will ingest a list of IP’s that you feed it (perhaps from another tool such as sshguard) and determine what block the IP belongs to, and match according to country. </li>
<li>Detailed setup instructions for the various firewalls are included, and some instructions for FreeBSD, although using it on OpenBSD or other $BSD should also be easy to adapt.
***</li>
</ul>

<h3><a href="https://distrowatch.com/weekly.php?issue=20160822#tips" rel="nofollow">More utilities via moreutils</a></h3>

<ul>
<li>In most BSDs, the “core” set of utilities and commands are just part of the base system, but on Linux, they are usually provided by the “coreutils” package.</li>
<li>However, on Linux and now FreeBSD, there is a “moreutils” package, that provides a number of interesting additional basic utilities, including:

<ul>
<li>chronic: Run a task via crontab, and only generate output if the task fails</li>
<li>combine: binary AND two text files together, only displaying lines that are in both files</li>
<li>errno: look up the text description of a specific error number</li>
<li>ifdata: parse out specific information from ifconfig</li>
<li>ifne: if-not-empty, only run a command if the output of the pipe is not blank</li>
<li>isutf8: determine if a file or stdin contains utf8</li>
<li>lckdo: execute a command with a lock held, to prevent a second copy from spawning</li>
<li>mispipe: return the exit code of the first command in a pipe chain, rather than the last</li>
<li>parallel: run multiple jobs at once</li>
<li>pee: tee standard input to multiple pipes</li>
<li>sponge: write standard input to a file, allows you to overwrite a file in place: sort file | sponge file</li>
<li>ts: add a timestamp to each line of standard input</li>
<li>vidir: edit a directory in vi, great for bulk renames</li>
<li>vipe: insert vi into a pipe, edit the content before it is passed to the next command</li>
<li>zrun: uncompress the arguments before passing them. Like gzless and friends, but for any command</li>
</ul></li>
<li>Just goes to show the power of the original UNIX philosophy, chaining together a bunch of small useful tools to do really powerful things
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160823100144" rel="nofollow">OpenBSD: SNI support added to libtls, httpd in –current</a></h3>

<ul>
<li>libtls, LibreSSL’s improved API to replace the OpenSSL standard, now has a set of functions to implement SNI (Server Name Indication) </li>
<li>Until a few years ago, each different SSL/TLS enabled website required a unique IP address, because typical HTTP Virtual Hosting (differentiating which content to serve based on the Host header in the HTTP request), didn’t work because the request was encrypted.</li>
<li>Finally the TLS standard was updated to include the hostname of the site the user is requesting in the TLS handshake, so the server can return the corresponding certificate, and multiple TLS enabled websites can be hosted on a single IP address</li>
<li>The new API includes the ability to provide additional keypairs (via tls_config_add_keypair_{file,mem}())</li>
<li>And allow the server to determine what servername the client requested viatls_conn_servername()</li>
<li>This is much easier to use, and therefore safer and less error prone, than the OpenSSL API</li>
<li>The libtls API is used in a number of OpenBSD tools, including the httpd
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://opnsense.org/new-core-team-member/" rel="nofollow">Shawn Webb of HardenedBSD joins the OPNSense Core Team</a> </li>
<li><a href="http://vak.ru/doku.php/proj/pdp11/211bsd" rel="nofollow">How to install 2.11 BSD on a (simulated) PDP11</a></li>
<li><a href="https://nemessica.tintagel.pl/blog/OpenBSD-Puffy/" rel="nofollow">OpenBSD Puffy needlepoint pixelart</a><br></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2016-August/313010.html" rel="nofollow">PulseAudio has been removed from dports (DragonFly BSD)</a> </li>
<li><a href="https://blog.pfsense.org/?p=2118" rel="nofollow">pfSense 2.4 pre-alpha available for testing, based on FreeBSD 11.0 </a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2016-September/004700.html" rel="nofollow">Call for Testing - Bhyve HDA Sound Emulation </a> 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/CrZiDAF0" rel="nofollow"> Matthew - ZFS Hole Birth</a> </li>
<li><a href="http://pastebin.com/GztjY4wz" rel="nofollow"> Hunter - systemd-mount </a> </li>
<li><a href="http://pastebin.com/gG4j4RCi" rel="nofollow"> Anonymous - Cool’n’quiet</a> </li>
<li><a href="http://pastebin.com/9XgPzMM9" rel="nofollow"> Nathan - Datacenter </a> </li>
<li><a href="http://pastebin.com/FM2xYcxh" rel="nofollow"> Chuck - OpenBSD w/DO</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, Allan is currently at EuroBSDCon! However due to the magic of video (or time travel), you still get a new episode. (You’re Welcome!). Stay tuned</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://backtrace.io/blog/blog/2016/08/25/improving-freebsd-kernel-debugging/" rel="nofollow">Performance Improvements for FreeBSD Kernel Debugging</a></h3>

<ul>
<li>“We previously <a href="http://backtrace.io/blog/blog/2015/10/03/whats-a-coredump" rel="nofollow">explored FreeBSD userspace coredumps</a>. Backtrace’s debugging platform supports FreeBSD kernel coredumps too, and their traces share many features. They are constructed somewhat differently, and in the process of adding support for them, we found a way to improve performance for automated programs accessing them.”</li>
<li>“A kernel core is typically only generated in exceptional circumstances. Unlike userspace processes, kernel routines cannot fault without sacrificing the machine’s availability. This means things like page faults and illegal instructions inside the kernel stop the machine, instead of just one process. At that point, in most cases, it is only usable enough to inspect its state in a debugger, or to generate a core file.”</li>
<li>No one likes it when this happens. This is why backtrace.io is focused on being able to figure out why it is happening</li>
<li>“A FreeBSD kernel core file can be formatted in several different ways. This depends on which type of dump was performed. Full core dumps are ELF files, similar in structure to userspace core files. However, as RAM size grew, this became more difficult to manage. In 2006, FreeBSD introduced minidumps, which are much smaller without making the core file useless. This has been the default dump type since FreeBSD 6.0.”</li>
<li>The article goes into detail on the minidump format, and some basic debugging techniques</li>
<li>“Libkvm will first determine whether the virtual address lies within the kernel or direct maps. If it lies in the kernel map, libkvm will consult the page table pages to discover the corresponding physical address. If it lies in the direct map, it can simply mask off the direct map base address. If neither of these applies, the address is illegal. This process is encapsulated by va_to_pa, or “virtual address to physical address”. Once the physical address is determined, libkvm consults the core file’s bitmap to figure out where in the core file it is located.”</li>
<li>“minidumps include a sparse bitmap indicating the pages that are included. These pages are dumped sequentially in the last section. Because they are sparse in a not entirely predictable way, figuring the offset into the dump for a particular physical address cannot be reduced to a trivial formula.”</li>
<li>The article goes into detail about how lookups against this map are slow, and how they were improved</li>
<li>“For typical manual debugger use, the impact of this change isn’t noticeable, which is probably why the hash table implementation has been in use for 10 years. However, for any automated debugging process, the extra latency adds up quickly.”</li>
<li>“On a sample 8GB kernel core file (generated on a 128GB server), crashinfo improves from 44 seconds to 9 seconds, and uses 30% less memory”</li>
<li>“Backtrace began shipping a version of this performance improvement in ptrace in February 2016. This enables us to also offer significantly faster tracing of FreeBSD kernel cores to customers running current and older releases of FreeBSD. On July 17, 2016, our work improving libkvm scaling was committed to FreeBSD/head. It will ship with FreeBSD 12.0.”
***</li>
</ul>

<h3><a href="https://www.mail-archive.com/tech@openbsd.org/msg34035.html" rel="nofollow">OpenBSD gunzip pipeline tightening</a></h3>

<ul>
<li>OpenBSD has rethought the way they handle package signing</li>
<li>Changing from: 1/ fetch data -&gt; 2/ uncompress it -&gt; 3/ check signature -&gt; 4/ process data</li>
<li>To: 1/ fetch data -&gt; 2/ check signature -&gt; 3/ uncompress -&gt; 4/ process data</li>
<li>“The solution is to move the signature outside of the gzip header”</li>
<li>“Now, Since step 1/ is privsep, as long as step 2 is airtight, 3/ and 4/are no longer vulnerable”</li>
<li>Guidelines:

<ul>
<li>small, self-contained code to parse simple gzip headers</li>
<li>signify-style  signature in the gzip comment. Contains checksums of 64K blocks of the compressed archive</li>
<li>don&#39;t even think about passing the original gzip header through</li>
<li>use as a pipeline step: does not need to download full archive to use it, and never ever pass any data to the gunzip part before it&#39;s been verified.</li>
</ul></li>
<li>“Note that afaik we haven&#39;t had any hole in our gunzipping process. Well… waiting for an accident to happen is not how we do things.  Hopefully, this should prevent future mishaps.”
***</li>
</ul>

<h3><a href="http://ramsdenj.com/2016/07/25/openvpn-on-freebsd-10_3.html" rel="nofollow">OpenVPN On FreeBSD 10.3</a></h3>

<ul>
<li>“While trying to setup OpenVPN, I noticed there was no up-to-date information with correct instructions. OpenVPN uses EasyRSA to setup keys, it has recently been changed in version 3. As a result of this, the old steps to configure OpenVPN are no longer correct. I went through the process of setting up a VPN using OpenVPN on FreeBSD 10.3.”</li>
<li>I know FreeBSD developer Adrian Chadd complained about this exact problem when he was trying to setup a VPN before attending DEFCON</li>
<li>The tutorial walks through the basic steps:

<ul>
<li>Install the needed software</li>
<li>Configure EasyRSA</li>
<li>Create a CA</li>
<li>Generate keys and DH params</li>
<li>OpenVPN Server Config</li>
<li>OpenVPN Client Config</li>
<li>Starting the daemon</li>
</ul></li>
<li>It even finishes off with bonus instructions on Port Forwarding, Firewalls, and Dynamic DNS
***</li>
</ul>

<h3><a href="https://github.com/606u/lsop" rel="nofollow">lsop</a></h3>

<ul>
<li>LSOP is the tool a bunch of users have been asking for</li>
<li>“a FreeBSD utility to list all processes running with outdated binaries or shared libraries”</li>
<li>How does it work? “lsop iterates over all running processes and looks through memory-mapped files with read + execute access; then it checks if those files are still available or have been modified/deleted.”</li>
<li>How would you use it? After installing an system update (that doesn’t require a reboot to update the kernel), or upgrade your packages, you still need to know which daemons need to be restarted to use the patched libraries and binaries</li>
<li>This tool gives you that list</li>
<li>Thanks to Bogdan Boyadzhiev for writing this much needed tool
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.openbsdfoundation.org/campaign2016.html" rel="nofollow">OpenBSD 2016 Fundraising Campaign</a></h3>

<ul>
<li>The OpenBSD fund-raising campaign has given us a status update on the state of 2016.</li>
<li><p>They start by giving us a re-cap of previous years:<br>
“2015 was a good year for the foundation financially, with one platinum, one gold, four silver and 3 bronze donors providing half of our total donations. 680 individuals making smaller contributions provided the other half. While the total was down significantly after 2014’s blockbuster year, we again exceeded our goal.”</p></li>
<li><p>As of Sept 5th, they were at approx $115k out of a total goal of 250k. </p></li>
<li><p>If you are an OpenBSD user, remember to contribute before the end of the year. Small amounts help, and the money of course goes to great causes such as hackathons and running the OpenBSD infrastructure.</p>

<hr></li>
</ul>

<h3><a href="https://github.com/KaiLoi/update-fw-BC" rel="nofollow">Update firewall Bad Countries</a></h3>

<ul>
<li>Network and Systems admins know, sometimes when all else fails you need to break out the HUGE ban-hammer. In this case sometimes entire countries get put on the excrement list until the attacks stop.</li>
<li>We have a handy GitHub project today, which will assist you in doing exactly that, enter update-fw-BC. (Update firewall by country)</li>
<li>This perl script may be your savior when dealing with instances that require major brute force. It specifically works with IPFW, PF and IPTABLES, which will allow it to run across a variety of BSD’s or even Linux.</li>
<li>It will ingest a list of IP’s that you feed it (perhaps from another tool such as sshguard) and determine what block the IP belongs to, and match according to country. </li>
<li>Detailed setup instructions for the various firewalls are included, and some instructions for FreeBSD, although using it on OpenBSD or other $BSD should also be easy to adapt.
***</li>
</ul>

<h3><a href="https://distrowatch.com/weekly.php?issue=20160822#tips" rel="nofollow">More utilities via moreutils</a></h3>

<ul>
<li>In most BSDs, the “core” set of utilities and commands are just part of the base system, but on Linux, they are usually provided by the “coreutils” package.</li>
<li>However, on Linux and now FreeBSD, there is a “moreutils” package, that provides a number of interesting additional basic utilities, including:

<ul>
<li>chronic: Run a task via crontab, and only generate output if the task fails</li>
<li>combine: binary AND two text files together, only displaying lines that are in both files</li>
<li>errno: look up the text description of a specific error number</li>
<li>ifdata: parse out specific information from ifconfig</li>
<li>ifne: if-not-empty, only run a command if the output of the pipe is not blank</li>
<li>isutf8: determine if a file or stdin contains utf8</li>
<li>lckdo: execute a command with a lock held, to prevent a second copy from spawning</li>
<li>mispipe: return the exit code of the first command in a pipe chain, rather than the last</li>
<li>parallel: run multiple jobs at once</li>
<li>pee: tee standard input to multiple pipes</li>
<li>sponge: write standard input to a file, allows you to overwrite a file in place: sort file | sponge file</li>
<li>ts: add a timestamp to each line of standard input</li>
<li>vidir: edit a directory in vi, great for bulk renames</li>
<li>vipe: insert vi into a pipe, edit the content before it is passed to the next command</li>
<li>zrun: uncompress the arguments before passing them. Like gzless and friends, but for any command</li>
</ul></li>
<li>Just goes to show the power of the original UNIX philosophy, chaining together a bunch of small useful tools to do really powerful things
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160823100144" rel="nofollow">OpenBSD: SNI support added to libtls, httpd in –current</a></h3>

<ul>
<li>libtls, LibreSSL’s improved API to replace the OpenSSL standard, now has a set of functions to implement SNI (Server Name Indication) </li>
<li>Until a few years ago, each different SSL/TLS enabled website required a unique IP address, because typical HTTP Virtual Hosting (differentiating which content to serve based on the Host header in the HTTP request), didn’t work because the request was encrypted.</li>
<li>Finally the TLS standard was updated to include the hostname of the site the user is requesting in the TLS handshake, so the server can return the corresponding certificate, and multiple TLS enabled websites can be hosted on a single IP address</li>
<li>The new API includes the ability to provide additional keypairs (via tls_config_add_keypair_{file,mem}())</li>
<li>And allow the server to determine what servername the client requested viatls_conn_servername()</li>
<li>This is much easier to use, and therefore safer and less error prone, than the OpenSSL API</li>
<li>The libtls API is used in a number of OpenBSD tools, including the httpd
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://opnsense.org/new-core-team-member/" rel="nofollow">Shawn Webb of HardenedBSD joins the OPNSense Core Team</a> </li>
<li><a href="http://vak.ru/doku.php/proj/pdp11/211bsd" rel="nofollow">How to install 2.11 BSD on a (simulated) PDP11</a></li>
<li><a href="https://nemessica.tintagel.pl/blog/OpenBSD-Puffy/" rel="nofollow">OpenBSD Puffy needlepoint pixelart</a><br></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2016-August/313010.html" rel="nofollow">PulseAudio has been removed from dports (DragonFly BSD)</a> </li>
<li><a href="https://blog.pfsense.org/?p=2118" rel="nofollow">pfSense 2.4 pre-alpha available for testing, based on FreeBSD 11.0 </a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2016-September/004700.html" rel="nofollow">Call for Testing - Bhyve HDA Sound Emulation </a> 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/CrZiDAF0" rel="nofollow"> Matthew - ZFS Hole Birth</a> </li>
<li><a href="http://pastebin.com/GztjY4wz" rel="nofollow"> Hunter - systemd-mount </a> </li>
<li><a href="http://pastebin.com/gG4j4RCi" rel="nofollow"> Anonymous - Cool’n’quiet</a> </li>
<li><a href="http://pastebin.com/9XgPzMM9" rel="nofollow"> Nathan - Datacenter </a> </li>
<li><a href="http://pastebin.com/FM2xYcxh" rel="nofollow"> Chuck - OpenBSD w/DO</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>159: Net Scaling Privacy (Flix Style)</title>
  <link>https://www.bsdnow.tv/159</link>
  <guid isPermaLink="false">f3978698-0f12-4129-b880-c3190272bd36</guid>
  <pubDate>Wed, 14 Sep 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f3978698-0f12-4129-b880-c3190272bd36.mp3" length="51808468" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow! We’ve got Netflix + FreeBSD news to discuss, always a crowd pleaser, that plus EuroBSDCon is just around the corner. Stick around for your place</itunes:subtitle>
  <itunes:duration>1:11:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow! We’ve got Netflix + FreeBSD news to discuss, always a crowd pleaser, that plus EuroBSDCon is just around the corner. Stick around for your place
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Protecting Netflix Viewing Privacy at Scale, with FreeBSD (http://techblog.netflix.com/search/label/FreeBSD)
This blog post from Netflix tells the story of how Netflix developed in-kernel TLS to speed up delivery of video via HTTPS
Since the beginning of the Open Connect program we have significantly increased the efficiency of our OCAs - from delivering 8 Gbps of throughput from a single server in 2012 to over 90 Gbps from a single server in 2016. We contribute to this effort on the software side by optimizing every aspect of the software for our unique use case - in particular, focusing on the open source FreeBSD operating system and the NGINX web server that run on the OCAs.
In the modern internet world, we have to focus not only on efficiency, but also security. There are many state-of-the-art security mechanisms in place at Netflix, including Transport Level Security (TLS) encryption of customer information, search queries, and other confidential data. We have always relied on pre-encoded Digital Rights Management (DRM) to secure our video streams. Over the past year, we’ve begun to use Secure HTTP (HTTP over TLS or HTTPS) to encrypt the transport of the video content as well. This helps protect member privacy, particularly when the network is insecure - ensuring that our members are safe from eavesdropping by anyone who might want to record their viewing habits.
The goal is to ensure that your government, ISP, and wifi sniffing neighbour cannot tell which Netflix videos you are watching
Netflix Open Connect serves over 125 million hours of content per day, all around the world. Given our scale, adding the overhead of TLS encryption calculations to our video stream transport had the potential to greatly reduce the efficiency of our global infrastructure.
We evaluated available and applicable ciphers and decided to primarily use the Advanced Encryption Standard (AES) cipher in Galois/Counter Mode (GCM), available starting in TLS 1.2. We chose AES-GCM over the Cipher Block Chaining (CBC) method, which comes at a higher computational cost. The AES-GCM cipher algorithm encrypts and authenticates the message simultaneously - as opposed to AES-CBC, which requires an additional pass over the data to generate keyed-hash message authentication code (HMAC). CBC can still be used as a fallback for clients that cannot support the preferred method.
All revisions of Open Connect Appliances also have Intel CPUs that support AES-NI, the extension to the x86 instruction set designed to improve encryption and decryption performance. We needed to determine the best implementation of AES-GCM with the AES-NI instruction set, so we investigated alternatives to OpenSSL, including BoringSSL and the Intel Intelligent Storage Acceleration Library (ISA-L).
Netflix and NGINX had previously worked together to improve our HTTP client request and response time via the use of sendfile calls to perform a zero-copy data flow from storage (HDD or SSD) to network socket, keeping the data in the kernel memory address space and relieving some of the CPU burden. The Netflix team specifically added the ability to make the sendfile calls asynchronous - further reducing the data path and enabling more simultaneous connections. However, TLS functionality, which requires the data to be passed to the application layer, was incompatible with the sendfile approach.
To retain the benefits of the sendfile model while adding TLS functionality, we designed a hybrid TLS scheme whereby session management stays in the application space, but the bulk encryption is inserted into the sendfile data pipeline in the kernel. This extends sendfile to support encrypting data for TLS/SSL connections.
 We tested the BoringSSL and ISA-L AES-GCM implementations with our sendfile improvements against a baseline of OpenSSL (with no sendfile changes), under typical Netflix traffic conditions on three different OCA hardware types. Our changes in both the BoringSSL and ISA-L test situations significantly increased both CPU utilization and bandwidth over baseline - increasing performance by up to 30%, depending on the OCA hardware version. We chose the ISA-L cipher implementation, which had slightly better results. With these improvements in place, we can continue the process of adding TLS to our video streams for clients that support it, without suffering prohibitive performance hits.
If you would like more detail, check out the papers from AsiaBSDCon 2015 (https://people.freebsd.org/~rrs/asiabsd_2015_tls.pdf) and the updated one from 2016 (https://people.freebsd.org/~rrs/asiabsd_tls_improved.pdf) 
***
OpenBSD on HP Stream 7 (http://www.tedunangst.com/flak/post/OpenBSD-on-HP-Stream-7)
Recent events have rocked the mobile computing world to its core. OpenBSD retired the zaurus port, leaving users in desperate need of a new device. And not long before that, Microsoft released the Anniversary Update to Windows 10, but with free space requirements such that it’s nigh impossible to install on cheap 32GB eMMC equipped devices such as the HP Stream series, leaving users searching for a new lightweight operating system. With necessity as both mother and father, the scene is set for a truly epic pairing. OpenBSD on the HP Stream 7.
The HP Stream line is a series of budget computers in a couple form factors. The Stream 11 is a fairly typical netbook. However, the Stream 7 and 8 are tablets. They look like cheap Android devices, but inside the case, they’re real boys, er PCs, with Intel Atom CPUs.
To install OpenBSD on such a device, we need a few parts. Obviously, the tablet itself. There’s a dearth of ports on these things, but there is a micro USB port. Attaching anything useful requires an OTG “on the go” cable that creates a type A port. Attaching more than one useful thing requires a mini hub. And completing the install requires one each USB stick, keyboard, and network adapter.
First, we need to prep the machine to boot from USB. Actually, before doing anything, make sure you have a full charge. It’s going to be battery only from here on out. Plug everything in. Flash drive, keyboard, and network into the hub, hub into the OTG cable, cable into the port on top of the Stream.
Turn on the machine while holding the volume down button. This launches a mini menu from which we can enter the BIOS. There’s a little on screen keyboard in the corner, so this can be done even without a keyboard attached, but the USB keyboard should work. We need to change two settings in the boot section. First, turn off secure boot. Second, switch boot order to prefer USB. Save and exit. The first reboot reveals a confirmation screen checking that we really want to disable secure boot. We must enter a PIN and press enter. Enter the PIN shown on the screen and press enter. And we are go.
Then boot up OpenBSD from the USB drive
 Ted then works there a number of kernel panics and device driver issues, but after disabling ACPI and IntelDRM, the device boots OpenBSD.
Of course, there’s no X at this point. And definitely no touch screen. And no internal networking. However, by keeping our USB hub attached, we can drive the console and access the network. At least until the battery is depleted, even if we have no way of knowing how long that will be since we disabled all the ACPI devices, which also means no suspend or resume.
With some xorg.conf hacking, he did get Xorg working
***
DragonflyBSD steps towards base LibreSSL (http://lists.dragonflybsd.org/pipermail/commits/2016-September/624493.html)
Project: DragonFlyBSD / Switch base to use private LibreSSL libraries (http://freshbsd.org/commit/dfbsd/304ca408000cd34559ef5319b4b5a6766d6eb35b)
DragonFly BSD adopts uses of LibreSSL (http://undeadly.org/cgi?action=article&amp;amp;sid=20160911231651)
The number of projects beginning to switch over to LibreSSL is growing and it appears we can now throw DragonFly into that camp.
Following something that sounds vaguely familiar (Allan!) DFLY is now creating “private” LibreSSL libraries which are only linked against by base system binaries.
For the moment OpenSSL is still built, primarily so that various ports and 3rd party apps can continue to function as before.
A NO_OPENSSL option has also been added, but doesn’t really do much (yet), since it’ll still build and install headers / libraries even if set.
***
OpenBSD g2k16 Hackathon
g2k16 Hackathon Report: Antoine Jacoutot on Binary Patches (http://undeadly.org/cgi?action=article&amp;amp;sid=20160911012316) 
g2k16 Hackathon Report: Matthieu Herrb on xenodm (http://undeadly.org/cgi?action=article&amp;amp;sid=20160911231712) 
g2k16 Hackathon Report: Vincent Gross on iked(8), armv7 and sys/netinet[6] (http://undeadly.org/cgi?action=article&amp;amp;sid=20160911000337) 
g2k16 Hackathon Report: Florian Obser on httpd, networking, acme-client, and more (http://undeadly.org/cgi?action=article&amp;amp;sid=20160911000052) 
g2k16 Hackathon Report: Jasper Lievisse Adriaanse on ddb(4) and more (http://undeadly.org/cgi?action=article&amp;amp;sid=20160909012520) 
g2k16 Hackathon Report: Christian Weisgerber on gettext progress, RTC work, removing kernel cruft (http://undeadly.org/cgi?action=article&amp;amp;sid=20160908002430) 
g2k16 Hackathon Report: Brent Cook on Chromebooks, crypto, and more (http://undeadly.org/cgi?action=article&amp;amp;sid=20160907131655) 
g2k16 Hackathon Report: Ted Unangst on doas, signify, code removal (http://undeadly.org/cgi?action=article&amp;amp;sid=20160906230610) 
g2k16 Hackathon Report: Marc Espie on package signing evolution (http://undeadly.org/cgi?action=article&amp;amp;sid=20160905235911) 
g2k16 Hackathon Report: Adam Wolk on ports, wireless drivers and more (http://undeadly.org/cgi?action=article&amp;amp;sid=20160906004915) 
g2k16 Hackathon Report: Mike Larkin on vmm + vmd progress (http://undeadly.org/cgi?action=article&amp;amp;sid=20160905134009&amp;amp;mode=expanded) 
***
News Roundup
OpenBSD (with encrypted softraid) on the Chromebook Pixel (https://jcs.org/notaweblog/2016/08/26/openbsd_chromebook/)
Looking for a Laptop to make your OpenBSD road-warrior? If so, we have a great blog tutorial on getting OpenBSD setup on the Chromebook Pixel with encrypted softraid!
Author Joshua Stein gives us a very verbose look at how to install and dial-in the laptop perfectly. But first for those wondering about the hardware in the pixel:
The Chromebook Pixel LS (2015) has an Intel Core i7 processor (Broadwell) at 2.4Ghz, 16Gb of RAM, a 2560x1700 400-nit IPS screen (239ppi), and Intel 802.11ac wireless. It has a Kingston 64Gib flash chip, of which about 54Gib can be used by OpenBSD when dual-booting with a 1Gb Chrome OS partition.
Due to this being a chromebook with seaBIOS, some manual key-press trickery will be required to initially get the OpenBSD Installer up and running.
From here you’ll want to pay special close attention to the disk partitioning. In particular Joshua will show us how to shrink the existing encrypted /home that ChromeOS uses, keeping the dual-boot intact. This will become important if you ever plan on updating the device.
From here, we move back to a more traditional setup, but with the added bonus of doing a soft-raid setup.
But the fun isn’t over yet! If you want to make OpenBSD the default boot, that’ll require cracking the lid on the device and removing a special pink write-protect screw. And of course if you want to remove the default splash-screen image, Joshua has you covered as well, although some flashrom magic will be required.
At this point you are nearly done. Final details on enabling specific bits of hardware are discussed. Most things work, apart from Audio and Bluetooth as of right now.
***
doas mastery (http://www.tedunangst.com/flak/post/doas-mastery)
“doas” mastery - Paging MWL!
Our buddy Ted Unangst has written up a great ‘mastery’ guide of the doas command, which can come in handy if you are among the un-initiated in doas land.
UNIX systems have two classes of user, the super user and regular users. The super user is super, and everybody else is not. This concentration of power keeps things simple, but also means that often too much power is granted. Usually we only need super user powers to perform one task. We would rather not have such power all the time. Think of the responsibility that would entail! Like the sudo command, doas allows for subdivision of super user privileges, granting them only for specific tasks.
He starts with the basic doas.conf setup, which starts with an empty config file
The doas config is much like a pf ruleset, the default is to block everything
&amp;gt; We add the root rule second because doas evaluates rules in a last match manner. root is in the wheel group, so the first rule will match, and then we need to override that with a second rule. Remember to always start with general rules, then make them more specific.
***
iXsystems
iXsystems to host MeetBSD (https://www.ixsystems.com/blog/ixsystems-host-meetbsd-california-2016-uc-berkeley/) 
FreeBSD Foundation Welcomes New Board Members
New Board Members (https://www.freebsdfoundation.org/blog/freebsd-foundation-welcomes-new-board-members/) 
The FreeBSD Foundation has added two new board members
Interview with Kylie Liang (https://www.freebsdfoundation.org/blog/new-board-member-interview-kylie-liang/)
Kylie will focus on representing FreeBSD at conferences and businesses in China
I live in China. There, I can act as a bridge between Chinese companies and the FreeBSD community to help drive FreeBSD adoption. Through my leadership role in the FreeBSD Foundation, I will help promote FreeBSD in China and also represent the Foundation at conferences and events in my region.
Kylie leads the team the ensures FreeBSD runs well on Hyper-V and Azure, including providing commercial support for customers who run FreeBSD or FreeBSD based appliances on the Azure Cloud
I joined Microsoft and started to lead the project called FreeBSD Integration Service to get FreeBSD running well on Hyper-V and Azure. To promote our work and to understand the FreeBSD ecosystem, I started to participate in FreeBSD events where I was inspired by this technical community.
Interview with Philip Paeps (https://www.freebsdfoundation.org/blog/new-board-member-interview-philip-paeps/) 
Philip started with FreeBSD in the early 2000s and got his commit bit in 2004
The patches I submitted to make ACPI and input devices work on that laptop led to a src commit bit in 2004. While I haven’t worked on ACPI or input devices since, I have been contributing to different areas of the kernel. Taking up maintainership of some ports I cared about also got me a ports commit bit after some time.
Philip will continue to help run EuroBSDCon, but is also spreading the word about FreeBSD in India and Africa
Primarily, I think I can be useful! I attend (and organize) a number of conferences around the world every year, particularly in regions that have a mostly “stealthy” FreeBSD community. While I clearly don’t need to be on the FreeBSD Foundation board to advocate for FreeBSD, joining as a director will provide an additional asset when working in areas of the world where organizational affiliations are meaningful.
Philip has also developed network drivers and various other bits and pieces, and has extensive experience working with and for hardware vendors and appliance vendors
Despite intending to eventually contribute their code to the FreeBSD Project as open source, many hardware vendors still find it very difficult to engage directly with the FreeBSD development community. The Foundation helps bridge that gap and helps facilitate collaboration between commercial vendors and the FreeBSD community.
I hope to make FreeBSD more visible in regions of the world where it is historically under-represented. I expect I will be attending even more conferences and getting myself invited to even more organizations.
more, less, and a story of typical Unix fossilization (https://utcc.utoronto.ca/~cks/space/blog/unix/MoreAndUnixFossilization)
Chris Siebenmann from the University of Toronto digs into the history of the difference between ‘less’ and ‘more’
In the beginning, by which we mean V7, Unix didn't have a pager at all. That was okay; Unix wasn't very visual in those days, partly because it was still sort of the era of the hard copy terminal. Then along came Berkeley and BSD. People at Berkeley were into CRT terminals, and so BSD Unix gave us things like vi and the first pager program, more (which showed up quite early, in 3BSD, although this isn't as early as vi, which appears in 2BSD). Calling a pager more is a little bit odd but it's a Unix type of name and from the beginning more prompted you with '--More--' at the bottom of the screen.
All of the Unix vendors that based their work on BSD Unix (like Sun and DEC) naturally shipped versions of more along with the rest of the BSD programs, and so more spread around the BSD side of things. However, more was by no means the best pager ever; as you might expect, it was actually a bit primitive and lacking in features. So fairly early on Mark Nudelman wrote a pager with somewhat more features and it wound up being called less as somewhat of a joke.
In a sane world, Unix vendors would have either replaced their version of more with the clearly superior less or at least updated their version of more to the 4.3 BSD version. Maybe less wouldn't have replaced more immediately, but certainly over say the next five years, when it kept on being better and most people kept preferring it when they had a choice.”
+ “This entire history has led to a series of vaguely absurd outcomes on various modern Unixes. On Solaris derivatives more is of course the traditional version with source code that can probably trace itself all the way back to 3BSD, carefully updated to SUS compliance. Solaris would never dream of changing what more is, not even if the replacement is better. Why, it might disturb someone.
Oddly, FreeBSD has done the most sensible thing; they've outright replaced more with less. There is a /usr/bin/more but it's the same binary as less and as you can see the more manpage is just the less manpage. OpenBSD has done the same thing but has a specific manpage for more instead of just giving you the less manpage.
So, now you can see why I say that less is more, or more, or both, at several levels. less is certainly more than more, and sometimes less literally is more (or rather more is less, to put it the right way around).
Beastie Bits
PC-BSD listed in the top 8 'best' alternatives to Windows 10 (http://www.computerworlduk.com/galleries/operating-systems/-free-alternatives-windows-10-3639433/) 
Creating a quick DNS server with a Rapsberry Pi2 and FreeBSD 11.0-RC1 (http://bsdimp.blogspot.co.uk/2016/08/creating-quick-dns-server-with.html) 
Dual Boot OpenBSD and Linux + UEFI (https://bsdlaptops.wordpress.com/2016/03/07/vaio-pro-11-part-2/) 
DesktopBSD 2.0 various versions available (Gnome, Lumina, KDE, LXDE) (http://desktopbsd.boards.net/board/10/announcements) 
FreeBSD gets new ZFS features including: Compressed ARC  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=305323) and ZFS Allocation Throttle  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=305331) 
One Floppy NetBSD Distribution (https://github.com/user340/fdgw2)
A Compendium of BUGs (https://github.com/q5sys/BUGtracker) 
Feedback/Questions
 Galahad - OpenBSD X setup (http://pastebin.com/b7W6NHqs) 
 Tang - Subtitles (http://pastebin.com/P4MUs3Pa) 
 Ivan - Zpool Options (http://pastebin.com/LQ8yTp0G) 
 Brad - Replication Issue (http://pastebin.com/XTK5gXMU) 
 MJ - HBA (http://pastebin.com/TdYTMSj9) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow! We’ve got Netflix + FreeBSD news to discuss, always a crowd pleaser, that plus EuroBSDCon is just around the corner. Stick around for your place</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://techblog.netflix.com/search/label/FreeBSD" rel="nofollow">Protecting Netflix Viewing Privacy at Scale, with FreeBSD</a></h3>

<ul>
<li>This blog post from Netflix tells the story of how Netflix developed in-kernel TLS to speed up delivery of video via HTTPS</li>
</ul>

<blockquote>
<p>Since the beginning of the Open Connect program we have significantly increased the efficiency of our OCAs - from delivering 8 Gbps of throughput from a single server in 2012 to over 90 Gbps from a single server in 2016. We contribute to this effort on the software side by optimizing every aspect of the software for our unique use case - in particular, focusing on the open source FreeBSD operating system and the NGINX web server that run on the OCAs.</p>

<p>In the modern internet world, we have to focus not only on efficiency, but also security. There are many state-of-the-art security mechanisms in place at Netflix, including Transport Level Security (TLS) encryption of customer information, search queries, and other confidential data. We have always relied on pre-encoded Digital Rights Management (DRM) to secure our video streams. Over the past year, we’ve begun to use Secure HTTP (HTTP over TLS or HTTPS) to encrypt the transport of the video content as well. This helps protect member privacy, particularly when the network is insecure - ensuring that our members are safe from eavesdropping by anyone who might want to record their viewing habits.</p>

<p>The goal is to ensure that your government, ISP, and wifi sniffing neighbour cannot tell which Netflix videos you are watching</p>

<p>Netflix Open Connect serves over 125 million hours of content per day, all around the world. Given our scale, adding the overhead of TLS encryption calculations to our video stream transport had the potential to greatly reduce the efficiency of our global infrastructure.</p>

<p>We evaluated available and applicable ciphers and decided to primarily use the Advanced Encryption Standard (AES) cipher in Galois/Counter Mode (GCM), available starting in TLS 1.2. We chose AES-GCM over the Cipher Block Chaining (CBC) method, which comes at a higher computational cost. The AES-GCM cipher algorithm encrypts and authenticates the message simultaneously - as opposed to AES-CBC, which requires an additional pass over the data to generate keyed-hash message authentication code (HMAC). CBC can still be used as a fallback for clients that cannot support the preferred method.</p>

<p>All revisions of Open Connect Appliances also have Intel CPUs that support AES-NI, the extension to the x86 instruction set designed to improve encryption and decryption performance. We needed to determine the best implementation of AES-GCM with the AES-NI instruction set, so we investigated alternatives to OpenSSL, including BoringSSL and the Intel Intelligent Storage Acceleration Library (ISA-L).</p>

<p>Netflix and NGINX had previously worked together to improve our HTTP client request and response time via the use of sendfile calls to perform a zero-copy data flow from storage (HDD or SSD) to network socket, keeping the data in the kernel memory address space and relieving some of the CPU burden. The Netflix team specifically added the ability to make the sendfile calls asynchronous - further reducing the data path and enabling more simultaneous connections. However, TLS functionality, which requires the data to be passed to the application layer, was incompatible with the sendfile approach.</p>

<p>To retain the benefits of the sendfile model while adding TLS functionality, we designed a hybrid TLS scheme whereby session management stays in the application space, but the bulk encryption is inserted into the sendfile data pipeline in the kernel. This extends sendfile to support encrypting data for TLS/SSL connections.</p>

<p>We tested the BoringSSL and ISA-L AES-GCM implementations with our sendfile improvements against a baseline of OpenSSL (with no sendfile changes), under typical Netflix traffic conditions on three different OCA hardware types. Our changes in both the BoringSSL and ISA-L test situations significantly increased both CPU utilization and bandwidth over baseline - increasing performance by up to 30%, depending on the OCA hardware version. We chose the ISA-L cipher implementation, which had slightly better results. With these improvements in place, we can continue the process of adding TLS to our video streams for clients that support it, without suffering prohibitive performance hits.</p>
</blockquote>

<ul>
<li>If you would like more detail, check out the papers from <a href="https://people.freebsd.org/%7Errs/asiabsd_2015_tls.pdf" rel="nofollow">AsiaBSDCon 2015</a> and the <a href="https://people.freebsd.org/%7Errs/asiabsd_tls_improved.pdf" rel="nofollow">updated one from 2016</a> 
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/OpenBSD-on-HP-Stream-7" rel="nofollow">OpenBSD on HP Stream 7</a></h3>

<blockquote>
<p>Recent events have rocked the mobile computing world to its core. OpenBSD retired the zaurus port, leaving users in desperate need of a new device. And not long before that, Microsoft released the Anniversary Update to Windows 10, but with free space requirements such that it’s nigh impossible to install on cheap 32GB eMMC equipped devices such as the HP Stream series, leaving users searching for a new lightweight operating system. With necessity as both mother and father, the scene is set for a truly epic pairing. OpenBSD on the HP Stream 7.</p>

<p>The HP Stream line is a series of budget computers in a couple form factors. The Stream 11 is a fairly typical netbook. However, the Stream 7 and 8 are tablets. They look like cheap Android devices, but inside the case, they’re real boys, er PCs, with Intel Atom CPUs.</p>

<p>To install OpenBSD on such a device, we need a few parts. Obviously, the tablet itself. There’s a dearth of ports on these things, but there is a micro USB port. Attaching anything useful requires an OTG “on the go” cable that creates a type A port. Attaching more than one useful thing requires a mini hub. And completing the install requires one each USB stick, keyboard, and network adapter.</p>

<p>First, we need to prep the machine to boot from USB. Actually, before doing anything, make sure you have a full charge. It’s going to be battery only from here on out. Plug everything in. Flash drive, keyboard, and network into the hub, hub into the OTG cable, cable into the port on top of the Stream.</p>

<p>Turn on the machine while holding the volume down button. This launches a mini menu from which we can enter the BIOS. There’s a little on screen keyboard in the corner, so this can be done even without a keyboard attached, but the USB keyboard should work. We need to change two settings in the boot section. First, turn off secure boot. Second, switch boot order to prefer USB. Save and exit. The first reboot reveals a confirmation screen checking that we really want to disable secure boot. We must enter a PIN and press enter. Enter the PIN shown on the screen and press enter. And we are go.</p>
</blockquote>

<ul>
<li><p>Then boot up OpenBSD from the USB drive</p></li>
<li><p>Ted then works there a number of kernel panics and device driver issues, but after disabling ACPI and IntelDRM, the device boots OpenBSD.</p></li>
</ul>

<blockquote>
<p>Of course, there’s no X at this point. And definitely no touch screen. And no internal networking. However, by keeping our USB hub attached, we can drive the console and access the network. At least until the battery is depleted, even if we have no way of knowing how long that will be since we disabled all the ACPI devices, which also means no suspend or resume.</p>
</blockquote>

<ul>
<li>With some xorg.conf hacking, he did get Xorg working
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-September/624493.html" rel="nofollow">DragonflyBSD steps towards base LibreSSL</a></h3>

<ul>
<li><a href="http://freshbsd.org/commit/dfbsd/304ca408000cd34559ef5319b4b5a6766d6eb35b" rel="nofollow">Project: DragonFlyBSD / Switch base to use private LibreSSL libraries</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160911231651" rel="nofollow">DragonFly BSD adopts uses of LibreSSL</a></li>
<li>The number of projects beginning to switch over to LibreSSL is growing and it appears we can now throw DragonFly into that camp.</li>
<li>Following something that sounds vaguely familiar (Allan!) DFLY is now creating “private” LibreSSL libraries which are only linked against by base system binaries.</li>
<li>For the moment OpenSSL is <em>still</em> built, primarily so that various ports and 3rd party apps can continue to function as before.</li>
<li>A NO_OPENSSL option has also been added, but doesn’t really do much (yet), since it’ll still build and install headers / libraries even if set.
***</li>
</ul>

<h3>OpenBSD g2k16 Hackathon</h3>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160911012316" rel="nofollow">g2k16 Hackathon Report: Antoine Jacoutot on Binary Patches</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160911231712" rel="nofollow">g2k16 Hackathon Report: Matthieu Herrb on xenodm</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160911000337" rel="nofollow">g2k16 Hackathon Report: Vincent Gross on iked(8), armv7 and sys/netinet[6]</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160911000052" rel="nofollow">g2k16 Hackathon Report: Florian Obser on httpd, networking, acme-client, and more</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160909012520" rel="nofollow">g2k16 Hackathon Report: Jasper Lievisse Adriaanse on ddb(4) and more</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160908002430" rel="nofollow">g2k16 Hackathon Report: Christian Weisgerber on gettext progress, RTC work, removing kernel cruft</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160907131655" rel="nofollow">g2k16 Hackathon Report: Brent Cook on Chromebooks, crypto, and more</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160906230610" rel="nofollow">g2k16 Hackathon Report: Ted Unangst on doas, signify, code removal</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160905235911" rel="nofollow">g2k16 Hackathon Report: Marc Espie on package signing evolution</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160906004915" rel="nofollow">g2k16 Hackathon Report: Adam Wolk on ports, wireless drivers and more</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160905134009&mode=expanded" rel="nofollow">g2k16 Hackathon Report: Mike Larkin on vmm + vmd progress</a> 
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/notaweblog/2016/08/26/openbsd_chromebook/" rel="nofollow">OpenBSD (with encrypted softraid) on the Chromebook Pixel</a></h3>

<ul>
<li>Looking for a Laptop to make your OpenBSD road-warrior? If so, we have a great blog tutorial on getting OpenBSD setup on the Chromebook Pixel with encrypted softraid!</li>
<li>Author Joshua Stein gives us a very verbose look at how to install and dial-in the laptop perfectly. But first for those wondering about the hardware in the pixel:</li>
</ul>

<blockquote>
<p>The Chromebook Pixel LS (2015) has an Intel Core i7 processor (Broadwell) at 2.4Ghz, 16Gb of RAM, a 2560x1700 400-nit IPS screen (239ppi), and Intel 802.11ac wireless. It has a Kingston 64Gib flash chip, of which about 54Gib can be used by OpenBSD when dual-booting with a 1Gb Chrome OS partition.</p>
</blockquote>

<ul>
<li>Due to this being a chromebook with seaBIOS, some manual key-press trickery will be required to initially get the OpenBSD Installer up and running.</li>
<li>From here you’ll want to pay special close attention to the disk partitioning. In particular Joshua will show us how to shrink the existing encrypted /home that ChromeOS uses, keeping the dual-boot intact. This will become important if you ever plan on updating the device.</li>
<li>From here, we move back to a more traditional setup, but with the added bonus of doing a soft-raid setup.</li>
<li>But the fun isn’t over yet! If you want to make OpenBSD the default boot, that’ll require cracking the lid on the device and removing a special pink write-protect screw. And of course if you want to remove the default splash-screen image, Joshua has you covered as well, although some flashrom magic will be required.</li>
<li>At this point you are nearly done. Final details on enabling specific bits of hardware are discussed. Most things work, apart from Audio and Bluetooth as of right now.
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/doas-mastery" rel="nofollow">doas mastery</a></h3>

<ul>
<li>“doas” mastery - Paging MWL!</li>
<li>Our buddy Ted Unangst has written up a great ‘mastery’ guide of the doas command, which can come in handy if you are among the un-initiated in doas land.</li>
</ul>

<blockquote>
<p>UNIX systems have two classes of user, the super user and regular users. The super user is super, and everybody else is not. This concentration of power keeps things simple, but also means that often too much power is granted. Usually we only need super user powers to perform one task. We would rather not have such power all the time. Think of the responsibility that would entail! Like the sudo command, doas allows for subdivision of super user privileges, granting them only for specific tasks.</p>
</blockquote>

<ul>
<li>He starts with the basic doas.conf setup, which starts with an empty config file</li>
<li>The doas config is much like a pf ruleset, the default is to block everything
&gt; We add the root rule second because doas evaluates rules in a last match manner. root is in the wheel group, so the first rule will match, and then we need to override that with a second rule. Remember to always start with general rules, then make them more specific.
***</li>
</ul>

<h3>iXsystems</h3>

<ul>
<li><a href="https://www.ixsystems.com/blog/ixsystems-host-meetbsd-california-2016-uc-berkeley/" rel="nofollow">iXsystems to host MeetBSD</a> </li>
</ul>

<hr>

<h3>FreeBSD Foundation Welcomes New Board Members</h3>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/freebsd-foundation-welcomes-new-board-members/" rel="nofollow">New Board Members</a> </li>
<li>The FreeBSD Foundation has added two new board members</li>
<li><a href="https://www.freebsdfoundation.org/blog/new-board-member-interview-kylie-liang/" rel="nofollow">Interview with Kylie Liang</a></li>
<li>Kylie will focus on representing FreeBSD at conferences and businesses in China</li>
</ul>

<blockquote>
<p>I live in China. There, I can act as a bridge between Chinese companies and the FreeBSD community to help drive FreeBSD adoption. Through my leadership role in the FreeBSD Foundation, I will help promote FreeBSD in China and also represent the Foundation at conferences and events in my region.</p>
</blockquote>

<ul>
<li>Kylie leads the team the ensures FreeBSD runs well on Hyper-V and Azure, including providing commercial support for customers who run FreeBSD or FreeBSD based appliances on the Azure Cloud</li>
</ul>

<blockquote>
<p>I joined Microsoft and started to lead the project called FreeBSD Integration Service to get FreeBSD running well on Hyper-V and Azure. To promote our work and to understand the FreeBSD ecosystem, I started to participate in FreeBSD events where I was inspired by this technical community.</p>
</blockquote>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/new-board-member-interview-philip-paeps/" rel="nofollow">Interview with Philip Paeps</a> </li>
<li>Philip started with FreeBSD in the early 2000s and got his commit bit in 2004</li>
</ul>

<blockquote>
<p>The patches I submitted to make ACPI and input devices work on that laptop led to a src commit bit in 2004. While I haven’t worked on ACPI or input devices since, I have been contributing to different areas of the kernel. Taking up maintainership of some ports I cared about also got me a ports commit bit after some time.</p>
</blockquote>

<ul>
<li>Philip will continue to help run EuroBSDCon, but is also spreading the word about FreeBSD in India and Africa</li>
</ul>

<blockquote>
<p>Primarily, I think I can be useful! I attend (and organize) a number of conferences around the world every year, particularly in regions that have a mostly “stealthy” FreeBSD community. While I clearly don’t need to be on the FreeBSD Foundation board to advocate for FreeBSD, joining as a director will provide an additional asset when working in areas of the world where organizational affiliations are meaningful.</p>
</blockquote>

<ul>
<li>Philip has also developed network drivers and various other bits and pieces, and has extensive experience working with and for hardware vendors and appliance vendors</li>
</ul>

<blockquote>
<p>Despite intending to eventually contribute their code to the FreeBSD Project as open source, many hardware vendors still find it very difficult to engage directly with the FreeBSD development community. The Foundation helps bridge that gap and helps facilitate collaboration between commercial vendors and the FreeBSD community.</p>

<p>I hope to make FreeBSD more visible in regions of the world where it is historically under-represented. I expect I will be attending even more conferences and getting myself invited to even more organizations.</p>

<hr>
</blockquote>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/MoreAndUnixFossilization" rel="nofollow">more, less, and a story of typical Unix fossilization</a></h3>

<ul>
<li>Chris Siebenmann from the University of Toronto digs into the history of the difference between ‘less’ and ‘more’</li>
</ul>

<blockquote>
<p>In the beginning, by which we mean V7, Unix didn&#39;t have a pager at all. That was okay; Unix wasn&#39;t very visual in those days, partly because it was still sort of the era of the hard copy terminal. Then along came Berkeley and BSD. People at Berkeley were into CRT terminals, and so BSD Unix gave us things like vi and the first pager program, more (which showed up quite early, in 3BSD, although this isn&#39;t as early as vi, which appears in 2BSD). Calling a pager more is a little bit odd but it&#39;s a Unix type of name and from the beginning more prompted you with &#39;--More--&#39; at the bottom of the screen.</p>

<p>All of the Unix vendors that based their work on BSD Unix (like Sun and DEC) naturally shipped versions of more along with the rest of the BSD programs, and so more spread around the BSD side of things. However, more was by no means the best pager ever; as you might expect, it was actually a bit primitive and lacking in features. So fairly early on Mark Nudelman wrote a pager with somewhat more features and it wound up being called less as somewhat of a joke.</p>

<p>In a sane world, Unix vendors would have either replaced their version of more with the clearly superior less or at least updated their version of more to the 4.3 BSD version. Maybe less wouldn&#39;t have replaced more immediately, but certainly over say the next five years, when it kept on being better and most people kept preferring it when they had a choice.”</p>

<ul>
<li>“This entire history has led to a series of vaguely absurd outcomes on various modern Unixes. On Solaris derivatives more is of course the traditional version with source code that can probably trace itself all the way back to 3BSD, carefully updated to SUS compliance. Solaris would never dream of changing what more is, not even if the replacement is better. Why, it might disturb someone.</li>
</ul>

<p>Oddly, FreeBSD has done the most sensible thing; they&#39;ve outright replaced more with less. There is a /usr/bin/more but it&#39;s the same binary as less and as you can see the more manpage is just the less manpage. OpenBSD has done the same thing but has a specific manpage for more instead of just giving you the less manpage.</p>

<p>So, now you can see why I say that less is more, or more, or both, at several levels. less is certainly more than more, and sometimes less literally is more (or rather more is less, to put it the right way around).</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://www.computerworlduk.com/galleries/operating-systems/-free-alternatives-windows-10-3639433/" rel="nofollow">PC-BSD listed in the top 8 &#39;best&#39; alternatives to Windows 10</a> </p></li>
<li><p><a href="http://bsdimp.blogspot.co.uk/2016/08/creating-quick-dns-server-with.html" rel="nofollow">Creating a quick DNS server with a Rapsberry Pi2 and FreeBSD 11.0-RC1</a> </p></li>
<li><p><a href="https://bsdlaptops.wordpress.com/2016/03/07/vaio-pro-11-part-2/" rel="nofollow">Dual Boot OpenBSD and Linux + UEFI</a> </p></li>
<li><p><a href="http://desktopbsd.boards.net/board/10/announcements" rel="nofollow">DesktopBSD 2.0 various versions available (Gnome, Lumina, KDE, LXDE)</a> </p></li>
<li><p>FreeBSD gets new ZFS features including: <a href="https://svnweb.freebsd.org/base?view=revision&revision=305323" rel="nofollow">Compressed ARC </a> and <a href="https://svnweb.freebsd.org/base?view=revision&revision=305331" rel="nofollow">ZFS Allocation Throttle </a> </p></li>
<li><p><a href="https://github.com/user340/fdgw2" rel="nofollow">One Floppy NetBSD Distribution</a></p></li>
<li><p><a href="https://github.com/q5sys/BUGtracker" rel="nofollow">A Compendium of BUGs</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/b7W6NHqs" rel="nofollow"> Galahad - OpenBSD X setup</a> </li>
<li><a href="http://pastebin.com/P4MUs3Pa" rel="nofollow"> Tang - Subtitles</a> </li>
<li><a href="http://pastebin.com/LQ8yTp0G" rel="nofollow"> Ivan - Zpool Options</a> </li>
<li><a href="http://pastebin.com/XTK5gXMU" rel="nofollow"> Brad - Replication Issue</a> </li>
<li><a href="http://pastebin.com/TdYTMSj9" rel="nofollow"> MJ - HBA</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow! We’ve got Netflix + FreeBSD news to discuss, always a crowd pleaser, that plus EuroBSDCon is just around the corner. Stick around for your place</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://techblog.netflix.com/search/label/FreeBSD" rel="nofollow">Protecting Netflix Viewing Privacy at Scale, with FreeBSD</a></h3>

<ul>
<li>This blog post from Netflix tells the story of how Netflix developed in-kernel TLS to speed up delivery of video via HTTPS</li>
</ul>

<blockquote>
<p>Since the beginning of the Open Connect program we have significantly increased the efficiency of our OCAs - from delivering 8 Gbps of throughput from a single server in 2012 to over 90 Gbps from a single server in 2016. We contribute to this effort on the software side by optimizing every aspect of the software for our unique use case - in particular, focusing on the open source FreeBSD operating system and the NGINX web server that run on the OCAs.</p>

<p>In the modern internet world, we have to focus not only on efficiency, but also security. There are many state-of-the-art security mechanisms in place at Netflix, including Transport Level Security (TLS) encryption of customer information, search queries, and other confidential data. We have always relied on pre-encoded Digital Rights Management (DRM) to secure our video streams. Over the past year, we’ve begun to use Secure HTTP (HTTP over TLS or HTTPS) to encrypt the transport of the video content as well. This helps protect member privacy, particularly when the network is insecure - ensuring that our members are safe from eavesdropping by anyone who might want to record their viewing habits.</p>

<p>The goal is to ensure that your government, ISP, and wifi sniffing neighbour cannot tell which Netflix videos you are watching</p>

<p>Netflix Open Connect serves over 125 million hours of content per day, all around the world. Given our scale, adding the overhead of TLS encryption calculations to our video stream transport had the potential to greatly reduce the efficiency of our global infrastructure.</p>

<p>We evaluated available and applicable ciphers and decided to primarily use the Advanced Encryption Standard (AES) cipher in Galois/Counter Mode (GCM), available starting in TLS 1.2. We chose AES-GCM over the Cipher Block Chaining (CBC) method, which comes at a higher computational cost. The AES-GCM cipher algorithm encrypts and authenticates the message simultaneously - as opposed to AES-CBC, which requires an additional pass over the data to generate keyed-hash message authentication code (HMAC). CBC can still be used as a fallback for clients that cannot support the preferred method.</p>

<p>All revisions of Open Connect Appliances also have Intel CPUs that support AES-NI, the extension to the x86 instruction set designed to improve encryption and decryption performance. We needed to determine the best implementation of AES-GCM with the AES-NI instruction set, so we investigated alternatives to OpenSSL, including BoringSSL and the Intel Intelligent Storage Acceleration Library (ISA-L).</p>

<p>Netflix and NGINX had previously worked together to improve our HTTP client request and response time via the use of sendfile calls to perform a zero-copy data flow from storage (HDD or SSD) to network socket, keeping the data in the kernel memory address space and relieving some of the CPU burden. The Netflix team specifically added the ability to make the sendfile calls asynchronous - further reducing the data path and enabling more simultaneous connections. However, TLS functionality, which requires the data to be passed to the application layer, was incompatible with the sendfile approach.</p>

<p>To retain the benefits of the sendfile model while adding TLS functionality, we designed a hybrid TLS scheme whereby session management stays in the application space, but the bulk encryption is inserted into the sendfile data pipeline in the kernel. This extends sendfile to support encrypting data for TLS/SSL connections.</p>

<p>We tested the BoringSSL and ISA-L AES-GCM implementations with our sendfile improvements against a baseline of OpenSSL (with no sendfile changes), under typical Netflix traffic conditions on three different OCA hardware types. Our changes in both the BoringSSL and ISA-L test situations significantly increased both CPU utilization and bandwidth over baseline - increasing performance by up to 30%, depending on the OCA hardware version. We chose the ISA-L cipher implementation, which had slightly better results. With these improvements in place, we can continue the process of adding TLS to our video streams for clients that support it, without suffering prohibitive performance hits.</p>
</blockquote>

<ul>
<li>If you would like more detail, check out the papers from <a href="https://people.freebsd.org/%7Errs/asiabsd_2015_tls.pdf" rel="nofollow">AsiaBSDCon 2015</a> and the <a href="https://people.freebsd.org/%7Errs/asiabsd_tls_improved.pdf" rel="nofollow">updated one from 2016</a> 
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/OpenBSD-on-HP-Stream-7" rel="nofollow">OpenBSD on HP Stream 7</a></h3>

<blockquote>
<p>Recent events have rocked the mobile computing world to its core. OpenBSD retired the zaurus port, leaving users in desperate need of a new device. And not long before that, Microsoft released the Anniversary Update to Windows 10, but with free space requirements such that it’s nigh impossible to install on cheap 32GB eMMC equipped devices such as the HP Stream series, leaving users searching for a new lightweight operating system. With necessity as both mother and father, the scene is set for a truly epic pairing. OpenBSD on the HP Stream 7.</p>

<p>The HP Stream line is a series of budget computers in a couple form factors. The Stream 11 is a fairly typical netbook. However, the Stream 7 and 8 are tablets. They look like cheap Android devices, but inside the case, they’re real boys, er PCs, with Intel Atom CPUs.</p>

<p>To install OpenBSD on such a device, we need a few parts. Obviously, the tablet itself. There’s a dearth of ports on these things, but there is a micro USB port. Attaching anything useful requires an OTG “on the go” cable that creates a type A port. Attaching more than one useful thing requires a mini hub. And completing the install requires one each USB stick, keyboard, and network adapter.</p>

<p>First, we need to prep the machine to boot from USB. Actually, before doing anything, make sure you have a full charge. It’s going to be battery only from here on out. Plug everything in. Flash drive, keyboard, and network into the hub, hub into the OTG cable, cable into the port on top of the Stream.</p>

<p>Turn on the machine while holding the volume down button. This launches a mini menu from which we can enter the BIOS. There’s a little on screen keyboard in the corner, so this can be done even without a keyboard attached, but the USB keyboard should work. We need to change two settings in the boot section. First, turn off secure boot. Second, switch boot order to prefer USB. Save and exit. The first reboot reveals a confirmation screen checking that we really want to disable secure boot. We must enter a PIN and press enter. Enter the PIN shown on the screen and press enter. And we are go.</p>
</blockquote>

<ul>
<li><p>Then boot up OpenBSD from the USB drive</p></li>
<li><p>Ted then works there a number of kernel panics and device driver issues, but after disabling ACPI and IntelDRM, the device boots OpenBSD.</p></li>
</ul>

<blockquote>
<p>Of course, there’s no X at this point. And definitely no touch screen. And no internal networking. However, by keeping our USB hub attached, we can drive the console and access the network. At least until the battery is depleted, even if we have no way of knowing how long that will be since we disabled all the ACPI devices, which also means no suspend or resume.</p>
</blockquote>

<ul>
<li>With some xorg.conf hacking, he did get Xorg working
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-September/624493.html" rel="nofollow">DragonflyBSD steps towards base LibreSSL</a></h3>

<ul>
<li><a href="http://freshbsd.org/commit/dfbsd/304ca408000cd34559ef5319b4b5a6766d6eb35b" rel="nofollow">Project: DragonFlyBSD / Switch base to use private LibreSSL libraries</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160911231651" rel="nofollow">DragonFly BSD adopts uses of LibreSSL</a></li>
<li>The number of projects beginning to switch over to LibreSSL is growing and it appears we can now throw DragonFly into that camp.</li>
<li>Following something that sounds vaguely familiar (Allan!) DFLY is now creating “private” LibreSSL libraries which are only linked against by base system binaries.</li>
<li>For the moment OpenSSL is <em>still</em> built, primarily so that various ports and 3rd party apps can continue to function as before.</li>
<li>A NO_OPENSSL option has also been added, but doesn’t really do much (yet), since it’ll still build and install headers / libraries even if set.
***</li>
</ul>

<h3>OpenBSD g2k16 Hackathon</h3>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160911012316" rel="nofollow">g2k16 Hackathon Report: Antoine Jacoutot on Binary Patches</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160911231712" rel="nofollow">g2k16 Hackathon Report: Matthieu Herrb on xenodm</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160911000337" rel="nofollow">g2k16 Hackathon Report: Vincent Gross on iked(8), armv7 and sys/netinet[6]</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160911000052" rel="nofollow">g2k16 Hackathon Report: Florian Obser on httpd, networking, acme-client, and more</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160909012520" rel="nofollow">g2k16 Hackathon Report: Jasper Lievisse Adriaanse on ddb(4) and more</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160908002430" rel="nofollow">g2k16 Hackathon Report: Christian Weisgerber on gettext progress, RTC work, removing kernel cruft</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160907131655" rel="nofollow">g2k16 Hackathon Report: Brent Cook on Chromebooks, crypto, and more</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160906230610" rel="nofollow">g2k16 Hackathon Report: Ted Unangst on doas, signify, code removal</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160905235911" rel="nofollow">g2k16 Hackathon Report: Marc Espie on package signing evolution</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160906004915" rel="nofollow">g2k16 Hackathon Report: Adam Wolk on ports, wireless drivers and more</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160905134009&mode=expanded" rel="nofollow">g2k16 Hackathon Report: Mike Larkin on vmm + vmd progress</a> 
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://jcs.org/notaweblog/2016/08/26/openbsd_chromebook/" rel="nofollow">OpenBSD (with encrypted softraid) on the Chromebook Pixel</a></h3>

<ul>
<li>Looking for a Laptop to make your OpenBSD road-warrior? If so, we have a great blog tutorial on getting OpenBSD setup on the Chromebook Pixel with encrypted softraid!</li>
<li>Author Joshua Stein gives us a very verbose look at how to install and dial-in the laptop perfectly. But first for those wondering about the hardware in the pixel:</li>
</ul>

<blockquote>
<p>The Chromebook Pixel LS (2015) has an Intel Core i7 processor (Broadwell) at 2.4Ghz, 16Gb of RAM, a 2560x1700 400-nit IPS screen (239ppi), and Intel 802.11ac wireless. It has a Kingston 64Gib flash chip, of which about 54Gib can be used by OpenBSD when dual-booting with a 1Gb Chrome OS partition.</p>
</blockquote>

<ul>
<li>Due to this being a chromebook with seaBIOS, some manual key-press trickery will be required to initially get the OpenBSD Installer up and running.</li>
<li>From here you’ll want to pay special close attention to the disk partitioning. In particular Joshua will show us how to shrink the existing encrypted /home that ChromeOS uses, keeping the dual-boot intact. This will become important if you ever plan on updating the device.</li>
<li>From here, we move back to a more traditional setup, but with the added bonus of doing a soft-raid setup.</li>
<li>But the fun isn’t over yet! If you want to make OpenBSD the default boot, that’ll require cracking the lid on the device and removing a special pink write-protect screw. And of course if you want to remove the default splash-screen image, Joshua has you covered as well, although some flashrom magic will be required.</li>
<li>At this point you are nearly done. Final details on enabling specific bits of hardware are discussed. Most things work, apart from Audio and Bluetooth as of right now.
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/doas-mastery" rel="nofollow">doas mastery</a></h3>

<ul>
<li>“doas” mastery - Paging MWL!</li>
<li>Our buddy Ted Unangst has written up a great ‘mastery’ guide of the doas command, which can come in handy if you are among the un-initiated in doas land.</li>
</ul>

<blockquote>
<p>UNIX systems have two classes of user, the super user and regular users. The super user is super, and everybody else is not. This concentration of power keeps things simple, but also means that often too much power is granted. Usually we only need super user powers to perform one task. We would rather not have such power all the time. Think of the responsibility that would entail! Like the sudo command, doas allows for subdivision of super user privileges, granting them only for specific tasks.</p>
</blockquote>

<ul>
<li>He starts with the basic doas.conf setup, which starts with an empty config file</li>
<li>The doas config is much like a pf ruleset, the default is to block everything
&gt; We add the root rule second because doas evaluates rules in a last match manner. root is in the wheel group, so the first rule will match, and then we need to override that with a second rule. Remember to always start with general rules, then make them more specific.
***</li>
</ul>

<h3>iXsystems</h3>

<ul>
<li><a href="https://www.ixsystems.com/blog/ixsystems-host-meetbsd-california-2016-uc-berkeley/" rel="nofollow">iXsystems to host MeetBSD</a> </li>
</ul>

<hr>

<h3>FreeBSD Foundation Welcomes New Board Members</h3>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/freebsd-foundation-welcomes-new-board-members/" rel="nofollow">New Board Members</a> </li>
<li>The FreeBSD Foundation has added two new board members</li>
<li><a href="https://www.freebsdfoundation.org/blog/new-board-member-interview-kylie-liang/" rel="nofollow">Interview with Kylie Liang</a></li>
<li>Kylie will focus on representing FreeBSD at conferences and businesses in China</li>
</ul>

<blockquote>
<p>I live in China. There, I can act as a bridge between Chinese companies and the FreeBSD community to help drive FreeBSD adoption. Through my leadership role in the FreeBSD Foundation, I will help promote FreeBSD in China and also represent the Foundation at conferences and events in my region.</p>
</blockquote>

<ul>
<li>Kylie leads the team the ensures FreeBSD runs well on Hyper-V and Azure, including providing commercial support for customers who run FreeBSD or FreeBSD based appliances on the Azure Cloud</li>
</ul>

<blockquote>
<p>I joined Microsoft and started to lead the project called FreeBSD Integration Service to get FreeBSD running well on Hyper-V and Azure. To promote our work and to understand the FreeBSD ecosystem, I started to participate in FreeBSD events where I was inspired by this technical community.</p>
</blockquote>

<ul>
<li><a href="https://www.freebsdfoundation.org/blog/new-board-member-interview-philip-paeps/" rel="nofollow">Interview with Philip Paeps</a> </li>
<li>Philip started with FreeBSD in the early 2000s and got his commit bit in 2004</li>
</ul>

<blockquote>
<p>The patches I submitted to make ACPI and input devices work on that laptop led to a src commit bit in 2004. While I haven’t worked on ACPI or input devices since, I have been contributing to different areas of the kernel. Taking up maintainership of some ports I cared about also got me a ports commit bit after some time.</p>
</blockquote>

<ul>
<li>Philip will continue to help run EuroBSDCon, but is also spreading the word about FreeBSD in India and Africa</li>
</ul>

<blockquote>
<p>Primarily, I think I can be useful! I attend (and organize) a number of conferences around the world every year, particularly in regions that have a mostly “stealthy” FreeBSD community. While I clearly don’t need to be on the FreeBSD Foundation board to advocate for FreeBSD, joining as a director will provide an additional asset when working in areas of the world where organizational affiliations are meaningful.</p>
</blockquote>

<ul>
<li>Philip has also developed network drivers and various other bits and pieces, and has extensive experience working with and for hardware vendors and appliance vendors</li>
</ul>

<blockquote>
<p>Despite intending to eventually contribute their code to the FreeBSD Project as open source, many hardware vendors still find it very difficult to engage directly with the FreeBSD development community. The Foundation helps bridge that gap and helps facilitate collaboration between commercial vendors and the FreeBSD community.</p>

<p>I hope to make FreeBSD more visible in regions of the world where it is historically under-represented. I expect I will be attending even more conferences and getting myself invited to even more organizations.</p>

<hr>
</blockquote>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/MoreAndUnixFossilization" rel="nofollow">more, less, and a story of typical Unix fossilization</a></h3>

<ul>
<li>Chris Siebenmann from the University of Toronto digs into the history of the difference between ‘less’ and ‘more’</li>
</ul>

<blockquote>
<p>In the beginning, by which we mean V7, Unix didn&#39;t have a pager at all. That was okay; Unix wasn&#39;t very visual in those days, partly because it was still sort of the era of the hard copy terminal. Then along came Berkeley and BSD. People at Berkeley were into CRT terminals, and so BSD Unix gave us things like vi and the first pager program, more (which showed up quite early, in 3BSD, although this isn&#39;t as early as vi, which appears in 2BSD). Calling a pager more is a little bit odd but it&#39;s a Unix type of name and from the beginning more prompted you with &#39;--More--&#39; at the bottom of the screen.</p>

<p>All of the Unix vendors that based their work on BSD Unix (like Sun and DEC) naturally shipped versions of more along with the rest of the BSD programs, and so more spread around the BSD side of things. However, more was by no means the best pager ever; as you might expect, it was actually a bit primitive and lacking in features. So fairly early on Mark Nudelman wrote a pager with somewhat more features and it wound up being called less as somewhat of a joke.</p>

<p>In a sane world, Unix vendors would have either replaced their version of more with the clearly superior less or at least updated their version of more to the 4.3 BSD version. Maybe less wouldn&#39;t have replaced more immediately, but certainly over say the next five years, when it kept on being better and most people kept preferring it when they had a choice.”</p>

<ul>
<li>“This entire history has led to a series of vaguely absurd outcomes on various modern Unixes. On Solaris derivatives more is of course the traditional version with source code that can probably trace itself all the way back to 3BSD, carefully updated to SUS compliance. Solaris would never dream of changing what more is, not even if the replacement is better. Why, it might disturb someone.</li>
</ul>

<p>Oddly, FreeBSD has done the most sensible thing; they&#39;ve outright replaced more with less. There is a /usr/bin/more but it&#39;s the same binary as less and as you can see the more manpage is just the less manpage. OpenBSD has done the same thing but has a specific manpage for more instead of just giving you the less manpage.</p>

<p>So, now you can see why I say that less is more, or more, or both, at several levels. less is certainly more than more, and sometimes less literally is more (or rather more is less, to put it the right way around).</p>

<hr>
</blockquote>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://www.computerworlduk.com/galleries/operating-systems/-free-alternatives-windows-10-3639433/" rel="nofollow">PC-BSD listed in the top 8 &#39;best&#39; alternatives to Windows 10</a> </p></li>
<li><p><a href="http://bsdimp.blogspot.co.uk/2016/08/creating-quick-dns-server-with.html" rel="nofollow">Creating a quick DNS server with a Rapsberry Pi2 and FreeBSD 11.0-RC1</a> </p></li>
<li><p><a href="https://bsdlaptops.wordpress.com/2016/03/07/vaio-pro-11-part-2/" rel="nofollow">Dual Boot OpenBSD and Linux + UEFI</a> </p></li>
<li><p><a href="http://desktopbsd.boards.net/board/10/announcements" rel="nofollow">DesktopBSD 2.0 various versions available (Gnome, Lumina, KDE, LXDE)</a> </p></li>
<li><p>FreeBSD gets new ZFS features including: <a href="https://svnweb.freebsd.org/base?view=revision&revision=305323" rel="nofollow">Compressed ARC </a> and <a href="https://svnweb.freebsd.org/base?view=revision&revision=305331" rel="nofollow">ZFS Allocation Throttle </a> </p></li>
<li><p><a href="https://github.com/user340/fdgw2" rel="nofollow">One Floppy NetBSD Distribution</a></p></li>
<li><p><a href="https://github.com/q5sys/BUGtracker" rel="nofollow">A Compendium of BUGs</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/b7W6NHqs" rel="nofollow"> Galahad - OpenBSD X setup</a> </li>
<li><a href="http://pastebin.com/P4MUs3Pa" rel="nofollow"> Tang - Subtitles</a> </li>
<li><a href="http://pastebin.com/LQ8yTp0G" rel="nofollow"> Ivan - Zpool Options</a> </li>
<li><a href="http://pastebin.com/XTK5gXMU" rel="nofollow"> Brad - Replication Issue</a> </li>
<li><a href="http://pastebin.com/TdYTMSj9" rel="nofollow"> MJ - HBA</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>158: Ham, Radio and Pie (oh my)</title>
  <link>https://www.bsdnow.tv/158</link>
  <guid isPermaLink="false">c0efd5d0-7ebb-4b12-822e-c3b63ad78e1f</guid>
  <pubDate>Wed, 07 Sep 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c0efd5d0-7ebb-4b12-822e-c3b63ad78e1f.mp3" length="78828052" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we’ll be talking to Diane Bruce about using it for Ham Radio Enthusiasts, the RPi3 and much more! That plus all the latest news from the week,</itunes:subtitle>
  <itunes:duration>1:49:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we’ll be talking to Diane Bruce about using it for Ham Radio Enthusiasts, the RPi3 and much more! That plus all the latest news from the week,
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
PC-BSD is now TrueOS (https://www.trueos.org/2016/09/01/pc-bsd-evolves-into-trueos/)
If you’ve been watching this show the past few months, I’ve been dropping little hints about the upcoming rename of PC-BSD -&amp;gt; TrueOS. We’ve made that more official finally, and are asking folks to test out the software before a wider announcement this fall.
For those wondering about the name change, it’s been something discussed over the past few years at different times. With us beginning to move more aggressively with changes for 11.0 (and eventually 12-CURRENT), the time seemed right to have a fresh start, using it as a spring-board to introduce all the changes in both software, and development / release model.
I’ll be discussing more about this shift in a talk at MeetBSD2016 (Another reason for you to go), but here’s some of the highlights.
No longer tied to specific FreeBSD point-releases, TrueOS will instead follow a rolling-release model based upon FreeBSD -CURRENT.
Special tooling and features (Such as boot-environments) make this a feasible option that we didn’t have as easily in the early days of PC-BSD.
In addition, TrueOS builds some things different from vanilla FreeBSD. Specifically Matt Macy’s DRM and Linux Compat work, LibreSSL directly in base, built from External Toolchain (No clang in base system package) and much more. 
New tools have have replaced, and are in the process of replacing the legacy PC-BSD control panel as well, which allows remote operation, either via Qt GUI, or WebSockets / REST API’s. 
I’ll be talking about more as things unfold, but for now please feel free to test and let us have feedback while we push towards a more stable release.
***
The Voicemail Scammers Never Got Past Our OpenBSD Greylisting (http://bsdly.blogspot.com/2016/08/the-voicemail-scammers-never-got-past.html)
Peter Hansteen (That grumpy BSD guy) gives us an interesting look at how their OpenBSD grey-listing prevented spam from ever making it to their inbox.
Specifically it looks like it occurred during Aug 23rd and 24th, with a particularly nasty ransomware payload destined to play havoc with Windows systems.
Peter then walks us through their three-server mail setup, and how spamd is run in greylisting mode on each.
The results? Nothing short of perfection:
   &amp;gt; “From those sources we can see that there were a total of 386 hosts that attempted delivery, to a total of 396 host and target email pairs (annotated here in a .csv file 
with geographic origin according to whois). The interesting part came when I started looking at the mail server logs to see how many had reached the content filtering or had even been passed on in the direction of users' mailboxes. There were none. The number of messages purportedly from voicemail@ in any of the domains we handle that made it even to the content filtering stage was 0. Zero. Not a single one made it through even to content filtering.”
Not bad at all! Looks like spam-trap addresses + grey-listing is the way to go for stopping this kind of foolishness. Checkout Peter’s blog post for more details, but perhaps this will encourage you to setup a similar-type system for your business.
***
FreeBSD on a tiny system; what’s missing (http://adrianchadd.blogspot.com/2016/08/freebsd-on-tiny-system-whats-missing.html)
Adrian Chadd talks about some of the bits that are missing to make FreeBSD truly useful on small embedded devices
Some of this stuff can be done now, but requires more work than it should
“The first is a lack of real service management. FreeBSD doesn't have a service management daemon - the framework assumes that daemons implement their own background and monitoring. It would be much nicer if init or something similar to init could manage services and start/restart them where appropriate.”
Of course, on a system with 32mb of memory, such a service manager would need to be very light weight
“maybe I want to only start telnetd or dropbear/sshd whenever a connection comes in. But I'd also like to be able to add services for monitoring, such as dnsmasq and hostapd.”
telnetd and sshd can be run from inetd, but often depend on special support from the daemon
“The next is a lack of suitable syslog daemon. Yes, I'd like to be able to log some messages locally - even if it's only a couple hundred kilobytes of messages. I'd also like to be able to push messages to a remote service. Unfortunately the FreeBSD syslog daemon doesn't do log rotation or maximum log file sizes itself - it's done by "newsyslog" which runs out of cron. This isn't any good for real embedded systems with limited storage.”
Syslog leaves much to be desired, especially in its configuration syntax, and filtering capabilities. Having it be able to detect with log files have grown beyond a reasonable size and fire off newsyslog would be very interesting
“Then yes, there's a lack of a cron service. It'd be nice to have that integrated into the service management framework so things could be easily added/removed. I may just use cron, but that means cron is also always running which adds memory footprint (~1.3 megabytes) for something that is almost never actually active. When you have 32MB of RAM, that's quite a bit of wasted memory.”
Systems have come back full circle, to where 32MB and 64MB are amounts of memory people expect to work with, while other people still want the system to perform well with 32 or 64 GB of memory
It will be interesting to see how this balancing act plays out, trying to make the same codebase useful for extremely small and extremely large systems at the same time, while also running it on your middle of the road laptop.
***
So I lost my OpenBSD FDE password  (https://blog.filippo.io/so-i-lost-my-openbsd-fde-password/)
“The other day I set up a new OpenBSD instance with a nice RAID array, encrypted with Full Disk Encryption. And promptly proceeded to forget part of the passphrase.”
So they started a little project
Goal: “We need to extract enough info from the encrypted disk and rebuild enough of the decryption algorithm to be able to rapidly try many passphrases.”
The post walks through how they reverse engineered the encryption system from the source code and a hexdump of a small encrypted memory disk
“Now that we know how to extract the data and how to try passphrases against it, it will be trivial to write a bruteforce tool to recover the part of passphrase I forgot.”
So, rather than having to try every possible passphrase, they only had to try fuzzing around the known keyword that was their passphrase.
“UPDATE: I found it! After fixing a bug or two in the brute force tool and almost losing hope, it found the right combination of forgotten word and (Italian) misspelling.”
This work lead to the author recommending that OpenBSD consider strengthening the key derivation algorithm (http://marc.info/?l=openbsd-tech&amp;amp;m=147316661717410&amp;amp;w=2) used in its FDE.
Rather than using a fixed number of rounds (8000 currently), do a small benchmark and determine how much work can be done in a reasonable amount of time
This is what FreeBSD’s GELI FDE does, targeting ‘over 2 million microseconds’ of work. On my desktop i5-3570 this results in 974842 rounds. The number will likely not be the same twice because of minor variations in how long it will take in microseconds.
***
Interview - Diane Bruce - db@freebsd.org (mailto:db@freebsd.org)  / @Dianora_1 (https://twitter.com/Dianora_1)
Ham Radio, RPi3 and more!
News Roundup
See Me &lt;sub&gt;&lt;sup&gt;(Michael W. Lucas)&lt;/sup&gt;&lt;/sub&gt; in 2016 (http://blather.michaelwlucas.com/archives/2739)
Looking for a chance to interact with author Michael W Lucas in meat-space? (That sounds wrong)
If so, he has posted a list of the up-coming conferences he’ll be speaking at, starting with Ohio LinuxFest Oct 7-8, where he’ll be giving an introduction to ZFS talk.
Nov 8th, he’ll also be at MUG (Michigan User Group) giving a PAM talk.
Sadly, no MeetBSD for Michael this year [moment of silence], but if you are able to make it to one of the aforementioned gatherings, be sure to bring your books for autographs. We promise he doesn’t bite. Much.
***
It’s hard work printing nothing (http://www.tedunangst.com/flak/post/its-hard-work-printing-nothing)
“It all starts with a bug report to LibreSSL that the openssl tool crashes when it tries to print NULL. This bug doesn’t manifest on OpenBSD because libc will convert NULL strings to ”(null)” when printing. However, this behavior is not required, and as observed, it’s not universal. When snprintf silently accepts NULL, that simply leads to propagating the error.”
“There’s an argument to be made that silly error messages are better than crashing browsers, but stacking layers of sand seems like a poor means of building robust software in the long term.”
“As soon as development for the next release of OpenBSD restarted, some developers began testing a patch that would remove this crutch from printf.”
If you’d like to help with this work, see our call for volunteers from 2 weeks ago: opportunity to help: %s audit in mandoc  (https://marc.info/?l=openbsd-misc&amp;amp;m=147059272201219&amp;amp;w=2)
Of course, immediately things started to complain. The configure script for talloc does a number of checks (check out the additional interesting observations by TedU here)
“The test checking that our snprintf function conforms to the C99 standard actually contains, at a minimum, 3 deviations from the standard. It should say “Checking for non-conformant vsnprintf”.”
“Of course, we’re dealing with NULL pointers, so all bets are off, but I wonder what people who expect printf NULL to work expect out of strlen? Does it return 0? Does it crash?”
So, talloc decides that the system printf is no good, and it should use its own bundled implementation
“After all the configure testing, eventually the build will fail, because somebody forgot to actually add the replacement object file to the Makefile.”
“If the replacement function has never been used, that’s hardly reassuring that it is actually better tested than the version we have in libc.”
***
Revisiting W^X with OpenBSD 6.0 (http://blog.acumensecurity.net/revisiting-wx-with-openbsd-6-0/)
OpenBSD 6.0 includes enforcement of W^X in user-land
This prevents an application from being able to map a page of memory with both Write and Execute permissions (protecting mmap(2))
Once mapped a page of memory should not be able to have permissions escalated (protecting mprotect(2))
OpenBSD 6.0 enforces the strict W^X definition, and not the PaX/grsec “once write never execute” type of policy
***
OpenBSD imports a letsencrypt client into the base system (http://undeadly.org/cgi?action=article&amp;amp;sid=20160901060733)
We’ve mentioned letskencrypt before (A native C version of the letsencrypt client, developed by Kristaps).
Looks like it’s undergoing a name-change to “acme-client” and has made it’s way into OpenBSD’s base system!
This should ensure first-class support for management of Let’s Encrypt certificates, here’s hoping the portable version continues to thrive as well.
Congrats to Kristaps!
***
Beastie Bits
OpenBSD: Release Songs 6.0: "Goodbye" -- no more CD releases (https://www.openbsd.org/lyrics.html#60f) 
FreeBSD 101 Hacks (https://nanxiao.gitbooks.io/freebsd-101-hacks/content/)
LibreSSL enabled by default in HardenedBSD (https://hardenedbsd.org/article/shawn-webb/2016-08-20/libressl-enabled-default)
DragonflyBSD removes last bits of 32-bit Linux emulation and has no plans to implement 64-bit linux emulation (http://lists.dragonflybsd.org/pipermail/commits/2016-August/624241.html)
OpenBSD has sent 32bit sparc to the great bitbucket in the sky (https://twitter.com/phessler/status/771277693090467840)
Front Range BSD User Group September Meeting (http://slexy.org/view/s2hm4HBkb2)
KnoxBug TrueOS Wrap-up (http://knoxbug.org/content/going-with-the-flow) 
Feedback/Questions
 Cody - TrueOS Questions  (http://pastebin.com/mVK8G1Vr) 
 John - FreeNAS Backups (http://pastebin.com/xsUNUfCS) 
 Herminio - PowerPC + OpenBSD  (http://pastebin.com/nHkWuNkm) 
 Dennis - pmake vs bmake (http://pastebin.com/NAh7r6Ed) 
 Al - Upgrade conflicts (http://pastebin.com/8HaK7yJ6) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we’ll be talking to Diane Bruce about using it for Ham Radio Enthusiasts, the RPi3 and much more! That plus all the latest news from the week,</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.trueos.org/2016/09/01/pc-bsd-evolves-into-trueos/" rel="nofollow">PC-BSD is now TrueOS</a></h3>

<ul>
<li>If you’ve been watching this show the past few months, I’ve been dropping little hints about the upcoming rename of PC-BSD -&gt; TrueOS. We’ve made that more official finally, and are asking folks to test out the software before a wider announcement this fall.</li>
<li>For those wondering about the name change, it’s been something discussed over the past few years at different times. With us beginning to move more aggressively with changes for 11.0 (and eventually 12-CURRENT), the time seemed right to have a fresh start, using it as a spring-board to introduce all the changes in both software, and development / release model.</li>
<li>I’ll be discussing more about this shift in a talk at MeetBSD2016 (Another reason for you to go), but here’s some of the highlights.</li>
<li>No longer tied to specific FreeBSD point-releases, TrueOS will instead follow a rolling-release model based upon FreeBSD -CURRENT.</li>
<li>Special tooling and features (Such as boot-environments) make this a feasible option that we didn’t have as easily in the early days of PC-BSD.</li>
<li>In addition, TrueOS builds some things different from vanilla FreeBSD. Specifically Matt Macy’s DRM and Linux Compat work, LibreSSL directly in base, built from External Toolchain (No clang in base system package) and much more. </li>
<li>New tools have have replaced, and are in the process of replacing the legacy PC-BSD control panel as well, which allows remote operation, either via Qt GUI, or WebSockets / REST API’s. </li>
<li>I’ll be talking about more as things unfold, but for now please feel free to test and let us have feedback while we push towards a more stable release.
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2016/08/the-voicemail-scammers-never-got-past.html" rel="nofollow">The Voicemail Scammers Never Got Past Our OpenBSD Greylisting</a></h3>

<ul>
<li>Peter Hansteen (That grumpy BSD guy) gives us an interesting look at how their OpenBSD grey-listing prevented spam from ever making it to their inbox.</li>
<li>Specifically it looks like it occurred during Aug 23rd and 24th, with a particularly nasty ransomware payload destined to play havoc with Windows systems.</li>
<li>Peter then walks us through their three-server mail setup, and how spamd is run in greylisting mode on each.</li>
<li>The results? Nothing short of perfection:
   &gt; “From those sources we can see that there were a total of 386 hosts that attempted delivery, to a total of 396 host and target email pairs (annotated here in a .csv file 
with geographic origin according to whois). The interesting part came when I started looking at the mail server logs to see how many had reached the content filtering or had even been passed on in the direction of users&#39; mailboxes. There were none. The number of messages purportedly from voicemail@ in any of the domains we handle that made it even to the content filtering stage was 0. Zero. Not a single one made it through even to content filtering.”</li>
<li>Not bad at all! Looks like spam-trap addresses + grey-listing is the way to go for stopping this kind of foolishness. Checkout Peter’s blog post for more details, but perhaps this will encourage you to setup a similar-type system for your business.
***</li>
</ul>

<h3><a href="http://adrianchadd.blogspot.com/2016/08/freebsd-on-tiny-system-whats-missing.html" rel="nofollow">FreeBSD on a tiny system; what’s missing</a></h3>

<ul>
<li>Adrian Chadd talks about some of the bits that are missing to make FreeBSD truly useful on small embedded devices</li>
<li>Some of this stuff can be done now, but requires more work than it should</li>
<li>“The first is a lack of real service management. FreeBSD doesn&#39;t have a service management daemon - the framework assumes that daemons implement their own background and monitoring. It would be much nicer if init or something similar to init could manage services and start/restart them where appropriate.”</li>
<li>Of course, on a system with 32mb of memory, such a service manager would need to be very light weight</li>
<li>“maybe I want to only start telnetd or dropbear/sshd whenever a connection comes in. But I&#39;d also like to be able to add services for monitoring, such as dnsmasq and hostapd.”</li>
<li>telnetd and sshd can be run from inetd, but often depend on special support from the daemon</li>
<li>“The next is a lack of suitable syslog daemon. Yes, I&#39;d like to be able to log some messages locally - even if it&#39;s only a couple hundred kilobytes of messages. I&#39;d also like to be able to push messages to a remote service. Unfortunately the FreeBSD syslog daemon doesn&#39;t do log rotation or maximum log file sizes itself - it&#39;s done by &quot;newsyslog&quot; which runs out of cron. This isn&#39;t any good for real embedded systems with limited storage.”</li>
<li>Syslog leaves much to be desired, especially in its configuration syntax, and filtering capabilities. Having it be able to detect with log files have grown beyond a reasonable size and fire off newsyslog would be very interesting</li>
<li>“Then yes, there&#39;s a lack of a cron service. It&#39;d be nice to have that integrated into the service management framework so things could be easily added/removed. I may just use cron, but that means cron is also always running which adds memory footprint (~1.3 megabytes) for something that is almost never actually active. When you have 32MB of RAM, that&#39;s quite a bit of wasted memory.”</li>
<li>Systems have come back full circle, to where 32MB and 64MB are amounts of memory people expect to work with, while other people still want the system to perform well with 32 or 64 GB of memory</li>
<li>It will be interesting to see how this balancing act plays out, trying to make the same codebase useful for extremely small and extremely large systems at the same time, while also running it on your middle of the road laptop.
***</li>
</ul>

<h3><a href="https://blog.filippo.io/so-i-lost-my-openbsd-fde-password/" rel="nofollow">So I lost my OpenBSD FDE password </a></h3>

<ul>
<li>“The other day I set up a new OpenBSD instance with a nice RAID array, encrypted with Full Disk Encryption. And promptly proceeded to forget part of the passphrase.”</li>
<li>So they started a little project</li>
<li>Goal: “We need to extract enough info from the encrypted disk and rebuild enough of the decryption algorithm to be able to rapidly try many passphrases.”</li>
<li>The post walks through how they reverse engineered the encryption system from the source code and a hexdump of a small encrypted memory disk</li>
<li>“Now that we know how to extract the data and how to try passphrases against it, it will be trivial to write a bruteforce tool to recover the part of passphrase I forgot.”</li>
<li>So, rather than having to try every possible passphrase, they only had to try fuzzing around the known keyword that was their passphrase.</li>
<li>“UPDATE: I found it! After fixing a bug or two in the brute force tool and almost losing hope, it found the right combination of forgotten word and (Italian) misspelling.”</li>
<li>This work lead to the author recommending that OpenBSD consider <a href="http://marc.info/?l=openbsd-tech&m=147316661717410&w=2" rel="nofollow">strengthening the key derivation algorithm</a> used in its FDE.</li>
<li>Rather than using a fixed number of rounds (8000 currently), do a small benchmark and determine how much work can be done in a reasonable amount of time</li>
<li>This is what FreeBSD’s GELI FDE does, targeting ‘over 2 million microseconds’ of work. On my desktop i5-3570 this results in 974842 rounds. The number will likely not be the same twice because of minor variations in how long it will take in microseconds.
***</li>
</ul>

<h2>Interview - Diane Bruce - <a href="mailto:db@freebsd.org" rel="nofollow">db@freebsd.org</a>  / <a href="https://twitter.com/Dianora_1" rel="nofollow">@Dianora_1</a></h2>

<p>Ham Radio, RPi3 and more!</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blather.michaelwlucas.com/archives/2739" rel="nofollow">See Me <sub><sup>(Michael W. Lucas)</sup></sub> in 2016</a></h3>

<ul>
<li>Looking for a chance to interact with author Michael W Lucas in meat-space? (That sounds wrong)</li>
<li>If so, he has posted a list of the up-coming conferences he’ll be speaking at, starting with Ohio LinuxFest Oct 7-8, where he’ll be giving an introduction to ZFS talk.</li>
<li>Nov 8th, he’ll also be at MUG (Michigan User Group) giving a PAM talk.</li>
<li>Sadly, no MeetBSD for Michael this year [moment of silence], but if you are able to make it to one of the aforementioned gatherings, be sure to bring your books for autographs. We promise he doesn’t bite. Much.
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/its-hard-work-printing-nothing" rel="nofollow">It’s hard work printing nothing</a></h3>

<ul>
<li>“It all starts with a bug report to LibreSSL that the openssl tool crashes when it tries to print NULL. This bug doesn’t manifest on OpenBSD because libc will convert NULL strings to ”(null)” when printing. However, this behavior is not required, and as observed, it’s not universal. When snprintf silently accepts NULL, that simply leads to propagating the error.”</li>
<li>“There’s an argument to be made that silly error messages are better than crashing browsers, but stacking layers of sand seems like a poor means of building robust software in the long term.”</li>
<li>“As soon as development for the next release of OpenBSD restarted, some developers began testing a patch that would remove this crutch from printf.”</li>
<li>If you’d like to help with this work, see our call for volunteers from 2 weeks ago: <a href="https://marc.info/?l=openbsd-misc&m=147059272201219&w=2" rel="nofollow">opportunity to help: %s audit in mandoc </a></li>
<li>Of course, immediately things started to complain. The configure script for talloc does a number of checks (check out the additional interesting observations by TedU here)</li>
<li>“The test checking that our snprintf function conforms to the C99 standard actually contains, at a minimum, 3 deviations from the standard. It should say “Checking for non-conformant vsnprintf”.”</li>
<li>“Of course, we’re dealing with NULL pointers, so all bets are off, but I wonder what people who expect printf NULL to work expect out of strlen? Does it return 0? Does it crash?”</li>
<li>So, talloc decides that the system printf is no good, and it should use its own bundled implementation</li>
<li>“After all the configure testing, eventually the build will fail, because somebody forgot to actually add the replacement object file to the Makefile.”</li>
<li>“If the replacement function has never been used, that’s hardly reassuring that it is actually better tested than the version we have in libc.”
***</li>
</ul>

<h3><a href="http://blog.acumensecurity.net/revisiting-wx-with-openbsd-6-0/" rel="nofollow">Revisiting W<sup>X</sup> with OpenBSD 6.0</a></h3>

<ul>
<li>OpenBSD 6.0 includes enforcement of W<sup>X</sup> in user-land</li>
<li>This prevents an application from being able to map a page of memory with both Write and Execute permissions (protecting mmap(2))</li>
<li>Once mapped a page of memory should not be able to have permissions escalated (protecting mprotect(2))</li>
<li>OpenBSD 6.0 enforces the strict W<sup>X</sup> definition, and not the PaX/grsec “once write never execute” type of policy
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160901060733" rel="nofollow">OpenBSD imports a letsencrypt client into the base system</a></h3>

<ul>
<li>We’ve mentioned letskencrypt before (A native C version of the letsencrypt client, developed by Kristaps).</li>
<li>Looks like it’s undergoing a name-change to “acme-client” and has made it’s way into OpenBSD’s base system!</li>
<li>This should ensure first-class support for management of Let’s Encrypt certificates, here’s hoping the portable version continues to thrive as well.</li>
<li>Congrats to Kristaps!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.openbsd.org/lyrics.html#60f" rel="nofollow">OpenBSD: Release Songs 6.0: &quot;Goodbye&quot; -- no more CD releases</a> </p></li>
<li><p><a href="https://nanxiao.gitbooks.io/freebsd-101-hacks/content/" rel="nofollow">FreeBSD 101 Hacks</a></p></li>
<li><p><a href="https://hardenedbsd.org/article/shawn-webb/2016-08-20/libressl-enabled-default" rel="nofollow">LibreSSL enabled by default in HardenedBSD</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-August/624241.html" rel="nofollow">DragonflyBSD removes last bits of 32-bit Linux emulation and has no plans to implement 64-bit linux emulation</a></p></li>
<li><p><a href="https://twitter.com/phessler/status/771277693090467840" rel="nofollow">OpenBSD has sent 32bit sparc to the great bitbucket in the sky</a></p></li>
<li><p><a href="http://slexy.org/view/s2hm4HBkb2" rel="nofollow">Front Range BSD User Group September Meeting</a></p></li>
<li><p><a href="http://knoxbug.org/content/going-with-the-flow" rel="nofollow">KnoxBug TrueOS Wrap-up</a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/mVK8G1Vr" rel="nofollow"> Cody - TrueOS Questions </a> </li>
<li><a href="http://pastebin.com/xsUNUfCS" rel="nofollow"> John - FreeNAS Backups</a> </li>
<li><a href="http://pastebin.com/nHkWuNkm" rel="nofollow"> Herminio - PowerPC + OpenBSD </a> </li>
<li><a href="http://pastebin.com/NAh7r6Ed" rel="nofollow"> Dennis - pmake vs bmake</a> </li>
<li><a href="http://pastebin.com/8HaK7yJ6" rel="nofollow"> Al - Upgrade conflicts</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we’ll be talking to Diane Bruce about using it for Ham Radio Enthusiasts, the RPi3 and much more! That plus all the latest news from the week,</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.trueos.org/2016/09/01/pc-bsd-evolves-into-trueos/" rel="nofollow">PC-BSD is now TrueOS</a></h3>

<ul>
<li>If you’ve been watching this show the past few months, I’ve been dropping little hints about the upcoming rename of PC-BSD -&gt; TrueOS. We’ve made that more official finally, and are asking folks to test out the software before a wider announcement this fall.</li>
<li>For those wondering about the name change, it’s been something discussed over the past few years at different times. With us beginning to move more aggressively with changes for 11.0 (and eventually 12-CURRENT), the time seemed right to have a fresh start, using it as a spring-board to introduce all the changes in both software, and development / release model.</li>
<li>I’ll be discussing more about this shift in a talk at MeetBSD2016 (Another reason for you to go), but here’s some of the highlights.</li>
<li>No longer tied to specific FreeBSD point-releases, TrueOS will instead follow a rolling-release model based upon FreeBSD -CURRENT.</li>
<li>Special tooling and features (Such as boot-environments) make this a feasible option that we didn’t have as easily in the early days of PC-BSD.</li>
<li>In addition, TrueOS builds some things different from vanilla FreeBSD. Specifically Matt Macy’s DRM and Linux Compat work, LibreSSL directly in base, built from External Toolchain (No clang in base system package) and much more. </li>
<li>New tools have have replaced, and are in the process of replacing the legacy PC-BSD control panel as well, which allows remote operation, either via Qt GUI, or WebSockets / REST API’s. </li>
<li>I’ll be talking about more as things unfold, but for now please feel free to test and let us have feedback while we push towards a more stable release.
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2016/08/the-voicemail-scammers-never-got-past.html" rel="nofollow">The Voicemail Scammers Never Got Past Our OpenBSD Greylisting</a></h3>

<ul>
<li>Peter Hansteen (That grumpy BSD guy) gives us an interesting look at how their OpenBSD grey-listing prevented spam from ever making it to their inbox.</li>
<li>Specifically it looks like it occurred during Aug 23rd and 24th, with a particularly nasty ransomware payload destined to play havoc with Windows systems.</li>
<li>Peter then walks us through their three-server mail setup, and how spamd is run in greylisting mode on each.</li>
<li>The results? Nothing short of perfection:
   &gt; “From those sources we can see that there were a total of 386 hosts that attempted delivery, to a total of 396 host and target email pairs (annotated here in a .csv file 
with geographic origin according to whois). The interesting part came when I started looking at the mail server logs to see how many had reached the content filtering or had even been passed on in the direction of users&#39; mailboxes. There were none. The number of messages purportedly from voicemail@ in any of the domains we handle that made it even to the content filtering stage was 0. Zero. Not a single one made it through even to content filtering.”</li>
<li>Not bad at all! Looks like spam-trap addresses + grey-listing is the way to go for stopping this kind of foolishness. Checkout Peter’s blog post for more details, but perhaps this will encourage you to setup a similar-type system for your business.
***</li>
</ul>

<h3><a href="http://adrianchadd.blogspot.com/2016/08/freebsd-on-tiny-system-whats-missing.html" rel="nofollow">FreeBSD on a tiny system; what’s missing</a></h3>

<ul>
<li>Adrian Chadd talks about some of the bits that are missing to make FreeBSD truly useful on small embedded devices</li>
<li>Some of this stuff can be done now, but requires more work than it should</li>
<li>“The first is a lack of real service management. FreeBSD doesn&#39;t have a service management daemon - the framework assumes that daemons implement their own background and monitoring. It would be much nicer if init or something similar to init could manage services and start/restart them where appropriate.”</li>
<li>Of course, on a system with 32mb of memory, such a service manager would need to be very light weight</li>
<li>“maybe I want to only start telnetd or dropbear/sshd whenever a connection comes in. But I&#39;d also like to be able to add services for monitoring, such as dnsmasq and hostapd.”</li>
<li>telnetd and sshd can be run from inetd, but often depend on special support from the daemon</li>
<li>“The next is a lack of suitable syslog daemon. Yes, I&#39;d like to be able to log some messages locally - even if it&#39;s only a couple hundred kilobytes of messages. I&#39;d also like to be able to push messages to a remote service. Unfortunately the FreeBSD syslog daemon doesn&#39;t do log rotation or maximum log file sizes itself - it&#39;s done by &quot;newsyslog&quot; which runs out of cron. This isn&#39;t any good for real embedded systems with limited storage.”</li>
<li>Syslog leaves much to be desired, especially in its configuration syntax, and filtering capabilities. Having it be able to detect with log files have grown beyond a reasonable size and fire off newsyslog would be very interesting</li>
<li>“Then yes, there&#39;s a lack of a cron service. It&#39;d be nice to have that integrated into the service management framework so things could be easily added/removed. I may just use cron, but that means cron is also always running which adds memory footprint (~1.3 megabytes) for something that is almost never actually active. When you have 32MB of RAM, that&#39;s quite a bit of wasted memory.”</li>
<li>Systems have come back full circle, to where 32MB and 64MB are amounts of memory people expect to work with, while other people still want the system to perform well with 32 or 64 GB of memory</li>
<li>It will be interesting to see how this balancing act plays out, trying to make the same codebase useful for extremely small and extremely large systems at the same time, while also running it on your middle of the road laptop.
***</li>
</ul>

<h3><a href="https://blog.filippo.io/so-i-lost-my-openbsd-fde-password/" rel="nofollow">So I lost my OpenBSD FDE password </a></h3>

<ul>
<li>“The other day I set up a new OpenBSD instance with a nice RAID array, encrypted with Full Disk Encryption. And promptly proceeded to forget part of the passphrase.”</li>
<li>So they started a little project</li>
<li>Goal: “We need to extract enough info from the encrypted disk and rebuild enough of the decryption algorithm to be able to rapidly try many passphrases.”</li>
<li>The post walks through how they reverse engineered the encryption system from the source code and a hexdump of a small encrypted memory disk</li>
<li>“Now that we know how to extract the data and how to try passphrases against it, it will be trivial to write a bruteforce tool to recover the part of passphrase I forgot.”</li>
<li>So, rather than having to try every possible passphrase, they only had to try fuzzing around the known keyword that was their passphrase.</li>
<li>“UPDATE: I found it! After fixing a bug or two in the brute force tool and almost losing hope, it found the right combination of forgotten word and (Italian) misspelling.”</li>
<li>This work lead to the author recommending that OpenBSD consider <a href="http://marc.info/?l=openbsd-tech&m=147316661717410&w=2" rel="nofollow">strengthening the key derivation algorithm</a> used in its FDE.</li>
<li>Rather than using a fixed number of rounds (8000 currently), do a small benchmark and determine how much work can be done in a reasonable amount of time</li>
<li>This is what FreeBSD’s GELI FDE does, targeting ‘over 2 million microseconds’ of work. On my desktop i5-3570 this results in 974842 rounds. The number will likely not be the same twice because of minor variations in how long it will take in microseconds.
***</li>
</ul>

<h2>Interview - Diane Bruce - <a href="mailto:db@freebsd.org" rel="nofollow">db@freebsd.org</a>  / <a href="https://twitter.com/Dianora_1" rel="nofollow">@Dianora_1</a></h2>

<p>Ham Radio, RPi3 and more!</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blather.michaelwlucas.com/archives/2739" rel="nofollow">See Me <sub><sup>(Michael W. Lucas)</sup></sub> in 2016</a></h3>

<ul>
<li>Looking for a chance to interact with author Michael W Lucas in meat-space? (That sounds wrong)</li>
<li>If so, he has posted a list of the up-coming conferences he’ll be speaking at, starting with Ohio LinuxFest Oct 7-8, where he’ll be giving an introduction to ZFS talk.</li>
<li>Nov 8th, he’ll also be at MUG (Michigan User Group) giving a PAM talk.</li>
<li>Sadly, no MeetBSD for Michael this year [moment of silence], but if you are able to make it to one of the aforementioned gatherings, be sure to bring your books for autographs. We promise he doesn’t bite. Much.
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/its-hard-work-printing-nothing" rel="nofollow">It’s hard work printing nothing</a></h3>

<ul>
<li>“It all starts with a bug report to LibreSSL that the openssl tool crashes when it tries to print NULL. This bug doesn’t manifest on OpenBSD because libc will convert NULL strings to ”(null)” when printing. However, this behavior is not required, and as observed, it’s not universal. When snprintf silently accepts NULL, that simply leads to propagating the error.”</li>
<li>“There’s an argument to be made that silly error messages are better than crashing browsers, but stacking layers of sand seems like a poor means of building robust software in the long term.”</li>
<li>“As soon as development for the next release of OpenBSD restarted, some developers began testing a patch that would remove this crutch from printf.”</li>
<li>If you’d like to help with this work, see our call for volunteers from 2 weeks ago: <a href="https://marc.info/?l=openbsd-misc&m=147059272201219&w=2" rel="nofollow">opportunity to help: %s audit in mandoc </a></li>
<li>Of course, immediately things started to complain. The configure script for talloc does a number of checks (check out the additional interesting observations by TedU here)</li>
<li>“The test checking that our snprintf function conforms to the C99 standard actually contains, at a minimum, 3 deviations from the standard. It should say “Checking for non-conformant vsnprintf”.”</li>
<li>“Of course, we’re dealing with NULL pointers, so all bets are off, but I wonder what people who expect printf NULL to work expect out of strlen? Does it return 0? Does it crash?”</li>
<li>So, talloc decides that the system printf is no good, and it should use its own bundled implementation</li>
<li>“After all the configure testing, eventually the build will fail, because somebody forgot to actually add the replacement object file to the Makefile.”</li>
<li>“If the replacement function has never been used, that’s hardly reassuring that it is actually better tested than the version we have in libc.”
***</li>
</ul>

<h3><a href="http://blog.acumensecurity.net/revisiting-wx-with-openbsd-6-0/" rel="nofollow">Revisiting W<sup>X</sup> with OpenBSD 6.0</a></h3>

<ul>
<li>OpenBSD 6.0 includes enforcement of W<sup>X</sup> in user-land</li>
<li>This prevents an application from being able to map a page of memory with both Write and Execute permissions (protecting mmap(2))</li>
<li>Once mapped a page of memory should not be able to have permissions escalated (protecting mprotect(2))</li>
<li>OpenBSD 6.0 enforces the strict W<sup>X</sup> definition, and not the PaX/grsec “once write never execute” type of policy
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160901060733" rel="nofollow">OpenBSD imports a letsencrypt client into the base system</a></h3>

<ul>
<li>We’ve mentioned letskencrypt before (A native C version of the letsencrypt client, developed by Kristaps).</li>
<li>Looks like it’s undergoing a name-change to “acme-client” and has made it’s way into OpenBSD’s base system!</li>
<li>This should ensure first-class support for management of Let’s Encrypt certificates, here’s hoping the portable version continues to thrive as well.</li>
<li>Congrats to Kristaps!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.openbsd.org/lyrics.html#60f" rel="nofollow">OpenBSD: Release Songs 6.0: &quot;Goodbye&quot; -- no more CD releases</a> </p></li>
<li><p><a href="https://nanxiao.gitbooks.io/freebsd-101-hacks/content/" rel="nofollow">FreeBSD 101 Hacks</a></p></li>
<li><p><a href="https://hardenedbsd.org/article/shawn-webb/2016-08-20/libressl-enabled-default" rel="nofollow">LibreSSL enabled by default in HardenedBSD</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-August/624241.html" rel="nofollow">DragonflyBSD removes last bits of 32-bit Linux emulation and has no plans to implement 64-bit linux emulation</a></p></li>
<li><p><a href="https://twitter.com/phessler/status/771277693090467840" rel="nofollow">OpenBSD has sent 32bit sparc to the great bitbucket in the sky</a></p></li>
<li><p><a href="http://slexy.org/view/s2hm4HBkb2" rel="nofollow">Front Range BSD User Group September Meeting</a></p></li>
<li><p><a href="http://knoxbug.org/content/going-with-the-flow" rel="nofollow">KnoxBug TrueOS Wrap-up</a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/mVK8G1Vr" rel="nofollow"> Cody - TrueOS Questions </a> </li>
<li><a href="http://pastebin.com/xsUNUfCS" rel="nofollow"> John - FreeNAS Backups</a> </li>
<li><a href="http://pastebin.com/nHkWuNkm" rel="nofollow"> Herminio - PowerPC + OpenBSD </a> </li>
<li><a href="http://pastebin.com/NAh7r6Ed" rel="nofollow"> Dennis - pmake vs bmake</a> </li>
<li><a href="http://pastebin.com/8HaK7yJ6" rel="nofollow"> Al - Upgrade conflicts</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>157: ZFS, The “Universal” File-system</title>
  <link>https://www.bsdnow.tv/157</link>
  <guid isPermaLink="false">b05374fc-d22e-4b78-9784-6e23162191ef</guid>
  <pubDate>Wed, 31 Aug 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b05374fc-d22e-4b78-9784-6e23162191ef.mp3" length="59546452" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we have an interview with Richard Yao, who will be telling us about the experience and challenges of porting ZFS to Linux. That plus the latest news and feedback is coming your way, on your place</itunes:subtitle>
  <itunes:duration>1:22:42</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we have an interview with Richard Yao, who will be telling us about the experience and challenges of porting ZFS to Linux. That plus the latest news and feedback is coming your way, on your place
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Registration for MeetBSD 2016 is now Open  (https://www.meetbsd.com/)
“Beastie’s coming home!” This year, MeetBSD will be held at UC Berkeley’s Clark Kerr Campus
November 11th and 12th, preceded by a two day FreeBSD Vendor/Dev Summit (Nov 9th and 10th)
MeetBSD can be traced back to its humble roots as a local workshop for BSD developers and users, hosted annually in Poland since 2004. Since then, MeetBSD’s popularity has spread, and it’s now widely recognized as its own conference with participants from all over the world.
The US version runs every two years in California since 2008, and now trades off with the east coast vBSDCon which runs on the odd years.
“MeetBSD 2016 uses a mixed unConference format featuring both scheduled talks and community-driven events such as birds-of-a-feather meetings, lightning talks, hackable presentations, stump the chumps, and speed geeking sessions. Speakers are to be determined – stay tuned for more information!”
Register before September 30th, and get $30 off
Kris and I will be there, along with lots of other FreeBSD Developers, Vendors, and Users.
MeetBSD’s unconference style does a very good job of mingling users with developers and is one of my favourite conferences.
***
Dual Booting FreeBSD and Windows UEFI (http://kev009.com/wp/2016/07/freebsd-uefi-root-on-zfs-and-windows-dual-boot/)
Looking to install FreeBSD alongside Windows 10? What happens if that that system is pre-installed and UEFI? Well you could run TrueOS, but if that isn’t your bag and you want vanilla FreeBSD we have you covered this week!
Over on Kevin Bowling’s blog, we have a detailed article showing exactly how to do that.
First up, as prep you’ll need to go into the Windows disk manager and shrink your existing NTFS partition.
You’ll need to next boot FreeBSD 11 or later.
From there the walkthrough takes us through disk partitioning using gpart, and setup of ZFS into a boot-environment friendly layout.
Once you get through the typical FreeBSD setup / extraction, the tutorial gives us a nice bonus, showing how to setup “rEFInd” for a graphical boot-menu. 
A great walkthrough, and hopefully it encourages others to try out dual-booting “EFI-style”.
***
ZFS High-Availability NAS (https://github.com/ewwhite/zfs-ha/wiki)
Interested in a DiY HA ZFS NAS? Edmund White (ewwhite on github) has posted a very detailed look at how he has custom-rolled his own Linux + ZFS + HA setup.
Most of the concepts are already ones used in various other HA products, but it is interesting and informative to see a public detailed look at how ZFS and HA works.
In particular this setup require some very specific hardware, such as dual-port SAS drives, so you will have to pre-plan according.
The only bummer is this is a ZFS on Linux setup. Maybe this can serve as the guide / inspiration for somebody in our community to do their own FreeBSD + HA + ZFS setup and blog about it in similar detail.
***
First public release of chyves - version 0.1.0 (http://chyves.org/)
As bhyve continues to mature we are seeing tooling evolve around it. Enter ‘chyves’ which started life as a fork of iohyve.
We are looking to do an interview with the author in the near future, but we still want to bring you some of the new features / changes in this evolution of bhyve management.
First up, nearly every function from iohyve has either been re-written in part or full.
Among the new features, a full logging system (master and per-vm logs), multiple pool configurations, properties stored outside of ZFS (for speed) and self-upgrading. (Will that work with pkg’d version?)
In addition to the above features, the website has a large chart showing the original ‘iohyve’ commands, and how that usage has changed moving to chyves. 
Give it a spin, let the author know of issues!
***
Interview - Richard Yao - ryao@gentoo.org (mailto:ryao@gentoo.org)
Sr. Kernel Engineer at ClusterHQ - Major Contributor to ZFS on Linux
News Roundup
ZFS Deadlock: 'Directory of Death' (http://lists.freebsd.org/pipermail/freebsd-hackers/2016-July/049740.html)
A user reports that when they try to install npm (the Node.js package manager), their system deadlocks
It turns out, this was also hitting the FreeBSD package building machines
PR 209158  (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209158) 
The problem was a race condition in the way renames are handled in the FreeBSD VFS vs how ZFS does them internally
This bug has existed since the original import of ZFS, but some other change caused it to happen much more frequently
“ZFS POSIX Layer is originally written for Solaris VFS which is very different from FreeBSD VFS.  Most importantly many things that FreeBSD VFS manages on behalf of all filesystems are implemented in ZPL in a different Way. Thus, ZPL contains code that is redundant on FreeBSD or duplicates VFS functionality or, in the worst cases, badly interacts / interferes with VFS.”
“The most prominent problem is a deadlock caused by the lock order reversal of vnode locks that may happen with concurrent zfsrename() and lookup(). The deadlock is a result of zfsrename() not observing the vnode locking contract expected by VFS.”
The fixes have been merged to the 10.x and 11.x branches
***
New BSD Magazine out (2016-07) (https://bsdmag.org/download/implementing-memory-cache-beast-architecture/)
Articles include: Implementing in-memory cache in the BeaST architecture, Docker Cleanup, FreeNAS Getting Started Guide, and starting at the very beginning with open source
The August issue is also out  (https://bsdmag.org/download/minix-3-free-open-source-operating-system-highly-reliable-flexible-secure/)
This issue features two articles about MINIX 3, continues the FreeNAS getting started guide, Optimizes the in-memory cache for the BeaST architecture, and talks about fixing failed ports for Hardened and LibreBSD
We hope to have an interview with the creator of the BeaST architecture in the coming weeks
***
DragonflyBSD and UEFI (http://lists.dragonflybsd.org/pipermail/users/2016-July/270796.html)
We’ve featured a few stories and walkthroughs about using UEFI to dual-boot BSD, and now its Dragonfly BSD’s turn.
Dave McFarlane writes into the DF mailing lists, telling us about the specific steps taken to get UEFI installed and boot-strapped on his system.
If you’ve done a FreeBSD manual UEFI install, the process looks very similar, but you will end up manually running ‘gpt’ to create partitions, installing dist files, and eventually installing boot1.efi into the FAT EFI partition.
Dave also ran into an issue with resulted in no /etc/fstab being present, and helpfully includes what his system needed to fully boot hammer properly.
Somebody should document this fully for DFLY, since I would expect to become more commonplace as commodity hardware is shipped with UEFI on by default.
***
Netflix and Fill  (http://techblog.netflix.com/2016/08/netflix-and-fill.html)
The Netflix team has produced a technical blog post describing how their OpenConnect appliances work
First the content is received from the content provider, and the Netflix content team makes it ready for deployment, by transcoding the various bitrates, packaging the subtitles, etc.
The finished files are then pushed to Amazon S3 storage
“We deploy the majority of our updates proactively during configured fill windows. An important difference between our OpenConnect CDN and other commercial CDNs is the concept of proactive caching. Because we can predict with high accuracy what our members will watch and what time of day they will watch it, we can make use of non-peak bandwidth to download most of the content updates to the OCAs in our network during these configurable time windows. By reducing disk reads (content serving) while we are performing disk writes (adding new content to the OCAs), we are able to optimize our disk efficiency by avoiding read/write contention. The predictability of off-peak traffic patterns helps with this optimization, but we still only have a finite amount of time every day to get our content pre-positioned to where it needs to be before our traffic starts to ramp up and we want to make all of the OCA capacity available for content serving.”
The OCA may actually contain more than one copy of the same video, because each disk in the OCA is independent, storing the same video on two different disks will provide twice the available read bandwidth
Normally the filesystem cache would obviate the need for this, but the Netflix OCA has so much storage, and not a lot of memory, and the requests from users are offset enough that the cache is useless
“OCAs communicate at regular intervals with the control plane services, requesting (among other things) a manifest file that contains the list of titles they should be storing and serving to members. If there is a delta between the list of titles in the manifest and what they are currently storing, each OCA will send a request, during its configured fill window, that includes a list of the new or updated titles that it needs. The response from the control plane in AWS is a ranked list of potential download locations, aka fill sources, for each title.”
“It would be inefficient, in terms of both time and cost, to distribute a title directly from S3 to all of our OCAs, so we use a tiered approach. The goal is to ensure that the title is passed from one part of our network to another using the most efficient route possible.”
The article then goes on to explain how they calculate the least cost filling source
“Now that Netflix operates in 190 countries and we have thousands of appliances embedded within many ISP networks around the world, we are even more obsessed with making sure that our OCAs get the latest content as quickly as possible while continuing to minimize bandwidth cost to our ISP partners.”
***
Beastie Bits:
Cover reveal for “PAM Mastery” (http://blather.michaelwlucas.com/archives/2734)
LibertyBSD 5.9 is out - looking for mirrors (http://libertybsd.net/download.html)
Unix for Poets (https://web.stanford.edu/class/cs124/lec/124-UnixForPoets.pdf)
Feedback/Questions
 Chuck / Ingo - Get Involved (http://pastebin.com/ksq0rfph) 
 Oskar - Thanks (http://pastebin.com/YqzcHEMg) 
 Alex - SMF (http://pastebin.com/WvdVZbYc) 
 Raymond - RPI3 (http://pastebin.com/JPWgzSGv) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we have an interview with Richard Yao, who will be telling us about the experience and challenges of porting ZFS to Linux. That plus the latest news and feedback is coming your way, on your place</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img <br>
src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" <br>
/></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.meetbsd.com/" rel="nofollow">Registration for MeetBSD 2016 is now Open </a></h3>

<ul>
<li>“Beastie’s coming home!” This year, MeetBSD will be held at UC Berkeley’s Clark Kerr Campus</li>
<li>November 11th and 12th, preceded by a two day FreeBSD Vendor/Dev Summit (Nov 9th and 10th)</li>
</ul>

<blockquote>
<p>MeetBSD can be traced back to its humble roots as a local workshop for BSD developers and users, hosted annually in Poland since 2004. Since then, MeetBSD’s popularity has spread, and it’s now widely recognized as its own conference with participants from all over the world.</p>
</blockquote>

<ul>
<li>The US version runs every two years in California since 2008, and now trades off with the east coast vBSDCon which runs on the odd years.</li>
<li>“MeetBSD 2016 uses a mixed unConference format featuring both scheduled talks and community-driven events such as birds-of-a-feather meetings, lightning talks, hackable presentations, stump the chumps, and speed geeking sessions. Speakers are to be determined – stay tuned for more information!”</li>
<li>Register before September 30th, and get $30 off</li>
<li>Kris and I will be there, along with lots of other FreeBSD Developers, Vendors, and Users.</li>
<li>MeetBSD’s unconference style does a very good job of mingling users with developers and is one of my favourite conferences.
***</li>
</ul>

<h3><a href="http://kev009.com/wp/2016/07/freebsd-uefi-root-on-zfs-and-windows-dual-boot/" rel="nofollow">Dual Booting FreeBSD and Windows UEFI</a></h3>

<ul>
<li>Looking to install FreeBSD alongside Windows 10? What happens if that that system is pre-installed and UEFI? Well you could run TrueOS, but if that isn’t your bag and you want vanilla FreeBSD we have you covered this week!</li>
<li>Over on Kevin Bowling’s blog, we have a detailed article showing exactly how to do that.</li>
<li>First up, as prep you’ll need to go into the Windows disk manager and shrink your existing NTFS partition.</li>
<li>You’ll need to next boot FreeBSD 11 or later.</li>
<li>From there the walkthrough takes us through disk partitioning using gpart, and setup of ZFS into a boot-environment friendly layout.</li>
<li>Once you get through the typical FreeBSD setup / extraction, the tutorial gives us a nice bonus, showing how to setup “rEFInd” for a graphical boot-menu. </li>
<li>A great walkthrough, and hopefully it encourages others to try out dual-booting “EFI-style”.
***</li>
</ul>

<h3><a href="https://github.com/ewwhite/zfs-ha/wiki" rel="nofollow">ZFS High-Availability NAS</a></h3>

<ul>
<li>Interested in a DiY HA ZFS NAS? Edmund White (ewwhite on github) has posted a very detailed look at how he has custom-rolled his own Linux + ZFS + HA setup.</li>
<li>Most of the concepts are already ones used in various other HA products, but it is interesting and informative to see a public detailed look at how ZFS and HA works.</li>
<li>In particular this setup require some very specific hardware, such as dual-port SAS drives, so you will have to pre-plan according.</li>
<li>The only bummer is this is a ZFS on Linux setup. Maybe this can serve as the guide / inspiration for somebody in our community to do their own FreeBSD + HA + ZFS setup and blog about it in similar detail.
***</li>
</ul>

<h3><a href="http://chyves.org/" rel="nofollow">First public release of chyves - version 0.1.0</a></h3>

<ul>
<li>As bhyve continues to mature we are seeing tooling evolve around it. Enter ‘chyves’ which started life as a fork of iohyve.</li>
<li>We are looking to do an interview with the author in the near future, but we still want to bring you some of the new features / changes in this evolution of bhyve management.</li>
<li>First up, nearly every function from iohyve has either been re-written in part or full.</li>
<li>Among the new features, a full logging system (master and per-vm logs), multiple pool configurations, properties stored outside of ZFS (for speed) and self-upgrading. (Will that work with pkg’d version?)</li>
<li>In addition to the above features, the website has a large chart showing the original ‘iohyve’ commands, and how that usage has changed moving to chyves. </li>
<li>Give it a spin, let the author know of issues!
***</li>
</ul>

<h2>Interview - Richard Yao - <a href="mailto:ryao@gentoo.org" rel="nofollow">ryao@gentoo.org</a></h2>

<p>Sr. Kernel Engineer at ClusterHQ - Major Contributor to ZFS on Linux</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://lists.freebsd.org/pipermail/freebsd-hackers/2016-July/049740.html" rel="nofollow">ZFS Deadlock: &#39;Directory of Death&#39;</a></h3>

<ul>
<li>A user reports that when they try to install npm (the Node.js package manager), their system deadlocks</li>
<li>It turns out, this was also hitting the FreeBSD package building machines</li>
<li><a href="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209158" rel="nofollow">PR 209158 </a> </li>
<li>The problem was a race condition in the way renames are handled in the FreeBSD VFS vs how ZFS does them internally</li>
<li>This bug has existed since the original import of ZFS, but some other change caused it to happen much more frequently</li>
<li>“ZFS POSIX Layer is originally written for Solaris VFS which is very different from FreeBSD VFS.  Most importantly many things that FreeBSD VFS manages on behalf of all filesystems are implemented in ZPL in a different Way. Thus, ZPL contains code that is redundant on FreeBSD or duplicates VFS functionality or, in the worst cases, badly interacts / interferes with VFS.”</li>
<li>“The most prominent problem is a deadlock caused by the lock order reversal of vnode locks that may happen with concurrent zfs_rename() and lookup(). The deadlock is a result of zfs_rename() not observing the vnode locking contract expected by VFS.”</li>
<li>The fixes have been merged to the 10.x and 11.x branches
***</li>
</ul>

<h3><a href="https://bsdmag.org/download/implementing-memory-cache-beast-architecture/" rel="nofollow">New BSD Magazine out (2016-07)</a></h3>

<ul>
<li>Articles include: Implementing in-memory cache in the BeaST architecture, Docker Cleanup, FreeNAS Getting Started Guide, and starting at the very beginning with open source</li>
<li><a href="https://bsdmag.org/download/minix-3-free-open-source-operating-system-highly-reliable-flexible-secure/" rel="nofollow">The August issue is also out </a></li>
<li>This issue features two articles about MINIX 3, continues the FreeNAS getting started guide, Optimizes the in-memory cache for the BeaST architecture, and talks about fixing failed ports for Hardened and LibreBSD</li>
<li>We hope to have an interview with the creator of the BeaST architecture in the coming weeks
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2016-July/270796.html" rel="nofollow">DragonflyBSD and UEFI</a></h3>

<ul>
<li>We’ve featured a few stories and walkthroughs about using UEFI to dual-boot BSD, and now its Dragonfly BSD’s turn.</li>
<li>Dave McFarlane writes into the DF mailing lists, telling us about the specific steps taken to get UEFI installed and boot-strapped on his system.</li>
<li>If you’ve done a FreeBSD manual UEFI install, the process looks very similar, but you will end up manually running ‘gpt’ to create partitions, installing dist files, and eventually installing boot1.efi into the FAT EFI partition.</li>
<li>Dave also ran into an issue with resulted in no /etc/fstab being present, and helpfully includes what his system needed to fully boot hammer properly.</li>
<li>Somebody should document this fully for DFLY, since I would expect to become more commonplace as commodity hardware is shipped with UEFI on by default.
***</li>
</ul>

<h3><a href="http://techblog.netflix.com/2016/08/netflix-and-fill.html" rel="nofollow">Netflix and Fill </a></h3>

<ul>
<li>The Netflix team has produced a technical blog post describing how their OpenConnect appliances work</li>
<li>First the content is received from the content provider, and the Netflix content team makes it ready for deployment, by transcoding the various bitrates, packaging the subtitles, etc.</li>
<li>The finished files are then pushed to Amazon S3 storage</li>
<li>“We deploy the majority of our updates proactively during configured fill windows. An important difference between our OpenConnect CDN and other commercial CDNs is the concept of proactive caching. Because we can predict with high accuracy what our members will watch and what time of day they will watch it, we can make use of non-peak bandwidth to download most of the content updates to the OCAs in our network during these configurable time windows. By reducing disk reads (content serving) while we are performing disk writes (adding new content to the OCAs), we are able to optimize our disk efficiency by avoiding read/write contention. The predictability of off-peak traffic patterns helps with this optimization, but we still only have a finite amount of time every day to get our content pre-positioned to where it needs to be before our traffic starts to ramp up and we want to make all of the OCA capacity available for content serving.”</li>
<li>The OCA may actually contain more than one copy of the same video, because each disk in the OCA is independent, storing the same video on two different disks will provide twice the available read bandwidth</li>
<li>Normally the filesystem cache would obviate the need for this, but the Netflix OCA has so much storage, and not a lot of memory, and the requests from users are offset enough that the cache is useless</li>
<li>“OCAs communicate at regular intervals with the control plane services, requesting (among other things) a manifest file that contains the list of titles they should be storing and serving to members. If there is a delta between the list of titles in the manifest and what they are currently storing, each OCA will send a request, during its configured fill window, that includes a list of the new or updated titles that it needs. The response from the control plane in AWS is a ranked list of potential download locations, aka fill sources, for each title.”</li>
<li>“It would be inefficient, in terms of both time and cost, to distribute a title directly from S3 to all of our OCAs, so we use a tiered approach. The goal is to ensure that the title is passed from one part of our network to another using the most efficient route possible.”</li>
<li>The article then goes on to explain how they calculate the least cost filling source</li>
<li>“Now that Netflix operates in 190 countries and we have thousands of appliances embedded within many ISP networks around the world, we are even more obsessed with making sure that our OCAs get the latest content as quickly as possible while continuing to minimize bandwidth cost to our ISP partners.”
***</li>
</ul>

<h2>Beastie Bits:</h2>

<ul>
<li><a href="http://blather.michaelwlucas.com/archives/2734" rel="nofollow">Cover reveal for “PAM Mastery”</a></li>
<li><a href="http://libertybsd.net/download.html" rel="nofollow">LibertyBSD 5.9 is out - looking for mirrors</a></li>
<li><a href="https://web.stanford.edu/class/cs124/lec/124-UnixForPoets.pdf" rel="nofollow">Unix for Poets</a></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/ksq0rfph" rel="nofollow"> Chuck / Ingo - Get Involved</a> </li>
<li><a href="http://pastebin.com/YqzcHEMg" rel="nofollow"> Oskar - Thanks</a> </li>
<li><a href="http://pastebin.com/WvdVZbYc" rel="nofollow"> Alex - SMF</a> </li>
<li><a href="http://pastebin.com/JPWgzSGv" rel="nofollow"> Raymond - RPI3</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we have an interview with Richard Yao, who will be telling us about the experience and challenges of porting ZFS to Linux. That plus the latest news and feedback is coming your way, on your place</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img <br>
src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" <br>
/></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.meetbsd.com/" rel="nofollow">Registration for MeetBSD 2016 is now Open </a></h3>

<ul>
<li>“Beastie’s coming home!” This year, MeetBSD will be held at UC Berkeley’s Clark Kerr Campus</li>
<li>November 11th and 12th, preceded by a two day FreeBSD Vendor/Dev Summit (Nov 9th and 10th)</li>
</ul>

<blockquote>
<p>MeetBSD can be traced back to its humble roots as a local workshop for BSD developers and users, hosted annually in Poland since 2004. Since then, MeetBSD’s popularity has spread, and it’s now widely recognized as its own conference with participants from all over the world.</p>
</blockquote>

<ul>
<li>The US version runs every two years in California since 2008, and now trades off with the east coast vBSDCon which runs on the odd years.</li>
<li>“MeetBSD 2016 uses a mixed unConference format featuring both scheduled talks and community-driven events such as birds-of-a-feather meetings, lightning talks, hackable presentations, stump the chumps, and speed geeking sessions. Speakers are to be determined – stay tuned for more information!”</li>
<li>Register before September 30th, and get $30 off</li>
<li>Kris and I will be there, along with lots of other FreeBSD Developers, Vendors, and Users.</li>
<li>MeetBSD’s unconference style does a very good job of mingling users with developers and is one of my favourite conferences.
***</li>
</ul>

<h3><a href="http://kev009.com/wp/2016/07/freebsd-uefi-root-on-zfs-and-windows-dual-boot/" rel="nofollow">Dual Booting FreeBSD and Windows UEFI</a></h3>

<ul>
<li>Looking to install FreeBSD alongside Windows 10? What happens if that that system is pre-installed and UEFI? Well you could run TrueOS, but if that isn’t your bag and you want vanilla FreeBSD we have you covered this week!</li>
<li>Over on Kevin Bowling’s blog, we have a detailed article showing exactly how to do that.</li>
<li>First up, as prep you’ll need to go into the Windows disk manager and shrink your existing NTFS partition.</li>
<li>You’ll need to next boot FreeBSD 11 or later.</li>
<li>From there the walkthrough takes us through disk partitioning using gpart, and setup of ZFS into a boot-environment friendly layout.</li>
<li>Once you get through the typical FreeBSD setup / extraction, the tutorial gives us a nice bonus, showing how to setup “rEFInd” for a graphical boot-menu. </li>
<li>A great walkthrough, and hopefully it encourages others to try out dual-booting “EFI-style”.
***</li>
</ul>

<h3><a href="https://github.com/ewwhite/zfs-ha/wiki" rel="nofollow">ZFS High-Availability NAS</a></h3>

<ul>
<li>Interested in a DiY HA ZFS NAS? Edmund White (ewwhite on github) has posted a very detailed look at how he has custom-rolled his own Linux + ZFS + HA setup.</li>
<li>Most of the concepts are already ones used in various other HA products, but it is interesting and informative to see a public detailed look at how ZFS and HA works.</li>
<li>In particular this setup require some very specific hardware, such as dual-port SAS drives, so you will have to pre-plan according.</li>
<li>The only bummer is this is a ZFS on Linux setup. Maybe this can serve as the guide / inspiration for somebody in our community to do their own FreeBSD + HA + ZFS setup and blog about it in similar detail.
***</li>
</ul>

<h3><a href="http://chyves.org/" rel="nofollow">First public release of chyves - version 0.1.0</a></h3>

<ul>
<li>As bhyve continues to mature we are seeing tooling evolve around it. Enter ‘chyves’ which started life as a fork of iohyve.</li>
<li>We are looking to do an interview with the author in the near future, but we still want to bring you some of the new features / changes in this evolution of bhyve management.</li>
<li>First up, nearly every function from iohyve has either been re-written in part or full.</li>
<li>Among the new features, a full logging system (master and per-vm logs), multiple pool configurations, properties stored outside of ZFS (for speed) and self-upgrading. (Will that work with pkg’d version?)</li>
<li>In addition to the above features, the website has a large chart showing the original ‘iohyve’ commands, and how that usage has changed moving to chyves. </li>
<li>Give it a spin, let the author know of issues!
***</li>
</ul>

<h2>Interview - Richard Yao - <a href="mailto:ryao@gentoo.org" rel="nofollow">ryao@gentoo.org</a></h2>

<p>Sr. Kernel Engineer at ClusterHQ - Major Contributor to ZFS on Linux</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://lists.freebsd.org/pipermail/freebsd-hackers/2016-July/049740.html" rel="nofollow">ZFS Deadlock: &#39;Directory of Death&#39;</a></h3>

<ul>
<li>A user reports that when they try to install npm (the Node.js package manager), their system deadlocks</li>
<li>It turns out, this was also hitting the FreeBSD package building machines</li>
<li><a href="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209158" rel="nofollow">PR 209158 </a> </li>
<li>The problem was a race condition in the way renames are handled in the FreeBSD VFS vs how ZFS does them internally</li>
<li>This bug has existed since the original import of ZFS, but some other change caused it to happen much more frequently</li>
<li>“ZFS POSIX Layer is originally written for Solaris VFS which is very different from FreeBSD VFS.  Most importantly many things that FreeBSD VFS manages on behalf of all filesystems are implemented in ZPL in a different Way. Thus, ZPL contains code that is redundant on FreeBSD or duplicates VFS functionality or, in the worst cases, badly interacts / interferes with VFS.”</li>
<li>“The most prominent problem is a deadlock caused by the lock order reversal of vnode locks that may happen with concurrent zfs_rename() and lookup(). The deadlock is a result of zfs_rename() not observing the vnode locking contract expected by VFS.”</li>
<li>The fixes have been merged to the 10.x and 11.x branches
***</li>
</ul>

<h3><a href="https://bsdmag.org/download/implementing-memory-cache-beast-architecture/" rel="nofollow">New BSD Magazine out (2016-07)</a></h3>

<ul>
<li>Articles include: Implementing in-memory cache in the BeaST architecture, Docker Cleanup, FreeNAS Getting Started Guide, and starting at the very beginning with open source</li>
<li><a href="https://bsdmag.org/download/minix-3-free-open-source-operating-system-highly-reliable-flexible-secure/" rel="nofollow">The August issue is also out </a></li>
<li>This issue features two articles about MINIX 3, continues the FreeNAS getting started guide, Optimizes the in-memory cache for the BeaST architecture, and talks about fixing failed ports for Hardened and LibreBSD</li>
<li>We hope to have an interview with the creator of the BeaST architecture in the coming weeks
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2016-July/270796.html" rel="nofollow">DragonflyBSD and UEFI</a></h3>

<ul>
<li>We’ve featured a few stories and walkthroughs about using UEFI to dual-boot BSD, and now its Dragonfly BSD’s turn.</li>
<li>Dave McFarlane writes into the DF mailing lists, telling us about the specific steps taken to get UEFI installed and boot-strapped on his system.</li>
<li>If you’ve done a FreeBSD manual UEFI install, the process looks very similar, but you will end up manually running ‘gpt’ to create partitions, installing dist files, and eventually installing boot1.efi into the FAT EFI partition.</li>
<li>Dave also ran into an issue with resulted in no /etc/fstab being present, and helpfully includes what his system needed to fully boot hammer properly.</li>
<li>Somebody should document this fully for DFLY, since I would expect to become more commonplace as commodity hardware is shipped with UEFI on by default.
***</li>
</ul>

<h3><a href="http://techblog.netflix.com/2016/08/netflix-and-fill.html" rel="nofollow">Netflix and Fill </a></h3>

<ul>
<li>The Netflix team has produced a technical blog post describing how their OpenConnect appliances work</li>
<li>First the content is received from the content provider, and the Netflix content team makes it ready for deployment, by transcoding the various bitrates, packaging the subtitles, etc.</li>
<li>The finished files are then pushed to Amazon S3 storage</li>
<li>“We deploy the majority of our updates proactively during configured fill windows. An important difference between our OpenConnect CDN and other commercial CDNs is the concept of proactive caching. Because we can predict with high accuracy what our members will watch and what time of day they will watch it, we can make use of non-peak bandwidth to download most of the content updates to the OCAs in our network during these configurable time windows. By reducing disk reads (content serving) while we are performing disk writes (adding new content to the OCAs), we are able to optimize our disk efficiency by avoiding read/write contention. The predictability of off-peak traffic patterns helps with this optimization, but we still only have a finite amount of time every day to get our content pre-positioned to where it needs to be before our traffic starts to ramp up and we want to make all of the OCA capacity available for content serving.”</li>
<li>The OCA may actually contain more than one copy of the same video, because each disk in the OCA is independent, storing the same video on two different disks will provide twice the available read bandwidth</li>
<li>Normally the filesystem cache would obviate the need for this, but the Netflix OCA has so much storage, and not a lot of memory, and the requests from users are offset enough that the cache is useless</li>
<li>“OCAs communicate at regular intervals with the control plane services, requesting (among other things) a manifest file that contains the list of titles they should be storing and serving to members. If there is a delta between the list of titles in the manifest and what they are currently storing, each OCA will send a request, during its configured fill window, that includes a list of the new or updated titles that it needs. The response from the control plane in AWS is a ranked list of potential download locations, aka fill sources, for each title.”</li>
<li>“It would be inefficient, in terms of both time and cost, to distribute a title directly from S3 to all of our OCAs, so we use a tiered approach. The goal is to ensure that the title is passed from one part of our network to another using the most efficient route possible.”</li>
<li>The article then goes on to explain how they calculate the least cost filling source</li>
<li>“Now that Netflix operates in 190 countries and we have thousands of appliances embedded within many ISP networks around the world, we are even more obsessed with making sure that our OCAs get the latest content as quickly as possible while continuing to minimize bandwidth cost to our ISP partners.”
***</li>
</ul>

<h2>Beastie Bits:</h2>

<ul>
<li><a href="http://blather.michaelwlucas.com/archives/2734" rel="nofollow">Cover reveal for “PAM Mastery”</a></li>
<li><a href="http://libertybsd.net/download.html" rel="nofollow">LibertyBSD 5.9 is out - looking for mirrors</a></li>
<li><a href="https://web.stanford.edu/class/cs124/lec/124-UnixForPoets.pdf" rel="nofollow">Unix for Poets</a></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/ksq0rfph" rel="nofollow"> Chuck / Ingo - Get Involved</a> </li>
<li><a href="http://pastebin.com/YqzcHEMg" rel="nofollow"> Oskar - Thanks</a> </li>
<li><a href="http://pastebin.com/WvdVZbYc" rel="nofollow"> Alex - SMF</a> </li>
<li><a href="http://pastebin.com/JPWgzSGv" rel="nofollow"> Raymond - RPI3</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>156: The Fresh BSD experience</title>
  <link>https://www.bsdnow.tv/156</link>
  <guid isPermaLink="false">b9e388cd-9daa-4d62-9422-394e403bc03e</guid>
  <pubDate>Wed, 24 Aug 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b9e388cd-9daa-4d62-9422-394e403bc03e.mp3" length="63828148" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, Allan is back from his UK trip and we’ll get to hear his thoughts on the developer summit. That plus all the</itunes:subtitle>
  <itunes:duration>1:28:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, Allan is back from his UK trip and we’ll get to hear his thoughts on the developer summit. That plus all the
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for 
Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly 
Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD 11.0-RC1 Available (https://lists.freebsd.org/pipermail/freebsd-stable/2016-August/085277.html)
FreeBSD is marching onwards to 11.0, and with it the first RC1 was released. In addition to the usual amd64 architectures, you may want to give it 
a whirl on your various ARM boards as well, as it includes images for the following systems:
11.0-RC1 amd64 GENERIC
11.0-RC1 i386 GENERIC
11.0-RC1 powerpc GENERIC
11.0-RC1 powerpc64 GENERIC64
11.0-RC1 sparc64 GENERIC
11.0-RC1 armv6 BANANAPI
11.0-RC1 armv6 BEAGLEBONE
11.0-RC1 armv6 CUBIEBOARD
11.0-RC1 armv6 CUBIEBOARD2
11.0-RC1 armv6 CUBOX-HUMMINGBOARD
11.0-RC1 armv6 GUMSTIX
11.0-RC1 armv6 RPI-B
11.0-RC1 armv6 RPI2
11.0-RC1 armv6 PANDABOARD
11.0-RC1 armv6 WANDBOARD
11.0-RC1 aarch64 GENERIC
For those wondering the list of changes between this and BETA4, we have that as well:
A NULL pointer dereference in IPSEC has been fixed.
Support for SSH Protocol 1 has been removed.
OpenSSH DSA keys have been disabled by default.  Users upgrading from
prior FreeBSD versions are urged to update their SSH keys to RSA or
ECDSA keys before upgrading to 11.0-RC1.
PCI-e hotplug on bridges with power controllers has been disabled.
A loader tunable (hw.pci.enablepciehp) to disable PCI-e HotPlug has
been added.
A VESA panic on suspend has been fixed.
Google Compute Engine image publication has been fixed.
An AES-ICM heap corruption typo bug has been fixed.
A regression in pf.conf while parsing the 'interval' keyword has been
fixed.
A ZFS/VFS deadlock has been fixed.
RC2 is delayed while some issues are sorted out  (https://lists.freebsd.org/pipermail/freebsd-stable/2016-August/085323.html)
RC2 is looming large, but was pushed back a few days while the following bugs are sorted out:
Issue with IPv6 UDP traffic being sent from wrong MAC address
Layer2 violation with IPv6
***
OpenBSD just added initial support for the RaspberryPi 2 and 3 devices (https://marc.info/?l=openbsd-cvs&amp;amp;m=147059203101111&amp;amp;w=2)
It’s a good time to be an ARM and BSD enthusiast. In addition to all the ARM images in FreeBSD 11.0, we also have word that initial support for RPi2 and RPi3 has started to land in OpenBSD.
Mark Kettenis has posted the following with his Commit:
Initial support for Raspberry Pi 2/3.  All the hard work done by patrick@, I just cleaned things up a bit.  Any bugs introduced in that process are entirely mine.
This doesn't work yet.  But when it does, you'll need recent firmware from the Raspberry Pi Foundation git repository at:
https://github.com/raspberrypi/firmware
The device tree for the Raspberry Pi is somewhat in flux as bits and pieces to support the Raspberry Pi 2 and 3 are committed to the mainline Linux kernel.“
+ Exciting news! We will of course keep you informed as to when we have images to play with. Running OpenBSD / PF on a RPi does sound intriguing.
drm-4.8-rc2 tagged in drm-next (https://lists.freebsd.org/pipermail/freebsd-x11/2016-August/017840.html)
Remember when FreeBSD lagged so far behind in Graphics support? Well, those days are rapidly coming to an end.
Matt Macy has posted an update to the FreeBSD X11 list with news of his DRM branch being caught up all the way to Linux 4.8-RC2 now.
This is a huge accomplishment, with Matt commenting:
As of this moment sys/dev/drm in the drm-next tree is sync with https://github.com/torvalds/linux drivers/gpu/drm (albeit only for the subset of drivers that FreeBSD supports -  i915, radeon, and amdgpu). I feel this is a bit of a milestone as it means that it is possible that in the future graphics support on FreeBSD could proceed in lockstep with Linux.
For those who want to try out the latest support, you can build from his branch at the following GitHub location: (https://github.com/FreeBSDDesktop/freebsd-base-graphics) 
Or, if compiling isn’t your thing, TrueOS (The re-branded PC-BSD) will be releasing the a new ISO based upon his update to Linux 4.7 in the coming days, with 4.8-RC2 to follow in the next week or two.
***
Installing FreeBSD for Raspberry Pi (https://www.freebsdfoundation.org/freebsd/how-to-guides/installing-freebsd-for-raspberry-pi/)
People have been running FreeBSD on various RPi devices for a while now, however there are still a lot of people who probably need a hand to get boot-strapped on their RPi system.
The FreeBSD foundation has put together a nice tutorial which walks even the most novice user through getting FreeBSD up and running.
In particular this could become a good way for students or other FreeBSD newcomers to try out the OS on a relatively low-cost platform outside of a VM.
The tutorial starts of with a check-list of the specific items you’ll need to get started, for RPi 1 (a/b) or RPi 2 hardware.
From there, instructions on how to get the downloaded images onto a sdcard are provided, including Mac and Windows image burning details.
With this done, it’s really only a matter of plugging in your device to be presented with your new RPi + FreeBSD system. The most important details (the default username/password) at also provided, so don’t skim too quickly.
***
Interview - Drew Gurkowski
Foundation Intern: First time FreeBSD User and Writing Tutorials
***
News Roundup
FreeBSD’s ipfw gets a NAT64 implementation  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=304046)
A new feature has been added to FreeBSD’s native firewall, ipfw2
The new loadable module implements stateless and stateful NAT64
“Stateless translation is appropriate when a NAT64 translator is used in front of IPv4-only servers to allow them to be reached by remote IPv6-only clients.”
With this setup, you map specific IPv6 addresses to the corresponding IPv4 address, allowing IPv4 only servers to be reachable on the v6 network.
“Stateful translation is suitable for deployment at the client side or at the service provider, allowing IPv6-only client hosts to reach remote IPv4-only nodes.”
This configuration allows many IPv6 only clients to reach the “legacy” internet. The FreeBSD cluster has been waiting for this feature for 
a while, because they have limited IP addresses, but many service jails that require access to services like GitHub that are not IPv6 enabled.
The work was sponsored by Yandex, the Russian search engine and long time FreeBSD user
Example configurations for both types are included in the commit message
If you would find this feature useful, please take the time to set it up and document the steps and contribute that to the FreeBSD Handbook.
***
Update on using LLVM's lld linker in the FreeBSD base system (https://lists.freebsd.org/pipermail/freebsd-toolchain/2016-August/002240.html)
Ed Maste has written a lengthy update on the progress being made towards using LLVM’s lld linker as a replacement for GNU’s ‘ld’.
Ed starts off by giving us some of the potential benefits of using lld vs the 2.17.50 ‘ld’ version FreeBSD currently uses:
AArch64 (arm64) support
Link Time Optimization (LTO)
New ABI support
Other linker optimization
Much faster link times
Maintained code base
Ed also gives us an update on several of the major blockers:
Since the last update in March several lld developers have implemented much of the missing functionality. The main blockers were symbol version support and expression evaluation in the linker script expression parser. Both are now nearly complete“
A detailed plan was also articulated in respect to switching over:
Update lld along with the Clang/LLVM 3.9 update that dim@ is working on.
Add the bmake build infrastructure, installing as /usr/bin/ld.lld on the same architectures that use Clang (amd64, arm, arm64, i386). I don't think there's a need for a WITH_LLD src.conf knob, but will add one if desired.
Update lld again (most likely to a snapshot from upstream SVN) once it is able to link an unmodified FreeBSD kernel.
Modify the boot loader and kernel builds to avoid using features not implemented by lld.
Introduce a WITHLLDAS_LD knob to have /usr/bin/ld be a ld.lld hardlink instead of /usr/bin/ld.bfd.
Request ports exp-runs and issue a call for testing with 3rd party software. Fix issues found during this process.
Switch /usr/bin/ld to ld.lld by default in head for the Clang-using architectures. Add a WITHOUTLLDAS_LD knob to switch back to GNU ld.
***
How to install FreeBSD with ZFS filesystem on DigitalOcean (https://github.com/fxlv/docs/blob/master/freebsd/freebsd-with-zfs-digitalocean.md)
I know we’ve mentioned using FreeBSD + ZFS on digital ocean in the past, but today we have a nice HowTo by Kaspars Mickevics (fxlv) on GitHub.
Before getting started, kaspars mentions some pre-reqs. First up  he recommends starting with a Minimum of 2GB of RAM. (The $20/mo droplet). This is to ensure you have plenty of cushion to avoid running out of memory during the process. It is possible to use ZFS with less, but depending on your desired workload this does make sense.
From there, checking out “mfsBSD” is discussed, along with details on how to make it suitable for a DO installation. (Mostly just disabling DHCP for the network device) For good measure ‘pkg-static’ is also included.
With that done, using mfsBSD you will create a tar file, which is then extracted on top of the running system.
After rebooting, you will be able to run “bsdinstall” and proceed to installing / formatting your disk with ZFS as normal.
A good tutorial, something I may need to do here in the near future.
User manages to get OpenBSD and FreeBSD working with Libreboot (https://lists.nongnu.org/archive/html/libreboot/2016-08/msg00058.html)
In a short drive-by post to the Libreboot mailing list Piotr Kubaj gives a quick notice that he managed to get OpenBSD and FreeBSD both booting.
&amp;gt; I know GNU people don't like BSD, so let me make it quick :)
&amp;gt; 
&amp;gt; 
&amp;gt; I've succeeded in booting FreeBSD 11.0-RC1 using txt mode on my X200
&amp;gt; with the newest Libreboot.
&amp;gt; 
&amp;gt; To get installer to boot, I used:
&amp;gt; kfreebsd (usb0,gpt3)/boot/kernel/kernel
&amp;gt; set FreeBSD.vfs.mountfrom=ufs:/dev/da1p3
&amp;gt; boot
&amp;gt; 
&amp;gt; I didn't try to install yet.
&amp;gt;
The trick looks relatively simple (looks like GRUB), manually loading the kernel with ‘kfreebsd’ and then setting the vfs.root.mountfrom 
variable to find the USB stick.
In an update he also mentions booting OpenBSD with ‘kopenbsd’ instead of ‘kfreebsd’ (again GRUB syntax)
Now somebody will need to test installation of the system (he didn’t) and see what other issues may crop up in running BSD on a free BIOS.
***
Beastie Bits:
The ACPICA (ACPI Component Architecture) coding language AML now in DragonFly BSD (http://lists.dragonflybsd.org/pipermail/commits/2016-July/624192.html) 
Release announcement for 4.3BSD Tahoe from 1988  (https://groups.google.com/forum/#!topic/comp.sys.tahoe/50ManvdM1-s) 
Feedback/Questions
 Mike - Jail Uptime (http://pastebin.com/FLpybL6D) 
 Greg - Router Hardware (http://pastebin.com/RGuayhB3) 
 Kristof writes in (http://pastebin.com/NT4zmHiG) 
 Ty - Updates and Logs (http://pastebin.com/CtetZdFg) 
 Benjamin - MTA Bug  (http://pastebin.com/Qq3VbQG2) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, trueos, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, Allan is back from his UK trip and we’ll get to hear his thoughts on the developer summit. That plus all the</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" <br>
/></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for <br>
Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly <br>
Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2016-August/085277.html" rel="nofollow">FreeBSD 11.0-RC1 Available</a></h3>

<ul>
<li><p>FreeBSD is marching onwards to 11.0, and with it the first RC1 was released. In addition to the usual amd64 architectures, you may want to give it <br>
a whirl on your various ARM boards as well, as it includes images for the following systems:</p>

<ul>
<li>11.0-RC1 amd64 GENERIC</li>
<li>11.0-RC1 i386 GENERIC</li>
<li>11.0-RC1 powerpc GENERIC</li>
<li>11.0-RC1 powerpc64 GENERIC64</li>
<li>11.0-RC1 sparc64 GENERIC</li>
<li>11.0-RC1 armv6 BANANAPI</li>
<li>11.0-RC1 armv6 BEAGLEBONE</li>
<li>11.0-RC1 armv6 CUBIEBOARD</li>
<li>11.0-RC1 armv6 CUBIEBOARD2</li>
<li>11.0-RC1 armv6 CUBOX-HUMMINGBOARD</li>
<li>11.0-RC1 armv6 GUMSTIX</li>
<li>11.0-RC1 armv6 RPI-B</li>
<li>11.0-RC1 armv6 RPI2</li>
<li>11.0-RC1 armv6 PANDABOARD</li>
<li>11.0-RC1 armv6 WANDBOARD</li>
<li>11.0-RC1 aarch64 GENERIC</li>
</ul></li>
<li><p>For those wondering the list of changes between this and BETA4, we have that as well:</p>

<ul>
<li>A NULL pointer dereference in IPSEC has been fixed.</li>
<li>Support for SSH Protocol 1 has been removed.</li>
<li>OpenSSH DSA keys have been disabled by default.  Users upgrading from
prior FreeBSD versions are urged to update their SSH keys to RSA or
ECDSA keys before upgrading to 11.0-RC1.</li>
<li>PCI-e hotplug on bridges with power controllers has been disabled.</li>
<li>A loader tunable (hw.pci.enable_pcie_hp) to disable PCI-e HotPlug has
been added.</li>
<li>A VESA panic on suspend has been fixed.</li>
<li>Google Compute Engine image publication has been fixed.</li>
<li>An AES-ICM heap corruption typo bug has been fixed.</li>
<li>A regression in pf.conf while parsing the &#39;interval&#39; keyword has been
fixed.</li>
<li>A ZFS/VFS deadlock has been fixed.</li>
</ul></li>
<li><p><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2016-August/085323.html" rel="nofollow">RC2 is delayed while some issues are sorted out </a></p></li>
<li><p>RC2 is looming large, but was pushed back a few days while the following bugs are sorted out:</p>

<ul>
<li>Issue with IPv6 UDP traffic being sent from wrong MAC address</li>
<li>Layer2 violation with IPv6
***</li>
</ul></li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-cvs&m=147059203101111&w=2" rel="nofollow">OpenBSD just added initial support for the RaspberryPi 2 and 3 devices</a></h3>

<ul>
<li>It’s a good time to be an ARM and BSD enthusiast. In addition to all the ARM images in FreeBSD 11.0, we also have word that initial support for RPi2 and RPi3 has started to land in OpenBSD.</li>
<li>Mark Kettenis has posted the following with his Commit:</li>
</ul>

<blockquote>
<p>Initial support for Raspberry Pi 2/3.  All the hard work done by patrick@, I just cleaned things up a bit.  Any bugs introduced in that process are entirely mine.</p>

<p>This doesn&#39;t work yet.  But when it does, you&#39;ll need recent firmware from the Raspberry Pi Foundation git repository at:</p>

<p><a href="https://github.com/raspberrypi/firmware" rel="nofollow">https://github.com/raspberrypi/firmware</a></p>

<p>The device tree for the Raspberry Pi is somewhat in flux as bits and pieces to support the Raspberry Pi 2 and 3 are committed to the mainline Linux kernel.“</p>

<ul>
<li>Exciting news! We will of course keep you informed as to when we have images to play with. Running OpenBSD / PF on a RPi does sound intriguing.
***</li>
</ul>
</blockquote>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-x11/2016-August/017840.html" rel="nofollow">drm-4.8-rc2 tagged in drm-next</a></h3>

<ul>
<li>Remember when FreeBSD lagged so far behind in Graphics support? Well, those days are rapidly coming to an end.</li>
<li>Matt Macy has posted an update to the FreeBSD X11 list with news of his DRM branch being caught up all the way to Linux 4.8-RC2 now.</li>
<li>This is a huge accomplishment, with Matt commenting:</li>
</ul>

<blockquote>
<p>As of this moment sys/dev/drm in the drm-next tree is sync with <a href="https://github.com/torvalds/linux" rel="nofollow">https://github.com/torvalds/linux</a> drivers/gpu/drm (albeit only for the subset of drivers that FreeBSD supports -  i915, radeon, and amdgpu). I feel this is a bit of a milestone as it means that it is possible that in the future graphics support on FreeBSD could proceed in lockstep with Linux.</p>
</blockquote>

<ul>
<li>For those who want to try out the latest support, you can build from his branch at the following GitHub location: (<a href="https://github.com/FreeBSDDesktop/freebsd-base-graphics" rel="nofollow">https://github.com/FreeBSDDesktop/freebsd-base-graphics</a>) </li>
<li>Or, if compiling isn’t your thing, TrueOS (The re-branded PC-BSD) will be releasing the a new ISO based upon his update to Linux 4.7 in the coming days, with 4.8-RC2 to follow in the next week or two.
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/freebsd/how-to-guides/installing-freebsd-for-raspberry-pi/" rel="nofollow">Installing FreeBSD for Raspberry Pi</a></h3>

<ul>
<li>People have been running FreeBSD on various RPi devices for a while now, however there are still a lot of people who probably need a hand to get boot-strapped on their RPi system.</li>
<li>The FreeBSD foundation has put together a nice tutorial which walks even the most novice user through getting FreeBSD up and running.</li>
<li>In particular this could become a good way for students or other FreeBSD newcomers to try out the OS on a relatively low-cost platform outside of a VM.</li>
<li>The tutorial starts of with a check-list of the specific items you’ll need to get started, for RPi 1 (a/b) or RPi 2 hardware.</li>
<li>From there, instructions on how to get the downloaded images onto a sdcard are provided, including Mac and Windows image burning details.</li>
<li>With this done, it’s really only a matter of plugging in your device to be presented with your new RPi + FreeBSD system. The most important details (the default username/password) at also provided, so don’t skim too quickly.
***</li>
</ul>

<h2>Interview - Drew Gurkowski</h2>

<ul>
<li>Foundation Intern: First time FreeBSD User and Writing Tutorials
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=304046" rel="nofollow">FreeBSD’s ipfw gets a NAT64 implementation </a></h3>

<ul>
<li>A new feature has been added to FreeBSD’s native firewall, ipfw2</li>
<li>The new loadable module implements stateless and stateful NAT64</li>
<li>“Stateless translation is appropriate when a NAT64 translator is used in front of IPv4-only servers to allow them to be reached by remote IPv6-only clients.”</li>
<li>With this setup, you map specific IPv6 addresses to the corresponding IPv4 address, allowing IPv4 only servers to be reachable on the v6 network.</li>
<li>“Stateful translation is suitable for deployment at the client side or at the service provider, allowing IPv6-only client hosts to reach remote IPv4-only nodes.”</li>
<li>This configuration allows many IPv6 only clients to reach the “legacy” internet. The FreeBSD cluster has been waiting for this feature for 
a while, because they have limited IP addresses, but many service jails that require access to services like GitHub that are not IPv6 enabled.</li>
<li>The work was sponsored by Yandex, the Russian search engine and long time FreeBSD user</li>
<li>Example configurations for both types are included in the commit message</li>
<li>If you would find this feature useful, please take the time to set it up and document the steps and contribute that to the FreeBSD Handbook.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-toolchain/2016-August/002240.html" rel="nofollow">Update on using LLVM&#39;s lld linker in the FreeBSD base system</a></h3>

<ul>
<li>Ed Maste has written a lengthy update on the progress being made towards using LLVM’s lld linker as a replacement for GNU’s ‘ld’.</li>
<li><p>Ed starts off by giving us some of the potential benefits of using lld vs the 2.17.50 ‘ld’ version FreeBSD currently uses:</p>

<ul>
<li>AArch64 (arm64) support</li>
<li>Link Time Optimization (LTO)</li>
<li>New ABI support</li>
<li>Other linker optimization</li>
<li>Much faster link times</li>
<li>Maintained code base</li>
</ul></li>
<li><p>Ed also gives us an update on several of the major blockers:</p></li>
</ul>

<blockquote>
<p>Since the last update in March several lld developers have implemented much of the missing functionality. The main blockers were symbol version support and expression evaluation in the linker script expression parser. Both are now nearly complete“</p>
</blockquote>

<ul>
<li>A detailed plan was also articulated in respect to switching over:</li>
</ul>

<ol>
<li>Update lld along with the Clang/LLVM 3.9 update that dim@ is working on.</li>
<li>Add the bmake build infrastructure, installing as /usr/bin/ld.lld on the same architectures that use Clang (amd64, arm, arm64, i386). I don&#39;t think there&#39;s a need for a WITH_LLD src.conf knob, but will add one if desired.</li>
<li>Update lld again (most likely to a snapshot from upstream SVN) once it is able to link an unmodified FreeBSD kernel.</li>
<li>Modify the boot loader and kernel builds to avoid using features not implemented by lld.</li>
<li>Introduce a WITH_LLD_AS_LD knob to have /usr/bin/ld be a ld.lld hardlink instead of /usr/bin/ld.bfd.</li>
<li>Request ports exp-runs and issue a call for testing with 3rd party software. Fix issues found during this process.</li>
<li>Switch /usr/bin/ld to ld.lld by default in head for the Clang-using architectures. Add a WITHOUT_LLD_AS_LD knob to switch back to GNU ld.
***</li>
</ol>

<h3><a href="https://github.com/fxlv/docs/blob/master/freebsd/freebsd-with-zfs-digitalocean.md" rel="nofollow">How to install FreeBSD with ZFS filesystem on DigitalOcean</a></h3>

<ul>
<li><p>I know we’ve mentioned using FreeBSD + ZFS on digital ocean in the past, but today we have a nice HowTo by Kaspars Mickevics (fxlv) on GitHub.</p></li>
<li><p>Before getting started, kaspars mentions some pre-reqs. First up  he recommends starting with a Minimum of 2GB of RAM. (The $20/mo droplet). This is to ensure you have plenty of cushion to avoid running out of memory during the process. It is possible to use ZFS with less, but depending on your desired workload this does make sense.</p></li>
<li><p>From there, checking out “mfsBSD” is discussed, along with details on how to make it suitable for a DO installation. (Mostly just disabling DHCP for the network device) For good measure ‘pkg-static’ is also included.</p></li>
<li><p>With that done, using mfsBSD you will create a tar file, which is then extracted on top of the running system.</p></li>
<li><p>After rebooting, you will be able to run “bsdinstall” and proceed to installing / formatting your disk with ZFS as normal.</p></li>
<li><p>A good tutorial, something I may need to do here in the near future.</p>

<hr></li>
</ul>

<h3><a href="https://lists.nongnu.org/archive/html/libreboot/2016-08/msg00058.html" rel="nofollow">User manages to get OpenBSD and FreeBSD working with Libreboot</a></h3>

<ul>
<li>In a short drive-by post to the Libreboot mailing list Piotr Kubaj gives a quick notice that he managed to get OpenBSD and FreeBSD both booting.
&gt; I know GNU people don&#39;t like BSD, so let me make it quick :)
&gt; 
&gt; 
&gt; I&#39;ve succeeded in booting FreeBSD 11.0-RC1 using txt mode on my X200
&gt; with the newest Libreboot.
&gt; 
&gt; To get installer to boot, I used:
&gt; kfreebsd (usb0,gpt3)/boot/kernel/kernel
&gt; set FreeBSD.vfs.mountfrom=ufs:/dev/da1p3
&gt; boot
&gt; 
&gt; I didn&#39;t try to install yet.
&gt;</li>
<li>The trick looks relatively simple (looks like GRUB), manually loading the kernel with ‘kfreebsd’ and then setting the vfs.root.mountfrom 
variable to find the USB stick.</li>
<li>In an update he also mentions booting OpenBSD with ‘kopenbsd’ instead of ‘kfreebsd’ (again GRUB syntax)</li>
<li>Now somebody will need to test installation of the system (he didn’t) and see what other issues may crop up in running BSD on a free BIOS.
***</li>
</ul>

<h2>Beastie Bits:</h2>

<ul>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-July/624192.html" rel="nofollow">The ACPICA (ACPI Component Architecture) coding language AML now in DragonFly BSD</a> </p></li>
<li><p><a href="https://groups.google.com/forum/#!topic/comp.sys.tahoe/50ManvdM1-s" rel="nofollow">Release announcement for 4.3BSD Tahoe from 1988 </a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/FLpybL6D" rel="nofollow"> Mike - Jail Uptime</a> </li>
<li><a href="http://pastebin.com/RGuayhB3" rel="nofollow"> Greg - Router Hardware</a> </li>
<li><a href="http://pastebin.com/NT4zmHiG" rel="nofollow"> Kristof writes in</a> </li>
<li><a href="http://pastebin.com/CtetZdFg" rel="nofollow"> Ty - Updates and Logs</a> </li>
<li><a href="http://pastebin.com/Qq3VbQG2" rel="nofollow"> Benjamin - MTA Bug </a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, Allan is back from his UK trip and we’ll get to hear his thoughts on the developer summit. That plus all the</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" <br>
/></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for <br>
Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly <br>
Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2016-August/085277.html" rel="nofollow">FreeBSD 11.0-RC1 Available</a></h3>

<ul>
<li><p>FreeBSD is marching onwards to 11.0, and with it the first RC1 was released. In addition to the usual amd64 architectures, you may want to give it <br>
a whirl on your various ARM boards as well, as it includes images for the following systems:</p>

<ul>
<li>11.0-RC1 amd64 GENERIC</li>
<li>11.0-RC1 i386 GENERIC</li>
<li>11.0-RC1 powerpc GENERIC</li>
<li>11.0-RC1 powerpc64 GENERIC64</li>
<li>11.0-RC1 sparc64 GENERIC</li>
<li>11.0-RC1 armv6 BANANAPI</li>
<li>11.0-RC1 armv6 BEAGLEBONE</li>
<li>11.0-RC1 armv6 CUBIEBOARD</li>
<li>11.0-RC1 armv6 CUBIEBOARD2</li>
<li>11.0-RC1 armv6 CUBOX-HUMMINGBOARD</li>
<li>11.0-RC1 armv6 GUMSTIX</li>
<li>11.0-RC1 armv6 RPI-B</li>
<li>11.0-RC1 armv6 RPI2</li>
<li>11.0-RC1 armv6 PANDABOARD</li>
<li>11.0-RC1 armv6 WANDBOARD</li>
<li>11.0-RC1 aarch64 GENERIC</li>
</ul></li>
<li><p>For those wondering the list of changes between this and BETA4, we have that as well:</p>

<ul>
<li>A NULL pointer dereference in IPSEC has been fixed.</li>
<li>Support for SSH Protocol 1 has been removed.</li>
<li>OpenSSH DSA keys have been disabled by default.  Users upgrading from
prior FreeBSD versions are urged to update their SSH keys to RSA or
ECDSA keys before upgrading to 11.0-RC1.</li>
<li>PCI-e hotplug on bridges with power controllers has been disabled.</li>
<li>A loader tunable (hw.pci.enable_pcie_hp) to disable PCI-e HotPlug has
been added.</li>
<li>A VESA panic on suspend has been fixed.</li>
<li>Google Compute Engine image publication has been fixed.</li>
<li>An AES-ICM heap corruption typo bug has been fixed.</li>
<li>A regression in pf.conf while parsing the &#39;interval&#39; keyword has been
fixed.</li>
<li>A ZFS/VFS deadlock has been fixed.</li>
</ul></li>
<li><p><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2016-August/085323.html" rel="nofollow">RC2 is delayed while some issues are sorted out </a></p></li>
<li><p>RC2 is looming large, but was pushed back a few days while the following bugs are sorted out:</p>

<ul>
<li>Issue with IPv6 UDP traffic being sent from wrong MAC address</li>
<li>Layer2 violation with IPv6
***</li>
</ul></li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-cvs&m=147059203101111&w=2" rel="nofollow">OpenBSD just added initial support for the RaspberryPi 2 and 3 devices</a></h3>

<ul>
<li>It’s a good time to be an ARM and BSD enthusiast. In addition to all the ARM images in FreeBSD 11.0, we also have word that initial support for RPi2 and RPi3 has started to land in OpenBSD.</li>
<li>Mark Kettenis has posted the following with his Commit:</li>
</ul>

<blockquote>
<p>Initial support for Raspberry Pi 2/3.  All the hard work done by patrick@, I just cleaned things up a bit.  Any bugs introduced in that process are entirely mine.</p>

<p>This doesn&#39;t work yet.  But when it does, you&#39;ll need recent firmware from the Raspberry Pi Foundation git repository at:</p>

<p><a href="https://github.com/raspberrypi/firmware" rel="nofollow">https://github.com/raspberrypi/firmware</a></p>

<p>The device tree for the Raspberry Pi is somewhat in flux as bits and pieces to support the Raspberry Pi 2 and 3 are committed to the mainline Linux kernel.“</p>

<ul>
<li>Exciting news! We will of course keep you informed as to when we have images to play with. Running OpenBSD / PF on a RPi does sound intriguing.
***</li>
</ul>
</blockquote>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-x11/2016-August/017840.html" rel="nofollow">drm-4.8-rc2 tagged in drm-next</a></h3>

<ul>
<li>Remember when FreeBSD lagged so far behind in Graphics support? Well, those days are rapidly coming to an end.</li>
<li>Matt Macy has posted an update to the FreeBSD X11 list with news of his DRM branch being caught up all the way to Linux 4.8-RC2 now.</li>
<li>This is a huge accomplishment, with Matt commenting:</li>
</ul>

<blockquote>
<p>As of this moment sys/dev/drm in the drm-next tree is sync with <a href="https://github.com/torvalds/linux" rel="nofollow">https://github.com/torvalds/linux</a> drivers/gpu/drm (albeit only for the subset of drivers that FreeBSD supports -  i915, radeon, and amdgpu). I feel this is a bit of a milestone as it means that it is possible that in the future graphics support on FreeBSD could proceed in lockstep with Linux.</p>
</blockquote>

<ul>
<li>For those who want to try out the latest support, you can build from his branch at the following GitHub location: (<a href="https://github.com/FreeBSDDesktop/freebsd-base-graphics" rel="nofollow">https://github.com/FreeBSDDesktop/freebsd-base-graphics</a>) </li>
<li>Or, if compiling isn’t your thing, TrueOS (The re-branded PC-BSD) will be releasing the a new ISO based upon his update to Linux 4.7 in the coming days, with 4.8-RC2 to follow in the next week or two.
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/freebsd/how-to-guides/installing-freebsd-for-raspberry-pi/" rel="nofollow">Installing FreeBSD for Raspberry Pi</a></h3>

<ul>
<li>People have been running FreeBSD on various RPi devices for a while now, however there are still a lot of people who probably need a hand to get boot-strapped on their RPi system.</li>
<li>The FreeBSD foundation has put together a nice tutorial which walks even the most novice user through getting FreeBSD up and running.</li>
<li>In particular this could become a good way for students or other FreeBSD newcomers to try out the OS on a relatively low-cost platform outside of a VM.</li>
<li>The tutorial starts of with a check-list of the specific items you’ll need to get started, for RPi 1 (a/b) or RPi 2 hardware.</li>
<li>From there, instructions on how to get the downloaded images onto a sdcard are provided, including Mac and Windows image burning details.</li>
<li>With this done, it’s really only a matter of plugging in your device to be presented with your new RPi + FreeBSD system. The most important details (the default username/password) at also provided, so don’t skim too quickly.
***</li>
</ul>

<h2>Interview - Drew Gurkowski</h2>

<ul>
<li>Foundation Intern: First time FreeBSD User and Writing Tutorials
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=304046" rel="nofollow">FreeBSD’s ipfw gets a NAT64 implementation </a></h3>

<ul>
<li>A new feature has been added to FreeBSD’s native firewall, ipfw2</li>
<li>The new loadable module implements stateless and stateful NAT64</li>
<li>“Stateless translation is appropriate when a NAT64 translator is used in front of IPv4-only servers to allow them to be reached by remote IPv6-only clients.”</li>
<li>With this setup, you map specific IPv6 addresses to the corresponding IPv4 address, allowing IPv4 only servers to be reachable on the v6 network.</li>
<li>“Stateful translation is suitable for deployment at the client side or at the service provider, allowing IPv6-only client hosts to reach remote IPv4-only nodes.”</li>
<li>This configuration allows many IPv6 only clients to reach the “legacy” internet. The FreeBSD cluster has been waiting for this feature for 
a while, because they have limited IP addresses, but many service jails that require access to services like GitHub that are not IPv6 enabled.</li>
<li>The work was sponsored by Yandex, the Russian search engine and long time FreeBSD user</li>
<li>Example configurations for both types are included in the commit message</li>
<li>If you would find this feature useful, please take the time to set it up and document the steps and contribute that to the FreeBSD Handbook.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-toolchain/2016-August/002240.html" rel="nofollow">Update on using LLVM&#39;s lld linker in the FreeBSD base system</a></h3>

<ul>
<li>Ed Maste has written a lengthy update on the progress being made towards using LLVM’s lld linker as a replacement for GNU’s ‘ld’.</li>
<li><p>Ed starts off by giving us some of the potential benefits of using lld vs the 2.17.50 ‘ld’ version FreeBSD currently uses:</p>

<ul>
<li>AArch64 (arm64) support</li>
<li>Link Time Optimization (LTO)</li>
<li>New ABI support</li>
<li>Other linker optimization</li>
<li>Much faster link times</li>
<li>Maintained code base</li>
</ul></li>
<li><p>Ed also gives us an update on several of the major blockers:</p></li>
</ul>

<blockquote>
<p>Since the last update in March several lld developers have implemented much of the missing functionality. The main blockers were symbol version support and expression evaluation in the linker script expression parser. Both are now nearly complete“</p>
</blockquote>

<ul>
<li>A detailed plan was also articulated in respect to switching over:</li>
</ul>

<ol>
<li>Update lld along with the Clang/LLVM 3.9 update that dim@ is working on.</li>
<li>Add the bmake build infrastructure, installing as /usr/bin/ld.lld on the same architectures that use Clang (amd64, arm, arm64, i386). I don&#39;t think there&#39;s a need for a WITH_LLD src.conf knob, but will add one if desired.</li>
<li>Update lld again (most likely to a snapshot from upstream SVN) once it is able to link an unmodified FreeBSD kernel.</li>
<li>Modify the boot loader and kernel builds to avoid using features not implemented by lld.</li>
<li>Introduce a WITH_LLD_AS_LD knob to have /usr/bin/ld be a ld.lld hardlink instead of /usr/bin/ld.bfd.</li>
<li>Request ports exp-runs and issue a call for testing with 3rd party software. Fix issues found during this process.</li>
<li>Switch /usr/bin/ld to ld.lld by default in head for the Clang-using architectures. Add a WITHOUT_LLD_AS_LD knob to switch back to GNU ld.
***</li>
</ol>

<h3><a href="https://github.com/fxlv/docs/blob/master/freebsd/freebsd-with-zfs-digitalocean.md" rel="nofollow">How to install FreeBSD with ZFS filesystem on DigitalOcean</a></h3>

<ul>
<li><p>I know we’ve mentioned using FreeBSD + ZFS on digital ocean in the past, but today we have a nice HowTo by Kaspars Mickevics (fxlv) on GitHub.</p></li>
<li><p>Before getting started, kaspars mentions some pre-reqs. First up  he recommends starting with a Minimum of 2GB of RAM. (The $20/mo droplet). This is to ensure you have plenty of cushion to avoid running out of memory during the process. It is possible to use ZFS with less, but depending on your desired workload this does make sense.</p></li>
<li><p>From there, checking out “mfsBSD” is discussed, along with details on how to make it suitable for a DO installation. (Mostly just disabling DHCP for the network device) For good measure ‘pkg-static’ is also included.</p></li>
<li><p>With that done, using mfsBSD you will create a tar file, which is then extracted on top of the running system.</p></li>
<li><p>After rebooting, you will be able to run “bsdinstall” and proceed to installing / formatting your disk with ZFS as normal.</p></li>
<li><p>A good tutorial, something I may need to do here in the near future.</p>

<hr></li>
</ul>

<h3><a href="https://lists.nongnu.org/archive/html/libreboot/2016-08/msg00058.html" rel="nofollow">User manages to get OpenBSD and FreeBSD working with Libreboot</a></h3>

<ul>
<li>In a short drive-by post to the Libreboot mailing list Piotr Kubaj gives a quick notice that he managed to get OpenBSD and FreeBSD both booting.
&gt; I know GNU people don&#39;t like BSD, so let me make it quick :)
&gt; 
&gt; 
&gt; I&#39;ve succeeded in booting FreeBSD 11.0-RC1 using txt mode on my X200
&gt; with the newest Libreboot.
&gt; 
&gt; To get installer to boot, I used:
&gt; kfreebsd (usb0,gpt3)/boot/kernel/kernel
&gt; set FreeBSD.vfs.mountfrom=ufs:/dev/da1p3
&gt; boot
&gt; 
&gt; I didn&#39;t try to install yet.
&gt;</li>
<li>The trick looks relatively simple (looks like GRUB), manually loading the kernel with ‘kfreebsd’ and then setting the vfs.root.mountfrom 
variable to find the USB stick.</li>
<li>In an update he also mentions booting OpenBSD with ‘kopenbsd’ instead of ‘kfreebsd’ (again GRUB syntax)</li>
<li>Now somebody will need to test installation of the system (he didn’t) and see what other issues may crop up in running BSD on a free BIOS.
***</li>
</ul>

<h2>Beastie Bits:</h2>

<ul>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-July/624192.html" rel="nofollow">The ACPICA (ACPI Component Architecture) coding language AML now in DragonFly BSD</a> </p></li>
<li><p><a href="https://groups.google.com/forum/#!topic/comp.sys.tahoe/50ManvdM1-s" rel="nofollow">Release announcement for 4.3BSD Tahoe from 1988 </a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/FLpybL6D" rel="nofollow"> Mike - Jail Uptime</a> </li>
<li><a href="http://pastebin.com/RGuayhB3" rel="nofollow"> Greg - Router Hardware</a> </li>
<li><a href="http://pastebin.com/NT4zmHiG" rel="nofollow"> Kristof writes in</a> </li>
<li><a href="http://pastebin.com/CtetZdFg" rel="nofollow"> Ty - Updates and Logs</a> </li>
<li><a href="http://pastebin.com/Qq3VbQG2" rel="nofollow"> Benjamin - MTA Bug </a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>155: Cabling up FreeBSD</title>
  <link>https://www.bsdnow.tv/155</link>
  <guid isPermaLink="false">fba64561-1dc0-4be9-8f98-99ed69324e02</guid>
  <pubDate>Wed, 17 Aug 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fba64561-1dc0-4be9-8f98-99ed69324e02.mp3" length="84693460" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, Allen is away in the UK (For BSDCam), but we still have a full episode for you! Don’t miss our interview with</itunes:subtitle>
  <itunes:duration>1:57:37</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, Allen is away in the UK (For BSDCam), but we still have a full episode for you! Don’t miss our interview with
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
My two year journey to becoming an OS Developer  (http://zinascii.com/2016/going-to-joyent.html)
A blog post by Ryan Zezeski about how he ended doing OS Development instead of working on application
We have featured his posts before, including The illumos SYSCALL Handler (http://zinascii.com/2016/the-illumos-syscall-handler.html)
It started in the summer of 2014: I had just left Basho after 3.5 years of working on Riak, when I decided I wanted to become an OS developer. I purchased Solaris Internals, cloned illumos-gate, fired up cscope, and got to work. I hardly knew any C, x86 might as well have been Brainfuck, and, frankly, I knew shit about operating systems. But I was determined.
I’ve always learned best by beating my head against something until it makes sense. I’m not a fast learner; I’m persistent. What others have in ability I make up for in effort. And when it comes to OS internals it’s all about work ethic. The more you look, the more you realize it’s just another program. The main difference being: it’s the program all the other programs run on.
My strategy: to pick something, anything, that looked interesting, and write a post describing how it works. I wrote several of these posts in 2014 and 2015. More important, it put me in touch with Roger Faulkner: the creator of truss(1), the Solaris process model, and the real /proc filesystem. At the time I didn’t like my interaction with Roger. He explained, in what I would later find out to be his typical gruff manner, that I was wrong; so I concluded he is a prick. But over the years I realized that I was being a brat—he was trying to teach me something and I let my ego get in the way. I’ve come to view that interaction as a blessing. I interacted with one of the greats, a mentor of my mentor’s mentor (a Great Great Mentor).
A couple of weeks later something even more surreal happened, at illumos Day 2014. Bryan Cantrill was the last speaker of the day. One of my mentors and someone I admire greatly. He was there to regale us with the story of Joyent’s resurrection of lx-branded zones: Linux system call emulation on top of the illumos kernel. But before he would do that he decided to speak about me! I couldn’t believe it. I was so overwhelmed that I don’t remember most of what he said. I was too busy flipping shit—Bryan Cantrill is on stage, in front of other kernel developers I look up to, saying my name. I was in a dream. It turns out, unknown to me at the time, that he wrote the POSIX queue code for both Solaris and QNX, which I wrote about. He compared me to the great expository technical writers Elliott Organick and Richard Stevens. And it was at this moment that I knew I could do this: I could become an OS developer.
Never underestimate the effect kind words can have on someone that looks up to you.
There is a lot more to the story, and it is definitely worth the read
The story then goes on to talk about his recent run in with Bryan Cantrill
&amp;gt; A week from now my two year journey to become an OS developer comes to an end; and a new chapter begins. I don’t know what specific things I’m going to work on, but I’m sure it will push me to the limit. I look forward to the challenge.
***
Version 1.0 of the Lumina Desktop released (https://lumina-desktop.org/version-1-0-0-released/)
After 4 years of development, Lumina Desktop has now hit version 1.0!
This release brings with it a slew of new features and support:
Completely customizable interface! Rather than having to learn how to use a new layout, change the desktop to suit you instead!
Simple shortcuts for any application! The “favorites” system makes it easy to find and launch applications at any time.
Extremely lightweight! Allows applications to utilize more of your system hardware and revitalizes older systems!
Multiple-monitor support! Each monitor is treated as an independent entity – making it great for presentation systems which use a temporary monitor or for workstations which utilize an array of monitors for various tasks.
While originally developed on PC-BSD, it already has been ported to a variety of different platforms, including OpenBSD, DragonFly, NetBSD, Debian and Gentoo
Lumina has become the defacto desktop environment for TrueOS (Formerly PC-BSD), and looks like will provide a solid framework to continue growing desktop features.
***
n2k16 hackathon report: Ken Westerback on dhclient, bridges, routing and more (http://undeadly.org/cgi?action=article&amp;amp;sid=20160804200232)
Next up, we have a report from Ken Westerback talking about the recent OpenBSD hackathon in Prague
He starts by telling us about the work in bpf:
First order of business, stsp@'s weird setup involving bridges and multiple dhclient clients. A bit of bpf(4) programming to restrict dhclient to handling ethernet packets unicast to its interface worked. Cool. Unfortunately it turned out some lazy dhcp servers always use ethernet broadcasts just because some lesser, non-OpenBSD clients ignore unicast packets until they have configured IP. Classic chicken and egg. So this was backed out just before 6.0. Sigh.
Next up, he talks about an idea he had on the flight over, specifically with regard to how DHCP leases are stored, and how keeping the SSID information with them could speed up re-connection times, by only trying leases for current SSID’s connected. After a day or so of hacking, it was working! However for $REASONS it was shelved for post 6.0, bummer! 
 He then discusses an on-going project with Peter Hessler on passing along relevant PIDs in response to routing messages generated by kernel from ioctl events. This is something they’ve been hacking at, in order to allow dhclient to recognize its own routing messages. Sounds like they are both still works-in-progress.
However, Ken did get something in for 6.0:
Diving back into dhclient code I discovered that in situations where multiple offers were received the unused offers were not being declined and discarded. Despite a clear comment saying that's what was being done! Thus dhclient might gradually use up more and more memory. And possibly be retrying offers that should have been discarded. The fix for this did make 6.0! Yay!
In Memoriam Roger Faulkner  (https://www.usenix.org/memoriam-roger-faulkner)
USENIX has re-released Roger Faulkner’s original paper on /proc as a free download
The UNIX community recently lost one of its original pioneers, Roger Faulkner, whom one commenter described as “The godfather of post-AT&amp;amp;T UNIX”
In his memory, the USENIX group as re-released his original paper on the /proc file-system from 1991.
Roger worked in many area’s of UNIX, however the process file system /proc was his special baby.
“/proc began as a debugger interface superseding ptrace(2) but has evolved into a general interface to the process model.”
The original /proc only had a file for each process, not a directory. "Data may be transferred from or to any valid locations in the process's address space by applying lseek(2) to position the file at the virtual address of interest followed by read(2) or write(2)."
Processes could be controlled using IOCTLs on the file
As the USENIX article states:
Roger believed that terrible things were sometimes required to create beautiful abstractions, and his trailblazing work on /proc embodies this burden: the innards may be delicate and nasty ("vile," as Roger might say in his distinguished Carolinian accent)—but the resulting abstractions are breathtaking in their power, scope and robustness.
RIP Roger, and thanks for the wonderful UNIX legacy you’ve left us all.
Interview - Myke Geiger - myke@servernorth.net (mailto:myke@servernorth.net) / @mWare (https://twitter.com/mWare)
Using FreeBSD at a DSL/Cable ISP
***
News Roundup
New options in bsdinstall - some sysctls and date/time settings (https://www.reddit.com/r/freebsd/comments/4vxnw3/new_options_in_bsdinstall_some_sysctls_and/)
bsdinstall in FreeBSD 11.0 will feature a number of new menus.
The first, well allow you to set the date and time. Often on computers that have been in storage, or some embedded type devices that have no RTC, the date will be wildly wrong, and ntpd will refuse to run until the date is correctly set. This feature makes it easy to enter the date and time using dialog(1)
The second menu, inspired by the existing ‘services’ menu, offers a number of ‘hardening’ options
This menu allows users to easily enable a number of security features, including:
Hide processes running as other users/groups
Disable reading the kernel message buffer and debugging processes for unprivileged users
Randomize the PID of newly created processes
Enable the stack guard
Erase /tmp at boot
Disable remote syslog
Disable sendmail
All of these options are off by default, so that an install done with the installer will be the same as an install from source, or an upgrade.
A number of these options are candidates to become on-by-default in the future, so the hope is that this menu will get more users to test these features and find any negative interactions with applications or general use, so they can be fixed.
***
Rawrite32: the NetBSD image writing tool (https://www.netbsd.org/~martin/rawrite32/)
Martin of the NetBSD project has released a new version of his USB imaging tool, rawrite32
For those who’ve not used this tool before, it is a Windows Application that allows writing NetBSD images directly to USB media (other other disk media)
This update brings with it support for writing .xz file, and binary signing
This may come in handy for writing other OS images to memory sticks as well, especially for those locked into a windows environment who need to 
switch.
***
ZFS-Snap-Diff -- A pretty interface for viewing what changed after a ZFS snapshot  (https://github.com/j-keck/zfs-snap-diff)
There are lots of nice little utilities to help create and maintain your ZFS snapshots. However today we have something unique to look at, ‘zfs-snap-diff’.
What makes it unique, is that it ships with a built-in golang / angularjs GUI for snapshot management
It looks very powerful, including a built-in diff utility, so you can even see the changes in text-files, in addition to downloading files, restoring old versions and more.
Its nice to see so many ZFS utilities starting to take off, and evolve file-management further.
***
Dtrace Conf 2016 Event Videos (https://www.joyent.com/about/events/2016/dtrace-conf)
The videos from Dtrace.conf 2016 have been posted
Some highlights:
Useful DTrace Intro
CTF Everywhere
Distributed DTrace
DTrace for Apps
DTrace json() subroutine
Implementing (or not) fds[] in FreeBSD
OpenDTrace
DTrace performance improvements with always-on instrumentation
D Syntactic Sugar
DTrace and Go, DTrace and Postgres
dtrace.conf(16) wrap-up by Bryan Cantrill (https://www.joyent.com/blog/dtrace-conf-16-wrap-up) 
Once again, it was an eclectic mix of technologists — and once again, the day got kicked off with me providing an introduction to dtrace.conf and its history. (Just to save you the time filling out your Cantrill Presentation Bingo Card: you can find me punching myself at 16:19, me offering unsolicited personal medical history at 20:11, and me getting trolled by unikernels at 38:25.)
The next DTrace.conf isn’t until 2020
***
Beastie Bits
The BSD Daemon features in Mexican candy packaging (https://www.reddit.com/r/BSD/comments/4vngmw/the_bsd_daemon_feature_in_mexican_candy_packaging/) 
Remove PG_ZERO and zeroidle (page-zeroing) entirely (http://lists.dragonflybsd.org/pipermail/commits/2016-August/624202.html)
OpenBSD: Release Songs: 6.0: "Black Hat" (https://www.openbsd.org/lyrics.html#60b)
OpenBSD Gaming Resource (http://satterly.neocities.org/openbsd_games.html) 
LibreSSL 2.4.2 and 2.3.7 Released (http://bsdsec.net/articles/libressl-2-4-2-and-2-3-7-released) 
Feedback/Questions
 Pedja - Bhyve GUI  (http://pastebin.com/LJcJmNsR) 
 Tim - Jail Management (http://pastebin.com/259x94Rh) 
 Don - X260  (http://pastebin.com/A86yHnzz) 
 David - Updates (http://pastebin.com/wjtcuVSA) 
 Ghislain - Jail Management (http://pastebin.com/DgH9G7p5) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, Allen is away in the UK (For BSDCam), but we still have a full episode for you! Don’t miss our interview with</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://zinascii.com/2016/going-to-joyent.html" rel="nofollow">My two year journey to becoming an OS Developer </a></h3>

<ul>
<li>A blog post by Ryan Zezeski about how he ended doing OS Development instead of working on application</li>
<li>We have featured his posts before, including <a href="http://zinascii.com/2016/the-illumos-syscall-handler.html" rel="nofollow">The illumos SYSCALL Handler</a></li>
</ul>

<blockquote>
<p>It started in the summer of 2014: I had just left Basho after 3.5 years of working on Riak, when I decided I wanted to become an OS developer. I purchased Solaris Internals, cloned illumos-gate, fired up cscope, and got to work. I hardly knew any C, x86 might as well have been Brainfuck, and, frankly, I knew shit about operating systems. But I was determined.<br>
I’ve always learned best by beating my head against something until it makes sense. I’m not a fast learner; I’m persistent. What others have in ability I make up for in effort. And when it comes to OS internals it’s all about work ethic. The more you look, the more you realize it’s just another program. The main difference being: it’s the program all the other programs run on.<br>
My strategy: to pick something, anything, that looked interesting, and write a post describing how it works. I wrote several of these posts in 2014 and 2015. More important, it put me in touch with Roger Faulkner: the creator of truss(1), the Solaris process model, and the real /proc filesystem. At the time I didn’t like my interaction with Roger. He explained, in what I would later find out to be his typical gruff manner, that I was wrong; so I concluded he is a prick. But over the years I realized that I was being a brat—he was trying to teach me something and I let my ego get in the way. I’ve come to view that interaction as a blessing. I interacted with one of the greats, a mentor of my mentor’s mentor (a Great Great Mentor).<br>
A couple of weeks later something even more surreal happened, at illumos Day 2014. Bryan Cantrill was the last speaker of the day. One of my mentors and someone I admire greatly. He was there to regale us with the story of Joyent’s resurrection of lx-branded zones: Linux system call emulation on top of the illumos kernel. But before he would do that he decided to speak about me! I couldn’t believe it. I was so overwhelmed that I don’t remember most of what he said. I was too busy flipping shit—Bryan Cantrill is on stage, in front of other kernel developers I look up to, saying my name. I was in a dream. It turns out, unknown to me at the time, that he wrote the POSIX queue code for both Solaris and QNX, which I wrote about. He compared me to the great expository technical writers Elliott Organick and Richard Stevens. And it was at this moment that I knew I could do this: I could become an OS developer.<br>
Never underestimate the effect kind words can have on someone that looks up to you.</p>
</blockquote>

<ul>
<li>There is a lot more to the story, and it is definitely worth the read</li>
<li>The story then goes on to talk about his recent run in with Bryan Cantrill
&gt; A week from now my two year journey to become an OS developer comes to an end; and a new chapter begins. I don’t know what specific things I’m going to work on, but I’m sure it will push me to the limit. I look forward to the challenge.
***</li>
</ul>

<h3><a href="https://lumina-desktop.org/version-1-0-0-released/" rel="nofollow">Version 1.0 of the Lumina Desktop released</a></h3>

<ul>
<li>After 4 years of development, Lumina Desktop has now hit version 1.0!</li>
<li>This release brings with it a slew of new features and support:</li>
</ul>

<blockquote>
<ul>
<li>Completely customizable interface! Rather than having to learn how to use a new layout, change the desktop to suit you instead!</li>
<li>Simple shortcuts for any application! The “favorites” system makes it easy to find and launch applications at any time.</li>
<li>Extremely lightweight! Allows applications to utilize more of your system hardware and revitalizes older systems!</li>
<li>Multiple-monitor support! Each monitor is treated as an independent entity – making it great for presentation systems which use a temporary monitor or for workstations which utilize an array of monitors for various tasks.</li>
</ul>
</blockquote>

<ul>
<li>While originally developed on PC-BSD, it already has been ported to a variety of different platforms, including OpenBSD, DragonFly, NetBSD, Debian and Gentoo</li>
<li>Lumina has become the defacto desktop environment for TrueOS (Formerly PC-BSD), and looks like will provide a solid framework to continue growing desktop features.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160804200232" rel="nofollow">n2k16 hackathon report: Ken Westerback on dhclient, bridges, routing and more</a></h3>

<ul>
<li>Next up, we have a report from Ken Westerback talking about the recent OpenBSD hackathon in Prague</li>
<li>He starts by telling us about the work in bpf:</li>
</ul>

<blockquote>
<p>First order of business, stsp@&#39;s weird setup involving bridges and multiple dhclient clients. A bit of bpf(4) programming to restrict dhclient to handling ethernet packets unicast to its interface worked. Cool. Unfortunately it turned out some lazy dhcp servers always use ethernet broadcasts just because some lesser, non-OpenBSD clients ignore unicast packets until they have configured IP. Classic chicken and egg. So this was backed out just before 6.0. Sigh.</p>
</blockquote>

<ul>
<li>Next up, he talks about an idea he had on the flight over, specifically with regard to how DHCP leases are stored, and how keeping the SSID information with them could speed up re-connection times, by only trying leases for current SSID’s connected. After a day or so of hacking, it was working! However for $REASONS it was shelved for post 6.0, bummer! </li>
<li> He then discusses an on-going project with Peter Hessler on passing along relevant PIDs in response to routing messages generated by kernel from ioctl events. This is something they’ve been hacking at, in order to allow dhclient to recognize its own routing messages. Sounds like they are both still works-in-progress.</li>
<li>However, Ken did get something in for 6.0:</li>
</ul>

<blockquote>
<p>Diving back into dhclient code I discovered that in situations where multiple offers were received the unused offers were not being declined and discarded. Despite a clear comment saying that&#39;s what was being done! Thus dhclient might gradually use up more and more memory. And possibly be retrying offers that should have been discarded. The fix for this did make 6.0! Yay!</p>
</blockquote>

<hr>

<h3><a href="https://www.usenix.org/memoriam-roger-faulkner" rel="nofollow">In Memoriam Roger Faulkner </a></h3>

<ul>
<li>USENIX has re-released Roger Faulkner’s original paper on /proc as a free download</li>
<li>The UNIX community recently lost one of its original pioneers, Roger Faulkner, whom one commenter described as “The godfather of post-AT&amp;T UNIX”</li>
<li>In his memory, the USENIX group as re-released his original paper on the /proc file-system from 1991.</li>
<li>Roger worked in many area’s of UNIX, however the process file system /proc was his special baby.</li>
<li>“/proc began as a debugger interface superseding ptrace(2) but has evolved into a general interface to the process model.”</li>
<li>The original /proc only had a file for each process, not a directory. &quot;Data may be transferred from or to any valid locations in the process&#39;s address space by applying lseek(2) to position the file at the virtual address of interest followed by read(2) or write(2).&quot;</li>
<li>Processes could be controlled using IOCTLs on the file</li>
<li><p>As the USENIX article states:</p>

<blockquote>
<p>Roger believed that terrible things were sometimes required to create beautiful abstractions, and his trailblazing work on /proc embodies this burden: the innards may be delicate and nasty (&quot;vile,&quot; as Roger might say in his distinguished Carolinian accent)—but the resulting abstractions are breathtaking in their power, scope and robustness.</p>
</blockquote></li>
<li><p>RIP Roger, and thanks for the wonderful UNIX legacy you’ve left us all.</p>

<hr></li>
</ul>

<h2>Interview - Myke Geiger - <a href="mailto:myke@servernorth.net" rel="nofollow">myke@servernorth.net</a> / <a href="https://twitter.com/mWare" rel="nofollow">@mWare</a></h2>

<ul>
<li>Using FreeBSD at a DSL/Cable ISP
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.reddit.com/r/freebsd/comments/4vxnw3/new_options_in_bsdinstall_some_sysctls_and/" rel="nofollow">New options in bsdinstall - some sysctls and date/time settings</a></h3>

<ul>
<li>bsdinstall in FreeBSD 11.0 will feature a number of new menus.</li>
<li>The first, well allow you to set the date and time. Often on computers that have been in storage, or some embedded type devices that have no RTC, the date will be wildly wrong, and ntpd will refuse to run until the date is correctly set. This feature makes it easy to enter the date and time using dialog(1)</li>
<li>The second menu, inspired by the existing ‘services’ menu, offers a number of ‘hardening’ options</li>
<li>This menu allows users to easily enable a number of security features, including:

<ul>
<li>Hide processes running as other users/groups</li>
<li>Disable reading the kernel message buffer and debugging processes for unprivileged users</li>
<li>Randomize the PID of newly created processes</li>
<li>Enable the stack guard</li>
<li>Erase /tmp at boot</li>
<li>Disable remote syslog</li>
<li>Disable sendmail</li>
</ul></li>
<li>All of these options are off by default, so that an install done with the installer will be the same as an install from source, or an upgrade.</li>
<li>A number of these options are candidates to become on-by-default in the future, so the hope is that this menu will get more users to test these features and find any negative interactions with applications or general use, so they can be fixed.
***</li>
</ul>

<h3><a href="https://www.netbsd.org/%7Emartin/rawrite32/" rel="nofollow">Rawrite32: the NetBSD image writing tool</a></h3>

<ul>
<li>Martin of the NetBSD project has released a new version of his USB imaging tool, rawrite32</li>
<li>For those who’ve not used this tool before, it is a Windows Application that allows writing NetBSD images directly to USB media (other other disk media)</li>
<li>This update brings with it support for writing .xz file, and binary signing</li>
<li>This may come in handy for writing other OS images to memory sticks as well, especially for those locked into a windows environment who need to 
switch.
***</li>
</ul>

<h3><a href="https://github.com/j-keck/zfs-snap-diff" rel="nofollow">ZFS-Snap-Diff -- A pretty interface for viewing what changed after a ZFS snapshot </a></h3>

<ul>
<li>There are lots of nice little utilities to help create and maintain your ZFS snapshots. However today we have something unique to look at, ‘zfs-snap-diff’.</li>
<li>What makes it unique, is that it ships with a built-in golang / angularjs GUI for snapshot management</li>
<li>It looks very powerful, including a built-in diff utility, so you can even see the changes in text-files, in addition to downloading files, restoring old versions and more.</li>
<li>Its nice to see so many ZFS utilities starting to take off, and evolve file-management further.
***</li>
</ul>

<h3><a href="https://www.joyent.com/about/events/2016/dtrace-conf" rel="nofollow">Dtrace Conf 2016 Event Videos</a></h3>

<ul>
<li>The videos from Dtrace.conf 2016 have been posted</li>
<li>Some highlights:

<ul>
<li>Useful DTrace Intro</li>
<li>CTF Everywhere</li>
<li>Distributed DTrace</li>
<li>DTrace for Apps</li>
<li>DTrace json() subroutine</li>
<li>Implementing (or not) fds[] in FreeBSD</li>
<li>OpenDTrace</li>
<li>DTrace performance improvements with always-on instrumentation</li>
<li>D Syntactic Sugar</li>
<li>DTrace and Go, DTrace and Postgres</li>
</ul></li>
<li><a href="https://www.joyent.com/blog/dtrace-conf-16-wrap-up" rel="nofollow">dtrace.conf(16) wrap-up by Bryan Cantrill</a> </li>
</ul>

<blockquote>
<p>Once again, it was an eclectic mix of technologists — and once again, the day got kicked off with me providing an introduction to dtrace.conf and its history. (Just to save you the time filling out your Cantrill Presentation Bingo Card: you can find me punching myself at 16:19, me offering unsolicited personal medical history at 20:11, and me getting trolled by unikernels at 38:25.)</p>
</blockquote>

<ul>
<li>The next DTrace.conf isn’t until 2020
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.reddit.com/r/BSD/comments/4vngmw/the_bsd_daemon_feature_in_mexican_candy_packaging/" rel="nofollow">The BSD Daemon features in Mexican candy packaging</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-August/624202.html" rel="nofollow">Remove PG_ZERO and zeroidle (page-zeroing) entirely</a></p></li>
<li><p><a href="https://www.openbsd.org/lyrics.html#60b" rel="nofollow">OpenBSD: Release Songs: 6.0: &quot;Black Hat&quot;</a></p></li>
<li><p><a href="http://satterly.neocities.org/openbsd_games.html" rel="nofollow">OpenBSD Gaming Resource</a> </p></li>
<li><p><a href="http://bsdsec.net/articles/libressl-2-4-2-and-2-3-7-released" rel="nofollow">LibreSSL 2.4.2 and 2.3.7 Released</a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/LJcJmNsR" rel="nofollow"> Pedja - Bhyve GUI </a> </li>
<li><a href="http://pastebin.com/259x94Rh" rel="nofollow"> Tim - Jail Management</a> </li>
<li><a href="http://pastebin.com/A86yHnzz" rel="nofollow"> Don - X260 </a> </li>
<li><a href="http://pastebin.com/wjtcuVSA" rel="nofollow"> David - Updates</a> </li>
<li><a href="http://pastebin.com/DgH9G7p5" rel="nofollow"> Ghislain - Jail Management</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, Allen is away in the UK (For BSDCam), but we still have a full episode for you! Don’t miss our interview with</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://zinascii.com/2016/going-to-joyent.html" rel="nofollow">My two year journey to becoming an OS Developer </a></h3>

<ul>
<li>A blog post by Ryan Zezeski about how he ended doing OS Development instead of working on application</li>
<li>We have featured his posts before, including <a href="http://zinascii.com/2016/the-illumos-syscall-handler.html" rel="nofollow">The illumos SYSCALL Handler</a></li>
</ul>

<blockquote>
<p>It started in the summer of 2014: I had just left Basho after 3.5 years of working on Riak, when I decided I wanted to become an OS developer. I purchased Solaris Internals, cloned illumos-gate, fired up cscope, and got to work. I hardly knew any C, x86 might as well have been Brainfuck, and, frankly, I knew shit about operating systems. But I was determined.<br>
I’ve always learned best by beating my head against something until it makes sense. I’m not a fast learner; I’m persistent. What others have in ability I make up for in effort. And when it comes to OS internals it’s all about work ethic. The more you look, the more you realize it’s just another program. The main difference being: it’s the program all the other programs run on.<br>
My strategy: to pick something, anything, that looked interesting, and write a post describing how it works. I wrote several of these posts in 2014 and 2015. More important, it put me in touch with Roger Faulkner: the creator of truss(1), the Solaris process model, and the real /proc filesystem. At the time I didn’t like my interaction with Roger. He explained, in what I would later find out to be his typical gruff manner, that I was wrong; so I concluded he is a prick. But over the years I realized that I was being a brat—he was trying to teach me something and I let my ego get in the way. I’ve come to view that interaction as a blessing. I interacted with one of the greats, a mentor of my mentor’s mentor (a Great Great Mentor).<br>
A couple of weeks later something even more surreal happened, at illumos Day 2014. Bryan Cantrill was the last speaker of the day. One of my mentors and someone I admire greatly. He was there to regale us with the story of Joyent’s resurrection of lx-branded zones: Linux system call emulation on top of the illumos kernel. But before he would do that he decided to speak about me! I couldn’t believe it. I was so overwhelmed that I don’t remember most of what he said. I was too busy flipping shit—Bryan Cantrill is on stage, in front of other kernel developers I look up to, saying my name. I was in a dream. It turns out, unknown to me at the time, that he wrote the POSIX queue code for both Solaris and QNX, which I wrote about. He compared me to the great expository technical writers Elliott Organick and Richard Stevens. And it was at this moment that I knew I could do this: I could become an OS developer.<br>
Never underestimate the effect kind words can have on someone that looks up to you.</p>
</blockquote>

<ul>
<li>There is a lot more to the story, and it is definitely worth the read</li>
<li>The story then goes on to talk about his recent run in with Bryan Cantrill
&gt; A week from now my two year journey to become an OS developer comes to an end; and a new chapter begins. I don’t know what specific things I’m going to work on, but I’m sure it will push me to the limit. I look forward to the challenge.
***</li>
</ul>

<h3><a href="https://lumina-desktop.org/version-1-0-0-released/" rel="nofollow">Version 1.0 of the Lumina Desktop released</a></h3>

<ul>
<li>After 4 years of development, Lumina Desktop has now hit version 1.0!</li>
<li>This release brings with it a slew of new features and support:</li>
</ul>

<blockquote>
<ul>
<li>Completely customizable interface! Rather than having to learn how to use a new layout, change the desktop to suit you instead!</li>
<li>Simple shortcuts for any application! The “favorites” system makes it easy to find and launch applications at any time.</li>
<li>Extremely lightweight! Allows applications to utilize more of your system hardware and revitalizes older systems!</li>
<li>Multiple-monitor support! Each monitor is treated as an independent entity – making it great for presentation systems which use a temporary monitor or for workstations which utilize an array of monitors for various tasks.</li>
</ul>
</blockquote>

<ul>
<li>While originally developed on PC-BSD, it already has been ported to a variety of different platforms, including OpenBSD, DragonFly, NetBSD, Debian and Gentoo</li>
<li>Lumina has become the defacto desktop environment for TrueOS (Formerly PC-BSD), and looks like will provide a solid framework to continue growing desktop features.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160804200232" rel="nofollow">n2k16 hackathon report: Ken Westerback on dhclient, bridges, routing and more</a></h3>

<ul>
<li>Next up, we have a report from Ken Westerback talking about the recent OpenBSD hackathon in Prague</li>
<li>He starts by telling us about the work in bpf:</li>
</ul>

<blockquote>
<p>First order of business, stsp@&#39;s weird setup involving bridges and multiple dhclient clients. A bit of bpf(4) programming to restrict dhclient to handling ethernet packets unicast to its interface worked. Cool. Unfortunately it turned out some lazy dhcp servers always use ethernet broadcasts just because some lesser, non-OpenBSD clients ignore unicast packets until they have configured IP. Classic chicken and egg. So this was backed out just before 6.0. Sigh.</p>
</blockquote>

<ul>
<li>Next up, he talks about an idea he had on the flight over, specifically with regard to how DHCP leases are stored, and how keeping the SSID information with them could speed up re-connection times, by only trying leases for current SSID’s connected. After a day or so of hacking, it was working! However for $REASONS it was shelved for post 6.0, bummer! </li>
<li> He then discusses an on-going project with Peter Hessler on passing along relevant PIDs in response to routing messages generated by kernel from ioctl events. This is something they’ve been hacking at, in order to allow dhclient to recognize its own routing messages. Sounds like they are both still works-in-progress.</li>
<li>However, Ken did get something in for 6.0:</li>
</ul>

<blockquote>
<p>Diving back into dhclient code I discovered that in situations where multiple offers were received the unused offers were not being declined and discarded. Despite a clear comment saying that&#39;s what was being done! Thus dhclient might gradually use up more and more memory. And possibly be retrying offers that should have been discarded. The fix for this did make 6.0! Yay!</p>
</blockquote>

<hr>

<h3><a href="https://www.usenix.org/memoriam-roger-faulkner" rel="nofollow">In Memoriam Roger Faulkner </a></h3>

<ul>
<li>USENIX has re-released Roger Faulkner’s original paper on /proc as a free download</li>
<li>The UNIX community recently lost one of its original pioneers, Roger Faulkner, whom one commenter described as “The godfather of post-AT&amp;T UNIX”</li>
<li>In his memory, the USENIX group as re-released his original paper on the /proc file-system from 1991.</li>
<li>Roger worked in many area’s of UNIX, however the process file system /proc was his special baby.</li>
<li>“/proc began as a debugger interface superseding ptrace(2) but has evolved into a general interface to the process model.”</li>
<li>The original /proc only had a file for each process, not a directory. &quot;Data may be transferred from or to any valid locations in the process&#39;s address space by applying lseek(2) to position the file at the virtual address of interest followed by read(2) or write(2).&quot;</li>
<li>Processes could be controlled using IOCTLs on the file</li>
<li><p>As the USENIX article states:</p>

<blockquote>
<p>Roger believed that terrible things were sometimes required to create beautiful abstractions, and his trailblazing work on /proc embodies this burden: the innards may be delicate and nasty (&quot;vile,&quot; as Roger might say in his distinguished Carolinian accent)—but the resulting abstractions are breathtaking in their power, scope and robustness.</p>
</blockquote></li>
<li><p>RIP Roger, and thanks for the wonderful UNIX legacy you’ve left us all.</p>

<hr></li>
</ul>

<h2>Interview - Myke Geiger - <a href="mailto:myke@servernorth.net" rel="nofollow">myke@servernorth.net</a> / <a href="https://twitter.com/mWare" rel="nofollow">@mWare</a></h2>

<ul>
<li>Using FreeBSD at a DSL/Cable ISP
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.reddit.com/r/freebsd/comments/4vxnw3/new_options_in_bsdinstall_some_sysctls_and/" rel="nofollow">New options in bsdinstall - some sysctls and date/time settings</a></h3>

<ul>
<li>bsdinstall in FreeBSD 11.0 will feature a number of new menus.</li>
<li>The first, well allow you to set the date and time. Often on computers that have been in storage, or some embedded type devices that have no RTC, the date will be wildly wrong, and ntpd will refuse to run until the date is correctly set. This feature makes it easy to enter the date and time using dialog(1)</li>
<li>The second menu, inspired by the existing ‘services’ menu, offers a number of ‘hardening’ options</li>
<li>This menu allows users to easily enable a number of security features, including:

<ul>
<li>Hide processes running as other users/groups</li>
<li>Disable reading the kernel message buffer and debugging processes for unprivileged users</li>
<li>Randomize the PID of newly created processes</li>
<li>Enable the stack guard</li>
<li>Erase /tmp at boot</li>
<li>Disable remote syslog</li>
<li>Disable sendmail</li>
</ul></li>
<li>All of these options are off by default, so that an install done with the installer will be the same as an install from source, or an upgrade.</li>
<li>A number of these options are candidates to become on-by-default in the future, so the hope is that this menu will get more users to test these features and find any negative interactions with applications or general use, so they can be fixed.
***</li>
</ul>

<h3><a href="https://www.netbsd.org/%7Emartin/rawrite32/" rel="nofollow">Rawrite32: the NetBSD image writing tool</a></h3>

<ul>
<li>Martin of the NetBSD project has released a new version of his USB imaging tool, rawrite32</li>
<li>For those who’ve not used this tool before, it is a Windows Application that allows writing NetBSD images directly to USB media (other other disk media)</li>
<li>This update brings with it support for writing .xz file, and binary signing</li>
<li>This may come in handy for writing other OS images to memory sticks as well, especially for those locked into a windows environment who need to 
switch.
***</li>
</ul>

<h3><a href="https://github.com/j-keck/zfs-snap-diff" rel="nofollow">ZFS-Snap-Diff -- A pretty interface for viewing what changed after a ZFS snapshot </a></h3>

<ul>
<li>There are lots of nice little utilities to help create and maintain your ZFS snapshots. However today we have something unique to look at, ‘zfs-snap-diff’.</li>
<li>What makes it unique, is that it ships with a built-in golang / angularjs GUI for snapshot management</li>
<li>It looks very powerful, including a built-in diff utility, so you can even see the changes in text-files, in addition to downloading files, restoring old versions and more.</li>
<li>Its nice to see so many ZFS utilities starting to take off, and evolve file-management further.
***</li>
</ul>

<h3><a href="https://www.joyent.com/about/events/2016/dtrace-conf" rel="nofollow">Dtrace Conf 2016 Event Videos</a></h3>

<ul>
<li>The videos from Dtrace.conf 2016 have been posted</li>
<li>Some highlights:

<ul>
<li>Useful DTrace Intro</li>
<li>CTF Everywhere</li>
<li>Distributed DTrace</li>
<li>DTrace for Apps</li>
<li>DTrace json() subroutine</li>
<li>Implementing (or not) fds[] in FreeBSD</li>
<li>OpenDTrace</li>
<li>DTrace performance improvements with always-on instrumentation</li>
<li>D Syntactic Sugar</li>
<li>DTrace and Go, DTrace and Postgres</li>
</ul></li>
<li><a href="https://www.joyent.com/blog/dtrace-conf-16-wrap-up" rel="nofollow">dtrace.conf(16) wrap-up by Bryan Cantrill</a> </li>
</ul>

<blockquote>
<p>Once again, it was an eclectic mix of technologists — and once again, the day got kicked off with me providing an introduction to dtrace.conf and its history. (Just to save you the time filling out your Cantrill Presentation Bingo Card: you can find me punching myself at 16:19, me offering unsolicited personal medical history at 20:11, and me getting trolled by unikernels at 38:25.)</p>
</blockquote>

<ul>
<li>The next DTrace.conf isn’t until 2020
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.reddit.com/r/BSD/comments/4vngmw/the_bsd_daemon_feature_in_mexican_candy_packaging/" rel="nofollow">The BSD Daemon features in Mexican candy packaging</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-August/624202.html" rel="nofollow">Remove PG_ZERO and zeroidle (page-zeroing) entirely</a></p></li>
<li><p><a href="https://www.openbsd.org/lyrics.html#60b" rel="nofollow">OpenBSD: Release Songs: 6.0: &quot;Black Hat&quot;</a></p></li>
<li><p><a href="http://satterly.neocities.org/openbsd_games.html" rel="nofollow">OpenBSD Gaming Resource</a> </p></li>
<li><p><a href="http://bsdsec.net/articles/libressl-2-4-2-and-2-3-7-released" rel="nofollow">LibreSSL 2.4.2 and 2.3.7 Released</a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/LJcJmNsR" rel="nofollow"> Pedja - Bhyve GUI </a> </li>
<li><a href="http://pastebin.com/259x94Rh" rel="nofollow"> Tim - Jail Management</a> </li>
<li><a href="http://pastebin.com/A86yHnzz" rel="nofollow"> Don - X260 </a> </li>
<li><a href="http://pastebin.com/wjtcuVSA" rel="nofollow"> David - Updates</a> </li>
<li><a href="http://pastebin.com/DgH9G7p5" rel="nofollow"> Ghislain - Jail Management</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>154: Myths, Pi’s &amp; Features, oh my!</title>
  <link>https://www.bsdnow.tv/154</link>
  <guid isPermaLink="false">0bae832b-aaaf-4862-8850-b4797b8350f8</guid>
  <pubDate>Wed, 10 Aug 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0bae832b-aaaf-4862-8850-b4797b8350f8.mp3" length="35808916" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we are taking a look at a few different tutorials, including running your very own RPi web-server. (Come-on, you</itunes:subtitle>
  <itunes:duration>49:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we are taking a look at a few different tutorials, including running your very own RPi web-server. (Come-on, you
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for 
Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly 
Paranoid"&gt;&lt;/a&gt;
Headlines
broken features aren't used (http://www.tedunangst.com/flak/post/broken-features-arent-used)
This post from TedU talks about the difficulty of removing features from an operating system
“One of the difficulties in removing a feature is identifying all the potential users. A feature here could be a program bundled with an operating system, or a command line option, or maybe just a function in a library. If we remove a feature, users that depend on it will be sad. Unfortunately, absence of evidence is not evidence of absence. I’ve never heard of anybody running ls -p but it’s not impossible that somebody does.”
“The reasons why we want to remove an existing feature can vary. Sometimes it’s old code that interferes with maintenance. Sometimes a nearly complete rewrite can improve performance. In other cases, the feature in question is really more of a misfeature. It may have security implications, where the existence of the feature can be used to facilitate the exploitation of other vulnerabilities, and removing the feature will help mitigate the exploit.”
“There’s no general test that can be used, but there is one test that works in many cases. Test that the feature works. If the feature doesn’t work, that’s compelling evidence that nobody is using it, because nobody can be using it. You don’t need to fix it. You can just remove it.”
He makes some interesting comments about exhaustive unit tests and the push to keep everything working all the time. If you never break anything to see if someone complains, how do you know if it is still being used?
***
A Raspberry Pi FreeBSD Web Server (http://devio.us/~spacemonkey/raspberry_pi_freebsd_web_server_howto.html)
Looking at a super-low power solution to host some webpages? If so, we have the tutorial for you.
Specifically a walkthrough of getting FreeBSD up on a Pi, and setting up nginx, OpenNTPD, LibreSSL and friends. 
The walkthrough starts with grabbing a FreeBSD 11 snapshot for arm64 and doing the initial setup process to get to a bootable FreeBSD system.
If you are an extreme noob, not to fear. The tutorial walks you through setting up usernames, timezones, even a larger /tmp directory on your new MiniBSD setup.
The tedious part comes to play during the setup of packages. The author walks us through setting up LibreSSL and various other packages via ports (Since LibreSSL isn’t the default in FreeBSD). This will take some time to compile on your humble RPi device. (Go make a sandwich, walk the dog, fix the gutters, etc)
When it’s all said and done, you’ll end up with a secure little web-server that you’ve configured all by yourself! (Wondering what the word-press performance would be like on that box)
***
Uber switches from PostgreSQL back to MySQL  (https://eng.uber.com/mysql-migration/)
We often hear success stories of people switching to PostgreSQL and getting huge performance gains, but this stories is the reverse
Uber’s engineering team has switched back to MySQL, because for their specific workload and design, MySQL’s innodb has better performance
Of course, it is not just vanilla MySQL, but “Schemaless”, a sharding system that sits on top of MySQL
The article goes into detail about the on-disk format used by Postgres, and the specific shortcomings that Uber encountered
Uber admits that all of its testing was against the older PostgreSQL 9.2, but one of their complaints is about having difficulty upgrading
“We started out with Postgres 9.1 and successfully completed the upgrade process to move to Postgres 9.2. However, the process took so many hours that we couldn’t afford to do the process again. By the time Postgres 9.3 came out, Uber’s growth increased our dataset substantially, so the upgrade would have been even lengthier. For this reason, our legacy Postgres instances run Postgres 9.2 to this day, even though the current Postgres GA release is 9.5.”
There is a followup, from the Postgres side
“Why we lost Uber as a user”  (https://www.postgresql.org/message-id/5797D5A1.5030009%40agliodbs.com) 
This thread goes into detail about the specific types of problematic queries that Uber was using
“The Uber guy is right that InnoDB handles this better as long as you don't touch the primary key (primary key updates in InnoDB are really bad)”
“This is a common problem case we don't have an answer for yet.”
The thread then goes on to discuss possibly supporting a “pluggable heap storage layer”, to allow different workloads to use different on-disk formats for best performance
***
Getting started with GhostBSD and FreeBSD
Part 1 (http://unsolicitedbutoffered.blogspot.com/2016/07/getting-started-with-ghostbsd-and.html) 
Part 2 (http://unsolicitedbutoffered.blogspot.com/2016/07/getting-started-with-ghostbsd-and_31.html) 
Part 3 (http://unsolicitedbutoffered.blogspot.com/2016/08/getting-started-with-ghostbsd-and.html) 
Part 4 (http://unsolicitedbutoffered.blogspot.com/2016/08/getting-started-with-ghostbsd-and_2.html) 
In what may be our first GhostBSD tutorial, we have a nice walkthrough on the initial getting started with it.
For those who don’t know, GhostBSD provides a nice XFCE or Mate desktop out of box, and still supports 32bit installs for those who want to keep that older hardware running.
The walkthough takes us through the process of grabbing GhostBSD images and getting the installer up and running via bootable USB stick.
Once booted, the graphical installer is straight-forward and short, allowing you to get the bits on disk as quickly as possible. (The actual installation took around 45 Minutes on an old Toshiba NB520)
The author then takes us on a tour of some of GhostBSD’s out-of-box bundled applications (Along with XFCE) and how it compares to similar Linux setups.
Lastly covered is the setup of Wireless (The manual way with WPA supplicant, since the GUI tool appeared to not work in this particular case)
All in all a good walkthrough, especially if you’ve not seen GhostBSD in action before, the screenshots are very informative!
***
News Roundup
Steam on FreeBSD 11-CURRENT (https://github.com/SteamOnFreeBSD/SteamOnFreeBSD)
Steam on FreeBSD. Yes, we’ve heard of setups using WINE, but what about running the Linux binaries natively?
Well you are in luck. We have a github project that details getting the Linux native client up and running on a FreeBSD 11-CURRENT system.
This github project is rather mysterious, with only the instructions to download a pre-packaged steam.txz file, extract and run the provided install.sh script.
Curious I inspected some of the scripts, the installer.sh is fairly straight-forward, but does some ‘non-standard’ freebsd things, like fetching packages and extracting specific files/libaries into a new /compat/ubuntu directory. 
After that, it goes through a huge list of debian/ubuntu packages, also throwing them into the aforementioned ubuntu directory.
At runtime, the wrapper script ensures that various linux compat file-systems are mounted in the correct location, then proceeds to run steam with some LDLIBRARYFLAGS set from the users .local/share/steam directory.
A tad scary if honest, however it is a neat PoC to see Steam working on FreeBSD. Hopefully somebody can turn this into a more traditional package which can be easily removed / cleaned up afterwards.
***
How to run Enlightenment on OpenBSD (http://enform.haxlab.org/)
Are you an enlightenment fan? Be honest, we know there are quite a few of you out there!
If so, we have a tutorial for you today, which talks about how to run E on OpenBSD.
The process is pretty easy, but some steps might be overlooked if you are new to OpenBSD or don’t know how to tune / compile things on your own.
It starts out with adjusting some sysctl’s for better tuning that works on an E based desktop.
Next is installing from package some pre-reqs that will enable us to build E from source.
After that, we need to download and install EFL from github, and the autogen / gmake commands are helpfully provided for you.
Lastly the same is done for E itself, and TADA, E is installed and ready to go on your OpenBSD system. If you do this right, should only take 5-10 minutes to be up and running.
***
Myths about FreeBSD (https://wiki.freebsd.org/Myths)
Over on the FreeBSD wiki, we have a new “Myths” page which we’ve never highlighted on the show before. 
First up, and one I’ve very familiar with, is the usual “FreeBSD is only for Servers and not Desktops”, along with a good rebuttal about what it does offer and mention of projects such as PC-BSD which do it also.
Another prevalent one is the “FreeBSD has a closed development model”, which is easily refuted:
FreeBSD has over 400 developers around the world who have commit access to the repository. Many of these are willing to commit patches from third parties. If you want to get an idea of the number of patches that have been committed on behalf of other developers, then search for 'Submitted by' in the commit logs. At the time of writing, this is just under twenty thousand, or about ten percent of all commits. After having a few patches accepted, regular contributors are usually encouraged to apply for commit access.
Another one that we are still hearing (Although it is less and less now) was the common “FreeBSD makes me compile everything from source”. Listeners of this show will know that pkg has pretty much made this irrelevant in recent years. However the option to compile yourself from source still exists, but most users won’t find this ever necessary.
A good list, with many more items on it than we’ve mentioned here. Take a look, you might find something there you’ve heard in the wild, or maybe even thought yourself at one point!
FreeBSD Area51 testing repo, KDE 5  (https://gist.github.com/swills/8a9a9f8a529256f134830c2a1476db0c)
This github GIST from Steve Wills provides the instructions to enable the FreeBSD xorg teams unofficial ‘Area51’ testing repo on your machine
This gives you access to the new KDE 5
Users should obviously be careful testing early-access software, but bug reports are very welcome, and important to getting KDE 5 working well under FreeBSD
***
Beastie Bits
NetBSD Machines at Open Source Conference 2016 Kyoto (http://mail-index.netbsd.org/netbsd-advocacy/2016/08/01/msg000712.html) 
How to install htop on pfSense (http://www.cyberciti.biz/faq/pfsense-install-htop-using-pkg-command/) 
The first ever patch for #Chromium on #NetBSD has been committed! (https://twitter.com/krytarowski/status/759909139300491265)
CharmBug - Adventures in Hardened BSD - August 24th 2016 (http://www.meetup.com/CharmBUG/events/232474857/) 
Feedback/Questions
 Emanual - GoTTY  (http://pastebin.com/q24sNcNY) 
 Joe - Disable Device  (http://pastebin.com/iTkmpVr9) 
 Allen - ZFS Send/Recv (http://pastebin.com/bPHEP4Ya) 
 Mica - Adobe Replacements (http://pastebin.com/L0ttuNx3) 
 Robroy - RAID (http://pastebin.com/Dr92CGCU) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we are taking a look at a few different tutorials, including running your very own RPi web-server. (Come-on, you</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" <br>
/></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for <br>
Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly <br>
Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/broken-features-arent-used" rel="nofollow">broken features aren&#39;t used</a></h3>

<ul>
<li>This post from TedU talks about the difficulty of removing features from an operating system</li>
<li>“One of the difficulties in removing a feature is identifying all the potential users. A feature here could be a program bundled with an operating system, or a command line option, or maybe just a function in a library. If we remove a feature, users that depend on it will be sad. Unfortunately, absence of evidence is not evidence of absence. I’ve never heard of anybody running ls -p but it’s not impossible that somebody does.”</li>
<li>“The reasons why we want to remove an existing feature can vary. Sometimes it’s old code that interferes with maintenance. Sometimes a nearly complete rewrite can improve performance. In other cases, the feature in question is really more of a misfeature. It may have security implications, where the existence of the feature can be used to facilitate the exploitation of other vulnerabilities, and removing the feature will help mitigate the exploit.”</li>
<li>“There’s no general test that can be used, but there is one test that works in many cases. Test that the feature works. If the feature doesn’t work, that’s compelling evidence that nobody is using it, because nobody can be using it. You don’t need to fix it. You can just remove it.”</li>
<li>He makes some interesting comments about exhaustive unit tests and the push to keep everything working all the time. If you never break anything to see if someone complains, how do you know if it is still being used?
***</li>
</ul>

<h3><a href="http://devio.us/%7Espacemonkey/raspberry_pi_freebsd_web_server_howto.html" rel="nofollow">A Raspberry Pi FreeBSD Web Server</a></h3>

<ul>
<li>Looking at a super-low power solution to host some webpages? If so, we have the tutorial for you.</li>
<li>Specifically a walkthrough of getting FreeBSD up on a Pi, and setting up nginx, OpenNTPD, LibreSSL and friends. </li>
<li>The walkthrough starts with grabbing a FreeBSD 11 snapshot for arm64 and doing the initial setup process to get to a bootable FreeBSD system.</li>
<li>If you are an extreme noob, not to fear. The tutorial walks you through setting up usernames, timezones, even a larger /tmp directory on your new MiniBSD setup.</li>
<li>The tedious part comes to play during the setup of packages. The author walks us through setting up LibreSSL and various other packages via ports (Since LibreSSL isn’t the default in FreeBSD). This will take some time to compile on your humble RPi device. (Go make a sandwich, walk the dog, fix the gutters, etc)</li>
<li>When it’s all said and done, you’ll end up with a secure little web-server that you’ve configured all by yourself! (Wondering what the word-press performance would be like on that box)
***</li>
</ul>

<h3><a href="https://eng.uber.com/mysql-migration/" rel="nofollow">Uber switches from PostgreSQL back to MySQL </a></h3>

<ul>
<li>We often hear success stories of people switching to PostgreSQL and getting huge performance gains, but this stories is the reverse</li>
<li>Uber’s engineering team has switched back to MySQL, because for their specific workload and design, MySQL’s innodb has better performance</li>
<li>Of course, it is not just vanilla MySQL, but “Schemaless”, a sharding system that sits on top of MySQL</li>
<li>The article goes into detail about the on-disk format used by Postgres, and the specific shortcomings that Uber encountered</li>
<li>Uber admits that all of its testing was against the older PostgreSQL 9.2, but one of their complaints is about having difficulty upgrading</li>
<li>“We started out with Postgres 9.1 and successfully completed the upgrade process to move to Postgres 9.2. However, the process took so many hours that we couldn’t afford to do the process again. By the time Postgres 9.3 came out, Uber’s growth increased our dataset substantially, so the upgrade would have been even lengthier. For this reason, our legacy Postgres instances run Postgres 9.2 to this day, even though the current Postgres GA release is 9.5.”</li>
<li>There is a followup, from the Postgres side</li>
<li><a href="https://www.postgresql.org/message-id/5797D5A1.5030009%40agliodbs.com" rel="nofollow">“Why we lost Uber as a user” </a> </li>
<li>This thread goes into detail about the specific types of problematic queries that Uber was using</li>
<li>“The Uber guy is right that InnoDB handles this better as long as you don&#39;t touch the primary key (primary key updates in InnoDB are really bad)”</li>
<li>“This is a common problem case we don&#39;t have an answer for yet.”</li>
<li>The thread then goes on to discuss possibly supporting a “pluggable heap storage layer”, to allow different workloads to use different on-disk formats for best performance
***</li>
</ul>

<h3>Getting started with GhostBSD and FreeBSD</h3>

<ul>
<li><a href="http://unsolicitedbutoffered.blogspot.com/2016/07/getting-started-with-ghostbsd-and.html" rel="nofollow">Part 1</a> </li>
<li><a href="http://unsolicitedbutoffered.blogspot.com/2016/07/getting-started-with-ghostbsd-and_31.html" rel="nofollow">Part 2</a> </li>
<li><a href="http://unsolicitedbutoffered.blogspot.com/2016/08/getting-started-with-ghostbsd-and.html" rel="nofollow">Part 3</a> </li>
<li><a href="http://unsolicitedbutoffered.blogspot.com/2016/08/getting-started-with-ghostbsd-and_2.html" rel="nofollow">Part 4</a> </li>
<li>In what may be our first GhostBSD tutorial, we have a nice walkthrough on the initial getting started with it.</li>
<li>For those who don’t know, GhostBSD provides a nice XFCE or Mate desktop out of box, and still supports 32bit installs for those who want to keep that older hardware running.</li>
<li>The walkthough takes us through the process of grabbing GhostBSD images and getting the installer up and running via bootable USB stick.</li>
<li>Once booted, the graphical installer is straight-forward and short, allowing you to get the bits on disk as quickly as possible. (The actual installation took around 45 Minutes on an old Toshiba NB520)</li>
<li>The author then takes us on a tour of some of GhostBSD’s out-of-box bundled applications (Along with XFCE) and how it compares to similar Linux setups.</li>
<li>Lastly covered is the setup of Wireless (The manual way with WPA supplicant, since the GUI tool appeared to not work in this particular case)</li>
<li>All in all a good walkthrough, especially if you’ve not seen GhostBSD in action before, the screenshots are very informative!
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://github.com/SteamOnFreeBSD/SteamOnFreeBSD" rel="nofollow">Steam on FreeBSD 11-CURRENT</a></h3>

<ul>
<li>Steam on FreeBSD. Yes, we’ve heard of setups using WINE, but what about running the Linux binaries natively?</li>
<li>Well you are in luck. We have a github project that details getting the Linux native client up and running on a FreeBSD 11-CURRENT system.</li>
<li>This github project is rather mysterious, with only the instructions to download a pre-packaged steam.txz file, extract and run the provided install.sh script.</li>
<li>Curious I inspected some of the scripts, the installer.sh is fairly straight-forward, but does some ‘non-standard’ freebsd things, like fetching packages and extracting specific files/libaries into a new /compat/ubuntu directory. </li>
<li>After that, it goes through a huge list of debian/ubuntu packages, also throwing them into the aforementioned ubuntu directory.</li>
<li>At runtime, the wrapper script ensures that various linux compat file-systems are mounted in the correct location, then proceeds to run steam with some LD_LIBRARY_FLAGS set from the users .local/share/steam directory.</li>
<li>A tad scary if honest, however it is a neat PoC to see Steam working on FreeBSD. Hopefully somebody can turn this into a more traditional package which can be easily removed / cleaned up afterwards.
***</li>
</ul>

<h3><a href="http://enform.haxlab.org/" rel="nofollow">How to run Enlightenment on OpenBSD</a></h3>

<ul>
<li>Are you an enlightenment fan? Be honest, we know there are quite a few of you out there!</li>
<li>If so, we have a tutorial for you today, which talks about how to run E on OpenBSD.</li>
<li>The process is pretty easy, but some steps might be overlooked if you are new to OpenBSD or don’t know how to tune / compile things on your own.</li>
<li>It starts out with adjusting some sysctl’s for better tuning that works on an E based desktop.</li>
<li>Next is installing from package some pre-reqs that will enable us to build E from source.</li>
<li>After that, we need to download and install EFL from github, and the autogen / gmake commands are helpfully provided for you.</li>
<li>Lastly the same is done for E itself, and TADA, E is installed and ready to go on your OpenBSD system. If you do this right, should only take 5-10 minutes to be up and running.
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/Myths" rel="nofollow">Myths about FreeBSD</a></h3>

<ul>
<li>Over on the FreeBSD wiki, we have a new “Myths” page which we’ve never highlighted on the show before. </li>
<li>First up, and one I’ve very familiar with, is the usual “FreeBSD is only for Servers and not Desktops”, along with a good rebuttal about what it does offer and mention of projects such as PC-BSD which do it also.</li>
<li>Another prevalent one is the “FreeBSD has a closed development model”, which is easily refuted:</li>
</ul>

<blockquote>
<p>FreeBSD has over 400 developers around the world who have commit access to the repository. Many of these are willing to commit patches from third parties. If you want to get an idea of the number of patches that have been committed on behalf of other developers, then search for &#39;Submitted by&#39; in the commit logs. At the time of writing, this is just under twenty thousand, or about ten percent of all commits. After having a few patches accepted, regular contributors are usually encouraged to apply for commit access.</p>
</blockquote>

<ul>
<li><p>Another one that we are still hearing (Although it is less and less now) was the common “FreeBSD makes me compile everything from source”. Listeners of this show will know that pkg has pretty much made this irrelevant in recent years. However the option to compile yourself from source still exists, but most users won’t find this ever necessary.</p></li>
<li><p>A good list, with many more items on it than we’ve mentioned here. Take a look, you might find something there you’ve heard in the wild, or maybe even thought yourself at one point!</p>

<hr></li>
</ul>

<h3><a href="https://gist.github.com/swills/8a9a9f8a529256f134830c2a1476db0c" rel="nofollow">FreeBSD Area51 testing repo, KDE 5 </a></h3>

<ul>
<li>This github GIST from Steve Wills provides the instructions to enable the FreeBSD xorg teams unofficial ‘Area51’ testing repo on your machine</li>
<li>This gives you access to the new KDE 5</li>
<li>Users should obviously be careful testing early-access software, but bug reports are very welcome, and important to getting KDE 5 working well under FreeBSD
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://mail-index.netbsd.org/netbsd-advocacy/2016/08/01/msg000712.html" rel="nofollow">NetBSD Machines at Open Source Conference 2016 Kyoto</a> </p></li>
<li><p><a href="http://www.cyberciti.biz/faq/pfsense-install-htop-using-pkg-command/" rel="nofollow">How to install htop on pfSense</a> </p></li>
<li><p><a href="https://twitter.com/krytarowski/status/759909139300491265" rel="nofollow">The first ever patch for #Chromium on #NetBSD has been committed!</a></p></li>
<li><p><a href="http://www.meetup.com/CharmBUG/events/232474857/" rel="nofollow">CharmBug - Adventures in Hardened BSD - August 24th 2016</a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/q24sNcNY" rel="nofollow"> Emanual - GoTTY </a> </li>
<li><a href="http://pastebin.com/iTkmpVr9" rel="nofollow"> Joe - Disable Device </a> </li>
<li><a href="http://pastebin.com/bPHEP4Ya" rel="nofollow"> Allen - ZFS Send/Recv</a> </li>
<li><a href="http://pastebin.com/L0ttuNx3" rel="nofollow"> Mica - Adobe Replacements</a> </li>
<li><a href="http://pastebin.com/Dr92CGCU" rel="nofollow"> Robroy - RAID</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we are taking a look at a few different tutorials, including running your very own RPi web-server. (Come-on, you</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" <br>
/></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for <br>
Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly <br>
Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/broken-features-arent-used" rel="nofollow">broken features aren&#39;t used</a></h3>

<ul>
<li>This post from TedU talks about the difficulty of removing features from an operating system</li>
<li>“One of the difficulties in removing a feature is identifying all the potential users. A feature here could be a program bundled with an operating system, or a command line option, or maybe just a function in a library. If we remove a feature, users that depend on it will be sad. Unfortunately, absence of evidence is not evidence of absence. I’ve never heard of anybody running ls -p but it’s not impossible that somebody does.”</li>
<li>“The reasons why we want to remove an existing feature can vary. Sometimes it’s old code that interferes with maintenance. Sometimes a nearly complete rewrite can improve performance. In other cases, the feature in question is really more of a misfeature. It may have security implications, where the existence of the feature can be used to facilitate the exploitation of other vulnerabilities, and removing the feature will help mitigate the exploit.”</li>
<li>“There’s no general test that can be used, but there is one test that works in many cases. Test that the feature works. If the feature doesn’t work, that’s compelling evidence that nobody is using it, because nobody can be using it. You don’t need to fix it. You can just remove it.”</li>
<li>He makes some interesting comments about exhaustive unit tests and the push to keep everything working all the time. If you never break anything to see if someone complains, how do you know if it is still being used?
***</li>
</ul>

<h3><a href="http://devio.us/%7Espacemonkey/raspberry_pi_freebsd_web_server_howto.html" rel="nofollow">A Raspberry Pi FreeBSD Web Server</a></h3>

<ul>
<li>Looking at a super-low power solution to host some webpages? If so, we have the tutorial for you.</li>
<li>Specifically a walkthrough of getting FreeBSD up on a Pi, and setting up nginx, OpenNTPD, LibreSSL and friends. </li>
<li>The walkthrough starts with grabbing a FreeBSD 11 snapshot for arm64 and doing the initial setup process to get to a bootable FreeBSD system.</li>
<li>If you are an extreme noob, not to fear. The tutorial walks you through setting up usernames, timezones, even a larger /tmp directory on your new MiniBSD setup.</li>
<li>The tedious part comes to play during the setup of packages. The author walks us through setting up LibreSSL and various other packages via ports (Since LibreSSL isn’t the default in FreeBSD). This will take some time to compile on your humble RPi device. (Go make a sandwich, walk the dog, fix the gutters, etc)</li>
<li>When it’s all said and done, you’ll end up with a secure little web-server that you’ve configured all by yourself! (Wondering what the word-press performance would be like on that box)
***</li>
</ul>

<h3><a href="https://eng.uber.com/mysql-migration/" rel="nofollow">Uber switches from PostgreSQL back to MySQL </a></h3>

<ul>
<li>We often hear success stories of people switching to PostgreSQL and getting huge performance gains, but this stories is the reverse</li>
<li>Uber’s engineering team has switched back to MySQL, because for their specific workload and design, MySQL’s innodb has better performance</li>
<li>Of course, it is not just vanilla MySQL, but “Schemaless”, a sharding system that sits on top of MySQL</li>
<li>The article goes into detail about the on-disk format used by Postgres, and the specific shortcomings that Uber encountered</li>
<li>Uber admits that all of its testing was against the older PostgreSQL 9.2, but one of their complaints is about having difficulty upgrading</li>
<li>“We started out with Postgres 9.1 and successfully completed the upgrade process to move to Postgres 9.2. However, the process took so many hours that we couldn’t afford to do the process again. By the time Postgres 9.3 came out, Uber’s growth increased our dataset substantially, so the upgrade would have been even lengthier. For this reason, our legacy Postgres instances run Postgres 9.2 to this day, even though the current Postgres GA release is 9.5.”</li>
<li>There is a followup, from the Postgres side</li>
<li><a href="https://www.postgresql.org/message-id/5797D5A1.5030009%40agliodbs.com" rel="nofollow">“Why we lost Uber as a user” </a> </li>
<li>This thread goes into detail about the specific types of problematic queries that Uber was using</li>
<li>“The Uber guy is right that InnoDB handles this better as long as you don&#39;t touch the primary key (primary key updates in InnoDB are really bad)”</li>
<li>“This is a common problem case we don&#39;t have an answer for yet.”</li>
<li>The thread then goes on to discuss possibly supporting a “pluggable heap storage layer”, to allow different workloads to use different on-disk formats for best performance
***</li>
</ul>

<h3>Getting started with GhostBSD and FreeBSD</h3>

<ul>
<li><a href="http://unsolicitedbutoffered.blogspot.com/2016/07/getting-started-with-ghostbsd-and.html" rel="nofollow">Part 1</a> </li>
<li><a href="http://unsolicitedbutoffered.blogspot.com/2016/07/getting-started-with-ghostbsd-and_31.html" rel="nofollow">Part 2</a> </li>
<li><a href="http://unsolicitedbutoffered.blogspot.com/2016/08/getting-started-with-ghostbsd-and.html" rel="nofollow">Part 3</a> </li>
<li><a href="http://unsolicitedbutoffered.blogspot.com/2016/08/getting-started-with-ghostbsd-and_2.html" rel="nofollow">Part 4</a> </li>
<li>In what may be our first GhostBSD tutorial, we have a nice walkthrough on the initial getting started with it.</li>
<li>For those who don’t know, GhostBSD provides a nice XFCE or Mate desktop out of box, and still supports 32bit installs for those who want to keep that older hardware running.</li>
<li>The walkthough takes us through the process of grabbing GhostBSD images and getting the installer up and running via bootable USB stick.</li>
<li>Once booted, the graphical installer is straight-forward and short, allowing you to get the bits on disk as quickly as possible. (The actual installation took around 45 Minutes on an old Toshiba NB520)</li>
<li>The author then takes us on a tour of some of GhostBSD’s out-of-box bundled applications (Along with XFCE) and how it compares to similar Linux setups.</li>
<li>Lastly covered is the setup of Wireless (The manual way with WPA supplicant, since the GUI tool appeared to not work in this particular case)</li>
<li>All in all a good walkthrough, especially if you’ve not seen GhostBSD in action before, the screenshots are very informative!
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://github.com/SteamOnFreeBSD/SteamOnFreeBSD" rel="nofollow">Steam on FreeBSD 11-CURRENT</a></h3>

<ul>
<li>Steam on FreeBSD. Yes, we’ve heard of setups using WINE, but what about running the Linux binaries natively?</li>
<li>Well you are in luck. We have a github project that details getting the Linux native client up and running on a FreeBSD 11-CURRENT system.</li>
<li>This github project is rather mysterious, with only the instructions to download a pre-packaged steam.txz file, extract and run the provided install.sh script.</li>
<li>Curious I inspected some of the scripts, the installer.sh is fairly straight-forward, but does some ‘non-standard’ freebsd things, like fetching packages and extracting specific files/libaries into a new /compat/ubuntu directory. </li>
<li>After that, it goes through a huge list of debian/ubuntu packages, also throwing them into the aforementioned ubuntu directory.</li>
<li>At runtime, the wrapper script ensures that various linux compat file-systems are mounted in the correct location, then proceeds to run steam with some LD_LIBRARY_FLAGS set from the users .local/share/steam directory.</li>
<li>A tad scary if honest, however it is a neat PoC to see Steam working on FreeBSD. Hopefully somebody can turn this into a more traditional package which can be easily removed / cleaned up afterwards.
***</li>
</ul>

<h3><a href="http://enform.haxlab.org/" rel="nofollow">How to run Enlightenment on OpenBSD</a></h3>

<ul>
<li>Are you an enlightenment fan? Be honest, we know there are quite a few of you out there!</li>
<li>If so, we have a tutorial for you today, which talks about how to run E on OpenBSD.</li>
<li>The process is pretty easy, but some steps might be overlooked if you are new to OpenBSD or don’t know how to tune / compile things on your own.</li>
<li>It starts out with adjusting some sysctl’s for better tuning that works on an E based desktop.</li>
<li>Next is installing from package some pre-reqs that will enable us to build E from source.</li>
<li>After that, we need to download and install EFL from github, and the autogen / gmake commands are helpfully provided for you.</li>
<li>Lastly the same is done for E itself, and TADA, E is installed and ready to go on your OpenBSD system. If you do this right, should only take 5-10 minutes to be up and running.
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/Myths" rel="nofollow">Myths about FreeBSD</a></h3>

<ul>
<li>Over on the FreeBSD wiki, we have a new “Myths” page which we’ve never highlighted on the show before. </li>
<li>First up, and one I’ve very familiar with, is the usual “FreeBSD is only for Servers and not Desktops”, along with a good rebuttal about what it does offer and mention of projects such as PC-BSD which do it also.</li>
<li>Another prevalent one is the “FreeBSD has a closed development model”, which is easily refuted:</li>
</ul>

<blockquote>
<p>FreeBSD has over 400 developers around the world who have commit access to the repository. Many of these are willing to commit patches from third parties. If you want to get an idea of the number of patches that have been committed on behalf of other developers, then search for &#39;Submitted by&#39; in the commit logs. At the time of writing, this is just under twenty thousand, or about ten percent of all commits. After having a few patches accepted, regular contributors are usually encouraged to apply for commit access.</p>
</blockquote>

<ul>
<li><p>Another one that we are still hearing (Although it is less and less now) was the common “FreeBSD makes me compile everything from source”. Listeners of this show will know that pkg has pretty much made this irrelevant in recent years. However the option to compile yourself from source still exists, but most users won’t find this ever necessary.</p></li>
<li><p>A good list, with many more items on it than we’ve mentioned here. Take a look, you might find something there you’ve heard in the wild, or maybe even thought yourself at one point!</p>

<hr></li>
</ul>

<h3><a href="https://gist.github.com/swills/8a9a9f8a529256f134830c2a1476db0c" rel="nofollow">FreeBSD Area51 testing repo, KDE 5 </a></h3>

<ul>
<li>This github GIST from Steve Wills provides the instructions to enable the FreeBSD xorg teams unofficial ‘Area51’ testing repo on your machine</li>
<li>This gives you access to the new KDE 5</li>
<li>Users should obviously be careful testing early-access software, but bug reports are very welcome, and important to getting KDE 5 working well under FreeBSD
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://mail-index.netbsd.org/netbsd-advocacy/2016/08/01/msg000712.html" rel="nofollow">NetBSD Machines at Open Source Conference 2016 Kyoto</a> </p></li>
<li><p><a href="http://www.cyberciti.biz/faq/pfsense-install-htop-using-pkg-command/" rel="nofollow">How to install htop on pfSense</a> </p></li>
<li><p><a href="https://twitter.com/krytarowski/status/759909139300491265" rel="nofollow">The first ever patch for #Chromium on #NetBSD has been committed!</a></p></li>
<li><p><a href="http://www.meetup.com/CharmBUG/events/232474857/" rel="nofollow">CharmBug - Adventures in Hardened BSD - August 24th 2016</a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/q24sNcNY" rel="nofollow"> Emanual - GoTTY </a> </li>
<li><a href="http://pastebin.com/iTkmpVr9" rel="nofollow"> Joe - Disable Device </a> </li>
<li><a href="http://pastebin.com/bPHEP4Ya" rel="nofollow"> Allen - ZFS Send/Recv</a> </li>
<li><a href="http://pastebin.com/L0ttuNx3" rel="nofollow"> Mica - Adobe Replacements</a> </li>
<li><a href="http://pastebin.com/Dr92CGCU" rel="nofollow"> Robroy - RAID</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>153: Big int trouble</title>
  <link>https://www.bsdnow.tv/153</link>
  <guid isPermaLink="false">a08dade0-6b9f-4b0c-8dbf-390f1d1a05c0</guid>
  <pubDate>Wed, 03 Aug 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a08dade0-6b9f-4b0c-8dbf-390f1d1a05c0.mp3" length="55789780" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we have a variety of news to discuss, covering quite the spectrum of BSD. (Including a new DragonFly release!).</itunes:subtitle>
  <itunes:duration>1:17:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we have a variety of news to discuss, covering quite the spectrum of BSD. (Including a new DragonFly release!).
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for 
Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly 
Paranoid"&gt;&lt;/a&gt;
Headlines
my int is too big (http://www.tedunangst.com/flak/post/my-int-is-too-big)
“The NCC Group report (http://marc.info/?l=oss-security&amp;amp;m=146853062403622&amp;amp;w=2) describes the bugs, but not the history of the code.”
“Several of them, as reported by NCC, involved similar integer truncation issues. Actually, they involved very similar modern 64 bit code meeting classic 32 bit code”
“The thrsleep system call is a part of the kernel code that supports threads. As the name implies, it gives userland a measure of control over scheduling and lets a thread sleep until something happens. As such, it takes a timeout in the form of a timespec. The kernel, however, internally implements time keeping using ticks (there are HZ, 100, ticks per second). The tsleep function (t is for timed) takes an int number of ticks and performs basic validation by checking that it’s not negative. A negative timeout would indicate that the caller has miscalculated. The kernel panics so you can fix the bug, instead of stalling forever.”
“The trouble therefore is when userland is allowed to specify a timeout that could be negative. The existing code made an attempt to handle various tricks by converting the timespec to a ticks value stored as a 64 bit long long which was checked against INTMAX before passing to sleep. Any value over INTMAX would be truncated, so we can’t allow that. Instead, we saturate the value to INT_MAX. Unfortunately, this check didn’t account for the possibility that the tick conversion from the timespec could also overflow and result in a negative value.”
Then there is the description of the kqueue flaw:
“Every kqueue keeps a list of all the attached events it’s watching for. A simple array is used to store file events, indexed by fd.”
“This array is scaled to accommodate the largest fd that needs to be stored. This would obviously cause trouble, consuming too much memory, if the identifier were not validated first. Which is exactly what kqueue tries to do. The fdgetfile function checks that the identifier is a file that the process has open. One wrinkle. fdgetfile takes an int argument but ident is a uintptr_t, possibly 64 bits. An ident of 2^32 + 2 will look like a valid file descriptor, but then cause the array to be resized to gargantuan proportions.”
“Again, the fix is pretty simple. We must check that the ident is bounded by INTMAX before calling fdgetfile. This bug likely would have been exploitable beyond a panic, but the array allocation was changed to use mallocarray instead of multiplying arguments by hand, thus preventing another overflow.”
Then there is a description of the anonymous mmap flaw, and the “secret magic” _MAPNOFAULT flag
***
FreeBSD Quarterly Status Report Q2 2016 (https://www.freebsd.org/news/status/report-2016-04-2016-06.html)
It’s time for another round of FreeBSD Quarterly Status Reports!
In this edition, we have status updates from the various teams, including IRC/Bugs/RE/Ports/Core and Foundation
We also have updates on some specific projects, including  from Konstantin on the on-going work for his implementation of ASLR, including the new ‘proccontrol’ command which provides the following:
&amp;gt; “The proccontrol(1) utility was written to manage and query ASLR enforcement on a per-process basis. It is required for analyzing ASLR failures in specific programs. This utility leverages the procctl(2) interface which was added to the previous version of the patch, with some bug fixes.”
Next are updates on porting CEPH to FreeBSD, the ongoing work to improve EFI+GELI (touched on last week) and more robust Mutexes. 
Additionally we have an update from Matt Macy and the Xorg team discussing the current work to update FreeBSD’s graphic stack:
&amp;gt; “All Intel GPUs up to and including the unreleased Kaby Lake     are supported. The xf86-video-intel driver will be updated soon. Updating this driver requires updating Xorg, which in turn is blocked on Nvidia updates.”
The kernel also got some feature status updates, including on the new Allwinner SoC support, an update on FreeBSD in Hyper-V and VIMAGE 
In addition to a quick update on the arm64 architecture (It’s getting there, RPi3 is almost a thing), we also have a slew of port updates, including support for GitLab in ports, updates on GNOME / KDE and some additional Intel-specific networking tools.
***
Vulnerabilities discovered in freebsd-update and portsnap (https://lists.freebsd.org/pipermail/freebsd-security/2016-July/009016.html)
There are two vulnerabilities discovered in freebsd-update and portsnap, where an attacker could place files in the portsnap directory and they would be used without being subject to having their checksum verified (but this requires root access), and the second where a man-in-the-middle attacker could guess the name of a file you will fetch by exploiting the time-gap between when you download the initial snapshot, and when you fetch the updated files.
There are a number of vulnerabilities that were discovered in libarchive/tar as well
There is also an issue with bspatch. A security advisory for bspatch has already been released, as this vulnerabilities was also discovered by the Chromium team, which uses this same code. The patch discussed in this mailing list thread is larger, but secteam@ believes at least one of the additional checks introduced is incorrect and may prevent a valid patch from being applied. The smaller patch was pushed out first, to solve the main attack vector, while the larger patch is investigated. Automated fuzz testing is underway. Great care is being taken fixing bspatch, as if it is broken installing future updates becomes much more difficult
secteam@ and core@ would like to emphasize that the FreeBSD project takes these issue very seriously and are working on it
&amp;gt;  “As a general rule, secteam@ does not announce vulnerabilities for which we don't have patches, but we concede that we should have considered making an exception in this case”
Work is underway to re-architect freebsd-update and portsnap to do signature verification on all files before they are passed to libarchive/tar, to help protect users from any future vulnerabilities in libarchive.
However, this requires changes to the metadata format to provide these additional signatures, and backwards compatibilities must be preserved, so people can update to the newer versions to get these additional security features 
There is also discussion of using HTTPS for delivery of the files, but certificate verification and trust are always an issue. FreeBSD does not distribute a certificate trust store by default.
There will be more on this in the coming days.
***
OpenSSH 7.3 Released (http://www.openssh.com/txt/release-7.3)
OpenSSH 7.3 has landed! 
Primarily a bug-fix release, the release notes do mention the pending deprecation of some more legacy Crypto in the future, including denying all RSA keys &amp;lt; 1024bit, and removal of SSHv1 support. (Already disabled via compile option)
On the bug side, there was a security issue addressed in sshd:
“sshd(8): Mitigate a potential denial-of-service attack against the system's crypt(3) function via sshd(8). An attacker could send very long passwords that would cause excessive CPU use in crypt(3). sshd(8) now refuses to accept password authentication requests of length greater than 1024 characters”
Also a timing issue was resolved in regard to password auth, which could possibly allow an attacker to discern between valid/invalid account names.
On the feature side, we have the new ProxyJump option (-J flag) which allows you to do simplified indirection through various SSH jump hosts.
Various bugs were fixed, and some compile failures resolved in the portable version to auto-disable some ciphers not supported by OpenSSL.
News Roundup
OpenBSD Ports - Integrating Third Party Applications [pdf] (http://jggimi.homeip.net/semibug.pdf)
A talk from Josh Grosse, presented at SEMIBUG (South-East Michigan BSD Users Group), about OpenBSD Ports
It opens by explaining the separation of the ‘base system’ from ‘packages’, as is common in most all BSDs
It explains the contents of OpenBSD package tar file, which contain some metadata files (+CONTENTS and +DESC) and then the actual package files
The talk goes on to explain the different branches (-release, -stable, and -current), and warn users that there are no official -stable packages from the project
Then it goes on into the development model, including what new contributors should expect
Then it walks through the entire process of creating a port and getting it contributed
***
NetBSD removes last RWX page in amd64 kernel (http://mail-index.netbsd.org/source-changes/2016/07/27/msg076413.html)
NetBSD has purged the last holdout RWX page on the amd64 platform
&amp;gt; “Use UVMPROTALL only if UVMKMFEXEC is given as argument. Otherwise, if UVMKMFPAGEABLE is also given as argument, only the VA is allocated and UVM waits for the page to fault before kentering it. When kentering it, it will use the UVMPROT flag that was passed to uvm_map; which means that it will kenter it as RWX. With this change, the number of RWX pages in the amd64 kernel reaches strictly zero.”
Break out the party favors! Hopefully any last stragglers in any of the other BSD’s gets retired soon as well.
***
DragonFly BSD 4.6 launches with home-grown support for NVMe Controllers (http://linux.softpedia.com/blog/dragonfly-bsd-4-6-0-launches-with-home-grown-support-for-nvme-controllers-506908.shtml)
Softpedia picked up on the release of DragonFlyBSD 4.6, specifically about their new home-grown NVMe driver. 
&amp;gt; “We now have a NVMe driver (PCIe SSDs). It currently must be kldloaded with nvme_load="YES" in /boot/loader.conf. The driver uses all concurrency features offered by the chip and will distribute queues and interrupts across multiple CPUs to maximize performance. It has been tested up to around 1.05M IOPS @4K, and roughly 6.5 GBytes/sec @32K (random read from urandom-filled partition, physio, many threads), with the 2xE5-2620v4 (xeon) test server 78% idle in the IOPS test and 72% idle on the bandwidth test. In other words, we maxed out the three NVMe devices we had plugged in and the system still had plenty of suds left over. Please note that a machine's ability to boot from an NVMe device depends on the BIOS, and not DragonFly. Most BIOSes cannot boot from NVMe devices and those that can probably only do it through UEFI. Info on device state is available with the new utility nvmectl.“
In addition to this improved support, 4.6 also brings in the improved graphics support, matching what is in Linux 4.4 and support for Broadwell/Skylake.
SMP also got some love:
&amp;gt; “SMP performance was already very good. As part of the NVMe driver work we revamped the buffer cache subsystem and a number of other I/O related paths, further reducing lock contention and IPI signalling overheads. We also put topology-aware cpu cache localization into the kernel memory allocator (primarily helps multi-socket systems and systems with high core counts). The network subsystem also continues to receive significant improvement, with modest machine configurations now capable of handling upwards of 580K conns/sec.“
+Full Release Notes (https://www.dragonflybsd.org/release46/) 
***
The powerd++ daemon monitors the system load and adjusts the CPU clock accordingly and is a drop-in replacement for FreeBSD's native powerd(8). (http://www.freshports.org/sysutils/powerdxx/)
As mentioned in our EuroBSDCon 2016 rundown, Dominic Fandrey will be giving a presentation about his powerd replacement, powerd++
The source code is already available on github, and is in ports
The major difference is the newer design handle many-core systems much better. The original powerd was written at a time when most laptops only had a single core, and maybe a hyperthread.
The new design decides which CPU frequency to use by looking at the busiest core, rather than the average across the cores, resulting in a more meaningful result. It also supports averaging over a longer period of time, to avoid jumping to a higher frequency to quickly
powerd++ also avoids ‘slewing’ the cpu frequency, ratching it up and down one step at a time, and instead jumps directly to the target frequency.
Often times, you will use less battery by jumping to maximum frequency, finishing the work, and going back to a low power state, than trying to do that work over a longer period of time in low power mode
***
Beastie Bits
Hyper-V: Unmapped I/O improves userland direct disk performance by 35% ~ 135% (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=303474) 
One does not simply remove FreeBSD (https://imgur.com/a/gjGoq) 
A new BSD Podcast "BSD Synergy" has started (https://www.youtube.com/channel/UCBua6yMtJ6W5ExYSREnS3UQ)
KnoxBug - Next Meeting - Aug 30th  (http://knoxbug.org/content/2016-08-30) 
Feedback/Questions
 Daniel - Root/Wheel (http://pastebin.com/8sMyKm6c) 
 Joe - IPV6 Frag (http://pastebin.com/r5Y0gbxf) 
 Paul - ChicagoBug (http://pastebin.com/iVYPYcVs) 
 Chris - SSH BruteBlock (http://pastebin.com/597m9gHa) 
 Todd - Jails  (http://pastebin.com/xjbKwSaz) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we have a variety of news to discuss, covering quite the spectrum of BSD. (Including a new DragonFly release!).</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" <br>
/></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for <br>
Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly <br>
Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/my-int-is-too-big" rel="nofollow">my int is too big</a></h3>

<ul>
<li>“The <a href="http://marc.info/?l=oss-security&m=146853062403622&w=2" rel="nofollow">NCC Group report</a> describes the bugs, but not the history of the code.”</li>
<li>“Several of them, as reported by NCC, involved similar integer truncation issues. Actually, they involved very similar modern 64 bit code meeting classic 32 bit code”</li>
<li>“The thrsleep system call is a part of the kernel code that supports threads. As the name implies, it gives userland a measure of control over scheduling and lets a thread sleep until something happens. As such, it takes a timeout in the form of a timespec. The kernel, however, internally implements time keeping using ticks (there are HZ, 100, ticks per second). The tsleep function (t is for timed) takes an int number of ticks and performs basic validation by checking that it’s not negative. A negative timeout would indicate that the caller has miscalculated. The kernel panics so you can fix the bug, instead of stalling forever.”</li>
<li>“The trouble therefore is when userland is allowed to specify a timeout that could be negative. The existing code made an attempt to handle various tricks by converting the timespec to a ticks value stored as a 64 bit long long which was checked against INT_MAX before passing to sleep. Any value over INT_MAX would be truncated, so we can’t allow that. Instead, we saturate the value to INT_MAX. Unfortunately, this check didn’t account for the possibility that the tick conversion from the timespec could also overflow and result in a negative value.”</li>
<li>Then there is the description of the kqueue flaw:</li>
<li>“Every kqueue keeps a list of all the attached events it’s watching for. A simple array is used to store file events, indexed by fd.”</li>
<li>“This array is scaled to accommodate the largest fd that needs to be stored. This would obviously cause trouble, consuming too much memory, if the identifier were not validated first. Which is exactly what kqueue tries to do. The fd_getfile function checks that the identifier is a file that the process has open. One wrinkle. fd_getfile takes an int argument but ident is a uintptr_t, possibly 64 bits. An ident of 2<sup>32</sup> + 2 will look like a valid file descriptor, but then cause the array to be resized to gargantuan proportions.”</li>
<li>“Again, the fix is pretty simple. We must check that the ident is bounded by INT_MAX before calling fd_getfile. This bug likely would have been exploitable beyond a panic, but the array allocation was changed to use mallocarray instead of multiplying arguments by hand, thus preventing another overflow.”</li>
<li>Then there is a description of the anonymous mmap flaw, and the “secret magic” __MAP_NOFAULT flag
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2016-04-2016-06.html" rel="nofollow">FreeBSD Quarterly Status Report Q2 2016</a></h3>

<ul>
<li>It’s time for another round of FreeBSD Quarterly Status Reports!</li>
<li>In this edition, we have status updates from the various teams, including IRC/Bugs/RE/Ports/Core and Foundation</li>
<li>We also have updates on some specific projects, including  from Konstantin on the on-going work for his implementation of ASLR, including the new ‘proccontrol’ command which provides the following:
&gt; “The proccontrol(1) utility was written to manage and query ASLR enforcement on a per-process basis. It is required for analyzing ASLR failures in specific programs. This utility leverages the procctl(2) interface which was added to the previous version of the patch, with some bug fixes.”</li>
<li>Next are updates on porting CEPH to FreeBSD, the ongoing work to improve EFI+GELI (touched on last week) and more robust Mutexes. </li>
<li>Additionally we have an update from Matt Macy and the Xorg team discussing the current work to update FreeBSD’s graphic stack:
&gt; “All Intel GPUs up to and including the unreleased Kaby Lake     are supported. The xf86-video-intel driver will be updated soon. Updating this driver requires updating Xorg, which in turn is blocked on Nvidia updates.”</li>
<li>The kernel also got some feature status updates, including on the new Allwinner SoC support, an update on FreeBSD in Hyper-V and VIMAGE </li>
<li>In addition to a quick update on the arm64 architecture (It’s getting there, RPi3 is almost a thing), we also have a slew of port updates, including support for GitLab in ports, updates on GNOME / KDE and some additional Intel-specific networking tools.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-security/2016-July/009016.html" rel="nofollow">Vulnerabilities discovered in freebsd-update and portsnap</a></h3>

<ul>
<li>There are two vulnerabilities discovered in freebsd-update and portsnap, where an attacker could place files in the portsnap directory and they would be used without being subject to having their checksum verified (but this requires root access), and the second where a man-in-the-middle attacker could guess the name of a file you will fetch by exploiting the time-gap between when you download the initial snapshot, and when you fetch the updated files.</li>
<li>There are a number of vulnerabilities that were discovered in libarchive/tar as well</li>
<li>There is also an issue with bspatch. A security advisory for bspatch has already been released, as this vulnerabilities was also discovered by the Chromium team, which uses this same code. The patch discussed in this mailing list thread is larger, but secteam@ believes at least one of the additional checks introduced is incorrect and may prevent a valid patch from being applied. The smaller patch was pushed out first, to solve the main attack vector, while the larger patch is investigated. Automated fuzz testing is underway. Great care is being taken fixing bspatch, as if it is broken installing future updates becomes much more difficult</li>
<li>secteam@ and core@ would like to emphasize that the FreeBSD project takes these issue very seriously and are working on it
&gt;  “As a general rule, secteam@ does not announce vulnerabilities for which we don&#39;t have patches, but we concede that we should have considered making an exception in this case”</li>
<li>Work is underway to re-architect freebsd-update and portsnap to do signature verification on all files before they are passed to libarchive/tar, to help protect users from any future vulnerabilities in libarchive.</li>
<li>However, this requires changes to the metadata format to provide these additional signatures, and backwards compatibilities must be preserved, so people can update to the newer versions to get these additional security features </li>
<li>There is also discussion of using HTTPS for delivery of the files, but certificate verification and trust are always an issue. FreeBSD does not distribute a certificate trust store by default.</li>
<li>There will be more on this in the coming days.
***</li>
</ul>

<h3><a href="http://www.openssh.com/txt/release-7.3" rel="nofollow">OpenSSH 7.3 Released</a></h3>

<ul>
<li>OpenSSH 7.3 has landed! </li>
<li>Primarily a bug-fix release, the release notes do mention the pending deprecation of some more legacy Crypto in the future, including denying all RSA keys &lt; 1024bit, and removal of SSHv1 support. (Already disabled via compile option)</li>
<li><p>On the bug side, there was a security issue addressed in sshd:</p>

<blockquote>
<p>“sshd(8): Mitigate a potential denial-of-service attack against the system&#39;s crypt(3) function via sshd(8). An attacker could send very long passwords that would cause excessive CPU use in crypt(3). sshd(8) now refuses to accept password authentication requests of length greater than 1024 characters”</p>
</blockquote></li>
<li><p>Also a timing issue was resolved in regard to password auth, which could possibly allow an attacker to discern between valid/invalid account names.</p></li>
<li><p>On the feature side, we have the new ProxyJump option (-J flag) which allows you to do simplified indirection through various SSH jump hosts.</p></li>
<li><p>Various bugs were fixed, and some compile failures resolved in the portable version to auto-disable some ciphers not supported by OpenSSL.</p>

<hr></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://jggimi.homeip.net/semibug.pdf" rel="nofollow">OpenBSD Ports - Integrating Third Party Applications [pdf]</a></h3>

<ul>
<li>A talk from Josh Grosse, presented at SEMIBUG (South-East Michigan BSD Users Group), about OpenBSD Ports</li>
<li>It opens by explaining the separation of the ‘base system’ from ‘packages’, as is common in most all BSDs</li>
<li>It explains the contents of OpenBSD package tar file, which contain some metadata files (+CONTENTS and +DESC) and then the actual package files</li>
<li>The talk goes on to explain the different branches (-release, -stable, and -current), and warn users that there are no official -stable packages from the project</li>
<li>Then it goes on into the development model, including what new contributors should expect</li>
<li>Then it walks through the entire process of creating a port and getting it contributed
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/source-changes/2016/07/27/msg076413.html" rel="nofollow">NetBSD removes last RWX page in amd64 kernel</a></h3>

<ul>
<li>NetBSD has purged the last holdout RWX page on the amd64 platform
&gt; “Use UVM_PROT_ALL only if UVM_KMF_EXEC is given as argument. Otherwise, if UVM_KMF_PAGEABLE is also given as argument, only the VA is allocated and UVM waits for the page to fault before kentering it. When kentering it, it will use the UVM_PROT_ flag that was passed to uvm_map; which means that it will kenter it as RWX. With this change, the number of RWX pages in the amd64 kernel reaches strictly zero.”</li>
<li>Break out the party favors! Hopefully any last stragglers in any of the other BSD’s gets retired soon as well.
***</li>
</ul>

<h3><a href="http://linux.softpedia.com/blog/dragonfly-bsd-4-6-0-launches-with-home-grown-support-for-nvme-controllers-506908.shtml" rel="nofollow">DragonFly BSD 4.6 launches with home-grown support for NVMe Controllers</a></h3>

<ul>
<li>Softpedia picked up on the release of DragonFlyBSD 4.6, specifically about their new home-grown NVMe driver. 
&gt; “We now have a NVMe driver (PCIe SSDs). It currently must be kldloaded with nvme_load=&quot;YES&quot; in /boot/loader.conf. The driver uses all concurrency features offered by the chip and will distribute queues and interrupts across multiple CPUs to maximize performance. It has been tested up to around 1.05M IOPS @4K, and roughly 6.5 GBytes/sec @32K (random read from urandom-filled partition, physio, many threads), with the 2xE5-2620v4 (xeon) test server 78% idle in the IOPS test and 72% idle on the bandwidth test. In other words, we maxed out the three NVMe devices we had plugged in and the system still had plenty of suds left over. Please note that a machine&#39;s ability to boot from an NVMe device depends on the BIOS, and not DragonFly. Most BIOSes cannot boot from NVMe devices and those that can probably only do it through UEFI. Info on device state is available with the new utility nvmectl.“</li>
<li>In addition to this improved support, 4.6 also brings in the improved graphics support, matching what is in Linux 4.4 and support for Broadwell/Skylake.</li>
<li>SMP also got some love:
&gt; “SMP performance was already very good. As part of the NVMe driver work we revamped the buffer cache subsystem and a number of other I/O related paths, further reducing lock contention and IPI signalling overheads. We also put topology-aware cpu cache localization into the kernel memory allocator (primarily helps multi-socket systems and systems with high core counts). The network subsystem also continues to receive significant improvement, with modest machine configurations now capable of handling upwards of 580K conns/sec.“
+<a href="https://www.dragonflybsd.org/release46/" rel="nofollow">Full Release Notes</a> 
***</li>
</ul>

<h3><a href="http://www.freshports.org/sysutils/powerdxx/" rel="nofollow">The powerd++ daemon monitors the system load and adjusts the CPU clock accordingly and is a drop-in replacement for FreeBSD&#39;s native powerd(8).</a></h3>

<ul>
<li>As mentioned in our EuroBSDCon 2016 rundown, Dominic Fandrey will be giving a presentation about his powerd replacement, powerd++</li>
<li>The source code is already available on github, and is in ports</li>
<li>The major difference is the newer design handle many-core systems much better. The original powerd was written at a time when most laptops only had a single core, and maybe a hyperthread.</li>
<li>The new design decides which CPU frequency to use by looking at the busiest core, rather than the average across the cores, resulting in a more meaningful result. It also supports averaging over a longer period of time, to avoid jumping to a higher frequency to quickly</li>
<li>powerd++ also avoids ‘slewing’ the cpu frequency, ratching it up and down one step at a time, and instead jumps directly to the target frequency.</li>
<li>Often times, you will use less battery by jumping to maximum frequency, finishing the work, and going back to a low power state, than trying to do that work over a longer period of time in low power mode
***</li>
</ul>

<h2>Beastie Bits</h2>

<p><a href="https://svnweb.freebsd.org/base?view=revision&revision=303474" rel="nofollow">Hyper-V: Unmapped I/O improves userland direct disk performance by 35% ~ 135%</a> </p>

<p><a href="https://imgur.com/a/gjGoq" rel="nofollow">One does not simply remove FreeBSD</a> </p>

<p><a href="https://www.youtube.com/channel/UCBua6yMtJ6W5ExYSREnS3UQ" rel="nofollow">A new BSD Podcast &quot;BSD Synergy&quot; has started</a></p>

<p><a href="http://knoxbug.org/content/2016-08-30" rel="nofollow">KnoxBug - Next Meeting - Aug 30th </a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/8sMyKm6c" rel="nofollow"> Daniel - Root/Wheel</a> </li>
<li><a href="http://pastebin.com/r5Y0gbxf" rel="nofollow"> Joe - IPV6 Frag</a> </li>
<li><a href="http://pastebin.com/iVYPYcVs" rel="nofollow"> Paul - ChicagoBug</a> </li>
<li><a href="http://pastebin.com/597m9gHa" rel="nofollow"> Chris - SSH BruteBlock</a> </li>
<li><a href="http://pastebin.com/xjbKwSaz" rel="nofollow"> Todd - Jails </a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we have a variety of news to discuss, covering quite the spectrum of BSD. (Including a new DragonFly release!).</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" <br>
/></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for <br>
Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly <br>
Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/my-int-is-too-big" rel="nofollow">my int is too big</a></h3>

<ul>
<li>“The <a href="http://marc.info/?l=oss-security&m=146853062403622&w=2" rel="nofollow">NCC Group report</a> describes the bugs, but not the history of the code.”</li>
<li>“Several of them, as reported by NCC, involved similar integer truncation issues. Actually, they involved very similar modern 64 bit code meeting classic 32 bit code”</li>
<li>“The thrsleep system call is a part of the kernel code that supports threads. As the name implies, it gives userland a measure of control over scheduling and lets a thread sleep until something happens. As such, it takes a timeout in the form of a timespec. The kernel, however, internally implements time keeping using ticks (there are HZ, 100, ticks per second). The tsleep function (t is for timed) takes an int number of ticks and performs basic validation by checking that it’s not negative. A negative timeout would indicate that the caller has miscalculated. The kernel panics so you can fix the bug, instead of stalling forever.”</li>
<li>“The trouble therefore is when userland is allowed to specify a timeout that could be negative. The existing code made an attempt to handle various tricks by converting the timespec to a ticks value stored as a 64 bit long long which was checked against INT_MAX before passing to sleep. Any value over INT_MAX would be truncated, so we can’t allow that. Instead, we saturate the value to INT_MAX. Unfortunately, this check didn’t account for the possibility that the tick conversion from the timespec could also overflow and result in a negative value.”</li>
<li>Then there is the description of the kqueue flaw:</li>
<li>“Every kqueue keeps a list of all the attached events it’s watching for. A simple array is used to store file events, indexed by fd.”</li>
<li>“This array is scaled to accommodate the largest fd that needs to be stored. This would obviously cause trouble, consuming too much memory, if the identifier were not validated first. Which is exactly what kqueue tries to do. The fd_getfile function checks that the identifier is a file that the process has open. One wrinkle. fd_getfile takes an int argument but ident is a uintptr_t, possibly 64 bits. An ident of 2<sup>32</sup> + 2 will look like a valid file descriptor, but then cause the array to be resized to gargantuan proportions.”</li>
<li>“Again, the fix is pretty simple. We must check that the ident is bounded by INT_MAX before calling fd_getfile. This bug likely would have been exploitable beyond a panic, but the array allocation was changed to use mallocarray instead of multiplying arguments by hand, thus preventing another overflow.”</li>
<li>Then there is a description of the anonymous mmap flaw, and the “secret magic” __MAP_NOFAULT flag
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2016-04-2016-06.html" rel="nofollow">FreeBSD Quarterly Status Report Q2 2016</a></h3>

<ul>
<li>It’s time for another round of FreeBSD Quarterly Status Reports!</li>
<li>In this edition, we have status updates from the various teams, including IRC/Bugs/RE/Ports/Core and Foundation</li>
<li>We also have updates on some specific projects, including  from Konstantin on the on-going work for his implementation of ASLR, including the new ‘proccontrol’ command which provides the following:
&gt; “The proccontrol(1) utility was written to manage and query ASLR enforcement on a per-process basis. It is required for analyzing ASLR failures in specific programs. This utility leverages the procctl(2) interface which was added to the previous version of the patch, with some bug fixes.”</li>
<li>Next are updates on porting CEPH to FreeBSD, the ongoing work to improve EFI+GELI (touched on last week) and more robust Mutexes. </li>
<li>Additionally we have an update from Matt Macy and the Xorg team discussing the current work to update FreeBSD’s graphic stack:
&gt; “All Intel GPUs up to and including the unreleased Kaby Lake     are supported. The xf86-video-intel driver will be updated soon. Updating this driver requires updating Xorg, which in turn is blocked on Nvidia updates.”</li>
<li>The kernel also got some feature status updates, including on the new Allwinner SoC support, an update on FreeBSD in Hyper-V and VIMAGE </li>
<li>In addition to a quick update on the arm64 architecture (It’s getting there, RPi3 is almost a thing), we also have a slew of port updates, including support for GitLab in ports, updates on GNOME / KDE and some additional Intel-specific networking tools.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-security/2016-July/009016.html" rel="nofollow">Vulnerabilities discovered in freebsd-update and portsnap</a></h3>

<ul>
<li>There are two vulnerabilities discovered in freebsd-update and portsnap, where an attacker could place files in the portsnap directory and they would be used without being subject to having their checksum verified (but this requires root access), and the second where a man-in-the-middle attacker could guess the name of a file you will fetch by exploiting the time-gap between when you download the initial snapshot, and when you fetch the updated files.</li>
<li>There are a number of vulnerabilities that were discovered in libarchive/tar as well</li>
<li>There is also an issue with bspatch. A security advisory for bspatch has already been released, as this vulnerabilities was also discovered by the Chromium team, which uses this same code. The patch discussed in this mailing list thread is larger, but secteam@ believes at least one of the additional checks introduced is incorrect and may prevent a valid patch from being applied. The smaller patch was pushed out first, to solve the main attack vector, while the larger patch is investigated. Automated fuzz testing is underway. Great care is being taken fixing bspatch, as if it is broken installing future updates becomes much more difficult</li>
<li>secteam@ and core@ would like to emphasize that the FreeBSD project takes these issue very seriously and are working on it
&gt;  “As a general rule, secteam@ does not announce vulnerabilities for which we don&#39;t have patches, but we concede that we should have considered making an exception in this case”</li>
<li>Work is underway to re-architect freebsd-update and portsnap to do signature verification on all files before they are passed to libarchive/tar, to help protect users from any future vulnerabilities in libarchive.</li>
<li>However, this requires changes to the metadata format to provide these additional signatures, and backwards compatibilities must be preserved, so people can update to the newer versions to get these additional security features </li>
<li>There is also discussion of using HTTPS for delivery of the files, but certificate verification and trust are always an issue. FreeBSD does not distribute a certificate trust store by default.</li>
<li>There will be more on this in the coming days.
***</li>
</ul>

<h3><a href="http://www.openssh.com/txt/release-7.3" rel="nofollow">OpenSSH 7.3 Released</a></h3>

<ul>
<li>OpenSSH 7.3 has landed! </li>
<li>Primarily a bug-fix release, the release notes do mention the pending deprecation of some more legacy Crypto in the future, including denying all RSA keys &lt; 1024bit, and removal of SSHv1 support. (Already disabled via compile option)</li>
<li><p>On the bug side, there was a security issue addressed in sshd:</p>

<blockquote>
<p>“sshd(8): Mitigate a potential denial-of-service attack against the system&#39;s crypt(3) function via sshd(8). An attacker could send very long passwords that would cause excessive CPU use in crypt(3). sshd(8) now refuses to accept password authentication requests of length greater than 1024 characters”</p>
</blockquote></li>
<li><p>Also a timing issue was resolved in regard to password auth, which could possibly allow an attacker to discern between valid/invalid account names.</p></li>
<li><p>On the feature side, we have the new ProxyJump option (-J flag) which allows you to do simplified indirection through various SSH jump hosts.</p></li>
<li><p>Various bugs were fixed, and some compile failures resolved in the portable version to auto-disable some ciphers not supported by OpenSSL.</p>

<hr></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://jggimi.homeip.net/semibug.pdf" rel="nofollow">OpenBSD Ports - Integrating Third Party Applications [pdf]</a></h3>

<ul>
<li>A talk from Josh Grosse, presented at SEMIBUG (South-East Michigan BSD Users Group), about OpenBSD Ports</li>
<li>It opens by explaining the separation of the ‘base system’ from ‘packages’, as is common in most all BSDs</li>
<li>It explains the contents of OpenBSD package tar file, which contain some metadata files (+CONTENTS and +DESC) and then the actual package files</li>
<li>The talk goes on to explain the different branches (-release, -stable, and -current), and warn users that there are no official -stable packages from the project</li>
<li>Then it goes on into the development model, including what new contributors should expect</li>
<li>Then it walks through the entire process of creating a port and getting it contributed
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/source-changes/2016/07/27/msg076413.html" rel="nofollow">NetBSD removes last RWX page in amd64 kernel</a></h3>

<ul>
<li>NetBSD has purged the last holdout RWX page on the amd64 platform
&gt; “Use UVM_PROT_ALL only if UVM_KMF_EXEC is given as argument. Otherwise, if UVM_KMF_PAGEABLE is also given as argument, only the VA is allocated and UVM waits for the page to fault before kentering it. When kentering it, it will use the UVM_PROT_ flag that was passed to uvm_map; which means that it will kenter it as RWX. With this change, the number of RWX pages in the amd64 kernel reaches strictly zero.”</li>
<li>Break out the party favors! Hopefully any last stragglers in any of the other BSD’s gets retired soon as well.
***</li>
</ul>

<h3><a href="http://linux.softpedia.com/blog/dragonfly-bsd-4-6-0-launches-with-home-grown-support-for-nvme-controllers-506908.shtml" rel="nofollow">DragonFly BSD 4.6 launches with home-grown support for NVMe Controllers</a></h3>

<ul>
<li>Softpedia picked up on the release of DragonFlyBSD 4.6, specifically about their new home-grown NVMe driver. 
&gt; “We now have a NVMe driver (PCIe SSDs). It currently must be kldloaded with nvme_load=&quot;YES&quot; in /boot/loader.conf. The driver uses all concurrency features offered by the chip and will distribute queues and interrupts across multiple CPUs to maximize performance. It has been tested up to around 1.05M IOPS @4K, and roughly 6.5 GBytes/sec @32K (random read from urandom-filled partition, physio, many threads), with the 2xE5-2620v4 (xeon) test server 78% idle in the IOPS test and 72% idle on the bandwidth test. In other words, we maxed out the three NVMe devices we had plugged in and the system still had plenty of suds left over. Please note that a machine&#39;s ability to boot from an NVMe device depends on the BIOS, and not DragonFly. Most BIOSes cannot boot from NVMe devices and those that can probably only do it through UEFI. Info on device state is available with the new utility nvmectl.“</li>
<li>In addition to this improved support, 4.6 also brings in the improved graphics support, matching what is in Linux 4.4 and support for Broadwell/Skylake.</li>
<li>SMP also got some love:
&gt; “SMP performance was already very good. As part of the NVMe driver work we revamped the buffer cache subsystem and a number of other I/O related paths, further reducing lock contention and IPI signalling overheads. We also put topology-aware cpu cache localization into the kernel memory allocator (primarily helps multi-socket systems and systems with high core counts). The network subsystem also continues to receive significant improvement, with modest machine configurations now capable of handling upwards of 580K conns/sec.“
+<a href="https://www.dragonflybsd.org/release46/" rel="nofollow">Full Release Notes</a> 
***</li>
</ul>

<h3><a href="http://www.freshports.org/sysutils/powerdxx/" rel="nofollow">The powerd++ daemon monitors the system load and adjusts the CPU clock accordingly and is a drop-in replacement for FreeBSD&#39;s native powerd(8).</a></h3>

<ul>
<li>As mentioned in our EuroBSDCon 2016 rundown, Dominic Fandrey will be giving a presentation about his powerd replacement, powerd++</li>
<li>The source code is already available on github, and is in ports</li>
<li>The major difference is the newer design handle many-core systems much better. The original powerd was written at a time when most laptops only had a single core, and maybe a hyperthread.</li>
<li>The new design decides which CPU frequency to use by looking at the busiest core, rather than the average across the cores, resulting in a more meaningful result. It also supports averaging over a longer period of time, to avoid jumping to a higher frequency to quickly</li>
<li>powerd++ also avoids ‘slewing’ the cpu frequency, ratching it up and down one step at a time, and instead jumps directly to the target frequency.</li>
<li>Often times, you will use less battery by jumping to maximum frequency, finishing the work, and going back to a low power state, than trying to do that work over a longer period of time in low power mode
***</li>
</ul>

<h2>Beastie Bits</h2>

<p><a href="https://svnweb.freebsd.org/base?view=revision&revision=303474" rel="nofollow">Hyper-V: Unmapped I/O improves userland direct disk performance by 35% ~ 135%</a> </p>

<p><a href="https://imgur.com/a/gjGoq" rel="nofollow">One does not simply remove FreeBSD</a> </p>

<p><a href="https://www.youtube.com/channel/UCBua6yMtJ6W5ExYSREnS3UQ" rel="nofollow">A new BSD Podcast &quot;BSD Synergy&quot; has started</a></p>

<p><a href="http://knoxbug.org/content/2016-08-30" rel="nofollow">KnoxBug - Next Meeting - Aug 30th </a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/8sMyKm6c" rel="nofollow"> Daniel - Root/Wheel</a> </li>
<li><a href="http://pastebin.com/r5Y0gbxf" rel="nofollow"> Joe - IPV6 Frag</a> </li>
<li><a href="http://pastebin.com/iVYPYcVs" rel="nofollow"> Paul - ChicagoBug</a> </li>
<li><a href="http://pastebin.com/597m9gHa" rel="nofollow"> Chris - SSH BruteBlock</a> </li>
<li><a href="http://pastebin.com/xjbKwSaz" rel="nofollow"> Todd - Jails </a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>152: The Laporte has landed!</title>
  <link>https://www.bsdnow.tv/152</link>
  <guid isPermaLink="false">b946bdcd-f9d8-4480-995a-0eb2cb5e1b77</guid>
  <pubDate>Wed, 27 Jul 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b946bdcd-f9d8-4480-995a-0eb2cb5e1b77.mp3" length="51561940" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we have some big breaking news about another major switcher to FreeBSD, plus early information about the pending</itunes:subtitle>
  <itunes:duration>1:11:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we have some big breaking news about another major switcher to FreeBSD, plus early information about the pending
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for 
Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly 
Paranoid"&gt;&lt;/a&gt;
Headlines
Leo Laporte tries FreeBSD (http://www.leolaporte.com/blog/a-grand-experiment)
Leo Laporte, formerly of TechTV, and now of TWiT.tv, is switching to FreeBSD
“The latest debacle over the "forced" upgrade to Windows 10 and Apple's increasingly locked-in ecosystem has got me thinking. Do I really need to use a proprietary operating system to get work done? And while I'm at it, do I need to use commercial cloud services to store my data?”
A sometimes Linux user since the mid 90s, Leo talks about his motivations:
“But as time went by, even Ubuntu began to seem too commercial to me”
“So now for the grand experiment. Is it possible, I wonder, to do everything I need to do on an even more venerable, more robust system: a true UNIX OS, FreeBSD? Here are my requirements”
Browsing
Email with PGP signing and encryption
Coding - I'm a hobbyist programmer requiring support for lisp/scheme/racket, rust, and python (and maybe forth and clojure and meteor and whatever else is cool and new)
Writing
A password vault. I currently use Lastpass because it syncs with mobile but eventually I'll need to find a FOSS replacement for that, too
Photo editing - this is the toughest to replace. I love Photoshop and Lightroom. Can I get by with, say, GIMP and Darktable?
I do all of those things on my PCBSD machine all the time
“I love Linux and will continue to use it on my laptops, but for my main workhorse desktop I think FreeBSD will be a better choice. I also look forward to learning and administering a true UNIX system.”
He got a nice SuperMicro based workstation, with an Intel Xeon E3-1275v5 and an NVIDIA GeForce GTX 960 GPU
I have a server with one of those Skylake E3s, it is very nice
“450Mbps Wireless N Dual Band PCI-e Adapter w/ 3x 2dBi Antennas (Yes, sad to say, unless I rewire my house I'll have to use Wi-Fi with this beast. I'll probably rewire my house.)”
He plans to have a 4x 1TB ZFS pool, plus a second pool backed by a 512 GB NVMe m.2 for the OS
“And I'll continue to chronicle my journey into the land of FOSS here when The Beast arrives. But in the meantime, please excuse me, I've got some reading to do.”
Leo went so far as to slap a “Power By FreeBSD” sticker  (https://youtu.be/vNVst_rxxm0?t=270) on the back of his new Tesla
***
OpenBSD 6.0 to be released on Sept 1st, 2016 (http://undeadly.org/cgi?action=article&amp;amp;sid=20160725100831)
OpenBSD 6.0 Tenative Released Notes (https://www.openbsd.org/60.html)
OpenBSD 6.0 is just around the corner, currently slated for Sept 1st and brings with it a whole slew of exciting new features
First up, and let’s get this right out of the way.. VAX support has been dropped!! Oh no!
However to make up for this devastating loss, armv7 has been added to this release.
The tentative release notes are very complete and marks 6.0 as quite an exciting release
OpenBSD 6.0 Pre-orders up (http://undeadly.org/cgi?action=article&amp;amp;sid=20160726230851) 
OpenBSD 6.0 tightens security by losing Linux compatibility (http://www.infoworld.com/article/3099038/open-source-tools/openbsd-60-tightens-security-by-losing-linux-compatibility.html)
In related news, infoworld picked up on the pending removal of Linux compat from OpenBSD 6.0.
Touted as a security feature, you will soon be unable to run legacy linux binaries on OpenBSD. This has both positives and negatives depending upon your use case. Ironically we’re excitedly awaiting improved Linux Compat support in FreeBSD, to allow running some various closed-source applications. (Netflix DRM, Steam, Skype to name a few)
***
EuroBSDCon 2016 Schedule released (https://2016.eurobsdcon.org/talks-schedule/)
EuroBSDCon 2016 Tutorial Schedule released (https://2016.eurobsdcon.org/tutorials/) 
EuroBSDCon has announced the list of talks and tutorials for September 22nd-25th’s conference!
George Neville Neil (Who we’ve interviewed in the past) is giving the keynote about “The Coming Decades of BSD”
***
News Roundup
Blast from the past
No interview again this week, we’re working on getting some people lined up.
The Leo Laporte story brought these old gem from TechTV into my youtube playlist:
Matt Olander and Murrey Stokey explain FreeBSD on TechTV  (https://www.youtube.com/watch?v=d0UsXwRvaIg)
Matt Olander and Brooks Davis explain building a cluster with FreeBSD on TechTV  (https://www.youtube.com/watch?v=bAsYz5pVwyc)
FreeBSD vs Linux Part 1 (https://www.youtube.com/watch?v=91igg2UX7o8)
FreeBSD vs Linux Part 2 (https://www.youtube.com/watch?v=oU88fQkwfws)
***
Running FreeBSD on the LibreM  (https://ericmccorkleblog.wordpress.com/2016/07/16/freebsd-librem-update/)
Eric McCorkle (Who has worked on the EFI loader for a while now) has written an update on his efforts to get FreeBSD working properly on the LibreM 13 laptop.
Since April the work seems to be progressing nicely
Matt Macy’s i915 graphics patch works well on the Librem 13, and I personally made sure that the suspend/resume support works.  The patch is very stable on the Librem, and I’ve only had one kernel panic the entire time testing it.
The HDMI output Just Works™ with the i915 driver.  Even better, it works for both X11 and console modes.
Full support for the Atheros 9462 card has been merged in.  I’ve had some occasional issues, but it works for the most part.
The vesa weirdness is obviated by i915 support, but it was resolved by using the scfb driver.
Some of the outstanding issues still being worked on are support for Synaptics on this particular touchpad, as well as hotkey support for the keyboard, and brightness controls.
In addition Eric is still working on the EFI + Geli support, with the eventual goal of getting EFI secure-boot working out of box as well.
More OpenBSD syscall fuzzing (http://seclists.org/oss-sec/2016/q3/157)
NCC Group’s Project Triforce continues its work of fuzzing OpenBSD
This time they have found a flaw that allows any user to panic the kernel
Attempting to read from the tmpfs_vfsops sysctl tree will panic the system: “attempt to execute user address 0x0 in supervisor mode”
This is actually a “good” thing…
“Impact: Any user can panic the kernel by using the sysctl call.  If a user can manage to map a page at address zero, they may be able to gain kernel code execution and escalate privileges”
OpenBSD’s default configuration prevents mapping a page at address zero, so the code execution is prevented
So while a panic is a bad outcome, it is a lot better than it could have been
***
Root privilege escalation on NetBSD (http://akat1.pl/?id=2)
This post described a root privilege escalation in NetBSD
mail.local is a utility included in the base system for delivering mail to other users on the same system, rather than invoking a mail client and going through the mail server.
The mail.local utility contains a ‘time of check / time of use’ vulnerability. This means that it checks if a file or permission is valid, and then later accesses that file. If an attacker can change that file between the time when it is checked, and the time when it is used, they may be able to exploit the system by evading the check
This is exactly what happens in this case
mail.local appends a message to the indicated user’s mailbox
It first checks if the target user already has an existing mailbox file. If the file exists, but is a link, mail.local exits with an error (to prevent exploits)
If the file does not exist, it is created
The message is then appended to the file
If the file needed to be created, it is chown’d to the owner of the mailbox
This is where the problem lies, if mail.local checks and does not find the mailbox, but an attacker then creates a link from the target mailbox to some other file
mail.local then appends to that file instead, thinking it is creating the new mailbox
Then, mail.local chown’s the target file to the user the attacker was trying to send mail to
The article explains how this could be used to replace /etc/master.passwd etc, but opts for an easier proof of concept, replacing /usr/bin/atrun, which is run as root every 5 minutes from crontab with a script that will copy the shell to /tmp and mark it setuid
The attacker can then run that shell out of /tmp, and be root
NetBSD fixed the vulnerability by changing the code flow, separating the cases for opening an existing file from creating a new file.
In the case where an existing file is opened, the code then verifies that the file that was opened has the same inode number and is on the same device, as the file that was checked earlier, to ensure it was not a link
***
FreeBSD Heap vulnerability in bspatch (https://www.freebsd.org/security/advisories/FreeBSD-SA-16:25.bspatch.asc)
An important vuln has been found and fixed in FreeBSD this past week, specifically relating to the ‘bspatch’ utility.
“Upstream's bspatch.c implementation doesn't check for negative values on the number of bytes to read from the "diff" and "extra" streams, allowing an attacker controlling the patch file to write at arbitrary locations in the heap.”
This could result in a crash, or running arbitrary code as the user running bspatch. (Often root)
“bspatch's main loop reads three numbers from the "control" stream in the patch: X, Y and Z. The first two are the number of bytes to read from "diff" and "extra" (and thus only non-negative), while the third one could be positive or negative and moves the oldpos pointer on the source image. These 3 values are 64bits signed ints (encoded somehow on the file) that are later passed the function that reads from the streams, but those values are not verified to be non-negative.”
“Chrome[OS] has four different implementations of this program, all derived from the same original code by Colin Percival.”
Chromium Issue Tracker  (https://bugs.chromium.org/p/chromium/issues/detail?id=372525)
Patch your systems now!
***
Beastie Bits:
If you're a BUG member or Organizer, please contact BSD Now (https://twitter.com/q5sys/status/758087886927388673) 
TedU writes about some interesting localizations to gcc in openbsd, and why they are there  (http://www.tedunangst.com/flak/post/one-reason-to-hate-openbsd) 
List of Products based on FreeBSD -- Help complete the list  (https://en.wikipedia.org/wiki/List_of_products_based_on_FreeBSD)
Virtualbox v5 hits the FreeBSD Ports tree (http://www.freshports.org/emulators/virtualbox-ose/) 
Skull Canyon NUC booting FreeBSD 11.0-BETA2 (https://gist.github.com/gonzopancho/b71be467f45594822131f4816d6cb718) 
2016 BSDCan Trip Report : Trent Thompson (https://www.freebsdfoundation.org/blog/2016-bsdcan-trip-report-trent-thompson/) 
August London BSD Meetup (http://mail-index.netbsd.org/regional-london/2016/07/25/msg000542.html) 
Feedback/Questions
 Michael Open-Source Alts (http://pastebin.com/eiWbDXTd) 
 Herminio - AP Troubles (http://pastebin.com/w9aCDBut) 
 Jake - Plasma (http://pastebin.com/d15QpVFw) 
 Morgan - Clean DO Droplets (http://pastebin.com/Wj1P7jq8) 
Chris - Auditd (http://pastebin.com/U9PYEH6K) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we have some big breaking news about another major switcher to FreeBSD, plus early information about the pending</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" <br>
/></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for <br>
Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly <br>
Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.leolaporte.com/blog/a-grand-experiment" rel="nofollow">Leo Laporte tries FreeBSD</a></h3>

<ul>
<li>Leo Laporte, formerly of TechTV, and now of TWiT.tv, is switching to FreeBSD</li>
<li>“The latest debacle over the &quot;forced&quot; upgrade to Windows 10 and Apple&#39;s increasingly locked-in ecosystem has got me thinking. Do I really need to use a proprietary operating system to get work done? And while I&#39;m at it, do I need to use commercial cloud services to store my data?”</li>
<li>A sometimes Linux user since the mid 90s, Leo talks about his motivations:</li>
<li>“But as time went by, even Ubuntu began to seem too commercial to me”</li>
<li>“So now for the grand experiment. Is it possible, I wonder, to do everything I need to do on an even more venerable, more robust system: a true UNIX OS, FreeBSD? Here are my requirements”</li>
<li>Browsing</li>
<li>Email with PGP signing and encryption</li>
<li>Coding - I&#39;m a hobbyist programmer requiring support for lisp/scheme/racket, rust, and python (and maybe forth and clojure and meteor and whatever else is cool and new)</li>
<li>Writing</li>
<li>A password vault. I currently use Lastpass because it syncs with mobile but eventually I&#39;ll need to find a FOSS replacement for that, too</li>
<li>Photo editing - this is the toughest to replace. I love Photoshop and Lightroom. Can I get by with, say, GIMP and Darktable?</li>
<li>I do all of those things on my PCBSD machine all the time</li>
<li>“I love Linux and will continue to use it on my laptops, but for my main workhorse desktop I think FreeBSD will be a better choice. I also look forward to learning and administering a true UNIX system.”</li>
<li>He got a nice SuperMicro based workstation, with an Intel Xeon E3-1275v5 and an NVIDIA GeForce GTX 960 GPU</li>
<li>I have a server with one of those Skylake E3s, it is very nice</li>
<li>“450Mbps Wireless N Dual Band PCI-e Adapter w/ 3x 2dBi Antennas (Yes, sad to say, unless I rewire my house I&#39;ll have to use Wi-Fi with this beast. I&#39;ll probably rewire my house.)”</li>
<li>He plans to have a 4x 1TB ZFS pool, plus a second pool backed by a 512 GB NVMe m.2 for the OS</li>
<li>“And I&#39;ll continue to chronicle my journey into the land of FOSS here when The Beast arrives. But in the meantime, please excuse me, I&#39;ve got some reading to do.”</li>
<li>Leo went so far as to <a href="https://youtu.be/vNVst_rxxm0?t=270" rel="nofollow">slap a “Power By FreeBSD” sticker </a> on the back of his new Tesla
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160725100831" rel="nofollow">OpenBSD 6.0 to be released on Sept 1st, 2016</a></h3>

<ul>
<li><a href="https://www.openbsd.org/60.html" rel="nofollow">OpenBSD 6.0 Tenative Released Notes</a></li>
<li>OpenBSD 6.0 is just around the corner, currently slated for Sept 1st and brings with it a whole slew of exciting new features</li>
<li>First up, and let’s get this right out of the way.. VAX support has been dropped!! Oh no!</li>
<li>However to make up for this devastating loss, armv7 has been added to this release.</li>
<li>The tentative release notes are very complete and marks 6.0 as quite an exciting release</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160726230851" rel="nofollow">OpenBSD 6.0 Pre-orders up</a> </li>
</ul>

<h3><a href="http://www.infoworld.com/article/3099038/open-source-tools/openbsd-60-tightens-security-by-losing-linux-compatibility.html" rel="nofollow">OpenBSD 6.0 tightens security by losing Linux compatibility</a></h3>

<ul>
<li>In related news, infoworld picked up on the pending removal of Linux compat from OpenBSD 6.0.</li>
<li>Touted as a security feature, you will soon be unable to run legacy linux binaries on OpenBSD. This has both positives and negatives depending upon your use case. Ironically we’re excitedly awaiting improved Linux Compat support in FreeBSD, to allow running some various closed-source applications. (Netflix DRM, Steam, Skype to name a few)
***</li>
</ul>

<h3><a href="https://2016.eurobsdcon.org/talks-schedule/" rel="nofollow">EuroBSDCon 2016 Schedule released</a></h3>

<ul>
<li><a href="https://2016.eurobsdcon.org/tutorials/" rel="nofollow">EuroBSDCon 2016 Tutorial Schedule released</a> </li>
<li>EuroBSDCon has announced the list of talks and tutorials for September 22nd-25th’s conference!</li>
<li>George Neville Neil (Who we’ve interviewed in the past) is giving the keynote about “The Coming Decades of BSD”
***</li>
</ul>

<h2>News Roundup</h2>

<h3>Blast from the past</h3>

<ul>
<li>No interview again this week, we’re working on getting some people lined up.</li>
<li>The Leo Laporte story brought these old gem from TechTV into my youtube playlist:</li>
<li><a href="https://www.youtube.com/watch?v=d0UsXwRvaIg" rel="nofollow">Matt Olander and Murrey Stokey explain FreeBSD on TechTV </a></li>
<li><a href="https://www.youtube.com/watch?v=bAsYz5pVwyc" rel="nofollow">Matt Olander and Brooks Davis explain building a cluster with FreeBSD on TechTV </a></li>
<li><a href="https://www.youtube.com/watch?v=91igg2UX7o8" rel="nofollow">FreeBSD vs Linux Part 1</a></li>
<li><a href="https://www.youtube.com/watch?v=oU88fQkwfws" rel="nofollow">FreeBSD vs Linux Part 2</a>
***</li>
</ul>

<h3><a href="https://ericmccorkleblog.wordpress.com/2016/07/16/freebsd-librem-update/" rel="nofollow">Running FreeBSD on the LibreM </a></h3>

<ul>
<li>Eric McCorkle (Who has worked on the EFI loader for a while now) has written an update on his efforts to get FreeBSD working properly on the LibreM 13 laptop.</li>
<li><p>Since April the work seems to be progressing nicely</p>

<ul>
<li>Matt Macy’s i915 graphics patch works well on the Librem 13, and I personally made sure that the suspend/resume support works.  The patch is very stable on the Librem, and I’ve only had one kernel panic the entire time testing it.</li>
<li>The HDMI output Just Works™ with the i915 driver.  Even better, it works for both X11 and console modes.</li>
<li>Full support for the Atheros 9462 card has been merged in.  I’ve had some occasional issues, but it works for the most part.</li>
<li>The vesa weirdness is obviated by i915 support, but it was resolved by using the scfb driver.</li>
</ul></li>
<li><p>Some of the outstanding issues still being worked on are support for Synaptics on this particular touchpad, as well as hotkey support for the keyboard, and brightness controls.</p></li>
<li><p>In addition Eric is still working on the EFI + Geli support, with the eventual goal of getting EFI secure-boot working out of box as well.</p>

<hr></li>
</ul>

<h3><a href="http://seclists.org/oss-sec/2016/q3/157" rel="nofollow">More OpenBSD syscall fuzzing</a></h3>

<ul>
<li>NCC Group’s Project Triforce continues its work of fuzzing OpenBSD</li>
<li>This time they have found a flaw that allows any user to panic the kernel</li>
<li>Attempting to read from the tmpfs_vfsops sysctl tree will panic the system: “attempt to execute user address 0x0 in supervisor mode”</li>
<li>This is actually a “good” thing…</li>
<li>“Impact: Any user can panic the kernel by using the sysctl call.  If a user can manage to map a page at address zero, they may be able to gain kernel code execution and escalate privileges”</li>
<li>OpenBSD’s default configuration prevents mapping a page at address zero, so the code execution is prevented</li>
<li>So while a panic is a bad outcome, it is a lot better than it could have been
***</li>
</ul>

<h3><a href="http://akat1.pl/?id=2" rel="nofollow">Root privilege escalation on NetBSD</a></h3>

<ul>
<li>This post described a root privilege escalation in NetBSD</li>
<li>mail.local is a utility included in the base system for delivering mail to other users on the same system, rather than invoking a mail client and going through the mail server.</li>
<li>The mail.local utility contains a ‘time of check / time of use’ vulnerability. This means that it checks if a file or permission is valid, and then later accesses that file. If an attacker can change that file between the time when it is checked, and the time when it is used, they may be able to exploit the system by evading the check</li>
<li>This is exactly what happens in this case</li>
<li>mail.local appends a message to the indicated user’s mailbox</li>
<li>It first checks if the target user already has an existing mailbox file. If the file exists, but is a link, mail.local exits with an error (to prevent exploits)</li>
<li>If the file does not exist, it is created</li>
<li>The message is then appended to the file</li>
<li>If the file needed to be created, it is chown’d to the owner of the mailbox</li>
<li>This is where the problem lies, if mail.local checks and does not find the mailbox, but an attacker then creates a link from the target mailbox to some other file</li>
<li>mail.local then appends to that file instead, thinking it is creating the new mailbox</li>
<li>Then, mail.local chown’s the target file to the user the attacker was trying to send mail to</li>
<li>The article explains how this could be used to replace /etc/master.passwd etc, but opts for an easier proof of concept, replacing /usr/bin/atrun, which is run as root every 5 minutes from crontab with a script that will copy the shell to /tmp and mark it setuid</li>
<li>The attacker can then run that shell out of /tmp, and be root</li>
<li>NetBSD fixed the vulnerability by changing the code flow, separating the cases for opening an existing file from creating a new file.</li>
<li>In the case where an existing file is opened, the code then verifies that the file that was opened has the same inode number and is on the same device, as the file that was checked earlier, to ensure it was not a link
***</li>
</ul>

<h3><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-16:25.bspatch.asc" rel="nofollow">FreeBSD Heap vulnerability in bspatch</a></h3>

<ul>
<li>An important vuln has been found and fixed in FreeBSD this past week, specifically relating to the ‘bspatch’ utility.</li>
<li>“Upstream&#39;s bspatch.c implementation doesn&#39;t check for negative values on the number of bytes to read from the &quot;diff&quot; and &quot;extra&quot; streams, allowing an attacker controlling the patch file to write at arbitrary locations in the heap.”</li>
<li>This could result in a crash, or running arbitrary code as the user running bspatch. (Often root)</li>
<li>“bspatch&#39;s main loop reads three numbers from the &quot;control&quot; stream in the patch: X, Y and Z. The first two are the number of bytes to read from &quot;diff&quot; and &quot;extra&quot; (and thus only non-negative), while the third one could be positive or negative and moves the oldpos pointer on the source image. These 3 values are 64bits signed ints (encoded somehow on the file) that are later passed the function that reads from the streams, but those values are not verified to be non-negative.”</li>
<li>“Chrome[OS] has four different implementations of this program, all derived from the same original code by Colin Percival.”</li>
<li><a href="https://bugs.chromium.org/p/chromium/issues/detail?id=372525" rel="nofollow">Chromium Issue Tracker </a></li>
<li>Patch your systems now!
***</li>
</ul>

<h2>Beastie Bits:</h2>

<ul>
<li><p><a href="https://twitter.com/q5sys/status/758087886927388673" rel="nofollow">If you&#39;re a BUG member or Organizer, please contact BSD Now</a> </p></li>
<li><p><a href="http://www.tedunangst.com/flak/post/one-reason-to-hate-openbsd" rel="nofollow">TedU writes about some interesting localizations to gcc in openbsd, and why they are there </a> </p></li>
<li><p><a href="https://en.wikipedia.org/wiki/List_of_products_based_on_FreeBSD" rel="nofollow">List of Products based on FreeBSD -- Help complete the list </a></p></li>
<li><p><a href="http://www.freshports.org/emulators/virtualbox-ose/" rel="nofollow">Virtualbox v5 hits the FreeBSD Ports tree</a> </p></li>
<li><p><a href="https://gist.github.com/gonzopancho/b71be467f45594822131f4816d6cb718" rel="nofollow">Skull Canyon NUC booting FreeBSD 11.0-BETA2</a> </p></li>
<li><p><a href="https://www.freebsdfoundation.org/blog/2016-bsdcan-trip-report-trent-thompson/" rel="nofollow">2016 BSDCan Trip Report : Trent Thompson</a> </p></li>
<li><p><a href="http://mail-index.netbsd.org/regional-london/2016/07/25/msg000542.html" rel="nofollow">August London BSD Meetup</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/eiWbDXTd" rel="nofollow"> Michael Open-Source Alts</a> </li>
<li><a href="http://pastebin.com/w9aCDBut" rel="nofollow"> Herminio - AP Troubles</a> </li>
<li><a href="http://pastebin.com/d15QpVFw" rel="nofollow"> Jake - Plasma</a> </li>
<li><a href="http://pastebin.com/Wj1P7jq8" rel="nofollow"> Morgan - Clean DO Droplets</a> </li>
<li><a href="http://pastebin.com/U9PYEH6K" rel="nofollow">Chris - Auditd</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we have some big breaking news about another major switcher to FreeBSD, plus early information about the pending</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" <br>
/></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for <br>
Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly <br>
Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.leolaporte.com/blog/a-grand-experiment" rel="nofollow">Leo Laporte tries FreeBSD</a></h3>

<ul>
<li>Leo Laporte, formerly of TechTV, and now of TWiT.tv, is switching to FreeBSD</li>
<li>“The latest debacle over the &quot;forced&quot; upgrade to Windows 10 and Apple&#39;s increasingly locked-in ecosystem has got me thinking. Do I really need to use a proprietary operating system to get work done? And while I&#39;m at it, do I need to use commercial cloud services to store my data?”</li>
<li>A sometimes Linux user since the mid 90s, Leo talks about his motivations:</li>
<li>“But as time went by, even Ubuntu began to seem too commercial to me”</li>
<li>“So now for the grand experiment. Is it possible, I wonder, to do everything I need to do on an even more venerable, more robust system: a true UNIX OS, FreeBSD? Here are my requirements”</li>
<li>Browsing</li>
<li>Email with PGP signing and encryption</li>
<li>Coding - I&#39;m a hobbyist programmer requiring support for lisp/scheme/racket, rust, and python (and maybe forth and clojure and meteor and whatever else is cool and new)</li>
<li>Writing</li>
<li>A password vault. I currently use Lastpass because it syncs with mobile but eventually I&#39;ll need to find a FOSS replacement for that, too</li>
<li>Photo editing - this is the toughest to replace. I love Photoshop and Lightroom. Can I get by with, say, GIMP and Darktable?</li>
<li>I do all of those things on my PCBSD machine all the time</li>
<li>“I love Linux and will continue to use it on my laptops, but for my main workhorse desktop I think FreeBSD will be a better choice. I also look forward to learning and administering a true UNIX system.”</li>
<li>He got a nice SuperMicro based workstation, with an Intel Xeon E3-1275v5 and an NVIDIA GeForce GTX 960 GPU</li>
<li>I have a server with one of those Skylake E3s, it is very nice</li>
<li>“450Mbps Wireless N Dual Band PCI-e Adapter w/ 3x 2dBi Antennas (Yes, sad to say, unless I rewire my house I&#39;ll have to use Wi-Fi with this beast. I&#39;ll probably rewire my house.)”</li>
<li>He plans to have a 4x 1TB ZFS pool, plus a second pool backed by a 512 GB NVMe m.2 for the OS</li>
<li>“And I&#39;ll continue to chronicle my journey into the land of FOSS here when The Beast arrives. But in the meantime, please excuse me, I&#39;ve got some reading to do.”</li>
<li>Leo went so far as to <a href="https://youtu.be/vNVst_rxxm0?t=270" rel="nofollow">slap a “Power By FreeBSD” sticker </a> on the back of his new Tesla
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160725100831" rel="nofollow">OpenBSD 6.0 to be released on Sept 1st, 2016</a></h3>

<ul>
<li><a href="https://www.openbsd.org/60.html" rel="nofollow">OpenBSD 6.0 Tenative Released Notes</a></li>
<li>OpenBSD 6.0 is just around the corner, currently slated for Sept 1st and brings with it a whole slew of exciting new features</li>
<li>First up, and let’s get this right out of the way.. VAX support has been dropped!! Oh no!</li>
<li>However to make up for this devastating loss, armv7 has been added to this release.</li>
<li>The tentative release notes are very complete and marks 6.0 as quite an exciting release</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160726230851" rel="nofollow">OpenBSD 6.0 Pre-orders up</a> </li>
</ul>

<h3><a href="http://www.infoworld.com/article/3099038/open-source-tools/openbsd-60-tightens-security-by-losing-linux-compatibility.html" rel="nofollow">OpenBSD 6.0 tightens security by losing Linux compatibility</a></h3>

<ul>
<li>In related news, infoworld picked up on the pending removal of Linux compat from OpenBSD 6.0.</li>
<li>Touted as a security feature, you will soon be unable to run legacy linux binaries on OpenBSD. This has both positives and negatives depending upon your use case. Ironically we’re excitedly awaiting improved Linux Compat support in FreeBSD, to allow running some various closed-source applications. (Netflix DRM, Steam, Skype to name a few)
***</li>
</ul>

<h3><a href="https://2016.eurobsdcon.org/talks-schedule/" rel="nofollow">EuroBSDCon 2016 Schedule released</a></h3>

<ul>
<li><a href="https://2016.eurobsdcon.org/tutorials/" rel="nofollow">EuroBSDCon 2016 Tutorial Schedule released</a> </li>
<li>EuroBSDCon has announced the list of talks and tutorials for September 22nd-25th’s conference!</li>
<li>George Neville Neil (Who we’ve interviewed in the past) is giving the keynote about “The Coming Decades of BSD”
***</li>
</ul>

<h2>News Roundup</h2>

<h3>Blast from the past</h3>

<ul>
<li>No interview again this week, we’re working on getting some people lined up.</li>
<li>The Leo Laporte story brought these old gem from TechTV into my youtube playlist:</li>
<li><a href="https://www.youtube.com/watch?v=d0UsXwRvaIg" rel="nofollow">Matt Olander and Murrey Stokey explain FreeBSD on TechTV </a></li>
<li><a href="https://www.youtube.com/watch?v=bAsYz5pVwyc" rel="nofollow">Matt Olander and Brooks Davis explain building a cluster with FreeBSD on TechTV </a></li>
<li><a href="https://www.youtube.com/watch?v=91igg2UX7o8" rel="nofollow">FreeBSD vs Linux Part 1</a></li>
<li><a href="https://www.youtube.com/watch?v=oU88fQkwfws" rel="nofollow">FreeBSD vs Linux Part 2</a>
***</li>
</ul>

<h3><a href="https://ericmccorkleblog.wordpress.com/2016/07/16/freebsd-librem-update/" rel="nofollow">Running FreeBSD on the LibreM </a></h3>

<ul>
<li>Eric McCorkle (Who has worked on the EFI loader for a while now) has written an update on his efforts to get FreeBSD working properly on the LibreM 13 laptop.</li>
<li><p>Since April the work seems to be progressing nicely</p>

<ul>
<li>Matt Macy’s i915 graphics patch works well on the Librem 13, and I personally made sure that the suspend/resume support works.  The patch is very stable on the Librem, and I’ve only had one kernel panic the entire time testing it.</li>
<li>The HDMI output Just Works™ with the i915 driver.  Even better, it works for both X11 and console modes.</li>
<li>Full support for the Atheros 9462 card has been merged in.  I’ve had some occasional issues, but it works for the most part.</li>
<li>The vesa weirdness is obviated by i915 support, but it was resolved by using the scfb driver.</li>
</ul></li>
<li><p>Some of the outstanding issues still being worked on are support for Synaptics on this particular touchpad, as well as hotkey support for the keyboard, and brightness controls.</p></li>
<li><p>In addition Eric is still working on the EFI + Geli support, with the eventual goal of getting EFI secure-boot working out of box as well.</p>

<hr></li>
</ul>

<h3><a href="http://seclists.org/oss-sec/2016/q3/157" rel="nofollow">More OpenBSD syscall fuzzing</a></h3>

<ul>
<li>NCC Group’s Project Triforce continues its work of fuzzing OpenBSD</li>
<li>This time they have found a flaw that allows any user to panic the kernel</li>
<li>Attempting to read from the tmpfs_vfsops sysctl tree will panic the system: “attempt to execute user address 0x0 in supervisor mode”</li>
<li>This is actually a “good” thing…</li>
<li>“Impact: Any user can panic the kernel by using the sysctl call.  If a user can manage to map a page at address zero, they may be able to gain kernel code execution and escalate privileges”</li>
<li>OpenBSD’s default configuration prevents mapping a page at address zero, so the code execution is prevented</li>
<li>So while a panic is a bad outcome, it is a lot better than it could have been
***</li>
</ul>

<h3><a href="http://akat1.pl/?id=2" rel="nofollow">Root privilege escalation on NetBSD</a></h3>

<ul>
<li>This post described a root privilege escalation in NetBSD</li>
<li>mail.local is a utility included in the base system for delivering mail to other users on the same system, rather than invoking a mail client and going through the mail server.</li>
<li>The mail.local utility contains a ‘time of check / time of use’ vulnerability. This means that it checks if a file or permission is valid, and then later accesses that file. If an attacker can change that file between the time when it is checked, and the time when it is used, they may be able to exploit the system by evading the check</li>
<li>This is exactly what happens in this case</li>
<li>mail.local appends a message to the indicated user’s mailbox</li>
<li>It first checks if the target user already has an existing mailbox file. If the file exists, but is a link, mail.local exits with an error (to prevent exploits)</li>
<li>If the file does not exist, it is created</li>
<li>The message is then appended to the file</li>
<li>If the file needed to be created, it is chown’d to the owner of the mailbox</li>
<li>This is where the problem lies, if mail.local checks and does not find the mailbox, but an attacker then creates a link from the target mailbox to some other file</li>
<li>mail.local then appends to that file instead, thinking it is creating the new mailbox</li>
<li>Then, mail.local chown’s the target file to the user the attacker was trying to send mail to</li>
<li>The article explains how this could be used to replace /etc/master.passwd etc, but opts for an easier proof of concept, replacing /usr/bin/atrun, which is run as root every 5 minutes from crontab with a script that will copy the shell to /tmp and mark it setuid</li>
<li>The attacker can then run that shell out of /tmp, and be root</li>
<li>NetBSD fixed the vulnerability by changing the code flow, separating the cases for opening an existing file from creating a new file.</li>
<li>In the case where an existing file is opened, the code then verifies that the file that was opened has the same inode number and is on the same device, as the file that was checked earlier, to ensure it was not a link
***</li>
</ul>

<h3><a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-16:25.bspatch.asc" rel="nofollow">FreeBSD Heap vulnerability in bspatch</a></h3>

<ul>
<li>An important vuln has been found and fixed in FreeBSD this past week, specifically relating to the ‘bspatch’ utility.</li>
<li>“Upstream&#39;s bspatch.c implementation doesn&#39;t check for negative values on the number of bytes to read from the &quot;diff&quot; and &quot;extra&quot; streams, allowing an attacker controlling the patch file to write at arbitrary locations in the heap.”</li>
<li>This could result in a crash, or running arbitrary code as the user running bspatch. (Often root)</li>
<li>“bspatch&#39;s main loop reads three numbers from the &quot;control&quot; stream in the patch: X, Y and Z. The first two are the number of bytes to read from &quot;diff&quot; and &quot;extra&quot; (and thus only non-negative), while the third one could be positive or negative and moves the oldpos pointer on the source image. These 3 values are 64bits signed ints (encoded somehow on the file) that are later passed the function that reads from the streams, but those values are not verified to be non-negative.”</li>
<li>“Chrome[OS] has four different implementations of this program, all derived from the same original code by Colin Percival.”</li>
<li><a href="https://bugs.chromium.org/p/chromium/issues/detail?id=372525" rel="nofollow">Chromium Issue Tracker </a></li>
<li>Patch your systems now!
***</li>
</ul>

<h2>Beastie Bits:</h2>

<ul>
<li><p><a href="https://twitter.com/q5sys/status/758087886927388673" rel="nofollow">If you&#39;re a BUG member or Organizer, please contact BSD Now</a> </p></li>
<li><p><a href="http://www.tedunangst.com/flak/post/one-reason-to-hate-openbsd" rel="nofollow">TedU writes about some interesting localizations to gcc in openbsd, and why they are there </a> </p></li>
<li><p><a href="https://en.wikipedia.org/wiki/List_of_products_based_on_FreeBSD" rel="nofollow">List of Products based on FreeBSD -- Help complete the list </a></p></li>
<li><p><a href="http://www.freshports.org/emulators/virtualbox-ose/" rel="nofollow">Virtualbox v5 hits the FreeBSD Ports tree</a> </p></li>
<li><p><a href="https://gist.github.com/gonzopancho/b71be467f45594822131f4816d6cb718" rel="nofollow">Skull Canyon NUC booting FreeBSD 11.0-BETA2</a> </p></li>
<li><p><a href="https://www.freebsdfoundation.org/blog/2016-bsdcan-trip-report-trent-thompson/" rel="nofollow">2016 BSDCan Trip Report : Trent Thompson</a> </p></li>
<li><p><a href="http://mail-index.netbsd.org/regional-london/2016/07/25/msg000542.html" rel="nofollow">August London BSD Meetup</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/eiWbDXTd" rel="nofollow"> Michael Open-Source Alts</a> </li>
<li><a href="http://pastebin.com/w9aCDBut" rel="nofollow"> Herminio - AP Troubles</a> </li>
<li><a href="http://pastebin.com/d15QpVFw" rel="nofollow"> Jake - Plasma</a> </li>
<li><a href="http://pastebin.com/Wj1P7jq8" rel="nofollow"> Morgan - Clean DO Droplets</a> </li>
<li><a href="http://pastebin.com/U9PYEH6K" rel="nofollow">Chris - Auditd</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>151: Fuzzy Auditing</title>
  <link>https://www.bsdnow.tv/151</link>
  <guid isPermaLink="false">a6d4cae2-dede-4e13-bab3-af1ea6a03992</guid>
  <pubDate>Wed, 20 Jul 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a6d4cae2-dede-4e13-bab3-af1ea6a03992.mp3" length="50343700" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we have all sorts of interesting news, including a Kernel Fuzzing audit done for OpenBSD, a much improved</itunes:subtitle>
  <itunes:duration>1:09:55</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we have all sorts of interesting news, including a Kernel Fuzzing audit done for OpenBSD, a much improved
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for 
Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly 
Paranoid"&gt;&lt;/a&gt;
Headlines
Multiple Bugs in OpenBSD Kernel (http://marc.info/?l=oss-security&amp;amp;m=146853062403622&amp;amp;w=2)
Its patch Wednesday! (OR last Thursday if you were watching the mailing lists)
Jesse Hertz and Tim Newsham (part of the NCC Group calling themselves project Triforce) have been working with the OpenBSD team to fix some newly discovered bugs in the kernel using fuzzing.
Specifically they were able to track down several potential methods to corrupt memory or panic the kernel:
mmap_panic: Malicious calls to mmap() can trigger an allocation panic or trigger memory corruption.
kevent_panic: Any user can panic the kernel with the kevent system call.
thrsleeppanic: Any user can panic the kernel with the _thrsleep system Call.
thrsigdivertpanic: Any user can panic the kernel with the _thrsigdivert system call.
ufsgetdentspanic: Any user can panic the kernel with the getdents system call.
mount_panic: Root users, or users on systems with kern.usermount set to true, can trigger a kernel panic when mounting a tmpfs filesystem.
unmount_panic: Root users, or users on systems with kern.usermount set to true, can trigger a kernel panic when unmounting a filesystem.
tmpfsmknodpanic: Root can panic kernel with mknod on a tmpfs filesystem.
This was a great find, and we have a link to more of the results, if you would like to explore them in more detail.
NCC Group OpenBSD Kernel fuzzing results (http://www.openwall.com/lists/oss-security/2016/07/14/5) 
Would like to see more work like this done in all of the BSDs
***
Running CockroachDB in a FreeBSD Jail (https://www.cockroachlabs.com/blog/critters-in-a-jar-running-cockroachdb-in-a-freebsd-jail/)
The developers behind CockroachDB have written up a nice walkthrough of getting their software to run inside FreeBSD jails.
“Manually encapsulating CockroachDB using Linux cgroups is no easy task, which is why tools like Docker exist in the first place. By comparison, running server processes natively in FreeBSD jails is straightforward and robust.”
The walkthrough begins with compiling CockroachDB straight from source (A port is pending), which is pretty easy relying upon bash / git / gmake and GO.
With the compile finished, the next step will be mounting linprocfs, although that may be going away in the future:
“(Note: Linux compatibility files / packages / libraries are not needed further. CockroachDB uses Linux’s procfs to inspect system properties via gosigar. If/when gosigar evolves to read FreeBSD properties natively, CockroachDB will not need linprocfs any more.)”
With the initial setup complete, the walkthrough then takes us through the process of creating the rc.d script (Which should be included with the port) and ultimately setting up ezjail and deploying CockroachDB within. 
With the word getting out about jails and their functionality, we hope to see more projects also provide walkthroughs and FreeBSD support natively. Kudos to the CockroachDB team!
***
Usermount bugs (https://marc.info/?l=openbsd-announce&amp;amp;m=146854517406640&amp;amp;w=2)
kern.usermount, (vfs.usermount on FreeBSD) is a sysctl that can be enabled to allow an unprivileged user to mount filesystems. It is very useful for allowing non-root users to mount a USB stick or other external media.
It is not without its dangers though:
&amp;gt; “kern.usermount=1 is unsafe for everyone, since it allows any non-pledged program to call the mount/umount system calls.  There is no way any user can be expected to keep their system safe / reliable with this feature. Ignore setting to =1, and after release we'll delete the sysctl entirely.”
In OpenBSD 6.0 and forward, the setting will no longer work, and root privileges will be required to mount a filesystem
If there is a bug in the filesystem driver, the user could potentially exploit that and root the system
&amp;gt; “In addition to the patched bugs, several panics were discovered by NCC that can be triggered by root or users with the usermount option set. These bugs are not getting patched because we believe they are only the tip of the iceberg. The mount system call exposes too much code to userland to be considered secure”
This is a very pragmatic way of dealing with these issues, as it is not really possible to be sure that EVERY bug has been fixed, and that this feature is no longer an exploit vector
usermount being removed from OpenBSD (http://undeadly.org/cgi?action=article&amp;amp;sid=20160715125022) 
I use this facility in FreeBSD extensively, combined with ZFS permission delegation, to allow non-root users to create and mount new ZFS datasets, and to do replication without requiring any root access
There are some safety belts, for instance: the user must own the directory that the new filesystem will be mounted to, so they can’t mount to /etc and replace the password file with their own
***
Let's Encrypt client from BSD in C (https://kristaps.bsd.lv/letskencrypt/)
File this one under the category of “It’s about time!”, but Kristaps (Who we’ve interviewed in the past) has released some new software for interacting with letsencrypt.
The header for the project site sums it up nicely:
“Be up-front about security: OpenSSL is known to have issues, you can't trust what comes down the pipe, and your private key's integrity is a hard requirement. Not a situation where you can be careless. letskencrypt is a client for Let's Encrypt users, but one designed for security. No Python. No Ruby. No Bash.A straightforward, open source     implementation in C that isolates each step of the sequence.”
What specifically does it isolate you ask? Right now it is broken down into 6 steps:
read and parse an account and domain private key
authenticate with the Let's Encrypt server
authorise each domain listed for the certificate
submit the X509 request
receive and serialise the signed X509 certificate
request, receive, and serialise the certificate chain from the issuer
I don’t know about all of you, but I’m going to be switching over one of my systems this weekend.
***
News Roundup
Videos from the FOSDEM BSD Dev room are now online (https://video.fosdem.org/2016/k4601/)
The videos from the BSD Dev room at FOSDEM have been stealthily posted online at some point since last I checked
The videos are individually linked from the talks on the Schedule  (https://archive.fosdem.org/2016/schedule/track/bsd/) 
The talk pages also include the slides, which can help you to follow along
***
FreeBSD on Jetson TK1 (http://kernelnomicon.org/?p=628)
The nVidia Jetson TK1 is a medium sized ARM device that is a big more than your standard Raspberry Pi
The device has:
NVIDIA 4-Plus-1™ Quad-Core ARM® Cortex™-A15 CPU (2.3 GHz)
NVIDIA Kepler GPU with 192 CUDA Cores
2 GB DDR3L x16 Memory with 64-bit Width
16 GB 4.51 eMMC Memory
1 Half Mini-PCIE Slot
1 Full-Size SD/MMC Connector
1 Full-Size HDMI Port
1 USB 2.0 Port, Micro AB
1 USB 3.0 Port, A
1 RS232 Serial Port
1 ALC5639 Realtek Audio Codec with Mic In and Line Out
1 RTL8111GS Realtek GigE LAN
1 SATA Data Port
SPI 4 MByte Boot Flash
The following signals are available through an expansion port:
DP/LVDS
Touch SPI 1x4 + 1x1 CSI-2
GPIOs
UART
HSIC
i2c
The device costs $192 USD from nVidia or Amazon
Oleksandr Tymoshenko (gonzo@freebsd.org) has a post describing what it takes to get FreeBSD running on the Jetson TK1
&amp;gt; “First of all – my TK1 didn’t have U-Boot. Type of bootloader depends on the version of Linux4Tegra TK1 comes with. Mine had L4T R19, with some kind of “not u-boot” bootloader.”
They tried using the provided tool, compiled on FreeBSD since it uses libusb, but it gave an error. Falling back to trying from Ubuntu, they got the same error.
They then flashed the TK1 with newer firmware, and suddenly, uboot is available.
The post then walks through pxe booting FreeBSD on the TK1
The guide then walks through replacing the UBoot with a version compatible with UBLDR, for more features
We’ll have to wait for another post to get FreeBSD burned onto the device, but at this point, you can reliably boot it without any user interaction
I have one of these devices, so I am very interested in this work
***
Why we use OpenBSD at VidiGaurd (https://blog.vidiguard.com/why-we-use-openbsd-at-vidiguard-4521f217b2b7#.9r86v742v)
VidiGuard (Which makes autonomous drone solutions for security monitoring) has posted an interesting write-up on why they use OpenBSD.
Specifically they start by mentioning while they are in business to provide physical security, they just as equally value their data security, especially their customer data.
They name 4 specific features that matter to them, starting with Uncompromising Quality and Security:
“Over the past 20 years, OpenBSD’s focus on uncompromising quality and code correctness has yielded an operating system second-to-none. Code auditing and review is core to the project’s development process. The team’s focus on security includes integrated cryptography, new security mitigation techniques, and an optional-security-is-no-security stance, making it arguably the most secure operating system available today. This approach pays off in the form of only a few security updates for a given release, compared to other operating systems that might release a handful of updates every week.”
High praise indeed! They also mention the sane-defaults, documentation and last but not least, the license as also winning factors in making OpenBSD their operating system of choice.
Thanks to VidiGuard for publically detailing the use of BSD, and we hope to see other business follow suit!
***
"You can (and should) slow down and learn how things work" – Interview with Dru Lavigne (https://bsdmag.org/dru_lavigne/)
If you’ve been around the BSD community for any length of time, you no doubt have heard of Dru Lavigne (Or perhaps own one of her books!)
She was recently interviewed by Luca Ferrari for BSD Magazine and you may find it a fascinating read.
The 2nd question asked sounded a lot like our opener to an interview (How did you get into BSD)
“ In the mid 90s, I went back to school to learn network and system administration. As graduation grew near and I started looking for a work, I noticed that all the interesting jobs wanted Unix skills. Wanting to increase my skills, and not having any money, I did an Internet search for “Free Unix”. The first hit was freebsd.org. I went to the website and started reading the Handbook and thought “I can do this”. Since I only had access to one computer and wanted to ramp up my skills quickly, I printed out the installation and networking chapters of the Handbook. I replaced the current operating system with FreeBSD and forced myself to learn how to do everything I needed to do on that computer in FreeBSD. It was a painful (and scary) few weeks as I figured out how to transition the family’s workflow to FreeBSD, but it was also exhilarating to learn that “yes, I can do this!.  Since then, I’ve had the opportunity to try out or administer the other BSDs, several Linux distros, SCO, and Solaris. I found that the layout, logic, and release engineering process of the BSDs makes the most sense to me and I’m happiest when on a BSD system.”
When asked, Dru also had a good response to what challenges potential new UNIX or BSD users may face:
“Students who haven’t been exposed to open source before are used to thinking of technology in terms of a purchasable brand consisting of “black boxes” that are supposed to “just work”, without having to think about how they work. You can (and should) slow down and learn how things work. It can be a mind shift to learn that the freedom to use and change how something works does exist, and isn’t considered stealing. And that learning how something works, while hard, can be fun. BSD culture, in particular, is well suited for those who have the time and temperament to dive into how things work. With over 40 years of freely available source and commit messages, you can dive as deep as you want into learning how things came to be, how they evolved over the years, how they work now, and how they can be improved. There is a diverse range of stuff to choose from: from user tools to networking to memory management to hardware drivers to security mechanisms and so on. There is also a culture of sharing and learning and encouragement for users who demonstrate that they have done their homework and have their own ideas to contribute.”
The interview is quite long, and Dru provides fantastic insights into more aspects of BSD in general. Well worth your time to read!
***
Beastie Bits:
Ed Maste is seeking testing 'withoutgpldtc' (https://twitter.com/ed_maste/status/755474764479672321) 
“PAM Mastery” tech reviewers wanted (http://blather.michaelwlucas.com/archives/2717)
OPNsense 16.7 RC2 (https://opnsense.org/opnsense-16-7-rc2-released/)
Jupyter Notebook for bootstrapping Arduino on FreeBSD (https://nbviewer.jupyter.org/github/DadAtH-me/Projects/blob/master/arduino-on-nix.ipynb) 
The Design and Implementation of the Anykernel and Rump Kernels (second edition) (http://www.fixup.fi/misc/rumpkernel-book/) 
Complete desktop synchronisation with Unison and FreeBSD jails (xjails) (https://github.com/kbs1/freebsd-synced-xjails) 
Feedback/Questions
 Eric - List most popular files (http://pastebin.com/S7u0VeVi) 
 Robroy - ZFS Write Cache (http://pastebin.com/81Zmj0cX) 
 Luis - FreeNAS HW Setup (http://pastebin.com/SfeKR7v2) 
 Emett - Python Followup (http://pastebin.com/wy4ar0YH) 
 Peter - Multicast + Jails (http://pastebin.com/zd2QAu25) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we have all sorts of interesting news, including a Kernel Fuzzing audit done for OpenBSD, a much improved</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" <br>
/></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for <br>
Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly <br>
Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://marc.info/?l=oss-security&m=146853062403622&w=2" rel="nofollow">Multiple Bugs in OpenBSD Kernel</a></h3>

<ul>
<li>Its patch Wednesday! (OR last Thursday if you were watching the mailing lists)</li>
<li>Jesse Hertz and Tim Newsham (part of the NCC Group calling themselves project Triforce) have been working with the OpenBSD team to fix some newly discovered bugs in the kernel using fuzzing.</li>
<li>Specifically they were able to track down several potential methods to corrupt memory or panic the kernel:

<ul>
<li>mmap_panic: Malicious calls to mmap() can trigger an allocation panic or trigger memory corruption.</li>
<li>kevent_panic: Any user can panic the kernel with the kevent system call.</li>
<li>thrsleep_panic: Any user can panic the kernel with the __thrsleep system Call.</li>
<li>thrsigdivert_panic: Any user can panic the kernel with the __thrsigdivert system call.</li>
<li>ufs_getdents_panic: Any user can panic the kernel with the getdents system call.</li>
<li>mount_panic: Root users, or users on systems with kern.usermount set to true, can trigger a kernel panic when mounting a tmpfs filesystem.</li>
<li>unmount_panic: Root users, or users on systems with kern.usermount set to true, can trigger a kernel panic when unmounting a filesystem.</li>
<li>tmpfs_mknod_panic: Root can panic kernel with mknod on a tmpfs filesystem.</li>
</ul></li>
<li>This was a great find, and we have a link to more of the results, if you would like to explore them in more detail.</li>
<li><a href="http://www.openwall.com/lists/oss-security/2016/07/14/5" rel="nofollow">NCC Group OpenBSD Kernel fuzzing results</a> </li>
<li>Would like to see more work like this done in all of the BSDs
***</li>
</ul>

<h3><a href="https://www.cockroachlabs.com/blog/critters-in-a-jar-running-cockroachdb-in-a-freebsd-jail/" rel="nofollow">Running CockroachDB in a FreeBSD Jail</a></h3>

<ul>
<li>The developers behind CockroachDB have written up a nice walkthrough of getting their software to run inside FreeBSD jails.</li>
</ul>

<blockquote>
<p>“Manually encapsulating CockroachDB using Linux cgroups is no easy task, which is why tools like Docker exist in the first place. By comparison, running server processes natively in FreeBSD jails is straightforward and robust.”</p>
</blockquote>

<ul>
<li>The walkthrough begins with compiling CockroachDB straight from source (A port is pending), which is pretty easy relying upon bash / git / gmake and GO.</li>
<li>With the compile finished, the next step will be mounting linprocfs, although that may be going away in the future:</li>
</ul>

<blockquote>
<p>“(Note: Linux compatibility files / packages / libraries are not needed further. CockroachDB uses Linux’s procfs to inspect system properties via gosigar. If/when gosigar evolves to read FreeBSD properties natively, CockroachDB will not need linprocfs any more.)”</p>
</blockquote>

<ul>
<li>With the initial setup complete, the walkthrough then takes us through the process of creating the rc.d script (Which should be included with the port) and ultimately setting up ezjail and deploying CockroachDB within. </li>
<li>With the word getting out about jails and their functionality, we hope to see more projects also provide walkthroughs and FreeBSD support natively. Kudos to the CockroachDB team!
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-announce&m=146854517406640&w=2" rel="nofollow">Usermount bugs</a></h3>

<ul>
<li>kern.usermount, (vfs.usermount on FreeBSD) is a sysctl that can be enabled to allow an unprivileged user to mount filesystems. It is very useful for allowing non-root users to mount a USB stick or other external media.</li>
<li>It is not without its dangers though:
&gt; “kern.usermount=1 is unsafe for everyone, since it allows any non-pledged program to call the mount/umount system calls.  There is no way any user can be expected to keep their system safe / reliable with this feature. Ignore setting to =1, and after release we&#39;ll delete the sysctl entirely.”</li>
<li>In OpenBSD 6.0 and forward, the setting will no longer work, and root privileges will be required to mount a filesystem</li>
<li>If there is a bug in the filesystem driver, the user could potentially exploit that and root the system
&gt; “In addition to the patched bugs, several panics were discovered by NCC that can be triggered by root or users with the usermount option set. These bugs are not getting patched because we believe they are only the tip of the iceberg. The mount system call exposes too much code to userland to be considered secure”</li>
<li>This is a very pragmatic way of dealing with these issues, as it is not really possible to be sure that EVERY bug has been fixed, and that this feature is no longer an exploit vector</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160715125022" rel="nofollow">usermount being removed from OpenBSD</a> </li>
<li>I use this facility in FreeBSD extensively, combined with ZFS permission delegation, to allow non-root users to create and mount new ZFS datasets, and to do replication without requiring any root access</li>
<li>There are some safety belts, for instance: the user must own the directory that the new filesystem will be mounted to, so they can’t mount to /etc and replace the password file with their own
***</li>
</ul>

<h3><a href="https://kristaps.bsd.lv/letskencrypt/" rel="nofollow">Let&#39;s Encrypt client from BSD in C</a></h3>

<ul>
<li>File this one under the category of “It’s about time!”, but Kristaps (Who we’ve interviewed in the past) has released some new software for interacting with letsencrypt.</li>
<li>The header for the project site sums it up nicely:</li>
</ul>

<blockquote>
<p>“Be up-front about security: OpenSSL is known to have issues, you can&#39;t trust what comes down the pipe, and your private key&#39;s integrity is a hard requirement. Not a situation where you can be careless. letskencrypt is a client for Let&#39;s Encrypt users, but one designed for security. No Python. No Ruby. No Bash.A straightforward, open source     implementation in C that isolates each step of the sequence.”</p>
</blockquote>

<ul>
<li>What specifically does it isolate you ask? Right now it is broken down into 6 steps:</li>
</ul>

<p>read and parse an account and domain private key<br>
authenticate with the Let&#39;s Encrypt server<br>
authorise each domain listed for the certificate<br>
submit the X509 request<br>
receive and serialise the signed X509 certificate<br>
request, receive, and serialise the certificate chain from the issuer</p>

<ul>
<li>I don’t know about all of you, but I’m going to be switching over one of my systems this weekend.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://video.fosdem.org/2016/k4601/" rel="nofollow">Videos from the FOSDEM BSD Dev room are now online</a></h3>

<ul>
<li>The videos from the BSD Dev room at FOSDEM have been stealthily posted online at some point since last I checked</li>
<li>The videos are individually linked from the talks on the <a href="https://archive.fosdem.org/2016/schedule/track/bsd/" rel="nofollow">Schedule </a> </li>
<li>The talk pages also include the slides, which can help you to follow along
***</li>
</ul>

<h3><a href="http://kernelnomicon.org/?p=628" rel="nofollow">FreeBSD on Jetson TK1</a></h3>

<ul>
<li>The nVidia Jetson TK1 is a medium sized ARM device that is a big more than your standard Raspberry Pi</li>
<li>The device has:

<ul>
<li>NVIDIA 4-Plus-1™ Quad-Core ARM® Cortex™-A15 CPU (2.3 GHz)</li>
<li>NVIDIA Kepler GPU with 192 CUDA Cores</li>
<li>2 GB DDR3L x16 Memory with 64-bit Width</li>
<li>16 GB 4.51 eMMC Memory</li>
<li>1 Half Mini-PCIE Slot</li>
<li>1 Full-Size SD/MMC Connector</li>
<li>1 Full-Size HDMI Port</li>
<li>1 USB 2.0 Port, Micro AB</li>
<li>1 USB 3.0 Port, A</li>
<li>1 RS232 Serial Port</li>
<li>1 ALC5639 Realtek Audio Codec with Mic In and Line Out</li>
<li>1 RTL8111GS Realtek GigE LAN</li>
<li>1 SATA Data Port</li>
<li>SPI 4 MByte Boot Flash</li>
</ul></li>
<li>The following signals are available through an expansion port:

<ul>
<li>DP/LVDS</li>
<li>Touch SPI 1x4 + 1x1 CSI-2</li>
<li>GPIOs</li>
<li>UART</li>
<li>HSIC</li>
<li>i2c</li>
</ul></li>
<li>The device costs $192 USD from nVidia or Amazon</li>
<li>Oleksandr Tymoshenko (<a href="mailto:gonzo@freebsd.org" rel="nofollow">gonzo@freebsd.org</a>) has a post describing what it takes to get FreeBSD running on the Jetson TK1
&gt; “First of all – my TK1 didn’t have U-Boot. Type of bootloader depends on the version of Linux4Tegra TK1 comes with. Mine had L4T R19, with some kind of “not u-boot” bootloader.”</li>
<li>They tried using the provided tool, compiled on FreeBSD since it uses libusb, but it gave an error. Falling back to trying from Ubuntu, they got the same error.</li>
<li>They then flashed the TK1 with newer firmware, and suddenly, uboot is available.</li>
<li>The post then walks through pxe booting FreeBSD on the TK1</li>
<li>The guide then walks through replacing the UBoot with a version compatible with UBLDR, for more features</li>
<li>We’ll have to wait for another post to get FreeBSD burned onto the device, but at this point, you can reliably boot it without any user interaction</li>
<li>I have one of these devices, so I am very interested in this work
***</li>
</ul>

<h3><a href="https://blog.vidiguard.com/why-we-use-openbsd-at-vidiguard-4521f217b2b7#.9r86v742v" rel="nofollow">Why we use OpenBSD at VidiGaurd</a></h3>

<ul>
<li>VidiGuard (Which makes autonomous drone solutions for security monitoring) has posted an interesting write-up on why they use OpenBSD.</li>
<li>Specifically they start by mentioning while they are in business to provide physical security, they just as equally value their data security, especially their customer data.</li>
<li>They name 4 specific features that matter to them, starting with Uncompromising Quality and Security:</li>
</ul>

<blockquote>
<p>“Over the past 20 years, OpenBSD’s focus on uncompromising quality and code correctness has yielded an operating system second-to-none. Code auditing and review is core to the project’s development process. The team’s focus on security includes integrated cryptography, new security mitigation techniques, and an optional-security-is-no-security stance, making it arguably the most secure operating system available today. This approach pays off in the form of only a few security updates for a given release, compared to other operating systems that might release a handful of updates every week.”</p>
</blockquote>

<ul>
<li>High praise indeed! They also mention the sane-defaults, documentation and last but not least, the license as also winning factors in making OpenBSD their operating system of choice.</li>
<li>Thanks to VidiGuard for publically detailing the use of BSD, and we hope to see other business follow suit!
***</li>
</ul>

<h3><a href="https://bsdmag.org/dru_lavigne/" rel="nofollow">&quot;You can (and should) slow down and learn how things work&quot; – Interview with Dru Lavigne</a></h3>

<ul>
<li>If you’ve been around the BSD community for any length of time, you no doubt have heard of Dru Lavigne (Or perhaps own one of her books!)</li>
<li>She was recently interviewed by Luca Ferrari for BSD Magazine and you may find it a fascinating read.</li>
<li>The 2nd question asked sounded a lot like our opener to an interview (How did you get into BSD)</li>
</ul>

<blockquote>
<p>“ In the mid 90s, I went back to school to learn network and system administration. As graduation grew near and I started looking for a work, I noticed that all the interesting jobs wanted Unix skills. Wanting to increase my skills, and not having any money, I did an Internet search for “Free Unix”. The first hit was freebsd.org. I went to the website and started reading the Handbook and thought “I can do this”. Since I only had access to one computer and wanted to ramp up my skills quickly, I printed out the installation and networking chapters of the Handbook. I replaced the current operating system with FreeBSD and forced myself to learn how to do everything I needed to do on that computer in FreeBSD. It was a painful (and scary) few weeks as I figured out how to transition the family’s workflow to FreeBSD, but it was also exhilarating to learn that “yes, I can do this!.  Since then, I’ve had the opportunity to try out or administer the other BSDs, several Linux distros, SCO, and Solaris. I found that the layout, logic, and release engineering process of the BSDs makes the most sense to me and I’m happiest when on a BSD system.”</p>
</blockquote>

<ul>
<li>When asked, Dru also had a good response to what challenges potential new UNIX or BSD users may face:</li>
</ul>

<blockquote>
<p>“Students who haven’t been exposed to open source before are used to thinking of technology in terms of a purchasable brand consisting of “black boxes” that are supposed to “just work”, without having to think about how they work. You can (and should) slow down and learn how things work. It can be a mind shift to learn that the freedom to use and change how something works does exist, and isn’t considered stealing. And that learning how something works, while hard, can be fun. BSD culture, in particular, is well suited for those who have the time and temperament to dive into how things work. With over 40 years of freely available source and commit messages, you can dive as deep as you want into learning how things came to be, how they evolved over the years, how they work now, and how they can be improved. There is a diverse range of stuff to choose from: from user tools to networking to memory management to hardware drivers to security mechanisms and so on. There is also a culture of sharing and learning and encouragement for users who demonstrate that they have done their homework and have their own ideas to contribute.”</p>
</blockquote>

<ul>
<li>The interview is quite long, and Dru provides fantastic insights into more aspects of BSD in general. Well worth your time to read!
***</li>
</ul>

<h2>Beastie Bits:</h2>

<ul>
<li><p><a href="https://twitter.com/ed_maste/status/755474764479672321" rel="nofollow">Ed Maste is seeking testing &#39;without_gpl_dtc&#39;</a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2717" rel="nofollow">“PAM Mastery” tech reviewers wanted</a></p></li>
<li><p><a href="https://opnsense.org/opnsense-16-7-rc2-released/" rel="nofollow">OPNsense 16.7 RC2</a></p></li>
<li><p><a href="https://nbviewer.jupyter.org/github/DadAtH-me/Projects/blob/master/arduino-on-nix.ipynb" rel="nofollow">Jupyter Notebook for bootstrapping Arduino on FreeBSD</a> </p></li>
<li><p><a href="http://www.fixup.fi/misc/rumpkernel-book/" rel="nofollow">The Design and Implementation of the Anykernel and Rump Kernels (second edition)</a> </p></li>
<li><p><a href="https://github.com/kbs1/freebsd-synced-xjails" rel="nofollow">Complete desktop synchronisation with Unison and FreeBSD jails (xjails)</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/S7u0VeVi" rel="nofollow"> Eric - List most popular files</a> </li>
<li><a href="http://pastebin.com/81Zmj0cX" rel="nofollow"> Robroy - ZFS Write Cache</a> </li>
<li><a href="http://pastebin.com/SfeKR7v2" rel="nofollow"> Luis - FreeNAS HW Setup</a> </li>
<li><a href="http://pastebin.com/wy4ar0YH" rel="nofollow"> Emett - Python Followup</a> </li>
<li><a href="http://pastebin.com/zd2QAu25" rel="nofollow"> Peter - Multicast + Jails</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we have all sorts of interesting news, including a Kernel Fuzzing audit done for OpenBSD, a much improved</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" <br>
/></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for <br>
Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly <br>
Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://marc.info/?l=oss-security&m=146853062403622&w=2" rel="nofollow">Multiple Bugs in OpenBSD Kernel</a></h3>

<ul>
<li>Its patch Wednesday! (OR last Thursday if you were watching the mailing lists)</li>
<li>Jesse Hertz and Tim Newsham (part of the NCC Group calling themselves project Triforce) have been working with the OpenBSD team to fix some newly discovered bugs in the kernel using fuzzing.</li>
<li>Specifically they were able to track down several potential methods to corrupt memory or panic the kernel:

<ul>
<li>mmap_panic: Malicious calls to mmap() can trigger an allocation panic or trigger memory corruption.</li>
<li>kevent_panic: Any user can panic the kernel with the kevent system call.</li>
<li>thrsleep_panic: Any user can panic the kernel with the __thrsleep system Call.</li>
<li>thrsigdivert_panic: Any user can panic the kernel with the __thrsigdivert system call.</li>
<li>ufs_getdents_panic: Any user can panic the kernel with the getdents system call.</li>
<li>mount_panic: Root users, or users on systems with kern.usermount set to true, can trigger a kernel panic when mounting a tmpfs filesystem.</li>
<li>unmount_panic: Root users, or users on systems with kern.usermount set to true, can trigger a kernel panic when unmounting a filesystem.</li>
<li>tmpfs_mknod_panic: Root can panic kernel with mknod on a tmpfs filesystem.</li>
</ul></li>
<li>This was a great find, and we have a link to more of the results, if you would like to explore them in more detail.</li>
<li><a href="http://www.openwall.com/lists/oss-security/2016/07/14/5" rel="nofollow">NCC Group OpenBSD Kernel fuzzing results</a> </li>
<li>Would like to see more work like this done in all of the BSDs
***</li>
</ul>

<h3><a href="https://www.cockroachlabs.com/blog/critters-in-a-jar-running-cockroachdb-in-a-freebsd-jail/" rel="nofollow">Running CockroachDB in a FreeBSD Jail</a></h3>

<ul>
<li>The developers behind CockroachDB have written up a nice walkthrough of getting their software to run inside FreeBSD jails.</li>
</ul>

<blockquote>
<p>“Manually encapsulating CockroachDB using Linux cgroups is no easy task, which is why tools like Docker exist in the first place. By comparison, running server processes natively in FreeBSD jails is straightforward and robust.”</p>
</blockquote>

<ul>
<li>The walkthrough begins with compiling CockroachDB straight from source (A port is pending), which is pretty easy relying upon bash / git / gmake and GO.</li>
<li>With the compile finished, the next step will be mounting linprocfs, although that may be going away in the future:</li>
</ul>

<blockquote>
<p>“(Note: Linux compatibility files / packages / libraries are not needed further. CockroachDB uses Linux’s procfs to inspect system properties via gosigar. If/when gosigar evolves to read FreeBSD properties natively, CockroachDB will not need linprocfs any more.)”</p>
</blockquote>

<ul>
<li>With the initial setup complete, the walkthrough then takes us through the process of creating the rc.d script (Which should be included with the port) and ultimately setting up ezjail and deploying CockroachDB within. </li>
<li>With the word getting out about jails and their functionality, we hope to see more projects also provide walkthroughs and FreeBSD support natively. Kudos to the CockroachDB team!
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-announce&m=146854517406640&w=2" rel="nofollow">Usermount bugs</a></h3>

<ul>
<li>kern.usermount, (vfs.usermount on FreeBSD) is a sysctl that can be enabled to allow an unprivileged user to mount filesystems. It is very useful for allowing non-root users to mount a USB stick or other external media.</li>
<li>It is not without its dangers though:
&gt; “kern.usermount=1 is unsafe for everyone, since it allows any non-pledged program to call the mount/umount system calls.  There is no way any user can be expected to keep their system safe / reliable with this feature. Ignore setting to =1, and after release we&#39;ll delete the sysctl entirely.”</li>
<li>In OpenBSD 6.0 and forward, the setting will no longer work, and root privileges will be required to mount a filesystem</li>
<li>If there is a bug in the filesystem driver, the user could potentially exploit that and root the system
&gt; “In addition to the patched bugs, several panics were discovered by NCC that can be triggered by root or users with the usermount option set. These bugs are not getting patched because we believe they are only the tip of the iceberg. The mount system call exposes too much code to userland to be considered secure”</li>
<li>This is a very pragmatic way of dealing with these issues, as it is not really possible to be sure that EVERY bug has been fixed, and that this feature is no longer an exploit vector</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160715125022" rel="nofollow">usermount being removed from OpenBSD</a> </li>
<li>I use this facility in FreeBSD extensively, combined with ZFS permission delegation, to allow non-root users to create and mount new ZFS datasets, and to do replication without requiring any root access</li>
<li>There are some safety belts, for instance: the user must own the directory that the new filesystem will be mounted to, so they can’t mount to /etc and replace the password file with their own
***</li>
</ul>

<h3><a href="https://kristaps.bsd.lv/letskencrypt/" rel="nofollow">Let&#39;s Encrypt client from BSD in C</a></h3>

<ul>
<li>File this one under the category of “It’s about time!”, but Kristaps (Who we’ve interviewed in the past) has released some new software for interacting with letsencrypt.</li>
<li>The header for the project site sums it up nicely:</li>
</ul>

<blockquote>
<p>“Be up-front about security: OpenSSL is known to have issues, you can&#39;t trust what comes down the pipe, and your private key&#39;s integrity is a hard requirement. Not a situation where you can be careless. letskencrypt is a client for Let&#39;s Encrypt users, but one designed for security. No Python. No Ruby. No Bash.A straightforward, open source     implementation in C that isolates each step of the sequence.”</p>
</blockquote>

<ul>
<li>What specifically does it isolate you ask? Right now it is broken down into 6 steps:</li>
</ul>

<p>read and parse an account and domain private key<br>
authenticate with the Let&#39;s Encrypt server<br>
authorise each domain listed for the certificate<br>
submit the X509 request<br>
receive and serialise the signed X509 certificate<br>
request, receive, and serialise the certificate chain from the issuer</p>

<ul>
<li>I don’t know about all of you, but I’m going to be switching over one of my systems this weekend.
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://video.fosdem.org/2016/k4601/" rel="nofollow">Videos from the FOSDEM BSD Dev room are now online</a></h3>

<ul>
<li>The videos from the BSD Dev room at FOSDEM have been stealthily posted online at some point since last I checked</li>
<li>The videos are individually linked from the talks on the <a href="https://archive.fosdem.org/2016/schedule/track/bsd/" rel="nofollow">Schedule </a> </li>
<li>The talk pages also include the slides, which can help you to follow along
***</li>
</ul>

<h3><a href="http://kernelnomicon.org/?p=628" rel="nofollow">FreeBSD on Jetson TK1</a></h3>

<ul>
<li>The nVidia Jetson TK1 is a medium sized ARM device that is a big more than your standard Raspberry Pi</li>
<li>The device has:

<ul>
<li>NVIDIA 4-Plus-1™ Quad-Core ARM® Cortex™-A15 CPU (2.3 GHz)</li>
<li>NVIDIA Kepler GPU with 192 CUDA Cores</li>
<li>2 GB DDR3L x16 Memory with 64-bit Width</li>
<li>16 GB 4.51 eMMC Memory</li>
<li>1 Half Mini-PCIE Slot</li>
<li>1 Full-Size SD/MMC Connector</li>
<li>1 Full-Size HDMI Port</li>
<li>1 USB 2.0 Port, Micro AB</li>
<li>1 USB 3.0 Port, A</li>
<li>1 RS232 Serial Port</li>
<li>1 ALC5639 Realtek Audio Codec with Mic In and Line Out</li>
<li>1 RTL8111GS Realtek GigE LAN</li>
<li>1 SATA Data Port</li>
<li>SPI 4 MByte Boot Flash</li>
</ul></li>
<li>The following signals are available through an expansion port:

<ul>
<li>DP/LVDS</li>
<li>Touch SPI 1x4 + 1x1 CSI-2</li>
<li>GPIOs</li>
<li>UART</li>
<li>HSIC</li>
<li>i2c</li>
</ul></li>
<li>The device costs $192 USD from nVidia or Amazon</li>
<li>Oleksandr Tymoshenko (<a href="mailto:gonzo@freebsd.org" rel="nofollow">gonzo@freebsd.org</a>) has a post describing what it takes to get FreeBSD running on the Jetson TK1
&gt; “First of all – my TK1 didn’t have U-Boot. Type of bootloader depends on the version of Linux4Tegra TK1 comes with. Mine had L4T R19, with some kind of “not u-boot” bootloader.”</li>
<li>They tried using the provided tool, compiled on FreeBSD since it uses libusb, but it gave an error. Falling back to trying from Ubuntu, they got the same error.</li>
<li>They then flashed the TK1 with newer firmware, and suddenly, uboot is available.</li>
<li>The post then walks through pxe booting FreeBSD on the TK1</li>
<li>The guide then walks through replacing the UBoot with a version compatible with UBLDR, for more features</li>
<li>We’ll have to wait for another post to get FreeBSD burned onto the device, but at this point, you can reliably boot it without any user interaction</li>
<li>I have one of these devices, so I am very interested in this work
***</li>
</ul>

<h3><a href="https://blog.vidiguard.com/why-we-use-openbsd-at-vidiguard-4521f217b2b7#.9r86v742v" rel="nofollow">Why we use OpenBSD at VidiGaurd</a></h3>

<ul>
<li>VidiGuard (Which makes autonomous drone solutions for security monitoring) has posted an interesting write-up on why they use OpenBSD.</li>
<li>Specifically they start by mentioning while they are in business to provide physical security, they just as equally value their data security, especially their customer data.</li>
<li>They name 4 specific features that matter to them, starting with Uncompromising Quality and Security:</li>
</ul>

<blockquote>
<p>“Over the past 20 years, OpenBSD’s focus on uncompromising quality and code correctness has yielded an operating system second-to-none. Code auditing and review is core to the project’s development process. The team’s focus on security includes integrated cryptography, new security mitigation techniques, and an optional-security-is-no-security stance, making it arguably the most secure operating system available today. This approach pays off in the form of only a few security updates for a given release, compared to other operating systems that might release a handful of updates every week.”</p>
</blockquote>

<ul>
<li>High praise indeed! They also mention the sane-defaults, documentation and last but not least, the license as also winning factors in making OpenBSD their operating system of choice.</li>
<li>Thanks to VidiGuard for publically detailing the use of BSD, and we hope to see other business follow suit!
***</li>
</ul>

<h3><a href="https://bsdmag.org/dru_lavigne/" rel="nofollow">&quot;You can (and should) slow down and learn how things work&quot; – Interview with Dru Lavigne</a></h3>

<ul>
<li>If you’ve been around the BSD community for any length of time, you no doubt have heard of Dru Lavigne (Or perhaps own one of her books!)</li>
<li>She was recently interviewed by Luca Ferrari for BSD Magazine and you may find it a fascinating read.</li>
<li>The 2nd question asked sounded a lot like our opener to an interview (How did you get into BSD)</li>
</ul>

<blockquote>
<p>“ In the mid 90s, I went back to school to learn network and system administration. As graduation grew near and I started looking for a work, I noticed that all the interesting jobs wanted Unix skills. Wanting to increase my skills, and not having any money, I did an Internet search for “Free Unix”. The first hit was freebsd.org. I went to the website and started reading the Handbook and thought “I can do this”. Since I only had access to one computer and wanted to ramp up my skills quickly, I printed out the installation and networking chapters of the Handbook. I replaced the current operating system with FreeBSD and forced myself to learn how to do everything I needed to do on that computer in FreeBSD. It was a painful (and scary) few weeks as I figured out how to transition the family’s workflow to FreeBSD, but it was also exhilarating to learn that “yes, I can do this!.  Since then, I’ve had the opportunity to try out or administer the other BSDs, several Linux distros, SCO, and Solaris. I found that the layout, logic, and release engineering process of the BSDs makes the most sense to me and I’m happiest when on a BSD system.”</p>
</blockquote>

<ul>
<li>When asked, Dru also had a good response to what challenges potential new UNIX or BSD users may face:</li>
</ul>

<blockquote>
<p>“Students who haven’t been exposed to open source before are used to thinking of technology in terms of a purchasable brand consisting of “black boxes” that are supposed to “just work”, without having to think about how they work. You can (and should) slow down and learn how things work. It can be a mind shift to learn that the freedom to use and change how something works does exist, and isn’t considered stealing. And that learning how something works, while hard, can be fun. BSD culture, in particular, is well suited for those who have the time and temperament to dive into how things work. With over 40 years of freely available source and commit messages, you can dive as deep as you want into learning how things came to be, how they evolved over the years, how they work now, and how they can be improved. There is a diverse range of stuff to choose from: from user tools to networking to memory management to hardware drivers to security mechanisms and so on. There is also a culture of sharing and learning and encouragement for users who demonstrate that they have done their homework and have their own ideas to contribute.”</p>
</blockquote>

<ul>
<li>The interview is quite long, and Dru provides fantastic insights into more aspects of BSD in general. Well worth your time to read!
***</li>
</ul>

<h2>Beastie Bits:</h2>

<ul>
<li><p><a href="https://twitter.com/ed_maste/status/755474764479672321" rel="nofollow">Ed Maste is seeking testing &#39;without_gpl_dtc&#39;</a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2717" rel="nofollow">“PAM Mastery” tech reviewers wanted</a></p></li>
<li><p><a href="https://opnsense.org/opnsense-16-7-rc2-released/" rel="nofollow">OPNsense 16.7 RC2</a></p></li>
<li><p><a href="https://nbviewer.jupyter.org/github/DadAtH-me/Projects/blob/master/arduino-on-nix.ipynb" rel="nofollow">Jupyter Notebook for bootstrapping Arduino on FreeBSD</a> </p></li>
<li><p><a href="http://www.fixup.fi/misc/rumpkernel-book/" rel="nofollow">The Design and Implementation of the Anykernel and Rump Kernels (second edition)</a> </p></li>
<li><p><a href="https://github.com/kbs1/freebsd-synced-xjails" rel="nofollow">Complete desktop synchronisation with Unison and FreeBSD jails (xjails)</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/S7u0VeVi" rel="nofollow"> Eric - List most popular files</a> </li>
<li><a href="http://pastebin.com/81Zmj0cX" rel="nofollow"> Robroy - ZFS Write Cache</a> </li>
<li><a href="http://pastebin.com/SfeKR7v2" rel="nofollow"> Luis - FreeNAS HW Setup</a> </li>
<li><a href="http://pastebin.com/wy4ar0YH" rel="nofollow"> Emett - Python Followup</a> </li>
<li><a href="http://pastebin.com/zd2QAu25" rel="nofollow"> Peter - Multicast + Jails</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>150: Sprinkle a little BSD into your life.</title>
  <link>https://www.bsdnow.tv/150</link>
  <guid isPermaLink="false">00b6ee02-f104-4624-9691-b5333683a5ed</guid>
  <pubDate>Wed, 13 Jul 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/00b6ee02-f104-4624-9691-b5333683a5ed.mp3" length="58734580" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Today on the show, we are going to be talking to Jim Brown (of BSD Cert Fame) about his home-brew sprinkler system… Wait for it…</itunes:subtitle>
  <itunes:duration>1:21:34</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Today on the show, we are going to be talking to Jim Brown (of BSD Cert Fame) about his home-brew sprinkler system… Wait for it…
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Distrowatch reviews OpenBSD and PCBSD's live upgrade method (http://distrowatch.com/weekly.php?issue=20160620#upgrade)
Upgrading… The bane of any sysadmin! Distrowatch has recently done a write-up on the in-place upgrading of various distros / BSDs including PC-BSD and OpenBSD.
Lets look first at the PC-BSD attempt, which was done going from 9.2 -&amp;gt; 10. 
“I soon found trying to upgrade either the base system or pkg would fail. The update manager did not provide details as to what had gone wrong and so I decided to attempt a manual upgrade by following the FreeBSD Handbook as I had when performing a live upgrade of FreeBSD back in May. At first the manual process seemed to work, downloading the necessary patches for FreeBSD 10 and getting me to resolve conflicts between my existing configuration files and the new versions. Part way through, we are asked to reboot and then continue the upgrade process using the freebsd-update command utility. PC-BSD failed to reboot and, in fact, the boot loader no longer found any operating systems to run.”
Ouch! I’m not sure on the particular commands used, but to lose the boot-loader indicates something went horribly wrong. There is good news in this though. After the pain experienced in the 9.X upgrade process, 11.0 has been vastly improved to help fix this going forward. The updater is also self-updating, which means future changes to tools such as package can be accounted for in previously released versions.
Moving on to OpenBSD, Jesse had much better luck:
&amp;gt; “The documentation provided explains how to upgrade OpenBSD 5.8 to version 5.9 step-by-step and the instructions worked exactly as laid out. Upgrading requires two reboots, one to initiate the upgrade process and one to boot into the new version of OpenBSD. Upgrading the base operating system took approximately ten minutes, including the two reboots. Upgrading the third-party packages took another minute or two. The only quirk I ran into was that I had to manually update my repository mirror information to gain access to the new packages available for OpenBSD 5.9. If this step is not done, then the pkg_add package manager will continue to pull in packages from the old repository we set up for OpenBSD 5.8. “
A good read, and they covered some Linux distros such as Mint and OpenMandriva as well, if you want to find out how they fared.
***
A curated list of awesome DTrace books, articles, videos, tools and resources (http://awesome-dtrace.com/)
The website awesome-dtrace.com compiles a list of resources, including books, articles, videos, tools, and other resources, to help you get the most out of DTrace
The list of books includes 2 open source books that are available on the web, and of course Brendan Gregg’s official DTrace book
There are also cheat sheets, one-liner collections, and a set of DTrace war stories
A breakdown of different PID providers and the userspace statically defined tracepoints
The videos from DTrace.conf 2008, 2012, and soon 2016
And links to the tools to start using DTrace with your favourite programming language, including Erlang, Node.JS, Perl, PHP, Python, or Ruby
There are also DTrace setups for MySQL/MariaDB, and PostreSQL
Joyent has even written a mod_usdt DTrace module for the Apache web server
This seems like a really good resource, and with the efforts of the new OpenDTrace project, to modernize the dtracetoolkit and make it more useful across the different supported operating systems, there has never been a better time to start learning DTrace
***
Installing OpenBSD using a serial console with no external monitor (http://unix.stackexchange.com/questions/292891/how-can-i-install-openbsd-using-the-serial-console-without-external-monitor-wi)
Have you found yourself needing to install OpenBSD from USB, but with a twist, as in no external monitor? Well somebody has and asked the question on stackexchange.
The answer provided is quite well explained, but in a nut-shell the process involves downloading the USB image and making some tweaks before copying it to the physical media.
Specifically with a couple of well-placed echo’s into boot.conf, the serial-port can be enabled and ready for use:
 echo "stty com0 115200" &amp;gt; /mnt/etc/boot.conf
 echo "set tty com0" &amp;gt;&amp;gt; /mnt/etc/boot.conf
+ After that, simply boot the box and you are ready to access the serial console and drive the installation as normal! #bsdhacks
GSoC 2016 Reports: Split debug symbols for pkgsrc builds (https://blog.netbsd.org/tnf/entry/gsoc_2016_reports_split_debug)
The NetBSD blog provides a status report on one of the GSoC projects that is nearing its midterm evaluation
The project to split debugging data into separate pkgsrc packages, so that users can install the debugging symbols if they need them to debug a failing application
The report is very detailed, and includes “A quick introduction to ELF and how debug information are stored/stripped off”
It walks through the process of writing a simple example application, compiling it, and dealing with the debug data
It includes a number of very useful diagrams, and a summary of what changes needed to be make to the pkgsrc makefile infrastructure
With this as a recipe, someone should be able to do something quite similar for FreeBSD’s ports tree
***
iXsystems
iXsystems’ TrueNAS Firmware Update Delivers Compelling Performance, Replication, and Graphing Improvements (https://www.ixsystems.com/blog/ixsystems-truenas-firmware-update-delivers-compelling-performance-replication-graphing-improvements/) 
***
Interview - Jim Brown - jpb@jimby.name (mailto:jpb@jimby.name)
FreeBSD+BBB Sprinkler System
News Roundup
From the past : A Research Unix Reader (http://www.cs.dartmouth.edu/~doug/reader.pdf)
A paper by by Douglas McIlroy
“Selected pages from the nine research editions of the UNIX® Programmer’s Manual illustrate the development of the system”
“Accompanying commentary recounts some of the needs, events, and individual contributions that shaped this evolution.”
Interesting insight into the evolution of the origin UNIX operating system
***
Evolution of C programming practices – Unix 1973–2015 (http://kristerw.blogspot.com/2016/06/evolution-of-c-programming-practices.html)
From the author of the recent post we covered, “20 years of NetBSD code bloat”, comes a new post
“I found a recent paper that also looks at how the BSD code base has evolved, but from a very different perspective compared to my code-size investigation.”
The paper "The Evolution of C Programming Practices: A Study of the Unix Operating System 1973–2015" investigates coding style, and tests seven hypotheses by looking at metrics (line length, number of volatile in the source code, etc.) in 66 releases of Unix from 1973 to 2014. The hypotheses are:
&amp;gt; + Programming practices reflect technology affordances (e.g. developers may be more liberal with screen space when using high resolution displays)
&amp;gt; + Modularity increases with code size
&amp;gt; + New language features are increasingly used to saturation point
&amp;gt; + Programmers trust the compiler for register allocation
&amp;gt; + Code formatting practices converge to a common standard
&amp;gt; + Software complexity evolution follows self correction feedback mechanisms
&amp;gt; + Code readability increases
and the result is that they seem to be true, as interpreted through the metrics.
&amp;gt; “The data points for the releases have somewhat random dates. One issue is that the paper use each release's mean file date (the average of the files' last modification time) instead of the release date (that is why the graphs stop at November 2010, even though FreeBSD 10 was released in 2014). The idea is that this better reflects the age of the code base, but this has the effect of compressing some of the data points (especially the clustering around 1993-1994), and it makes the spline fitting even more suspect.”
&amp;gt; “One other problem is that the original data used by the researchers seems to have incorrect timestamps. For example, 4.3BSD Net/1 was released in 1989, but is listed as 1993-12-25 in the paper. The same is true for at least the Net/2 release too, which was released in 1991, but the paper list it as 1993-07-02.”
***
[old release pictures]
openbsd 2.1 - 5.9, straight from theo's bookshelf. (https://twitter.com/blakkheim/status/747540167112671232) 
Speaking of old releases, our Producer JT picked up this gem at Southeast Linuxfest this year (https://twitter.com/q5sys/status/748003859012984837) 
Noah Axon shares a scan of his NetBSD 1.4 disc (https://plus.google.com/+NoahAxon/posts/VsiQhUn3tHb) 
Jan van den broek shares a pic of his FreeBSD 2.2.5 set (https://plus.google.com/101232368324501316985/posts/4QsaJE2KxXh) 
***
FreeBSD: Just in Time (https://bsdmag.org/just_in_time/)
Another BSDMag goodie this week, we have a small article written by Jonathan Garrido  which details their experience switching to FreeBSD for a NTP server.
The article is short, but a good read:
&amp;gt; “A Few years ago we had a time problem. Suddenly our linux NTP server, for a reason that I still do not know, started to fail giving us a lot of issues within all the equipment and services within our network. After a quick and brief meeting with management, I found out that there was not sufficient budget left for a fancy and well-suited appliance. So, with no time (literally) and no money to spend, I decided to give it a try and utilized a homemade open source solution, and the operating system of choice was FreeBSD 10.0.”
“Now, let’s pause for a second. You may be thinking, why in the world is this guy doing this, when he has never installed a BSD machine in his life? The answer is very simple; here, in the Dominican Republic, in the heart of the Caribbean, FreeBSD has a very good reputation when it comes to reliability and security. In fact, there is some collective thought within the sysadmin community that says something like: “If you want to deal only once with a service, install it over FreeBSD.””
Jonathan then goes through some of the steps taken to initial deploy NTP services, but with that out of the way, he has a great summary:
&amp;gt; “Fascinated with the whole experience, we migrate one of our internal dns servers to a second FreeBSD machine and at the moment of this writing we are testing haproxy, an open source load-balancing proxy into a another server with the same OS.
&amp;gt; After all this, no time issues have been reported in the past 2 years, so at least for my environment, FreeBSD came just in time.“
***
Beastie Bits
MiniBSD laptop computer (https://hackaday.io/project/643-minibsd-laptop-computer) 
The state of LibreSSL in FreeBSD (https://attilagyorffy.com/2016/07/02/the-state-of-libressl-in-freebsd/) 
Justin Sherrill is looking for someone willing to run a Go builder with DragonflyBSD (https://www.dragonflydigest.com/2016/07/01/18372.html)
Tiny Unix tools for Windows (https://tinyapps.org/blog/windows/201606040700_tiny_unix_tools_windows.html) 
OpenBSD's doas added to the FreeBSD Ports Tree (http://www.freshports.org/security/doas/) 
ubuntuBSD 16.04 to feature a combo of BusyBox and OpenRC, no systemd (http://linux.softpedia.com/blog/ubuntubsd-16-04-will-feature-a-combination-of-busybox-and-openrc-but-no-systemd-505463.shtml) 
Syncast Podcast 4 : Curl, libcurl and the future of the web, with Daniel Stenberg (http://podcast.sysca.st/podcast/4-curl-libcurl-future-web-daniel-stenberg/) 
Feedback/Questions
 Harri - Using beadm / zfssnap  (http://pastebin.com/qKeCd63F) 
 Jonathan - bhyve vs Proxmox  (http://pastebin.com/EhXDwbWQ) 
 Mohammad - Bhyve gfx passthrough (http://pastebin.com/ZCNk4Bga) 
 Jeremy - Shapshots and more Snapshots (http://pastebin.com/xp7nzEYa) 
 Ron - Microphone (http://pastebin.com/H2xr53CR) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Today on the show, we are going to be talking to Jim Brown (of BSD Cert Fame) about his home-brew sprinkler system… Wait for it…</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://distrowatch.com/weekly.php?issue=20160620#upgrade" rel="nofollow">Distrowatch reviews OpenBSD and PCBSD&#39;s live upgrade method</a></h3>

<ul>
<li>Upgrading… The bane of any sysadmin! Distrowatch has recently done a write-up on the in-place upgrading of various distros / BSDs including PC-BSD and OpenBSD.</li>
<li>Lets look first at the PC-BSD attempt, which was done going from 9.2 -&gt; 10. </li>
</ul>

<blockquote>
<p>“I soon found trying to upgrade either the base system or pkg would fail. The update manager did not provide details as to what had gone wrong and so I decided to attempt a manual upgrade by following the FreeBSD Handbook as I had when performing a live upgrade of FreeBSD back in May. At first the manual process seemed to work, downloading the necessary patches for FreeBSD 10 and getting me to resolve conflicts between my existing configuration files and the new versions. Part way through, we are asked to reboot and then continue the upgrade process using the freebsd-update command utility. PC-BSD failed to reboot and, in fact, the boot loader no longer found any operating systems to run.”</p>
</blockquote>

<ul>
<li>Ouch! I’m not sure on the particular commands used, but to lose the boot-loader indicates something went horribly wrong. There is good news in this though. After the pain experienced in the 9.X upgrade process, 11.0 has been vastly improved to help fix this going forward. The updater is also self-updating, which means future changes to tools such as package can be accounted for in previously released versions.</li>
<li>Moving on to OpenBSD, Jesse had much better luck:
&gt; “The documentation provided explains how to upgrade OpenBSD 5.8 to version 5.9 step-by-step and the instructions worked exactly as laid out. Upgrading requires two reboots, one to initiate the upgrade process and one to boot into the new version of OpenBSD. Upgrading the base operating system took approximately ten minutes, including the two reboots. Upgrading the third-party packages took another minute or two. The only quirk I ran into was that I had to manually update my repository mirror information to gain access to the new packages available for OpenBSD 5.9. If this step is not done, then the pkg_add package manager will continue to pull in packages from the old repository we set up for OpenBSD 5.8. “</li>
<li>A good read, and they covered some Linux distros such as Mint and OpenMandriva as well, if you want to find out how they fared.
***</li>
</ul>

<h3><a href="http://awesome-dtrace.com/" rel="nofollow">A curated list of awesome DTrace books, articles, videos, tools and resources</a></h3>

<ul>
<li>The website awesome-dtrace.com compiles a list of resources, including books, articles, videos, tools, and other resources, to help you get the most out of DTrace</li>
<li>The list of books includes 2 open source books that are available on the web, and of course Brendan Gregg’s official DTrace book</li>
<li>There are also cheat sheets, one-liner collections, and a set of DTrace war stories</li>
<li>A breakdown of different PID providers and the userspace statically defined tracepoints</li>
<li>The videos from DTrace.conf 2008, 2012, and soon 2016</li>
<li>And links to the tools to start using DTrace with your favourite programming language, including Erlang, Node.JS, Perl, PHP, Python, or Ruby</li>
<li>There are also DTrace setups for MySQL/MariaDB, and PostreSQL</li>
<li>Joyent has even written a mod_usdt DTrace module for the Apache web server</li>
<li>This seems like a really good resource, and with the efforts of the new OpenDTrace project, to modernize the dtracetoolkit and make it more useful across the different supported operating systems, there has never been a better time to start learning DTrace
***</li>
</ul>

<h3><a href="http://unix.stackexchange.com/questions/292891/how-can-i-install-openbsd-using-the-serial-console-without-external-monitor-wi" rel="nofollow">Installing OpenBSD using a serial console with no external monitor</a></h3>

<ul>
<li>Have you found yourself needing to install OpenBSD from USB, but with a twist, as in no external monitor? Well somebody has and asked the question on stackexchange.</li>
<li>The answer provided is quite well explained, but in a nut-shell the process involves downloading the USB image and making some tweaks before copying it to the physical media.</li>
<li>Specifically with a couple of well-placed echo’s into boot.conf, the serial-port can be enabled and ready for use:</li>
</ul>

<blockquote>
<p>echo &quot;stty com0 115200&quot; &gt; /mnt/etc/boot.conf<br>
 echo &quot;set tty com0&quot; &gt;&gt; /mnt/etc/boot.conf</p>

<ul>
<li>After that, simply boot the box and you are ready to access the serial console and drive the installation as normal! #bsdhacks
***</li>
</ul>
</blockquote>

<h3><a href="https://blog.netbsd.org/tnf/entry/gsoc_2016_reports_split_debug" rel="nofollow">GSoC 2016 Reports: Split debug symbols for pkgsrc builds</a></h3>

<ul>
<li>The NetBSD blog provides a status report on one of the GSoC projects that is nearing its midterm evaluation</li>
<li>The project to split debugging data into separate pkgsrc packages, so that users can install the debugging symbols if they need them to debug a failing application</li>
<li>The report is very detailed, and includes “A quick introduction to ELF and how debug information are stored/stripped off”</li>
<li>It walks through the process of writing a simple example application, compiling it, and dealing with the debug data</li>
<li>It includes a number of very useful diagrams, and a summary of what changes needed to be make to the pkgsrc makefile infrastructure</li>
<li>With this as a recipe, someone should be able to do something quite similar for FreeBSD’s ports tree
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.ixsystems.com/blog/ixsystems-truenas-firmware-update-delivers-compelling-performance-replication-graphing-improvements/" rel="nofollow">iXsystems’ TrueNAS Firmware Update Delivers Compelling Performance, Replication, and Graphing Improvements</a> 
***</li>
</ul>

<h2>Interview - Jim Brown - <a href="mailto:jpb@jimby.name" rel="nofollow">jpb@jimby.name</a></h2>

<p>FreeBSD+BBB Sprinkler System</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.cs.dartmouth.edu/%7Edoug/reader.pdf" rel="nofollow">From the past : A Research Unix Reader</a></h3>

<ul>
<li>A paper by by Douglas McIlroy</li>
<li>“Selected pages from the nine research editions of the UNIX® Programmer’s Manual illustrate the development of the system”</li>
<li>“Accompanying commentary recounts some of the needs, events, and individual contributions that shaped this evolution.”</li>
<li>Interesting insight into the evolution of the origin UNIX operating system
***</li>
</ul>

<h3><a href="http://kristerw.blogspot.com/2016/06/evolution-of-c-programming-practices.html" rel="nofollow">Evolution of C programming practices – Unix 1973–2015</a></h3>

<ul>
<li>From the author of the recent post we covered, “20 years of NetBSD code bloat”, comes a new post</li>
<li>“I found a recent paper that also looks at how the BSD code base has evolved, but from a very different perspective compared to my code-size investigation.”</li>
<li>The paper &quot;The Evolution of C Programming Practices: A Study of the Unix Operating System 1973–2015&quot; investigates coding style, and tests seven hypotheses by looking at metrics (line length, number of volatile in the source code, etc.) in 66 releases of Unix from 1973 to 2014. The hypotheses are:
&gt; + Programming practices reflect technology affordances (e.g. developers may be more liberal with screen space when using high resolution displays)
&gt; + Modularity increases with code size
&gt; + New language features are increasingly used to saturation point
&gt; + Programmers trust the compiler for register allocation
&gt; + Code formatting practices converge to a common standard
&gt; + Software complexity evolution follows self correction feedback mechanisms
&gt; + Code readability increases</li>
<li>and the result is that they seem to be true, as interpreted through the metrics.
&gt; “The data points for the releases have somewhat random dates. One issue is that the paper use each release&#39;s mean file date (the average of the files&#39; last modification time) instead of the release date (that is why the graphs stop at November 2010, even though FreeBSD 10 was released in 2014). The idea is that this better reflects the age of the code base, but this has the effect of compressing some of the data points (especially the clustering around 1993-1994), and it makes the spline fitting even more suspect.”
&gt; “One other problem is that the original data used by the researchers seems to have incorrect timestamps. For example, 4.3BSD Net/1 was released in 1989, but is listed as 1993-12-25 in the paper. The same is true for at least the Net/2 release too, which was released in 1991, but the paper list it as 1993-07-02.”
***</li>
</ul>

<h3>[old release pictures]</h3>

<ul>
<li><a href="https://twitter.com/blakkheim/status/747540167112671232" rel="nofollow">openbsd 2.1 - 5.9, straight from theo&#39;s bookshelf.</a> </li>
<li><a href="https://twitter.com/q5sys/status/748003859012984837" rel="nofollow">Speaking of old releases, our Producer JT picked up this gem at Southeast Linuxfest this year</a> </li>
<li><a href="https://plus.google.com/+NoahAxon/posts/VsiQhUn3tHb" rel="nofollow">Noah Axon shares a scan of his NetBSD 1.4 disc</a> </li>
<li><a href="https://plus.google.com/101232368324501316985/posts/4QsaJE2KxXh" rel="nofollow">Jan van den broek shares a pic of his FreeBSD 2.2.5 set</a> 
***</li>
</ul>

<h3><a href="https://bsdmag.org/just_in_time/" rel="nofollow">FreeBSD: Just in Time</a></h3>

<ul>
<li>Another BSDMag goodie this week, we have a small article written by Jonathan Garrido  which details their experience switching to FreeBSD for a NTP server.</li>
<li>The article is short, but a good read:
&gt; “A Few years ago we had a time problem. Suddenly our linux NTP server, for a reason that I still do not know, started to fail giving us a lot of issues within all the equipment and services within our network. After a quick and brief meeting with management, I found out that there was not sufficient budget left for a fancy and well-suited appliance. So, with no time (literally) and no money to spend, I decided to give it a try and utilized a homemade open source solution, and the operating system of choice was FreeBSD 10.0.”</li>
</ul>

<blockquote>
<p>“Now, let’s pause for a second. You may be thinking, why in the world is this guy doing this, when he has never installed a BSD machine in his life? The answer is very simple; here, in the Dominican Republic, in the heart of the Caribbean, FreeBSD has a very good reputation when it comes to reliability and security. In fact, there is some collective thought within the sysadmin community that says something like: “If you want to deal only once with a service, install it over FreeBSD.””</p>
</blockquote>

<ul>
<li>Jonathan then goes through some of the steps taken to initial deploy NTP services, but with that out of the way, he has a great summary:
&gt; “Fascinated with the whole experience, we migrate one of our internal dns servers to a second FreeBSD machine and at the moment of this writing we are testing haproxy, an open source load-balancing proxy into a another server with the same OS.
&gt; After all this, no time issues have been reported in the past 2 years, so at least for my environment, FreeBSD came just in time.“
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://hackaday.io/project/643-minibsd-laptop-computer" rel="nofollow">MiniBSD laptop computer</a> </p></li>
<li><p><a href="https://attilagyorffy.com/2016/07/02/the-state-of-libressl-in-freebsd/" rel="nofollow">The state of LibreSSL in FreeBSD</a> </p></li>
<li><p><a href="https://www.dragonflydigest.com/2016/07/01/18372.html" rel="nofollow">Justin Sherrill is looking for someone willing to run a Go builder with DragonflyBSD</a></p></li>
<li><p><a href="https://tinyapps.org/blog/windows/201606040700_tiny_unix_tools_windows.html" rel="nofollow">Tiny Unix tools for Windows</a> </p></li>
<li><p><a href="http://www.freshports.org/security/doas/" rel="nofollow">OpenBSD&#39;s doas added to the FreeBSD Ports Tree</a> </p></li>
<li><p><a href="http://linux.softpedia.com/blog/ubuntubsd-16-04-will-feature-a-combination-of-busybox-and-openrc-but-no-systemd-505463.shtml" rel="nofollow">ubuntuBSD 16.04 to feature a combo of BusyBox and OpenRC, no systemd</a> </p></li>
<li><p><a href="http://podcast.sysca.st/podcast/4-curl-libcurl-future-web-daniel-stenberg/" rel="nofollow">Syncast Podcast 4 : Curl, libcurl and the future of the web, with Daniel Stenberg</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/qKeCd63F" rel="nofollow"> Harri - Using beadm / zfssnap </a> </li>
<li><a href="http://pastebin.com/EhXDwbWQ" rel="nofollow"> Jonathan - bhyve vs Proxmox </a> </li>
<li><a href="http://pastebin.com/ZCNk4Bga" rel="nofollow"> Mohammad - Bhyve gfx passthrough</a> </li>
<li><a href="http://pastebin.com/xp7nzEYa" rel="nofollow"> Jeremy - Shapshots and more Snapshots</a> </li>
<li><a href="http://pastebin.com/H2xr53CR" rel="nofollow"> Ron - Microphone</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Today on the show, we are going to be talking to Jim Brown (of BSD Cert Fame) about his home-brew sprinkler system… Wait for it…</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://distrowatch.com/weekly.php?issue=20160620#upgrade" rel="nofollow">Distrowatch reviews OpenBSD and PCBSD&#39;s live upgrade method</a></h3>

<ul>
<li>Upgrading… The bane of any sysadmin! Distrowatch has recently done a write-up on the in-place upgrading of various distros / BSDs including PC-BSD and OpenBSD.</li>
<li>Lets look first at the PC-BSD attempt, which was done going from 9.2 -&gt; 10. </li>
</ul>

<blockquote>
<p>“I soon found trying to upgrade either the base system or pkg would fail. The update manager did not provide details as to what had gone wrong and so I decided to attempt a manual upgrade by following the FreeBSD Handbook as I had when performing a live upgrade of FreeBSD back in May. At first the manual process seemed to work, downloading the necessary patches for FreeBSD 10 and getting me to resolve conflicts between my existing configuration files and the new versions. Part way through, we are asked to reboot and then continue the upgrade process using the freebsd-update command utility. PC-BSD failed to reboot and, in fact, the boot loader no longer found any operating systems to run.”</p>
</blockquote>

<ul>
<li>Ouch! I’m not sure on the particular commands used, but to lose the boot-loader indicates something went horribly wrong. There is good news in this though. After the pain experienced in the 9.X upgrade process, 11.0 has been vastly improved to help fix this going forward. The updater is also self-updating, which means future changes to tools such as package can be accounted for in previously released versions.</li>
<li>Moving on to OpenBSD, Jesse had much better luck:
&gt; “The documentation provided explains how to upgrade OpenBSD 5.8 to version 5.9 step-by-step and the instructions worked exactly as laid out. Upgrading requires two reboots, one to initiate the upgrade process and one to boot into the new version of OpenBSD. Upgrading the base operating system took approximately ten minutes, including the two reboots. Upgrading the third-party packages took another minute or two. The only quirk I ran into was that I had to manually update my repository mirror information to gain access to the new packages available for OpenBSD 5.9. If this step is not done, then the pkg_add package manager will continue to pull in packages from the old repository we set up for OpenBSD 5.8. “</li>
<li>A good read, and they covered some Linux distros such as Mint and OpenMandriva as well, if you want to find out how they fared.
***</li>
</ul>

<h3><a href="http://awesome-dtrace.com/" rel="nofollow">A curated list of awesome DTrace books, articles, videos, tools and resources</a></h3>

<ul>
<li>The website awesome-dtrace.com compiles a list of resources, including books, articles, videos, tools, and other resources, to help you get the most out of DTrace</li>
<li>The list of books includes 2 open source books that are available on the web, and of course Brendan Gregg’s official DTrace book</li>
<li>There are also cheat sheets, one-liner collections, and a set of DTrace war stories</li>
<li>A breakdown of different PID providers and the userspace statically defined tracepoints</li>
<li>The videos from DTrace.conf 2008, 2012, and soon 2016</li>
<li>And links to the tools to start using DTrace with your favourite programming language, including Erlang, Node.JS, Perl, PHP, Python, or Ruby</li>
<li>There are also DTrace setups for MySQL/MariaDB, and PostreSQL</li>
<li>Joyent has even written a mod_usdt DTrace module for the Apache web server</li>
<li>This seems like a really good resource, and with the efforts of the new OpenDTrace project, to modernize the dtracetoolkit and make it more useful across the different supported operating systems, there has never been a better time to start learning DTrace
***</li>
</ul>

<h3><a href="http://unix.stackexchange.com/questions/292891/how-can-i-install-openbsd-using-the-serial-console-without-external-monitor-wi" rel="nofollow">Installing OpenBSD using a serial console with no external monitor</a></h3>

<ul>
<li>Have you found yourself needing to install OpenBSD from USB, but with a twist, as in no external monitor? Well somebody has and asked the question on stackexchange.</li>
<li>The answer provided is quite well explained, but in a nut-shell the process involves downloading the USB image and making some tweaks before copying it to the physical media.</li>
<li>Specifically with a couple of well-placed echo’s into boot.conf, the serial-port can be enabled and ready for use:</li>
</ul>

<blockquote>
<p>echo &quot;stty com0 115200&quot; &gt; /mnt/etc/boot.conf<br>
 echo &quot;set tty com0&quot; &gt;&gt; /mnt/etc/boot.conf</p>

<ul>
<li>After that, simply boot the box and you are ready to access the serial console and drive the installation as normal! #bsdhacks
***</li>
</ul>
</blockquote>

<h3><a href="https://blog.netbsd.org/tnf/entry/gsoc_2016_reports_split_debug" rel="nofollow">GSoC 2016 Reports: Split debug symbols for pkgsrc builds</a></h3>

<ul>
<li>The NetBSD blog provides a status report on one of the GSoC projects that is nearing its midterm evaluation</li>
<li>The project to split debugging data into separate pkgsrc packages, so that users can install the debugging symbols if they need them to debug a failing application</li>
<li>The report is very detailed, and includes “A quick introduction to ELF and how debug information are stored/stripped off”</li>
<li>It walks through the process of writing a simple example application, compiling it, and dealing with the debug data</li>
<li>It includes a number of very useful diagrams, and a summary of what changes needed to be make to the pkgsrc makefile infrastructure</li>
<li>With this as a recipe, someone should be able to do something quite similar for FreeBSD’s ports tree
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.ixsystems.com/blog/ixsystems-truenas-firmware-update-delivers-compelling-performance-replication-graphing-improvements/" rel="nofollow">iXsystems’ TrueNAS Firmware Update Delivers Compelling Performance, Replication, and Graphing Improvements</a> 
***</li>
</ul>

<h2>Interview - Jim Brown - <a href="mailto:jpb@jimby.name" rel="nofollow">jpb@jimby.name</a></h2>

<p>FreeBSD+BBB Sprinkler System</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.cs.dartmouth.edu/%7Edoug/reader.pdf" rel="nofollow">From the past : A Research Unix Reader</a></h3>

<ul>
<li>A paper by by Douglas McIlroy</li>
<li>“Selected pages from the nine research editions of the UNIX® Programmer’s Manual illustrate the development of the system”</li>
<li>“Accompanying commentary recounts some of the needs, events, and individual contributions that shaped this evolution.”</li>
<li>Interesting insight into the evolution of the origin UNIX operating system
***</li>
</ul>

<h3><a href="http://kristerw.blogspot.com/2016/06/evolution-of-c-programming-practices.html" rel="nofollow">Evolution of C programming practices – Unix 1973–2015</a></h3>

<ul>
<li>From the author of the recent post we covered, “20 years of NetBSD code bloat”, comes a new post</li>
<li>“I found a recent paper that also looks at how the BSD code base has evolved, but from a very different perspective compared to my code-size investigation.”</li>
<li>The paper &quot;The Evolution of C Programming Practices: A Study of the Unix Operating System 1973–2015&quot; investigates coding style, and tests seven hypotheses by looking at metrics (line length, number of volatile in the source code, etc.) in 66 releases of Unix from 1973 to 2014. The hypotheses are:
&gt; + Programming practices reflect technology affordances (e.g. developers may be more liberal with screen space when using high resolution displays)
&gt; + Modularity increases with code size
&gt; + New language features are increasingly used to saturation point
&gt; + Programmers trust the compiler for register allocation
&gt; + Code formatting practices converge to a common standard
&gt; + Software complexity evolution follows self correction feedback mechanisms
&gt; + Code readability increases</li>
<li>and the result is that they seem to be true, as interpreted through the metrics.
&gt; “The data points for the releases have somewhat random dates. One issue is that the paper use each release&#39;s mean file date (the average of the files&#39; last modification time) instead of the release date (that is why the graphs stop at November 2010, even though FreeBSD 10 was released in 2014). The idea is that this better reflects the age of the code base, but this has the effect of compressing some of the data points (especially the clustering around 1993-1994), and it makes the spline fitting even more suspect.”
&gt; “One other problem is that the original data used by the researchers seems to have incorrect timestamps. For example, 4.3BSD Net/1 was released in 1989, but is listed as 1993-12-25 in the paper. The same is true for at least the Net/2 release too, which was released in 1991, but the paper list it as 1993-07-02.”
***</li>
</ul>

<h3>[old release pictures]</h3>

<ul>
<li><a href="https://twitter.com/blakkheim/status/747540167112671232" rel="nofollow">openbsd 2.1 - 5.9, straight from theo&#39;s bookshelf.</a> </li>
<li><a href="https://twitter.com/q5sys/status/748003859012984837" rel="nofollow">Speaking of old releases, our Producer JT picked up this gem at Southeast Linuxfest this year</a> </li>
<li><a href="https://plus.google.com/+NoahAxon/posts/VsiQhUn3tHb" rel="nofollow">Noah Axon shares a scan of his NetBSD 1.4 disc</a> </li>
<li><a href="https://plus.google.com/101232368324501316985/posts/4QsaJE2KxXh" rel="nofollow">Jan van den broek shares a pic of his FreeBSD 2.2.5 set</a> 
***</li>
</ul>

<h3><a href="https://bsdmag.org/just_in_time/" rel="nofollow">FreeBSD: Just in Time</a></h3>

<ul>
<li>Another BSDMag goodie this week, we have a small article written by Jonathan Garrido  which details their experience switching to FreeBSD for a NTP server.</li>
<li>The article is short, but a good read:
&gt; “A Few years ago we had a time problem. Suddenly our linux NTP server, for a reason that I still do not know, started to fail giving us a lot of issues within all the equipment and services within our network. After a quick and brief meeting with management, I found out that there was not sufficient budget left for a fancy and well-suited appliance. So, with no time (literally) and no money to spend, I decided to give it a try and utilized a homemade open source solution, and the operating system of choice was FreeBSD 10.0.”</li>
</ul>

<blockquote>
<p>“Now, let’s pause for a second. You may be thinking, why in the world is this guy doing this, when he has never installed a BSD machine in his life? The answer is very simple; here, in the Dominican Republic, in the heart of the Caribbean, FreeBSD has a very good reputation when it comes to reliability and security. In fact, there is some collective thought within the sysadmin community that says something like: “If you want to deal only once with a service, install it over FreeBSD.””</p>
</blockquote>

<ul>
<li>Jonathan then goes through some of the steps taken to initial deploy NTP services, but with that out of the way, he has a great summary:
&gt; “Fascinated with the whole experience, we migrate one of our internal dns servers to a second FreeBSD machine and at the moment of this writing we are testing haproxy, an open source load-balancing proxy into a another server with the same OS.
&gt; After all this, no time issues have been reported in the past 2 years, so at least for my environment, FreeBSD came just in time.“
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://hackaday.io/project/643-minibsd-laptop-computer" rel="nofollow">MiniBSD laptop computer</a> </p></li>
<li><p><a href="https://attilagyorffy.com/2016/07/02/the-state-of-libressl-in-freebsd/" rel="nofollow">The state of LibreSSL in FreeBSD</a> </p></li>
<li><p><a href="https://www.dragonflydigest.com/2016/07/01/18372.html" rel="nofollow">Justin Sherrill is looking for someone willing to run a Go builder with DragonflyBSD</a></p></li>
<li><p><a href="https://tinyapps.org/blog/windows/201606040700_tiny_unix_tools_windows.html" rel="nofollow">Tiny Unix tools for Windows</a> </p></li>
<li><p><a href="http://www.freshports.org/security/doas/" rel="nofollow">OpenBSD&#39;s doas added to the FreeBSD Ports Tree</a> </p></li>
<li><p><a href="http://linux.softpedia.com/blog/ubuntubsd-16-04-will-feature-a-combination-of-busybox-and-openrc-but-no-systemd-505463.shtml" rel="nofollow">ubuntuBSD 16.04 to feature a combo of BusyBox and OpenRC, no systemd</a> </p></li>
<li><p><a href="http://podcast.sysca.st/podcast/4-curl-libcurl-future-web-daniel-stenberg/" rel="nofollow">Syncast Podcast 4 : Curl, libcurl and the future of the web, with Daniel Stenberg</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/qKeCd63F" rel="nofollow"> Harri - Using beadm / zfssnap </a> </li>
<li><a href="http://pastebin.com/EhXDwbWQ" rel="nofollow"> Jonathan - bhyve vs Proxmox </a> </li>
<li><a href="http://pastebin.com/ZCNk4Bga" rel="nofollow"> Mohammad - Bhyve gfx passthrough</a> </li>
<li><a href="http://pastebin.com/xp7nzEYa" rel="nofollow"> Jeremy - Shapshots and more Snapshots</a> </li>
<li><a href="http://pastebin.com/H2xr53CR" rel="nofollow"> Ron - Microphone</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>149: The bhyve has been disturbed, and a wild Dexter appears!</title>
  <link>https://www.bsdnow.tv/149</link>
  <guid isPermaLink="false">24138cd0-e03d-4871-a6b5-6c78f13bd631</guid>
  <pubDate>Wed, 06 Jul 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/24138cd0-e03d-4871-a6b5-6c78f13bd631.mp3" length="84439828" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Today on the show, we are going to be chatting with Michael Dexter about a variety of topics, but of course including bhyve! That plus</itunes:subtitle>
  <itunes:duration>2:20:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Today on the show, we are going to be chatting with Michael Dexter about a variety of topics, but of course including bhyve! That plus
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
NetBSD Introduction (https://bsdmag.org/netbsd_intr/)
We start off today’s episode with a great new NetBSD article!
Siju Oommen George has written an article for BSDMag, which provides a great overview of NetBSD’s beginnings and what it is today.
Of course you can’t start an article about NetBSD without mentioning where the name came from:
“The four founders of the NetBSD project, Chris Demetriou, Theo de Raadt, Adam Glass, and Charles Hannum, felt that a more open development model would benefit the project: one centered on portable, clean and correct code. They aimed to produce a unified, multi-platform, production-quality, BSD-based operating system. The name “NetBSD” was suggested by de Raadt, based on the importance and growth of networks, such as the Internet at that time, the distributed and collaborative nature of its development.”
From there NetBSD has expanded, and keeping in line with its motto “Of course it runs NetBSD” it has grown to over 57 hardware platforms, including “IA-32, Alpha, PowerPC,SPARC, Raspberry pi 2, SPARC64 and Zaurus”
From there topics such as pkgsrc, SMP, embedded and of course virtualization are all covered, which gives the reader a good overview of what to expect in the modern NetBSD today.
Lastly, in addition to mentioning some of the vendors using NetBSD in a variety of ways, including Point-Of-Sale systems, routers and thin-clients, you may not have known about the research teams which deploy NetBSD:
NASA Lewis Research Center – Satellite Networks and Architectures Branch use NetBSD almost exclusively in their investigation of TCP for use in satellite networks.
KAME project – A research group for implementing IPv6, IPsec and other recent TCP/IP related technologies into BSD UNIX kernels, under BSD license.
NEC Europe Ltd. established the Network Laboratories in Heidelberg, Germany in 1997, as NEC’s third research facility in Europe. The Heidelberg labs focus on software-oriented research and development for the next generation Internet.
SAMS-II Project – Space Acceleration Measurement System II. NASA will be measuring the microgravity environment on the International Space Station using a distributed system, consisting of NetBSD.“
My condolences, you’re now the maintainer of a popular open source project (https://runcommand.io/2016/06/26/my-condolences-youre-now-the-maintainer-of-a-popular-open-source-project/)
A presentation from a Wordpress conference, about what it is like to be the maintainer of a popular open source project
The presentation covers the basics:
Open Source is more than just the license, it is about community and involvement
The difference between Maintainers and Contributors
It covers some of the reasons people do not open up their code, and other common problems people run into:
“I'm embarrassed by my code” (Hint: so is everyone else, post it anyway, it is the best way to learn)
“I'm discouraged that I can't finish releases on time”
“I'm overwhelmed by the PR backlog”
“I'm frustrated when issues turn into flamewars”
“I'm overcommitted on my open source involvement”
“I feel all alone”
Each of those points is met with advice and possible solutions
So, there you have it. Open up your code, or join an existing project and help maintain it
***
FreeBSD Committer Allan Jude Discusses the Advantages of FreeBSD and His Role in Keeping Millions of Servers Running (http://www.hostingadvice.com/blog/freebsd-project-under-the-hood/)
 An interesting twist on our normal news-stories today, we have an article featuring our very own Allan Jude, talking about why FreeBSD and the advantages of working on an open-source project.
“When Allan started his own company hosting websites for video streaming, FreeBSD was the only operating system he had previously used with other hosts. Based on his experience and comfort with it, he trusted the system with the future of his budding business.A decade later, the former-SysAdmin went to a conference focused on the open-source operating system, where he ran into some of the folks on its documentation team. “They inspired me,” he told our team in a recent chat. He began writing documentation but soon wanted to contribute improvements beyond the docs.Today, Allan sits as a FreeBSD Project Committer. It’s rare that you get to chat with someone involved with a massive-scale open-source project like this — rare and awesome.”
From there Allan goes into some of the reasons “Why” FreeBSD, starting with Code Organization being well-maintained and documented:
“The FreeBSD Project functions like an extremely well-organized world all its own. Allan explained the environment: “There’s a documentation page that explains how the file system’s laid out and everything has a place and it always goes in that place.””
+ In addition, Allan gives us some insight into his work to bring Boot-Environments to the loader, and other reasons why FreeBSD “just makes sense”
+ In summary Allan wraps it up quite nicely:
“An important take-away is that you don’t have to be a major developer with tons of experience to make a difference in the project,” Allan said — and the difference that devs like Allan are making is incredible. If you too want to submit the commit that contributes to the project relied on by millions of web servers, there are plenty of ways to get involved!
We’re especially talking to SysAdmins here, as Allan noted that they are the main users of FreeBSD. “Having more SysAdmins involved in the actual build of the system means we can offer the tools they’re looking for — designed the way a SysAdmin would want them designed, not necessarily the way a developer would think makes the most sense”
A guide to saving electricity and time with poudriere and bhyve (http://justinholcomb.me/blog/2016/07/03/poudriere-in-bhyve-and-bare-metal.html)
“This article goes over running poudriere to built packages for a Raspberry Pi with the interesting twist of running it both as a bhyve guest and then switching to running on bare metal via Fiber Channel via ctld by sharing the same ZFS volume.”
“Firstly, poudriere can build packages for different architectures such as ARM. This can save hours of build time compared to building ports from said ARM device.”
“Secondly, let’s say a person has an always-on device (NAS) running FreeBSD. To save power, this device has a CPU with a low clock-rate and low core count. This low clock-rate and core count is great for saving power but terrible for processor intensive application such as poudriere. Let’s say a person also has another physical server with fast processors and a high CPU count but draws nearly twice the power and a fan noise to match.”
“To get the best of both worlds, the goal is to build the packages on the fast physical server, power it down, and then start the same ZFS volume in a bhyve environment to serve packages from the always-on device.”
The tutorial walks through setting up ‘ahost’, the always on machine, ‘fhost’ the fast but noisy build machine, and a raspberry pi
It also includes creating a zvol, configuring iSCSI over fibre channel and exporting the zvol, booting an iSCSI volume in bhyve, plus installing and setting up poudriere
This it configures booting over fibre channel, and cross-building armv6 (raspberry pi) packages on the fast build machine
Then the fast machine is shut down, and the zvol is booted in bhyve on the NAS
Everything you need to know to make a hybrid physical/virtual machine
The same setup could also work to run the same bhyve VM from either ahost or fhost
bhyve does not yet support live migration, but when it does, having common network storage like the zvol will be an important part of that
***
Interview - Michael Dexter - editor@callfortesting.org (mailto:editor@callfortesting.org) / @michaeldexter (https://twitter.com/michaeldexter)
The RoloDexter
***
iXSystems
Children's Minnesota Star Studio Chooses iXsystems' TrueNAS Storage (https://www.youtube.com/watch?v=FFbdQ_05e-0) 
***
News Roundup
FreeBSD Foundation June 2016 Update (https://www.freebsdfoundation.org/wp-content/uploads/2016/06/FreeBSD-Foundation-June-2016-Update.pdf)
The FreeBSD Foundation’s June newsletter is out
Make sure you submit the FreeBSD Community Survey (https://www.surveymonkey.com/r/freebsd2016) by July 7th:
In addition to the opening message from the executive director of the foundation, the update includes details to sponsored work on the FreeBSD VM system, reports from a number of conferences the Foundation attended, including BSDCan
The results of the foundation's yearly board meeting
People the foundation recognized for their contributions to FreeBSD at BSDCan
And an introduction to their new “Getting Started with FreeBSD” project
***
[How-To] Building the FreeBSD OS from scratch (http://www.all-nettools.com/forum/showthread.php?34422-Building-the-FreeBSD-OS-from-scratch)
A tutorial over at the All-NetTools.com forums that walks through building FreeBSD from scratch
I am not sure why anyone would want to build Xorg from source, but you can
It covers everything in quite a bit of detail, from the installation process through adding Xorg and a window manager from source
It also includes tweaking some device node permissions for easier operation as a non-root user, and configuring the firewall
***
Window Systems Should Be Transparent (http://doc.cat-v.org/bell_labs/transparent_wsys/) + Rob Pike of AT&amp;amp;T Labs writes about why Window Systems should be transparent
This is an old paper (undated, but I think from the late 80s), but may contain some timeless insights
“UNIX window systems are unsatisfactory. Because they are cumbersome and complicated, they are unsuitable companions for an operating system that is appreciated for its technical elegance”
“A good interface should clarify the view, not obscure it”
“Mux is one window system that is popular and therefore worth studying as an example of good design. (It is not commercially important because it runs only on obsolete hardware.) This paper uses mux as a case study to illustrate some principles that can help keep a user interface simple, comfortable, and unobtrusive. When designing their products, the purveyors of commercial window systems should keep these principles in mind.”
There are not many commercial window systems anymore, but “open source” was not really a big thing when this paper was written
***
Roger Faulkner, of Solaris fame passed away  (http://permalink.gmane.org/gmane.comp.standards.posix.austin.general/12877)
“RIP Roger Faulkner: creator of the One and True /proc, slayer of the M-to-N threading model -- and the godfather of post-AT&amp;amp;T Unix”
@bcantrill: Another great Roger Faulkner story  (https://twitter.com/bcantrill/status/750442169807171584) 
The story of how pgrep -w saved a monitor -- if not a life (https://news.ycombinator.com/item?id=4306515) 
@bcantrill: With Roger Faulkner, Tim led an engineering coup inside Sun that saved Solaris circa 2.5 (https://twitter.com/bcantrill/status/750442169807171584) 
***
Beastie Bits:
Developer Ed Maste is requesting information from those who are users of libvgl. (https://lists.freebsd.org/pipermail/freebsd-stable/2016-June/084843.html) 
HEADS UP: DragonFly 4.5 world reneeds rebuilding (http://lists.dragonflybsd.org/pipermail/users/2016-June/249748.html) 
Chris Buechler is leaving the pfSense project, the entire community thanks you for your many years of service  (https://blog.pfsense.org/?p=2095) 
GhostBSD 10.3-BETA1 now available (http://ghostbsd.org/10.3_BETA1) 
DragonFlyBSD adds nvmectl (http://lists.dragonflybsd.org/pipermail/commits/2016-June/500671.html) 
OPNsense 16.1.18 released (https://opnsense.org/opnsense-16-1-18-released/) 
bhyve_graphics hit CURRENT (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=302332) 
BUG Update
FreeBSD Central Twitter account looking for a new owner (https://twitter.com/freebsdcentral/status/750053703420350465)  
NYCBUG meeting : Meet the Smallest BSDs: RetroBSD and LiteBSD, Brian Callahan (http://lists.nycbug.org/pipermail/talk/2016-July/016732.html) 
NYCBUG install fest @ HOPE (http://lists.nycbug.org/pipermail/talk/2016-June/016694.html) 
SemiBUG is looking for presentations for September and beyond (http://lists.nycbug.org/pipermail/semibug/2016-June/000107.html) 
Caleb Cooper is giving a talk on Crytpo at KnoxBUG on July 26th (http://knoxbug.org/content/2016-07-26) 
Feedback/Questions
 Leif - ZFS xfer  (http://pastebin.com/vvASr64P) 
 Zach - Python3 (http://pastebin.com/SznQHq7n) 
 Dave - Versioning (http://pastebin.com/qkpjKEr0) 
 David - Encrypted Disk Images (http://pastebin.com/yr7BUmv2) 
 Eli - TLF in all the wrong places (http://pastebin.com/xby81NvC) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Today on the show, we are going to be chatting with Michael Dexter about a variety of topics, but of course including bhyve! That plus</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://bsdmag.org/netbsd_intr/" rel="nofollow">NetBSD Introduction</a></h3>

<ul>
<li>We start off today’s episode with a great new NetBSD article!</li>
<li>Siju Oommen George has written an article for BSDMag, which provides a great overview of NetBSD’s beginnings and what it is today.</li>
<li>Of course you can’t start an article about NetBSD without mentioning where the name came from:</li>
</ul>

<p>“The four founders of the NetBSD project, Chris Demetriou, Theo de Raadt, Adam Glass, and Charles Hannum, felt that a more open development model would benefit the project: one centered on portable, clean and correct code. They aimed to produce a unified, multi-platform, production-quality, BSD-based operating system. The name “NetBSD” was suggested by de Raadt, based on the importance and growth of networks, such as the Internet at that time, the distributed and collaborative nature of its development.”</p>

<ul>
<li>From there NetBSD has expanded, and keeping in line with its motto “Of course it runs NetBSD” it has grown to over 57 hardware platforms, including “IA-32, Alpha, PowerPC,SPARC, Raspberry pi 2, SPARC64 and Zaurus”</li>
<li>From there topics such as pkgsrc, SMP, embedded and of course virtualization are all covered, which gives the reader a good overview of what to expect in the modern NetBSD today.</li>
<li>Lastly, in addition to mentioning some of the vendors using NetBSD in a variety of ways, including Point-Of-Sale systems, routers and thin-clients, you may not have known about the research teams which deploy NetBSD:</li>
</ul>

<blockquote>
<p>NASA Lewis Research Center – Satellite Networks and Architectures Branch use NetBSD almost exclusively in their investigation of TCP for use in satellite networks.<br>
KAME project – A research group for implementing IPv6, IPsec and other recent TCP/IP related technologies into BSD UNIX kernels, under BSD license.<br>
NEC Europe Ltd. established the Network Laboratories in Heidelberg, Germany in 1997, as NEC’s third research facility in Europe. The Heidelberg labs focus on software-oriented research and development for the next generation Internet.<br>
SAMS-II Project – Space Acceleration Measurement System II. NASA will be measuring the microgravity environment on the International Space Station using a distributed system, consisting of NetBSD.“</p>

<hr>
</blockquote>

<h3><a href="https://runcommand.io/2016/06/26/my-condolences-youre-now-the-maintainer-of-a-popular-open-source-project/" rel="nofollow">My condolences, you’re now the maintainer of a popular open source project</a></h3>

<ul>
<li>A presentation from a Wordpress conference, about what it is like to be the maintainer of a popular open source project</li>
<li>The presentation covers the basics:</li>
<li>Open Source is more than just the license, it is about community and involvement</li>
<li>The difference between Maintainers and Contributors</li>
<li>It covers some of the reasons people do not open up their code, and other common problems people run into:

<ul>
<li>“I&#39;m embarrassed by my code” (Hint: so is everyone else, post it anyway, it is the best way to learn)</li>
<li>“I&#39;m discouraged that I can&#39;t finish releases on time”</li>
<li>“I&#39;m overwhelmed by the PR backlog”</li>
<li>“I&#39;m frustrated when issues turn into flamewars”</li>
<li>“I&#39;m overcommitted on my open source involvement”</li>
<li>“I feel all alone”</li>
</ul></li>
<li>Each of those points is met with advice and possible solutions</li>
<li>So, there you have it. Open up your code, or join an existing project and help maintain it
***</li>
</ul>

<h3><a href="http://www.hostingadvice.com/blog/freebsd-project-under-the-hood/" rel="nofollow">FreeBSD Committer Allan Jude Discusses the Advantages of FreeBSD and His Role in Keeping Millions of Servers Running</a></h3>

<ul>
<li> An interesting twist on our normal news-stories today, we have an article featuring our very own Allan Jude, talking about why FreeBSD and the advantages of working on an open-source project.</li>
</ul>

<blockquote>
<p>“When Allan started his own company hosting websites for video streaming, FreeBSD was the only operating system he had previously used with other hosts. Based on his experience and comfort with it, he trusted the system with the future of his budding business.A decade later, the former-SysAdmin went to a conference focused on the open-source operating system, where he ran into some of the folks on its documentation team. “They inspired me,” he told our team in a recent chat. He began writing documentation but soon wanted to contribute improvements beyond the docs.Today, Allan sits as a FreeBSD Project Committer. It’s rare that you get to chat with someone involved with a massive-scale open-source project like this — rare and awesome.”</p>
</blockquote>

<ul>
<li>From there Allan goes into some of the reasons “Why” FreeBSD, starting with Code Organization being well-maintained and documented:</li>
</ul>

<blockquote>
<p>“The FreeBSD Project functions like an extremely well-organized world all its own. Allan explained the environment: “There’s a documentation page that explains how the file system’s laid out and everything has a place and it always goes in that place.””</p>

<ul>
<li>In addition, Allan gives us some insight into his work to bring Boot-Environments to the loader, and other reasons why FreeBSD “just makes sense”</li>
<li>In summary Allan wraps it up quite nicely:</li>
</ul>

<p>“An important take-away is that you don’t have to be a major developer with tons of experience to make a difference in the project,” Allan said — and the difference that devs like Allan are making is incredible. If you too want to submit the commit that contributes to the project relied on by millions of web servers, there are plenty of ways to get involved!</p>

<p>We’re especially talking to SysAdmins here, as Allan noted that they are the main users of FreeBSD. “Having more SysAdmins involved in the actual build of the system means we can offer the tools they’re looking for — designed the way a SysAdmin would want them designed, not necessarily the way a developer would think makes the most sense”</p>

<hr>
</blockquote>

<h3><a href="http://justinholcomb.me/blog/2016/07/03/poudriere-in-bhyve-and-bare-metal.html" rel="nofollow">A guide to saving electricity and time with poudriere and bhyve</a></h3>

<ul>
<li>“This article goes over running poudriere to built packages for a Raspberry Pi with the interesting twist of running it both as a bhyve guest and then switching to running on bare metal via Fiber Channel via ctld by sharing the same ZFS volume.”</li>
<li>“Firstly, poudriere can build packages for different architectures such as ARM. This can save hours of build time compared to building ports from said ARM device.”</li>
<li>“Secondly, let’s say a person has an always-on device (NAS) running FreeBSD. To save power, this device has a CPU with a low clock-rate and low core count. This low clock-rate and core count is great for saving power but terrible for processor intensive application such as poudriere. Let’s say a person also has another physical server with fast processors and a high CPU count but draws nearly twice the power and a fan noise to match.”</li>
<li>“To get the best of both worlds, the goal is to build the packages on the fast physical server, power it down, and then start the same ZFS volume in a bhyve environment to serve packages from the always-on device.”</li>
<li>The tutorial walks through setting up ‘ahost’, the always on machine, ‘fhost’ the fast but noisy build machine, and a raspberry pi</li>
<li>It also includes creating a zvol, configuring iSCSI over fibre channel and exporting the zvol, booting an iSCSI volume in bhyve, plus installing and setting up poudriere</li>
<li>This it configures booting over fibre channel, and cross-building armv6 (raspberry pi) packages on the fast build machine</li>
<li>Then the fast machine is shut down, and the zvol is booted in bhyve on the NAS</li>
<li>Everything you need to know to make a hybrid physical/virtual machine</li>
<li>The same setup could also work to run the same bhyve VM from either ahost or fhost</li>
<li>bhyve does not yet support live migration, but when it does, having common network storage like the zvol will be an important part of that
***</li>
</ul>

<h2>Interview - Michael Dexter - <a href="mailto:editor@callfortesting.org" rel="nofollow">editor@callfortesting.org</a> / <a href="https://twitter.com/michaeldexter" rel="nofollow">@michaeldexter</a></h2>

<ul>
<li>The RoloDexter
***</li>
</ul>

<h3>iXSystems</h3>

<ul>
<li><a href="https://www.youtube.com/watch?v=FFbdQ_05e-0" rel="nofollow">Children&#39;s Minnesota Star Studio Chooses iXsystems&#39; TrueNAS Storage</a> 
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.freebsdfoundation.org/wp-content/uploads/2016/06/FreeBSD-Foundation-June-2016-Update.pdf" rel="nofollow">FreeBSD Foundation June 2016 Update</a></h3>

<ul>
<li>The FreeBSD Foundation’s June newsletter is out</li>
<li>Make sure you submit the <a href="https://www.surveymonkey.com/r/freebsd2016" rel="nofollow">FreeBSD Community Survey</a> by July 7th:</li>
<li>In addition to the opening message from the executive director of the foundation, the update includes details to sponsored work on the FreeBSD VM system, reports from a number of conferences the Foundation attended, including BSDCan</li>
<li>The results of the foundation&#39;s yearly board meeting</li>
<li>People the foundation recognized for their contributions to FreeBSD at BSDCan</li>
<li>And an introduction to their new “Getting Started with FreeBSD” project
***</li>
</ul>

<h3><a href="http://www.all-nettools.com/forum/showthread.php?34422-Building-the-FreeBSD-OS-from-scratch" rel="nofollow">[How-To] Building the FreeBSD OS from scratch</a></h3>

<ul>
<li>A tutorial over at the All-NetTools.com forums that walks through building FreeBSD from scratch</li>
<li>I am not sure why anyone would want to build Xorg from source, but you can</li>
<li>It covers everything in quite a bit of detail, from the installation process through adding Xorg and a window manager from source</li>
<li>It also includes tweaking some device node permissions for easier operation as a non-root user, and configuring the firewall
***</li>
</ul>

<h3><a href="http://doc.cat-v.org/bell_labs/transparent_wsys/" rel="nofollow">Window Systems Should Be Transparent</a> + Rob Pike of AT&amp;T Labs writes about why Window Systems should be transparent</h3>

<ul>
<li>This is an old paper (undated, but I think from the late 80s), but may contain some timeless insights</li>
<li>“UNIX window systems are unsatisfactory. Because they are cumbersome and complicated, they are unsuitable companions for an operating system that is appreciated for its technical elegance”</li>
<li>“A good interface should clarify the view, not obscure it”</li>
<li>“Mux is one window system that is popular and therefore worth studying as an example of good design. (It is not commercially important because it runs only on obsolete hardware.) This paper uses mux as a case study to illustrate some principles that can help keep a user interface simple, comfortable, and unobtrusive. When designing their products, the purveyors of commercial window systems should keep these principles in mind.”</li>
<li>There are not many commercial window systems anymore, but “open source” was not really a big thing when this paper was written
***</li>
</ul>

<h3><a href="http://permalink.gmane.org/gmane.comp.standards.posix.austin.general/12877" rel="nofollow">Roger Faulkner, of Solaris fame passed away </a></h3>

<ul>
<li>“RIP Roger Faulkner: creator of the One and True /proc, slayer of the M-to-N threading model -- and the godfather of post-AT&amp;T Unix”</li>
<li><a href="https://twitter.com/bcantrill/status/750442169807171584" rel="nofollow">@bcantrill: Another great Roger Faulkner story </a> </li>
<li><a href="https://news.ycombinator.com/item?id=4306515" rel="nofollow">The story of how pgrep -w saved a monitor -- if not a life</a> </li>
<li><a href="https://twitter.com/bcantrill/status/750442169807171584" rel="nofollow">@bcantrill: With Roger Faulkner, Tim led an engineering coup inside Sun that saved Solaris circa 2.5</a> 
***</li>
</ul>

<h2>Beastie Bits:</h2>

<ul>
<li><p><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2016-June/084843.html" rel="nofollow">Developer Ed Maste is requesting information from those who are users of libvgl.</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-June/249748.html" rel="nofollow">HEADS UP: DragonFly 4.5 world reneeds rebuilding</a> </p></li>
<li><p><a href="https://blog.pfsense.org/?p=2095" rel="nofollow">Chris Buechler is leaving the pfSense project, the entire community thanks you for your many years of service </a> </p></li>
<li><p><a href="http://ghostbsd.org/10.3_BETA1" rel="nofollow">GhostBSD 10.3-BETA1 now available</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-June/500671.html" rel="nofollow">DragonFlyBSD adds nvmectl</a> </p></li>
<li><p><a href="https://opnsense.org/opnsense-16-1-18-released/" rel="nofollow">OPNsense 16.1.18 released</a> </p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=302332" rel="nofollow">bhyve_graphics hit CURRENT</a> </p>

<hr></li>
</ul>

<h3>BUG Update</h3>

<ul>
<li><p><a href="https://twitter.com/freebsdcentral/status/750053703420350465" rel="nofollow">FreeBSD Central Twitter account looking for a new owner</a>  </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/talk/2016-July/016732.html" rel="nofollow">NYCBUG meeting : Meet the Smallest BSDs: RetroBSD and LiteBSD, Brian Callahan</a> </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/talk/2016-June/016694.html" rel="nofollow">NYCBUG install fest @ HOPE</a> </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/semibug/2016-June/000107.html" rel="nofollow">SemiBUG is looking for presentations for September and beyond</a> </p></li>
<li><p><a href="http://knoxbug.org/content/2016-07-26" rel="nofollow">Caleb Cooper is giving a talk on Crytpo at KnoxBUG on July 26th</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/vvASr64P" rel="nofollow"> Leif - ZFS xfer </a> </li>
<li><a href="http://pastebin.com/SznQHq7n" rel="nofollow"> Zach - Python3</a> </li>
<li><a href="http://pastebin.com/qkpjKEr0" rel="nofollow"> Dave - Versioning</a> </li>
<li><a href="http://pastebin.com/yr7BUmv2" rel="nofollow"> David - Encrypted Disk Images</a> </li>
<li><a href="http://pastebin.com/xby81NvC" rel="nofollow"> Eli - TLF in all the wrong places</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Today on the show, we are going to be chatting with Michael Dexter about a variety of topics, but of course including bhyve! That plus</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://bsdmag.org/netbsd_intr/" rel="nofollow">NetBSD Introduction</a></h3>

<ul>
<li>We start off today’s episode with a great new NetBSD article!</li>
<li>Siju Oommen George has written an article for BSDMag, which provides a great overview of NetBSD’s beginnings and what it is today.</li>
<li>Of course you can’t start an article about NetBSD without mentioning where the name came from:</li>
</ul>

<p>“The four founders of the NetBSD project, Chris Demetriou, Theo de Raadt, Adam Glass, and Charles Hannum, felt that a more open development model would benefit the project: one centered on portable, clean and correct code. They aimed to produce a unified, multi-platform, production-quality, BSD-based operating system. The name “NetBSD” was suggested by de Raadt, based on the importance and growth of networks, such as the Internet at that time, the distributed and collaborative nature of its development.”</p>

<ul>
<li>From there NetBSD has expanded, and keeping in line with its motto “Of course it runs NetBSD” it has grown to over 57 hardware platforms, including “IA-32, Alpha, PowerPC,SPARC, Raspberry pi 2, SPARC64 and Zaurus”</li>
<li>From there topics such as pkgsrc, SMP, embedded and of course virtualization are all covered, which gives the reader a good overview of what to expect in the modern NetBSD today.</li>
<li>Lastly, in addition to mentioning some of the vendors using NetBSD in a variety of ways, including Point-Of-Sale systems, routers and thin-clients, you may not have known about the research teams which deploy NetBSD:</li>
</ul>

<blockquote>
<p>NASA Lewis Research Center – Satellite Networks and Architectures Branch use NetBSD almost exclusively in their investigation of TCP for use in satellite networks.<br>
KAME project – A research group for implementing IPv6, IPsec and other recent TCP/IP related technologies into BSD UNIX kernels, under BSD license.<br>
NEC Europe Ltd. established the Network Laboratories in Heidelberg, Germany in 1997, as NEC’s third research facility in Europe. The Heidelberg labs focus on software-oriented research and development for the next generation Internet.<br>
SAMS-II Project – Space Acceleration Measurement System II. NASA will be measuring the microgravity environment on the International Space Station using a distributed system, consisting of NetBSD.“</p>

<hr>
</blockquote>

<h3><a href="https://runcommand.io/2016/06/26/my-condolences-youre-now-the-maintainer-of-a-popular-open-source-project/" rel="nofollow">My condolences, you’re now the maintainer of a popular open source project</a></h3>

<ul>
<li>A presentation from a Wordpress conference, about what it is like to be the maintainer of a popular open source project</li>
<li>The presentation covers the basics:</li>
<li>Open Source is more than just the license, it is about community and involvement</li>
<li>The difference between Maintainers and Contributors</li>
<li>It covers some of the reasons people do not open up their code, and other common problems people run into:

<ul>
<li>“I&#39;m embarrassed by my code” (Hint: so is everyone else, post it anyway, it is the best way to learn)</li>
<li>“I&#39;m discouraged that I can&#39;t finish releases on time”</li>
<li>“I&#39;m overwhelmed by the PR backlog”</li>
<li>“I&#39;m frustrated when issues turn into flamewars”</li>
<li>“I&#39;m overcommitted on my open source involvement”</li>
<li>“I feel all alone”</li>
</ul></li>
<li>Each of those points is met with advice and possible solutions</li>
<li>So, there you have it. Open up your code, or join an existing project and help maintain it
***</li>
</ul>

<h3><a href="http://www.hostingadvice.com/blog/freebsd-project-under-the-hood/" rel="nofollow">FreeBSD Committer Allan Jude Discusses the Advantages of FreeBSD and His Role in Keeping Millions of Servers Running</a></h3>

<ul>
<li> An interesting twist on our normal news-stories today, we have an article featuring our very own Allan Jude, talking about why FreeBSD and the advantages of working on an open-source project.</li>
</ul>

<blockquote>
<p>“When Allan started his own company hosting websites for video streaming, FreeBSD was the only operating system he had previously used with other hosts. Based on his experience and comfort with it, he trusted the system with the future of his budding business.A decade later, the former-SysAdmin went to a conference focused on the open-source operating system, where he ran into some of the folks on its documentation team. “They inspired me,” he told our team in a recent chat. He began writing documentation but soon wanted to contribute improvements beyond the docs.Today, Allan sits as a FreeBSD Project Committer. It’s rare that you get to chat with someone involved with a massive-scale open-source project like this — rare and awesome.”</p>
</blockquote>

<ul>
<li>From there Allan goes into some of the reasons “Why” FreeBSD, starting with Code Organization being well-maintained and documented:</li>
</ul>

<blockquote>
<p>“The FreeBSD Project functions like an extremely well-organized world all its own. Allan explained the environment: “There’s a documentation page that explains how the file system’s laid out and everything has a place and it always goes in that place.””</p>

<ul>
<li>In addition, Allan gives us some insight into his work to bring Boot-Environments to the loader, and other reasons why FreeBSD “just makes sense”</li>
<li>In summary Allan wraps it up quite nicely:</li>
</ul>

<p>“An important take-away is that you don’t have to be a major developer with tons of experience to make a difference in the project,” Allan said — and the difference that devs like Allan are making is incredible. If you too want to submit the commit that contributes to the project relied on by millions of web servers, there are plenty of ways to get involved!</p>

<p>We’re especially talking to SysAdmins here, as Allan noted that they are the main users of FreeBSD. “Having more SysAdmins involved in the actual build of the system means we can offer the tools they’re looking for — designed the way a SysAdmin would want them designed, not necessarily the way a developer would think makes the most sense”</p>

<hr>
</blockquote>

<h3><a href="http://justinholcomb.me/blog/2016/07/03/poudriere-in-bhyve-and-bare-metal.html" rel="nofollow">A guide to saving electricity and time with poudriere and bhyve</a></h3>

<ul>
<li>“This article goes over running poudriere to built packages for a Raspberry Pi with the interesting twist of running it both as a bhyve guest and then switching to running on bare metal via Fiber Channel via ctld by sharing the same ZFS volume.”</li>
<li>“Firstly, poudriere can build packages for different architectures such as ARM. This can save hours of build time compared to building ports from said ARM device.”</li>
<li>“Secondly, let’s say a person has an always-on device (NAS) running FreeBSD. To save power, this device has a CPU with a low clock-rate and low core count. This low clock-rate and core count is great for saving power but terrible for processor intensive application such as poudriere. Let’s say a person also has another physical server with fast processors and a high CPU count but draws nearly twice the power and a fan noise to match.”</li>
<li>“To get the best of both worlds, the goal is to build the packages on the fast physical server, power it down, and then start the same ZFS volume in a bhyve environment to serve packages from the always-on device.”</li>
<li>The tutorial walks through setting up ‘ahost’, the always on machine, ‘fhost’ the fast but noisy build machine, and a raspberry pi</li>
<li>It also includes creating a zvol, configuring iSCSI over fibre channel and exporting the zvol, booting an iSCSI volume in bhyve, plus installing and setting up poudriere</li>
<li>This it configures booting over fibre channel, and cross-building armv6 (raspberry pi) packages on the fast build machine</li>
<li>Then the fast machine is shut down, and the zvol is booted in bhyve on the NAS</li>
<li>Everything you need to know to make a hybrid physical/virtual machine</li>
<li>The same setup could also work to run the same bhyve VM from either ahost or fhost</li>
<li>bhyve does not yet support live migration, but when it does, having common network storage like the zvol will be an important part of that
***</li>
</ul>

<h2>Interview - Michael Dexter - <a href="mailto:editor@callfortesting.org" rel="nofollow">editor@callfortesting.org</a> / <a href="https://twitter.com/michaeldexter" rel="nofollow">@michaeldexter</a></h2>

<ul>
<li>The RoloDexter
***</li>
</ul>

<h3>iXSystems</h3>

<ul>
<li><a href="https://www.youtube.com/watch?v=FFbdQ_05e-0" rel="nofollow">Children&#39;s Minnesota Star Studio Chooses iXsystems&#39; TrueNAS Storage</a> 
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.freebsdfoundation.org/wp-content/uploads/2016/06/FreeBSD-Foundation-June-2016-Update.pdf" rel="nofollow">FreeBSD Foundation June 2016 Update</a></h3>

<ul>
<li>The FreeBSD Foundation’s June newsletter is out</li>
<li>Make sure you submit the <a href="https://www.surveymonkey.com/r/freebsd2016" rel="nofollow">FreeBSD Community Survey</a> by July 7th:</li>
<li>In addition to the opening message from the executive director of the foundation, the update includes details to sponsored work on the FreeBSD VM system, reports from a number of conferences the Foundation attended, including BSDCan</li>
<li>The results of the foundation&#39;s yearly board meeting</li>
<li>People the foundation recognized for their contributions to FreeBSD at BSDCan</li>
<li>And an introduction to their new “Getting Started with FreeBSD” project
***</li>
</ul>

<h3><a href="http://www.all-nettools.com/forum/showthread.php?34422-Building-the-FreeBSD-OS-from-scratch" rel="nofollow">[How-To] Building the FreeBSD OS from scratch</a></h3>

<ul>
<li>A tutorial over at the All-NetTools.com forums that walks through building FreeBSD from scratch</li>
<li>I am not sure why anyone would want to build Xorg from source, but you can</li>
<li>It covers everything in quite a bit of detail, from the installation process through adding Xorg and a window manager from source</li>
<li>It also includes tweaking some device node permissions for easier operation as a non-root user, and configuring the firewall
***</li>
</ul>

<h3><a href="http://doc.cat-v.org/bell_labs/transparent_wsys/" rel="nofollow">Window Systems Should Be Transparent</a> + Rob Pike of AT&amp;T Labs writes about why Window Systems should be transparent</h3>

<ul>
<li>This is an old paper (undated, but I think from the late 80s), but may contain some timeless insights</li>
<li>“UNIX window systems are unsatisfactory. Because they are cumbersome and complicated, they are unsuitable companions for an operating system that is appreciated for its technical elegance”</li>
<li>“A good interface should clarify the view, not obscure it”</li>
<li>“Mux is one window system that is popular and therefore worth studying as an example of good design. (It is not commercially important because it runs only on obsolete hardware.) This paper uses mux as a case study to illustrate some principles that can help keep a user interface simple, comfortable, and unobtrusive. When designing their products, the purveyors of commercial window systems should keep these principles in mind.”</li>
<li>There are not many commercial window systems anymore, but “open source” was not really a big thing when this paper was written
***</li>
</ul>

<h3><a href="http://permalink.gmane.org/gmane.comp.standards.posix.austin.general/12877" rel="nofollow">Roger Faulkner, of Solaris fame passed away </a></h3>

<ul>
<li>“RIP Roger Faulkner: creator of the One and True /proc, slayer of the M-to-N threading model -- and the godfather of post-AT&amp;T Unix”</li>
<li><a href="https://twitter.com/bcantrill/status/750442169807171584" rel="nofollow">@bcantrill: Another great Roger Faulkner story </a> </li>
<li><a href="https://news.ycombinator.com/item?id=4306515" rel="nofollow">The story of how pgrep -w saved a monitor -- if not a life</a> </li>
<li><a href="https://twitter.com/bcantrill/status/750442169807171584" rel="nofollow">@bcantrill: With Roger Faulkner, Tim led an engineering coup inside Sun that saved Solaris circa 2.5</a> 
***</li>
</ul>

<h2>Beastie Bits:</h2>

<ul>
<li><p><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2016-June/084843.html" rel="nofollow">Developer Ed Maste is requesting information from those who are users of libvgl.</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-June/249748.html" rel="nofollow">HEADS UP: DragonFly 4.5 world reneeds rebuilding</a> </p></li>
<li><p><a href="https://blog.pfsense.org/?p=2095" rel="nofollow">Chris Buechler is leaving the pfSense project, the entire community thanks you for your many years of service </a> </p></li>
<li><p><a href="http://ghostbsd.org/10.3_BETA1" rel="nofollow">GhostBSD 10.3-BETA1 now available</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-June/500671.html" rel="nofollow">DragonFlyBSD adds nvmectl</a> </p></li>
<li><p><a href="https://opnsense.org/opnsense-16-1-18-released/" rel="nofollow">OPNsense 16.1.18 released</a> </p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=302332" rel="nofollow">bhyve_graphics hit CURRENT</a> </p>

<hr></li>
</ul>

<h3>BUG Update</h3>

<ul>
<li><p><a href="https://twitter.com/freebsdcentral/status/750053703420350465" rel="nofollow">FreeBSD Central Twitter account looking for a new owner</a>  </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/talk/2016-July/016732.html" rel="nofollow">NYCBUG meeting : Meet the Smallest BSDs: RetroBSD and LiteBSD, Brian Callahan</a> </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/talk/2016-June/016694.html" rel="nofollow">NYCBUG install fest @ HOPE</a> </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/semibug/2016-June/000107.html" rel="nofollow">SemiBUG is looking for presentations for September and beyond</a> </p></li>
<li><p><a href="http://knoxbug.org/content/2016-07-26" rel="nofollow">Caleb Cooper is giving a talk on Crytpo at KnoxBUG on July 26th</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/vvASr64P" rel="nofollow"> Leif - ZFS xfer </a> </li>
<li><a href="http://pastebin.com/SznQHq7n" rel="nofollow"> Zach - Python3</a> </li>
<li><a href="http://pastebin.com/qkpjKEr0" rel="nofollow"> Dave - Versioning</a> </li>
<li><a href="http://pastebin.com/yr7BUmv2" rel="nofollow"> David - Encrypted Disk Images</a> </li>
<li><a href="http://pastebin.com/xby81NvC" rel="nofollow"> Eli - TLF in all the wrong places</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>148: The place to B...A Robot!</title>
  <link>https://www.bsdnow.tv/148</link>
  <guid isPermaLink="false">47c069f8-5392-4497-a727-c0cb0b4eb050</guid>
  <pubDate>Wed, 29 Jun 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/47c069f8-5392-4497-a727-c0cb0b4eb050.mp3" length="75272404" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, Allan and I are going to be showing you a very interesting interview we did talking about using FreeBSD to drive</itunes:subtitle>
  <itunes:duration>1:44:32</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, Allan and I are going to be showing you a very interesting interview we did talking about using FreeBSD to drive
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and 
Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD Core Team Election (https://www.freebsd.org/administration.html#t-core)
Core.9 has been elected, and will officially take over from Core.8 on Wednesday, 6 July 2016
Many thanks to the outgoing members of the core team for their service over the last 2 years
214 out of 325 eligible voters (65.8%) cast their votes in an election counting 14 candidates.
The top nine candidates are, in descending order of votes received:
   180    84.1%    Ed Maste (incumbent)
   176    82.2%    George V. Neville-Neil (incumbent)
   171    79.9%    Baptiste Daroussin (incumbent)
   168    78.5%    John Baldwin
   166    77.6%    Hiroki Sato (incumbent)
   147    68.7%    Allan Jude
   132    61.7%    Kris Moore
   121    56.5%    Benedict Reuschling
   108    50.5%    Benno Rice
There was no tie for ninth.
BSDNow and the entire community would also like to extend their thanks to all those who stood for election to the core team
Next week’s core meeting will encompass the members of Core.8 and Core.9, as responsibility for any outstanding items will be passed from outgoing members of core to the new incoming members
***
Why I run OpenBSD (http://deftly.net/posts/2016-05-31-why-i-run-openbsd.html)
This week we have a good article / blog post talking about why the posted has moved to OpenBSD from Linux. 
“One thing I learned during my travels between OSs: consistency is everything.
Most operating systems seem to, at least, keep a consistent interface between themselves and binaries / applications. They do this by keeping consistent APIs (Application Programming Interfaces) and ABIs (Application Binary Interfaces). If you take a binary from a really old version of Linux and run or build it on a brand-spanking new install of Linux, it will likely Just Work™. This is great for applications and developers of applications. Vendors can build binaries for distribution and worry less about their product working when it gets out in the wild (sure this binary built in 2016 will run on RedHat AS2.1!!).“
The author then goes through another important part of the consistency argument, with what he calls “UPI” or “User Program Interfaces”. In other words, while the ABI may be stable, what about the end-user tooling that the user directly has to interact with on a daily basis?
“This inconsistency seems to have come to be when Linux started getting wireless support. For some reason someone (vendors, maybe?) decided that ifconfig wasn’t a good place to let users interact with their wireless device. Maybe they felt their device was special? Maybe there were technical reasons? The bottom line is, someone decided to create a new utility to manage a wireless device… and then another one came along… pretty soon there was iwconfig(8), iw(8), ifconfig(8), some funky thing that let windows drivers interface with Linux.. and one called ip(8) I am sure there are others I am forgetting, but I prefer to forget. I have moved onto greener pastures and the knowledge of these programs no longer serves me.”
The article then goes through the rundown of how he evaluated the various BSD’s and ultimately settled on OpenBSD:
“OpenBSD won the showdown. It was the most complete, simple, and coherent system. The documentation was thorough, the code was easy to follow 
and understand.
It had one command to configure all of the network interfaces!
I didn’t have wireless, but I was able to find a cheap USB adapter that worked by simply running man -k wireless and reading about the USB 
entries.
It didn’t have some of the applications I use regularly, so I started reading about ports (intuitively, via man ports!).”
The ultimate NetBSD Router (http://blog.tbrodel.me/2016/#netbsd-router)
“So yesterday I spent the day setting up a new firewall at home here, based off of this BSD Now tutorial. Having set up a couple of OpenBSD routers before, either based on old laptops, bulky old power-sucking desktops or completely over-specced machines like the Intel NUC, I wanted to get some kind of BSD onto a low-powered ARM board and use that instead.”
“I've had a couple of Cubietrucks lying around for a while now, I've used them in a couple of art installations, running Debian and Pure Data, but over all they've been a bit disappointing. It's more the manufacturer's fault but they require blobs for the graphics and audio, which Debian won't allow, so as a multimedia board they're dud for video, and only passable for audio work with a usb sound card. So they've been collecting dust.”
“Only thing missing is a second NIC, luckily I had an Apple USB-&amp;gt;Ethernet dongle lying around, which when I bought it was the cheapest thing I could find on eBay that OpenBSD definitely supported. There, and on NetBSD, it's supported by the axe(4) driver. USB 2.0 works fine for me as I live in Australia and my ISP can only give me 30Mbps, so this should do for the forseeable future.”
+ The article then walks through installing and configuring NetBSD
+ Configuration includes: pf, unbound, and dhcpd
“This project has been really fun, I started with basically no experience with NetBSD and have finished with a really useful, low-powered and robust appliance. It's a testament to the simplicity of the NetBSD system, and the BSD design principles in general, that such a novice as myself could figure this out. The NetBSD project has easily the most polished experience on Allwinner ARM boards, even Debian doesn't make it this easy. It's been a joy running the system, it has the bits I love from OpenBSD; ksh(1), tmux(1), an http daemon in base and of course, pf(4). This is mixed with some of the pragmatism I see in FreeBSD; a willingness to accept blobs if that really is the only way to boot, or get audio, or a video console.”
bhyve-Bootable Boot Environments (http://callfortesting.org/bhyve-boot-environments/)
We have a lengthy article also today from our friend Michael Dexter, who asks the basic question “What if multibooting and OS upgrades weren't horrible?”
No doubt if you’ve been a frequent listener to this show, you’ve heard Allan or Myself talking about ZFS Boot Environments, and how they can “change your life”.
Well today Michael goes further into detail on how the BE’s work, and how they can be leveraged to do neat things, like installing other versions of an operating system from the original running system.
“If you are reading this, you have probably used a personal computer with a BSD or GNU/Linux operating system and at some point attempted to multiboot between multiple operating systems on the same computer. This goal is typically attempted with complex disk partitioning and a BSD or GNU/Linux boot loader like LILO or GRUB, plus several hours of frustrating experimentation and perhaps data loss. While exotic OS experimentation has driven my virtualization work since the late 1990s, there are very pragmatic reasons for multibooting the same OS on the same hardware, notable for updates and failback to "known good" versions. To its credit, FreeBSD has long had various strategies including the NanoBSD embedded system framework with primary and secondary root partitions, plus the nextboot(8) utility for selecting the "next" kernel with various boot parameters. Get everything set correctly and you can multiboot "with impunity".
“That's a good start, and over time we have seen ZFS "boot environments" be used by PC-BSD and FreeNAS to allow for system updates that allow one to fall back to previous versions should something go wrong. Hats off to these efforts but they exist in essentially purpose-built appliance environments. I have long sensed that there is more fun to be had here and a wonderful thing happened with FreeBSD 10.3 and 11.0: Allan Jude added a boot environment menu to the FreeBSD loader”
From here Michael takes us through the mechanical bits of actually creating a new ZFS dataset (BE) and performing a fresh FreeBSD 10.3 installation into this new boot-environment. 
The twist comes at the end, where he next sets up the BE to be a root NFS for booting in bhyve! This is interesting and gives you a way to test booting into your new environment via a VM, before rebooting the host directly into it.
***
Interview - Edicarla Andrade &amp;amp; Vinícius Zavam - @egypcio (https://twitter.com/egypcio)
BSD-Powered Robots
News Roundup
Tomohiro Kasumi explains what “@@” means, in the context of the Hammer filesystem (http://lists.dragonflybsd.org/pipermail/users/2016-June/249717.html)
A post from the Dragonfly users’ mailing list about what the @@ construct means in the Hammer filesystem
“@@ represents the existence of a PFS which is logically separated pseudo filesystem space within HAMMER's B-Tree”
“HAMMER only has 1 large B-Tree per filesystem (not per PFS), so all the PFS exist within that single B-Tree. PFS are separated by localization parameter which is one of the B-Tree keys used to lookup the tree.”
Each substring in "@@-1:00001" means:
"@@" means it's a PFS or snapshot.
"-1" means it's a master.
":" is just a separator.
"00001" means it's PFS#1, where PFS#0 is the default PFS created on newfs. There is no "00000" because that's what's mounted on /HAMMER. PFS# is used for localization parameter.
“Localization parameter has the highest priority when inserting or looking up B-Tree elements, so fs elements that belong to the same PFS# tend to be localized (clustered) within the B-Tree”
There is also a note about how snapshots are named: "@@0x00..."
A user points out that having : in the path can confuse some applications, such as in the case of adding the current directory or a relative path to the $PATH environment variable, which is a colon delimited list of paths
This seems quite a bit more confusing that the datasets created by ZFS, but they might have other useful properties
***
FreeBSD 11.0 nearing RC1 (https://www.freebsd.org/releases/11.0R/schedule.html)
We’ve all been eagerly awaiting the pending release of FreeBSD 11.0, and the schedule has now been updated!
The first release candidate is slated for July 29th!
If all goes well (and we stick to schedule) there will be another RC2 and possible RC3 release, before 11.0 officially drops near the end of August.
Start playing with those builds folks, be sure to send your feedback to the team to make this the best .0 release ever!
***
TensorFlow on FreeBSD (http://ecc-comp.blogspot.com/2016/06/tensorflow-on-freebsd.html)
Next we have a blog post about the experience of a “new” FreeBSD user trying to deploy some non-ported software to his new system.
Specifically he was interested in running TensorFlow, but not doing a port himself, because in his words: 
“First, I apologize for not supplying a port archive myself. After reading the FreeBSD handbook for creating a port, it's too complex of a task for me right now. I've only been using FreeBSD for two weeks. I would also not like to waste anyone's time giving them a terrible port archive and mess up their system.”
First of all, good ports are often born out of bad ports! Don’t let the porting framework daunt you, give it a go, since that's the only way you are going to learn how to write “good” ports over time. The porters-handbook is a good first place to start, plus the community usually is very helpful in providing feedback.
He then walks us through the changes made to the TensorFlow code (starting with the assumption that OSX was a good “flavor” to begin porting from) and ultimately compiling. 
This ends up with the creation of a pip package which works!
A good tutorial, and also very similar to what goes on in the porting process. With this write-up perhaps somebody will take up creating a port of it… hint hint!
***
NetBSD: A New Beginning? (http://jamesdeagle.blogspot.ca/2016/06/netbsd-new-beginning.html)
We don’t get enough NetBSD news at times, but this post by James Deagle talks about his adventure with NetBSD 7.0 and making it his “new beginning”
“After a few months of traipsing around the worlds of SunOS and Linux, I'm back to NetBSD for what I hope will be a lengthy return engagement. And while I'm enamored of NetBSD for all the previously-mentioned reasons, I'm already thinking ahead to some problems to solve, some of which have also been mentioned before.”
He then goes through and lists some of the small nits he’s still running into during the daily workflow
YouTube audio - Specifically he mentions that no audio is playing, but wonders if Flash plays some part. (Ideally you’re not using Flash though, in which case you need to check the audio backend FF is using. Try PulseAudio since it seems the best supported. If pulse is already enabled, install ‘pavucontrol’ to make sure audio is playing to the correct sound device)
Slow gaming performance (TuxKart and Celestia) - Check DRI / Xorg? Or is it CPU bound?
Lastly some unspecified Wireless issues, which typically end up being driver related. (Or use another chipset)
Beastie Bits
Reproducible NetBSD?  77.7% of the way there (https://reproducible.debian.net/netbsd/netbsd.html) 
Create FreeBSD virtual machine using qemu. Run the VM using xhyve. (https://gist.github.com/zg/38a3afa112ddf7de4912aafc249ec82f) 
FreeBSD PowerPC 32bit pkg repository (unofficial). ~19,500 packages, more to come (https://joshcummings.net/pub/FreeBSD) 
NetBSD machines at Open Source Conference 2016 Gunma (http://mail-index.netbsd.org/netbsd-advocacy/2016/05/16/msg000706.html) 
Adam Leventhal (of ZFS and DTrace) does an analysis of APFS  (http://arstechnica.com/apple/2016/06/a-zfs-developers-analysis-of-the-good-and-bad-in-apples-new-apfs-file-system/) 
SemiBug June meeting summary (http://lists.nycbug.org/pipermail/semibug/2016-June/000106.html) 
KnoxBug Meeting (http://knoxbug.org/content/2016-07-26)
Feedback/Questions
 Andrew - iocage  (http://pastebin.com/nuYTzaG6) 
 Florian - Arm + GitHub (http://pastebin.com/PzY68hNS) 
 Clint - Synth (http://pastebin.com/JESGZjLu) 
 Leonardo - Translations (http://pastebin.com/b4LAiPs4) 
 Zachary - Moving things to VMs (http://pastebin.com/VRc8fvBk) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, Allan and I are going to be showing you a very interesting interview we did talking about using FreeBSD to drive</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/administration.html#t-core" rel="nofollow">FreeBSD Core Team Election</a></h3>

<ul>
<li>Core.9 has been elected, and will officially take over from Core.8 on Wednesday, 6 July 2016</li>
<li>Many thanks to the outgoing members of the core team for their service over the last 2 years</li>
<li>214 out of 325 eligible voters (65.8%) cast their votes in an election counting 14 candidates.</li>
<li>The top nine candidates are, in descending order of votes received:</li>
<li>   180    84.1%    Ed Maste (incumbent)</li>
<li>   176    82.2%    George V. Neville-Neil (incumbent)</li>
<li>   171    79.9%    Baptiste Daroussin (incumbent)</li>
<li>   168    78.5%    John Baldwin</li>
<li>   166    77.6%    Hiroki Sato (incumbent)</li>
<li>   147    68.7%    Allan Jude</li>
<li>   132    61.7%    Kris Moore</li>
<li>   121    56.5%    Benedict Reuschling</li>
<li>   108    50.5%    Benno Rice</li>
<li>There was no tie for ninth.</li>
<li>BSDNow and the entire community would also like to extend their thanks to all those who stood for election to the core team</li>
<li>Next week’s core meeting will encompass the members of Core.8 and Core.9, as responsibility for any outstanding items will be passed from outgoing members of core to the new incoming members
***</li>
</ul>

<h3><a href="http://deftly.net/posts/2016-05-31-why-i-run-openbsd.html" rel="nofollow">Why I run OpenBSD</a></h3>

<ul>
<li>This week we have a good article / blog post talking about why the posted has moved to OpenBSD from Linux. </li>
</ul>

<blockquote>
<p>“One thing I learned during my travels between OSs: consistency is everything.</p>

<p>Most operating systems seem to, at least, keep a consistent interface between themselves and binaries / applications. They do this by keeping consistent APIs (Application Programming Interfaces) and ABIs (Application Binary Interfaces). If you take a binary from a really old version of Linux and run or build it on a brand-spanking new install of Linux, it will likely Just Work™. This is great for applications and developers of applications. Vendors can build binaries for distribution and worry less about their product working when it gets out in the wild (sure this binary built in 2016 will run on RedHat AS2.1!!).“</p>
</blockquote>

<ul>
<li>The author then goes through another important part of the consistency argument, with what he calls “UPI” or “User Program Interfaces”. In other words, while the ABI may be stable, what about the end-user tooling that the user directly has to interact with on a daily basis?</li>
</ul>

<blockquote>
<p>“This inconsistency seems to have come to be when Linux started getting wireless support. For some reason someone (vendors, maybe?) decided that ifconfig wasn’t a good place to let users interact with their wireless device. Maybe they felt their device was special? Maybe there were technical reasons? The bottom line is, someone decided to create a new utility to manage a wireless device… and then another one came along… pretty soon there was iwconfig(8), iw(8), ifconfig(8), some funky thing that let windows drivers interface with Linux.. and one called ip(8) I am sure there are others I am forgetting, but I prefer to forget. I have moved onto greener pastures and the knowledge of these programs no longer serves me.”</p>
</blockquote>

<ul>
<li>The article then goes through the rundown of how he evaluated the various BSD’s and ultimately settled on OpenBSD:</li>
</ul>

<blockquote>
<p>“OpenBSD won the showdown. It was the most complete, simple, and coherent system. The documentation was thorough, the code was easy to follow <br>
and understand.<br>
It had one command to configure all of the network interfaces!<br>
I didn’t have wireless, but I was able to find a cheap USB adapter that worked by simply running man -k wireless and reading about the USB <br>
entries.<br>
It didn’t have some of the applications I use regularly, so I started reading about ports (intuitively, via man ports!).”</p>

<hr>
</blockquote>

<h3><a href="http://blog.tbrodel.me/2016/#netbsd-router" rel="nofollow">The ultimate NetBSD Router</a></h3>

<blockquote>
<p>“So yesterday I spent the day setting up a new firewall at home here, based off of this BSD Now tutorial. Having set up a couple of OpenBSD routers before, either based on old laptops, bulky old power-sucking desktops or completely over-specced machines like the Intel NUC, I wanted to get some kind of BSD onto a low-powered ARM board and use that instead.”<br>
“I&#39;ve had a couple of Cubietrucks lying around for a while now, I&#39;ve used them in a couple of art installations, running Debian and Pure Data, but over all they&#39;ve been a bit disappointing. It&#39;s more the manufacturer&#39;s fault but they require blobs for the graphics and audio, which Debian won&#39;t allow, so as a multimedia board they&#39;re dud for video, and only passable for audio work with a usb sound card. So they&#39;ve been collecting dust.”<br>
“Only thing missing is a second NIC, luckily I had an Apple USB-&gt;Ethernet dongle lying around, which when I bought it was the cheapest thing I could find on eBay that OpenBSD definitely supported. There, and on NetBSD, it&#39;s supported by the axe(4) driver. USB 2.0 works fine for me as I live in Australia and my ISP can only give me 30Mbps, so this should do for the forseeable future.”</p>

<ul>
<li>The article then walks through installing and configuring NetBSD</li>
<li>Configuration includes: pf, unbound, and dhcpd
“This project has been really fun, I started with basically no experience with NetBSD and have finished with a really useful, low-powered and robust appliance. It&#39;s a testament to the simplicity of the NetBSD system, and the BSD design principles in general, that such a novice as myself could figure this out. The NetBSD project has easily the most polished experience on Allwinner ARM boards, even Debian doesn&#39;t make it this easy. It&#39;s been a joy running the system, it has the bits I love from OpenBSD; ksh(1), tmux(1), an http daemon in base and of course, pf(4). This is mixed with some of the pragmatism I see in FreeBSD; a willingness to accept blobs if that really is the only way to boot, or get audio, or a video console.”
***</li>
</ul>
</blockquote>

<h3><a href="http://callfortesting.org/bhyve-boot-environments/" rel="nofollow">bhyve-Bootable Boot Environments</a></h3>

<ul>
<li>We have a lengthy article also today from our friend Michael Dexter, who asks the basic question “What if multibooting and OS upgrades weren&#39;t horrible?”</li>
<li>No doubt if you’ve been a frequent listener to this show, you’ve heard Allan or Myself talking about ZFS Boot Environments, and how they can “change your life”.</li>
<li>Well today Michael goes further into detail on how the BE’s work, and how they can be leveraged to do neat things, like installing other versions of an operating system from the original running system.</li>
</ul>

<blockquote>
<p>“If you are reading this, you have probably used a personal computer with a BSD or GNU/Linux operating system and at some point attempted to multiboot between multiple operating systems on the same computer. This goal is typically attempted with complex disk partitioning and a BSD or GNU/Linux boot loader like LILO or GRUB, plus several hours of frustrating experimentation and perhaps data loss. While exotic OS experimentation has driven my virtualization work since the late 1990s, there are very pragmatic reasons for multibooting the same OS on the same hardware, notable for updates and failback to &quot;known good&quot; versions. To its credit, FreeBSD has long had various strategies including the NanoBSD embedded system framework with primary and secondary root partitions, plus the nextboot(8) utility for selecting the &quot;next&quot; kernel with various boot parameters. Get everything set correctly and you can multiboot &quot;with impunity&quot;.</p>

<p>“That&#39;s a good start, and over time we have seen ZFS &quot;boot environments&quot; be used by PC-BSD and FreeNAS to allow for system updates that allow one to fall back to previous versions should something go wrong. Hats off to these efforts but they exist in essentially purpose-built appliance environments. I have long sensed that there is more fun to be had here and a wonderful thing happened with FreeBSD 10.3 and 11.0: Allan Jude added a boot environment menu to the FreeBSD loader”</p>
</blockquote>

<ul>
<li>From here Michael takes us through the mechanical bits of actually creating a new ZFS dataset (BE) and performing a fresh FreeBSD 10.3 installation into this new boot-environment. </li>
<li>The twist comes at the end, where he next sets up the BE to be a root NFS for booting in bhyve! This is interesting and gives you a way to test booting into your new environment via a VM, before rebooting the host directly into it.
***</li>
</ul>

<h2>Interview - Edicarla Andrade &amp; Vinícius Zavam - <a href="https://twitter.com/egypcio" rel="nofollow">@egypcio</a></h2>

<ul>
<li>BSD-Powered Robots</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2016-June/249717.html" rel="nofollow">Tomohiro Kasumi explains what “@@” means, in the context of the Hammer filesystem</a></h3>

<ul>
<li>A post from the Dragonfly users’ mailing list about what the @@ construct means in the Hammer filesystem</li>
<li>“@@ represents the existence of a PFS which is logically separated pseudo filesystem space within HAMMER&#39;s B-Tree”</li>
<li>“HAMMER only has 1 large B-Tree per filesystem (not per PFS), so all the PFS exist within that single B-Tree. PFS are separated by localization parameter which is one of the B-Tree keys used to lookup the tree.”</li>
<li>Each substring in &quot;@@-1:00001&quot; means:

<ol>
<li>&quot;@@&quot; means it&#39;s a PFS or snapshot.</li>
<li>&quot;-1&quot; means it&#39;s a master.</li>
<li>&quot;:&quot; is just a separator.</li>
<li>&quot;00001&quot; means it&#39;s PFS#1, where PFS#0 is the default PFS created on newfs. There is no &quot;00000&quot; because that&#39;s what&#39;s mounted on /HAMMER. PFS# is used for localization parameter.</li>
</ol></li>
<li>“Localization parameter has the highest priority when inserting or looking up B-Tree elements, so fs elements that belong to the same PFS# tend to be localized (clustered) within the B-Tree”</li>
<li>There is also a note about how snapshots are named: &quot;@@0x00...&quot;</li>
<li>A user points out that having : in the path can confuse some applications, such as in the case of adding the current directory or a relative path to the $PATH environment variable, which is a colon delimited list of paths</li>
<li>This seems quite a bit more confusing that the datasets created by ZFS, but they might have other useful properties
***</li>
</ul>

<h3><a href="https://www.freebsd.org/releases/11.0R/schedule.html" rel="nofollow">FreeBSD 11.0 nearing RC1</a></h3>

<ul>
<li>We’ve all been eagerly awaiting the pending release of FreeBSD 11.0, and the schedule has now been updated!</li>
<li>The first release candidate is slated for July 29th!</li>
<li>If all goes well (and we stick to schedule) there will be another RC2 and possible RC3 release, before 11.0 officially drops near the end of August.</li>
<li>Start playing with those builds folks, be sure to send your feedback to the team to make this the best .0 release ever!
***</li>
</ul>

<h3><a href="http://ecc-comp.blogspot.com/2016/06/tensorflow-on-freebsd.html" rel="nofollow">TensorFlow on FreeBSD</a></h3>

<ul>
<li>Next we have a blog post about the experience of a “new” FreeBSD user trying to deploy some non-ported software to his new system.</li>
<li>Specifically he was interested in running TensorFlow, but not doing a port himself, because in his words: </li>
</ul>

<blockquote>
<p>“First, I apologize for not supplying a port archive myself. After reading the FreeBSD handbook for creating a port, it&#39;s too complex of a task for me right now. I&#39;ve only been using FreeBSD for two weeks. I would also not like to waste anyone&#39;s time giving them a terrible port archive and mess up their system.”</p>
</blockquote>

<ul>
<li>First of all, good ports are often born out of bad ports! Don’t let the porting framework daunt you, give it a go, since that&#39;s the only way you are going to learn how to write “good” ports over time. The porters-handbook is a good first place to start, plus the community usually is very helpful in providing feedback.</li>
<li>He then walks us through the changes made to the TensorFlow code (starting with the assumption that OSX was a good “flavor” to begin porting from) and ultimately compiling. </li>
<li>This ends up with the creation of a pip package which works!</li>
<li>A good tutorial, and also very similar to what goes on in the porting process. With this write-up perhaps somebody will take up creating a port of it… hint hint!
***</li>
</ul>

<h3><a href="http://jamesdeagle.blogspot.ca/2016/06/netbsd-new-beginning.html" rel="nofollow">NetBSD: A New Beginning?</a></h3>

<ul>
<li>We don’t get enough NetBSD news at times, but this post by James Deagle talks about his adventure with NetBSD 7.0 and making it his “new beginning”</li>
</ul>

<blockquote>
<p>“After a few months of traipsing around the worlds of SunOS and Linux, I&#39;m back to NetBSD for what I hope will be a lengthy return engagement. And while I&#39;m enamored of NetBSD for all the previously-mentioned reasons, I&#39;m already thinking ahead to some problems to solve, some of which have also been mentioned before.”</p>
</blockquote>

<ul>
<li><p>He then goes through and lists some of the small nits he’s still running into during the daily workflow</p></li>
<li><p>YouTube audio - Specifically he mentions that no audio is playing, but wonders if Flash plays some part. (Ideally you’re not using Flash though, in which case you need to check the audio backend FF is using. Try PulseAudio since it seems the best supported. If pulse is already enabled, install ‘pavucontrol’ to make sure audio is playing to the correct sound device)</p></li>
<li><p>Slow gaming performance (TuxKart and Celestia) - Check DRI / Xorg? Or is it CPU bound?</p></li>
<li><p>Lastly some unspecified Wireless issues, which typically end up being driver related. (Or use another chipset)</p>

<hr></li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="https://reproducible.debian.net/netbsd/netbsd.html" rel="nofollow">Reproducible NetBSD?  77.7% of the way there</a> </p></li>
<li><p><a href="https://gist.github.com/zg/38a3afa112ddf7de4912aafc249ec82f" rel="nofollow">Create FreeBSD virtual machine using qemu. Run the VM using xhyve.</a> </p></li>
<li><p><a href="https://joshcummings.net/pub/FreeBSD" rel="nofollow">FreeBSD PowerPC 32bit pkg repository (unofficial). ~19,500 packages, more to come</a> </p></li>
<li><p><a href="http://mail-index.netbsd.org/netbsd-advocacy/2016/05/16/msg000706.html" rel="nofollow">NetBSD machines at Open Source Conference 2016 Gunma</a> </p></li>
<li><p><a href="http://arstechnica.com/apple/2016/06/a-zfs-developers-analysis-of-the-good-and-bad-in-apples-new-apfs-file-system/" rel="nofollow">Adam Leventhal (of ZFS and DTrace) does an analysis of APFS </a> </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/semibug/2016-June/000106.html" rel="nofollow">SemiBug June meeting summary</a> </p></li>
<li><p><a href="http://knoxbug.org/content/2016-07-26" rel="nofollow">KnoxBug Meeting</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/nuYTzaG6" rel="nofollow"> Andrew - iocage </a> </li>
<li><a href="http://pastebin.com/PzY68hNS" rel="nofollow"> Florian - Arm + GitHub</a> </li>
<li><a href="http://pastebin.com/JESGZjLu" rel="nofollow"> Clint - Synth</a> </li>
<li><a href="http://pastebin.com/b4LAiPs4" rel="nofollow"> Leonardo - Translations</a> </li>
<li><a href="http://pastebin.com/VRc8fvBk" rel="nofollow"> Zachary - Moving things to VMs</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, Allan and I are going to be showing you a very interesting interview we did talking about using FreeBSD to drive</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/administration.html#t-core" rel="nofollow">FreeBSD Core Team Election</a></h3>

<ul>
<li>Core.9 has been elected, and will officially take over from Core.8 on Wednesday, 6 July 2016</li>
<li>Many thanks to the outgoing members of the core team for their service over the last 2 years</li>
<li>214 out of 325 eligible voters (65.8%) cast their votes in an election counting 14 candidates.</li>
<li>The top nine candidates are, in descending order of votes received:</li>
<li>   180    84.1%    Ed Maste (incumbent)</li>
<li>   176    82.2%    George V. Neville-Neil (incumbent)</li>
<li>   171    79.9%    Baptiste Daroussin (incumbent)</li>
<li>   168    78.5%    John Baldwin</li>
<li>   166    77.6%    Hiroki Sato (incumbent)</li>
<li>   147    68.7%    Allan Jude</li>
<li>   132    61.7%    Kris Moore</li>
<li>   121    56.5%    Benedict Reuschling</li>
<li>   108    50.5%    Benno Rice</li>
<li>There was no tie for ninth.</li>
<li>BSDNow and the entire community would also like to extend their thanks to all those who stood for election to the core team</li>
<li>Next week’s core meeting will encompass the members of Core.8 and Core.9, as responsibility for any outstanding items will be passed from outgoing members of core to the new incoming members
***</li>
</ul>

<h3><a href="http://deftly.net/posts/2016-05-31-why-i-run-openbsd.html" rel="nofollow">Why I run OpenBSD</a></h3>

<ul>
<li>This week we have a good article / blog post talking about why the posted has moved to OpenBSD from Linux. </li>
</ul>

<blockquote>
<p>“One thing I learned during my travels between OSs: consistency is everything.</p>

<p>Most operating systems seem to, at least, keep a consistent interface between themselves and binaries / applications. They do this by keeping consistent APIs (Application Programming Interfaces) and ABIs (Application Binary Interfaces). If you take a binary from a really old version of Linux and run or build it on a brand-spanking new install of Linux, it will likely Just Work™. This is great for applications and developers of applications. Vendors can build binaries for distribution and worry less about their product working when it gets out in the wild (sure this binary built in 2016 will run on RedHat AS2.1!!).“</p>
</blockquote>

<ul>
<li>The author then goes through another important part of the consistency argument, with what he calls “UPI” or “User Program Interfaces”. In other words, while the ABI may be stable, what about the end-user tooling that the user directly has to interact with on a daily basis?</li>
</ul>

<blockquote>
<p>“This inconsistency seems to have come to be when Linux started getting wireless support. For some reason someone (vendors, maybe?) decided that ifconfig wasn’t a good place to let users interact with their wireless device. Maybe they felt their device was special? Maybe there were technical reasons? The bottom line is, someone decided to create a new utility to manage a wireless device… and then another one came along… pretty soon there was iwconfig(8), iw(8), ifconfig(8), some funky thing that let windows drivers interface with Linux.. and one called ip(8) I am sure there are others I am forgetting, but I prefer to forget. I have moved onto greener pastures and the knowledge of these programs no longer serves me.”</p>
</blockquote>

<ul>
<li>The article then goes through the rundown of how he evaluated the various BSD’s and ultimately settled on OpenBSD:</li>
</ul>

<blockquote>
<p>“OpenBSD won the showdown. It was the most complete, simple, and coherent system. The documentation was thorough, the code was easy to follow <br>
and understand.<br>
It had one command to configure all of the network interfaces!<br>
I didn’t have wireless, but I was able to find a cheap USB adapter that worked by simply running man -k wireless and reading about the USB <br>
entries.<br>
It didn’t have some of the applications I use regularly, so I started reading about ports (intuitively, via man ports!).”</p>

<hr>
</blockquote>

<h3><a href="http://blog.tbrodel.me/2016/#netbsd-router" rel="nofollow">The ultimate NetBSD Router</a></h3>

<blockquote>
<p>“So yesterday I spent the day setting up a new firewall at home here, based off of this BSD Now tutorial. Having set up a couple of OpenBSD routers before, either based on old laptops, bulky old power-sucking desktops or completely over-specced machines like the Intel NUC, I wanted to get some kind of BSD onto a low-powered ARM board and use that instead.”<br>
“I&#39;ve had a couple of Cubietrucks lying around for a while now, I&#39;ve used them in a couple of art installations, running Debian and Pure Data, but over all they&#39;ve been a bit disappointing. It&#39;s more the manufacturer&#39;s fault but they require blobs for the graphics and audio, which Debian won&#39;t allow, so as a multimedia board they&#39;re dud for video, and only passable for audio work with a usb sound card. So they&#39;ve been collecting dust.”<br>
“Only thing missing is a second NIC, luckily I had an Apple USB-&gt;Ethernet dongle lying around, which when I bought it was the cheapest thing I could find on eBay that OpenBSD definitely supported. There, and on NetBSD, it&#39;s supported by the axe(4) driver. USB 2.0 works fine for me as I live in Australia and my ISP can only give me 30Mbps, so this should do for the forseeable future.”</p>

<ul>
<li>The article then walks through installing and configuring NetBSD</li>
<li>Configuration includes: pf, unbound, and dhcpd
“This project has been really fun, I started with basically no experience with NetBSD and have finished with a really useful, low-powered and robust appliance. It&#39;s a testament to the simplicity of the NetBSD system, and the BSD design principles in general, that such a novice as myself could figure this out. The NetBSD project has easily the most polished experience on Allwinner ARM boards, even Debian doesn&#39;t make it this easy. It&#39;s been a joy running the system, it has the bits I love from OpenBSD; ksh(1), tmux(1), an http daemon in base and of course, pf(4). This is mixed with some of the pragmatism I see in FreeBSD; a willingness to accept blobs if that really is the only way to boot, or get audio, or a video console.”
***</li>
</ul>
</blockquote>

<h3><a href="http://callfortesting.org/bhyve-boot-environments/" rel="nofollow">bhyve-Bootable Boot Environments</a></h3>

<ul>
<li>We have a lengthy article also today from our friend Michael Dexter, who asks the basic question “What if multibooting and OS upgrades weren&#39;t horrible?”</li>
<li>No doubt if you’ve been a frequent listener to this show, you’ve heard Allan or Myself talking about ZFS Boot Environments, and how they can “change your life”.</li>
<li>Well today Michael goes further into detail on how the BE’s work, and how they can be leveraged to do neat things, like installing other versions of an operating system from the original running system.</li>
</ul>

<blockquote>
<p>“If you are reading this, you have probably used a personal computer with a BSD or GNU/Linux operating system and at some point attempted to multiboot between multiple operating systems on the same computer. This goal is typically attempted with complex disk partitioning and a BSD or GNU/Linux boot loader like LILO or GRUB, plus several hours of frustrating experimentation and perhaps data loss. While exotic OS experimentation has driven my virtualization work since the late 1990s, there are very pragmatic reasons for multibooting the same OS on the same hardware, notable for updates and failback to &quot;known good&quot; versions. To its credit, FreeBSD has long had various strategies including the NanoBSD embedded system framework with primary and secondary root partitions, plus the nextboot(8) utility for selecting the &quot;next&quot; kernel with various boot parameters. Get everything set correctly and you can multiboot &quot;with impunity&quot;.</p>

<p>“That&#39;s a good start, and over time we have seen ZFS &quot;boot environments&quot; be used by PC-BSD and FreeNAS to allow for system updates that allow one to fall back to previous versions should something go wrong. Hats off to these efforts but they exist in essentially purpose-built appliance environments. I have long sensed that there is more fun to be had here and a wonderful thing happened with FreeBSD 10.3 and 11.0: Allan Jude added a boot environment menu to the FreeBSD loader”</p>
</blockquote>

<ul>
<li>From here Michael takes us through the mechanical bits of actually creating a new ZFS dataset (BE) and performing a fresh FreeBSD 10.3 installation into this new boot-environment. </li>
<li>The twist comes at the end, where he next sets up the BE to be a root NFS for booting in bhyve! This is interesting and gives you a way to test booting into your new environment via a VM, before rebooting the host directly into it.
***</li>
</ul>

<h2>Interview - Edicarla Andrade &amp; Vinícius Zavam - <a href="https://twitter.com/egypcio" rel="nofollow">@egypcio</a></h2>

<ul>
<li>BSD-Powered Robots</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2016-June/249717.html" rel="nofollow">Tomohiro Kasumi explains what “@@” means, in the context of the Hammer filesystem</a></h3>

<ul>
<li>A post from the Dragonfly users’ mailing list about what the @@ construct means in the Hammer filesystem</li>
<li>“@@ represents the existence of a PFS which is logically separated pseudo filesystem space within HAMMER&#39;s B-Tree”</li>
<li>“HAMMER only has 1 large B-Tree per filesystem (not per PFS), so all the PFS exist within that single B-Tree. PFS are separated by localization parameter which is one of the B-Tree keys used to lookup the tree.”</li>
<li>Each substring in &quot;@@-1:00001&quot; means:

<ol>
<li>&quot;@@&quot; means it&#39;s a PFS or snapshot.</li>
<li>&quot;-1&quot; means it&#39;s a master.</li>
<li>&quot;:&quot; is just a separator.</li>
<li>&quot;00001&quot; means it&#39;s PFS#1, where PFS#0 is the default PFS created on newfs. There is no &quot;00000&quot; because that&#39;s what&#39;s mounted on /HAMMER. PFS# is used for localization parameter.</li>
</ol></li>
<li>“Localization parameter has the highest priority when inserting or looking up B-Tree elements, so fs elements that belong to the same PFS# tend to be localized (clustered) within the B-Tree”</li>
<li>There is also a note about how snapshots are named: &quot;@@0x00...&quot;</li>
<li>A user points out that having : in the path can confuse some applications, such as in the case of adding the current directory or a relative path to the $PATH environment variable, which is a colon delimited list of paths</li>
<li>This seems quite a bit more confusing that the datasets created by ZFS, but they might have other useful properties
***</li>
</ul>

<h3><a href="https://www.freebsd.org/releases/11.0R/schedule.html" rel="nofollow">FreeBSD 11.0 nearing RC1</a></h3>

<ul>
<li>We’ve all been eagerly awaiting the pending release of FreeBSD 11.0, and the schedule has now been updated!</li>
<li>The first release candidate is slated for July 29th!</li>
<li>If all goes well (and we stick to schedule) there will be another RC2 and possible RC3 release, before 11.0 officially drops near the end of August.</li>
<li>Start playing with those builds folks, be sure to send your feedback to the team to make this the best .0 release ever!
***</li>
</ul>

<h3><a href="http://ecc-comp.blogspot.com/2016/06/tensorflow-on-freebsd.html" rel="nofollow">TensorFlow on FreeBSD</a></h3>

<ul>
<li>Next we have a blog post about the experience of a “new” FreeBSD user trying to deploy some non-ported software to his new system.</li>
<li>Specifically he was interested in running TensorFlow, but not doing a port himself, because in his words: </li>
</ul>

<blockquote>
<p>“First, I apologize for not supplying a port archive myself. After reading the FreeBSD handbook for creating a port, it&#39;s too complex of a task for me right now. I&#39;ve only been using FreeBSD for two weeks. I would also not like to waste anyone&#39;s time giving them a terrible port archive and mess up their system.”</p>
</blockquote>

<ul>
<li>First of all, good ports are often born out of bad ports! Don’t let the porting framework daunt you, give it a go, since that&#39;s the only way you are going to learn how to write “good” ports over time. The porters-handbook is a good first place to start, plus the community usually is very helpful in providing feedback.</li>
<li>He then walks us through the changes made to the TensorFlow code (starting with the assumption that OSX was a good “flavor” to begin porting from) and ultimately compiling. </li>
<li>This ends up with the creation of a pip package which works!</li>
<li>A good tutorial, and also very similar to what goes on in the porting process. With this write-up perhaps somebody will take up creating a port of it… hint hint!
***</li>
</ul>

<h3><a href="http://jamesdeagle.blogspot.ca/2016/06/netbsd-new-beginning.html" rel="nofollow">NetBSD: A New Beginning?</a></h3>

<ul>
<li>We don’t get enough NetBSD news at times, but this post by James Deagle talks about his adventure with NetBSD 7.0 and making it his “new beginning”</li>
</ul>

<blockquote>
<p>“After a few months of traipsing around the worlds of SunOS and Linux, I&#39;m back to NetBSD for what I hope will be a lengthy return engagement. And while I&#39;m enamored of NetBSD for all the previously-mentioned reasons, I&#39;m already thinking ahead to some problems to solve, some of which have also been mentioned before.”</p>
</blockquote>

<ul>
<li><p>He then goes through and lists some of the small nits he’s still running into during the daily workflow</p></li>
<li><p>YouTube audio - Specifically he mentions that no audio is playing, but wonders if Flash plays some part. (Ideally you’re not using Flash though, in which case you need to check the audio backend FF is using. Try PulseAudio since it seems the best supported. If pulse is already enabled, install ‘pavucontrol’ to make sure audio is playing to the correct sound device)</p></li>
<li><p>Slow gaming performance (TuxKart and Celestia) - Check DRI / Xorg? Or is it CPU bound?</p></li>
<li><p>Lastly some unspecified Wireless issues, which typically end up being driver related. (Or use another chipset)</p>

<hr></li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="https://reproducible.debian.net/netbsd/netbsd.html" rel="nofollow">Reproducible NetBSD?  77.7% of the way there</a> </p></li>
<li><p><a href="https://gist.github.com/zg/38a3afa112ddf7de4912aafc249ec82f" rel="nofollow">Create FreeBSD virtual machine using qemu. Run the VM using xhyve.</a> </p></li>
<li><p><a href="https://joshcummings.net/pub/FreeBSD" rel="nofollow">FreeBSD PowerPC 32bit pkg repository (unofficial). ~19,500 packages, more to come</a> </p></li>
<li><p><a href="http://mail-index.netbsd.org/netbsd-advocacy/2016/05/16/msg000706.html" rel="nofollow">NetBSD machines at Open Source Conference 2016 Gunma</a> </p></li>
<li><p><a href="http://arstechnica.com/apple/2016/06/a-zfs-developers-analysis-of-the-good-and-bad-in-apples-new-apfs-file-system/" rel="nofollow">Adam Leventhal (of ZFS and DTrace) does an analysis of APFS </a> </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/semibug/2016-June/000106.html" rel="nofollow">SemiBug June meeting summary</a> </p></li>
<li><p><a href="http://knoxbug.org/content/2016-07-26" rel="nofollow">KnoxBug Meeting</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/nuYTzaG6" rel="nofollow"> Andrew - iocage </a> </li>
<li><a href="http://pastebin.com/PzY68hNS" rel="nofollow"> Florian - Arm + GitHub</a> </li>
<li><a href="http://pastebin.com/JESGZjLu" rel="nofollow"> Clint - Synth</a> </li>
<li><a href="http://pastebin.com/b4LAiPs4" rel="nofollow"> Leonardo - Translations</a> </li>
<li><a href="http://pastebin.com/VRc8fvBk" rel="nofollow"> Zachary - Moving things to VMs</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>147: Release all the things!</title>
  <link>https://www.bsdnow.tv/147</link>
  <guid isPermaLink="false">5d5709eb-d443-4e84-bf66-b521e3b7c5eb</guid>
  <pubDate>Wed, 22 Jun 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5d5709eb-d443-4e84-bf66-b521e3b7c5eb.mp3" length="72186484" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>On this episode of BSDNow, we will be talking to Glen Barber and Peter Wemm of the FreeBSD RE and Cluster Admin teams! That plus our</itunes:subtitle>
  <itunes:duration>1:40:15</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>On this episode of BSDNow, we will be talking to Glen Barber and Peter Wemm of the FreeBSD RE and Cluster Admin teams! That plus our
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and 
Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
2016 FreeBSD Community Survey (https://www.surveymonkey.com/r/freebsd2016)
We often get comments from our listeners, “I’m not a developer, how can I help out”?
Well today is your chance to do something. The FreeBSD Foundation has its 2016 Community Survey online, where they are asking for feedback from 
you!
I just did the survey, it’ll take you about 5 minutes, but gives you a chance to provide valuable feedback to the foundation about things that 
are important to you.
Be sure to answer in as much detail as possible and the foundation will review and use this feedback for its operations going forward.
***
ART, OpenBSDs new routing table, single thread performances (http://www.grenadille.net/post/2016/06/17/ART-single-thread-performances)
OpenBSD has changed the way routes are looked up in the kernel as part of their path to an SMP networking stack
The “Allotment Routing Table” (ART) is a performance tradeoff, where more memory is used to store the routing table, in exchange for faster 
lookups
With this new arrangement, a full BGP routing table will grow from 130MB to 180MB of memory
“ART is a free multibit trie based routing table. To keep it simple, it can be seen as using more memory for fewer CPU cycles. In other words, 
we get a faster lookup by wasting memory. The original paper (http://www.hariguchi.org/art/art.pdf) presents some performance comparisons between 
two ART configurations and the BSD Radix. But how does this apply to OpenBSD?”
“I asked Hrvoje Popovski to run his packet forwarding test on his Xeon box (E5-2620 v2 @ 2.10GHz, 2400.34 MHz) with ix(4) (82599) interfaces. 
The test setup consist of three machines with the OpenBSD box in the middle”
“The simulations have been performed with an OpenBSD -current from June 9th. The machine is configured with pf(4) disabled in order to force a 
single route lookup for every IPv4 packet. Based on the result of the lookup the kernel decide if it should forward, deliver or drop the packet”
***
BSDCan 2016 Playlist (https://www.youtube.com/playlist?list=PLeF8ZihVdpFfoEV67dBSrKfA8ifpUr6qC)
The complete set of videos from BSDCan is online and ready to be consumed
Remember the good-ole days where we would wait months (or years) to get videos posted from conferences?
Well, who are we kidding, some conferences STILL do that, but we can’t count BSDCan among them. 
Only two weeks out from this years exciting BSDCan, and all the videos have now landed on YouTube.
Granted, this is no substitute for actually being at the conference, but even if you attended you probably missed quite a few of the talks.
There are no videos of the hallway track, which is the best part of the conference
Except the dinner discussion of course.
and don’t forget the hacker lounge
***
Should you be scared of Unix signals? (http://jvns.ca/blog/2016/06/13/should-you-be-scared-of-signals/)
Do you know much about UNIX Signals?
Are you afraid of their complexity? 
Do you know there are signals other than SIGKILL?
This article talks about the practical implications of signals from a programming perspective
The things you need to consider when dealing with signals
Basically, you register a “signal handler”, the function that will be run when a signal arrives
As you program is running, if a signal arrives, your program will be interrupted. Its current state will be saved and any system calls in progress 
will return EINTR (Error, Interrupted), then your signal handler will be run.
Once the signal handler is complete, the state of your application will be restored, and execution will resume
As long as your program properly handles this interruption, and errors that might result from it (getting EINTR from a read() call, instead of the 
data you expected), then everything should be fine.
Of course, you need to be careful what you do inside your signal handler, as if you modify any variables or state in your application, it might be 
very confused when it resumes.
***
Interview - Glen and Peter-
News Roundup
Unik - The Unikernel Compilation and Deployment Platform (uses NetBSD's Rump) (https://github.com/emc-advanced-dev/unik)
We’ve talked a bit about NetBSD’s RUMP (unikernel) in the past, including articles on how to deploy services using it.
Now we have an interesting project which makes the process super-easy, and dare-we-say almost “Docker-Like?”
The Unik project has a fairly complete walkthrough right on their GitHub project page, including details on installation and creating your own 
unikernel containers. 
In addition, it provides instructions on boot-strapping your own Go/Node.js/Python/Java applications, and supports out of Box VCenter / AWS / Qemu 
/ VirtualBox providers.
***
PkgSrc 50th Release Highlights ()
pkgsrc is celebrating its 50th release, and to highlight this, they have posted a series of interviews from people who have been active in the 
project
pkgsrc 50th release interviews - Jonathan Perkin (http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interviews_jonathan)
pkgsrc 50th release interviews - Ryo ONODERA (http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interviews_ryo)
pkgsrc 50th release interviews - Joerg Sonnenberg (http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interview_with) 
pkgsrc 50th release interviews - Sevan Janiyan (https://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interviews_sevan) 
***
Migrating to FreeBSD from Solaris 11 (http://justinholcomb.me/blog/2016/02/28/migration-to-freebsd-part1.html)
Part 2 (http://justinholcomb.me/blog/2016/03/12/migration-to-freebsd-part2.html) 
Part 3 (http://justinholcomb.me/blog/2016/03/19/migration-to-freebsd-part3.html) 
Part 4 (http://justinholcomb.me/blog/2016/03/26/migration-to-freebsd-part4.html) 
Part 5 (http://justinholcomb.me/blog/2016/04/03/migration-to-freebsd-part5.html) 
***
How to chroot www/firefox on NetBSD (https://github.com/alnsn/localpkgsrc/tree/master/firefox-chroot)
Looking for a jail-like method of running FireFox on NetBSD? (Or possibly other BSDs?)
We have a github repo with details on how to setup and run FireFox using a chroot using a “webuser” account for safety. 
Think of this as a jail alternative, may be useful on systems with no jail support.
Of interest is the method used to do X forwarding. It uses Xorg TCP listen option (which is often off by default for security reasons). Perhaps SSH 
X forwarding would be a better alternative. (Or nullfs mounts of /tmp)
***
Beastie Bits
Tredly - V1 Release Candidate (https://github.com/tredly/tredly/releases/tag/v1.0.0-rc.1)
Call for Testing - ypldap testing against OpenLDAP and Microsoft Active 
Directory (http://lists.freebsd.org/pipermail/freebsd-current/2016-June/061775.html) 
BSD Magazine, June 2016 Out Now (https://bsdmag.org/)
Hammer2 - Add xxhash to H2 and throw in debug stuff for performance 
testing (http://lists.dragonflybsd.org/pipermail/commits/2016-June/500610.html) 
chyves pre-announcement (http://justinholcomb.me/blog/2016/06/14/chyves-project-preannouncement.html) 
***
Feedback/Questions
 Michael - Versioning  (http://pastebin.com/1hpGrmuL) 
 Michael - Removing Encryption  (http://pastebin.com/2PkrMGGx) 
 Bostjan - PC-BSD Questions (http://pastebin.com/q5VdmNxG) 
 Fong - ZFS Rollback  (http://pastebin.com/2aedLV7d) 
 Jochen - Docker on FBSD (http://pastebin.com/dneVZkXc) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>On this episode of BSDNow, we will be talking to Glen Barber and Peter Wemm of the FreeBSD RE and Cluster Admin teams! That plus our</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.surveymonkey.com/r/freebsd2016" rel="nofollow">2016 FreeBSD Community Survey</a></h3>

<ul>
<li>We often get comments from our listeners, “I’m not a developer, how can I help out”?</li>
<li>Well today is your chance to do something. The FreeBSD Foundation has its 2016 Community Survey online, where they are asking for feedback from 
you!</li>
<li>I just did the survey, it’ll take you about 5 minutes, but gives you a chance to provide valuable feedback to the foundation about things that 
are important to you.</li>
<li>Be sure to answer in as much detail as possible and the foundation will review and use this feedback for its operations going forward.
***</li>
</ul>

<h3><a href="http://www.grenadille.net/post/2016/06/17/ART-single-thread-performances" rel="nofollow">ART, OpenBSDs new routing table, single thread performances</a></h3>

<ul>
<li>OpenBSD has changed the way routes are looked up in the kernel as part of their path to an SMP networking stack</li>
<li>The “Allotment Routing Table” (ART) is a performance tradeoff, where more memory is used to store the routing table, in exchange for faster 
lookups</li>
<li>With this new arrangement, a full BGP routing table will grow from 130MB to 180MB of memory</li>
<li>“ART is a free multibit trie based routing table. To keep it simple, it can be seen as using more memory for fewer CPU cycles. In other words, 
we get a faster lookup by wasting memory. The <a href="http://www.hariguchi.org/art/art.pdf" rel="nofollow">original paper</a> presents some performance comparisons between 
two ART configurations and the BSD Radix. But how does this apply to OpenBSD?”</li>
<li>“I asked Hrvoje Popovski to run his packet forwarding test on his Xeon box (E5-2620 v2 @ 2.10GHz, 2400.34 MHz) with ix(4) (82599) interfaces. 
The test setup consist of three machines with the OpenBSD box in the middle”</li>
<li>“The simulations have been performed with an OpenBSD -current from June 9th. The machine is configured with pf(4) disabled in order to force a 
single route lookup for every IPv4 packet. Based on the result of the lookup the kernel decide if it should forward, deliver or drop the packet”
***</li>
</ul>

<h3><a href="https://www.youtube.com/playlist?list=PLeF8ZihVdpFfoEV67dBSrKfA8ifpUr6qC" rel="nofollow">BSDCan 2016 Playlist</a></h3>

<ul>
<li>The complete set of videos from BSDCan is online and ready to be consumed</li>
<li>Remember the good-ole days where we would wait months (or years) to get videos posted from conferences?</li>
<li>Well, who are we kidding, some conferences STILL do that, but we can’t count BSDCan among them. </li>
<li>Only two weeks out from this years exciting BSDCan, and <em>all</em> the videos have now landed on YouTube.</li>
<li>Granted, this is no substitute for actually being at the conference, but even if you attended you probably missed quite a few of the talks.</li>
<li>There are no videos of the hallway track, which is the best part of the conference</li>
<li>Except the dinner discussion of course.</li>
<li>and don’t forget the hacker lounge
***</li>
</ul>

<h3><a href="http://jvns.ca/blog/2016/06/13/should-you-be-scared-of-signals/" rel="nofollow">Should you be scared of Unix signals?</a></h3>

<ul>
<li>Do you know much about UNIX Signals?</li>
<li>Are you afraid of their complexity? </li>
<li>Do you know there are signals other than SIGKILL?</li>
<li>This article talks about the practical implications of signals from a programming perspective</li>
<li>The things you need to consider when dealing with signals</li>
<li>Basically, you register a “signal handler”, the function that will be run when a signal arrives</li>
<li>As you program is running, if a signal arrives, your program will be interrupted. Its current state will be saved and any system calls in progress 
will return EINTR (Error, Interrupted), then your signal handler will be run.</li>
<li>Once the signal handler is complete, the state of your application will be restored, and execution will resume</li>
<li>As long as your program properly handles this interruption, and errors that might result from it (getting EINTR from a read() call, instead of the 
data you expected), then everything should be fine.</li>
<li>Of course, you need to be careful what you do inside your signal handler, as if you modify any variables or state in your application, it might be 
very confused when it resumes.
***</li>
</ul>

<h2>Interview - Glen and Peter-</h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/emc-advanced-dev/unik" rel="nofollow">Unik - The Unikernel Compilation and Deployment Platform (uses NetBSD&#39;s Rump)</a></h3>

<ul>
<li>We’ve talked a bit about NetBSD’s RUMP (unikernel) in the past, including articles on how to deploy services using it.</li>
<li>Now we have an interesting project which makes the process super-easy, and dare-we-say almost “Docker-Like?”</li>
<li>The Unik project has a fairly complete walkthrough right on their GitHub project page, including details on installation and creating your own 
unikernel containers. </li>
<li>In addition, it provides instructions on boot-strapping your own Go/Node.js/Python/Java applications, and supports out of Box VCenter / AWS / Qemu 
/ VirtualBox providers.
***</li>
</ul>

<h3><a href="" rel="nofollow">PkgSrc 50th Release Highlights</a></h3>

<ul>
<li>pkgsrc is celebrating its 50th release, and to highlight this, they have posted a series of interviews from people who have been active in the 
project</li>
<li><a href="http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interviews_jonathan" rel="nofollow">pkgsrc 50th release interviews - Jonathan Perkin</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interviews_ryo" rel="nofollow">pkgsrc 50th release interviews - Ryo ONODERA</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interview_with" rel="nofollow">pkgsrc 50th release interviews - Joerg Sonnenberg</a> </li>
<li><a href="https://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interviews_sevan" rel="nofollow">pkgsrc 50th release interviews - Sevan Janiyan</a> 
***</li>
</ul>

<h3><a href="http://justinholcomb.me/blog/2016/02/28/migration-to-freebsd-part1.html" rel="nofollow">Migrating to FreeBSD from Solaris 11</a></h3>

<ul>
<li><a href="http://justinholcomb.me/blog/2016/03/12/migration-to-freebsd-part2.html" rel="nofollow">Part 2</a> </li>
<li><a href="http://justinholcomb.me/blog/2016/03/19/migration-to-freebsd-part3.html" rel="nofollow">Part 3</a> </li>
<li><a href="http://justinholcomb.me/blog/2016/03/26/migration-to-freebsd-part4.html" rel="nofollow">Part 4</a> </li>
<li><a href="http://justinholcomb.me/blog/2016/04/03/migration-to-freebsd-part5.html" rel="nofollow">Part 5</a> 
***</li>
</ul>

<h3><a href="https://github.com/alnsn/localpkgsrc/tree/master/firefox-chroot" rel="nofollow">How to chroot www/firefox on NetBSD</a></h3>

<ul>
<li>Looking for a jail-like method of running FireFox on NetBSD? (Or possibly other BSDs?)</li>
<li>We have a github repo with details on how to setup and run FireFox using a chroot using a “webuser” account for safety. </li>
<li>Think of this as a jail alternative, may be useful on systems with no jail support.</li>
<li>Of interest is the method used to do X forwarding. It uses Xorg TCP listen option (which is often off by default for security reasons). Perhaps SSH 
X forwarding would be a better alternative. (Or nullfs mounts of /tmp)
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><a href="https://github.com/tredly/tredly/releases/tag/v1.0.0-rc.1" rel="nofollow">Tredly - V1 Release Candidate</a></li>
<li><a href="http://lists.freebsd.org/pipermail/freebsd-current/2016-June/061775.html" rel="nofollow">Call for Testing - ypldap testing against OpenLDAP and Microsoft Active 
Directory</a> </li>
<li><a href="https://bsdmag.org/" rel="nofollow">BSD Magazine, June 2016 Out Now</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-June/500610.html" rel="nofollow">Hammer2 - Add xxhash to H2 and throw in debug stuff for performance 
testing</a> </li>
<li><a href="http://justinholcomb.me/blog/2016/06/14/chyves-project-preannouncement.html" rel="nofollow">chyves pre-announcement</a> 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/1hpGrmuL" rel="nofollow"> Michael - Versioning </a> </li>
<li><a href="http://pastebin.com/2PkrMGGx" rel="nofollow"> Michael - Removing Encryption </a> </li>
<li><a href="http://pastebin.com/q5VdmNxG" rel="nofollow"> Bostjan - PC-BSD Questions</a> </li>
<li><a href="http://pastebin.com/2aedLV7d" rel="nofollow"> Fong - ZFS Rollback </a> </li>
<li><a href="http://pastebin.com/dneVZkXc" rel="nofollow"> Jochen - Docker on FBSD</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>On this episode of BSDNow, we will be talking to Glen Barber and Peter Wemm of the FreeBSD RE and Cluster Admin teams! That plus our</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.surveymonkey.com/r/freebsd2016" rel="nofollow">2016 FreeBSD Community Survey</a></h3>

<ul>
<li>We often get comments from our listeners, “I’m not a developer, how can I help out”?</li>
<li>Well today is your chance to do something. The FreeBSD Foundation has its 2016 Community Survey online, where they are asking for feedback from 
you!</li>
<li>I just did the survey, it’ll take you about 5 minutes, but gives you a chance to provide valuable feedback to the foundation about things that 
are important to you.</li>
<li>Be sure to answer in as much detail as possible and the foundation will review and use this feedback for its operations going forward.
***</li>
</ul>

<h3><a href="http://www.grenadille.net/post/2016/06/17/ART-single-thread-performances" rel="nofollow">ART, OpenBSDs new routing table, single thread performances</a></h3>

<ul>
<li>OpenBSD has changed the way routes are looked up in the kernel as part of their path to an SMP networking stack</li>
<li>The “Allotment Routing Table” (ART) is a performance tradeoff, where more memory is used to store the routing table, in exchange for faster 
lookups</li>
<li>With this new arrangement, a full BGP routing table will grow from 130MB to 180MB of memory</li>
<li>“ART is a free multibit trie based routing table. To keep it simple, it can be seen as using more memory for fewer CPU cycles. In other words, 
we get a faster lookup by wasting memory. The <a href="http://www.hariguchi.org/art/art.pdf" rel="nofollow">original paper</a> presents some performance comparisons between 
two ART configurations and the BSD Radix. But how does this apply to OpenBSD?”</li>
<li>“I asked Hrvoje Popovski to run his packet forwarding test on his Xeon box (E5-2620 v2 @ 2.10GHz, 2400.34 MHz) with ix(4) (82599) interfaces. 
The test setup consist of three machines with the OpenBSD box in the middle”</li>
<li>“The simulations have been performed with an OpenBSD -current from June 9th. The machine is configured with pf(4) disabled in order to force a 
single route lookup for every IPv4 packet. Based on the result of the lookup the kernel decide if it should forward, deliver or drop the packet”
***</li>
</ul>

<h3><a href="https://www.youtube.com/playlist?list=PLeF8ZihVdpFfoEV67dBSrKfA8ifpUr6qC" rel="nofollow">BSDCan 2016 Playlist</a></h3>

<ul>
<li>The complete set of videos from BSDCan is online and ready to be consumed</li>
<li>Remember the good-ole days where we would wait months (or years) to get videos posted from conferences?</li>
<li>Well, who are we kidding, some conferences STILL do that, but we can’t count BSDCan among them. </li>
<li>Only two weeks out from this years exciting BSDCan, and <em>all</em> the videos have now landed on YouTube.</li>
<li>Granted, this is no substitute for actually being at the conference, but even if you attended you probably missed quite a few of the talks.</li>
<li>There are no videos of the hallway track, which is the best part of the conference</li>
<li>Except the dinner discussion of course.</li>
<li>and don’t forget the hacker lounge
***</li>
</ul>

<h3><a href="http://jvns.ca/blog/2016/06/13/should-you-be-scared-of-signals/" rel="nofollow">Should you be scared of Unix signals?</a></h3>

<ul>
<li>Do you know much about UNIX Signals?</li>
<li>Are you afraid of their complexity? </li>
<li>Do you know there are signals other than SIGKILL?</li>
<li>This article talks about the practical implications of signals from a programming perspective</li>
<li>The things you need to consider when dealing with signals</li>
<li>Basically, you register a “signal handler”, the function that will be run when a signal arrives</li>
<li>As you program is running, if a signal arrives, your program will be interrupted. Its current state will be saved and any system calls in progress 
will return EINTR (Error, Interrupted), then your signal handler will be run.</li>
<li>Once the signal handler is complete, the state of your application will be restored, and execution will resume</li>
<li>As long as your program properly handles this interruption, and errors that might result from it (getting EINTR from a read() call, instead of the 
data you expected), then everything should be fine.</li>
<li>Of course, you need to be careful what you do inside your signal handler, as if you modify any variables or state in your application, it might be 
very confused when it resumes.
***</li>
</ul>

<h2>Interview - Glen and Peter-</h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/emc-advanced-dev/unik" rel="nofollow">Unik - The Unikernel Compilation and Deployment Platform (uses NetBSD&#39;s Rump)</a></h3>

<ul>
<li>We’ve talked a bit about NetBSD’s RUMP (unikernel) in the past, including articles on how to deploy services using it.</li>
<li>Now we have an interesting project which makes the process super-easy, and dare-we-say almost “Docker-Like?”</li>
<li>The Unik project has a fairly complete walkthrough right on their GitHub project page, including details on installation and creating your own 
unikernel containers. </li>
<li>In addition, it provides instructions on boot-strapping your own Go/Node.js/Python/Java applications, and supports out of Box VCenter / AWS / Qemu 
/ VirtualBox providers.
***</li>
</ul>

<h3><a href="" rel="nofollow">PkgSrc 50th Release Highlights</a></h3>

<ul>
<li>pkgsrc is celebrating its 50th release, and to highlight this, they have posted a series of interviews from people who have been active in the 
project</li>
<li><a href="http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interviews_jonathan" rel="nofollow">pkgsrc 50th release interviews - Jonathan Perkin</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interviews_ryo" rel="nofollow">pkgsrc 50th release interviews - Ryo ONODERA</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interview_with" rel="nofollow">pkgsrc 50th release interviews - Joerg Sonnenberg</a> </li>
<li><a href="https://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interviews_sevan" rel="nofollow">pkgsrc 50th release interviews - Sevan Janiyan</a> 
***</li>
</ul>

<h3><a href="http://justinholcomb.me/blog/2016/02/28/migration-to-freebsd-part1.html" rel="nofollow">Migrating to FreeBSD from Solaris 11</a></h3>

<ul>
<li><a href="http://justinholcomb.me/blog/2016/03/12/migration-to-freebsd-part2.html" rel="nofollow">Part 2</a> </li>
<li><a href="http://justinholcomb.me/blog/2016/03/19/migration-to-freebsd-part3.html" rel="nofollow">Part 3</a> </li>
<li><a href="http://justinholcomb.me/blog/2016/03/26/migration-to-freebsd-part4.html" rel="nofollow">Part 4</a> </li>
<li><a href="http://justinholcomb.me/blog/2016/04/03/migration-to-freebsd-part5.html" rel="nofollow">Part 5</a> 
***</li>
</ul>

<h3><a href="https://github.com/alnsn/localpkgsrc/tree/master/firefox-chroot" rel="nofollow">How to chroot www/firefox on NetBSD</a></h3>

<ul>
<li>Looking for a jail-like method of running FireFox on NetBSD? (Or possibly other BSDs?)</li>
<li>We have a github repo with details on how to setup and run FireFox using a chroot using a “webuser” account for safety. </li>
<li>Think of this as a jail alternative, may be useful on systems with no jail support.</li>
<li>Of interest is the method used to do X forwarding. It uses Xorg TCP listen option (which is often off by default for security reasons). Perhaps SSH 
X forwarding would be a better alternative. (Or nullfs mounts of /tmp)
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><a href="https://github.com/tredly/tredly/releases/tag/v1.0.0-rc.1" rel="nofollow">Tredly - V1 Release Candidate</a></li>
<li><a href="http://lists.freebsd.org/pipermail/freebsd-current/2016-June/061775.html" rel="nofollow">Call for Testing - ypldap testing against OpenLDAP and Microsoft Active 
Directory</a> </li>
<li><a href="https://bsdmag.org/" rel="nofollow">BSD Magazine, June 2016 Out Now</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-June/500610.html" rel="nofollow">Hammer2 - Add xxhash to H2 and throw in debug stuff for performance 
testing</a> </li>
<li><a href="http://justinholcomb.me/blog/2016/06/14/chyves-project-preannouncement.html" rel="nofollow">chyves pre-announcement</a> 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/1hpGrmuL" rel="nofollow"> Michael - Versioning </a> </li>
<li><a href="http://pastebin.com/2PkrMGGx" rel="nofollow"> Michael - Removing Encryption </a> </li>
<li><a href="http://pastebin.com/q5VdmNxG" rel="nofollow"> Bostjan - PC-BSD Questions</a> </li>
<li><a href="http://pastebin.com/2aedLV7d" rel="nofollow"> Fong - ZFS Rollback </a> </li>
<li><a href="http://pastebin.com/dneVZkXc" rel="nofollow"> Jochen - Docker on FBSD</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>146: Music to Beastie’s ears</title>
  <link>https://www.bsdnow.tv/146</link>
  <guid isPermaLink="false">65789003-28e4-49f2-83a2-80f129d71d0d</guid>
  <pubDate>Thu, 16 Jun 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/65789003-28e4-49f2-83a2-80f129d71d0d.mp3" length="46132564" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Kris is on vacation this week, so allan flies solo, provides a recap of BSDCan &amp; cover's a boatload of news including Microsoft</itunes:subtitle>
  <itunes:duration>1:04:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Kris is on vacation this week, so allan flies solo, provides a recap of BSDCan &amp;amp; cover's a boatload of news including Microsoft
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
BSDCan Recap and Live Stream Videos (http://www.bsdcan.org/2016/)
OpenBSD BSDCan 2016 papers now available (http://www.openbsd.org/papers)
Allan’s slides  (http://allanjude.com/bsd/BSDCan2016_-_GELIBoot.pdf) and Paper  (http://allanjude.com/bsd/AsiaBSDCon2016_geliboot_pdf1a.pdf)
Michael W Lucas presents Allan with a gift  (https://www.youtube.com/watch?v=LFgxAHkrSTg)
“FreeBSD Mastery: Advanced ZedFS”  (http://blather.michaelwlucas.com/archives/2698)
Highlighted Tweets:
Groff Arrives at BSDCan  (https://twitter.com/Keltounet/status/740344735194320896)
FreeBSD Foundation recognizes the contributions of Bryan Drewery, Rod Grimes, Warren Block, &amp;amp; Gleb Smirnoff  (https://twitter.com/freebsdfndation/status/742456950676393984)
A moment of silence and shots in memory in Benjamin Perrault @creepingfur  (https://twitter.com/__briancallahan/status/741854476340858880)
@gvnn3 sells the FreeBSD Foundation shirt off of his back for Charity  (https://twitter.com/Keltounet/status/741763867471155201)
Michael W. Lucas asks Matt Ahrens how to pronounce ZFS, “You can pronounce ZFS however you like, but if you pronounce it 'reiserfs', people might be confused.”  (https://twitter.com/cperciva/status/741375414967410688)
Sysadmin T-Shirt  (https://twitter.com/BSDCan/status/741420633007874050)
FreeBSD Dev Summit ran out of room on the chalkboards listing accomplishments of 11.0  (https://twitter.com/SeanChittenden/status/740904105388978176)
List of things people have or want for FreeBSD 12  (https://twitter.com/Keltounet/status/740928627471159296)
Matt Ahrens signing Allan’s ZFS book  (https://twitter.com/kprovst/status/741322268480049152?cn=bWVudGlvbg%3D%3D&amp;amp;refsrc=email)
FreeBSD’s new marketing strategy  (https://twitter.com/cperciva/status/741707948469157889)
Charity Auction: systemd whoopie cushion  (https://twitter.com/HippyWizard/status/741768670704066560)
Embarass OpenBSD’s @HenningBrauer by donating $10 to charity for a selfie with him wearing a Linux t-shirt  (https://twitter.com/juliefriday/status/741948048788586496)
@GroffTheBSDGoat changes handlers, from @HenningBrauer to @GavinAtkinson  (https://twitter.com/GroffTheBSDGoat/status/742415390798716928)
Day 1 Video  (https://www.youtube.com/watch?v=AOidjSS7Hsg)
Day 2 Video  (https://www.youtube.com/watch?v=z7pDnBO5wSM)
Allan’s GELIBoot talk (day 2)  (https://www.youtube.com/watch?v=z7pDnBO5wSM&amp;amp;feature=youtu.be&amp;amp;list=PLeF8ZihVdpFfoEV67dBSrKfA8ifpUr6qC&amp;amp;t=4440)
***
Media Coverage of Microsoft + FreeBSD story (https://azure.microsoft.com/en-us/blog/freebsd-now-available-in-azure-marketplace/)
Microsoft has released their own custom image of FreeBSD 10.3 for the Azure Cloud
“This means that not only can you quickly bring-up a FreeBSD VM in Azure, but also that in the event you need technical support, Microsoft support engineers can assist.”
“Microsoft is the publisher of the FreeBSD image in the marketplace rather than the FreeBSD Foundation. The FreeBSD Foundation is supported by donations from the FreeBSD community, including companies that build their solutions on FreeBSD. They are not a solution provider or an ISV with a support organization but rather rely on a very active community that support one another. In order to ensure our customers have an enterprise SLA for their FreeBSD VMs running in Azure, we took on the work of building, testing, releasing and maintaining the image in order to remove that burden from the Foundation. We will continue to partner closely with the Foundation as we make further investments in FreeBSD on Hyper-V and in Azure.”
"It's quite a significant milestone for FreeBSD community and for Microsoft to publish a supported FreeBSD image on Azure Marketplace. We really appreciate Microsoft's commitment and investment in FreeBSD project". - Justin T. Gibbs, President of FreeBSD Foundation
Microsoft took a FreeBSD 10.3-RELEASE image and added additional patches, most of which they have upstreamed but that were too late for the regular 10.3 release cycle.
Rather than requiring users to use a snapshot of the stable/10 branch, which would complicate the user experience, and complicate the job of the Microsoft support engineers, they created their own “certified” release
This allows Microsoft to selectively deploy errata fixes to the image as well
It is not clear how this affects update mechanisms like freebsd-update(8)
The Register  (http://www.theregister.co.uk/2016/06/09/microsoft_freebsd/)
The Inquirer  (http://www.theinquirer.net/inquirer/news/2461070/microsoft-creates-own-distribution-of-freebsd-for-azure-developers)
Infoworld  (http://www.infoworld.com/article/3082090/open-source-tools/is-microsoft-publishing-its-own-freebsd-yes-and-no.html)
The Hacker News  (http://thehackernews.com/2016/06/microsoft-azure-freebsd.html)
Windows Report  (http://windowsreport.com/microsoft-freebsd-10-3-ready-made-vm-image-azure/)
Windows Club  (http://news.thewindowsclub.com/microsoft-freebsd-operating-system-84375/)
***
Select works poorly (http://www.tedunangst.com/flak/post/select-works-poorly)
“At the bottom of the OpenBSD man page for select is a little note. “Internally to the kernel, select() and pselect() work poorly if multiple processes wait on the same file descriptor.” There’s a similar warning in the poll man page. Where does this warning come from and what does it mean?”
Ted found that at first glance, OpenBSD’s select() appears to be quite bad:
“whenever some data gets written, we call wakeup(&amp;amp;selwait);. Based on what we’ve seen so far, one can conclude that this is likely to be inefficient. Every time any socket has some data available, we wake up every selecting process in the system. Works poorly indeed.”
After further investigation, it turns out to not be quite as bad
When the select() is first setup, the PID of the process that cares about the FD is recorded in the selinfo struct
If a second process runs select() on the same FD, the SI_COLL (Select Collision) flag is set on the selinfo struct
When selwakeup() is called, if SI_COLL is set, all select()ing processes are woken up, and the sysctl kern.nselcoll is incremented. If the flag is not set, and only a single PID is waiting for activity on that FD, only that process is woken up
“This is not an intractable problem. kevent avoids it entirely. Other implementations may too. But practically, does it need to be solved? My laptop says it’s happened 43 times. A server with substantially more uptime says 0. Doesn’t seem so bad.”
***
Interview - Hans Petter Selasky - hps@freebsd.org (mailto:hps@freebsd.org) / @twitter (https://twitter.com/user)
Designing FreeBSD’s USB drivers, hooking up a piano to FreeBSD &amp;amp; more!
***
News Roundup
Timeline of libexpat random vulnerability (http://www.tedunangst.com/flak/post/timeline-of-libexpat-random-vulnerability)
Do you use FreeBSD as web server? Why or why not? (https://news.ycombinator.com/item?id=11804565)
20 years of NetBSD code Bloat (http://kristerw.blogspot.sg/2016/05/20-years-of-netbsd-code-bloat.html)
HP Chromebook 13 now booting OpenBSD (https://jcs.org/statuses/2016/06/08/740606952149942272/)
UNIX for Poets  (https://web.stanford.edu/class/cs124/lec/124-UnixForPoets.pdf)
Comparing live version upgrade methods (https://distrowatch.com/weekly.php?issue=20160530#upgrades)
My life with FreeBSD on a Thinkpad X220 (https://www.reddit.com/r/BSD/comments/4n3flx/my_life_with_freebsd_on_a_thinkpad_x220/)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Kris is on vacation this week, so allan flies solo, provides a recap of BSDCan &amp; cover&#39;s a boatload of news including Microsoft</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.bsdcan.org/2016/" rel="nofollow">BSDCan Recap and Live Stream Videos</a></h3>

<ul>
<li><a href="http://www.openbsd.org/papers" rel="nofollow">OpenBSD BSDCan 2016 papers now available</a></li>
<li><a href="http://allanjude.com/bsd/BSDCan2016_-_GELIBoot.pdf" rel="nofollow">Allan’s slides </a> <a href="http://allanjude.com/bsd/AsiaBSDCon2016_geliboot_pdf1a.pdf" rel="nofollow">and Paper </a></li>
<li><a href="https://www.youtube.com/watch?v=LFgxAHkrSTg" rel="nofollow">Michael W Lucas presents Allan with a gift </a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2698" rel="nofollow">“FreeBSD Mastery: Advanced ZedFS” </a></li>
<li>Highlighted Tweets:

<ul>
<li><a href="https://twitter.com/Keltounet/status/740344735194320896" rel="nofollow">Groff Arrives at BSDCan </a></li>
<li><a href="https://twitter.com/freebsdfndation/status/742456950676393984" rel="nofollow">FreeBSD Foundation recognizes the contributions of Bryan Drewery, Rod Grimes, Warren Block, &amp; Gleb Smirnoff </a></li>
<li><a href="https://twitter.com/__briancallahan/status/741854476340858880" rel="nofollow">A moment of silence and shots in memory in Benjamin Perrault @creepingfur </a></li>
<li><a href="https://twitter.com/Keltounet/status/741763867471155201" rel="nofollow">@gvnn3 sells the FreeBSD Foundation shirt off of his back for Charity </a></li>
<li><a href="https://twitter.com/cperciva/status/741375414967410688" rel="nofollow">Michael W. Lucas asks Matt Ahrens how to pronounce ZFS, “You can pronounce ZFS however you like, but if you pronounce it &#39;reiserfs&#39;, people might be confused.” </a></li>
<li><a href="https://twitter.com/BSDCan/status/741420633007874050" rel="nofollow">Sysadmin T-Shirt </a></li>
<li><a href="https://twitter.com/SeanChittenden/status/740904105388978176" rel="nofollow">FreeBSD Dev Summit ran out of room on the chalkboards listing accomplishments of 11.0 </a></li>
<li><a href="https://twitter.com/Keltounet/status/740928627471159296" rel="nofollow">List of things people have or want for FreeBSD 12 </a></li>
<li><a href="https://twitter.com/kprovst/status/741322268480049152?cn=bWVudGlvbg%3D%3D&refsrc=email" rel="nofollow">Matt Ahrens signing Allan’s ZFS book </a></li>
<li><a href="https://twitter.com/cperciva/status/741707948469157889" rel="nofollow">FreeBSD’s new marketing strategy </a></li>
<li><a href="https://twitter.com/HippyWizard/status/741768670704066560" rel="nofollow">Charity Auction: systemd whoopie cushion </a></li>
<li><a href="https://twitter.com/juliefriday/status/741948048788586496" rel="nofollow">Embarass OpenBSD’s @HenningBrauer by donating $10 to charity for a selfie with him wearing a Linux t-shirt </a></li>
<li><a href="https://twitter.com/GroffTheBSDGoat/status/742415390798716928" rel="nofollow">@GroffTheBSDGoat changes handlers, from @HenningBrauer to @GavinAtkinson </a></li>
</ul></li>
<li><a href="https://www.youtube.com/watch?v=AOidjSS7Hsg" rel="nofollow">Day 1 Video </a></li>
<li><a href="https://www.youtube.com/watch?v=z7pDnBO5wSM" rel="nofollow">Day 2 Video </a></li>
<li><a href="https://www.youtube.com/watch?v=z7pDnBO5wSM&feature=youtu.be&list=PLeF8ZihVdpFfoEV67dBSrKfA8ifpUr6qC&t=4440" rel="nofollow">Allan’s GELIBoot talk (day 2) </a>
***</li>
</ul>

<h3><a href="https://azure.microsoft.com/en-us/blog/freebsd-now-available-in-azure-marketplace/" rel="nofollow">Media Coverage of Microsoft + FreeBSD story</a></h3>

<ul>
<li>Microsoft has released their own custom image of FreeBSD 10.3 for the Azure Cloud</li>
<li>“This means that not only can you quickly bring-up a FreeBSD VM in Azure, but also that in the event you need technical support, Microsoft support engineers can assist.”</li>
<li>“Microsoft is the publisher of the FreeBSD image in the marketplace rather than the FreeBSD Foundation. The FreeBSD Foundation is supported by donations from the FreeBSD community, including companies that build their solutions on FreeBSD. They are not a solution provider or an ISV with a support organization but rather rely on a very active community that support one another. In order to ensure our customers have an enterprise SLA for their FreeBSD VMs running in Azure, we took on the work of building, testing, releasing and maintaining the image in order to remove that burden from the Foundation. We will continue to partner closely with the Foundation as we make further investments in FreeBSD on Hyper-V and in Azure.”</li>
<li>&quot;It&#39;s quite a significant milestone for FreeBSD community and for Microsoft to publish a supported FreeBSD image on Azure Marketplace. We really appreciate Microsoft&#39;s commitment and investment in FreeBSD project&quot;. - Justin T. Gibbs, President of FreeBSD Foundation</li>
<li>Microsoft took a FreeBSD 10.3-RELEASE image and added additional patches, most of which they have upstreamed but that were too late for the regular 10.3 release cycle.</li>
<li>Rather than requiring users to use a snapshot of the stable/10 branch, which would complicate the user experience, and complicate the job of the Microsoft support engineers, they created their own “certified” release</li>
<li>This allows Microsoft to selectively deploy errata fixes to the image as well</li>
<li>It is not clear how this affects update mechanisms like freebsd-update(8)</li>
<li><a href="http://www.theregister.co.uk/2016/06/09/microsoft_freebsd/" rel="nofollow">The Register </a></li>
<li><a href="http://www.theinquirer.net/inquirer/news/2461070/microsoft-creates-own-distribution-of-freebsd-for-azure-developers" rel="nofollow">The Inquirer </a></li>
<li><a href="http://www.infoworld.com/article/3082090/open-source-tools/is-microsoft-publishing-its-own-freebsd-yes-and-no.html" rel="nofollow">Infoworld </a></li>
<li><a href="http://thehackernews.com/2016/06/microsoft-azure-freebsd.html" rel="nofollow">The Hacker News </a></li>
<li><a href="http://windowsreport.com/microsoft-freebsd-10-3-ready-made-vm-image-azure/" rel="nofollow">Windows Report </a></li>
<li><a href="http://news.thewindowsclub.com/microsoft-freebsd-operating-system-84375/" rel="nofollow">Windows Club </a>
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/select-works-poorly" rel="nofollow">Select works poorly</a></h3>

<ul>
<li>“At the bottom of the OpenBSD man page for select is a little note. “Internally to the kernel, select() and pselect() work poorly if multiple processes wait on the same file descriptor.” There’s a similar warning in the poll man page. Where does this warning come from and what does it mean?”</li>
<li>Ted found that at first glance, OpenBSD’s select() appears to be quite bad:</li>
<li>“whenever some data gets written, we call wakeup(&amp;selwait);. Based on what we’ve seen so far, one can conclude that this is likely to be inefficient. Every time any socket has some data available, we wake up every selecting process in the system. Works poorly indeed.”</li>
<li>After further investigation, it turns out to not be quite as bad</li>
<li>When the select() is first setup, the PID of the process that cares about the FD is recorded in the selinfo struct</li>
<li>If a second process runs select() on the same FD, the SI_COLL (Select Collision) flag is set on the selinfo struct</li>
<li>When selwakeup() is called, if SI_COLL is set, all select()ing processes are woken up, and the sysctl kern.nselcoll is incremented. If the flag is not set, and only a single PID is waiting for activity on that FD, only that process is woken up</li>
<li>“This is not an intractable problem. kevent avoids it entirely. Other implementations may too. But practically, does it need to be solved? My laptop says it’s happened 43 times. A server with substantially more uptime says 0. Doesn’t seem so bad.”
***</li>
</ul>

<h2>Interview - Hans Petter Selasky - <a href="mailto:hps@freebsd.org" rel="nofollow">hps@freebsd.org</a> / <a href="https://twitter.com/user" rel="nofollow">@twitter</a></h2>

<ul>
<li>Designing FreeBSD’s USB drivers, hooking up a piano to FreeBSD &amp; more!
***</li>
</ul>

<h2>News Roundup</h2>

<ul>
<li><p><a href="http://www.tedunangst.com/flak/post/timeline-of-libexpat-random-vulnerability" rel="nofollow">Timeline of libexpat random vulnerability</a></p></li>
<li><p><a href="https://news.ycombinator.com/item?id=11804565" rel="nofollow">Do you use FreeBSD as web server? Why or why not?</a></p></li>
<li><p><a href="http://kristerw.blogspot.sg/2016/05/20-years-of-netbsd-code-bloat.html" rel="nofollow">20 years of NetBSD code Bloat</a></p></li>
<li><p><a href="https://jcs.org/statuses/2016/06/08/740606952149942272/" rel="nofollow">HP Chromebook 13 now booting OpenBSD</a></p></li>
<li><p><a href="https://web.stanford.edu/class/cs124/lec/124-UnixForPoets.pdf" rel="nofollow">UNIX for Poets </a></p></li>
<li><p><a href="https://distrowatch.com/weekly.php?issue=20160530#upgrades" rel="nofollow">Comparing live version upgrade methods</a></p></li>
<li><p><a href="https://www.reddit.com/r/BSD/comments/4n3flx/my_life_with_freebsd_on_a_thinkpad_x220/" rel="nofollow">My life with FreeBSD on a Thinkpad X220</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Kris is on vacation this week, so allan flies solo, provides a recap of BSDCan &amp; cover&#39;s a boatload of news including Microsoft</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.bsdcan.org/2016/" rel="nofollow">BSDCan Recap and Live Stream Videos</a></h3>

<ul>
<li><a href="http://www.openbsd.org/papers" rel="nofollow">OpenBSD BSDCan 2016 papers now available</a></li>
<li><a href="http://allanjude.com/bsd/BSDCan2016_-_GELIBoot.pdf" rel="nofollow">Allan’s slides </a> <a href="http://allanjude.com/bsd/AsiaBSDCon2016_geliboot_pdf1a.pdf" rel="nofollow">and Paper </a></li>
<li><a href="https://www.youtube.com/watch?v=LFgxAHkrSTg" rel="nofollow">Michael W Lucas presents Allan with a gift </a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2698" rel="nofollow">“FreeBSD Mastery: Advanced ZedFS” </a></li>
<li>Highlighted Tweets:

<ul>
<li><a href="https://twitter.com/Keltounet/status/740344735194320896" rel="nofollow">Groff Arrives at BSDCan </a></li>
<li><a href="https://twitter.com/freebsdfndation/status/742456950676393984" rel="nofollow">FreeBSD Foundation recognizes the contributions of Bryan Drewery, Rod Grimes, Warren Block, &amp; Gleb Smirnoff </a></li>
<li><a href="https://twitter.com/__briancallahan/status/741854476340858880" rel="nofollow">A moment of silence and shots in memory in Benjamin Perrault @creepingfur </a></li>
<li><a href="https://twitter.com/Keltounet/status/741763867471155201" rel="nofollow">@gvnn3 sells the FreeBSD Foundation shirt off of his back for Charity </a></li>
<li><a href="https://twitter.com/cperciva/status/741375414967410688" rel="nofollow">Michael W. Lucas asks Matt Ahrens how to pronounce ZFS, “You can pronounce ZFS however you like, but if you pronounce it &#39;reiserfs&#39;, people might be confused.” </a></li>
<li><a href="https://twitter.com/BSDCan/status/741420633007874050" rel="nofollow">Sysadmin T-Shirt </a></li>
<li><a href="https://twitter.com/SeanChittenden/status/740904105388978176" rel="nofollow">FreeBSD Dev Summit ran out of room on the chalkboards listing accomplishments of 11.0 </a></li>
<li><a href="https://twitter.com/Keltounet/status/740928627471159296" rel="nofollow">List of things people have or want for FreeBSD 12 </a></li>
<li><a href="https://twitter.com/kprovst/status/741322268480049152?cn=bWVudGlvbg%3D%3D&refsrc=email" rel="nofollow">Matt Ahrens signing Allan’s ZFS book </a></li>
<li><a href="https://twitter.com/cperciva/status/741707948469157889" rel="nofollow">FreeBSD’s new marketing strategy </a></li>
<li><a href="https://twitter.com/HippyWizard/status/741768670704066560" rel="nofollow">Charity Auction: systemd whoopie cushion </a></li>
<li><a href="https://twitter.com/juliefriday/status/741948048788586496" rel="nofollow">Embarass OpenBSD’s @HenningBrauer by donating $10 to charity for a selfie with him wearing a Linux t-shirt </a></li>
<li><a href="https://twitter.com/GroffTheBSDGoat/status/742415390798716928" rel="nofollow">@GroffTheBSDGoat changes handlers, from @HenningBrauer to @GavinAtkinson </a></li>
</ul></li>
<li><a href="https://www.youtube.com/watch?v=AOidjSS7Hsg" rel="nofollow">Day 1 Video </a></li>
<li><a href="https://www.youtube.com/watch?v=z7pDnBO5wSM" rel="nofollow">Day 2 Video </a></li>
<li><a href="https://www.youtube.com/watch?v=z7pDnBO5wSM&feature=youtu.be&list=PLeF8ZihVdpFfoEV67dBSrKfA8ifpUr6qC&t=4440" rel="nofollow">Allan’s GELIBoot talk (day 2) </a>
***</li>
</ul>

<h3><a href="https://azure.microsoft.com/en-us/blog/freebsd-now-available-in-azure-marketplace/" rel="nofollow">Media Coverage of Microsoft + FreeBSD story</a></h3>

<ul>
<li>Microsoft has released their own custom image of FreeBSD 10.3 for the Azure Cloud</li>
<li>“This means that not only can you quickly bring-up a FreeBSD VM in Azure, but also that in the event you need technical support, Microsoft support engineers can assist.”</li>
<li>“Microsoft is the publisher of the FreeBSD image in the marketplace rather than the FreeBSD Foundation. The FreeBSD Foundation is supported by donations from the FreeBSD community, including companies that build their solutions on FreeBSD. They are not a solution provider or an ISV with a support organization but rather rely on a very active community that support one another. In order to ensure our customers have an enterprise SLA for their FreeBSD VMs running in Azure, we took on the work of building, testing, releasing and maintaining the image in order to remove that burden from the Foundation. We will continue to partner closely with the Foundation as we make further investments in FreeBSD on Hyper-V and in Azure.”</li>
<li>&quot;It&#39;s quite a significant milestone for FreeBSD community and for Microsoft to publish a supported FreeBSD image on Azure Marketplace. We really appreciate Microsoft&#39;s commitment and investment in FreeBSD project&quot;. - Justin T. Gibbs, President of FreeBSD Foundation</li>
<li>Microsoft took a FreeBSD 10.3-RELEASE image and added additional patches, most of which they have upstreamed but that were too late for the regular 10.3 release cycle.</li>
<li>Rather than requiring users to use a snapshot of the stable/10 branch, which would complicate the user experience, and complicate the job of the Microsoft support engineers, they created their own “certified” release</li>
<li>This allows Microsoft to selectively deploy errata fixes to the image as well</li>
<li>It is not clear how this affects update mechanisms like freebsd-update(8)</li>
<li><a href="http://www.theregister.co.uk/2016/06/09/microsoft_freebsd/" rel="nofollow">The Register </a></li>
<li><a href="http://www.theinquirer.net/inquirer/news/2461070/microsoft-creates-own-distribution-of-freebsd-for-azure-developers" rel="nofollow">The Inquirer </a></li>
<li><a href="http://www.infoworld.com/article/3082090/open-source-tools/is-microsoft-publishing-its-own-freebsd-yes-and-no.html" rel="nofollow">Infoworld </a></li>
<li><a href="http://thehackernews.com/2016/06/microsoft-azure-freebsd.html" rel="nofollow">The Hacker News </a></li>
<li><a href="http://windowsreport.com/microsoft-freebsd-10-3-ready-made-vm-image-azure/" rel="nofollow">Windows Report </a></li>
<li><a href="http://news.thewindowsclub.com/microsoft-freebsd-operating-system-84375/" rel="nofollow">Windows Club </a>
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/select-works-poorly" rel="nofollow">Select works poorly</a></h3>

<ul>
<li>“At the bottom of the OpenBSD man page for select is a little note. “Internally to the kernel, select() and pselect() work poorly if multiple processes wait on the same file descriptor.” There’s a similar warning in the poll man page. Where does this warning come from and what does it mean?”</li>
<li>Ted found that at first glance, OpenBSD’s select() appears to be quite bad:</li>
<li>“whenever some data gets written, we call wakeup(&amp;selwait);. Based on what we’ve seen so far, one can conclude that this is likely to be inefficient. Every time any socket has some data available, we wake up every selecting process in the system. Works poorly indeed.”</li>
<li>After further investigation, it turns out to not be quite as bad</li>
<li>When the select() is first setup, the PID of the process that cares about the FD is recorded in the selinfo struct</li>
<li>If a second process runs select() on the same FD, the SI_COLL (Select Collision) flag is set on the selinfo struct</li>
<li>When selwakeup() is called, if SI_COLL is set, all select()ing processes are woken up, and the sysctl kern.nselcoll is incremented. If the flag is not set, and only a single PID is waiting for activity on that FD, only that process is woken up</li>
<li>“This is not an intractable problem. kevent avoids it entirely. Other implementations may too. But practically, does it need to be solved? My laptop says it’s happened 43 times. A server with substantially more uptime says 0. Doesn’t seem so bad.”
***</li>
</ul>

<h2>Interview - Hans Petter Selasky - <a href="mailto:hps@freebsd.org" rel="nofollow">hps@freebsd.org</a> / <a href="https://twitter.com/user" rel="nofollow">@twitter</a></h2>

<ul>
<li>Designing FreeBSD’s USB drivers, hooking up a piano to FreeBSD &amp; more!
***</li>
</ul>

<h2>News Roundup</h2>

<ul>
<li><p><a href="http://www.tedunangst.com/flak/post/timeline-of-libexpat-random-vulnerability" rel="nofollow">Timeline of libexpat random vulnerability</a></p></li>
<li><p><a href="https://news.ycombinator.com/item?id=11804565" rel="nofollow">Do you use FreeBSD as web server? Why or why not?</a></p></li>
<li><p><a href="http://kristerw.blogspot.sg/2016/05/20-years-of-netbsd-code-bloat.html" rel="nofollow">20 years of NetBSD code Bloat</a></p></li>
<li><p><a href="https://jcs.org/statuses/2016/06/08/740606952149942272/" rel="nofollow">HP Chromebook 13 now booting OpenBSD</a></p></li>
<li><p><a href="https://web.stanford.edu/class/cs124/lec/124-UnixForPoets.pdf" rel="nofollow">UNIX for Poets </a></p></li>
<li><p><a href="https://distrowatch.com/weekly.php?issue=20160530#upgrades" rel="nofollow">Comparing live version upgrade methods</a></p></li>
<li><p><a href="https://www.reddit.com/r/BSD/comments/4n3flx/my_life_with_freebsd_on_a_thinkpad_x220/" rel="nofollow">My life with FreeBSD on a Thinkpad X220</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>145: At the Core of it all</title>
  <link>https://www.bsdnow.tv/145</link>
  <guid isPermaLink="false">95c07cb8-0807-4cdc-bd2f-80c2a089f669</guid>
  <pubDate>Wed, 08 Jun 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/95c07cb8-0807-4cdc-bd2f-80c2a089f669.mp3" length="51492820" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>It’s BSDCan time! Allan and I are both enjoying what is sure to be a super-busy week, but don’t think we’ve forgotten about</itunes:subtitle>
  <itunes:duration>1:11:31</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>It’s BSDCan time! Allan and I are both enjoying what is sure to be a super-busy week, but don’t think we’ve forgotten about
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and 
Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Interview - Benno Rice - benno@freebsd.org (mailto:benno@freebsd.org) / @jeamland (https://twitter.com/jeamland)
Manager, OS &amp;amp; Networking at EMC Isilon
Emily Dunham: Community Automation  (https://www.youtube.com/watch?v=dIageYT0Vgg)
iXsystems
1U Rackmount Server - 4 Bay Hot-Swap SAS/SATA Drive Bays 400W Redundant Power Supply  -  Single Socket Embedded CPU (48 cores) - 8 DIMM Slots with 
16GB DIMMs for a total of 128GB RAM – Dual Gigabit LAN, Dual 10GbE SFP+ and 1 x 40Gb QSFP+ port, (1) PCI-E Expansion Slots + IPMI Dedicated LAN - 
Cavium ThunderX ARM CN8890 48 Core ThunderX CPU - 2.5GHz per core
System has 128GB RAM, 4 x 2TB SATA HDD, Additional Intel i350 (2 x 1GbE) 
Beastie Bits
file considered harmful (http://www.tedunangst.com/flak/post/file-considered-harmful)
An open source talk on ZFS. “Intro to ZFS” as a set of open source slides for the community to build on, and to reuse. Go give this talk at your local conference.  (https://github.com/problame/talkintrozfs2016) 
ARMv7 now has a bootloader (http://undeadly.org/cgi?action=article&amp;amp;sid=20160529145411) 
SHA256/512 speed improvements in FreeBSD 11  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=300966)
pkgsrc 50th release interviews - Joerg Sonnenberg (http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interview_with)
DFly versus PC-BSD on a Laptop (http://lists.dragonflybsd.org/pipermail/users/2016-May/249636.html) 
FreeBSD ifconfig can print subnet masks in CIDR or dotted-quad, finally  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=301059) 
Feedback/Questions
 Eli - Getting rid of ports? (http://pastebin.com/4Y6VYSyN)
 Morgan - Best way to admin jails? (http://pastebin.com/w8hsMtbc)
 Simon - Use existing pkgs in poudriere (http://pastebin.com/mqSJk0pP)
 Pete - Lots of Q’s (http://pastebin.com/1M7HLAXs)
 Van - Made the switch (http://pastebin.com/NTVBvtC5) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>It’s BSDCan time! Allan and I are both enjoying what is sure to be a super-busy week, but don’t think we’ve forgotten about</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Benno Rice - <a href="mailto:benno@freebsd.org" rel="nofollow">benno@freebsd.org</a> / <a href="https://twitter.com/jeamland" rel="nofollow">@jeamland</a></h2>

<ul>
<li><p>Manager, OS &amp; Networking at EMC Isilon</p></li>
<li><p><a href="https://www.youtube.com/watch?v=dIageYT0Vgg" rel="nofollow">Emily Dunham: Community Automation </a></p>

<hr></li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><p>1U Rackmount Server - 4 Bay Hot-Swap SAS/SATA Drive Bays 400W Redundant Power Supply  -  Single Socket Embedded CPU (48 cores) - 8 DIMM Slots with <br>
16GB DIMMs for a total of 128GB RAM – Dual Gigabit LAN, Dual 10GbE SFP+ and 1 x 40Gb QSFP+ port, (1) PCI-E Expansion Slots + IPMI Dedicated LAN - <br>
Cavium ThunderX ARM CN8890 48 Core ThunderX CPU - 2.5GHz per core</p></li>
<li><p>System has 128GB RAM, 4 x 2TB SATA HDD, Additional Intel i350 (2 x 1GbE) </p>

<hr></li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://www.tedunangst.com/flak/post/file-considered-harmful" rel="nofollow">file considered harmful</a></p></li>
<li><p><a href="https://github.com/problame/talkintrozfs2016" rel="nofollow">An open source talk on ZFS. “Intro to ZFS” as a set of open source slides for the community to build on, and to reuse. Go give this talk at your local conference. </a> </p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20160529145411" rel="nofollow">ARMv7 now has a bootloader</a> </p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=300966" rel="nofollow">SHA256/512 speed improvements in FreeBSD 11 </a></p></li>
<li><p><a href="http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interview_with" rel="nofollow">pkgsrc 50th release interviews - Joerg Sonnenberg</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-May/249636.html" rel="nofollow">DFly versus PC-BSD on a Laptop</a> </p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=301059" rel="nofollow">FreeBSD ifconfig can print subnet masks in CIDR or dotted-quad, finally </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/4Y6VYSyN" rel="nofollow"> Eli - Getting rid of ports?</a></li>
<li><a href="http://pastebin.com/w8hsMtbc" rel="nofollow"> Morgan - Best way to admin jails?</a></li>
<li><a href="http://pastebin.com/mqSJk0pP" rel="nofollow"> Simon - Use existing pkgs in poudriere</a></li>
<li><a href="http://pastebin.com/1M7HLAXs" rel="nofollow"> Pete - Lots of Q’s</a></li>
<li><a href="http://pastebin.com/NTVBvtC5" rel="nofollow"> Van - Made the switch</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>It’s BSDCan time! Allan and I are both enjoying what is sure to be a super-busy week, but don’t think we’ve forgotten about</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and <br>
Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" <br>
alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Benno Rice - <a href="mailto:benno@freebsd.org" rel="nofollow">benno@freebsd.org</a> / <a href="https://twitter.com/jeamland" rel="nofollow">@jeamland</a></h2>

<ul>
<li><p>Manager, OS &amp; Networking at EMC Isilon</p></li>
<li><p><a href="https://www.youtube.com/watch?v=dIageYT0Vgg" rel="nofollow">Emily Dunham: Community Automation </a></p>

<hr></li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><p>1U Rackmount Server - 4 Bay Hot-Swap SAS/SATA Drive Bays 400W Redundant Power Supply  -  Single Socket Embedded CPU (48 cores) - 8 DIMM Slots with <br>
16GB DIMMs for a total of 128GB RAM – Dual Gigabit LAN, Dual 10GbE SFP+ and 1 x 40Gb QSFP+ port, (1) PCI-E Expansion Slots + IPMI Dedicated LAN - <br>
Cavium ThunderX ARM CN8890 48 Core ThunderX CPU - 2.5GHz per core</p></li>
<li><p>System has 128GB RAM, 4 x 2TB SATA HDD, Additional Intel i350 (2 x 1GbE) </p>

<hr></li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://www.tedunangst.com/flak/post/file-considered-harmful" rel="nofollow">file considered harmful</a></p></li>
<li><p><a href="https://github.com/problame/talkintrozfs2016" rel="nofollow">An open source talk on ZFS. “Intro to ZFS” as a set of open source slides for the community to build on, and to reuse. Go give this talk at your local conference. </a> </p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20160529145411" rel="nofollow">ARMv7 now has a bootloader</a> </p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=300966" rel="nofollow">SHA256/512 speed improvements in FreeBSD 11 </a></p></li>
<li><p><a href="http://blog.netbsd.org/tnf/entry/pkgsrc_50th_release_interview_with" rel="nofollow">pkgsrc 50th release interviews - Joerg Sonnenberg</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-May/249636.html" rel="nofollow">DFly versus PC-BSD on a Laptop</a> </p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=301059" rel="nofollow">FreeBSD ifconfig can print subnet masks in CIDR or dotted-quad, finally </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/4Y6VYSyN" rel="nofollow"> Eli - Getting rid of ports?</a></li>
<li><a href="http://pastebin.com/w8hsMtbc" rel="nofollow"> Morgan - Best way to admin jails?</a></li>
<li><a href="http://pastebin.com/mqSJk0pP" rel="nofollow"> Simon - Use existing pkgs in poudriere</a></li>
<li><a href="http://pastebin.com/1M7HLAXs" rel="nofollow"> Pete - Lots of Q’s</a></li>
<li><a href="http://pastebin.com/NTVBvtC5" rel="nofollow"> Van - Made the switch</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>144: The PF life</title>
  <link>https://www.bsdnow.tv/144</link>
  <guid isPermaLink="false">88258e16-7914-442e-9f73-ae58b6a26468</guid>
  <pubDate>Wed, 01 Jun 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/88258e16-7914-442e-9f73-ae58b6a26468.mp3" length="46038964" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>It’s only one-week away from BSDCan, both Allan and I are excited to meet some of you in person! However, the show keeps on</itunes:subtitle>
  <itunes:duration>1:03:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>It’s only one-week away from BSDCan, both Allan and I are excited to meet some of you in person! However, the show keeps on
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
dotSecurity 2016 - Theo de Raadt - Privilege Separation and Pledge (http://www.dotsecurity.io/)
Video (https://www.youtube.com/watch?v=a_EYdzGyNWs) 
Slides (https://www.openbsd.org/papers/dot2016.pdf) 
Interested in Privilege Separation and security in general? If so, then you are in for a treat, we have both the video and slides from Theo de Raadt at dotSecurity 2016.
Specifically the the talk starts off looking at Pledge (no copyright issues with the pictures I hope??) and how their NTP daemon uses it.
After going through some internals, Theo reveals that around 10% of programs “pledged” so far were found to be trying to do actions outside of their security scope.
On the future-work side, they mention going back and looking at OpenSSH privilege separation next, as well as working with other OS’s that may want pledge support.
***
bhyve now supports UEFI GOP (https://lists.freebsd.org/pipermail/freebsd-virtualization/2016-May/004471.html)
The log awaited UEFI GOP (Graphics Output Protocol (https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#GOP)) features has landed in bhyve
This provides emulated graphics via an internal VNC server, allowing users to have full graphical access to the guest OS
This allows installation of Windows guests without needing to create a modified ISO with an unattended installation script
The code has not actually landed in FreeBSD head yet, but has been committed to a project branch
Following a few simple commands, you can compile the new bhyve binary on your -CURRENT system and get started right away
This feature is expected to be included in the upcoming FreeBSD 11.0
This commit drop also brings with it:
XHCI -- an emulated usb tablet device that provides exact mouse positioning in supported OSs
PS2 mouse for fallback if the guest does not support XHCI (Windows 7)
PS2 keyboard
“The code has been tested with Windows 7/8/8.1/10 and Server 2k12/2k16, Ubuntu 15.10, and FreeBSD 10.3/11-CURRENT”
“For VNC clients, TightVNC, TigherVNC, and RealVNC (aka VNC Viewer) have been tested on various hosts. The OSX VNC client is known not to work.”
The VNC server supports an optional ‘wait’ parameter, that causes the VM to not actually boot until the VNC client connects, allowing you to interrupt the boot process if need be
Related user blog post  (http://justinholcomb.me/blog/2016/05/28/bhyve-uefi-gop-support.html)
SVN commit (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=300829)
***
zfsd lands in FreeBSD HEAD, in time for 11.0-RELEASE (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=300906)
zfsd has been committed to FreeBSD -CURRENT in time to be included in FreeBSD 11.0
zfsd is the missing piece required to make ‘hot spares’ work properly in FreeBSD ZFS
“zfsd attempts to resolve ZFS faults that the kernel can't resolve by itself. It listens to devctl(4) events, which is how the kernel notifies of events such as I/O errors and disk removals.  Zfsd attempts to resolve these faults by activating or deactivating hotspares and onlining offline vdevs.”
“The administrator never interacts with zfsd directly.  Instead, he controls its behavior indirectly through zpool configuration.  There are two ways to influence zfsd: assigning hotspares and setting pool properties.  Currently, only the autoreplace property has any effect.  See zpool(8) for details.”
So, what example does it do?
Device Removal: “When a leaf vdev disappears, zfsd will activate any available hotspare.”
Device Arrival: “When a new GEOM device appears, zfsd will attempt to read its ZFS label, if any.  If it matches a previously removed vdev on an active pool, zfsd will online it.  Once resilvering completes, any active hotspare will detach automatically.”
So if you disconnect a drive, then reconnect it, it will automatically be brought back online. Since ZFS is smart, the resilver will only have to copy data that has changed since the device went offline.
“If the new device has no ZFS label but its physical path matches the physical path of a previously removed vdev on an active pool, and that pool has the autoreplace property set, then zfsd will replace the missing vdev with the newly arrived device.  Once resilvering completes, any active hotspare will detach automatically.”
If the new drive is in the same slot in your hot swap array as a failed device, it will be used as a replacement immediately.
vdev degrade or fault events: “If a vdev becomes degraded or faulted, zfsd will activate any available hotspare. If a leaf vdev generates more than 50 I/O errors in a 60 second period, then zfsd will mark that vdev as FAULTED.  zfs(4) will no longer issue any I/Os to it.  zfsd will activate 
a hotspare if one is available.” Same for checksum errors.
So if zfsd detects a drive is going bad, it brings the hotspare online before it is too late
Spare addition: “If the system administrator adds a hotspare to a pool that is already degraded, zfsd will activate the spare.”
Resilver complete: “zfsd will detach any hotspare once a permanent replacement finishes resilvering.”
Physical path change: “If the physical path of an existing disk changes, zfsd will attempt to replace any missing disk with the same physical path, if its pool's autoreplace property is set.”
In general, this tool means less reliance on the system administrator to keep the pool healthy
***
W^X now mandatory in OpenBSD (http://undeadly.org/cgi?action=article&amp;amp;sid=20160527203200)
We’ve talked a bit about W^X in the past. (Refresher: Memory being writable and executable at once)
Well, this major security no-no is no-more on OpenBSD. Theo has committed a change which now prevents violations of this policy:
“W^X violations are no longer permitted by default.  A kernel log message is generated, and mprotect/mmap return ENOTSUP.  If the sysctl(8) flag kern.wxabort is set then a SIGABRT occurs instead, for gdb use or coredump creation.”
There are a few cases where you may still need W^X, which Theo points out can be enabled on a file-system basis.
“W^X violating programs can be permitted on a ffs/nfs filesystem-basis, using the "wxallowed" mount option.  One day far in the future upstream software developers will understand that W^X violations are a tremendously risky practice and that style of programming will be banished outright.  Until then, we recommend most users need to use the wxallowed option on their /usr/local filesystem.  At least your other filesystems don't permit such programs.”
This is a great ability to grow, since now users can begin doing auditing of programs that violate this principle and making noise to upstream.
***
Interview - Kristof Provost - kp@freebsd.org (mailto:kp@freebsd.org) @kprovst (https://twitter.com/kprovst)
pf improvements on FreeBSD
***
News Roundup
GELI Support for the EFI Loader  (https://ericmccorkleblog.wordpress.com/2016/05/28/freebsd-geli-support/)
We’ve had Allan’s work to bring GELI support to the GPT / BIOS / ZFS loader for a while now, but the missing piece has been support for EFI.
No longer, Eric McCorkle has posted a blog entry (with relevant github links) introducing us to his work to bring GELI encryption support to EFI.
First the bad-news. This won’t make it into 11.0. (Maybe PC-BSD, TBD)
Next he explains why this is more than just a new feature, but a re-factor of the EFI boot code:
I have already written extensively about my EFI refactoring here.  The reason for undertaking this effort, however, was driven by GELI support.  Early in my work on this, I had implemented a non-EFI “providers” framework in boot1 in order to support the notion of disk partitions that may contain sub-partitions.
This was deeply unsatisfying to me for several reasons:
It implemented a lot of the same functionality that exists in the EFI framework.
It involved implementing a GPT partition driver to deal with partition tables inside GELI partitions (GPT detection and support is guaranteed by the EFI spec).
The interface between the EFI framework and the custom “providers” framework was awkward.
The driver was completely boot1-specific, and exporting it to something like GRUB probably involved a total rewrite.
Implementing it within loader was going to involve a lot of code duplication.
There was no obvious was to pass keys between boot1, loader, and the kernel.
With the issues known, Eric seems pleased with the results of the conversion so far:
The GELI driver can be extracted from the FreeBSD codebase without too much trouble.
While I was unable to go all the way to the EFI driver model, the only blocker is the bcache code, and once that is resolved, we can have hotplug support in the boot loader!
The boot1 and loader codebases are now sharing all the backend drivers, and boot1 has been reduced to one very small source file.
An interesting read, looking forward to playing with EFI more in the future!
***
Faces of FreeBSD 2016: Michael W. Lucas (https://www.freebsdfoundation.org/blog/faces-of-freebsd-2016-michael-lucas/)
On this edition of “Faces of FreeBSD”, Michael W Lucas tells the story of how he got started with FreeBSD
After an amusing re-telling of his childhood (The words “Purina Monkey Chow” were mentioned), he then tells us how he got into BSD.
His being thrown into the project may sound familiar to many: 
I came in at 11 PM one night and was told “The DNS administrator just got walked out the door. You’re the new lead DNS administrator. Make those servers work. Good luck.”
From there (because he wanted more sleep), he began ripping out the systems that had been failing and waking him up at night. Good-bye UnixWare, Good-bye Solaris, hello BSD!
A very amusing read, check it out!
***
High Availability with PostgreSQL on FreeBSD (https://www.youtube.com/watch?v=ugct9-Mm7Ls)
A talk by Sean Chittenden, who we interviewed previously on episode Episode 95  (http://www.bsdnow.tv/episodes/2015_06_24-bitrot_group_therapy)
Explains how to setup Multi Data Center High Availability for PostgreSQL using consul
Goes into how consul works, how it does the election, the gossip protocol, etc
The HA setup uses DNS Failover, and the pros and cons of that approach are discussed
Then he walks through the implementation details, and example configuration
***
New FreeBSD i915 testing images (http://www.bsddesktop.com/images/)
Still need users to test the Linux Kernel 4.6 DRM update to FreeBSD’s graphics stack
Download the test image and write it to a USB stick and boot from it
It will not modify your installed system, it runs entirely off of the USB drive
Allows you to test the updated drivers without having to install the development branch on your device
 you can tell them that ATI/AMD support will be coming shortly
 and that stability has been steadily improving
 and that I'll do another announcement as soon as I've had a chance to test the newest Xorg bits
***
Beastie Bits
Comfortable on the CLI: Series Part 1 (https://www.cotcli.com/post/The-Very-Basics/)
FreeBSD Booting on the Netgate uFW, a smaller-than-a-raspberry-pi dual port firewall (https://gist.github.com/gonzopancho/8e7df7a826e9a2949b36ed2a9d30312e) 
Picture of uFW (https://twitter.com/gonzopancho/status/737874921435594753) 
uFW OpenSSL Benchmarks (https://gist.github.com/gonzopancho/8f20b50487a4f7de56e99448866a147d)   
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>It’s only one-week away from BSDCan, both Allan and I are excited to meet some of you in person! However, the show keeps on</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.dotsecurity.io/" rel="nofollow">dotSecurity 2016 - Theo de Raadt - Privilege Separation and Pledge</a></h3>

<ul>
<li><a href="https://www.youtube.com/watch?v=a_EYdzGyNWs" rel="nofollow">Video</a> </li>
<li><a href="https://www.openbsd.org/papers/dot2016.pdf" rel="nofollow">Slides</a> </li>
<li>Interested in Privilege Separation and security in general? If so, then you are in for a treat, we have both the video and slides from Theo de Raadt at dotSecurity 2016.</li>
<li>Specifically the the talk starts off looking at Pledge (no copyright issues with the pictures I hope??) and how their NTP daemon uses it.</li>
<li>After going through some internals, Theo reveals that around 10% of programs “pledged” so far were found to be trying to do actions outside of their security scope.</li>
<li>On the future-work side, they mention going back and looking at OpenSSH privilege separation next, as well as working with other OS’s that may want pledge support.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2016-May/004471.html" rel="nofollow">bhyve now supports UEFI GOP</a></h3>

<ul>
<li>The log awaited UEFI GOP (<a href="https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#GOP" rel="nofollow">Graphics Output Protocol</a>) features has landed in bhyve</li>
<li>This provides emulated graphics via an internal VNC server, allowing users to have full graphical access to the guest OS</li>
<li>This allows installation of Windows guests without needing to create a modified ISO with an unattended installation script</li>
<li>The code has not actually landed in FreeBSD head yet, but has been committed to a project branch</li>
<li>Following a few simple commands, you can compile the new bhyve binary on your -CURRENT system and get started right away</li>
<li>This feature is expected to be included in the upcoming FreeBSD 11.0</li>
<li>This commit drop also brings with it:

<ul>
<li>XHCI -- an emulated usb tablet device that provides exact mouse positioning in supported OSs</li>
<li>PS2 mouse for fallback if the guest does not support XHCI (Windows 7)</li>
<li>PS2 keyboard</li>
</ul></li>
<li>“The code has been tested with Windows 7/8/8.1/10 and Server 2k12/2k16, Ubuntu 15.10, and FreeBSD 10.3/11-CURRENT”</li>
<li>“For VNC clients, TightVNC, TigherVNC, and RealVNC (aka VNC Viewer) have been tested on various hosts. The OSX VNC client is known not to work.”</li>
<li>The VNC server supports an optional ‘wait’ parameter, that causes the VM to not actually boot until the VNC client connects, allowing you to interrupt the boot process if need be</li>
<li><a href="http://justinholcomb.me/blog/2016/05/28/bhyve-uefi-gop-support.html" rel="nofollow">Related user blog post </a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=300829" rel="nofollow">SVN commit</a>
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=300906" rel="nofollow">zfsd lands in FreeBSD HEAD, in time for 11.0-RELEASE</a></h3>

<ul>
<li>zfsd has been committed to FreeBSD -CURRENT in time to be included in FreeBSD 11.0</li>
<li>zfsd is the missing piece required to make ‘hot spares’ work properly in FreeBSD ZFS</li>
<li>“zfsd attempts to resolve ZFS faults that the kernel can&#39;t resolve by itself. It listens to devctl(4) events, which is how the kernel notifies of events such as I/O errors and disk removals.  Zfsd attempts to resolve these faults by activating or deactivating hotspares and onlining offline vdevs.”</li>
<li>“The administrator never interacts with zfsd directly.  Instead, he controls its behavior indirectly through zpool configuration.  There are two ways to influence zfsd: assigning hotspares and setting pool properties.  Currently, only the <em>autoreplace</em> property has any effect.  See zpool(8) for details.”</li>
<li>So, what example does it do?</li>
<li>Device Removal: “When a leaf vdev disappears, zfsd will activate any available hotspare.”</li>
<li>Device Arrival: “When a new GEOM device appears, zfsd will attempt to read its ZFS label, if any.  If it matches a previously removed vdev on an active pool, zfsd will online it.  Once resilvering completes, any active hotspare will detach automatically.”</li>
<li>So if you disconnect a drive, then reconnect it, it will automatically be brought back online. Since ZFS is smart, the resilver will only have to copy data that has changed since the device went offline.</li>
<li>“If the new device has no ZFS label but its physical path matches the physical path of a previously removed vdev on an active pool, and that pool has the autoreplace property set, then zfsd will replace the missing vdev with the newly arrived device.  Once resilvering completes, any active hotspare will detach automatically.”</li>
<li>If the new drive is in the same slot in your hot swap array as a failed device, it will be used as a replacement immediately.</li>
<li>vdev degrade or fault events: “If a vdev becomes degraded or faulted, zfsd will activate any available hotspare. If a leaf vdev generates more than 50 I/O errors in a 60 second period, then zfsd will mark that vdev as FAULTED.  zfs(4) will no longer issue any I/Os to it.  zfsd will activate 
a hotspare if one is available.” Same for checksum errors.</li>
<li>So if zfsd detects a drive is going bad, it brings the hotspare online before it is too late</li>
<li>Spare addition: “If the system administrator adds a hotspare to a pool that is already degraded, zfsd will activate the spare.”</li>
<li>Resilver complete: “zfsd will detach any hotspare once a permanent replacement finishes resilvering.”</li>
<li>Physical path change: “If the physical path of an existing disk changes, zfsd will attempt to replace any missing disk with the same physical path, if its pool&#39;s autoreplace property is set.”</li>
<li>In general, this tool means less reliance on the system administrator to keep the pool healthy
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160527203200" rel="nofollow">W<sup>X</sup> now mandatory in OpenBSD</a></h3>

<ul>
<li>We’ve talked a bit about W<sup>X</sup> in the past. (Refresher: Memory being writable and executable at once)</li>
<li>Well, this major security no-no is no-more on OpenBSD. Theo has committed a change which now prevents violations of this policy:</li>
</ul>

<blockquote>
<p>“W<sup>X</sup> violations are no longer permitted by default.  A kernel log message is generated, and mprotect/mmap return ENOTSUP.  If the sysctl(8) flag kern.wxabort is set then a SIGABRT occurs instead, for gdb use or coredump creation.”</p>
</blockquote>

<ul>
<li>There are a few cases where you may still need W<sup>X,</sup> which Theo points out can be enabled on a file-system basis.</li>
</ul>

<blockquote>
<p>“W<sup>X</sup> violating programs can be permitted on a ffs/nfs filesystem-basis, using the &quot;wxallowed&quot; mount option.  One day far in the future upstream software developers will understand that W<sup>X</sup> violations are a tremendously risky practice and that style of programming will be banished outright.  Until then, we recommend most users need to use the wxallowed option on their /usr/local filesystem.  At least your other filesystems don&#39;t permit such programs.”</p>
</blockquote>

<ul>
<li>This is a great ability to grow, since now users can begin doing auditing of programs that violate this principle and making noise to upstream.
***</li>
</ul>

<h2>Interview - Kristof Provost - <a href="mailto:kp@freebsd.org" rel="nofollow">kp@freebsd.org</a> <a href="https://twitter.com/kprovst" rel="nofollow">@kprovst</a></h2>

<ul>
<li>pf improvements on FreeBSD
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://ericmccorkleblog.wordpress.com/2016/05/28/freebsd-geli-support/" rel="nofollow">GELI Support for the EFI Loader </a></h3>

<ul>
<li>We’ve had Allan’s work to bring GELI support to the GPT / BIOS / ZFS loader for a while now, but the missing piece has been support for EFI.</li>
<li>No longer, Eric McCorkle has posted a blog entry (with relevant github links) introducing us to his work to bring GELI encryption support to EFI.</li>
<li>First the bad-news. This won’t make it into 11.0. (Maybe PC-BSD, TBD)</li>
<li>Next he explains why this is more than just a new feature, but a re-factor of the EFI boot code:</li>
</ul>

<blockquote>
<p>I have already written extensively about my EFI refactoring here.  The reason for undertaking this effort, however, was driven by GELI support.  Early in my work on this, I had implemented a non-EFI “providers” framework in boot1 in order to support the notion of disk partitions that may contain sub-partitions.</p>
</blockquote>

<ul>
<li>This was deeply unsatisfying to me for several reasons:

<ul>
<li>It implemented a lot of the same functionality that exists in the EFI framework.</li>
<li>It involved implementing a GPT partition driver to deal with partition tables inside GELI partitions (GPT detection and support is guaranteed by the EFI spec).</li>
<li>The interface between the EFI framework and the custom “providers” framework was awkward.</li>
<li>The driver was completely boot1-specific, and exporting it to something like GRUB probably involved a total rewrite.</li>
<li>Implementing it within loader was going to involve a lot of code duplication.</li>
<li>There was no obvious was to pass keys between boot1, loader, and the kernel.</li>
</ul></li>
<li>With the issues known, Eric seems pleased with the results of the conversion so far:

<ul>
<li>The GELI driver can be extracted from the FreeBSD codebase without too much trouble.</li>
<li>While I was unable to go all the way to the EFI driver model, the only blocker is the bcache code, and once that is resolved, we can have hotplug support in the boot loader!</li>
<li>The boot1 and loader codebases are now sharing all the backend drivers, and boot1 has been reduced to one very small source file.</li>
</ul></li>
<li>An interesting read, looking forward to playing with EFI more in the future!
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/blog/faces-of-freebsd-2016-michael-lucas/" rel="nofollow">Faces of FreeBSD 2016: Michael W. Lucas</a></h3>

<ul>
<li>On this edition of “Faces of FreeBSD”, Michael W Lucas tells the story of how he got started with FreeBSD</li>
<li>After an amusing re-telling of his childhood (The words “Purina Monkey Chow” were mentioned), he then tells us how he got into BSD.</li>
<li>His being thrown into the project may sound familiar to many: </li>
</ul>

<blockquote>
<p>I came in at 11 PM one night and was told “The DNS administrator just got walked out the door. You’re the new lead DNS administrator. Make those servers work. Good luck.”</p>
</blockquote>

<ul>
<li>From there (because he wanted more sleep), he began ripping out the systems that had been failing and waking him up at night. Good-bye UnixWare, Good-bye Solaris, hello BSD!</li>
<li>A very amusing read, check it out!
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=ugct9-Mm7Ls" rel="nofollow">High Availability with PostgreSQL on FreeBSD</a></h3>

<ul>
<li>A talk by Sean Chittenden, who we interviewed previously on episode <a href="http://www.bsdnow.tv/episodes/2015_06_24-bitrot_group_therapy" rel="nofollow">Episode 95 </a></li>
<li>Explains how to setup Multi Data Center High Availability for PostgreSQL using consul</li>
<li>Goes into how consul works, how it does the election, the gossip protocol, etc</li>
<li>The HA setup uses DNS Failover, and the pros and cons of that approach are discussed</li>
<li>Then he walks through the implementation details, and example configuration
***</li>
</ul>

<h3><a href="http://www.bsddesktop.com/images/" rel="nofollow">New FreeBSD i915 testing images</a></h3>

<ul>
<li>Still need users to test the Linux Kernel 4.6 DRM update to FreeBSD’s graphics stack</li>
<li>Download the test image and write it to a USB stick and boot from it</li>
<li>It will not modify your installed system, it runs entirely off of the USB drive</li>
<li>Allows you to test the updated drivers without having to install the development branch on your device</li>
<li><mmacy> you can tell them that ATI/AMD support will be coming shortly</li>
<li><mmacy> and that stability has been steadily improving</li>
<li><mmacy> and that I&#39;ll do another announcement as soon as I&#39;ve had a chance to test the newest Xorg bits
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.cotcli.com/post/The-Very-Basics/" rel="nofollow">Comfortable on the CLI: Series Part 1</a></li>
<li><a href="https://gist.github.com/gonzopancho/8e7df7a826e9a2949b36ed2a9d30312e" rel="nofollow">FreeBSD Booting on the Netgate uFW, a smaller-than-a-raspberry-pi dual port firewall</a> </li>
<li><a href="https://twitter.com/gonzopancho/status/737874921435594753" rel="nofollow">Picture of uFW</a> </li>
<li><a href="https://gist.github.com/gonzopancho/8f20b50487a4f7de56e99448866a147d" rel="nofollow">uFW OpenSSL Benchmarks</a><br>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>It’s only one-week away from BSDCan, both Allan and I are excited to meet some of you in person! However, the show keeps on</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.dotsecurity.io/" rel="nofollow">dotSecurity 2016 - Theo de Raadt - Privilege Separation and Pledge</a></h3>

<ul>
<li><a href="https://www.youtube.com/watch?v=a_EYdzGyNWs" rel="nofollow">Video</a> </li>
<li><a href="https://www.openbsd.org/papers/dot2016.pdf" rel="nofollow">Slides</a> </li>
<li>Interested in Privilege Separation and security in general? If so, then you are in for a treat, we have both the video and slides from Theo de Raadt at dotSecurity 2016.</li>
<li>Specifically the the talk starts off looking at Pledge (no copyright issues with the pictures I hope??) and how their NTP daemon uses it.</li>
<li>After going through some internals, Theo reveals that around 10% of programs “pledged” so far were found to be trying to do actions outside of their security scope.</li>
<li>On the future-work side, they mention going back and looking at OpenSSH privilege separation next, as well as working with other OS’s that may want pledge support.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2016-May/004471.html" rel="nofollow">bhyve now supports UEFI GOP</a></h3>

<ul>
<li>The log awaited UEFI GOP (<a href="https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#GOP" rel="nofollow">Graphics Output Protocol</a>) features has landed in bhyve</li>
<li>This provides emulated graphics via an internal VNC server, allowing users to have full graphical access to the guest OS</li>
<li>This allows installation of Windows guests without needing to create a modified ISO with an unattended installation script</li>
<li>The code has not actually landed in FreeBSD head yet, but has been committed to a project branch</li>
<li>Following a few simple commands, you can compile the new bhyve binary on your -CURRENT system and get started right away</li>
<li>This feature is expected to be included in the upcoming FreeBSD 11.0</li>
<li>This commit drop also brings with it:

<ul>
<li>XHCI -- an emulated usb tablet device that provides exact mouse positioning in supported OSs</li>
<li>PS2 mouse for fallback if the guest does not support XHCI (Windows 7)</li>
<li>PS2 keyboard</li>
</ul></li>
<li>“The code has been tested with Windows 7/8/8.1/10 and Server 2k12/2k16, Ubuntu 15.10, and FreeBSD 10.3/11-CURRENT”</li>
<li>“For VNC clients, TightVNC, TigherVNC, and RealVNC (aka VNC Viewer) have been tested on various hosts. The OSX VNC client is known not to work.”</li>
<li>The VNC server supports an optional ‘wait’ parameter, that causes the VM to not actually boot until the VNC client connects, allowing you to interrupt the boot process if need be</li>
<li><a href="http://justinholcomb.me/blog/2016/05/28/bhyve-uefi-gop-support.html" rel="nofollow">Related user blog post </a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=300829" rel="nofollow">SVN commit</a>
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=300906" rel="nofollow">zfsd lands in FreeBSD HEAD, in time for 11.0-RELEASE</a></h3>

<ul>
<li>zfsd has been committed to FreeBSD -CURRENT in time to be included in FreeBSD 11.0</li>
<li>zfsd is the missing piece required to make ‘hot spares’ work properly in FreeBSD ZFS</li>
<li>“zfsd attempts to resolve ZFS faults that the kernel can&#39;t resolve by itself. It listens to devctl(4) events, which is how the kernel notifies of events such as I/O errors and disk removals.  Zfsd attempts to resolve these faults by activating or deactivating hotspares and onlining offline vdevs.”</li>
<li>“The administrator never interacts with zfsd directly.  Instead, he controls its behavior indirectly through zpool configuration.  There are two ways to influence zfsd: assigning hotspares and setting pool properties.  Currently, only the <em>autoreplace</em> property has any effect.  See zpool(8) for details.”</li>
<li>So, what example does it do?</li>
<li>Device Removal: “When a leaf vdev disappears, zfsd will activate any available hotspare.”</li>
<li>Device Arrival: “When a new GEOM device appears, zfsd will attempt to read its ZFS label, if any.  If it matches a previously removed vdev on an active pool, zfsd will online it.  Once resilvering completes, any active hotspare will detach automatically.”</li>
<li>So if you disconnect a drive, then reconnect it, it will automatically be brought back online. Since ZFS is smart, the resilver will only have to copy data that has changed since the device went offline.</li>
<li>“If the new device has no ZFS label but its physical path matches the physical path of a previously removed vdev on an active pool, and that pool has the autoreplace property set, then zfsd will replace the missing vdev with the newly arrived device.  Once resilvering completes, any active hotspare will detach automatically.”</li>
<li>If the new drive is in the same slot in your hot swap array as a failed device, it will be used as a replacement immediately.</li>
<li>vdev degrade or fault events: “If a vdev becomes degraded or faulted, zfsd will activate any available hotspare. If a leaf vdev generates more than 50 I/O errors in a 60 second period, then zfsd will mark that vdev as FAULTED.  zfs(4) will no longer issue any I/Os to it.  zfsd will activate 
a hotspare if one is available.” Same for checksum errors.</li>
<li>So if zfsd detects a drive is going bad, it brings the hotspare online before it is too late</li>
<li>Spare addition: “If the system administrator adds a hotspare to a pool that is already degraded, zfsd will activate the spare.”</li>
<li>Resilver complete: “zfsd will detach any hotspare once a permanent replacement finishes resilvering.”</li>
<li>Physical path change: “If the physical path of an existing disk changes, zfsd will attempt to replace any missing disk with the same physical path, if its pool&#39;s autoreplace property is set.”</li>
<li>In general, this tool means less reliance on the system administrator to keep the pool healthy
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160527203200" rel="nofollow">W<sup>X</sup> now mandatory in OpenBSD</a></h3>

<ul>
<li>We’ve talked a bit about W<sup>X</sup> in the past. (Refresher: Memory being writable and executable at once)</li>
<li>Well, this major security no-no is no-more on OpenBSD. Theo has committed a change which now prevents violations of this policy:</li>
</ul>

<blockquote>
<p>“W<sup>X</sup> violations are no longer permitted by default.  A kernel log message is generated, and mprotect/mmap return ENOTSUP.  If the sysctl(8) flag kern.wxabort is set then a SIGABRT occurs instead, for gdb use or coredump creation.”</p>
</blockquote>

<ul>
<li>There are a few cases where you may still need W<sup>X,</sup> which Theo points out can be enabled on a file-system basis.</li>
</ul>

<blockquote>
<p>“W<sup>X</sup> violating programs can be permitted on a ffs/nfs filesystem-basis, using the &quot;wxallowed&quot; mount option.  One day far in the future upstream software developers will understand that W<sup>X</sup> violations are a tremendously risky practice and that style of programming will be banished outright.  Until then, we recommend most users need to use the wxallowed option on their /usr/local filesystem.  At least your other filesystems don&#39;t permit such programs.”</p>
</blockquote>

<ul>
<li>This is a great ability to grow, since now users can begin doing auditing of programs that violate this principle and making noise to upstream.
***</li>
</ul>

<h2>Interview - Kristof Provost - <a href="mailto:kp@freebsd.org" rel="nofollow">kp@freebsd.org</a> <a href="https://twitter.com/kprovst" rel="nofollow">@kprovst</a></h2>

<ul>
<li>pf improvements on FreeBSD
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://ericmccorkleblog.wordpress.com/2016/05/28/freebsd-geli-support/" rel="nofollow">GELI Support for the EFI Loader </a></h3>

<ul>
<li>We’ve had Allan’s work to bring GELI support to the GPT / BIOS / ZFS loader for a while now, but the missing piece has been support for EFI.</li>
<li>No longer, Eric McCorkle has posted a blog entry (with relevant github links) introducing us to his work to bring GELI encryption support to EFI.</li>
<li>First the bad-news. This won’t make it into 11.0. (Maybe PC-BSD, TBD)</li>
<li>Next he explains why this is more than just a new feature, but a re-factor of the EFI boot code:</li>
</ul>

<blockquote>
<p>I have already written extensively about my EFI refactoring here.  The reason for undertaking this effort, however, was driven by GELI support.  Early in my work on this, I had implemented a non-EFI “providers” framework in boot1 in order to support the notion of disk partitions that may contain sub-partitions.</p>
</blockquote>

<ul>
<li>This was deeply unsatisfying to me for several reasons:

<ul>
<li>It implemented a lot of the same functionality that exists in the EFI framework.</li>
<li>It involved implementing a GPT partition driver to deal with partition tables inside GELI partitions (GPT detection and support is guaranteed by the EFI spec).</li>
<li>The interface between the EFI framework and the custom “providers” framework was awkward.</li>
<li>The driver was completely boot1-specific, and exporting it to something like GRUB probably involved a total rewrite.</li>
<li>Implementing it within loader was going to involve a lot of code duplication.</li>
<li>There was no obvious was to pass keys between boot1, loader, and the kernel.</li>
</ul></li>
<li>With the issues known, Eric seems pleased with the results of the conversion so far:

<ul>
<li>The GELI driver can be extracted from the FreeBSD codebase without too much trouble.</li>
<li>While I was unable to go all the way to the EFI driver model, the only blocker is the bcache code, and once that is resolved, we can have hotplug support in the boot loader!</li>
<li>The boot1 and loader codebases are now sharing all the backend drivers, and boot1 has been reduced to one very small source file.</li>
</ul></li>
<li>An interesting read, looking forward to playing with EFI more in the future!
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/blog/faces-of-freebsd-2016-michael-lucas/" rel="nofollow">Faces of FreeBSD 2016: Michael W. Lucas</a></h3>

<ul>
<li>On this edition of “Faces of FreeBSD”, Michael W Lucas tells the story of how he got started with FreeBSD</li>
<li>After an amusing re-telling of his childhood (The words “Purina Monkey Chow” were mentioned), he then tells us how he got into BSD.</li>
<li>His being thrown into the project may sound familiar to many: </li>
</ul>

<blockquote>
<p>I came in at 11 PM one night and was told “The DNS administrator just got walked out the door. You’re the new lead DNS administrator. Make those servers work. Good luck.”</p>
</blockquote>

<ul>
<li>From there (because he wanted more sleep), he began ripping out the systems that had been failing and waking him up at night. Good-bye UnixWare, Good-bye Solaris, hello BSD!</li>
<li>A very amusing read, check it out!
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=ugct9-Mm7Ls" rel="nofollow">High Availability with PostgreSQL on FreeBSD</a></h3>

<ul>
<li>A talk by Sean Chittenden, who we interviewed previously on episode <a href="http://www.bsdnow.tv/episodes/2015_06_24-bitrot_group_therapy" rel="nofollow">Episode 95 </a></li>
<li>Explains how to setup Multi Data Center High Availability for PostgreSQL using consul</li>
<li>Goes into how consul works, how it does the election, the gossip protocol, etc</li>
<li>The HA setup uses DNS Failover, and the pros and cons of that approach are discussed</li>
<li>Then he walks through the implementation details, and example configuration
***</li>
</ul>

<h3><a href="http://www.bsddesktop.com/images/" rel="nofollow">New FreeBSD i915 testing images</a></h3>

<ul>
<li>Still need users to test the Linux Kernel 4.6 DRM update to FreeBSD’s graphics stack</li>
<li>Download the test image and write it to a USB stick and boot from it</li>
<li>It will not modify your installed system, it runs entirely off of the USB drive</li>
<li>Allows you to test the updated drivers without having to install the development branch on your device</li>
<li><mmacy> you can tell them that ATI/AMD support will be coming shortly</li>
<li><mmacy> and that stability has been steadily improving</li>
<li><mmacy> and that I&#39;ll do another announcement as soon as I&#39;ve had a chance to test the newest Xorg bits
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="https://www.cotcli.com/post/The-Very-Basics/" rel="nofollow">Comfortable on the CLI: Series Part 1</a></li>
<li><a href="https://gist.github.com/gonzopancho/8e7df7a826e9a2949b36ed2a9d30312e" rel="nofollow">FreeBSD Booting on the Netgate uFW, a smaller-than-a-raspberry-pi dual port firewall</a> </li>
<li><a href="https://twitter.com/gonzopancho/status/737874921435594753" rel="nofollow">Picture of uFW</a> </li>
<li><a href="https://gist.github.com/gonzopancho/8f20b50487a4f7de56e99448866a147d" rel="nofollow">uFW OpenSSL Benchmarks</a><br>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>143: One small step for DRM, one giant leap for BSD</title>
  <link>https://www.bsdnow.tv/143</link>
  <guid isPermaLink="false">de687a92-fb4a-4af8-92f5-a8e5aeee2999</guid>
  <pubDate>Wed, 25 May 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/de687a92-fb4a-4af8-92f5-a8e5aeee2999.mp3" length="86056564" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we have an interview with Matthew Macy, who has some exciting news to share with us regarding the state of graphics</itunes:subtitle>
  <itunes:duration>1:59:31</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we have an interview with Matthew Macy, who has some exciting news to share with us regarding the state of graphics
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
How the number of states affects pf’s performance of FreeBSD (http://blog.cochard.me/2016/05/playing-with-freebsd-packet-filter.html)
 Our friend Olivier of FreeNAS and BSDRP fame has an interesting blog post this week detailing his unique issue with finding a firewall that can handle upwards of 4 million state table entries.
He begins in the article with benchmarking the defaults, since without that we don’t have a framework to compare the later results.  All done on his  Netgate RCC-VE 4860 (4 cores ATOM C2558, 8GB RAM) under FreeBSD 10.3.
“We notice a little performance impact when we reach the default 10K state table limit: From 413Kpps with 128 states in-used, it lower to 372Kpps.”
With the initial benchmarks done and graphed, he then starts the tuning process by adjusting the “net.pf.states_hashsize”sysctl, and then playing with the number of states for the firewall to keep.
“For the next bench, the number of flow will be fixed for generating 9800 pf state entries, but I will try different value of pf.states_hashsize until the maximum allowed on my 8GB RAM server (still with the default max states of 10k):”
Then he cranks it up to 4 million states
“There is only 12% performance penalty between pf 128 pf states and 4 million pf states.”
“With 10M state, pf performance lower to 362Kpps: Still only 12% lower performance than with only 128 states”
He then looks at what this does of pfsync, the protocol to sync the state table between two redundant pf firewalls
Conclusions:
There need to be a linear relationship between the pf hard-limit of states and the pf.stateshashsize; RAM needed for pf.stateshashsize = pf.stateshashsize * 80 Byte and pf.stateshashsize should be a power of 2 (from the manual page); Even small hardware can manage large number of sessions (it's a matter of RAM),  but under too lot's of pressure pfsync will suffer.
Introducing the BCHS Stack = BSD, C, httpd, SQLite (http://www.learnbchs.org/)
Pronounced Beaches
“It's a hipster-free, open source software stack for web applications”
“Don't just write C. Write portable and secure C.”
“Get to know your security tools. OpenBSD has systrace(4) and pledge(2). FreeBSD has capsicum(4).”
“Statically scan your binary with LLVM” and “Run your application under valgrind”
“Don't forget: BSD is a community of professionals. Go to conferences (EuroBSDCon, AsiaBSDCon, BSDCan, etc.)”
This seems like a really interesting project, we’ll have to get Kristaps Dzonsons back on the show to talk about it
***
Installing OpenBSD's httpd server, MariaDB, PHP 5.6 on OpenBSD 5.9 (https://www.rootbsd.net/kb/339/Installing-OpenBSDandsharp039s-httpd-server-MariaDB-PHP-56-on-OpenBSD-59.html)
Looking to deploy your next web-stack on OpenBSD 5.9? If so this next article from rootbsd.net is for you.
Specifically it will walk you through the process of getting OpenBSD’s own httpd server up and running, followed by MariaDB and PHP 5.6.
Most of the setup is pretty straight-forward, the httpd syntax may be different to you, if this is your first time trying it out.
Once the various packages are installed / configured, the rest of the tutorial will be easy, walking you through the standard hello world PHP script, and enabling the services to run at reboot.
A good article for those wanting to start hosting PHP/DB content (wordpress anyone?) on your OpenBSD system.
***
The infrastructure behind Varnish  (https://www.varnish-cache.org/news/20160425_website.html)
Dogfooding. It’s a term you hear often in the software community, which essentially means to “Run your own stuff”. Today we have an article by PKH over at varnish-cache, talking about what that means to them.
Specifically, they recently went through a website upgrade, which will enable them to run more of their own stuff. 
He has a great quote on what OS they use:“So, dogfood: Obviously FreeBSD. Apart from the obvious reason that I wrote a lot of FreeBSD and can get world-class support by bugging my buddies about it, there are two equally serious reasons for the Varnish Project to run on FreeBSD: Dogfood and jails.Varnish Cache is not “software for Linux”, it is software for any competent UNIX-like operating system, and FreeBSD is our primary “keep us honest about this” platform.“
He then goes through the process of explaining how they would setup a new Varnish-cache website, or upgrade it. 
All together a great read, and if you are one of the admin-types, you really should pay attention to how they build from the ground up. Some valuable knowledge here which every admin should try to replicate.
I can not reiterate the value of having your config files in a private source control repo strongly enough
The biggest take-away is: “And by doing it this way, I know it will work next time also.”
***
Interview - Matt Macy - mmacy@nextbsd.org (mailto:mmacy@nextbsd.org)Graphics Stack Update (https://lists.freebsd.org/pipermail/freebsd-x11/2016-May/017560.html)
News Roundup
Followup on packaging base with pkg(8) (https://lists.freebsd.org/pipermail/freebsd-pkgbase/2016-May/000238.html)
In spite of the heroic last minute effort by a team of contributors, pkg’d base will not be ready in time for FreeBSD 11.0
There are just too many issues that were discovered during testing
The plan is to continue using freebsd-update in the meantime, and introduce a pkg based upgrade mechanism in FreeBSD 11.1
With the new support model for the FreeBSD 11 branch, 11.1 may come sooner than with previous major releases
***
FreeBSD Core Election (https://www.freebsd.org/internal/bylaws.html)
It is time once again for the FreeBSD Core Election
Application period begins: Wednesday, 18 May 2016 at 18:00:00 UTC
Application period ends: Wednesday, 25 May 2016 at 18:00:00 UTC
Voting begins: Wednesday, 25 May 2016 at 18:00:00 UTC
Voting ends: Wednesday, 22 June 2016 at 18:00:00 UTC
Results announced Wednesday, 29 June 2016
New core team takes office: Wednesday, 6 July 2016
As of the time I was writing these notes, 3 hours before the application deadline, the candidates are:
Allan Jude: Filling in the potholes
Marcelo Araujo: We are not vampires, but we need new blood.
Baptiste Daroussin (incumbent): Keep on improving
Benedict Reuschling: Learn and Teach
Benno Rice: Revitalising The Community
Devin Teske: Here to help
Ed Maste (incumbent): FreeBSD is people
George V. Neville-Neil (incumbent): There is much to do…
Hiroki Sato (incumbent): Keep up with our good community and technical strength
John Baldwin: Ready to work
Juli Mallett: Caring for community.
Kris Moore: User-Focused
Mathieu Arnold: Someone ask for fresh blood ?
Ollivier Robert: Caring for the project and you, its developers
The deadline for applications is around the time we finish recording the live show
We welcome any of the candidates to schedule an interview in the next few weeks. We will make an attempt to hunt many of them down at BSDCan as well.
***
Wayland/Weston with XWayland works on DragonFly (http://lists.dragonflybsd.org/pipermail/users/2016-May/249620.html)
We haven’t talked a lot about Wayland on BSD recently (or much at all), but today we have a post from Peter to the dragonfly mailing list, detailing his experience with it.
Specifically he talks about getting XWayland working, which provides the compat bits for native X applications to run on WayLand displays.
So far on the working list of apps:
“gtk3:
gedit
nautilus
evince
xfce4:
  - xfce4-terminal
  - atril
firefox
spyder
scilab”
A pretty impressive list, although he said “chrome” failed with a seg-fault
This is something I’m personally interested in. Now with the newer DRM bits landing in FreeBSD, perhaps it’s time for some further looking into Wayland.
Broadcom WiFi driver update (http://adrianchadd.blogspot.ca/2016/05/updating-broadcom-softmac-driver-bwn-or.html)
In this blog post Adrian Chadd talks about his recent work on the bwn(4) driver for Broadcom WiFi chips
This work has added support for a number of older 802.11g chips, including the one from 2009-era Macbooks
Work is ongoing, and the hope is to add 802.11n and 5ghz support as well
Adrian is mentoring a number of developers working on embedded or wifi related things, to try to increase the projects bandwidth in those areas
If you are interested in driver development, or wifi internals, the blog post has lots of interesting details and covers the story of Adrian’s recent adventures in bringing the drivers up
***
Beastie Bits
The Design of the NetBSD I/O Subsystems (2002) (http://arxiv.org/abs/1605.05810)
ZFS, BTRFS, XFS, EXT4 and LVM with KVM – a storage performance comparison (http://www.ilsistemista.net/index.php/virtualization/47-zfs-btrfs-xfs-ext4-and-lvm-with-kvm-a-storage-performance-comparison.html?print=true) 
Swift added to FreeBSD Ports (http://www.freshports.org/lang/swift/)
misc@openbsd: 'NSA addition to ifconfig' (http://marc.info/?l=openbsd-misc&amp;amp;m=146391388912602&amp;amp;w=2)
Papers We Love: Memory by the Slab: The Tale of Bonwick's Slab Allocator  (http://paperswelove.org/2015/video/ryan-zezeski-memory-by-the-slab/) 
Feedback/Questions
 Lars - Poudriere (http://pastebin.com/HRRyfxev) 
 Warren - .NET (http://pastebin.com/fESV1egk) 
 Eddy - Sys Init (http://pastebin.com/kQecpA1X) 
 Tim - ZFS Resources (http://pastebin.com/5096cGXr) 
 Morgan - Ports and Kernel (http://pastebin.com/rYr1CDcV) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we have an interview with Matthew Macy, who has some exciting news to share with us regarding the state of graphics</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.cochard.me/2016/05/playing-with-freebsd-packet-filter.html" rel="nofollow">How the number of states affects pf’s performance of FreeBSD</a></h3>

<ul>
<li> Our friend Olivier of FreeNAS and BSDRP fame has an interesting blog post this week detailing his unique issue with finding a firewall that can handle upwards of 4 million state table entries.</li>
<li>He begins in the article with benchmarking the defaults, since without that we don’t have a framework to compare the later results.  All done on his  Netgate RCC-VE 4860 (4 cores ATOM C2558, 8GB RAM) under FreeBSD 10.3.</li>
<li>“We notice a little performance impact when we reach the default 10K state table limit: From 413Kpps with 128 states in-used, it lower to 372Kpps.”</li>
<li>With the initial benchmarks done and graphed, he then starts the tuning process by adjusting the “net.pf.states_hashsize”sysctl, and then playing with the number of states for the firewall to keep.</li>
<li>“For the next bench, the number of flow will be fixed for generating 9800 pf state entries, but I will try different value of pf.states_hashsize until the maximum allowed on my 8GB RAM server (still with the default max states of 10k):”</li>
<li>Then he cranks it up to 4 million states</li>
<li>“There is only 12% performance penalty between pf 128 pf states and 4 million pf states.”</li>
<li>“With 10M state, pf performance lower to 362Kpps: Still only 12% lower performance than with only 128 states”</li>
<li>He then looks at what this does of pfsync, the protocol to sync the state table between two redundant pf firewalls</li>
<li>Conclusions:</li>
</ul>

<p>There need to be a linear relationship between the pf hard-limit of states and the pf.states_hashsize; RAM needed for pf.states_hashsize = pf.states_hashsize * 80 Byte and pf.states_hashsize should be a power of 2 (from the manual page); Even small hardware can manage large number of sessions (it&#39;s a matter of RAM),  but under too lot&#39;s of pressure pfsync will suffer.</p>

<hr>

<h3><a href="http://www.learnbchs.org/" rel="nofollow">Introducing the BCHS Stack = BSD, C, httpd, SQLite</a></h3>

<ul>
<li>Pronounced Beaches</li>
<li>“It&#39;s a hipster-free, open source software stack for web applications”</li>
<li>“Don&#39;t just write C. Write portable and secure C.”</li>
<li>“Get to know your security tools. OpenBSD has systrace(4) and pledge(2). FreeBSD has capsicum(4).”</li>
<li>“Statically scan your binary with LLVM” and “Run your application under valgrind”</li>
<li>“Don&#39;t forget: BSD is a community of professionals. Go to conferences (EuroBSDCon, AsiaBSDCon, BSDCan, etc.)”</li>
<li>This seems like a really interesting project, we’ll have to get Kristaps Dzonsons back on the show to talk about it
***</li>
</ul>

<h3><a href="https://www.rootbsd.net/kb/339/Installing-OpenBSDandsharp039s-httpd-server-MariaDB-PHP-56-on-OpenBSD-59.html" rel="nofollow">Installing OpenBSD&#39;s httpd server, MariaDB, PHP 5.6 on OpenBSD 5.9</a></h3>

<ul>
<li>Looking to deploy your next web-stack on OpenBSD 5.9? If so this next article from rootbsd.net is for you.</li>
<li>Specifically it will walk you through the process of getting OpenBSD’s own httpd server up and running, followed by MariaDB and PHP 5.6.</li>
<li>Most of the setup is pretty straight-forward, the httpd syntax may be different to you, if this is your first time trying it out.</li>
<li>Once the various packages are installed / configured, the rest of the tutorial will be easy, walking you through the standard hello world PHP script, and enabling the services to run at reboot.</li>
<li>A good article for those wanting to start hosting PHP/DB content (wordpress anyone?) on your OpenBSD system.
***</li>
</ul>

<h3><a href="https://www.varnish-cache.org/news/20160425_website.html" rel="nofollow">The infrastructure behind Varnish </a></h3>

<ul>
<li>Dogfooding. It’s a term you hear often in the software community, which essentially means to “Run your own stuff”. Today we have an article by PKH over at varnish-cache, talking about what that means to them.</li>
<li>Specifically, they recently went through a website upgrade, which will enable them to run more of their own stuff. </li>
<li>He has a great quote on what OS they use:“So, dogfood: Obviously FreeBSD. Apart from the obvious reason that I wrote a lot of FreeBSD and can get world-class support by bugging my buddies about it, there are two equally serious reasons for the Varnish Project to run on FreeBSD: Dogfood and jails.Varnish Cache is not “software for Linux”, it is software for any competent UNIX-like operating system, and FreeBSD is our primary “keep us honest about this” platform.“</li>
<li>He then goes through the process of explaining how they would setup a new Varnish-cache website, or upgrade it. </li>
<li>All together a great read, and if you are one of the admin-types, you really should pay attention to how they build from the ground up. Some valuable knowledge here which every admin should try to replicate.</li>
<li>I can not reiterate the value of having your config files in a private source control repo strongly enough</li>
<li>The biggest take-away is: “And by doing it this way, I know it will work next time also.”
***</li>
</ul>

<h2>Interview - Matt Macy - <a href="mailto:mmacy@nextbsd.org" rel="nofollow">mmacy@nextbsd.org</a><a href="https://lists.freebsd.org/pipermail/freebsd-x11/2016-May/017560.html" rel="nofollow">Graphics Stack Update</a></h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-pkgbase/2016-May/000238.html" rel="nofollow">Followup on packaging base with pkg(8)</a></h3>

<ul>
<li>In spite of the heroic last minute effort by a team of contributors, pkg’d base will not be ready in time for FreeBSD 11.0</li>
<li>There are just too many issues that were discovered during testing</li>
<li>The plan is to continue using freebsd-update in the meantime, and introduce a pkg based upgrade mechanism in FreeBSD 11.1</li>
<li>With the new support model for the FreeBSD 11 branch, 11.1 may come sooner than with previous major releases
***</li>
</ul>

<h3><a href="https://www.freebsd.org/internal/bylaws.html" rel="nofollow">FreeBSD Core Election</a></h3>

<ul>
<li>It is time once again for the FreeBSD Core Election</li>
<li>Application period begins: Wednesday, 18 May 2016 at 18:00:00 UTC</li>
<li>Application period ends: Wednesday, 25 May 2016 at 18:00:00 UTC</li>
<li>Voting begins: Wednesday, 25 May 2016 at 18:00:00 UTC</li>
<li>Voting ends: Wednesday, 22 June 2016 at 18:00:00 UTC</li>
<li>Results announced Wednesday, 29 June 2016</li>
<li>New core team takes office: Wednesday, 6 July 2016</li>
<li>As of the time I was writing these notes, 3 hours before the application deadline, the candidates are:</li>
<li>Allan Jude: Filling in the potholes</li>
<li>Marcelo Araujo: We are not vampires, but we need new blood.</li>
<li>Baptiste Daroussin (incumbent): Keep on improving</li>
<li>Benedict Reuschling: Learn and Teach</li>
<li>Benno Rice: Revitalising The Community</li>
<li>Devin Teske: Here to help</li>
<li>Ed Maste (incumbent): FreeBSD is people</li>
<li>George V. Neville-Neil (incumbent): There is much to do…</li>
<li>Hiroki Sato (incumbent): Keep up with our good community and technical strength</li>
<li>John Baldwin: Ready to work</li>
<li>Juli Mallett: Caring for community.</li>
<li>Kris Moore: User-Focused</li>
<li>Mathieu Arnold: Someone ask for fresh blood ?</li>
<li>Ollivier Robert: Caring for the project and you, its developers</li>
<li>The deadline for applications is around the time we finish recording the live show</li>
<li>We welcome any of the candidates to schedule an interview in the next few weeks. We will make an attempt to hunt many of them down at BSDCan as well.
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2016-May/249620.html" rel="nofollow">Wayland/Weston with XWayland works on DragonFly</a></h3>

<ul>
<li>We haven’t talked a lot about Wayland on BSD recently (or much at all), but today we have a post from Peter to the dragonfly mailing list, detailing his experience with it.</li>
<li>Specifically he talks about getting XWayland working, which provides the compat bits for native X applications to run on WayLand displays.</li>
<li>So far on the working list of apps:
“gtk3:

<ul>
<li>gedit</li>
<li>nautilus</li>
<li>evince</li>
</ul></li>
</ul>

<p>xfce4:</p>

<ul>
<li>xfce4-terminal</li>
<li><p>atril</p>

<ul>
<li>firefox</li>
<li>spyder</li>
<li>scilab”</li>
<li>A pretty impressive list, although he said “chrome” failed with a seg-fault</li>
<li>This is something I’m personally interested in. Now with the newer DRM bits landing in FreeBSD, perhaps it’s time for some further looking into Wayland.
***</li>
</ul></li>
</ul>

<h3><a href="http://adrianchadd.blogspot.ca/2016/05/updating-broadcom-softmac-driver-bwn-or.html" rel="nofollow">Broadcom WiFi driver update</a></h3>

<ul>
<li>In this blog post Adrian Chadd talks about his recent work on the bwn(4) driver for Broadcom WiFi chips</li>
<li>This work has added support for a number of older 802.11g chips, including the one from 2009-era Macbooks</li>
<li>Work is ongoing, and the hope is to add 802.11n and 5ghz support as well</li>
<li>Adrian is mentoring a number of developers working on embedded or wifi related things, to try to increase the projects bandwidth in those areas</li>
<li>If you are interested in driver development, or wifi internals, the blog post has lots of interesting details and covers the story of Adrian’s recent adventures in bringing the drivers up
***</li>
</ul>

<h3>Beastie Bits</h3>

<p><a href="http://arxiv.org/abs/1605.05810" rel="nofollow">The Design of the NetBSD I/O Subsystems (2002)</a></p>

<p><a href="http://www.ilsistemista.net/index.php/virtualization/47-zfs-btrfs-xfs-ext4-and-lvm-with-kvm-a-storage-performance-comparison.html?print=true" rel="nofollow">ZFS, BTRFS, XFS, EXT4 and LVM with KVM – a storage performance comparison</a> </p>

<p><a href="http://www.freshports.org/lang/swift/" rel="nofollow">Swift added to FreeBSD Ports</a></p>

<p><a href="http://marc.info/?l=openbsd-misc&m=146391388912602&w=2" rel="nofollow">misc@openbsd: &#39;NSA addition to ifconfig&#39;</a></p>

<p><a href="http://paperswelove.org/2015/video/ryan-zezeski-memory-by-the-slab/" rel="nofollow">Papers We Love: Memory by the Slab: The Tale of Bonwick&#39;s Slab Allocator </a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/HRRyfxev" rel="nofollow"> Lars - Poudriere</a> </li>
<li><a href="http://pastebin.com/fESV1egk" rel="nofollow"> Warren - .NET</a> </li>
<li><a href="http://pastebin.com/kQecpA1X" rel="nofollow"> Eddy - Sys Init</a> </li>
<li><a href="http://pastebin.com/5096cGXr" rel="nofollow"> Tim - ZFS Resources</a> </li>
<li><a href="http://pastebin.com/rYr1CDcV" rel="nofollow"> Morgan - Ports and Kernel</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we have an interview with Matthew Macy, who has some exciting news to share with us regarding the state of graphics</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.cochard.me/2016/05/playing-with-freebsd-packet-filter.html" rel="nofollow">How the number of states affects pf’s performance of FreeBSD</a></h3>

<ul>
<li> Our friend Olivier of FreeNAS and BSDRP fame has an interesting blog post this week detailing his unique issue with finding a firewall that can handle upwards of 4 million state table entries.</li>
<li>He begins in the article with benchmarking the defaults, since without that we don’t have a framework to compare the later results.  All done on his  Netgate RCC-VE 4860 (4 cores ATOM C2558, 8GB RAM) under FreeBSD 10.3.</li>
<li>“We notice a little performance impact when we reach the default 10K state table limit: From 413Kpps with 128 states in-used, it lower to 372Kpps.”</li>
<li>With the initial benchmarks done and graphed, he then starts the tuning process by adjusting the “net.pf.states_hashsize”sysctl, and then playing with the number of states for the firewall to keep.</li>
<li>“For the next bench, the number of flow will be fixed for generating 9800 pf state entries, but I will try different value of pf.states_hashsize until the maximum allowed on my 8GB RAM server (still with the default max states of 10k):”</li>
<li>Then he cranks it up to 4 million states</li>
<li>“There is only 12% performance penalty between pf 128 pf states and 4 million pf states.”</li>
<li>“With 10M state, pf performance lower to 362Kpps: Still only 12% lower performance than with only 128 states”</li>
<li>He then looks at what this does of pfsync, the protocol to sync the state table between two redundant pf firewalls</li>
<li>Conclusions:</li>
</ul>

<p>There need to be a linear relationship between the pf hard-limit of states and the pf.states_hashsize; RAM needed for pf.states_hashsize = pf.states_hashsize * 80 Byte and pf.states_hashsize should be a power of 2 (from the manual page); Even small hardware can manage large number of sessions (it&#39;s a matter of RAM),  but under too lot&#39;s of pressure pfsync will suffer.</p>

<hr>

<h3><a href="http://www.learnbchs.org/" rel="nofollow">Introducing the BCHS Stack = BSD, C, httpd, SQLite</a></h3>

<ul>
<li>Pronounced Beaches</li>
<li>“It&#39;s a hipster-free, open source software stack for web applications”</li>
<li>“Don&#39;t just write C. Write portable and secure C.”</li>
<li>“Get to know your security tools. OpenBSD has systrace(4) and pledge(2). FreeBSD has capsicum(4).”</li>
<li>“Statically scan your binary with LLVM” and “Run your application under valgrind”</li>
<li>“Don&#39;t forget: BSD is a community of professionals. Go to conferences (EuroBSDCon, AsiaBSDCon, BSDCan, etc.)”</li>
<li>This seems like a really interesting project, we’ll have to get Kristaps Dzonsons back on the show to talk about it
***</li>
</ul>

<h3><a href="https://www.rootbsd.net/kb/339/Installing-OpenBSDandsharp039s-httpd-server-MariaDB-PHP-56-on-OpenBSD-59.html" rel="nofollow">Installing OpenBSD&#39;s httpd server, MariaDB, PHP 5.6 on OpenBSD 5.9</a></h3>

<ul>
<li>Looking to deploy your next web-stack on OpenBSD 5.9? If so this next article from rootbsd.net is for you.</li>
<li>Specifically it will walk you through the process of getting OpenBSD’s own httpd server up and running, followed by MariaDB and PHP 5.6.</li>
<li>Most of the setup is pretty straight-forward, the httpd syntax may be different to you, if this is your first time trying it out.</li>
<li>Once the various packages are installed / configured, the rest of the tutorial will be easy, walking you through the standard hello world PHP script, and enabling the services to run at reboot.</li>
<li>A good article for those wanting to start hosting PHP/DB content (wordpress anyone?) on your OpenBSD system.
***</li>
</ul>

<h3><a href="https://www.varnish-cache.org/news/20160425_website.html" rel="nofollow">The infrastructure behind Varnish </a></h3>

<ul>
<li>Dogfooding. It’s a term you hear often in the software community, which essentially means to “Run your own stuff”. Today we have an article by PKH over at varnish-cache, talking about what that means to them.</li>
<li>Specifically, they recently went through a website upgrade, which will enable them to run more of their own stuff. </li>
<li>He has a great quote on what OS they use:“So, dogfood: Obviously FreeBSD. Apart from the obvious reason that I wrote a lot of FreeBSD and can get world-class support by bugging my buddies about it, there are two equally serious reasons for the Varnish Project to run on FreeBSD: Dogfood and jails.Varnish Cache is not “software for Linux”, it is software for any competent UNIX-like operating system, and FreeBSD is our primary “keep us honest about this” platform.“</li>
<li>He then goes through the process of explaining how they would setup a new Varnish-cache website, or upgrade it. </li>
<li>All together a great read, and if you are one of the admin-types, you really should pay attention to how they build from the ground up. Some valuable knowledge here which every admin should try to replicate.</li>
<li>I can not reiterate the value of having your config files in a private source control repo strongly enough</li>
<li>The biggest take-away is: “And by doing it this way, I know it will work next time also.”
***</li>
</ul>

<h2>Interview - Matt Macy - <a href="mailto:mmacy@nextbsd.org" rel="nofollow">mmacy@nextbsd.org</a><a href="https://lists.freebsd.org/pipermail/freebsd-x11/2016-May/017560.html" rel="nofollow">Graphics Stack Update</a></h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-pkgbase/2016-May/000238.html" rel="nofollow">Followup on packaging base with pkg(8)</a></h3>

<ul>
<li>In spite of the heroic last minute effort by a team of contributors, pkg’d base will not be ready in time for FreeBSD 11.0</li>
<li>There are just too many issues that were discovered during testing</li>
<li>The plan is to continue using freebsd-update in the meantime, and introduce a pkg based upgrade mechanism in FreeBSD 11.1</li>
<li>With the new support model for the FreeBSD 11 branch, 11.1 may come sooner than with previous major releases
***</li>
</ul>

<h3><a href="https://www.freebsd.org/internal/bylaws.html" rel="nofollow">FreeBSD Core Election</a></h3>

<ul>
<li>It is time once again for the FreeBSD Core Election</li>
<li>Application period begins: Wednesday, 18 May 2016 at 18:00:00 UTC</li>
<li>Application period ends: Wednesday, 25 May 2016 at 18:00:00 UTC</li>
<li>Voting begins: Wednesday, 25 May 2016 at 18:00:00 UTC</li>
<li>Voting ends: Wednesday, 22 June 2016 at 18:00:00 UTC</li>
<li>Results announced Wednesday, 29 June 2016</li>
<li>New core team takes office: Wednesday, 6 July 2016</li>
<li>As of the time I was writing these notes, 3 hours before the application deadline, the candidates are:</li>
<li>Allan Jude: Filling in the potholes</li>
<li>Marcelo Araujo: We are not vampires, but we need new blood.</li>
<li>Baptiste Daroussin (incumbent): Keep on improving</li>
<li>Benedict Reuschling: Learn and Teach</li>
<li>Benno Rice: Revitalising The Community</li>
<li>Devin Teske: Here to help</li>
<li>Ed Maste (incumbent): FreeBSD is people</li>
<li>George V. Neville-Neil (incumbent): There is much to do…</li>
<li>Hiroki Sato (incumbent): Keep up with our good community and technical strength</li>
<li>John Baldwin: Ready to work</li>
<li>Juli Mallett: Caring for community.</li>
<li>Kris Moore: User-Focused</li>
<li>Mathieu Arnold: Someone ask for fresh blood ?</li>
<li>Ollivier Robert: Caring for the project and you, its developers</li>
<li>The deadline for applications is around the time we finish recording the live show</li>
<li>We welcome any of the candidates to schedule an interview in the next few weeks. We will make an attempt to hunt many of them down at BSDCan as well.
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2016-May/249620.html" rel="nofollow">Wayland/Weston with XWayland works on DragonFly</a></h3>

<ul>
<li>We haven’t talked a lot about Wayland on BSD recently (or much at all), but today we have a post from Peter to the dragonfly mailing list, detailing his experience with it.</li>
<li>Specifically he talks about getting XWayland working, which provides the compat bits for native X applications to run on WayLand displays.</li>
<li>So far on the working list of apps:
“gtk3:

<ul>
<li>gedit</li>
<li>nautilus</li>
<li>evince</li>
</ul></li>
</ul>

<p>xfce4:</p>

<ul>
<li>xfce4-terminal</li>
<li><p>atril</p>

<ul>
<li>firefox</li>
<li>spyder</li>
<li>scilab”</li>
<li>A pretty impressive list, although he said “chrome” failed with a seg-fault</li>
<li>This is something I’m personally interested in. Now with the newer DRM bits landing in FreeBSD, perhaps it’s time for some further looking into Wayland.
***</li>
</ul></li>
</ul>

<h3><a href="http://adrianchadd.blogspot.ca/2016/05/updating-broadcom-softmac-driver-bwn-or.html" rel="nofollow">Broadcom WiFi driver update</a></h3>

<ul>
<li>In this blog post Adrian Chadd talks about his recent work on the bwn(4) driver for Broadcom WiFi chips</li>
<li>This work has added support for a number of older 802.11g chips, including the one from 2009-era Macbooks</li>
<li>Work is ongoing, and the hope is to add 802.11n and 5ghz support as well</li>
<li>Adrian is mentoring a number of developers working on embedded or wifi related things, to try to increase the projects bandwidth in those areas</li>
<li>If you are interested in driver development, or wifi internals, the blog post has lots of interesting details and covers the story of Adrian’s recent adventures in bringing the drivers up
***</li>
</ul>

<h3>Beastie Bits</h3>

<p><a href="http://arxiv.org/abs/1605.05810" rel="nofollow">The Design of the NetBSD I/O Subsystems (2002)</a></p>

<p><a href="http://www.ilsistemista.net/index.php/virtualization/47-zfs-btrfs-xfs-ext4-and-lvm-with-kvm-a-storage-performance-comparison.html?print=true" rel="nofollow">ZFS, BTRFS, XFS, EXT4 and LVM with KVM – a storage performance comparison</a> </p>

<p><a href="http://www.freshports.org/lang/swift/" rel="nofollow">Swift added to FreeBSD Ports</a></p>

<p><a href="http://marc.info/?l=openbsd-misc&m=146391388912602&w=2" rel="nofollow">misc@openbsd: &#39;NSA addition to ifconfig&#39;</a></p>

<p><a href="http://paperswelove.org/2015/video/ryan-zezeski-memory-by-the-slab/" rel="nofollow">Papers We Love: Memory by the Slab: The Tale of Bonwick&#39;s Slab Allocator </a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/HRRyfxev" rel="nofollow"> Lars - Poudriere</a> </li>
<li><a href="http://pastebin.com/fESV1egk" rel="nofollow"> Warren - .NET</a> </li>
<li><a href="http://pastebin.com/kQecpA1X" rel="nofollow"> Eddy - Sys Init</a> </li>
<li><a href="http://pastebin.com/5096cGXr" rel="nofollow"> Tim - ZFS Resources</a> </li>
<li><a href="http://pastebin.com/rYr1CDcV" rel="nofollow"> Morgan - Ports and Kernel</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>142: Diving for BSD Perls</title>
  <link>https://www.bsdnow.tv/142</link>
  <guid isPermaLink="false">0a4f8b9a-8fcf-431a-9247-afadb21893c0</guid>
  <pubDate>Wed, 18 May 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0a4f8b9a-8fcf-431a-9247-afadb21893c0.mp3" length="69742804" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we have all the latest news and stories! Plus an interview with BSD developer Alfred Perlstein, that you</itunes:subtitle>
  <itunes:duration>1:36:51</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we have all the latest news and stories! Plus an interview with BSD developer Alfred Perlstein, that you
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
The May issus of BSDMag is now out (https://bsdmag.org/download/reusing_openbsd/)
GhostBSD
Reusing OpenBSD's arc4random in multi-threaded user space programs
Securing VPN's with GRE / Strongswan
Installing XFCE 4.12 on NetBSD 7
Interview with Fernando Rodriguez, the co-founder of KeepCoding
***
A rundown of the FPTW^XEXT.1 security reqiurement for General Purpose Operating Systems by the NSA (http://blog.acumensecurity.net/fpt_wx_ext-1-a-rundown/)
NIST/NSA Validation Scheme Report (https://www.commoncriteriaportal.org/files/ppfiles/pp_os_v4.1-vr.pdf) 
The SFR or Security Functional Requirement requires that; "The OS shall prevent allocation of any memory region with both write and execute permissions except for [assignment: list of exceptions]."
While nearly all operating systems currently support the use of the NX bit, or the equivalent on processors such as SPARC and ARM, and will correctly mark the stack as non-executable, the fact remains that this in and of itself is deemed insufficient by NIST and NSA.
OpenBSD 5.8, FreeBSD, Solaris, RHEL, and most other Linux distro have failed.
HardenedBSD passes all three tests out of the box.
NetBSD will do so with a single sysctl tweak. Since they are using the PaX model, anything else using PaX, such as a grsecurity-enabled Linux distribution pass these assurance activities as well.
OpenBSD 5.9 does not allow memory mapping due to W^X being enforced by the kernel, however the kernel will panic if there are any attempts to create such mappings.
***
DistroWatch reviews new features in FreeBSD 10.3 (https://distrowatch.com/weekly.php?issue=20160516#freebsd)
DistroWatch did a review of FreeBSD 10.3
They ran into a few problems, but hopefully those can be fixed
An issue with beadm setting the canmount property incorrectly causing the ZFS BE menu to not work as expected should be resolved in the next version, thanks to a patch from kmoore
The limitations of the Linux 64 support are what they are, CentOS 6 is still fairly popular with enterprise software, but hopefully some folks are interested in working on bringing the syscall emulation forward
In a third issue, the reviewer seemed to have issues SSHing from inside the jail. This likely has to do with how they got a console in the jail. I remember having problems with this in the past, something about a secure console.
***
BSD Unix: Power to the people, from the code (https://www.salon.com/2000/05/16/chapter_2_part_one/)
Salon.com has a very long article, chronicling much of the history behind BSD UNIX.
It starts with detailing the humble origins of BSD, starting with Bill Joy in the mid-70’s, and then goes through details on how it rapidly grew, and the influence that the University of Berkeley had on open-source. 
“But too much focus on Joy, a favorite target for business magazine hagiography, obscures the larger picture. Berkeley’s most important contribution was not software; it was the way Berkeley created software. At Berkeley, a small core group — never more than four people at any one time — coordinated the contributions of an ever-growing network of far-flung, mostly volunteer programmers into progressive releases of steadily improving software. In so doing, they codified a template for what is now referred to as the “open-source software development methodology.” Put more simply, the Berkeley hackers set up a system for creating free software.”
The article goes on to talk about some of the back and forth between Linux and BSD, and why Linux has captured more of the market in recent years, but BSD is far from throwing in the towel.
“BSD patriots argue that the battle is far from over, that BSD is technically superior and will therefore win in the end. That’s for the future to determine. What’s indisputable is BSD’s contribution in the past. Even if, by 1975, Berkeley’s Free Speech Movement was a relic belonging to a fast-fading generation, on the fourth floor of Evans Hall, where Joy shared an office, the free-software movement was just beginning.”
An excellent article (If a bit long), but well worth your time to understand the origins of what we consider modern day BSD, and how the University of Berkley helped shape it.
***
iXsystems (http://ixsystems.com)
#ServerEnvy: It's over 10,000 Terabytes! (https://www.ixsystems.com/blog/serverenvy-10000-terabytes/) 
***
Interview - Alfred Perlstein - alfred@freebsd.org (mailto:alfred@freebsd.org) / @splbio (https://twitter.com/splbio)
Using BSD for projects
***
News Roundup
.NET framework ported to NetBSD (https://github.com/dotnet/coreclr/pull/4504/files)
This pull request adds basic support for the .NET framework on NetBSD 7.x amd64
It includes documentation on how to get the .NET framework installed
It uses pkgsrc to bootstrap the required tools
pkgsrc-wip is used to get the actual .NET framework, as porting is still in progress
The .NET Core-CLR is now available for: FreeBSD, Linux, NetBSD, and OS X
***
OpenBSD SROP mitigation – call for testing (https://marc.info/?l=openbsd-tech&amp;amp;m=146281531025185&amp;amp;w=2)
A new technique for exploiting flaws in applications and operating systems has been developed, called SROP
“we describe Sigreturn Oriented Programming (SROP), a novel technique for exploits and   backdoors in UNIX-like systems. Like return-oriented programming (ROP), sigreturn  oriented  programming  constructs  what  is  known  as a  ‘weird  machine’  that  can  be  programmed  by  attackers  to change  the  behavior  of  a  process.  To  program  the  machine, attackers  set  up  fake  signal  frames  and  initiate  returns  from signals that the kernel never really delivered. This is possible, because  UNIX  stores  signal  frames  on  the  process’  stack.”
“Sigreturn oriented programming is interesting for attackers, OS  developers  and  academics.  For  attackers,  the  technique is  very  versatile,  with  pre-conditions  that  are  different  from those  of  existing  exploitation  techniques  like  ROP.  Moreover, unlike  ROP,  sigreturn  oriented  programming  programs  are portable. For OS developers, the technique presents a problem that has been present in one of the two main operating system families  from  its  inception,  while  the  fixes  (which  we  also present)  are  non-trivial.  From  a  more  academic  viewpoint,  it is  also  interesting  because  we  show  that  sigreturn  oriented programming  is  Turing  complete.”
Paper describing SROP  (http://www.cs.vu.nl/~herbertb/papers/srop_sp14.pdf) 
OpenBSD has developed a mitigation against SROP
“Utilizing a trick from kbind(2), the kernel now only accepts signal returns from the PC address of the sigreturn(2) syscall in the signal trampoline.  Since the signal trampoline page is randomized placed per process, it is only known by directly returning from a signal handler.”
“As well, the sigcontext provided to sigreturn(2) now contains a magic cookie constructed from a per-process cookie XOR'd against the address of the signal context.”
This is just a draft of the patch, not yet considered production quality
***
Running Tor in a NetBSD rump unikernel (https://github.com/supradix/rumprun-packages/tree/33d9cc3a65a39e32b4bc8034c151a5d7e0b89f66/tor)
We’ve talked about “rump” kernels before, and also Tor pretty frequently, but this new github project combines the two!
Specifically, this set of Makefile and scripts will prep a system to run Tor via the Unikernel through Qemu.
The script mainly describes how to do the initial setup on Linux, using iptables, but could easily be adapted to a BSD if somebody wants to do so. (Send them a pull request with the instructions!)
All in all, this is a fascinating way to run a Tor node or relay, in the most minimal operating environment possible.
***
An update on SSH protocol 1 ("we're most of the way towards fully deprecating SSH protocol 1" (http://lists.mindrot.org/pipermail/openssh-unix-dev/2016-May/035069.html)
Damien Miller has given us an update on the status of the “SSH protocol 1”, and the current plans to deprecate it in an upcoming version of openssh.
“We've had this old protocol in various stages of deprecation for almost 10 years and it has been compile-time disabled for about a year.
Downstream vendors, to their credit, have included this change in recent OS releases by shipping OpenSSH packages that disable protocol 1 by default and/or offering separate, non-default packages to enable it.
This seems to have proceeded far more smoothly than even my most optimistic hopes, so this gives us greater confidence that we can complete the removal of protocol 1 soon. We want to do this partly to hasten the demise of this cryptographic trainwreck, but also because doing so removes a lot of legacy code from OpenSSH that inflates our attack surface. Having it gone will make our jobs quite a bit easier as we maintain and refactor.”
The current time-line looks like removing server-size protocol 1 support this August after OpenSSH 7.4 is released, leaving client-side disabled.
Then a year from now (June 2017) all protocol 1 code will be removed.
Beastie Bits
Last day to get your BSDNow Shirts! Order now, wear at BSDCan! (https://teespring.com/bsdnow) 
Move local government (Austin TX) from Microsoft Windows (incl. Office) to Linux and/or PC-BSD (https://github.com/atxhack4change/2016-project-proposals/issues/15) 
Plan9 boot camp is back... and already at capacity. Another opportunity may come in September (http://lists.nycbug.org/pipermail/talk/2016-May/016642.html) 
Smaller is better - building an openbsd based router (https://functionallyparanoid.com/2016/04/22/smaller-is-better/) 
Baby Unix (https://i.redditmedia.com/KAjSscL9XOUdpIEWBQF1qi3QMr7zWgeETzQM6m3B4mY.jpg?w=1024&amp;amp;s=e8c08a7d4c4cea0256adb69b1e7c1887) 
Security Update for FreeBSD (https://security.freebsd.org/advisories/FreeBSD-SA-16:19.sendmsg.asc) &amp;amp; Another security update for FreeBSD (https://security.freebsd.org/advisories/FreeBSD-SA-16:18.atkbd.asc) 
Feedback/Questions
 Eric - The iX experience (http://pastebin.com/ZknTuKGv) 
 Mike - Building Ports (http://pastebin.com/M760ZmHQ) 
 David - ZFS Backups (http://pastebin.com/Pi0AFghV) 
 James - BSD VPS (http://pastebin.com/EQ7envez) 
 Rich - ZFS Followup (http://pastebin.com/p0HPDisH) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we have all the latest news and stories! Plus an interview with BSD developer Alfred Perlstein, that you</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://bsdmag.org/download/reusing_openbsd/" rel="nofollow">The May issus of BSDMag is now out</a></h3>

<ul>
<li>GhostBSD</li>
<li>Reusing OpenBSD&#39;s arc4random in multi-threaded user space programs</li>
<li>Securing VPN&#39;s with GRE / Strongswan</li>
<li>Installing XFCE 4.12 on NetBSD 7</li>
<li>Interview with Fernando Rodriguez, the co-founder of KeepCoding
***</li>
</ul>

<h3><a href="http://blog.acumensecurity.net/fpt_wx_ext-1-a-rundown/" rel="nofollow">A rundown of the FPT_W<sup>X_EXT.1</sup> security reqiurement for General Purpose Operating Systems by the NSA</a></h3>

<ul>
<li><a href="https://www.commoncriteriaportal.org/files/ppfiles/pp_os_v4.1-vr.pdf" rel="nofollow">NIST/NSA Validation Scheme Report</a> </li>
<li>The SFR or Security Functional Requirement requires that; &quot;The OS shall prevent allocation of any memory region with both write and execute permissions except for [assignment: list of exceptions].&quot;</li>
<li>While nearly all operating systems currently support the use of the NX bit, or the equivalent on processors such as SPARC and ARM, and will correctly mark the stack as non-executable, the fact remains that this in and of itself is deemed insufficient by NIST and NSA.</li>
<li>OpenBSD 5.8, FreeBSD, Solaris, RHEL, and most other Linux distro have failed.</li>
<li>HardenedBSD passes all three tests out of the box.</li>
<li>NetBSD will do so with a single sysctl tweak. Since they are using the PaX model, anything else using PaX, such as a grsecurity-enabled Linux distribution pass these assurance activities as well.</li>
<li>OpenBSD 5.9 does not allow memory mapping due to W<sup>X</sup> being enforced by the kernel, however the kernel will panic if there are any attempts to create such mappings.
***</li>
</ul>

<h3><a href="https://distrowatch.com/weekly.php?issue=20160516#freebsd" rel="nofollow">DistroWatch reviews new features in FreeBSD 10.3</a></h3>

<ul>
<li>DistroWatch did a review of FreeBSD 10.3</li>
<li>They ran into a few problems, but hopefully those can be fixed</li>
<li>An issue with beadm setting the canmount property incorrectly causing the ZFS BE menu to not work as expected should be resolved in the next version, thanks to a patch from kmoore</li>
<li>The limitations of the Linux 64 support are what they are, CentOS 6 is still fairly popular with enterprise software, but hopefully some folks are interested in working on bringing the syscall emulation forward</li>
<li>In a third issue, the reviewer seemed to have issues SSHing from inside the jail. This likely has to do with how they got a console in the jail. I remember having problems with this in the past, something about a secure console.
***</li>
</ul>

<h3><a href="https://www.salon.com/2000/05/16/chapter_2_part_one/" rel="nofollow">BSD Unix: Power to the people, from the code</a></h3>

<ul>
<li>Salon.com has a very long article, chronicling much of the history behind BSD UNIX.</li>
<li>It starts with detailing the humble origins of BSD, starting with Bill Joy in the mid-70’s, and then goes through details on how it rapidly grew, and the influence that the University of Berkeley had on open-source. </li>
</ul>

<blockquote>
<p>“But too much focus on Joy, a favorite target for business magazine hagiography, obscures the larger picture. Berkeley’s most important contribution was not software; it was the way Berkeley created software. At Berkeley, a small core group — never more than four people at any one time — coordinated the contributions of an ever-growing network of far-flung, mostly volunteer programmers into progressive releases of steadily improving software. In so doing, they codified a template for what is now referred to as the “open-source software development methodology.” Put more simply, the Berkeley hackers set up a system for creating free software.”</p>
</blockquote>

<ul>
<li>The article goes on to talk about some of the back and forth between Linux and BSD, and why Linux has captured more of the market in recent years, but BSD is far from throwing in the towel.</li>
</ul>

<blockquote>
<p>“BSD patriots argue that the battle is far from over, that BSD is technically superior and will therefore win in the end. That’s for the future to determine. What’s indisputable is BSD’s contribution in the past. Even if, by 1975, Berkeley’s Free Speech Movement was a relic belonging to a fast-fading generation, on the fourth floor of Evans Hall, where Joy shared an office, the free-software movement was just beginning.”</p>
</blockquote>

<ul>
<li>An excellent article (If a bit long), but well worth your time to understand the origins of what we consider modern day BSD, and how the University of Berkley helped shape it.
***</li>
</ul>

<h3><a href="http://ixsystems.com" rel="nofollow">iXsystems</a></h3>

<ul>
<li><a href="https://www.ixsystems.com/blog/serverenvy-10000-terabytes/" rel="nofollow">#ServerEnvy: It&#39;s over 10,000 Terabytes!</a> 
***</li>
</ul>

<h2>Interview - Alfred Perlstein - <a href="mailto:alfred@freebsd.org" rel="nofollow">alfred@freebsd.org</a> / <a href="https://twitter.com/splbio" rel="nofollow">@splbio</a></h2>

<ul>
<li>Using BSD for projects
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://github.com/dotnet/coreclr/pull/4504/files" rel="nofollow">.NET framework ported to NetBSD</a></h3>

<ul>
<li>This pull request adds basic support for the .NET framework on NetBSD 7.x amd64</li>
<li>It includes documentation on how to get the .NET framework installed</li>
<li>It uses pkgsrc to bootstrap the required tools</li>
<li>pkgsrc-wip is used to get the actual .NET framework, as porting is still in progress</li>
<li>The .NET Core-CLR is now available for: FreeBSD, Linux, NetBSD, and OS X
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-tech&m=146281531025185&w=2" rel="nofollow">OpenBSD SROP mitigation – call for testing</a></h3>

<ul>
<li>A new technique for exploiting flaws in applications and operating systems has been developed, called SROP</li>
<li>“we describe Sigreturn Oriented Programming (SROP), a novel technique for exploits and   backdoors in UNIX-like systems. Like return-oriented programming (ROP), sigreturn  oriented  programming  constructs  what  is  known  as a  ‘weird  machine’  that  can  be  programmed  by  attackers  to change  the  behavior  of  a  process.  To  program  the  machine, attackers  set  up  fake  signal  frames  and  initiate  returns  from signals that the kernel never really delivered. This is possible, because  UNIX  stores  signal  frames  on  the  process’  stack.”</li>
<li>“Sigreturn oriented programming is interesting for attackers, OS  developers  and  academics.  For  attackers,  the  technique is  very  versatile,  with  pre-conditions  that  are  different  from those  of  existing  exploitation  techniques  like  ROP.  Moreover, unlike  ROP,  sigreturn  oriented  programming  programs  are portable. For OS developers, the technique presents a problem that has been present in one of the two main operating system families  from  its  inception,  while  the  fixes  (which  we  also present)  are  non-trivial.  From  a  more  academic  viewpoint,  it is  also  interesting  because  we  show  that  sigreturn  oriented programming  is  Turing  complete.”</li>
<li><a href="http://www.cs.vu.nl/%7Eherbertb/papers/srop_sp14.pdf" rel="nofollow">Paper describing SROP </a> </li>
<li>OpenBSD has developed a mitigation against SROP</li>
<li>“Utilizing a trick from kbind(2), the kernel now only accepts signal returns from the PC address of the sigreturn(2) syscall in the signal trampoline.  Since the signal trampoline page is randomized placed per process, it is only known by directly returning from a signal handler.”</li>
<li>“As well, the sigcontext provided to sigreturn(2) now contains a magic cookie constructed from a per-process cookie XOR&#39;d against the address of the signal context.”</li>
<li>This is just a draft of the patch, not yet considered production quality
***</li>
</ul>

<h3><a href="https://github.com/supradix/rumprun-packages/tree/33d9cc3a65a39e32b4bc8034c151a5d7e0b89f66/tor" rel="nofollow">Running Tor in a NetBSD rump unikernel</a></h3>

<ul>
<li>We’ve talked about “rump” kernels before, and also Tor pretty frequently, but this new github project combines the two!</li>
<li>Specifically, this set of Makefile and scripts will prep a system to run Tor via the Unikernel through Qemu.</li>
<li>The script mainly describes how to do the initial setup on Linux, using iptables, but could easily be adapted to a BSD if somebody wants to do so. (Send them a pull request with the instructions!)</li>
<li>All in all, this is a fascinating way to run a Tor node or relay, in the most minimal operating environment possible.
***</li>
</ul>

<h3><a href="http://lists.mindrot.org/pipermail/openssh-unix-dev/2016-May/035069.html" rel="nofollow">An update on SSH protocol 1 (&quot;we&#39;re most of the way towards fully deprecating SSH protocol 1&quot;</a></h3>

<ul>
<li>Damien Miller has given us an update on the status of the “SSH protocol 1”, and the current plans to deprecate it in an upcoming version of openssh.</li>
</ul>

<blockquote>
<p>“We&#39;ve had this old protocol in various stages of deprecation for almost 10 years and it has been compile-time disabled for about a year.<br>
Downstream vendors, to their credit, have included this change in recent OS releases by shipping OpenSSH packages that disable protocol 1 by default and/or offering separate, non-default packages to enable it.</p>

<p>This seems to have proceeded far more smoothly than even my most optimistic hopes, so this gives us greater confidence that we can complete the removal of protocol 1 soon. We want to do this partly to hasten the demise of this cryptographic trainwreck, but also because doing so removes a lot of legacy code from OpenSSH that inflates our attack surface. Having it gone will make our jobs quite a bit easier as we maintain and refactor.”</p>
</blockquote>

<ul>
<li><p>The current time-line looks like removing server-size protocol 1 support this August after OpenSSH 7.4 is released, leaving client-side disabled.</p></li>
<li><p>Then a year from now (June 2017) all protocol 1 code will be removed.</p>

<hr></li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="https://teespring.com/bsdnow" rel="nofollow">Last day to get your BSDNow Shirts! Order now, wear at BSDCan!</a> </p></li>
<li><p><a href="https://github.com/atxhack4change/2016-project-proposals/issues/15" rel="nofollow">Move local government (Austin TX) from Microsoft Windows (incl. Office) to Linux and/or PC-BSD</a> </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/talk/2016-May/016642.html" rel="nofollow">Plan9 boot camp is back... and already at capacity. Another opportunity may come in September</a> </p></li>
<li><p><a href="https://functionallyparanoid.com/2016/04/22/smaller-is-better/" rel="nofollow">Smaller is better - building an openbsd based router</a> </p></li>
<li><p><a href="https://i.redditmedia.com/KAjSscL9XOUdpIEWBQF1qi3QMr7zWgeETzQM6m3B4mY.jpg?w=1024&s=e8c08a7d4c4cea0256adb69b1e7c1887" rel="nofollow">Baby Unix</a> </p></li>
<li><p><a href="https://security.freebsd.org/advisories/FreeBSD-SA-16:19.sendmsg.asc" rel="nofollow">Security Update for FreeBSD</a> &amp; <a href="https://security.freebsd.org/advisories/FreeBSD-SA-16:18.atkbd.asc" rel="nofollow">Another security update for FreeBSD</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/ZknTuKGv" rel="nofollow"> Eric - The iX experience</a> </li>
<li><a href="http://pastebin.com/M760ZmHQ" rel="nofollow"> Mike - Building Ports</a> </li>
<li><a href="http://pastebin.com/Pi0AFghV" rel="nofollow"> David - ZFS Backups</a> </li>
<li><a href="http://pastebin.com/EQ7envez" rel="nofollow"> James - BSD VPS</a> </li>
<li><a href="http://pastebin.com/p0HPDisH" rel="nofollow"> Rich - ZFS Followup</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we have all the latest news and stories! Plus an interview with BSD developer Alfred Perlstein, that you</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://bsdmag.org/download/reusing_openbsd/" rel="nofollow">The May issus of BSDMag is now out</a></h3>

<ul>
<li>GhostBSD</li>
<li>Reusing OpenBSD&#39;s arc4random in multi-threaded user space programs</li>
<li>Securing VPN&#39;s with GRE / Strongswan</li>
<li>Installing XFCE 4.12 on NetBSD 7</li>
<li>Interview with Fernando Rodriguez, the co-founder of KeepCoding
***</li>
</ul>

<h3><a href="http://blog.acumensecurity.net/fpt_wx_ext-1-a-rundown/" rel="nofollow">A rundown of the FPT_W<sup>X_EXT.1</sup> security reqiurement for General Purpose Operating Systems by the NSA</a></h3>

<ul>
<li><a href="https://www.commoncriteriaportal.org/files/ppfiles/pp_os_v4.1-vr.pdf" rel="nofollow">NIST/NSA Validation Scheme Report</a> </li>
<li>The SFR or Security Functional Requirement requires that; &quot;The OS shall prevent allocation of any memory region with both write and execute permissions except for [assignment: list of exceptions].&quot;</li>
<li>While nearly all operating systems currently support the use of the NX bit, or the equivalent on processors such as SPARC and ARM, and will correctly mark the stack as non-executable, the fact remains that this in and of itself is deemed insufficient by NIST and NSA.</li>
<li>OpenBSD 5.8, FreeBSD, Solaris, RHEL, and most other Linux distro have failed.</li>
<li>HardenedBSD passes all three tests out of the box.</li>
<li>NetBSD will do so with a single sysctl tweak. Since they are using the PaX model, anything else using PaX, such as a grsecurity-enabled Linux distribution pass these assurance activities as well.</li>
<li>OpenBSD 5.9 does not allow memory mapping due to W<sup>X</sup> being enforced by the kernel, however the kernel will panic if there are any attempts to create such mappings.
***</li>
</ul>

<h3><a href="https://distrowatch.com/weekly.php?issue=20160516#freebsd" rel="nofollow">DistroWatch reviews new features in FreeBSD 10.3</a></h3>

<ul>
<li>DistroWatch did a review of FreeBSD 10.3</li>
<li>They ran into a few problems, but hopefully those can be fixed</li>
<li>An issue with beadm setting the canmount property incorrectly causing the ZFS BE menu to not work as expected should be resolved in the next version, thanks to a patch from kmoore</li>
<li>The limitations of the Linux 64 support are what they are, CentOS 6 is still fairly popular with enterprise software, but hopefully some folks are interested in working on bringing the syscall emulation forward</li>
<li>In a third issue, the reviewer seemed to have issues SSHing from inside the jail. This likely has to do with how they got a console in the jail. I remember having problems with this in the past, something about a secure console.
***</li>
</ul>

<h3><a href="https://www.salon.com/2000/05/16/chapter_2_part_one/" rel="nofollow">BSD Unix: Power to the people, from the code</a></h3>

<ul>
<li>Salon.com has a very long article, chronicling much of the history behind BSD UNIX.</li>
<li>It starts with detailing the humble origins of BSD, starting with Bill Joy in the mid-70’s, and then goes through details on how it rapidly grew, and the influence that the University of Berkeley had on open-source. </li>
</ul>

<blockquote>
<p>“But too much focus on Joy, a favorite target for business magazine hagiography, obscures the larger picture. Berkeley’s most important contribution was not software; it was the way Berkeley created software. At Berkeley, a small core group — never more than four people at any one time — coordinated the contributions of an ever-growing network of far-flung, mostly volunteer programmers into progressive releases of steadily improving software. In so doing, they codified a template for what is now referred to as the “open-source software development methodology.” Put more simply, the Berkeley hackers set up a system for creating free software.”</p>
</blockquote>

<ul>
<li>The article goes on to talk about some of the back and forth between Linux and BSD, and why Linux has captured more of the market in recent years, but BSD is far from throwing in the towel.</li>
</ul>

<blockquote>
<p>“BSD patriots argue that the battle is far from over, that BSD is technically superior and will therefore win in the end. That’s for the future to determine. What’s indisputable is BSD’s contribution in the past. Even if, by 1975, Berkeley’s Free Speech Movement was a relic belonging to a fast-fading generation, on the fourth floor of Evans Hall, where Joy shared an office, the free-software movement was just beginning.”</p>
</blockquote>

<ul>
<li>An excellent article (If a bit long), but well worth your time to understand the origins of what we consider modern day BSD, and how the University of Berkley helped shape it.
***</li>
</ul>

<h3><a href="http://ixsystems.com" rel="nofollow">iXsystems</a></h3>

<ul>
<li><a href="https://www.ixsystems.com/blog/serverenvy-10000-terabytes/" rel="nofollow">#ServerEnvy: It&#39;s over 10,000 Terabytes!</a> 
***</li>
</ul>

<h2>Interview - Alfred Perlstein - <a href="mailto:alfred@freebsd.org" rel="nofollow">alfred@freebsd.org</a> / <a href="https://twitter.com/splbio" rel="nofollow">@splbio</a></h2>

<ul>
<li>Using BSD for projects
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://github.com/dotnet/coreclr/pull/4504/files" rel="nofollow">.NET framework ported to NetBSD</a></h3>

<ul>
<li>This pull request adds basic support for the .NET framework on NetBSD 7.x amd64</li>
<li>It includes documentation on how to get the .NET framework installed</li>
<li>It uses pkgsrc to bootstrap the required tools</li>
<li>pkgsrc-wip is used to get the actual .NET framework, as porting is still in progress</li>
<li>The .NET Core-CLR is now available for: FreeBSD, Linux, NetBSD, and OS X
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-tech&m=146281531025185&w=2" rel="nofollow">OpenBSD SROP mitigation – call for testing</a></h3>

<ul>
<li>A new technique for exploiting flaws in applications and operating systems has been developed, called SROP</li>
<li>“we describe Sigreturn Oriented Programming (SROP), a novel technique for exploits and   backdoors in UNIX-like systems. Like return-oriented programming (ROP), sigreturn  oriented  programming  constructs  what  is  known  as a  ‘weird  machine’  that  can  be  programmed  by  attackers  to change  the  behavior  of  a  process.  To  program  the  machine, attackers  set  up  fake  signal  frames  and  initiate  returns  from signals that the kernel never really delivered. This is possible, because  UNIX  stores  signal  frames  on  the  process’  stack.”</li>
<li>“Sigreturn oriented programming is interesting for attackers, OS  developers  and  academics.  For  attackers,  the  technique is  very  versatile,  with  pre-conditions  that  are  different  from those  of  existing  exploitation  techniques  like  ROP.  Moreover, unlike  ROP,  sigreturn  oriented  programming  programs  are portable. For OS developers, the technique presents a problem that has been present in one of the two main operating system families  from  its  inception,  while  the  fixes  (which  we  also present)  are  non-trivial.  From  a  more  academic  viewpoint,  it is  also  interesting  because  we  show  that  sigreturn  oriented programming  is  Turing  complete.”</li>
<li><a href="http://www.cs.vu.nl/%7Eherbertb/papers/srop_sp14.pdf" rel="nofollow">Paper describing SROP </a> </li>
<li>OpenBSD has developed a mitigation against SROP</li>
<li>“Utilizing a trick from kbind(2), the kernel now only accepts signal returns from the PC address of the sigreturn(2) syscall in the signal trampoline.  Since the signal trampoline page is randomized placed per process, it is only known by directly returning from a signal handler.”</li>
<li>“As well, the sigcontext provided to sigreturn(2) now contains a magic cookie constructed from a per-process cookie XOR&#39;d against the address of the signal context.”</li>
<li>This is just a draft of the patch, not yet considered production quality
***</li>
</ul>

<h3><a href="https://github.com/supradix/rumprun-packages/tree/33d9cc3a65a39e32b4bc8034c151a5d7e0b89f66/tor" rel="nofollow">Running Tor in a NetBSD rump unikernel</a></h3>

<ul>
<li>We’ve talked about “rump” kernels before, and also Tor pretty frequently, but this new github project combines the two!</li>
<li>Specifically, this set of Makefile and scripts will prep a system to run Tor via the Unikernel through Qemu.</li>
<li>The script mainly describes how to do the initial setup on Linux, using iptables, but could easily be adapted to a BSD if somebody wants to do so. (Send them a pull request with the instructions!)</li>
<li>All in all, this is a fascinating way to run a Tor node or relay, in the most minimal operating environment possible.
***</li>
</ul>

<h3><a href="http://lists.mindrot.org/pipermail/openssh-unix-dev/2016-May/035069.html" rel="nofollow">An update on SSH protocol 1 (&quot;we&#39;re most of the way towards fully deprecating SSH protocol 1&quot;</a></h3>

<ul>
<li>Damien Miller has given us an update on the status of the “SSH protocol 1”, and the current plans to deprecate it in an upcoming version of openssh.</li>
</ul>

<blockquote>
<p>“We&#39;ve had this old protocol in various stages of deprecation for almost 10 years and it has been compile-time disabled for about a year.<br>
Downstream vendors, to their credit, have included this change in recent OS releases by shipping OpenSSH packages that disable protocol 1 by default and/or offering separate, non-default packages to enable it.</p>

<p>This seems to have proceeded far more smoothly than even my most optimistic hopes, so this gives us greater confidence that we can complete the removal of protocol 1 soon. We want to do this partly to hasten the demise of this cryptographic trainwreck, but also because doing so removes a lot of legacy code from OpenSSH that inflates our attack surface. Having it gone will make our jobs quite a bit easier as we maintain and refactor.”</p>
</blockquote>

<ul>
<li><p>The current time-line looks like removing server-size protocol 1 support this August after OpenSSH 7.4 is released, leaving client-side disabled.</p></li>
<li><p>Then a year from now (June 2017) all protocol 1 code will be removed.</p>

<hr></li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="https://teespring.com/bsdnow" rel="nofollow">Last day to get your BSDNow Shirts! Order now, wear at BSDCan!</a> </p></li>
<li><p><a href="https://github.com/atxhack4change/2016-project-proposals/issues/15" rel="nofollow">Move local government (Austin TX) from Microsoft Windows (incl. Office) to Linux and/or PC-BSD</a> </p></li>
<li><p><a href="http://lists.nycbug.org/pipermail/talk/2016-May/016642.html" rel="nofollow">Plan9 boot camp is back... and already at capacity. Another opportunity may come in September</a> </p></li>
<li><p><a href="https://functionallyparanoid.com/2016/04/22/smaller-is-better/" rel="nofollow">Smaller is better - building an openbsd based router</a> </p></li>
<li><p><a href="https://i.redditmedia.com/KAjSscL9XOUdpIEWBQF1qi3QMr7zWgeETzQM6m3B4mY.jpg?w=1024&s=e8c08a7d4c4cea0256adb69b1e7c1887" rel="nofollow">Baby Unix</a> </p></li>
<li><p><a href="https://security.freebsd.org/advisories/FreeBSD-SA-16:19.sendmsg.asc" rel="nofollow">Security Update for FreeBSD</a> &amp; <a href="https://security.freebsd.org/advisories/FreeBSD-SA-16:18.atkbd.asc" rel="nofollow">Another security update for FreeBSD</a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/ZknTuKGv" rel="nofollow"> Eric - The iX experience</a> </li>
<li><a href="http://pastebin.com/M760ZmHQ" rel="nofollow"> Mike - Building Ports</a> </li>
<li><a href="http://pastebin.com/Pi0AFghV" rel="nofollow"> David - ZFS Backups</a> </li>
<li><a href="http://pastebin.com/EQ7envez" rel="nofollow"> James - BSD VPS</a> </li>
<li><a href="http://pastebin.com/p0HPDisH" rel="nofollow"> Rich - ZFS Followup</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>141: BSD Likes Ike!</title>
  <link>https://www.bsdnow.tv/141</link>
  <guid isPermaLink="false">ce14c795-4c84-4fcb-962e-611036c7abfa</guid>
  <pubDate>Wed, 11 May 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ce14c795-4c84-4fcb-962e-611036c7abfa.mp3" length="72815476" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we have all the latest news and stories! Plus we’ll be hearing more about OpnSense from the man himself, Ike!</itunes:subtitle>
  <itunes:duration>1:41:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we have all the latest news and stories! Plus we’ll be hearing more about OpnSense from the man himself, Ike!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Regarding Embargoes (http://www.tedunangst.com/flak/post/regarding-embargoes)
Our buddy TedU has a great thought piece today on the idea of “embargoes” for security advisories. 
This all stemmed from a recent incident with LibreSSL patches from embargoed OpenSSL vulns, that accidentally got committed too early. 
Ted makes a pretty good case on the difficulties of having embargos, and maybe the reason there shouldn’t be. Couple of quotes to give you a taste:
“There are several difficulties maintaining embargoes. Keeping secrets is against human nature. I don’t want to be the one who leaks, but if I see something that looks like the secret is out, it’s a relief to be able to speak freely. There is a bias towards recognizing such signs where they may not really exist. (Exacerbated by broad embargoes where some parts leak but other parts don’t. It’s actually very hard to tell what’s not publicly known when you know everything.)
The most thorough embargo and release timeline reconstruction is the heartbleed timeline. It’s another great case study. Who exactly decided who were the haves and have nots? Was it determined by who needed to know or who you needed to know? Eventually the dam started to crack.”
“When Cloudflare brags that they get advance notice of vulnerabilities, attracting more customers, and therefore requiring even more early access, how are smaller players to compete? What happens if you’re not big enough to prenotify?
Sometimes vulnerabilities are announced unplanned. Zero day cyber missiles are part of our reality, which means end users don’t really have the luxury of only patching on Tuesday. They need to apply patches when they appear. If applying patches at inconvenient times is a problem, make it not a problem. Not really a gripe about embargoes per se, but the scheduled timing of coordinated release at the end of the embargo is catering to a problem that shouldn’t exist.”
I will admit that CloudFlare bragging around Heartbleed was upsetting
The biggest issue here is the difficulty with coordinating so many open source projects, which are often done by volunteers, in different countries and time zones
The other issue is determining when the secret is “out of the bag”
***
MAJOR ABI BREAK: csu, ld.so, libc, libpthread update (http://www.openbsd.org/faq/current.html#r20160507)
OpenBSD warns those following the -current (development) branch to be careful as they upgrade because of a major ABI break that will result in applications not working
“Handling of single-threaded programs is now closer to multi-threaded, with ld.so and libc.a doing thread information base (TIB) allocation. Threaded programs from before the 2016/03/19 csu and ld.so update will no longer run. An updated ld.so must be built and installed before running make build.”
A special note for those on PowerPC: “PowerPC has been updated to offset the TIB from the hardware register. As a result, all threaded programs are broken until they have been rebuilt with the new libc and libpthread. perl must be built after building the libraries and before building the rest of base.”
“The definitions of environ and __progname for dynamically linked programs have been moved from the C startup code to ld.so(1). An updated ld.so must be built and installed before running make build.”
The link provides instructions on how to update your system properly
***
How to install FreeBSD 10.3 on VMWare Workstation 12 Pro (http://random-notes-of-a-sysadmin.blogspot.be/2016/04/howto-install-freebsd-103-on-vmware.html)
This tutorial starts at the very basics, running through the FreeBSD installer
But then it goes on to configuring the machine specifically for VMWare
After the system has been booted, the tutorial walks through installing the VMWare tools
Then networking is configured in both VMWare and FreeBSD
A small hack is required to make the VMWare tools startup script wait until the network is up
A very nice tutorial for people using VMWare
I am working on a patch to bsdinstall to ensure that the swap partition is put before the main partition, so it can more easily be resized if you later decide you need more space in your VM
the camcontrol reprobe subcommand has been added  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=299371),
“This makes it possible to manually force updating capacity data after the disk got resized. Without it it might be necessary to reboot before FreeBSD notices updated disk size under eg VMWare.”
***
BSD Router project releases v1.59 (https://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.59/)
We’ve talked about the BSD Router project a bit in the past, but today we have a brand new release to bring to you. 
For those who don’t remember, the BSDrp is a router aimed at replacing more of your big-commercial type systems.
First up in the new hotness, we have it based upon recently released FreeBSD 10.3!
In addition, there is a new package: New package: mlvpn (aggregated network links in order to benefit from the bandwidth of multiple links)
Other packages have gotten a bump with this release as well: 
bsnmp-ucd to 0.4.2
dma to 0.11
dmidecode to 3.0
exabgp to 3.4.15
iperf3 to 3.1.2
monit to 5.17
mpd5 to 5.8
openvpn to 2.3.10
python to 2.7.11
quagga to 1.0.20160315
strongswan to 5.4.0
What are you waiting for? Amd64 and i386 images are ready for you to download now. 
Interview - Isaac (.Ike) Levy -
See Ike again at SEMIBug in Troy, Michigan on May 17th (http://semibug.org/) 
***
News Roundup
Tredly - Prebuilt containers on FreeBSD (https://github.com/tredly/)
Discussion regarding its GPLv3 licensing (https://www.reddit.com/r/freebsd/comments/4gggw8/introducing_tredly_containers_for_unix_freebsd/)
A new “container” solution called “Trendly” has started making some news around various tech sites.
In particular, this new project uses FreeBSD as its base OS and jail functionality in the backend.
Their solution seems based around the idea of shipping containers as manifests, such as lists of packages to install and configuration knobs. 
The project is still rather new, and we’ll be keeping an eye on it for the future.
One notable change already though, it was (for some reason) released under GPLv3. Understandably this caused quite a ruckus with various folks in the community, since it’s built specifically on BSD. Since this, the code has been re-licensed as MIT, which is far more in the spirit of a traditional BSD license. 
***
NVMe driver added to NetBSD - ported from OpenBSD (https://www.netbsd.org/changes/changes-8.0.html#nvme%284%29)
NetBSD has gained support for Non-Volatile Memory Express, the new standard for PCIe attached Flash Memory
The change of interface from SATA to NVMe offers a number of advantages, mostly, it doesn’t require the device to pretend to be a spinning disk
One of the biggest advantages is that it supports completing multiple operations at once, with the Intel hardware I have tested, 63 I/Os can happen concurrently, so a very large queue depth is required to keep the device busy. The 64th I/O channel is reserved for administrative commands, to keep them from being delayed by the large queue depth
The device I tested could read at 3800 MB/s, and write 1700MB/s, something that wouldn’t be possible with a normal SSD
It is interesting that NetBSD took the NVMe support from OpenBSD, whereas the FreeBSD implementation was contributed directly by Intel
This may have to do with that fact that OpenBSD’s device model is closer to that of NetBSD
Commit Log  (http://mail-index.netbsd.org/source-changes/2016/05/01/msg074367.html) 
***
New BSDNow T-Shirts (https://teespring.com/bsdnow)
By popular demand, we have created a more subtle BSDNow shirt
Featuring only the smallish BSDNow logo over the left breast
Available in a number of styles (T-Shirt, Women’s T-Shirt, Long Sleeve, and Hoodie) as well as a number of colours: Black, Blue, Grey, and White
The hope is that enough orders come though so we can get them shipped in and your sweaty little hands in time for BSDCan. (I’ll be wearing mine, will you B...SD?)
If you still want one of our now-famous “The Usual BSD’s” t-shirts, you can also indicate your interest here, and once 10 or more shirts are ordered, a reprint will happen automatically (https://teespring.com/bsd105) 
***
PC-BSD 11-CURRENT with Package Base (http://lists.pcbsd.org/pipermail/testing/2016-May/010616.html)
Looking for a way to play with the new FreeBSD base package system?
This month’s PC-BSD -CURRENT image now used packages for base system installation, and is asking for testers to help find bugs.
Known issues so far: 
setuid binaries (Fix in works)
Missing tzone files
Distrib packages
If all that doesn’t scare you away, then give it a whirl! Upgrades for previous APRIL images are now online also.
***
BeastieBits
HardenedBSD + LibreSSL (https://hardenedbsd.org/article/shawn-webb/2016-05-05/libressl-hardenedbsd-base) 
Michael Dexter's talk at LFNW 2016 is the 2nd highest youtube views from this years conference (https://www.youtube.com/watch?v=6k1Mf0c6YW8) 
Why OpenBSD is important to me (http://ggr.com/why-openbsd-is-important-to-me.html) 
Study of nginx-1.9.12 performance/latency on DragonFlyBSD-g67a73 (http://lists.dragonflybsd.org/pipermail/users/2016-May/249581.html) 
Running FreeBSD / OpenBSD / NetBSD as a virtualised guest on Online.net (https://www.geeklan.co.uk/?p=2109) 
The interesting story of how IllumOS syscalls work  (http://zinascii.com/2016/the-illumos-syscall-handler.html) 
The BeaST is the FreeBSD based dual-controller reliable storage system concept with aim to implement ZFS and in-memory cache. (https://mezzantrop.wordpress.com/portfolio/the-beast/) 
Francois Tigeot updates the drm/i915 driver to match what’s in Linux kernel 4.3 (http://lists.dragonflybsd.org/pipermail/commits/2016-May/500352.html) 
FreeBSD is working on the update to Linux Kernel 4.6, we may finally get ahead of Dragonfly!  (https://twitter.com/ed_maste/status/730450314889924608) 
Feedback/Questions
 Oskar - Torrent Jail (http://pastebin.com/RT7tVtQ7) 
 Shane - ZFS Delete (http://pastebin.com/VkpMeims) 
 Adam - Zimbra Port (http://pastebin.com/MmQ00Sv1) 
 Ray - PC-BSD - FrameBuffer (http://pastebin.com/Xx9TkX7A) 
 Richard - ZFS Backups (http://pastebin.com/ncYxqpg3) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we have all the latest news and stories! Plus we’ll be hearing more about OpnSense from the man himself, Ike!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/regarding-embargoes" rel="nofollow">Regarding Embargoes</a></h3>

<ul>
<li>Our buddy TedU has a great thought piece today on the idea of “embargoes” for security advisories. </li>
<li>This all stemmed from a recent incident with LibreSSL patches from embargoed OpenSSL vulns, that accidentally got committed too early. </li>
<li>Ted makes a pretty good case on the difficulties of having embargos, and maybe the reason there shouldn’t be. Couple of quotes to give you a taste:</li>
</ul>

<blockquote>
<p>“There are several difficulties maintaining embargoes. Keeping secrets is against human nature. I don’t want to be the one who leaks, but if I see something that looks like the secret is out, it’s a relief to be able to speak freely. There is a bias towards recognizing such signs where they may not really exist. (Exacerbated by broad embargoes where some parts leak but other parts don’t. It’s actually very hard to tell what’s not publicly known when you know everything.)</p>

<p>The most thorough embargo and release timeline reconstruction is the heartbleed timeline. It’s another great case study. Who exactly decided who were the haves and have nots? Was it determined by who needed to know or who you needed to know? Eventually the dam started to crack.”</p>

<p>“When Cloudflare brags that they get advance notice of vulnerabilities, attracting more customers, and therefore requiring even more early access, how are smaller players to compete? What happens if you’re not big enough to prenotify?</p>

<p>Sometimes vulnerabilities are announced unplanned. Zero day cyber missiles are part of our reality, which means end users don’t really have the luxury of only patching on Tuesday. They need to apply patches when they appear. If applying patches at inconvenient times is a problem, make it not a problem. Not really a gripe about embargoes per se, but the scheduled timing of coordinated release at the end of the embargo is catering to a problem that shouldn’t exist.”</p>
</blockquote>

<ul>
<li>I will admit that CloudFlare bragging around Heartbleed was upsetting</li>
<li>The biggest issue here is the difficulty with coordinating so many open source projects, which are often done by volunteers, in different countries and time zones</li>
<li>The other issue is determining when the secret is “out of the bag”
***</li>
</ul>

<h3><a href="http://www.openbsd.org/faq/current.html#r20160507" rel="nofollow">MAJOR ABI BREAK: csu, ld.so, libc, libpthread update</a></h3>

<ul>
<li>OpenBSD warns those following the -current (development) branch to be careful as they upgrade because of a major ABI break that will result in applications not working</li>
<li>“Handling of single-threaded programs is now closer to multi-threaded, with ld.so and libc.a doing thread information base (TIB) allocation. Threaded programs from before the 2016/03/19 csu and ld.so update will no longer run. An updated ld.so must be built and installed before running make build.”</li>
<li>A special note for those on PowerPC: “PowerPC has been updated to offset the TIB from the hardware register. As a result, all threaded programs are broken until they have been rebuilt with the new libc and libpthread. perl must be built after building the libraries and before building the rest of base.”</li>
<li>“The definitions of environ and __progname for dynamically linked programs have been moved from the C startup code to ld.so(1). An updated ld.so must be built and installed before running make build.”</li>
<li>The link provides instructions on how to update your system properly
***</li>
</ul>

<h3><a href="http://random-notes-of-a-sysadmin.blogspot.be/2016/04/howto-install-freebsd-103-on-vmware.html" rel="nofollow">How to install FreeBSD 10.3 on VMWare Workstation 12 Pro</a></h3>

<ul>
<li>This tutorial starts at the very basics, running through the FreeBSD installer</li>
<li>But then it goes on to configuring the machine specifically for VMWare</li>
<li>After the system has been booted, the tutorial walks through installing the VMWare tools</li>
<li>Then networking is configured in both VMWare and FreeBSD</li>
<li>A small hack is required to make the VMWare tools startup script wait until the network is up</li>
<li>A very nice tutorial for people using VMWare</li>
<li>I am working on a patch to bsdinstall to ensure that the swap partition is put before the main partition, so it can more easily be resized if you later decide you need more space in your VM</li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=299371" rel="nofollow">the camcontrol reprobe subcommand has been added </a>,</li>
<li>“This makes it possible to manually force updating capacity data after the disk got resized. Without it it might be necessary to reboot before FreeBSD notices updated disk size under eg VMWare.”
***</li>
</ul>

<h3><a href="https://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.59/" rel="nofollow">BSD Router project releases v1.59</a></h3>

<ul>
<li>We’ve talked about the BSD Router project a bit in the past, but today we have a brand new release to bring to you. </li>
<li>For those who don’t remember, the BSDrp is a router aimed at replacing more of your big-commercial type systems.</li>
<li>First up in the new hotness, we have it based upon recently released FreeBSD 10.3!</li>
<li>In addition, there is a new package: New package: mlvpn (aggregated network links in order to benefit from the bandwidth of multiple links)</li>
<li><p>Other packages have gotten a bump with this release as well: </p>

<ul>
<li>bsnmp-ucd to 0.4.2</li>
<li>dma to 0.11</li>
<li>dmidecode to 3.0</li>
<li>exabgp to 3.4.15</li>
<li>iperf3 to 3.1.2</li>
<li>monit to 5.17</li>
<li>mpd5 to 5.8</li>
<li>openvpn to 2.3.10</li>
<li>python to 2.7.11</li>
<li>quagga to 1.0.20160315</li>
<li>strongswan to 5.4.0</li>
</ul></li>
<li><p>What are you waiting for? Amd64 and i386 images are ready for you to download now. </p>

<hr></li>
</ul>

<h2>Interview - Isaac (.Ike) Levy -</h2>

<ul>
<li><a href="http://semibug.org/" rel="nofollow">See Ike again at SEMIBug in Troy, Michigan on May 17th</a> 
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://github.com/tredly/" rel="nofollow">Tredly - Prebuilt containers on FreeBSD</a></h3>

<ul>
<li><a href="https://www.reddit.com/r/freebsd/comments/4gggw8/introducing_tredly_containers_for_unix_freebsd/" rel="nofollow">Discussion regarding its GPLv3 licensing</a></li>
<li>A new “container” solution called “Trendly” has started making some news around various tech sites.</li>
<li>In particular, this new project uses FreeBSD as its base OS and jail functionality in the backend.</li>
<li>Their solution seems based around the idea of shipping containers as manifests, such as lists of packages to install and configuration knobs. </li>
<li>The project is still rather new, and we’ll be keeping an eye on it for the future.</li>
<li>One notable change already though, it was (for some reason) released under GPLv3. Understandably this caused quite a ruckus with various folks in the community, since it’s built specifically on BSD. Since this, the code has been re-licensed as MIT, which is far more in the spirit of a traditional BSD license. 
***</li>
</ul>

<h3><a href="https://www.netbsd.org/changes/changes-8.0.html#nvme%284%29" rel="nofollow">NVMe driver added to NetBSD - ported from OpenBSD</a></h3>

<ul>
<li>NetBSD has gained support for Non-Volatile Memory Express, the new standard for PCIe attached Flash Memory</li>
<li>The change of interface from SATA to NVMe offers a number of advantages, mostly, it doesn’t require the device to pretend to be a spinning disk</li>
<li>One of the biggest advantages is that it supports completing multiple operations at once, with the Intel hardware I have tested, 63 I/Os can happen concurrently, so a very large queue depth is required to keep the device busy. The 64th I/O channel is reserved for administrative commands, to keep them from being delayed by the large queue depth</li>
<li>The device I tested could read at 3800 MB/s, and write 1700MB/s, something that wouldn’t be possible with a normal SSD</li>
<li>It is interesting that NetBSD took the NVMe support from OpenBSD, whereas the FreeBSD implementation was contributed directly by Intel</li>
<li>This may have to do with that fact that OpenBSD’s device model is closer to that of NetBSD</li>
<li><a href="http://mail-index.netbsd.org/source-changes/2016/05/01/msg074367.html" rel="nofollow">Commit Log </a> 
***</li>
</ul>

<h3><a href="https://teespring.com/bsdnow" rel="nofollow">New BSDNow T-Shirts</a></h3>

<ul>
<li>By popular demand, we have created a more subtle BSDNow shirt</li>
<li>Featuring only the smallish BSDNow logo over the left breast</li>
<li>Available in a number of styles (T-Shirt, Women’s T-Shirt, Long Sleeve, and Hoodie) as well as a number of colours: Black, Blue, Grey, and White</li>
<li>The hope is that enough orders come though so we can get them shipped in and your sweaty little hands in time for BSDCan. (I’ll be wearing mine, will you B...SD?)</li>
<li><a href="https://teespring.com/bsd105" rel="nofollow">If you still want one of our now-famous “The Usual BSD’s” t-shirts, you can also indicate your interest here, and once 10 or more shirts are ordered, a reprint will happen automatically</a> 
***</li>
</ul>

<h3><a href="http://lists.pcbsd.org/pipermail/testing/2016-May/010616.html" rel="nofollow">PC-BSD 11-CURRENT with Package Base</a></h3>

<ul>
<li>Looking for a way to play with the new FreeBSD base package system?</li>
<li>This month’s PC-BSD -CURRENT image now used packages for base system installation, and is asking for testers to help find bugs.</li>
<li>Known issues so far: 

<ul>
<li>setuid binaries (Fix in works)</li>
<li>Missing tzone files</li>
<li>Distrib packages</li>
</ul></li>
<li>If all that doesn’t scare you away, then give it a whirl! Upgrades for previous APRIL images are now online also.
***</li>
</ul>

<h2>BeastieBits</h2>

<ul>
<li><p><a href="https://hardenedbsd.org/article/shawn-webb/2016-05-05/libressl-hardenedbsd-base" rel="nofollow">HardenedBSD + LibreSSL</a> </p></li>
<li><p><a href="https://www.youtube.com/watch?v=6k1Mf0c6YW8" rel="nofollow">Michael Dexter&#39;s talk at LFNW 2016 is the 2nd highest youtube views from this years conference</a> </p></li>
<li><p><a href="http://ggr.com/why-openbsd-is-important-to-me.html" rel="nofollow">Why OpenBSD is important to me</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-May/249581.html" rel="nofollow">Study of nginx-1.9.12 performance/latency on DragonFlyBSD-g67a73</a> </p></li>
<li><p><a href="https://www.geeklan.co.uk/?p=2109" rel="nofollow">Running FreeBSD / OpenBSD / NetBSD as a virtualised guest on Online.net</a> </p></li>
<li><p><a href="http://zinascii.com/2016/the-illumos-syscall-handler.html" rel="nofollow">The interesting story of how IllumOS syscalls work </a> </p></li>
<li><p><a href="https://mezzantrop.wordpress.com/portfolio/the-beast/" rel="nofollow">The BeaST is the FreeBSD based dual-controller reliable storage system concept with aim to implement ZFS and in-memory cache.</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-May/500352.html" rel="nofollow">Francois Tigeot updates the drm/i915 driver to match what’s in Linux kernel 4.3</a> </p></li>
<li><p><a href="https://twitter.com/ed_maste/status/730450314889924608" rel="nofollow">FreeBSD is working on the update to Linux Kernel 4.6, we may finally get ahead of Dragonfly! </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/RT7tVtQ7" rel="nofollow"> Oskar - Torrent Jail</a> </li>
<li><a href="http://pastebin.com/VkpMeims" rel="nofollow"> Shane - ZFS Delete</a> </li>
<li><a href="http://pastebin.com/MmQ00Sv1" rel="nofollow"> Adam - Zimbra Port</a> </li>
<li><a href="http://pastebin.com/Xx9TkX7A" rel="nofollow"> Ray - PC-BSD - FrameBuffer</a> </li>
<li><a href="http://pastebin.com/ncYxqpg3" rel="nofollow"> Richard - ZFS Backups</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we have all the latest news and stories! Plus we’ll be hearing more about OpnSense from the man himself, Ike!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/regarding-embargoes" rel="nofollow">Regarding Embargoes</a></h3>

<ul>
<li>Our buddy TedU has a great thought piece today on the idea of “embargoes” for security advisories. </li>
<li>This all stemmed from a recent incident with LibreSSL patches from embargoed OpenSSL vulns, that accidentally got committed too early. </li>
<li>Ted makes a pretty good case on the difficulties of having embargos, and maybe the reason there shouldn’t be. Couple of quotes to give you a taste:</li>
</ul>

<blockquote>
<p>“There are several difficulties maintaining embargoes. Keeping secrets is against human nature. I don’t want to be the one who leaks, but if I see something that looks like the secret is out, it’s a relief to be able to speak freely. There is a bias towards recognizing such signs where they may not really exist. (Exacerbated by broad embargoes where some parts leak but other parts don’t. It’s actually very hard to tell what’s not publicly known when you know everything.)</p>

<p>The most thorough embargo and release timeline reconstruction is the heartbleed timeline. It’s another great case study. Who exactly decided who were the haves and have nots? Was it determined by who needed to know or who you needed to know? Eventually the dam started to crack.”</p>

<p>“When Cloudflare brags that they get advance notice of vulnerabilities, attracting more customers, and therefore requiring even more early access, how are smaller players to compete? What happens if you’re not big enough to prenotify?</p>

<p>Sometimes vulnerabilities are announced unplanned. Zero day cyber missiles are part of our reality, which means end users don’t really have the luxury of only patching on Tuesday. They need to apply patches when they appear. If applying patches at inconvenient times is a problem, make it not a problem. Not really a gripe about embargoes per se, but the scheduled timing of coordinated release at the end of the embargo is catering to a problem that shouldn’t exist.”</p>
</blockquote>

<ul>
<li>I will admit that CloudFlare bragging around Heartbleed was upsetting</li>
<li>The biggest issue here is the difficulty with coordinating so many open source projects, which are often done by volunteers, in different countries and time zones</li>
<li>The other issue is determining when the secret is “out of the bag”
***</li>
</ul>

<h3><a href="http://www.openbsd.org/faq/current.html#r20160507" rel="nofollow">MAJOR ABI BREAK: csu, ld.so, libc, libpthread update</a></h3>

<ul>
<li>OpenBSD warns those following the -current (development) branch to be careful as they upgrade because of a major ABI break that will result in applications not working</li>
<li>“Handling of single-threaded programs is now closer to multi-threaded, with ld.so and libc.a doing thread information base (TIB) allocation. Threaded programs from before the 2016/03/19 csu and ld.so update will no longer run. An updated ld.so must be built and installed before running make build.”</li>
<li>A special note for those on PowerPC: “PowerPC has been updated to offset the TIB from the hardware register. As a result, all threaded programs are broken until they have been rebuilt with the new libc and libpthread. perl must be built after building the libraries and before building the rest of base.”</li>
<li>“The definitions of environ and __progname for dynamically linked programs have been moved from the C startup code to ld.so(1). An updated ld.so must be built and installed before running make build.”</li>
<li>The link provides instructions on how to update your system properly
***</li>
</ul>

<h3><a href="http://random-notes-of-a-sysadmin.blogspot.be/2016/04/howto-install-freebsd-103-on-vmware.html" rel="nofollow">How to install FreeBSD 10.3 on VMWare Workstation 12 Pro</a></h3>

<ul>
<li>This tutorial starts at the very basics, running through the FreeBSD installer</li>
<li>But then it goes on to configuring the machine specifically for VMWare</li>
<li>After the system has been booted, the tutorial walks through installing the VMWare tools</li>
<li>Then networking is configured in both VMWare and FreeBSD</li>
<li>A small hack is required to make the VMWare tools startup script wait until the network is up</li>
<li>A very nice tutorial for people using VMWare</li>
<li>I am working on a patch to bsdinstall to ensure that the swap partition is put before the main partition, so it can more easily be resized if you later decide you need more space in your VM</li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=299371" rel="nofollow">the camcontrol reprobe subcommand has been added </a>,</li>
<li>“This makes it possible to manually force updating capacity data after the disk got resized. Without it it might be necessary to reboot before FreeBSD notices updated disk size under eg VMWare.”
***</li>
</ul>

<h3><a href="https://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.59/" rel="nofollow">BSD Router project releases v1.59</a></h3>

<ul>
<li>We’ve talked about the BSD Router project a bit in the past, but today we have a brand new release to bring to you. </li>
<li>For those who don’t remember, the BSDrp is a router aimed at replacing more of your big-commercial type systems.</li>
<li>First up in the new hotness, we have it based upon recently released FreeBSD 10.3!</li>
<li>In addition, there is a new package: New package: mlvpn (aggregated network links in order to benefit from the bandwidth of multiple links)</li>
<li><p>Other packages have gotten a bump with this release as well: </p>

<ul>
<li>bsnmp-ucd to 0.4.2</li>
<li>dma to 0.11</li>
<li>dmidecode to 3.0</li>
<li>exabgp to 3.4.15</li>
<li>iperf3 to 3.1.2</li>
<li>monit to 5.17</li>
<li>mpd5 to 5.8</li>
<li>openvpn to 2.3.10</li>
<li>python to 2.7.11</li>
<li>quagga to 1.0.20160315</li>
<li>strongswan to 5.4.0</li>
</ul></li>
<li><p>What are you waiting for? Amd64 and i386 images are ready for you to download now. </p>

<hr></li>
</ul>

<h2>Interview - Isaac (.Ike) Levy -</h2>

<ul>
<li><a href="http://semibug.org/" rel="nofollow">See Ike again at SEMIBug in Troy, Michigan on May 17th</a> 
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://github.com/tredly/" rel="nofollow">Tredly - Prebuilt containers on FreeBSD</a></h3>

<ul>
<li><a href="https://www.reddit.com/r/freebsd/comments/4gggw8/introducing_tredly_containers_for_unix_freebsd/" rel="nofollow">Discussion regarding its GPLv3 licensing</a></li>
<li>A new “container” solution called “Trendly” has started making some news around various tech sites.</li>
<li>In particular, this new project uses FreeBSD as its base OS and jail functionality in the backend.</li>
<li>Their solution seems based around the idea of shipping containers as manifests, such as lists of packages to install and configuration knobs. </li>
<li>The project is still rather new, and we’ll be keeping an eye on it for the future.</li>
<li>One notable change already though, it was (for some reason) released under GPLv3. Understandably this caused quite a ruckus with various folks in the community, since it’s built specifically on BSD. Since this, the code has been re-licensed as MIT, which is far more in the spirit of a traditional BSD license. 
***</li>
</ul>

<h3><a href="https://www.netbsd.org/changes/changes-8.0.html#nvme%284%29" rel="nofollow">NVMe driver added to NetBSD - ported from OpenBSD</a></h3>

<ul>
<li>NetBSD has gained support for Non-Volatile Memory Express, the new standard for PCIe attached Flash Memory</li>
<li>The change of interface from SATA to NVMe offers a number of advantages, mostly, it doesn’t require the device to pretend to be a spinning disk</li>
<li>One of the biggest advantages is that it supports completing multiple operations at once, with the Intel hardware I have tested, 63 I/Os can happen concurrently, so a very large queue depth is required to keep the device busy. The 64th I/O channel is reserved for administrative commands, to keep them from being delayed by the large queue depth</li>
<li>The device I tested could read at 3800 MB/s, and write 1700MB/s, something that wouldn’t be possible with a normal SSD</li>
<li>It is interesting that NetBSD took the NVMe support from OpenBSD, whereas the FreeBSD implementation was contributed directly by Intel</li>
<li>This may have to do with that fact that OpenBSD’s device model is closer to that of NetBSD</li>
<li><a href="http://mail-index.netbsd.org/source-changes/2016/05/01/msg074367.html" rel="nofollow">Commit Log </a> 
***</li>
</ul>

<h3><a href="https://teespring.com/bsdnow" rel="nofollow">New BSDNow T-Shirts</a></h3>

<ul>
<li>By popular demand, we have created a more subtle BSDNow shirt</li>
<li>Featuring only the smallish BSDNow logo over the left breast</li>
<li>Available in a number of styles (T-Shirt, Women’s T-Shirt, Long Sleeve, and Hoodie) as well as a number of colours: Black, Blue, Grey, and White</li>
<li>The hope is that enough orders come though so we can get them shipped in and your sweaty little hands in time for BSDCan. (I’ll be wearing mine, will you B...SD?)</li>
<li><a href="https://teespring.com/bsd105" rel="nofollow">If you still want one of our now-famous “The Usual BSD’s” t-shirts, you can also indicate your interest here, and once 10 or more shirts are ordered, a reprint will happen automatically</a> 
***</li>
</ul>

<h3><a href="http://lists.pcbsd.org/pipermail/testing/2016-May/010616.html" rel="nofollow">PC-BSD 11-CURRENT with Package Base</a></h3>

<ul>
<li>Looking for a way to play with the new FreeBSD base package system?</li>
<li>This month’s PC-BSD -CURRENT image now used packages for base system installation, and is asking for testers to help find bugs.</li>
<li>Known issues so far: 

<ul>
<li>setuid binaries (Fix in works)</li>
<li>Missing tzone files</li>
<li>Distrib packages</li>
</ul></li>
<li>If all that doesn’t scare you away, then give it a whirl! Upgrades for previous APRIL images are now online also.
***</li>
</ul>

<h2>BeastieBits</h2>

<ul>
<li><p><a href="https://hardenedbsd.org/article/shawn-webb/2016-05-05/libressl-hardenedbsd-base" rel="nofollow">HardenedBSD + LibreSSL</a> </p></li>
<li><p><a href="https://www.youtube.com/watch?v=6k1Mf0c6YW8" rel="nofollow">Michael Dexter&#39;s talk at LFNW 2016 is the 2nd highest youtube views from this years conference</a> </p></li>
<li><p><a href="http://ggr.com/why-openbsd-is-important-to-me.html" rel="nofollow">Why OpenBSD is important to me</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-May/249581.html" rel="nofollow">Study of nginx-1.9.12 performance/latency on DragonFlyBSD-g67a73</a> </p></li>
<li><p><a href="https://www.geeklan.co.uk/?p=2109" rel="nofollow">Running FreeBSD / OpenBSD / NetBSD as a virtualised guest on Online.net</a> </p></li>
<li><p><a href="http://zinascii.com/2016/the-illumos-syscall-handler.html" rel="nofollow">The interesting story of how IllumOS syscalls work </a> </p></li>
<li><p><a href="https://mezzantrop.wordpress.com/portfolio/the-beast/" rel="nofollow">The BeaST is the FreeBSD based dual-controller reliable storage system concept with aim to implement ZFS and in-memory cache.</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-May/500352.html" rel="nofollow">Francois Tigeot updates the drm/i915 driver to match what’s in Linux kernel 4.3</a> </p></li>
<li><p><a href="https://twitter.com/ed_maste/status/730450314889924608" rel="nofollow">FreeBSD is working on the update to Linux Kernel 4.6, we may finally get ahead of Dragonfly! </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/RT7tVtQ7" rel="nofollow"> Oskar - Torrent Jail</a> </li>
<li><a href="http://pastebin.com/VkpMeims" rel="nofollow"> Shane - ZFS Delete</a> </li>
<li><a href="http://pastebin.com/MmQ00Sv1" rel="nofollow"> Adam - Zimbra Port</a> </li>
<li><a href="http://pastebin.com/Xx9TkX7A" rel="nofollow"> Ray - PC-BSD - FrameBuffer</a> </li>
<li><a href="http://pastebin.com/ncYxqpg3" rel="nofollow"> Richard - ZFS Backups</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>140: Tracing it back to BSD</title>
  <link>https://www.bsdnow.tv/140</link>
  <guid isPermaLink="false">2f09a59d-90ec-4052-a4ef-e41c1eaac3be</guid>
  <pubDate>Wed, 04 May 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2f09a59d-90ec-4052-a4ef-e41c1eaac3be.mp3" length="65543188" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, Allan is back in down from Europe! We’ll get to hear some of his wrap-up and get caught up on the latest BSD</itunes:subtitle>
  <itunes:duration>1:31:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, Allan is back in down from Europe! We’ll get to hear some of his wrap-up and get caught up on the latest BSD
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD Quarterly Report (http://www.freebsd.org/news/status/report-2016-01-2016-03.html)
This quarterly status report starts with a rather interesting introduction by Warren Block
ASLR
Porting CEPH to FreeBSD
RCTL I/O Rate Limiting
The Graphics Stack on FreeBSD (Haswell is in, work is progressing on the next update)
CAM I/O Scheduler
NFS Server updates, working around the 16 group limit, and implementing pNFS, allowing NFS to scale beyond a single server
Static Analysis of the FreeBSD Kernel with PVS Studio
PCI-express HotPlug
GitLab Port committed!
WITHFASTDEPEND and other improvements to the FreeBSD build system
Lots of other interesting stuff
***
A Prog By Any Other Name (http://www.tedunangst.com/flak/post/a-prog-by-any-other-name)
Ted Unangst looks at what goes into the name of a program
“Sometimes two similar programs are really the same program with two names. For example, grep and egrep are two commands that perform very similar functions and are therefore implemented as a single program. Running ls -i and observing the inode number of each file will reveal that there is only one file. Calling the program egrep is a shorthand for -E and does the same thing.”
So BSD provides __progname in libc, so a program can tell what its name is
But, what if it has more than one name?
“In fact, every program has three names: its name in the filesystem, the name it has been invoked with, and whatever it believes its own name to be.”
Of course it is not that easy. 
“there’s another set of choices for each name, the full path and the basename”
“It’s even possible on some systems for argv[0] to be NULL.”
He then goes on to rename doas (the OpenBSD light replacement for sudo) to banana and discuss what happens
“On that note, another possible bug is to realize that syslog by default uses progname. A user may be able to evade log monitoring by invoking doas with a different name. (Just fixed.)”
Another interesting article from our friend Ted
***
FreeBSD (https://summerofcode.withgoogle.com/organizations/4892834293350400/) and NetBSD (https://summerofcode.withgoogle.com/organizations/6246531984261120/)   Google Summer of Code projects have been announced
Some FreeBSD highlights:
Add SCSI passthrough to CTL (share an optical drive via iSCSI)
Add USB target mode driver based on CTL (share a USB device via iSCSI)
API to link created /dev entries to sysctl nodes
Implement Ethernet Ring Protection Switching (ERPS)
HD Audio device model in userspace for bhyve
Some NetBSD highlights:
Implement Ext4fs support in ReadOnly mode
NPF and blacklistd web interface
Port U-Boot so it can be compiled on NetBSD
Split debug symbols for pkgsrc builds
***
libressl - more vague priomises (http://www.tedunangst.com/flak/post/libressl-more-vague-promises)
We haven’t had a Ted U article on the show as of late, however this week we get several! In his next entry “LibreSSL, more vague promises”
He then goes into some detail on what has happened with LibreSSL in the past while, as well as future plans going forward. 
“With an eye to the future, what new promises can we make? Some time ago I joked that we only promised to make a better TLS implementation, not a better TLS. Remains true, but fortunately there are people working on that, too. TLS 1.3 support is on the short term watchlist. The good news is we may be ahead of the game, having already removed compression. How much more work can there be?”
“LibreSSL integrated the draft chacha20-poly1305 construction from BoringSSL. The IETF has since standardized a slightly different version because if it were the same it wouldn’t be different. Support for standard variant, and the beginning of deprecation for the existing code, should be landing very shortly. Incidentally, some people got bent out of shape because shipping chacha20 meant exposing non IANA approved numbers to Internet. No promises that won’t happen again.”
***
Interview - Samy Al Bahra - @0xF390 (https://twitter.com/0xF390)
Backtrace
***
News Roundup
systrace(1) is removed for OpenBSD 6.0 (http://marc.info/?l=openbsd-cvs&amp;amp;m=146161167911029&amp;amp;w=2)
OpenBSD has removed systrace, an older mechanism for limiting what syscalls an application can make
It is mostly replaced by the pledge() system
OpenBSD was the first implementation, most others have been unmaintained for some time
The last reported Linux version was for kernel 2.6.1
NetBSD removed systrace in 2007
***
pfSense Video Series: Comprehensive Guide To pfSense 2.3 (https://www.youtube.com/playlist?list=PLE726R7YUJTePGvo0Zga2juUBxxFTH4Bk)
A series of videos (11 so far), about pfSense
Covers Why you would use it, how to pick your hardware, and installation
Then the series covers some networking basics, to make sure you are up to speed before configuring your pfSense
Then a comprehensive tour of the WebUI
Then goes on to cover graphing, backing up and restoring configuration
There are also videos on running DHCP, NTP, and DNS servers
***
DuckDuckGo announces its 2016 FOSS Donations  (https://duck.co/blog/post/303/2016-foss-donations-announcement)
The theme is “raising the standard of trust online”
Supported projects include:
OpenBSD Foundation announces DuckDuckGo as a Gold Sponsor (http://undeadly.org/cgi?action=article&amp;amp;sid=20160503085227&amp;amp;mode=expanded)
the Freedom of the Press Foundation for SecureDrop
the Freenet Project
the CrypTech Project
the Tor Project
Fight for the Future for Save Security
Open Source Technology Improvement Fund for VeraCrypt (based on TrueCrypt)
Riseup Labs for LEAP (LEAP Encryption Access Project)
GPGTools for GPGMail
***
Larry the BSD Guy hangs up his hat at FOSS Force (http://fossforce.com/2016/04/bsd-linuxfest-northwest/)
After 15 years, Larry the BSD Guy has decided to hang it up, and walk into the sunset! (Figuratively of course)
After wrapping up coverage of recent LinuxFest NorthWest (Which he didn’t attend), Larry has decided it’s time for a change and is giving up his column over at FOSS Force, as well as stepping away from all things technical. 
His last write-up is a good one, and he has some nice plugs for both Dru Lavigne and Michael Dexter of the BSD community. 
He will be missed, but we wish him all the luck with the future! He also puts out the plug that FOSS Force will be needing a new columnist in the near future, so if you are interested please let them know!
***
Beastie Bits
If you sponsored “FreeBSD Mastery: Advanced ZFS”, check your mail box  (http://blather.michaelwlucas.com/archives/2648) 
pkg-1.7.0 is an order of magnitude slower than pkg-1.6.4 (https://marc.info/?l=freebsd-ports&amp;amp;m=146001143408868&amp;amp;w=2) -- Caused by a problem not in pkg
LinuxFest Northwest 2016 Recap (https://www.ixsystems.com/blog/linuxfest-northwest-2016/) 
Dru Lavigne's 'Doc like an Egyption' talk from LFNW (https://www.linuxfestnorthwest.org/2016/sessions/doc-egyptian) 
Michael Dexters' 'Switching to BSD from Linux' talk from LFNW (https://www.linuxfestnorthwest.org/2016/sessions/devil-details-switching-bsd-linux) 
Michael Dexters' 'Secrets to enduring user groups' talk from LFNW (https://www.linuxfestnorthwest.org/2016/sessions/20-year-and-counting-secrets-enduring-user-groups) 
January issue of Freebsd Journal online for free (https://www.freebsdfoundation.org/journal/)
Ghost BSD releases 10.3 Alpha1 for testing (http://ghostbsd.org/10.3_alpha1) 
EuroBSDcon 2016 - Call for Papers - Dealine: May 8th (https://www.freebsdnews.com/2016/04/15/eurobsdcon-2016-call-for-papers/)
KnoxBUG Initial Meeting (http://www.knoxbug.org/content/knoxbug-maiden-voyage) 
Photos, slides, and videos from the Open Source Data Center Conference  (https://www.netways.de/en/events_trainings/osdc/archive/osdc2016/)
*** 
Feedback/Questions
 Mohammad - Replication (http://pastebin.com/KDnyWf6Y) 
 John - Rolling new packages (http://pastebin.com/mAbRwbEF) 
Clint - Unicast (http://pastebin.com/BNa6pyir) 
 Bill - GhostBSD (http://pastebin.com/KDjS2Hxa) 
 Charles - BSD Videos (http://pastebin.com/ABUUtzWM) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, Allan is back in down from Europe! We’ll get to hear some of his wrap-up and get caught up on the latest BSD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.freebsd.org/news/status/report-2016-01-2016-03.html" rel="nofollow">FreeBSD Quarterly Report</a></h3>

<ul>
<li>This quarterly status report starts with a rather interesting introduction by Warren Block</li>
<li>ASLR</li>
<li>Porting CEPH to FreeBSD</li>
<li>RCTL I/O Rate Limiting</li>
<li>The Graphics Stack on FreeBSD (Haswell is in, work is progressing on the next update)</li>
<li>CAM I/O Scheduler</li>
<li>NFS Server updates, working around the 16 group limit, and implementing pNFS, allowing NFS to scale beyond a single server</li>
<li>Static Analysis of the FreeBSD Kernel with PVS Studio</li>
<li>PCI-express HotPlug</li>
<li>GitLab Port committed!</li>
<li>WITH_FAST_DEPEND and other improvements to the FreeBSD build system</li>
<li>Lots of other interesting stuff
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/a-prog-by-any-other-name" rel="nofollow">A Prog By Any Other Name</a></h3>

<ul>
<li>Ted Unangst looks at what goes into the name of a program</li>
<li>“Sometimes two similar programs are really the same program with two names. For example, grep and egrep are two commands that perform very similar functions and are therefore implemented as a single program. Running ls -i and observing the inode number of each file will reveal that there is only one file. Calling the program egrep is a shorthand for -E and does the same thing.”</li>
<li>So BSD provides __progname in libc, so a program can tell what its name is</li>
<li>But, what if it has more than one name?</li>
<li>“In fact, every program has three names: its name in the filesystem, the name it has been invoked with, and whatever it believes its own name to be.”</li>
<li>Of course it is not that easy. </li>
<li>“there’s another set of choices for each name, the full path and the basename”</li>
<li>“It’s even possible on some systems for argv[0] to be NULL.”</li>
<li>He then goes on to rename doas (the OpenBSD light replacement for sudo) to banana and discuss what happens</li>
<li>“On that note, another possible bug is to realize that syslog by default uses progname. A user may be able to evade log monitoring by invoking doas with a different name. (Just fixed.)”</li>
<li>Another interesting article from our friend Ted
***</li>
</ul>

<h3><a href="https://summerofcode.withgoogle.com/organizations/4892834293350400/" rel="nofollow">FreeBSD</a> and <a href="https://summerofcode.withgoogle.com/organizations/6246531984261120/" rel="nofollow">NetBSD</a>   Google Summer of Code projects have been announced</h3>

<ul>
<li>Some FreeBSD highlights:

<ul>
<li>Add SCSI passthrough to CTL (share an optical drive via iSCSI)</li>
<li>Add USB target mode driver based on CTL (share a USB device via iSCSI)</li>
<li>API to link created /dev entries to sysctl nodes</li>
<li>Implement Ethernet Ring Protection Switching (ERPS)</li>
<li>HD Audio device model in userspace for bhyve</li>
</ul></li>
<li>Some NetBSD highlights:

<ul>
<li>Implement Ext4fs support in ReadOnly mode</li>
<li>NPF and blacklistd web interface</li>
<li>Port U-Boot so it can be compiled on NetBSD</li>
<li>Split debug symbols for pkgsrc builds
***</li>
</ul></li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/libressl-more-vague-promises" rel="nofollow">libressl - more vague priomises</a></h3>

<ul>
<li>We haven’t had a Ted U article on the show as of late, however this week we get several! In his next entry “LibreSSL, more vague promises”</li>
<li>He then goes into some detail on what has happened with LibreSSL in the past while, as well as future plans going forward. </li>
<li>“With an eye to the future, what new promises can we make? Some time ago I joked that we only promised to make a better TLS implementation, not a better TLS. Remains true, but fortunately there are people working on that, too. TLS 1.3 support is on the short term watchlist. The good news is we may be ahead of the game, having already removed compression. How much more work can there be?”</li>
<li>“LibreSSL integrated the draft chacha20-poly1305 construction from BoringSSL. The IETF has since standardized a slightly different version because if it were the same it wouldn’t be different. Support for standard variant, and the beginning of deprecation for the existing code, should be landing very shortly. Incidentally, some people got bent out of shape because shipping chacha20 meant exposing non IANA approved numbers to Internet. No promises that won’t happen again.”
***</li>
</ul>

<h2>Interview - Samy Al Bahra - <a href="https://twitter.com/0xF390" rel="nofollow">@0xF390</a></h2>

<ul>
<li>Backtrace
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=146161167911029&w=2" rel="nofollow">systrace(1) is removed for OpenBSD 6.0</a></h3>

<ul>
<li>OpenBSD has removed systrace, an older mechanism for limiting what syscalls an application can make</li>
<li>It is mostly replaced by the pledge() system</li>
<li>OpenBSD was the first implementation, most others have been unmaintained for some time</li>
<li>The last reported Linux version was for kernel 2.6.1</li>
<li>NetBSD removed systrace in 2007
***</li>
</ul>

<h3><a href="https://www.youtube.com/playlist?list=PLE726R7YUJTePGvo0Zga2juUBxxFTH4Bk" rel="nofollow">pfSense Video Series: Comprehensive Guide To pfSense 2.3</a></h3>

<ul>
<li>A series of videos (11 so far), about pfSense</li>
<li>Covers Why you would use it, how to pick your hardware, and installation</li>
<li>Then the series covers some networking basics, to make sure you are up to speed before configuring your pfSense</li>
<li>Then a comprehensive tour of the WebUI</li>
<li>Then goes on to cover graphing, backing up and restoring configuration</li>
<li>There are also videos on running DHCP, NTP, and DNS servers
***</li>
</ul>

<h3><a href="https://duck.co/blog/post/303/2016-foss-donations-announcement" rel="nofollow">DuckDuckGo announces its 2016 FOSS Donations </a></h3>

<ul>
<li>The theme is “raising the standard of trust online”</li>
<li>Supported projects include:</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160503085227&mode=expanded" rel="nofollow">OpenBSD Foundation announces DuckDuckGo as a Gold Sponsor</a></li>
<li>the Freedom of the Press Foundation for SecureDrop</li>
<li>the Freenet Project</li>
<li>the CrypTech Project</li>
<li>the Tor Project</li>
<li>Fight for the Future for Save Security</li>
<li>Open Source Technology Improvement Fund for VeraCrypt (based on TrueCrypt)</li>
<li>Riseup Labs for LEAP (LEAP Encryption Access Project)</li>
<li>GPGTools for GPGMail
***</li>
</ul>

<h3><a href="http://fossforce.com/2016/04/bsd-linuxfest-northwest/" rel="nofollow">Larry the BSD Guy hangs up his hat at FOSS Force</a></h3>

<ul>
<li>After 15 years, Larry the BSD Guy has decided to hang it up, and walk into the sunset! (Figuratively of course)</li>
<li>After wrapping up coverage of recent LinuxFest NorthWest (Which he didn’t attend), Larry has decided it’s time for a change and is giving up his column over at FOSS Force, as well as stepping away from all things technical. </li>
<li>His last write-up is a good one, and he has some nice plugs for both Dru Lavigne and Michael Dexter of the BSD community. </li>
<li>He will be missed, but we wish him all the luck with the future! He also puts out the plug that FOSS Force will be needing a new columnist in the near future, so if you are interested please let them know!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://blather.michaelwlucas.com/archives/2648" rel="nofollow">If you sponsored “FreeBSD Mastery: Advanced ZFS”, check your mail box </a> </li>
<li><a href="https://marc.info/?l=freebsd-ports&m=146001143408868&w=2" rel="nofollow">pkg-1.7.0 is an order of magnitude slower than pkg-1.6.4</a> -- Caused by a problem not in pkg</li>
<li><a href="https://www.ixsystems.com/blog/linuxfest-northwest-2016/" rel="nofollow">LinuxFest Northwest 2016 Recap</a> </li>
<li><a href="https://www.linuxfestnorthwest.org/2016/sessions/doc-egyptian" rel="nofollow">Dru Lavigne&#39;s &#39;Doc like an Egyption&#39; talk from LFNW</a> </li>
<li><a href="https://www.linuxfestnorthwest.org/2016/sessions/devil-details-switching-bsd-linux" rel="nofollow">Michael Dexters&#39; &#39;Switching to BSD from Linux&#39; talk from LFNW</a> </li>
<li><a href="https://www.linuxfestnorthwest.org/2016/sessions/20-year-and-counting-secrets-enduring-user-groups" rel="nofollow">Michael Dexters&#39; &#39;Secrets to enduring user groups&#39; talk from LFNW</a> </li>
<li><a href="https://www.freebsdfoundation.org/journal/" rel="nofollow">January issue of Freebsd Journal online for free</a></li>
<li><a href="http://ghostbsd.org/10.3_alpha1" rel="nofollow">Ghost BSD releases 10.3 Alpha1 for testing</a> </li>
<li><a href="https://www.freebsdnews.com/2016/04/15/eurobsdcon-2016-call-for-papers/" rel="nofollow">EuroBSDcon 2016 - Call for Papers - Dealine: May 8th</a></li>
<li><a href="http://www.knoxbug.org/content/knoxbug-maiden-voyage" rel="nofollow">KnoxBUG Initial Meeting</a> </li>
<li><a href="https://www.netways.de/en/events_trainings/osdc/archive/osdc2016/" rel="nofollow">Photos, slides, and videos from the Open Source Data Center Conference </a>
*** </li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/KDnyWf6Y" rel="nofollow"> Mohammad - Replication</a> </li>
<li><a href="http://pastebin.com/mAbRwbEF" rel="nofollow"> John - Rolling new packages</a> </li>
<li><a href="http://pastebin.com/BNa6pyir" rel="nofollow">Clint - Unicast</a> </li>
<li><a href="http://pastebin.com/KDjS2Hxa" rel="nofollow"> Bill - GhostBSD</a> </li>
<li><a href="http://pastebin.com/ABUUtzWM" rel="nofollow"> Charles - BSD Videos</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, Allan is back in down from Europe! We’ll get to hear some of his wrap-up and get caught up on the latest BSD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.freebsd.org/news/status/report-2016-01-2016-03.html" rel="nofollow">FreeBSD Quarterly Report</a></h3>

<ul>
<li>This quarterly status report starts with a rather interesting introduction by Warren Block</li>
<li>ASLR</li>
<li>Porting CEPH to FreeBSD</li>
<li>RCTL I/O Rate Limiting</li>
<li>The Graphics Stack on FreeBSD (Haswell is in, work is progressing on the next update)</li>
<li>CAM I/O Scheduler</li>
<li>NFS Server updates, working around the 16 group limit, and implementing pNFS, allowing NFS to scale beyond a single server</li>
<li>Static Analysis of the FreeBSD Kernel with PVS Studio</li>
<li>PCI-express HotPlug</li>
<li>GitLab Port committed!</li>
<li>WITH_FAST_DEPEND and other improvements to the FreeBSD build system</li>
<li>Lots of other interesting stuff
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/a-prog-by-any-other-name" rel="nofollow">A Prog By Any Other Name</a></h3>

<ul>
<li>Ted Unangst looks at what goes into the name of a program</li>
<li>“Sometimes two similar programs are really the same program with two names. For example, grep and egrep are two commands that perform very similar functions and are therefore implemented as a single program. Running ls -i and observing the inode number of each file will reveal that there is only one file. Calling the program egrep is a shorthand for -E and does the same thing.”</li>
<li>So BSD provides __progname in libc, so a program can tell what its name is</li>
<li>But, what if it has more than one name?</li>
<li>“In fact, every program has three names: its name in the filesystem, the name it has been invoked with, and whatever it believes its own name to be.”</li>
<li>Of course it is not that easy. </li>
<li>“there’s another set of choices for each name, the full path and the basename”</li>
<li>“It’s even possible on some systems for argv[0] to be NULL.”</li>
<li>He then goes on to rename doas (the OpenBSD light replacement for sudo) to banana and discuss what happens</li>
<li>“On that note, another possible bug is to realize that syslog by default uses progname. A user may be able to evade log monitoring by invoking doas with a different name. (Just fixed.)”</li>
<li>Another interesting article from our friend Ted
***</li>
</ul>

<h3><a href="https://summerofcode.withgoogle.com/organizations/4892834293350400/" rel="nofollow">FreeBSD</a> and <a href="https://summerofcode.withgoogle.com/organizations/6246531984261120/" rel="nofollow">NetBSD</a>   Google Summer of Code projects have been announced</h3>

<ul>
<li>Some FreeBSD highlights:

<ul>
<li>Add SCSI passthrough to CTL (share an optical drive via iSCSI)</li>
<li>Add USB target mode driver based on CTL (share a USB device via iSCSI)</li>
<li>API to link created /dev entries to sysctl nodes</li>
<li>Implement Ethernet Ring Protection Switching (ERPS)</li>
<li>HD Audio device model in userspace for bhyve</li>
</ul></li>
<li>Some NetBSD highlights:

<ul>
<li>Implement Ext4fs support in ReadOnly mode</li>
<li>NPF and blacklistd web interface</li>
<li>Port U-Boot so it can be compiled on NetBSD</li>
<li>Split debug symbols for pkgsrc builds
***</li>
</ul></li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/libressl-more-vague-promises" rel="nofollow">libressl - more vague priomises</a></h3>

<ul>
<li>We haven’t had a Ted U article on the show as of late, however this week we get several! In his next entry “LibreSSL, more vague promises”</li>
<li>He then goes into some detail on what has happened with LibreSSL in the past while, as well as future plans going forward. </li>
<li>“With an eye to the future, what new promises can we make? Some time ago I joked that we only promised to make a better TLS implementation, not a better TLS. Remains true, but fortunately there are people working on that, too. TLS 1.3 support is on the short term watchlist. The good news is we may be ahead of the game, having already removed compression. How much more work can there be?”</li>
<li>“LibreSSL integrated the draft chacha20-poly1305 construction from BoringSSL. The IETF has since standardized a slightly different version because if it were the same it wouldn’t be different. Support for standard variant, and the beginning of deprecation for the existing code, should be landing very shortly. Incidentally, some people got bent out of shape because shipping chacha20 meant exposing non IANA approved numbers to Internet. No promises that won’t happen again.”
***</li>
</ul>

<h2>Interview - Samy Al Bahra - <a href="https://twitter.com/0xF390" rel="nofollow">@0xF390</a></h2>

<ul>
<li>Backtrace
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=146161167911029&w=2" rel="nofollow">systrace(1) is removed for OpenBSD 6.0</a></h3>

<ul>
<li>OpenBSD has removed systrace, an older mechanism for limiting what syscalls an application can make</li>
<li>It is mostly replaced by the pledge() system</li>
<li>OpenBSD was the first implementation, most others have been unmaintained for some time</li>
<li>The last reported Linux version was for kernel 2.6.1</li>
<li>NetBSD removed systrace in 2007
***</li>
</ul>

<h3><a href="https://www.youtube.com/playlist?list=PLE726R7YUJTePGvo0Zga2juUBxxFTH4Bk" rel="nofollow">pfSense Video Series: Comprehensive Guide To pfSense 2.3</a></h3>

<ul>
<li>A series of videos (11 so far), about pfSense</li>
<li>Covers Why you would use it, how to pick your hardware, and installation</li>
<li>Then the series covers some networking basics, to make sure you are up to speed before configuring your pfSense</li>
<li>Then a comprehensive tour of the WebUI</li>
<li>Then goes on to cover graphing, backing up and restoring configuration</li>
<li>There are also videos on running DHCP, NTP, and DNS servers
***</li>
</ul>

<h3><a href="https://duck.co/blog/post/303/2016-foss-donations-announcement" rel="nofollow">DuckDuckGo announces its 2016 FOSS Donations </a></h3>

<ul>
<li>The theme is “raising the standard of trust online”</li>
<li>Supported projects include:</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160503085227&mode=expanded" rel="nofollow">OpenBSD Foundation announces DuckDuckGo as a Gold Sponsor</a></li>
<li>the Freedom of the Press Foundation for SecureDrop</li>
<li>the Freenet Project</li>
<li>the CrypTech Project</li>
<li>the Tor Project</li>
<li>Fight for the Future for Save Security</li>
<li>Open Source Technology Improvement Fund for VeraCrypt (based on TrueCrypt)</li>
<li>Riseup Labs for LEAP (LEAP Encryption Access Project)</li>
<li>GPGTools for GPGMail
***</li>
</ul>

<h3><a href="http://fossforce.com/2016/04/bsd-linuxfest-northwest/" rel="nofollow">Larry the BSD Guy hangs up his hat at FOSS Force</a></h3>

<ul>
<li>After 15 years, Larry the BSD Guy has decided to hang it up, and walk into the sunset! (Figuratively of course)</li>
<li>After wrapping up coverage of recent LinuxFest NorthWest (Which he didn’t attend), Larry has decided it’s time for a change and is giving up his column over at FOSS Force, as well as stepping away from all things technical. </li>
<li>His last write-up is a good one, and he has some nice plugs for both Dru Lavigne and Michael Dexter of the BSD community. </li>
<li>He will be missed, but we wish him all the luck with the future! He also puts out the plug that FOSS Force will be needing a new columnist in the near future, so if you are interested please let them know!
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><a href="http://blather.michaelwlucas.com/archives/2648" rel="nofollow">If you sponsored “FreeBSD Mastery: Advanced ZFS”, check your mail box </a> </li>
<li><a href="https://marc.info/?l=freebsd-ports&m=146001143408868&w=2" rel="nofollow">pkg-1.7.0 is an order of magnitude slower than pkg-1.6.4</a> -- Caused by a problem not in pkg</li>
<li><a href="https://www.ixsystems.com/blog/linuxfest-northwest-2016/" rel="nofollow">LinuxFest Northwest 2016 Recap</a> </li>
<li><a href="https://www.linuxfestnorthwest.org/2016/sessions/doc-egyptian" rel="nofollow">Dru Lavigne&#39;s &#39;Doc like an Egyption&#39; talk from LFNW</a> </li>
<li><a href="https://www.linuxfestnorthwest.org/2016/sessions/devil-details-switching-bsd-linux" rel="nofollow">Michael Dexters&#39; &#39;Switching to BSD from Linux&#39; talk from LFNW</a> </li>
<li><a href="https://www.linuxfestnorthwest.org/2016/sessions/20-year-and-counting-secrets-enduring-user-groups" rel="nofollow">Michael Dexters&#39; &#39;Secrets to enduring user groups&#39; talk from LFNW</a> </li>
<li><a href="https://www.freebsdfoundation.org/journal/" rel="nofollow">January issue of Freebsd Journal online for free</a></li>
<li><a href="http://ghostbsd.org/10.3_alpha1" rel="nofollow">Ghost BSD releases 10.3 Alpha1 for testing</a> </li>
<li><a href="https://www.freebsdnews.com/2016/04/15/eurobsdcon-2016-call-for-papers/" rel="nofollow">EuroBSDcon 2016 - Call for Papers - Dealine: May 8th</a></li>
<li><a href="http://www.knoxbug.org/content/knoxbug-maiden-voyage" rel="nofollow">KnoxBUG Initial Meeting</a> </li>
<li><a href="https://www.netways.de/en/events_trainings/osdc/archive/osdc2016/" rel="nofollow">Photos, slides, and videos from the Open Source Data Center Conference </a>
*** </li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/KDnyWf6Y" rel="nofollow"> Mohammad - Replication</a> </li>
<li><a href="http://pastebin.com/mAbRwbEF" rel="nofollow"> John - Rolling new packages</a> </li>
<li><a href="http://pastebin.com/BNa6pyir" rel="nofollow">Clint - Unicast</a> </li>
<li><a href="http://pastebin.com/KDjS2Hxa" rel="nofollow"> Bill - GhostBSD</a> </li>
<li><a href="http://pastebin.com/ABUUtzWM" rel="nofollow"> Charles - BSD Videos</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>139: Cheri-picking BSD</title>
  <link>https://www.bsdnow.tv/139</link>
  <guid isPermaLink="false">5aeb1bdc-48f8-4b0b-b1e6-2bce2bd11ffc</guid>
  <pubDate>Wed, 27 Apr 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5aeb1bdc-48f8-4b0b-b1e6-2bce2bd11ffc.mp3" length="50138068" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week, Allan is out of town, but since when has that ever stopped us from bringing you a new episode of BSDNow? We have news,</itunes:subtitle>
  <itunes:duration>1:09:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week, Allan is out of town, but since when has that ever stopped us from bringing you a new episode of BSDNow? We have news,
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Unix's file durability problem (https://utcc.utoronto.ca/~cks/space/blog/unix/FileSyncProblem)
Another article by Chris Siebenmann from the University of Toronto
This time, the issue was a lost comment on his Python based blog which uses files on disk rather than a database
After an unexpected restart of the system, a recently posted comment no longer existed
The post goes on to investigate what the ‘right way’ to ensure file durability is
The answer, as you might expect, is “it depends…”
Normally, fsync() should work, but it seems with ext4 and some other file systems, you must also fsync() the directory where the file was created, or it might not be possible to find the file after a crash
Do you need to fsync() the parent of that directory too? Then what is fdatasync() for? What about just calling sync()?
“One issue is that unlike many other Unix API issues, it's impossible to test to see if you got it all correct and complete. If your steps are incomplete, you don't get any errors; your data is just silently sometimes at risk. Even with a test setup to create system crashes or abrupt power loss (which VMs make much easier), you need uncommon instrumentation to know things like if your OS actually issued disk flushes or just did normal buffered writes. And straightforward testing can't tell you if what you're doing will work all the time, because what is required varies by Unix, kernel version, and the specific filesystem involved.”
Second post by author: How I'm trying to do durable disk writes  (https://utcc.utoronto.ca/~cks/space/blog/python/HowISyncDataDWiki)
Additional Discussion on Hacker News (https://news.ycombinator.com/item?id=11511269) 
The discussion on HN also gets into AIO and other more complicated facilities, but even those seem to be vague about when your data is actually safe
At least ZFS ensures you never get half of your new data, and half of your old data.
***
Build a FreeBSD 10.3-release Openstack Image with bsd-cloudinit (https://raymii.org/s/tutorials/FreeBSD_10.3-release_Openstack_Image.html)
Are you using FreeBSD and OpenStack or would you like to be? We next have a great tutorial which explains the ins-and-outs of doing exactly that.  
Remy van Elst brings us a great walkthrough on his site on how to get started, and hint it involves just a few ‘pip’ commands. 
After getting the initial Python tools bootstrapped, next he shows us how to save our OpenStack settings in a sourceable shell command, which comes in handy before doing admin on a instance.
Next the ‘glance’ and ‘cinder’ tools are used to upload the target OS ISO file and then create a volume for it to install onto.
Next the VM is started and some specific steps are outlined on getting FreeBSD 10.3 installed into the instance. It includes some helpful hints as how to fix a mountroot error, if you installed to ada0, but need to mount via vtdb0 instead now. 
After the installation is finished, the prep for ‘cloudinit’ is done, and the resulting image is compressed and made ready for deployment. 
We’ve kinda stepped through some of the more gory steps here, but if OpenStack is something you work with, this tutorial should be at the top of your “must read” list.
***
Undeadly and HTTPS (http://undeadly.org/cgi?action=article&amp;amp;sid=20160411201504)
Undeadly, the OpenBSD journal, is thinking of moving to HTTPS only
In order to do this, they would like some help rewriting part of the site
Currently, when you login to post comments, this is done over HTTPS, but to an stunnel instance running a custom script that gives you a cookie, and sends you back to the non-HTTPS site
They would like to better integrate the authentication system, and otherwise improve the code for the site
There is some pushback as well, questioning whether it makes sense to block users who are unable to use HTTPS for one reason or another
I think it makes sense to have the site default to HTTPS, but, maybe HTTPS only doesn’t make sense. There is nothing private on the site, other than the authentication system which is optional, not required to post a comment.
There is also some discussion about the code for the site, including the fact that when the code was released, the salt for the password database was included
This is not actually a security problem, but the discussion may be interesting to some viewers
***
FreeBSD Journal March/April Edition  (https://www.freebsdfoundation.org/journal/browser-based-edition/)
The next issue of the FreeBSD Journal is here, and this time it is about Teaching with Operating Systems
In addition to the usual columns, including: svn update, the ports report, a conference report from FOSDEM, a meetup report from PortsCamp Taipei, A book review of "The Algorithm Design Manual", and the Events Calendar; there are a set of feature articles about teaching
Teaching with FreeBSD through Tracing, Analysis, and Experimentation
CHERI: Building a foundation for secure, trusted computing bases
A brief history of Fast Filesystems
There is also an interview with Gleb Smirnoff, a member of the Core team, release engineering, and the deputy security officer, as well as a senior software developer at Netflix
Get the latest issue from your favourite mobile store, or the “Desktop Edition” directly in your browser from the FreeBSD Foundation’s website
***
Interview - Brooks Davis - brooks@FreeBSD.org (mailto:brooks@FreeBSD.org) / @brooksdavis (https://twitter.com/brooksdavis)
CHERI and Capabilities
***
TrueNAS Three-Peats!!! (https://www.ixsystems.com/blog/truenas-three-peats/)
News Roundup
UbuntuBSD Is Looking To Become An Official Ubuntu Flavor (http://linux.softpedia.com/blog/ubuntubsd-is-looking-to-become-an-official-ubuntu-flavor-502746.shtml)
You may recall a few weeks back that we were a bit surprised by the UbuntuBSD project and its longevity / goals.
However the project seems to be pushing forward, with news on softpedia.com that they are now seeking to become an ‘official’ Ubuntu Flavor. 
They’ve already released a forth beta, so it seems the project currently has some developers pushing it forward:
"I would like to contribute all my work to Ubuntu Community and, if you think it is worthy, make ubuntuBSD an official Ubuntu project like Xubuntu or Edubuntu," said Jon Boden. "If you're interested, please let me know how would you like me to proceed."
It's Just Bits (http://blog.appliedcompscilab.com/its_just_bits/index.html)
We have next an interesting blog post talking about the idea that “It’s just all bits!”
The author then takes us down the idea of no matter how old or mysterious the code may be, in the end it is ending up as bits arranged a certain way.
Then the article transitions and takes us through the idea that old bits, and bits that have grown too large should often be good candidates for replacement by “simpler” bits, using OpenBSD as an example. 
“The OpenBSD community exemplifies this in many ways by taking existing solutions and simplifying them. Processing man pages is as old as Unix, and even in the 21st century OpenBSD has taken the time to rewrite the existing solution to be simpler and safer. It's just bits that need to be turned into other bits. Similarly, OpenBSD has introduced doas as an alternative to sudo. While not replacing sudo entirely, doas makes the 99.99% case of what people use sudo for easier and safer. They are just bits that need to be authenticated. “
All in all, a good read, and it reinforces the point that nothing is really truly “finished”. As computing advances and new technologies / practices are made available, sometimes it makes a lot of sense to go back and re-write things in order to simplify the complexity that has snuck in over time.
***
Disk IO limiting is coming to FreeBSD (https://lists.freebsd.org/pipermail/svn-src-head/2016-April/084288.html)
A much requested feature for both Jails and VM’s on FreeBSD has just landed with experimental support in -HEAD, Disk IO limiting!
The Commit message states as follows:
“Add four new RCTL resources - readbps, readiops, writebps and writeiops,
 for limiting disk (actually filesystem) IO.
 Note that in some cases these limits are not quite precise. It's ok,
 as long as it's within some reasonable bounds.
 Testing - and review of the code, in particular the VFS and VM parts - is
 very welcome.”
Well, what are you waiting for? This is a fantastic new feature which I’m sure will get incorporated into other tools for controlling jails and VM’s down the road.
If you give it a spin, be sure to report back bugs so they can get quashed in time for 11.
***
BeastieBits
PC-BSD 10.3 Is the Last in the Series, PC-BSD 11.0 Arrives Later This Year (http://news.softpedia.com/news/pc-bsd-10-3-is-the-last-in-the-series-pc-bsd-11-0-arrives-later-this-year-502570.shtml)
ASLR now on by default in NetBSD amd64 (http://mail-index.netbsd.org/source-changes/2016/04/10/msg073939.html)
Daniel Bilik's fix for hangs on Baytrail (http://lists.dragonflybsd.org/pipermail/users/2016-April/228682.html) 
Don’t forget about PGCon 2016 (http://www.pgcon.org/2016/) 
Get your paper in for EuroBSDCon 2016, deadline is May 8th (https://2016.eurobsdcon.org/call-for-papers/) 
Feedback/Questions
 John - Destroy all Dataset (http://pastebin.com/QdGWn0TW) 
 Thomas - Misc Questions (http://pastebin.com/43YkwBjP) 
 Ben - ZFS Copy (http://pastebin.com/gdi3pswe)  
 Bryson - SysV IPC (http://pastebin.com/E9n938D1) 
 Drin - IPSEC  (http://pastebin.com/bgGTmbDG) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week, Allan is out of town, but since when has that ever stopped us from bringing you a new episode of BSDNow? We have news,</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FileSyncProblem" rel="nofollow">Unix&#39;s file durability problem</a></h3>

<ul>
<li>Another article by Chris Siebenmann from the University of Toronto</li>
<li>This time, the issue was a lost comment on his Python based blog which uses files on disk rather than a database</li>
<li>After an unexpected restart of the system, a recently posted comment no longer existed</li>
<li>The post goes on to investigate what the ‘right way’ to ensure file durability is</li>
<li>The answer, as you might expect, is “it depends…”</li>
<li>Normally, fsync() should work, but it seems with ext4 and some other file systems, you must also fsync() the directory where the file was created, or it might not be possible to find the file after a crash</li>
<li>Do you need to fsync() the parent of that directory too? Then what is fdatasync() for? What about just calling sync()?</li>
<li>“One issue is that unlike many other Unix API issues, it&#39;s impossible to test to see if you got it all correct and complete. If your steps are incomplete, you don&#39;t get any errors; your data is just silently sometimes at risk. Even with a test setup to create system crashes or abrupt power loss (which VMs make much easier), you need uncommon instrumentation to know things like if your OS actually issued disk flushes or just did normal buffered writes. And straightforward testing can&#39;t tell you if what you&#39;re doing will work all the time, because what is required varies by Unix, kernel version, and the specific filesystem involved.”</li>
<li><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/python/HowISyncDataDWiki" rel="nofollow">Second post by author: How I&#39;m trying to do durable disk writes </a></li>
<li><a href="https://news.ycombinator.com/item?id=11511269" rel="nofollow">Additional Discussion on Hacker News</a> </li>
<li>The discussion on HN also gets into AIO and other more complicated facilities, but even those seem to be vague about when your data is actually safe</li>
<li>At least ZFS ensures you never get half of your new data, and half of your old data.
***</li>
</ul>

<h3><a href="https://raymii.org/s/tutorials/FreeBSD_10.3-release_Openstack_Image.html" rel="nofollow">Build a FreeBSD 10.3-release Openstack Image with bsd-cloudinit</a></h3>

<ul>
<li>Are you using FreeBSD and OpenStack or would you like to be? We next have a great tutorial which explains the ins-and-outs of doing exactly that.<br></li>
<li>Remy van Elst brings us a great walkthrough on his site on how to get started, and hint it involves just a few ‘pip’ commands. </li>
<li>After getting the initial Python tools bootstrapped, next he shows us how to save our OpenStack settings in a sourceable shell command, which comes in handy before doing admin on a instance.</li>
<li>Next the ‘glance’ and ‘cinder’ tools are used to upload the target OS ISO file and then create a volume for it to install onto.</li>
<li>Next the VM is started and some specific steps are outlined on getting FreeBSD 10.3 installed into the instance. It includes some helpful hints as how to fix a mountroot error, if you installed to ada0, but need to mount via vtdb0 instead now. </li>
<li>After the installation is finished, the prep for ‘cloudinit’ is done, and the resulting image is compressed and made ready for deployment. </li>
<li>We’ve kinda stepped through some of the more gory steps here, but if OpenStack is something you work with, this tutorial should be at the top of your “must read” list.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160411201504" rel="nofollow">Undeadly and HTTPS</a></h3>

<ul>
<li>Undeadly, the OpenBSD journal, is thinking of moving to HTTPS only</li>
<li>In order to do this, they would like some help rewriting part of the site</li>
<li>Currently, when you login to post comments, this is done over HTTPS, but to an stunnel instance running a custom script that gives you a cookie, and sends you back to the non-HTTPS site</li>
<li>They would like to better integrate the authentication system, and otherwise improve the code for the site</li>
<li>There is some pushback as well, questioning whether it makes sense to block users who are unable to use HTTPS for one reason or another</li>
<li>I think it makes sense to have the site default to HTTPS, but, maybe HTTPS only doesn’t make sense. There is nothing private on the site, other than the authentication system which is optional, not required to post a comment.</li>
<li>There is also some discussion about the code for the site, including the fact that when the code was released, the salt for the password database was included</li>
<li>This is not actually a security problem, but the discussion may be interesting to some viewers
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/journal/browser-based-edition/" rel="nofollow">FreeBSD Journal March/April Edition </a></h3>

<ul>
<li>The next issue of the FreeBSD Journal is here, and this time it is about Teaching with Operating Systems</li>
<li>In addition to the usual columns, including: svn update, the ports report, a conference report from FOSDEM, a meetup report from PortsCamp Taipei, A book review of &quot;The Algorithm Design Manual&quot;, and the Events Calendar; there are a set of feature articles about teaching</li>
<li>Teaching with FreeBSD through Tracing, Analysis, and Experimentation</li>
<li>CHERI: Building a foundation for secure, trusted computing bases</li>
<li>A brief history of Fast Filesystems</li>
<li>There is also an interview with Gleb Smirnoff, a member of the Core team, release engineering, and the deputy security officer, as well as a senior software developer at Netflix</li>
<li>Get the latest issue from your favourite mobile store, or the “Desktop Edition” directly in your browser from the FreeBSD Foundation’s website
***</li>
</ul>

<h2>Interview - Brooks Davis - <a href="mailto:brooks@FreeBSD.org" rel="nofollow">brooks@FreeBSD.org</a> / <a href="https://twitter.com/brooksdavis" rel="nofollow">@brooksdavis</a></h2>

<ul>
<li>CHERI and Capabilities
***</li>
</ul>

<p><a href="https://www.ixsystems.com/blog/truenas-three-peats/" rel="nofollow">TrueNAS Three-Peats!!!</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://linux.softpedia.com/blog/ubuntubsd-is-looking-to-become-an-official-ubuntu-flavor-502746.shtml" rel="nofollow">UbuntuBSD Is Looking To Become An Official Ubuntu Flavor</a></h3>

<ul>
<li>You may recall a few weeks back that we were a bit surprised by the UbuntuBSD project and its longevity / goals.</li>
<li>However the project seems to be pushing forward, with news on softpedia.com that they are now seeking to become an ‘official’ Ubuntu Flavor. </li>
<li>They’ve already released a forth beta, so it seems the project currently has some developers pushing it forward:</li>
</ul>

<blockquote>
<p>&quot;I would like to contribute all my work to Ubuntu Community and, if you think it is worthy, make ubuntuBSD an official Ubuntu project like Xubuntu or Edubuntu,&quot; said Jon Boden. &quot;If you&#39;re interested, please let me know how would you like me to proceed.&quot;</p>

<hr>
</blockquote>

<h3><a href="http://blog.appliedcompscilab.com/its_just_bits/index.html" rel="nofollow">It&#39;s Just Bits</a></h3>

<ul>
<li>We have next an interesting blog post talking about the idea that “It’s just all bits!”</li>
<li>The author then takes us down the idea of no matter how old or mysterious the code may be, in the end it is ending up as bits arranged a certain way.</li>
<li>Then the article transitions and takes us through the idea that old bits, and bits that have grown too large should often be good candidates for replacement by “simpler” bits, using OpenBSD as an example. </li>
</ul>

<blockquote>
<p>“The OpenBSD community exemplifies this in many ways by taking existing solutions and simplifying them. Processing man pages is as old as Unix, and even in the 21st century OpenBSD has taken the time to rewrite the existing solution to be simpler and safer. It&#39;s just bits that need to be turned into other bits. Similarly, OpenBSD has introduced doas as an alternative to sudo. While not replacing sudo entirely, doas makes the 99.99% case of what people use sudo for easier and safer. They are just bits that need to be authenticated. “</p>
</blockquote>

<ul>
<li>All in all, a good read, and it reinforces the point that nothing is really truly “finished”. As computing advances and new technologies / practices are made available, sometimes it makes a lot of sense to go back and re-write things in order to simplify the complexity that has snuck in over time.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/svn-src-head/2016-April/084288.html" rel="nofollow">Disk IO limiting is coming to FreeBSD</a></h3>

<ul>
<li><p>A much requested feature for both Jails and VM’s on FreeBSD has just landed with experimental support in -HEAD, Disk IO limiting!</p></li>
<li><p>The Commit message states as follows:</p></li>
</ul>

<blockquote>
<p>“Add four new RCTL resources - readbps, readiops, writebps and writeiops,<br>
 for limiting disk (actually filesystem) IO.</p>

<p>Note that in some cases these limits are not quite precise. It&#39;s ok,<br>
 as long as it&#39;s within some reasonable bounds.</p>

<p>Testing - and review of the code, in particular the VFS and VM parts - is<br>
 very welcome.”</p>
</blockquote>

<ul>
<li>Well, what are you waiting for? This is a fantastic new feature which I’m sure will get incorporated into other tools for controlling jails and VM’s down the road.</li>
<li>If you give it a spin, be sure to report back bugs so they can get quashed in time for 11.
***</li>
</ul>

<h3>BeastieBits</h3>

<ul>
<li><p><a href="http://news.softpedia.com/news/pc-bsd-10-3-is-the-last-in-the-series-pc-bsd-11-0-arrives-later-this-year-502570.shtml" rel="nofollow">PC-BSD 10.3 Is the Last in the Series, PC-BSD 11.0 Arrives Later This Year</a></p></li>
<li><p><a href="http://mail-index.netbsd.org/source-changes/2016/04/10/msg073939.html" rel="nofollow">ASLR now on by default in NetBSD amd64</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-April/228682.html" rel="nofollow">Daniel Bilik&#39;s fix for hangs on Baytrail</a> </p></li>
<li><p><a href="http://www.pgcon.org/2016/" rel="nofollow">Don’t forget about PGCon 2016</a> </p></li>
<li><p><a href="https://2016.eurobsdcon.org/call-for-papers/" rel="nofollow">Get your paper in for EuroBSDCon 2016, deadline is May 8th</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/QdGWn0TW" rel="nofollow"> John - Destroy all Dataset</a> </li>
<li><a href="http://pastebin.com/43YkwBjP" rel="nofollow"> Thomas - Misc Questions</a> </li>
<li><a href="http://pastebin.com/gdi3pswe" rel="nofollow"> Ben - ZFS Copy</a><br></li>
<li><a href="http://pastebin.com/E9n938D1" rel="nofollow"> Bryson - SysV IPC</a> </li>
<li><a href="http://pastebin.com/bgGTmbDG" rel="nofollow"> Drin - IPSEC </a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week, Allan is out of town, but since when has that ever stopped us from bringing you a new episode of BSDNow? We have news,</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FileSyncProblem" rel="nofollow">Unix&#39;s file durability problem</a></h3>

<ul>
<li>Another article by Chris Siebenmann from the University of Toronto</li>
<li>This time, the issue was a lost comment on his Python based blog which uses files on disk rather than a database</li>
<li>After an unexpected restart of the system, a recently posted comment no longer existed</li>
<li>The post goes on to investigate what the ‘right way’ to ensure file durability is</li>
<li>The answer, as you might expect, is “it depends…”</li>
<li>Normally, fsync() should work, but it seems with ext4 and some other file systems, you must also fsync() the directory where the file was created, or it might not be possible to find the file after a crash</li>
<li>Do you need to fsync() the parent of that directory too? Then what is fdatasync() for? What about just calling sync()?</li>
<li>“One issue is that unlike many other Unix API issues, it&#39;s impossible to test to see if you got it all correct and complete. If your steps are incomplete, you don&#39;t get any errors; your data is just silently sometimes at risk. Even with a test setup to create system crashes or abrupt power loss (which VMs make much easier), you need uncommon instrumentation to know things like if your OS actually issued disk flushes or just did normal buffered writes. And straightforward testing can&#39;t tell you if what you&#39;re doing will work all the time, because what is required varies by Unix, kernel version, and the specific filesystem involved.”</li>
<li><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/python/HowISyncDataDWiki" rel="nofollow">Second post by author: How I&#39;m trying to do durable disk writes </a></li>
<li><a href="https://news.ycombinator.com/item?id=11511269" rel="nofollow">Additional Discussion on Hacker News</a> </li>
<li>The discussion on HN also gets into AIO and other more complicated facilities, but even those seem to be vague about when your data is actually safe</li>
<li>At least ZFS ensures you never get half of your new data, and half of your old data.
***</li>
</ul>

<h3><a href="https://raymii.org/s/tutorials/FreeBSD_10.3-release_Openstack_Image.html" rel="nofollow">Build a FreeBSD 10.3-release Openstack Image with bsd-cloudinit</a></h3>

<ul>
<li>Are you using FreeBSD and OpenStack or would you like to be? We next have a great tutorial which explains the ins-and-outs of doing exactly that.<br></li>
<li>Remy van Elst brings us a great walkthrough on his site on how to get started, and hint it involves just a few ‘pip’ commands. </li>
<li>After getting the initial Python tools bootstrapped, next he shows us how to save our OpenStack settings in a sourceable shell command, which comes in handy before doing admin on a instance.</li>
<li>Next the ‘glance’ and ‘cinder’ tools are used to upload the target OS ISO file and then create a volume for it to install onto.</li>
<li>Next the VM is started and some specific steps are outlined on getting FreeBSD 10.3 installed into the instance. It includes some helpful hints as how to fix a mountroot error, if you installed to ada0, but need to mount via vtdb0 instead now. </li>
<li>After the installation is finished, the prep for ‘cloudinit’ is done, and the resulting image is compressed and made ready for deployment. </li>
<li>We’ve kinda stepped through some of the more gory steps here, but if OpenStack is something you work with, this tutorial should be at the top of your “must read” list.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160411201504" rel="nofollow">Undeadly and HTTPS</a></h3>

<ul>
<li>Undeadly, the OpenBSD journal, is thinking of moving to HTTPS only</li>
<li>In order to do this, they would like some help rewriting part of the site</li>
<li>Currently, when you login to post comments, this is done over HTTPS, but to an stunnel instance running a custom script that gives you a cookie, and sends you back to the non-HTTPS site</li>
<li>They would like to better integrate the authentication system, and otherwise improve the code for the site</li>
<li>There is some pushback as well, questioning whether it makes sense to block users who are unable to use HTTPS for one reason or another</li>
<li>I think it makes sense to have the site default to HTTPS, but, maybe HTTPS only doesn’t make sense. There is nothing private on the site, other than the authentication system which is optional, not required to post a comment.</li>
<li>There is also some discussion about the code for the site, including the fact that when the code was released, the salt for the password database was included</li>
<li>This is not actually a security problem, but the discussion may be interesting to some viewers
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/journal/browser-based-edition/" rel="nofollow">FreeBSD Journal March/April Edition </a></h3>

<ul>
<li>The next issue of the FreeBSD Journal is here, and this time it is about Teaching with Operating Systems</li>
<li>In addition to the usual columns, including: svn update, the ports report, a conference report from FOSDEM, a meetup report from PortsCamp Taipei, A book review of &quot;The Algorithm Design Manual&quot;, and the Events Calendar; there are a set of feature articles about teaching</li>
<li>Teaching with FreeBSD through Tracing, Analysis, and Experimentation</li>
<li>CHERI: Building a foundation for secure, trusted computing bases</li>
<li>A brief history of Fast Filesystems</li>
<li>There is also an interview with Gleb Smirnoff, a member of the Core team, release engineering, and the deputy security officer, as well as a senior software developer at Netflix</li>
<li>Get the latest issue from your favourite mobile store, or the “Desktop Edition” directly in your browser from the FreeBSD Foundation’s website
***</li>
</ul>

<h2>Interview - Brooks Davis - <a href="mailto:brooks@FreeBSD.org" rel="nofollow">brooks@FreeBSD.org</a> / <a href="https://twitter.com/brooksdavis" rel="nofollow">@brooksdavis</a></h2>

<ul>
<li>CHERI and Capabilities
***</li>
</ul>

<p><a href="https://www.ixsystems.com/blog/truenas-three-peats/" rel="nofollow">TrueNAS Three-Peats!!!</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://linux.softpedia.com/blog/ubuntubsd-is-looking-to-become-an-official-ubuntu-flavor-502746.shtml" rel="nofollow">UbuntuBSD Is Looking To Become An Official Ubuntu Flavor</a></h3>

<ul>
<li>You may recall a few weeks back that we were a bit surprised by the UbuntuBSD project and its longevity / goals.</li>
<li>However the project seems to be pushing forward, with news on softpedia.com that they are now seeking to become an ‘official’ Ubuntu Flavor. </li>
<li>They’ve already released a forth beta, so it seems the project currently has some developers pushing it forward:</li>
</ul>

<blockquote>
<p>&quot;I would like to contribute all my work to Ubuntu Community and, if you think it is worthy, make ubuntuBSD an official Ubuntu project like Xubuntu or Edubuntu,&quot; said Jon Boden. &quot;If you&#39;re interested, please let me know how would you like me to proceed.&quot;</p>

<hr>
</blockquote>

<h3><a href="http://blog.appliedcompscilab.com/its_just_bits/index.html" rel="nofollow">It&#39;s Just Bits</a></h3>

<ul>
<li>We have next an interesting blog post talking about the idea that “It’s just all bits!”</li>
<li>The author then takes us down the idea of no matter how old or mysterious the code may be, in the end it is ending up as bits arranged a certain way.</li>
<li>Then the article transitions and takes us through the idea that old bits, and bits that have grown too large should often be good candidates for replacement by “simpler” bits, using OpenBSD as an example. </li>
</ul>

<blockquote>
<p>“The OpenBSD community exemplifies this in many ways by taking existing solutions and simplifying them. Processing man pages is as old as Unix, and even in the 21st century OpenBSD has taken the time to rewrite the existing solution to be simpler and safer. It&#39;s just bits that need to be turned into other bits. Similarly, OpenBSD has introduced doas as an alternative to sudo. While not replacing sudo entirely, doas makes the 99.99% case of what people use sudo for easier and safer. They are just bits that need to be authenticated. “</p>
</blockquote>

<ul>
<li>All in all, a good read, and it reinforces the point that nothing is really truly “finished”. As computing advances and new technologies / practices are made available, sometimes it makes a lot of sense to go back and re-write things in order to simplify the complexity that has snuck in over time.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/svn-src-head/2016-April/084288.html" rel="nofollow">Disk IO limiting is coming to FreeBSD</a></h3>

<ul>
<li><p>A much requested feature for both Jails and VM’s on FreeBSD has just landed with experimental support in -HEAD, Disk IO limiting!</p></li>
<li><p>The Commit message states as follows:</p></li>
</ul>

<blockquote>
<p>“Add four new RCTL resources - readbps, readiops, writebps and writeiops,<br>
 for limiting disk (actually filesystem) IO.</p>

<p>Note that in some cases these limits are not quite precise. It&#39;s ok,<br>
 as long as it&#39;s within some reasonable bounds.</p>

<p>Testing - and review of the code, in particular the VFS and VM parts - is<br>
 very welcome.”</p>
</blockquote>

<ul>
<li>Well, what are you waiting for? This is a fantastic new feature which I’m sure will get incorporated into other tools for controlling jails and VM’s down the road.</li>
<li>If you give it a spin, be sure to report back bugs so they can get quashed in time for 11.
***</li>
</ul>

<h3>BeastieBits</h3>

<ul>
<li><p><a href="http://news.softpedia.com/news/pc-bsd-10-3-is-the-last-in-the-series-pc-bsd-11-0-arrives-later-this-year-502570.shtml" rel="nofollow">PC-BSD 10.3 Is the Last in the Series, PC-BSD 11.0 Arrives Later This Year</a></p></li>
<li><p><a href="http://mail-index.netbsd.org/source-changes/2016/04/10/msg073939.html" rel="nofollow">ASLR now on by default in NetBSD amd64</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-April/228682.html" rel="nofollow">Daniel Bilik&#39;s fix for hangs on Baytrail</a> </p></li>
<li><p><a href="http://www.pgcon.org/2016/" rel="nofollow">Don’t forget about PGCon 2016</a> </p></li>
<li><p><a href="https://2016.eurobsdcon.org/call-for-papers/" rel="nofollow">Get your paper in for EuroBSDCon 2016, deadline is May 8th</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/QdGWn0TW" rel="nofollow"> John - Destroy all Dataset</a> </li>
<li><a href="http://pastebin.com/43YkwBjP" rel="nofollow"> Thomas - Misc Questions</a> </li>
<li><a href="http://pastebin.com/gdi3pswe" rel="nofollow"> Ben - ZFS Copy</a><br></li>
<li><a href="http://pastebin.com/E9n938D1" rel="nofollow"> Bryson - SysV IPC</a> </li>
<li><a href="http://pastebin.com/bgGTmbDG" rel="nofollow"> Drin - IPSEC </a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>138: Rushing into BSD</title>
  <link>https://www.bsdnow.tv/138</link>
  <guid isPermaLink="false">76132fe6-471f-4b50-bf70-f6fdf784b561</guid>
  <pubDate>Wed, 20 Apr 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/76132fe6-471f-4b50-bf70-f6fdf784b561.mp3" length="69487348" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we will be talking to Benedict Reushling about his role with the FreeBSD foundation and the journey that took him</itunes:subtitle>
  <itunes:duration>1:36:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we will be talking to Benedict Reushling about his role with the FreeBSD foundation and the journey that took him
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
HardenedBSD introduces full PIE support (https://hardenedbsd.org/article/shawn-webb/2016-04-15/introducing-full-pie-support)
PIE base for amd64 and i386
Only nine applications are not compiled as PIEs
Tested PIE base on several amd64 systems, both virtualized and bare metal
Hoped to be to enabled it for ARM64 before or during BSDCan.
Shawn will be bringing ten Raspberry Pi 3 devices (which are ARM64) with to BSDCan, eight of which will be given out to lucky individuals. “We want the BSD community to hack on them and get ARM64/Aarch64 fully functional on them.”
***
Lessons learned from 30 years of MINIX (http://m.cacm.acm.org/magazines/2016/3/198874-lessons-learned-from-30-years-of-minix/fulltext)
Eat your own dog food.
By not relying on idiosyncratic features of the hardware, one makes porting to new platforms much easier.
The Internet is like an elephant; it never forgets.
When standards exist (such as ANSI Standard C) stick to them.
Even after you have adopted a strategy, you should nevertheless reexamine it from time to time.
Keep focused on your real goal, Einstein was right: Things should be as simple as possible but not simpler.
***
pfSense 2.3 released (https://blog.pfsense.org/?p=2008)
Rewrite of the webGUI utilizing Bootstrap
TLS v1.0 disabled for the GUI
Moved to a FreeBSD 10.3-RELEASE base
PHP Upgraded to 5.6
The "Full Backup" feature has been deprecated
Closed 760 total tickets of which 137 are fixed bugs
Known Regressions
OpenVPN topology change
IP aliases with CARP IP parent lose their parent interface association post-upgrade    
IPsec IPComp does not work.
IGMP Proxy does not work with VLAN interfaces.
Many other updates and changes
***
OPNsense 16.1.10 released (https://opnsense.org/opnsense-16-1-10-released/)
openvpn: revive windows installer binaries
system: improved config history and backup pages layout
system: increased backup count default from 30 to 60
system: /var /tmp MFS awareness for crash dumps added
trust: add “IP security IKE intermediate” to server key usage
firmware: moved reboot, halt and defaults pages to new home
languages: updates to Russian, French, German and Japanese
Many other updates and changes
***
Interview - Benedict Reuschling - bcr@freebsd.org (mailto:bcr@freebsd.org)
FreeBSD Foundation in Europe
***
News Roundup
Write opinionated workarounds (http://www.daemonology.net/blog/2016-04-11-write-opinionated-workarounds.html)
Colin Percival has written a great blog post this past week, specifically talking about his policy of writing “opinionated workarounds”.
The idea came about due to his working on multi-platform software, and the frustrations of dealing with POSIX violations
The crux of the post is how he deals with these workarounds. Specifically by only applying them to the particular system in which it was required. And doing so loudly. 
This has some important benefits. First, it doesn’t potentially expose other systems to bugs / security flaws when a workaround doesn’t 
“work” on a system for which it wasn’t designed. Secondly it’s important to complain. Loudly. This lets the user know that they are running on a system that doesn’t adhere to POSIX compliance, and maybe even get the attention of a developer who could remedy the situation.
***
Privilege escalation in calendar(1) (http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-003.txt.asc)
File this one under “Ouch that hurts” a new security vuln has been posted, this time against NetBSD’s ‘calendar’ command.
Specifically it looks like some of the daily scripts uses the ‘-a’ flag, which requires super-user privs in order to process all users calendar files and mail the results.
However the bug occurred because the calendar command didn’t drop priv properly before executing external commands (whoops!)
To workaround you can set run_calendar=NO in the daily.conf file, or apply the fixed binary from upstream.
***
PGCon 2016 (http://www.pgcon.org/2016/)
PGCon 2016 is now only 4 weeks away
The conference will be held at the University of Ottawa (same venue as BSDCan) from May 17th to 20th
Tutorials: 17-18 May 2016 (Tue &amp;amp; Wed)
Talks: 19-20 May 2016 (Thu-Fri)
Wednesday is a developer unconference.
Saturday is a user unconference.
“PGCon is an annual conference for users and developers of PostgreSQL, a leading relational database, which just happens to be open source. PGCon is the place to meet, discuss, build relationships, learn valuable insights, and generally chat about the work you are doing with PostgreSQL. If you want to learn why so many people are moving to PostgreSQL, PGCon will be the place to find out why. Whether you are a casual user or you've been working with PostgreSQL for years, PGCon will have something for you.”
New to PGSQL? Just a user? Long time developers? This conference has something for you. A great lineup of talks (https://www.pgcon.org/2016/schedule/events.en.html), plus unconference days focused on both users and developers
***
CfP EuroBSDCon 2016 (https://2016.eurobsdcon.org/call-for-papers/)
The call for papers has been issued for EuroBSDCon 2016 in Belgrade, Serbia
The conference will be held from the 22nd to 25th of September, 2016
The deadline for talk submissions is: Sunday the 8th of May, 2016
Submit your talk or tutorial proposal before it is too late
***
Beastie Bits
“FreeBSD Mastery: Advanced ZFS” has officially been released  (https://www.michaelwlucas.com/nonfiction/fmaz) 
Support of OpenBSD pledge(2) in programming Languages (https://gist.github.com/ligurio/f6114bd1df371047dd80ea9b8a55c104) 
pkgsrcCon 2016 -Call for Presentations (http://daemonforums.org/showthread.php?t=9781)
Christos Zoulas talks about blacklistd (http://blog.netbsd.org/tnf/entry/talks_about_blacklistd) 
Penguicon 2016 Lucas Track Schedule (http://blather.michaelwlucas.com/archives/2617) 
Feedback/Questions
 Peter - NVME (http://pastebin.com/HiiDpGcT) 
 Jeremy - Wireless Gear (http://pastebin.com/L5XeVS1H) 
 Ted - Rpi2 Packages (http://pastebin.com/yrCEnkWt) - Cross Building Wiki (https://wiki.freebsd.org/FreeBSD/arm/crossbuild) 
 Geoff - Jail Failover (http://pastebin.com/pYFC1vdQ) 
 Zach - Graphical Bhyve? (http://pastebin.com/WEgN0ZVw) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we will be talking to Benedict Reushling about his role with the FreeBSD foundation and the journey that took him</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2016-04-15/introducing-full-pie-support" rel="nofollow">HardenedBSD introduces full PIE support</a></h3>

<ul>
<li>PIE base for amd64 and i386</li>
<li>Only nine applications are not compiled as PIEs</li>
<li>Tested PIE base on several amd64 systems, both virtualized and bare metal</li>
<li>Hoped to be to enabled it for ARM64 before or during BSDCan.</li>
<li>Shawn will be bringing ten Raspberry Pi 3 devices (which are ARM64) with to BSDCan, eight of which will be given out to lucky individuals. “We want the BSD community to hack on them and get ARM64/Aarch64 fully functional on them.”
***</li>
</ul>

<h3><a href="http://m.cacm.acm.org/magazines/2016/3/198874-lessons-learned-from-30-years-of-minix/fulltext" rel="nofollow">Lessons learned from 30 years of MINIX</a></h3>

<ul>
<li>Eat your own dog food.</li>
<li>By not relying on idiosyncratic features of the hardware, one makes porting to new platforms much easier.</li>
<li>The Internet is like an elephant; it never forgets.</li>
<li>When standards exist (such as ANSI Standard C) stick to them.</li>
<li>Even after you have adopted a strategy, you should nevertheless reexamine it from time to time.</li>
<li>Keep focused on your real goal, Einstein was right: Things should be as simple as possible but not simpler.
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=2008" rel="nofollow">pfSense 2.3 released</a></h3>

<ul>
<li>Rewrite of the webGUI utilizing Bootstrap</li>
<li>TLS v1.0 disabled for the GUI</li>
<li>Moved to a FreeBSD 10.3-RELEASE base</li>
<li>PHP Upgraded to 5.6</li>
<li>The &quot;Full Backup&quot; feature has been deprecated</li>
<li>Closed 760 total tickets of which 137 are fixed bugs</li>
<li>Known Regressions</li>
<li>OpenVPN topology change</li>
<li>IP aliases with CARP IP parent lose their parent interface association post-upgrade<br></li>
<li>IPsec IPComp does not work.</li>
<li>IGMP Proxy does not work with VLAN interfaces.</li>
<li>Many other updates and changes
***</li>
</ul>

<h3><a href="https://opnsense.org/opnsense-16-1-10-released/" rel="nofollow">OPNsense 16.1.10 released</a></h3>

<ul>
<li>openvpn: revive windows installer binaries</li>
<li>system: improved config history and backup pages layout</li>
<li>system: increased backup count default from 30 to 60</li>
<li>system: /var /tmp MFS awareness for crash dumps added</li>
<li>trust: add “IP security IKE intermediate” to server key usage</li>
<li>firmware: moved reboot, halt and defaults pages to new home</li>
<li>languages: updates to Russian, French, German and Japanese</li>
<li>Many other updates and changes
***</li>
</ul>

<h2>Interview - Benedict Reuschling - <a href="mailto:bcr@freebsd.org" rel="nofollow">bcr@freebsd.org</a></h2>

<ul>
<li>FreeBSD Foundation in Europe
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.daemonology.net/blog/2016-04-11-write-opinionated-workarounds.html" rel="nofollow">Write opinionated workarounds</a></h3>

<ul>
<li>Colin Percival has written a great blog post this past week, specifically talking about his policy of writing “opinionated workarounds”.</li>
<li>The idea came about due to his working on multi-platform software, and the frustrations of dealing with POSIX violations</li>
<li>The crux of the post is how he deals with these workarounds. Specifically by <em>only</em> applying them to the particular system in which it was required. And doing so loudly. </li>
<li>This has some important benefits. First, it doesn’t potentially expose other systems to bugs / security flaws when a workaround doesn’t 
“work” on a system for which it wasn’t designed. Secondly it’s important to complain. Loudly. This lets the user know that they are running on a system that doesn’t adhere to POSIX compliance, and maybe even get the attention of a developer who could remedy the situation.
***</li>
</ul>

<h3><a href="http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-003.txt.asc" rel="nofollow">Privilege escalation in calendar(1)</a></h3>

<ul>
<li>File this one under “Ouch that hurts” a new security vuln has been posted, this time against NetBSD’s ‘calendar’ command.</li>
<li>Specifically it looks like some of the daily scripts uses the ‘-a’ flag, which requires super-user privs in order to process all users calendar files and mail the results.</li>
<li>However the bug occurred because the calendar command didn’t drop priv properly before executing external commands (whoops!)</li>
<li>To workaround you can set run_calendar=NO in the daily.conf file, or apply the fixed binary from upstream.
***</li>
</ul>

<h3><a href="http://www.pgcon.org/2016/" rel="nofollow">PGCon 2016</a></h3>

<ul>
<li>PGCon 2016 is now only 4 weeks away</li>
<li>The conference will be held at the University of Ottawa (same venue as BSDCan) from May 17th to 20th</li>
<li>Tutorials: 17-18 May 2016 (Tue &amp; Wed)</li>
<li>Talks: 19-20 May 2016 (Thu-Fri)</li>
<li>Wednesday is a developer unconference.</li>
<li>Saturday is a user unconference.</li>
<li>“PGCon is an annual conference for users and developers of PostgreSQL, a leading relational database, which just happens to be open source. PGCon is the place to meet, discuss, build relationships, learn valuable insights, and generally chat about the work you are doing with PostgreSQL. If you want to learn why so many people are moving to PostgreSQL, PGCon will be the place to find out why. Whether you are a casual user or you&#39;ve been working with PostgreSQL for years, PGCon will have something for you.”</li>
<li>New to PGSQL? Just a user? Long time developers? This conference has something for you. <a href="https://www.pgcon.org/2016/schedule/events.en.html" rel="nofollow">A great lineup of talks</a>, plus unconference days focused on both users and developers
***</li>
</ul>

<h3><a href="https://2016.eurobsdcon.org/call-for-papers/" rel="nofollow">CfP EuroBSDCon 2016</a></h3>

<ul>
<li>The call for papers has been issued for EuroBSDCon 2016 in Belgrade, Serbia</li>
<li>The conference will be held from the 22nd to 25th of September, 2016</li>
<li>The deadline for talk submissions is: Sunday the 8th of May, 2016</li>
<li>Submit your talk or tutorial proposal before it is too late
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.michaelwlucas.com/nonfiction/fmaz" rel="nofollow">“FreeBSD Mastery: Advanced ZFS” has officially been released </a> </p></li>
<li><p><a href="https://gist.github.com/ligurio/f6114bd1df371047dd80ea9b8a55c104" rel="nofollow">Support of OpenBSD pledge(2) in programming Languages</a> </p></li>
<li><p><a href="http://daemonforums.org/showthread.php?t=9781" rel="nofollow">pkgsrcCon 2016 -Call for Presentations</a></p></li>
<li><p><a href="http://blog.netbsd.org/tnf/entry/talks_about_blacklistd" rel="nofollow">Christos Zoulas talks about blacklistd</a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2617" rel="nofollow">Penguicon 2016 Lucas Track Schedule</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/HiiDpGcT" rel="nofollow"> Peter - NVME</a> </li>
<li><a href="http://pastebin.com/L5XeVS1H" rel="nofollow"> Jeremy - Wireless Gear</a> </li>
<li><a href="http://pastebin.com/yrCEnkWt" rel="nofollow"> Ted - Rpi2 Packages</a> - <a href="https://wiki.freebsd.org/FreeBSD/arm/crossbuild" rel="nofollow">Cross Building Wiki</a> </li>
<li><a href="http://pastebin.com/pYFC1vdQ" rel="nofollow"> Geoff - Jail Failover</a> </li>
<li><a href="http://pastebin.com/WEgN0ZVw" rel="nofollow"> Zach - Graphical Bhyve?</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we will be talking to Benedict Reushling about his role with the FreeBSD foundation and the journey that took him</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2016-04-15/introducing-full-pie-support" rel="nofollow">HardenedBSD introduces full PIE support</a></h3>

<ul>
<li>PIE base for amd64 and i386</li>
<li>Only nine applications are not compiled as PIEs</li>
<li>Tested PIE base on several amd64 systems, both virtualized and bare metal</li>
<li>Hoped to be to enabled it for ARM64 before or during BSDCan.</li>
<li>Shawn will be bringing ten Raspberry Pi 3 devices (which are ARM64) with to BSDCan, eight of which will be given out to lucky individuals. “We want the BSD community to hack on them and get ARM64/Aarch64 fully functional on them.”
***</li>
</ul>

<h3><a href="http://m.cacm.acm.org/magazines/2016/3/198874-lessons-learned-from-30-years-of-minix/fulltext" rel="nofollow">Lessons learned from 30 years of MINIX</a></h3>

<ul>
<li>Eat your own dog food.</li>
<li>By not relying on idiosyncratic features of the hardware, one makes porting to new platforms much easier.</li>
<li>The Internet is like an elephant; it never forgets.</li>
<li>When standards exist (such as ANSI Standard C) stick to them.</li>
<li>Even after you have adopted a strategy, you should nevertheless reexamine it from time to time.</li>
<li>Keep focused on your real goal, Einstein was right: Things should be as simple as possible but not simpler.
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=2008" rel="nofollow">pfSense 2.3 released</a></h3>

<ul>
<li>Rewrite of the webGUI utilizing Bootstrap</li>
<li>TLS v1.0 disabled for the GUI</li>
<li>Moved to a FreeBSD 10.3-RELEASE base</li>
<li>PHP Upgraded to 5.6</li>
<li>The &quot;Full Backup&quot; feature has been deprecated</li>
<li>Closed 760 total tickets of which 137 are fixed bugs</li>
<li>Known Regressions</li>
<li>OpenVPN topology change</li>
<li>IP aliases with CARP IP parent lose their parent interface association post-upgrade<br></li>
<li>IPsec IPComp does not work.</li>
<li>IGMP Proxy does not work with VLAN interfaces.</li>
<li>Many other updates and changes
***</li>
</ul>

<h3><a href="https://opnsense.org/opnsense-16-1-10-released/" rel="nofollow">OPNsense 16.1.10 released</a></h3>

<ul>
<li>openvpn: revive windows installer binaries</li>
<li>system: improved config history and backup pages layout</li>
<li>system: increased backup count default from 30 to 60</li>
<li>system: /var /tmp MFS awareness for crash dumps added</li>
<li>trust: add “IP security IKE intermediate” to server key usage</li>
<li>firmware: moved reboot, halt and defaults pages to new home</li>
<li>languages: updates to Russian, French, German and Japanese</li>
<li>Many other updates and changes
***</li>
</ul>

<h2>Interview - Benedict Reuschling - <a href="mailto:bcr@freebsd.org" rel="nofollow">bcr@freebsd.org</a></h2>

<ul>
<li>FreeBSD Foundation in Europe
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.daemonology.net/blog/2016-04-11-write-opinionated-workarounds.html" rel="nofollow">Write opinionated workarounds</a></h3>

<ul>
<li>Colin Percival has written a great blog post this past week, specifically talking about his policy of writing “opinionated workarounds”.</li>
<li>The idea came about due to his working on multi-platform software, and the frustrations of dealing with POSIX violations</li>
<li>The crux of the post is how he deals with these workarounds. Specifically by <em>only</em> applying them to the particular system in which it was required. And doing so loudly. </li>
<li>This has some important benefits. First, it doesn’t potentially expose other systems to bugs / security flaws when a workaround doesn’t 
“work” on a system for which it wasn’t designed. Secondly it’s important to complain. Loudly. This lets the user know that they are running on a system that doesn’t adhere to POSIX compliance, and maybe even get the attention of a developer who could remedy the situation.
***</li>
</ul>

<h3><a href="http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-003.txt.asc" rel="nofollow">Privilege escalation in calendar(1)</a></h3>

<ul>
<li>File this one under “Ouch that hurts” a new security vuln has been posted, this time against NetBSD’s ‘calendar’ command.</li>
<li>Specifically it looks like some of the daily scripts uses the ‘-a’ flag, which requires super-user privs in order to process all users calendar files and mail the results.</li>
<li>However the bug occurred because the calendar command didn’t drop priv properly before executing external commands (whoops!)</li>
<li>To workaround you can set run_calendar=NO in the daily.conf file, or apply the fixed binary from upstream.
***</li>
</ul>

<h3><a href="http://www.pgcon.org/2016/" rel="nofollow">PGCon 2016</a></h3>

<ul>
<li>PGCon 2016 is now only 4 weeks away</li>
<li>The conference will be held at the University of Ottawa (same venue as BSDCan) from May 17th to 20th</li>
<li>Tutorials: 17-18 May 2016 (Tue &amp; Wed)</li>
<li>Talks: 19-20 May 2016 (Thu-Fri)</li>
<li>Wednesday is a developer unconference.</li>
<li>Saturday is a user unconference.</li>
<li>“PGCon is an annual conference for users and developers of PostgreSQL, a leading relational database, which just happens to be open source. PGCon is the place to meet, discuss, build relationships, learn valuable insights, and generally chat about the work you are doing with PostgreSQL. If you want to learn why so many people are moving to PostgreSQL, PGCon will be the place to find out why. Whether you are a casual user or you&#39;ve been working with PostgreSQL for years, PGCon will have something for you.”</li>
<li>New to PGSQL? Just a user? Long time developers? This conference has something for you. <a href="https://www.pgcon.org/2016/schedule/events.en.html" rel="nofollow">A great lineup of talks</a>, plus unconference days focused on both users and developers
***</li>
</ul>

<h3><a href="https://2016.eurobsdcon.org/call-for-papers/" rel="nofollow">CfP EuroBSDCon 2016</a></h3>

<ul>
<li>The call for papers has been issued for EuroBSDCon 2016 in Belgrade, Serbia</li>
<li>The conference will be held from the 22nd to 25th of September, 2016</li>
<li>The deadline for talk submissions is: Sunday the 8th of May, 2016</li>
<li>Submit your talk or tutorial proposal before it is too late
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://www.michaelwlucas.com/nonfiction/fmaz" rel="nofollow">“FreeBSD Mastery: Advanced ZFS” has officially been released </a> </p></li>
<li><p><a href="https://gist.github.com/ligurio/f6114bd1df371047dd80ea9b8a55c104" rel="nofollow">Support of OpenBSD pledge(2) in programming Languages</a> </p></li>
<li><p><a href="http://daemonforums.org/showthread.php?t=9781" rel="nofollow">pkgsrcCon 2016 -Call for Presentations</a></p></li>
<li><p><a href="http://blog.netbsd.org/tnf/entry/talks_about_blacklistd" rel="nofollow">Christos Zoulas talks about blacklistd</a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2617" rel="nofollow">Penguicon 2016 Lucas Track Schedule</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/HiiDpGcT" rel="nofollow"> Peter - NVME</a> </li>
<li><a href="http://pastebin.com/L5XeVS1H" rel="nofollow"> Jeremy - Wireless Gear</a> </li>
<li><a href="http://pastebin.com/yrCEnkWt" rel="nofollow"> Ted - Rpi2 Packages</a> - <a href="https://wiki.freebsd.org/FreeBSD/arm/crossbuild" rel="nofollow">Cross Building Wiki</a> </li>
<li><a href="http://pastebin.com/pYFC1vdQ" rel="nofollow"> Geoff - Jail Failover</a> </li>
<li><a href="http://pastebin.com/WEgN0ZVw" rel="nofollow"> Zach - Graphical Bhyve?</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>137: FreeNAS Mini XL</title>
  <link>https://www.bsdnow.tv/137</link>
  <guid isPermaLink="false">9d4cd10e-3ef9-4849-8a3d-de5a4dfc4542</guid>
  <pubDate>Wed, 13 Apr 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9d4cd10e-3ef9-4849-8a3d-de5a4dfc4542.mp3" length="28774228" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSD Now, I’m out of town for the week, but we have a special unboxing video to share with you, that you won’t want to miss. That, plus the latest BSD news, is coming your way right now!</itunes:subtitle>
  <itunes:duration>39:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSD Now, I’m out of town for the week, but we have a special unboxing video to share with you, that you won’t want to miss. That, plus the latest BSD news, is coming your way right now!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Example of a FreeBSD bug hunting session by a simple user (http://blog.cochard.me/2016/01/example-of-freebsd-bug-hunting-session.html)
Don’t be fooled, Olivier Cochard-Labbé is a bit more than just a FreeBSD user
Original founder of the FreeNAS project many years ago, and currently leads the BSD Router Project (designed as a replacement for “Big Iron” routers like Cisco’s etc)
However, he is not actually a committer on any of the BSD projects, and is mostly focused on networking, rather than development, so it is fair to call him a user
He walks us through a bug hunting session that started when he updated his wireless router
“My wireless-router configuration was complex: it involves routing, wireless in hostap mode, ipfw, snort, bridge, openvpn, etc.”
Provides helpful advice on writing problem reports to developers, including trying to reproduce your issue with as minimal a setup as possible. This both reduces the amount of setup a developer has to do to try to recreate your issue, and can often make it more obvious where the problem actually lies
As you might expect, the more he researched the problem, the more questions he had
The journey goes through the kernel debugger, learning dtrace, and reading some source code
In the end it seems the problem is that the bridge interface marks itself as down if none of the interfaces are in an ‘UP’ state. The wireless interface was in the unknown state, and was actually up, but when the wired interface was disconnected, this caused the bridge to mark it self as down.
***
How-to Install OpenBSD 5.9 plus XFCE desktop and basic applications (http://ribalinux.blogspot.com/2016/04/how-to-install-openbsd-59-plus-xfce.html)
Now this is the way to do videos. Over at the RibaLinux blogspot site, we have a great video showing how to setup and install OpenBSD 5.9 with XFCE and basic desktop applications.
Along with the video tutorial, another nicety is the commands-used script, so you can see exactly how the setup was done, without having to pause/rewind the video to keep up. How to install PC-BSD 10.3 (http://ribalinux.blogspot.com/2016/04/how-to-install-pc-bsd-103.html) 
In addition to the OpenBSD 5.9 setup video, they just published a PC-BSD 10.3 installation video as well, check it out!
***
FreeBSD on xhyve tutorial (https://gist.github.com/tanb/f8fefa22332edc7a641d)
Originally only able to boot linux, xhyve, a “sort of” port of bhyve to OS X, can now run FreeBSD
This tutorial makes it much easier, providing a script
There are a few small command line flag differences from bhyve on FreeBSD
The tutorial also covers sharing a directory between the guest and the host, resizing and growing the disk for the guest, and converting a QEMU image to be run under xhyve
***
How to Configure SSHguard With IPFW Firewall On FreeBSD (http://www.unixmen.com/configure-sshguard-ipfw-firewall-freebsd)
It’s been a while, but UNIXMen has dropped on us another FreeBSD tutorial, this time on how to setup IPFW and ‘sshguard’ to protect your system.
In this tutorial they first lay down the rationale for picking IPFW as the firewall, but the reasons mainly boil down to IPFW being developed primarily on FreeBSD, and as such isn’t lagging behind when it comes to features / support.
Interestingly enough, they also go the route of adding their own /usr/local/etc/rc.firewall script which will be used to specify TCP/UDP ports to open through IPFW via the rc.conf file
Once that setup is complete (which you can just copy-n-paste) they then move onto ‘sshguard’ setup.
Specifically you’ll need to be sure to install the correct port/pkg, sshguard-ipfw in order to work in this setup, although sshguard-pf and friends are available also.
The article mentions that the name ‘sshguard’ can also be misleading, since it can be used to detect brute force attempts into a number of services.
From there a bunch of configuration is thrown at you, which will allow you to start making the most out of sshguard’s potential, well worth your read if you are using IPFW, or even PF and want to get the basics down of using sshguard properly.
***
FreeNAS Mini XL Video Unboxing
Beastie Bits
Amazon lists FreeBSD as 'Other Linux' (https://i.imgur.com/NJ7lpso.png) 
sbin/hammer: Make hammer commands print root volume path (http://lists.dragonflybsd.org/pipermail/commits/2016-April/459667.html) 
sbin/hammer: Print volume list after volume-add|del (http://lists.dragonflybsd.org/pipermail/commits/2016-April/459674.html) 
Front cover reveal for the upcoming 'FreeBSD Mastery: Advanced ZFS" book (https://twitter.com/mwlauthor/status/716328414072872960) 
If you don’t already have one, get your FreeBSD Pillow (http://linuxpillow.blogspot.com/2016/03/world-backup-day.html) 
Feedback/Questions
 Daniel - SysVIPC (http://pastebin.com/raw/JBbMj87t)
 Shane - OpenToonz (http://pastebin.com/raw/54ngYVEN) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSD Now, I’m out of town for the week, but we have a special unboxing video to share with you, that you won’t want to miss. That, plus the latest BSD news, is coming your way right now!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.cochard.me/2016/01/example-of-freebsd-bug-hunting-session.html" rel="nofollow">Example of a FreeBSD bug hunting session by a simple user</a></h3>

<ul>
<li>Don’t be fooled, Olivier Cochard-Labbé is a bit more than just a FreeBSD user</li>
<li>Original founder of the FreeNAS project many years ago, and currently leads the BSD Router Project (designed as a replacement for “Big Iron” routers like Cisco’s etc)</li>
<li>However, he is not actually a committer on any of the BSD projects, and is mostly focused on networking, rather than development, so it is fair to call him a user</li>
<li>He walks us through a bug hunting session that started when he updated his wireless router</li>
<li>“My wireless-router configuration was complex: it involves routing, wireless in hostap mode, ipfw, snort, bridge, openvpn, etc.”</li>
<li>Provides helpful advice on writing problem reports to developers, including trying to reproduce your issue with as minimal a setup as possible. This both reduces the amount of setup a developer has to do to try to recreate your issue, and can often make it more obvious where the problem actually lies</li>
<li>As you might expect, the more he researched the problem, the more questions he had</li>
<li>The journey goes through the kernel debugger, learning dtrace, and reading some source code</li>
<li>In the end it seems the problem is that the bridge interface marks itself as down if none of the interfaces are in an ‘UP’ state. The wireless interface was in the unknown state, and was actually up, but when the wired interface was disconnected, this caused the bridge to mark it self as down.
***</li>
</ul>

<h3><a href="http://ribalinux.blogspot.com/2016/04/how-to-install-openbsd-59-plus-xfce.html" rel="nofollow">How-to Install OpenBSD 5.9 plus XFCE desktop and basic applications</a></h3>

<ul>
<li>Now this is the way to do videos. Over at the RibaLinux blogspot site, we have a great video showing how to setup and install OpenBSD 5.9 with XFCE and basic desktop applications.</li>
<li>Along with the video tutorial, another nicety is the commands-used script, so you can see exactly how the setup was done, without having to pause/rewind the video to keep up. <a href="http://ribalinux.blogspot.com/2016/04/how-to-install-pc-bsd-103.html" rel="nofollow">How to install PC-BSD 10.3</a> </li>
<li>In addition to the OpenBSD 5.9 setup video, they just published a PC-BSD 10.3 installation video as well, check it out!
***</li>
</ul>

<h3><a href="https://gist.github.com/tanb/f8fefa22332edc7a641d" rel="nofollow">FreeBSD on xhyve tutorial</a></h3>

<ul>
<li>Originally only able to boot linux, xhyve, a “sort of” port of bhyve to OS X, can now run FreeBSD</li>
<li>This tutorial makes it much easier, providing a script</li>
<li>There are a few small command line flag differences from bhyve on FreeBSD</li>
<li>The tutorial also covers sharing a directory between the guest and the host, resizing and growing the disk for the guest, and converting a QEMU image to be run under xhyve
***</li>
</ul>

<h3><a href="http://www.unixmen.com/configure-sshguard-ipfw-firewall-freebsd" rel="nofollow">How to Configure SSHguard With IPFW Firewall On FreeBSD</a></h3>

<ul>
<li>It’s been a while, but UNIXMen has dropped on us another FreeBSD tutorial, this time on how to setup IPFW and ‘sshguard’ to protect your system.</li>
<li>In this tutorial they first lay down the rationale for picking IPFW as the firewall, but the reasons mainly boil down to IPFW being developed primarily on FreeBSD, and as such isn’t lagging behind when it comes to features / support.</li>
<li>Interestingly enough, they also go the route of adding their own /usr/local/etc/rc.firewall script which will be used to specify TCP/UDP ports to open through IPFW via the rc.conf file</li>
<li>Once that setup is complete (which you can just copy-n-paste) they then move onto ‘sshguard’ setup.</li>
<li>Specifically you’ll need to be sure to install the correct port/pkg, sshguard-ipfw in order to work in this setup, although sshguard-pf and friends are available also.</li>
<li>The article mentions that the name ‘sshguard’ can also be misleading, since it can be used to detect brute force attempts into a number of services.</li>
<li>From there a bunch of configuration is thrown at you, which will allow you to start making the most out of sshguard’s potential, well worth your read if you are using IPFW, or even PF and want to get the basics down of using sshguard properly.
***</li>
</ul>

<h2>FreeNAS Mini XL Video Unboxing</h2>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://i.imgur.com/NJ7lpso.png" rel="nofollow">Amazon lists FreeBSD as &#39;Other Linux&#39;</a> </p>

<p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-April/459667.html" rel="nofollow">sbin/hammer: Make hammer commands print root volume path</a> </p>

<p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-April/459674.html" rel="nofollow">sbin/hammer: Print volume list after volume-add|del</a> </p>

<p><a href="https://twitter.com/mwlauthor/status/716328414072872960" rel="nofollow">Front cover reveal for the upcoming &#39;FreeBSD Mastery: Advanced ZFS&quot; book</a> </p>

<p>If you don’t already have one, get your <a href="http://linuxpillow.blogspot.com/2016/03/world-backup-day.html" rel="nofollow">FreeBSD Pillow</a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/raw/JBbMj87t" rel="nofollow"> Daniel - SysVIPC</a></li>
<li><a href="http://pastebin.com/raw/54ngYVEN" rel="nofollow"> Shane - OpenToonz</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSD Now, I’m out of town for the week, but we have a special unboxing video to share with you, that you won’t want to miss. That, plus the latest BSD news, is coming your way right now!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.cochard.me/2016/01/example-of-freebsd-bug-hunting-session.html" rel="nofollow">Example of a FreeBSD bug hunting session by a simple user</a></h3>

<ul>
<li>Don’t be fooled, Olivier Cochard-Labbé is a bit more than just a FreeBSD user</li>
<li>Original founder of the FreeNAS project many years ago, and currently leads the BSD Router Project (designed as a replacement for “Big Iron” routers like Cisco’s etc)</li>
<li>However, he is not actually a committer on any of the BSD projects, and is mostly focused on networking, rather than development, so it is fair to call him a user</li>
<li>He walks us through a bug hunting session that started when he updated his wireless router</li>
<li>“My wireless-router configuration was complex: it involves routing, wireless in hostap mode, ipfw, snort, bridge, openvpn, etc.”</li>
<li>Provides helpful advice on writing problem reports to developers, including trying to reproduce your issue with as minimal a setup as possible. This both reduces the amount of setup a developer has to do to try to recreate your issue, and can often make it more obvious where the problem actually lies</li>
<li>As you might expect, the more he researched the problem, the more questions he had</li>
<li>The journey goes through the kernel debugger, learning dtrace, and reading some source code</li>
<li>In the end it seems the problem is that the bridge interface marks itself as down if none of the interfaces are in an ‘UP’ state. The wireless interface was in the unknown state, and was actually up, but when the wired interface was disconnected, this caused the bridge to mark it self as down.
***</li>
</ul>

<h3><a href="http://ribalinux.blogspot.com/2016/04/how-to-install-openbsd-59-plus-xfce.html" rel="nofollow">How-to Install OpenBSD 5.9 plus XFCE desktop and basic applications</a></h3>

<ul>
<li>Now this is the way to do videos. Over at the RibaLinux blogspot site, we have a great video showing how to setup and install OpenBSD 5.9 with XFCE and basic desktop applications.</li>
<li>Along with the video tutorial, another nicety is the commands-used script, so you can see exactly how the setup was done, without having to pause/rewind the video to keep up. <a href="http://ribalinux.blogspot.com/2016/04/how-to-install-pc-bsd-103.html" rel="nofollow">How to install PC-BSD 10.3</a> </li>
<li>In addition to the OpenBSD 5.9 setup video, they just published a PC-BSD 10.3 installation video as well, check it out!
***</li>
</ul>

<h3><a href="https://gist.github.com/tanb/f8fefa22332edc7a641d" rel="nofollow">FreeBSD on xhyve tutorial</a></h3>

<ul>
<li>Originally only able to boot linux, xhyve, a “sort of” port of bhyve to OS X, can now run FreeBSD</li>
<li>This tutorial makes it much easier, providing a script</li>
<li>There are a few small command line flag differences from bhyve on FreeBSD</li>
<li>The tutorial also covers sharing a directory between the guest and the host, resizing and growing the disk for the guest, and converting a QEMU image to be run under xhyve
***</li>
</ul>

<h3><a href="http://www.unixmen.com/configure-sshguard-ipfw-firewall-freebsd" rel="nofollow">How to Configure SSHguard With IPFW Firewall On FreeBSD</a></h3>

<ul>
<li>It’s been a while, but UNIXMen has dropped on us another FreeBSD tutorial, this time on how to setup IPFW and ‘sshguard’ to protect your system.</li>
<li>In this tutorial they first lay down the rationale for picking IPFW as the firewall, but the reasons mainly boil down to IPFW being developed primarily on FreeBSD, and as such isn’t lagging behind when it comes to features / support.</li>
<li>Interestingly enough, they also go the route of adding their own /usr/local/etc/rc.firewall script which will be used to specify TCP/UDP ports to open through IPFW via the rc.conf file</li>
<li>Once that setup is complete (which you can just copy-n-paste) they then move onto ‘sshguard’ setup.</li>
<li>Specifically you’ll need to be sure to install the correct port/pkg, sshguard-ipfw in order to work in this setup, although sshguard-pf and friends are available also.</li>
<li>The article mentions that the name ‘sshguard’ can also be misleading, since it can be used to detect brute force attempts into a number of services.</li>
<li>From there a bunch of configuration is thrown at you, which will allow you to start making the most out of sshguard’s potential, well worth your read if you are using IPFW, or even PF and want to get the basics down of using sshguard properly.
***</li>
</ul>

<h2>FreeNAS Mini XL Video Unboxing</h2>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://i.imgur.com/NJ7lpso.png" rel="nofollow">Amazon lists FreeBSD as &#39;Other Linux&#39;</a> </p>

<p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-April/459667.html" rel="nofollow">sbin/hammer: Make hammer commands print root volume path</a> </p>

<p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-April/459674.html" rel="nofollow">sbin/hammer: Print volume list after volume-add|del</a> </p>

<p><a href="https://twitter.com/mwlauthor/status/716328414072872960" rel="nofollow">Front cover reveal for the upcoming &#39;FreeBSD Mastery: Advanced ZFS&quot; book</a> </p>

<p>If you don’t already have one, get your <a href="http://linuxpillow.blogspot.com/2016/03/world-backup-day.html" rel="nofollow">FreeBSD Pillow</a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/raw/JBbMj87t" rel="nofollow"> Daniel - SysVIPC</a></li>
<li><a href="http://pastebin.com/raw/54ngYVEN" rel="nofollow"> Shane - OpenToonz</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>136: This is GNN</title>
  <link>https://www.bsdnow.tv/136</link>
  <guid isPermaLink="false">719cbcc9-9b74-4129-9a35-bef5f499f3b9</guid>
  <pubDate>Wed, 06 Apr 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/719cbcc9-9b74-4129-9a35-bef5f499f3b9.mp3" length="69077236" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we will be interviewing GNN of the FreeBSD project to talk about the new TeachBSD initiative. That plus the latest BSD headlines, all coming your way right now!</itunes:subtitle>
  <itunes:duration>1:35:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we will be interviewing GNN of the FreeBSD project to talk about the new TeachBSD initiative. That plus the latest BSD headlines, all coming your way right now!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD 10.3-RELEASE Announcement  (https://www.freebsd.org/releases/10.3R/announce.html)
FreeBSD 10.3 has landed, with extended support until April 30, 2018
This is likely to be the last extended support release, as starting with 11, the new support model will encourage upgrading to the latest minor version by ending support for the previous minor version approximately 2 months after each point release. The Major version / stable branch will still be supported for the same 5 year term. This will allow the FreeBSD project to move forward more quickly, while still providing the same level of long term support
The UEFI boot loader is much improved, and now supports booting root-on-ZFS, and the beastie menu
The beastie menu itself has been updated with support for ZFS Boot Environments
The CAM Target Layer (CTL) now supports High Availability, allowing the construction of much more advanced storage systems
The 64bit Linux Emulation Layer was backported
Reroot support was added, allowing the system to boot off of a minimal image, such as a mfsroot and then reload all of userland from a different root file system (such as iSCSI, NFS, etc)
The version of xz(1) has been updated to support multi-threaded compression
sesutil(8) has been introduced, making it easier to manage large storage nodes
Various ZFS updates
As usual, a huge number of driver updates are also included
***
How to use OpenBSD with Libreboot: detailed instructions  (https://lists.nongnu.org/archive/html/libreboot/2016-04/msg00010.html)
This tutorial covers installing OpenBSD on a Thinkpad X200 using Libreboot, a replacement for the traditional BIOS/firmware that comes from the manufacturer
“Since 5.9, OpenBSD supports EFI boot mode, which means that it also have had to support framebuffer out of the box, so lack of proprietary VGA BIOS blob is no longer a problem and you can boot it with unmodified Libreboot binary release 20150518.”
“In order to install OpenBSD on such a machine you will need someadditional preparations, since regular install59.fs won't work because bsd.rd doesn't have a framebuffer console.”
A few extra steps are required to get it going, but they are outlined in the post
This may be very interesting to those who prefer not to depend on binary blobs
***
Linking the FreeBSD base system with lld -- status update (http://lists.llvm.org/pipermail/llvm-dev/2016-March/096449.html)
The FreeBSD Foundation’s Ed Maste provides an update on the LLVM mailing list about the progress of replacing the GNU linker with the lld in the FreeBSD base system
“I'm pleased to report that I can now build a runnable FreeBSD system using lld as the linker (for buildworld), with a few workarounds and work-in-progress patches. I have not yet extensively tested the result but it is possible to login to the resulting system, and basic sanity tests I've tried are successful. Note that the kernel is still linked with ld.bfd.”
Outstanding Issues
Symbol version support (PR 23231). FreeBSD uses symbol versioning for backwards compatibility
Linker script expression support (PR 26731). The FreeBSD kernel linker scripts contain expressions not currently supported by lld
Library search paths. GNU LD automatically searches /lib, and lld does not
the -N flag makes the text and data sections RW and does not page-align data.
It is used by boot loader components.
The -dc flag assigns space to common symbols when producing relocatable output (-r). It is used by the /rescue build, which is a single binary assembled from a collection of individual tools (sh, ls, fsck, ...)
-Y adds a path to the default library search path. It is used by the lib32 build, which provides i386 builds of the system libraries for compatibility with i386 applications.
With the ongoing work, it might be possible for FreeBSD 11 to use lld by default, although it might be best to wait to throw that particular switch
***
Your favorite billion user company using BSD just flipped on encryption for all their users -- and it took 15 Engineers to do it (http://www.wired.com/2016/04/forget-apple-vs-fbi-whatsapp-just-switched-encryption-billion-people/)
With the help of Moxie Marlinspike’s Open Whisper Systems, WhatsApp has integrated the ‘Signal’ encryption system for all messages, class, pictures, and videos sent between individuals or groups
It uses public key cryptography, very similar to GPG, but with automated public key servers
It also includes a system of QR codes to verify the identity of individuals in person, so you can be sure the person you are talking to is actually the person you met with
WhatsApp runs their billion user network, using FreeBSD, with only about 50 engineers
Only 15 of those engineers we needed to work on the project that has now deployed complete end-to-end encryption across the entire network
The Wired article is very detailed and well worth the read
***
Interview - George Neville-Neil - gnn@freebsd.org (mailto:gnn@freebsd.org) / @gvnn3 (https://twitter.com/gvnn3)
Teaching BSD with Tracing
News Roundup
Faces of FreeBSD 2016: Scott Long (https://www.freebsdfoundation.org/blog/faces-of-freebsd-2016-scott-long/)
It’s been awhile since we’ve had a new entry into the “Faces of FreeBSD” series, but due to popular demand it’s back!
This installment features developer Scott Long, who currently works at NetFlix, previously at Yahoo and Adaptec.
Scott got a very early start into BSD, first discovering i386BSD 0.1 on a FTP server at Berkeley, back at 1992. From there on it’s been a journey, following along with FreeBSD since version 1.0 in 1993.
So what stuff can we blame Scott for? In his own words:
I’ve been a source committer since 2000. I got my start by taking over maintainership of the Adaptec ‘aac’ RAID driver. From 2002-2006 I was the Release Engineer and was responsible for the 5.x and 6.x releases. Though the early 5.x releases were not great, they were necessary stepping stones to the success of FreeBSD 6.x and beyond. I’m exceptionally proud of my role in helping FreeBSD move forward during that time.
I authored and maintained the ‘mfi’ and ‘mps’ storage drivers, the ‘udf’ filesystem driver, and several smaller sound and USB drivers. I’ve maintained, or at least touched, most of the storage device drivers in the system to some extent, and I implemented medium-grained locking on the CAM storage stack. Recently I’ve been working on overall system scalability and performance.
ASCII Flow (http://asciiflow.com/)
A website that lets to draw and share ASCII diagrams
Great for network layout maps, rack diagrams, protocol analysis etc
Use it in your presentations and slides
Sample  (https://drive.google.com/open?id=0BynxTTJrNUOKeWxCVm1ERExrNkU)
***
System Under Test: FreeBSD (http://lowlevelbits.org/system-under-test-freebsd/)
Part of a series looking at testing across a number of projects
Outlines the testing framework of FreeBSD
Provides a mini-tutorial on how to run the tests
There are some other tests that are now covered, but this is due to a lack of documentation on the fact that the tests exist, and how to run them
There is much ongoing work in this area
***
Worst April Fools Joke EVER! (http://www.rhyous.com/2016/04/01/microsoft-announces-it-is-acquiring-freebsd-for-300-million/)
While a bad April Fool’s joke, it also shows some common misconceptions
The FreeBSD Foundation does not own the source repository, it is only the care taken of the trademark, and other things that require a single legal entity
OpenBSD and NetBSD are not ‘sub brands’ of FreeBSD
Bash was not ported to Windows, but rather Windows gained a system similar to FreeBSD’s linux_compat
It would be nice to have ZFS on Windows
***
Beastie Bits
Credit where credit's due... (https://forums.freebsd.org/threads/55642/) 
M:Tier's OpenBSD packages and binpatches updated for 5.9 (https://stable.mtier.org/)
NYC BUG Meeting (2016-04-06) - Debugging with LLVM, John Wolfe (http://www.nycbug.org/index.cgi)
Need to create extremely high traffic loads? kq_sendrecv is worth checking out (http://lists.dragonflybsd.org/pipermail/commits/2016-March/459651.html) 
If you're in the Maryland region, CharmBug has a meetup next week (http://www.meetup.com/CharmBUG/events/230048300/) 
How to get a desktop on DragonFly (https://www.dragonflybsd.org/docs/how_to_get_to_the_desktop/) 
Linux vs BSD Development Models  (https://twitter.com/q5sys/status/717509675630084096) 
Feedback/Question
 Paulo - ZFS Setup (http://pastebin.com/raw/GrM0jKZK) 
 Jonathan - Installation  (http://pastebin.com/raw/13KCkhMU) 
 Andrew - Career / School (http://pastebin.com/wsx90L2m) 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we will be interviewing GNN of the FreeBSD project to talk about the new TeachBSD initiative. That plus the latest BSD headlines, all coming your way right now!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/10.3R/announce.html" rel="nofollow">FreeBSD 10.3-RELEASE Announcement </a></h3>

<ul>
<li>FreeBSD 10.3 has landed, with extended support until April 30, 2018</li>
<li>This is likely to be the last extended support release, as starting with 11, the new support model will encourage upgrading to the latest minor version by ending support for the previous minor version approximately 2 months after each point release. The Major version / stable branch will still be supported for the same 5 year term. This will allow the FreeBSD project to move forward more quickly, while still providing the same level of long term support</li>
<li>The UEFI boot loader is much improved, and now supports booting root-on-ZFS, and the beastie menu</li>
<li>The beastie menu itself has been updated with support for ZFS Boot Environments</li>
<li>The CAM Target Layer (CTL) now supports High Availability, allowing the construction of much more advanced storage systems</li>
<li>The 64bit Linux Emulation Layer was backported</li>
<li>Reroot support was added, allowing the system to boot off of a minimal image, such as a mfsroot and then reload all of userland from a different root file system (such as iSCSI, NFS, etc)</li>
<li>The version of xz(1) has been updated to support multi-threaded compression</li>
<li>sesutil(8) has been introduced, making it easier to manage large storage nodes</li>
<li>Various ZFS updates</li>
<li>As usual, a huge number of driver updates are also included
***</li>
</ul>

<h3><a href="https://lists.nongnu.org/archive/html/libreboot/2016-04/msg00010.html" rel="nofollow">How to use OpenBSD with Libreboot: detailed instructions </a></h3>

<ul>
<li>This tutorial covers installing OpenBSD on a Thinkpad X200 using Libreboot, a replacement for the traditional BIOS/firmware that comes from the manufacturer</li>
<li>“Since 5.9, OpenBSD supports EFI boot mode, which means that it also have had to support framebuffer out of the box, so lack of proprietary VGA BIOS blob is no longer a problem and you can boot it with unmodified Libreboot binary release 20150518.”</li>
<li>“In order to install OpenBSD on such a machine you will need someadditional preparations, since regular install59.fs won&#39;t work because bsd.rd doesn&#39;t have a framebuffer console.”</li>
<li>A few extra steps are required to get it going, but they are outlined in the post</li>
<li>This may be very interesting to those who prefer not to depend on binary blobs
***</li>
</ul>

<h3><a href="http://lists.llvm.org/pipermail/llvm-dev/2016-March/096449.html" rel="nofollow">Linking the FreeBSD base system with lld -- status update</a></h3>

<ul>
<li>The FreeBSD Foundation’s Ed Maste provides an update on the LLVM mailing list about the progress of replacing the GNU linker with the lld in the FreeBSD base system</li>
<li>“I&#39;m pleased to report that I can now build a runnable FreeBSD system using lld as the linker (for buildworld), with a few workarounds and work-in-progress patches. I have not yet extensively tested the result but it is possible to login to the resulting system, and basic sanity tests I&#39;ve tried are successful. Note that the kernel is still linked with ld.bfd.”</li>
<li>Outstanding Issues

<ul>
<li>Symbol version support (PR 23231). FreeBSD uses symbol versioning for backwards compatibility</li>
<li>Linker script expression support (PR 26731). The FreeBSD kernel linker scripts contain expressions not currently supported by lld</li>
<li>Library search paths. GNU LD automatically searches /lib, and lld does not</li>
<li>the -N flag makes the text and data sections RW and does not page-align data.
It is used by boot loader components.</li>
<li>The -dc flag assigns space to common symbols when producing relocatable output (-r). It is used by the /rescue build, which is a single binary assembled from a collection of individual tools (sh, ls, fsck, ...)</li>
<li>-Y adds a path to the default library search path. It is used by the lib32 build, which provides i386 builds of the system libraries for compatibility with i386 applications.</li>
</ul></li>
<li>With the ongoing work, it might be possible for FreeBSD 11 to use lld by default, although it might be best to wait to throw that particular switch
***</li>
</ul>

<h3><a href="http://www.wired.com/2016/04/forget-apple-vs-fbi-whatsapp-just-switched-encryption-billion-people/" rel="nofollow">Your favorite billion user company using BSD just flipped on encryption for all their users -- and it took 15 Engineers to do it</a></h3>

<ul>
<li>With the help of Moxie Marlinspike’s Open Whisper Systems, WhatsApp has integrated the ‘Signal’ encryption system for all messages, class, pictures, and videos sent between individuals or groups</li>
<li>It uses public key cryptography, very similar to GPG, but with automated public key servers</li>
<li>It also includes a system of QR codes to verify the identity of individuals in person, so you can be sure the person you are talking to is actually the person you met with</li>
<li>WhatsApp runs their billion user network, using FreeBSD, with only about 50 engineers</li>
<li>Only 15 of those engineers we needed to work on the project that has now deployed complete end-to-end encryption across the entire network</li>
<li>The Wired article is very detailed and well worth the read
***</li>
</ul>

<h2>Interview - George Neville-Neil - <a href="mailto:gnn@freebsd.org" rel="nofollow">gnn@freebsd.org</a> / <a href="https://twitter.com/gvnn3" rel="nofollow">@gvnn3</a></h2>

<p>Teaching BSD with Tracing</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/faces-of-freebsd-2016-scott-long/" rel="nofollow">Faces of FreeBSD 2016: Scott Long</a></h3>

<ul>
<li>It’s been awhile since we’ve had a new entry into the “Faces of FreeBSD” series, but due to popular demand it’s back!</li>
<li>This installment features developer Scott Long, who currently works at NetFlix, previously at Yahoo and Adaptec.</li>
<li>Scott got a very early start into BSD, first discovering i386BSD 0.1 on a FTP server at Berkeley, back at 1992. From there on it’s been a journey, following along with FreeBSD since version 1.0 in 1993.</li>
<li>So what stuff can we blame Scott for? In his own words:</li>
</ul>

<blockquote>
<p>I’ve been a source committer since 2000. I got my start by taking over maintainership of the Adaptec ‘aac’ RAID driver. From 2002-2006 I was the Release Engineer and was responsible for the 5.x and 6.x releases. Though the early 5.x releases were not great, they were necessary stepping stones to the success of FreeBSD 6.x and beyond. I’m exceptionally proud of my role in helping FreeBSD move forward during that time.</p>

<p>I authored and maintained the ‘mfi’ and ‘mps’ storage drivers, the ‘udf’ filesystem driver, and several smaller sound and USB drivers. I’ve maintained, or at least touched, most of the storage device drivers in the system to some extent, and I implemented medium-grained locking on the CAM storage stack. Recently I’ve been working on overall system scalability and performance.</p>
</blockquote>

<hr>

<h3><a href="http://asciiflow.com/" rel="nofollow">ASCII Flow</a></h3>

<ul>
<li>A website that lets to draw and share ASCII diagrams</li>
<li>Great for network layout maps, rack diagrams, protocol analysis etc</li>
<li>Use it in your presentations and slides</li>
<li><a href="https://drive.google.com/open?id=0BynxTTJrNUOKeWxCVm1ERExrNkU" rel="nofollow">Sample </a>
***</li>
</ul>

<h3><a href="http://lowlevelbits.org/system-under-test-freebsd/" rel="nofollow">System Under Test: FreeBSD</a></h3>

<ul>
<li>Part of a series looking at testing across a number of projects</li>
<li>Outlines the testing framework of FreeBSD</li>
<li>Provides a mini-tutorial on how to run the tests</li>
<li>There are some other tests that are now covered, but this is due to a lack of documentation on the fact that the tests exist, and how to run them</li>
<li>There is much ongoing work in this area
***</li>
</ul>

<h3><a href="http://www.rhyous.com/2016/04/01/microsoft-announces-it-is-acquiring-freebsd-for-300-million/" rel="nofollow">Worst April Fools Joke EVER!</a></h3>

<ul>
<li>While a bad April Fool’s joke, it also shows some common misconceptions</li>
<li>The FreeBSD Foundation does not own the source repository, it is only the care taken of the trademark, and other things that require a single legal entity</li>
<li>OpenBSD and NetBSD are not ‘sub brands’ of FreeBSD</li>
<li>Bash was not ported to Windows, but rather Windows gained a system similar to FreeBSD’s linux_compat</li>
<li>It would be nice to have ZFS on Windows
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://forums.freebsd.org/threads/55642/" rel="nofollow">Credit where credit&#39;s due...</a> </p></li>
<li><p><a href="https://stable.mtier.org/" rel="nofollow">M:Tier&#39;s OpenBSD packages and binpatches updated for 5.9</a></p></li>
<li><p><a href="http://www.nycbug.org/index.cgi" rel="nofollow">NYC BUG Meeting (2016-04-06) - Debugging with LLVM, John Wolfe</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-March/459651.html" rel="nofollow">Need to create extremely high traffic loads? kq_sendrecv is worth checking out</a> </p></li>
<li><p><a href="http://www.meetup.com/CharmBUG/events/230048300/" rel="nofollow">If you&#39;re in the Maryland region, CharmBug has a meetup next week</a> </p></li>
<li><p><a href="https://www.dragonflybsd.org/docs/how_to_get_to_the_desktop/" rel="nofollow">How to get a desktop on DragonFly</a> </p></li>
<li><p><a href="https://twitter.com/q5sys/status/717509675630084096" rel="nofollow">Linux vs BSD Development Models </a> </p></li>
</ul>

<h2>Feedback/Question</h2>

<ul>
<li><a href="http://pastebin.com/raw/GrM0jKZK" rel="nofollow"> Paulo - ZFS Setup</a> </li>
<li><a href="http://pastebin.com/raw/13KCkhMU" rel="nofollow"> Jonathan - Installation </a> </li>
<li><a href="http://pastebin.com/wsx90L2m" rel="nofollow"> Andrew - Career / School</a> </li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we will be interviewing GNN of the FreeBSD project to talk about the new TeachBSD initiative. That plus the latest BSD headlines, all coming your way right now!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/10.3R/announce.html" rel="nofollow">FreeBSD 10.3-RELEASE Announcement </a></h3>

<ul>
<li>FreeBSD 10.3 has landed, with extended support until April 30, 2018</li>
<li>This is likely to be the last extended support release, as starting with 11, the new support model will encourage upgrading to the latest minor version by ending support for the previous minor version approximately 2 months after each point release. The Major version / stable branch will still be supported for the same 5 year term. This will allow the FreeBSD project to move forward more quickly, while still providing the same level of long term support</li>
<li>The UEFI boot loader is much improved, and now supports booting root-on-ZFS, and the beastie menu</li>
<li>The beastie menu itself has been updated with support for ZFS Boot Environments</li>
<li>The CAM Target Layer (CTL) now supports High Availability, allowing the construction of much more advanced storage systems</li>
<li>The 64bit Linux Emulation Layer was backported</li>
<li>Reroot support was added, allowing the system to boot off of a minimal image, such as a mfsroot and then reload all of userland from a different root file system (such as iSCSI, NFS, etc)</li>
<li>The version of xz(1) has been updated to support multi-threaded compression</li>
<li>sesutil(8) has been introduced, making it easier to manage large storage nodes</li>
<li>Various ZFS updates</li>
<li>As usual, a huge number of driver updates are also included
***</li>
</ul>

<h3><a href="https://lists.nongnu.org/archive/html/libreboot/2016-04/msg00010.html" rel="nofollow">How to use OpenBSD with Libreboot: detailed instructions </a></h3>

<ul>
<li>This tutorial covers installing OpenBSD on a Thinkpad X200 using Libreboot, a replacement for the traditional BIOS/firmware that comes from the manufacturer</li>
<li>“Since 5.9, OpenBSD supports EFI boot mode, which means that it also have had to support framebuffer out of the box, so lack of proprietary VGA BIOS blob is no longer a problem and you can boot it with unmodified Libreboot binary release 20150518.”</li>
<li>“In order to install OpenBSD on such a machine you will need someadditional preparations, since regular install59.fs won&#39;t work because bsd.rd doesn&#39;t have a framebuffer console.”</li>
<li>A few extra steps are required to get it going, but they are outlined in the post</li>
<li>This may be very interesting to those who prefer not to depend on binary blobs
***</li>
</ul>

<h3><a href="http://lists.llvm.org/pipermail/llvm-dev/2016-March/096449.html" rel="nofollow">Linking the FreeBSD base system with lld -- status update</a></h3>

<ul>
<li>The FreeBSD Foundation’s Ed Maste provides an update on the LLVM mailing list about the progress of replacing the GNU linker with the lld in the FreeBSD base system</li>
<li>“I&#39;m pleased to report that I can now build a runnable FreeBSD system using lld as the linker (for buildworld), with a few workarounds and work-in-progress patches. I have not yet extensively tested the result but it is possible to login to the resulting system, and basic sanity tests I&#39;ve tried are successful. Note that the kernel is still linked with ld.bfd.”</li>
<li>Outstanding Issues

<ul>
<li>Symbol version support (PR 23231). FreeBSD uses symbol versioning for backwards compatibility</li>
<li>Linker script expression support (PR 26731). The FreeBSD kernel linker scripts contain expressions not currently supported by lld</li>
<li>Library search paths. GNU LD automatically searches /lib, and lld does not</li>
<li>the -N flag makes the text and data sections RW and does not page-align data.
It is used by boot loader components.</li>
<li>The -dc flag assigns space to common symbols when producing relocatable output (-r). It is used by the /rescue build, which is a single binary assembled from a collection of individual tools (sh, ls, fsck, ...)</li>
<li>-Y adds a path to the default library search path. It is used by the lib32 build, which provides i386 builds of the system libraries for compatibility with i386 applications.</li>
</ul></li>
<li>With the ongoing work, it might be possible for FreeBSD 11 to use lld by default, although it might be best to wait to throw that particular switch
***</li>
</ul>

<h3><a href="http://www.wired.com/2016/04/forget-apple-vs-fbi-whatsapp-just-switched-encryption-billion-people/" rel="nofollow">Your favorite billion user company using BSD just flipped on encryption for all their users -- and it took 15 Engineers to do it</a></h3>

<ul>
<li>With the help of Moxie Marlinspike’s Open Whisper Systems, WhatsApp has integrated the ‘Signal’ encryption system for all messages, class, pictures, and videos sent between individuals or groups</li>
<li>It uses public key cryptography, very similar to GPG, but with automated public key servers</li>
<li>It also includes a system of QR codes to verify the identity of individuals in person, so you can be sure the person you are talking to is actually the person you met with</li>
<li>WhatsApp runs their billion user network, using FreeBSD, with only about 50 engineers</li>
<li>Only 15 of those engineers we needed to work on the project that has now deployed complete end-to-end encryption across the entire network</li>
<li>The Wired article is very detailed and well worth the read
***</li>
</ul>

<h2>Interview - George Neville-Neil - <a href="mailto:gnn@freebsd.org" rel="nofollow">gnn@freebsd.org</a> / <a href="https://twitter.com/gvnn3" rel="nofollow">@gvnn3</a></h2>

<p>Teaching BSD with Tracing</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.freebsdfoundation.org/blog/faces-of-freebsd-2016-scott-long/" rel="nofollow">Faces of FreeBSD 2016: Scott Long</a></h3>

<ul>
<li>It’s been awhile since we’ve had a new entry into the “Faces of FreeBSD” series, but due to popular demand it’s back!</li>
<li>This installment features developer Scott Long, who currently works at NetFlix, previously at Yahoo and Adaptec.</li>
<li>Scott got a very early start into BSD, first discovering i386BSD 0.1 on a FTP server at Berkeley, back at 1992. From there on it’s been a journey, following along with FreeBSD since version 1.0 in 1993.</li>
<li>So what stuff can we blame Scott for? In his own words:</li>
</ul>

<blockquote>
<p>I’ve been a source committer since 2000. I got my start by taking over maintainership of the Adaptec ‘aac’ RAID driver. From 2002-2006 I was the Release Engineer and was responsible for the 5.x and 6.x releases. Though the early 5.x releases were not great, they were necessary stepping stones to the success of FreeBSD 6.x and beyond. I’m exceptionally proud of my role in helping FreeBSD move forward during that time.</p>

<p>I authored and maintained the ‘mfi’ and ‘mps’ storage drivers, the ‘udf’ filesystem driver, and several smaller sound and USB drivers. I’ve maintained, or at least touched, most of the storage device drivers in the system to some extent, and I implemented medium-grained locking on the CAM storage stack. Recently I’ve been working on overall system scalability and performance.</p>
</blockquote>

<hr>

<h3><a href="http://asciiflow.com/" rel="nofollow">ASCII Flow</a></h3>

<ul>
<li>A website that lets to draw and share ASCII diagrams</li>
<li>Great for network layout maps, rack diagrams, protocol analysis etc</li>
<li>Use it in your presentations and slides</li>
<li><a href="https://drive.google.com/open?id=0BynxTTJrNUOKeWxCVm1ERExrNkU" rel="nofollow">Sample </a>
***</li>
</ul>

<h3><a href="http://lowlevelbits.org/system-under-test-freebsd/" rel="nofollow">System Under Test: FreeBSD</a></h3>

<ul>
<li>Part of a series looking at testing across a number of projects</li>
<li>Outlines the testing framework of FreeBSD</li>
<li>Provides a mini-tutorial on how to run the tests</li>
<li>There are some other tests that are now covered, but this is due to a lack of documentation on the fact that the tests exist, and how to run them</li>
<li>There is much ongoing work in this area
***</li>
</ul>

<h3><a href="http://www.rhyous.com/2016/04/01/microsoft-announces-it-is-acquiring-freebsd-for-300-million/" rel="nofollow">Worst April Fools Joke EVER!</a></h3>

<ul>
<li>While a bad April Fool’s joke, it also shows some common misconceptions</li>
<li>The FreeBSD Foundation does not own the source repository, it is only the care taken of the trademark, and other things that require a single legal entity</li>
<li>OpenBSD and NetBSD are not ‘sub brands’ of FreeBSD</li>
<li>Bash was not ported to Windows, but rather Windows gained a system similar to FreeBSD’s linux_compat</li>
<li>It would be nice to have ZFS on Windows
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="https://forums.freebsd.org/threads/55642/" rel="nofollow">Credit where credit&#39;s due...</a> </p></li>
<li><p><a href="https://stable.mtier.org/" rel="nofollow">M:Tier&#39;s OpenBSD packages and binpatches updated for 5.9</a></p></li>
<li><p><a href="http://www.nycbug.org/index.cgi" rel="nofollow">NYC BUG Meeting (2016-04-06) - Debugging with LLVM, John Wolfe</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-March/459651.html" rel="nofollow">Need to create extremely high traffic loads? kq_sendrecv is worth checking out</a> </p></li>
<li><p><a href="http://www.meetup.com/CharmBUG/events/230048300/" rel="nofollow">If you&#39;re in the Maryland region, CharmBug has a meetup next week</a> </p></li>
<li><p><a href="https://www.dragonflybsd.org/docs/how_to_get_to_the_desktop/" rel="nofollow">How to get a desktop on DragonFly</a> </p></li>
<li><p><a href="https://twitter.com/q5sys/status/717509675630084096" rel="nofollow">Linux vs BSD Development Models </a> </p></li>
</ul>

<h2>Feedback/Question</h2>

<ul>
<li><a href="http://pastebin.com/raw/GrM0jKZK" rel="nofollow"> Paulo - ZFS Setup</a> </li>
<li><a href="http://pastebin.com/raw/13KCkhMU" rel="nofollow"> Jonathan - Installation </a> </li>
<li><a href="http://pastebin.com/wsx90L2m" rel="nofollow"> Andrew - Career / School</a> </li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>135: Speciality MWL</title>
  <link>https://www.bsdnow.tv/135</link>
  <guid isPermaLink="false">8a5f5b3a-051c-4322-a49a-e3f61cf57381</guid>
  <pubDate>Wed, 30 Mar 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8a5f5b3a-051c-4322-a49a-e3f61cf57381.mp3" length="72669172" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we interview author Michael W Lucas to discuss his new book in the FreeBSD</itunes:subtitle>
  <itunes:duration>1:40:55</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we interview author Michael W Lucas to discuss his new book in the FreeBSD
This episode was brought to you by
&lt;a title="iXsystems" href="http://www.ixsystems.com/bsdnow"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a title="DigitalOcean" href="http://www.digitalocean.com/"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a title="Tarsnap" href="http://www.tarsnap.com/bsdnow"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenBSD 5.9 Released early (http://undeadly.org/cgi?action=article&amp;amp;sid=20160329181346&amp;amp;mode=expanded)
Finished ahead of schedule! OpenBSD 5.9 has officially landed
We’ve been covering some of the ongoing changes as they landed in the tree, but with the official release it’s time to bring you the final list of the new hotness which landed.
First up:
Pledge - Over 70%! Of the userland utilities have been converted to use it, and the best part, you probably didn’t even notice
UEFI - Laptops which are pre-locked down to boot UEFI only can now be installed and used - GPT support has also been greatly improved
‘Less’ was replaced with a fork from Illumos, and has been further improved
Xen DomU support - OpenBSD now plays nice in the cloud
X11 - Broadwell and Bay Trail are now supported
Initial work on making the network stack better support SMP has been added, this is still ongoing, but things are starting to happen
802.11N! Specifically for the iwn/iwm drivers
In addition to support for UTF-8, most other locales have been ripped out, leaving only C and UTF-8 left standing in the wake
All and all, sounds like a solid new release with plenty of new goodies to play with. Go grab a copy now!
***
New routing table code (ART) enabled in -current (http://undeadly.org/cgi?action=article&amp;amp;sid=20160324093944)
While OpenBSD 5.9 just landed, we also have some interesting work landing right now in -CURRENT as well. Specifically the new routing table code (ART) has landed:
“I just enabled ART in -current, it will be the default routing table backend in the next snapshots.
The plan is to squash the possible regressions with this new routing table backend then when we're confident enough, take its route lookup out of the KERNEL_LOCK(). Yes, this is one of the big steps for our network SMP improvements.
In order to make progress, we need your help to make sure this new backend works well on your setup. So please, go download the next snapshot and report back.
If you encounter any routing table regression, please make sure that you cannot reproduce it with your old kernel and include the output of # route -n show
for the 2 kernels as well as the dmesg in your report.
I know that simple dhclient(8) based setups work with ART, so please do not flood us too much. It's always great to know that things work, but it's also hard to keep focus ;)
Thank your very much for your support!”
+ There you have it folks! If 5.9 is already too stale for you, time to move over to -CURRENT and give the new routing tables a whirl.
fractal cells - FreeBSD-based All-In-One solution for software development startups (https://forums.freebsd.org/threads/55561/)
Fractal Cells is a suite that transforms a stock FreeBSD installation into an instant “Startup Software Development Platform”
It Integrates ZFS, PostgreSQL, OpenSMTPD, NGINX, OpenVPN, Redmine, Jenkins, Zabbix, Gitlab, and Ansible, all under OpenLDAP common authentication
The suite is available under the 2-clause BSD license
Provides all of the tools and infrastructure to build your application, including code review, issue tracking, continuous integration, and monitoring
An interesting way to make it easier for people to start building new applications and startups on top of FreeBSD
***
LinuxSecrets publishes guide on installing FreeBSD ezJail (http://www.linuxsecrets.com/blog/51freebsd/2016/02/29/1726-installing)
Covers all of the steps of setting up ezjail on FreeBSD
Includes the instructions for updating the version of the OS in the jail
In a number of places the tutorial uses:  
&amp;gt; cat &amp;lt;&amp;lt; EOF &amp;gt;&amp;gt; /etc/rc.conf &amp;gt; setting=”value”
Instead, use: sysrc setting=”value”
It is safer, and easier to type
When you create the jail, if you specify an IP address, it is expected that this IP address is already setup on the host machine
If instead you specify: ‘em0|192.168.1.105’ (where em0 is your network interface), the IP address will be added as an alias when the jail starts, and removed from the host when the jail is stopped
You can also comma separate a list of addresses to have multiple IPs (possibly on different interfaces) in the jail
Although recently posted, this appears as if it might be an update to a previous tutorial, as there are a few old references that have not been updated (pkg_add, rc.d/ezjail.sh), while the start of the article clearly covers pkg(8)
***
Interview - Michael W. Lucas - mwlucas@michaelwlucas.com (mailto:mwlucas@michaelwlucas.com) /
@mwlauthor (https://twitter.com/mwlauthor)
+ New Book: “FreeBSD Mastery: Specialty Filesystems”
News Roundup
NetBSD on Dreamcast (https://github.com/fwbug/dreamcast-slides)
Ahh the dreamcast, so much promise. So much potential. If you are still holding onto your beloved dreamcast hoping that someday Sega will re-enter the console market… Then give it up now!
In the meantime, you can now do something more interesting with that box taking up space in the closet. We have a link to a GitHub repo where a user has uploaded his curses-based slide-show for the upcoming Fort-Wayne, Indiana meetup.
Aside from the novelty of using a curses-based slide setup, the presenter will also be displaying them from his beloved dreamcast, which “of course” runs NetBSD 7
The slide source code is available, which you too can view / compile and find out details of getting NetBSD boot-strapped on the DC.
***
OPNsense 16.1.7 Released (https://opnsense.org/opnsense-16-1-7-released/)
captive portal: add session timeout to status info
firewall: fix non-report of errors when filter reload errors couldn’t be parsed
proxy: adjust category visibility as not all of them were shown before
firmware: fix an overzealous upgrade run when the package tool only changes options
firmware: fixed the binary upgrade patch from 15.7.x in FreeBSD’s package tool
system: removed NTP settings from general settings
access: let only root access status.php as it leaks too much info
development: remove the automount features
development: addition of “opnsense-stable” package on our way to nightly builds
development: opnsense-update can now install locally available base and kernel sets
***
“FreeBSD Mastery: Advanced ZFS” in tech review (http://blather.michaelwlucas.com/archives/2570)
Most of the tech review is finished
It was very interesting to hear from many ZFS experts that they learned something from reading the review copy of the book, I was not expecting this
Many minor corrections and clarifications have been integrated
The book is now being copy edited
***
Why OpenBSD? (http://www.cambus.net/why-openbsd/)
Frederic Cambus gives us a nice perspective piece today on what his particular reasons are for choosing OpenBSD.
Frederic is no stranger to UNIX-Like systems, having used them for 20 years now. In particular starting on Slackware back in ‘96 and moving to FreeBSD from 2000-2005 (around the 4.x series)
His adventure into OpenBSD began sometime after 2005 (specific time unknown), but a bunch of things left a very good impression on him throughout the years.
First, was the ease of installation, with its very minimalistic layout, which was one of the fastest installs he had ever done.
Second was the extensive documentation, which extends beyond just manpages, but into other forms of documentation, such as presentations and papers as well.
He makes the point about an “ecosystem of quality” that surrounds OpenBSD:
OpenBSD is an ecosystem of quality. This is the result of a culture of code auditing, reviewing, and a rigorous development process where each commit hitting the tree must be approved by other developers. It has a slower evolution pace and a more carefully planned development model which leads to better code quality overall. Its well deserved reputation of being an ultra secure operating system is the byproduct of a no compromise attitude valuing simplicity, correctness, and most importantly proactivity. OpenBSD also deletes code, a lot of code. Everyone should know that removing code and keeping the codebase modern is probably as important as adding new one. Quoting Saint-Exupery: "It seems that perfection is attained not when there is nothing more to add, but when there is nothing more to remove".
The article then covers security mechanisms, as well as the defaults which are turned specifically with an eye towards security.
All-in-all a good perspective piece about the reasons why OpenBSD is the right choice for Frederic, worth your time to read up on it if you want to learn more about OpenBSD’s differences.
***
BeastieBits
Call for 2016Q1 quarterly status reports (https://docs.freebsd.org/cgi/getmsg.cgi?fetch=9011+0+current/freebsd-hackers)
FreeBSD Mastery: Advanced ZFS” sponsorships ending soon (http://blather.michaelwlucas.com/archives/2593)
Shawn Webb from HardenedBSD talking about giving away RPi3’s at BSDCan and hacking on them to get FreeBSD working (https://docs.freebsd.org/cgi/getmsg.cgi?fetch=250105+0+archive/2016/freebsd-arm/20160306.freebsd-arm)
xterm(1) now UTF-8 by default (http://undeadly.org/cgi?action=article&amp;amp;sid=20160308204011)
Call For Artists: New Icon Theme (https://blog.pcbsd.org/2016/03/call-for-artists-new-icon-theme/)
Happy 23rd Birthday, src! (http://blog.netbsd.org/tnf/entry/happy_23rd_birthday_src)
Feedback/Questions
 Alison - Readahead and Wayland (http://slexy.org/view/s2oqRuXCYW)
 Kenny - Gear (http://slexy.org/view/s2sQ8MxNPh)
 Ben - IPFW2/3 (http://slexy.org/view/s20SRvXPZA)
 Brad - ZFS Writeback (http://slexy.org/view/s207mV2Ph1)
 Simon - BSD Toonz (http://slexy.org/view/s202loSWdf)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we interview author Michael W Lucas to discuss his new book in the FreeBSD</p>

<h2>This episode was brought to you by</h2>

<p><a title="iXsystems" href="http://www.ixsystems.com/bsdnow"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a title="DigitalOcean" href="http://www.digitalocean.com/"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a title="Tarsnap" href="http://www.tarsnap.com/bsdnow"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160329181346&mode=expanded" rel="nofollow">OpenBSD 5.9 Released early</a></h3>

<ul>
<li>Finished ahead of schedule! OpenBSD 5.9 has officially landed</li>
<li>We’ve been covering some of the ongoing changes as they landed in the tree, but with the official release it’s time to bring you the final list of the new hotness which landed.</li>
<li>First up:

<ul>
<li>Pledge - Over 70%! Of the userland utilities have been converted to use it, and the best part, you probably didn’t even notice</li>
<li>UEFI - Laptops which are pre-locked down to boot UEFI only can now be installed and used - GPT support has also been greatly improved</li>
<li>‘Less’ was replaced with a fork from Illumos, and has been further improved</li>
<li>Xen DomU support - OpenBSD now plays nice in the cloud</li>
<li>X11 - Broadwell and Bay Trail are now supported</li>
<li>Initial work on making the network stack better support SMP has been added, this is still ongoing, but things are starting to happen</li>
<li>802.11N! Specifically for the iwn/iwm drivers</li>
<li>In addition to support for UTF-8, most other locales have been ripped out, leaving only C and UTF-8 left standing in the wake</li>
<li>All and all, sounds like a solid new release with plenty of new goodies to play with. Go grab a copy now!
***</li>
</ul></li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160324093944" rel="nofollow">New routing table code (ART) enabled in -current</a></h3>

<ul>
<li>While OpenBSD 5.9 just landed, we also have some interesting work landing right now in -CURRENT as well. Specifically the new routing table code (ART) has landed:</li>
</ul>

<blockquote>
<p>“I just enabled ART in -current, it will be the default routing table backend in the next snapshots.<br>
The plan is to squash the possible regressions with this new routing table backend then when we&#39;re confident enough, take its route lookup out of the KERNEL_LOCK(). Yes, this is one of the big steps for our network SMP improvements.<br>
In order to make progress, we need your help to make sure this new backend works well on your setup. So please, go download the next snapshot and report back.<br>
If you encounter any routing table regression, please make sure that you cannot reproduce it with your old kernel and include the output of # route -n show<br>
for the 2 kernels as well as the dmesg in your report.<br>
I know that simple dhclient(8) based setups work with ART, so please do not flood us too much. It&#39;s always great to know that things work, but it&#39;s also hard to keep focus ;)<br>
Thank your very much for your support!”</p>

<ul>
<li>There you have it folks! If 5.9 is already too stale for you, time to move over to -CURRENT and give the new routing tables a whirl.
***</li>
</ul>
</blockquote>

<h3><a href="https://forums.freebsd.org/threads/55561/" rel="nofollow">fractal cells - FreeBSD-based All-In-One solution for software development startups</a></h3>

<ul>
<li>Fractal Cells is a suite that transforms a stock FreeBSD installation into an instant “Startup Software Development Platform”</li>
<li>It Integrates ZFS, PostgreSQL, OpenSMTPD, NGINX, OpenVPN, Redmine, Jenkins, Zabbix, Gitlab, and Ansible, all under OpenLDAP common authentication</li>
<li>The suite is available under the 2-clause BSD license</li>
<li>Provides all of the tools and infrastructure to build your application, including code review, issue tracking, continuous integration, and monitoring</li>
<li>An interesting way to make it easier for people to start building new applications and startups on top of FreeBSD
***</li>
</ul>

<h3><a href="http://www.linuxsecrets.com/blog/51freebsd/2016/02/29/1726-installing" rel="nofollow">LinuxSecrets publishes guide on installing FreeBSD ezJail</a></h3>

<ul>
<li>Covers all of the steps of setting up ezjail on FreeBSD</li>
<li>Includes the instructions for updating the version of the OS in the jail</li>
<li>In a number of places the tutorial uses:<br>
&gt; cat &lt;&lt; EOF &gt;&gt; /etc/rc.conf &gt; setting=”value”</li>
<li>Instead, use: sysrc setting=”value”</li>
<li>It is safer, and easier to type</li>
<li>When you create the jail, if you specify an IP address, it is expected that this IP address is already setup on the host machine</li>
<li>If instead you specify: ‘em0|192.168.1.105’ (where em0 is your network interface), the IP address will be added as an alias when the jail starts, and removed from the host when the jail is stopped</li>
<li>You can also comma separate a list of addresses to have multiple IPs (possibly on different interfaces) in the jail</li>
<li>Although recently posted, this appears as if it might be an update to a previous tutorial, as there are a few old references that have not been updated (pkg_add, rc.d/ezjail.sh), while the start of the article clearly covers pkg(8)
***</li>
</ul>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com" rel="nofollow">mwlucas@michaelwlucas.com</a> /</h2>

<p><a href="https://twitter.com/mwlauthor" rel="nofollow">@mwlauthor</a></p>

<ul>
<li>New Book: “FreeBSD Mastery: Specialty Filesystems”</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/fwbug/dreamcast-slides" rel="nofollow">NetBSD on Dreamcast</a></h3>

<ul>
<li>Ahh the dreamcast, so much promise. So much potential. If you are still holding onto your beloved dreamcast hoping that someday Sega will re-enter the console market… Then give it up now!</li>
<li>In the meantime, you can now do something more interesting with that box taking up space in the closet. We have a link to a GitHub repo where a user has uploaded his curses-based slide-show for the upcoming Fort-Wayne, Indiana meetup.</li>
<li>Aside from the novelty of using a curses-based slide setup, the presenter will also be displaying them from his beloved dreamcast, which “of course” runs NetBSD 7</li>
<li>The slide source code is available, which you too can view / compile and find out details of getting NetBSD boot-strapped on the DC.
***</li>
</ul>

<h3><a href="https://opnsense.org/opnsense-16-1-7-released/" rel="nofollow">OPNsense 16.1.7 Released</a></h3>

<ul>
<li>captive portal: add session timeout to status info</li>
<li>firewall: fix non-report of errors when filter reload errors couldn’t be parsed</li>
<li>proxy: adjust category visibility as not all of them were shown before</li>
<li>firmware: fix an overzealous upgrade run when the package tool only changes options</li>
<li>firmware: fixed the binary upgrade patch from 15.7.x in FreeBSD’s package tool</li>
<li>system: removed NTP settings from general settings</li>
<li>access: let only root access status.php as it leaks too much info</li>
<li>development: remove the automount features</li>
<li>development: addition of “opnsense-stable” package on our way to nightly builds</li>
<li>development: opnsense-update can now install locally available base and kernel sets
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/2570" rel="nofollow">“FreeBSD Mastery: Advanced ZFS” in tech review</a></h3>

<ul>
<li>Most of the tech review is finished</li>
<li>It was very interesting to hear from many ZFS experts that they learned something from reading the review copy of the book, I was not expecting this</li>
<li>Many minor corrections and clarifications have been integrated</li>
<li>The book is now being copy edited
***</li>
</ul>

<h3><a href="http://www.cambus.net/why-openbsd/" rel="nofollow">Why OpenBSD?</a></h3>

<ul>
<li>Frederic Cambus gives us a nice perspective piece today on what his particular reasons are for choosing OpenBSD.</li>
<li>Frederic is no stranger to UNIX-Like systems, having used them for 20 years now. In particular starting on Slackware back in ‘96 and moving to FreeBSD from 2000-2005 (around the 4.x series)</li>
<li>His adventure into OpenBSD began sometime after 2005 (specific time unknown), but a bunch of things left a very good impression on him throughout the years.</li>
<li>First, was the ease of installation, with its very minimalistic layout, which was one of the fastest installs he had ever done.</li>
<li>Second was the extensive documentation, which extends beyond just manpages, but into other forms of documentation, such as presentations and papers as well.</li>
<li>He makes the point about an “ecosystem of quality” that surrounds OpenBSD:</li>
</ul>

<blockquote>
<p>OpenBSD is an ecosystem of quality. This is the result of a culture of code auditing, reviewing, and a rigorous development process where each commit hitting the tree must be approved by other developers. It has a slower evolution pace and a more carefully planned development model which leads to better code quality overall. Its well deserved reputation of being an ultra secure operating system is the byproduct of a no compromise attitude valuing simplicity, correctness, and most importantly proactivity. OpenBSD also deletes code, a lot of code. Everyone should know that removing code and keeping the codebase modern is probably as important as adding new one. Quoting Saint-Exupery: &quot;It seems that perfection is attained not when there is nothing more to add, but when there is nothing more to remove&quot;.</p>
</blockquote>

<ul>
<li>The article then covers security mechanisms, as well as the defaults which are turned specifically with an eye towards security.</li>
<li>All-in-all a good perspective piece about the reasons why OpenBSD is the right choice for Frederic, worth your time to read up on it if you want to learn more about OpenBSD’s differences.
***</li>
</ul>

<h2>BeastieBits</h2>

<ul>
<li><a href="https://docs.freebsd.org/cgi/getmsg.cgi?fetch=9011+0+current/freebsd-hackers" rel="nofollow">Call for 2016Q1 quarterly status reports</a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2593" rel="nofollow">FreeBSD Mastery: Advanced ZFS” sponsorships ending soon</a></li>
<li><a href="https://docs.freebsd.org/cgi/getmsg.cgi?fetch=250105+0+archive/2016/freebsd-arm/20160306.freebsd-arm" rel="nofollow">Shawn Webb from HardenedBSD talking about giving away RPi3’s at BSDCan and hacking on them to get FreeBSD working</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160308204011" rel="nofollow">xterm(1) now UTF-8 by default</a></li>
<li><a href="https://blog.pcbsd.org/2016/03/call-for-artists-new-icon-theme/" rel="nofollow">Call For Artists: New Icon Theme</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/happy_23rd_birthday_src" rel="nofollow">Happy 23rd Birthday, src!</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2oqRuXCYW" rel="nofollow"> Alison - Readahead and Wayland</a></li>
<li><a href="http://slexy.org/view/s2sQ8MxNPh" rel="nofollow"> Kenny - Gear</a></li>
<li><a href="http://slexy.org/view/s20SRvXPZA" rel="nofollow"> Ben - IPFW2/3</a></li>
<li><a href="http://slexy.org/view/s207mV2Ph1" rel="nofollow"> Brad - ZFS Writeback</a></li>
<li><a href="http://slexy.org/view/s202loSWdf" rel="nofollow"> Simon - BSD Toonz</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we interview author Michael W Lucas to discuss his new book in the FreeBSD</p>

<h2>This episode was brought to you by</h2>

<p><a title="iXsystems" href="http://www.ixsystems.com/bsdnow"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a title="DigitalOcean" href="http://www.digitalocean.com/"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a title="Tarsnap" href="http://www.tarsnap.com/bsdnow"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160329181346&mode=expanded" rel="nofollow">OpenBSD 5.9 Released early</a></h3>

<ul>
<li>Finished ahead of schedule! OpenBSD 5.9 has officially landed</li>
<li>We’ve been covering some of the ongoing changes as they landed in the tree, but with the official release it’s time to bring you the final list of the new hotness which landed.</li>
<li>First up:

<ul>
<li>Pledge - Over 70%! Of the userland utilities have been converted to use it, and the best part, you probably didn’t even notice</li>
<li>UEFI - Laptops which are pre-locked down to boot UEFI only can now be installed and used - GPT support has also been greatly improved</li>
<li>‘Less’ was replaced with a fork from Illumos, and has been further improved</li>
<li>Xen DomU support - OpenBSD now plays nice in the cloud</li>
<li>X11 - Broadwell and Bay Trail are now supported</li>
<li>Initial work on making the network stack better support SMP has been added, this is still ongoing, but things are starting to happen</li>
<li>802.11N! Specifically for the iwn/iwm drivers</li>
<li>In addition to support for UTF-8, most other locales have been ripped out, leaving only C and UTF-8 left standing in the wake</li>
<li>All and all, sounds like a solid new release with plenty of new goodies to play with. Go grab a copy now!
***</li>
</ul></li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160324093944" rel="nofollow">New routing table code (ART) enabled in -current</a></h3>

<ul>
<li>While OpenBSD 5.9 just landed, we also have some interesting work landing right now in -CURRENT as well. Specifically the new routing table code (ART) has landed:</li>
</ul>

<blockquote>
<p>“I just enabled ART in -current, it will be the default routing table backend in the next snapshots.<br>
The plan is to squash the possible regressions with this new routing table backend then when we&#39;re confident enough, take its route lookup out of the KERNEL_LOCK(). Yes, this is one of the big steps for our network SMP improvements.<br>
In order to make progress, we need your help to make sure this new backend works well on your setup. So please, go download the next snapshot and report back.<br>
If you encounter any routing table regression, please make sure that you cannot reproduce it with your old kernel and include the output of # route -n show<br>
for the 2 kernels as well as the dmesg in your report.<br>
I know that simple dhclient(8) based setups work with ART, so please do not flood us too much. It&#39;s always great to know that things work, but it&#39;s also hard to keep focus ;)<br>
Thank your very much for your support!”</p>

<ul>
<li>There you have it folks! If 5.9 is already too stale for you, time to move over to -CURRENT and give the new routing tables a whirl.
***</li>
</ul>
</blockquote>

<h3><a href="https://forums.freebsd.org/threads/55561/" rel="nofollow">fractal cells - FreeBSD-based All-In-One solution for software development startups</a></h3>

<ul>
<li>Fractal Cells is a suite that transforms a stock FreeBSD installation into an instant “Startup Software Development Platform”</li>
<li>It Integrates ZFS, PostgreSQL, OpenSMTPD, NGINX, OpenVPN, Redmine, Jenkins, Zabbix, Gitlab, and Ansible, all under OpenLDAP common authentication</li>
<li>The suite is available under the 2-clause BSD license</li>
<li>Provides all of the tools and infrastructure to build your application, including code review, issue tracking, continuous integration, and monitoring</li>
<li>An interesting way to make it easier for people to start building new applications and startups on top of FreeBSD
***</li>
</ul>

<h3><a href="http://www.linuxsecrets.com/blog/51freebsd/2016/02/29/1726-installing" rel="nofollow">LinuxSecrets publishes guide on installing FreeBSD ezJail</a></h3>

<ul>
<li>Covers all of the steps of setting up ezjail on FreeBSD</li>
<li>Includes the instructions for updating the version of the OS in the jail</li>
<li>In a number of places the tutorial uses:<br>
&gt; cat &lt;&lt; EOF &gt;&gt; /etc/rc.conf &gt; setting=”value”</li>
<li>Instead, use: sysrc setting=”value”</li>
<li>It is safer, and easier to type</li>
<li>When you create the jail, if you specify an IP address, it is expected that this IP address is already setup on the host machine</li>
<li>If instead you specify: ‘em0|192.168.1.105’ (where em0 is your network interface), the IP address will be added as an alias when the jail starts, and removed from the host when the jail is stopped</li>
<li>You can also comma separate a list of addresses to have multiple IPs (possibly on different interfaces) in the jail</li>
<li>Although recently posted, this appears as if it might be an update to a previous tutorial, as there are a few old references that have not been updated (pkg_add, rc.d/ezjail.sh), while the start of the article clearly covers pkg(8)
***</li>
</ul>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com" rel="nofollow">mwlucas@michaelwlucas.com</a> /</h2>

<p><a href="https://twitter.com/mwlauthor" rel="nofollow">@mwlauthor</a></p>

<ul>
<li>New Book: “FreeBSD Mastery: Specialty Filesystems”</li>
</ul>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/fwbug/dreamcast-slides" rel="nofollow">NetBSD on Dreamcast</a></h3>

<ul>
<li>Ahh the dreamcast, so much promise. So much potential. If you are still holding onto your beloved dreamcast hoping that someday Sega will re-enter the console market… Then give it up now!</li>
<li>In the meantime, you can now do something more interesting with that box taking up space in the closet. We have a link to a GitHub repo where a user has uploaded his curses-based slide-show for the upcoming Fort-Wayne, Indiana meetup.</li>
<li>Aside from the novelty of using a curses-based slide setup, the presenter will also be displaying them from his beloved dreamcast, which “of course” runs NetBSD 7</li>
<li>The slide source code is available, which you too can view / compile and find out details of getting NetBSD boot-strapped on the DC.
***</li>
</ul>

<h3><a href="https://opnsense.org/opnsense-16-1-7-released/" rel="nofollow">OPNsense 16.1.7 Released</a></h3>

<ul>
<li>captive portal: add session timeout to status info</li>
<li>firewall: fix non-report of errors when filter reload errors couldn’t be parsed</li>
<li>proxy: adjust category visibility as not all of them were shown before</li>
<li>firmware: fix an overzealous upgrade run when the package tool only changes options</li>
<li>firmware: fixed the binary upgrade patch from 15.7.x in FreeBSD’s package tool</li>
<li>system: removed NTP settings from general settings</li>
<li>access: let only root access status.php as it leaks too much info</li>
<li>development: remove the automount features</li>
<li>development: addition of “opnsense-stable” package on our way to nightly builds</li>
<li>development: opnsense-update can now install locally available base and kernel sets
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/2570" rel="nofollow">“FreeBSD Mastery: Advanced ZFS” in tech review</a></h3>

<ul>
<li>Most of the tech review is finished</li>
<li>It was very interesting to hear from many ZFS experts that they learned something from reading the review copy of the book, I was not expecting this</li>
<li>Many minor corrections and clarifications have been integrated</li>
<li>The book is now being copy edited
***</li>
</ul>

<h3><a href="http://www.cambus.net/why-openbsd/" rel="nofollow">Why OpenBSD?</a></h3>

<ul>
<li>Frederic Cambus gives us a nice perspective piece today on what his particular reasons are for choosing OpenBSD.</li>
<li>Frederic is no stranger to UNIX-Like systems, having used them for 20 years now. In particular starting on Slackware back in ‘96 and moving to FreeBSD from 2000-2005 (around the 4.x series)</li>
<li>His adventure into OpenBSD began sometime after 2005 (specific time unknown), but a bunch of things left a very good impression on him throughout the years.</li>
<li>First, was the ease of installation, with its very minimalistic layout, which was one of the fastest installs he had ever done.</li>
<li>Second was the extensive documentation, which extends beyond just manpages, but into other forms of documentation, such as presentations and papers as well.</li>
<li>He makes the point about an “ecosystem of quality” that surrounds OpenBSD:</li>
</ul>

<blockquote>
<p>OpenBSD is an ecosystem of quality. This is the result of a culture of code auditing, reviewing, and a rigorous development process where each commit hitting the tree must be approved by other developers. It has a slower evolution pace and a more carefully planned development model which leads to better code quality overall. Its well deserved reputation of being an ultra secure operating system is the byproduct of a no compromise attitude valuing simplicity, correctness, and most importantly proactivity. OpenBSD also deletes code, a lot of code. Everyone should know that removing code and keeping the codebase modern is probably as important as adding new one. Quoting Saint-Exupery: &quot;It seems that perfection is attained not when there is nothing more to add, but when there is nothing more to remove&quot;.</p>
</blockquote>

<ul>
<li>The article then covers security mechanisms, as well as the defaults which are turned specifically with an eye towards security.</li>
<li>All-in-all a good perspective piece about the reasons why OpenBSD is the right choice for Frederic, worth your time to read up on it if you want to learn more about OpenBSD’s differences.
***</li>
</ul>

<h2>BeastieBits</h2>

<ul>
<li><a href="https://docs.freebsd.org/cgi/getmsg.cgi?fetch=9011+0+current/freebsd-hackers" rel="nofollow">Call for 2016Q1 quarterly status reports</a></li>
<li><a href="http://blather.michaelwlucas.com/archives/2593" rel="nofollow">FreeBSD Mastery: Advanced ZFS” sponsorships ending soon</a></li>
<li><a href="https://docs.freebsd.org/cgi/getmsg.cgi?fetch=250105+0+archive/2016/freebsd-arm/20160306.freebsd-arm" rel="nofollow">Shawn Webb from HardenedBSD talking about giving away RPi3’s at BSDCan and hacking on them to get FreeBSD working</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20160308204011" rel="nofollow">xterm(1) now UTF-8 by default</a></li>
<li><a href="https://blog.pcbsd.org/2016/03/call-for-artists-new-icon-theme/" rel="nofollow">Call For Artists: New Icon Theme</a></li>
<li><a href="http://blog.netbsd.org/tnf/entry/happy_23rd_birthday_src" rel="nofollow">Happy 23rd Birthday, src!</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2oqRuXCYW" rel="nofollow"> Alison - Readahead and Wayland</a></li>
<li><a href="http://slexy.org/view/s2sQ8MxNPh" rel="nofollow"> Kenny - Gear</a></li>
<li><a href="http://slexy.org/view/s20SRvXPZA" rel="nofollow"> Ben - IPFW2/3</a></li>
<li><a href="http://slexy.org/view/s207mV2Ph1" rel="nofollow"> Brad - ZFS Writeback</a></li>
<li><a href="http://slexy.org/view/s202loSWdf" rel="nofollow"> Simon - BSD Toonz</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>134: Marking up the Ports tree</title>
  <link>https://www.bsdnow.tv/134</link>
  <guid isPermaLink="false">af2a0241-5911-434f-8fe1-6dd556b074ae</guid>
  <pubDate>Thu, 24 Mar 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/af2a0241-5911-434f-8fe1-6dd556b074ae.mp3" length="90344596" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, Allan and I have gotten a bit more sleep since AsiaBSDCon, which is excellent since there is a LOT of news to cover. That plus our interview with Ports SecTeam member Mark Felder. So keep it</itunes:subtitle>
  <itunes:duration>2:05:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, Allan and I have gotten a bit more sleep since AsiaBSDCon, which is excellent since there is a LOT of news to cover. That plus our interview with Ports SecTeam member Mark Felder. So keep it
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeNAS 9.10 Released (http://lists.freenas.org/pipermail/freenas-announce/2016-March/000028.html)
OS:
The base OS version for FreeNAS 9.10 is now FreeBSD 10.3-RC3, bringing in a huge number of OS-related bug fixes, performance improvements and new features.
+Directory Services:
You can now connect to large AD domains with cache disabled.
+Reporting:
Add the ability to send collectd data to a remote graphite server.
+Hardware Support:
Added Support for Intel I219-V &amp;amp; I219-LM Gigabit Ethernet Chipset
Added Support for Intel Skylake architecture
Improved support for USB devices (like network adapters)
USB 3.0 devices now supported.
+Filesharing:
Samba (SMB filesharing) updated from version 4.1 to 4.3.4
Added GUI feature to allow nfsv3-like ownership when using nfsv4
Various bug fixes related to FreeBSD 10.
+Ports:
FreeBSD ports updated to follow the FreeBSD 2016Q1 branch.
+Jails:
FreeBSD Jails now default to a FreeBSD 10.3-RC2 based template.
Old jails, or systems on which jails have been installed, will still default to the previous FreeBSD 9.3 based template. Only those machinesusing jails for the first time (or deleting and recreating their jails dataset) will use the new template.
+bhyve:
++In the upcoming 10 release, the CLI will offer full support for managing virtual machines and containers. Until then, the iohyve command is bundled as a stop-gap solution to provide basic VM management support -
***
Ubuntu BSD's first Beta Release (https://sourceforge.net/projects/ubuntubsd/)
Under the category of “Where did this come from?”, we have a first beta release of Ubuntu BSD.
Specifically it is Ubuntu, respun to use the FreeBSD kernel and ZFS natively.
From looking at the minimal information up on sourceforge, we gather that is has a nice text-based installer, which supports ZFS configuration and iSCSI volume creation setups.
Aside from that, it includes the XFCE desktop out of box, but claims to be suitable for both desktops and servers alike right now.
We will keep an eye on this, if anybody listening has already tested it out, maybe drop us a line on your thoughts of how this mash-up works out.
***
FreeBSD - a lesson in poor defaults (http://vez.mrsk.me/freebsd-defaults.txt)
Former BSD producer, and now OpenBSD developer, TJ, writes a post detailing the defaults he changes in a fresh FreeBSD installation
Maybe some of these should be the defaults
While others are definitely a personal preference, or are not as security related as they seem
A few of these, while valid criticisms, but some are done for a reason
Specifically, the OpenSSH changes.
So, you’re a user, you install FreeBSD 10.0, and it comes with OpenSSH version X, which has some specific defaults
As guaranteed by the FreeBSD Project, you will have a nice smooth upgrade path to any version in the 10.x branch
Just because OpenSSH has released version Y, doesn’t mean that the upgrade can suddenly remove support for DSA keys, or re-adding support for AES-CBC (which is not really weak, and which can be hardware accelerated, unlikely most of the replacements)
“FreeBSD is the team trying to increase the risk.” Is incorrect, they are trying to reduce the impact on the end user
Specifically, a user upgrading from 10.x to 10.3, should not end up locked out of their SSH server, or otherwise confronted by unexpected errors or slowdowns because of upstream changes
I will note again, (and again), that the NONE cipher can NOT allow a user to “shoot themselves in the foot”, encryption is still used during the login phase, it is just disabled for the file transfer phase. The NONE cipher will refuse to work for an interactive session.
While the post states that the NONE cipher doesn’t improve performance that much, it infact does
In my own testing, chacha20-poly1305 1.3 gbps, aes128-gcm (fastest) 5.0 gbps, NONE cipher 6.3 gbps
That means that the NONE cipher is an hour faster to transfer 10 TB over the LAN.
The article suggests just removing sendmail with no replacement. Not sure how they expect users to deliver mail, or the daily/weekly reports
Ports can be compiled as a regular user. Only the install phase requires root
for ntpd, it is not clear that there is an acceptable replacement yet, but I will not that it is off by default
In the sysctl section, I am not sure I see how enabling tcp blackhole actually increases security at all
I am not sure that linking to every security advisory in openssl since 2001 is actually useful
Encrypted swap is an option in bsdinstall now, but I am not sure it is really that important
FreeBSD now uses the Fortuna PRNG, upgraded to replace the older Yarrow, not vanilla RC4.
“The resistance from the security team to phase out legacy options makes mewonder if they should be called a compatibility team instead.”
I do not think this is the choice of the security team, it is the ABI guarantee that the project makes. The stable/10 branch will always have the same ABI, and a program or driver compiled against it will work with any version on that branch
The security team doesn’t really have a choice in the matter. Switching the version of OpenSSL used in FreeBSD 9.x would likely break a large number of applications the user has installed
Something may need to be done differently, since it doesn’t look like any version of OpenSSL, (or OpenSSH), will be supported for 5 years ever again
***
ZFS Raidz Performance, Capacity and Integrity (https://calomel.org/zfs_raid_speed_capacity.html)
An updated version of an article comparing the performance of various ZFS vdev configurations
The settings users in the test may not reflect your workload
If you are benchmarking ZFS, consider using multiple files across different datasets, and not making all of the writes synchronous
Also, it is advisable to run more than 3 runs of each test
Comparing the numbers from the 12 and 24 disk tests, it is surprising to see that the 12 mirror sets did not outperform the other configurations. In the 12 drive tests, the 6 mirror sets had about the same read performance as the other configurations, it is not clear why the performance with more disks is worse, or why it is no longer in line with the other configurations
More investigation of this would be required
There are obviously so other bottlenecks, as 5x SSDs in RAID-Z1 performed the same as 17x SSDs in RAID-Z1
Interesting results none the less
***
iXSystems
FreeNAS Mini Review (http://www.nasanda.com/2016/03/ixsystems-freenas-mini-nas-device-reviewed/) 
Interview - Mark Felder - feld@freebsd.org (mailto:feld@freebsd.org) / @feldpos (https://twitter.com/feldpos)
Ports, Ports and more Ports
DigitalOcean
Digital Ocean's guide to setting up an OpenVPN server (https://www.digitalocean.com/community/tutorials/how-to-configure-and-connect-to-a-private-openvpn-server-on-freebsd-10-1) 
News Roundup
AsiaBSDCon OpenBSD Papers (http://undeadly.org/cgi?action=article&amp;amp;sid=20160316153158&amp;amp;mode=flat&amp;amp;count=0) 
+ Undeadly.org has compiled a handy list of the various OpenBSD talks / papers that were offered a few weeks ago at AsiaBSDCon 2016.
Antoine Jacoutot (ajacoutot@) - OpenBSD rc.d(8) (slides | paper)
Henning Brauer (henning@) - Running an ISP on OpenBSD (slides)
Mike Belopuhov (mikeb@) - Implementation of Xen PVHVM drivers in OpenBSD (slides | paper)
Mike Belopuhov (mikeb@) - OpenBSD project status update (slides)
Mike Larkin (mlarkin@) - OpenBSD vmm Update (slides)
Reyk Floeter (reyk@) - OpenBSD vmd Update (slides) 
Each talk provides slides, and some the papers as well. Also included is the update to ‘vmm’ discussed at bhyveCon, which will be of interest to virtualization enthusiasts.
***
Bitcoin Devs could learn a lot from BSD (http://bitcoinist.net/bitcoin-devs-could-learn-a-lot-from-bsd/)
An interesting article this week, comparing two projects that at first glance may not be entirely related, namely BitCoin and BSD.
The article first details some of the woes currently plaguing the BitCoin development community, such as toxic community feedback to changes and stakeholders with vested financial interests being unable to work towards a common development purpose.
This leads into the crux or the article, about what BitCoin devs could learn from BSD:
First and foremost, the way code is developed needs change to stop the current negative trend in Bitcoin. The FreeBSD project has a rigid internal hierarchy of people with write access to their codebase, which the various Bitcoin implementations also have, but BSD does this in a way that is very open to fresh eyes on their code, allowing parallel problem solving without the petty infighting we see in Bitcoin. Anyone can propose a commit publicly to the code, make it publicly available, and democratically decide which change ends up in the codebase. FreeBSD has a tiny number of core developers compared to the size of their codebase, but at any point, they have a huge community advancing their project without hard forks popping up at every small disagreement. Brian Armstrong commented recently on this flaw with Bitcoin development, particularly with the Core Devs:
“Being high IQ is not enough for a team to succeed. You need to make reasonable tradeoffs, collaborate, be welcoming, communicate, and be easy to work with. Any team that doesn’t have this will be unable to attract top talent and will struggle long term. In my opinion, perhaps the biggest risk in Bitcoin right now is, ironically, one of the things which has helped it the most in the past: the Bitcoin Core developers.”
A good summary of the culture that could be adopted is summed up as follows:
The other thing Bitcoin devs could learn from is the BSD community’s adoption of the Unix Design philosophy. Primarily “Worse is Better,” The rule of Diversity, and Do One Thing and Do It Well. “Worse is Better” emphasizes using extant functional solutions rather than making more complex ones, even if they would be more robust. The Rule of Diversity stresses flexibility of the program being developed, allowing for modification and different implementations without breaking. Do one Thing and Do it well is a mantra of the BSD and Unix Communities that stresses modularity and progress over “perfect” solutions. Each of these elements help to make BSD a wildly successful open source project with a healthy development community and lots of inter-cooperation between the different BSD systems. While this is the opposite of what we see with Bitcoin at present, the situation is salvageable provided changes like this are made, especially by Core Developers.
All in all, a well written and interesting take on the FreeBSD/BSD project. We hope the BitCoin devs can take something useful from it down the road.
***
FreeBSD cross-compiling with gcc and poudriere (http://ben.eficium.net/2016/03/freebsd-cross-compiling-with-gcc.html)
Cross-Compiling, always a challenge, has gotten easier using poudriere and qemu in recent years.
However this blog post details some of the particular issues still being face when trying to compile some certain ports for ARM (I.E. rPi) that don’t play nicely with FreeBSD’s default CLANG compiler.
The writer (Ben Slack) takes us through some of the work-arounds he uses to build some troublesome ports, namely lsof and libatomic_ops. 
Note this is not just an issue with cross compile, the above mentioned ports also don’t build with clang on the Pi directly. 
After doing the initial poudriere/qemu cross-compile setup, he then shows us the minor tweaks to adjust which compiler builds specific ports, and how he triggers the builds using poudriere.
With the actual Makefile adjustment being so minor, one wonders if this shouldn’t just be committed upstream, with some if (ARM) - USE_GCC=yes type conditional. 
***
Nvidia releases new Beta graphics driver for FreeBSD (https://devtalk.nvidia.com/default/topic/925607/unix-graphics-announcements-and-news/linux-solaris-and-freebsd-driver-364-12-beta-/)
Added support for the following GPUs: GeForce 920MX &amp;amp; GeForce 930MX
Added support for the Vulkan API version 1.0.
Fixed a bug that could cause incorrect frame rate reporting on Quadro Sync configurations with multiple GPUs.
Added a new RandR property, CscMatrix, which specifies a 3x4 color-space conversion matrix.
Improved handling of the X gamma ramp on GF119 and newer GPUs. On these GPUs, the RandR gamma ramp is always 1024 entries and now applies to the cursor and VDPAU or workstation overlays in addition to the X root window.
Fixes for bugs and added several other EGL extensions
***
Beastie Bits
New TN Bug started (http://knoxbug.org/) 
DragonFlyBSD Network/TCP Performance's gets a bump (http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4a43469a10cef8c17553c342aab9d73611ea7bc8?utm_source=anzwix)
FreeBSD Foundation introduces a new website and logo (https://www.freebsdfoundation.org/blog/introducing-a-new-look-for-the-foundation/)
Our producer made these based on the new logo:
http://q5sys.sh/2016/03/a-new-freebsd-foundation-logo-means-its-time-for-some-new-wallpapers/
http://q5sys.sh/2016/03/pc-bsd-and-lumina-desktop-wallpapers/
https://github.com/pcbsd/lumina/commit/60314f46247b7ad6e877af503b3814b0be170da8 
IPv6 errata for 5.7/5.8, pledge errata for 5.9 (http://undeadly.org/cgi?action=article&amp;amp;sid=20160316190937&amp;amp;mode=flat)
Sponsoring “PAM Mastery” (http://blather.michaelwlucas.com/archives/2577)
A visualization of FreeBSD commits on GitHub for 2015 (https://rocketgraph.com/s/v89jBkKN4e-)
The VAX platform is no more (http://undeadly.org/cgi?action=article&amp;amp;sid=20160309192510)
Feedback/Questions
 Hunter - Utils for Blind (http://slexy.org/view/s20KPYDOsq) 
 Chris - ZFS Quotas (http://slexy.org/view/s2EHdI3z3L) 
 Anonymous - Tun, Tap and Me! (http://slexy.org/view/s21Nx1VSiU) 
 Andrew - Navigating the BSDs (http://slexy.org/view/s2ZKK2DZTL) 
 Brent - Wifi on BSD (http://slexy.org/view/s20duO29mN) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, Allan and I have gotten a bit more sleep since AsiaBSDCon, which is excellent since there is a LOT of news to cover. That plus our interview with Ports SecTeam member Mark Felder. So keep it</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://lists.freenas.org/pipermail/freenas-announce/2016-March/000028.html" rel="nofollow">FreeNAS 9.10 Released</a></h3>

<ul>
<li>OS:

<ul>
<li>The base OS version for FreeNAS 9.10 is now FreeBSD 10.3-RC3, bringing in a huge number of OS-related bug fixes, performance improvements and new features.
+Directory Services:</li>
<li>You can now connect to large AD domains with cache disabled.
+Reporting:</li>
<li>Add the ability to send collectd data to a remote graphite server.
+Hardware Support:</li>
<li>Added Support for Intel I219-V &amp; I219-LM Gigabit Ethernet Chipset</li>
<li>Added Support for Intel Skylake architecture</li>
<li>Improved support for USB devices (like network adapters)</li>
<li>USB 3.0 devices now supported.
+Filesharing:</li>
<li>Samba (SMB filesharing) updated from version 4.1 to 4.3.4</li>
<li>Added GUI feature to allow nfsv3-like ownership when using nfsv4</li>
<li>Various bug fixes related to FreeBSD 10.
+Ports:</li>
<li>FreeBSD ports updated to follow the FreeBSD 2016Q1 branch.
+Jails:</li>
<li>FreeBSD Jails now default to a FreeBSD 10.3-RC2 based template.</li>
<li>Old jails, or systems on which jails have been installed, will still default to the previous FreeBSD 9.3 based template. Only those machinesusing jails for the first time (or deleting and recreating their jails dataset) will use the new template.
+bhyve:
++In the upcoming 10 release, the CLI will offer full support for managing virtual machines and containers. Until then, the iohyve command is bundled as a stop-gap solution to provide basic VM management support -
***</li>
</ul></li>
</ul>

<h3><a href="https://sourceforge.net/projects/ubuntubsd/" rel="nofollow">Ubuntu BSD&#39;s first Beta Release</a></h3>

<ul>
<li>Under the category of “Where did this come from?”, we have a first beta release of Ubuntu BSD.</li>
<li>Specifically it is Ubuntu, respun to use the FreeBSD kernel and ZFS natively.</li>
<li>From looking at the minimal information up on sourceforge, we gather that is has a nice text-based installer, which supports ZFS configuration and iSCSI volume creation setups.</li>
<li>Aside from that, it includes the XFCE desktop out of box, but claims to be suitable for both desktops and servers alike right now.</li>
<li>We will keep an eye on this, if anybody listening has already tested it out, maybe drop us a line on your thoughts of how this mash-up works out.
***</li>
</ul>

<h3><a href="http://vez.mrsk.me/freebsd-defaults.txt" rel="nofollow">FreeBSD - a lesson in poor defaults</a></h3>

<ul>
<li>Former BSD producer, and now OpenBSD developer, TJ, writes a post detailing the defaults he changes in a fresh FreeBSD installation</li>
<li>Maybe some of these should be the defaults</li>
<li>While others are definitely a personal preference, or are not as security related as they seem</li>
<li>A few of these, while valid criticisms, but some are done for a reason</li>
<li>Specifically, the OpenSSH changes.</li>
<li>So, you’re a user, you install FreeBSD 10.0, and it comes with OpenSSH version X, which has some specific defaults</li>
<li>As guaranteed by the FreeBSD Project, you will have a nice smooth upgrade path to any version in the 10.x branch</li>
<li>Just because OpenSSH has released version Y, doesn’t mean that the upgrade can suddenly remove support for DSA keys, or re-adding support for AES-CBC (which is not really weak, and which can be hardware accelerated, unlikely most of the replacements)</li>
<li>“FreeBSD is the team trying to increase the risk.” Is incorrect, they are trying to reduce the impact on the end user</li>
<li>Specifically, a user upgrading from 10.x to 10.3, should not end up locked out of their SSH server, or otherwise confronted by unexpected errors or slowdowns because of upstream changes</li>
<li>I will note again, (and again), that the NONE cipher can NOT allow a user to “shoot themselves in the foot”, encryption is still used during the login phase, it is just disabled for the file transfer phase. The NONE cipher will refuse to work for an interactive session.</li>
<li>While the post states that the NONE cipher doesn’t improve performance that much, it infact does</li>
<li>In my own testing, chacha20-poly1305 1.3 gbps, aes128-gcm (fastest) 5.0 gbps, NONE cipher 6.3 gbps</li>
<li>That means that the NONE cipher is an hour faster to transfer 10 TB over the LAN.</li>
<li>The article suggests just removing sendmail with no replacement. Not sure how they expect users to deliver mail, or the daily/weekly reports</li>
<li>Ports can be compiled as a regular user. Only the install phase requires root</li>
<li>for ntpd, it is not clear that there is an acceptable replacement yet, but I will not that it is off by default</li>
<li>In the sysctl section, I am not sure I see how enabling tcp blackhole actually increases security at all</li>
<li>I am not sure that linking to every security advisory in openssl since 2001 is actually useful</li>
<li>Encrypted swap is an option in bsdinstall now, but I am not sure it is really that important</li>
<li>FreeBSD now uses the Fortuna PRNG, upgraded to replace the older Yarrow, not vanilla RC4.</li>
<li>“The resistance from the security team to phase out legacy options makes mewonder if they should be called a compatibility team instead.”</li>
<li>I do not think this is the choice of the security team, it is the ABI guarantee that the project makes. The stable/10 branch will always have the same ABI, and a program or driver compiled against it will work with any version on that branch</li>
<li>The security team doesn’t really have a choice in the matter. Switching the version of OpenSSL used in FreeBSD 9.x would likely break a large number of applications the user has installed</li>
<li>Something may need to be done differently, since it doesn’t look like any version of OpenSSL, (or OpenSSH), will be supported for 5 years ever again
***</li>
</ul>

<h3><a href="https://calomel.org/zfs_raid_speed_capacity.html" rel="nofollow">ZFS Raidz Performance, Capacity and Integrity</a></h3>

<ul>
<li>An updated version of an article comparing the performance of various ZFS vdev configurations</li>
<li>The settings users in the test may not reflect your workload</li>
<li>If you are benchmarking ZFS, consider using multiple files across different datasets, and not making all of the writes synchronous</li>
<li>Also, it is advisable to run more than 3 runs of each test</li>
<li>Comparing the numbers from the 12 and 24 disk tests, it is surprising to see that the 12 mirror sets did not outperform the other configurations. In the 12 drive tests, the 6 mirror sets had about the same read performance as the other configurations, it is not clear why the performance with more disks is worse, or why it is no longer in line with the other configurations</li>
<li>More investigation of this would be required</li>
<li>There are obviously so other bottlenecks, as 5x SSDs in RAID-Z1 performed the same as 17x SSDs in RAID-Z1</li>
<li>Interesting results none the less
***</li>
</ul>

<h2>iXSystems</h2>

<ul>
<li><a href="http://www.nasanda.com/2016/03/ixsystems-freenas-mini-nas-device-reviewed/" rel="nofollow">FreeNAS Mini Review</a> </li>
</ul>

<h2>Interview - Mark Felder - <a href="mailto:feld@freebsd.org" rel="nofollow">feld@freebsd.org</a> / <a href="https://twitter.com/feldpos" rel="nofollow">@feldpos</a></h2>

<ul>
<li>Ports, Ports and more Ports</li>
</ul>

<h2>DigitalOcean</h2>

<ul>
<li><a href="https://www.digitalocean.com/community/tutorials/how-to-configure-and-connect-to-a-private-openvpn-server-on-freebsd-10-1" rel="nofollow">Digital Ocean&#39;s guide to setting up an OpenVPN server</a> </li>
</ul>

<h2>News Roundup</h2>

<p><a href="http://undeadly.org/cgi?action=article&sid=20160316153158&mode=flat&count=0" rel="nofollow">AsiaBSDCon OpenBSD Papers</a> </p>

<ul>
<li>Undeadly.org has compiled a handy list of the various OpenBSD talks / papers that were offered a few weeks ago at AsiaBSDCon 2016.</li>
</ul>

<p>Antoine Jacoutot (ajacoutot@) - OpenBSD rc.d(8) (slides | paper)<br>
Henning Brauer (henning@) - Running an ISP on OpenBSD (slides)<br>
Mike Belopuhov (mikeb@) - Implementation of Xen PVHVM drivers in OpenBSD (slides | paper)<br>
Mike Belopuhov (mikeb@) - OpenBSD project status update (slides)<br>
Mike Larkin (mlarkin@) - OpenBSD vmm Update (slides)<br>
Reyk Floeter (reyk@) - OpenBSD vmd Update (slides) </p>

<ul>
<li>Each talk provides slides, and some the papers as well. Also included is the update to ‘vmm’ discussed at bhyveCon, which will be of interest to virtualization enthusiasts.
***</li>
</ul>

<h3><a href="http://bitcoinist.net/bitcoin-devs-could-learn-a-lot-from-bsd/" rel="nofollow">Bitcoin Devs could learn a lot from BSD</a></h3>

<ul>
<li>An interesting article this week, comparing two projects that at first glance may not be entirely related, namely BitCoin and BSD.</li>
<li>The article first details some of the woes currently plaguing the BitCoin development community, such as toxic community feedback to changes and stakeholders with vested financial interests being unable to work towards a common development purpose.</li>
<li>This leads into the crux or the article, about what BitCoin devs could learn from BSD:</li>
</ul>

<blockquote>
<p>First and foremost, the way code is developed needs change to stop the current negative trend in Bitcoin. The FreeBSD project has a rigid internal hierarchy of people with write access to their codebase, which the various Bitcoin implementations also have, but BSD does this in a way that is very open to fresh eyes on their code, allowing parallel problem solving without the petty infighting we see in Bitcoin. Anyone can propose a commit publicly to the code, make it publicly available, and democratically decide which change ends up in the codebase. FreeBSD has a tiny number of core developers compared to the size of their codebase, but at any point, they have a huge community advancing their project without hard forks popping up at every small disagreement. Brian Armstrong commented recently on this flaw with Bitcoin development, particularly with the Core Devs:</p>

<p>“Being high IQ is not enough for a team to succeed. You need to make reasonable tradeoffs, collaborate, be welcoming, communicate, and be easy to work with. Any team that doesn’t have this will be unable to attract top talent and will struggle long term. In my opinion, perhaps the biggest risk in Bitcoin right now is, ironically, one of the things which has helped it the most in the past: the Bitcoin Core developers.”</p>
</blockquote>

<ul>
<li>A good summary of the culture that could be adopted is summed up as follows:</li>
</ul>

<blockquote>
<p>The other thing Bitcoin devs could learn from is the BSD community’s adoption of the Unix Design philosophy. Primarily “Worse is Better,” The rule of Diversity, and Do One Thing and Do It Well. “Worse is Better” emphasizes using extant functional solutions rather than making more complex ones, even if they would be more robust. The Rule of Diversity stresses flexibility of the program being developed, allowing for modification and different implementations without breaking. Do one Thing and Do it well is a mantra of the BSD and Unix Communities that stresses modularity and progress over “perfect” solutions. Each of these elements help to make BSD a wildly successful open source project with a healthy development community and lots of inter-cooperation between the different BSD systems. While this is the opposite of what we see with Bitcoin at present, the situation is salvageable provided changes like this are made, especially by Core Developers.</p>
</blockquote>

<ul>
<li>All in all, a well written and interesting take on the FreeBSD/BSD project. We hope the BitCoin devs can take something useful from it down the road.
***</li>
</ul>

<h3><a href="http://ben.eficium.net/2016/03/freebsd-cross-compiling-with-gcc.html" rel="nofollow">FreeBSD cross-compiling with gcc and poudriere</a></h3>

<ul>
<li>Cross-Compiling, always a challenge, has gotten easier using poudriere and qemu in recent years.</li>
<li>However this blog post details some of the particular issues still being face when trying to compile some certain ports for ARM (I.E. rPi) that don’t play nicely with FreeBSD’s default CLANG compiler.</li>
<li>The writer (Ben Slack) takes us through some of the work-arounds he uses to build some troublesome ports, namely lsof and libatomic_ops. </li>
<li>Note this is not just an issue with cross compile, the above mentioned ports also don’t build with clang on the Pi directly. </li>
<li>After doing the initial poudriere/qemu cross-compile setup, he then shows us the minor tweaks to adjust which compiler builds specific ports, and how he triggers the builds using poudriere.</li>
<li>With the actual Makefile adjustment being so minor, one wonders if this shouldn’t just be committed upstream, with some if (ARM) - USE_GCC=yes type conditional. 
***</li>
</ul>

<h3><a href="https://devtalk.nvidia.com/default/topic/925607/unix-graphics-announcements-and-news/linux-solaris-and-freebsd-driver-364-12-beta-/" rel="nofollow">Nvidia releases new Beta graphics driver for FreeBSD</a></h3>

<ul>
<li>Added support for the following GPUs: GeForce 920MX &amp; GeForce 930MX</li>
<li>Added support for the Vulkan API version 1.0.</li>
<li>Fixed a bug that could cause incorrect frame rate reporting on Quadro Sync configurations with multiple GPUs.</li>
<li>Added a new RandR property, CscMatrix, which specifies a 3x4 color-space conversion matrix.</li>
<li>Improved handling of the X gamma ramp on GF119 and newer GPUs. On these GPUs, the RandR gamma ramp is always 1024 entries and now applies to the cursor and VDPAU or workstation overlays in addition to the X root window.</li>
<li>Fixes for bugs and added several other EGL extensions
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://knoxbug.org/" rel="nofollow">New TN Bug started</a> </p></li>
<li><p><a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4a43469a10cef8c17553c342aab9d73611ea7bc8?utm_source=anzwix" rel="nofollow">DragonFlyBSD Network/TCP Performance&#39;s gets a bump</a></p></li>
<li><p><a href="https://www.freebsdfoundation.org/blog/introducing-a-new-look-for-the-foundation/" rel="nofollow">FreeBSD Foundation introduces a new website and logo</a></p></li>
<li><p>Our producer made these based on the new logo:</p>

<ul>
<li><a href="http://q5sys.sh/2016/03/a-new-freebsd-foundation-logo-means-its-time-for-some-new-wallpapers/" rel="nofollow">http://q5sys.sh/2016/03/a-new-freebsd-foundation-logo-means-its-time-for-some-new-wallpapers/</a></li>
<li><a href="http://q5sys.sh/2016/03/pc-bsd-and-lumina-desktop-wallpapers/" rel="nofollow">http://q5sys.sh/2016/03/pc-bsd-and-lumina-desktop-wallpapers/</a></li>
<li><a href="https://github.com/pcbsd/lumina/commit/60314f46247b7ad6e877af503b3814b0be170da8" rel="nofollow">https://github.com/pcbsd/lumina/commit/60314f46247b7ad6e877af503b3814b0be170da8</a> </li>
</ul></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20160316190937&mode=flat" rel="nofollow">IPv6 errata for 5.7/5.8, pledge errata for 5.9</a></p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2577" rel="nofollow">Sponsoring “PAM Mastery”</a></p></li>
<li><p><a href="https://rocketgraph.com/s/v89jBkKN4e-" rel="nofollow">A visualization of FreeBSD commits on GitHub for 2015</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20160309192510" rel="nofollow">The VAX platform is no more</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20KPYDOsq" rel="nofollow"> Hunter - Utils for Blind</a> </li>
<li><a href="http://slexy.org/view/s2EHdI3z3L" rel="nofollow"> Chris - ZFS Quotas</a> </li>
<li><a href="http://slexy.org/view/s21Nx1VSiU" rel="nofollow"> Anonymous - Tun, Tap and Me!</a> </li>
<li><a href="http://slexy.org/view/s2ZKK2DZTL" rel="nofollow"> Andrew - Navigating the BSDs</a> </li>
<li><a href="http://slexy.org/view/s20duO29mN" rel="nofollow"> Brent - Wifi on BSD</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, Allan and I have gotten a bit more sleep since AsiaBSDCon, which is excellent since there is a LOT of news to cover. That plus our interview with Ports SecTeam member Mark Felder. So keep it</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://lists.freenas.org/pipermail/freenas-announce/2016-March/000028.html" rel="nofollow">FreeNAS 9.10 Released</a></h3>

<ul>
<li>OS:

<ul>
<li>The base OS version for FreeNAS 9.10 is now FreeBSD 10.3-RC3, bringing in a huge number of OS-related bug fixes, performance improvements and new features.
+Directory Services:</li>
<li>You can now connect to large AD domains with cache disabled.
+Reporting:</li>
<li>Add the ability to send collectd data to a remote graphite server.
+Hardware Support:</li>
<li>Added Support for Intel I219-V &amp; I219-LM Gigabit Ethernet Chipset</li>
<li>Added Support for Intel Skylake architecture</li>
<li>Improved support for USB devices (like network adapters)</li>
<li>USB 3.0 devices now supported.
+Filesharing:</li>
<li>Samba (SMB filesharing) updated from version 4.1 to 4.3.4</li>
<li>Added GUI feature to allow nfsv3-like ownership when using nfsv4</li>
<li>Various bug fixes related to FreeBSD 10.
+Ports:</li>
<li>FreeBSD ports updated to follow the FreeBSD 2016Q1 branch.
+Jails:</li>
<li>FreeBSD Jails now default to a FreeBSD 10.3-RC2 based template.</li>
<li>Old jails, or systems on which jails have been installed, will still default to the previous FreeBSD 9.3 based template. Only those machinesusing jails for the first time (or deleting and recreating their jails dataset) will use the new template.
+bhyve:
++In the upcoming 10 release, the CLI will offer full support for managing virtual machines and containers. Until then, the iohyve command is bundled as a stop-gap solution to provide basic VM management support -
***</li>
</ul></li>
</ul>

<h3><a href="https://sourceforge.net/projects/ubuntubsd/" rel="nofollow">Ubuntu BSD&#39;s first Beta Release</a></h3>

<ul>
<li>Under the category of “Where did this come from?”, we have a first beta release of Ubuntu BSD.</li>
<li>Specifically it is Ubuntu, respun to use the FreeBSD kernel and ZFS natively.</li>
<li>From looking at the minimal information up on sourceforge, we gather that is has a nice text-based installer, which supports ZFS configuration and iSCSI volume creation setups.</li>
<li>Aside from that, it includes the XFCE desktop out of box, but claims to be suitable for both desktops and servers alike right now.</li>
<li>We will keep an eye on this, if anybody listening has already tested it out, maybe drop us a line on your thoughts of how this mash-up works out.
***</li>
</ul>

<h3><a href="http://vez.mrsk.me/freebsd-defaults.txt" rel="nofollow">FreeBSD - a lesson in poor defaults</a></h3>

<ul>
<li>Former BSD producer, and now OpenBSD developer, TJ, writes a post detailing the defaults he changes in a fresh FreeBSD installation</li>
<li>Maybe some of these should be the defaults</li>
<li>While others are definitely a personal preference, or are not as security related as they seem</li>
<li>A few of these, while valid criticisms, but some are done for a reason</li>
<li>Specifically, the OpenSSH changes.</li>
<li>So, you’re a user, you install FreeBSD 10.0, and it comes with OpenSSH version X, which has some specific defaults</li>
<li>As guaranteed by the FreeBSD Project, you will have a nice smooth upgrade path to any version in the 10.x branch</li>
<li>Just because OpenSSH has released version Y, doesn’t mean that the upgrade can suddenly remove support for DSA keys, or re-adding support for AES-CBC (which is not really weak, and which can be hardware accelerated, unlikely most of the replacements)</li>
<li>“FreeBSD is the team trying to increase the risk.” Is incorrect, they are trying to reduce the impact on the end user</li>
<li>Specifically, a user upgrading from 10.x to 10.3, should not end up locked out of their SSH server, or otherwise confronted by unexpected errors or slowdowns because of upstream changes</li>
<li>I will note again, (and again), that the NONE cipher can NOT allow a user to “shoot themselves in the foot”, encryption is still used during the login phase, it is just disabled for the file transfer phase. The NONE cipher will refuse to work for an interactive session.</li>
<li>While the post states that the NONE cipher doesn’t improve performance that much, it infact does</li>
<li>In my own testing, chacha20-poly1305 1.3 gbps, aes128-gcm (fastest) 5.0 gbps, NONE cipher 6.3 gbps</li>
<li>That means that the NONE cipher is an hour faster to transfer 10 TB over the LAN.</li>
<li>The article suggests just removing sendmail with no replacement. Not sure how they expect users to deliver mail, or the daily/weekly reports</li>
<li>Ports can be compiled as a regular user. Only the install phase requires root</li>
<li>for ntpd, it is not clear that there is an acceptable replacement yet, but I will not that it is off by default</li>
<li>In the sysctl section, I am not sure I see how enabling tcp blackhole actually increases security at all</li>
<li>I am not sure that linking to every security advisory in openssl since 2001 is actually useful</li>
<li>Encrypted swap is an option in bsdinstall now, but I am not sure it is really that important</li>
<li>FreeBSD now uses the Fortuna PRNG, upgraded to replace the older Yarrow, not vanilla RC4.</li>
<li>“The resistance from the security team to phase out legacy options makes mewonder if they should be called a compatibility team instead.”</li>
<li>I do not think this is the choice of the security team, it is the ABI guarantee that the project makes. The stable/10 branch will always have the same ABI, and a program or driver compiled against it will work with any version on that branch</li>
<li>The security team doesn’t really have a choice in the matter. Switching the version of OpenSSL used in FreeBSD 9.x would likely break a large number of applications the user has installed</li>
<li>Something may need to be done differently, since it doesn’t look like any version of OpenSSL, (or OpenSSH), will be supported for 5 years ever again
***</li>
</ul>

<h3><a href="https://calomel.org/zfs_raid_speed_capacity.html" rel="nofollow">ZFS Raidz Performance, Capacity and Integrity</a></h3>

<ul>
<li>An updated version of an article comparing the performance of various ZFS vdev configurations</li>
<li>The settings users in the test may not reflect your workload</li>
<li>If you are benchmarking ZFS, consider using multiple files across different datasets, and not making all of the writes synchronous</li>
<li>Also, it is advisable to run more than 3 runs of each test</li>
<li>Comparing the numbers from the 12 and 24 disk tests, it is surprising to see that the 12 mirror sets did not outperform the other configurations. In the 12 drive tests, the 6 mirror sets had about the same read performance as the other configurations, it is not clear why the performance with more disks is worse, or why it is no longer in line with the other configurations</li>
<li>More investigation of this would be required</li>
<li>There are obviously so other bottlenecks, as 5x SSDs in RAID-Z1 performed the same as 17x SSDs in RAID-Z1</li>
<li>Interesting results none the less
***</li>
</ul>

<h2>iXSystems</h2>

<ul>
<li><a href="http://www.nasanda.com/2016/03/ixsystems-freenas-mini-nas-device-reviewed/" rel="nofollow">FreeNAS Mini Review</a> </li>
</ul>

<h2>Interview - Mark Felder - <a href="mailto:feld@freebsd.org" rel="nofollow">feld@freebsd.org</a> / <a href="https://twitter.com/feldpos" rel="nofollow">@feldpos</a></h2>

<ul>
<li>Ports, Ports and more Ports</li>
</ul>

<h2>DigitalOcean</h2>

<ul>
<li><a href="https://www.digitalocean.com/community/tutorials/how-to-configure-and-connect-to-a-private-openvpn-server-on-freebsd-10-1" rel="nofollow">Digital Ocean&#39;s guide to setting up an OpenVPN server</a> </li>
</ul>

<h2>News Roundup</h2>

<p><a href="http://undeadly.org/cgi?action=article&sid=20160316153158&mode=flat&count=0" rel="nofollow">AsiaBSDCon OpenBSD Papers</a> </p>

<ul>
<li>Undeadly.org has compiled a handy list of the various OpenBSD talks / papers that were offered a few weeks ago at AsiaBSDCon 2016.</li>
</ul>

<p>Antoine Jacoutot (ajacoutot@) - OpenBSD rc.d(8) (slides | paper)<br>
Henning Brauer (henning@) - Running an ISP on OpenBSD (slides)<br>
Mike Belopuhov (mikeb@) - Implementation of Xen PVHVM drivers in OpenBSD (slides | paper)<br>
Mike Belopuhov (mikeb@) - OpenBSD project status update (slides)<br>
Mike Larkin (mlarkin@) - OpenBSD vmm Update (slides)<br>
Reyk Floeter (reyk@) - OpenBSD vmd Update (slides) </p>

<ul>
<li>Each talk provides slides, and some the papers as well. Also included is the update to ‘vmm’ discussed at bhyveCon, which will be of interest to virtualization enthusiasts.
***</li>
</ul>

<h3><a href="http://bitcoinist.net/bitcoin-devs-could-learn-a-lot-from-bsd/" rel="nofollow">Bitcoin Devs could learn a lot from BSD</a></h3>

<ul>
<li>An interesting article this week, comparing two projects that at first glance may not be entirely related, namely BitCoin and BSD.</li>
<li>The article first details some of the woes currently plaguing the BitCoin development community, such as toxic community feedback to changes and stakeholders with vested financial interests being unable to work towards a common development purpose.</li>
<li>This leads into the crux or the article, about what BitCoin devs could learn from BSD:</li>
</ul>

<blockquote>
<p>First and foremost, the way code is developed needs change to stop the current negative trend in Bitcoin. The FreeBSD project has a rigid internal hierarchy of people with write access to their codebase, which the various Bitcoin implementations also have, but BSD does this in a way that is very open to fresh eyes on their code, allowing parallel problem solving without the petty infighting we see in Bitcoin. Anyone can propose a commit publicly to the code, make it publicly available, and democratically decide which change ends up in the codebase. FreeBSD has a tiny number of core developers compared to the size of their codebase, but at any point, they have a huge community advancing their project without hard forks popping up at every small disagreement. Brian Armstrong commented recently on this flaw with Bitcoin development, particularly with the Core Devs:</p>

<p>“Being high IQ is not enough for a team to succeed. You need to make reasonable tradeoffs, collaborate, be welcoming, communicate, and be easy to work with. Any team that doesn’t have this will be unable to attract top talent and will struggle long term. In my opinion, perhaps the biggest risk in Bitcoin right now is, ironically, one of the things which has helped it the most in the past: the Bitcoin Core developers.”</p>
</blockquote>

<ul>
<li>A good summary of the culture that could be adopted is summed up as follows:</li>
</ul>

<blockquote>
<p>The other thing Bitcoin devs could learn from is the BSD community’s adoption of the Unix Design philosophy. Primarily “Worse is Better,” The rule of Diversity, and Do One Thing and Do It Well. “Worse is Better” emphasizes using extant functional solutions rather than making more complex ones, even if they would be more robust. The Rule of Diversity stresses flexibility of the program being developed, allowing for modification and different implementations without breaking. Do one Thing and Do it well is a mantra of the BSD and Unix Communities that stresses modularity and progress over “perfect” solutions. Each of these elements help to make BSD a wildly successful open source project with a healthy development community and lots of inter-cooperation between the different BSD systems. While this is the opposite of what we see with Bitcoin at present, the situation is salvageable provided changes like this are made, especially by Core Developers.</p>
</blockquote>

<ul>
<li>All in all, a well written and interesting take on the FreeBSD/BSD project. We hope the BitCoin devs can take something useful from it down the road.
***</li>
</ul>

<h3><a href="http://ben.eficium.net/2016/03/freebsd-cross-compiling-with-gcc.html" rel="nofollow">FreeBSD cross-compiling with gcc and poudriere</a></h3>

<ul>
<li>Cross-Compiling, always a challenge, has gotten easier using poudriere and qemu in recent years.</li>
<li>However this blog post details some of the particular issues still being face when trying to compile some certain ports for ARM (I.E. rPi) that don’t play nicely with FreeBSD’s default CLANG compiler.</li>
<li>The writer (Ben Slack) takes us through some of the work-arounds he uses to build some troublesome ports, namely lsof and libatomic_ops. </li>
<li>Note this is not just an issue with cross compile, the above mentioned ports also don’t build with clang on the Pi directly. </li>
<li>After doing the initial poudriere/qemu cross-compile setup, he then shows us the minor tweaks to adjust which compiler builds specific ports, and how he triggers the builds using poudriere.</li>
<li>With the actual Makefile adjustment being so minor, one wonders if this shouldn’t just be committed upstream, with some if (ARM) - USE_GCC=yes type conditional. 
***</li>
</ul>

<h3><a href="https://devtalk.nvidia.com/default/topic/925607/unix-graphics-announcements-and-news/linux-solaris-and-freebsd-driver-364-12-beta-/" rel="nofollow">Nvidia releases new Beta graphics driver for FreeBSD</a></h3>

<ul>
<li>Added support for the following GPUs: GeForce 920MX &amp; GeForce 930MX</li>
<li>Added support for the Vulkan API version 1.0.</li>
<li>Fixed a bug that could cause incorrect frame rate reporting on Quadro Sync configurations with multiple GPUs.</li>
<li>Added a new RandR property, CscMatrix, which specifies a 3x4 color-space conversion matrix.</li>
<li>Improved handling of the X gamma ramp on GF119 and newer GPUs. On these GPUs, the RandR gamma ramp is always 1024 entries and now applies to the cursor and VDPAU or workstation overlays in addition to the X root window.</li>
<li>Fixes for bugs and added several other EGL extensions
***</li>
</ul>

<h2>Beastie Bits</h2>

<ul>
<li><p><a href="http://knoxbug.org/" rel="nofollow">New TN Bug started</a> </p></li>
<li><p><a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4a43469a10cef8c17553c342aab9d73611ea7bc8?utm_source=anzwix" rel="nofollow">DragonFlyBSD Network/TCP Performance&#39;s gets a bump</a></p></li>
<li><p><a href="https://www.freebsdfoundation.org/blog/introducing-a-new-look-for-the-foundation/" rel="nofollow">FreeBSD Foundation introduces a new website and logo</a></p></li>
<li><p>Our producer made these based on the new logo:</p>

<ul>
<li><a href="http://q5sys.sh/2016/03/a-new-freebsd-foundation-logo-means-its-time-for-some-new-wallpapers/" rel="nofollow">http://q5sys.sh/2016/03/a-new-freebsd-foundation-logo-means-its-time-for-some-new-wallpapers/</a></li>
<li><a href="http://q5sys.sh/2016/03/pc-bsd-and-lumina-desktop-wallpapers/" rel="nofollow">http://q5sys.sh/2016/03/pc-bsd-and-lumina-desktop-wallpapers/</a></li>
<li><a href="https://github.com/pcbsd/lumina/commit/60314f46247b7ad6e877af503b3814b0be170da8" rel="nofollow">https://github.com/pcbsd/lumina/commit/60314f46247b7ad6e877af503b3814b0be170da8</a> </li>
</ul></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20160316190937&mode=flat" rel="nofollow">IPv6 errata for 5.7/5.8, pledge errata for 5.9</a></p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2577" rel="nofollow">Sponsoring “PAM Mastery”</a></p></li>
<li><p><a href="https://rocketgraph.com/s/v89jBkKN4e-" rel="nofollow">A visualization of FreeBSD commits on GitHub for 2015</a></p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20160309192510" rel="nofollow">The VAX platform is no more</a></p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20KPYDOsq" rel="nofollow"> Hunter - Utils for Blind</a> </li>
<li><a href="http://slexy.org/view/s2EHdI3z3L" rel="nofollow"> Chris - ZFS Quotas</a> </li>
<li><a href="http://slexy.org/view/s21Nx1VSiU" rel="nofollow"> Anonymous - Tun, Tap and Me!</a> </li>
<li><a href="http://slexy.org/view/s2ZKK2DZTL" rel="nofollow"> Andrew - Navigating the BSDs</a> </li>
<li><a href="http://slexy.org/view/s20duO29mN" rel="nofollow"> Brent - Wifi on BSD</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>133: The Tokyo Debrief</title>
  <link>https://www.bsdnow.tv/133</link>
  <guid isPermaLink="false">4673def9-dead-4353-b97b-9b557eef899a</guid>
  <pubDate>Wed, 16 Mar 2016 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4673def9-dead-4353-b97b-9b557eef899a.mp3" length="55224148" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, Allan and I are back from AsiaBSDCon and we have an interview with Brad Davis about the new “Packaging Base” call-for-testing. We’ll be sharing our thoughts and stories on how the week</itunes:subtitle>
  <itunes:duration>1:16:42</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, Allan and I are back from AsiaBSDCon and we have an interview with Brad Davis about the new “Packaging Base” call-for-testing. We’ll be sharing our thoughts and stories on how the week
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
AsiaBSDCon 2016 - Wrap-up
FreeBSD gets Haswell graphics support in time for 11.0-RELEASE (https://svnweb.freebsd.org/changeset/base/296548)
The moment that many have been waiting for has finally arrived, support for Haswell graphics has been committed to FreeBSD -CURRENT
The brings the DRM/i915 code up to date with Linux kernel 3.8.13
Work has already started on updating to Linux kernel 3.9
It is hoped that subsequent updates will be much easier, and much faster
It does not appear to require setting the i915.preliminaryhwsupport loader tunable
***
OpenBSD vmm/vmd Update (http://bhyvecon.org/bhyvecon2016-Mike.pdf)
For the third year running, bhyvecon was held last week, during the lead up to AsiaBSDCon
Bhyvecon has expanded, and now covers all virtualization on BSDs
There were presentations on bhyve, Xen Dom0 on FreeBSD, Xen DomU for OpenBSD, and OpenBSD’s vmm
OpenBSD vmm started at the Brisbane 2015 hackathon in Australia
Work continued through the summer and fall thanks to funding by the OpenBSD Foundation
The presentation answered some outstanding questions, such as, why not just port bhyve?
Initial focus is OpenBSD on OpenBSD
Loader currently supports FreeBSD and NetBSD as well
After the initial commits, other developers joined in to help with the work
Reyk reworked the vmd and vmctl commands, to provide a better user interface
Future plans:
Nested VMX
i386 support
AMD SVM support
Filesystem passthru
Live migration (with ZFS like command syntax)
Other developers are working on related projects:
qemu interface: Allow qemu to be accelerated by the vmm backend, while providing emulated hardware, for legacy systems
KVM interface: Make vmm look like KVM, so existing tools like openstack “just work”
***
Interview - Brad Davis - brd@freebsd.org (mailto:brd@freebsd.org) / @so14k (https://twitter.com/so14k)
Packaging Base
News Roundup
Packaging the base system with pkg(8) (https://lists.freebsd.org/pipermail/freebsd-pkgbase/2016-March/000032.html)
The official call for testing for FreeBSD’s pkg(8)’d base is out
Users are requested to checkout the release-pkg branch, and build it as normal (buildworld, buildkernel)
Instead of installworld, run: make packages
This will produce a pkg repo in the /usr/obj directory
The post to the mailing list includes an example pkg repo config file to point to those packages
Run: pkg update -r FreeBSD-base
This will read the metadata from the new repository
Then run: pkg install -g 'FreeBSD-*'
This will find all packages that start with ‘FreeBSD-’ and install them
In the future, there will be meta packages, so you can just install FreeBSD-base and it will pull in other packages are dependencies
Currently, there are a large number of packages (over 700), because each shared library is packaged separately, and almost all optional features are in a separate package
The number of packages is also increased because there are separate -debug, -profiling, etc versions of each package
New features are being added to pkg(8) to mark important system components, like libc, as ‘vital’, so they cannot be deleted accidently
However, in the case of using pkg(8)’d base to create a jail, the administrator should be able to delete the entire base system
Classic conundrum: “UNIX does not stop you doing something stupid, as that would also stop you doing something clever”
Work is still ongoing
At AsiaBSDCon, after the interview was recorded, bapt@ and brd@ had a whiteboarding session and have come up with how they expect to handle the kernel package, to ensure there is a /boot/kernel.old for you to fall back to incase the newly installer kernel does not work correctly.
***
FreeBSD 10.3-RC2 Now Available (https://lists.freebsd.org/pipermail/freebsd-stable/2016-March/084384.html)
The second release candidate for FreeBSD 10.3 is now available for testing
Notable changes include:
Import an upstream fix for ‘zfs send -i’ to avoid data corruption in specific instances
Boot loaders and kernel have been taught to handle ELF sections of type SHTAMD64UNWIND. This does not really apply to FreeBSD 10.3, but is required for 11.0, so will make upgrades easier
Various mkdb commands (/etc/services, /etc/login.conf, etc) commands now use fsync() instead of opening the files as O_SYNC, greatly increasing the speed of the database generation
From the earlier BETA3, the VFS improvements that were causing ZFS hangs, and the new ‘tryforward’ routing code, have been reverted
Work is ongoing to fix these issues for FreeBSD 11.0
There are two open issues:
A fix for OpenSSH CVE-2016-3115 has not be included yet
the re-addition of AES-CBC ciphers to the default server proposal list. AES-CBC was removed as part of the update to OpenSSH version 7.1p2, but the plan is to re-add it, specifically for lightweight clients who rely on hardware crypto offload to have acceptable SSH performance
Please go out and test
***
OPNsense 16.1.6 released (https://forum.opnsense.org/index.php?topic=2378.0)
A new point-release of OPNsense has dropped, and apart from the usual security updates, some new features have been included
firmware: bootstrap utility can now directly install e.g. the development version
dhcp: all GUI pages have been reworked for a polished look and feel
proxy: added category-based remote file support if compressed file contains multiple files
proxy: added ICAP support (contributed by Fabian Franz)
proxy: hook up the transparent FTP proxy
proxy: add intercept on IPv6 for FTP and HTTP proxy options
logging: syslog facilities, like services, are now fully pluggable
vpn: stripped an invalid PPTP server configuration from the standard configuration
vpn: converted to pluggable syslog, menu and ACL
dyndns: all GUI pages have been reworked for a polished look and feel
dyndns: widget now shows IPv6 entries too
dns forwarder: all GUI pages have been reworked for a polished look and feel
dns resolver: all GUI pages have been reworked for a polished look and feel
dns resolver: rewrote the dhcp lease registration hooks
dns resolver: allow parallel operation on non-standard port when dns forwarder is running as well
firewall: hide outbound nat rule input for "interface address" option and toggle bitmask correctly
interfaces: fix problem when VLAN tags weren't generated properly
interfaces: improve interface capability reconfigure
ipsec: fix service restart behaviour from GUI
captive portal: add missing chain in certificate generation
configd: improve recovery and reload behaviour
load balancer: reordered menu entries for clarity
ntp: reordered menu entries for clarity
traffic shaper: fix mismatch for direction + dual interfaces setup
languages: updated German and French
Call for testing - ASLR patch (https://lists.freebsd.org/pipermail/freebsd-arch/2016-March/017719.html)
A patch that provides a first pass implementation of basic ASLR (Address Space Layout Randomization) for FreeBSD has been posted to the mailing list
“Stack gap, W^X, shared page randomization, KASLR and other techniques are explicitly out of scope of this work.”
“ASLR is enabled on per-ABI basis, and currently it is only enabled on native i386 and amd64 (including compat 32bit) ABIs.  I expect to test and enable ASLR for armv6 and arm64 as well, later”
“Thanks to Oliver Pinter and Shawn Webb of the HardenedBSD project for pursuing ASLR for FreeBSD.  Although this work is not based on theirs, it was inspired by their efforts.”
***
Feedback/Questions
 Daniel - OpenZFS (http://slexy.org/view/s20Z81SPq3) 
 Florian - JBODS (http://slexy.org/view/s2be4zDkG6) 
 Hunter - SSL on DO (http://slexy.org/view/s2o0MijCFy) 
 Ben - Backups (http://slexy.org/view/s2fXlOwdU7) 
 Damian - Bug’in Me! (http://slexy.org/view/s2weBPb8sx) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, Allan and I are back from AsiaBSDCon and we have an interview with Brad Davis about the new “Packaging Base” call-for-testing. We’ll be sharing our thoughts and stories on how the week</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>AsiaBSDCon 2016 - Wrap-up</h3>

<h3><a href="https://svnweb.freebsd.org/changeset/base/296548" rel="nofollow">FreeBSD gets Haswell graphics support in time for 11.0-RELEASE</a></h3>

<ul>
<li>The moment that many have been waiting for has finally arrived, support for Haswell graphics has been committed to FreeBSD -CURRENT</li>
<li>The brings the DRM/i915 code up to date with Linux kernel 3.8.13</li>
<li>Work has already started on updating to Linux kernel 3.9</li>
<li>It is hoped that subsequent updates will be much easier, and much faster</li>
<li>It does not appear to require setting the i915.preliminary_hw_support loader tunable
***</li>
</ul>

<h3><a href="http://bhyvecon.org/bhyvecon2016-Mike.pdf" rel="nofollow">OpenBSD vmm/vmd Update</a></h3>

<ul>
<li>For the third year running, bhyvecon was held last week, during the lead up to AsiaBSDCon</li>
<li>Bhyvecon has expanded, and now covers all virtualization on BSDs</li>
<li>There were presentations on bhyve, Xen Dom0 on FreeBSD, Xen DomU for OpenBSD, and OpenBSD’s vmm</li>
<li>OpenBSD vmm started at the Brisbane 2015 hackathon in Australia</li>
<li>Work continued through the summer and fall thanks to funding by the OpenBSD Foundation</li>
<li>The presentation answered some outstanding questions, such as, why not just port bhyve?</li>
<li>Initial focus is OpenBSD on OpenBSD</li>
<li>Loader currently supports FreeBSD and NetBSD as well</li>
<li>After the initial commits, other developers joined in to help with the work</li>
<li>Reyk reworked the vmd and vmctl commands, to provide a better user interface</li>
<li>Future plans:

<ul>
<li>Nested VMX</li>
<li>i386 support</li>
<li>AMD SVM support</li>
<li>Filesystem passthru</li>
<li>Live migration (with ZFS like command syntax)</li>
</ul></li>
<li>Other developers are working on related projects:

<ul>
<li>qemu interface: Allow qemu to be accelerated by the vmm backend, while providing emulated hardware, for legacy systems</li>
<li>KVM interface: Make vmm look like KVM, so existing tools like openstack “just work”
***</li>
</ul></li>
</ul>

<h2>Interview - Brad Davis - <a href="mailto:brd@freebsd.org" rel="nofollow">brd@freebsd.org</a> / <a href="https://twitter.com/so14k" rel="nofollow">@so14k</a></h2>

<ul>
<li>Packaging Base</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-pkgbase/2016-March/000032.html" rel="nofollow">Packaging the base system with pkg(8)</a></h3>

<ul>
<li>The official call for testing for FreeBSD’s pkg(8)’d base is out</li>
<li>Users are requested to checkout the release-pkg branch, and build it as normal (buildworld, buildkernel)</li>
<li>Instead of installworld, run: make packages</li>
<li>This will produce a pkg repo in the /usr/obj directory</li>
<li>The post to the mailing list includes an example pkg repo config file to point to those packages</li>
<li>Run: pkg update -r FreeBSD-base</li>
<li>This will read the metadata from the new repository</li>
<li>Then run: pkg install -g &#39;FreeBSD-*&#39;</li>
<li>This will find all packages that start with ‘FreeBSD-’ and install them</li>
<li>In the future, there will be meta packages, so you can just install FreeBSD-base and it will pull in other packages are dependencies</li>
<li>Currently, there are a large number of packages (over 700), because each shared library is packaged separately, and almost all optional features are in a separate package</li>
<li>The number of packages is also increased because there are separate -debug, -profiling, etc versions of each package</li>
<li>New features are being added to pkg(8) to mark important system components, like libc, as ‘vital’, so they cannot be deleted accidently</li>
<li>However, in the case of using pkg(8)’d base to create a jail, the administrator should be able to delete the entire base system</li>
<li>Classic conundrum: “UNIX does not stop you doing something stupid, as that would also stop you doing something clever”</li>
<li>Work is still ongoing</li>
<li>At AsiaBSDCon, after the interview was recorded, bapt@ and brd@ had a whiteboarding session and have come up with how they expect to handle the kernel package, to ensure there is a /boot/kernel.old for you to fall back to incase the newly installer kernel does not work correctly.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2016-March/084384.html" rel="nofollow">FreeBSD 10.3-RC2 Now Available</a></h3>

<ul>
<li>The second release candidate for FreeBSD 10.3 is now available for testing</li>
<li>Notable changes include:

<ul>
<li>Import an upstream fix for ‘zfs send -i’ to avoid data corruption in specific instances</li>
<li>Boot loaders and kernel have been taught to handle ELF sections of type SHT_AMD64_UNWIND. This does not really apply to FreeBSD 10.3, but is required for 11.0, so will make upgrades easier</li>
<li>Various mkdb commands (/etc/services, /etc/login.conf, etc) commands now use fsync() instead of opening the files as O_SYNC, greatly increasing the speed of the database generation</li>
</ul></li>
<li>From the earlier BETA3, the VFS improvements that were causing ZFS hangs, and the new ‘tryforward’ routing code, have been reverted</li>
<li>Work is ongoing to fix these issues for FreeBSD 11.0</li>
<li>There are two open issues:

<ul>
<li>A fix for OpenSSH CVE-2016-3115 has not be included yet</li>
<li>the re-addition of AES-CBC ciphers to the default server proposal list. AES-CBC was removed as part of the update to OpenSSH version 7.1p2, but the plan is to re-add it, specifically for lightweight clients who rely on hardware crypto offload to have acceptable SSH performance</li>
</ul></li>
<li>Please go out and test
***</li>
</ul>

<h3><a href="https://forum.opnsense.org/index.php?topic=2378.0" rel="nofollow">OPNsense 16.1.6 released</a></h3>

<ul>
<li>A new point-release of OPNsense has dropped, and apart from the usual security updates, some new features have been included</li>
</ul>

<blockquote>
<ul>
<li>firmware: bootstrap utility can now directly install e.g. the development version</li>
<li>dhcp: all GUI pages have been reworked for a polished look and feel</li>
<li>proxy: added category-based remote file support if compressed file contains multiple files</li>
<li>proxy: added ICAP support (contributed by Fabian Franz)</li>
<li>proxy: hook up the transparent FTP proxy</li>
<li>proxy: add intercept on IPv6 for FTP and HTTP proxy options</li>
<li>logging: syslog facilities, like services, are now fully pluggable</li>
<li>vpn: stripped an invalid PPTP server configuration from the standard configuration</li>
<li>vpn: converted to pluggable syslog, menu and ACL</li>
<li>dyndns: all GUI pages have been reworked for a polished look and feel</li>
<li>dyndns: widget now shows IPv6 entries too</li>
<li>dns forwarder: all GUI pages have been reworked for a polished look and feel</li>
<li>dns resolver: all GUI pages have been reworked for a polished look and feel</li>
<li>dns resolver: rewrote the dhcp lease registration hooks</li>
<li>dns resolver: allow parallel operation on non-standard port when dns forwarder is running as well</li>
<li>firewall: hide outbound nat rule input for &quot;interface address&quot; option and toggle bitmask correctly</li>
<li>interfaces: fix problem when VLAN tags weren&#39;t generated properly</li>
<li>interfaces: improve interface capability reconfigure</li>
<li>ipsec: fix service restart behaviour from GUI</li>
<li>captive portal: add missing chain in certificate generation</li>
<li>configd: improve recovery and reload behaviour</li>
<li>load balancer: reordered menu entries for clarity</li>
<li>ntp: reordered menu entries for clarity</li>
<li>traffic shaper: fix mismatch for direction + dual interfaces setup</li>
<li>languages: updated German and French</li>
</ul>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-arch/2016-March/017719.html" rel="nofollow">Call for testing - ASLR patch</a></h3>

<ul>
<li>A patch that provides a first pass implementation of basic ASLR (Address Space Layout Randomization) for FreeBSD has been posted to the mailing list</li>
<li>“Stack gap, W<sup>X,</sup> shared page randomization, KASLR and other techniques are explicitly out of scope of this work.”</li>
<li>“ASLR is enabled on per-ABI basis, and currently it is only enabled on native i386 and amd64 (including compat 32bit) ABIs.  I expect to test and enable ASLR for armv6 and arm64 as well, later”</li>
<li>“Thanks to Oliver Pinter and Shawn Webb of the HardenedBSD project for pursuing ASLR for FreeBSD.  Although this work is not based on theirs, it was inspired by their efforts.”
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20Z81SPq3" rel="nofollow"> Daniel - OpenZFS</a> </li>
<li><a href="http://slexy.org/view/s2be4zDkG6" rel="nofollow"> Florian - JBODS</a> </li>
<li><a href="http://slexy.org/view/s2o0MijCFy" rel="nofollow"> Hunter - SSL on DO</a> </li>
<li><a href="http://slexy.org/view/s2fXlOwdU7" rel="nofollow"> Ben - Backups</a> </li>
<li><a href="http://slexy.org/view/s2weBPb8sx" rel="nofollow"> Damian - Bug’in Me!</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, Allan and I are back from AsiaBSDCon and we have an interview with Brad Davis about the new “Packaging Base” call-for-testing. We’ll be sharing our thoughts and stories on how the week</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>AsiaBSDCon 2016 - Wrap-up</h3>

<h3><a href="https://svnweb.freebsd.org/changeset/base/296548" rel="nofollow">FreeBSD gets Haswell graphics support in time for 11.0-RELEASE</a></h3>

<ul>
<li>The moment that many have been waiting for has finally arrived, support for Haswell graphics has been committed to FreeBSD -CURRENT</li>
<li>The brings the DRM/i915 code up to date with Linux kernel 3.8.13</li>
<li>Work has already started on updating to Linux kernel 3.9</li>
<li>It is hoped that subsequent updates will be much easier, and much faster</li>
<li>It does not appear to require setting the i915.preliminary_hw_support loader tunable
***</li>
</ul>

<h3><a href="http://bhyvecon.org/bhyvecon2016-Mike.pdf" rel="nofollow">OpenBSD vmm/vmd Update</a></h3>

<ul>
<li>For the third year running, bhyvecon was held last week, during the lead up to AsiaBSDCon</li>
<li>Bhyvecon has expanded, and now covers all virtualization on BSDs</li>
<li>There were presentations on bhyve, Xen Dom0 on FreeBSD, Xen DomU for OpenBSD, and OpenBSD’s vmm</li>
<li>OpenBSD vmm started at the Brisbane 2015 hackathon in Australia</li>
<li>Work continued through the summer and fall thanks to funding by the OpenBSD Foundation</li>
<li>The presentation answered some outstanding questions, such as, why not just port bhyve?</li>
<li>Initial focus is OpenBSD on OpenBSD</li>
<li>Loader currently supports FreeBSD and NetBSD as well</li>
<li>After the initial commits, other developers joined in to help with the work</li>
<li>Reyk reworked the vmd and vmctl commands, to provide a better user interface</li>
<li>Future plans:

<ul>
<li>Nested VMX</li>
<li>i386 support</li>
<li>AMD SVM support</li>
<li>Filesystem passthru</li>
<li>Live migration (with ZFS like command syntax)</li>
</ul></li>
<li>Other developers are working on related projects:

<ul>
<li>qemu interface: Allow qemu to be accelerated by the vmm backend, while providing emulated hardware, for legacy systems</li>
<li>KVM interface: Make vmm look like KVM, so existing tools like openstack “just work”
***</li>
</ul></li>
</ul>

<h2>Interview - Brad Davis - <a href="mailto:brd@freebsd.org" rel="nofollow">brd@freebsd.org</a> / <a href="https://twitter.com/so14k" rel="nofollow">@so14k</a></h2>

<ul>
<li>Packaging Base</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-pkgbase/2016-March/000032.html" rel="nofollow">Packaging the base system with pkg(8)</a></h3>

<ul>
<li>The official call for testing for FreeBSD’s pkg(8)’d base is out</li>
<li>Users are requested to checkout the release-pkg branch, and build it as normal (buildworld, buildkernel)</li>
<li>Instead of installworld, run: make packages</li>
<li>This will produce a pkg repo in the /usr/obj directory</li>
<li>The post to the mailing list includes an example pkg repo config file to point to those packages</li>
<li>Run: pkg update -r FreeBSD-base</li>
<li>This will read the metadata from the new repository</li>
<li>Then run: pkg install -g &#39;FreeBSD-*&#39;</li>
<li>This will find all packages that start with ‘FreeBSD-’ and install them</li>
<li>In the future, there will be meta packages, so you can just install FreeBSD-base and it will pull in other packages are dependencies</li>
<li>Currently, there are a large number of packages (over 700), because each shared library is packaged separately, and almost all optional features are in a separate package</li>
<li>The number of packages is also increased because there are separate -debug, -profiling, etc versions of each package</li>
<li>New features are being added to pkg(8) to mark important system components, like libc, as ‘vital’, so they cannot be deleted accidently</li>
<li>However, in the case of using pkg(8)’d base to create a jail, the administrator should be able to delete the entire base system</li>
<li>Classic conundrum: “UNIX does not stop you doing something stupid, as that would also stop you doing something clever”</li>
<li>Work is still ongoing</li>
<li>At AsiaBSDCon, after the interview was recorded, bapt@ and brd@ had a whiteboarding session and have come up with how they expect to handle the kernel package, to ensure there is a /boot/kernel.old for you to fall back to incase the newly installer kernel does not work correctly.
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2016-March/084384.html" rel="nofollow">FreeBSD 10.3-RC2 Now Available</a></h3>

<ul>
<li>The second release candidate for FreeBSD 10.3 is now available for testing</li>
<li>Notable changes include:

<ul>
<li>Import an upstream fix for ‘zfs send -i’ to avoid data corruption in specific instances</li>
<li>Boot loaders and kernel have been taught to handle ELF sections of type SHT_AMD64_UNWIND. This does not really apply to FreeBSD 10.3, but is required for 11.0, so will make upgrades easier</li>
<li>Various mkdb commands (/etc/services, /etc/login.conf, etc) commands now use fsync() instead of opening the files as O_SYNC, greatly increasing the speed of the database generation</li>
</ul></li>
<li>From the earlier BETA3, the VFS improvements that were causing ZFS hangs, and the new ‘tryforward’ routing code, have been reverted</li>
<li>Work is ongoing to fix these issues for FreeBSD 11.0</li>
<li>There are two open issues:

<ul>
<li>A fix for OpenSSH CVE-2016-3115 has not be included yet</li>
<li>the re-addition of AES-CBC ciphers to the default server proposal list. AES-CBC was removed as part of the update to OpenSSH version 7.1p2, but the plan is to re-add it, specifically for lightweight clients who rely on hardware crypto offload to have acceptable SSH performance</li>
</ul></li>
<li>Please go out and test
***</li>
</ul>

<h3><a href="https://forum.opnsense.org/index.php?topic=2378.0" rel="nofollow">OPNsense 16.1.6 released</a></h3>

<ul>
<li>A new point-release of OPNsense has dropped, and apart from the usual security updates, some new features have been included</li>
</ul>

<blockquote>
<ul>
<li>firmware: bootstrap utility can now directly install e.g. the development version</li>
<li>dhcp: all GUI pages have been reworked for a polished look and feel</li>
<li>proxy: added category-based remote file support if compressed file contains multiple files</li>
<li>proxy: added ICAP support (contributed by Fabian Franz)</li>
<li>proxy: hook up the transparent FTP proxy</li>
<li>proxy: add intercept on IPv6 for FTP and HTTP proxy options</li>
<li>logging: syslog facilities, like services, are now fully pluggable</li>
<li>vpn: stripped an invalid PPTP server configuration from the standard configuration</li>
<li>vpn: converted to pluggable syslog, menu and ACL</li>
<li>dyndns: all GUI pages have been reworked for a polished look and feel</li>
<li>dyndns: widget now shows IPv6 entries too</li>
<li>dns forwarder: all GUI pages have been reworked for a polished look and feel</li>
<li>dns resolver: all GUI pages have been reworked for a polished look and feel</li>
<li>dns resolver: rewrote the dhcp lease registration hooks</li>
<li>dns resolver: allow parallel operation on non-standard port when dns forwarder is running as well</li>
<li>firewall: hide outbound nat rule input for &quot;interface address&quot; option and toggle bitmask correctly</li>
<li>interfaces: fix problem when VLAN tags weren&#39;t generated properly</li>
<li>interfaces: improve interface capability reconfigure</li>
<li>ipsec: fix service restart behaviour from GUI</li>
<li>captive portal: add missing chain in certificate generation</li>
<li>configd: improve recovery and reload behaviour</li>
<li>load balancer: reordered menu entries for clarity</li>
<li>ntp: reordered menu entries for clarity</li>
<li>traffic shaper: fix mismatch for direction + dual interfaces setup</li>
<li>languages: updated German and French</li>
</ul>
</blockquote>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-arch/2016-March/017719.html" rel="nofollow">Call for testing - ASLR patch</a></h3>

<ul>
<li>A patch that provides a first pass implementation of basic ASLR (Address Space Layout Randomization) for FreeBSD has been posted to the mailing list</li>
<li>“Stack gap, W<sup>X,</sup> shared page randomization, KASLR and other techniques are explicitly out of scope of this work.”</li>
<li>“ASLR is enabled on per-ABI basis, and currently it is only enabled on native i386 and amd64 (including compat 32bit) ABIs.  I expect to test and enable ASLR for armv6 and arm64 as well, later”</li>
<li>“Thanks to Oliver Pinter and Shawn Webb of the HardenedBSD project for pursuing ASLR for FreeBSD.  Although this work is not based on theirs, it was inspired by their efforts.”
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20Z81SPq3" rel="nofollow"> Daniel - OpenZFS</a> </li>
<li><a href="http://slexy.org/view/s2be4zDkG6" rel="nofollow"> Florian - JBODS</a> </li>
<li><a href="http://slexy.org/view/s2o0MijCFy" rel="nofollow"> Hunter - SSL on DO</a> </li>
<li><a href="http://slexy.org/view/s2fXlOwdU7" rel="nofollow"> Ben - Backups</a> </li>
<li><a href="http://slexy.org/view/s2weBPb8sx" rel="nofollow"> Damian - Bug’in Me!</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>132: Scaling up with BSD</title>
  <link>https://www.bsdnow.tv/132</link>
  <guid isPermaLink="false">f3d59dae-8eeb-40fd-8450-504566ad449e</guid>
  <pubDate>Tue, 08 Mar 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f3d59dae-8eeb-40fd-8450-504566ad449e.mp3" length="46636852" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week, Allan and I are away at AsiaBSDCon! (If you aren’t there, you are missing out). We will be back with a live episode next week. However, we’ve been asked for Allan to tell us about ScaleEngine’s</itunes:subtitle>
  <itunes:duration>1:04:46</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week, Allan and I are away at AsiaBSDCon! (If you aren’t there, you are missing out). We will be back with a live episode next week. However, we’ve been asked for Allan to tell us about ScaleEngine’s
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Interview - Allan Jude - allanjude@freebsd.org (mailto:allanjude@freebsd.org) / @allanjude (https://twitter.com/allanjude)
Spotlight on ScaleEngine
***
Beastie Bits
NetBSD on an RPi Zero (https://github.com/ebijun/NetBSD/blob/master/dmesg/earmv6hf/RPI0) 
DragonFly tips for printing with CUPS (http://lists.dragonflybsd.org/pipermail/users/2016-February/228608.html) 
Fighting fraudulent networks using secure connections (SSL) blacklisting with OPNsense. Blocks known-bad certificates as listed at abuse.ch 
 (https://opnsense.org/fighting-fraudulent-networks-using-secure-connections-ssl-with-opnsense/) 
Fix for running NetBSD/amd64 7.0 on kvm based virtual machines (https://imil.net/blog/2016/01/29/netbsdamd64-7-0-kvm/) 
Michael W. Lucas’s new book, FreeBSD Mastery: Specialty Filesystems is now escaping (http://blather.michaelwlucas.com/archives/2537) 
The Penguicon Lucas Tech Track (http://blather.michaelwlucas.com/archives/2534) 
FreeBSD based nginx/ffmpeg camera recording and live streaming (http://www.unixmen.com/freebsd-nginx-ffmpeg-camera-recording-and-live-streaming/) 
CFT: New Jenkins Builder for FreeNAS / PC-BSD (https://github.com/iXsystems/ixbuild/) 
Status Update: PC-BSD’s SysAdm Server (https://github.com/pcbsd/sysadm/)
Status Update: PC-BSD’s SysAdm Client UI (https://github.com/pcbsd/sysadm-ui-qt) 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week, Allan and I are away at AsiaBSDCon! (If you aren’t there, you are missing out). We will be back with a live episode next week. However, we’ve been asked for Allan to tell us about ScaleEngine’s</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Allan Jude - <a href="mailto:allanjude@freebsd.org" rel="nofollow">allanjude@freebsd.org</a> / <a href="https://twitter.com/allanjude" rel="nofollow">@allanjude</a></h2>

<ul>
<li>Spotlight on ScaleEngine
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="https://github.com/ebijun/NetBSD/blob/master/dmesg/earmv6hf/RPI0" rel="nofollow">NetBSD on an RPi Zero</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-February/228608.html" rel="nofollow">DragonFly tips for printing with CUPS</a> </p></li>
<li><p><a href="https://opnsense.org/fighting-fraudulent-networks-using-secure-connections-ssl-with-opnsense/" rel="nofollow">Fighting fraudulent networks using secure connections (SSL) blacklisting with OPNsense. Blocks known-bad certificates as listed at abuse.ch <br>
</a> </p></li>
<li><p><a href="https://imil.net/blog/2016/01/29/netbsdamd64-7-0-kvm/" rel="nofollow">Fix for running NetBSD/amd64 7.0 on kvm based virtual machines</a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2537" rel="nofollow">Michael W. Lucas’s new book, FreeBSD Mastery: Specialty Filesystems is now escaping</a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2534" rel="nofollow">The Penguicon Lucas Tech Track</a> </p></li>
<li><p><a href="http://www.unixmen.com/freebsd-nginx-ffmpeg-camera-recording-and-live-streaming/" rel="nofollow">FreeBSD based nginx/ffmpeg camera recording and live streaming</a> </p></li>
<li><p><a href="https://github.com/iXsystems/ixbuild/" rel="nofollow">CFT: New Jenkins Builder for FreeNAS / PC-BSD</a> </p></li>
<li><p><a href="https://github.com/pcbsd/sysadm/" rel="nofollow">Status Update: PC-BSD’s SysAdm Server</a></p></li>
<li><p><a href="https://github.com/pcbsd/sysadm-ui-qt" rel="nofollow">Status Update: PC-BSD’s SysAdm Client UI</a> </p></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week, Allan and I are away at AsiaBSDCon! (If you aren’t there, you are missing out). We will be back with a live episode next week. However, we’ve been asked for Allan to tell us about ScaleEngine’s</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Allan Jude - <a href="mailto:allanjude@freebsd.org" rel="nofollow">allanjude@freebsd.org</a> / <a href="https://twitter.com/allanjude" rel="nofollow">@allanjude</a></h2>

<ul>
<li>Spotlight on ScaleEngine
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="https://github.com/ebijun/NetBSD/blob/master/dmesg/earmv6hf/RPI0" rel="nofollow">NetBSD on an RPi Zero</a> </p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-February/228608.html" rel="nofollow">DragonFly tips for printing with CUPS</a> </p></li>
<li><p><a href="https://opnsense.org/fighting-fraudulent-networks-using-secure-connections-ssl-with-opnsense/" rel="nofollow">Fighting fraudulent networks using secure connections (SSL) blacklisting with OPNsense. Blocks known-bad certificates as listed at abuse.ch <br>
</a> </p></li>
<li><p><a href="https://imil.net/blog/2016/01/29/netbsdamd64-7-0-kvm/" rel="nofollow">Fix for running NetBSD/amd64 7.0 on kvm based virtual machines</a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2537" rel="nofollow">Michael W. Lucas’s new book, FreeBSD Mastery: Specialty Filesystems is now escaping</a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2534" rel="nofollow">The Penguicon Lucas Tech Track</a> </p></li>
<li><p><a href="http://www.unixmen.com/freebsd-nginx-ffmpeg-camera-recording-and-live-streaming/" rel="nofollow">FreeBSD based nginx/ffmpeg camera recording and live streaming</a> </p></li>
<li><p><a href="https://github.com/iXsystems/ixbuild/" rel="nofollow">CFT: New Jenkins Builder for FreeNAS / PC-BSD</a> </p></li>
<li><p><a href="https://github.com/pcbsd/sysadm/" rel="nofollow">Status Update: PC-BSD’s SysAdm Server</a></p></li>
<li><p><a href="https://github.com/pcbsd/sysadm-ui-qt" rel="nofollow">Status Update: PC-BSD’s SysAdm Client UI</a> </p></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>131: BSD behind the chalkboard</title>
  <link>https://www.bsdnow.tv/131</link>
  <guid isPermaLink="false">f302f270-36ec-4244-b701-fb8213e2f134</guid>
  <pubDate>Wed, 02 Mar 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f302f270-36ec-4244-b701-fb8213e2f134.mp3" length="72833908" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we have an interview with Jamie</itunes:subtitle>
  <itunes:duration>1:41:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we have an interview with Jamie
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
BSDCan 2016 List of Talks (http://www.bsdcan.org/2016/list-of-talks.txt)
We are all looking forward to BSDCan
Make sure you arrive in time for the Goat BoF, the evening of Tuesday June 7th at the Royal Oak, just up the street from the university residence
There will also be a ZFS BoF during lunch of one of the conference days, be sure to grab your lunch and bring it to the BoF room
Also, don’t forget to get signed up for the various DevSummits taking place at BSDCan. 
***
What does Load Average really mean (https://utcc.utoronto.ca/~cks/space/blog/unix/ManyLoadAveragesOfUnix)
Chris Siebenmann, a sysadmin at the University of Toronto, does some comparison of what “Load Average” means on different unix systems, including Solaris/IllumOS, FreeBSD, NetBSD, OpenBSD, and Linux
It seems that no two OSes use the same definition, so comparing load averages is impossible
On FreeBSD, where I/O does not affect load average, you can divide the load average by the number of CPU cores to be able to compare across machines with different core counts
***
GPL violations related to combining ZFS and Linux (http://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/)
As we mentioned in last week’s episode, Ubuntu was preparing to release their next version with native ZFS support. + As expected, the Software Freedom Conservancy has issued a statement detailing the legal argument why they believe this is a violation of the GPL license for the Linux kernel.
It’s a pretty long and complete article, but we wanted to bring you the summary of the whole, and encourage you to read the rest, since it’s good to be knowledgeable about the various open-source projects and their license conditions.
“We are sympathetic to Canonical's frustration in this desire to easily support more features for their users. However, as set out below, we have concluded that their distribution of zfs.ko violates the GPL. We have written this statement to answer, from the point of view of many key Linux copyright holders, the community questions that we've seen on this matter. Specifically, we provide our detailed analysis of the incompatibility between CDDLv1 and GPLv2 — and its potential impact on the trajectory of free software development — below. 
However, our conclusion is simple: Conservancy and the Linux copyright holders in the GPL Compliance Project for Linux Developers believe that distribution of ZFS binaries is a GPL violation and infringes Linux's copyright. We are also concerned that it may infringe Oracle's copyrights in ZFS. As such, we again ask Oracle to respect community norms against license proliferation and simply relicense its copyrights in ZFS under a GPLv2-compatible license.”
The Software Freedom Law Center’s take on the issue  (https://softwarefreedom.org/resources/2016/linux-kernel-cddl.html)
Linux SCSI subsystem Maintainer, James Bottomley, asks “where is the harm” (http://blog.hansenpartnership.com/are-gplv2-and-cddl-incompatible/)
FreeBSD and ZFS  (http://freebsdfoundation.blogspot.ca/2016/02/freebsd-and-zfs.html) 
***
DragonFly i915 reaches Linux 4.2  (https://www.phoronix.com/scan.php?page=news_item&amp;amp;px=DragonFlyBSD-i915-4.2)
The port of the Intel i915 DRM/KMS Linux driver to DragonFlyBSD has been updated to match Linux kernel 4.2
Various improvements and better support for new hardware are included
One big difference, is that DragonFlyBSD will not require the binary firmware blob that Linux does
François Tigeot explains: "starting from Linux 4.2, a separate firmware blob is required to save and restore the state of display engines in some low-power modes. These low-power modes have been forcibly disabled in the DragonFly version of this driver in order to keep it blob-free."
Obviously this will have some disadvantage, but as those modes were never available on DragonFlyBSD before, users are not likely to miss them
***
Interview - Jamie McParland - mcparlandj@newberg.k12.or.us (mailto:mcparlandj@newberg.k12.or.us) / @nsdjamie (https://twitter.com/nsdjamie)
FreeBSD behind the chalkboard
***
iXsystems
My New IXSystems Mail Server (https://www.reddit.com/r/LinuxActionShow/comments/48c9nt/my_new_ixsystems_mail_server/)
News Roundup
Installing ELK on FreeBSD, Tutorial Part 1 (https://blog.gufi.org/2016/02/15/elk-first-part/)
Are you an ELK user, or interested in becoming one? If so, Gruppo Utenti has a nice blog post / tutorial on how to get started with it on FreeBSD.
Maybe you haven’t heard of ELK, but its not the ELK in ports, specifically in this case he is referring to “ElasticSearch/Logstash/Kibana” as a stack.
Getting started is relatively simply, first we install a few ports/packages:
textproc/elasticsearch
sysutils/logstash
textproc/kibana43
www/nginx
After enabling the various services for those (hint: sysrc may be easier), he then takes us through the configuration of ElasticSearch and LogStash. For the most part they are fairly straightforward, but you can always copy and paste his example config files as a template.
Follow up to Installing ELK on FreeBSD (https://blog.gufi.org/2016/02/23/elk-second-part/) 
Jumping directly into the next blog entry, he then takes us through the “K” part of ELK, specifically setting up Kibana, and exposing it via nginx publically. 
At this point most of the CLI work is finished, and we have a great walkthrough of doing the Kibana configuration via their UI. We are still awaiting the final entry to the series, where the setup of ElastAlert will be detailed, and we will bring that to your attention when it lands. 
***
From 1989: An Empirical Study of the Reliablity of Unix Utilities (http://ftp.cs.wisc.edu/paradyn/technical_papers/fuzz.pdf)
A paper from 1989 on the results of fuzz testing various unix utilities across a range of available unix operating systems
Very interesting results, it is interesting to look back at before the start of the modern BSD projects
New problems are still being found in utilities using similar testing methodologies, like afl (American Fuzzy lop)
***
Google Summer of Code
Both 
FreeBSD (https://summerofcode.withgoogle.com/organizations/4892834293350400/)
and 
NetBSD (https://summerofcode.withgoogle.com/organizations/6246531984261120/)
Are running 2016 Google Summer of Code projects.
Students can start submitting proposals on March 14th.
In the meantime, if you have any ideas, please post them to the 
Summer Of Code Ideas Page  (https://wiki.freebsd.org/SummerOfCodeIdeas) on the FreeBSD wiki
Students can start looking at the list now and try to find mentors to get a jump start on their project.
***
High Availablity Sync for ipfw3 in Dragonfly (http://lists.dragonflybsd.org/pipermail/commits/2016-February/459424.html)
Similar to pfsync, this new protocol allows firewall dynamic rules (state) to be synchronized between two firewalls that are working together in HA with CARP
Does not yet sync NAT state, it seems libalias will need some modernization first
Apparently it will be relatively easy to port to FreeBSD
This is one of the only features ipfw lacks when compared to pf
***
Beastie Bits
FreeBSD 10.3-BETA3 Now Available (https://lists.freebsd.org/pipermail/freebsd-stable/2016-February/084238.html) 
LibreSSL isnt affected by the OpenSSL DROWN attack (http://undeadly.org/cgi?action=article&amp;amp;sid=20160301141941&amp;amp;mode=expanded) 
NetBSD machines at the Open Source Conference 2016 in Toyko (http://mail-index.netbsd.org/netbsd-advocacy/2016/02/29/msg000703.html) 
OpenBSD removes Linux Emulation (https://marc.info/?l=openbsd-ports-cvs&amp;amp;m=145650279825695&amp;amp;w=2)
Time is an illusion - George Neville-Neil (https://queue.acm.org/detail.cfm?id=2878574)
OpenSSH 7.2 Released (http://www.openssh.com/txt/release-7.2) 
Feedback/Questions
 Shane - IPSEC (http://slexy.org/view/s2qCKWWKv0) 
 Darrall - 14TB Zpool (http://slexy.org/view/s20CP3ty5P) 
 Pedja - ZFS setup (http://slexy.org/view/s2qp7K9KBG) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we have an interview with Jamie</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.bsdcan.org/2016/list-of-talks.txt" rel="nofollow">BSDCan 2016 List of Talks</a></h3>

<ul>
<li>We are all looking forward to BSDCan</li>
<li>Make sure you arrive in time for the Goat BoF, the evening of Tuesday June 7th at the Royal Oak, just up the street from the university residence</li>
<li>There will also be a ZFS BoF during lunch of one of the conference days, be sure to grab your lunch and bring it to the BoF room</li>
<li>Also, don’t forget to get signed up for the various DevSummits taking place at BSDCan. 
***</li>
</ul>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ManyLoadAveragesOfUnix" rel="nofollow">What does Load Average really mean</a></h3>

<ul>
<li>Chris Siebenmann, a sysadmin at the University of Toronto, does some comparison of what “Load Average” means on different unix systems, including Solaris/IllumOS, FreeBSD, NetBSD, OpenBSD, and Linux</li>
<li>It seems that no two OSes use the same definition, so comparing load averages is impossible</li>
<li>On FreeBSD, where I/O does not affect load average, you can divide the load average by the number of CPU cores to be able to compare across machines with different core counts
***</li>
</ul>

<h3><a href="http://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/" rel="nofollow">GPL violations related to combining ZFS and Linux</a></h3>

<ul>
<li>As we mentioned in last week’s episode, Ubuntu was preparing to release their next version with native ZFS support. + As expected, the Software Freedom Conservancy has issued a statement detailing the legal argument why they believe this is a violation of the GPL license for the Linux kernel.</li>
<li>It’s a pretty long and complete article, but we wanted to bring you the summary of the whole, and encourage you to read the rest, since it’s good to be knowledgeable about the various open-source projects and their license conditions.</li>
</ul>

<blockquote>
<p>“We are sympathetic to Canonical&#39;s frustration in this desire to easily support more features for their users. However, as set out below, we have concluded that their distribution of zfs.ko violates the GPL. We have written this statement to answer, from the point of view of many key Linux copyright holders, the community questions that we&#39;ve seen on this matter. Specifically, we provide our detailed analysis of the incompatibility between CDDLv1 and GPLv2 — and its potential impact on the trajectory of free software development — below. </p>

<p>However, our conclusion is simple: Conservancy and the Linux copyright holders in the GPL Compliance Project for Linux Developers believe that distribution of ZFS binaries is a GPL violation and infringes Linux&#39;s copyright. We are also concerned that it may infringe Oracle&#39;s copyrights in ZFS. As such, we again ask Oracle to respect community norms against license proliferation and simply relicense its copyrights in ZFS under a GPLv2-compatible license.”</p>
</blockquote>

<ul>
<li><a href="https://softwarefreedom.org/resources/2016/linux-kernel-cddl.html" rel="nofollow">The Software Freedom Law Center’s take on the issue </a></li>
<li><a href="http://blog.hansenpartnership.com/are-gplv2-and-cddl-incompatible/" rel="nofollow">Linux SCSI subsystem Maintainer, James Bottomley, asks “where is the harm”</a></li>
<li><a href="http://freebsdfoundation.blogspot.ca/2016/02/freebsd-and-zfs.html" rel="nofollow">FreeBSD and ZFS </a> 
***</li>
</ul>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-i915-4.2" rel="nofollow">DragonFly i915 reaches Linux 4.2 </a></h3>

<ul>
<li>The port of the Intel i915 DRM/KMS Linux driver to DragonFlyBSD has been updated to match Linux kernel 4.2</li>
<li>Various improvements and better support for new hardware are included</li>
<li>One big difference, is that DragonFlyBSD will not require the binary firmware blob that Linux does</li>
<li>François Tigeot explains: &quot;starting from Linux 4.2, a separate firmware blob is required to save and restore the state of display engines in some low-power modes. These low-power modes have been forcibly disabled in the DragonFly version of this driver in order to keep it blob-free.&quot;</li>
<li>Obviously this will have some disadvantage, but as those modes were never available on DragonFlyBSD before, users are not likely to miss them
***</li>
</ul>

<h2>Interview - Jamie McParland - <a href="mailto:mcparlandj@newberg.k12.or.us" rel="nofollow">mcparlandj@newberg.k12.or.us</a> / <a href="https://twitter.com/nsdjamie" rel="nofollow">@nsdjamie</a></h2>

<ul>
<li>FreeBSD behind the chalkboard
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.reddit.com/r/LinuxActionShow/comments/48c9nt/my_new_ixsystems_mail_server/" rel="nofollow">My New IXSystems Mail Server</a></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://blog.gufi.org/2016/02/15/elk-first-part/" rel="nofollow">Installing ELK on FreeBSD, Tutorial Part 1</a></h3>

<ul>
<li>Are you an ELK user, or interested in becoming one? If so, Gruppo Utenti has a nice blog post / tutorial on how to get started with it on FreeBSD.</li>
<li>Maybe you haven’t heard of ELK, but its not the ELK in ports, specifically in this case he is referring to “ElasticSearch/Logstash/Kibana” as a stack.</li>
<li>Getting started is relatively simply, first we install a few ports/packages:

<ul>
<li>textproc/elasticsearch</li>
<li>sysutils/logstash</li>
<li>textproc/kibana43</li>
<li>www/nginx</li>
</ul></li>
<li>After enabling the various services for those (hint: sysrc may be easier), he then takes us through the configuration of ElasticSearch and LogStash. For the most part they are fairly straightforward, but you can always copy and paste his example config files as a template.</li>
<li><a href="https://blog.gufi.org/2016/02/23/elk-second-part/" rel="nofollow">Follow up to Installing ELK on FreeBSD</a> </li>
<li>Jumping directly into the next blog entry, he then takes us through the “K” part of ELK, specifically setting up Kibana, and exposing it via nginx publically. </li>
<li>At this point most of the CLI work is finished, and we have a great walkthrough of doing the Kibana configuration via their UI. We are still awaiting the final entry to the series, where the setup of ElastAlert will be detailed, and we will bring that to your attention when it lands. 
***</li>
</ul>

<h3><a href="http://ftp.cs.wisc.edu/paradyn/technical_papers/fuzz.pdf" rel="nofollow">From 1989: An Empirical Study of the Reliablity of Unix Utilities</a></h3>

<ul>
<li>A paper from 1989 on the results of fuzz testing various unix utilities across a range of available unix operating systems</li>
<li>Very interesting results, it is interesting to look back at before the start of the modern BSD projects</li>
<li>New problems are still being found in utilities using similar testing methodologies, like afl (American Fuzzy lop)
***</li>
</ul>

<h3>Google Summer of Code</h3>

<ul>
<li>Both 
<a href="https://summerofcode.withgoogle.com/organizations/4892834293350400/" rel="nofollow">FreeBSD</a></li>
<li>and 
<a href="https://summerofcode.withgoogle.com/organizations/6246531984261120/" rel="nofollow">NetBSD</a></li>
<li>Are running 2016 Google Summer of Code projects.</li>
<li>Students can start submitting proposals on March 14th.</li>
<li>In the meantime, if you have any ideas, please post them to the 
<a href="https://wiki.freebsd.org/SummerOfCodeIdeas" rel="nofollow">Summer Of Code Ideas Page </a> on the FreeBSD wiki</li>
<li>Students can start looking at the list now and try to find mentors to get a jump start on their project.
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-February/459424.html" rel="nofollow">High Availablity Sync for ipfw3 in Dragonfly</a></h3>

<ul>
<li>Similar to pfsync, this new protocol allows firewall dynamic rules (state) to be synchronized between two firewalls that are working together in HA with CARP</li>
<li>Does not yet sync NAT state, it seems libalias will need some modernization first</li>
<li>Apparently it will be relatively easy to port to FreeBSD</li>
<li>This is one of the only features ipfw lacks when compared to pf
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2016-February/084238.html" rel="nofollow">FreeBSD 10.3-BETA3 Now Available</a> </p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20160301141941&mode=expanded" rel="nofollow">LibreSSL isnt affected by the OpenSSL DROWN attack</a> </p></li>
<li><p><a href="http://mail-index.netbsd.org/netbsd-advocacy/2016/02/29/msg000703.html" rel="nofollow">NetBSD machines at the Open Source Conference 2016 in Toyko</a> </p></li>
<li><p><a href="https://marc.info/?l=openbsd-ports-cvs&m=145650279825695&w=2" rel="nofollow">OpenBSD removes Linux Emulation</a></p></li>
<li><p><a href="https://queue.acm.org/detail.cfm?id=2878574" rel="nofollow">Time is an illusion - George Neville-Neil</a></p></li>
<li><p><a href="http://www.openssh.com/txt/release-7.2" rel="nofollow">OpenSSH 7.2 Released</a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2qCKWWKv0" rel="nofollow"> Shane - IPSEC</a> </li>
<li><a href="http://slexy.org/view/s20CP3ty5P" rel="nofollow"> Darrall - 14TB Zpool</a> </li>
<li><a href="http://slexy.org/view/s2qp7K9KBG" rel="nofollow"> Pedja - ZFS setup</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we have an interview with Jamie</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.bsdcan.org/2016/list-of-talks.txt" rel="nofollow">BSDCan 2016 List of Talks</a></h3>

<ul>
<li>We are all looking forward to BSDCan</li>
<li>Make sure you arrive in time for the Goat BoF, the evening of Tuesday June 7th at the Royal Oak, just up the street from the university residence</li>
<li>There will also be a ZFS BoF during lunch of one of the conference days, be sure to grab your lunch and bring it to the BoF room</li>
<li>Also, don’t forget to get signed up for the various DevSummits taking place at BSDCan. 
***</li>
</ul>

<h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ManyLoadAveragesOfUnix" rel="nofollow">What does Load Average really mean</a></h3>

<ul>
<li>Chris Siebenmann, a sysadmin at the University of Toronto, does some comparison of what “Load Average” means on different unix systems, including Solaris/IllumOS, FreeBSD, NetBSD, OpenBSD, and Linux</li>
<li>It seems that no two OSes use the same definition, so comparing load averages is impossible</li>
<li>On FreeBSD, where I/O does not affect load average, you can divide the load average by the number of CPU cores to be able to compare across machines with different core counts
***</li>
</ul>

<h3><a href="http://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/" rel="nofollow">GPL violations related to combining ZFS and Linux</a></h3>

<ul>
<li>As we mentioned in last week’s episode, Ubuntu was preparing to release their next version with native ZFS support. + As expected, the Software Freedom Conservancy has issued a statement detailing the legal argument why they believe this is a violation of the GPL license for the Linux kernel.</li>
<li>It’s a pretty long and complete article, but we wanted to bring you the summary of the whole, and encourage you to read the rest, since it’s good to be knowledgeable about the various open-source projects and their license conditions.</li>
</ul>

<blockquote>
<p>“We are sympathetic to Canonical&#39;s frustration in this desire to easily support more features for their users. However, as set out below, we have concluded that their distribution of zfs.ko violates the GPL. We have written this statement to answer, from the point of view of many key Linux copyright holders, the community questions that we&#39;ve seen on this matter. Specifically, we provide our detailed analysis of the incompatibility between CDDLv1 and GPLv2 — and its potential impact on the trajectory of free software development — below. </p>

<p>However, our conclusion is simple: Conservancy and the Linux copyright holders in the GPL Compliance Project for Linux Developers believe that distribution of ZFS binaries is a GPL violation and infringes Linux&#39;s copyright. We are also concerned that it may infringe Oracle&#39;s copyrights in ZFS. As such, we again ask Oracle to respect community norms against license proliferation and simply relicense its copyrights in ZFS under a GPLv2-compatible license.”</p>
</blockquote>

<ul>
<li><a href="https://softwarefreedom.org/resources/2016/linux-kernel-cddl.html" rel="nofollow">The Software Freedom Law Center’s take on the issue </a></li>
<li><a href="http://blog.hansenpartnership.com/are-gplv2-and-cddl-incompatible/" rel="nofollow">Linux SCSI subsystem Maintainer, James Bottomley, asks “where is the harm”</a></li>
<li><a href="http://freebsdfoundation.blogspot.ca/2016/02/freebsd-and-zfs.html" rel="nofollow">FreeBSD and ZFS </a> 
***</li>
</ul>

<h3><a href="https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-i915-4.2" rel="nofollow">DragonFly i915 reaches Linux 4.2 </a></h3>

<ul>
<li>The port of the Intel i915 DRM/KMS Linux driver to DragonFlyBSD has been updated to match Linux kernel 4.2</li>
<li>Various improvements and better support for new hardware are included</li>
<li>One big difference, is that DragonFlyBSD will not require the binary firmware blob that Linux does</li>
<li>François Tigeot explains: &quot;starting from Linux 4.2, a separate firmware blob is required to save and restore the state of display engines in some low-power modes. These low-power modes have been forcibly disabled in the DragonFly version of this driver in order to keep it blob-free.&quot;</li>
<li>Obviously this will have some disadvantage, but as those modes were never available on DragonFlyBSD before, users are not likely to miss them
***</li>
</ul>

<h2>Interview - Jamie McParland - <a href="mailto:mcparlandj@newberg.k12.or.us" rel="nofollow">mcparlandj@newberg.k12.or.us</a> / <a href="https://twitter.com/nsdjamie" rel="nofollow">@nsdjamie</a></h2>

<ul>
<li>FreeBSD behind the chalkboard
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.reddit.com/r/LinuxActionShow/comments/48c9nt/my_new_ixsystems_mail_server/" rel="nofollow">My New IXSystems Mail Server</a></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://blog.gufi.org/2016/02/15/elk-first-part/" rel="nofollow">Installing ELK on FreeBSD, Tutorial Part 1</a></h3>

<ul>
<li>Are you an ELK user, or interested in becoming one? If so, Gruppo Utenti has a nice blog post / tutorial on how to get started with it on FreeBSD.</li>
<li>Maybe you haven’t heard of ELK, but its not the ELK in ports, specifically in this case he is referring to “ElasticSearch/Logstash/Kibana” as a stack.</li>
<li>Getting started is relatively simply, first we install a few ports/packages:

<ul>
<li>textproc/elasticsearch</li>
<li>sysutils/logstash</li>
<li>textproc/kibana43</li>
<li>www/nginx</li>
</ul></li>
<li>After enabling the various services for those (hint: sysrc may be easier), he then takes us through the configuration of ElasticSearch and LogStash. For the most part they are fairly straightforward, but you can always copy and paste his example config files as a template.</li>
<li><a href="https://blog.gufi.org/2016/02/23/elk-second-part/" rel="nofollow">Follow up to Installing ELK on FreeBSD</a> </li>
<li>Jumping directly into the next blog entry, he then takes us through the “K” part of ELK, specifically setting up Kibana, and exposing it via nginx publically. </li>
<li>At this point most of the CLI work is finished, and we have a great walkthrough of doing the Kibana configuration via their UI. We are still awaiting the final entry to the series, where the setup of ElastAlert will be detailed, and we will bring that to your attention when it lands. 
***</li>
</ul>

<h3><a href="http://ftp.cs.wisc.edu/paradyn/technical_papers/fuzz.pdf" rel="nofollow">From 1989: An Empirical Study of the Reliablity of Unix Utilities</a></h3>

<ul>
<li>A paper from 1989 on the results of fuzz testing various unix utilities across a range of available unix operating systems</li>
<li>Very interesting results, it is interesting to look back at before the start of the modern BSD projects</li>
<li>New problems are still being found in utilities using similar testing methodologies, like afl (American Fuzzy lop)
***</li>
</ul>

<h3>Google Summer of Code</h3>

<ul>
<li>Both 
<a href="https://summerofcode.withgoogle.com/organizations/4892834293350400/" rel="nofollow">FreeBSD</a></li>
<li>and 
<a href="https://summerofcode.withgoogle.com/organizations/6246531984261120/" rel="nofollow">NetBSD</a></li>
<li>Are running 2016 Google Summer of Code projects.</li>
<li>Students can start submitting proposals on March 14th.</li>
<li>In the meantime, if you have any ideas, please post them to the 
<a href="https://wiki.freebsd.org/SummerOfCodeIdeas" rel="nofollow">Summer Of Code Ideas Page </a> on the FreeBSD wiki</li>
<li>Students can start looking at the list now and try to find mentors to get a jump start on their project.
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-February/459424.html" rel="nofollow">High Availablity Sync for ipfw3 in Dragonfly</a></h3>

<ul>
<li>Similar to pfsync, this new protocol allows firewall dynamic rules (state) to be synchronized between two firewalls that are working together in HA with CARP</li>
<li>Does not yet sync NAT state, it seems libalias will need some modernization first</li>
<li>Apparently it will be relatively easy to port to FreeBSD</li>
<li>This is one of the only features ipfw lacks when compared to pf
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2016-February/084238.html" rel="nofollow">FreeBSD 10.3-BETA3 Now Available</a> </p></li>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20160301141941&mode=expanded" rel="nofollow">LibreSSL isnt affected by the OpenSSL DROWN attack</a> </p></li>
<li><p><a href="http://mail-index.netbsd.org/netbsd-advocacy/2016/02/29/msg000703.html" rel="nofollow">NetBSD machines at the Open Source Conference 2016 in Toyko</a> </p></li>
<li><p><a href="https://marc.info/?l=openbsd-ports-cvs&m=145650279825695&w=2" rel="nofollow">OpenBSD removes Linux Emulation</a></p></li>
<li><p><a href="https://queue.acm.org/detail.cfm?id=2878574" rel="nofollow">Time is an illusion - George Neville-Neil</a></p></li>
<li><p><a href="http://www.openssh.com/txt/release-7.2" rel="nofollow">OpenSSH 7.2 Released</a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2qCKWWKv0" rel="nofollow"> Shane - IPSEC</a> </li>
<li><a href="http://slexy.org/view/s20CP3ty5P" rel="nofollow"> Darrall - 14TB Zpool</a> </li>
<li><a href="http://slexy.org/view/s2qp7K9KBG" rel="nofollow"> Pedja - ZFS setup</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>130: Store all the Things | BSD Now 130</title>
  <link>https://www.bsdnow.tv/130</link>
  <guid isPermaLink="false">361b50a5-0039-4457-a81d-8501d6d3e588</guid>
  <pubDate>Wed, 24 Feb 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/361b50a5-0039-4457-a81d-8501d6d3e588.mp3" length="93656020" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, Allan is back from the Storage Summit in Silicon Valley! We are going to get his thoughts on how the conference went, plus bring you the latest ZFS info discussed. That plus the usual BSD news is</itunes:subtitle>
  <itunes:duration>2:10:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, Allan is back from the Storage Summit in Silicon Valley! We are going to get his thoughts on how the conference went, plus bring you the latest ZFS info discussed. That plus the usual BSD news is
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenBSD website operators urged to fix mind-alteringly bad bug (http://www.theregister.co.uk/2016/02/21/openbsd_website_operator_patch_now_for_the_sake_of_your_sanity/?mt=1456206806399)
We start off a bit light-hearted this week, with the important, breaking news that finally a long-standing OpenBSD bug has been addressed for the HTTP daemon.
Specifically? It changes the default 404 page fonts away from Comic Sans, to a bit more crowd-pleasing alternative:
“For some reason the httpd status pages (e.g. 404) use the Comic Sans typeface. This patch removes comic sans and sets the typeface to the default sans-serif typeface of the client.
“This lowers the number of people contacting website maintainers with typeface complaints bordering on harassment”.
Operators running HTTPD are highly encouraged to update their systems to the latest code, right now……... No seriously, we are waiting for you. Get it done now and then we’ll continue with the show.
Registration for AsiaBSDCon 2016 is now open + Talk Schedule (https://2016.asiabsdcon.org/registration/?lang=en)
After a few delays, the registration for AsiaBSDCon has now opened!
The conference starts in less than two weeks! now, so be sure to get signed up ASAP.
In addition the schedule has been posted, and here’s some of the highlights of this year’s conference.
In addition to FreeBSD and NetBSD dev summits on the first two days, we have some excellent tutorials being given this year by Kirk, Gnn, Dru and more! (https://2016.asiabsdcon.org/program.html.en) 
The regular paper talks also have lots of good ones this year, including this crazy encrypted boot loader one given by our very own Allan Jude!
***
OPENBSD ON AWS : AN UNEXPECTED JOURNEY (http://blog.d2-si.fr/2016/02/15/openbsd-on-aws/?hn)
We have a blog post from Antoine Jacoutot, talking about the process of getting OpenBSD up and running in AWS
It starts with his process of creating an AMI from scratch, which ended up not being that bad:
create and loopback-mount a raw image containing a UFS filesystem extract the OpenBSD base sets (which are just regular tarballs) and kernel enable console output (so that one could “aws ec2 get-console-output”)
install the boot loader on the image then use the ec2 tools to import the RAW image to S3, convert it into a volume (ec2-import-volume) which we can snapshot (ec2-create-snapshot) and create an AMI from (ec2-register)
The blog post also has a link to a script which automates this process, so don’t be daunted if you didn’t quite follow all of that. 
Thanks to the recently landed DomU support, the final pieces of the puzzle fell into place, allowing OpenBSD to function as a proper guest (with networking!)
Next it details the process of injecting a public SSH key into the instances for instant remote access. 
An ec2-init.sh script was created (also on github) which does the following:
setting the hostname
installing the provided SSH public key to /root/.ssh/authorized_keys
executing user-data (if it starts with a shebang)
displaying the host SSH fingerprints on the console (to match cloud-init)
With that done, OpenBSD is pretty much AWS ready! He then gives a brief walkthrough of setting up nginx for new users, but if you’ve already done this before then the instance is ready for you to hacking on.
Start thinking of ideas for things with FreeBSD for Google's 2016 Summer of Code (https://wiki.freebsd.org/SummerOfCodeIdeas)
Students and Developers, listen up! It’s time to start thinking about GSoC again, and FreeBSD is looking to update its project ideas page.
There’s some good ones on the list, plus ones that should be pruned (such as GELI boot), but now is the time to start adding new ones before we get too deep into the process.
This goes for the other BSD’s as well, start thinking about your proposals, or if you are developer, which projects would be a good fit for mentoring.
(Improving the Linux Compat layer is one I think should be done!)
Guide to getting started with kernel hacking (https://wiki.freebsd.org/Graphics/Getting%20started%20with%20kernel%20projects) 
One of the things that’s been asked frequently is how to contribute towards the efforts to bring updated DRM / X drivers to the FreeBSD kernel. 
Jean-Sébastien Pédron has started a great guide on the Wiki which details how to get started with the porting effort, and that developers need not be afraid of helping.
***
Storage Summit Roundup
Earlier this week a number of developers from FreeBSD, as well as various vendors that use FreeBSD, or provide products used with FreeBSD met for a Storage Summit (https://wiki.freebsd.org/201602StorageSummit), to discuss the 
future of these technologies
The summit was co-located with the USENIX FAST (Filesystems And Storage Technologies) conference
The summit was sponsored by the FreeBSD Foundation and FlightAware
After a short introduction, the event opened with a Networking Synergy panel
The focus of this panel was to see if there were techniques and lessons learned in improving the networking stack over the last 10 years that could be applied to improving the storage stack
A lot of time was spent discussing issues like multi-queue support, CPU scheduling, and ways to modernize the stack
CAM Scheduling &amp;amp; Locking Revamp (https://wiki.freebsd.org/201602StorageSummit/CAM)
No notes posted
User Space Storage Stack (https://wiki.freebsd.org/201602StorageSummit/UserSpace)
One of the user space storage stacks discussed was Diskmap
Like netmap, but for disks (diskmap)
Kernel bypass for accessing disks
Ilias Marinos, who is working on diskmap at Cambridge University, described diskmap to the group
A design discussion then followed in which the memory management was covered as that's an issue for any sort of "IO" map system
Action Items:
Discuss with Luigi the idea of code merges
Need a reset path API
Kernel buffer mapping for reliability
Support for other interfaces (SATA/SCSI)
GEOM layer adaptation
Adapting to New Storage Technologies (https://wiki.freebsd.org/201602StorageSummit/NewStorageTechnologies) 
This working group was led by Adrian Palmer, from Seagate
SMR
Persistent Memory
Session 1: Device Identification and the structural requirements
Agenda: We'll look over the Identification nuances and what needs to change to support the structure. Support for IO order guarantees, forward-write only requirements, new commands and topology. Dig into CAM and GEOM layers. Solutions should be fast and have as few code paths as possible
Results: Small audience. We talked about zoned characteristics, and how it can be used in various workloads, projected to be implemented in years
Session 2: Information dissemination and consumption
Agenda: Where and how will information from the report_zones command be gathered, stored, combined and used. This will include userspace storage and multi-volume management. Will CAM store this data, or will GEOM? How frequently will this need to be queried/updated/verified from the drive?
Results: Merged with ZFS working group to discuss SMR. Came up with idea that could be implemented as circular buffer zone type. Began to discuss solutions among developers
ZFS (https://wiki.freebsd.org/201602StorageSummit/ZFS) 
During the first session we discussed how to improve dedup support
    + A dedup throttle or cap was discussed. When the size of the DDT grows beyond this size, new entries would not be deduped.
An alternative to this was also discussed, where when the DDT reached the cap size, it would remove a random entry with only a single reference from the DDT to make room for the new entry. When a block is going to be freed, if it is not found in the DDT, it is assumed to have only 1 reference, and removed.
There was also discussion of replacing the DDT with an in-memory hash table and a “log” of increment/decrement operations, that is periodically compacted. The hash table is recreated from the log at pool import time. This would reduce the in-memory footprint of the DDT, as well as speed up all write operations as adding an entry to the dedup log will be less expensive than updating the DDT.
There was also discussion of using dedicated device(s) for the DDT, either using the DDT on SSD work by Nexenta, or the Metadata Classes work by Intel
The first session also discussed Secure Delete and related things
The desire for an implementation of TRIM that uses the “secure erase” functionality provided by some disks was expressed
Overwriting sectors with patterns of garbage may be insufficient because SSDs may internally remap where a specific LBA physically resides
The possibility of using something like the “eager zero” feature to periodically write zeros over all free blocks in the pool to erase any lingering data fragments
Problems with the FreeBSD TRIM implementation were discussed, as well as looking at ways to implement the new ZFS TRIM implementation on FreeBSD
ABD (ARC Buf Data) was discussed, a new design that lessens the requirement for contiguous memory. Only a small area of contiguous blocks is reserved at boot, and compressed ARC blocks are constructed of scatter-gather lists of individual pages
The second session combined with the SMR group and talked about SMR support in ZFS
Later in the second session ZFS Encryption was also discussed, mostly with a focus on what the use cases are
The third session combined all of the groups for an overview of upcoming ZFS features including device removal and channel programs
There was also a request for code review, for mostly finished projects like Persistent L2ARC, Writeback cache, and Large dnode support
Hallway Track
ZFS / VFS Interaction
Adrian Palmer has been a FreeBSD hobbyist since FreeBSD 7, and I think I managed to convince him to start contributing
***
News Roundup
One Week with NetBSD 7.0: Back to Unix basics (http://jamesdeagle.blogspot.com/2016/02/one-week-with-netbsd-70-back-to-unix.html)
The author of this blog series is sending a week using NetBSD 7.0, following a previous series on Solaris 10
“This is actually familiar territory, as I've been using BSD variants almost exclusively since 2006. My recent SunOS explorations were triggered last summer by OpenBSD having choked on my current laptop's NVIDIA card, and from what I could see at the time, FreeBSD had the same problem, although I now know NVIDIA drivers exist for that system. The thing that keeps me from going all-in with FreeBSD 10.x, however, is the fact that Firefox crashes and leaves "core dump" messages in its wake, and I'm just not a Chrome kinda guy.”
“For those with a catholic taste in Unix, NetBSD is a keg party at the Vatican. If you're an absolute Unix beginner, or have been living on Ubuntu-based Linux distros for too long, then you may feel stranded at first by NetBSD's sparseness. You'll find yourself staring into the abyss and seeing only a blinking cursor staring back. If you have the presence of mind to type startx, you'll be greeted by twm, a window manager offering little more than an xterm window with the same blinking cursor until you learn how to configure the .twmrc file to include whatever applications you want or need in the right-click menu.”
“As for NetBSD itself, I can't think of any major productivity applications that can't be installed, and most multimedia stuff works fine.”
Issues the author hopes to sort out in later posts:
Audio playback (youtube videos in Firefox)
Wireless
Flash
Digital Camera SD Card readability, video playback
Audacity
A “fancy” desktop like Gnome 2, KDE, or xfce
In a follow-up post (http://jamesdeagle.blogspot.com/2016/02/one-week-with-netbsd-70-libreoffice.html), the author got LibreOffice installed and sorted out the audio issues they were having
In a later follow-up (http://jamesdeagle.blogspot.com/2016/02/one-week-with-netbsd-70-mixed-review-of.html) XFCE is up and running as well
***
ZFS is for Containers in Ubuntu 16.04 (http://blog.dustinkirkland.com/2016/02/zfs-is-fs-for-containers-in-ubuntu-1604.html)
As you may have heard, Ubuntu 16.04 will include ZFS -- baked directly into Ubuntu -- supported by Canonical
“ZFS one of the most beloved features of Solaris, universally coveted by every Linux sysadmin with a Solaris background.  To our delight, we're happy to make to OpenZFS available on every Ubuntu system.”
What does “supported by Canonical” mean?
“You'll find zfs.ko automatically built and installed on your Ubuntu systems.  No more DKMS-built modules”
“The user space zfsutils-linux package will be included in Ubuntu Main, with security updates provided by Canonical”
The article then provides a quick tutorial for setting up Linux Containers (LXC) backed by ZFS
In the example, ZFS is backed by a file on the existing disk, not by a real disk, and with no redundancy
However, the setup script seems to support using real block devices
The Software Freedom Conservancy (https://sfconservancy.org/) is expected to issue a statement detailing their opinion on the legalities and licensing issues of bundling ZFS with Linux.
***
Polling is a Hack: Server Sent Events (EventSource) with gevent, Flask, nginx, and FreeBSD (http://hypatia.software/2016/01/29/polling-is-a-hack-server-sent-events-eventsource-with-gevent-flask-nginx-and-freebsd/)
A tutorial on setting up ‘Server-Sent Events’, also know as EventSource in javascript, to notify website clients of new data, rather than having the javascript constantly poll for new data.
The setup uses FreeBSD, nginx, gevent, Python, and the Flask framework
The tutorial walks through setting a basic Python application using the Flask framework
Then setting up the client side in Javascript
Then for the server side setup, it covers installing and configuring nginx, and py-supervisor on FreeBSD
The tutorial also includes links to additional resources and examples, including how to rate limit the Flash application
***
Why FreeBSD? (http://www.aikchar.me/blog/why-freebsd.html)
An excellent article written by Hamza Sheikh, discussing why FreeBSD is now his clear choice for learning UNIX.
The article is pretty well written and lengthy, but has some great parts which we wanted to share with you:
There were many rough edges in the Linux world and some of them exist even today. Choosing the right distribution (distro) for the task at hand is always the first and most difficult decision to make. While this is a strength of the Linux community it is also its weakness. This is exacerbated with the toxic infighting within the community in the last few years.
A herd of voices believes it is their right to bring down a distro community because it is not like their distro of choice. Forking upstream projects has somehow become taboo. Hurling abuse in mailing lists is acceptable. Helping new users is limited to lambasting their distro of choice. Creating conspiracy theories over software decisions is the way to go. Copyleft zealots roam social media declaring non-copyleft free software heretic abominations. It all boils down to an ecosystem soured by the presence of maniacs who have the loudest voices and they seem to be everywhere you turn.
Where is the engineering among all this noise? Btrfs - baking for a long time - is still nowhere near ZFS in stability or feature parity. systemd is an insatiable entity that feeds on every idea in sight and just devours indiscriminately. Wayland was promised years ago and its time has yet to arrive. Containers are represented by Docker that neither securely contains applications nor makes them easy to manage in production. Firewalling is dithering between firewalld, nftables, etc. SystemTap cannot match DTrace.
In the same time span what do various BSDs offer? pf, CARP, ZFS, Hammer, OpenSSH, jails, pkgsrc, (software) ports, DTrace, hardware portability; just to name a few. Few would deny that BSDs have delivered great engineering with free software licenses to the entire world. To me they appear to be better flag bearers of free software with engineering to back it.
He then goes through some of the various BSD’s and the specifics on why FreeBSD was the logical choice for his situation. But at the end has a great summary on the community as a whole:
Finally - and maybe repeating myself here - I have nothing but praise for the community. Be it BSD Now, mailing lists, Reddit, Twitter, LFNW, or SeaGL, people have encouraged me, answered my questions, and filed bugs for me. I have been welcomed and made a part of the community with open arms. These reasons are (good) enough for me to use FreeBSD and contribute to it.
BeastieBits
OPNsense 16.1.3 released (https://opnsense.org/opnsense-16-1-3-released/)
Copies of "FreeBSD Mastery: Specialty Filesystems" seen in the wild (https://twitter.com/Savagedlight/status/700001944547491842) 
pfsense training available in Europe (http://www.netgate.com/training/) 
LiteBSD now has 50 ports in its ports tree (https://github.com/ibara/LiteBSD-Ports) 
Ports tree locked for OpenBSD 5.9 (http://marc.info/?l=openbsd-ports&amp;amp;m=145615281431064&amp;amp;w=2)
“FreeBSD Filesystem Fun” at March semibug (http://blather.michaelwlucas.com/archives/2556)
Event #46 — Embedded Platforms (BSD, OpenWRT, Plan 9 &amp;amp; Inferno) (http://oshug.org/event/46) 
Feedback/Questions
Frank - ZFS RAM? (http://slexy.org/view/s21lcCKrSB) 
David - ARM Porting (http://slexy.org/view/s204lxjvlq) 
 Johnny - Lumina Default? (http://slexy.org/view/s2xMiSNLYn) 
 Adam - PC-BSD Install and Q’s (http://slexy.org/view/s214gJbLwD) 
 Jeremy - Video Card Q (http://slexy.org/view/s20UNyzEeh) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, storage, summit, ZFS, news, AsiaBSDCon, Podcast ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, Allan is back from the Storage Summit in Silicon Valley! We are going to get his thoughts on how the conference went, plus bring you the latest ZFS info discussed. That plus the usual BSD news is</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.theregister.co.uk/2016/02/21/openbsd_website_operator_patch_now_for_the_sake_of_your_sanity/?mt=1456206806399" rel="nofollow">OpenBSD website operators urged to fix mind-alteringly bad bug</a></h3>

<ul>
<li>We start off a bit light-hearted this week, with the important, breaking news that <em>finally</em> a long-standing OpenBSD bug has been addressed for the HTTP daemon.</li>
<li>Specifically? It changes the default 404 page fonts away from Comic Sans, to a bit more crowd-pleasing alternative:

<ul>
<li>“For some reason the httpd status pages (e.g. 404) use the Comic Sans typeface. This patch removes comic sans and sets the typeface to the default sans-serif typeface of the client.</li>
<li>“This lowers the number of people contacting website maintainers with typeface complaints bordering on harassment”.</li>
</ul></li>
<li>Operators running HTTPD are highly encouraged to update their systems to the latest code, right now……... No seriously, we are waiting for you. Get it done now and then we’ll continue with the show.</li>
</ul>

<hr>

<h3><a href="https://2016.asiabsdcon.org/registration/?lang=en" rel="nofollow">Registration for AsiaBSDCon 2016 is now open + Talk Schedule</a></h3>

<ul>
<li>After a few delays, the registration for AsiaBSDCon has now opened!</li>
<li>The conference starts in less than two weeks! now, so be sure to get signed up ASAP.</li>
<li>In addition the schedule has been posted, and here’s some of the highlights of this year’s conference.</li>
<li>In addition to FreeBSD and NetBSD dev summits on the first two days, we have some excellent tutorials being given this year by Kirk, Gnn, Dru and more! (<a href="https://2016.asiabsdcon.org/program.html.en" rel="nofollow">https://2016.asiabsdcon.org/program.html.en</a>) </li>
<li>The regular paper talks also have lots of good ones this year, including this crazy encrypted boot loader one given by our very own Allan Jude!
***</li>
</ul>

<h3><a href="http://blog.d2-si.fr/2016/02/15/openbsd-on-aws/?hn" rel="nofollow">OPENBSD ON AWS : AN UNEXPECTED JOURNEY</a></h3>

<ul>
<li>We have a blog post from Antoine Jacoutot, talking about the process of getting OpenBSD up and running in AWS</li>
<li><p>It starts with his process of creating an AMI from scratch, which ended up not being that bad:</p>

<ul>
<li>create and loopback-mount a raw image containing a UFS filesystem extract the OpenBSD base sets (which are just regular tarballs) and kernel enable console output (so that one could “aws ec2 get-console-output”)</li>
<li>install the boot loader on the image then use the ec2 tools to import the RAW image to S3, convert it into a volume (ec2-import-volume) which we can snapshot (ec2-create-snapshot) and create an AMI from (ec2-register)</li>
</ul></li>
<li><p>The blog post also has a link to a script which automates this process, so don’t be daunted if you didn’t quite follow all of that. </p></li>
<li><p>Thanks to the recently landed DomU support, the final pieces of the puzzle fell into place, allowing OpenBSD to function as a proper guest (with networking!)</p></li>
<li><p>Next it details the process of injecting a public SSH key into the instances for instant remote access. </p></li>
<li><p>An ec2-init.sh script was created (also on github) which does the following:</p>

<ul>
<li>setting the hostname</li>
<li>installing the provided SSH public key to /root/.ssh/authorized_keys</li>
<li>executing user-data (if it starts with a shebang)</li>
<li>displaying the host SSH fingerprints on the console (to match cloud-init)</li>
</ul></li>
<li><p>With that done, OpenBSD is pretty much AWS ready! He then gives a brief walkthrough of setting up nginx for new users, but if you’ve already done this before then the instance is ready for you to hacking on.</p>

<hr></li>
</ul>

<h3><a href="https://wiki.freebsd.org/SummerOfCodeIdeas" rel="nofollow">Start thinking of ideas for things with FreeBSD for Google&#39;s 2016 Summer of Code</a></h3>

<ul>
<li>Students and Developers, listen up! It’s time to start thinking about GSoC again, and FreeBSD is looking to update its project ideas page.</li>
<li>There’s some good ones on the list, plus ones that should be pruned (such as GELI boot), but now is the time to start adding new ones before we get too deep into the process.</li>
<li>This goes for the other BSD’s as well, start thinking about your proposals, or if you are developer, which projects would be a good fit for mentoring.</li>
<li>(Improving the Linux Compat layer is one I think should be done!)
<a href="https://wiki.freebsd.org/Graphics/Getting%20started%20with%20kernel%20projects" rel="nofollow">Guide to getting started with kernel hacking</a> </li>
<li>One of the things that’s been asked frequently is how to contribute towards the efforts to bring updated DRM / X drivers to the FreeBSD kernel. </li>
<li>Jean-Sébastien Pédron has started a great guide on the Wiki which details how to get started with the porting effort, and that developers need not be afraid of helping.
***</li>
</ul>

<h3>Storage Summit Roundup</h3>

<ul>
<li>Earlier this week a number of developers from FreeBSD, as well as various vendors that use FreeBSD, or provide products used with FreeBSD met for a <a href="https://wiki.freebsd.org/201602StorageSummit" rel="nofollow">Storage Summit</a>, to discuss the 
future of these technologies</li>
<li>The summit was co-located with the USENIX FAST (Filesystems And Storage Technologies) conference</li>
<li>The summit was sponsored by the FreeBSD Foundation and FlightAware</li>
<li>After a short introduction, the event opened with a Networking Synergy panel</li>
<li>The focus of this panel was to see if there were techniques and lessons learned in improving the networking stack over the last 10 years that could be applied to improving the storage stack</li>
<li>A lot of time was spent discussing issues like multi-queue support, CPU scheduling, and ways to modernize the stack</li>
<li><a href="https://wiki.freebsd.org/201602StorageSummit/CAM" rel="nofollow">CAM Scheduling &amp; Locking Revamp</a>

<ul>
<li>No notes posted</li>
</ul></li>
<li><a href="https://wiki.freebsd.org/201602StorageSummit/UserSpace" rel="nofollow">User Space Storage Stack</a>

<ul>
<li>One of the user space storage stacks discussed was Diskmap</li>
<li>Like netmap, but for disks (diskmap)</li>
<li>Kernel bypass for accessing disks</li>
<li>Ilias Marinos, who is working on diskmap at Cambridge University, described diskmap to the group</li>
</ul></li>
<li>A design discussion then followed in which the memory management was covered as that&#39;s an issue for any sort of &quot;IO&quot; map system

<ul>
<li>Action Items:</li>
</ul></li>
<li>Discuss with Luigi the idea of code merges</li>
<li>Need a reset path API</li>
<li>Kernel buffer mapping for reliability</li>
<li>Support for other interfaces (SATA/SCSI)</li>
<li>GEOM layer adaptation</li>
<li><a href="https://wiki.freebsd.org/201602StorageSummit/NewStorageTechnologies" rel="nofollow">Adapting to New Storage Technologies</a> 

<ul>
<li>This working group was led by Adrian Palmer, from Seagate</li>
<li>SMR</li>
<li>Persistent Memory</li>
<li>Session 1: Device Identification and the structural requirements

<ul>
<li>Agenda: We&#39;ll look over the Identification nuances and what needs to change to support the structure. Support for IO order guarantees, forward-write only requirements, new commands and topology. Dig into CAM and GEOM layers. Solutions should be fast and have as few code paths as possible</li>
<li>Results: Small audience. We talked about zoned characteristics, and how it can be used in various workloads, projected to be implemented in years</li>
</ul></li>
<li>Session 2: Information dissemination and consumption

<ul>
<li>Agenda: Where and how will information from the report_zones command be gathered, stored, combined and used. This will include userspace storage and multi-volume management. Will CAM store this data, or will GEOM? How frequently will this need to be queried/updated/verified from the drive?</li>
<li>Results: Merged with ZFS working group to discuss SMR. Came up with idea that could be implemented as circular buffer zone type. Began to discuss solutions among developers</li>
</ul></li>
</ul></li>
<li><a href="https://wiki.freebsd.org/201602StorageSummit/ZFS" rel="nofollow">ZFS</a> 

<ul>
<li>During the first session we discussed how to improve dedup support
    + A dedup throttle or cap was discussed. When the size of the DDT grows beyond this size, new entries would not be deduped.

<ul>
<li>An alternative to this was also discussed, where when the DDT reached the cap size, it would remove a random entry with only a single reference from the DDT to make room for the new entry. When a block is going to be freed, if it is not found in the DDT, it is assumed to have only 1 reference, and removed.</li>
<li>There was also discussion of replacing the DDT with an in-memory hash table and a “log” of increment/decrement operations, that is periodically compacted. The hash table is recreated from the log at pool import time. This would reduce the in-memory footprint of the DDT, as well as speed up all write operations as adding an entry to the dedup log will be less expensive than updating the DDT.</li>
<li>There was also discussion of using dedicated device(s) for the DDT, either using the DDT on SSD work by Nexenta, or the Metadata Classes work by Intel</li>
</ul></li>
<li>The first session also discussed Secure Delete and related things

<ul>
<li>The desire for an implementation of TRIM that uses the “secure erase” functionality provided by some disks was expressed</li>
<li>Overwriting sectors with patterns of garbage may be insufficient because SSDs may internally remap where a specific LBA physically resides</li>
<li>The possibility of using something like the “eager zero” feature to periodically write zeros over all free blocks in the pool to erase any lingering data fragments</li>
<li>Problems with the FreeBSD TRIM implementation were discussed, as well as looking at ways to implement the new ZFS TRIM implementation on FreeBSD</li>
<li>ABD (ARC Buf Data) was discussed, a new design that lessens the requirement for contiguous memory. Only a small area of contiguous blocks is reserved at boot, and compressed ARC blocks are constructed of scatter-gather lists of individual pages</li>
</ul></li>
<li>The second session combined with the SMR group and talked about SMR support in ZFS

<ul>
<li>Later in the second session ZFS Encryption was also discussed, mostly with a focus on what the use cases are</li>
</ul></li>
<li>The third session combined all of the groups for an overview of upcoming ZFS features including device removal and channel programs</li>
<li>There was also a request for code review, for mostly finished projects like Persistent L2ARC, Writeback cache, and Large dnode support</li>
</ul></li>
<li>Hallway Track

<ul>
<li>ZFS / VFS Interaction</li>
<li>Adrian Palmer has been a FreeBSD hobbyist since FreeBSD 7, and I think I managed to convince him to start contributing
***</li>
</ul></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://jamesdeagle.blogspot.com/2016/02/one-week-with-netbsd-70-back-to-unix.html" rel="nofollow">One Week with NetBSD 7.0: Back to Unix basics</a></h3>

<ul>
<li>The author of this blog series is sending a week using NetBSD 7.0, following a previous series on Solaris 10</li>
<li>“This is actually familiar territory, as I&#39;ve been using BSD variants almost exclusively since 2006. My recent SunOS explorations were triggered last summer by OpenBSD having choked on my current laptop&#39;s NVIDIA card, and from what I could see at the time, FreeBSD had the same problem, although I now know NVIDIA drivers exist for that system. The thing that keeps me from going all-in with FreeBSD 10.x, however, is the fact that Firefox crashes and leaves &quot;core dump&quot; messages in its wake, and I&#39;m just not a Chrome kinda guy.”</li>
<li>“For those with a catholic taste in Unix, NetBSD is a keg party at the Vatican. If you&#39;re an absolute Unix beginner, or have been living on Ubuntu-based Linux distros for too long, then you may feel stranded at first by NetBSD&#39;s sparseness. You&#39;ll find yourself staring into the abyss and seeing only a blinking cursor staring back. If you have the presence of mind to type startx, you&#39;ll be greeted by twm, a window manager offering little more than an xterm window with the same blinking cursor until you learn how to configure the .twmrc file to include whatever applications you want or need in the right-click menu.”</li>
<li>“As for NetBSD itself, I can&#39;t think of any major productivity applications that can&#39;t be installed, and most multimedia stuff works fine.”</li>
<li>Issues the author hopes to sort out in later posts:

<ul>
<li>Audio playback (youtube videos in Firefox)</li>
<li>Wireless</li>
<li>Flash</li>
<li>Digital Camera SD Card readability, video playback</li>
<li>Audacity</li>
<li>A “fancy” desktop like Gnome 2, KDE, or xfce</li>
</ul></li>
<li>In a <a href="http://jamesdeagle.blogspot.com/2016/02/one-week-with-netbsd-70-libreoffice.html" rel="nofollow">follow-up post</a>, the author got LibreOffice installed and sorted out the audio issues they were having</li>
<li>In a <a href="http://jamesdeagle.blogspot.com/2016/02/one-week-with-netbsd-70-mixed-review-of.html" rel="nofollow">later follow-up</a> XFCE is up and running as well
***</li>
</ul>

<h3><a href="http://blog.dustinkirkland.com/2016/02/zfs-is-fs-for-containers-in-ubuntu-1604.html" rel="nofollow">ZFS is for Containers in Ubuntu 16.04</a></h3>

<ul>
<li>As you may have heard, Ubuntu 16.04 will include ZFS -- baked directly into Ubuntu -- supported by Canonical</li>
<li>“ZFS one of the most beloved features of Solaris, universally coveted by every Linux sysadmin with a Solaris background.  To our delight, we&#39;re happy to make to OpenZFS available on every Ubuntu system.”</li>
<li>What does “supported by Canonical” mean?</li>
<li>“You&#39;ll find zfs.ko automatically built and installed on your Ubuntu systems.  No more DKMS-built modules”</li>
<li>“The user space zfsutils-linux package will be included in Ubuntu Main, with security updates provided by Canonical”</li>
<li>The article then provides a quick tutorial for setting up Linux Containers (LXC) backed by ZFS</li>
<li>In the example, ZFS is backed by a file on the existing disk, not by a real disk, and with no redundancy</li>
<li>However, the setup script seems to support using real block devices</li>
<li>The <a href="https://sfconservancy.org/" rel="nofollow">Software Freedom Conservancy</a> is expected to issue a statement detailing their opinion on the legalities and licensing issues of bundling ZFS with Linux.
***</li>
</ul>

<h3><a href="http://hypatia.software/2016/01/29/polling-is-a-hack-server-sent-events-eventsource-with-gevent-flask-nginx-and-freebsd/" rel="nofollow">Polling is a Hack: Server Sent Events (EventSource) with gevent, Flask, nginx, and FreeBSD</a></h3>

<ul>
<li>A tutorial on setting up ‘Server-Sent Events’, also know as EventSource in javascript, to notify website clients of new data, rather than having the javascript constantly poll for new data.</li>
<li>The setup uses FreeBSD, nginx, gevent, Python, and the Flask framework</li>
<li>The tutorial walks through setting a basic Python application using the Flask framework</li>
<li>Then setting up the client side in Javascript</li>
<li>Then for the server side setup, it covers installing and configuring nginx, and py-supervisor on FreeBSD</li>
<li>The tutorial also includes links to additional resources and examples, including how to rate limit the Flash application
***</li>
</ul>

<h3><a href="http://www.aikchar.me/blog/why-freebsd.html" rel="nofollow">Why FreeBSD?</a></h3>

<ul>
<li>An excellent article written by Hamza Sheikh, discussing why FreeBSD is now his clear choice for learning UNIX.</li>
<li>The article is pretty well written and lengthy, but has some great parts which we wanted to share with you:</li>
</ul>

<p>There were many rough edges in the Linux world and some of them exist even today. Choosing the right distribution (distro) for the task at hand is always the first and most difficult decision to make. While this is a strength of the Linux community it is also its weakness. This is exacerbated with the toxic infighting within the community in the last few years.</p>

<p>A herd of voices believes it is their right to bring down a distro community because it is not like their distro of choice. Forking upstream projects has somehow become taboo. Hurling abuse in mailing lists is acceptable. Helping new users is limited to lambasting their distro of choice. Creating conspiracy theories over software decisions is the way to go. Copyleft zealots roam social media declaring non-copyleft free software heretic abominations. It all boils down to an ecosystem soured by the presence of maniacs who have the loudest voices and they seem to be everywhere you turn.</p>

<p>Where is the engineering among all this noise? Btrfs - baking for a long time - is still nowhere near ZFS in stability or feature parity. systemd is an insatiable entity that feeds on every idea in sight and just devours indiscriminately. Wayland was promised years ago and its time has yet to arrive. Containers are represented by Docker that neither securely contains applications nor makes them easy to manage in production. Firewalling is dithering between firewalld, nftables, etc. SystemTap cannot match DTrace.</p>

<p>In the same time span what do various BSDs offer? pf, CARP, ZFS, Hammer, OpenSSH, jails, pkgsrc, (software) ports, DTrace, hardware portability; just to name a few. Few would deny that BSDs have delivered great engineering with free software licenses to the entire world. To me they appear to be better flag bearers of free software with engineering to back it.</p>

<ul>
<li>He then goes through some of the various BSD’s and the specifics on why FreeBSD was the logical choice for his situation. But at the end has a great summary on the community as a whole:</li>
</ul>

<p>Finally - and maybe repeating myself here - I have nothing but praise for the community. Be it BSD Now, mailing lists, Reddit, Twitter, LFNW, or SeaGL, people have encouraged me, answered my questions, and filed bugs for me. I have been welcomed and made a part of the community with open arms. These reasons are (good) enough for me to use FreeBSD and contribute to it.</p>

<hr>

<h3>BeastieBits</h3>

<p><a href="https://opnsense.org/opnsense-16-1-3-released/" rel="nofollow">OPNsense 16.1.3 released</a></p>

<p><a href="https://twitter.com/Savagedlight/status/700001944547491842" rel="nofollow">Copies of &quot;FreeBSD Mastery: Specialty Filesystems&quot; seen in the wild</a> </p>

<p><a href="http://www.netgate.com/training/" rel="nofollow">pfsense training available in Europe</a> </p>

<p><a href="https://github.com/ibara/LiteBSD-Ports" rel="nofollow">LiteBSD now has 50 ports in its ports tree</a> </p>

<p><a href="http://marc.info/?l=openbsd-ports&m=145615281431064&w=2" rel="nofollow">Ports tree locked for OpenBSD 5.9</a></p>

<p><a href="http://blather.michaelwlucas.com/archives/2556" rel="nofollow">“FreeBSD Filesystem Fun” at March semibug</a></p>

<p><a href="http://oshug.org/event/46" rel="nofollow">Event #46 — Embedded Platforms (BSD, OpenWRT, Plan 9 &amp; Inferno)</a> </p>

<hr>

<h3>Feedback/Questions</h3>

<ul>
<li><a href="http://slexy.org/view/s21lcCKrSB" rel="nofollow">Frank - ZFS RAM?</a> </li>
<li><a href="http://slexy.org/view/s204lxjvlq" rel="nofollow">David - ARM Porting</a> </li>
<li><a href="http://slexy.org/view/s2xMiSNLYn" rel="nofollow"> Johnny - Lumina Default?</a> </li>
<li><a href="http://slexy.org/view/s214gJbLwD" rel="nofollow"> Adam - PC-BSD Install and Q’s</a> </li>
<li><a href="http://slexy.org/view/s20UNyzEeh" rel="nofollow"> Jeremy - Video Card Q</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, Allan is back from the Storage Summit in Silicon Valley! We are going to get his thoughts on how the conference went, plus bring you the latest ZFS info discussed. That plus the usual BSD news is</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.theregister.co.uk/2016/02/21/openbsd_website_operator_patch_now_for_the_sake_of_your_sanity/?mt=1456206806399" rel="nofollow">OpenBSD website operators urged to fix mind-alteringly bad bug</a></h3>

<ul>
<li>We start off a bit light-hearted this week, with the important, breaking news that <em>finally</em> a long-standing OpenBSD bug has been addressed for the HTTP daemon.</li>
<li>Specifically? It changes the default 404 page fonts away from Comic Sans, to a bit more crowd-pleasing alternative:

<ul>
<li>“For some reason the httpd status pages (e.g. 404) use the Comic Sans typeface. This patch removes comic sans and sets the typeface to the default sans-serif typeface of the client.</li>
<li>“This lowers the number of people contacting website maintainers with typeface complaints bordering on harassment”.</li>
</ul></li>
<li>Operators running HTTPD are highly encouraged to update their systems to the latest code, right now……... No seriously, we are waiting for you. Get it done now and then we’ll continue with the show.</li>
</ul>

<hr>

<h3><a href="https://2016.asiabsdcon.org/registration/?lang=en" rel="nofollow">Registration for AsiaBSDCon 2016 is now open + Talk Schedule</a></h3>

<ul>
<li>After a few delays, the registration for AsiaBSDCon has now opened!</li>
<li>The conference starts in less than two weeks! now, so be sure to get signed up ASAP.</li>
<li>In addition the schedule has been posted, and here’s some of the highlights of this year’s conference.</li>
<li>In addition to FreeBSD and NetBSD dev summits on the first two days, we have some excellent tutorials being given this year by Kirk, Gnn, Dru and more! (<a href="https://2016.asiabsdcon.org/program.html.en" rel="nofollow">https://2016.asiabsdcon.org/program.html.en</a>) </li>
<li>The regular paper talks also have lots of good ones this year, including this crazy encrypted boot loader one given by our very own Allan Jude!
***</li>
</ul>

<h3><a href="http://blog.d2-si.fr/2016/02/15/openbsd-on-aws/?hn" rel="nofollow">OPENBSD ON AWS : AN UNEXPECTED JOURNEY</a></h3>

<ul>
<li>We have a blog post from Antoine Jacoutot, talking about the process of getting OpenBSD up and running in AWS</li>
<li><p>It starts with his process of creating an AMI from scratch, which ended up not being that bad:</p>

<ul>
<li>create and loopback-mount a raw image containing a UFS filesystem extract the OpenBSD base sets (which are just regular tarballs) and kernel enable console output (so that one could “aws ec2 get-console-output”)</li>
<li>install the boot loader on the image then use the ec2 tools to import the RAW image to S3, convert it into a volume (ec2-import-volume) which we can snapshot (ec2-create-snapshot) and create an AMI from (ec2-register)</li>
</ul></li>
<li><p>The blog post also has a link to a script which automates this process, so don’t be daunted if you didn’t quite follow all of that. </p></li>
<li><p>Thanks to the recently landed DomU support, the final pieces of the puzzle fell into place, allowing OpenBSD to function as a proper guest (with networking!)</p></li>
<li><p>Next it details the process of injecting a public SSH key into the instances for instant remote access. </p></li>
<li><p>An ec2-init.sh script was created (also on github) which does the following:</p>

<ul>
<li>setting the hostname</li>
<li>installing the provided SSH public key to /root/.ssh/authorized_keys</li>
<li>executing user-data (if it starts with a shebang)</li>
<li>displaying the host SSH fingerprints on the console (to match cloud-init)</li>
</ul></li>
<li><p>With that done, OpenBSD is pretty much AWS ready! He then gives a brief walkthrough of setting up nginx for new users, but if you’ve already done this before then the instance is ready for you to hacking on.</p>

<hr></li>
</ul>

<h3><a href="https://wiki.freebsd.org/SummerOfCodeIdeas" rel="nofollow">Start thinking of ideas for things with FreeBSD for Google&#39;s 2016 Summer of Code</a></h3>

<ul>
<li>Students and Developers, listen up! It’s time to start thinking about GSoC again, and FreeBSD is looking to update its project ideas page.</li>
<li>There’s some good ones on the list, plus ones that should be pruned (such as GELI boot), but now is the time to start adding new ones before we get too deep into the process.</li>
<li>This goes for the other BSD’s as well, start thinking about your proposals, or if you are developer, which projects would be a good fit for mentoring.</li>
<li>(Improving the Linux Compat layer is one I think should be done!)
<a href="https://wiki.freebsd.org/Graphics/Getting%20started%20with%20kernel%20projects" rel="nofollow">Guide to getting started with kernel hacking</a> </li>
<li>One of the things that’s been asked frequently is how to contribute towards the efforts to bring updated DRM / X drivers to the FreeBSD kernel. </li>
<li>Jean-Sébastien Pédron has started a great guide on the Wiki which details how to get started with the porting effort, and that developers need not be afraid of helping.
***</li>
</ul>

<h3>Storage Summit Roundup</h3>

<ul>
<li>Earlier this week a number of developers from FreeBSD, as well as various vendors that use FreeBSD, or provide products used with FreeBSD met for a <a href="https://wiki.freebsd.org/201602StorageSummit" rel="nofollow">Storage Summit</a>, to discuss the 
future of these technologies</li>
<li>The summit was co-located with the USENIX FAST (Filesystems And Storage Technologies) conference</li>
<li>The summit was sponsored by the FreeBSD Foundation and FlightAware</li>
<li>After a short introduction, the event opened with a Networking Synergy panel</li>
<li>The focus of this panel was to see if there were techniques and lessons learned in improving the networking stack over the last 10 years that could be applied to improving the storage stack</li>
<li>A lot of time was spent discussing issues like multi-queue support, CPU scheduling, and ways to modernize the stack</li>
<li><a href="https://wiki.freebsd.org/201602StorageSummit/CAM" rel="nofollow">CAM Scheduling &amp; Locking Revamp</a>

<ul>
<li>No notes posted</li>
</ul></li>
<li><a href="https://wiki.freebsd.org/201602StorageSummit/UserSpace" rel="nofollow">User Space Storage Stack</a>

<ul>
<li>One of the user space storage stacks discussed was Diskmap</li>
<li>Like netmap, but for disks (diskmap)</li>
<li>Kernel bypass for accessing disks</li>
<li>Ilias Marinos, who is working on diskmap at Cambridge University, described diskmap to the group</li>
</ul></li>
<li>A design discussion then followed in which the memory management was covered as that&#39;s an issue for any sort of &quot;IO&quot; map system

<ul>
<li>Action Items:</li>
</ul></li>
<li>Discuss with Luigi the idea of code merges</li>
<li>Need a reset path API</li>
<li>Kernel buffer mapping for reliability</li>
<li>Support for other interfaces (SATA/SCSI)</li>
<li>GEOM layer adaptation</li>
<li><a href="https://wiki.freebsd.org/201602StorageSummit/NewStorageTechnologies" rel="nofollow">Adapting to New Storage Technologies</a> 

<ul>
<li>This working group was led by Adrian Palmer, from Seagate</li>
<li>SMR</li>
<li>Persistent Memory</li>
<li>Session 1: Device Identification and the structural requirements

<ul>
<li>Agenda: We&#39;ll look over the Identification nuances and what needs to change to support the structure. Support for IO order guarantees, forward-write only requirements, new commands and topology. Dig into CAM and GEOM layers. Solutions should be fast and have as few code paths as possible</li>
<li>Results: Small audience. We talked about zoned characteristics, and how it can be used in various workloads, projected to be implemented in years</li>
</ul></li>
<li>Session 2: Information dissemination and consumption

<ul>
<li>Agenda: Where and how will information from the report_zones command be gathered, stored, combined and used. This will include userspace storage and multi-volume management. Will CAM store this data, or will GEOM? How frequently will this need to be queried/updated/verified from the drive?</li>
<li>Results: Merged with ZFS working group to discuss SMR. Came up with idea that could be implemented as circular buffer zone type. Began to discuss solutions among developers</li>
</ul></li>
</ul></li>
<li><a href="https://wiki.freebsd.org/201602StorageSummit/ZFS" rel="nofollow">ZFS</a> 

<ul>
<li>During the first session we discussed how to improve dedup support
    + A dedup throttle or cap was discussed. When the size of the DDT grows beyond this size, new entries would not be deduped.

<ul>
<li>An alternative to this was also discussed, where when the DDT reached the cap size, it would remove a random entry with only a single reference from the DDT to make room for the new entry. When a block is going to be freed, if it is not found in the DDT, it is assumed to have only 1 reference, and removed.</li>
<li>There was also discussion of replacing the DDT with an in-memory hash table and a “log” of increment/decrement operations, that is periodically compacted. The hash table is recreated from the log at pool import time. This would reduce the in-memory footprint of the DDT, as well as speed up all write operations as adding an entry to the dedup log will be less expensive than updating the DDT.</li>
<li>There was also discussion of using dedicated device(s) for the DDT, either using the DDT on SSD work by Nexenta, or the Metadata Classes work by Intel</li>
</ul></li>
<li>The first session also discussed Secure Delete and related things

<ul>
<li>The desire for an implementation of TRIM that uses the “secure erase” functionality provided by some disks was expressed</li>
<li>Overwriting sectors with patterns of garbage may be insufficient because SSDs may internally remap where a specific LBA physically resides</li>
<li>The possibility of using something like the “eager zero” feature to periodically write zeros over all free blocks in the pool to erase any lingering data fragments</li>
<li>Problems with the FreeBSD TRIM implementation were discussed, as well as looking at ways to implement the new ZFS TRIM implementation on FreeBSD</li>
<li>ABD (ARC Buf Data) was discussed, a new design that lessens the requirement for contiguous memory. Only a small area of contiguous blocks is reserved at boot, and compressed ARC blocks are constructed of scatter-gather lists of individual pages</li>
</ul></li>
<li>The second session combined with the SMR group and talked about SMR support in ZFS

<ul>
<li>Later in the second session ZFS Encryption was also discussed, mostly with a focus on what the use cases are</li>
</ul></li>
<li>The third session combined all of the groups for an overview of upcoming ZFS features including device removal and channel programs</li>
<li>There was also a request for code review, for mostly finished projects like Persistent L2ARC, Writeback cache, and Large dnode support</li>
</ul></li>
<li>Hallway Track

<ul>
<li>ZFS / VFS Interaction</li>
<li>Adrian Palmer has been a FreeBSD hobbyist since FreeBSD 7, and I think I managed to convince him to start contributing
***</li>
</ul></li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://jamesdeagle.blogspot.com/2016/02/one-week-with-netbsd-70-back-to-unix.html" rel="nofollow">One Week with NetBSD 7.0: Back to Unix basics</a></h3>

<ul>
<li>The author of this blog series is sending a week using NetBSD 7.0, following a previous series on Solaris 10</li>
<li>“This is actually familiar territory, as I&#39;ve been using BSD variants almost exclusively since 2006. My recent SunOS explorations were triggered last summer by OpenBSD having choked on my current laptop&#39;s NVIDIA card, and from what I could see at the time, FreeBSD had the same problem, although I now know NVIDIA drivers exist for that system. The thing that keeps me from going all-in with FreeBSD 10.x, however, is the fact that Firefox crashes and leaves &quot;core dump&quot; messages in its wake, and I&#39;m just not a Chrome kinda guy.”</li>
<li>“For those with a catholic taste in Unix, NetBSD is a keg party at the Vatican. If you&#39;re an absolute Unix beginner, or have been living on Ubuntu-based Linux distros for too long, then you may feel stranded at first by NetBSD&#39;s sparseness. You&#39;ll find yourself staring into the abyss and seeing only a blinking cursor staring back. If you have the presence of mind to type startx, you&#39;ll be greeted by twm, a window manager offering little more than an xterm window with the same blinking cursor until you learn how to configure the .twmrc file to include whatever applications you want or need in the right-click menu.”</li>
<li>“As for NetBSD itself, I can&#39;t think of any major productivity applications that can&#39;t be installed, and most multimedia stuff works fine.”</li>
<li>Issues the author hopes to sort out in later posts:

<ul>
<li>Audio playback (youtube videos in Firefox)</li>
<li>Wireless</li>
<li>Flash</li>
<li>Digital Camera SD Card readability, video playback</li>
<li>Audacity</li>
<li>A “fancy” desktop like Gnome 2, KDE, or xfce</li>
</ul></li>
<li>In a <a href="http://jamesdeagle.blogspot.com/2016/02/one-week-with-netbsd-70-libreoffice.html" rel="nofollow">follow-up post</a>, the author got LibreOffice installed and sorted out the audio issues they were having</li>
<li>In a <a href="http://jamesdeagle.blogspot.com/2016/02/one-week-with-netbsd-70-mixed-review-of.html" rel="nofollow">later follow-up</a> XFCE is up and running as well
***</li>
</ul>

<h3><a href="http://blog.dustinkirkland.com/2016/02/zfs-is-fs-for-containers-in-ubuntu-1604.html" rel="nofollow">ZFS is for Containers in Ubuntu 16.04</a></h3>

<ul>
<li>As you may have heard, Ubuntu 16.04 will include ZFS -- baked directly into Ubuntu -- supported by Canonical</li>
<li>“ZFS one of the most beloved features of Solaris, universally coveted by every Linux sysadmin with a Solaris background.  To our delight, we&#39;re happy to make to OpenZFS available on every Ubuntu system.”</li>
<li>What does “supported by Canonical” mean?</li>
<li>“You&#39;ll find zfs.ko automatically built and installed on your Ubuntu systems.  No more DKMS-built modules”</li>
<li>“The user space zfsutils-linux package will be included in Ubuntu Main, with security updates provided by Canonical”</li>
<li>The article then provides a quick tutorial for setting up Linux Containers (LXC) backed by ZFS</li>
<li>In the example, ZFS is backed by a file on the existing disk, not by a real disk, and with no redundancy</li>
<li>However, the setup script seems to support using real block devices</li>
<li>The <a href="https://sfconservancy.org/" rel="nofollow">Software Freedom Conservancy</a> is expected to issue a statement detailing their opinion on the legalities and licensing issues of bundling ZFS with Linux.
***</li>
</ul>

<h3><a href="http://hypatia.software/2016/01/29/polling-is-a-hack-server-sent-events-eventsource-with-gevent-flask-nginx-and-freebsd/" rel="nofollow">Polling is a Hack: Server Sent Events (EventSource) with gevent, Flask, nginx, and FreeBSD</a></h3>

<ul>
<li>A tutorial on setting up ‘Server-Sent Events’, also know as EventSource in javascript, to notify website clients of new data, rather than having the javascript constantly poll for new data.</li>
<li>The setup uses FreeBSD, nginx, gevent, Python, and the Flask framework</li>
<li>The tutorial walks through setting a basic Python application using the Flask framework</li>
<li>Then setting up the client side in Javascript</li>
<li>Then for the server side setup, it covers installing and configuring nginx, and py-supervisor on FreeBSD</li>
<li>The tutorial also includes links to additional resources and examples, including how to rate limit the Flash application
***</li>
</ul>

<h3><a href="http://www.aikchar.me/blog/why-freebsd.html" rel="nofollow">Why FreeBSD?</a></h3>

<ul>
<li>An excellent article written by Hamza Sheikh, discussing why FreeBSD is now his clear choice for learning UNIX.</li>
<li>The article is pretty well written and lengthy, but has some great parts which we wanted to share with you:</li>
</ul>

<p>There were many rough edges in the Linux world and some of them exist even today. Choosing the right distribution (distro) for the task at hand is always the first and most difficult decision to make. While this is a strength of the Linux community it is also its weakness. This is exacerbated with the toxic infighting within the community in the last few years.</p>

<p>A herd of voices believes it is their right to bring down a distro community because it is not like their distro of choice. Forking upstream projects has somehow become taboo. Hurling abuse in mailing lists is acceptable. Helping new users is limited to lambasting their distro of choice. Creating conspiracy theories over software decisions is the way to go. Copyleft zealots roam social media declaring non-copyleft free software heretic abominations. It all boils down to an ecosystem soured by the presence of maniacs who have the loudest voices and they seem to be everywhere you turn.</p>

<p>Where is the engineering among all this noise? Btrfs - baking for a long time - is still nowhere near ZFS in stability or feature parity. systemd is an insatiable entity that feeds on every idea in sight and just devours indiscriminately. Wayland was promised years ago and its time has yet to arrive. Containers are represented by Docker that neither securely contains applications nor makes them easy to manage in production. Firewalling is dithering between firewalld, nftables, etc. SystemTap cannot match DTrace.</p>

<p>In the same time span what do various BSDs offer? pf, CARP, ZFS, Hammer, OpenSSH, jails, pkgsrc, (software) ports, DTrace, hardware portability; just to name a few. Few would deny that BSDs have delivered great engineering with free software licenses to the entire world. To me they appear to be better flag bearers of free software with engineering to back it.</p>

<ul>
<li>He then goes through some of the various BSD’s and the specifics on why FreeBSD was the logical choice for his situation. But at the end has a great summary on the community as a whole:</li>
</ul>

<p>Finally - and maybe repeating myself here - I have nothing but praise for the community. Be it BSD Now, mailing lists, Reddit, Twitter, LFNW, or SeaGL, people have encouraged me, answered my questions, and filed bugs for me. I have been welcomed and made a part of the community with open arms. These reasons are (good) enough for me to use FreeBSD and contribute to it.</p>

<hr>

<h3>BeastieBits</h3>

<p><a href="https://opnsense.org/opnsense-16-1-3-released/" rel="nofollow">OPNsense 16.1.3 released</a></p>

<p><a href="https://twitter.com/Savagedlight/status/700001944547491842" rel="nofollow">Copies of &quot;FreeBSD Mastery: Specialty Filesystems&quot; seen in the wild</a> </p>

<p><a href="http://www.netgate.com/training/" rel="nofollow">pfsense training available in Europe</a> </p>

<p><a href="https://github.com/ibara/LiteBSD-Ports" rel="nofollow">LiteBSD now has 50 ports in its ports tree</a> </p>

<p><a href="http://marc.info/?l=openbsd-ports&m=145615281431064&w=2" rel="nofollow">Ports tree locked for OpenBSD 5.9</a></p>

<p><a href="http://blather.michaelwlucas.com/archives/2556" rel="nofollow">“FreeBSD Filesystem Fun” at March semibug</a></p>

<p><a href="http://oshug.org/event/46" rel="nofollow">Event #46 — Embedded Platforms (BSD, OpenWRT, Plan 9 &amp; Inferno)</a> </p>

<hr>

<h3>Feedback/Questions</h3>

<ul>
<li><a href="http://slexy.org/view/s21lcCKrSB" rel="nofollow">Frank - ZFS RAM?</a> </li>
<li><a href="http://slexy.org/view/s204lxjvlq" rel="nofollow">David - ARM Porting</a> </li>
<li><a href="http://slexy.org/view/s2xMiSNLYn" rel="nofollow"> Johnny - Lumina Default?</a> </li>
<li><a href="http://slexy.org/view/s214gJbLwD" rel="nofollow"> Adam - PC-BSD Install and Q’s</a> </li>
<li><a href="http://slexy.org/view/s20UNyzEeh" rel="nofollow"> Jeremy - Video Card Q</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>129: Synthesize all the Things!</title>
  <link>https://www.bsdnow.tv/129</link>
  <guid isPermaLink="false">22b2e499-6a84-4015-bb28-fa3a78fb831b</guid>
  <pubDate>Wed, 17 Feb 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/22b2e499-6a84-4015-bb28-fa3a78fb831b.mp3" length="74414164" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week, we will be talking to John Marino about his work on the ports-mgmt utility “Synth” and the cross-pollination between DragonFly and FreeBSD. That plus the latest news and your email here on</itunes:subtitle>
  <itunes:duration>1:43:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week, we will be talking to John Marino about his work on the ports-mgmt utility “Synth” and the cross-pollination between DragonFly and FreeBSD. That plus the latest news and your email here on
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
glibc and the BSDs  (https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/)
You have likely already heard about CVE-2015-7547  (https://access.redhat.com/security/cve/cve-2015-7547)
“A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, 
potentially, execute code with the permissions of the user running the library.”
“Note: this issue is only exposed when libresolv is called from the nss_dns NSS service module.”
More details from Google’s Online Security team blog  (https://googleonlinesecurity.blogspot.ca/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html) 
“Naturally, people have started asking whether FreeBSD is affected. The FreeBSD Security Officer has not yet released an official statement, but in the meantime, here is a brief look at the issue as far as FreeBSD is concerned.”
“First of all: neither FreeBSD itself nor native FreeBSD applications are affected. While the resolver in FreeBSD’s libc and GNU libc share a common parentage, the bug was introduced when the latter was rewritten to send A and AAAA queries in parallel rather than sequentially when the application requests both.”
The same most likely applies to the other BSDs
“However, Linux applications running under emulation on a FreeBSD system use the GNU libc and are therefore vulnerable unless patched.”
A patch to update emulation/linux_base-c6 has been prepared and should be committed soon
Running ‘pkg audit’ will list any known vulnerable packages installed on your system
“The issue can be mitigated by only using resolvers you trust, and configuring them to avoid sending responses which can trigger the bug.”
“If you already have your own resolvers, you can configure them to avoid sending UDP responses larger than 2048 bytes. If the response does not fit in 2048 bytes, the server will send a truncated response, and the client should retry using TCP. While a similar bug exists in the code path for TCP requests, I believe that it can only be exploited by a malicious resolver, and interposing your own resolver will protect affected Linux systems and applications.”
Dag-Erling’s blog post also includes instructions and configuration examples for locking down your resolver, or setting up your own resolver if you don’t have one already
***
OpenBSD Foundation - 2016 Fundraising Campaign (http://www.openbsdfoundation.org/campaign2016.html)
The OpenBSD foundation has announced their 2016 fundraising campaign, and set the goal of raising $250k for the year. 
While they mention that fundraising for 2015 didn’t hit 2014’s blockbuster numbers, it still exceeded the goal set, with an almost equal mix of corporate and community donors. 
‘Our goal for 2016 is to increase the amount of support we offer for development, without compromising our regular support for the projects. We would like to:
 Plan and support more developer events (hackathons), and allow for more developers to attend these events.
 Continue to improve the project infrastructure.
 Fund more dedicated developer time for targeted development of specific projects.‘
To give you an idea of how much OpenBSD technology is used around the world, they broke it down this way:
If $10 were given for every installation of OpenBSD in the last year from the master site (ignoring the mirrors) we would be at our goal.
If $2 were given for every download of the OpenSSH source code in the last year from the master site (ignoring the mirrors) we would be at our goal.
If a penny was donated for every pf or OpenSSH installed with a mainstream operating system or phone in the last year we would be at our goal.
Getting Started with ION-DTN 3.4.0 on FreeBSD (https://sgeos.github.io/freebsd/ion/dtn/2016/02/07/getting-started-with-ion-dtn-3-4-0-on-freebsd.html)
“The Interplanetary Overlay Network (ION) software distribution is an implementation of Delay-Tolerant Networking (DTN) architecture as described in Internet RFC 4838, suitable for use in spacecraft”
This tutorial covers setting up ION 3.4.0 on FreeBSD
The tutorial starts by downloading the ION software, and installing the relevant build tools
The instructions allow ION to be installed system-wide, or for a specific user
The each host is configured
Then pings are traded between the hosts to ensure everything works
Then a web page is served over the interplanetary network
Sadly I don’t have any hosts on other planets to test with.
The tutorial also includes a troubleshooting guide
***
Open Storage Issue – New BSD Mag is Out! (https://bsdmag.org/download/open_storage/)
The next issue of BSDMag (The Open Storage Issue) just landed which features an interview with Matt Olander of iXsystems. 
During the interview, Matt talks about the culture of support for open-source down at iX,  not only FreeNAS and PC-BSD, but the FreeBSD foundation, Slackware and more. 
He also gets to extol the virtues of the open-source development model itself, why it tends to lead to better code overall. 
In addition to the lead interview with Matt, this issue also features some other great interviews with Open Source storage vendors, and even some ZFS howto’s about setting up your ZIL devive
***
Interview - John Marino - marino@freebsd.org (mailto:marino@freebsd.org)
FreeNAS with FreeBSD as its base helped save taxpayers $36,000 for a small public school district (https://www.ixsystems.com/whats-new/2016/02/11/january-missioncomplete-best-story/) 
News Roundup
Getting Started With Tor Hidden Services on FreeBSD (https://sgeos.github.io/tor/freebsd/nc/curl/2016/02/06/getting-started-with-tor-hidden-services-on-freebsd.html)
Ever wondered how to setup and use a Tor hidden service? We have a walkthrough posted over on github.io which details how to do that on a FreeBSD -CURRENT system.
The basics are pretty simple, installing security/tor is the first step (although, he is using portmaster, you may wish to just ‘pkg install security/tor’)
The walkthrough provides an example server hosting just the date/time on port 8080, which you can use as an example and to verify it works, before serving anything real.
Once a local server is ready to serve something, the Tor setup is pretty quick, basically just two lines of config in torrc:
HiddenServiceDir /usr/home/tor/hidden_service/
HiddenServicePort 80 127.0.0.1:8080
After starting the service, the walkthrough will show you how to get the new hostname for this hidden service and verify its functionality. 
ZFS Remote Mirrors for Home Use (https://github.com/hughobrien/zfs-remote-mirror)
A recently updated tutorial on remotely mirroring your ZFS files
Using a spare old computer, or a SBC like a Raspberry Pi, and an (external) hard drive
It covers installing and configuring FreeBSD for both sides of the remote replication
The new appendix covers the creation of a Raspberry Pi image, although a prebuilt one is also provided
The setup uses GELI to ensure the data is encrypted at-rest
Updating and maintaining both systems is covered in detail
The article is very detailed, and covers pretty much every aspect of the setup, including suggestions on where to physically locate the remote system, and configuration tips to reduce the chance that local intervention will be required
Most importantly, it covers the disaster recovery steps. How to get your files back when bad things happen
***
Lumina Desktop 0.8.8 Released (http://lumina-desktop.org/lumina-desktop-0-8-8-released/)
PC-BSD’s very own Lumina desktop has issued a new release, 0.8.8
Notable in this release is support for NetBSD out of box, improvements to the start menu, and ability to change monitor resolutions in the X configuration tool. (Also the desktop font colors look better!)
0.8.8 is now available in PC-BSD via pkg, and FreeBSD ports/pkg system as well.
Lumina Desktop aims for v1.0 in July 2016 (http://fossforce.com/2016/02/lumina-desktop-getting-ready-freebsd-11-0/) 
We also have a blog post from Larry over at FossForce, highlighting that 1.0 of Lumina is still targeted for July(ish)
***
NetBSD on Google's Compute Engine (http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20160213_1951.html)
A NetBSD developer has gotten NetBSD running on Google Compute Engine, a service somewhat similar to Amazon’s EC2, and Microsoft’s Azure
Support is still being worked on, but I imagine it will land in NetBSD before too long
NetBSD on GCE dmesg  (http://dmesgd.nycbug.org/index.cgi?action=dmesgd&amp;amp;do=view&amp;amp;id=2900) 
OpenBSD on GCE  (http://marc.info/?l=openbsd-misc&amp;amp;m=138610199311393&amp;amp;w=2) 
FreeBSD on GCE  (https://github.com/swills/FreeBSD-gcloud) 
***
BeastieBits
htop 2.0 released - an interactive process viewer for Unix (including FreeBSD and OpenBSD) (http://hisham.hm/htop/) 
Full set of binary packages for 7.0 released for ARM v6 and v7 (hf) (http://mail-index.netbsd.org/port-arm/2016/01/31/msg003648.html) 
DragonFly 4.4.2 released (https://www.dragonflybsd.org/release44/) 
LibertyBSD 5.8 has been released (http://libertybsd.net/) 
Broadwell systems may want to take advantage of the patch by Imre Vadasz (http://lists.dragonflybsd.org/pipermail/commits/2016-January/459239.html) 
Finding the hard-to-spot bugs in FreeBSD  (http://www.viva64.com/en/b/0377/) 
Feedback/Questions
Johnny - The Daily Show (http://slexy.org/view/s21dwzoXRn) 
 Randy - Let it BSD (http://slexy.org/view/s2Hmmu5pUr) 
 Miguel - NullFS  (http://slexy.org/view/s20tOLsHHj) 
 Jaek - PC-BSD Hardware (http://slexy.org/view/s2N9wQ1n5X) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week, we will be talking to John Marino about his work on the ports-mgmt utility “Synth” and the cross-pollination between DragonFly and FreeBSD. That plus the latest news and your email here on</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/" rel="nofollow">glibc and the BSDs </a></h3>

<ul>
<li>You have likely already heard about <a href="https://access.redhat.com/security/cve/cve-2015-7547" rel="nofollow">CVE-2015-7547 </a></li>
<li>“A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, 
potentially, execute code with the permissions of the user running the library.”</li>
<li>“Note: this issue is only exposed when libresolv is called from the nss_dns NSS service module.”</li>
<li><a href="https://googleonlinesecurity.blogspot.ca/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html" rel="nofollow">More details from Google’s Online Security team blog </a> </li>
<li>“Naturally, people have started asking whether FreeBSD is affected. The FreeBSD Security Officer has not yet released an official statement, but in the meantime, here is a brief look at the issue as far as FreeBSD is concerned.”</li>
<li>“First of all: neither FreeBSD itself nor native FreeBSD applications are affected. While the resolver in FreeBSD’s libc and GNU libc share a common parentage, the bug was introduced when the latter was rewritten to send A and AAAA queries in parallel rather than sequentially when the application requests both.”</li>
<li>The same most likely applies to the other BSDs</li>
<li>“However, Linux applications running under emulation on a FreeBSD system use the GNU libc and are therefore vulnerable unless patched.”</li>
<li>A patch to update emulation/linux_base-c6 has been prepared and should be committed soon</li>
<li>Running ‘pkg audit’ will list any known vulnerable packages installed on your system</li>
<li>“The issue can be mitigated by only using resolvers you trust, and configuring them to avoid sending responses which can trigger the bug.”</li>
<li>“If you already have your own resolvers, you can configure them to avoid sending UDP responses larger than 2048 bytes. If the response does not fit in 2048 bytes, the server will send a truncated response, and the client should retry using TCP. While a similar bug exists in the code path for TCP requests, I believe that it can only be exploited by a malicious resolver, and interposing your own resolver will protect affected Linux systems and applications.”</li>
<li>Dag-Erling’s blog post also includes instructions and configuration examples for locking down your resolver, or setting up your own resolver if you don’t have one already
***</li>
</ul>

<h3><a href="http://www.openbsdfoundation.org/campaign2016.html" rel="nofollow">OpenBSD Foundation - 2016 Fundraising Campaign</a></h3>

<ul>
<li>The OpenBSD foundation has announced their 2016 fundraising campaign, and set the goal of raising $250k for the year. </li>
<li>While they mention that fundraising for 2015 didn’t hit 2014’s blockbuster numbers, it still exceeded the goal set, with an almost equal mix of corporate and community donors. </li>
</ul>

<p>‘Our goal for 2016 is to increase the amount of support we offer for development, without compromising our regular support for the projects. We would like to:<br>
 Plan and support more developer events (hackathons), and allow for more developers to attend these events.<br>
 Continue to improve the project infrastructure.<br>
 Fund more dedicated developer time for targeted development of specific projects.‘</p>

<ul>
<li>To give you an idea of how much OpenBSD technology is used around the world, they broke it down this way:</li>
</ul>

<p>If $10 were given for every installation of OpenBSD in the last year from the master site (ignoring the mirrors) we would be at our goal.<br>
If $2 were given for every download of the OpenSSH source code in the last year from the master site (ignoring the mirrors) we would be at our goal.<br>
If a penny was donated for every pf or OpenSSH installed with a mainstream operating system or phone in the last year we would be at our goal.</p>

<hr>

<h3><a href="https://sgeos.github.io/freebsd/ion/dtn/2016/02/07/getting-started-with-ion-dtn-3-4-0-on-freebsd.html" rel="nofollow">Getting Started with ION-DTN 3.4.0 on FreeBSD</a></h3>

<ul>
<li>“The Interplanetary Overlay Network (ION) software distribution is an implementation of Delay-Tolerant Networking (DTN) architecture as described in Internet RFC 4838, suitable for use in spacecraft”</li>
<li>This tutorial covers setting up ION 3.4.0 on FreeBSD</li>
<li>The tutorial starts by downloading the ION software, and installing the relevant build tools</li>
<li>The instructions allow ION to be installed system-wide, or for a specific user</li>
<li>The each host is configured</li>
<li>Then pings are traded between the hosts to ensure everything works</li>
<li>Then a web page is served over the interplanetary network</li>
<li>Sadly I don’t have any hosts on other planets to test with.</li>
<li>The tutorial also includes a troubleshooting guide
***</li>
</ul>

<h3><a href="https://bsdmag.org/download/open_storage/" rel="nofollow">Open Storage Issue – New BSD Mag is Out!</a></h3>

<ul>
<li>The next issue of BSDMag (The Open Storage Issue) just landed which features an interview with Matt Olander of iXsystems. </li>
<li>During the interview, Matt talks about the culture of support for open-source down at iX,  not only FreeNAS and PC-BSD, but the FreeBSD foundation, Slackware and more. </li>
<li>He also gets to extol the virtues of the open-source development model itself, why it tends to lead to better code overall. </li>
<li>In addition to the lead interview with Matt, this issue also features some other great interviews with Open Source storage vendors, and even some ZFS howto’s about setting up your ZIL devive
***</li>
</ul>

<h2>Interview - John Marino - <a href="mailto:marino@freebsd.org" rel="nofollow">marino@freebsd.org</a></h2>

<hr>

<p><a href="https://www.ixsystems.com/whats-new/2016/02/11/january-missioncomplete-best-story/" rel="nofollow">FreeNAS with FreeBSD as its base helped save taxpayers $36,000 for a small public school district</a> </p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://sgeos.github.io/tor/freebsd/nc/curl/2016/02/06/getting-started-with-tor-hidden-services-on-freebsd.html" rel="nofollow">Getting Started With Tor Hidden Services on FreeBSD</a></h3>

<ul>
<li>Ever wondered how to setup and use a Tor hidden service? We have a walkthrough posted over on github.io which details how to do that on a FreeBSD -CURRENT system.</li>
<li>The basics are pretty simple, installing security/tor is the first step (although, he is using portmaster, you may wish to just ‘pkg install security/tor’)</li>
<li>The walkthrough provides an example server hosting just the date/time on port 8080, which you can use as an example and to verify it works, before serving anything real.</li>
<li>Once a local server is ready to serve something, the Tor setup is pretty quick, basically just two lines of config in torrc:</li>
</ul>

<p>HiddenServiceDir /usr/home/tor/hidden_service/</p>

<p>HiddenServicePort 80 127.0.0.1:8080</p>

<ul>
<li>After starting the service, the walkthrough will show you how to get the new hostname for this hidden service and verify its functionality. </li>
</ul>

<hr>

<h3><a href="https://github.com/hughobrien/zfs-remote-mirror" rel="nofollow">ZFS Remote Mirrors for Home Use</a></h3>

<ul>
<li>A recently updated tutorial on remotely mirroring your ZFS files</li>
<li>Using a spare old computer, or a SBC like a Raspberry Pi, and an (external) hard drive</li>
<li>It covers installing and configuring FreeBSD for both sides of the remote replication</li>
<li>The new appendix covers the creation of a Raspberry Pi image, although a prebuilt one is also provided</li>
<li>The setup uses GELI to ensure the data is encrypted at-rest</li>
<li>Updating and maintaining both systems is covered in detail</li>
<li>The article is very detailed, and covers pretty much every aspect of the setup, including suggestions on where to physically locate the remote system, and configuration tips to reduce the chance that local intervention will be required</li>
<li>Most importantly, it covers the disaster recovery steps. How to get your files back when bad things happen
***</li>
</ul>

<h3><a href="http://lumina-desktop.org/lumina-desktop-0-8-8-released/" rel="nofollow">Lumina Desktop 0.8.8 Released</a></h3>

<ul>
<li>PC-BSD’s very own Lumina desktop has issued a new release, 0.8.8</li>
<li>Notable in this release is support for NetBSD out of box, improvements to the start menu, and ability to change monitor resolutions in the X configuration tool. (Also the desktop font colors look better!)</li>
<li>0.8.8 is now available in PC-BSD via pkg, and FreeBSD ports/pkg system as well.</li>
<li><a href="http://fossforce.com/2016/02/lumina-desktop-getting-ready-freebsd-11-0/" rel="nofollow">Lumina Desktop aims for v1.0 in July 2016</a> </li>
<li>We also have a blog post from Larry over at FossForce, highlighting that 1.0 of Lumina is still targeted for July(ish)
***</li>
</ul>

<h3><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20160213_1951.html" rel="nofollow">NetBSD on Google&#39;s Compute Engine</a></h3>

<ul>
<li>A NetBSD developer has gotten NetBSD running on Google Compute Engine, a service somewhat similar to Amazon’s EC2, and Microsoft’s Azure</li>
<li>Support is still being worked on, but I imagine it will land in NetBSD before too long</li>
<li><a href="http://dmesgd.nycbug.org/index.cgi?action=dmesgd&do=view&id=2900" rel="nofollow">NetBSD on GCE dmesg </a> </li>
<li><a href="http://marc.info/?l=openbsd-misc&m=138610199311393&w=2" rel="nofollow">OpenBSD on GCE </a> </li>
<li><a href="https://github.com/swills/FreeBSD-gcloud" rel="nofollow">FreeBSD on GCE </a> 
***</li>
</ul>

<h3>BeastieBits</h3>

<p><a href="http://hisham.hm/htop/" rel="nofollow">htop 2.0 released - an interactive process viewer for Unix (including FreeBSD and OpenBSD)</a> </p>

<p><a href="http://mail-index.netbsd.org/port-arm/2016/01/31/msg003648.html" rel="nofollow">Full set of binary packages for 7.0 released for ARM v6 and v7 (hf)</a> </p>

<p><a href="https://www.dragonflybsd.org/release44/" rel="nofollow">DragonFly 4.4.2 released</a> </p>

<p><a href="http://libertybsd.net/" rel="nofollow">LibertyBSD 5.8 has been released</a> </p>

<p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-January/459239.html" rel="nofollow">Broadwell systems may want to take advantage of the patch by Imre Vadasz</a> </p>

<p><a href="http://www.viva64.com/en/b/0377/" rel="nofollow">Finding the hard-to-spot bugs in FreeBSD </a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21dwzoXRn" rel="nofollow">Johnny - The Daily Show</a> </li>
<li><a href="http://slexy.org/view/s2Hmmu5pUr" rel="nofollow"> Randy - Let it BSD</a> </li>
<li><a href="http://slexy.org/view/s20tOLsHHj" rel="nofollow"> Miguel - NullFS </a> </li>
<li><a href="http://slexy.org/view/s2N9wQ1n5X" rel="nofollow"> Jaek - PC-BSD Hardware</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week, we will be talking to John Marino about his work on the ports-mgmt utility “Synth” and the cross-pollination between DragonFly and FreeBSD. That plus the latest news and your email here on</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/" rel="nofollow">glibc and the BSDs </a></h3>

<ul>
<li>You have likely already heard about <a href="https://access.redhat.com/security/cve/cve-2015-7547" rel="nofollow">CVE-2015-7547 </a></li>
<li>“A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, 
potentially, execute code with the permissions of the user running the library.”</li>
<li>“Note: this issue is only exposed when libresolv is called from the nss_dns NSS service module.”</li>
<li><a href="https://googleonlinesecurity.blogspot.ca/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html" rel="nofollow">More details from Google’s Online Security team blog </a> </li>
<li>“Naturally, people have started asking whether FreeBSD is affected. The FreeBSD Security Officer has not yet released an official statement, but in the meantime, here is a brief look at the issue as far as FreeBSD is concerned.”</li>
<li>“First of all: neither FreeBSD itself nor native FreeBSD applications are affected. While the resolver in FreeBSD’s libc and GNU libc share a common parentage, the bug was introduced when the latter was rewritten to send A and AAAA queries in parallel rather than sequentially when the application requests both.”</li>
<li>The same most likely applies to the other BSDs</li>
<li>“However, Linux applications running under emulation on a FreeBSD system use the GNU libc and are therefore vulnerable unless patched.”</li>
<li>A patch to update emulation/linux_base-c6 has been prepared and should be committed soon</li>
<li>Running ‘pkg audit’ will list any known vulnerable packages installed on your system</li>
<li>“The issue can be mitigated by only using resolvers you trust, and configuring them to avoid sending responses which can trigger the bug.”</li>
<li>“If you already have your own resolvers, you can configure them to avoid sending UDP responses larger than 2048 bytes. If the response does not fit in 2048 bytes, the server will send a truncated response, and the client should retry using TCP. While a similar bug exists in the code path for TCP requests, I believe that it can only be exploited by a malicious resolver, and interposing your own resolver will protect affected Linux systems and applications.”</li>
<li>Dag-Erling’s blog post also includes instructions and configuration examples for locking down your resolver, or setting up your own resolver if you don’t have one already
***</li>
</ul>

<h3><a href="http://www.openbsdfoundation.org/campaign2016.html" rel="nofollow">OpenBSD Foundation - 2016 Fundraising Campaign</a></h3>

<ul>
<li>The OpenBSD foundation has announced their 2016 fundraising campaign, and set the goal of raising $250k for the year. </li>
<li>While they mention that fundraising for 2015 didn’t hit 2014’s blockbuster numbers, it still exceeded the goal set, with an almost equal mix of corporate and community donors. </li>
</ul>

<p>‘Our goal for 2016 is to increase the amount of support we offer for development, without compromising our regular support for the projects. We would like to:<br>
 Plan and support more developer events (hackathons), and allow for more developers to attend these events.<br>
 Continue to improve the project infrastructure.<br>
 Fund more dedicated developer time for targeted development of specific projects.‘</p>

<ul>
<li>To give you an idea of how much OpenBSD technology is used around the world, they broke it down this way:</li>
</ul>

<p>If $10 were given for every installation of OpenBSD in the last year from the master site (ignoring the mirrors) we would be at our goal.<br>
If $2 were given for every download of the OpenSSH source code in the last year from the master site (ignoring the mirrors) we would be at our goal.<br>
If a penny was donated for every pf or OpenSSH installed with a mainstream operating system or phone in the last year we would be at our goal.</p>

<hr>

<h3><a href="https://sgeos.github.io/freebsd/ion/dtn/2016/02/07/getting-started-with-ion-dtn-3-4-0-on-freebsd.html" rel="nofollow">Getting Started with ION-DTN 3.4.0 on FreeBSD</a></h3>

<ul>
<li>“The Interplanetary Overlay Network (ION) software distribution is an implementation of Delay-Tolerant Networking (DTN) architecture as described in Internet RFC 4838, suitable for use in spacecraft”</li>
<li>This tutorial covers setting up ION 3.4.0 on FreeBSD</li>
<li>The tutorial starts by downloading the ION software, and installing the relevant build tools</li>
<li>The instructions allow ION to be installed system-wide, or for a specific user</li>
<li>The each host is configured</li>
<li>Then pings are traded between the hosts to ensure everything works</li>
<li>Then a web page is served over the interplanetary network</li>
<li>Sadly I don’t have any hosts on other planets to test with.</li>
<li>The tutorial also includes a troubleshooting guide
***</li>
</ul>

<h3><a href="https://bsdmag.org/download/open_storage/" rel="nofollow">Open Storage Issue – New BSD Mag is Out!</a></h3>

<ul>
<li>The next issue of BSDMag (The Open Storage Issue) just landed which features an interview with Matt Olander of iXsystems. </li>
<li>During the interview, Matt talks about the culture of support for open-source down at iX,  not only FreeNAS and PC-BSD, but the FreeBSD foundation, Slackware and more. </li>
<li>He also gets to extol the virtues of the open-source development model itself, why it tends to lead to better code overall. </li>
<li>In addition to the lead interview with Matt, this issue also features some other great interviews with Open Source storage vendors, and even some ZFS howto’s about setting up your ZIL devive
***</li>
</ul>

<h2>Interview - John Marino - <a href="mailto:marino@freebsd.org" rel="nofollow">marino@freebsd.org</a></h2>

<hr>

<p><a href="https://www.ixsystems.com/whats-new/2016/02/11/january-missioncomplete-best-story/" rel="nofollow">FreeNAS with FreeBSD as its base helped save taxpayers $36,000 for a small public school district</a> </p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://sgeos.github.io/tor/freebsd/nc/curl/2016/02/06/getting-started-with-tor-hidden-services-on-freebsd.html" rel="nofollow">Getting Started With Tor Hidden Services on FreeBSD</a></h3>

<ul>
<li>Ever wondered how to setup and use a Tor hidden service? We have a walkthrough posted over on github.io which details how to do that on a FreeBSD -CURRENT system.</li>
<li>The basics are pretty simple, installing security/tor is the first step (although, he is using portmaster, you may wish to just ‘pkg install security/tor’)</li>
<li>The walkthrough provides an example server hosting just the date/time on port 8080, which you can use as an example and to verify it works, before serving anything real.</li>
<li>Once a local server is ready to serve something, the Tor setup is pretty quick, basically just two lines of config in torrc:</li>
</ul>

<p>HiddenServiceDir /usr/home/tor/hidden_service/</p>

<p>HiddenServicePort 80 127.0.0.1:8080</p>

<ul>
<li>After starting the service, the walkthrough will show you how to get the new hostname for this hidden service and verify its functionality. </li>
</ul>

<hr>

<h3><a href="https://github.com/hughobrien/zfs-remote-mirror" rel="nofollow">ZFS Remote Mirrors for Home Use</a></h3>

<ul>
<li>A recently updated tutorial on remotely mirroring your ZFS files</li>
<li>Using a spare old computer, or a SBC like a Raspberry Pi, and an (external) hard drive</li>
<li>It covers installing and configuring FreeBSD for both sides of the remote replication</li>
<li>The new appendix covers the creation of a Raspberry Pi image, although a prebuilt one is also provided</li>
<li>The setup uses GELI to ensure the data is encrypted at-rest</li>
<li>Updating and maintaining both systems is covered in detail</li>
<li>The article is very detailed, and covers pretty much every aspect of the setup, including suggestions on where to physically locate the remote system, and configuration tips to reduce the chance that local intervention will be required</li>
<li>Most importantly, it covers the disaster recovery steps. How to get your files back when bad things happen
***</li>
</ul>

<h3><a href="http://lumina-desktop.org/lumina-desktop-0-8-8-released/" rel="nofollow">Lumina Desktop 0.8.8 Released</a></h3>

<ul>
<li>PC-BSD’s very own Lumina desktop has issued a new release, 0.8.8</li>
<li>Notable in this release is support for NetBSD out of box, improvements to the start menu, and ability to change monitor resolutions in the X configuration tool. (Also the desktop font colors look better!)</li>
<li>0.8.8 is now available in PC-BSD via pkg, and FreeBSD ports/pkg system as well.</li>
<li><a href="http://fossforce.com/2016/02/lumina-desktop-getting-ready-freebsd-11-0/" rel="nofollow">Lumina Desktop aims for v1.0 in July 2016</a> </li>
<li>We also have a blog post from Larry over at FossForce, highlighting that 1.0 of Lumina is still targeted for July(ish)
***</li>
</ul>

<h3><a href="http://www.feyrer.de/NetBSD/bx/blosxom.cgi/nb_20160213_1951.html" rel="nofollow">NetBSD on Google&#39;s Compute Engine</a></h3>

<ul>
<li>A NetBSD developer has gotten NetBSD running on Google Compute Engine, a service somewhat similar to Amazon’s EC2, and Microsoft’s Azure</li>
<li>Support is still being worked on, but I imagine it will land in NetBSD before too long</li>
<li><a href="http://dmesgd.nycbug.org/index.cgi?action=dmesgd&do=view&id=2900" rel="nofollow">NetBSD on GCE dmesg </a> </li>
<li><a href="http://marc.info/?l=openbsd-misc&m=138610199311393&w=2" rel="nofollow">OpenBSD on GCE </a> </li>
<li><a href="https://github.com/swills/FreeBSD-gcloud" rel="nofollow">FreeBSD on GCE </a> 
***</li>
</ul>

<h3>BeastieBits</h3>

<p><a href="http://hisham.hm/htop/" rel="nofollow">htop 2.0 released - an interactive process viewer for Unix (including FreeBSD and OpenBSD)</a> </p>

<p><a href="http://mail-index.netbsd.org/port-arm/2016/01/31/msg003648.html" rel="nofollow">Full set of binary packages for 7.0 released for ARM v6 and v7 (hf)</a> </p>

<p><a href="https://www.dragonflybsd.org/release44/" rel="nofollow">DragonFly 4.4.2 released</a> </p>

<p><a href="http://libertybsd.net/" rel="nofollow">LibertyBSD 5.8 has been released</a> </p>

<p><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-January/459239.html" rel="nofollow">Broadwell systems may want to take advantage of the patch by Imre Vadasz</a> </p>

<p><a href="http://www.viva64.com/en/b/0377/" rel="nofollow">Finding the hard-to-spot bugs in FreeBSD </a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21dwzoXRn" rel="nofollow">Johnny - The Daily Show</a> </li>
<li><a href="http://slexy.org/view/s2Hmmu5pUr" rel="nofollow"> Randy - Let it BSD</a> </li>
<li><a href="http://slexy.org/view/s20tOLsHHj" rel="nofollow"> Miguel - NullFS </a> </li>
<li><a href="http://slexy.org/view/s2N9wQ1n5X" rel="nofollow"> Jaek - PC-BSD Hardware</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>128: The State of BSD</title>
  <link>https://www.bsdnow.tv/128</link>
  <guid isPermaLink="false">562ad286-1548-407d-b0d4-4c26b3d1a69f</guid>
  <pubDate>Wed, 10 Feb 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/562ad286-1548-407d-b0d4-4c26b3d1a69f.mp3" length="64978420" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we interview Nick Wolff about how FreeBSD is used across the State of Ohio and some of the specific technology used. That, plus the latest news is coming your way right now on BSDNow, the place to</itunes:subtitle>
  <itunes:duration>1:30:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we interview Nick Wolff about how FreeBSD is used across the State of Ohio and some of the specific technology used. That, plus the latest news is coming your way right now on BSDNow, the place to
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Doc like an Egyptian: Managing project documentation with Sphinx (https://opensource.com/business/16/1/scale-14x-interview-dru-lavigne)
In case you didn’t make it out to SCALE a few weeks back, we have a great interview with Dru Lavigne over at OpenSource.com which goes over her talk on “Doc like an Egyptian”. 
In particular she discusses the challenges of running a wiki for documentation for PC-BSD and FreeNAS which prompted the shift to using Sphinx instead.
“While the main purpose of a wiki is to invite user contributions and to provide a low barrier to entry, very few people come to write documentation (however, every spambot on the planet will quickly find your wiki, which creates its own set of maintenance issues).
Wikis are designed for separate, one-ish page infobytes, such as how-tos. They really aren't designed to provide navigation in a Table of Contents or to provide a flow of Chapters, though you can hack your pages to provide navigational elements to match the document's flow. This gets more difficult as the document increases in size—our guides tend to be 300+ pages. It becomes a nightmare as you try to provide versioned copies of each of those pages so that the user is finding and reading the right page for their version of software.
While wiki translation extensions are available, how to configure them is not well documented, their use is slow and clunky, and translated pages only increase the number of available pages, getting you back to the problems in the previous bullet. This is a big deal for projects that have a global audience.
While output-generation wiki extensions are available (for example, to convert your wiki pages to HTML or PDF), how to configure them is not well documented, and they provide very little control for the layout of the generated format. This is a big deal for projects that need to make their documentation available in multiple formats.“
She then discusses some of the hurdles of migration from the Wiki to Sphinx, and follows up with some of the differences using Sphinx you should be aware of for any documentation project.
“While Sphinx is easy to learn, it does have its quirks. For example, it does not support stacked tags. This means, for example, you can not bold italic a phrase using tags—to achieve that requires a CSS workaround. And, while Sphinx does have extensive documentation, a lot of it assumes you already know what you are doing. When you don't, it can be difficult to find an example that does what you are trying to achieve.
Sphinx is well suited for projects with an existing repository—say, on github—a build infrastructure, and contributors who are comfortable with using text editors and committing to the repo (or creating, say, git pull requests).“
Initial FreeBSD RISC-V Architecture Port Committed. (http://freebsdfoundation.blogspot.com/2016/02/initial-freebsd-risc-v-architecture.html)
Touching on a story we mentioned a few weeks back, we have a blog post from from Annie over at the FreeBSD foundation talking about the details behind the initial support for RISC-V.
To start us off, you may be wondering what is RISC-V and what makes it special?RISC-V is an exciting new open-source Instruction-Set Architecture (ISA) developed at the University of California at Berkeley, which is seeing increasing interest in the embedded systems and hardware-software research communities.
Currently the improvements allows booting FreeBSD in the Spike simulator, from the university of Berkeley, with enough reliability to do various things, such as SSH, shell, mail, etc.
The next steps include getting multi-core support working, and getting  it working in simulations of Cambridge’s open-source LowRISC System-on-Chip functioning, and ready for early hardware.
Both ports and packages are expected to land in the coming days, so if you love hacking on branch new architectures, this may be your time to jump in.
***
FreeBSD Bhyve hypervisor supporting Windows UEFI guests  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=295124)
If you have not been following bhyve lately, you’re in for a treat when FreeBSD 10.3 ships in the coming weeks
bhyve now supports UEFI and CSM booting, in addition to its existing FreeBSD userboot loader, and grub-bhyve port
The EFI support allows Windows guests to be run on FreeBSD
Due to the lack of graphics, this requires making a custom .iso to do an ‘Unattended Install’ of Windows, but this is easily done just editing and including a .xml file
The bootrom can now allocate memory
Added some SATA command emulations (no-op)
Increased the number of virtio-blk indirect descriptors
Added a Firmware guest query interface
Add -l option to specify userboot path
FreeBSD Bhyve Hypervisor Running Windows Server 2012 R2 Standard (https://jameslodge.com/freebsd-bhyve-hypervisor-running-windows-server-2012-r2-standard/) 
In related news, TidalScale officially released their product today  (http://www.prnewswire.com/news-releases/tidalscale-releases-its-system-scaling-hyperkernel-300216105.html) 
TidalScale is a commercial product based on bhyve that allows multiple physical machines to be combined into a single massive virtual machine, with the combined processor power, memory, disk I/O, and network capacity of all of the machines
***
FreeBSD TACACS+ GNS3 and Cisco 3700 Router (http://www.unixmen.com/freebsd-tacacs-gns3-and-cisco-3700-router/)
“TACACS+ – (Terminal Access Controller Access Control System plus) — is a session protocol developed by Cisco.”
This tutorial covers configuring FreeBSD and the tac_plus4 port to act as an authentication, authorization, and accounting server for Cisco routers
The configuration of FreeBSD, the software, and the router are covered
It also includes how to set the FreeBSD server up as a VM on windows, and bridge it to the network
I am sure there are some network administrators out there that would appreciate this
***
Interview - Nick Wolff - darkfiberiru@gmail.com (mailto:darkfiberiru@gmail.com) / @darkfiberiru (https://twitter.com/darkfiberiru)
News Roundup
Papers We Love Presents : Bryan Cantrill on Jails &amp;amp; Solaris Zones (http://lists.nycbug.org/pipermail/talk/2016-February/016495.html)
The folks over at NYCBug point us to “Papers We Love”, a New York based meetup group where past papers are presented. They have a talk scheduled for tomorrow (Feb 11th) with Bryan Cantrill discussing Jails and Solaris Zones
The talk starts at 7PM at the Tumblr building, located between 5th and Park Ave South on 21st street
“We're crazy excited to have Bryan Cantrill, CTO of Joyent, formerly of Sun Microsystems, presenting on Jails: Confining the omnipotent root (https://us-east.manta.joyent.com/bcantrill/public/ppwl-cantrill-jails.pdf). 
by Poul-Henning Kamp and Robert Watson and Solaris Zones: Operating System Support for Consolidating Commercial Workloads (https://us-east.manta.joyent.com/bcantrill/public/ppwl-cantrill-zones.pdf) by Dan Price and Andy Tucker!”
The abstract posted gives us a sneak peak of what to expect, first covering jails as a method to “partition” the operating system environment, but maintaining the UNIX “root” model.
Next it looks like he will compare and contrast with the Solaris Zones functionality, which creates virtualized application execution environments, within the single OS instance.
Sounds like a fantastic talk, hopefully somebody remembers to record and post it for us to enjoy later!
There will not be a live stream, but a video of the event should appear online after it has been edited
***
FreeBSD Storage Summit (https://wiki.freebsd.org/201602StorageSummit)
The FreeBSD Foundation will be hosting a Storage Summit, co-located at the USENIX FAST (Filesystems And Storage Technology) conference
Developers and Vendors are invited to work on storage related issues
This summit will be a hackathon focused event, rather than a discussion focused devsummit
After setup and introductions, the summit will start with a “Networking Synergies Panel”, to discuss networking as it relates to storage
After a short break, the attendees will break up into a number of working groups focused on solving actual problems
The current working groups include:
CAM Scheduling &amp;amp; Locking, led by Justin Gibbs: “Updating CAM queuing/scheduling and locking models to minimize cross-cpu contention and support multi-queue controllers”
ZFS, led by Matt Ahrens: topics will include enabling the new cryptographic hashes supported by OpenZFS on FreeBSD, Interaction with the kernel memory subsystem, and other upcoming features.
User Space Storage Stack, led by George Neville-Neil
This event offers a unique opportunity for developers and vendors from the storage industry to meet at an event they will likely already be attending
***
Tor Browser 5.5 for OpenBSD/amd64 -current is completed (http://lists.nycbug.org/pipermail/talk/2016-February/016514.html)
“The Tor BSD Diversity Project (TDP) is proud to announce the release of Tor Browser (TB) version 5.5 for OpenBSD. Please note that this version of TB remains in development mode, and is not meant to ensure strong privacy, anonymity or security.”
“TDP (https://torbsd.github.io) is an effort to extend the use of the BSD Unixes into the Tor ecosystem, from the desktop to the network. TDP is focused on diversifying the Tor network, with TB being the flagship project. 
Additional efforts are made to increase the number of *BSD relays on the Tor network among other sub-projects”
Help test the new browser bundle, or help diversify the Tor network
***
“FreeBSD Mastery: Advanced ZFS” Table of Contents (http://blather.michaelwlucas.com/archives/2548)
We brought you the news about sponsoring the Advanced ZFS book that MWL is working on, now Michael has given us the tentative chapter layout of the (sure to be a classic) tome coming from him and Allan.
0: Introduction
1: Boot Environments
2: Delegation and Jails
3: Sharing
4: Replication
5: zvols
6: Advanced Hardware
7: Caches
8: Performance
9: Tuning
10: ZFS Potpourri
In addition to the tease about the upcoming book, michael has asked the community for assistance in coming up with the cover art for it as well. 
In particular it should probably be in-line with his previous works, with a parody of some other classic art-work. 
If you have something, go tweet out to him at @mwlauthor
Beastie Bits
Online registration for AsiaBSDCon 2016 now open SOON (https://2016.asiabsdcon.org/index.html.en)
BhyveCon 2016 (http://bhyvecon.org/) 
NYC*BUG shell-fu talk slides (http://www.nycbug.org/index.cgi?action=view&amp;amp;id=10640)
Possible regression in DragonFly i915 graphics on older Core2Duos  (http://lists.dragonflybsd.org/pipermail/users/2016-February/228597.html) 
Videos from FOSDEM 2016. BSD dev room was k4601 (http://video.fosdem.org/2016/) 
Feedback/Questions
 Andrew - SMART Tests (http://slexy.org/view/s2F39XEu9w) 
 JT - Secure File Delete (http://slexy.org/view/s20kk6lzc9) 
 Jordan - Migrate (http://slexy.org/view/s21zjZ0ci8) 
 Lars - Pros and Cons of VM (http://slexy.org/view/s2Hqbt0Uq8) 
 Alex - IPSEC (http://slexy.org/view/s2HnO1hxSO) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we interview Nick Wolff about how FreeBSD is used across the State of Ohio and some of the specific technology used. That, plus the latest news is coming your way right now on BSDNow, the place to</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" <br>
title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://opensource.com/business/16/1/scale-14x-interview-dru-lavigne" rel="nofollow">Doc like an Egyptian: Managing project documentation with Sphinx</a></h3>

<ul>
<li>In case you didn’t make it out to SCALE a few weeks back, we have a great interview with Dru Lavigne over at OpenSource.com which goes over her talk on “Doc like an Egyptian”. </li>
<li>In particular she discusses the challenges of running a wiki for documentation for PC-BSD and FreeNAS which prompted the shift to using Sphinx instead.</li>
</ul>

<blockquote>
<p>“While the main purpose of a wiki is to invite user contributions and to provide a low barrier to entry, very few people come to write documentation (however, every spambot on the planet will quickly find your wiki, which creates its own set of maintenance issues).</p>

<p>Wikis are designed for separate, one-ish page infobytes, such as how-tos. They really aren&#39;t designed to provide navigation in a Table of Contents or to provide a flow of Chapters, though you can hack your pages to provide navigational elements to match the document&#39;s flow. This gets more difficult as the document increases in size—our guides tend to be 300+ pages. It becomes a nightmare as you try to provide versioned copies of each of those pages so that the user is finding and reading the right page for their version of software.</p>

<p>While wiki translation extensions are available, how to configure them is not well documented, their use is slow and clunky, and translated pages only increase the number of available pages, getting you back to the problems in the previous bullet. This is a big deal for projects that have a global audience.</p>

<p>While output-generation wiki extensions are available (for example, to convert your wiki pages to HTML or PDF), how to configure them is not well documented, and they provide very little control for the layout of the generated format. This is a big deal for projects that need to make their documentation available in multiple formats.“</p>
</blockquote>

<ul>
<li>She then discusses some of the hurdles of migration from the Wiki to Sphinx, and follows up with some of the differences using Sphinx you should be aware of for any documentation project.</li>
</ul>

<blockquote>
<p>“While Sphinx is easy to learn, it does have its quirks. For example, it does not support stacked tags. This means, for example, you can not bold italic a phrase using tags—to achieve that requires a CSS workaround. And, while Sphinx does have extensive documentation, a lot of it assumes you already know what you are doing. When you don&#39;t, it can be difficult to find an example that does what you are trying to achieve.</p>

<p>Sphinx is well suited for projects with an existing repository—say, on github—a build infrastructure, and contributors who are comfortable with using text editors and committing to the repo (or creating, say, git pull requests).“</p>
</blockquote>

<hr>

<h3><a href="http://freebsdfoundation.blogspot.com/2016/02/initial-freebsd-risc-v-architecture.html" rel="nofollow">Initial FreeBSD RISC-V Architecture Port Committed.</a></h3>

<ul>
<li>Touching on a story we mentioned a few weeks back, we have a blog post from from Annie over at the FreeBSD foundation talking about the details behind the initial support for RISC-V.</li>
<li>To start us off, you may be wondering what is RISC-V and what makes it special?RISC-V is an exciting new open-source Instruction-Set Architecture (ISA) developed at the University of California at Berkeley, which is seeing increasing interest in the embedded systems and hardware-software research communities.</li>
<li>Currently the improvements allows booting FreeBSD in the Spike simulator, from the university of Berkeley, with enough reliability to do various things, such as SSH, shell, mail, etc.</li>
<li>The next steps include getting multi-core support working, and getting  it working in simulations of Cambridge’s open-source LowRISC System-on-Chip functioning, and ready for early hardware.</li>
<li>Both ports and packages are expected to land in the coming days, so if you love hacking on branch new architectures, this may be your time to jump in.
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=295124" rel="nofollow">FreeBSD Bhyve hypervisor supporting Windows UEFI guests </a></h3>

<ul>
<li>If you have not been following bhyve lately, you’re in for a treat when FreeBSD 10.3 ships in the coming weeks</li>
<li>bhyve now supports UEFI and CSM booting, in addition to its existing FreeBSD userboot loader, and grub-bhyve port</li>
<li>The EFI support allows Windows guests to be run on FreeBSD</li>
<li>Due to the lack of graphics, this requires making a custom .iso to do an ‘Unattended Install’ of Windows, but this is easily done just editing and including a .xml file</li>
<li>The bootrom can now allocate memory</li>
<li>Added some SATA command emulations (no-op)</li>
<li>Increased the number of virtio-blk indirect descriptors</li>
<li>Added a Firmware guest query interface</li>
<li>Add -l option to specify userboot path
<a href="https://jameslodge.com/freebsd-bhyve-hypervisor-running-windows-server-2012-r2-standard/" rel="nofollow">FreeBSD Bhyve Hypervisor Running Windows Server 2012 R2 Standard</a> </li>
<li>In related news, <a href="http://www.prnewswire.com/news-releases/tidalscale-releases-its-system-scaling-hyperkernel-300216105.html" rel="nofollow">TidalScale officially released their product today </a> </li>
<li>TidalScale is a commercial product based on bhyve that allows multiple physical machines to be combined into a single massive virtual machine, with the combined processor power, memory, disk I/O, and network capacity of all of the machines
***</li>
</ul>

<h3><a href="http://www.unixmen.com/freebsd-tacacs-gns3-and-cisco-3700-router/" rel="nofollow">FreeBSD TACACS+ GNS3 and Cisco 3700 Router</a></h3>

<ul>
<li>“TACACS+ – (Terminal Access Controller Access Control System plus) — is a session protocol developed by Cisco.”</li>
<li>This tutorial covers configuring FreeBSD and the tac_plus4 port to act as an authentication, authorization, and accounting server for Cisco routers</li>
<li>The configuration of FreeBSD, the software, and the router are covered</li>
<li>It also includes how to set the FreeBSD server up as a VM on windows, and bridge it to the network</li>
<li>I am sure there are some network administrators out there that would appreciate this
***</li>
</ul>

<h2>Interview - Nick Wolff - <a href="mailto:darkfiberiru@gmail.com" rel="nofollow">darkfiberiru@gmail.com</a> / <a href="https://twitter.com/darkfiberiru" rel="nofollow">@darkfiberiru</a></h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2016-February/016495.html" rel="nofollow">Papers We Love Presents : Bryan Cantrill on Jails &amp; Solaris Zones</a></h3>

<ul>
<li>The folks over at NYCBug point us to “Papers We Love”, a New York based meetup group where past papers are presented. They have a talk scheduled for tomorrow (Feb 11th) with Bryan Cantrill discussing Jails and Solaris Zones</li>
<li>The talk starts at 7PM at the Tumblr building, located between 5th and Park Ave South on 21st street</li>
<li>“We&#39;re <strong>crazy</strong> excited to have Bryan Cantrill, CTO of Joyent, formerly of Sun Microsystems, presenting on <a href="https://us-east.manta.joyent.com/bcantrill/public/ppwl-cantrill-jails.pdf" rel="nofollow">Jails: Confining the omnipotent root</a>. 
by Poul-Henning Kamp and Robert Watson and <a href="https://us-east.manta.joyent.com/bcantrill/public/ppwl-cantrill-zones.pdf" rel="nofollow">Solaris Zones: Operating System Support for Consolidating Commercial Workloads</a> by Dan Price and Andy Tucker!”</li>
<li>The abstract posted gives us a sneak peak of what to expect, first covering jails as a method to “partition” the operating system environment, but maintaining the UNIX “root” model.</li>
<li>Next it looks like he will compare and contrast with the Solaris Zones functionality, which creates virtualized application execution environments, within the single OS instance.</li>
<li>Sounds like a fantastic talk, hopefully somebody remembers to record and post it for us to enjoy later!</li>
<li>There will not be a live stream, but a video of the event should appear online after it has been edited
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/201602StorageSummit" rel="nofollow">FreeBSD Storage Summit</a></h3>

<ul>
<li>The FreeBSD Foundation will be hosting a Storage Summit, co-located at the USENIX FAST (Filesystems And Storage Technology) conference</li>
<li>Developers and Vendors are invited to work on storage related issues</li>
<li>This summit will be a hackathon focused event, rather than a discussion focused devsummit</li>
<li>After setup and introductions, the summit will start with a “Networking Synergies Panel”, to discuss networking as it relates to storage</li>
<li>After a short break, the attendees will break up into a number of working groups focused on solving actual problems</li>
<li>The current working groups include:</li>
<li>CAM Scheduling &amp; Locking, led by Justin Gibbs: “Updating CAM queuing/scheduling and locking models to minimize cross-cpu contention and support multi-queue controllers”</li>
<li>ZFS, led by Matt Ahrens: topics will include enabling the new cryptographic hashes supported by OpenZFS on FreeBSD, Interaction with the kernel memory subsystem, and other upcoming features.</li>
<li>User Space Storage Stack, led by George Neville-Neil</li>
<li>This event offers a unique opportunity for developers and vendors from the storage industry to meet at an event they will likely already be attending
***</li>
</ul>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2016-February/016514.html" rel="nofollow">Tor Browser 5.5 for OpenBSD/amd64 -current is completed</a></h3>

<ul>
<li>“The Tor BSD Diversity Project (TDP) is proud to announce the release of Tor Browser (TB) version 5.5 for OpenBSD. Please note that this version of TB remains in development mode, and is not meant to ensure strong privacy, anonymity or security.”</li>
<li>“TDP (<a href="https://torbsd.github.io" rel="nofollow">https://torbsd.github.io</a>) is an effort to extend the use of the BSD Unixes into the Tor ecosystem, from the desktop to the network. TDP is focused on diversifying the Tor network, with TB being the flagship project. 
Additional efforts are made to increase the number of *BSD relays on the Tor network among other sub-projects”</li>
<li>Help test the new browser bundle, or help diversify the Tor network
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/2548" rel="nofollow">“FreeBSD Mastery: Advanced ZFS” Table of Contents</a></h3>

<ul>
<li><p>We brought you the news about sponsoring the Advanced ZFS book that MWL is working on, now Michael has given us the tentative chapter layout of the (sure to be a classic) tome coming from him and Allan.</p>

<ul>
<li>0: Introduction</li>
<li>1: Boot Environments</li>
<li>2: Delegation and Jails</li>
<li>3: Sharing</li>
<li>4: Replication</li>
<li>5: zvols</li>
<li>6: Advanced Hardware</li>
<li>7: Caches</li>
<li>8: Performance</li>
<li>9: Tuning</li>
<li>10: ZFS Potpourri</li>
</ul></li>
<li><p>In addition to the tease about the upcoming book, michael has asked the community for assistance in coming up with the cover art for it as well. </p></li>
<li><p>In particular it should probably be in-line with his previous works, with a parody of some other classic art-work. </p></li>
<li><p>If you have something, go tweet out to him at @mwlauthor</p>

<hr></li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="https://2016.asiabsdcon.org/index.html.en" rel="nofollow">Online registration for AsiaBSDCon 2016 now open <em>SOON</em></a></p></li>
<li><p><a href="http://bhyvecon.org/" rel="nofollow">BhyveCon 2016</a> </p></li>
<li><p><a href="http://www.nycbug.org/index.cgi?action=view&id=10640" rel="nofollow">NYC*BUG shell-fu talk slides</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-February/228597.html" rel="nofollow">Possible regression in DragonFly i915 graphics on older Core2Duos </a> </p></li>
<li><p><a href="http://video.fosdem.org/2016/" rel="nofollow">Videos from FOSDEM 2016. BSD dev room was k4601</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2F39XEu9w" rel="nofollow"> Andrew - SMART Tests</a> </li>
<li><a href="http://slexy.org/view/s20kk6lzc9" rel="nofollow"> JT - Secure File Delete</a> </li>
<li><a href="http://slexy.org/view/s21zjZ0ci8" rel="nofollow"> Jordan - Migrate</a> </li>
<li><a href="http://slexy.org/view/s2Hqbt0Uq8" rel="nofollow"> Lars - Pros and Cons of VM</a> </li>
<li><a href="http://slexy.org/view/s2HnO1hxSO" rel="nofollow"> Alex - IPSEC</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we interview Nick Wolff about how FreeBSD is used across the State of Ohio and some of the specific technology used. That, plus the latest news is coming your way right now on BSDNow, the place to</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" <br>
title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://opensource.com/business/16/1/scale-14x-interview-dru-lavigne" rel="nofollow">Doc like an Egyptian: Managing project documentation with Sphinx</a></h3>

<ul>
<li>In case you didn’t make it out to SCALE a few weeks back, we have a great interview with Dru Lavigne over at OpenSource.com which goes over her talk on “Doc like an Egyptian”. </li>
<li>In particular she discusses the challenges of running a wiki for documentation for PC-BSD and FreeNAS which prompted the shift to using Sphinx instead.</li>
</ul>

<blockquote>
<p>“While the main purpose of a wiki is to invite user contributions and to provide a low barrier to entry, very few people come to write documentation (however, every spambot on the planet will quickly find your wiki, which creates its own set of maintenance issues).</p>

<p>Wikis are designed for separate, one-ish page infobytes, such as how-tos. They really aren&#39;t designed to provide navigation in a Table of Contents or to provide a flow of Chapters, though you can hack your pages to provide navigational elements to match the document&#39;s flow. This gets more difficult as the document increases in size—our guides tend to be 300+ pages. It becomes a nightmare as you try to provide versioned copies of each of those pages so that the user is finding and reading the right page for their version of software.</p>

<p>While wiki translation extensions are available, how to configure them is not well documented, their use is slow and clunky, and translated pages only increase the number of available pages, getting you back to the problems in the previous bullet. This is a big deal for projects that have a global audience.</p>

<p>While output-generation wiki extensions are available (for example, to convert your wiki pages to HTML or PDF), how to configure them is not well documented, and they provide very little control for the layout of the generated format. This is a big deal for projects that need to make their documentation available in multiple formats.“</p>
</blockquote>

<ul>
<li>She then discusses some of the hurdles of migration from the Wiki to Sphinx, and follows up with some of the differences using Sphinx you should be aware of for any documentation project.</li>
</ul>

<blockquote>
<p>“While Sphinx is easy to learn, it does have its quirks. For example, it does not support stacked tags. This means, for example, you can not bold italic a phrase using tags—to achieve that requires a CSS workaround. And, while Sphinx does have extensive documentation, a lot of it assumes you already know what you are doing. When you don&#39;t, it can be difficult to find an example that does what you are trying to achieve.</p>

<p>Sphinx is well suited for projects with an existing repository—say, on github—a build infrastructure, and contributors who are comfortable with using text editors and committing to the repo (or creating, say, git pull requests).“</p>
</blockquote>

<hr>

<h3><a href="http://freebsdfoundation.blogspot.com/2016/02/initial-freebsd-risc-v-architecture.html" rel="nofollow">Initial FreeBSD RISC-V Architecture Port Committed.</a></h3>

<ul>
<li>Touching on a story we mentioned a few weeks back, we have a blog post from from Annie over at the FreeBSD foundation talking about the details behind the initial support for RISC-V.</li>
<li>To start us off, you may be wondering what is RISC-V and what makes it special?RISC-V is an exciting new open-source Instruction-Set Architecture (ISA) developed at the University of California at Berkeley, which is seeing increasing interest in the embedded systems and hardware-software research communities.</li>
<li>Currently the improvements allows booting FreeBSD in the Spike simulator, from the university of Berkeley, with enough reliability to do various things, such as SSH, shell, mail, etc.</li>
<li>The next steps include getting multi-core support working, and getting  it working in simulations of Cambridge’s open-source LowRISC System-on-Chip functioning, and ready for early hardware.</li>
<li>Both ports and packages are expected to land in the coming days, so if you love hacking on branch new architectures, this may be your time to jump in.
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=295124" rel="nofollow">FreeBSD Bhyve hypervisor supporting Windows UEFI guests </a></h3>

<ul>
<li>If you have not been following bhyve lately, you’re in for a treat when FreeBSD 10.3 ships in the coming weeks</li>
<li>bhyve now supports UEFI and CSM booting, in addition to its existing FreeBSD userboot loader, and grub-bhyve port</li>
<li>The EFI support allows Windows guests to be run on FreeBSD</li>
<li>Due to the lack of graphics, this requires making a custom .iso to do an ‘Unattended Install’ of Windows, but this is easily done just editing and including a .xml file</li>
<li>The bootrom can now allocate memory</li>
<li>Added some SATA command emulations (no-op)</li>
<li>Increased the number of virtio-blk indirect descriptors</li>
<li>Added a Firmware guest query interface</li>
<li>Add -l option to specify userboot path
<a href="https://jameslodge.com/freebsd-bhyve-hypervisor-running-windows-server-2012-r2-standard/" rel="nofollow">FreeBSD Bhyve Hypervisor Running Windows Server 2012 R2 Standard</a> </li>
<li>In related news, <a href="http://www.prnewswire.com/news-releases/tidalscale-releases-its-system-scaling-hyperkernel-300216105.html" rel="nofollow">TidalScale officially released their product today </a> </li>
<li>TidalScale is a commercial product based on bhyve that allows multiple physical machines to be combined into a single massive virtual machine, with the combined processor power, memory, disk I/O, and network capacity of all of the machines
***</li>
</ul>

<h3><a href="http://www.unixmen.com/freebsd-tacacs-gns3-and-cisco-3700-router/" rel="nofollow">FreeBSD TACACS+ GNS3 and Cisco 3700 Router</a></h3>

<ul>
<li>“TACACS+ – (Terminal Access Controller Access Control System plus) — is a session protocol developed by Cisco.”</li>
<li>This tutorial covers configuring FreeBSD and the tac_plus4 port to act as an authentication, authorization, and accounting server for Cisco routers</li>
<li>The configuration of FreeBSD, the software, and the router are covered</li>
<li>It also includes how to set the FreeBSD server up as a VM on windows, and bridge it to the network</li>
<li>I am sure there are some network administrators out there that would appreciate this
***</li>
</ul>

<h2>Interview - Nick Wolff - <a href="mailto:darkfiberiru@gmail.com" rel="nofollow">darkfiberiru@gmail.com</a> / <a href="https://twitter.com/darkfiberiru" rel="nofollow">@darkfiberiru</a></h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2016-February/016495.html" rel="nofollow">Papers We Love Presents : Bryan Cantrill on Jails &amp; Solaris Zones</a></h3>

<ul>
<li>The folks over at NYCBug point us to “Papers We Love”, a New York based meetup group where past papers are presented. They have a talk scheduled for tomorrow (Feb 11th) with Bryan Cantrill discussing Jails and Solaris Zones</li>
<li>The talk starts at 7PM at the Tumblr building, located between 5th and Park Ave South on 21st street</li>
<li>“We&#39;re <strong>crazy</strong> excited to have Bryan Cantrill, CTO of Joyent, formerly of Sun Microsystems, presenting on <a href="https://us-east.manta.joyent.com/bcantrill/public/ppwl-cantrill-jails.pdf" rel="nofollow">Jails: Confining the omnipotent root</a>. 
by Poul-Henning Kamp and Robert Watson and <a href="https://us-east.manta.joyent.com/bcantrill/public/ppwl-cantrill-zones.pdf" rel="nofollow">Solaris Zones: Operating System Support for Consolidating Commercial Workloads</a> by Dan Price and Andy Tucker!”</li>
<li>The abstract posted gives us a sneak peak of what to expect, first covering jails as a method to “partition” the operating system environment, but maintaining the UNIX “root” model.</li>
<li>Next it looks like he will compare and contrast with the Solaris Zones functionality, which creates virtualized application execution environments, within the single OS instance.</li>
<li>Sounds like a fantastic talk, hopefully somebody remembers to record and post it for us to enjoy later!</li>
<li>There will not be a live stream, but a video of the event should appear online after it has been edited
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/201602StorageSummit" rel="nofollow">FreeBSD Storage Summit</a></h3>

<ul>
<li>The FreeBSD Foundation will be hosting a Storage Summit, co-located at the USENIX FAST (Filesystems And Storage Technology) conference</li>
<li>Developers and Vendors are invited to work on storage related issues</li>
<li>This summit will be a hackathon focused event, rather than a discussion focused devsummit</li>
<li>After setup and introductions, the summit will start with a “Networking Synergies Panel”, to discuss networking as it relates to storage</li>
<li>After a short break, the attendees will break up into a number of working groups focused on solving actual problems</li>
<li>The current working groups include:</li>
<li>CAM Scheduling &amp; Locking, led by Justin Gibbs: “Updating CAM queuing/scheduling and locking models to minimize cross-cpu contention and support multi-queue controllers”</li>
<li>ZFS, led by Matt Ahrens: topics will include enabling the new cryptographic hashes supported by OpenZFS on FreeBSD, Interaction with the kernel memory subsystem, and other upcoming features.</li>
<li>User Space Storage Stack, led by George Neville-Neil</li>
<li>This event offers a unique opportunity for developers and vendors from the storage industry to meet at an event they will likely already be attending
***</li>
</ul>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2016-February/016514.html" rel="nofollow">Tor Browser 5.5 for OpenBSD/amd64 -current is completed</a></h3>

<ul>
<li>“The Tor BSD Diversity Project (TDP) is proud to announce the release of Tor Browser (TB) version 5.5 for OpenBSD. Please note that this version of TB remains in development mode, and is not meant to ensure strong privacy, anonymity or security.”</li>
<li>“TDP (<a href="https://torbsd.github.io" rel="nofollow">https://torbsd.github.io</a>) is an effort to extend the use of the BSD Unixes into the Tor ecosystem, from the desktop to the network. TDP is focused on diversifying the Tor network, with TB being the flagship project. 
Additional efforts are made to increase the number of *BSD relays on the Tor network among other sub-projects”</li>
<li>Help test the new browser bundle, or help diversify the Tor network
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/2548" rel="nofollow">“FreeBSD Mastery: Advanced ZFS” Table of Contents</a></h3>

<ul>
<li><p>We brought you the news about sponsoring the Advanced ZFS book that MWL is working on, now Michael has given us the tentative chapter layout of the (sure to be a classic) tome coming from him and Allan.</p>

<ul>
<li>0: Introduction</li>
<li>1: Boot Environments</li>
<li>2: Delegation and Jails</li>
<li>3: Sharing</li>
<li>4: Replication</li>
<li>5: zvols</li>
<li>6: Advanced Hardware</li>
<li>7: Caches</li>
<li>8: Performance</li>
<li>9: Tuning</li>
<li>10: ZFS Potpourri</li>
</ul></li>
<li><p>In addition to the tease about the upcoming book, michael has asked the community for assistance in coming up with the cover art for it as well. </p></li>
<li><p>In particular it should probably be in-line with his previous works, with a parody of some other classic art-work. </p></li>
<li><p>If you have something, go tweet out to him at @mwlauthor</p>

<hr></li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="https://2016.asiabsdcon.org/index.html.en" rel="nofollow">Online registration for AsiaBSDCon 2016 now open <em>SOON</em></a></p></li>
<li><p><a href="http://bhyvecon.org/" rel="nofollow">BhyveCon 2016</a> </p></li>
<li><p><a href="http://www.nycbug.org/index.cgi?action=view&id=10640" rel="nofollow">NYC*BUG shell-fu talk slides</a></p></li>
<li><p><a href="http://lists.dragonflybsd.org/pipermail/users/2016-February/228597.html" rel="nofollow">Possible regression in DragonFly i915 graphics on older Core2Duos </a> </p></li>
<li><p><a href="http://video.fosdem.org/2016/" rel="nofollow">Videos from FOSDEM 2016. BSD dev room was k4601</a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2F39XEu9w" rel="nofollow"> Andrew - SMART Tests</a> </li>
<li><a href="http://slexy.org/view/s20kk6lzc9" rel="nofollow"> JT - Secure File Delete</a> </li>
<li><a href="http://slexy.org/view/s21zjZ0ci8" rel="nofollow"> Jordan - Migrate</a> </li>
<li><a href="http://slexy.org/view/s2Hqbt0Uq8" rel="nofollow"> Lars - Pros and Cons of VM</a> </li>
<li><a href="http://slexy.org/view/s2HnO1hxSO" rel="nofollow"> Alex - IPSEC</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>127: DNS, Black Holes &amp; Willem</title>
  <link>https://www.bsdnow.tv/127</link>
  <guid isPermaLink="false">f7ba1724-995a-465c-8528-7b593b402bfe</guid>
  <pubDate>Wed, 03 Feb 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f7ba1724-995a-465c-8528-7b593b402bfe.mp3" length="93318196" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Today on the show, we welcome Allan back from FOSSDEM, and enjoy an interview with Willem about DNS and MTU Black Holes. That plus all the weeks news, keep it turned here to BSD</itunes:subtitle>
  <itunes:duration>2:09:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Today on the show, we welcome Allan back from FOSSDEM, and enjoy an interview with Willem about DNS and MTU Black Holes. That plus all the weeks news, keep it turned here to BSD
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD Quarterly Status Report (https://www.freebsd.org/news/status/report-2015-10-2015-12.html)
It is that time of year again, reviewing the progress of the FreeBSD project over the last quarter of 2015
There are a huge number of projects that have recently been completed or that are planned to finish in time for FreeBSD 10.3 or 11.0
This is just a sample of the of the items that stood out most to us:
A number of new teams have been created, and existing teams report in. The Issue Triage, bugmeister, jenkins, IPv6 advocacy, and wiki-admin teams are all mentioned in the status report
Progress is reported on the i915 project to update the Intel graphics drivers
In the storage subsystem: RCTL I/O rate limiting, Warner Losh’s CAM I/O Scheduler is progressing, Mellanox iSCSI Extensions for RDMA (iSER) was added, Chelsio iSCSI offload drivers, Mellanox 100 gbit/s drivers
In Security: Encrypted crash dumps, OpenBSM updates, and a status report on HardenedBSD
For embedded: Support for Ralink/Mediatek MIPS devices, Raspberry Pi Video Code packages, touch screen support for RPI and BBB, new port to the Marvell Armada38x, and the work on arm64 and RISC-V
kib@ rewrote the out-of-memory handler, specifically to perform better in situations where a system does not have swap. Was tested on systems ranging from 32 MB of memory, to 512 GB
Various improvements to the tool chain, build system, and nanobsd
It was nice to see a bunch of reports from ports committers
An overview of the different proposed init replacements, with a report on each
***
First timer’s guide to FOSS conferences  (http://sarah.thesharps.us/2016/02/02/first-timers-guide-to-foss-conferences/)
This post provides a lot of good information for those considering going to their first conference
The very first item says the most: “Conference talks are great because they teach you new skills or give you ideas. However, what conference talks are really for is giving you additional topics of conversation to chat with your fellow conference goers with. Hanging out after a talk ends to chat with the speaker is a great way to connect with speakers or fellow attendees that are passionate about a particular subject.”
The hallway track is the best part of the conference. I’ve ended up missing as much as 2/3rds of a conference, and still found it to be a very valuable conference, sometimes more so than if I attend a talk in every slot
It is important to remember that missing a talk is not the end of the world, that discussion in the hallway may be much more valuable. Most of the talks end up on youtube anyway. The point of the conference is being in the same place as the other people at the conference, the talks are just a means to get us all there.
There is even a lot of good advice for people with social anxiety, and those like Allan who do not partake in alcohol
Know the conference perks and the resources available to you. The author of the post commented on twitter about originally being unaware of the resources that some conferences provide for speakers, but also of discounts for students, and travel grants from Google and others like the FreeBSD Foundation
There are also tips about swag, including watching out for booth wranglers (not common at BSD events, but many larger conferences have booths where your personal information can be exchanged for swag), as well as advice for following up with the people you meet at conferences.
Lastly, it provides thoughts on avoiding “Project Passion Explosion“, or what I call “overcharging your BSD battery”, where after hearing about the interesting stuff other people are doing, or about the things other need, you try to do everything at once, and burn yourself out
I know for myself, there are at least 10 projects I would love to work on, but I need to balance my free time, my work schedule, the FreeBSD release schedule, and which items might be better for someone else to work on.
***
FreeBSD 10.1 based WiFi Captive Portal (http://www.unixmen.com/freebsd-10-1-x64-wifi-captive-portal/)
Captive portals, the bane of many a traveler’s existence, however a necessary evil in the era of war-driving and other potentially nefarious uses of “free-wifi”. 
This week we have an article from the folks at “unixmen”, showing (in great detail) how they setup a FreeBSD 10.1 based captive portal, and yes those are manual MySQL commands.
First up is a diagram showing the layout of their new portal system, using multiple APs for different floors of the apartment / hotel?
The walkthrough assumes you have Apache/MySQL and PHP already installed, so you’ll need to prep those bits beforehand.
Some Apache configuration is up next, which re-directs all port 80 requests over to 443/SSL and the captive portal web-login
At this point we have to install “pear” from ports or packages and begin to do the database setup which is fairly typical if you done any SQL before, such as create user / database / table, etc.
With the database finished, the article provides a nice and clean rc.conf which enables all the necessary services.
Next up is the firewall configuration, which is using IPFW, specifically DUMMYNET/IPALIAS/IPDIVERT and friends. The article does mention to compile a new minimal kernel with these features, if you plan on doing so they I would recommend starting off with that. 
The article then continues, with setting up DHCP server, SUDO and the PHP file creation that will act as the interface between the client and mysql/firewall rules. 
When it’s all said and done, you end up with a nice web-interface for clients, plus a bonus Admin interface to manage creating and removing users. 
For convenience at the very end is a link to all the files / configurations used, so grab that and avoid some of the copy-n-paste
***
Sailor, a 'wannabe' portable container system {their own words!} (https://github.com/NetBSDfr/sailor)
In the world of docker / jails / VMs, containers are all the rage right now, and now we can introduce “Sailor” to this mix
A unique thing about this new solution, is that its based upon chroot/pkgin, and available on NetBSD / OSX and CentOS
Since it is not using “jail” or other security mechanism, they to give us this cavet “Note that sailor's goal is not to provide bullet-proof security, chroot is definitely not a trustable isolator; instead, sailor is a really convenient way of trying / testing an environment without compromising your workstation filesystem.”
Creating a new “ship” is relatively straight-forward, a simple shell define file can supply most of the relevant information. Nginx for example is only a few lines: https://github.com/NetBSDfr/sailor/blob/master/examples/nginx.conf 
In addition to the basic pkg configuration, it also provides methods to do rw/ro mounts into the chroot, as well as IP aliases and copying of specific host binaries into the container
***
Interview - Willem Toorop - willem@nlnetlabs.nl (mailto:willem@nlnetlabs.nl) / @WillemToorop (https://twitter.com/WillemToorop)
GetDNS
vBSDCon 2015 Talk (https://www.youtube.com/watch?v=73M7h56Dsas)
***
News Roundup
A Quarter Century of Unix (http://wiki.tuhs.org/doku.php?id=publications:quarter_century_of_unix)
An oldie, but goodie, the book “A Quarter Century of UNIX” is now available for free download via PDF format. 
This provides an invaluable look into the history of UNIX, which of course we wouldn’t have BSD without. 
There is also a print version still available via Amazon (link at the above URL also). If you find the book useful, consider buying a copy, since a % still goes to the original author
***
Bjoern Zeeb has been awarded grant to finalize VIMAGE fixes  (https://www.freebsdfoundation.org/press/2016janupdate.pdf)
“Bjoern Zeeb has been awarded a project grant to finalize and integrate the work done to make the VIMAGE network stack virtualization infrastructure production ready.”
VIMAGE is the network virtualization kernel component that can be used to give jails their own network interfaces, so they can have their own firewalls, be assign addresses via DHCP, etc.
Currently, a number of bugs prevent this feature from being enabled by default, or used in production
The main areas of focus for the work are: network stack teardown, interface ordering, locking, and addressing the remaining memory leaks at teardown
The work is expected to be completed by the end of March and to be included in FreeBSD 11.0
***
Building a smtpd Mail Server on OpenBSD (http://www.openbsd.org/opensmtpd/faq/example1.html)
The OpenSMTPd FAQ has been updated with a new walkthrough of a complete installation
Following this guide, the resulting installation will:
Accepting mails for multiple domains and virtual users
Allowing virtual users to authenticate and send mails
Applying anti-spam and anti-virus filters on mails
Providing IMAP access for the virtual users
Providing log statistics
It covers setting up the new filter system, configuring TLS, creating the domain and user tables, configuring spamassassin and clamav, and setting up dovecot
There is even a crontab to send you weekly stats on what your email server is doing
***
Introduction to the FreeBSD Open Source Operating System LiveLessons (http://www.informit.com/store/introduction-to-the-freebsd-open-source-operating-system-9780134305868)
Dr. Kirk McKusick has been one of the foremost authorities on FreeBSD for some time now, as co-author of the D&amp;amp;I of FreeBSD (along with George Neville-Neil and Robert Watson) and teaching numerous classes on the same. (Another good reason to come to a *BSD conference)
As part of the Addison-Wesley Professional / LiveLessons series, he has made a 10+ hour video lecture you can now purchase to take his class from the comfort of your own home/couch/office/etc
Aspiring FreeBSD developers, kernel developers, Application Developers and other interested individuals should really consider this invaluable resource in their learning.
The video starts with an introduction to the FreeBSD community and explains how it differs from the Linux ecosystem. The video then goes on to provide a firm background in the FreeBSD kernel. The POSIX kernel interfaces are used as examples where they are defined. Where they are not defined, the FreeBSD interfaces are described.
The video covers basic kernel services, locking, process structure, scheduling, signal handling, jails, and virtual and physical memory management.
The kernel I/O structure is described showing how I/O is multiplexed and the virtual filesystem interface is used to support multiple filesystems.
Devices are described showing disk management and their auto-configuration.
The organization and implementation of the fast filesystem is described concluding with a discussion of how to maintain consistency in the face of hardware or software failures.
The video includes an overview of the ZFS filesystem and covers the socket-based network architecture, layering and routing issues.
The presentations emphasize code organization, data structure navigation, and algorithms.
Normally the video will set you back $299, but right now you can pick it up for $239 (USD). We can’t recommend this enough, but also don’t forget to try and make it out to BSDCan or MeetBSD, where you can usually talk to Dr. McKusick in person.
***
BeastieBits
Faces of FreeBSD: Sean Bruno  (http://freebsdfoundation.blogspot.ca/2016/01/faces-of-freebsd-2016-sean-bruno.html) 
Support Michael W. Lucas writing BSD books, and get your name in the credits  (http://blather.michaelwlucas.com/archives/2539) 
bhyve windows support merged to stable/10 branch, will be included in FreeBSD 10.3  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=295124)
FreeBSD Outsells Windows by almost 2-1 (http://arstechnica.com/gaming/2016/01/ea-lets-slip-lifetime-xbox-one-and-ps4-consoles-sales/) 
A rant about the whois protocol (http://fanf.livejournal.com/140505.html) 
Kris Moore talks about Jails and system management on BSDTalk (http://bsdtalk.blogspot.com/2016/01/bsdtalk261-jails-and-system-management.html) 
FOSDEM 2016: Slides from the 5 years of IllumOS talk  (https://fosdem.org/2016/schedule/event/illumos_overview/attachments/audio/873/export/events/attachments/illumos_overview/audio/873/FOSDEM_2016.pdf) 
A tweet from the first day of FOSDEM showed only 1 FreeBSD machine. Many of the FreeBSD developers were at a devsummit offsite that day, and more users arrived for the BSD dev room which was on the Sunday  (https://twitter.com/pvaneynd/status/693813132649697281) 
Feedback/Questions
 Antonio - ZFS Book Formatting (http://pastebin.com/ZWNHgqHQ) 
 Simon - ZFS Corruption? (http://pastebin.com/XW97YSQK) 
 Christian - rm -r^^^OOOPSSS (http://pastebin.com/W7TwWwtE) 
 Phillipp - ZFS Send/Recv (http://pastebin.com/zA2ewPuF) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Today on the show, we welcome Allan back from FOSSDEM, and enjoy an interview with Willem about DNS and MTU Black Holes. That plus all the weeks news, keep it turned here to BSD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2015-10-2015-12.html" rel="nofollow">FreeBSD Quarterly Status Report</a></h3>

<ul>
<li>It is that time of year again, reviewing the progress of the FreeBSD project over the last quarter of 2015</li>
<li>There are a huge number of projects that have recently been completed or that are planned to finish in time for FreeBSD 10.3 or 11.0</li>
<li>This is just a sample of the of the items that stood out most to us:</li>
<li>A number of new teams have been created, and existing teams report in. The Issue Triage, bugmeister, jenkins, IPv6 advocacy, and wiki-admin teams are all mentioned in the status report</li>
<li>Progress is reported on the i915 project to update the Intel graphics drivers</li>
<li>In the storage subsystem: RCTL I/O rate limiting, Warner Losh’s CAM I/O Scheduler is progressing, Mellanox iSCSI Extensions for RDMA (iSER) was added, Chelsio iSCSI offload drivers, Mellanox 100 gbit/s drivers</li>
<li>In Security: Encrypted crash dumps, OpenBSM updates, and a status report on HardenedBSD</li>
<li>For embedded: Support for Ralink/Mediatek MIPS devices, Raspberry Pi Video Code packages, touch screen support for RPI and BBB, new port to the Marvell Armada38x, and the work on arm64 and RISC-V</li>
<li>kib@ rewrote the out-of-memory handler, specifically to perform better in situations where a system does not have swap. Was tested on systems ranging from 32 MB of memory, to 512 GB</li>
<li>Various improvements to the tool chain, build system, and nanobsd</li>
<li>It was nice to see a bunch of reports from ports committers</li>
<li>An overview of the different proposed init replacements, with a report on each
***</li>
</ul>

<h3><a href="http://sarah.thesharps.us/2016/02/02/first-timers-guide-to-foss-conferences/" rel="nofollow">First timer’s guide to FOSS conferences </a></h3>

<ul>
<li>This post provides a lot of good information for those considering going to their first conference</li>
<li>The very first item says the most: “Conference talks are great because they teach you new skills or give you ideas. However, what conference talks are really for is giving you additional topics of conversation to chat with your fellow conference goers with. Hanging out after a talk ends to chat with the speaker is a great way to connect with speakers or fellow attendees that are passionate about a particular subject.”</li>
<li>The hallway track is the best part of the conference. I’ve ended up missing as much as 2/3rds of a conference, and still found it to be a very valuable conference, sometimes more so than if I attend a talk in every slot</li>
<li>It is important to remember that missing a talk is not the end of the world, that discussion in the hallway may be much more valuable. Most of the talks end up on youtube anyway. The point of the conference is being in the same place as the other people at the conference, the talks are just a means to get us all there.</li>
<li>There is even a lot of good advice for people with social anxiety, and those like Allan who do not partake in alcohol</li>
<li>Know the conference perks and the resources available to you. The author of the post commented on twitter about originally being unaware of the resources that some conferences provide for speakers, but also of discounts for students, and travel grants from Google and others like the FreeBSD Foundation</li>
<li>There are also tips about swag, including watching out for booth wranglers (not common at BSD events, but many larger conferences have booths where your personal information can be exchanged for swag), as well as advice for following up with the people you meet at conferences.</li>
<li>Lastly, it provides thoughts on avoiding “Project Passion Explosion“, or what I call “overcharging your BSD battery”, where after hearing about the interesting stuff other people are doing, or about the things other need, you try to do everything at once, and burn yourself out</li>
<li>I know for myself, there are at least 10 projects I would love to work on, but I need to balance my free time, my work schedule, the FreeBSD release schedule, and which items might be better for someone else to work on.
***</li>
</ul>

<h3><a href="http://www.unixmen.com/freebsd-10-1-x64-wifi-captive-portal/" rel="nofollow">FreeBSD 10.1 based WiFi Captive Portal</a></h3>

<ul>
<li>Captive portals, the bane of many a traveler’s existence, however a necessary evil in the era of war-driving and other potentially nefarious uses of “free-wifi”. </li>
<li>This week we have an article from the folks at “unixmen”, showing (in great detail) how they setup a FreeBSD 10.1 based captive portal, and yes those are manual MySQL commands.</li>
<li>First up is a diagram showing the layout of their new portal system, using multiple APs for different floors of the apartment / hotel?</li>
<li>The walkthrough assumes you have Apache/MySQL and PHP already installed, so you’ll need to prep those bits beforehand.</li>
<li>Some Apache configuration is up next, which re-directs all port 80 requests over to 443/SSL and the captive portal web-login</li>
<li>At this point we have to install “pear” from ports or packages and begin to do the database setup which is fairly typical if you done any SQL before, such as create user / database / table, etc.</li>
<li>With the database finished, the article provides a nice and clean rc.conf which enables all the necessary services.</li>
<li>Next up is the firewall configuration, which is using IPFW, specifically DUMMYNET/IPALIAS/IPDIVERT and friends. The article does mention to compile a new minimal kernel with these features, if you plan on doing so they I would recommend starting off with that. </li>
<li>The article then continues, with setting up DHCP server, SUDO and the PHP file creation that will act as the interface between the client and mysql/firewall rules. </li>
<li>When it’s all said and done, you end up with a nice web-interface for clients, plus a bonus Admin interface to manage creating and removing users. </li>
<li>For convenience at the very end is a link to all the files / configurations used, so grab that and avoid some of the copy-n-paste
***</li>
</ul>

<h3><a href="https://github.com/NetBSDfr/sailor" rel="nofollow">Sailor, a &#39;wannabe&#39; portable container system {their own words!}</a></h3>

<ul>
<li>In the world of docker / jails / VMs, containers are all the rage right now, and now we can introduce “Sailor” to this mix</li>
<li>A unique thing about this new solution, is that its based upon chroot/pkgin, and available on NetBSD / OSX and CentOS</li>
<li>Since it is not using “jail” or other security mechanism, they to give us this cavet “Note that sailor&#39;s goal is not to provide bullet-proof security, chroot is definitely not a trustable isolator; instead, sailor is a really convenient way of trying / testing an environment without compromising your workstation filesystem.”</li>
<li>Creating a new “ship” is relatively straight-forward, a simple shell define file can supply most of the relevant information. Nginx for example is only a few lines: <a href="https://github.com/NetBSDfr/sailor/blob/master/examples/nginx.conf" rel="nofollow">https://github.com/NetBSDfr/sailor/blob/master/examples/nginx.conf</a> </li>
<li>In addition to the basic pkg configuration, it also provides methods to do rw/ro mounts into the chroot, as well as IP aliases and copying of specific host binaries into the container
***</li>
</ul>

<h2>Interview - Willem Toorop - <a href="mailto:willem@nlnetlabs.nl" rel="nofollow">willem@nlnetlabs.nl</a> / <a href="https://twitter.com/WillemToorop" rel="nofollow">@WillemToorop</a></h2>

<ul>
<li>GetDNS</li>
<li><a href="https://www.youtube.com/watch?v=73M7h56Dsas" rel="nofollow">vBSDCon 2015 Talk</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://wiki.tuhs.org/doku.php?id=publications:quarter_century_of_unix" rel="nofollow">A Quarter Century of Unix</a></h3>

<ul>
<li>An oldie, but goodie, the book “A Quarter Century of UNIX” is now available for free download via PDF format. </li>
<li>This provides an invaluable look into the history of UNIX, which of course we wouldn’t have BSD without. </li>
<li>There is also a print version still available via Amazon (link at the above URL also). If you find the book useful, consider buying a copy, since a % still goes to the original author
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/press/2016janupdate.pdf" rel="nofollow">Bjoern Zeeb has been awarded grant to finalize VIMAGE fixes </a></h3>

<ul>
<li>“Bjoern Zeeb has been awarded a project grant to finalize and integrate the work done to make the VIMAGE network stack virtualization infrastructure production ready.”</li>
<li>VIMAGE is the network virtualization kernel component that can be used to give jails their own network interfaces, so they can have their own firewalls, be assign addresses via DHCP, etc.</li>
<li>Currently, a number of bugs prevent this feature from being enabled by default, or used in production</li>
<li>The main areas of focus for the work are: network stack teardown, interface ordering, locking, and addressing the remaining memory leaks at teardown</li>
<li>The work is expected to be completed by the end of March and to be included in FreeBSD 11.0
***</li>
</ul>

<h3><a href="http://www.openbsd.org/opensmtpd/faq/example1.html" rel="nofollow">Building a smtpd Mail Server on OpenBSD</a></h3>

<ul>
<li>The OpenSMTPd FAQ has been updated with a new walkthrough of a complete installation</li>
<li>Following this guide, the resulting installation will:</li>
<li>Accepting mails for multiple domains and virtual users</li>
<li>Allowing virtual users to authenticate and send mails</li>
<li>Applying anti-spam and anti-virus filters on mails</li>
<li>Providing IMAP access for the virtual users</li>
<li>Providing log statistics</li>
<li>It covers setting up the new filter system, configuring TLS, creating the domain and user tables, configuring spamassassin and clamav, and setting up dovecot</li>
<li>There is even a crontab to send you weekly stats on what your email server is doing
***</li>
</ul>

<h3><a href="http://www.informit.com/store/introduction-to-the-freebsd-open-source-operating-system-9780134305868" rel="nofollow">Introduction to the FreeBSD Open Source Operating System LiveLessons</a></h3>

<ul>
<li>Dr. Kirk McKusick has been one of the foremost authorities on FreeBSD for some time now, as co-author of the D&amp;I of FreeBSD (along with George Neville-Neil and Robert Watson) and teaching numerous classes on the same. (Another good reason to come to a *BSD conference)</li>
<li>As part of the Addison-Wesley Professional / LiveLessons series, he has made a 10+ hour video lecture you can now purchase to take his class from the comfort of your own home/couch/office/etc</li>
<li>Aspiring FreeBSD developers, kernel developers, Application Developers and other interested individuals should really consider this invaluable resource in their learning.

<ul>
<li>The video starts with an introduction to the FreeBSD community and explains how it differs from the Linux ecosystem. The video then goes on to provide a firm background in the FreeBSD kernel. The POSIX kernel interfaces are used as examples where they are defined. Where they are not defined, the FreeBSD interfaces are described.</li>
<li>The video covers basic kernel services, locking, process structure, scheduling, signal handling, jails, and virtual and physical memory management.</li>
<li>The kernel I/O structure is described showing how I/O is multiplexed and the virtual filesystem interface is used to support multiple filesystems.</li>
<li>Devices are described showing disk management and their auto-configuration.</li>
<li>The organization and implementation of the fast filesystem is described concluding with a discussion of how to maintain consistency in the face of hardware or software failures.</li>
<li>The video includes an overview of the ZFS filesystem and covers the socket-based network architecture, layering and routing issues.</li>
<li>The presentations emphasize code organization, data structure navigation, and algorithms.</li>
</ul></li>
<li>Normally the video will set you back $299, but right now you can pick it up for $239 (USD). We can’t recommend this enough, but also don’t forget to try and make it out to BSDCan or MeetBSD, where you can usually talk to Dr. McKusick in person.
***</li>
</ul>

<h3>BeastieBits</h3>

<ul>
<li><p><a href="http://freebsdfoundation.blogspot.ca/2016/01/faces-of-freebsd-2016-sean-bruno.html" rel="nofollow">Faces of FreeBSD: Sean Bruno </a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2539" rel="nofollow">Support Michael W. Lucas writing BSD books, and get your name in the credits </a> </p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=295124" rel="nofollow">bhyve windows support merged to stable/10 branch, will be included in FreeBSD 10.3 </a></p></li>
<li><p><a href="http://arstechnica.com/gaming/2016/01/ea-lets-slip-lifetime-xbox-one-and-ps4-consoles-sales/" rel="nofollow">FreeBSD Outsells Windows by almost 2-1</a> </p></li>
<li><p><a href="http://fanf.livejournal.com/140505.html" rel="nofollow">A rant about the whois protocol</a> </p></li>
<li><p><a href="http://bsdtalk.blogspot.com/2016/01/bsdtalk261-jails-and-system-management.html" rel="nofollow">Kris Moore talks about Jails and system management on BSDTalk</a> </p></li>
<li><p><a href="https://fosdem.org/2016/schedule/event/illumos_overview/attachments/audio/873/export/events/attachments/illumos_overview/audio/873/FOSDEM_2016.pdf" rel="nofollow">FOSDEM 2016: Slides from the 5 years of IllumOS talk </a> </p></li>
<li><p><a href="https://twitter.com/pvaneynd/status/693813132649697281" rel="nofollow">A tweet from the first day of FOSDEM showed only 1 FreeBSD machine. Many of the FreeBSD developers were at a devsummit offsite that day, and more users arrived for the BSD dev room which was on the Sunday </a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/ZWNHgqHQ" rel="nofollow"> Antonio - ZFS Book Formatting</a> </li>
<li><a href="http://pastebin.com/XW97YSQK" rel="nofollow"> Simon - ZFS Corruption?</a> </li>
<li><a href="http://pastebin.com/W7TwWwtE" rel="nofollow"> Christian - rm -r<sup><sup><sup>OOOPSSS</sup></sup></sup></a> </li>
<li><a href="http://pastebin.com/zA2ewPuF" rel="nofollow"> Phillipp - ZFS Send/Recv</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Today on the show, we welcome Allan back from FOSSDEM, and enjoy an interview with Willem about DNS and MTU Black Holes. That plus all the weeks news, keep it turned here to BSD</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2015-10-2015-12.html" rel="nofollow">FreeBSD Quarterly Status Report</a></h3>

<ul>
<li>It is that time of year again, reviewing the progress of the FreeBSD project over the last quarter of 2015</li>
<li>There are a huge number of projects that have recently been completed or that are planned to finish in time for FreeBSD 10.3 or 11.0</li>
<li>This is just a sample of the of the items that stood out most to us:</li>
<li>A number of new teams have been created, and existing teams report in. The Issue Triage, bugmeister, jenkins, IPv6 advocacy, and wiki-admin teams are all mentioned in the status report</li>
<li>Progress is reported on the i915 project to update the Intel graphics drivers</li>
<li>In the storage subsystem: RCTL I/O rate limiting, Warner Losh’s CAM I/O Scheduler is progressing, Mellanox iSCSI Extensions for RDMA (iSER) was added, Chelsio iSCSI offload drivers, Mellanox 100 gbit/s drivers</li>
<li>In Security: Encrypted crash dumps, OpenBSM updates, and a status report on HardenedBSD</li>
<li>For embedded: Support for Ralink/Mediatek MIPS devices, Raspberry Pi Video Code packages, touch screen support for RPI and BBB, new port to the Marvell Armada38x, and the work on arm64 and RISC-V</li>
<li>kib@ rewrote the out-of-memory handler, specifically to perform better in situations where a system does not have swap. Was tested on systems ranging from 32 MB of memory, to 512 GB</li>
<li>Various improvements to the tool chain, build system, and nanobsd</li>
<li>It was nice to see a bunch of reports from ports committers</li>
<li>An overview of the different proposed init replacements, with a report on each
***</li>
</ul>

<h3><a href="http://sarah.thesharps.us/2016/02/02/first-timers-guide-to-foss-conferences/" rel="nofollow">First timer’s guide to FOSS conferences </a></h3>

<ul>
<li>This post provides a lot of good information for those considering going to their first conference</li>
<li>The very first item says the most: “Conference talks are great because they teach you new skills or give you ideas. However, what conference talks are really for is giving you additional topics of conversation to chat with your fellow conference goers with. Hanging out after a talk ends to chat with the speaker is a great way to connect with speakers or fellow attendees that are passionate about a particular subject.”</li>
<li>The hallway track is the best part of the conference. I’ve ended up missing as much as 2/3rds of a conference, and still found it to be a very valuable conference, sometimes more so than if I attend a talk in every slot</li>
<li>It is important to remember that missing a talk is not the end of the world, that discussion in the hallway may be much more valuable. Most of the talks end up on youtube anyway. The point of the conference is being in the same place as the other people at the conference, the talks are just a means to get us all there.</li>
<li>There is even a lot of good advice for people with social anxiety, and those like Allan who do not partake in alcohol</li>
<li>Know the conference perks and the resources available to you. The author of the post commented on twitter about originally being unaware of the resources that some conferences provide for speakers, but also of discounts for students, and travel grants from Google and others like the FreeBSD Foundation</li>
<li>There are also tips about swag, including watching out for booth wranglers (not common at BSD events, but many larger conferences have booths where your personal information can be exchanged for swag), as well as advice for following up with the people you meet at conferences.</li>
<li>Lastly, it provides thoughts on avoiding “Project Passion Explosion“, or what I call “overcharging your BSD battery”, where after hearing about the interesting stuff other people are doing, or about the things other need, you try to do everything at once, and burn yourself out</li>
<li>I know for myself, there are at least 10 projects I would love to work on, but I need to balance my free time, my work schedule, the FreeBSD release schedule, and which items might be better for someone else to work on.
***</li>
</ul>

<h3><a href="http://www.unixmen.com/freebsd-10-1-x64-wifi-captive-portal/" rel="nofollow">FreeBSD 10.1 based WiFi Captive Portal</a></h3>

<ul>
<li>Captive portals, the bane of many a traveler’s existence, however a necessary evil in the era of war-driving and other potentially nefarious uses of “free-wifi”. </li>
<li>This week we have an article from the folks at “unixmen”, showing (in great detail) how they setup a FreeBSD 10.1 based captive portal, and yes those are manual MySQL commands.</li>
<li>First up is a diagram showing the layout of their new portal system, using multiple APs for different floors of the apartment / hotel?</li>
<li>The walkthrough assumes you have Apache/MySQL and PHP already installed, so you’ll need to prep those bits beforehand.</li>
<li>Some Apache configuration is up next, which re-directs all port 80 requests over to 443/SSL and the captive portal web-login</li>
<li>At this point we have to install “pear” from ports or packages and begin to do the database setup which is fairly typical if you done any SQL before, such as create user / database / table, etc.</li>
<li>With the database finished, the article provides a nice and clean rc.conf which enables all the necessary services.</li>
<li>Next up is the firewall configuration, which is using IPFW, specifically DUMMYNET/IPALIAS/IPDIVERT and friends. The article does mention to compile a new minimal kernel with these features, if you plan on doing so they I would recommend starting off with that. </li>
<li>The article then continues, with setting up DHCP server, SUDO and the PHP file creation that will act as the interface between the client and mysql/firewall rules. </li>
<li>When it’s all said and done, you end up with a nice web-interface for clients, plus a bonus Admin interface to manage creating and removing users. </li>
<li>For convenience at the very end is a link to all the files / configurations used, so grab that and avoid some of the copy-n-paste
***</li>
</ul>

<h3><a href="https://github.com/NetBSDfr/sailor" rel="nofollow">Sailor, a &#39;wannabe&#39; portable container system {their own words!}</a></h3>

<ul>
<li>In the world of docker / jails / VMs, containers are all the rage right now, and now we can introduce “Sailor” to this mix</li>
<li>A unique thing about this new solution, is that its based upon chroot/pkgin, and available on NetBSD / OSX and CentOS</li>
<li>Since it is not using “jail” or other security mechanism, they to give us this cavet “Note that sailor&#39;s goal is not to provide bullet-proof security, chroot is definitely not a trustable isolator; instead, sailor is a really convenient way of trying / testing an environment without compromising your workstation filesystem.”</li>
<li>Creating a new “ship” is relatively straight-forward, a simple shell define file can supply most of the relevant information. Nginx for example is only a few lines: <a href="https://github.com/NetBSDfr/sailor/blob/master/examples/nginx.conf" rel="nofollow">https://github.com/NetBSDfr/sailor/blob/master/examples/nginx.conf</a> </li>
<li>In addition to the basic pkg configuration, it also provides methods to do rw/ro mounts into the chroot, as well as IP aliases and copying of specific host binaries into the container
***</li>
</ul>

<h2>Interview - Willem Toorop - <a href="mailto:willem@nlnetlabs.nl" rel="nofollow">willem@nlnetlabs.nl</a> / <a href="https://twitter.com/WillemToorop" rel="nofollow">@WillemToorop</a></h2>

<ul>
<li>GetDNS</li>
<li><a href="https://www.youtube.com/watch?v=73M7h56Dsas" rel="nofollow">vBSDCon 2015 Talk</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://wiki.tuhs.org/doku.php?id=publications:quarter_century_of_unix" rel="nofollow">A Quarter Century of Unix</a></h3>

<ul>
<li>An oldie, but goodie, the book “A Quarter Century of UNIX” is now available for free download via PDF format. </li>
<li>This provides an invaluable look into the history of UNIX, which of course we wouldn’t have BSD without. </li>
<li>There is also a print version still available via Amazon (link at the above URL also). If you find the book useful, consider buying a copy, since a % still goes to the original author
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/press/2016janupdate.pdf" rel="nofollow">Bjoern Zeeb has been awarded grant to finalize VIMAGE fixes </a></h3>

<ul>
<li>“Bjoern Zeeb has been awarded a project grant to finalize and integrate the work done to make the VIMAGE network stack virtualization infrastructure production ready.”</li>
<li>VIMAGE is the network virtualization kernel component that can be used to give jails their own network interfaces, so they can have their own firewalls, be assign addresses via DHCP, etc.</li>
<li>Currently, a number of bugs prevent this feature from being enabled by default, or used in production</li>
<li>The main areas of focus for the work are: network stack teardown, interface ordering, locking, and addressing the remaining memory leaks at teardown</li>
<li>The work is expected to be completed by the end of March and to be included in FreeBSD 11.0
***</li>
</ul>

<h3><a href="http://www.openbsd.org/opensmtpd/faq/example1.html" rel="nofollow">Building a smtpd Mail Server on OpenBSD</a></h3>

<ul>
<li>The OpenSMTPd FAQ has been updated with a new walkthrough of a complete installation</li>
<li>Following this guide, the resulting installation will:</li>
<li>Accepting mails for multiple domains and virtual users</li>
<li>Allowing virtual users to authenticate and send mails</li>
<li>Applying anti-spam and anti-virus filters on mails</li>
<li>Providing IMAP access for the virtual users</li>
<li>Providing log statistics</li>
<li>It covers setting up the new filter system, configuring TLS, creating the domain and user tables, configuring spamassassin and clamav, and setting up dovecot</li>
<li>There is even a crontab to send you weekly stats on what your email server is doing
***</li>
</ul>

<h3><a href="http://www.informit.com/store/introduction-to-the-freebsd-open-source-operating-system-9780134305868" rel="nofollow">Introduction to the FreeBSD Open Source Operating System LiveLessons</a></h3>

<ul>
<li>Dr. Kirk McKusick has been one of the foremost authorities on FreeBSD for some time now, as co-author of the D&amp;I of FreeBSD (along with George Neville-Neil and Robert Watson) and teaching numerous classes on the same. (Another good reason to come to a *BSD conference)</li>
<li>As part of the Addison-Wesley Professional / LiveLessons series, he has made a 10+ hour video lecture you can now purchase to take his class from the comfort of your own home/couch/office/etc</li>
<li>Aspiring FreeBSD developers, kernel developers, Application Developers and other interested individuals should really consider this invaluable resource in their learning.

<ul>
<li>The video starts with an introduction to the FreeBSD community and explains how it differs from the Linux ecosystem. The video then goes on to provide a firm background in the FreeBSD kernel. The POSIX kernel interfaces are used as examples where they are defined. Where they are not defined, the FreeBSD interfaces are described.</li>
<li>The video covers basic kernel services, locking, process structure, scheduling, signal handling, jails, and virtual and physical memory management.</li>
<li>The kernel I/O structure is described showing how I/O is multiplexed and the virtual filesystem interface is used to support multiple filesystems.</li>
<li>Devices are described showing disk management and their auto-configuration.</li>
<li>The organization and implementation of the fast filesystem is described concluding with a discussion of how to maintain consistency in the face of hardware or software failures.</li>
<li>The video includes an overview of the ZFS filesystem and covers the socket-based network architecture, layering and routing issues.</li>
<li>The presentations emphasize code organization, data structure navigation, and algorithms.</li>
</ul></li>
<li>Normally the video will set you back $299, but right now you can pick it up for $239 (USD). We can’t recommend this enough, but also don’t forget to try and make it out to BSDCan or MeetBSD, where you can usually talk to Dr. McKusick in person.
***</li>
</ul>

<h3>BeastieBits</h3>

<ul>
<li><p><a href="http://freebsdfoundation.blogspot.ca/2016/01/faces-of-freebsd-2016-sean-bruno.html" rel="nofollow">Faces of FreeBSD: Sean Bruno </a> </p></li>
<li><p><a href="http://blather.michaelwlucas.com/archives/2539" rel="nofollow">Support Michael W. Lucas writing BSD books, and get your name in the credits </a> </p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=295124" rel="nofollow">bhyve windows support merged to stable/10 branch, will be included in FreeBSD 10.3 </a></p></li>
<li><p><a href="http://arstechnica.com/gaming/2016/01/ea-lets-slip-lifetime-xbox-one-and-ps4-consoles-sales/" rel="nofollow">FreeBSD Outsells Windows by almost 2-1</a> </p></li>
<li><p><a href="http://fanf.livejournal.com/140505.html" rel="nofollow">A rant about the whois protocol</a> </p></li>
<li><p><a href="http://bsdtalk.blogspot.com/2016/01/bsdtalk261-jails-and-system-management.html" rel="nofollow">Kris Moore talks about Jails and system management on BSDTalk</a> </p></li>
<li><p><a href="https://fosdem.org/2016/schedule/event/illumos_overview/attachments/audio/873/export/events/attachments/illumos_overview/audio/873/FOSDEM_2016.pdf" rel="nofollow">FOSDEM 2016: Slides from the 5 years of IllumOS talk </a> </p></li>
<li><p><a href="https://twitter.com/pvaneynd/status/693813132649697281" rel="nofollow">A tweet from the first day of FOSDEM showed only 1 FreeBSD machine. Many of the FreeBSD developers were at a devsummit offsite that day, and more users arrived for the BSD dev room which was on the Sunday </a> </p>

<hr></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/ZWNHgqHQ" rel="nofollow"> Antonio - ZFS Book Formatting</a> </li>
<li><a href="http://pastebin.com/XW97YSQK" rel="nofollow"> Simon - ZFS Corruption?</a> </li>
<li><a href="http://pastebin.com/W7TwWwtE" rel="nofollow"> Christian - rm -r<sup><sup><sup>OOOPSSS</sup></sup></sup></a> </li>
<li><a href="http://pastebin.com/zA2ewPuF" rel="nofollow"> Phillipp - ZFS Send/Recv</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>126: Illuminating the future on PC-BSD</title>
  <link>https://www.bsdnow.tv/126</link>
  <guid isPermaLink="false">38a81f5a-d2f7-40c2-a625-0c36792766d7</guid>
  <pubDate>Wed, 27 Jan 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/38a81f5a-d2f7-40c2-a625-0c36792766d7.mp3" length="78139732" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we are going to be talking to Ken Moore about the Lumina desktop environment, where it stands now &amp; looking ahead. Then Allan turns the tables &amp; interviews both Kris &amp; Ken about new ongoings in PC-BSD land. Stay tuned, lots of exciting show is coming your way right now on BSDNow, the place to B...SD!</itunes:subtitle>
  <itunes:duration>1:48:31</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we are going to be talking to Ken Moore about the Lumina desktop environment, where it stands now &amp;amp; looking ahead. Then Allan turns the tables &amp;amp; interviews both Kris &amp;amp; Ken about new ongoings in PC-BSD land. Stay tuned, lots of exciting show is coming your way right now on BSDNow, the place to B...SD!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Linuxvoice reviews six NAS designed OSes and states that FreeNAS has the largest amount of features (https://www.linuxvoice.com/group-test-nas-distros/)
The review compares the features of: FreeNAS, NAS4Free, Open Media Vault, Openfiler Community Edition, EasyNAS, and Turnkey Linux File Server
“Many NAS solutions can do a lot more than just back up and restore files – you can extend them with plugins to do a variety of tasks. Some enable you to stream media to computers and others devices. Others can hook up with apps and services and allow them to use the NAS for storing and retrieving data”
Open Media Vault: 4/5, “A feature-rich NAS distro that’s easy to deploy and manage”. Many plugins, good UI
Turnkey Linux File Server: 2/5, “A no-fuss distro that’ll set up a fully functional file sharing server in no time”. No RAID, LVM must be down manually
Openfiler Community Edition: 1/5, “There is a target segment for Openfiler, but we can’t spot it”. In the middle of rebasing on CentOS, lacking documentation, confusing UI
EasyNAS: 3/5, “A simple NAS distro that balances the availability of features with reasonable assumptions”. Major updates require reinstall, lacks advanced features and advanced protocols
FreeNAS: 3/5, “FreeNAS The most feature-rich NAS distribution requires some getting used to”. Best documentation, best snapshot management, most plugins, jailed plugins, most enterprise features
NAS4Free: 3/5, “NAS4Free An advanced NAS distro that’s designed for advanced users”, additional flexibility with disk layout (partition the first disk to install the OS there, use remaining space for data storage)
“If we had to award this group test to the distro with the biggest number of features then the top two challengers would have been FreeNAS and its protegée NAS4Free. While both of these solutions pitch themselves to users outside the corporate environment, they’d simply be overkill for most home users. Furthermore, their FreeBSD base and the ZFS filesystem, while a boon to enterprise users, virtually makes them alien technology to the average Linux household.”
It is not clear why they gave NAS4Free and FreeNAS the same score when they wrote a list of reasons why FreeNAS was better.
It seems the goal of their rundown was to find the best Linux NAS, not the best NAS.
***
FreeBSD based Snort IPS (http://www.unixmen.com/freebsd-snort-ips/)
UnixMen.com provides a new tutorial on setting up Snort, the IPS (Intrusion Prevention system) on FreeBSD
Install Apache, PHP, and MySQL, then Snort
Download the latest Snort rules from the official website
Disable the Packet Filter on the USB interfaces to avoid issues with Snort
Install oinkmaster and barnyard2, and configure them
Then install the Snorby WEB interface, which will give you a nice overview of the data generated by the IPS
Then install SnortSAM, and connect it to ipfw
Now when Snort detects a potential intrusion, it will be displayed in Snorby, and automatically blocked with IPFW
***
Opensource.com features two BSD developers as examples of how open source can help your career (https://opensource.com/life/16/1/3-new-open-source-contributors-share-their-experiences)
“When contributing to open source projects and communities, one of the many benefits is that you can improve your tech skills. In this article, hear from three contributors on how their open source helped them get a job or improved their career.”
Alexander Yurchenko, an OpenBSD developer who now works at Yandex says: “Participating in such a project yields colossal experience. A good, large open source project has everything that is typically required from a developer at job interviews: good planning, good coding, use of versioning systems and bug trackers, peer reviews, teamwork, and such. So, after stewing in such an environment for a year or two, you have a good opportunity to grow to a senior developer level.”
“That is, in fact, what happened to me. I was hired as a senior developer without having any formal work experience on my service record. After the first week, my probation period was reduced from three months to zero.”
While you may not have “formal work experience”, you do have a body of work, a (code/documentation/etc) portfolio, you can point to
Having spent a year working somewhere may say something about you, but showing some code you wrote that other people use every day, is usually more valuable
Alexander Polyakov, a DragonFly contributor, worked on updating support for other languages and on ACPI.
“I even made some money in the process—a customer found me via git log. He wanted to use DragonFlyBSD in production and needed better ACPI support and some RAID driver or something.”
“In a nutshell, contributing to various open source projects is how you gain great experience. Don't be afraid to send in bad code (happens to the best of us), keep calm (while being scolded for sending in that bad code), and choose projects you are really interested in. Then you'll both gain experience and have fun while you doing it.”
Kirill Gorkunov talks about his experience with turning open source into a career: “For a few years, I've been fixing the code, sending patches, getting scolded for bad code and complimented for good code. That experience was priceless. And you can be sure that as soon as you get good at it, job offers will follow. This is, in fact, how I met the kernel developers working on OpenVZ. Together, we decided to continue working on the OpenVZ kernel and related stuff as well”
When you contribute to open source, you end up being the person who wrote “Foo”, and this can often turn into work, when someone wants to build something with “Foo”, or like “Foo”
This same point was focus of a panel the FreeBSD Foundation organized at the womENcourage conference in Sweden last year: Open Source as a Career Path
 (https://www.youtube.com/watch?v=p7PW1E3IJvY)
***
FreeBSD, LibreSSL and LetsEncrypt oh my! (https://wiki.freebsd.org/BernardSpil/LetsEncrypt)
Over on the FreeBSD Wiki, Bernard Spil (whom we’ve interviewed before) has started a walkthrough talking about how he uses LibreSSL and LetsEncrypt, without using the heavy python client
The article provides detailed instructions on prepping the system and automating the process of updating the SSL certificates
If you’ve used the “official” letsencrypt client in the past, you’ll note some differences in his method, which keeps all the ‘acme-challenge’ files in a single-directory, which is aliased into domains. 
Using this method also drops the requirement to run the letsencrypt auth as root, and allows you to run it as the unprivileged “letsencrypt” user instead. 
He mentions that the bash/zsh scripts used may be added to ports at some point as well
***
Interview - Ken Moore &amp;amp; Kris Moore - ken@pcbsd.org (mailto:ken@pcbsd.org) / @pcbsdkris (https://twitter.com/pcbsdkris)
PC-BSD’s new SysAdm Project and Lumina Update
***
News Roundup
DragonFly Intel i915 support to match what’s in the Linux 4.1 kernel (http://lists.dragonflybsd.org/pipermail/commits/2016-January/459241.html)
In DragonFly’s ongoing quest for DRM awesomeness, they have now merged changes to bring them up to Linux 4.1 kernel features. 
Some of the notables include that “Valleyview” support is greatly improved, and not considered preliminary anymore
Skylake got some support improvements as well, including runtime power management, and that turbo and sleep states should be functional. 
Some great improvements to power usage have been added, such as setting GPU frequencies to hardware minimum and enabling of DRRS (Dynamic Refresh Rate Switching) being enabled by default
They’ve even begun importing some of the prelim work for Broxton, the upcoming Atom SOC
***
FreeNAS Home Server Build (https://ramsdenj.github.io/server/2016/01/01/FreeNAS-Server-Build.html)
We have a nice article to share with you this week by John Ramsden, which walks us through his home-brew FreeNAS server setup.
As is typical with most home users, he will be using the system to both serve media, and as a backup target for other systems.
His hardware setup is pretty impressive for a home-brew, made up of the following:
Fractal Design Node 804 Chassis
Supermicro X10SL7-F Motherboard
Xeon E3-1231 v3 CPU
4x Samsung DDR3 1.35v-1600 M391B1G73QH0 RAM
2x 32GB SATA III SMC DOM Boot Drive
SeaSonic G-550 Power Supply
Cyberpower CP1500PFCLCD 1500VA 900W PFC UPS
6x Western Digital 6TB Red HDD
2 x ENERMAX T.B. Silence UCTB12P Case Fan
3x Noctua NF-P14s redux-1200 Case Fan
The SATA DOM was neat to see in use, in his case in a mirror
He then walks us through his burn-in process, which involved memory testing for 46 hours, and then disk testing with the smartctl long tests. 
There is even details on how the fan thresholds were set up, which may be of use to other DiY’ers out there. 
The SATA DOM was neat to see in use, in his case in a mirror
He then walks us through his burn-in process, which involved memory testing for 46 hours, and then disk testing with the smartctl long tests. 
There is even details on how the fan thresholds were set up, which may be of use to other DiY’ers out there. 
claviger manages your SSH authorized_keys files for you (https://github.com/bwesterb/claviger)
An application to manage your SSH authorized_keys files for you
Make a list of your keys (laptop, desktop, work)
Then a list of your ssh accounts
List which keys should be present, and which should be absent
Optional setting to keep all “other” keys, such as those added by other users
Optional list of specific “other” keys to allow (does not add them, but does not remove them if they are present)
You say say ‘server2 like server1’, and it will inherit all of the settings from that server
There is a “default” server, that all others inherit
***
FreeBSD 9.2 x64 OpenVPN AD authentication with crypt (http://www.unixmen.com/openvpn-ad-authentication-with-crypt/)
A few days back unixmen.com posted a nice tutorial walkthrough of a OpenVPN setup on FreeBSD 9.2 using Active Directory for auth
In this particular setup, FreeBSD is running the gateway / OpenVPN server, the client desktops are running Windows 7 and domain controller on Windows 2008
The setup on FreeBSD pretty straightforward, thanks to the openvpn-auth-ldap port. (Unknown why they didn’t use the package)
In addition to showing the details on how configuration was done on BSD, what makes this walkthrough nice is the addition of so many screenshots of how the windows configuration was done. 
Part of the walkthrough will also detail how they created their .ovpn files for importing on the OpenVPN clients. 
***
Beastie Bits
dtrace included by default in NetBSD (http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.own.mk.diff?r1=1.883&amp;amp;r2=1.884&amp;amp;only_with_tag=MAIN&amp;amp;f=h) 
FOSDEM16 is approaching, get ready to follow the BSD devroom (https://fosdem.org/2016/schedule/track/bsd/) 
Call for testing: Concurrent: malloc(3) calls (to speed up Firefox) (http://undeadly.org/cgi?action=article&amp;amp;sid=20160123165549)
"With the PV drivers in -CURRENT, it is now possible to run OpenBSD within AWS." (http://daemonforums.org/showthread.php?p=57767) 
PC-BSD Handbook in Spanish (http://www.pcbsd.org/doc-archive/10.2/html-es/pcbsd.html) 
Feedback/Questions
 Clint - ZIL on Partition (http://pastebin.com/WLpHzz3F) 
 Federico - LibreSSL and DMA (http://pastebin.com/1QFZU2Bz) 
 Ghislain - FreeBSD vs Linux vs Illumos (http://pastebin.com/aesVaKG4) 
 Cary - ZFS - Caching - Replication (http://pastebin.com/x4DRHP0i) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we are going to be talking to Ken Moore about the Lumina desktop environment, where it stands now &amp; looking ahead. Then Allan turns the tables &amp; interviews both Kris &amp; Ken about new ongoings in PC-BSD land. Stay tuned, lots of exciting show is coming your way right now on BSDNow, the place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.linuxvoice.com/group-test-nas-distros/" rel="nofollow">Linuxvoice reviews six NAS designed OSes and states that FreeNAS has the largest amount of features</a></h3>

<ul>
<li>The review compares the features of: FreeNAS, NAS4Free, Open Media Vault, Openfiler Community Edition, EasyNAS, and Turnkey Linux File Server</li>
<li>“Many NAS solutions can do a lot more than just back up and restore files – you can extend them with plugins to do a variety of tasks. Some enable you to stream media to computers and others devices. Others can hook up with apps and services and allow them to use the NAS for storing and retrieving data”</li>
<li>Open Media Vault: 4/5, “A feature-rich NAS distro that’s easy to deploy and manage”. Many plugins, good UI</li>
<li>Turnkey Linux File Server: 2/5, “A no-fuss distro that’ll set up a fully functional file sharing server in no time”. No RAID, LVM must be down manually</li>
<li>Openfiler Community Edition: 1/5, “There is a target segment for Openfiler, but we can’t spot it”. In the middle of rebasing on CentOS, lacking documentation, confusing UI</li>
<li>EasyNAS: 3/5, “A simple NAS distro that balances the availability of features with reasonable assumptions”. Major updates require reinstall, lacks advanced features and advanced protocols</li>
<li>FreeNAS: 3/5, “FreeNAS The most feature-rich NAS distribution requires some getting used to”. Best documentation, best snapshot management, most plugins, jailed plugins, most enterprise features</li>
<li>NAS4Free: 3/5, “NAS4Free An advanced NAS distro that’s designed for advanced users”, additional flexibility with disk layout (partition the first disk to install the OS there, use remaining space for data storage)</li>
<li>“If we had to award this group test to the distro with the biggest number of features then the top two challengers would have been FreeNAS and its protegée NAS4Free. While both of these solutions pitch themselves to users outside the corporate environment, they’d simply be overkill for most home users. Furthermore, their FreeBSD base and the ZFS filesystem, while a boon to enterprise users, virtually makes them alien technology to the average Linux household.”</li>
<li>It is not clear why they gave NAS4Free and FreeNAS the same score when they wrote a list of reasons why FreeNAS was better.</li>
<li>It seems the goal of their rundown was to find the best Linux NAS, not the best NAS.
***</li>
</ul>

<h3><a href="http://www.unixmen.com/freebsd-snort-ips/" rel="nofollow">FreeBSD based Snort IPS</a></h3>

<ul>
<li>UnixMen.com provides a new tutorial on setting up Snort, the IPS (Intrusion Prevention system) on FreeBSD</li>
<li>Install Apache, PHP, and MySQL, then Snort</li>
<li>Download the latest Snort rules from the official website</li>
<li>Disable the Packet Filter on the USB interfaces to avoid issues with Snort</li>
<li>Install oinkmaster and barnyard2, and configure them</li>
<li>Then install the Snorby WEB interface, which will give you a nice overview of the data generated by the IPS</li>
<li>Then install SnortSAM, and connect it to ipfw</li>
<li>Now when Snort detects a potential intrusion, it will be displayed in Snorby, and automatically blocked with IPFW
***</li>
</ul>

<h3><a href="https://opensource.com/life/16/1/3-new-open-source-contributors-share-their-experiences" rel="nofollow">Opensource.com features two BSD developers as examples of how open source can help your career</a></h3>

<ul>
<li>“When contributing to open source projects and communities, one of the many benefits is that you can improve your tech skills. In this article, hear from three contributors on how their open source helped them get a job or improved their career.”</li>
<li>Alexander Yurchenko, an OpenBSD developer who now works at Yandex says: “Participating in such a project yields colossal experience. A good, large open source project has everything that is typically required from a developer at job interviews: good planning, good coding, use of versioning systems and bug trackers, peer reviews, teamwork, and such. So, after stewing in such an environment for a year or two, you have a good opportunity to grow to a senior developer level.”</li>
<li>“That is, in fact, what happened to me. I was hired as a senior developer without having any formal work experience on my service record. After the first week, my probation period was reduced from three months to zero.”</li>
<li>While you may not have “formal work experience”, you do have a body of work, a (code/documentation/etc) portfolio, you can point to</li>
<li>Having spent a year working somewhere may say something about you, but showing some code you wrote that other people use every day, is usually more valuable</li>
<li>Alexander Polyakov, a DragonFly contributor, worked on updating support for other languages and on ACPI.</li>
<li>“I even made some money in the process—a customer found me via git log. He wanted to use DragonFlyBSD in production and needed better ACPI support and some RAID driver or something.”</li>
<li>“In a nutshell, contributing to various open source projects is how you gain great experience. Don&#39;t be afraid to send in bad code (happens to the best of us), keep calm (while being scolded for sending in that bad code), and choose projects you are really interested in. Then you&#39;ll both gain experience and have fun while you doing it.”</li>
<li>Kirill Gorkunov talks about his experience with turning open source into a career: “For a few years, I&#39;ve been fixing the code, sending patches, getting scolded for bad code and complimented for good code. That experience was priceless. And you can be sure that as soon as you get good at it, job offers will follow. This is, in fact, how I met the kernel developers working on OpenVZ. Together, we decided to continue working on the OpenVZ kernel and related stuff as well”</li>
<li>When you contribute to open source, you end up being the person who wrote “Foo”, and this can often turn into work, when someone wants to build something with “Foo”, or like “Foo”</li>
<li>This same point was focus of a panel the FreeBSD Foundation organized at the womENcourage conference in Sweden last year: <a href="https://www.youtube.com/watch?v=p7PW1E3IJvY" rel="nofollow">Open Source as a Career Path
</a>
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/BernardSpil/LetsEncrypt" rel="nofollow">FreeBSD, LibreSSL and LetsEncrypt oh my!</a></h3>

<ul>
<li>Over on the FreeBSD Wiki, Bernard Spil (whom we’ve interviewed before) has started a walkthrough talking about how he uses LibreSSL and LetsEncrypt, without using the heavy python client</li>
<li>The article provides detailed instructions on prepping the system and automating the process of updating the SSL certificates</li>
<li>If you’ve used the “official” letsencrypt client in the past, you’ll note some differences in his method, which keeps all the ‘acme-challenge’ files in a single-directory, which is aliased into domains. </li>
<li>Using this method also drops the requirement to run the letsencrypt auth as root, and allows you to run it as the unprivileged “letsencrypt” user instead. </li>
<li>He mentions that the bash/zsh scripts used may be added to ports at some point as well
***</li>
</ul>

<h2>Interview - Ken Moore &amp; Kris Moore - <a href="mailto:ken@pcbsd.org" rel="nofollow">ken@pcbsd.org</a> / <a href="https://twitter.com/pcbsdkris" rel="nofollow">@pcbsdkris</a></h2>

<ul>
<li>PC-BSD’s new SysAdm Project and Lumina Update
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-January/459241.html" rel="nofollow">DragonFly Intel i915 support to match what’s in the Linux 4.1 kernel</a></h3>

<ul>
<li>In DragonFly’s ongoing quest for DRM awesomeness, they have now merged changes to bring them up to Linux 4.1 kernel features. </li>
<li>Some of the notables include that “Valleyview” support is greatly improved, and not considered preliminary anymore</li>
<li>Skylake got some support improvements as well, including runtime power management, and that turbo and sleep states should be functional. </li>
<li>Some great improvements to power usage have been added, such as setting GPU frequencies to hardware minimum and enabling of DRRS (Dynamic Refresh Rate Switching) being enabled by default</li>
<li>They’ve even begun importing some of the prelim work for Broxton, the upcoming Atom SOC
***</li>
</ul>

<h3><a href="https://ramsdenj.github.io/server/2016/01/01/FreeNAS-Server-Build.html" rel="nofollow">FreeNAS Home Server Build</a></h3>

<ul>
<li>We have a nice article to share with you this week by John Ramsden, which walks us through his home-brew FreeNAS server setup.</li>
<li>As is typical with most home users, he will be using the system to both serve media, and as a backup target for other systems.</li>
<li>His hardware setup is pretty impressive for a home-brew, made up of the following:

<ul>
<li>Fractal Design Node 804 Chassis</li>
<li>Supermicro X10SL7-F Motherboard</li>
<li>Xeon E3-1231 v3 CPU</li>
<li>4x Samsung DDR3 1.35v-1600 M391B1G73QH0 RAM</li>
<li>2x 32GB SATA III SMC DOM Boot Drive</li>
<li>SeaSonic G-550 Power Supply</li>
<li>Cyberpower CP1500PFCLCD 1500VA 900W PFC UPS</li>
<li>6x Western Digital 6TB Red HDD</li>
<li>2 x ENERMAX T.B. Silence UCTB12P Case Fan</li>
<li>3x Noctua NF-P14s redux-1200 Case Fan</li>
</ul></li>
<li>The SATA DOM was neat to see in use, in his case in a mirror</li>
<li>He then walks us through his burn-in process, which involved memory testing for 46 hours, and then disk testing with the smartctl long tests. </li>
<li><p>There is even details on how the fan thresholds were set up, which may be of use to other DiY’ers out there. </p></li>
<li><p>The SATA DOM was neat to see in use, in his case in a mirror</p></li>
<li><p>He then walks us through his burn-in process, which involved memory testing for 46 hours, and then disk testing with the smartctl long tests. </p></li>
<li><p>There is even details on how the fan thresholds were set up, which may be of use to other DiY’ers out there. </p>

<hr></li>
</ul>

<h3><a href="https://github.com/bwesterb/claviger" rel="nofollow">claviger manages your SSH authorized_keys files for you</a></h3>

<ul>
<li>An application to manage your SSH authorized_keys files for you</li>
<li>Make a list of your keys (laptop, desktop, work)</li>
<li>Then a list of your ssh accounts</li>
<li>List which keys should be present, and which should be absent</li>
<li>Optional setting to keep all “other” keys, such as those added by other users</li>
<li>Optional list of specific “other” keys to allow (does not add them, but does not remove them if they are present)</li>
<li>You say say ‘server2 like server1’, and it will inherit all of the settings from that server</li>
<li>There is a “default” server, that all others inherit
***</li>
</ul>

<h3><a href="http://www.unixmen.com/openvpn-ad-authentication-with-crypt/" rel="nofollow">FreeBSD 9.2 x64 OpenVPN AD authentication with crypt</a></h3>

<ul>
<li>A few days back unixmen.com posted a nice tutorial walkthrough of a OpenVPN setup on FreeBSD 9.2 using Active Directory for auth</li>
<li>In this particular setup, FreeBSD is running the gateway / OpenVPN server, the client desktops are running Windows 7 and domain controller on Windows 2008</li>
<li>The setup on FreeBSD pretty straightforward, thanks to the openvpn-auth-ldap port. (Unknown why they didn’t use the package)</li>
<li>In addition to showing the details on how configuration was done on BSD, what makes this walkthrough nice is the addition of so many screenshots of how the windows configuration was done. </li>
<li>Part of the walkthrough will also detail how they created their .ovpn files for importing on the OpenVPN clients. 
***</li>
</ul>

<h3>Beastie Bits</h3>

<p><a href="http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.own.mk.diff?r1=1.883&r2=1.884&only_with_tag=MAIN&f=h" rel="nofollow">dtrace included by default in NetBSD</a> </p>

<p><a href="https://fosdem.org/2016/schedule/track/bsd/" rel="nofollow">FOSDEM16 is approaching, get ready to follow the BSD devroom</a> </p>

<p><a href="http://undeadly.org/cgi?action=article&sid=20160123165549" rel="nofollow">Call for testing: Concurrent: malloc(3) calls (to speed up Firefox)</a></p>

<p><a href="http://daemonforums.org/showthread.php?p=57767" rel="nofollow">&quot;With the PV drivers in -CURRENT, it is now possible to run OpenBSD within AWS.&quot;</a> </p>

<p><a href="http://www.pcbsd.org/doc-archive/10.2/html-es/pcbsd.html" rel="nofollow">PC-BSD Handbook in Spanish</a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/WLpHzz3F" rel="nofollow"> Clint - ZIL on Partition</a> </li>
<li><a href="http://pastebin.com/1QFZU2Bz" rel="nofollow"> Federico - LibreSSL and DMA</a> </li>
<li><a href="http://pastebin.com/aesVaKG4" rel="nofollow"> Ghislain - FreeBSD vs Linux vs Illumos</a> </li>
<li><a href="http://pastebin.com/x4DRHP0i" rel="nofollow"> Cary - ZFS - Caching - Replication</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we are going to be talking to Ken Moore about the Lumina desktop environment, where it stands now &amp; looking ahead. Then Allan turns the tables &amp; interviews both Kris &amp; Ken about new ongoings in PC-BSD land. Stay tuned, lots of exciting show is coming your way right now on BSDNow, the place to B...SD!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.linuxvoice.com/group-test-nas-distros/" rel="nofollow">Linuxvoice reviews six NAS designed OSes and states that FreeNAS has the largest amount of features</a></h3>

<ul>
<li>The review compares the features of: FreeNAS, NAS4Free, Open Media Vault, Openfiler Community Edition, EasyNAS, and Turnkey Linux File Server</li>
<li>“Many NAS solutions can do a lot more than just back up and restore files – you can extend them with plugins to do a variety of tasks. Some enable you to stream media to computers and others devices. Others can hook up with apps and services and allow them to use the NAS for storing and retrieving data”</li>
<li>Open Media Vault: 4/5, “A feature-rich NAS distro that’s easy to deploy and manage”. Many plugins, good UI</li>
<li>Turnkey Linux File Server: 2/5, “A no-fuss distro that’ll set up a fully functional file sharing server in no time”. No RAID, LVM must be down manually</li>
<li>Openfiler Community Edition: 1/5, “There is a target segment for Openfiler, but we can’t spot it”. In the middle of rebasing on CentOS, lacking documentation, confusing UI</li>
<li>EasyNAS: 3/5, “A simple NAS distro that balances the availability of features with reasonable assumptions”. Major updates require reinstall, lacks advanced features and advanced protocols</li>
<li>FreeNAS: 3/5, “FreeNAS The most feature-rich NAS distribution requires some getting used to”. Best documentation, best snapshot management, most plugins, jailed plugins, most enterprise features</li>
<li>NAS4Free: 3/5, “NAS4Free An advanced NAS distro that’s designed for advanced users”, additional flexibility with disk layout (partition the first disk to install the OS there, use remaining space for data storage)</li>
<li>“If we had to award this group test to the distro with the biggest number of features then the top two challengers would have been FreeNAS and its protegée NAS4Free. While both of these solutions pitch themselves to users outside the corporate environment, they’d simply be overkill for most home users. Furthermore, their FreeBSD base and the ZFS filesystem, while a boon to enterprise users, virtually makes them alien technology to the average Linux household.”</li>
<li>It is not clear why they gave NAS4Free and FreeNAS the same score when they wrote a list of reasons why FreeNAS was better.</li>
<li>It seems the goal of their rundown was to find the best Linux NAS, not the best NAS.
***</li>
</ul>

<h3><a href="http://www.unixmen.com/freebsd-snort-ips/" rel="nofollow">FreeBSD based Snort IPS</a></h3>

<ul>
<li>UnixMen.com provides a new tutorial on setting up Snort, the IPS (Intrusion Prevention system) on FreeBSD</li>
<li>Install Apache, PHP, and MySQL, then Snort</li>
<li>Download the latest Snort rules from the official website</li>
<li>Disable the Packet Filter on the USB interfaces to avoid issues with Snort</li>
<li>Install oinkmaster and barnyard2, and configure them</li>
<li>Then install the Snorby WEB interface, which will give you a nice overview of the data generated by the IPS</li>
<li>Then install SnortSAM, and connect it to ipfw</li>
<li>Now when Snort detects a potential intrusion, it will be displayed in Snorby, and automatically blocked with IPFW
***</li>
</ul>

<h3><a href="https://opensource.com/life/16/1/3-new-open-source-contributors-share-their-experiences" rel="nofollow">Opensource.com features two BSD developers as examples of how open source can help your career</a></h3>

<ul>
<li>“When contributing to open source projects and communities, one of the many benefits is that you can improve your tech skills. In this article, hear from three contributors on how their open source helped them get a job or improved their career.”</li>
<li>Alexander Yurchenko, an OpenBSD developer who now works at Yandex says: “Participating in such a project yields colossal experience. A good, large open source project has everything that is typically required from a developer at job interviews: good planning, good coding, use of versioning systems and bug trackers, peer reviews, teamwork, and such. So, after stewing in such an environment for a year or two, you have a good opportunity to grow to a senior developer level.”</li>
<li>“That is, in fact, what happened to me. I was hired as a senior developer without having any formal work experience on my service record. After the first week, my probation period was reduced from three months to zero.”</li>
<li>While you may not have “formal work experience”, you do have a body of work, a (code/documentation/etc) portfolio, you can point to</li>
<li>Having spent a year working somewhere may say something about you, but showing some code you wrote that other people use every day, is usually more valuable</li>
<li>Alexander Polyakov, a DragonFly contributor, worked on updating support for other languages and on ACPI.</li>
<li>“I even made some money in the process—a customer found me via git log. He wanted to use DragonFlyBSD in production and needed better ACPI support and some RAID driver or something.”</li>
<li>“In a nutshell, contributing to various open source projects is how you gain great experience. Don&#39;t be afraid to send in bad code (happens to the best of us), keep calm (while being scolded for sending in that bad code), and choose projects you are really interested in. Then you&#39;ll both gain experience and have fun while you doing it.”</li>
<li>Kirill Gorkunov talks about his experience with turning open source into a career: “For a few years, I&#39;ve been fixing the code, sending patches, getting scolded for bad code and complimented for good code. That experience was priceless. And you can be sure that as soon as you get good at it, job offers will follow. This is, in fact, how I met the kernel developers working on OpenVZ. Together, we decided to continue working on the OpenVZ kernel and related stuff as well”</li>
<li>When you contribute to open source, you end up being the person who wrote “Foo”, and this can often turn into work, when someone wants to build something with “Foo”, or like “Foo”</li>
<li>This same point was focus of a panel the FreeBSD Foundation organized at the womENcourage conference in Sweden last year: <a href="https://www.youtube.com/watch?v=p7PW1E3IJvY" rel="nofollow">Open Source as a Career Path
</a>
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/BernardSpil/LetsEncrypt" rel="nofollow">FreeBSD, LibreSSL and LetsEncrypt oh my!</a></h3>

<ul>
<li>Over on the FreeBSD Wiki, Bernard Spil (whom we’ve interviewed before) has started a walkthrough talking about how he uses LibreSSL and LetsEncrypt, without using the heavy python client</li>
<li>The article provides detailed instructions on prepping the system and automating the process of updating the SSL certificates</li>
<li>If you’ve used the “official” letsencrypt client in the past, you’ll note some differences in his method, which keeps all the ‘acme-challenge’ files in a single-directory, which is aliased into domains. </li>
<li>Using this method also drops the requirement to run the letsencrypt auth as root, and allows you to run it as the unprivileged “letsencrypt” user instead. </li>
<li>He mentions that the bash/zsh scripts used may be added to ports at some point as well
***</li>
</ul>

<h2>Interview - Ken Moore &amp; Kris Moore - <a href="mailto:ken@pcbsd.org" rel="nofollow">ken@pcbsd.org</a> / <a href="https://twitter.com/pcbsdkris" rel="nofollow">@pcbsdkris</a></h2>

<ul>
<li>PC-BSD’s new SysAdm Project and Lumina Update
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2016-January/459241.html" rel="nofollow">DragonFly Intel i915 support to match what’s in the Linux 4.1 kernel</a></h3>

<ul>
<li>In DragonFly’s ongoing quest for DRM awesomeness, they have now merged changes to bring them up to Linux 4.1 kernel features. </li>
<li>Some of the notables include that “Valleyview” support is greatly improved, and not considered preliminary anymore</li>
<li>Skylake got some support improvements as well, including runtime power management, and that turbo and sleep states should be functional. </li>
<li>Some great improvements to power usage have been added, such as setting GPU frequencies to hardware minimum and enabling of DRRS (Dynamic Refresh Rate Switching) being enabled by default</li>
<li>They’ve even begun importing some of the prelim work for Broxton, the upcoming Atom SOC
***</li>
</ul>

<h3><a href="https://ramsdenj.github.io/server/2016/01/01/FreeNAS-Server-Build.html" rel="nofollow">FreeNAS Home Server Build</a></h3>

<ul>
<li>We have a nice article to share with you this week by John Ramsden, which walks us through his home-brew FreeNAS server setup.</li>
<li>As is typical with most home users, he will be using the system to both serve media, and as a backup target for other systems.</li>
<li>His hardware setup is pretty impressive for a home-brew, made up of the following:

<ul>
<li>Fractal Design Node 804 Chassis</li>
<li>Supermicro X10SL7-F Motherboard</li>
<li>Xeon E3-1231 v3 CPU</li>
<li>4x Samsung DDR3 1.35v-1600 M391B1G73QH0 RAM</li>
<li>2x 32GB SATA III SMC DOM Boot Drive</li>
<li>SeaSonic G-550 Power Supply</li>
<li>Cyberpower CP1500PFCLCD 1500VA 900W PFC UPS</li>
<li>6x Western Digital 6TB Red HDD</li>
<li>2 x ENERMAX T.B. Silence UCTB12P Case Fan</li>
<li>3x Noctua NF-P14s redux-1200 Case Fan</li>
</ul></li>
<li>The SATA DOM was neat to see in use, in his case in a mirror</li>
<li>He then walks us through his burn-in process, which involved memory testing for 46 hours, and then disk testing with the smartctl long tests. </li>
<li><p>There is even details on how the fan thresholds were set up, which may be of use to other DiY’ers out there. </p></li>
<li><p>The SATA DOM was neat to see in use, in his case in a mirror</p></li>
<li><p>He then walks us through his burn-in process, which involved memory testing for 46 hours, and then disk testing with the smartctl long tests. </p></li>
<li><p>There is even details on how the fan thresholds were set up, which may be of use to other DiY’ers out there. </p>

<hr></li>
</ul>

<h3><a href="https://github.com/bwesterb/claviger" rel="nofollow">claviger manages your SSH authorized_keys files for you</a></h3>

<ul>
<li>An application to manage your SSH authorized_keys files for you</li>
<li>Make a list of your keys (laptop, desktop, work)</li>
<li>Then a list of your ssh accounts</li>
<li>List which keys should be present, and which should be absent</li>
<li>Optional setting to keep all “other” keys, such as those added by other users</li>
<li>Optional list of specific “other” keys to allow (does not add them, but does not remove them if they are present)</li>
<li>You say say ‘server2 like server1’, and it will inherit all of the settings from that server</li>
<li>There is a “default” server, that all others inherit
***</li>
</ul>

<h3><a href="http://www.unixmen.com/openvpn-ad-authentication-with-crypt/" rel="nofollow">FreeBSD 9.2 x64 OpenVPN AD authentication with crypt</a></h3>

<ul>
<li>A few days back unixmen.com posted a nice tutorial walkthrough of a OpenVPN setup on FreeBSD 9.2 using Active Directory for auth</li>
<li>In this particular setup, FreeBSD is running the gateway / OpenVPN server, the client desktops are running Windows 7 and domain controller on Windows 2008</li>
<li>The setup on FreeBSD pretty straightforward, thanks to the openvpn-auth-ldap port. (Unknown why they didn’t use the package)</li>
<li>In addition to showing the details on how configuration was done on BSD, what makes this walkthrough nice is the addition of so many screenshots of how the windows configuration was done. </li>
<li>Part of the walkthrough will also detail how they created their .ovpn files for importing on the OpenVPN clients. 
***</li>
</ul>

<h3>Beastie Bits</h3>

<p><a href="http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.own.mk.diff?r1=1.883&r2=1.884&only_with_tag=MAIN&f=h" rel="nofollow">dtrace included by default in NetBSD</a> </p>

<p><a href="https://fosdem.org/2016/schedule/track/bsd/" rel="nofollow">FOSDEM16 is approaching, get ready to follow the BSD devroom</a> </p>

<p><a href="http://undeadly.org/cgi?action=article&sid=20160123165549" rel="nofollow">Call for testing: Concurrent: malloc(3) calls (to speed up Firefox)</a></p>

<p><a href="http://daemonforums.org/showthread.php?p=57767" rel="nofollow">&quot;With the PV drivers in -CURRENT, it is now possible to run OpenBSD within AWS.&quot;</a> </p>

<p><a href="http://www.pcbsd.org/doc-archive/10.2/html-es/pcbsd.html" rel="nofollow">PC-BSD Handbook in Spanish</a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://pastebin.com/WLpHzz3F" rel="nofollow"> Clint - ZIL on Partition</a> </li>
<li><a href="http://pastebin.com/1QFZU2Bz" rel="nofollow"> Federico - LibreSSL and DMA</a> </li>
<li><a href="http://pastebin.com/aesVaKG4" rel="nofollow"> Ghislain - FreeBSD vs Linux vs Illumos</a> </li>
<li><a href="http://pastebin.com/x4DRHP0i" rel="nofollow"> Cary - ZFS - Caching - Replication</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>125: DevSummits, Core and the Baldwin</title>
  <link>https://www.bsdnow.tv/125</link>
  <guid isPermaLink="false">089fc2b7-be76-41de-bbf3-016592d78ef5</guid>
  <pubDate>Wed, 20 Jan 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/089fc2b7-be76-41de-bbf3-016592d78ef5.mp3" length="96359764" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we will be talking to FreeBSD developer and former core-team member John Baldwin about a variety of topics, including running a DevSummit, everything you needed or wanted to know. Coming up right now on BSDNow, the place to B...SD.</itunes:subtitle>
  <itunes:duration>2:13:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we will be talking to FreeBSD developer and former core-team member John Baldwin about a variety of topics, including running a DevSummit, everything you needed or wanted to know. Coming up right now on BSDNow, the place to B...SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD server retired after almost 19 years (http://www.theregister.co.uk/2016/01/14/server_retired_after_18_years_and_ten_months_beat_that_readers/)
We’ve heard stories about this kind of thing before, that box that often sits under-appreciated, but refuses to die. Well the UK register has picked up on a story of a FreeBSD server finally being retired after almost 19 years of dedicated service.
“In its day, it was a reasonable machine - 200MHz Pentium, 32MB RAM, 4GB SCSI-2 drive,” Ross writes. “And up until recently, it was doing its job fine.” Of late, however the “hard drive finally started throwing errors, it was time to retire it before it gave up the ghost!” The drive's a Seagate, for those of you looking to avoid drives that can't deliver more than 19 years of error-free operations.
This system in particular had been running FreeBSD 2.2.1 over the years. Why not upgrade you ask? Ross has an answer for that:
“It was heavily firewalled and only very specific services were visible to anyone, and most only visible to our directly connected customers,” Ross told Vulture South. “By the time it was probably due for a review, things had moved so far that all the original code was so tightly bound to the operating system itself, that later versions of the OS would have (and ultimately, did) require substantial rework. While it was running and not showing any signs of stress, it was simply expedient to leave sleeping dogs lie.”
All in all, an amazing story of the longevity of a system and its operating system. Do you have a server with a similar or even greater uptime? Let us know so we can try and top this story.
***
Roundup of all the BSDs (https://www.linuxvoice.com/group-test-bsd-distros/)
The magazine LinuxVoice recently did a group test of a variety of “BSD Distros”.
Included in their review were Free/Open/Net/Dragon/Ghost/PC
It starts with a pretty good overview of BSD in general, its starts and the various projects / forks that spawned from it, such as FreeNAS / Junos / Playstation / PFSense / etc
The review starts with a look at OpenBSD, and the consensus reached is that it is good, but does require a bit more manual work to run as a desktop. (Most of the review focuses on desktop usage). It ends up with a solid ⅘ stars though. 
Next it moves into GhostBSD, discusses it being a “Live” distro, which can optionally be installed to disk. It loses a few points for lacking a graphical package management utility, and some bugs during the installation, but still earns a respectable ⅗ stars.
Dragonfly gets the next spin and gets praise for its very-up to date video driver support and availability of the HAMMER filesystem. It also lands at ⅗ stars, partly due to the reviewer having to use the command-line for management. (Notice a trend here?)
NetBSD is up next, and gets special mention for being one of the only “distros” that doesn’t do frequent releases. However that doesn’t mean you can’t have updated packages, since the review mentions pkgsrc and pkg as both available to customize your desktop. The reviewer was slightly haunted by having to edit files in /etc by hand to do wireless, but still gives NetBSD a ⅗ overall. 
Last up are FreeBSD and PC-BSD, which get a different sort of head-to-head review. FreeBSD goes first, with mention that the text-install is fairly straight-forward and most configuration will require being done by hand. However the reviewer must be getting use to the command-line at this point, because he mentions:
“This might sound cumbersome, but is actually pretty straightforward and at the end produces a finely tuned aerodynamic system that does exactly what you want it to do and nothing else.”
He does mention that FreeBSD is the ultimate DIY system, even to the point of not having the package management tools provided out of box. 
PC-BSD ultimately gets a lot of love in this review, again with it being focused on desktop usage this follows. Particularly popular are all the various tools written to make PC-BSD easier to use, such as Life-Preserver, Warden, the graphical installer and more. (slight mistake though, Life-Preserver does not use rsync to backup to FreeNAS, it does ZFS replication)
In the end he rates FreeBSD ⅘ and PC-BSD a whopping 5/5 for this roundup. 
While reviews may be subjective to the particular use-case being evaluated for, it is still nice to see BSD getting some press and more interest from the Linux community in general. 
***
OpenBSD Laptops (http://www.tedunangst.com/flak/post/openbsd-laptops)
Our buddy Ted Unangst has posted a nice “planning ahead” guide for those thinking of new laptops for 2016 and the upcoming OpenBSD 5.9
He starts by giving us a status update on several of the key driver components that will be in 5.9 release“5.9 will be the first release to support the graphics on Broadwell CPUs. This is anything that looks like i5-5xxx. There are a few minor quirks, but generally it works well. There’s no support for the new Skylake models, however. They’ll probably work with the VESA driver but minus suspend/resume/acceleration (just as 5.8 did with Broadwell).”
He then goes on to mention that the IWM driver works well with most of the revisions (7260, 7265, and 3160) that ship with broadwell based laptops, however the newer skylake series ships with the 8260, which is NOT yet supported.
He then goes on to list some of the more common makes and models to look for, starting with the broadwell based X1 carbons which work really well (Kris gives +++), but make sure its not the newer skylake model just yet.
The macbook gets a mention, but probably should be avoided due to broadcom wifi
The Dell XPS he mentions as a good choice for a powerful (portable) desktops
***
Significant changes from NetBSD 7.0 to 8.0 (https://www.netbsd.org/changes/changes-8.0.html)
Updated to GCC 4.8.5
Imported dhcpcd and replaced rtsol and rtsold
gpt(8) utility gained the ability to resize partitions and disks, as well as change the type of a partition
OpenSSH 7.1 and OpenSSL 1.0.1q
FTP client got support for SNI for https
Imported dtrace from FreeBSD
Add syscall support
Add lockstat support
***
Interview - John Baldwin - jhb@freebsd.org (mailto:jhb@freebsd.org) / @BSDHokie (https://twitter.com/BSDHokie)
FreeBSD Kernel Debugging
News Roundup
Dragonfly Mail Agent spreads to FreeBSD and NetBSD (https://www.dragonflydigest.com/2016/01/18/17508.html)
DMA, the Dragonfly Mail Agent is now available not only in Dragonfly’s dports, but also FreeBSD ports, and NetBSD pkgsrc
“dma is a small Mail Transport Agent (MTA), designed for home and office use.  It accepts mails from locally installed Mail User Agents (MUA) and delivers the mails either locally or to a remote destination.  Remote delivery includes several features like TLS/SSL support and SMTP authentication. dma is not intended as a replacement for real, big MTAs like sendmail(8) or postfix(1).  Consequently, dma does not listen on port 25 for incoming connections.”
There was a project looking at importing DMA into the FreeBSD base system to replace sendmail, I wonder of the port signals that some of the blockers have been fixed
***
ZFS UEFI Support has landed! (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=294068)
Originally started by Eric McCorkle
Picked up by Steven Hartland
Including modularizing the existing UFS boot code, and adding ZFS boot code
General improvements to the EFI loader including using more of libstand instead of containing its own implementations of many common functions
Thanks to work by Toomas Soome, there is now a Beastie Menu as part of the EFI loader, similar to the regular loader
As soon as this was committed, I added a few lines to it to connect the ZFS BE Menu to it, thanks to all of the above, without whom my work wouldn’t be usable
It should be relatively easy to hook my GELI boot stuff in as a module, and possibly just stack the UFS and ZFS modules on top of it
I might try to redesign the non-EFI boot code to use a similar design instead of what I have now
***
How three BSD OSes compare to ten Linux Distros (http://www.phoronix.com/scan.php?page=article&amp;amp;item=3bsd-10linux)
After benchmarking 10 of the latest Linux distros, Phoronix took to benchmarking 3 of the big BSDs
DragonFlyBSD 4.4.1 - The latest DragonFly release with GCC 5.2.1 and the HAMMER file-system.
OpenBSD 5.8 - OpenBSD 5.8 with GCC 4.2.1 as the default compiler and FFS file-system.
PC-BSD 10.2 - Derived off FreeBSD 10.2, the defaults were the Clang 3.4.1 compiler and ZFS file-system.
In the SQLite test, PCBSD+ZFS won out over all of the Linux distros, including those that were also using ZFS
In the first compile benchmark, PCBSD came second only to Intel’s Linux distro, Clear Linux. OpenBSD can last, although it is not clear if the benchmark was just comparing the system compiler, which would be unfair to OpenBSD
In Disk transaction performance, against ZFS won the day, with PCBSD edging out the Linux distros. OpenBSD’s older ffs was hurt by the lack of soft updates, and DragonFly’s Hammer did not perform well. Although in an fsync() heavy test, safety is more important that speed
As with all benchmarks, these obviously need to be taken with a grain of salt
In some of them you can clearly see that the ‘winner’ has a much higher standard error, suggesting that the numbers are quite variable
***
OPNSense 15.7.24 Released (https://opnsense.org/opnsense-15-7-24-released/)
We are just barely into the new year and OPNSense has dropped a new release on us to play with. 
This new version, 15.7.24 brings a bunch of notable changes, which includes improvements to the firewall UI and a plugin management section of the firmware page. Additionally better signature verification using PKG’s internal verification mechanisms was added for kernel and world updates.
The announcement contains the full rundown of changes, including the suricata, openvpn and ntp got package bumps as well. 
***
Beastie Bits
A FreeBSD 10 Desktop How-to (https://cooltrainer.org/a-freebsd-desktop-howto/) (A bit old, but still one of the most complete walkthroughs of a desktop FreeBSD setup from scratch)
BSD and Scale 14 (http://fossforce.com/2016/01/bsd-ready-scale-14x/)
Xen support enabled in OpenBSD -current (http://undeadly.org/cgi?action=article&amp;amp;sid=20160114113445&amp;amp;mode=expanded)
Feedback/Questions
 Matt - Zil Sizes (http://slexy.org/view/s20a0mLaAv) 
 Drin - IPSEC (http://slexy.org/view/s21qpiTF8h) 
 John - ZFS + UEFI (http://slexy.org/view/s2HCq0r0aD) 
 Jake - ZFS Cluster SAN (http://slexy.org/view/s2VORfyqlS) 
 Phillip - Media Server (http://slexy.org/view/s20ycRhUkM) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we will be talking to FreeBSD developer and former core-team member John Baldwin about a variety of topics, including running a DevSummit, everything you needed or wanted to know. Coming up right now on BSDNow, the place to B...SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.theregister.co.uk/2016/01/14/server_retired_after_18_years_and_ten_months_beat_that_readers/" rel="nofollow">FreeBSD server retired after almost 19 years</a></h3>

<ul>
<li>We’ve heard stories about this kind of thing before, that box that often sits under-appreciated, but refuses to die. Well the UK register has picked up on a story of a FreeBSD server finally being retired after almost 19 years of dedicated service.</li>
</ul>

<p>“In its day, it was a reasonable machine - 200MHz Pentium, 32MB RAM, 4GB SCSI-2 drive,” Ross writes. “And up until recently, it was doing its job fine.” Of late, however the “hard drive finally started throwing errors, it was time to retire it before it gave up the ghost!” The drive&#39;s a Seagate, for those of you looking to avoid drives that can&#39;t deliver more than 19 years of error-free operations.</p>

<ul>
<li>This system in particular had been running FreeBSD 2.2.1 over the years. Why not upgrade you ask? Ross has an answer for that:</li>
</ul>

<p>“It was heavily firewalled and only very specific services were visible to anyone, and most only visible to our directly connected customers,” Ross told Vulture South. “By the time it was probably due for a review, things had moved so far that all the original code was so tightly bound to the operating system itself, that later versions of the OS would have (and ultimately, did) require substantial rework. While it was running and not showing any signs of stress, it was simply expedient to leave sleeping dogs lie.”</p>

<ul>
<li>All in all, an amazing story of the longevity of a system and its operating system. Do you have a server with a similar or even greater uptime? Let us know so we can try and top this story.
***</li>
</ul>

<h3><a href="https://www.linuxvoice.com/group-test-bsd-distros/" rel="nofollow">Roundup of all the BSDs</a></h3>

<ul>
<li>The magazine LinuxVoice recently did a group test of a variety of “BSD Distros”.</li>
<li>Included in their review were Free/Open/Net/Dragon/Ghost/PC</li>
<li>It starts with a pretty good overview of BSD in general, its starts and the various projects / forks that spawned from it, such as FreeNAS / Junos / Playstation / PFSense / etc</li>
<li>The review starts with a look at OpenBSD, and the consensus reached is that it is good, but does require a bit more manual work to run as a desktop. (Most of the review focuses on desktop usage). It ends up with a solid ⅘ stars though. </li>
<li>Next it moves into GhostBSD, discusses it being a “Live” distro, which can optionally be installed to disk. It loses a few points for lacking a graphical package management utility, and some bugs during the installation, but still earns a respectable ⅗ stars.</li>
<li>Dragonfly gets the next spin and gets praise for its very-up to date video driver support and availability of the HAMMER filesystem. It also lands at ⅗ stars, partly due to the reviewer having to use the command-line for management. (Notice a trend here?)</li>
<li>NetBSD is up next, and gets special mention for being one of the only “distros” that doesn’t do frequent releases. However that doesn’t mean you can’t have updated packages, since the review mentions pkgsrc and pkg as both available to customize your desktop. The reviewer was slightly haunted by having to edit files in /etc by hand to do wireless, but still gives NetBSD a ⅗ overall. </li>
<li>Last up are FreeBSD and PC-BSD, which get a different sort of head-to-head review. FreeBSD goes first, with mention that the text-install is fairly straight-forward and most configuration will require being done by hand. However the reviewer must be getting use to the command-line at this point, because he mentions:</li>
</ul>

<p>“This might sound cumbersome, but is actually pretty straightforward and at the end produces a finely tuned aerodynamic system that does exactly what you want it to do and nothing else.”</p>

<ul>
<li>He does mention that FreeBSD is the ultimate DIY system, even to the point of not having the package management tools provided out of box. </li>
<li>PC-BSD ultimately gets a lot of love in this review, again with it being focused on desktop usage this follows. Particularly popular are all the various tools written to make PC-BSD easier to use, such as Life-Preserver, Warden, the graphical installer and more. (slight mistake though, Life-Preserver does not use rsync to backup to FreeNAS, it does ZFS replication)</li>
<li>In the end he rates FreeBSD ⅘ and PC-BSD a whopping 5/5 for this roundup. </li>
<li>While reviews may be subjective to the particular use-case being evaluated for, it is still nice to see BSD getting some press and more interest from the Linux community in general. 
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/openbsd-laptops" rel="nofollow">OpenBSD Laptops</a></h3>

<ul>
<li>Our buddy Ted Unangst has posted a nice “planning ahead” guide for those thinking of new laptops for 2016 and the upcoming OpenBSD 5.9</li>
<li>He starts by giving us a status update on several of the key driver components that will be in 5.9 release“5.9 will be the first release to support the graphics on Broadwell CPUs. This is anything that looks like i5-5xxx. There are a few minor quirks, but generally it works well. There’s no support for the new Skylake models, however. They’ll probably work with the VESA driver but minus suspend/resume/acceleration (just as 5.8 did with Broadwell).”</li>
<li>He then goes on to mention that the IWM driver works well with most of the revisions (7260, 7265, and 3160) that ship with broadwell based laptops, however the newer skylake series ships with the 8260, which is NOT yet supported.</li>
<li>He then goes on to list some of the more common makes and models to look for, starting with the broadwell based X1 carbons which work really well (Kris gives +++), but make sure its not the newer skylake model just yet.</li>
<li>The macbook gets a mention, but probably should be avoided due to broadcom wifi</li>
<li>The Dell XPS he mentions as a good choice for a powerful (portable) desktops
***</li>
</ul>

<h3><a href="https://www.netbsd.org/changes/changes-8.0.html" rel="nofollow">Significant changes from NetBSD 7.0 to 8.0</a></h3>

<ul>
<li>Updated to GCC 4.8.5</li>
<li>Imported dhcpcd and replaced rtsol and rtsold</li>
<li>gpt(8) utility gained the ability to resize partitions and disks, as well as change the type of a partition</li>
<li>OpenSSH 7.1 and OpenSSL 1.0.1q</li>
<li>FTP client got support for SNI for https</li>
<li>Imported dtrace from FreeBSD</li>
<li>Add syscall support</li>
<li>Add lockstat support
***</li>
</ul>

<h2>Interview - John Baldwin - <a href="mailto:jhb@freebsd.org" rel="nofollow">jhb@freebsd.org</a> / <a href="https://twitter.com/BSDHokie" rel="nofollow">@BSDHokie</a></h2>

<p>FreeBSD Kernel Debugging</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.dragonflydigest.com/2016/01/18/17508.html" rel="nofollow">Dragonfly Mail Agent spreads to FreeBSD and NetBSD</a></h3>

<ul>
<li>DMA, the Dragonfly Mail Agent is now available not only in Dragonfly’s dports, but also FreeBSD ports, and NetBSD pkgsrc</li>
<li>“dma is a small Mail Transport Agent (MTA), designed for home and office use.  It accepts mails from locally installed Mail User Agents (MUA) and delivers the mails either locally or to a remote destination.  Remote delivery includes several features like TLS/SSL support and SMTP authentication. dma is not intended as a replacement for real, big MTAs like sendmail(8) or postfix(1).  Consequently, dma does not listen on port 25 for incoming connections.”</li>
<li>There was a project looking at importing DMA into the FreeBSD base system to replace sendmail, I wonder of the port signals that some of the blockers have been fixed
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=294068" rel="nofollow">ZFS UEFI Support has landed!</a></h3>

<ul>
<li>Originally started by Eric McCorkle</li>
<li>Picked up by Steven Hartland</li>
<li>Including modularizing the existing UFS boot code, and adding ZFS boot code</li>
<li>General improvements to the EFI loader including using more of libstand instead of containing its own implementations of many common functions</li>
<li>Thanks to work by Toomas Soome, there is now a Beastie Menu as part of the EFI loader, similar to the regular loader</li>
<li>As soon as this was committed, I added a few lines to it to connect the ZFS BE Menu to it, thanks to all of the above, without whom my work wouldn’t be usable</li>
<li>It should be relatively easy to hook my GELI boot stuff in as a module, and possibly just stack the UFS and ZFS modules on top of it</li>
<li>I might try to redesign the non-EFI boot code to use a similar design instead of what I have now
***</li>
</ul>

<h3><a href="http://www.phoronix.com/scan.php?page=article&item=3bsd-10linux" rel="nofollow">How three BSD OSes compare to ten Linux Distros</a></h3>

<ul>
<li>After benchmarking 10 of the latest Linux distros, Phoronix took to benchmarking 3 of the big BSDs</li>
<li>DragonFlyBSD 4.4.1 - The latest DragonFly release with GCC 5.2.1 and the HAMMER file-system.</li>
<li>OpenBSD 5.8 - OpenBSD 5.8 with GCC 4.2.1 as the default compiler and FFS file-system.</li>
<li>PC-BSD 10.2 - Derived off FreeBSD 10.2, the defaults were the Clang 3.4.1 compiler and ZFS file-system.</li>
<li>In the SQLite test, PCBSD+ZFS won out over all of the Linux distros, including those that were also using ZFS</li>
<li>In the first compile benchmark, PCBSD came second only to Intel’s Linux distro, Clear Linux. OpenBSD can last, although it is not clear if the benchmark was just comparing the system compiler, which would be unfair to OpenBSD</li>
<li>In Disk transaction performance, against ZFS won the day, with PCBSD edging out the Linux distros. OpenBSD’s older ffs was hurt by the lack of soft updates, and DragonFly’s Hammer did not perform well. Although in an fsync() heavy test, safety is more important that speed</li>
<li>As with all benchmarks, these obviously need to be taken with a grain of salt</li>
<li>In some of them you can clearly see that the ‘winner’ has a much higher standard error, suggesting that the numbers are quite variable
***</li>
</ul>

<h3><a href="https://opnsense.org/opnsense-15-7-24-released/" rel="nofollow">OPNSense 15.7.24 Released</a></h3>

<ul>
<li>We are just barely into the new year and OPNSense has dropped a new release on us to play with. </li>
<li>This new version, 15.7.24 brings a bunch of notable changes, which includes improvements to the firewall UI and a plugin management section of the firmware page. Additionally better signature verification using PKG’s internal verification mechanisms was added for kernel and world updates.</li>
<li>The announcement contains the full rundown of changes, including the suricata, openvpn and ntp got package bumps as well. 
***</li>
</ul>

<h3>Beastie Bits</h3>

<p><a href="https://cooltrainer.org/a-freebsd-desktop-howto/" rel="nofollow">A FreeBSD 10 Desktop How-to</a> (A bit old, but still one of the most complete walkthroughs of a desktop FreeBSD setup from scratch)</p>

<p><a href="http://fossforce.com/2016/01/bsd-ready-scale-14x/" rel="nofollow">BSD and Scale 14</a></p>

<p><a href="http://undeadly.org/cgi?action=article&sid=20160114113445&mode=expanded" rel="nofollow">Xen support enabled in OpenBSD -current</a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20a0mLaAv" rel="nofollow"> Matt - Zil Sizes</a> </li>
<li><a href="http://slexy.org/view/s21qpiTF8h" rel="nofollow"> Drin - IPSEC</a> </li>
<li><a href="http://slexy.org/view/s2HCq0r0aD" rel="nofollow"> John - ZFS + UEFI</a> </li>
<li><a href="http://slexy.org/view/s2VORfyqlS" rel="nofollow"> Jake - ZFS Cluster SAN</a> </li>
<li><a href="http://slexy.org/view/s20ycRhUkM" rel="nofollow"> Phillip - Media Server</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we will be talking to FreeBSD developer and former core-team member John Baldwin about a variety of topics, including running a DevSummit, everything you needed or wanted to know. Coming up right now on BSDNow, the place to B...SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.theregister.co.uk/2016/01/14/server_retired_after_18_years_and_ten_months_beat_that_readers/" rel="nofollow">FreeBSD server retired after almost 19 years</a></h3>

<ul>
<li>We’ve heard stories about this kind of thing before, that box that often sits under-appreciated, but refuses to die. Well the UK register has picked up on a story of a FreeBSD server finally being retired after almost 19 years of dedicated service.</li>
</ul>

<p>“In its day, it was a reasonable machine - 200MHz Pentium, 32MB RAM, 4GB SCSI-2 drive,” Ross writes. “And up until recently, it was doing its job fine.” Of late, however the “hard drive finally started throwing errors, it was time to retire it before it gave up the ghost!” The drive&#39;s a Seagate, for those of you looking to avoid drives that can&#39;t deliver more than 19 years of error-free operations.</p>

<ul>
<li>This system in particular had been running FreeBSD 2.2.1 over the years. Why not upgrade you ask? Ross has an answer for that:</li>
</ul>

<p>“It was heavily firewalled and only very specific services were visible to anyone, and most only visible to our directly connected customers,” Ross told Vulture South. “By the time it was probably due for a review, things had moved so far that all the original code was so tightly bound to the operating system itself, that later versions of the OS would have (and ultimately, did) require substantial rework. While it was running and not showing any signs of stress, it was simply expedient to leave sleeping dogs lie.”</p>

<ul>
<li>All in all, an amazing story of the longevity of a system and its operating system. Do you have a server with a similar or even greater uptime? Let us know so we can try and top this story.
***</li>
</ul>

<h3><a href="https://www.linuxvoice.com/group-test-bsd-distros/" rel="nofollow">Roundup of all the BSDs</a></h3>

<ul>
<li>The magazine LinuxVoice recently did a group test of a variety of “BSD Distros”.</li>
<li>Included in their review were Free/Open/Net/Dragon/Ghost/PC</li>
<li>It starts with a pretty good overview of BSD in general, its starts and the various projects / forks that spawned from it, such as FreeNAS / Junos / Playstation / PFSense / etc</li>
<li>The review starts with a look at OpenBSD, and the consensus reached is that it is good, but does require a bit more manual work to run as a desktop. (Most of the review focuses on desktop usage). It ends up with a solid ⅘ stars though. </li>
<li>Next it moves into GhostBSD, discusses it being a “Live” distro, which can optionally be installed to disk. It loses a few points for lacking a graphical package management utility, and some bugs during the installation, but still earns a respectable ⅗ stars.</li>
<li>Dragonfly gets the next spin and gets praise for its very-up to date video driver support and availability of the HAMMER filesystem. It also lands at ⅗ stars, partly due to the reviewer having to use the command-line for management. (Notice a trend here?)</li>
<li>NetBSD is up next, and gets special mention for being one of the only “distros” that doesn’t do frequent releases. However that doesn’t mean you can’t have updated packages, since the review mentions pkgsrc and pkg as both available to customize your desktop. The reviewer was slightly haunted by having to edit files in /etc by hand to do wireless, but still gives NetBSD a ⅗ overall. </li>
<li>Last up are FreeBSD and PC-BSD, which get a different sort of head-to-head review. FreeBSD goes first, with mention that the text-install is fairly straight-forward and most configuration will require being done by hand. However the reviewer must be getting use to the command-line at this point, because he mentions:</li>
</ul>

<p>“This might sound cumbersome, but is actually pretty straightforward and at the end produces a finely tuned aerodynamic system that does exactly what you want it to do and nothing else.”</p>

<ul>
<li>He does mention that FreeBSD is the ultimate DIY system, even to the point of not having the package management tools provided out of box. </li>
<li>PC-BSD ultimately gets a lot of love in this review, again with it being focused on desktop usage this follows. Particularly popular are all the various tools written to make PC-BSD easier to use, such as Life-Preserver, Warden, the graphical installer and more. (slight mistake though, Life-Preserver does not use rsync to backup to FreeNAS, it does ZFS replication)</li>
<li>In the end he rates FreeBSD ⅘ and PC-BSD a whopping 5/5 for this roundup. </li>
<li>While reviews may be subjective to the particular use-case being evaluated for, it is still nice to see BSD getting some press and more interest from the Linux community in general. 
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/openbsd-laptops" rel="nofollow">OpenBSD Laptops</a></h3>

<ul>
<li>Our buddy Ted Unangst has posted a nice “planning ahead” guide for those thinking of new laptops for 2016 and the upcoming OpenBSD 5.9</li>
<li>He starts by giving us a status update on several of the key driver components that will be in 5.9 release“5.9 will be the first release to support the graphics on Broadwell CPUs. This is anything that looks like i5-5xxx. There are a few minor quirks, but generally it works well. There’s no support for the new Skylake models, however. They’ll probably work with the VESA driver but minus suspend/resume/acceleration (just as 5.8 did with Broadwell).”</li>
<li>He then goes on to mention that the IWM driver works well with most of the revisions (7260, 7265, and 3160) that ship with broadwell based laptops, however the newer skylake series ships with the 8260, which is NOT yet supported.</li>
<li>He then goes on to list some of the more common makes and models to look for, starting with the broadwell based X1 carbons which work really well (Kris gives +++), but make sure its not the newer skylake model just yet.</li>
<li>The macbook gets a mention, but probably should be avoided due to broadcom wifi</li>
<li>The Dell XPS he mentions as a good choice for a powerful (portable) desktops
***</li>
</ul>

<h3><a href="https://www.netbsd.org/changes/changes-8.0.html" rel="nofollow">Significant changes from NetBSD 7.0 to 8.0</a></h3>

<ul>
<li>Updated to GCC 4.8.5</li>
<li>Imported dhcpcd and replaced rtsol and rtsold</li>
<li>gpt(8) utility gained the ability to resize partitions and disks, as well as change the type of a partition</li>
<li>OpenSSH 7.1 and OpenSSL 1.0.1q</li>
<li>FTP client got support for SNI for https</li>
<li>Imported dtrace from FreeBSD</li>
<li>Add syscall support</li>
<li>Add lockstat support
***</li>
</ul>

<h2>Interview - John Baldwin - <a href="mailto:jhb@freebsd.org" rel="nofollow">jhb@freebsd.org</a> / <a href="https://twitter.com/BSDHokie" rel="nofollow">@BSDHokie</a></h2>

<p>FreeBSD Kernel Debugging</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.dragonflydigest.com/2016/01/18/17508.html" rel="nofollow">Dragonfly Mail Agent spreads to FreeBSD and NetBSD</a></h3>

<ul>
<li>DMA, the Dragonfly Mail Agent is now available not only in Dragonfly’s dports, but also FreeBSD ports, and NetBSD pkgsrc</li>
<li>“dma is a small Mail Transport Agent (MTA), designed for home and office use.  It accepts mails from locally installed Mail User Agents (MUA) and delivers the mails either locally or to a remote destination.  Remote delivery includes several features like TLS/SSL support and SMTP authentication. dma is not intended as a replacement for real, big MTAs like sendmail(8) or postfix(1).  Consequently, dma does not listen on port 25 for incoming connections.”</li>
<li>There was a project looking at importing DMA into the FreeBSD base system to replace sendmail, I wonder of the port signals that some of the blockers have been fixed
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=294068" rel="nofollow">ZFS UEFI Support has landed!</a></h3>

<ul>
<li>Originally started by Eric McCorkle</li>
<li>Picked up by Steven Hartland</li>
<li>Including modularizing the existing UFS boot code, and adding ZFS boot code</li>
<li>General improvements to the EFI loader including using more of libstand instead of containing its own implementations of many common functions</li>
<li>Thanks to work by Toomas Soome, there is now a Beastie Menu as part of the EFI loader, similar to the regular loader</li>
<li>As soon as this was committed, I added a few lines to it to connect the ZFS BE Menu to it, thanks to all of the above, without whom my work wouldn’t be usable</li>
<li>It should be relatively easy to hook my GELI boot stuff in as a module, and possibly just stack the UFS and ZFS modules on top of it</li>
<li>I might try to redesign the non-EFI boot code to use a similar design instead of what I have now
***</li>
</ul>

<h3><a href="http://www.phoronix.com/scan.php?page=article&item=3bsd-10linux" rel="nofollow">How three BSD OSes compare to ten Linux Distros</a></h3>

<ul>
<li>After benchmarking 10 of the latest Linux distros, Phoronix took to benchmarking 3 of the big BSDs</li>
<li>DragonFlyBSD 4.4.1 - The latest DragonFly release with GCC 5.2.1 and the HAMMER file-system.</li>
<li>OpenBSD 5.8 - OpenBSD 5.8 with GCC 4.2.1 as the default compiler and FFS file-system.</li>
<li>PC-BSD 10.2 - Derived off FreeBSD 10.2, the defaults were the Clang 3.4.1 compiler and ZFS file-system.</li>
<li>In the SQLite test, PCBSD+ZFS won out over all of the Linux distros, including those that were also using ZFS</li>
<li>In the first compile benchmark, PCBSD came second only to Intel’s Linux distro, Clear Linux. OpenBSD can last, although it is not clear if the benchmark was just comparing the system compiler, which would be unfair to OpenBSD</li>
<li>In Disk transaction performance, against ZFS won the day, with PCBSD edging out the Linux distros. OpenBSD’s older ffs was hurt by the lack of soft updates, and DragonFly’s Hammer did not perform well. Although in an fsync() heavy test, safety is more important that speed</li>
<li>As with all benchmarks, these obviously need to be taken with a grain of salt</li>
<li>In some of them you can clearly see that the ‘winner’ has a much higher standard error, suggesting that the numbers are quite variable
***</li>
</ul>

<h3><a href="https://opnsense.org/opnsense-15-7-24-released/" rel="nofollow">OPNSense 15.7.24 Released</a></h3>

<ul>
<li>We are just barely into the new year and OPNSense has dropped a new release on us to play with. </li>
<li>This new version, 15.7.24 brings a bunch of notable changes, which includes improvements to the firewall UI and a plugin management section of the firmware page. Additionally better signature verification using PKG’s internal verification mechanisms was added for kernel and world updates.</li>
<li>The announcement contains the full rundown of changes, including the suricata, openvpn and ntp got package bumps as well. 
***</li>
</ul>

<h3>Beastie Bits</h3>

<p><a href="https://cooltrainer.org/a-freebsd-desktop-howto/" rel="nofollow">A FreeBSD 10 Desktop How-to</a> (A bit old, but still one of the most complete walkthroughs of a desktop FreeBSD setup from scratch)</p>

<p><a href="http://fossforce.com/2016/01/bsd-ready-scale-14x/" rel="nofollow">BSD and Scale 14</a></p>

<p><a href="http://undeadly.org/cgi?action=article&sid=20160114113445&mode=expanded" rel="nofollow">Xen support enabled in OpenBSD -current</a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20a0mLaAv" rel="nofollow"> Matt - Zil Sizes</a> </li>
<li><a href="http://slexy.org/view/s21qpiTF8h" rel="nofollow"> Drin - IPSEC</a> </li>
<li><a href="http://slexy.org/view/s2HCq0r0aD" rel="nofollow"> John - ZFS + UEFI</a> </li>
<li><a href="http://slexy.org/view/s2VORfyqlS" rel="nofollow"> Jake - ZFS Cluster SAN</a> </li>
<li><a href="http://slexy.org/view/s20ycRhUkM" rel="nofollow"> Phillip - Media Server</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>124: Get your engine(x) started!</title>
  <link>https://www.bsdnow.tv/124</link>
  <guid isPermaLink="false">91c6faea-62a9-4334-b732-cab3cb55ba35</guid>
  <pubDate>Wed, 13 Jan 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/91c6faea-62a9-4334-b732-cab3cb55ba35.mp3" length="54317524" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we have a very full news roster to rundown, plus an oldie, but goodie with Igor of the nginx project. That plus all your questions and feedback,</itunes:subtitle>
  <itunes:duration>1:15:26</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we have a very full news roster to rundown, plus an oldie, but goodie with Igor of the nginx project. That plus all your questions and feedback,
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSDJournal!
***
FreeNAS Logo Design Contest (https://www.ixsystems.com/freenas-logo-contest/)
Rules and Requirements (https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/)
For those of you curious about Kris' new lighting here are the links to what he is using.
Softbox Light Diffuser (http://smile.amazon.com/gp/product/B00OTG6474?psc=1&amp;amp;redirect=true&amp;amp;ref_=oh_aui_detailpage_o01_s00&amp;amp;pldnSite=1)
Full Spectrum 5500K CFL Bulb (http://smile.amazon.com/gp/product/B00198U6U6?psc=1&amp;amp;redirect=true&amp;amp;ref_=oh_aui_detailpage_o06_s00)
***
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Clearing the air  (http://blog.randi.io/2015/12/31/the-developer-formerly-known-as-freebsdgirl/)
A number of you have written in the past few weeks asking why Allan and I didn’t talk about one of the biggest stories to make headlines last week. 
Both of us are quite aware of the details surrounding the incidents between former FreeBSD developers “freebsdgirl” and “xmj”, however the news was still ongoing and we didn’t feel it right to discuss until some of the facts had time to shake out and a more clear (and calm) discussion could be had. 
However, without getting into all the gory details here’s some of the key points that we want to highlight for our listeners. We each have our own thoughts on this.
Kris:
The FreeBSD that I know has been VERY open and inclusive to all who want to contribute. The saying “Shut up and code” is there for a reason. We’ve seen developers of all types, different race / gender / creed, and the one thing we all have in common is the love for BSD.
This particular incident has been linked to FreeBSD, which isn’t exactly a fair association, since the project and other members of community were not directly involved. What started out as a disagreement (over something non-BSD related) turned into an ugly slugfest all across social media and (briefly) on a BSD chatroom.
In this case after reviewing lots of the facts, I think both sides were WAY out of line, and hope they recognize that. 
There has been slamming of the core team and foundation in social media, as somehow the delay / silence is an admission of wrong-doing. Nothing could be further from the truth. These are serious people doing a serious job, and much like BSD they would rather take the time to do it right instead of just going off on social media and making things worse. (Plus they all are volunteers who are spread across many different time-zones)
Also, if you hear rumors of incidents of harassment, remember that without details all those will ever be is rumors. Obviously those in the project would take any incident like that seriously, but without coming forward and sharing the details it’s impossible to take any action or make changes for the better.
Allan:
The FreeBSD community is the best group of people I have ever worked with, but that doesn’t mean that it is immune to the same problems that every other group of people faces. As much as all of us wish it didn’t, harassment and other ill-behavior does happen, and must be dealt with
The FreeBSD Core team has previously sanctioned committers and revoked commit bits for things that happened entirely offline and outside of the FreeBSD community. Part of being a committer is representing the project in everything that you do, so anything you do that reflects badly upon the project is grounds for your removal
There was something written about this in the project documentation somewhere (that I can not find for the live of me), specifically about the prestige that comes with (or used to) an @freebsd.org account, and how new members of the community need to keep that in mind as they work to earn, and keep, a commit bit
In this specific situation, I am not sure what core did exactly, we’ll have to wait for their report to find out, but I am not sure what more they could have done.
“Individual members of core have the power to temporarily suspend commit privileges until core as a whole has the chance to review the issue. Only a 2/3 majority of core has the authority to suspend commit privileges for longer than a week or to remove them permanently. Core's “special powers” only kick in when it acts as a group, not on an individual basis. As individuals, the core team members are all committers first and core second”
So, an individual member of core can revoke the commit bit of someone who is reported to have acted in a manner not conducive with the rules, but I don’t know how that would have made a difference in this case.
The only point from Randi’s list of 10 things the project should change that I do not think is possible is #6. As stated in the “Committers' Big List of Rules” that I quoted earlier, the core team can only take action after they have had time for everyone to review and discuss a matter, and then vote on it.
The core team is made up of 9 people with other responsibilities and commitments. Further, they are currently spread across 6 different countries, and 6 different times zones (even the countries and time zones do not line up).
We eagerly await Cores report on this matter, and more importantly, Core and the Foundation's work to come up with a better framework and response policy to deal with such situations in the future.
The important thing is to ensure that incident reports are properly handled, so that those reporting issues feel safe in doing so
While we hope there is never another incident of harassment in the FreeBSD community, the realities of the world we live in mean we need to be ready to deal with it
***
Dan Langille discussing his rig (https://www.reddit.com/r/homelab/comments/3zv64t/the_home_lab_9_servers_about_98tb_working_url/)
Pictures of Dan Langille's Home Lab (http://imgur.com/gallery/nuBBD) 
Ever read FreeBSD Diary? How about used FreshPorts or FreshSource? Gone to BSDCan? If so you may be interested in seeing exactly where those sites are served from.
Dan Langille posts to reddit with information about his home lab, with the obligatory pictures to back it up
As most good home racks do, this one starts at Home Depot and ends up with a variety of systems and hardware living on it. 
All in all an impressive rig and nice job wiring
(I wonder what that ASUS RT‑N66U is doing, if it’s running FreeBSD or just an access point??)
Reminder: Get your BSDCan talk proposal submitted before the deadline, January 19th
***
Pre-5.9 pledge(2) update (http://undeadly.org/cgi?action=article&amp;amp;sid=20160107174436)
Theo gives us a status update on pledge() for pre OpenBSD 5.9“For the next upcoming release, we will disable the 'paths' argument.Reasoning: We have been very busy making as much of the tree set thepromises right in applications, and building a few new promises aswell.  We simply don't have enough time to review the kernel code andmake sure it is bug-free.  We'll use the next 6 months developmentcycle to decide on paths, and then re-audit the tree to use theinterface where it is suitable.
The base tree (/bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/games)contains 652 ELF binaries. 451 use pledge.  201 do not. Approximately47 do not need or cannot use pledge.  Leaving 154 we could potentiallypledge in the future.  Most of those are not very important.  Thereare a few hot spots, but most of what people use has been handled wellby the team.“
Chromium: now with OpenBSD pledge(2) (http://undeadly.org/cgi?action=article&amp;amp;sid=20160107075227) 
In addition to the pledge news, we also have a story about the Chromium browser being converted to use pledge on OpenBSD.“The renderer, gpu, plugin and utility processes are now using pledge(2)Unfortunately the GPU process only requires an rpath pledge because ofMesa trying to parse two configuration files, /etc/drirc and ${HOME}/.drircSo currently the GPU process will use an rpath pledge in the nextweek or so so that people can test, but this situation has to beresolved because it is not acceptable that a mostly unused configurationfile is being parsed from a library and that stops us from using lesspledges and thus disallowing the GPU process to have read accessto the filesystem ... like your ssh keys.”
UPDATE: the rpath pledge has been removed.         
***
iXsystems
https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/
Interview - Igor Sysoev - igor@sysoev.ru (mailto:igor@sysoev.ru) / @isysoev (https://twitter.com/isysoev)
NGINX and FreeBSD
News Roundup
FreeBSD on EdgeRouter Lite - no serial port required (http://www.daemonology.net/blog/2016-01-10-FreeBSD-EdgeRouter-Lite.html)
A few years back there was a neat story on how to setup FreeBSD on the EdgeRouter-Lite
This last week we get to revisit this, as Colin Percival posts a script, and a very detailed walkthrough of using it to generate your own custom image which does NOT require hooking up a serial cable.
Currently the script only works on -CURRENT, but may work later for 10.3
The script is pretty complete, does the buildworld and creation of a USB image for you. It also does a basic firewall configuration and even growfs for expanding to the full-size of your USB media.
Using the ‘firstboot’ keyword, an rc.d script does all the initial configuration allowing you access to the system
If you have one, or are looking at switching to a FreeBSD based router, do yourself a favor and take a look at this article. 
***
John Marino reaches out to the community for testing of Synth, a new custom package repo builder (http://lists.dragonflybsd.org/pipermail/users/2016-January/228540.html)
A hybrid of poudriere and portmaster/portupgrade
Uses your regular ports tree and your running system, but built builds packages faster, the poudriere way
Requires no setup, no downloading or building reference versions of the OS, no checking out yet another copy of the ports tree
In the future may have support for using binary packages for dependencies, build only the apps you actually want to customize
Looks very promising
***
OpenBSD malloc finds use-after-free in Android OS  (https://android-review.googlesource.com/#/c/196090/)
Score one for OpenBSD’s rigorous security and attention to detail. We have an interesting commit / comment from Android
It looks like this particular mistake was found in the uncrypt routines, in particular the using of a variable memory which had already gone out of scope. 
Through the usage of OpenBSD’s malloc junk filling feature, the developers were able to identify and correct the issue.
Maybe there is a case to be made that this be used more widely, especially during testing?
***
Netflix's async sendfile now in FreeBSD-current (http://www.slideshare.net/facepalmtarbz2/new-sendfile-in-english)
We have some slides presented by Gleb Smirnoff at last years FreeBSD storage summit, talking about changes to sendfile made by Netflix. 
It starts off with a bit of history, showing the misery of life without sendfile(2) back in FreeBSD 1.0, specifically the ftpd daemon.
Then in 1997 that all changed, HP-UX 11.00 grew the sendfile function, and FreeBSD 3.0 / Linux 2.2 added it in ‘98
The slides then go into other details, on how the first implementations would map the userland cycle into the kernel. Then in 2004 the SF_NODISKIO flag was added, followed by changes in 2006 and 2013 to using sbspace() bytes and sending shared memory descriptor data respectively. 
The idea is that instead of the web server waiting for the send to complete, it calls sendfile then goes about its other work, then it gets a notification when the work is done, and finishes up any of the request handling, like logging how many bytes were sent
The new sendfile implementation took the maximum load of an older netflix box from 25 gigabits/sec to 35 gigabits/sec
Separately, Netflix has also done work on implementing a TLS version of sendfile(), to streamline the process of sending encrypted data
There is still a todo list, including making sendfile() play nice with ZFS. Currently files sent via sendfile from ZFS are stored in memory twice, once in the ARC, and once in the buffer cache that sendfile uses
***
Beastie Bits
Unix Timeline of how Unix versions have evolved (http://www.levenez.com/unix/) 
netmap support now in bhyve in FreeBSD -Current (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=293459)
McCabe complexity and Dragonfly BSD (https://www.dragonflydigest.com/2016/01/12/17478.html) 
Bourne Basic - a BASIC interpreter implemented (painfully) in pure Bourne shell (https://gist.github.com/cander/2785819) 
NixOS on FreeBSD (https://github.com/NixOS/nixpkgs/pull/10816#issuecomment-169298385) 
Turning an ordinary OpenBSD system into a router (http://www.openbsd.org/faq/pf/example1.html)
nvidia releases beta 361.16 driver for FreeBSD (https://devtalk.nvidia.com/default/topic/908423/unix-graphics-announcements-and-news/linux-solaris-and-freebsd-driver-361-16-beta-/) 
Feedback/Questions
 Bryson - SmartOS / KVM / ZFS (http://slexy.org/view/s2BLZeBrSK) 
 Samba 1969 (http://slexy.org/view/s2OQIxkZst) 
 DO / VPN / PF (http://slexy.org/view/s206j2ekTZ) 
 Unstable VM  / Update (http://slexy.org/view/s20kyrKSH9)
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv (mailto:feedback@bsdnow.tv)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we have a very full news roster to rundown, plus an oldie, but goodie with Igor of the nginx project. That plus all your questions and feedback,</p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSDJournal!
***</li>
</ul>

<h4><a href="https://www.ixsystems.com/freenas-logo-contest/" rel="nofollow">FreeNAS Logo Design Contest</a></h4>

<p><a href="https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/" rel="nofollow">Rules and Requirements</a></p>

<hr>

<h4>For those of you curious about Kris&#39; new lighting here are the links to what he is using.</h4>

<ul>
<li><a href="http://smile.amazon.com/gp/product/B00OTG6474?psc=1&redirect=true&ref_=oh_aui_detailpage_o01_s00&pldnSite=1" rel="nofollow">Softbox Light Diffuser</a></li>
<li><a href="http://smile.amazon.com/gp/product/B00198U6U6?psc=1&redirect=true&ref_=oh_aui_detailpage_o06_s00" rel="nofollow">Full Spectrum 5500K CFL Bulb</a>
***</li>
</ul>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.randi.io/2015/12/31/the-developer-formerly-known-as-freebsdgirl/" rel="nofollow">Clearing the air </a></h3>

<ul>
<li>A number of you have written in the past few weeks asking why Allan and I didn’t talk about one of the biggest stories to make headlines last week. </li>
<li>Both of us are quite aware of the details surrounding the incidents between former FreeBSD developers “freebsdgirl” and “xmj”, however the news was still ongoing and we didn’t feel it right to discuss until some of the facts had time to shake out and a more clear (and calm) discussion could be had. </li>
<li>However, without getting into all the gory details here’s some of the key points that we want to highlight for our listeners. We each have our own thoughts on this.</li>
</ul>

<p>Kris:</p>

<ul>
<li>The FreeBSD that I know has been VERY open and inclusive to all who want to contribute. The saying “Shut up and code” is there for a reason. We’ve seen developers of all types, different race / gender / creed, and the one thing we all have in common is the love for BSD.</li>
<li>This particular incident has been linked to FreeBSD, which isn’t exactly a fair association, since the project and other members of community were not directly involved. What started out as a disagreement (over something non-BSD related) turned into an ugly slugfest all across social media and (briefly) on a BSD chatroom.</li>
<li>In this case after reviewing lots of the facts, I think both sides were WAY out of line, and hope they recognize that. </li>
<li>There has been slamming of the core team and foundation in social media, as somehow the delay / silence is an admission of wrong-doing. Nothing could be further from the truth. These are serious people doing a serious job, and much like BSD they would rather take the time to do it right instead of just going off on social media and making things worse. (Plus they all are volunteers who are spread across many different time-zones)</li>
<li>Also, if you hear rumors of incidents of harassment, remember that without details all those will ever be is rumors. Obviously those in the project would take any incident like that seriously, but without coming forward and sharing the details it’s impossible to take any action or make changes for the better.</li>
</ul>

<p>Allan:</p>

<ul>
<li>The FreeBSD community is the best group of people I have ever worked with, but that doesn’t mean that it is immune to the same problems that every other group of people faces. As much as all of us wish it didn’t, harassment and other ill-behavior does happen, and must be dealt with</li>
<li>The FreeBSD Core team has previously sanctioned committers and revoked commit bits for things that happened entirely offline and outside of the FreeBSD community. Part of being a committer is representing the project in everything that you do, so anything you do that reflects badly upon the project is grounds for your removal</li>
<li>There was something written about this in the project documentation somewhere (that I can not find for the live of me), specifically about the prestige that comes with (or used to) an @freebsd.org account, and how new members of the community need to keep that in mind as they work to earn, and keep, a commit bit</li>
<li>In this specific situation, I am not sure what core did exactly, we’ll have to wait for their report to find out, but I am not sure what more they could have done.</li>
<li>“Individual members of core have the power to temporarily suspend commit privileges until core as a whole has the chance to review the issue. Only a 2/3 majority of core has the authority to suspend commit privileges for longer than a week or to remove them permanently. Core&#39;s “special powers” only kick in when it acts as a group, not on an individual basis. As individuals, the core team members are all committers first and core second”</li>
<li>So, an individual member of core can revoke the commit bit of someone who is reported to have acted in a manner not conducive with the rules, but I don’t know how that would have made a difference in this case.</li>
<li>The only point from Randi’s list of 10 things the project should change that I do not think is possible is #6. As stated in the “Committers&#39; Big List of Rules” that I quoted earlier, the core team can only take action after they have had time for everyone to review and discuss a matter, and then vote on it.</li>
<li>The core team is made up of 9 people with other responsibilities and commitments. Further, they are currently spread across 6 different countries, and 6 different times zones (even the countries and time zones do not line up).</li>
<li>We eagerly await Cores report on this matter, and more importantly, Core and the Foundation&#39;s work to come up with a better framework and response policy to deal with such situations in the future.</li>
<li>The important thing is to ensure that incident reports are properly handled, so that those reporting issues feel safe in doing so</li>
<li>While we hope there is never another incident of harassment in the FreeBSD community, the realities of the world we live in mean we need to be ready to deal with it
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/homelab/comments/3zv64t/the_home_lab_9_servers_about_98tb_working_url/" rel="nofollow">Dan Langille discussing his rig</a></h3>

<ul>
<li><a href="http://imgur.com/gallery/nuBBD" rel="nofollow">Pictures of Dan Langille&#39;s Home Lab</a> </li>
<li>Ever read FreeBSD Diary? How about used FreshPorts or FreshSource? Gone to BSDCan? If so you may be interested in seeing exactly where those sites are served from.</li>
<li>Dan Langille posts to reddit with information about his home lab, with the obligatory pictures to back it up</li>
<li>As most good home racks do, this one starts at Home Depot and ends up with a variety of systems and hardware living on it. </li>
<li>All in all an impressive rig and nice job wiring</li>
<li>(I wonder what that ASUS RT‑N66U is doing, if it’s running FreeBSD or just an access point??)</li>
<li>Reminder: Get your BSDCan talk proposal submitted before the deadline, January 19th
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160107174436" rel="nofollow">Pre-5.9 pledge(2) update</a></h3>

<ul>
<li>Theo gives us a status update on pledge() for pre OpenBSD 5.9“For the next upcoming release, we will disable the &#39;paths&#39; argument.Reasoning: We have been very busy making as much of the tree set thepromises right in applications, and building a few new promises aswell.  We simply don&#39;t have enough time to review the kernel code andmake sure it is bug-free.  We&#39;ll use the next 6 months developmentcycle to decide on paths, and then re-audit the tree to use theinterface where it is suitable.
The base tree (/bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/games)contains 652 ELF binaries. 451 use pledge.  201 do not. Approximately47 do not need or cannot use pledge.  Leaving 154 we could potentiallypledge in the future.  Most of those are not very important.  Thereare a few hot spots, but most of what people use has been handled wellby the team.“</li>
</ul>

<p><a href="http://undeadly.org/cgi?action=article&sid=20160107075227" rel="nofollow">Chromium: now with OpenBSD pledge(2)</a> </p>

<ul>
<li>In addition to the pledge news, we also have a story about the Chromium browser being converted to use pledge on OpenBSD.“The renderer, gpu, plugin and utility processes are now using pledge(2)Unfortunately the GPU process only requires an rpath pledge because ofMesa trying to parse two configuration files, /etc/drirc and ${HOME}/.drircSo currently the GPU process will use an rpath pledge in the nextweek or so so that people can test, but this situation has to beresolved because it is not acceptable that a mostly unused configurationfile is being parsed from a library and that stops us from using lesspledges and thus disallowing the GPU process to have read accessto the filesystem ... like your ssh keys.”
UPDATE: the rpath pledge has been removed.<br>
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/" rel="nofollow">https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/</a></li>
</ul>

<hr>

<h2>Interview - Igor Sysoev - <a href="mailto:igor@sysoev.ru" rel="nofollow">igor@sysoev.ru</a> / <a href="https://twitter.com/isysoev" rel="nofollow">@isysoev</a></h2>

<p>NGINX and FreeBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.daemonology.net/blog/2016-01-10-FreeBSD-EdgeRouter-Lite.html" rel="nofollow">FreeBSD on EdgeRouter Lite - no serial port required</a></h3>

<ul>
<li>A few years back there was a neat story on how to setup FreeBSD on the EdgeRouter-Lite</li>
<li>This last week we get to revisit this, as Colin Percival posts a script, and a very detailed walkthrough of using it to generate your own custom image which does NOT require hooking up a serial cable.</li>
<li>Currently the script only works on -CURRENT, but may work later for 10.3</li>
<li>The script is pretty complete, does the buildworld and creation of a USB image for you. It also does a basic firewall configuration and even growfs for expanding to the full-size of your USB media.</li>
<li>Using the ‘firstboot’ keyword, an rc.d script does all the initial configuration allowing you access to the system</li>
<li>If you have one, or are looking at switching to a FreeBSD based router, do yourself a favor and take a look at this article. 
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2016-January/228540.html" rel="nofollow">John Marino reaches out to the community for testing of Synth, a new custom package repo builder</a></h3>

<ul>
<li>A hybrid of poudriere and portmaster/portupgrade</li>
<li>Uses your regular ports tree and your running system, but built builds packages faster, the poudriere way</li>
<li>Requires no setup, no downloading or building reference versions of the OS, no checking out yet another copy of the ports tree</li>
<li>In the future may have support for using binary packages for dependencies, build only the apps you actually want to customize</li>
<li>Looks very promising
***</li>
</ul>

<h3><a href="https://android-review.googlesource.com/#/c/196090/" rel="nofollow">OpenBSD malloc finds use-after-free in Android OS </a></h3>

<ul>
<li>Score one for OpenBSD’s rigorous security and attention to detail. We have an interesting commit / comment from Android</li>
<li>It looks like this particular mistake was found in the uncrypt routines, in particular the using of a variable memory which had already gone out of scope. </li>
<li>Through the usage of OpenBSD’s malloc junk filling feature, the developers were able to identify and correct the issue.</li>
<li>Maybe there is a case to be made that this be used more widely, especially during testing?
***</li>
</ul>

<h3><a href="http://www.slideshare.net/facepalmtarbz2/new-sendfile-in-english" rel="nofollow">Netflix&#39;s async sendfile now in FreeBSD-current</a></h3>

<ul>
<li>We have some slides presented by Gleb Smirnoff at last years FreeBSD storage summit, talking about changes to sendfile made by Netflix. </li>
<li>It starts off with a bit of history, showing the misery of life without sendfile(2) back in FreeBSD 1.0, specifically the ftpd daemon.</li>
<li>Then in 1997 that all changed, HP-UX 11.00 grew the sendfile function, and FreeBSD 3.0 / Linux 2.2 added it in ‘98</li>
<li>The slides then go into other details, on how the first implementations would map the userland cycle into the kernel. Then in 2004 the SF_NODISKIO flag was added, followed by changes in 2006 and 2013 to using sbspace() bytes and sending shared memory descriptor data respectively. </li>
<li>The idea is that instead of the web server waiting for the send to complete, it calls sendfile then goes about its other work, then it gets a notification when the work is done, and finishes up any of the request handling, like logging how many bytes were sent</li>
<li>The new sendfile implementation took the maximum load of an older netflix box from 25 gigabits/sec to 35 gigabits/sec</li>
<li>Separately, Netflix has also done work on implementing a TLS version of sendfile(), to streamline the process of sending encrypted data</li>
<li>There is still a todo list, including making sendfile() play nice with ZFS. Currently files sent via sendfile from ZFS are stored in memory twice, once in the ARC, and once in the buffer cache that sendfile uses
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="http://www.levenez.com/unix/" rel="nofollow">Unix Timeline of how Unix versions have evolved</a> </p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=293459" rel="nofollow">netmap support now in bhyve in FreeBSD -Current</a></p></li>
<li><p><a href="https://www.dragonflydigest.com/2016/01/12/17478.html" rel="nofollow">McCabe complexity and Dragonfly BSD</a> </p></li>
<li><p><a href="https://gist.github.com/cander/2785819" rel="nofollow">Bourne Basic - a BASIC interpreter implemented (painfully) in pure Bourne shell</a> </p></li>
<li><p><a href="https://github.com/NixOS/nixpkgs/pull/10816#issuecomment-169298385" rel="nofollow">NixOS on FreeBSD</a> </p></li>
<li><p><a href="http://www.openbsd.org/faq/pf/example1.html" rel="nofollow">Turning an ordinary OpenBSD system into a router</a></p></li>
<li><p><a href="https://devtalk.nvidia.com/default/topic/908423/unix-graphics-announcements-and-news/linux-solaris-and-freebsd-driver-361-16-beta-/" rel="nofollow">nvidia releases beta 361.16 driver for FreeBSD</a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2BLZeBrSK" rel="nofollow"> Bryson - SmartOS / KVM / ZFS</a> </li>
<li><a href="http://slexy.org/view/s2OQIxkZst" rel="nofollow"> Samba 1969</a> </li>
<li><a href="http://slexy.org/view/s206j2ekTZ" rel="nofollow"> DO / VPN / PF</a> </li>
<li><p><a href="http://slexy.org/view/s20kyrKSH9" rel="nofollow"> Unstable VM  / Update</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we have a very full news roster to rundown, plus an oldie, but goodie with Igor of the nginx project. That plus all your questions and feedback,</p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSDJournal!
***</li>
</ul>

<h4><a href="https://www.ixsystems.com/freenas-logo-contest/" rel="nofollow">FreeNAS Logo Design Contest</a></h4>

<p><a href="https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/" rel="nofollow">Rules and Requirements</a></p>

<hr>

<h4>For those of you curious about Kris&#39; new lighting here are the links to what he is using.</h4>

<ul>
<li><a href="http://smile.amazon.com/gp/product/B00OTG6474?psc=1&redirect=true&ref_=oh_aui_detailpage_o01_s00&pldnSite=1" rel="nofollow">Softbox Light Diffuser</a></li>
<li><a href="http://smile.amazon.com/gp/product/B00198U6U6?psc=1&redirect=true&ref_=oh_aui_detailpage_o06_s00" rel="nofollow">Full Spectrum 5500K CFL Bulb</a>
***</li>
</ul>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.randi.io/2015/12/31/the-developer-formerly-known-as-freebsdgirl/" rel="nofollow">Clearing the air </a></h3>

<ul>
<li>A number of you have written in the past few weeks asking why Allan and I didn’t talk about one of the biggest stories to make headlines last week. </li>
<li>Both of us are quite aware of the details surrounding the incidents between former FreeBSD developers “freebsdgirl” and “xmj”, however the news was still ongoing and we didn’t feel it right to discuss until some of the facts had time to shake out and a more clear (and calm) discussion could be had. </li>
<li>However, without getting into all the gory details here’s some of the key points that we want to highlight for our listeners. We each have our own thoughts on this.</li>
</ul>

<p>Kris:</p>

<ul>
<li>The FreeBSD that I know has been VERY open and inclusive to all who want to contribute. The saying “Shut up and code” is there for a reason. We’ve seen developers of all types, different race / gender / creed, and the one thing we all have in common is the love for BSD.</li>
<li>This particular incident has been linked to FreeBSD, which isn’t exactly a fair association, since the project and other members of community were not directly involved. What started out as a disagreement (over something non-BSD related) turned into an ugly slugfest all across social media and (briefly) on a BSD chatroom.</li>
<li>In this case after reviewing lots of the facts, I think both sides were WAY out of line, and hope they recognize that. </li>
<li>There has been slamming of the core team and foundation in social media, as somehow the delay / silence is an admission of wrong-doing. Nothing could be further from the truth. These are serious people doing a serious job, and much like BSD they would rather take the time to do it right instead of just going off on social media and making things worse. (Plus they all are volunteers who are spread across many different time-zones)</li>
<li>Also, if you hear rumors of incidents of harassment, remember that without details all those will ever be is rumors. Obviously those in the project would take any incident like that seriously, but without coming forward and sharing the details it’s impossible to take any action or make changes for the better.</li>
</ul>

<p>Allan:</p>

<ul>
<li>The FreeBSD community is the best group of people I have ever worked with, but that doesn’t mean that it is immune to the same problems that every other group of people faces. As much as all of us wish it didn’t, harassment and other ill-behavior does happen, and must be dealt with</li>
<li>The FreeBSD Core team has previously sanctioned committers and revoked commit bits for things that happened entirely offline and outside of the FreeBSD community. Part of being a committer is representing the project in everything that you do, so anything you do that reflects badly upon the project is grounds for your removal</li>
<li>There was something written about this in the project documentation somewhere (that I can not find for the live of me), specifically about the prestige that comes with (or used to) an @freebsd.org account, and how new members of the community need to keep that in mind as they work to earn, and keep, a commit bit</li>
<li>In this specific situation, I am not sure what core did exactly, we’ll have to wait for their report to find out, but I am not sure what more they could have done.</li>
<li>“Individual members of core have the power to temporarily suspend commit privileges until core as a whole has the chance to review the issue. Only a 2/3 majority of core has the authority to suspend commit privileges for longer than a week or to remove them permanently. Core&#39;s “special powers” only kick in when it acts as a group, not on an individual basis. As individuals, the core team members are all committers first and core second”</li>
<li>So, an individual member of core can revoke the commit bit of someone who is reported to have acted in a manner not conducive with the rules, but I don’t know how that would have made a difference in this case.</li>
<li>The only point from Randi’s list of 10 things the project should change that I do not think is possible is #6. As stated in the “Committers&#39; Big List of Rules” that I quoted earlier, the core team can only take action after they have had time for everyone to review and discuss a matter, and then vote on it.</li>
<li>The core team is made up of 9 people with other responsibilities and commitments. Further, they are currently spread across 6 different countries, and 6 different times zones (even the countries and time zones do not line up).</li>
<li>We eagerly await Cores report on this matter, and more importantly, Core and the Foundation&#39;s work to come up with a better framework and response policy to deal with such situations in the future.</li>
<li>The important thing is to ensure that incident reports are properly handled, so that those reporting issues feel safe in doing so</li>
<li>While we hope there is never another incident of harassment in the FreeBSD community, the realities of the world we live in mean we need to be ready to deal with it
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/homelab/comments/3zv64t/the_home_lab_9_servers_about_98tb_working_url/" rel="nofollow">Dan Langille discussing his rig</a></h3>

<ul>
<li><a href="http://imgur.com/gallery/nuBBD" rel="nofollow">Pictures of Dan Langille&#39;s Home Lab</a> </li>
<li>Ever read FreeBSD Diary? How about used FreshPorts or FreshSource? Gone to BSDCan? If so you may be interested in seeing exactly where those sites are served from.</li>
<li>Dan Langille posts to reddit with information about his home lab, with the obligatory pictures to back it up</li>
<li>As most good home racks do, this one starts at Home Depot and ends up with a variety of systems and hardware living on it. </li>
<li>All in all an impressive rig and nice job wiring</li>
<li>(I wonder what that ASUS RT‑N66U is doing, if it’s running FreeBSD or just an access point??)</li>
<li>Reminder: Get your BSDCan talk proposal submitted before the deadline, January 19th
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20160107174436" rel="nofollow">Pre-5.9 pledge(2) update</a></h3>

<ul>
<li>Theo gives us a status update on pledge() for pre OpenBSD 5.9“For the next upcoming release, we will disable the &#39;paths&#39; argument.Reasoning: We have been very busy making as much of the tree set thepromises right in applications, and building a few new promises aswell.  We simply don&#39;t have enough time to review the kernel code andmake sure it is bug-free.  We&#39;ll use the next 6 months developmentcycle to decide on paths, and then re-audit the tree to use theinterface where it is suitable.
The base tree (/bin /sbin /usr/bin /usr/sbin /usr/libexec /usr/games)contains 652 ELF binaries. 451 use pledge.  201 do not. Approximately47 do not need or cannot use pledge.  Leaving 154 we could potentiallypledge in the future.  Most of those are not very important.  Thereare a few hot spots, but most of what people use has been handled wellby the team.“</li>
</ul>

<p><a href="http://undeadly.org/cgi?action=article&sid=20160107075227" rel="nofollow">Chromium: now with OpenBSD pledge(2)</a> </p>

<ul>
<li>In addition to the pledge news, we also have a story about the Chromium browser being converted to use pledge on OpenBSD.“The renderer, gpu, plugin and utility processes are now using pledge(2)Unfortunately the GPU process only requires an rpath pledge because ofMesa trying to parse two configuration files, /etc/drirc and ${HOME}/.drircSo currently the GPU process will use an rpath pledge in the nextweek or so so that people can test, but this situation has to beresolved because it is not acceptable that a mostly unused configurationfile is being parsed from a library and that stops us from using lesspledges and thus disallowing the GPU process to have read accessto the filesystem ... like your ssh keys.”
UPDATE: the rpath pledge has been removed.<br>
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/" rel="nofollow">https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/</a></li>
</ul>

<hr>

<h2>Interview - Igor Sysoev - <a href="mailto:igor@sysoev.ru" rel="nofollow">igor@sysoev.ru</a> / <a href="https://twitter.com/isysoev" rel="nofollow">@isysoev</a></h2>

<p>NGINX and FreeBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.daemonology.net/blog/2016-01-10-FreeBSD-EdgeRouter-Lite.html" rel="nofollow">FreeBSD on EdgeRouter Lite - no serial port required</a></h3>

<ul>
<li>A few years back there was a neat story on how to setup FreeBSD on the EdgeRouter-Lite</li>
<li>This last week we get to revisit this, as Colin Percival posts a script, and a very detailed walkthrough of using it to generate your own custom image which does NOT require hooking up a serial cable.</li>
<li>Currently the script only works on -CURRENT, but may work later for 10.3</li>
<li>The script is pretty complete, does the buildworld and creation of a USB image for you. It also does a basic firewall configuration and even growfs for expanding to the full-size of your USB media.</li>
<li>Using the ‘firstboot’ keyword, an rc.d script does all the initial configuration allowing you access to the system</li>
<li>If you have one, or are looking at switching to a FreeBSD based router, do yourself a favor and take a look at this article. 
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2016-January/228540.html" rel="nofollow">John Marino reaches out to the community for testing of Synth, a new custom package repo builder</a></h3>

<ul>
<li>A hybrid of poudriere and portmaster/portupgrade</li>
<li>Uses your regular ports tree and your running system, but built builds packages faster, the poudriere way</li>
<li>Requires no setup, no downloading or building reference versions of the OS, no checking out yet another copy of the ports tree</li>
<li>In the future may have support for using binary packages for dependencies, build only the apps you actually want to customize</li>
<li>Looks very promising
***</li>
</ul>

<h3><a href="https://android-review.googlesource.com/#/c/196090/" rel="nofollow">OpenBSD malloc finds use-after-free in Android OS </a></h3>

<ul>
<li>Score one for OpenBSD’s rigorous security and attention to detail. We have an interesting commit / comment from Android</li>
<li>It looks like this particular mistake was found in the uncrypt routines, in particular the using of a variable memory which had already gone out of scope. </li>
<li>Through the usage of OpenBSD’s malloc junk filling feature, the developers were able to identify and correct the issue.</li>
<li>Maybe there is a case to be made that this be used more widely, especially during testing?
***</li>
</ul>

<h3><a href="http://www.slideshare.net/facepalmtarbz2/new-sendfile-in-english" rel="nofollow">Netflix&#39;s async sendfile now in FreeBSD-current</a></h3>

<ul>
<li>We have some slides presented by Gleb Smirnoff at last years FreeBSD storage summit, talking about changes to sendfile made by Netflix. </li>
<li>It starts off with a bit of history, showing the misery of life without sendfile(2) back in FreeBSD 1.0, specifically the ftpd daemon.</li>
<li>Then in 1997 that all changed, HP-UX 11.00 grew the sendfile function, and FreeBSD 3.0 / Linux 2.2 added it in ‘98</li>
<li>The slides then go into other details, on how the first implementations would map the userland cycle into the kernel. Then in 2004 the SF_NODISKIO flag was added, followed by changes in 2006 and 2013 to using sbspace() bytes and sending shared memory descriptor data respectively. </li>
<li>The idea is that instead of the web server waiting for the send to complete, it calls sendfile then goes about its other work, then it gets a notification when the work is done, and finishes up any of the request handling, like logging how many bytes were sent</li>
<li>The new sendfile implementation took the maximum load of an older netflix box from 25 gigabits/sec to 35 gigabits/sec</li>
<li>Separately, Netflix has also done work on implementing a TLS version of sendfile(), to streamline the process of sending encrypted data</li>
<li>There is still a todo list, including making sendfile() play nice with ZFS. Currently files sent via sendfile from ZFS are stored in memory twice, once in the ARC, and once in the buffer cache that sendfile uses
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="http://www.levenez.com/unix/" rel="nofollow">Unix Timeline of how Unix versions have evolved</a> </p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=293459" rel="nofollow">netmap support now in bhyve in FreeBSD -Current</a></p></li>
<li><p><a href="https://www.dragonflydigest.com/2016/01/12/17478.html" rel="nofollow">McCabe complexity and Dragonfly BSD</a> </p></li>
<li><p><a href="https://gist.github.com/cander/2785819" rel="nofollow">Bourne Basic - a BASIC interpreter implemented (painfully) in pure Bourne shell</a> </p></li>
<li><p><a href="https://github.com/NixOS/nixpkgs/pull/10816#issuecomment-169298385" rel="nofollow">NixOS on FreeBSD</a> </p></li>
<li><p><a href="http://www.openbsd.org/faq/pf/example1.html" rel="nofollow">Turning an ordinary OpenBSD system into a router</a></p></li>
<li><p><a href="https://devtalk.nvidia.com/default/topic/908423/unix-graphics-announcements-and-news/linux-solaris-and-freebsd-driver-361-16-beta-/" rel="nofollow">nvidia releases beta 361.16 driver for FreeBSD</a> </p></li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2BLZeBrSK" rel="nofollow"> Bryson - SmartOS / KVM / ZFS</a> </li>
<li><a href="http://slexy.org/view/s2OQIxkZst" rel="nofollow"> Samba 1969</a> </li>
<li><a href="http://slexy.org/view/s206j2ekTZ" rel="nofollow"> DO / VPN / PF</a> </li>
<li><p><a href="http://slexy.org/view/s20kyrKSH9" rel="nofollow"> Unstable VM  / Update</a></p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p>

<hr></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>123: ZFS in the trenches</title>
  <link>https://www.bsdnow.tv/123</link>
  <guid isPermaLink="false">f2ccc8f8-3740-4e85-995f-cdf83d7f795f</guid>
  <pubDate>Wed, 06 Jan 2016 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f2ccc8f8-3740-4e85-995f-cdf83d7f795f.mp3" length="87151828" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we will be talking shop with Josh Paetzel of FreeNAS fame, hearing about his best do’s and do-nots of using ZFS in production. Also, a quick</itunes:subtitle>
  <itunes:duration>2:01:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we will be talking shop with Josh Paetzel of FreeNAS fame, hearing about his best do’s and do-nots of using ZFS in production. Also, a quick
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD 
Journal!
***
FreeNAS Logo Design Contest (https://www.ixsystems.com/freenas-logo-contest/)
Rules and Requirements (https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/)
For those of you curious about Kris' new lighting here are the links to what he is using.
Softbox Light Diffuser (http://smile.amazon.com/gp/product/B00OTG6474?psc=1&amp;amp;redirect=true&amp;amp;ref_=oh_aui_detailpage_o01_s00&amp;amp;pldnSite=1)
Full Spectrum 5500K CFL Bulb (http://smile.amazon.com/gp/product/B00198U6U6?psc=1&amp;amp;redirect=true&amp;amp;ref_=oh_aui_detailpage_o06_s00)
***
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
A Brief look back at 2015 (http://fossforce.com/2015/12/bsd-brief-look-back-2015/)
As we start the show this week, we begin with a brief look back at BSD in 2015, brought to us by Larry at FOSS force.
Aside from his issue with tap-to-click on the touchpad, his PC-BSD experience has been pretty good. (Larry, if you hear this, jump on #pcbsd on FreeNode and we will lend a hand)
He mentions that this really isn’t his first time running BSD, apparently back in ye-olden days he got NetBSD up and running on a PowerBook G3, until an update brought that experience to abrupt ending. 
He gives a shout-out to the FreeBSD Foundation as being a great go-to source for wrapup on the previous year in FreeBSD land, while also mentioning the great 4.4 release of DragonFly, and some of the variants, such as RetroBSD and LiteBSD
He leaves us with a tease for 2016 that work is ongoing on Twitter to port over Mopidy, a python based extensible music server
***
A look forward at BSD events throughout 2016 (http://www.bsdevents.org/scheduler/)
After a quick look back at 2015, now its time to start planning your 2016 schedule. The BSDEvents site has a calendar of all the upcoming conferences / shows where BSD will have a presence this year. 
There are quite a few items on the agenda, including non BSD specific conferences, such as SCALE / Fosdem and more.
Take a look and see, you may be able to find something close your location where you can come hang out with other BSD developers.
(or better yet), if a linux conference is coming to your town, think about submitting a BSD talk!
Additionally, if getting BSD Certification is something on your 2016 resolutions, you can often take the test at one of these shows, avoiding the need to travel to a testing center. 
***
The 'Hidden' Cost of Using ZFS for Your Home NAS (http://louwrentius.com/the-hidden-cost-of-using-zfs-for-your-home-nas.html)
An article was recently posted that seems to be trying to dissuade people from using ZFS for their home NAS
It points out what experienced users already know, but many newcomers are not strictly aware of: Expanding a ZFS pool is not always as straightforward as you think it should be
ZFS was designed to be expanded, and it handled this very well
However, a ZFS pool is made up of VDEVs, and it is these VDEVs that provide the redundancy. RAID-Z VDEVs cannot be changed once they are created. You can replace each disk individually, and the VDEV will grow to its new larger size, but you cannot add additional disks to a RAID-Z VDEV
At this point, your option is to add an additional VDEV, although best practises dictate that the new VDEV should use an equal number of disks, to avoid uneven performance
So, if you started with a 6 disk RAID-Z2, having to add 6 more disks to grow the pool does seem excessive
For the best flexibility, use mirrors. If you had used 6 disks as 3 mirrors of 2 disks each, you could then just add 2 more disks at a time. The downside is that using 2TB disks, you’d only have 6TB of usable space, versus the 8TB you would get from those disks in a RAID-Z2
This is the trade-off, mirrors give you better performance and flexibility, but less space efficiency
It is important to note that the diagrams in this article make it appear as if all parity information is stored on specific drives. In ZFS parity is spread across all drives. Often times, the data written to the drive is not of a size that can evenly be split across all drives, so the data actually ends up looking like this (http://blog.delphix.com/matt/files/2014/06/RAIDZ.png)
The errors as I see it in the original article are:
It notes that the hidden cost of ZFS is that if you add a second RAID-Z VDEV, you will have a whole second set of parity drives. While this is a cost, it is the cost of making sure your data is safe. If you had an array with more than 12 drives, it is likely that you would to be able to withstand the failure of the larger number of drives
The article does not consider the resilver time. If you did create a configuration with a very wide RAID-Z stripe, the failure of a disk would leave the pool degraded for a much longer time, leaving your pool at risk for that longer period.
The article does not consider performance. Two RAID-Z2 VDEVs of 6 disks each will give much better performance than a single VDEV of 10 or 12 disks, especially when it comes to IOPS.
***
ZFS Boot Enviroments now availble in the FreeBSD bootloader (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=293001)
It’s been in phabricator for a while (and PC-BSD), but the support for Boot-Environments has now landed upstream in -CURRENT
This work was helped by cross-project collaboration when an IllumOS Developer, Toomas Soome, started porting the FreeBSD loader to IllumOS to replace GRUB there
This gives Beastie menu the ability to look at the ZFS disk, and dynamically list boot-environments that it finds. (Much nicer than GRUB, which required a pre-written configuration file)
This work was extended further, when Toomas Soome also ported the Beastie Menu to the UEFI loader (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=293233) which is now enabled by default for UEFI (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=293234)
All of these changes are scheduled to be merged back in time for FreeBSD 10.3 as well.
There is also a patch being worked on to support booting from ZFS in UEFI (https://reviews.freebsd.org/D4515) 
This is exciting times for doing neat things with ZFS on root, these plus Allans forthcoming GELI support (https://reviews.freebsd.org/D4593) will negate the necessity for GRUB on PC-BSD for example (Kris is very happy)
***
Interview - Josh Paetzel - email@email (mailto:email@email) / @bsdunix4ever (https://twitter.com/bsdunix4ever)
ZFS Support
***
News Roundup
RetroBSD being tested on ESP32 (http://retrobsd.org/viewtopic.php?f=1&amp;amp;t=37470)
More hardware news for RetroBSD and LiteBSD
I don’t know much about this hardware, but there is a lot of discussion in the forum threads about it
Not sure what you are supposed to accomplish with only 400kb of ram
LITEBSD Brings 4.4BSD to PIC32 (https://hackaday.com/2016/01/04/litebsd-brings-4-4bsd-to-pic32/)
It is interesting to see these super-small boards with only 512kb of memory, but will crypto offload support
It is also interesting to see talk of 140mbps WiFi, can the processor actually handle that much traffic?
BSD Unix-like OS is Resurrected for Embedded IoT Market (http://thevarguy.com/open-source-application-software-companies/bsd-unix-os-resurrected-embedded-iot-market)
Related to the above stories, we also have an article about BSD making a resurgence on various Internet of things devices, which mentions both RetroBSD and LiteBSD
The article mentions that this is an exciting development for embedded vars who now have an alternative licensed open-source OS to potentially use
***
HardenedBSD’s new Binary Updater (https://hardenedbsd.org/article/shawn-webb/2015-12-31/introducing-hardenedbsds-new-binary-updater)
It looks like there is now another way to update your FreeBSD(hardened) system
The post by Shawn Web, details how the new updater will work in future releases of HBSD
 Right now it looks fairly straight-forward, creating both the base.txz and kernel.txz, along with some data for etcupdate
It includes a nice option for the kernel name in the update, allowing different kernels to be installed / updated at will
Everything is cryptographically signed and verified using the base system openssl
The build system is fairly simple, only requiring “sh/git/openssl” to create the binary updates
Planned features also include updating of jails, and ZFS boot-environments
***
Sometimes, processors need (BSD) love too (http://functionallyparanoid.com/2016/01/02/sometimes-processors-need-love-too/)
We have a blog post from Brian Everly, talking about his long journey into legacy processors and the plans for the future to work on better supporting them on OpenBSD ports
He begins with the story of his UNIX journey to today, and why this fostered his love for many of these old (and not so old) architectures, such as Sparc64, PPC32, i386.
This journey ended up with the purchase of some legacy hardware (ebay is your friend), and the creation of a database listing the major port blockers on each platform
This is the great kind of thing folks can do to step up and help a project, even as a weekend hobby it’s great to run some hardware and help test / fix up issues that other developers maybe don’t interact with as much anymore. 
***
Beastie Bits
The standard MWL disclaimer (http://blather.michaelwlucas.com/archives/2510)
PC-BSD 11.0-CURRENTJAN2016 Available (http://lists.pcbsd.org/pipermail/testing/2016-January/010350.html) 
NetBSD pkgsrc-2015Q3 statistics (http://mail-index.netbsd.org/tech-pkg/2015/12/28/msg016193.html)
NetBSD pkgsrc-2015Q4 released (http://mail-index.netbsd.org/tech-pkg/2016/01/01/msg016213.html)
First Reproducible builds conference in Athens (http://blog.netbsd.org/tnf/entry/reproducible_builds_conference_in_athens)
The creator of the original ThinkPad design passes away  (http://www.theregister.co.uk/2016/01/06/thinkpad_designer_obituary)
Feedback/Questions
 Andrew - High Contrast (http://slexy.org/view/s213iCKLwn) 
 John - FreeNAS followup (http://slexy.org/view/s21ClGePLP) 
 Giorgio - Custom Install (http://slexy.org/view/s21527pkO1) 
 Don - ZFS Slowdowns (http://slexy.org/view/s2jOlCsjkU) 
 Fred - Dual Boot PC-BSD/Linux (http://slexy.org/view/s21uaB0FDU) 
***
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we will be talking shop with Josh Paetzel of FreeNAS fame, hearing about his best do’s and do-nots of using ZFS in production. Also, a quick</p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD 
Journal!
***</li>
</ul>

<h4><a href="https://www.ixsystems.com/freenas-logo-contest/" rel="nofollow">FreeNAS Logo Design Contest</a></h4>

<p><a href="https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/" rel="nofollow">Rules and Requirements</a></p>

<hr>

<h4>For those of you curious about Kris&#39; new lighting here are the links to what he is using.</h4>

<ul>
<li><a href="http://smile.amazon.com/gp/product/B00OTG6474?psc=1&redirect=true&ref_=oh_aui_detailpage_o01_s00&pldnSite=1" rel="nofollow">Softbox Light Diffuser</a></li>
<li><a href="http://smile.amazon.com/gp/product/B00198U6U6?psc=1&redirect=true&ref_=oh_aui_detailpage_o06_s00" rel="nofollow">Full Spectrum 5500K CFL Bulb</a>
***</li>
</ul>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://fossforce.com/2015/12/bsd-brief-look-back-2015/" rel="nofollow">A Brief look back at 2015</a></h3>

<ul>
<li>As we start the show this week, we begin with a brief look back at BSD in 2015, brought to us by Larry at FOSS force.</li>
<li>Aside from his issue with tap-to-click on the touchpad, his PC-BSD experience has been pretty good. (Larry, if you hear this, jump on #pcbsd on FreeNode and we will lend a hand)</li>
<li>He mentions that this <em>really</em> isn’t his first time running BSD, apparently back in ye-olden days he got NetBSD up and running on a PowerBook G3, until an update brought that experience to abrupt ending. </li>
<li>He gives a shout-out to the FreeBSD Foundation as being a great go-to source for wrapup on the previous year in FreeBSD land, while also mentioning the great 4.4 release of DragonFly, and some of the variants, such as RetroBSD and LiteBSD</li>
<li>He leaves us with a tease for 2016 that work is ongoing on Twitter to port over Mopidy, a python based extensible music server
***</li>
</ul>

<h3><a href="http://www.bsdevents.org/scheduler/" rel="nofollow">A look forward at BSD events throughout 2016</a></h3>

<ul>
<li>After a quick look back at 2015, now its time to start planning your 2016 schedule. The BSDEvents site has a calendar of all the upcoming conferences / shows where BSD will have a presence this year. </li>
<li>There are quite a few items on the agenda, including non BSD specific conferences, such as SCALE / Fosdem and more.</li>
<li>Take a look and see, you may be able to find something close your location where you can come hang out with other BSD developers.</li>
<li>(or better yet), if a linux conference is coming to your town, think about submitting a BSD talk!</li>
<li>Additionally, if getting BSD Certification is something on your 2016 resolutions, you can often take the test at one of these shows, avoiding the need to travel to a testing center. 
***</li>
</ul>

<h3><a href="http://louwrentius.com/the-hidden-cost-of-using-zfs-for-your-home-nas.html" rel="nofollow">The &#39;Hidden&#39; Cost of Using ZFS for Your Home NAS</a></h3>

<ul>
<li>An article was recently posted that seems to be trying to dissuade people from using ZFS for their home NAS</li>
<li>It points out what experienced users already know, but many newcomers are not strictly aware of: Expanding a ZFS pool is not always as straightforward as you think it should be</li>
<li>ZFS was designed to be expanded, and it handled this very well</li>
<li>However, a ZFS pool is made up of VDEVs, and it is these VDEVs that provide the redundancy. RAID-Z VDEVs cannot be changed once they are created. You can replace each disk individually, and the VDEV will grow to its new larger size, but you cannot add additional disks to a RAID-Z VDEV</li>
<li>At this point, your option is to add an additional VDEV, although best practises dictate that the new VDEV should use an equal number of disks, to avoid uneven performance</li>
<li>So, if you started with a 6 disk RAID-Z2, having to add 6 more disks to grow the pool does seem excessive</li>
<li>For the best flexibility, use mirrors. If you had used 6 disks as 3 mirrors of 2 disks each, you could then just add 2 more disks at a time. The downside is that using 2TB disks, you’d only have 6TB of usable space, versus the 8TB you would get from those disks in a RAID-Z2</li>
<li>This is the trade-off, mirrors give you better performance and flexibility, but less space efficiency</li>
<li>It is important to note that the diagrams in this article make it appear as if all parity information is stored on specific drives. In ZFS parity is spread across all drives. Often times, the data written to the drive is not of a size that can evenly be split across all drives, so the data actually ends up <a href="http://blog.delphix.com/matt/files/2014/06/RAIDZ.png" rel="nofollow">looking like this</a></li>
<li>The errors as I see it in the original article are:

<ul>
<li>It notes that the hidden cost of ZFS is that if you add a second RAID-Z VDEV, you will have a whole second set of parity drives. While this is a cost, it is the cost of making sure your data is safe. If you had an array with more than 12 drives, it is likely that you would to be able to withstand the failure of the larger number of drives</li>
<li>The article does not consider the resilver time. If you did create a configuration with a very wide RAID-Z stripe, the failure of a disk would leave the pool degraded for a much longer time, leaving your pool at risk for that longer period.</li>
<li>The article does not consider performance. Two RAID-Z2 VDEVs of 6 disks each will give much better performance than a single VDEV of 10 or 12 disks, especially when it comes to IOPS.
***</li>
</ul></li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=293001" rel="nofollow">ZFS Boot Enviroments now availble in the FreeBSD bootloader</a></h3>

<ul>
<li>It’s been in phabricator for a while (and PC-BSD), but the support for Boot-Environments has now landed upstream in -CURRENT</li>
<li>This work was helped by cross-project collaboration when an IllumOS Developer, Toomas Soome, started porting the FreeBSD loader to IllumOS to replace GRUB there</li>
<li>This gives Beastie menu the ability to look at the ZFS disk, and dynamically list boot-environments that it finds. (Much nicer than GRUB, which required a pre-written configuration file)</li>
<li>This work was extended further, when Toomas Soome also ported the <a href="https://svnweb.freebsd.org/base?view=revision&revision=293233" rel="nofollow">Beastie Menu to the UEFI loader</a> which is now <a href="https://svnweb.freebsd.org/base?view=revision&revision=293234" rel="nofollow">enabled by default for UEFI</a></li>
<li>All of these changes are scheduled to be merged back in time for FreeBSD 10.3 as well.</li>
<li>There is also a patch being worked on to <a href="https://reviews.freebsd.org/D4515" rel="nofollow">support booting from ZFS in UEFI</a> </li>
<li>This is exciting times for doing neat things with ZFS on root, these plus Allans forthcoming <a href="https://reviews.freebsd.org/D4593" rel="nofollow">GELI support</a> will negate the necessity for GRUB on PC-BSD for example (Kris is very happy)
***</li>
</ul>

<h2>Interview - Josh Paetzel - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/bsdunix4ever" rel="nofollow">@bsdunix4ever</a></h2>

<ul>
<li>ZFS Support
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://retrobsd.org/viewtopic.php?f=1&t=37470" rel="nofollow">RetroBSD being tested on ESP32</a></h3>

<ul>
<li>More hardware news for RetroBSD and LiteBSD</li>
<li>I don’t know much about this hardware, but there is a lot of discussion in the forum threads about it</li>
<li>Not sure what you are supposed to accomplish with only 400kb of ram</li>
<li><a href="https://hackaday.com/2016/01/04/litebsd-brings-4-4bsd-to-pic32/" rel="nofollow">LITEBSD Brings 4.4BSD to PIC32</a></li>
<li>It is interesting to see these super-small boards with only 512kb of memory, but will crypto offload support</li>
<li>It is also interesting to see talk of 140mbps WiFi, can the processor actually handle that much traffic?
<a href="http://thevarguy.com/open-source-application-software-companies/bsd-unix-os-resurrected-embedded-iot-market" rel="nofollow">BSD Unix-like OS is Resurrected for Embedded IoT Market</a></li>
<li>Related to the above stories, we also have an article about BSD making a resurgence on various Internet of things devices, which mentions both RetroBSD and LiteBSD</li>
<li>The article mentions that this is an exciting development for embedded vars who now have an alternative licensed open-source OS to potentially use
***</li>
</ul>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2015-12-31/introducing-hardenedbsds-new-binary-updater" rel="nofollow">HardenedBSD’s new Binary Updater</a></h3>

<ul>
<li>It looks like there is now another way to update your FreeBSD(hardened) system</li>
<li>The post by Shawn Web, details how the new updater will work in future releases of HBSD</li>
<li> Right now it looks fairly straight-forward, creating both the base.txz and kernel.txz, along with some data for etcupdate</li>
<li>It includes a nice option for the kernel name in the update, allowing different kernels to be installed / updated at will</li>
<li>Everything is cryptographically signed and verified using the base system openssl</li>
<li>The build system is fairly simple, only requiring “sh/git/openssl” to create the binary updates</li>
<li>Planned features also include updating of jails, and ZFS boot-environments
***</li>
</ul>

<h3><a href="http://functionallyparanoid.com/2016/01/02/sometimes-processors-need-love-too/" rel="nofollow">Sometimes, processors need (BSD) love too</a></h3>

<ul>
<li>We have a blog post from Brian Everly, talking about his long journey into legacy processors and the plans for the future to work on better supporting them on OpenBSD ports</li>
<li>He begins with the story of his UNIX journey to today, and why this fostered his love for many of these old (and not so old) architectures, such as Sparc64, PPC32, i386.</li>
<li>This journey ended up with the purchase of some legacy hardware (ebay is your friend), and the creation of a database listing the major port blockers on each platform</li>
<li>This is the great kind of thing folks can do to step up and help a project, even as a weekend hobby it’s great to run some hardware and help test / fix up issues that other developers maybe don’t interact with as much anymore. 
***</li>
</ul>

<h3>Beastie Bits</h3>

<p><a href="http://blather.michaelwlucas.com/archives/2510" rel="nofollow">The standard MWL disclaimer</a></p>

<p><a href="http://lists.pcbsd.org/pipermail/testing/2016-January/010350.html" rel="nofollow">PC-BSD 11.0-CURRENTJAN2016 Available</a> </p>

<p><a href="http://mail-index.netbsd.org/tech-pkg/2015/12/28/msg016193.html" rel="nofollow">NetBSD pkgsrc-2015Q3 statistics</a></p>

<p><a href="http://mail-index.netbsd.org/tech-pkg/2016/01/01/msg016213.html" rel="nofollow">NetBSD pkgsrc-2015Q4 released</a></p>

<p><a href="http://blog.netbsd.org/tnf/entry/reproducible_builds_conference_in_athens" rel="nofollow">First Reproducible builds conference in Athens</a></p>

<p><a href="http://www.theregister.co.uk/2016/01/06/thinkpad_designer_obituary" rel="nofollow">The creator of the original ThinkPad design passes away </a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s213iCKLwn" rel="nofollow"> Andrew - High Contrast</a> </li>
<li><a href="http://slexy.org/view/s21ClGePLP" rel="nofollow"> John - FreeNAS followup</a> </li>
<li><a href="http://slexy.org/view/s21527pkO1" rel="nofollow"> Giorgio - Custom Install</a> </li>
<li><a href="http://slexy.org/view/s2jOlCsjkU" rel="nofollow"> Don - ZFS Slowdowns</a> </li>
<li><a href="http://slexy.org/view/s21uaB0FDU" rel="nofollow"> Fred - Dual Boot PC-BSD/Linux</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we will be talking shop with Josh Paetzel of FreeNAS fame, hearing about his best do’s and do-nots of using ZFS in production. Also, a quick</p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD 
Journal!
***</li>
</ul>

<h4><a href="https://www.ixsystems.com/freenas-logo-contest/" rel="nofollow">FreeNAS Logo Design Contest</a></h4>

<p><a href="https://forums.freenas.org/index.php?threads/freenas-logo-design-contest.39968/" rel="nofollow">Rules and Requirements</a></p>

<hr>

<h4>For those of you curious about Kris&#39; new lighting here are the links to what he is using.</h4>

<ul>
<li><a href="http://smile.amazon.com/gp/product/B00OTG6474?psc=1&redirect=true&ref_=oh_aui_detailpage_o01_s00&pldnSite=1" rel="nofollow">Softbox Light Diffuser</a></li>
<li><a href="http://smile.amazon.com/gp/product/B00198U6U6?psc=1&redirect=true&ref_=oh_aui_detailpage_o06_s00" rel="nofollow">Full Spectrum 5500K CFL Bulb</a>
***</li>
</ul>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://fossforce.com/2015/12/bsd-brief-look-back-2015/" rel="nofollow">A Brief look back at 2015</a></h3>

<ul>
<li>As we start the show this week, we begin with a brief look back at BSD in 2015, brought to us by Larry at FOSS force.</li>
<li>Aside from his issue with tap-to-click on the touchpad, his PC-BSD experience has been pretty good. (Larry, if you hear this, jump on #pcbsd on FreeNode and we will lend a hand)</li>
<li>He mentions that this <em>really</em> isn’t his first time running BSD, apparently back in ye-olden days he got NetBSD up and running on a PowerBook G3, until an update brought that experience to abrupt ending. </li>
<li>He gives a shout-out to the FreeBSD Foundation as being a great go-to source for wrapup on the previous year in FreeBSD land, while also mentioning the great 4.4 release of DragonFly, and some of the variants, such as RetroBSD and LiteBSD</li>
<li>He leaves us with a tease for 2016 that work is ongoing on Twitter to port over Mopidy, a python based extensible music server
***</li>
</ul>

<h3><a href="http://www.bsdevents.org/scheduler/" rel="nofollow">A look forward at BSD events throughout 2016</a></h3>

<ul>
<li>After a quick look back at 2015, now its time to start planning your 2016 schedule. The BSDEvents site has a calendar of all the upcoming conferences / shows where BSD will have a presence this year. </li>
<li>There are quite a few items on the agenda, including non BSD specific conferences, such as SCALE / Fosdem and more.</li>
<li>Take a look and see, you may be able to find something close your location where you can come hang out with other BSD developers.</li>
<li>(or better yet), if a linux conference is coming to your town, think about submitting a BSD talk!</li>
<li>Additionally, if getting BSD Certification is something on your 2016 resolutions, you can often take the test at one of these shows, avoiding the need to travel to a testing center. 
***</li>
</ul>

<h3><a href="http://louwrentius.com/the-hidden-cost-of-using-zfs-for-your-home-nas.html" rel="nofollow">The &#39;Hidden&#39; Cost of Using ZFS for Your Home NAS</a></h3>

<ul>
<li>An article was recently posted that seems to be trying to dissuade people from using ZFS for their home NAS</li>
<li>It points out what experienced users already know, but many newcomers are not strictly aware of: Expanding a ZFS pool is not always as straightforward as you think it should be</li>
<li>ZFS was designed to be expanded, and it handled this very well</li>
<li>However, a ZFS pool is made up of VDEVs, and it is these VDEVs that provide the redundancy. RAID-Z VDEVs cannot be changed once they are created. You can replace each disk individually, and the VDEV will grow to its new larger size, but you cannot add additional disks to a RAID-Z VDEV</li>
<li>At this point, your option is to add an additional VDEV, although best practises dictate that the new VDEV should use an equal number of disks, to avoid uneven performance</li>
<li>So, if you started with a 6 disk RAID-Z2, having to add 6 more disks to grow the pool does seem excessive</li>
<li>For the best flexibility, use mirrors. If you had used 6 disks as 3 mirrors of 2 disks each, you could then just add 2 more disks at a time. The downside is that using 2TB disks, you’d only have 6TB of usable space, versus the 8TB you would get from those disks in a RAID-Z2</li>
<li>This is the trade-off, mirrors give you better performance and flexibility, but less space efficiency</li>
<li>It is important to note that the diagrams in this article make it appear as if all parity information is stored on specific drives. In ZFS parity is spread across all drives. Often times, the data written to the drive is not of a size that can evenly be split across all drives, so the data actually ends up <a href="http://blog.delphix.com/matt/files/2014/06/RAIDZ.png" rel="nofollow">looking like this</a></li>
<li>The errors as I see it in the original article are:

<ul>
<li>It notes that the hidden cost of ZFS is that if you add a second RAID-Z VDEV, you will have a whole second set of parity drives. While this is a cost, it is the cost of making sure your data is safe. If you had an array with more than 12 drives, it is likely that you would to be able to withstand the failure of the larger number of drives</li>
<li>The article does not consider the resilver time. If you did create a configuration with a very wide RAID-Z stripe, the failure of a disk would leave the pool degraded for a much longer time, leaving your pool at risk for that longer period.</li>
<li>The article does not consider performance. Two RAID-Z2 VDEVs of 6 disks each will give much better performance than a single VDEV of 10 or 12 disks, especially when it comes to IOPS.
***</li>
</ul></li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=293001" rel="nofollow">ZFS Boot Enviroments now availble in the FreeBSD bootloader</a></h3>

<ul>
<li>It’s been in phabricator for a while (and PC-BSD), but the support for Boot-Environments has now landed upstream in -CURRENT</li>
<li>This work was helped by cross-project collaboration when an IllumOS Developer, Toomas Soome, started porting the FreeBSD loader to IllumOS to replace GRUB there</li>
<li>This gives Beastie menu the ability to look at the ZFS disk, and dynamically list boot-environments that it finds. (Much nicer than GRUB, which required a pre-written configuration file)</li>
<li>This work was extended further, when Toomas Soome also ported the <a href="https://svnweb.freebsd.org/base?view=revision&revision=293233" rel="nofollow">Beastie Menu to the UEFI loader</a> which is now <a href="https://svnweb.freebsd.org/base?view=revision&revision=293234" rel="nofollow">enabled by default for UEFI</a></li>
<li>All of these changes are scheduled to be merged back in time for FreeBSD 10.3 as well.</li>
<li>There is also a patch being worked on to <a href="https://reviews.freebsd.org/D4515" rel="nofollow">support booting from ZFS in UEFI</a> </li>
<li>This is exciting times for doing neat things with ZFS on root, these plus Allans forthcoming <a href="https://reviews.freebsd.org/D4593" rel="nofollow">GELI support</a> will negate the necessity for GRUB on PC-BSD for example (Kris is very happy)
***</li>
</ul>

<h2>Interview - Josh Paetzel - <a href="mailto:email@email" rel="nofollow">email@email</a> / <a href="https://twitter.com/bsdunix4ever" rel="nofollow">@bsdunix4ever</a></h2>

<ul>
<li>ZFS Support
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://retrobsd.org/viewtopic.php?f=1&t=37470" rel="nofollow">RetroBSD being tested on ESP32</a></h3>

<ul>
<li>More hardware news for RetroBSD and LiteBSD</li>
<li>I don’t know much about this hardware, but there is a lot of discussion in the forum threads about it</li>
<li>Not sure what you are supposed to accomplish with only 400kb of ram</li>
<li><a href="https://hackaday.com/2016/01/04/litebsd-brings-4-4bsd-to-pic32/" rel="nofollow">LITEBSD Brings 4.4BSD to PIC32</a></li>
<li>It is interesting to see these super-small boards with only 512kb of memory, but will crypto offload support</li>
<li>It is also interesting to see talk of 140mbps WiFi, can the processor actually handle that much traffic?
<a href="http://thevarguy.com/open-source-application-software-companies/bsd-unix-os-resurrected-embedded-iot-market" rel="nofollow">BSD Unix-like OS is Resurrected for Embedded IoT Market</a></li>
<li>Related to the above stories, we also have an article about BSD making a resurgence on various Internet of things devices, which mentions both RetroBSD and LiteBSD</li>
<li>The article mentions that this is an exciting development for embedded vars who now have an alternative licensed open-source OS to potentially use
***</li>
</ul>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2015-12-31/introducing-hardenedbsds-new-binary-updater" rel="nofollow">HardenedBSD’s new Binary Updater</a></h3>

<ul>
<li>It looks like there is now another way to update your FreeBSD(hardened) system</li>
<li>The post by Shawn Web, details how the new updater will work in future releases of HBSD</li>
<li> Right now it looks fairly straight-forward, creating both the base.txz and kernel.txz, along with some data for etcupdate</li>
<li>It includes a nice option for the kernel name in the update, allowing different kernels to be installed / updated at will</li>
<li>Everything is cryptographically signed and verified using the base system openssl</li>
<li>The build system is fairly simple, only requiring “sh/git/openssl” to create the binary updates</li>
<li>Planned features also include updating of jails, and ZFS boot-environments
***</li>
</ul>

<h3><a href="http://functionallyparanoid.com/2016/01/02/sometimes-processors-need-love-too/" rel="nofollow">Sometimes, processors need (BSD) love too</a></h3>

<ul>
<li>We have a blog post from Brian Everly, talking about his long journey into legacy processors and the plans for the future to work on better supporting them on OpenBSD ports</li>
<li>He begins with the story of his UNIX journey to today, and why this fostered his love for many of these old (and not so old) architectures, such as Sparc64, PPC32, i386.</li>
<li>This journey ended up with the purchase of some legacy hardware (ebay is your friend), and the creation of a database listing the major port blockers on each platform</li>
<li>This is the great kind of thing folks can do to step up and help a project, even as a weekend hobby it’s great to run some hardware and help test / fix up issues that other developers maybe don’t interact with as much anymore. 
***</li>
</ul>

<h3>Beastie Bits</h3>

<p><a href="http://blather.michaelwlucas.com/archives/2510" rel="nofollow">The standard MWL disclaimer</a></p>

<p><a href="http://lists.pcbsd.org/pipermail/testing/2016-January/010350.html" rel="nofollow">PC-BSD 11.0-CURRENTJAN2016 Available</a> </p>

<p><a href="http://mail-index.netbsd.org/tech-pkg/2015/12/28/msg016193.html" rel="nofollow">NetBSD pkgsrc-2015Q3 statistics</a></p>

<p><a href="http://mail-index.netbsd.org/tech-pkg/2016/01/01/msg016213.html" rel="nofollow">NetBSD pkgsrc-2015Q4 released</a></p>

<p><a href="http://blog.netbsd.org/tnf/entry/reproducible_builds_conference_in_athens" rel="nofollow">First Reproducible builds conference in Athens</a></p>

<p><a href="http://www.theregister.co.uk/2016/01/06/thinkpad_designer_obituary" rel="nofollow">The creator of the original ThinkPad design passes away </a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s213iCKLwn" rel="nofollow"> Andrew - High Contrast</a> </li>
<li><a href="http://slexy.org/view/s21ClGePLP" rel="nofollow"> John - FreeNAS followup</a> </li>
<li><a href="http://slexy.org/view/s21527pkO1" rel="nofollow"> Giorgio - Custom Install</a> </li>
<li><a href="http://slexy.org/view/s2jOlCsjkU" rel="nofollow"> Don - ZFS Slowdowns</a> </li>
<li><a href="http://slexy.org/view/s21uaB0FDU" rel="nofollow"> Fred - Dual Boot PC-BSD/Linux</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>122: The BSD Black Box</title>
  <link>https://www.bsdnow.tv/122</link>
  <guid isPermaLink="false">a7a3ccc1-f728-4364-b18d-f351af30438b</guid>
  <pubDate>Wed, 30 Dec 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a7a3ccc1-f728-4364-b18d-f351af30438b.mp3" length="86202628" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we will be interviewing Alex Rosenberg, to</itunes:subtitle>
  <itunes:duration>2:23:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we will be interviewing Alex Rosenberg, to
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
Life with an OpenBSD Laptop: A UNIX-lover's tale of migrating away from the Mac. The Good, The Bad, The Ugly (http://www.nycbug.org/event/10356/openbsd_laptop_nycbug_2015.pdf)
OpenBSD user Isaac (.ike) Levy details his switch from a Mac to an OpenBSD laptop
He covers a bit about selecting hardware and dealing with wifi
Talks about binary packages and system upgrades
Talks about power management, suspend/resume, battery life
Show screenshots of some of his favourite window managers
Browsers and email clients are also discussed
Things he found missing in OpenBSD:
A journaling file system, every unclean shutdown means a full fsck(1)
UTF-8/unicode was not everywhere
Syncing pictures and contacts to his phone
Drawing tools
***
DragonFlyBSD matches its Intel kernel graphics driver against Linux 4.0 (http://lists.dragonflybsd.org/pipermail/commits/2015-December/459067.html)
The DragonFlyBSD DRM stack continues to rapidly advance, now bringing in support from Linux 4.0!
Some of the notable features:
Basic Skylake support    
Panel Self-Refresh (PSR) now supported on Valleyview and Cherryview    
Preparations for atomic display updates    
Performance improvements on various GPU families, including Cherryview, Broadwell and Haswell    
GPU frequencies are now kept at a minimum of 450MHz when possible on Haswell and Broadwell, ensuring a minimum experience level for various types of workloads    
Improved reset support for gen3/4 GPUs, which should fix some OpenGL crashes on Core 2 and pre-2012 Atom machine
Better sound/graphics driver synchronization for audio over hdmi support    
As usual, small bugfixes and stability improvements here and there
***
A BSD Wish List for 2016 (http://fossforce.com/2015/12/bsd-wish-list-2016/)
Larry over at Foss Force brings us his wish list for BSD support in 2016. 
Since he has converted most of his daily desktop usage to PC-BSD, he is specifically wanting support for some desktop applications. Namely Google hangouts and Spotify. 
This is something which has come up periodically among the PC-BSD community. At the moment most users are dual-booting or using alternatives, like WebRTC. However the Google Hangouts plugin is available for Linux, and perhaps this will encourage some developers to see if we can get it running with the newer Linux stack on -CURRENT. 
Spotify also has a native Linux version, which may need testing on FreeBSD - CURRENT. It may be closer now, and should be updated on the Wanted Ports Page
https://wiki.freebsd.org/WantedPorts 
***
Hard Float API coming soon by default to armv6 (http://bsdimp.blogspot.com/2015/12/hard-float-api-coming-soon-by-default.html)
Warner Losh talks about upcoming changes to armv6 on FreeBSD 
“All the CPUs that FreeBSD supports have hard floating point in them. We've supported hard float for quite some time in the FreeBSD kernel. However, by default, we still use a soft-float ABI.”
First, “A new armv6hf (architecture) was created, but that caused some issues with some ports, and the meaning of 'soft float' sadly was ambiguous between the soft-float ABI, and the soft-float libraries that implement floating point when there's no hardware FPU”
“Over the spring and summer, I fixed ld.so so that it  can load both soft ABI and hard ABI libraries on the same system, depending on markings in the binaries themselves. Soft float ABI and hard float ABI binaries have different flags in the ELF headers, so it is relatively straightforward to know which is which.”
“So, in the coming days, I'll commit the first set of changes to move to armv6 as a hard float ABI by default. The kernel doesn't care: it can execute both. The new ld.so will allow you to transition through this change by allowing old, compat soft ABI libraries to co-exist on the system with new hard ABI libraries. This change alone isn't enough, but it will be good to get it out into circulation.”
“armv6hf will be removed before FreeBSD 11”
A LIBSOFT will be created, similar in concept to the LIB32 available on AMD64
***
Interview - Alex Rosenberg - alexr@leftfield.org (mailto:alexr@leftfield.org) / @alexr (https://twitter.com/alexr)
Former Manager of Platform Architecture at Sony
***
Beastie Bits
Tuesday, Dec 20, 2005 was the release date of the very first bsdtalkpodcast (http://bsdtalk.blogspot.com/2005/12/bsdtalk001-intro-to-bsd.html)
Patch: Server side support for TCP FastOpen  (https://reviews.freebsd.org/D4350) 
Learn to tame OpenBSD quickly (http://www.openbsdjumpstart.org/)
Hardware Accerated iSCSI lands in FreeBSD  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=292740) 
Settings for full HD resolution on DragonFlyBSD under QEMU/KVM, thanks to reddit user Chapo_Rouge (https://www.reddit.com/r/dragonflybsd/comments/3x4n7u/psa_1920x1080_on_dragonflybsd_44_under_qemukvm/)
Patch: An IllumOS developer has been porting the FreeBSD boot loader to replace their old version of GRUB. In doing so, he has also made improvements to the block caching in the boot loader  (https://reviews.freebsd.org/D4713) 
A FreeBSD user working at Microsoft talks about Microsoft’s shift to Open Source  (http://blog.teleri.net/open-microsoft/) 
BSDCG Exam Session at FOSDEM'16 (https://fosdem.org/2016/schedule/event/cert_bsdcg/)
Schedule for the BSD devroom at FOSDEM'16 (https://fosdem.org/2016/schedule/track/bsd/)
OpenBSD snapshots are now 5.9 (http://marc.info/?l=openbsd-cvs&amp;amp;m=145055446007162&amp;amp;w=2)
Notes on making BSD grep faster  (http://blog.erratasec.com/2015/12/some-notes-on-fast-grep.html#.VoQKD1JSRhx) 
Intel’s Platform Application Engineering (PAE) group within the Networking Division (ND) is looking for a Network Software Engineer (https://www-ssl.intel.com/content/www/us/en/jobs/job-search/js2.html?job=782165&amp;amp;src=ML-12080) 
Did you watch Die Hard at Christmas? Get the Die Hard FreeBSD boot screen: install this file in /boot and set loader_logo="tribute" in /boot/loader.conf  (http://locheil.shxd.cx/logo-tribute.4th) 
Feedback/Questions
 Jeremy - ZFS without root (http://slexy.org/view/s20CTqtEan) 
 Dan - Getting PC-BSD Media (http://slexy.org/view/s20sNPoDm5)  
 Chris - VMs and FreeBSD (http://slexy.org/view/s2hjsVgGBK) 
 Ben - Haswell and IRC (http://slexy.org/view/s21pwYOTHi) 
Instructions for trying the Haswell patch (https://wiki.freebsd.org/Graphics/Update%20i915%20GPU%20driver%20to%20Linux%203.8)
 Matt - Donation to foundation (http://slexy.org/view/s20vifHCyc) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we will be interviewing Alex Rosenberg, to</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://www.nycbug.org/event/10356/openbsd_laptop_nycbug_2015.pdf" rel="nofollow">Life with an OpenBSD Laptop: A UNIX-lover&#39;s tale of migrating away from the Mac. The Good, The Bad, The Ugly</a></h3>

<ul>
<li>OpenBSD user Isaac (.ike) Levy details his switch from a Mac to an OpenBSD laptop</li>
<li>He covers a bit about selecting hardware and dealing with wifi</li>
<li>Talks about binary packages and system upgrades</li>
<li>Talks about power management, suspend/resume, battery life</li>
<li>Show screenshots of some of his favourite window managers</li>
<li>Browsers and email clients are also discussed</li>
<li>Things he found missing in OpenBSD:

<ul>
<li>A journaling file system, every unclean shutdown means a full fsck(1)</li>
<li>UTF-8/unicode was not everywhere</li>
<li>Syncing pictures and contacts to his phone</li>
<li>Drawing tools
***</li>
</ul></li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-December/459067.html" rel="nofollow">DragonFlyBSD matches its Intel kernel graphics driver against Linux 4.0</a></h3>

<ul>
<li>The DragonFlyBSD DRM stack continues to rapidly advance, now bringing in support from Linux 4.0!</li>
<li>Some of the notable features:</li>
<li>Basic Skylake support<br>

<ul>
<li>Panel Self-Refresh (PSR) now supported on Valleyview and Cherryview<br></li>
<li>Preparations for atomic display updates<br></li>
<li>Performance improvements on various GPU families, including Cherryview, Broadwell and Haswell<br></li>
<li>GPU frequencies are now kept at a minimum of 450MHz when possible on Haswell and Broadwell, ensuring a minimum experience level for various types of workloads<br></li>
<li>Improved reset support for gen3/4 GPUs, which should fix some OpenGL crashes on Core 2 and pre-2012 Atom machine</li>
<li>Better sound/graphics driver synchronization for audio over hdmi support<br></li>
<li>As usual, small bugfixes and stability improvements here and there
***</li>
</ul></li>
</ul>

<h3><a href="http://fossforce.com/2015/12/bsd-wish-list-2016/" rel="nofollow">A BSD Wish List for 2016</a></h3>

<ul>
<li>Larry over at Foss Force brings us his wish list for BSD support in 2016. </li>
<li>Since he has converted most of his daily desktop usage to PC-BSD, he is specifically wanting support for some desktop applications. Namely Google hangouts and Spotify. </li>
<li>This is something which has come up periodically among the PC-BSD community. At the moment most users are dual-booting or using alternatives, like WebRTC. However the Google Hangouts plugin is available for Linux, and perhaps this will encourage some developers to see if we can get it running with the newer Linux stack on -CURRENT. </li>
<li>Spotify also has a native Linux version, which may need testing on FreeBSD - CURRENT. It may be closer now, and should be updated on the Wanted Ports Page</li>
<li><a href="https://wiki.freebsd.org/WantedPorts" rel="nofollow">https://wiki.freebsd.org/WantedPorts</a> 
***</li>
</ul>

<h3><a href="http://bsdimp.blogspot.com/2015/12/hard-float-api-coming-soon-by-default.html" rel="nofollow">Hard Float API coming soon by default to armv6</a></h3>

<ul>
<li>Warner Losh talks about upcoming changes to armv6 on FreeBSD </li>
<li>“All the CPUs that FreeBSD supports have hard floating point in them. We&#39;ve supported hard float for quite some time in the FreeBSD kernel. However, by default, we still use a soft-float ABI.”</li>
<li>First, “A new armv6hf (architecture) was created, but that caused some issues with some ports, and the meaning of &#39;soft float&#39; sadly was ambiguous between the soft-float ABI, and the soft-float libraries that implement floating point when there&#39;s no hardware FPU”</li>
<li>“Over the spring and summer, I fixed ld.so so that it  can load both soft ABI and hard ABI libraries on the same system, depending on markings in the binaries themselves. Soft float ABI and hard float ABI binaries have different flags in the ELF headers, so it is relatively straightforward to know which is which.”</li>
<li>“So, in the coming days, I&#39;ll commit the first set of changes to move to armv6 as a hard float ABI by default. The kernel doesn&#39;t care: it can execute both. The new ld.so will allow you to transition through this change by allowing old, compat soft ABI libraries to co-exist on the system with new hard ABI libraries. This change alone isn&#39;t enough, but it will be good to get it out into circulation.”</li>
<li>“armv6hf will be removed before FreeBSD 11”</li>
<li>A LIBSOFT will be created, similar in concept to the LIB32 available on AMD64
***</li>
</ul>

<h2>Interview - Alex Rosenberg - <a href="mailto:alexr@leftfield.org" rel="nofollow">alexr@leftfield.org</a> / <a href="https://twitter.com/alexr" rel="nofollow">@alexr</a></h2>

<ul>
<li>Former Manager of Platform Architecture at Sony
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="http://bsdtalk.blogspot.com/2005/12/bsdtalk001-intro-to-bsd.html" rel="nofollow">Tuesday, Dec 20, 2005 was the release date of the very first bsdtalkpodcast</a></p></li>
<li><p><a href="https://reviews.freebsd.org/D4350" rel="nofollow">Patch: Server side support for TCP FastOpen </a> </p></li>
<li><p><a href="http://www.openbsdjumpstart.org/" rel="nofollow">Learn to tame OpenBSD quickly</a></p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=292740" rel="nofollow">Hardware Accerated iSCSI lands in FreeBSD </a> </p></li>
<li><p><a href="https://www.reddit.com/r/dragonflybsd/comments/3x4n7u/psa_1920x1080_on_dragonflybsd_44_under_qemukvm/" rel="nofollow">Settings for full HD resolution on DragonFlyBSD under QEMU/KVM, thanks to reddit user Chapo_Rouge</a></p></li>
<li><p><a href="https://reviews.freebsd.org/D4713" rel="nofollow">Patch: An IllumOS developer has been porting the FreeBSD boot loader to replace their old version of GRUB. In doing so, he has also made improvements to the block caching in the boot loader </a> </p></li>
<li><p><a href="http://blog.teleri.net/open-microsoft/" rel="nofollow">A FreeBSD user working at Microsoft talks about Microsoft’s shift to Open Source </a> </p></li>
<li><p><a href="https://fosdem.org/2016/schedule/event/cert_bsdcg/" rel="nofollow">BSDCG Exam Session at FOSDEM&#39;16</a></p></li>
<li><p><a href="https://fosdem.org/2016/schedule/track/bsd/" rel="nofollow">Schedule for the BSD devroom at FOSDEM&#39;16</a></p></li>
<li><p><a href="http://marc.info/?l=openbsd-cvs&m=145055446007162&w=2" rel="nofollow">OpenBSD snapshots are now 5.9</a></p></li>
<li><p><a href="http://blog.erratasec.com/2015/12/some-notes-on-fast-grep.html#.VoQKD1JSRhx" rel="nofollow">Notes on making BSD grep faster </a> </p></li>
<li><p><a href="https://www-ssl.intel.com/content/www/us/en/jobs/job-search/js2.html?job=782165&src=ML-12080" rel="nofollow">Intel’s Platform Application Engineering (PAE) group within the Networking Division (ND) is looking for a Network Software Engineer</a> </p></li>
<li><p><a href="http://locheil.shxd.cx/logo-tribute.4th" rel="nofollow">Did you watch Die Hard at Christmas? Get the Die Hard FreeBSD boot screen: install this file in /boot and set loader_logo=&quot;tribute&quot; in /boot/loader.conf </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20CTqtEan" rel="nofollow"> Jeremy - ZFS without root</a> </li>
<li><a href="http://slexy.org/view/s20sNPoDm5" rel="nofollow"> Dan - Getting PC-BSD Media</a><br></li>
<li><a href="http://slexy.org/view/s2hjsVgGBK" rel="nofollow"> Chris - VMs and FreeBSD</a> </li>
<li><a href="http://slexy.org/view/s21pwYOTHi" rel="nofollow"> Ben - Haswell and IRC</a> 

<ul>
<li><a href="https://wiki.freebsd.org/Graphics/Update%20i915%20GPU%20driver%20to%20Linux%203.8" rel="nofollow">Instructions for trying the Haswell patch</a></li>
</ul></li>
<li><a href="http://slexy.org/view/s20vifHCyc" rel="nofollow"> Matt - Donation to foundation</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we will be interviewing Alex Rosenberg, to</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://www.nycbug.org/event/10356/openbsd_laptop_nycbug_2015.pdf" rel="nofollow">Life with an OpenBSD Laptop: A UNIX-lover&#39;s tale of migrating away from the Mac. The Good, The Bad, The Ugly</a></h3>

<ul>
<li>OpenBSD user Isaac (.ike) Levy details his switch from a Mac to an OpenBSD laptop</li>
<li>He covers a bit about selecting hardware and dealing with wifi</li>
<li>Talks about binary packages and system upgrades</li>
<li>Talks about power management, suspend/resume, battery life</li>
<li>Show screenshots of some of his favourite window managers</li>
<li>Browsers and email clients are also discussed</li>
<li>Things he found missing in OpenBSD:

<ul>
<li>A journaling file system, every unclean shutdown means a full fsck(1)</li>
<li>UTF-8/unicode was not everywhere</li>
<li>Syncing pictures and contacts to his phone</li>
<li>Drawing tools
***</li>
</ul></li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-December/459067.html" rel="nofollow">DragonFlyBSD matches its Intel kernel graphics driver against Linux 4.0</a></h3>

<ul>
<li>The DragonFlyBSD DRM stack continues to rapidly advance, now bringing in support from Linux 4.0!</li>
<li>Some of the notable features:</li>
<li>Basic Skylake support<br>

<ul>
<li>Panel Self-Refresh (PSR) now supported on Valleyview and Cherryview<br></li>
<li>Preparations for atomic display updates<br></li>
<li>Performance improvements on various GPU families, including Cherryview, Broadwell and Haswell<br></li>
<li>GPU frequencies are now kept at a minimum of 450MHz when possible on Haswell and Broadwell, ensuring a minimum experience level for various types of workloads<br></li>
<li>Improved reset support for gen3/4 GPUs, which should fix some OpenGL crashes on Core 2 and pre-2012 Atom machine</li>
<li>Better sound/graphics driver synchronization for audio over hdmi support<br></li>
<li>As usual, small bugfixes and stability improvements here and there
***</li>
</ul></li>
</ul>

<h3><a href="http://fossforce.com/2015/12/bsd-wish-list-2016/" rel="nofollow">A BSD Wish List for 2016</a></h3>

<ul>
<li>Larry over at Foss Force brings us his wish list for BSD support in 2016. </li>
<li>Since he has converted most of his daily desktop usage to PC-BSD, he is specifically wanting support for some desktop applications. Namely Google hangouts and Spotify. </li>
<li>This is something which has come up periodically among the PC-BSD community. At the moment most users are dual-booting or using alternatives, like WebRTC. However the Google Hangouts plugin is available for Linux, and perhaps this will encourage some developers to see if we can get it running with the newer Linux stack on -CURRENT. </li>
<li>Spotify also has a native Linux version, which may need testing on FreeBSD - CURRENT. It may be closer now, and should be updated on the Wanted Ports Page</li>
<li><a href="https://wiki.freebsd.org/WantedPorts" rel="nofollow">https://wiki.freebsd.org/WantedPorts</a> 
***</li>
</ul>

<h3><a href="http://bsdimp.blogspot.com/2015/12/hard-float-api-coming-soon-by-default.html" rel="nofollow">Hard Float API coming soon by default to armv6</a></h3>

<ul>
<li>Warner Losh talks about upcoming changes to armv6 on FreeBSD </li>
<li>“All the CPUs that FreeBSD supports have hard floating point in them. We&#39;ve supported hard float for quite some time in the FreeBSD kernel. However, by default, we still use a soft-float ABI.”</li>
<li>First, “A new armv6hf (architecture) was created, but that caused some issues with some ports, and the meaning of &#39;soft float&#39; sadly was ambiguous between the soft-float ABI, and the soft-float libraries that implement floating point when there&#39;s no hardware FPU”</li>
<li>“Over the spring and summer, I fixed ld.so so that it  can load both soft ABI and hard ABI libraries on the same system, depending on markings in the binaries themselves. Soft float ABI and hard float ABI binaries have different flags in the ELF headers, so it is relatively straightforward to know which is which.”</li>
<li>“So, in the coming days, I&#39;ll commit the first set of changes to move to armv6 as a hard float ABI by default. The kernel doesn&#39;t care: it can execute both. The new ld.so will allow you to transition through this change by allowing old, compat soft ABI libraries to co-exist on the system with new hard ABI libraries. This change alone isn&#39;t enough, but it will be good to get it out into circulation.”</li>
<li>“armv6hf will be removed before FreeBSD 11”</li>
<li>A LIBSOFT will be created, similar in concept to the LIB32 available on AMD64
***</li>
</ul>

<h2>Interview - Alex Rosenberg - <a href="mailto:alexr@leftfield.org" rel="nofollow">alexr@leftfield.org</a> / <a href="https://twitter.com/alexr" rel="nofollow">@alexr</a></h2>

<ul>
<li>Former Manager of Platform Architecture at Sony
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="http://bsdtalk.blogspot.com/2005/12/bsdtalk001-intro-to-bsd.html" rel="nofollow">Tuesday, Dec 20, 2005 was the release date of the very first bsdtalkpodcast</a></p></li>
<li><p><a href="https://reviews.freebsd.org/D4350" rel="nofollow">Patch: Server side support for TCP FastOpen </a> </p></li>
<li><p><a href="http://www.openbsdjumpstart.org/" rel="nofollow">Learn to tame OpenBSD quickly</a></p></li>
<li><p><a href="https://svnweb.freebsd.org/base?view=revision&revision=292740" rel="nofollow">Hardware Accerated iSCSI lands in FreeBSD </a> </p></li>
<li><p><a href="https://www.reddit.com/r/dragonflybsd/comments/3x4n7u/psa_1920x1080_on_dragonflybsd_44_under_qemukvm/" rel="nofollow">Settings for full HD resolution on DragonFlyBSD under QEMU/KVM, thanks to reddit user Chapo_Rouge</a></p></li>
<li><p><a href="https://reviews.freebsd.org/D4713" rel="nofollow">Patch: An IllumOS developer has been porting the FreeBSD boot loader to replace their old version of GRUB. In doing so, he has also made improvements to the block caching in the boot loader </a> </p></li>
<li><p><a href="http://blog.teleri.net/open-microsoft/" rel="nofollow">A FreeBSD user working at Microsoft talks about Microsoft’s shift to Open Source </a> </p></li>
<li><p><a href="https://fosdem.org/2016/schedule/event/cert_bsdcg/" rel="nofollow">BSDCG Exam Session at FOSDEM&#39;16</a></p></li>
<li><p><a href="https://fosdem.org/2016/schedule/track/bsd/" rel="nofollow">Schedule for the BSD devroom at FOSDEM&#39;16</a></p></li>
<li><p><a href="http://marc.info/?l=openbsd-cvs&m=145055446007162&w=2" rel="nofollow">OpenBSD snapshots are now 5.9</a></p></li>
<li><p><a href="http://blog.erratasec.com/2015/12/some-notes-on-fast-grep.html#.VoQKD1JSRhx" rel="nofollow">Notes on making BSD grep faster </a> </p></li>
<li><p><a href="https://www-ssl.intel.com/content/www/us/en/jobs/job-search/js2.html?job=782165&src=ML-12080" rel="nofollow">Intel’s Platform Application Engineering (PAE) group within the Networking Division (ND) is looking for a Network Software Engineer</a> </p></li>
<li><p><a href="http://locheil.shxd.cx/logo-tribute.4th" rel="nofollow">Did you watch Die Hard at Christmas? Get the Die Hard FreeBSD boot screen: install this file in /boot and set loader_logo=&quot;tribute&quot; in /boot/loader.conf </a> </p></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20CTqtEan" rel="nofollow"> Jeremy - ZFS without root</a> </li>
<li><a href="http://slexy.org/view/s20sNPoDm5" rel="nofollow"> Dan - Getting PC-BSD Media</a><br></li>
<li><a href="http://slexy.org/view/s2hjsVgGBK" rel="nofollow"> Chris - VMs and FreeBSD</a> </li>
<li><a href="http://slexy.org/view/s21pwYOTHi" rel="nofollow"> Ben - Haswell and IRC</a> 

<ul>
<li><a href="https://wiki.freebsd.org/Graphics/Update%20i915%20GPU%20driver%20to%20Linux%203.8" rel="nofollow">Instructions for trying the Haswell patch</a></li>
</ul></li>
<li><a href="http://slexy.org/view/s20vifHCyc" rel="nofollow"> Matt - Donation to foundation</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>121: All your hyves are belong to us</title>
  <link>https://www.bsdnow.tv/121</link>
  <guid isPermaLink="false">5b75bf88-8fe1-4fb0-a9c3-b66fb7e3fe1e</guid>
  <pubDate>Wed, 23 Dec 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5b75bf88-8fe1-4fb0-a9c3-b66fb7e3fe1e.mp3" length="70514932" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we are going to be talking to Trent Thompson,</itunes:subtitle>
  <itunes:duration>1:37:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we are going to be talking to Trent Thompson,
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
Review: Guarding the gates with OpenBSD 5.8 (http://distrowatch.com/weekly.php?issue=20151207#openbsd)
Jesse Smith over at DistroWatch treats us this week to a nice review of OpenBSD 5.8, which may be a good introduction for the uninitiated to learn more+ He first walks through some of the various highlights of 5.8, and spends time introducing the reader to a number of the projects that originate from OpenBSD, such as LibreSSL, OpenSSH, doas, the new “file” implementation and W^X support on i386. 
The article then walks through his impressions of performing a fresh install of 5.8, and then getting up and running in X. 
He mentions that you may want to check the installation defaults, since on his 8GB VM disk, it didn’t leave enough room for packages on the /usr partition. 
It also includes a nice heads-up for new users about using the pkg_add command, and where / how you can set the initial repository mirror address. 
The “doas” command was also praised:“I found I very much appreciated the doas command, its documentation and configuration file. The doas configuration file is much easier to read than sudo's and the available options are well explained. The doas command allowed me to assign root access to a user given the proper password and doas worked as advertised.”
A glowing summary as well:“OpenBSD may be very secure, but I think what sets the operating system apart are its documentation and clean system design. It is so easy to find things and understand the configuration of an OpenBSD system. The file system is organized in a clean and orderly manner. It always takes me a while to get accustomed to using OpenBSD, as for me it is a rare occurrence, but once I get settled in I like how straight forward everything is. I can usually find and configure anything on the system without referring to external documents or searching for answers on-line and that is quite an accomplishment for an operating system where virtually everything is done from the command line. “
***
OpenBSD Hackathon Reports
Alexander Bluhm: multiprocessor networking  (http://undeadly.org/cgi?action=article&amp;amp;sid=20151212192918) 
“The next step, we are currently working on, is to remove the big kernel lock from forwarding and routing. mpi@ has been doing this for a long time, but some corner cases were still left. I have written a regression test for handling ARP packets to show that all cases including proxy ARP are still working. Another thing that may happen with lock-free routing is that the interface is destroyed on one CPU while another CPU is working with a route to that interface. We finally got this resolved. The code that destroys the interface has to wait until all routes don't use this interface anymore. I moved the sleep before the destruction of the interface is started, so that the routes can always operate on a completely valid interface structure.”
Vincent Gross: ifa_ifwithaddr()  (http://undeadly.org/cgi?action=article&amp;amp;sid=20151215150708) 
Vincent worked on the function that finds the interface with the specified address, which is used to tell if the machine is the intended recipient of an incoming packet. A number of corner cases existed with broadcast addresses, especially if two interfaces were in the same subnet. This code was moved to the new in_broadcast()
Ken Westerback: fdisk, installbot, and dhclient (http://undeadly.org/cgi?action=article&amp;amp;sid=20151216192843) 
Reyk Floeter: Hosting a hackathon, vmd, vmctl  (http://undeadly.org/cgi?action=article&amp;amp;sid=20151217134417) 
“When I heard that Martin Pieuchot (mpi@) was looking for a place to hold another mini-hackathon for three to four people to work on multiprocessor (MP) enhancements of the network stack, I offered to come to our work place in Hannover, Northern Germany. We have space, gear, fast Internet and it is easy to reach for the involved people. Little did I know that it would quickly turn into n2k15, a network hackathon with 20 attendees from all over the world”
“If you ever hosted such an event or a party for many guests, you will know the dilemma of the host: you’re constantly concerned about your guests enjoying it, you have to take care about many trivial things, other things will break, and you get little to no time to attend or even enjoy it yourself. Fortunately, I had very experienced and welcomed guests: only one vintage table and a vase broke – the table can be fixed – and I even found some time for hacking myself.”
Martin Pieuchot: MP networking  (http://undeadly.org/cgi?action=article&amp;amp;sid=20151218175010) 
“ We found two kind of MP bugs! There are MP bugs that you fix without even understanding them, and there are MP bugs that you understand but can't fix”
Stefan Sperling: initial 802.11n support  (http://undeadly.org/cgi?action=article&amp;amp;sid=20151219160501) 
***
Hacking the PS4 (https://cturt.github.io/ps4.html)
As a followup to the story last week about the PS4 being “jailbroken”, we have a link to further information about how far this project has come along
This article also provides some great background information about whats running under the hood of your PS4, including FreeBSD 9, Mono VM and WebKit, with WebKit being the primary point of entry to jailbreak the box. 
One particular point of interest, was the revelation that early firmware versions did not include ASLR, but it appears ASLR was added sometime around firmware 1.70. (Wonder if they used HardenedBSD’s implementation), and how they can bypass it entirely. “Luckily for us, we aren't limited to just writing static ROP chains. We can use JavaScript to read the modules table, which will tell us the base addresses of all loaded modules. Using these bases, we can then calculate the addresses of all our gadgets before we trigger ROP execution, bypassing ASLR.“
The article also mentions that they can prove that jails are used in some fashion, and provides examples of how they can browse the file system and dump a module list.
The kernel exploit in question is SA-15:21 (https://www.freebsd.org/security/advisories/FreeBSD-SA-15:21.amd64.asc) from August of this year. The jailbreaking appears to be against an older version of PS4 firmware that did not include this patch
***
Nokia and ARM leading the charge to implement better TCP/IP as part of the 5G standard  (http://www.theregister.co.uk/2015/12/14/nokia_and_arm_bid_reinvent_tcpip_stack_5g/?page=1)
“Many believe that a critical success factor for 5G will be a fully revamped TCP/IP stack, optimized for the massively varied use cases of the next mobile generation, for cloud services, and for virtualization and software-defined networking (SDN). This is the goal of the new OpenFastPath (OFP) Foundation, founded by Nokia Networks, ARM and industrial IT services player Enea. This aims to create an open source TCP/IP stack which can accelerate the move towards SDN in carrier and enterprise networks. Other sign-ups include AMD, Cavium, Freescale, Hewlett Packard Enterprise and the ARM-associated open source initiative, Linaro.”
“The new fast-path TCP/IP stack will be based on the open source FreeBSD operating system”
The general idea is to have a fast, open source, user space networking stack, based on the FreeBSD stack
with an “optimised callback-based zero-copy socket API” to keep packet processing in user-space as far as possible
It will be interesting to see a little bit more FreeBSD getting into every mobile and cloud based device.
***
Interview - Trent Thompson - trentnthompson@gmail.com (trentnthompson@gmail.com) / @pr1ntf (https://twitter.com/pr1ntf)
iohyve (https://github.com/pr1ntf/iohyve)
***
News Roundup
First cut of the FreeBSD modularized TCP stack  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=292309)
FreeBSD now has more than one TCP stack, and better yet, you can use more than one at once
Each socket pcb is associated with a stack, and it is possible to select a non-default stack with a socket option, so you can make a specific application use an experimental stack, while still defaulting to the known-good stack
This should lead to a lot of interesting development and testing, without the level of risk usually associated with modifying the TCP stack
The first new module available is ‘fastpath’, which may relate to the Nokia story earlier in the show
There are also plans to support changing TCP stacks after establish a session, which might land as early as January
***
Faces of FreeBSD : Erin Clark (http://freebsdfoundation.blogspot.com/2015/12/faces-of-freebsd-2015-erin-clark.html)
In this edition of “Faces of FreeBSD” the FreeBSD foundation gives us an introduction to Erin Clark, of our very own iXsystems!
Her journey to the BSD family may sound similar to a lot of ours. She first began using Linux / Slackware in the early 2000’s, but in 2009 a friend introduced her to FreeBSD and the rest, as they say, is history. 
“I use FreeBSD because it is very solid and secure and has a great selection of open source software that can be used with it from the ports collection.  I have always appreciated FreeBSD’s networking stack because it makes a great router or network appliance.  FreeBSD’s use of the ZFS file system is also very nice - ZFS snapshots definitely saved me a few times.  I also like that FreeBSD is very well documented; almost everything you need to know about working with FreeBSD can be found in the FreeBSD Handbook.”
Originally a sys admin at iXsystems, where she helped managed PC-BSD desktops among others, now she works on the FreeNAS project as a developer for the CLI interface functionality. 
***
New Olimex board runs Unix (https://olimex.wordpress.com/2015/12/16/new-product-in-stock-pic32-retrobsd-open-source-hardware-board-running-unix-like-retrobsd-os/)
Looking for some small / embedded gear to mess around with? The Olimex folks have a new Pic32 system now available which runs “RetroBSD”
“The current target is Microchip PIC32 microcontroller with 128 kbytes of RAM and 512 kbytes of Flash. PIC32 processor has MIPS M4K architecture, executable data memory and flexible RAM partitioning between user and kernel modes.”
RetroBSD isn’t something we’ve covered extensively here on BSDNow, so to bring you up to speed, it is a port of 2.11 BSD
Their website lists the following features of this 2.11 refresh:“
Small resource requirements. RetroBSD needs only 128 kbytes of RAM to be up and running user applications.
Memory protection. Kernel memory is fully protected from user application using hardware mechanisms.
Open functionality. Usually, user application is fixed in Flash memory - but in case of RetroBSD, any number of applications could be placed into SD card, and run as required.
Real multitasking. Standard POSIX API is implemented (fork, exec, wait4 etc).
Development system on-board. It is possible to have C compiler in the system, and to recompile the user application (or the whole operating system) when needed.“
For those looking into BSD history, or wanting something small and exotic to play with this may fit the bill nicely. 
***
OpenSource.com reviews PCBSD  (https://opensource.com/life/15/12/bsd-desktop-user-review-pc-bsd)
Joshua over at opensource.com writes up a review of PC-BSD (10.2 we assume)
Some of the highlights mentioned, include the easy to use graphical installer, but he does mention we should update the sorting of languages. (Good idea!)
Along with including nice screenshots, it also covers the availability of various DE’s / WM’s, and talks a fair amount about the AppCafe and Control Panel utilities. 
“Thanks to being featured on PC-BSD's desktop, the PC-BSD Handbook is easily located by even the most novice user. There is no need to search through the system's installed applications for a manual, or relying solely on the help documentation for individual components. While not comprehensive, PC-BSD's handbook does a good job as striking a balance between concise and thorough. It contains enough information to help and provides detailed instructions for the topics it covers, but it avoids providing so much information that it overwhelms”
***
BeastieBits
Gandi introduces support for FreeBSD on their IaaS platform, with both ZFS and UFS based images available  (https://www.gandi.net/news/en/2015-12-23/6473-introducing_freebsd_and_trimming_down_the_official_image_list/) 
Funny commit message from the Linux kernel  (http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f076ef44a44d02ed91543f820c14c2c7dff53716) 
FreeBSD Journal, Nov/Dec 2015  (https://www.freebsdfoundation.org/journal/vol2_no6) 
Feedback/Questions
 Zafer - NetBSD on DO (http://slexy.org/view/s2MPhvSFja) 
 Richard - FreeNAS Replication (http://slexy.org/view/s2hhJktjRu) 
 Winston - Android ADP (http://slexy.org/view/s2VK83ILlK) 
 Alex - Multiple Domains (http://slexy.org/view/s20UVY8Bs5) 
 Randy - Getting Involved (http://slexy.org/view/s20Cb076tu) 
 Craig - zprezto (http://slexy.org/view/s2HNQ2aB42) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we are going to be talking to Trent Thompson,</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://distrowatch.com/weekly.php?issue=20151207#openbsd" rel="nofollow">Review: Guarding the gates with OpenBSD 5.8</a></h3>

<ul>
<li>Jesse Smith over at DistroWatch treats us this week to a nice review of OpenBSD 5.8, which may be a good introduction for the uninitiated to learn more+ He first walks through some of the various highlights of 5.8, and spends time introducing the reader to a number of the projects that originate from OpenBSD, such as LibreSSL, OpenSSH, doas, the new “file” implementation and W<sup>X</sup> support on i386. </li>
<li>The article then walks through his impressions of performing a fresh install of 5.8, and then getting up and running in X. </li>
<li>He mentions that you may want to check the installation defaults, since on his 8GB VM disk, it didn’t leave enough room for packages on the /usr partition. </li>
<li>It also includes a nice heads-up for new users about using the pkg_add command, and where / how you can set the initial repository mirror address. </li>
<li>The “doas” command was also praised:“I found I very much appreciated the doas command, its documentation and configuration file. The doas configuration file is much easier to read than sudo&#39;s and the available options are well explained. The doas command allowed me to assign root access to a user given the proper password and doas worked as advertised.”</li>
<li>A glowing summary as well:“OpenBSD may be very secure, but I think what sets the operating system apart are its documentation and clean system design. It is so easy to find things and understand the configuration of an OpenBSD system. The file system is organized in a clean and orderly manner. It always takes me a while to get accustomed to using OpenBSD, as for me it is a rare occurrence, but once I get settled in I like how straight forward everything is. I can usually find and configure anything on the system without referring to external documents or searching for answers on-line and that is quite an accomplishment for an operating system where virtually everything is done from the command line. “
***</li>
</ul>

<h3>OpenBSD Hackathon Reports</h3>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151212192918" rel="nofollow">Alexander Bluhm: multiprocessor networking </a> </li>
<li>“The next step, we are currently working on, is to remove the big kernel lock from forwarding and routing. mpi@ has been doing this for a long time, but some corner cases were still left. I have written a regression test for handling ARP packets to show that all cases including proxy ARP are still working. Another thing that may happen with lock-free routing is that the interface is destroyed on one CPU while another CPU is working with a route to that interface. We finally got this resolved. The code that destroys the interface has to wait until all routes don&#39;t use this interface anymore. I moved the sleep before the destruction of the interface is started, so that the routes can always operate on a completely valid interface structure.”</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151215150708" rel="nofollow">Vincent Gross: ifa_ifwithaddr() </a> </li>
<li>Vincent worked on the function that finds the interface with the specified address, which is used to tell if the machine is the intended recipient of an incoming packet. A number of corner cases existed with broadcast addresses, especially if two interfaces were in the same subnet. This code was moved to the new in_broadcast()</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151216192843" rel="nofollow">Ken Westerback: fdisk, installbot, and dhclient</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151217134417" rel="nofollow">Reyk Floeter: Hosting a hackathon, vmd, vmctl </a> </li>
<li>“When I heard that Martin Pieuchot (mpi@) was looking for a place to hold another mini-hackathon for three to four people to work on multiprocessor (MP) enhancements of the network stack, I offered to come to our work place in Hannover, Northern Germany. We have space, gear, fast Internet and it is easy to reach for the involved people. Little did I know that it would quickly turn into n2k15, a network hackathon with 20 attendees from all over the world”</li>
<li>“If you ever hosted such an event or a party for many guests, you will know the dilemma of the host: you’re constantly concerned about your guests enjoying it, you have to take care about many trivial things, other things will break, and you get little to no time to attend or even enjoy it yourself. Fortunately, I had very experienced and welcomed guests: only one vintage table and a vase broke – the table can be fixed – and I even found some time for hacking myself.”</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151218175010" rel="nofollow">Martin Pieuchot: MP networking </a> </li>
<li>“ We found two kind of MP bugs! There are MP bugs that you fix without even understanding them, and there are MP bugs that you understand but can&#39;t fix”</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151219160501" rel="nofollow">Stefan Sperling: initial 802.11n support </a> 
***</li>
</ul>

<h3><a href="https://cturt.github.io/ps4.html" rel="nofollow">Hacking the PS4</a></h3>

<ul>
<li>As a followup to the story last week about the PS4 being “jailbroken”, we have a link to further information about how far this project has come along</li>
<li>This article also provides some great background information about whats running under the hood of your PS4, including FreeBSD 9, Mono VM and WebKit, with WebKit being the primary point of entry to jailbreak the box. </li>
<li>One particular point of interest, was the revelation that early firmware versions did not include ASLR, but it appears ASLR was added sometime around firmware 1.70. (Wonder if they used HardenedBSD’s implementation), and how they can bypass it entirely. “Luckily for us, we aren&#39;t limited to just writing static ROP chains. We can use JavaScript to read the modules table, which will tell us the base addresses of all loaded modules. Using these bases, we can then calculate the addresses of all our gadgets before we trigger ROP execution, bypassing ASLR.“</li>
<li>The article also mentions that they can prove that jails are used in some fashion, and provides examples of how they can browse the file system and dump a module list.</li>
<li>The kernel exploit in question is <a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-15:21.amd64.asc" rel="nofollow">SA-15:21</a> from August of this year. The jailbreaking appears to be against an older version of PS4 firmware that did not include this patch
***</li>
</ul>

<h3><a href="http://www.theregister.co.uk/2015/12/14/nokia_and_arm_bid_reinvent_tcpip_stack_5g/?page=1" rel="nofollow">Nokia and ARM leading the charge to implement better TCP/IP as part of the 5G standard </a></h3>

<ul>
<li>“Many believe that a critical success factor for 5G will be a fully revamped TCP/IP stack, optimized for the massively varied use cases of the next mobile generation, for cloud services, and for virtualization and software-defined networking (SDN). This is the goal of the new OpenFastPath (OFP) Foundation, founded by Nokia Networks, ARM and industrial IT services player Enea. This aims to create an open source TCP/IP stack which can accelerate the move towards SDN in carrier and enterprise networks. Other sign-ups include AMD, Cavium, Freescale, Hewlett Packard Enterprise and the ARM-associated open source initiative, Linaro.”</li>
<li>“The new fast-path TCP/IP stack will be based on the open source FreeBSD operating system”</li>
<li>The general idea is to have a fast, open source, user space networking stack, based on the FreeBSD stack</li>
<li>with an “optimised callback-based zero-copy socket API” to keep packet processing in user-space as far as possible</li>
<li>It will be interesting to see a little bit more FreeBSD getting into every mobile and cloud based device.
***</li>
</ul>

<h2>Interview - Trent Thompson - [<a href="mailto:trentnthompson@gmail.com" rel="nofollow">trentnthompson@gmail.com</a>](<a href="mailto:trentnthompson@gmail.com" rel="nofollow">trentnthompson@gmail.com</a>) / <a href="https://twitter.com/pr1ntf" rel="nofollow">@pr1ntf</a></h2>

<ul>
<li><a href="https://github.com/pr1ntf/iohyve" rel="nofollow">iohyve</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=292309" rel="nofollow">First cut of the FreeBSD modularized TCP stack </a></h3>

<ul>
<li>FreeBSD now has more than one TCP stack, and better yet, you can use more than one at once</li>
<li>Each socket pcb is associated with a stack, and it is possible to select a non-default stack with a socket option, so you can make a specific application use an experimental stack, while still defaulting to the known-good stack</li>
<li>This should lead to a lot of interesting development and testing, without the level of risk usually associated with modifying the TCP stack</li>
<li>The first new module available is ‘fastpath’, which may relate to the Nokia story earlier in the show</li>
<li>There are also plans to support changing TCP stacks after establish a session, which might land as early as January
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/12/faces-of-freebsd-2015-erin-clark.html" rel="nofollow">Faces of FreeBSD : Erin Clark</a></h3>

<ul>
<li>In this edition of “Faces of FreeBSD” the FreeBSD foundation gives us an introduction to Erin Clark, of our very own iXsystems!</li>
<li>Her journey to the BSD family may sound similar to a lot of ours. She first began using Linux / Slackware in the early 2000’s, but in 2009 a friend introduced her to FreeBSD and the rest, as they say, is history. </li>
<li>“I use FreeBSD because it is very solid and secure and has a great selection of open source software that can be used with it from the ports collection.  I have always appreciated FreeBSD’s networking stack because it makes a great router or network appliance.  FreeBSD’s use of the ZFS file system is also very nice - ZFS snapshots definitely saved me a few times.  I also like that FreeBSD is very well documented; almost everything you need to know about working with FreeBSD can be found in the FreeBSD Handbook.”</li>
<li>Originally a sys admin at iXsystems, where she helped managed PC-BSD desktops among others, now she works on the FreeNAS project as a developer for the CLI interface functionality. 
***</li>
</ul>

<h3><a href="https://olimex.wordpress.com/2015/12/16/new-product-in-stock-pic32-retrobsd-open-source-hardware-board-running-unix-like-retrobsd-os/" rel="nofollow">New Olimex board runs Unix</a></h3>

<ul>
<li>Looking for some small / embedded gear to mess around with? The Olimex folks have a new Pic32 system now available which runs “RetroBSD”</li>
<li>“The current target is Microchip PIC32 microcontroller with 128 kbytes of RAM and 512 kbytes of Flash. PIC32 processor has MIPS M4K architecture, executable data memory and flexible RAM partitioning between user and kernel modes.”</li>
<li>RetroBSD isn’t something we’ve covered extensively here on BSDNow, so to bring you up to speed, it is a port of 2.11 BSD</li>
<li>Their website lists the following features of this 2.11 refresh:“</li>
<li>Small resource requirements. RetroBSD needs only 128 kbytes of RAM to be up and running user applications.</li>
<li>Memory protection. Kernel memory is fully protected from user application using hardware mechanisms.</li>
<li>Open functionality. Usually, user application is fixed in Flash memory - but in case of RetroBSD, any number of applications could be placed into SD card, and run as required.</li>
<li>Real multitasking. Standard POSIX API is implemented (fork, exec, wait4 etc).</li>
<li>Development system on-board. It is possible to have C compiler in the system, and to recompile the user application (or the whole operating system) when needed.“</li>
<li>For those looking into BSD history, or wanting something small and exotic to play with this may fit the bill nicely. 
***</li>
</ul>

<h3><a href="https://opensource.com/life/15/12/bsd-desktop-user-review-pc-bsd" rel="nofollow">OpenSource.com reviews PCBSD </a></h3>

<ul>
<li>Joshua over at opensource.com writes up a review of PC-BSD (10.2 we assume)</li>
<li>Some of the highlights mentioned, include the easy to use graphical installer, but he does mention we should update the sorting of languages. (Good idea!)</li>
<li>Along with including nice screenshots, it also covers the availability of various DE’s / WM’s, and talks a fair amount about the AppCafe and Control Panel utilities. </li>
<li>“Thanks to being featured on PC-BSD&#39;s desktop, the PC-BSD Handbook is easily located by even the most novice user. There is no need to search through the system&#39;s installed applications for a manual, or relying solely on the help documentation for individual components. While not comprehensive, PC-BSD&#39;s handbook does a good job as striking a balance between concise and thorough. It contains enough information to help and provides detailed instructions for the topics it covers, but it avoids providing so much information that it overwhelms”
***</li>
</ul>

<h2>BeastieBits</h2>

<p><a href="https://www.gandi.net/news/en/2015-12-23/6473-introducing_freebsd_and_trimming_down_the_official_image_list/" rel="nofollow">Gandi introduces support for FreeBSD on their IaaS platform, with both ZFS and UFS based images available </a> </p>

<p><a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f076ef44a44d02ed91543f820c14c2c7dff53716" rel="nofollow">Funny commit message from the Linux kernel </a> </p>

<p><a href="https://www.freebsdfoundation.org/journal/vol2_no6" rel="nofollow">FreeBSD Journal, Nov/Dec 2015 </a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2MPhvSFja" rel="nofollow"> Zafer - NetBSD on DO</a> </li>
<li><a href="http://slexy.org/view/s2hhJktjRu" rel="nofollow"> Richard - FreeNAS Replication</a> </li>
<li><a href="http://slexy.org/view/s2VK83ILlK" rel="nofollow"> Winston - Android ADP</a> </li>
<li><a href="http://slexy.org/view/s20UVY8Bs5" rel="nofollow"> Alex - Multiple Domains</a> </li>
<li><a href="http://slexy.org/view/s20Cb076tu" rel="nofollow"> Randy - Getting Involved</a> </li>
<li><a href="http://slexy.org/view/s2HNQ2aB42" rel="nofollow"> Craig - zprezto</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we are going to be talking to Trent Thompson,</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://distrowatch.com/weekly.php?issue=20151207#openbsd" rel="nofollow">Review: Guarding the gates with OpenBSD 5.8</a></h3>

<ul>
<li>Jesse Smith over at DistroWatch treats us this week to a nice review of OpenBSD 5.8, which may be a good introduction for the uninitiated to learn more+ He first walks through some of the various highlights of 5.8, and spends time introducing the reader to a number of the projects that originate from OpenBSD, such as LibreSSL, OpenSSH, doas, the new “file” implementation and W<sup>X</sup> support on i386. </li>
<li>The article then walks through his impressions of performing a fresh install of 5.8, and then getting up and running in X. </li>
<li>He mentions that you may want to check the installation defaults, since on his 8GB VM disk, it didn’t leave enough room for packages on the /usr partition. </li>
<li>It also includes a nice heads-up for new users about using the pkg_add command, and where / how you can set the initial repository mirror address. </li>
<li>The “doas” command was also praised:“I found I very much appreciated the doas command, its documentation and configuration file. The doas configuration file is much easier to read than sudo&#39;s and the available options are well explained. The doas command allowed me to assign root access to a user given the proper password and doas worked as advertised.”</li>
<li>A glowing summary as well:“OpenBSD may be very secure, but I think what sets the operating system apart are its documentation and clean system design. It is so easy to find things and understand the configuration of an OpenBSD system. The file system is organized in a clean and orderly manner. It always takes me a while to get accustomed to using OpenBSD, as for me it is a rare occurrence, but once I get settled in I like how straight forward everything is. I can usually find and configure anything on the system without referring to external documents or searching for answers on-line and that is quite an accomplishment for an operating system where virtually everything is done from the command line. “
***</li>
</ul>

<h3>OpenBSD Hackathon Reports</h3>

<ul>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151212192918" rel="nofollow">Alexander Bluhm: multiprocessor networking </a> </li>
<li>“The next step, we are currently working on, is to remove the big kernel lock from forwarding and routing. mpi@ has been doing this for a long time, but some corner cases were still left. I have written a regression test for handling ARP packets to show that all cases including proxy ARP are still working. Another thing that may happen with lock-free routing is that the interface is destroyed on one CPU while another CPU is working with a route to that interface. We finally got this resolved. The code that destroys the interface has to wait until all routes don&#39;t use this interface anymore. I moved the sleep before the destruction of the interface is started, so that the routes can always operate on a completely valid interface structure.”</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151215150708" rel="nofollow">Vincent Gross: ifa_ifwithaddr() </a> </li>
<li>Vincent worked on the function that finds the interface with the specified address, which is used to tell if the machine is the intended recipient of an incoming packet. A number of corner cases existed with broadcast addresses, especially if two interfaces were in the same subnet. This code was moved to the new in_broadcast()</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151216192843" rel="nofollow">Ken Westerback: fdisk, installbot, and dhclient</a> </li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151217134417" rel="nofollow">Reyk Floeter: Hosting a hackathon, vmd, vmctl </a> </li>
<li>“When I heard that Martin Pieuchot (mpi@) was looking for a place to hold another mini-hackathon for three to four people to work on multiprocessor (MP) enhancements of the network stack, I offered to come to our work place in Hannover, Northern Germany. We have space, gear, fast Internet and it is easy to reach for the involved people. Little did I know that it would quickly turn into n2k15, a network hackathon with 20 attendees from all over the world”</li>
<li>“If you ever hosted such an event or a party for many guests, you will know the dilemma of the host: you’re constantly concerned about your guests enjoying it, you have to take care about many trivial things, other things will break, and you get little to no time to attend or even enjoy it yourself. Fortunately, I had very experienced and welcomed guests: only one vintage table and a vase broke – the table can be fixed – and I even found some time for hacking myself.”</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151218175010" rel="nofollow">Martin Pieuchot: MP networking </a> </li>
<li>“ We found two kind of MP bugs! There are MP bugs that you fix without even understanding them, and there are MP bugs that you understand but can&#39;t fix”</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20151219160501" rel="nofollow">Stefan Sperling: initial 802.11n support </a> 
***</li>
</ul>

<h3><a href="https://cturt.github.io/ps4.html" rel="nofollow">Hacking the PS4</a></h3>

<ul>
<li>As a followup to the story last week about the PS4 being “jailbroken”, we have a link to further information about how far this project has come along</li>
<li>This article also provides some great background information about whats running under the hood of your PS4, including FreeBSD 9, Mono VM and WebKit, with WebKit being the primary point of entry to jailbreak the box. </li>
<li>One particular point of interest, was the revelation that early firmware versions did not include ASLR, but it appears ASLR was added sometime around firmware 1.70. (Wonder if they used HardenedBSD’s implementation), and how they can bypass it entirely. “Luckily for us, we aren&#39;t limited to just writing static ROP chains. We can use JavaScript to read the modules table, which will tell us the base addresses of all loaded modules. Using these bases, we can then calculate the addresses of all our gadgets before we trigger ROP execution, bypassing ASLR.“</li>
<li>The article also mentions that they can prove that jails are used in some fashion, and provides examples of how they can browse the file system and dump a module list.</li>
<li>The kernel exploit in question is <a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-15:21.amd64.asc" rel="nofollow">SA-15:21</a> from August of this year. The jailbreaking appears to be against an older version of PS4 firmware that did not include this patch
***</li>
</ul>

<h3><a href="http://www.theregister.co.uk/2015/12/14/nokia_and_arm_bid_reinvent_tcpip_stack_5g/?page=1" rel="nofollow">Nokia and ARM leading the charge to implement better TCP/IP as part of the 5G standard </a></h3>

<ul>
<li>“Many believe that a critical success factor for 5G will be a fully revamped TCP/IP stack, optimized for the massively varied use cases of the next mobile generation, for cloud services, and for virtualization and software-defined networking (SDN). This is the goal of the new OpenFastPath (OFP) Foundation, founded by Nokia Networks, ARM and industrial IT services player Enea. This aims to create an open source TCP/IP stack which can accelerate the move towards SDN in carrier and enterprise networks. Other sign-ups include AMD, Cavium, Freescale, Hewlett Packard Enterprise and the ARM-associated open source initiative, Linaro.”</li>
<li>“The new fast-path TCP/IP stack will be based on the open source FreeBSD operating system”</li>
<li>The general idea is to have a fast, open source, user space networking stack, based on the FreeBSD stack</li>
<li>with an “optimised callback-based zero-copy socket API” to keep packet processing in user-space as far as possible</li>
<li>It will be interesting to see a little bit more FreeBSD getting into every mobile and cloud based device.
***</li>
</ul>

<h2>Interview - Trent Thompson - [<a href="mailto:trentnthompson@gmail.com" rel="nofollow">trentnthompson@gmail.com</a>](<a href="mailto:trentnthompson@gmail.com" rel="nofollow">trentnthompson@gmail.com</a>) / <a href="https://twitter.com/pr1ntf" rel="nofollow">@pr1ntf</a></h2>

<ul>
<li><a href="https://github.com/pr1ntf/iohyve" rel="nofollow">iohyve</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=292309" rel="nofollow">First cut of the FreeBSD modularized TCP stack </a></h3>

<ul>
<li>FreeBSD now has more than one TCP stack, and better yet, you can use more than one at once</li>
<li>Each socket pcb is associated with a stack, and it is possible to select a non-default stack with a socket option, so you can make a specific application use an experimental stack, while still defaulting to the known-good stack</li>
<li>This should lead to a lot of interesting development and testing, without the level of risk usually associated with modifying the TCP stack</li>
<li>The first new module available is ‘fastpath’, which may relate to the Nokia story earlier in the show</li>
<li>There are also plans to support changing TCP stacks after establish a session, which might land as early as January
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/12/faces-of-freebsd-2015-erin-clark.html" rel="nofollow">Faces of FreeBSD : Erin Clark</a></h3>

<ul>
<li>In this edition of “Faces of FreeBSD” the FreeBSD foundation gives us an introduction to Erin Clark, of our very own iXsystems!</li>
<li>Her journey to the BSD family may sound similar to a lot of ours. She first began using Linux / Slackware in the early 2000’s, but in 2009 a friend introduced her to FreeBSD and the rest, as they say, is history. </li>
<li>“I use FreeBSD because it is very solid and secure and has a great selection of open source software that can be used with it from the ports collection.  I have always appreciated FreeBSD’s networking stack because it makes a great router or network appliance.  FreeBSD’s use of the ZFS file system is also very nice - ZFS snapshots definitely saved me a few times.  I also like that FreeBSD is very well documented; almost everything you need to know about working with FreeBSD can be found in the FreeBSD Handbook.”</li>
<li>Originally a sys admin at iXsystems, where she helped managed PC-BSD desktops among others, now she works on the FreeNAS project as a developer for the CLI interface functionality. 
***</li>
</ul>

<h3><a href="https://olimex.wordpress.com/2015/12/16/new-product-in-stock-pic32-retrobsd-open-source-hardware-board-running-unix-like-retrobsd-os/" rel="nofollow">New Olimex board runs Unix</a></h3>

<ul>
<li>Looking for some small / embedded gear to mess around with? The Olimex folks have a new Pic32 system now available which runs “RetroBSD”</li>
<li>“The current target is Microchip PIC32 microcontroller with 128 kbytes of RAM and 512 kbytes of Flash. PIC32 processor has MIPS M4K architecture, executable data memory and flexible RAM partitioning between user and kernel modes.”</li>
<li>RetroBSD isn’t something we’ve covered extensively here on BSDNow, so to bring you up to speed, it is a port of 2.11 BSD</li>
<li>Their website lists the following features of this 2.11 refresh:“</li>
<li>Small resource requirements. RetroBSD needs only 128 kbytes of RAM to be up and running user applications.</li>
<li>Memory protection. Kernel memory is fully protected from user application using hardware mechanisms.</li>
<li>Open functionality. Usually, user application is fixed in Flash memory - but in case of RetroBSD, any number of applications could be placed into SD card, and run as required.</li>
<li>Real multitasking. Standard POSIX API is implemented (fork, exec, wait4 etc).</li>
<li>Development system on-board. It is possible to have C compiler in the system, and to recompile the user application (or the whole operating system) when needed.“</li>
<li>For those looking into BSD history, or wanting something small and exotic to play with this may fit the bill nicely. 
***</li>
</ul>

<h3><a href="https://opensource.com/life/15/12/bsd-desktop-user-review-pc-bsd" rel="nofollow">OpenSource.com reviews PCBSD </a></h3>

<ul>
<li>Joshua over at opensource.com writes up a review of PC-BSD (10.2 we assume)</li>
<li>Some of the highlights mentioned, include the easy to use graphical installer, but he does mention we should update the sorting of languages. (Good idea!)</li>
<li>Along with including nice screenshots, it also covers the availability of various DE’s / WM’s, and talks a fair amount about the AppCafe and Control Panel utilities. </li>
<li>“Thanks to being featured on PC-BSD&#39;s desktop, the PC-BSD Handbook is easily located by even the most novice user. There is no need to search through the system&#39;s installed applications for a manual, or relying solely on the help documentation for individual components. While not comprehensive, PC-BSD&#39;s handbook does a good job as striking a balance between concise and thorough. It contains enough information to help and provides detailed instructions for the topics it covers, but it avoids providing so much information that it overwhelms”
***</li>
</ul>

<h2>BeastieBits</h2>

<p><a href="https://www.gandi.net/news/en/2015-12-23/6473-introducing_freebsd_and_trimming_down_the_official_image_list/" rel="nofollow">Gandi introduces support for FreeBSD on their IaaS platform, with both ZFS and UFS based images available </a> </p>

<p><a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f076ef44a44d02ed91543f820c14c2c7dff53716" rel="nofollow">Funny commit message from the Linux kernel </a> </p>

<p><a href="https://www.freebsdfoundation.org/journal/vol2_no6" rel="nofollow">FreeBSD Journal, Nov/Dec 2015 </a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2MPhvSFja" rel="nofollow"> Zafer - NetBSD on DO</a> </li>
<li><a href="http://slexy.org/view/s2hhJktjRu" rel="nofollow"> Richard - FreeNAS Replication</a> </li>
<li><a href="http://slexy.org/view/s2VK83ILlK" rel="nofollow"> Winston - Android ADP</a> </li>
<li><a href="http://slexy.org/view/s20UVY8Bs5" rel="nofollow"> Alex - Multiple Domains</a> </li>
<li><a href="http://slexy.org/view/s20Cb076tu" rel="nofollow"> Randy - Getting Involved</a> </li>
<li><a href="http://slexy.org/view/s2HNQ2aB42" rel="nofollow"> Craig - zprezto</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>120: I’m talking about the man in the middle</title>
  <link>https://www.bsdnow.tv/120</link>
  <guid isPermaLink="false">9fdf3957-250a-492b-8a41-e65e8d732656</guid>
  <pubDate>Wed, 16 Dec 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9fdf3957-250a-492b-8a41-e65e8d732656.mp3" length="83930260" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we are going to be talking to Pawel about how his</itunes:subtitle>
  <itunes:duration>1:56:34</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we are going to be talking to Pawel about how his
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
Note the recent passing of 2 members of the BSD community
Juergen Lock / Nox (https://www.freebsd.org/doc/en_US.ISO8859-1/articles/contributors/contrib-develinmemoriam.html) 
Benjamin Perrault / creepingfur (https://twitter.com/michaeldexter/status/676290499389485057) Memories from Michael Dexter  (http://pastebin.com/4BQ5uVsT) 
Additional Memories  (http://www.filis.org/rip_ben.txt) 
Benjamin and Allan at Ben’s local bar  (http://www.allanjude.com/bsd/bp/IMG_20151101_161727-auto.jpg) 
Benjamin treated Allan and Michael Dexter to their first ever Bermese food  (http://www.allanjude.com/bsd/bp/IMG_20151101_191344-auto.jpg) 
Benjamin enjoying the hallway track at EuroBSDCon 2015  (http://www.allanjude.com/bsd/bp/IMG_20151003_105457-auto.jpg) 
***
NGINX as Reverse Proxy for Apache on FreeBSD 10.2 (http://linoxide.com/linux-how-to/install-nginx-reverse-proxy-apache-freebsd-10-2/)
A tutorial on setting up NGINX as a reverse proxy for Apache
Sometimes your users or application require some feature of Apache, that cannot be easily replicated in NGINX, like .htaccess files or a custom apache module
In addition, because the default worker model in Apache does not accept new work until it is finished sending the request, a user with a slow connection can tie down that worker for a long time
With NGINX as a reverse proxy, it will receive the data from the Apache worker over localhost, freeing that worker to answer the next request, while NGINX takes care of sending the data to the user
The tutorial walks through the setup, which is very easy on modern FreeBSD
One could also add mod_rpaf2 to the Apache, to securely pass through the users’ real IP address for use by Apache’s logging and the PHP scripts
***
FreeBSD and FreeNAS in Business by Randy Westlund (http://bsdmag.org/freebsd_freenas/)
The story of how a Tent &amp;amp; Awning company switched from managing orders with paper, to a computerized system backed by a FreeNAS
“At first, I looked at off-the-shelf solutions. I found a number of cloud services that were like Dropbox, but with some generic management stuff layered on top. Not only did these all feel like a poor solution, they were very expensive. If the provider were to go out of business, what would happen to my dad’s company?”
“Fortunately, sourcing the hardware and setting up the OS was the easiest part; I talked to iXsystems. I ordered a FreeNAS Mini and a nice workstation tower”
“I have r2d2 (the tower, which hosts the database) replicating ZFS snapshots to c3po (the FreeNAS mini), and the data is backed up off-site regularly. This data is absolutely mission-critical, so I can’t take any risks. I’m glad I have ZFS on my side.”
“I replaced Dropbox with Samba on c3po, and the Windows machines in the office now store important data on the NAS, rather than their local drives.”
“I also replaced their router with an APU board running pfSense and replaced their PPTP VPN with OpenVPN and certificate authorization.”
“FreeBSD (in three different incarnations) helped me focus on improving the company’s workflow without spending much time on the OS. And now there’s an awning company that is, in a very real sense, powered by FreeBSD.”
***
Tutorial, Windows running under bhyve (http://pr1ntf.xyz/windowsunderbhyve.html)
With the recent passing of the world’s foremost expert on running Windows under bhyve on FreeBSD, this tutorial will help you get up to speed
“The secret sauce to getting Windows running under bhyve is the new UEFI support. This is pretty great news, because when you utilize UEFI in bhyve, you don't have to load the operating system in bhyveload or grub-bhyve first.”
The author works on iohyve, and wanted to migrate away from VirtualBox, the only thing stopping that was support for Windows Guests
iohyve now has support for managing Windows VMs
The tutorial uses a script to extract the Windows Server 2008 ISO and set up AutoUnattend.xml to handle the installation of Windows, including setting the default administrator password, this is required because there is no graphical console yet
The AutoUnattended setup also includes setting the IP address, laying out the partitions, and configuring the serial console
A second script is then used to make a new ISO with the modifications
The user is directed to fetch the UEFI firmware and some other bits
Then iohyve is used to create the Windows VM
The first boot uses the newly created ISO to install Windows Server 2008
Subsequent boots start Windows directly from the virtual disk
Remote Desktop is enabled, so the user can manage the Windows Server graphically, using FreeRDP or a Windows client
iohyve can then be used to take snapshots of the machine, and clone it
***
BSD Router Project has released 1.58 (http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.58/)
The BSD Router project has announced the release of version 1.58 with some notable new features
Update to FreeBSD 10.2-RELEASE-p8
Disabled some Chelsio Nic features not used by a router
Added new easy installation helper option, use with “system install ”
Added the debugging symbols for userland
Includes the iperf package, and flashrom package, which allows updating system BIOS on supported boxes
IMPORTANT: Corrects an important UFS label bug introduced on 1.57. If you are running 1.57, you will need to fetch their fixlabel.sh script before upgrading to 1.58
***
OPNsense 15.7.22 Released (https://opnsense.org/opnsense-15-7-22-released/)
An update to OPNsense has landed this week which includes the important updates to OpenSSL 1.0.2e and LibreSSL 2.2.5
A long-standing annoying bug with filter reload timeouts has finally been identified and sorted out as well, allowing the functionality to run quickly and “glitch free” again. 
Some newer ports for curl (7.46), squid (3.5.12) and lighttpd (1.4.38) have also been thrown in for good measure
Some other minor UI fixes have also been included as well
With the holidays coming up, if you are still running a consumer router, this may be a good time to convert over to a OPNsense or PFsense box and get yourself ready for the new year. 
***
iXsystems
iXSystems releases vCenter Web Client Plug-in for TrueNAS (https://www.ixsystems.com/whats-new/2015/12/vcenter-web-client-plug-in-for-truenas-now-available/) 
Interview - Pawel Jakub Dawidek - pjd@FreeBSD.org (mailto:pjd@FreeBSD.org)
News Roundup
Developer claims the PS4 has been jail-broken (http://www.networkworld.com/article/3014714/security/developer-claims-ps4-officially-jailbroken.html)
While not exactly a well-kept secret, the PS4’s proprietary “OrbOS” is FreeBSD based. 
Using this knowledge and a Kernel exploit, developer CTurt (https://twitter.com/CTurtE/) claims he was able jailbreak a WebKit process and gain access to the system. 
He has posted a small tease to GitHub, detailing some of the information gleaned from the exploit, such as PID list and root FS dump
As such with these kinds of jailbreaks, he already requested that users stop sending him requests about game piracy, but the ability to hack on / run homebrew apps on the PS4 seems intriguing
***
Sepherosa Ziehau is looking for testers if you have a em(4), emx(4), or igb(4) Intel device (http://lists.dragonflybsd.org/pipermail/users/2015-December/228461.html)
DragonFly Testers wanted! Sephe has posted a request for users of the em(4), emx(4) and igb(4) intel drivers to test his latest branch and report back results
He mentions that he has tested the models 82571, 82574 and 82573 (em/emx); 82575, 82576, 82580 and i350 specifically, so if you have something different, I’m sure he would be much appreciative of the help. 
It looks like the em(4) driver has been updated to 7.5.2, and igb(4) 2.4.3, and adds support for the I219-LM and I219-V NICS.
***
OpenBSD Xen Support (https://marc.info/?l=openbsd-tech&amp;amp;m=144933933119525&amp;amp;w=2)
Filed under the “Ohh, look what’s coming soon” section, it appears that patches are starting to surface for OpenBSD Xen DOMU support. 
For those who aren’t up on their Xen terminology, DomU is the unprivileged domain (I.E. Guest mode)
Right now the patch exists at the link above, and adds a new (commented out) device to the GENERIC kernel, but this gives Xen users something new to watch for updates to. 
***
Thinkpad Backlit Keyboard support being worked on (http://freshbsd.org/commit/openbsd/b355449caa22e7bb6c460f7a647874836ef604f0)
Another reason why Lenovo / ThinkPads are some of the best laptops currently to use with BSD, the kettenis over at the OpenBSD project has committed a patch to enable support for the “ThinkLight”
For those who don’t know, this is the little light that helps illuminate the laptop’s keyboard under low-light situations. 
While the initial patch only supports the “real-deal” ThinkLight, he does mention that support will be added soon for the others on ThinkPads
No sysctl’s to fiddle with, this works directly with the ACPI / keyboard function keys directly, nice!
***
Deadline is approaching for Submissions of Tutorial Proposals for AsiaBSDCon 2016 (https://2016.asiabsdcon.org/cfp.html)
Call for Papers for BSDCAN 2016 now open (http://www.bsdcan.org/2016/papers.php) 
+ The next two major BSD conferences both have their CFP up right now. First up is AsiaBSDCon in Tokyo from March 10th-13th, followed by BSDCan in Ottawa, June 8th-11th.
+ If you are working on anything interesting in the BSD community, this is a good way to get the word out about your project, plus the conference pays for Hotel / Travel. 
+ If you can make it to both, DO SO, you won’t regret it. Both Allan and Kris will be attending and we would look forward to meeting you. 
iohyve lands in ports (https://github.com/pr1ntf/iohyve)
(http://www.freshports.org/sysutils/iohyve/)
+ Something we’ve mentioned in passing has taken its first steps in becoming reality for users! “iohyve” has now landed in the FreeBSD ports tree
+ While it shares a similar name to “iocage” its not directly related, different developers and such. However it does share a very similar syntax and some principles of ZFS usage
+ The current version is 0.7, but it already has a rather large feature set
+ Among the current features are ISO Management, resource management, snapshot support (via ZFS), and support for OpenBSD, NetBSD and Linux (Using grub-bhyve port)
BeastieBits
hammer mount is forced noatime by default (http://lists.dragonflybsd.org/pipermail/users/2015-November/228445.html)
Show your support for FreeBSD (http://freebsdfoundation.blogspot.com/2015/12/show-your-support-for-freebsd.html) 
OpenBSD running in an Amazon EC2 t2.micro (https://gist.github.com/reyk/e23fde95354d4bc35a40) 
NetBSD's 2015Q4 Package freeze is coming (http://mail-index.netbsd.org/tech-pkg/2015/12/05/msg016059.html)
‘Screenshots from Developers’ that we covered previously from 2002, updated for 2015  (https://anders.unix.se/2015/12/10/screenshots-from-developers--2002-vs.-2015/) 
Feedback/Questions (slexy was down when I made these, I only did 3, since the last is really long, save rest for next week)
 Mark - BSD laptops (http://pastebin.com/g0DnFG95) 
 Jamie - zxfer (http://pastebin.com/BNCmDgTe) 
 Anonymous - Long Story (http://pastebin.com/iw0dXZ9P) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we are going to be talking to Pawel about how his</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3>Note the recent passing of 2 members of the BSD community</h3>

<ul>
<li><a href="https://www.freebsd.org/doc/en_US.ISO8859-1/articles/contributors/contrib-develinmemoriam.html" rel="nofollow">Juergen Lock / Nox</a> </li>
<li><a href="https://twitter.com/michaeldexter/status/676290499389485057" rel="nofollow">Benjamin Perrault / creepingfur</a> <a href="http://pastebin.com/4BQ5uVsT" rel="nofollow">Memories from Michael Dexter </a> </li>
<li><a href="http://www.filis.org/rip_ben.txt" rel="nofollow">Additional Memories </a> 

<ul>
<li><a href="http://www.allanjude.com/bsd/bp/IMG_20151101_161727-auto.jpg" rel="nofollow">Benjamin and Allan at Ben’s local bar </a> </li>
<li><a href="http://www.allanjude.com/bsd/bp/IMG_20151101_191344-auto.jpg" rel="nofollow">Benjamin treated Allan and Michael Dexter to their first ever Bermese food </a> </li>
<li><a href="http://www.allanjude.com/bsd/bp/IMG_20151003_105457-auto.jpg" rel="nofollow">Benjamin enjoying the hallway track at EuroBSDCon 2015 </a> 
***</li>
</ul></li>
</ul>

<h3><a href="http://linoxide.com/linux-how-to/install-nginx-reverse-proxy-apache-freebsd-10-2/" rel="nofollow">NGINX as Reverse Proxy for Apache on FreeBSD 10.2</a></h3>

<ul>
<li>A tutorial on setting up NGINX as a reverse proxy for Apache</li>
<li>Sometimes your users or application require some feature of Apache, that cannot be easily replicated in NGINX, like .htaccess files or a custom apache module</li>
<li>In addition, because the default worker model in Apache does not accept new work until it is finished sending the request, a user with a slow connection can tie down that worker for a long time</li>
<li>With NGINX as a reverse proxy, it will receive the data from the Apache worker over localhost, freeing that worker to answer the next request, while NGINX takes care of sending the data to the user</li>
<li>The tutorial walks through the setup, which is very easy on modern FreeBSD</li>
<li>One could also add mod_rpaf2 to the Apache, to securely pass through the users’ real IP address for use by Apache’s logging and the PHP scripts
***</li>
</ul>

<h3><a href="http://bsdmag.org/freebsd_freenas/" rel="nofollow">FreeBSD and FreeNAS in Business by Randy Westlund</a></h3>

<ul>
<li>The story of how a Tent &amp; Awning company switched from managing orders with paper, to a computerized system backed by a FreeNAS</li>
<li>“At first, I looked at off-the-shelf solutions. I found a number of cloud services that were like Dropbox, but with some generic management stuff layered on top. Not only did these all feel like a poor solution, they were very expensive. If the provider were to go out of business, what would happen to my dad’s company?”</li>
<li>“Fortunately, sourcing the hardware and setting up the OS was the easiest part; I talked to iXsystems. I ordered a FreeNAS Mini and a nice workstation tower”</li>
<li>“I have r2d2 (the tower, which hosts the database) replicating ZFS snapshots to c3po (the FreeNAS mini), and the data is backed up off-site regularly. This data is absolutely mission-critical, so I can’t take any risks. I’m glad I have ZFS on my side.”</li>
<li>“I replaced Dropbox with Samba on c3po, and the Windows machines in the office now store important data on the NAS, rather than their local drives.”</li>
<li>“I also replaced their router with an APU board running pfSense and replaced their PPTP VPN with OpenVPN and certificate authorization.”</li>
<li>“FreeBSD (in three different incarnations) helped me focus on improving the company’s workflow without spending much time on the OS. And now there’s an awning company that is, in a very real sense, powered by FreeBSD.”
***</li>
</ul>

<h3><a href="http://pr1ntf.xyz/windowsunderbhyve.html" rel="nofollow">Tutorial, Windows running under bhyve</a></h3>

<ul>
<li>With the recent passing of the world’s foremost expert on running Windows under bhyve on FreeBSD, this tutorial will help you get up to speed</li>
<li>“The secret sauce to getting Windows running under bhyve is the new UEFI support. This is pretty great news, because when you utilize UEFI in bhyve, you don&#39;t have to load the operating system in bhyveload or grub-bhyve first.”</li>
<li>The author works on iohyve, and wanted to migrate away from VirtualBox, the only thing stopping that was support for Windows Guests</li>
<li>iohyve now has support for managing Windows VMs</li>
<li>The tutorial uses a script to extract the Windows Server 2008 ISO and set up AutoUnattend.xml to handle the installation of Windows, including setting the default administrator password, this is required because there is no graphical console yet</li>
<li>The AutoUnattended setup also includes setting the IP address, laying out the partitions, and configuring the serial console</li>
<li>A second script is then used to make a new ISO with the modifications</li>
<li>The user is directed to fetch the UEFI firmware and some other bits</li>
<li>Then iohyve is used to create the Windows VM</li>
<li>The first boot uses the newly created ISO to install Windows Server 2008</li>
<li>Subsequent boots start Windows directly from the virtual disk</li>
<li>Remote Desktop is enabled, so the user can manage the Windows Server graphically, using FreeRDP or a Windows client</li>
<li>iohyve can then be used to take snapshots of the machine, and clone it
***</li>
</ul>

<h3><a href="http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.58/" rel="nofollow">BSD Router Project has released 1.58</a></h3>

<ul>
<li>The BSD Router project has announced the release of version 1.58 with some notable new features</li>
<li>Update to FreeBSD 10.2-RELEASE-p8</li>
<li>Disabled some Chelsio Nic features not used by a router</li>
<li>Added new easy installation helper option, use with “system install <disk>”</li>
<li>Added the debugging symbols for userland</li>
<li>Includes the iperf package, and flashrom package, which allows updating system BIOS on supported boxes</li>
<li>IMPORTANT: Corrects an important UFS label bug introduced on 1.57. If you are running 1.57, you will need to fetch their fixlabel.sh script before upgrading to 1.58
***</li>
</ul>

<h3><a href="https://opnsense.org/opnsense-15-7-22-released/" rel="nofollow">OPNsense 15.7.22 Released</a></h3>

<ul>
<li>An update to OPNsense has landed this week which includes the important updates to OpenSSL 1.0.2e and LibreSSL 2.2.5</li>
<li>A long-standing annoying bug with filter reload timeouts has finally been identified and sorted out as well, allowing the functionality to run quickly and “glitch free” again. </li>
<li>Some newer ports for curl (7.46), squid (3.5.12) and lighttpd (1.4.38) have also been thrown in for good measure</li>
<li>Some other minor UI fixes have also been included as well</li>
<li>With the holidays coming up, if you are still running a consumer router, this may be a good time to convert over to a OPNsense or PFsense box and get yourself ready for the new year. 
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.ixsystems.com/whats-new/2015/12/vcenter-web-client-plug-in-for-truenas-now-available/" rel="nofollow">iXSystems releases vCenter Web Client Plug-in for TrueNAS</a> </li>
</ul>

<h2>Interview - Pawel Jakub Dawidek - <a href="mailto:pjd@FreeBSD.org" rel="nofollow">pjd@FreeBSD.org</a></h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.networkworld.com/article/3014714/security/developer-claims-ps4-officially-jailbroken.html" rel="nofollow">Developer claims the PS4 has been jail-broken</a></h3>

<ul>
<li>While not exactly a well-kept secret, the PS4’s proprietary “OrbOS” is FreeBSD based. </li>
<li>Using this knowledge and a Kernel exploit, developer CTurt (<a href="https://twitter.com/CTurtE/" rel="nofollow">https://twitter.com/CTurtE/</a>) claims he was able jailbreak a WebKit process and gain access to the system. </li>
<li>He has posted a small tease to GitHub, detailing some of the information gleaned from the exploit, such as PID list and root FS dump</li>
<li>As such with these kinds of jailbreaks, he already requested that users stop sending him requests about game piracy, but the ability to hack on / run homebrew apps on the PS4 seems intriguing
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-December/228461.html" rel="nofollow">Sepherosa Ziehau is looking for testers if you have a em(4), emx(4), or igb(4) Intel device</a></h3>

<ul>
<li>DragonFly Testers wanted! Sephe has posted a request for users of the em(4), emx(4) and igb(4) intel drivers to test his latest branch and report back results</li>
<li>He mentions that he has tested the models 82571, 82574 and 82573 (em/emx); 82575, 82576, 82580 and i350 specifically, so if you have something different, I’m sure he would be much appreciative of the help. </li>
<li>It looks like the em(4) driver has been updated to 7.5.2, and igb(4) 2.4.3, and adds support for the I219-LM and I219-V NICS.
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-tech&m=144933933119525&w=2" rel="nofollow">OpenBSD Xen Support</a></h3>

<ul>
<li>Filed under the “Ohh, look what’s coming soon” section, it appears that patches are starting to surface for OpenBSD Xen DOMU support. </li>
<li>For those who aren’t up on their Xen terminology, DomU is the unprivileged domain (I.E. Guest mode)</li>
<li>Right now the patch exists at the link above, and adds a new (commented out) device to the GENERIC kernel, but this gives Xen users something new to watch for updates to. 
***</li>
</ul>

<h3><a href="http://freshbsd.org/commit/openbsd/b355449caa22e7bb6c460f7a647874836ef604f0" rel="nofollow">Thinkpad Backlit Keyboard support being worked on</a></h3>

<ul>
<li>Another reason why Lenovo / ThinkPads are some of the best laptops currently to use with BSD, the kettenis over at the OpenBSD project has committed a patch to enable support for the “ThinkLight”</li>
<li>For those who don’t know, this is the little light that helps illuminate the laptop’s keyboard under low-light situations. </li>
<li>While the initial patch only supports the “real-deal” ThinkLight, he does mention that support will be added soon for the others on ThinkPads</li>
<li>No sysctl’s to fiddle with, this works directly with the ACPI / keyboard function keys directly, nice!
***</li>
</ul>

<h3><a href="https://2016.asiabsdcon.org/cfp.html" rel="nofollow">Deadline is approaching for Submissions of Tutorial Proposals for AsiaBSDCon 2016</a></h3>

<p><a href="http://www.bsdcan.org/2016/papers.php" rel="nofollow">Call for Papers for BSDCAN 2016 now open</a> </p>

<ul>
<li>The next two major BSD conferences both have their CFP up right now. First up is AsiaBSDCon in Tokyo from March 10th-13th, followed by BSDCan in Ottawa, June 8th-11th.</li>
<li>If you are working on anything interesting in the BSD community, this is a good way to get the word out about your project, plus the conference pays for Hotel / Travel. </li>
<li>If you can make it to both, DO SO, you won’t regret it. Both Allan and Kris will be attending and we would look forward to meeting you. 
***</li>
</ul>

<h3><a href="https://github.com/pr1ntf/iohyve" rel="nofollow">iohyve lands in ports</a></h3>

<p>(<a href="http://www.freshports.org/sysutils/iohyve/" rel="nofollow">http://www.freshports.org/sysutils/iohyve/</a>)</p>

<ul>
<li>Something we’ve mentioned in passing has taken its first steps in becoming reality for users! “iohyve” has now landed in the FreeBSD ports tree</li>
<li>While it shares a similar name to “iocage” its not directly related, different developers and such. However it does share a very similar syntax and some principles of ZFS usage</li>
<li>The current version is 0.7, but it already has a rather large feature set</li>
<li>Among the current features are ISO Management, resource management, snapshot support (via ZFS), and support for OpenBSD, NetBSD and Linux (Using grub-bhyve port)
***</li>
</ul>

<h2>BeastieBits</h2>

<p><a href="http://lists.dragonflybsd.org/pipermail/users/2015-November/228445.html" rel="nofollow">hammer mount is forced noatime by default</a></p>

<p><a href="http://freebsdfoundation.blogspot.com/2015/12/show-your-support-for-freebsd.html" rel="nofollow">Show your support for FreeBSD</a> </p>

<p><a href="https://gist.github.com/reyk/e23fde95354d4bc35a40" rel="nofollow">OpenBSD running in an Amazon EC2 t2.micro</a> </p>

<p><a href="http://mail-index.netbsd.org/tech-pkg/2015/12/05/msg016059.html" rel="nofollow">NetBSD&#39;s 2015Q4 Package freeze is coming</a></p>

<p><a href="https://anders.unix.se/2015/12/10/screenshots-from-developers--2002-vs.-2015/" rel="nofollow">‘Screenshots from Developers’ that we covered previously from 2002, updated for 2015 </a> </p>

<hr>

<h2>Feedback/Questions (slexy was down when I made these, I only did 3, since the last is really long, save rest for next week)</h2>

<ul>
<li><a href="http://pastebin.com/g0DnFG95" rel="nofollow"> Mark - BSD laptops</a> </li>
<li><a href="http://pastebin.com/BNCmDgTe" rel="nofollow"> Jamie - zxfer</a> </li>
<li><a href="http://pastebin.com/iw0dXZ9P" rel="nofollow"> Anonymous - Long Story</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we are going to be talking to Pawel about how his</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3>Note the recent passing of 2 members of the BSD community</h3>

<ul>
<li><a href="https://www.freebsd.org/doc/en_US.ISO8859-1/articles/contributors/contrib-develinmemoriam.html" rel="nofollow">Juergen Lock / Nox</a> </li>
<li><a href="https://twitter.com/michaeldexter/status/676290499389485057" rel="nofollow">Benjamin Perrault / creepingfur</a> <a href="http://pastebin.com/4BQ5uVsT" rel="nofollow">Memories from Michael Dexter </a> </li>
<li><a href="http://www.filis.org/rip_ben.txt" rel="nofollow">Additional Memories </a> 

<ul>
<li><a href="http://www.allanjude.com/bsd/bp/IMG_20151101_161727-auto.jpg" rel="nofollow">Benjamin and Allan at Ben’s local bar </a> </li>
<li><a href="http://www.allanjude.com/bsd/bp/IMG_20151101_191344-auto.jpg" rel="nofollow">Benjamin treated Allan and Michael Dexter to their first ever Bermese food </a> </li>
<li><a href="http://www.allanjude.com/bsd/bp/IMG_20151003_105457-auto.jpg" rel="nofollow">Benjamin enjoying the hallway track at EuroBSDCon 2015 </a> 
***</li>
</ul></li>
</ul>

<h3><a href="http://linoxide.com/linux-how-to/install-nginx-reverse-proxy-apache-freebsd-10-2/" rel="nofollow">NGINX as Reverse Proxy for Apache on FreeBSD 10.2</a></h3>

<ul>
<li>A tutorial on setting up NGINX as a reverse proxy for Apache</li>
<li>Sometimes your users or application require some feature of Apache, that cannot be easily replicated in NGINX, like .htaccess files or a custom apache module</li>
<li>In addition, because the default worker model in Apache does not accept new work until it is finished sending the request, a user with a slow connection can tie down that worker for a long time</li>
<li>With NGINX as a reverse proxy, it will receive the data from the Apache worker over localhost, freeing that worker to answer the next request, while NGINX takes care of sending the data to the user</li>
<li>The tutorial walks through the setup, which is very easy on modern FreeBSD</li>
<li>One could also add mod_rpaf2 to the Apache, to securely pass through the users’ real IP address for use by Apache’s logging and the PHP scripts
***</li>
</ul>

<h3><a href="http://bsdmag.org/freebsd_freenas/" rel="nofollow">FreeBSD and FreeNAS in Business by Randy Westlund</a></h3>

<ul>
<li>The story of how a Tent &amp; Awning company switched from managing orders with paper, to a computerized system backed by a FreeNAS</li>
<li>“At first, I looked at off-the-shelf solutions. I found a number of cloud services that were like Dropbox, but with some generic management stuff layered on top. Not only did these all feel like a poor solution, they were very expensive. If the provider were to go out of business, what would happen to my dad’s company?”</li>
<li>“Fortunately, sourcing the hardware and setting up the OS was the easiest part; I talked to iXsystems. I ordered a FreeNAS Mini and a nice workstation tower”</li>
<li>“I have r2d2 (the tower, which hosts the database) replicating ZFS snapshots to c3po (the FreeNAS mini), and the data is backed up off-site regularly. This data is absolutely mission-critical, so I can’t take any risks. I’m glad I have ZFS on my side.”</li>
<li>“I replaced Dropbox with Samba on c3po, and the Windows machines in the office now store important data on the NAS, rather than their local drives.”</li>
<li>“I also replaced their router with an APU board running pfSense and replaced their PPTP VPN with OpenVPN and certificate authorization.”</li>
<li>“FreeBSD (in three different incarnations) helped me focus on improving the company’s workflow without spending much time on the OS. And now there’s an awning company that is, in a very real sense, powered by FreeBSD.”
***</li>
</ul>

<h3><a href="http://pr1ntf.xyz/windowsunderbhyve.html" rel="nofollow">Tutorial, Windows running under bhyve</a></h3>

<ul>
<li>With the recent passing of the world’s foremost expert on running Windows under bhyve on FreeBSD, this tutorial will help you get up to speed</li>
<li>“The secret sauce to getting Windows running under bhyve is the new UEFI support. This is pretty great news, because when you utilize UEFI in bhyve, you don&#39;t have to load the operating system in bhyveload or grub-bhyve first.”</li>
<li>The author works on iohyve, and wanted to migrate away from VirtualBox, the only thing stopping that was support for Windows Guests</li>
<li>iohyve now has support for managing Windows VMs</li>
<li>The tutorial uses a script to extract the Windows Server 2008 ISO and set up AutoUnattend.xml to handle the installation of Windows, including setting the default administrator password, this is required because there is no graphical console yet</li>
<li>The AutoUnattended setup also includes setting the IP address, laying out the partitions, and configuring the serial console</li>
<li>A second script is then used to make a new ISO with the modifications</li>
<li>The user is directed to fetch the UEFI firmware and some other bits</li>
<li>Then iohyve is used to create the Windows VM</li>
<li>The first boot uses the newly created ISO to install Windows Server 2008</li>
<li>Subsequent boots start Windows directly from the virtual disk</li>
<li>Remote Desktop is enabled, so the user can manage the Windows Server graphically, using FreeRDP or a Windows client</li>
<li>iohyve can then be used to take snapshots of the machine, and clone it
***</li>
</ul>

<h3><a href="http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.58/" rel="nofollow">BSD Router Project has released 1.58</a></h3>

<ul>
<li>The BSD Router project has announced the release of version 1.58 with some notable new features</li>
<li>Update to FreeBSD 10.2-RELEASE-p8</li>
<li>Disabled some Chelsio Nic features not used by a router</li>
<li>Added new easy installation helper option, use with “system install <disk>”</li>
<li>Added the debugging symbols for userland</li>
<li>Includes the iperf package, and flashrom package, which allows updating system BIOS on supported boxes</li>
<li>IMPORTANT: Corrects an important UFS label bug introduced on 1.57. If you are running 1.57, you will need to fetch their fixlabel.sh script before upgrading to 1.58
***</li>
</ul>

<h3><a href="https://opnsense.org/opnsense-15-7-22-released/" rel="nofollow">OPNsense 15.7.22 Released</a></h3>

<ul>
<li>An update to OPNsense has landed this week which includes the important updates to OpenSSL 1.0.2e and LibreSSL 2.2.5</li>
<li>A long-standing annoying bug with filter reload timeouts has finally been identified and sorted out as well, allowing the functionality to run quickly and “glitch free” again. </li>
<li>Some newer ports for curl (7.46), squid (3.5.12) and lighttpd (1.4.38) have also been thrown in for good measure</li>
<li>Some other minor UI fixes have also been included as well</li>
<li>With the holidays coming up, if you are still running a consumer router, this may be a good time to convert over to a OPNsense or PFsense box and get yourself ready for the new year. 
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.ixsystems.com/whats-new/2015/12/vcenter-web-client-plug-in-for-truenas-now-available/" rel="nofollow">iXSystems releases vCenter Web Client Plug-in for TrueNAS</a> </li>
</ul>

<h2>Interview - Pawel Jakub Dawidek - <a href="mailto:pjd@FreeBSD.org" rel="nofollow">pjd@FreeBSD.org</a></h2>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.networkworld.com/article/3014714/security/developer-claims-ps4-officially-jailbroken.html" rel="nofollow">Developer claims the PS4 has been jail-broken</a></h3>

<ul>
<li>While not exactly a well-kept secret, the PS4’s proprietary “OrbOS” is FreeBSD based. </li>
<li>Using this knowledge and a Kernel exploit, developer CTurt (<a href="https://twitter.com/CTurtE/" rel="nofollow">https://twitter.com/CTurtE/</a>) claims he was able jailbreak a WebKit process and gain access to the system. </li>
<li>He has posted a small tease to GitHub, detailing some of the information gleaned from the exploit, such as PID list and root FS dump</li>
<li>As such with these kinds of jailbreaks, he already requested that users stop sending him requests about game piracy, but the ability to hack on / run homebrew apps on the PS4 seems intriguing
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-December/228461.html" rel="nofollow">Sepherosa Ziehau is looking for testers if you have a em(4), emx(4), or igb(4) Intel device</a></h3>

<ul>
<li>DragonFly Testers wanted! Sephe has posted a request for users of the em(4), emx(4) and igb(4) intel drivers to test his latest branch and report back results</li>
<li>He mentions that he has tested the models 82571, 82574 and 82573 (em/emx); 82575, 82576, 82580 and i350 specifically, so if you have something different, I’m sure he would be much appreciative of the help. </li>
<li>It looks like the em(4) driver has been updated to 7.5.2, and igb(4) 2.4.3, and adds support for the I219-LM and I219-V NICS.
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-tech&m=144933933119525&w=2" rel="nofollow">OpenBSD Xen Support</a></h3>

<ul>
<li>Filed under the “Ohh, look what’s coming soon” section, it appears that patches are starting to surface for OpenBSD Xen DOMU support. </li>
<li>For those who aren’t up on their Xen terminology, DomU is the unprivileged domain (I.E. Guest mode)</li>
<li>Right now the patch exists at the link above, and adds a new (commented out) device to the GENERIC kernel, but this gives Xen users something new to watch for updates to. 
***</li>
</ul>

<h3><a href="http://freshbsd.org/commit/openbsd/b355449caa22e7bb6c460f7a647874836ef604f0" rel="nofollow">Thinkpad Backlit Keyboard support being worked on</a></h3>

<ul>
<li>Another reason why Lenovo / ThinkPads are some of the best laptops currently to use with BSD, the kettenis over at the OpenBSD project has committed a patch to enable support for the “ThinkLight”</li>
<li>For those who don’t know, this is the little light that helps illuminate the laptop’s keyboard under low-light situations. </li>
<li>While the initial patch only supports the “real-deal” ThinkLight, he does mention that support will be added soon for the others on ThinkPads</li>
<li>No sysctl’s to fiddle with, this works directly with the ACPI / keyboard function keys directly, nice!
***</li>
</ul>

<h3><a href="https://2016.asiabsdcon.org/cfp.html" rel="nofollow">Deadline is approaching for Submissions of Tutorial Proposals for AsiaBSDCon 2016</a></h3>

<p><a href="http://www.bsdcan.org/2016/papers.php" rel="nofollow">Call for Papers for BSDCAN 2016 now open</a> </p>

<ul>
<li>The next two major BSD conferences both have their CFP up right now. First up is AsiaBSDCon in Tokyo from March 10th-13th, followed by BSDCan in Ottawa, June 8th-11th.</li>
<li>If you are working on anything interesting in the BSD community, this is a good way to get the word out about your project, plus the conference pays for Hotel / Travel. </li>
<li>If you can make it to both, DO SO, you won’t regret it. Both Allan and Kris will be attending and we would look forward to meeting you. 
***</li>
</ul>

<h3><a href="https://github.com/pr1ntf/iohyve" rel="nofollow">iohyve lands in ports</a></h3>

<p>(<a href="http://www.freshports.org/sysutils/iohyve/" rel="nofollow">http://www.freshports.org/sysutils/iohyve/</a>)</p>

<ul>
<li>Something we’ve mentioned in passing has taken its first steps in becoming reality for users! “iohyve” has now landed in the FreeBSD ports tree</li>
<li>While it shares a similar name to “iocage” its not directly related, different developers and such. However it does share a very similar syntax and some principles of ZFS usage</li>
<li>The current version is 0.7, but it already has a rather large feature set</li>
<li>Among the current features are ISO Management, resource management, snapshot support (via ZFS), and support for OpenBSD, NetBSD and Linux (Using grub-bhyve port)
***</li>
</ul>

<h2>BeastieBits</h2>

<p><a href="http://lists.dragonflybsd.org/pipermail/users/2015-November/228445.html" rel="nofollow">hammer mount is forced noatime by default</a></p>

<p><a href="http://freebsdfoundation.blogspot.com/2015/12/show-your-support-for-freebsd.html" rel="nofollow">Show your support for FreeBSD</a> </p>

<p><a href="https://gist.github.com/reyk/e23fde95354d4bc35a40" rel="nofollow">OpenBSD running in an Amazon EC2 t2.micro</a> </p>

<p><a href="http://mail-index.netbsd.org/tech-pkg/2015/12/05/msg016059.html" rel="nofollow">NetBSD&#39;s 2015Q4 Package freeze is coming</a></p>

<p><a href="https://anders.unix.se/2015/12/10/screenshots-from-developers--2002-vs.-2015/" rel="nofollow">‘Screenshots from Developers’ that we covered previously from 2002, updated for 2015 </a> </p>

<hr>

<h2>Feedback/Questions (slexy was down when I made these, I only did 3, since the last is really long, save rest for next week)</h2>

<ul>
<li><a href="http://pastebin.com/g0DnFG95" rel="nofollow"> Mark - BSD laptops</a> </li>
<li><a href="http://pastebin.com/BNCmDgTe" rel="nofollow"> Jamie - zxfer</a> </li>
<li><a href="http://pastebin.com/iw0dXZ9P" rel="nofollow"> Anonymous - Long Story</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>119: There be Dragons, BSD Dragons anyway</title>
  <link>https://www.bsdnow.tv/119</link>
  <guid isPermaLink="false">37b89eb3-cafc-4d08-916c-024e11347e21</guid>
  <pubDate>Wed, 09 Dec 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/37b89eb3-cafc-4d08-916c-024e11347e21.mp3" length="72811156" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow - It’s getting close to christmas and the</itunes:subtitle>
  <itunes:duration>1:41:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow - It’s getting close to christmas and the
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
n2k15 hackathon reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20151208172029)
tedu@ worked on rebound, malloc hardening, removing legacy code
“I don't usually get too involved with the network stack, but sometimes you find yourself at a network hackathon and have to go with the flow. With many developers working in the same area, it can be hard to find an appropriate project, but fortunately there are a few dusty corners in networking land that can be swept up without too much disturbance to others.”
“IPv6 is the future of networking. IPv6 has also been the future of networking for 20 years. As a result, a number of features have been proposed, implemented, then obsoleted, but the corresponding code never quite gets deleted. The IPsec stack has followed a somewhat similar trajectory”
“I read through various networking headers in search of features that would normally be exposed to userland, but were instead guarded by ifdef _KERNEL. This identified a number of options for setsockopt() that had been officially retired from the API, but the kernel code retained to provide ABI compatibility during a transition period. That transition occurred more than a decade ago. Binary programs from that era no longer run for many other reasons, and so we can delete support. It's only a small improvement, but it gradually reduces the amount of code that needs to be reviewed when making larger more important changes”
Ifconfig txpower got similar treatment, as no modern WiFi driver supports it
Support for Ethernet Trailers, RFC 893 (https://tools.ietf.org/html/rfc893), enabled zero copy networking on a VAX with 512 byte hardware pages, the feature was removed even before OpenBSD was founded, but the ifconfig option was still in place
Alexandr Nedvedicky (sashan@) worked on MP-Safe PF (http://undeadly.org/cgi?action=article&amp;amp;sid=20151207143819) 
“I'd like to thank Reyk for hackroom and showing us a Christmas market. It was also my pleasure to meet Mr. Henning in person. Speaking of Henning, let's switch to PF hacking.”
“mpi@ came with patch (sent to priv. list only currently), which adds a new lock for PF. It's called PF big lock. The big PF lock essentially establishes a safe playground for PF hackers. The lock currently covers all pftest() function. The pftest() function parts will be gradually unlocked as the work will progress.
To make PF big lock safe few more details must be sorted out. The first of them is to avoid recursive calls to pftest(). The pftest() could get entered recursively, when packet hits block rule with return-* action. This is no longer the case as ipsend() functions got introduced (committed change has been discussed privately). Packets sent on behalf of kernel are dispatched using softnet task queue now. We still have to sort out pfroute() functions. The other thing we need to sort out with respect to PF big lock is reference counting for statekey, which gets attached to mbuf. Patch has been sent to hackers, waiting for OK too. The plan is to commit reference counting sometimes next year after CVS will be unlocked. There is one more patch at tech@ waiting for OK. It brings OpenBSD and Solaris PF closer to each other by one tiny little step.”
***
ACM Queue: Challenges of Memory Management on Modern NUMA System (http://queue.acm.org/detail.cfm?id=2852078)
“Modern server-class systems are typically built as several multicore chips put together in a single system. Each chip has a local DRAM (dynamic random-access memory) module; together they are referred to as a node. Nodes are connected via a high-speed interconnect, and the system is fully coherent. This means that, transparently to the programmer, a core can issue requests to its node's local memory as well as to the memories of other nodes. The key distinction is that remote requests will take longer, because they are subject to longer wire delays and may have to jump several hops as they traverse the interconnect. The latency of memory-access times is hence non-uniform, because it depends on where the request originates and where it is destined to go. Such systems are referred to as NUMA (non-uniform memory access).”
So, depending what core a program is running on, it will have different throughput and latency to specific banks of memory. Therefore, it is usually optimal to try to allocate memory from the bank of ram connected to the CPU that the program is running on, and to keep that program running on that same CPU, rather than moving it around
There are a number of different NUMA strategies, including:
Fixed, memory is always allocated from a specific bank of memory
First Touch, which means that memory is allocated from the bank connected to the CPU that the application is running on when it requests the memory, which can increase performance if the application remains on that same CPU, and the load is balanced optimally
Round Robin or Interleave, where memory is allocated evenly, each allocation coming from the next bank of memory so that all banks are used. This method can provide more uniform performance, because it ensures that all memory accesses have the same change to be local vs remote. If even performance is required, this method can be better than something more focused on locality, but that might fail and result in remote access
AutoNUMA, A kernel task routinely iterates through the allocated memory of each process and tallies the number of memory pages on each node for that process. It also clears the present bit on the pages, which will force the CPU to stop and enter the page-fault handler when the page is next accessed. In the page-fault handler it records which node and thread is trying to access the page before setting the present bit and allowing execution to continue. Pages that are accessed from remote nodes are put into a queue to be migrated to that node. After a page has already been migrated once, though, future migrations require two recorded accesses from a remote node, which is designed to prevent excessive migrations (known as page bouncing).
The paper also introduces a new strategy:
Carrefour is a memory-placement algorithm for NUMA systems that focuses on traffic management: placing memory so as to minimize congestion on interconnect links or memory controllers. Trying to strike a balance between locality, and ensuring that the interconnect between a specific pair of CPUs does not become congested, which can make remote accesses even slower
Carrefour uses three primary techniques:
Memory collocation, Moving memory to a different node so that accesses will likely be local.
Replication, Copying memory to several nodes so that threads from each node can access it locally (useful for read-only and read-mostly data).
Interleaving, Moving memory such that it is distributed evenly among all nodes.
FreeBSD is slowly gaining NUMA capabilities, and currently supports: fixed, round-robin, first-touch. Additionally, it also supports fixed-rr, and first-touch-rr, where if the memory allocation fails, because the fixed domain or first-touch domain is full, it falls back to round-robin.
For more information, see numa(4) and numa_setaffinity(2) on 11-CURRENT
***
Is that Linux? No it is PC-BSD (http://fossforce.com/2015/12/linux-no-pc-bsd/)
Larry Cafiero continues to make some news about his switch to PC-BSD from Linux. This time in an blog post titled “Is that Linux? No, its PC-BSD” he describes an experience out and about where he was asked what is running on his laptop, and was unable for the first time in 9 years to answer, it’s Linux. 
The blog then goes on to mention his experience up to now running PC-BSD, how the learning curve was fairly easy coming from a Linux background. 
He mentions that he has noticed an uptick in performance on the system, no specific benchmarks but this “Linux was fast enough on this machine. But in street racing parlance, with PC-BSD I’m burning rubber in all four gears.”
The only major nits he mentions is having trouble getting a font to switch in FireFox, and not knowing how to enable GRUB quiet mode. (I’ll have to add a knob back for that)
***
Dual booting OS X and OpenBSD with full disk encryption (https://gist.github.com/jcs/5573685)
New GPT and UEFI support allow OpenBSD to co-exist with Mac OS X without the need for Boot Camp Assistant or Hybrid MBRs
This tutorial walks the read through the steps of installing OpenBSD side-by-side with Mac OS X
First the HFS+ partition is shrunk to make room for a new OpenBSD partition
Then the OpenBSD installer is run, and the available free space is setup as an encrypted softraid 
The OpenBSD installer will add itself to the EFI partition
Rename the boot loader installed by OpenBSD and replace it with rEFInd, so you will get a boot menu allowing you to select between OpenBSD and OS X
***
Interview - Paul Goyette - pgoyette@netbsd.org (mailto:pgoyette@netbsd.org)
NetBSD Testing and Modularity
***
iXsystems
iXsystems Wins Press and Industry Analyst Accolades in Best in Biz Awards 2015 (http://www.virtual-strategy.com/2015/12/08/ixsystems-wins-press-and-industry-analyst-accolades-best-biz-awards-2015)
***
News Roundup
HOWTO: L2TP/IPSec with OpenBSD (https://www.geeklan.co.uk/?p=2019)
*BSD contributor Sevan Janiyan provides an update on setting up a road-warrior VPN
This first article walks through setting up the OpenBSD server side, and followup articles will cover configuring various client systems to connect to it
The previous tutorial on this configuration is from 2012, and things have improved greatly since then, and is much easier to set up now
The tutorial includes PF rules, npppd configuration, and how to enable isakmpd and ipsec
L2TP/IPSec is chosen because most operating systems, including Windows, OS X, iOS, and Android, include a native L2TP client, rather than requiring some additional software to be installed
***
DragonFly 4.4 Released (http://www.dragonflybsd.org/release44/)
DragonFly BSD has made its 4.4 release official this week!
A lot of big changes, but some of the highlights
Radeon / i915 DRM support for up to Linux Kernel 3.18
Proper collation support for named locales, shared back to FreeBSD 11-CURRENT
Regex Support using TRE “As a consequence of the locale upgrades, the original regex library had to be forced into POSIX (single-byte) mode always. The support for multi-byte characters just wasn't there. ” …. “TRE is faster, more capable, and supports multibyte characters, so it's a nice addition to this release.”
Other noteworthy, iwm(4) driver, CPU power-saving improvements, import ipfw from FreeBSD (named ipfw3)
An interesting tidbit is switching to the Gold linker (http://bsd.slashdot.org/story/15/12/04/2351241/dragonflybsd-44-switches-to-the-gold-linker-by-default) 
***
Guide to install Ajenti on Nginx with SSL on FreeBSD 10.2 (http://linoxide.com/linux-how-to/install-ajenti-nginx-ssl-freebsd-10-2/)
Looking for a webmin-like interface to control your FreeBSD box? Enter Ajenti, and today we have a walkthrough posted on how to get it setup on a FreeBSD 10.2 system.
The walkthrough is mostly straightforward, you’ll need a FreeBSD box with root, and will need to install several packages / ports initially. 
Because there is no native package (yet), it guides you through using python’s PIP installer to fetch and get Ajenti running. 
The author links to some pre-built rc.d scripts and other helpful config files on GitHub, which will further assist in the process of making it run on FreeBSD.
Ajenti by itself may not be the best to serve publically, so it also provides instructions on how to protect the connection by serving it through nginx / SSL, a must-have if you plan on using this over unsecure networks. 
***
BSDCan 2016 CFP is up! (http://www.bsdcan.org/2016/papers.php)
BSDCan is the biggest North American BSD conference, and my personal favourite
The call for papers is now out, and I would like to see more first-time submitters this year
If you do anything interesting with or on a BSD, please write a proposal
Are the machines you run BSD on bigger or smaller than what most people have? Tell us about it
Are you running a big farm that does something interesting?
Is your university research using BSD?
Do you have an idea for a great new subsystem or utility?
Have you suffered through some horrible ordeal? Make sure the rest of us know the best way out when it happens to us.
Did you build a radar that runs NetBSD? A telescope controlled by FreeBSD?
Have you run an ISP at the north pole using Jails?
Do you run a usergroup and have tips to share?
Have you combined the features and tools of a BSD in a new and interesting way?
Don’t have a talk to give? Teach a tutorial!
The conference will arrange your air travel and hotel, and you’ll get to spend a few great days with the best community on earth
Michael W. Lucas’s post about the 2015 proposals and rejections  (http://blather.michaelwlucas.com/archives/2325)
***
Beastie Bits
OpenBSD's lightweight web server now in FreeBSD's ports tree (http://www.freshports.org/www/obhttpd/) 
Stephen Bourne's NYCBUG talk is online (https://www.youtube.com/watch?v=FI_bZhV7wpI)
Looking for owner to FreeBSDWiki (http://freebsdwiki.net/index.php/Main_Page) 
HOWTO: OpenBSD Mail Server  (http://frozen-geek.net/openbsd-email-server-1/) 
A new magic getopt library (http://www.daemonology.net/blog/2015-12-06-magic-getopt.html)
PXE boot OpenBSD from OpenWRT (http://uggedal.com/journal/pxe-boot-openbsd-from-openwrt/) 
Supporting the OpenBSD project (http://permalink.gmane.org/gmane.os.openbsd.misc/227054)
Feedback/Questions
 Zachary - FreeBSD Jails (http://slexy.org/view/s20pbRLRRz) 
 Robert - Iocage help! (http://slexy.org/view/s2jGy34fy2) 
 Kjell - Server Management (http://slexy.org/view/s20Ht8JfpL) 
 Brian - NAS Setup (http://slexy.org/view/s2GYtvd7hU) 
 Mike - Radius Followup (http://slexy.org/view/s21EVs6aUg) 
 Laszlo - Best Stocking Ever (http://slexy.org/view/s205zZiJCv) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow - It’s getting close to christmas and the</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151208172029" rel="nofollow">n2k15 hackathon reports</a></h3>

<ul>
<li>tedu@ worked on rebound, malloc hardening, removing legacy code</li>
<li>“I don&#39;t usually get too involved with the network stack, but sometimes you find yourself at a network hackathon and have to go with the flow. With many developers working in the same area, it can be hard to find an appropriate project, but fortunately there are a few dusty corners in networking land that can be swept up without too much disturbance to others.”</li>
<li>“IPv6 is the future of networking. IPv6 has also been the future of networking for 20 years. As a result, a number of features have been proposed, implemented, then obsoleted, but the corresponding code never quite gets deleted. The IPsec stack has followed a somewhat similar trajectory”</li>
<li>“I read through various networking headers in search of features that would normally be exposed to userland, but were instead guarded by ifdef _KERNEL. This identified a number of options for setsockopt() that had been officially retired from the API, but the kernel code retained to provide ABI compatibility during a transition period. That transition occurred more than a decade ago. Binary programs from that era no longer run for many other reasons, and so we can delete support. It&#39;s only a small improvement, but it gradually reduces the amount of code that needs to be reviewed when making larger more important changes”</li>
<li>Ifconfig txpower got similar treatment, as no modern WiFi driver supports it</li>
<li>Support for Ethernet Trailers, <a href="https://tools.ietf.org/html/rfc893" rel="nofollow">RFC 893</a>, enabled zero copy networking on a VAX with 512 byte hardware pages, the feature was removed even before OpenBSD was founded, but the ifconfig option was still in place</li>
<li>Alexandr Nedvedicky (sashan@) worked on <a href="http://undeadly.org/cgi?action=article&sid=20151207143819" rel="nofollow">MP-Safe PF</a> </li>
<li>“I&#39;d like to thank Reyk for hackroom and showing us a Christmas market. It was also my pleasure to meet Mr. Henning in person. Speaking of Henning, let&#39;s switch to PF hacking.”</li>
<li>“mpi@ came with patch (sent to priv. list only currently), which adds a new lock for PF. It&#39;s called PF big lock. The big PF lock essentially establishes a safe playground for PF hackers. The lock currently covers all pf_test() function. The pf_test() function parts will be gradually unlocked as the work will progress.</li>
<li>To make PF big lock safe few more details must be sorted out. The first of them is to avoid recursive calls to pf_test(). The pf_test() could get entered recursively, when packet hits block rule with return-* action. This is no longer the case as ip*_send() functions got introduced (committed change has been discussed privately). Packets sent on behalf of kernel are dispatched using softnet task queue now. We still have to sort out pf_route*() functions. The other thing we need to sort out with respect to PF big lock is reference counting for statekey, which gets attached to mbuf. Patch has been sent to hackers, waiting for OK too. The plan is to commit reference counting sometimes next year after CVS will be unlocked. There is one more patch at tech@ waiting for OK. It brings OpenBSD and Solaris PF closer to each other by one tiny little step.”
***</li>
</ul>

<h3><a href="http://queue.acm.org/detail.cfm?id=2852078" rel="nofollow">ACM Queue: Challenges of Memory Management on Modern NUMA System</a></h3>

<ul>
<li>“Modern server-class systems are typically built as several multicore chips put together in a single system. Each chip has a local DRAM (dynamic random-access memory) module; together they are referred to as a node. Nodes are connected via a high-speed interconnect, and the system is fully coherent. This means that, transparently to the programmer, a core can issue requests to its node&#39;s local memory as well as to the memories of other nodes. The key distinction is that remote requests will take longer, because they are subject to longer wire delays and may have to jump several hops as they traverse the interconnect. The latency of memory-access times is hence non-uniform, because it depends on where the request originates and where it is destined to go. Such systems are referred to as NUMA (non-uniform memory access).”</li>
<li>So, depending what core a program is running on, it will have different throughput and latency to specific banks of memory. Therefore, it is usually optimal to try to allocate memory from the bank of ram connected to the CPU that the program is running on, and to keep that program running on that same CPU, rather than moving it around</li>
<li>There are a number of different NUMA strategies, including:</li>
<li><strong>Fixed</strong>, memory is always allocated from a specific bank of memory</li>
<li><strong>First Touch</strong>, which means that memory is allocated from the bank connected to the CPU that the application is running on when it requests the memory, which can increase performance if the application remains on that same CPU, and the load is balanced optimally</li>
<li><strong>Round Robin</strong> or <strong>Interleave</strong>, where memory is allocated evenly, each allocation coming from the next bank of memory so that all banks are used. This method can provide more uniform performance, because it ensures that all memory accesses have the same change to be local vs remote. If even performance is required, this method can be better than something more focused on locality, but that might fail and result in remote access</li>
<li><strong>AutoNUMA</strong>, A kernel task routinely iterates through the allocated memory of each process and tallies the number of memory pages on each node for that process. It also clears the present bit on the pages, which will force the CPU to stop and enter the page-fault handler when the page is next accessed. In the page-fault handler it records which node and thread is trying to access the page before setting the present bit and allowing execution to continue. Pages that are accessed from remote nodes are put into a queue to be migrated to that node. After a page has already been migrated once, though, future migrations require two recorded accesses from a remote node, which is designed to prevent excessive migrations (known as page bouncing).</li>
<li>The paper also introduces a new strategy:</li>
<li><strong>Carrefour</strong> is a memory-placement algorithm for NUMA systems that focuses on traffic management: placing memory so as to minimize congestion on interconnect links or memory controllers. Trying to strike a balance between locality, and ensuring that the interconnect between a specific pair of CPUs does not become congested, which can make remote accesses even slower</li>
<li>Carrefour uses three primary techniques:</li>
<li><strong>Memory collocation</strong>, Moving memory to a different node so that accesses will likely be local.</li>
<li><strong>Replication</strong>, Copying memory to several nodes so that threads from each node can access it locally (useful for read-only and read-mostly data).</li>
<li><strong>Interleaving</strong>, Moving memory such that it is distributed evenly among all nodes.</li>
<li>FreeBSD is slowly gaining NUMA capabilities, and currently supports: fixed, round-robin, first-touch. Additionally, it also supports fixed-rr, and first-touch-rr, where if the memory allocation fails, because the fixed domain or first-touch domain is full, it falls back to round-robin.</li>
<li>For more information, see numa(4) and numa_setaffinity(2) on 11-CURRENT
***</li>
</ul>

<h3><a href="http://fossforce.com/2015/12/linux-no-pc-bsd/" rel="nofollow">Is that Linux? No it is PC-BSD</a></h3>

<ul>
<li>Larry Cafiero continues to make some news about his switch to PC-BSD from Linux. This time in an blog post titled “Is that Linux? No, its PC-BSD” he describes an experience out and about where he was asked what is running on his laptop, and was unable for the first time in 9 years to answer, it’s Linux. </li>
<li>The blog then goes on to mention his experience up to now running PC-BSD, how the learning curve was fairly easy coming from a Linux background. </li>
<li>He mentions that he has noticed an uptick in performance on the system, no specific benchmarks but this “Linux was fast enough on this machine. But in street racing parlance, with PC-BSD I’m burning rubber in all four gears.”</li>
<li>The only major nits he mentions is having trouble getting a font to switch in FireFox, and not knowing how to enable GRUB quiet mode. (I’ll have to add a knob back for that)
***</li>
</ul>

<h3><a href="https://gist.github.com/jcs/5573685" rel="nofollow">Dual booting OS X and OpenBSD with full disk encryption</a></h3>

<ul>
<li>New GPT and UEFI support allow OpenBSD to co-exist with Mac OS X without the need for Boot Camp Assistant or Hybrid MBRs</li>
<li>This tutorial walks the read through the steps of installing OpenBSD side-by-side with Mac OS X</li>
<li>First the HFS+ partition is shrunk to make room for a new OpenBSD partition</li>
<li>Then the OpenBSD installer is run, and the available free space is setup as an encrypted softraid </li>
<li>The OpenBSD installer will add itself to the EFI partition</li>
<li>Rename the boot loader installed by OpenBSD and replace it with rEFInd, so you will get a boot menu allowing you to select between OpenBSD and OS X
***</li>
</ul>

<h2>Interview - Paul Goyette - <a href="mailto:pgoyette@netbsd.org" rel="nofollow">pgoyette@netbsd.org</a></h2>

<ul>
<li>NetBSD Testing and Modularity
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="http://www.virtual-strategy.com/2015/12/08/ixsystems-wins-press-and-industry-analyst-accolades-best-biz-awards-2015" rel="nofollow">iXsystems Wins Press and Industry Analyst Accolades in Best in Biz Awards 2015</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.geeklan.co.uk/?p=2019" rel="nofollow">HOWTO: L2TP/IPSec with OpenBSD</a></h3>

<ul>
<li>*BSD contributor Sevan Janiyan provides an update on setting up a road-warrior VPN</li>
<li>This first article walks through setting up the OpenBSD server side, and followup articles will cover configuring various client systems to connect to it</li>
<li>The previous tutorial on this configuration is from 2012, and things have improved greatly since then, and is much easier to set up now</li>
<li>The tutorial includes PF rules, npppd configuration, and how to enable isakmpd and ipsec</li>
<li>L2TP/IPSec is chosen because most operating systems, including Windows, OS X, iOS, and Android, include a native L2TP client, rather than requiring some additional software to be installed
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/release44/" rel="nofollow">DragonFly 4.4 Released</a></h3>

<ul>
<li>DragonFly BSD has made its 4.4 release official this week!</li>
<li>A lot of big changes, but some of the highlights

<ul>
<li>Radeon / i915 DRM support for up to Linux Kernel 3.18</li>
<li>Proper collation support for named locales, shared back to FreeBSD 11-CURRENT</li>
<li>Regex Support using TRE “As a consequence of the locale upgrades, the original regex library had to be forced into POSIX (single-byte) mode always. The support for multi-byte characters just wasn&#39;t there. ” …. “TRE is faster, more capable, and supports multibyte characters, so it&#39;s a nice addition to this release.”</li>
<li>Other noteworthy, iwm(4) driver, CPU power-saving improvements, import ipfw from FreeBSD (named ipfw3)</li>
</ul></li>
<li>An interesting tidbit is <a href="http://bsd.slashdot.org/story/15/12/04/2351241/dragonflybsd-44-switches-to-the-gold-linker-by-default" rel="nofollow">switching to the Gold linker</a> 
***</li>
</ul>

<h3><a href="http://linoxide.com/linux-how-to/install-ajenti-nginx-ssl-freebsd-10-2/" rel="nofollow">Guide to install Ajenti on Nginx with SSL on FreeBSD 10.2</a></h3>

<ul>
<li>Looking for a webmin-like interface to control your FreeBSD box? Enter Ajenti, and today we have a walkthrough posted on how to get it setup on a FreeBSD 10.2 system.</li>
<li>The walkthrough is mostly straightforward, you’ll need a FreeBSD box with root, and will need to install several packages / ports initially. </li>
<li>Because there is no native package (yet), it guides you through using python’s PIP installer to fetch and get Ajenti running. </li>
<li>The author links to some pre-built rc.d scripts and other helpful config files on GitHub, which will further assist in the process of making it run on FreeBSD.</li>
<li>Ajenti by itself may not be the best to serve publically, so it also provides instructions on how to protect the connection by serving it through nginx / SSL, a must-have if you plan on using this over unsecure networks. 
***</li>
</ul>

<h3><a href="http://www.bsdcan.org/2016/papers.php" rel="nofollow">BSDCan 2016 CFP is up!</a></h3>

<ul>
<li>BSDCan is the biggest North American BSD conference, and my personal favourite</li>
<li>The call for papers is now out, and I would like to see more first-time submitters this year</li>
<li>If you do anything interesting with or on a BSD, please write a proposal</li>
<li>Are the machines you run BSD on bigger or smaller than what most people have? Tell us about it</li>
<li>Are you running a big farm that does something interesting?</li>
<li>Is your university research using BSD?</li>
<li>Do you have an idea for a great new subsystem or utility?</li>
<li>Have you suffered through some horrible ordeal? Make sure the rest of us know the best way out when it happens to us.</li>
<li>Did you build a radar that runs NetBSD? A telescope controlled by FreeBSD?</li>
<li>Have you run an ISP at the north pole using Jails?</li>
<li>Do you run a usergroup and have tips to share?</li>
<li>Have you combined the features and tools of a BSD in a new and interesting way?</li>
<li>Don’t have a talk to give? Teach a tutorial!</li>
<li>The conference will arrange your air travel and hotel, and you’ll get to spend a few great days with the best community on earth</li>
<li><a href="http://blather.michaelwlucas.com/archives/2325" rel="nofollow">Michael W. Lucas’s post about the 2015 proposals and rejections </a>
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><a href="http://www.freshports.org/www/obhttpd/" rel="nofollow">OpenBSD&#39;s lightweight web server now in FreeBSD&#39;s ports tree</a> </li>
<li><a href="https://www.youtube.com/watch?v=FI_bZhV7wpI" rel="nofollow">Stephen Bourne&#39;s NYCBUG talk is online</a></li>
<li><a href="http://freebsdwiki.net/index.php/Main_Page" rel="nofollow">Looking for owner to FreeBSDWiki</a> </li>
<li><a href="http://frozen-geek.net/openbsd-email-server-1/" rel="nofollow">HOWTO: OpenBSD Mail Server </a> </li>
<li><a href="http://www.daemonology.net/blog/2015-12-06-magic-getopt.html" rel="nofollow">A new magic getopt library</a></li>
<li><a href="http://uggedal.com/journal/pxe-boot-openbsd-from-openwrt/" rel="nofollow">PXE boot OpenBSD from OpenWRT</a> </li>
<li><a href="http://permalink.gmane.org/gmane.os.openbsd.misc/227054" rel="nofollow">Supporting the OpenBSD project</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20pbRLRRz" rel="nofollow"> Zachary - FreeBSD Jails</a> </li>
<li><a href="http://slexy.org/view/s2jGy34fy2" rel="nofollow"> Robert - Iocage help!</a> </li>
<li><a href="http://slexy.org/view/s20Ht8JfpL" rel="nofollow"> Kjell - Server Management</a> </li>
<li><a href="http://slexy.org/view/s2GYtvd7hU" rel="nofollow"> Brian - NAS Setup</a> </li>
<li><a href="http://slexy.org/view/s21EVs6aUg" rel="nofollow"> Mike - Radius Followup</a> </li>
<li><a href="http://slexy.org/view/s205zZiJCv" rel="nofollow"> Laszlo - Best Stocking Ever</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow - It’s getting close to christmas and the</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151208172029" rel="nofollow">n2k15 hackathon reports</a></h3>

<ul>
<li>tedu@ worked on rebound, malloc hardening, removing legacy code</li>
<li>“I don&#39;t usually get too involved with the network stack, but sometimes you find yourself at a network hackathon and have to go with the flow. With many developers working in the same area, it can be hard to find an appropriate project, but fortunately there are a few dusty corners in networking land that can be swept up without too much disturbance to others.”</li>
<li>“IPv6 is the future of networking. IPv6 has also been the future of networking for 20 years. As a result, a number of features have been proposed, implemented, then obsoleted, but the corresponding code never quite gets deleted. The IPsec stack has followed a somewhat similar trajectory”</li>
<li>“I read through various networking headers in search of features that would normally be exposed to userland, but were instead guarded by ifdef _KERNEL. This identified a number of options for setsockopt() that had been officially retired from the API, but the kernel code retained to provide ABI compatibility during a transition period. That transition occurred more than a decade ago. Binary programs from that era no longer run for many other reasons, and so we can delete support. It&#39;s only a small improvement, but it gradually reduces the amount of code that needs to be reviewed when making larger more important changes”</li>
<li>Ifconfig txpower got similar treatment, as no modern WiFi driver supports it</li>
<li>Support for Ethernet Trailers, <a href="https://tools.ietf.org/html/rfc893" rel="nofollow">RFC 893</a>, enabled zero copy networking on a VAX with 512 byte hardware pages, the feature was removed even before OpenBSD was founded, but the ifconfig option was still in place</li>
<li>Alexandr Nedvedicky (sashan@) worked on <a href="http://undeadly.org/cgi?action=article&sid=20151207143819" rel="nofollow">MP-Safe PF</a> </li>
<li>“I&#39;d like to thank Reyk for hackroom and showing us a Christmas market. It was also my pleasure to meet Mr. Henning in person. Speaking of Henning, let&#39;s switch to PF hacking.”</li>
<li>“mpi@ came with patch (sent to priv. list only currently), which adds a new lock for PF. It&#39;s called PF big lock. The big PF lock essentially establishes a safe playground for PF hackers. The lock currently covers all pf_test() function. The pf_test() function parts will be gradually unlocked as the work will progress.</li>
<li>To make PF big lock safe few more details must be sorted out. The first of them is to avoid recursive calls to pf_test(). The pf_test() could get entered recursively, when packet hits block rule with return-* action. This is no longer the case as ip*_send() functions got introduced (committed change has been discussed privately). Packets sent on behalf of kernel are dispatched using softnet task queue now. We still have to sort out pf_route*() functions. The other thing we need to sort out with respect to PF big lock is reference counting for statekey, which gets attached to mbuf. Patch has been sent to hackers, waiting for OK too. The plan is to commit reference counting sometimes next year after CVS will be unlocked. There is one more patch at tech@ waiting for OK. It brings OpenBSD and Solaris PF closer to each other by one tiny little step.”
***</li>
</ul>

<h3><a href="http://queue.acm.org/detail.cfm?id=2852078" rel="nofollow">ACM Queue: Challenges of Memory Management on Modern NUMA System</a></h3>

<ul>
<li>“Modern server-class systems are typically built as several multicore chips put together in a single system. Each chip has a local DRAM (dynamic random-access memory) module; together they are referred to as a node. Nodes are connected via a high-speed interconnect, and the system is fully coherent. This means that, transparently to the programmer, a core can issue requests to its node&#39;s local memory as well as to the memories of other nodes. The key distinction is that remote requests will take longer, because they are subject to longer wire delays and may have to jump several hops as they traverse the interconnect. The latency of memory-access times is hence non-uniform, because it depends on where the request originates and where it is destined to go. Such systems are referred to as NUMA (non-uniform memory access).”</li>
<li>So, depending what core a program is running on, it will have different throughput and latency to specific banks of memory. Therefore, it is usually optimal to try to allocate memory from the bank of ram connected to the CPU that the program is running on, and to keep that program running on that same CPU, rather than moving it around</li>
<li>There are a number of different NUMA strategies, including:</li>
<li><strong>Fixed</strong>, memory is always allocated from a specific bank of memory</li>
<li><strong>First Touch</strong>, which means that memory is allocated from the bank connected to the CPU that the application is running on when it requests the memory, which can increase performance if the application remains on that same CPU, and the load is balanced optimally</li>
<li><strong>Round Robin</strong> or <strong>Interleave</strong>, where memory is allocated evenly, each allocation coming from the next bank of memory so that all banks are used. This method can provide more uniform performance, because it ensures that all memory accesses have the same change to be local vs remote. If even performance is required, this method can be better than something more focused on locality, but that might fail and result in remote access</li>
<li><strong>AutoNUMA</strong>, A kernel task routinely iterates through the allocated memory of each process and tallies the number of memory pages on each node for that process. It also clears the present bit on the pages, which will force the CPU to stop and enter the page-fault handler when the page is next accessed. In the page-fault handler it records which node and thread is trying to access the page before setting the present bit and allowing execution to continue. Pages that are accessed from remote nodes are put into a queue to be migrated to that node. After a page has already been migrated once, though, future migrations require two recorded accesses from a remote node, which is designed to prevent excessive migrations (known as page bouncing).</li>
<li>The paper also introduces a new strategy:</li>
<li><strong>Carrefour</strong> is a memory-placement algorithm for NUMA systems that focuses on traffic management: placing memory so as to minimize congestion on interconnect links or memory controllers. Trying to strike a balance between locality, and ensuring that the interconnect between a specific pair of CPUs does not become congested, which can make remote accesses even slower</li>
<li>Carrefour uses three primary techniques:</li>
<li><strong>Memory collocation</strong>, Moving memory to a different node so that accesses will likely be local.</li>
<li><strong>Replication</strong>, Copying memory to several nodes so that threads from each node can access it locally (useful for read-only and read-mostly data).</li>
<li><strong>Interleaving</strong>, Moving memory such that it is distributed evenly among all nodes.</li>
<li>FreeBSD is slowly gaining NUMA capabilities, and currently supports: fixed, round-robin, first-touch. Additionally, it also supports fixed-rr, and first-touch-rr, where if the memory allocation fails, because the fixed domain or first-touch domain is full, it falls back to round-robin.</li>
<li>For more information, see numa(4) and numa_setaffinity(2) on 11-CURRENT
***</li>
</ul>

<h3><a href="http://fossforce.com/2015/12/linux-no-pc-bsd/" rel="nofollow">Is that Linux? No it is PC-BSD</a></h3>

<ul>
<li>Larry Cafiero continues to make some news about his switch to PC-BSD from Linux. This time in an blog post titled “Is that Linux? No, its PC-BSD” he describes an experience out and about where he was asked what is running on his laptop, and was unable for the first time in 9 years to answer, it’s Linux. </li>
<li>The blog then goes on to mention his experience up to now running PC-BSD, how the learning curve was fairly easy coming from a Linux background. </li>
<li>He mentions that he has noticed an uptick in performance on the system, no specific benchmarks but this “Linux was fast enough on this machine. But in street racing parlance, with PC-BSD I’m burning rubber in all four gears.”</li>
<li>The only major nits he mentions is having trouble getting a font to switch in FireFox, and not knowing how to enable GRUB quiet mode. (I’ll have to add a knob back for that)
***</li>
</ul>

<h3><a href="https://gist.github.com/jcs/5573685" rel="nofollow">Dual booting OS X and OpenBSD with full disk encryption</a></h3>

<ul>
<li>New GPT and UEFI support allow OpenBSD to co-exist with Mac OS X without the need for Boot Camp Assistant or Hybrid MBRs</li>
<li>This tutorial walks the read through the steps of installing OpenBSD side-by-side with Mac OS X</li>
<li>First the HFS+ partition is shrunk to make room for a new OpenBSD partition</li>
<li>Then the OpenBSD installer is run, and the available free space is setup as an encrypted softraid </li>
<li>The OpenBSD installer will add itself to the EFI partition</li>
<li>Rename the boot loader installed by OpenBSD and replace it with rEFInd, so you will get a boot menu allowing you to select between OpenBSD and OS X
***</li>
</ul>

<h2>Interview - Paul Goyette - <a href="mailto:pgoyette@netbsd.org" rel="nofollow">pgoyette@netbsd.org</a></h2>

<ul>
<li>NetBSD Testing and Modularity
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="http://www.virtual-strategy.com/2015/12/08/ixsystems-wins-press-and-industry-analyst-accolades-best-biz-awards-2015" rel="nofollow">iXsystems Wins Press and Industry Analyst Accolades in Best in Biz Awards 2015</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://www.geeklan.co.uk/?p=2019" rel="nofollow">HOWTO: L2TP/IPSec with OpenBSD</a></h3>

<ul>
<li>*BSD contributor Sevan Janiyan provides an update on setting up a road-warrior VPN</li>
<li>This first article walks through setting up the OpenBSD server side, and followup articles will cover configuring various client systems to connect to it</li>
<li>The previous tutorial on this configuration is from 2012, and things have improved greatly since then, and is much easier to set up now</li>
<li>The tutorial includes PF rules, npppd configuration, and how to enable isakmpd and ipsec</li>
<li>L2TP/IPSec is chosen because most operating systems, including Windows, OS X, iOS, and Android, include a native L2TP client, rather than requiring some additional software to be installed
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/release44/" rel="nofollow">DragonFly 4.4 Released</a></h3>

<ul>
<li>DragonFly BSD has made its 4.4 release official this week!</li>
<li>A lot of big changes, but some of the highlights

<ul>
<li>Radeon / i915 DRM support for up to Linux Kernel 3.18</li>
<li>Proper collation support for named locales, shared back to FreeBSD 11-CURRENT</li>
<li>Regex Support using TRE “As a consequence of the locale upgrades, the original regex library had to be forced into POSIX (single-byte) mode always. The support for multi-byte characters just wasn&#39;t there. ” …. “TRE is faster, more capable, and supports multibyte characters, so it&#39;s a nice addition to this release.”</li>
<li>Other noteworthy, iwm(4) driver, CPU power-saving improvements, import ipfw from FreeBSD (named ipfw3)</li>
</ul></li>
<li>An interesting tidbit is <a href="http://bsd.slashdot.org/story/15/12/04/2351241/dragonflybsd-44-switches-to-the-gold-linker-by-default" rel="nofollow">switching to the Gold linker</a> 
***</li>
</ul>

<h3><a href="http://linoxide.com/linux-how-to/install-ajenti-nginx-ssl-freebsd-10-2/" rel="nofollow">Guide to install Ajenti on Nginx with SSL on FreeBSD 10.2</a></h3>

<ul>
<li>Looking for a webmin-like interface to control your FreeBSD box? Enter Ajenti, and today we have a walkthrough posted on how to get it setup on a FreeBSD 10.2 system.</li>
<li>The walkthrough is mostly straightforward, you’ll need a FreeBSD box with root, and will need to install several packages / ports initially. </li>
<li>Because there is no native package (yet), it guides you through using python’s PIP installer to fetch and get Ajenti running. </li>
<li>The author links to some pre-built rc.d scripts and other helpful config files on GitHub, which will further assist in the process of making it run on FreeBSD.</li>
<li>Ajenti by itself may not be the best to serve publically, so it also provides instructions on how to protect the connection by serving it through nginx / SSL, a must-have if you plan on using this over unsecure networks. 
***</li>
</ul>

<h3><a href="http://www.bsdcan.org/2016/papers.php" rel="nofollow">BSDCan 2016 CFP is up!</a></h3>

<ul>
<li>BSDCan is the biggest North American BSD conference, and my personal favourite</li>
<li>The call for papers is now out, and I would like to see more first-time submitters this year</li>
<li>If you do anything interesting with or on a BSD, please write a proposal</li>
<li>Are the machines you run BSD on bigger or smaller than what most people have? Tell us about it</li>
<li>Are you running a big farm that does something interesting?</li>
<li>Is your university research using BSD?</li>
<li>Do you have an idea for a great new subsystem or utility?</li>
<li>Have you suffered through some horrible ordeal? Make sure the rest of us know the best way out when it happens to us.</li>
<li>Did you build a radar that runs NetBSD? A telescope controlled by FreeBSD?</li>
<li>Have you run an ISP at the north pole using Jails?</li>
<li>Do you run a usergroup and have tips to share?</li>
<li>Have you combined the features and tools of a BSD in a new and interesting way?</li>
<li>Don’t have a talk to give? Teach a tutorial!</li>
<li>The conference will arrange your air travel and hotel, and you’ll get to spend a few great days with the best community on earth</li>
<li><a href="http://blather.michaelwlucas.com/archives/2325" rel="nofollow">Michael W. Lucas’s post about the 2015 proposals and rejections </a>
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><a href="http://www.freshports.org/www/obhttpd/" rel="nofollow">OpenBSD&#39;s lightweight web server now in FreeBSD&#39;s ports tree</a> </li>
<li><a href="https://www.youtube.com/watch?v=FI_bZhV7wpI" rel="nofollow">Stephen Bourne&#39;s NYCBUG talk is online</a></li>
<li><a href="http://freebsdwiki.net/index.php/Main_Page" rel="nofollow">Looking for owner to FreeBSDWiki</a> </li>
<li><a href="http://frozen-geek.net/openbsd-email-server-1/" rel="nofollow">HOWTO: OpenBSD Mail Server </a> </li>
<li><a href="http://www.daemonology.net/blog/2015-12-06-magic-getopt.html" rel="nofollow">A new magic getopt library</a></li>
<li><a href="http://uggedal.com/journal/pxe-boot-openbsd-from-openwrt/" rel="nofollow">PXE boot OpenBSD from OpenWRT</a> </li>
<li><a href="http://permalink.gmane.org/gmane.os.openbsd.misc/227054" rel="nofollow">Supporting the OpenBSD project</a></li>
</ul>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20pbRLRRz" rel="nofollow"> Zachary - FreeBSD Jails</a> </li>
<li><a href="http://slexy.org/view/s2jGy34fy2" rel="nofollow"> Robert - Iocage help!</a> </li>
<li><a href="http://slexy.org/view/s20Ht8JfpL" rel="nofollow"> Kjell - Server Management</a> </li>
<li><a href="http://slexy.org/view/s2GYtvd7hU" rel="nofollow"> Brian - NAS Setup</a> </li>
<li><a href="http://slexy.org/view/s21EVs6aUg" rel="nofollow"> Mike - Radius Followup</a> </li>
<li><a href="http://slexy.org/view/s205zZiJCv" rel="nofollow"> Laszlo - Best Stocking Ever</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>118: BSD is go for Launch</title>
  <link>https://www.bsdnow.tv/118</link>
  <guid isPermaLink="false">f6f6236e-2e69-406f-879c-67f05cf5e490</guid>
  <pubDate>Wed, 02 Dec 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f6f6236e-2e69-406f-879c-67f05cf5e490.mp3" length="66828532" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up on BSDNow - We know init systems have been all the rage</itunes:subtitle>
  <itunes:duration>1:32:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up on BSDNow - We know init systems have been all the rage
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
Interview with Renato Westphal (http://undeadly.org/cgi?action=article&amp;amp;sid=20151123113224&amp;amp;mode=expanded)
An interview with Brazilian OpenBSD developer Renato Westphal
He describes how he first got into OpenBSD, working on a University-Industry partnership program and looking to deploy LDP (Label Distribution Protocol) for MPLS.
He ported OpenBSDs ldpd(8) to Linux, but then contributed his bug fixes and improvements back to OpenBSD
When asked if he was motivated to replace closed-source router implementations with OpenBSD: “Well, I don't administer any network, I work full time as a programmer. I have some friends however that succeeded replacing closed vendor solutions with OpenBSD boxes and that for sure motivates me to keep doing what I'm doing. My biggest motivation, however, is the challenge of resolving complex problems writing trivially simple code that is both secure and efficient.”
They also go on to discuss some of the interesting features of EIGRP, and developing eigrpd(8)
What do you think is missing from routing in OpenBSD: “Implementing new features and protocols while they are in their draft stage in IETF. I'd like to see OpenBSD as the reference platform for the development of new routing and networking technologies in general”
***
Let’s Encrypt on a FreeBSD NGINX reverse proxy (http://savagedlight.me/2015/11/24/lets-encrypt-on-a-freebsd-nginx-reverse-proxy/)
We have a neat guide/story today on how to setup the “Let’s Encrypt” certificates on a FreeBSD / nginx reverse proxy
Backstory: For those who don’t know, “Let’s Encrypt” (https://letsencrypt.org) is a new Certificate Authority, which will allow you to create free and automated certificates.
They have been in closed beta for several months now, and will be opening to a public beta Dec 3rd (tomorrow)
This guide is particularly timely, since by the time most of you are watching this episode, the public beta will be up and running.
Most of the instructions are fairly straight-forward. She starts by installing the lets-encrypt package from ports/pkg and modifying her nginx with a ‘catch-all’ vhost that re-directs traffic to the https versions of a site.
With that done, the certificate creation is just a few commands to get started, in which she shows creating a cert for multiple domains
As a bonus! She includes a nice renewal script which can be run from cron. It will monitor the certs daily, and renew it when it’s 14 days from expiring, or throw an error for somebody to look at.
***
Mike Larkins OpenBSD vmm subsystem now in tree (http://marc.info/?l=openbsd-tech&amp;amp;m=144822644214614&amp;amp;w=2)
An openBSD native hypervisor has taken another step closer to reality, with Mike Larkin pushing the initial bits of “vmm” into the base kernel/world
He mentions in the commit message that it still needs a lot of work, and as such is disabled by default. 
However for the adventurous among you, it can be turned on and tested
Right now there is no BIOS, and as such it can only be used to boot other OpenBSD instances, although he mentions other BSD’s could be supported fairly quickly (He did a 1 hour port to bootstrap NetBSD)
No big documentation expected for this release, since there is so much ongoing churn. Take a look at the man page for details on getting started. 
***
The story of how Yahoo switched to FreeBSD (http://zer0.org/daemons/yahoobsd.html)
Yahoo originally started running on SunOS, but quickly found it not able to cope with the high frequency of HTTP requests
“Having spend many frustrating hours trying to install other PC OS's, I was a bit skeptical. I had no intention of spending three days trying to install yet another one. To my surprise I went to the FreeBSD Web site, downloaded the floppy boot image, booted a PC with the created floppy, answered a few install questions, and a few minutes later FreeBSD was installing over the Net. The real surprise was when I came back later to a fully configured system that actually worked.”
“If anything had gone wrong with that install it would likely been the end of that trial. Luckily for us that it was the easiest and most painless OS installs I had ever experienced.”
Just that easily, Yahoo might never have ended up on FreeBSD
“A couple of days later we added a FreeBSD box to our cluster of Web servers. Not only did it out-perform the rest of our machines, but it was more stable.”
From my understanding of stories told over dinner, Yahoo had a few very important perl scripts, and they tended to crash on Linux, but kept running without issue on FreeBSD
Related hackernews thread (https://news.ycombinator.com/item?id=10558288) 
***
iXsystems
iXsystem's recap of LISA 2015 (https://www.ixsystems.com/whats-new/lisa-2015/) 
***
Interview - Mark Heily - mark@heily.com (mailto:mark@heily.com) / @MarkHeily (https://twitter.com/MarkHeily)
relaunchd (https://github.com/mheily/relaunchd)
***
News Roundup
Inline Intrusion Prevision System is an upcoming OPNSense Feature (https://opnsense.org/inline-intrusion-prevention/)
The next OPNSense release, 16.1 is around the corner and today we have a sneak peek at their new Inline Intrusion Prevention system
Suricata working with Netmap 2.1 enabled version, which allows Deep Packet Inspection of traffic. Such as looking at each packet individually and only blocking specific ones. They use the example of blocking Warcraft (oh noes!)
Enabling this feature is just a simple mouse-click away, and various default rules are included as part of the Emerging Threats Community rules. 
***
Matthew Dillion working on Hardlinks in Hammer2 (http://lists.dragonflybsd.org/pipermail/commits/2015-November/458763.html)
We have an interesting commit from Matthew Dillon for Hammer2, specifically targeted at hard-links
The backstory he gives us: “The H2 design has had a long-standing problem of losing track of hardlinks when intermediate directories are renamed, breaking the  common-parent-directory design for the inode target.”
The implemented fix was one which instead places the hardlink target in the first common parent directory, which is marked with “xlink” via chflag
If no parent directory is marked “xlink”, it will fall-through instead to the root of the mount
They also modified their installworld to set “/” /usr/,/var/,/home/ as “xlink” flagged
This prevents moving hard-links across these directories, but is similar to dealing with multiple partitions / datasets already.
***
Japan's NetBSD User Group showed off some NetBSD machines at the 2015 Tokushima Open Source Conference (http://lists.nycbug.org/pipermail/talk/2015-November/016403.html)
It’s been a little while since we’ve shown off a bunch of odd devices running NetBSD, but we have an update from the 2015 Tokushima Open Source Conference.
This time around, we have pictures of the booth, as well as a variety of oddities such as:
ODroid-C1 / Sharp X68030
Sharp NetWalker
Sharp WZero3 (Cell phone)
Give them a look, this time around they have nice cards pictured which details the hardware being used (in english none the less!)
***
One of the three OpenBSD users Blog Post by Adam Wolk (http://blog.tintagel.pl/2015/11/22/one-of-the-three-openbsd-users.html)
An OpenBSD user comments on a recent interaction with the syncthing project (a dropbox like alternative)
The application has an auto-update feature (which doesn’t mix well with package systems in the first place), but it doesn’t work on OpenBSD because there is no /proc/curproc/file to determine the filename of the executable. This is a trivially easy task, but when the bug was reported, syncthings response was “Maybe one of the three (https://data.syncthing.net/#metrics) OpenBSD users feel strongly enough about this to propose a patch. :D”
Part of the issue is that many users (especially the type that would run OpenBSD) opt out of reporting metrics, so OpenBSD is under-represented in the metrics the project developers are basing their decisions on
Maybe someone can post a patch to solve the problem. While FreeBSD can provide a linux procfs, it would be better to use a more portable way to get the location of the process binary
***
BeastieBits
DragonFly BSD 4.4 RC branch created (http://lists.dragonflybsd.org/pipermail/commits/2015-November/458818.html) 
HOWTO: NFS booting bhyve (http://oshogbo.vexillium.org/blog/39/) 
DragonFly BSD is looking for a 4.4 RC image by the end of November (http://lists.dragonflybsd.org/pipermail/kernel/2015-November/175040.html)
Support for Atheros QCA953x "Honeybee" has been added to FreeBSD (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=290910) 
Top updated in DragonflyBSD to allow the 'c' command (http://lists.dragonflybsd.org/pipermail/commits/2015-November/458692.html) 
FreeBSD textbook makes appearance on the 6pm news in the Netherlands 12:49 (http://www.npo.nl/nos-journaal/30-11-2015/POW_00941854) 
SemiBug gives a recap of its Inaugural meeting and its plans for future meetups (http://blather.michaelwlucas.com/archives/2495) 
***
Feedback/Questions
 Adam - GELI on USB (http://slexy.org/view/s204HRCPdR) 
 Noble - Radius on FreeBSD (http://slexy.org/view/s21q2WWisr) 
 Jim - Backporting Wifi Code (http://slexy.org/view/s21L59OGyF) 
 Mohammad - Zombies! (http://slexy.org/view/s20nWwzTGS) 
 Miguel - ScaleEngine BTS (http://slexy.org/view/s201Kpd4GX) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up on BSDNow - We know init systems have been all the rage</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151123113224&mode=expanded" rel="nofollow">Interview with Renato Westphal</a></h3>

<ul>
<li>An interview with Brazilian OpenBSD developer Renato Westphal</li>
<li>He describes how he first got into OpenBSD, working on a University-Industry partnership program and looking to deploy LDP (Label Distribution Protocol) for MPLS.</li>
<li>He ported OpenBSDs ldpd(8) to Linux, but then contributed his bug fixes and improvements back to OpenBSD</li>
<li>When asked if he was motivated to replace closed-source router implementations with OpenBSD: “Well, I don&#39;t administer any network, I work full time as a programmer. I have some friends however that succeeded replacing closed vendor solutions with OpenBSD boxes and that for sure motivates me to keep doing what I&#39;m doing. My biggest motivation, however, is the challenge of resolving complex problems writing trivially simple code that is both secure and efficient.”</li>
<li>They also go on to discuss some of the interesting features of EIGRP, and developing eigrpd(8)</li>
<li>What do you think is missing from routing in OpenBSD: “Implementing new features and protocols while they are in their draft stage in IETF. I&#39;d like to see OpenBSD as the reference platform for the development of new routing and networking technologies in general”
***</li>
</ul>

<h3><a href="http://savagedlight.me/2015/11/24/lets-encrypt-on-a-freebsd-nginx-reverse-proxy/" rel="nofollow">Let’s Encrypt on a FreeBSD NGINX reverse proxy</a></h3>

<ul>
<li>We have a neat guide/story today on how to setup the “Let’s Encrypt” certificates on a FreeBSD / nginx reverse proxy</li>
<li>Backstory: For those who don’t know, “Let’s Encrypt” (<a href="https://letsencrypt.org" rel="nofollow">https://letsencrypt.org</a>) is a new Certificate Authority, which will allow you to create free and automated certificates.</li>
<li>They have been in closed beta for several months now, and will be opening to a public beta Dec 3rd (tomorrow)</li>
<li>This guide is particularly timely, since by the time most of you are watching this episode, the public beta will be up and running.</li>
<li>Most of the instructions are fairly straight-forward. She starts by installing the lets-encrypt package from ports/pkg and modifying her nginx with a ‘catch-all’ vhost that re-directs traffic to the https versions of a site.</li>
<li>With that done, the certificate creation is just a few commands to get started, in which she shows creating a cert for multiple domains</li>
<li>As a bonus! She includes a nice renewal script which can be run from cron. It will monitor the certs daily, and renew it when it’s 14 days from expiring, or throw an error for somebody to look at.
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-tech&m=144822644214614&w=2" rel="nofollow">Mike Larkins OpenBSD vmm subsystem now in tree</a></h3>

<ul>
<li>An openBSD native hypervisor has taken another step closer to reality, with Mike Larkin pushing the initial bits of “vmm” into the base kernel/world</li>
<li>He mentions in the commit message that it still needs a lot of work, and as such is disabled by default. </li>
<li>However for the adventurous among you, it can be turned on and tested</li>
<li>Right now there is no BIOS, and as such it can only be used to boot other OpenBSD instances, although he mentions other BSD’s could be supported fairly quickly (He did a 1 hour port to bootstrap NetBSD)</li>
<li>No big documentation expected for this release, since there is so much ongoing churn. Take a look at the man page for details on getting started. 
***</li>
</ul>

<h3><a href="http://zer0.org/daemons/yahoobsd.html" rel="nofollow">The story of how Yahoo switched to FreeBSD</a></h3>

<ul>
<li>Yahoo originally started running on SunOS, but quickly found it not able to cope with the high frequency of HTTP requests</li>
<li>“Having spend many frustrating hours trying to install other PC OS&#39;s, I was a bit skeptical. I had no intention of spending three days trying to install yet another one. To my surprise I went to the FreeBSD Web site, downloaded the floppy boot image, booted a PC with the created floppy, answered a few install questions, and a few minutes later FreeBSD was installing over the Net. The real surprise was when I came back later to a fully configured system that actually worked.”</li>
<li>“If anything had gone wrong with that install it would likely been the end of that trial. Luckily for us that it was the easiest and most painless OS installs I had ever experienced.”</li>
<li>Just that easily, Yahoo might never have ended up on FreeBSD</li>
<li>“A couple of days later we added a FreeBSD box to our cluster of Web servers. Not only did it out-perform the rest of our machines, but it was more stable.”</li>
<li>From my understanding of stories told over dinner, Yahoo had a few very important perl scripts, and they tended to crash on Linux, but kept running without issue on FreeBSD</li>
<li><a href="https://news.ycombinator.com/item?id=10558288" rel="nofollow">Related hackernews thread</a> 
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.ixsystems.com/whats-new/lisa-2015/" rel="nofollow">iXsystem&#39;s recap of LISA 2015</a> 
***</li>
</ul>

<h2>Interview - Mark Heily - <a href="mailto:mark@heily.com" rel="nofollow">mark@heily.com</a> / <a href="https://twitter.com/MarkHeily" rel="nofollow">@MarkHeily</a></h2>

<ul>
<li><a href="https://github.com/mheily/relaunchd" rel="nofollow">relaunchd</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://opnsense.org/inline-intrusion-prevention/" rel="nofollow">Inline Intrusion Prevision System is an upcoming OPNSense Feature</a></h3>

<ul>
<li>The next OPNSense release, 16.1 is around the corner and today we have a sneak peek at their new Inline Intrusion Prevention system</li>
<li>Suricata working with Netmap 2.1 enabled version, which allows Deep Packet Inspection of traffic. Such as looking at each packet individually and only blocking specific ones. They use the example of blocking Warcraft (oh noes!)</li>
<li>Enabling this feature is just a simple mouse-click away, and various default rules are included as part of the Emerging Threats Community rules. 
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-November/458763.html" rel="nofollow">Matthew Dillion working on Hardlinks in Hammer2</a></h3>

<ul>
<li>We have an interesting commit from Matthew Dillon for Hammer2, specifically targeted at hard-links</li>
<li>The backstory he gives us: “The H2 design has had a long-standing problem of losing track of hardlinks when intermediate directories are renamed, breaking the  common-parent-directory design for the inode target.”</li>
<li>The implemented fix was one which instead places the hardlink target in the first common parent directory, which is marked with “xlink” via chflag</li>
<li>If no parent directory is marked “xlink”, it will fall-through instead to the root of the mount</li>
<li>They also modified their installworld to set “/<em>” /usr/</em>,/var/<em>,/home/</em> as “xlink” flagged</li>
<li>This prevents moving hard-links across these directories, but is similar to dealing with multiple partitions / datasets already.
***</li>
</ul>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2015-November/016403.html" rel="nofollow">Japan&#39;s NetBSD User Group showed off some NetBSD machines at the 2015 Tokushima Open Source Conference</a></h3>

<ul>
<li>It’s been a little while since we’ve shown off a bunch of odd devices running NetBSD, but we have an update from the 2015 Tokushima Open Source Conference.</li>
<li>This time around, we have pictures of the booth, as well as a variety of oddities such as:</li>
<li>ODroid-C1 / Sharp X68030</li>
<li>Sharp NetWalker</li>
<li>Sharp WZero3 (Cell phone)</li>
<li>Give them a look, this time around they have nice cards pictured which details the hardware being used (in english none the less!)
***</li>
</ul>

<h3><a href="http://blog.tintagel.pl/2015/11/22/one-of-the-three-openbsd-users.html" rel="nofollow">One of the three OpenBSD users Blog Post by Adam Wolk</a></h3>

<ul>
<li>An OpenBSD user comments on a recent interaction with the syncthing project (a dropbox like alternative)</li>
<li>The application has an auto-update feature (which doesn’t mix well with package systems in the first place), but it doesn’t work on OpenBSD because there is no /proc/curproc/file to determine the filename of the executable. This is a trivially easy task, but when the bug was reported, syncthings response was “Maybe one of the <a href="https://data.syncthing.net/#metrics" rel="nofollow">three</a> OpenBSD users feel strongly enough about this to propose a patch. :D”</li>
<li>Part of the issue is that many users (especially the type that would run OpenBSD) opt out of reporting metrics, so OpenBSD is under-represented in the metrics the project developers are basing their decisions on</li>
<li>Maybe someone can post a patch to solve the problem. While FreeBSD can provide a linux procfs, it would be better to use a more portable way to get the location of the process binary
***</li>
</ul>

<h2>BeastieBits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-November/458818.html" rel="nofollow">DragonFly BSD 4.4 RC branch created</a> </li>
<li><a href="http://oshogbo.vexillium.org/blog/39/" rel="nofollow">HOWTO: NFS booting bhyve</a> </li>
<li><a href="http://lists.dragonflybsd.org/pipermail/kernel/2015-November/175040.html" rel="nofollow">DragonFly BSD is looking for a 4.4 RC image by the end of November</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=290910" rel="nofollow">Support for Atheros QCA953x &quot;Honeybee&quot; has been added to FreeBSD</a> </li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-November/458692.html" rel="nofollow">Top updated in DragonflyBSD to allow the &#39;c&#39; command</a> </li>
<li><a href="http://www.npo.nl/nos-journaal/30-11-2015/POW_00941854" rel="nofollow">FreeBSD textbook makes appearance on the 6pm news in the Netherlands 12:49</a> </li>
<li><a href="http://blather.michaelwlucas.com/archives/2495" rel="nofollow">SemiBug gives a recap of its Inaugural meeting and its plans for future meetups</a> 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s204HRCPdR" rel="nofollow"> Adam - GELI on USB</a> </li>
<li><a href="http://slexy.org/view/s21q2WWisr" rel="nofollow"> Noble - Radius on FreeBSD</a> </li>
<li><a href="http://slexy.org/view/s21L59OGyF" rel="nofollow"> Jim - Backporting Wifi Code</a> </li>
<li><a href="http://slexy.org/view/s20nWwzTGS" rel="nofollow"> Mohammad - Zombies!</a> </li>
<li><a href="http://slexy.org/view/s201Kpd4GX" rel="nofollow"> Miguel - ScaleEngine BTS</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up on BSDNow - We know init systems have been all the rage</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151123113224&mode=expanded" rel="nofollow">Interview with Renato Westphal</a></h3>

<ul>
<li>An interview with Brazilian OpenBSD developer Renato Westphal</li>
<li>He describes how he first got into OpenBSD, working on a University-Industry partnership program and looking to deploy LDP (Label Distribution Protocol) for MPLS.</li>
<li>He ported OpenBSDs ldpd(8) to Linux, but then contributed his bug fixes and improvements back to OpenBSD</li>
<li>When asked if he was motivated to replace closed-source router implementations with OpenBSD: “Well, I don&#39;t administer any network, I work full time as a programmer. I have some friends however that succeeded replacing closed vendor solutions with OpenBSD boxes and that for sure motivates me to keep doing what I&#39;m doing. My biggest motivation, however, is the challenge of resolving complex problems writing trivially simple code that is both secure and efficient.”</li>
<li>They also go on to discuss some of the interesting features of EIGRP, and developing eigrpd(8)</li>
<li>What do you think is missing from routing in OpenBSD: “Implementing new features and protocols while they are in their draft stage in IETF. I&#39;d like to see OpenBSD as the reference platform for the development of new routing and networking technologies in general”
***</li>
</ul>

<h3><a href="http://savagedlight.me/2015/11/24/lets-encrypt-on-a-freebsd-nginx-reverse-proxy/" rel="nofollow">Let’s Encrypt on a FreeBSD NGINX reverse proxy</a></h3>

<ul>
<li>We have a neat guide/story today on how to setup the “Let’s Encrypt” certificates on a FreeBSD / nginx reverse proxy</li>
<li>Backstory: For those who don’t know, “Let’s Encrypt” (<a href="https://letsencrypt.org" rel="nofollow">https://letsencrypt.org</a>) is a new Certificate Authority, which will allow you to create free and automated certificates.</li>
<li>They have been in closed beta for several months now, and will be opening to a public beta Dec 3rd (tomorrow)</li>
<li>This guide is particularly timely, since by the time most of you are watching this episode, the public beta will be up and running.</li>
<li>Most of the instructions are fairly straight-forward. She starts by installing the lets-encrypt package from ports/pkg and modifying her nginx with a ‘catch-all’ vhost that re-directs traffic to the https versions of a site.</li>
<li>With that done, the certificate creation is just a few commands to get started, in which she shows creating a cert for multiple domains</li>
<li>As a bonus! She includes a nice renewal script which can be run from cron. It will monitor the certs daily, and renew it when it’s 14 days from expiring, or throw an error for somebody to look at.
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-tech&m=144822644214614&w=2" rel="nofollow">Mike Larkins OpenBSD vmm subsystem now in tree</a></h3>

<ul>
<li>An openBSD native hypervisor has taken another step closer to reality, with Mike Larkin pushing the initial bits of “vmm” into the base kernel/world</li>
<li>He mentions in the commit message that it still needs a lot of work, and as such is disabled by default. </li>
<li>However for the adventurous among you, it can be turned on and tested</li>
<li>Right now there is no BIOS, and as such it can only be used to boot other OpenBSD instances, although he mentions other BSD’s could be supported fairly quickly (He did a 1 hour port to bootstrap NetBSD)</li>
<li>No big documentation expected for this release, since there is so much ongoing churn. Take a look at the man page for details on getting started. 
***</li>
</ul>

<h3><a href="http://zer0.org/daemons/yahoobsd.html" rel="nofollow">The story of how Yahoo switched to FreeBSD</a></h3>

<ul>
<li>Yahoo originally started running on SunOS, but quickly found it not able to cope with the high frequency of HTTP requests</li>
<li>“Having spend many frustrating hours trying to install other PC OS&#39;s, I was a bit skeptical. I had no intention of spending three days trying to install yet another one. To my surprise I went to the FreeBSD Web site, downloaded the floppy boot image, booted a PC with the created floppy, answered a few install questions, and a few minutes later FreeBSD was installing over the Net. The real surprise was when I came back later to a fully configured system that actually worked.”</li>
<li>“If anything had gone wrong with that install it would likely been the end of that trial. Luckily for us that it was the easiest and most painless OS installs I had ever experienced.”</li>
<li>Just that easily, Yahoo might never have ended up on FreeBSD</li>
<li>“A couple of days later we added a FreeBSD box to our cluster of Web servers. Not only did it out-perform the rest of our machines, but it was more stable.”</li>
<li>From my understanding of stories told over dinner, Yahoo had a few very important perl scripts, and they tended to crash on Linux, but kept running without issue on FreeBSD</li>
<li><a href="https://news.ycombinator.com/item?id=10558288" rel="nofollow">Related hackernews thread</a> 
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.ixsystems.com/whats-new/lisa-2015/" rel="nofollow">iXsystem&#39;s recap of LISA 2015</a> 
***</li>
</ul>

<h2>Interview - Mark Heily - <a href="mailto:mark@heily.com" rel="nofollow">mark@heily.com</a> / <a href="https://twitter.com/MarkHeily" rel="nofollow">@MarkHeily</a></h2>

<ul>
<li><a href="https://github.com/mheily/relaunchd" rel="nofollow">relaunchd</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://opnsense.org/inline-intrusion-prevention/" rel="nofollow">Inline Intrusion Prevision System is an upcoming OPNSense Feature</a></h3>

<ul>
<li>The next OPNSense release, 16.1 is around the corner and today we have a sneak peek at their new Inline Intrusion Prevention system</li>
<li>Suricata working with Netmap 2.1 enabled version, which allows Deep Packet Inspection of traffic. Such as looking at each packet individually and only blocking specific ones. They use the example of blocking Warcraft (oh noes!)</li>
<li>Enabling this feature is just a simple mouse-click away, and various default rules are included as part of the Emerging Threats Community rules. 
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-November/458763.html" rel="nofollow">Matthew Dillion working on Hardlinks in Hammer2</a></h3>

<ul>
<li>We have an interesting commit from Matthew Dillon for Hammer2, specifically targeted at hard-links</li>
<li>The backstory he gives us: “The H2 design has had a long-standing problem of losing track of hardlinks when intermediate directories are renamed, breaking the  common-parent-directory design for the inode target.”</li>
<li>The implemented fix was one which instead places the hardlink target in the first common parent directory, which is marked with “xlink” via chflag</li>
<li>If no parent directory is marked “xlink”, it will fall-through instead to the root of the mount</li>
<li>They also modified their installworld to set “/<em>” /usr/</em>,/var/<em>,/home/</em> as “xlink” flagged</li>
<li>This prevents moving hard-links across these directories, but is similar to dealing with multiple partitions / datasets already.
***</li>
</ul>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2015-November/016403.html" rel="nofollow">Japan&#39;s NetBSD User Group showed off some NetBSD machines at the 2015 Tokushima Open Source Conference</a></h3>

<ul>
<li>It’s been a little while since we’ve shown off a bunch of odd devices running NetBSD, but we have an update from the 2015 Tokushima Open Source Conference.</li>
<li>This time around, we have pictures of the booth, as well as a variety of oddities such as:</li>
<li>ODroid-C1 / Sharp X68030</li>
<li>Sharp NetWalker</li>
<li>Sharp WZero3 (Cell phone)</li>
<li>Give them a look, this time around they have nice cards pictured which details the hardware being used (in english none the less!)
***</li>
</ul>

<h3><a href="http://blog.tintagel.pl/2015/11/22/one-of-the-three-openbsd-users.html" rel="nofollow">One of the three OpenBSD users Blog Post by Adam Wolk</a></h3>

<ul>
<li>An OpenBSD user comments on a recent interaction with the syncthing project (a dropbox like alternative)</li>
<li>The application has an auto-update feature (which doesn’t mix well with package systems in the first place), but it doesn’t work on OpenBSD because there is no /proc/curproc/file to determine the filename of the executable. This is a trivially easy task, but when the bug was reported, syncthings response was “Maybe one of the <a href="https://data.syncthing.net/#metrics" rel="nofollow">three</a> OpenBSD users feel strongly enough about this to propose a patch. :D”</li>
<li>Part of the issue is that many users (especially the type that would run OpenBSD) opt out of reporting metrics, so OpenBSD is under-represented in the metrics the project developers are basing their decisions on</li>
<li>Maybe someone can post a patch to solve the problem. While FreeBSD can provide a linux procfs, it would be better to use a more portable way to get the location of the process binary
***</li>
</ul>

<h2>BeastieBits</h2>

<ul>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-November/458818.html" rel="nofollow">DragonFly BSD 4.4 RC branch created</a> </li>
<li><a href="http://oshogbo.vexillium.org/blog/39/" rel="nofollow">HOWTO: NFS booting bhyve</a> </li>
<li><a href="http://lists.dragonflybsd.org/pipermail/kernel/2015-November/175040.html" rel="nofollow">DragonFly BSD is looking for a 4.4 RC image by the end of November</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=290910" rel="nofollow">Support for Atheros QCA953x &quot;Honeybee&quot; has been added to FreeBSD</a> </li>
<li><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-November/458692.html" rel="nofollow">Top updated in DragonflyBSD to allow the &#39;c&#39; command</a> </li>
<li><a href="http://www.npo.nl/nos-journaal/30-11-2015/POW_00941854" rel="nofollow">FreeBSD textbook makes appearance on the 6pm news in the Netherlands 12:49</a> </li>
<li><a href="http://blather.michaelwlucas.com/archives/2495" rel="nofollow">SemiBug gives a recap of its Inaugural meeting and its plans for future meetups</a> 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s204HRCPdR" rel="nofollow"> Adam - GELI on USB</a> </li>
<li><a href="http://slexy.org/view/s21q2WWisr" rel="nofollow"> Noble - Radius on FreeBSD</a> </li>
<li><a href="http://slexy.org/view/s21L59OGyF" rel="nofollow"> Jim - Backporting Wifi Code</a> </li>
<li><a href="http://slexy.org/view/s20nWwzTGS" rel="nofollow"> Mohammad - Zombies!</a> </li>
<li><a href="http://slexy.org/view/s201Kpd4GX" rel="nofollow"> Miguel - ScaleEngine BTS</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>117: The Cantrill Strikes Back: ...</title>
  <link>https://www.bsdnow.tv/117</link>
  <guid isPermaLink="false">729727f1-dbfe-4631-ab85-62cded2f6ef6</guid>
  <pubDate>Tue, 24 Nov 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/729727f1-dbfe-4631-ab85-62cded2f6ef6.mp3" length="96142900" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle></itunes:subtitle>
  <itunes:duration>2:13:31</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or 
iXsystems hardware, and you could win monthly prizes, and have your story featured 
in the FreeBSD Journal!
***
Headlines
Why did I choose the DragonFlyBSD Operating System by Siju George (http://bsdmag.org/siju_george/)
We have a new article this week by Siju George posted over at BSDMag, talking about his reasons for using DragonFlyBSD in production. 
He ran through periods of using both Free/OpenBSD, but different reasons led him away from each. Specifically problems doing port upgrades on FreeBSD, and the time required to do fsck / raid parity checks on OpenBSD. 
During his research, he had heard about the HAMMER file-system, but didn’t know of anybody running it in production. After some mailing list conversions, and pointers from Matthew Dillon, he took the plunge and switched. 
Now he has fallen in love with the operating system, some of the key strengths he notes at:
Rolling-Release model, which can be upgraded every few weeks or whenever he has the time
No time-consuming fsck after a unclean shutdown
No RAID parity checks while still having redundancy
Able to add volumes to HAMMER on the fly
He also mentions looking forward to HAMMER2, and its potential for easy clustering support, along with eventual CARP implementation so he can run two systems on the same IP. 
***
The Devil &amp;amp; BSD - Larry Cafiero (http://fossforce.com/2015/11/devil-bsd-leaving-linux-behind/)
A story that has been making the rounds on social media is by Larry Cafiero, on his reasons for deciding to switch from Linux over to the BSD side of things.
While most of the reasons are over the conflicts surrounding behavior by Linux leaders towards those in the community, he does mention that he has converted his main workstation over to PC-BSD. 
According to Larry, “With a couple of hours of adding backup files and tweaking (augmented by a variety of “oh, look” moments which could easily make me the ADHD Foundation Poster Boy), it looks exactly like my personally modified Korora 22 Xfce which graced the machine earlier. “
He also gave a great compliment to the quality of the docs / applications in PC-BSD: “In addition, you have to like a operating system which gives you a book — in this case, the PC-BSD Handbook — which should be the gold standard of documentation. It’s enviable, as in, “man, I wish I had written that.” Also programs like AppCafe provide a plethora of FOSS software, so there’s no shortage of programs. Side by side, there’s nothing on the Linux side of things that is lacking on the BSD side of things.”
Regardless the initial reason for the switch, we are glad to have him and any other switchers join us on the BSD side of FOSS.
***
New resource for BSD-schoolin’ (http://teachbsd.org/)
“The initial repository (https://github.com/teachbsd/course) contains all of the material for the practitioner and masters style courses as well as a PDF for the teaching guide.  All of the material is licensed under a BSD doc team license, also visible in the repo and on the github site.”
“we expect all other work, including the extension of the practitioner course to 5 days, and the adaptation of the graduate course to undergraduates will be in the github repo”
“Our goal now is to recruit a small number of universities to partner with us to teach this material.  We will keep you posted on our progress.”
We are working on getting an interview lined up to talk more about this project
If I somehow find the time, I am try to contribute towards a sysadmin course similar to what I used to teach at an Arts&amp;amp;Tech College here in Canada
***
A Few thoughts on OpenBSD 5.8 (http://lippard.blogspot.co.uk/2015/11/a-few-thoughts-on-openbsd-58.html)
A user details their thoughts, reactions, and concerns after upgrading to OpenBSD 5.8
Among the changes: 
sudo was removed and replaced as doas. The user decided to make the switch, but ran into a bug with line continuation (\ to escape newline to continue a long line)
The removal of TCP Wrappers support from ssh - this caused a number of rules in hosts.allow to no longer be respected. 
The FreeBSD port of openssh-portable has a patch to readd TCP wrappers because many people find it useful, including myself, when the ssh is in a jail and cannot run a firewall
The removal of the pfrules= rc.conf variable. “I used to just put the default pf.conf rules file in place with each release and upgrade, and keep my changes in a pf.conf.local file that was specified in the pfrules variable. The effect was that from the period after the upgrade until I noticed the change, my systems were using the default rules and thus more exposed than they were supposed to be”
This is what is often called a “POLA Violation”, Policy of Least Astonishment. When deciding what the system should do after some change or new feature is introduced, it should be the thing that will be the least “surprising” to the user. Having your firewall rules suddenly not apply, is surprising.
“A minor annoying change that was made in 5.8 was putting the file /var/unbound/db/root.key into /etc/changelist, so that the file gets checked daily by the security script. The issue with this is that if you are actually using unbound with DNSSEC, this file changes daily, though only in the comments”
It is very helpful to see a list of feedback like this after a release, so that the next release can be better
I would be interested in seeing similar feedback for the other BSDs
***
Interview - Bryan Cantrill - @bcantrill (https://twitter.com/bcantrill)
Linux Interface Rants
News Roundup
FreeBSD AMI building AMI - Colin’s Corner (http://www.daemonology.net/blog/2015-11-21-FreeBSD-AMI-builder-AMI.html)
Colin Percival (Of TarSnap Fame) has brought us a new article this week on how to create your own custom EC2 AMI builds.
This new tool and instructions allows the creation of AMI files, without needing to go through the hassle of doing a fresh FreeBSD release build each time.
Essentially it works similar to Colin’s previous “de-penguinator” utility, by running a FreeBSD in a memory instance, allowing the disk to be unmounted and prepped for becoming an AMI.
The hope  is that this new work allows easier creation of a new variety of “customized” FreeBSD instances, for end users to download and deploy at will. 
***
Peter Hessler on OpenBSD / OpenBGPd (https://ripe71.ripe.net/archives/video/1200/)
Last week a new video landed of Peter Hessler giving us a status update on OpenBSD tech, and OpenBGPd specifically
Of interest, he notes that LibreSSL is being used in iOS / OSX, and of course PF is used all over, Apple, BSD, Solaris and even a Windows port!
OpenNTPD gets a mention as well, still ZERO CVEs for the lifetime of the project
On the OpenBGPd side, it is considered production ready, so no reason to hold back deployment
Very “feature-complete”, able to handle Edge Router, Route server, Multi-RIB. Slew of optional features like route reflector, looking glass, mrt dumps, mpls / mpls vpn. 
Bugs fixed, crashers, memory constraints and performance has been improved
Filtering Performance, in example provided, importing 561K rules / 60K prefixes, went from 35 minutes down to 30 seconds. 
***
Onion Omega Updates (https://github.com/freebsd/freebsd-wifi-build/wiki/Onion-Omega)
I have a newer kernel config that will be committed soon that hooks up the system LED, and the three LEDs on the expansion dock via /dev/led
I also have the I2C interface working to talk to the Relay and Servo expansions
I have not determined the exact protocol for the Servo expansions, but the relay expansion is fairly simple to operate
Instructions have been added to the wiki
I have managed to use the GPIO to toggle external LEDs and to read the value from a switch
I have also used the Servo PWM controller to dim an LED and control the speed of a PWM computer case fan
My plan is to operate a 32x32 multi colour LED matrix from the device for an interactive christmas display
***
FreeBSD Mastery: ZFS Book review (http://www.cyberciti.biz/datacenter/book-review-freebsd-mastery-zfs/)
Book can be purchased here (http://smile.amazon.com/FreeBSD-Mastery-ZFS-7/dp/0692452354/)
or from the list of vendors including directly from the author here (http://www.zfsbook.com/) 
***
Beastie Bits
Computer History Museum is looking for Bell Labs UNIX (http://www.computerhistory.org/artifactdonation/) 
ACM Queue Portrait: Robert Watson  (https://youtu.be/rA_5Cz99z28) 
Video Collection about BSD History, put together by FreeBSDNews (https://www.freebsdnews.com/2015/11/12/bsd-videos/)
Minix announces its 2016 conference (http://www.minix3.org/conference/2016/) 
Chris Henschen from fP Technologies' talk about BSD is now online (http://bsdtalk.blogspot.com/2015/10/bsdtalk258-chris-henschen-from-fp.html)
Mike Larkin and Theo de Raadt's talks from Hackfest this year in Quebec are online (http://undeadly.org/cgi?action=article&amp;amp;sid=20151123161651&amp;amp;mode=expanded) 
FreeBSD on a BeagleBoneBlack with a Touchscreen Display (http://kernelnomicon.org/?p=534)
Dan Langille will be talking at CINLUG (http://www.cinlug.org/meetings/2015/December)
Feedback/Questions
John - Rpi2 and BSD (http://slexy.org/view/s2Gm06eC0Y) 
Roger - Win10 + FreeBSD (http://slexy.org/view/s2Kf2FG84H) 
 Anonymous - Sharing Socket (http://slexy.org/view/s21bOG5UhS) 
 Brad - Scrub Repaired (http://slexy.org/view/s20bKjCNXW) 
 Kelly - Automated Provisioning (http://slexy.org/view/s2qb07BC2G) 
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd,</itunes:keywords>
  <content:encoded>
    <![CDATA[<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or 
iXsystems hardware, and you could win monthly prizes, and have your story featured 
in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://bsdmag.org/siju_george/" rel="nofollow">Why did I choose the DragonFlyBSD Operating System by Siju George</a></h3>

<ul>
<li>We have a new article this week by Siju George posted over at BSDMag, talking about his reasons for using DragonFlyBSD in production. </li>
<li>He ran through periods of using both Free/OpenBSD, but different reasons led him away from each. Specifically problems doing port upgrades on FreeBSD, and the time required to do fsck / raid parity checks on OpenBSD. </li>
<li>During his research, he had heard about the HAMMER file-system, but didn’t know of anybody running it in production. After some mailing list conversions, and pointers from Matthew Dillon, he took the plunge and switched. </li>
<li>Now he has fallen in love with the operating system, some of the key strengths he notes at:</li>
<li>Rolling-Release model, which can be upgraded every few weeks or whenever he has the time

<ul>
<li>No time-consuming fsck after a unclean shutdown</li>
<li>No RAID parity checks while still having redundancy</li>
<li>Able to add volumes to HAMMER on the fly</li>
</ul></li>
<li>He also mentions looking forward to HAMMER2, and its potential for easy clustering support, along with eventual CARP implementation so he can run two systems on the same IP. 
***</li>
</ul>

<h3><a href="http://fossforce.com/2015/11/devil-bsd-leaving-linux-behind/" rel="nofollow">The Devil &amp; BSD - Larry Cafiero</a></h3>

<ul>
<li>A story that has been making the rounds on social media is by Larry Cafiero, on his reasons for deciding to switch from Linux over to the BSD side of things.</li>
<li>While most of the reasons are over the conflicts surrounding behavior by Linux leaders towards those in the community, he does mention that he has converted his main workstation over to PC-BSD. </li>
<li>According to Larry, “With a couple of hours of adding backup files and tweaking (augmented by a variety of “oh, look” moments which could easily make me the ADHD Foundation Poster Boy), it looks exactly like my personally modified Korora 22 Xfce which graced the machine earlier. “</li>
<li>He also gave a great compliment to the quality of the docs / applications in PC-BSD: “In addition, you have to like a operating system which gives you a book — in this case, the PC-BSD Handbook — which should be the gold standard of documentation. It’s enviable, as in, “man, I wish I had written that.” Also programs like AppCafe provide a plethora of FOSS software, so there’s no shortage of programs. Side by side, there’s nothing on the Linux side of things that is lacking on the BSD side of things.”</li>
<li>Regardless the initial reason for the switch, we are glad to have him and any other switchers join us on the BSD side of FOSS.
***</li>
</ul>

<h3><a href="http://teachbsd.org/" rel="nofollow">New resource for BSD-schoolin’</a></h3>

<ul>
<li>“The <a href="https://github.com/teachbsd/course" rel="nofollow">initial repository</a> contains all of the material for the practitioner and masters style courses as well as a PDF for the teaching guide.  All of the material is licensed under a BSD doc team license, also visible in the repo and on the github site.”</li>
<li>“we expect all other work, including the extension of the practitioner course to 5 days, and the adaptation of the graduate course to undergraduates will be in the github repo”</li>
<li>“Our goal now is to recruit a small number of universities to partner with us to teach this material.  We will keep you posted on our progress.”</li>
<li>We are working on getting an interview lined up to talk more about this project</li>
<li>If I somehow find the time, I am try to contribute towards a sysadmin course similar to what I used to teach at an Arts&amp;Tech College here in Canada
***</li>
</ul>

<h3><a href="http://lippard.blogspot.co.uk/2015/11/a-few-thoughts-on-openbsd-58.html" rel="nofollow">A Few thoughts on OpenBSD 5.8</a></h3>

<ul>
<li>A user details their thoughts, reactions, and concerns after upgrading to OpenBSD 5.8</li>
<li>Among the changes: </li>
<li>sudo was removed and replaced as doas. The user decided to make the switch, but ran into a bug with line continuation (\ to escape newline to continue a long line)</li>
<li>The removal of TCP Wrappers support from ssh - this caused a number of rules in hosts.allow to no longer be respected. </li>
<li>The FreeBSD port of openssh-portable has a patch to readd TCP wrappers because many people find it useful, including myself, when the ssh is in a jail and cannot run a firewall</li>
<li>The removal of the pf_rules= rc.conf variable. “I used to just put the default pf.conf rules file in place with each release and upgrade, and keep my changes in a pf.conf.local file that was specified in the pf_rules variable. The effect was that from the period after the upgrade until I noticed the change, my systems were using the default rules and thus more exposed than they were supposed to be”</li>
<li>This is what is often called a “POLA Violation”, Policy of Least Astonishment. When deciding what the system should do after some change or new feature is introduced, it should be the thing that will be the least “surprising” to the user. Having your firewall rules suddenly not apply, is surprising.</li>
<li>“A minor annoying change that was made in 5.8 was putting the file /var/unbound/db/root.key into /etc/changelist, so that the file gets checked daily by the security script. The issue with this is that if you are actually using unbound with DNSSEC, this file changes daily, though only in the comments”</li>
<li>It is very helpful to see a list of feedback like this after a release, so that the next release can be better</li>
<li>I would be interested in seeing similar feedback for the other BSDs
***</li>
</ul>

<h2>Interview - Bryan Cantrill - <a href="https://twitter.com/bcantrill" rel="nofollow">@bcantrill</a></h2>

<p>Linux Interface Rants</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.daemonology.net/blog/2015-11-21-FreeBSD-AMI-builder-AMI.html" rel="nofollow">FreeBSD AMI building AMI - Colin’s Corner</a></h3>

<ul>
<li>Colin Percival (Of TarSnap Fame) has brought us a new article this week on how to create your own custom EC2 AMI builds.</li>
<li>This new tool and instructions allows the creation of AMI files, without needing to go through the hassle of doing a fresh FreeBSD release build each time.</li>
<li>Essentially it works similar to Colin’s previous “de-penguinator” utility, by running a FreeBSD in a memory instance, allowing the disk to be unmounted and prepped for becoming an AMI.</li>
<li>The hope  is that this new work allows easier creation of a new variety of “customized” FreeBSD instances, for end users to download and deploy at will. 
***</li>
</ul>

<h3><a href="https://ripe71.ripe.net/archives/video/1200/" rel="nofollow">Peter Hessler on OpenBSD / OpenBGPd</a></h3>

<ul>
<li>Last week a new video landed of Peter Hessler giving us a status update on OpenBSD tech, and OpenBGPd specifically</li>
<li>Of interest, he notes that LibreSSL is being used in iOS / OSX, and of course PF is used all over, Apple, BSD, Solaris and even a Windows port!</li>
<li>OpenNTPD gets a mention as well, still ZERO CVEs for the lifetime of the project</li>
<li>On the OpenBGPd side, it is considered production ready, so no reason to hold back deployment</li>
<li>Very “feature-complete”, able to handle Edge Router, Route server, Multi-RIB. Slew of optional features like route reflector, looking glass, mrt dumps, mpls / mpls vpn. </li>
<li>Bugs fixed, crashers, memory constraints and performance has been improved</li>
<li>Filtering Performance, in example provided, importing 561K rules / 60K prefixes, went from 35 minutes down to 30 seconds. 
***</li>
</ul>

<h3><a href="https://github.com/freebsd/freebsd-wifi-build/wiki/Onion-Omega" rel="nofollow">Onion Omega Updates</a></h3>

<ul>
<li>I have a newer kernel config that will be committed soon that hooks up the system LED, and the three LEDs on the expansion dock via /dev/led</li>
<li>I also have the I2C interface working to talk to the Relay and Servo expansions</li>
<li>I have not determined the exact protocol for the Servo expansions, but the relay expansion is fairly simple to operate</li>
<li>Instructions have been added to the wiki</li>
<li>I have managed to use the GPIO to toggle external LEDs and to read the value from a switch</li>
<li>I have also used the Servo PWM controller to dim an LED and control the speed of a PWM computer case fan</li>
<li>My plan is to operate a 32x32 multi colour LED matrix from the device for an interactive christmas display
***</li>
</ul>

<h3><a href="http://www.cyberciti.biz/datacenter/book-review-freebsd-mastery-zfs/" rel="nofollow">FreeBSD Mastery: ZFS Book review</a></h3>

<ul>
<li>Book can be <a href="http://smile.amazon.com/FreeBSD-Mastery-ZFS-7/dp/0692452354/" rel="nofollow">purchased here</a></li>
<li>or <a href="http://www.zfsbook.com/" rel="nofollow">from the list of vendors including directly from the author here</a> 
***</li>
</ul>

<h2>Beastie Bits</h2>

<p><a href="http://www.computerhistory.org/artifactdonation/" rel="nofollow">Computer History Museum is looking for Bell Labs UNIX</a> </p>

<p><a href="https://youtu.be/rA_5Cz99z28" rel="nofollow">ACM Queue Portrait: Robert Watson </a> </p>

<p><a href="https://www.freebsdnews.com/2015/11/12/bsd-videos/" rel="nofollow">Video Collection about BSD History, put together by FreeBSDNews</a></p>

<p><a href="http://www.minix3.org/conference/2016/" rel="nofollow">Minix announces its 2016 conference</a> </p>

<p><a href="http://bsdtalk.blogspot.com/2015/10/bsdtalk258-chris-henschen-from-fp.html" rel="nofollow">Chris Henschen from fP Technologies&#39; talk about BSD is now online</a></p>

<p><a href="http://undeadly.org/cgi?action=article&sid=20151123161651&mode=expanded" rel="nofollow">Mike Larkin and Theo de Raadt&#39;s talks from Hackfest this year in Quebec are online</a> </p>

<p><a href="http://kernelnomicon.org/?p=534" rel="nofollow">FreeBSD on a BeagleBoneBlack with a Touchscreen Display</a></p>

<p><a href="http://www.cinlug.org/meetings/2015/December" rel="nofollow">Dan Langille will be talking at CINLUG</a></p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2Gm06eC0Y" rel="nofollow">John - Rpi2 and BSD</a> </li>
<li><a href="http://slexy.org/view/s2Kf2FG84H" rel="nofollow">Roger - Win10 + FreeBSD</a> </li>
<li><a href="http://slexy.org/view/s21bOG5UhS" rel="nofollow"> Anonymous - Sharing Socket</a> </li>
<li><a href="http://slexy.org/view/s20bKjCNXW" rel="nofollow"> Brad - Scrub Repaired</a> </li>
<li><a href="http://slexy.org/view/s2qb07BC2G" rel="nofollow"> Kelly - Automated Provisioning</a> 
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or 
iXsystems hardware, and you could win monthly prizes, and have your story featured 
in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://bsdmag.org/siju_george/" rel="nofollow">Why did I choose the DragonFlyBSD Operating System by Siju George</a></h3>

<ul>
<li>We have a new article this week by Siju George posted over at BSDMag, talking about his reasons for using DragonFlyBSD in production. </li>
<li>He ran through periods of using both Free/OpenBSD, but different reasons led him away from each. Specifically problems doing port upgrades on FreeBSD, and the time required to do fsck / raid parity checks on OpenBSD. </li>
<li>During his research, he had heard about the HAMMER file-system, but didn’t know of anybody running it in production. After some mailing list conversions, and pointers from Matthew Dillon, he took the plunge and switched. </li>
<li>Now he has fallen in love with the operating system, some of the key strengths he notes at:</li>
<li>Rolling-Release model, which can be upgraded every few weeks or whenever he has the time

<ul>
<li>No time-consuming fsck after a unclean shutdown</li>
<li>No RAID parity checks while still having redundancy</li>
<li>Able to add volumes to HAMMER on the fly</li>
</ul></li>
<li>He also mentions looking forward to HAMMER2, and its potential for easy clustering support, along with eventual CARP implementation so he can run two systems on the same IP. 
***</li>
</ul>

<h3><a href="http://fossforce.com/2015/11/devil-bsd-leaving-linux-behind/" rel="nofollow">The Devil &amp; BSD - Larry Cafiero</a></h3>

<ul>
<li>A story that has been making the rounds on social media is by Larry Cafiero, on his reasons for deciding to switch from Linux over to the BSD side of things.</li>
<li>While most of the reasons are over the conflicts surrounding behavior by Linux leaders towards those in the community, he does mention that he has converted his main workstation over to PC-BSD. </li>
<li>According to Larry, “With a couple of hours of adding backup files and tweaking (augmented by a variety of “oh, look” moments which could easily make me the ADHD Foundation Poster Boy), it looks exactly like my personally modified Korora 22 Xfce which graced the machine earlier. “</li>
<li>He also gave a great compliment to the quality of the docs / applications in PC-BSD: “In addition, you have to like a operating system which gives you a book — in this case, the PC-BSD Handbook — which should be the gold standard of documentation. It’s enviable, as in, “man, I wish I had written that.” Also programs like AppCafe provide a plethora of FOSS software, so there’s no shortage of programs. Side by side, there’s nothing on the Linux side of things that is lacking on the BSD side of things.”</li>
<li>Regardless the initial reason for the switch, we are glad to have him and any other switchers join us on the BSD side of FOSS.
***</li>
</ul>

<h3><a href="http://teachbsd.org/" rel="nofollow">New resource for BSD-schoolin’</a></h3>

<ul>
<li>“The <a href="https://github.com/teachbsd/course" rel="nofollow">initial repository</a> contains all of the material for the practitioner and masters style courses as well as a PDF for the teaching guide.  All of the material is licensed under a BSD doc team license, also visible in the repo and on the github site.”</li>
<li>“we expect all other work, including the extension of the practitioner course to 5 days, and the adaptation of the graduate course to undergraduates will be in the github repo”</li>
<li>“Our goal now is to recruit a small number of universities to partner with us to teach this material.  We will keep you posted on our progress.”</li>
<li>We are working on getting an interview lined up to talk more about this project</li>
<li>If I somehow find the time, I am try to contribute towards a sysadmin course similar to what I used to teach at an Arts&amp;Tech College here in Canada
***</li>
</ul>

<h3><a href="http://lippard.blogspot.co.uk/2015/11/a-few-thoughts-on-openbsd-58.html" rel="nofollow">A Few thoughts on OpenBSD 5.8</a></h3>

<ul>
<li>A user details their thoughts, reactions, and concerns after upgrading to OpenBSD 5.8</li>
<li>Among the changes: </li>
<li>sudo was removed and replaced as doas. The user decided to make the switch, but ran into a bug with line continuation (\ to escape newline to continue a long line)</li>
<li>The removal of TCP Wrappers support from ssh - this caused a number of rules in hosts.allow to no longer be respected. </li>
<li>The FreeBSD port of openssh-portable has a patch to readd TCP wrappers because many people find it useful, including myself, when the ssh is in a jail and cannot run a firewall</li>
<li>The removal of the pf_rules= rc.conf variable. “I used to just put the default pf.conf rules file in place with each release and upgrade, and keep my changes in a pf.conf.local file that was specified in the pf_rules variable. The effect was that from the period after the upgrade until I noticed the change, my systems were using the default rules and thus more exposed than they were supposed to be”</li>
<li>This is what is often called a “POLA Violation”, Policy of Least Astonishment. When deciding what the system should do after some change or new feature is introduced, it should be the thing that will be the least “surprising” to the user. Having your firewall rules suddenly not apply, is surprising.</li>
<li>“A minor annoying change that was made in 5.8 was putting the file /var/unbound/db/root.key into /etc/changelist, so that the file gets checked daily by the security script. The issue with this is that if you are actually using unbound with DNSSEC, this file changes daily, though only in the comments”</li>
<li>It is very helpful to see a list of feedback like this after a release, so that the next release can be better</li>
<li>I would be interested in seeing similar feedback for the other BSDs
***</li>
</ul>

<h2>Interview - Bryan Cantrill - <a href="https://twitter.com/bcantrill" rel="nofollow">@bcantrill</a></h2>

<p>Linux Interface Rants</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.daemonology.net/blog/2015-11-21-FreeBSD-AMI-builder-AMI.html" rel="nofollow">FreeBSD AMI building AMI - Colin’s Corner</a></h3>

<ul>
<li>Colin Percival (Of TarSnap Fame) has brought us a new article this week on how to create your own custom EC2 AMI builds.</li>
<li>This new tool and instructions allows the creation of AMI files, without needing to go through the hassle of doing a fresh FreeBSD release build each time.</li>
<li>Essentially it works similar to Colin’s previous “de-penguinator” utility, by running a FreeBSD in a memory instance, allowing the disk to be unmounted and prepped for becoming an AMI.</li>
<li>The hope  is that this new work allows easier creation of a new variety of “customized” FreeBSD instances, for end users to download and deploy at will. 
***</li>
</ul>

<h3><a href="https://ripe71.ripe.net/archives/video/1200/" rel="nofollow">Peter Hessler on OpenBSD / OpenBGPd</a></h3>

<ul>
<li>Last week a new video landed of Peter Hessler giving us a status update on OpenBSD tech, and OpenBGPd specifically</li>
<li>Of interest, he notes that LibreSSL is being used in iOS / OSX, and of course PF is used all over, Apple, BSD, Solaris and even a Windows port!</li>
<li>OpenNTPD gets a mention as well, still ZERO CVEs for the lifetime of the project</li>
<li>On the OpenBGPd side, it is considered production ready, so no reason to hold back deployment</li>
<li>Very “feature-complete”, able to handle Edge Router, Route server, Multi-RIB. Slew of optional features like route reflector, looking glass, mrt dumps, mpls / mpls vpn. </li>
<li>Bugs fixed, crashers, memory constraints and performance has been improved</li>
<li>Filtering Performance, in example provided, importing 561K rules / 60K prefixes, went from 35 minutes down to 30 seconds. 
***</li>
</ul>

<h3><a href="https://github.com/freebsd/freebsd-wifi-build/wiki/Onion-Omega" rel="nofollow">Onion Omega Updates</a></h3>

<ul>
<li>I have a newer kernel config that will be committed soon that hooks up the system LED, and the three LEDs on the expansion dock via /dev/led</li>
<li>I also have the I2C interface working to talk to the Relay and Servo expansions</li>
<li>I have not determined the exact protocol for the Servo expansions, but the relay expansion is fairly simple to operate</li>
<li>Instructions have been added to the wiki</li>
<li>I have managed to use the GPIO to toggle external LEDs and to read the value from a switch</li>
<li>I have also used the Servo PWM controller to dim an LED and control the speed of a PWM computer case fan</li>
<li>My plan is to operate a 32x32 multi colour LED matrix from the device for an interactive christmas display
***</li>
</ul>

<h3><a href="http://www.cyberciti.biz/datacenter/book-review-freebsd-mastery-zfs/" rel="nofollow">FreeBSD Mastery: ZFS Book review</a></h3>

<ul>
<li>Book can be <a href="http://smile.amazon.com/FreeBSD-Mastery-ZFS-7/dp/0692452354/" rel="nofollow">purchased here</a></li>
<li>or <a href="http://www.zfsbook.com/" rel="nofollow">from the list of vendors including directly from the author here</a> 
***</li>
</ul>

<h2>Beastie Bits</h2>

<p><a href="http://www.computerhistory.org/artifactdonation/" rel="nofollow">Computer History Museum is looking for Bell Labs UNIX</a> </p>

<p><a href="https://youtu.be/rA_5Cz99z28" rel="nofollow">ACM Queue Portrait: Robert Watson </a> </p>

<p><a href="https://www.freebsdnews.com/2015/11/12/bsd-videos/" rel="nofollow">Video Collection about BSD History, put together by FreeBSDNews</a></p>

<p><a href="http://www.minix3.org/conference/2016/" rel="nofollow">Minix announces its 2016 conference</a> </p>

<p><a href="http://bsdtalk.blogspot.com/2015/10/bsdtalk258-chris-henschen-from-fp.html" rel="nofollow">Chris Henschen from fP Technologies&#39; talk about BSD is now online</a></p>

<p><a href="http://undeadly.org/cgi?action=article&sid=20151123161651&mode=expanded" rel="nofollow">Mike Larkin and Theo de Raadt&#39;s talks from Hackfest this year in Quebec are online</a> </p>

<p><a href="http://kernelnomicon.org/?p=534" rel="nofollow">FreeBSD on a BeagleBoneBlack with a Touchscreen Display</a></p>

<p><a href="http://www.cinlug.org/meetings/2015/December" rel="nofollow">Dan Langille will be talking at CINLUG</a></p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2Gm06eC0Y" rel="nofollow">John - Rpi2 and BSD</a> </li>
<li><a href="http://slexy.org/view/s2Kf2FG84H" rel="nofollow">Roger - Win10 + FreeBSD</a> </li>
<li><a href="http://slexy.org/view/s21bOG5UhS" rel="nofollow"> Anonymous - Sharing Socket</a> </li>
<li><a href="http://slexy.org/view/s20bKjCNXW" rel="nofollow"> Brad - Scrub Repaired</a> </li>
<li><a href="http://slexy.org/view/s2qb07BC2G" rel="nofollow"> Kelly - Automated Provisioning</a> 
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>116: Arcing ZFS</title>
  <link>https://www.bsdnow.tv/116</link>
  <guid isPermaLink="false">ae6271fa-c8be-4fb6-9e87-d13ea9fccf1a</guid>
  <pubDate>Wed, 18 Nov 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ae6271fa-c8be-4fb6-9e87-d13ea9fccf1a.mp3" length="84798292" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we are going to be talking to George Wilson AKA</itunes:subtitle>
  <itunes:duration>1:57:46</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
Headlines
How to create new binary packages in the Ports system on OpenBSD (http://functionallyparanoid.com/2015/11/06/where-do-binary-packages-come-from/)
Creating a port is often a great first step you can take to get involved in your favorite BSD of choice, and (often) doesn’t require any actual programming to do so.
In this article we have a great walkthrough for users on creating a new ported application, and eventually binary package, on OpenBSD
As mentioned in the tutorial, a good starting place is always an existing port, which can you use as a template for your new creation. Tip: Try to pick something similar, I.E. python for a python app, Qt for Qt, etc.
This tutorial will first walk you through the process of creating your Makefile and related description about the new port. 
Once you’ve created the initial Makefile, there are a bunch of new “make” targets you can begin to run to try building your port, everything from “make fetch” to “make makesum” and “make package”. Using these tests you can verify that your port is correct and results in the installable package/app you wanted.
***
Status update on pledge(2) (http://undeadly.org/cgi?action=article&amp;amp;sid=20151116152318)
OpenBSD has been working very aggressively to convert much of their base system applications to using pledge(2) “Formerly Tame(2))
Theo has provided a great status update on where that stands as of right now and the numbers look like the following:
Out of 600 ELF binaries, 368 of them have been updated to utilize pledge(2) in some manner
This is quite a few, and includes everything from openssl, ping, sftp, grep, gzip and much more
There are still a number of “pledge-able” commands waiting for conversion, such as login, sysctl, nfsd, ssh and others.
He also mentions that there does exist some subset of commands which aren’t viable pledge(2) candidates, such as simple things like “true”, or commands like reboot/mount or even perl itself. 
***
FreeBSD booting on the Onion Omega (https://onion.io/omega/)
Tiny $19 MIPS SoC ($25 with dock that provides built in mini-USB Serial interface, power supply, LED lights, GPIO expansion, USB port, etc)
A number of pluggable ‘expansions’ are available, including:
Arduino Dock (connect the Omega device to your existing Arduino components)
Blue Tooth Lower Energy
10/100 Ethernet Port
Relay expansion (2 relays each, can stack up to 8 expansions to control 16 relays)
Servo expansion (control up to 16 PWM servos, like robotic arms or camera mounts)
OLED expansion (1" monochrome 128x64 OLED display)
Thermal Printer Kit (includes all wiring and other components)
The device is the product of a successful Kick Starter campaign (https://www.kickstarter.com/projects/onion/onion-omega-invention-platform-for-the-internet-of/description) from March of this year
Specs:
Atheros AR9330 rev1 400MHZ MIPS 24K
64MB DDR2 400MHz
16MB Flash 
802.11b/g/n 150Mbps Atheros Wifi + 100mbps Atheros Wired Ethernet
18 GPIO Pins
USB Controller
Using the freebsd-wifi-build (https://github.com/freebsd/freebsd-wifi-build/wiki) tool, I was able to build a new firmware for the device based on a profile for a similar device based on the same Atheros chip. I hope to have time to validate some of the settings and get them posted up into the wiki and get the kernel configuration committed to FreeBSD in the next week or two
It is an interesting device compared to the TP-Link WDR3600’s we did at BSDCan, as it has twice as much flash, leaving more room for the system image, but only half as much ram, and a slower CPU
***
SSH Performance testing (https://wiki.freebsd.org/SSHPerf)
There has been a discussion (https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058244.html)  about the value of upkeeping the HPN (High Performance Networking) patch to OpenSSH in the base system of FreeBSD
As part of this, I did some fresh benchmarks on my pair of new high end servers
The remaining part to be done is testing different levels of latency
By tweaking the socket buffer sizes, I was able to saturate the full 10 gigabit with netcat, iperf, etc
From the tests that have been done so far, it doesn’t look like even the NONE cipher can reach that level of performance because of the MAC (Message Authentication Code)
It does appear that some of the auto-tuning in HPN is not worked as expected
Explicitly setting -oTcpRcvBuf=7168 (KB) is enough to saturate a gigabit with 50ms RTT (round trip time)
***
iXsystems
iX gives an overview of FreeBSD at SeaGl 2015 (https://www.ixsystems.com/whats-new/seagl-2015/) 
On the FreeNAS Blog, Michael Dexter explains the ZFS Intent Log and SLOG  (http://www.freenas.org/whats-new/2015/11/zfs-zil-and-slog-demystified.html) 
Interview - George Wilson - wilzun@gmail.com (mailto:wilzun@gmail.com) / @zfsdude (https://twitter.com/zfsdude)
OpenZFS and Delphix
***
News Roundup
Nicholas Marriott has replaced the aging version of less(1) in OpenBSD (http://undeadly.org/cgi?action=article&amp;amp;sid=20151105223808)
Sometimes less isn’t more, it’s just less
In this story, we have news that the old version of less(1) in OpenBSD has now been ripped out in favor of the more modern fork from illumos founder Garrett D’Amore.
In addition to being a “more” modern version, it also includes far “less” of the portability code, uses terminfo, replacing termcap and is more POSIX compliant. 
***
FreeBSD gets initial support for advanced SMR drives  (https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058522.html)
Kenneth D. Merry ken@freebsd.org has developed initial support for Host Managed, and Host Aware Shingled Magnetic Recording drives in FreeBSD, available as a patch against both -current and 10-stable
“This includes support for Host Managed, Host Aware and Drive Managed SMRdrives that are either SCSI (ZBC) or ATA (ZAC) attached via a SAScontroller.  This does not include support for SMR ATA drives attached viaan ATA controller.  Also, I have not yet figured out how to properly detecta Host Managed ATA drive, so this code won't do that.”
SMR drives have overlapping tracks, because the read head can be much smaller than the write head
The drawback to this approach is that writes to the disk must take place in 256 MB “zones” that must be written from the beginning
New features in the patch:
A new 'camcontrol zone' command that allows displaying and managing drive zones via SCSI/ATA passthrough.
A new zonectl(8) utility that uses the new DIOCZONECMD ioctl to display and manage zones via the da(4) (and later ada(4)) driver.
Changes to diskinfo -v to display the zone mode of a drive.
A new disk zone API, sys/sys/disk_zone.h.
A new bio type, BIO_ZONE, and modifications to GEOM to support it.  This new bio will allow filesystems to query zone support in a drive and manage zoned drives.
Extensive modifications to the da(4) driver to handle probing SCSI and SATA behind SAS SMR drives.
Additional CAM CDB building functions for zone commands.
“We (Spectra Logic) are working on ZFS changes that will use this CAM and GEOM infrastructure to make ZFS play well with SMR drives.  Those changes aren't yet done.”
It is good to see active development in this area, especially from experts in archival storage
A second patch (https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058521.html) is also offered, that improves the pass(4) passthrough interface for disks, and introduces a new camdd(8) command, a version of dd that uses the pass(4) interface, kqueue, and separate reader/writer threads for improved performance
He also presents a feature wishlist that includes some interesting benchmarking features, including a ‘sink’ mode, where reads from the device are just thrown away, rather than having to write then to /dev/null
***
Initial implemtnation of 802.11n now in iwm(4) (http://undeadly.org/cgi?action=article&amp;amp;sid=20151112212739)
OpenBSD laptop users rejoice! 802.11n has landed!
Initially only for the iwm(4) driver, support is planned for other devices in the future
Includes support for all the required (non-optional) bits to make 802.11N functional
Adds a new 11n mode to ifmedia, and MCS (modulation coding scheme) that sits alongside the ieee80211_rateset structure. 
No support for MIMO / SGI (Short Guard Interval) or 40 MHz wide-channels, but perhaps we will see those in a future update.
They are asking users for testing against a wide variety of any/all APs!
***
Freebsd adds support for Bluetooth LE Security Management (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=290038)
FreeBSD + BlueTooth, not something we discuss a lot about, but it is still under active development.
The most recently added features come from Takanori Watanabe, and adds new LE Security Management. 
Specifically, it enables support for BLE Security Manager Protocol(SMP), and enables a userland tool to wait for the underlying HCI connection to be encrypted.
***
Building OpnSense on HardenedBSD (http://0xfeedface.org/2015/11/07/hbsd-opnsense.html)
Looking for a way to further Harden your router? We have a tutorial from the HardenedBSD developer, Shawn Webb, about how to build OpnSense on HBSD 10-STABLE.
You’ll need to first be running HBSD 10-STABLE somewhere, in this article he is using bhyve for the builder VM.
The build process itself is mostly pretty straight-forward, but there are a number of different repos that all have to be checked out, so pay attention to which goes where. 
+In this example he does a targeted build for a Netgate RCC-VE-4860, but you can pick your particular build. 
***
Beastie Bits
1 BTC bounty for chromium bug! (https://github.com/gliaskos/freebsd-chromium/issues/40)
DesktopBSD 2.0 M1 released (http://www.desktopbsd.net/forums/threads/desktopbsd-2-0-m1-released.806/)
By implementing asynchronous pru_attach for UDP, Sepherosa Ziehau has increased connect rate by around 15K connections per second (http://lists.dragonflybsd.org/pipermail/commits/2015-October/458500.html)
Stephen Bourne, known for the Bourne Shell, will be giving a talk at NYCBUG this week (http://lists.nycbug.org/pipermail/talk/2015-October/016384.html) 
Tor Browser 5.0.3 for OpenBSD released (http://lists.nycbug.org/pipermail/talk/2015-October/016390.html)
The Tor BSD Diversity Project (https://torbsd.github.io/) aim to
Increase the number of Tor relays running BSDs. We envision this happening by increasing the total number of relays, with the addition of more BSD users running relays;
Make the Tor Browser available under BSD operating systems using native packaging mechanisms. Our first target is OpenBSD;
Engage the broader BSD community about the Tor anonymity network and the place that BSD Unix should occupy in the privacy community at large.
Screenshots from Unix People circa 2002 (https://anders.unix.se/2015/10/28/screenshots-from-developers--unix-people-2002/) 
Feedback/Questions
Dominik - Bhyve Setup (http://slexy.org/view/s21xTyirkO)
 John - beadm + GELI  (http://slexy.org/view/s2YVi7ULlJ)
 Darrall - ZFS + RAID = Problems (http://slexy.org/view/s20lRTaZSy)
 Hamza - Which shell? (http://slexy.org/view/s2omNWdTBU)
 Amenia - FreeBSD routing (http://slexy.org/view/s21Y8bPbnm)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!</li>
</ul>

<hr>

<h2>Headlines</h2>

<h3><a href="http://functionallyparanoid.com/2015/11/06/where-do-binary-packages-come-from/" rel="nofollow">How to create new binary packages in the Ports system on OpenBSD</a></h3>

<ul>
<li>Creating a port is often a great first step you can take to get involved in your favorite BSD of choice, and (often) doesn’t require any actual programming to do so.</li>
<li>In this article we have a great walkthrough for users on creating a new ported application, and eventually binary package, on OpenBSD</li>
<li>As mentioned in the tutorial, a good starting place is always an existing port, which can you use as a template for your new creation. Tip: Try to pick something similar, I.E. python for a python app, Qt for Qt, etc.</li>
<li>This tutorial will first walk you through the process of creating your Makefile and related description about the new port. </li>
<li>Once you’ve created the initial Makefile, there are a bunch of new “make” targets you can begin to run to try building your port, everything from “make fetch” to “make makesum” and “make package”. Using these tests you can verify that your port is correct and results in the installable package/app you wanted.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151116152318" rel="nofollow">Status update on pledge(2)</a></h3>

<ul>
<li>OpenBSD has been working very aggressively to convert much of their base system applications to using pledge(2) “Formerly Tame(2))</li>
<li>Theo has provided a great status update on where that stands as of right now and the numbers look like the following:</li>
<li>Out of 600 ELF binaries, 368 of them have been updated to utilize pledge(2) in some manner</li>
<li>This is quite a few, and includes everything from openssl, ping, sftp, grep, gzip and much more</li>
<li>There are still a number of “pledge-able” commands waiting for conversion, such as login, sysctl, nfsd, ssh and others.</li>
<li>He also mentions that there does exist some subset of commands which aren’t viable pledge(2) candidates, such as simple things like “true”, or commands like reboot/mount or even perl itself. 
***</li>
</ul>

<h3><a href="https://onion.io/omega/" rel="nofollow">FreeBSD booting on the Onion Omega</a></h3>

<ul>
<li>Tiny $19 MIPS SoC ($25 with dock that provides built in mini-USB Serial interface, power supply, LED lights, GPIO expansion, USB port, etc)</li>
<li>A number of pluggable ‘expansions’ are available, including:

<ul>
<li>Arduino Dock (connect the Omega device to your existing Arduino components)</li>
<li>Blue Tooth Lower Energy</li>
<li>10/100 Ethernet Port</li>
<li>Relay expansion (2 relays each, can stack up to 8 expansions to control 16 relays)</li>
<li>Servo expansion (control up to 16 PWM servos, like robotic arms or camera mounts)</li>
<li>OLED expansion (1&quot; monochrome 128x64 OLED display)</li>
<li>Thermal Printer Kit (includes all wiring and other components)</li>
</ul></li>
<li>The device is the product of a successful <a href="https://www.kickstarter.com/projects/onion/onion-omega-invention-platform-for-the-internet-of/description" rel="nofollow">Kick Starter campaign</a> from March of this year</li>
<li>Specs:</li>
<li>Atheros AR9330 rev1 400MHZ MIPS 24K</li>
<li>64MB DDR2 400MHz</li>
<li>16MB Flash </li>
<li>802.11b/g/n 150Mbps Atheros Wifi + 100mbps Atheros Wired Ethernet</li>
<li>18 GPIO Pins</li>
<li>USB Controller</li>
<li>Using the <a href="https://github.com/freebsd/freebsd-wifi-build/wiki" rel="nofollow">freebsd-wifi-build</a> tool, I was able to build a new firmware for the device based on a profile for a similar device based on the same Atheros chip. I hope to have time to validate some of the settings and get them posted up into the wiki and get the kernel configuration committed to FreeBSD in the next week or two</li>
<li>It is an interesting device compared to the TP-Link WDR3600’s we did at BSDCan, as it has twice as much flash, leaving more room for the system image, but only half as much ram, and a slower CPU
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/SSHPerf" rel="nofollow">SSH Performance testing</a></h3>

<ul>
<li>There has <a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058244.html" rel="nofollow">been a discussion</a>  about the value of upkeeping the HPN (High Performance Networking) patch to OpenSSH in the base system of FreeBSD</li>
<li>As part of this, I did some fresh benchmarks on my pair of new high end servers</li>
<li>The remaining part to be done is testing different levels of latency</li>
<li>By tweaking the socket buffer sizes, I was able to saturate the full 10 gigabit with netcat, iperf, etc</li>
<li>From the tests that have been done so far, it doesn’t look like even the NONE cipher can reach that level of performance because of the MAC (Message Authentication Code)</li>
<li>It does appear that some of the auto-tuning in HPN is not worked as expected</li>
<li>Explicitly setting -oTcpRcvBuf=7168 (KB) is enough to saturate a gigabit with 50ms RTT (round trip time)
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.ixsystems.com/whats-new/seagl-2015/" rel="nofollow">iX gives an overview of FreeBSD at SeaGl 2015</a> </li>
<li><a href="http://www.freenas.org/whats-new/2015/11/zfs-zil-and-slog-demystified.html" rel="nofollow">On the FreeNAS Blog, Michael Dexter explains the ZFS Intent Log and SLOG </a> </li>
</ul>

<h2>Interview - George Wilson - <a href="mailto:wilzun@gmail.com" rel="nofollow">wilzun@gmail.com</a> / <a href="https://twitter.com/zfsdude" rel="nofollow">@zfsdude</a></h2>

<ul>
<li>OpenZFS and Delphix
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151105223808" rel="nofollow">Nicholas Marriott has replaced the aging version of less(1) in OpenBSD</a></h3>

<ul>
<li>Sometimes less isn’t more, it’s just less</li>
<li>In this story, we have news that the old version of less(1) in OpenBSD has now been ripped out in favor of the more modern fork from illumos founder Garrett D’Amore.</li>
<li>In addition to being a “more” modern version, it also includes far “less” of the portability code, uses terminfo, replacing termcap and is more POSIX compliant. 
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058522.html" rel="nofollow">FreeBSD gets initial support for advanced SMR drives </a></h3>

<ul>
<li>Kenneth D. Merry <a href="mailto:ken@freebsd.org" rel="nofollow">ken@freebsd.org</a> has developed initial support for Host Managed, and Host Aware Shingled Magnetic Recording drives in FreeBSD, available as a patch against both -current and 10-stable</li>
<li>“This includes support for Host Managed, Host Aware and Drive Managed SMRdrives that are either SCSI (ZBC) or ATA (ZAC) attached via a SAScontroller.  This does not include support for SMR ATA drives attached viaan ATA controller.  Also, I have not yet figured out how to properly detecta Host Managed ATA drive, so this code won&#39;t do that.”</li>
<li>SMR drives have overlapping tracks, because the read head can be much smaller than the write head</li>
<li>The drawback to this approach is that writes to the disk must take place in 256 MB “zones” that must be written from the beginning</li>
<li>New features in the patch:</li>
<li>A new &#39;camcontrol zone&#39; command that allows displaying and managing drive zones via SCSI/ATA passthrough.

<ul>
<li>A new zonectl(8) utility that uses the new DIOCZONECMD ioctl to display and manage zones via the da(4) (and later ada(4)) driver.</li>
<li>Changes to diskinfo -v to display the zone mode of a drive.</li>
<li>A new disk zone API, sys/sys/disk_zone.h.</li>
<li>A new bio type, BIO_ZONE, and modifications to GEOM to support it.  This new bio will allow filesystems to query zone support in a drive and manage zoned drives.</li>
</ul></li>
<li>Extensive modifications to the da(4) driver to handle probing SCSI and SATA behind SAS SMR drives.

<ul>
<li>Additional CAM CDB building functions for zone commands.</li>
</ul></li>
<li>“We (Spectra Logic) are working on ZFS changes that will use this CAM and GEOM infrastructure to make ZFS play well with SMR drives.  Those changes aren&#39;t yet done.”</li>
<li>It is good to see active development in this area, especially from experts in archival storage</li>
<li>A <a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058521.html" rel="nofollow">second patch</a> is also offered, that improves the pass(4) passthrough interface for disks, and introduces a new camdd(8) command, a version of dd that uses the pass(4) interface, kqueue, and separate reader/writer threads for improved performance</li>
<li>He also presents a feature wishlist that includes some interesting benchmarking features, including a ‘sink’ mode, where reads from the device are just thrown away, rather than having to write then to /dev/null
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151112212739" rel="nofollow">Initial implemtnation of 802.11n now in iwm(4)</a></h3>

<ul>
<li>OpenBSD laptop users rejoice! 802.11n has landed!</li>
<li>Initially only for the iwm(4) driver, support is planned for other devices in the future</li>
<li>Includes support for all the required (non-optional) bits to make 802.11N functional</li>
<li>Adds a new 11n mode to ifmedia, and MCS (modulation coding scheme) that sits alongside the ieee80211_rateset structure. </li>
<li>No support for MIMO / SGI (Short Guard Interval) or 40 MHz wide-channels, but perhaps we will see those in a future update.</li>
<li>They are asking users for testing against a wide variety of any/all APs!
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=290038" rel="nofollow">Freebsd adds support for Bluetooth LE Security Management</a></h3>

<ul>
<li>FreeBSD + BlueTooth, not something we discuss a lot about, but it is still under active development.</li>
<li>The most recently added features come from Takanori Watanabe, and adds new LE Security Management. </li>
<li>Specifically, it enables support for BLE Security Manager Protocol(SMP), and enables a userland tool to wait for the underlying HCI connection to be encrypted.
***</li>
</ul>

<h3><a href="http://0xfeedface.org/2015/11/07/hbsd-opnsense.html" rel="nofollow">Building OpnSense on HardenedBSD</a></h3>

<ul>
<li>Looking for a way to further Harden your router? We have a tutorial from the HardenedBSD developer, Shawn Webb, about how to build OpnSense on HBSD 10-STABLE.</li>
<li>You’ll need to first be running HBSD 10-STABLE somewhere, in this article he is using bhyve for the builder VM.</li>
<li>The build process itself is mostly pretty straight-forward, but there are a number of different repos that all have to be checked out, so pay attention to which goes where. 
+In this example he does a targeted build for a Netgate RCC-VE-4860, but you can pick your particular build. 
***</li>
</ul>

<h2>Beastie Bits</h2>

<p><a href="https://github.com/gliaskos/freebsd-chromium/issues/40" rel="nofollow">1 BTC bounty for chromium bug!</a></p>

<p><a href="http://www.desktopbsd.net/forums/threads/desktopbsd-2-0-m1-released.806/" rel="nofollow">DesktopBSD 2.0 M1 released</a></p>

<p><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-October/458500.html" rel="nofollow">By implementing asynchronous pru_attach for UDP, Sepherosa Ziehau has increased connect rate by around 15K connections per second</a></p>

<p><a href="http://lists.nycbug.org/pipermail/talk/2015-October/016384.html" rel="nofollow">Stephen Bourne, known for the Bourne Shell, will be giving a talk at NYCBUG this week</a> </p>

<p><a href="http://lists.nycbug.org/pipermail/talk/2015-October/016390.html" rel="nofollow">Tor Browser 5.0.3 for OpenBSD released</a></p>

<ul>
<li><a href="https://torbsd.github.io/" rel="nofollow">The Tor BSD Diversity Project</a> aim to

<ul>
<li>Increase the number of Tor relays running BSDs. We envision this happening by increasing the total number of relays, with the addition of more BSD users running relays;</li>
<li>Make the Tor Browser available under BSD operating systems using native packaging mechanisms. Our first target is OpenBSD;</li>
<li>Engage the broader BSD community about the Tor anonymity network and the place that BSD Unix should occupy in the privacy community at large.</li>
</ul></li>
</ul>

<p><a href="https://anders.unix.se/2015/10/28/screenshots-from-developers--unix-people-2002/" rel="nofollow">Screenshots from Unix People circa 2002</a> </p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21xTyirkO" rel="nofollow">Dominik - Bhyve Setup</a></li>
<li><a href="http://slexy.org/view/s2YVi7ULlJ" rel="nofollow"> John - beadm + GELI </a></li>
<li><a href="http://slexy.org/view/s20lRTaZSy" rel="nofollow"> Darrall - ZFS + RAID = Problems</a></li>
<li><a href="http://slexy.org/view/s2omNWdTBU" rel="nofollow"> Hamza - Which shell?</a></li>
<li><a href="http://slexy.org/view/s21Y8bPbnm" rel="nofollow"> Amenia - FreeBSD routing</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!</li>
</ul>

<hr>

<h2>Headlines</h2>

<h3><a href="http://functionallyparanoid.com/2015/11/06/where-do-binary-packages-come-from/" rel="nofollow">How to create new binary packages in the Ports system on OpenBSD</a></h3>

<ul>
<li>Creating a port is often a great first step you can take to get involved in your favorite BSD of choice, and (often) doesn’t require any actual programming to do so.</li>
<li>In this article we have a great walkthrough for users on creating a new ported application, and eventually binary package, on OpenBSD</li>
<li>As mentioned in the tutorial, a good starting place is always an existing port, which can you use as a template for your new creation. Tip: Try to pick something similar, I.E. python for a python app, Qt for Qt, etc.</li>
<li>This tutorial will first walk you through the process of creating your Makefile and related description about the new port. </li>
<li>Once you’ve created the initial Makefile, there are a bunch of new “make” targets you can begin to run to try building your port, everything from “make fetch” to “make makesum” and “make package”. Using these tests you can verify that your port is correct and results in the installable package/app you wanted.
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151116152318" rel="nofollow">Status update on pledge(2)</a></h3>

<ul>
<li>OpenBSD has been working very aggressively to convert much of their base system applications to using pledge(2) “Formerly Tame(2))</li>
<li>Theo has provided a great status update on where that stands as of right now and the numbers look like the following:</li>
<li>Out of 600 ELF binaries, 368 of them have been updated to utilize pledge(2) in some manner</li>
<li>This is quite a few, and includes everything from openssl, ping, sftp, grep, gzip and much more</li>
<li>There are still a number of “pledge-able” commands waiting for conversion, such as login, sysctl, nfsd, ssh and others.</li>
<li>He also mentions that there does exist some subset of commands which aren’t viable pledge(2) candidates, such as simple things like “true”, or commands like reboot/mount or even perl itself. 
***</li>
</ul>

<h3><a href="https://onion.io/omega/" rel="nofollow">FreeBSD booting on the Onion Omega</a></h3>

<ul>
<li>Tiny $19 MIPS SoC ($25 with dock that provides built in mini-USB Serial interface, power supply, LED lights, GPIO expansion, USB port, etc)</li>
<li>A number of pluggable ‘expansions’ are available, including:

<ul>
<li>Arduino Dock (connect the Omega device to your existing Arduino components)</li>
<li>Blue Tooth Lower Energy</li>
<li>10/100 Ethernet Port</li>
<li>Relay expansion (2 relays each, can stack up to 8 expansions to control 16 relays)</li>
<li>Servo expansion (control up to 16 PWM servos, like robotic arms or camera mounts)</li>
<li>OLED expansion (1&quot; monochrome 128x64 OLED display)</li>
<li>Thermal Printer Kit (includes all wiring and other components)</li>
</ul></li>
<li>The device is the product of a successful <a href="https://www.kickstarter.com/projects/onion/onion-omega-invention-platform-for-the-internet-of/description" rel="nofollow">Kick Starter campaign</a> from March of this year</li>
<li>Specs:</li>
<li>Atheros AR9330 rev1 400MHZ MIPS 24K</li>
<li>64MB DDR2 400MHz</li>
<li>16MB Flash </li>
<li>802.11b/g/n 150Mbps Atheros Wifi + 100mbps Atheros Wired Ethernet</li>
<li>18 GPIO Pins</li>
<li>USB Controller</li>
<li>Using the <a href="https://github.com/freebsd/freebsd-wifi-build/wiki" rel="nofollow">freebsd-wifi-build</a> tool, I was able to build a new firmware for the device based on a profile for a similar device based on the same Atheros chip. I hope to have time to validate some of the settings and get them posted up into the wiki and get the kernel configuration committed to FreeBSD in the next week or two</li>
<li>It is an interesting device compared to the TP-Link WDR3600’s we did at BSDCan, as it has twice as much flash, leaving more room for the system image, but only half as much ram, and a slower CPU
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/SSHPerf" rel="nofollow">SSH Performance testing</a></h3>

<ul>
<li>There has <a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058244.html" rel="nofollow">been a discussion</a>  about the value of upkeeping the HPN (High Performance Networking) patch to OpenSSH in the base system of FreeBSD</li>
<li>As part of this, I did some fresh benchmarks on my pair of new high end servers</li>
<li>The remaining part to be done is testing different levels of latency</li>
<li>By tweaking the socket buffer sizes, I was able to saturate the full 10 gigabit with netcat, iperf, etc</li>
<li>From the tests that have been done so far, it doesn’t look like even the NONE cipher can reach that level of performance because of the MAC (Message Authentication Code)</li>
<li>It does appear that some of the auto-tuning in HPN is not worked as expected</li>
<li>Explicitly setting -oTcpRcvBuf=7168 (KB) is enough to saturate a gigabit with 50ms RTT (round trip time)
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.ixsystems.com/whats-new/seagl-2015/" rel="nofollow">iX gives an overview of FreeBSD at SeaGl 2015</a> </li>
<li><a href="http://www.freenas.org/whats-new/2015/11/zfs-zil-and-slog-demystified.html" rel="nofollow">On the FreeNAS Blog, Michael Dexter explains the ZFS Intent Log and SLOG </a> </li>
</ul>

<h2>Interview - George Wilson - <a href="mailto:wilzun@gmail.com" rel="nofollow">wilzun@gmail.com</a> / <a href="https://twitter.com/zfsdude" rel="nofollow">@zfsdude</a></h2>

<ul>
<li>OpenZFS and Delphix
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151105223808" rel="nofollow">Nicholas Marriott has replaced the aging version of less(1) in OpenBSD</a></h3>

<ul>
<li>Sometimes less isn’t more, it’s just less</li>
<li>In this story, we have news that the old version of less(1) in OpenBSD has now been ripped out in favor of the more modern fork from illumos founder Garrett D’Amore.</li>
<li>In addition to being a “more” modern version, it also includes far “less” of the portability code, uses terminfo, replacing termcap and is more POSIX compliant. 
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058522.html" rel="nofollow">FreeBSD gets initial support for advanced SMR drives </a></h3>

<ul>
<li>Kenneth D. Merry <a href="mailto:ken@freebsd.org" rel="nofollow">ken@freebsd.org</a> has developed initial support for Host Managed, and Host Aware Shingled Magnetic Recording drives in FreeBSD, available as a patch against both -current and 10-stable</li>
<li>“This includes support for Host Managed, Host Aware and Drive Managed SMRdrives that are either SCSI (ZBC) or ATA (ZAC) attached via a SAScontroller.  This does not include support for SMR ATA drives attached viaan ATA controller.  Also, I have not yet figured out how to properly detecta Host Managed ATA drive, so this code won&#39;t do that.”</li>
<li>SMR drives have overlapping tracks, because the read head can be much smaller than the write head</li>
<li>The drawback to this approach is that writes to the disk must take place in 256 MB “zones” that must be written from the beginning</li>
<li>New features in the patch:</li>
<li>A new &#39;camcontrol zone&#39; command that allows displaying and managing drive zones via SCSI/ATA passthrough.

<ul>
<li>A new zonectl(8) utility that uses the new DIOCZONECMD ioctl to display and manage zones via the da(4) (and later ada(4)) driver.</li>
<li>Changes to diskinfo -v to display the zone mode of a drive.</li>
<li>A new disk zone API, sys/sys/disk_zone.h.</li>
<li>A new bio type, BIO_ZONE, and modifications to GEOM to support it.  This new bio will allow filesystems to query zone support in a drive and manage zoned drives.</li>
</ul></li>
<li>Extensive modifications to the da(4) driver to handle probing SCSI and SATA behind SAS SMR drives.

<ul>
<li>Additional CAM CDB building functions for zone commands.</li>
</ul></li>
<li>“We (Spectra Logic) are working on ZFS changes that will use this CAM and GEOM infrastructure to make ZFS play well with SMR drives.  Those changes aren&#39;t yet done.”</li>
<li>It is good to see active development in this area, especially from experts in archival storage</li>
<li>A <a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058521.html" rel="nofollow">second patch</a> is also offered, that improves the pass(4) passthrough interface for disks, and introduces a new camdd(8) command, a version of dd that uses the pass(4) interface, kqueue, and separate reader/writer threads for improved performance</li>
<li>He also presents a feature wishlist that includes some interesting benchmarking features, including a ‘sink’ mode, where reads from the device are just thrown away, rather than having to write then to /dev/null
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151112212739" rel="nofollow">Initial implemtnation of 802.11n now in iwm(4)</a></h3>

<ul>
<li>OpenBSD laptop users rejoice! 802.11n has landed!</li>
<li>Initially only for the iwm(4) driver, support is planned for other devices in the future</li>
<li>Includes support for all the required (non-optional) bits to make 802.11N functional</li>
<li>Adds a new 11n mode to ifmedia, and MCS (modulation coding scheme) that sits alongside the ieee80211_rateset structure. </li>
<li>No support for MIMO / SGI (Short Guard Interval) or 40 MHz wide-channels, but perhaps we will see those in a future update.</li>
<li>They are asking users for testing against a wide variety of any/all APs!
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=290038" rel="nofollow">Freebsd adds support for Bluetooth LE Security Management</a></h3>

<ul>
<li>FreeBSD + BlueTooth, not something we discuss a lot about, but it is still under active development.</li>
<li>The most recently added features come from Takanori Watanabe, and adds new LE Security Management. </li>
<li>Specifically, it enables support for BLE Security Manager Protocol(SMP), and enables a userland tool to wait for the underlying HCI connection to be encrypted.
***</li>
</ul>

<h3><a href="http://0xfeedface.org/2015/11/07/hbsd-opnsense.html" rel="nofollow">Building OpnSense on HardenedBSD</a></h3>

<ul>
<li>Looking for a way to further Harden your router? We have a tutorial from the HardenedBSD developer, Shawn Webb, about how to build OpnSense on HBSD 10-STABLE.</li>
<li>You’ll need to first be running HBSD 10-STABLE somewhere, in this article he is using bhyve for the builder VM.</li>
<li>The build process itself is mostly pretty straight-forward, but there are a number of different repos that all have to be checked out, so pay attention to which goes where. 
+In this example he does a targeted build for a Netgate RCC-VE-4860, but you can pick your particular build. 
***</li>
</ul>

<h2>Beastie Bits</h2>

<p><a href="https://github.com/gliaskos/freebsd-chromium/issues/40" rel="nofollow">1 BTC bounty for chromium bug!</a></p>

<p><a href="http://www.desktopbsd.net/forums/threads/desktopbsd-2-0-m1-released.806/" rel="nofollow">DesktopBSD 2.0 M1 released</a></p>

<p><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-October/458500.html" rel="nofollow">By implementing asynchronous pru_attach for UDP, Sepherosa Ziehau has increased connect rate by around 15K connections per second</a></p>

<p><a href="http://lists.nycbug.org/pipermail/talk/2015-October/016384.html" rel="nofollow">Stephen Bourne, known for the Bourne Shell, will be giving a talk at NYCBUG this week</a> </p>

<p><a href="http://lists.nycbug.org/pipermail/talk/2015-October/016390.html" rel="nofollow">Tor Browser 5.0.3 for OpenBSD released</a></p>

<ul>
<li><a href="https://torbsd.github.io/" rel="nofollow">The Tor BSD Diversity Project</a> aim to

<ul>
<li>Increase the number of Tor relays running BSDs. We envision this happening by increasing the total number of relays, with the addition of more BSD users running relays;</li>
<li>Make the Tor Browser available under BSD operating systems using native packaging mechanisms. Our first target is OpenBSD;</li>
<li>Engage the broader BSD community about the Tor anonymity network and the place that BSD Unix should occupy in the privacy community at large.</li>
</ul></li>
</ul>

<p><a href="https://anders.unix.se/2015/10/28/screenshots-from-developers--unix-people-2002/" rel="nofollow">Screenshots from Unix People circa 2002</a> </p>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21xTyirkO" rel="nofollow">Dominik - Bhyve Setup</a></li>
<li><a href="http://slexy.org/view/s2YVi7ULlJ" rel="nofollow"> John - beadm + GELI </a></li>
<li><a href="http://slexy.org/view/s20lRTaZSy" rel="nofollow"> Darrall - ZFS + RAID = Problems</a></li>
<li><a href="http://slexy.org/view/s2omNWdTBU" rel="nofollow"> Hamza - Which shell?</a></li>
<li><a href="http://slexy.org/view/s21Y8bPbnm" rel="nofollow"> Amenia - FreeBSD routing</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>115: Controlling the Transmissions</title>
  <link>https://www.bsdnow.tv/115</link>
  <guid isPermaLink="false">b30ad3ce-cbcf-4d14-8d50-f41bd6f0b74a</guid>
  <pubDate>Wed, 11 Nov 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b30ad3ce-cbcf-4d14-8d50-f41bd6f0b74a.mp3" length="68483380" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Controlling the Transmissions</itunes:subtitle>
  <itunes:duration>1:35:06</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Controlling the Transmissions
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
FreeBSD 2015 Vendor Dev Summit (https://wiki.freebsd.org/201511VendorDevSummit)
FreeBSD Quarterly Status Report - Third Quarter 2015 (https://www.freebsd.org/news/status/report-2015-07-2015-09.html)
We have a fresh quarterly status report from the FreeBSD project. Once again it almost merits an entire show, but we will try to hit all the highlights. 
Bhyve - Porting of the Intel edk2 UEFI firmware, allowing Windows in headless mode, and Illumos support. Also porting to ARM has begun!
Improved Support for Acer C720 ChromeBooks
High Availability Clustering in CTL (Cam Target Layer)
Root Remounting (Similar to pivot_root in Linux). This work allows using “reboot -r” to do a fast-reboot, with a partial shutdown, kill all processes, and re-mount rootfs and boot. Especially useful for booting from mfs or similar then transitioning to iscsi or some other backing storage
OpenCL Support in Mesa, as well as kernel progress on the i915 driver
Improved support for UEFI FrameBuffer on a bunch of recent MacBook Pro and other Macs, in addition to improvements to “vt” framebuffer driver for high resolution displays. 
ZFS support for UEFI Boot (Needs testing, but used in PC-BSD for a couple months now), and importing new features from IllumOS (resumable send, receive prefetch, replication checksumming, 50% less ram required for L2ARC, better prefetch)
DTrace SDT probes added to TCP code, to replace the old TCPDEBUG kernel option. Recompiling the kernel is no longer required to debug TCP, just use DTrace
Ongoing work to bring us a native port/package of GitLab
***
Meteor, the popular javascript web application framework has been forked to run on FreeBSD, OpenBSD and NetBSD - FreeBSD testers requested (https://forums.meteor.com/t/freebsd-testers-please/12919/10)
We have a public call for testing for FreeBSD users of Meteor by Tom Freudenberg
The included link includes all the details on how to currently get meteor boot-strapped on your box and bring up the server
So far the reports are positive, many users reporting that it is running on their 10.2 systems / jails just fine. 
Just a day ago the original porter mentioned that OpenBSD is ready to go for testing using the prepared dev bundle. 
***
Mike Larkin work continues on an native OpenBSD hypervisor, which he has announced is now booting (http://undeadly.org/cgi?action=article&amp;amp;sid=20151101223132)
Speaking of OpenBSD, we have an update from Mike Larkin about the status of the OpenBSD native hypervisor vmm(4). 
His twitter post included the output from a successful VM bootup of OpenBSD 5.8-current, all the way to multi-user
While the code hasn’t been committed (yet) we will keep you informed when it lands so you too can begin playing with it. 
***
This is how I like open source (http://blog.etoilebsd.net/post/This_is_how_I_like_opensource)
A blog post by FreeBSD Core Team member, and one of the lead developers of pkg, Baptiste Daroussin
One project he has been working on is string collation
Garrett d'Amore (of IllumOS) implemented unicode string collation while working for Nexenta and made it BSD license
John Marino (from Dragonfly) imported the work done on Illumos into Dragonfly, while he was doing that he decided, it was probably a good idea to rework how locales are handled
He discovered that Edwin Groothuis (from FreeBSD) had long ago started a project to simplify locales handling on FreeBSD
He extended the tools written by Edwin and has been able to update Dragonfly to the latest (v27 so far) unicode definitions
John Marino has worked with Bapt many times on various projects (including bringing pkg and ports to Dragonfly)
Bapt decided it was time that FreeBSD got proper string collation support as well, and worked with John to import the support to FreeBSD
Bapt spotted a couple of bugs and worked with John on fixing them: issues with eucJP encoding, issues with Russian encoding (John did most of the work on tracking down and fixing the bugs), Bapt also converted localedef (the tool to generate the locales) into using BSD license only code (original version used the CDDL libavl library which I modified to use tree(3)), fixed issues. I also took the locale generation from Edwin (extended by John)
This work resulted in a nice flow of patches going from Dragonfly to FreeBSD and from FreeBSD to Dragonfly.
And now Garrett is interested in grabbing back our patches into Illumos!
The result of this collaboration is that now 3 OS share the same implementation for collation support! This is very good because when one discovers a bug the 3 of them benefit the fix!
The biggest win here is that this was a lot of work, and not an area that many people are interested in working on, so it was especially important to share the work rather than reimplement it separately.
***
Interview - Hiren Panchasara - hiren@freebsd.org (mailto:hiren@freebsd.org) / @hirenpanchasara (https://twitter.com/hirenpanchasara)
Improving TCP
***
iXsystems
MissonComplete winners (https://www.ixsystems.com/whats-new/october-missioncomplete-winners/)
***
News Roundup
LibreSSL 2.3.1 released (http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.1-relnotes.txt)
LibreSSl keeps on chugging, the latest release has landed, 2.3.1, which is the second snapshot based upon the OpenBSD 5.9 development branch.
Currently they are targeting a stable ABI/API sometime around March 2016 for the 2.3.X series.
Included in this update are ASN. 1 cleanups and some compliance fixes for RFC5280
Switched internally to timet, with a check that the host OS supports 64bit timet
Various TLS fixes, including the ability to check cert validity times with tlspeercert_not{before|after}
Fixed a reported memory leak in OBJ_obj2txt
***
Guide for Installing Ghost w/ Nginx on FreeBSD (http://linoxide.com/linux-how-to/install-ghost-nginx-freebsd-10-2/)
A nice walkthrough for the week, we’ve found an article about how to install the Ghost blogging platform on FreeBSD 10.2. 
For those who don’t know, Ghost is a MIT licensed blogging tool, started in 2012 by a former WordPress UI developer and is entirely coded in Node.js
While a port for FreeBSD does not yet exist (somebody get on that please), this tutorial can walk you through the process of getting it deployed manually
Most of the requirements are simple, www/node, www/npm and sqlite3. 
With those installed, most of the steps are simply creating the username / home for ghost, and some “npm” setup. 
The walkthrough even includes a handy rc.d script, making the possibility of a port seem much more likely
***
Adrian Chadd on 'Why attention to detail matters when you're a kernel developer (http://adrianchadd.blogspot.com/2015/10/fixing-up-qca9558-performance-on.html)
Adrian was correctly trolled in the FreeBSD embedded IRC chatroom and started looking at why the bridging performance in MIPS boards was so bad
120-150 mbit/sec is not really enough anymore
Using previous MIPS24k support as a starting point, Adrian managed to get HWPMC (Hardware Performance Monitoring Counters) working on MIPS74k
Using the data collected from the performance counters Adrian was able to figure out that packets were being copied in order to meet alignment requirements of the NIC and the FreeBSD networking stack. It turns out this is no longer a requirement for most modern Atheros NICs, so the workaround could be removed
Now performance was 180 mbit/sec
Next, on the receive side, only the TCP stack requires strict alignment, the ethernet stack does not, so offset the start point by 2 bytes so that TCP ends up aligned, and problem solved. Or not, no performance difference...
The problem appeared to be busdma, Ian Lepore had recently made improves in this area on armv6 and helpfully ported these over to MIPS
Now 420 mbit/sec. Getting better, but not as fast as Linux
After some further investigation, a missing ‘sync’ operation was added, and the memory caching was changed from writethrough to writeback
Things were so fast now, that the descriptor ring was being run through the ring so quickly as to hit the next descriptor that is still being setup. The first was to mark the first descriptor of a multi-descriptor packet as ‘empty’ until the entire chain was setup, so it would not be processed before the latter bits were done being added to the ring.
So now MIPS can bridge at 720 mbit/sec, and route 320 mbit/sec
Adrian wants to improve the routing speed and get it caught up to the bridging speed, but as always, free time is scarce.
***
Switching from OS X to FreeBSD (http://mirrorshades.net/post/132753032310)
The story of a user who had used OS X since its beta, but 10.9 and 10.10, became more and more dissatisfied
They found they were spending too much time fighting with the system, rather than getting work done
They cover the new workstation they bought, and the process of getting FreeBSD going on it, including why they chose FreeBSD rather than PCBSD
Also covered it setting up a Lenovo X220 laptop
They setup the i3wm and mutt
The blog is very detailed and goes so far as to share a github repo of dotfiles and configuration files to ease the transition from OS X.
***
BeastieBits
The Stack behind Netflix's scaling (http://www.scalescale.com/the-stack-behind-netflix-scaling/)
The Amiga port of NetBSD now has xorg support (https://mail-index.netbsd.org/source-changes/2015/11/04/msg069873.html)
NetBSD has announced EOL for v5.x to be November 9th (http://blog.netbsd.org/tnf/entry/end_of_life_for_netbsd)
RetroArch ports allow playing PlayStation, Sega, Atari, etc., games on FreeBSD (https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058266.html)
OpenBSD booting on a 75mhz Cyrex system with 32MB RAM (http://gfycat.com/InnocentSneakyEwe)
Matthew Green reports Nouveau Nvidia can support GL with his latest commit (http://mail-index.netbsd.org/source-changes/2015/10/29/msg069729.html)
Releases!
OPNsense releases 15.7.18 (https://opnsense.org/opnsense-15-7-18-released/)
pfSense releases 2.2.5 (https://blog.pfsense.org/?p=1925)
Feedback/Questions
 Eric (http://slexy.org/view/s2ogdURldm)
 Andrew (http://slexy.org/view/s22bK2LZLm)
 Joseph (http://slexy.org/view/s2to6ZpBTc)
 Sean (http://slexy.org/view/s2oLU0KM7Y)
 Dustin (http://slexy.org/view/s21k6oKvle)
***
For those of you curious about Kris' new lighting here are the links to what he is using.
Softbox Light Diffuser (http://smile.amazon.com/gp/product/B00OTG6474?psc=1&amp;amp;redirect=true&amp;amp;ref_=oh_aui_detailpage_o01_s00&amp;amp;pldnSite=1)
Full Spectrum 5500K CFL Bulb (http://smile.amazon.com/gp/product/B00198U6U6?psc=1&amp;amp;redirect=true&amp;amp;ref_=oh_aui_detailpage_o06_s00)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Controlling the Transmissions</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="https://wiki.freebsd.org/201511VendorDevSummit" rel="nofollow">FreeBSD 2015 Vendor Dev Summit</a></h3>

<hr>

<h3><a href="https://www.freebsd.org/news/status/report-2015-07-2015-09.html" rel="nofollow">FreeBSD Quarterly Status Report - Third Quarter 2015</a></h3>

<ul>
<li>We have a fresh quarterly status report from the FreeBSD project. Once again it almost merits an entire show, but we will try to hit all the highlights. </li>
<li>Bhyve - Porting of the Intel edk2 UEFI firmware, allowing Windows in headless mode, and Illumos support. Also porting to ARM has begun!</li>
<li>Improved Support for Acer C720 ChromeBooks</li>
<li>High Availability Clustering in CTL (Cam Target Layer)</li>
<li>Root Remounting (Similar to pivot_root in Linux). This work allows using “reboot -r” to do a fast-reboot, with a partial shutdown, kill all processes, and re-mount rootfs and boot. Especially useful for booting from mfs or similar then transitioning to iscsi or some other backing storage</li>
<li>OpenCL Support in Mesa, as well as kernel progress on the i915 driver</li>
<li>Improved support for UEFI FrameBuffer on a bunch of recent MacBook Pro and other Macs, in addition to improvements to “vt” framebuffer driver for high resolution displays. </li>
<li>ZFS support for UEFI Boot (Needs testing, but used in PC-BSD for a couple months now), and importing new features from IllumOS (resumable send, receive prefetch, replication checksumming, 50% less ram required for L2ARC, better prefetch)</li>
<li>DTrace SDT probes added to TCP code, to replace the old TCPDEBUG kernel option. Recompiling the kernel is no longer required to debug TCP, just use DTrace</li>
<li>Ongoing work to bring us a native port/package of GitLab
***</li>
</ul>

<h3><a href="https://forums.meteor.com/t/freebsd-testers-please/12919/10" rel="nofollow">Meteor, the popular javascript web application framework has been forked to run on FreeBSD, OpenBSD and NetBSD - FreeBSD testers requested</a></h3>

<ul>
<li>We have a public call for testing for FreeBSD users of Meteor by Tom Freudenberg</li>
<li>The included link includes all the details on how to currently get meteor boot-strapped on your box and bring up the server</li>
<li>So far the reports are positive, many users reporting that it is running on their 10.2 systems / jails just fine. </li>
<li>Just a day ago the original porter mentioned that OpenBSD is ready to go for testing using the prepared dev bundle. 
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151101223132" rel="nofollow">Mike Larkin work continues on an native OpenBSD hypervisor, which he has announced is now booting</a></h3>

<ul>
<li>Speaking of OpenBSD, we have an update from Mike Larkin about the status of the OpenBSD native hypervisor vmm(4). </li>
<li>His twitter post included the output from a successful VM bootup of OpenBSD 5.8-current, all the way to multi-user</li>
<li>While the code hasn’t been committed (yet) we will keep you informed when it lands so you too can begin playing with it. 
***</li>
</ul>

<h3><a href="http://blog.etoilebsd.net/post/This_is_how_I_like_opensource" rel="nofollow">This is how I like open source</a></h3>

<ul>
<li>A blog post by FreeBSD Core Team member, and one of the lead developers of pkg, Baptiste Daroussin</li>
<li>One project he has been working on is string collation</li>
<li>Garrett d&#39;Amore (of IllumOS) implemented unicode string collation while working for Nexenta and made it BSD license</li>
<li>John Marino (from Dragonfly) imported the work done on Illumos into Dragonfly, while he was doing that he decided, it was probably a good idea to rework how locales are handled</li>
<li>He discovered that Edwin Groothuis (from FreeBSD) had long ago started a project to simplify locales handling on FreeBSD</li>
<li>He extended the tools written by Edwin and has been able to update Dragonfly to the latest (v27 so far) unicode definitions</li>
<li>John Marino has worked with Bapt many times on various projects (including bringing pkg and ports to Dragonfly)</li>
<li>Bapt decided it was time that FreeBSD got proper string collation support as well, and worked with John to import the support to FreeBSD</li>
<li>Bapt spotted a couple of bugs and worked with John on fixing them: issues with eucJP encoding, issues with Russian encoding (John did most of the work on tracking down and fixing the bugs), Bapt also converted localedef (the tool to generate the locales) into using BSD license only code (original version used the CDDL libavl library which I modified to use tree(3)), fixed issues. I also took the locale generation from Edwin (extended by John)</li>
<li>This work resulted in a nice flow of patches going from Dragonfly to FreeBSD and from FreeBSD to Dragonfly.</li>
<li>And now Garrett is interested in grabbing back our patches into Illumos!</li>
<li>The result of this collaboration is that now 3 OS share the same implementation for collation support! This is very good because when one discovers a bug the 3 of them benefit the fix!</li>
<li>The biggest win here is that this was a lot of work, and not an area that many people are interested in working on, so it was especially important to share the work rather than reimplement it separately.
***</li>
</ul>

<h2>Interview - Hiren Panchasara - <a href="mailto:hiren@freebsd.org" rel="nofollow">hiren@freebsd.org</a> / <a href="https://twitter.com/hirenpanchasara" rel="nofollow">@hirenpanchasara</a></h2>

<ul>
<li>Improving TCP
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.ixsystems.com/whats-new/october-missioncomplete-winners/" rel="nofollow">MissonComplete winners</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.1-relnotes.txt" rel="nofollow">LibreSSL 2.3.1 released</a></h3>

<ul>
<li>LibreSSl keeps on chugging, the latest release has landed, 2.3.1, which is the second snapshot based upon the OpenBSD 5.9 development branch.</li>
<li>Currently they are targeting a stable ABI/API sometime around March 2016 for the 2.3.X series.</li>
<li>Included in this update are ASN. 1 cleanups and some compliance fixes for RFC5280</li>
<li>Switched internally to time_t, with a check that the host OS supports 64bit time_t</li>
<li>Various TLS fixes, including the ability to check cert validity times with tls_peer_cert_not{before|after}</li>
<li>Fixed a reported memory leak in OBJ_obj2txt
***</li>
</ul>

<h3><a href="http://linoxide.com/linux-how-to/install-ghost-nginx-freebsd-10-2/" rel="nofollow">Guide for Installing Ghost w/ Nginx on FreeBSD</a></h3>

<ul>
<li>A nice walkthrough for the week, we’ve found an article about how to install the Ghost blogging platform on FreeBSD 10.2. </li>
<li>For those who don’t know, Ghost is a MIT licensed blogging tool, started in 2012 by a former WordPress UI developer and is entirely coded in Node.js</li>
<li>While a port for FreeBSD does not yet exist (somebody get on that please), this tutorial can walk you through the process of getting it deployed manually</li>
<li>Most of the requirements are simple, www/node, www/npm and sqlite3. </li>
<li>With those installed, most of the steps are simply creating the username / home for ghost, and some “npm” setup. </li>
<li>The walkthrough even includes a handy rc.d script, making the possibility of a port seem much more likely
***</li>
</ul>

<h3><a href="http://adrianchadd.blogspot.com/2015/10/fixing-up-qca9558-performance-on.html" rel="nofollow">Adrian Chadd on &#39;Why attention to detail matters when you&#39;re a kernel developer</a></h3>

<ul>
<li>Adrian was correctly trolled in the FreeBSD embedded IRC chatroom and started looking at why the bridging performance in MIPS boards was so bad</li>
<li>120-150 mbit/sec is not really enough anymore</li>
<li>Using previous MIPS24k support as a starting point, Adrian managed to get HWPMC (Hardware Performance Monitoring Counters) working on MIPS74k</li>
<li>Using the data collected from the performance counters Adrian was able to figure out that packets were being copied in order to meet alignment requirements of the NIC and the FreeBSD networking stack. It turns out this is no longer a requirement for most modern Atheros NICs, so the workaround could be removed</li>
<li>Now performance was 180 mbit/sec</li>
<li>Next, on the receive side, only the TCP stack requires strict alignment, the ethernet stack does not, so offset the start point by 2 bytes so that TCP ends up aligned, and problem solved. Or not, no performance difference...</li>
<li>The problem appeared to be busdma, Ian Lepore had recently made improves in this area on armv6 and helpfully ported these over to MIPS</li>
<li>Now 420 mbit/sec. Getting better, but not as fast as Linux</li>
<li>After some further investigation, a missing ‘sync’ operation was added, and the memory caching was changed from writethrough to writeback</li>
<li>Things were so fast now, that the descriptor ring was being run through the ring so quickly as to hit the next descriptor that is still being setup. The first was to mark the first descriptor of a multi-descriptor packet as ‘empty’ until the entire chain was setup, so it would not be processed before the latter bits were done being added to the ring.</li>
<li>So now MIPS can bridge at 720 mbit/sec, and route 320 mbit/sec</li>
<li>Adrian wants to improve the routing speed and get it caught up to the bridging speed, but as always, free time is scarce.
***</li>
</ul>

<h3><a href="http://mirrorshades.net/post/132753032310" rel="nofollow">Switching from OS X to FreeBSD</a></h3>

<ul>
<li>The story of a user who had used OS X since its beta, but 10.9 and 10.10, became more and more dissatisfied</li>
<li>They found they were spending too much time fighting with the system, rather than getting work done</li>
<li>They cover the new workstation they bought, and the process of getting FreeBSD going on it, including why they chose FreeBSD rather than PCBSD</li>
<li>Also covered it setting up a Lenovo X220 laptop</li>
<li>They setup the i3wm and mutt</li>
<li>The blog is very detailed and goes so far as to share a github repo of dotfiles and configuration files to ease the transition from OS X.
***</li>
</ul>

<h2>BeastieBits</h2>

<h3><a href="http://www.scalescale.com/the-stack-behind-netflix-scaling/" rel="nofollow">The Stack behind Netflix&#39;s scaling</a></h3>

<hr>

<h3><a href="https://mail-index.netbsd.org/source-changes/2015/11/04/msg069873.html" rel="nofollow">The Amiga port of NetBSD now has xorg support</a></h3>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/end_of_life_for_netbsd" rel="nofollow">NetBSD has announced EOL for v5.x to be November 9th</a></h3>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058266.html" rel="nofollow">RetroArch ports allow playing PlayStation, Sega, Atari, etc., games on FreeBSD</a></h3>

<h3><a href="http://gfycat.com/InnocentSneakyEwe" rel="nofollow">OpenBSD booting on a 75mhz Cyrex system with 32MB RAM</a></h3>

<hr>

<h3><a href="http://mail-index.netbsd.org/source-changes/2015/10/29/msg069729.html" rel="nofollow">Matthew Green reports Nouveau Nvidia can support GL with his latest commit</a></h3>

<hr>

<h3>Releases!</h3>

<p><a href="https://opnsense.org/opnsense-15-7-18-released/" rel="nofollow">OPNsense releases 15.7.18</a></p>

<p><a href="https://blog.pfsense.org/?p=1925" rel="nofollow">pfSense releases 2.2.5</a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2ogdURldm" rel="nofollow"> Eric</a></li>
<li><a href="http://slexy.org/view/s22bK2LZLm" rel="nofollow"> Andrew</a></li>
<li><a href="http://slexy.org/view/s2to6ZpBTc" rel="nofollow"> Joseph</a></li>
<li><a href="http://slexy.org/view/s2oLU0KM7Y" rel="nofollow"> Sean</a></li>
<li><a href="http://slexy.org/view/s21k6oKvle" rel="nofollow"> Dustin</a>
***</li>
</ul>

<h3>For those of you curious about Kris&#39; new lighting here are the links to what he is using.</h3>

<ul>
<li><a href="http://smile.amazon.com/gp/product/B00OTG6474?psc=1&redirect=true&ref_=oh_aui_detailpage_o01_s00&pldnSite=1" rel="nofollow">Softbox Light Diffuser</a></li>
<li><a href="http://smile.amazon.com/gp/product/B00198U6U6?psc=1&redirect=true&ref_=oh_aui_detailpage_o06_s00" rel="nofollow">Full Spectrum 5500K CFL Bulb</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Controlling the Transmissions</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="https://wiki.freebsd.org/201511VendorDevSummit" rel="nofollow">FreeBSD 2015 Vendor Dev Summit</a></h3>

<hr>

<h3><a href="https://www.freebsd.org/news/status/report-2015-07-2015-09.html" rel="nofollow">FreeBSD Quarterly Status Report - Third Quarter 2015</a></h3>

<ul>
<li>We have a fresh quarterly status report from the FreeBSD project. Once again it almost merits an entire show, but we will try to hit all the highlights. </li>
<li>Bhyve - Porting of the Intel edk2 UEFI firmware, allowing Windows in headless mode, and Illumos support. Also porting to ARM has begun!</li>
<li>Improved Support for Acer C720 ChromeBooks</li>
<li>High Availability Clustering in CTL (Cam Target Layer)</li>
<li>Root Remounting (Similar to pivot_root in Linux). This work allows using “reboot -r” to do a fast-reboot, with a partial shutdown, kill all processes, and re-mount rootfs and boot. Especially useful for booting from mfs or similar then transitioning to iscsi or some other backing storage</li>
<li>OpenCL Support in Mesa, as well as kernel progress on the i915 driver</li>
<li>Improved support for UEFI FrameBuffer on a bunch of recent MacBook Pro and other Macs, in addition to improvements to “vt” framebuffer driver for high resolution displays. </li>
<li>ZFS support for UEFI Boot (Needs testing, but used in PC-BSD for a couple months now), and importing new features from IllumOS (resumable send, receive prefetch, replication checksumming, 50% less ram required for L2ARC, better prefetch)</li>
<li>DTrace SDT probes added to TCP code, to replace the old TCPDEBUG kernel option. Recompiling the kernel is no longer required to debug TCP, just use DTrace</li>
<li>Ongoing work to bring us a native port/package of GitLab
***</li>
</ul>

<h3><a href="https://forums.meteor.com/t/freebsd-testers-please/12919/10" rel="nofollow">Meteor, the popular javascript web application framework has been forked to run on FreeBSD, OpenBSD and NetBSD - FreeBSD testers requested</a></h3>

<ul>
<li>We have a public call for testing for FreeBSD users of Meteor by Tom Freudenberg</li>
<li>The included link includes all the details on how to currently get meteor boot-strapped on your box and bring up the server</li>
<li>So far the reports are positive, many users reporting that it is running on their 10.2 systems / jails just fine. </li>
<li>Just a day ago the original porter mentioned that OpenBSD is ready to go for testing using the prepared dev bundle. 
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151101223132" rel="nofollow">Mike Larkin work continues on an native OpenBSD hypervisor, which he has announced is now booting</a></h3>

<ul>
<li>Speaking of OpenBSD, we have an update from Mike Larkin about the status of the OpenBSD native hypervisor vmm(4). </li>
<li>His twitter post included the output from a successful VM bootup of OpenBSD 5.8-current, all the way to multi-user</li>
<li>While the code hasn’t been committed (yet) we will keep you informed when it lands so you too can begin playing with it. 
***</li>
</ul>

<h3><a href="http://blog.etoilebsd.net/post/This_is_how_I_like_opensource" rel="nofollow">This is how I like open source</a></h3>

<ul>
<li>A blog post by FreeBSD Core Team member, and one of the lead developers of pkg, Baptiste Daroussin</li>
<li>One project he has been working on is string collation</li>
<li>Garrett d&#39;Amore (of IllumOS) implemented unicode string collation while working for Nexenta and made it BSD license</li>
<li>John Marino (from Dragonfly) imported the work done on Illumos into Dragonfly, while he was doing that he decided, it was probably a good idea to rework how locales are handled</li>
<li>He discovered that Edwin Groothuis (from FreeBSD) had long ago started a project to simplify locales handling on FreeBSD</li>
<li>He extended the tools written by Edwin and has been able to update Dragonfly to the latest (v27 so far) unicode definitions</li>
<li>John Marino has worked with Bapt many times on various projects (including bringing pkg and ports to Dragonfly)</li>
<li>Bapt decided it was time that FreeBSD got proper string collation support as well, and worked with John to import the support to FreeBSD</li>
<li>Bapt spotted a couple of bugs and worked with John on fixing them: issues with eucJP encoding, issues with Russian encoding (John did most of the work on tracking down and fixing the bugs), Bapt also converted localedef (the tool to generate the locales) into using BSD license only code (original version used the CDDL libavl library which I modified to use tree(3)), fixed issues. I also took the locale generation from Edwin (extended by John)</li>
<li>This work resulted in a nice flow of patches going from Dragonfly to FreeBSD and from FreeBSD to Dragonfly.</li>
<li>And now Garrett is interested in grabbing back our patches into Illumos!</li>
<li>The result of this collaboration is that now 3 OS share the same implementation for collation support! This is very good because when one discovers a bug the 3 of them benefit the fix!</li>
<li>The biggest win here is that this was a lot of work, and not an area that many people are interested in working on, so it was especially important to share the work rather than reimplement it separately.
***</li>
</ul>

<h2>Interview - Hiren Panchasara - <a href="mailto:hiren@freebsd.org" rel="nofollow">hiren@freebsd.org</a> / <a href="https://twitter.com/hirenpanchasara" rel="nofollow">@hirenpanchasara</a></h2>

<ul>
<li>Improving TCP
***</li>
</ul>

<h2>iXsystems</h2>

<ul>
<li><a href="https://www.ixsystems.com/whats-new/october-missioncomplete-winners/" rel="nofollow">MissonComplete winners</a>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.1-relnotes.txt" rel="nofollow">LibreSSL 2.3.1 released</a></h3>

<ul>
<li>LibreSSl keeps on chugging, the latest release has landed, 2.3.1, which is the second snapshot based upon the OpenBSD 5.9 development branch.</li>
<li>Currently they are targeting a stable ABI/API sometime around March 2016 for the 2.3.X series.</li>
<li>Included in this update are ASN. 1 cleanups and some compliance fixes for RFC5280</li>
<li>Switched internally to time_t, with a check that the host OS supports 64bit time_t</li>
<li>Various TLS fixes, including the ability to check cert validity times with tls_peer_cert_not{before|after}</li>
<li>Fixed a reported memory leak in OBJ_obj2txt
***</li>
</ul>

<h3><a href="http://linoxide.com/linux-how-to/install-ghost-nginx-freebsd-10-2/" rel="nofollow">Guide for Installing Ghost w/ Nginx on FreeBSD</a></h3>

<ul>
<li>A nice walkthrough for the week, we’ve found an article about how to install the Ghost blogging platform on FreeBSD 10.2. </li>
<li>For those who don’t know, Ghost is a MIT licensed blogging tool, started in 2012 by a former WordPress UI developer and is entirely coded in Node.js</li>
<li>While a port for FreeBSD does not yet exist (somebody get on that please), this tutorial can walk you through the process of getting it deployed manually</li>
<li>Most of the requirements are simple, www/node, www/npm and sqlite3. </li>
<li>With those installed, most of the steps are simply creating the username / home for ghost, and some “npm” setup. </li>
<li>The walkthrough even includes a handy rc.d script, making the possibility of a port seem much more likely
***</li>
</ul>

<h3><a href="http://adrianchadd.blogspot.com/2015/10/fixing-up-qca9558-performance-on.html" rel="nofollow">Adrian Chadd on &#39;Why attention to detail matters when you&#39;re a kernel developer</a></h3>

<ul>
<li>Adrian was correctly trolled in the FreeBSD embedded IRC chatroom and started looking at why the bridging performance in MIPS boards was so bad</li>
<li>120-150 mbit/sec is not really enough anymore</li>
<li>Using previous MIPS24k support as a starting point, Adrian managed to get HWPMC (Hardware Performance Monitoring Counters) working on MIPS74k</li>
<li>Using the data collected from the performance counters Adrian was able to figure out that packets were being copied in order to meet alignment requirements of the NIC and the FreeBSD networking stack. It turns out this is no longer a requirement for most modern Atheros NICs, so the workaround could be removed</li>
<li>Now performance was 180 mbit/sec</li>
<li>Next, on the receive side, only the TCP stack requires strict alignment, the ethernet stack does not, so offset the start point by 2 bytes so that TCP ends up aligned, and problem solved. Or not, no performance difference...</li>
<li>The problem appeared to be busdma, Ian Lepore had recently made improves in this area on armv6 and helpfully ported these over to MIPS</li>
<li>Now 420 mbit/sec. Getting better, but not as fast as Linux</li>
<li>After some further investigation, a missing ‘sync’ operation was added, and the memory caching was changed from writethrough to writeback</li>
<li>Things were so fast now, that the descriptor ring was being run through the ring so quickly as to hit the next descriptor that is still being setup. The first was to mark the first descriptor of a multi-descriptor packet as ‘empty’ until the entire chain was setup, so it would not be processed before the latter bits were done being added to the ring.</li>
<li>So now MIPS can bridge at 720 mbit/sec, and route 320 mbit/sec</li>
<li>Adrian wants to improve the routing speed and get it caught up to the bridging speed, but as always, free time is scarce.
***</li>
</ul>

<h3><a href="http://mirrorshades.net/post/132753032310" rel="nofollow">Switching from OS X to FreeBSD</a></h3>

<ul>
<li>The story of a user who had used OS X since its beta, but 10.9 and 10.10, became more and more dissatisfied</li>
<li>They found they were spending too much time fighting with the system, rather than getting work done</li>
<li>They cover the new workstation they bought, and the process of getting FreeBSD going on it, including why they chose FreeBSD rather than PCBSD</li>
<li>Also covered it setting up a Lenovo X220 laptop</li>
<li>They setup the i3wm and mutt</li>
<li>The blog is very detailed and goes so far as to share a github repo of dotfiles and configuration files to ease the transition from OS X.
***</li>
</ul>

<h2>BeastieBits</h2>

<h3><a href="http://www.scalescale.com/the-stack-behind-netflix-scaling/" rel="nofollow">The Stack behind Netflix&#39;s scaling</a></h3>

<hr>

<h3><a href="https://mail-index.netbsd.org/source-changes/2015/11/04/msg069873.html" rel="nofollow">The Amiga port of NetBSD now has xorg support</a></h3>

<hr>

<h3><a href="http://blog.netbsd.org/tnf/entry/end_of_life_for_netbsd" rel="nofollow">NetBSD has announced EOL for v5.x to be November 9th</a></h3>

<hr>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-November/058266.html" rel="nofollow">RetroArch ports allow playing PlayStation, Sega, Atari, etc., games on FreeBSD</a></h3>

<h3><a href="http://gfycat.com/InnocentSneakyEwe" rel="nofollow">OpenBSD booting on a 75mhz Cyrex system with 32MB RAM</a></h3>

<hr>

<h3><a href="http://mail-index.netbsd.org/source-changes/2015/10/29/msg069729.html" rel="nofollow">Matthew Green reports Nouveau Nvidia can support GL with his latest commit</a></h3>

<hr>

<h3>Releases!</h3>

<p><a href="https://opnsense.org/opnsense-15-7-18-released/" rel="nofollow">OPNsense releases 15.7.18</a></p>

<p><a href="https://blog.pfsense.org/?p=1925" rel="nofollow">pfSense releases 2.2.5</a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2ogdURldm" rel="nofollow"> Eric</a></li>
<li><a href="http://slexy.org/view/s22bK2LZLm" rel="nofollow"> Andrew</a></li>
<li><a href="http://slexy.org/view/s2to6ZpBTc" rel="nofollow"> Joseph</a></li>
<li><a href="http://slexy.org/view/s2oLU0KM7Y" rel="nofollow"> Sean</a></li>
<li><a href="http://slexy.org/view/s21k6oKvle" rel="nofollow"> Dustin</a>
***</li>
</ul>

<h3>For those of you curious about Kris&#39; new lighting here are the links to what he is using.</h3>

<ul>
<li><a href="http://smile.amazon.com/gp/product/B00OTG6474?psc=1&redirect=true&ref_=oh_aui_detailpage_o01_s00&pldnSite=1" rel="nofollow">Softbox Light Diffuser</a></li>
<li><a href="http://smile.amazon.com/gp/product/B00198U6U6?psc=1&redirect=true&ref_=oh_aui_detailpage_o06_s00" rel="nofollow">Full Spectrum 5500K CFL Bulb</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>114: BSD-Schooling</title>
  <link>https://www.bsdnow.tv/114</link>
  <guid isPermaLink="false">c2648e61-e485-4213-a0de-d1afa10c713f</guid>
  <pubDate>Wed, 04 Nov 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c2648e61-e485-4213-a0de-d1afa10c713f.mp3" length="64337620" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week, Allan is out of town at another Developer Summit, but we have a great episode coming</itunes:subtitle>
  <itunes:duration>1:29:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week, Allan is out of town at another Developer Summit, but we have a great episode coming
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, 
Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
WhatsApp founder, on how it got so HUGE (http://www.wired.com/2015/10/whatsapps-co-founder-on-how-the-iconoclastic-app-got-huge/)
Wired has interviewed WhatsApp co-founder Brian Acton, about the infrastructure behind WhatsApp
WhatsApp manages 900 million users with a team of 50, while Twitter needs around 4,000 employees to manage 300 million users.
“FreeBSD has a nicely tuned network stack and extremely good reliability. We find managing FreeBSD installations to be quite straightforward.”
“Linux is a beast of complexity. FreeBSD has the advantage of being a single distribution with an extraordinarily good ports collection.”
“To us, it has been an advantage as we have had very few problems that have occurred at the OS level. With Linux, you tend to have to wrangle more and you want to avoid that if you can.”
“FreeBSD happened because both Jan and I have experience with FreeBSD from Yahoo!.”
Additional Coverage  (http://uk.businessinsider.com/whatsapp-built-using-erlang-and-freebsd-2015-10) 
***
User feedback in the SystemD vs BSD init (https://www.textplain.net/blog/2015/problems-with-systemd-and-why-i-like-bsd-init/)
We have a very detailed blog post this week from Randy Westlund, about his experiences on Linux and BSD, contrasting the init systems.
What he finds is that while, it does make some things easier, such as writing a service file once, and having it run everywhere, the tradeoff comes in the complexity and lack of transparency. 
Another area of concern was the reproducibility of boots, how in his examples on servers, there can often be times when services start in different orders, to save a few moments of boot-time.
His take on the simplicity of BSD’s startup scripts is that they are very easy to hack on and monitor, while not introducing the feature creep we have seen in sysd. 
It will be interesting to see NextBSD / LaunchD and how it compares in the future!
***
Learn to embrace open source, or get buried (http://opensource.com/business/15/10/ato-interview-jim-salter)
At the recent “All Things Open” conference, opensource.com interviewed Jim Salter
He describes how he first got started using FreeBSD to host his personal website
He then goes on to talk about starting FreeBSDWiki.net and what its goals were
The interview then talks about using Open Source at solve customers’ problems at his consulting firm
Finally, the talks about his presentation at AllThingsOpen: Move Over, Rsync 
 (http://allthingsopen.org/talks/move-over-rsync/) about switching to ZFS replication
***
HP’s CTO Urges businesses to avoid permissive licenses  (http://lwn.net/Articles/660428/)
Martin Fink went on a rant about the negative effects of license proliferation
While I agree that having too many new licenses is confusing and adds difficulty, I didn’t agree with his closing point
“He then ended the session with an extended appeal to move the open-source software industry away from permissive licenses like Apache 2.0 and toward copyleft licenses like the GPL”
“The Apache 2.0 license is currently the most widely used "permissive" license. But the thing that developers overlook when adopting it, he said, is that by using Apache they are also making a choice about how much work they will have to put into building any sort of community around the project. If you look at Apache-licensed projects, he noted, "you'll find that they are very top-heavy with 'governance' structures." Technical committees, working groups, and various boards, he said, are needed to make such projects function. But if you look at copyleft projects, he added, you find that those structures simply are not needed.”
There are plenty of smaller permissively licensed projects that do not have this sort of structure, infact, most of this structure comes from being an Apache run project, rather than from using the Apache or any other permissive license
Luckily, he goes on to state that the “OpenSwitch code is released under the Apache 2.0 license, he said, because the other partner companies viewed that as a requirement.”
“HP wanted to get networking companies and hardware suppliers on board. In order to get all of the legal departments at all of the partners to sign on to the project, he said, HP was forced to go with a permissive license”
Hopefully the trend towards permissive licenses continues
Additionally, in a separate LWN post:
RMS Says: “I am not saying that competitors to a GNU package are unjust or bad -- that isn't necessarily so. The pertinent point is that they are competitors. The goal of the GNU Project is for GNU to win the competition. Each GNU package is a part of the GNU system, and should contribute to the success of the GNU Project. Thus, each GNU package should encourage people to run other GNU packages rather than their competitors -- even competitors which are free software.”  (http://lwn.net/Articles/659757/) 
Never thought I’d see RMS espousing vendor lock-in
***
Interview - Brian Callahan - bcallah@devio.us (mailto:bcallah@devio.us) / @twitter (https://twitter.com/__briancallahan)
The BSDs in Education
***
News Roundup
Digital Libraries in Africa making use of DragonflyBSD and HAMMER (http://lists.dragonflybsd.org/pipermail/users/2015-October/228403.html)
In the international development context, we have an interesting post from Michael Wilson of the PeerCorps Trust Fund.
They are using DragonFlyBSD and FreeBSD to support the Tanzanian Digital Library Initiative in very resource-limited settings.  
They cite among the most important reasons for using BSD as the availability and quality of the documentation, as well as the robustness of the filesystems, both ZFS and HAMMER.
Their website is now online over at (http://www.tandli.com/) , check it out to see exactly how BSD is being used in the field
***
netflix hits &amp;gt; 65gbps from a single freebsd box (https://twitter.com/ed_maste/status/655120086248763396)
A single socket server, with a high end Xeon E5 processor and a dual ported Chelsio T580 (2x 40 Gbps ports) set a netflix record pushing over 65 Gbps of traffic from a single machine
The videos were being pushed from SSDs and some new high end NVMe devices
The previous record at Netflix was 52 Gbps from a single machine, but only with very experimental settings. The current work is under much more typical settings
By the end of that night, traffic surged to over 70 Gbps
Only about 10-15% of that traffic was encrypted with the in-kernel TLS engine that Netflix has been working on with John-Mark Gurney
It was reported that the machine was only using about 65% cpu, and had plenty of head room
If I remember the discussion correctly, there were about 60,000 streams running off the machine
***
Lumina Desktop 0.8.7 has been released (http://lumina-desktop.org/lumina-desktop-0-8-7-released/)
A very large update has landed for PC-BSD’s Lumina desktop
A brand new “Start” menu has been added, which enables quick launch of favorite apps, pinning to desktop / favorites and more.
Desktop icons have been overhauled, with better font support, and a new Grid system for placement of icons.
Support for other BSD’s such as DragonFly has been improved, along with TONS of internal changes to functionality and backends.
Almost too many things to list here, but the link above will have full details, along with screenshots.
***
A LiveUSB for NetBSD has been released by Jibbed (http://www.jibbed.org/)
After a three year absence, the Jibbed project has come back with a Live USB image for NetBSD!
The image contains NetBSD 7.0, and is fully R/W, allowing you to run the entire system from a single USB drive.
Images are available for 8Gb and 4Gb sticks (64bit and 32bit respectively), along with VirtualBox images as well
For those wanting X, it includes both X and TWM, although ‘pkgin’ is available, so you can quickly add other desktops to the image
***
Beastie Bits
After recent discussions of revisiting W^X support in Mozilla Firefox, David Coppa has flipped the switch to enable it for OpenBSD users running -current. (http://undeadly.org/cgi?action=article&amp;amp;sid=20151021191401&amp;amp;mode=expanded)
Using the vt(4) driver to change console resolution (http://lme.postach.io/post/changing-console-resolution-in-freebsd-10-with-vt-4) 
The FreeBSD Foundation gives a great final overview of the Grace Hopper Conference (http://freebsdfoundation.blogspot.com/2015/10/conference-recap-grace-hopper.html)
A dialog about Compilers in the (BSD) base system (https://medium.com/@jmmv/compilers-in-the-bsd-base-system-1c4515a18c49)
One upping their 48-core work from July, The Semihalf team shows off their the 96-core SMP support for FreeBSD on Cavium ThunderX (ARMv8 architecture (https://www.youtube.com/watch?v=1q5aDEt18mw)
NYC Bug's November meeting will be featuring a talk by Stephen R. Bourne (http://lists.nycbug.org/pipermail/talk/2015-October/016384.html)
New not-just-BSD postcast, hosted by two OpenBSD devs Brandon Mercer and Joshua Stein (http://garbage.fm/)
Feedback/Questions
 Stefan  (http://slexy.org/view/s21wjbhCJ4) 
 Zach  (http://slexy.org/view/s21TbKS5t0) 
 Jake  (http://slexy.org/view/s20AkO1i1R) 
 Corey  (http://slexy.org/view/s2nrUMatU5) 
 Robroy  (http://slexy.org/view/s2pZsC7arX) 
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to 
feedback@bsdnow.tv (mailto:feedback@bsdnow.tv) 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week, Allan is out of town at another Developer Summit, but we have a great episode coming</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" <br>
alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" <br>
title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, <br>
Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://www.wired.com/2015/10/whatsapps-co-founder-on-how-the-iconoclastic-app-got-huge/" rel="nofollow">WhatsApp founder, on how it got so HUGE</a></h3>

<ul>
<li>Wired has interviewed WhatsApp co-founder Brian Acton, about the infrastructure behind WhatsApp</li>
<li>WhatsApp manages 900 million users with a team of 50, while Twitter needs around 4,000 employees to manage 300 million users.</li>
<li>“FreeBSD has a nicely tuned network stack and extremely good reliability. We find managing FreeBSD installations to be quite straightforward.”</li>
<li>“Linux is a beast of complexity. FreeBSD has the advantage of being a single distribution with an extraordinarily good ports collection.”</li>
<li>“To us, it has been an advantage as we have had very few problems that have occurred at the OS level. With Linux, you tend to have to wrangle more and you want to avoid that if you can.”</li>
<li>“FreeBSD happened because both Jan and I have experience with FreeBSD from Yahoo!.”</li>
<li><a href="http://uk.businessinsider.com/whatsapp-built-using-erlang-and-freebsd-2015-10" rel="nofollow">Additional Coverage </a> 
***</li>
</ul>

<h3><a href="https://www.textplain.net/blog/2015/problems-with-systemd-and-why-i-like-bsd-init/" rel="nofollow">User feedback in the SystemD vs BSD init</a></h3>

<ul>
<li>We have a very detailed blog post this week from Randy Westlund, about his experiences on Linux and BSD, contrasting the init systems.</li>
<li>What he finds is that while, it does make some things easier, such as writing a service file once, and having it run everywhere, the tradeoff comes in the complexity and lack of transparency. </li>
<li>Another area of concern was the reproducibility of boots, how in his examples on servers, there can often be times when services start in different orders, to save a few moments of boot-time.</li>
<li>His take on the simplicity of BSD’s startup scripts is that they are very easy to hack on and monitor, while not introducing the feature creep we have seen in sysd. </li>
<li>It will be interesting to see NextBSD / LaunchD and how it compares in the future!
***</li>
</ul>

<h3><a href="http://opensource.com/business/15/10/ato-interview-jim-salter" rel="nofollow">Learn to embrace open source, or get buried</a></h3>

<ul>
<li>At the recent “All Things Open” conference, opensource.com interviewed Jim Salter</li>
<li>He describes how he first got started using FreeBSD to host his personal website</li>
<li>He then goes on to talk about starting FreeBSDWiki.net and what its goals were</li>
<li>The interview then talks about using Open Source at solve customers’ problems at his consulting firm</li>
<li>Finally, the talks about his presentation at AllThingsOpen: <a href="http://allthingsopen.org/talks/move-over-rsync/" rel="nofollow">Move Over, Rsync 
</a> about switching to ZFS replication
***</li>
</ul>

<h3><a href="http://lwn.net/Articles/660428/" rel="nofollow">HP’s CTO Urges businesses to avoid permissive licenses </a></h3>

<ul>
<li>Martin Fink went on a rant about the negative effects of license proliferation</li>
<li>While I agree that having too many new licenses is confusing and adds difficulty, I didn’t agree with his closing point</li>
<li>“He then ended the session with an extended appeal to move the open-source software industry away from permissive licenses like Apache 2.0 and toward copyleft licenses like the GPL”</li>
<li>“The Apache 2.0 license is currently the most widely used &quot;permissive&quot; license. But the thing that developers overlook when adopting it, he said, is that by using Apache they are also making a choice about how much work they will have to put into building any sort of community around the project. If you look at Apache-licensed projects, he noted, &quot;you&#39;ll find that they are very top-heavy with &#39;governance&#39; structures.&quot; Technical committees, working groups, and various boards, he said, are needed to make such projects function. But if you look at copyleft projects, he added, you find that those structures simply are not needed.”</li>
<li>There are plenty of smaller permissively licensed projects that do not have this sort of structure, infact, most of this structure comes from being an Apache run project, rather than from using the Apache or any other permissive license</li>
<li>Luckily, he goes on to state that the “OpenSwitch code is released under the Apache 2.0 license, he said, because the other partner companies viewed that as a requirement.”</li>
<li>“HP wanted to get networking companies and hardware suppliers on board. In order to get all of the legal departments at all of the partners to sign on to the project, he said, HP was forced to go with a permissive license”</li>
<li>Hopefully the trend towards permissive licenses continues</li>
<li>Additionally, in a separate LWN post:</li>
<li><a href="http://lwn.net/Articles/659757/" rel="nofollow">RMS Says: “I am not saying that competitors to a GNU package are unjust or bad -- that isn&#39;t necessarily so. The pertinent point is that they are <em>competitors</em>. The goal of the GNU Project is for GNU to win the competition. Each GNU package is a part of the GNU system, and should contribute to the success of the GNU Project. Thus, each GNU package should encourage people to run other GNU packages rather than their competitors -- even competitors which are free software.” </a> </li>
<li>Never thought I’d see RMS espousing vendor lock-in
***</li>
</ul>

<h2>Interview - Brian Callahan - <a href="mailto:bcallah@devio.us" rel="nofollow">bcallah@devio.us</a> / <a href="https://twitter.com/__briancallahan" rel="nofollow">@twitter</a></h2>

<ul>
<li>The BSDs in Education
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-October/228403.html" rel="nofollow">Digital Libraries in Africa making use of DragonflyBSD and HAMMER</a></h3>

<ul>
<li>In the international development context, we have an interesting post from Michael Wilson of the PeerCorps Trust Fund.</li>
<li>They are using DragonFlyBSD and FreeBSD to support the Tanzanian Digital Library Initiative in very resource-limited settings.<br></li>
<li>They cite among the most important reasons for using BSD as the availability and quality of the documentation, as well as the robustness of the filesystems, both ZFS and HAMMER.</li>
<li>Their website is now online over at (<a href="http://www.tandli.com/" rel="nofollow">http://www.tandli.com/</a>) , check it out to see exactly how BSD is being used in the field
***</li>
</ul>

<h3><a href="https://twitter.com/ed_maste/status/655120086248763396" rel="nofollow">netflix hits &gt; 65gbps from a single freebsd box</a></h3>

<ul>
<li>A single socket server, with a high end Xeon E5 processor and a dual ported Chelsio T580 (2x 40 Gbps ports) set a netflix record pushing over 65 Gbps of traffic from a single machine</li>
<li>The videos were being pushed from SSDs and some new high end NVMe devices</li>
<li>The previous record at Netflix was 52 Gbps from a single machine, but only with very experimental settings. The current work is under much more typical settings</li>
<li>By the end of that night, traffic surged to over 70 Gbps</li>
<li>Only about 10-15% of that traffic was encrypted with the in-kernel TLS engine that Netflix has been working on with John-Mark Gurney</li>
<li>It was reported that the machine was only using about 65% cpu, and had plenty of head room</li>
<li>If I remember the discussion correctly, there were about 60,000 streams running off the machine
***</li>
</ul>

<h3><a href="http://lumina-desktop.org/lumina-desktop-0-8-7-released/" rel="nofollow">Lumina Desktop 0.8.7 has been released</a></h3>

<ul>
<li>A very large update has landed for PC-BSD’s Lumina desktop</li>
<li>A brand new “Start” menu has been added, which enables quick launch of favorite apps, pinning to desktop / favorites and more.</li>
<li>Desktop icons have been overhauled, with better font support, and a new Grid system for placement of icons.</li>
<li>Support for other BSD’s such as DragonFly has been improved, along with TONS of internal changes to functionality and backends.</li>
<li>Almost too many things to list here, but the link above will have full details, along with screenshots.
***</li>
</ul>

<h3><a href="http://www.jibbed.org/" rel="nofollow">A LiveUSB for NetBSD has been released by Jibbed</a></h3>

<ul>
<li>After a three year absence, the Jibbed project has come back with a Live USB image for NetBSD!</li>
<li>The image contains NetBSD 7.0, and is fully R/W, allowing you to run the entire system from a single USB drive.</li>
<li>Images are available for 8Gb and 4Gb sticks (64bit and 32bit respectively), along with VirtualBox images as well</li>
<li>For those wanting X, it includes both X and TWM, although ‘pkgin’ is available, so you can quickly add other desktops to the image
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20151021191401&mode=expanded" rel="nofollow">After recent discussions of revisiting W<sup>X</sup> support in Mozilla Firefox, David Coppa has flipped the switch to enable it for OpenBSD users running -current.</a></p></li>
<li><p><a href="http://lme.postach.io/post/changing-console-resolution-in-freebsd-10-with-vt-4" rel="nofollow">Using the vt(4) driver to change console resolution</a> </p></li>
<li><p><a href="http://freebsdfoundation.blogspot.com/2015/10/conference-recap-grace-hopper.html" rel="nofollow">The FreeBSD Foundation gives a great final overview of the Grace Hopper Conference</a></p></li>
<li><p><a href="https://medium.com/@jmmv/compilers-in-the-bsd-base-system-1c4515a18c49" rel="nofollow">A dialog about Compilers in the (BSD) base system</a></p></li>
<li><p><a href="https://www.youtube.com/watch?v=1q5aDEt18mw" rel="nofollow">One upping their 48-core work from July, The Semihalf team shows off their the 96-core SMP support for FreeBSD on Cavium ThunderX (ARMv8 architecture</a></p></li>
</ul>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2015-October/016384.html" rel="nofollow">NYC Bug&#39;s November meeting will be featuring a talk by Stephen R. Bourne</a></h3>

<h3><a href="http://garbage.fm/" rel="nofollow">New not-just-BSD postcast, hosted by two OpenBSD devs Brandon Mercer and Joshua Stein</a></h3>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21wjbhCJ4" rel="nofollow"> Stefan </a> </li>
<li><a href="http://slexy.org/view/s21TbKS5t0" rel="nofollow"> Zach </a> </li>
<li><a href="http://slexy.org/view/s20AkO1i1R" rel="nofollow"> Jake </a> </li>
<li><a href="http://slexy.org/view/s2nrUMatU5" rel="nofollow"> Corey </a> </li>
<li><p><a href="http://slexy.org/view/s2pZsC7arX" rel="nofollow"> Robroy </a> </p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <br>
<a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week, Allan is out of town at another Developer Summit, but we have a great episode coming</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" <br>
alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" <br>
title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, <br>
Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://www.wired.com/2015/10/whatsapps-co-founder-on-how-the-iconoclastic-app-got-huge/" rel="nofollow">WhatsApp founder, on how it got so HUGE</a></h3>

<ul>
<li>Wired has interviewed WhatsApp co-founder Brian Acton, about the infrastructure behind WhatsApp</li>
<li>WhatsApp manages 900 million users with a team of 50, while Twitter needs around 4,000 employees to manage 300 million users.</li>
<li>“FreeBSD has a nicely tuned network stack and extremely good reliability. We find managing FreeBSD installations to be quite straightforward.”</li>
<li>“Linux is a beast of complexity. FreeBSD has the advantage of being a single distribution with an extraordinarily good ports collection.”</li>
<li>“To us, it has been an advantage as we have had very few problems that have occurred at the OS level. With Linux, you tend to have to wrangle more and you want to avoid that if you can.”</li>
<li>“FreeBSD happened because both Jan and I have experience with FreeBSD from Yahoo!.”</li>
<li><a href="http://uk.businessinsider.com/whatsapp-built-using-erlang-and-freebsd-2015-10" rel="nofollow">Additional Coverage </a> 
***</li>
</ul>

<h3><a href="https://www.textplain.net/blog/2015/problems-with-systemd-and-why-i-like-bsd-init/" rel="nofollow">User feedback in the SystemD vs BSD init</a></h3>

<ul>
<li>We have a very detailed blog post this week from Randy Westlund, about his experiences on Linux and BSD, contrasting the init systems.</li>
<li>What he finds is that while, it does make some things easier, such as writing a service file once, and having it run everywhere, the tradeoff comes in the complexity and lack of transparency. </li>
<li>Another area of concern was the reproducibility of boots, how in his examples on servers, there can often be times when services start in different orders, to save a few moments of boot-time.</li>
<li>His take on the simplicity of BSD’s startup scripts is that they are very easy to hack on and monitor, while not introducing the feature creep we have seen in sysd. </li>
<li>It will be interesting to see NextBSD / LaunchD and how it compares in the future!
***</li>
</ul>

<h3><a href="http://opensource.com/business/15/10/ato-interview-jim-salter" rel="nofollow">Learn to embrace open source, or get buried</a></h3>

<ul>
<li>At the recent “All Things Open” conference, opensource.com interviewed Jim Salter</li>
<li>He describes how he first got started using FreeBSD to host his personal website</li>
<li>He then goes on to talk about starting FreeBSDWiki.net and what its goals were</li>
<li>The interview then talks about using Open Source at solve customers’ problems at his consulting firm</li>
<li>Finally, the talks about his presentation at AllThingsOpen: <a href="http://allthingsopen.org/talks/move-over-rsync/" rel="nofollow">Move Over, Rsync 
</a> about switching to ZFS replication
***</li>
</ul>

<h3><a href="http://lwn.net/Articles/660428/" rel="nofollow">HP’s CTO Urges businesses to avoid permissive licenses </a></h3>

<ul>
<li>Martin Fink went on a rant about the negative effects of license proliferation</li>
<li>While I agree that having too many new licenses is confusing and adds difficulty, I didn’t agree with his closing point</li>
<li>“He then ended the session with an extended appeal to move the open-source software industry away from permissive licenses like Apache 2.0 and toward copyleft licenses like the GPL”</li>
<li>“The Apache 2.0 license is currently the most widely used &quot;permissive&quot; license. But the thing that developers overlook when adopting it, he said, is that by using Apache they are also making a choice about how much work they will have to put into building any sort of community around the project. If you look at Apache-licensed projects, he noted, &quot;you&#39;ll find that they are very top-heavy with &#39;governance&#39; structures.&quot; Technical committees, working groups, and various boards, he said, are needed to make such projects function. But if you look at copyleft projects, he added, you find that those structures simply are not needed.”</li>
<li>There are plenty of smaller permissively licensed projects that do not have this sort of structure, infact, most of this structure comes from being an Apache run project, rather than from using the Apache or any other permissive license</li>
<li>Luckily, he goes on to state that the “OpenSwitch code is released under the Apache 2.0 license, he said, because the other partner companies viewed that as a requirement.”</li>
<li>“HP wanted to get networking companies and hardware suppliers on board. In order to get all of the legal departments at all of the partners to sign on to the project, he said, HP was forced to go with a permissive license”</li>
<li>Hopefully the trend towards permissive licenses continues</li>
<li>Additionally, in a separate LWN post:</li>
<li><a href="http://lwn.net/Articles/659757/" rel="nofollow">RMS Says: “I am not saying that competitors to a GNU package are unjust or bad -- that isn&#39;t necessarily so. The pertinent point is that they are <em>competitors</em>. The goal of the GNU Project is for GNU to win the competition. Each GNU package is a part of the GNU system, and should contribute to the success of the GNU Project. Thus, each GNU package should encourage people to run other GNU packages rather than their competitors -- even competitors which are free software.” </a> </li>
<li>Never thought I’d see RMS espousing vendor lock-in
***</li>
</ul>

<h2>Interview - Brian Callahan - <a href="mailto:bcallah@devio.us" rel="nofollow">bcallah@devio.us</a> / <a href="https://twitter.com/__briancallahan" rel="nofollow">@twitter</a></h2>

<ul>
<li>The BSDs in Education
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-October/228403.html" rel="nofollow">Digital Libraries in Africa making use of DragonflyBSD and HAMMER</a></h3>

<ul>
<li>In the international development context, we have an interesting post from Michael Wilson of the PeerCorps Trust Fund.</li>
<li>They are using DragonFlyBSD and FreeBSD to support the Tanzanian Digital Library Initiative in very resource-limited settings.<br></li>
<li>They cite among the most important reasons for using BSD as the availability and quality of the documentation, as well as the robustness of the filesystems, both ZFS and HAMMER.</li>
<li>Their website is now online over at (<a href="http://www.tandli.com/" rel="nofollow">http://www.tandli.com/</a>) , check it out to see exactly how BSD is being used in the field
***</li>
</ul>

<h3><a href="https://twitter.com/ed_maste/status/655120086248763396" rel="nofollow">netflix hits &gt; 65gbps from a single freebsd box</a></h3>

<ul>
<li>A single socket server, with a high end Xeon E5 processor and a dual ported Chelsio T580 (2x 40 Gbps ports) set a netflix record pushing over 65 Gbps of traffic from a single machine</li>
<li>The videos were being pushed from SSDs and some new high end NVMe devices</li>
<li>The previous record at Netflix was 52 Gbps from a single machine, but only with very experimental settings. The current work is under much more typical settings</li>
<li>By the end of that night, traffic surged to over 70 Gbps</li>
<li>Only about 10-15% of that traffic was encrypted with the in-kernel TLS engine that Netflix has been working on with John-Mark Gurney</li>
<li>It was reported that the machine was only using about 65% cpu, and had plenty of head room</li>
<li>If I remember the discussion correctly, there were about 60,000 streams running off the machine
***</li>
</ul>

<h3><a href="http://lumina-desktop.org/lumina-desktop-0-8-7-released/" rel="nofollow">Lumina Desktop 0.8.7 has been released</a></h3>

<ul>
<li>A very large update has landed for PC-BSD’s Lumina desktop</li>
<li>A brand new “Start” menu has been added, which enables quick launch of favorite apps, pinning to desktop / favorites and more.</li>
<li>Desktop icons have been overhauled, with better font support, and a new Grid system for placement of icons.</li>
<li>Support for other BSD’s such as DragonFly has been improved, along with TONS of internal changes to functionality and backends.</li>
<li>Almost too many things to list here, but the link above will have full details, along with screenshots.
***</li>
</ul>

<h3><a href="http://www.jibbed.org/" rel="nofollow">A LiveUSB for NetBSD has been released by Jibbed</a></h3>

<ul>
<li>After a three year absence, the Jibbed project has come back with a Live USB image for NetBSD!</li>
<li>The image contains NetBSD 7.0, and is fully R/W, allowing you to run the entire system from a single USB drive.</li>
<li>Images are available for 8Gb and 4Gb sticks (64bit and 32bit respectively), along with VirtualBox images as well</li>
<li>For those wanting X, it includes both X and TWM, although ‘pkgin’ is available, so you can quickly add other desktops to the image
***</li>
</ul>

<h3>Beastie Bits</h3>

<ul>
<li><p><a href="http://undeadly.org/cgi?action=article&sid=20151021191401&mode=expanded" rel="nofollow">After recent discussions of revisiting W<sup>X</sup> support in Mozilla Firefox, David Coppa has flipped the switch to enable it for OpenBSD users running -current.</a></p></li>
<li><p><a href="http://lme.postach.io/post/changing-console-resolution-in-freebsd-10-with-vt-4" rel="nofollow">Using the vt(4) driver to change console resolution</a> </p></li>
<li><p><a href="http://freebsdfoundation.blogspot.com/2015/10/conference-recap-grace-hopper.html" rel="nofollow">The FreeBSD Foundation gives a great final overview of the Grace Hopper Conference</a></p></li>
<li><p><a href="https://medium.com/@jmmv/compilers-in-the-bsd-base-system-1c4515a18c49" rel="nofollow">A dialog about Compilers in the (BSD) base system</a></p></li>
<li><p><a href="https://www.youtube.com/watch?v=1q5aDEt18mw" rel="nofollow">One upping their 48-core work from July, The Semihalf team shows off their the 96-core SMP support for FreeBSD on Cavium ThunderX (ARMv8 architecture</a></p></li>
</ul>

<h3><a href="http://lists.nycbug.org/pipermail/talk/2015-October/016384.html" rel="nofollow">NYC Bug&#39;s November meeting will be featuring a talk by Stephen R. Bourne</a></h3>

<h3><a href="http://garbage.fm/" rel="nofollow">New not-just-BSD postcast, hosted by two OpenBSD devs Brandon Mercer and Joshua Stein</a></h3>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21wjbhCJ4" rel="nofollow"> Stefan </a> </li>
<li><a href="http://slexy.org/view/s21TbKS5t0" rel="nofollow"> Zach </a> </li>
<li><a href="http://slexy.org/view/s20AkO1i1R" rel="nofollow"> Jake </a> </li>
<li><a href="http://slexy.org/view/s2nrUMatU5" rel="nofollow"> Corey </a> </li>
<li><p><a href="http://slexy.org/view/s2pZsC7arX" rel="nofollow"> Robroy </a> </p>

<hr></li>
<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <br>
<a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p></li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>113: What’s Next for BSD?</title>
  <link>https://www.bsdnow.tv/113</link>
  <guid isPermaLink="false">894b07bf-05ec-4da1-aeb5-9850cfdd6880</guid>
  <pubDate>Wed, 28 Oct 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/894b07bf-05ec-4da1-aeb5-9850cfdd6880.mp3" length="83640388" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up on this week’s episode, we have an interview</itunes:subtitle>
  <itunes:duration>2:19:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up on this week’s episode, we have an interview
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise 
Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud 
Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups 
for the Truly Paranoid"&gt;&lt;/a&gt;
iX Systems Mission Complete (https://www.ixsystems.com/missioncomplete/)
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
OpenBSD 5.8 is released on the 20th birthday of the OpenBSD project (http://bsdsec.net/articles/openbsd-5-8-released)
5.8 has landed, and just in time for the 20th birthday of OpenBSD, Oct 18th
A long list of changes can be found on the release announcement, but here’s a small scattering of them
Drivers for new hardware, such as:
rtwn = Realtek RTL8188CE wifi
hpb = HyperTransport bridge in IBM CPC945
Improved sensor support for upd driver (USB power devices)
Jumbo frame support on re driver, using RTL8168C/D/E/F/G and RTL8411
Updated to installer, improve autoinstall, and questions about SSH setup
Sudo in base has been replace with “doas”, sudo moved to package tree
New file(1) command with sandboxing and priv separation
The tame(2) API WiP
Improvements to the httpd(8) daemon, such as support for lua pattern matching redirections
Bugfixes and the security updates to OpenSMTPD 5.4.4
LibreSSL security fixes, removed SSLv3 support from openssl(1) (Still working on nuking SSLv3 from all ports)
And much more, too much to mention here, read the notes for all the gory details!
OpenBSD Developer Interviews
To go along with the 20th birthday, we have a whole slew of new interviews brought to us by the beastie.pl team. English and Polish are both provided, so be sure not to miss these!
Dmitrij D. Czarkoff (http://beastie.pl/deweloperzy-openbsd-dmitrij-d-czarkoff/)
Vadim Zhukov (http://beastie.pl/deweloperzy-openbsd-vadim-zhukov/)
Marc Espie (http://beastie.pl/deweloperzy-openbsd-marc-espie/)
Bryan Steele (http://beastie.pl/deweloperzy-openbsd-bryan-steele/) 
Ingo Schwarze (http://beastie.pl/deweloperzy-openbsd-ingo-schwarze/)
Gilles Chehade (http://beastie.pl/deweloperzy-openbsd-gilles-chehade/) 
Jean-Sébastien Pédron has submitted a call for testing out the neIntel i915 driver (http://lists.freebsd.org/pipermail/freebsd-x11/2015-October/016758.html)
A very eagerly awaited feature, Haswell GPU support has begun the testing process
The main developer, Jean-Sébastien Pédron dumbbell@freebsd.org  looking for users to test the patch, both those that have older supported cards (Sandybridge, Ivybridge) that are currently working, and users with Haswell devices that have, until now, not been supported
Included is a link to the Wiki with instructions on how to enable debugging, and grab the updated branch of FreeBSD with the graphical improvements. Jean-Sébastien is calling for testers to send results both good and bad over to the freebsd-x11 mailing lists
For those who want an “out of box solution” the next PC-BSD 11.0-CURRENT November images will include these changes as well
How to install FreeBSD on a Raspberry Pi 2 (http://www.cyberciti.biz/faq/how-to-install-freebsd-on-raspberry-pi-2-model-b/)
We have a nice walkthrough this week on how to install FreeBSD, both 
10 or 11-CURRENT on a RPi 2!
The walkthrough shows us how to use OSX to copy the image to SD card, 
then booting.
In this case, we have him using a USB to serial cable to capture 
output with screen
This is a pretty quick way for users sitting on a RPi2 to get up and 
running with FreeBSD 
Interview - Jordan Hubbard - jkh@ixsystems.com (mailto:email@email)
NextBSD (http://www.nextbsd.org/) | NextBSD Github (https://github.com/NextBSD/NextBSD)
Beastie Bits
OpenBSD's Source Tree turned 20 on October 18th (https://marc.info/?l=openbsd-misc&amp;amp;m=144515087006177&amp;amp;w=2)
GhostBSD working on Graphical ZFS Configuration Utility (https://plus.google.com/+GhostbsdOrg/posts/JoNZzrKrhtB)
EuroBSDcon 2014 videos finally online (https://www.youtube.com/channel/UCz6C-szau90f9Vn07A6W2aA/videos)
Postdoctoral research position at Memorial University is open (http://www.mun.ca/postdoc/tc-postdoc-2015.pdf)
NetBSD Security Advisory: TCP LAST_ACK memory exhaustion, reported by NetFlix and Juniper  (http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-009.txt.asc) 
DesktopBSD making a comeback? (http://www.desktopbsd.net/forums/threads/desktopbsd-2-0-roadmap.798/) 
Feedback/Questions
 Steve  (http://slexy.org/view/s20PllfFXt) 
 Ben  (http://slexy.org/view/s21jJm1lFN) 
 Frank  (http://slexy.org/view/s20TsrN3uq) 
 Tyler  (http://slexy.org/view/s20AydOevW)
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up on this week’s episode, we have an interview</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img <br>
src="/images/1.png" alt="iXsystems - Enterprise <br>
Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img <br>
src="/images/2.png" alt="DigitalOcean - Simple Cloud <br>
Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups <br>
for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://bsdsec.net/articles/openbsd-5-8-released" rel="nofollow">OpenBSD 5.8 is released on the 20th birthday of the OpenBSD project</a></h3>

<ul>
<li>5.8 has landed, and just in time for the 20th birthday of OpenBSD, Oct 18th</li>
<li>A long list of changes can be found on the release announcement, but here’s a small scattering of them</li>
<li>Drivers for new hardware, such as:

<ul>
<li>rtwn = Realtek RTL8188CE wifi</li>
<li>hpb = HyperTransport bridge in IBM CPC945</li>
<li>Improved sensor support for upd driver (USB power devices)</li>
<li>Jumbo frame support on re driver, using RTL8168C/D/E/F/G and RTL8411</li>
</ul></li>
<li>Updated to installer, improve autoinstall, and questions about SSH setup</li>
<li>Sudo in base has been replace with “doas”, sudo moved to package tree</li>
<li>New file(1) command with sandboxing and priv separation</li>
<li>The tame(2) API WiP</li>
<li>Improvements to the httpd(8) daemon, such as support for lua pattern matching redirections</li>
<li>Bugfixes and the security updates to OpenSMTPD 5.4.4</li>
<li>LibreSSL security fixes, removed SSLv3 support from openssl(1) (Still working on nuking SSLv3 from all ports)</li>
<li>And much more, too much to mention here, read the notes for all the gory details!</li>
</ul>

<hr>

<h2>OpenBSD Developer Interviews</h2>

<ul>
<li>To go along with the 20th birthday, we have a whole slew of new interviews brought to us by the beastie.pl team. English and Polish are both provided, so be sure not to miss these!

<ul>
<li><a href="http://beastie.pl/deweloperzy-openbsd-dmitrij-d-czarkoff/" rel="nofollow">Dmitrij D. Czarkoff</a></li>
<li><a href="http://beastie.pl/deweloperzy-openbsd-vadim-zhukov/" rel="nofollow">Vadim Zhukov</a></li>
<li><a href="http://beastie.pl/deweloperzy-openbsd-marc-espie/" rel="nofollow">Marc Espie</a></li>
<li><a href="http://beastie.pl/deweloperzy-openbsd-bryan-steele/" rel="nofollow">Bryan Steele</a> </li>
<li><a href="http://beastie.pl/deweloperzy-openbsd-ingo-schwarze/" rel="nofollow">Ingo Schwarze</a></li>
<li><a href="http://beastie.pl/deweloperzy-openbsd-gilles-chehade/" rel="nofollow">Gilles Chehade</a> </li>
</ul></li>
</ul>

<hr>

<h3><a href="http://lists.freebsd.org/pipermail/freebsd-x11/2015-October/016758.html" rel="nofollow">Jean-Sébastien Pédron has submitted a call for testing out the neIntel i915 driver</a></h3>

<ul>
<li>A very eagerly awaited feature, Haswell GPU support has begun the testing process</li>
<li>The main developer, Jean-Sébastien Pédron <a href="mailto:dumbbell@freebsd.org" rel="nofollow">dumbbell@freebsd.org</a>  looking for users to test the patch, both those that have older supported cards (Sandybridge, Ivybridge) that are currently working, and users with Haswell devices that have, until now, not been supported</li>
<li>Included is a link to the Wiki with instructions on how to enable debugging, and grab the updated branch of FreeBSD with the graphical improvements. Jean-Sébastien is calling for testers to send results both good and bad over to the freebsd-x11 mailing lists</li>
<li>For those who want an “out of box solution” the next PC-BSD 11.0-CURRENT November images will include these changes as well</li>
</ul>

<hr>

<h3><a href="http://www.cyberciti.biz/faq/how-to-install-freebsd-on-raspberry-pi-2-model-b/" rel="nofollow">How to install FreeBSD on a Raspberry Pi 2</a></h3>

<ul>
<li>We have a nice walkthrough this week on how to install FreeBSD, both 
10 or 11-CURRENT on a RPi 2!</li>
<li>The walkthrough shows us how to use OSX to copy the image to SD card, 
then booting.</li>
<li>In this case, we have him using a USB to serial cable to capture 
output with screen</li>
<li>This is a pretty quick way for users sitting on a RPi2 to get up and 
running with FreeBSD </li>
</ul>

<hr>

<h2>Interview - Jordan Hubbard - <a href="mailto:email@email" rel="nofollow">jkh@ixsystems.com</a></h2>

<p><a href="http://www.nextbsd.org/" rel="nofollow">NextBSD</a> | <a href="https://github.com/NextBSD/NextBSD" rel="nofollow">NextBSD Github</a></p>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://marc.info/?l=openbsd-misc&m=144515087006177&w=2" rel="nofollow">OpenBSD&#39;s Source Tree turned 20 on October 18th</a></p>

<p><a href="https://plus.google.com/+GhostbsdOrg/posts/JoNZzrKrhtB" rel="nofollow">GhostBSD working on Graphical ZFS Configuration Utility</a></p>

<p><a href="https://www.youtube.com/channel/UCz6C-szau90f9Vn07A6W2aA/videos" rel="nofollow">EuroBSDcon 2014 videos finally online</a></p>

<p><a href="http://www.mun.ca/postdoc/tc-postdoc-2015.pdf" rel="nofollow">Postdoctoral research position at Memorial University is open</a></p>

<p><a href="http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-009.txt.asc" rel="nofollow">NetBSD Security Advisory: TCP LAST_ACK memory exhaustion, reported by NetFlix and Juniper </a> </p>

<p><a href="http://www.desktopbsd.net/forums/threads/desktopbsd-2-0-roadmap.798/" rel="nofollow">DesktopBSD making a comeback?</a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20PllfFXt" rel="nofollow"> Steve </a> </li>
<li><a href="http://slexy.org/view/s21jJm1lFN" rel="nofollow"> Ben </a> </li>
<li><a href="http://slexy.org/view/s20TsrN3uq" rel="nofollow"> Frank </a> </li>
<li><a href="http://slexy.org/view/s20AydOevW" rel="nofollow"> Tyler </a></li>
</ul>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up on this week’s episode, we have an interview</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img <br>
src="/images/1.png" alt="iXsystems - Enterprise <br>
Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img <br>
src="/images/2.png" alt="DigitalOcean - Simple Cloud <br>
Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups <br>
for the Truly Paranoid" /></a></p>

<h4><a href="https://www.ixsystems.com/missioncomplete/" rel="nofollow">iX Systems Mission Complete</a></h4>

<ul>
<li>Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***</li>
</ul>

<h2>Headlines</h2>

<h3><a href="http://bsdsec.net/articles/openbsd-5-8-released" rel="nofollow">OpenBSD 5.8 is released on the 20th birthday of the OpenBSD project</a></h3>

<ul>
<li>5.8 has landed, and just in time for the 20th birthday of OpenBSD, Oct 18th</li>
<li>A long list of changes can be found on the release announcement, but here’s a small scattering of them</li>
<li>Drivers for new hardware, such as:

<ul>
<li>rtwn = Realtek RTL8188CE wifi</li>
<li>hpb = HyperTransport bridge in IBM CPC945</li>
<li>Improved sensor support for upd driver (USB power devices)</li>
<li>Jumbo frame support on re driver, using RTL8168C/D/E/F/G and RTL8411</li>
</ul></li>
<li>Updated to installer, improve autoinstall, and questions about SSH setup</li>
<li>Sudo in base has been replace with “doas”, sudo moved to package tree</li>
<li>New file(1) command with sandboxing and priv separation</li>
<li>The tame(2) API WiP</li>
<li>Improvements to the httpd(8) daemon, such as support for lua pattern matching redirections</li>
<li>Bugfixes and the security updates to OpenSMTPD 5.4.4</li>
<li>LibreSSL security fixes, removed SSLv3 support from openssl(1) (Still working on nuking SSLv3 from all ports)</li>
<li>And much more, too much to mention here, read the notes for all the gory details!</li>
</ul>

<hr>

<h2>OpenBSD Developer Interviews</h2>

<ul>
<li>To go along with the 20th birthday, we have a whole slew of new interviews brought to us by the beastie.pl team. English and Polish are both provided, so be sure not to miss these!

<ul>
<li><a href="http://beastie.pl/deweloperzy-openbsd-dmitrij-d-czarkoff/" rel="nofollow">Dmitrij D. Czarkoff</a></li>
<li><a href="http://beastie.pl/deweloperzy-openbsd-vadim-zhukov/" rel="nofollow">Vadim Zhukov</a></li>
<li><a href="http://beastie.pl/deweloperzy-openbsd-marc-espie/" rel="nofollow">Marc Espie</a></li>
<li><a href="http://beastie.pl/deweloperzy-openbsd-bryan-steele/" rel="nofollow">Bryan Steele</a> </li>
<li><a href="http://beastie.pl/deweloperzy-openbsd-ingo-schwarze/" rel="nofollow">Ingo Schwarze</a></li>
<li><a href="http://beastie.pl/deweloperzy-openbsd-gilles-chehade/" rel="nofollow">Gilles Chehade</a> </li>
</ul></li>
</ul>

<hr>

<h3><a href="http://lists.freebsd.org/pipermail/freebsd-x11/2015-October/016758.html" rel="nofollow">Jean-Sébastien Pédron has submitted a call for testing out the neIntel i915 driver</a></h3>

<ul>
<li>A very eagerly awaited feature, Haswell GPU support has begun the testing process</li>
<li>The main developer, Jean-Sébastien Pédron <a href="mailto:dumbbell@freebsd.org" rel="nofollow">dumbbell@freebsd.org</a>  looking for users to test the patch, both those that have older supported cards (Sandybridge, Ivybridge) that are currently working, and users with Haswell devices that have, until now, not been supported</li>
<li>Included is a link to the Wiki with instructions on how to enable debugging, and grab the updated branch of FreeBSD with the graphical improvements. Jean-Sébastien is calling for testers to send results both good and bad over to the freebsd-x11 mailing lists</li>
<li>For those who want an “out of box solution” the next PC-BSD 11.0-CURRENT November images will include these changes as well</li>
</ul>

<hr>

<h3><a href="http://www.cyberciti.biz/faq/how-to-install-freebsd-on-raspberry-pi-2-model-b/" rel="nofollow">How to install FreeBSD on a Raspberry Pi 2</a></h3>

<ul>
<li>We have a nice walkthrough this week on how to install FreeBSD, both 
10 or 11-CURRENT on a RPi 2!</li>
<li>The walkthrough shows us how to use OSX to copy the image to SD card, 
then booting.</li>
<li>In this case, we have him using a USB to serial cable to capture 
output with screen</li>
<li>This is a pretty quick way for users sitting on a RPi2 to get up and 
running with FreeBSD </li>
</ul>

<hr>

<h2>Interview - Jordan Hubbard - <a href="mailto:email@email" rel="nofollow">jkh@ixsystems.com</a></h2>

<p><a href="http://www.nextbsd.org/" rel="nofollow">NextBSD</a> | <a href="https://github.com/NextBSD/NextBSD" rel="nofollow">NextBSD Github</a></p>

<hr>

<h2>Beastie Bits</h2>

<p><a href="https://marc.info/?l=openbsd-misc&m=144515087006177&w=2" rel="nofollow">OpenBSD&#39;s Source Tree turned 20 on October 18th</a></p>

<p><a href="https://plus.google.com/+GhostbsdOrg/posts/JoNZzrKrhtB" rel="nofollow">GhostBSD working on Graphical ZFS Configuration Utility</a></p>

<p><a href="https://www.youtube.com/channel/UCz6C-szau90f9Vn07A6W2aA/videos" rel="nofollow">EuroBSDcon 2014 videos finally online</a></p>

<p><a href="http://www.mun.ca/postdoc/tc-postdoc-2015.pdf" rel="nofollow">Postdoctoral research position at Memorial University is open</a></p>

<p><a href="http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-009.txt.asc" rel="nofollow">NetBSD Security Advisory: TCP LAST_ACK memory exhaustion, reported by NetFlix and Juniper </a> </p>

<p><a href="http://www.desktopbsd.net/forums/threads/desktopbsd-2-0-roadmap.798/" rel="nofollow">DesktopBSD making a comeback?</a> </p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20PllfFXt" rel="nofollow"> Steve </a> </li>
<li><a href="http://slexy.org/view/s21jJm1lFN" rel="nofollow"> Ben </a> </li>
<li><a href="http://slexy.org/view/s20TsrN3uq" rel="nofollow"> Frank </a> </li>
<li><a href="http://slexy.org/view/s20AydOevW" rel="nofollow"> Tyler </a></li>
</ul>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>112: Tracing the source</title>
  <link>https://www.bsdnow.tv/112</link>
  <guid isPermaLink="false">c85e2b31-1e84-4751-8348-25bcba47d013</guid>
  <pubDate>Wed, 21 Oct 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c85e2b31-1e84-4751-8348-25bcba47d013.mp3" length="42396340" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week Allan is away at a ZFS conference, so it seems</itunes:subtitle>
  <itunes:duration>58:53</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week Allan is away at a ZFS conference, so it seems
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise 
Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud 
Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups 
for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
pfsense - 2.3 alpha snapshots available (https://blog.pfsense.org/?p=1854)
pfsense 2.3 Features and Changes (https://doc.pfsense.org/index.php/2.3_New_Features_and_Changes)
The entire front end has been re-written
Upgrade of base OS to FreeBSD 10-STABLE
The PPTP server component has been removed,
PBIs have been replaced with pkg
PHP upgraded to 5.6
The web interface has been converted to Bootstrap
***
BSDMag October 2015 out (http://bsdmag.org/download/bsd-09-2015/)
A Look at the New PC-BSD 10.2 - Kris Moore
Basis Of The Lumina Desktop Environment 18 - Ken Moore
A Secure Webserver on FreeBSD with Hiawatha - David Carlier
Defeating CryptoLocker Attacks with ZFS - Michael Dexter
Emerging Technology Has Increasingly Been a Force for Both Good and 
Evil - Rob Somerville
Interviews with: Dru Lavigne, Luca Ferrari, Oleksandr Rybalko
***
OpnSense 15.7.14 Released (https://opnsense.org/opnsense-15-7-14-released/)
Another update to OpnSense has landed!
Some of the notable takeaways this time are that it isn’t a 
security update
Major rework of the firewall rules sections including, rules, 
schedules, virtual ip, nat and aliases pages
Latest BIND and Squid packages
Improved configuration management, including fixes to importing an old 
config file. New location for configuration history / backups. 
***
OpenBSD in Toyota Highlander (http://marc.info/?l=openbsd-misc&amp;amp;m=144327954931983&amp;amp;w=2)
Images (http://imgur.com/a/SMVdp)
While looking through the ‘Software Information’ screen of a Toyota Highlander, Chad Dougherty of the ACM found a bunch of OpenBSD copyright notices
At least one of which I recognize as OpenCrypto, because of the comment about “transforms”
It is likely that the vehicle is running QNX, which contains various bits of BSD
QNX: Third Party License Terms List version 2.17 (http://support7.qnx.com/download/download/25111/TPLTL.v2.17.Jul23-13.pdf)
Some highlights
Robert N. M. Watson (FreeBSD)
TrustedBSD Project (FreeBSD)
NetBSD Foundation
NASA Ames Research Center (NetBSD)
Damien Miller (OpenBSD)
Theo de Raadt (OpenBSD)
Sony Computer Science Laboratories Inc.
Bob Beck (OpenBSD)
Christos Zoulas (NetBSD)
Markus Friedl (OpenBSD)
Henning Brauer (OpenBSD)
Network Associates Technology, Inc. (FreeBSD)
100s of others
OpenSSH seems to be included
It also seems to contain tcpdump for some reason
Interview - Adam Leventhal -
adam.leventhal@delphix.com (mailto:adam.leventhal@delphix.com) / 
@ahl (https://twitter.com/ahl)
ZFS and DTrace
Beastie-Bits
isboot, an iSCSI boot driver for FreeBSD 9 and 10 (https://lists.freebsd.org/pipermail/freebsd-current/2015-September/057572.html)
tame() is now called pledge()  (http://marc.info/?l=openbsd-tech&amp;amp;m=144469071208559&amp;amp;w=2)
Interview with NetBSD developer Leoardo 
Taccari (http://beastie.pl/deweloperzy-netbsd-7-0-leonardo-taccari/)
Fuguita releases LiveCD based on OpenBSD 5.8 (http://fuguita.org/index.php?FuguIta)
Dtrace toolkit gets an update and imported into NetBSD (http://mail-index.netbsd.org/source-changes/2015/09/30/msg069173.html)
An older article about how to do failover / load-balancing in pfsense (http://www.tecmint.com/how-to-setup-failover-and-load-balancing-in-pfsense/)
Feedback/Questions
 Michael writes in (http://slexy.org/view/s217HyOZ9U)
 Possniffer writes in (http://slexy.org/view/s2YODjppwX)
 Erno writes in (http://slexy.org/view/s21xltQ6jd)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week Allan is away at a ZFS conference, so it seems</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img <br>
src="/images/1.png" alt="iXsystems - Enterprise <br>
Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img <br>
src="/images/2.png" alt="DigitalOcean - Simple Cloud <br>
Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups <br>
for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.pfsense.org/?p=1854" rel="nofollow">pfsense - 2.3 alpha snapshots available</a></h3>

<ul>
<li><a href="https://doc.pfsense.org/index.php/2.3_New_Features_and_Changes" rel="nofollow">pfsense 2.3 Features and Changes</a></li>
<li>The entire front end has been re-written</li>
<li>Upgrade of base OS to FreeBSD 10-STABLE</li>
<li>The PPTP server component has been removed,</li>
<li>PBIs have been replaced with pkg</li>
<li>PHP upgraded to 5.6</li>
<li>The web interface has been converted to Bootstrap
***</li>
</ul>

<h3><a href="http://bsdmag.org/download/bsd-09-2015/" rel="nofollow">BSDMag October 2015 out</a></h3>

<ul>
<li>A Look at the New PC-BSD 10.2 - Kris Moore</li>
<li>Basis Of The Lumina Desktop Environment 18 - Ken Moore</li>
<li>A Secure Webserver on FreeBSD with Hiawatha - David Carlier</li>
<li>Defeating CryptoLocker Attacks with ZFS - Michael Dexter</li>
<li>Emerging Technology Has Increasingly Been a Force for Both Good and 
Evil - Rob Somerville</li>
<li>Interviews with: Dru Lavigne, Luca Ferrari, Oleksandr Rybalko
***</li>
</ul>

<h3><a href="https://opnsense.org/opnsense-15-7-14-released/" rel="nofollow">OpnSense 15.7.14 Released</a></h3>

<ul>
<li>Another update to OpnSense has landed!</li>
<li>Some of the notable takeaways this time are that it isn’t a 
security update</li>
<li>Major rework of the firewall rules sections including, rules, 
schedules, virtual ip, nat and aliases pages</li>
<li>Latest BIND and Squid packages</li>
<li>Improved configuration management, including fixes to importing an old 
config file. New location for configuration history / backups. 
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-misc&m=144327954931983&w=2" rel="nofollow">OpenBSD in Toyota Highlander</a></h3>

<ul>
<li><a href="http://imgur.com/a/SMVdp" rel="nofollow">Images</a></li>
<li>While looking through the ‘Software Information’ screen of a Toyota Highlander, Chad Dougherty of the ACM found a bunch of OpenBSD copyright notices</li>
<li>At least one of which I recognize as OpenCrypto, because of the comment about “transforms”</li>
<li>It is likely that the vehicle is running QNX, which contains various bits of BSD</li>
<li><a href="http://support7.qnx.com/download/download/25111/TPLTL.v2.17.Jul23-13.pdf" rel="nofollow">QNX: Third Party License Terms List version 2.17</a></li>
<li>Some highlights

<ul>
<li>Robert N. M. Watson (FreeBSD)</li>
<li>TrustedBSD Project (FreeBSD)</li>
<li>NetBSD Foundation</li>
<li>NASA Ames Research Center (NetBSD)</li>
<li>Damien Miller (OpenBSD)</li>
<li>Theo de Raadt (OpenBSD)</li>
<li>Sony Computer Science Laboratories Inc.</li>
<li>Bob Beck (OpenBSD)</li>
<li>Christos Zoulas (NetBSD)</li>
<li>Markus Friedl (OpenBSD)</li>
<li>Henning Brauer (OpenBSD)</li>
<li>Network Associates Technology, Inc. (FreeBSD)</li>
<li>100s of others</li>
</ul></li>
<li>OpenSSH seems to be included</li>
<li>It also seems to contain tcpdump for some reason</li>
</ul>

<hr>

<h2>Interview - Adam Leventhal -</h2>

<p><a href="mailto:adam.leventhal@delphix.com" rel="nofollow">adam.leventhal@delphix.com</a> / <br>
<a href="https://twitter.com/ahl" rel="nofollow">@ahl</a><br>
ZFS and DTrace</p>

<hr>

<h3>Beastie-Bits</h3>

<p><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-September/057572.html" rel="nofollow">isboot, an iSCSI boot driver for FreeBSD 9 and 10</a></p>

<p><a href="http://marc.info/?l=openbsd-tech&m=144469071208559&w=2" rel="nofollow">tame() is now called pledge() </a><br>
<a href="http://beastie.pl/deweloperzy-netbsd-7-0-leonardo-taccari/" rel="nofollow">Interview with NetBSD developer Leoardo <br>
Taccari</a></p>

<p><a href="http://fuguita.org/index.php?FuguIta" rel="nofollow">Fuguita releases LiveCD based on OpenBSD 5.8</a></p>

<p><a href="http://mail-index.netbsd.org/source-changes/2015/09/30/msg069173.html" rel="nofollow">Dtrace toolkit gets an update and imported into NetBSD</a></p>

<p><a href="http://www.tecmint.com/how-to-setup-failover-and-load-balancing-in-pfsense/" rel="nofollow">An older article about how to do failover / load-balancing in pfsense</a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s217HyOZ9U" rel="nofollow"> Michael writes in</a></li>
<li><a href="http://slexy.org/view/s2YODjppwX" rel="nofollow"> Possniffer writes in</a></li>
<li><a href="http://slexy.org/view/s21xltQ6jd" rel="nofollow"> Erno writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week Allan is away at a ZFS conference, so it seems</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img <br>
src="/images/1.png" alt="iXsystems - Enterprise <br>
Servers and Storage for Open Source" /></a><a <br>
href="http://www.digitalocean.com/" title="DigitalOcean"><img <br>
src="/images/2.png" alt="DigitalOcean - Simple Cloud <br>
Hosting, Built for Developers" /></a><a <br>
href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img <br>
src="/images/3.png" alt="Tarsnap - Online Backups <br>
for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.pfsense.org/?p=1854" rel="nofollow">pfsense - 2.3 alpha snapshots available</a></h3>

<ul>
<li><a href="https://doc.pfsense.org/index.php/2.3_New_Features_and_Changes" rel="nofollow">pfsense 2.3 Features and Changes</a></li>
<li>The entire front end has been re-written</li>
<li>Upgrade of base OS to FreeBSD 10-STABLE</li>
<li>The PPTP server component has been removed,</li>
<li>PBIs have been replaced with pkg</li>
<li>PHP upgraded to 5.6</li>
<li>The web interface has been converted to Bootstrap
***</li>
</ul>

<h3><a href="http://bsdmag.org/download/bsd-09-2015/" rel="nofollow">BSDMag October 2015 out</a></h3>

<ul>
<li>A Look at the New PC-BSD 10.2 - Kris Moore</li>
<li>Basis Of The Lumina Desktop Environment 18 - Ken Moore</li>
<li>A Secure Webserver on FreeBSD with Hiawatha - David Carlier</li>
<li>Defeating CryptoLocker Attacks with ZFS - Michael Dexter</li>
<li>Emerging Technology Has Increasingly Been a Force for Both Good and 
Evil - Rob Somerville</li>
<li>Interviews with: Dru Lavigne, Luca Ferrari, Oleksandr Rybalko
***</li>
</ul>

<h3><a href="https://opnsense.org/opnsense-15-7-14-released/" rel="nofollow">OpnSense 15.7.14 Released</a></h3>

<ul>
<li>Another update to OpnSense has landed!</li>
<li>Some of the notable takeaways this time are that it isn’t a 
security update</li>
<li>Major rework of the firewall rules sections including, rules, 
schedules, virtual ip, nat and aliases pages</li>
<li>Latest BIND and Squid packages</li>
<li>Improved configuration management, including fixes to importing an old 
config file. New location for configuration history / backups. 
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-misc&m=144327954931983&w=2" rel="nofollow">OpenBSD in Toyota Highlander</a></h3>

<ul>
<li><a href="http://imgur.com/a/SMVdp" rel="nofollow">Images</a></li>
<li>While looking through the ‘Software Information’ screen of a Toyota Highlander, Chad Dougherty of the ACM found a bunch of OpenBSD copyright notices</li>
<li>At least one of which I recognize as OpenCrypto, because of the comment about “transforms”</li>
<li>It is likely that the vehicle is running QNX, which contains various bits of BSD</li>
<li><a href="http://support7.qnx.com/download/download/25111/TPLTL.v2.17.Jul23-13.pdf" rel="nofollow">QNX: Third Party License Terms List version 2.17</a></li>
<li>Some highlights

<ul>
<li>Robert N. M. Watson (FreeBSD)</li>
<li>TrustedBSD Project (FreeBSD)</li>
<li>NetBSD Foundation</li>
<li>NASA Ames Research Center (NetBSD)</li>
<li>Damien Miller (OpenBSD)</li>
<li>Theo de Raadt (OpenBSD)</li>
<li>Sony Computer Science Laboratories Inc.</li>
<li>Bob Beck (OpenBSD)</li>
<li>Christos Zoulas (NetBSD)</li>
<li>Markus Friedl (OpenBSD)</li>
<li>Henning Brauer (OpenBSD)</li>
<li>Network Associates Technology, Inc. (FreeBSD)</li>
<li>100s of others</li>
</ul></li>
<li>OpenSSH seems to be included</li>
<li>It also seems to contain tcpdump for some reason</li>
</ul>

<hr>

<h2>Interview - Adam Leventhal -</h2>

<p><a href="mailto:adam.leventhal@delphix.com" rel="nofollow">adam.leventhal@delphix.com</a> / <br>
<a href="https://twitter.com/ahl" rel="nofollow">@ahl</a><br>
ZFS and DTrace</p>

<hr>

<h3>Beastie-Bits</h3>

<p><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-September/057572.html" rel="nofollow">isboot, an iSCSI boot driver for FreeBSD 9 and 10</a></p>

<p><a href="http://marc.info/?l=openbsd-tech&m=144469071208559&w=2" rel="nofollow">tame() is now called pledge() </a><br>
<a href="http://beastie.pl/deweloperzy-netbsd-7-0-leonardo-taccari/" rel="nofollow">Interview with NetBSD developer Leoardo <br>
Taccari</a></p>

<p><a href="http://fuguita.org/index.php?FuguIta" rel="nofollow">Fuguita releases LiveCD based on OpenBSD 5.8</a></p>

<p><a href="http://mail-index.netbsd.org/source-changes/2015/09/30/msg069173.html" rel="nofollow">Dtrace toolkit gets an update and imported into NetBSD</a></p>

<p><a href="http://www.tecmint.com/how-to-setup-failover-and-load-balancing-in-pfsense/" rel="nofollow">An older article about how to do failover / load-balancing in pfsense</a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s217HyOZ9U" rel="nofollow"> Michael writes in</a></li>
<li><a href="http://slexy.org/view/s2YODjppwX" rel="nofollow"> Possniffer writes in</a></li>
<li><a href="http://slexy.org/view/s21xltQ6jd" rel="nofollow"> Erno writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>111: Xenocratic Oath</title>
  <link>https://www.bsdnow.tv/111</link>
  <guid isPermaLink="false">f858706f-01c9-4fa1-bca3-07c9fd71554b</guid>
  <pubDate>Wed, 14 Oct 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f858706f-01c9-4fa1-bca3-07c9fd71554b.mp3" length="44653396" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up on this weeks episode, we have BSD news, tidbits and articles out the wazoo to share. Also, be sure to stick around for our interview with Brandon Mercer as he tells us about OpenBSD being used in the healthcare industry.</itunes:subtitle>
  <itunes:duration>1:02:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up on this weeks episode, we have BSD news, tidbits and articles out the wazoo to share. Also, be sure to stick around for our interview with Brandon Mercer as he tells us about OpenBSD being used in the healthcare industry.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
NetBSD 7.0 Release Announcement (http://www.netbsd.org/releases/formal-7/NetBSD-7.0.html)
DRM/KMS support brings accelerated graphics to x86 systems using modern Intel and Radeon devices (Linux 3.15)
Multiprocessor ARM support.
Support for many new ARM boards, including the Raspberry Pi 2 and BeagleBone Black
Major NPF improvements:
BPF with just-in-time (JIT) compilation by default
support for dynamic rules
support for static (stateless) NAT
support for IPv6-to-IPv6 Network Prefix Translation (NPTv6) as per RFC 6296
support for CDB based tables (uses perfect hashing and guarantees lock-free O(1) lookups)
Multiprocessor support in the USB subsystem.
GPT support in sysinst via the extended partitioning menu.
Lua kernel scripting
GCC 4.8.4, which brings support for C++11
Experimental support for SSD TRIM in wd(4) and FFS
tetris(6): Add colours and a 'down' key, defaulting to 'n'. It moves the block down a line, if it fits. 
***
CloudFlare develops interesting new netmap feature  (https://blog.cloudflare.com/single-rx-queue-kernel-bypass-with-netmap/)
Normally, when Netmap is enabled on an interface, the kernel is bypassed and all of the packets go to the Netmap consumers
CloudFlare has developed a feature that allows all but one of the RX queues to remain connected to the kernel, and only a single queue be passed to Netmap
The change is a simple modification to the nm_open API, allowing the application to open only a specific queue of the NIC, rather than the entire thing
The RSS or other hashing must be modified to not direct traffic to this queue
Then specific flows are directed to the netmap application for matching traffic
For example under Linux:
ethtool -X eth3 weight 1 1 1 1 0 1 1 1 1 1
ethtool -K eth3 lro off gro off
ethtool -N eth3 flow-type udp4 dst-port 53 action 4
Directs all name server traffic to NIC queue number 4
Currently there is no tool like ethtool to accomplish this same under FreeBSD
I wonder if the flows could be identified more specifically using something like ipfw-netmap
***
Building your own OpenBSD based Mail server! (http://www.theregister.co.uk/2015/09/12/feature_last_post_build_mail_server/?mt=1442858572214)
part 2 (http://www.theregister.co.uk/2015/09/19/feature_last_post_build_mailserver_part_2/) 
part 3 (http://www.theregister.co.uk/2015/09/26/feature_last_post_build_mailserver_part_3/)
The UK Register gives us a great writeup on getting your own mail server setup specifically on OpenBSD 5.7
In this article they used a MiniPC the Acer Revo One RL85, which is a decently priced little box for a mail server  (http://www.theregister.co.uk/2015/07/24/review_acer_revo_one_rl85_/)
While a bit lengthy in 3 parts, it does provide a good walkthrough of getting OpenBSD setup, PostFix and DoveCot configured and working. In the final installment it also provides details on spam filtering and antivirus scanning. 
Getting started with the UEFI bootloader on OpenBSD (http://blog.jasper.la/openbsd-uefi-bootloader-howto/)
If you've been listening over the past few weeks, you've heard about OpenBSD.s new UEFI boot-loader. We now have a blog post with detailed instructions on how to get setup with this on your own system.
The initial setup is pretty straightforward, and should only take a few minutes at most. In involves the usual fdisk commands to create a FAT EFI partition, and placing the bootx64.efi file in the correct location.
As a bonus, we even get instructions on how to enable the frame-buffer driver on systems without native Intel video support (ThinkPad x250 in this example)
***
Recipe for building a 10Mpps FreeBSD based router (http://blog.cochard.me/2015/09/receipt-for-building-10mpps-freebsd.html)
Olivier, (of FreeNAS and BSD Router Project fame) treats us this week to a neat blog post about building your own high-performance 10Mpps FreeBSD router
As he first mentions, the hardware required will need to be beefy, no $200 miniPC here. In his setup he uses a 8 core Intel Xeon E5-2650, along with a Quad port 10 Gigabit Chelsio TS540-CR.
He mentions that this doesn't work quite on stock FreeBSD yet, you will need to pull code in from the projects/routing  (https://svnweb.freebsd.org/base/projects/routing/) which fixes an issue with scaling on cores, in this case he is shrinking the NIC queues down to 4 from 8.
If you don't feel like doing the compiles yourself, he also includes links to experimental BSDRouter project images which he used to do the benchmarks
Bonus! Nice graphic of the benchmarks from enabling IPFW or PF and what that does to the performance. 
***
Interview - Brandon Mercer - bmercer@openbsd.org (mailto:bmercer@openbsd.org) / @knowmercymod (https://twitter.com/knowmercymod)
OpenBSD in Healthcare
Sorry about the audio quality degradation. The last 7 or 8 minutes of the interview had to be cut, a problem with the software that captures the audio from skype and adds it to our compositor. My local monitor is analogue and did not experience the issue, so I was unaware of the issue during the recording
***
News Roundup
Nvidia releases new beta FreeBSD driver along with new kernel module (https://devtalk.nvidia.com/default/topic/884727/unix-graphics-announcements-and-news/linux-solaris-and-freebsd-driver-358-09-beta-/)
Includes a new kernel module, nvidia-modeset.ko
While this module does NOT have any user-settable features, it works with the existing nvidia.ko to provide kernel-mode setting (KMS) used by the integrated DRM within the kernel. 
The beta adds support for 805A and 960A nvidia cards
Also fixes a memory leak and some regressions
***
MidnightBSD 0.7-RELEASE (http://www.midnightbsd.org/pipermail/midnightbsd-users/Week-of-Mon-20150914/003462.html)
We missed this while away at Euro and elsewhere, but MidnightBSD (A desktop-focused FreeBSD 6.1 Fork) has come out with a new 0.7 release
This release primarily focuses on stability, but also includes important security fixes as well. 
It cherry-picks updates to a variety of FreeBSD base-system updates, and some important ZFS features, such as TRIM and LZ4 compression
Their custom .mports. system has also gotten a slew of updates, with almost 2000 packages now available, including a WiP of Gnome3. It also brings support for starting / stopping services automatically at pkg install or removal. 
They note that this will most likely be the last i386 release, joining the club of other projects that are going 64bit only. 
***
"Open Source as a Career Path" (http://media.medfarm.uu.se/play/video/5400)
The FreeBSD Project held a panel discussion (http://www.cb.uu.se/~kristina/WomENcourage/2014/2015-09-25_Friday/2015-09-25%20113238.JPG) of why Open Source makes a good career path at the ACM.s womENcourage conference in Uppsala, Sweden, the weekend before EuroBSDCon
The Panel was lead by Dru Lavigne, and consisted of Deb Goodkin, Benedict Reuschling, Dan Langille, and myself
We attempted to provide a cross section of experiences, including women in the field, the academic side, the community side, and the business side
During the question period, Dan gave a great answer (https://gist.github.com/dlangille/e262bccdea08b89b5360) to the question of .Why do open source projects still use old technologies like mailing lists and IRC.
The day before, the FreeBSD Foundation also had a booth at the career fair. We were the only open source project that attended. Other exhibitors included: Cisco, Facebook, Intel, Google, and Oracle.
The following day, Dan also gave a workshop (http://www.cb.uu.se/~kristina/WomENcourage/2014/2015-09-25_Friday/2015-09-25%20113238.JPG) on how to contribute to an open source project
***
Beastie-Bits
NetBSD 2015PkgSrc Freeze (http://mail-index.netbsd.org/pkgsrc-users/2015/09/12/msg022186.html)
Support for 802.11N for RealTek USB in FreeBSD (https://github.com/freebsd/freebsd/commits/master/sys/dev/usb/wlan/if_rsu.c)
Wayland ported to DragonFlyBSD  (https://github.com/DragonFlyBSD/DeltaPorts/pull/123)
OpenSMTPd developer debriefs on audit report  (http://undeadly.org/cgi?action=article&amp;amp;sid=20151013161745)
FreeBSD fixes issue with pf under Xen with TSO. Errata coming soon  (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=289316)
Xinuos funds the HardenedBSD project  (http://slexy.org/view/s2EBjrxQ9M)
Feedback/Questions
 Evan (http://slexy.org/view/s21PMmNFIs)
 Darin writes in (http://slexy.org/view/s20qH07ox0)
 Jochen writes in (http://slexy.org/view/s2d0SFmRlD)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up on this weeks episode, we have BSD news, tidbits and articles out the wazoo to share. Also, be sure to stick around for our interview with Brandon Mercer as he tells us about OpenBSD being used in the healthcare industry.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.netbsd.org/releases/formal-7/NetBSD-7.0.html" rel="nofollow">NetBSD 7.0 Release Announcement</a></h3>

<ul>
<li>DRM/KMS support brings accelerated graphics to x86 systems using modern Intel and Radeon devices (Linux 3.15)</li>
<li>Multiprocessor ARM support.</li>
<li>Support for many new ARM boards, including the Raspberry Pi 2 and BeagleBone Black</li>
<li>Major NPF improvements:

<ul>
<li>BPF with just-in-time (JIT) compilation by default</li>
<li>support for dynamic rules</li>
</ul></li>
<li>support for static (stateless) NAT</li>
<li>support for IPv6-to-IPv6 Network Prefix Translation (NPTv6) as per RFC 6296</li>
<li>support for CDB based tables (uses perfect hashing and guarantees lock-free O(1) lookups)</li>
<li>Multiprocessor support in the USB subsystem.</li>
<li>GPT support in sysinst via the extended partitioning menu.</li>
<li>Lua kernel scripting</li>
<li>GCC 4.8.4, which brings support for C++11</li>
<li>Experimental support for SSD TRIM in wd(4) and FFS</li>
<li>tetris(6): Add colours and a &#39;down&#39; key, defaulting to &#39;n&#39;. It moves the block down a line, if it fits. 
***</li>
</ul>

<h3><a href="https://blog.cloudflare.com/single-rx-queue-kernel-bypass-with-netmap/" rel="nofollow">CloudFlare develops interesting new netmap feature </a></h3>

<ul>
<li>Normally, when Netmap is enabled on an interface, the kernel is bypassed and all of the packets go to the Netmap consumers</li>
<li>CloudFlare has developed a feature that allows all but one of the RX queues to remain connected to the kernel, and only a single queue be passed to Netmap</li>
<li>The change is a simple modification to the nm_open API, allowing the application to open only a specific queue of the NIC, rather than the entire thing</li>
<li>The RSS or other hashing must be modified to not direct traffic to this queue</li>
<li>Then specific flows are directed to the netmap application for matching traffic</li>
<li>For example under Linux:</li>
<li>ethtool -X eth3 weight 1 1 1 1 0 1 1 1 1 1</li>
<li>ethtool -K eth3 lro off gro off</li>
<li>ethtool -N eth3 flow-type udp4 dst-port 53 action 4</li>
<li>Directs all name server traffic to NIC queue number 4</li>
<li>Currently there is no tool like ethtool to accomplish this same under FreeBSD</li>
<li>I wonder if the flows could be identified more specifically using something like ipfw-netmap
***</li>
</ul>

<h3><a href="http://www.theregister.co.uk/2015/09/12/feature_last_post_build_mail_server/?mt=1442858572214" rel="nofollow">Building your own OpenBSD based Mail server!</a></h3>

<ul>
<li><a href="http://www.theregister.co.uk/2015/09/19/feature_last_post_build_mailserver_part_2/" rel="nofollow">part 2</a> </li>
<li><a href="http://www.theregister.co.uk/2015/09/26/feature_last_post_build_mailserver_part_3/" rel="nofollow">part 3</a></li>
<li>The UK Register gives us a great writeup on getting your own mail server setup specifically on OpenBSD 5.7</li>
<li><a href="http://www.theregister.co.uk/2015/07/24/review_acer_revo_one_rl85_/" rel="nofollow">In this article they used a MiniPC the Acer Revo One RL85, which is a decently priced little box for a mail server </a></li>
<li>While a bit lengthy in 3 parts, it does provide a good walkthrough of getting OpenBSD setup, PostFix and DoveCot configured and working. In the final installment it also provides details on spam filtering and antivirus scanning. </li>
</ul>

<h3><a href="http://blog.jasper.la/openbsd-uefi-bootloader-howto/" rel="nofollow">Getting started with the UEFI bootloader on OpenBSD</a></h3>

<ul>
<li>If you&#39;ve been listening over the past few weeks, you&#39;ve heard about OpenBSD.s new UEFI boot-loader. We now have a blog post with detailed instructions on how to get setup with this on your own system.</li>
<li>The initial setup is pretty straightforward, and should only take a few minutes at most. In involves the usual fdisk commands to create a FAT EFI partition, and placing the bootx64.efi file in the correct location.</li>
<li>As a bonus, we even get instructions on how to enable the frame-buffer driver on systems without native Intel video support (ThinkPad x250 in this example)
***</li>
</ul>

<h3><a href="http://blog.cochard.me/2015/09/receipt-for-building-10mpps-freebsd.html" rel="nofollow">Recipe for building a 10Mpps FreeBSD based router</a></h3>

<ul>
<li>Olivier, (of FreeNAS and BSD Router Project fame) treats us this week to a neat blog post about building your own high-performance 10Mpps FreeBSD router</li>
<li>As he first mentions, the hardware required will need to be beefy, no $200 miniPC here. In his setup he uses a 8 core Intel Xeon E5-2650, along with a Quad port 10 Gigabit Chelsio TS540-CR.</li>
<li>He mentions that this doesn&#39;t work quite on stock FreeBSD yet, you will need to pull code in from the <a href="https://svnweb.freebsd.org/base/projects/routing/" rel="nofollow">projects/routing </a> which fixes an issue with scaling on cores, in this case he is shrinking the NIC queues down to 4 from 8.</li>
<li>If you don&#39;t feel like doing the compiles yourself, he also includes links to experimental BSDRouter project images which he used to do the benchmarks</li>
<li>Bonus! Nice graphic of the benchmarks from enabling IPFW or PF and what that does to the performance. 
***</li>
</ul>

<h2>Interview - Brandon Mercer - <a href="mailto:bmercer@openbsd.org" rel="nofollow">bmercer@openbsd.org</a> / <a href="https://twitter.com/knowmercymod" rel="nofollow">@knowmercymod</a></h2>

<p>OpenBSD in Healthcare</p>

<ul>
<li>Sorry about the audio quality degradation. The last 7 or 8 minutes of the interview had to be cut, a problem with the software that captures the audio from skype and adds it to our compositor. My local monitor is analogue and did not experience the issue, so I was unaware of the issue during the recording
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://devtalk.nvidia.com/default/topic/884727/unix-graphics-announcements-and-news/linux-solaris-and-freebsd-driver-358-09-beta-/" rel="nofollow">Nvidia releases new beta FreeBSD driver along with new kernel module</a></h3>

<ul>
<li>Includes a new kernel module, nvidia-modeset.ko</li>
<li>While this module does NOT have any user-settable features, it works with the existing nvidia.ko to provide kernel-mode setting (KMS) used by the integrated DRM within the kernel. </li>
<li>The beta adds support for 805A and 960A nvidia cards</li>
<li>Also fixes a memory leak and some regressions
***</li>
</ul>

<h3><a href="http://www.midnightbsd.org/pipermail/midnightbsd-users/Week-of-Mon-20150914/003462.html" rel="nofollow">MidnightBSD 0.7-RELEASE</a></h3>

<ul>
<li>We missed this while away at Euro and elsewhere, but MidnightBSD (A desktop-focused FreeBSD 6.1 Fork) has come out with a new 0.7 release</li>
<li>This release primarily focuses on stability, but also includes important security fixes as well. </li>
<li>It cherry-picks updates to a variety of FreeBSD base-system updates, and some important ZFS features, such as TRIM and LZ4 compression</li>
<li>Their custom .mports. system has also gotten a slew of updates, with almost 2000 packages now available, including a WiP of Gnome3. It also brings support for starting / stopping services automatically at pkg install or removal. </li>
<li>They note that this will most likely be the last i386 release, joining the club of other projects that are going 64bit only. 
***</li>
</ul>

<h3><a href="http://media.medfarm.uu.se/play/video/5400" rel="nofollow">&quot;Open Source as a Career Path&quot;</a></h3>

<ul>
<li>The FreeBSD Project held a <a href="http://www.cb.uu.se/%7Ekristina/WomENcourage/2014/2015-09-25_Friday/2015-09-25%20113238.JPG" rel="nofollow">panel discussion</a> of why Open Source makes a good career path at the ACM.s womENcourage conference in Uppsala, Sweden, the weekend before EuroBSDCon</li>
<li>The Panel was lead by Dru Lavigne, and consisted of Deb Goodkin, Benedict Reuschling, Dan Langille, and myself</li>
<li>We attempted to provide a cross section of experiences, including women in the field, the academic side, the community side, and the business side</li>
<li>During the question period, Dan gave a <a href="https://gist.github.com/dlangille/e262bccdea08b89b5360" rel="nofollow">great answer</a> to the question of .Why do open source projects still use old technologies like mailing lists and IRC.</li>
<li>The day before, the FreeBSD Foundation also had a booth at the career fair. We were the only open source project that attended. Other exhibitors included: Cisco, Facebook, Intel, Google, and Oracle.</li>
<li>The following day, Dan also <a href="http://www.cb.uu.se/%7Ekristina/WomENcourage/2014/2015-09-25_Friday/2015-09-25%20113238.JPG" rel="nofollow">gave a workshop</a> on how to contribute to an open source project
***</li>
</ul>

<h3>Beastie-Bits</h3>

<p><a href="http://mail-index.netbsd.org/pkgsrc-users/2015/09/12/msg022186.html" rel="nofollow">NetBSD 2015PkgSrc Freeze</a></p>

<p><a href="https://github.com/freebsd/freebsd/commits/master/sys/dev/usb/wlan/if_rsu.c" rel="nofollow">Support for 802.11N for RealTek USB in FreeBSD</a></p>

<p><a href="https://github.com/DragonFlyBSD/DeltaPorts/pull/123" rel="nofollow">Wayland ported to DragonFlyBSD </a></p>

<p><a href="http://undeadly.org/cgi?action=article&sid=20151013161745" rel="nofollow">OpenSMTPd developer debriefs on audit report </a></p>

<p><a href="https://svnweb.freebsd.org/base?view=revision&revision=289316" rel="nofollow">FreeBSD fixes issue with pf under Xen with TSO. Errata coming soon </a></p>

<p><a href="http://slexy.org/view/s2EBjrxQ9M" rel="nofollow">Xinuos funds the HardenedBSD project </a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21PMmNFIs" rel="nofollow"> Evan</a></li>
<li><a href="http://slexy.org/view/s20qH07ox0" rel="nofollow"> Darin writes in</a></li>
<li><a href="http://slexy.org/view/s2d0SFmRlD" rel="nofollow"> Jochen writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up on this weeks episode, we have BSD news, tidbits and articles out the wazoo to share. Also, be sure to stick around for our interview with Brandon Mercer as he tells us about OpenBSD being used in the healthcare industry.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.netbsd.org/releases/formal-7/NetBSD-7.0.html" rel="nofollow">NetBSD 7.0 Release Announcement</a></h3>

<ul>
<li>DRM/KMS support brings accelerated graphics to x86 systems using modern Intel and Radeon devices (Linux 3.15)</li>
<li>Multiprocessor ARM support.</li>
<li>Support for many new ARM boards, including the Raspberry Pi 2 and BeagleBone Black</li>
<li>Major NPF improvements:

<ul>
<li>BPF with just-in-time (JIT) compilation by default</li>
<li>support for dynamic rules</li>
</ul></li>
<li>support for static (stateless) NAT</li>
<li>support for IPv6-to-IPv6 Network Prefix Translation (NPTv6) as per RFC 6296</li>
<li>support for CDB based tables (uses perfect hashing and guarantees lock-free O(1) lookups)</li>
<li>Multiprocessor support in the USB subsystem.</li>
<li>GPT support in sysinst via the extended partitioning menu.</li>
<li>Lua kernel scripting</li>
<li>GCC 4.8.4, which brings support for C++11</li>
<li>Experimental support for SSD TRIM in wd(4) and FFS</li>
<li>tetris(6): Add colours and a &#39;down&#39; key, defaulting to &#39;n&#39;. It moves the block down a line, if it fits. 
***</li>
</ul>

<h3><a href="https://blog.cloudflare.com/single-rx-queue-kernel-bypass-with-netmap/" rel="nofollow">CloudFlare develops interesting new netmap feature </a></h3>

<ul>
<li>Normally, when Netmap is enabled on an interface, the kernel is bypassed and all of the packets go to the Netmap consumers</li>
<li>CloudFlare has developed a feature that allows all but one of the RX queues to remain connected to the kernel, and only a single queue be passed to Netmap</li>
<li>The change is a simple modification to the nm_open API, allowing the application to open only a specific queue of the NIC, rather than the entire thing</li>
<li>The RSS or other hashing must be modified to not direct traffic to this queue</li>
<li>Then specific flows are directed to the netmap application for matching traffic</li>
<li>For example under Linux:</li>
<li>ethtool -X eth3 weight 1 1 1 1 0 1 1 1 1 1</li>
<li>ethtool -K eth3 lro off gro off</li>
<li>ethtool -N eth3 flow-type udp4 dst-port 53 action 4</li>
<li>Directs all name server traffic to NIC queue number 4</li>
<li>Currently there is no tool like ethtool to accomplish this same under FreeBSD</li>
<li>I wonder if the flows could be identified more specifically using something like ipfw-netmap
***</li>
</ul>

<h3><a href="http://www.theregister.co.uk/2015/09/12/feature_last_post_build_mail_server/?mt=1442858572214" rel="nofollow">Building your own OpenBSD based Mail server!</a></h3>

<ul>
<li><a href="http://www.theregister.co.uk/2015/09/19/feature_last_post_build_mailserver_part_2/" rel="nofollow">part 2</a> </li>
<li><a href="http://www.theregister.co.uk/2015/09/26/feature_last_post_build_mailserver_part_3/" rel="nofollow">part 3</a></li>
<li>The UK Register gives us a great writeup on getting your own mail server setup specifically on OpenBSD 5.7</li>
<li><a href="http://www.theregister.co.uk/2015/07/24/review_acer_revo_one_rl85_/" rel="nofollow">In this article they used a MiniPC the Acer Revo One RL85, which is a decently priced little box for a mail server </a></li>
<li>While a bit lengthy in 3 parts, it does provide a good walkthrough of getting OpenBSD setup, PostFix and DoveCot configured and working. In the final installment it also provides details on spam filtering and antivirus scanning. </li>
</ul>

<h3><a href="http://blog.jasper.la/openbsd-uefi-bootloader-howto/" rel="nofollow">Getting started with the UEFI bootloader on OpenBSD</a></h3>

<ul>
<li>If you&#39;ve been listening over the past few weeks, you&#39;ve heard about OpenBSD.s new UEFI boot-loader. We now have a blog post with detailed instructions on how to get setup with this on your own system.</li>
<li>The initial setup is pretty straightforward, and should only take a few minutes at most. In involves the usual fdisk commands to create a FAT EFI partition, and placing the bootx64.efi file in the correct location.</li>
<li>As a bonus, we even get instructions on how to enable the frame-buffer driver on systems without native Intel video support (ThinkPad x250 in this example)
***</li>
</ul>

<h3><a href="http://blog.cochard.me/2015/09/receipt-for-building-10mpps-freebsd.html" rel="nofollow">Recipe for building a 10Mpps FreeBSD based router</a></h3>

<ul>
<li>Olivier, (of FreeNAS and BSD Router Project fame) treats us this week to a neat blog post about building your own high-performance 10Mpps FreeBSD router</li>
<li>As he first mentions, the hardware required will need to be beefy, no $200 miniPC here. In his setup he uses a 8 core Intel Xeon E5-2650, along with a Quad port 10 Gigabit Chelsio TS540-CR.</li>
<li>He mentions that this doesn&#39;t work quite on stock FreeBSD yet, you will need to pull code in from the <a href="https://svnweb.freebsd.org/base/projects/routing/" rel="nofollow">projects/routing </a> which fixes an issue with scaling on cores, in this case he is shrinking the NIC queues down to 4 from 8.</li>
<li>If you don&#39;t feel like doing the compiles yourself, he also includes links to experimental BSDRouter project images which he used to do the benchmarks</li>
<li>Bonus! Nice graphic of the benchmarks from enabling IPFW or PF and what that does to the performance. 
***</li>
</ul>

<h2>Interview - Brandon Mercer - <a href="mailto:bmercer@openbsd.org" rel="nofollow">bmercer@openbsd.org</a> / <a href="https://twitter.com/knowmercymod" rel="nofollow">@knowmercymod</a></h2>

<p>OpenBSD in Healthcare</p>

<ul>
<li>Sorry about the audio quality degradation. The last 7 or 8 minutes of the interview had to be cut, a problem with the software that captures the audio from skype and adds it to our compositor. My local monitor is analogue and did not experience the issue, so I was unaware of the issue during the recording
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="https://devtalk.nvidia.com/default/topic/884727/unix-graphics-announcements-and-news/linux-solaris-and-freebsd-driver-358-09-beta-/" rel="nofollow">Nvidia releases new beta FreeBSD driver along with new kernel module</a></h3>

<ul>
<li>Includes a new kernel module, nvidia-modeset.ko</li>
<li>While this module does NOT have any user-settable features, it works with the existing nvidia.ko to provide kernel-mode setting (KMS) used by the integrated DRM within the kernel. </li>
<li>The beta adds support for 805A and 960A nvidia cards</li>
<li>Also fixes a memory leak and some regressions
***</li>
</ul>

<h3><a href="http://www.midnightbsd.org/pipermail/midnightbsd-users/Week-of-Mon-20150914/003462.html" rel="nofollow">MidnightBSD 0.7-RELEASE</a></h3>

<ul>
<li>We missed this while away at Euro and elsewhere, but MidnightBSD (A desktop-focused FreeBSD 6.1 Fork) has come out with a new 0.7 release</li>
<li>This release primarily focuses on stability, but also includes important security fixes as well. </li>
<li>It cherry-picks updates to a variety of FreeBSD base-system updates, and some important ZFS features, such as TRIM and LZ4 compression</li>
<li>Their custom .mports. system has also gotten a slew of updates, with almost 2000 packages now available, including a WiP of Gnome3. It also brings support for starting / stopping services automatically at pkg install or removal. </li>
<li>They note that this will most likely be the last i386 release, joining the club of other projects that are going 64bit only. 
***</li>
</ul>

<h3><a href="http://media.medfarm.uu.se/play/video/5400" rel="nofollow">&quot;Open Source as a Career Path&quot;</a></h3>

<ul>
<li>The FreeBSD Project held a <a href="http://www.cb.uu.se/%7Ekristina/WomENcourage/2014/2015-09-25_Friday/2015-09-25%20113238.JPG" rel="nofollow">panel discussion</a> of why Open Source makes a good career path at the ACM.s womENcourage conference in Uppsala, Sweden, the weekend before EuroBSDCon</li>
<li>The Panel was lead by Dru Lavigne, and consisted of Deb Goodkin, Benedict Reuschling, Dan Langille, and myself</li>
<li>We attempted to provide a cross section of experiences, including women in the field, the academic side, the community side, and the business side</li>
<li>During the question period, Dan gave a <a href="https://gist.github.com/dlangille/e262bccdea08b89b5360" rel="nofollow">great answer</a> to the question of .Why do open source projects still use old technologies like mailing lists and IRC.</li>
<li>The day before, the FreeBSD Foundation also had a booth at the career fair. We were the only open source project that attended. Other exhibitors included: Cisco, Facebook, Intel, Google, and Oracle.</li>
<li>The following day, Dan also <a href="http://www.cb.uu.se/%7Ekristina/WomENcourage/2014/2015-09-25_Friday/2015-09-25%20113238.JPG" rel="nofollow">gave a workshop</a> on how to contribute to an open source project
***</li>
</ul>

<h3>Beastie-Bits</h3>

<p><a href="http://mail-index.netbsd.org/pkgsrc-users/2015/09/12/msg022186.html" rel="nofollow">NetBSD 2015PkgSrc Freeze</a></p>

<p><a href="https://github.com/freebsd/freebsd/commits/master/sys/dev/usb/wlan/if_rsu.c" rel="nofollow">Support for 802.11N for RealTek USB in FreeBSD</a></p>

<p><a href="https://github.com/DragonFlyBSD/DeltaPorts/pull/123" rel="nofollow">Wayland ported to DragonFlyBSD </a></p>

<p><a href="http://undeadly.org/cgi?action=article&sid=20151013161745" rel="nofollow">OpenSMTPd developer debriefs on audit report </a></p>

<p><a href="https://svnweb.freebsd.org/base?view=revision&revision=289316" rel="nofollow">FreeBSD fixes issue with pf under Xen with TSO. Errata coming soon </a></p>

<p><a href="http://slexy.org/view/s2EBjrxQ9M" rel="nofollow">Xinuos funds the HardenedBSD project </a></p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21PMmNFIs" rel="nofollow"> Evan</a></li>
<li><a href="http://slexy.org/view/s20qH07ox0" rel="nofollow"> Darin writes in</a></li>
<li><a href="http://slexy.org/view/s2d0SFmRlD" rel="nofollow"> Jochen writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>110: - Firmware Fights</title>
  <link>https://www.bsdnow.tv/110</link>
  <guid isPermaLink="false">42636b74-791c-44c4-b313-75b8ace4844b</guid>
  <pubDate>Wed, 07 Oct 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/42636b74-791c-44c4-b313-75b8ace4844b.mp3" length="69718036" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSDNow, we get to hear all of Allans post EuroBSDCon wrap-up and a great interview with Benno Rice from Isilon. We got to discuss some of the pain of doing major forklift upgrades, and why your business should track -CURRENT.</itunes:subtitle>
  <itunes:duration>1:36:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSDNow, we get to hear all of Allans post EuroBSDCon wrap-up and a great interview with Benno Rice from Isilon. We got to discuss some of the pain of doing major forklift upgrades, and why your business should track -CURRENT.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
EuroBSDCon Videos
EuroBSDCon has started posting videos of the talks online already.
The videos posted online are archives of the live stream, so some of the videos contain multiple talks
Due to a technical complication, some videos only have 1 channel of audio
EuroBSDCon Talk Schedule (https://2015.eurobsdcon.org/talks-and-schedule/talk-schedule/)
Red Room Videos (https://www.youtube.com/channel/UCBPvcqZrNuKZuP1LQhlCp-A)
Yellow Room Videos (https://www.youtube.com/channel/UCJk8Kls9LT-Txu-Jhv7csfw)
Blue Room Videos (https://www.youtube.com/channel/UC-3DOxIOI5oHXE1H57g3FzQ)
Photos of the conference courtersy of Ollivier Robert (https://assets.keltia.net/photos/EuroBSDCon-2015/)
***
A series of OpenSMTPd patches fix multiple vulnerabilities (http://undeadly.org/cgi?action=article&amp;amp;sid=20151005200020)
Qualys recently published an audit of the OpenSNMPd source code (https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt)
The fixes for these vulnerabilities were released as 5.7.2
After its release, two additional vulnerabilities (http://www.openwall.com/lists/oss-security/2015/10/04/2) were found. One, in the portable version, newer code that was added after the audit started
All users are strongly encouraged to upgrade to 5.7.3
OpenBSD users should apply the latest errata or upgrade to the newest snapshot
***
FreeBSD updates in -CURRENT (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=288917)
Looks like Xen header support has been bumped in FreeBSD from 4.2 -&amp;gt; 4.6
It also enables support for ARM
Update to Clang / LLVM  to 3.7.0 (https://lists.freebsd.org/pipermail/freebsd-current/2015-October/057691.html)
http://llvm.org/releases/3.7.0/docs/ReleaseNotes.html
ZFS gets FRU (field replaceable unit) tracking (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=287745)
OpenCL makes it way into the ports tree (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=397198)
bhyve has grown UEFI support, plus a CSM module
bhyve can now boot Windows  (https://lists.freebsd.org/pipermail/freebsd-virtualization/2015-October/003832.html)
Currently there is still only a serial console, so the post includes an unattended install .xml file and instructions on how to repack the ISO. Once Windows is installed, you can RDP into the machine
bhyve can also now run IllumOS  (https://lists.freebsd.org/pipermail/freebsd-virtualization/2015-October/003833.html)
***
OpenBSD Initial Support for Broadwell Graphics (http://marc.info/?l=openbsd-cvs&amp;amp;m=144304997800589&amp;amp;w=2)
OpenBSD joins DragonFly now with initial support for broadwell GPUs landing in their development branch
This brings Open up to Linux 3.14.52 DRM, and Mark Kettenis mentions that it isn.t perfect yet, and may cause some issues with older hardware, although no major regressions yet
***
OpenBSD Slides for TAME (http://www.openbsd.org/papers/tame-fsec2015/) and libTLS APIs (http://www.openbsd.org/papers/libtls-fsec-2015/)
The first set of slides are from a talk Theo de Raadt gave in Croatia, they describe the history and impetus for tame
Theo specifically avoids comparisons to other sandboxing techniques like capsicum and seccomp, because he is not impartial
tame() itself is only about 1200 lines of code
Sandboxing the file(1) command with systrace: 300 lines of code, with tame: 4 lines
Theo makes the point that .optional security. is irrelevant. If a mitigation feature has a knob to turn it off, some program will break and advise users to turn the feature off. Eventually, no one uses the feature, and it dies
This has lead to OpenBSD.s policy: .Once working, these features cannot be disabled. Application bugs must be fixed.
The second talk is by Bob Beck, about LibreSSL
when LibreSSL was forked from OpenSSL 1.0.1g, it contained 388,000 lines of C code
30 days in LibreSSL, they had deleted 90,000 lines of C
OpenSSL 1.0.2d has 432,000 lines of C (728k total), and OpenSSL Current has 411,000 lines of C (over 1 million total)
LibreSSL today, contains 297,000 lines of C (511k total)
None of the high risk CVEs against OpenSSL (there have been 5) have affected LibreSSL. It turns out removing old code and unneeded features is good for security.
The talk focuses on libtls, an alternative to the OpenSSL API, designed to be easier to use and less error prone
In the libtls api, if -1 is returned, it is always an error. In OpenSSL, it might not be an error, needs additional code to check errno
In OpenBSD: ftp, nc, ntpd, httpd, spamd, syslog have been converted to the new API
The OpenBSD Foundation is looking for donations in order to sponsor 2-3 developers to spend 6 months dedicated to LibreSSL
***
Interview - Benno Rice - benno@FreeBSD.org (mailto:benno@FreeBSD.org) / @jeamland (https://twitter.com/jeamland)
Isilon and building products on top of FreeBSD
News Roundup
ReLaunchd (https://github.com/mheily/relaunchd/blob/master/doc/rationale.txt)
This past week we got a heads up about another init/launchd replacement, this time .Relaunchd.
The goals of this project appear to be keeping launchd functionality, while being portable enough to run on FreeBSD / Linux, etc. 
It also has aspirations of being .container-aware. with support for jailed services, ala-docker, as well as cluster awareness. 
Written in ruby :(, it also maintains that it wishes to NOT take over PID1 or replace the initial system boot scripts, but extend / leverage them in new ways. 
***
Static Intrusion Detection in NetBSD (https://mail-index.netbsd.org/source-changes/2015/09/24/msg069028.html)
Alistar Crooks has committed a new .sid. utility to NetBSD, which allows intrusion detection by comparing the file-system contents to a database of known good values
The utility can compare the entire root file system of a modest NetBSD machine in about 15 seconds
The following parameters of each file can be checked: atime, block count, ctime, file type, flags, group, inode, link target, mtime, number of links, permissions, size, user, crc32c checksum, sha256 checksum, sha512 checksum
A JSON report is issued at the end, for any detected variances
***
LibreSSL 2.3.0 in PC-BSD
If you.re running PC-BSD 10.2-EDGE or October's -CURRENT image, LibreSSL 2.3.0 is now a thing
Thanks to the hard work of Bernard Spil and others, we have merged in the latest LibreSSL which actually removes SSL support in favor of TLS
Quite a number of bugs have been fixed, as well as patches brought over from OpenBSD to fix numerous ports.
Allan has started a patchset that sets the OpenSSL in base to "private" (http://allanjude.com/bsd/privatessl_2015-10-07.patch)
This hides the library so that applications and ports cannot find it, so only tools in the base system, like fetch, will be able to use it. This makes OpenSSL no longer part of the base system ABI, meaning the version can be upgraded without breaking the stable ABI promise. This feature may be important in the future as OpenSSL versions now have EoL dates, that may be sooner than the EoL on the FreeBSD stable branches.
***
PC-BSD and boot-environments without GRUB (http://lists.pcbsd.org/pipermail/testing/2015-October/010173.html)
In this month.s -CURRENT image of PC-BSD, we began the process of moving back from the GRUB boot-loader, in favor of FreeBSD.s
A couple of patches have been included, which enables boot-environment support via the 4th menus (Thanks Allan) and support for booting ZFS on root via UEFI
"beadm" has also been updated to seamlessly support both boot-loaders
No full-disk encryption support yet (hopefully soon), but GRUB is still available on installer for those who need it
***
Import of IWM wireless to DragonFly (http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/24a8d46a22f9106b0c1466c41ba73460d7d22262)
Matthew Dillon has recently imported the newer if_iwm driver from FreeBSD -&amp;gt; DragonFly
Across the internet, users with newer Intel chipsets rejoiced!
Coupled with the latest Broadwell DRM improvements, DragonFly sounds very ready for the latest laptop chipsets
Also, looks like progress is being made on i386 removal (http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/cf37dc2040cea9f384bd7d3dcaf24014f441b8a6)
***
Feedback/Questions
Dan writes in about PCBSD (http://slexy.org/view/s27ZeOiM4t)
Matt writes in about ZFS (http://slexy.org/view/s219J3ebx5)
Anonymous writes in about problems booting (http://slexy.org/view/s21uuMAmZb)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSDNow, we get to hear all of Allans post EuroBSDCon wrap-up and a great interview with Benno Rice from Isilon. We got to discuss some of the pain of doing major forklift upgrades, and why your business should track -CURRENT.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>EuroBSDCon Videos</h3>

<ul>
<li>EuroBSDCon has started posting videos of the talks online already.</li>
<li>The videos posted online are archives of the live stream, so some of the videos contain multiple talks</li>
<li>Due to a technical complication, some videos only have 1 channel of audio</li>
<li><a href="https://2015.eurobsdcon.org/talks-and-schedule/talk-schedule/" rel="nofollow">EuroBSDCon Talk Schedule</a></li>
<li><a href="https://www.youtube.com/channel/UCBPvcqZrNuKZuP1LQhlCp-A" rel="nofollow">Red Room Videos</a></li>
<li><a href="https://www.youtube.com/channel/UCJk8Kls9LT-Txu-Jhv7csfw" rel="nofollow">Yellow Room Videos</a></li>
<li><a href="https://www.youtube.com/channel/UC-3DOxIOI5oHXE1H57g3FzQ" rel="nofollow">Blue Room Videos</a></li>
<li><a href="https://assets.keltia.net/photos/EuroBSDCon-2015/" rel="nofollow">Photos of the conference courtersy of Ollivier Robert</a>
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151005200020" rel="nofollow">A series of OpenSMTPd patches fix multiple vulnerabilities</a></h3>

<ul>
<li>Qualys recently published an <a href="https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt" rel="nofollow">audit of the OpenSNMPd source code</a></li>
<li>The fixes for these vulnerabilities were released as 5.7.2</li>
<li>After its release, two <a href="http://www.openwall.com/lists/oss-security/2015/10/04/2" rel="nofollow">additional vulnerabilities</a> were found. One, in the portable version, newer code that was added after the audit started</li>
<li>All users are strongly encouraged to upgrade to 5.7.3</li>
<li>OpenBSD users should apply the latest errata or upgrade to the newest snapshot
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=288917" rel="nofollow">FreeBSD updates in -CURRENT</a></h3>

<ul>
<li>Looks like Xen header support has been bumped in FreeBSD from 4.2 -&gt; 4.6</li>
<li>It also enables support for ARM</li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-October/057691.html" rel="nofollow">Update to Clang / LLVM  to 3.7.0</a></li>
<li><a href="http://llvm.org/releases/3.7.0/docs/ReleaseNotes.html" rel="nofollow">http://llvm.org/releases/3.7.0/docs/ReleaseNotes.html</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=287745" rel="nofollow">ZFS gets FRU (field replaceable unit) tracking</a></li>
<li><a href="https://svnweb.freebsd.org/ports?view=revision&revision=397198" rel="nofollow">OpenCL makes it way into the ports tree</a></li>
<li>bhyve has grown UEFI support, plus a CSM module</li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2015-October/003832.html" rel="nofollow">bhyve can now boot Windows </a></li>
<li>Currently there is still only a serial console, so the post includes an unattended install .xml file and instructions on how to repack the ISO. Once Windows is installed, you can RDP into the machine</li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2015-October/003833.html" rel="nofollow">bhyve can also now run IllumOS </a>
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=144304997800589&w=2" rel="nofollow">OpenBSD Initial Support for Broadwell Graphics</a></h3>

<ul>
<li>OpenBSD joins DragonFly now with initial support for broadwell GPUs landing in their development branch</li>
<li>This brings Open up to Linux 3.14.52 DRM, and Mark Kettenis mentions that it isn.t perfect yet, and may cause some issues with older hardware, although no major regressions yet
***</li>
</ul>

<h3>OpenBSD Slides for <a href="http://www.openbsd.org/papers/tame-fsec2015/" rel="nofollow">TAME</a> and <a href="http://www.openbsd.org/papers/libtls-fsec-2015/" rel="nofollow">libTLS APIs</a></h3>

<ul>
<li>The first set of slides are from a talk Theo de Raadt gave in Croatia, they describe the history and impetus for tame</li>
<li>Theo specifically avoids comparisons to other sandboxing techniques like capsicum and seccomp, because he is not impartial</li>
<li>tame() itself is only about 1200 lines of code</li>
<li>Sandboxing the file(1) command with systrace: 300 lines of code, with tame: 4 lines</li>
<li>Theo makes the point that .optional security. is irrelevant. If a mitigation feature has a knob to turn it off, some program will break and advise users to turn the feature off. Eventually, no one uses the feature, and it dies</li>
<li>This has lead to OpenBSD.s policy: .Once working, these features cannot be disabled. Application bugs must be fixed.</li>
<li>The second talk is by Bob Beck, about LibreSSL</li>
<li>when LibreSSL was forked from OpenSSL 1.0.1g, it contained 388,000 lines of C code</li>
<li>30 days in LibreSSL, they had deleted 90,000 lines of C</li>
<li>OpenSSL 1.0.2d has 432,000 lines of C (728k total), and OpenSSL Current has 411,000 lines of C (over 1 million total)</li>
<li>LibreSSL today, contains 297,000 lines of C (511k total)</li>
<li>None of the high risk CVEs against OpenSSL (there have been 5) have affected LibreSSL. It turns out removing old code and unneeded features is good for security.</li>
<li>The talk focuses on libtls, an alternative to the OpenSSL API, designed to be easier to use and less error prone</li>
<li>In the libtls api, if -1 is returned, it is always an error. In OpenSSL, it might not be an error, needs additional code to check errno</li>
<li>In OpenBSD: ftp, nc, ntpd, httpd, spamd, syslog have been converted to the new API</li>
<li>The OpenBSD Foundation is looking for donations in order to sponsor 2-3 developers to spend 6 months dedicated to LibreSSL
***</li>
</ul>

<h2>Interview - Benno Rice - <a href="mailto:benno@FreeBSD.org" rel="nofollow">benno@FreeBSD.org</a> / <a href="https://twitter.com/jeamland" rel="nofollow">@jeamland</a></h2>

<p>Isilon and building products on top of FreeBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/mheily/relaunchd/blob/master/doc/rationale.txt" rel="nofollow">ReLaunchd</a></h3>

<ul>
<li>This past week we got a heads up about another init/launchd replacement, this time .Relaunchd.</li>
<li>The goals of this project appear to be keeping launchd functionality, while being portable enough to run on FreeBSD / Linux, etc. </li>
<li>It also has aspirations of being .container-aware. with support for jailed services, ala-docker, as well as cluster awareness. </li>
<li>Written in ruby :(, it also maintains that it wishes to NOT take over PID1 or replace the initial system boot scripts, but extend / leverage them in new ways. 
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/source-changes/2015/09/24/msg069028.html" rel="nofollow">Static Intrusion Detection in NetBSD</a></h3>

<ul>
<li>Alistar Crooks has committed a new .sid. utility to NetBSD, which allows intrusion detection by comparing the file-system contents to a database of known good values</li>
<li>The utility can compare the entire root file system of a modest NetBSD machine in about 15 seconds</li>
<li>The following parameters of each file can be checked: atime, block count, ctime, file type, flags, group, inode, link target, mtime, number of links, permissions, size, user, crc32c checksum, sha256 checksum, sha512 checksum</li>
<li>A JSON report is issued at the end, for any detected variances
***</li>
</ul>

<h3>LibreSSL 2.3.0 in PC-BSD</h3>

<ul>
<li>If you.re running PC-BSD 10.2-EDGE or October&#39;s -CURRENT image, LibreSSL 2.3.0 is now a thing</li>
<li>Thanks to the hard work of Bernard Spil and others, we have merged in the latest LibreSSL which actually removes SSL support in favor of TLS</li>
<li>Quite a number of bugs have been fixed, as well as patches brought over from OpenBSD to fix numerous ports.</li>
<li>Allan has started a patchset that sets the <a href="http://allanjude.com/bsd/privatessl_2015-10-07.patch" rel="nofollow">OpenSSL in base to &quot;private&quot;</a></li>
<li>This hides the library so that applications and ports cannot find it, so only tools in the base system, like fetch, will be able to use it. This makes OpenSSL no longer part of the base system ABI, meaning the version can be upgraded without breaking the stable ABI promise. This feature may be important in the future as OpenSSL versions now have EoL dates, that may be sooner than the EoL on the FreeBSD stable branches.
***</li>
</ul>

<h3><a href="http://lists.pcbsd.org/pipermail/testing/2015-October/010173.html" rel="nofollow">PC-BSD and boot-environments without GRUB</a></h3>

<ul>
<li>In this month.s -CURRENT image of PC-BSD, we began the process of moving back from the GRUB boot-loader, in favor of FreeBSD.s</li>
<li>A couple of patches have been included, which enables boot-environment support via the 4th menus (Thanks Allan) and support for booting ZFS on root via UEFI</li>
<li>&quot;beadm&quot; has also been updated to seamlessly support both boot-loaders</li>
<li>No full-disk encryption support yet (hopefully soon), but GRUB is still available on installer for those who need it
***</li>
</ul>

<h3><a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/24a8d46a22f9106b0c1466c41ba73460d7d22262" rel="nofollow">Import of IWM wireless to DragonFly</a></h3>

<ul>
<li>Matthew Dillon has recently imported the newer if_iwm driver from FreeBSD -&gt; DragonFly</li>
<li>Across the internet, users with newer Intel chipsets rejoiced!</li>
<li>Coupled with the latest Broadwell DRM improvements, DragonFly sounds very ready for the latest laptop chipsets</li>
<li>Also, looks like progress is being made on <a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/cf37dc2040cea9f384bd7d3dcaf24014f441b8a6" rel="nofollow">i386 removal</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s27ZeOiM4t" rel="nofollow">Dan writes in about PCBSD</a></li>
<li><a href="http://slexy.org/view/s219J3ebx5" rel="nofollow">Matt writes in about ZFS</a></li>
<li><a href="http://slexy.org/view/s21uuMAmZb" rel="nofollow">Anonymous writes in about problems booting</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSDNow, we get to hear all of Allans post EuroBSDCon wrap-up and a great interview with Benno Rice from Isilon. We got to discuss some of the pain of doing major forklift upgrades, and why your business should track -CURRENT.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3>EuroBSDCon Videos</h3>

<ul>
<li>EuroBSDCon has started posting videos of the talks online already.</li>
<li>The videos posted online are archives of the live stream, so some of the videos contain multiple talks</li>
<li>Due to a technical complication, some videos only have 1 channel of audio</li>
<li><a href="https://2015.eurobsdcon.org/talks-and-schedule/talk-schedule/" rel="nofollow">EuroBSDCon Talk Schedule</a></li>
<li><a href="https://www.youtube.com/channel/UCBPvcqZrNuKZuP1LQhlCp-A" rel="nofollow">Red Room Videos</a></li>
<li><a href="https://www.youtube.com/channel/UCJk8Kls9LT-Txu-Jhv7csfw" rel="nofollow">Yellow Room Videos</a></li>
<li><a href="https://www.youtube.com/channel/UC-3DOxIOI5oHXE1H57g3FzQ" rel="nofollow">Blue Room Videos</a></li>
<li><a href="https://assets.keltia.net/photos/EuroBSDCon-2015/" rel="nofollow">Photos of the conference courtersy of Ollivier Robert</a>
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20151005200020" rel="nofollow">A series of OpenSMTPd patches fix multiple vulnerabilities</a></h3>

<ul>
<li>Qualys recently published an <a href="https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt" rel="nofollow">audit of the OpenSNMPd source code</a></li>
<li>The fixes for these vulnerabilities were released as 5.7.2</li>
<li>After its release, two <a href="http://www.openwall.com/lists/oss-security/2015/10/04/2" rel="nofollow">additional vulnerabilities</a> were found. One, in the portable version, newer code that was added after the audit started</li>
<li>All users are strongly encouraged to upgrade to 5.7.3</li>
<li>OpenBSD users should apply the latest errata or upgrade to the newest snapshot
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=288917" rel="nofollow">FreeBSD updates in -CURRENT</a></h3>

<ul>
<li>Looks like Xen header support has been bumped in FreeBSD from 4.2 -&gt; 4.6</li>
<li>It also enables support for ARM</li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-October/057691.html" rel="nofollow">Update to Clang / LLVM  to 3.7.0</a></li>
<li><a href="http://llvm.org/releases/3.7.0/docs/ReleaseNotes.html" rel="nofollow">http://llvm.org/releases/3.7.0/docs/ReleaseNotes.html</a></li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=287745" rel="nofollow">ZFS gets FRU (field replaceable unit) tracking</a></li>
<li><a href="https://svnweb.freebsd.org/ports?view=revision&revision=397198" rel="nofollow">OpenCL makes it way into the ports tree</a></li>
<li>bhyve has grown UEFI support, plus a CSM module</li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2015-October/003832.html" rel="nofollow">bhyve can now boot Windows </a></li>
<li>Currently there is still only a serial console, so the post includes an unattended install .xml file and instructions on how to repack the ISO. Once Windows is installed, you can RDP into the machine</li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2015-October/003833.html" rel="nofollow">bhyve can also now run IllumOS </a>
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=144304997800589&w=2" rel="nofollow">OpenBSD Initial Support for Broadwell Graphics</a></h3>

<ul>
<li>OpenBSD joins DragonFly now with initial support for broadwell GPUs landing in their development branch</li>
<li>This brings Open up to Linux 3.14.52 DRM, and Mark Kettenis mentions that it isn.t perfect yet, and may cause some issues with older hardware, although no major regressions yet
***</li>
</ul>

<h3>OpenBSD Slides for <a href="http://www.openbsd.org/papers/tame-fsec2015/" rel="nofollow">TAME</a> and <a href="http://www.openbsd.org/papers/libtls-fsec-2015/" rel="nofollow">libTLS APIs</a></h3>

<ul>
<li>The first set of slides are from a talk Theo de Raadt gave in Croatia, they describe the history and impetus for tame</li>
<li>Theo specifically avoids comparisons to other sandboxing techniques like capsicum and seccomp, because he is not impartial</li>
<li>tame() itself is only about 1200 lines of code</li>
<li>Sandboxing the file(1) command with systrace: 300 lines of code, with tame: 4 lines</li>
<li>Theo makes the point that .optional security. is irrelevant. If a mitigation feature has a knob to turn it off, some program will break and advise users to turn the feature off. Eventually, no one uses the feature, and it dies</li>
<li>This has lead to OpenBSD.s policy: .Once working, these features cannot be disabled. Application bugs must be fixed.</li>
<li>The second talk is by Bob Beck, about LibreSSL</li>
<li>when LibreSSL was forked from OpenSSL 1.0.1g, it contained 388,000 lines of C code</li>
<li>30 days in LibreSSL, they had deleted 90,000 lines of C</li>
<li>OpenSSL 1.0.2d has 432,000 lines of C (728k total), and OpenSSL Current has 411,000 lines of C (over 1 million total)</li>
<li>LibreSSL today, contains 297,000 lines of C (511k total)</li>
<li>None of the high risk CVEs against OpenSSL (there have been 5) have affected LibreSSL. It turns out removing old code and unneeded features is good for security.</li>
<li>The talk focuses on libtls, an alternative to the OpenSSL API, designed to be easier to use and less error prone</li>
<li>In the libtls api, if -1 is returned, it is always an error. In OpenSSL, it might not be an error, needs additional code to check errno</li>
<li>In OpenBSD: ftp, nc, ntpd, httpd, spamd, syslog have been converted to the new API</li>
<li>The OpenBSD Foundation is looking for donations in order to sponsor 2-3 developers to spend 6 months dedicated to LibreSSL
***</li>
</ul>

<h2>Interview - Benno Rice - <a href="mailto:benno@FreeBSD.org" rel="nofollow">benno@FreeBSD.org</a> / <a href="https://twitter.com/jeamland" rel="nofollow">@jeamland</a></h2>

<p>Isilon and building products on top of FreeBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/mheily/relaunchd/blob/master/doc/rationale.txt" rel="nofollow">ReLaunchd</a></h3>

<ul>
<li>This past week we got a heads up about another init/launchd replacement, this time .Relaunchd.</li>
<li>The goals of this project appear to be keeping launchd functionality, while being portable enough to run on FreeBSD / Linux, etc. </li>
<li>It also has aspirations of being .container-aware. with support for jailed services, ala-docker, as well as cluster awareness. </li>
<li>Written in ruby :(, it also maintains that it wishes to NOT take over PID1 or replace the initial system boot scripts, but extend / leverage them in new ways. 
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/source-changes/2015/09/24/msg069028.html" rel="nofollow">Static Intrusion Detection in NetBSD</a></h3>

<ul>
<li>Alistar Crooks has committed a new .sid. utility to NetBSD, which allows intrusion detection by comparing the file-system contents to a database of known good values</li>
<li>The utility can compare the entire root file system of a modest NetBSD machine in about 15 seconds</li>
<li>The following parameters of each file can be checked: atime, block count, ctime, file type, flags, group, inode, link target, mtime, number of links, permissions, size, user, crc32c checksum, sha256 checksum, sha512 checksum</li>
<li>A JSON report is issued at the end, for any detected variances
***</li>
</ul>

<h3>LibreSSL 2.3.0 in PC-BSD</h3>

<ul>
<li>If you.re running PC-BSD 10.2-EDGE or October&#39;s -CURRENT image, LibreSSL 2.3.0 is now a thing</li>
<li>Thanks to the hard work of Bernard Spil and others, we have merged in the latest LibreSSL which actually removes SSL support in favor of TLS</li>
<li>Quite a number of bugs have been fixed, as well as patches brought over from OpenBSD to fix numerous ports.</li>
<li>Allan has started a patchset that sets the <a href="http://allanjude.com/bsd/privatessl_2015-10-07.patch" rel="nofollow">OpenSSL in base to &quot;private&quot;</a></li>
<li>This hides the library so that applications and ports cannot find it, so only tools in the base system, like fetch, will be able to use it. This makes OpenSSL no longer part of the base system ABI, meaning the version can be upgraded without breaking the stable ABI promise. This feature may be important in the future as OpenSSL versions now have EoL dates, that may be sooner than the EoL on the FreeBSD stable branches.
***</li>
</ul>

<h3><a href="http://lists.pcbsd.org/pipermail/testing/2015-October/010173.html" rel="nofollow">PC-BSD and boot-environments without GRUB</a></h3>

<ul>
<li>In this month.s -CURRENT image of PC-BSD, we began the process of moving back from the GRUB boot-loader, in favor of FreeBSD.s</li>
<li>A couple of patches have been included, which enables boot-environment support via the 4th menus (Thanks Allan) and support for booting ZFS on root via UEFI</li>
<li>&quot;beadm&quot; has also been updated to seamlessly support both boot-loaders</li>
<li>No full-disk encryption support yet (hopefully soon), but GRUB is still available on installer for those who need it
***</li>
</ul>

<h3><a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/24a8d46a22f9106b0c1466c41ba73460d7d22262" rel="nofollow">Import of IWM wireless to DragonFly</a></h3>

<ul>
<li>Matthew Dillon has recently imported the newer if_iwm driver from FreeBSD -&gt; DragonFly</li>
<li>Across the internet, users with newer Intel chipsets rejoiced!</li>
<li>Coupled with the latest Broadwell DRM improvements, DragonFly sounds very ready for the latest laptop chipsets</li>
<li>Also, looks like progress is being made on <a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/cf37dc2040cea9f384bd7d3dcaf24014f441b8a6" rel="nofollow">i386 removal</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s27ZeOiM4t" rel="nofollow">Dan writes in about PCBSD</a></li>
<li><a href="http://slexy.org/view/s219J3ebx5" rel="nofollow">Matt writes in about ZFS</a></li>
<li><a href="http://slexy.org/view/s21uuMAmZb" rel="nofollow">Anonymous writes in about problems booting</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>109: Impish BSD</title>
  <link>https://www.bsdnow.tv/109</link>
  <guid isPermaLink="false">a2df1fdd-3669-4b6c-8bad-03ee4f1716d1</guid>
  <pubDate>Wed, 30 Sep 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a2df1fdd-3669-4b6c-8bad-03ee4f1716d1.mp3" length="39751060" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week, we have a great interview with Warner Losh of the FreeBSD project! We will be discussing everything from automatic kernel module loading, IO scheduling and of course NanoBSD.</itunes:subtitle>
  <itunes:duration>55:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week, we have a great interview with Warner Losh of the FreeBSD project! We will be discussing everything from automatic kernel module loading, IO scheduling and of course NanoBSD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Interview - Warner Losh - imp@bsdimp.com (imp@bsdimp.com) / @bsdimp (https://twitter.com/bsdimp)
SSD performance and driver auto-loader
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week, we have a great interview with Warner Losh of the FreeBSD project! We will be discussing everything from automatic kernel module loading, IO scheduling and of course NanoBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Warner Losh - [<a href="mailto:imp@bsdimp.com" rel="nofollow">imp@bsdimp.com</a>](<a href="mailto:imp@bsdimp.com" rel="nofollow">imp@bsdimp.com</a>) / <a href="https://twitter.com/bsdimp" rel="nofollow">@bsdimp</a></h2>

<p>SSD performance and driver auto-loader</p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week, we have a great interview with Warner Losh of the FreeBSD project! We will be discussing everything from automatic kernel module loading, IO scheduling and of course NanoBSD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Warner Losh - [<a href="mailto:imp@bsdimp.com" rel="nofollow">imp@bsdimp.com</a>](<a href="mailto:imp@bsdimp.com" rel="nofollow">imp@bsdimp.com</a>) / <a href="https://twitter.com/bsdimp" rel="nofollow">@bsdimp</a></h2>

<p>SSD performance and driver auto-loader</p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>108: ServeUp BSD</title>
  <link>https://www.bsdnow.tv/108</link>
  <guid isPermaLink="false">a3075d6e-f3f6-46a7-9c4f-402d380237db</guid>
  <pubDate>Wed, 23 Sep 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a3075d6e-f3f6-46a7-9c4f-402d380237db.mp3" length="56182612" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, Allan is heading to Sweden, but we have a great interview with Andrew Pantyukhin to bring you. We will be discussing everything from contributions to FreeBSD, which technologies worked best in the datacenter, config management and more.</itunes:subtitle>
  <itunes:duration>1:18:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, Allan is heading to Sweden, but we have a great interview with Andrew Pantyukhin to bring you. We will be discussing everything from contributions to FreeBSD, which technologies worked best in the datacenter, config management and more.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Allan is away this week, traveling to Sweden for the ACM womENcourage conference followed by EuroBSDCon, but we have an excellent interview for you, so sit back and enjoy the show. Allan will be back on October 5th, so we look forward to bringing you a live show, with all the details about EuroBSD and more!
Interview - Andrew Pantyukhin - infofarmer@gmail.com (mailto:infofarmer@gmail.com) / @infofarmer (https://twitter.com/infofarmer)
Building products with FreeBSD
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, Allan is heading to Sweden, but we have a great interview with Andrew Pantyukhin to bring you. We will be discussing everything from contributions to FreeBSD, which technologies worked best in the datacenter, config management and more.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<p>Allan is away this week, traveling to Sweden for the ACM womENcourage conference followed by EuroBSDCon, but we have an excellent interview for you, so sit back and enjoy the show. Allan will be back on October 5th, so we look forward to bringing you a live show, with all the details about EuroBSD and more!</p>

<h2>Interview - Andrew Pantyukhin - <a href="mailto:infofarmer@gmail.com" rel="nofollow">infofarmer@gmail.com</a> / <a href="https://twitter.com/infofarmer" rel="nofollow">@infofarmer</a></h2>

<p>Building products with FreeBSD</p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, Allan is heading to Sweden, but we have a great interview with Andrew Pantyukhin to bring you. We will be discussing everything from contributions to FreeBSD, which technologies worked best in the datacenter, config management and more.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<p>Allan is away this week, traveling to Sweden for the ACM womENcourage conference followed by EuroBSDCon, but we have an excellent interview for you, so sit back and enjoy the show. Allan will be back on October 5th, so we look forward to bringing you a live show, with all the details about EuroBSD and more!</p>

<h2>Interview - Andrew Pantyukhin - <a href="mailto:infofarmer@gmail.com" rel="nofollow">infofarmer@gmail.com</a> / <a href="https://twitter.com/infofarmer" rel="nofollow">@infofarmer</a></h2>

<p>Building products with FreeBSD</p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>107: In their midst</title>
  <link>https://www.bsdnow.tv/107</link>
  <guid isPermaLink="false">5bead015-3333-45fa-bfba-838f2d3a8801</guid>
  <pubDate>Wed, 16 Sep 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5bead015-3333-45fa-bfba-838f2d3a8801.mp3" length="62196052" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week, we are going to be talking with Aaron Poffenberger, who has much to share about his first-hand experience in infiltrating Linux conferences with BSD-goodness.</itunes:subtitle>
  <itunes:duration>1:26:22</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week, we are going to be talking with Aaron Poffenberger, who has much to share about his first-hand experience in infiltrating Linux conferences with BSD-goodness.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Alexander Motin implements CTL High Availability (https://svnweb.freebsd.org/changeset/base/r287621)
CTL HA allows two .head. nodes to be connected to the same set of disks, safely
An HA storage appliance usually consists of 2 totally separate servers, connected to a shared set of disks in separate JBOD sleds
The problem with this setup is that if both machines try to use the disks at the same time, bad things will happen
With CTL HA, the two nodes can communicate, in this case over a special TCP protocol, to coordinate and make sure they do not step on each others toes, allowing safe operation
The CTL HA implementation in FreeBSD can operate in the following four modes:
Active/Unavailable -- without interlink between nodes
Active/Standby -- with the second node handling only basic LUN discovery and
reservation, synchronizing with the first node through the interlink
Active/Active -- with both nodes processing commands and accessing the
backing storage, synchronizing with the first node through the interlink
Active/Proxy -- with second node working as proxy, transferring all
commands to the first node for execution through the interlink
The custom TCP protocol has no authentication, so it should never be enabled on public interfaces
Doc Update (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=287707)
***
Panel Self-Refresh support lands in DragonFlyBSD (http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d13e957b0d66a395b3736c43f18972c282bbd58a)
In what seems almost weekly improvements being made to the Xorg stack for DragonFly, we now have Panel Self-Refresh landing, thanks to Imre Vadász
Understanding Panel Self-Refresh (http://www.anandtech.com/show/7208/understanding-panel-self-refresh) and More about Panel Self-Refresh (http://www.hardwaresecrets.com/introducing-the-panel-self-refresh-technology/)
In a nutshell, the above articles talks about how in the case of static images on the screen, power-savings can be obtained by refreshing static images from display memory (frame-buffer), disabling the video processing of the CPU/GPU and associated pipeline during the process. 
And just for good measure, Imre also committed some further Intel driver cleanup, reducing the diff with Linux 3.17 (http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/6b231eab9db5ef4d4dc3816487d8e3d48941e0e2)
***
Introducing Sluice, a new ZFS snapshot management tool (https://bitbucket.org/stevedrake/sluice)
A new ZFS snapshot management tool written in Python and modeled after Apple.s Time Machine
Simple command line interface
No configuration files, settings are stored as ZFS user properties
Includes simple remote replication support
Can operate on remote systems with the zfs://user@host/path@snapname url schema
Future feature list includes .import. command to moved files from non-ZFS storage to ZFS and create a snapshot, and .export. to do the inverse
Thanks to Dan for tipping us about this new project
***
Why WhatsApp only needs 50 engineers for 900 million users (http://www.wired.com/2015/09/whatsapp-serves-900-million-users-50-engineers/)
Wired has a good write-up on the behind-the-scenes work taking place at WhatsApp
While the article mentions FreeBSD, it spends the bulk of its discussion about Erlang and using its scalable concurrency and deployment of new code to running processes. 
FB messenger uses Haskell to accomplish much the same thing, while Google and Mozilla are currently trying to bring the same level of flexibility to Go and Rust respectively. 
video (https://www.youtube.com/watch?v=57Ch2j8U0lk)
Thanks to Ed for submitting this news item
***
Interview - Aaron Poffenberger - email@email (mailto:akp@hypernote.com) / @akpoff (https://twitter.com/akpoff)
BSD in a strange place
+ KM: Go ahead and tell us about yourself and how did you first get involved with BSD?
+ AJ: You.ve presented recently at Texas Linux Fest, both on FreeBSD and FreeNAS. What specifically prompted you to do that?
+ KM: What would you say are the main selling points when presenting BSD to Linux users and admins? 
+ AJ: On the flip side of this topic, in what areas to do you think we could improve BSD to present better to Linux users?
+ KM: What would you specifically recommend to other BSD users or fans who may also want to help present or teach about BSD? Any things specifically to avoid?
+ AJ: What is the typical depth of knowledge you encounter when presenting BSD to a mostly Linux crowd? Any surprises when doing so?
+ KM: Since you have done this before, are you mainly writing your own material or borrowing from other talks that have been done on BSD? Do you think there.s a place for some collaboration, maybe having a repository of materials that can be used for other BSD presenters at their local linux conference / LUG?
+ AJ: Since you are primarily an OpenBSD user have you thought about doing any talks related to it? Is OpenBSD something on the radar of the typical Linux conference-goer?
+ KM: Is there anything else you would like to mention before we wrap up?
News Roundup
GhostBSD 10.1 released  (http://ghostbsd.org/10.1_release_eve)
GhostBSD has given us a new release, this time it also includes XFCE as an alternative to the MATE desktop
The installer has been updated to allow using GRUB, BSD loader, or none at all
It also includes the new OctoPKG manager, which proves a Qt driven front-end to pkgng
Thanks to Shawn for submitting this
***
Moving to FreeBSD (https://www.textplain.net/blog/2015/moving-to-freebsd/)
In this blog post, Randy Westlund takes us through his journey of moving from Gentoo over to FreeBSD
Inspired in part due to Systemd, he first spent some time on Wikipedia reading about BSD before taking the plunge to grab FreeBSD and give it a whirl in a VM.
"My first impression was that installation was super easy. Installing Gentoo is done manually and can be a "fun" weekend adventure if you're not sure what you're doing. I can spin up a new FreeBSD VM in five minutes."
"There's a man page for everything! And they're well-written! Gentoo has the best documentation of any Linux distro I've used, but FreeBSD is on another level. With a copy of the FreeBSD Handbook and the system man pages, I can actually get things done without tabbing over to Google every five minutes."
He goes on to mention everything from Init system, Jails, Security, Community and License, a well-rounded article. 
Also gives a nice shout-out to PC-BSD as an even easier way to get started on a FreeBSD journey, thanks!
Shout out to Matt for tipping us to this blog post
***
OpenBSD Enables GPT by default  (https://marc.info/?l=openbsd-cvs&amp;amp;m=144190275908215&amp;amp;w=2)
Looks like OpenBSD has taken the plunge and enabled GPT by default now
Ken Westerback does us the honors, by removing the kernel option for GPT
Users on -CURRENT should give this a whirl, and of course report issues back upstream
Credit to Jona for writing in about this one
***
DISCUSSION: Are reproducible builds worth-while? (http://www.tedunangst.com/flak/post/reproducible-builds-are-a-waste-of-time)
In this weeks article / rant, Ted takes on the notion of reproducible builds being the end-all be-all for security. 
What about compiler backdoors?
This does not prevent shellshock, or other bugs in the code itself
Personally, I.m all in favor, another .Trust but verify. mechanism of the distributed binaries, plus it makes it handy to do source builds and not end up with various checksum changes where no code actually changed. 
***
Feedback/Questions
David writes in (http://slexy.org/view/s20Q7XjxNH)
Possnfiffer writes in (http://slexy.org/view/s2QtE6XzJK)
Daniel writes in (http://slexy.org/view/s20uloOljw)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week, we are going to be talking with Aaron Poffenberger, who has much to share about his first-hand experience in infiltrating Linux conferences with BSD-goodness.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/changeset/base/r287621" rel="nofollow">Alexander Motin implements CTL High Availability</a></h3>

<ul>
<li>CTL HA allows two .head. nodes to be connected to the same set of disks, safely</li>
<li>An HA storage appliance usually consists of 2 totally separate servers, connected to a shared set of disks in separate JBOD sleds</li>
<li>The problem with this setup is that if both machines try to use the disks at the same time, bad things will happen</li>
<li>With CTL HA, the two nodes can communicate, in this case over a special TCP protocol, to coordinate and make sure they do not step on each others toes, allowing safe operation</li>
<li>The CTL HA implementation in FreeBSD can operate in the following four modes:</li>
<li>Active/Unavailable -- without interlink between nodes

<ul>
<li>Active/Standby -- with the second node handling only basic LUN discovery and
reservation, synchronizing with the first node through the interlink</li>
<li>Active/Active -- with both nodes processing commands and accessing the
backing storage, synchronizing with the first node through the interlink</li>
<li>Active/Proxy -- with second node working as proxy, transferring all
commands to the first node for execution through the interlink</li>
</ul></li>
<li>The custom TCP protocol has no authentication, so it should never be enabled on public interfaces</li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=287707" rel="nofollow">Doc Update</a>
***</li>
</ul>

<h3><a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d13e957b0d66a395b3736c43f18972c282bbd58a" rel="nofollow">Panel Self-Refresh support lands in DragonFlyBSD</a></h3>

<ul>
<li>In what seems almost weekly improvements being made to the Xorg stack for DragonFly, we now have Panel Self-Refresh landing, thanks to Imre Vadász</li>
<li><a href="http://www.anandtech.com/show/7208/understanding-panel-self-refresh" rel="nofollow">Understanding Panel Self-Refresh</a> and <a href="http://www.hardwaresecrets.com/introducing-the-panel-self-refresh-technology/" rel="nofollow">More about Panel Self-Refresh</a></li>
<li>In a nutshell, the above articles talks about how in the case of static images on the screen, power-savings can be obtained by refreshing static images from display memory (frame-buffer), disabling the video processing of the CPU/GPU and associated pipeline during the process. </li>
<li>And just for good measure, Imre also committed some further Intel driver cleanup, <a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/6b231eab9db5ef4d4dc3816487d8e3d48941e0e2" rel="nofollow">reducing the diff with Linux 3.17</a>
***</li>
</ul>

<h3><a href="https://bitbucket.org/stevedrake/sluice" rel="nofollow">Introducing Sluice, a new ZFS snapshot management tool</a></h3>

<ul>
<li>A new ZFS snapshot management tool written in Python and modeled after Apple.s Time Machine</li>
<li>Simple command line interface</li>
<li>No configuration files, settings are stored as ZFS user properties</li>
<li>Includes simple remote replication support</li>
<li>Can operate on remote systems with the zfs://user@host/path@snapname url schema</li>
<li>Future feature list includes .import. command to moved files from non-ZFS storage to ZFS and create a snapshot, and .export. to do the inverse</li>
<li>Thanks to Dan for tipping us about this new project
***</li>
</ul>

<h3><a href="http://www.wired.com/2015/09/whatsapp-serves-900-million-users-50-engineers/" rel="nofollow">Why WhatsApp only needs 50 engineers for 900 million users</a></h3>

<ul>
<li>Wired has a good write-up on the behind-the-scenes work taking place at WhatsApp</li>
<li>While the article mentions FreeBSD, it spends the bulk of its discussion about Erlang and using its scalable concurrency and deployment of new code to running processes. </li>
<li>FB messenger uses Haskell to accomplish much the same thing, while Google and Mozilla are currently trying to bring the same level of flexibility to Go and Rust respectively. </li>
<li><a href="https://www.youtube.com/watch?v=57Ch2j8U0lk" rel="nofollow">video</a></li>
<li>Thanks to Ed for submitting this news item
***</li>
</ul>

<h2>Interview - Aaron Poffenberger - <a href="mailto:akp@hypernote.com" rel="nofollow">email@email</a> / <a href="https://twitter.com/akpoff" rel="nofollow">@akpoff</a></h2>

<p>BSD in a strange place</p>

<ul>
<li>KM: Go ahead and tell us about yourself and how did you first get involved with BSD?</li>
<li>AJ: You.ve presented recently at Texas Linux Fest, both on FreeBSD and FreeNAS. What specifically prompted you to do that?</li>
<li>KM: What would you say are the main selling points when presenting BSD to Linux users and admins? </li>
<li>AJ: On the flip side of this topic, in what areas to do you think we could improve BSD to present better to Linux users?</li>
<li>KM: What would you specifically recommend to other BSD users or fans who may also want to help present or teach about BSD? Any things specifically to avoid?</li>
<li>AJ: What is the typical depth of knowledge you encounter when presenting BSD to a mostly Linux crowd? Any surprises when doing so?</li>
<li>KM: Since you have done this before, are you mainly writing your own material or borrowing from other talks that have been done on BSD? Do you think there.s a place for some collaboration, maybe having a repository of materials that can be used for other BSD presenters at their local linux conference / LUG?</li>
<li>AJ: Since you are primarily an OpenBSD user have you thought about doing any talks related to it? Is OpenBSD something on the radar of the typical Linux conference-goer?</li>
<li>KM: Is there anything else you would like to mention before we wrap up?
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://ghostbsd.org/10.1_release_eve" rel="nofollow">GhostBSD 10.1 released </a></h3>

<ul>
<li>GhostBSD has given us a new release, this time it also includes XFCE as an alternative to the MATE desktop</li>
<li>The installer has been updated to allow using GRUB, BSD loader, or none at all</li>
<li>It also includes the new OctoPKG manager, which proves a Qt driven front-end to pkgng</li>
<li>Thanks to Shawn for submitting this
***</li>
</ul>

<h3><a href="https://www.textplain.net/blog/2015/moving-to-freebsd/" rel="nofollow">Moving to FreeBSD</a></h3>

<ul>
<li>In this blog post, Randy Westlund takes us through his journey of moving from Gentoo over to FreeBSD</li>
<li>Inspired in part due to Systemd, he first spent some time on Wikipedia reading about BSD before taking the plunge to grab FreeBSD and give it a whirl in a VM.</li>
<li>&quot;My first impression was that installation was super easy. Installing Gentoo is done manually and can be a &quot;fun&quot; weekend adventure if you&#39;re not sure what you&#39;re doing. I can spin up a new FreeBSD VM in five minutes.&quot;</li>
<li>&quot;There&#39;s a man page for everything! And they&#39;re well-written! Gentoo has the best documentation of any Linux distro I&#39;ve used, but FreeBSD is on another level. With a copy of the FreeBSD Handbook and the system man pages, I can actually get things done without tabbing over to Google every five minutes.&quot;</li>
<li>He goes on to mention everything from Init system, Jails, Security, Community and License, a well-rounded article. </li>
<li>Also gives a nice shout-out to PC-BSD as an even easier way to get started on a FreeBSD journey, thanks!</li>
<li>Shout out to Matt for tipping us to this blog post
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-cvs&m=144190275908215&w=2" rel="nofollow">OpenBSD Enables GPT by default </a></h3>

<ul>
<li>Looks like OpenBSD has taken the plunge and enabled GPT by default now</li>
<li>Ken Westerback does us the honors, by removing the kernel option for GPT</li>
<li>Users on -CURRENT should give this a whirl, and of course report issues back upstream</li>
<li>Credit to Jona for writing in about this one
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/reproducible-builds-are-a-waste-of-time" rel="nofollow">DISCUSSION: Are reproducible builds worth-while?</a></h3>

<ul>
<li>In this weeks article / rant, Ted takes on the notion of reproducible builds being the end-all be-all for security. </li>
<li>What about compiler backdoors?</li>
<li>This does not prevent shellshock, or other bugs in the code itself</li>
<li>Personally, I.m all in favor, another .Trust but verify. mechanism of the distributed binaries, plus it makes it handy to do source builds and not end up with various checksum changes where no code actually changed. 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20Q7XjxNH" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s2QtE6XzJK" rel="nofollow">Possnfiffer writes in</a></li>
<li><a href="http://slexy.org/view/s20uloOljw" rel="nofollow">Daniel writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week, we are going to be talking with Aaron Poffenberger, who has much to share about his first-hand experience in infiltrating Linux conferences with BSD-goodness.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/changeset/base/r287621" rel="nofollow">Alexander Motin implements CTL High Availability</a></h3>

<ul>
<li>CTL HA allows two .head. nodes to be connected to the same set of disks, safely</li>
<li>An HA storage appliance usually consists of 2 totally separate servers, connected to a shared set of disks in separate JBOD sleds</li>
<li>The problem with this setup is that if both machines try to use the disks at the same time, bad things will happen</li>
<li>With CTL HA, the two nodes can communicate, in this case over a special TCP protocol, to coordinate and make sure they do not step on each others toes, allowing safe operation</li>
<li>The CTL HA implementation in FreeBSD can operate in the following four modes:</li>
<li>Active/Unavailable -- without interlink between nodes

<ul>
<li>Active/Standby -- with the second node handling only basic LUN discovery and
reservation, synchronizing with the first node through the interlink</li>
<li>Active/Active -- with both nodes processing commands and accessing the
backing storage, synchronizing with the first node through the interlink</li>
<li>Active/Proxy -- with second node working as proxy, transferring all
commands to the first node for execution through the interlink</li>
</ul></li>
<li>The custom TCP protocol has no authentication, so it should never be enabled on public interfaces</li>
<li><a href="https://svnweb.freebsd.org/base?view=revision&revision=287707" rel="nofollow">Doc Update</a>
***</li>
</ul>

<h3><a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/d13e957b0d66a395b3736c43f18972c282bbd58a" rel="nofollow">Panel Self-Refresh support lands in DragonFlyBSD</a></h3>

<ul>
<li>In what seems almost weekly improvements being made to the Xorg stack for DragonFly, we now have Panel Self-Refresh landing, thanks to Imre Vadász</li>
<li><a href="http://www.anandtech.com/show/7208/understanding-panel-self-refresh" rel="nofollow">Understanding Panel Self-Refresh</a> and <a href="http://www.hardwaresecrets.com/introducing-the-panel-self-refresh-technology/" rel="nofollow">More about Panel Self-Refresh</a></li>
<li>In a nutshell, the above articles talks about how in the case of static images on the screen, power-savings can be obtained by refreshing static images from display memory (frame-buffer), disabling the video processing of the CPU/GPU and associated pipeline during the process. </li>
<li>And just for good measure, Imre also committed some further Intel driver cleanup, <a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/6b231eab9db5ef4d4dc3816487d8e3d48941e0e2" rel="nofollow">reducing the diff with Linux 3.17</a>
***</li>
</ul>

<h3><a href="https://bitbucket.org/stevedrake/sluice" rel="nofollow">Introducing Sluice, a new ZFS snapshot management tool</a></h3>

<ul>
<li>A new ZFS snapshot management tool written in Python and modeled after Apple.s Time Machine</li>
<li>Simple command line interface</li>
<li>No configuration files, settings are stored as ZFS user properties</li>
<li>Includes simple remote replication support</li>
<li>Can operate on remote systems with the zfs://user@host/path@snapname url schema</li>
<li>Future feature list includes .import. command to moved files from non-ZFS storage to ZFS and create a snapshot, and .export. to do the inverse</li>
<li>Thanks to Dan for tipping us about this new project
***</li>
</ul>

<h3><a href="http://www.wired.com/2015/09/whatsapp-serves-900-million-users-50-engineers/" rel="nofollow">Why WhatsApp only needs 50 engineers for 900 million users</a></h3>

<ul>
<li>Wired has a good write-up on the behind-the-scenes work taking place at WhatsApp</li>
<li>While the article mentions FreeBSD, it spends the bulk of its discussion about Erlang and using its scalable concurrency and deployment of new code to running processes. </li>
<li>FB messenger uses Haskell to accomplish much the same thing, while Google and Mozilla are currently trying to bring the same level of flexibility to Go and Rust respectively. </li>
<li><a href="https://www.youtube.com/watch?v=57Ch2j8U0lk" rel="nofollow">video</a></li>
<li>Thanks to Ed for submitting this news item
***</li>
</ul>

<h2>Interview - Aaron Poffenberger - <a href="mailto:akp@hypernote.com" rel="nofollow">email@email</a> / <a href="https://twitter.com/akpoff" rel="nofollow">@akpoff</a></h2>

<p>BSD in a strange place</p>

<ul>
<li>KM: Go ahead and tell us about yourself and how did you first get involved with BSD?</li>
<li>AJ: You.ve presented recently at Texas Linux Fest, both on FreeBSD and FreeNAS. What specifically prompted you to do that?</li>
<li>KM: What would you say are the main selling points when presenting BSD to Linux users and admins? </li>
<li>AJ: On the flip side of this topic, in what areas to do you think we could improve BSD to present better to Linux users?</li>
<li>KM: What would you specifically recommend to other BSD users or fans who may also want to help present or teach about BSD? Any things specifically to avoid?</li>
<li>AJ: What is the typical depth of knowledge you encounter when presenting BSD to a mostly Linux crowd? Any surprises when doing so?</li>
<li>KM: Since you have done this before, are you mainly writing your own material or borrowing from other talks that have been done on BSD? Do you think there.s a place for some collaboration, maybe having a repository of materials that can be used for other BSD presenters at their local linux conference / LUG?</li>
<li>AJ: Since you are primarily an OpenBSD user have you thought about doing any talks related to it? Is OpenBSD something on the radar of the typical Linux conference-goer?</li>
<li>KM: Is there anything else you would like to mention before we wrap up?
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://ghostbsd.org/10.1_release_eve" rel="nofollow">GhostBSD 10.1 released </a></h3>

<ul>
<li>GhostBSD has given us a new release, this time it also includes XFCE as an alternative to the MATE desktop</li>
<li>The installer has been updated to allow using GRUB, BSD loader, or none at all</li>
<li>It also includes the new OctoPKG manager, which proves a Qt driven front-end to pkgng</li>
<li>Thanks to Shawn for submitting this
***</li>
</ul>

<h3><a href="https://www.textplain.net/blog/2015/moving-to-freebsd/" rel="nofollow">Moving to FreeBSD</a></h3>

<ul>
<li>In this blog post, Randy Westlund takes us through his journey of moving from Gentoo over to FreeBSD</li>
<li>Inspired in part due to Systemd, he first spent some time on Wikipedia reading about BSD before taking the plunge to grab FreeBSD and give it a whirl in a VM.</li>
<li>&quot;My first impression was that installation was super easy. Installing Gentoo is done manually and can be a &quot;fun&quot; weekend adventure if you&#39;re not sure what you&#39;re doing. I can spin up a new FreeBSD VM in five minutes.&quot;</li>
<li>&quot;There&#39;s a man page for everything! And they&#39;re well-written! Gentoo has the best documentation of any Linux distro I&#39;ve used, but FreeBSD is on another level. With a copy of the FreeBSD Handbook and the system man pages, I can actually get things done without tabbing over to Google every five minutes.&quot;</li>
<li>He goes on to mention everything from Init system, Jails, Security, Community and License, a well-rounded article. </li>
<li>Also gives a nice shout-out to PC-BSD as an even easier way to get started on a FreeBSD journey, thanks!</li>
<li>Shout out to Matt for tipping us to this blog post
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-cvs&m=144190275908215&w=2" rel="nofollow">OpenBSD Enables GPT by default </a></h3>

<ul>
<li>Looks like OpenBSD has taken the plunge and enabled GPT by default now</li>
<li>Ken Westerback does us the honors, by removing the kernel option for GPT</li>
<li>Users on -CURRENT should give this a whirl, and of course report issues back upstream</li>
<li>Credit to Jona for writing in about this one
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/reproducible-builds-are-a-waste-of-time" rel="nofollow">DISCUSSION: Are reproducible builds worth-while?</a></h3>

<ul>
<li>In this weeks article / rant, Ted takes on the notion of reproducible builds being the end-all be-all for security. </li>
<li>What about compiler backdoors?</li>
<li>This does not prevent shellshock, or other bugs in the code itself</li>
<li>Personally, I.m all in favor, another .Trust but verify. mechanism of the distributed binaries, plus it makes it handy to do source builds and not end up with various checksum changes where no code actually changed. 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20Q7XjxNH" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s2QtE6XzJK" rel="nofollow">Possnfiffer writes in</a></li>
<li><a href="http://slexy.org/view/s20uloOljw" rel="nofollow">Daniel writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>106: Multipath TCP</title>
  <link>https://www.bsdnow.tv/106</link>
  <guid isPermaLink="false">56f32661-ba43-4458-8d3b-9ef39c55be8c</guid>
  <pubDate>Wed, 09 Sep 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/56f32661-ba43-4458-8d3b-9ef39c55be8c.mp3" length="48462196" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week, we have Nigel Williams here to bring us all sorts of info about Multipath TCP, what it is, how it works and the ongoing effort to bring it into FreeBSD. All that and of course the latest BSD news coming your way, right now!</itunes:subtitle>
  <itunes:duration>1:07:18</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week, we have Nigel Williams here to bring us all sorts of info about Multipath TCP, what it is, how it works and the ongoing effort to bring it into FreeBSD. All that and of course the latest BSD news coming your way, right now!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Backing out changes doesn.t always pinpoint the problem  (https://blog.crashed.org/dont-backout/)
Peter Wemm brings us a fascinating look at debugging an issue which occurred on the FreeBSD build cluster recently. 
Bottom line? Backing out something isn.t necessarily the fix, rather it should be apart of the diagnostic process
In this particular case, a change to some mmap() functionality ended up exposing a bug in the kernel.s page fault handler which existed since (wait for it.) 1997!
As Peter mentions at the bottom of the Article, this bug had been showing up for years, but was sporadic and often written off as a networking hiccup. 
***
BSD Router Project benchmarks new routing changes to FreeBSD  (https://github.com/ocochard/netbenchs/blob/master/Xeon_E5-2650-8Cores-Chelsio_T540-CR/nXxq10g/results/fbsd11-melifaro.r287531/README.md)
A project branch of FreeBSD -CURRENT has been created with a number of optimizations to the routing code
Alexander V. Chernikov (melifaro@).s routing branch  (https://svnweb.freebsd.org/base/projects/routing/?view=log)
The net result is an almost doubling of peak performance in packets per second
Performance scales well with the number of NIC queues (2 queues is 88% faster than 1 queue, 3 is 270% faster). Unlike the previous code, when the number of queues hits 4, performance is down by only 10%, instead of being cut nearly in half
Other Benchmark Results, and the tools to do your own tests  (https://github.com/ocochard/netbenchs)
***
When is SSL not SSL? (http://www.tedunangst.com/flak/post/the-peculiar-libretunnel-situation)
Our buddy Ted has a good write-up on a weird situation related to licensing of stunnel and LibreSSL
The problem exists due to stunnel being released with a different license, that is technically incompatible with the GPL, as well as linking against non-OpenSSL versions. 
The author has also decided to create specific named exceptions when the *SSL lib is part of the base operating system, but does not personally consider LibreSSL as a valid linking target on its own
Ted points out that the LibreSSL team considers LibreSSL == OpenSSL, so this may be a moot concern
***
Update on systembsd  (http://darknedgy.net/files/systembsd.pdf)
We.ve mentioned the GSoC project to create a SystemD shim in OpenBSD before. Now we have the slides from Ian Sutton talking about this project. 
As a refresher, this project is to take DBUS and create daemons emulating various systemd components, such as hostnamed, localed, timedated, and friends. 
Written from scratch in C, it was mainly created in the hopes of becoming a port, allowing Gnome and related tools to function on OpenBSD. 
This is a good read, especially for current or aspiring porters who want to bring over newer versions of applications which now depend upon SystemD. 
***
Interview - Nigel Williams - njwilliams@swin.edu.au (njwilliams@swin.edu.au)
Multipath TCP
News Roundup
OpenBSD UEFI boot loader (http://marc.info/?l=openbsd-cvs&amp;amp;m=144115942223734&amp;amp;w=2)
We.ve mentioned the ongoing work to bring UEFI booting to OpenBSD and it looks like this has now landed in the tree
The .fdisk. utility has also been updated with a new -b flag, when used  with .-i. will create the special EFI system partition on amd64/i386 . (http://marc.info/?l=openbsd-cvs&amp;amp;m=144139348416071&amp;amp;w=2)
Some twitter benchmarks  (https://twitter.com/mherrb/status/641004331035193344)
***
FreeBSD Journal, July/August issue  (https://www.freebsdfoundation.org/journal/vol2_no4/)
The latest issue of the FreeBSD Journal has arrived
As always, the Journal opens with a letter from the FreeBSD Foundation 
Feature Articles:
Groupon's Deal on FreeBSD -- How to drive adoption of FreeBSD at your organization, and lessons learned in retraining Linux sysadmins
FreeBSD: The Isilon Experience -- Mistakes not to make when basing a product on FreeBSD. TL;DR: track head
Reflections on FreeBSD.org: Packages -- A status update on where we are with binary packages, what issues have been overcome, and which still remain
Inside the Foundation -- An overview of some of the things you might not be aware that the FreeBSD Foundation is doing to support the project and attract the next generation of committers
Includes a book review of .The Practise of System and Network Administration.
As usual, various other reports are included: The Ports Report, SVN Update, A conference report, a report from the Essen hackathon, and the Event Calendar
***
Building ARMv6 packages on FreeBSD, the easy way  (http://blogs.freebsdish.org/brd/2015/08/25/building-arm-packages-with-poudriere-the-simple-way/)
Previously we have discussed how to build ARMv6 packages on FreeBSD
We also interviewed Sean Bruno about his work in this area
Thankfully, over time this process has been simplified, and no longer requires a lot of manual configuration, or fussing with the .image activator.
Now, you can just build packages for your Raspberry Pi or similar device, just as simply as you would build for x86, it just takes longer to build.
***
New PC-BSD Release Schedule (http://blog.pcbsd.org/2015/09/new-release-schedule-for-pc-bsd/)
The PC-BSD Team has announce an updated release schedule for beyond 10.2
This schedule follows more closely the FreeBSD schedules, with major releases only occurring when FreeBSD does the next point update, or major version bump. 
PC-BSD.s source tree has been split into master(current) and stable as well
PRODUCTION / EDGE packages will be built from stable, with PRODUCTION updated monthly now. The -CURRENT monthly images will contain the master source builds. 
***
Feedback/Questions
Joris writes in (http://slexy.org/view/s21cguSv7E)
 Anonymous  (http://slexy.org/view/s217A5NNGg)
 Darin  (http://slexy.org/view/s20HyiqJV0)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, TCP, multipath, tutorial, howto, guide, bsd, interview, ...</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week, we have Nigel Williams here to bring us all sorts of info about Multipath TCP, what it is, how it works and the ongoing effort to bring it into FreeBSD. All that and of course the latest BSD news coming your way, right now!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.crashed.org/dont-backout/" rel="nofollow">Backing out changes doesn.t always pinpoint the problem </a></h3>

<ul>
<li>Peter Wemm brings us a fascinating look at debugging an issue which occurred on the FreeBSD build cluster recently. </li>
<li>Bottom line? Backing out something isn.t necessarily the fix, rather it should be apart of the diagnostic process</li>
<li>In this particular case, a change to some mmap() functionality ended up exposing a bug in the kernel.s page fault handler which existed since (wait for it.) 1997!</li>
<li>As Peter mentions at the bottom of the Article, this bug had been showing up for years, but was sporadic and often written off as a networking hiccup. 
***</li>
</ul>

<h3><a href="https://github.com/ocochard/netbenchs/blob/master/Xeon_E5-2650-8Cores-Chelsio_T540-CR/nXxq10g/results/fbsd11-melifaro.r287531/README.md" rel="nofollow">BSD Router Project benchmarks new routing changes to FreeBSD </a></h3>

<ul>
<li>A project branch of FreeBSD -CURRENT has been created with a number of optimizations to the routing code</li>
<li><a href="https://svnweb.freebsd.org/base/projects/routing/?view=log" rel="nofollow">Alexander V. Chernikov (melifaro@).s routing branch </a></li>
<li>The net result is an almost doubling of peak performance in packets per second</li>
<li>Performance scales well with the number of NIC queues (2 queues is 88% faster than 1 queue, 3 is 270% faster). Unlike the previous code, when the number of queues hits 4, performance is down by only 10%, instead of being cut nearly in half</li>
<li><a href="https://github.com/ocochard/netbenchs" rel="nofollow">Other Benchmark Results, and the tools to do your own tests </a>
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/the-peculiar-libretunnel-situation" rel="nofollow">When is SSL not SSL?</a></h3>

<ul>
<li>Our buddy Ted has a good write-up on a weird situation related to licensing of stunnel and LibreSSL</li>
<li>The problem exists due to stunnel being released with a different license, that is technically incompatible with the GPL, as well as linking against non-OpenSSL versions. </li>
<li>The author has also decided to create specific named exceptions when the *SSL lib is part of the base operating system, but does not personally consider LibreSSL as a valid linking target on its own</li>
<li>Ted points out that the LibreSSL team considers LibreSSL == OpenSSL, so this may be a moot concern
***</li>
</ul>

<h3><a href="http://darknedgy.net/files/systembsd.pdf" rel="nofollow">Update on systembsd </a></h3>

<ul>
<li>We.ve mentioned the GSoC project to create a SystemD shim in OpenBSD before. Now we have the slides from Ian Sutton talking about this project. </li>
<li>As a refresher, this project is to take DBUS and create daemons emulating various systemd components, such as hostnamed, localed, timedated, and friends. </li>
<li>Written from scratch in C, it was mainly created in the hopes of becoming a port, allowing Gnome and related tools to function on OpenBSD. </li>
<li>This is a good read, especially for current or aspiring porters who want to bring over newer versions of applications which now depend upon SystemD. 
***</li>
</ul>

<h2>Interview - Nigel Williams - [<a href="mailto:njwilliams@swin.edu.au" rel="nofollow">njwilliams@swin.edu.au</a>](<a href="mailto:njwilliams@swin.edu.au" rel="nofollow">njwilliams@swin.edu.au</a>)</h2>

<p>Multipath TCP</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=144115942223734&w=2" rel="nofollow">OpenBSD UEFI boot loader</a></h3>

<ul>
<li>We.ve mentioned the ongoing work to bring UEFI booting to OpenBSD and it looks like this has now landed in the tree</li>
<li>The .fdisk. utility has also been updated with a new -b flag, when used  with .-i. will create the special EFI system partition on amd64/i386 . (<a href="http://marc.info/?l=openbsd-cvs&m=144139348416071&w=2" rel="nofollow">http://marc.info/?l=openbsd-cvs&amp;m=144139348416071&amp;w=2</a>)</li>
<li><a href="https://twitter.com/mherrb/status/641004331035193344" rel="nofollow">Some twitter benchmarks </a>
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/journal/vol2_no4/" rel="nofollow">FreeBSD Journal, July/August issue </a></h3>

<ul>
<li>The latest issue of the FreeBSD Journal has arrived</li>
<li>As always, the Journal opens with a letter from the FreeBSD Foundation </li>
<li>Feature Articles:</li>
<li>Groupon&#39;s Deal on FreeBSD -- How to drive adoption of FreeBSD at your organization, and lessons learned in retraining Linux sysadmins</li>
<li>FreeBSD: The Isilon Experience -- Mistakes not to make when basing a product on FreeBSD. TL;DR: track head</li>
<li>Reflections on FreeBSD.org: Packages -- A status update on where we are with binary packages, what issues have been overcome, and which still remain</li>
<li>Inside the Foundation -- An overview of some of the things you might not be aware that the FreeBSD Foundation is doing to support the project and attract the next generation of committers</li>
<li>Includes a book review of .The Practise of System and Network Administration.</li>
<li>As usual, various other reports are included: The Ports Report, SVN Update, A conference report, a report from the Essen hackathon, and the Event Calendar
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/brd/2015/08/25/building-arm-packages-with-poudriere-the-simple-way/" rel="nofollow">Building ARMv6 packages on FreeBSD, the easy way </a></h3>

<ul>
<li>Previously we have discussed how to build ARMv6 packages on FreeBSD</li>
<li>We also interviewed Sean Bruno about his work in this area</li>
<li>Thankfully, over time this process has been simplified, and no longer requires a lot of manual configuration, or fussing with the .image activator.</li>
<li>Now, you can just build packages for your Raspberry Pi or similar device, just as simply as you would build for x86, it just takes longer to build.
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/09/new-release-schedule-for-pc-bsd/" rel="nofollow">New PC-BSD Release Schedule</a></h3>

<ul>
<li>The PC-BSD Team has announce an updated release schedule for beyond 10.2</li>
<li>This schedule follows more closely the FreeBSD schedules, with major releases only occurring when FreeBSD does the next point update, or major version bump. </li>
<li>PC-BSD.s source tree has been split into master(current) and stable as well</li>
<li>PRODUCTION / EDGE packages will be built from stable, with PRODUCTION updated monthly now. The -CURRENT monthly images will contain the master source builds. 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21cguSv7E" rel="nofollow">Joris writes in</a></li>
<li><a href="http://slexy.org/view/s217A5NNGg" rel="nofollow"> Anonymous </a></li>
<li><a href="http://slexy.org/view/s20HyiqJV0" rel="nofollow"> Darin </a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week, we have Nigel Williams here to bring us all sorts of info about Multipath TCP, what it is, how it works and the ongoing effort to bring it into FreeBSD. All that and of course the latest BSD news coming your way, right now!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.crashed.org/dont-backout/" rel="nofollow">Backing out changes doesn.t always pinpoint the problem </a></h3>

<ul>
<li>Peter Wemm brings us a fascinating look at debugging an issue which occurred on the FreeBSD build cluster recently. </li>
<li>Bottom line? Backing out something isn.t necessarily the fix, rather it should be apart of the diagnostic process</li>
<li>In this particular case, a change to some mmap() functionality ended up exposing a bug in the kernel.s page fault handler which existed since (wait for it.) 1997!</li>
<li>As Peter mentions at the bottom of the Article, this bug had been showing up for years, but was sporadic and often written off as a networking hiccup. 
***</li>
</ul>

<h3><a href="https://github.com/ocochard/netbenchs/blob/master/Xeon_E5-2650-8Cores-Chelsio_T540-CR/nXxq10g/results/fbsd11-melifaro.r287531/README.md" rel="nofollow">BSD Router Project benchmarks new routing changes to FreeBSD </a></h3>

<ul>
<li>A project branch of FreeBSD -CURRENT has been created with a number of optimizations to the routing code</li>
<li><a href="https://svnweb.freebsd.org/base/projects/routing/?view=log" rel="nofollow">Alexander V. Chernikov (melifaro@).s routing branch </a></li>
<li>The net result is an almost doubling of peak performance in packets per second</li>
<li>Performance scales well with the number of NIC queues (2 queues is 88% faster than 1 queue, 3 is 270% faster). Unlike the previous code, when the number of queues hits 4, performance is down by only 10%, instead of being cut nearly in half</li>
<li><a href="https://github.com/ocochard/netbenchs" rel="nofollow">Other Benchmark Results, and the tools to do your own tests </a>
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/the-peculiar-libretunnel-situation" rel="nofollow">When is SSL not SSL?</a></h3>

<ul>
<li>Our buddy Ted has a good write-up on a weird situation related to licensing of stunnel and LibreSSL</li>
<li>The problem exists due to stunnel being released with a different license, that is technically incompatible with the GPL, as well as linking against non-OpenSSL versions. </li>
<li>The author has also decided to create specific named exceptions when the *SSL lib is part of the base operating system, but does not personally consider LibreSSL as a valid linking target on its own</li>
<li>Ted points out that the LibreSSL team considers LibreSSL == OpenSSL, so this may be a moot concern
***</li>
</ul>

<h3><a href="http://darknedgy.net/files/systembsd.pdf" rel="nofollow">Update on systembsd </a></h3>

<ul>
<li>We.ve mentioned the GSoC project to create a SystemD shim in OpenBSD before. Now we have the slides from Ian Sutton talking about this project. </li>
<li>As a refresher, this project is to take DBUS and create daemons emulating various systemd components, such as hostnamed, localed, timedated, and friends. </li>
<li>Written from scratch in C, it was mainly created in the hopes of becoming a port, allowing Gnome and related tools to function on OpenBSD. </li>
<li>This is a good read, especially for current or aspiring porters who want to bring over newer versions of applications which now depend upon SystemD. 
***</li>
</ul>

<h2>Interview - Nigel Williams - [<a href="mailto:njwilliams@swin.edu.au" rel="nofollow">njwilliams@swin.edu.au</a>](<a href="mailto:njwilliams@swin.edu.au" rel="nofollow">njwilliams@swin.edu.au</a>)</h2>

<p>Multipath TCP</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=144115942223734&w=2" rel="nofollow">OpenBSD UEFI boot loader</a></h3>

<ul>
<li>We.ve mentioned the ongoing work to bring UEFI booting to OpenBSD and it looks like this has now landed in the tree</li>
<li>The .fdisk. utility has also been updated with a new -b flag, when used  with .-i. will create the special EFI system partition on amd64/i386 . (<a href="http://marc.info/?l=openbsd-cvs&m=144139348416071&w=2" rel="nofollow">http://marc.info/?l=openbsd-cvs&amp;m=144139348416071&amp;w=2</a>)</li>
<li><a href="https://twitter.com/mherrb/status/641004331035193344" rel="nofollow">Some twitter benchmarks </a>
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/journal/vol2_no4/" rel="nofollow">FreeBSD Journal, July/August issue </a></h3>

<ul>
<li>The latest issue of the FreeBSD Journal has arrived</li>
<li>As always, the Journal opens with a letter from the FreeBSD Foundation </li>
<li>Feature Articles:</li>
<li>Groupon&#39;s Deal on FreeBSD -- How to drive adoption of FreeBSD at your organization, and lessons learned in retraining Linux sysadmins</li>
<li>FreeBSD: The Isilon Experience -- Mistakes not to make when basing a product on FreeBSD. TL;DR: track head</li>
<li>Reflections on FreeBSD.org: Packages -- A status update on where we are with binary packages, what issues have been overcome, and which still remain</li>
<li>Inside the Foundation -- An overview of some of the things you might not be aware that the FreeBSD Foundation is doing to support the project and attract the next generation of committers</li>
<li>Includes a book review of .The Practise of System and Network Administration.</li>
<li>As usual, various other reports are included: The Ports Report, SVN Update, A conference report, a report from the Essen hackathon, and the Event Calendar
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/brd/2015/08/25/building-arm-packages-with-poudriere-the-simple-way/" rel="nofollow">Building ARMv6 packages on FreeBSD, the easy way </a></h3>

<ul>
<li>Previously we have discussed how to build ARMv6 packages on FreeBSD</li>
<li>We also interviewed Sean Bruno about his work in this area</li>
<li>Thankfully, over time this process has been simplified, and no longer requires a lot of manual configuration, or fussing with the .image activator.</li>
<li>Now, you can just build packages for your Raspberry Pi or similar device, just as simply as you would build for x86, it just takes longer to build.
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/09/new-release-schedule-for-pc-bsd/" rel="nofollow">New PC-BSD Release Schedule</a></h3>

<ul>
<li>The PC-BSD Team has announce an updated release schedule for beyond 10.2</li>
<li>This schedule follows more closely the FreeBSD schedules, with major releases only occurring when FreeBSD does the next point update, or major version bump. </li>
<li>PC-BSD.s source tree has been split into master(current) and stable as well</li>
<li>PRODUCTION / EDGE packages will be built from stable, with PRODUCTION updated monthly now. The -CURRENT monthly images will contain the master source builds. 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21cguSv7E" rel="nofollow">Joris writes in</a></li>
<li><a href="http://slexy.org/view/s217A5NNGg" rel="nofollow"> Anonymous </a></li>
<li><a href="http://slexy.org/view/s20HyiqJV0" rel="nofollow"> Darin </a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>105: Virginia BSD Assembly</title>
  <link>https://www.bsdnow.tv/105</link>
  <guid isPermaLink="false">09c955b0-1ecf-440f-9aa9-80dc2fb05a49</guid>
  <pubDate>Wed, 02 Sep 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/09c955b0-1ecf-440f-9aa9-80dc2fb05a49.mp3" length="47635924" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>It's already our two-year anniversary! This time on the show, we'll be chatting with Scott Courtney, vice president of infrastructure engineering at Verisign, about this year's vBSDCon. What's it have to offer in an already-crowded BSD conference space? We'll find out.</itunes:subtitle>
  <itunes:duration>1:06:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>It's already our two-year anniversary! This time on the show, we'll be chatting with Scott Courtney, vice president of infrastructure engineering at Verisign, about this year's vBSDCon. What's it have to offer in an already-crowded BSD conference space? We'll find out.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenBSD hypervisor coming soon (https://www.marc.info/?l=openbsd-tech&amp;amp;m=144104398132541&amp;amp;w=2)
Our buddy Mike Larkin never rests, and he posted some very tight-lipped console output (http://pastebin.com/raw.php?i=F2Qbgdde) on Twitter recently
From what little he revealed at the time (https://twitter.com/mlarkin2012/status/638265767864070144), it appeared to be a new hypervisor (https://en.wikipedia.org/wiki/Hypervisor) (that is, X86 hardware virtualization) running on OpenBSD -current, tentatively titled "vmm"
Later on, he provided a much longer explanation on the mailing list, detailing a bit about what the overall plan for the code is
Originally started around the time of the Australia hackathon, the work has since picked up more steam, and has gotten a funding boost from the OpenBSD foundation
One thing to note: this isn't just a port of something like Xen or Bhyve; it's all-new code, and Mike explains why he chose to go that route
He also answered some basic questions about the requirements, when it'll be available, what OSes it can run, what's left to do, how to get involved and so on
***
Why FreeBSD should not adopt launchd (http://blog.darknedgy.net/technology/2015/08/26/0/)
Last week (http://www.bsdnow.tv/episodes/2015_08_26-beverly_hills_25519) we mentioned a talk Jordan Hubbard gave about integrating various parts of Mac OS X into FreeBSD
One of the changes, perhaps the most controversial item on the list, was the adoption of launchd to replace the init system (replacing init systems seems to cause backlash, we've learned)
In this article, the author talks about why he thinks this is a bad idea
He doesn't oppose the integration into FreeBSD-derived projects, like FreeNAS and PC-BSD, only vanilla FreeBSD itself - this is also explained in more detail
The post includes both high-level descriptions and low-level technical details, and provides an interesting outlook on the situation and possibilities
Reddit had quite a bit (https://www.reddit.com/r/BSD/comments/3ilhpk) to say (https://www.reddit.com/r/freebsd/comments/3ilj4i) about this one, some in agreement and some not
***
DragonFly graphics improvements (http://lists.dragonflybsd.org/pipermail/commits/2015-August/458108.html)
The DragonFlyBSD guys are at it again, merging newer support and fixes into their i915 (Intel) graphics stack
This latest update brings them in sync with Linux 3.17, and includes Haswell fixes, DisplayPort fixes, improvements for Broadwell and even Cherryview GPUs
You should also see some power management improvements, longer battery life and various other bug fixes
If you're running DragonFly, especially on a laptop, you'll want to get this stuff on your machine quick - big improvements all around
***
OpenBSD tames the userland (https://www.marc.info/?l=openbsd-tech&amp;amp;m=144070638327053&amp;amp;w=2)
Last week we mentioned OpenBSD's tame framework getting support for file whitelists, and said that the userland integration was next - well, now here we are
Theo posted a mega diff of nearly 100 smaller diffs, adding tame support to many areas of the userland tools
It's still a work-in-progress version; there's still more to be added (including the file path whitelist stuff)
Some classic utilities are even being reworked to make taming them easier - the "w" command (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=144103945031253&amp;amp;w=2), for example
The diff provides some good insight on exactly how to restrict different types of utilities, as well as how easy it is to actually do so (and en masse)
More discussion can be found on HN (https://news.ycombinator.com/item?id=10135901), as one might expect
If you're a software developer, and especially if your software is in ports already, consider adding some more fine-grained tame support in your next release
***
Interview - Scott Courtney - vbsdcon@verisign.com (mailto:vbsdcon@verisign.com) / @verisign (https://twitter.com/verisign)
vBSDCon (http://vbsdcon.com/) 2015
News Roundup
OPNsense, beyond the fork (https://opnsense.org/opnsense-beyond-the-fork)
We first heard about (http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach) OPNsense back in January, and they've since released nearly 40 versions, spanning over 5,000 commits
This is their first big status update, covering some of the things that've happened since the project was born
There's been a lot of community growth and participation, mass bug fixing, new features added, experimental builds with ASLR and much more - the report touches on a little of everything
***
LibreSSL nukes SSLv3 (http://undeadly.org/cgi?action=article&amp;amp;sid=20150827112006)
With their latest release, LibreSSL began to turn off SSLv3 (http://disablessl3.com) support, starting with the "openssl" command
At the time, SSLv3 wasn't disabled entirely because of some things in the OpenBSD ports tree requiring it (apache being one odd example)
They've now flipped the switch, and the process of complete removal has started
From the Undeadly summary, "This is an important step for the security of the LibreSSL library and, by extension, the ports tree. It does, however, require lots of testing of the resulting packages, as some of the fallout may be at runtime (so not detected during the build). That is part of why this is committed at this point during the release cycle: it gives the community more time to test packages and report issues so that these can be fixed. When these fixes are then pushed upstream, the entire software ecosystem will benefit. In short: you know what to do!"
With this change and a few more to follow shortly, LibreSSL won't actually support SSL anymore - time to rename it "LibreTLS"
***
FreeBSD MPTCP updated (http://caia.swin.edu.au/urp/newtcp/mptcp/tools/v05/mptcp-readme-v0.5.txt)
For anyone unaware, Multipath TCP (https://en.wikipedia.org/wiki/Multipath_TCP) is "an ongoing effort of the Internet Engineering Task Force's (IETF) Multipath TCP working group, that aims at allowing a Transmission Control Protocol (TCP) connection to use multiple paths to maximize resource usage and increase redundancy."
There's been work out of an Australian university to add support for it to the FreeBSD kernel, and the patchset was recently updated
Including in this latest version is an overview of the protocol, how to get it compiled in, current features and limitations and some info about the routing requirements
Some big performance gains can be had with MPTCP, but only if both the client and server systems support it - getting it into the FreeBSD kernel would be a good start
***
UEFI and GPT in OpenBSD (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=144092912907778&amp;amp;w=2)
There hasn't been much fanfare about it yet, but some initial UEFI and GPT-related commits have been creeping into OpenBSD recently
Some support (https://github.com/yasuoka/openbsd-uefi) for UEFI booting has landed in the kernel, and more bits are being slowly enabled after review
This comes along with a number (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=143732984925140&amp;amp;w=2) of (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=144088136200753&amp;amp;w=2) other (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=144046793225230&amp;amp;w=2) commits (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=144045760723039&amp;amp;w=2) related to GPT, much of which is being refactored and slowly reintroduced
Currently, you have to do some disklabel wizardry to bypass the MBR limit and access more than 2TB of space on a single drive, but it should "just work" with GPT (once everything's in)
The UEFI bootloader support has been committed (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=144115942223734&amp;amp;w=2), so stay tuned for more updates (http://undeadly.org/cgi?action=article&amp;amp;sid=20150902074526&amp;amp;mode=flat) as further (https://twitter.com/kotatsu_mi/status/638909417761562624) progress (https://twitter.com/yojiro/status/638189353601097728) is made
***
Feedback/Questions
John writes in (http://slexy.org/view/s2sIWfb3Qh)
Mason writes in (http://slexy.org/view/s2Ybrx00KI)
Earl writes in (http://slexy.org/view/s20FpmR7ZW)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, verisign, vbsdcon, conference, eurobsdcon, bsdcan, meetbsd, asiabsdcon, nextbsd, launchd, darwin, tame, mach, libressl, vmm, hypervisor, bhyve, multipath, tcp</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>It&#39;s already our two-year anniversary! This time on the show, we&#39;ll be chatting with Scott Courtney, vice president of infrastructure engineering at Verisign, about this year&#39;s vBSDCon. What&#39;s it have to offer in an already-crowded BSD conference space? We&#39;ll find out.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=144104398132541&w=2" rel="nofollow">OpenBSD hypervisor coming soon</a></h3>

<ul>
<li>Our buddy Mike Larkin never rests, and he posted some very tight-lipped <a href="http://pastebin.com/raw.php?i=F2Qbgdde" rel="nofollow">console output</a> on Twitter recently</li>
<li>From what little he revealed <a href="https://twitter.com/mlarkin2012/status/638265767864070144" rel="nofollow">at the time</a>, it appeared to be a new <a href="https://en.wikipedia.org/wiki/Hypervisor" rel="nofollow">hypervisor</a> (that is, X86 hardware virtualization) running on OpenBSD -current, tentatively titled &quot;vmm&quot;</li>
<li>Later on, he provided a much longer explanation on the mailing list, detailing a bit about what the overall plan for the code is</li>
<li>Originally started around the time of the Australia hackathon, the work has since picked up more steam, and has gotten a funding boost from the OpenBSD foundation</li>
<li>One thing to note: this <strong>isn&#39;t</strong> just a port of something like Xen or Bhyve; it&#39;s all-new code, and Mike explains why he chose to go that route</li>
<li>He also answered some basic questions about the requirements, when it&#39;ll be available, what OSes it can run, what&#39;s left to do, how to get involved and so on
***</li>
</ul>

<h3><a href="http://blog.darknedgy.net/technology/2015/08/26/0/" rel="nofollow">Why FreeBSD should not adopt launchd</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2015_08_26-beverly_hills_25519" rel="nofollow">Last week</a> we mentioned a talk Jordan Hubbard gave about integrating various parts of Mac OS X into FreeBSD</li>
<li>One of the changes, perhaps the most controversial item on the list, was the adoption of launchd to replace the init system (replacing init systems seems to cause backlash, we&#39;ve learned)</li>
<li>In this article, the author talks about why he thinks this is a bad idea</li>
<li>He doesn&#39;t oppose the integration into FreeBSD-<em>derived</em> projects, like FreeNAS and PC-BSD, only vanilla FreeBSD itself - this is also explained in more detail</li>
<li>The post includes both high-level descriptions and low-level technical details, and provides an interesting outlook on the situation and possibilities</li>
<li>Reddit had <a href="https://www.reddit.com/r/BSD/comments/3ilhpk" rel="nofollow">quite a bit</a> <a href="https://www.reddit.com/r/freebsd/comments/3ilj4i" rel="nofollow">to say</a> about this one, some in agreement and some not
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-August/458108.html" rel="nofollow">DragonFly graphics improvements</a></h3>

<ul>
<li>The DragonFlyBSD guys are at it again, merging newer support and fixes into their i915 (Intel) graphics stack</li>
<li>This latest update brings them in sync with Linux 3.17, and includes Haswell fixes, DisplayPort fixes, improvements for Broadwell and even Cherryview GPUs</li>
<li>You should also see some power management improvements, longer battery life and various other bug fixes</li>
<li>If you&#39;re running DragonFly, especially on a laptop, you&#39;ll want to get this stuff on your machine quick - big improvements all around
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=144070638327053&w=2" rel="nofollow">OpenBSD tames the userland</a></h3>

<ul>
<li>Last week we mentioned OpenBSD&#39;s tame framework getting support for file whitelists, and said that the userland integration was next - well, now here we are</li>
<li>Theo posted a <em>mega diff</em> of nearly 100 smaller diffs, adding tame support to many areas of the userland tools</li>
<li>It&#39;s still a work-in-progress version; there&#39;s still more to be added (including the file path whitelist stuff)</li>
<li>Some classic utilities are even being reworked to make taming them easier - <a href="https://www.marc.info/?l=openbsd-cvs&m=144103945031253&w=2" rel="nofollow">the &quot;w&quot; command</a>, for example</li>
<li>The diff provides some good insight on exactly how to restrict different types of utilities, as well as how easy it is to actually do so (and en masse)</li>
<li>More discussion can be found <a href="https://news.ycombinator.com/item?id=10135901" rel="nofollow">on HN</a>, as one might expect</li>
<li>If you&#39;re a software developer, and especially if your software is in ports already, consider adding some more fine-grained tame support in your next release
***</li>
</ul>

<h2>Interview - Scott Courtney - <a href="mailto:vbsdcon@verisign.com" rel="nofollow">vbsdcon@verisign.com</a> / <a href="https://twitter.com/verisign" rel="nofollow">@verisign</a></h2>

<p><a href="http://vbsdcon.com/" rel="nofollow">vBSDCon</a> 2015</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://opnsense.org/opnsense-beyond-the-fork" rel="nofollow">OPNsense, beyond the fork</a></h3>

<ul>
<li>We first <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">heard about</a> OPNsense back in January, and they&#39;ve since released nearly <strong>40</strong> versions, spanning over <strong>5,000</strong> commits</li>
<li>This is their first big status update, covering some of the things that&#39;ve happened since the project was born</li>
<li>There&#39;s been a lot of community growth and participation, mass bug fixing, new features added, experimental builds with ASLR and much more - the report touches on a little of everything
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150827112006" rel="nofollow">LibreSSL nukes SSLv3</a></h3>

<ul>
<li>With their latest release, LibreSSL began to turn off <a href="http://disablessl3.com" rel="nofollow">SSLv3</a> support, starting with the &quot;openssl&quot; command</li>
<li>At the time, SSLv3 wasn&#39;t disabled entirely because of some things in the OpenBSD ports tree requiring it (apache being one odd example)</li>
<li>They&#39;ve now flipped the switch, and the process of complete removal has started</li>
<li>From the Undeadly summary, &quot;This is an important step for the security of the LibreSSL library and, by extension, the ports tree. It does, however, require lots of testing of the resulting packages, as some of the fallout may be at runtime (so not detected during the build). That is part of why this is committed at this point during the release cycle: it gives the community more time to test packages and report issues so that these can be fixed. When these fixes are then pushed upstream, the entire software ecosystem will benefit. In short: you know what to do!&quot;</li>
<li>With this change and a few more to follow shortly, Libre*SSL* won&#39;t actually <em>support SSL</em> anymore - time to rename it &quot;LibreTLS&quot;
***</li>
</ul>

<h3><a href="http://caia.swin.edu.au/urp/newtcp/mptcp/tools/v05/mptcp-readme-v0.5.txt" rel="nofollow">FreeBSD MPTCP updated</a></h3>

<ul>
<li>For anyone unaware, <a href="https://en.wikipedia.org/wiki/Multipath_TCP" rel="nofollow">Multipath TCP</a> is &quot;an ongoing effort of the Internet Engineering Task Force&#39;s (IETF) Multipath TCP working group, that aims at allowing a Transmission Control Protocol (TCP) connection to use multiple paths to maximize resource usage and increase redundancy.&quot;</li>
<li>There&#39;s been work out of an Australian university to add support for it to the FreeBSD kernel, and the patchset was recently updated</li>
<li>Including in this latest version is an overview of the protocol, how to get it compiled in, current features and limitations and some info about the routing requirements</li>
<li>Some big performance gains can be had with MPTCP, but only if both the client and server systems support it - getting it into the FreeBSD kernel would be a good start
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=144092912907778&w=2" rel="nofollow">UEFI and GPT in OpenBSD</a></h3>

<ul>
<li>There hasn&#39;t been much fanfare about it yet, but some initial UEFI and GPT-related commits have been creeping into OpenBSD recently</li>
<li>Some <a href="https://github.com/yasuoka/openbsd-uefi" rel="nofollow">support</a> for UEFI booting has landed in the kernel, and more bits are being slowly enabled after review</li>
<li>This comes along with a <a href="https://www.marc.info/?l=openbsd-cvs&m=143732984925140&w=2" rel="nofollow">number</a> <a href="https://www.marc.info/?l=openbsd-cvs&m=144088136200753&w=2" rel="nofollow">of</a> <a href="https://www.marc.info/?l=openbsd-cvs&m=144046793225230&w=2" rel="nofollow">other</a> <a href="https://www.marc.info/?l=openbsd-cvs&m=144045760723039&w=2" rel="nofollow">commits</a> related to GPT, much of which is being refactored and slowly reintroduced</li>
<li>Currently, you have to do some disklabel wizardry to bypass the MBR limit and access more than 2TB of space on a single drive, but it should &quot;just work&quot; with GPT (once everything&#39;s in)</li>
<li>The UEFI bootloader support <a href="https://www.marc.info/?l=openbsd-cvs&m=144115942223734&w=2" rel="nofollow">has been committed</a>, so stay tuned for <a href="http://undeadly.org/cgi?action=article&sid=20150902074526&mode=flat" rel="nofollow">more updates</a> as <a href="https://twitter.com/kotatsu_mi/status/638909417761562624" rel="nofollow">further</a> <a href="https://twitter.com/yojiro/status/638189353601097728" rel="nofollow">progress</a> is made
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2sIWfb3Qh" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s2Ybrx00KI" rel="nofollow">Mason writes in</a></li>
<li><a href="http://slexy.org/view/s20FpmR7ZW" rel="nofollow">Earl writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>It&#39;s already our two-year anniversary! This time on the show, we&#39;ll be chatting with Scott Courtney, vice president of infrastructure engineering at Verisign, about this year&#39;s vBSDCon. What&#39;s it have to offer in an already-crowded BSD conference space? We&#39;ll find out.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=144104398132541&w=2" rel="nofollow">OpenBSD hypervisor coming soon</a></h3>

<ul>
<li>Our buddy Mike Larkin never rests, and he posted some very tight-lipped <a href="http://pastebin.com/raw.php?i=F2Qbgdde" rel="nofollow">console output</a> on Twitter recently</li>
<li>From what little he revealed <a href="https://twitter.com/mlarkin2012/status/638265767864070144" rel="nofollow">at the time</a>, it appeared to be a new <a href="https://en.wikipedia.org/wiki/Hypervisor" rel="nofollow">hypervisor</a> (that is, X86 hardware virtualization) running on OpenBSD -current, tentatively titled &quot;vmm&quot;</li>
<li>Later on, he provided a much longer explanation on the mailing list, detailing a bit about what the overall plan for the code is</li>
<li>Originally started around the time of the Australia hackathon, the work has since picked up more steam, and has gotten a funding boost from the OpenBSD foundation</li>
<li>One thing to note: this <strong>isn&#39;t</strong> just a port of something like Xen or Bhyve; it&#39;s all-new code, and Mike explains why he chose to go that route</li>
<li>He also answered some basic questions about the requirements, when it&#39;ll be available, what OSes it can run, what&#39;s left to do, how to get involved and so on
***</li>
</ul>

<h3><a href="http://blog.darknedgy.net/technology/2015/08/26/0/" rel="nofollow">Why FreeBSD should not adopt launchd</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2015_08_26-beverly_hills_25519" rel="nofollow">Last week</a> we mentioned a talk Jordan Hubbard gave about integrating various parts of Mac OS X into FreeBSD</li>
<li>One of the changes, perhaps the most controversial item on the list, was the adoption of launchd to replace the init system (replacing init systems seems to cause backlash, we&#39;ve learned)</li>
<li>In this article, the author talks about why he thinks this is a bad idea</li>
<li>He doesn&#39;t oppose the integration into FreeBSD-<em>derived</em> projects, like FreeNAS and PC-BSD, only vanilla FreeBSD itself - this is also explained in more detail</li>
<li>The post includes both high-level descriptions and low-level technical details, and provides an interesting outlook on the situation and possibilities</li>
<li>Reddit had <a href="https://www.reddit.com/r/BSD/comments/3ilhpk" rel="nofollow">quite a bit</a> <a href="https://www.reddit.com/r/freebsd/comments/3ilj4i" rel="nofollow">to say</a> about this one, some in agreement and some not
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-August/458108.html" rel="nofollow">DragonFly graphics improvements</a></h3>

<ul>
<li>The DragonFlyBSD guys are at it again, merging newer support and fixes into their i915 (Intel) graphics stack</li>
<li>This latest update brings them in sync with Linux 3.17, and includes Haswell fixes, DisplayPort fixes, improvements for Broadwell and even Cherryview GPUs</li>
<li>You should also see some power management improvements, longer battery life and various other bug fixes</li>
<li>If you&#39;re running DragonFly, especially on a laptop, you&#39;ll want to get this stuff on your machine quick - big improvements all around
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=144070638327053&w=2" rel="nofollow">OpenBSD tames the userland</a></h3>

<ul>
<li>Last week we mentioned OpenBSD&#39;s tame framework getting support for file whitelists, and said that the userland integration was next - well, now here we are</li>
<li>Theo posted a <em>mega diff</em> of nearly 100 smaller diffs, adding tame support to many areas of the userland tools</li>
<li>It&#39;s still a work-in-progress version; there&#39;s still more to be added (including the file path whitelist stuff)</li>
<li>Some classic utilities are even being reworked to make taming them easier - <a href="https://www.marc.info/?l=openbsd-cvs&m=144103945031253&w=2" rel="nofollow">the &quot;w&quot; command</a>, for example</li>
<li>The diff provides some good insight on exactly how to restrict different types of utilities, as well as how easy it is to actually do so (and en masse)</li>
<li>More discussion can be found <a href="https://news.ycombinator.com/item?id=10135901" rel="nofollow">on HN</a>, as one might expect</li>
<li>If you&#39;re a software developer, and especially if your software is in ports already, consider adding some more fine-grained tame support in your next release
***</li>
</ul>

<h2>Interview - Scott Courtney - <a href="mailto:vbsdcon@verisign.com" rel="nofollow">vbsdcon@verisign.com</a> / <a href="https://twitter.com/verisign" rel="nofollow">@verisign</a></h2>

<p><a href="http://vbsdcon.com/" rel="nofollow">vBSDCon</a> 2015</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://opnsense.org/opnsense-beyond-the-fork" rel="nofollow">OPNsense, beyond the fork</a></h3>

<ul>
<li>We first <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">heard about</a> OPNsense back in January, and they&#39;ve since released nearly <strong>40</strong> versions, spanning over <strong>5,000</strong> commits</li>
<li>This is their first big status update, covering some of the things that&#39;ve happened since the project was born</li>
<li>There&#39;s been a lot of community growth and participation, mass bug fixing, new features added, experimental builds with ASLR and much more - the report touches on a little of everything
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150827112006" rel="nofollow">LibreSSL nukes SSLv3</a></h3>

<ul>
<li>With their latest release, LibreSSL began to turn off <a href="http://disablessl3.com" rel="nofollow">SSLv3</a> support, starting with the &quot;openssl&quot; command</li>
<li>At the time, SSLv3 wasn&#39;t disabled entirely because of some things in the OpenBSD ports tree requiring it (apache being one odd example)</li>
<li>They&#39;ve now flipped the switch, and the process of complete removal has started</li>
<li>From the Undeadly summary, &quot;This is an important step for the security of the LibreSSL library and, by extension, the ports tree. It does, however, require lots of testing of the resulting packages, as some of the fallout may be at runtime (so not detected during the build). That is part of why this is committed at this point during the release cycle: it gives the community more time to test packages and report issues so that these can be fixed. When these fixes are then pushed upstream, the entire software ecosystem will benefit. In short: you know what to do!&quot;</li>
<li>With this change and a few more to follow shortly, Libre*SSL* won&#39;t actually <em>support SSL</em> anymore - time to rename it &quot;LibreTLS&quot;
***</li>
</ul>

<h3><a href="http://caia.swin.edu.au/urp/newtcp/mptcp/tools/v05/mptcp-readme-v0.5.txt" rel="nofollow">FreeBSD MPTCP updated</a></h3>

<ul>
<li>For anyone unaware, <a href="https://en.wikipedia.org/wiki/Multipath_TCP" rel="nofollow">Multipath TCP</a> is &quot;an ongoing effort of the Internet Engineering Task Force&#39;s (IETF) Multipath TCP working group, that aims at allowing a Transmission Control Protocol (TCP) connection to use multiple paths to maximize resource usage and increase redundancy.&quot;</li>
<li>There&#39;s been work out of an Australian university to add support for it to the FreeBSD kernel, and the patchset was recently updated</li>
<li>Including in this latest version is an overview of the protocol, how to get it compiled in, current features and limitations and some info about the routing requirements</li>
<li>Some big performance gains can be had with MPTCP, but only if both the client and server systems support it - getting it into the FreeBSD kernel would be a good start
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=144092912907778&w=2" rel="nofollow">UEFI and GPT in OpenBSD</a></h3>

<ul>
<li>There hasn&#39;t been much fanfare about it yet, but some initial UEFI and GPT-related commits have been creeping into OpenBSD recently</li>
<li>Some <a href="https://github.com/yasuoka/openbsd-uefi" rel="nofollow">support</a> for UEFI booting has landed in the kernel, and more bits are being slowly enabled after review</li>
<li>This comes along with a <a href="https://www.marc.info/?l=openbsd-cvs&m=143732984925140&w=2" rel="nofollow">number</a> <a href="https://www.marc.info/?l=openbsd-cvs&m=144088136200753&w=2" rel="nofollow">of</a> <a href="https://www.marc.info/?l=openbsd-cvs&m=144046793225230&w=2" rel="nofollow">other</a> <a href="https://www.marc.info/?l=openbsd-cvs&m=144045760723039&w=2" rel="nofollow">commits</a> related to GPT, much of which is being refactored and slowly reintroduced</li>
<li>Currently, you have to do some disklabel wizardry to bypass the MBR limit and access more than 2TB of space on a single drive, but it should &quot;just work&quot; with GPT (once everything&#39;s in)</li>
<li>The UEFI bootloader support <a href="https://www.marc.info/?l=openbsd-cvs&m=144115942223734&w=2" rel="nofollow">has been committed</a>, so stay tuned for <a href="http://undeadly.org/cgi?action=article&sid=20150902074526&mode=flat" rel="nofollow">more updates</a> as <a href="https://twitter.com/kotatsu_mi/status/638909417761562624" rel="nofollow">further</a> <a href="https://twitter.com/yojiro/status/638189353601097728" rel="nofollow">progress</a> is made
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2sIWfb3Qh" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s2Ybrx00KI" rel="nofollow">Mason writes in</a></li>
<li><a href="http://slexy.org/view/s20FpmR7ZW" rel="nofollow">Earl writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>104: Beverly Hills 25519</title>
  <link>https://www.bsdnow.tv/104</link>
  <guid isPermaLink="false">0bc0c068-36fe-429f-b7f4-38ac01fb7f19</guid>
  <pubDate>Wed, 26 Aug 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0bc0c068-36fe-429f-b7f4-38ac01fb7f19.mp3" length="58136116" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week on the show, we'll be talking with Damien Miller of the OpenSSH team. Their 7.0 release has some major changes, including phasing out older crypto and changing one of the defaults that might surprise you.</itunes:subtitle>
  <itunes:duration>1:20:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week on the show, we'll be talking with Damien Miller of the OpenSSH team. Their 7.0 release has some major changes, including phasing out older crypto and changing one of the defaults that might surprise you.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
EdgeRouter Lite, meet OpenBSD (http://www.tedunangst.com/flak/post/OpenBSD-on-ERL)
The ERL, much like the Raspberry Pi and a bunch of other cheap boards, is getting more and more popular as more things get ported to run on it 
We've covered installing NetBSD and FreeBSD on them before, but OpenBSD has gotten a lot better support for them as well now (including the onboard storage in 5.8)
Ted Unangst got a hold of one recently and kindly wrote up some notes about installing and using OpenBSD on it
He covers doing a network install, getting the (slightly strange) bootloader working with u-boot and some final notes about the hardware
More discussion can be found on Hacker News (https://news.ycombinator.com/item?id=10079210) and various (https://www.reddit.com/r/openbsd/comments/3hgf2c) other (https://www.marc.info/?t=143974140500001&amp;amp;r=1&amp;amp;w=2) places (https://lobste.rs/s/acz9bu/openbsd_on_edgerouter_lite)
One thing to note (https://www.marc.info/?l=openbsd-misc&amp;amp;m=143991822827285&amp;amp;w=2) about these devices: because of their MIPS64 processor, they'll have weaker ASLR than X86 CPUs (and no W^X at all)
***
Design and Implementation of the FreeBSD Operating System interview (http://www.infoq.com/articles/freebsd-design-implementation-review)
For those who don't know, the "Design and Implementation of the FreeBSD Operating System" is a semi-recently-revived technical reference book for FreeBSD development
InfoQ has a review of the book up for anyone who might be interested, but they also have an interview the authors
"The book takes an approach to FreeBSD from inside out, starting with kernel services, then moving to process and memory management, I/O and devices, filesystems, IPC and network protocols, and finally system startup and shutdown. The book provides dense, technical information in a clear way, with lots of pseudo-code, diagrams, and tables to illustrate the main points."
Aside from detailing a few of the chapters, the interview covers who the book's target audience is, some history of the project, long-term support, some of the newer features and some general OS development topics
***
Path list parameter in OpenBSD tame (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=144027474117290&amp;amp;w=2)
We've mentioned OpenBSD's relatively new "tame (https://marc.info/?l=openbsd-tech&amp;amp;m=143725996614627&amp;amp;w=2)" subsystem a couple times before: it's an easy-to-implement "self-containment" framework, allowing programs to have a reduced feature set mode with even less privileges
One of the early concerns from users of other process containment tools was that tame was too broad in the way it separated disk access - you could either read/write files or not, nothing in between
Now there's the option to create a whitelist of specific files and directories that your binary is allowed to access, giving a much finer-grained set of controls to developers
The next step is to add tame restraints to the OpenBSD userland utilities, which should probably be done by 5.9
More discussion can be found on Reddit (https://www.reddit.com/r/openbsd/comments/3i2lk7) and Hacker News (https://news.ycombinator.com/item?id=10104886)
***
FreeBSD &amp;amp; PC-BSD 10.2-RELEASE (https://www.freebsd.org/releases/10.2R/announce.html)
The FreeBSD team has released the second minor version bump to the 10.x branch, including all the fixes from 10-STABLE since 10.1 came out
The Linux compatibility layer has been updated to support CentOS 6, rather than the much older Fedora Core base used previously, and the DRM graphics code has been updated to match Linux 3.8.13
New installations (and newly-upgraded systems) will use the quarterly binary package set, rather than the rolling release model that most people are used to
A VXLAN driver was added, allowing you to create virtual LANs by encapsulating the ethernet frame in a UDP packet
The bhyve codebase is much newer, enabling support for AMD CPUs with SVM and AMD-V extensions
ARM and ARM64 code saw some fixes and improvements, including SMP support on a few specific boards and support for a few new boards
The bootloader now supports entering your GELI passphrase before loading the kernel in full disk encryption setups
In addition to assorted userland fixes and driver improvements, various third party tools in the base system were updated: resolvconf, ISC NTPd, netcat, file, unbound, OpenSSL, sendmail
Check the full release notes (https://www.freebsd.org/releases/10.2R/relnotes.html) for the rest of the details and changes
PC-BSD also followed with their 10.2-RELEASE (http://blog.pcbsd.org/2015/08/pc-bsd-10-2-release-now-available), sporting a few more additional features
***
Interview - Damien Miller - djm@openbsd.org (mailto:djm@openbsd.org) / @damienmiller (https://twitter.com/damienmiller)
OpenSSH: phasing out broken crypto, default cipher changes
News Roundup
NetBSD at Open Source Conference Shimane (https://mail-index.netbsd.org/netbsd-advocacy/2015/08/22/msg000692.html)
We weren't the only ones away at conferences last week - the Japanese NetBSD guys are always raiding one event or another
This time they had NetBSD running on some Sony NWS devices (MIPS-based)
JavaStations (https://en.wikipedia.org/wiki/JavaStation) were also on display - something we haven't ever seen before (made between 1996-2000)
***
BAFUG videos (https://www.youtube.com/watch?v=-XF20nitI90)
The Bay Area FreeBSD users group has been uploading some videos of their recent meetings
Devin Teske hosts the first one, discussing adding GELI support to the bootloader, including some video demonstrations of how it works
Shortly after beginning, Adrian Chadd takes over the conversation and they discuss various problems (and solutions) related to the bootloader - for example, how can we type encryption passwords with non-US keyboard layouts
In a second video (https://www.youtube.com/watch?v=49sPYHh473U), Jordan Hubbard and Kip Macy introduce "NeXTBSD aka FreeBSD X"
In it, they discuss their ideas of merging more Mac OS X features into FreeBSD (launchd to replace the init system, some APIs, etc)
People should record presentations at their BSD users groups and send them to us
***
L2TP over IPSEC on OpenBSD (http://frankgroeneveld.nl/2015/08/16/configuring-l2tp-over-ipsec-on-openbsd-for-mac-os-x-clients)
If you've got an OpenBSD box and some Mac OS X clients that need secure communications, surprise: they can work together pretty well
Using only the base tools in both operating systems, you can build a nice IPSEC setup for tunneling all your traffic
This guide specifically covers L2TP, using npppd and pre-shared keys
Server setup, client setup, firewall configuration and routing-related settings are all covered in detail
***
Reliable bare metal with TrueOS (http://www.tubsta.com/2015/08/reliable-bare-metal-server-using-trueosfreebsd)
Imagine a server version of PC-BSD with some useful utilities preinstalled - that's basically TrueOS
This article walks you through setting up a FreeBSD -CURRENT server (using TrueOS) to create a pretty solid backup solution
Most importantly, he also covers how to keep everything redundant and deal with hard drives failing
The author chose to go with the -CURRENT branch because of the delay between regular releases, and newer features not making their way to users as fast as he'd like
Another factor is that there are no binary snapshots of FreeBSD -CURRENT that can be easily used for in-place upgrades, but with TrueOS (and some other BSDs) there are
***
Kernel W^X on i386 (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=144047868127049&amp;amp;w=2)
We mentioned some big W^X kernel changes in OpenBSD a while back (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142120787308107&amp;amp;w=2), but the work was mainly for x86_64 CPU architecture (which makes sense; that's what most people run now)
Mike Larkin is back again, and isn't leaving the people with older hardware out, committing similar kernel work into the i386 platform now as well
Check out our interview with Mike (http://www.bsdnow.tv/episodes/2015_05_13-exclusive_disjunction) for some more background info on memory protections like W^X
***
Feedback/Questions
Markus writes in (http://slexy.org/view/s2iGoeYMyb)
Sean writes in (http://slexy.org/view/s21bIFfmUS)
Theo writes in (http://slexy.org/view/s21Hjm8Tsa)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, openssh, openssl, chacha20, chacha20-poly1305, aes, md5, hmac, cbc, gcm, cryptography, ed25519, curve25519, erl, edgerouter lite, tame, bafug</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week on the show, we&#39;ll be talking with Damien Miller of the OpenSSH team. Their 7.0 release has some major changes, including phasing out older crypto and changing one of the defaults that might surprise you.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/OpenBSD-on-ERL" rel="nofollow">EdgeRouter Lite, meet OpenBSD</a></h3>

<ul>
<li>The ERL, much like the Raspberry Pi and a bunch of other cheap boards, is getting more and more popular as more things get ported to run on it </li>
<li>We&#39;ve covered installing NetBSD and FreeBSD on them before, but OpenBSD has gotten a lot better support for them as well now (including the onboard storage in 5.8)</li>
<li>Ted Unangst got a hold of one recently and kindly wrote up some notes about installing and using OpenBSD on it</li>
<li>He covers doing a network install, getting the (slightly strange) bootloader working with u-boot and some final notes about the hardware</li>
<li>More discussion can be found <a href="https://news.ycombinator.com/item?id=10079210" rel="nofollow">on Hacker News</a> and <a href="https://www.reddit.com/r/openbsd/comments/3hgf2c" rel="nofollow">various</a> <a href="https://www.marc.info/?t=143974140500001&r=1&w=2" rel="nofollow">other</a> <a href="https://lobste.rs/s/acz9bu/openbsd_on_edgerouter_lite" rel="nofollow">places</a></li>
<li>One thing to <a href="https://www.marc.info/?l=openbsd-misc&m=143991822827285&w=2" rel="nofollow">note</a> about these devices: because of their MIPS64 processor, they&#39;ll have weaker ASLR than X86 CPUs (and no W<sup>X</sup> at all)
***</li>
</ul>

<h3><a href="http://www.infoq.com/articles/freebsd-design-implementation-review" rel="nofollow">Design and Implementation of the FreeBSD Operating System interview</a></h3>

<ul>
<li>For those who don&#39;t know, the &quot;Design and Implementation of the FreeBSD Operating System&quot; is a semi-recently-revived technical reference book for FreeBSD development</li>
<li>InfoQ has a review of the book up for anyone who might be interested, but they also have an interview the authors</li>
<li>&quot;The book takes an approach to FreeBSD from inside out, starting with kernel services, then moving to process and memory management, I/O and devices, filesystems, IPC and network protocols, and finally system startup and shutdown. The book provides dense, technical information in a clear way, with lots of pseudo-code, diagrams, and tables to illustrate the main points.&quot;</li>
<li>Aside from detailing a few of the chapters, the interview covers who the book&#39;s target audience is, some history of the project, long-term support, some of the newer features and some general OS development topics
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=144027474117290&w=2" rel="nofollow">Path list parameter in OpenBSD tame</a></h3>

<ul>
<li>We&#39;ve mentioned OpenBSD&#39;s relatively new &quot;<a href="https://marc.info/?l=openbsd-tech&m=143725996614627&w=2" rel="nofollow">tame</a>&quot; subsystem a couple times before: it&#39;s an easy-to-implement &quot;self-containment&quot; framework, allowing programs to have a reduced feature set mode with even less privileges</li>
<li>One of the early concerns from users of other process containment tools was that tame was too broad in the way it separated disk access - you could either read/write files or not, nothing in between</li>
<li>Now there&#39;s the option to create a whitelist of specific files and directories that your binary is allowed to access, giving a much finer-grained set of controls to developers</li>
<li>The next step is to add tame restraints to the OpenBSD userland utilities, which should probably be done by 5.9</li>
<li>More discussion can be found <a href="https://www.reddit.com/r/openbsd/comments/3i2lk7" rel="nofollow">on Reddit</a> <a href="https://news.ycombinator.com/item?id=10104886" rel="nofollow">and Hacker News</a>
***</li>
</ul>

<h3><a href="https://www.freebsd.org/releases/10.2R/announce.html" rel="nofollow">FreeBSD &amp; PC-BSD 10.2-RELEASE</a></h3>

<ul>
<li>The FreeBSD team has released the second minor version bump to the 10.x branch, including all the fixes from 10-STABLE since 10.1 came out</li>
<li>The Linux compatibility layer has been updated to support CentOS 6, rather than the much older Fedora Core base used previously, and the DRM graphics code has been updated to match Linux 3.8.13</li>
<li>New installations (and newly-upgraded systems) will use the quarterly binary package set, rather than the rolling release model that most people are used to</li>
<li>A VXLAN driver was added, allowing you to create virtual LANs by encapsulating the ethernet frame in a UDP packet</li>
<li>The bhyve codebase is much newer, enabling support for AMD CPUs with SVM and AMD-V extensions</li>
<li>ARM and ARM64 code saw some fixes and improvements, including SMP support on a few specific boards and support for a few new boards</li>
<li>The bootloader now supports entering your GELI passphrase before loading the kernel in full disk encryption setups</li>
<li>In addition to assorted userland fixes and driver improvements, various third party tools in the base system were updated: resolvconf, ISC NTPd, netcat, file, unbound, OpenSSL, sendmail</li>
<li>Check the <a href="https://www.freebsd.org/releases/10.2R/relnotes.html" rel="nofollow">full release notes</a> for the rest of the details and changes</li>
<li>PC-BSD also followed with <a href="http://blog.pcbsd.org/2015/08/pc-bsd-10-2-release-now-available" rel="nofollow">their 10.2-RELEASE</a>, sporting a few more additional features
***</li>
</ul>

<h2>Interview - Damien Miller - <a href="mailto:djm@openbsd.org" rel="nofollow">djm@openbsd.org</a> / <a href="https://twitter.com/damienmiller" rel="nofollow">@damienmiller</a></h2>

<p>OpenSSH: phasing out broken crypto, default cipher changes</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/08/22/msg000692.html" rel="nofollow">NetBSD at Open Source Conference Shimane</a></h3>

<ul>
<li>We weren&#39;t the only ones away at conferences last week - the Japanese NetBSD guys are always raiding one event or another</li>
<li>This time they had NetBSD running on some Sony NWS devices (MIPS-based)</li>
<li><a href="https://en.wikipedia.org/wiki/JavaStation" rel="nofollow">JavaStations</a> were also on display - something we haven&#39;t ever seen before (made between 1996-2000)
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=-XF20nitI90" rel="nofollow">BAFUG videos</a></h3>

<ul>
<li>The Bay Area FreeBSD users group has been uploading some videos of their recent meetings</li>
<li>Devin Teske hosts the first one, discussing adding GELI support to the bootloader, including some video demonstrations of how it works</li>
<li>Shortly after beginning, Adrian Chadd takes over the conversation and they discuss various problems (and solutions) related to the bootloader - for example, how can we type encryption passwords with non-US keyboard layouts</li>
<li>In <a href="https://www.youtube.com/watch?v=49sPYHh473U" rel="nofollow">a second video</a>, Jordan Hubbard and Kip Macy introduce &quot;NeXTBSD aka FreeBSD X&quot;</li>
<li>In it, they discuss their ideas of merging more Mac OS X features into FreeBSD (launchd to replace the init system, some APIs, etc)</li>
<li>People should record presentations at their BSD users groups and send them to us
***</li>
</ul>

<h3><a href="http://frankgroeneveld.nl/2015/08/16/configuring-l2tp-over-ipsec-on-openbsd-for-mac-os-x-clients" rel="nofollow">L2TP over IPSEC on OpenBSD</a></h3>

<ul>
<li>If you&#39;ve got an OpenBSD box and some Mac OS X clients that need secure communications, surprise: they can work together pretty well</li>
<li>Using only the base tools in both operating systems, you can build a nice IPSEC setup for tunneling all your traffic</li>
<li>This guide specifically covers L2TP, using npppd and pre-shared keys</li>
<li>Server setup, client setup, firewall configuration and routing-related settings are all covered in detail
***</li>
</ul>

<h3><a href="http://www.tubsta.com/2015/08/reliable-bare-metal-server-using-trueosfreebsd" rel="nofollow">Reliable bare metal with TrueOS</a></h3>

<ul>
<li>Imagine a server version of PC-BSD with some useful utilities preinstalled - that&#39;s basically TrueOS</li>
<li>This article walks you through setting up a FreeBSD -CURRENT server (using TrueOS) to create a pretty solid backup solution</li>
<li>Most importantly, he also covers how to keep everything redundant and deal with hard drives failing</li>
<li>The author chose to go with the -CURRENT branch because of the delay between regular releases, and newer features not making their way to users as fast as he&#39;d like</li>
<li>Another factor is that there are no binary snapshots of FreeBSD -CURRENT that can be easily used for in-place upgrades, but with TrueOS (and some other BSDs) there are
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=144047868127049&w=2" rel="nofollow">Kernel W<sup>X</sup> on i386</a></h3>

<ul>
<li>We mentioned some big W<sup>X</sup> kernel changes in OpenBSD <a href="https://www.marc.info/?l=openbsd-tech&m=142120787308107&w=2" rel="nofollow">a while back</a>, but the work was mainly for x86_64 CPU architecture (which makes sense; that&#39;s what most people run now)</li>
<li>Mike Larkin is back again, and isn&#39;t leaving the people with older hardware out, committing similar kernel work into the i386 platform now as well</li>
<li>Check out <a href="http://www.bsdnow.tv/episodes/2015_05_13-exclusive_disjunction" rel="nofollow">our interview with Mike</a> for some more background info on memory protections like W<sup>X</sup>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2iGoeYMyb" rel="nofollow">Markus writes in</a></li>
<li><a href="http://slexy.org/view/s21bIFfmUS" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s21Hjm8Tsa" rel="nofollow">Theo writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week on the show, we&#39;ll be talking with Damien Miller of the OpenSSH team. Their 7.0 release has some major changes, including phasing out older crypto and changing one of the defaults that might surprise you.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/OpenBSD-on-ERL" rel="nofollow">EdgeRouter Lite, meet OpenBSD</a></h3>

<ul>
<li>The ERL, much like the Raspberry Pi and a bunch of other cheap boards, is getting more and more popular as more things get ported to run on it </li>
<li>We&#39;ve covered installing NetBSD and FreeBSD on them before, but OpenBSD has gotten a lot better support for them as well now (including the onboard storage in 5.8)</li>
<li>Ted Unangst got a hold of one recently and kindly wrote up some notes about installing and using OpenBSD on it</li>
<li>He covers doing a network install, getting the (slightly strange) bootloader working with u-boot and some final notes about the hardware</li>
<li>More discussion can be found <a href="https://news.ycombinator.com/item?id=10079210" rel="nofollow">on Hacker News</a> and <a href="https://www.reddit.com/r/openbsd/comments/3hgf2c" rel="nofollow">various</a> <a href="https://www.marc.info/?t=143974140500001&r=1&w=2" rel="nofollow">other</a> <a href="https://lobste.rs/s/acz9bu/openbsd_on_edgerouter_lite" rel="nofollow">places</a></li>
<li>One thing to <a href="https://www.marc.info/?l=openbsd-misc&m=143991822827285&w=2" rel="nofollow">note</a> about these devices: because of their MIPS64 processor, they&#39;ll have weaker ASLR than X86 CPUs (and no W<sup>X</sup> at all)
***</li>
</ul>

<h3><a href="http://www.infoq.com/articles/freebsd-design-implementation-review" rel="nofollow">Design and Implementation of the FreeBSD Operating System interview</a></h3>

<ul>
<li>For those who don&#39;t know, the &quot;Design and Implementation of the FreeBSD Operating System&quot; is a semi-recently-revived technical reference book for FreeBSD development</li>
<li>InfoQ has a review of the book up for anyone who might be interested, but they also have an interview the authors</li>
<li>&quot;The book takes an approach to FreeBSD from inside out, starting with kernel services, then moving to process and memory management, I/O and devices, filesystems, IPC and network protocols, and finally system startup and shutdown. The book provides dense, technical information in a clear way, with lots of pseudo-code, diagrams, and tables to illustrate the main points.&quot;</li>
<li>Aside from detailing a few of the chapters, the interview covers who the book&#39;s target audience is, some history of the project, long-term support, some of the newer features and some general OS development topics
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=144027474117290&w=2" rel="nofollow">Path list parameter in OpenBSD tame</a></h3>

<ul>
<li>We&#39;ve mentioned OpenBSD&#39;s relatively new &quot;<a href="https://marc.info/?l=openbsd-tech&m=143725996614627&w=2" rel="nofollow">tame</a>&quot; subsystem a couple times before: it&#39;s an easy-to-implement &quot;self-containment&quot; framework, allowing programs to have a reduced feature set mode with even less privileges</li>
<li>One of the early concerns from users of other process containment tools was that tame was too broad in the way it separated disk access - you could either read/write files or not, nothing in between</li>
<li>Now there&#39;s the option to create a whitelist of specific files and directories that your binary is allowed to access, giving a much finer-grained set of controls to developers</li>
<li>The next step is to add tame restraints to the OpenBSD userland utilities, which should probably be done by 5.9</li>
<li>More discussion can be found <a href="https://www.reddit.com/r/openbsd/comments/3i2lk7" rel="nofollow">on Reddit</a> <a href="https://news.ycombinator.com/item?id=10104886" rel="nofollow">and Hacker News</a>
***</li>
</ul>

<h3><a href="https://www.freebsd.org/releases/10.2R/announce.html" rel="nofollow">FreeBSD &amp; PC-BSD 10.2-RELEASE</a></h3>

<ul>
<li>The FreeBSD team has released the second minor version bump to the 10.x branch, including all the fixes from 10-STABLE since 10.1 came out</li>
<li>The Linux compatibility layer has been updated to support CentOS 6, rather than the much older Fedora Core base used previously, and the DRM graphics code has been updated to match Linux 3.8.13</li>
<li>New installations (and newly-upgraded systems) will use the quarterly binary package set, rather than the rolling release model that most people are used to</li>
<li>A VXLAN driver was added, allowing you to create virtual LANs by encapsulating the ethernet frame in a UDP packet</li>
<li>The bhyve codebase is much newer, enabling support for AMD CPUs with SVM and AMD-V extensions</li>
<li>ARM and ARM64 code saw some fixes and improvements, including SMP support on a few specific boards and support for a few new boards</li>
<li>The bootloader now supports entering your GELI passphrase before loading the kernel in full disk encryption setups</li>
<li>In addition to assorted userland fixes and driver improvements, various third party tools in the base system were updated: resolvconf, ISC NTPd, netcat, file, unbound, OpenSSL, sendmail</li>
<li>Check the <a href="https://www.freebsd.org/releases/10.2R/relnotes.html" rel="nofollow">full release notes</a> for the rest of the details and changes</li>
<li>PC-BSD also followed with <a href="http://blog.pcbsd.org/2015/08/pc-bsd-10-2-release-now-available" rel="nofollow">their 10.2-RELEASE</a>, sporting a few more additional features
***</li>
</ul>

<h2>Interview - Damien Miller - <a href="mailto:djm@openbsd.org" rel="nofollow">djm@openbsd.org</a> / <a href="https://twitter.com/damienmiller" rel="nofollow">@damienmiller</a></h2>

<p>OpenSSH: phasing out broken crypto, default cipher changes</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/08/22/msg000692.html" rel="nofollow">NetBSD at Open Source Conference Shimane</a></h3>

<ul>
<li>We weren&#39;t the only ones away at conferences last week - the Japanese NetBSD guys are always raiding one event or another</li>
<li>This time they had NetBSD running on some Sony NWS devices (MIPS-based)</li>
<li><a href="https://en.wikipedia.org/wiki/JavaStation" rel="nofollow">JavaStations</a> were also on display - something we haven&#39;t ever seen before (made between 1996-2000)
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=-XF20nitI90" rel="nofollow">BAFUG videos</a></h3>

<ul>
<li>The Bay Area FreeBSD users group has been uploading some videos of their recent meetings</li>
<li>Devin Teske hosts the first one, discussing adding GELI support to the bootloader, including some video demonstrations of how it works</li>
<li>Shortly after beginning, Adrian Chadd takes over the conversation and they discuss various problems (and solutions) related to the bootloader - for example, how can we type encryption passwords with non-US keyboard layouts</li>
<li>In <a href="https://www.youtube.com/watch?v=49sPYHh473U" rel="nofollow">a second video</a>, Jordan Hubbard and Kip Macy introduce &quot;NeXTBSD aka FreeBSD X&quot;</li>
<li>In it, they discuss their ideas of merging more Mac OS X features into FreeBSD (launchd to replace the init system, some APIs, etc)</li>
<li>People should record presentations at their BSD users groups and send them to us
***</li>
</ul>

<h3><a href="http://frankgroeneveld.nl/2015/08/16/configuring-l2tp-over-ipsec-on-openbsd-for-mac-os-x-clients" rel="nofollow">L2TP over IPSEC on OpenBSD</a></h3>

<ul>
<li>If you&#39;ve got an OpenBSD box and some Mac OS X clients that need secure communications, surprise: they can work together pretty well</li>
<li>Using only the base tools in both operating systems, you can build a nice IPSEC setup for tunneling all your traffic</li>
<li>This guide specifically covers L2TP, using npppd and pre-shared keys</li>
<li>Server setup, client setup, firewall configuration and routing-related settings are all covered in detail
***</li>
</ul>

<h3><a href="http://www.tubsta.com/2015/08/reliable-bare-metal-server-using-trueosfreebsd" rel="nofollow">Reliable bare metal with TrueOS</a></h3>

<ul>
<li>Imagine a server version of PC-BSD with some useful utilities preinstalled - that&#39;s basically TrueOS</li>
<li>This article walks you through setting up a FreeBSD -CURRENT server (using TrueOS) to create a pretty solid backup solution</li>
<li>Most importantly, he also covers how to keep everything redundant and deal with hard drives failing</li>
<li>The author chose to go with the -CURRENT branch because of the delay between regular releases, and newer features not making their way to users as fast as he&#39;d like</li>
<li>Another factor is that there are no binary snapshots of FreeBSD -CURRENT that can be easily used for in-place upgrades, but with TrueOS (and some other BSDs) there are
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=144047868127049&w=2" rel="nofollow">Kernel W<sup>X</sup> on i386</a></h3>

<ul>
<li>We mentioned some big W<sup>X</sup> kernel changes in OpenBSD <a href="https://www.marc.info/?l=openbsd-tech&m=142120787308107&w=2" rel="nofollow">a while back</a>, but the work was mainly for x86_64 CPU architecture (which makes sense; that&#39;s what most people run now)</li>
<li>Mike Larkin is back again, and isn&#39;t leaving the people with older hardware out, committing similar kernel work into the i386 platform now as well</li>
<li>Check out <a href="http://www.bsdnow.tv/episodes/2015_05_13-exclusive_disjunction" rel="nofollow">our interview with Mike</a> for some more background info on memory protections like W<sup>X</sup>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2iGoeYMyb" rel="nofollow">Markus writes in</a></li>
<li><a href="http://slexy.org/view/s21bIFfmUS" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s21Hjm8Tsa" rel="nofollow">Theo writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>103: Ubuntu Slaughters Kittens</title>
  <link>https://www.bsdnow.tv/103</link>
  <guid isPermaLink="false">227b2929-398f-4d82-b29d-80981ddcc4d7</guid>
  <pubDate>Wed, 19 Aug 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/227b2929-398f-4d82-b29d-80981ddcc4d7.mp3" length="86734228" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Allan's away at BSDCam this week, but we've still got an exciting episode for you. We sat down with Bryan Cantrill, CTO of Joyent, to talk about a wide variety of topics: dtrace, ZFS, pkgsrc, containers and much more. This is easily our longest interview to date!</itunes:subtitle>
  <itunes:duration>2:00:27</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Allan's away at BSDCam this week, but we've still got an exciting episode for you. We sat down with Bryan Cantrill, CTO of Joyent, to talk about a wide variety of topics: dtrace, ZFS, pkgsrc, containers and much more. This is easily our longest interview to date!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Interview - Bryan Cantrill - bryan@joyent.com (mailto:bryan@joyent.com) / @bcantrill (https://twitter.com/bcantrill)
BSD and Solaris history, illumos, dtrace, Joyent, pkgsrc, various topics (and rants)
Feedback/Questions
Randy writes in (http://slexy.org/view/s2b6dA7fAr)
Jared writes in (http://slexy.org/view/s2vABMHiok)
Steve writes in (http://slexy.org/view/s2194ADVUL)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, multipath, tcp, performance, dtrace, zfs, illumos, opensolaris, solaris, joyent, pkgsrc, omnios</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Allan&#39;s away at BSDCam this week, but we&#39;ve still got an exciting episode for you. We sat down with Bryan Cantrill, CTO of Joyent, to talk about a wide variety of topics: dtrace, ZFS, pkgsrc, containers and much more. This is easily our longest interview to date!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Bryan Cantrill - <a href="mailto:bryan@joyent.com" rel="nofollow">bryan@joyent.com</a> / <a href="https://twitter.com/bcantrill" rel="nofollow">@bcantrill</a></h2>

<p>BSD and Solaris history, illumos, dtrace, Joyent, pkgsrc, various topics (and rants)</p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2b6dA7fAr" rel="nofollow">Randy writes in</a></li>
<li><a href="http://slexy.org/view/s2vABMHiok" rel="nofollow">Jared writes in</a></li>
<li><a href="http://slexy.org/view/s2194ADVUL" rel="nofollow">Steve writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Allan&#39;s away at BSDCam this week, but we&#39;ve still got an exciting episode for you. We sat down with Bryan Cantrill, CTO of Joyent, to talk about a wide variety of topics: dtrace, ZFS, pkgsrc, containers and much more. This is easily our longest interview to date!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Bryan Cantrill - <a href="mailto:bryan@joyent.com" rel="nofollow">bryan@joyent.com</a> / <a href="https://twitter.com/bcantrill" rel="nofollow">@bcantrill</a></h2>

<p>BSD and Solaris history, illumos, dtrace, Joyent, pkgsrc, various topics (and rants)</p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2b6dA7fAr" rel="nofollow">Randy writes in</a></li>
<li><a href="http://slexy.org/view/s2vABMHiok" rel="nofollow">Jared writes in</a></li>
<li><a href="http://slexy.org/view/s2194ADVUL" rel="nofollow">Steve writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>102: May Contain ZFS</title>
  <link>https://www.bsdnow.tv/102</link>
  <guid isPermaLink="false">e0de53ca-3dcf-4df7-a556-faa52c7788a7</guid>
  <pubDate>Wed, 12 Aug 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e0de53ca-3dcf-4df7-a556-faa52c7788a7.mp3" length="48985492" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we'll be talking with Peter Toth. He's got a jail management system called "iocage" that's been getting pretty popular recently. Have we finally found a replacement for ezjail? We'll see how it stacks up.</itunes:subtitle>
  <itunes:duration>1:08:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we'll be talking with Peter Toth. He's got a jail management system called "iocage" that's been getting pretty popular recently. Have we finally found a replacement for ezjail? We'll see how it stacks up.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD on Olimex RT5350F-OLinuXino (https://www.bidouilliste.com/blog/2015/07/22/FreeBSD-on-Olimex-RT5350F-OLinuXino)
If you haven't heard of the RT5350F-OLinuXino-EVB, you're not alone (actually, we probably couldn't even remember the name if we did know about it)
It's a small board with a MIPS CPU, two ethernet ports, wireless support and... 32MB of RAM
This blog series documents installing FreeBSD on the device, but it is quite a DIY setup at the moment
In part two of the series (https://www.bidouilliste.com/blog/2015/07/24/FreeBSD-on-Olimex-RT5350F-OLinuXino-Part-2), he talks about the GPIO and how you can configure it
Part three is still in the works, so check the site later on for further progress and info
***
The modern OpenBSD home router (https://www.azabani.com/2015/08/06/modern-openbsd-home-router.html)
In a new series of blog posts, one guy takes you through the process of building an OpenBSD-based gateway (http://www.bsdnow.tv/tutorials/openbsd-router) for his home network
"It’s no secret that most consumer routers ship with software that’s flaky at best, and prohibitively insecure at worst"
Armed with a 600MHz Pentium III CPU, he shows the process of setting up basic NAT, firewalling and even getting hostap mode working for wireless
This guide also covers PPP and IPv6, in case you have those requirements
In a similar but unrelated series (http://jaytongarnett.blogspot.com/2015/07/openbsd-router-bt-home-hub-5-replacement.html), another user does a similar thing - his post also includes details on reusing your consumer router as a wireless bridge
He also has a separate post (http://jaytongarnett.blogspot.com/2015/08/openbsd-l2tpipsec-vpn-works-with.html) for setting up an IPSEC VPN on the router
***
NetBSD at Open Source Conference 2015 Kansai (https://mail-index.netbsd.org/netbsd-advocacy/2015/08/10/msg000691.html)
The Japanese NetBSD users group has teamed up with the Kansai BSD users group and Nagoya BSD users group to invade another conference
They had NetBSD running on all the usual (unusual?) devices, but some of the other BSDs also got a chance to shine at the event
Last time they mostly had ARM devices, but this time the centerpiece was an OMRON LUNA88k
They had at least one FreeBSD and OpenBSD device, and at least one NetBSD device even had Adobe Flash running on it
And what conference would be complete without an LED-powered towel
***
OpenSSH 7.0 released (https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-August/034289.html)
The OpenSSH team has just finished up the 7.0 release, and the focus this time is deprecating legacy code
SSHv1 support is disabled, 1024 bit diffie-hellman-group1-sha1 KEX is disabled and the v00 cert format authentication is disabled
The syntax for permitting root logins has been changed, and is now called "prohibit-password" instead of "without-password" (this makes it so root can login, but only with keys) - all interactive authentication methods for root are also disabled by default now
If you're using an older configuration file, the "without-password" option still works, so no change is required
You can now control which public key types are available for authentication, as well as control which public key types are offered for host authentications
Various bug fixes and documentation improvements are also included
Aside from the keyboard-interactive and PAM-related bugs, this release includes one minor security fix: TTY permissions were too open, so users could write messages to other logged in users
In the next release, even more deprecation is planned: RSA keys will be refused if they're under 1024 bits, CBC-based ciphers will be disabled and the MD5 HMAC will also be disabled
***
Interview - Peter Toth - peter.toth198@gmail.com (mailto:peter.toth198@gmail.com) / @pannonp (https://twitter.com/pannonp)
Containment with iocage (https://github.com/iocage/iocage)
News Roundup
More c2k15 reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20150809105132)
A few more hackathon reports from c2k15 in Calgary are still slowly trickling in
Alexander Bluhm's up first, and he continued improving OpenBSD's regression test suite (this ensures that no changes accidentally break existing things)
He also worked on syslogd, completing the TCP input code - the syslogd in 5.8 will have TLS support for secure remote logging
Renato Westphal sent in a report (http://undeadly.org/cgi?action=article&amp;amp;sid=20150811171006) of his very first hackathon
He finished up the VPLS implementation and worked on EIGRP (which is explained in the report) - the end result is that OpenBSD will be more easily deployable in a Cisco-heavy network
Philip Guenther also wrote in (http://undeadly.org/cgi?action=article&amp;amp;sid=20150809165912), getting some very technical and low-level stuff done at the hackathon
His report opens with "First came a diff to move the grabbing of the kernel lock for soft-interrupts from the ASM stubs to the C routine so that mere mortals can actually push it around further to reduce locking." - not exactly beginner stuff
There were also some C-state, suspend/resume and general ACPI improvements committed, and he gives a long list of random other bits he worked on as well
***
FreeBSD jails, the hard way (https://clinta.github.io/freebsd-jails-the-hard-way)
As you learned from our interview this week, there's quite a selection of tools available to manage your jails
This article takes the opposite approach, using only the tools in the base system: ZFS, nullfs and jail.conf
Unlike with iocage, ZFS isn't actually a requirement for this method
If you are using it, though, you can make use of snapshots for making template jails
***
OpenSSH hardware tokens (http://www.tancsa.com/mdtblog/?p=73)
We've talked about a number of ways to do two-factor authentication with SSH, but what if you want it on both the client and server?
This blog post will show you how to use a hardware token as a second authentication factor, for the "something you know, something you have" security model
It takes you through from start to finish: formatting the token, generating keys, getting it integrated with sshd
Most of this will apply to any OS that can run ssh, and the token used in the example can be found online for pretty cheap too
***
LibreSSL 2.2.2 released (http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.2-relnotes.txt)
The LibreSSL team has released version 2.2.2, which signals the end of the 5.8 development cycle and includes many fixes
At the c2k15 hackathon, developers uncovered dozens of problems in the OpenSSL codebase with the Coverity code scanner, and this release incorporates all those: dead code, memory leaks, logic errors (which, by the way, you really don't want in a crypto tool...) and much more
SSLv3 support was removed from the "openssl" command, and only a few other SSLv3 bits remain - once workarounds are found for ports that specifically depend on it, it'll be removed completely
Various other small improvements were made: DH params are now 2048 bits by default, more old workarounds removed, cmake support added, etc
It'll be in 5.8 (due out earlier than usual) and it's in the FreeBSD ports tree as well
***
Feedback/Questions
James writes in (http://slexy.org/view/s216lrsVVd)
Stuart writes in (http://slexy.org/view/s20uGUHWLr)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, jails, iocage, bhyve, containers, lxc, docker, ezjail, router, gateway, ipsec, vpn, libressl, authentication, uefi, jails</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we&#39;ll be talking with Peter Toth. He&#39;s got a jail management system called &quot;iocage&quot; that&#39;s been getting pretty popular recently. Have we finally found a replacement for ezjail? We&#39;ll see how it stacks up.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bidouilliste.com/blog/2015/07/22/FreeBSD-on-Olimex-RT5350F-OLinuXino" rel="nofollow">FreeBSD on Olimex RT5350F-OLinuXino</a></h3>

<ul>
<li>If you haven&#39;t heard of the RT5350F-OLinuXino-EVB, you&#39;re not alone (actually, we probably couldn&#39;t even remember the name if we did know about it)</li>
<li>It&#39;s a small board with a MIPS CPU, two ethernet ports, wireless support and... 32MB of RAM</li>
<li>This blog series documents installing FreeBSD on the device, but it is quite a DIY setup at the moment</li>
<li>In <a href="https://www.bidouilliste.com/blog/2015/07/24/FreeBSD-on-Olimex-RT5350F-OLinuXino-Part-2" rel="nofollow">part two of the series</a>, he talks about the GPIO and how you can configure it</li>
<li>Part three is still in the works, so check the site later on for further progress and info
***</li>
</ul>

<h3><a href="https://www.azabani.com/2015/08/06/modern-openbsd-home-router.html" rel="nofollow">The modern OpenBSD home router</a></h3>

<ul>
<li>In a new series of blog posts, one guy takes you through the process of building an <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">OpenBSD-based gateway</a> for his home network</li>
<li>&quot;It’s no secret that most consumer routers ship with software that’s flaky at best, and prohibitively insecure at worst&quot;</li>
<li>Armed with a 600MHz Pentium III CPU, he shows the process of setting up basic NAT, firewalling and even getting hostap mode working for wireless</li>
<li>This guide also covers PPP and IPv6, in case you have those requirements</li>
<li>In a <a href="http://jaytongarnett.blogspot.com/2015/07/openbsd-router-bt-home-hub-5-replacement.html" rel="nofollow">similar but unrelated series</a>, another user does a similar thing - his post also includes details on reusing your consumer router as a wireless bridge</li>
<li>He also has <a href="http://jaytongarnett.blogspot.com/2015/08/openbsd-l2tpipsec-vpn-works-with.html" rel="nofollow">a separate post</a> for setting up an IPSEC VPN on the router
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/08/10/msg000691.html" rel="nofollow">NetBSD at Open Source Conference 2015 Kansai</a></h3>

<ul>
<li>The Japanese NetBSD users group has teamed up with the Kansai BSD users group and Nagoya BSD users group to invade another conference</li>
<li>They had NetBSD running on all the usual (unusual?) devices, but some of the other BSDs also got a chance to shine at the event</li>
<li>Last time they mostly had ARM devices, but this time the centerpiece was an OMRON LUNA88k</li>
<li>They had at least one FreeBSD and OpenBSD device, and at least one NetBSD device even had Adobe Flash running on it</li>
<li>And what conference would be complete without an LED-powered towel
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-August/034289.html" rel="nofollow">OpenSSH 7.0 released</a></h3>

<ul>
<li>The OpenSSH team has just finished up the 7.0 release, and the focus this time is deprecating legacy code</li>
<li>SSHv1 support is disabled, 1024 bit diffie-hellman-group1-sha1 KEX is disabled and the v00 cert format authentication is disabled</li>
<li>The syntax for permitting root logins has been changed, and is now called &quot;prohibit-password&quot; instead of &quot;without-password&quot; (this makes it so root can login, but only with keys) - all interactive authentication methods for root are also disabled by default now</li>
<li>If you&#39;re using an older configuration file, the &quot;without-password&quot; option still works, so no change is required</li>
<li>You can now control which public key types are available for authentication, as well as control which public key types are offered for host authentications</li>
<li>Various bug fixes and documentation improvements are also included</li>
<li>Aside from the keyboard-interactive and PAM-related bugs, this release includes one minor security fix: TTY permissions were too open, so users could write messages to other logged in users</li>
<li>In the <em>next release</em>, even more deprecation is planned: RSA keys will be refused if they&#39;re under 1024 bits, CBC-based ciphers will be disabled and the MD5 HMAC will also be disabled
***</li>
</ul>

<h2>Interview - Peter Toth - <a href="mailto:peter.toth198@gmail.com" rel="nofollow">peter.toth198@gmail.com</a> / <a href="https://twitter.com/pannonp" rel="nofollow">@pannonp</a></h2>

<p>Containment with <a href="https://github.com/iocage/iocage" rel="nofollow">iocage</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150809105132" rel="nofollow">More c2k15 reports</a></h3>

<ul>
<li>A few more hackathon reports from c2k15 in Calgary are still slowly trickling in</li>
<li>Alexander Bluhm&#39;s up first, and he continued improving OpenBSD&#39;s regression test suite (this ensures that no changes accidentally break existing things)</li>
<li>He also worked on syslogd, completing the TCP input code - the syslogd in 5.8 will have TLS support for secure remote logging</li>
<li>Renato Westphal <a href="http://undeadly.org/cgi?action=article&sid=20150811171006" rel="nofollow">sent in a report</a> of his very first hackathon</li>
<li>He finished up the VPLS implementation and worked on EIGRP (which is explained in the report) - the end result is that OpenBSD will be more easily deployable in a Cisco-heavy network</li>
<li>Philip Guenther <a href="http://undeadly.org/cgi?action=article&sid=20150809165912" rel="nofollow">also wrote in</a>, getting some very technical and low-level stuff done at the hackathon</li>
<li>His report opens with &quot;First came a diff to move the grabbing of the kernel lock for soft-interrupts from the ASM stubs to the C routine so that mere mortals can actually push it around further to reduce locking.&quot; - not exactly beginner stuff</li>
<li>There were also some C-state, suspend/resume and general ACPI improvements committed, and he gives a long list of random other bits he worked on as well
***</li>
</ul>

<h3><a href="https://clinta.github.io/freebsd-jails-the-hard-way" rel="nofollow">FreeBSD jails, the hard way</a></h3>

<ul>
<li>As you learned from our interview this week, there&#39;s quite a selection of tools available to manage your jails</li>
<li>This article takes the opposite approach, using only the tools in the base system: ZFS, nullfs and jail.conf</li>
<li>Unlike with iocage, ZFS isn&#39;t actually a requirement for this method</li>
<li>If you are using it, though, you can make use of snapshots for making template jails
***</li>
</ul>

<h3><a href="http://www.tancsa.com/mdtblog/?p=73" rel="nofollow">OpenSSH hardware tokens</a></h3>

<ul>
<li>We&#39;ve talked about a number of ways to do two-factor authentication with SSH, but what if you want it on both the client <em>and</em> server?</li>
<li>This blog post will show you how to use a hardware token as a second authentication factor, for the &quot;something you know, something you have&quot; security model</li>
<li>It takes you through from start to finish: formatting the token, generating keys, getting it integrated with sshd</li>
<li>Most of this will apply to any OS that can run ssh, and the token used in the example can be found online for pretty cheap too
***</li>
</ul>

<h3><a href="http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.2-relnotes.txt" rel="nofollow">LibreSSL 2.2.2 released</a></h3>

<ul>
<li>The LibreSSL team has released version 2.2.2, which signals the end of the 5.8 development cycle and includes many fixes</li>
<li>At the c2k15 hackathon, developers uncovered dozens of problems in the OpenSSL codebase with the Coverity code scanner, and this release incorporates all those: dead code, memory leaks, logic errors (which, by the way, you really don&#39;t want in a crypto tool...) and much more</li>
<li>SSLv3 support was removed from the &quot;openssl&quot; command, and only a few other SSLv3 bits remain - once workarounds are found for ports that specifically depend on it, it&#39;ll be removed completely</li>
<li>Various other small improvements were made: DH params are now 2048 bits by default, more old workarounds removed, cmake support added, etc</li>
<li>It&#39;ll be in 5.8 (due out earlier than usual) and it&#39;s in the FreeBSD ports tree as well
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s216lrsVVd" rel="nofollow">James writes in</a></li>
<li><a href="http://slexy.org/view/s20uGUHWLr" rel="nofollow">Stuart writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we&#39;ll be talking with Peter Toth. He&#39;s got a jail management system called &quot;iocage&quot; that&#39;s been getting pretty popular recently. Have we finally found a replacement for ezjail? We&#39;ll see how it stacks up.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bidouilliste.com/blog/2015/07/22/FreeBSD-on-Olimex-RT5350F-OLinuXino" rel="nofollow">FreeBSD on Olimex RT5350F-OLinuXino</a></h3>

<ul>
<li>If you haven&#39;t heard of the RT5350F-OLinuXino-EVB, you&#39;re not alone (actually, we probably couldn&#39;t even remember the name if we did know about it)</li>
<li>It&#39;s a small board with a MIPS CPU, two ethernet ports, wireless support and... 32MB of RAM</li>
<li>This blog series documents installing FreeBSD on the device, but it is quite a DIY setup at the moment</li>
<li>In <a href="https://www.bidouilliste.com/blog/2015/07/24/FreeBSD-on-Olimex-RT5350F-OLinuXino-Part-2" rel="nofollow">part two of the series</a>, he talks about the GPIO and how you can configure it</li>
<li>Part three is still in the works, so check the site later on for further progress and info
***</li>
</ul>

<h3><a href="https://www.azabani.com/2015/08/06/modern-openbsd-home-router.html" rel="nofollow">The modern OpenBSD home router</a></h3>

<ul>
<li>In a new series of blog posts, one guy takes you through the process of building an <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">OpenBSD-based gateway</a> for his home network</li>
<li>&quot;It’s no secret that most consumer routers ship with software that’s flaky at best, and prohibitively insecure at worst&quot;</li>
<li>Armed with a 600MHz Pentium III CPU, he shows the process of setting up basic NAT, firewalling and even getting hostap mode working for wireless</li>
<li>This guide also covers PPP and IPv6, in case you have those requirements</li>
<li>In a <a href="http://jaytongarnett.blogspot.com/2015/07/openbsd-router-bt-home-hub-5-replacement.html" rel="nofollow">similar but unrelated series</a>, another user does a similar thing - his post also includes details on reusing your consumer router as a wireless bridge</li>
<li>He also has <a href="http://jaytongarnett.blogspot.com/2015/08/openbsd-l2tpipsec-vpn-works-with.html" rel="nofollow">a separate post</a> for setting up an IPSEC VPN on the router
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/08/10/msg000691.html" rel="nofollow">NetBSD at Open Source Conference 2015 Kansai</a></h3>

<ul>
<li>The Japanese NetBSD users group has teamed up with the Kansai BSD users group and Nagoya BSD users group to invade another conference</li>
<li>They had NetBSD running on all the usual (unusual?) devices, but some of the other BSDs also got a chance to shine at the event</li>
<li>Last time they mostly had ARM devices, but this time the centerpiece was an OMRON LUNA88k</li>
<li>They had at least one FreeBSD and OpenBSD device, and at least one NetBSD device even had Adobe Flash running on it</li>
<li>And what conference would be complete without an LED-powered towel
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-August/034289.html" rel="nofollow">OpenSSH 7.0 released</a></h3>

<ul>
<li>The OpenSSH team has just finished up the 7.0 release, and the focus this time is deprecating legacy code</li>
<li>SSHv1 support is disabled, 1024 bit diffie-hellman-group1-sha1 KEX is disabled and the v00 cert format authentication is disabled</li>
<li>The syntax for permitting root logins has been changed, and is now called &quot;prohibit-password&quot; instead of &quot;without-password&quot; (this makes it so root can login, but only with keys) - all interactive authentication methods for root are also disabled by default now</li>
<li>If you&#39;re using an older configuration file, the &quot;without-password&quot; option still works, so no change is required</li>
<li>You can now control which public key types are available for authentication, as well as control which public key types are offered for host authentications</li>
<li>Various bug fixes and documentation improvements are also included</li>
<li>Aside from the keyboard-interactive and PAM-related bugs, this release includes one minor security fix: TTY permissions were too open, so users could write messages to other logged in users</li>
<li>In the <em>next release</em>, even more deprecation is planned: RSA keys will be refused if they&#39;re under 1024 bits, CBC-based ciphers will be disabled and the MD5 HMAC will also be disabled
***</li>
</ul>

<h2>Interview - Peter Toth - <a href="mailto:peter.toth198@gmail.com" rel="nofollow">peter.toth198@gmail.com</a> / <a href="https://twitter.com/pannonp" rel="nofollow">@pannonp</a></h2>

<p>Containment with <a href="https://github.com/iocage/iocage" rel="nofollow">iocage</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150809105132" rel="nofollow">More c2k15 reports</a></h3>

<ul>
<li>A few more hackathon reports from c2k15 in Calgary are still slowly trickling in</li>
<li>Alexander Bluhm&#39;s up first, and he continued improving OpenBSD&#39;s regression test suite (this ensures that no changes accidentally break existing things)</li>
<li>He also worked on syslogd, completing the TCP input code - the syslogd in 5.8 will have TLS support for secure remote logging</li>
<li>Renato Westphal <a href="http://undeadly.org/cgi?action=article&sid=20150811171006" rel="nofollow">sent in a report</a> of his very first hackathon</li>
<li>He finished up the VPLS implementation and worked on EIGRP (which is explained in the report) - the end result is that OpenBSD will be more easily deployable in a Cisco-heavy network</li>
<li>Philip Guenther <a href="http://undeadly.org/cgi?action=article&sid=20150809165912" rel="nofollow">also wrote in</a>, getting some very technical and low-level stuff done at the hackathon</li>
<li>His report opens with &quot;First came a diff to move the grabbing of the kernel lock for soft-interrupts from the ASM stubs to the C routine so that mere mortals can actually push it around further to reduce locking.&quot; - not exactly beginner stuff</li>
<li>There were also some C-state, suspend/resume and general ACPI improvements committed, and he gives a long list of random other bits he worked on as well
***</li>
</ul>

<h3><a href="https://clinta.github.io/freebsd-jails-the-hard-way" rel="nofollow">FreeBSD jails, the hard way</a></h3>

<ul>
<li>As you learned from our interview this week, there&#39;s quite a selection of tools available to manage your jails</li>
<li>This article takes the opposite approach, using only the tools in the base system: ZFS, nullfs and jail.conf</li>
<li>Unlike with iocage, ZFS isn&#39;t actually a requirement for this method</li>
<li>If you are using it, though, you can make use of snapshots for making template jails
***</li>
</ul>

<h3><a href="http://www.tancsa.com/mdtblog/?p=73" rel="nofollow">OpenSSH hardware tokens</a></h3>

<ul>
<li>We&#39;ve talked about a number of ways to do two-factor authentication with SSH, but what if you want it on both the client <em>and</em> server?</li>
<li>This blog post will show you how to use a hardware token as a second authentication factor, for the &quot;something you know, something you have&quot; security model</li>
<li>It takes you through from start to finish: formatting the token, generating keys, getting it integrated with sshd</li>
<li>Most of this will apply to any OS that can run ssh, and the token used in the example can be found online for pretty cheap too
***</li>
</ul>

<h3><a href="http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.2-relnotes.txt" rel="nofollow">LibreSSL 2.2.2 released</a></h3>

<ul>
<li>The LibreSSL team has released version 2.2.2, which signals the end of the 5.8 development cycle and includes many fixes</li>
<li>At the c2k15 hackathon, developers uncovered dozens of problems in the OpenSSL codebase with the Coverity code scanner, and this release incorporates all those: dead code, memory leaks, logic errors (which, by the way, you really don&#39;t want in a crypto tool...) and much more</li>
<li>SSLv3 support was removed from the &quot;openssl&quot; command, and only a few other SSLv3 bits remain - once workarounds are found for ports that specifically depend on it, it&#39;ll be removed completely</li>
<li>Various other small improvements were made: DH params are now 2048 bits by default, more old workarounds removed, cmake support added, etc</li>
<li>It&#39;ll be in 5.8 (due out earlier than usual) and it&#39;s in the FreeBSD ports tree as well
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s216lrsVVd" rel="nofollow">James writes in</a></li>
<li><a href="http://slexy.org/view/s20uGUHWLr" rel="nofollow">Stuart writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>101: I'll Fix Everything</title>
  <link>https://www.bsdnow.tv/101</link>
  <guid isPermaLink="false">b0fef23d-9748-4e29-9419-eb23bd948f84</guid>
  <pubDate>Wed, 05 Aug 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b0fef23d-9748-4e29-9419-eb23bd948f84.mp3" length="67071892" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week, we'll be talking with Adrian Chadd about an infamous reddit thread he made. With a title like "what would you like to see in FreeBSD?" and hundreds of responses, well, we've got a lot to cover...</itunes:subtitle>
  <itunes:duration>1:33:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week, we'll be talking with Adrian Chadd about an infamous reddit thread he made. With a title like "what would you like to see in FreeBSD?" and hundreds of responses, well, we've got a lot to cover...
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenBSD, from distribution to project (http://www.tedunangst.com/flak/post/from-distribution-to-project)
Ted Unangst has yet another interesting blog post up, this time covering a bit of BSD history and some different phases OpenBSD has been through
It's the third part of his ongoing (http://www.openbsd.org/papers/pruning.html) series (http://www.tedunangst.com/flak/post/out-with-the-old-in-with-the-less) of posts about OpenBSD removing large bits of code in favor of smaller replacements
In the earliest days, OpenBSD collected and maintained code from lots of other projects (Apache, lynx, perl..)
After importing new updates every release cycle, they eventually hit a transitional phase - things were updated, but nothing new was imported
When the need arose, instead of importing a known tool to do the job, homemade replacements (OpenNTPD, OpenBGPD, etc) were slowly developed
In more recent times, a lot of the imported code has been completely removed in favor of the homegrown daemons
More discussion on HN (https://news.ycombinator.com/item?id=9980373) and reddit (https://www.reddit.com/r/openbsd/comments/3f9o19/from_distribution_to_project/)
***
Remote ZFS mirrors, the hard way (https://github.com/hughobrien/zfs-remote-mirror)
Backups to "the cloud" have become a hot topic in recent years, but most of them require trade-offs between convenience and security
You have to trust (some of) the providers not to snoop on your data, but even the ones who allow you to locally encrypt files aren't without some compromise
As the author puts it: "We don't need live synchronisation, cloud scaling, SLAs, NSAs, terms of service, lock-ins, buy-outs, up-sells, shut-downs, DoSs, fail whales, pay-us-or-we'll-deletes, or any of the noise that comes with using someone else's infrastructure."
This guide walks you through setting up a FreeBSD server with ZFS to do secure offsite backups yourself
The end result is an automatic system for incremental backups that's backed (pun intended) by ZFS
If you're serious about keeping your important data safe and sound, you'll want to give this one a read - lots of detailed instructions
***
Various DragonFlyBSD updates (http://lists.dragonflybsd.org/pipermail/commits/2015-July/419064.html)
The DragonFly guys have been quite busy this week, making an assortment of improvements throughout the tree
Intel ValleyView graphics support was finally committed to the main repository
While on the topic of graphics, they've also issued a call for testing (http://lists.dragonflybsd.org/pipermail/users/2015-July/207923.html) for a DRM update (matching Linux 3.16's and including some more Broadwell fixes)
Their base GCC compiler is also now upgraded to version 5.2 (http://lists.dragonflybsd.org/pipermail/commits/2015-July/419045.html)
If your hardware supports it, DragonFly will now use an accelerated console by default (http://lists.dragonflybsd.org/pipermail/commits/2015-July/419070.html)
***
QuakeCon runs on OpenBSD (https://youtu.be/mOv62lBdlXU?t=292)
QuakeCon (https://en.wikipedia.org/wiki/QuakeCon), everyone's favorite event full of rocket launchers, recently gave a mini-tour of their network setup
For such a crazy network, unsurprisingly, they seem to be big fans of OpenBSD and PF
In this video interview, one of the sysadmins discusses why he chose OpenBSD, what he likes about it, different packet queueing systems, how their firewalls and servers are laid out and much more
He also talks about why they went with vanilla PF, writing their ruleset from the ground up rather than relying on a prebuilt solution
There's also some general networking talk about nginx, reverse proxies, caching, fiber links and all that good stuff
Follow-up questions can be asked in this reddit thread (https://www.reddit.com/r/BSD/comments/3f43fh/bsd_runs_quakecon/)
The host doesn't seem to be that familiar with the topics at hand, mentioning "OpenPF" multiple times among other things, so our listeners should get a kick out of it
***
Interview - Adrian Chadd - adrian@freebsd.org (mailto:adrian@freebsd.org) / @erikarn (https://twitter.com/erikarn)
Rethinking ways to improve FreeBSD (https://www.reddit.com/r/freebsd/comments/3d80vt)
News Roundup
CII contributes to OpenBSD (http://undeadly.org/cgi?action=article&amp;amp;sid=20150804161939)
If you recall back to when we talked to the OpenBSD foundation (http://www.bsdnow.tv/episodes/2015_02_25-from_the_foundation_2), one of the things Ken mentioned was the Core Infrastructure Initiative (https://www.coreinfrastructure.org)
In a nutshell (https://www.coreinfrastructure.org/faq), it's an organization of security experts that helps facilitate (with money, in most cases) the advancement of the more critical open source components of the internet
The group is organized by the Linux foundation, and gets its multi-million dollar backing from various big companies in the technology space (and donations from volunteers) 
To ensure that OpenBSD and its related projects (OpenSSH, LibreSSL and PF likely being the main ones here) remain healthy, they've just made a large donation to the foundation - this makes them the first (http://www.openbsdfoundation.org/contributors.html) "platinum" level donor as well
While the exact amount wasn't disclosed, it was somewhere between $50,000 and $100,000
The donation comes less than a month after Microsoft's big donation (http://undeadly.org/cgi?action=article&amp;amp;sid=20150708134520), so it's good to see these large organizations helping out important open source projects that we depend on every day
***
Another BSDCan report (http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-mark-linimon.html)
The FreeBSD foundation is still getting trip reports from BSDCan, and this one comes from Mark Linimon
In his report, he mainly covers the devsummit and some discussion with the portmgr team
One notable change for the upcoming 10.2 release is that the default binary repository is now the quarterly branch - Mark talks a bit about this as well
He also gives his thoughts on using QEMU for cross-compiling packages (http://www.bsdnow.tv/episodes/2015_03_04-just_add_qemu) and network performance testing
***
Lumina 0.8.6 released (http://blog.pcbsd.org/2015/08/lumina-desktop-0-8-6-released/)
The PC-BSD team has released another version of Lumina (http://www.lumina-desktop.org/), their BSD-licensed desktop environment
This is mainly a bugfix and performance improvement release, rather than one with lots of new features
The on-screen display widget should be much faster now, and the configuration now allows for easier selection of default applications (which browser, which terminal, etc)
Lots of non-English translation updates and assorted fixes are included as well
If you haven't given it a try yet, or maybe you're looking for a new window manager, Lumina runs on all the BSDs
***
More c2k15 hackathon reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20150730180506)
Even more reports from OpenBSD's latest hackathon are starting to pour in
The first one is from Alexandr Nedvedicky, one of their brand new developers (the guy from Oracle)
He talks about his experience going to a hackathon for the first time, and lays out some of the plans for integrating their (very large) SMP PF patch into OpenBSD
Second up is Andrew Fresh (http://undeadly.org/cgi?action=article&amp;amp;sid=20150731191156&amp;amp;mode=flat), who went without any specific plans, but still ended up getting some UTF8 work done
On the topic of ARMv7, "I did enjoy being there when things weren't working so [Brandon Mercer] could futilely try to explain the problem to me (I wasn't much help with kernel memory layouts). Fortunately others overheard and provided words of encouragement and some help which was one of my favorite parts of attending this hackathon."
Florian Obser sent in a report that includes a little bit of everything (http://undeadly.org/cgi?action=article&amp;amp;sid=20150805151453): setting up the hackathon's network, relayd and httpd work, bidirectional forwarding detection, airplane stories and even lots of food
Paul Irofti wrote in as well (http://undeadly.org/cgi?action=article&amp;amp;sid=20150801100002&amp;amp;mode=flat) about his activities, which were mainly focused on the Octeon CPU architecture
He wrote a new driver for the onboard flash of a DSR-500 machine, which was built following the Common Flash Interface specification
This means that, going forward, OpenBSD will have out-of-the-box support for any flash memory device (often the case for MIPS and ARM-based embedded devices)
***
Feedback/Questions
Hamza writes in (http://slexy.org/view/s205kqTEIj)
Florian writes in (http://slexy.org/view/s2ogIP6cEf)
Dominik writes in (http://slexy.org/view/s214xE9ulK)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, quakecon, pf, firewall, gateway, server, reddit, c2k15, hackathon, octeon, zfs, backups, offsite, valleyview, bsdcan, cii</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week, we&#39;ll be talking with Adrian Chadd about an infamous reddit thread he made. With a title like &quot;what would you like to see in FreeBSD?&quot; and hundreds of responses, well, we&#39;ve got a lot to cover...</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/from-distribution-to-project" rel="nofollow">OpenBSD, from distribution to project</a></h3>

<ul>
<li>Ted Unangst has yet another interesting blog post up, this time covering a bit of BSD history and some different phases OpenBSD has been through</li>
<li>It&#39;s the third part of his <a href="http://www.openbsd.org/papers/pruning.html" rel="nofollow">ongoing</a> <a href="http://www.tedunangst.com/flak/post/out-with-the-old-in-with-the-less" rel="nofollow">series</a> of posts about OpenBSD removing large bits of code in favor of smaller replacements</li>
<li>In the earliest days, OpenBSD collected and maintained code from lots of other projects (Apache, lynx, perl..)</li>
<li>After importing new updates every release cycle, they eventually hit a transitional phase - things were updated, but nothing new was imported</li>
<li>When the need arose, instead of importing a known tool to do the job, homemade replacements (OpenNTPD, OpenBGPD, etc) were slowly developed</li>
<li>In more recent times, a lot of the imported code has been completely removed in favor of the homegrown daemons</li>
<li>More discussion <a href="https://news.ycombinator.com/item?id=9980373" rel="nofollow">on HN</a> <a href="https://www.reddit.com/r/openbsd/comments/3f9o19/from_distribution_to_project/" rel="nofollow">and reddit</a>
***</li>
</ul>

<h3><a href="https://github.com/hughobrien/zfs-remote-mirror" rel="nofollow">Remote ZFS mirrors, the hard way</a></h3>

<ul>
<li>Backups to &quot;the cloud&quot; have become a hot topic in recent years, but most of them require trade-offs between convenience and security</li>
<li>You have to trust (some of) the providers not to snoop on your data, but even the ones who allow you to locally encrypt files aren&#39;t without some compromise</li>
<li>As the author puts it: &quot;We don&#39;t need live synchronisation, cloud scaling, SLAs, NSAs, terms of service, lock-ins, buy-outs, up-sells, shut-downs, DoSs, fail whales, pay-us-or-we&#39;ll-deletes, or any of the noise that comes with using someone else&#39;s infrastructure.&quot;</li>
<li>This guide walks you through setting up a FreeBSD server with ZFS to do secure offsite backups yourself</li>
<li>The end result is an automatic system for incremental backups that&#39;s backed (pun intended) by ZFS</li>
<li>If you&#39;re serious about keeping your important data safe and sound, you&#39;ll want to give this one a read - lots of detailed instructions
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-July/419064.html" rel="nofollow">Various DragonFlyBSD updates</a></h3>

<ul>
<li>The DragonFly guys have been quite busy this week, making an assortment of improvements throughout the tree</li>
<li>Intel ValleyView graphics support was finally committed to the main repository</li>
<li>While on the topic of graphics, they&#39;ve also issued <a href="http://lists.dragonflybsd.org/pipermail/users/2015-July/207923.html" rel="nofollow">a call for testing</a> for a DRM update (matching Linux 3.16&#39;s and including some more Broadwell fixes)</li>
<li>Their base GCC compiler is also now <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-July/419045.html" rel="nofollow">upgraded to version 5.2</a></li>
<li>If your hardware supports it, DragonFly will now <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-July/419070.html" rel="nofollow">use an accelerated console by default</a>
***</li>
</ul>

<h3><a href="https://youtu.be/mOv62lBdlXU?t=292" rel="nofollow">QuakeCon runs on OpenBSD</a></h3>

<ul>
<li><a href="https://en.wikipedia.org/wiki/QuakeCon" rel="nofollow">QuakeCon</a>, everyone&#39;s favorite event full of rocket launchers, recently gave a mini-tour of their network setup</li>
<li>For such a crazy network, unsurprisingly, they seem to be big fans of OpenBSD and PF</li>
<li>In this video interview, one of the sysadmins discusses why he chose OpenBSD, what he likes about it, different packet queueing systems, how their firewalls and servers are laid out and much more</li>
<li>He also talks about why they went with vanilla PF, writing their ruleset from the ground up rather than relying on a prebuilt solution</li>
<li>There&#39;s also some general networking talk about nginx, reverse proxies, caching, fiber links and all that good stuff</li>
<li>Follow-up questions can be asked in <a href="https://www.reddit.com/r/BSD/comments/3f43fh/bsd_runs_quakecon/" rel="nofollow">this reddit thread</a></li>
<li>The host doesn&#39;t seem to be that familiar with the topics at hand, mentioning &quot;OpenPF&quot; multiple times among other things, so our listeners should get a kick out of it
***</li>
</ul>

<h2>Interview - Adrian Chadd - <a href="mailto:adrian@freebsd.org" rel="nofollow">adrian@freebsd.org</a> / <a href="https://twitter.com/erikarn" rel="nofollow">@erikarn</a></h2>

<p>Rethinking <a href="https://www.reddit.com/r/freebsd/comments/3d80vt" rel="nofollow">ways to improve FreeBSD</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150804161939" rel="nofollow">CII contributes to OpenBSD</a></h3>

<ul>
<li>If you recall back to <a href="http://www.bsdnow.tv/episodes/2015_02_25-from_the_foundation_2" rel="nofollow">when we talked to the OpenBSD foundation</a>, one of the things Ken mentioned was the <a href="https://www.coreinfrastructure.org" rel="nofollow">Core Infrastructure Initiative</a></li>
<li>In <a href="https://www.coreinfrastructure.org/faq" rel="nofollow">a nutshell</a>, it&#39;s an organization of security experts that helps facilitate (with money, in most cases) the advancement of the more critical open source components of the internet</li>
<li>The group is organized by the Linux foundation, and gets its multi-million dollar backing from various big companies in the technology space (and donations from volunteers) </li>
<li>To ensure that OpenBSD and its related projects (OpenSSH, LibreSSL and PF likely being the main ones here) remain healthy, they&#39;ve just made a large donation to the foundation - this makes them <a href="http://www.openbsdfoundation.org/contributors.html" rel="nofollow">the first</a> &quot;platinum&quot; level donor as well</li>
<li>While the exact amount wasn&#39;t disclosed, it was somewhere between $50,000 and $100,000</li>
<li>The donation comes less than a month after <a href="http://undeadly.org/cgi?action=article&sid=20150708134520" rel="nofollow">Microsoft&#39;s big donation</a>, so it&#39;s good to see these large organizations helping out important open source projects that we depend on every day
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-mark-linimon.html" rel="nofollow">Another BSDCan report</a></h3>

<ul>
<li>The FreeBSD foundation is still getting trip reports from BSDCan, and this one comes from Mark Linimon</li>
<li>In his report, he mainly covers the devsummit and some discussion with the portmgr team</li>
<li>One notable change for the upcoming 10.2 release is that the default binary repository is now the quarterly branch - Mark talks a bit about this as well</li>
<li>He also gives his thoughts on using <a href="http://www.bsdnow.tv/episodes/2015_03_04-just_add_qemu" rel="nofollow">QEMU for cross-compiling packages</a> and network performance testing
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/08/lumina-desktop-0-8-6-released/" rel="nofollow">Lumina 0.8.6 released</a></h3>

<ul>
<li>The PC-BSD team has released another version of <a href="http://www.lumina-desktop.org/" rel="nofollow">Lumina</a>, their BSD-licensed desktop environment</li>
<li>This is mainly a bugfix and performance improvement release, rather than one with lots of new features</li>
<li>The on-screen display widget should be much faster now, and the configuration now allows for easier selection of default applications (which browser, which terminal, etc)</li>
<li>Lots of non-English translation updates and assorted fixes are included as well</li>
<li>If you haven&#39;t given it a try yet, or maybe you&#39;re looking for a new window manager, Lumina runs on all the BSDs
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150730180506" rel="nofollow">More c2k15 hackathon reports</a></h3>

<ul>
<li>Even more reports from OpenBSD&#39;s latest hackathon are starting to pour in</li>
<li>The first one is from Alexandr Nedvedicky, one of their brand new developers (the guy from Oracle)</li>
<li>He talks about his experience going to a hackathon for the first time, and lays out some of the plans for integrating their (very large) SMP PF patch into OpenBSD</li>
<li>Second up <a href="http://undeadly.org/cgi?action=article&sid=20150731191156&mode=flat" rel="nofollow">is Andrew Fresh</a>, who went without any specific plans, but still ended up getting some UTF8 work done</li>
<li>On the topic of ARMv7, &quot;I did enjoy being there when things weren&#39;t working so [Brandon Mercer] could futilely try to explain the problem to me (I wasn&#39;t much help with kernel memory layouts). Fortunately others overheard and provided words of encouragement and some help which was one of my favorite parts of attending this hackathon.&quot;</li>
<li>Florian Obser sent in a report that includes <a href="http://undeadly.org/cgi?action=article&sid=20150805151453" rel="nofollow">a little bit of everything</a>: setting up the hackathon&#39;s network, relayd and httpd work, bidirectional forwarding detection, airplane stories and even lots of food</li>
<li>Paul Irofti <a href="http://undeadly.org/cgi?action=article&sid=20150801100002&mode=flat" rel="nofollow">wrote in as well</a> about his activities, which were mainly focused on the Octeon CPU architecture</li>
<li>He wrote a new driver for the onboard flash of a DSR-500 machine, which was built following the Common Flash Interface specification</li>
<li>This means that, going forward, OpenBSD will have out-of-the-box support for any flash memory device (often the case for MIPS and ARM-based embedded devices)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s205kqTEIj" rel="nofollow">Hamza writes in</a></li>
<li><a href="http://slexy.org/view/s2ogIP6cEf" rel="nofollow">Florian writes in</a></li>
<li><a href="http://slexy.org/view/s214xE9ulK" rel="nofollow">Dominik writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week, we&#39;ll be talking with Adrian Chadd about an infamous reddit thread he made. With a title like &quot;what would you like to see in FreeBSD?&quot; and hundreds of responses, well, we&#39;ve got a lot to cover...</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/from-distribution-to-project" rel="nofollow">OpenBSD, from distribution to project</a></h3>

<ul>
<li>Ted Unangst has yet another interesting blog post up, this time covering a bit of BSD history and some different phases OpenBSD has been through</li>
<li>It&#39;s the third part of his <a href="http://www.openbsd.org/papers/pruning.html" rel="nofollow">ongoing</a> <a href="http://www.tedunangst.com/flak/post/out-with-the-old-in-with-the-less" rel="nofollow">series</a> of posts about OpenBSD removing large bits of code in favor of smaller replacements</li>
<li>In the earliest days, OpenBSD collected and maintained code from lots of other projects (Apache, lynx, perl..)</li>
<li>After importing new updates every release cycle, they eventually hit a transitional phase - things were updated, but nothing new was imported</li>
<li>When the need arose, instead of importing a known tool to do the job, homemade replacements (OpenNTPD, OpenBGPD, etc) were slowly developed</li>
<li>In more recent times, a lot of the imported code has been completely removed in favor of the homegrown daemons</li>
<li>More discussion <a href="https://news.ycombinator.com/item?id=9980373" rel="nofollow">on HN</a> <a href="https://www.reddit.com/r/openbsd/comments/3f9o19/from_distribution_to_project/" rel="nofollow">and reddit</a>
***</li>
</ul>

<h3><a href="https://github.com/hughobrien/zfs-remote-mirror" rel="nofollow">Remote ZFS mirrors, the hard way</a></h3>

<ul>
<li>Backups to &quot;the cloud&quot; have become a hot topic in recent years, but most of them require trade-offs between convenience and security</li>
<li>You have to trust (some of) the providers not to snoop on your data, but even the ones who allow you to locally encrypt files aren&#39;t without some compromise</li>
<li>As the author puts it: &quot;We don&#39;t need live synchronisation, cloud scaling, SLAs, NSAs, terms of service, lock-ins, buy-outs, up-sells, shut-downs, DoSs, fail whales, pay-us-or-we&#39;ll-deletes, or any of the noise that comes with using someone else&#39;s infrastructure.&quot;</li>
<li>This guide walks you through setting up a FreeBSD server with ZFS to do secure offsite backups yourself</li>
<li>The end result is an automatic system for incremental backups that&#39;s backed (pun intended) by ZFS</li>
<li>If you&#39;re serious about keeping your important data safe and sound, you&#39;ll want to give this one a read - lots of detailed instructions
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-July/419064.html" rel="nofollow">Various DragonFlyBSD updates</a></h3>

<ul>
<li>The DragonFly guys have been quite busy this week, making an assortment of improvements throughout the tree</li>
<li>Intel ValleyView graphics support was finally committed to the main repository</li>
<li>While on the topic of graphics, they&#39;ve also issued <a href="http://lists.dragonflybsd.org/pipermail/users/2015-July/207923.html" rel="nofollow">a call for testing</a> for a DRM update (matching Linux 3.16&#39;s and including some more Broadwell fixes)</li>
<li>Their base GCC compiler is also now <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-July/419045.html" rel="nofollow">upgraded to version 5.2</a></li>
<li>If your hardware supports it, DragonFly will now <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-July/419070.html" rel="nofollow">use an accelerated console by default</a>
***</li>
</ul>

<h3><a href="https://youtu.be/mOv62lBdlXU?t=292" rel="nofollow">QuakeCon runs on OpenBSD</a></h3>

<ul>
<li><a href="https://en.wikipedia.org/wiki/QuakeCon" rel="nofollow">QuakeCon</a>, everyone&#39;s favorite event full of rocket launchers, recently gave a mini-tour of their network setup</li>
<li>For such a crazy network, unsurprisingly, they seem to be big fans of OpenBSD and PF</li>
<li>In this video interview, one of the sysadmins discusses why he chose OpenBSD, what he likes about it, different packet queueing systems, how their firewalls and servers are laid out and much more</li>
<li>He also talks about why they went with vanilla PF, writing their ruleset from the ground up rather than relying on a prebuilt solution</li>
<li>There&#39;s also some general networking talk about nginx, reverse proxies, caching, fiber links and all that good stuff</li>
<li>Follow-up questions can be asked in <a href="https://www.reddit.com/r/BSD/comments/3f43fh/bsd_runs_quakecon/" rel="nofollow">this reddit thread</a></li>
<li>The host doesn&#39;t seem to be that familiar with the topics at hand, mentioning &quot;OpenPF&quot; multiple times among other things, so our listeners should get a kick out of it
***</li>
</ul>

<h2>Interview - Adrian Chadd - <a href="mailto:adrian@freebsd.org" rel="nofollow">adrian@freebsd.org</a> / <a href="https://twitter.com/erikarn" rel="nofollow">@erikarn</a></h2>

<p>Rethinking <a href="https://www.reddit.com/r/freebsd/comments/3d80vt" rel="nofollow">ways to improve FreeBSD</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150804161939" rel="nofollow">CII contributes to OpenBSD</a></h3>

<ul>
<li>If you recall back to <a href="http://www.bsdnow.tv/episodes/2015_02_25-from_the_foundation_2" rel="nofollow">when we talked to the OpenBSD foundation</a>, one of the things Ken mentioned was the <a href="https://www.coreinfrastructure.org" rel="nofollow">Core Infrastructure Initiative</a></li>
<li>In <a href="https://www.coreinfrastructure.org/faq" rel="nofollow">a nutshell</a>, it&#39;s an organization of security experts that helps facilitate (with money, in most cases) the advancement of the more critical open source components of the internet</li>
<li>The group is organized by the Linux foundation, and gets its multi-million dollar backing from various big companies in the technology space (and donations from volunteers) </li>
<li>To ensure that OpenBSD and its related projects (OpenSSH, LibreSSL and PF likely being the main ones here) remain healthy, they&#39;ve just made a large donation to the foundation - this makes them <a href="http://www.openbsdfoundation.org/contributors.html" rel="nofollow">the first</a> &quot;platinum&quot; level donor as well</li>
<li>While the exact amount wasn&#39;t disclosed, it was somewhere between $50,000 and $100,000</li>
<li>The donation comes less than a month after <a href="http://undeadly.org/cgi?action=article&sid=20150708134520" rel="nofollow">Microsoft&#39;s big donation</a>, so it&#39;s good to see these large organizations helping out important open source projects that we depend on every day
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-mark-linimon.html" rel="nofollow">Another BSDCan report</a></h3>

<ul>
<li>The FreeBSD foundation is still getting trip reports from BSDCan, and this one comes from Mark Linimon</li>
<li>In his report, he mainly covers the devsummit and some discussion with the portmgr team</li>
<li>One notable change for the upcoming 10.2 release is that the default binary repository is now the quarterly branch - Mark talks a bit about this as well</li>
<li>He also gives his thoughts on using <a href="http://www.bsdnow.tv/episodes/2015_03_04-just_add_qemu" rel="nofollow">QEMU for cross-compiling packages</a> and network performance testing
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/08/lumina-desktop-0-8-6-released/" rel="nofollow">Lumina 0.8.6 released</a></h3>

<ul>
<li>The PC-BSD team has released another version of <a href="http://www.lumina-desktop.org/" rel="nofollow">Lumina</a>, their BSD-licensed desktop environment</li>
<li>This is mainly a bugfix and performance improvement release, rather than one with lots of new features</li>
<li>The on-screen display widget should be much faster now, and the configuration now allows for easier selection of default applications (which browser, which terminal, etc)</li>
<li>Lots of non-English translation updates and assorted fixes are included as well</li>
<li>If you haven&#39;t given it a try yet, or maybe you&#39;re looking for a new window manager, Lumina runs on all the BSDs
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150730180506" rel="nofollow">More c2k15 hackathon reports</a></h3>

<ul>
<li>Even more reports from OpenBSD&#39;s latest hackathon are starting to pour in</li>
<li>The first one is from Alexandr Nedvedicky, one of their brand new developers (the guy from Oracle)</li>
<li>He talks about his experience going to a hackathon for the first time, and lays out some of the plans for integrating their (very large) SMP PF patch into OpenBSD</li>
<li>Second up <a href="http://undeadly.org/cgi?action=article&sid=20150731191156&mode=flat" rel="nofollow">is Andrew Fresh</a>, who went without any specific plans, but still ended up getting some UTF8 work done</li>
<li>On the topic of ARMv7, &quot;I did enjoy being there when things weren&#39;t working so [Brandon Mercer] could futilely try to explain the problem to me (I wasn&#39;t much help with kernel memory layouts). Fortunately others overheard and provided words of encouragement and some help which was one of my favorite parts of attending this hackathon.&quot;</li>
<li>Florian Obser sent in a report that includes <a href="http://undeadly.org/cgi?action=article&sid=20150805151453" rel="nofollow">a little bit of everything</a>: setting up the hackathon&#39;s network, relayd and httpd work, bidirectional forwarding detection, airplane stories and even lots of food</li>
<li>Paul Irofti <a href="http://undeadly.org/cgi?action=article&sid=20150801100002&mode=flat" rel="nofollow">wrote in as well</a> about his activities, which were mainly focused on the Octeon CPU architecture</li>
<li>He wrote a new driver for the onboard flash of a DSR-500 machine, which was built following the Common Flash Interface specification</li>
<li>This means that, going forward, OpenBSD will have out-of-the-box support for any flash memory device (often the case for MIPS and ARM-based embedded devices)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s205kqTEIj" rel="nofollow">Hamza writes in</a></li>
<li><a href="http://slexy.org/view/s2ogIP6cEf" rel="nofollow">Florian writes in</a></li>
<li><a href="http://slexy.org/view/s214xE9ulK" rel="nofollow">Dominik writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>100: Straight from the Src</title>
  <link>https://www.bsdnow.tv/100</link>
  <guid isPermaLink="false">06d71c41-6630-4fa3-8cd3-46e35a9a535c</guid>
  <pubDate>Wed, 29 Jul 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/06d71c41-6630-4fa3-8cd3-46e35a9a535c.mp3" length="53030452" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We've finally reached a hundred episodes, and this week we'll be talking to Sebastian Wiedenroth about pkgsrc. Though originally a NetBSD project, now it runs pretty much everywhere, and he even runs a conference about it!</itunes:subtitle>
  <itunes:duration>1:13:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We've finally reached a hundred episodes, and this week we'll be talking to Sebastian Wiedenroth about pkgsrc. Though originally a NetBSD project, now it runs pretty much everywhere, and he even runs a conference about it!
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Remote DoS in the TCP stack (https://blog.team-cymru.org/2015/07/another-day-another-patch/)
A pretty devious bug in the BSD network stack has been making its rounds for a while now, allowing remote attackers to exhaust the resources of a system with nothing more than TCP connections
While in the LAST_ACK state, which is one of the final stages of a connection's lifetime, the connection can get stuck and hang there indefinitely
This problem has a slightly confusing history that involves different fixes at different points in time from different people
Juniper originally discovered the bug and announced a fix (https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=JSA10686) for their proprietary networking gear on June 8th
On June 29th, FreeBSD caught wind of it and fixed the bug in their -current branch (https://svnweb.freebsd.org/base/head/sys/netinet/tcp_output.c?view=patch&amp;amp;r1=284941&amp;amp;r2=284940&amp;amp;pathrev=284941), but did not issue a security notice or MFC the fix back to the -stable branches
On July 13th, two weeks later, OpenBSD fixed the issue (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=143682919807388&amp;amp;w=2) in their -current branch with a slightly different patch, citing the FreeBSD revision from which the problem was found
Immediately afterwards, they merged it back to -stable and issued an errata notice (http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/010_tcp_persist.patch.sig) for 5.7 and 5.6
On July 21st, three weeks after their original fix, FreeBSD committed yet another slightly different fix (https://svnweb.freebsd.org/base/head/sys/netinet/tcp_output.c?view=patch&amp;amp;r1=285777&amp;amp;r2=285776&amp;amp;pathrev=285777) and issued a security notice (https://lists.freebsd.org/pipermail/freebsd-announce/2015-July/001655.html) for the problem (which didn't include the first fix)
After the second fix from FreeBSD, OpenBSD gave them both another look and found their single fix to be sufficient, covering the timer issue in a more general way
NetBSD confirmed they were vulnerable too, and applied another completely different fix (http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet/tcp_output.c.diff?r1=1.183&amp;amp;r2=1.184&amp;amp;only_with_tag=MAIN) to -current on July 24th, but haven't released a security notice yet
DragonFly is also investigating the issue now to see if they're affected as well
***
c2k15 hackathon reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20150721180312&amp;amp;mode=flat)
Reports from OpenBSD's latest hackathon (http://www.openbsd.org/hackathons.html), held in Calgary this time, are starting to roll in (there were over 40 devs there, so we might see a lot more of these)
The first one, from Ingo Schwarze, talks about some of the mandoc work he did at the event
He writes, "Did you ever look at a huge page in man, wanted to jump to the definition of a specific term - say, in ksh, to the definition of the "command" built-in command - and had to step through dozens of false positives with the less '/' and 'n' search keys before you finally found the actual definition?"
With mandoc's new internal jump targets, this is a problem of the past now
Jasper also sent in a report (http://undeadly.org/cgi?action=article&amp;amp;sid=20150723124332&amp;amp;mode=flat), doing his usual work with Puppet (and specifically "Facter," a tool used by Puppet to gather various bits of system information)
Aside from that and various ports-related work, Jasper worked on adding tame support to some userland tools, fixing some Octeon stuff and introduced something that OpenBSD has oddly lacked until now: an "-i" flag for sed (hooray!)
Antoine Jacoutot gave a report (http://undeadly.org/cgi?action=article&amp;amp;sid=20150722205349&amp;amp;mode=flat) on what he did at the hackathon as well, including improvements to the rcctl tool (for configuring startup services)
It now has an "ls" subcommand with status parsing, allowing you to list running services, stopped services or even ones that failed to start or are supposed to be running (he calls this "the poor man's service monitoring tool")
He also reworked some of the rc.d system to allow smoother operation of multiple instances of the same daemon to run (using tor with different config files as an example)
His list also included updating ports, updating ports documentation, updating the hotplug daemon and laying out some plans for automatic sysmerge for future upgrades
Foundation director Ken Westerback was also there (http://undeadly.org/cgi?action=article&amp;amp;sid=20150722105658&amp;amp;mode=flat), getting some disk-related and laptop work done
He cleaned up and committed the 4k sector softraid code that he'd been working on, as well as fixing some trackpad issues
Stefan Sperling, OpenBSD's token "wireless guy," had a lot to say (http://undeadly.org/cgi?action=article&amp;amp;sid=20150722182236&amp;amp;mode=flat) about the hackathon and what he did there (and even sent in his write-up before he got home)
He taught tcpdump about some new things, including 802.11n metadata beacons (there's a lot more specific detail about this one in the report)
Bringing a bag full of USB wireless devices with him, he set out to get the unsupported ones working, as well as fix some driver bugs in the ones that already did work
One quote from Stefan's report that a lot of people seem to be talking about: "Partway through the hackathon tedu proposed an old diff of his to make our base ls utility display multi-byte characters. This led to a long discussion about how to expand UTF-8 support in base. The conclusion so far indicates that single-byte locales (such as ISO-8859-1 and KOI-8) will be removed from the base OS after the 5.8 release is cut. This simplifies things because the whole system only has to care about a single character encoding. We'll then have a full release cycle to bring UTF-8 support to more base system utilities such as vi, ksh, and mg. To help with this plan, I started organizing a UTF-8-focused hackathon for some time later this year."
Jeremy Evans wrote in (http://undeadly.org/cgi?action=article&amp;amp;sid=20150725180527&amp;amp;mode=flat) to talk about updating lots of ports, moving the ruby ports up to the latest version and also creating perl and ruby wrappers for the new tame subsystem
While he's mainly a ports guy, he got to commit fixes to ports, the base system and even the kernel during the hackathon
Rafael Zalamena, who got commit access at the event, gives his very first report (http://undeadly.org/cgi?action=article&amp;amp;sid=20150725183439&amp;amp;mode=flat) on his networking-related hackathon activities
With Rafael's diffs and help from a couple other developers, OpenBSD now has support for VPLS (https://en.wikipedia.org/wiki/Virtual_Private_LAN_Service)
Jonathan Gray got a lot done (http://undeadly.org/cgi?action=article&amp;amp;sid=20150728184743&amp;amp;mode=flat) in the area of graphics, working on OpenGL and Mesa, updating libdrm and even working with upstream projects to remove some GNU-specific code
As he's become somewhat known for, Jonathan was also busy running three things in the background: clang's fuzzer, cppcheck and AFL (looking for any potential crashes to fix)
Martin Pieuchot gave an write-up (http://undeadly.org/cgi?action=article&amp;amp;sid=20150724183210&amp;amp;mode=flat) on his experience: "I always though that hackathons were the best place to write code, but what's even more important is that they are the best (well actually only) moment where one can discuss and coordinate projects with other developers IRL. And that's what I did."
He laid out some plans for the wireless stack, discussed future plans for PF, made some routing table improvements and did various other bits to the network stack
Unfortunately, most of Martin's secret plans seem to have been left intentionally vague, and will start to take form in the next release cycle
We're still eagerly awaiting a report from one of OpenBSD's newest developers (https://twitter.com/phessler/status/623291827878137856), Alexandr Nedvedicky (the Oracle guy who's working on SMP PF and some other PF fixes)
OpenBSD 5.8's "beta" status was recently reverted, with the message "take that as a hint (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=143766883514831&amp;amp;w=2)," so that may mean more big changes are still to come...
***
FreeBSD quarterly status report (https://www.freebsd.org/news/status/report-2015-04-2015-06.html)
FreeBSD has published their quarterly status report for the months of April to June, citing it to be the largest one so far
It's broken down into a number of sections: team reports, projects, kernel, architectures, userland programs, ports, documentation, Google Summer of Code and miscellaneous others
Starting off with the cluster admin, some machines were moved to the datacenter at New York Internet, email services are now more resilient to failure, the svn mirrors (now just "svn.freebsd.org") are now using GeoGNS with official SSL certs and general redundancy was increased
In the release engineering space, ARM and ARM64 work continues to improve on the Cavium ThunderX, more focus is being put into cloud platforms and the 10.2-RELEASE cycle is reaching its final stages
The core team has been working on phabricator, the fancy review system, and is considering to integrate oauth support soon
Work also continues on bhyve, and more operating systems are slowly gaining support (including the much-rumored Windows Server 2012)
The report also covers recent developments in the Linux emulation layer, and encourages people using 11-CURRENT to help test out the 64bit support
Multipath TCP was also a hot topic, and there's a brief summary of the current status on that patch (it will be available publicly soon)
ZFSguru, a project we haven't talked about a lot, also gets some attention in the report - version 0.3 is set to be completed in early August
PCIe hotplug support is also mentioned, though it's still in the development stages (basic hot-swap functions are working though)
The official binary packages are now built more frequently than before with the help of additional hardware, so AMD64 and i386 users will have fresher ports without the need for compiling
Various other small updates on specific areas of ports (KDE, XFCE, X11...) are also included in the report
Documentation is a strong focus as always, a number of new documentation committers were added and some of the translations have been improved a lot
Many other topics were covered, including foundation updates, conference plans, pkgsrc support in pkgng, ZFS support for UEFI boot and much more
***
The OpenSSH bug that wasn't (http://bsdly.blogspot.com/2015/07/the-openssh-bug-that-wasnt.html)
There's been a lot of discussion (https://www.marc.info/?t=143766048000005&amp;amp;r=1&amp;amp;w=2) about a supposed flaw (https://kingcope.wordpress.com/2015/07/16/openssh-keyboard-interactive-authentication-brute-force-vulnerability-maxauthtries-bypass/) in OpenSSH, allowing attackers to substantially amplify the number of password attempts they can try per session (without leaving any abnormal log traces, even)
There's no actual exploit to speak of; this bug would only help someone get more bruteforce tries in with a fewer number of connections (https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-July/034209.html)
FreeBSD in its default configuration, with PAM (https://en.wikipedia.org/wiki/Pluggable_authentication_module) and ChallengeResponseAuthentication enabled, was the only one vulnerable to the problem - not upstream OpenSSH (https://www.marc.info/?l=openbsd-misc&amp;amp;m=143767296016252&amp;amp;w=2), nor any of the other BSDs, and not even the majority of Linux distros
If you disable all forms of authentication except public keys, like you're supposed to (https://stribika.github.io/2015/01/04/secure-secure-shell.html), then this is also not a big deal for FreeBSD systems
Realistically speaking, it's more of a PAM bug (https://www.marc.info/?l=openbsd-misc&amp;amp;m=143782167322500&amp;amp;w=2) than anything else
OpenSSH added an additional check (https://anongit.mindrot.org/openssh.git/patch/?id=5b64f85bb811246c59ebab) for this type of setup that will be in 7.0, but simply changing your sshd_config is enough to mitigate the issue for now on FreeBSD (or you can run freebsd-update (https://lists.freebsd.org/pipermail/freebsd-security-notifications/2015-July/000248.html))
***
Interview - Sebastian Wiedenroth - wiedi@netbsd.org (mailto:wiedi@netbsd.org) / @wied0r (https://twitter.com/wied0r)
pkgsrc (https://en.wikipedia.org/wiki/Pkgsrc) and pkgsrcCon (http://pkgsrc.org/pkgsrcCon/)
News Roundup
Now served by OpenBSD (https://tribaal.io/this-now-served-by-openbsd.html)
We've mentioned that you can also install OpenBSD on DO droplets, and this blog post is about someone who actually did it
The use case for the author was for a webserver, so he decided to try out the httpd in base
Configuration is ridiculously simple, and the config file in his example provides an HTTPS-only webserver, with plaintext requests automatically redirecting
TLS 1.2 by default, strong ciphers with LibreSSL and HSTS (https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) combined give you a pretty secure web server
***
FreeBSD laptop playbooks (https://github.com/sean-/freebsd-laptops)
A new project has started up on Github for configuring FreeBSD on various laptops, unsurprisingly named "freebsd-laptops"
It's based on ansible, and uses the playbook format for automatic set up and configuration
Right now, it's only working on a single Lenovo laptop, but the plan is to add instructions for many more models
Check the Github page for instructions on how to get started, and maybe get involved if you're running FreeBSD on a laptop
***
NetBSD on the NVIDIA Jetson TK1 (https://blog.netbsd.org/tnf/entry/netbsd_on_the_nvidia_jetson)
If you've never heard of the Jetson TK1 (https://developer.nvidia.com/jetson-tk1), we can go ahead and spoil the secret here: NetBSD runs on it
As for the specs, it has a quad-core ARMv7 CPU at 2.3GHz, 2 gigs of RAM, gigabit ethernet, SATA, HDMI and mini-PCIE
This blog post shows which parts of the board are working with NetBSD -current (which seems to be almost everything)
You can even run X11 on it, pretty sweet
***
DragonFly power mangement options (http://lists.dragonflybsd.org/pipermail/users/2015-July/207911.html)
DragonFly developer Sepherosa, who we've had on the show, has been doing some ACPI work over there
In this email, he presents some of DragonFly's different power management options: ACPI P-states, C-states, mwait C-states and some Intel-specific bits as well
He also did some testing with each of them and gave his findings about power saving
If you've been thinking about running DragonFly on a laptop, this would be a good one to read
***
OpenBSD router under FreeBSD bhyve (https://www.quernus.co.uk/2015/07/27/openbsd-as-freebsd-router/)
If one BSD just isn't enough for you, and you've only got one machine, why not run two at once
This article talks about taking a FreeBSD server running bhyve and making a virtualized OpenBSD router with it
If you've been considering switching over your router at home or the office, doing it in a virtual machine is a good way to test the waters before committing to real hardware
The author also includes a little bit of history on how he got into both operating systems
There are lots of mixed opinions about virtualizing core network components, so we'll leave it up to you to do your research
Of course, the next logical step is to put that bhyve host under Xen on NetBSD...
***
Feedback/Questions
Kevin writes in (http://slexy.org/view/s2yPVV5Wyp)
Logan writes in (http://slexy.org/view/s21zcz9rut)
Peter writes in (http://slexy.org/view/s21CRmiPwK)
Randy writes in (http://slexy.org/view/s211zfIXff)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, pkgsrc, pkgsrccon, portability, illumos, solaris, openindiana, opensolaris, zfs, openzfs, tcp, dos, c2k15, hackathon, openssh, pam, exploit, smartos, omnios, joyent, delphix</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;ve finally reached a hundred episodes, and this week we&#39;ll be talking to Sebastian Wiedenroth about pkgsrc. Though originally a NetBSD project, now it runs pretty much everywhere, and he even runs a conference about it!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.team-cymru.org/2015/07/another-day-another-patch/" rel="nofollow">Remote DoS in the TCP stack</a></h3>

<ul>
<li>A pretty devious bug in the BSD network stack has been making its rounds for a while now, allowing <em>remote</em> attackers to exhaust the resources of a system with nothing more than TCP connections</li>
<li>While in the LAST_ACK state, which is one of the final stages of a connection&#39;s lifetime, the connection can get stuck and hang there indefinitely</li>
<li>This problem has a slightly confusing history that involves different fixes at different points in time from different people</li>
<li>Juniper originally discovered the bug and <a href="https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10686" rel="nofollow">announced a fix</a> for their proprietary networking gear on June 8th</li>
<li>On June 29th, FreeBSD caught wind of it and fixed the bug <a href="https://svnweb.freebsd.org/base/head/sys/netinet/tcp_output.c?view=patch&r1=284941&r2=284940&pathrev=284941" rel="nofollow">in their -current branch</a>, but did not issue a security notice or MFC the fix back to the -stable branches</li>
<li>On July 13th, two weeks later, OpenBSD <a href="https://www.marc.info/?l=openbsd-cvs&m=143682919807388&w=2" rel="nofollow">fixed the issue</a> in their -current branch with a slightly different patch, citing the FreeBSD revision from which the problem was found</li>
<li>Immediately afterwards, they merged it back to -stable and issued <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/010_tcp_persist.patch.sig" rel="nofollow">an errata notice</a> for 5.7 and 5.6</li>
<li>On July 21st, three weeks after their original fix, FreeBSD committed <a href="https://svnweb.freebsd.org/base/head/sys/netinet/tcp_output.c?view=patch&r1=285777&r2=285776&pathrev=285777" rel="nofollow">yet another slightly different fix</a> and issued <a href="https://lists.freebsd.org/pipermail/freebsd-announce/2015-July/001655.html" rel="nofollow">a security notice</a> for the problem (which didn&#39;t include the first fix)</li>
<li>After the second fix from FreeBSD, OpenBSD gave them both another look and found their single fix to be sufficient, covering the timer issue in a more general way</li>
<li>NetBSD confirmed they were vulnerable too, and <a href="http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet/tcp_output.c.diff?r1=1.183&r2=1.184&only_with_tag=MAIN" rel="nofollow">applied another completely different fix</a> to -current on July 24th, but haven&#39;t released a security notice yet</li>
<li>DragonFly is also investigating the issue now to see if they&#39;re affected as well
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150721180312&mode=flat" rel="nofollow">c2k15 hackathon reports</a></h3>

<ul>
<li>Reports from OpenBSD&#39;s latest <a href="http://www.openbsd.org/hackathons.html" rel="nofollow">hackathon</a>, held in Calgary this time, are starting to roll in (there were over 40 devs there, so we might see a lot more of these)</li>
<li>The first one, from Ingo Schwarze, talks about some of the mandoc work he did at the event</li>
<li>He writes, &quot;Did you ever look at a huge page in man, wanted to jump to the definition of a specific term - say, in ksh, to the definition of the &quot;command&quot; built-in command - and had to step through dozens of false positives with the less &#39;/&#39; and &#39;n&#39; search keys before you finally found the actual definition?&quot;</li>
<li>With mandoc&#39;s new internal jump targets, this is a problem of the past now</li>
<li>Jasper <a href="http://undeadly.org/cgi?action=article&sid=20150723124332&mode=flat" rel="nofollow">also sent in a report</a>, doing his usual work with Puppet (and specifically &quot;Facter,&quot; a tool used by Puppet to gather various bits of system information)</li>
<li>Aside from that and various ports-related work, Jasper worked on adding tame support to some userland tools, fixing some Octeon stuff and introduced something that OpenBSD has oddly lacked until now: an &quot;-i&quot; flag for sed (hooray!)</li>
<li>Antoine Jacoutot <a href="http://undeadly.org/cgi?action=article&sid=20150722205349&mode=flat" rel="nofollow">gave a report</a> on what he did at the hackathon as well, including improvements to the rcctl tool (for configuring startup services)</li>
<li>It now has an &quot;ls&quot; subcommand with status parsing, allowing you to list running services, stopped services or even ones that failed to start or are supposed to be running (he calls this &quot;the poor man&#39;s service monitoring tool&quot;)</li>
<li>He also reworked some of the rc.d system to allow smoother operation of multiple instances of the same daemon to run (using tor with different config files as an example)</li>
<li>His list also included updating ports, updating ports documentation, updating the hotplug daemon and laying out some plans for automatic sysmerge for future upgrades</li>
<li>Foundation director Ken Westerback <a href="http://undeadly.org/cgi?action=article&sid=20150722105658&mode=flat" rel="nofollow">was also there</a>, getting some disk-related and laptop work done</li>
<li>He cleaned up and committed the 4k sector softraid code that he&#39;d been working on, as well as fixing some trackpad issues</li>
<li>Stefan Sperling, OpenBSD&#39;s token &quot;wireless guy,&quot; had <a href="http://undeadly.org/cgi?action=article&sid=20150722182236&mode=flat" rel="nofollow">a lot to say</a> about the hackathon and what he did there (and even sent in his write-up before he got home)</li>
<li>He taught tcpdump about some new things, including 802.11n metadata beacons (there&#39;s a lot more specific detail about this one in the report)</li>
<li>Bringing <em>a bag full of USB wireless devices</em> with him, he set out to get the unsupported ones working, as well as fix some driver bugs in the ones that already did work</li>
<li>One quote from Stefan&#39;s report that a lot of people seem to be talking about: &quot;Partway through the hackathon tedu proposed an old diff of his to make our base ls utility display multi-byte characters. This led to a long discussion about how to expand UTF-8 support in base. The conclusion so far indicates that single-byte locales (such as ISO-8859-1 and KOI-8) will be removed from the base OS after the 5.8 release is cut. This simplifies things because the whole system only has to care about a single character encoding. We&#39;ll then have a full release cycle to bring UTF-8 support to more base system utilities such as vi, ksh, and mg. To help with this plan, I started organizing a UTF-8-focused hackathon for some time later this year.&quot;</li>
<li>Jeremy Evans <a href="http://undeadly.org/cgi?action=article&sid=20150725180527&mode=flat" rel="nofollow">wrote in</a> to talk about updating lots of ports, moving the ruby ports up to the latest version and also creating perl and ruby wrappers for the new tame subsystem</li>
<li>While he&#39;s mainly a ports guy, he got to commit fixes to ports, the base system and even the kernel during the hackathon</li>
<li>Rafael Zalamena, who got commit access at the event, <a href="http://undeadly.org/cgi?action=article&sid=20150725183439&mode=flat" rel="nofollow">gives his very first report</a> on his networking-related hackathon activities</li>
<li>With Rafael&#39;s diffs and help from a couple other developers, OpenBSD now has support for <a href="https://en.wikipedia.org/wiki/Virtual_Private_LAN_Service" rel="nofollow">VPLS</a></li>
<li>Jonathan Gray <a href="http://undeadly.org/cgi?action=article&sid=20150728184743&mode=flat" rel="nofollow">got a lot done</a> in the area of graphics, working on OpenGL and Mesa, updating libdrm and even working with upstream projects to remove some GNU-specific code</li>
<li>As he&#39;s become somewhat known for, Jonathan was also busy running three things in the background: clang&#39;s fuzzer, cppcheck and AFL (looking for any potential crashes to fix)</li>
<li>Martin Pieuchot <a href="http://undeadly.org/cgi?action=article&sid=20150724183210&mode=flat" rel="nofollow">gave an write-up</a> on his experience: &quot;I always though that hackathons were the best place to write code, but what&#39;s even more important is that they are the best (well actually only) moment where one can discuss and coordinate projects with other developers IRL. And that&#39;s what I did.&quot;</li>
<li>He laid out some plans for the wireless stack, discussed future plans for PF, made some routing table improvements and did various other bits to the network stack</li>
<li>Unfortunately, most of Martin&#39;s secret plans seem to have been left intentionally vague, and will start to take form in the next release cycle</li>
<li>We&#39;re still eagerly awaiting a report from one of OpenBSD&#39;s <a href="https://twitter.com/phessler/status/623291827878137856" rel="nofollow">newest developers</a>, Alexandr Nedvedicky (the Oracle guy who&#39;s working on SMP PF and some other PF fixes)</li>
<li>OpenBSD 5.8&#39;s &quot;beta&quot; status was recently <strong>reverted</strong>, with the message &quot;<a href="https://www.marc.info/?l=openbsd-cvs&m=143766883514831&w=2" rel="nofollow">take that as a hint</a>,&quot; so that may mean more big changes are still to come...
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2015-04-2015-06.html" rel="nofollow">FreeBSD quarterly status report</a></h3>

<ul>
<li>FreeBSD has published their quarterly status report for the months of April to June, citing it to be the largest one so far</li>
<li>It&#39;s broken down into a number of sections: team reports, projects, kernel, architectures, userland programs, ports, documentation, Google Summer of Code and miscellaneous others</li>
<li>Starting off with the cluster admin, some machines were moved to the datacenter at New York Internet, email services are now more resilient to failure, the svn mirrors (now just &quot;svn.freebsd.org&quot;) are now using GeoGNS with official SSL certs and general redundancy was increased</li>
<li>In the release engineering space, ARM and ARM64 work continues to improve on the Cavium ThunderX, more focus is being put into cloud platforms and the 10.2-RELEASE cycle is reaching its final stages</li>
<li>The core team has been working on phabricator, the fancy review system, and is considering to integrate oauth support soon</li>
<li>Work also continues on bhyve, and more operating systems are slowly gaining support (including the much-rumored Windows Server 2012)</li>
<li>The report also covers recent developments in the Linux emulation layer, and encourages people using 11-CURRENT to help test out the 64bit support</li>
<li>Multipath TCP was also a hot topic, and there&#39;s a brief summary of the current status on that patch (it will be available publicly soon)</li>
<li>ZFSguru, a project we haven&#39;t talked about a lot, also gets some attention in the report - version 0.3 is set to be completed in early August</li>
<li>PCIe hotplug support is also mentioned, though it&#39;s still in the development stages (basic hot-swap functions are working though)</li>
<li>The official binary packages are now built more frequently than before with the help of additional hardware, so AMD64 and i386 users will have fresher ports without the need for compiling</li>
<li>Various other small updates on specific areas of ports (KDE, XFCE, X11...) are also included in the report</li>
<li>Documentation is a strong focus as always, a number of new documentation committers were added and some of the translations have been improved a lot</li>
<li>Many other topics were covered, including foundation updates, conference plans, pkgsrc support in pkgng, ZFS support for UEFI boot and much more
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2015/07/the-openssh-bug-that-wasnt.html" rel="nofollow">The OpenSSH bug that wasn&#39;t</a></h3>

<ul>
<li>There&#39;s been a lot of <a href="https://www.marc.info/?t=143766048000005&r=1&w=2" rel="nofollow">discussion</a> about <a href="https://kingcope.wordpress.com/2015/07/16/openssh-keyboard-interactive-authentication-brute-force-vulnerability-maxauthtries-bypass/" rel="nofollow">a supposed flaw</a> in OpenSSH, allowing attackers to substantially amplify the number of password attempts they can try per session (without leaving any abnormal log traces, even)</li>
<li>There&#39;s no actual <em>exploit</em> to speak of; this bug would only help someone get more bruteforce tries in with a <a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-July/034209.html" rel="nofollow">fewer number of connections</a></li>
<li>FreeBSD in its default configuration, with <a href="https://en.wikipedia.org/wiki/Pluggable_authentication_module" rel="nofollow">PAM</a> and ChallengeResponseAuthentication enabled, was the only one vulnerable to the problem - <a href="https://www.marc.info/?l=openbsd-misc&m=143767296016252&w=2" rel="nofollow">not upstream OpenSSH</a>, nor any of the other BSDs, and not even the majority of Linux distros</li>
<li>If you disable all forms of authentication except public keys, <a href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" rel="nofollow">like you&#39;re supposed to</a>, then this is also not a big deal for FreeBSD systems</li>
<li>Realistically speaking, it&#39;s more of <a href="https://www.marc.info/?l=openbsd-misc&m=143782167322500&w=2" rel="nofollow">a PAM bug</a> than anything else</li>
<li>OpenSSH <a href="https://anongit.mindrot.org/openssh.git/patch/?id=5b64f85bb811246c59ebab" rel="nofollow">added an additional check</a> for this type of setup that will be in 7.0, but simply changing your sshd_config is enough to mitigate the issue for now on FreeBSD (or you can <a href="https://lists.freebsd.org/pipermail/freebsd-security-notifications/2015-July/000248.html" rel="nofollow">run freebsd-update</a>)
***</li>
</ul>

<h2>Interview - Sebastian Wiedenroth - <a href="mailto:wiedi@netbsd.org" rel="nofollow">wiedi@netbsd.org</a> / <a href="https://twitter.com/wied0r" rel="nofollow">@wied0r</a></h2>

<p><a href="https://en.wikipedia.org/wiki/Pkgsrc" rel="nofollow">pkgsrc</a> and <a href="http://pkgsrc.org/pkgsrcCon/" rel="nofollow">pkgsrcCon</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://tribaal.io/this-now-served-by-openbsd.html" rel="nofollow">Now served by OpenBSD</a></h3>

<ul>
<li>We&#39;ve mentioned that you can also install OpenBSD on DO droplets, and this blog post is about someone who actually did it</li>
<li>The use case for the author was for a webserver, so he decided to try out the httpd in base</li>
<li>Configuration is ridiculously simple, and the config file in his example provides an HTTPS-only webserver, with plaintext requests automatically redirecting</li>
<li>TLS 1.2 by default, strong ciphers with LibreSSL and <a href="https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" rel="nofollow">HSTS</a> combined give you a pretty secure web server
***</li>
</ul>

<h3><a href="https://github.com/sean-/freebsd-laptops" rel="nofollow">FreeBSD laptop playbooks</a></h3>

<ul>
<li>A new project has started up on Github for configuring FreeBSD on various laptops, unsurprisingly named &quot;freebsd-laptops&quot;</li>
<li>It&#39;s based on ansible, and uses the playbook format for automatic set up and configuration</li>
<li>Right now, it&#39;s only working on a single Lenovo laptop, but the plan is to add instructions for many more models</li>
<li>Check the Github page for instructions on how to get started, and maybe get involved if you&#39;re running FreeBSD on a laptop
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_on_the_nvidia_jetson" rel="nofollow">NetBSD on the NVIDIA Jetson TK1</a></h3>

<ul>
<li>If you&#39;ve never heard of the <a href="https://developer.nvidia.com/jetson-tk1" rel="nofollow">Jetson TK1</a>, we can go ahead and spoil the secret here: NetBSD runs on it</li>
<li>As for the specs, it has a quad-core ARMv7 CPU at 2.3GHz, 2 gigs of RAM, gigabit ethernet, SATA, HDMI and mini-PCIE</li>
<li>This blog post shows which parts of the board are working with NetBSD -current (which seems to be almost everything)</li>
<li>You can even run X11 on it, pretty sweet
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-July/207911.html" rel="nofollow">DragonFly power mangement options</a></h3>

<ul>
<li>DragonFly developer Sepherosa, who we&#39;ve had on the show, has been doing some ACPI work over there</li>
<li>In this email, he presents some of DragonFly&#39;s different power management options: ACPI P-states, C-states, mwait C-states and some Intel-specific bits as well</li>
<li>He also did some testing with each of them and gave his findings about power saving</li>
<li>If you&#39;ve been thinking about running DragonFly on a laptop, this would be a good one to read
***</li>
</ul>

<h3><a href="https://www.quernus.co.uk/2015/07/27/openbsd-as-freebsd-router/" rel="nofollow">OpenBSD router under FreeBSD bhyve</a></h3>

<ul>
<li>If one BSD just isn&#39;t enough for you, and you&#39;ve only got one machine, why not run two at once</li>
<li>This article talks about taking a FreeBSD server running bhyve and making a virtualized OpenBSD router with it</li>
<li>If you&#39;ve been considering switching over your router at home or the office, doing it in a virtual machine is a good way to test the waters before committing to real hardware</li>
<li>The author also includes a little bit of history on how he got into both operating systems</li>
<li>There are lots of mixed opinions about virtualizing core network components, so we&#39;ll leave it up to you to do your research</li>
<li>Of course, the next logical step is to put that bhyve host under Xen on NetBSD...
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2yPVV5Wyp" rel="nofollow">Kevin writes in</a></li>
<li><a href="http://slexy.org/view/s21zcz9rut" rel="nofollow">Logan writes in</a></li>
<li><a href="http://slexy.org/view/s21CRmiPwK" rel="nofollow">Peter writes in</a></li>
<li><a href="http://slexy.org/view/s211zfIXff" rel="nofollow">Randy writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;ve finally reached a hundred episodes, and this week we&#39;ll be talking to Sebastian Wiedenroth about pkgsrc. Though originally a NetBSD project, now it runs pretty much everywhere, and he even runs a conference about it!</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.team-cymru.org/2015/07/another-day-another-patch/" rel="nofollow">Remote DoS in the TCP stack</a></h3>

<ul>
<li>A pretty devious bug in the BSD network stack has been making its rounds for a while now, allowing <em>remote</em> attackers to exhaust the resources of a system with nothing more than TCP connections</li>
<li>While in the LAST_ACK state, which is one of the final stages of a connection&#39;s lifetime, the connection can get stuck and hang there indefinitely</li>
<li>This problem has a slightly confusing history that involves different fixes at different points in time from different people</li>
<li>Juniper originally discovered the bug and <a href="https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10686" rel="nofollow">announced a fix</a> for their proprietary networking gear on June 8th</li>
<li>On June 29th, FreeBSD caught wind of it and fixed the bug <a href="https://svnweb.freebsd.org/base/head/sys/netinet/tcp_output.c?view=patch&r1=284941&r2=284940&pathrev=284941" rel="nofollow">in their -current branch</a>, but did not issue a security notice or MFC the fix back to the -stable branches</li>
<li>On July 13th, two weeks later, OpenBSD <a href="https://www.marc.info/?l=openbsd-cvs&m=143682919807388&w=2" rel="nofollow">fixed the issue</a> in their -current branch with a slightly different patch, citing the FreeBSD revision from which the problem was found</li>
<li>Immediately afterwards, they merged it back to -stable and issued <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/010_tcp_persist.patch.sig" rel="nofollow">an errata notice</a> for 5.7 and 5.6</li>
<li>On July 21st, three weeks after their original fix, FreeBSD committed <a href="https://svnweb.freebsd.org/base/head/sys/netinet/tcp_output.c?view=patch&r1=285777&r2=285776&pathrev=285777" rel="nofollow">yet another slightly different fix</a> and issued <a href="https://lists.freebsd.org/pipermail/freebsd-announce/2015-July/001655.html" rel="nofollow">a security notice</a> for the problem (which didn&#39;t include the first fix)</li>
<li>After the second fix from FreeBSD, OpenBSD gave them both another look and found their single fix to be sufficient, covering the timer issue in a more general way</li>
<li>NetBSD confirmed they were vulnerable too, and <a href="http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet/tcp_output.c.diff?r1=1.183&r2=1.184&only_with_tag=MAIN" rel="nofollow">applied another completely different fix</a> to -current on July 24th, but haven&#39;t released a security notice yet</li>
<li>DragonFly is also investigating the issue now to see if they&#39;re affected as well
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150721180312&mode=flat" rel="nofollow">c2k15 hackathon reports</a></h3>

<ul>
<li>Reports from OpenBSD&#39;s latest <a href="http://www.openbsd.org/hackathons.html" rel="nofollow">hackathon</a>, held in Calgary this time, are starting to roll in (there were over 40 devs there, so we might see a lot more of these)</li>
<li>The first one, from Ingo Schwarze, talks about some of the mandoc work he did at the event</li>
<li>He writes, &quot;Did you ever look at a huge page in man, wanted to jump to the definition of a specific term - say, in ksh, to the definition of the &quot;command&quot; built-in command - and had to step through dozens of false positives with the less &#39;/&#39; and &#39;n&#39; search keys before you finally found the actual definition?&quot;</li>
<li>With mandoc&#39;s new internal jump targets, this is a problem of the past now</li>
<li>Jasper <a href="http://undeadly.org/cgi?action=article&sid=20150723124332&mode=flat" rel="nofollow">also sent in a report</a>, doing his usual work with Puppet (and specifically &quot;Facter,&quot; a tool used by Puppet to gather various bits of system information)</li>
<li>Aside from that and various ports-related work, Jasper worked on adding tame support to some userland tools, fixing some Octeon stuff and introduced something that OpenBSD has oddly lacked until now: an &quot;-i&quot; flag for sed (hooray!)</li>
<li>Antoine Jacoutot <a href="http://undeadly.org/cgi?action=article&sid=20150722205349&mode=flat" rel="nofollow">gave a report</a> on what he did at the hackathon as well, including improvements to the rcctl tool (for configuring startup services)</li>
<li>It now has an &quot;ls&quot; subcommand with status parsing, allowing you to list running services, stopped services or even ones that failed to start or are supposed to be running (he calls this &quot;the poor man&#39;s service monitoring tool&quot;)</li>
<li>He also reworked some of the rc.d system to allow smoother operation of multiple instances of the same daemon to run (using tor with different config files as an example)</li>
<li>His list also included updating ports, updating ports documentation, updating the hotplug daemon and laying out some plans for automatic sysmerge for future upgrades</li>
<li>Foundation director Ken Westerback <a href="http://undeadly.org/cgi?action=article&sid=20150722105658&mode=flat" rel="nofollow">was also there</a>, getting some disk-related and laptop work done</li>
<li>He cleaned up and committed the 4k sector softraid code that he&#39;d been working on, as well as fixing some trackpad issues</li>
<li>Stefan Sperling, OpenBSD&#39;s token &quot;wireless guy,&quot; had <a href="http://undeadly.org/cgi?action=article&sid=20150722182236&mode=flat" rel="nofollow">a lot to say</a> about the hackathon and what he did there (and even sent in his write-up before he got home)</li>
<li>He taught tcpdump about some new things, including 802.11n metadata beacons (there&#39;s a lot more specific detail about this one in the report)</li>
<li>Bringing <em>a bag full of USB wireless devices</em> with him, he set out to get the unsupported ones working, as well as fix some driver bugs in the ones that already did work</li>
<li>One quote from Stefan&#39;s report that a lot of people seem to be talking about: &quot;Partway through the hackathon tedu proposed an old diff of his to make our base ls utility display multi-byte characters. This led to a long discussion about how to expand UTF-8 support in base. The conclusion so far indicates that single-byte locales (such as ISO-8859-1 and KOI-8) will be removed from the base OS after the 5.8 release is cut. This simplifies things because the whole system only has to care about a single character encoding. We&#39;ll then have a full release cycle to bring UTF-8 support to more base system utilities such as vi, ksh, and mg. To help with this plan, I started organizing a UTF-8-focused hackathon for some time later this year.&quot;</li>
<li>Jeremy Evans <a href="http://undeadly.org/cgi?action=article&sid=20150725180527&mode=flat" rel="nofollow">wrote in</a> to talk about updating lots of ports, moving the ruby ports up to the latest version and also creating perl and ruby wrappers for the new tame subsystem</li>
<li>While he&#39;s mainly a ports guy, he got to commit fixes to ports, the base system and even the kernel during the hackathon</li>
<li>Rafael Zalamena, who got commit access at the event, <a href="http://undeadly.org/cgi?action=article&sid=20150725183439&mode=flat" rel="nofollow">gives his very first report</a> on his networking-related hackathon activities</li>
<li>With Rafael&#39;s diffs and help from a couple other developers, OpenBSD now has support for <a href="https://en.wikipedia.org/wiki/Virtual_Private_LAN_Service" rel="nofollow">VPLS</a></li>
<li>Jonathan Gray <a href="http://undeadly.org/cgi?action=article&sid=20150728184743&mode=flat" rel="nofollow">got a lot done</a> in the area of graphics, working on OpenGL and Mesa, updating libdrm and even working with upstream projects to remove some GNU-specific code</li>
<li>As he&#39;s become somewhat known for, Jonathan was also busy running three things in the background: clang&#39;s fuzzer, cppcheck and AFL (looking for any potential crashes to fix)</li>
<li>Martin Pieuchot <a href="http://undeadly.org/cgi?action=article&sid=20150724183210&mode=flat" rel="nofollow">gave an write-up</a> on his experience: &quot;I always though that hackathons were the best place to write code, but what&#39;s even more important is that they are the best (well actually only) moment where one can discuss and coordinate projects with other developers IRL. And that&#39;s what I did.&quot;</li>
<li>He laid out some plans for the wireless stack, discussed future plans for PF, made some routing table improvements and did various other bits to the network stack</li>
<li>Unfortunately, most of Martin&#39;s secret plans seem to have been left intentionally vague, and will start to take form in the next release cycle</li>
<li>We&#39;re still eagerly awaiting a report from one of OpenBSD&#39;s <a href="https://twitter.com/phessler/status/623291827878137856" rel="nofollow">newest developers</a>, Alexandr Nedvedicky (the Oracle guy who&#39;s working on SMP PF and some other PF fixes)</li>
<li>OpenBSD 5.8&#39;s &quot;beta&quot; status was recently <strong>reverted</strong>, with the message &quot;<a href="https://www.marc.info/?l=openbsd-cvs&m=143766883514831&w=2" rel="nofollow">take that as a hint</a>,&quot; so that may mean more big changes are still to come...
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2015-04-2015-06.html" rel="nofollow">FreeBSD quarterly status report</a></h3>

<ul>
<li>FreeBSD has published their quarterly status report for the months of April to June, citing it to be the largest one so far</li>
<li>It&#39;s broken down into a number of sections: team reports, projects, kernel, architectures, userland programs, ports, documentation, Google Summer of Code and miscellaneous others</li>
<li>Starting off with the cluster admin, some machines were moved to the datacenter at New York Internet, email services are now more resilient to failure, the svn mirrors (now just &quot;svn.freebsd.org&quot;) are now using GeoGNS with official SSL certs and general redundancy was increased</li>
<li>In the release engineering space, ARM and ARM64 work continues to improve on the Cavium ThunderX, more focus is being put into cloud platforms and the 10.2-RELEASE cycle is reaching its final stages</li>
<li>The core team has been working on phabricator, the fancy review system, and is considering to integrate oauth support soon</li>
<li>Work also continues on bhyve, and more operating systems are slowly gaining support (including the much-rumored Windows Server 2012)</li>
<li>The report also covers recent developments in the Linux emulation layer, and encourages people using 11-CURRENT to help test out the 64bit support</li>
<li>Multipath TCP was also a hot topic, and there&#39;s a brief summary of the current status on that patch (it will be available publicly soon)</li>
<li>ZFSguru, a project we haven&#39;t talked about a lot, also gets some attention in the report - version 0.3 is set to be completed in early August</li>
<li>PCIe hotplug support is also mentioned, though it&#39;s still in the development stages (basic hot-swap functions are working though)</li>
<li>The official binary packages are now built more frequently than before with the help of additional hardware, so AMD64 and i386 users will have fresher ports without the need for compiling</li>
<li>Various other small updates on specific areas of ports (KDE, XFCE, X11...) are also included in the report</li>
<li>Documentation is a strong focus as always, a number of new documentation committers were added and some of the translations have been improved a lot</li>
<li>Many other topics were covered, including foundation updates, conference plans, pkgsrc support in pkgng, ZFS support for UEFI boot and much more
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2015/07/the-openssh-bug-that-wasnt.html" rel="nofollow">The OpenSSH bug that wasn&#39;t</a></h3>

<ul>
<li>There&#39;s been a lot of <a href="https://www.marc.info/?t=143766048000005&r=1&w=2" rel="nofollow">discussion</a> about <a href="https://kingcope.wordpress.com/2015/07/16/openssh-keyboard-interactive-authentication-brute-force-vulnerability-maxauthtries-bypass/" rel="nofollow">a supposed flaw</a> in OpenSSH, allowing attackers to substantially amplify the number of password attempts they can try per session (without leaving any abnormal log traces, even)</li>
<li>There&#39;s no actual <em>exploit</em> to speak of; this bug would only help someone get more bruteforce tries in with a <a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-July/034209.html" rel="nofollow">fewer number of connections</a></li>
<li>FreeBSD in its default configuration, with <a href="https://en.wikipedia.org/wiki/Pluggable_authentication_module" rel="nofollow">PAM</a> and ChallengeResponseAuthentication enabled, was the only one vulnerable to the problem - <a href="https://www.marc.info/?l=openbsd-misc&m=143767296016252&w=2" rel="nofollow">not upstream OpenSSH</a>, nor any of the other BSDs, and not even the majority of Linux distros</li>
<li>If you disable all forms of authentication except public keys, <a href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" rel="nofollow">like you&#39;re supposed to</a>, then this is also not a big deal for FreeBSD systems</li>
<li>Realistically speaking, it&#39;s more of <a href="https://www.marc.info/?l=openbsd-misc&m=143782167322500&w=2" rel="nofollow">a PAM bug</a> than anything else</li>
<li>OpenSSH <a href="https://anongit.mindrot.org/openssh.git/patch/?id=5b64f85bb811246c59ebab" rel="nofollow">added an additional check</a> for this type of setup that will be in 7.0, but simply changing your sshd_config is enough to mitigate the issue for now on FreeBSD (or you can <a href="https://lists.freebsd.org/pipermail/freebsd-security-notifications/2015-July/000248.html" rel="nofollow">run freebsd-update</a>)
***</li>
</ul>

<h2>Interview - Sebastian Wiedenroth - <a href="mailto:wiedi@netbsd.org" rel="nofollow">wiedi@netbsd.org</a> / <a href="https://twitter.com/wied0r" rel="nofollow">@wied0r</a></h2>

<p><a href="https://en.wikipedia.org/wiki/Pkgsrc" rel="nofollow">pkgsrc</a> and <a href="http://pkgsrc.org/pkgsrcCon/" rel="nofollow">pkgsrcCon</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://tribaal.io/this-now-served-by-openbsd.html" rel="nofollow">Now served by OpenBSD</a></h3>

<ul>
<li>We&#39;ve mentioned that you can also install OpenBSD on DO droplets, and this blog post is about someone who actually did it</li>
<li>The use case for the author was for a webserver, so he decided to try out the httpd in base</li>
<li>Configuration is ridiculously simple, and the config file in his example provides an HTTPS-only webserver, with plaintext requests automatically redirecting</li>
<li>TLS 1.2 by default, strong ciphers with LibreSSL and <a href="https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" rel="nofollow">HSTS</a> combined give you a pretty secure web server
***</li>
</ul>

<h3><a href="https://github.com/sean-/freebsd-laptops" rel="nofollow">FreeBSD laptop playbooks</a></h3>

<ul>
<li>A new project has started up on Github for configuring FreeBSD on various laptops, unsurprisingly named &quot;freebsd-laptops&quot;</li>
<li>It&#39;s based on ansible, and uses the playbook format for automatic set up and configuration</li>
<li>Right now, it&#39;s only working on a single Lenovo laptop, but the plan is to add instructions for many more models</li>
<li>Check the Github page for instructions on how to get started, and maybe get involved if you&#39;re running FreeBSD on a laptop
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_on_the_nvidia_jetson" rel="nofollow">NetBSD on the NVIDIA Jetson TK1</a></h3>

<ul>
<li>If you&#39;ve never heard of the <a href="https://developer.nvidia.com/jetson-tk1" rel="nofollow">Jetson TK1</a>, we can go ahead and spoil the secret here: NetBSD runs on it</li>
<li>As for the specs, it has a quad-core ARMv7 CPU at 2.3GHz, 2 gigs of RAM, gigabit ethernet, SATA, HDMI and mini-PCIE</li>
<li>This blog post shows which parts of the board are working with NetBSD -current (which seems to be almost everything)</li>
<li>You can even run X11 on it, pretty sweet
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-July/207911.html" rel="nofollow">DragonFly power mangement options</a></h3>

<ul>
<li>DragonFly developer Sepherosa, who we&#39;ve had on the show, has been doing some ACPI work over there</li>
<li>In this email, he presents some of DragonFly&#39;s different power management options: ACPI P-states, C-states, mwait C-states and some Intel-specific bits as well</li>
<li>He also did some testing with each of them and gave his findings about power saving</li>
<li>If you&#39;ve been thinking about running DragonFly on a laptop, this would be a good one to read
***</li>
</ul>

<h3><a href="https://www.quernus.co.uk/2015/07/27/openbsd-as-freebsd-router/" rel="nofollow">OpenBSD router under FreeBSD bhyve</a></h3>

<ul>
<li>If one BSD just isn&#39;t enough for you, and you&#39;ve only got one machine, why not run two at once</li>
<li>This article talks about taking a FreeBSD server running bhyve and making a virtualized OpenBSD router with it</li>
<li>If you&#39;ve been considering switching over your router at home or the office, doing it in a virtual machine is a good way to test the waters before committing to real hardware</li>
<li>The author also includes a little bit of history on how he got into both operating systems</li>
<li>There are lots of mixed opinions about virtualizing core network components, so we&#39;ll leave it up to you to do your research</li>
<li>Of course, the next logical step is to put that bhyve host under Xen on NetBSD...
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2yPVV5Wyp" rel="nofollow">Kevin writes in</a></li>
<li><a href="http://slexy.org/view/s21zcz9rut" rel="nofollow">Logan writes in</a></li>
<li><a href="http://slexy.org/view/s21CRmiPwK" rel="nofollow">Peter writes in</a></li>
<li><a href="http://slexy.org/view/s211zfIXff" rel="nofollow">Randy writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>99: BSD Gnow</title>
  <link>https://www.bsdnow.tv/99</link>
  <guid isPermaLink="false">c234f2ea-9f17-4c25-bd28-db41586b32de</guid>
  <pubDate>Wed, 22 Jul 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c234f2ea-9f17-4c25-bd28-db41586b32de.mp3" length="57071380" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week we'll be talking with Ryan Lortie and Baptiste Daroussin about GNOME on BSD. Upstream development is finally treating the BSDs as a first class citizen, so we'll hear about how the recent porting efforts have been since.</itunes:subtitle>
  <itunes:duration>1:19:15</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week we'll be talking with Ryan Lortie and Baptiste Daroussin about GNOME on BSD. Upstream development is finally treating the BSDs as a first class citizen, so we'll hear about how the recent porting efforts have been since.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenBSD presents tame (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143725996614627&amp;amp;w=2)
Theo de Raadt sent out an email detailing OpenBSD's new "tame" subsystem, written by Nicholas Marriott and himself, for restricting what processes can and can't do
When using tame, programs will switch to a "restricted-service operating mode," limiting them to only the things they actually need to do
As for the background: "Generally there are two models of operation. The first model requires a major rewrite of application software for effective use (ie. capsicum). The other model in common use lacks granularity, and allows or denies an operation throughout the entire lifetime of a process. As a result, they lack differentiation between program 'initialization' versus 'main servicing loop.' systrace had the same problem. My observation is that programs need a large variety of calls during initialization, but few in their main loops."
Some initial categories of operation include: computation, memory management, read-write operations on file descriptors, opening of files and, of course, networking
Restrictions can also be stacked further into the lifespan of the process, but removed abilities can never be regained (obviously)
Anything that tries to access resources outside of its in-place limits gets terminated with a SIGKILL or, optionally, a SIGABRT (which can produce useful core dumps for investigation)
Also included are 29 examples of userland programs that get additional protection with very minimal changes to the source - only 2 or 3 lines needing changed in the case of binaries like cat, ps, dmesg, etc.
This is an initial work-in-progress version of tame, so there may be more improvements or further (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143740834710502&amp;amp;w=2) control (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143741052411159&amp;amp;w=2) options added before it hits a release (very specific access policies can sometimes backfire (https://forums.grsecurity.net/viewtopic.php?f=7&amp;amp;t=2522), however)
The man page, also included in the mail, provides some specifics about how to integrate tame properly into your code (which, by design, was made very easy to do - making it simple means third party programs are more likely to actually use it)
Kernel bits are in the tree now (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=143727335416513&amp;amp;w=2), with userland changes starting to trickle in too
Combined with a myriad of memory protections (http://www.bsdnow.tv/episodes/2015_05_13-exclusive_disjunction), tight privilege separation and (above all else (https://en.wikipedia.org/wiki/OpenBSD_security_features)) good coding practices, tame should further harden the OpenBSD security fortress
Further discussion (https://news.ycombinator.com/item?id=9928221) can (https://www.reddit.com/r/programming/comments/3dsr0t) be (http://undeadly.org/cgi?action=article&amp;amp;sid=20150719000800&amp;amp;mode=flat) found (https://news.ycombinator.com/item?id=9909429) in (https://www.reddit.com/r/linux/comments/3ds66o) the (https://lobste.rs/s/tbbtfs) usual (https://www.reddit.com/r/openbsd/comments/3ds64c) places (https://www.reddit.com/r/BSD/comments/3ds681) you'd expect
***
Using Docker on FreeBSD (https://wiki.freebsd.org/Docker)
With the experimental Docker port landing in FreeBSD a few weeks ago, some initial docs are starting to show up
This docker is "the real thing," and isn’t using a virtual machine as the backend - as such, it has some limitations
The FreeBSD wiki has a page detailing how it works in general, as well as more info about those limitations
When running Linux containers, it will only work as well as the Linux ABI compat layer for your version of FreeBSD (11.0, or -CURRENT when we're recording this, is where all the action is for 64bit support)
For users on 10.X, there's also a FreeBSD container available, which allows you to use Docker as a fancy jail manager (it uses the jail subsystem internally)
Give it a try, let us know how you find it to be compared to other solutions
***
OpenBSD imports doas, removes sudo (http://www.tedunangst.com/flak/post/doas)
OpenBSD has included the ubiquitous "sudo" utility for many years now, and the current maintainer of sudo (Todd C. Miller) is also a long-time OpenBSD dev
The version included in the base system was much smaller than the latest current version used elsewhere, but was based on older code
Some internal discussion lead to the decision that sudo should probably be moved to ports now, where it can be updated easily and offer all the extra features that were missing in base (LDAP and whatnot)
Ted Unangst conjured up with a rewritten utility to replace it in the base system, dubbed "do as," with the aim of being more simple and compact
There were concerns that sudo was too big and too complicated, and a quick 'n' dirty check reveals that doas is around 350 lines of code, while sudo is around 10,000 - which would you rather have as a setuid root binary?
After the initial import, a number of developers began reviewing and improving various bits here and there
You can check out the code (http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/doas/) now if you're interested
Command usage (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/doas.1) and config syntax (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/doas.conf.5) seem pretty straightforward
More discussion (https://news.ycombinator.com/item?id=9914693) on HN
***
What would you like to see in FreeBSD (https://www.reddit.com/r/freebsd/comments/3d80vt/what_would_you_like_to_see_in_freebsd/)
Adrian Chadd started a reddit thread about areas in which FreeBSD could be improved, asking the community what they'd like to see
There are over 200 comments that span a wide range of topics, so we'll just cover a few of the more popular requests - check the very long thread if you're interested in more
The top comment says things don't "just work," citing failover link aggregation of LACP laggs, PPPoE issues, disorganized jail configuration options, unclear CARP configuration and userland dtrace being unstable
Another common one was that there are three firewalls in the base system, with ipfilter and pf being kinda dead now - should they be removed, and more focus put into ipfw?
Video drivers also came up frequently, with users hoping for better OpenGL support and support for newer graphics cards from Intel and AMD - similar comments were made about wireless chipsets as well
Some other replies included more clarity with pkgng output, paying more attention to security issues, updating PF to match the one in OpenBSD, improved laptop support, a graphical installer, LibreSSL in base, more focus on embedded MIPS devices, binary packages with different config options, steam support and lots more
At least one user suggested better "marketing" for FreeBSD, with more advocacy and (hopefully) more business adoption
That one really applies to all the BSDs, and regular users (that's you listening to this) can help make it happen for whichever ones you use right now
Maybe Adrian can singlehandedly do all the work and make all the users happy
***
Interview - Ryan Lortie &amp;amp; Baptiste Daroussin
Porting the latest GNOME code to FreeBSD
News Roundup
Introducing resflash (http://stable.rcesoftware.com/resflash/)
If you haven't heard of resflash before, it's "a tool for building OpenBSD images for embedded and cloud environments in a programmatic, reproducible way"
One of the major benefits to images like this is the read-only filesystem, so there's no possibility of filesystem corruption if power is lost
There's an optional read-write partition as well, used for any persistent changes you want to make
You can check out the source code on Github (https://github.com/bconway/resflash) or read the main site for more info
***
Jails with iocage (http://pid1.com/posts/post10.html)
There are a growing number of FreeBSD jail management utilities: ezjail, cbsd, warden and a few others
After looking at all the different choices, the author of this blog post eventually settled on iocage (https://github.com/iocage/iocage) for the job
The post walks you through the basic configuration and usage of iocage for creating managing jails
If you've been unhappy with ezjail or some of the others, iocage might be worth giving a try instead (it also has really good ZFS integration)
***
DragonFly GPU improvements (http://lists.dragonflybsd.org/pipermail/users/2015-July/207892.html)
DragonFlyBSD continues to up their graphics game, this time with Intel's ValleyView series of CPUs
These GPUs are primarily used in the newer Atom CPUs and offer much better performance than the older ones
A git branch was created to hold the fixes for now while the last remaining bugs get fixed
Fully-accelerated Broadwell support and an update to newer DRM code are also available in the git branch, and will be merged to the main tree after some testing
***
Branchless development (http://www.tedunangst.com/flak/post/branchless-development)
Ted Unangst has a new blog post up, talking about software branches and the effects of having (or not having) them
He covers integrating and merging code, and the versioning problems that can happen with multiple people contributing at once
"For an open source project, branching is counter intuitively antisocial. For instance, I usually tell people I’m running OpenBSD, but that’s kind of a lie. I’m actually running teduBSD, which is like OpenBSD but has some changes to make it even better. Of course, you can’t have teduBSD because I’m selfish. I’m also lazy, and only inclined to make my changes work for me, not everyone else."
The solution, according to him, is bringing all the code the developers are using closer together
One big benefit is that WIP code gets tested much faster (and bugs get fixed early on)
***
Feedback/Questions
Matthew writes in (http://slexy.org/view/s21yQtBCCK)
Chris writes in (http://slexy.org/view/s21oFA80kY)
Anonymous writes in (http://slexy.org/view/s2JYvTlJlm)
Bill writes in (http://slexy.org/view/s21LXvk53z)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, gnome, gnome shell, gnome3, puns i will regret forever, doas, sudo, resflash, flashrd, nanobsd, tame, capsicum, iocage, ezjail, docker</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week we&#39;ll be talking with Ryan Lortie and Baptiste Daroussin about GNOME on BSD. Upstream development is finally treating the BSDs as a first class citizen, so we&#39;ll hear about how the recent porting efforts have been since.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=143725996614627&w=2" rel="nofollow">OpenBSD presents tame</a></h3>

<ul>
<li>Theo de Raadt sent out an email detailing OpenBSD&#39;s new &quot;tame&quot; subsystem, written by Nicholas Marriott and himself, for restricting what processes can and can&#39;t do</li>
<li>When using tame, programs will switch to a &quot;restricted-service operating mode,&quot; limiting them to only the things they actually need to do</li>
<li>As for the background: &quot;Generally there are two models of operation. The first model requires a major rewrite of application software for effective use (ie. capsicum). The other model in common use lacks granularity, and allows or denies an operation throughout the entire lifetime of a process. As a result, they lack differentiation between program &#39;initialization&#39; versus &#39;main servicing loop.&#39; systrace had the same problem. My observation is that programs need a large variety of calls during initialization, but few in their main loops.&quot;</li>
<li>Some initial categories of operation include: computation, memory management, read-write operations on file descriptors, opening of files and, of course, networking</li>
<li>Restrictions can also be stacked further into the lifespan of the process, but removed abilities can never be regained (obviously)</li>
<li>Anything that tries to access resources outside of its in-place limits gets terminated with a SIGKILL or, optionally, a SIGABRT (which can produce useful core dumps for investigation)</li>
<li>Also included are 29 examples of userland programs that get additional protection with very minimal changes to the source - only 2 or 3 lines needing changed in the case of binaries like cat, ps, dmesg, etc.</li>
<li>This is an initial work-in-progress version of tame, so there may be more improvements or <a href="https://www.marc.info/?l=openbsd-tech&m=143740834710502&w=2" rel="nofollow">further</a> <a href="https://www.marc.info/?l=openbsd-tech&m=143741052411159&w=2" rel="nofollow">control</a> options added before it hits a release (very specific access policies can <a href="https://forums.grsecurity.net/viewtopic.php?f=7&t=2522" rel="nofollow">sometimes backfire</a>, however)</li>
<li>The man page, also included in the mail, provides some specifics about how to integrate tame properly into your code (which, by design, was made very easy to do - making it simple means third party programs are more likely to <em>actually use it</em>)</li>
<li>Kernel bits are <a href="https://www.marc.info/?l=openbsd-cvs&m=143727335416513&w=2" rel="nofollow">in the tree now</a>, with userland changes starting to trickle in too</li>
<li>Combined with a <a href="http://www.bsdnow.tv/episodes/2015_05_13-exclusive_disjunction" rel="nofollow">myriad of memory protections</a>, tight privilege separation and (above <a href="https://en.wikipedia.org/wiki/OpenBSD_security_features" rel="nofollow">all else</a>) good coding practices, tame should further harden the OpenBSD security fortress</li>
<li>Further <a href="https://news.ycombinator.com/item?id=9928221" rel="nofollow">discussion</a> <a href="https://www.reddit.com/r/programming/comments/3dsr0t" rel="nofollow">can</a> <a href="http://undeadly.org/cgi?action=article&sid=20150719000800&mode=flat" rel="nofollow">be</a> <a href="https://news.ycombinator.com/item?id=9909429" rel="nofollow">found</a> <a href="https://www.reddit.com/r/linux/comments/3ds66o" rel="nofollow">in</a> <a href="https://lobste.rs/s/tbbtfs" rel="nofollow">the</a> <a href="https://www.reddit.com/r/openbsd/comments/3ds64c" rel="nofollow">usual</a> <a href="https://www.reddit.com/r/BSD/comments/3ds681" rel="nofollow">places</a> you&#39;d expect
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/Docker" rel="nofollow">Using Docker on FreeBSD</a></h3>

<ul>
<li>With the experimental Docker port landing in FreeBSD a few weeks ago, some initial docs are starting to show up</li>
<li>This docker is &quot;the real thing,&quot; and isn’t using a virtual machine as the backend - as such, it has some limitations</li>
<li>The FreeBSD wiki has a page detailing how it works in general, as well as more info about those limitations</li>
<li>When running Linux containers, it will only work as well as the Linux ABI compat layer for your version of FreeBSD (11.0, or -CURRENT when we&#39;re recording this, is where all the action is for 64bit support)</li>
<li>For users on 10.X, there&#39;s also a FreeBSD container available, which allows you to use Docker as a fancy jail manager (it uses the jail subsystem internally)</li>
<li>Give it a try, let us know how you find it to be compared to other solutions
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/doas" rel="nofollow">OpenBSD imports doas, removes sudo</a></h3>

<ul>
<li>OpenBSD has included the ubiquitous &quot;sudo&quot; utility for many years now, and the current maintainer of sudo (Todd C. Miller) is also a long-time OpenBSD dev</li>
<li>The version included in the base system was much smaller than the latest current version used elsewhere, but was based on older code</li>
<li>Some internal discussion lead to the decision that sudo should probably be moved to ports now, where it can be updated easily and offer all the extra features that were missing in base (LDAP and whatnot)</li>
<li>Ted Unangst conjured up with a rewritten utility to replace it in the base system, dubbed &quot;do as,&quot; with the aim of being more simple and compact</li>
<li>There were concerns that sudo was too big and too complicated, and a quick &#39;n&#39; dirty check reveals that doas is around 350 lines of code, while sudo is around 10,000 - which would you rather have as a setuid root binary?</li>
<li>After the initial import, a number of developers began reviewing and improving various bits here and there</li>
<li>You can <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/doas/" rel="nofollow">check out the code</a> now if you&#39;re interested</li>
<li><a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/doas.1" rel="nofollow">Command usage</a> and <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/doas.conf.5" rel="nofollow">config syntax</a> seem pretty straightforward</li>
<li>More <a href="https://news.ycombinator.com/item?id=9914693" rel="nofollow">discussion</a> on HN
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/freebsd/comments/3d80vt/what_would_you_like_to_see_in_freebsd/" rel="nofollow">What would you like to see in FreeBSD</a></h3>

<ul>
<li>Adrian Chadd started a reddit thread about areas in which FreeBSD could be improved, asking the community what they&#39;d like to see</li>
<li>There are over <strong>200</strong> comments that span a wide range of topics, so we&#39;ll just cover a few of the more popular requests - check the very long thread if you&#39;re interested in more</li>
<li>The top comment says things don&#39;t &quot;just work,&quot; citing failover link aggregation of LACP laggs, PPPoE issues, disorganized jail configuration options, unclear CARP configuration and userland dtrace being unstable</li>
<li>Another common one was that there are <em>three</em> firewalls in the base system, with ipfilter and pf being kinda dead now - should they be removed, and more focus put into ipfw?</li>
<li>Video drivers also came up frequently, with users hoping for better OpenGL support and support for newer graphics cards from Intel and AMD - similar comments were made about wireless chipsets as well</li>
<li>Some other replies included more clarity with pkgng output, paying more attention to security issues, updating PF to match the one in OpenBSD, improved laptop support, a graphical installer, LibreSSL in base, more focus on embedded MIPS devices, binary packages with different config options, steam support and lots more</li>
<li>At least one user suggested better &quot;marketing&quot; for FreeBSD, with more advocacy and (hopefully) more business adoption</li>
<li>That one really applies to all the BSDs, and regular users (that&#39;s you listening to this) can help make it happen for whichever ones you use <em>right now</em></li>
<li>Maybe Adrian can singlehandedly do all the work and make all the users happy
***</li>
</ul>

<h2>Interview - Ryan Lortie &amp; Baptiste Daroussin</h2>

<p>Porting the latest GNOME code to FreeBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://stable.rcesoftware.com/resflash/" rel="nofollow">Introducing resflash</a></h3>

<ul>
<li>If you haven&#39;t heard of resflash before, it&#39;s &quot;a tool for building OpenBSD images for embedded and cloud environments in a programmatic, reproducible way&quot;</li>
<li>One of the major benefits to images like this is the read-only filesystem, so there&#39;s no possibility of filesystem corruption if power is lost</li>
<li>There&#39;s an optional read-write partition as well, used for any persistent changes you want to make</li>
<li>You can check out the source code <a href="https://github.com/bconway/resflash" rel="nofollow">on Github</a> or read the main site for more info
***</li>
</ul>

<h3><a href="http://pid1.com/posts/post10.html" rel="nofollow">Jails with iocage</a></h3>

<ul>
<li>There are a growing number of FreeBSD jail management utilities: ezjail, cbsd, warden and a few others</li>
<li>After looking at all the different choices, the author of this blog post eventually settled on <a href="https://github.com/iocage/iocage" rel="nofollow">iocage</a> for the job</li>
<li>The post walks you through the basic configuration and usage of iocage for creating managing jails</li>
<li>If you&#39;ve been unhappy with ezjail or some of the others, iocage might be worth giving a try instead (it also has really good ZFS integration)
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-July/207892.html" rel="nofollow">DragonFly GPU improvements</a></h3>

<ul>
<li>DragonFlyBSD continues to up their graphics game, this time with Intel&#39;s ValleyView series of CPUs</li>
<li>These GPUs are primarily used in the newer Atom CPUs and offer much better performance than the older ones</li>
<li>A git branch was created to hold the fixes for now while the last remaining bugs get fixed</li>
<li>Fully-accelerated Broadwell support and an update to newer DRM code are also available in the git branch, and will be merged to the main tree after some testing
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/branchless-development" rel="nofollow">Branchless development</a></h3>

<ul>
<li>Ted Unangst has a new blog post up, talking about software branches and the effects of having (or not having) them</li>
<li>He covers integrating and merging code, and the versioning problems that can happen with multiple people contributing at once</li>
<li>&quot;For an open source project, branching is counter intuitively antisocial. For instance, I usually tell people I’m running OpenBSD, but that’s kind of a lie. I’m actually running teduBSD, which is like OpenBSD but has some changes to make it even better. Of course, you can’t have teduBSD because I’m selfish. I’m also lazy, and only inclined to make my changes work for me, not everyone else.&quot;</li>
<li>The solution, according to him, is bringing all the code the developers are using closer together</li>
<li>One big benefit is that WIP code gets tested much faster (and bugs get fixed early on)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21yQtBCCK" rel="nofollow">Matthew writes in</a></li>
<li><a href="http://slexy.org/view/s21oFA80kY" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s2JYvTlJlm" rel="nofollow">Anonymous writes in</a></li>
<li><a href="http://slexy.org/view/s21LXvk53z" rel="nofollow">Bill writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week we&#39;ll be talking with Ryan Lortie and Baptiste Daroussin about GNOME on BSD. Upstream development is finally treating the BSDs as a first class citizen, so we&#39;ll hear about how the recent porting efforts have been since.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=143725996614627&w=2" rel="nofollow">OpenBSD presents tame</a></h3>

<ul>
<li>Theo de Raadt sent out an email detailing OpenBSD&#39;s new &quot;tame&quot; subsystem, written by Nicholas Marriott and himself, for restricting what processes can and can&#39;t do</li>
<li>When using tame, programs will switch to a &quot;restricted-service operating mode,&quot; limiting them to only the things they actually need to do</li>
<li>As for the background: &quot;Generally there are two models of operation. The first model requires a major rewrite of application software for effective use (ie. capsicum). The other model in common use lacks granularity, and allows or denies an operation throughout the entire lifetime of a process. As a result, they lack differentiation between program &#39;initialization&#39; versus &#39;main servicing loop.&#39; systrace had the same problem. My observation is that programs need a large variety of calls during initialization, but few in their main loops.&quot;</li>
<li>Some initial categories of operation include: computation, memory management, read-write operations on file descriptors, opening of files and, of course, networking</li>
<li>Restrictions can also be stacked further into the lifespan of the process, but removed abilities can never be regained (obviously)</li>
<li>Anything that tries to access resources outside of its in-place limits gets terminated with a SIGKILL or, optionally, a SIGABRT (which can produce useful core dumps for investigation)</li>
<li>Also included are 29 examples of userland programs that get additional protection with very minimal changes to the source - only 2 or 3 lines needing changed in the case of binaries like cat, ps, dmesg, etc.</li>
<li>This is an initial work-in-progress version of tame, so there may be more improvements or <a href="https://www.marc.info/?l=openbsd-tech&m=143740834710502&w=2" rel="nofollow">further</a> <a href="https://www.marc.info/?l=openbsd-tech&m=143741052411159&w=2" rel="nofollow">control</a> options added before it hits a release (very specific access policies can <a href="https://forums.grsecurity.net/viewtopic.php?f=7&t=2522" rel="nofollow">sometimes backfire</a>, however)</li>
<li>The man page, also included in the mail, provides some specifics about how to integrate tame properly into your code (which, by design, was made very easy to do - making it simple means third party programs are more likely to <em>actually use it</em>)</li>
<li>Kernel bits are <a href="https://www.marc.info/?l=openbsd-cvs&m=143727335416513&w=2" rel="nofollow">in the tree now</a>, with userland changes starting to trickle in too</li>
<li>Combined with a <a href="http://www.bsdnow.tv/episodes/2015_05_13-exclusive_disjunction" rel="nofollow">myriad of memory protections</a>, tight privilege separation and (above <a href="https://en.wikipedia.org/wiki/OpenBSD_security_features" rel="nofollow">all else</a>) good coding practices, tame should further harden the OpenBSD security fortress</li>
<li>Further <a href="https://news.ycombinator.com/item?id=9928221" rel="nofollow">discussion</a> <a href="https://www.reddit.com/r/programming/comments/3dsr0t" rel="nofollow">can</a> <a href="http://undeadly.org/cgi?action=article&sid=20150719000800&mode=flat" rel="nofollow">be</a> <a href="https://news.ycombinator.com/item?id=9909429" rel="nofollow">found</a> <a href="https://www.reddit.com/r/linux/comments/3ds66o" rel="nofollow">in</a> <a href="https://lobste.rs/s/tbbtfs" rel="nofollow">the</a> <a href="https://www.reddit.com/r/openbsd/comments/3ds64c" rel="nofollow">usual</a> <a href="https://www.reddit.com/r/BSD/comments/3ds681" rel="nofollow">places</a> you&#39;d expect
***</li>
</ul>

<h3><a href="https://wiki.freebsd.org/Docker" rel="nofollow">Using Docker on FreeBSD</a></h3>

<ul>
<li>With the experimental Docker port landing in FreeBSD a few weeks ago, some initial docs are starting to show up</li>
<li>This docker is &quot;the real thing,&quot; and isn’t using a virtual machine as the backend - as such, it has some limitations</li>
<li>The FreeBSD wiki has a page detailing how it works in general, as well as more info about those limitations</li>
<li>When running Linux containers, it will only work as well as the Linux ABI compat layer for your version of FreeBSD (11.0, or -CURRENT when we&#39;re recording this, is where all the action is for 64bit support)</li>
<li>For users on 10.X, there&#39;s also a FreeBSD container available, which allows you to use Docker as a fancy jail manager (it uses the jail subsystem internally)</li>
<li>Give it a try, let us know how you find it to be compared to other solutions
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/doas" rel="nofollow">OpenBSD imports doas, removes sudo</a></h3>

<ul>
<li>OpenBSD has included the ubiquitous &quot;sudo&quot; utility for many years now, and the current maintainer of sudo (Todd C. Miller) is also a long-time OpenBSD dev</li>
<li>The version included in the base system was much smaller than the latest current version used elsewhere, but was based on older code</li>
<li>Some internal discussion lead to the decision that sudo should probably be moved to ports now, where it can be updated easily and offer all the extra features that were missing in base (LDAP and whatnot)</li>
<li>Ted Unangst conjured up with a rewritten utility to replace it in the base system, dubbed &quot;do as,&quot; with the aim of being more simple and compact</li>
<li>There were concerns that sudo was too big and too complicated, and a quick &#39;n&#39; dirty check reveals that doas is around 350 lines of code, while sudo is around 10,000 - which would you rather have as a setuid root binary?</li>
<li>After the initial import, a number of developers began reviewing and improving various bits here and there</li>
<li>You can <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/doas/" rel="nofollow">check out the code</a> now if you&#39;re interested</li>
<li><a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/doas.1" rel="nofollow">Command usage</a> and <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/doas.conf.5" rel="nofollow">config syntax</a> seem pretty straightforward</li>
<li>More <a href="https://news.ycombinator.com/item?id=9914693" rel="nofollow">discussion</a> on HN
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/freebsd/comments/3d80vt/what_would_you_like_to_see_in_freebsd/" rel="nofollow">What would you like to see in FreeBSD</a></h3>

<ul>
<li>Adrian Chadd started a reddit thread about areas in which FreeBSD could be improved, asking the community what they&#39;d like to see</li>
<li>There are over <strong>200</strong> comments that span a wide range of topics, so we&#39;ll just cover a few of the more popular requests - check the very long thread if you&#39;re interested in more</li>
<li>The top comment says things don&#39;t &quot;just work,&quot; citing failover link aggregation of LACP laggs, PPPoE issues, disorganized jail configuration options, unclear CARP configuration and userland dtrace being unstable</li>
<li>Another common one was that there are <em>three</em> firewalls in the base system, with ipfilter and pf being kinda dead now - should they be removed, and more focus put into ipfw?</li>
<li>Video drivers also came up frequently, with users hoping for better OpenGL support and support for newer graphics cards from Intel and AMD - similar comments were made about wireless chipsets as well</li>
<li>Some other replies included more clarity with pkgng output, paying more attention to security issues, updating PF to match the one in OpenBSD, improved laptop support, a graphical installer, LibreSSL in base, more focus on embedded MIPS devices, binary packages with different config options, steam support and lots more</li>
<li>At least one user suggested better &quot;marketing&quot; for FreeBSD, with more advocacy and (hopefully) more business adoption</li>
<li>That one really applies to all the BSDs, and regular users (that&#39;s you listening to this) can help make it happen for whichever ones you use <em>right now</em></li>
<li>Maybe Adrian can singlehandedly do all the work and make all the users happy
***</li>
</ul>

<h2>Interview - Ryan Lortie &amp; Baptiste Daroussin</h2>

<p>Porting the latest GNOME code to FreeBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://stable.rcesoftware.com/resflash/" rel="nofollow">Introducing resflash</a></h3>

<ul>
<li>If you haven&#39;t heard of resflash before, it&#39;s &quot;a tool for building OpenBSD images for embedded and cloud environments in a programmatic, reproducible way&quot;</li>
<li>One of the major benefits to images like this is the read-only filesystem, so there&#39;s no possibility of filesystem corruption if power is lost</li>
<li>There&#39;s an optional read-write partition as well, used for any persistent changes you want to make</li>
<li>You can check out the source code <a href="https://github.com/bconway/resflash" rel="nofollow">on Github</a> or read the main site for more info
***</li>
</ul>

<h3><a href="http://pid1.com/posts/post10.html" rel="nofollow">Jails with iocage</a></h3>

<ul>
<li>There are a growing number of FreeBSD jail management utilities: ezjail, cbsd, warden and a few others</li>
<li>After looking at all the different choices, the author of this blog post eventually settled on <a href="https://github.com/iocage/iocage" rel="nofollow">iocage</a> for the job</li>
<li>The post walks you through the basic configuration and usage of iocage for creating managing jails</li>
<li>If you&#39;ve been unhappy with ezjail or some of the others, iocage might be worth giving a try instead (it also has really good ZFS integration)
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-July/207892.html" rel="nofollow">DragonFly GPU improvements</a></h3>

<ul>
<li>DragonFlyBSD continues to up their graphics game, this time with Intel&#39;s ValleyView series of CPUs</li>
<li>These GPUs are primarily used in the newer Atom CPUs and offer much better performance than the older ones</li>
<li>A git branch was created to hold the fixes for now while the last remaining bugs get fixed</li>
<li>Fully-accelerated Broadwell support and an update to newer DRM code are also available in the git branch, and will be merged to the main tree after some testing
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/branchless-development" rel="nofollow">Branchless development</a></h3>

<ul>
<li>Ted Unangst has a new blog post up, talking about software branches and the effects of having (or not having) them</li>
<li>He covers integrating and merging code, and the versioning problems that can happen with multiple people contributing at once</li>
<li>&quot;For an open source project, branching is counter intuitively antisocial. For instance, I usually tell people I’m running OpenBSD, but that’s kind of a lie. I’m actually running teduBSD, which is like OpenBSD but has some changes to make it even better. Of course, you can’t have teduBSD because I’m selfish. I’m also lazy, and only inclined to make my changes work for me, not everyone else.&quot;</li>
<li>The solution, according to him, is bringing all the code the developers are using closer together</li>
<li>One big benefit is that WIP code gets tested much faster (and bugs get fixed early on)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21yQtBCCK" rel="nofollow">Matthew writes in</a></li>
<li><a href="http://slexy.org/view/s21oFA80kY" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s2JYvTlJlm" rel="nofollow">Anonymous writes in</a></li>
<li><a href="http://slexy.org/view/s21LXvk53z" rel="nofollow">Bill writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>98: Our Code is Your Code</title>
  <link>https://www.bsdnow.tv/98</link>
  <guid isPermaLink="false">ed9812b6-0041-42fd-804b-8cf3e5bba0fc</guid>
  <pubDate>Wed, 15 Jul 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ed9812b6-0041-42fd-804b-8cf3e5bba0fc.mp3" length="53150260" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this time on the show, we'll be talking with the CTO of Xinuos, David Meyer, about their adoption of FreeBSD. We also discuss the BSD license model for businesses and the benefits of contributing changes back.</itunes:subtitle>
  <itunes:duration>1:13:49</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this time on the show, we'll be talking with the CTO of Xinuos, David Meyer, about their adoption of FreeBSD. We also discuss the BSD license model for businesses and the benefits of contributing changes back.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Enabling FreeBSD on AArch64 (https://community.arm.com/groups/processors/blog/2015/07/07/enabling-freebsd-on-aarch64)
One of the things the FreeBSD foundation has been dumping money into lately is ARM64 support, but we haven't heard too much about it - this article should change that
Since it's on a mainstream ARM site, the article begins with a bit of FreeBSD history, leading up to the current work on ARM64
There's also a summary of some of the ARM work done at this year's BSDCan, including details about running it on the Cavium ThunderX platform (which has 48 cores)
As of just a couple months ago, dtrace is even working on this new architecture
Come 11.0-RELEASE, the plan is for ARM64 to get the same "tier 1" treatment as X86, which would imply binary updates for base and ports - something Raspberry Pi users often complain about not having
***
OpenBSD's tcpdump detailed (https://www.youtube.com/watch?v=8kR-tW1kyDc#t=8)
Most people are probably familiar with tcpdump (https://en.wikipedia.org/wiki/Tcpdump), a very useful packet sniffing and capturing utility that's included in all the main BSD base systems
This video guide is specifically about the version in OpenBSD, which has gone through some major changes (it's pretty much a fork with no version number anymore)
Unlike on the other platforms, OpenBSD's tcpdump will always run in a chroot as an unprivileged user - this has saved it from a number of high-profile exploits
It also has support for the "pf.os" system, allowing you to filter out operating system fingerprints in the packet captures
There's also PF (and pflog) integration, letting you see which line in your ruleset triggered a specific match
Being able to run tcpdump directly on your router (http://www.bsdnow.tv/tutorials/openbsd-router) is pretty awesome for troubleshooting
***
More FreeBSD foundation at BSDCan (http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-kamil-czekirda.html)
The FreeBSD foundation has another round of trip reports from this year's BSDCan
First up is Kamil Czekirda, who gives a good summary of some of the devsummit, FreeBSD-related presentations, some tutorials, getting freebsd-update bugs fixed and of course eating cake
A second post (http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-christian.html) from Christian Brueffer, who cleverly planned ahead to avoid jetlag, details how he got some things done during the FreeBSD devsummit
Their third report (http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-warren-block.html) is from our buddy Warren Block, who (unsurprisingly) worked on a lot of documentation-related things, including getting more people involved with writing them
In true doc team style, his report is the most well-written of the bunch, including lots of links and a clear separation of topics (doc lounge, contributing to the wiki, presentations...)
Finally, the fourth one (http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-shonali.html) comes to us from Shonali Balakrishna, who also gives an outline of some of the talks
"Not only does a BSD conference have way too many very smart people in one room, but also some of the nicest."
***
DragonFly on the Chromebook C720 (https://www.dragonflydigest.com/2015/07/08/16391.html)
If you've got one of the Chromebook laptops and weren't happy with the included OS, DragonFlyBSD might be worth a go
This article is a "mini-report" on how DragonFly functions on the device as a desktop, and 
While the 2GB of RAM proved to be a bit limiting, most of the hardware is well-supported
DragonFly's wiki has a full guide (http://www.dragonflybsd.org/docs/newhandbook/ConfigChromebook/) on getting set up on one of these devices as well
***
Interview - David Meyer - info@xinuos.com (mailto:info@xinuos.com) / @xinuos (https://twitter.com/xinuos)
Xinuos, BSD license model vs. others, community interaction
News Roundup
Introducing LiteBSD (https://github.com/sergev/LiteBSD)
We definitely don't talk about 4.4BSD a lot on the show
LiteBSD is "a variant of [the] 4.4BSD operating system adapted for microcontrollers"
If you've got really, really old hardware (or are working in the embedded space) then this might be an interesting hobby project to look info
***
HardenedBSD announces ASLR completion (http://hardenedbsd.org/article/shawn-webb/2015-07-06/announcing-aslr-completion)
HardenedBSD, now officially a full-on fork of FreeBSD (http://hardenedbsd.org/content/about), has declared their ASLR patchset to be complete
The latest and last addition to the work was VDSO (Virtual Dynamic Shared Object) randomization, which is now configurable with a sysctl
This post gives a summary of the six main features they've added since the beginning (http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover)
Only a few small things are left to do - man page cleanups, possibly shared object load order improvements
***
Unlock the reaper (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143636371501474&amp;amp;w=2)
In the ongoing quest to make more of OpenBSD SMP-friendly, a new patch was posted that unlocks the reaper in the kernel
When there's a zombie process (https://en.wikipedia.org/wiki/Zombie_process) causing a resource leak, it's the reaper's job (https://en.wikipedia.org/wiki/Wait_%28system_call%29) to deallocate their resources (and yes we're still talking about computers, not horror movies)
Initial testing has yielded positive (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143642748717836&amp;amp;w=2) results (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143639356810690&amp;amp;w=2) and no regressions (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143638955809675&amp;amp;w=2)
They're looking for testers, so you can install a -current snapshot and get it automatically
An updated version of the patch is coming soon (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143643025118637&amp;amp;w=2) too
A hackathon (http://www.openbsd.org/images/hackathons/c2k15-s.gif) is going on right now, so you can expect more SMP improvements in the near future
***
The importance of mentoring (http://adrianchadd.blogspot.com/2015/07/the-importance-of-mentoring-or-how-i.html)
Adrian Chadd has a blog post up about mentoring new users, and it tells the story of how he originally got into FreeBSD
He tells the story of, at age 11, meeting someone else who knew about making crystal sets that became his role model
Eventually we get to his first FreeBSD 1.1 installation (which he temporarily abandoned for Linux, since it didn't have a color "ls" command) and how he started using the OS
Nowadays, there's a formal mentoring system in FreeBSD
While he talks about FreeBSD in the post, a lot of the concepts apply to all the BSDs (or even just life in general)
***
Feedback/Questions
Sean writes in (http://slexy.org/view/s29LpvIxDD)
Herminio writes in (http://slexy.org/view/s21I1MZsDl)
Stuart writes in (http://slexy.org/view/s20kk3ilM6)
Richard writes in (http://slexy.org/view/s2pL5xA80B)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, xinuos, business, bsd license, gpl, mit, copyright, copyleft, copyfree, bsdcan, chromebook, c720, tcpdump, arm64, aarch64, litebsd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this time on the show, we&#39;ll be talking with the CTO of Xinuos, David Meyer, about their adoption of FreeBSD. We also discuss the BSD license model for businesses and the benefits of contributing changes back.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://community.arm.com/groups/processors/blog/2015/07/07/enabling-freebsd-on-aarch64" rel="nofollow">Enabling FreeBSD on AArch64</a></h3>

<ul>
<li>One of the things the FreeBSD foundation has been dumping money into lately is ARM64 support, but we haven&#39;t heard too much about it - this article should change that</li>
<li>Since it&#39;s on a mainstream ARM site, the article begins with a bit of FreeBSD history, leading up to the current work on ARM64</li>
<li>There&#39;s also a summary of some of the ARM work done at this year&#39;s BSDCan, including details about running it on the Cavium ThunderX platform (which has 48 cores)</li>
<li>As of just a couple months ago, dtrace is even working on this new architecture</li>
<li>Come 11.0-RELEASE, the plan is for ARM64 to get the same &quot;tier 1&quot; treatment as X86, which would imply binary updates for base and ports - something Raspberry Pi users often complain about not having
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=8kR-tW1kyDc#t=8" rel="nofollow">OpenBSD&#39;s tcpdump detailed</a></h3>

<ul>
<li>Most people are probably familiar with <a href="https://en.wikipedia.org/wiki/Tcpdump" rel="nofollow">tcpdump</a>, a very useful packet sniffing and capturing utility that&#39;s included in all the main BSD base systems</li>
<li>This video guide is specifically about the version in OpenBSD, which has gone through some major changes (it&#39;s pretty much a fork with no version number anymore)</li>
<li>Unlike on the other platforms, OpenBSD&#39;s tcpdump will always run in a chroot as an unprivileged user - this has saved it from a number of high-profile exploits</li>
<li>It also has support for the &quot;pf.os&quot; system, allowing you to filter out operating system fingerprints in the packet captures</li>
<li>There&#39;s also PF (and pflog) integration, letting you see which line in your ruleset triggered a specific match</li>
<li>Being able to run tcpdump directly <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">on your router</a> is pretty awesome for troubleshooting
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-kamil-czekirda.html" rel="nofollow">More FreeBSD foundation at BSDCan</a></h3>

<ul>
<li>The FreeBSD foundation has another round of trip reports from this year&#39;s BSDCan</li>
<li>First up is Kamil Czekirda, who gives a good summary of some of the devsummit, FreeBSD-related presentations, some tutorials, getting freebsd-update bugs fixed and of course eating cake</li>
<li>A <a href="http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-christian.html" rel="nofollow">second post</a> from Christian Brueffer, who cleverly planned ahead to avoid jetlag, details how he got some things done during the FreeBSD devsummit</li>
<li>Their <a href="http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-warren-block.html" rel="nofollow">third report</a> is from our buddy Warren Block, who (unsurprisingly) worked on a lot of documentation-related things, including getting more people involved with writing them</li>
<li>In true doc team style, his report is the most well-written of the bunch, including lots of links and a clear separation of topics (doc lounge, contributing to the wiki, presentations...)</li>
<li>Finally, the <a href="http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-shonali.html" rel="nofollow">fourth one</a> comes to us from Shonali Balakrishna, who also gives an outline of some of the talks</li>
<li>&quot;Not only does a BSD conference have way too many very smart people in one room, but also some of the nicest.&quot;
***</li>
</ul>

<h3><a href="https://www.dragonflydigest.com/2015/07/08/16391.html" rel="nofollow">DragonFly on the Chromebook C720</a></h3>

<ul>
<li>If you&#39;ve got one of the Chromebook laptops and weren&#39;t happy with the included OS, DragonFlyBSD might be worth a go</li>
<li>This article is a &quot;mini-report&quot; on how DragonFly functions on the device as a desktop, and </li>
<li>While the 2GB of RAM proved to be a bit limiting, most of the hardware is well-supported</li>
<li>DragonFly&#39;s wiki has <a href="http://www.dragonflybsd.org/docs/newhandbook/ConfigChromebook/" rel="nofollow">a full guide</a> on getting set up on one of these devices as well
***</li>
</ul>

<h2>Interview - David Meyer - <a href="mailto:info@xinuos.com" rel="nofollow">info@xinuos.com</a> / <a href="https://twitter.com/xinuos" rel="nofollow">@xinuos</a></h2>

<p>Xinuos, BSD license model vs. others, community interaction</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/sergev/LiteBSD" rel="nofollow">Introducing LiteBSD</a></h3>

<ul>
<li>We definitely don&#39;t talk about 4.4BSD a lot on the show</li>
<li>LiteBSD is &quot;a variant of [the] 4.4BSD operating system adapted for microcontrollers&quot;</li>
<li>If you&#39;ve got really, really old hardware (or are working in the embedded space) then this might be an interesting hobby project to look info
***</li>
</ul>

<h3><a href="http://hardenedbsd.org/article/shawn-webb/2015-07-06/announcing-aslr-completion" rel="nofollow">HardenedBSD announces ASLR completion</a></h3>

<ul>
<li>HardenedBSD, now officially <a href="http://hardenedbsd.org/content/about" rel="nofollow">a full-on fork of FreeBSD</a>, has declared their ASLR patchset to be complete</li>
<li>The latest and last addition to the work was VDSO (Virtual Dynamic Shared Object) randomization, which is now configurable with a sysctl</li>
<li>This post gives a summary of the six main features they&#39;ve added since <a href="http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover" rel="nofollow">the beginning</a></li>
<li>Only a few small things are left to do - man page cleanups, possibly shared object load order improvements
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=143636371501474&w=2" rel="nofollow">Unlock the reaper</a></h3>

<ul>
<li>In the ongoing quest to make more of OpenBSD SMP-friendly, a new patch was posted that unlocks the reaper in the kernel</li>
<li>When there&#39;s a <a href="https://en.wikipedia.org/wiki/Zombie_process" rel="nofollow">zombie process</a> causing a resource leak, it&#39;s the <a href="https://en.wikipedia.org/wiki/Wait_%28system_call%29" rel="nofollow">reaper&#39;s job</a> to deallocate their resources (and yes we&#39;re still talking about computers, not horror movies)</li>
<li>Initial testing has yielded <a href="https://www.marc.info/?l=openbsd-tech&m=143642748717836&w=2" rel="nofollow">positive</a> <a href="https://www.marc.info/?l=openbsd-tech&m=143639356810690&w=2" rel="nofollow">results</a> and <a href="https://www.marc.info/?l=openbsd-tech&m=143638955809675&w=2" rel="nofollow">no regressions</a></li>
<li>They&#39;re looking for testers, so you can install a -current snapshot and get it automatically</li>
<li>An updated version of the patch is <a href="https://www.marc.info/?l=openbsd-tech&m=143643025118637&w=2" rel="nofollow">coming soon</a> too</li>
<li><a href="http://www.openbsd.org/images/hackathons/c2k15-s.gif" rel="nofollow">A hackathon</a> is going on <em>right now</em>, so you can expect more SMP improvements in the near future
***</li>
</ul>

<h3><a href="http://adrianchadd.blogspot.com/2015/07/the-importance-of-mentoring-or-how-i.html" rel="nofollow">The importance of mentoring</a></h3>

<ul>
<li>Adrian Chadd has a blog post up about mentoring new users, and it tells the story of how he originally got into FreeBSD</li>
<li>He tells the story of, at age 11, meeting someone else who knew about making crystal sets that became his role model</li>
<li>Eventually we get to his first FreeBSD 1.1 installation (which he temporarily abandoned for Linux, since it didn&#39;t have a color &quot;ls&quot; command) and how he started using the OS</li>
<li>Nowadays, there&#39;s a formal mentoring system in FreeBSD</li>
<li>While he talks about FreeBSD in the post, a lot of the concepts apply to all the BSDs (or even just life in general)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s29LpvIxDD" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s21I1MZsDl" rel="nofollow">Herminio writes in</a></li>
<li><a href="http://slexy.org/view/s20kk3ilM6" rel="nofollow">Stuart writes in</a></li>
<li><a href="http://slexy.org/view/s2pL5xA80B" rel="nofollow">Richard writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this time on the show, we&#39;ll be talking with the CTO of Xinuos, David Meyer, about their adoption of FreeBSD. We also discuss the BSD license model for businesses and the benefits of contributing changes back.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://community.arm.com/groups/processors/blog/2015/07/07/enabling-freebsd-on-aarch64" rel="nofollow">Enabling FreeBSD on AArch64</a></h3>

<ul>
<li>One of the things the FreeBSD foundation has been dumping money into lately is ARM64 support, but we haven&#39;t heard too much about it - this article should change that</li>
<li>Since it&#39;s on a mainstream ARM site, the article begins with a bit of FreeBSD history, leading up to the current work on ARM64</li>
<li>There&#39;s also a summary of some of the ARM work done at this year&#39;s BSDCan, including details about running it on the Cavium ThunderX platform (which has 48 cores)</li>
<li>As of just a couple months ago, dtrace is even working on this new architecture</li>
<li>Come 11.0-RELEASE, the plan is for ARM64 to get the same &quot;tier 1&quot; treatment as X86, which would imply binary updates for base and ports - something Raspberry Pi users often complain about not having
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=8kR-tW1kyDc#t=8" rel="nofollow">OpenBSD&#39;s tcpdump detailed</a></h3>

<ul>
<li>Most people are probably familiar with <a href="https://en.wikipedia.org/wiki/Tcpdump" rel="nofollow">tcpdump</a>, a very useful packet sniffing and capturing utility that&#39;s included in all the main BSD base systems</li>
<li>This video guide is specifically about the version in OpenBSD, which has gone through some major changes (it&#39;s pretty much a fork with no version number anymore)</li>
<li>Unlike on the other platforms, OpenBSD&#39;s tcpdump will always run in a chroot as an unprivileged user - this has saved it from a number of high-profile exploits</li>
<li>It also has support for the &quot;pf.os&quot; system, allowing you to filter out operating system fingerprints in the packet captures</li>
<li>There&#39;s also PF (and pflog) integration, letting you see which line in your ruleset triggered a specific match</li>
<li>Being able to run tcpdump directly <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">on your router</a> is pretty awesome for troubleshooting
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-kamil-czekirda.html" rel="nofollow">More FreeBSD foundation at BSDCan</a></h3>

<ul>
<li>The FreeBSD foundation has another round of trip reports from this year&#39;s BSDCan</li>
<li>First up is Kamil Czekirda, who gives a good summary of some of the devsummit, FreeBSD-related presentations, some tutorials, getting freebsd-update bugs fixed and of course eating cake</li>
<li>A <a href="http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-christian.html" rel="nofollow">second post</a> from Christian Brueffer, who cleverly planned ahead to avoid jetlag, details how he got some things done during the FreeBSD devsummit</li>
<li>Their <a href="http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-warren-block.html" rel="nofollow">third report</a> is from our buddy Warren Block, who (unsurprisingly) worked on a lot of documentation-related things, including getting more people involved with writing them</li>
<li>In true doc team style, his report is the most well-written of the bunch, including lots of links and a clear separation of topics (doc lounge, contributing to the wiki, presentations...)</li>
<li>Finally, the <a href="http://freebsdfoundation.blogspot.com/2015/07/bsdcan-2015-trip-report-shonali.html" rel="nofollow">fourth one</a> comes to us from Shonali Balakrishna, who also gives an outline of some of the talks</li>
<li>&quot;Not only does a BSD conference have way too many very smart people in one room, but also some of the nicest.&quot;
***</li>
</ul>

<h3><a href="https://www.dragonflydigest.com/2015/07/08/16391.html" rel="nofollow">DragonFly on the Chromebook C720</a></h3>

<ul>
<li>If you&#39;ve got one of the Chromebook laptops and weren&#39;t happy with the included OS, DragonFlyBSD might be worth a go</li>
<li>This article is a &quot;mini-report&quot; on how DragonFly functions on the device as a desktop, and </li>
<li>While the 2GB of RAM proved to be a bit limiting, most of the hardware is well-supported</li>
<li>DragonFly&#39;s wiki has <a href="http://www.dragonflybsd.org/docs/newhandbook/ConfigChromebook/" rel="nofollow">a full guide</a> on getting set up on one of these devices as well
***</li>
</ul>

<h2>Interview - David Meyer - <a href="mailto:info@xinuos.com" rel="nofollow">info@xinuos.com</a> / <a href="https://twitter.com/xinuos" rel="nofollow">@xinuos</a></h2>

<p>Xinuos, BSD license model vs. others, community interaction</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/sergev/LiteBSD" rel="nofollow">Introducing LiteBSD</a></h3>

<ul>
<li>We definitely don&#39;t talk about 4.4BSD a lot on the show</li>
<li>LiteBSD is &quot;a variant of [the] 4.4BSD operating system adapted for microcontrollers&quot;</li>
<li>If you&#39;ve got really, really old hardware (or are working in the embedded space) then this might be an interesting hobby project to look info
***</li>
</ul>

<h3><a href="http://hardenedbsd.org/article/shawn-webb/2015-07-06/announcing-aslr-completion" rel="nofollow">HardenedBSD announces ASLR completion</a></h3>

<ul>
<li>HardenedBSD, now officially <a href="http://hardenedbsd.org/content/about" rel="nofollow">a full-on fork of FreeBSD</a>, has declared their ASLR patchset to be complete</li>
<li>The latest and last addition to the work was VDSO (Virtual Dynamic Shared Object) randomization, which is now configurable with a sysctl</li>
<li>This post gives a summary of the six main features they&#39;ve added since <a href="http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover" rel="nofollow">the beginning</a></li>
<li>Only a few small things are left to do - man page cleanups, possibly shared object load order improvements
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=143636371501474&w=2" rel="nofollow">Unlock the reaper</a></h3>

<ul>
<li>In the ongoing quest to make more of OpenBSD SMP-friendly, a new patch was posted that unlocks the reaper in the kernel</li>
<li>When there&#39;s a <a href="https://en.wikipedia.org/wiki/Zombie_process" rel="nofollow">zombie process</a> causing a resource leak, it&#39;s the <a href="https://en.wikipedia.org/wiki/Wait_%28system_call%29" rel="nofollow">reaper&#39;s job</a> to deallocate their resources (and yes we&#39;re still talking about computers, not horror movies)</li>
<li>Initial testing has yielded <a href="https://www.marc.info/?l=openbsd-tech&m=143642748717836&w=2" rel="nofollow">positive</a> <a href="https://www.marc.info/?l=openbsd-tech&m=143639356810690&w=2" rel="nofollow">results</a> and <a href="https://www.marc.info/?l=openbsd-tech&m=143638955809675&w=2" rel="nofollow">no regressions</a></li>
<li>They&#39;re looking for testers, so you can install a -current snapshot and get it automatically</li>
<li>An updated version of the patch is <a href="https://www.marc.info/?l=openbsd-tech&m=143643025118637&w=2" rel="nofollow">coming soon</a> too</li>
<li><a href="http://www.openbsd.org/images/hackathons/c2k15-s.gif" rel="nofollow">A hackathon</a> is going on <em>right now</em>, so you can expect more SMP improvements in the near future
***</li>
</ul>

<h3><a href="http://adrianchadd.blogspot.com/2015/07/the-importance-of-mentoring-or-how-i.html" rel="nofollow">The importance of mentoring</a></h3>

<ul>
<li>Adrian Chadd has a blog post up about mentoring new users, and it tells the story of how he originally got into FreeBSD</li>
<li>He tells the story of, at age 11, meeting someone else who knew about making crystal sets that became his role model</li>
<li>Eventually we get to his first FreeBSD 1.1 installation (which he temporarily abandoned for Linux, since it didn&#39;t have a color &quot;ls&quot; command) and how he started using the OS</li>
<li>Nowadays, there&#39;s a formal mentoring system in FreeBSD</li>
<li>While he talks about FreeBSD in the post, a lot of the concepts apply to all the BSDs (or even just life in general)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s29LpvIxDD" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s21I1MZsDl" rel="nofollow">Herminio writes in</a></li>
<li><a href="http://slexy.org/view/s20kk3ilM6" rel="nofollow">Stuart writes in</a></li>
<li><a href="http://slexy.org/view/s2pL5xA80B" rel="nofollow">Richard writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>97: Big Network, SmallWall</title>
  <link>https://www.bsdnow.tv/97</link>
  <guid isPermaLink="false">8ae01f5e-8be5-4cbc-bb95-094f2d536681</guid>
  <pubDate>Wed, 08 Jul 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8ae01f5e-8be5-4cbc-bb95-094f2d536681.mp3" length="56408980" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this time on the show, we'll be chatting with Lee Sharp. He's recently revived the m0n0wall codebase, now known as SmallWall, and we'll find out what the future holds for this new addition to the BSD family. Answers to your emails and all this week's news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:18:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this time on the show, we'll be chatting with Lee Sharp. He's recently revived the m0n0wall codebase, now known as SmallWall, and we'll find out what the future holds for this new addition to the BSD family. Answers to your emails and all this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
BSDCan and pkgsrcCon videos (https://www.youtube.com/channel/UCAEx6zhR2sD2pAGKezasAjA/videos)
Even more BSDCan 2015 videos are slowly but surely making their way to the internet
Nigel Williams, Multipath TCP for FreeBSD (https://www.youtube.com/watch?v=P3vB_FWtyIs)
Stephen Bourne, Early days of Unix and design of sh (https://www.youtube.com/watch?v=2kEJoWfobpA)
John Criswell, Protecting FreeBSD with Secure Virtual Architecture (https://www.youtube.com/watch?v=hRIC_aF_u24)
Shany Michaely, Expanding RDMA capability over Ethernet in FreeBSD (https://www.youtube.com/watch?v=stsaeKvF3no)
John-Mark Gurney, Adding AES-ICM and AES-GCM to OpenCrypto (https://www.youtube.com/watch?v=JaufZ7yCrLU)
Sevan Janiyan, Adventures in building (https://www.youtube.com/watch?v=-HMXyzybgdM) open source software (https://www.youtube.com/watch?v=Xof-uKnQ6cY)
And finally, the BSDCan 2015 closing (https://www.youtube.com/watch?v=Ynm0bGnYdfY)
Some videos (https://vimeo.com/channels/pkgsrccon/videos) from this year's pkgsrcCon (http://pkgsrc.org/pkgsrcCon/2015/) are also starting to appear online
Sevan Janiyan, A year of pkgsrc 2014 - 2015 (https://vimeo.com/channels/pkgsrccon/132767946)
Pierre Pronchery, pkgsrc meets pkg-ng (https://vimeo.com/channels/pkgsrccon/132766052)
Jonathan Perkin, pkgsrc at Joyent (https://vimeo.com/channels/pkgsrccon/132760863)
Jörg Sonnenberger, pkg_install script framework (https://vimeo.com/channels/pkgsrccon/132757658)
Benny Siegert, New Features in BulkTracker (https://vimeo.com/channels/pkgsrccon/132751897)
This is the first time we've ever seen recordings from the conference - hopefully they continue this trend
***
OPNsense 15.7 released (https://forum.opnsense.org/index.php?topic=839.0)
The OPNsense team has released version 15.7, almost exactly six months after their initial debut (http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach)
In addition to pulling in the latest security fixes from upstream FreeBSD, 15.7 also includes new integration of an intrusion detection system (and new GUI for it) as well as new blacklisting options for the proxy server
Taking a note from upstream PF's playbook, ALTQ traffic shaping support has finally been retired as of this release (it was deprecated from OpenBSD a few years ago, and the code was completely removed (http://undeadly.org/cgi?action=article&amp;amp;sid=20140419151959) just over a year ago)
The LibreSSL flavor has been promoted to production-ready, and users can easily migrate over from OpenSSL via the GUI - switching between the two is simple; no commitment needed
Various third party ports have also been bumped up to their latest versions to keep things fresh, and there's the usual round of bug fixes included
Shortly afterwards, 15.7.1 (https://forum.opnsense.org/index.php?topic=915.0) was released with a few more small fixes
***
NetBSD at Open Source Conference 2015 Okinawa (https://mail-index.netbsd.org/netbsd-advocacy/2015/07/04/msg000688.html)
If you liked last week's episode (http://www.bsdnow.tv/episodes/2015_07_01-lost_technology) then you'll probably know what to expect with this one
The NetBSD users group of Japan hit another open source conference, this time in Okinawa
This time, they had a few interesting NetBSD machines on display that we didn't get to see in the interview last week
We'd love to see something like this in North America or Europe too - anyone up for installing BSD on some interesting devices and showing them off at a Linux con?
***
OpenBSD BGP and VRFs (http://firstyear.id.au/entry/21)
"VRFs (https://en.wikipedia.org/wiki/Virtual_routing_and_forwarding), or in OpenBSD rdomains, are a simple, yet powerful (and sometimes confusing) topic"
This article aims to explain both BGP and rdomains, using network diagrams, for some network isolation goodness
With multiple rdomains, it's also possible to have two upstream internet connections, but lock different groups of your internal network to just one of them
The idea of a "guest network" can greatly benefit from this separation as well, even allowing for the same IP ranges to be used without issues
Combining rdomains with the BGP protocol allows for some very selective and precise blocking/passing of traffic between networks, which is also covered in detail here
The BSDCan talk on rdomains (https://www.youtube.com/watch?v=BizrC8Zr-YY) expands on the subject a bit more if you haven't seen it, as well as a few related (https://www.packetmischief.ca/2011/09/20/virtualizing-the-openbsd-routing-table/) posts (http://cybermashup.com/2013/05/21/complex-routing-with-openbsd/)
***
Interview - Lee Sharp - lee@smallwall.org (mailto:lee@smallwall.org)
SmallWall (http://smallwall.org), a continuation of m0n0wall
News Roundup
Solaris adopts more BSD goodies (https://blogs.oracle.com/solarisfw/entry/pf_for_solaris)
We mentioned a while back that Oracle developers have begun porting a current version of OpenBSD's PF firewall to their next version, even contributing back patches for SMP and other bug fixes
They recently published an article about PF, talking about what's different about it on their platform compared to others - not especially useful for BSD users, but interesting to read if you like firewalls
Darren Moffat, who was part of originally getting an SSH implementation into Solaris, has a second blog post (https://blogs.oracle.com/darren/entry/openssh_in_solaris_11_3) up about their "SunSSH" fork
Going forward, their next version is going to offer a completely vanilla OpenSSH option as well, with the plan being to phase out SunSSH after that
The article talks a bit about the history of getting SSH into the OS, forking the code and also lists some of the differences between the two
In a third blog post (https://blogs.oracle.com/darren/entry/solaris_new_system_calls_getentropy), they talk about a new system call they're borrowing from OpenBSD, getentropy(2) (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2), as well as the addition of arc4random (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man3/arc4random.3) to their libc
With an up-to-date and SMP-capable PF, ZFS with native encryption, jail-like Zones, unaltered OpenSSH and secure entropy calls… is Solaris becoming better than us?
Look forward to the upcoming "Solaris Now" podcast &lt;sub&gt;(not really)&lt;/sub&gt;
***
EuroBSDCon 2015 talks and tutorials (https://2015.eurobsdcon.org/talks/)
This year's EuroBSDCon is set to be held in Sweden at the beginning of October, and the preliminary list of accepted presentations has been published
The list looks pretty well-balanced between the different BSDs, something Paul would be happy to see if he was still with us
It even includes an interesting DragonFly talk and a couple talks from NetBSD developers, in addition to plenty of FreeBSD and OpenBSD of course
There are also a few tutorials (https://2015.eurobsdcon.org/tutorials/) planned for the event, some you've probably seen already and some you haven't
Registration for the event will be opening very soon (likely this week or next)
***
Using ZFS replication to improve offsite backups (https://www.iceflatline.com/2015/07/using-zfs-replication-features-in-freebsd-to-improve-my-offsite-backups/)
If you take backups seriously, you're probably using ZFS and probably keeping an offsite copy of the data
This article covers doing just that, but with a focus on making use of the replication capability
It'll walk you through taking a snapshot of your pool and then replicating it to another remote system, using "zfs send" and SSH - this has the benefit of only transferring the files that have changed since the last time you did it
Steps are also taken to allow a regular user to take and manage snapshots, so you don't need to be root for the SSH transfer
Data integrity is a long process - filesystem-level checksums, resistance to hardware failure, ECC memory, multiple copies in different locations... they all play a role in keeping your files secure; don't skip out on any of them
One thing the author didn't mention in his post: having an offline copy of the data, ideally sealed in a safe place, is also important
***
Block encryption in OpenBSD (http://anadoxin.org/blog/blog/20150705/block-encryption-in-openbsd/)
We've covered (http://www.bsdnow.tv/tutorials/fde) ways to do fully-encrypted installations of OpenBSD (and FreeBSD) before, but that requires dedicating a whole drive or partition to the sensitive data
This blog post takes you through the process of creating encrypted containers in OpenBSD, à la TrueCrypt - that is, a file-backed virtual device with an encrypted filesystem
It goes through creating a file that looks like random data, pointing vnconfig at it, setting up the crypto and finally using it as a fake storage device
The encrypted container method offers the advantage of being a bit more portable across installations than other ways
***
Docker hits FreeBSD ports (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=391421)
The inevitable has happened, and an early FreeBSD port of docker is finally here 
Some details and directions (https://github.com/kvasdopil/docker/blob/freebsd-compat/FREEBSD-PORTING.md) are available to read if you'd like to give it a try, as well as a list of which features work and which don't
There was also some Hacker News discussion (https://news.ycombinator.com/item?id=9840025) on the topic
***
Microsoft donates to OpenSSH (http://undeadly.org/cgi?action=article&amp;amp;sid=20150708134520&amp;amp;mode=flat)
We've talked about big businesses using BSD and contributing back before, even mentioning a few other large public donations - now it's Microsoft's turn
With their recent decision to integrate OpenSSH into an upcoming Windows release, Microsoft has donated a large sum of money to the OpenBSD foundation, making them a gold-level sponsor
They've also posted some contract work offers on the OpenSSH mailing list, and say that their changes will be upstreamed if appropriate - we're always glad to see this
***
Feedback/Questions
Joe writes in (http://slexy.org/view/s2NqbhwOoH)
Mike writes in (http://slexy.org/view/s2T3NEia98)
Randy writes in (http://slexy.org/view/s20RlTK6Ha)
Tony writes in (http://slexy.org/view/s2rjCd0bGX)
Kevin writes in (http://slexy.org/view/s21PfSIyG5)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, smallwall, m0n0wall, opnsense, pfsense, router, mini-itx, apu, alix, soekris, pcengines, edgerouter, lite, encryption, containers, zfs, replication, docker</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this time on the show, we&#39;ll be chatting with Lee Sharp. He&#39;s recently revived the m0n0wall codebase, now known as SmallWall, and we&#39;ll find out what the future holds for this new addition to the BSD family. Answers to your emails and all this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.youtube.com/channel/UCAEx6zhR2sD2pAGKezasAjA/videos" rel="nofollow">BSDCan and pkgsrcCon videos</a></h3>

<ul>
<li>Even more BSDCan 2015 videos are slowly but surely making their way to the internet</li>
<li>Nigel Williams, <a href="https://www.youtube.com/watch?v=P3vB_FWtyIs" rel="nofollow">Multipath TCP for FreeBSD</a></li>
<li>Stephen Bourne, <a href="https://www.youtube.com/watch?v=2kEJoWfobpA" rel="nofollow">Early days of Unix and design of sh</a></li>
<li>John Criswell, <a href="https://www.youtube.com/watch?v=hRIC_aF_u24" rel="nofollow">Protecting FreeBSD with Secure Virtual Architecture</a></li>
<li>Shany Michaely, <a href="https://www.youtube.com/watch?v=stsaeKvF3no" rel="nofollow">Expanding RDMA capability over Ethernet in FreeBSD</a></li>
<li>John-Mark Gurney, <a href="https://www.youtube.com/watch?v=JaufZ7yCrLU" rel="nofollow">Adding AES-ICM and AES-GCM to OpenCrypto</a></li>
<li>Sevan Janiyan, <a href="https://www.youtube.com/watch?v=-HMXyzybgdM" rel="nofollow">Adventures in building</a> <a href="https://www.youtube.com/watch?v=Xof-uKnQ6cY" rel="nofollow">open source software</a></li>
<li>And finally, <a href="https://www.youtube.com/watch?v=Ynm0bGnYdfY" rel="nofollow">the BSDCan 2015 closing</a></li>
<li>Some <a href="https://vimeo.com/channels/pkgsrccon/videos" rel="nofollow">videos</a> from this year&#39;s <a href="http://pkgsrc.org/pkgsrcCon/2015/" rel="nofollow">pkgsrcCon</a> are also starting to appear online</li>
<li>Sevan Janiyan, <a href="https://vimeo.com/channels/pkgsrccon/132767946" rel="nofollow">A year of pkgsrc 2014 - 2015</a></li>
<li>Pierre Pronchery, <a href="https://vimeo.com/channels/pkgsrccon/132766052" rel="nofollow">pkgsrc meets pkg-ng</a></li>
<li>Jonathan Perkin, <a href="https://vimeo.com/channels/pkgsrccon/132760863" rel="nofollow">pkgsrc at Joyent</a></li>
<li>Jörg Sonnenberger, <a href="https://vimeo.com/channels/pkgsrccon/132757658" rel="nofollow">pkg_install script framework</a></li>
<li>Benny Siegert, <a href="https://vimeo.com/channels/pkgsrccon/132751897" rel="nofollow">New Features in BulkTracker</a></li>
<li>This is the first time we&#39;ve ever seen recordings from the conference - hopefully they continue this trend
***</li>
</ul>

<h3><a href="https://forum.opnsense.org/index.php?topic=839.0" rel="nofollow">OPNsense 15.7 released</a></h3>

<ul>
<li>The OPNsense team has released version 15.7, almost exactly six months after <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">their initial debut</a></li>
<li>In addition to pulling in the latest security fixes from upstream FreeBSD, 15.7 also includes new integration of an intrusion detection system (and new GUI for it) as well as new blacklisting options for the proxy server</li>
<li>Taking a note from upstream PF&#39;s playbook, ALTQ traffic shaping support has finally been retired as of this release (it was deprecated from OpenBSD a few years ago, and the code was <a href="http://undeadly.org/cgi?action=article&sid=20140419151959" rel="nofollow">completely removed</a> just over a year ago)</li>
<li>The LibreSSL flavor has been promoted to production-ready, and users can easily migrate over from OpenSSL via the GUI - switching between the two is simple; no commitment needed</li>
<li>Various third party ports have also been bumped up to their latest versions to keep things fresh, and there&#39;s the usual round of bug fixes included</li>
<li>Shortly afterwards, <a href="https://forum.opnsense.org/index.php?topic=915.0" rel="nofollow">15.7.1</a> was released with a few more small fixes
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/07/04/msg000688.html" rel="nofollow">NetBSD at Open Source Conference 2015 Okinawa</a></h3>

<ul>
<li>If you liked <a href="http://www.bsdnow.tv/episodes/2015_07_01-lost_technology" rel="nofollow">last week&#39;s episode</a> then you&#39;ll probably know what to expect with this one</li>
<li>The NetBSD users group of Japan hit another open source conference, this time in Okinawa</li>
<li>This time, they had a few interesting NetBSD machines on display that we didn&#39;t get to see in the interview last week</li>
<li>We&#39;d love to see something like this in North America or Europe too - anyone up for installing BSD on some interesting devices and showing them off at a Linux con?
***</li>
</ul>

<h3><a href="http://firstyear.id.au/entry/21" rel="nofollow">OpenBSD BGP and VRFs</a></h3>

<ul>
<li>&quot;<a href="https://en.wikipedia.org/wiki/Virtual_routing_and_forwarding" rel="nofollow">VRFs</a>, or in OpenBSD rdomains, are a simple, yet powerful (and sometimes confusing) topic&quot;</li>
<li>This article aims to explain both BGP and rdomains, using network diagrams, for some network isolation goodness</li>
<li>With multiple rdomains, it&#39;s also possible to have two upstream internet connections, but lock different groups of your internal network to just one of them</li>
<li>The idea of a &quot;guest network&quot; can greatly benefit from this separation as well, even allowing for the same IP ranges to be used without issues</li>
<li>Combining rdomains with the BGP protocol allows for some very selective and precise blocking/passing of traffic between networks, which is also covered in detail here</li>
<li>The <a href="https://www.youtube.com/watch?v=BizrC8Zr-YY" rel="nofollow">BSDCan talk on rdomains</a> expands on the subject a bit more if you haven&#39;t seen it, as well as a few <a href="https://www.packetmischief.ca/2011/09/20/virtualizing-the-openbsd-routing-table/" rel="nofollow">related</a> <a href="http://cybermashup.com/2013/05/21/complex-routing-with-openbsd/" rel="nofollow">posts</a>
***</li>
</ul>

<h2>Interview - Lee Sharp - <a href="mailto:lee@smallwall.org" rel="nofollow">lee@smallwall.org</a></h2>

<p><a href="http://smallwall.org" rel="nofollow">SmallWall</a>, a continuation of m0n0wall</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blogs.oracle.com/solarisfw/entry/pf_for_solaris" rel="nofollow">Solaris adopts more BSD goodies</a></h3>

<ul>
<li>We mentioned a while back that Oracle developers have begun porting a current version of OpenBSD&#39;s PF firewall to their next version, even contributing back patches for SMP and other bug fixes</li>
<li>They recently published an article about PF, talking about what&#39;s different about it on their platform compared to others - not especially useful for BSD users, but interesting to read if you like firewalls</li>
<li>Darren Moffat, who was part of originally getting an SSH implementation into Solaris, has a <a href="https://blogs.oracle.com/darren/entry/openssh_in_solaris_11_3" rel="nofollow">second blog post</a> up about their &quot;SunSSH&quot; fork</li>
<li>Going forward, their next version is going to offer a completely vanilla OpenSSH option as well, with the plan being to phase out SunSSH after that</li>
<li>The article talks a bit about the history of getting SSH into the OS, forking the code and also lists some of the differences between the two</li>
<li>In <a href="https://blogs.oracle.com/darren/entry/solaris_new_system_calls_getentropy" rel="nofollow">a third blog post</a>, they talk about a new system call they&#39;re borrowing from OpenBSD, <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2" rel="nofollow">getentropy(2)</a>, as well as the addition of <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man3/arc4random.3" rel="nofollow">arc4random</a> to their libc</li>
<li>With an up-to-date and SMP-capable PF, ZFS with native encryption, jail-like Zones, unaltered OpenSSH and secure entropy calls… is Solaris becoming <em>better than us</em>?</li>
<li>Look forward to the upcoming &quot;Solaris Now&quot; podcast <sub>(not really)</sub>
***</li>
</ul>

<h3><a href="https://2015.eurobsdcon.org/talks/" rel="nofollow">EuroBSDCon 2015 talks and tutorials</a></h3>

<ul>
<li>This year&#39;s EuroBSDCon is set to be held in Sweden at the beginning of October, and the preliminary list of accepted presentations has been published</li>
<li>The list looks pretty well-balanced between the different BSDs, something Paul would be happy to see if he was still with us</li>
<li>It even includes an interesting DragonFly talk and a couple talks from NetBSD developers, in addition to plenty of FreeBSD and OpenBSD of course</li>
<li>There are also <a href="https://2015.eurobsdcon.org/tutorials/" rel="nofollow">a few tutorials</a> planned for the event, some you&#39;ve probably seen already and some you haven&#39;t</li>
<li>Registration for the event will be opening very soon (likely this week or next)
***</li>
</ul>

<h3><a href="https://www.iceflatline.com/2015/07/using-zfs-replication-features-in-freebsd-to-improve-my-offsite-backups/" rel="nofollow">Using ZFS replication to improve offsite backups</a></h3>

<ul>
<li>If you take backups seriously, you&#39;re probably using ZFS and probably keeping an offsite copy of the data</li>
<li>This article covers doing just that, but with a focus on making use of the replication capability</li>
<li>It&#39;ll walk you through taking a snapshot of your pool and then replicating it to another remote system, using &quot;zfs send&quot; and SSH - this has the benefit of only transferring the files that have changed since the last time you did it</li>
<li>Steps are also taken to allow a regular user to take and manage snapshots, so you don&#39;t need to be root for the SSH transfer</li>
<li>Data integrity is a long process - filesystem-level checksums, resistance to hardware failure, ECC memory, multiple copies in different locations... they all play a role in keeping your files secure; don&#39;t skip out on any of them</li>
<li>One thing the author didn&#39;t mention in his post: having an <strong>offline</strong> copy of the data, ideally sealed in a safe place, is also important
***</li>
</ul>

<h3><a href="http://anadoxin.org/blog/blog/20150705/block-encryption-in-openbsd/" rel="nofollow">Block encryption in OpenBSD</a></h3>

<ul>
<li>We&#39;ve <a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">covered</a> ways to do fully-encrypted installations of OpenBSD (and FreeBSD) before, but that requires dedicating a whole drive or partition to the sensitive data</li>
<li>This blog post takes you through the process of creating encrypted <em>containers</em> in OpenBSD, à la TrueCrypt - that is, a file-backed virtual device with an encrypted filesystem</li>
<li>It goes through creating a file that looks like random data, pointing <strong>vnconfig</strong> at it, setting up the crypto and finally using it as a fake storage device</li>
<li>The encrypted container method offers the advantage of being a bit more portable across installations than other ways
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=391421" rel="nofollow">Docker hits FreeBSD ports</a></h3>

<ul>
<li>The inevitable has happened, and an early FreeBSD port of docker is finally here </li>
<li>Some <a href="https://github.com/kvasdopil/docker/blob/freebsd-compat/FREEBSD-PORTING.md" rel="nofollow">details and directions</a> are available to read if you&#39;d like to give it a try, as well as a list of which features work and which don&#39;t</li>
<li>There was also some <a href="https://news.ycombinator.com/item?id=9840025" rel="nofollow">Hacker News discussion</a> on the topic
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150708134520&mode=flat" rel="nofollow">Microsoft donates to OpenSSH</a></h3>

<ul>
<li>We&#39;ve talked about big businesses using BSD and contributing back before, even mentioning a few other large public donations - now it&#39;s Microsoft&#39;s turn</li>
<li>With their recent decision to integrate OpenSSH into an upcoming Windows release, Microsoft has donated a large sum of money to the OpenBSD foundation, making them a gold-level sponsor</li>
<li>They&#39;ve also posted some contract work offers on the OpenSSH mailing list, and say that their changes will be upstreamed if appropriate - we&#39;re always glad to see this
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2NqbhwOoH" rel="nofollow">Joe writes in</a></li>
<li><a href="http://slexy.org/view/s2T3NEia98" rel="nofollow">Mike writes in</a></li>
<li><a href="http://slexy.org/view/s20RlTK6Ha" rel="nofollow">Randy writes in</a></li>
<li><a href="http://slexy.org/view/s2rjCd0bGX" rel="nofollow">Tony writes in</a></li>
<li><a href="http://slexy.org/view/s21PfSIyG5" rel="nofollow">Kevin writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this time on the show, we&#39;ll be chatting with Lee Sharp. He&#39;s recently revived the m0n0wall codebase, now known as SmallWall, and we&#39;ll find out what the future holds for this new addition to the BSD family. Answers to your emails and all this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.youtube.com/channel/UCAEx6zhR2sD2pAGKezasAjA/videos" rel="nofollow">BSDCan and pkgsrcCon videos</a></h3>

<ul>
<li>Even more BSDCan 2015 videos are slowly but surely making their way to the internet</li>
<li>Nigel Williams, <a href="https://www.youtube.com/watch?v=P3vB_FWtyIs" rel="nofollow">Multipath TCP for FreeBSD</a></li>
<li>Stephen Bourne, <a href="https://www.youtube.com/watch?v=2kEJoWfobpA" rel="nofollow">Early days of Unix and design of sh</a></li>
<li>John Criswell, <a href="https://www.youtube.com/watch?v=hRIC_aF_u24" rel="nofollow">Protecting FreeBSD with Secure Virtual Architecture</a></li>
<li>Shany Michaely, <a href="https://www.youtube.com/watch?v=stsaeKvF3no" rel="nofollow">Expanding RDMA capability over Ethernet in FreeBSD</a></li>
<li>John-Mark Gurney, <a href="https://www.youtube.com/watch?v=JaufZ7yCrLU" rel="nofollow">Adding AES-ICM and AES-GCM to OpenCrypto</a></li>
<li>Sevan Janiyan, <a href="https://www.youtube.com/watch?v=-HMXyzybgdM" rel="nofollow">Adventures in building</a> <a href="https://www.youtube.com/watch?v=Xof-uKnQ6cY" rel="nofollow">open source software</a></li>
<li>And finally, <a href="https://www.youtube.com/watch?v=Ynm0bGnYdfY" rel="nofollow">the BSDCan 2015 closing</a></li>
<li>Some <a href="https://vimeo.com/channels/pkgsrccon/videos" rel="nofollow">videos</a> from this year&#39;s <a href="http://pkgsrc.org/pkgsrcCon/2015/" rel="nofollow">pkgsrcCon</a> are also starting to appear online</li>
<li>Sevan Janiyan, <a href="https://vimeo.com/channels/pkgsrccon/132767946" rel="nofollow">A year of pkgsrc 2014 - 2015</a></li>
<li>Pierre Pronchery, <a href="https://vimeo.com/channels/pkgsrccon/132766052" rel="nofollow">pkgsrc meets pkg-ng</a></li>
<li>Jonathan Perkin, <a href="https://vimeo.com/channels/pkgsrccon/132760863" rel="nofollow">pkgsrc at Joyent</a></li>
<li>Jörg Sonnenberger, <a href="https://vimeo.com/channels/pkgsrccon/132757658" rel="nofollow">pkg_install script framework</a></li>
<li>Benny Siegert, <a href="https://vimeo.com/channels/pkgsrccon/132751897" rel="nofollow">New Features in BulkTracker</a></li>
<li>This is the first time we&#39;ve ever seen recordings from the conference - hopefully they continue this trend
***</li>
</ul>

<h3><a href="https://forum.opnsense.org/index.php?topic=839.0" rel="nofollow">OPNsense 15.7 released</a></h3>

<ul>
<li>The OPNsense team has released version 15.7, almost exactly six months after <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">their initial debut</a></li>
<li>In addition to pulling in the latest security fixes from upstream FreeBSD, 15.7 also includes new integration of an intrusion detection system (and new GUI for it) as well as new blacklisting options for the proxy server</li>
<li>Taking a note from upstream PF&#39;s playbook, ALTQ traffic shaping support has finally been retired as of this release (it was deprecated from OpenBSD a few years ago, and the code was <a href="http://undeadly.org/cgi?action=article&sid=20140419151959" rel="nofollow">completely removed</a> just over a year ago)</li>
<li>The LibreSSL flavor has been promoted to production-ready, and users can easily migrate over from OpenSSL via the GUI - switching between the two is simple; no commitment needed</li>
<li>Various third party ports have also been bumped up to their latest versions to keep things fresh, and there&#39;s the usual round of bug fixes included</li>
<li>Shortly afterwards, <a href="https://forum.opnsense.org/index.php?topic=915.0" rel="nofollow">15.7.1</a> was released with a few more small fixes
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/07/04/msg000688.html" rel="nofollow">NetBSD at Open Source Conference 2015 Okinawa</a></h3>

<ul>
<li>If you liked <a href="http://www.bsdnow.tv/episodes/2015_07_01-lost_technology" rel="nofollow">last week&#39;s episode</a> then you&#39;ll probably know what to expect with this one</li>
<li>The NetBSD users group of Japan hit another open source conference, this time in Okinawa</li>
<li>This time, they had a few interesting NetBSD machines on display that we didn&#39;t get to see in the interview last week</li>
<li>We&#39;d love to see something like this in North America or Europe too - anyone up for installing BSD on some interesting devices and showing them off at a Linux con?
***</li>
</ul>

<h3><a href="http://firstyear.id.au/entry/21" rel="nofollow">OpenBSD BGP and VRFs</a></h3>

<ul>
<li>&quot;<a href="https://en.wikipedia.org/wiki/Virtual_routing_and_forwarding" rel="nofollow">VRFs</a>, or in OpenBSD rdomains, are a simple, yet powerful (and sometimes confusing) topic&quot;</li>
<li>This article aims to explain both BGP and rdomains, using network diagrams, for some network isolation goodness</li>
<li>With multiple rdomains, it&#39;s also possible to have two upstream internet connections, but lock different groups of your internal network to just one of them</li>
<li>The idea of a &quot;guest network&quot; can greatly benefit from this separation as well, even allowing for the same IP ranges to be used without issues</li>
<li>Combining rdomains with the BGP protocol allows for some very selective and precise blocking/passing of traffic between networks, which is also covered in detail here</li>
<li>The <a href="https://www.youtube.com/watch?v=BizrC8Zr-YY" rel="nofollow">BSDCan talk on rdomains</a> expands on the subject a bit more if you haven&#39;t seen it, as well as a few <a href="https://www.packetmischief.ca/2011/09/20/virtualizing-the-openbsd-routing-table/" rel="nofollow">related</a> <a href="http://cybermashup.com/2013/05/21/complex-routing-with-openbsd/" rel="nofollow">posts</a>
***</li>
</ul>

<h2>Interview - Lee Sharp - <a href="mailto:lee@smallwall.org" rel="nofollow">lee@smallwall.org</a></h2>

<p><a href="http://smallwall.org" rel="nofollow">SmallWall</a>, a continuation of m0n0wall</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blogs.oracle.com/solarisfw/entry/pf_for_solaris" rel="nofollow">Solaris adopts more BSD goodies</a></h3>

<ul>
<li>We mentioned a while back that Oracle developers have begun porting a current version of OpenBSD&#39;s PF firewall to their next version, even contributing back patches for SMP and other bug fixes</li>
<li>They recently published an article about PF, talking about what&#39;s different about it on their platform compared to others - not especially useful for BSD users, but interesting to read if you like firewalls</li>
<li>Darren Moffat, who was part of originally getting an SSH implementation into Solaris, has a <a href="https://blogs.oracle.com/darren/entry/openssh_in_solaris_11_3" rel="nofollow">second blog post</a> up about their &quot;SunSSH&quot; fork</li>
<li>Going forward, their next version is going to offer a completely vanilla OpenSSH option as well, with the plan being to phase out SunSSH after that</li>
<li>The article talks a bit about the history of getting SSH into the OS, forking the code and also lists some of the differences between the two</li>
<li>In <a href="https://blogs.oracle.com/darren/entry/solaris_new_system_calls_getentropy" rel="nofollow">a third blog post</a>, they talk about a new system call they&#39;re borrowing from OpenBSD, <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2" rel="nofollow">getentropy(2)</a>, as well as the addition of <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man3/arc4random.3" rel="nofollow">arc4random</a> to their libc</li>
<li>With an up-to-date and SMP-capable PF, ZFS with native encryption, jail-like Zones, unaltered OpenSSH and secure entropy calls… is Solaris becoming <em>better than us</em>?</li>
<li>Look forward to the upcoming &quot;Solaris Now&quot; podcast <sub>(not really)</sub>
***</li>
</ul>

<h3><a href="https://2015.eurobsdcon.org/talks/" rel="nofollow">EuroBSDCon 2015 talks and tutorials</a></h3>

<ul>
<li>This year&#39;s EuroBSDCon is set to be held in Sweden at the beginning of October, and the preliminary list of accepted presentations has been published</li>
<li>The list looks pretty well-balanced between the different BSDs, something Paul would be happy to see if he was still with us</li>
<li>It even includes an interesting DragonFly talk and a couple talks from NetBSD developers, in addition to plenty of FreeBSD and OpenBSD of course</li>
<li>There are also <a href="https://2015.eurobsdcon.org/tutorials/" rel="nofollow">a few tutorials</a> planned for the event, some you&#39;ve probably seen already and some you haven&#39;t</li>
<li>Registration for the event will be opening very soon (likely this week or next)
***</li>
</ul>

<h3><a href="https://www.iceflatline.com/2015/07/using-zfs-replication-features-in-freebsd-to-improve-my-offsite-backups/" rel="nofollow">Using ZFS replication to improve offsite backups</a></h3>

<ul>
<li>If you take backups seriously, you&#39;re probably using ZFS and probably keeping an offsite copy of the data</li>
<li>This article covers doing just that, but with a focus on making use of the replication capability</li>
<li>It&#39;ll walk you through taking a snapshot of your pool and then replicating it to another remote system, using &quot;zfs send&quot; and SSH - this has the benefit of only transferring the files that have changed since the last time you did it</li>
<li>Steps are also taken to allow a regular user to take and manage snapshots, so you don&#39;t need to be root for the SSH transfer</li>
<li>Data integrity is a long process - filesystem-level checksums, resistance to hardware failure, ECC memory, multiple copies in different locations... they all play a role in keeping your files secure; don&#39;t skip out on any of them</li>
<li>One thing the author didn&#39;t mention in his post: having an <strong>offline</strong> copy of the data, ideally sealed in a safe place, is also important
***</li>
</ul>

<h3><a href="http://anadoxin.org/blog/blog/20150705/block-encryption-in-openbsd/" rel="nofollow">Block encryption in OpenBSD</a></h3>

<ul>
<li>We&#39;ve <a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">covered</a> ways to do fully-encrypted installations of OpenBSD (and FreeBSD) before, but that requires dedicating a whole drive or partition to the sensitive data</li>
<li>This blog post takes you through the process of creating encrypted <em>containers</em> in OpenBSD, à la TrueCrypt - that is, a file-backed virtual device with an encrypted filesystem</li>
<li>It goes through creating a file that looks like random data, pointing <strong>vnconfig</strong> at it, setting up the crypto and finally using it as a fake storage device</li>
<li>The encrypted container method offers the advantage of being a bit more portable across installations than other ways
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=391421" rel="nofollow">Docker hits FreeBSD ports</a></h3>

<ul>
<li>The inevitable has happened, and an early FreeBSD port of docker is finally here </li>
<li>Some <a href="https://github.com/kvasdopil/docker/blob/freebsd-compat/FREEBSD-PORTING.md" rel="nofollow">details and directions</a> are available to read if you&#39;d like to give it a try, as well as a list of which features work and which don&#39;t</li>
<li>There was also some <a href="https://news.ycombinator.com/item?id=9840025" rel="nofollow">Hacker News discussion</a> on the topic
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150708134520&mode=flat" rel="nofollow">Microsoft donates to OpenSSH</a></h3>

<ul>
<li>We&#39;ve talked about big businesses using BSD and contributing back before, even mentioning a few other large public donations - now it&#39;s Microsoft&#39;s turn</li>
<li>With their recent decision to integrate OpenSSH into an upcoming Windows release, Microsoft has donated a large sum of money to the OpenBSD foundation, making them a gold-level sponsor</li>
<li>They&#39;ve also posted some contract work offers on the OpenSSH mailing list, and say that their changes will be upstreamed if appropriate - we&#39;re always glad to see this
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2NqbhwOoH" rel="nofollow">Joe writes in</a></li>
<li><a href="http://slexy.org/view/s2T3NEia98" rel="nofollow">Mike writes in</a></li>
<li><a href="http://slexy.org/view/s20RlTK6Ha" rel="nofollow">Randy writes in</a></li>
<li><a href="http://slexy.org/view/s2rjCd0bGX" rel="nofollow">Tony writes in</a></li>
<li><a href="http://slexy.org/view/s21PfSIyG5" rel="nofollow">Kevin writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>96: Lost Technology</title>
  <link>https://www.bsdnow.tv/96</link>
  <guid isPermaLink="false">a1813e16-466a-4617-9bb0-24dbdc1cb5f2</guid>
  <pubDate>Wed, 01 Jul 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a1813e16-466a-4617-9bb0-24dbdc1cb5f2.mp3" length="52701844" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week, we'll be talking with Jun Ebihara about some lesser-known CPU architectures in NetBSD. He'll tell us what makes these old (and often forgotten) machines so interesting. As usual, we've also got answers to your emails and all this week's news on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:13:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week, we'll be talking with Jun Ebihara about some lesser-known CPU architectures in NetBSD. He'll tell us what makes these old (and often forgotten) machines so interesting. As usual, we've also got answers to your emails and all this week's news on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Out with the old, in with the less (http://www.tedunangst.com/flak/post/out-with-the-old-in-with-the-less)
Our friend Ted Unangst has a new article up, talking about "various OpenBSD replacements and reductions"
"Instead of trying to fix known bugs, we’re trying to fix unknown bugs. It’s not based on the current buggy state of the code, but the anticipated future buggy state of the code. Past bugs are a bigger factor than current bugs."
In the post, he goes through some of the bigger (and smaller) examples of OpenBSD rewriting tools to be simpler and more secure
It starts off with a lesser-known SCSI driver that "tried to do too much" being replaced with three separate drivers
"Each driver can now be modified in isolation without unintentional side effects on other hardware, or the need to consider if and where further special cases need to be added. Despite the fact that these three drivers duplicate all the common boilerplate code, combined they only amount to about half as much code as the old driver."
In contrast to that example, he goes on to cite mandoc as taking a very non "unixy" direction, but at the same time being smaller and simpler than all the tools it replaced
The next case is the new http daemon, and he talks a bit about the recently-added rewrite support being done in a simple and secure way (as opposed to regex and its craziness)
He also talks about the rewritten "file" utility: "Almost by definition, its sole input will be untrusted input. Perversely, people will then trust what file tells them and then go about using that input, as if file somehow sanitized it."
Finally, sudo in OpenBSD's base system is moving to ports soon, and the article briefly describes a new tool that may or may not replace it (https://marc.info/?l=openbsd-ports&amp;amp;m=143481227122523&amp;amp;w=2), called "doas"
There's also a nice wrap-up of all the examples at the end, and the "Pruning and Polishing (http://www.openbsd.org/papers/pruning.html)" talk is good complementary reading material
***
More OpenZFS and BSDCan videos (https://www.youtube.com/channel/UC0IK6Y4Go2KtRueHDiQcxow/videos)
We mentioned last week (http://www.bsdnow.tv/episodes/2015_06_24-bitrot_group_therapy) that some of the videos from the second OpenZFS conference in Europe were being uploaded - here's some more
Matt Ahrens did a Q&amp;amp;A session (https://www.youtube.com/watch?v=I6fXZ_6OT5c) and talked about ZFS send and receive (https://www.youtube.com/watch?v=iY44jPMvxog), as well as giving an overview of OpenZFS (https://www.youtube.com/watch?v=RQlMDmnty80)
George Wilson talked about a performance retrospective (https://www.youtube.com/watch?v=KBI6rRGUv4E)
Toshiba (https://www.youtube.com/watch?v=sSi47-k78IM), Syneto (https://www.youtube.com/watch?v=Hhje5KEF5cE) and HGST (https://www.youtube.com/watch?v=aKgxXipss8k) also gave some talks about their companies and how they're using ZFS
As for BSDCan, more of their BSD presentations have been uploaded too...
Ryan Stone, PCI SR-IOV on FreeBSD (https://www.youtube.com/watch?v=INeMd-i5jzM)
George Neville-Neil, Measure Twice, Code Once (https://www.youtube.com/watch?v=LE4wMsP7zeA)
Kris Moore, Unifying jail and package management for PC-BSD, FreeNAS and FreeBSD (https://www.youtube.com/watch?v=qNYXqpJiFN0)
Warner Losh, I/O Scheduling in CAM (https://www.youtube.com/watch?v=3WqOLolj5EU)
Kirk McKusick, An Introduction to the Implementation of ZFS (https://www.youtube.com/watch?v=l-RCLgLxuSc)
Midori Kato, Extensions to FreeBSD Datacenter TCP for Incremental Deployment Support (https://www.youtube.com/watch?v=zZXvjhWcg_4)
Baptiste Daroussin, Packaging FreeBSD's (https://www.youtube.com/watch?v=Br6izhH5P1I) base system (https://www.youtube.com/watch?v=v7px6ktoDAI)
Matt Ahrens, New OpenZFS features supporting remote replication (https://www.youtube.com/watch?v=UOX7WDAjqso)
Ed Schouten, CloudABI Cloud computing meets fine-grained capabilities (https://www.youtube.com/watch?v=SVdF84x1EdA)
The audio of Ingo Schwarze's talk "mandoc: becoming the main BSD manual toolbox" got messed up, but there's an alternate recording here (http://www.bsdcan.org/2015/audio/mandoc.mp3), and the slides are here (http://www.openbsd.org/papers/bsdcan15-mandoc.pdf)
***
SMP steroids for PF (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143526329006942&amp;amp;w=2)
An Oracle employee that's been porting OpenBSD's PF to an upcoming Solaris release has sent in an interesting patch for review
Attached to the mail was what may be the beginnings of making native PF SMP-aware
Before you start partying, the road to SMP (specifically, giant lock removal) is a long and very complicated one, requiring every relevant bit of the stack to be written with it in mind - this is just one piece of the puzzle
The initial response (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143532243322281&amp;amp;w=2) has been quite positive though, with some back and forth (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143532963824548&amp;amp;w=2) between developers and the submitter
For now, let's be patient and see what happens
***
DragonFly 4.2.0 released (http://www.dragonflybsd.org/release42/)
DragonFlyBSD has released the next big update of their 4.x branch, complete with a decent amount of new features and fixes
i915 and Radeon graphics have been updated, and DragonFly can claim the title of first BSD with Broadwell support in a release
Sendmail in the base system has been replaced with their homegrown DragonFly Mail Agent, and there's a wiki page (http://www.dragonflybsd.com/docs/docs/newhandbook/mta/) about configuring it
They've also switched the default compiler to GCC 5, though why they've gone in that direction instead of embracing Clang is a mystery
The announcement page also contains a list of kernel changes, details on the audio and graphics updates, removal of the SCTP protocol, improvements to the temperature sensors, various userland utility fixes and a list of updates to third party tools
Work is continuing on the second generation HAMMER filesystem, and Matt Dillon provides a status update in the release announcement
There was also some hacker news discussion (https://news.ycombinator.com/item?id=9797932) you can check out, as well as upgrade instructions (http://lists.dragonflybsd.org/pipermail/users/2015-June/207801.html)
***
OpenSMTPD 5.7.1 released (https://opensmtpd.org/announces/release-5.7.1.txt)
The OpenSMTPD guys have just released version 5.7.1, a major milestone version that we mentioned recently
Crypto-related bits have been vastly improved: the RSA engine is now privilege-separated, TLS errors are handled more gracefully, ciphers and curve preferences can now be specified, the PKI interface has been reworked to allow custom CAs, SNI and certificate verification have been simplified and the DH parameters are now 2048 bit by default
The long-awaited filter API is now enabled by default, though still considered slightly experimental
Documentation has been improved quite a bit, with more examples and common use cases (as well as exotic ones)
Many more small additions and bugfixes were made, so check the changelog for the full list
Starting with 5.7.1, releases are now cryptographically (https://twitter.com/OpenSMTPD/status/613257722574839808) signed (https://www.opensmtpd.org/archives/opensmtpd-5.7.1.sum.sig) to ensure integrity
This release has gone through some major stress testing to ensure stability - Gilles regularly asks their Twitter followers to flood a test server (https://twitter.com/OpenSMTPD/status/608399272447471616) with thousands of emails per second, even offering prizes (https://twitter.com/OpenSMTPD/status/608235180839567360) to whoever can DDoS them the hardest
OpenSMTPD runs on all the BSDs of course, and seems to be getting pretty popular lately
Let's all encourage (mailto:feedback@bsdnow.tv) Kris to stop procrastinating on switching from Postfix
***
Interview - Jun Ebihara (蛯原純) - jun@netbsd.org (mailto:jun@netbsd.org) / @ebijun (https://twitter.com/ebijun)
Lesser-known CPU architectures, embedded NetBSD devices
News Roundup
FreeBSD foundation at BSDCan (http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-steven-douglas.html)
The FreeBSD foundation has posted a few BSDCan summaries on their blog
The first, from Steven Douglas, begins with a sentiment a lot of us can probably identify with: "Where I live, there are only a handful of people that even know what BSD is, let alone can talk at a high level about it. That was one of my favorite things, being around like minded people."
He got to meet a lot of the people working on big-name projects, and enjoyed being able to ask them questions so easily
Their second (http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-ahmed-kamal.html) trip report is from Ahmed Kamal, who flew in all the way from Egypt
A bit starstruck, he seems to have enjoyed all the talks, particularly Andrew Tanenbaum's about MINIX and NetBSD
There are also two more wrap-ups from Zbigniew Bodek (http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-zbigniew-bodek.html) and Vsevolod Stakhov (http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-vsevolod-stakhov.html), so you've got plenty to read
***
OpenBSD from a veteran Linux user perspective (http://cfenollosa.com/blog/openbsd-from-a-veteran-linux-user-perspective.html)
In a new series of blog posts, a self-proclaimed veteran Linux user is giving OpenBSD a try for the first time
"For the first time I installed a BSD box on a machine I control. The experience has been eye-opening, especially since I consider myself an 'old-school' Linux admin, and I've felt out of place with the latest changes on the system administration."
The post is a collection of his thoughts about what's different between Linux and BSD, what surprised him as a beginner - admittedly, a lot of his knowledge carried over, and there were just minor differences in command flags
One of the things that surprised him (in a positive way) was the documentation: "OpenBSD's man pages are so nice that RTFMing somebody on the internet is not condescending but selfless."
He also goes through some of the basics, installing and updating software, following different branches
It concludes with "If you like UNIX, it will open your eyes to the fact that there is more than one way to do things, and that system administration can still be simple while modern."
***
FreeBSD on the desktop, am I crazy (http://sysconfig.org.uk/freebsd-on-the-desktop-am-i-crazy.html)
Similar to the previous article, the guy that wrote the SSH two factor authentication post we covered last week has another new article up - this time about FreeBSD on the desktop
He begins with a bit of forewarning for potential Linux switchers: "It certainly wasn't an easy journey, and I'm tempted to say do not try this at home to anybody who isn't going to leverage any of FreeBSD's strong points. Definitely don't try FreeBSD on the desktop if you haven't used it on servers or virtual machines before. It's got less in common with Linux than you might think."
With that out of the way, the list of positives is pretty large: a tidy base system, separation between base and ports, having the option to choose binary packages or ports, ZFS, jails, licensing and of course the lack of systemd
The rest of the post talks about some of the hurdles he had to overcome, namely with graphics and the infamous Adobe Flash
Also worth noting is that he found jails to be not only good for isolating daemons on a server, but pretty useful for desktop applications as well
In the end, he says it was worth all the trouble, and is even planning on converting his laptop to FreeBSD soon too
***
OpenIKED and Cisco CSR 1000v IPSEC (https://www.netflask.net/ipsec-ikev2-cisco-csr1000v-openiked/)
This article covers setting up a site-to-site IPSEC tunnel between a Cisco CSR 1000v router and an OpenBSD gateway running OpenIKED
What kind of networking blog post would be complete without a diagram where the internet is represented by a big cloud
There are lots of details (and example configuration files) for using IKEv2 and OpenBSD's built-in IKE daemon
It also goes to show that the BSDs generally play well with existing network infrastructure, so if you were a business that's afraid to try them… don't be
***
HardenedBSD improves stack randomization (https://github.com/HardenedBSD/hardenedBSD/commit/bd5cecb4dc7947a5e214fc100834399b4bffdee8)
The HardenedBSD guys have improved their FreeBSD ASLR patchset, specifically in the stack randomization area
In their initial implementation, the stack randomization was a random gap - this update makes the base address randomized as well
They're now stacking the new on top of the old as well, with the goal being even more entropy
This change triggered an ABI and API incompatibility, so their major version has been bumped
***
OpenSSH 6.9 released (https://lists.mindrot.org/pipermail/openssh-unix-announce/2015-July/000121.html)
The OpenSSH team has announced the release of a new version which, following their tick/tock major/minor release cycle, is focused mainly on bug fixes
There are a couple new things though - the "AuthorizedKeysCommand" config option now takes custom arguments
One very notable change is that the default cipher has changed as of this release
The traditional pairing of AES128 in counter mode with MD5 HMAC has been replaced by the ever-trendy ChaCha20-Poly1305 combo
Their next release, 7.0, is set to get rid a number of legacy items: PermitRootLogin will be switched to "no" by default, SSHv1 support will be totally disabled, the 1024bit diffie-hellman-group1-sha1 KEX will be disabled, old ssh-dss and v00 certs will be removed, a number of weak ciphers will be disabled by default (including all CBC ones) and RSA keys will be refused if they're under 1024 bits
Many small bugs fixes and improvements were also made, so check the announcement for everything else
The native version is in OpenBSD -current, and an update to the portable version should be hitting a ports or pkgsrc tree near you soon
***
Feedback/Questions
Brad writes in (http://slexy.org/view/s2Ws6Y2rZy)
Mason writes in (http://slexy.org/view/s21GvZ5xbs)
Jochen writes in (http://slexy.org/view/s209TrPK4e)
Simon writes in (http://slexy.org/view/s21TQjUjxv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, osc, embedded, japanese, users group, pf, smp, multithreading, file, solaris, httpd, leap second, openzfs, zfs, opensmtpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week, we&#39;ll be talking with Jun Ebihara about some lesser-known CPU architectures in NetBSD. He&#39;ll tell us what makes these old (and often forgotten) machines so interesting. As usual, we&#39;ve also got answers to your emails and all this week&#39;s news on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/out-with-the-old-in-with-the-less" rel="nofollow">Out with the old, in with the less</a></h3>

<ul>
<li>Our friend Ted Unangst has a new article up, talking about &quot;various OpenBSD replacements and reductions&quot;</li>
<li>&quot;Instead of trying to fix known bugs, we’re trying to fix unknown bugs. It’s not based on the current buggy state of the code, but the anticipated future buggy state of the code. Past bugs are a bigger factor than current bugs.&quot;</li>
<li>In the post, he goes through some of the bigger (and smaller) examples of OpenBSD rewriting tools to be simpler and more secure</li>
<li>It starts off with a lesser-known SCSI driver that &quot;tried to do too much&quot; being replaced with three separate drivers</li>
<li>&quot;Each driver can now be modified in isolation without unintentional side effects on other hardware, or the need to consider if and where further special cases need to be added. Despite the fact that these three drivers duplicate all the common boilerplate code, combined they only amount to about half as much code as the old driver.&quot;</li>
<li>In contrast to that example, he goes on to cite mandoc as taking a very non &quot;unixy&quot; direction, but at the same time being smaller and simpler than all the tools it replaced</li>
<li>The next case is the new http daemon, and he talks a bit about the recently-added rewrite support being done in a simple and secure way (as opposed to regex and its craziness)</li>
<li>He also talks about the rewritten &quot;file&quot; utility: &quot;Almost by definition, its sole input will be untrusted input. Perversely, people will then trust what file tells them and then go about using that input, as if file somehow sanitized it.&quot;</li>
<li>Finally, sudo in OpenBSD&#39;s base system is moving to ports soon, and the article briefly describes a new tool that <a href="https://marc.info/?l=openbsd-ports&m=143481227122523&w=2" rel="nofollow">may or may not replace it</a>, called &quot;doas&quot;</li>
<li>There&#39;s also a nice wrap-up of all the examples at the end, and the &quot;<a href="http://www.openbsd.org/papers/pruning.html" rel="nofollow">Pruning and Polishing</a>&quot; talk is good complementary reading material
***</li>
</ul>

<h3><a href="https://www.youtube.com/channel/UC0IK6Y4Go2KtRueHDiQcxow/videos" rel="nofollow">More OpenZFS and BSDCan videos</a></h3>

<ul>
<li>We mentioned <a href="http://www.bsdnow.tv/episodes/2015_06_24-bitrot_group_therapy" rel="nofollow">last week</a> that some of the videos from the second OpenZFS conference in Europe were being uploaded - here&#39;s some more</li>
<li>Matt Ahrens did <a href="https://www.youtube.com/watch?v=I6fXZ_6OT5c" rel="nofollow">a Q&amp;A session</a> and talked about ZFS <a href="https://www.youtube.com/watch?v=iY44jPMvxog" rel="nofollow">send and receive</a>, as well as giving an <a href="https://www.youtube.com/watch?v=RQlMDmnty80" rel="nofollow">overview of OpenZFS</a></li>
<li>George Wilson talked about a <a href="https://www.youtube.com/watch?v=KBI6rRGUv4E" rel="nofollow">performance retrospective</a></li>
<li><a href="https://www.youtube.com/watch?v=sSi47-k78IM" rel="nofollow">Toshiba</a>, <a href="https://www.youtube.com/watch?v=Hhje5KEF5cE" rel="nofollow">Syneto</a> and <a href="https://www.youtube.com/watch?v=aKgxXipss8k" rel="nofollow">HGST</a> also gave some talks about their companies and how they&#39;re using ZFS</li>
<li>As for BSDCan, more of their BSD presentations have been uploaded too...</li>
<li>Ryan Stone, <a href="https://www.youtube.com/watch?v=INeMd-i5jzM" rel="nofollow">PCI SR-IOV on FreeBSD</a></li>
<li>George Neville-Neil, <a href="https://www.youtube.com/watch?v=LE4wMsP7zeA" rel="nofollow">Measure Twice, Code Once</a></li>
<li>Kris Moore, <a href="https://www.youtube.com/watch?v=qNYXqpJiFN0" rel="nofollow">Unifying jail and package management for PC-BSD, FreeNAS and FreeBSD</a></li>
<li>Warner Losh, <a href="https://www.youtube.com/watch?v=3WqOLolj5EU" rel="nofollow">I/O Scheduling in CAM</a></li>
<li>Kirk McKusick, <a href="https://www.youtube.com/watch?v=l-RCLgLxuSc" rel="nofollow">An Introduction to the Implementation of ZFS</a></li>
<li>Midori Kato, <a href="https://www.youtube.com/watch?v=zZXvjhWcg_4" rel="nofollow">Extensions to FreeBSD Datacenter TCP for Incremental Deployment Support</a></li>
<li>Baptiste Daroussin, <a href="https://www.youtube.com/watch?v=Br6izhH5P1I" rel="nofollow">Packaging FreeBSD&#39;s</a> <a href="https://www.youtube.com/watch?v=v7px6ktoDAI" rel="nofollow">base system</a></li>
<li>Matt Ahrens, <a href="https://www.youtube.com/watch?v=UOX7WDAjqso" rel="nofollow">New OpenZFS features supporting remote replication</a></li>
<li>Ed Schouten, <a href="https://www.youtube.com/watch?v=SVdF84x1EdA" rel="nofollow">CloudABI Cloud computing meets fine-grained capabilities</a></li>
<li>The audio of Ingo Schwarze&#39;s talk &quot;mandoc: becoming the main BSD manual toolbox&quot; got messed up, but there&#39;s an alternate recording <a href="http://www.bsdcan.org/2015/audio/mandoc.mp3" rel="nofollow">here</a>, and the slides are <a href="http://www.openbsd.org/papers/bsdcan15-mandoc.pdf" rel="nofollow">here</a>
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=143526329006942&w=2" rel="nofollow">SMP steroids for PF</a></h3>

<ul>
<li>An Oracle employee that&#39;s been porting OpenBSD&#39;s PF to an upcoming Solaris release has sent in an interesting patch for review</li>
<li>Attached to the mail was what may be the beginnings of making native PF SMP-aware</li>
<li>Before you start partying, the road to SMP (specifically, giant lock removal) is a long and very complicated one, requiring every relevant bit of the stack to be written with it in mind - this is just one piece of the puzzle</li>
<li>The <a href="https://www.marc.info/?l=openbsd-tech&m=143532243322281&w=2" rel="nofollow">initial response</a> has been quite positive though, with some <a href="https://www.marc.info/?l=openbsd-tech&m=143532963824548&w=2" rel="nofollow">back and forth</a> between developers and the submitter</li>
<li>For now, let&#39;s be patient and see what happens
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/release42/" rel="nofollow">DragonFly 4.2.0 released</a></h3>

<ul>
<li>DragonFlyBSD has released the next big update of their 4.x branch, complete with a decent amount of new features and fixes</li>
<li>i915 and Radeon graphics have been updated, and DragonFly can claim the title of first BSD with Broadwell support in a release</li>
<li>Sendmail in the base system has been replaced with their homegrown DragonFly Mail Agent, and there&#39;s <a href="http://www.dragonflybsd.com/docs/docs/newhandbook/mta/" rel="nofollow">a wiki page</a> about configuring it</li>
<li>They&#39;ve also switched the default compiler to GCC 5, though why they&#39;ve gone in that direction instead of embracing Clang is a mystery</li>
<li>The announcement page also contains a list of kernel changes, details on the audio and graphics updates, removal of the SCTP protocol, improvements to the temperature sensors, various userland utility fixes and a list of updates to third party tools</li>
<li>Work is continuing on the second generation HAMMER filesystem, and Matt Dillon provides a status update in the release announcement</li>
<li>There was also some <a href="https://news.ycombinator.com/item?id=9797932" rel="nofollow">hacker news discussion</a> you can check out, as well as <a href="http://lists.dragonflybsd.org/pipermail/users/2015-June/207801.html" rel="nofollow">upgrade instructions</a>
***</li>
</ul>

<h3><a href="https://opensmtpd.org/announces/release-5.7.1.txt" rel="nofollow">OpenSMTPD 5.7.1 released</a></h3>

<ul>
<li>The OpenSMTPD guys have just released version 5.7.1, a major milestone version that we mentioned recently</li>
<li>Crypto-related bits have been vastly improved: the RSA engine is now privilege-separated, TLS errors are handled more gracefully, ciphers and curve preferences can now be specified, the PKI interface has been reworked to allow custom CAs, SNI and certificate verification have been simplified and the DH parameters are now 2048 bit by default</li>
<li>The long-awaited filter API is now enabled by default, though still considered slightly experimental</li>
<li>Documentation has been improved quite a bit, with more examples and common use cases (as well as exotic ones)</li>
<li>Many more small additions and bugfixes were made, so check the changelog for the full list</li>
<li>Starting with 5.7.1, releases are now <a href="https://twitter.com/OpenSMTPD/status/613257722574839808" rel="nofollow">cryptographically</a> <a href="https://www.opensmtpd.org/archives/opensmtpd-5.7.1.sum.sig" rel="nofollow">signed</a> to ensure integrity</li>
<li>This release has gone through some major stress testing to ensure stability - Gilles regularly asks their Twitter followers to <a href="https://twitter.com/OpenSMTPD/status/608399272447471616" rel="nofollow">flood a test server</a> with thousands of emails per second, even <a href="https://twitter.com/OpenSMTPD/status/608235180839567360" rel="nofollow">offering prizes</a> to whoever can DDoS them the hardest</li>
<li>OpenSMTPD runs on all the BSDs of course, and seems to be getting pretty popular lately</li>
<li>Let&#39;s all <a href="mailto:feedback@bsdnow.tv" rel="nofollow">encourage</a> Kris to stop procrastinating on switching from Postfix
***</li>
</ul>

<h2>Interview - Jun Ebihara (蛯原純) - <a href="mailto:jun@netbsd.org" rel="nofollow">jun@netbsd.org</a> / <a href="https://twitter.com/ebijun" rel="nofollow">@ebijun</a></h2>

<p>Lesser-known CPU architectures, embedded NetBSD devices</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-steven-douglas.html" rel="nofollow">FreeBSD foundation at BSDCan</a></h3>

<ul>
<li>The FreeBSD foundation has posted a few BSDCan summaries on their blog</li>
<li>The first, from Steven Douglas, begins with a sentiment a lot of us can probably identify with: &quot;Where I live, there are only a handful of people that even know what BSD is, let alone can talk at a high level about it. That was one of my favorite things, being around like minded people.&quot;</li>
<li>He got to meet a lot of the people working on big-name projects, and enjoyed being able to ask them questions so easily</li>
<li>Their <a href="http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-ahmed-kamal.html" rel="nofollow">second</a> trip report is from Ahmed Kamal, who flew in all the way from Egypt</li>
<li>A bit starstruck, he seems to have enjoyed all the talks, particularly Andrew Tanenbaum&#39;s about MINIX and NetBSD</li>
<li>There are also two more wrap-ups from <a href="http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-zbigniew-bodek.html" rel="nofollow">Zbigniew Bodek</a> and <a href="http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-vsevolod-stakhov.html" rel="nofollow">Vsevolod Stakhov</a>, so you&#39;ve got plenty to read
***</li>
</ul>

<h3><a href="http://cfenollosa.com/blog/openbsd-from-a-veteran-linux-user-perspective.html" rel="nofollow">OpenBSD from a veteran Linux user perspective</a></h3>

<ul>
<li>In a new series of blog posts, a self-proclaimed veteran Linux user is giving OpenBSD a try for the first time</li>
<li>&quot;For the first time I installed a BSD box on a machine I control. The experience has been eye-opening, especially since I consider myself an &#39;old-school&#39; Linux admin, and I&#39;ve felt out of place with the latest changes on the system administration.&quot;</li>
<li>The post is a collection of his thoughts about what&#39;s different between Linux and BSD, what surprised him as a beginner - admittedly, a lot of his knowledge carried over, and there were just minor differences in command flags</li>
<li>One of the things that surprised him (in a positive way) was the documentation: &quot;OpenBSD&#39;s man pages are so nice that RTFMing somebody on the internet is not condescending but selfless.&quot;</li>
<li>He also goes through some of the basics, installing and updating software, following different branches</li>
<li>It concludes with &quot;If you like UNIX, it will open your eyes to the fact that there is more than one way to do things, and that system administration can still be simple while modern.&quot;
***</li>
</ul>

<h3><a href="http://sysconfig.org.uk/freebsd-on-the-desktop-am-i-crazy.html" rel="nofollow">FreeBSD on the desktop, am I crazy</a></h3>

<ul>
<li>Similar to the previous article, the guy that wrote the SSH two factor authentication post we covered last week has another new article up - this time about FreeBSD on the desktop</li>
<li>He begins with a bit of forewarning for potential Linux switchers: &quot;It certainly wasn&#39;t an easy journey, and I&#39;m tempted to say do not try this at home to anybody who isn&#39;t going to leverage any of FreeBSD&#39;s strong points. Definitely don&#39;t try FreeBSD on the desktop if you haven&#39;t used it on servers or virtual machines before. It&#39;s got less in common with Linux than you might think.&quot;</li>
<li>With that out of the way, the list of positives is pretty large: a tidy base system, separation between base and ports, having the option to choose binary packages or ports, ZFS, jails, licensing and of course the lack of systemd</li>
<li>The rest of the post talks about some of the hurdles he had to overcome, namely with graphics and the infamous Adobe Flash</li>
<li>Also worth noting is that he found jails to be not only good for isolating daemons on a server, but pretty useful for desktop applications as well</li>
<li>In the end, he says it was worth all the trouble, and is even planning on converting his laptop to FreeBSD soon too
***</li>
</ul>

<h3><a href="https://www.netflask.net/ipsec-ikev2-cisco-csr1000v-openiked/" rel="nofollow">OpenIKED and Cisco CSR 1000v IPSEC</a></h3>

<ul>
<li>This article covers setting up a site-to-site IPSEC tunnel between a Cisco CSR 1000v router and an OpenBSD gateway running OpenIKED</li>
<li>What kind of networking blog post would be complete without a diagram where the internet is represented by a big cloud</li>
<li>There are lots of details (and example configuration files) for using IKEv2 and OpenBSD&#39;s built-in IKE daemon</li>
<li>It also goes to show that the BSDs generally play well with existing network infrastructure, so if you were a business that&#39;s afraid to try them… don&#39;t be
***</li>
</ul>

<h3><a href="https://github.com/HardenedBSD/hardenedBSD/commit/bd5cecb4dc7947a5e214fc100834399b4bffdee8" rel="nofollow">HardenedBSD improves stack randomization</a></h3>

<ul>
<li>The HardenedBSD guys have improved their FreeBSD ASLR patchset, specifically in the stack randomization area</li>
<li>In their initial implementation, the stack randomization was a random gap - this update makes the base address randomized as well</li>
<li>They&#39;re now stacking the new on top of the old as well, with the goal being even more entropy</li>
<li>This change triggered an ABI and API incompatibility, so their major version has been bumped
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-announce/2015-July/000121.html" rel="nofollow">OpenSSH 6.9 released</a></h3>

<ul>
<li>The OpenSSH team has announced the release of a new version which, following their tick/tock major/minor release cycle, is focused mainly on bug fixes</li>
<li>There are a couple new things though - the &quot;AuthorizedKeysCommand&quot; config option now takes custom arguments</li>
<li>One very notable change is that <strong>the default cipher has changed</strong> as of this release</li>
<li>The traditional pairing of AES128 in counter mode with MD5 HMAC has been <em>replaced</em> by the ever-trendy ChaCha20-Poly1305 combo</li>
<li>Their next release, 7.0, is set to get rid a number of legacy items: PermitRootLogin will be switched to &quot;no&quot; by default, SSHv1 support will be totally disabled, the 1024bit diffie-hellman-group1-sha1 KEX will be disabled, old ssh-dss and v00 certs will be removed, a number of weak ciphers will be disabled by default (including all CBC ones) and RSA keys will be refused if they&#39;re under 1024 bits</li>
<li>Many small bugs fixes and improvements were also made, so check the announcement for everything else</li>
<li>The native version is in OpenBSD -current, and an update to the portable version should be hitting a ports or pkgsrc tree near you soon
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2Ws6Y2rZy" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s21GvZ5xbs" rel="nofollow">Mason writes in</a></li>
<li><a href="http://slexy.org/view/s209TrPK4e" rel="nofollow">Jochen writes in</a></li>
<li><a href="http://slexy.org/view/s21TQjUjxv" rel="nofollow">Simon writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week, we&#39;ll be talking with Jun Ebihara about some lesser-known CPU architectures in NetBSD. He&#39;ll tell us what makes these old (and often forgotten) machines so interesting. As usual, we&#39;ve also got answers to your emails and all this week&#39;s news on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/out-with-the-old-in-with-the-less" rel="nofollow">Out with the old, in with the less</a></h3>

<ul>
<li>Our friend Ted Unangst has a new article up, talking about &quot;various OpenBSD replacements and reductions&quot;</li>
<li>&quot;Instead of trying to fix known bugs, we’re trying to fix unknown bugs. It’s not based on the current buggy state of the code, but the anticipated future buggy state of the code. Past bugs are a bigger factor than current bugs.&quot;</li>
<li>In the post, he goes through some of the bigger (and smaller) examples of OpenBSD rewriting tools to be simpler and more secure</li>
<li>It starts off with a lesser-known SCSI driver that &quot;tried to do too much&quot; being replaced with three separate drivers</li>
<li>&quot;Each driver can now be modified in isolation without unintentional side effects on other hardware, or the need to consider if and where further special cases need to be added. Despite the fact that these three drivers duplicate all the common boilerplate code, combined they only amount to about half as much code as the old driver.&quot;</li>
<li>In contrast to that example, he goes on to cite mandoc as taking a very non &quot;unixy&quot; direction, but at the same time being smaller and simpler than all the tools it replaced</li>
<li>The next case is the new http daemon, and he talks a bit about the recently-added rewrite support being done in a simple and secure way (as opposed to regex and its craziness)</li>
<li>He also talks about the rewritten &quot;file&quot; utility: &quot;Almost by definition, its sole input will be untrusted input. Perversely, people will then trust what file tells them and then go about using that input, as if file somehow sanitized it.&quot;</li>
<li>Finally, sudo in OpenBSD&#39;s base system is moving to ports soon, and the article briefly describes a new tool that <a href="https://marc.info/?l=openbsd-ports&m=143481227122523&w=2" rel="nofollow">may or may not replace it</a>, called &quot;doas&quot;</li>
<li>There&#39;s also a nice wrap-up of all the examples at the end, and the &quot;<a href="http://www.openbsd.org/papers/pruning.html" rel="nofollow">Pruning and Polishing</a>&quot; talk is good complementary reading material
***</li>
</ul>

<h3><a href="https://www.youtube.com/channel/UC0IK6Y4Go2KtRueHDiQcxow/videos" rel="nofollow">More OpenZFS and BSDCan videos</a></h3>

<ul>
<li>We mentioned <a href="http://www.bsdnow.tv/episodes/2015_06_24-bitrot_group_therapy" rel="nofollow">last week</a> that some of the videos from the second OpenZFS conference in Europe were being uploaded - here&#39;s some more</li>
<li>Matt Ahrens did <a href="https://www.youtube.com/watch?v=I6fXZ_6OT5c" rel="nofollow">a Q&amp;A session</a> and talked about ZFS <a href="https://www.youtube.com/watch?v=iY44jPMvxog" rel="nofollow">send and receive</a>, as well as giving an <a href="https://www.youtube.com/watch?v=RQlMDmnty80" rel="nofollow">overview of OpenZFS</a></li>
<li>George Wilson talked about a <a href="https://www.youtube.com/watch?v=KBI6rRGUv4E" rel="nofollow">performance retrospective</a></li>
<li><a href="https://www.youtube.com/watch?v=sSi47-k78IM" rel="nofollow">Toshiba</a>, <a href="https://www.youtube.com/watch?v=Hhje5KEF5cE" rel="nofollow">Syneto</a> and <a href="https://www.youtube.com/watch?v=aKgxXipss8k" rel="nofollow">HGST</a> also gave some talks about their companies and how they&#39;re using ZFS</li>
<li>As for BSDCan, more of their BSD presentations have been uploaded too...</li>
<li>Ryan Stone, <a href="https://www.youtube.com/watch?v=INeMd-i5jzM" rel="nofollow">PCI SR-IOV on FreeBSD</a></li>
<li>George Neville-Neil, <a href="https://www.youtube.com/watch?v=LE4wMsP7zeA" rel="nofollow">Measure Twice, Code Once</a></li>
<li>Kris Moore, <a href="https://www.youtube.com/watch?v=qNYXqpJiFN0" rel="nofollow">Unifying jail and package management for PC-BSD, FreeNAS and FreeBSD</a></li>
<li>Warner Losh, <a href="https://www.youtube.com/watch?v=3WqOLolj5EU" rel="nofollow">I/O Scheduling in CAM</a></li>
<li>Kirk McKusick, <a href="https://www.youtube.com/watch?v=l-RCLgLxuSc" rel="nofollow">An Introduction to the Implementation of ZFS</a></li>
<li>Midori Kato, <a href="https://www.youtube.com/watch?v=zZXvjhWcg_4" rel="nofollow">Extensions to FreeBSD Datacenter TCP for Incremental Deployment Support</a></li>
<li>Baptiste Daroussin, <a href="https://www.youtube.com/watch?v=Br6izhH5P1I" rel="nofollow">Packaging FreeBSD&#39;s</a> <a href="https://www.youtube.com/watch?v=v7px6ktoDAI" rel="nofollow">base system</a></li>
<li>Matt Ahrens, <a href="https://www.youtube.com/watch?v=UOX7WDAjqso" rel="nofollow">New OpenZFS features supporting remote replication</a></li>
<li>Ed Schouten, <a href="https://www.youtube.com/watch?v=SVdF84x1EdA" rel="nofollow">CloudABI Cloud computing meets fine-grained capabilities</a></li>
<li>The audio of Ingo Schwarze&#39;s talk &quot;mandoc: becoming the main BSD manual toolbox&quot; got messed up, but there&#39;s an alternate recording <a href="http://www.bsdcan.org/2015/audio/mandoc.mp3" rel="nofollow">here</a>, and the slides are <a href="http://www.openbsd.org/papers/bsdcan15-mandoc.pdf" rel="nofollow">here</a>
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=143526329006942&w=2" rel="nofollow">SMP steroids for PF</a></h3>

<ul>
<li>An Oracle employee that&#39;s been porting OpenBSD&#39;s PF to an upcoming Solaris release has sent in an interesting patch for review</li>
<li>Attached to the mail was what may be the beginnings of making native PF SMP-aware</li>
<li>Before you start partying, the road to SMP (specifically, giant lock removal) is a long and very complicated one, requiring every relevant bit of the stack to be written with it in mind - this is just one piece of the puzzle</li>
<li>The <a href="https://www.marc.info/?l=openbsd-tech&m=143532243322281&w=2" rel="nofollow">initial response</a> has been quite positive though, with some <a href="https://www.marc.info/?l=openbsd-tech&m=143532963824548&w=2" rel="nofollow">back and forth</a> between developers and the submitter</li>
<li>For now, let&#39;s be patient and see what happens
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/release42/" rel="nofollow">DragonFly 4.2.0 released</a></h3>

<ul>
<li>DragonFlyBSD has released the next big update of their 4.x branch, complete with a decent amount of new features and fixes</li>
<li>i915 and Radeon graphics have been updated, and DragonFly can claim the title of first BSD with Broadwell support in a release</li>
<li>Sendmail in the base system has been replaced with their homegrown DragonFly Mail Agent, and there&#39;s <a href="http://www.dragonflybsd.com/docs/docs/newhandbook/mta/" rel="nofollow">a wiki page</a> about configuring it</li>
<li>They&#39;ve also switched the default compiler to GCC 5, though why they&#39;ve gone in that direction instead of embracing Clang is a mystery</li>
<li>The announcement page also contains a list of kernel changes, details on the audio and graphics updates, removal of the SCTP protocol, improvements to the temperature sensors, various userland utility fixes and a list of updates to third party tools</li>
<li>Work is continuing on the second generation HAMMER filesystem, and Matt Dillon provides a status update in the release announcement</li>
<li>There was also some <a href="https://news.ycombinator.com/item?id=9797932" rel="nofollow">hacker news discussion</a> you can check out, as well as <a href="http://lists.dragonflybsd.org/pipermail/users/2015-June/207801.html" rel="nofollow">upgrade instructions</a>
***</li>
</ul>

<h3><a href="https://opensmtpd.org/announces/release-5.7.1.txt" rel="nofollow">OpenSMTPD 5.7.1 released</a></h3>

<ul>
<li>The OpenSMTPD guys have just released version 5.7.1, a major milestone version that we mentioned recently</li>
<li>Crypto-related bits have been vastly improved: the RSA engine is now privilege-separated, TLS errors are handled more gracefully, ciphers and curve preferences can now be specified, the PKI interface has been reworked to allow custom CAs, SNI and certificate verification have been simplified and the DH parameters are now 2048 bit by default</li>
<li>The long-awaited filter API is now enabled by default, though still considered slightly experimental</li>
<li>Documentation has been improved quite a bit, with more examples and common use cases (as well as exotic ones)</li>
<li>Many more small additions and bugfixes were made, so check the changelog for the full list</li>
<li>Starting with 5.7.1, releases are now <a href="https://twitter.com/OpenSMTPD/status/613257722574839808" rel="nofollow">cryptographically</a> <a href="https://www.opensmtpd.org/archives/opensmtpd-5.7.1.sum.sig" rel="nofollow">signed</a> to ensure integrity</li>
<li>This release has gone through some major stress testing to ensure stability - Gilles regularly asks their Twitter followers to <a href="https://twitter.com/OpenSMTPD/status/608399272447471616" rel="nofollow">flood a test server</a> with thousands of emails per second, even <a href="https://twitter.com/OpenSMTPD/status/608235180839567360" rel="nofollow">offering prizes</a> to whoever can DDoS them the hardest</li>
<li>OpenSMTPD runs on all the BSDs of course, and seems to be getting pretty popular lately</li>
<li>Let&#39;s all <a href="mailto:feedback@bsdnow.tv" rel="nofollow">encourage</a> Kris to stop procrastinating on switching from Postfix
***</li>
</ul>

<h2>Interview - Jun Ebihara (蛯原純) - <a href="mailto:jun@netbsd.org" rel="nofollow">jun@netbsd.org</a> / <a href="https://twitter.com/ebijun" rel="nofollow">@ebijun</a></h2>

<p>Lesser-known CPU architectures, embedded NetBSD devices</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-steven-douglas.html" rel="nofollow">FreeBSD foundation at BSDCan</a></h3>

<ul>
<li>The FreeBSD foundation has posted a few BSDCan summaries on their blog</li>
<li>The first, from Steven Douglas, begins with a sentiment a lot of us can probably identify with: &quot;Where I live, there are only a handful of people that even know what BSD is, let alone can talk at a high level about it. That was one of my favorite things, being around like minded people.&quot;</li>
<li>He got to meet a lot of the people working on big-name projects, and enjoyed being able to ask them questions so easily</li>
<li>Their <a href="http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-ahmed-kamal.html" rel="nofollow">second</a> trip report is from Ahmed Kamal, who flew in all the way from Egypt</li>
<li>A bit starstruck, he seems to have enjoyed all the talks, particularly Andrew Tanenbaum&#39;s about MINIX and NetBSD</li>
<li>There are also two more wrap-ups from <a href="http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-zbigniew-bodek.html" rel="nofollow">Zbigniew Bodek</a> and <a href="http://freebsdfoundation.blogspot.com/2015/06/bsdcan-2015-trip-report-vsevolod-stakhov.html" rel="nofollow">Vsevolod Stakhov</a>, so you&#39;ve got plenty to read
***</li>
</ul>

<h3><a href="http://cfenollosa.com/blog/openbsd-from-a-veteran-linux-user-perspective.html" rel="nofollow">OpenBSD from a veteran Linux user perspective</a></h3>

<ul>
<li>In a new series of blog posts, a self-proclaimed veteran Linux user is giving OpenBSD a try for the first time</li>
<li>&quot;For the first time I installed a BSD box on a machine I control. The experience has been eye-opening, especially since I consider myself an &#39;old-school&#39; Linux admin, and I&#39;ve felt out of place with the latest changes on the system administration.&quot;</li>
<li>The post is a collection of his thoughts about what&#39;s different between Linux and BSD, what surprised him as a beginner - admittedly, a lot of his knowledge carried over, and there were just minor differences in command flags</li>
<li>One of the things that surprised him (in a positive way) was the documentation: &quot;OpenBSD&#39;s man pages are so nice that RTFMing somebody on the internet is not condescending but selfless.&quot;</li>
<li>He also goes through some of the basics, installing and updating software, following different branches</li>
<li>It concludes with &quot;If you like UNIX, it will open your eyes to the fact that there is more than one way to do things, and that system administration can still be simple while modern.&quot;
***</li>
</ul>

<h3><a href="http://sysconfig.org.uk/freebsd-on-the-desktop-am-i-crazy.html" rel="nofollow">FreeBSD on the desktop, am I crazy</a></h3>

<ul>
<li>Similar to the previous article, the guy that wrote the SSH two factor authentication post we covered last week has another new article up - this time about FreeBSD on the desktop</li>
<li>He begins with a bit of forewarning for potential Linux switchers: &quot;It certainly wasn&#39;t an easy journey, and I&#39;m tempted to say do not try this at home to anybody who isn&#39;t going to leverage any of FreeBSD&#39;s strong points. Definitely don&#39;t try FreeBSD on the desktop if you haven&#39;t used it on servers or virtual machines before. It&#39;s got less in common with Linux than you might think.&quot;</li>
<li>With that out of the way, the list of positives is pretty large: a tidy base system, separation between base and ports, having the option to choose binary packages or ports, ZFS, jails, licensing and of course the lack of systemd</li>
<li>The rest of the post talks about some of the hurdles he had to overcome, namely with graphics and the infamous Adobe Flash</li>
<li>Also worth noting is that he found jails to be not only good for isolating daemons on a server, but pretty useful for desktop applications as well</li>
<li>In the end, he says it was worth all the trouble, and is even planning on converting his laptop to FreeBSD soon too
***</li>
</ul>

<h3><a href="https://www.netflask.net/ipsec-ikev2-cisco-csr1000v-openiked/" rel="nofollow">OpenIKED and Cisco CSR 1000v IPSEC</a></h3>

<ul>
<li>This article covers setting up a site-to-site IPSEC tunnel between a Cisco CSR 1000v router and an OpenBSD gateway running OpenIKED</li>
<li>What kind of networking blog post would be complete without a diagram where the internet is represented by a big cloud</li>
<li>There are lots of details (and example configuration files) for using IKEv2 and OpenBSD&#39;s built-in IKE daemon</li>
<li>It also goes to show that the BSDs generally play well with existing network infrastructure, so if you were a business that&#39;s afraid to try them… don&#39;t be
***</li>
</ul>

<h3><a href="https://github.com/HardenedBSD/hardenedBSD/commit/bd5cecb4dc7947a5e214fc100834399b4bffdee8" rel="nofollow">HardenedBSD improves stack randomization</a></h3>

<ul>
<li>The HardenedBSD guys have improved their FreeBSD ASLR patchset, specifically in the stack randomization area</li>
<li>In their initial implementation, the stack randomization was a random gap - this update makes the base address randomized as well</li>
<li>They&#39;re now stacking the new on top of the old as well, with the goal being even more entropy</li>
<li>This change triggered an ABI and API incompatibility, so their major version has been bumped
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-announce/2015-July/000121.html" rel="nofollow">OpenSSH 6.9 released</a></h3>

<ul>
<li>The OpenSSH team has announced the release of a new version which, following their tick/tock major/minor release cycle, is focused mainly on bug fixes</li>
<li>There are a couple new things though - the &quot;AuthorizedKeysCommand&quot; config option now takes custom arguments</li>
<li>One very notable change is that <strong>the default cipher has changed</strong> as of this release</li>
<li>The traditional pairing of AES128 in counter mode with MD5 HMAC has been <em>replaced</em> by the ever-trendy ChaCha20-Poly1305 combo</li>
<li>Their next release, 7.0, is set to get rid a number of legacy items: PermitRootLogin will be switched to &quot;no&quot; by default, SSHv1 support will be totally disabled, the 1024bit diffie-hellman-group1-sha1 KEX will be disabled, old ssh-dss and v00 certs will be removed, a number of weak ciphers will be disabled by default (including all CBC ones) and RSA keys will be refused if they&#39;re under 1024 bits</li>
<li>Many small bugs fixes and improvements were also made, so check the announcement for everything else</li>
<li>The native version is in OpenBSD -current, and an update to the portable version should be hitting a ports or pkgsrc tree near you soon
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2Ws6Y2rZy" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s21GvZ5xbs" rel="nofollow">Mason writes in</a></li>
<li><a href="http://slexy.org/view/s209TrPK4e" rel="nofollow">Jochen writes in</a></li>
<li><a href="http://slexy.org/view/s21TQjUjxv" rel="nofollow">Simon writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>95: Bitrot Group Therapy</title>
  <link>https://www.bsdnow.tv/95</link>
  <guid isPermaLink="false">e712bc93-a45f-45ce-9d3a-e58ee627200c</guid>
  <pubDate>Wed, 24 Jun 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e712bc93-a45f-45ce-9d3a-e58ee627200c.mp3" length="54443956" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we'll be talking some ZFS with Sean Chittenden. He's been using it on FreeBSD at Groupon, and has some interesting stories about how it's saved his data. Answers to your emails and all of this week's headlines, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:15:36</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we'll be talking some ZFS with Sean Chittenden. He's been using it on FreeBSD at Groupon, and has some interesting stories about how it's saved his data. Answers to your emails and all of this week's headlines, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
More BSDCan 2015 videos (https://www.bsdcan.org/2015/schedule/)
Almost as if we said it would happen last week, more BSD-related presentation videos have been uploaded
Alexander Motin, Feature-rich and fast SCSI target with CTL and ZFS (https://www.youtube.com/watch?v=lBE4BfxVDQc)
Daichi Goto, FreeBSD for High Density Servers (https://www.youtube.com/watch?v=r2BoQ70bwK4)
Ken Moore, Lumina-DE (https://www.youtube.com/watch?v=Qh_YK9y4_Os)
Kevin Bowling, FreeBSD Operations at (https://www.youtube.com/watch?v=4l2rlRjkGhk) Limelight Networks (https://www.youtube.com/watch?v=K1-ZyiY5z48)
Maciej Pasternacki, Jetpack, a container (https://www.youtube.com/watch?v=8phbsAhJ-9w) runtime for FreeBSD (https://www.youtube.com/watch?v=kJ74mgkzLxc)
Ray Percival, Networking with OpenBSD in a virtualized environment (https://www.youtube.com/watch?v=gx5FILdSp2w)
Reyk Floeter, Introducing OpenBSD's (https://www.youtube.com/watch?v=DV1-EfdIp8I) new httpd (https://www.youtube.com/watch?v=_v0lI6qDWFs)
Still more to come, hopefully
***
OpenBSD httpd rewrite support (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143480475721221&amp;amp;w=2)
One of the most-requested features of OpenBSD's new HTTP daemon (in fact, you can hear someone asking about it in the video just above) is rewrite support
There were concerns about regex code being too complicated and potentially allowing another attack surface, so that was out
Instead, Reyk ported over an implementation of lua pattern matching while on the flight back from BSDCan, turning it into a C API without the lua bindings
In the mailing list post, he shows an example of how to use it for redirects and provides the diff (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143489473103114&amp;amp;w=2) if you'd like to give it a try now
It's since been committed (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=143507301715409&amp;amp;w=2) to -current, so you can try it out with a snapshot too
***
SSH 2FA on FreeBSD (http://sysconfig.org.uk/two-factor-authentication-with-ssh.html)
We've discussed different ways to lock down SSH access to your BSD boxes before - use keys instead of passwords, whitelist IPs, or even use two-factor authentication
This article serves as a sort of "roundup" on different methods to set up two-factor authentication on FreeBSD
It touches on key pairs with a server-side password, google authenticator and a few other variations
While the article is focused on FreeBSD, a lot of it can be easily applied to the others too
OpenSSH has a great security record, but two-factor authentication is always a good thing to have for the most important systems
***
NetBSD 7.0-RC1 released (https://blog.netbsd.org/tnf/entry/netbsd_7_0_rc1_binaries)
NetBSD has just announced the first release candidate for the 7.0 branch, after a long delay since the initial beta (11 months ago (http://www.bsdnow.tv/episodes/2014_07_23-des_challenge_iv))
Some of the standout features include: improved KMS/DRM with support for modern GPUs, SMP support on ARM, lots of new ARM boards officially supported, GPT support in the installer, Lua kernel scripting, a multiprocessor USB stack, improvements to NPF (their firewall) and, optionally, Clang 3.6.1
They're looking for as much testing as possible, so give it a try and report your findings to the release engineering team
***
Interview - Sean Chittenden - seanc@freebsd.org (mailto:seanc@freebsd.org) / @seanchittenden (https://twitter.com/seanchittenden)
FreeBSD at Groupon, ZFS
News Roundup
OpenSMTPD and Dovecot (http://www.tumfatig.net/20150620/opensmtpd-and-dovecot-on-openbsd-5-7/)
We've covered a number of OpenSMTPD mail server guides on the show, each with just a little something different to offer than the last
This blog post about it has something not mentioned before: virtual domains and virtual users
This means you can easily have "user1@domain.com" and "user2@otherdomain.com" both go to a local user on the box (or a different third address)
It also covers SSL certificates, blocking spam and setting up IMAP access, the usual
Now might also be a good time to test out OpenSMTPD 5.7.1-rc1 (https://www.mail-archive.com/misc@opensmtpd.org/msg02177.html), which we'll cover in more detail when it's released...
***
OctoPkg, a QT frontend to pkgng (https://github.com/aarnt/octopkg)
A PC-BSD user has begun porting over a graphical package management utility from Arch linux called Octopi (https://octopiproject.wordpress.com/about/)
Obviously, it needed to be rewritten to use FreeBSD's pkg system instead of pacman
There are some basic instructions on how to get it built and running on the github page
After some testing, it'll likely make its way to the FreeBSD ports tree
Tools like this might make it easier for desktop users (who are used to similar things in Ubuntu or related distros) to switch over
***
AFL vs. mandoc, a quantitative analysis (http://undeadly.org/cgi?action=article&amp;amp;sid=20150619071929)
Ingo Schwarze has written a pretty detailed article about how he and other OpenBSD developers have been fuzzing mandoc with AFL
It's meant to be accompanying material to his BSDCan talk, which already covered nine topics
mandoc is an interesting example to stress test with fuzzing, since its main job is to take and parse some highly varying input
The article breaks down the 45 different bugs that were found, based on their root cause
If you're interested in secure coding practices, this'll be a great one to read
***
OpenZFS conference videos (https://www.youtube.com/playlist?list=PLaUVvul17xScvtic0SPoks2MlQleyejks)
Videos from the second OpenZFS conference have just started to show up
The first talk is by, you guessed it, Matt Ahrens
In it, he covers some ZFS history, the Oracle takeover, the birth of illumos and OpenZFS, some administration basics and also some upcoming features that are being worked on
There are also videos from Nexenta (https://www.youtube.com/watch?v=5ciV4z7WWmo) and HGST (https://www.youtube.com/watch?v=a2lnMxMUxyc), talking about how they use and contribute to OpenZFS
***
Feedback/Questions
Bryson writes in (http://slexy.org/view/s2FqJfmeK3)
Kevin writes in (http://slexy.org/view/s20erRHahQ)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, fuzzing, mandoc, httpd, 7.0, opensmtpd, dovecot, bsdcan 2015, pkgng, groupon, ecommerce, zfs, bitrot, zpool, afl</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ll be talking some ZFS with Sean Chittenden. He&#39;s been using it on FreeBSD at Groupon, and has some interesting stories about how it&#39;s saved his data. Answers to your emails and all of this week&#39;s headlines, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2015/schedule/" rel="nofollow">More BSDCan 2015 videos</a></h3>

<ul>
<li>Almost as if we said it would happen last week, more BSD-related presentation videos have been uploaded</li>
<li>Alexander Motin, <a href="https://www.youtube.com/watch?v=lBE4BfxVDQc" rel="nofollow">Feature-rich and fast SCSI target with CTL and ZFS</a></li>
<li>Daichi Goto, <a href="https://www.youtube.com/watch?v=r2BoQ70bwK4" rel="nofollow">FreeBSD for High Density Servers</a></li>
<li>Ken Moore, <a href="https://www.youtube.com/watch?v=Qh_YK9y4_Os" rel="nofollow">Lumina-DE</a></li>
<li>Kevin Bowling, <a href="https://www.youtube.com/watch?v=4l2rlRjkGhk" rel="nofollow">FreeBSD Operations at</a> <a href="https://www.youtube.com/watch?v=K1-ZyiY5z48" rel="nofollow">Limelight Networks</a></li>
<li>Maciej Pasternacki, <a href="https://www.youtube.com/watch?v=8phbsAhJ-9w" rel="nofollow">Jetpack, a container</a> <a href="https://www.youtube.com/watch?v=kJ74mgkzLxc" rel="nofollow">runtime for FreeBSD</a></li>
<li>Ray Percival, <a href="https://www.youtube.com/watch?v=gx5FILdSp2w" rel="nofollow">Networking with OpenBSD in a virtualized environment</a></li>
<li>Reyk Floeter, <a href="https://www.youtube.com/watch?v=DV1-EfdIp8I" rel="nofollow">Introducing OpenBSD&#39;s</a> <a href="https://www.youtube.com/watch?v=_v0lI6qDWFs" rel="nofollow">new httpd</a></li>
<li>Still more to come, hopefully
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=143480475721221&w=2" rel="nofollow">OpenBSD httpd rewrite support</a></h3>

<ul>
<li>One of the most-requested features of OpenBSD&#39;s new HTTP daemon (in fact, you can hear someone asking about it in the video just above) is rewrite support</li>
<li>There were concerns about regex code being too complicated and potentially allowing another attack surface, so that was out</li>
<li>Instead, Reyk ported over an implementation of lua pattern matching while on the flight back from BSDCan, turning it into a C API without the lua bindings</li>
<li>In the mailing list post, he shows an example of how to use it for redirects and provides <a href="https://www.marc.info/?l=openbsd-tech&m=143489473103114&w=2" rel="nofollow">the diff</a> if you&#39;d like to give it a try now</li>
<li>It&#39;s since <a href="https://www.marc.info/?l=openbsd-cvs&m=143507301715409&w=2" rel="nofollow">been committed</a> to -current, so you can try it out with a snapshot too
***</li>
</ul>

<h3><a href="http://sysconfig.org.uk/two-factor-authentication-with-ssh.html" rel="nofollow">SSH 2FA on FreeBSD</a></h3>

<ul>
<li>We&#39;ve discussed different ways to lock down SSH access to your BSD boxes before - use keys instead of passwords, whitelist IPs, or even use two-factor authentication</li>
<li>This article serves as a sort of &quot;roundup&quot; on different methods to set up two-factor authentication on FreeBSD</li>
<li>It touches on key pairs with a server-side password, google authenticator and a few other variations</li>
<li>While the article is focused on FreeBSD, a lot of it can be easily applied to the others too</li>
<li>OpenSSH has a great security record, but two-factor authentication is always a good thing to have for the most important systems
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_7_0_rc1_binaries" rel="nofollow">NetBSD 7.0-RC1 released</a></h3>

<ul>
<li>NetBSD has just announced the first release candidate for the 7.0 branch, after a long delay since the initial beta (<a href="http://www.bsdnow.tv/episodes/2014_07_23-des_challenge_iv" rel="nofollow">11 months ago</a>)</li>
<li>Some of the standout features include: improved KMS/DRM with support for modern GPUs, SMP support on ARM, lots of new ARM boards officially supported, GPT support in the installer, Lua kernel scripting, a multiprocessor USB stack, improvements to NPF (their firewall) and, optionally, Clang 3.6.1</li>
<li>They&#39;re looking for as much testing as possible, so give it a try and report your findings to the release engineering team
***</li>
</ul>

<h2>Interview - Sean Chittenden - <a href="mailto:seanc@freebsd.org" rel="nofollow">seanc@freebsd.org</a> / <a href="https://twitter.com/seanchittenden" rel="nofollow">@seanchittenden</a></h2>

<p>FreeBSD at Groupon, ZFS</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.tumfatig.net/20150620/opensmtpd-and-dovecot-on-openbsd-5-7/" rel="nofollow">OpenSMTPD and Dovecot</a></h3>

<ul>
<li>We&#39;ve covered a number of OpenSMTPD mail server guides on the show, each with just a little something different to offer than the last</li>
<li>This blog post about it has something not mentioned before: virtual domains and virtual users</li>
<li>This means you can easily have &quot;<a href="mailto:user1@domain.com" rel="nofollow">user1@domain.com</a>&quot; and &quot;<a href="mailto:user2@otherdomain.com" rel="nofollow">user2@otherdomain.com</a>&quot; both go to a local user on the box (or a different third address)</li>
<li>It also covers SSL certificates, blocking spam and setting up IMAP access, the usual</li>
<li>Now might also be a good time to test out OpenSMTPD <a href="https://www.mail-archive.com/misc@opensmtpd.org/msg02177.html" rel="nofollow">5.7.1-rc1</a>, which we&#39;ll cover in more detail when it&#39;s released...
***</li>
</ul>

<h3><a href="https://github.com/aarnt/octopkg" rel="nofollow">OctoPkg, a QT frontend to pkgng</a></h3>

<ul>
<li>A PC-BSD user has begun porting over a graphical package management utility from Arch linux called <a href="https://octopiproject.wordpress.com/about/" rel="nofollow">Octopi</a></li>
<li>Obviously, it needed to be rewritten to use FreeBSD&#39;s pkg system instead of pacman</li>
<li>There are some basic instructions on how to get it built and running on the github page</li>
<li>After some testing, it&#39;ll likely make its way to the FreeBSD ports tree</li>
<li>Tools like this might make it easier for desktop users (who are used to similar things in Ubuntu or related distros) to switch over
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150619071929" rel="nofollow">AFL vs. mandoc, a quantitative analysis</a></h3>

<ul>
<li>Ingo Schwarze has written a pretty detailed article about how he and other OpenBSD developers have been fuzzing mandoc with AFL</li>
<li>It&#39;s meant to be accompanying material to his BSDCan talk, which already covered nine topics</li>
<li>mandoc is an interesting example to stress test with fuzzing, since its main job is to take and parse some highly varying input</li>
<li>The article breaks down the 45 different bugs that were found, based on their root cause</li>
<li>If you&#39;re interested in secure coding practices, this&#39;ll be a great one to read
***</li>
</ul>

<h3><a href="https://www.youtube.com/playlist?list=PLaUVvul17xScvtic0SPoks2MlQleyejks" rel="nofollow">OpenZFS conference videos</a></h3>

<ul>
<li>Videos from the second OpenZFS conference have just started to show up</li>
<li>The first talk is by, you guessed it, Matt Ahrens</li>
<li>In it, he covers some ZFS history, the Oracle takeover, the birth of illumos and OpenZFS, some administration basics and also some upcoming features that are being worked on</li>
<li>There are also videos <a href="https://www.youtube.com/watch?v=5ciV4z7WWmo" rel="nofollow">from Nexenta</a> <a href="https://www.youtube.com/watch?v=a2lnMxMUxyc" rel="nofollow">and HGST</a>, talking about how they use and contribute to OpenZFS
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2FqJfmeK3" rel="nofollow">Bryson writes in</a></li>
<li><a href="http://slexy.org/view/s20erRHahQ" rel="nofollow">Kevin writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ll be talking some ZFS with Sean Chittenden. He&#39;s been using it on FreeBSD at Groupon, and has some interesting stories about how it&#39;s saved his data. Answers to your emails and all of this week&#39;s headlines, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2015/schedule/" rel="nofollow">More BSDCan 2015 videos</a></h3>

<ul>
<li>Almost as if we said it would happen last week, more BSD-related presentation videos have been uploaded</li>
<li>Alexander Motin, <a href="https://www.youtube.com/watch?v=lBE4BfxVDQc" rel="nofollow">Feature-rich and fast SCSI target with CTL and ZFS</a></li>
<li>Daichi Goto, <a href="https://www.youtube.com/watch?v=r2BoQ70bwK4" rel="nofollow">FreeBSD for High Density Servers</a></li>
<li>Ken Moore, <a href="https://www.youtube.com/watch?v=Qh_YK9y4_Os" rel="nofollow">Lumina-DE</a></li>
<li>Kevin Bowling, <a href="https://www.youtube.com/watch?v=4l2rlRjkGhk" rel="nofollow">FreeBSD Operations at</a> <a href="https://www.youtube.com/watch?v=K1-ZyiY5z48" rel="nofollow">Limelight Networks</a></li>
<li>Maciej Pasternacki, <a href="https://www.youtube.com/watch?v=8phbsAhJ-9w" rel="nofollow">Jetpack, a container</a> <a href="https://www.youtube.com/watch?v=kJ74mgkzLxc" rel="nofollow">runtime for FreeBSD</a></li>
<li>Ray Percival, <a href="https://www.youtube.com/watch?v=gx5FILdSp2w" rel="nofollow">Networking with OpenBSD in a virtualized environment</a></li>
<li>Reyk Floeter, <a href="https://www.youtube.com/watch?v=DV1-EfdIp8I" rel="nofollow">Introducing OpenBSD&#39;s</a> <a href="https://www.youtube.com/watch?v=_v0lI6qDWFs" rel="nofollow">new httpd</a></li>
<li>Still more to come, hopefully
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=143480475721221&w=2" rel="nofollow">OpenBSD httpd rewrite support</a></h3>

<ul>
<li>One of the most-requested features of OpenBSD&#39;s new HTTP daemon (in fact, you can hear someone asking about it in the video just above) is rewrite support</li>
<li>There were concerns about regex code being too complicated and potentially allowing another attack surface, so that was out</li>
<li>Instead, Reyk ported over an implementation of lua pattern matching while on the flight back from BSDCan, turning it into a C API without the lua bindings</li>
<li>In the mailing list post, he shows an example of how to use it for redirects and provides <a href="https://www.marc.info/?l=openbsd-tech&m=143489473103114&w=2" rel="nofollow">the diff</a> if you&#39;d like to give it a try now</li>
<li>It&#39;s since <a href="https://www.marc.info/?l=openbsd-cvs&m=143507301715409&w=2" rel="nofollow">been committed</a> to -current, so you can try it out with a snapshot too
***</li>
</ul>

<h3><a href="http://sysconfig.org.uk/two-factor-authentication-with-ssh.html" rel="nofollow">SSH 2FA on FreeBSD</a></h3>

<ul>
<li>We&#39;ve discussed different ways to lock down SSH access to your BSD boxes before - use keys instead of passwords, whitelist IPs, or even use two-factor authentication</li>
<li>This article serves as a sort of &quot;roundup&quot; on different methods to set up two-factor authentication on FreeBSD</li>
<li>It touches on key pairs with a server-side password, google authenticator and a few other variations</li>
<li>While the article is focused on FreeBSD, a lot of it can be easily applied to the others too</li>
<li>OpenSSH has a great security record, but two-factor authentication is always a good thing to have for the most important systems
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_7_0_rc1_binaries" rel="nofollow">NetBSD 7.0-RC1 released</a></h3>

<ul>
<li>NetBSD has just announced the first release candidate for the 7.0 branch, after a long delay since the initial beta (<a href="http://www.bsdnow.tv/episodes/2014_07_23-des_challenge_iv" rel="nofollow">11 months ago</a>)</li>
<li>Some of the standout features include: improved KMS/DRM with support for modern GPUs, SMP support on ARM, lots of new ARM boards officially supported, GPT support in the installer, Lua kernel scripting, a multiprocessor USB stack, improvements to NPF (their firewall) and, optionally, Clang 3.6.1</li>
<li>They&#39;re looking for as much testing as possible, so give it a try and report your findings to the release engineering team
***</li>
</ul>

<h2>Interview - Sean Chittenden - <a href="mailto:seanc@freebsd.org" rel="nofollow">seanc@freebsd.org</a> / <a href="https://twitter.com/seanchittenden" rel="nofollow">@seanchittenden</a></h2>

<p>FreeBSD at Groupon, ZFS</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.tumfatig.net/20150620/opensmtpd-and-dovecot-on-openbsd-5-7/" rel="nofollow">OpenSMTPD and Dovecot</a></h3>

<ul>
<li>We&#39;ve covered a number of OpenSMTPD mail server guides on the show, each with just a little something different to offer than the last</li>
<li>This blog post about it has something not mentioned before: virtual domains and virtual users</li>
<li>This means you can easily have &quot;<a href="mailto:user1@domain.com" rel="nofollow">user1@domain.com</a>&quot; and &quot;<a href="mailto:user2@otherdomain.com" rel="nofollow">user2@otherdomain.com</a>&quot; both go to a local user on the box (or a different third address)</li>
<li>It also covers SSL certificates, blocking spam and setting up IMAP access, the usual</li>
<li>Now might also be a good time to test out OpenSMTPD <a href="https://www.mail-archive.com/misc@opensmtpd.org/msg02177.html" rel="nofollow">5.7.1-rc1</a>, which we&#39;ll cover in more detail when it&#39;s released...
***</li>
</ul>

<h3><a href="https://github.com/aarnt/octopkg" rel="nofollow">OctoPkg, a QT frontend to pkgng</a></h3>

<ul>
<li>A PC-BSD user has begun porting over a graphical package management utility from Arch linux called <a href="https://octopiproject.wordpress.com/about/" rel="nofollow">Octopi</a></li>
<li>Obviously, it needed to be rewritten to use FreeBSD&#39;s pkg system instead of pacman</li>
<li>There are some basic instructions on how to get it built and running on the github page</li>
<li>After some testing, it&#39;ll likely make its way to the FreeBSD ports tree</li>
<li>Tools like this might make it easier for desktop users (who are used to similar things in Ubuntu or related distros) to switch over
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150619071929" rel="nofollow">AFL vs. mandoc, a quantitative analysis</a></h3>

<ul>
<li>Ingo Schwarze has written a pretty detailed article about how he and other OpenBSD developers have been fuzzing mandoc with AFL</li>
<li>It&#39;s meant to be accompanying material to his BSDCan talk, which already covered nine topics</li>
<li>mandoc is an interesting example to stress test with fuzzing, since its main job is to take and parse some highly varying input</li>
<li>The article breaks down the 45 different bugs that were found, based on their root cause</li>
<li>If you&#39;re interested in secure coding practices, this&#39;ll be a great one to read
***</li>
</ul>

<h3><a href="https://www.youtube.com/playlist?list=PLaUVvul17xScvtic0SPoks2MlQleyejks" rel="nofollow">OpenZFS conference videos</a></h3>

<ul>
<li>Videos from the second OpenZFS conference have just started to show up</li>
<li>The first talk is by, you guessed it, Matt Ahrens</li>
<li>In it, he covers some ZFS history, the Oracle takeover, the birth of illumos and OpenZFS, some administration basics and also some upcoming features that are being worked on</li>
<li>There are also videos <a href="https://www.youtube.com/watch?v=5ciV4z7WWmo" rel="nofollow">from Nexenta</a> <a href="https://www.youtube.com/watch?v=a2lnMxMUxyc" rel="nofollow">and HGST</a>, talking about how they use and contribute to OpenZFS
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2FqJfmeK3" rel="nofollow">Bryson writes in</a></li>
<li><a href="http://slexy.org/view/s20erRHahQ" rel="nofollow">Kevin writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>94: Builder's Insurance</title>
  <link>https://www.bsdnow.tv/94</link>
  <guid isPermaLink="false">62d29419-94fa-4252-89a9-581546c7e61d</guid>
  <pubDate>Wed, 17 Jun 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/62d29419-94fa-4252-89a9-581546c7e61d.mp3" length="61384180" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we'll be chatting with Marc Espie. He's recently added some additional security measures to dpb, OpenBSD's package building tool, and we'll find out why they're so important. We've also got all this week's news, answers to your emails and even a BSDCan wrap-up, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:25:15</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we'll be chatting with Marc Espie. He's recently added some additional security measures to dpb, OpenBSD's package building tool, and we'll find out why they're so important. We've also got all this week's news, answers to your emails and even a BSDCan wrap-up, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
BSDCan 2015 videos (https://www.bsdcan.org/2015/schedule/)
BSDCan just ended last week, but some of the BSD-related presentation videos are already online
Allan Jude, UCL for FreeBSD (https://www.youtube.com/watch?v=8l6bhKIDecg)
Andrew Cagney, What happens when a dwarf and a daemon start dancing by the light of the silvery moon? (https://www.youtube.com/watch?v=XDIcD4LR5HE)
Andy Tanenbaum, A reimplementation of NetBSD (https://www.youtube.com/watch?v=0pebP891V0c) using a MicroKernel (https://www.youtube.com/watch?v=Bu1JuwVfYTc)
Brooks Davis, CheriBSD: A research fork of FreeBSD (https://www.youtube.com/watch?v=DwCg-51vFAs)
Giuseppe Lettieri, Even faster VM networking with virtual passthrough (https://www.youtube.com/watch?v=Lo6wDCapo4k)
Joseph Mingrone, Molecular Evolution, Genomic Analysis and FreeBSD (https://www.youtube.com/watch?v=K2pnf1YcMTY)
Olivier Cochard-Labbe, Large-scale plug&amp;amp;play x86 network appliance deployment over Internet (https://www.youtube.com/watch?v=6jhSvdnu4k0)
Peter Hessler, Using routing domains / routing tables in a production network (https://www.youtube.com/watch?v=BizrC8Zr-YY)
Ryan Lortie, a stitch in time: jhbuild (https://www.youtube.com/watch?v=YSVFnM3_2Ik)
Ted Unangst, signify: Securing OpenBSD From Us To You (https://www.youtube.com/watch?v=9R5s3l-0wh0)
Many more still to come...
***
Documenting my BSD experience (http://pid1.com/posts/post1.html)
Increasingly common scenario: a long-time Linux user (since the mid-90s) decides it's finally time to give BSD a try
"That night I came home, I had been trying to find out everything I could about BSD and I watched many videos, read forums, etc. One of the shows I found was BSD Now. I saw that they helped people and answered questions, so I decided to write in."
In this ongoing series of blog posts, a user named Michael writes about his initial experiences with trying different BSDs for some different tasks
The first post covers ZFS on FreeBSD, used to build a file server for his house (and of course he lists the hardware, if you're into that)
You get a glimpse of a brand new user trying things out, learning how great ZFS-based RAID arrays are and even some of the initial hurdles someone could run into
He's also looking to venture into the realm of replacing some of his VMs with jails and bhyve soon
His second post (http://pid1.com/posts/post2.html) explores replacing the firewall on his self-described "over complicated home network" with an OpenBSD box
After going from ipfwadmin to ipchains to iptables, not even making it to nftables, he found the simple PF syntax to be really refreshing
All the tools for his networking needs, the majority of which are in the base system, worked quickly and were easy to understand
Getting to hear experiences like this are very important - they show areas where all the BSD developers' hard work has paid off, but can also let us know where we need to improve
***
PC-BSD tries HardenedBSD builds (https://github.com/pcbsd/hardenedBSD-stable)
The PC-BSD team has created a new branch of their git repo with the HardenedBSD ASLR patches integrated
They're not the first major FreeBSD-based project to offer an alternate build - OPNsense did that (https://hardenedbsd.org/article/shawn-webb/2015-05-08/hardenedbsd-teams-opnsense) a few weeks ago - but this might open the door for more projects to give it a try as well
With Personacrypt, OpenNTPD, LibreSSL and recent Tor integration through the tools, these additional memory protections will offer PC-BSD users even more security that a default FreeBSD install won't have
Time will tell if more projects and products like FreeNAS might be interested too
***
C-states in OpenBSD (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=143423172522625&amp;amp;w=2)
People who run BSD on their notebooks, you'll want to pay attention to this one
OpenBSD has recently committed some ACPI improvements for deep C-states (http://www.hardwaresecrets.com/article/Everything-You-Need-to-Know-About-the-CPU-C-States-Power-Saving-Modes/611), enabling the processor to enter a low-power mode
According (https://twitter.com/StevenUniq/status/610586711358316545) to a (https://www.marc.info/?l=openbsd-misc&amp;amp;m=143430996602802&amp;amp;w=2) few users (https://www.marc.info/?l=openbsd-misc&amp;amp;m=143429914700826&amp;amp;w=2) so far (https://www.marc.info/?l=openbsd-misc&amp;amp;m=143425943026225&amp;amp;w=2), the change has resulted in dramatically lower CPU temperatures on their laptops, as well as much better battery life
If you're running OpenBSD -current on a laptop, try out the latest snapshot and report back (https://www.marc.info/?l=openbsd-misc&amp;amp;m=143423391222952&amp;amp;w=2) with your findings
***
NetBSD at Open Source Conference 2015 Hokkaido (https://mail-index.netbsd.org/netbsd-advocacy/2015/06/13/msg000687.html)
The Japanese NetBSD users group never sleeps, and they've hit yet another open source conference
As is usually the case, lots of strange machines on display were running none other than NetBSD (though it was mostly ARM this time)
We'll be having one of these guys on the show next week to discuss some of the lesser-known NetBSD platforms
***
Interview - Marc Espie - espie@openbsd.org (mailto:espie@openbsd.org) / @espie_openbsd (https://twitter.com/espie_openbsd)
Recent (https://www.marc.info/?l=openbsd-ports&amp;amp;m=143051151521627&amp;amp;w=2) improvements (https://www.marc.info/?l=openbsd-ports&amp;amp;m=143151777209226&amp;amp;w=2) to OpenBSD's dpb (http://www.bsdnow.tv/tutorials/dpb) tool
News Roundup
Introducing xhyve, bhyve on OS X (https://github.com/mist64/xhyve/blob/master/README.md)
We've talked about FreeBSD's "bhyve" hypervisor a lot on the show, and now it's been ported to another OS
As the name "xhyve" might imply, it's a port of bhyve to Mac OS X 
Currently it only has support for virtualizing a few Linux distributions, but more guest systems can be added in the future
It runs entirely in userspace, and has no extra requirements beyond OS X 10.10 or newer
There are also a few examples (http://www.pagetable.com/?p=831) on how to use it
***
4K displays on DragonFlyBSD (http://www.dragonflybsd.org/docs/newhandbook/docs/newhandbook/4KDisplays/)
If you've been using DragonFly as a desktop, maybe with those nice Broadwell graphics, you'll be pleased to know that 4K displays work just fine
Matthew Dillon wrote up a wiki page about some of the specifics, including a couple gotchas
Some GUI applications might look weird on such a huge resolution, 
HDMI ports are mostly limited to a 30Hz refresh rate, and there are slightly steeper hardware requirements for a smooth experience
***
Sandboxing port daemons on OpenBSD (http://coderinaworldofcode.blogspot.com/2015/06/chrooting-mumble-server-on-openbsd.html)
We talked about different containment methods last week, and mentioned that a lot of the daemons in OpenBSD's base as chrooted by default - things from ports or packages don't always get the same treatment
This blog post uses a mumble server as an example, but you can apply it to any service from ports that doesn't chroot by default
It goes through the process of manually building a sandbox with all the libraries you'll need to run the daemon, and this setup will even wipe and refresh the chroot every time you restart it
With a few small changes, similar tricks could be done on the other BSDs as well - everybody has chroots
***
SmallWall 1.8.2 released (http://smallwall.freeforums.net/thread/44/version-1-8-2-released)
SmallWall is a relatively new BSD-based project that we've never covered before
It's an attempt to keep the old m0n0wall codebase going, and appears to have started around the time m0n0wall called it quits
They've just released the first official version (http://www.smallwall.org/download.html), so you can give it a try now
If you're interested in learning more about SmallWall, the lead developer just might be on the show in a few weeks...
***
Feedback/Questions
David writes in (http://slexy.org/view/s21gRTNnk7)
Brian writes in (http://slexy.org/view/s2DdiMvELg)
Dan writes in (http://slexy.org/view/s2h4ZS6SMd)
Joel writes in (http://slexy.org/view/s20kA1jeXY)
Steve writes in (http://slexy.org/view/s2wJ9HP1bs)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, dpb, poudriere, pbulk, packages, ports, distributed, bsdcan, pf, zfs, opnsense, pfsense, hardenedbsd, aslr, smallwall, m0n0wall, xhyve, bhyve</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we&#39;ll be chatting with Marc Espie. He&#39;s recently added some additional security measures to dpb, OpenBSD&#39;s package building tool, and we&#39;ll find out why they&#39;re so important. We&#39;ve also got all this week&#39;s news, answers to your emails and even a BSDCan wrap-up, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2015/schedule/" rel="nofollow">BSDCan 2015 videos</a></h3>

<ul>
<li>BSDCan just ended last week, but some of the BSD-related presentation videos are already online</li>
<li>Allan Jude, <a href="https://www.youtube.com/watch?v=8l6bhKIDecg" rel="nofollow">UCL for FreeBSD</a></li>
<li>Andrew Cagney, <a href="https://www.youtube.com/watch?v=XDIcD4LR5HE" rel="nofollow">What happens when a dwarf and a daemon start dancing by the light of the silvery moon?</a></li>
<li>Andy Tanenbaum, <a href="https://www.youtube.com/watch?v=0pebP891V0c" rel="nofollow">A reimplementation of NetBSD</a> <a href="https://www.youtube.com/watch?v=Bu1JuwVfYTc" rel="nofollow">using a MicroKernel</a></li>
<li>Brooks Davis, <a href="https://www.youtube.com/watch?v=DwCg-51vFAs" rel="nofollow">CheriBSD: A research fork of FreeBSD</a></li>
<li>Giuseppe Lettieri, <a href="https://www.youtube.com/watch?v=Lo6wDCapo4k" rel="nofollow">Even faster VM networking with virtual passthrough</a></li>
<li>Joseph Mingrone, <a href="https://www.youtube.com/watch?v=K2pnf1YcMTY" rel="nofollow">Molecular Evolution, Genomic Analysis and FreeBSD</a></li>
<li>Olivier Cochard-Labbe, <a href="https://www.youtube.com/watch?v=6jhSvdnu4k0" rel="nofollow">Large-scale plug&amp;play x86 network appliance deployment over Internet</a></li>
<li>Peter Hessler, <a href="https://www.youtube.com/watch?v=BizrC8Zr-YY" rel="nofollow">Using routing domains / routing tables in a production network</a></li>
<li>Ryan Lortie, <a href="https://www.youtube.com/watch?v=YSVFnM3_2Ik" rel="nofollow">a stitch in time: jhbuild</a></li>
<li>Ted Unangst, <a href="https://www.youtube.com/watch?v=9R5s3l-0wh0" rel="nofollow">signify: Securing OpenBSD From Us To You</a></li>
<li>Many more still to come...
***</li>
</ul>

<h3><a href="http://pid1.com/posts/post1.html" rel="nofollow">Documenting my BSD experience</a></h3>

<ul>
<li>Increasingly common scenario: a long-time Linux user (since the mid-90s) decides it&#39;s finally time to give BSD a try</li>
<li>&quot;That night I came home, I had been trying to find out everything I could about BSD and I watched many videos, read forums, etc. One of the shows I found was BSD Now. I saw that they helped people and answered questions, so I decided to write in.&quot;</li>
<li>In this ongoing series of blog posts, a user named Michael writes about his initial experiences with trying different BSDs for some different tasks</li>
<li>The first post covers ZFS on FreeBSD, used to build a file server for his house (and of course he lists the hardware, if you&#39;re into that)</li>
<li>You get a glimpse of a brand new user trying things out, learning how great ZFS-based RAID arrays are and even some of the initial hurdles someone could run into</li>
<li>He&#39;s also looking to venture into the realm of replacing some of his VMs with jails and bhyve soon</li>
<li>His <a href="http://pid1.com/posts/post2.html" rel="nofollow">second post</a> explores replacing the firewall on his self-described &quot;over complicated home network&quot; with an OpenBSD box</li>
<li>After going from ipfwadmin to ipchains to iptables, not even making it to nftables, he found the simple PF syntax to be really refreshing</li>
<li>All the tools for his networking needs, the majority of which are in the base system, worked quickly and were easy to understand</li>
<li>Getting to hear experiences like this are very important - they show areas where all the BSD developers&#39; hard work has paid off, but can also let us know where we need to improve
***</li>
</ul>

<h3><a href="https://github.com/pcbsd/hardenedBSD-stable" rel="nofollow">PC-BSD tries HardenedBSD builds</a></h3>

<ul>
<li>The PC-BSD team has created a new branch of their git repo with the HardenedBSD ASLR patches integrated</li>
<li>They&#39;re not the first major FreeBSD-based project to offer an alternate build - OPNsense <a href="https://hardenedbsd.org/article/shawn-webb/2015-05-08/hardenedbsd-teams-opnsense" rel="nofollow">did that</a> a few weeks ago - but this might open the door for more projects to give it a try as well</li>
<li>With Personacrypt, OpenNTPD, LibreSSL and recent Tor integration through the tools, these additional memory protections will offer PC-BSD users even more security that a default FreeBSD install won&#39;t have</li>
<li>Time will tell if more projects and products like FreeNAS might be interested too
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=143423172522625&w=2" rel="nofollow">C-states in OpenBSD</a></h3>

<ul>
<li>People who run BSD on their notebooks, you&#39;ll want to pay attention to this one</li>
<li>OpenBSD has recently committed some ACPI improvements for <a href="http://www.hardwaresecrets.com/article/Everything-You-Need-to-Know-About-the-CPU-C-States-Power-Saving-Modes/611" rel="nofollow">deep C-states</a>, enabling the processor to enter a low-power mode</li>
<li><a href="https://twitter.com/StevenUniq/status/610586711358316545" rel="nofollow">According</a> <a href="https://www.marc.info/?l=openbsd-misc&m=143430996602802&w=2" rel="nofollow">to a</a> <a href="https://www.marc.info/?l=openbsd-misc&m=143429914700826&w=2" rel="nofollow">few users</a> <a href="https://www.marc.info/?l=openbsd-misc&m=143425943026225&w=2" rel="nofollow">so far</a>, the change has resulted in dramatically lower CPU temperatures on their laptops, as well as much better battery life</li>
<li>If you&#39;re running OpenBSD -current on a laptop, try out the latest snapshot and <a href="https://www.marc.info/?l=openbsd-misc&m=143423391222952&w=2" rel="nofollow">report back</a> with your findings
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/06/13/msg000687.html" rel="nofollow">NetBSD at Open Source Conference 2015 Hokkaido</a></h3>

<ul>
<li>The Japanese NetBSD users group never sleeps, and they&#39;ve hit yet another open source conference</li>
<li>As is usually the case, lots of strange machines on display were running none other than NetBSD (though it was mostly ARM this time)</li>
<li>We&#39;ll be having one of these guys on the show next week to discuss some of the lesser-known NetBSD platforms
***</li>
</ul>

<h2>Interview - Marc Espie - <a href="mailto:espie@openbsd.org" rel="nofollow">espie@openbsd.org</a> / <a href="https://twitter.com/espie_openbsd" rel="nofollow">@espie_openbsd</a></h2>

<p><a href="https://www.marc.info/?l=openbsd-ports&m=143051151521627&w=2" rel="nofollow">Recent</a> <a href="https://www.marc.info/?l=openbsd-ports&m=143151777209226&w=2" rel="nofollow">improvements</a> to OpenBSD&#39;s <a href="http://www.bsdnow.tv/tutorials/dpb" rel="nofollow">dpb</a> tool</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/mist64/xhyve/blob/master/README.md" rel="nofollow">Introducing xhyve, bhyve on OS X</a></h3>

<ul>
<li>We&#39;ve talked about FreeBSD&#39;s &quot;bhyve&quot; hypervisor a lot on the show, and now it&#39;s been ported to another OS</li>
<li>As the name &quot;xhyve&quot; might imply, it&#39;s a port of bhyve to Mac OS X </li>
<li>Currently it only has support for virtualizing a few Linux distributions, but more guest systems can be added in the future</li>
<li>It runs entirely in userspace, and has no extra requirements beyond OS X 10.10 or newer</li>
<li>There are also <a href="http://www.pagetable.com/?p=831" rel="nofollow">a few examples</a> on how to use it
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/docs/newhandbook/docs/newhandbook/4KDisplays/" rel="nofollow">4K displays on DragonFlyBSD</a></h3>

<ul>
<li>If you&#39;ve been using DragonFly as a desktop, maybe with those nice Broadwell graphics, you&#39;ll be pleased to know that 4K displays work just fine</li>
<li>Matthew Dillon wrote up a wiki page about some of the specifics, including a couple gotchas</li>
<li>Some GUI applications might look weird on such a huge resolution, </li>
<li>HDMI ports are mostly limited to a 30Hz refresh rate, and there are slightly steeper hardware requirements for a smooth experience
***</li>
</ul>

<h3><a href="http://coderinaworldofcode.blogspot.com/2015/06/chrooting-mumble-server-on-openbsd.html" rel="nofollow">Sandboxing port daemons on OpenBSD</a></h3>

<ul>
<li>We talked about different containment methods last week, and mentioned that a lot of the daemons in OpenBSD&#39;s base as chrooted by default - things from ports or packages don&#39;t always get the same treatment</li>
<li>This blog post uses a mumble server as an example, but you can apply it to <em>any</em> service from ports that doesn&#39;t chroot by default</li>
<li>It goes through the process of manually building a sandbox with all the libraries you&#39;ll need to run the daemon, and this setup will even wipe and refresh the chroot every time you restart it</li>
<li>With a few small changes, similar tricks could be done on the other BSDs as well - everybody has chroots
***</li>
</ul>

<h3><a href="http://smallwall.freeforums.net/thread/44/version-1-8-2-released" rel="nofollow">SmallWall 1.8.2 released</a></h3>

<ul>
<li>SmallWall is a relatively new BSD-based project that we&#39;ve never covered before</li>
<li>It&#39;s an attempt to keep the old m0n0wall codebase going, and appears to have started around the time m0n0wall called it quits</li>
<li>They&#39;ve just released <a href="http://www.smallwall.org/download.html" rel="nofollow">the first official version</a>, so you can give it a try now</li>
<li>If you&#39;re interested in learning more about SmallWall, the lead developer just might be on the show in a few weeks...
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21gRTNnk7" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s2DdiMvELg" rel="nofollow">Brian writes in</a></li>
<li><a href="http://slexy.org/view/s2h4ZS6SMd" rel="nofollow">Dan writes in</a></li>
<li><a href="http://slexy.org/view/s20kA1jeXY" rel="nofollow">Joel writes in</a></li>
<li><a href="http://slexy.org/view/s2wJ9HP1bs" rel="nofollow">Steve writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we&#39;ll be chatting with Marc Espie. He&#39;s recently added some additional security measures to dpb, OpenBSD&#39;s package building tool, and we&#39;ll find out why they&#39;re so important. We&#39;ve also got all this week&#39;s news, answers to your emails and even a BSDCan wrap-up, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2015/schedule/" rel="nofollow">BSDCan 2015 videos</a></h3>

<ul>
<li>BSDCan just ended last week, but some of the BSD-related presentation videos are already online</li>
<li>Allan Jude, <a href="https://www.youtube.com/watch?v=8l6bhKIDecg" rel="nofollow">UCL for FreeBSD</a></li>
<li>Andrew Cagney, <a href="https://www.youtube.com/watch?v=XDIcD4LR5HE" rel="nofollow">What happens when a dwarf and a daemon start dancing by the light of the silvery moon?</a></li>
<li>Andy Tanenbaum, <a href="https://www.youtube.com/watch?v=0pebP891V0c" rel="nofollow">A reimplementation of NetBSD</a> <a href="https://www.youtube.com/watch?v=Bu1JuwVfYTc" rel="nofollow">using a MicroKernel</a></li>
<li>Brooks Davis, <a href="https://www.youtube.com/watch?v=DwCg-51vFAs" rel="nofollow">CheriBSD: A research fork of FreeBSD</a></li>
<li>Giuseppe Lettieri, <a href="https://www.youtube.com/watch?v=Lo6wDCapo4k" rel="nofollow">Even faster VM networking with virtual passthrough</a></li>
<li>Joseph Mingrone, <a href="https://www.youtube.com/watch?v=K2pnf1YcMTY" rel="nofollow">Molecular Evolution, Genomic Analysis and FreeBSD</a></li>
<li>Olivier Cochard-Labbe, <a href="https://www.youtube.com/watch?v=6jhSvdnu4k0" rel="nofollow">Large-scale plug&amp;play x86 network appliance deployment over Internet</a></li>
<li>Peter Hessler, <a href="https://www.youtube.com/watch?v=BizrC8Zr-YY" rel="nofollow">Using routing domains / routing tables in a production network</a></li>
<li>Ryan Lortie, <a href="https://www.youtube.com/watch?v=YSVFnM3_2Ik" rel="nofollow">a stitch in time: jhbuild</a></li>
<li>Ted Unangst, <a href="https://www.youtube.com/watch?v=9R5s3l-0wh0" rel="nofollow">signify: Securing OpenBSD From Us To You</a></li>
<li>Many more still to come...
***</li>
</ul>

<h3><a href="http://pid1.com/posts/post1.html" rel="nofollow">Documenting my BSD experience</a></h3>

<ul>
<li>Increasingly common scenario: a long-time Linux user (since the mid-90s) decides it&#39;s finally time to give BSD a try</li>
<li>&quot;That night I came home, I had been trying to find out everything I could about BSD and I watched many videos, read forums, etc. One of the shows I found was BSD Now. I saw that they helped people and answered questions, so I decided to write in.&quot;</li>
<li>In this ongoing series of blog posts, a user named Michael writes about his initial experiences with trying different BSDs for some different tasks</li>
<li>The first post covers ZFS on FreeBSD, used to build a file server for his house (and of course he lists the hardware, if you&#39;re into that)</li>
<li>You get a glimpse of a brand new user trying things out, learning how great ZFS-based RAID arrays are and even some of the initial hurdles someone could run into</li>
<li>He&#39;s also looking to venture into the realm of replacing some of his VMs with jails and bhyve soon</li>
<li>His <a href="http://pid1.com/posts/post2.html" rel="nofollow">second post</a> explores replacing the firewall on his self-described &quot;over complicated home network&quot; with an OpenBSD box</li>
<li>After going from ipfwadmin to ipchains to iptables, not even making it to nftables, he found the simple PF syntax to be really refreshing</li>
<li>All the tools for his networking needs, the majority of which are in the base system, worked quickly and were easy to understand</li>
<li>Getting to hear experiences like this are very important - they show areas where all the BSD developers&#39; hard work has paid off, but can also let us know where we need to improve
***</li>
</ul>

<h3><a href="https://github.com/pcbsd/hardenedBSD-stable" rel="nofollow">PC-BSD tries HardenedBSD builds</a></h3>

<ul>
<li>The PC-BSD team has created a new branch of their git repo with the HardenedBSD ASLR patches integrated</li>
<li>They&#39;re not the first major FreeBSD-based project to offer an alternate build - OPNsense <a href="https://hardenedbsd.org/article/shawn-webb/2015-05-08/hardenedbsd-teams-opnsense" rel="nofollow">did that</a> a few weeks ago - but this might open the door for more projects to give it a try as well</li>
<li>With Personacrypt, OpenNTPD, LibreSSL and recent Tor integration through the tools, these additional memory protections will offer PC-BSD users even more security that a default FreeBSD install won&#39;t have</li>
<li>Time will tell if more projects and products like FreeNAS might be interested too
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=143423172522625&w=2" rel="nofollow">C-states in OpenBSD</a></h3>

<ul>
<li>People who run BSD on their notebooks, you&#39;ll want to pay attention to this one</li>
<li>OpenBSD has recently committed some ACPI improvements for <a href="http://www.hardwaresecrets.com/article/Everything-You-Need-to-Know-About-the-CPU-C-States-Power-Saving-Modes/611" rel="nofollow">deep C-states</a>, enabling the processor to enter a low-power mode</li>
<li><a href="https://twitter.com/StevenUniq/status/610586711358316545" rel="nofollow">According</a> <a href="https://www.marc.info/?l=openbsd-misc&m=143430996602802&w=2" rel="nofollow">to a</a> <a href="https://www.marc.info/?l=openbsd-misc&m=143429914700826&w=2" rel="nofollow">few users</a> <a href="https://www.marc.info/?l=openbsd-misc&m=143425943026225&w=2" rel="nofollow">so far</a>, the change has resulted in dramatically lower CPU temperatures on their laptops, as well as much better battery life</li>
<li>If you&#39;re running OpenBSD -current on a laptop, try out the latest snapshot and <a href="https://www.marc.info/?l=openbsd-misc&m=143423391222952&w=2" rel="nofollow">report back</a> with your findings
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/06/13/msg000687.html" rel="nofollow">NetBSD at Open Source Conference 2015 Hokkaido</a></h3>

<ul>
<li>The Japanese NetBSD users group never sleeps, and they&#39;ve hit yet another open source conference</li>
<li>As is usually the case, lots of strange machines on display were running none other than NetBSD (though it was mostly ARM this time)</li>
<li>We&#39;ll be having one of these guys on the show next week to discuss some of the lesser-known NetBSD platforms
***</li>
</ul>

<h2>Interview - Marc Espie - <a href="mailto:espie@openbsd.org" rel="nofollow">espie@openbsd.org</a> / <a href="https://twitter.com/espie_openbsd" rel="nofollow">@espie_openbsd</a></h2>

<p><a href="https://www.marc.info/?l=openbsd-ports&m=143051151521627&w=2" rel="nofollow">Recent</a> <a href="https://www.marc.info/?l=openbsd-ports&m=143151777209226&w=2" rel="nofollow">improvements</a> to OpenBSD&#39;s <a href="http://www.bsdnow.tv/tutorials/dpb" rel="nofollow">dpb</a> tool</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/mist64/xhyve/blob/master/README.md" rel="nofollow">Introducing xhyve, bhyve on OS X</a></h3>

<ul>
<li>We&#39;ve talked about FreeBSD&#39;s &quot;bhyve&quot; hypervisor a lot on the show, and now it&#39;s been ported to another OS</li>
<li>As the name &quot;xhyve&quot; might imply, it&#39;s a port of bhyve to Mac OS X </li>
<li>Currently it only has support for virtualizing a few Linux distributions, but more guest systems can be added in the future</li>
<li>It runs entirely in userspace, and has no extra requirements beyond OS X 10.10 or newer</li>
<li>There are also <a href="http://www.pagetable.com/?p=831" rel="nofollow">a few examples</a> on how to use it
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/docs/newhandbook/docs/newhandbook/4KDisplays/" rel="nofollow">4K displays on DragonFlyBSD</a></h3>

<ul>
<li>If you&#39;ve been using DragonFly as a desktop, maybe with those nice Broadwell graphics, you&#39;ll be pleased to know that 4K displays work just fine</li>
<li>Matthew Dillon wrote up a wiki page about some of the specifics, including a couple gotchas</li>
<li>Some GUI applications might look weird on such a huge resolution, </li>
<li>HDMI ports are mostly limited to a 30Hz refresh rate, and there are slightly steeper hardware requirements for a smooth experience
***</li>
</ul>

<h3><a href="http://coderinaworldofcode.blogspot.com/2015/06/chrooting-mumble-server-on-openbsd.html" rel="nofollow">Sandboxing port daemons on OpenBSD</a></h3>

<ul>
<li>We talked about different containment methods last week, and mentioned that a lot of the daemons in OpenBSD&#39;s base as chrooted by default - things from ports or packages don&#39;t always get the same treatment</li>
<li>This blog post uses a mumble server as an example, but you can apply it to <em>any</em> service from ports that doesn&#39;t chroot by default</li>
<li>It goes through the process of manually building a sandbox with all the libraries you&#39;ll need to run the daemon, and this setup will even wipe and refresh the chroot every time you restart it</li>
<li>With a few small changes, similar tricks could be done on the other BSDs as well - everybody has chroots
***</li>
</ul>

<h3><a href="http://smallwall.freeforums.net/thread/44/version-1-8-2-released" rel="nofollow">SmallWall 1.8.2 released</a></h3>

<ul>
<li>SmallWall is a relatively new BSD-based project that we&#39;ve never covered before</li>
<li>It&#39;s an attempt to keep the old m0n0wall codebase going, and appears to have started around the time m0n0wall called it quits</li>
<li>They&#39;ve just released <a href="http://www.smallwall.org/download.html" rel="nofollow">the first official version</a>, so you can give it a try now</li>
<li>If you&#39;re interested in learning more about SmallWall, the lead developer just might be on the show in a few weeks...
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21gRTNnk7" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s2DdiMvELg" rel="nofollow">Brian writes in</a></li>
<li><a href="http://slexy.org/view/s2h4ZS6SMd" rel="nofollow">Dan writes in</a></li>
<li><a href="http://slexy.org/view/s20kA1jeXY" rel="nofollow">Joel writes in</a></li>
<li><a href="http://slexy.org/view/s2wJ9HP1bs" rel="nofollow">Steve writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>93: Stacked in Our Favor</title>
  <link>https://www.bsdnow.tv/93</link>
  <guid isPermaLink="false">68a32090-b775-42f2-a1e5-50b8189800fa</guid>
  <pubDate>Wed, 10 Jun 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/68a32090-b775-42f2-a1e5-50b8189800fa.mp3" length="49138996" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We're at BSDCan this week, but fear not! We've got a great interview with Sepherosa Ziehau, a DragonFly developer, about their network stack. After that, we'll be discussing different methods of containment and privilege separation. Assuming no polar bears eat us, we'll be back next week with more BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:08:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We're at BSDCan this week, but fear not! We've got a great interview with Sepherosa Ziehau, a DragonFly developer, about their network stack. After that, we'll be discussing different methods of containment and privilege separation. Assuming no polar bears eat us, we'll be back next week with more BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Interview - Sepherosa Ziehau - sephe@dragonflybsd.org (mailto:sephe@dragonflybsd.org)
Features of DragonFlyBSD's network stack
Discussion
Comparing containment methods and privilege separation
chroot, jails, systrace, capsicum, filesystem permissions, separating users
***
Feedback/Questions
Brad writes in (http://slexy.org/view/s2GjCsGPef)
Anonymous writes in (http://slexy.org/view/s21jj3QgTj)
Benjamin writes in (http://slexy.org/view/s2irrhYfPT)
Jeroen writes in (http://slexy.org/view/s21gtuqXAe)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, network stack, bsdcan, systrace, capsicum, chroot, jails, privsep, casper, containers, docker, performance</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;re at BSDCan this week, but fear not! We&#39;ve got a great interview with Sepherosa Ziehau, a DragonFly developer, about their network stack. After that, we&#39;ll be discussing different methods of containment and privilege separation. Assuming no polar bears eat us, we&#39;ll be back next week with more BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Sepherosa Ziehau - <a href="mailto:sephe@dragonflybsd.org" rel="nofollow">sephe@dragonflybsd.org</a></h2>

<p>Features of DragonFlyBSD&#39;s network stack</p>

<hr>

<h2>Discussion</h2>

<h3>Comparing containment methods and privilege separation</h3>

<ul>
<li>chroot, jails, systrace, capsicum, filesystem permissions, separating users
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2GjCsGPef" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s21jj3QgTj" rel="nofollow">Anonymous writes in</a></li>
<li><a href="http://slexy.org/view/s2irrhYfPT" rel="nofollow">Benjamin writes in</a></li>
<li><a href="http://slexy.org/view/s21gtuqXAe" rel="nofollow">Jeroen writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;re at BSDCan this week, but fear not! We&#39;ve got a great interview with Sepherosa Ziehau, a DragonFly developer, about their network stack. After that, we&#39;ll be discussing different methods of containment and privilege separation. Assuming no polar bears eat us, we&#39;ll be back next week with more BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Interview - Sepherosa Ziehau - <a href="mailto:sephe@dragonflybsd.org" rel="nofollow">sephe@dragonflybsd.org</a></h2>

<p>Features of DragonFlyBSD&#39;s network stack</p>

<hr>

<h2>Discussion</h2>

<h3>Comparing containment methods and privilege separation</h3>

<ul>
<li>chroot, jails, systrace, capsicum, filesystem permissions, separating users
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2GjCsGPef" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s21jj3QgTj" rel="nofollow">Anonymous writes in</a></li>
<li><a href="http://slexy.org/view/s2irrhYfPT" rel="nofollow">Benjamin writes in</a></li>
<li><a href="http://slexy.org/view/s21gtuqXAe" rel="nofollow">Jeroen writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>92: BSD After Midnight</title>
  <link>https://www.bsdnow.tv/92</link>
  <guid isPermaLink="false">9d0d8811-2914-45e0-a34f-9638d2c4e761</guid>
  <pubDate>Wed, 03 Jun 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9d0d8811-2914-45e0-a34f-9638d2c4e761.mp3" length="48412372" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week, we'll be chatting with Lucas Holt, founder of MidnightBSD. It's a slightly lesser-known fork of FreeBSD, with a focus on easy desktop use. We'll find out what's different about it and why it was created. Answers to your emails and all this week's news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:07:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week, we'll be chatting with Lucas Holt, founder of MidnightBSD. It's a slightly lesser-known fork of FreeBSD, with a focus on easy desktop use. We'll find out what's different about it and why it was created. Answers to your emails and all this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Zocker, it's like docker on FreeBSD (http://toni.yweb.fi/2015/05/zocker-diy-docker-on-freebsd.html)
Containment is always a hot topic, and docker has gotten a lot of hype in Linux land in the last couple years - they're working on native FreeBSD support at the moment
This blog post is about a docker-like script, mainly for ease-of-use, that uses only jails and ZFS in the base system
In total, it's 1,500 lines of shell script (https://github.com/toddnni/zocker)
The post goes through the process of using the tool, showing off all the subcommands and explaining the configuration
In contrast to something like ezjail, Zocker utilizes the jail.conf system in the 10.x branch
***
Patrol Read in OpenBSD (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=143285964216970&amp;amp;w=4)
OpenBSD has recently imported some new code to support the Patrol Read (http://www.intel.com/support/motherboards/server/sb/CS-028742.htm) function of some RAID controllers
In a nutshell, Patrol Read is a function that lets you check the health of your drives in the background, similar to a zpool "scrub" operation
The goal is to protect file integrity by detecting drive failures before they can damage your data
It detects bad blocks and prevents silent data corruption, while marking any bad sectors it finds
***
HAMMER 2 improvements (http://lists.dragonflybsd.org/pipermail/commits/2015-May/418653.html)
DragonFly BSD has been working on the second generation HAMMER FS
It now uses LZ4 compression by default, which we've been big fans of in ZFS
They've also switched to a faster CRC (http://lists.dragonflybsd.org/pipermail/commits/2015-May/418652.html) algorithm, further improving HAMMER's performance, especially (http://lists.dragonflybsd.org/pipermail/commits/2015-May/418651.html) when using iSCSI
***
FreeBSD foundation May update (https://www.freebsdfoundation.org/press/2015mayupdate.pdf)
The FreeBSD foundation has published another update newsletter, detailing some of the things they've been up to lately
In it, you'll find some development status updates: notably more ARM64 work and the addition of 64 bit Linux emulation
Some improvements were also made to FreeBSD's release building process for non-X86 architectures
There's also an AsiaBSDCon recap that covers some of the presentations and the dev events
They also have an accompanying blog post (http://freebsdfoundation.blogspot.com/2015/05/another-data-center-site-visit-nyi.html) where Glen Barber talks about more sysadmin and clusteradm work at NYI
***
Interview - Lucas Holt - questions@midnightbsd.org (mailto:questions@midnightbsd.org) / @midnightbsd (https://twitter.com/midnightbsd)
MidnightBSD
News Roundup
The launchd on train is never coming (http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/launchd-on-bsd.html)
Replacement of init systems has been quite controversial in the last few years
Fortunately, the BSDs have avoided most of that conflict thus far, but there have been a few efforts made to port launchd from OS X (https://en.wikipedia.org/wiki/Launchd)
This blog post details the author's opinion on why he thinks we're never going to have launchd in any of the BSDs
Email us your thoughts on the matter
***
Native SSH comes to… Windows (http://blogs.msdn.com/b/looking_forward_microsoft__support_for_secure_shell_ssh1/archive/2015/06/02/managing-looking-forward-microsoft-support-for-secure-shell-ssh.aspx)
In what may be the first (and last) mention of Microsoft on BSD Now...
They've just recently announced that PowerShell will get native SSH support in the near future
It's not based on the commercial SSH either, it's the same one from OpenBSD that we already use everywhere
Up until now, interacting between BSD and Windows has required something like PuTTY, WinSCP, FileZilla or Cygwin - most of which are based on really outdated versions
The announcement also promises that they'll be working with the OpenSSH community, so we'll see how many Microsoft-submitted patches make it upstream (or how many donations (http://www.openbsdfoundation.org/index.html) they make)
***
Moving to FreeBSD (http://www.textplain.net/blog/2015/moving-to-freebsd/)
This blog post describes a long-time Linux user's first BSD switching experience
The author first talks about his Linux journey, eventually coming to love the more customization-friendly systems, but the journey ended with systemd
After doing a bit of research, he gave FreeBSD a try and ended up liking it - the rest of the post mostly covers why that is
He also plans to write about his experience with other BSDs, and is writing some tutorials too - we'll check in with him again later on
***
Feedback/Questions
Adam writes in (http://slexy.org/view/s29hS2cI05)
Dan writes in (http://slexy.org/view/s20VRZYBsw)
Ivan writes in (http://slexy.org/view/s20bumJ5u9)
Josh writes in (http://slexy.org/view/s21BU6Pnka)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, midnightbsd, ghostbsd, zocker, docker, hammerfs, powershell, patrol read, openssh, launchd, bsdcan</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week, we&#39;ll be chatting with Lucas Holt, founder of MidnightBSD. It&#39;s a slightly lesser-known fork of FreeBSD, with a focus on easy desktop use. We&#39;ll find out what&#39;s different about it and why it was created. Answers to your emails and all this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://toni.yweb.fi/2015/05/zocker-diy-docker-on-freebsd.html" rel="nofollow">Zocker, it&#39;s like docker on FreeBSD</a></h3>

<ul>
<li>Containment is always a hot topic, and docker has gotten a lot of hype in Linux land in the last couple years - they&#39;re working on native FreeBSD support at the moment</li>
<li>This blog post is about a docker-<em>like</em> script, mainly for ease-of-use, that uses only jails and ZFS in the base system</li>
<li>In total, it&#39;s <a href="https://github.com/toddnni/zocker" rel="nofollow">1,500 lines of shell script</a></li>
<li>The post goes through the process of using the tool, showing off all the subcommands and explaining the configuration</li>
<li>In contrast to something like ezjail, Zocker utilizes the jail.conf system in the 10.x branch
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=143285964216970&w=4" rel="nofollow">Patrol Read in OpenBSD</a></h3>

<ul>
<li>OpenBSD has recently imported some new code to support the <a href="http://www.intel.com/support/motherboards/server/sb/CS-028742.htm" rel="nofollow">Patrol Read</a> function of some RAID controllers</li>
<li>In a nutshell, Patrol Read is a function that lets you check the health of your drives in the background, similar to a zpool &quot;scrub&quot; operation</li>
<li>The goal is to protect file integrity by detecting drive failures before they can damage your data</li>
<li>It detects bad blocks and prevents silent data corruption, while marking any bad sectors it finds
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-May/418653.html" rel="nofollow">HAMMER 2 improvements</a></h3>

<ul>
<li>DragonFly BSD has been working on the second generation HAMMER FS</li>
<li>It now uses LZ4 compression by default, which we&#39;ve been big fans of in ZFS</li>
<li>They&#39;ve also switched to a <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-May/418652.html" rel="nofollow">faster CRC</a> algorithm, further improving HAMMER&#39;s performance, <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-May/418651.html" rel="nofollow">especially</a> when using iSCSI
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/press/2015mayupdate.pdf" rel="nofollow">FreeBSD foundation May update</a></h3>

<ul>
<li>The FreeBSD foundation has published another update newsletter, detailing some of the things they&#39;ve been up to lately</li>
<li>In it, you&#39;ll find some development status updates: notably more ARM64 work and the addition of 64 bit Linux emulation</li>
<li>Some improvements were also made to FreeBSD&#39;s release building process for non-X86 architectures</li>
<li>There&#39;s also an AsiaBSDCon recap that covers some of the presentations and the dev events</li>
<li>They also have an accompanying <a href="http://freebsdfoundation.blogspot.com/2015/05/another-data-center-site-visit-nyi.html" rel="nofollow">blog post</a> where Glen Barber talks about more sysadmin and clusteradm work at NYI
***</li>
</ul>

<h2>Interview - Lucas Holt - <a href="mailto:questions@midnightbsd.org" rel="nofollow">questions@midnightbsd.org</a> / <a href="https://twitter.com/midnightbsd" rel="nofollow">@midnightbsd</a></h2>

<p>MidnightBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/launchd-on-bsd.html" rel="nofollow">The launchd on train is never coming</a></h3>

<ul>
<li>Replacement of init systems has been quite controversial in the last few years</li>
<li>Fortunately, the BSDs have avoided most of that conflict thus far, but there have been a few efforts made to port <a href="https://en.wikipedia.org/wiki/Launchd" rel="nofollow">launchd from OS X</a></li>
<li>This blog post details the author&#39;s opinion on why he thinks we&#39;re never going to have launchd in any of the BSDs</li>
<li>Email us your thoughts on the matter
***</li>
</ul>

<h3><a href="http://blogs.msdn.com/b/looking_forward_microsoft__support_for_secure_shell_ssh1/archive/2015/06/02/managing-looking-forward-microsoft-support-for-secure-shell-ssh.aspx" rel="nofollow">Native SSH comes to… Windows</a></h3>

<ul>
<li>In what may be the first (and last) mention of Microsoft on BSD Now...</li>
<li>They&#39;ve just recently announced that PowerShell will get native SSH support in the near future</li>
<li>It&#39;s not based on the commercial SSH either, it&#39;s the same one from OpenBSD that we already use everywhere</li>
<li>Up until now, interacting between BSD and Windows has required something like PuTTY, WinSCP, FileZilla or Cygwin - most of which are based on really outdated versions</li>
<li>The announcement also promises that they&#39;ll be working with the OpenSSH community, so we&#39;ll see how many Microsoft-submitted patches make it upstream (or how many <a href="http://www.openbsdfoundation.org/index.html" rel="nofollow">donations</a> they make)
***</li>
</ul>

<h3><a href="http://www.textplain.net/blog/2015/moving-to-freebsd/" rel="nofollow">Moving to FreeBSD</a></h3>

<ul>
<li>This blog post describes a long-time Linux user&#39;s first BSD switching experience</li>
<li>The author first talks about his Linux journey, eventually coming to love the more customization-friendly systems, but the journey ended with systemd</li>
<li>After doing a bit of research, he gave FreeBSD a try and ended up liking it - the rest of the post mostly covers why that is</li>
<li>He also plans to write about his experience with other BSDs, and is writing some tutorials too - we&#39;ll check in with him again later on
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s29hS2cI05" rel="nofollow">Adam writes in</a></li>
<li><a href="http://slexy.org/view/s20VRZYBsw" rel="nofollow">Dan writes in</a></li>
<li><a href="http://slexy.org/view/s20bumJ5u9" rel="nofollow">Ivan writes in</a></li>
<li><a href="http://slexy.org/view/s21BU6Pnka" rel="nofollow">Josh writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week, we&#39;ll be chatting with Lucas Holt, founder of MidnightBSD. It&#39;s a slightly lesser-known fork of FreeBSD, with a focus on easy desktop use. We&#39;ll find out what&#39;s different about it and why it was created. Answers to your emails and all this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://toni.yweb.fi/2015/05/zocker-diy-docker-on-freebsd.html" rel="nofollow">Zocker, it&#39;s like docker on FreeBSD</a></h3>

<ul>
<li>Containment is always a hot topic, and docker has gotten a lot of hype in Linux land in the last couple years - they&#39;re working on native FreeBSD support at the moment</li>
<li>This blog post is about a docker-<em>like</em> script, mainly for ease-of-use, that uses only jails and ZFS in the base system</li>
<li>In total, it&#39;s <a href="https://github.com/toddnni/zocker" rel="nofollow">1,500 lines of shell script</a></li>
<li>The post goes through the process of using the tool, showing off all the subcommands and explaining the configuration</li>
<li>In contrast to something like ezjail, Zocker utilizes the jail.conf system in the 10.x branch
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=143285964216970&w=4" rel="nofollow">Patrol Read in OpenBSD</a></h3>

<ul>
<li>OpenBSD has recently imported some new code to support the <a href="http://www.intel.com/support/motherboards/server/sb/CS-028742.htm" rel="nofollow">Patrol Read</a> function of some RAID controllers</li>
<li>In a nutshell, Patrol Read is a function that lets you check the health of your drives in the background, similar to a zpool &quot;scrub&quot; operation</li>
<li>The goal is to protect file integrity by detecting drive failures before they can damage your data</li>
<li>It detects bad blocks and prevents silent data corruption, while marking any bad sectors it finds
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2015-May/418653.html" rel="nofollow">HAMMER 2 improvements</a></h3>

<ul>
<li>DragonFly BSD has been working on the second generation HAMMER FS</li>
<li>It now uses LZ4 compression by default, which we&#39;ve been big fans of in ZFS</li>
<li>They&#39;ve also switched to a <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-May/418652.html" rel="nofollow">faster CRC</a> algorithm, further improving HAMMER&#39;s performance, <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-May/418651.html" rel="nofollow">especially</a> when using iSCSI
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/press/2015mayupdate.pdf" rel="nofollow">FreeBSD foundation May update</a></h3>

<ul>
<li>The FreeBSD foundation has published another update newsletter, detailing some of the things they&#39;ve been up to lately</li>
<li>In it, you&#39;ll find some development status updates: notably more ARM64 work and the addition of 64 bit Linux emulation</li>
<li>Some improvements were also made to FreeBSD&#39;s release building process for non-X86 architectures</li>
<li>There&#39;s also an AsiaBSDCon recap that covers some of the presentations and the dev events</li>
<li>They also have an accompanying <a href="http://freebsdfoundation.blogspot.com/2015/05/another-data-center-site-visit-nyi.html" rel="nofollow">blog post</a> where Glen Barber talks about more sysadmin and clusteradm work at NYI
***</li>
</ul>

<h2>Interview - Lucas Holt - <a href="mailto:questions@midnightbsd.org" rel="nofollow">questions@midnightbsd.org</a> / <a href="https://twitter.com/midnightbsd" rel="nofollow">@midnightbsd</a></h2>

<p>MidnightBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/launchd-on-bsd.html" rel="nofollow">The launchd on train is never coming</a></h3>

<ul>
<li>Replacement of init systems has been quite controversial in the last few years</li>
<li>Fortunately, the BSDs have avoided most of that conflict thus far, but there have been a few efforts made to port <a href="https://en.wikipedia.org/wiki/Launchd" rel="nofollow">launchd from OS X</a></li>
<li>This blog post details the author&#39;s opinion on why he thinks we&#39;re never going to have launchd in any of the BSDs</li>
<li>Email us your thoughts on the matter
***</li>
</ul>

<h3><a href="http://blogs.msdn.com/b/looking_forward_microsoft__support_for_secure_shell_ssh1/archive/2015/06/02/managing-looking-forward-microsoft-support-for-secure-shell-ssh.aspx" rel="nofollow">Native SSH comes to… Windows</a></h3>

<ul>
<li>In what may be the first (and last) mention of Microsoft on BSD Now...</li>
<li>They&#39;ve just recently announced that PowerShell will get native SSH support in the near future</li>
<li>It&#39;s not based on the commercial SSH either, it&#39;s the same one from OpenBSD that we already use everywhere</li>
<li>Up until now, interacting between BSD and Windows has required something like PuTTY, WinSCP, FileZilla or Cygwin - most of which are based on really outdated versions</li>
<li>The announcement also promises that they&#39;ll be working with the OpenSSH community, so we&#39;ll see how many Microsoft-submitted patches make it upstream (or how many <a href="http://www.openbsdfoundation.org/index.html" rel="nofollow">donations</a> they make)
***</li>
</ul>

<h3><a href="http://www.textplain.net/blog/2015/moving-to-freebsd/" rel="nofollow">Moving to FreeBSD</a></h3>

<ul>
<li>This blog post describes a long-time Linux user&#39;s first BSD switching experience</li>
<li>The author first talks about his Linux journey, eventually coming to love the more customization-friendly systems, but the journey ended with systemd</li>
<li>After doing a bit of research, he gave FreeBSD a try and ended up liking it - the rest of the post mostly covers why that is</li>
<li>He also plans to write about his experience with other BSDs, and is writing some tutorials too - we&#39;ll check in with him again later on
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s29hS2cI05" rel="nofollow">Adam writes in</a></li>
<li><a href="http://slexy.org/view/s20VRZYBsw" rel="nofollow">Dan writes in</a></li>
<li><a href="http://slexy.org/view/s20bumJ5u9" rel="nofollow">Ivan writes in</a></li>
<li><a href="http://slexy.org/view/s21BU6Pnka" rel="nofollow">Josh writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>91: Vox Populi</title>
  <link>https://www.bsdnow.tv/91</link>
  <guid isPermaLink="false">fb5f8b6c-3786-48ec-b8ed-0e2d4d62f539</guid>
  <pubDate>Wed, 27 May 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fb5f8b6c-3786-48ec-b8ed-0e2d4d62f539.mp3" length="52090996" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we've got something pretty different. We went to a Linux convention and asked various people if they've ever tried BSD and what they know about it. Stay tuned for that, all this week's news and, of course, answers to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:12:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we've got something pretty different. We went to a Linux convention and asked various people if they've ever tried BSD and what they know about it. Stay tuned for that, all this week's news and, of course, answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
LUKS in OpenBSD (https://www.marc.info/?l=openbsd-tech&amp;amp;m=143247114716771&amp;amp;w=2)
Last week, we were surprised to find out that DragonFlyBSD has support (http://leaf.dragonflybsd.org/cgi/web-man?command=cryptsetup&amp;amp;section=8) for dm-crypt (https://en.wikipedia.org/wiki/Dm-crypt), sometimes referred to as LUKS (Linux Unified Key Setup (https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup))
It looks like they might not be the only BSD with support for it for much longer, as OpenBSD is currently reviewing a patch for it as well
LUKS would presumably be an additional option in OpenBSD's softraid (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/softraid.4) system, which already provides native disk encryption
Support hasn't been officially committed yet, it's still going through testing, but the code is there if you want to try it out and report your findings
If enabled, this might pave the way for the first (semi-)cross platform encryption scheme since the demise of TrueCrypt (and maybe other BSDs will get it too in time)
***
FreeBSD gets 64bit Linux emulation (https://lists.freebsd.org/pipermail/svn-src-head/2015-May/072255.html)
For those who might be unfamiliar, FreeBSD has an emulation layer (https://www.freebsd.org/doc/handbook/linuxemu.html) to run Linux-only binaries (as rare as they may be)
The most common use case is for desktop users, enabling them to run proprietary applications like Adobe Flash or Skype
Similar systems can also be found in NetBSD (https://www.netbsd.org/docs/guide/en/chap-linux.html) and OpenBSD (http://www.openbsd.org/faq/faq9.html#Interact) (though disabled by default on the latter)
However, until now, it's only supported binaries compiled for the i386 architecture
This new update, already committed to -CURRENT, will open some new possibilities that weren't previously possible
Meanwhile, HardenedBSD considers removing the emulation layer (https://hardenedbsd.org/content/poll-linuxulator-removal) entirely
***
BSD at Open Source Conference 2015 Nagoya (https://mail-index.netbsd.org/netbsd-advocacy/2015/05/23/msg000686.html)
We've covered the Japanese NetBSD users group setting up lots of machines at various conferences in the past, but now they're expanding
Their latest report includes many of the NetBSD things you'd expect, but also a couple OpenBSD machines
Some of the NetBSD ones included a Power Mac G4, SHARP NetWalker, Cubieboard2 and the not-so-foreign Raspberry Pi
One new addition of interest is the OMRON LUNA88k, running the luna88k (http://www.openbsd.org/luna88k.html) port of OpenBSD
There was even an old cell phone running Windows games (https://twitter.com/tsutsuii/status/601458973338775553) on NetBSD
Check the mailing list post for some (https://pbs.twimg.com/media/CFrSmztWEAAS2uE.jpg) links (http://image.movapic.com/pic/m_201505230541335560130d49213.jpeg) to (http://image.movapic.com/pic/m_2015052305145455600ccea723a.jpeg) all (https://pbs.twimg.com/media/CFjPv9_UEAA8iEx.jpg:large) of (https://pbs.twimg.com/media/CD4k6ZUUMAA0tEM.jpg) the (https://pbs.twimg.com/media/CFqn1GXUsAAFuro.jpg) nice (https://pbs.twimg.com/media/CFdIS2IUkAAZvjc.jpg) pictures (https://pbs.twimg.com/media/CFf5mToUIAAFrRU.jpg)
***
LLVM introduces OpenMP support (http://blog.llvm.org/2015/05/openmp-support_22.html)
One of the things that has kept some people in the GCC camp is the lack of OpenMP (https://en.wikipedia.org/wiki/OpenMP) support in LLVM
According to the blog post, it "enables Clang users to harness full power of modern multi-core processors with vector units"
With Clang being the default in FreeBSD, Bitrig and OS X, and with some other BSDs exploring the option of switching, the need for this potential speed boost was definitely there
This could also open some doors for more BSD in the area of high performance computing, putting an end to the current Linux monopoly
***
Interview - Eric, FSF, John, Jose, Kris and Stewart
Various "man on the street" style mini-interviews
News Roundup
BSD-licensed gettext replacement (https://gitlab.com/worr/libintl/blob/master/src/usr.bin/gettext/gettext.c)
If you've ever installed ports on any of the BSDs, you've probably had GNU's gettext pulled in as a dependency
Wikipedia says "gettext is an internationalization and localization (i18n) system commonly used for writing multilingual programs on Unix-like computer operating systems"
A new BSD-licensed rewrite has begun, with the initial version being for NetBSD (but it's likely to be portable)
If you've got some coding skills, get involved with the project - the more freely-licensed replacements, the better
***
Unix history git repo (https://github.com/dspinellis/unix-history-repo)
A git repository was recently created to show off some Unix source code history
The repository contains 659 thousand commits and 2306 merges
You can see early 386BSD commits all the way up to some of the more modern FreeBSD code
If you want to browse through the giant codebase, it can be a great history lesson
***
PCBSD 10.1.2 and Lumina updates (http://blog.pcbsd.org/2015/05/hotfix-release-to-10-1-2-now-available/)
We mentioned 10.1.1 being released last week (and all the cool features a couple weeks before) but now 10.1.2 is out
This minor update contained a few hotfixes: RAID-Z installation, cache and log devices and the text-only installer in UEFI mode
There's also a new post (http://blog.pcbsd.org/2015/05/lumina-desktop-status-updatefaq/) on the PCBSD blog about Lumina, answering some frequently asked questions and giving a general status update
***
Feedback/Questions
Jake writes in (http://slexy.org/view/s25h4Biwzq)
Van writes in (http://slexy.org/view/s2AF0bGmL6)
Anonymous writes in (http://slexy.org/view/s20Ie1USFD)
Dominik writes in (http://slexy.org/view/s20vBtoKqL) (text answer (http://slexy.org/view/s20RjbIT5v))
Chris writes in (http://slexy.org/view/s20USR3WzT)
***
Mailing List Gold
Death by chocolate (https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-May/033945.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, lfnw, linuxfest northwest, fsf, rms, hammer fs, nagoya, osc, dm-crypt, luks, cryptography, openmp, clang, llvm</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we&#39;ve got something pretty different. We went to a Linux convention and asked various people if they&#39;ve ever tried BSD and what they know about it. Stay tuned for that, all this week&#39;s news and, of course, answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=143247114716771&w=2" rel="nofollow">LUKS in OpenBSD</a></h3>

<ul>
<li>Last week, we were surprised to find out that DragonFlyBSD <a href="http://leaf.dragonflybsd.org/cgi/web-man?command=cryptsetup&section=8" rel="nofollow">has support</a> for <a href="https://en.wikipedia.org/wiki/Dm-crypt" rel="nofollow">dm-crypt</a>, sometimes referred to as LUKS (<a href="https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup" rel="nofollow">Linux Unified Key Setup</a>)</li>
<li>It looks like they might not be the only BSD with support for it for much longer, as OpenBSD is currently reviewing a patch for it as well</li>
<li>LUKS would presumably be an additional option in OpenBSD&#39;s <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/softraid.4" rel="nofollow">softraid</a> system, which already provides native disk encryption</li>
<li>Support hasn&#39;t been officially committed yet, it&#39;s still going through testing, but the code is there if you want to try it out and report your findings</li>
<li><strong>If enabled</strong>, this might pave the way for the first (semi-)cross platform encryption scheme since the demise of TrueCrypt (and maybe other BSDs will get it too in time)
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-May/072255.html" rel="nofollow">FreeBSD gets 64bit Linux emulation</a></h3>

<ul>
<li>For those who might be unfamiliar, FreeBSD has an <a href="https://www.freebsd.org/doc/handbook/linuxemu.html" rel="nofollow">emulation layer</a> to run Linux-only binaries (as rare as they may be)</li>
<li>The most common use case is for desktop users, enabling them to run proprietary applications like Adobe Flash or Skype</li>
<li>Similar systems can also be found <a href="https://www.netbsd.org/docs/guide/en/chap-linux.html" rel="nofollow">in NetBSD</a> <a href="http://www.openbsd.org/faq/faq9.html#Interact" rel="nofollow">and OpenBSD</a> (though disabled by default on the latter)</li>
<li>However, until now, it&#39;s only supported binaries compiled for the i386 architecture</li>
<li>This new update, already committed to -CURRENT, will open some new possibilities that weren&#39;t previously possible</li>
<li>Meanwhile, HardenedBSD considers <a href="https://hardenedbsd.org/content/poll-linuxulator-removal" rel="nofollow">removing the emulation layer</a> entirely
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/05/23/msg000686.html" rel="nofollow">BSD at Open Source Conference 2015 Nagoya</a></h3>

<ul>
<li>We&#39;ve covered the Japanese NetBSD users group setting up lots of machines at various conferences in the past, but now they&#39;re expanding</li>
<li>Their latest report includes many of the NetBSD things you&#39;d expect, but also a couple OpenBSD machines</li>
<li>Some of the NetBSD ones included a Power Mac G4, SHARP NetWalker, Cubieboard2 and the not-so-foreign Raspberry Pi</li>
<li>One new addition of interest is the OMRON LUNA88k, running the <a href="http://www.openbsd.org/luna88k.html" rel="nofollow">luna88k</a> port of OpenBSD</li>
<li>There was even an old cell phone <a href="https://twitter.com/tsutsuii/status/601458973338775553" rel="nofollow">running Windows games</a> on NetBSD</li>
<li>Check the mailing list post for <a href="https://pbs.twimg.com/media/CFrSmztWEAAS2uE.jpg" rel="nofollow">some</a> <a href="http://image.movapic.com/pic/m_201505230541335560130d49213.jpeg" rel="nofollow">links</a> <a href="http://image.movapic.com/pic/m_2015052305145455600ccea723a.jpeg" rel="nofollow">to</a> <a href="https://pbs.twimg.com/media/CFjPv9_UEAA8iEx.jpg:large" rel="nofollow">all</a> <a href="https://pbs.twimg.com/media/CD4k6ZUUMAA0tEM.jpg" rel="nofollow">of</a> <a href="https://pbs.twimg.com/media/CFqn1GXUsAAFuro.jpg" rel="nofollow">the</a> <a href="https://pbs.twimg.com/media/CFdIS2IUkAAZvjc.jpg" rel="nofollow">nice</a> <a href="https://pbs.twimg.com/media/CFf5mToUIAAFrRU.jpg" rel="nofollow">pictures</a>
***</li>
</ul>

<h3><a href="http://blog.llvm.org/2015/05/openmp-support_22.html" rel="nofollow">LLVM introduces OpenMP support</a></h3>

<ul>
<li>One of the things that has kept some people in the GCC camp is the lack of <a href="https://en.wikipedia.org/wiki/OpenMP" rel="nofollow">OpenMP</a> support in LLVM</li>
<li>According to the blog post, it &quot;enables Clang users to harness full power of modern multi-core processors with vector units&quot;</li>
<li>With Clang being the default in FreeBSD, Bitrig and OS X, and with some other BSDs exploring the option of switching, the need for this potential speed boost was definitely there</li>
<li>This could also open some doors for more BSD in the area of high performance computing, putting an end to the current Linux monopoly
***</li>
</ul>

<h2>Interview - Eric, FSF, John, Jose, Kris and Stewart</h2>

<p>Various &quot;man on the street&quot; style mini-interviews</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://gitlab.com/worr/libintl/blob/master/src/usr.bin/gettext/gettext.c" rel="nofollow">BSD-licensed gettext replacement</a></h3>

<ul>
<li>If you&#39;ve ever installed ports on any of the BSDs, you&#39;ve probably had GNU&#39;s gettext pulled in as a dependency</li>
<li>Wikipedia says &quot;gettext is an internationalization and localization (i18n) system commonly used for writing multilingual programs on Unix-like computer operating systems&quot;</li>
<li>A new BSD-licensed rewrite has begun, with the initial version being for NetBSD (but it&#39;s likely to be portable)</li>
<li>If you&#39;ve got some coding skills, get involved with the project - the more freely-licensed replacements, the better
***</li>
</ul>

<h3><a href="https://github.com/dspinellis/unix-history-repo" rel="nofollow">Unix history git repo</a></h3>

<ul>
<li>A git repository was recently created to show off some Unix source code history</li>
<li>The repository contains 659 thousand commits and 2306 merges</li>
<li>You can see early 386BSD commits all the way up to some of the more modern FreeBSD code</li>
<li>If you want to browse through the <em>giant</em> codebase, it can be a great history lesson
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/05/hotfix-release-to-10-1-2-now-available/" rel="nofollow">PCBSD 10.1.2 and Lumina updates</a></h3>

<ul>
<li>We mentioned 10.1.1 being released last week (and all the cool features a couple weeks before) but now 10.1.2 is out</li>
<li>This minor update contained a few hotfixes: RAID-Z installation, cache and log devices and the text-only installer in UEFI mode</li>
<li>There&#39;s also a <a href="http://blog.pcbsd.org/2015/05/lumina-desktop-status-updatefaq/" rel="nofollow">new post</a> on the PCBSD blog about Lumina, answering some frequently asked questions and giving a general status update
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s25h4Biwzq" rel="nofollow">Jake writes in</a></li>
<li><a href="http://slexy.org/view/s2AF0bGmL6" rel="nofollow">Van writes in</a></li>
<li><a href="http://slexy.org/view/s20Ie1USFD" rel="nofollow">Anonymous writes in</a></li>
<li><a href="http://slexy.org/view/s20vBtoKqL" rel="nofollow">Dominik writes in</a> (<a href="http://slexy.org/view/s20RjbIT5v" rel="nofollow">text answer</a>)</li>
<li><a href="http://slexy.org/view/s20USR3WzT" rel="nofollow">Chris writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-May/033945.html" rel="nofollow">Death by chocolate</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we&#39;ve got something pretty different. We went to a Linux convention and asked various people if they&#39;ve ever tried BSD and what they know about it. Stay tuned for that, all this week&#39;s news and, of course, answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=143247114716771&w=2" rel="nofollow">LUKS in OpenBSD</a></h3>

<ul>
<li>Last week, we were surprised to find out that DragonFlyBSD <a href="http://leaf.dragonflybsd.org/cgi/web-man?command=cryptsetup&section=8" rel="nofollow">has support</a> for <a href="https://en.wikipedia.org/wiki/Dm-crypt" rel="nofollow">dm-crypt</a>, sometimes referred to as LUKS (<a href="https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup" rel="nofollow">Linux Unified Key Setup</a>)</li>
<li>It looks like they might not be the only BSD with support for it for much longer, as OpenBSD is currently reviewing a patch for it as well</li>
<li>LUKS would presumably be an additional option in OpenBSD&#39;s <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/softraid.4" rel="nofollow">softraid</a> system, which already provides native disk encryption</li>
<li>Support hasn&#39;t been officially committed yet, it&#39;s still going through testing, but the code is there if you want to try it out and report your findings</li>
<li><strong>If enabled</strong>, this might pave the way for the first (semi-)cross platform encryption scheme since the demise of TrueCrypt (and maybe other BSDs will get it too in time)
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-May/072255.html" rel="nofollow">FreeBSD gets 64bit Linux emulation</a></h3>

<ul>
<li>For those who might be unfamiliar, FreeBSD has an <a href="https://www.freebsd.org/doc/handbook/linuxemu.html" rel="nofollow">emulation layer</a> to run Linux-only binaries (as rare as they may be)</li>
<li>The most common use case is for desktop users, enabling them to run proprietary applications like Adobe Flash or Skype</li>
<li>Similar systems can also be found <a href="https://www.netbsd.org/docs/guide/en/chap-linux.html" rel="nofollow">in NetBSD</a> <a href="http://www.openbsd.org/faq/faq9.html#Interact" rel="nofollow">and OpenBSD</a> (though disabled by default on the latter)</li>
<li>However, until now, it&#39;s only supported binaries compiled for the i386 architecture</li>
<li>This new update, already committed to -CURRENT, will open some new possibilities that weren&#39;t previously possible</li>
<li>Meanwhile, HardenedBSD considers <a href="https://hardenedbsd.org/content/poll-linuxulator-removal" rel="nofollow">removing the emulation layer</a> entirely
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/05/23/msg000686.html" rel="nofollow">BSD at Open Source Conference 2015 Nagoya</a></h3>

<ul>
<li>We&#39;ve covered the Japanese NetBSD users group setting up lots of machines at various conferences in the past, but now they&#39;re expanding</li>
<li>Their latest report includes many of the NetBSD things you&#39;d expect, but also a couple OpenBSD machines</li>
<li>Some of the NetBSD ones included a Power Mac G4, SHARP NetWalker, Cubieboard2 and the not-so-foreign Raspberry Pi</li>
<li>One new addition of interest is the OMRON LUNA88k, running the <a href="http://www.openbsd.org/luna88k.html" rel="nofollow">luna88k</a> port of OpenBSD</li>
<li>There was even an old cell phone <a href="https://twitter.com/tsutsuii/status/601458973338775553" rel="nofollow">running Windows games</a> on NetBSD</li>
<li>Check the mailing list post for <a href="https://pbs.twimg.com/media/CFrSmztWEAAS2uE.jpg" rel="nofollow">some</a> <a href="http://image.movapic.com/pic/m_201505230541335560130d49213.jpeg" rel="nofollow">links</a> <a href="http://image.movapic.com/pic/m_2015052305145455600ccea723a.jpeg" rel="nofollow">to</a> <a href="https://pbs.twimg.com/media/CFjPv9_UEAA8iEx.jpg:large" rel="nofollow">all</a> <a href="https://pbs.twimg.com/media/CD4k6ZUUMAA0tEM.jpg" rel="nofollow">of</a> <a href="https://pbs.twimg.com/media/CFqn1GXUsAAFuro.jpg" rel="nofollow">the</a> <a href="https://pbs.twimg.com/media/CFdIS2IUkAAZvjc.jpg" rel="nofollow">nice</a> <a href="https://pbs.twimg.com/media/CFf5mToUIAAFrRU.jpg" rel="nofollow">pictures</a>
***</li>
</ul>

<h3><a href="http://blog.llvm.org/2015/05/openmp-support_22.html" rel="nofollow">LLVM introduces OpenMP support</a></h3>

<ul>
<li>One of the things that has kept some people in the GCC camp is the lack of <a href="https://en.wikipedia.org/wiki/OpenMP" rel="nofollow">OpenMP</a> support in LLVM</li>
<li>According to the blog post, it &quot;enables Clang users to harness full power of modern multi-core processors with vector units&quot;</li>
<li>With Clang being the default in FreeBSD, Bitrig and OS X, and with some other BSDs exploring the option of switching, the need for this potential speed boost was definitely there</li>
<li>This could also open some doors for more BSD in the area of high performance computing, putting an end to the current Linux monopoly
***</li>
</ul>

<h2>Interview - Eric, FSF, John, Jose, Kris and Stewart</h2>

<p>Various &quot;man on the street&quot; style mini-interviews</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://gitlab.com/worr/libintl/blob/master/src/usr.bin/gettext/gettext.c" rel="nofollow">BSD-licensed gettext replacement</a></h3>

<ul>
<li>If you&#39;ve ever installed ports on any of the BSDs, you&#39;ve probably had GNU&#39;s gettext pulled in as a dependency</li>
<li>Wikipedia says &quot;gettext is an internationalization and localization (i18n) system commonly used for writing multilingual programs on Unix-like computer operating systems&quot;</li>
<li>A new BSD-licensed rewrite has begun, with the initial version being for NetBSD (but it&#39;s likely to be portable)</li>
<li>If you&#39;ve got some coding skills, get involved with the project - the more freely-licensed replacements, the better
***</li>
</ul>

<h3><a href="https://github.com/dspinellis/unix-history-repo" rel="nofollow">Unix history git repo</a></h3>

<ul>
<li>A git repository was recently created to show off some Unix source code history</li>
<li>The repository contains 659 thousand commits and 2306 merges</li>
<li>You can see early 386BSD commits all the way up to some of the more modern FreeBSD code</li>
<li>If you want to browse through the <em>giant</em> codebase, it can be a great history lesson
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/05/hotfix-release-to-10-1-2-now-available/" rel="nofollow">PCBSD 10.1.2 and Lumina updates</a></h3>

<ul>
<li>We mentioned 10.1.1 being released last week (and all the cool features a couple weeks before) but now 10.1.2 is out</li>
<li>This minor update contained a few hotfixes: RAID-Z installation, cache and log devices and the text-only installer in UEFI mode</li>
<li>There&#39;s also a <a href="http://blog.pcbsd.org/2015/05/lumina-desktop-status-updatefaq/" rel="nofollow">new post</a> on the PCBSD blog about Lumina, answering some frequently asked questions and giving a general status update
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s25h4Biwzq" rel="nofollow">Jake writes in</a></li>
<li><a href="http://slexy.org/view/s2AF0bGmL6" rel="nofollow">Van writes in</a></li>
<li><a href="http://slexy.org/view/s20Ie1USFD" rel="nofollow">Anonymous writes in</a></li>
<li><a href="http://slexy.org/view/s20vBtoKqL" rel="nofollow">Dominik writes in</a> (<a href="http://slexy.org/view/s20RjbIT5v" rel="nofollow">text answer</a>)</li>
<li><a href="http://slexy.org/view/s20USR3WzT" rel="nofollow">Chris writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-May/033945.html" rel="nofollow">Death by chocolate</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>90: ZFS Armistice</title>
  <link>https://www.bsdnow.tv/90</link>
  <guid isPermaLink="false">5faad566-284e-4d62-b377-5144cf232cdb</guid>
  <pubDate>Wed, 20 May 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5faad566-284e-4d62-b377-5144cf232cdb.mp3" length="52647700" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we'll be chatting with Jed Reynolds about ZFS. He's been using it extensively on a certain other OS, and we can both learn a bit about the other side's implementation. Answers to your questions and all this week's news, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:13:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we'll be chatting with Jed Reynolds about ZFS. He's been using it extensively on a certain other OS, and we can both learn a bit about the other side's implementation. Answers to your questions and all this week's news, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Playing with sandboxing (http://blog.conviso.com.br/2015/05/playing-with-sandbox-analysis-of_13.html)
Sandboxing and privilege separation are popular topics these days - they're the goal of the new "shill" scripting language, they're used heavily throughout OpenBSD, and they're gaining traction with the capsicum framework
This blog post explores capsicum in FreeBSD, some of its history and where it's used in the base system
They also include some code samples so you can verify that capsicum is actually denying the program access to certain system calls
Check our interview about capsicum (http://www.bsdnow.tv/episodes/2014_05_28-the_friendly_sandbox) from a while back if you haven't seen it already
***
OpenNTPD on by default (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=143195693612629&amp;amp;w=4)
OpenBSD has enabled ntpd (http://www.bsdnow.tv/episodes/2015_02_11-time_for_a_change) by default in the installer, rather than prompting the user if they want to turn it on
In nearly every case, you're going to want to have your clock synced via NTP
With the HTTPS constraints feature also enabled by default, this should keep the time checked and accurate, even against spoofing attacks
Lots of problems can be traced back to the time on one system or another being wrong, so this will also eliminate some of those cases
For those who might be curious (http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/etc/ntpd.conf), they're using the "pool.ntp.org (http://www.pool.ntp.org/en/)" cluster of addresses and google for HTTPS constraints (but these can be easily changed (http://www.bsdnow.tv/tutorials/ntpd))
***
FreeBSD workshop in Landshut (https://www.banym.de/freebsd/review-first-freebsd-workshop-in-landshut-on-15-may-2015)
We mentioned a BSD installfest happening in Germany a few weeks back, and the organizer wrote in with a review of the event
The installfest instead became a "FreeBSD workshop" session, introducing curious new users to some of the flagship features of the OS
They covered when to use UFS or ZFS, firewall options, the release/stable/current branches and finally how to automate installations with Ansible
If you're in south Germany and want to give similar introduction talks or Q&amp;amp;A sessions about the other BSDs, get in touch
We'll hear more from him about how it went in the feedback section today
***
Swap encryption in DragonFly (http://lists.dragonflybsd.org/pipermail/users/2015-May/207690.html)
Doing full disk encryption (http://www.bsdnow.tv/tutorials/fde) is very important, but something that people sometimes overlook is encrypting their swap
This can actually be more important than the contents of your disks, especially if an unencrypted password or key hits your swap (as it can be recovered quite easily)
DragonFlyBSD has added a new experimental option to automatically encrypt your swap partition in fstab
There was another way (http://lists.dragonflybsd.org/pipermail/users/2015-May/207691.html) to do it previously, but this is a lot easier
You can achieve similar results in FreeBSD by adding ".eli" to the end of the swap device in fstab, there are a few steps (https://www.netbsd.org/docs/misc/#cgd-swap) to do it in NetBSD and swap in OpenBSD is encrypted by default
A one-time key will be created and then destroyed in each case, making recovery of the plaintext nearly impossible
***
Interview - Jed Reynolds - jed@bitratchet.com (mailto:jed@bitratchet.com) / @jed_reynolds (https://twitter.com/jed_reynolds)
Comparing ZFS on Linux and FreeBSD
News Roundup
USB thermometer on OpenBSD (http://www.cambus.net/rding-temper-gold-usb-thermometer-on-openbsd/)
So maybe you've got BSD on your server or router, maybe NetBSD on a toaster, but have you ever used a thermometer with one?
This blog post introduces the RDing TEMPer Gold USB thermometer, a small device that can tell the room temperature, and how to get it working on OpenBSD
Wouldn't you know it, OpenBSD has a native "ugold (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/ugold.4)" driver to support it with the sensors framework
How useful such a device would be is another story though
***
NAS4Free now on ARM (http://sourceforge.net/projects/nas4free/files/NAS4Free-ARM/10.1.0.2.1511/)
We talk a lot about hardware for network-attached storage devices on the show, but ARM doesn't come up a lot
That might be changing soon, as NAS4Free has just released some ARM builds
These new (somewhat experimental) images are based on FreeBSD 11-CURRENT
Included in the announcement is a list of fully-supported and partially-supported hardware that they've tested it with
If anyone has experience with running a NAS on slightly exotic hardware, write in to us
***
pkgsrcCon 2015 CFP and info (http://pkgsrc.pub/pkgsrcCon/2015/)
This year's pkgsrcCon will be in Berlin, Germany on July 4th and 5th (https://mail-index.netbsd.org/pkgsrc-users/2015/05/16/msg021560.html)
They're looking for talk proposals and ideas for things you'd like to see
If you or your company uses pkgsrc, or if you're just interested in NetBSD in general, it would be a good event to check out
***
BSDTalk episode 253 (http://bsdtalk.blogspot.com/2015/05/bsdtalk253-george-neville-neil.html)
BSDTalk has released another new episode
In it, he interviews George Neville-Neil about the 2nd edition of "The Design and Implementation of the FreeBSD Operating System"
They discuss what's new since the last edition, who the book's target audience is and a lot more
We're up to 90 episodes now, slowly catching up to Will...
***
Feedback/Questions
Dominik writes in (http://slexy.org/view/s2SWlyuOeb)
Brad writes in (http://slexy.org/view/s216z44lDU)
Corvin writes in (http://slexy.org/view/s2djtX0dSE)
James writes in (http://slexy.org/view/s21XM4hPRh)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, zfs, zpool, openzfs, zfsonlinux, nas4free, capsicum, systrace, arm, rfc7539, bsdrp, openntpd, landshut, pkgsrc, pkgsrccon</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ll be chatting with Jed Reynolds about ZFS. He&#39;s been using it extensively on a certain other OS, and we can both learn a bit about the other side&#39;s implementation. Answers to your questions and all this week&#39;s news, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.conviso.com.br/2015/05/playing-with-sandbox-analysis-of_13.html" rel="nofollow">Playing with sandboxing</a></h3>

<ul>
<li>Sandboxing and privilege separation are popular topics these days - they&#39;re the goal of the new &quot;shill&quot; scripting language, they&#39;re used heavily throughout OpenBSD, and they&#39;re gaining traction with the capsicum framework</li>
<li>This blog post explores capsicum in FreeBSD, some of its history and where it&#39;s used in the base system</li>
<li>They also include some code samples so you can verify that capsicum is actually denying the program access to certain system calls</li>
<li>Check our <a href="http://www.bsdnow.tv/episodes/2014_05_28-the_friendly_sandbox" rel="nofollow">interview about capsicum</a> from a while back if you haven&#39;t seen it already
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=143195693612629&w=4" rel="nofollow">OpenNTPD on by default</a></h3>

<ul>
<li>OpenBSD has enabled <a href="http://www.bsdnow.tv/episodes/2015_02_11-time_for_a_change" rel="nofollow">ntpd</a> by default in the installer, rather than prompting the user if they want to turn it on</li>
<li>In nearly every case, you&#39;re going to want to have your clock synced via NTP</li>
<li>With the HTTPS constraints feature also enabled by default, this should keep the time checked and accurate, even against spoofing attacks</li>
<li>Lots of problems can be traced back to the time on one system or another being wrong, so this will also eliminate some of those cases</li>
<li>For those who might be <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/etc/ntpd.conf" rel="nofollow">curious</a>, they&#39;re using the &quot;<a href="http://www.pool.ntp.org/en/" rel="nofollow">pool.ntp.org</a>&quot; cluster of addresses and google for HTTPS constraints (but these can be <a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">easily changed</a>)
***</li>
</ul>

<h3><a href="https://www.banym.de/freebsd/review-first-freebsd-workshop-in-landshut-on-15-may-2015" rel="nofollow">FreeBSD workshop in Landshut</a></h3>

<ul>
<li>We mentioned a BSD installfest happening in Germany a few weeks back, and the organizer wrote in with a review of the event</li>
<li>The installfest instead became a &quot;FreeBSD workshop&quot; session, introducing curious new users to some of the flagship features of the OS</li>
<li>They covered when to use UFS or ZFS, firewall options, the release/stable/current branches and finally how to automate installations with Ansible</li>
<li>If you&#39;re in south Germany and want to give similar introduction talks or Q&amp;A sessions about the other BSDs, get in touch</li>
<li>We&#39;ll hear more from him about how it went in the feedback section today
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-May/207690.html" rel="nofollow">Swap encryption in DragonFly</a></h3>

<ul>
<li>Doing <a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">full disk encryption</a> is very important, but something that people sometimes overlook is encrypting their swap</li>
<li>This can actually be <em>more</em> important than the contents of your disks, especially if an unencrypted password or key hits your swap (as it can be recovered quite easily)</li>
<li>DragonFlyBSD has added a new experimental option to automatically encrypt your swap partition in fstab</li>
<li>There was <a href="http://lists.dragonflybsd.org/pipermail/users/2015-May/207691.html" rel="nofollow">another way</a> to do it previously, but this is a lot easier</li>
<li>You can achieve similar results in FreeBSD by adding &quot;.eli&quot; to the end of the swap device in fstab, there are <a href="https://www.netbsd.org/docs/misc/#cgd-swap" rel="nofollow">a few steps</a> to do it in NetBSD and swap in OpenBSD is encrypted by default</li>
<li>A one-time key will be created and then destroyed in each case, making recovery of the plaintext nearly impossible
***</li>
</ul>

<h2>Interview - Jed Reynolds - <a href="mailto:jed@bitratchet.com" rel="nofollow">jed@bitratchet.com</a> / <a href="https://twitter.com/jed_reynolds" rel="nofollow">@jed_reynolds</a></h2>

<p>Comparing ZFS on Linux and FreeBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.cambus.net/rding-temper-gold-usb-thermometer-on-openbsd/" rel="nofollow">USB thermometer on OpenBSD</a></h3>

<ul>
<li>So maybe you&#39;ve got BSD on your server or router, maybe NetBSD on a toaster, but have you ever used a thermometer with one?</li>
<li>This blog post introduces the RDing TEMPer Gold USB thermometer, a small device that can tell the room temperature, and how to get it working on OpenBSD</li>
<li>Wouldn&#39;t you know it, OpenBSD has a native &quot;<a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/ugold.4" rel="nofollow">ugold</a>&quot; driver to support it with the sensors framework</li>
<li>How useful such a device would be is another story though
***</li>
</ul>

<h3><a href="http://sourceforge.net/projects/nas4free/files/NAS4Free-ARM/10.1.0.2.1511/" rel="nofollow">NAS4Free now on ARM</a></h3>

<ul>
<li>We talk a lot about hardware for network-attached storage devices on the show, but ARM doesn&#39;t come up a lot</li>
<li>That might be changing soon, as NAS4Free has just released some ARM builds</li>
<li>These new (somewhat experimental) images are based on FreeBSD 11-CURRENT</li>
<li>Included in the announcement is a list of fully-supported and partially-supported hardware that they&#39;ve tested it with</li>
<li>If anyone has experience with running a NAS on slightly exotic hardware, write in to us
***</li>
</ul>

<h3><a href="http://pkgsrc.pub/pkgsrcCon/2015/" rel="nofollow">pkgsrcCon 2015 CFP and info</a></h3>

<ul>
<li>This year&#39;s pkgsrcCon will be in Berlin, Germany <a href="https://mail-index.netbsd.org/pkgsrc-users/2015/05/16/msg021560.html" rel="nofollow">on July 4th and 5th</a></li>
<li>They&#39;re looking for talk proposals and ideas for things you&#39;d like to see</li>
<li>If you or your company uses pkgsrc, or if you&#39;re just interested in NetBSD in general, it would be a good event to check out
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2015/05/bsdtalk253-george-neville-neil.html" rel="nofollow">BSDTalk episode 253</a></h3>

<ul>
<li>BSDTalk has released another new episode</li>
<li>In it, he interviews George Neville-Neil about the 2nd edition of &quot;The Design and Implementation of the FreeBSD Operating System&quot;</li>
<li>They discuss what&#39;s new since the last edition, who the book&#39;s target audience is and a lot more</li>
<li>We&#39;re up to 90 episodes now, slowly catching up to Will...
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2SWlyuOeb" rel="nofollow">Dominik writes in</a></li>
<li><a href="http://slexy.org/view/s216z44lDU" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s2djtX0dSE" rel="nofollow">Corvin writes in</a></li>
<li><a href="http://slexy.org/view/s21XM4hPRh" rel="nofollow">James writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ll be chatting with Jed Reynolds about ZFS. He&#39;s been using it extensively on a certain other OS, and we can both learn a bit about the other side&#39;s implementation. Answers to your questions and all this week&#39;s news, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.conviso.com.br/2015/05/playing-with-sandbox-analysis-of_13.html" rel="nofollow">Playing with sandboxing</a></h3>

<ul>
<li>Sandboxing and privilege separation are popular topics these days - they&#39;re the goal of the new &quot;shill&quot; scripting language, they&#39;re used heavily throughout OpenBSD, and they&#39;re gaining traction with the capsicum framework</li>
<li>This blog post explores capsicum in FreeBSD, some of its history and where it&#39;s used in the base system</li>
<li>They also include some code samples so you can verify that capsicum is actually denying the program access to certain system calls</li>
<li>Check our <a href="http://www.bsdnow.tv/episodes/2014_05_28-the_friendly_sandbox" rel="nofollow">interview about capsicum</a> from a while back if you haven&#39;t seen it already
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=143195693612629&w=4" rel="nofollow">OpenNTPD on by default</a></h3>

<ul>
<li>OpenBSD has enabled <a href="http://www.bsdnow.tv/episodes/2015_02_11-time_for_a_change" rel="nofollow">ntpd</a> by default in the installer, rather than prompting the user if they want to turn it on</li>
<li>In nearly every case, you&#39;re going to want to have your clock synced via NTP</li>
<li>With the HTTPS constraints feature also enabled by default, this should keep the time checked and accurate, even against spoofing attacks</li>
<li>Lots of problems can be traced back to the time on one system or another being wrong, so this will also eliminate some of those cases</li>
<li>For those who might be <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/etc/ntpd.conf" rel="nofollow">curious</a>, they&#39;re using the &quot;<a href="http://www.pool.ntp.org/en/" rel="nofollow">pool.ntp.org</a>&quot; cluster of addresses and google for HTTPS constraints (but these can be <a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">easily changed</a>)
***</li>
</ul>

<h3><a href="https://www.banym.de/freebsd/review-first-freebsd-workshop-in-landshut-on-15-may-2015" rel="nofollow">FreeBSD workshop in Landshut</a></h3>

<ul>
<li>We mentioned a BSD installfest happening in Germany a few weeks back, and the organizer wrote in with a review of the event</li>
<li>The installfest instead became a &quot;FreeBSD workshop&quot; session, introducing curious new users to some of the flagship features of the OS</li>
<li>They covered when to use UFS or ZFS, firewall options, the release/stable/current branches and finally how to automate installations with Ansible</li>
<li>If you&#39;re in south Germany and want to give similar introduction talks or Q&amp;A sessions about the other BSDs, get in touch</li>
<li>We&#39;ll hear more from him about how it went in the feedback section today
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-May/207690.html" rel="nofollow">Swap encryption in DragonFly</a></h3>

<ul>
<li>Doing <a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">full disk encryption</a> is very important, but something that people sometimes overlook is encrypting their swap</li>
<li>This can actually be <em>more</em> important than the contents of your disks, especially if an unencrypted password or key hits your swap (as it can be recovered quite easily)</li>
<li>DragonFlyBSD has added a new experimental option to automatically encrypt your swap partition in fstab</li>
<li>There was <a href="http://lists.dragonflybsd.org/pipermail/users/2015-May/207691.html" rel="nofollow">another way</a> to do it previously, but this is a lot easier</li>
<li>You can achieve similar results in FreeBSD by adding &quot;.eli&quot; to the end of the swap device in fstab, there are <a href="https://www.netbsd.org/docs/misc/#cgd-swap" rel="nofollow">a few steps</a> to do it in NetBSD and swap in OpenBSD is encrypted by default</li>
<li>A one-time key will be created and then destroyed in each case, making recovery of the plaintext nearly impossible
***</li>
</ul>

<h2>Interview - Jed Reynolds - <a href="mailto:jed@bitratchet.com" rel="nofollow">jed@bitratchet.com</a> / <a href="https://twitter.com/jed_reynolds" rel="nofollow">@jed_reynolds</a></h2>

<p>Comparing ZFS on Linux and FreeBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.cambus.net/rding-temper-gold-usb-thermometer-on-openbsd/" rel="nofollow">USB thermometer on OpenBSD</a></h3>

<ul>
<li>So maybe you&#39;ve got BSD on your server or router, maybe NetBSD on a toaster, but have you ever used a thermometer with one?</li>
<li>This blog post introduces the RDing TEMPer Gold USB thermometer, a small device that can tell the room temperature, and how to get it working on OpenBSD</li>
<li>Wouldn&#39;t you know it, OpenBSD has a native &quot;<a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/ugold.4" rel="nofollow">ugold</a>&quot; driver to support it with the sensors framework</li>
<li>How useful such a device would be is another story though
***</li>
</ul>

<h3><a href="http://sourceforge.net/projects/nas4free/files/NAS4Free-ARM/10.1.0.2.1511/" rel="nofollow">NAS4Free now on ARM</a></h3>

<ul>
<li>We talk a lot about hardware for network-attached storage devices on the show, but ARM doesn&#39;t come up a lot</li>
<li>That might be changing soon, as NAS4Free has just released some ARM builds</li>
<li>These new (somewhat experimental) images are based on FreeBSD 11-CURRENT</li>
<li>Included in the announcement is a list of fully-supported and partially-supported hardware that they&#39;ve tested it with</li>
<li>If anyone has experience with running a NAS on slightly exotic hardware, write in to us
***</li>
</ul>

<h3><a href="http://pkgsrc.pub/pkgsrcCon/2015/" rel="nofollow">pkgsrcCon 2015 CFP and info</a></h3>

<ul>
<li>This year&#39;s pkgsrcCon will be in Berlin, Germany <a href="https://mail-index.netbsd.org/pkgsrc-users/2015/05/16/msg021560.html" rel="nofollow">on July 4th and 5th</a></li>
<li>They&#39;re looking for talk proposals and ideas for things you&#39;d like to see</li>
<li>If you or your company uses pkgsrc, or if you&#39;re just interested in NetBSD in general, it would be a good event to check out
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2015/05/bsdtalk253-george-neville-neil.html" rel="nofollow">BSDTalk episode 253</a></h3>

<ul>
<li>BSDTalk has released another new episode</li>
<li>In it, he interviews George Neville-Neil about the 2nd edition of &quot;The Design and Implementation of the FreeBSD Operating System&quot;</li>
<li>They discuss what&#39;s new since the last edition, who the book&#39;s target audience is and a lot more</li>
<li>We&#39;re up to 90 episodes now, slowly catching up to Will...
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2SWlyuOeb" rel="nofollow">Dominik writes in</a></li>
<li><a href="http://slexy.org/view/s216z44lDU" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s2djtX0dSE" rel="nofollow">Corvin writes in</a></li>
<li><a href="http://slexy.org/view/s21XM4hPRh" rel="nofollow">James writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>89: Exclusive Disjunction</title>
  <link>https://www.bsdnow.tv/89</link>
  <guid isPermaLink="false">e47f088b-2b32-4187-92cd-0f4be4f1426e</guid>
  <pubDate>Wed, 13 May 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e47f088b-2b32-4187-92cd-0f4be4f1426e.mp3" length="45530932" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we'll be talking to Mike Larkin about various memory protections in OpenBSD. We'll cover recent W^X improvements, SSP, ASLR, PIE and all kinds of acronyms! We've also got a bunch of news and answers to your questions, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:03:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we'll be talking to Mike Larkin about various memory protections in OpenBSD. We'll cover recent W^X improvements, SSP, ASLR, PIE and all kinds of acronyms! We've also got a bunch of news and answers to your questions, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
OpenSMTPD for the whole family (http://homing-on-code.blogspot.com/2015/05/accept-from-any-for-any-relay-via.html)
Setting up a BSD mail server is something a lot of us are probably familiar with doing, at least for our own accounts
This article talks about configuring a home mail server too, but even for the other people you live with
After convincing his wife to use their BSD-based Owncloud server for backups, the author talks about moving her over to his brand new OpenSMTPD server too
If you've ever run a mail server and had to deal with greylisting, you'll appreciate the struggle he went through
In the end, BGP-based list distribution saved the day, and his family is being served well by a BSD box
***
NetBSD on the Edgerouter Lite (https://blog.netbsd.org/tnf/entry/hands_on_experience_with_edgerouter)
We've talked a lot about building your own BSD-based router on the show, but not many of the devices we mention are in the same price range as consumer devices
The EdgeRouter Lite, a small MIPS-powered machine, is starting to become popular (and is a bit cheaper)
A NetBSD developer has been hacking on it, and documents the steps to get a working install in this blog post
The process is fairly simple, and you can cross-compile (http://www.bsdnow.tv/tutorials/current-nbsd) your own installation image on any CPU architecture (even from another BSD!)
OpenBSD and FreeBSD also have some (http://www.openbsd.org/octeon.html) support (http://rtfm.net/FreeBSD/ERL/) for these devices
***
Bitrig at NYC*BUG (https://www.youtube.com/watch?v=h4FhgBdYSUU)
The New York City BSD users group has semi-regular meetings with presentations, and this time the speaker was John Vernaleo
John discussed Bitrig (http://www.bsdnow.tv/episodes/2014_12_10-must_be_rigged), an OpenBSD fork that we've talked about a couple times on the show
He talks about what they've been up to lately, why they're doing what they're doing, difference in supported platforms
Ports and packages between the two projects are almost exactly the same, but he covers the differences in the base systems, how (some) patches get shared between the two and finally some development model differences
***
OPNsense, meet HardenedBSD (https://hardenedbsd.org/article/shawn-webb/2015-05-08/hardenedbsd-teams-opnsense)
Speaking of forks, two FreeBSD-based forked projects we've mentioned on the show, HardenedBSD (http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover) and OPNsense (http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach), have decided to join forces
Backporting their changes to the 10-STABLE branch, HardenedBSD hopes to introduce some of their security additions to the OPNsense codebase
Paired up with LibreSSL, this combination should offer a good solution for anyone wanting a BSD-based firewall with an easy web interface
We'll cover more news on the collaboration as it comes out
***
Interview - Mike Larkin - mlarkin@openbsd.org (mailto:mlarkin@openbsd.org) / @mlarkin2012 (https://twitter.com/mlarkin2012)
Memory protections in OpenBSD: W^X (https://en.wikipedia.org/wiki/W%5EX), ASLR (https://en.wikipedia.org/wiki/Address_space_layout_randomization), PIE (https://en.wikipedia.org/wiki/Position-independent_code), SSP (https://en.wikipedia.org/wiki/Buffer_overflow_protection)
News Roundup
A closer look at FreeBSD (http://www.techopedia.com/2/31035/software/a-closer-look-at-freebsd)
The week wouldn't be complete without at least one BSD article making it to a mainstream tech site
This time, it's a high-level overview of FreeBSD, some of its features and where it's used
Being that it's an overview article on a more mainstream site, you won't find anything too technical - it covers some BSD history, stability, ZFS, LLVM and Clang, ports and packages, jails and the licensing
If you have any BSD-curious Linux friends, this might be a good one to send to them
***
Linksys NSLU2 and NetBSD (http://ramblingfoo.blogspot.com/2015/05/linksys-nslu2-adventures-into-netbsd.html)
The Linksys NSLU2 is a proprietary network-attached storage device introduced back in 2004
"About 2 months ago I set a goal to run some kind of BSD on the spare Linksys NSLU2 I had. This was driven mostly by curiosity, after listening to a few BSDNow episodes and becoming a regular listener [...]"
After doing some research, the author of this post discovered that he could cross-compile NetBSD for the device straight from his Linux box
If you've got one of these old devices kicking around, check out this write-up and get some BSD action on there
***
OpenBSD disklabel templates (http://blog.jeffreyforman.net/2015/05/09/from-0-to-an-openbsd-install-with-no-hands-and-a-custom-disk-layou)
We've covered OpenBSD's "autoinstall" feature for unattended installations in the past, but one area where it didn't offer a lot of customization was with the disk layout
With a few recent changes (http://undeadly.org/cgi?action=article&amp;amp;sid=20150505123418), there are now a series of templates you can use for a completely customized partition scheme
This article takes you through the process of configuring an autoinstall answer file and adding the new section for disklabel
Combine this new feature with our -stable iso tutorial (http://www.bsdnow.tv/tutorials/stable-iso), and you could deploy completely patched and customized images en masse pretty easily
***
FreeBSD native ARM builds (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=282693)
FreeBSD -CURRENT builds for the ARM CPU architecture can now be built natively, without utilities that aren't part of base
Some of the older board-specific kernel configuration files have been replaced, and now the "IMC6" target is used
This goes along with what we read in the most recent quarterly status report - ARM is starting to get treated as a first class citizen
***
Feedback/Questions
Sean writes in (http://slexy.org/view/s2088U2OjO)
Ron writes in (http://slexy.org/view/s29ZKhQKOz)
Charles writes in (http://slexy.org/view/s2NCVHEKt1)
Bostjan writes in (http://slexy.org/view/s2mGRoKo5G)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, verisign, vbsdcon, 2015, presentations, talks, w^x, aslr, pie, ssp, stack smashing, gcc, exploit mitigation, security, edgerouter lite, opnsense, hardenedbsd, bitrig</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we&#39;ll be talking to Mike Larkin about various memory protections in OpenBSD. We&#39;ll cover recent W<sup>X</sup> improvements, SSP, ASLR, PIE and all kinds of acronyms! We&#39;ve also got a bunch of news and answers to your questions, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://homing-on-code.blogspot.com/2015/05/accept-from-any-for-any-relay-via.html" rel="nofollow">OpenSMTPD for the whole family</a></h3>

<ul>
<li>Setting up a BSD mail server is something a lot of us are probably familiar with doing, at least for our own accounts</li>
<li>This article talks about configuring a home mail server too, but even for the other people you live with</li>
<li>After convincing his wife to use their BSD-based Owncloud server for backups, the author talks about moving her over to his brand new OpenSMTPD server too</li>
<li>If you&#39;ve ever run a mail server and had to deal with greylisting, you&#39;ll appreciate the struggle he went through</li>
<li>In the end, BGP-based list distribution saved the day, and his family is being served well by a BSD box
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/hands_on_experience_with_edgerouter" rel="nofollow">NetBSD on the Edgerouter Lite</a></h3>

<ul>
<li>We&#39;ve talked a lot about building your own BSD-based router on the show, but not many of the devices we mention are in the same price range as consumer devices</li>
<li>The EdgeRouter Lite, a small MIPS-powered machine, is starting to become popular (and is a bit cheaper)</li>
<li>A NetBSD developer has been hacking on it, and documents the steps to get a working install in this blog post</li>
<li>The process is fairly simple, and you can <a href="http://www.bsdnow.tv/tutorials/current-nbsd" rel="nofollow">cross-compile</a> your own installation image on any CPU architecture (even from another BSD!)</li>
<li>OpenBSD and FreeBSD also have <a href="http://www.openbsd.org/octeon.html" rel="nofollow">some</a> <a href="http://rtfm.net/FreeBSD/ERL/" rel="nofollow">support</a> for these devices
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=h4FhgBdYSUU" rel="nofollow">Bitrig at NYC*BUG</a></h3>

<ul>
<li>The New York City BSD users group has semi-regular meetings with presentations, and this time the speaker was John Vernaleo</li>
<li>John discussed <a href="http://www.bsdnow.tv/episodes/2014_12_10-must_be_rigged" rel="nofollow">Bitrig</a>, an OpenBSD fork that we&#39;ve talked about a couple times on the show</li>
<li>He talks about what they&#39;ve been up to lately, why they&#39;re doing what they&#39;re doing, difference in supported platforms</li>
<li>Ports and packages between the two projects are almost exactly the same, but he covers the differences in the base systems, how (some) patches get shared between the two and finally some development model differences
***</li>
</ul>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2015-05-08/hardenedbsd-teams-opnsense" rel="nofollow">OPNsense, meet HardenedBSD</a></h3>

<ul>
<li>Speaking of forks, two FreeBSD-based forked projects we&#39;ve mentioned on the show, <a href="http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover" rel="nofollow">HardenedBSD</a> and <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">OPNsense</a>, have decided to join forces</li>
<li>Backporting their changes to the 10-STABLE branch, HardenedBSD hopes to introduce some of their security additions to the OPNsense codebase</li>
<li>Paired up with LibreSSL, this combination should offer a good solution for anyone wanting a BSD-based firewall with an easy web interface</li>
<li>We&#39;ll cover more news on the collaboration as it comes out
***</li>
</ul>

<h2>Interview - Mike Larkin - <a href="mailto:mlarkin@openbsd.org" rel="nofollow">mlarkin@openbsd.org</a> / <a href="https://twitter.com/mlarkin2012" rel="nofollow">@mlarkin2012</a></h2>

<p>Memory protections in OpenBSD: <a href="https://en.wikipedia.org/wiki/W%5EX" rel="nofollow">W<sup>X</sup></a>, <a href="https://en.wikipedia.org/wiki/Address_space_layout_randomization" rel="nofollow">ASLR</a>, <a href="https://en.wikipedia.org/wiki/Position-independent_code" rel="nofollow">PIE</a>, <a href="https://en.wikipedia.org/wiki/Buffer_overflow_protection" rel="nofollow">SSP</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.techopedia.com/2/31035/software/a-closer-look-at-freebsd" rel="nofollow">A closer look at FreeBSD</a></h3>

<ul>
<li>The week wouldn&#39;t be complete without at least one BSD article making it to a mainstream tech site</li>
<li>This time, it&#39;s a high-level overview of FreeBSD, some of its features and where it&#39;s used</li>
<li>Being that it&#39;s an overview article on a more mainstream site, you won&#39;t find anything too technical - it covers some BSD history, stability, ZFS, LLVM and Clang, ports and packages, jails and the licensing</li>
<li>If you have any BSD-curious Linux friends, this might be a good one to send to them
***</li>
</ul>

<h3><a href="http://ramblingfoo.blogspot.com/2015/05/linksys-nslu2-adventures-into-netbsd.html" rel="nofollow">Linksys NSLU2 and NetBSD</a></h3>

<ul>
<li>The Linksys NSLU2 is a proprietary network-attached storage device introduced back in 2004</li>
<li>&quot;About 2 months ago I set a goal to run some kind of BSD on the spare Linksys NSLU2 I had. This was driven mostly by curiosity, after listening to a few BSDNow episodes and becoming a regular listener [...]&quot;</li>
<li>After doing some research, the author of this post discovered that he could cross-compile NetBSD for the device straight from his Linux box</li>
<li>If you&#39;ve got one of these old devices kicking around, check out this write-up and get some BSD action on there
***</li>
</ul>

<h3><a href="http://blog.jeffreyforman.net/2015/05/09/from-0-to-an-openbsd-install-with-no-hands-and-a-custom-disk-layou" rel="nofollow">OpenBSD disklabel templates</a></h3>

<ul>
<li>We&#39;ve covered OpenBSD&#39;s &quot;autoinstall&quot; feature for unattended installations in the past, but one area where it didn&#39;t offer a lot of customization was with the disk layout</li>
<li>With a few <a href="http://undeadly.org/cgi?action=article&sid=20150505123418" rel="nofollow">recent changes</a>, there are now a series of templates you can use for a completely customized partition scheme</li>
<li>This article takes you through the process of configuring an autoinstall answer file and adding the new section for disklabel</li>
<li>Combine this new feature with our <a href="http://www.bsdnow.tv/tutorials/stable-iso" rel="nofollow">-stable iso tutorial</a>, and you could deploy completely patched and customized images en masse pretty easily
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=282693" rel="nofollow">FreeBSD native ARM builds</a></h3>

<ul>
<li>FreeBSD -CURRENT builds for the ARM CPU architecture can now be built natively, without utilities that aren&#39;t part of base</li>
<li>Some of the older board-specific kernel configuration files have been replaced, and now the &quot;IMC6&quot; target is used</li>
<li>This goes along with what we read in the most recent quarterly status report - ARM is starting to get treated as a first class citizen
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2088U2OjO" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s29ZKhQKOz" rel="nofollow">Ron writes in</a></li>
<li><a href="http://slexy.org/view/s2NCVHEKt1" rel="nofollow">Charles writes in</a></li>
<li><a href="http://slexy.org/view/s2mGRoKo5G" rel="nofollow">Bostjan writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we&#39;ll be talking to Mike Larkin about various memory protections in OpenBSD. We&#39;ll cover recent W<sup>X</sup> improvements, SSP, ASLR, PIE and all kinds of acronyms! We&#39;ve also got a bunch of news and answers to your questions, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://homing-on-code.blogspot.com/2015/05/accept-from-any-for-any-relay-via.html" rel="nofollow">OpenSMTPD for the whole family</a></h3>

<ul>
<li>Setting up a BSD mail server is something a lot of us are probably familiar with doing, at least for our own accounts</li>
<li>This article talks about configuring a home mail server too, but even for the other people you live with</li>
<li>After convincing his wife to use their BSD-based Owncloud server for backups, the author talks about moving her over to his brand new OpenSMTPD server too</li>
<li>If you&#39;ve ever run a mail server and had to deal with greylisting, you&#39;ll appreciate the struggle he went through</li>
<li>In the end, BGP-based list distribution saved the day, and his family is being served well by a BSD box
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/hands_on_experience_with_edgerouter" rel="nofollow">NetBSD on the Edgerouter Lite</a></h3>

<ul>
<li>We&#39;ve talked a lot about building your own BSD-based router on the show, but not many of the devices we mention are in the same price range as consumer devices</li>
<li>The EdgeRouter Lite, a small MIPS-powered machine, is starting to become popular (and is a bit cheaper)</li>
<li>A NetBSD developer has been hacking on it, and documents the steps to get a working install in this blog post</li>
<li>The process is fairly simple, and you can <a href="http://www.bsdnow.tv/tutorials/current-nbsd" rel="nofollow">cross-compile</a> your own installation image on any CPU architecture (even from another BSD!)</li>
<li>OpenBSD and FreeBSD also have <a href="http://www.openbsd.org/octeon.html" rel="nofollow">some</a> <a href="http://rtfm.net/FreeBSD/ERL/" rel="nofollow">support</a> for these devices
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=h4FhgBdYSUU" rel="nofollow">Bitrig at NYC*BUG</a></h3>

<ul>
<li>The New York City BSD users group has semi-regular meetings with presentations, and this time the speaker was John Vernaleo</li>
<li>John discussed <a href="http://www.bsdnow.tv/episodes/2014_12_10-must_be_rigged" rel="nofollow">Bitrig</a>, an OpenBSD fork that we&#39;ve talked about a couple times on the show</li>
<li>He talks about what they&#39;ve been up to lately, why they&#39;re doing what they&#39;re doing, difference in supported platforms</li>
<li>Ports and packages between the two projects are almost exactly the same, but he covers the differences in the base systems, how (some) patches get shared between the two and finally some development model differences
***</li>
</ul>

<h3><a href="https://hardenedbsd.org/article/shawn-webb/2015-05-08/hardenedbsd-teams-opnsense" rel="nofollow">OPNsense, meet HardenedBSD</a></h3>

<ul>
<li>Speaking of forks, two FreeBSD-based forked projects we&#39;ve mentioned on the show, <a href="http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover" rel="nofollow">HardenedBSD</a> and <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">OPNsense</a>, have decided to join forces</li>
<li>Backporting their changes to the 10-STABLE branch, HardenedBSD hopes to introduce some of their security additions to the OPNsense codebase</li>
<li>Paired up with LibreSSL, this combination should offer a good solution for anyone wanting a BSD-based firewall with an easy web interface</li>
<li>We&#39;ll cover more news on the collaboration as it comes out
***</li>
</ul>

<h2>Interview - Mike Larkin - <a href="mailto:mlarkin@openbsd.org" rel="nofollow">mlarkin@openbsd.org</a> / <a href="https://twitter.com/mlarkin2012" rel="nofollow">@mlarkin2012</a></h2>

<p>Memory protections in OpenBSD: <a href="https://en.wikipedia.org/wiki/W%5EX" rel="nofollow">W<sup>X</sup></a>, <a href="https://en.wikipedia.org/wiki/Address_space_layout_randomization" rel="nofollow">ASLR</a>, <a href="https://en.wikipedia.org/wiki/Position-independent_code" rel="nofollow">PIE</a>, <a href="https://en.wikipedia.org/wiki/Buffer_overflow_protection" rel="nofollow">SSP</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.techopedia.com/2/31035/software/a-closer-look-at-freebsd" rel="nofollow">A closer look at FreeBSD</a></h3>

<ul>
<li>The week wouldn&#39;t be complete without at least one BSD article making it to a mainstream tech site</li>
<li>This time, it&#39;s a high-level overview of FreeBSD, some of its features and where it&#39;s used</li>
<li>Being that it&#39;s an overview article on a more mainstream site, you won&#39;t find anything too technical - it covers some BSD history, stability, ZFS, LLVM and Clang, ports and packages, jails and the licensing</li>
<li>If you have any BSD-curious Linux friends, this might be a good one to send to them
***</li>
</ul>

<h3><a href="http://ramblingfoo.blogspot.com/2015/05/linksys-nslu2-adventures-into-netbsd.html" rel="nofollow">Linksys NSLU2 and NetBSD</a></h3>

<ul>
<li>The Linksys NSLU2 is a proprietary network-attached storage device introduced back in 2004</li>
<li>&quot;About 2 months ago I set a goal to run some kind of BSD on the spare Linksys NSLU2 I had. This was driven mostly by curiosity, after listening to a few BSDNow episodes and becoming a regular listener [...]&quot;</li>
<li>After doing some research, the author of this post discovered that he could cross-compile NetBSD for the device straight from his Linux box</li>
<li>If you&#39;ve got one of these old devices kicking around, check out this write-up and get some BSD action on there
***</li>
</ul>

<h3><a href="http://blog.jeffreyforman.net/2015/05/09/from-0-to-an-openbsd-install-with-no-hands-and-a-custom-disk-layou" rel="nofollow">OpenBSD disklabel templates</a></h3>

<ul>
<li>We&#39;ve covered OpenBSD&#39;s &quot;autoinstall&quot; feature for unattended installations in the past, but one area where it didn&#39;t offer a lot of customization was with the disk layout</li>
<li>With a few <a href="http://undeadly.org/cgi?action=article&sid=20150505123418" rel="nofollow">recent changes</a>, there are now a series of templates you can use for a completely customized partition scheme</li>
<li>This article takes you through the process of configuring an autoinstall answer file and adding the new section for disklabel</li>
<li>Combine this new feature with our <a href="http://www.bsdnow.tv/tutorials/stable-iso" rel="nofollow">-stable iso tutorial</a>, and you could deploy completely patched and customized images en masse pretty easily
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=282693" rel="nofollow">FreeBSD native ARM builds</a></h3>

<ul>
<li>FreeBSD -CURRENT builds for the ARM CPU architecture can now be built natively, without utilities that aren&#39;t part of base</li>
<li>Some of the older board-specific kernel configuration files have been replaced, and now the &quot;IMC6&quot; target is used</li>
<li>This goes along with what we read in the most recent quarterly status report - ARM is starting to get treated as a first class citizen
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2088U2OjO" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s29ZKhQKOz" rel="nofollow">Ron writes in</a></li>
<li><a href="http://slexy.org/view/s2NCVHEKt1" rel="nofollow">Charles writes in</a></li>
<li><a href="http://slexy.org/view/s2mGRoKo5G" rel="nofollow">Bostjan writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>88: Below the Clouds</title>
  <link>https://www.bsdnow.tv/88</link>
  <guid isPermaLink="false">26ef6d0e-ea2a-4032-88ee-121e1b2be033</guid>
  <pubDate>Wed, 06 May 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/26ef6d0e-ea2a-4032-88ee-121e1b2be033.mp3" length="67680724" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we'll be talking with Ed Schouten about CloudABI. It's a new application binary interface with a strong focus on isolation and restricted capabilities. As always, all this week's BSD news and answers to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:34:00</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we'll be talking with Ed Schouten about CloudABI. It's a new application binary interface with a strong focus on isolation and restricted capabilities. As always, all this week's BSD news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD quarterly status report (https://www.freebsd.org/news/status/report-2015-01-2015-03.html)
The FreeBSD team has posted a report of the activities that went on between January and March of this year
As usual, it's broken down into separate reports from the various teams in the project (ports, kernel, virtualization, etc)
The ports team continuing battling the flood of PRs, closing quite a lot of them and boasting nearly 7,000 commits this quarter
The core team and cluster admins dealt with the accidental deletion of the Bugzilla database, and are making plans for an improved backup strategy within the project going forward
FreeBSD's future release support model was also finalized and published in February, which should be a big improvement for both users and the release team
Some topics are still being discussed internally, mainly MFCing ZFS ARC responsiveness patches to the 10 branch and deciding whether to maintain or abandon C89 support in the kernel code
Lots of activity is happening in bhyve, some of which we've covered recently (http://www.bsdnow.tv/episodes/2015_04_29-on_the_list), and a number of improvements were made this quarter
Clang, LLVM and LLDB have been updated to the 3.6.0 branch in -CURRENT
Work to get FreeBSD booting natively on the POWER8 CPU architecture is also still in progress, but it does boot in KVM for the time being
The project to replace forth in the bootloader with lua is in its final stages, and can be used on x86 already
ASLR work (http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover) is still being done by the HardenedBSD guys, and their next aim is position-independent executable
The report also touches on multipath TCP support, the new automounter, opaque ifnet, pkgng updates, secureboot (which should be in 10.2-RELEASE), GNOME and KDE on FreeBSD, PCIe hotplugging, nested kernel support and more
Also of note: work is going on to make ARM a Tier 1 platform in the upcoming 11.0-RELEASE (and support for more ARM boards is still being added, including ARM64)
***
OpenBSD 5.7 released (http://www.openbsd.org/57.html)
OpenBSD has formally released another new version, complete with the giant changelog we've come to expect
In the hardware department, 5.7 features many driver improvements and fixes, as well as support for some new things: USB 3.0 controllers, newer Intel and Atheros wireless cards and some additional 10gbit NICs
If you're using one of the Soekris boards, there's even a new driver (http://bodgitandscarper.co.uk/openbsd/further-soekris-net6501-improvements-for-openbsd/) to manipulate the GPIO and LEDs on them - this has some fun possibilities
Some new security improvements include: SipHash (https://en.wikipedia.org/wiki/SipHash) being sprinkled in some areas to protect hashing functions, big W^X improvements (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142120787308107&amp;amp;w=2) in the kernel space, static PIE (http://www.bsdnow.tv/episodes/2015_04_15-pie_in_the_sky) on all architectures, deterministic "random" functions being replaced (https://www.marc.info/?l=openbsd-tech&amp;amp;m=141807224826859&amp;amp;w=2) with strong randomness, and support for remote logging over TLS
The entire source tree has also been audited to use reallocarray (http://lteo.net/blog/2014/10/28/reallocarray-in-openbsd-integer-overflow-detection-for-free/), which unintentionally saved (https://splone.com/blog/2015/3/11/integer-overflow-prevention-in-c) OpenBSD's libc from being vulnerable to earlier attacks (https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/) affecting other BSDs' implementations
Being that it's OpenBSD, a number of things have also been removed from the base system: procfs, sendmail, SSLv3 support and loadable kernel modules are all gone now (not to mention the continuing massacre of dead code in LibreSSL)
Some people seem to be surprised about the removal of loadable modules, but almost nothing utilized them in OpenBSD, so it was really just removing old code that no one used anymore - very different from FreeBSD or Linux in this regard, where kernel modules are used pretty heavily
BIND and nginx have been taken out, so you'll need to either use the versions in ports or switch to Unbound and the in-base HTTP daemon
Speaking of httpd, it's gotten a number of new (http://www.openbsd.org/papers/httpd-slides-asiabsdcon2015.pdf) features (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/httpd.conf.5), and has had time to grow and mature since its initial debut - if you've been considering trying it out, now would be a great time to do so
This release also includes the latest OpenSSH (with stronger fingerprint types and host key rotation), OpenNTPD (with the HTTPS constraints feature), OpenSMTPD, LibreSSL and mandoc (http://www.bsdnow.tv/episodes/2014_11_12-a_mans_man)
Check the errata page (http://www.openbsd.org/errata57.html) for any post-release fixes, and the upgrade guide (http://www.openbsd.org/faq/upgrade57.html) for specific instructions on updating from 5.6
Groundwork has also been laid for some major SMP scalability improvements - look forward to those in future releases
There's a song and artwork (http://www.openbsd.org/lyrics.html#57) to go along with the release as always, and CDs should be arriving within a few days - we'll show some pictures next week
Consider picking one up (https://www.openbsdstore.com) to support the project (and it's the only way to get puffy stickers)
For those of you paying close attention, the banner image (http://www.openbsd.org/images/puffy57.gif) for this release just might remind you of a certain special episode (http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time) of BSD Now...
***
Tor-BSD diversity project (https://torbsd.github.io/)
We've talked about Tor on the show a few times, and specifically about getting more of the network on BSD (Linux has an overwhelming majority right now)
A new initiative has started to do just that, called the Tor-BSD diversity project
"Monocultures in nature are dangerous, as vulnerabilities are held in common across a broad spectrum. Diversity means single vulnerabilities are less likely to harm the entire ecosystem. [...] A single kernel vulnerability in GNU/Linux that impacting Tor relays could be devastating. We want to see a stronger Tor network, and we believe one critical ingredient for that is operating system diversity."
In addition to encouraging people to put up more relays, they're also continuing work on porting the Tor Browser Bundle to BSD, so more desktop users can have easy access to online privacy
There's an additional progress report (http://trac.haqistan.net/blog/tor-browser-ports-progress) for that part specifically, and it looks like most of the work is done now
Engaging the broader BSD community about Tor and fixing up the official documentation are also both on their todo list 
If you've been considering running a node to help out, there's always our handy tutorial (http://www.bsdnow.tv/tutorials/tor) on getting set up
***
PC-BSD 10.1.2-RC1 released (http://blog.pcbsd.org/2015/05/pc-bsd-10-1-2-rc1-now-available/)
If you want a sneak peek at the upcoming PC-BSD 10.1.2, the first release candidate is now available to grab
This quarterly update includes a number of new features, improvements and even some additional utilities
PersonaCrypt is one of them - it's a new tool for easily migrating encrypted home directories between systems
A new "stealth mode" option allows for a one-time login, using a blank home directory that gets wiped after use
Similarly, a new "Tor mode" allows for easy tunneling of all your traffic through the Tor network
IPFW is now the default firewall, offering improved VIMAGE capabilities
The life preserver backup tool now allows for bare-metal restores via the install CD
ISC's NTP daemon has been replaced with OpenNTPD (http://www.bsdnow.tv/episodes/2015_02_11-time_for_a_change), and OpenSSL has been replaced with LibreSSL (http://www.bsdnow.tv/episodes/2015_03_25-ssl_in_the_wild)
It also includes the latest Lumina (http://www.bsdnow.tv/episodes/2014_09_10-luminary_environment) desktop, and there's another post dedicated to that (http://blog.pcbsd.org/2015/05/pc-bsd-10-1-2-rc1-lumina-desktop-0-8-4-released/)
Binary packages have also been updated to fresh versions from the ports tree
More details, including upgrade instructions, can be found in the linked blog post
***
Interview - Ed Schouten - ed@freebsd.org (mailto:ed@freebsd.org) / @edschouten (https://twitter.com/edschouten)
CloudABI (https://www.bsdcan.org/2015/schedule/track/Security/524.en.html)
News Roundup
Open Household Router Contraption (http://code.saghul.net/index.php/2015/05/01/announcing-the-open-household-router-contraption/)
This article introduces OpenHRC, the "Open Household Router Contraption"
In short, it's a set of bootstrapping scripts to turn a vanilla OpenBSD install into a feature-rich gateway device
It also makes use of Ansible playbooks for configuration, allowing for a more "mass deployment" type of setup
Everything is configured via a simple text file, and you end up with a local NTP server, DHCP server, firewall (obviously) and local caching DNS resolver - it even does DNSSEC validation
All the code is open source and on Github (https://github.com/ioc32/openhrc), so you can read through what's actually being changed and put in place
There's also a video guide (https://www.youtube.com/watch?v=LZeKDM5jc90) to the entire process, if you're more of a visual person
***
OPNsense 15.1.10 released (https://forum.opnsense.org/index.php?topic=365.0)
Speaking of BSD routers, if you're looking for a "prebuilt and ready to go" option, OPNsense has just released a new version
15.1.10 drops some of the legacy patches they inherited from pfSense, aiming to stay closer to the mainline FreeBSD source code
Going along with this theme, they've redone how they do ports, and are now kept totally in sync with the regular ports tree
Their binary packages are now signed using the fingerprint-style method, various GUI menus have been rewritten and a number of other bugs were fixed
NanoBSD-based images are also available now, so you can try it out on hardware with constrained resources as well
Version 15.1.10.1 (https://twitter.com/opnsense/status/596009164746432512) was released shortly thereafter, including a hotfix for VLANs
***
IBM Workpad Z50 and NetBSD (https://www.ibm.com/developerworks/community/blogs/hpcgoulash/entry/ibm_workpad_z50_netbsd_an_interesting_combination1?lang=en)
Before the infamous netbook fad came and went, IBM had a handheld PDA device that looked pretty much the same
Back in 1999, they released the Workpad Z50 (http://www.hpcfactor.com/reviews/hardware/ibm/workpad-z50/) with Windows CE, sporting a 131MHz MIPS CPU, 16MB of RAM and a 640x480 display
You can probably tell where this is going... the article is about installing NetBSD it
"What prevents me from taking my pristine Workpad z50 to the local electronics recycling  facility is NetBSD. With a little effort it is possible to install recent versions of NetBSD on the Workpad z50 and even have XWindows running"
The author got pkgsrc up and running on it too, and cleverly used distcc to offload the compiling jobs to something a bit more modern
He's also got a couple (https://www.youtube.com/watch?v=hSLVnSZKB9I) videos (https://www.youtube.com/watch?v=mIA-NWEHLM4) of the bootup process and running Xorg (neither of which we'd call "speedy" by any stretch of the imagination)
***
FreeBSD from the trenches (http://freebsdfoundation.blogspot.com/2015/04/from-trenches-tips-tricks-edition.html)
The FreeBSD foundation has a new blog post up in their "from the trenches" series, detailing FreeBSD in some real-world use cases
In this installment, Glen Barber talks about how he sets up all his laptops with ZFS and GELI
While the installer allows for an automatic ZFS layout, Glen notes that it's not a one-size-fits-all thing, and goes through doing everything manually
Each command is explained, and he walks you through the process of doing an encrypted installation (http://www.bsdnow.tv/tutorials/fde) on your root zpool
***
Broadwell in DragonFly (http://lists.dragonflybsd.org/pipermail/users/2015-May/207671.html)
DragonFlyBSD has officially won the race to get an Intel Broadwell graphics driver
Their i915 driver has been brought up to speed with Linux 3.14's, adding not only Broadwell support, but many other bugfixes for other cards too
It's planned for commit to the main tree very soon, but you can test it out with a git branch for the time being
***
Feedback/Questions
Bostjan writes in (http://slexy.org/view/s216QQcHyX)
Hunter writes in (http://slexy.org/view/s21hGSk3c0)
Hrishi writes in (http://slexy.org/view/s20JwPw9Je)
Clint writes in (http://slexy.org/view/s2x1GYr7y6)
Sergei writes in (http://slexy.org/view/s2swXxr2PX)
***
Mailing List Gold
How did you guess (https://lists.freebsd.org/pipermail/freebsd-advocacy/2015-May/004541.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, 5.7, libressl, opensmtpd, openntpd, openssh, cloudabi, capsicum, 5.7, tor-bsd, tor, diversity, browser bundle, ipfw, openhrc, opnsense, router, workpad z50, gateway</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ll be talking with Ed Schouten about CloudABI. It&#39;s a new application binary interface with a strong focus on isolation and restricted capabilities. As always, all this week&#39;s BSD news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2015-01-2015-03.html" rel="nofollow">FreeBSD quarterly status report</a></h3>

<ul>
<li>The FreeBSD team has posted a report of the activities that went on between January and March of this year</li>
<li>As usual, it&#39;s broken down into separate reports from the various teams in the project (ports, kernel, virtualization, etc)</li>
<li>The ports team continuing battling the flood of PRs, closing quite a lot of them and boasting nearly 7,000 commits this quarter</li>
<li>The core team and cluster admins dealt with the accidental deletion of the Bugzilla database, and are making plans for an improved backup strategy within the project going forward</li>
<li>FreeBSD&#39;s future release support model was also finalized and published in February, which should be a big improvement for both users and the release team</li>
<li>Some topics are still being discussed internally, mainly MFCing ZFS ARC responsiveness patches to the 10 branch and deciding whether to maintain or abandon C89 support in the kernel code</li>
<li>Lots of activity is happening in bhyve, some of which we&#39;ve covered <a href="http://www.bsdnow.tv/episodes/2015_04_29-on_the_list" rel="nofollow">recently</a>, and a number of improvements were made this quarter</li>
<li>Clang, LLVM and LLDB have been updated to the 3.6.0 branch in -CURRENT</li>
<li>Work to get FreeBSD booting natively on the POWER8 CPU architecture is also still in progress, but it does boot in KVM for the time being</li>
<li>The project to replace forth in the bootloader with lua is in its final stages, and can be used on x86 already</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover" rel="nofollow">ASLR work</a> is still being done by the HardenedBSD guys, and their next aim is position-independent executable</li>
<li>The report also touches on multipath TCP support, the new automounter, opaque ifnet, pkgng updates, secureboot (which should be in 10.2-RELEASE), GNOME and KDE on FreeBSD, PCIe hotplugging, nested kernel support and more</li>
<li>Also of note: work is going on to make ARM a Tier 1 platform in the upcoming 11.0-RELEASE (and support for more ARM boards is still being added, including ARM64)
***</li>
</ul>

<h3><a href="http://www.openbsd.org/57.html" rel="nofollow">OpenBSD 5.7 released</a></h3>

<ul>
<li>OpenBSD has formally released another new version, complete with the giant changelog we&#39;ve come to expect</li>
<li>In the hardware department, 5.7 features many driver improvements and fixes, as well as support for some new things: USB 3.0 controllers, newer Intel and Atheros wireless cards and some additional 10gbit NICs</li>
<li>If you&#39;re using one of the Soekris boards, there&#39;s even <a href="http://bodgitandscarper.co.uk/openbsd/further-soekris-net6501-improvements-for-openbsd/" rel="nofollow">a new driver</a> to manipulate the GPIO and LEDs on them - this has some fun possibilities</li>
<li>Some new security improvements include: <a href="https://en.wikipedia.org/wiki/SipHash" rel="nofollow">SipHash</a> being sprinkled in some areas to protect hashing functions, big <a href="https://www.marc.info/?l=openbsd-tech&m=142120787308107&w=2" rel="nofollow">W<sup>X</sup> improvements</a> in the kernel space, <a href="http://www.bsdnow.tv/episodes/2015_04_15-pie_in_the_sky" rel="nofollow">static PIE</a> on all architectures, deterministic &quot;random&quot; functions <a href="https://www.marc.info/?l=openbsd-tech&m=141807224826859&w=2" rel="nofollow">being replaced</a> with strong randomness, and support for remote logging over TLS</li>
<li>The entire source tree has also been audited to use <a href="http://lteo.net/blog/2014/10/28/reallocarray-in-openbsd-integer-overflow-detection-for-free/" rel="nofollow">reallocarray</a>, which unintentionally <a href="https://splone.com/blog/2015/3/11/integer-overflow-prevention-in-c" rel="nofollow">saved</a> OpenBSD&#39;s libc from being vulnerable to <a href="https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/" rel="nofollow">earlier attacks</a> affecting other BSDs&#39; implementations</li>
<li>Being that it&#39;s OpenBSD, a number of things have also been <em>removed</em> from the base system: procfs, sendmail, SSLv3 support and loadable kernel modules are all gone now (not to mention the continuing massacre of dead code in LibreSSL)</li>
<li>Some people seem to be surprised about the removal of loadable modules, but almost nothing utilized them in OpenBSD, so it was really just removing old code that no one used anymore - very different from FreeBSD or Linux in this regard, where kernel modules are used pretty heavily</li>
<li>BIND and nginx have been taken out, so you&#39;ll need to either use the versions in ports or switch to Unbound and the in-base HTTP daemon</li>
<li>Speaking of httpd, it&#39;s gotten a number of <a href="http://www.openbsd.org/papers/httpd-slides-asiabsdcon2015.pdf" rel="nofollow">new</a> <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/httpd.conf.5" rel="nofollow">features</a>, and has had time to grow and mature since its initial debut - if you&#39;ve been considering trying it out, now would be a great time to do so</li>
<li>This release also includes the latest OpenSSH (with stronger fingerprint types and host key rotation), OpenNTPD (with the HTTPS constraints feature), OpenSMTPD, LibreSSL and <a href="http://www.bsdnow.tv/episodes/2014_11_12-a_mans_man" rel="nofollow">mandoc</a></li>
<li>Check the <a href="http://www.openbsd.org/errata57.html" rel="nofollow">errata page</a> for any post-release fixes, and the <a href="http://www.openbsd.org/faq/upgrade57.html" rel="nofollow">upgrade guide</a> for specific instructions on updating from 5.6</li>
<li>Groundwork has also been laid for some major SMP scalability improvements - look forward to those in future releases</li>
<li>There&#39;s a <a href="http://www.openbsd.org/lyrics.html#57" rel="nofollow">song and artwork</a> to go along with the release as always, and CDs should be arriving within a few days - we&#39;ll show some pictures next week</li>
<li>Consider <a href="https://www.openbsdstore.com" rel="nofollow">picking one up</a> to support the project (and it&#39;s the only way to get puffy stickers)</li>
<li>For those of you paying close attention, the <a href="http://www.openbsd.org/images/puffy57.gif" rel="nofollow">banner image</a> for this release just might remind you of a <a href="http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time" rel="nofollow">certain special episode</a> of BSD Now...
***</li>
</ul>

<h3><a href="https://torbsd.github.io/" rel="nofollow">Tor-BSD diversity project</a></h3>

<ul>
<li>We&#39;ve talked about Tor on the show a few times, and specifically about getting more of the network on BSD (Linux has an overwhelming majority right now)</li>
<li>A new initiative has started to do just that, called the Tor-BSD diversity project</li>
<li>&quot;Monocultures in nature are dangerous, as vulnerabilities are held in common across a broad spectrum. Diversity means single vulnerabilities are less likely to harm the entire ecosystem. [...] A single kernel vulnerability in GNU/Linux that impacting Tor relays could be devastating. We want to see a stronger Tor network, and we believe one critical ingredient for that is operating system diversity.&quot;</li>
<li>In addition to encouraging people to put up more relays, they&#39;re also continuing work on porting the Tor Browser Bundle to BSD, so more desktop users can have easy access to online privacy</li>
<li>There&#39;s an additional <a href="http://trac.haqistan.net/blog/tor-browser-ports-progress" rel="nofollow">progress report</a> for that part specifically, and it looks like most of the work is done now</li>
<li>Engaging the broader BSD community about Tor and fixing up the official documentation are also both on their todo list </li>
<li>If you&#39;ve been considering running a node to help out, there&#39;s always <a href="http://www.bsdnow.tv/tutorials/tor" rel="nofollow">our handy tutorial</a> on getting set up
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/05/pc-bsd-10-1-2-rc1-now-available/" rel="nofollow">PC-BSD 10.1.2-RC1 released</a></h3>

<ul>
<li>If you want a sneak peek at the upcoming PC-BSD 10.1.2, the first release candidate is now available to grab</li>
<li>This quarterly update includes a number of new features, improvements and even some additional utilities</li>
<li>PersonaCrypt is one of them - it&#39;s a new tool for easily migrating encrypted home directories between systems</li>
<li>A new &quot;stealth mode&quot; option allows for a one-time login, using a blank home directory that gets wiped after use</li>
<li>Similarly, a new &quot;Tor mode&quot; allows for easy tunneling of all your traffic through the Tor network</li>
<li>IPFW is now the default firewall, offering improved VIMAGE capabilities</li>
<li>The life preserver backup tool now allows for bare-metal restores via the install CD</li>
<li>ISC&#39;s NTP daemon has been replaced with <a href="http://www.bsdnow.tv/episodes/2015_02_11-time_for_a_change" rel="nofollow">OpenNTPD</a>, and OpenSSL has been replaced with <a href="http://www.bsdnow.tv/episodes/2015_03_25-ssl_in_the_wild" rel="nofollow">LibreSSL</a></li>
<li>It also includes the latest <a href="http://www.bsdnow.tv/episodes/2014_09_10-luminary_environment" rel="nofollow">Lumina</a> desktop, and there&#39;s another <a href="http://blog.pcbsd.org/2015/05/pc-bsd-10-1-2-rc1-lumina-desktop-0-8-4-released/" rel="nofollow">post dedicated to that</a></li>
<li>Binary packages have also been updated to fresh versions from the ports tree</li>
<li>More details, including upgrade instructions, can be found in the linked blog post
***</li>
</ul>

<h2>Interview - Ed Schouten - <a href="mailto:ed@freebsd.org" rel="nofollow">ed@freebsd.org</a> / <a href="https://twitter.com/edschouten" rel="nofollow">@edschouten</a></h2>

<p><a href="https://www.bsdcan.org/2015/schedule/track/Security/524.en.html" rel="nofollow">CloudABI</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://code.saghul.net/index.php/2015/05/01/announcing-the-open-household-router-contraption/" rel="nofollow">Open Household Router Contraption</a></h3>

<ul>
<li>This article introduces OpenHRC, the &quot;Open Household Router Contraption&quot;</li>
<li>In short, it&#39;s a set of bootstrapping scripts to turn a vanilla OpenBSD install into a feature-rich gateway device</li>
<li>It also makes use of Ansible playbooks for configuration, allowing for a more &quot;mass deployment&quot; type of setup</li>
<li>Everything is configured via a simple text file, and you end up with a local NTP server, DHCP server, firewall (obviously) and local caching DNS resolver - it even does DNSSEC validation</li>
<li>All the code is open source <a href="https://github.com/ioc32/openhrc" rel="nofollow">and on Github</a>, so you can read through what&#39;s actually being changed and put in place</li>
<li>There&#39;s also a <a href="https://www.youtube.com/watch?v=LZeKDM5jc90" rel="nofollow">video guide</a> to the entire process, if you&#39;re more of a visual person
***</li>
</ul>

<h3><a href="https://forum.opnsense.org/index.php?topic=365.0" rel="nofollow">OPNsense 15.1.10 released</a></h3>

<ul>
<li>Speaking of BSD routers, if you&#39;re looking for a &quot;prebuilt and ready to go&quot; option, OPNsense has just released a new version</li>
<li>15.1.10 drops some of the legacy patches they inherited from pfSense, aiming to stay closer to the mainline FreeBSD source code</li>
<li>Going along with this theme, they&#39;ve redone how they do ports, and are now kept totally in sync with the regular ports tree</li>
<li>Their binary packages are now signed using the fingerprint-style method, various GUI menus have been rewritten and a number of other bugs were fixed</li>
<li>NanoBSD-based images are also available now, so you can try it out on hardware with constrained resources as well</li>
<li>Version <a href="https://twitter.com/opnsense/status/596009164746432512" rel="nofollow">15.1.10.1</a> was released shortly thereafter, including a hotfix for VLANs
***</li>
</ul>

<h3><a href="https://www.ibm.com/developerworks/community/blogs/hpcgoulash/entry/ibm_workpad_z50_netbsd_an_interesting_combination1?lang=en" rel="nofollow">IBM Workpad Z50 and NetBSD</a></h3>

<ul>
<li>Before the infamous netbook fad came and went, IBM had a handheld PDA device that looked pretty much the same</li>
<li>Back in 1999, they released <a href="http://www.hpcfactor.com/reviews/hardware/ibm/workpad-z50/" rel="nofollow">the Workpad Z50</a> with Windows CE, sporting a 131MHz MIPS CPU, 16MB of RAM and a 640x480 display</li>
<li>You can probably tell where this is going... the article is about installing NetBSD it</li>
<li>&quot;What prevents me from taking my pristine Workpad z50 to the local electronics recycling  facility is NetBSD. With a little effort it is possible to install recent versions of NetBSD on the Workpad z50 and even have XWindows running&quot;</li>
<li>The author got pkgsrc up and running on it too, and cleverly used distcc to offload the compiling jobs to something a bit more modern</li>
<li>He&#39;s also got a <a href="https://www.youtube.com/watch?v=hSLVnSZKB9I" rel="nofollow">couple</a> <a href="https://www.youtube.com/watch?v=mIA-NWEHLM4" rel="nofollow">videos</a> of the bootup process and running Xorg (neither of which we&#39;d call &quot;speedy&quot; by any stretch of the imagination)
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/04/from-trenches-tips-tricks-edition.html" rel="nofollow">FreeBSD from the trenches</a></h3>

<ul>
<li>The FreeBSD foundation has a new blog post up in their &quot;from the trenches&quot; series, detailing FreeBSD in some real-world use cases</li>
<li>In this installment, Glen Barber talks about how he sets up all his laptops with ZFS and GELI</li>
<li>While the installer allows for an automatic ZFS layout, Glen notes that it&#39;s not a one-size-fits-all thing, and goes through doing everything manually</li>
<li>Each command is explained, and he walks you through the process of doing <a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">an encrypted installation</a> on your root zpool
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-May/207671.html" rel="nofollow">Broadwell in DragonFly</a></h3>

<ul>
<li>DragonFlyBSD has officially won the race to get an Intel Broadwell graphics driver</li>
<li>Their i915 driver has been brought up to speed with Linux 3.14&#39;s, adding not only Broadwell support, but many other bugfixes for other cards too</li>
<li>It&#39;s planned for commit to the main tree very soon, but you can test it out with a git branch for the time being
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s216QQcHyX" rel="nofollow">Bostjan writes in</a></li>
<li><a href="http://slexy.org/view/s21hGSk3c0" rel="nofollow">Hunter writes in</a></li>
<li><a href="http://slexy.org/view/s20JwPw9Je" rel="nofollow">Hrishi writes in</a></li>
<li><a href="http://slexy.org/view/s2x1GYr7y6" rel="nofollow">Clint writes in</a></li>
<li><a href="http://slexy.org/view/s2swXxr2PX" rel="nofollow">Sergei writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-advocacy/2015-May/004541.html" rel="nofollow">How did you guess</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ll be talking with Ed Schouten about CloudABI. It&#39;s a new application binary interface with a strong focus on isolation and restricted capabilities. As always, all this week&#39;s BSD news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2015-01-2015-03.html" rel="nofollow">FreeBSD quarterly status report</a></h3>

<ul>
<li>The FreeBSD team has posted a report of the activities that went on between January and March of this year</li>
<li>As usual, it&#39;s broken down into separate reports from the various teams in the project (ports, kernel, virtualization, etc)</li>
<li>The ports team continuing battling the flood of PRs, closing quite a lot of them and boasting nearly 7,000 commits this quarter</li>
<li>The core team and cluster admins dealt with the accidental deletion of the Bugzilla database, and are making plans for an improved backup strategy within the project going forward</li>
<li>FreeBSD&#39;s future release support model was also finalized and published in February, which should be a big improvement for both users and the release team</li>
<li>Some topics are still being discussed internally, mainly MFCing ZFS ARC responsiveness patches to the 10 branch and deciding whether to maintain or abandon C89 support in the kernel code</li>
<li>Lots of activity is happening in bhyve, some of which we&#39;ve covered <a href="http://www.bsdnow.tv/episodes/2015_04_29-on_the_list" rel="nofollow">recently</a>, and a number of improvements were made this quarter</li>
<li>Clang, LLVM and LLDB have been updated to the 3.6.0 branch in -CURRENT</li>
<li>Work to get FreeBSD booting natively on the POWER8 CPU architecture is also still in progress, but it does boot in KVM for the time being</li>
<li>The project to replace forth in the bootloader with lua is in its final stages, and can be used on x86 already</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover" rel="nofollow">ASLR work</a> is still being done by the HardenedBSD guys, and their next aim is position-independent executable</li>
<li>The report also touches on multipath TCP support, the new automounter, opaque ifnet, pkgng updates, secureboot (which should be in 10.2-RELEASE), GNOME and KDE on FreeBSD, PCIe hotplugging, nested kernel support and more</li>
<li>Also of note: work is going on to make ARM a Tier 1 platform in the upcoming 11.0-RELEASE (and support for more ARM boards is still being added, including ARM64)
***</li>
</ul>

<h3><a href="http://www.openbsd.org/57.html" rel="nofollow">OpenBSD 5.7 released</a></h3>

<ul>
<li>OpenBSD has formally released another new version, complete with the giant changelog we&#39;ve come to expect</li>
<li>In the hardware department, 5.7 features many driver improvements and fixes, as well as support for some new things: USB 3.0 controllers, newer Intel and Atheros wireless cards and some additional 10gbit NICs</li>
<li>If you&#39;re using one of the Soekris boards, there&#39;s even <a href="http://bodgitandscarper.co.uk/openbsd/further-soekris-net6501-improvements-for-openbsd/" rel="nofollow">a new driver</a> to manipulate the GPIO and LEDs on them - this has some fun possibilities</li>
<li>Some new security improvements include: <a href="https://en.wikipedia.org/wiki/SipHash" rel="nofollow">SipHash</a> being sprinkled in some areas to protect hashing functions, big <a href="https://www.marc.info/?l=openbsd-tech&m=142120787308107&w=2" rel="nofollow">W<sup>X</sup> improvements</a> in the kernel space, <a href="http://www.bsdnow.tv/episodes/2015_04_15-pie_in_the_sky" rel="nofollow">static PIE</a> on all architectures, deterministic &quot;random&quot; functions <a href="https://www.marc.info/?l=openbsd-tech&m=141807224826859&w=2" rel="nofollow">being replaced</a> with strong randomness, and support for remote logging over TLS</li>
<li>The entire source tree has also been audited to use <a href="http://lteo.net/blog/2014/10/28/reallocarray-in-openbsd-integer-overflow-detection-for-free/" rel="nofollow">reallocarray</a>, which unintentionally <a href="https://splone.com/blog/2015/3/11/integer-overflow-prevention-in-c" rel="nofollow">saved</a> OpenBSD&#39;s libc from being vulnerable to <a href="https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/" rel="nofollow">earlier attacks</a> affecting other BSDs&#39; implementations</li>
<li>Being that it&#39;s OpenBSD, a number of things have also been <em>removed</em> from the base system: procfs, sendmail, SSLv3 support and loadable kernel modules are all gone now (not to mention the continuing massacre of dead code in LibreSSL)</li>
<li>Some people seem to be surprised about the removal of loadable modules, but almost nothing utilized them in OpenBSD, so it was really just removing old code that no one used anymore - very different from FreeBSD or Linux in this regard, where kernel modules are used pretty heavily</li>
<li>BIND and nginx have been taken out, so you&#39;ll need to either use the versions in ports or switch to Unbound and the in-base HTTP daemon</li>
<li>Speaking of httpd, it&#39;s gotten a number of <a href="http://www.openbsd.org/papers/httpd-slides-asiabsdcon2015.pdf" rel="nofollow">new</a> <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/httpd.conf.5" rel="nofollow">features</a>, and has had time to grow and mature since its initial debut - if you&#39;ve been considering trying it out, now would be a great time to do so</li>
<li>This release also includes the latest OpenSSH (with stronger fingerprint types and host key rotation), OpenNTPD (with the HTTPS constraints feature), OpenSMTPD, LibreSSL and <a href="http://www.bsdnow.tv/episodes/2014_11_12-a_mans_man" rel="nofollow">mandoc</a></li>
<li>Check the <a href="http://www.openbsd.org/errata57.html" rel="nofollow">errata page</a> for any post-release fixes, and the <a href="http://www.openbsd.org/faq/upgrade57.html" rel="nofollow">upgrade guide</a> for specific instructions on updating from 5.6</li>
<li>Groundwork has also been laid for some major SMP scalability improvements - look forward to those in future releases</li>
<li>There&#39;s a <a href="http://www.openbsd.org/lyrics.html#57" rel="nofollow">song and artwork</a> to go along with the release as always, and CDs should be arriving within a few days - we&#39;ll show some pictures next week</li>
<li>Consider <a href="https://www.openbsdstore.com" rel="nofollow">picking one up</a> to support the project (and it&#39;s the only way to get puffy stickers)</li>
<li>For those of you paying close attention, the <a href="http://www.openbsd.org/images/puffy57.gif" rel="nofollow">banner image</a> for this release just might remind you of a <a href="http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time" rel="nofollow">certain special episode</a> of BSD Now...
***</li>
</ul>

<h3><a href="https://torbsd.github.io/" rel="nofollow">Tor-BSD diversity project</a></h3>

<ul>
<li>We&#39;ve talked about Tor on the show a few times, and specifically about getting more of the network on BSD (Linux has an overwhelming majority right now)</li>
<li>A new initiative has started to do just that, called the Tor-BSD diversity project</li>
<li>&quot;Monocultures in nature are dangerous, as vulnerabilities are held in common across a broad spectrum. Diversity means single vulnerabilities are less likely to harm the entire ecosystem. [...] A single kernel vulnerability in GNU/Linux that impacting Tor relays could be devastating. We want to see a stronger Tor network, and we believe one critical ingredient for that is operating system diversity.&quot;</li>
<li>In addition to encouraging people to put up more relays, they&#39;re also continuing work on porting the Tor Browser Bundle to BSD, so more desktop users can have easy access to online privacy</li>
<li>There&#39;s an additional <a href="http://trac.haqistan.net/blog/tor-browser-ports-progress" rel="nofollow">progress report</a> for that part specifically, and it looks like most of the work is done now</li>
<li>Engaging the broader BSD community about Tor and fixing up the official documentation are also both on their todo list </li>
<li>If you&#39;ve been considering running a node to help out, there&#39;s always <a href="http://www.bsdnow.tv/tutorials/tor" rel="nofollow">our handy tutorial</a> on getting set up
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/05/pc-bsd-10-1-2-rc1-now-available/" rel="nofollow">PC-BSD 10.1.2-RC1 released</a></h3>

<ul>
<li>If you want a sneak peek at the upcoming PC-BSD 10.1.2, the first release candidate is now available to grab</li>
<li>This quarterly update includes a number of new features, improvements and even some additional utilities</li>
<li>PersonaCrypt is one of them - it&#39;s a new tool for easily migrating encrypted home directories between systems</li>
<li>A new &quot;stealth mode&quot; option allows for a one-time login, using a blank home directory that gets wiped after use</li>
<li>Similarly, a new &quot;Tor mode&quot; allows for easy tunneling of all your traffic through the Tor network</li>
<li>IPFW is now the default firewall, offering improved VIMAGE capabilities</li>
<li>The life preserver backup tool now allows for bare-metal restores via the install CD</li>
<li>ISC&#39;s NTP daemon has been replaced with <a href="http://www.bsdnow.tv/episodes/2015_02_11-time_for_a_change" rel="nofollow">OpenNTPD</a>, and OpenSSL has been replaced with <a href="http://www.bsdnow.tv/episodes/2015_03_25-ssl_in_the_wild" rel="nofollow">LibreSSL</a></li>
<li>It also includes the latest <a href="http://www.bsdnow.tv/episodes/2014_09_10-luminary_environment" rel="nofollow">Lumina</a> desktop, and there&#39;s another <a href="http://blog.pcbsd.org/2015/05/pc-bsd-10-1-2-rc1-lumina-desktop-0-8-4-released/" rel="nofollow">post dedicated to that</a></li>
<li>Binary packages have also been updated to fresh versions from the ports tree</li>
<li>More details, including upgrade instructions, can be found in the linked blog post
***</li>
</ul>

<h2>Interview - Ed Schouten - <a href="mailto:ed@freebsd.org" rel="nofollow">ed@freebsd.org</a> / <a href="https://twitter.com/edschouten" rel="nofollow">@edschouten</a></h2>

<p><a href="https://www.bsdcan.org/2015/schedule/track/Security/524.en.html" rel="nofollow">CloudABI</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://code.saghul.net/index.php/2015/05/01/announcing-the-open-household-router-contraption/" rel="nofollow">Open Household Router Contraption</a></h3>

<ul>
<li>This article introduces OpenHRC, the &quot;Open Household Router Contraption&quot;</li>
<li>In short, it&#39;s a set of bootstrapping scripts to turn a vanilla OpenBSD install into a feature-rich gateway device</li>
<li>It also makes use of Ansible playbooks for configuration, allowing for a more &quot;mass deployment&quot; type of setup</li>
<li>Everything is configured via a simple text file, and you end up with a local NTP server, DHCP server, firewall (obviously) and local caching DNS resolver - it even does DNSSEC validation</li>
<li>All the code is open source <a href="https://github.com/ioc32/openhrc" rel="nofollow">and on Github</a>, so you can read through what&#39;s actually being changed and put in place</li>
<li>There&#39;s also a <a href="https://www.youtube.com/watch?v=LZeKDM5jc90" rel="nofollow">video guide</a> to the entire process, if you&#39;re more of a visual person
***</li>
</ul>

<h3><a href="https://forum.opnsense.org/index.php?topic=365.0" rel="nofollow">OPNsense 15.1.10 released</a></h3>

<ul>
<li>Speaking of BSD routers, if you&#39;re looking for a &quot;prebuilt and ready to go&quot; option, OPNsense has just released a new version</li>
<li>15.1.10 drops some of the legacy patches they inherited from pfSense, aiming to stay closer to the mainline FreeBSD source code</li>
<li>Going along with this theme, they&#39;ve redone how they do ports, and are now kept totally in sync with the regular ports tree</li>
<li>Their binary packages are now signed using the fingerprint-style method, various GUI menus have been rewritten and a number of other bugs were fixed</li>
<li>NanoBSD-based images are also available now, so you can try it out on hardware with constrained resources as well</li>
<li>Version <a href="https://twitter.com/opnsense/status/596009164746432512" rel="nofollow">15.1.10.1</a> was released shortly thereafter, including a hotfix for VLANs
***</li>
</ul>

<h3><a href="https://www.ibm.com/developerworks/community/blogs/hpcgoulash/entry/ibm_workpad_z50_netbsd_an_interesting_combination1?lang=en" rel="nofollow">IBM Workpad Z50 and NetBSD</a></h3>

<ul>
<li>Before the infamous netbook fad came and went, IBM had a handheld PDA device that looked pretty much the same</li>
<li>Back in 1999, they released <a href="http://www.hpcfactor.com/reviews/hardware/ibm/workpad-z50/" rel="nofollow">the Workpad Z50</a> with Windows CE, sporting a 131MHz MIPS CPU, 16MB of RAM and a 640x480 display</li>
<li>You can probably tell where this is going... the article is about installing NetBSD it</li>
<li>&quot;What prevents me from taking my pristine Workpad z50 to the local electronics recycling  facility is NetBSD. With a little effort it is possible to install recent versions of NetBSD on the Workpad z50 and even have XWindows running&quot;</li>
<li>The author got pkgsrc up and running on it too, and cleverly used distcc to offload the compiling jobs to something a bit more modern</li>
<li>He&#39;s also got a <a href="https://www.youtube.com/watch?v=hSLVnSZKB9I" rel="nofollow">couple</a> <a href="https://www.youtube.com/watch?v=mIA-NWEHLM4" rel="nofollow">videos</a> of the bootup process and running Xorg (neither of which we&#39;d call &quot;speedy&quot; by any stretch of the imagination)
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/04/from-trenches-tips-tricks-edition.html" rel="nofollow">FreeBSD from the trenches</a></h3>

<ul>
<li>The FreeBSD foundation has a new blog post up in their &quot;from the trenches&quot; series, detailing FreeBSD in some real-world use cases</li>
<li>In this installment, Glen Barber talks about how he sets up all his laptops with ZFS and GELI</li>
<li>While the installer allows for an automatic ZFS layout, Glen notes that it&#39;s not a one-size-fits-all thing, and goes through doing everything manually</li>
<li>Each command is explained, and he walks you through the process of doing <a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">an encrypted installation</a> on your root zpool
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-May/207671.html" rel="nofollow">Broadwell in DragonFly</a></h3>

<ul>
<li>DragonFlyBSD has officially won the race to get an Intel Broadwell graphics driver</li>
<li>Their i915 driver has been brought up to speed with Linux 3.14&#39;s, adding not only Broadwell support, but many other bugfixes for other cards too</li>
<li>It&#39;s planned for commit to the main tree very soon, but you can test it out with a git branch for the time being
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s216QQcHyX" rel="nofollow">Bostjan writes in</a></li>
<li><a href="http://slexy.org/view/s21hGSk3c0" rel="nofollow">Hunter writes in</a></li>
<li><a href="http://slexy.org/view/s20JwPw9Je" rel="nofollow">Hrishi writes in</a></li>
<li><a href="http://slexy.org/view/s2x1GYr7y6" rel="nofollow">Clint writes in</a></li>
<li><a href="http://slexy.org/view/s2swXxr2PX" rel="nofollow">Sergei writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-advocacy/2015-May/004541.html" rel="nofollow">How did you guess</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>87: On the List</title>
  <link>https://www.bsdnow.tv/87</link>
  <guid isPermaLink="false">56f4b27b-9384-4cb9-9877-d825f62815a7</guid>
  <pubDate>Wed, 29 Apr 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/56f4b27b-9384-4cb9-9877-d825f62815a7.mp3" length="58344340" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this time on the show, we'll be speaking with Christos Zoulas, a NetBSD security officer. He's got a new project called blacklistd, with some interesting possibilities for stopping bruteforce attacks. We've also got answers to your emails and all this week's news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:21:02</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this time on the show, we'll be speaking with Christos Zoulas, a NetBSD security officer. He's got a new project called blacklistd, with some interesting possibilities for stopping bruteforce attacks. We've also got answers to your emails and all this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
New PAE support in OpenBSD (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142990524317070&amp;amp;w=2)
OpenBSD has just added Physical Address Extention (https://en.wikipedia.org/wiki/Physical_Address_Extension) support to the i386 architecture, but it's probably not what you'd think of when you hear the term
In most operating systems, PAE's main advantage is to partially circumvent the 4GB memory limit on 32 bit platforms - this version isn't for that
Instead, this change specifically allows the system to use the No-eXecute Bit (https://en.wikipedia.org/wiki/NX_bit#OpenBSD) of the processor for the userland, further hardening the in-place memory protections
Other operating systems enable the CPU feature without doing anything to the page table entries (https://en.wikipedia.org/wiki/Page_table#Role_of_the_page_table), so they do get the available memory expansion, but don't get the potential security benefit
As we discussed in a previous episode (http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach), the AMD64 platform already saw some major W^X kernel and userland improvements - the i386 kernel reworking will begin shortly
Not all CPUs support this feature, but, if yours supports NX, this will improve upon the previous version of W^X that was already there
The AMD64 improvements will be in 5.7, due out in just a couple days as of when we're recording this, but the i386 improvements will likely be in 5.8
***
Booting Windows in bhyve (https://twitter.com/nahannisys/status/591733319357730816)
Work on FreeBSD's bhyve (http://www.bsdnow.tv/episodes/2014_01_15-bhyve_mind) continues, and a big addition is on the way
Thus far, bhyve has only been able to boot operating systems with a serial console - no VGA, no graphics, no Windows
This is finally changing, and a teasing screenshot of Windows Server was recently posted on Twitter
Graphics emulation is still in the works; this image was taken by booting headless and using RDP
A lot of the needed code is being committed to -CURRENT now, but the UEFI portion of it requires a bit more development (and the aim for that is around the time of BSDCan)
Not a lot of details on the matter currently, but we'll be sure to bring you more info as it comes out
Are you more interested in bhyve or Xen on FreeBSD? Email us your thoughts
***
MidnightBSD 0.6 released (http://www.midnightbsd.org/notes/)
MidnightBSD is a smaller project we've not covered a lot on the show before
It's an operating system that was forked from FreeBSD back in the 6.1 days, and their focus seems to be on ease-of-use
They also have their own, smaller version of FreeBSD ports, called "mports"
If you're already using it, this new version is mainly a security and bugfix release
It syncs up with the most recent FreeBSD security patches and gets a lot of their ports closer to the latest versions
You can check their site (http://www.midnightbsd.org/about/) for more information about the project
We're trying to get the lead developer to come on for an interview, but haven't heard anything back yet
***
OpenBSD rewrites the file utility (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142989267412968&amp;amp;w=4)
We're all probably familiar with the traditional file (https://en.wikipedia.org/wiki/File_%28command%29) command - it's been around since the 1970s (http://darwinsys.com/file/)
For anyone who doesn't know, it's used to determine what type of file something actually is
This tool doesn't see a lot of development these days, and it's had its share of security issues as well
Some of those security issues remain (https://www.marc.info/?l=openbsd-tech&amp;amp;m=141857001403570&amp;amp;w=2) unfixed (https://www.marc.info/?l=freebsd-security&amp;amp;m=142980545021888&amp;amp;w=2) in various BSDs even today, despite being publicly known for a while
It's not uncommon for people to run file on random things they download from the internet, maybe even as root, and some of the previous bugs have allowed file to overwrite other files or execute code as the user running it
When you think about it, file was technically designed to be used on untrusted files
OpenBSD developer Nicholas Marriott, who also happens to be the author of tmux, decided it was time to do a complete rewrite - this time with modern coding practices and the usual OpenBSD scrutiny
This new version will, by default, run as an unprivileged user (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=143014212727213&amp;amp;w=2) with no shell, and in a systrace sandbox (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=143014276127454&amp;amp;w=2), strictly limiting what system calls can be made
With these two things combined, it should drastically reduce the damage a malicious file could potentially do
Ian Darwin, the original author of the utility, saw the commit and replied (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142989483913635&amp;amp;w=4), in what may be a moment in BSD history to remember
It'll be interesting to see if the other BSDs, OS X, Linux or other UNIXes consider adopting this implementation in the future - someone's already thrown together an unofficial portable version
Coincidentally, the lead developer and current maintainer of file just happens to be our guest today…
***
Interview - Christos Zoulas - christos@netbsd.org (mailto:christos@netbsd.org)
blacklistd (https://www.youtube.com/watch?v=0UKCAsezF3Q) and NetBSD advocacy
News Roundup
GSoC-accepted BSD projects (https://www.google-melange.com/gsoc/projects/list/google/gsoc2015)
The Google Summer of Code people have published a list of all the projects that got accepted this year, and both FreeBSD and OpenBSD are on that list
FreeBSD's list (https://wiki.freebsd.org/SummerOfCode2015Projects) includes: NE2000 device model in userspace for bhyve, updating Ficl in the bootloader, type-aware kernel virtual memory access for utilities, JIT compilation for firewalls, test cluster automation, Linux packages for pkgng, an mtree parsing and manipulation library, porting bhyve to ARM-based platforms, CD-ROM emulation in CTL, libc security extensions, gptzfsboot support for dynamically discovering BEs during startup, CubieBoard support, a bhyve version of the netmap virtual passthrough for VMs, PXE support for FreeBSD guests in bhyve and finally.. memory compression and deduplication
OpenBSD's list (http://www.openbsdfoundation.org/gsoc2015.html) includes: asynchronous USB transfer submission from userland, ARM SD/MMC &amp;amp; controller driver in libsa, improving USB userland tools and ioctl, automating module porting, implementing a KMS driver to the kernel and, wait for it... porting HAMMER FS to OpenBSD
We'll be sure to keep you up to date on developments from both projects
Hopefully the other BSDs will make the cut too next year
***
FreeBSD on the Gumstix Duovero (http://www.jumpnowtek.com/gumstix-freebsd/FreeBSD-Duovero-build-workstation-setup.html)
If you're not familiar with the Gumstix Duovero, it's an dual core ARM-based computer-on-module (https://store.gumstix.com/index.php/coms/duovero-coms.html)
They actually look more like a stick of RAM than a mini-computer
This article shows you how to build a FreeBSD -CURRENT image to run on them, using crochet-freebsd (https://github.com/freebsd/crochet)
If anyone has any interesting devices like this that they use BSD on, write up something about it and send it to us
***
EU study recommends OpenBSD (https://joinup.ec.europa.eu/community/osor/news/ep-study-%E2%80%9Ceu-should-finance-key-open-source-tools%E2%80%9D)
A recent study by the European Parliament was published, explaining that more funding should go into critical open source projects and tools
This is especially important, in all countries, after the mass surveillance documents came out 
"[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts."
The report goes on to mention users becoming more and more security and privacy-aware, installing additional software to help protect themselves and their traffic from being spied on
Alongside Qubes, a Linux distro focused on containment and isolation, OpenBSD got a special mention: "Proactive security and cryptography are two of the features highlighted in the product together with portability, standardisation and correctness. Its built-in cryptography and packet filter make OpenBSD suitable for use in the security industry, for example on firewalls, intrusion-detection systems and VPN gateways"
Reddit, Undeadly and Hacker News also had (https://www.reddit.com/r/programming/comments/340xh3/eu_study_recommends_use_of_openbsd_for_its/) some (http://undeadly.org/cgi?action=article&amp;amp;sid=20150427093546) discussion (https://news.ycombinator.com/item?id=9445831), particularly about corporations giving back to the BSDs that they make use of in their infrastructure - something we've discussed with Voxer (http://www.bsdnow.tv/episodes/2014_10_08-behind_the_masq) and M:Tier (http://www.bsdnow.tv/episodes/2015_04_22-business_as_usual) before
***
FreeBSD workflow with Git (https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055551.html)
If you're interested in contributing to FreeBSD, but aren't a big fan of SVN, they have a Github mirror too
This mailing list post talks about interacting between (https://wiki.freebsd.org/GitWorkflow/GitSvn) the official source repository and the Git mirror
This makes it easy to get pull requests merged into the official tree, and encourages more developers to get involved
***
Feedback/Questions
Sean writes in (http://slexy.org/view/s2vjh3ogvG)
Bryan writes in (http://slexy.org/view/s20GMcWvKE)
Sean writes in (http://slexy.org/view/s21M1imT3d)
Charles writes in (http://slexy.org/view/s25ScxQSwb)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, blacklistd, file, pae, w^x, aslr, bhyve, windows, efi, rdp, gumstix, duovero, midnightbsd, coreclr, gsoc</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this time on the show, we&#39;ll be speaking with Christos Zoulas, a NetBSD security officer. He&#39;s got a new project called blacklistd, with some interesting possibilities for stopping bruteforce attacks. We&#39;ve also got answers to your emails and all this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=142990524317070&w=2" rel="nofollow">New PAE support in OpenBSD</a></h3>

<ul>
<li>OpenBSD has just added <a href="https://en.wikipedia.org/wiki/Physical_Address_Extension" rel="nofollow">Physical Address Extention</a> support to the i386 architecture, but it&#39;s probably not what you&#39;d think of when you hear the term</li>
<li>In most operating systems, PAE&#39;s main advantage is to partially circumvent the 4GB memory limit on 32 bit platforms - this version isn&#39;t for that</li>
<li>Instead, this change specifically allows the system to use the <a href="https://en.wikipedia.org/wiki/NX_bit#OpenBSD" rel="nofollow">No-eXecute Bit</a> of the processor for the userland, further hardening the in-place memory protections</li>
<li>Other operating systems enable the CPU feature without doing anything to the <a href="https://en.wikipedia.org/wiki/Page_table#Role_of_the_page_table" rel="nofollow">page table entries</a>, so they <strong>do get</strong> the available memory expansion, but <strong>don&#39;t get</strong> the potential security benefit</li>
<li>As we discussed in a <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">previous episode</a>, the AMD64 platform already saw some major W<sup>X</sup> kernel <strong>and</strong> userland improvements - the i386 kernel reworking will begin shortly</li>
<li>Not all CPUs support this feature, but, if yours supports NX, this will improve upon the previous version of W<sup>X</sup> that was already there</li>
<li>The AMD64 improvements will be in 5.7, due out in just a couple days as of when we&#39;re recording this, but the i386 improvements will likely be in 5.8
***</li>
</ul>

<h3><a href="https://twitter.com/nahannisys/status/591733319357730816" rel="nofollow">Booting Windows in bhyve</a></h3>

<ul>
<li>Work on FreeBSD&#39;s <a href="http://www.bsdnow.tv/episodes/2014_01_15-bhyve_mind" rel="nofollow">bhyve</a> continues, and a big addition is on the way</li>
<li>Thus far, bhyve has only been able to boot operating systems with a serial console - no VGA, no graphics, <em>no Windows</em></li>
<li>This is finally changing, and a teasing screenshot of Windows Server was recently posted on Twitter</li>
<li>Graphics emulation is still in the works; this image was taken by booting headless and using RDP</li>
<li>A lot of the needed code is being committed to -CURRENT now, but the UEFI portion of it requires a bit more development (and the aim for that is around the time of BSDCan)</li>
<li>Not a lot of details on the matter currently, but we&#39;ll be sure to bring you more info as it comes out</li>
<li>Are you more interested in bhyve or Xen on FreeBSD? Email us your thoughts
***</li>
</ul>

<h3><a href="http://www.midnightbsd.org/notes/" rel="nofollow">MidnightBSD 0.6 released</a></h3>

<ul>
<li>MidnightBSD is a smaller project we&#39;ve not covered a lot on the show before</li>
<li>It&#39;s an operating system that was forked from FreeBSD back in the 6.1 days, and their focus seems to be on ease-of-use</li>
<li>They also have their own, smaller version of FreeBSD ports, called &quot;mports&quot;</li>
<li>If you&#39;re already using it, this new version is mainly a security and bugfix release</li>
<li>It syncs up with the most recent FreeBSD security patches and gets a lot of their ports closer to the latest versions</li>
<li>You can check <a href="http://www.midnightbsd.org/about/" rel="nofollow">their site</a> for more information about the project</li>
<li>We&#39;re trying to get the lead developer to come on for an interview, but haven&#39;t heard anything back yet
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=142989267412968&w=4" rel="nofollow">OpenBSD rewrites the file utility</a></h3>

<ul>
<li>We&#39;re all probably familiar with the traditional <a href="https://en.wikipedia.org/wiki/File_%28command%29" rel="nofollow">file</a> command - it&#39;s been around <a href="http://darwinsys.com/file/" rel="nofollow">since the 1970s</a></li>
<li>For anyone who doesn&#39;t know, it&#39;s used to determine what type of file something actually is</li>
<li>This tool doesn&#39;t see a lot of development these days, and it&#39;s had its share of security issues as well</li>
<li>Some of those security issues <a href="https://www.marc.info/?l=openbsd-tech&m=141857001403570&w=2" rel="nofollow">remain</a> <a href="https://www.marc.info/?l=freebsd-security&m=142980545021888&w=2" rel="nofollow">unfixed</a> in various BSDs <strong>even today</strong>, despite being publicly known for a while</li>
<li>It&#39;s not uncommon for people to run file on random things they download from the internet, maybe even as root, and some of the previous bugs have allowed file to overwrite other files or execute code as the user running it</li>
<li>When you think about it, file was technically <em>designed</em> to be used on untrusted files</li>
<li>OpenBSD developer Nicholas Marriott, who also happens to be the author of tmux, decided it was time to do a complete rewrite - this time with modern coding practices and the usual OpenBSD scrutiny</li>
<li>This new version will, by default, run <a href="https://www.marc.info/?l=openbsd-cvs&m=143014212727213&w=2" rel="nofollow">as an unprivileged user</a> with no shell, and in a <a href="https://www.marc.info/?l=openbsd-cvs&m=143014276127454&w=2" rel="nofollow">systrace sandbox</a>, strictly limiting what system calls can be made</li>
<li>With these two things combined, it should drastically reduce the damage a malicious file could potentially do</li>
<li>Ian Darwin, the original author of the utility, <a href="https://www.marc.info/?l=openbsd-cvs&m=142989483913635&w=4" rel="nofollow">saw the commit and replied</a>, in what may be a moment in BSD history to remember</li>
<li>It&#39;ll be interesting to see if the other BSDs, OS X, Linux or other UNIXes consider adopting this implementation in the future - someone&#39;s already thrown together an unofficial portable version</li>
<li>Coincidentally, the lead developer and current maintainer of file just happens to be our guest today…
***</li>
</ul>

<h2>Interview - Christos Zoulas - <a href="mailto:christos@netbsd.org" rel="nofollow">christos@netbsd.org</a></h2>

<p><a href="https://www.youtube.com/watch?v=0UKCAsezF3Q" rel="nofollow">blacklistd</a> and NetBSD advocacy</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.google-melange.com/gsoc/projects/list/google/gsoc2015" rel="nofollow">GSoC-accepted BSD projects</a></h3>

<ul>
<li>The Google Summer of Code people have published a list of all the projects that got accepted this year, and both FreeBSD and OpenBSD are on that list</li>
<li>FreeBSD&#39;s <a href="https://wiki.freebsd.org/SummerOfCode2015Projects" rel="nofollow">list</a> includes: NE2000 device model in userspace for bhyve, updating Ficl in the bootloader, type-aware kernel virtual memory access for utilities, JIT compilation for firewalls, test cluster automation, Linux packages for pkgng, an mtree parsing and manipulation library, porting bhyve to ARM-based platforms, CD-ROM emulation in CTL, libc security extensions, gptzfsboot support for dynamically discovering BEs during startup, CubieBoard support, a bhyve version of the netmap virtual passthrough for VMs, PXE support for FreeBSD guests in bhyve and finally.. <strong>memory compression and deduplication</strong></li>
<li>OpenBSD&#39;s <a href="http://www.openbsdfoundation.org/gsoc2015.html" rel="nofollow">list</a> includes: asynchronous USB transfer submission from userland, ARM SD/MMC &amp; controller driver in libsa, improving USB userland tools and ioctl, automating module porting, implementing a KMS driver to the kernel and, wait for it... <strong>porting HAMMER FS to OpenBSD</strong></li>
<li>We&#39;ll be sure to keep you up to date on developments from both projects</li>
<li>Hopefully the other BSDs will make the cut too next year
***</li>
</ul>

<h3><a href="http://www.jumpnowtek.com/gumstix-freebsd/FreeBSD-Duovero-build-workstation-setup.html" rel="nofollow">FreeBSD on the Gumstix Duovero</a></h3>

<ul>
<li>If you&#39;re not familiar with the Gumstix Duovero, it&#39;s an dual core ARM-based <a href="https://store.gumstix.com/index.php/coms/duovero-coms.html" rel="nofollow">computer-on-module</a></li>
<li>They actually look more like a stick of RAM than a mini-computer</li>
<li>This article shows you how to build a FreeBSD -CURRENT image to run on them, using <a href="https://github.com/freebsd/crochet" rel="nofollow">crochet-freebsd</a></li>
<li>If anyone has any interesting devices like this that they use BSD on, write up something about it and send it to us
***</li>
</ul>

<h3><a href="https://joinup.ec.europa.eu/community/osor/news/ep-study-%E2%80%9Ceu-should-finance-key-open-source-tools%E2%80%9D" rel="nofollow">EU study recommends OpenBSD</a></h3>

<ul>
<li>A recent study by the European Parliament was published, explaining that more funding should go into critical open source projects and tools</li>
<li>This is especially important, in all countries, after the mass surveillance documents came out </li>
<li>&quot;[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts.&quot;</li>
<li>The report goes on to mention users becoming more and more security and privacy-aware, installing additional software to help protect themselves and their traffic from being spied on</li>
<li>Alongside Qubes, a Linux distro focused on containment and isolation, OpenBSD got a special mention: &quot;Proactive security and cryptography are two of the features highlighted in the product together with portability, standardisation and correctness. Its built-in cryptography and packet filter make OpenBSD suitable for use in the security industry, for example on firewalls, intrusion-detection systems and VPN gateways&quot;</li>
<li>Reddit, Undeadly and Hacker News also <a href="https://www.reddit.com/r/programming/comments/340xh3/eu_study_recommends_use_of_openbsd_for_its/" rel="nofollow">had</a> <a href="http://undeadly.org/cgi?action=article&sid=20150427093546" rel="nofollow">some</a> <a href="https://news.ycombinator.com/item?id=9445831" rel="nofollow">discussion</a>, particularly about corporations giving back to the BSDs that they make use of in their infrastructure - something we&#39;ve discussed with <a href="http://www.bsdnow.tv/episodes/2014_10_08-behind_the_masq" rel="nofollow">Voxer</a> and <a href="http://www.bsdnow.tv/episodes/2015_04_22-business_as_usual" rel="nofollow">M:Tier</a> before
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055551.html" rel="nofollow">FreeBSD workflow with Git</a></h3>

<ul>
<li>If you&#39;re interested in contributing to FreeBSD, but aren&#39;t a big fan of SVN, they have a Github mirror too</li>
<li>This mailing list post talks about interacting <a href="https://wiki.freebsd.org/GitWorkflow/GitSvn" rel="nofollow">between</a> the official source repository and the Git mirror</li>
<li>This makes it easy to get pull requests merged into the official tree, and encourages more developers to get involved
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2vjh3ogvG" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s20GMcWvKE" rel="nofollow">Bryan writes in</a></li>
<li><a href="http://slexy.org/view/s21M1imT3d" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s25ScxQSwb" rel="nofollow">Charles writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this time on the show, we&#39;ll be speaking with Christos Zoulas, a NetBSD security officer. He&#39;s got a new project called blacklistd, with some interesting possibilities for stopping bruteforce attacks. We&#39;ve also got answers to your emails and all this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=142990524317070&w=2" rel="nofollow">New PAE support in OpenBSD</a></h3>

<ul>
<li>OpenBSD has just added <a href="https://en.wikipedia.org/wiki/Physical_Address_Extension" rel="nofollow">Physical Address Extention</a> support to the i386 architecture, but it&#39;s probably not what you&#39;d think of when you hear the term</li>
<li>In most operating systems, PAE&#39;s main advantage is to partially circumvent the 4GB memory limit on 32 bit platforms - this version isn&#39;t for that</li>
<li>Instead, this change specifically allows the system to use the <a href="https://en.wikipedia.org/wiki/NX_bit#OpenBSD" rel="nofollow">No-eXecute Bit</a> of the processor for the userland, further hardening the in-place memory protections</li>
<li>Other operating systems enable the CPU feature without doing anything to the <a href="https://en.wikipedia.org/wiki/Page_table#Role_of_the_page_table" rel="nofollow">page table entries</a>, so they <strong>do get</strong> the available memory expansion, but <strong>don&#39;t get</strong> the potential security benefit</li>
<li>As we discussed in a <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">previous episode</a>, the AMD64 platform already saw some major W<sup>X</sup> kernel <strong>and</strong> userland improvements - the i386 kernel reworking will begin shortly</li>
<li>Not all CPUs support this feature, but, if yours supports NX, this will improve upon the previous version of W<sup>X</sup> that was already there</li>
<li>The AMD64 improvements will be in 5.7, due out in just a couple days as of when we&#39;re recording this, but the i386 improvements will likely be in 5.8
***</li>
</ul>

<h3><a href="https://twitter.com/nahannisys/status/591733319357730816" rel="nofollow">Booting Windows in bhyve</a></h3>

<ul>
<li>Work on FreeBSD&#39;s <a href="http://www.bsdnow.tv/episodes/2014_01_15-bhyve_mind" rel="nofollow">bhyve</a> continues, and a big addition is on the way</li>
<li>Thus far, bhyve has only been able to boot operating systems with a serial console - no VGA, no graphics, <em>no Windows</em></li>
<li>This is finally changing, and a teasing screenshot of Windows Server was recently posted on Twitter</li>
<li>Graphics emulation is still in the works; this image was taken by booting headless and using RDP</li>
<li>A lot of the needed code is being committed to -CURRENT now, but the UEFI portion of it requires a bit more development (and the aim for that is around the time of BSDCan)</li>
<li>Not a lot of details on the matter currently, but we&#39;ll be sure to bring you more info as it comes out</li>
<li>Are you more interested in bhyve or Xen on FreeBSD? Email us your thoughts
***</li>
</ul>

<h3><a href="http://www.midnightbsd.org/notes/" rel="nofollow">MidnightBSD 0.6 released</a></h3>

<ul>
<li>MidnightBSD is a smaller project we&#39;ve not covered a lot on the show before</li>
<li>It&#39;s an operating system that was forked from FreeBSD back in the 6.1 days, and their focus seems to be on ease-of-use</li>
<li>They also have their own, smaller version of FreeBSD ports, called &quot;mports&quot;</li>
<li>If you&#39;re already using it, this new version is mainly a security and bugfix release</li>
<li>It syncs up with the most recent FreeBSD security patches and gets a lot of their ports closer to the latest versions</li>
<li>You can check <a href="http://www.midnightbsd.org/about/" rel="nofollow">their site</a> for more information about the project</li>
<li>We&#39;re trying to get the lead developer to come on for an interview, but haven&#39;t heard anything back yet
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=142989267412968&w=4" rel="nofollow">OpenBSD rewrites the file utility</a></h3>

<ul>
<li>We&#39;re all probably familiar with the traditional <a href="https://en.wikipedia.org/wiki/File_%28command%29" rel="nofollow">file</a> command - it&#39;s been around <a href="http://darwinsys.com/file/" rel="nofollow">since the 1970s</a></li>
<li>For anyone who doesn&#39;t know, it&#39;s used to determine what type of file something actually is</li>
<li>This tool doesn&#39;t see a lot of development these days, and it&#39;s had its share of security issues as well</li>
<li>Some of those security issues <a href="https://www.marc.info/?l=openbsd-tech&m=141857001403570&w=2" rel="nofollow">remain</a> <a href="https://www.marc.info/?l=freebsd-security&m=142980545021888&w=2" rel="nofollow">unfixed</a> in various BSDs <strong>even today</strong>, despite being publicly known for a while</li>
<li>It&#39;s not uncommon for people to run file on random things they download from the internet, maybe even as root, and some of the previous bugs have allowed file to overwrite other files or execute code as the user running it</li>
<li>When you think about it, file was technically <em>designed</em> to be used on untrusted files</li>
<li>OpenBSD developer Nicholas Marriott, who also happens to be the author of tmux, decided it was time to do a complete rewrite - this time with modern coding practices and the usual OpenBSD scrutiny</li>
<li>This new version will, by default, run <a href="https://www.marc.info/?l=openbsd-cvs&m=143014212727213&w=2" rel="nofollow">as an unprivileged user</a> with no shell, and in a <a href="https://www.marc.info/?l=openbsd-cvs&m=143014276127454&w=2" rel="nofollow">systrace sandbox</a>, strictly limiting what system calls can be made</li>
<li>With these two things combined, it should drastically reduce the damage a malicious file could potentially do</li>
<li>Ian Darwin, the original author of the utility, <a href="https://www.marc.info/?l=openbsd-cvs&m=142989483913635&w=4" rel="nofollow">saw the commit and replied</a>, in what may be a moment in BSD history to remember</li>
<li>It&#39;ll be interesting to see if the other BSDs, OS X, Linux or other UNIXes consider adopting this implementation in the future - someone&#39;s already thrown together an unofficial portable version</li>
<li>Coincidentally, the lead developer and current maintainer of file just happens to be our guest today…
***</li>
</ul>

<h2>Interview - Christos Zoulas - <a href="mailto:christos@netbsd.org" rel="nofollow">christos@netbsd.org</a></h2>

<p><a href="https://www.youtube.com/watch?v=0UKCAsezF3Q" rel="nofollow">blacklistd</a> and NetBSD advocacy</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.google-melange.com/gsoc/projects/list/google/gsoc2015" rel="nofollow">GSoC-accepted BSD projects</a></h3>

<ul>
<li>The Google Summer of Code people have published a list of all the projects that got accepted this year, and both FreeBSD and OpenBSD are on that list</li>
<li>FreeBSD&#39;s <a href="https://wiki.freebsd.org/SummerOfCode2015Projects" rel="nofollow">list</a> includes: NE2000 device model in userspace for bhyve, updating Ficl in the bootloader, type-aware kernel virtual memory access for utilities, JIT compilation for firewalls, test cluster automation, Linux packages for pkgng, an mtree parsing and manipulation library, porting bhyve to ARM-based platforms, CD-ROM emulation in CTL, libc security extensions, gptzfsboot support for dynamically discovering BEs during startup, CubieBoard support, a bhyve version of the netmap virtual passthrough for VMs, PXE support for FreeBSD guests in bhyve and finally.. <strong>memory compression and deduplication</strong></li>
<li>OpenBSD&#39;s <a href="http://www.openbsdfoundation.org/gsoc2015.html" rel="nofollow">list</a> includes: asynchronous USB transfer submission from userland, ARM SD/MMC &amp; controller driver in libsa, improving USB userland tools and ioctl, automating module porting, implementing a KMS driver to the kernel and, wait for it... <strong>porting HAMMER FS to OpenBSD</strong></li>
<li>We&#39;ll be sure to keep you up to date on developments from both projects</li>
<li>Hopefully the other BSDs will make the cut too next year
***</li>
</ul>

<h3><a href="http://www.jumpnowtek.com/gumstix-freebsd/FreeBSD-Duovero-build-workstation-setup.html" rel="nofollow">FreeBSD on the Gumstix Duovero</a></h3>

<ul>
<li>If you&#39;re not familiar with the Gumstix Duovero, it&#39;s an dual core ARM-based <a href="https://store.gumstix.com/index.php/coms/duovero-coms.html" rel="nofollow">computer-on-module</a></li>
<li>They actually look more like a stick of RAM than a mini-computer</li>
<li>This article shows you how to build a FreeBSD -CURRENT image to run on them, using <a href="https://github.com/freebsd/crochet" rel="nofollow">crochet-freebsd</a></li>
<li>If anyone has any interesting devices like this that they use BSD on, write up something about it and send it to us
***</li>
</ul>

<h3><a href="https://joinup.ec.europa.eu/community/osor/news/ep-study-%E2%80%9Ceu-should-finance-key-open-source-tools%E2%80%9D" rel="nofollow">EU study recommends OpenBSD</a></h3>

<ul>
<li>A recent study by the European Parliament was published, explaining that more funding should go into critical open source projects and tools</li>
<li>This is especially important, in all countries, after the mass surveillance documents came out </li>
<li>&quot;[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts.&quot;</li>
<li>The report goes on to mention users becoming more and more security and privacy-aware, installing additional software to help protect themselves and their traffic from being spied on</li>
<li>Alongside Qubes, a Linux distro focused on containment and isolation, OpenBSD got a special mention: &quot;Proactive security and cryptography are two of the features highlighted in the product together with portability, standardisation and correctness. Its built-in cryptography and packet filter make OpenBSD suitable for use in the security industry, for example on firewalls, intrusion-detection systems and VPN gateways&quot;</li>
<li>Reddit, Undeadly and Hacker News also <a href="https://www.reddit.com/r/programming/comments/340xh3/eu_study_recommends_use_of_openbsd_for_its/" rel="nofollow">had</a> <a href="http://undeadly.org/cgi?action=article&sid=20150427093546" rel="nofollow">some</a> <a href="https://news.ycombinator.com/item?id=9445831" rel="nofollow">discussion</a>, particularly about corporations giving back to the BSDs that they make use of in their infrastructure - something we&#39;ve discussed with <a href="http://www.bsdnow.tv/episodes/2014_10_08-behind_the_masq" rel="nofollow">Voxer</a> and <a href="http://www.bsdnow.tv/episodes/2015_04_22-business_as_usual" rel="nofollow">M:Tier</a> before
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055551.html" rel="nofollow">FreeBSD workflow with Git</a></h3>

<ul>
<li>If you&#39;re interested in contributing to FreeBSD, but aren&#39;t a big fan of SVN, they have a Github mirror too</li>
<li>This mailing list post talks about interacting <a href="https://wiki.freebsd.org/GitWorkflow/GitSvn" rel="nofollow">between</a> the official source repository and the Git mirror</li>
<li>This makes it easy to get pull requests merged into the official tree, and encourages more developers to get involved
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2vjh3ogvG" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s20GMcWvKE" rel="nofollow">Bryan writes in</a></li>
<li><a href="http://slexy.org/view/s21M1imT3d" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s25ScxQSwb" rel="nofollow">Charles writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>86: Business as Usual</title>
  <link>https://www.bsdnow.tv/86</link>
  <guid isPermaLink="false">299268e7-d000-4377-8a05-1d0b89b36c5c</guid>
  <pubDate>Wed, 22 Apr 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/299268e7-d000-4377-8a05-1d0b89b36c5c.mp3" length="75048916" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this time on the show, we'll be chatting with Antoine Jacoutot about how M:Tier uses BSD in their business. After that, we'll be discussing the different release models across the BSDs, and which style we like the most. As always, answers to your emails and all the latest news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:44:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this time on the show, we'll be chatting with Antoine Jacoutot about how M:Tier uses BSD in their business. After that, we'll be discussing the different release models across the BSDs, and which style we like the most. As always, answers to your emails and all the latest news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Optimizing TLS for high bandwidth applications (https://people.freebsd.org/~rrs/asiabsd_2015_tls.pdf)
Netflix has released a report on some of their recent activities, pushing lots of traffic through TLS on FreeBSD
TLS has traditionally had too much overhead for the levels of bandwidth they're using, so this pdf outlines some of their strategy in optimizing it
The sendfile() syscall (which nginx uses) isn't available when data is encrypted in userland
To get around this, Netflix is proposing to add TLS support to the FreeBSD kernel
Having encrypted movie streams would be pretty neat
***
Crypto in unexpected places (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142944822223482&amp;amp;w=2)
OpenBSD is somewhat known for its integrated cryptography, right down to strong randomness in every place you could imagine (process IDs, TCP initial sequence numbers, etc)
One place you might not expect crypto to be used (or even needed) is in the "ping" utility, right? Well, think again 
David Gwynne recently committed (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142944754923359&amp;amp;w=2) a change that adds MAC (https://en.wikipedia.org/wiki/Message_authentication_code) to the ping timestamp payload
By default, it'll be filled with a ChaCha stream instead of an unvarying payload, and David says "this lets us have some confidence that the timestamp hasn't been damaged or tampered with in transit"
Not only is this a security feature, but it should also help detect dodgy or malfunctioning network equipment going forward
Maybe we can look forward to a cryptographically secure "echo" command next...
***
Broadwell in DragonFly (http://www.dragonflybsd.org/docs/newhandbook/docs/newhandbook/BroadwellBoxes/)
The DragonFlyBSD guys have started a new page on their wiki to discuss Broadwell hardware and its current status
Matt Dillon, the project lead, recently bought some hardware with this chipset, and lays out what works and what doesn't work
The two main show-stoppers right now are the graphics and wireless, but they have someone who's already making progress with the GPU support
Wireless support will likely have to wait until FreeBSD gets it, then they'll port it back over
None of the BSDs currently have full Broadwell support, so stay tuned for further updates
***
DIY NAS software roundup (http://blog.brianmoses.net/2015/04/diy-nas-software-roundup.html)
In this blog post, the author compares a few different software solutions for a network attached storage device
He puts FreeNAS, one of our favorites, up against a number of opponents - both BSD and Linux-based
NAS4Free gets an honorable mention as well, particularly for its lower hardware requirements and sleek interface
If you've been thinking about putting together a NAS, but aren't quite comfortable enough to set it up by yourself yet, this article should give you a good view of the current big names
Some competition is always good, gotta keep those guys on their toes
***
Interview - Antoine Jacoutot - ajacoutot@openbsd.org (mailto:ajacoutot@openbsd.org) / @ajacoutot (https://twitter.com/ajacoutot)
OpenBSD at M:Tier (http://www.mtier.org/about-us/), business adoption of BSD, various topics
News Roundup
OpenBSD on DigitalOcean (http://www.tubsta.com/2015/04/openbsd-on-digital-ocean/)
When DigitalOcean rolled out initial support for FreeBSD, it was a great step in the right direction - we hoped that all the other BSDs would soon follow
This is not yet the case, but a blog article here has details on how you can install OpenBSD (and likely the others too) on your VPS
Using a -current snapshot and some swapfile trickery, it's possible to image an OpenBSD ramdisk installer onto an unmounted portion of the virtual disk
After doing so, you just boot from their web UI-based console and can perform a standard installation 
You will have to pay special attention to some details of the disk layout, but this article takes you through the entire process step by step
***
Initial ARM64 support lands in FreeBSD (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=281494)
The ARM64 architecture, sometimes called ARMv8 or AArch64 (https://wiki.freebsd.org/arm64), is a new generation of CPUs that will mostly be in embedded devices
FreeBSD has just gotten support for this platform in the -CURRENT branch
Previously, it was only the beginnings of the kernel and enough bits to boot in QEMU - now a full build (https://lists.freebsd.org/pipermail/freebsd-testing/2015-April/000918.html) is possible
Work should now start happening in the main source code tree, and hopefully they'll have full support in a branch soon
***
Scripting with least privilege (http://shill.seas.harvard.edu/)
A new scripting language with a focus on privilege separation and running with only what's absolutely needed has been popular in the headlines lately
Shell scripts are used everywhere today: startup scripts, orchestration scripts for mass deployment, configuring and compiling software, etc.
Shill aims to answer the questions "how do we limit the authority of scripts" and "how do we determine what authority is necessary" by including a declarative security policy that's checked and enforced by the language runtime
If used on FreeBSD, Shill will use Capsicum for sandboxing
You can find some more of the technical information in their documentation pdf (http://shill.seas.harvard.edu/shill-osdi-2014.pdf) or watch their USENIX presentation (https://2459d6dc103cb5933875-c0245c5c937c5dedcca3f1764ecc9b2f.ssl.cf2.rackcdn.com/osdi14/moore.mp4) video
Hacker News also had some discussion (https://news.ycombinator.com/item?id=9328277) on the topic
***
OpenBSD first impressions (http://blog.greduan.com/2015-04-19-mstobfi.html)
A brand new BSD user has started documenting his experience through a series of blog posts
Formerly a Linux guy, he's tried out FreeBSD and OpenBSD so far, and is currently working on an OpenBSD desktop
The first post goes into why he chose BSD at all, why he's switching away from Linux, how the initial transition has been, what you'll need to relearn and what he's got planned going forward
He's only been using OpenBSD for a few days as of the time this was written - we don't usually get to hear from people this early in on their BSD journey, so it offers a unique perspective
***
PCBSD and 4K oh my! (http://blog.pcbsd.org/2015/04/pc-bsd-and-4k-oh-my/)
Yesterday, Kris got ahold of some 4K monitor hardware to test PC-BSD out
The short of it - It works great!
Minor tweaks being made to some of the PC-BSD defaults to better accommodate 4K out of box
This particular model monitor ships with DisplayPort set to 1.1 mode only, switching it to 1.2 mode enables 60Hz properly
***
Feedback/Questions
Darin writes in (http://slexy.org/view/s21kFuvAFs)
Mitch writes in (http://slexy.org/view/s2nf4o9p4E)
***
Discussion
Comparison of BSD release cycles
FreeBSD (https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/introduction.html#idp55486416), OpenBSD (http://www.openbsd.org/faq/faq5.html#Flavors), NetBSD (https://www.netbsd.org/releases/release-map.html) and DragonFlyBSD (https://www.dragonflybsd.org/releases/)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, mtier, m:tier, business, it, consulting, binpatch-ng, openup, stable, packages, enterprise, support, freenas, tls, netflix, broadwell, nas4free</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this time on the show, we&#39;ll be chatting with Antoine Jacoutot about how M:Tier uses BSD in their business. After that, we&#39;ll be discussing the different release models across the BSDs, and which style we like the most. As always, answers to your emails and all the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://people.freebsd.org/%7Errs/asiabsd_2015_tls.pdf" rel="nofollow">Optimizing TLS for high bandwidth applications</a></h3>

<ul>
<li>Netflix has released a report on some of their recent activities, pushing lots of traffic through TLS on FreeBSD</li>
<li>TLS has traditionally had too much overhead for the levels of bandwidth they&#39;re using, so this pdf outlines some of their strategy in optimizing it</li>
<li>The sendfile() syscall (which nginx uses) isn&#39;t available when data is encrypted in userland</li>
<li>To get around this, Netflix is proposing to add TLS support to the FreeBSD <strong>kernel</strong></li>
<li>Having encrypted movie streams would be pretty neat
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=142944822223482&w=2" rel="nofollow">Crypto in unexpected places</a></h3>

<ul>
<li>OpenBSD is somewhat known for its integrated cryptography, right down to strong randomness in every place you could imagine (process IDs, TCP initial sequence numbers, etc)</li>
<li>One place you might not expect crypto to be used (or even needed) is in the &quot;ping&quot; utility, right? Well, think again </li>
<li>David Gwynne recently <a href="https://www.marc.info/?l=openbsd-cvs&m=142944754923359&w=2" rel="nofollow">committed</a> a change that adds <a href="https://en.wikipedia.org/wiki/Message_authentication_code" rel="nofollow">MAC</a> to the ping timestamp payload</li>
<li>By default, it&#39;ll be filled with a ChaCha stream instead of an unvarying payload, and David says &quot;this lets us have some confidence that the timestamp hasn&#39;t been damaged or tampered with in transit&quot;</li>
<li>Not only is this a security feature, but it should also help detect dodgy or malfunctioning network equipment going forward</li>
<li>Maybe we can look forward to a cryptographically secure &quot;echo&quot; command next...
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/docs/newhandbook/docs/newhandbook/BroadwellBoxes/" rel="nofollow">Broadwell in DragonFly</a></h3>

<ul>
<li>The DragonFlyBSD guys have started a new page on their wiki to discuss Broadwell hardware and its current status</li>
<li>Matt Dillon, the project lead, recently bought some hardware with this chipset, and lays out what works and what doesn&#39;t work</li>
<li>The two main show-stoppers right now are the graphics and wireless, but they have someone who&#39;s already making progress with the GPU support</li>
<li>Wireless support will likely have to wait until FreeBSD gets it, then they&#39;ll port it back over</li>
<li>None of the BSDs currently have full Broadwell support, so stay tuned for further updates
***</li>
</ul>

<h3><a href="http://blog.brianmoses.net/2015/04/diy-nas-software-roundup.html" rel="nofollow">DIY NAS software roundup</a></h3>

<ul>
<li>In this blog post, the author compares a few different software solutions for a network attached storage device</li>
<li>He puts FreeNAS, one of our favorites, up against a number of opponents - both BSD and Linux-based</li>
<li>NAS4Free gets an honorable mention as well, particularly for its lower hardware requirements and sleek interface</li>
<li>If you&#39;ve been thinking about putting together a NAS, but aren&#39;t quite comfortable enough to set it up by yourself yet, this article should give you a good view of the current big names</li>
<li>Some competition is always good, gotta keep those guys on their toes
***</li>
</ul>

<h2>Interview - Antoine Jacoutot - <a href="mailto:ajacoutot@openbsd.org" rel="nofollow">ajacoutot@openbsd.org</a> / <a href="https://twitter.com/ajacoutot" rel="nofollow">@ajacoutot</a></h2>

<p>OpenBSD at <a href="http://www.mtier.org/about-us/" rel="nofollow">M:Tier</a>, business adoption of BSD, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.tubsta.com/2015/04/openbsd-on-digital-ocean/" rel="nofollow">OpenBSD on DigitalOcean</a></h3>

<ul>
<li>When DigitalOcean rolled out initial support for FreeBSD, it was a great step in the right direction - we hoped that all the other BSDs would soon follow</li>
<li>This is not yet the case, but a blog article here has details on how you can install OpenBSD (and likely the others too) on your VPS</li>
<li>Using a -current snapshot and some swapfile trickery, it&#39;s possible to image an OpenBSD ramdisk installer onto an unmounted portion of the virtual disk</li>
<li>After doing so, you just boot from their web UI-based console and can perform a standard installation </li>
<li>You will have to pay special attention to some details of the disk layout, but this article takes you through the entire process step by step
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=281494" rel="nofollow">Initial ARM64 support lands in FreeBSD</a></h3>

<ul>
<li>The ARM64 architecture, sometimes called <a href="https://wiki.freebsd.org/arm64" rel="nofollow">ARMv8 or AArch64</a>, is a new generation of CPUs that will mostly be in embedded devices</li>
<li>FreeBSD has just gotten support for this platform in the -CURRENT branch</li>
<li>Previously, it was only the beginnings of the kernel and enough bits to boot in QEMU - now <a href="https://lists.freebsd.org/pipermail/freebsd-testing/2015-April/000918.html" rel="nofollow">a full build</a> is possible</li>
<li>Work should now start happening in the main source code tree, and hopefully they&#39;ll have full support in a branch soon
***</li>
</ul>

<h3><a href="http://shill.seas.harvard.edu/" rel="nofollow">Scripting with least privilege</a></h3>

<ul>
<li>A new scripting language with a focus on privilege separation and running with only what&#39;s absolutely needed has been popular in the headlines lately</li>
<li>Shell scripts are used everywhere today: startup scripts, orchestration scripts for mass deployment, configuring and compiling software, etc.</li>
<li>Shill aims to answer the questions &quot;how do we limit the authority of scripts&quot; and &quot;how do we determine what authority is necessary&quot; by including a declarative security policy that&#39;s checked and enforced by the language runtime</li>
<li>If used on FreeBSD, Shill will use Capsicum for sandboxing</li>
<li>You can find some more of the technical information in their <a href="http://shill.seas.harvard.edu/shill-osdi-2014.pdf" rel="nofollow">documentation pdf</a> or watch their <a href="https://2459d6dc103cb5933875-c0245c5c937c5dedcca3f1764ecc9b2f.ssl.cf2.rackcdn.com/osdi14/moore.mp4" rel="nofollow">USENIX presentation</a> video</li>
<li>Hacker News also <a href="https://news.ycombinator.com/item?id=9328277" rel="nofollow">had some discussion</a> on the topic
***</li>
</ul>

<h3><a href="http://blog.greduan.com/2015-04-19-mstobfi.html" rel="nofollow">OpenBSD first impressions</a></h3>

<ul>
<li>A brand new BSD user has started documenting his experience through a series of blog posts</li>
<li>Formerly a Linux guy, he&#39;s tried out FreeBSD and OpenBSD so far, and is currently working on an OpenBSD desktop</li>
<li>The first post goes into why he chose BSD at all, why he&#39;s switching away from Linux, how the initial transition has been, what you&#39;ll need to relearn and what he&#39;s got planned going forward</li>
<li>He&#39;s only been using OpenBSD for a few days as of the time this was written - we don&#39;t usually get to hear from people this early in on their BSD journey, so it offers a unique perspective
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/04/pc-bsd-and-4k-oh-my/" rel="nofollow">PCBSD and 4K oh my!</a></h3>

<ul>
<li>Yesterday, Kris got ahold of some 4K monitor hardware to test PC-BSD out</li>
<li>The short of it - It works great!</li>
<li>Minor tweaks being made to some of the PC-BSD defaults to better accommodate 4K out of box</li>
<li>This particular model monitor ships with DisplayPort set to 1.1 mode only, switching it to 1.2 mode enables 60Hz properly
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21kFuvAFs" rel="nofollow">Darin writes in</a></li>
<li><a href="http://slexy.org/view/s2nf4o9p4E" rel="nofollow">Mitch writes in</a>
***</li>
</ul>

<h2>Discussion</h2>

<h3>Comparison of BSD release cycles</h3>

<ul>
<li><a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/introduction.html#idp55486416" rel="nofollow">FreeBSD</a>, <a href="http://www.openbsd.org/faq/faq5.html#Flavors" rel="nofollow">OpenBSD</a>, <a href="https://www.netbsd.org/releases/release-map.html" rel="nofollow">NetBSD</a> and <a href="https://www.dragonflybsd.org/releases/" rel="nofollow">DragonFlyBSD</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this time on the show, we&#39;ll be chatting with Antoine Jacoutot about how M:Tier uses BSD in their business. After that, we&#39;ll be discussing the different release models across the BSDs, and which style we like the most. As always, answers to your emails and all the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://people.freebsd.org/%7Errs/asiabsd_2015_tls.pdf" rel="nofollow">Optimizing TLS for high bandwidth applications</a></h3>

<ul>
<li>Netflix has released a report on some of their recent activities, pushing lots of traffic through TLS on FreeBSD</li>
<li>TLS has traditionally had too much overhead for the levels of bandwidth they&#39;re using, so this pdf outlines some of their strategy in optimizing it</li>
<li>The sendfile() syscall (which nginx uses) isn&#39;t available when data is encrypted in userland</li>
<li>To get around this, Netflix is proposing to add TLS support to the FreeBSD <strong>kernel</strong></li>
<li>Having encrypted movie streams would be pretty neat
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=142944822223482&w=2" rel="nofollow">Crypto in unexpected places</a></h3>

<ul>
<li>OpenBSD is somewhat known for its integrated cryptography, right down to strong randomness in every place you could imagine (process IDs, TCP initial sequence numbers, etc)</li>
<li>One place you might not expect crypto to be used (or even needed) is in the &quot;ping&quot; utility, right? Well, think again </li>
<li>David Gwynne recently <a href="https://www.marc.info/?l=openbsd-cvs&m=142944754923359&w=2" rel="nofollow">committed</a> a change that adds <a href="https://en.wikipedia.org/wiki/Message_authentication_code" rel="nofollow">MAC</a> to the ping timestamp payload</li>
<li>By default, it&#39;ll be filled with a ChaCha stream instead of an unvarying payload, and David says &quot;this lets us have some confidence that the timestamp hasn&#39;t been damaged or tampered with in transit&quot;</li>
<li>Not only is this a security feature, but it should also help detect dodgy or malfunctioning network equipment going forward</li>
<li>Maybe we can look forward to a cryptographically secure &quot;echo&quot; command next...
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/docs/newhandbook/docs/newhandbook/BroadwellBoxes/" rel="nofollow">Broadwell in DragonFly</a></h3>

<ul>
<li>The DragonFlyBSD guys have started a new page on their wiki to discuss Broadwell hardware and its current status</li>
<li>Matt Dillon, the project lead, recently bought some hardware with this chipset, and lays out what works and what doesn&#39;t work</li>
<li>The two main show-stoppers right now are the graphics and wireless, but they have someone who&#39;s already making progress with the GPU support</li>
<li>Wireless support will likely have to wait until FreeBSD gets it, then they&#39;ll port it back over</li>
<li>None of the BSDs currently have full Broadwell support, so stay tuned for further updates
***</li>
</ul>

<h3><a href="http://blog.brianmoses.net/2015/04/diy-nas-software-roundup.html" rel="nofollow">DIY NAS software roundup</a></h3>

<ul>
<li>In this blog post, the author compares a few different software solutions for a network attached storage device</li>
<li>He puts FreeNAS, one of our favorites, up against a number of opponents - both BSD and Linux-based</li>
<li>NAS4Free gets an honorable mention as well, particularly for its lower hardware requirements and sleek interface</li>
<li>If you&#39;ve been thinking about putting together a NAS, but aren&#39;t quite comfortable enough to set it up by yourself yet, this article should give you a good view of the current big names</li>
<li>Some competition is always good, gotta keep those guys on their toes
***</li>
</ul>

<h2>Interview - Antoine Jacoutot - <a href="mailto:ajacoutot@openbsd.org" rel="nofollow">ajacoutot@openbsd.org</a> / <a href="https://twitter.com/ajacoutot" rel="nofollow">@ajacoutot</a></h2>

<p>OpenBSD at <a href="http://www.mtier.org/about-us/" rel="nofollow">M:Tier</a>, business adoption of BSD, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.tubsta.com/2015/04/openbsd-on-digital-ocean/" rel="nofollow">OpenBSD on DigitalOcean</a></h3>

<ul>
<li>When DigitalOcean rolled out initial support for FreeBSD, it was a great step in the right direction - we hoped that all the other BSDs would soon follow</li>
<li>This is not yet the case, but a blog article here has details on how you can install OpenBSD (and likely the others too) on your VPS</li>
<li>Using a -current snapshot and some swapfile trickery, it&#39;s possible to image an OpenBSD ramdisk installer onto an unmounted portion of the virtual disk</li>
<li>After doing so, you just boot from their web UI-based console and can perform a standard installation </li>
<li>You will have to pay special attention to some details of the disk layout, but this article takes you through the entire process step by step
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=281494" rel="nofollow">Initial ARM64 support lands in FreeBSD</a></h3>

<ul>
<li>The ARM64 architecture, sometimes called <a href="https://wiki.freebsd.org/arm64" rel="nofollow">ARMv8 or AArch64</a>, is a new generation of CPUs that will mostly be in embedded devices</li>
<li>FreeBSD has just gotten support for this platform in the -CURRENT branch</li>
<li>Previously, it was only the beginnings of the kernel and enough bits to boot in QEMU - now <a href="https://lists.freebsd.org/pipermail/freebsd-testing/2015-April/000918.html" rel="nofollow">a full build</a> is possible</li>
<li>Work should now start happening in the main source code tree, and hopefully they&#39;ll have full support in a branch soon
***</li>
</ul>

<h3><a href="http://shill.seas.harvard.edu/" rel="nofollow">Scripting with least privilege</a></h3>

<ul>
<li>A new scripting language with a focus on privilege separation and running with only what&#39;s absolutely needed has been popular in the headlines lately</li>
<li>Shell scripts are used everywhere today: startup scripts, orchestration scripts for mass deployment, configuring and compiling software, etc.</li>
<li>Shill aims to answer the questions &quot;how do we limit the authority of scripts&quot; and &quot;how do we determine what authority is necessary&quot; by including a declarative security policy that&#39;s checked and enforced by the language runtime</li>
<li>If used on FreeBSD, Shill will use Capsicum for sandboxing</li>
<li>You can find some more of the technical information in their <a href="http://shill.seas.harvard.edu/shill-osdi-2014.pdf" rel="nofollow">documentation pdf</a> or watch their <a href="https://2459d6dc103cb5933875-c0245c5c937c5dedcca3f1764ecc9b2f.ssl.cf2.rackcdn.com/osdi14/moore.mp4" rel="nofollow">USENIX presentation</a> video</li>
<li>Hacker News also <a href="https://news.ycombinator.com/item?id=9328277" rel="nofollow">had some discussion</a> on the topic
***</li>
</ul>

<h3><a href="http://blog.greduan.com/2015-04-19-mstobfi.html" rel="nofollow">OpenBSD first impressions</a></h3>

<ul>
<li>A brand new BSD user has started documenting his experience through a series of blog posts</li>
<li>Formerly a Linux guy, he&#39;s tried out FreeBSD and OpenBSD so far, and is currently working on an OpenBSD desktop</li>
<li>The first post goes into why he chose BSD at all, why he&#39;s switching away from Linux, how the initial transition has been, what you&#39;ll need to relearn and what he&#39;s got planned going forward</li>
<li>He&#39;s only been using OpenBSD for a few days as of the time this was written - we don&#39;t usually get to hear from people this early in on their BSD journey, so it offers a unique perspective
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/04/pc-bsd-and-4k-oh-my/" rel="nofollow">PCBSD and 4K oh my!</a></h3>

<ul>
<li>Yesterday, Kris got ahold of some 4K monitor hardware to test PC-BSD out</li>
<li>The short of it - It works great!</li>
<li>Minor tweaks being made to some of the PC-BSD defaults to better accommodate 4K out of box</li>
<li>This particular model monitor ships with DisplayPort set to 1.1 mode only, switching it to 1.2 mode enables 60Hz properly
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21kFuvAFs" rel="nofollow">Darin writes in</a></li>
<li><a href="http://slexy.org/view/s2nf4o9p4E" rel="nofollow">Mitch writes in</a>
***</li>
</ul>

<h2>Discussion</h2>

<h3>Comparison of BSD release cycles</h3>

<ul>
<li><a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/introduction.html#idp55486416" rel="nofollow">FreeBSD</a>, <a href="http://www.openbsd.org/faq/faq5.html#Flavors" rel="nofollow">OpenBSD</a>, <a href="https://www.netbsd.org/releases/release-map.html" rel="nofollow">NetBSD</a> and <a href="https://www.dragonflybsd.org/releases/" rel="nofollow">DragonFlyBSD</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>85: PIE in the Sky</title>
  <link>https://www.bsdnow.tv/85</link>
  <guid isPermaLink="false">7b947cd6-04e4-4210-a3a1-3f80d96ccc79</guid>
  <pubDate>Wed, 15 Apr 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7b947cd6-04e4-4210-a3a1-3f80d96ccc79.mp3" length="58114516" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we'll be talking with Pascal Stumpf about static PIE in the upcoming OpenBSD release. He'll tell us what types of attacks it prevents, and why it's such a big deal. We've also got answers to questions from you in the audience and all this week's news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:20:42</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we'll be talking with Pascal Stumpf about static PIE in the upcoming OpenBSD release. He'll tell us what types of attacks it prevents, and why it's such a big deal. We've also got answers to questions from you in the audience and all this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Solaris' networking future is with OpenBSD (http://bsdly.blogspot.com/2015/04/solaris-admins-for-glimpse-of-your.html)
A curious patch from someone with an Oracle email address was recently sent in (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142822852613581&amp;amp;w=2) to one of the OpenBSD mailing lists
It was revealed that future releases of Solaris are going to drop their IPFilter firewall entirely, in favor of a port of the current version of PF
For anyone unfamiliar with the history of PF, it was actually made as a replacement for IPFilter in OpenBSD, due to some licensing issues
What's more, Solaris was the original development platform for IPFilter, so the fact that it would be replaced in its own home is pretty interesting
This blog post goes through some of the backstory of the two firewalls
PF is in a lot of places - other BSDs, Mac OS X and iOS - but there are plenty of other OpenBSD-developed technologies end up ported to other projects too
"Many of the world's largest corporations and government agencies are heavy Solaris users, meaning that even if you're neither an OpenBSD user or a Solaris user, your kit is likely interacting intensely with both kinds, and with Solaris moving to OpenBSD's PF for their filtering needs, we will all be benefiting even more from the OpenBSD project's emphasis on correctness, quality and security"
You're welcome, Oracle
***
BAFUG discussion videos (https://www.youtube.com/watch?v=Cb--h-iOQEM#t=15)
The Bay Area FreeBSD users group has been uploading some videos from their recent meetings
Sean Bruno gave a recap of his experiences at EuroBSDCon last year, including the devsummit and some proposed ideas from it (as well as their current status)
Craig Rodrigues also gave a talk (https://www.youtube.com/watch?v=kPs8Dni_g3M#t=15) about Kyua and the FreeBSD testing framework
Lastly, Kip Macy gave a talk (https://www.youtube.com/watch?v=Q13WtuqbZ7E#t=15) titled "network stack changes, user-level FreeBSD"
The main two subjects there are some network stack changes, and how to get more people contributing, but there's also open discussion about a variety of FreeBSD topics
If you're close to the Bay Area in California, be sure to check out their group and attend a meeting sometime
***
More than just a makefile (http://homing-on-code.blogspot.com/2015/04/ports-are-more-than-just-makefile.html)
If you're not a BSD user just yet, you might be wondering how the various ports and pkgsrc systems compare to the binary way of doing things on Linux
This blog entry talks about the ports system in OpenBSD, but a lot of the concepts apply to all the ports systems across the BSDs
As it turns out, the ports system really isn't that different from a binary package manager - they are what's used to create binary packages, after all
The author goes through what makefiles do, customizing which options software is compiled with, patching source code to build and getting those patches back upstream
After that, he shows you how to get your new port tested, if you're interesting in doing some porting yourself, and getting involved with the rest of the community
This post is very long and there's a lot more to it, so check it out (and more discussion on Hacker News (https://news.ycombinator.com/item?id=9360827))
***
Securing your home fences (http://www.scip.ch/en/?labs.20150409)
Hopefully all our listeners have realized that trusting your network(s) to a consumer router is a bad (http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/) idea (https://threatpost.com/12-million-home-routers-vulnerable-to-takeover/109970) by now
We hear from a lot of users who want to set up some kind of BSD-based firewall, but don't hear back from them after they've done it.. until now
In this post, someone goes through the process of setting up a home firewall using OPNsense on a PCEngines APU board (http://www.pcengines.ch/apu1d4.htm)
He notes that you have a lot of options software-wise, including vanilla FreeBSD (http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/), OpenBSD (http://www.bsdnow.tv/tutorials/openbsd-router) or even Linux, but decided to go with OPNsense because of the easy interface and configuration
The post covers all the hardware you'll need, getting the OS installed to a flash drive or SD card and going through the whole process
Finally, he goes through setting up the firewall with the graphical interface, applying updates and finishing everything up
If you don't have any experience using a serial console, this guide also has some good info for beginners about those (which also applies to regular FreeBSD)
We love super-detailed guides like this, so everyone should write more and send them to us immediately
***
Interview - Pascal Stumpf - pascal@openbsd.org (mailto:pascal@openbsd.org)
Static PIE in OpenBSD
News Roundup
LLVM's new libFuzzer (http://blog.llvm.org/2015/04/fuzz-all-clangs.html)
We've discussed fuzzing on the show a number of times, albeit mostly with the American Fuzzy Lop utility
It looks like LLVM is going to have their own fuzzing tool too now
The Clang and LLVM guys are no strangers to this type of code testing, but decided to "close the loop" and start fuzzing parts of LLVM (including Clang) using LLVM itself
With Clang being the default in both FreeBSD and Bitrig, and with the other BSDs considering the switch, this could make for some good bug hunting across all the projects in the future
***
HardenedBSD upgrades secadm (http://hardenedbsd.org/article/shawn-webb/2015-04-14/introducing-secadm-02)
The HardenedBSD guys have released a new version of their secadm tool, with the showcase feature being integriforce support
We covered both the secadm tool and integriforce in previous episodes, but the short version is that it's a way to prevent files from being altered (even as root)
Their integriforce feature itself has also gotten a couple improvements: shared objects are now checked too, instead of just binaries, and it uses more caching to speed up the whole process now
***
RAID5 returns to OpenBSD (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142877132517229&amp;amp;w=2)
OpenBSD's softraid (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/softraid.4) subsystem, somewhat similar to FreeBSD's GEOM, has had experimental RAID5 support for a while
However, it was exactly that - experimental - and required a recompile to enable
With some work from recent hackathons, the final piece (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142876943116907&amp;amp;w=2) was added to enable resuming partial array rebuilds
Now it's on by default (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142877026917030&amp;amp;w=2), and there's a call for testing being put out, so grab a snapshot and put the code through its paces
The bioctl softraid command also now supports (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142877223817406&amp;amp;w=2) DUIDs during pseudo-device detachment, possibly paving the way for the installer to drop (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142643313416298&amp;amp;w=2) the "do you want to enable DUIDs?" question entirely
***
pkgng 1.5.0 released (https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055463.html)
Going back to what we talked about last week (http://www.bsdnow.tv/episodes/2015_04_08-pkg_remove_freebsd-update), the final version of pkgng 1.5.0 is out
The "provides" and "requires" support is finally in a regular release
A new "-r" switch will allow for direct installation to a chroot or alternate root directory
Memory usage should be much better now, and some general code speed-ups were added
This version also introduces support for Mac OS X, NetBSD and EdgeBSD - it'll be interesting to see if anything comes of that
Many more bugs were fixed, so check the mailing list announcement for the rest (and plenty new bugs were added, according to bapt)
***
p2k15 hackathon reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20150411160247)
There was another OpenBSD hackathon that just finished up in the UK - this time it was mainly for ports work
As usual, the developers sent in reports of some of the things they got done at the event
Landry Breuil, both an upstream Mozilla developer and an OpenBSD developer, wrote in about the work he did on the Firefox port (specifically WebRTC) and some others, as well as reviewing lots of patches that were ready to commit
Stefan Sperling wrote in (http://undeadly.org/cgi?action=article&amp;amp;sid=20150414064710), detailing his work with wireless chipsets, specifically when the vendor doesn't provide any hardware documentation, as well as updating some of the games in ports
Ken Westerback also sent in a report (http://undeadly.org/cgi?action=article&amp;amp;sid=20150413163333), but decided to be a rebel and not work on ports at all - he got a lot of GPT-related work done, and also reviewed the RAID5 support we talked about earlier
***
Feedback/Questions
Shaun writes in (http://slexy.org/view/s2iNBo2swq)
Hrishi writes in (http://slexy.org/view/s202BRLwrd)
Randy writes in (http://slexy.org/view/s2KT7M35uY)
Zach writes in (http://slexy.org/view/s2Q5lOoxzl)
Ben writes in (http://slexy.org/view/s2ynDjuzVi)
***
Mailing List Gold
Gstreamer hates us (https://www.marc.info/?l=openbsd-ports&amp;amp;m=142884995931428&amp;amp;w=2)
At least he's honest (https://lists.torproject.org/pipermail/tor-relays/2015-April/006765.html)
I find myself in a situation (https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055390.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, aslr, pie, position-independent executable, static, binary, dynamic, linking, security, llvm, fuzzing, clang, opnsense, pcengines, apu, alix, hammer2, zfs, oracle, solaris, pf</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ll be talking with Pascal Stumpf about static PIE in the upcoming OpenBSD release. He&#39;ll tell us what types of attacks it prevents, and why it&#39;s such a big deal. We&#39;ve also got answers to questions from you in the audience and all this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://bsdly.blogspot.com/2015/04/solaris-admins-for-glimpse-of-your.html" rel="nofollow">Solaris&#39; networking future is with OpenBSD</a></h3>

<ul>
<li>A curious patch from someone with an Oracle email address was <a href="https://www.marc.info/?l=openbsd-tech&m=142822852613581&w=2" rel="nofollow">recently sent in</a> to one of the OpenBSD mailing lists</li>
<li>It was revealed that future releases of Solaris are going to drop their IPFilter firewall entirely, in favor of a port of the <strong>current</strong> version of PF</li>
<li>For anyone unfamiliar with the history of PF, it was actually made <em>as a replacement for</em> IPFilter in OpenBSD, due to some licensing issues</li>
<li>What&#39;s more, Solaris was the original development platform for IPFilter, so the fact that it would be replaced in its own home is pretty interesting</li>
<li>This blog post goes through some of the backstory of the two firewalls</li>
<li>PF is in a lot of places - other BSDs, Mac OS X and iOS - but there are plenty of other OpenBSD-developed technologies end up ported to other projects too</li>
<li>&quot;Many of the world&#39;s largest corporations and government agencies are heavy Solaris users, meaning that even if you&#39;re neither an OpenBSD user or a Solaris user, your kit is likely interacting intensely with both kinds, and with Solaris moving to OpenBSD&#39;s PF for their filtering needs, we will all be benefiting even more from the OpenBSD project&#39;s emphasis on correctness, quality and security&quot;</li>
<li>You&#39;re welcome, Oracle
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=Cb--h-iOQEM#t=15" rel="nofollow">BAFUG discussion videos</a></h3>

<ul>
<li>The Bay Area FreeBSD users group has been uploading some videos from their recent meetings</li>
<li>Sean Bruno gave a recap of his experiences at EuroBSDCon last year, including the devsummit and some proposed ideas from it (as well as their current status)</li>
<li>Craig Rodrigues also gave <a href="https://www.youtube.com/watch?v=kPs8Dni_g3M#t=15" rel="nofollow">a talk</a> about Kyua and the FreeBSD testing framework</li>
<li>Lastly, Kip Macy gave <a href="https://www.youtube.com/watch?v=Q13WtuqbZ7E#t=15" rel="nofollow">a talk</a> titled &quot;network stack changes, user-level FreeBSD&quot;</li>
<li>The main two subjects there are some network stack changes, and how to get more people contributing, but there&#39;s also open discussion about a variety of FreeBSD topics</li>
<li>If you&#39;re close to the Bay Area in California, be sure to check out their group and attend a meeting sometime
***</li>
</ul>

<h3><a href="http://homing-on-code.blogspot.com/2015/04/ports-are-more-than-just-makefile.html" rel="nofollow">More than just a makefile</a></h3>

<ul>
<li>If you&#39;re not a BSD user just yet, you might be wondering how the various ports and pkgsrc systems compare to the binary way of doing things on Linux</li>
<li>This blog entry talks about the ports system in OpenBSD, but a lot of the concepts apply to all the ports systems across the BSDs</li>
<li>As it turns out, the ports system really isn&#39;t that different from a binary package manager - they are what&#39;s <em>used</em> to create binary packages, after all</li>
<li>The author goes through what makefiles do, customizing which options software is compiled with, patching source code to build and getting those patches back upstream</li>
<li>After that, he shows you how to get your new port tested, if you&#39;re interesting in doing some porting yourself, and getting involved with the rest of the community</li>
<li>This post is very long and there&#39;s a lot more to it, so check it out (and more discussion <a href="https://news.ycombinator.com/item?id=9360827" rel="nofollow">on Hacker News</a>)
***</li>
</ul>

<h3><a href="http://www.scip.ch/en/?labs.20150409" rel="nofollow">Securing your home fences</a></h3>

<ul>
<li>Hopefully all our listeners have realized that trusting your network(s) to a consumer router is a <a href="http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/" rel="nofollow">bad</a> <a href="https://threatpost.com/12-million-home-routers-vulnerable-to-takeover/109970" rel="nofollow">idea</a> by now</li>
<li>We hear from a lot of users who want to set up some kind of BSD-based firewall, but don&#39;t hear back from them after they&#39;ve done it.. until now</li>
<li>In this post, someone goes through the process of setting up a home firewall using OPNsense on a PCEngines <a href="http://www.pcengines.ch/apu1d4.htm" rel="nofollow">APU board</a></li>
<li>He notes that you have a lot of options software-wise, including vanilla <a href="http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/" rel="nofollow">FreeBSD</a>, <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">OpenBSD</a> or even Linux, but decided to go with OPNsense because of the easy interface and configuration</li>
<li>The post covers all the hardware you&#39;ll need, getting the OS installed to a flash drive or SD card and going through the whole process</li>
<li>Finally, he goes through setting up the firewall with the graphical interface, applying updates and finishing everything up</li>
<li>If you don&#39;t have any experience using a serial console, this guide also has some good info for beginners about those (which also applies to regular FreeBSD)</li>
<li>We love super-detailed guides like this, so everyone should write more and send them to us immediately
***</li>
</ul>

<h2>Interview - Pascal Stumpf - <a href="mailto:pascal@openbsd.org" rel="nofollow">pascal@openbsd.org</a></h2>

<p>Static PIE in OpenBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blog.llvm.org/2015/04/fuzz-all-clangs.html" rel="nofollow">LLVM&#39;s new libFuzzer</a></h3>

<ul>
<li>We&#39;ve discussed fuzzing on the show a number of times, albeit mostly with the American Fuzzy Lop utility</li>
<li>It looks like LLVM is going to have their own fuzzing tool too now</li>
<li>The Clang and LLVM guys are no strangers to this type of code testing, but decided to &quot;close the loop&quot; and start fuzzing parts of LLVM (including Clang) using LLVM itself</li>
<li>With Clang being the default in both FreeBSD and Bitrig, and with the other BSDs considering the switch, this could make for some good bug hunting across all the projects in the future
***</li>
</ul>

<h3><a href="http://hardenedbsd.org/article/shawn-webb/2015-04-14/introducing-secadm-02" rel="nofollow">HardenedBSD upgrades secadm</a></h3>

<ul>
<li>The HardenedBSD guys have released a new version of their secadm tool, with the showcase feature being integriforce support</li>
<li>We covered both the secadm tool and integriforce in previous episodes, but the short version is that it&#39;s a way to prevent files from being altered (even as root)</li>
<li>Their integriforce feature itself has also gotten a couple improvements: shared objects are now checked too, instead of just binaries, and it uses more caching to speed up the whole process now
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=142877132517229&w=2" rel="nofollow">RAID5 returns to OpenBSD</a></h3>

<ul>
<li>OpenBSD&#39;s <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/softraid.4" rel="nofollow">softraid</a> subsystem, somewhat similar to FreeBSD&#39;s GEOM, has had experimental RAID5 support for a while</li>
<li>However, it was exactly that - experimental - and required a recompile to enable</li>
<li>With some work from recent hackathons, the <a href="https://www.marc.info/?l=openbsd-cvs&m=142876943116907&w=2" rel="nofollow">final piece</a> was added to enable resuming partial array rebuilds</li>
<li>Now it&#39;s <a href="https://www.marc.info/?l=openbsd-cvs&m=142877026917030&w=2" rel="nofollow">on by default</a>, and there&#39;s a call for testing being put out, so grab a snapshot and put the code through its paces</li>
<li>The bioctl softraid command also <a href="https://www.marc.info/?l=openbsd-cvs&m=142877223817406&w=2" rel="nofollow">now supports</a> DUIDs during pseudo-device detachment, possibly paving the way for the installer to <a href="https://www.marc.info/?l=openbsd-tech&m=142643313416298&w=2" rel="nofollow">drop</a> the &quot;do you want to enable DUIDs?&quot; question entirely
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055463.html" rel="nofollow">pkgng 1.5.0 released</a></h3>

<ul>
<li>Going back to what we <a href="http://www.bsdnow.tv/episodes/2015_04_08-pkg_remove_freebsd-update" rel="nofollow">talked about last week</a>, the final version of pkgng 1.5.0 is out</li>
<li>The &quot;provides&quot; and &quot;requires&quot; support is finally in a regular release</li>
<li>A new &quot;-r&quot; switch will allow for direct installation to a chroot or alternate root directory</li>
<li>Memory usage should be much better now, and some general code speed-ups were added</li>
<li>This version also introduces support for Mac OS X, NetBSD and EdgeBSD - it&#39;ll be interesting to see if anything comes of that</li>
<li>Many more bugs were fixed, so check the mailing list announcement for the rest (and plenty new bugs were added, according to bapt)
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150411160247" rel="nofollow">p2k15 hackathon reports</a></h3>

<ul>
<li>There was another OpenBSD hackathon that just finished up in the UK - this time it was mainly for ports work</li>
<li>As usual, the developers sent in reports of some of the things they got done at the event</li>
<li>Landry Breuil, both an upstream Mozilla developer and an OpenBSD developer, wrote in about the work he did on the Firefox port (specifically WebRTC) and some others, as well as reviewing lots of patches that were ready to commit</li>
<li>Stefan Sperling <a href="http://undeadly.org/cgi?action=article&sid=20150414064710" rel="nofollow">wrote in</a>, detailing his work with wireless chipsets, specifically when the vendor doesn&#39;t provide any hardware documentation, as well as updating some of the games in ports</li>
<li>Ken Westerback <a href="http://undeadly.org/cgi?action=article&sid=20150413163333" rel="nofollow">also sent in a report</a>, but decided to be a rebel and not work on ports at all - he got a lot of GPT-related work done, and also reviewed the RAID5 support we talked about earlier
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2iNBo2swq" rel="nofollow">Shaun writes in</a></li>
<li><a href="http://slexy.org/view/s202BRLwrd" rel="nofollow">Hrishi writes in</a></li>
<li><a href="http://slexy.org/view/s2KT7M35uY" rel="nofollow">Randy writes in</a></li>
<li><a href="http://slexy.org/view/s2Q5lOoxzl" rel="nofollow">Zach writes in</a></li>
<li><a href="http://slexy.org/view/s2ynDjuzVi" rel="nofollow">Ben writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-ports&m=142884995931428&w=2" rel="nofollow">Gstreamer hates us</a></li>
<li><a href="https://lists.torproject.org/pipermail/tor-relays/2015-April/006765.html" rel="nofollow">At least he&#39;s honest</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055390.html" rel="nofollow">I find myself in a situation</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ll be talking with Pascal Stumpf about static PIE in the upcoming OpenBSD release. He&#39;ll tell us what types of attacks it prevents, and why it&#39;s such a big deal. We&#39;ve also got answers to questions from you in the audience and all this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://bsdly.blogspot.com/2015/04/solaris-admins-for-glimpse-of-your.html" rel="nofollow">Solaris&#39; networking future is with OpenBSD</a></h3>

<ul>
<li>A curious patch from someone with an Oracle email address was <a href="https://www.marc.info/?l=openbsd-tech&m=142822852613581&w=2" rel="nofollow">recently sent in</a> to one of the OpenBSD mailing lists</li>
<li>It was revealed that future releases of Solaris are going to drop their IPFilter firewall entirely, in favor of a port of the <strong>current</strong> version of PF</li>
<li>For anyone unfamiliar with the history of PF, it was actually made <em>as a replacement for</em> IPFilter in OpenBSD, due to some licensing issues</li>
<li>What&#39;s more, Solaris was the original development platform for IPFilter, so the fact that it would be replaced in its own home is pretty interesting</li>
<li>This blog post goes through some of the backstory of the two firewalls</li>
<li>PF is in a lot of places - other BSDs, Mac OS X and iOS - but there are plenty of other OpenBSD-developed technologies end up ported to other projects too</li>
<li>&quot;Many of the world&#39;s largest corporations and government agencies are heavy Solaris users, meaning that even if you&#39;re neither an OpenBSD user or a Solaris user, your kit is likely interacting intensely with both kinds, and with Solaris moving to OpenBSD&#39;s PF for their filtering needs, we will all be benefiting even more from the OpenBSD project&#39;s emphasis on correctness, quality and security&quot;</li>
<li>You&#39;re welcome, Oracle
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=Cb--h-iOQEM#t=15" rel="nofollow">BAFUG discussion videos</a></h3>

<ul>
<li>The Bay Area FreeBSD users group has been uploading some videos from their recent meetings</li>
<li>Sean Bruno gave a recap of his experiences at EuroBSDCon last year, including the devsummit and some proposed ideas from it (as well as their current status)</li>
<li>Craig Rodrigues also gave <a href="https://www.youtube.com/watch?v=kPs8Dni_g3M#t=15" rel="nofollow">a talk</a> about Kyua and the FreeBSD testing framework</li>
<li>Lastly, Kip Macy gave <a href="https://www.youtube.com/watch?v=Q13WtuqbZ7E#t=15" rel="nofollow">a talk</a> titled &quot;network stack changes, user-level FreeBSD&quot;</li>
<li>The main two subjects there are some network stack changes, and how to get more people contributing, but there&#39;s also open discussion about a variety of FreeBSD topics</li>
<li>If you&#39;re close to the Bay Area in California, be sure to check out their group and attend a meeting sometime
***</li>
</ul>

<h3><a href="http://homing-on-code.blogspot.com/2015/04/ports-are-more-than-just-makefile.html" rel="nofollow">More than just a makefile</a></h3>

<ul>
<li>If you&#39;re not a BSD user just yet, you might be wondering how the various ports and pkgsrc systems compare to the binary way of doing things on Linux</li>
<li>This blog entry talks about the ports system in OpenBSD, but a lot of the concepts apply to all the ports systems across the BSDs</li>
<li>As it turns out, the ports system really isn&#39;t that different from a binary package manager - they are what&#39;s <em>used</em> to create binary packages, after all</li>
<li>The author goes through what makefiles do, customizing which options software is compiled with, patching source code to build and getting those patches back upstream</li>
<li>After that, he shows you how to get your new port tested, if you&#39;re interesting in doing some porting yourself, and getting involved with the rest of the community</li>
<li>This post is very long and there&#39;s a lot more to it, so check it out (and more discussion <a href="https://news.ycombinator.com/item?id=9360827" rel="nofollow">on Hacker News</a>)
***</li>
</ul>

<h3><a href="http://www.scip.ch/en/?labs.20150409" rel="nofollow">Securing your home fences</a></h3>

<ul>
<li>Hopefully all our listeners have realized that trusting your network(s) to a consumer router is a <a href="http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/" rel="nofollow">bad</a> <a href="https://threatpost.com/12-million-home-routers-vulnerable-to-takeover/109970" rel="nofollow">idea</a> by now</li>
<li>We hear from a lot of users who want to set up some kind of BSD-based firewall, but don&#39;t hear back from them after they&#39;ve done it.. until now</li>
<li>In this post, someone goes through the process of setting up a home firewall using OPNsense on a PCEngines <a href="http://www.pcengines.ch/apu1d4.htm" rel="nofollow">APU board</a></li>
<li>He notes that you have a lot of options software-wise, including vanilla <a href="http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/" rel="nofollow">FreeBSD</a>, <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">OpenBSD</a> or even Linux, but decided to go with OPNsense because of the easy interface and configuration</li>
<li>The post covers all the hardware you&#39;ll need, getting the OS installed to a flash drive or SD card and going through the whole process</li>
<li>Finally, he goes through setting up the firewall with the graphical interface, applying updates and finishing everything up</li>
<li>If you don&#39;t have any experience using a serial console, this guide also has some good info for beginners about those (which also applies to regular FreeBSD)</li>
<li>We love super-detailed guides like this, so everyone should write more and send them to us immediately
***</li>
</ul>

<h2>Interview - Pascal Stumpf - <a href="mailto:pascal@openbsd.org" rel="nofollow">pascal@openbsd.org</a></h2>

<p>Static PIE in OpenBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blog.llvm.org/2015/04/fuzz-all-clangs.html" rel="nofollow">LLVM&#39;s new libFuzzer</a></h3>

<ul>
<li>We&#39;ve discussed fuzzing on the show a number of times, albeit mostly with the American Fuzzy Lop utility</li>
<li>It looks like LLVM is going to have their own fuzzing tool too now</li>
<li>The Clang and LLVM guys are no strangers to this type of code testing, but decided to &quot;close the loop&quot; and start fuzzing parts of LLVM (including Clang) using LLVM itself</li>
<li>With Clang being the default in both FreeBSD and Bitrig, and with the other BSDs considering the switch, this could make for some good bug hunting across all the projects in the future
***</li>
</ul>

<h3><a href="http://hardenedbsd.org/article/shawn-webb/2015-04-14/introducing-secadm-02" rel="nofollow">HardenedBSD upgrades secadm</a></h3>

<ul>
<li>The HardenedBSD guys have released a new version of their secadm tool, with the showcase feature being integriforce support</li>
<li>We covered both the secadm tool and integriforce in previous episodes, but the short version is that it&#39;s a way to prevent files from being altered (even as root)</li>
<li>Their integriforce feature itself has also gotten a couple improvements: shared objects are now checked too, instead of just binaries, and it uses more caching to speed up the whole process now
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=142877132517229&w=2" rel="nofollow">RAID5 returns to OpenBSD</a></h3>

<ul>
<li>OpenBSD&#39;s <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/softraid.4" rel="nofollow">softraid</a> subsystem, somewhat similar to FreeBSD&#39;s GEOM, has had experimental RAID5 support for a while</li>
<li>However, it was exactly that - experimental - and required a recompile to enable</li>
<li>With some work from recent hackathons, the <a href="https://www.marc.info/?l=openbsd-cvs&m=142876943116907&w=2" rel="nofollow">final piece</a> was added to enable resuming partial array rebuilds</li>
<li>Now it&#39;s <a href="https://www.marc.info/?l=openbsd-cvs&m=142877026917030&w=2" rel="nofollow">on by default</a>, and there&#39;s a call for testing being put out, so grab a snapshot and put the code through its paces</li>
<li>The bioctl softraid command also <a href="https://www.marc.info/?l=openbsd-cvs&m=142877223817406&w=2" rel="nofollow">now supports</a> DUIDs during pseudo-device detachment, possibly paving the way for the installer to <a href="https://www.marc.info/?l=openbsd-tech&m=142643313416298&w=2" rel="nofollow">drop</a> the &quot;do you want to enable DUIDs?&quot; question entirely
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055463.html" rel="nofollow">pkgng 1.5.0 released</a></h3>

<ul>
<li>Going back to what we <a href="http://www.bsdnow.tv/episodes/2015_04_08-pkg_remove_freebsd-update" rel="nofollow">talked about last week</a>, the final version of pkgng 1.5.0 is out</li>
<li>The &quot;provides&quot; and &quot;requires&quot; support is finally in a regular release</li>
<li>A new &quot;-r&quot; switch will allow for direct installation to a chroot or alternate root directory</li>
<li>Memory usage should be much better now, and some general code speed-ups were added</li>
<li>This version also introduces support for Mac OS X, NetBSD and EdgeBSD - it&#39;ll be interesting to see if anything comes of that</li>
<li>Many more bugs were fixed, so check the mailing list announcement for the rest (and plenty new bugs were added, according to bapt)
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150411160247" rel="nofollow">p2k15 hackathon reports</a></h3>

<ul>
<li>There was another OpenBSD hackathon that just finished up in the UK - this time it was mainly for ports work</li>
<li>As usual, the developers sent in reports of some of the things they got done at the event</li>
<li>Landry Breuil, both an upstream Mozilla developer and an OpenBSD developer, wrote in about the work he did on the Firefox port (specifically WebRTC) and some others, as well as reviewing lots of patches that were ready to commit</li>
<li>Stefan Sperling <a href="http://undeadly.org/cgi?action=article&sid=20150414064710" rel="nofollow">wrote in</a>, detailing his work with wireless chipsets, specifically when the vendor doesn&#39;t provide any hardware documentation, as well as updating some of the games in ports</li>
<li>Ken Westerback <a href="http://undeadly.org/cgi?action=article&sid=20150413163333" rel="nofollow">also sent in a report</a>, but decided to be a rebel and not work on ports at all - he got a lot of GPT-related work done, and also reviewed the RAID5 support we talked about earlier
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2iNBo2swq" rel="nofollow">Shaun writes in</a></li>
<li><a href="http://slexy.org/view/s202BRLwrd" rel="nofollow">Hrishi writes in</a></li>
<li><a href="http://slexy.org/view/s2KT7M35uY" rel="nofollow">Randy writes in</a></li>
<li><a href="http://slexy.org/view/s2Q5lOoxzl" rel="nofollow">Zach writes in</a></li>
<li><a href="http://slexy.org/view/s2ynDjuzVi" rel="nofollow">Ben writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-ports&m=142884995931428&w=2" rel="nofollow">Gstreamer hates us</a></li>
<li><a href="https://lists.torproject.org/pipermail/tor-relays/2015-April/006765.html" rel="nofollow">At least he&#39;s honest</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055390.html" rel="nofollow">I find myself in a situation</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>84: pkg remove freebsd-update</title>
  <link>https://www.bsdnow.tv/84</link>
  <guid isPermaLink="false">88c9bd14-b1bf-4d45-96b6-9af12b44d40b</guid>
  <pubDate>Wed, 08 Apr 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/88c9bd14-b1bf-4d45-96b6-9af12b44d40b.mp3" length="53948308" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>On this week's mini-episode, we'll be talking with Baptiste Daroussin about packaging the FreeBSD base system with pkgng. Is this the best way going forward, or are we getting dangerously close to being Linux-like? We'll find out, and also get to a couple of your emails while we're at it, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:14:55</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>On this week's mini-episode, we'll be talking with Baptiste Daroussin about packaging the FreeBSD base system with pkgng. Is this the best way going forward, or are we getting dangerously close to being Linux-like? We'll find out, and also get to a couple of your emails while we're at it, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Xen dom0 in FreeBSD 11-CURRENT (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=382965)
FreeBSD has just gotten dom0 (http://wiki.xen.org/wiki/Dom0) support for the Xen hypervisor, something NetBSD has had (http://wiki.netbsd.org/ports/xen/howto/#netbsd-dom0) for a while now
The ports tree will now have a Xen kernel and toolstack, meaning that they can be updated much more rapidly than if they were part of base
It's currently limited to Intel boxes with EPT and a working IOMMU, running a recent version of the -CURRENT branch, but we'll likely see it when 11.0 comes out
How will this affect interest in Bhyve?
***
A tale of two educational moments (http://blog.anthrobsd.net/044.html)
Here we have a blog post from an OpenBSD developer about some experiences he had helping people get involved with the project
It's split into two stories: one that could've gone better, and one that went really well
For the first one, he found that someone was trying to modify a package from their ports tree to have fewer dependencies
Experience really showed its worth, and he was able to write a quick patch to do exactly what the other person had been working on for a few hours - but wasn't so encouraging about getting it committed
In the second story, he discussed updating a different port with a user of a forum, and ended up improving the new user's workflow considerably with just a few tips
The lesson to take away from this is that we can all help out to encourage and assist new users - everyone was a newbie once
***
What's coming in NetBSD 7 (http://saveosx.org/NetBSD7/)
We first mentioned NetBSD 7.0 on the show in July of 2014, but it still hasn't been released and there hasn't been much public info about it
This blog post outlines some of the bigger features that we can expect to see when it actually does come out
Their total platform count is now over 70, so you'd be hard-pressed to find something that it doesn't run on
There have been a lot of improvements in the graphics area, particularly with DRM/KMS, including Intel Haswell and Nouveau (for nVidia cards)
Many ARM boards now have full SMP support
Clang has also finally made its way into the base system, something we're glad to see, and it should be able to build the base OS on i386, AMD64 and ARM - other architectures are still a WIP
In the crypto department: their PNRG has switched from the broken RC4 to the more modern ChaCha20, OpenSSL has been updated in base and LibreSSL is in pkgsrc
NetBSD's in-house firewall, npf, has gotten major improvements since its initial debut in NetBSD 6.0
Looking to the future, NetBSD hopes to integrate a stable ZFS implementation later on
***
OpenZFS office hours (https://www.youtube.com/watch?v=mS4bfbEq46I)
We mentioned a couple weeks back that the OpenZFS office hours series was starting back up
They've just uploaded the recording of their most recent freeform discussion, with Justin Gibbs (http://www.bsdnow.tv/episodes/2015_03_11-the_pcbsd_tour_ii) being the main presenter
In it, they cover how Justin got into ZFS, running in virtualized environments, getting patches into the different projects, getting more people involved, reviewing code, spinning disks vs SSDs, defragging, speeding up resilvering, zfsd and much more
***
Interview - Baptiste Daroussin - bapt@freebsd.org (mailto:bapt@freebsd.org)
Packaging the FreeBSD base system with pkgng
Discussion
Packaging the FreeBSD base system with pkgng (follow-up)
Feedback/Questions
Jeff writes in (http://slexy.org/view/s20AWp6Av1)
Anonymous writes in (http://slexy.org/view/s20QiFcdh8)
Alex writes in (http://slexy.org/view/s2YzZlswaB)
Joris writes in (http://slexy.org/view/s21Mx9TopQ)
***
Mailing List Gold
ok feedback@ (https://www.marc.info/?l=openbsd-ports&amp;amp;m=142679136422432&amp;amp;w=2)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, pkg, poudriere, pkgng, freebsd-update, packaging base, presentation, asiabsdcon, xen, dom0, domu</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>On this week&#39;s mini-episode, we&#39;ll be talking with Baptiste Daroussin about packaging the FreeBSD base system with pkgng. Is this the best way going forward, or are we getting dangerously close to being Linux-like? We&#39;ll find out, and also get to a couple of your emails while we&#39;re at it, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=382965" rel="nofollow">Xen dom0 in FreeBSD 11-CURRENT</a></h3>

<ul>
<li>FreeBSD has just gotten <a href="http://wiki.xen.org/wiki/Dom0" rel="nofollow">dom0</a> support for the Xen hypervisor, something <a href="http://wiki.netbsd.org/ports/xen/howto/#netbsd-dom0" rel="nofollow">NetBSD has had</a> for a while now</li>
<li>The ports tree will now have a Xen kernel and toolstack, meaning that they can be updated much more rapidly than if they were part of base</li>
<li>It&#39;s currently limited to Intel boxes with EPT and a working IOMMU, running a recent version of the -CURRENT branch, but we&#39;ll likely see it when 11.0 comes out</li>
<li>How will this affect interest in Bhyve?
***</li>
</ul>

<h3><a href="http://blog.anthrobsd.net/044.html" rel="nofollow">A tale of two educational moments</a></h3>

<ul>
<li>Here we have a blog post from an OpenBSD developer about some experiences he had helping people get involved with the project</li>
<li>It&#39;s split into two stories: one that could&#39;ve gone better, and one that went really well</li>
<li>For the first one, he found that someone was trying to modify a package from their ports tree to have fewer dependencies</li>
<li>Experience really showed its worth, and he was able to write a quick patch to do exactly what the other person had been working on for a few hours - but wasn&#39;t so encouraging about getting it committed</li>
<li>In the second story, he discussed updating a different port with a user of a forum, and ended up improving the new user&#39;s workflow considerably with just a few tips</li>
<li>The lesson to take away from this is that we can all help out to encourage and assist new users - everyone was a newbie once
***</li>
</ul>

<h3><a href="http://saveosx.org/NetBSD7/" rel="nofollow">What&#39;s coming in NetBSD 7</a></h3>

<ul>
<li>We first mentioned NetBSD 7.0 on the show in July of 2014, but it still hasn&#39;t been released and there hasn&#39;t been much public info about it</li>
<li>This blog post outlines some of the bigger features that we can expect to see when it actually does come out</li>
<li>Their total platform count is now over 70, so you&#39;d be hard-pressed to find something that it doesn&#39;t run on</li>
<li>There have been a lot of improvements in the graphics area, particularly with DRM/KMS, including Intel Haswell and Nouveau (for nVidia cards)</li>
<li>Many ARM boards now have full SMP support</li>
<li>Clang has also finally made its way into the base system, something we&#39;re glad to see, and it should be able to build the base OS on i386, AMD64 and ARM - other architectures are still a WIP</li>
<li>In the crypto department: their PNRG has switched from the broken RC4 to the more modern ChaCha20, OpenSSL has been updated in base and LibreSSL is in pkgsrc</li>
<li>NetBSD&#39;s in-house firewall, npf, has gotten major improvements since its initial debut in NetBSD 6.0</li>
<li>Looking to the future, NetBSD hopes to integrate a stable ZFS implementation later on
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=mS4bfbEq46I" rel="nofollow">OpenZFS office hours</a></h3>

<ul>
<li>We mentioned a couple weeks back that the OpenZFS office hours series was starting back up</li>
<li>They&#39;ve just uploaded the recording of their most recent freeform discussion, with <a href="http://www.bsdnow.tv/episodes/2015_03_11-the_pcbsd_tour_ii" rel="nofollow">Justin Gibbs</a> being the main presenter</li>
<li>In it, they cover how Justin got into ZFS, running in virtualized environments, getting patches into the different projects, getting more people involved, reviewing code, spinning disks vs SSDs, defragging, speeding up resilvering, zfsd and much more
***</li>
</ul>

<h2>Interview - Baptiste Daroussin - <a href="mailto:bapt@freebsd.org" rel="nofollow">bapt@freebsd.org</a></h2>

<p>Packaging the FreeBSD base system with pkgng</p>

<hr>

<h2>Discussion</h2>

<h3>Packaging the FreeBSD base system with pkgng (follow-up)</h3>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20AWp6Av1" rel="nofollow">Jeff writes in</a></li>
<li><a href="http://slexy.org/view/s20QiFcdh8" rel="nofollow">Anonymous writes in</a></li>
<li><a href="http://slexy.org/view/s2YzZlswaB" rel="nofollow">Alex writes in</a></li>
<li><a href="http://slexy.org/view/s21Mx9TopQ" rel="nofollow">Joris writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-ports&m=142679136422432&w=2" rel="nofollow">ok feedback@</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>On this week&#39;s mini-episode, we&#39;ll be talking with Baptiste Daroussin about packaging the FreeBSD base system with pkgng. Is this the best way going forward, or are we getting dangerously close to being Linux-like? We&#39;ll find out, and also get to a couple of your emails while we&#39;re at it, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=382965" rel="nofollow">Xen dom0 in FreeBSD 11-CURRENT</a></h3>

<ul>
<li>FreeBSD has just gotten <a href="http://wiki.xen.org/wiki/Dom0" rel="nofollow">dom0</a> support for the Xen hypervisor, something <a href="http://wiki.netbsd.org/ports/xen/howto/#netbsd-dom0" rel="nofollow">NetBSD has had</a> for a while now</li>
<li>The ports tree will now have a Xen kernel and toolstack, meaning that they can be updated much more rapidly than if they were part of base</li>
<li>It&#39;s currently limited to Intel boxes with EPT and a working IOMMU, running a recent version of the -CURRENT branch, but we&#39;ll likely see it when 11.0 comes out</li>
<li>How will this affect interest in Bhyve?
***</li>
</ul>

<h3><a href="http://blog.anthrobsd.net/044.html" rel="nofollow">A tale of two educational moments</a></h3>

<ul>
<li>Here we have a blog post from an OpenBSD developer about some experiences he had helping people get involved with the project</li>
<li>It&#39;s split into two stories: one that could&#39;ve gone better, and one that went really well</li>
<li>For the first one, he found that someone was trying to modify a package from their ports tree to have fewer dependencies</li>
<li>Experience really showed its worth, and he was able to write a quick patch to do exactly what the other person had been working on for a few hours - but wasn&#39;t so encouraging about getting it committed</li>
<li>In the second story, he discussed updating a different port with a user of a forum, and ended up improving the new user&#39;s workflow considerably with just a few tips</li>
<li>The lesson to take away from this is that we can all help out to encourage and assist new users - everyone was a newbie once
***</li>
</ul>

<h3><a href="http://saveosx.org/NetBSD7/" rel="nofollow">What&#39;s coming in NetBSD 7</a></h3>

<ul>
<li>We first mentioned NetBSD 7.0 on the show in July of 2014, but it still hasn&#39;t been released and there hasn&#39;t been much public info about it</li>
<li>This blog post outlines some of the bigger features that we can expect to see when it actually does come out</li>
<li>Their total platform count is now over 70, so you&#39;d be hard-pressed to find something that it doesn&#39;t run on</li>
<li>There have been a lot of improvements in the graphics area, particularly with DRM/KMS, including Intel Haswell and Nouveau (for nVidia cards)</li>
<li>Many ARM boards now have full SMP support</li>
<li>Clang has also finally made its way into the base system, something we&#39;re glad to see, and it should be able to build the base OS on i386, AMD64 and ARM - other architectures are still a WIP</li>
<li>In the crypto department: their PNRG has switched from the broken RC4 to the more modern ChaCha20, OpenSSL has been updated in base and LibreSSL is in pkgsrc</li>
<li>NetBSD&#39;s in-house firewall, npf, has gotten major improvements since its initial debut in NetBSD 6.0</li>
<li>Looking to the future, NetBSD hopes to integrate a stable ZFS implementation later on
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=mS4bfbEq46I" rel="nofollow">OpenZFS office hours</a></h3>

<ul>
<li>We mentioned a couple weeks back that the OpenZFS office hours series was starting back up</li>
<li>They&#39;ve just uploaded the recording of their most recent freeform discussion, with <a href="http://www.bsdnow.tv/episodes/2015_03_11-the_pcbsd_tour_ii" rel="nofollow">Justin Gibbs</a> being the main presenter</li>
<li>In it, they cover how Justin got into ZFS, running in virtualized environments, getting patches into the different projects, getting more people involved, reviewing code, spinning disks vs SSDs, defragging, speeding up resilvering, zfsd and much more
***</li>
</ul>

<h2>Interview - Baptiste Daroussin - <a href="mailto:bapt@freebsd.org" rel="nofollow">bapt@freebsd.org</a></h2>

<p>Packaging the FreeBSD base system with pkgng</p>

<hr>

<h2>Discussion</h2>

<h3>Packaging the FreeBSD base system with pkgng (follow-up)</h3>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20AWp6Av1" rel="nofollow">Jeff writes in</a></li>
<li><a href="http://slexy.org/view/s20QiFcdh8" rel="nofollow">Anonymous writes in</a></li>
<li><a href="http://slexy.org/view/s2YzZlswaB" rel="nofollow">Alex writes in</a></li>
<li><a href="http://slexy.org/view/s21Mx9TopQ" rel="nofollow">Joris writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-ports&m=142679136422432&w=2" rel="nofollow">ok feedback@</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>83: woN DSB</title>
  <link>https://www.bsdnow.tv/83</link>
  <guid isPermaLink="false">6b7846ec-2bb1-475f-aead-9fa2dd2d70ef</guid>
  <pubDate>Wed, 01 Apr 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6b7846ec-2bb1-475f-aead-9fa2dd2d70ef.mp3" length="46578388" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week on the show, we'll be talking to Kamila Součková, a Google intern. She's been working on the FreeBSD pager daemon, and also tells us about her initial experiences trying out BSD and going to a conference. As always, all the week's news and answers to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:04:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week on the show, we'll be talking to Kamila Součková, a Google intern. She's been working on the FreeBSD pager daemon, and also tells us about her initial experiences trying out BSD and going to a conference. As always, all the week's news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Major changes coming in PCBSD 11 (http://blog.pcbsd.org/2015/04/huge-announcement-for-pc-bsd/)
The PCBSD team has announced that version 11.0 will have some more pretty big changes (as they've been known to do lately with NTP daemons and firewalls)
Switching from PF to IPFW provided some benefits for VIMAGE, but the syntax was just too complicated for regular everyday users
To solve this, they've ported over Linux's iptables, giving users a much more straightforward configuration (http://dpaste.com/2F1KM6T.txt)
While ZFS has served them well as the default filesystem for a while, Kris decided that Btrfs would be a better choice going forward
Since the FreeBSD kernel doesn't support it natively, all filesystem calls will be through FUSE from now on - performance is Good Enough
People often complain about PCBSD's huge ISO download, so, to save space, the default email client will be switched to mutt, and KDE will be replaced with DWM as the default window manager
To reconfigure it, or make any appearance changes, users just need to edit a simple C header file and recompile - easy peasy
As we've mentioned on the show, PCBSD has been promoting safe backup solutions for a long time with its "life preserver" utility, making it simple to manage multiple snapshots too
To test if people have been listening to this advice, Kris recently activated the backdoor he put in life preserver that deletes all the users' files - hope you had that stuff backed up
***
NetBSD and FreeBSD join forces (http://www.freebsddiary.org/fretbsd.php)
The BSD community has been running into one of the same problems Linux has lately: we just have too many different BSDs to choose from
What's more, none of them have any specific areas they focus on or anything like that (they're all basically the same)
That situation is about to improve somewhat, as FreeBSD and NetBSD have just merged codebases... say hello to FretBSD
Within a week, all mailing lists and webservers for the legacy NetBSD and FreeBSD projects will be terminated - the mailing list for the new combined project will be hosted from the United Nations datacenter on a Microsoft Exchange server
As UN monitors will be moderating the mailing lists to prevent disagreements and divisive arguments before they begin, this system is expected to be adequate for the load
With FretBSD, your toaster can now run ZFS, so you'll never need to worry about the bread becoming silently corrupted again
***
Puffy in the cloud (http://homing-on-code.blogspot.com/2015/03/puffy-in-cloud.html)
If you've ever wanted to set up a backup server, especially for family members or someone who's not as technology-savvy, you've probably realized there are a lot of options
This post explores the option of setting up your own Dropbox-like service with Owncloud and PostgreSQL, running atop the new OpenBSD http daemon
Doing it this way with your own setup, you can control all the security aspects - disk encryption, firewall rules, who can access what and from where, etc
He also mentions our pf tutorial (http://www.bsdnow.tv/tutorials/pf) being helpful in blocking script kiddies from hammering the box
Be sure to encourage your less-technical friends to always back up their important data
***
NetBSD at AsiaBSDCon (https://blog.netbsd.org/tnf/entry/asiabsdcon_2015)
Some NetBSD developers have put together a report of what they did at the most recent event in Tokyo
It includes a wrap-up of the event, as well as a list of presentations (https://www.netbsd.org/gallery/presentations/#asiabsdcon2015) that NetBSD developers gave
Have you ever wanted even more pictures of NetBSD running on lots of devices? There's a never-ending supply, apparently
At the BSD research booth of AsiaBSDCon, there were a large number of machines on display, and someone has finally uploaded pictures of all of them (http://www.ki.nu/~makoto/p15/20150315/)
There's also a video (https://www.youtube.com/watch?v=K1y9cdmLFjw) of an OMRON LUNA-II running the luna68k port
***
Interview - Kamila Součková - kamila@ksp.sk (mailto:kamila@ksp.sk) / @anotherkamila (https://twitter.com/anotherkamila)
BSD conferences, Google Summer of Code, various topics
News Roundup
FreeBSD foundation March update (https://www.freebsdfoundation.org/press/2015marchupdate.pdf)
The FreeBSD foundation has published their March update for fundraising and sponsored projects
In the document, you'll find information about upcoming ARMv8 enhancements, some event recaps and a Google Summer of Code status update
They also mention our interview with the foundation president (http://www.bsdnow.tv/episodes/2015_03_11-the_pcbsd_tour_ii) - be sure to check it out if you haven't
***
Inside OpenBSD's new httpd (http://sdtimes.com/inside-openbsds-new-httpd-web-server/)
BSD news continues to dominate mainstream tech news sites… well not really, but they talk about it once in a while
The SD Times is featuring an article about OpenBSD's in-house HTTP server, after seeing Reyk's AsiaBSDCon presentation (http://www.openbsd.org/papers/httpd-slides-asiabsdcon2015.pdf) about it (which he's giving at BSDCan this year, too)
In this article, they talk about the rapid transition of webservers in the base system - apache being replaced with nginx, only to be replaced with httpd shortly thereafter
Since the new daemon has had almost a full release cycle to grow, new features and fixes have been pouring in
The post also highlights some of the security features: everything runs in a chroot with privsep by default, and it also leverages strong TLS 1.2 defaults (including Perfect Forward Secrecy)
***
Using poudriere without OpenSSL (http://bsdxbsdx.blogspot.com/2015/04/build-packages-in-poudriere-without.html)
Last week we talked about (http://www.bsdnow.tv/episodes/2015_03_25-ssl_in_the_wild) using LibreSSL in FreeBSD for all your ports
One of the problems that was mentioned is that some ports are configured improperly, and end up linking against the OpenSSL in the base system even when you tell them not to
This blog post shows how to completely strip OpenSSL out of the poudriere (http://www.bsdnow.tv/tutorials/poudriere) build jails, something that's a lot more difficult than you'd think
If you're a port maintainer, pay close attention to this post, and get your ports fixed to adhere to the make.conf options properly
***
HAMMER and GPT in OpenBSD (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142755452428573&amp;amp;w=2)
Someone, presumably a Google Summer of Code student, wrote in to the lists about his HAMMER FS (http://www.bsdnow.tv/tutorials/hammer) porting proposal
He outlined the entire process and estimated timetable, including what would be supported and which aspects were beyond the scope of his work (like the clustering stuff)
There's no word yet on if it will be accepted, but it's an interesting idea to explore, especially when you consider that HAMMER really only has one developer
In more disk-related news, Ken Westerback (http://www.bsdnow.tv/episodes/2015_02_25-from_the_foundation_2) has been committing quite a lot of GPT-related fixes (https://www.marc.info/?l=openbsd-cvs&amp;amp;w=2&amp;amp;r=1&amp;amp;s=gpt&amp;amp;q=b) recently
Full GPT support will most likely be finished before 5.8, but anything involving HAMMER FS is still anyone's guess
***
Feedback/Questions
Morgan writes in (http://slexy.org/view/s20e30p4qf)
Dustin writes in (http://slexy.org/view/s20clKByMP)
Stan writes in (http://slexy.org/view/s20aBlmaT5)
Mica writes in (http://slexy.org/view/s2ufFrZY9y)
***
Mailing List Gold
Developers in freefall (https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055281.html)
Xorg thieves pt. 1 (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142786808725483&amp;amp;w=4)
Xorg thieves pt. 2 (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142790740405547&amp;amp;w=4)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, april fools, prank, fretbsd, httpd, foundation, newsletter, cloud, dropbox, owncloud, backups, asiabsdcon, eurobsdcon</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week on the show, we&#39;ll be talking to Kamila Součková, a Google intern. She&#39;s been working on the FreeBSD pager daemon, and also tells us about her initial experiences trying out BSD and going to a conference. As always, all the week&#39;s news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.pcbsd.org/2015/04/huge-announcement-for-pc-bsd/" rel="nofollow">Major changes coming in PCBSD 11</a></h3>

<ul>
<li>The PCBSD team has announced that version 11.0 will have some more pretty big changes (as they&#39;ve been known to do lately with NTP daemons and firewalls)</li>
<li>Switching from PF to IPFW provided some benefits for VIMAGE, but the syntax was just too complicated for regular everyday users</li>
<li>To solve this, they&#39;ve ported over Linux&#39;s iptables, giving users a much more <a href="http://dpaste.com/2F1KM6T.txt" rel="nofollow">straightforward configuration</a></li>
<li>While ZFS has served them well as the default filesystem for a while, Kris decided that Btrfs would be a better choice going forward</li>
<li>Since the FreeBSD kernel doesn&#39;t support it natively, all filesystem calls will be through FUSE from now on - performance is Good Enough</li>
<li>People often complain about PCBSD&#39;s huge ISO download, so, to save space, the default email client will be switched to mutt, and KDE will be replaced with DWM as the default window manager</li>
<li>To reconfigure it, or make any appearance changes, users just need to edit a simple C header file and recompile - easy peasy</li>
<li>As we&#39;ve mentioned on the show, PCBSD has been promoting safe backup solutions for a long time with its &quot;life preserver&quot; utility, making it simple to manage multiple snapshots too</li>
<li>To test if people have been listening to this advice, Kris recently activated the backdoor he put in life preserver that deletes all the users&#39; files - hope you had that stuff backed up
***</li>
</ul>

<h3><a href="http://www.freebsddiary.org/fretbsd.php" rel="nofollow">NetBSD and FreeBSD join forces</a></h3>

<ul>
<li>The BSD community has been running into one of the same problems Linux has lately: we just have too many different BSDs to choose from</li>
<li>What&#39;s more, none of them have any specific areas they focus on or anything like that (they&#39;re all basically the same)</li>
<li>That situation is about to improve somewhat, as FreeBSD and NetBSD have just merged codebases... say hello to <strong>FretBSD</strong></li>
<li>Within a week, all mailing lists and webservers for the legacy NetBSD and FreeBSD projects will be terminated - the mailing list for the new combined project will be hosted from the United Nations datacenter on a Microsoft Exchange server</li>
<li>As UN monitors will be moderating the mailing lists to prevent disagreements and divisive arguments before they begin, this system is expected to be adequate for the load</li>
<li>With FretBSD, your toaster can now run ZFS, so you&#39;ll never need to worry about the bread becoming silently corrupted again
***</li>
</ul>

<h3><a href="http://homing-on-code.blogspot.com/2015/03/puffy-in-cloud.html" rel="nofollow">Puffy in the cloud</a></h3>

<ul>
<li>If you&#39;ve ever wanted to set up a backup server, especially for family members or someone who&#39;s not as technology-savvy, you&#39;ve probably realized there are a lot of options</li>
<li>This post explores the option of setting up your own Dropbox-like service with Owncloud and PostgreSQL, running atop the new OpenBSD http daemon</li>
<li>Doing it this way with your own setup, you can control all the security aspects - disk encryption, firewall rules, who can access what and from where, etc</li>
<li>He also mentions <a href="http://www.bsdnow.tv/tutorials/pf" rel="nofollow">our pf tutorial</a> being helpful in blocking script kiddies from hammering the box</li>
<li>Be sure to encourage your less-technical friends to always back up their important data
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/asiabsdcon_2015" rel="nofollow">NetBSD at AsiaBSDCon</a></h3>

<ul>
<li>Some NetBSD developers have put together a report of what they did at the most recent event in Tokyo</li>
<li>It includes a wrap-up of the event, as well as a <a href="https://www.netbsd.org/gallery/presentations/#asiabsdcon2015" rel="nofollow">list of presentations</a> that NetBSD developers gave</li>
<li>Have you ever wanted even more pictures of NetBSD running on lots of devices? There&#39;s a never-ending supply, apparently</li>
<li>At the BSD research booth of AsiaBSDCon, there were a large number of machines on display, and someone has finally uploaded <a href="http://www.ki.nu/%7Emakoto/p15/20150315/" rel="nofollow">pictures of all of them</a></li>
<li>There&#39;s also <a href="https://www.youtube.com/watch?v=K1y9cdmLFjw" rel="nofollow">a video</a> of an OMRON LUNA-II running the luna68k port
***</li>
</ul>

<h2>Interview - Kamila Součková - <a href="mailto:kamila@ksp.sk" rel="nofollow">kamila@ksp.sk</a> / <a href="https://twitter.com/anotherkamila" rel="nofollow">@anotherkamila</a></h2>

<p>BSD conferences, Google Summer of Code, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.freebsdfoundation.org/press/2015marchupdate.pdf" rel="nofollow">FreeBSD foundation March update</a></h3>

<ul>
<li>The FreeBSD foundation has published their March update for fundraising and sponsored projects</li>
<li>In the document, you&#39;ll find information about upcoming ARMv8 enhancements, some event recaps and a Google Summer of Code status update</li>
<li>They also mention <a href="http://www.bsdnow.tv/episodes/2015_03_11-the_pcbsd_tour_ii" rel="nofollow">our interview with the foundation president</a> - be sure to check it out if you haven&#39;t
***</li>
</ul>

<h3><a href="http://sdtimes.com/inside-openbsds-new-httpd-web-server/" rel="nofollow">Inside OpenBSD&#39;s new httpd</a></h3>

<ul>
<li>BSD news continues to <strong>dominate</strong> mainstream tech news sites… well <em>not really</em>, but they talk about it once in a while</li>
<li>The SD Times is featuring an article about OpenBSD&#39;s in-house HTTP server, after seeing Reyk&#39;s <a href="http://www.openbsd.org/papers/httpd-slides-asiabsdcon2015.pdf" rel="nofollow">AsiaBSDCon presentation</a> about it (which he&#39;s giving at BSDCan this year, too)</li>
<li>In this article, they talk about the rapid transition of webservers in the base system - apache being replaced with nginx, only to be replaced with httpd shortly thereafter</li>
<li>Since the new daemon has had almost a full release cycle to grow, new features and fixes have been pouring in</li>
<li>The post also highlights some of the security features: everything runs in a chroot with privsep by default, and it also leverages strong TLS 1.2 defaults (including Perfect Forward Secrecy)
***</li>
</ul>

<h3><a href="http://bsdxbsdx.blogspot.com/2015/04/build-packages-in-poudriere-without.html" rel="nofollow">Using poudriere without OpenSSL</a></h3>

<ul>
<li>Last week we <a href="http://www.bsdnow.tv/episodes/2015_03_25-ssl_in_the_wild" rel="nofollow">talked about</a> using LibreSSL in FreeBSD for all your ports</li>
<li>One of the problems that was mentioned is that some ports are configured improperly, and end up linking against the OpenSSL in the base system even when you tell them not to</li>
<li>This blog post shows how to completely strip OpenSSL out of the <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere</a> build jails, something that&#39;s a lot more difficult than you&#39;d think</li>
<li>If you&#39;re a port maintainer, pay close attention to this post, and get your ports fixed to adhere to the make.conf options properly
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=142755452428573&w=2" rel="nofollow">HAMMER and GPT in OpenBSD</a></h3>

<ul>
<li>Someone, presumably a Google Summer of Code student, wrote in to the lists about his <a href="http://www.bsdnow.tv/tutorials/hammer" rel="nofollow">HAMMER FS</a> porting proposal</li>
<li>He outlined the entire process and estimated timetable, including what would be supported and which aspects were beyond the scope of his work (like the clustering stuff)</li>
<li>There&#39;s no word yet on if it will be accepted, but it&#39;s an interesting idea to explore, especially when you consider that HAMMER really only has one developer</li>
<li>In more disk-related news, <a href="http://www.bsdnow.tv/episodes/2015_02_25-from_the_foundation_2" rel="nofollow">Ken Westerback</a> has been committing quite a lot of <a href="https://www.marc.info/?l=openbsd-cvs&w=2&r=1&s=gpt&q=b" rel="nofollow">GPT-related fixes</a> recently</li>
<li>Full GPT support will most likely be finished before 5.8, but anything involving HAMMER FS is still anyone&#39;s guess
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20e30p4qf" rel="nofollow">Morgan writes in</a></li>
<li><a href="http://slexy.org/view/s20clKByMP" rel="nofollow">Dustin writes in</a></li>
<li><a href="http://slexy.org/view/s20aBlmaT5" rel="nofollow">Stan writes in</a></li>
<li><a href="http://slexy.org/view/s2ufFrZY9y" rel="nofollow">Mica writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055281.html" rel="nofollow">Developers in freefall</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=142786808725483&w=4" rel="nofollow">Xorg thieves pt. 1</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=142790740405547&w=4" rel="nofollow">Xorg thieves pt. 2</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week on the show, we&#39;ll be talking to Kamila Součková, a Google intern. She&#39;s been working on the FreeBSD pager daemon, and also tells us about her initial experiences trying out BSD and going to a conference. As always, all the week&#39;s news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.pcbsd.org/2015/04/huge-announcement-for-pc-bsd/" rel="nofollow">Major changes coming in PCBSD 11</a></h3>

<ul>
<li>The PCBSD team has announced that version 11.0 will have some more pretty big changes (as they&#39;ve been known to do lately with NTP daemons and firewalls)</li>
<li>Switching from PF to IPFW provided some benefits for VIMAGE, but the syntax was just too complicated for regular everyday users</li>
<li>To solve this, they&#39;ve ported over Linux&#39;s iptables, giving users a much more <a href="http://dpaste.com/2F1KM6T.txt" rel="nofollow">straightforward configuration</a></li>
<li>While ZFS has served them well as the default filesystem for a while, Kris decided that Btrfs would be a better choice going forward</li>
<li>Since the FreeBSD kernel doesn&#39;t support it natively, all filesystem calls will be through FUSE from now on - performance is Good Enough</li>
<li>People often complain about PCBSD&#39;s huge ISO download, so, to save space, the default email client will be switched to mutt, and KDE will be replaced with DWM as the default window manager</li>
<li>To reconfigure it, or make any appearance changes, users just need to edit a simple C header file and recompile - easy peasy</li>
<li>As we&#39;ve mentioned on the show, PCBSD has been promoting safe backup solutions for a long time with its &quot;life preserver&quot; utility, making it simple to manage multiple snapshots too</li>
<li>To test if people have been listening to this advice, Kris recently activated the backdoor he put in life preserver that deletes all the users&#39; files - hope you had that stuff backed up
***</li>
</ul>

<h3><a href="http://www.freebsddiary.org/fretbsd.php" rel="nofollow">NetBSD and FreeBSD join forces</a></h3>

<ul>
<li>The BSD community has been running into one of the same problems Linux has lately: we just have too many different BSDs to choose from</li>
<li>What&#39;s more, none of them have any specific areas they focus on or anything like that (they&#39;re all basically the same)</li>
<li>That situation is about to improve somewhat, as FreeBSD and NetBSD have just merged codebases... say hello to <strong>FretBSD</strong></li>
<li>Within a week, all mailing lists and webservers for the legacy NetBSD and FreeBSD projects will be terminated - the mailing list for the new combined project will be hosted from the United Nations datacenter on a Microsoft Exchange server</li>
<li>As UN monitors will be moderating the mailing lists to prevent disagreements and divisive arguments before they begin, this system is expected to be adequate for the load</li>
<li>With FretBSD, your toaster can now run ZFS, so you&#39;ll never need to worry about the bread becoming silently corrupted again
***</li>
</ul>

<h3><a href="http://homing-on-code.blogspot.com/2015/03/puffy-in-cloud.html" rel="nofollow">Puffy in the cloud</a></h3>

<ul>
<li>If you&#39;ve ever wanted to set up a backup server, especially for family members or someone who&#39;s not as technology-savvy, you&#39;ve probably realized there are a lot of options</li>
<li>This post explores the option of setting up your own Dropbox-like service with Owncloud and PostgreSQL, running atop the new OpenBSD http daemon</li>
<li>Doing it this way with your own setup, you can control all the security aspects - disk encryption, firewall rules, who can access what and from where, etc</li>
<li>He also mentions <a href="http://www.bsdnow.tv/tutorials/pf" rel="nofollow">our pf tutorial</a> being helpful in blocking script kiddies from hammering the box</li>
<li>Be sure to encourage your less-technical friends to always back up their important data
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/asiabsdcon_2015" rel="nofollow">NetBSD at AsiaBSDCon</a></h3>

<ul>
<li>Some NetBSD developers have put together a report of what they did at the most recent event in Tokyo</li>
<li>It includes a wrap-up of the event, as well as a <a href="https://www.netbsd.org/gallery/presentations/#asiabsdcon2015" rel="nofollow">list of presentations</a> that NetBSD developers gave</li>
<li>Have you ever wanted even more pictures of NetBSD running on lots of devices? There&#39;s a never-ending supply, apparently</li>
<li>At the BSD research booth of AsiaBSDCon, there were a large number of machines on display, and someone has finally uploaded <a href="http://www.ki.nu/%7Emakoto/p15/20150315/" rel="nofollow">pictures of all of them</a></li>
<li>There&#39;s also <a href="https://www.youtube.com/watch?v=K1y9cdmLFjw" rel="nofollow">a video</a> of an OMRON LUNA-II running the luna68k port
***</li>
</ul>

<h2>Interview - Kamila Součková - <a href="mailto:kamila@ksp.sk" rel="nofollow">kamila@ksp.sk</a> / <a href="https://twitter.com/anotherkamila" rel="nofollow">@anotherkamila</a></h2>

<p>BSD conferences, Google Summer of Code, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.freebsdfoundation.org/press/2015marchupdate.pdf" rel="nofollow">FreeBSD foundation March update</a></h3>

<ul>
<li>The FreeBSD foundation has published their March update for fundraising and sponsored projects</li>
<li>In the document, you&#39;ll find information about upcoming ARMv8 enhancements, some event recaps and a Google Summer of Code status update</li>
<li>They also mention <a href="http://www.bsdnow.tv/episodes/2015_03_11-the_pcbsd_tour_ii" rel="nofollow">our interview with the foundation president</a> - be sure to check it out if you haven&#39;t
***</li>
</ul>

<h3><a href="http://sdtimes.com/inside-openbsds-new-httpd-web-server/" rel="nofollow">Inside OpenBSD&#39;s new httpd</a></h3>

<ul>
<li>BSD news continues to <strong>dominate</strong> mainstream tech news sites… well <em>not really</em>, but they talk about it once in a while</li>
<li>The SD Times is featuring an article about OpenBSD&#39;s in-house HTTP server, after seeing Reyk&#39;s <a href="http://www.openbsd.org/papers/httpd-slides-asiabsdcon2015.pdf" rel="nofollow">AsiaBSDCon presentation</a> about it (which he&#39;s giving at BSDCan this year, too)</li>
<li>In this article, they talk about the rapid transition of webservers in the base system - apache being replaced with nginx, only to be replaced with httpd shortly thereafter</li>
<li>Since the new daemon has had almost a full release cycle to grow, new features and fixes have been pouring in</li>
<li>The post also highlights some of the security features: everything runs in a chroot with privsep by default, and it also leverages strong TLS 1.2 defaults (including Perfect Forward Secrecy)
***</li>
</ul>

<h3><a href="http://bsdxbsdx.blogspot.com/2015/04/build-packages-in-poudriere-without.html" rel="nofollow">Using poudriere without OpenSSL</a></h3>

<ul>
<li>Last week we <a href="http://www.bsdnow.tv/episodes/2015_03_25-ssl_in_the_wild" rel="nofollow">talked about</a> using LibreSSL in FreeBSD for all your ports</li>
<li>One of the problems that was mentioned is that some ports are configured improperly, and end up linking against the OpenSSL in the base system even when you tell them not to</li>
<li>This blog post shows how to completely strip OpenSSL out of the <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere</a> build jails, something that&#39;s a lot more difficult than you&#39;d think</li>
<li>If you&#39;re a port maintainer, pay close attention to this post, and get your ports fixed to adhere to the make.conf options properly
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=142755452428573&w=2" rel="nofollow">HAMMER and GPT in OpenBSD</a></h3>

<ul>
<li>Someone, presumably a Google Summer of Code student, wrote in to the lists about his <a href="http://www.bsdnow.tv/tutorials/hammer" rel="nofollow">HAMMER FS</a> porting proposal</li>
<li>He outlined the entire process and estimated timetable, including what would be supported and which aspects were beyond the scope of his work (like the clustering stuff)</li>
<li>There&#39;s no word yet on if it will be accepted, but it&#39;s an interesting idea to explore, especially when you consider that HAMMER really only has one developer</li>
<li>In more disk-related news, <a href="http://www.bsdnow.tv/episodes/2015_02_25-from_the_foundation_2" rel="nofollow">Ken Westerback</a> has been committing quite a lot of <a href="https://www.marc.info/?l=openbsd-cvs&w=2&r=1&s=gpt&q=b" rel="nofollow">GPT-related fixes</a> recently</li>
<li>Full GPT support will most likely be finished before 5.8, but anything involving HAMMER FS is still anyone&#39;s guess
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20e30p4qf" rel="nofollow">Morgan writes in</a></li>
<li><a href="http://slexy.org/view/s20clKByMP" rel="nofollow">Dustin writes in</a></li>
<li><a href="http://slexy.org/view/s20aBlmaT5" rel="nofollow">Stan writes in</a></li>
<li><a href="http://slexy.org/view/s2ufFrZY9y" rel="nofollow">Mica writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-April/055281.html" rel="nofollow">Developers in freefall</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=142786808725483&w=4" rel="nofollow">Xorg thieves pt. 1</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=142790740405547&w=4" rel="nofollow">Xorg thieves pt. 2</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>82: SSL in the Wild</title>
  <link>https://www.bsdnow.tv/82</link>
  <guid isPermaLink="false">530c2987-381d-4c49-bfb9-b78872dd2e03</guid>
  <pubDate>Wed, 25 Mar 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/530c2987-381d-4c49-bfb9-b78872dd2e03.mp3" length="63405364" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week, we'll be chatting with Bernard Spil about wider adoption of LibreSSL in other communities. He's been doing a lot of work with FreeBSD ports specifically, but also working with upstream projects. As usual, all this weeks news and answers to your questions, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:28:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week, we'll be chatting with Bernard Spil about wider adoption of LibreSSL in other communities. He's been doing a lot of work with FreeBSD ports specifically, but also working with upstream projects. As usual, all this weeks news and answers to your questions, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
EuroBSDCon 2015 call for papers (https://2015.eurobsdcon.org/call-for-papers/)
The call for papers has been announced for the next EuroBSDCon (http://www.bsdnow.tv/episodes/2014_12_03-conference-connoisseur), which is set to be held in Sweden this year
According to their site, the call for presentation proposals period will start on Monday the 23rd of March until Friday the 17th of April
If giving a full talk isn't your thing, there's also a call for tutorials - if you're comfortable teaching other people about something BSD-related, this could be a great thing too
You're not limited to one proposal - several speakers gave multiple in 2014 - so don't hesitate if you've got more than one thing you'd like to talk about
We'd like to see a more balanced conference schedule than BSDCan's having this year, but that requires effort on both sides - if you're doing anything cool with any BSD, we'd encourage you submit a proposal (or two)
Check the announcement for all the specific details and requirements
If your talk gets accepted, the conference even pays for your travel expenses
***
Making security sausage (http://www.tedunangst.com/flak/post/making-security-sausage)
Ted Unangst (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures) has a new blog post up, detailing his experiences with some recent security patches both in and out of OpenBSD
"Unfortunately, I wrote the tool used for signing patches which somehow turned into a responsibility for also creating the inputs to be signed. That was not the plan!"
The post first takes us through a few OpenBSD errata patches, explaining how some can get fixed very quickly, but others are more complicated and need a bit more review
It also covers security in upstream codebases, and how upstream projects sometimes treat security issues as any other bug
Following that, it leads to the topic of FreeType - and a much more complicated problem with backporting patches between versions
The recent OpenSSL vulnerabilities were also mentioned, with an interesting story to go along with them
Just 45 minutes before the agreed-upon announcement, OpenBSD devs found a problem with the patch OpenSSL planned to release - it had to be redone at the last minute
It was because of this that FreeBSD actually had to release a security update to their security update (https://lists.freebsd.org/pipermail/freebsd-security-notifications/2015-March/000237.html)
He concludes with "My number one wish would be that every project provide small patches for security issues. Dropping enormous feature releases along with a note 'oh, and some security too' creates downstream mayhem."
***
Running FreeBSD on the server, a sysadmin speaks (http://www.itwire.com/business-it-news/open-source/67420-running-freebsd-on-the-server-a-sysadmin-speaks)
More BSD content is appearing on mainstream technology sites, and, more importantly, BSD Now is being mentioned
ITWire recently did an interview with Allan about running FreeBSD on servers (possibly to go with their earlier interview with Kris about desktop usage)
They discuss some of the advantages BSD brings to the table for sysadmins that might be used to Linux or some other UNIX flavor
It also covers specific features like jails, ZFS, long-term support, automating tasks and even… what to name your computers
If you've been considering switching your servers over from Linux to FreeBSD, but maybe wanted to hear some first-hand experience, this is the article for you
***
NetBSD ported to Hardkernel ODROID-C1 (https://blog.netbsd.org/tnf/entry/netbsd_ported_to_hardkernel_odroid)
In their never-ending quest to run on every new board that comes out, NetBSD has been ported to the Hardkernel ODROID-C1 (http://www.hardkernel.com/main/products/prdt_info.php?g_code=G141578608433)
This one features a quad-core ARMv7 CPU at 1.5GHz, has a gig of ram and gigabit ethernet... all for just $35
There's a special kernel config file for this board's hardware, available in both -current and the upcoming 7.0
More info can be found on their wiki page (https://wiki.netbsd.org/ports/evbarm/odroid-c1/)
After this was written, basic framebuffer console support was also committed (http://mail-index.netbsd.org/source-changes/2015/03/21/msg064156.html), allowing a developer to run XFCE (https://pbs.twimg.com/media/CAqU5CnWEAAEhH2.png:large) on the device
***
Interview - Bernard Spil - brnrd@freebsd.org (mailto:brnrd@freebsd.org) / @sp1l (https://twitter.com/sp1l)
LibreSSL adoption in FreeBSD ports (https://wiki.freebsd.org/LibreSSL) and the wider software ecosystem
News Roundup
Monitoring pf logs with Gource (http://www.echothrust.com/blogs/monitoring-pf-logs-gource)
If you're using pf (http://www.bsdnow.tv/tutorials/pf) on any of the BSDs, maybe you've gotten bored of grepping logs and want to do something more fancy
This article will show you how to get set up with Gource for a cinematic-like experience
If you've never heard of Gource, it's "an OpenGL-based 3D visualization tool intended for visualizing activity on source control repositories"
When you put all the tools together, you can end up with some pretty eye-catching animations of your firewall traffic
One of our listeners wrote in to say that he set this up and, almost immediately, noticed his girlfriend's phone had been compromised - graphical representations of traffic could be useful for detecting suspicious network activity
***
pkgng 1.5.0 alpha1 released (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=381573)
The development version of pkgng was updated to 1.4.99.14, or 1.5.0 alpha1
This update introduces support for provides/requires, something that we've been wanting for a long time
It will also now print which package is the reason for direct dependency change
Another interesting addition is the "pkg -r" switch, allowing cross installation of packages
Remember this isn't the stable version, so maybe don't upgrade to it just yet on any production systems
DragonFly will also likely pick up this update once it's marked stable
***
Welcome to OpenBSD (http://devio.us/~bcallah/rcos2015.pdf)
We mentioned last week that our listener Brian was giving a talk in the Troy, New York area
The slides from that talk are now online, and they've been generating quite a bit of discussion (https://news.ycombinator.com/item?id=9240533) online (https://www.reddit.com/r/openbsd/comments/2ztokc/welcome_to_openbsd/)
It's simply titled "Welcome to OpenBSD" and gives the reader an introduction to the OS (and how easy it is to get involved with contributing)
Topics include a quick history of the project, who the developers are and what they do, some proactive security techniques and finally how to get involved
As you may know, NetBSD has almost 60 supported platforms (https://www.netbsd.org/ports/) and their slogan is "of course it runs NetBSD" - Brian says, with 17 platforms (http://www.openbsd.org/plat.html) over 13 CPU architectures, "it probably runs OpenBSD"
No matter which BSD you might be interested in, these slides are a great read, especially for any beginners looking to get their feet wet
Try to guess which font he used...
***
BSDTalk episode 252 (http://bsdtalk.blogspot.com/2015/03/bsdtalk252-devious-with-brian-callahan.html)
And somehow Brian has snuck himself into another news item this week
He makes an appearance in the latest episode of BSD Talk (http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk), where he chats with Will about running a BSD-based shell provider
If that sounds familiar, it's probably because we did the same thing (http://www.bsdnow.tv/episodes/2014_06_18-devious_methods), albeit with a different member of their team
In this interview, they discuss what a shell provider does, hardware requirements and how to weed out the spammers in favor of real people
They also talk a bit about the community aspect of a shared server, as opposed to just running a virtual machine by yourself
***
Feedback/Questions
Christian writes in (http://slexy.org/view/s2O81pixhq)
Stefan writes in (http://slexy.org/view/s2dhr2WfVc)
Possnfiffer writes in (http://slexy.org/view/s2Kisq2EqT)
Ruudsch writes in (http://slexy.org/view/s2Xr0e5YAJ)
Shane writes in (http://slexy.org/view/s2Xz7BNoJE)
***
Mailing List Gold
Accidental support (https://lists.freebsd.org/pipermail/svn-src-head/2015-March/069679.html)
Larry's tears (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142686812913221&amp;amp;w=2)
The boy who sailed with BSD (https://lists.freebsd.org/pipermail/freebsd-hardware/2015-March/007625.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, pkgng, poudriere, eurobsdcon, 2015, mg, emacs, libressl, openssl, ports, tls, heartbleed, freak attack, pkgng, hardkernel, gource</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week, we&#39;ll be chatting with Bernard Spil about wider adoption of LibreSSL in other communities. He&#39;s been doing a lot of work with FreeBSD ports specifically, but also working with upstream projects. As usual, all this weeks news and answers to your questions, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://2015.eurobsdcon.org/call-for-papers/" rel="nofollow">EuroBSDCon 2015 call for papers</a></h3>

<ul>
<li>The call for papers has been announced for the next <a href="http://www.bsdnow.tv/episodes/2014_12_03-conference-connoisseur" rel="nofollow">EuroBSDCon</a>, which is set to be held in Sweden this year</li>
<li>According to their site, the call for presentation proposals period will start on Monday the 23rd of March until Friday the 17th of April</li>
<li>If giving a full talk isn&#39;t your thing, there&#39;s also a call for tutorials - if you&#39;re comfortable teaching other people about something BSD-related, this could be a great thing too</li>
<li>You&#39;re not limited to one proposal - several speakers gave multiple in 2014 - so don&#39;t hesitate if you&#39;ve got more than one thing you&#39;d like to talk about</li>
<li>We&#39;d like to see a more balanced conference schedule than BSDCan&#39;s having this year, but that requires effort on both sides - if you&#39;re doing <em>anything</em> cool with <em>any</em> BSD, we&#39;d encourage you submit a proposal (or two)</li>
<li>Check the announcement for all the specific details and requirements</li>
<li>If your talk gets accepted, the conference even pays for your travel expenses
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/making-security-sausage" rel="nofollow">Making security sausage</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> has a new blog post up, detailing his experiences with some recent security patches both in and out of OpenBSD</li>
<li>&quot;Unfortunately, I wrote the tool used for signing patches which somehow turned into a responsibility for also creating the inputs to be signed. That was not the plan!&quot;</li>
<li>The post first takes us through a few OpenBSD errata patches, explaining how some can get fixed very quickly, but others are more complicated and need a bit more review</li>
<li>It also covers security in upstream codebases, and how upstream projects sometimes treat security issues as any other bug</li>
<li>Following that, it leads to the topic of FreeType - and a much more complicated problem with backporting patches between versions</li>
<li>The recent OpenSSL vulnerabilities were also mentioned, with an interesting story to go along with them</li>
<li>Just 45 minutes before the agreed-upon announcement, OpenBSD devs found a problem with the patch OpenSSL planned to release - it had to be redone at the last minute</li>
<li>It was because of this that FreeBSD actually had to release <a href="https://lists.freebsd.org/pipermail/freebsd-security-notifications/2015-March/000237.html" rel="nofollow">a security update to their security update</a></li>
<li>He concludes with &quot;My number one wish would be that every project provide small patches for security issues. Dropping enormous feature releases along with a note &#39;oh, and some security too&#39; creates downstream mayhem.&quot;
***</li>
</ul>

<h3><a href="http://www.itwire.com/business-it-news/open-source/67420-running-freebsd-on-the-server-a-sysadmin-speaks" rel="nofollow">Running FreeBSD on the server, a sysadmin speaks</a></h3>

<ul>
<li>More BSD content is appearing on mainstream technology sites, and, <strong>more importantly</strong>, BSD Now is being mentioned</li>
<li>ITWire recently did an interview with Allan about running FreeBSD on servers (possibly to go with their earlier interview with Kris about desktop usage)</li>
<li>They discuss some of the advantages BSD brings to the table for sysadmins that might be used to Linux or some other UNIX flavor</li>
<li>It also covers specific features like jails, ZFS, long-term support, automating tasks and even… what to name your computers</li>
<li>If you&#39;ve been considering switching your servers over from Linux to FreeBSD, but maybe wanted to hear some first-hand experience, this is the article for you
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_ported_to_hardkernel_odroid" rel="nofollow">NetBSD ported to Hardkernel ODROID-C1</a></h3>

<ul>
<li>In their never-ending quest to run on every new board that comes out, NetBSD has been ported to the <a href="http://www.hardkernel.com/main/products/prdt_info.php?g_code=G141578608433" rel="nofollow">Hardkernel ODROID-C1</a></li>
<li>This one features a quad-core ARMv7 CPU at 1.5GHz, has a gig of ram and gigabit ethernet... all for just $35</li>
<li>There&#39;s a special kernel config file for this board&#39;s hardware, available in both -current and the upcoming 7.0</li>
<li>More info can be found on <a href="https://wiki.netbsd.org/ports/evbarm/odroid-c1/" rel="nofollow">their wiki page</a></li>
<li>After this was written, basic framebuffer console support was <a href="http://mail-index.netbsd.org/source-changes/2015/03/21/msg064156.html" rel="nofollow">also committed</a>, allowing a developer to <a href="https://pbs.twimg.com/media/CAqU5CnWEAAEhH2.png:large" rel="nofollow">run XFCE</a> on the device
***</li>
</ul>

<h2>Interview - Bernard Spil - <a href="mailto:brnrd@freebsd.org" rel="nofollow">brnrd@freebsd.org</a> / <a href="https://twitter.com/sp1l" rel="nofollow">@sp1l</a></h2>

<p>LibreSSL adoption <a href="https://wiki.freebsd.org/LibreSSL" rel="nofollow">in FreeBSD ports</a> and the wider software ecosystem</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.echothrust.com/blogs/monitoring-pf-logs-gource" rel="nofollow">Monitoring pf logs with Gource</a></h3>

<ul>
<li>If you&#39;re <a href="http://www.bsdnow.tv/tutorials/pf" rel="nofollow">using pf</a> on any of the BSDs, maybe you&#39;ve gotten bored of grepping logs and want to do something more fancy</li>
<li>This article will show you how to get set up with Gource for a cinematic-like experience</li>
<li>If you&#39;ve never heard of Gource, it&#39;s &quot;an OpenGL-based 3D visualization tool intended for visualizing activity on source control repositories&quot;</li>
<li>When you put all the tools together, you can end up with some pretty eye-catching animations of your firewall traffic</li>
<li>One of our listeners wrote in to say that he set this up and, almost immediately, noticed his girlfriend&#39;s phone had been compromised - graphical representations of traffic could be useful for detecting suspicious network activity
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=381573" rel="nofollow">pkgng 1.5.0 alpha1 released</a></h3>

<ul>
<li>The development version of pkgng was updated to 1.4.99.14, or 1.5.0 alpha1</li>
<li>This update introduces support for provides/requires, something that we&#39;ve been wanting for a long time</li>
<li>It will also now print which package is the reason for direct dependency change</li>
<li>Another interesting addition is the &quot;pkg -r&quot; switch, allowing cross installation of packages</li>
<li>Remember this isn&#39;t the stable version, so maybe don&#39;t upgrade to it just yet on any production systems</li>
<li>DragonFly will also likely pick up this update once it&#39;s marked stable
***</li>
</ul>

<h3><a href="http://devio.us/%7Ebcallah/rcos2015.pdf" rel="nofollow">Welcome to OpenBSD</a></h3>

<ul>
<li>We mentioned last week that our listener Brian was giving a talk in the Troy, New York area</li>
<li>The slides from that talk are now online, and they&#39;ve been generating quite a bit of <a href="https://news.ycombinator.com/item?id=9240533" rel="nofollow">discussion</a> <a href="https://www.reddit.com/r/openbsd/comments/2ztokc/welcome_to_openbsd/" rel="nofollow">online</a></li>
<li>It&#39;s simply titled &quot;Welcome to OpenBSD&quot; and gives the reader an introduction to the OS (and how easy it is to get involved with contributing)</li>
<li>Topics include a quick history of the project, who the developers are and what they do, some proactive security techniques and finally how to get involved</li>
<li>As you may know, NetBSD has almost 60 <a href="https://www.netbsd.org/ports/" rel="nofollow">supported platforms</a> and their slogan is &quot;<em>of course</em> it runs NetBSD&quot; - Brian says, with <a href="http://www.openbsd.org/plat.html" rel="nofollow">17 platforms</a> over 13 CPU architectures, &quot;it <em>probably</em> runs OpenBSD&quot;</li>
<li>No matter which BSD you might be interested in, these slides are a great read, especially for any beginners looking to get their feet wet</li>
<li>Try to guess which font he used...
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2015/03/bsdtalk252-devious-with-brian-callahan.html" rel="nofollow">BSDTalk episode 252</a></h3>

<ul>
<li>And somehow Brian has snuck himself into <em>another</em> news item this week</li>
<li>He makes an appearance in the latest episode of <a href="http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk" rel="nofollow">BSD Talk</a>, where he chats with Will about running a BSD-based shell provider</li>
<li>If that sounds familiar, it&#39;s probably because <a href="http://www.bsdnow.tv/episodes/2014_06_18-devious_methods" rel="nofollow">we did the same thing</a>, albeit with a different member of their team</li>
<li>In this interview, they discuss what a shell provider does, hardware requirements and how to weed out the spammers in favor of real people</li>
<li>They also talk a bit about the community aspect of a shared server, as opposed to just running a virtual machine by yourself
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2O81pixhq" rel="nofollow">Christian writes in</a></li>
<li><a href="http://slexy.org/view/s2dhr2WfVc" rel="nofollow">Stefan writes in</a></li>
<li><a href="http://slexy.org/view/s2Kisq2EqT" rel="nofollow">Possnfiffer writes in</a></li>
<li><a href="http://slexy.org/view/s2Xr0e5YAJ" rel="nofollow">Ruudsch writes in</a></li>
<li><a href="http://slexy.org/view/s2Xz7BNoJE" rel="nofollow">Shane writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-March/069679.html" rel="nofollow">Accidental support</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=142686812913221&w=2" rel="nofollow">Larry&#39;s tears</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-hardware/2015-March/007625.html" rel="nofollow">The boy who sailed with BSD</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week, we&#39;ll be chatting with Bernard Spil about wider adoption of LibreSSL in other communities. He&#39;s been doing a lot of work with FreeBSD ports specifically, but also working with upstream projects. As usual, all this weeks news and answers to your questions, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://2015.eurobsdcon.org/call-for-papers/" rel="nofollow">EuroBSDCon 2015 call for papers</a></h3>

<ul>
<li>The call for papers has been announced for the next <a href="http://www.bsdnow.tv/episodes/2014_12_03-conference-connoisseur" rel="nofollow">EuroBSDCon</a>, which is set to be held in Sweden this year</li>
<li>According to their site, the call for presentation proposals period will start on Monday the 23rd of March until Friday the 17th of April</li>
<li>If giving a full talk isn&#39;t your thing, there&#39;s also a call for tutorials - if you&#39;re comfortable teaching other people about something BSD-related, this could be a great thing too</li>
<li>You&#39;re not limited to one proposal - several speakers gave multiple in 2014 - so don&#39;t hesitate if you&#39;ve got more than one thing you&#39;d like to talk about</li>
<li>We&#39;d like to see a more balanced conference schedule than BSDCan&#39;s having this year, but that requires effort on both sides - if you&#39;re doing <em>anything</em> cool with <em>any</em> BSD, we&#39;d encourage you submit a proposal (or two)</li>
<li>Check the announcement for all the specific details and requirements</li>
<li>If your talk gets accepted, the conference even pays for your travel expenses
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/making-security-sausage" rel="nofollow">Making security sausage</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> has a new blog post up, detailing his experiences with some recent security patches both in and out of OpenBSD</li>
<li>&quot;Unfortunately, I wrote the tool used for signing patches which somehow turned into a responsibility for also creating the inputs to be signed. That was not the plan!&quot;</li>
<li>The post first takes us through a few OpenBSD errata patches, explaining how some can get fixed very quickly, but others are more complicated and need a bit more review</li>
<li>It also covers security in upstream codebases, and how upstream projects sometimes treat security issues as any other bug</li>
<li>Following that, it leads to the topic of FreeType - and a much more complicated problem with backporting patches between versions</li>
<li>The recent OpenSSL vulnerabilities were also mentioned, with an interesting story to go along with them</li>
<li>Just 45 minutes before the agreed-upon announcement, OpenBSD devs found a problem with the patch OpenSSL planned to release - it had to be redone at the last minute</li>
<li>It was because of this that FreeBSD actually had to release <a href="https://lists.freebsd.org/pipermail/freebsd-security-notifications/2015-March/000237.html" rel="nofollow">a security update to their security update</a></li>
<li>He concludes with &quot;My number one wish would be that every project provide small patches for security issues. Dropping enormous feature releases along with a note &#39;oh, and some security too&#39; creates downstream mayhem.&quot;
***</li>
</ul>

<h3><a href="http://www.itwire.com/business-it-news/open-source/67420-running-freebsd-on-the-server-a-sysadmin-speaks" rel="nofollow">Running FreeBSD on the server, a sysadmin speaks</a></h3>

<ul>
<li>More BSD content is appearing on mainstream technology sites, and, <strong>more importantly</strong>, BSD Now is being mentioned</li>
<li>ITWire recently did an interview with Allan about running FreeBSD on servers (possibly to go with their earlier interview with Kris about desktop usage)</li>
<li>They discuss some of the advantages BSD brings to the table for sysadmins that might be used to Linux or some other UNIX flavor</li>
<li>It also covers specific features like jails, ZFS, long-term support, automating tasks and even… what to name your computers</li>
<li>If you&#39;ve been considering switching your servers over from Linux to FreeBSD, but maybe wanted to hear some first-hand experience, this is the article for you
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_ported_to_hardkernel_odroid" rel="nofollow">NetBSD ported to Hardkernel ODROID-C1</a></h3>

<ul>
<li>In their never-ending quest to run on every new board that comes out, NetBSD has been ported to the <a href="http://www.hardkernel.com/main/products/prdt_info.php?g_code=G141578608433" rel="nofollow">Hardkernel ODROID-C1</a></li>
<li>This one features a quad-core ARMv7 CPU at 1.5GHz, has a gig of ram and gigabit ethernet... all for just $35</li>
<li>There&#39;s a special kernel config file for this board&#39;s hardware, available in both -current and the upcoming 7.0</li>
<li>More info can be found on <a href="https://wiki.netbsd.org/ports/evbarm/odroid-c1/" rel="nofollow">their wiki page</a></li>
<li>After this was written, basic framebuffer console support was <a href="http://mail-index.netbsd.org/source-changes/2015/03/21/msg064156.html" rel="nofollow">also committed</a>, allowing a developer to <a href="https://pbs.twimg.com/media/CAqU5CnWEAAEhH2.png:large" rel="nofollow">run XFCE</a> on the device
***</li>
</ul>

<h2>Interview - Bernard Spil - <a href="mailto:brnrd@freebsd.org" rel="nofollow">brnrd@freebsd.org</a> / <a href="https://twitter.com/sp1l" rel="nofollow">@sp1l</a></h2>

<p>LibreSSL adoption <a href="https://wiki.freebsd.org/LibreSSL" rel="nofollow">in FreeBSD ports</a> and the wider software ecosystem</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.echothrust.com/blogs/monitoring-pf-logs-gource" rel="nofollow">Monitoring pf logs with Gource</a></h3>

<ul>
<li>If you&#39;re <a href="http://www.bsdnow.tv/tutorials/pf" rel="nofollow">using pf</a> on any of the BSDs, maybe you&#39;ve gotten bored of grepping logs and want to do something more fancy</li>
<li>This article will show you how to get set up with Gource for a cinematic-like experience</li>
<li>If you&#39;ve never heard of Gource, it&#39;s &quot;an OpenGL-based 3D visualization tool intended for visualizing activity on source control repositories&quot;</li>
<li>When you put all the tools together, you can end up with some pretty eye-catching animations of your firewall traffic</li>
<li>One of our listeners wrote in to say that he set this up and, almost immediately, noticed his girlfriend&#39;s phone had been compromised - graphical representations of traffic could be useful for detecting suspicious network activity
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=381573" rel="nofollow">pkgng 1.5.0 alpha1 released</a></h3>

<ul>
<li>The development version of pkgng was updated to 1.4.99.14, or 1.5.0 alpha1</li>
<li>This update introduces support for provides/requires, something that we&#39;ve been wanting for a long time</li>
<li>It will also now print which package is the reason for direct dependency change</li>
<li>Another interesting addition is the &quot;pkg -r&quot; switch, allowing cross installation of packages</li>
<li>Remember this isn&#39;t the stable version, so maybe don&#39;t upgrade to it just yet on any production systems</li>
<li>DragonFly will also likely pick up this update once it&#39;s marked stable
***</li>
</ul>

<h3><a href="http://devio.us/%7Ebcallah/rcos2015.pdf" rel="nofollow">Welcome to OpenBSD</a></h3>

<ul>
<li>We mentioned last week that our listener Brian was giving a talk in the Troy, New York area</li>
<li>The slides from that talk are now online, and they&#39;ve been generating quite a bit of <a href="https://news.ycombinator.com/item?id=9240533" rel="nofollow">discussion</a> <a href="https://www.reddit.com/r/openbsd/comments/2ztokc/welcome_to_openbsd/" rel="nofollow">online</a></li>
<li>It&#39;s simply titled &quot;Welcome to OpenBSD&quot; and gives the reader an introduction to the OS (and how easy it is to get involved with contributing)</li>
<li>Topics include a quick history of the project, who the developers are and what they do, some proactive security techniques and finally how to get involved</li>
<li>As you may know, NetBSD has almost 60 <a href="https://www.netbsd.org/ports/" rel="nofollow">supported platforms</a> and their slogan is &quot;<em>of course</em> it runs NetBSD&quot; - Brian says, with <a href="http://www.openbsd.org/plat.html" rel="nofollow">17 platforms</a> over 13 CPU architectures, &quot;it <em>probably</em> runs OpenBSD&quot;</li>
<li>No matter which BSD you might be interested in, these slides are a great read, especially for any beginners looking to get their feet wet</li>
<li>Try to guess which font he used...
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2015/03/bsdtalk252-devious-with-brian-callahan.html" rel="nofollow">BSDTalk episode 252</a></h3>

<ul>
<li>And somehow Brian has snuck himself into <em>another</em> news item this week</li>
<li>He makes an appearance in the latest episode of <a href="http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk" rel="nofollow">BSD Talk</a>, where he chats with Will about running a BSD-based shell provider</li>
<li>If that sounds familiar, it&#39;s probably because <a href="http://www.bsdnow.tv/episodes/2014_06_18-devious_methods" rel="nofollow">we did the same thing</a>, albeit with a different member of their team</li>
<li>In this interview, they discuss what a shell provider does, hardware requirements and how to weed out the spammers in favor of real people</li>
<li>They also talk a bit about the community aspect of a shared server, as opposed to just running a virtual machine by yourself
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2O81pixhq" rel="nofollow">Christian writes in</a></li>
<li><a href="http://slexy.org/view/s2dhr2WfVc" rel="nofollow">Stefan writes in</a></li>
<li><a href="http://slexy.org/view/s2Kisq2EqT" rel="nofollow">Possnfiffer writes in</a></li>
<li><a href="http://slexy.org/view/s2Xr0e5YAJ" rel="nofollow">Ruudsch writes in</a></li>
<li><a href="http://slexy.org/view/s2Xz7BNoJE" rel="nofollow">Shane writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-March/069679.html" rel="nofollow">Accidental support</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=142686812913221&w=2" rel="nofollow">Larry&#39;s tears</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-hardware/2015-March/007625.html" rel="nofollow">The boy who sailed with BSD</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>81: Puffy in a Box</title>
  <link>https://www.bsdnow.tv/81</link>
  <guid isPermaLink="false">a8a11e67-acad-44db-b8d9-840c53f401f9</guid>
  <pubDate>Wed, 18 Mar 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a8a11e67-acad-44db-b8d9-840c53f401f9.mp3" length="62032180" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We're back from AsiaBSDCon! This week on the show, we'll be talking to Lawrence Teo about how Calyptix uses OpenBSD in their line of commercial routers. They're getting BSD in the hands of Windows admins who don't even realize it. We also have all this week's news and answer to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:26:09</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We're back from AsiaBSDCon! This week on the show, we'll be talking to Lawrence Teo about how Calyptix uses OpenBSD in their line of commercial routers. They're getting BSD in the hands of Windows admins who don't even realize it. We also have all this week's news and answer to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Using OpenBGPD to distribute pf table updates (http://www.echothrust.com/blogs/using-openbgpd-distribute-pf-table-updates-your-servers)
For those not familiar, OpenBGPD (https://en.wikipedia.org/wiki/OpenBGPD) is a daemon for the Border Gateway Protocol (https://en.wikipedia.org/wiki/Border_Gateway_Protocol) - a way for routers on the internet to discover and exchange routes to different addresses
This post, inspired by a talk about using BGP to distribute spam lists (https://www.youtube.com/watch?v=Vet0eQB00X0), details how to use the protocol to distribute some other useful lists and information
It begins with "One of the challenges faced when managing our OpenBSD firewalls is the distribution of IPs to pf tables without manually modifying /etc/pf.conf on each of the firewalls every time. This task becomes quite tedious, specifically when you want to distribute different types of changes to different systems (eg administrative IPs to a firewall and spammer IPs to a mail server), or if you need to distribute real time blacklists to a large number of systems."
If you manage a lot of BSD boxes, this might be an interesting alternative to some of the other ways to distribute configuration files
OpenBGPD is part of the OpenBSD base system, but there's also an unofficial port to FreeBSD (https://www.freshports.org/net/openbgpd/) and a "work in progress" pkgsrc version (http://pkgsrc.se/wip/openbgpd)
***
Mounting removable media with autofs (http://freebsdfoundation.blogspot.com/2015/03/freebsd-from-trenches-using-autofs5-to_13.html)
The FreeBSD foundation has a new article in the "FreeBSD from the trenches" series, this time about the sponsored autofs (https://www.freebsd.org/cgi/man.cgi?query=autofs&amp;amp;sektion=5) tool
It's written by one of the autofs developers, and he details his work on creating and using the utility
"The purpose of autofs(5) is to mount filesystems on access, in a way that's transparent to the application. In other words, filesystems get mounted when they are first accessed, and then unmounted after some time passes."
He talks about all the components that need to work together for smooth operation, how to configure it and how to enable it by default for removable drives
It ends with a real-world example of something we're all probably familiar with: plugging in USB drives and watching the magic happen
There's also some more advanced bonus material on GEOM classes and all the more technical details
***
The Tor Browser on BSD (http://trac.haqistan.net/blog/adventures-ports-tor-browser)
The Tor Project has provided a "browser bundle (https://www.torproject.org/projects/torbrowser/design/)" for a long time, which is more or less a repackaged Firefox with many security and privacy-related settings preconfigured and some patches applied to the source
Just tunneling your browser through a transparent Tor proxy is not safe enough - many things can lead to passive fingerprinting or, even worse, anonymity being completely lost 
It has, however, only been released for Windows, OS X and Linux - no BSD version
"[...] we are pushing back against an emerging monoculture, and this is always a healthy thing. Monocultures are dangerous for many reasons, most importantly to themselves."
Some work has begun to get a working port on BSD going, and this document tells about the process and how it all got started
If you've got porting skills, or are interested in online privacy, any help would be appreciated of course (see the post for details on getting involved)
***
OpenSSH 6.8 released (https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-March/033686.html)
Continuing their "tick tock" pattern of releases alternating between new features and bugfixes, the OpenSSH team has released 6.8 - it's a major upgrade, focused on new features (we like those better of course)
Most of the codebase has gone through refactoring, making it easier for regression tests and improving the general readability
This release adds support for SHA256-hashed, base64-encoded host key fingerprints, as well as making that the default - a big step up from the previously hex-encoded MD5 fingerprints
Experimental host key rotation support also makes it debut, allowing for easy in-place upgrading of old keys to newer (or refreshed) keys
You can now require multiple, different public keys to be verified for a user to authenticate (useful if you're extra paranoid or don't have 100% confidence in any single key type)
The native version will be in OpenBSD 5.7, and the portable version should hit a ports tree near you soon
Speaking of the portable version, it now has a configure option to build without OpenSSL or LibreSSL, but doing so limits you to Ed25519 key types and ChaCha20 and AES-CTR ciphers
***
NetBSD at AsiaBSDCon (https://mail-index.netbsd.org/netbsd-advocacy/2015/03/15/msg000682.html)
The NetBSD guys already have a wrap-up of the recent event, complete with all the pictures and weird devices you'd expect
It covers their BoF session, the six NetBSD-related presentations and finally their "work in progress" session
There was a grand total of 34 different NetBSD gadgets (https://docs.google.com/spreadsheets/d/14q6zJK5PjlMoSeBV5HBiEik5LkqlrcrbSxPoxVKKlec/edit#gid=0) on display at the event
***
Interview - Lawrence Teo - lteo@openbsd.org (mailto:lteo@openbsd.org) / @lteo (https://twitter.com/lteo)
OpenBSD at Calyptix (http://www.nycbsdcon.org/2010/presentations/lteo-nycbsdcon2010.pdf)
News Roundup
HardenedBSD introduces Integriforce (http://hardenedbsd.org/article/shawn-webb/2015-03-11/call-testing-secadm-integriforce)
A little bit of background on this one first: NetBSD has something called veriexec (https://www.netbsd.org/docs/guide/en/chap-veriexec.html), used for checking file integrity (http://wiki.netbsd.org/guide/veriexec/) at the kernel level
By doing it at the kernel level, similar to securelevels (https://en.wikipedia.org/wiki/Securelevel), it offers some level of protection even when the root account is compromised
HardenedBSD has introduced a similar mechanism into their "secadm" utility
You can list binaries in the config file that you want to be protected from changes, then specify whether those can't be run (http://i.imgur.com/wHp2eAN.png) at all, or if they just print a warning
They're looking for some more extensive testing of this new feature
***
More s2k15 hackathon reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20150305100712&amp;amp;mode=flat)
A couple more Australian hackathon reports have poured in since the last time
The first comes from Jonathan Gray, who's done a lot of graphics-related work in OpenBSD recently
He worked on getting some newer "Southern Islands" and "Graphics Core Next" AMD GPUs working, as well as some OpenGL and DRM-related things
Also on his todo list was to continue hitting various parts of the tree with American Fuzzy Lop, which ended up fixing a few crashes in mandoc (http://www.bsdnow.tv/episodes/2014_11_12-a_mans_man)
Ted Unangst also sent in a report (http://undeadly.org/cgi?action=article&amp;amp;sid=20150307165135&amp;amp;mode=flat) to detail what he hacked on at the event
With a strong focus on improving SMP scalability, he tackled the virtual memory layer
His goal was to speed up some syscalls that are used heavily during code compilation, much of which will probably end up in 5.8
All the trip reports are much more detailed than our short summaries, so give them a read if you're interested in all the technicalities
***
DragonFly 4.0.4 and IPFW3 (https://www.dragonflydigest.com/2015/03/10/15733.html)
DragonFly BSD has put out a small point release to the 4.x branch, 4.0.4
It includes a minor list of fixes (http://lists.dragonflybsd.org/pipermail/commits/2015-March/418098.html), some of which include a HAMMER FS history fix, removing the no-longer-needed "new xorg" and "with kms" variables and a few LAGG fixes
There was also a bug in the installer that prevented the rescue image from being installed correctly, which also gets fixed in this version
Shortly after it was released, their new IPFW2 firewall was added to the tree (http://lists.dragonflybsd.org/pipermail/commits/2015-March/418133.html) and subsequently renamed to IPFW3 (http://lists.dragonflybsd.org/pipermail/commits/2015-March/418160.html) (since it's technically the third revision)
***
NetBSD gets Raspberry Pi 2 support (https://blog.netbsd.org/tnf/entry/raspberry_pi_2_support_added)
NetBSD has announced initial support for the second revision (http://www.raspberrypi.org/products/raspberry-pi-2-model-b/) of the ever-popular Raspberry Pi board
There are -current snapshots available for download, and multiprocessor support is also on the way
The NetBSD wiki page about the Raspberry Pi also has some more information (https://wiki.netbsd.org/ports/evbarm/raspberry_pi/) and an installation guide
The usual Hacker News discussion (https://news.ycombinator.com/item?id=9172100) on the subject
If anyone has one of these little boards, let us know - maybe write up a blog post about your experience with BSD on it
***
OpenIKED as a VPN gateway (http://puffysecurity.com/wiki/openikedoffshore.html)
In our first discussion segment, we talked about a few different ways to tunnel your traffic
While we've done full tutorials on things like SSH tunnels (http://www.bsdnow.tv/tutorials/stunnel), OpenVPN (http://www.bsdnow.tv/tutorials/openvpn) and Tor (http://www.bsdnow.tv/tutorials/tor), we haven't talked a whole lot about OpenBSD's IPSEC suite
This article should help fill that gap - it walks you through the complete IKED setup
From creating the public key infrastructure to configuring the firewall to configuring both the VPN server and client, this guide's got it all
***
Feedback/Questions
Gary writes in (http://slexy.org/view/s21G9TWALE)
Robert writes in (http://slexy.org/view/s206aZrxOi)
Joris writes in (http://slexy.org/view/s28Um5R7LG)
Mike writes in (http://slexy.org/view/s2yAJsl1Es)
Anders writes in (http://slexy.org/view/s21dMAE55M)
***
Mailing List Gold
Can you hear me now (https://www.marc.info/?l=openbsd-misc&amp;amp;m=142577632205484&amp;amp;w=2)
He must be GNU here (https://lists.freebsd.org/pipermail/freebsd-hackers/2015-March/047207.html)
I've seen some... (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142593175408756&amp;amp;w=2)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, calyptix, router, gateway, pfsense, opnsense, smb, asiabsdcon, 2015, openbgpd, openiked, hardenedbsd, tor, vpn, autofs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;re back from AsiaBSDCon! This week on the show, we&#39;ll be talking to Lawrence Teo about how Calyptix uses OpenBSD in their line of commercial routers. They&#39;re getting BSD in the hands of Windows admins who don&#39;t even realize it. We also have all this week&#39;s news and answer to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.echothrust.com/blogs/using-openbgpd-distribute-pf-table-updates-your-servers" rel="nofollow">Using OpenBGPD to distribute pf table updates</a></h3>

<ul>
<li>For those not familiar, <a href="https://en.wikipedia.org/wiki/OpenBGPD" rel="nofollow">OpenBGPD</a> is a daemon for the <a href="https://en.wikipedia.org/wiki/Border_Gateway_Protocol" rel="nofollow">Border Gateway Protocol</a> - a way for routers on the internet to discover and exchange routes to different addresses</li>
<li>This post, inspired by <a href="https://www.youtube.com/watch?v=Vet0eQB00X0" rel="nofollow">a talk about using BGP to distribute spam lists</a>, details how to use the protocol to distribute some other useful lists and information</li>
<li>It begins with &quot;One of the challenges faced when managing our OpenBSD firewalls is the distribution of IPs to pf tables without manually modifying /etc/pf.conf on each of the firewalls every time. This task becomes quite tedious, specifically when you want to distribute different types of changes to different systems (eg administrative IPs to a firewall and spammer IPs to a mail server), or if you need to distribute real time blacklists to a large number of systems.&quot;</li>
<li>If you manage a lot of BSD boxes, this might be an interesting alternative to some of the other ways to distribute configuration files</li>
<li>OpenBGPD is part of the OpenBSD base system, but there&#39;s also an unofficial port <a href="https://www.freshports.org/net/openbgpd/" rel="nofollow">to FreeBSD</a> and a &quot;work in progress&quot; <a href="http://pkgsrc.se/wip/openbgpd" rel="nofollow">pkgsrc version</a>
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/03/freebsd-from-trenches-using-autofs5-to_13.html" rel="nofollow">Mounting removable media with autofs</a></h3>

<ul>
<li>The FreeBSD foundation has a new article in the &quot;FreeBSD from the trenches&quot; series, this time about the sponsored <a href="https://www.freebsd.org/cgi/man.cgi?query=autofs&sektion=5" rel="nofollow">autofs</a> tool</li>
<li>It&#39;s written by one of the autofs developers, and he details his work on creating and using the utility</li>
<li>&quot;The purpose of autofs(5) is to mount filesystems on access, in a way that&#39;s transparent to the application. In other words, filesystems get mounted when they are first accessed, and then unmounted after some time passes.&quot;</li>
<li>He talks about all the components that need to work together for smooth operation, how to configure it and how to enable it by default for removable drives</li>
<li>It ends with a real-world example of something we&#39;re all probably familiar with: plugging in USB drives and watching the magic happen</li>
<li>There&#39;s also some more advanced bonus material on GEOM classes and all the more technical details
***</li>
</ul>

<h3><a href="http://trac.haqistan.net/blog/adventures-ports-tor-browser" rel="nofollow">The Tor Browser on BSD</a></h3>

<ul>
<li>The Tor Project has provided a &quot;<a href="https://www.torproject.org/projects/torbrowser/design/" rel="nofollow">browser bundle</a>&quot; for a long time, which is more or less a repackaged Firefox with many security and privacy-related settings preconfigured and some patches applied to the source</li>
<li>Just tunneling your browser through a transparent Tor proxy is not safe enough - many things can lead to passive fingerprinting or, even worse, anonymity being completely lost </li>
<li>It has, however, only been released for Windows, OS X and Linux - no BSD version</li>
<li>&quot;[...] we are pushing back against an emerging monoculture, and this is always a healthy thing. Monocultures are dangerous for many reasons, most importantly to themselves.&quot;</li>
<li>Some work has begun to get a working port on BSD going, and this document tells about the process and how it all got started</li>
<li>If you&#39;ve got porting skills, or are interested in online privacy, any help would be appreciated of course (see the post for details on getting involved)
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-March/033686.html" rel="nofollow">OpenSSH 6.8 released</a></h3>

<ul>
<li>Continuing their &quot;tick tock&quot; pattern of releases alternating between new features and bugfixes, the OpenSSH team has released 6.8 - it&#39;s a major upgrade, focused on new features (we like those better of course)</li>
<li>Most of the codebase has gone through refactoring, making it easier for regression tests and improving the general readability</li>
<li>This release adds support for SHA256-hashed, base64-encoded host key fingerprints, as well as making that the default - a big step up from the previously hex-encoded MD5 fingerprints</li>
<li>Experimental host key rotation support also makes it debut, allowing for easy in-place upgrading of old keys to newer (or refreshed) keys</li>
<li>You can now require multiple, different public keys to be verified for a user to authenticate (useful if you&#39;re extra paranoid or don&#39;t have 100% confidence in any single key type)</li>
<li>The native version will be in OpenBSD 5.7, and the portable version should hit a ports tree near you soon</li>
<li>Speaking of the portable version, it now has a configure option to build without OpenSSL or LibreSSL, but doing so limits you to Ed25519 key types and ChaCha20 and AES-CTR ciphers
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/03/15/msg000682.html" rel="nofollow">NetBSD at AsiaBSDCon</a></h3>

<ul>
<li>The NetBSD guys already have a wrap-up of the recent event, complete with all the pictures and weird devices you&#39;d expect</li>
<li>It covers their BoF session, the six NetBSD-related presentations and finally their &quot;work in progress&quot; session</li>
<li>There was a grand total of <a href="https://docs.google.com/spreadsheets/d/14q6zJK5PjlMoSeBV5HBiEik5LkqlrcrbSxPoxVKKlec/edit#gid=0" rel="nofollow">34 different NetBSD gadgets</a> on display at the event
***</li>
</ul>

<h2>Interview - Lawrence Teo - <a href="mailto:lteo@openbsd.org" rel="nofollow">lteo@openbsd.org</a> / <a href="https://twitter.com/lteo" rel="nofollow">@lteo</a></h2>

<p>OpenBSD <a href="http://www.nycbsdcon.org/2010/presentations/lteo-nycbsdcon2010.pdf" rel="nofollow">at Calyptix</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://hardenedbsd.org/article/shawn-webb/2015-03-11/call-testing-secadm-integriforce" rel="nofollow">HardenedBSD introduces Integriforce</a></h3>

<ul>
<li>A little bit of background on this one first: NetBSD has something called <a href="https://www.netbsd.org/docs/guide/en/chap-veriexec.html" rel="nofollow">veriexec</a>, used for <a href="http://wiki.netbsd.org/guide/veriexec/" rel="nofollow">checking file integrity</a> at the kernel level</li>
<li>By doing it at the kernel level, similar to <a href="https://en.wikipedia.org/wiki/Securelevel" rel="nofollow">securelevels</a>, it offers some level of protection even when the root account is compromised</li>
<li>HardenedBSD has introduced a similar mechanism into their &quot;secadm&quot; utility</li>
<li>You can list binaries in the config file that you want to be protected from changes, then specify whether those <a href="http://i.imgur.com/wHp2eAN.png" rel="nofollow">can&#39;t be run</a> at all, or if they just print a warning</li>
<li>They&#39;re looking for some more extensive testing of this new feature
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150305100712&mode=flat" rel="nofollow">More s2k15 hackathon reports</a></h3>

<ul>
<li>A couple more Australian hackathon reports have poured in since the last time</li>
<li>The first comes from Jonathan Gray, who&#39;s done a lot of graphics-related work in OpenBSD recently</li>
<li>He worked on getting some newer &quot;Southern Islands&quot; and &quot;Graphics Core Next&quot; AMD GPUs working, as well as some OpenGL and DRM-related things</li>
<li>Also on his todo list was to continue hitting various parts of the tree with American Fuzzy Lop, which ended up fixing a few crashes in <a href="http://www.bsdnow.tv/episodes/2014_11_12-a_mans_man" rel="nofollow">mandoc</a></li>
<li>Ted Unangst also <a href="http://undeadly.org/cgi?action=article&sid=20150307165135&mode=flat" rel="nofollow">sent in a report</a> to detail what he hacked on at the event</li>
<li>With a strong focus on improving SMP scalability, he tackled the virtual memory layer</li>
<li>His goal was to speed up some syscalls that are used heavily during code compilation, much of which will probably end up in 5.8</li>
<li>All the trip reports are <strong>much</strong> more detailed than our short summaries, so give them a read if you&#39;re interested in all the technicalities
***</li>
</ul>

<h3><a href="https://www.dragonflydigest.com/2015/03/10/15733.html" rel="nofollow">DragonFly 4.0.4 and IPFW3</a></h3>

<ul>
<li>DragonFly BSD has put out a small point release to the 4.x branch, 4.0.4</li>
<li>It includes a minor <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-March/418098.html" rel="nofollow">list of fixes</a>, some of which include a HAMMER FS history fix, removing the no-longer-needed &quot;new xorg&quot; and &quot;with kms&quot; variables and a few LAGG fixes</li>
<li>There was also a bug in the installer that prevented the rescue image from being installed correctly, which also gets fixed in this version</li>
<li>Shortly after it was released, their new IPFW2 firewall was <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-March/418133.html" rel="nofollow">added to the tree</a> and subsequently renamed to <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-March/418160.html" rel="nofollow">IPFW3</a> (since it&#39;s technically the third revision)
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/raspberry_pi_2_support_added" rel="nofollow">NetBSD gets Raspberry Pi 2 support</a></h3>

<ul>
<li>NetBSD has announced initial support for the <a href="http://www.raspberrypi.org/products/raspberry-pi-2-model-b/" rel="nofollow">second revision</a> of the ever-popular Raspberry Pi board</li>
<li>There are -current snapshots available for download, and multiprocessor support is also on the way</li>
<li>The NetBSD wiki page about the Raspberry Pi also has some <a href="https://wiki.netbsd.org/ports/evbarm/raspberry_pi/" rel="nofollow">more information</a> and an installation guide</li>
<li>The usual <a href="https://news.ycombinator.com/item?id=9172100" rel="nofollow">Hacker News discussion</a> on the subject</li>
<li>If anyone has one of these little boards, let us know - maybe write up a blog post about your experience with BSD on it
***</li>
</ul>

<h3><a href="http://puffysecurity.com/wiki/openikedoffshore.html" rel="nofollow">OpenIKED as a VPN gateway</a></h3>

<ul>
<li>In our first discussion segment, we talked about a few different ways to tunnel your traffic</li>
<li>While we&#39;ve done full tutorials on things like <a href="http://www.bsdnow.tv/tutorials/stunnel" rel="nofollow">SSH tunnels</a>, <a href="http://www.bsdnow.tv/tutorials/openvpn" rel="nofollow">OpenVPN</a> and <a href="http://www.bsdnow.tv/tutorials/tor" rel="nofollow">Tor</a>, we haven&#39;t talked a whole lot about OpenBSD&#39;s IPSEC suite</li>
<li>This article should help fill that gap - it walks you through the complete IKED setup</li>
<li>From creating the public key infrastructure to configuring the firewall to configuring both the VPN server and client, this guide&#39;s got it all
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21G9TWALE" rel="nofollow">Gary writes in</a></li>
<li><a href="http://slexy.org/view/s206aZrxOi" rel="nofollow">Robert writes in</a></li>
<li><a href="http://slexy.org/view/s28Um5R7LG" rel="nofollow">Joris writes in</a></li>
<li><a href="http://slexy.org/view/s2yAJsl1Es" rel="nofollow">Mike writes in</a></li>
<li><a href="http://slexy.org/view/s21dMAE55M" rel="nofollow">Anders writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-misc&m=142577632205484&w=2" rel="nofollow">Can you hear me now</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2015-March/047207.html" rel="nofollow">He must be GNU here</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=142593175408756&w=2" rel="nofollow">I&#39;ve seen some...</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;re back from AsiaBSDCon! This week on the show, we&#39;ll be talking to Lawrence Teo about how Calyptix uses OpenBSD in their line of commercial routers. They&#39;re getting BSD in the hands of Windows admins who don&#39;t even realize it. We also have all this week&#39;s news and answer to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.echothrust.com/blogs/using-openbgpd-distribute-pf-table-updates-your-servers" rel="nofollow">Using OpenBGPD to distribute pf table updates</a></h3>

<ul>
<li>For those not familiar, <a href="https://en.wikipedia.org/wiki/OpenBGPD" rel="nofollow">OpenBGPD</a> is a daemon for the <a href="https://en.wikipedia.org/wiki/Border_Gateway_Protocol" rel="nofollow">Border Gateway Protocol</a> - a way for routers on the internet to discover and exchange routes to different addresses</li>
<li>This post, inspired by <a href="https://www.youtube.com/watch?v=Vet0eQB00X0" rel="nofollow">a talk about using BGP to distribute spam lists</a>, details how to use the protocol to distribute some other useful lists and information</li>
<li>It begins with &quot;One of the challenges faced when managing our OpenBSD firewalls is the distribution of IPs to pf tables without manually modifying /etc/pf.conf on each of the firewalls every time. This task becomes quite tedious, specifically when you want to distribute different types of changes to different systems (eg administrative IPs to a firewall and spammer IPs to a mail server), or if you need to distribute real time blacklists to a large number of systems.&quot;</li>
<li>If you manage a lot of BSD boxes, this might be an interesting alternative to some of the other ways to distribute configuration files</li>
<li>OpenBGPD is part of the OpenBSD base system, but there&#39;s also an unofficial port <a href="https://www.freshports.org/net/openbgpd/" rel="nofollow">to FreeBSD</a> and a &quot;work in progress&quot; <a href="http://pkgsrc.se/wip/openbgpd" rel="nofollow">pkgsrc version</a>
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2015/03/freebsd-from-trenches-using-autofs5-to_13.html" rel="nofollow">Mounting removable media with autofs</a></h3>

<ul>
<li>The FreeBSD foundation has a new article in the &quot;FreeBSD from the trenches&quot; series, this time about the sponsored <a href="https://www.freebsd.org/cgi/man.cgi?query=autofs&sektion=5" rel="nofollow">autofs</a> tool</li>
<li>It&#39;s written by one of the autofs developers, and he details his work on creating and using the utility</li>
<li>&quot;The purpose of autofs(5) is to mount filesystems on access, in a way that&#39;s transparent to the application. In other words, filesystems get mounted when they are first accessed, and then unmounted after some time passes.&quot;</li>
<li>He talks about all the components that need to work together for smooth operation, how to configure it and how to enable it by default for removable drives</li>
<li>It ends with a real-world example of something we&#39;re all probably familiar with: plugging in USB drives and watching the magic happen</li>
<li>There&#39;s also some more advanced bonus material on GEOM classes and all the more technical details
***</li>
</ul>

<h3><a href="http://trac.haqistan.net/blog/adventures-ports-tor-browser" rel="nofollow">The Tor Browser on BSD</a></h3>

<ul>
<li>The Tor Project has provided a &quot;<a href="https://www.torproject.org/projects/torbrowser/design/" rel="nofollow">browser bundle</a>&quot; for a long time, which is more or less a repackaged Firefox with many security and privacy-related settings preconfigured and some patches applied to the source</li>
<li>Just tunneling your browser through a transparent Tor proxy is not safe enough - many things can lead to passive fingerprinting or, even worse, anonymity being completely lost </li>
<li>It has, however, only been released for Windows, OS X and Linux - no BSD version</li>
<li>&quot;[...] we are pushing back against an emerging monoculture, and this is always a healthy thing. Monocultures are dangerous for many reasons, most importantly to themselves.&quot;</li>
<li>Some work has begun to get a working port on BSD going, and this document tells about the process and how it all got started</li>
<li>If you&#39;ve got porting skills, or are interested in online privacy, any help would be appreciated of course (see the post for details on getting involved)
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2015-March/033686.html" rel="nofollow">OpenSSH 6.8 released</a></h3>

<ul>
<li>Continuing their &quot;tick tock&quot; pattern of releases alternating between new features and bugfixes, the OpenSSH team has released 6.8 - it&#39;s a major upgrade, focused on new features (we like those better of course)</li>
<li>Most of the codebase has gone through refactoring, making it easier for regression tests and improving the general readability</li>
<li>This release adds support for SHA256-hashed, base64-encoded host key fingerprints, as well as making that the default - a big step up from the previously hex-encoded MD5 fingerprints</li>
<li>Experimental host key rotation support also makes it debut, allowing for easy in-place upgrading of old keys to newer (or refreshed) keys</li>
<li>You can now require multiple, different public keys to be verified for a user to authenticate (useful if you&#39;re extra paranoid or don&#39;t have 100% confidence in any single key type)</li>
<li>The native version will be in OpenBSD 5.7, and the portable version should hit a ports tree near you soon</li>
<li>Speaking of the portable version, it now has a configure option to build without OpenSSL or LibreSSL, but doing so limits you to Ed25519 key types and ChaCha20 and AES-CTR ciphers
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/03/15/msg000682.html" rel="nofollow">NetBSD at AsiaBSDCon</a></h3>

<ul>
<li>The NetBSD guys already have a wrap-up of the recent event, complete with all the pictures and weird devices you&#39;d expect</li>
<li>It covers their BoF session, the six NetBSD-related presentations and finally their &quot;work in progress&quot; session</li>
<li>There was a grand total of <a href="https://docs.google.com/spreadsheets/d/14q6zJK5PjlMoSeBV5HBiEik5LkqlrcrbSxPoxVKKlec/edit#gid=0" rel="nofollow">34 different NetBSD gadgets</a> on display at the event
***</li>
</ul>

<h2>Interview - Lawrence Teo - <a href="mailto:lteo@openbsd.org" rel="nofollow">lteo@openbsd.org</a> / <a href="https://twitter.com/lteo" rel="nofollow">@lteo</a></h2>

<p>OpenBSD <a href="http://www.nycbsdcon.org/2010/presentations/lteo-nycbsdcon2010.pdf" rel="nofollow">at Calyptix</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://hardenedbsd.org/article/shawn-webb/2015-03-11/call-testing-secadm-integriforce" rel="nofollow">HardenedBSD introduces Integriforce</a></h3>

<ul>
<li>A little bit of background on this one first: NetBSD has something called <a href="https://www.netbsd.org/docs/guide/en/chap-veriexec.html" rel="nofollow">veriexec</a>, used for <a href="http://wiki.netbsd.org/guide/veriexec/" rel="nofollow">checking file integrity</a> at the kernel level</li>
<li>By doing it at the kernel level, similar to <a href="https://en.wikipedia.org/wiki/Securelevel" rel="nofollow">securelevels</a>, it offers some level of protection even when the root account is compromised</li>
<li>HardenedBSD has introduced a similar mechanism into their &quot;secadm&quot; utility</li>
<li>You can list binaries in the config file that you want to be protected from changes, then specify whether those <a href="http://i.imgur.com/wHp2eAN.png" rel="nofollow">can&#39;t be run</a> at all, or if they just print a warning</li>
<li>They&#39;re looking for some more extensive testing of this new feature
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150305100712&mode=flat" rel="nofollow">More s2k15 hackathon reports</a></h3>

<ul>
<li>A couple more Australian hackathon reports have poured in since the last time</li>
<li>The first comes from Jonathan Gray, who&#39;s done a lot of graphics-related work in OpenBSD recently</li>
<li>He worked on getting some newer &quot;Southern Islands&quot; and &quot;Graphics Core Next&quot; AMD GPUs working, as well as some OpenGL and DRM-related things</li>
<li>Also on his todo list was to continue hitting various parts of the tree with American Fuzzy Lop, which ended up fixing a few crashes in <a href="http://www.bsdnow.tv/episodes/2014_11_12-a_mans_man" rel="nofollow">mandoc</a></li>
<li>Ted Unangst also <a href="http://undeadly.org/cgi?action=article&sid=20150307165135&mode=flat" rel="nofollow">sent in a report</a> to detail what he hacked on at the event</li>
<li>With a strong focus on improving SMP scalability, he tackled the virtual memory layer</li>
<li>His goal was to speed up some syscalls that are used heavily during code compilation, much of which will probably end up in 5.8</li>
<li>All the trip reports are <strong>much</strong> more detailed than our short summaries, so give them a read if you&#39;re interested in all the technicalities
***</li>
</ul>

<h3><a href="https://www.dragonflydigest.com/2015/03/10/15733.html" rel="nofollow">DragonFly 4.0.4 and IPFW3</a></h3>

<ul>
<li>DragonFly BSD has put out a small point release to the 4.x branch, 4.0.4</li>
<li>It includes a minor <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-March/418098.html" rel="nofollow">list of fixes</a>, some of which include a HAMMER FS history fix, removing the no-longer-needed &quot;new xorg&quot; and &quot;with kms&quot; variables and a few LAGG fixes</li>
<li>There was also a bug in the installer that prevented the rescue image from being installed correctly, which also gets fixed in this version</li>
<li>Shortly after it was released, their new IPFW2 firewall was <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-March/418133.html" rel="nofollow">added to the tree</a> and subsequently renamed to <a href="http://lists.dragonflybsd.org/pipermail/commits/2015-March/418160.html" rel="nofollow">IPFW3</a> (since it&#39;s technically the third revision)
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/raspberry_pi_2_support_added" rel="nofollow">NetBSD gets Raspberry Pi 2 support</a></h3>

<ul>
<li>NetBSD has announced initial support for the <a href="http://www.raspberrypi.org/products/raspberry-pi-2-model-b/" rel="nofollow">second revision</a> of the ever-popular Raspberry Pi board</li>
<li>There are -current snapshots available for download, and multiprocessor support is also on the way</li>
<li>The NetBSD wiki page about the Raspberry Pi also has some <a href="https://wiki.netbsd.org/ports/evbarm/raspberry_pi/" rel="nofollow">more information</a> and an installation guide</li>
<li>The usual <a href="https://news.ycombinator.com/item?id=9172100" rel="nofollow">Hacker News discussion</a> on the subject</li>
<li>If anyone has one of these little boards, let us know - maybe write up a blog post about your experience with BSD on it
***</li>
</ul>

<h3><a href="http://puffysecurity.com/wiki/openikedoffshore.html" rel="nofollow">OpenIKED as a VPN gateway</a></h3>

<ul>
<li>In our first discussion segment, we talked about a few different ways to tunnel your traffic</li>
<li>While we&#39;ve done full tutorials on things like <a href="http://www.bsdnow.tv/tutorials/stunnel" rel="nofollow">SSH tunnels</a>, <a href="http://www.bsdnow.tv/tutorials/openvpn" rel="nofollow">OpenVPN</a> and <a href="http://www.bsdnow.tv/tutorials/tor" rel="nofollow">Tor</a>, we haven&#39;t talked a whole lot about OpenBSD&#39;s IPSEC suite</li>
<li>This article should help fill that gap - it walks you through the complete IKED setup</li>
<li>From creating the public key infrastructure to configuring the firewall to configuring both the VPN server and client, this guide&#39;s got it all
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21G9TWALE" rel="nofollow">Gary writes in</a></li>
<li><a href="http://slexy.org/view/s206aZrxOi" rel="nofollow">Robert writes in</a></li>
<li><a href="http://slexy.org/view/s28Um5R7LG" rel="nofollow">Joris writes in</a></li>
<li><a href="http://slexy.org/view/s2yAJsl1Es" rel="nofollow">Mike writes in</a></li>
<li><a href="http://slexy.org/view/s21dMAE55M" rel="nofollow">Anders writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-misc&m=142577632205484&w=2" rel="nofollow">Can you hear me now</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2015-March/047207.html" rel="nofollow">He must be GNU here</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=142593175408756&w=2" rel="nofollow">I&#39;ve seen some...</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>80: The PC-BSD Tour II</title>
  <link>https://www.bsdnow.tv/80</link>
  <guid isPermaLink="false">42370236-9013-44ce-882f-6e1b829bbca8</guid>
  <pubDate>Wed, 11 Mar 2015 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/42370236-9013-44ce-882f-6e1b829bbca8.mp3" length="57728596" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We're away at AsiaBSDCon this week, but we've still got a packed episode for you. First up is a sequel to the "PC-BSD tour" segment from a while back, highlighting how ZFS boot environments work. After that, Justin Gibbs joins us to talk about the FreeBSD foundation's 15th anniversary. We'll return next week with a normal episode of BSD Now - which is of course, the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:20:10</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We're away at AsiaBSDCon this week, but we've still got a packed episode for you. First up is a sequel to the "PC-BSD tour" segment from a while back, highlighting how ZFS boot environments work. After that, Justin Gibbs joins us to talk about the FreeBSD foundation's 15th anniversary. We'll return next week with a normal episode of BSD Now - which is of course, the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Special segment
Demystifying Boot Environments in PC-BSD
Interview - Justin Gibbs - gibbs@freebsd.org (mailto:gibbs@freebsd.org) / @freebsdfndation (https://twitter.com/freebsdfndation)
The FreeBSD foundation's 15th anniversary
Discussion
The story of PC-BSD
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, asiabsdcon, 2015, freebsd foundation, president, anniversary, walkthrough, tour, guide, pkgng, boot environments, zfs</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;re away at AsiaBSDCon this week, but we&#39;ve still got a packed episode for you. First up is a sequel to the &quot;PC-BSD tour&quot; segment from a while back, highlighting how ZFS boot environments work. After that, Justin Gibbs joins us to talk about the FreeBSD foundation&#39;s 15th anniversary. We&#39;ll return next week with a normal episode of BSD Now - which is of course, the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Special segment</h2>

<p>Demystifying Boot Environments in PC-BSD</p>

<hr>

<h2>Interview - Justin Gibbs - <a href="mailto:gibbs@freebsd.org" rel="nofollow">gibbs@freebsd.org</a> / <a href="https://twitter.com/freebsdfndation" rel="nofollow">@freebsdfndation</a></h2>

<p>The FreeBSD foundation&#39;s 15th anniversary</p>

<hr>

<h2>Discussion</h2>

<p>The story of PC-BSD</p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;re away at AsiaBSDCon this week, but we&#39;ve still got a packed episode for you. First up is a sequel to the &quot;PC-BSD tour&quot; segment from a while back, highlighting how ZFS boot environments work. After that, Justin Gibbs joins us to talk about the FreeBSD foundation&#39;s 15th anniversary. We&#39;ll return next week with a normal episode of BSD Now - which is of course, the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Special segment</h2>

<p>Demystifying Boot Environments in PC-BSD</p>

<hr>

<h2>Interview - Justin Gibbs - <a href="mailto:gibbs@freebsd.org" rel="nofollow">gibbs@freebsd.org</a> / <a href="https://twitter.com/freebsdfndation" rel="nofollow">@freebsdfndation</a></h2>

<p>The FreeBSD foundation&#39;s 15th anniversary</p>

<hr>

<h2>Discussion</h2>

<p>The story of PC-BSD</p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>79: Just Add QEMU</title>
  <link>https://www.bsdnow.tv/79</link>
  <guid isPermaLink="false">cb3fc5ef-1795-4d76-8b42-56a205255a03</guid>
  <pubDate>Wed, 04 Mar 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cb3fc5ef-1795-4d76-8b42-56a205255a03.mp3" length="60830644" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this time on the show, we'll be talking to Sean Bruno. He's been using poudriere and QEMU to cross compile binary packages, and has some interesting stories to tell about it. We've also got answers to viewer-submitted questions and all this week's news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:24:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this time on the show, we'll be talking to Sean Bruno. He's been using poudriere and QEMU to cross compile binary packages, and has some interesting stories to tell about it. We've also got answers to viewer-submitted questions and all this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
AsiaBSDCon 2015 schedule (http://2015.asiabsdcon.org/timetable.html.en)
Almost immediately after we finished recording an episode last week, the 2015 AsiaBSDCon schedule went up
This year's conference will be between 12-15 March at the Tokyo University of Science in Japan
The first and second days are for tutorials, as well as the developer summit and vendor summit
Days four and five are the main event with the presentations, which Kris and Allan both made the cut for once again
Not counting the ones that have yet to be revealed (as of the day we're recording this), there will be thirty-six different talks in all - four BSD-neutral, four NetBSD, six OpenBSD and twenty-two FreeBSD
Summaries of all the presentations are on the timetable page if you scroll down a bit
***
FreeBSD foundation updates and more (https://www.freebsdfoundation.org/press/2015febupdate.pdf)
The FreeBSD foundation (http://www.bsdnow.tv/episodes/2015_02_04-from_the_foundation_1) has posted a number of things this week, the first of which is their February 2015 status update
It provides some updates on the funded projects, including PCI express hotplugging and FreeBSD on the POWER8 platform
There's a FOSDEM recap and another update of their fundraising goal for 2015
They also have two new blog posts: a trip report from SCALE13x (http://freebsdfoundation.blogspot.com/2015/02/scale-13x-trip-report-michael-dexter.html) and a featured "FreeBSD in the trenches (http://freebsdfoundation.blogspot.com/2015/02/freebsd-from-trenches-zfs-and-how-to.html)" article about how a small typo caused a lot of ZFS chaos in the cluster
"Then panic ensued.  The machine didn't panic -- I did."
***
OpenBSD improves browser security (https://www.marc.info/?l=openbsd-misc&amp;amp;m=142523501726732&amp;amp;w=2)
No matter what OS you run on your desktop, the most likely entry point for an exploit these days is almost certainly the web browser
Ted Unangst writes in to the OpenBSD misc list to introduce a new project he's working on, simply titled "improving browser security"
He gives some background on the W^X memory protection (https://en.wikipedia.org/wiki/W%5EX) in the base system, but also mentions that some applications in ports don't adhere to it
For it to be enforced globally instead of just recommended, at least one browser (or specifically, one JIT (https://en.wikipedia.org/wiki/Just-in-time_compilation) engine) needs to be fixed to use it
"A system that is 'all W^X except where it's not' is the same as a system that's not W^X. We've worked hard to provide a secure foundation for programs; we'd like to see them take advantage of it."
The work is being supported by the OpenBSD foundation (http://www.bsdnow.tv/episodes/2015_02_25-from_the_foundation_2), and we'll keep you updated on this undertaking as more news about it is released
There's also some discussion on Hacker News (https://news.ycombinator.com/item?id=9128360) and Undeadly (http://undeadly.org/cgi?action=article&amp;amp;sid=20150303075848&amp;amp;mode=expanded) about it
***
NetBSD at Open Source Conference 2015 Tokyo (https://mail-index.netbsd.org/netbsd-advocacy/2015/02/28/msg000680.html)
The Japanese NetBSD users group has once again invaded a conference, this time in Tokyo
There's even a spreadsheet (https://docs.google.com/spreadsheets/d/1DTJbESfnOUgOiVkFG8vsrxTq6oCGRpf8PkRcMkhWYWQ/edit#gid=0) of all the different platforms they were showing off at the booth (mostly ARM, MIPS, PowerPC and Landisk this time around)
If you just can't get enough strange devices running BSD, check the mailing list post for lots of pictures
Their next target is, as you might guess, AsiaBSDCon 2015 - maybe we'll run into them
***
Interview - Sean Bruno - sbruno@freebsd.org (mailto:sbruno@freebsd.org) / @franknbeans (https://twitter.com/franknbeans)
Cross-compiling packages with poudriere (http://www.bsdnow.tv/tutorials/poudriere) and QEMU
News Roundup
The Crypto Bone (http://crypto-bone.com/what.html)
The Crypto Bone is a new device (http://www.crypto-bone.com/) that's aimed at making encryption and secure communications easier (http://crypto-bone.com/cbb-usersview.html) and more accessible
Under the hood, it's actually just a Beaglebone (http://beagleboard.org/bone) board, running stock OpenBSD with a few extra packages
It includes a web interface (http://crypto-bone.com/release/root/var/www/apache/html/) for configuring keys and secure tunnels
The source code (http://crypto-bone.com/release/root/) is freely available for anyone interested in hacking on it (or auditing the crypto), and there's a technical overview (http://crypto-bone.com/cbb-technicalview.html) of how everything works on their site
If you don't want to teach your mom how to use PGP, buy her one of these(?)
***
BSD in the 2015 Google Summer of Code (https://www.google-melange.com/gsoc/document/show/gsoc_program/google/gsoc2015/about_page)
For those who don't know, GSoC is a way for students to get paid to work on a coding project for an open source organization
Good news: both FreeBSD and OpenBSD were accepted (https://www.google-melange.com/gsoc/org/list/public/google/gsoc2015) for the 2015 event
FreeBSD has a wiki page (https://wiki.freebsd.org/SummerOfCodeIdeas) of ideas for people to work on
OpenBSD also has an ideas page (http://www.openbsdfoundation.org/gsoc2015.html) where you can see some of the initial things that might be interesting
If you're a student looking to get involved with BSD development, this might be a great opportunity to even get paid to do it
Who knows, you may even end up on the show (http://www.bsdnow.tv/episodes/2015_01_07-system_disaster) if you work on a cool project
GSoC will be accepting idea proposals starting March 16th, so you have some time to think about what you'd like to hack on
***
pfSense 2.3 roadmap (https://blog.pfsense.org/?p=1588)
The pfSense team has posted a new blog entry, detailing some of their plans for future versions
PPTP will finally be deprecated, PHP will be updated to 5.6 and other packages will also get updated to newer versions
PBIs are scheduled to be replaced with native pkgng packages
Version 3.0, something coming much later, will be a major rewrite that gets rid of PHP entirely
Their ultimate goal is for pfSense to be a package you can install atop of a regular FreeBSD install, rather than a repackaged distribution
***
PCBSD 10.1.2 security features (http://blog.pcbsd.org/2015/03/a-look-at-the-upcoming-features-for-10-1-2/)
PCBSD 10.1.2 will include a number of cool security features, some of which are detailed in a new blog post
A new "personacrypt" utility is introduced, which allows for easy encryption and management of external drives for your home directory
Going along with this, it also has a "stealth mode" that allows for one-time temporary home directories (but it doesn't self-destruct, don't worry)
The LibreSSL integration also continues, and now packages will be built with it by default
If you're using the Life Preserver utility for backups, it will encrypt the remote copy of your files in the next update
They've also been working on introducing some new options to enable tunneling your traffic through Tor
There will now be a fully-transparent proxy option that utilizes the switch to IPFW we mentioned last week
A small disclaimer: remember that many things can expose your true IP when using Tor, so use this option at your own risk if you require full anonymity
Look forward to Kris wearing a Tor shirt (https://www.torproject.org/getinvolved/tshirt.html) in future episodes
***
Feedback/Questions
Antonio writes in (http://slexy.org/view/s2ofBPRT5n)
Chris writes in (http://slexy.org/view/s26LsYcoJF)
Van writes in (http://slexy.org/view/s28Rho0jvL)
Stu writes in (http://slexy.org/view/s21AkGbniU)
***
Mailing List Gold
H (https://lists.freebsd.org/pipermail/freebsd-ports/2015-February/098183.html)
Pay up, mister Free (https://lists.freebsd.org/pipermail/freebsd-chat/2015-February/007024.html)
Heritage protected (https://www.mail-archive.com/tech%40openbsd.org/msg22663.html)
Blind leading the blind (https://lists.freebsd.org/pipermail/freebsd-questions/2015-February/264466.html)
What are the chances (https://lists.freebsd.org/pipermail/svn-src-head/2015-February/068682.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, qemu, mips, arm, poudriere, packages, scale13x, asiabsdcon 2015, tor, tails, w^m, browser, exploit</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this time on the show, we&#39;ll be talking to Sean Bruno. He&#39;s been using poudriere and QEMU to cross compile binary packages, and has some interesting stories to tell about it. We&#39;ve also got answers to viewer-submitted questions and all this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2015.asiabsdcon.org/timetable.html.en" rel="nofollow">AsiaBSDCon 2015 schedule</a></h3>

<ul>
<li>Almost immediately after we finished recording an episode last week, the 2015 AsiaBSDCon schedule went up</li>
<li>This year&#39;s conference will be between 12-15 March at the Tokyo University of Science in Japan</li>
<li>The first and second days are for tutorials, as well as the developer summit and vendor summit</li>
<li>Days four and five are the main event with the presentations, which Kris and Allan both made the cut for once again</li>
<li>Not counting the ones that have yet to be revealed (as of the day we&#39;re recording this), there will be thirty-six different talks in all - four BSD-neutral, four NetBSD, six OpenBSD and twenty-two FreeBSD</li>
<li>Summaries of all the presentations are on the timetable page if you scroll down a bit
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/press/2015febupdate.pdf" rel="nofollow">FreeBSD foundation updates and more</a></h3>

<ul>
<li>The <a href="http://www.bsdnow.tv/episodes/2015_02_04-from_the_foundation_1" rel="nofollow">FreeBSD foundation</a> has posted a number of things this week, the first of which is their February 2015 status update</li>
<li>It provides some updates on the funded projects, including PCI express hotplugging and FreeBSD on the POWER8 platform</li>
<li>There&#39;s a FOSDEM recap and another update of their fundraising goal for 2015</li>
<li>They also have two new blog posts: <a href="http://freebsdfoundation.blogspot.com/2015/02/scale-13x-trip-report-michael-dexter.html" rel="nofollow">a trip report from SCALE13x</a> and a featured &quot;<a href="http://freebsdfoundation.blogspot.com/2015/02/freebsd-from-trenches-zfs-and-how-to.html" rel="nofollow">FreeBSD in the trenches</a>&quot; article about how a small typo caused a lot of ZFS chaos in the cluster</li>
<li>&quot;Then panic ensued.  The machine didn&#39;t panic -- I did.&quot;
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-misc&m=142523501726732&w=2" rel="nofollow">OpenBSD improves browser security</a></h3>

<ul>
<li>No matter what OS you run on your desktop, the most likely entry point for an exploit these days is <em>almost certainly</em> the web browser</li>
<li>Ted Unangst writes in to the OpenBSD misc list to introduce a new project he&#39;s working on, simply titled &quot;improving browser security&quot;</li>
<li>He gives some background on the <a href="https://en.wikipedia.org/wiki/W%5EX" rel="nofollow">W<sup>X</sup> memory protection</a> in the base system, but also mentions that some applications in ports don&#39;t adhere to it</li>
<li>For it to be enforced globally instead of just recommended, at least one browser (or specifically, one <a href="https://en.wikipedia.org/wiki/Just-in-time_compilation" rel="nofollow">JIT</a> engine) needs to be fixed to use it</li>
<li>&quot;A system that is &#39;all W<sup>X</sup> except where it&#39;s not&#39; is the same as a system that&#39;s not W<sup>X.</sup> We&#39;ve worked hard to provide a secure foundation for programs; we&#39;d like to see them take advantage of it.&quot;</li>
<li>The work is being supported by the <a href="http://www.bsdnow.tv/episodes/2015_02_25-from_the_foundation_2" rel="nofollow">OpenBSD foundation</a>, and we&#39;ll keep you updated on this undertaking as more news about it is released</li>
<li>There&#39;s also some discussion <a href="https://news.ycombinator.com/item?id=9128360" rel="nofollow">on Hacker News</a> <a href="http://undeadly.org/cgi?action=article&sid=20150303075848&mode=expanded" rel="nofollow">and Undeadly</a> about it
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/02/28/msg000680.html" rel="nofollow">NetBSD at Open Source Conference 2015 Tokyo</a></h3>

<ul>
<li>The Japanese NetBSD users group has once again invaded a conference, this time in Tokyo</li>
<li>There&#39;s even a <a href="https://docs.google.com/spreadsheets/d/1DTJbESfnOUgOiVkFG8vsrxTq6oCGRpf8PkRcMkhWYWQ/edit#gid=0" rel="nofollow">spreadsheet</a> of all the different platforms they were showing off at the booth (mostly ARM, MIPS, PowerPC and Landisk this time around)</li>
<li>If you just can&#39;t get enough strange devices running BSD, check the mailing list post for lots of pictures</li>
<li>Their next target is, as you might guess, AsiaBSDCon 2015 - maybe we&#39;ll run into them
***</li>
</ul>

<h2>Interview - Sean Bruno - <a href="mailto:sbruno@freebsd.org" rel="nofollow">sbruno@freebsd.org</a> / <a href="https://twitter.com/franknbeans" rel="nofollow">@franknbeans</a></h2>

<p>Cross-compiling packages with <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere</a> and QEMU</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://crypto-bone.com/what.html" rel="nofollow">The Crypto Bone</a></h3>

<ul>
<li>The Crypto Bone is a new <a href="http://www.crypto-bone.com/" rel="nofollow">device</a> that&#39;s aimed at making encryption and secure communications <a href="http://crypto-bone.com/cbb-usersview.html" rel="nofollow">easier</a> and more accessible</li>
<li>Under the hood, it&#39;s actually just a <a href="http://beagleboard.org/bone" rel="nofollow">Beaglebone</a> board, running stock OpenBSD with a few extra packages</li>
<li>It includes a <a href="http://crypto-bone.com/release/root/var/www/apache/html/" rel="nofollow">web interface</a> for configuring keys and secure tunnels</li>
<li>The <a href="http://crypto-bone.com/release/root/" rel="nofollow">source code</a> is freely available for anyone interested in hacking on it (or auditing the crypto), and there&#39;s <a href="http://crypto-bone.com/cbb-technicalview.html" rel="nofollow">a technical overview</a> of how everything works on their site</li>
<li>If you don&#39;t want to teach your mom how to use PGP, buy her one of these(?)
***</li>
</ul>

<h3><a href="https://www.google-melange.com/gsoc/document/show/gsoc_program/google/gsoc2015/about_page" rel="nofollow">BSD in the 2015 Google Summer of Code</a></h3>

<ul>
<li>For those who don&#39;t know, GSoC is a way for students to get paid to work on a coding project for an open source organization</li>
<li>Good news: both FreeBSD and OpenBSD were <a href="https://www.google-melange.com/gsoc/org/list/public/google/gsoc2015" rel="nofollow">accepted</a> for the 2015 event</li>
<li>FreeBSD has <a href="https://wiki.freebsd.org/SummerOfCodeIdeas" rel="nofollow">a wiki page</a> of ideas for people to work on</li>
<li>OpenBSD also has <a href="http://www.openbsdfoundation.org/gsoc2015.html" rel="nofollow">an ideas page</a> where you can see some of the initial things that might be interesting</li>
<li>If you&#39;re a student looking to get involved with BSD development, this might be a great opportunity to even get paid to do it</li>
<li>Who knows, you may even <a href="http://www.bsdnow.tv/episodes/2015_01_07-system_disaster" rel="nofollow">end up on the show</a> if you work on a cool project</li>
<li>GSoC will be accepting idea proposals starting March 16th, so you have some time to think about what you&#39;d like to hack on
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=1588" rel="nofollow">pfSense 2.3 roadmap</a></h3>

<ul>
<li>The pfSense team has posted a new blog entry, detailing some of their plans for future versions</li>
<li>PPTP will finally be deprecated, PHP will be updated to 5.6 and other packages will also get updated to newer versions</li>
<li>PBIs are scheduled to be replaced with native pkgng packages</li>
<li>Version 3.0, something coming much later, will be a major rewrite that gets rid of PHP entirely</li>
<li>Their ultimate goal is for pfSense to be a package you can install atop of a regular FreeBSD install, rather than a repackaged distribution
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/03/a-look-at-the-upcoming-features-for-10-1-2/" rel="nofollow">PCBSD 10.1.2 security features</a></h3>

<ul>
<li>PCBSD 10.1.2 will include a number of cool security features, some of which are detailed in a new blog post</li>
<li>A new &quot;personacrypt&quot; utility is introduced, which allows for easy encryption and management of external drives for your home directory</li>
<li>Going along with this, it also has a &quot;stealth mode&quot; that allows for one-time temporary home directories (but it doesn&#39;t self-destruct, don&#39;t worry)</li>
<li>The LibreSSL integration also continues, and now packages will be built with it by default</li>
<li>If you&#39;re using the Life Preserver utility for backups, it will encrypt the remote copy of your files in the next update</li>
<li>They&#39;ve also been working on introducing some new options to enable tunneling your traffic through Tor</li>
<li>There will now be a fully-transparent proxy option that utilizes the switch to IPFW we mentioned last week</li>
<li>A small disclaimer: remember that <strong>many</strong> things can expose your true IP when using Tor, so use this option at your own risk if you require full anonymity</li>
<li>Look forward to Kris wearing a <a href="https://www.torproject.org/getinvolved/tshirt.html" rel="nofollow">Tor shirt</a> in future episodes
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2ofBPRT5n" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s26LsYcoJF" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s28Rho0jvL" rel="nofollow">Van writes in</a></li>
<li><a href="http://slexy.org/view/s21AkGbniU" rel="nofollow">Stu writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2015-February/098183.html" rel="nofollow">H</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-chat/2015-February/007024.html" rel="nofollow">Pay up, mister Free</a></li>
<li><a href="https://www.mail-archive.com/tech%40openbsd.org/msg22663.html" rel="nofollow">Heritage protected</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-questions/2015-February/264466.html" rel="nofollow">Blind leading the blind</a></li>
<li><a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-February/068682.html" rel="nofollow">What are the chances</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this time on the show, we&#39;ll be talking to Sean Bruno. He&#39;s been using poudriere and QEMU to cross compile binary packages, and has some interesting stories to tell about it. We&#39;ve also got answers to viewer-submitted questions and all this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2015.asiabsdcon.org/timetable.html.en" rel="nofollow">AsiaBSDCon 2015 schedule</a></h3>

<ul>
<li>Almost immediately after we finished recording an episode last week, the 2015 AsiaBSDCon schedule went up</li>
<li>This year&#39;s conference will be between 12-15 March at the Tokyo University of Science in Japan</li>
<li>The first and second days are for tutorials, as well as the developer summit and vendor summit</li>
<li>Days four and five are the main event with the presentations, which Kris and Allan both made the cut for once again</li>
<li>Not counting the ones that have yet to be revealed (as of the day we&#39;re recording this), there will be thirty-six different talks in all - four BSD-neutral, four NetBSD, six OpenBSD and twenty-two FreeBSD</li>
<li>Summaries of all the presentations are on the timetable page if you scroll down a bit
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/press/2015febupdate.pdf" rel="nofollow">FreeBSD foundation updates and more</a></h3>

<ul>
<li>The <a href="http://www.bsdnow.tv/episodes/2015_02_04-from_the_foundation_1" rel="nofollow">FreeBSD foundation</a> has posted a number of things this week, the first of which is their February 2015 status update</li>
<li>It provides some updates on the funded projects, including PCI express hotplugging and FreeBSD on the POWER8 platform</li>
<li>There&#39;s a FOSDEM recap and another update of their fundraising goal for 2015</li>
<li>They also have two new blog posts: <a href="http://freebsdfoundation.blogspot.com/2015/02/scale-13x-trip-report-michael-dexter.html" rel="nofollow">a trip report from SCALE13x</a> and a featured &quot;<a href="http://freebsdfoundation.blogspot.com/2015/02/freebsd-from-trenches-zfs-and-how-to.html" rel="nofollow">FreeBSD in the trenches</a>&quot; article about how a small typo caused a lot of ZFS chaos in the cluster</li>
<li>&quot;Then panic ensued.  The machine didn&#39;t panic -- I did.&quot;
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-misc&m=142523501726732&w=2" rel="nofollow">OpenBSD improves browser security</a></h3>

<ul>
<li>No matter what OS you run on your desktop, the most likely entry point for an exploit these days is <em>almost certainly</em> the web browser</li>
<li>Ted Unangst writes in to the OpenBSD misc list to introduce a new project he&#39;s working on, simply titled &quot;improving browser security&quot;</li>
<li>He gives some background on the <a href="https://en.wikipedia.org/wiki/W%5EX" rel="nofollow">W<sup>X</sup> memory protection</a> in the base system, but also mentions that some applications in ports don&#39;t adhere to it</li>
<li>For it to be enforced globally instead of just recommended, at least one browser (or specifically, one <a href="https://en.wikipedia.org/wiki/Just-in-time_compilation" rel="nofollow">JIT</a> engine) needs to be fixed to use it</li>
<li>&quot;A system that is &#39;all W<sup>X</sup> except where it&#39;s not&#39; is the same as a system that&#39;s not W<sup>X.</sup> We&#39;ve worked hard to provide a secure foundation for programs; we&#39;d like to see them take advantage of it.&quot;</li>
<li>The work is being supported by the <a href="http://www.bsdnow.tv/episodes/2015_02_25-from_the_foundation_2" rel="nofollow">OpenBSD foundation</a>, and we&#39;ll keep you updated on this undertaking as more news about it is released</li>
<li>There&#39;s also some discussion <a href="https://news.ycombinator.com/item?id=9128360" rel="nofollow">on Hacker News</a> <a href="http://undeadly.org/cgi?action=article&sid=20150303075848&mode=expanded" rel="nofollow">and Undeadly</a> about it
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/02/28/msg000680.html" rel="nofollow">NetBSD at Open Source Conference 2015 Tokyo</a></h3>

<ul>
<li>The Japanese NetBSD users group has once again invaded a conference, this time in Tokyo</li>
<li>There&#39;s even a <a href="https://docs.google.com/spreadsheets/d/1DTJbESfnOUgOiVkFG8vsrxTq6oCGRpf8PkRcMkhWYWQ/edit#gid=0" rel="nofollow">spreadsheet</a> of all the different platforms they were showing off at the booth (mostly ARM, MIPS, PowerPC and Landisk this time around)</li>
<li>If you just can&#39;t get enough strange devices running BSD, check the mailing list post for lots of pictures</li>
<li>Their next target is, as you might guess, AsiaBSDCon 2015 - maybe we&#39;ll run into them
***</li>
</ul>

<h2>Interview - Sean Bruno - <a href="mailto:sbruno@freebsd.org" rel="nofollow">sbruno@freebsd.org</a> / <a href="https://twitter.com/franknbeans" rel="nofollow">@franknbeans</a></h2>

<p>Cross-compiling packages with <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere</a> and QEMU</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://crypto-bone.com/what.html" rel="nofollow">The Crypto Bone</a></h3>

<ul>
<li>The Crypto Bone is a new <a href="http://www.crypto-bone.com/" rel="nofollow">device</a> that&#39;s aimed at making encryption and secure communications <a href="http://crypto-bone.com/cbb-usersview.html" rel="nofollow">easier</a> and more accessible</li>
<li>Under the hood, it&#39;s actually just a <a href="http://beagleboard.org/bone" rel="nofollow">Beaglebone</a> board, running stock OpenBSD with a few extra packages</li>
<li>It includes a <a href="http://crypto-bone.com/release/root/var/www/apache/html/" rel="nofollow">web interface</a> for configuring keys and secure tunnels</li>
<li>The <a href="http://crypto-bone.com/release/root/" rel="nofollow">source code</a> is freely available for anyone interested in hacking on it (or auditing the crypto), and there&#39;s <a href="http://crypto-bone.com/cbb-technicalview.html" rel="nofollow">a technical overview</a> of how everything works on their site</li>
<li>If you don&#39;t want to teach your mom how to use PGP, buy her one of these(?)
***</li>
</ul>

<h3><a href="https://www.google-melange.com/gsoc/document/show/gsoc_program/google/gsoc2015/about_page" rel="nofollow">BSD in the 2015 Google Summer of Code</a></h3>

<ul>
<li>For those who don&#39;t know, GSoC is a way for students to get paid to work on a coding project for an open source organization</li>
<li>Good news: both FreeBSD and OpenBSD were <a href="https://www.google-melange.com/gsoc/org/list/public/google/gsoc2015" rel="nofollow">accepted</a> for the 2015 event</li>
<li>FreeBSD has <a href="https://wiki.freebsd.org/SummerOfCodeIdeas" rel="nofollow">a wiki page</a> of ideas for people to work on</li>
<li>OpenBSD also has <a href="http://www.openbsdfoundation.org/gsoc2015.html" rel="nofollow">an ideas page</a> where you can see some of the initial things that might be interesting</li>
<li>If you&#39;re a student looking to get involved with BSD development, this might be a great opportunity to even get paid to do it</li>
<li>Who knows, you may even <a href="http://www.bsdnow.tv/episodes/2015_01_07-system_disaster" rel="nofollow">end up on the show</a> if you work on a cool project</li>
<li>GSoC will be accepting idea proposals starting March 16th, so you have some time to think about what you&#39;d like to hack on
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=1588" rel="nofollow">pfSense 2.3 roadmap</a></h3>

<ul>
<li>The pfSense team has posted a new blog entry, detailing some of their plans for future versions</li>
<li>PPTP will finally be deprecated, PHP will be updated to 5.6 and other packages will also get updated to newer versions</li>
<li>PBIs are scheduled to be replaced with native pkgng packages</li>
<li>Version 3.0, something coming much later, will be a major rewrite that gets rid of PHP entirely</li>
<li>Their ultimate goal is for pfSense to be a package you can install atop of a regular FreeBSD install, rather than a repackaged distribution
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/03/a-look-at-the-upcoming-features-for-10-1-2/" rel="nofollow">PCBSD 10.1.2 security features</a></h3>

<ul>
<li>PCBSD 10.1.2 will include a number of cool security features, some of which are detailed in a new blog post</li>
<li>A new &quot;personacrypt&quot; utility is introduced, which allows for easy encryption and management of external drives for your home directory</li>
<li>Going along with this, it also has a &quot;stealth mode&quot; that allows for one-time temporary home directories (but it doesn&#39;t self-destruct, don&#39;t worry)</li>
<li>The LibreSSL integration also continues, and now packages will be built with it by default</li>
<li>If you&#39;re using the Life Preserver utility for backups, it will encrypt the remote copy of your files in the next update</li>
<li>They&#39;ve also been working on introducing some new options to enable tunneling your traffic through Tor</li>
<li>There will now be a fully-transparent proxy option that utilizes the switch to IPFW we mentioned last week</li>
<li>A small disclaimer: remember that <strong>many</strong> things can expose your true IP when using Tor, so use this option at your own risk if you require full anonymity</li>
<li>Look forward to Kris wearing a <a href="https://www.torproject.org/getinvolved/tshirt.html" rel="nofollow">Tor shirt</a> in future episodes
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2ofBPRT5n" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s26LsYcoJF" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s28Rho0jvL" rel="nofollow">Van writes in</a></li>
<li><a href="http://slexy.org/view/s21AkGbniU" rel="nofollow">Stu writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2015-February/098183.html" rel="nofollow">H</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-chat/2015-February/007024.html" rel="nofollow">Pay up, mister Free</a></li>
<li><a href="https://www.mail-archive.com/tech%40openbsd.org/msg22663.html" rel="nofollow">Heritage protected</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-questions/2015-February/264466.html" rel="nofollow">Blind leading the blind</a></li>
<li><a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-February/068682.html" rel="nofollow">What are the chances</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>78: From the Foundation (Part 2)</title>
  <link>https://www.bsdnow.tv/78</link>
  <guid isPermaLink="false">6999608e-fe27-4efa-96b0-eb1e928acf0a</guid>
  <pubDate>Wed, 25 Feb 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6999608e-fe27-4efa-96b0-eb1e928acf0a.mp3" length="50146996" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week we continue our two-part series on the activities of various BSD foundations. Ken Westerback joins us today to talk all about the OpenBSD foundation and what it is they do. We've also got answers to your emails and all the latest news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:09:38</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week we continue our two-part series on the activities of various BSD foundations. Ken Westerback joins us today to talk all about the OpenBSD foundation and what it is they do. We've also got answers to your emails and all the latest news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
BSDCan 2015 schedule (https://www.bsdcan.org/2015/schedule/)
The list of presentations for the upcoming BSDCan conference has been posted, and the time schedule should be up shortly as well
Just a reminder: it's going to be held on June 12th and 13th at the University of Ottawa in Canada
This year's conference will have a massive fifty talks, split up between four tracks instead of three (but unfortunately a person can only be in one place at a time)
Both Allan and Kris had at least one presentation accepted, and Allan will also be leading a few  "birds of a feather" gatherings
In total, there will be three NetBSD talks, five OpenBSD talks, eight BSD-neutral talks, thirty-five FreeBSD talks and no DragonFly talks
That's not the ideal balance (https://twitter.com/bsdcan/status/570394627158773760) we'd hope for, but BSDCan says (https://twitter.com/bsdcan/status/570398181864972288) they'll try to improve that next year
Those numbers are based on the speaker's background, or any past presentations, for the few whose actual topic wasn't made obvious from the title (so there may be a small margin of error)
Michael Lucas (who's on the BSDCan board) wrote up a blog post (http://blather.michaelwlucas.com/archives/2325) about the proposals and rejections this year
If you can't make it this year, don't worry, we'll be sure to announce the recordings when they're made available
We also interviewed Dan Langille (http://www.bsdnow.tv/episodes/2014_12_31-daemons_in_the_north) about the conference and what to expect this year, so check that out too
***
SSL interception with relayd (http://www.reykfloeter.com/post/41814177050/relayd-ssl-interception)
There was a lot of commotion recently about superfish (http://www.forbes.com/sites/thomasbrewster/2015/02/19/superfish-need-to-know/), a way that Lenovo was intercepting HTTPS traffic and injecting advertisements
If you're running relayd (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/relayd.8), you can mimic this evil setup on your own networks (just for testing of course…)
Reyk Floeter (http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time), the guy who wrote relayd, came up a blog post about how to do just that (https://gist.github.com/reyk/4b42858d1eab3825f9bc#file-relayd-superfish-conf)
It starts off with some backstory and some of the things relayd is capable of
relayd can run as an SSL server to terminate SSL connections and forward them as plain TCP and, conversely, run as an SSL client to terminal plain TCP connections and tunnel them through SSL
When you combine these two, you end up with possibilities to filter between SSL connections, effectively creating a MITM scenario
The post is very long, with lots of details (https://www.marc.info/?l=openbsd-tech&amp;amp;m=135887624714548&amp;amp;w=2) and some sample config files - the whole nine yards
***
OPNsense 15.1.6.1 released (https://forum.opnsense.org/index.php?topic=77.0)
The OPNsense team has released yet another version in rapid succession, but this one has some big changes
It's now based on FreeBSD 10.1, with all the latest security patches and driver updates (as well as some in-house patches)
This version also features a new tool for easily upgrading between versions, simply called "opnsense-update" (similar to freebsd-update)
It also includes security fixes for BIND (https://kb.isc.org/article/AA-01235) and PHP (http://php.net/ChangeLog-5.php#5.6.6), as well as some other assorted bug fixes
The installation images have been laid out in a clean way: standard CD and USB images that default to VGA, as well as USB images that default to a console output (for things like Soekris and PCEngines APU boards that only have serial ports)
With the news of m0n0wall shutting down last week, they've also released bare minimum hardware specifications required to run OPNsense on embedded devices
Encouraged by last week's mention of PCBSD trying to cut ties with OpenSSL, OPNsense is also now providing experimental images built against LibreSSL (https://forum.opnsense.org/index.php?topic=78.0) for testing (and have instructions on how to switch over without reinstalling)
***
OpenBSD on a Minnowboard Max (http://www.countersiege.com/2015/02/22/minnowboard_max_openbsd.html)
What would our show be without at least one story about someone installing BSD on a weird device
For once, it's actually not NetBSD…
This article is about the minnowboard max (http://www.minnowboard.org/meet-minnowboard-max/), a very small X86-based motherboard that looks vaguely similar to a Raspberry Pi
It's using an Atom CPU instead of ARM, so overall application compatibility should be a bit better (and it even has AES-NI, so crypto performance will be much better than a normal Atom)
The author describes his entirely solid-state setup, noting that there's virtually no noise, no concern about hard drives dying and very reasonable power usage
You'll find instructions on how to get OpenBSD installed and going throughout the rest of the article
Have a look at the spec sheet if you're interested, they make for cool little BSD boxes
***
Netmap for 40gbit NICs in FreeBSD (https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054717.html)
Luigi Rizzo posted an announcement to the -current mailing list, detailing some of the work he's just committed
The ixl(4) driver, that's one for the X1710 40-gigabit card, now has netmap support
It's currently in 11-CURRENT, but he says it works in 10-STABLE and will be committed there too
This should make for some serious packet-pushing power
If you have any network hardware like this, he would appreciate testing for the new code
***
Interview - Ken Westerback - directors@openbsdfoundation.org (mailto:directors@openbsdfoundation.org)
The OpenBSD foundation (http://www.openbsdfoundation.org/donations.html)'s activities
News Roundup
s2k15 hackathon report: dhclient/dhcpd/fdisk (http://undeadly.org/cgi?action=article&amp;amp;sid=20150221222235)
The second trip report from the recent OpenBSD hackathon has been published, from the very same guy we just talked to
Ken was also busy, getting a few networking-related things fixed and improved in the base system
He wrote a few new small additions for dhclient and beefed up the privsep security, as well as some fixes for tcpdump and dhcpd
The fdisk tool also got worked on a bit, enabling OpenBSD to properly wipe GPT tables on a previously-formatted disk so you can do a normal install on it
There's apparently plans for "dhclientng" - presumably a big improvement (rewrite?) of dhclient
***
FreeBSD beginner video series (https://www.youtube.com/user/bsdtutorial/videos)
A new series of videos has started on YouTube, aimed at helping total beginners learn about FreeBSD
We usually assume that people who watch the show are already familiar with basic concepts, but they'd be a great introduction to any of your friends that are looking to get started with BSD and need a helping hand
So far, he's covered how to get FreeBSD (https://www.youtube.com/watch?v=D26rOHkI-iE), an introduction to installing in VirtualBox (https://www.youtube.com/watch?v=PCyYW19bPDU), a simple installation (https://www.youtube.com/watch?v=HCE89kObutA) or a more in-depth manual installation (https://www.youtube.com/watch?v=OwqCjz9Fgao), navigating the filesystem (https://www.youtube.com/watch?v=6YJhdOGjN50), basic ssh use (https://www.youtube.com/watch?v=Yl5Bg2qz21I), managing users and groups (https://www.youtube.com/watch?v=ioB73i7QUjI) and finally some basic editing (https://www.youtube.com/watch?v=VxxbO-gt9FA) with vi (https://www.youtube.com/watch?v=16FNtCj-uS4) and a few other topics
Everyone's gotta start somewhere and, with a little bit of initial direction, today's newbies could be tomorrow's developers
It should be an ongoing series with more topics to come
***
NetBSD tests: zero unexpected failures (https://blog.netbsd.org/tnf/entry/regular_test_runs_down_to)
The NetBSD guys have a new blog post up about their testing suite (http://wiki.netbsd.org/tutorials/atf/) for all the CPU architectures
They've finally gotten the number of "expected" failures down to zero on a few select architectures
Results are published (http://releng.netbsd.org/test-results.html) on a special release engineering page, so you can have a look if you're interested
The rest of the post links to the "top performers" (ones with less than ten failure) in the -current branch
***
PCBSD switches to IPFW (https://github.com/pcbsd/pcbsd/commit/b80f78d8a5d002396c28ac0e5fd6f69699beaace)
The PCBSD crew continues their recent series of switching between major competing features
This time, they've switched the default firewall away from PF to FreeBSD's native IPFW firewall
Look forward to Kris wearing a "keep calm and use IPFW" shir- wait
***
Feedback/Questions
Sean writes in (http://slexy.org/view/s21U6Ln6wC)
Dan writes in (http://slexy.org/view/s2Kp0xdfIb)
Florian writes in (http://slexy.org/view/s216DcA8DP)
Sean writes in (http://slexy.org/view/s271iJjqtQ)
Chris writes in (http://slexy.org/view/s21zerHI9P)
***
Mailing List Gold
VCS flamebait (https://www.marc.info/?l=openbsd-misc&amp;amp;m=142454205416445&amp;amp;w=2)
Hidden agenda (https://lists.freebsd.org/pipermail/freebsd-gnome/2015-February/031561.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, openbsd foundation, donations, openssh, funding, hackathon, gsoc, core infrastructure initiative, linux foundation, charity, lenovo, superfish, relayd, opnsense, soekris</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week we continue our two-part series on the activities of various BSD foundations. Ken Westerback joins us today to talk all about the OpenBSD foundation and what it is they do. We&#39;ve also got answers to your emails and all the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2015/schedule/" rel="nofollow">BSDCan 2015 schedule</a></h3>

<ul>
<li>The list of presentations for the upcoming BSDCan conference has been posted, and the time schedule should be up shortly as well</li>
<li>Just a reminder: it&#39;s going to be held on June 12th and 13th at the University of Ottawa in Canada</li>
<li>This year&#39;s conference will have a massive <strong>fifty</strong> talks, split up between four tracks instead of three (but unfortunately a person can only be in one place at a time)</li>
<li>Both Allan and Kris had at least one presentation accepted, and Allan will also be leading a few  &quot;birds of a feather&quot; gatherings</li>
<li>In total, there will be three NetBSD talks, five OpenBSD talks, eight BSD-neutral talks, thirty-five FreeBSD talks and no DragonFly talks</li>
<li>That&#39;s not the <a href="https://twitter.com/bsdcan/status/570394627158773760" rel="nofollow">ideal balance</a> we&#39;d hope for, but <a href="https://twitter.com/bsdcan/status/570398181864972288" rel="nofollow">BSDCan says</a> they&#39;ll try to improve that next year</li>
<li>Those numbers are based on the speaker&#39;s background, or any past presentations, for the few whose actual topic wasn&#39;t made obvious from the title (so there may be a small margin of error)</li>
<li>Michael Lucas (who&#39;s on the BSDCan board) wrote up <a href="http://blather.michaelwlucas.com/archives/2325" rel="nofollow">a blog post</a> about the proposals and rejections this year</li>
<li>If you can&#39;t make it this year, don&#39;t worry, we&#39;ll be sure to announce the recordings when they&#39;re made available</li>
<li>We also <a href="http://www.bsdnow.tv/episodes/2014_12_31-daemons_in_the_north" rel="nofollow">interviewed Dan Langille</a> about the conference and what to expect this year, so check that out too
***</li>
</ul>

<h3><a href="http://www.reykfloeter.com/post/41814177050/relayd-ssl-interception" rel="nofollow">SSL interception with relayd</a></h3>

<ul>
<li>There was a lot of commotion recently about <a href="http://www.forbes.com/sites/thomasbrewster/2015/02/19/superfish-need-to-know/" rel="nofollow">superfish</a>, a way that Lenovo was intercepting HTTPS traffic and injecting advertisements</li>
<li>If you&#39;re running <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/relayd.8" rel="nofollow">relayd</a>, you can mimic this <em>evil</em> setup on your own networks (just for testing of course…)</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time" rel="nofollow">Reyk Floeter</a>, the guy who wrote relayd, came up a blog post about how to do <a href="https://gist.github.com/reyk/4b42858d1eab3825f9bc#file-relayd-superfish-conf" rel="nofollow">just that</a></li>
<li>It starts off with some backstory and some of the things relayd is capable of</li>
<li>relayd can run as an SSL server to terminate SSL connections and forward them as plain TCP and, conversely, run as an SSL client to terminal plain TCP connections and tunnel them through SSL</li>
<li>When you combine these two, you end up with possibilities to filter between SSL connections, effectively creating a MITM scenario</li>
<li>The post is very long, with lots of <a href="https://www.marc.info/?l=openbsd-tech&m=135887624714548&w=2" rel="nofollow">details</a> and some sample config files - the whole nine yards
***</li>
</ul>

<h3><a href="https://forum.opnsense.org/index.php?topic=77.0" rel="nofollow">OPNsense 15.1.6.1 released</a></h3>

<ul>
<li>The OPNsense team has released yet another version in rapid succession, but this one has some big changes</li>
<li>It&#39;s now based on FreeBSD 10.1, with all the latest security patches and driver updates (as well as some in-house patches)</li>
<li>This version also features a new tool for easily upgrading between versions, simply called &quot;opnsense-update&quot; (similar to freebsd-update)</li>
<li>It also includes <strong>security</strong> fixes <a href="https://kb.isc.org/article/AA-01235" rel="nofollow">for BIND</a> <a href="http://php.net/ChangeLog-5.php#5.6.6" rel="nofollow">and PHP</a>, as well as some other assorted bug fixes</li>
<li>The installation images have been laid out in a clean way: standard CD and USB images that default to VGA, as well as USB images that default to a console output (for things like Soekris and PCEngines APU boards that only have serial ports)</li>
<li>With the news of m0n0wall shutting down last week, they&#39;ve also released bare minimum hardware specifications required to run OPNsense on embedded devices</li>
<li>Encouraged by last week&#39;s mention of PCBSD trying to cut ties with OpenSSL, OPNsense is also now providing experimental <a href="https://forum.opnsense.org/index.php?topic=78.0" rel="nofollow">images built against LibreSSL</a> for testing (and have instructions on how to switch over without reinstalling)
***</li>
</ul>

<h3><a href="http://www.countersiege.com/2015/02/22/minnowboard_max_openbsd.html" rel="nofollow">OpenBSD on a Minnowboard Max</a></h3>

<ul>
<li>What would our show be without at least one story about someone installing BSD on a weird device</li>
<li>For once, it&#39;s actually not NetBSD…</li>
<li>This article is about the <a href="http://www.minnowboard.org/meet-minnowboard-max/" rel="nofollow">minnowboard max</a>, a very small X86-based motherboard that looks vaguely similar to a Raspberry Pi</li>
<li>It&#39;s using an Atom CPU instead of ARM, so overall application compatibility should be a bit better (and it even has AES-NI, so crypto performance will be much better than a normal Atom)</li>
<li>The author describes his entirely solid-state setup, noting that there&#39;s virtually no noise, no concern about hard drives dying and very reasonable power usage</li>
<li>You&#39;ll find instructions on how to get OpenBSD installed and going throughout the rest of the article</li>
<li>Have a look at the spec sheet if you&#39;re interested, they make for cool little BSD boxes
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054717.html" rel="nofollow">Netmap for 40gbit NICs in FreeBSD</a></h3>

<ul>
<li>Luigi Rizzo posted an announcement to the -current mailing list, detailing some of the work he&#39;s just committed</li>
<li>The ixl(4) driver, that&#39;s one for the X1710 40-gigabit card, now has netmap support</li>
<li>It&#39;s currently in 11-CURRENT, but he says it works in 10-STABLE and will be committed there too</li>
<li>This should make for some serious packet-pushing power</li>
<li>If you have any network hardware like this, he would appreciate testing for the new code
***</li>
</ul>

<h2>Interview - Ken Westerback - <a href="mailto:directors@openbsdfoundation.org" rel="nofollow">directors@openbsdfoundation.org</a></h2>

<p><a href="http://www.openbsdfoundation.org/donations.html" rel="nofollow">The OpenBSD foundation</a>&#39;s activities</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150221222235" rel="nofollow">s2k15 hackathon report: dhclient/dhcpd/fdisk</a></h3>

<ul>
<li>The second trip report from the recent OpenBSD hackathon has been published, from the very same guy we just talked to</li>
<li>Ken was also busy, getting a few networking-related things fixed and improved in the base system</li>
<li>He wrote a few new small additions for dhclient and beefed up the privsep security, as well as some fixes for tcpdump and dhcpd</li>
<li>The fdisk tool also got worked on a bit, enabling OpenBSD to properly wipe GPT tables on a previously-formatted disk so you can do a normal install on it</li>
<li>There&#39;s apparently plans for &quot;dhclientng&quot; - presumably a big improvement (rewrite?) of dhclient
***</li>
</ul>

<h3><a href="https://www.youtube.com/user/bsdtutorial/videos" rel="nofollow">FreeBSD beginner video series</a></h3>

<ul>
<li>A new series of videos has started on YouTube, aimed at helping total beginners learn about FreeBSD</li>
<li>We usually assume that people who watch the show are already familiar with basic concepts, but they&#39;d be a great introduction to any of your friends that are looking to get started with BSD and need a helping hand</li>
<li>So far, he&#39;s covered <a href="https://www.youtube.com/watch?v=D26rOHkI-iE" rel="nofollow">how to get FreeBSD</a>, <a href="https://www.youtube.com/watch?v=PCyYW19bPDU" rel="nofollow">an introduction to installing in VirtualBox</a>, <a href="https://www.youtube.com/watch?v=HCE89kObutA" rel="nofollow">a simple installation</a> or a more in-depth <a href="https://www.youtube.com/watch?v=OwqCjz9Fgao" rel="nofollow">manual installation</a>, <a href="https://www.youtube.com/watch?v=6YJhdOGjN50" rel="nofollow">navigating the filesystem</a>, <a href="https://www.youtube.com/watch?v=Yl5Bg2qz21I" rel="nofollow">basic ssh use</a>, <a href="https://www.youtube.com/watch?v=ioB73i7QUjI" rel="nofollow">managing users and groups</a> and finally some <a href="https://www.youtube.com/watch?v=VxxbO-gt9FA" rel="nofollow">basic editing</a> <a href="https://www.youtube.com/watch?v=16FNtCj-uS4" rel="nofollow">with vi</a> and a few other topics</li>
<li>Everyone&#39;s gotta start somewhere and, with a little bit of initial direction, today&#39;s newbies could be tomorrow&#39;s developers</li>
<li>It should be an ongoing series with more topics to come
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/regular_test_runs_down_to" rel="nofollow">NetBSD tests: zero unexpected failures</a></h3>

<ul>
<li>The NetBSD guys have a new blog post up about their <a href="http://wiki.netbsd.org/tutorials/atf/" rel="nofollow">testing suite</a> for all the CPU architectures</li>
<li>They&#39;ve finally gotten the number of &quot;expected&quot; failures down to zero on a few select architectures</li>
<li>Results are <a href="http://releng.netbsd.org/test-results.html" rel="nofollow">published</a> on a special release engineering page, so you can have a look if you&#39;re interested</li>
<li>The rest of the post links to the &quot;top performers&quot; (ones with less than ten failure) in the -current branch
***</li>
</ul>

<h3><a href="https://github.com/pcbsd/pcbsd/commit/b80f78d8a5d002396c28ac0e5fd6f69699beaace" rel="nofollow">PCBSD switches to IPFW</a></h3>

<ul>
<li>The PCBSD crew continues their recent series of switching between major competing features</li>
<li>This time, they&#39;ve switched the default firewall away from PF to FreeBSD&#39;s native IPFW firewall</li>
<li>Look forward to Kris wearing a &quot;keep calm and use IPFW&quot; shir- wait
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21U6Ln6wC" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s2Kp0xdfIb" rel="nofollow">Dan writes in</a></li>
<li><a href="http://slexy.org/view/s216DcA8DP" rel="nofollow">Florian writes in</a></li>
<li><a href="http://slexy.org/view/s271iJjqtQ" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s21zerHI9P" rel="nofollow">Chris writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-misc&m=142454205416445&w=2" rel="nofollow">VCS flamebait</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-gnome/2015-February/031561.html" rel="nofollow">Hidden agenda</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week we continue our two-part series on the activities of various BSD foundations. Ken Westerback joins us today to talk all about the OpenBSD foundation and what it is they do. We&#39;ve also got answers to your emails and all the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2015/schedule/" rel="nofollow">BSDCan 2015 schedule</a></h3>

<ul>
<li>The list of presentations for the upcoming BSDCan conference has been posted, and the time schedule should be up shortly as well</li>
<li>Just a reminder: it&#39;s going to be held on June 12th and 13th at the University of Ottawa in Canada</li>
<li>This year&#39;s conference will have a massive <strong>fifty</strong> talks, split up between four tracks instead of three (but unfortunately a person can only be in one place at a time)</li>
<li>Both Allan and Kris had at least one presentation accepted, and Allan will also be leading a few  &quot;birds of a feather&quot; gatherings</li>
<li>In total, there will be three NetBSD talks, five OpenBSD talks, eight BSD-neutral talks, thirty-five FreeBSD talks and no DragonFly talks</li>
<li>That&#39;s not the <a href="https://twitter.com/bsdcan/status/570394627158773760" rel="nofollow">ideal balance</a> we&#39;d hope for, but <a href="https://twitter.com/bsdcan/status/570398181864972288" rel="nofollow">BSDCan says</a> they&#39;ll try to improve that next year</li>
<li>Those numbers are based on the speaker&#39;s background, or any past presentations, for the few whose actual topic wasn&#39;t made obvious from the title (so there may be a small margin of error)</li>
<li>Michael Lucas (who&#39;s on the BSDCan board) wrote up <a href="http://blather.michaelwlucas.com/archives/2325" rel="nofollow">a blog post</a> about the proposals and rejections this year</li>
<li>If you can&#39;t make it this year, don&#39;t worry, we&#39;ll be sure to announce the recordings when they&#39;re made available</li>
<li>We also <a href="http://www.bsdnow.tv/episodes/2014_12_31-daemons_in_the_north" rel="nofollow">interviewed Dan Langille</a> about the conference and what to expect this year, so check that out too
***</li>
</ul>

<h3><a href="http://www.reykfloeter.com/post/41814177050/relayd-ssl-interception" rel="nofollow">SSL interception with relayd</a></h3>

<ul>
<li>There was a lot of commotion recently about <a href="http://www.forbes.com/sites/thomasbrewster/2015/02/19/superfish-need-to-know/" rel="nofollow">superfish</a>, a way that Lenovo was intercepting HTTPS traffic and injecting advertisements</li>
<li>If you&#39;re running <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/relayd.8" rel="nofollow">relayd</a>, you can mimic this <em>evil</em> setup on your own networks (just for testing of course…)</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time" rel="nofollow">Reyk Floeter</a>, the guy who wrote relayd, came up a blog post about how to do <a href="https://gist.github.com/reyk/4b42858d1eab3825f9bc#file-relayd-superfish-conf" rel="nofollow">just that</a></li>
<li>It starts off with some backstory and some of the things relayd is capable of</li>
<li>relayd can run as an SSL server to terminate SSL connections and forward them as plain TCP and, conversely, run as an SSL client to terminal plain TCP connections and tunnel them through SSL</li>
<li>When you combine these two, you end up with possibilities to filter between SSL connections, effectively creating a MITM scenario</li>
<li>The post is very long, with lots of <a href="https://www.marc.info/?l=openbsd-tech&m=135887624714548&w=2" rel="nofollow">details</a> and some sample config files - the whole nine yards
***</li>
</ul>

<h3><a href="https://forum.opnsense.org/index.php?topic=77.0" rel="nofollow">OPNsense 15.1.6.1 released</a></h3>

<ul>
<li>The OPNsense team has released yet another version in rapid succession, but this one has some big changes</li>
<li>It&#39;s now based on FreeBSD 10.1, with all the latest security patches and driver updates (as well as some in-house patches)</li>
<li>This version also features a new tool for easily upgrading between versions, simply called &quot;opnsense-update&quot; (similar to freebsd-update)</li>
<li>It also includes <strong>security</strong> fixes <a href="https://kb.isc.org/article/AA-01235" rel="nofollow">for BIND</a> <a href="http://php.net/ChangeLog-5.php#5.6.6" rel="nofollow">and PHP</a>, as well as some other assorted bug fixes</li>
<li>The installation images have been laid out in a clean way: standard CD and USB images that default to VGA, as well as USB images that default to a console output (for things like Soekris and PCEngines APU boards that only have serial ports)</li>
<li>With the news of m0n0wall shutting down last week, they&#39;ve also released bare minimum hardware specifications required to run OPNsense on embedded devices</li>
<li>Encouraged by last week&#39;s mention of PCBSD trying to cut ties with OpenSSL, OPNsense is also now providing experimental <a href="https://forum.opnsense.org/index.php?topic=78.0" rel="nofollow">images built against LibreSSL</a> for testing (and have instructions on how to switch over without reinstalling)
***</li>
</ul>

<h3><a href="http://www.countersiege.com/2015/02/22/minnowboard_max_openbsd.html" rel="nofollow">OpenBSD on a Minnowboard Max</a></h3>

<ul>
<li>What would our show be without at least one story about someone installing BSD on a weird device</li>
<li>For once, it&#39;s actually not NetBSD…</li>
<li>This article is about the <a href="http://www.minnowboard.org/meet-minnowboard-max/" rel="nofollow">minnowboard max</a>, a very small X86-based motherboard that looks vaguely similar to a Raspberry Pi</li>
<li>It&#39;s using an Atom CPU instead of ARM, so overall application compatibility should be a bit better (and it even has AES-NI, so crypto performance will be much better than a normal Atom)</li>
<li>The author describes his entirely solid-state setup, noting that there&#39;s virtually no noise, no concern about hard drives dying and very reasonable power usage</li>
<li>You&#39;ll find instructions on how to get OpenBSD installed and going throughout the rest of the article</li>
<li>Have a look at the spec sheet if you&#39;re interested, they make for cool little BSD boxes
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054717.html" rel="nofollow">Netmap for 40gbit NICs in FreeBSD</a></h3>

<ul>
<li>Luigi Rizzo posted an announcement to the -current mailing list, detailing some of the work he&#39;s just committed</li>
<li>The ixl(4) driver, that&#39;s one for the X1710 40-gigabit card, now has netmap support</li>
<li>It&#39;s currently in 11-CURRENT, but he says it works in 10-STABLE and will be committed there too</li>
<li>This should make for some serious packet-pushing power</li>
<li>If you have any network hardware like this, he would appreciate testing for the new code
***</li>
</ul>

<h2>Interview - Ken Westerback - <a href="mailto:directors@openbsdfoundation.org" rel="nofollow">directors@openbsdfoundation.org</a></h2>

<p><a href="http://www.openbsdfoundation.org/donations.html" rel="nofollow">The OpenBSD foundation</a>&#39;s activities</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150221222235" rel="nofollow">s2k15 hackathon report: dhclient/dhcpd/fdisk</a></h3>

<ul>
<li>The second trip report from the recent OpenBSD hackathon has been published, from the very same guy we just talked to</li>
<li>Ken was also busy, getting a few networking-related things fixed and improved in the base system</li>
<li>He wrote a few new small additions for dhclient and beefed up the privsep security, as well as some fixes for tcpdump and dhcpd</li>
<li>The fdisk tool also got worked on a bit, enabling OpenBSD to properly wipe GPT tables on a previously-formatted disk so you can do a normal install on it</li>
<li>There&#39;s apparently plans for &quot;dhclientng&quot; - presumably a big improvement (rewrite?) of dhclient
***</li>
</ul>

<h3><a href="https://www.youtube.com/user/bsdtutorial/videos" rel="nofollow">FreeBSD beginner video series</a></h3>

<ul>
<li>A new series of videos has started on YouTube, aimed at helping total beginners learn about FreeBSD</li>
<li>We usually assume that people who watch the show are already familiar with basic concepts, but they&#39;d be a great introduction to any of your friends that are looking to get started with BSD and need a helping hand</li>
<li>So far, he&#39;s covered <a href="https://www.youtube.com/watch?v=D26rOHkI-iE" rel="nofollow">how to get FreeBSD</a>, <a href="https://www.youtube.com/watch?v=PCyYW19bPDU" rel="nofollow">an introduction to installing in VirtualBox</a>, <a href="https://www.youtube.com/watch?v=HCE89kObutA" rel="nofollow">a simple installation</a> or a more in-depth <a href="https://www.youtube.com/watch?v=OwqCjz9Fgao" rel="nofollow">manual installation</a>, <a href="https://www.youtube.com/watch?v=6YJhdOGjN50" rel="nofollow">navigating the filesystem</a>, <a href="https://www.youtube.com/watch?v=Yl5Bg2qz21I" rel="nofollow">basic ssh use</a>, <a href="https://www.youtube.com/watch?v=ioB73i7QUjI" rel="nofollow">managing users and groups</a> and finally some <a href="https://www.youtube.com/watch?v=VxxbO-gt9FA" rel="nofollow">basic editing</a> <a href="https://www.youtube.com/watch?v=16FNtCj-uS4" rel="nofollow">with vi</a> and a few other topics</li>
<li>Everyone&#39;s gotta start somewhere and, with a little bit of initial direction, today&#39;s newbies could be tomorrow&#39;s developers</li>
<li>It should be an ongoing series with more topics to come
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/regular_test_runs_down_to" rel="nofollow">NetBSD tests: zero unexpected failures</a></h3>

<ul>
<li>The NetBSD guys have a new blog post up about their <a href="http://wiki.netbsd.org/tutorials/atf/" rel="nofollow">testing suite</a> for all the CPU architectures</li>
<li>They&#39;ve finally gotten the number of &quot;expected&quot; failures down to zero on a few select architectures</li>
<li>Results are <a href="http://releng.netbsd.org/test-results.html" rel="nofollow">published</a> on a special release engineering page, so you can have a look if you&#39;re interested</li>
<li>The rest of the post links to the &quot;top performers&quot; (ones with less than ten failure) in the -current branch
***</li>
</ul>

<h3><a href="https://github.com/pcbsd/pcbsd/commit/b80f78d8a5d002396c28ac0e5fd6f69699beaace" rel="nofollow">PCBSD switches to IPFW</a></h3>

<ul>
<li>The PCBSD crew continues their recent series of switching between major competing features</li>
<li>This time, they&#39;ve switched the default firewall away from PF to FreeBSD&#39;s native IPFW firewall</li>
<li>Look forward to Kris wearing a &quot;keep calm and use IPFW&quot; shir- wait
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21U6Ln6wC" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s2Kp0xdfIb" rel="nofollow">Dan writes in</a></li>
<li><a href="http://slexy.org/view/s216DcA8DP" rel="nofollow">Florian writes in</a></li>
<li><a href="http://slexy.org/view/s271iJjqtQ" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s21zerHI9P" rel="nofollow">Chris writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-misc&m=142454205416445&w=2" rel="nofollow">VCS flamebait</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-gnome/2015-February/031561.html" rel="nofollow">Hidden agenda</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>77: Noah's L2ARC</title>
  <link>https://www.bsdnow.tv/77</link>
  <guid isPermaLink="false">7f831a01-7c9e-48e5-8400-717e0198fc07</guid>
  <pubDate>Wed, 18 Feb 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7f831a01-7c9e-48e5-8400-717e0198fc07.mp3" length="62093524" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we'll be chatting with Alex Reece and Matt Ahrens about what's new in the world of OpenZFS. After that, we're starting a new tutorial series on submitting your first patch. All the latest BSD news and answers to your emails, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:26:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we'll be chatting with Alex Reece and Matt Ahrens about what's new in the world of OpenZFS. After that, we're starting a new tutorial series on submitting your first patch. All the latest BSD news and answers to your emails, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Revisiting FreeBSD after 20 years (http://changelog.complete.org/archives/9317-has-linux-lost-its-way-comments-prompt-a-debian-developer-to-revisit-freebsd-after-20-years)
With comments like "has Linux lost its way?" floating around, a Debian developer was prompted to revisit FreeBSD after nearly two decades
This blog post goes through his experiences trying out a modern BSD variant, and includes the good, the bad and the ugly - not just praise this time
He loves ZFS and the beadm tool, and finds the FreeBSD implementation to be much more stable than ZoL
On the topic of jails, he summarizes: "Linux has tried so hard to get this right, and fallen on its face so many times, a person just wants to take pity sometimes. We’ve had linux-vserver, openvz, lxc, and still none of them match what FreeBSD jails have done for a long time."
The post also goes through the "just plain different" aspects of a complete OS vs. a distribution of various things pieced together
Finally, he includes some things he wasn't so happy about: subpar laptop support, virtualization being a bit behind, a myriad of complaints about pkgng and a few other things
There was some decent discussion (https://news.ycombinator.com/item?id=9063216) on Hacker News about this article too, with counterpoints from both sides
***
s2k15 hackathon report: network stack SMP (http://undeadly.org/cgi?action=article&amp;amp;sid=20150218085759)
The first trip report from the recent OpenBSD hackathon in Australia has finally been submitted
One of the themes of this hackathon was SMP (symmetric multiprocessing) improvement, and Martin Pieuchot did some hacking on the network stack
If you're not familiar with him, he gave a presentation (http://www.openbsd.org/papers/tamingdragons.pdf) at EuroBSDCon last year, titled Taming OpenBSD Network Stack Dragons (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/03.Taming%20OpenBSD%20Network%20Stack%20Dragons%20-%20Martin%20Pieuchot.mp4)
Teaming up with David Gwynne, they worked on getting some bits of the networking code out of the big lock (https://en.wikipedia.org/wiki/Giant_lock)
Hopefully more trip reports will be sent in during the coming weeks
Most of the big code changes should probably appear after the 5.7-release testing period
***
From BIND to NSD and Unbound (https://www.tumfatig.net/20150215/bind-nsd-unbound-openbsd-5-6/)
If you've been running a DNS server on any of the BSDs, you've probably noticed a semi-recent trend: BIND being replaced with Unbound
BIND was ripped out in FreeBSD 10.0 and will be gone in OpenBSD 5.7, but both systems include Unbound now as an alternative
OpenBSD goes a step further, also including NSD in the base system, whereas you'll need to install that from ports on FreeBSD
Instead of one daemon doing everything like BIND tried to do, this new setup splits the authoritative nameserver and the caching resolver into two separate daemons 
This post takes you through the transitional phase of going from a single BIND setup to a combination of NSD and Unbound
All in all, everyone wins here, as there will be a lot less security advisories in both BSDs because of it...
***
m0n0wall calls it quits (http://m0n0.ch/wall/end_announcement.php)
The original, classic BSD firewall distribution m0n0wall (https://en.wikipedia.org/wiki/M0n0wall) has finally decided to close up shop
For those unfamiliar, m0n0wall was a FreeBSD-based firewall project that put a lot of focus on embedded devices: running from a CF card, CD, USB drive or even a floppy disk
It started over twelve years ago, which is pretty amazing when you consider that's around half of FreeBSD itself's lifespan
The project was probably a lot of people's first encounter with BSD in any form
If you were a m0n0wall user, fear not, you've got plenty of choices for a potential replacement: doing it yourself with something like FreeBSD (http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/) or OpenBSD (http://www.bsdnow.tv/tutorials/openbsd-router), or going the premade route with something like pfSense (http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense), OPNsense (http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach) or the BSD Router Project (http://www.bsdnow.tv/episodes/2014_10_22-dont_buy_a_router)
The founder's announcement includes these closing words: "m0n0wall has served as the seed for several other well known open source projects, like pfSense, FreeNAS and AskoziaPBX. The newest offspring, OPNsense, aims to continue the open source spirit of m0n0wall while updating the technology to be ready for the future. In my view, it is the perfect way to bring the m0n0wall idea into 2015, and I encourage all current m0n0wall users to check out OPNsense and contribute if they can."
While m0n0wall didn't get a lot of on-air mention, surely a lot of our listeners will remember it fondly
***
Interview - Alex Reece &amp;amp; Matt Ahrens - alex@delphix.com (mailto:alex@delphix.com) &amp;amp; matt@delphix.com (mailto:matt@delphix.com) / @openzfs (https://twitter.com/openzfs)
What's new in OpenZFS
Tutorial
Making your first patch (OpenBSD) (http://www.bsdnow.tv/tutorials/patching-obsd)
News Roundup
Overlaying remote LANs with OpenBSD's VXLAN (http://www.echothrust.com/blogs/using-openbsd-and-vxlan-overlay-remote-lans)
Have you ever wanted to "merge" multiple remote LANs? OpenBSD's vxlan(4) (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/vxlan.4) is exactly what you need
This article talks about using it to connect two virtualized infrastructures on different ESXi servers
It gives a bit of networking background first, in case you're not quite up to speed on all this stuff
This tool opens up a lot of very cool possibilities, even possibly doing a "remote" LAN party
Be sure to check the AsiaBSDCon talk (https://www.youtube.com/watch?v=ufeEP_hzFN0) about VXLANs if you haven't already
***
2020, year of the PCBSD desktop (http://lukewolf.blogspot.com/2015/02/a-prediction-2020-year-of-pc-bsd-on.html)
Here we have a blog post about BSD on the desktop, straight from a KDE developer
He predicts that PCBSD is going to take off before the year 2020, possibly even overtaking Linux's desktop market share (small as it may be)
With PCBSD making a preconfigured FreeBSD desktop a reality, and the new KMS work, the author is impressed with how far BSD has come as a viable desktop option
ZFS and easy-to-use boot environments top the list of things he says differentiate the BSD desktop experience from the Linux one
There was also some discussion on Slashdot (http://bsd.slashdot.org/story/15/02/16/2355236/pc-bsd-set-for-serious-growth) that might be worth reading
***
OpenSSH host key rotation, redux (http://blog.djm.net.au/2015/02/hostkey-rotation-redux.html)
We mentioned the new OpenSSH host key rotation and other goodies in a previous episode (http://www.bsdnow.tv/episodes/2015_02_04-from_the_foundation_1), but things have changed a little bit since then
djm (http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline) says "almost immediately after smugly declaring 'mission accomplished', the bug reports started rolling in."
There were some initial complaints from developers about the new options, and a serious bug shortly thereafter
After going back to the drawing board, he refactored some of the new code (and API) and added some more regression tests
Most importantly, the bigger big fix was described as: "a malicious server (say, "host-a") could advertise the public key of another server (say, "host-b"). Then, when the client subsequently connects back to host-a, instead of answering the connection as usual itself, host-a could proxy the connection to host-b. This would cause the user to connect to host-b when they think they are connecting to host-a, which is a violation of the authentication the host key is supposed to provide."
None of this code has been in a formal OpenSSH release just yet, but hopefully it will soon
***
PCBSD tries out LibreSSL (https://github.com/pcbsd/pcbsd/commit/6ede13117dcee1272d7a7060b16818506874286e)
PCBSD users may soon be seeing a lot less security problems because of two recent changes
After switching over to OpenNTPD last week (http://www.bsdnow.tv/episodes/2015_02_11-time_for_a_change), PCBSD decides to give the portable LibreSSL (http://www.bsdnow.tv/episodes/2014_07_30-liberating_ssl) a try too
Note that this is only for the packages built from ports, not the base system unfortunately
They're not the first ones to do this - OPNsense has been experimenting with replacing OpenSSL in their ports tree for a little while now, and of course all of OpenBSD's ports are built against it
A good number of patches (https://github.com/pcbsd/freebsd-ports/commit/2eee669f4d6ab9a641162ecda29b62ab921438eb) are still not committed in vanilla FreeBSD ports, so they had to borrow some from Bugzilla
Look forward to Kris wearing a "keep calm and abandon OpenSSL (https://www.openbsdstore.com/cgi-bin/live/ecommerce.pl?site=shop_openbsdeurope_com&amp;amp;state=item&amp;amp;dept_id=01&amp;amp;sub_dept_id=01&amp;amp;product_id=TSHIRTOSSL)" shirt in the near future
***
Feedback/Questions
Benjamin writes in (http://slexy.org/view/s28nyJ5omV)
Mike writes in (http://slexy.org/view/s2wYUmUmh0)
Brad writes in (http://slexy.org/view/s2BAKAQvMt)
***
Mailing List Gold
Debian (https://lists.freebsd.org/pipermail/svn-src-head/2015-February/068405.html) Dejavu (https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054580.html)
Package gone missing (http://lists.dragonflybsd.org/pipermail/users/2015-February/207475.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, zfs, raid, openzfs, illumos, solaris, openindiana, opensolaris, omnios, smartos, m0n0wall, opnsense, rng, libressl</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we&#39;ll be chatting with Alex Reece and Matt Ahrens about what&#39;s new in the world of OpenZFS. After that, we&#39;re starting a new tutorial series on submitting your first patch. All the latest BSD news and answers to your emails, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://changelog.complete.org/archives/9317-has-linux-lost-its-way-comments-prompt-a-debian-developer-to-revisit-freebsd-after-20-years" rel="nofollow">Revisiting FreeBSD after 20 years</a></h3>

<ul>
<li>With comments like &quot;has Linux lost its way?&quot; floating around, a Debian developer was prompted to revisit FreeBSD after nearly two decades</li>
<li>This blog post goes through his experiences trying out a modern BSD variant, and includes the good, the bad and the ugly - not just praise this time</li>
<li>He loves ZFS and the beadm tool, and finds the FreeBSD implementation to be much more stable than ZoL</li>
<li>On the topic of jails, he summarizes: &quot;Linux has tried so hard to get this right, and fallen on its face so many times, a person just wants to take pity sometimes. We’ve had linux-vserver, openvz, lxc, and still none of them match what FreeBSD jails have done for a long time.&quot;</li>
<li>The post also goes through the &quot;just plain different&quot; aspects of a complete OS vs. a distribution of various things pieced together</li>
<li>Finally, he includes some things he wasn&#39;t so happy about: subpar laptop support, virtualization being a bit behind, a <em>myriad</em> of complaints about pkgng and a few other things</li>
<li>There was some <a href="https://news.ycombinator.com/item?id=9063216" rel="nofollow">decent discussion</a> on Hacker News about this article too, with counterpoints from both sides
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150218085759" rel="nofollow">s2k15 hackathon report: network stack SMP</a></h3>

<ul>
<li>The first trip report from the recent OpenBSD hackathon in Australia has finally been submitted</li>
<li>One of the themes of this hackathon was SMP (symmetric multiprocessing) improvement, and Martin Pieuchot did some hacking on the network stack</li>
<li>If you&#39;re not familiar with him, he gave a <a href="http://www.openbsd.org/papers/tamingdragons.pdf" rel="nofollow">presentation</a> at EuroBSDCon last year, titled <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/03.Taming%20OpenBSD%20Network%20Stack%20Dragons%20-%20Martin%20Pieuchot.mp4" rel="nofollow">Taming OpenBSD Network Stack Dragons</a></li>
<li>Teaming up with David Gwynne, they worked on getting some bits of the networking code out of the <a href="https://en.wikipedia.org/wiki/Giant_lock" rel="nofollow">big lock</a></li>
<li>Hopefully more trip reports will be sent in during the coming weeks</li>
<li>Most of the big code changes should probably appear after the 5.7-release testing period
***</li>
</ul>

<h3><a href="https://www.tumfatig.net/20150215/bind-nsd-unbound-openbsd-5-6/" rel="nofollow">From BIND to NSD and Unbound</a></h3>

<ul>
<li>If you&#39;ve been running a DNS server on any of the BSDs, you&#39;ve probably noticed a semi-recent trend: BIND being replaced with Unbound</li>
<li>BIND was ripped out in FreeBSD 10.0 and will be gone in OpenBSD 5.7, but both systems include Unbound now as an alternative</li>
<li>OpenBSD goes a step further, also including NSD in the base system, whereas you&#39;ll need to install that from ports on FreeBSD</li>
<li>Instead of one daemon doing everything like BIND tried to do, this new setup splits the authoritative nameserver and the caching resolver into two separate daemons </li>
<li>This post takes you through the transitional phase of going from a single BIND setup to a combination of NSD and Unbound</li>
<li>All in all, everyone wins here, as there will be a lot less security advisories in both BSDs because of it...
***</li>
</ul>

<h3><a href="http://m0n0.ch/wall/end_announcement.php" rel="nofollow">m0n0wall calls it quits</a></h3>

<ul>
<li>The original, classic BSD firewall distribution <a href="https://en.wikipedia.org/wiki/M0n0wall" rel="nofollow">m0n0wall</a> has finally decided to close up shop</li>
<li>For those unfamiliar, m0n0wall was a FreeBSD-based firewall project that put a lot of focus on embedded devices: running from a CF card, CD, USB drive or <strong>even a floppy disk</strong></li>
<li>It started over twelve years ago, which is pretty amazing when you consider that&#39;s around half of FreeBSD itself&#39;s lifespan</li>
<li>The project was probably a lot of people&#39;s first encounter with BSD in any form</li>
<li>If you were a m0n0wall user, fear not, you&#39;ve got <em>plenty</em> of choices for a potential replacement: doing it yourself with something like <a href="http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/" rel="nofollow">FreeBSD</a> or <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">OpenBSD</a>, or going the premade route with something like <a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">pfSense</a>, <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">OPNsense</a> or the <a href="http://www.bsdnow.tv/episodes/2014_10_22-dont_buy_a_router" rel="nofollow">BSD Router Project</a></li>
<li>The founder&#39;s announcement includes these closing words: &quot;m0n0wall has served as the seed for several other well known open source projects, like pfSense, FreeNAS and AskoziaPBX. The newest offspring, OPNsense, aims to continue the open source spirit of m0n0wall while updating the technology to be ready for the future. In my view, it is the perfect way to bring the m0n0wall idea into 2015, and I encourage all current m0n0wall users to check out OPNsense and contribute if they can.&quot;</li>
<li>While m0n0wall didn&#39;t get a lot of on-air mention, surely a lot of our listeners will remember it fondly
***</li>
</ul>

<h2>Interview - Alex Reece &amp; Matt Ahrens - <a href="mailto:alex@delphix.com" rel="nofollow">alex@delphix.com</a> &amp; <a href="mailto:matt@delphix.com" rel="nofollow">matt@delphix.com</a> / <a href="https://twitter.com/openzfs" rel="nofollow">@openzfs</a></h2>

<p>What&#39;s new in OpenZFS</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/patching-obsd" rel="nofollow">Making your first patch (OpenBSD)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.echothrust.com/blogs/using-openbsd-and-vxlan-overlay-remote-lans" rel="nofollow">Overlaying remote LANs with OpenBSD&#39;s VXLAN</a></h3>

<ul>
<li>Have you ever wanted to &quot;merge&quot; multiple remote LANs? OpenBSD&#39;s <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/vxlan.4" rel="nofollow">vxlan(4)</a> is exactly what you need</li>
<li>This article talks about using it to connect two virtualized infrastructures on different ESXi servers</li>
<li>It gives a bit of networking background first, in case you&#39;re not quite up to speed on all this stuff</li>
<li>This tool opens up a lot of very cool possibilities, even possibly doing a &quot;remote&quot; LAN party</li>
<li>Be sure to check the <a href="https://www.youtube.com/watch?v=ufeEP_hzFN0" rel="nofollow">AsiaBSDCon talk</a> about VXLANs if you haven&#39;t already
***</li>
</ul>

<h3><a href="http://lukewolf.blogspot.com/2015/02/a-prediction-2020-year-of-pc-bsd-on.html" rel="nofollow">2020, year of the PCBSD desktop</a></h3>

<ul>
<li>Here we have a blog post about BSD on the desktop, straight from a KDE developer</li>
<li>He predicts that PCBSD is going to take off before the year 2020, possibly even overtaking Linux&#39;s desktop market share (small as it may be)</li>
<li>With PCBSD making a preconfigured FreeBSD desktop a reality, and the new KMS work, the author is impressed with how far BSD has come as a viable desktop option</li>
<li>ZFS and easy-to-use boot environments top the list of things he says differentiate the BSD desktop experience from the Linux one</li>
<li>There was also some <a href="http://bsd.slashdot.org/story/15/02/16/2355236/pc-bsd-set-for-serious-growth" rel="nofollow">discussion on Slashdot</a> that might be worth reading
***</li>
</ul>

<h3><a href="http://blog.djm.net.au/2015/02/hostkey-rotation-redux.html" rel="nofollow">OpenSSH host key rotation, redux</a></h3>

<ul>
<li>We mentioned the new OpenSSH host key rotation and other goodies in <a href="http://www.bsdnow.tv/episodes/2015_02_04-from_the_foundation_1" rel="nofollow">a previous episode</a>, but things have changed a little bit since then</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">djm</a> says &quot;almost immediately after smugly declaring &#39;mission accomplished&#39;, the bug reports started rolling in.&quot;</li>
<li>There were some initial complaints from developers about the new options, and a serious bug shortly thereafter</li>
<li>After going back to the drawing board, he refactored some of the new code (and API) and added some more regression tests</li>
<li>Most importantly, the bigger big fix was described as: &quot;a malicious server (say, &quot;host-a&quot;) could advertise the public key of another server (say, &quot;host-b&quot;). Then, when the client subsequently connects back to host-a, instead of answering the connection as usual itself, host-a could proxy the connection to host-b. This would cause the user to connect to host-b when they think they are connecting to host-a, which is a violation of the authentication the host key is supposed to provide.&quot;</li>
<li>None of this code has been in a formal OpenSSH release just yet, but hopefully it will soon
***</li>
</ul>

<h3><a href="https://github.com/pcbsd/pcbsd/commit/6ede13117dcee1272d7a7060b16818506874286e" rel="nofollow">PCBSD tries out LibreSSL</a></h3>

<ul>
<li>PCBSD users may soon be seeing a lot less security problems because of two recent changes</li>
<li>After switching over to OpenNTPD <a href="http://www.bsdnow.tv/episodes/2015_02_11-time_for_a_change" rel="nofollow">last week</a>, PCBSD decides to give the <a href="http://www.bsdnow.tv/episodes/2014_07_30-liberating_ssl" rel="nofollow">portable LibreSSL</a> a try too</li>
<li>Note that this is only for the packages built from ports, not the base system unfortunately</li>
<li>They&#39;re not the first ones to do this - OPNsense has been experimenting with replacing OpenSSL in their ports tree for a little while now, and of course all of OpenBSD&#39;s ports are built against it</li>
<li>A good <a href="https://github.com/pcbsd/freebsd-ports/commit/2eee669f4d6ab9a641162ecda29b62ab921438eb" rel="nofollow">number of patches</a> are still not committed in vanilla FreeBSD ports, so they had to borrow some from Bugzilla</li>
<li>Look forward to Kris wearing a &quot;<a href="https://www.openbsdstore.com/cgi-bin/live/ecommerce.pl?site=shop_openbsdeurope_com&state=item&dept_id=01&sub_dept_id=01&product_id=TSHIRTOSSL" rel="nofollow">keep calm and abandon OpenSSL</a>&quot; shirt in the near future
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s28nyJ5omV" rel="nofollow">Benjamin writes in</a></li>
<li><a href="http://slexy.org/view/s2wYUmUmh0" rel="nofollow">Mike writes in</a></li>
<li><a href="http://slexy.org/view/s2BAKAQvMt" rel="nofollow">Brad writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-February/068405.html" rel="nofollow">Debian</a> <a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054580.html" rel="nofollow">Dejavu</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2015-February/207475.html" rel="nofollow">Package gone missing</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we&#39;ll be chatting with Alex Reece and Matt Ahrens about what&#39;s new in the world of OpenZFS. After that, we&#39;re starting a new tutorial series on submitting your first patch. All the latest BSD news and answers to your emails, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://changelog.complete.org/archives/9317-has-linux-lost-its-way-comments-prompt-a-debian-developer-to-revisit-freebsd-after-20-years" rel="nofollow">Revisiting FreeBSD after 20 years</a></h3>

<ul>
<li>With comments like &quot;has Linux lost its way?&quot; floating around, a Debian developer was prompted to revisit FreeBSD after nearly two decades</li>
<li>This blog post goes through his experiences trying out a modern BSD variant, and includes the good, the bad and the ugly - not just praise this time</li>
<li>He loves ZFS and the beadm tool, and finds the FreeBSD implementation to be much more stable than ZoL</li>
<li>On the topic of jails, he summarizes: &quot;Linux has tried so hard to get this right, and fallen on its face so many times, a person just wants to take pity sometimes. We’ve had linux-vserver, openvz, lxc, and still none of them match what FreeBSD jails have done for a long time.&quot;</li>
<li>The post also goes through the &quot;just plain different&quot; aspects of a complete OS vs. a distribution of various things pieced together</li>
<li>Finally, he includes some things he wasn&#39;t so happy about: subpar laptop support, virtualization being a bit behind, a <em>myriad</em> of complaints about pkgng and a few other things</li>
<li>There was some <a href="https://news.ycombinator.com/item?id=9063216" rel="nofollow">decent discussion</a> on Hacker News about this article too, with counterpoints from both sides
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20150218085759" rel="nofollow">s2k15 hackathon report: network stack SMP</a></h3>

<ul>
<li>The first trip report from the recent OpenBSD hackathon in Australia has finally been submitted</li>
<li>One of the themes of this hackathon was SMP (symmetric multiprocessing) improvement, and Martin Pieuchot did some hacking on the network stack</li>
<li>If you&#39;re not familiar with him, he gave a <a href="http://www.openbsd.org/papers/tamingdragons.pdf" rel="nofollow">presentation</a> at EuroBSDCon last year, titled <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/03.Taming%20OpenBSD%20Network%20Stack%20Dragons%20-%20Martin%20Pieuchot.mp4" rel="nofollow">Taming OpenBSD Network Stack Dragons</a></li>
<li>Teaming up with David Gwynne, they worked on getting some bits of the networking code out of the <a href="https://en.wikipedia.org/wiki/Giant_lock" rel="nofollow">big lock</a></li>
<li>Hopefully more trip reports will be sent in during the coming weeks</li>
<li>Most of the big code changes should probably appear after the 5.7-release testing period
***</li>
</ul>

<h3><a href="https://www.tumfatig.net/20150215/bind-nsd-unbound-openbsd-5-6/" rel="nofollow">From BIND to NSD and Unbound</a></h3>

<ul>
<li>If you&#39;ve been running a DNS server on any of the BSDs, you&#39;ve probably noticed a semi-recent trend: BIND being replaced with Unbound</li>
<li>BIND was ripped out in FreeBSD 10.0 and will be gone in OpenBSD 5.7, but both systems include Unbound now as an alternative</li>
<li>OpenBSD goes a step further, also including NSD in the base system, whereas you&#39;ll need to install that from ports on FreeBSD</li>
<li>Instead of one daemon doing everything like BIND tried to do, this new setup splits the authoritative nameserver and the caching resolver into two separate daemons </li>
<li>This post takes you through the transitional phase of going from a single BIND setup to a combination of NSD and Unbound</li>
<li>All in all, everyone wins here, as there will be a lot less security advisories in both BSDs because of it...
***</li>
</ul>

<h3><a href="http://m0n0.ch/wall/end_announcement.php" rel="nofollow">m0n0wall calls it quits</a></h3>

<ul>
<li>The original, classic BSD firewall distribution <a href="https://en.wikipedia.org/wiki/M0n0wall" rel="nofollow">m0n0wall</a> has finally decided to close up shop</li>
<li>For those unfamiliar, m0n0wall was a FreeBSD-based firewall project that put a lot of focus on embedded devices: running from a CF card, CD, USB drive or <strong>even a floppy disk</strong></li>
<li>It started over twelve years ago, which is pretty amazing when you consider that&#39;s around half of FreeBSD itself&#39;s lifespan</li>
<li>The project was probably a lot of people&#39;s first encounter with BSD in any form</li>
<li>If you were a m0n0wall user, fear not, you&#39;ve got <em>plenty</em> of choices for a potential replacement: doing it yourself with something like <a href="http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/" rel="nofollow">FreeBSD</a> or <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">OpenBSD</a>, or going the premade route with something like <a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">pfSense</a>, <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">OPNsense</a> or the <a href="http://www.bsdnow.tv/episodes/2014_10_22-dont_buy_a_router" rel="nofollow">BSD Router Project</a></li>
<li>The founder&#39;s announcement includes these closing words: &quot;m0n0wall has served as the seed for several other well known open source projects, like pfSense, FreeNAS and AskoziaPBX. The newest offspring, OPNsense, aims to continue the open source spirit of m0n0wall while updating the technology to be ready for the future. In my view, it is the perfect way to bring the m0n0wall idea into 2015, and I encourage all current m0n0wall users to check out OPNsense and contribute if they can.&quot;</li>
<li>While m0n0wall didn&#39;t get a lot of on-air mention, surely a lot of our listeners will remember it fondly
***</li>
</ul>

<h2>Interview - Alex Reece &amp; Matt Ahrens - <a href="mailto:alex@delphix.com" rel="nofollow">alex@delphix.com</a> &amp; <a href="mailto:matt@delphix.com" rel="nofollow">matt@delphix.com</a> / <a href="https://twitter.com/openzfs" rel="nofollow">@openzfs</a></h2>

<p>What&#39;s new in OpenZFS</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/patching-obsd" rel="nofollow">Making your first patch (OpenBSD)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.echothrust.com/blogs/using-openbsd-and-vxlan-overlay-remote-lans" rel="nofollow">Overlaying remote LANs with OpenBSD&#39;s VXLAN</a></h3>

<ul>
<li>Have you ever wanted to &quot;merge&quot; multiple remote LANs? OpenBSD&#39;s <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/vxlan.4" rel="nofollow">vxlan(4)</a> is exactly what you need</li>
<li>This article talks about using it to connect two virtualized infrastructures on different ESXi servers</li>
<li>It gives a bit of networking background first, in case you&#39;re not quite up to speed on all this stuff</li>
<li>This tool opens up a lot of very cool possibilities, even possibly doing a &quot;remote&quot; LAN party</li>
<li>Be sure to check the <a href="https://www.youtube.com/watch?v=ufeEP_hzFN0" rel="nofollow">AsiaBSDCon talk</a> about VXLANs if you haven&#39;t already
***</li>
</ul>

<h3><a href="http://lukewolf.blogspot.com/2015/02/a-prediction-2020-year-of-pc-bsd-on.html" rel="nofollow">2020, year of the PCBSD desktop</a></h3>

<ul>
<li>Here we have a blog post about BSD on the desktop, straight from a KDE developer</li>
<li>He predicts that PCBSD is going to take off before the year 2020, possibly even overtaking Linux&#39;s desktop market share (small as it may be)</li>
<li>With PCBSD making a preconfigured FreeBSD desktop a reality, and the new KMS work, the author is impressed with how far BSD has come as a viable desktop option</li>
<li>ZFS and easy-to-use boot environments top the list of things he says differentiate the BSD desktop experience from the Linux one</li>
<li>There was also some <a href="http://bsd.slashdot.org/story/15/02/16/2355236/pc-bsd-set-for-serious-growth" rel="nofollow">discussion on Slashdot</a> that might be worth reading
***</li>
</ul>

<h3><a href="http://blog.djm.net.au/2015/02/hostkey-rotation-redux.html" rel="nofollow">OpenSSH host key rotation, redux</a></h3>

<ul>
<li>We mentioned the new OpenSSH host key rotation and other goodies in <a href="http://www.bsdnow.tv/episodes/2015_02_04-from_the_foundation_1" rel="nofollow">a previous episode</a>, but things have changed a little bit since then</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">djm</a> says &quot;almost immediately after smugly declaring &#39;mission accomplished&#39;, the bug reports started rolling in.&quot;</li>
<li>There were some initial complaints from developers about the new options, and a serious bug shortly thereafter</li>
<li>After going back to the drawing board, he refactored some of the new code (and API) and added some more regression tests</li>
<li>Most importantly, the bigger big fix was described as: &quot;a malicious server (say, &quot;host-a&quot;) could advertise the public key of another server (say, &quot;host-b&quot;). Then, when the client subsequently connects back to host-a, instead of answering the connection as usual itself, host-a could proxy the connection to host-b. This would cause the user to connect to host-b when they think they are connecting to host-a, which is a violation of the authentication the host key is supposed to provide.&quot;</li>
<li>None of this code has been in a formal OpenSSH release just yet, but hopefully it will soon
***</li>
</ul>

<h3><a href="https://github.com/pcbsd/pcbsd/commit/6ede13117dcee1272d7a7060b16818506874286e" rel="nofollow">PCBSD tries out LibreSSL</a></h3>

<ul>
<li>PCBSD users may soon be seeing a lot less security problems because of two recent changes</li>
<li>After switching over to OpenNTPD <a href="http://www.bsdnow.tv/episodes/2015_02_11-time_for_a_change" rel="nofollow">last week</a>, PCBSD decides to give the <a href="http://www.bsdnow.tv/episodes/2014_07_30-liberating_ssl" rel="nofollow">portable LibreSSL</a> a try too</li>
<li>Note that this is only for the packages built from ports, not the base system unfortunately</li>
<li>They&#39;re not the first ones to do this - OPNsense has been experimenting with replacing OpenSSL in their ports tree for a little while now, and of course all of OpenBSD&#39;s ports are built against it</li>
<li>A good <a href="https://github.com/pcbsd/freebsd-ports/commit/2eee669f4d6ab9a641162ecda29b62ab921438eb" rel="nofollow">number of patches</a> are still not committed in vanilla FreeBSD ports, so they had to borrow some from Bugzilla</li>
<li>Look forward to Kris wearing a &quot;<a href="https://www.openbsdstore.com/cgi-bin/live/ecommerce.pl?site=shop_openbsdeurope_com&state=item&dept_id=01&sub_dept_id=01&product_id=TSHIRTOSSL" rel="nofollow">keep calm and abandon OpenSSL</a>&quot; shirt in the near future
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s28nyJ5omV" rel="nofollow">Benjamin writes in</a></li>
<li><a href="http://slexy.org/view/s2wYUmUmh0" rel="nofollow">Mike writes in</a></li>
<li><a href="http://slexy.org/view/s2BAKAQvMt" rel="nofollow">Brad writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-February/068405.html" rel="nofollow">Debian</a> <a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054580.html" rel="nofollow">Dejavu</a></li>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2015-February/207475.html" rel="nofollow">Package gone missing</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>76: Time for a Change</title>
  <link>https://www.bsdnow.tv/76</link>
  <guid isPermaLink="false">b872a625-f3d6-477b-b162-fd4248aef998</guid>
  <pubDate>Wed, 11 Feb 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b872a625-f3d6-477b-b162-fd4248aef998.mp3" length="64285204" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week, we'll be talking to Henning Brauer about OpenNTPD and its recently revived portable version. After that, we'll be discussing different ways to securely tunnel your traffic: specifically OpenVPN, IPSEC, SSH and Tor. All that and the latest news, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:29:17</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week, we'll be talking to Henning Brauer about OpenNTPD and its recently revived portable version. After that, we'll be discussing different ways to securely tunnel your traffic: specifically OpenVPN, IPSEC, SSH and Tor. All that and the latest news, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Strange timer bug in FreeBSD 11 (https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054295.html)
Peter Wemm (http://www.bsdnow.tv/episodes/2014_09_24-beastly_infrastructure) wrote in to the FreeBSD -CURRENT mailing list with an interesting observation
Running the latest development code in the infrastructure, the clock would stop keeping time after 24 days of uptime
This meant things like cron and sleep would break, TCP/IP wouldn't time out or resend packets, a lot of things would break
A workaround until it was fixed was to reboot every 24 days, but this is BSD we're talking about - uptime is our game
An initial proposal was adding a CFLAG to the build options which makes makes signed arithmetic wrap
Peter disagreed and gave some background (https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054320.html), offering a different patch to fix (https://lists.freebsd.org/pipermail/svn-src-head/2015-February/067827.html) the issue and detect it early (https://lists.freebsd.org/pipermail/svn-src-head/2015-February/067828.html) if it happens again
Ultimately, the problem was traced back to an issue with a recent clang import
It only affected -CURRENT, not -RELEASE or -STABLE, but was definitely a bizarre bug to track down
***
An OpenBSD mail server (http://technoquarter.blogspot.com/p/series.html)
There's been a recent influx of blog posts about building a BSD mail server for some reason
In this fancy series of posts, the author sets up OpenSMTPD in its native OpenBSD home, whereas previous posts have been aimed at FreeBSD and Linux
In addition to the usual steps, this one also covers DKIMproxy, ClamAV for scanning attachments, Dovecot for IMAP and also multiple choices of spam filtering: spamd or SpamAssassin
It also shows you how to set up Roundcube for building a web interface, using the new in-base httpd
That means this is more of a "complete solution" - right down to what the end users see
The series is split up into categories so it's very easy to follow along step-by-step
***
How DragonFlyBSD uses git (http://lists.dragonflybsd.org/pipermail/users/2015-January/207421.html)
DragonFlyBSD, along with PCBSD and EdgeBSD, uses git as its version control system for the system source code
In a series (http://lists.dragonflybsd.org/pipermail/users/2015-January/207422.html) of posts (http://lists.dragonflybsd.org/pipermail/users/2015-January/207424.html), Matthew Dillon (the project lead) details their internal setup
They're using vanilla git over ssh, with the developers' accounts set to git-only (no shell access)
The maintainers of the server are the only ones with shell access available
He also details how a cron job syncs from the master to a public box that anyone can check out code from
It would be interesting to hear about how other BSD projects manage their master source repository
***
Why not try PCBSD? (http://www.itwire.com/business-it-news/open-source/66900-fed-up-with-systemd-and-linux?-why-not-try-pc-bsd)
ITwire, another more mainstream tech site, published a recent article about switching to PCBSD
They interview a guy named Kris that we've never heard of before
In the article, they touch on how easy it can potentially be for Linux users looking to switch over to the BSD side - lots of applications are exactly the same
"With the growing adoption of systemd, dissatisfaction with Linux has reached proportions not seen in recent years, to the extent that people have started talking of switching to FreeBSD."
If you have some friends who complain to you about systemd all the time, this might be a good article to show them
***
Interview - Henning Brauer - henning@openbsd.org (mailto:henning@openbsd.org) / @henningbrauer (https://twitter.com/henningbrauer)
OpenNTPD (http://openntpd.org/) and its portable variant
News Roundup
Authenticated time in OpenNTPD (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142356166731390&amp;amp;w=2)
We recorded that interview with Henning just a few days ago, and it looks like part of it may be outdated already
While at the hackathon, some developers came up with an alternate way (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142355043928397&amp;amp;w=2) to get authenticated NTP responses
You can now add an HTTPS URL to your ntpd.conf in addition to the time server pool
OpenNTPD will query it (over TLS, with CA verification) and look at the date sent in the HTTPS header
It's not intended to be a direct time source, just a constraint to keep things within reason
If you receive regular NTP packets that are way off from the TLS packet, those will be discarded and the server(s) marked as invalid
Henning (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142363215730069&amp;amp;w=2) and Theo (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142363400330522&amp;amp;w=2) also weigh in to give some of the backstory on the idea
Lots more detail can be found in Reyk's email explaining the new feature (and it's optional of course)
***
NetBSD at Open Source Conference 2015 Oita and Hamanako (https://mail-index.netbsd.org/netbsd-advocacy/2015/02/08/msg000678.html)
It's been a while since we've featured one of these trip reports, but the Japanese NetBSD users group is still doing them
This time the conferences were in Oita and Hamanako (https://mail-index.netbsd.org/netbsd-advocacy/2015/02/11/msg000679.html), Japan
Machines running NetBSD included the CubieBoard2 Allwinner A20, Raspberry Pi and Banana Pi, Sharp NetWalker and a couple Zaurus devices
As always, they took lots of pictures from the event of NetBSD on all these weird machines
***
Poudriere in a jail (http://www.tobeannounced.org/2015/02/poudriere-in-a-jail/)
A common question we get about our poudriere tutorial (http://www.bsdnow.tv/tutorials/poudriere) is "how do I run it in a jail?" - this blog post is about exactly that
It takes you through the networking setup, zpool setup, nginx setup, making the jail and finally poking the right holes in the jail to allow poudriere to work its magic
***
Bruteblock, another way to stop bruteforce (http://easyos.net/articles/bsd/freebsd/bruteblock_protection_against_bruteforce_attacks_in_ssh)
We've mentioned a few different ways to stop ssh bruteforce attempts in the past: fail2ban, denyhosts, or even just with pf's built-in rate limiting
Bruteblock is a similar tool, but it's not just for ssh logins - it can do a number of other services
It can also work directly with IPFW, which is a plus if you're using that as your firewall
Add a few lines to your syslog.conf and bruteblock will get executed automatically
The rest of the article takes you through the different settings you can configure for blocking
***
New iwm(4) driver and cross-polination (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142325218626853&amp;amp;w=2)
The OpenBSD guys recently imported a new "iwm" driver for newer Intel 7260 wireless cards (commonly found in Thinkpads)
NetBSD wasted no time in porting it over (https://mail-index.netbsd.org/source-changes/2015/02/07/msg062979.html), giving a bit of interesting backstory
According to Antti Kantee (http://www.bsdnow.tv/episodes/2013_10_23-a_brief_intorduction), "it was created for OpenBSD by writing and porting a NetBSD driver which was developed in a rump kernel in Linux userspace"
Both projects would appreciate further testing if you have the hardware and can provide useful bug reports
Maybe FreeBSD and DragonFly will port it over too, or come up with something that's partially based on the code
***
PCBSD current images (http://blog.pcbsd.org/2015/02/pc-bsd-11-0-current-images-now-available/)
The first PCBSD -CURRENT images should be available this weekend
This image will be tagged 11.0-CURRENTFEB2015, with planned monthly updates
For the more adventurous this will allow testing both FreeBSD and PCBSD bleeding edge
***
Feedback/Questions
Antonio writes in (http://slexy.org/view/s2E4NbJwzs)
Richard writes in (http://slexy.org/view/s2FkxcSYKy)
Charlie writes in (http://slexy.org/view/s217EgA1JC)
Ben writes in (http://slexy.org/view/s21vlCbGDt)
***
Mailing List Gold
A systematic effort (https://lists.gnu.org/archive/html/emacs-devel/2015-02/msg00360.html)
GCC's lunch (https://lists.gnu.org/archive/html/emacs-devel/2015-02/msg00457.html)
Hopes and dreams (https://marc.info/?l=openbsd-cvs&amp;amp;m=142331891908776&amp;amp;w=2)
***
Discussion
Comparison of ways to securely tunnel your traffic
OpenVPN (https://openvpn.net/index.php/open-source.html), OpenBSD IKED (http://www.openiked.org/), FreeBSD IPSEC (https://www.freebsd.org/doc/handbook/ipsec.html), OpenSSH (http://www.openssh.com/), Tor (https://www.torproject.org/)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ntp, ntpd, ntimed, openntpd, time keeping, stratum, ipsec, openvpn, ssh, openiked, ike, tor, tunneling, bhws, afl-fuzz, opensmtpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week, we&#39;ll be talking to Henning Brauer about OpenNTPD and its recently revived portable version. After that, we&#39;ll be discussing different ways to securely tunnel your traffic: specifically OpenVPN, IPSEC, SSH and Tor. All that and the latest news, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054295.html" rel="nofollow">Strange timer bug in FreeBSD 11</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2014_09_24-beastly_infrastructure" rel="nofollow">Peter Wemm</a> wrote in to the FreeBSD -CURRENT mailing list with an interesting observation</li>
<li>Running the latest development code in the infrastructure, the clock would stop keeping time after 24 days of uptime</li>
<li>This meant things like cron and sleep would break, TCP/IP wouldn&#39;t time out or resend packets, a lot of things would break</li>
<li>A workaround until it was fixed was to reboot every 24 days, but this is BSD we&#39;re talking about - uptime is our game</li>
<li>An initial proposal was adding a CFLAG to the build options which makes makes signed arithmetic wrap</li>
<li>Peter disagreed and <a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054320.html" rel="nofollow">gave some background</a>, offering a different patch to <a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-February/067827.html" rel="nofollow">fix</a> the issue and <a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-February/067828.html" rel="nofollow">detect it early</a> if it happens again</li>
<li>Ultimately, the problem was traced back to an issue with a recent clang import</li>
<li>It only affected -CURRENT, not -RELEASE or -STABLE, but was definitely a bizarre bug to track down
***</li>
</ul>

<h3><a href="http://technoquarter.blogspot.com/p/series.html" rel="nofollow">An OpenBSD mail server</a></h3>

<ul>
<li>There&#39;s been a recent influx of blog posts about building a BSD mail server for some reason</li>
<li>In this fancy series of posts, the author sets up OpenSMTPD in its native OpenBSD home, whereas previous posts have been aimed at FreeBSD and Linux</li>
<li>In addition to the usual steps, this one also covers DKIMproxy, ClamAV for scanning attachments, Dovecot for IMAP and also multiple choices of spam filtering: spamd or SpamAssassin</li>
<li>It also shows you how to set up Roundcube for building a web interface, using the new in-base httpd</li>
<li>That means this is more of a &quot;complete solution&quot; - right down to what the end users see</li>
<li>The series is split up into categories so it&#39;s very easy to follow along step-by-step
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-January/207421.html" rel="nofollow">How DragonFlyBSD uses git</a></h3>

<ul>
<li>DragonFlyBSD, along with PCBSD and EdgeBSD, uses git as its version control system for the system source code</li>
<li>In a <a href="http://lists.dragonflybsd.org/pipermail/users/2015-January/207422.html" rel="nofollow">series</a> of <a href="http://lists.dragonflybsd.org/pipermail/users/2015-January/207424.html" rel="nofollow">posts</a>, Matthew Dillon (the project lead) details their internal setup</li>
<li>They&#39;re using vanilla git over ssh, with the developers&#39; accounts set to git-only (no shell access)</li>
<li>The maintainers of the server are the only ones with shell access available</li>
<li>He also details how a cron job syncs from the master to a public box that anyone can check out code from</li>
<li>It would be interesting to hear about how other BSD projects manage their master source repository
***</li>
</ul>

<h3><a href="http://www.itwire.com/business-it-news/open-source/66900-fed-up-with-systemd-and-linux?-why-not-try-pc-bsd" rel="nofollow">Why not try PCBSD?</a></h3>

<ul>
<li>ITwire, another more mainstream tech site, published a recent article about switching to PCBSD</li>
<li>They interview a guy named Kris that we&#39;ve never heard of before</li>
<li>In the article, they touch on how easy it can potentially be for Linux users looking to switch over to the BSD side - lots of applications are exactly the same</li>
<li>&quot;With the growing adoption of systemd, dissatisfaction with Linux has reached proportions not seen in recent years, to the extent that people have started talking of switching to FreeBSD.&quot;</li>
<li>If you have some friends who complain to you about systemd all the time, this might be a good article to show them
***</li>
</ul>

<h2>Interview - Henning Brauer - <a href="mailto:henning@openbsd.org" rel="nofollow">henning@openbsd.org</a> / <a href="https://twitter.com/henningbrauer" rel="nofollow">@henningbrauer</a></h2>

<p><a href="http://openntpd.org/" rel="nofollow">OpenNTPD</a> and its portable variant</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=142356166731390&w=2" rel="nofollow">Authenticated time in OpenNTPD</a></h3>

<ul>
<li>We recorded that interview with Henning just a few days ago, and it looks like part of it may be outdated <em>already</em></li>
<li>While at the hackathon, some developers came up with an <a href="https://www.marc.info/?l=openbsd-cvs&m=142355043928397&w=2" rel="nofollow">alternate way</a> to get authenticated NTP responses</li>
<li>You can now add an HTTPS URL to your ntpd.conf in addition to the time server pool</li>
<li>OpenNTPD will query it (over TLS, with CA verification) and look at the date sent in the HTTPS header</li>
<li>It&#39;s not intended to be a direct time source, just a constraint to keep things within reason</li>
<li>If you receive regular NTP packets that are way off from the TLS packet, those will be discarded and the server(s) marked as invalid</li>
<li><a href="https://www.marc.info/?l=openbsd-tech&m=142363215730069&w=2" rel="nofollow">Henning</a> and <a href="https://www.marc.info/?l=openbsd-tech&m=142363400330522&w=2" rel="nofollow">Theo</a> also weigh in to give some of the backstory on the idea</li>
<li>Lots more detail can be found in Reyk&#39;s email explaining the new feature (and it&#39;s optional of course)
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/02/08/msg000678.html" rel="nofollow">NetBSD at Open Source Conference 2015 Oita and Hamanako</a></h3>

<ul>
<li>It&#39;s been a while since we&#39;ve featured one of these trip reports, but the Japanese NetBSD users group is still doing them</li>
<li>This time the conferences were in Oita <a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/02/11/msg000679.html" rel="nofollow">and Hamanako</a>, Japan</li>
<li>Machines running NetBSD included the CubieBoard2 Allwinner A20, Raspberry Pi and Banana Pi, Sharp NetWalker and a couple Zaurus devices</li>
<li>As always, they took lots of pictures from the event of NetBSD on all these weird machines
***</li>
</ul>

<h3><a href="http://www.tobeannounced.org/2015/02/poudriere-in-a-jail/" rel="nofollow">Poudriere in a jail</a></h3>

<ul>
<li>A common question we get about our <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere tutorial</a> is &quot;how do I run it in a jail?&quot; - this blog post is about exactly that</li>
<li>It takes you through the networking setup, zpool setup, nginx setup, making the jail and finally poking the right holes in the jail to allow poudriere to work its magic
***</li>
</ul>

<h3><a href="http://easyos.net/articles/bsd/freebsd/bruteblock_protection_against_bruteforce_attacks_in_ssh" rel="nofollow">Bruteblock, another way to stop bruteforce</a></h3>

<ul>
<li>We&#39;ve mentioned a few different ways to stop ssh bruteforce attempts in the past: fail2ban, denyhosts, or even just with pf&#39;s built-in rate limiting</li>
<li>Bruteblock is a similar tool, but it&#39;s not just for ssh logins - it can do a number of other services</li>
<li>It can also work directly with IPFW, which is a plus if you&#39;re using that as your firewall</li>
<li>Add a few lines to your syslog.conf and bruteblock will get executed automatically</li>
<li>The rest of the article takes you through the different settings you can configure for blocking
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=142325218626853&w=2" rel="nofollow">New iwm(4) driver and cross-polination</a></h3>

<ul>
<li>The OpenBSD guys recently imported a new &quot;iwm&quot; driver for newer Intel 7260 wireless cards (commonly found in Thinkpads)</li>
<li>NetBSD wasted no time in <a href="https://mail-index.netbsd.org/source-changes/2015/02/07/msg062979.html" rel="nofollow">porting it over</a>, giving a bit of interesting backstory</li>
<li>According to <a href="http://www.bsdnow.tv/episodes/2013_10_23-a_brief_intorduction" rel="nofollow">Antti Kantee</a>, &quot;it was created for OpenBSD by writing and porting a NetBSD driver which was developed in a rump kernel in Linux userspace&quot;</li>
<li>Both projects would appreciate further testing if you have the hardware and can provide useful bug reports</li>
<li>Maybe FreeBSD and DragonFly will port it over too, or come up with something that&#39;s partially based on the code
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/02/pc-bsd-11-0-current-images-now-available/" rel="nofollow">PCBSD current images</a></h3>

<ul>
<li>The first PCBSD -CURRENT images should be available this weekend</li>
<li>This image will be tagged 11.0-CURRENTFEB2015, with planned monthly updates</li>
<li>For the more adventurous this will allow testing both FreeBSD and PCBSD bleeding edge
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2E4NbJwzs" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s2FkxcSYKy" rel="nofollow">Richard writes in</a></li>
<li><a href="http://slexy.org/view/s217EgA1JC" rel="nofollow">Charlie writes in</a></li>
<li><a href="http://slexy.org/view/s21vlCbGDt" rel="nofollow">Ben writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.gnu.org/archive/html/emacs-devel/2015-02/msg00360.html" rel="nofollow">A systematic effort</a></li>
<li><a href="https://lists.gnu.org/archive/html/emacs-devel/2015-02/msg00457.html" rel="nofollow">GCC&#39;s lunch</a></li>
<li><a href="https://marc.info/?l=openbsd-cvs&m=142331891908776&w=2" rel="nofollow">Hopes and dreams</a>
***</li>
</ul>

<h2>Discussion</h2>

<h3>Comparison of ways to securely tunnel your traffic</h3>

<ul>
<li><a href="https://openvpn.net/index.php/open-source.html" rel="nofollow">OpenVPN</a>, <a href="http://www.openiked.org/" rel="nofollow">OpenBSD IKED</a>, <a href="https://www.freebsd.org/doc/handbook/ipsec.html" rel="nofollow">FreeBSD IPSEC</a>, <a href="http://www.openssh.com/" rel="nofollow">OpenSSH</a>, <a href="https://www.torproject.org/" rel="nofollow">Tor</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week, we&#39;ll be talking to Henning Brauer about OpenNTPD and its recently revived portable version. After that, we&#39;ll be discussing different ways to securely tunnel your traffic: specifically OpenVPN, IPSEC, SSH and Tor. All that and the latest news, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054295.html" rel="nofollow">Strange timer bug in FreeBSD 11</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2014_09_24-beastly_infrastructure" rel="nofollow">Peter Wemm</a> wrote in to the FreeBSD -CURRENT mailing list with an interesting observation</li>
<li>Running the latest development code in the infrastructure, the clock would stop keeping time after 24 days of uptime</li>
<li>This meant things like cron and sleep would break, TCP/IP wouldn&#39;t time out or resend packets, a lot of things would break</li>
<li>A workaround until it was fixed was to reboot every 24 days, but this is BSD we&#39;re talking about - uptime is our game</li>
<li>An initial proposal was adding a CFLAG to the build options which makes makes signed arithmetic wrap</li>
<li>Peter disagreed and <a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-February/054320.html" rel="nofollow">gave some background</a>, offering a different patch to <a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-February/067827.html" rel="nofollow">fix</a> the issue and <a href="https://lists.freebsd.org/pipermail/svn-src-head/2015-February/067828.html" rel="nofollow">detect it early</a> if it happens again</li>
<li>Ultimately, the problem was traced back to an issue with a recent clang import</li>
<li>It only affected -CURRENT, not -RELEASE or -STABLE, but was definitely a bizarre bug to track down
***</li>
</ul>

<h3><a href="http://technoquarter.blogspot.com/p/series.html" rel="nofollow">An OpenBSD mail server</a></h3>

<ul>
<li>There&#39;s been a recent influx of blog posts about building a BSD mail server for some reason</li>
<li>In this fancy series of posts, the author sets up OpenSMTPD in its native OpenBSD home, whereas previous posts have been aimed at FreeBSD and Linux</li>
<li>In addition to the usual steps, this one also covers DKIMproxy, ClamAV for scanning attachments, Dovecot for IMAP and also multiple choices of spam filtering: spamd or SpamAssassin</li>
<li>It also shows you how to set up Roundcube for building a web interface, using the new in-base httpd</li>
<li>That means this is more of a &quot;complete solution&quot; - right down to what the end users see</li>
<li>The series is split up into categories so it&#39;s very easy to follow along step-by-step
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/users/2015-January/207421.html" rel="nofollow">How DragonFlyBSD uses git</a></h3>

<ul>
<li>DragonFlyBSD, along with PCBSD and EdgeBSD, uses git as its version control system for the system source code</li>
<li>In a <a href="http://lists.dragonflybsd.org/pipermail/users/2015-January/207422.html" rel="nofollow">series</a> of <a href="http://lists.dragonflybsd.org/pipermail/users/2015-January/207424.html" rel="nofollow">posts</a>, Matthew Dillon (the project lead) details their internal setup</li>
<li>They&#39;re using vanilla git over ssh, with the developers&#39; accounts set to git-only (no shell access)</li>
<li>The maintainers of the server are the only ones with shell access available</li>
<li>He also details how a cron job syncs from the master to a public box that anyone can check out code from</li>
<li>It would be interesting to hear about how other BSD projects manage their master source repository
***</li>
</ul>

<h3><a href="http://www.itwire.com/business-it-news/open-source/66900-fed-up-with-systemd-and-linux?-why-not-try-pc-bsd" rel="nofollow">Why not try PCBSD?</a></h3>

<ul>
<li>ITwire, another more mainstream tech site, published a recent article about switching to PCBSD</li>
<li>They interview a guy named Kris that we&#39;ve never heard of before</li>
<li>In the article, they touch on how easy it can potentially be for Linux users looking to switch over to the BSD side - lots of applications are exactly the same</li>
<li>&quot;With the growing adoption of systemd, dissatisfaction with Linux has reached proportions not seen in recent years, to the extent that people have started talking of switching to FreeBSD.&quot;</li>
<li>If you have some friends who complain to you about systemd all the time, this might be a good article to show them
***</li>
</ul>

<h2>Interview - Henning Brauer - <a href="mailto:henning@openbsd.org" rel="nofollow">henning@openbsd.org</a> / <a href="https://twitter.com/henningbrauer" rel="nofollow">@henningbrauer</a></h2>

<p><a href="http://openntpd.org/" rel="nofollow">OpenNTPD</a> and its portable variant</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=142356166731390&w=2" rel="nofollow">Authenticated time in OpenNTPD</a></h3>

<ul>
<li>We recorded that interview with Henning just a few days ago, and it looks like part of it may be outdated <em>already</em></li>
<li>While at the hackathon, some developers came up with an <a href="https://www.marc.info/?l=openbsd-cvs&m=142355043928397&w=2" rel="nofollow">alternate way</a> to get authenticated NTP responses</li>
<li>You can now add an HTTPS URL to your ntpd.conf in addition to the time server pool</li>
<li>OpenNTPD will query it (over TLS, with CA verification) and look at the date sent in the HTTPS header</li>
<li>It&#39;s not intended to be a direct time source, just a constraint to keep things within reason</li>
<li>If you receive regular NTP packets that are way off from the TLS packet, those will be discarded and the server(s) marked as invalid</li>
<li><a href="https://www.marc.info/?l=openbsd-tech&m=142363215730069&w=2" rel="nofollow">Henning</a> and <a href="https://www.marc.info/?l=openbsd-tech&m=142363400330522&w=2" rel="nofollow">Theo</a> also weigh in to give some of the backstory on the idea</li>
<li>Lots more detail can be found in Reyk&#39;s email explaining the new feature (and it&#39;s optional of course)
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/02/08/msg000678.html" rel="nofollow">NetBSD at Open Source Conference 2015 Oita and Hamanako</a></h3>

<ul>
<li>It&#39;s been a while since we&#39;ve featured one of these trip reports, but the Japanese NetBSD users group is still doing them</li>
<li>This time the conferences were in Oita <a href="https://mail-index.netbsd.org/netbsd-advocacy/2015/02/11/msg000679.html" rel="nofollow">and Hamanako</a>, Japan</li>
<li>Machines running NetBSD included the CubieBoard2 Allwinner A20, Raspberry Pi and Banana Pi, Sharp NetWalker and a couple Zaurus devices</li>
<li>As always, they took lots of pictures from the event of NetBSD on all these weird machines
***</li>
</ul>

<h3><a href="http://www.tobeannounced.org/2015/02/poudriere-in-a-jail/" rel="nofollow">Poudriere in a jail</a></h3>

<ul>
<li>A common question we get about our <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere tutorial</a> is &quot;how do I run it in a jail?&quot; - this blog post is about exactly that</li>
<li>It takes you through the networking setup, zpool setup, nginx setup, making the jail and finally poking the right holes in the jail to allow poudriere to work its magic
***</li>
</ul>

<h3><a href="http://easyos.net/articles/bsd/freebsd/bruteblock_protection_against_bruteforce_attacks_in_ssh" rel="nofollow">Bruteblock, another way to stop bruteforce</a></h3>

<ul>
<li>We&#39;ve mentioned a few different ways to stop ssh bruteforce attempts in the past: fail2ban, denyhosts, or even just with pf&#39;s built-in rate limiting</li>
<li>Bruteblock is a similar tool, but it&#39;s not just for ssh logins - it can do a number of other services</li>
<li>It can also work directly with IPFW, which is a plus if you&#39;re using that as your firewall</li>
<li>Add a few lines to your syslog.conf and bruteblock will get executed automatically</li>
<li>The rest of the article takes you through the different settings you can configure for blocking
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=142325218626853&w=2" rel="nofollow">New iwm(4) driver and cross-polination</a></h3>

<ul>
<li>The OpenBSD guys recently imported a new &quot;iwm&quot; driver for newer Intel 7260 wireless cards (commonly found in Thinkpads)</li>
<li>NetBSD wasted no time in <a href="https://mail-index.netbsd.org/source-changes/2015/02/07/msg062979.html" rel="nofollow">porting it over</a>, giving a bit of interesting backstory</li>
<li>According to <a href="http://www.bsdnow.tv/episodes/2013_10_23-a_brief_intorduction" rel="nofollow">Antti Kantee</a>, &quot;it was created for OpenBSD by writing and porting a NetBSD driver which was developed in a rump kernel in Linux userspace&quot;</li>
<li>Both projects would appreciate further testing if you have the hardware and can provide useful bug reports</li>
<li>Maybe FreeBSD and DragonFly will port it over too, or come up with something that&#39;s partially based on the code
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/02/pc-bsd-11-0-current-images-now-available/" rel="nofollow">PCBSD current images</a></h3>

<ul>
<li>The first PCBSD -CURRENT images should be available this weekend</li>
<li>This image will be tagged 11.0-CURRENTFEB2015, with planned monthly updates</li>
<li>For the more adventurous this will allow testing both FreeBSD and PCBSD bleeding edge
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2E4NbJwzs" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s2FkxcSYKy" rel="nofollow">Richard writes in</a></li>
<li><a href="http://slexy.org/view/s217EgA1JC" rel="nofollow">Charlie writes in</a></li>
<li><a href="http://slexy.org/view/s21vlCbGDt" rel="nofollow">Ben writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.gnu.org/archive/html/emacs-devel/2015-02/msg00360.html" rel="nofollow">A systematic effort</a></li>
<li><a href="https://lists.gnu.org/archive/html/emacs-devel/2015-02/msg00457.html" rel="nofollow">GCC&#39;s lunch</a></li>
<li><a href="https://marc.info/?l=openbsd-cvs&m=142331891908776&w=2" rel="nofollow">Hopes and dreams</a>
***</li>
</ul>

<h2>Discussion</h2>

<h3>Comparison of ways to securely tunnel your traffic</h3>

<ul>
<li><a href="https://openvpn.net/index.php/open-source.html" rel="nofollow">OpenVPN</a>, <a href="http://www.openiked.org/" rel="nofollow">OpenBSD IKED</a>, <a href="https://www.freebsd.org/doc/handbook/ipsec.html" rel="nofollow">FreeBSD IPSEC</a>, <a href="http://www.openssh.com/" rel="nofollow">OpenSSH</a>, <a href="https://www.torproject.org/" rel="nofollow">Tor</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>75: From the Foundation (Part 1)</title>
  <link>https://www.bsdnow.tv/75</link>
  <guid isPermaLink="false">34bf4647-35b0-4919-9b96-c12799506f14</guid>
  <pubDate>Wed, 04 Feb 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/34bf4647-35b0-4919-9b96-c12799506f14.mp3" length="61549780" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we'll be starting a two-part series detailing the activities of various BSD foundations. Ed Maste from the FreeBSD foundation will be joining us this time, and we'll talk about what all they've been up to lately. All this week's news and answers to viewer-submitted questions, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:25:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we'll be starting a two-part series detailing the activities of various BSD foundations. Ed Maste from the FreeBSD foundation will be joining us this time, and we'll talk about what all they've been up to lately. All this week's news and answers to viewer-submitted questions, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
Key rotation in OpenSSH 6.8 (http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html)
Damien Miller (http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline) posted a new blog entry about one of the features in the upcoming OpenSSH 6.8
Times changes, key types change, problems are found with old algorithms and we switch to new ones
In OpenSSH (and the SSH protocol) however, there hasn't been an easy way to rotate host keys... until now
With this change, when you connect to a server, it will log all the server's public keys in your known_hosts file, instead of just the first one used during the key exchange
Keys that are in your known_hosts file but not on the server will get automatically removed
This fixes the problem of old servers still authenticating with ancient DSA or small RSA keys, as well as providing a way for the server to rotate keys every so often
There are some instructions in the blog post for how you'll be able to rotate host keys and eventually phase out the older ones - it's really simple
There are a lot of big changes coming in OpenSSH 6.8, so we'll be sure to cover them all when it's released
***
NetBSD Banana Pi images (https://mail-index.netbsd.org/port-arm/2015/01/30/msg002809.html)
We've talked about the Banana Pi (http://www.bananapi.org/p/product.html) a bit before - it's a small ARM board that's comparable to the popular Raspberry Pi
Some NetBSD -current images were posted on the mailing list, so now you can get some BSD action on one of these little devices
There are even a set of prebuilt pkgsrc packages, so you won't have to compile everything initially
The email includes some steps to get everything working and an overview of what comes with the image
Also check the wiki page (https://wiki.netbsd.org/ports/evbarm/allwinner/) for some related boards and further instructions on getting set up
On a related note, NetBSD also recently got GPU acceleration working (https://blog.netbsd.org/tnf/entry/raspberry_pi_gpu_acceleration_in) for the Raspberry Pi (which is a first for their ARM port)
***
LibreSSL shirts and other BSD goodies (https://www.marc.info/?l=openbsd-misc&amp;amp;m=142255048510669&amp;amp;w=2)
If you've been keeping up with the LibreSSL saga and want a shirt to show your support, they're finally available to buy online
There are two versions, either "keep calm and use LibreSSL (https://shop.openbsdeurope.com/images/shop_openbsdeurope_com/products/large/TSHIRTLSSL.jpg)" or the slightly more snarky "keep calm and abandon OpenSSL (https://shop.openbsdeurope.com/images/shop_openbsdeurope_com/products/large/TSHIRTOSSL.jpg)"
While on the topic, we thought it would be good to make people aware of shirts for other BSD projects too
You can get some FreeBSD, PCBSD (https://www.freebsdmall.com/cgi-bin/fm/scan/fi=prod_bsd/se=pc-bsd) and FreeNAS stuff (https://www.freebsdmall.com/cgi-bin/fm/scan/fi=prod_bsd/se=shirts) from the FreeBSD mall site (https://www.freebsdmall.com/cgi-bin/fm/scan/fi=prod_bsd/se=tshirt)
OpenBSD recently launched their new store (https://www.openbsdstore.com), but the selection is still a bit limited right now
NetBSD has a couple places (https://www.netbsd.org/gallery/devotionalia.html#cafepress) where you can buy shirts and other apparel with the flag logo on it
We couldn't find any DragonFlyBSD shirts unfortunately, which is a shame since their logo (http://www.dragonflybsd.org/images/small_logo.png) is pretty cool
Profits from the sale of the gear go back to the projects, so pick up some swag and support your BSD of choice (and of course wear them at any Linux events you happen to go to)
***
OPNsense 15.1.4 released (https://forum.opnsense.org/index.php?topic=35.0)
The OPNsense guys have been hard at work since we spoke to them (http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach), fixing lots of bugs and keeping everything up to date
A number of versions have come out since then, with 15.1.4 being the latest (assuming they haven't updated it again by the time this airs)
This version includes the latest round of FreeBSD kernel security patches, as well as minor SSL and GUI fixes
They're doing a great job of getting upstream fixes pushed out to users quickly, a very welcome change
A developer has also posted an interesting write-up titled "Development Workflow in OPNsense (http://lastsummer.de/development-workflow-in-opnsense/)"
If any of our listeners are trying OPNsense as their gateway firewall, let us know how you like it
***
Interview - Ed Maste - board@freebsdfoundation.org (mailto:board@freebsdfoundation.org)
The FreeBSD foundation (https://www.freebsdfoundation.org/donate)'s activities
News Roundup
Rolling with OpenBSD snapshots (http://homing-on-code.blogspot.com/2015/02/rolling-with-snapshots.html)
One of the cool things about the -current branch of OpenBSD is that it doesn't require any compiling
There are signed binary snapshots being continuously re-rolled and posted on the FTP sites for every architecture
This provides an easy method to get onboard with the latest features, and you can also easily upgrade between them without reformatting or rebuilding
This blog post will walk you through the process of using snapshots to stay on the bleeding edge of OpenBSD goodness
After using -current for seven weeks, the author comes to the conclusion that it's not as unstable as people might think
He's now helping test out patches and new ports since he's running the same code as the developers
***
Signing pkgsrc packages (https://mail-index.netbsd.org/tech-pkg/2015/02/02/msg014224.html)
As of the time this show airs, the official pkgsrc (http://www.bsdnow.tv/tutorials/pkgsrc) packages aren't cryptographically signed
Someone from Joyent has been working on that, since they'd like to sign their pkgsrc packages for SmartOS
Using GNUPG pulled in a lot of dependencies, and they're trying to keep the bootstrapping process minimal
Instead, they're using netpgpverify, a fork of NetBSD's netpgp (https://en.wikipedia.org/wiki/Netpgp) utility
Maybe someday this will become the official way to sign packages in NetBSD?
***
FreeBSD support model changes (https://lists.freebsd.org/pipermail/freebsd-announce/2015-February/001624.html)
Starting with 11.0-RELEASE, which won't be for a few months probably, FreeBSD releases are going to have a different support model
The plan is to move "from a point release-based support model to a set of releases from a branch with a guaranteed support lifetime"
There will now be a five-year lifespan for each major release, regardless of how many minor point releases it gets
This new model should reduce the turnaround time for errata and security patches, since there will be a lot less work involved to build and verify them
Lots more detail can be found in the mailing list post, including some important changes to the -STABLE branch, so give it a read
***
OpenSMTPD, Dovecot and SpamAssassin (http://guillaumevincent.com/2015/01/31/OpenSMTPD-Dovecot-SpamAssassin.html)
We've been talking about setting up your own BSD-based mail server on the last couple episodes
Here we have another post from a user setting up OpenSMTPD, including Dovecot for IMAP and SpamAssassin for spam filtering
A lot of people regularly ask the developers (http://permalink.gmane.org/gmane.mail.opensmtpd.general/2265) how to combine OpenSMTPD with spam filtering, and this post should finally reveal the dark secrets
In addition, it also covers SSL certificates, PKI and setting up MX records - some things that previous posts have lacked
Just be sure to replace those "apt-get" commands and "eth0" interface names with something a bit more sane…
In related news, OpenSMTPD has got some interesting new features coming soon (http://article.gmane.org/gmane.mail.opensmtpd.general/2272)
They're also planning to switch to LibreSSL by default (https://github.com/OpenSMTPD/OpenSMTPD/issues/534) for the portable version
***
FreeBSD 10 on the Thinkpad T400 (http://lastsummer.de/freebsd-desktop-on-the-t400/)
BSD laptop articles are becoming popular it seems - this one is about FreeBSD on a T400
Like most of the ones we've mentioned before, it shows you how to get a BSD desktop set up with all the little tweaks you might not think to do
This one differs in that it takes a more minimal approach to graphics: instead of a full-featured environment like XFCE or KDE, it uses the i3 tiling window manager
If you're a commandline junkie that basically just uses X11 to run more than one terminal at once, this might be an ideal setup for you
The post also includes some bits about the DRM and KMS in the 10.x branch, as well as vt
***
PC-BSD 10.1.1 Released (http://blog.pcbsd.org/2015/02/1810/)
Automatic background updater now in
Shiny new Qt5 utils
OVA files for VM’s
Full disk encryption with GELI v7
***
Feedback/Questions
Camio writes in (http://slexy.org/view/s2MsjllAyU)
Sha'ul writes in (http://slexy.org/view/s20eYELsAg)
John writes in (http://slexy.org/view/s20Y2GN1az)
Sean writes in (http://slexy.org/view/s20ARVQ1T6) (TJ's lengthy reply (http://slexy.org/view/s212XezEYt))
Christopher writes in (http://slexy.org/view/s2DRgEv4j8)
***
Mailing List Gold
Special Instructions (https://lists.freebsd.org/pipermail/freebsd-questions/2015-February/264010.html)
Pretending to be a VT220 (https://mail-index.netbsd.org/netbsd-users/2015/01/19/msg015669.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ssh, ed25519, banana pi, opnsense, libressl, t400, opensmtpd, dovecot, mail server, spamassassin, foundation, donations</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we&#39;ll be starting a two-part series detailing the activities of various BSD foundations. Ed Maste from the FreeBSD foundation will be joining us this time, and we&#39;ll talk about what all they&#39;ve been up to lately. All this week&#39;s news and answers to viewer-submitted questions, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html" rel="nofollow">Key rotation in OpenSSH 6.8</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">Damien Miller</a> posted a new blog entry about one of the features in the upcoming OpenSSH 6.8</li>
<li>Times changes, key types change, problems are found with old algorithms and we switch to new ones</li>
<li>In OpenSSH (and the SSH protocol) however, there hasn&#39;t been an easy way to rotate host keys... until now</li>
<li>With this change, when you connect to a server, it will log <em>all</em> the server&#39;s public keys in your known_hosts file, instead of just the first one used during the key exchange</li>
<li>Keys that are in your known_hosts file but not on the server will get automatically removed</li>
<li>This fixes the problem of old servers still authenticating with ancient DSA or small RSA keys, as well as providing a way for the server to rotate keys every so often</li>
<li>There are some instructions in the blog post for how you&#39;ll be able to rotate host keys and eventually phase out the older ones - it&#39;s really simple</li>
<li>There are a lot of big changes coming in OpenSSH 6.8, so we&#39;ll be sure to cover them all when it&#39;s released
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/port-arm/2015/01/30/msg002809.html" rel="nofollow">NetBSD Banana Pi images</a></h3>

<ul>
<li>We&#39;ve talked about the <a href="http://www.bananapi.org/p/product.html" rel="nofollow">Banana Pi</a> a bit before - it&#39;s a small ARM board that&#39;s comparable to the popular Raspberry Pi</li>
<li>Some NetBSD -current images were posted on the mailing list, so now you can get some BSD action on one of these little devices</li>
<li>There are even a set of prebuilt pkgsrc packages, so you won&#39;t have to compile everything initially</li>
<li>The email includes some steps to get everything working and an overview of what comes with the image</li>
<li>Also check <a href="https://wiki.netbsd.org/ports/evbarm/allwinner/" rel="nofollow">the wiki page</a> for some related boards and further instructions on getting set up</li>
<li>On a related note, NetBSD also recently <a href="https://blog.netbsd.org/tnf/entry/raspberry_pi_gpu_acceleration_in" rel="nofollow">got GPU acceleration working</a> for the Raspberry Pi (which is a first for their ARM port)
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-misc&m=142255048510669&w=2" rel="nofollow">LibreSSL shirts and other BSD goodies</a></h3>

<ul>
<li>If you&#39;ve been keeping up with the LibreSSL saga and want a shirt to show your support, they&#39;re finally available to buy online</li>
<li>There are two versions, either &quot;<a href="https://shop.openbsdeurope.com/images/shop_openbsdeurope_com/products/large/TSHIRTLSSL.jpg" rel="nofollow">keep calm and use LibreSSL</a>&quot; or the slightly more snarky &quot;<a href="https://shop.openbsdeurope.com/images/shop_openbsdeurope_com/products/large/TSHIRTOSSL.jpg" rel="nofollow">keep calm and abandon OpenSSL</a>&quot;</li>
<li>While on the topic, we thought it would be good to make people aware of shirts for other BSD projects too</li>
<li>You can get some FreeBSD, <a href="https://www.freebsdmall.com/cgi-bin/fm/scan/fi=prod_bsd/se=pc-bsd" rel="nofollow">PCBSD</a> and FreeNAS <a href="https://www.freebsdmall.com/cgi-bin/fm/scan/fi=prod_bsd/se=shirts" rel="nofollow">stuff</a> from the <a href="https://www.freebsdmall.com/cgi-bin/fm/scan/fi=prod_bsd/se=tshirt" rel="nofollow">FreeBSD mall site</a></li>
<li>OpenBSD recently launched their <a href="https://www.openbsdstore.com" rel="nofollow">new store</a>, but the selection is still a bit limited right now</li>
<li>NetBSD has a <a href="https://www.netbsd.org/gallery/devotionalia.html#cafepress" rel="nofollow">couple places</a> where you can buy shirts and other apparel with the flag logo on it</li>
<li>We couldn&#39;t find any DragonFlyBSD shirts unfortunately, which is a shame since <a href="http://www.dragonflybsd.org/images/small_logo.png" rel="nofollow">their logo</a> is pretty cool</li>
<li>Profits from the sale of the gear go back to the projects, so pick up some swag and support your BSD of choice (and of course wear them at any Linux events you happen to go to)
***</li>
</ul>

<h3><a href="https://forum.opnsense.org/index.php?topic=35.0" rel="nofollow">OPNsense 15.1.4 released</a></h3>

<ul>
<li>The OPNsense guys have been hard at work since <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">we spoke to them</a>, fixing lots of bugs and keeping everything up to date</li>
<li>A number of versions have come out since then, with 15.1.4 being the latest (assuming they haven&#39;t updated it <strong>again</strong> by the time this airs)</li>
<li>This version includes the latest round of FreeBSD kernel security patches, as well as minor SSL and GUI fixes</li>
<li>They&#39;re doing a great job of getting upstream fixes pushed out to users quickly, a very welcome change</li>
<li>A developer has also posted an interesting write-up titled &quot;<a href="http://lastsummer.de/development-workflow-in-opnsense/" rel="nofollow">Development Workflow in OPNsense</a>&quot;</li>
<li>If any of our listeners are trying OPNsense as their gateway firewall, let us know how you like it
***</li>
</ul>

<h2>Interview - Ed Maste - <a href="mailto:board@freebsdfoundation.org" rel="nofollow">board@freebsdfoundation.org</a></h2>

<p><a href="https://www.freebsdfoundation.org/donate" rel="nofollow">The FreeBSD foundation</a>&#39;s activities</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://homing-on-code.blogspot.com/2015/02/rolling-with-snapshots.html" rel="nofollow">Rolling with OpenBSD snapshots</a></h3>

<ul>
<li>One of the cool things about the -current branch of OpenBSD is that it doesn&#39;t require any compiling</li>
<li>There are signed binary snapshots being continuously re-rolled and posted on the FTP sites for every architecture</li>
<li>This provides an easy method to get onboard with the latest features, and you can also easily upgrade between them without reformatting or rebuilding</li>
<li>This blog post will walk you through the process of using snapshots to stay on the bleeding edge of OpenBSD goodness</li>
<li>After using -current for seven weeks, the author comes to the conclusion that it&#39;s not as unstable as people might think</li>
<li>He&#39;s now helping test out patches and new ports since he&#39;s running the same code as the developers
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/tech-pkg/2015/02/02/msg014224.html" rel="nofollow">Signing pkgsrc packages</a></h3>

<ul>
<li>As of the time this show airs, the official <a href="http://www.bsdnow.tv/tutorials/pkgsrc" rel="nofollow">pkgsrc</a> packages aren&#39;t cryptographically signed</li>
<li>Someone from Joyent has been working on that, since they&#39;d like to sign their pkgsrc packages for SmartOS</li>
<li>Using GNUPG pulled in a lot of dependencies, and they&#39;re trying to keep the bootstrapping process minimal</li>
<li>Instead, they&#39;re using netpgpverify, a fork of NetBSD&#39;s <a href="https://en.wikipedia.org/wiki/Netpgp" rel="nofollow">netpgp</a> utility</li>
<li>Maybe someday this will become the official way to sign packages in NetBSD?
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2015-February/001624.html" rel="nofollow">FreeBSD support model changes</a></h3>

<ul>
<li>Starting with 11.0-RELEASE, which won&#39;t be for a few months probably, FreeBSD releases are going to have a different support model</li>
<li>The plan is to move &quot;from a point release-based support model to a set of releases from a branch with a guaranteed support lifetime&quot;</li>
<li>There will now be a five-year lifespan for each major release, regardless of how many minor point releases it gets</li>
<li>This new model should reduce the turnaround time for errata and security patches, since there will be a lot less work involved to build and verify them</li>
<li>Lots more detail can be found in the mailing list post, including some important changes to the -STABLE branch, so give it a read
***</li>
</ul>

<h3><a href="http://guillaumevincent.com/2015/01/31/OpenSMTPD-Dovecot-SpamAssassin.html" rel="nofollow">OpenSMTPD, Dovecot and SpamAssassin</a></h3>

<ul>
<li>We&#39;ve been talking about setting up your own BSD-based mail server on the last couple episodes</li>
<li>Here we have another post from a user setting up OpenSMTPD, including Dovecot for IMAP and SpamAssassin for spam filtering</li>
<li>A <strong>lot</strong> of people <a href="http://permalink.gmane.org/gmane.mail.opensmtpd.general/2265" rel="nofollow">regularly ask the developers</a> how to combine OpenSMTPD with spam filtering, and this post should finally reveal the dark secrets</li>
<li>In addition, it also covers SSL certificates, PKI and setting up MX records - some things that previous posts have lacked</li>
<li>Just be sure to replace those &quot;apt-get&quot; commands and &quot;eth0&quot; interface names with something a bit more sane…</li>
<li>In related news, OpenSMTPD has got some interesting new features <a href="http://article.gmane.org/gmane.mail.opensmtpd.general/2272" rel="nofollow">coming soon</a></li>
<li>They&#39;re also planning to <a href="https://github.com/OpenSMTPD/OpenSMTPD/issues/534" rel="nofollow">switch to LibreSSL by default</a> for the portable version
***</li>
</ul>

<h3><a href="http://lastsummer.de/freebsd-desktop-on-the-t400/" rel="nofollow">FreeBSD 10 on the Thinkpad T400</a></h3>

<ul>
<li>BSD laptop articles are becoming popular it seems - this one is about FreeBSD on a T400</li>
<li>Like most of the ones we&#39;ve mentioned before, it shows you how to get a BSD desktop set up with all the little tweaks you might not think to do</li>
<li>This one differs in that it takes a more minimal approach to graphics: instead of a full-featured environment like XFCE or KDE, it uses the i3 tiling window manager</li>
<li>If you&#39;re a commandline junkie that basically just uses X11 to run more than one terminal at once, this might be an ideal setup for you</li>
<li>The post also includes some bits about the DRM and KMS in the 10.x branch, as well as vt
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/02/1810/" rel="nofollow">PC-BSD 10.1.1 Released</a></h3>

<ul>
<li>Automatic background updater now in</li>
<li>Shiny new Qt5 utils</li>
<li>OVA files for VM’s</li>
<li>Full disk encryption with GELI v7
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2MsjllAyU" rel="nofollow">Camio writes in</a></li>
<li><a href="http://slexy.org/view/s20eYELsAg" rel="nofollow">Sha&#39;ul writes in</a></li>
<li><a href="http://slexy.org/view/s20Y2GN1az" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s20ARVQ1T6" rel="nofollow">Sean writes in</a> (<a href="http://slexy.org/view/s212XezEYt" rel="nofollow">TJ&#39;s lengthy reply</a>)</li>
<li><a href="http://slexy.org/view/s2DRgEv4j8" rel="nofollow">Christopher writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-questions/2015-February/264010.html" rel="nofollow">Special Instructions</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-users/2015/01/19/msg015669.html" rel="nofollow">Pretending to be a VT220</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we&#39;ll be starting a two-part series detailing the activities of various BSD foundations. Ed Maste from the FreeBSD foundation will be joining us this time, and we&#39;ll talk about what all they&#39;ve been up to lately. All this week&#39;s news and answers to viewer-submitted questions, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html" rel="nofollow">Key rotation in OpenSSH 6.8</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">Damien Miller</a> posted a new blog entry about one of the features in the upcoming OpenSSH 6.8</li>
<li>Times changes, key types change, problems are found with old algorithms and we switch to new ones</li>
<li>In OpenSSH (and the SSH protocol) however, there hasn&#39;t been an easy way to rotate host keys... until now</li>
<li>With this change, when you connect to a server, it will log <em>all</em> the server&#39;s public keys in your known_hosts file, instead of just the first one used during the key exchange</li>
<li>Keys that are in your known_hosts file but not on the server will get automatically removed</li>
<li>This fixes the problem of old servers still authenticating with ancient DSA or small RSA keys, as well as providing a way for the server to rotate keys every so often</li>
<li>There are some instructions in the blog post for how you&#39;ll be able to rotate host keys and eventually phase out the older ones - it&#39;s really simple</li>
<li>There are a lot of big changes coming in OpenSSH 6.8, so we&#39;ll be sure to cover them all when it&#39;s released
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/port-arm/2015/01/30/msg002809.html" rel="nofollow">NetBSD Banana Pi images</a></h3>

<ul>
<li>We&#39;ve talked about the <a href="http://www.bananapi.org/p/product.html" rel="nofollow">Banana Pi</a> a bit before - it&#39;s a small ARM board that&#39;s comparable to the popular Raspberry Pi</li>
<li>Some NetBSD -current images were posted on the mailing list, so now you can get some BSD action on one of these little devices</li>
<li>There are even a set of prebuilt pkgsrc packages, so you won&#39;t have to compile everything initially</li>
<li>The email includes some steps to get everything working and an overview of what comes with the image</li>
<li>Also check <a href="https://wiki.netbsd.org/ports/evbarm/allwinner/" rel="nofollow">the wiki page</a> for some related boards and further instructions on getting set up</li>
<li>On a related note, NetBSD also recently <a href="https://blog.netbsd.org/tnf/entry/raspberry_pi_gpu_acceleration_in" rel="nofollow">got GPU acceleration working</a> for the Raspberry Pi (which is a first for their ARM port)
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-misc&m=142255048510669&w=2" rel="nofollow">LibreSSL shirts and other BSD goodies</a></h3>

<ul>
<li>If you&#39;ve been keeping up with the LibreSSL saga and want a shirt to show your support, they&#39;re finally available to buy online</li>
<li>There are two versions, either &quot;<a href="https://shop.openbsdeurope.com/images/shop_openbsdeurope_com/products/large/TSHIRTLSSL.jpg" rel="nofollow">keep calm and use LibreSSL</a>&quot; or the slightly more snarky &quot;<a href="https://shop.openbsdeurope.com/images/shop_openbsdeurope_com/products/large/TSHIRTOSSL.jpg" rel="nofollow">keep calm and abandon OpenSSL</a>&quot;</li>
<li>While on the topic, we thought it would be good to make people aware of shirts for other BSD projects too</li>
<li>You can get some FreeBSD, <a href="https://www.freebsdmall.com/cgi-bin/fm/scan/fi=prod_bsd/se=pc-bsd" rel="nofollow">PCBSD</a> and FreeNAS <a href="https://www.freebsdmall.com/cgi-bin/fm/scan/fi=prod_bsd/se=shirts" rel="nofollow">stuff</a> from the <a href="https://www.freebsdmall.com/cgi-bin/fm/scan/fi=prod_bsd/se=tshirt" rel="nofollow">FreeBSD mall site</a></li>
<li>OpenBSD recently launched their <a href="https://www.openbsdstore.com" rel="nofollow">new store</a>, but the selection is still a bit limited right now</li>
<li>NetBSD has a <a href="https://www.netbsd.org/gallery/devotionalia.html#cafepress" rel="nofollow">couple places</a> where you can buy shirts and other apparel with the flag logo on it</li>
<li>We couldn&#39;t find any DragonFlyBSD shirts unfortunately, which is a shame since <a href="http://www.dragonflybsd.org/images/small_logo.png" rel="nofollow">their logo</a> is pretty cool</li>
<li>Profits from the sale of the gear go back to the projects, so pick up some swag and support your BSD of choice (and of course wear them at any Linux events you happen to go to)
***</li>
</ul>

<h3><a href="https://forum.opnsense.org/index.php?topic=35.0" rel="nofollow">OPNsense 15.1.4 released</a></h3>

<ul>
<li>The OPNsense guys have been hard at work since <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">we spoke to them</a>, fixing lots of bugs and keeping everything up to date</li>
<li>A number of versions have come out since then, with 15.1.4 being the latest (assuming they haven&#39;t updated it <strong>again</strong> by the time this airs)</li>
<li>This version includes the latest round of FreeBSD kernel security patches, as well as minor SSL and GUI fixes</li>
<li>They&#39;re doing a great job of getting upstream fixes pushed out to users quickly, a very welcome change</li>
<li>A developer has also posted an interesting write-up titled &quot;<a href="http://lastsummer.de/development-workflow-in-opnsense/" rel="nofollow">Development Workflow in OPNsense</a>&quot;</li>
<li>If any of our listeners are trying OPNsense as their gateway firewall, let us know how you like it
***</li>
</ul>

<h2>Interview - Ed Maste - <a href="mailto:board@freebsdfoundation.org" rel="nofollow">board@freebsdfoundation.org</a></h2>

<p><a href="https://www.freebsdfoundation.org/donate" rel="nofollow">The FreeBSD foundation</a>&#39;s activities</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://homing-on-code.blogspot.com/2015/02/rolling-with-snapshots.html" rel="nofollow">Rolling with OpenBSD snapshots</a></h3>

<ul>
<li>One of the cool things about the -current branch of OpenBSD is that it doesn&#39;t require any compiling</li>
<li>There are signed binary snapshots being continuously re-rolled and posted on the FTP sites for every architecture</li>
<li>This provides an easy method to get onboard with the latest features, and you can also easily upgrade between them without reformatting or rebuilding</li>
<li>This blog post will walk you through the process of using snapshots to stay on the bleeding edge of OpenBSD goodness</li>
<li>After using -current for seven weeks, the author comes to the conclusion that it&#39;s not as unstable as people might think</li>
<li>He&#39;s now helping test out patches and new ports since he&#39;s running the same code as the developers
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/tech-pkg/2015/02/02/msg014224.html" rel="nofollow">Signing pkgsrc packages</a></h3>

<ul>
<li>As of the time this show airs, the official <a href="http://www.bsdnow.tv/tutorials/pkgsrc" rel="nofollow">pkgsrc</a> packages aren&#39;t cryptographically signed</li>
<li>Someone from Joyent has been working on that, since they&#39;d like to sign their pkgsrc packages for SmartOS</li>
<li>Using GNUPG pulled in a lot of dependencies, and they&#39;re trying to keep the bootstrapping process minimal</li>
<li>Instead, they&#39;re using netpgpverify, a fork of NetBSD&#39;s <a href="https://en.wikipedia.org/wiki/Netpgp" rel="nofollow">netpgp</a> utility</li>
<li>Maybe someday this will become the official way to sign packages in NetBSD?
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2015-February/001624.html" rel="nofollow">FreeBSD support model changes</a></h3>

<ul>
<li>Starting with 11.0-RELEASE, which won&#39;t be for a few months probably, FreeBSD releases are going to have a different support model</li>
<li>The plan is to move &quot;from a point release-based support model to a set of releases from a branch with a guaranteed support lifetime&quot;</li>
<li>There will now be a five-year lifespan for each major release, regardless of how many minor point releases it gets</li>
<li>This new model should reduce the turnaround time for errata and security patches, since there will be a lot less work involved to build and verify them</li>
<li>Lots more detail can be found in the mailing list post, including some important changes to the -STABLE branch, so give it a read
***</li>
</ul>

<h3><a href="http://guillaumevincent.com/2015/01/31/OpenSMTPD-Dovecot-SpamAssassin.html" rel="nofollow">OpenSMTPD, Dovecot and SpamAssassin</a></h3>

<ul>
<li>We&#39;ve been talking about setting up your own BSD-based mail server on the last couple episodes</li>
<li>Here we have another post from a user setting up OpenSMTPD, including Dovecot for IMAP and SpamAssassin for spam filtering</li>
<li>A <strong>lot</strong> of people <a href="http://permalink.gmane.org/gmane.mail.opensmtpd.general/2265" rel="nofollow">regularly ask the developers</a> how to combine OpenSMTPD with spam filtering, and this post should finally reveal the dark secrets</li>
<li>In addition, it also covers SSL certificates, PKI and setting up MX records - some things that previous posts have lacked</li>
<li>Just be sure to replace those &quot;apt-get&quot; commands and &quot;eth0&quot; interface names with something a bit more sane…</li>
<li>In related news, OpenSMTPD has got some interesting new features <a href="http://article.gmane.org/gmane.mail.opensmtpd.general/2272" rel="nofollow">coming soon</a></li>
<li>They&#39;re also planning to <a href="https://github.com/OpenSMTPD/OpenSMTPD/issues/534" rel="nofollow">switch to LibreSSL by default</a> for the portable version
***</li>
</ul>

<h3><a href="http://lastsummer.de/freebsd-desktop-on-the-t400/" rel="nofollow">FreeBSD 10 on the Thinkpad T400</a></h3>

<ul>
<li>BSD laptop articles are becoming popular it seems - this one is about FreeBSD on a T400</li>
<li>Like most of the ones we&#39;ve mentioned before, it shows you how to get a BSD desktop set up with all the little tweaks you might not think to do</li>
<li>This one differs in that it takes a more minimal approach to graphics: instead of a full-featured environment like XFCE or KDE, it uses the i3 tiling window manager</li>
<li>If you&#39;re a commandline junkie that basically just uses X11 to run more than one terminal at once, this might be an ideal setup for you</li>
<li>The post also includes some bits about the DRM and KMS in the 10.x branch, as well as vt
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/02/1810/" rel="nofollow">PC-BSD 10.1.1 Released</a></h3>

<ul>
<li>Automatic background updater now in</li>
<li>Shiny new Qt5 utils</li>
<li>OVA files for VM’s</li>
<li>Full disk encryption with GELI v7
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2MsjllAyU" rel="nofollow">Camio writes in</a></li>
<li><a href="http://slexy.org/view/s20eYELsAg" rel="nofollow">Sha&#39;ul writes in</a></li>
<li><a href="http://slexy.org/view/s20Y2GN1az" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s20ARVQ1T6" rel="nofollow">Sean writes in</a> (<a href="http://slexy.org/view/s212XezEYt" rel="nofollow">TJ&#39;s lengthy reply</a>)</li>
<li><a href="http://slexy.org/view/s2DRgEv4j8" rel="nofollow">Christopher writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-questions/2015-February/264010.html" rel="nofollow">Special Instructions</a></li>
<li><a href="https://mail-index.netbsd.org/netbsd-users/2015/01/19/msg015669.html" rel="nofollow">Pretending to be a VT220</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>74: That Sly MINIX</title>
  <link>https://www.bsdnow.tv/74</link>
  <guid isPermaLink="false">6e3c9361-afc5-4f27-b2de-a33a6ac82db5</guid>
  <pubDate>Wed, 28 Jan 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6e3c9361-afc5-4f27-b2de-a33a6ac82db5.mp3" length="54813172" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week, we've got something a little bit different for you. We'll be talking with Andrew Tanenbaum, the creator of MINIX. They've recently imported parts of NetBSD into their OS, and we'll find out how and why that came about. As always, all the latest news and answers to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:16:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week, we've got something a little bit different for you. We'll be talking with Andrew Tanenbaum, the creator of MINIX. They've recently imported parts of NetBSD into their OS, and we'll find out how and why that came about. As always, all the latest news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
The missing EuroBSDCon videos (http://2014.eurobsdcon.org/)
Some of the missing videos from EuroBSDCon 2014 we mentioned before (http://www.bsdnow.tv/episodes/2014_11_19-rump_kernels_revisited) have mysteriously appeared
Jordan Hubbard (http://www.bsdnow.tv/episodes/2013_11_27-bridging_the_gap), FreeBSD, looking forward to another 10 years (https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/01.Keynote%20-%20FreeBSD:%20looking%20forward%20to%20another%2010%20years%20-%20Jordan%20Hubbard.mp4)
Lourival Viera Neto, NPF scripting with Lua (https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/06.NFS%20scripting%20with%20Lua%20-%20Lourival%20Viera%20Neto.mp4)
Kris Moore, Snapshots, replication and boot environments (https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/02.Snapshots,%20replication%20and%20boot%20environments%20-%20Kris%20Moore.mp4)
Andy Tanenbaum, A reimplementation of NetBSD based on a microkernel (https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/07.A%20reimplementation%20of%20NetBSD%20based%20on%20a%20microkernel%20-%20Andy%20Tanenbaum.mp4)
Kirk McKusick (http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache), An introduction to FreeBSD's implementation of ZFS (https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/03.An%20introduction%20to%20the%20implementation%20of%20ZFS%20-%20Kirk%20McKusick.mp4)
Emannuel Dreyfus, FUSE and beyond, bridging filesystems (https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/05.FUSE%20and%20beyond:%20bridging%20filesystems%20-%20Emannuel%20Dreyfus.mp4)
John-Mark Gurney (http://www.bsdnow.tv/episodes/2014_10_29-ipsecond_wind), Optimizing GELI performance (https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/04.Optimizing%20GELI%20performance%20-%20John-Mark%20Gurney.mp4)
Unfortunately, there are still about six talks missing… and no ETA
***
FreeBSD on a MacBook Pro (or two) (https://gist.github.com/mpasternacki/974e29d1e3865e940c53)
We've got a couple posts about running FreeBSD on a MacBook Pro this week
In the first one, the author talks a bit about trying to run Linux on his laptop for quite a while, going back and forth between it and something that Just Works™
Eventually he came full circle, and the focus on using only GUI tools got in the way, instead of making things easier
He works on a lot of FreeBSD-related software, so switching to it for a desktop seems to be the obvious next step
He's still not quite to that point yet, but documents his experiments with BSD as a desktop
The second article (http://blog.foxkit.us/2015/01/freebsd-on-apple-macbook-pro-13-late.html) also documents an ex-Linux user switching over to BSD for their desktop
It also covers (http://blog.foxkit.us/2015/01/freebsd-on-apple-macbook-pro-82-now.html) power management, bluetooth and trackpad setup
On the topic of Gentoo, "Underneath the beautiful and easy-to-use Portage system lies the same glibc, the same turmoil over a switch to a less-than-ideal init system, and the same kernel-level bugs that bring my productivity down"
Check out both articles if you've been considering running FreeBSD on a MacBook
***
Remote logging over TLS (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142136923124184&amp;amp;w=2)
In most of the BSDs, syslogd has been able to remotely send logs to another server for a long time
That feature can be very useful, especially for forensics purposes - it's much harder for an attacker to hide their activities if the logs aren't on the same server
The problem is, of course, that it's sent in cleartext (https://en.wikipedia.org/wiki/Syslog#Protocol), unless you tunnel it over SSH or use some kind of third party wrapper
With a few recent commits (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142160989610410&amp;amp;w=2), OpenBSD's syslogd now supports sending logs over TLS natively, including X509 certificate verification
By default, syslogd runs as an unprivileged user in a chroot on OpenBSD, so there were some initial concerns about certificate verification - how does that user access the CA chain outside of the chroot?
That problem was also conquered (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142188450524692&amp;amp;w=2), by loading the CA chain directly from memory (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142191799331938&amp;amp;w=2), so the entire process can be run in the chroot (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142191819131993&amp;amp;w=2) without issue
Some of the privsep verifcation code even made its way into (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142191878632141&amp;amp;w=2) LibreSSL right afterwards
If you haven't set up remote logging before, now might be an interesting time to try it out
***
FreeBSD, not a Linux distro (https://www.youtube.com/watch?v=wwbO4eTieQY)
George Neville-Neil gave a presentation recently, titled "FreeBSD: not a Linux distro"
It's meant to be an introduction to new users that might've heard about FreeBSD, but aren't familiar with any BSD history
He goes through some of that history, and talks about what FreeBSD is and why you might want to use it over other options
There's even an interesting "thirty years in three minutes" segment
It's not just a history lesson though, he talks about some of the current features and even some new things coming in the next version(s)
We also learn about filesystems, jails, capsicum, clang, dtrace and the various big companies using FreeBSD in their products
This might be a good video to show your friends or potential employer if you're looking to introduce FreeBSD to them 
***
Long-term support considered harmful (http://www.tedunangst.com/flak/post/long-term-support-considered-harmful)
There was recently a pretty horrible bug (https://www.marc.info/?l=bugtraq&amp;amp;m=142237866420639&amp;amp;w=2) in GNU's libc (BSDs aren't affected, don't worry)
Aside from the severity of the actual problem, the fix was delayed (https://code.google.com/p/chromium/issues/detail?id=364511) for quite a long time, leaving people vulnerable
Ted Unangst writes a post about how this idea of long-term support (https://plus.google.com/u/0/+ArtoPekkanen/posts/88jk5ggXYts?cfem=1) could actually be harmful in the long run, and compares it to how OpenBSD does things
OpenBSD releases a new version every six months, and only the two most recent releases get support and security fixes
He describes this as both a good thing and a bad thing: all the bugs in the ecosystem get flushed out within a year, but it forces people to stay (relatively) up-to-date
"Upgrades only get harder and more painful (and more fragile) the longer one goes between them. More changes, more damage. Frequent upgrades amortize the cost and ensure that regressions are caught early."
There was also some (https://lobste.rs/s/a4iijx/long_term_support_considered_harmful) discussion (https://news.ycombinator.com/item?id=8954737) about the article you can check out
***
Interview - Andrew Tanenbaum - info@minix3.org (mailto:info@minix3.org) / @minix3 (https://twitter.com/minix3)
MINIX's integration of NetBSD
News Roundup
Using AFL on OpenBSD (http://www.undeadly.org/cgi?action=article&amp;amp;sid=20150121093259)
We've talked about American Fuzzy Lop (http://lcamtuf.coredump.cx/afl/) a bit on a previous episode, and how some OpenBSD devs are using it (https://www.marc.info/?l=openbsd-cvs&amp;amp;w=2&amp;amp;r=1&amp;amp;s=afl&amp;amp;q=b) to catch and fix new bugs
Undeadly has a cool guide on how you can get started with fuzzing
It's a little on the advanced side, but if you're interested in programming or diagnosing crashes, it'll be a really interesting article to read
Lots of recent CVEs in other open source projects are attributed to fuzzing - it's a great way to stress test your software
***
Lumina 0.8.1 released (http://blog.pcbsd.org/2015/01/lumina-desktop-0-8-1-released/)
A new version of Lumina, the BSD-licensed desktop environment from PCBSD, has been released
This update includes some new plugins, lots of bugfixes and even "quality-of-life improvements"
There's a new audio player desktop plugin, a button to easily minimize all windows at once and some cool new customization options
You can get it in PCBSD's edge repo or install it through regular ports (on FreeBSD, OpenBSD or DragonFly!)
If you haven't seen our episode about Lumina, where we interview the developer and show you a tour of its features, gotta go watch it (http://www.bsdnow.tv/episodes/2014_09_10-luminary_environment)
***
My first OpenBSD port (http://homing-on-code.blogspot.com/2015/01/my-first-openbsd-port.html)
The author of the "Code Rot &amp;amp; Why I Chose OpenBSD" article has a new post up, this time about ports
He recently made his first port and got it into the tree, so he talks about the whole process from start to finish
After learning some of the basics and becoming comfortable running -current, he noticed there wasn't a port for the "Otter" web browser
At that point he did what you're supposed to do in that situation, and started working on it himself
OpenBSD has a great porter's handbook (http://www.openbsd.org/faq/ports/) that he referenced throughout the process
Long story short, his browser of choice is in the official ports collection and now he's the maintainer (and gets to deal with any bug reports, of course)
If some software you use isn't available for whatever BSD you're using, you could be the one to make it happen
***
How to slide with DragonFly (http://www.dragonflybsd.org/docs/docs/howtos/howtoslide/)
DragonFly BSD has a new HAMMER FS utility called "Slider"
It's used to easily browse through file history and undelete files - imagine something like a commandline version of Apple's Time Machine
They have a pretty comprehensive guide on how to use it on their wiki page
If you're using HAMMER FS, this is a really handy tool to have, check it out
***
OpenSMTPD with Dovecot and Salt (https://blog.al-shami.net/2015/01/howto-small-mail-server-with-salt-dovecot-and-opensmtpd/)
We recently had a feedback question about which mail servers you can use on BSD - Postfix, Exim and OpenSMTPD being the big three
This blog post details how to set up OpenSMTPD, including Dovecot for IMAP and Salt for quick and easy deployment
Intrigued by it becoming the default MTA in OpenBSD, the author decided to give it a try after being a long-time Postfix fan
"Small, fast, stable, and very easy to customize, no more ugly m4 macros to deal with"
Check it out if you've been thinking about configuring your first mail server on any of the BSDs
***
Feedback/Questions
Christopher writes in (http://slexy.org/view/s20q2fSfEO) (handbook section (https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails-ezjail.html#jails-ezjail-update-os))
Mark writes in (http://slexy.org/view/s2zGvAczeN)
Kevin writes in (http://slexy.org/view/s21Dn2Tey8)
Stefano writes in (http://slexy.org/view/s215nxxrtF)
Matthew writes in (http://slexy.org/view/s20cwezc9l)
***
Mailing List Gold
Not that interested actually (https://www.marc.info/?l=openbsd-misc&amp;amp;m=142194821910087&amp;amp;w=2)
This guy again (https://lists.freebsd.org/pipermail/freebsd-jail/2015-January/002742.html)
Yep, this is the place (https://lists.freebsd.org/pipermail/freebsd-doc/2015-January/024888.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, minix, minix3, userland, pkgsrc, afl, american fuzzy lop, fuzzing, hammerfs, hammer fs, slider, eurobsdcon, opensmtpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week, we&#39;ve got something a little bit different for you. We&#39;ll be talking with Andrew Tanenbaum, the creator of MINIX. They&#39;ve recently imported parts of NetBSD into their OS, and we&#39;ll find out how and why that came about. As always, all the latest news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.eurobsdcon.org/" rel="nofollow">The missing EuroBSDCon videos</a></h3>

<ul>
<li>Some of the missing videos from EuroBSDCon 2014 <a href="http://www.bsdnow.tv/episodes/2014_11_19-rump_kernels_revisited" rel="nofollow">we mentioned before</a> have mysteriously appeared</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_27-bridging_the_gap" rel="nofollow">Jordan Hubbard</a>, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/01.Keynote%20-%20FreeBSD:%20looking%20forward%20to%20another%2010%20years%20-%20Jordan%20Hubbard.mp4" rel="nofollow">FreeBSD, looking forward to another 10 years</a></li>
<li>Lourival Viera Neto, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/06.NFS%20scripting%20with%20Lua%20-%20Lourival%20Viera%20Neto.mp4" rel="nofollow">NPF scripting with Lua</a></li>
<li>Kris Moore, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/02.Snapshots,%20replication%20and%20boot%20environments%20-%20Kris%20Moore.mp4" rel="nofollow">Snapshots, replication and boot environments</a></li>
<li>Andy Tanenbaum, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/07.A%20reimplementation%20of%20NetBSD%20based%20on%20a%20microkernel%20-%20Andy%20Tanenbaum.mp4" rel="nofollow">A reimplementation of NetBSD based on a microkernel</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache" rel="nofollow">Kirk McKusick</a>, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/03.An%20introduction%20to%20the%20implementation%20of%20ZFS%20-%20Kirk%20McKusick.mp4" rel="nofollow">An introduction to FreeBSD&#39;s implementation of ZFS</a></li>
<li>Emannuel Dreyfus, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/05.FUSE%20and%20beyond:%20bridging%20filesystems%20-%20Emannuel%20Dreyfus.mp4" rel="nofollow">FUSE and beyond, bridging filesystems</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_10_29-ipsecond_wind" rel="nofollow">John-Mark Gurney</a>, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/04.Optimizing%20GELI%20performance%20-%20John-Mark%20Gurney.mp4" rel="nofollow">Optimizing GELI performance</a></li>
<li>Unfortunately, there are still about six talks missing… and no ETA
***</li>
</ul>

<h3><a href="https://gist.github.com/mpasternacki/974e29d1e3865e940c53" rel="nofollow">FreeBSD on a MacBook Pro (or two)</a></h3>

<ul>
<li>We&#39;ve got a couple posts about running FreeBSD on a MacBook Pro this week</li>
<li>In the first one, the author talks a bit about trying to run Linux on his laptop for quite a while, going back and forth between it and something that Just Works™</li>
<li>Eventually he came full circle, and the focus on using only GUI tools got in the way, instead of making things easier</li>
<li>He works on a lot of FreeBSD-related software, so switching to it for a desktop seems to be the obvious next step</li>
<li>He&#39;s still not quite to that point yet, but documents his experiments with BSD as a desktop</li>
<li>The <a href="http://blog.foxkit.us/2015/01/freebsd-on-apple-macbook-pro-13-late.html" rel="nofollow">second article</a> also documents an ex-Linux user switching over to BSD for their desktop</li>
<li>It <a href="http://blog.foxkit.us/2015/01/freebsd-on-apple-macbook-pro-82-now.html" rel="nofollow">also covers</a> power management, bluetooth and trackpad setup</li>
<li>On the topic of Gentoo, &quot;Underneath the beautiful and easy-to-use Portage system lies the same glibc, the same turmoil over a switch to a less-than-ideal init system, and the same kernel-level bugs that bring my productivity down&quot;</li>
<li>Check out both articles if you&#39;ve been considering running FreeBSD on a MacBook
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=142136923124184&w=2" rel="nofollow">Remote logging over TLS</a></h3>

<ul>
<li>In most of the BSDs, syslogd has been able to remotely send logs to another server for a long time</li>
<li>That feature can be very useful, especially for forensics purposes - it&#39;s much harder for an attacker to hide their activities if the logs aren&#39;t on the same server</li>
<li>The problem is, of course, that it&#39;s <a href="https://en.wikipedia.org/wiki/Syslog#Protocol" rel="nofollow">sent in cleartext</a>, unless you tunnel it over SSH or use some kind of third party wrapper</li>
<li>With a few <a href="https://www.marc.info/?l=openbsd-cvs&m=142160989610410&w=2" rel="nofollow">recent commits</a>, OpenBSD&#39;s syslogd now supports sending logs over TLS natively, including X509 certificate verification</li>
<li>By default, syslogd runs as an unprivileged user in a chroot on OpenBSD, so there were some initial concerns about certificate verification - how does that user access the CA chain <em>outside</em> of the chroot?</li>
<li>That problem <a href="https://www.marc.info/?l=openbsd-tech&m=142188450524692&w=2" rel="nofollow">was also conquered</a>, by loading the CA chain <a href="https://www.marc.info/?l=openbsd-cvs&m=142191799331938&w=2" rel="nofollow">directly from memory</a>, so the entire process <a href="https://www.marc.info/?l=openbsd-cvs&m=142191819131993&w=2" rel="nofollow">can be run in the chroot</a> without issue</li>
<li>Some of the privsep verifcation code even <a href="https://www.marc.info/?l=openbsd-cvs&m=142191878632141&w=2" rel="nofollow">made its way into</a> LibreSSL right afterwards</li>
<li>If you haven&#39;t set up remote logging before, now might be an interesting time to try it out
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=wwbO4eTieQY" rel="nofollow">FreeBSD, not a Linux distro</a></h3>

<ul>
<li>George Neville-Neil gave a presentation recently, titled &quot;FreeBSD: not a Linux distro&quot;</li>
<li>It&#39;s meant to be an introduction to new users that might&#39;ve heard about FreeBSD, but aren&#39;t familiar with any BSD history</li>
<li>He goes through some of that history, and talks about what FreeBSD is and why you might want to use it over other options</li>
<li>There&#39;s even an interesting &quot;thirty years in three minutes&quot; segment</li>
<li>It&#39;s not just a history lesson though, he talks about some of the current features and even some new things coming in the next version(s)</li>
<li>We also learn about filesystems, jails, capsicum, clang, dtrace and the various big companies using FreeBSD in their products</li>
<li>This might be a good video to show your friends or potential employer if you&#39;re looking to introduce FreeBSD to them 
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/long-term-support-considered-harmful" rel="nofollow">Long-term support considered harmful</a></h3>

<ul>
<li>There was recently a <a href="https://www.marc.info/?l=bugtraq&m=142237866420639&w=2" rel="nofollow">pretty horrible bug</a> in GNU&#39;s libc (BSDs aren&#39;t affected, don&#39;t worry)</li>
<li>Aside from the severity of the actual problem, the fix was <a href="https://code.google.com/p/chromium/issues/detail?id=364511" rel="nofollow">delayed</a> for quite a long time, leaving people vulnerable</li>
<li>Ted Unangst writes a post about how this <a href="https://plus.google.com/u/0/+ArtoPekkanen/posts/88jk5ggXYts?cfem=1" rel="nofollow">idea of long-term support</a> could actually be harmful in the long run, and compares it to how OpenBSD does things</li>
<li>OpenBSD releases a new version every six months, and only the two most recent releases get support and security fixes</li>
<li>He describes this as both a good thing and a bad thing: all the bugs in the ecosystem get flushed out within a year, but it forces people to stay (relatively) up-to-date</li>
<li>&quot;Upgrades only get harder and more painful (and more fragile) the longer one goes between them. More changes, more damage. Frequent upgrades amortize the cost and ensure that regressions are caught early.&quot;</li>
<li>There was also <a href="https://lobste.rs/s/a4iijx/long_term_support_considered_harmful" rel="nofollow">some</a> <a href="https://news.ycombinator.com/item?id=8954737" rel="nofollow">discussion</a> about the article you can check out
***</li>
</ul>

<h2>Interview - Andrew Tanenbaum - <a href="mailto:info@minix3.org" rel="nofollow">info@minix3.org</a> / <a href="https://twitter.com/minix3" rel="nofollow">@minix3</a></h2>

<p>MINIX&#39;s integration of NetBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.undeadly.org/cgi?action=article&sid=20150121093259" rel="nofollow">Using AFL on OpenBSD</a></h3>

<ul>
<li>We&#39;ve talked about <a href="http://lcamtuf.coredump.cx/afl/" rel="nofollow">American Fuzzy Lop</a> a bit on a previous episode, and how some OpenBSD devs <a href="https://www.marc.info/?l=openbsd-cvs&w=2&r=1&s=afl&q=b" rel="nofollow">are using it</a> to catch and fix new bugs</li>
<li>Undeadly has a cool guide on how you can get started with fuzzing</li>
<li>It&#39;s a little on the advanced side, but if you&#39;re interested in programming or diagnosing crashes, it&#39;ll be a really interesting article to read</li>
<li>Lots of recent CVEs in other open source projects are attributed to fuzzing - it&#39;s a great way to stress test your software
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/01/lumina-desktop-0-8-1-released/" rel="nofollow">Lumina 0.8.1 released</a></h3>

<ul>
<li>A new version of Lumina, the BSD-licensed desktop environment from PCBSD, has been released</li>
<li>This update includes some new plugins, lots of bugfixes and even &quot;quality-of-life improvements&quot;</li>
<li>There&#39;s a new audio player desktop plugin, a button to easily minimize all windows at once and some cool new customization options</li>
<li>You can get it in PCBSD&#39;s edge repo or install it through regular ports (on FreeBSD, OpenBSD <em>or</em> DragonFly!)</li>
<li>If you haven&#39;t seen our episode about Lumina, where we interview the developer and show you a tour of its features, <a href="http://www.bsdnow.tv/episodes/2014_09_10-luminary_environment" rel="nofollow">gotta go watch it</a>
***</li>
</ul>

<h3><a href="http://homing-on-code.blogspot.com/2015/01/my-first-openbsd-port.html" rel="nofollow">My first OpenBSD port</a></h3>

<ul>
<li>The author of the &quot;Code Rot &amp; Why I Chose OpenBSD&quot; article has a new post up, this time about ports</li>
<li>He recently made his first port and got it into the tree, so he talks about the whole process from start to finish</li>
<li>After learning some of the basics and becoming comfortable running -current, he noticed there wasn&#39;t a port for the &quot;Otter&quot; web browser</li>
<li>At that point he did what you&#39;re <em>supposed to do</em> in that situation, and started working on it himself</li>
<li>OpenBSD has a great <a href="http://www.openbsd.org/faq/ports/" rel="nofollow">porter&#39;s handbook</a> that he referenced throughout the process</li>
<li>Long story short, his browser of choice is in the official ports collection and now he&#39;s the maintainer (and gets to deal with any bug reports, of course)</li>
<li>If some software you use isn&#39;t available for whatever BSD you&#39;re using, you could be the one to make it happen
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/docs/docs/howtos/howtoslide/" rel="nofollow">How to slide with DragonFly</a></h3>

<ul>
<li>DragonFly BSD has a new HAMMER FS utility called &quot;Slider&quot;</li>
<li>It&#39;s used to easily browse through file history and undelete files - imagine something like a commandline version of Apple&#39;s Time Machine</li>
<li>They have a pretty comprehensive guide on how to use it on their wiki page</li>
<li>If you&#39;re using HAMMER FS, this is a really handy tool to have, check it out
***</li>
</ul>

<h3><a href="https://blog.al-shami.net/2015/01/howto-small-mail-server-with-salt-dovecot-and-opensmtpd/" rel="nofollow">OpenSMTPD with Dovecot and Salt</a></h3>

<ul>
<li>We recently had a feedback question about which mail servers you can use on BSD - Postfix, Exim and OpenSMTPD being the big three</li>
<li>This blog post details how to set up OpenSMTPD, including Dovecot for IMAP and Salt for quick and easy deployment</li>
<li>Intrigued by it becoming the default MTA in OpenBSD, the author decided to give it a try after being a long-time Postfix fan</li>
<li>&quot;Small, fast, stable, and very easy to customize, no more ugly m4 macros to deal with&quot;</li>
<li>Check it out if you&#39;ve been thinking about configuring your first mail server on any of the BSDs
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20q2fSfEO" rel="nofollow">Christopher writes in</a> (<a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails-ezjail.html#jails-ezjail-update-os" rel="nofollow">handbook section</a>)</li>
<li><a href="http://slexy.org/view/s2zGvAczeN" rel="nofollow">Mark writes in</a></li>
<li><a href="http://slexy.org/view/s21Dn2Tey8" rel="nofollow">Kevin writes in</a></li>
<li><a href="http://slexy.org/view/s215nxxrtF" rel="nofollow">Stefano writes in</a></li>
<li><a href="http://slexy.org/view/s20cwezc9l" rel="nofollow">Matthew writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-misc&m=142194821910087&w=2" rel="nofollow">Not that interested actually</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-jail/2015-January/002742.html" rel="nofollow">This guy again</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-doc/2015-January/024888.html" rel="nofollow">Yep, this is the place</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week, we&#39;ve got something a little bit different for you. We&#39;ll be talking with Andrew Tanenbaum, the creator of MINIX. They&#39;ve recently imported parts of NetBSD into their OS, and we&#39;ll find out how and why that came about. As always, all the latest news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.eurobsdcon.org/" rel="nofollow">The missing EuroBSDCon videos</a></h3>

<ul>
<li>Some of the missing videos from EuroBSDCon 2014 <a href="http://www.bsdnow.tv/episodes/2014_11_19-rump_kernels_revisited" rel="nofollow">we mentioned before</a> have mysteriously appeared</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_27-bridging_the_gap" rel="nofollow">Jordan Hubbard</a>, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/01.Keynote%20-%20FreeBSD:%20looking%20forward%20to%20another%2010%20years%20-%20Jordan%20Hubbard.mp4" rel="nofollow">FreeBSD, looking forward to another 10 years</a></li>
<li>Lourival Viera Neto, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/06.NFS%20scripting%20with%20Lua%20-%20Lourival%20Viera%20Neto.mp4" rel="nofollow">NPF scripting with Lua</a></li>
<li>Kris Moore, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/02.Snapshots,%20replication%20and%20boot%20environments%20-%20Kris%20Moore.mp4" rel="nofollow">Snapshots, replication and boot environments</a></li>
<li>Andy Tanenbaum, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/07.A%20reimplementation%20of%20NetBSD%20based%20on%20a%20microkernel%20-%20Andy%20Tanenbaum.mp4" rel="nofollow">A reimplementation of NetBSD based on a microkernel</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache" rel="nofollow">Kirk McKusick</a>, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/03.An%20introduction%20to%20the%20implementation%20of%20ZFS%20-%20Kirk%20McKusick.mp4" rel="nofollow">An introduction to FreeBSD&#39;s implementation of ZFS</a></li>
<li>Emannuel Dreyfus, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/05.FUSE%20and%20beyond:%20bridging%20filesystems%20-%20Emannuel%20Dreyfus.mp4" rel="nofollow">FUSE and beyond, bridging filesystems</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_10_29-ipsecond_wind" rel="nofollow">John-Mark Gurney</a>, <a href="https://va.ludost.net/files/eurobsdcon/2014/Vitosha/03.Saturday/04.Optimizing%20GELI%20performance%20-%20John-Mark%20Gurney.mp4" rel="nofollow">Optimizing GELI performance</a></li>
<li>Unfortunately, there are still about six talks missing… and no ETA
***</li>
</ul>

<h3><a href="https://gist.github.com/mpasternacki/974e29d1e3865e940c53" rel="nofollow">FreeBSD on a MacBook Pro (or two)</a></h3>

<ul>
<li>We&#39;ve got a couple posts about running FreeBSD on a MacBook Pro this week</li>
<li>In the first one, the author talks a bit about trying to run Linux on his laptop for quite a while, going back and forth between it and something that Just Works™</li>
<li>Eventually he came full circle, and the focus on using only GUI tools got in the way, instead of making things easier</li>
<li>He works on a lot of FreeBSD-related software, so switching to it for a desktop seems to be the obvious next step</li>
<li>He&#39;s still not quite to that point yet, but documents his experiments with BSD as a desktop</li>
<li>The <a href="http://blog.foxkit.us/2015/01/freebsd-on-apple-macbook-pro-13-late.html" rel="nofollow">second article</a> also documents an ex-Linux user switching over to BSD for their desktop</li>
<li>It <a href="http://blog.foxkit.us/2015/01/freebsd-on-apple-macbook-pro-82-now.html" rel="nofollow">also covers</a> power management, bluetooth and trackpad setup</li>
<li>On the topic of Gentoo, &quot;Underneath the beautiful and easy-to-use Portage system lies the same glibc, the same turmoil over a switch to a less-than-ideal init system, and the same kernel-level bugs that bring my productivity down&quot;</li>
<li>Check out both articles if you&#39;ve been considering running FreeBSD on a MacBook
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=142136923124184&w=2" rel="nofollow">Remote logging over TLS</a></h3>

<ul>
<li>In most of the BSDs, syslogd has been able to remotely send logs to another server for a long time</li>
<li>That feature can be very useful, especially for forensics purposes - it&#39;s much harder for an attacker to hide their activities if the logs aren&#39;t on the same server</li>
<li>The problem is, of course, that it&#39;s <a href="https://en.wikipedia.org/wiki/Syslog#Protocol" rel="nofollow">sent in cleartext</a>, unless you tunnel it over SSH or use some kind of third party wrapper</li>
<li>With a few <a href="https://www.marc.info/?l=openbsd-cvs&m=142160989610410&w=2" rel="nofollow">recent commits</a>, OpenBSD&#39;s syslogd now supports sending logs over TLS natively, including X509 certificate verification</li>
<li>By default, syslogd runs as an unprivileged user in a chroot on OpenBSD, so there were some initial concerns about certificate verification - how does that user access the CA chain <em>outside</em> of the chroot?</li>
<li>That problem <a href="https://www.marc.info/?l=openbsd-tech&m=142188450524692&w=2" rel="nofollow">was also conquered</a>, by loading the CA chain <a href="https://www.marc.info/?l=openbsd-cvs&m=142191799331938&w=2" rel="nofollow">directly from memory</a>, so the entire process <a href="https://www.marc.info/?l=openbsd-cvs&m=142191819131993&w=2" rel="nofollow">can be run in the chroot</a> without issue</li>
<li>Some of the privsep verifcation code even <a href="https://www.marc.info/?l=openbsd-cvs&m=142191878632141&w=2" rel="nofollow">made its way into</a> LibreSSL right afterwards</li>
<li>If you haven&#39;t set up remote logging before, now might be an interesting time to try it out
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=wwbO4eTieQY" rel="nofollow">FreeBSD, not a Linux distro</a></h3>

<ul>
<li>George Neville-Neil gave a presentation recently, titled &quot;FreeBSD: not a Linux distro&quot;</li>
<li>It&#39;s meant to be an introduction to new users that might&#39;ve heard about FreeBSD, but aren&#39;t familiar with any BSD history</li>
<li>He goes through some of that history, and talks about what FreeBSD is and why you might want to use it over other options</li>
<li>There&#39;s even an interesting &quot;thirty years in three minutes&quot; segment</li>
<li>It&#39;s not just a history lesson though, he talks about some of the current features and even some new things coming in the next version(s)</li>
<li>We also learn about filesystems, jails, capsicum, clang, dtrace and the various big companies using FreeBSD in their products</li>
<li>This might be a good video to show your friends or potential employer if you&#39;re looking to introduce FreeBSD to them 
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/long-term-support-considered-harmful" rel="nofollow">Long-term support considered harmful</a></h3>

<ul>
<li>There was recently a <a href="https://www.marc.info/?l=bugtraq&m=142237866420639&w=2" rel="nofollow">pretty horrible bug</a> in GNU&#39;s libc (BSDs aren&#39;t affected, don&#39;t worry)</li>
<li>Aside from the severity of the actual problem, the fix was <a href="https://code.google.com/p/chromium/issues/detail?id=364511" rel="nofollow">delayed</a> for quite a long time, leaving people vulnerable</li>
<li>Ted Unangst writes a post about how this <a href="https://plus.google.com/u/0/+ArtoPekkanen/posts/88jk5ggXYts?cfem=1" rel="nofollow">idea of long-term support</a> could actually be harmful in the long run, and compares it to how OpenBSD does things</li>
<li>OpenBSD releases a new version every six months, and only the two most recent releases get support and security fixes</li>
<li>He describes this as both a good thing and a bad thing: all the bugs in the ecosystem get flushed out within a year, but it forces people to stay (relatively) up-to-date</li>
<li>&quot;Upgrades only get harder and more painful (and more fragile) the longer one goes between them. More changes, more damage. Frequent upgrades amortize the cost and ensure that regressions are caught early.&quot;</li>
<li>There was also <a href="https://lobste.rs/s/a4iijx/long_term_support_considered_harmful" rel="nofollow">some</a> <a href="https://news.ycombinator.com/item?id=8954737" rel="nofollow">discussion</a> about the article you can check out
***</li>
</ul>

<h2>Interview - Andrew Tanenbaum - <a href="mailto:info@minix3.org" rel="nofollow">info@minix3.org</a> / <a href="https://twitter.com/minix3" rel="nofollow">@minix3</a></h2>

<p>MINIX&#39;s integration of NetBSD</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.undeadly.org/cgi?action=article&sid=20150121093259" rel="nofollow">Using AFL on OpenBSD</a></h3>

<ul>
<li>We&#39;ve talked about <a href="http://lcamtuf.coredump.cx/afl/" rel="nofollow">American Fuzzy Lop</a> a bit on a previous episode, and how some OpenBSD devs <a href="https://www.marc.info/?l=openbsd-cvs&w=2&r=1&s=afl&q=b" rel="nofollow">are using it</a> to catch and fix new bugs</li>
<li>Undeadly has a cool guide on how you can get started with fuzzing</li>
<li>It&#39;s a little on the advanced side, but if you&#39;re interested in programming or diagnosing crashes, it&#39;ll be a really interesting article to read</li>
<li>Lots of recent CVEs in other open source projects are attributed to fuzzing - it&#39;s a great way to stress test your software
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/01/lumina-desktop-0-8-1-released/" rel="nofollow">Lumina 0.8.1 released</a></h3>

<ul>
<li>A new version of Lumina, the BSD-licensed desktop environment from PCBSD, has been released</li>
<li>This update includes some new plugins, lots of bugfixes and even &quot;quality-of-life improvements&quot;</li>
<li>There&#39;s a new audio player desktop plugin, a button to easily minimize all windows at once and some cool new customization options</li>
<li>You can get it in PCBSD&#39;s edge repo or install it through regular ports (on FreeBSD, OpenBSD <em>or</em> DragonFly!)</li>
<li>If you haven&#39;t seen our episode about Lumina, where we interview the developer and show you a tour of its features, <a href="http://www.bsdnow.tv/episodes/2014_09_10-luminary_environment" rel="nofollow">gotta go watch it</a>
***</li>
</ul>

<h3><a href="http://homing-on-code.blogspot.com/2015/01/my-first-openbsd-port.html" rel="nofollow">My first OpenBSD port</a></h3>

<ul>
<li>The author of the &quot;Code Rot &amp; Why I Chose OpenBSD&quot; article has a new post up, this time about ports</li>
<li>He recently made his first port and got it into the tree, so he talks about the whole process from start to finish</li>
<li>After learning some of the basics and becoming comfortable running -current, he noticed there wasn&#39;t a port for the &quot;Otter&quot; web browser</li>
<li>At that point he did what you&#39;re <em>supposed to do</em> in that situation, and started working on it himself</li>
<li>OpenBSD has a great <a href="http://www.openbsd.org/faq/ports/" rel="nofollow">porter&#39;s handbook</a> that he referenced throughout the process</li>
<li>Long story short, his browser of choice is in the official ports collection and now he&#39;s the maintainer (and gets to deal with any bug reports, of course)</li>
<li>If some software you use isn&#39;t available for whatever BSD you&#39;re using, you could be the one to make it happen
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/docs/docs/howtos/howtoslide/" rel="nofollow">How to slide with DragonFly</a></h3>

<ul>
<li>DragonFly BSD has a new HAMMER FS utility called &quot;Slider&quot;</li>
<li>It&#39;s used to easily browse through file history and undelete files - imagine something like a commandline version of Apple&#39;s Time Machine</li>
<li>They have a pretty comprehensive guide on how to use it on their wiki page</li>
<li>If you&#39;re using HAMMER FS, this is a really handy tool to have, check it out
***</li>
</ul>

<h3><a href="https://blog.al-shami.net/2015/01/howto-small-mail-server-with-salt-dovecot-and-opensmtpd/" rel="nofollow">OpenSMTPD with Dovecot and Salt</a></h3>

<ul>
<li>We recently had a feedback question about which mail servers you can use on BSD - Postfix, Exim and OpenSMTPD being the big three</li>
<li>This blog post details how to set up OpenSMTPD, including Dovecot for IMAP and Salt for quick and easy deployment</li>
<li>Intrigued by it becoming the default MTA in OpenBSD, the author decided to give it a try after being a long-time Postfix fan</li>
<li>&quot;Small, fast, stable, and very easy to customize, no more ugly m4 macros to deal with&quot;</li>
<li>Check it out if you&#39;ve been thinking about configuring your first mail server on any of the BSDs
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20q2fSfEO" rel="nofollow">Christopher writes in</a> (<a href="https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails-ezjail.html#jails-ezjail-update-os" rel="nofollow">handbook section</a>)</li>
<li><a href="http://slexy.org/view/s2zGvAczeN" rel="nofollow">Mark writes in</a></li>
<li><a href="http://slexy.org/view/s21Dn2Tey8" rel="nofollow">Kevin writes in</a></li>
<li><a href="http://slexy.org/view/s215nxxrtF" rel="nofollow">Stefano writes in</a></li>
<li><a href="http://slexy.org/view/s20cwezc9l" rel="nofollow">Matthew writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-misc&m=142194821910087&w=2" rel="nofollow">Not that interested actually</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-jail/2015-January/002742.html" rel="nofollow">This guy again</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-doc/2015-January/024888.html" rel="nofollow">Yep, this is the place</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>73: Pipe Dreams</title>
  <link>https://www.bsdnow.tv/73</link>
  <guid isPermaLink="false">bca95163-7c0b-4440-902b-594ea8c61554</guid>
  <pubDate>Wed, 21 Jan 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/bca95163-7c0b-4440-902b-594ea8c61554.mp3" length="65969428" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show we'll be chatting with David Maxwell, a former NetBSD security officer. He's got an interesting project called Pipecut that takes a whole new approach to the commandline. We've also got answers to viewer-submitted questions and all this week's headlines, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:31:37</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show we'll be chatting with David Maxwell, a former NetBSD security officer. He's got an interesting project called Pipecut that takes a whole new approach to the commandline. We've also got answers to viewer-submitted questions and all this week's headlines, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.digitalocean.com/" title="DigitalOcean"&gt;&lt;img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD quarterly status report (https://www.freebsd.org/news/status/report-2014-10-2014-12.html)
The FreeBSD team has posted an updated on some of their activities between October and December of 2014
They put a big focus on compatibility with other systems: the Linux emulation layer, bhyve (http://www.bsdnow.tv/tutorials/bhyve), WINE and Xen all got some nice improvements
As always, the report has lots of updates from the various teams working on different parts of the OS and ports infrastructure
The release engineering team got 10.1 out the door, the ports team shuffled a few members in and out and continued working on closing more PRs
FreeBSD's forums underwent a huge change, and discussion about the new support model for release cycles continues (hopefully taking effect after 11.0 is released)
Git was promoted from beta to an officially-supported version control system (Kris is happy)
The core team is also assembling a new QA team to ensure better code quality in critical areas, such as security and release engineering, after getting a number of complaints
Other notable entries include: lots of bhyve fixes, Clang/LLVM being updated to 3.5.0, ongoing work to the external toolchain, adding FreeBSD support to more "cloud" services, pkgng updates, work on SecureBoot, more ARM support and graphics stack improvements
Check out the full report for all the details that we didn't cover
***
OpenBSD package signature audit (http://linux-audit.com/vulnerabilities-and-digital-signatures-for-openbsd-software-packages/)
"Linux Audit" is a website focused on auditing and hardening systems, as well as educating people about securing their boxes
They recently did an article about OpenBSD, specifically their ports and package system (http://www.bsdnow.tv/tutorials/ports-obsd) and signing infrastructure
The author gives a little background on the difference between ports and binary packages, then goes through the technical details of how releases and packages are cryptographically signed
Package signature formats and public key distribution methods are also touched on
After some heckling, the author of the post said he plans to write more BSD security articles, so look forward to them in the future
If you haven't seen our episode about signify (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures) with Ted Unangst, that would be a great one to check out after reading this
***
Replacing a Linux router with BSD (http://ask.slashdot.org/story/15/01/15/1547209/ask-slashdot-migrating-a-router-from-linux-to-bsd)
There was recently a Slashdot discussion about migrating a Linux-based router to a BSD-based one
The poster begins with "I'm in the camp that doesn't trust systemd. You can discuss the technical merits of all init solutions all you want, but if I wanted to run Windows NT I'd run Windows NT, not Linux. So I've decided to migrate my homebrew router/firewall/samba server to one of the BSDs."
A lot of people were quick to recommend OPNsense (http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach) and pfSense, being that they're very easy to administer (requiring basically no BSD knowledge at all)
Other commenters suggested a more hands-on approach, setting one up yourself with FreeBSD (http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/) or OpenBSD (http://www.bsdnow.tv/tutorials/openbsd-router)
If you've been thinking about moving some routers over from Linux or other commercial solution, this might be a good discussion to read through
Unfortunately, a lot of the comments are just Linux users bickering about systemd, so you'll have to wade through some of that to get to the good information
***
LibreSSL in FreeBSD and OPNsense (http://bsdxbsdx.blogspot.com/2015/01/switching-to-openssl-from-ports-in.html)
A FreeBSD sysadmin has started documenting his experience replacing OpenSSL in the base system with the one from ports (and also experimenting with LibreSSL)
The reasoning being that updates in base tend to lag behind (http://www.openbsd.org/papers/eurobsdcon2014-libressl.html), whereas the port can be updated for security very quickly
OPNsense developers are looking into (https://twitter.com/fitchitis/status/555625679614521345)  switching away (http://forum.opnsense.org/index.php?topic=21.0) from OpenSSL to LibreSSL's portable version (http://www.bsdnow.tv/episodes/2014_07_30-liberating_ssl), for both their ports and base system, which would be a pretty huge differentiator for their project
Some ports still need fixing (https://bugs.freebsd.org/bugzilla/buglist.cgi?order=Importance&amp;amp;query_format=advanced&amp;amp;short_desc=libressl&amp;amp;short_desc_type=allwordssubstr) to be compatible though, particularly a few (https://github.com/opnsense/ports/commit/c15af648e9d5fcecf0ae666292e8f41c08979057) python-related (https://github.com/pyca/cryptography/issues/928) ones
If you're a FreeBSD ports person, get involved and help squash some of the last remaining bugs
A lot of the work has already been done in OpenBSD's ports tree (http://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/) - some patches just need to be adopted
More and more upstream projects are incorporating LibreSSL patches in their code - let your favorite software vendor know that you're using it
***
Interview - David Maxwell - david@netbsd.org (mailto:david@netbsd.org) / @davidwmaxwell (https://twitter.com/david_w_maxwell)
Pipecut (https://www.youtube.com/watch?v=CZHEZHK4jRc), text processing, commandline wizardry
News Roundup
Jetpack, a new jail container system (https://github.com/3ofcoins/jetpack)
A new project was launched to adapt FreeBSD jails to the "app container specification"
While still pretty experimental in terms of the development phase, this might be something to show your Linux friends who are in love with docker
It's a similar project to iocage (https://github.com/pannon/iocage) or bsdploy (https://github.com/ployground/bsdploy), which we haven't talked a whole lot about
There was also some discussion (https://news.ycombinator.com/item?id=8893630) about it on Hacker News
***
Separating base and package binaries (https://www.reddit.com/r/BSD/comments/2szofc)
All of the main BSDs make a strong separation between the base system and third party software
This is in contrast to Linux where there's no real concept of a "base system" - more recently, some distros have even merged all the binaries into a single directory
A user asks the community about the BSD way of doing it, trying to find out the advantages and disadvantages of both hierarchies
Read the comments for the full explanation, but having things separated really helps keep things organized
***
Updated i915kms driver for FreeBSD (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=277487)
This update brings the FreeBSD code closer inline with the Linux code, to make it easier to update going forward
It doesn't introduce Haswell support just yet, but was required before the Haswell bits can be added
***
Year of the OpenBSD desktop (http://zacbrown.org/2015/01/18/openbsd-as-a-desktop/)
Here we have an article about using OpenBSD as a daily driver for regular desktop usage
The author says he "ran fifty thousand different distributions, never being satisfied"
After dealing with the problems of Linux and fragmentation, he eventually gave up and bought a Macbook
He also used FreeBSD between versions 7 and 9, finding a "a mostly harmonious environment," but regressions lead him to give up on desktop *nix once again
Starting with 2015, he's back and is using OpenBSD on a Thinkpad x201
The rest of the article covers some of his configuration tweaks and gives an overall conclusion on his current setup
He apparently used our desktop tutorial (http://www.bsdnow.tv/tutorials/the-desktop-obsd) - thanks for watching!
***
Unattended FreeBSD installation (http://louwrentius.com/freebsd-101-unattended-install-over-pxe-http-no-nfs.html)
A new BSD user was looking to get some more experience, so he documented how to install FreeBSD over PXE
His goal was to have a setup similar to Redhat's "kickstart" or OpenBSD's autoinstall (http://www.bsdnow.tv/tutorials/autoinstall)
The article shows you how to set up DHCP and TFTP, with no NFS share setup required
He also gives a mention to mfsbsd, showing how you can customize its startup script to do most of the work for you
***
Feedback/Questions
Robert writes in (http://slexy.org/view/s20UsZjN4h)
Sean writes in (http://slexy.org/view/s219cMQz3U)
l33tname writes in (http://slexy.org/view/s2EkzMUMyb)
Charlie writes in (http://slexy.org/view/s2nq6L6H1n)
Eric writes in (http://slexy.org/view/s21EGqUYLd)
***
Mailing List Gold
Clowning around (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=142159202606668&amp;amp;w=2)
Better than succeeding in this case (https://lists.freebsd.org/pipermail/freebsd-ports/2015-January/097734.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, pipecut, david maxwell, commandline, shell, libressl, router, pf, cryptography, router, openssl, bhyve, digitalocean</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show we&#39;ll be chatting with David Maxwell, a former NetBSD security officer. He&#39;s got an interesting project called Pipecut that takes a whole new approach to the commandline. We&#39;ve also got answers to viewer-submitted questions and all this week&#39;s headlines, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2014-10-2014-12.html" rel="nofollow">FreeBSD quarterly status report</a></h3>

<ul>
<li>The FreeBSD team has posted an updated on some of their activities between October and December of 2014</li>
<li>They put a big focus on compatibility with other systems: the Linux emulation layer, <a href="http://www.bsdnow.tv/tutorials/bhyve" rel="nofollow">bhyve</a>, WINE and Xen all got some nice improvements</li>
<li>As always, the report has lots of updates from the various teams working on different parts of the OS and ports infrastructure</li>
<li>The release engineering team got 10.1 out the door, the ports team shuffled a few members in and out and continued working on closing more PRs</li>
<li>FreeBSD&#39;s forums underwent a huge change, and discussion about the new support model for release cycles continues (hopefully taking effect after 11.0 is released)</li>
<li>Git was promoted from beta to an officially-supported version control system (Kris is happy)</li>
<li>The core team is also assembling a new QA team to ensure better code quality in critical areas, such as security and release engineering, after getting a number of complaints</li>
<li>Other notable entries include: lots of bhyve fixes, Clang/LLVM being updated to 3.5.0, ongoing work to the external toolchain, adding FreeBSD support to more &quot;cloud&quot; services, pkgng updates, work on SecureBoot, more ARM support and graphics stack improvements</li>
<li>Check out the full report for all the details that we didn&#39;t cover
***</li>
</ul>

<h3><a href="http://linux-audit.com/vulnerabilities-and-digital-signatures-for-openbsd-software-packages/" rel="nofollow">OpenBSD package signature audit</a></h3>

<ul>
<li>&quot;Linux Audit&quot; is a website focused on auditing and hardening systems, as well as educating people about securing their boxes</li>
<li>They recently did an article about OpenBSD, specifically their <a href="http://www.bsdnow.tv/tutorials/ports-obsd" rel="nofollow">ports and package system</a> and signing infrastructure</li>
<li>The author gives a little background on the difference between ports and binary packages, then goes through the technical details of how releases and packages are cryptographically signed</li>
<li>Package signature formats and public key distribution methods are also touched on</li>
<li>After some heckling, the author of the post said he plans to write more BSD security articles, so look forward to them in the future</li>
<li>If you haven&#39;t seen <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">our episode about signify</a> with Ted Unangst, that would be a great one to check out after reading this
***</li>
</ul>

<h3><a href="http://ask.slashdot.org/story/15/01/15/1547209/ask-slashdot-migrating-a-router-from-linux-to-bsd" rel="nofollow">Replacing a Linux router with BSD</a></h3>

<ul>
<li>There was recently a Slashdot discussion about migrating a Linux-based router to a BSD-based one</li>
<li>The poster begins with &quot;I&#39;m in the camp that doesn&#39;t trust systemd. You can discuss the technical merits of all init solutions all you want, but if I wanted to run Windows NT I&#39;d run Windows NT, not Linux. So I&#39;ve decided to migrate my homebrew router/firewall/samba server to one of the BSDs.&quot;</li>
<li>A lot of people were quick to recommend <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">OPNsense</a> and pfSense, being that they&#39;re very easy to administer (requiring basically no BSD knowledge at all)</li>
<li>Other commenters suggested a more hands-on approach, setting one up yourself with <a href="http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/" rel="nofollow">FreeBSD</a> or <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">OpenBSD</a></li>
<li>If you&#39;ve been thinking about moving some routers over from Linux or other commercial solution, this might be a good discussion to read through</li>
<li>Unfortunately, a lot of the comments are just Linux users bickering about systemd, so you&#39;ll have to wade through some of that to get to the good information
***</li>
</ul>

<h3><a href="http://bsdxbsdx.blogspot.com/2015/01/switching-to-openssl-from-ports-in.html" rel="nofollow">LibreSSL in FreeBSD and OPNsense</a></h3>

<ul>
<li>A FreeBSD sysadmin has started documenting his experience replacing OpenSSL in the base system with the one from ports (and also experimenting with LibreSSL)</li>
<li>The reasoning being that updates in base <a href="http://www.openbsd.org/papers/eurobsdcon2014-libressl.html" rel="nofollow">tend to lag behind</a>, whereas the port can be updated for security very quickly</li>
<li>OPNsense developers are <a href="https://twitter.com/fitchitis/status/555625679614521345" rel="nofollow">looking into</a>  <a href="http://forum.opnsense.org/index.php?topic=21.0" rel="nofollow">switching away</a> from OpenSSL to <a href="http://www.bsdnow.tv/episodes/2014_07_30-liberating_ssl" rel="nofollow">LibreSSL&#39;s portable version</a>, for both their ports and base system, which would be a pretty huge differentiator for their project</li>
<li>Some ports <a href="https://bugs.freebsd.org/bugzilla/buglist.cgi?order=Importance&query_format=advanced&short_desc=libressl&short_desc_type=allwordssubstr" rel="nofollow">still need fixing</a> to be compatible though, particularly <a href="https://github.com/opnsense/ports/commit/c15af648e9d5fcecf0ae666292e8f41c08979057" rel="nofollow">a few</a> <a href="https://github.com/pyca/cryptography/issues/928" rel="nofollow">python-related</a> ones</li>
<li>If you&#39;re a FreeBSD ports person, get involved and help squash some of the last remaining bugs</li>
<li>A lot of the work has already been done <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/" rel="nofollow">in OpenBSD&#39;s ports tree</a> - some patches just need to be adopted</li>
<li>More and more upstream projects are incorporating LibreSSL patches in their code - let your favorite software vendor know that you&#39;re using it
***</li>
</ul>

<h2>Interview - David Maxwell - <a href="mailto:david@netbsd.org" rel="nofollow">david@netbsd.org</a> / <a href="https://twitter.com/david_w_maxwell" rel="nofollow">@david_w_maxwell</a></h2>

<p><a href="https://www.youtube.com/watch?v=CZHEZHK4jRc" rel="nofollow">Pipecut</a>, text processing, commandline wizardry</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/3ofcoins/jetpack" rel="nofollow">Jetpack, a new jail container system</a></h3>

<ul>
<li>A new project was launched to adapt FreeBSD jails to the &quot;app container specification&quot;</li>
<li>While still pretty experimental in terms of the development phase, this might be something to show your Linux friends who are in love with docker</li>
<li>It&#39;s a similar project to <a href="https://github.com/pannon/iocage" rel="nofollow">iocage</a> or <a href="https://github.com/ployground/bsdploy" rel="nofollow">bsdploy</a>, which we haven&#39;t talked a whole lot about</li>
<li>There was also <a href="https://news.ycombinator.com/item?id=8893630" rel="nofollow">some discussion</a> about it on Hacker News
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/BSD/comments/2szofc" rel="nofollow">Separating base and package binaries</a></h3>

<ul>
<li>All of the main BSDs make a strong separation between the base system and third party software</li>
<li>This is in contrast to Linux where there&#39;s no real concept of a &quot;base system&quot; - more recently, some distros have even merged all the binaries into a single directory</li>
<li>A user asks the community about the BSD way of doing it, trying to find out the advantages and disadvantages of both hierarchies</li>
<li>Read the comments for the full explanation, but having things separated really helps keep things organized
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=277487" rel="nofollow">Updated i915kms driver for FreeBSD</a></h3>

<ul>
<li>This update brings the FreeBSD code closer inline with the Linux code, to make it easier to update going forward</li>
<li>It doesn&#39;t introduce Haswell support just yet, but was required before the Haswell bits can be added
***</li>
</ul>

<h3><a href="http://zacbrown.org/2015/01/18/openbsd-as-a-desktop/" rel="nofollow">Year of the OpenBSD desktop</a></h3>

<ul>
<li>Here we have an article about using OpenBSD as a daily driver for regular desktop usage</li>
<li>The author says he &quot;ran fifty thousand different distributions, never being satisfied&quot;</li>
<li>After dealing with the problems of Linux and fragmentation, he eventually gave up and bought a Macbook</li>
<li>He also used FreeBSD between versions 7 and 9, finding a &quot;a mostly harmonious environment,&quot; but regressions lead him to give up on desktop *nix once again</li>
<li>Starting with 2015, he&#39;s back and is using OpenBSD on a Thinkpad x201</li>
<li>The rest of the article covers some of his configuration tweaks and gives an overall conclusion on his current setup</li>
<li>He apparently used <a href="http://www.bsdnow.tv/tutorials/the-desktop-obsd" rel="nofollow">our desktop tutorial</a> - thanks for watching!
***</li>
</ul>

<h3><a href="http://louwrentius.com/freebsd-101-unattended-install-over-pxe-http-no-nfs.html" rel="nofollow">Unattended FreeBSD installation</a></h3>

<ul>
<li>A new BSD user was looking to get some more experience, so he documented how to install FreeBSD over PXE</li>
<li>His goal was to have a setup similar to Redhat&#39;s &quot;kickstart&quot; or <a href="http://www.bsdnow.tv/tutorials/autoinstall" rel="nofollow">OpenBSD&#39;s autoinstall</a></li>
<li>The article shows you how to set up DHCP and TFTP, with no NFS share setup required</li>
<li>He also gives a mention to mfsbsd, showing how you can customize its startup script to do most of the work for you
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20UsZjN4h" rel="nofollow">Robert writes in</a></li>
<li><a href="http://slexy.org/view/s219cMQz3U" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s2EkzMUMyb" rel="nofollow">l33tname writes in</a></li>
<li><a href="http://slexy.org/view/s2nq6L6H1n" rel="nofollow">Charlie writes in</a></li>
<li><a href="http://slexy.org/view/s21EGqUYLd" rel="nofollow">Eric writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=142159202606668&w=2" rel="nofollow">Clowning around</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2015-January/097734.html" rel="nofollow">Better than succeeding in this case</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show we&#39;ll be chatting with David Maxwell, a former NetBSD security officer. He&#39;s got an interesting project called Pipecut that takes a whole new approach to the commandline. We&#39;ve also got answers to viewer-submitted questions and all this week&#39;s headlines, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/1.png" alt="iXsystems - Enterprise Servers and Storage for Open Source" /></a><a href="http://www.digitalocean.com/" title="DigitalOcean"><img src="/images/2.png" alt="DigitalOcean - Simple Cloud Hosting, Built for Developers" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2014-10-2014-12.html" rel="nofollow">FreeBSD quarterly status report</a></h3>

<ul>
<li>The FreeBSD team has posted an updated on some of their activities between October and December of 2014</li>
<li>They put a big focus on compatibility with other systems: the Linux emulation layer, <a href="http://www.bsdnow.tv/tutorials/bhyve" rel="nofollow">bhyve</a>, WINE and Xen all got some nice improvements</li>
<li>As always, the report has lots of updates from the various teams working on different parts of the OS and ports infrastructure</li>
<li>The release engineering team got 10.1 out the door, the ports team shuffled a few members in and out and continued working on closing more PRs</li>
<li>FreeBSD&#39;s forums underwent a huge change, and discussion about the new support model for release cycles continues (hopefully taking effect after 11.0 is released)</li>
<li>Git was promoted from beta to an officially-supported version control system (Kris is happy)</li>
<li>The core team is also assembling a new QA team to ensure better code quality in critical areas, such as security and release engineering, after getting a number of complaints</li>
<li>Other notable entries include: lots of bhyve fixes, Clang/LLVM being updated to 3.5.0, ongoing work to the external toolchain, adding FreeBSD support to more &quot;cloud&quot; services, pkgng updates, work on SecureBoot, more ARM support and graphics stack improvements</li>
<li>Check out the full report for all the details that we didn&#39;t cover
***</li>
</ul>

<h3><a href="http://linux-audit.com/vulnerabilities-and-digital-signatures-for-openbsd-software-packages/" rel="nofollow">OpenBSD package signature audit</a></h3>

<ul>
<li>&quot;Linux Audit&quot; is a website focused on auditing and hardening systems, as well as educating people about securing their boxes</li>
<li>They recently did an article about OpenBSD, specifically their <a href="http://www.bsdnow.tv/tutorials/ports-obsd" rel="nofollow">ports and package system</a> and signing infrastructure</li>
<li>The author gives a little background on the difference between ports and binary packages, then goes through the technical details of how releases and packages are cryptographically signed</li>
<li>Package signature formats and public key distribution methods are also touched on</li>
<li>After some heckling, the author of the post said he plans to write more BSD security articles, so look forward to them in the future</li>
<li>If you haven&#39;t seen <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">our episode about signify</a> with Ted Unangst, that would be a great one to check out after reading this
***</li>
</ul>

<h3><a href="http://ask.slashdot.org/story/15/01/15/1547209/ask-slashdot-migrating-a-router-from-linux-to-bsd" rel="nofollow">Replacing a Linux router with BSD</a></h3>

<ul>
<li>There was recently a Slashdot discussion about migrating a Linux-based router to a BSD-based one</li>
<li>The poster begins with &quot;I&#39;m in the camp that doesn&#39;t trust systemd. You can discuss the technical merits of all init solutions all you want, but if I wanted to run Windows NT I&#39;d run Windows NT, not Linux. So I&#39;ve decided to migrate my homebrew router/firewall/samba server to one of the BSDs.&quot;</li>
<li>A lot of people were quick to recommend <a href="http://www.bsdnow.tv/episodes/2015_01_14-common_sense_approach" rel="nofollow">OPNsense</a> and pfSense, being that they&#39;re very easy to administer (requiring basically no BSD knowledge at all)</li>
<li>Other commenters suggested a more hands-on approach, setting one up yourself with <a href="http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/" rel="nofollow">FreeBSD</a> or <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">OpenBSD</a></li>
<li>If you&#39;ve been thinking about moving some routers over from Linux or other commercial solution, this might be a good discussion to read through</li>
<li>Unfortunately, a lot of the comments are just Linux users bickering about systemd, so you&#39;ll have to wade through some of that to get to the good information
***</li>
</ul>

<h3><a href="http://bsdxbsdx.blogspot.com/2015/01/switching-to-openssl-from-ports-in.html" rel="nofollow">LibreSSL in FreeBSD and OPNsense</a></h3>

<ul>
<li>A FreeBSD sysadmin has started documenting his experience replacing OpenSSL in the base system with the one from ports (and also experimenting with LibreSSL)</li>
<li>The reasoning being that updates in base <a href="http://www.openbsd.org/papers/eurobsdcon2014-libressl.html" rel="nofollow">tend to lag behind</a>, whereas the port can be updated for security very quickly</li>
<li>OPNsense developers are <a href="https://twitter.com/fitchitis/status/555625679614521345" rel="nofollow">looking into</a>  <a href="http://forum.opnsense.org/index.php?topic=21.0" rel="nofollow">switching away</a> from OpenSSL to <a href="http://www.bsdnow.tv/episodes/2014_07_30-liberating_ssl" rel="nofollow">LibreSSL&#39;s portable version</a>, for both their ports and base system, which would be a pretty huge differentiator for their project</li>
<li>Some ports <a href="https://bugs.freebsd.org/bugzilla/buglist.cgi?order=Importance&query_format=advanced&short_desc=libressl&short_desc_type=allwordssubstr" rel="nofollow">still need fixing</a> to be compatible though, particularly <a href="https://github.com/opnsense/ports/commit/c15af648e9d5fcecf0ae666292e8f41c08979057" rel="nofollow">a few</a> <a href="https://github.com/pyca/cryptography/issues/928" rel="nofollow">python-related</a> ones</li>
<li>If you&#39;re a FreeBSD ports person, get involved and help squash some of the last remaining bugs</li>
<li>A lot of the work has already been done <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/" rel="nofollow">in OpenBSD&#39;s ports tree</a> - some patches just need to be adopted</li>
<li>More and more upstream projects are incorporating LibreSSL patches in their code - let your favorite software vendor know that you&#39;re using it
***</li>
</ul>

<h2>Interview - David Maxwell - <a href="mailto:david@netbsd.org" rel="nofollow">david@netbsd.org</a> / <a href="https://twitter.com/david_w_maxwell" rel="nofollow">@david_w_maxwell</a></h2>

<p><a href="https://www.youtube.com/watch?v=CZHEZHK4jRc" rel="nofollow">Pipecut</a>, text processing, commandline wizardry</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/3ofcoins/jetpack" rel="nofollow">Jetpack, a new jail container system</a></h3>

<ul>
<li>A new project was launched to adapt FreeBSD jails to the &quot;app container specification&quot;</li>
<li>While still pretty experimental in terms of the development phase, this might be something to show your Linux friends who are in love with docker</li>
<li>It&#39;s a similar project to <a href="https://github.com/pannon/iocage" rel="nofollow">iocage</a> or <a href="https://github.com/ployground/bsdploy" rel="nofollow">bsdploy</a>, which we haven&#39;t talked a whole lot about</li>
<li>There was also <a href="https://news.ycombinator.com/item?id=8893630" rel="nofollow">some discussion</a> about it on Hacker News
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/BSD/comments/2szofc" rel="nofollow">Separating base and package binaries</a></h3>

<ul>
<li>All of the main BSDs make a strong separation between the base system and third party software</li>
<li>This is in contrast to Linux where there&#39;s no real concept of a &quot;base system&quot; - more recently, some distros have even merged all the binaries into a single directory</li>
<li>A user asks the community about the BSD way of doing it, trying to find out the advantages and disadvantages of both hierarchies</li>
<li>Read the comments for the full explanation, but having things separated really helps keep things organized
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=277487" rel="nofollow">Updated i915kms driver for FreeBSD</a></h3>

<ul>
<li>This update brings the FreeBSD code closer inline with the Linux code, to make it easier to update going forward</li>
<li>It doesn&#39;t introduce Haswell support just yet, but was required before the Haswell bits can be added
***</li>
</ul>

<h3><a href="http://zacbrown.org/2015/01/18/openbsd-as-a-desktop/" rel="nofollow">Year of the OpenBSD desktop</a></h3>

<ul>
<li>Here we have an article about using OpenBSD as a daily driver for regular desktop usage</li>
<li>The author says he &quot;ran fifty thousand different distributions, never being satisfied&quot;</li>
<li>After dealing with the problems of Linux and fragmentation, he eventually gave up and bought a Macbook</li>
<li>He also used FreeBSD between versions 7 and 9, finding a &quot;a mostly harmonious environment,&quot; but regressions lead him to give up on desktop *nix once again</li>
<li>Starting with 2015, he&#39;s back and is using OpenBSD on a Thinkpad x201</li>
<li>The rest of the article covers some of his configuration tweaks and gives an overall conclusion on his current setup</li>
<li>He apparently used <a href="http://www.bsdnow.tv/tutorials/the-desktop-obsd" rel="nofollow">our desktop tutorial</a> - thanks for watching!
***</li>
</ul>

<h3><a href="http://louwrentius.com/freebsd-101-unattended-install-over-pxe-http-no-nfs.html" rel="nofollow">Unattended FreeBSD installation</a></h3>

<ul>
<li>A new BSD user was looking to get some more experience, so he documented how to install FreeBSD over PXE</li>
<li>His goal was to have a setup similar to Redhat&#39;s &quot;kickstart&quot; or <a href="http://www.bsdnow.tv/tutorials/autoinstall" rel="nofollow">OpenBSD&#39;s autoinstall</a></li>
<li>The article shows you how to set up DHCP and TFTP, with no NFS share setup required</li>
<li>He also gives a mention to mfsbsd, showing how you can customize its startup script to do most of the work for you
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20UsZjN4h" rel="nofollow">Robert writes in</a></li>
<li><a href="http://slexy.org/view/s219cMQz3U" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s2EkzMUMyb" rel="nofollow">l33tname writes in</a></li>
<li><a href="http://slexy.org/view/s2nq6L6H1n" rel="nofollow">Charlie writes in</a></li>
<li><a href="http://slexy.org/view/s21EGqUYLd" rel="nofollow">Eric writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=142159202606668&w=2" rel="nofollow">Clowning around</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2015-January/097734.html" rel="nofollow">Better than succeeding in this case</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>72: Common *Sense Approach</title>
  <link>https://www.bsdnow.tv/72</link>
  <guid isPermaLink="false">efe89103-4a81-4974-89f3-cb650975dace</guid>
  <pubDate>Wed, 14 Jan 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/efe89103-4a81-4974-89f3-cb650975dace.mp3" length="57654580" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we'll be talking to Jos Schellevis about OPNsense, a new firewall project that was forked from pfSense. We'll learn some of the backstory and see what they've got planned for the future. We've also got all this week's news and answers to all your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:20:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we'll be talking to Jos Schellevis about OPNsense, a new firewall project that was forked from pfSense. We'll learn some of the backstory and see what they've got planned for the future. We've also got all this week's news and answers to all your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
Be your own VPN provider with OpenBSD (http://networkfilter.blogspot.com/2015/01/be-your-own-vpn-provider-with-openbsd.html)
We've covered how to build a BSD-based gateway that tunnels all your traffic through a VPN in the past - but what if you don't trust any VPN company?
It's easy for anyone to say "of course we don't run a modified version of OpenVPN that logs all your traffic... what are you talking about?"
The VPN provider might also be slow to apply security patches, putting you and the rest of the users at risk
With this guide, you'll be able to cut out the middleman and create your own VPN, using OpenBSD
It covers topics such as protecting your server, securing DNS lookups, configuring the firewall properly, general security practices and of course actually setting up the VPN
***
FreeBSD vs Gentoo comparison (http://www.iwillfolo.com/2015/01/comparison-gentoo-vs-freebsd-tweak-tweak-little-star/)
People coming over from Linux will sometimes compare FreeBSD to Gentoo, mostly because of the ports-like portage system for installing software
This article takes that notion and goes much more in-depth, with lots more comparisons between the two systems
The author mentions that the installers are very different, ports and portage have many subtle differences and a few other things
If you're a curious Gentoo user considering FreeBSD, this might be a good article to check out to learn a bit more
***
Kernel W^X in OpenBSD (https://www.marc.info/?l=openbsd-tech&amp;amp;m=142120787308107&amp;amp;w=2)
W^X, "Write XOR Execute (https://en.wikipedia.org/wiki/W%5EX)," is a security feature of OpenBSD with a rather strange-looking name
It's meant to be an exploit mitigation technique, disallowing pages in the address space of a process to be both writable and executable at the same time
This helps prevent some types of buffer overflows: code injected into it won't execute, but will crash the program (quite obviously the lesser of the two evils)
Through some recent work, OpenBSD's kernel now has no part of the address space without this feature - whereas it was only enabled in the userland previously (http://www.openbsd.org/papers/ru13-deraadt/)
Doing this incorrectly in the kernel could lead to far worse consequences, and is a lot harder to debug, so this is a pretty huge accomplishment that's been in the works for a while
More technical details can be found in some recent CVS commits (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141917924602780&amp;amp;w=2)
***
Building an IPFW-based router (http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/)
We've covered building routers with PF (http://www.bsdnow.tv/tutorials/openbsd-router) many times before, but what about IPFW (https://www.freebsd.org/doc/handbook/firewalls-ipfw.html)?
A certain host of a certain podcast decided it was finally time to replace his disappointing (https://github.com/jduck/asus-cmd) consumer router with something BSD-based
In this blog post, Kris details his experience building and configuring a new router for his home, using IPFW as the firewall
He covers in-kernel NAT and NATD, installing a DHCP server from packages and even touches on NAT reflection a bit
If you're an IPFW fan and are thinking about putting together a new router, give this post a read
***
Interview - Jos Schellevis - project@opnsense.org (mailto:project@opnsense.org) / @opnsense (https://twitter.com/opnsense)
The birth of OPNsense (http://opnsense.org)
News Roundup
On profiling HTTP (http://adrianchadd.blogspot.com/2015/01/on-profiling-http-or-god-damnit-people.html)
Adrian Chadd, who we've had on the show before (http://www.bsdnow.tv/episodes/2014_09_17-the_promised_wlan), has been doing some more ultra-high performance testing
Faced with the problem of how to generate a massive amount of HTTP traffic, he looked into the current state of benchmarking tools
According to him, it's "not very pretty"
He decided to work on a new tool to benchmark huge amounts of web traffic, and the rest of this post describes the whole process
You can check out his new code on Github (https://github.com/erikarn/libevhtp-http/) right now
***
Using divert(4) to reduce attacks (http://daemonforums.org/showthread.php?s=db0dd79ca26eb645eadd2d8abd267cae&amp;amp;t=8846)
We talked about using divert(4) (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/divert.4) with PF last week, and this post is a good follow-up to that introduction (though unrelated to that series)
It talks about how you can use divert, combined with some blacklists, to reduce attacks on whatever public services you're running
PF has good built-in rate limiting for abusive IPs that hit rapidly, but when they attack slowly over a longer period of time, that won't work
The Composite Blocking List is a public DNS blocklist, operated alongside Spamhaus, that contains many IPs known to be malicious
Consider setting this up to reduce the attack spam in your logs if you run public services
***
ChaCha20 patchset for GELI (https://lists.freebsd.org/pipermail/freebsd-hackers/2015-January/046814.html)
A user has posted a patch to the freebsd-hackers list that adds ChaCha support to GELI, the disk encryption (http://www.bsdnow.tv/tutorials/fde) system
There are also some benchmarks that look pretty good in terms of performance
Currently, GELI defaults to AES in XTS mode (https://en.wikipedia.org/wiki/Disk_encryption_theory#XEX-based_tweaked-codebook_mode_with_ciphertext_stealing_.28XTS.29) with a few tweakable options (but also supports Blowfish, Camellia and Triple DES)
There's some discussion (https://lists.freebsd.org/pipermail/freebsd-hackers/2015-January/046824.html) going on about whether a stream cipher (https://en.wikipedia.org/wiki/Stream_cipher) is suitable or not (https://lists.freebsd.org/pipermail/freebsd-hackers/2015-January/046834.html) for disk encryption though, so this might not be a match made in heaven just yet
***
PCBSD update system enhancements (http://blog.pcbsd.org/2015/01/new-update-gui-for-pc-bsd-automatic-updates/)
The PCBSD update utility has gotten an update itself, now supporting automatic upgrades
You can choose what parts of your system you want to let it automatically handle (packages, security updates)
The update system uses ZFS and Boot Environments for safe updating and bypasses some dubious pkgng functionality
There's also a new graphical frontend available for it
***
Feedback/Questions
Mat writes in (http://slexy.org/view/s2XJhAsffU)
Chris writes in (http://slexy.org/view/s20qnSHujZ)
Andy writes in (http://slexy.org/view/s21O0MShqi)
Beau writes in (http://slexy.org/view/s2LutVQOXN) 
Kutay writes in (http://slexy.org/view/s21Esexdrc)
***
Mailing List Gold
Wait, a real one? (https://www.mail-archive.com/advocacy@openbsd.org/msg02249.html)
What's that glowing... (https://www.marc.info/?l=openbsd-misc&amp;amp;m=142125454022458&amp;amp;w=2)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, bsd, interview, opnsense, pfsense, m0n0wall, firewall, gateway, router, php, fork, deciso, netgate, portage, owncloud, soekris, apu, pcengines, alix, vpn, ipfw</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we&#39;ll be talking to Jos Schellevis about OPNsense, a new firewall project that was forked from pfSense. We&#39;ll learn some of the backstory and see what they&#39;ve got planned for the future. We&#39;ve also got all this week&#39;s news and answers to all your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://networkfilter.blogspot.com/2015/01/be-your-own-vpn-provider-with-openbsd.html" rel="nofollow">Be your own VPN provider with OpenBSD</a></h3>

<ul>
<li>We&#39;ve covered how to build a BSD-based gateway that tunnels all your traffic through a VPN in the past - but what if you don&#39;t trust any VPN company?</li>
<li>It&#39;s easy for anyone to say &quot;of course we don&#39;t run a modified version of OpenVPN that logs all your traffic... what are you talking about?&quot;</li>
<li>The VPN provider might also be slow to apply security patches, putting you and the rest of the users at risk</li>
<li>With this guide, you&#39;ll be able to cut out the middleman and create your own VPN, using OpenBSD</li>
<li>It covers topics such as protecting your server, securing DNS lookups, configuring the firewall properly, general security practices and of course actually setting up the VPN
***</li>
</ul>

<h3><a href="http://www.iwillfolo.com/2015/01/comparison-gentoo-vs-freebsd-tweak-tweak-little-star/" rel="nofollow">FreeBSD vs Gentoo comparison</a></h3>

<ul>
<li>People coming over from Linux will sometimes compare FreeBSD to Gentoo, mostly because of the ports-like portage system for installing software</li>
<li>This article takes that notion and goes much more in-depth, with lots more comparisons between the two systems</li>
<li>The author mentions that the installers are very different, ports and portage have many subtle differences and a few other things</li>
<li>If you&#39;re a curious Gentoo user considering FreeBSD, this might be a good article to check out to learn a bit more
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=142120787308107&w=2" rel="nofollow">Kernel W<sup>X</sup> in OpenBSD</a></h3>

<ul>
<li>W<sup>X,</sup> &quot;<a href="https://en.wikipedia.org/wiki/W%5EX" rel="nofollow">Write XOR Execute</a>,&quot; is a security feature of OpenBSD with a rather strange-looking name</li>
<li>It&#39;s meant to be an exploit mitigation technique, disallowing pages in the address space of a process to be both writable and executable at the same time</li>
<li>This helps prevent some types of buffer overflows: code injected into it <em>won&#39;t</em> execute, but <em>will</em> crash the program (quite obviously the lesser of the two evils)</li>
<li>Through some recent work, OpenBSD&#39;s kernel now has no part of the address space without this feature - whereas it was only enabled in the userland <a href="http://www.openbsd.org/papers/ru13-deraadt/" rel="nofollow">previously</a></li>
<li>Doing this incorrectly in the kernel could lead to <strong>far worse</strong> consequences, and is a lot harder to debug, so this is a pretty huge accomplishment that&#39;s been in the works for a while</li>
<li>More technical details can be found in some <a href="https://www.marc.info/?l=openbsd-cvs&m=141917924602780&w=2" rel="nofollow">recent CVS commits</a>
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/" rel="nofollow">Building an IPFW-based router</a></h3>

<ul>
<li>We&#39;ve covered building <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">routers with PF</a> many times before, but what about <a href="https://www.freebsd.org/doc/handbook/firewalls-ipfw.html" rel="nofollow">IPFW</a>?</li>
<li>A certain host of a certain podcast decided it was finally time to replace his <a href="https://github.com/jduck/asus-cmd" rel="nofollow">disappointing</a> consumer router with something BSD-based</li>
<li>In this blog post, Kris details his experience building and configuring a new router for his home, using IPFW as the firewall</li>
<li>He covers in-kernel NAT and NATD, installing a DHCP server from packages and even touches on NAT reflection a bit</li>
<li>If you&#39;re an IPFW fan and are thinking about putting together a new router, give this post a read
***</li>
</ul>

<h2>Interview - Jos Schellevis - <a href="mailto:project@opnsense.org" rel="nofollow">project@opnsense.org</a> / <a href="https://twitter.com/opnsense" rel="nofollow">@opnsense</a></h2>

<p>The birth of <a href="http://opnsense.org" rel="nofollow">OPNsense</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://adrianchadd.blogspot.com/2015/01/on-profiling-http-or-god-damnit-people.html" rel="nofollow">On profiling HTTP</a></h3>

<ul>
<li>Adrian Chadd, who <a href="http://www.bsdnow.tv/episodes/2014_09_17-the_promised_wlan" rel="nofollow">we&#39;ve had on the show before</a>, has been doing some more ultra-high performance testing</li>
<li>Faced with the problem of how to generate a massive amount of HTTP traffic, he looked into the current state of benchmarking tools</li>
<li>According to him, it&#39;s &quot;not very pretty&quot;</li>
<li>He decided to work on a new tool to benchmark huge amounts of web traffic, and the rest of this post describes the whole process</li>
<li>You can check out his new code <a href="https://github.com/erikarn/libevhtp-http/" rel="nofollow">on Github</a> right now
***</li>
</ul>

<h3><a href="http://daemonforums.org/showthread.php?s=db0dd79ca26eb645eadd2d8abd267cae&t=8846" rel="nofollow">Using divert(4) to reduce attacks</a></h3>

<ul>
<li>We talked about using <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/divert.4" rel="nofollow">divert(4)</a> with PF last week, and this post is a good follow-up to that introduction (though unrelated to that series)</li>
<li>It talks about how you can use divert, combined with some blacklists, to reduce attacks on whatever public services you&#39;re running</li>
<li>PF has good built-in rate limiting for abusive IPs that hit rapidly, but when they attack slowly over a longer period of time, that won&#39;t work</li>
<li>The Composite Blocking List is a public DNS blocklist, operated alongside Spamhaus, that contains many IPs known to be malicious</li>
<li>Consider setting this up to reduce the attack spam in your logs if you run public services
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2015-January/046814.html" rel="nofollow">ChaCha20 patchset for GELI</a></h3>

<ul>
<li>A user has posted a patch to the freebsd-hackers list that adds ChaCha support to GELI, the <a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">disk encryption</a> system</li>
<li>There are also some benchmarks that look pretty good in terms of performance</li>
<li>Currently, GELI defaults to AES <a href="https://en.wikipedia.org/wiki/Disk_encryption_theory#XEX-based_tweaked-codebook_mode_with_ciphertext_stealing_.28XTS.29" rel="nofollow">in XTS mode</a> with a few tweakable options (but also supports Blowfish, Camellia and Triple DES)</li>
<li>There&#39;s <a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2015-January/046824.html" rel="nofollow">some discussion</a> going on about whether a <a href="https://en.wikipedia.org/wiki/Stream_cipher" rel="nofollow">stream cipher</a> is <a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2015-January/046834.html" rel="nofollow">suitable or not</a> for disk encryption though, so this might not be a match made in heaven just yet
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/01/new-update-gui-for-pc-bsd-automatic-updates/" rel="nofollow">PCBSD update system enhancements</a></h3>

<ul>
<li>The PCBSD update utility has gotten an update itself, now supporting automatic upgrades</li>
<li>You can choose what parts of your system you want to let it automatically handle (packages, security updates)</li>
<li>The update system uses ZFS and Boot Environments for safe updating and bypasses some dubious pkgng functionality</li>
<li>There&#39;s also a new graphical frontend available for it
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2XJhAsffU" rel="nofollow">Mat writes in</a></li>
<li><a href="http://slexy.org/view/s20qnSHujZ" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s21O0MShqi" rel="nofollow">Andy writes in</a></li>
<li><a href="http://slexy.org/view/s2LutVQOXN" rel="nofollow">Beau writes in</a> </li>
<li><a href="http://slexy.org/view/s21Esexdrc" rel="nofollow">Kutay writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.mail-archive.com/advocacy@openbsd.org/msg02249.html" rel="nofollow">Wait, a real one?</a></li>
<li><a href="https://www.marc.info/?l=openbsd-misc&m=142125454022458&w=2" rel="nofollow">What&#39;s that glowing...</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we&#39;ll be talking to Jos Schellevis about OPNsense, a new firewall project that was forked from pfSense. We&#39;ll learn some of the backstory and see what they&#39;ve got planned for the future. We&#39;ve also got all this week&#39;s news and answers to all your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://networkfilter.blogspot.com/2015/01/be-your-own-vpn-provider-with-openbsd.html" rel="nofollow">Be your own VPN provider with OpenBSD</a></h3>

<ul>
<li>We&#39;ve covered how to build a BSD-based gateway that tunnels all your traffic through a VPN in the past - but what if you don&#39;t trust any VPN company?</li>
<li>It&#39;s easy for anyone to say &quot;of course we don&#39;t run a modified version of OpenVPN that logs all your traffic... what are you talking about?&quot;</li>
<li>The VPN provider might also be slow to apply security patches, putting you and the rest of the users at risk</li>
<li>With this guide, you&#39;ll be able to cut out the middleman and create your own VPN, using OpenBSD</li>
<li>It covers topics such as protecting your server, securing DNS lookups, configuring the firewall properly, general security practices and of course actually setting up the VPN
***</li>
</ul>

<h3><a href="http://www.iwillfolo.com/2015/01/comparison-gentoo-vs-freebsd-tweak-tweak-little-star/" rel="nofollow">FreeBSD vs Gentoo comparison</a></h3>

<ul>
<li>People coming over from Linux will sometimes compare FreeBSD to Gentoo, mostly because of the ports-like portage system for installing software</li>
<li>This article takes that notion and goes much more in-depth, with lots more comparisons between the two systems</li>
<li>The author mentions that the installers are very different, ports and portage have many subtle differences and a few other things</li>
<li>If you&#39;re a curious Gentoo user considering FreeBSD, this might be a good article to check out to learn a bit more
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=142120787308107&w=2" rel="nofollow">Kernel W<sup>X</sup> in OpenBSD</a></h3>

<ul>
<li>W<sup>X,</sup> &quot;<a href="https://en.wikipedia.org/wiki/W%5EX" rel="nofollow">Write XOR Execute</a>,&quot; is a security feature of OpenBSD with a rather strange-looking name</li>
<li>It&#39;s meant to be an exploit mitigation technique, disallowing pages in the address space of a process to be both writable and executable at the same time</li>
<li>This helps prevent some types of buffer overflows: code injected into it <em>won&#39;t</em> execute, but <em>will</em> crash the program (quite obviously the lesser of the two evils)</li>
<li>Through some recent work, OpenBSD&#39;s kernel now has no part of the address space without this feature - whereas it was only enabled in the userland <a href="http://www.openbsd.org/papers/ru13-deraadt/" rel="nofollow">previously</a></li>
<li>Doing this incorrectly in the kernel could lead to <strong>far worse</strong> consequences, and is a lot harder to debug, so this is a pretty huge accomplishment that&#39;s been in the works for a while</li>
<li>More technical details can be found in some <a href="https://www.marc.info/?l=openbsd-cvs&m=141917924602780&w=2" rel="nofollow">recent CVS commits</a>
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/01/using-trueos-as-a-ipfw-based-home-router/" rel="nofollow">Building an IPFW-based router</a></h3>

<ul>
<li>We&#39;ve covered building <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">routers with PF</a> many times before, but what about <a href="https://www.freebsd.org/doc/handbook/firewalls-ipfw.html" rel="nofollow">IPFW</a>?</li>
<li>A certain host of a certain podcast decided it was finally time to replace his <a href="https://github.com/jduck/asus-cmd" rel="nofollow">disappointing</a> consumer router with something BSD-based</li>
<li>In this blog post, Kris details his experience building and configuring a new router for his home, using IPFW as the firewall</li>
<li>He covers in-kernel NAT and NATD, installing a DHCP server from packages and even touches on NAT reflection a bit</li>
<li>If you&#39;re an IPFW fan and are thinking about putting together a new router, give this post a read
***</li>
</ul>

<h2>Interview - Jos Schellevis - <a href="mailto:project@opnsense.org" rel="nofollow">project@opnsense.org</a> / <a href="https://twitter.com/opnsense" rel="nofollow">@opnsense</a></h2>

<p>The birth of <a href="http://opnsense.org" rel="nofollow">OPNsense</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://adrianchadd.blogspot.com/2015/01/on-profiling-http-or-god-damnit-people.html" rel="nofollow">On profiling HTTP</a></h3>

<ul>
<li>Adrian Chadd, who <a href="http://www.bsdnow.tv/episodes/2014_09_17-the_promised_wlan" rel="nofollow">we&#39;ve had on the show before</a>, has been doing some more ultra-high performance testing</li>
<li>Faced with the problem of how to generate a massive amount of HTTP traffic, he looked into the current state of benchmarking tools</li>
<li>According to him, it&#39;s &quot;not very pretty&quot;</li>
<li>He decided to work on a new tool to benchmark huge amounts of web traffic, and the rest of this post describes the whole process</li>
<li>You can check out his new code <a href="https://github.com/erikarn/libevhtp-http/" rel="nofollow">on Github</a> right now
***</li>
</ul>

<h3><a href="http://daemonforums.org/showthread.php?s=db0dd79ca26eb645eadd2d8abd267cae&t=8846" rel="nofollow">Using divert(4) to reduce attacks</a></h3>

<ul>
<li>We talked about using <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/divert.4" rel="nofollow">divert(4)</a> with PF last week, and this post is a good follow-up to that introduction (though unrelated to that series)</li>
<li>It talks about how you can use divert, combined with some blacklists, to reduce attacks on whatever public services you&#39;re running</li>
<li>PF has good built-in rate limiting for abusive IPs that hit rapidly, but when they attack slowly over a longer period of time, that won&#39;t work</li>
<li>The Composite Blocking List is a public DNS blocklist, operated alongside Spamhaus, that contains many IPs known to be malicious</li>
<li>Consider setting this up to reduce the attack spam in your logs if you run public services
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2015-January/046814.html" rel="nofollow">ChaCha20 patchset for GELI</a></h3>

<ul>
<li>A user has posted a patch to the freebsd-hackers list that adds ChaCha support to GELI, the <a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">disk encryption</a> system</li>
<li>There are also some benchmarks that look pretty good in terms of performance</li>
<li>Currently, GELI defaults to AES <a href="https://en.wikipedia.org/wiki/Disk_encryption_theory#XEX-based_tweaked-codebook_mode_with_ciphertext_stealing_.28XTS.29" rel="nofollow">in XTS mode</a> with a few tweakable options (but also supports Blowfish, Camellia and Triple DES)</li>
<li>There&#39;s <a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2015-January/046824.html" rel="nofollow">some discussion</a> going on about whether a <a href="https://en.wikipedia.org/wiki/Stream_cipher" rel="nofollow">stream cipher</a> is <a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2015-January/046834.html" rel="nofollow">suitable or not</a> for disk encryption though, so this might not be a match made in heaven just yet
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2015/01/new-update-gui-for-pc-bsd-automatic-updates/" rel="nofollow">PCBSD update system enhancements</a></h3>

<ul>
<li>The PCBSD update utility has gotten an update itself, now supporting automatic upgrades</li>
<li>You can choose what parts of your system you want to let it automatically handle (packages, security updates)</li>
<li>The update system uses ZFS and Boot Environments for safe updating and bypasses some dubious pkgng functionality</li>
<li>There&#39;s also a new graphical frontend available for it
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2XJhAsffU" rel="nofollow">Mat writes in</a></li>
<li><a href="http://slexy.org/view/s20qnSHujZ" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s21O0MShqi" rel="nofollow">Andy writes in</a></li>
<li><a href="http://slexy.org/view/s2LutVQOXN" rel="nofollow">Beau writes in</a> </li>
<li><a href="http://slexy.org/view/s21Esexdrc" rel="nofollow">Kutay writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.mail-archive.com/advocacy@openbsd.org/msg02249.html" rel="nofollow">Wait, a real one?</a></li>
<li><a href="https://www.marc.info/?l=openbsd-misc&m=142125454022458&w=2" rel="nofollow">What&#39;s that glowing...</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>71: System Disaster</title>
  <link>https://www.bsdnow.tv/71</link>
  <guid isPermaLink="false">b9b0efcb-197e-4dfc-a239-5ae487a72e51</guid>
  <pubDate>Wed, 07 Jan 2015 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b9b0efcb-197e-4dfc-a239-5ae487a72e51.mp3" length="48002836" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we'll be talking to Ian Sutton about his new BSD compatibility wrappers for various systemd dependencies. Don't worry, systemd is not being ported to BSD! We're still safe! We've also got all the week's news and answers to your emails, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:06:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we'll be talking to Ian Sutton about his new BSD compatibility wrappers for various systemd dependencies. Don't worry, systemd is not being ported to BSD! We're still safe! We've also got all the week's news and answers to your emails, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
Introducing OPNsense, a pfSense fork (http://opnsense.org/)
OPNsense is a new BSD-based firewall project that was recently started (http://www.prnewswire.com/news-releases/deciso-launches-opnsense-a-new-open-source-firewall-initiative-287334371.html), forked from the pfSense codebase
Even though it's just been announced, they already have a formal release based on FreeBSD 10 (pfSense's latest stable release is based on 8.3)
The core team (http://opnsense.org/about/about-opnsense/#opnsense-core-team) includes a well-known DragonFlyBSD developer
You can check out their code on Github (https://github.com/opnsense) now, or download an image and try it out - let us know (mailto:feedback@bsdnow.tv) if you do and what you think about it
They also have a nice wiki and some instructions on getting started (http://wiki.opnsense.org/index.php/Manual:Installation_and_Initial_Configuration) for new users
We plan on having them on the show next week to learn a bit more about how the project got started and why you might want to use it - stay tuned
***
Code rot and why I chose OpenBSD (http://homing-on-code.blogspot.com/2015/01/code-rot-openbsd.html)
Here we have a blog post about rotting codebases - a core banking system in this example
The author tells the story of how his last days spent at the job were mostly removing old, dead code from a giant project
He goes on to compare it to OpenSSL and the hearbleed disaster, from which LibreSSL was born
Instead of just bikeshedding like the rest of the internet, OpenBSD "silently started putting the beast into shape" as he puts it
The article continues on to mention OpenBSD's code review process, and how it catches any bugs so we don't have more heartbleeds
"In OpenBSD you are encouraged to run current and the whole team tries its best to make current as stable as it can. You know why? They eat their own dog food. That's so simple yet so amazing that it blows my mind. Developers actually run OpenBSD on their machines daily."
It's a very long and detailed story about how the author has gotten more involved with BSD, learned from the mailing lists and even started contributing back - he says "In summary, I'm learning more than ever - computing is fun again"
Look for the phrase "Getting Started" in the blog post for a nice little gem
***
ZFS vs HAMMER FS (https://forums.freebsd.org/threads/zfs-vs-hammer.49789/)
One of the topics we've seen come up from time to time is how FreeBSD's ZFS (http://www.bsdnow.tv/tutorials/zfs) and DragonFly's HAMMER FS (http://www.bsdnow.tv/tutorials/hammer) compare to each other
They both have a lot of features that traditional filesystems lack
A forum thread was opened for discussion about them both and what they're typically used for
It compares resource requirements, ideal hardware and pros/cons of each
Hopefully someone will do another new comparison when HAMMER 2 is finished
This is not to be confused with the other "hammer" filesystem (https://www.youtube.com/watch?v=HBXlVl5Ll6k)
***
Portable OpenNTPD revived (https://www.mail-archive.com/tech@openbsd.org/msg21886.html)
With ISC's NTPd having so many security vulnerabilities recently, people need an alternative NTP daemon (http://www.bsdnow.tv/tutorials/ntpd)
OpenBSD has developed OpenNTPD (http://openntpd.org/) since 2004, but the portable version for other operating systems hasn't been actively maintained in a few years
The older version still works fine, and is in FreeBSD ports and NetBSD pkgsrc, but it would be nice to have some of the newer features and fixes from the native version
Brent Cook, who we've had on the show before (http://www.bsdnow.tv/episodes/2014_07_30-liberating_ssl) to talk about LibreSSL, decided it was time to fix this
While looking through the code, he also found some fixes (http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/?sortby=date#dirlist) for the native version as well
You can grab it from Github (https://github.com/openntpd-portable/openntpd-portable) now, or just wait for the updated release (https://lists.freebsd.org/pipermail/freebsd-ports/2015-January/097400.html) to hit the repos of your OS of choice
***
Interview - Ian Sutton - ian@kremlin.cc (mailto:ian@kremlin.cc)
BSD replacements (https://uglyman.kremlin.cc/gitweb/gitweb.cgi?p=systembsd.git;a=summary) for systemd dependencies (http://undeadly.org/cgi?action=article&amp;amp;sid=20140915064856)
News Roundup
pkgng adds OS X support (https://github.com/freebsd/pkg/pull/1113)
FreeBSD's next-gen package manager (http://www.bsdnow.tv/tutorials/pkgng) has just added support for Mac OS X
Why would you want that? Well.. we don't really know, but it's cool
The author of the patch may have some insight (https://github.com/freebsd/pkg/pull/1113#issuecomment-68063964) about what his goal is though
This could open up the door for a cross-platform pkgng solution, similar to NetBSD's pkgsrc
There's also the possibility of pkgng being used as a packaging format for MacPorts in the future
While we're on the topic of pkgng, you can also watch bapt (http://www.bsdnow.tv/episodes/2014_01_01-eclipsing_binaries)'s latest presentation about it from ruBSD 2014 - "four years of pkg (http://is.gd/4AvUwt)"
***
Secure secure shell (https://stribika.github.io/2015/01/04/secure-secure-shell.html)
Almost everyone watching BSD Now probably uses OpenSSH (http://www.bsdnow.tv/tutorials/ssh-tmux) and has set up a server at one point or another
This guide provides a list of best practices beyond the typical "disable root login and use keys" advice you'll often hear
It specifically goes in-depth with server and client configuration with the best key types, KEX methods and encryption ciphers to use
There are also good explanations for all the choices, based both on history and probability
Minimal backwards compatibility is kept, but most of the old and insecure stuff gets disabled
We've also got a handy chart (http://ssh-comparison.quendi.de/comparison.html) to show which SSH implementations support which ciphers, in case you need to support Windows users or people who use weird clients
***
Dissecting OpenBSD's divert(4) (http://lteo.net/blog/2015/01/06/dissecting-openbsds-divert-4-part-1-introduction/)
PF has a cool feature that not a lot of people seem to know about: divert
It lets you send packets to userspace, allowing you to inspect them a lot easier
This blog post, the first in a series, details all the cool things you can do with divert and how to use it
A very common example is with intrusion detection systems like Snort
***
Screen recording on FreeBSD (https://www.banym.de/freebsd/create-a-screen-recording-on-freebsd-with-kdenlive-and-external-usb-mic)
This is a neat article about a topic we don't cover very often: making video content on BSD
In the post, you'll learn how to make screencasts with FreeBSD, using kdenlive and ffmpeg
There are also notes about getting a USB microphone working, so you can do commentary on whatever you're showing
It also includes lots of details and helpful screenshots throughout the process
You should make cool screencasts and send them to us
***
Feedback/Questions
Camio writes in (http://slexy.org/view/s21Zx0ktmb)
ezpzy writes in (http://slexy.org/view/s2vVR5Orhh)
Emett writes in (http://slexy.org/view/s21Ahb5Lxa)
Ben writes in (http://slexy.org/view/s20oJmveN6)
Laszlo writes in (http://slexy.org/view/s2cTayMxPk)
***
Mailing List Gold
Protocol X97 (https://lists.freebsd.org/pipermail/freebsd-questions/2015-January/263441.html)
My thoughts echoed (https://www.marc.info/?l=openbsd-tech&amp;amp;m=141159429123859&amp;amp;w=2)
Vulnerability sample (http://www.openwall.com/lists/oss-security/2015/01/04/10)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, systemd, launchd, systembsd, gsoc, google summer of code, ntp, openntpd, opnsense, pfsense, hammer, zfs, gpl, license, macports</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ll be talking to Ian Sutton about his new BSD compatibility wrappers for various systemd dependencies. Don&#39;t worry, systemd is not being ported to BSD! We&#39;re still safe! We&#39;ve also got all the week&#39;s news and answers to your emails, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://opnsense.org/" rel="nofollow">Introducing OPNsense, a pfSense fork</a></h3>

<ul>
<li>OPNsense is a new BSD-based firewall project that was <a href="http://www.prnewswire.com/news-releases/deciso-launches-opnsense-a-new-open-source-firewall-initiative-287334371.html" rel="nofollow">recently started</a>, forked from the pfSense codebase</li>
<li>Even though it&#39;s just been announced, they already have a formal release based on FreeBSD 10 (pfSense&#39;s latest stable release is based on 8.3)</li>
<li>The <a href="http://opnsense.org/about/about-opnsense/#opnsense-core-team" rel="nofollow">core team</a> includes a well-known DragonFlyBSD developer</li>
<li>You can check out their code <a href="https://github.com/opnsense" rel="nofollow">on Github</a> now, or download an image and try it out - <a href="mailto:feedback@bsdnow.tv" rel="nofollow">let us know</a> if you do and what you think about it</li>
<li>They also have a nice wiki and some <a href="http://wiki.opnsense.org/index.php/Manual:Installation_and_Initial_Configuration" rel="nofollow">instructions on getting started</a> for new users</li>
<li>We plan on having them on the show <strong>next week</strong> to learn a bit more about how the project got started and why you might want to use it - stay tuned
***</li>
</ul>

<h3><a href="http://homing-on-code.blogspot.com/2015/01/code-rot-openbsd.html" rel="nofollow">Code rot and why I chose OpenBSD</a></h3>

<ul>
<li>Here we have a blog post about rotting codebases - a core banking system in this example</li>
<li>The author tells the story of how his last days spent at the job were mostly removing old, dead code from a giant project</li>
<li>He goes on to compare it to OpenSSL and the hearbleed disaster, from which LibreSSL was born</li>
<li>Instead of just bikeshedding like the rest of the internet, OpenBSD &quot;silently started putting the beast into shape&quot; as he puts it</li>
<li>The article continues on to mention OpenBSD&#39;s code review process, and how it catches any bugs so we don&#39;t have more heartbleeds</li>
<li>&quot;In OpenBSD you are encouraged to run current and the whole team tries its best to make current as stable as it can. You know why? They eat their own dog food. That&#39;s so simple yet so amazing that it blows my mind. Developers actually run OpenBSD on their machines daily.&quot;</li>
<li>It&#39;s a very long and detailed story about how the author has gotten more involved with BSD, learned from the mailing lists and even started contributing back - he says &quot;In summary, I&#39;m learning more than ever - computing is fun again&quot;</li>
<li>Look for the phrase &quot;Getting Started&quot; in the blog post for a nice little gem
***</li>
</ul>

<h3><a href="https://forums.freebsd.org/threads/zfs-vs-hammer.49789/" rel="nofollow">ZFS vs HAMMER FS</a></h3>

<ul>
<li>One of the topics we&#39;ve seen come up from time to time is how <a href="http://www.bsdnow.tv/tutorials/zfs" rel="nofollow">FreeBSD&#39;s ZFS</a> and <a href="http://www.bsdnow.tv/tutorials/hammer" rel="nofollow">DragonFly&#39;s HAMMER FS</a> compare to each other</li>
<li>They both have a lot of features that traditional filesystems lack</li>
<li>A forum thread was opened for discussion about them both and what they&#39;re typically used for</li>
<li>It compares resource requirements, ideal hardware and pros/cons of each</li>
<li>Hopefully someone will do another new comparison when HAMMER 2 is finished</li>
<li>This is not to be confused with the <a href="https://www.youtube.com/watch?v=HBXlVl5Ll6k" rel="nofollow">other &quot;hammer&quot; filesystem</a>
***</li>
</ul>

<h3><a href="https://www.mail-archive.com/tech@openbsd.org/msg21886.html" rel="nofollow">Portable OpenNTPD revived</a></h3>

<ul>
<li>With ISC&#39;s NTPd having so many security vulnerabilities recently, people need an alternative <a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">NTP daemon</a></li>
<li>OpenBSD has developed <a href="http://openntpd.org/" rel="nofollow">OpenNTPD</a> since 2004, but the portable version for other operating systems hasn&#39;t been actively maintained in a few years</li>
<li>The older version still works fine, and is in FreeBSD ports and NetBSD pkgsrc, but it would be nice to have some of the newer features and fixes from the native version</li>
<li>Brent Cook, who we&#39;ve <a href="http://www.bsdnow.tv/episodes/2014_07_30-liberating_ssl" rel="nofollow">had on the show before</a> to talk about LibreSSL, decided it was time to fix this</li>
<li>While looking through the code, he also found <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/?sortby=date#dirlist" rel="nofollow">some fixes</a> for the native version as well</li>
<li>You can grab it from <a href="https://github.com/openntpd-portable/openntpd-portable" rel="nofollow">Github</a> now, or just wait for <a href="https://lists.freebsd.org/pipermail/freebsd-ports/2015-January/097400.html" rel="nofollow">the updated release</a> to hit the repos of your OS of choice
***</li>
</ul>

<h2>Interview - Ian Sutton - <a href="mailto:ian@kremlin.cc" rel="nofollow">ian@kremlin.cc</a></h2>

<p><a href="https://uglyman.kremlin.cc/gitweb/gitweb.cgi?p=systembsd.git;a=summary" rel="nofollow">BSD replacements</a> for <a href="http://undeadly.org/cgi?action=article&sid=20140915064856" rel="nofollow">systemd dependencies</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/freebsd/pkg/pull/1113" rel="nofollow">pkgng adds OS X support</a></h3>

<ul>
<li>FreeBSD&#39;s next-gen <a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">package manager</a> has just added support for Mac OS X</li>
<li>Why would you want that? Well.. we don&#39;t really know, but it&#39;s cool</li>
<li>The author of the patch <a href="https://github.com/freebsd/pkg/pull/1113#issuecomment-68063964" rel="nofollow">may have some insight</a> about what his goal is though</li>
<li>This could open up the door for a cross-platform pkgng solution, similar to NetBSD&#39;s pkgsrc</li>
<li>There&#39;s also the possibility of pkgng being used as a packaging format for MacPorts in the future</li>
<li>While we&#39;re on the topic of pkgng, you can also watch <a href="http://www.bsdnow.tv/episodes/2014_01_01-eclipsing_binaries" rel="nofollow">bapt</a>&#39;s latest presentation about it from ruBSD 2014 - &quot;<a href="http://is.gd/4AvUwt" rel="nofollow">four years of pkg</a>&quot;
***</li>
</ul>

<h3><a href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" rel="nofollow">Secure secure shell</a></h3>

<ul>
<li>Almost everyone watching BSD Now probably <a href="http://www.bsdnow.tv/tutorials/ssh-tmux" rel="nofollow">uses OpenSSH</a> and has set up a server at one point or another</li>
<li>This guide provides a list of best practices beyond the typical &quot;disable root login and use keys&quot; advice you&#39;ll often hear</li>
<li>It specifically goes in-depth with server and client configuration with the best key types, KEX methods and encryption ciphers to use</li>
<li>There are also good explanations for all the choices, based both on history and probability</li>
<li>Minimal backwards compatibility is kept, but most of the old and insecure stuff gets disabled</li>
<li>We&#39;ve also got <a href="http://ssh-comparison.quendi.de/comparison.html" rel="nofollow">a handy chart</a> to show which SSH implementations support which ciphers, in case you need to support Windows users or people who use weird clients
***</li>
</ul>

<h3><a href="http://lteo.net/blog/2015/01/06/dissecting-openbsds-divert-4-part-1-introduction/" rel="nofollow">Dissecting OpenBSD&#39;s divert(4)</a></h3>

<ul>
<li>PF has a cool feature that not a lot of people seem to know about: divert</li>
<li>It lets you send packets to userspace, allowing you to inspect them a lot easier</li>
<li>This blog post, the first in a series, details all the cool things you can do with divert and how to use it</li>
<li>A very common example is with intrusion detection systems like Snort
***</li>
</ul>

<h3><a href="https://www.banym.de/freebsd/create-a-screen-recording-on-freebsd-with-kdenlive-and-external-usb-mic" rel="nofollow">Screen recording on FreeBSD</a></h3>

<ul>
<li>This is a neat article about a topic we don&#39;t cover very often: making video content on BSD</li>
<li>In the post, you&#39;ll learn how to make screencasts with FreeBSD, using kdenlive and ffmpeg</li>
<li>There are also notes about getting a USB microphone working, so you can do commentary on whatever you&#39;re showing</li>
<li>It also includes lots of details and helpful screenshots throughout the process</li>
<li>You should make cool screencasts and send them to us
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21Zx0ktmb" rel="nofollow">Camio writes in</a></li>
<li><a href="http://slexy.org/view/s2vVR5Orhh" rel="nofollow">ezpzy writes in</a></li>
<li><a href="http://slexy.org/view/s21Ahb5Lxa" rel="nofollow">Emett writes in</a></li>
<li><a href="http://slexy.org/view/s20oJmveN6" rel="nofollow">Ben writes in</a></li>
<li><a href="http://slexy.org/view/s2cTayMxPk" rel="nofollow">Laszlo writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-questions/2015-January/263441.html" rel="nofollow">Protocol X97</a></li>
<li><a href="https://www.marc.info/?l=openbsd-tech&m=141159429123859&w=2" rel="nofollow">My thoughts echoed</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2015/01/04/10" rel="nofollow">Vulnerability sample</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ll be talking to Ian Sutton about his new BSD compatibility wrappers for various systemd dependencies. Don&#39;t worry, systemd is not being ported to BSD! We&#39;re still safe! We&#39;ve also got all the week&#39;s news and answers to your emails, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://opnsense.org/" rel="nofollow">Introducing OPNsense, a pfSense fork</a></h3>

<ul>
<li>OPNsense is a new BSD-based firewall project that was <a href="http://www.prnewswire.com/news-releases/deciso-launches-opnsense-a-new-open-source-firewall-initiative-287334371.html" rel="nofollow">recently started</a>, forked from the pfSense codebase</li>
<li>Even though it&#39;s just been announced, they already have a formal release based on FreeBSD 10 (pfSense&#39;s latest stable release is based on 8.3)</li>
<li>The <a href="http://opnsense.org/about/about-opnsense/#opnsense-core-team" rel="nofollow">core team</a> includes a well-known DragonFlyBSD developer</li>
<li>You can check out their code <a href="https://github.com/opnsense" rel="nofollow">on Github</a> now, or download an image and try it out - <a href="mailto:feedback@bsdnow.tv" rel="nofollow">let us know</a> if you do and what you think about it</li>
<li>They also have a nice wiki and some <a href="http://wiki.opnsense.org/index.php/Manual:Installation_and_Initial_Configuration" rel="nofollow">instructions on getting started</a> for new users</li>
<li>We plan on having them on the show <strong>next week</strong> to learn a bit more about how the project got started and why you might want to use it - stay tuned
***</li>
</ul>

<h3><a href="http://homing-on-code.blogspot.com/2015/01/code-rot-openbsd.html" rel="nofollow">Code rot and why I chose OpenBSD</a></h3>

<ul>
<li>Here we have a blog post about rotting codebases - a core banking system in this example</li>
<li>The author tells the story of how his last days spent at the job were mostly removing old, dead code from a giant project</li>
<li>He goes on to compare it to OpenSSL and the hearbleed disaster, from which LibreSSL was born</li>
<li>Instead of just bikeshedding like the rest of the internet, OpenBSD &quot;silently started putting the beast into shape&quot; as he puts it</li>
<li>The article continues on to mention OpenBSD&#39;s code review process, and how it catches any bugs so we don&#39;t have more heartbleeds</li>
<li>&quot;In OpenBSD you are encouraged to run current and the whole team tries its best to make current as stable as it can. You know why? They eat their own dog food. That&#39;s so simple yet so amazing that it blows my mind. Developers actually run OpenBSD on their machines daily.&quot;</li>
<li>It&#39;s a very long and detailed story about how the author has gotten more involved with BSD, learned from the mailing lists and even started contributing back - he says &quot;In summary, I&#39;m learning more than ever - computing is fun again&quot;</li>
<li>Look for the phrase &quot;Getting Started&quot; in the blog post for a nice little gem
***</li>
</ul>

<h3><a href="https://forums.freebsd.org/threads/zfs-vs-hammer.49789/" rel="nofollow">ZFS vs HAMMER FS</a></h3>

<ul>
<li>One of the topics we&#39;ve seen come up from time to time is how <a href="http://www.bsdnow.tv/tutorials/zfs" rel="nofollow">FreeBSD&#39;s ZFS</a> and <a href="http://www.bsdnow.tv/tutorials/hammer" rel="nofollow">DragonFly&#39;s HAMMER FS</a> compare to each other</li>
<li>They both have a lot of features that traditional filesystems lack</li>
<li>A forum thread was opened for discussion about them both and what they&#39;re typically used for</li>
<li>It compares resource requirements, ideal hardware and pros/cons of each</li>
<li>Hopefully someone will do another new comparison when HAMMER 2 is finished</li>
<li>This is not to be confused with the <a href="https://www.youtube.com/watch?v=HBXlVl5Ll6k" rel="nofollow">other &quot;hammer&quot; filesystem</a>
***</li>
</ul>

<h3><a href="https://www.mail-archive.com/tech@openbsd.org/msg21886.html" rel="nofollow">Portable OpenNTPD revived</a></h3>

<ul>
<li>With ISC&#39;s NTPd having so many security vulnerabilities recently, people need an alternative <a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">NTP daemon</a></li>
<li>OpenBSD has developed <a href="http://openntpd.org/" rel="nofollow">OpenNTPD</a> since 2004, but the portable version for other operating systems hasn&#39;t been actively maintained in a few years</li>
<li>The older version still works fine, and is in FreeBSD ports and NetBSD pkgsrc, but it would be nice to have some of the newer features and fixes from the native version</li>
<li>Brent Cook, who we&#39;ve <a href="http://www.bsdnow.tv/episodes/2014_07_30-liberating_ssl" rel="nofollow">had on the show before</a> to talk about LibreSSL, decided it was time to fix this</li>
<li>While looking through the code, he also found <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/?sortby=date#dirlist" rel="nofollow">some fixes</a> for the native version as well</li>
<li>You can grab it from <a href="https://github.com/openntpd-portable/openntpd-portable" rel="nofollow">Github</a> now, or just wait for <a href="https://lists.freebsd.org/pipermail/freebsd-ports/2015-January/097400.html" rel="nofollow">the updated release</a> to hit the repos of your OS of choice
***</li>
</ul>

<h2>Interview - Ian Sutton - <a href="mailto:ian@kremlin.cc" rel="nofollow">ian@kremlin.cc</a></h2>

<p><a href="https://uglyman.kremlin.cc/gitweb/gitweb.cgi?p=systembsd.git;a=summary" rel="nofollow">BSD replacements</a> for <a href="http://undeadly.org/cgi?action=article&sid=20140915064856" rel="nofollow">systemd dependencies</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/freebsd/pkg/pull/1113" rel="nofollow">pkgng adds OS X support</a></h3>

<ul>
<li>FreeBSD&#39;s next-gen <a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">package manager</a> has just added support for Mac OS X</li>
<li>Why would you want that? Well.. we don&#39;t really know, but it&#39;s cool</li>
<li>The author of the patch <a href="https://github.com/freebsd/pkg/pull/1113#issuecomment-68063964" rel="nofollow">may have some insight</a> about what his goal is though</li>
<li>This could open up the door for a cross-platform pkgng solution, similar to NetBSD&#39;s pkgsrc</li>
<li>There&#39;s also the possibility of pkgng being used as a packaging format for MacPorts in the future</li>
<li>While we&#39;re on the topic of pkgng, you can also watch <a href="http://www.bsdnow.tv/episodes/2014_01_01-eclipsing_binaries" rel="nofollow">bapt</a>&#39;s latest presentation about it from ruBSD 2014 - &quot;<a href="http://is.gd/4AvUwt" rel="nofollow">four years of pkg</a>&quot;
***</li>
</ul>

<h3><a href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" rel="nofollow">Secure secure shell</a></h3>

<ul>
<li>Almost everyone watching BSD Now probably <a href="http://www.bsdnow.tv/tutorials/ssh-tmux" rel="nofollow">uses OpenSSH</a> and has set up a server at one point or another</li>
<li>This guide provides a list of best practices beyond the typical &quot;disable root login and use keys&quot; advice you&#39;ll often hear</li>
<li>It specifically goes in-depth with server and client configuration with the best key types, KEX methods and encryption ciphers to use</li>
<li>There are also good explanations for all the choices, based both on history and probability</li>
<li>Minimal backwards compatibility is kept, but most of the old and insecure stuff gets disabled</li>
<li>We&#39;ve also got <a href="http://ssh-comparison.quendi.de/comparison.html" rel="nofollow">a handy chart</a> to show which SSH implementations support which ciphers, in case you need to support Windows users or people who use weird clients
***</li>
</ul>

<h3><a href="http://lteo.net/blog/2015/01/06/dissecting-openbsds-divert-4-part-1-introduction/" rel="nofollow">Dissecting OpenBSD&#39;s divert(4)</a></h3>

<ul>
<li>PF has a cool feature that not a lot of people seem to know about: divert</li>
<li>It lets you send packets to userspace, allowing you to inspect them a lot easier</li>
<li>This blog post, the first in a series, details all the cool things you can do with divert and how to use it</li>
<li>A very common example is with intrusion detection systems like Snort
***</li>
</ul>

<h3><a href="https://www.banym.de/freebsd/create-a-screen-recording-on-freebsd-with-kdenlive-and-external-usb-mic" rel="nofollow">Screen recording on FreeBSD</a></h3>

<ul>
<li>This is a neat article about a topic we don&#39;t cover very often: making video content on BSD</li>
<li>In the post, you&#39;ll learn how to make screencasts with FreeBSD, using kdenlive and ffmpeg</li>
<li>There are also notes about getting a USB microphone working, so you can do commentary on whatever you&#39;re showing</li>
<li>It also includes lots of details and helpful screenshots throughout the process</li>
<li>You should make cool screencasts and send them to us
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21Zx0ktmb" rel="nofollow">Camio writes in</a></li>
<li><a href="http://slexy.org/view/s2vVR5Orhh" rel="nofollow">ezpzy writes in</a></li>
<li><a href="http://slexy.org/view/s21Ahb5Lxa" rel="nofollow">Emett writes in</a></li>
<li><a href="http://slexy.org/view/s20oJmveN6" rel="nofollow">Ben writes in</a></li>
<li><a href="http://slexy.org/view/s2cTayMxPk" rel="nofollow">Laszlo writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-questions/2015-January/263441.html" rel="nofollow">Protocol X97</a></li>
<li><a href="https://www.marc.info/?l=openbsd-tech&m=141159429123859&w=2" rel="nofollow">My thoughts echoed</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2015/01/04/10" rel="nofollow">Vulnerability sample</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>70: Daemons in the North</title>
  <link>https://www.bsdnow.tv/70</link>
  <guid isPermaLink="false">55684d1a-97da-439b-a037-b02c8d49de70</guid>
  <pubDate>Wed, 31 Dec 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/55684d1a-97da-439b-a037-b02c8d49de70.mp3" length="60663316" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>It's our last episode of 2014, and we'll be chatting with Dan Langille about the upcoming BSDCan conference. We'll find out what's planned and what sorts of presentations they're looking for. As usual, answers to viewer-submitted questions and all the week's news, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:24:15</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>It's our last episode of 2014, and we'll be chatting with Dan Langille about the upcoming BSDCan conference. We'll find out what's planned and what sorts of presentations they're looking for. As usual, answers to viewer-submitted questions and all the week's news, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
More conference presentation videos (http://2014.asiabsdcon.org/timetable.html.en)
Some more of the presentation videos from AsiaBSDCon are appearing online
Masanobu Saitoh, Developing CPE Routers Based on NetBSD (https://www.youtube.com/watch?v=ApruZrU5fVs)
Reyk Floeter (http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time), VXLAN and Cloud-based Networking with OpenBSD (https://www.youtube.com/watch?v=ufeEP_hzFN0)
Jos Jansen, Adapting OS X to the enterprise (https://www.youtube.com/watch?v=gOPfRQgTjNo)
Pierre Pronchery (http://www.bsdnow.tv/episodes/2014_04_01-edgy_bsd_users) &amp;amp; Guillaume Lasmayous, Carve your NetBSD (https://www.youtube.com/watch?v=vh-TjLUj6os) 
Colin Percival (http://www.bsdnow.tv/episodes/2014_01_22-tendresse_for_ten), Everything you need to know about cryptography in 1 hour (https://www.youtube.com/watch?v=jzY3m5Kv7Y8) (not from AsiaBSDCon)
The "bsdconferences" YouTube channel has quite a lot of interesting older BSD talks (https://www.youtube.com/user/bsdconferences/videos?sort=da&amp;amp;view=0&amp;amp;flow=grid) too - you may want to go back and watch them if you haven't already
***
OpenBSD PIE enhancements (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141922027318727&amp;amp;w=2)
ASLR (https://en.wikipedia.org/wiki/Address_space_layout_randomization) and PIE (https://en.wikipedia.org/wiki/Position-independent_executable) are great security features that OpenBSD has had enabled by default for a long time, in both the base system and ports, but they have one inherent problem
They only work with dynamic libraries and binaries, so if you have any static binaries, they don't get the same treatment
For example, the default shells (and many other things in /bin and /sbin) are statically linked
In the case of the static ones, you can always predict the memory layout, which is very bad and sort of defeats the whole purpose (https://en.wikipedia.org/wiki/Return-oriented_programming)
With this and a few related commits (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141927571832106&amp;amp;w=2), OpenBSD fixes this by introducing static self-relocation
More and more CPU architectures are being tested and getting support too; this isn't just for amd64 and i386 - VAX users can rest easy
It'll be available in 5.7 in May, or you can use a -current snapshot (http://www.openbsd.org/faq/faq5.html#BldBinary) if you want to get a slice of the action now
***
FreeBSD foundation semi-annual newsletter (https://www.freebsdfoundation.org/press/2014dec-newsletter.html)
The FreeBSD foundation publishes a huge newsletter twice a year, detailing their funded projects and some community activities
As always, it starts with a letter from the president of the foundation - this time it's about encouraging students and new developers to get involved
The article also has a fundraising update with a list of sponsored projects, and they note that the donations meter has changed from dollars to number of donors (since they exceeded the goal already)
You can read summaries of all the BSD conferences of 2014 and see a list of upcoming ones next year too
There are also sections about the FreeBSD Journal (http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates)'s progress, a new staff member and a testimonial from NetApp
It's a very long report, so dedicate some time to read all the way through it
This year was pretty great for BSD: both the FreeBSD and OpenBSD foundations exceeded their goals and the NetBSD foundation came really close too
As we go into 2015, consider donating to whichever (https://www.freebsdfoundation.org/donate) BSD (http://www.openbsdfoundation.org/donations.html) you (https://www.netbsd.org/donations/) use (http://www.dragonflybsd.org/donations/), it really can make a difference
***
Modernizing OpenSSH fingerprints (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141920089614758&amp;amp;w=4)
When you connect to a server for the first time, you'll get what's called a fingerprint of the host's public key - this is used to verify that you're actually talking to the same server you intended to
Up until now, the key fingerprints have been an MD5 hash, displayed as hex
This can be problematic (https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-November/033117.html), especially for larger key types like RSA that give lots of wiggle room for collisions, as an attacker could generate a fake host key that gives the same MD5 string as the one you wanted to connect to
This new change replaces the default MD5 and hex with a base64-encoded SHA256 fingerprint
You can add a "FingerprintHash" line in your ssh_config to force using only the new type
There's also a new option (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141923470520906&amp;amp;w=2) to require users to authenticate with more than one public key, so you can really lock down login access to your servers - also useful if you're not 100% confident in any single key type
The new options should be in the upcoming 6.8 release
***
Interview - Dan Langille - info@bsdcan.org (mailto:info@bsdcan.org) / @bsdcan (https://twitter.com/bsdcan)
Plans for the BSDCan 2015 conference
News Roundup
Introducing ntimed, a new NTP daemon (https://github.com/bsdphk/Ntimed)
As we've mentioned before in our tutorials (http://www.bsdnow.tv/tutorials/ntpd), there are two main daemons for the Network Time Protocol - ISC's NTPd and OpenBSD's OpenNTPD
With all the recent security problems with ISC's NTPd, Poul-Henning Kamp (http://www.bsdnow.tv/episodes/2013_10_16-go_directly_to_jail) has been working on a third NTP daemon
It's called "ntimed" and you can try out a preview version of it right now - it's in FreeBSD ports (https://www.freshports.org/net/ntimed/) or on Github
PHK also has a few blog entries (http://phk.freebsd.dk/time/) about the project, including status updates
***
OpenBSD-maintained projects list (http://mdocml.bsd.lv/openbsd_projects.html)
There was recently a read on the misc mailing list (https://www.marc.info/?t=141961588200003&amp;amp;r=1&amp;amp;w=2) asking about different projects started by OpenBSD developers
The initial list had marks for which software had portable versions to other operating systems (OpenSSH being the most popular example)
A developer compiled a new list from all of the replies to that thread into a nice organized webpage
Most people are only familiar with things like OpenSSH, OpenSMTPD, OpenNTPD and more recently LibreSSL, but there are quite a lot more
This page also serves as a good history lesson for BSD in general: FreeBSD and others have ported some things over, while a couple OpenBSD tools were born from forks of FreeBSD tools (mergemaster, pkg tools, portscout)
***
Monitoring network traffic with FreeBSD (https://forums.freebsd.org/threads/howto-monitor-network-traffic-with-netflow-nfdump-nfsen-on-freebsd.49724/)
If you've ever been curious about monitoring network traffic on your FreeBSD boxes, this forum post may be exactly the thing for you
It'll show you how to combine the Netflow, NfDump and NfSen suite of tools to get some pretty detailed network stats (and of course put them into a fancy webpage)
This is especially useful for finding out what was going on at a certain point in time, for example if you had a traffic spike
***
Trapping spammers with spamd (http://www.protoc.org/blog/2014/12/22/trapping-spammers-with-the-openbsd-spam-deferral-daemon)
This is a blog post about OpenBSD's spamd (https://en.wikipedia.org/wiki/Spamd) - a spam email deferral daemon - and how to use it for your mail
It gives some background on the greylisting approach to spam, rather than just a typical host blacklist
"Greylisting is a method of defending e-mail users against spam. A mail transfer agent (MTA) using greylisting will "temporarily reject" any email from a sender it does not recognize. If the sender re-attempts mail delivery at a later time, the sender may be allowed to continue the mail delivery conversation."
The post also shows how to combine it with PF and other tools for a pretty fancy mail setup
You can find spamd in the OpenBSD base system (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/spamd.8), or use it with FreeBSD (https://www.freshports.org/mail/spamd) or NetBSD (http://pkgsrc.se/mail/spamd) via ports and pkgsrc
You might also want to go back and listen to BSDTalk episode 68 (https://archive.org/details/bsdtalk068), where Will talks to Bob Beck about spamd
***
Feedback/Questions
Sean writes in (http://slexy.org/view/s20rUK9XVJ)
Brandon writes in (http://slexy.org/view/s20nfzIuT2)
Anders writes in (http://slexy.org/view/s20wCBhFLO)
David writes in (http://slexy.org/view/s20xGrBIyl)
Kyle writes in (http://slexy.org/view/s2QHRaiZJW)
***
Mailing List Gold
NTP code comparison (https://www.marc.info/?l=openbsd-tech&amp;amp;m=141903858708123&amp;amp;w=2) - 192870 vs. 2898 (https://www.marc.info/?l=openbsd-tech&amp;amp;m=141905854411370&amp;amp;w=2)
NICs have feelings too (https://lists.freebsd.org/pipermail/freebsd-hackers/2014-December/046741.html)
Just think about it (https://www.marc.info/?l=openbsd-ports&amp;amp;m=141998130824977&amp;amp;w=2)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, bsdcan, call for papers, conference, talk, presentation, vxlan, static, pie, openssh, ntimed, ntp, openntpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>It&#39;s our last episode of 2014, and we&#39;ll be chatting with Dan Langille about the upcoming BSDCan conference. We&#39;ll find out what&#39;s planned and what sorts of presentations they&#39;re looking for. As usual, answers to viewer-submitted questions and all the week&#39;s news, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.asiabsdcon.org/timetable.html.en" rel="nofollow">More conference presentation videos</a></h3>

<ul>
<li>Some more of the presentation videos from AsiaBSDCon are appearing online</li>
<li>Masanobu Saitoh, <a href="https://www.youtube.com/watch?v=ApruZrU5fVs" rel="nofollow">Developing CPE Routers Based on NetBSD</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time" rel="nofollow">Reyk Floeter</a>, <a href="https://www.youtube.com/watch?v=ufeEP_hzFN0" rel="nofollow">VXLAN and Cloud-based Networking with OpenBSD</a></li>
<li>Jos Jansen, <a href="https://www.youtube.com/watch?v=gOPfRQgTjNo" rel="nofollow">Adapting OS X to the enterprise</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_04_01-edgy_bsd_users" rel="nofollow">Pierre Pronchery</a> &amp; Guillaume Lasmayous, <a href="https://www.youtube.com/watch?v=vh-TjLUj6os" rel="nofollow">Carve your NetBSD</a> &lt;!-- skip to 5:06 for henning trolling --&gt;</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_01_22-tendresse_for_ten" rel="nofollow">Colin Percival</a>, <a href="https://www.youtube.com/watch?v=jzY3m5Kv7Y8" rel="nofollow">Everything you need to know about cryptography in 1 hour</a> (not from AsiaBSDCon)</li>
<li>The &quot;bsdconferences&quot; YouTube channel has quite a lot of interesting <a href="https://www.youtube.com/user/bsdconferences/videos?sort=da&view=0&flow=grid" rel="nofollow">older BSD talks</a> too - you may want to go back and watch them if you haven&#39;t already
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=141922027318727&w=2" rel="nofollow">OpenBSD PIE enhancements</a></h3>

<ul>
<li><a href="https://en.wikipedia.org/wiki/Address_space_layout_randomization" rel="nofollow">ASLR</a> and <a href="https://en.wikipedia.org/wiki/Position-independent_executable" rel="nofollow">PIE</a> are great security features that OpenBSD has had enabled by default for a long time, in both the base system and ports, but they have one inherent problem</li>
<li>They only work with <em>dynamic</em> libraries and binaries, so if you have any static binaries, they don&#39;t get the same treatment</li>
<li>For example, the default shells (and many other things in /bin and /sbin) are statically linked</li>
<li>In the case of the static ones, you can always predict the memory layout, which is very bad and sort of <a href="https://en.wikipedia.org/wiki/Return-oriented_programming" rel="nofollow">defeats the whole purpose</a></li>
<li>With this and a few <a href="https://www.marc.info/?l=openbsd-cvs&m=141927571832106&w=2" rel="nofollow">related commits</a>, OpenBSD fixes this by introducing <strong>static self-relocation</strong></li>
<li>More and more CPU architectures are being tested and getting support too; this isn&#39;t just for amd64 and i386 - VAX users can rest easy</li>
<li>It&#39;ll be available in 5.7 in May, or you can use a <a href="http://www.openbsd.org/faq/faq5.html#BldBinary" rel="nofollow">-current snapshot</a> if you want to get a <em>slice</em> of the action now
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/press/2014dec-newsletter.html" rel="nofollow">FreeBSD foundation semi-annual newsletter</a></h3>

<ul>
<li>The FreeBSD foundation publishes a huge newsletter twice a year, detailing their funded projects and some community activities</li>
<li>As always, it starts with a letter from the president of the foundation - this time it&#39;s about encouraging students and new developers to get involved</li>
<li>The article also has a fundraising update with a list of sponsored projects, and they note that the donations meter has changed from dollars to number of donors (since they exceeded the goal already)</li>
<li>You can read summaries of all the BSD conferences of 2014 and see a list of upcoming ones next year too</li>
<li>There are also sections about the <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">FreeBSD Journal</a>&#39;s progress, a new staff member and a testimonial from NetApp</li>
<li>It&#39;s a very long report, so dedicate some time to read all the way through it</li>
<li>This year was pretty great for BSD: both the FreeBSD and OpenBSD foundations exceeded their goals and the NetBSD foundation came really close too</li>
<li>As we go into 2015, consider donating to <a href="https://www.freebsdfoundation.org/donate" rel="nofollow">whichever</a> <a href="http://www.openbsdfoundation.org/donations.html" rel="nofollow">BSD</a> <a href="https://www.netbsd.org/donations/" rel="nofollow">you</a> <a href="http://www.dragonflybsd.org/donations/" rel="nofollow">use</a>, it really can make a difference
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=141920089614758&w=4" rel="nofollow">Modernizing OpenSSH fingerprints</a></h3>

<ul>
<li>When you connect to a server for the first time, you&#39;ll get what&#39;s called a fingerprint of the host&#39;s public key - this is used to verify that you&#39;re actually talking to the same server you intended to</li>
<li>Up until now, the key fingerprints have been an MD5 hash, displayed as hex</li>
<li>This <a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-November/033117.html" rel="nofollow">can be problematic</a>, especially for larger key types like RSA that give lots of wiggle room for collisions, as an attacker could generate a fake host key that gives the same MD5 string as the one you wanted to connect to</li>
<li>This new change replaces the default MD5 and hex with a base64-encoded SHA256 fingerprint</li>
<li>You can add a &quot;FingerprintHash&quot; line in your ssh_config to force using only the new type</li>
<li>There&#39;s also a <a href="https://www.marc.info/?l=openbsd-cvs&m=141923470520906&w=2" rel="nofollow">new option</a> to require users to authenticate with <strong>more than one</strong> public key, so you can really lock down login access to your servers - also useful if you&#39;re not 100% confident in any single key type</li>
<li>The new options should be in the upcoming 6.8 release
***</li>
</ul>

<h2>Interview - Dan Langille - <a href="mailto:info@bsdcan.org" rel="nofollow">info@bsdcan.org</a> / <a href="https://twitter.com/bsdcan" rel="nofollow">@bsdcan</a></h2>

<p>Plans for the BSDCan 2015 conference</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/bsdphk/Ntimed" rel="nofollow">Introducing ntimed, a new NTP daemon</a></h3>

<ul>
<li>As we&#39;ve mentioned before in <a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">our tutorials</a>, there are two main daemons for the Network Time Protocol - ISC&#39;s NTPd and OpenBSD&#39;s OpenNTPD</li>
<li>With all the recent security problems with ISC&#39;s NTPd, <a href="http://www.bsdnow.tv/episodes/2013_10_16-go_directly_to_jail" rel="nofollow">Poul-Henning Kamp</a> has been working on a third NTP daemon</li>
<li>It&#39;s called &quot;ntimed&quot; and you can try out a preview version of it right now - it&#39;s <a href="https://www.freshports.org/net/ntimed/" rel="nofollow">in FreeBSD ports</a> or on Github</li>
<li>PHK also has a few <a href="http://phk.freebsd.dk/time/" rel="nofollow">blog entries</a> about the project, including status updates
***</li>
</ul>

<h3><a href="http://mdocml.bsd.lv/openbsd_projects.html" rel="nofollow">OpenBSD-maintained projects list</a></h3>

<ul>
<li>There was recently a read on the <a href="https://www.marc.info/?t=141961588200003&r=1&w=2" rel="nofollow">misc mailing list</a> asking about different projects started by OpenBSD developers</li>
<li>The initial list had marks for which software had portable versions to other operating systems (OpenSSH being the most popular example)</li>
<li>A developer compiled a new list from all of the replies to that thread into a nice organized webpage</li>
<li>Most people are only familiar with things like OpenSSH, OpenSMTPD, OpenNTPD and more recently LibreSSL, but there are quite a lot more</li>
<li>This page also serves as a good history lesson for BSD in general: FreeBSD and others have ported some things over, while a couple OpenBSD tools were born from forks of FreeBSD tools (mergemaster, pkg tools, portscout)
***</li>
</ul>

<h3><a href="https://forums.freebsd.org/threads/howto-monitor-network-traffic-with-netflow-nfdump-nfsen-on-freebsd.49724/" rel="nofollow">Monitoring network traffic with FreeBSD</a></h3>

<ul>
<li>If you&#39;ve ever been curious about monitoring network traffic on your FreeBSD boxes, this forum post may be exactly the thing for you</li>
<li>It&#39;ll show you how to combine the Netflow, NfDump and NfSen suite of tools to get some pretty detailed network stats (and of course put them into a fancy webpage)</li>
<li>This is especially useful for finding out what was going on at a certain point in time, for example if you had a traffic spike
***</li>
</ul>

<h3><a href="http://www.protoc.org/blog/2014/12/22/trapping-spammers-with-the-openbsd-spam-deferral-daemon" rel="nofollow">Trapping spammers with spamd</a></h3>

<ul>
<li>This is a blog post about OpenBSD&#39;s <a href="https://en.wikipedia.org/wiki/Spamd" rel="nofollow">spamd</a> - a spam email deferral daemon - and how to use it for your mail</li>
<li>It gives some background on the greylisting approach to spam, rather than just a typical host blacklist</li>
<li>&quot;Greylisting is a method of defending e-mail users against spam. A mail transfer agent (MTA) using greylisting will &quot;temporarily reject&quot; any email from a sender it does not recognize. If the sender re-attempts mail delivery at a later time, the sender may be allowed to continue the mail delivery conversation.&quot;</li>
<li>The post also shows how to combine it with PF and other tools for a pretty fancy mail setup</li>
<li>You can find spamd in the OpenBSD <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/spamd.8" rel="nofollow">base system</a>, or use it <a href="https://www.freshports.org/mail/spamd" rel="nofollow">with FreeBSD</a> <a href="http://pkgsrc.se/mail/spamd" rel="nofollow">or NetBSD</a> via ports and pkgsrc</li>
<li>You might also want to go back and listen to <a href="https://archive.org/details/bsdtalk068" rel="nofollow">BSDTalk episode 68</a>, where Will talks to Bob Beck about spamd
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20rUK9XVJ" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s20nfzIuT2" rel="nofollow">Brandon writes in</a></li>
<li><a href="http://slexy.org/view/s20wCBhFLO" rel="nofollow">Anders writes in</a></li>
<li><a href="http://slexy.org/view/s20xGrBIyl" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s2QHRaiZJW" rel="nofollow">Kyle writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-tech&m=141903858708123&w=2" rel="nofollow">NTP code comparison</a> - <a href="https://www.marc.info/?l=openbsd-tech&m=141905854411370&w=2" rel="nofollow">192870 vs. 2898</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2014-December/046741.html" rel="nofollow">NICs have feelings too</a></li>
<li><a href="https://www.marc.info/?l=openbsd-ports&m=141998130824977&w=2" rel="nofollow">Just think about it</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>It&#39;s our last episode of 2014, and we&#39;ll be chatting with Dan Langille about the upcoming BSDCan conference. We&#39;ll find out what&#39;s planned and what sorts of presentations they&#39;re looking for. As usual, answers to viewer-submitted questions and all the week&#39;s news, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.asiabsdcon.org/timetable.html.en" rel="nofollow">More conference presentation videos</a></h3>

<ul>
<li>Some more of the presentation videos from AsiaBSDCon are appearing online</li>
<li>Masanobu Saitoh, <a href="https://www.youtube.com/watch?v=ApruZrU5fVs" rel="nofollow">Developing CPE Routers Based on NetBSD</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time" rel="nofollow">Reyk Floeter</a>, <a href="https://www.youtube.com/watch?v=ufeEP_hzFN0" rel="nofollow">VXLAN and Cloud-based Networking with OpenBSD</a></li>
<li>Jos Jansen, <a href="https://www.youtube.com/watch?v=gOPfRQgTjNo" rel="nofollow">Adapting OS X to the enterprise</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_04_01-edgy_bsd_users" rel="nofollow">Pierre Pronchery</a> &amp; Guillaume Lasmayous, <a href="https://www.youtube.com/watch?v=vh-TjLUj6os" rel="nofollow">Carve your NetBSD</a> &lt;!-- skip to 5:06 for henning trolling --&gt;</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_01_22-tendresse_for_ten" rel="nofollow">Colin Percival</a>, <a href="https://www.youtube.com/watch?v=jzY3m5Kv7Y8" rel="nofollow">Everything you need to know about cryptography in 1 hour</a> (not from AsiaBSDCon)</li>
<li>The &quot;bsdconferences&quot; YouTube channel has quite a lot of interesting <a href="https://www.youtube.com/user/bsdconferences/videos?sort=da&view=0&flow=grid" rel="nofollow">older BSD talks</a> too - you may want to go back and watch them if you haven&#39;t already
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=141922027318727&w=2" rel="nofollow">OpenBSD PIE enhancements</a></h3>

<ul>
<li><a href="https://en.wikipedia.org/wiki/Address_space_layout_randomization" rel="nofollow">ASLR</a> and <a href="https://en.wikipedia.org/wiki/Position-independent_executable" rel="nofollow">PIE</a> are great security features that OpenBSD has had enabled by default for a long time, in both the base system and ports, but they have one inherent problem</li>
<li>They only work with <em>dynamic</em> libraries and binaries, so if you have any static binaries, they don&#39;t get the same treatment</li>
<li>For example, the default shells (and many other things in /bin and /sbin) are statically linked</li>
<li>In the case of the static ones, you can always predict the memory layout, which is very bad and sort of <a href="https://en.wikipedia.org/wiki/Return-oriented_programming" rel="nofollow">defeats the whole purpose</a></li>
<li>With this and a few <a href="https://www.marc.info/?l=openbsd-cvs&m=141927571832106&w=2" rel="nofollow">related commits</a>, OpenBSD fixes this by introducing <strong>static self-relocation</strong></li>
<li>More and more CPU architectures are being tested and getting support too; this isn&#39;t just for amd64 and i386 - VAX users can rest easy</li>
<li>It&#39;ll be available in 5.7 in May, or you can use a <a href="http://www.openbsd.org/faq/faq5.html#BldBinary" rel="nofollow">-current snapshot</a> if you want to get a <em>slice</em> of the action now
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/press/2014dec-newsletter.html" rel="nofollow">FreeBSD foundation semi-annual newsletter</a></h3>

<ul>
<li>The FreeBSD foundation publishes a huge newsletter twice a year, detailing their funded projects and some community activities</li>
<li>As always, it starts with a letter from the president of the foundation - this time it&#39;s about encouraging students and new developers to get involved</li>
<li>The article also has a fundraising update with a list of sponsored projects, and they note that the donations meter has changed from dollars to number of donors (since they exceeded the goal already)</li>
<li>You can read summaries of all the BSD conferences of 2014 and see a list of upcoming ones next year too</li>
<li>There are also sections about the <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">FreeBSD Journal</a>&#39;s progress, a new staff member and a testimonial from NetApp</li>
<li>It&#39;s a very long report, so dedicate some time to read all the way through it</li>
<li>This year was pretty great for BSD: both the FreeBSD and OpenBSD foundations exceeded their goals and the NetBSD foundation came really close too</li>
<li>As we go into 2015, consider donating to <a href="https://www.freebsdfoundation.org/donate" rel="nofollow">whichever</a> <a href="http://www.openbsdfoundation.org/donations.html" rel="nofollow">BSD</a> <a href="https://www.netbsd.org/donations/" rel="nofollow">you</a> <a href="http://www.dragonflybsd.org/donations/" rel="nofollow">use</a>, it really can make a difference
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&m=141920089614758&w=4" rel="nofollow">Modernizing OpenSSH fingerprints</a></h3>

<ul>
<li>When you connect to a server for the first time, you&#39;ll get what&#39;s called a fingerprint of the host&#39;s public key - this is used to verify that you&#39;re actually talking to the same server you intended to</li>
<li>Up until now, the key fingerprints have been an MD5 hash, displayed as hex</li>
<li>This <a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-November/033117.html" rel="nofollow">can be problematic</a>, especially for larger key types like RSA that give lots of wiggle room for collisions, as an attacker could generate a fake host key that gives the same MD5 string as the one you wanted to connect to</li>
<li>This new change replaces the default MD5 and hex with a base64-encoded SHA256 fingerprint</li>
<li>You can add a &quot;FingerprintHash&quot; line in your ssh_config to force using only the new type</li>
<li>There&#39;s also a <a href="https://www.marc.info/?l=openbsd-cvs&m=141923470520906&w=2" rel="nofollow">new option</a> to require users to authenticate with <strong>more than one</strong> public key, so you can really lock down login access to your servers - also useful if you&#39;re not 100% confident in any single key type</li>
<li>The new options should be in the upcoming 6.8 release
***</li>
</ul>

<h2>Interview - Dan Langille - <a href="mailto:info@bsdcan.org" rel="nofollow">info@bsdcan.org</a> / <a href="https://twitter.com/bsdcan" rel="nofollow">@bsdcan</a></h2>

<p>Plans for the BSDCan 2015 conference</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/bsdphk/Ntimed" rel="nofollow">Introducing ntimed, a new NTP daemon</a></h3>

<ul>
<li>As we&#39;ve mentioned before in <a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">our tutorials</a>, there are two main daemons for the Network Time Protocol - ISC&#39;s NTPd and OpenBSD&#39;s OpenNTPD</li>
<li>With all the recent security problems with ISC&#39;s NTPd, <a href="http://www.bsdnow.tv/episodes/2013_10_16-go_directly_to_jail" rel="nofollow">Poul-Henning Kamp</a> has been working on a third NTP daemon</li>
<li>It&#39;s called &quot;ntimed&quot; and you can try out a preview version of it right now - it&#39;s <a href="https://www.freshports.org/net/ntimed/" rel="nofollow">in FreeBSD ports</a> or on Github</li>
<li>PHK also has a few <a href="http://phk.freebsd.dk/time/" rel="nofollow">blog entries</a> about the project, including status updates
***</li>
</ul>

<h3><a href="http://mdocml.bsd.lv/openbsd_projects.html" rel="nofollow">OpenBSD-maintained projects list</a></h3>

<ul>
<li>There was recently a read on the <a href="https://www.marc.info/?t=141961588200003&r=1&w=2" rel="nofollow">misc mailing list</a> asking about different projects started by OpenBSD developers</li>
<li>The initial list had marks for which software had portable versions to other operating systems (OpenSSH being the most popular example)</li>
<li>A developer compiled a new list from all of the replies to that thread into a nice organized webpage</li>
<li>Most people are only familiar with things like OpenSSH, OpenSMTPD, OpenNTPD and more recently LibreSSL, but there are quite a lot more</li>
<li>This page also serves as a good history lesson for BSD in general: FreeBSD and others have ported some things over, while a couple OpenBSD tools were born from forks of FreeBSD tools (mergemaster, pkg tools, portscout)
***</li>
</ul>

<h3><a href="https://forums.freebsd.org/threads/howto-monitor-network-traffic-with-netflow-nfdump-nfsen-on-freebsd.49724/" rel="nofollow">Monitoring network traffic with FreeBSD</a></h3>

<ul>
<li>If you&#39;ve ever been curious about monitoring network traffic on your FreeBSD boxes, this forum post may be exactly the thing for you</li>
<li>It&#39;ll show you how to combine the Netflow, NfDump and NfSen suite of tools to get some pretty detailed network stats (and of course put them into a fancy webpage)</li>
<li>This is especially useful for finding out what was going on at a certain point in time, for example if you had a traffic spike
***</li>
</ul>

<h3><a href="http://www.protoc.org/blog/2014/12/22/trapping-spammers-with-the-openbsd-spam-deferral-daemon" rel="nofollow">Trapping spammers with spamd</a></h3>

<ul>
<li>This is a blog post about OpenBSD&#39;s <a href="https://en.wikipedia.org/wiki/Spamd" rel="nofollow">spamd</a> - a spam email deferral daemon - and how to use it for your mail</li>
<li>It gives some background on the greylisting approach to spam, rather than just a typical host blacklist</li>
<li>&quot;Greylisting is a method of defending e-mail users against spam. A mail transfer agent (MTA) using greylisting will &quot;temporarily reject&quot; any email from a sender it does not recognize. If the sender re-attempts mail delivery at a later time, the sender may be allowed to continue the mail delivery conversation.&quot;</li>
<li>The post also shows how to combine it with PF and other tools for a pretty fancy mail setup</li>
<li>You can find spamd in the OpenBSD <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/spamd.8" rel="nofollow">base system</a>, or use it <a href="https://www.freshports.org/mail/spamd" rel="nofollow">with FreeBSD</a> <a href="http://pkgsrc.se/mail/spamd" rel="nofollow">or NetBSD</a> via ports and pkgsrc</li>
<li>You might also want to go back and listen to <a href="https://archive.org/details/bsdtalk068" rel="nofollow">BSDTalk episode 68</a>, where Will talks to Bob Beck about spamd
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20rUK9XVJ" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s20nfzIuT2" rel="nofollow">Brandon writes in</a></li>
<li><a href="http://slexy.org/view/s20wCBhFLO" rel="nofollow">Anders writes in</a></li>
<li><a href="http://slexy.org/view/s20xGrBIyl" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s2QHRaiZJW" rel="nofollow">Kyle writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-tech&m=141903858708123&w=2" rel="nofollow">NTP code comparison</a> - <a href="https://www.marc.info/?l=openbsd-tech&m=141905854411370&w=2" rel="nofollow">192870 vs. 2898</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2014-December/046741.html" rel="nofollow">NICs have feelings too</a></li>
<li><a href="https://www.marc.info/?l=openbsd-ports&m=141998130824977&w=2" rel="nofollow">Just think about it</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>69: Under the Ports Tree</title>
  <link>https://www.bsdnow.tv/69</link>
  <guid isPermaLink="false">0b26db6f-81d9-4338-b84d-c843b9a8b49a</guid>
  <pubDate>Wed, 24 Dec 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0b26db6f-81d9-4338-b84d-c843b9a8b49a.mp3" length="52238740" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>It's a special holiday episode! We asked you guys in the audience to send in the tale of how you first got into BSD, and we're going to share those with everyone today. We'll also be playing two bonus mini-interviews, so get comfy by the fire and listen to some BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:12:33</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>It's a special holiday episode! We asked you guys in the audience to send in the tale of how you first got into BSD, and we're going to share those with everyone today. We'll also be playing two bonus mini-interviews, so get comfy by the fire and listen to some BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Special segment
How our viewers got into BSD
Jason's story (text (http://slexy.org/view/s207hi9pTo))
bsdx's story (text (http://slexy.org/view/s20cmh0anD))
David's story (text (http://slexy.org/view/s21r4AL53g))
Brad's story (text (http://slexy.org/view/s2OqEie53V))
Reese's story (video)
Bryan's story (video)
Pete's story (text (http://slexy.org/view/s2ve2kfgW7))
Anders' story (text (http://slexy.org/view/s20eL5EYMv))
Guillermo's story (text (http://slexy.org/view/s20KRuIaks))
Jonathan's story (text (http://slexy.org/view/s20IFqrc7O))
Adam's story (text (http://slexy.org/view/s2FnnJH9zs))
Chris' story (text (http://slexy.org/view/s21GazXKH2))
Tigersharke's story (text (http://slexy.org/view/s2iJdLoxzZ))
Roller and Kandie's stories (text (http://slexy.org/view/s203RsddHG))
Uwe's story (text (http://slexy.org/view/s2gmB5VaS3))
Pascal's story (text (http://slexy.org/view/s2PWntJ7Tc)) and (image (https://i.imgur.com/ekXbDvb.jpg))
***
Interview - Erwin Lansing - erwin@freebsd.org (mailto:erwin@freebsd.org)
BSD in Europe, getting people involved
Interview - Cristina Vintila - @cristina_crow (https://twitter.com/cristina_crow)
BSD conferences
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, christmas, advocacy, women in technology, language barriers, europe, eurobsdcon</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>It&#39;s a special holiday episode! We asked you guys in the audience to send in the tale of how you first got into BSD, and we&#39;re going to share those with everyone today. We&#39;ll also be playing two bonus mini-interviews, so get comfy by the fire and listen to some BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Special segment</h2>

<h3>How our viewers got into BSD</h3>

<ul>
<li>Jason&#39;s story (<a href="http://slexy.org/view/s207hi9pTo" rel="nofollow">text</a>)</li>
<li>bsdx&#39;s story (<a href="http://slexy.org/view/s20cmh0anD" rel="nofollow">text</a>)</li>
<li>David&#39;s story (<a href="http://slexy.org/view/s21r4AL53g" rel="nofollow">text</a>)</li>
<li>Brad&#39;s story (<a href="http://slexy.org/view/s2OqEie53V" rel="nofollow">text</a>)</li>
<li>Reese&#39;s story (video)</li>
<li>Bryan&#39;s story (video)</li>
<li>Pete&#39;s story (<a href="http://slexy.org/view/s2ve2kfgW7" rel="nofollow">text</a>)</li>
<li>Anders&#39; story (<a href="http://slexy.org/view/s20eL5EYMv" rel="nofollow">text</a>)</li>
<li>Guillermo&#39;s story (<a href="http://slexy.org/view/s20KRuIaks" rel="nofollow">text</a>)</li>
<li>Jonathan&#39;s story (<a href="http://slexy.org/view/s20IFqrc7O" rel="nofollow">text</a>)</li>
<li>Adam&#39;s story (<a href="http://slexy.org/view/s2FnnJH9zs" rel="nofollow">text</a>)</li>
<li>Chris&#39; story (<a href="http://slexy.org/view/s21GazXKH2" rel="nofollow">text</a>)</li>
<li>Tigersharke&#39;s story (<a href="http://slexy.org/view/s2iJdLoxzZ" rel="nofollow">text</a>)</li>
<li>Roller and Kandie&#39;s stories (<a href="http://slexy.org/view/s203RsddHG" rel="nofollow">text</a>)</li>
<li>Uwe&#39;s story (<a href="http://slexy.org/view/s2gmB5VaS3" rel="nofollow">text</a>)</li>
<li>Pascal&#39;s story (<a href="http://slexy.org/view/s2PWntJ7Tc" rel="nofollow">text</a>) and (<a href="https://i.imgur.com/ekXbDvb.jpg" rel="nofollow">image</a>)
***</li>
</ul>

<h2>Interview - Erwin Lansing - <a href="mailto:erwin@freebsd.org" rel="nofollow">erwin@freebsd.org</a></h2>

<p>BSD in Europe, getting people involved</p>

<hr>

<h2>Interview - Cristina Vintila - <a href="https://twitter.com/cristina_crow" rel="nofollow">@cristina_crow</a></h2>

<p>BSD conferences</p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>It&#39;s a special holiday episode! We asked you guys in the audience to send in the tale of how you first got into BSD, and we&#39;re going to share those with everyone today. We&#39;ll also be playing two bonus mini-interviews, so get comfy by the fire and listen to some BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Special segment</h2>

<h3>How our viewers got into BSD</h3>

<ul>
<li>Jason&#39;s story (<a href="http://slexy.org/view/s207hi9pTo" rel="nofollow">text</a>)</li>
<li>bsdx&#39;s story (<a href="http://slexy.org/view/s20cmh0anD" rel="nofollow">text</a>)</li>
<li>David&#39;s story (<a href="http://slexy.org/view/s21r4AL53g" rel="nofollow">text</a>)</li>
<li>Brad&#39;s story (<a href="http://slexy.org/view/s2OqEie53V" rel="nofollow">text</a>)</li>
<li>Reese&#39;s story (video)</li>
<li>Bryan&#39;s story (video)</li>
<li>Pete&#39;s story (<a href="http://slexy.org/view/s2ve2kfgW7" rel="nofollow">text</a>)</li>
<li>Anders&#39; story (<a href="http://slexy.org/view/s20eL5EYMv" rel="nofollow">text</a>)</li>
<li>Guillermo&#39;s story (<a href="http://slexy.org/view/s20KRuIaks" rel="nofollow">text</a>)</li>
<li>Jonathan&#39;s story (<a href="http://slexy.org/view/s20IFqrc7O" rel="nofollow">text</a>)</li>
<li>Adam&#39;s story (<a href="http://slexy.org/view/s2FnnJH9zs" rel="nofollow">text</a>)</li>
<li>Chris&#39; story (<a href="http://slexy.org/view/s21GazXKH2" rel="nofollow">text</a>)</li>
<li>Tigersharke&#39;s story (<a href="http://slexy.org/view/s2iJdLoxzZ" rel="nofollow">text</a>)</li>
<li>Roller and Kandie&#39;s stories (<a href="http://slexy.org/view/s203RsddHG" rel="nofollow">text</a>)</li>
<li>Uwe&#39;s story (<a href="http://slexy.org/view/s2gmB5VaS3" rel="nofollow">text</a>)</li>
<li>Pascal&#39;s story (<a href="http://slexy.org/view/s2PWntJ7Tc" rel="nofollow">text</a>) and (<a href="https://i.imgur.com/ekXbDvb.jpg" rel="nofollow">image</a>)
***</li>
</ul>

<h2>Interview - Erwin Lansing - <a href="mailto:erwin@freebsd.org" rel="nofollow">erwin@freebsd.org</a></h2>

<p>BSD in Europe, getting people involved</p>

<hr>

<h2>Interview - Cristina Vintila - <a href="https://twitter.com/cristina_crow" rel="nofollow">@cristina_crow</a></h2>

<p>BSD conferences</p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>68: Just the Essentials</title>
  <link>https://www.bsdnow.tv/68</link>
  <guid isPermaLink="false">d06324f4-7dc5-4b8f-9618-666fe480b68d</guid>
  <pubDate>Wed, 17 Dec 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d06324f4-7dc5-4b8f-9618-666fe480b68d.mp3" length="62609620" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week, we'll be talking with Michael Lucas about his newest BSD book, "FreeBSD Mastery: Storage Essentials." It's got lots of great information about the disk subsystems, GEOM, filesystems, you name it. We've also got the usual round of news and answers to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:26:57</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week, we'll be talking with Michael Lucas about his newest BSD book, "FreeBSD Mastery: Storage Essentials." It's got lots of great information about the disk subsystems, GEOM, filesystems, you name it. We've also got the usual round of news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
More BSD conference videos (https://www.youtube.com/channel/UCLy8AikPZfWEmzWxUec69PA/videos)
We mentioned it a few times, but the "New Directions in Operating Systems" conference was held in November in the UK
The presentations videos are now online, with a few BSD-related talks of interest
Antti Kantee (http://www.bsdnow.tv/episodes/2013_10_23-a_brief_intorduction), Rump kernels and why / how we got here (https://www.youtube.com/watch?v=GoB73cVyScI)
Franco Fichtner, An introduction to userland networking (https://www.youtube.com/watch?v=WiMNuGTRgbA)
Robert Watson (http://www.bsdnow.tv/episodes/2014_08_13-vpn_my_dear_watson), New ideas about old OS security (https://www.youtube.com/watch?v=60elN996rtg)
Lots of other interesting, but non-BSD-related, talks were also presented, so check the full list (https://www.youtube.com/playlist?list=PLmRrx948XMnEUlzKOCYn3AzT8OAInP_5M) if you're interested in operating systems in general
The 2014 AsiaBSDCon videos are also slowly being uploaded (better late than never)
Kirk McKusick (http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache), An Overview of Security in the FreeBSD Kernel (https://www.youtube.com/watch?v=E04LxKiu79I)
Matthew Ahrens (http://www.bsdnow.tv/episodes/2014_05_14-bsdcanned_goods), OpenZFS ensures the continued excellence of ZFS (https://www.youtube.com/watch?v=8T9Rh-46jhI)
Eric Allman, Bambi Meets Godzilla: They Elope - Open Source Meets the Commercial World (https://www.youtube.com/watch?v=o2dmreSy76Q)
Scott Long (http://www.bsdnow.tv/episodes/2013_12_25-the_gift_of_giving), Modifying the FreeBSD kernel Netflix streaming servers (https://www.youtube.com/watch?v=4sZZN8Szh14)
Dru Lavigne (http://www.bsdnow.tv/episodes/2014_04_09-pxe_dust), ZFS for the Masses (https://www.youtube.com/watch?v=z5apZFFvx4k)
Kris Moore, Snapshots, Replication, and Boot Environments (https://www.youtube.com/watch?v=w-0PlAVSg5U)
David Chisnall (http://www.bsdnow.tv/episodes/2014_05_07-lets_get_raid), The Future of LLVM in the FreeBSD Toolchain (https://www.youtube.com/watch?v=NLqDAclXMMU)
Luba Tang, Bold, fast optimizing linker for BSD (https://www.youtube.com/watch?v=fWgbBUPMsVw)
John Hixson (http://www.bsdnow.tv/episodes/2014_04_23-its_gonna_get_nasty), Introduction to FreeNAS development (https://www.youtube.com/watch?v=iwF82aep-l8)
Zbigniew Bodek, Transparent Superpages for FreeBSD on ARM (https://www.youtube.com/watch?v=2KLXcyLZ_RE)
Michael Dexter, Visualizing Unix: Graphing bhyve, ZFS and PF with Graphite (https://www.youtube.com/watch?v=rjNg1eQ7uAk)
Peter Grehan (http://www.bsdnow.tv/episodes/2014_01_15-bhyve_mind), Nested Paging in Bhyve (https://www.youtube.com/watch?v=wptkUxJSNMY)
Martin Matuška, Deploying FreeBSD systems with Foreman and mfsBSD (https://www.youtube.com/watch?v=nb8jB5x0OX4)
James Brown (http://www.bsdnow.tv/episodes/2014_04_16-certified_package_delivery), Analysys of BSD Associate Exam Results (https://www.youtube.com/watch?v=6eKMLuzsTbY)
Mindaugas Rasiukevicius, NPF - progress and perspective (https://www.youtube.com/watch?v=cgBh0iC9WhM)
Luigi Rizzo, Netmap as a core networking technology (https://www.youtube.com/watch?v=nW8iHgOL9y4)
Michael W. Lucas (http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop), Sudo: You're Doing it Wrong (https://www.youtube.com/watch?v=o0purspHg-o) (not from a BSD conference, but still good)
They should make for some great material to watch during the holidays
***
OpenBSD vs FreeBSD security features (http://networkfilter.blogspot.com/2014/12/security-openbsd-vs-freebsd.html)
From the author of both the OpenBSD and FreeBSD secure gateway articles we've featured in the past comes a new entry about security
The article goes through a list of all the security features enabled (and disabled) by default in both FreeBSD and OpenBSD
It covers a wide range of topics, including: memory protection, randomization, encryption, privilege separation, Capsicum, securelevels, MAC, Jails and chroots, network stack hardening, firewall features and much more
This is definitely one of the most in-depth and complete articles we've seen in a while - the author seems to have done his homework
If you're looking to secure any sort of BSD box, this post has some very detailed explanations of different exploit mitigation techniques - be sure to read the whole thing
There are also some good comments (http://daemonforums.org/showthread.php?s=16fd0771d929aff294b252924b414f2c&amp;amp;t=8823) on DaemonForums and lobste.rs (https://lobste.rs/s/e3s9xr/security_openbsd_vs_freebsd) that you may want to read 
***
The password? You changed it, right? (http://bsdly.blogspot.com/2014/12/the-password-you-changed-it-right.html)
Peter Hansteen (http://www.bsdnow.tv/episodes/2014_04_30-puffy_firewall) has a new blog post up, detailing some weird SSH bruteforcing he's seen recently
He apparently reads his auth logs when he gets bored at an airport
This new bruteforcing attempt seems to be targetting D-Link devices, as evidenced by the three usernames the bots try to use
More than 700 IPs have tried to get into Peter's BSD boxes using these names in combination with weak passwords
Lots more details, including the lists of passwords and IPs, can be found in the full article
If you're using a BSD router (http://www.bsdnow.tv/tutorials/openbsd-router), things like this can be easily prevented with PF or fail2ban (and you probably don't have a "d-link" user anyway)
***
Get started with FreeBSD, an intro for Linux users (http://www.infoworld.com/article/2858288/unix/intro-to-freebsd-for-linux-users.html)
Another new BSD article on a mainstream technology news site - seems we're getting popular
This article is written for Linux users who may be considering switching over to BSD and wondering what it's all about
It details installing FreeBSD 9.3 and getting a basic system setup, while touching on ports and packages, and explaining some terminology along the way
"Among the legions of Linux users and admins, there seems to be a sort of passive curiosity about FreeBSD and other BSDs. Like commuters on a packed train, they gaze out at a less crowded, vaguely mysterious train heading in a slightly different direction and wonder what traveling on that train might be like"
**
Interview - Michael W. Lucas - mwlucas@michaelwlucas.com (mailto:mwlucas@michaelwlucas.com) / @mwlauthor (https://twitter.com/mwlauthor)
FreeBSD Mastery: Storage Essentials (https://www.tiltedwindmillpress.com/?product=freebsd-mastery-storage-essentials)
News Roundup
OpenSMTPD status update (https://poolp.org/0xa86e/Some-OpenSMTPD-overview,-part-3)
The OpenSMTPD guys (http://www.bsdnow.tv/episodes/2013-09-18_mx_with_ttx), particularly Gilles, have posted an update on what they've been up to lately
As of 5.6, it's become the default MTA in OpenBSD, and sendmail will be totally gone in 5.7
Email is a much more tricky protocol than you might imagine, and the post goes through some of the weirdness and problems they've had to deal with
There's also another post (https://poolp.org/0xa871/The-state-of-filters) that goes into detail on their upcoming filtering API - a feature many have requested
The API is still being developed, but you can test it out now if you know what you're doing - full details in the article
OpenSMTPD also has portable versions in FreeBSD ports and NetBSD pkgsrc, so check it out
***
OpenCrypto changes in FreeBSD (https://lists.freebsd.org/pipermail/svn-src-head/2014-December/065806.html)
A little while back, we talked to John-Mark Gurney (http://www.bsdnow.tv/episodes/2014_10_29-ipsecond_wind) about updating FreeBSD's OpenCrypto framework, specifically for IPSEC
Some of that work has just landed in the -CURRENT branch, and the commit has a bit of details
The ICM and GCM modes of AES were added, and both include support for AESNI
There's a new port - "nist-kat" - that can be used to test the new modes of operation
Some things were fixed in the process as well, including an issue that would leak timing info and result in the ability to forge messages
Code was also borrowed from both OpenBSD and NetBSD to make this possible
***
First thoughts on OpenBSD's httpd (http://www.protoc.org/blog/2014/11/23/first-thoughts-on-the-new-openbsd-httpd-server/)
Here we have a blog post from a user of OpenBSD's new homegrown web server that made its debut in 5.6
The author loves that it has proper privilege separation, a very simple config syntax and that it always runs in a chroot
He also mentions dynamic content hosting with FastCGI, and provides an example of how to set it up
Be sure to check our interview with Reyk (http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time) about the new httpd if you're curious on how it got started
Also, if you're running the version that came with 5.6, there's a huge patch (http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/009_httpd.patch.sig) you can apply to get a lot of the features and fixes from -current without waiting for 5.7
***
Steam on PCBSD (https://www.youtube.com/watch?v=B04EuZ9hpAI)
One of the most common questions people who want to use BSD as a desktop ask us is "can I run games?" or "can I use steam?"
Steam through the Linux emulation layer (in FreeBSD) may be possible soon, but it's already possible to use it with WINE
This video shows how to get Steam set up on PCBSD using the Windows version
There are also some instructions in the video description to look over
A second video (https://www.youtube.com/watch?v=BJ88B8aWdk0) details getting streaming set up
***
Feedback/Questions
Charlie writes in (http://slexy.org/view/s2JgqXcw4i)
Sean writes in (http://slexy.org/view/s2WormjMCs)
Predrag writes in (http://slexy.org/view/s20UmdFrbj)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, freebsd mastery, storage essentials, ufs, zfs, disks, book, review, michael lucas, asiabsdcon, operatingsystems.io, opensmtpd, steam</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week, we&#39;ll be talking with Michael Lucas about his newest BSD book, &quot;FreeBSD Mastery: Storage Essentials.&quot; It&#39;s got lots of great information about the disk subsystems, GEOM, filesystems, you name it. We&#39;ve also got the usual round of news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.youtube.com/channel/UCLy8AikPZfWEmzWxUec69PA/videos" rel="nofollow">More BSD conference videos</a></h3>

<ul>
<li>We mentioned it a few times, but the &quot;New Directions in Operating Systems&quot; conference was held in November in the UK</li>
<li>The presentations videos are now online, with a few BSD-related talks of interest</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_10_23-a_brief_intorduction" rel="nofollow">Antti Kantee</a>, <a href="https://www.youtube.com/watch?v=GoB73cVyScI" rel="nofollow">Rump kernels and why / how we got here</a></li>
<li>Franco Fichtner, <a href="https://www.youtube.com/watch?v=WiMNuGTRgbA" rel="nofollow">An introduction to userland networking</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_08_13-vpn_my_dear_watson" rel="nofollow">Robert Watson</a>, <a href="https://www.youtube.com/watch?v=60elN996rtg" rel="nofollow">New ideas about old OS security</a></li>
<li>Lots of other interesting, but non-BSD-related, talks were also presented, so check the <a href="https://www.youtube.com/playlist?list=PLmRrx948XMnEUlzKOCYn3AzT8OAInP_5M" rel="nofollow">full list</a> if you&#39;re interested in operating systems in general</li>
<li>The 2014 AsiaBSDCon videos are also slowly being uploaded (better late than never)</li>
<li><a href="http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache" rel="nofollow">Kirk McKusick</a>, <a href="https://www.youtube.com/watch?v=E04LxKiu79I" rel="nofollow">An Overview of Security in the FreeBSD Kernel</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_05_14-bsdcanned_goods" rel="nofollow">Matthew Ahrens</a>, <a href="https://www.youtube.com/watch?v=8T9Rh-46jhI" rel="nofollow">OpenZFS ensures the continued excellence of ZFS</a></li>
<li>Eric Allman, <a href="https://www.youtube.com/watch?v=o2dmreSy76Q" rel="nofollow">Bambi Meets Godzilla: They Elope - Open Source Meets the Commercial World</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2013_12_25-the_gift_of_giving" rel="nofollow">Scott Long</a>, <a href="https://www.youtube.com/watch?v=4sZZN8Szh14" rel="nofollow">Modifying the FreeBSD kernel Netflix streaming servers</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_04_09-pxe_dust" rel="nofollow">Dru Lavigne</a>, <a href="https://www.youtube.com/watch?v=z5apZFFvx4k" rel="nofollow">ZFS for the Masses</a></li>
<li>Kris Moore, <a href="https://www.youtube.com/watch?v=w-0PlAVSg5U" rel="nofollow">Snapshots, Replication, and Boot Environments</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_05_07-lets_get_raid" rel="nofollow">David Chisnall</a>, <a href="https://www.youtube.com/watch?v=NLqDAclXMMU" rel="nofollow">The Future of LLVM in the FreeBSD Toolchain</a></li>
<li>Luba Tang, <a href="https://www.youtube.com/watch?v=fWgbBUPMsVw" rel="nofollow">Bold, fast optimizing linker for BSD</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_04_23-its_gonna_get_nasty" rel="nofollow">John Hixson</a>, <a href="https://www.youtube.com/watch?v=iwF82aep-l8" rel="nofollow">Introduction to FreeNAS development</a></li>
<li>Zbigniew Bodek, <a href="https://www.youtube.com/watch?v=2KLXcyLZ_RE" rel="nofollow">Transparent Superpages for FreeBSD on ARM</a></li>
<li>Michael Dexter, <a href="https://www.youtube.com/watch?v=rjNg1eQ7uAk" rel="nofollow">Visualizing Unix: Graphing bhyve, ZFS and PF with Graphite</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_01_15-bhyve_mind" rel="nofollow">Peter Grehan</a>, <a href="https://www.youtube.com/watch?v=wptkUxJSNMY" rel="nofollow">Nested Paging in Bhyve</a></li>
<li>Martin Matuška, <a href="https://www.youtube.com/watch?v=nb8jB5x0OX4" rel="nofollow">Deploying FreeBSD systems with Foreman and mfsBSD</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_04_16-certified_package_delivery" rel="nofollow">James Brown</a>, <a href="https://www.youtube.com/watch?v=6eKMLuzsTbY" rel="nofollow">Analysys of BSD Associate Exam Results</a></li>
<li>Mindaugas Rasiukevicius, <a href="https://www.youtube.com/watch?v=cgBh0iC9WhM" rel="nofollow">NPF - progress and perspective</a></li>
<li>Luigi Rizzo, <a href="https://www.youtube.com/watch?v=nW8iHgOL9y4" rel="nofollow">Netmap as a core networking technology</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">Michael W. Lucas</a>, <a href="https://www.youtube.com/watch?v=o0purspHg-o" rel="nofollow">Sudo: You&#39;re Doing it Wrong</a> (not from a BSD conference, but still good)</li>
<li>They should make for some great material to watch during the holidays
***</li>
</ul>

<h3><a href="http://networkfilter.blogspot.com/2014/12/security-openbsd-vs-freebsd.html" rel="nofollow">OpenBSD vs FreeBSD security features</a></h3>

<ul>
<li>From the author of both the OpenBSD and FreeBSD secure gateway articles we&#39;ve featured in the past comes a new entry about security</li>
<li>The article goes through a list of all the security features enabled (and disabled) by default in both FreeBSD and OpenBSD</li>
<li>It covers a wide range of topics, including: memory protection, randomization, encryption, privilege separation, Capsicum, securelevels, MAC, Jails and chroots, network stack hardening, firewall features and <strong>much more</strong></li>
<li>This is definitely one of the most in-depth and complete articles we&#39;ve seen in a while - the author seems to have done his homework</li>
<li>If you&#39;re looking to secure any sort of BSD box, this post has some very detailed explanations of different exploit mitigation techniques - be sure to read the whole thing</li>
<li>There are also <a href="http://daemonforums.org/showthread.php?s=16fd0771d929aff294b252924b414f2c&t=8823" rel="nofollow">some good comments</a> on DaemonForums <a href="https://lobste.rs/s/e3s9xr/security_openbsd_vs_freebsd" rel="nofollow">and lobste.rs</a> that you may want to read 
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2014/12/the-password-you-changed-it-right.html" rel="nofollow">The password? You changed it, right?</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2014_04_30-puffy_firewall" rel="nofollow">Peter Hansteen</a> has a new blog post up, detailing some weird SSH bruteforcing he&#39;s seen recently</li>
<li>He apparently reads his auth logs when he gets bored at an airport</li>
<li>This new bruteforcing attempt seems to be targetting D-Link devices, as evidenced by the three usernames the bots try to use</li>
<li>More than 700 IPs have tried to get into Peter&#39;s BSD boxes using these names in combination with weak passwords</li>
<li>Lots more details, including the lists of passwords and IPs, can be found in the full article</li>
<li>If you&#39;re <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">using a BSD router</a>, things like this can be easily prevented with PF or fail2ban (and you probably don&#39;t have a &quot;d-link&quot; user anyway)
***</li>
</ul>

<h3><a href="http://www.infoworld.com/article/2858288/unix/intro-to-freebsd-for-linux-users.html" rel="nofollow">Get started with FreeBSD, an intro for Linux users</a></h3>

<ul>
<li>Another new BSD article on a mainstream technology news site - seems we&#39;re getting popular</li>
<li>This article is written for Linux users who may be considering switching over to BSD and wondering what it&#39;s all about</li>
<li>It details installing FreeBSD 9.3 and getting a basic system setup, while touching on ports and packages, and explaining some terminology along the way</li>
<li>&quot;Among the legions of Linux users and admins, there seems to be a sort of passive curiosity about FreeBSD and other <em>BSDs. Like commuters on a packed train, they gaze out at a less crowded, vaguely mysterious train heading in a slightly different direction and wonder what traveling on that train might be like&quot;
*</em>*</li>
</ul>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com" rel="nofollow">mwlucas@michaelwlucas.com</a> / <a href="https://twitter.com/mwlauthor" rel="nofollow">@mwlauthor</a></h2>

<p><a href="https://www.tiltedwindmillpress.com/?product=freebsd-mastery-storage-essentials" rel="nofollow">FreeBSD Mastery: Storage Essentials</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://poolp.org/0xa86e/Some-OpenSMTPD-overview,-part-3" rel="nofollow">OpenSMTPD status update</a></h3>

<ul>
<li>The <a href="http://www.bsdnow.tv/episodes/2013-09-18_mx_with_ttx" rel="nofollow">OpenSMTPD guys</a>, particularly Gilles, have posted an update on what they&#39;ve been up to lately</li>
<li>As of 5.6, it&#39;s become the default MTA in OpenBSD, and sendmail will be totally gone in 5.7</li>
<li>Email is a much more tricky protocol than you might imagine, and the post goes through some of the weirdness and problems they&#39;ve had to deal with</li>
<li>There&#39;s also <a href="https://poolp.org/0xa871/The-state-of-filters" rel="nofollow">another post</a> that goes into detail on their upcoming filtering API - a feature <strong>many</strong> have requested</li>
<li>The API is still being developed, but you can test it out now if you know what you&#39;re doing - full details in the article</li>
<li>OpenSMTPD also has portable versions in FreeBSD ports and NetBSD pkgsrc, so check it out
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/svn-src-head/2014-December/065806.html" rel="nofollow">OpenCrypto changes in FreeBSD</a></h3>

<ul>
<li>A little while back, <a href="http://www.bsdnow.tv/episodes/2014_10_29-ipsecond_wind" rel="nofollow">we talked to John-Mark Gurney</a> about updating FreeBSD&#39;s OpenCrypto framework, specifically for IPSEC</li>
<li>Some of that work has just landed in the -CURRENT branch, and the commit has a bit of details</li>
<li>The ICM and GCM modes of AES were added, and both include support for AESNI</li>
<li>There&#39;s a new port - &quot;nist-kat&quot; - that can be used to test the new modes of operation</li>
<li>Some things were fixed in the process as well, including an issue that would leak timing info and result in the ability to forge messages</li>
<li>Code was also borrowed from both OpenBSD and NetBSD to make this possible
***</li>
</ul>

<h3><a href="http://www.protoc.org/blog/2014/11/23/first-thoughts-on-the-new-openbsd-httpd-server/" rel="nofollow">First thoughts on OpenBSD&#39;s httpd</a></h3>

<ul>
<li>Here we have a blog post from a user of OpenBSD&#39;s new homegrown web server that made its debut in 5.6</li>
<li>The author loves that it has proper privilege separation, a very simple config syntax and that it always runs in a chroot</li>
<li>He also mentions dynamic content hosting with FastCGI, and provides an example of how to set it up</li>
<li>Be sure to check <a href="http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time" rel="nofollow">our interview with Reyk</a> about the new httpd if you&#39;re curious on how it got started</li>
<li>Also, if you&#39;re running the version that came with 5.6, there&#39;s <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/009_httpd.patch.sig" rel="nofollow">a huge patch</a> you can apply to get a lot of the features and fixes from -current without waiting for 5.7
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=B04EuZ9hpAI" rel="nofollow">Steam on PCBSD</a></h3>

<ul>
<li>One of the most common questions people who want to use BSD as a desktop ask us is &quot;can I run games?&quot; or &quot;can I use steam?&quot;</li>
<li>Steam through the Linux emulation layer (in FreeBSD) may be possible soon, but it&#39;s already possible to use it with WINE</li>
<li>This video shows how to get Steam set up on PCBSD using the Windows version</li>
<li>There are also some instructions in the video description to look over</li>
<li>A <a href="https://www.youtube.com/watch?v=BJ88B8aWdk0" rel="nofollow">second video</a> details getting streaming set up
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2JgqXcw4i" rel="nofollow">Charlie writes in</a></li>
<li><a href="http://slexy.org/view/s2WormjMCs" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s20UmdFrbj" rel="nofollow">Predrag writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week, we&#39;ll be talking with Michael Lucas about his newest BSD book, &quot;FreeBSD Mastery: Storage Essentials.&quot; It&#39;s got lots of great information about the disk subsystems, GEOM, filesystems, you name it. We&#39;ve also got the usual round of news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.youtube.com/channel/UCLy8AikPZfWEmzWxUec69PA/videos" rel="nofollow">More BSD conference videos</a></h3>

<ul>
<li>We mentioned it a few times, but the &quot;New Directions in Operating Systems&quot; conference was held in November in the UK</li>
<li>The presentations videos are now online, with a few BSD-related talks of interest</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_10_23-a_brief_intorduction" rel="nofollow">Antti Kantee</a>, <a href="https://www.youtube.com/watch?v=GoB73cVyScI" rel="nofollow">Rump kernels and why / how we got here</a></li>
<li>Franco Fichtner, <a href="https://www.youtube.com/watch?v=WiMNuGTRgbA" rel="nofollow">An introduction to userland networking</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_08_13-vpn_my_dear_watson" rel="nofollow">Robert Watson</a>, <a href="https://www.youtube.com/watch?v=60elN996rtg" rel="nofollow">New ideas about old OS security</a></li>
<li>Lots of other interesting, but non-BSD-related, talks were also presented, so check the <a href="https://www.youtube.com/playlist?list=PLmRrx948XMnEUlzKOCYn3AzT8OAInP_5M" rel="nofollow">full list</a> if you&#39;re interested in operating systems in general</li>
<li>The 2014 AsiaBSDCon videos are also slowly being uploaded (better late than never)</li>
<li><a href="http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache" rel="nofollow">Kirk McKusick</a>, <a href="https://www.youtube.com/watch?v=E04LxKiu79I" rel="nofollow">An Overview of Security in the FreeBSD Kernel</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_05_14-bsdcanned_goods" rel="nofollow">Matthew Ahrens</a>, <a href="https://www.youtube.com/watch?v=8T9Rh-46jhI" rel="nofollow">OpenZFS ensures the continued excellence of ZFS</a></li>
<li>Eric Allman, <a href="https://www.youtube.com/watch?v=o2dmreSy76Q" rel="nofollow">Bambi Meets Godzilla: They Elope - Open Source Meets the Commercial World</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2013_12_25-the_gift_of_giving" rel="nofollow">Scott Long</a>, <a href="https://www.youtube.com/watch?v=4sZZN8Szh14" rel="nofollow">Modifying the FreeBSD kernel Netflix streaming servers</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_04_09-pxe_dust" rel="nofollow">Dru Lavigne</a>, <a href="https://www.youtube.com/watch?v=z5apZFFvx4k" rel="nofollow">ZFS for the Masses</a></li>
<li>Kris Moore, <a href="https://www.youtube.com/watch?v=w-0PlAVSg5U" rel="nofollow">Snapshots, Replication, and Boot Environments</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_05_07-lets_get_raid" rel="nofollow">David Chisnall</a>, <a href="https://www.youtube.com/watch?v=NLqDAclXMMU" rel="nofollow">The Future of LLVM in the FreeBSD Toolchain</a></li>
<li>Luba Tang, <a href="https://www.youtube.com/watch?v=fWgbBUPMsVw" rel="nofollow">Bold, fast optimizing linker for BSD</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_04_23-its_gonna_get_nasty" rel="nofollow">John Hixson</a>, <a href="https://www.youtube.com/watch?v=iwF82aep-l8" rel="nofollow">Introduction to FreeNAS development</a></li>
<li>Zbigniew Bodek, <a href="https://www.youtube.com/watch?v=2KLXcyLZ_RE" rel="nofollow">Transparent Superpages for FreeBSD on ARM</a></li>
<li>Michael Dexter, <a href="https://www.youtube.com/watch?v=rjNg1eQ7uAk" rel="nofollow">Visualizing Unix: Graphing bhyve, ZFS and PF with Graphite</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_01_15-bhyve_mind" rel="nofollow">Peter Grehan</a>, <a href="https://www.youtube.com/watch?v=wptkUxJSNMY" rel="nofollow">Nested Paging in Bhyve</a></li>
<li>Martin Matuška, <a href="https://www.youtube.com/watch?v=nb8jB5x0OX4" rel="nofollow">Deploying FreeBSD systems with Foreman and mfsBSD</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_04_16-certified_package_delivery" rel="nofollow">James Brown</a>, <a href="https://www.youtube.com/watch?v=6eKMLuzsTbY" rel="nofollow">Analysys of BSD Associate Exam Results</a></li>
<li>Mindaugas Rasiukevicius, <a href="https://www.youtube.com/watch?v=cgBh0iC9WhM" rel="nofollow">NPF - progress and perspective</a></li>
<li>Luigi Rizzo, <a href="https://www.youtube.com/watch?v=nW8iHgOL9y4" rel="nofollow">Netmap as a core networking technology</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">Michael W. Lucas</a>, <a href="https://www.youtube.com/watch?v=o0purspHg-o" rel="nofollow">Sudo: You&#39;re Doing it Wrong</a> (not from a BSD conference, but still good)</li>
<li>They should make for some great material to watch during the holidays
***</li>
</ul>

<h3><a href="http://networkfilter.blogspot.com/2014/12/security-openbsd-vs-freebsd.html" rel="nofollow">OpenBSD vs FreeBSD security features</a></h3>

<ul>
<li>From the author of both the OpenBSD and FreeBSD secure gateway articles we&#39;ve featured in the past comes a new entry about security</li>
<li>The article goes through a list of all the security features enabled (and disabled) by default in both FreeBSD and OpenBSD</li>
<li>It covers a wide range of topics, including: memory protection, randomization, encryption, privilege separation, Capsicum, securelevels, MAC, Jails and chroots, network stack hardening, firewall features and <strong>much more</strong></li>
<li>This is definitely one of the most in-depth and complete articles we&#39;ve seen in a while - the author seems to have done his homework</li>
<li>If you&#39;re looking to secure any sort of BSD box, this post has some very detailed explanations of different exploit mitigation techniques - be sure to read the whole thing</li>
<li>There are also <a href="http://daemonforums.org/showthread.php?s=16fd0771d929aff294b252924b414f2c&t=8823" rel="nofollow">some good comments</a> on DaemonForums <a href="https://lobste.rs/s/e3s9xr/security_openbsd_vs_freebsd" rel="nofollow">and lobste.rs</a> that you may want to read 
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2014/12/the-password-you-changed-it-right.html" rel="nofollow">The password? You changed it, right?</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2014_04_30-puffy_firewall" rel="nofollow">Peter Hansteen</a> has a new blog post up, detailing some weird SSH bruteforcing he&#39;s seen recently</li>
<li>He apparently reads his auth logs when he gets bored at an airport</li>
<li>This new bruteforcing attempt seems to be targetting D-Link devices, as evidenced by the three usernames the bots try to use</li>
<li>More than 700 IPs have tried to get into Peter&#39;s BSD boxes using these names in combination with weak passwords</li>
<li>Lots more details, including the lists of passwords and IPs, can be found in the full article</li>
<li>If you&#39;re <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">using a BSD router</a>, things like this can be easily prevented with PF or fail2ban (and you probably don&#39;t have a &quot;d-link&quot; user anyway)
***</li>
</ul>

<h3><a href="http://www.infoworld.com/article/2858288/unix/intro-to-freebsd-for-linux-users.html" rel="nofollow">Get started with FreeBSD, an intro for Linux users</a></h3>

<ul>
<li>Another new BSD article on a mainstream technology news site - seems we&#39;re getting popular</li>
<li>This article is written for Linux users who may be considering switching over to BSD and wondering what it&#39;s all about</li>
<li>It details installing FreeBSD 9.3 and getting a basic system setup, while touching on ports and packages, and explaining some terminology along the way</li>
<li>&quot;Among the legions of Linux users and admins, there seems to be a sort of passive curiosity about FreeBSD and other <em>BSDs. Like commuters on a packed train, they gaze out at a less crowded, vaguely mysterious train heading in a slightly different direction and wonder what traveling on that train might be like&quot;
*</em>*</li>
</ul>

<h2>Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com" rel="nofollow">mwlucas@michaelwlucas.com</a> / <a href="https://twitter.com/mwlauthor" rel="nofollow">@mwlauthor</a></h2>

<p><a href="https://www.tiltedwindmillpress.com/?product=freebsd-mastery-storage-essentials" rel="nofollow">FreeBSD Mastery: Storage Essentials</a></p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://poolp.org/0xa86e/Some-OpenSMTPD-overview,-part-3" rel="nofollow">OpenSMTPD status update</a></h3>

<ul>
<li>The <a href="http://www.bsdnow.tv/episodes/2013-09-18_mx_with_ttx" rel="nofollow">OpenSMTPD guys</a>, particularly Gilles, have posted an update on what they&#39;ve been up to lately</li>
<li>As of 5.6, it&#39;s become the default MTA in OpenBSD, and sendmail will be totally gone in 5.7</li>
<li>Email is a much more tricky protocol than you might imagine, and the post goes through some of the weirdness and problems they&#39;ve had to deal with</li>
<li>There&#39;s also <a href="https://poolp.org/0xa871/The-state-of-filters" rel="nofollow">another post</a> that goes into detail on their upcoming filtering API - a feature <strong>many</strong> have requested</li>
<li>The API is still being developed, but you can test it out now if you know what you&#39;re doing - full details in the article</li>
<li>OpenSMTPD also has portable versions in FreeBSD ports and NetBSD pkgsrc, so check it out
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/svn-src-head/2014-December/065806.html" rel="nofollow">OpenCrypto changes in FreeBSD</a></h3>

<ul>
<li>A little while back, <a href="http://www.bsdnow.tv/episodes/2014_10_29-ipsecond_wind" rel="nofollow">we talked to John-Mark Gurney</a> about updating FreeBSD&#39;s OpenCrypto framework, specifically for IPSEC</li>
<li>Some of that work has just landed in the -CURRENT branch, and the commit has a bit of details</li>
<li>The ICM and GCM modes of AES were added, and both include support for AESNI</li>
<li>There&#39;s a new port - &quot;nist-kat&quot; - that can be used to test the new modes of operation</li>
<li>Some things were fixed in the process as well, including an issue that would leak timing info and result in the ability to forge messages</li>
<li>Code was also borrowed from both OpenBSD and NetBSD to make this possible
***</li>
</ul>

<h3><a href="http://www.protoc.org/blog/2014/11/23/first-thoughts-on-the-new-openbsd-httpd-server/" rel="nofollow">First thoughts on OpenBSD&#39;s httpd</a></h3>

<ul>
<li>Here we have a blog post from a user of OpenBSD&#39;s new homegrown web server that made its debut in 5.6</li>
<li>The author loves that it has proper privilege separation, a very simple config syntax and that it always runs in a chroot</li>
<li>He also mentions dynamic content hosting with FastCGI, and provides an example of how to set it up</li>
<li>Be sure to check <a href="http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time" rel="nofollow">our interview with Reyk</a> about the new httpd if you&#39;re curious on how it got started</li>
<li>Also, if you&#39;re running the version that came with 5.6, there&#39;s <a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/009_httpd.patch.sig" rel="nofollow">a huge patch</a> you can apply to get a lot of the features and fixes from -current without waiting for 5.7
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=B04EuZ9hpAI" rel="nofollow">Steam on PCBSD</a></h3>

<ul>
<li>One of the most common questions people who want to use BSD as a desktop ask us is &quot;can I run games?&quot; or &quot;can I use steam?&quot;</li>
<li>Steam through the Linux emulation layer (in FreeBSD) may be possible soon, but it&#39;s already possible to use it with WINE</li>
<li>This video shows how to get Steam set up on PCBSD using the Windows version</li>
<li>There are also some instructions in the video description to look over</li>
<li>A <a href="https://www.youtube.com/watch?v=BJ88B8aWdk0" rel="nofollow">second video</a> details getting streaming set up
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2JgqXcw4i" rel="nofollow">Charlie writes in</a></li>
<li><a href="http://slexy.org/view/s2WormjMCs" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s20UmdFrbj" rel="nofollow">Predrag writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>67: Must Be Rigged</title>
  <link>https://www.bsdnow.tv/67</link>
  <guid isPermaLink="false">5e135afe-0a75-46d6-b995-ae5d3ca228ba</guid>
  <pubDate>Wed, 10 Dec 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5e135afe-0a75-46d6-b995-ae5d3ca228ba.mp3" length="58310356" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week on the show, we've got an interview with Patrick Wildt, one of the developers of Bitrig. We'll find out all the details of their OpenBSD fork, what makes it different and what their plans are going forward. We've also got all the week's news and answers to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:20:59</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week on the show, we've got an interview with Patrick Wildt, one of the developers of Bitrig. We'll find out all the details of their OpenBSD fork, what makes it different and what their plans are going forward. We've also got all the week's news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
Bitrig 1.0 released (http://article.gmane.org/gmane.os.bitrig.devel/6)
If you haven't heard of it, Bitrig (https://www.bitrig.org/) is a fork of OpenBSD that started a couple years ago
According to their FAQ (https://github.com/bitrig/bitrig/wiki/Faq), some of their goals include: only supporting modern hardware and a limited set of CPU architectures, replacing nearly all GNU tools in base with BSD versions and having better virtualization support
They've finally announced their first official release, 1.0
This release introduces support for Clang 3.4, replacing the old GCC, along with libc++ replacing the GNU version
It also includes filesystem journaling, support for GPT and - most importantly - a hacker-style console with green text on black background
One of the developers answered some questions (https://news.ycombinator.com/item?id=8701936) about it on Hacker News too
***
Is it time to try BSD? (http://www.technewsworld.com/story/81424.html)
Here we get a little peek into the Linux world - more and more people are considering switching
On a more mainstream tech news site, they have an article about people switching away from Linux and to BSD
People are starting to get even more suspicious of systemd, and lots of drama in the Linux world is leading a whole new group of potential users over to the BSD side
This article explores some pros and cons of switching, and features opinions of various users
***
Poudriere 3.1 released (https://github.com/freebsd/poudriere/wiki/release_notes_31)
One of the first things we ever covered on the show was poudriere (http://www.bsdnow.tv/tutorials/poudriere), a tool with a funny name that's used to build binary packages from FreeBSD ports
It's come a long way since then, and bdrewery (http://www.bsdnow.tv/episodes/2014_07_16-network_iodometry) and bapt (http://www.bsdnow.tv/episodes/2014_01_01-eclipsing_binaries) have just announced a new major version
This new release features a redesigned web interface to check on the status of your packages
There are lots of new bulk building options to preserve packages even if some fail to compile - this makes maintaining a production repo much easier
It also introduces a useful new "pkgclean" subcommand to clean out your repository of packages that aren't needed anymore, and poudriere keeps it cleaner by default as well now
Check the full release notes for all the additions and bug fixes
***
Firewalling with OpenBSD's pf and pfsync (https://www.youtube.com/watch?v=mN5E2EYJnrw)
A talk by David Gwynne from an Australian conference was uploaded, with the subject matter being pf and pfsync
He uses pf to manage 60 internal networks with a single firewall
The talk gives some background on how pf originally came to be and some OpenBSD 101 for the uninitiated
It also touches on different rulesets, use cases, configuration syntax, placing limits on connections, ospf, authpf, segregating VLANs, synproxy handling and a lot more
The second half of the presentation focuses on pfsync and carp for failover and redundancy
With two BSD boxes running pfsync, you can actually patch your kernel and still stay connected to IRC
***
Interview - Patrick Wildt - patrick@bitrig.org (mailto:patrick@bitrig.org) / @bitrig (https://twitter.com/bitrig)
The initial release of Bitrig
News Roundup
Infrastructural enhancements at NYI (http://freebsdfoundation.blogspot.com/2014/12/the-freebsd-cluster-infrastructural.html)
The FreeBSD foundation put up a new blog post detailing some hardware improvements they've recently done
Their eastern US colocation is hosted at New York Internet, and is used for FTP mirrors, pkgng mirrors, and also as a place for developers to test things
There've been fourteen machines purchased since July, and now FreeBSD boasts a total of sixty-eight physical boxes there
This blog post goes into detail about how those servers are used and details some of the network topology
***
The long tail of MD5 (http://www.tedunangst.com/flak/post/the-long-tail-of-MD5)
Our friend Ted Unangst is on a quest to replace all instances of MD5 in OpenBSD's tree with something more modern
In this blog post, he goes through some of the different areas where MD5 still lives, and discovers how easy (or impossible) it would be to replace
Through some recent commits, OpenBSD now uses SHA512 in some places that you might not expect
Some other places (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141763065223567&amp;amp;w=4) require a bit more care… 
***
DragonFly cheat sheet (http://www.dragonflybsd.org/varialus/)
If you've been thinking of trying out DragonFlyBSD lately, this might make the transition a bit easier
A user-created "cheat sheet" on the website lists some common answers to beginner questions
The page features a walkthrough of the installer, some shell tips and workarounds for various issues
At the end, it also has some things that new users can get involved with to help out
***
Experiences with an OpenBSD laptop (http://alxjsn.com/unix/openbsd-laptop/)
A lot of people seem to be interested in trying out some form of BSD on their laptop, and this article details just that
The author got interested in OpenBSD mostly because of the security focus and the fact that it's not Linux
In this blog post, he goes through the steps of researching, installing, configuring, upgrading and finally actually using it on his Thinkpad
He even gives us a mention as a good place to learn more about BSD, thanks!
***
PC-BSD Updates (http://lists.pcbsd.org/pipermail/testing/2014-December/009638.html)
A call for testing of a new update system has gone out
Conversion to Qt5 for utils has taken place
***
Feedback/Questions
Chris writes in (http://slexy.org/view/s2ihSmjpLu)
AJ writes in (http://slexy.org/view/s20JXhXS6o)
Dan writes in (http://slexy.org/view/s21hfeWB2K)
Jeff writes in (http://slexy.org/view/s2k6SmuDGB)
***
Mailing List Gold
Over 440% faster (https://www.marc.info/?l=openbsd-tech&amp;amp;m=141775233603723&amp;amp;w=2)
The (https://lists.freebsd.org/pipermail/freebsd-pf/2014-December/007528.html) PF (https://lists.freebsd.org/pipermail/freebsd-pf/2014-December/007529.html) conundrum (https://lists.freebsd.org/pipermail/freebsd-pf/2014-December/007543.html) (edit: Allan misspoke about PF performance during this segment, apologies.)
Violating (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141807513728073&amp;amp;w=4) bad standards (https://www.marc.info/?l=openbsd-tech&amp;amp;m=141807224826859&amp;amp;w=2)
apt-get rid of systemd (https://www.marc.info/?l=openbsd-misc&amp;amp;m=141798194330985&amp;amp;w=2)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, bitrig, fork, clang, llvm, virtualization, poudriere, srand, random, md5, sha512, rand, srand, systemd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week on the show, we&#39;ve got an interview with Patrick Wildt, one of the developers of Bitrig. We&#39;ll find out all the details of their OpenBSD fork, what makes it different and what their plans are going forward. We&#39;ve also got all the week&#39;s news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://article.gmane.org/gmane.os.bitrig.devel/6" rel="nofollow">Bitrig 1.0 released</a></h3>

<ul>
<li>If you haven&#39;t heard of it, <a href="https://www.bitrig.org/" rel="nofollow">Bitrig</a> is a fork of OpenBSD that started a couple years ago</li>
<li>According to <a href="https://github.com/bitrig/bitrig/wiki/Faq" rel="nofollow">their FAQ</a>, some of their goals include: only supporting modern hardware and a limited set of CPU architectures, replacing nearly all GNU tools in base with BSD versions and having better virtualization support</li>
<li>They&#39;ve finally announced their first official release, 1.0</li>
<li>This release introduces support for Clang 3.4, replacing the old GCC, along with libc++ replacing the GNU version</li>
<li>It also includes filesystem journaling, support for GPT and - most importantly - a hacker-style console with green text on black background</li>
<li>One of the developers <a href="https://news.ycombinator.com/item?id=8701936" rel="nofollow">answered some questions</a> about it on Hacker News too
***</li>
</ul>

<h3><a href="http://www.technewsworld.com/story/81424.html" rel="nofollow">Is it time to try BSD?</a></h3>

<ul>
<li>Here we get a little peek into the Linux world - more and more people are considering switching</li>
<li>On a more mainstream tech news site, they have an article about people switching away from Linux and to BSD</li>
<li>People are starting to get even more suspicious of systemd, and lots of drama in the Linux world is leading a whole new group of potential users over to the BSD side</li>
<li>This article explores some pros and cons of switching, and features opinions of various users
***</li>
</ul>

<h3><a href="https://github.com/freebsd/poudriere/wiki/release_notes_31" rel="nofollow">Poudriere 3.1 released</a></h3>

<ul>
<li>One of the first things we ever covered on the show was <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere</a>, a tool with a funny name that&#39;s used to build binary packages from FreeBSD ports</li>
<li>It&#39;s come a long way since then, and <a href="http://www.bsdnow.tv/episodes/2014_07_16-network_iodometry" rel="nofollow">bdrewery</a> and <a href="http://www.bsdnow.tv/episodes/2014_01_01-eclipsing_binaries" rel="nofollow">bapt</a> have just announced a new major version</li>
<li>This new release features a redesigned web interface to check on the status of your packages</li>
<li>There are lots of new bulk building options to preserve packages even if some fail to compile - this makes maintaining a production repo much easier</li>
<li>It also introduces a useful new &quot;pkgclean&quot; subcommand to clean out your repository of packages that aren&#39;t needed anymore, and poudriere keeps it cleaner by default as well now</li>
<li>Check the full release notes for all the additions and bug fixes
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=mN5E2EYJnrw" rel="nofollow">Firewalling with OpenBSD&#39;s pf and pfsync</a></h3>

<ul>
<li>A talk by David Gwynne from an Australian conference was uploaded, with the subject matter being pf and pfsync</li>
<li>He uses pf to manage 60 internal networks with a single firewall</li>
<li>The talk gives some background on how pf originally came to be and some OpenBSD 101 for the uninitiated</li>
<li>It also touches on different rulesets, use cases, configuration syntax, placing limits on connections, ospf, authpf, segregating VLANs, synproxy handling and a lot more</li>
<li>The second half of the presentation focuses on pfsync and carp for failover and redundancy</li>
<li>With two BSD boxes running pfsync, you can actually <em>patch your kernel and still stay connected to IRC</em>
***</li>
</ul>

<h2>Interview - Patrick Wildt - <a href="mailto:patrick@bitrig.org" rel="nofollow">patrick@bitrig.org</a> / <a href="https://twitter.com/bitrig" rel="nofollow">@bitrig</a></h2>

<p>The initial release of Bitrig</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/12/the-freebsd-cluster-infrastructural.html" rel="nofollow">Infrastructural enhancements at NYI</a></h3>

<ul>
<li>The FreeBSD foundation put up a new blog post detailing some hardware improvements they&#39;ve recently done</li>
<li>Their eastern US colocation is hosted at New York Internet, and is used for FTP mirrors, pkgng mirrors, and also as a place for developers to test things</li>
<li>There&#39;ve been fourteen machines purchased since July, and now FreeBSD boasts a total of sixty-eight physical boxes there</li>
<li>This blog post goes into detail about how those servers are used and details some of the network topology
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/the-long-tail-of-MD5" rel="nofollow">The long tail of MD5</a></h3>

<ul>
<li>Our friend Ted Unangst is on a quest to replace all instances of MD5 in OpenBSD&#39;s tree with something more modern</li>
<li>In this blog post, he goes through some of the different areas where MD5 still lives, and discovers how easy (or impossible) it would be to replace</li>
<li>Through some recent commits, OpenBSD now uses SHA512 in some places that you might not expect</li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=141763065223567&w=4" rel="nofollow">Some other places</a> require a bit more care… 
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/varialus/" rel="nofollow">DragonFly cheat sheet</a></h3>

<ul>
<li>If you&#39;ve been thinking of trying out DragonFlyBSD lately, this might make the transition a bit easier</li>
<li>A user-created &quot;cheat sheet&quot; on the website lists some common answers to beginner questions</li>
<li>The page features a walkthrough of the installer, some shell tips and workarounds for various issues</li>
<li>At the end, it also has some things that new users can get involved with to help out
***</li>
</ul>

<h3><a href="http://alxjsn.com/unix/openbsd-laptop/" rel="nofollow">Experiences with an OpenBSD laptop</a></h3>

<ul>
<li>A lot of people seem to be interested in trying out some form of BSD on their laptop, and this article details just that</li>
<li>The author got interested in OpenBSD mostly because of the security focus and the fact that it&#39;s <em>not</em> Linux</li>
<li>In this blog post, he goes through the steps of researching, installing, configuring, upgrading and finally actually using it on his Thinkpad</li>
<li>He even gives us a mention as a good place to learn more about BSD, thanks!
***</li>
</ul>

<h3><a href="http://lists.pcbsd.org/pipermail/testing/2014-December/009638.html" rel="nofollow">PC-BSD Updates</a></h3>

<ul>
<li>A call for testing of a new update system has gone out</li>
<li>Conversion to Qt5 for utils has taken place
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2ihSmjpLu" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s20JXhXS6o" rel="nofollow">AJ writes in</a></li>
<li><a href="http://slexy.org/view/s21hfeWB2K" rel="nofollow">Dan writes in</a></li>
<li><a href="http://slexy.org/view/s2k6SmuDGB" rel="nofollow">Jeff writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-tech&m=141775233603723&w=2" rel="nofollow">Over 440% faster</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-pf/2014-December/007528.html" rel="nofollow">The</a> <a href="https://lists.freebsd.org/pipermail/freebsd-pf/2014-December/007529.html" rel="nofollow">PF</a> <a href="https://lists.freebsd.org/pipermail/freebsd-pf/2014-December/007543.html" rel="nofollow">conundrum</a> (<strong>edit:</strong> Allan misspoke about PF performance during this segment, apologies.)</li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=141807513728073&w=4" rel="nofollow">Violating</a> <a href="https://www.marc.info/?l=openbsd-tech&m=141807224826859&w=2" rel="nofollow">bad standards</a></li>
<li><a href="https://www.marc.info/?l=openbsd-misc&m=141798194330985&w=2" rel="nofollow">apt-get rid of systemd</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week on the show, we&#39;ve got an interview with Patrick Wildt, one of the developers of Bitrig. We&#39;ll find out all the details of their OpenBSD fork, what makes it different and what their plans are going forward. We&#39;ve also got all the week&#39;s news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://article.gmane.org/gmane.os.bitrig.devel/6" rel="nofollow">Bitrig 1.0 released</a></h3>

<ul>
<li>If you haven&#39;t heard of it, <a href="https://www.bitrig.org/" rel="nofollow">Bitrig</a> is a fork of OpenBSD that started a couple years ago</li>
<li>According to <a href="https://github.com/bitrig/bitrig/wiki/Faq" rel="nofollow">their FAQ</a>, some of their goals include: only supporting modern hardware and a limited set of CPU architectures, replacing nearly all GNU tools in base with BSD versions and having better virtualization support</li>
<li>They&#39;ve finally announced their first official release, 1.0</li>
<li>This release introduces support for Clang 3.4, replacing the old GCC, along with libc++ replacing the GNU version</li>
<li>It also includes filesystem journaling, support for GPT and - most importantly - a hacker-style console with green text on black background</li>
<li>One of the developers <a href="https://news.ycombinator.com/item?id=8701936" rel="nofollow">answered some questions</a> about it on Hacker News too
***</li>
</ul>

<h3><a href="http://www.technewsworld.com/story/81424.html" rel="nofollow">Is it time to try BSD?</a></h3>

<ul>
<li>Here we get a little peek into the Linux world - more and more people are considering switching</li>
<li>On a more mainstream tech news site, they have an article about people switching away from Linux and to BSD</li>
<li>People are starting to get even more suspicious of systemd, and lots of drama in the Linux world is leading a whole new group of potential users over to the BSD side</li>
<li>This article explores some pros and cons of switching, and features opinions of various users
***</li>
</ul>

<h3><a href="https://github.com/freebsd/poudriere/wiki/release_notes_31" rel="nofollow">Poudriere 3.1 released</a></h3>

<ul>
<li>One of the first things we ever covered on the show was <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere</a>, a tool with a funny name that&#39;s used to build binary packages from FreeBSD ports</li>
<li>It&#39;s come a long way since then, and <a href="http://www.bsdnow.tv/episodes/2014_07_16-network_iodometry" rel="nofollow">bdrewery</a> and <a href="http://www.bsdnow.tv/episodes/2014_01_01-eclipsing_binaries" rel="nofollow">bapt</a> have just announced a new major version</li>
<li>This new release features a redesigned web interface to check on the status of your packages</li>
<li>There are lots of new bulk building options to preserve packages even if some fail to compile - this makes maintaining a production repo much easier</li>
<li>It also introduces a useful new &quot;pkgclean&quot; subcommand to clean out your repository of packages that aren&#39;t needed anymore, and poudriere keeps it cleaner by default as well now</li>
<li>Check the full release notes for all the additions and bug fixes
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=mN5E2EYJnrw" rel="nofollow">Firewalling with OpenBSD&#39;s pf and pfsync</a></h3>

<ul>
<li>A talk by David Gwynne from an Australian conference was uploaded, with the subject matter being pf and pfsync</li>
<li>He uses pf to manage 60 internal networks with a single firewall</li>
<li>The talk gives some background on how pf originally came to be and some OpenBSD 101 for the uninitiated</li>
<li>It also touches on different rulesets, use cases, configuration syntax, placing limits on connections, ospf, authpf, segregating VLANs, synproxy handling and a lot more</li>
<li>The second half of the presentation focuses on pfsync and carp for failover and redundancy</li>
<li>With two BSD boxes running pfsync, you can actually <em>patch your kernel and still stay connected to IRC</em>
***</li>
</ul>

<h2>Interview - Patrick Wildt - <a href="mailto:patrick@bitrig.org" rel="nofollow">patrick@bitrig.org</a> / <a href="https://twitter.com/bitrig" rel="nofollow">@bitrig</a></h2>

<p>The initial release of Bitrig</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/12/the-freebsd-cluster-infrastructural.html" rel="nofollow">Infrastructural enhancements at NYI</a></h3>

<ul>
<li>The FreeBSD foundation put up a new blog post detailing some hardware improvements they&#39;ve recently done</li>
<li>Their eastern US colocation is hosted at New York Internet, and is used for FTP mirrors, pkgng mirrors, and also as a place for developers to test things</li>
<li>There&#39;ve been fourteen machines purchased since July, and now FreeBSD boasts a total of sixty-eight physical boxes there</li>
<li>This blog post goes into detail about how those servers are used and details some of the network topology
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/the-long-tail-of-MD5" rel="nofollow">The long tail of MD5</a></h3>

<ul>
<li>Our friend Ted Unangst is on a quest to replace all instances of MD5 in OpenBSD&#39;s tree with something more modern</li>
<li>In this blog post, he goes through some of the different areas where MD5 still lives, and discovers how easy (or impossible) it would be to replace</li>
<li>Through some recent commits, OpenBSD now uses SHA512 in some places that you might not expect</li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=141763065223567&w=4" rel="nofollow">Some other places</a> require a bit more care… 
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/varialus/" rel="nofollow">DragonFly cheat sheet</a></h3>

<ul>
<li>If you&#39;ve been thinking of trying out DragonFlyBSD lately, this might make the transition a bit easier</li>
<li>A user-created &quot;cheat sheet&quot; on the website lists some common answers to beginner questions</li>
<li>The page features a walkthrough of the installer, some shell tips and workarounds for various issues</li>
<li>At the end, it also has some things that new users can get involved with to help out
***</li>
</ul>

<h3><a href="http://alxjsn.com/unix/openbsd-laptop/" rel="nofollow">Experiences with an OpenBSD laptop</a></h3>

<ul>
<li>A lot of people seem to be interested in trying out some form of BSD on their laptop, and this article details just that</li>
<li>The author got interested in OpenBSD mostly because of the security focus and the fact that it&#39;s <em>not</em> Linux</li>
<li>In this blog post, he goes through the steps of researching, installing, configuring, upgrading and finally actually using it on his Thinkpad</li>
<li>He even gives us a mention as a good place to learn more about BSD, thanks!
***</li>
</ul>

<h3><a href="http://lists.pcbsd.org/pipermail/testing/2014-December/009638.html" rel="nofollow">PC-BSD Updates</a></h3>

<ul>
<li>A call for testing of a new update system has gone out</li>
<li>Conversion to Qt5 for utils has taken place
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2ihSmjpLu" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s20JXhXS6o" rel="nofollow">AJ writes in</a></li>
<li><a href="http://slexy.org/view/s21hfeWB2K" rel="nofollow">Dan writes in</a></li>
<li><a href="http://slexy.org/view/s2k6SmuDGB" rel="nofollow">Jeff writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-tech&m=141775233603723&w=2" rel="nofollow">Over 440% faster</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-pf/2014-December/007528.html" rel="nofollow">The</a> <a href="https://lists.freebsd.org/pipermail/freebsd-pf/2014-December/007529.html" rel="nofollow">PF</a> <a href="https://lists.freebsd.org/pipermail/freebsd-pf/2014-December/007543.html" rel="nofollow">conundrum</a> (<strong>edit:</strong> Allan misspoke about PF performance during this segment, apologies.)</li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=141807513728073&w=4" rel="nofollow">Violating</a> <a href="https://www.marc.info/?l=openbsd-tech&m=141807224826859&w=2" rel="nofollow">bad standards</a></li>
<li><a href="https://www.marc.info/?l=openbsd-misc&m=141798194330985&w=2" rel="nofollow">apt-get rid of systemd</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>66: Conference Connoisseur</title>
  <link>https://www.bsdnow.tv/66</link>
  <guid isPermaLink="false">e76cf015-25d3-4a75-89c3-629d1f6d9a87</guid>
  <pubDate>Wed, 03 Dec 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e76cf015-25d3-4a75-89c3-629d1f6d9a87.mp3" length="59426068" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we'll be talking with Paul Schenkeveld, chairman of the EuroBSDCon foundation. He tells us about his experiences running BSD conferences and how regular users can get involved too. We've also got answers to all your emails and the latest news, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:22:32</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we'll be talking with Paul Schenkeveld, chairman of the EuroBSDCon foundation. He tells us about his experiences running BSD conferences and how regular users can get involved too. We've also got answers to all your emails and the latest news, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
More BSD presentation videos (https://www.meetbsd.com/)
The MeetBSD video uploading spree continues with a few more talks, maybe this'll be the last batch
Corey Vixie, Web Apps in Embedded BSD (https://www.youtube.com/watch?v=Pbks12Mqpp8)
Allan Jude, UCL config (https://www.youtube.com/watch?v=TjP86iWsEzQ)
Kip Macy, iflib (https://www.youtube.com/watch?v=P4FRPKj7F80)
While we're on the topic of conferences, AsiaBSDCon's CFP was extended (https://twitter.com/asiabsdcon/status/538352055245492226) by one week
This year's ruBSD (https://events.yandex.ru/events/yagosti/rubsd14/) will be on December 13th in Moscow
Also, the BSDCan call for papers (http://lists.bsdcan.org/pipermail/bsdcan-announce/2014-December/000135.html) is out, and the event will be in June next year
Lastly, according to Rick Miller, "A potential vBSDcon 2015 event is being explored though a decision has yet to be made."
***
BSD-powered digital library in Africa (http://peercorpsglobal.org/nzegas-digital-library-becomes-a-reality/)
You probably haven't heard much about Nzega, Tanzania, but it's an East African country without much internet access
With physical schoolbooks being a rarity there, a few companies helped out to bring some BSD-powered reading material to a local school
They now have a pair of FreeNAS Minis at the center of their local network, with over 80,000 books and accompanying video content stored on them (~5TB of data currently)
The school's workstations also got wiped and reloaded with FreeBSD, and everyone there seems to really enjoy using it
***
pfSense 2.2 status update (https://blog.pfsense.org/?p=1486)
With lots of people asking when the 2.2 release will be done, some pfSense developers decided to provide a status update
2.2 will have a lot of changes: being based on FreeBSD 10.1, Unbound instead of BIND, updating PHP to something recent, including the new(ish) IPSEC stack updates, etc
All these things have taken more time than previously expected
The post also has some interesting graphs showing the ratio of opened and close bugs for the upcoming release
***
Recommended hardware threads (https://www.reddit.com/r/BSD/comments/2n8wrg/bsd_on_mini_itx/)
A few threads on caught our attention this week, all about hardware recommendations for BSD setups
In the first one, the OP asks about mini-ITX hardware to run a FreeBSD server and NAS
Everyone gave some good recommendations for low power, Atom-based systems
The second thread (https://www.marc.info/?t=141694918800006&amp;amp;r=1&amp;amp;w=2) started off asking about which CPU architecture is best for PF on an OpenBSD router, but ended up being another hardware thread
For a router, the ALIX, APU and Soekris boards still seem to be the most popular choices, with the third (https://www.reddit.com/r/homelab/comments/24m6tj/) and fourth (https://www.reddit.com/r/PFSENSE/comments/2nblgp/) threads confirming this
If you're thinking about building your first BSD box - server, router, NAS, whatever - these might be some good links to read
***
Interview - Paul Schenkeveld - freebsd@psconsult.nl (mailto:freebsd@psconsult.nl)
Running a BSD conference
News Roundup
From Linux to FreeBSD - for reals (https://www.reddit.com/r/freebsd/comments/2nqa60/)
Another Linux user is ready to switch to BSD, and takes to Reddit for some community encouragement (seems to be a common thing now)
After being a Linux guy for 20(!) years, he's ready to switch his systems over, and is looking for some helpful guides to transition
In the comments, a lot of new switchers offer some advice and reading material
If any of the listeners have some things that were helpful along your switching journey, maybe send 'em this guy's way
***
Running FreeBSD as a Xen Dom0 (http://wiki.xenproject.org/wiki/FreeBSD_Dom0)
Continuing progress has been made to allow FreeBSD to be a host for the Xen hypervisor
This wiki article explains how to run the Xen branch of FreeBSD and host virtual machines on it
Xen on FreeBSD currently supports PV guests (modified kernels) and HVM (unmodified kernels, uses hardware virtualization features)
The wiki provides instructions for running Debian (PV) and FreeBSD (HVM), and discusses the features that are not finished yet
***
HardenedBSD updates and changes (http://hardenedbsd.org/article/shawn-webb/2014-11-18/aout-and-null-mapping-support-removal)
a.out is the old executable format for Unix
The name stands for assembler output, and was coined by Ken Thompson as the fixed name for output of his PDP-7 assembler in 1968
FreeBSD, on which HardenedBSD is based, switched away from a.out in version 3.0
A restriction against NULL mapping was introduced in FreeBSD 7 (https://www.freebsd.org/security/advisories/FreeBSD-EN-09:05.null.asc) and enabled by default in FreeBSD 8
However, for reasons of compatibility, it could be switched off, allowing buggy applications to continue to run, at the risk of allowing a kernel bug to be exploited
HardenedBSD has removed the sysctl, making it impossible to run in ‘insecure mode’
Package building update: more consistent repo, no more i386 packages  (http://hardenedbsd.org/article/shawn-webb/2014-11-30/package-building-infrastructure-maintenance)
***
Feedback/Questions
Boris writes in (http://slexy.org/view/s2kVPKICqj)
Alex writes in (http://slexy.org/view/s21Fic4dZC) (&lt;b&gt;edit:&lt;/b&gt; adding "tinker panic 0" to the ntp.conf will disable the sanity check)
Chris writes in (http://slexy.org/view/s2zk1Tvfe9)
Robert writes in (http://slexy.org/view/s22alvJ4mu)
Jake writes in (http://slexy.org/view/s203YMc2zL)
***
Mailing List Gold
Real world authpf use (https://www.marc.info/?t=141711266800001&amp;amp;r=1&amp;amp;w=2)
The (https://svnweb.freebsd.org/ports/head/UPDATING?r1=373564&amp;amp;r2=373563&amp;amp;pathrev=373564) great (https://lists.freebsd.org/pipermail/freebsd-ports/2014-November/096788.html) perl (https://lists.freebsd.org/pipermail/freebsd-ports/2014-November/096799.html) event (https://lists.freebsd.org/pipermail/freebsd-perl/2014-November/010146.html) of (https://lists.freebsd.org/pipermail/freebsd-perl/2014-November/010149.html) 2014 (https://lists.freebsd.org/pipermail/freebsd-perl/2014-November/010167.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, eurobsdcon, meetbsd, bsdcan, asiabsdcon, conference, community, organization, foundation, pfsense, soekris, router, alix, apu, netgate, pcengines</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we&#39;ll be talking with Paul Schenkeveld, chairman of the EuroBSDCon foundation. He tells us about his experiences running BSD conferences and how regular users can get involved too. We&#39;ve also got answers to all your emails and the latest news, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.meetbsd.com/" rel="nofollow">More BSD presentation videos</a></h3>

<ul>
<li>The MeetBSD video uploading spree continues with a few more talks, maybe this&#39;ll be the last batch</li>
<li>Corey Vixie, <a href="https://www.youtube.com/watch?v=Pbks12Mqpp8" rel="nofollow">Web Apps in Embedded BSD</a></li>
<li>Allan Jude, <a href="https://www.youtube.com/watch?v=TjP86iWsEzQ" rel="nofollow">UCL config</a></li>
<li>Kip Macy, <a href="https://www.youtube.com/watch?v=P4FRPKj7F80" rel="nofollow">iflib</a></li>
<li>While we&#39;re on the topic of conferences, AsiaBSDCon&#39;s CFP was <a href="https://twitter.com/asiabsdcon/status/538352055245492226" rel="nofollow">extended</a> by one week</li>
<li>This year&#39;s <a href="https://events.yandex.ru/events/yagosti/rubsd14/" rel="nofollow">ruBSD</a> will be on December 13th in Moscow</li>
<li>Also, the <a href="http://lists.bsdcan.org/pipermail/bsdcan-announce/2014-December/000135.html" rel="nofollow">BSDCan call for papers</a> is out, and the event will be in June next year</li>
<li>Lastly, according to Rick Miller, &quot;A potential vBSDcon 2015 event is being explored though a decision has yet to be made.&quot;
***</li>
</ul>

<h3><a href="http://peercorpsglobal.org/nzegas-digital-library-becomes-a-reality/" rel="nofollow">BSD-powered digital library in Africa</a></h3>

<ul>
<li>You probably haven&#39;t heard much about Nzega, Tanzania, but it&#39;s an East African country without much internet access</li>
<li>With physical schoolbooks being a rarity there, a few companies helped out to bring some BSD-powered reading material to a local school</li>
<li>They now have a pair of FreeNAS Minis at the center of their local network, with over 80,000 books and accompanying video content stored on them (~5TB of data currently)</li>
<li>The school&#39;s workstations also got wiped and reloaded with FreeBSD, and everyone there seems to really enjoy using it
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=1486" rel="nofollow">pfSense 2.2 status update</a></h3>

<ul>
<li>With lots of people asking when the 2.2 release will be done, some pfSense developers decided to provide a status update</li>
<li>2.2 will have a lot of changes: being based on FreeBSD 10.1, Unbound instead of BIND, updating PHP to something recent, including the new(ish) IPSEC stack updates, etc</li>
<li>All these things have taken more time than previously expected</li>
<li>The post also has some interesting graphs showing the ratio of opened and close bugs for the upcoming release
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/BSD/comments/2n8wrg/bsd_on_mini_itx/" rel="nofollow">Recommended hardware threads</a></h3>

<ul>
<li>A few threads on caught our attention this week, all about hardware recommendations for BSD setups</li>
<li>In the first one, the OP asks about mini-ITX hardware to run a FreeBSD server and NAS</li>
<li>Everyone gave some good recommendations for low power, Atom-based systems</li>
<li>The <a href="https://www.marc.info/?t=141694918800006&r=1&w=2" rel="nofollow">second thread</a> started off asking about which CPU architecture is best for PF on an OpenBSD router, but ended up being another hardware thread</li>
<li>For a router, the ALIX, APU and Soekris boards still seem to be the most popular choices, with the <a href="https://www.reddit.com/r/homelab/comments/24m6tj/" rel="nofollow">third</a> and <a href="https://www.reddit.com/r/PFSENSE/comments/2nblgp/" rel="nofollow">fourth</a> threads confirming this</li>
<li>If you&#39;re thinking about building your first BSD box - server, router, NAS, whatever - these might be some good links to read
***</li>
</ul>

<h2>Interview - Paul Schenkeveld - <a href="mailto:freebsd@psconsult.nl" rel="nofollow">freebsd@psconsult.nl</a></h2>

<p>Running a BSD conference</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.reddit.com/r/freebsd/comments/2nqa60/" rel="nofollow">From Linux to FreeBSD - for reals</a></h3>

<ul>
<li>Another Linux user is ready to switch to BSD, and takes to Reddit for some community encouragement (seems to be a common thing now)</li>
<li>After being a Linux guy for 20(!) years, he&#39;s ready to switch his systems over, and is looking for some helpful guides to transition</li>
<li>In the comments, a lot of new switchers offer some advice and reading material</li>
<li>If any of the listeners have some things that were helpful along your switching journey, maybe send &#39;em this guy&#39;s way
***</li>
</ul>

<h3><a href="http://wiki.xenproject.org/wiki/FreeBSD_Dom0" rel="nofollow">Running FreeBSD as a Xen Dom0</a></h3>

<ul>
<li>Continuing progress has been made to allow FreeBSD to be a host for the Xen hypervisor</li>
<li>This wiki article explains how to run the Xen branch of FreeBSD and host virtual machines on it</li>
<li>Xen on FreeBSD currently supports PV guests (modified kernels) and HVM (unmodified kernels, uses hardware virtualization features)</li>
<li>The wiki provides instructions for running Debian (PV) and FreeBSD (HVM), and discusses the features that are not finished yet
***</li>
</ul>

<h3><a href="http://hardenedbsd.org/article/shawn-webb/2014-11-18/aout-and-null-mapping-support-removal" rel="nofollow">HardenedBSD updates and changes</a></h3>

<ul>
<li>a.out is the old executable format for Unix</li>
<li>The name stands for assembler output, and was coined by Ken Thompson as the fixed name for output of his PDP-7 assembler in 1968</li>
<li>FreeBSD, on which HardenedBSD is based, switched away from a.out in version 3.0</li>
<li>A restriction against NULL mapping was introduced in <a href="https://www.freebsd.org/security/advisories/FreeBSD-EN-09:05.null.asc" rel="nofollow">FreeBSD 7</a> and enabled by default in FreeBSD 8</li>
<li>However, for reasons of compatibility, it could be switched off, allowing buggy applications to continue to run, at the risk of allowing a kernel bug to be exploited</li>
<li>HardenedBSD has removed the sysctl, making it impossible to run in ‘insecure mode’</li>
<li>Package building update: <a href="http://hardenedbsd.org/article/shawn-webb/2014-11-30/package-building-infrastructure-maintenance" rel="nofollow">more consistent repo, no more i386 packages </a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2kVPKICqj" rel="nofollow">Boris writes in</a></li>
<li><a href="http://slexy.org/view/s21Fic4dZC" rel="nofollow">Alex writes in</a> (<b>edit:</b> adding &quot;tinker panic 0&quot; to the ntp.conf will disable the sanity check)</li>
<li><a href="http://slexy.org/view/s2zk1Tvfe9" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s22alvJ4mu" rel="nofollow">Robert writes in</a></li>
<li><a href="http://slexy.org/view/s203YMc2zL" rel="nofollow">Jake writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?t=141711266800001&r=1&w=2" rel="nofollow">Real world authpf use</a></li>
<li><a href="https://svnweb.freebsd.org/ports/head/UPDATING?r1=373564&r2=373563&pathrev=373564" rel="nofollow">The</a> <a href="https://lists.freebsd.org/pipermail/freebsd-ports/2014-November/096788.html" rel="nofollow">great</a> <a href="https://lists.freebsd.org/pipermail/freebsd-ports/2014-November/096799.html" rel="nofollow">perl</a> <a href="https://lists.freebsd.org/pipermail/freebsd-perl/2014-November/010146.html" rel="nofollow">event</a> <a href="https://lists.freebsd.org/pipermail/freebsd-perl/2014-November/010149.html" rel="nofollow">of</a> <a href="https://lists.freebsd.org/pipermail/freebsd-perl/2014-November/010167.html" rel="nofollow">2014</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we&#39;ll be talking with Paul Schenkeveld, chairman of the EuroBSDCon foundation. He tells us about his experiences running BSD conferences and how regular users can get involved too. We&#39;ve also got answers to all your emails and the latest news, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.meetbsd.com/" rel="nofollow">More BSD presentation videos</a></h3>

<ul>
<li>The MeetBSD video uploading spree continues with a few more talks, maybe this&#39;ll be the last batch</li>
<li>Corey Vixie, <a href="https://www.youtube.com/watch?v=Pbks12Mqpp8" rel="nofollow">Web Apps in Embedded BSD</a></li>
<li>Allan Jude, <a href="https://www.youtube.com/watch?v=TjP86iWsEzQ" rel="nofollow">UCL config</a></li>
<li>Kip Macy, <a href="https://www.youtube.com/watch?v=P4FRPKj7F80" rel="nofollow">iflib</a></li>
<li>While we&#39;re on the topic of conferences, AsiaBSDCon&#39;s CFP was <a href="https://twitter.com/asiabsdcon/status/538352055245492226" rel="nofollow">extended</a> by one week</li>
<li>This year&#39;s <a href="https://events.yandex.ru/events/yagosti/rubsd14/" rel="nofollow">ruBSD</a> will be on December 13th in Moscow</li>
<li>Also, the <a href="http://lists.bsdcan.org/pipermail/bsdcan-announce/2014-December/000135.html" rel="nofollow">BSDCan call for papers</a> is out, and the event will be in June next year</li>
<li>Lastly, according to Rick Miller, &quot;A potential vBSDcon 2015 event is being explored though a decision has yet to be made.&quot;
***</li>
</ul>

<h3><a href="http://peercorpsglobal.org/nzegas-digital-library-becomes-a-reality/" rel="nofollow">BSD-powered digital library in Africa</a></h3>

<ul>
<li>You probably haven&#39;t heard much about Nzega, Tanzania, but it&#39;s an East African country without much internet access</li>
<li>With physical schoolbooks being a rarity there, a few companies helped out to bring some BSD-powered reading material to a local school</li>
<li>They now have a pair of FreeNAS Minis at the center of their local network, with over 80,000 books and accompanying video content stored on them (~5TB of data currently)</li>
<li>The school&#39;s workstations also got wiped and reloaded with FreeBSD, and everyone there seems to really enjoy using it
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=1486" rel="nofollow">pfSense 2.2 status update</a></h3>

<ul>
<li>With lots of people asking when the 2.2 release will be done, some pfSense developers decided to provide a status update</li>
<li>2.2 will have a lot of changes: being based on FreeBSD 10.1, Unbound instead of BIND, updating PHP to something recent, including the new(ish) IPSEC stack updates, etc</li>
<li>All these things have taken more time than previously expected</li>
<li>The post also has some interesting graphs showing the ratio of opened and close bugs for the upcoming release
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/BSD/comments/2n8wrg/bsd_on_mini_itx/" rel="nofollow">Recommended hardware threads</a></h3>

<ul>
<li>A few threads on caught our attention this week, all about hardware recommendations for BSD setups</li>
<li>In the first one, the OP asks about mini-ITX hardware to run a FreeBSD server and NAS</li>
<li>Everyone gave some good recommendations for low power, Atom-based systems</li>
<li>The <a href="https://www.marc.info/?t=141694918800006&r=1&w=2" rel="nofollow">second thread</a> started off asking about which CPU architecture is best for PF on an OpenBSD router, but ended up being another hardware thread</li>
<li>For a router, the ALIX, APU and Soekris boards still seem to be the most popular choices, with the <a href="https://www.reddit.com/r/homelab/comments/24m6tj/" rel="nofollow">third</a> and <a href="https://www.reddit.com/r/PFSENSE/comments/2nblgp/" rel="nofollow">fourth</a> threads confirming this</li>
<li>If you&#39;re thinking about building your first BSD box - server, router, NAS, whatever - these might be some good links to read
***</li>
</ul>

<h2>Interview - Paul Schenkeveld - <a href="mailto:freebsd@psconsult.nl" rel="nofollow">freebsd@psconsult.nl</a></h2>

<p>Running a BSD conference</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.reddit.com/r/freebsd/comments/2nqa60/" rel="nofollow">From Linux to FreeBSD - for reals</a></h3>

<ul>
<li>Another Linux user is ready to switch to BSD, and takes to Reddit for some community encouragement (seems to be a common thing now)</li>
<li>After being a Linux guy for 20(!) years, he&#39;s ready to switch his systems over, and is looking for some helpful guides to transition</li>
<li>In the comments, a lot of new switchers offer some advice and reading material</li>
<li>If any of the listeners have some things that were helpful along your switching journey, maybe send &#39;em this guy&#39;s way
***</li>
</ul>

<h3><a href="http://wiki.xenproject.org/wiki/FreeBSD_Dom0" rel="nofollow">Running FreeBSD as a Xen Dom0</a></h3>

<ul>
<li>Continuing progress has been made to allow FreeBSD to be a host for the Xen hypervisor</li>
<li>This wiki article explains how to run the Xen branch of FreeBSD and host virtual machines on it</li>
<li>Xen on FreeBSD currently supports PV guests (modified kernels) and HVM (unmodified kernels, uses hardware virtualization features)</li>
<li>The wiki provides instructions for running Debian (PV) and FreeBSD (HVM), and discusses the features that are not finished yet
***</li>
</ul>

<h3><a href="http://hardenedbsd.org/article/shawn-webb/2014-11-18/aout-and-null-mapping-support-removal" rel="nofollow">HardenedBSD updates and changes</a></h3>

<ul>
<li>a.out is the old executable format for Unix</li>
<li>The name stands for assembler output, and was coined by Ken Thompson as the fixed name for output of his PDP-7 assembler in 1968</li>
<li>FreeBSD, on which HardenedBSD is based, switched away from a.out in version 3.0</li>
<li>A restriction against NULL mapping was introduced in <a href="https://www.freebsd.org/security/advisories/FreeBSD-EN-09:05.null.asc" rel="nofollow">FreeBSD 7</a> and enabled by default in FreeBSD 8</li>
<li>However, for reasons of compatibility, it could be switched off, allowing buggy applications to continue to run, at the risk of allowing a kernel bug to be exploited</li>
<li>HardenedBSD has removed the sysctl, making it impossible to run in ‘insecure mode’</li>
<li>Package building update: <a href="http://hardenedbsd.org/article/shawn-webb/2014-11-30/package-building-infrastructure-maintenance" rel="nofollow">more consistent repo, no more i386 packages </a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2kVPKICqj" rel="nofollow">Boris writes in</a></li>
<li><a href="http://slexy.org/view/s21Fic4dZC" rel="nofollow">Alex writes in</a> (<b>edit:</b> adding &quot;tinker panic 0&quot; to the ntp.conf will disable the sanity check)</li>
<li><a href="http://slexy.org/view/s2zk1Tvfe9" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s22alvJ4mu" rel="nofollow">Robert writes in</a></li>
<li><a href="http://slexy.org/view/s203YMc2zL" rel="nofollow">Jake writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?t=141711266800001&r=1&w=2" rel="nofollow">Real world authpf use</a></li>
<li><a href="https://svnweb.freebsd.org/ports/head/UPDATING?r1=373564&r2=373563&pathrev=373564" rel="nofollow">The</a> <a href="https://lists.freebsd.org/pipermail/freebsd-ports/2014-November/096788.html" rel="nofollow">great</a> <a href="https://lists.freebsd.org/pipermail/freebsd-ports/2014-November/096799.html" rel="nofollow">perl</a> <a href="https://lists.freebsd.org/pipermail/freebsd-perl/2014-November/010146.html" rel="nofollow">event</a> <a href="https://lists.freebsd.org/pipermail/freebsd-perl/2014-November/010149.html" rel="nofollow">of</a> <a href="https://lists.freebsd.org/pipermail/freebsd-perl/2014-November/010167.html" rel="nofollow">2014</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>65: 8,000,000 Mogofoo-ops</title>
  <link>https://www.bsdnow.tv/65</link>
  <guid isPermaLink="false">c905fcf9-ebc6-4a15-8d34-631dc9742cea</guid>
  <pubDate>Wed, 26 Nov 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c905fcf9-ebc6-4a15-8d34-631dc9742cea.mp3" length="66537364" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up on the show this week, we've got an interview with Brendan Gregg of Netflix. He's got a lot to say about performance tuning and benchmarks, and even some pretty funny stories about how people have done them incorrectly. As always, this week's news and answers to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:32:24</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up on the show this week, we've got an interview with Brendan Gregg of Netflix. He's got a lot to say about performance tuning and benchmarks, and even some pretty funny stories about how people have done them incorrectly. As always, this week's news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
Even more BSD presentation videos (https://www.meetbsd.com/)
More videos from this year's MeetBSD and OpenZFS devsummit were uploaded since last week
Robert Ryan, At the Heart of the Digital Economy (https://www.youtube.com/watch?v=Rc9k1xEepWU)
FreeNAS &amp;amp; ZFS, The Indestructible Duo - Except for the Hard Drives (https://www.youtube.com/watch?v=d1C6DELK7fc)
Richard Yao, libzfs_core and ioctl stabilization (https://www.youtube.com/watch?v=PIC0dwLRBZU)
OpenZFS, Company lightning talks (https://www.youtube.com/watch?v=LmbI7F7XTTc)
OpenZFS, Hackathon Presentation and Awards (https://www.youtube.com/watch?v=gPbVPwScMGk)
Pavel Zakharov, Fast File Cloning (https://www.youtube.com/watch?v=_lGOAZFXra8)
Rick Reed, Half a billion unsuspecting FreeBSD users (https://www.youtube.com/watch?v=TneLO5TdW_M)
Alex Reece &amp;amp; Matt Ahrens, Device Removal (https://www.youtube.com/watch?v=Xs6MsJ9kKKE)
Chris Side, Channel Programs (https://www.youtube.com/watch?v=RMTxyqcomPA)
David Maxwell, The Unix command pipeline (https://www.youtube.com/watch?v=CZHEZHK4jRc)
Be sure to check out the giant list of videos from last week's episode (http://www.bsdnow.tv/episodes/2014_11_19-rump_kernels_revisited) if you haven't seen them already
***
NetBSD on a Cobalt Qube 2 (http://www.jarredcapellman.com/2014/3/9/NetBSD-and-a-Cobalt-Qube-2)
The Cobalt Qube was a very expensive networking appliance around 2000
In 2014, you can apparently get one of these MIPS-based machines for about forty bucks
This blog post details getting NetBSD installed and set up on the rare relic of our networking past
If you're an old-time fan of RISC or MIPS CPUs, this'll be a treat for you
Lots of great pictures of the hardware too
***
OpenBSD vs. AFL (https://www.marc.info/?l=openbsd-cvs&amp;amp;w=2&amp;amp;r=1&amp;amp;s=afl&amp;amp;q=b)
In their never-ending security audit, some OpenBSD developers have been hitting various parts of the tree (https://twitter.com/damienmiller/status/534156368391831552) with a fuzzer
If you're not familiar, fuzzing (https://en.wikipedia.org/wiki/Fuzz_testing) is a semi-automated way to test programs for crashes and potential security problems
The program being subjected to torture gets all sorts of random and invalid input, in the hopes of uncovering overflows and other bugs
American Fuzzy Lop (http://lcamtuf.coredump.cx/afl/), in particular, has provided some interesting results across various open source projects recently
So far, it's fixed some NULL pointer dereferences in OpenSSH, various crashes in tcpdump and mandoc (http://www.bsdnow.tv/episodes/2014_11_12-a_mans_man) and a few other things (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141646270127039&amp;amp;w=2)
AFL has an impressive list of CVEs (vulnerabilities) that it's helped developers discover and fix
It also made its way into OpenBSD ports, FreeBSD ports and NetBSD's pkgsrc very recently, so you can try it out for yourself
***
GNOME 3 hits the FreeBSD ports tree (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=372768)
While you've been able to run GNOME 3 on PC-BSD and OpenBSD for a while, it hasn't actually hit the FreeBSD ports tree.. until now
Now you can play with GNOME 3 and all its goodies (as well as Cinnamon 2.2, which this also brings in) on vanilla FreeBSD
Be sure to check the commit message and /usr/ports/UPDATING (http://www.bsdnow.tv/tutorials/ports) if you're upgrading from GNOME 2
You might also want to go back and listen to our interview (http://www.bsdnow.tv/episodes/2014_02_26-port_authority) with Joe Marcus Clark about GNOME's portability
***
Interview - Brendan Gregg - bgregg@netflix.com (mailto:bgregg@netflix.com) / @brendangregg (https://twitter.com/brendangregg)
Performance tuning, benchmarks, debugging
News Roundup
DragonFlyBSD 4.0 released (http://www.dragonflybsd.org/release40/)
A new major version of DragonFly, 4.0.1, was just recently announced
This version includes support for Haswell GPUs, lots of SMP improvements (including some in PF) and support for up to 256 CPUs
It's also the first release to drop support for i386, so it joins PCBSD in the 64 bit-only club
Check the release notes for all the details, including networking and kernel improvements, as well as some crypto changes
***
Can we talk about FreeBSD vs Linux (https://news.ycombinator.com/item?id=8645443)
Hackernews had a recent thread about discussing Linux vs BSD, and the trolls stayed away for once
Rather than rehashing why one is "better" than the other, it was focused on explaining some of the differences between ecosystems and communities
If you're one of the many people who watch our show just out of curiosity about the BSD world, this might be a good thread to read
Someone in the comments even gave bsdnow.tv a mention as a good resource to learn, thanks guy
***
OpenBSD IPSEC tunnel guide (http://www.packetmischief.ca/openbsd-ipsec-tunnel-guide/)
If you've ever wanted to connect two networks with OpenBSD gateways, this is the article for you
It shows how to set up an IPSEC tunnel between destinations, how to lock it down and how to access all the machines on the other network just like they were on your LAN
The article also explains some of the basics of IPSEC if you're not familiar with all the terminology, so this isn't just for experts
Though the article itself is a few years old, it mostly still applies to the latest stuff today
All the tools used are in the OpenBSD base system, so that's pretty handy too
***
DragonFly starts work on IPFW2 (http://www.dragonflybsd.org/docs/ipfw2/)
DragonFlyBSD, much like FreeBSD, comes with more than one firewall you can use
Now it looks like you're going to have yet another choice, as someone is working on a fork of IPFW (which is actually already in its second version, so it should be "IPFW3")
Not a whole lot is known yet; it's still in heavy development, but there's a brief roadmap (http://www.dragonflybsd.org/docs/ipfw2/#index6h1) page with some planned additions
The guy who's working on this has already agreed to come on the show for an interview, but we're going to give him a chance to get some more work done first
Expect that sometime next year, once he's made some progress
***
Feedback/Questions
Michael writes in (http://slexy.org/view/s2NYgVifXN)
Samael writes in (http://slexy.org/view/s21X02saI3)
Steven writes in (http://slexy.org/view/s21Dj7zImH)
Remy writes in (http://slexy.org/view/s218lXg38C)
Michael writes in (http://slexy.org/view/s20SEuKlaH)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, dtrace, benchmarks, zfs, solaris, pmstat, performance, high availability, ktrace, strace, iops, freenas, ipfw2, gnome3, afl, fuzzing, american fuzzy lop, ipsec, tunnel</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up on the show this week, we&#39;ve got an interview with Brendan Gregg of Netflix. He&#39;s got a lot to say about performance tuning and benchmarks, and even some pretty funny stories about how people have done them incorrectly. As always, this week&#39;s news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.meetbsd.com/" rel="nofollow">Even more BSD presentation videos</a></h3>

<ul>
<li>More videos from this year&#39;s MeetBSD and OpenZFS devsummit were uploaded since last week</li>
<li>Robert Ryan, <a href="https://www.youtube.com/watch?v=Rc9k1xEepWU" rel="nofollow">At the Heart of the Digital Economy</a></li>
<li>FreeNAS &amp; ZFS, The Indestructible Duo - <a href="https://www.youtube.com/watch?v=d1C6DELK7fc" rel="nofollow">Except for the Hard Drives</a></li>
<li>Richard Yao, <a href="https://www.youtube.com/watch?v=PIC0dwLRBZU" rel="nofollow">libzfs_core and ioctl stabilization</a></li>
<li>OpenZFS, <a href="https://www.youtube.com/watch?v=LmbI7F7XTTc" rel="nofollow">Company lightning talks</a></li>
<li>OpenZFS, <a href="https://www.youtube.com/watch?v=gPbVPwScMGk" rel="nofollow">Hackathon Presentation and Awards</a></li>
<li>Pavel Zakharov, <a href="https://www.youtube.com/watch?v=_lGOAZFXra8" rel="nofollow">Fast File Cloning</a></li>
<li>Rick Reed, <a href="https://www.youtube.com/watch?v=TneLO5TdW_M" rel="nofollow">Half a billion unsuspecting FreeBSD users</a></li>
<li>Alex Reece &amp; Matt Ahrens, <a href="https://www.youtube.com/watch?v=Xs6MsJ9kKKE" rel="nofollow">Device Removal</a></li>
<li>Chris Side, <a href="https://www.youtube.com/watch?v=RMTxyqcomPA" rel="nofollow">Channel Programs</a></li>
<li>David Maxwell, <a href="https://www.youtube.com/watch?v=CZHEZHK4jRc" rel="nofollow">The Unix command pipeline</a></li>
<li>Be sure to check out the <strong>giant list of videos</strong> from <a href="http://www.bsdnow.tv/episodes/2014_11_19-rump_kernels_revisited" rel="nofollow">last week&#39;s episode</a> if you haven&#39;t seen them already
***</li>
</ul>

<h3><a href="http://www.jarredcapellman.com/2014/3/9/NetBSD-and-a-Cobalt-Qube-2" rel="nofollow">NetBSD on a Cobalt Qube 2</a></h3>

<ul>
<li>The Cobalt Qube was a very expensive networking appliance around 2000</li>
<li>In 2014, you can apparently get one of these MIPS-based machines for about forty bucks</li>
<li>This blog post details getting NetBSD installed and set up on the rare relic of our networking past</li>
<li>If you&#39;re an old-time fan of RISC or MIPS CPUs, this&#39;ll be a treat for you</li>
<li>Lots of great pictures of the hardware too
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&w=2&r=1&s=afl&q=b" rel="nofollow">OpenBSD vs. AFL</a></h3>

<ul>
<li>In their never-ending security audit, some OpenBSD developers have been <a href="https://twitter.com/damienmiller/status/534156368391831552" rel="nofollow">hitting various parts of the tree</a> with a fuzzer</li>
<li>If you&#39;re not familiar, <a href="https://en.wikipedia.org/wiki/Fuzz_testing" rel="nofollow">fuzzing</a> is a semi-automated way to test programs for crashes and potential security problems</li>
<li>The program being subjected to torture gets all sorts of random and invalid input, in the hopes of uncovering overflows and other bugs</li>
<li><a href="http://lcamtuf.coredump.cx/afl/" rel="nofollow">American Fuzzy Lop</a>, in particular, has provided some interesting results across various open source projects recently</li>
<li>So far, it&#39;s fixed some NULL pointer dereferences in OpenSSH, various crashes in tcpdump and <a href="http://www.bsdnow.tv/episodes/2014_11_12-a_mans_man" rel="nofollow">mandoc</a> and <a href="https://www.marc.info/?l=openbsd-cvs&m=141646270127039&w=2" rel="nofollow">a few other things</a></li>
<li>AFL has an impressive list of CVEs (vulnerabilities) that it&#39;s helped developers discover and fix</li>
<li>It also made its way into OpenBSD ports, FreeBSD ports and NetBSD&#39;s pkgsrc very recently, so you can try it out for yourself
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=372768" rel="nofollow">GNOME 3 hits the FreeBSD ports tree</a></h3>

<ul>
<li>While you&#39;ve been able to run GNOME 3 on PC-BSD and OpenBSD for a while, it hasn&#39;t actually hit the FreeBSD ports tree.. until now</li>
<li>Now you can play with GNOME 3 and all its goodies (as well as Cinnamon 2.2, which this also brings in) on vanilla FreeBSD</li>
<li>Be sure to check the commit message and <a href="http://www.bsdnow.tv/tutorials/ports" rel="nofollow">/usr/ports/UPDATING</a> if you&#39;re upgrading from GNOME 2</li>
<li>You might also want to go back and listen to <a href="http://www.bsdnow.tv/episodes/2014_02_26-port_authority" rel="nofollow">our interview</a> with Joe Marcus Clark about GNOME&#39;s portability
***</li>
</ul>

<h2>Interview - Brendan Gregg - <a href="mailto:bgregg@netflix.com" rel="nofollow">bgregg@netflix.com</a> / <a href="https://twitter.com/brendangregg" rel="nofollow">@brendangregg</a></h2>

<p>Performance tuning, benchmarks, debugging</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.dragonflybsd.org/release40/" rel="nofollow">DragonFlyBSD 4.0 released</a></h3>

<ul>
<li>A new major version of DragonFly, 4.0.1, was just recently announced</li>
<li>This version includes support for Haswell GPUs, lots of SMP improvements (including some in PF) and support for up to 256 CPUs</li>
<li>It&#39;s also the first release to drop support for i386, so it joins PCBSD in the 64 bit-only club</li>
<li>Check the release notes for all the details, including networking and kernel improvements, as well as some crypto changes
***</li>
</ul>

<h3><a href="https://news.ycombinator.com/item?id=8645443" rel="nofollow">Can we talk about FreeBSD vs Linux</a></h3>

<ul>
<li>Hackernews had a recent thread about discussing Linux vs BSD, and the trolls stayed away for once</li>
<li>Rather than rehashing why one is &quot;better&quot; than the other, it was focused on explaining some of the differences between ecosystems and communities</li>
<li>If you&#39;re one of the many people who watch our show just out of curiosity about the BSD world, this might be a good thread to read</li>
<li>Someone in the comments even gave bsdnow.tv a mention as a good resource to learn, thanks guy
***</li>
</ul>

<h3><a href="http://www.packetmischief.ca/openbsd-ipsec-tunnel-guide/" rel="nofollow">OpenBSD IPSEC tunnel guide</a></h3>

<ul>
<li>If you&#39;ve ever wanted to connect two networks with OpenBSD gateways, this is the article for you</li>
<li>It shows how to set up an IPSEC tunnel between destinations, how to lock it down and how to access all the machines on the other network just like they were on your LAN</li>
<li>The article also explains some of the basics of IPSEC if you&#39;re not familiar with all the terminology, so this isn&#39;t just for experts</li>
<li>Though the article itself is a few years old, it mostly still applies to the latest stuff today</li>
<li>All the tools used are in the OpenBSD base system, so that&#39;s pretty handy too
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/docs/ipfw2/" rel="nofollow">DragonFly starts work on IPFW2</a></h3>

<ul>
<li>DragonFlyBSD, much like FreeBSD, comes with more than one firewall you can use</li>
<li>Now it looks like you&#39;re going to have yet another choice, as someone is working on a fork of IPFW (which is actually already in its second version, so it should be &quot;IPFW3&quot;)</li>
<li>Not a whole lot is known yet; it&#39;s still in heavy development, but there&#39;s a brief <a href="http://www.dragonflybsd.org/docs/ipfw2/#index6h1" rel="nofollow">roadmap</a> page with some planned additions</li>
<li>The guy who&#39;s working on this has already agreed to come on the show for an interview, but we&#39;re going to give him a chance to get some more work done first</li>
<li>Expect that sometime next year, once he&#39;s made some progress
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2NYgVifXN" rel="nofollow">Michael writes in</a></li>
<li><a href="http://slexy.org/view/s21X02saI3" rel="nofollow">Samael writes in</a></li>
<li><a href="http://slexy.org/view/s21Dj7zImH" rel="nofollow">Steven writes in</a></li>
<li><a href="http://slexy.org/view/s218lXg38C" rel="nofollow">Remy writes in</a></li>
<li><a href="http://slexy.org/view/s20SEuKlaH" rel="nofollow">Michael writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up on the show this week, we&#39;ve got an interview with Brendan Gregg of Netflix. He&#39;s got a lot to say about performance tuning and benchmarks, and even some pretty funny stories about how people have done them incorrectly. As always, this week&#39;s news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.meetbsd.com/" rel="nofollow">Even more BSD presentation videos</a></h3>

<ul>
<li>More videos from this year&#39;s MeetBSD and OpenZFS devsummit were uploaded since last week</li>
<li>Robert Ryan, <a href="https://www.youtube.com/watch?v=Rc9k1xEepWU" rel="nofollow">At the Heart of the Digital Economy</a></li>
<li>FreeNAS &amp; ZFS, The Indestructible Duo - <a href="https://www.youtube.com/watch?v=d1C6DELK7fc" rel="nofollow">Except for the Hard Drives</a></li>
<li>Richard Yao, <a href="https://www.youtube.com/watch?v=PIC0dwLRBZU" rel="nofollow">libzfs_core and ioctl stabilization</a></li>
<li>OpenZFS, <a href="https://www.youtube.com/watch?v=LmbI7F7XTTc" rel="nofollow">Company lightning talks</a></li>
<li>OpenZFS, <a href="https://www.youtube.com/watch?v=gPbVPwScMGk" rel="nofollow">Hackathon Presentation and Awards</a></li>
<li>Pavel Zakharov, <a href="https://www.youtube.com/watch?v=_lGOAZFXra8" rel="nofollow">Fast File Cloning</a></li>
<li>Rick Reed, <a href="https://www.youtube.com/watch?v=TneLO5TdW_M" rel="nofollow">Half a billion unsuspecting FreeBSD users</a></li>
<li>Alex Reece &amp; Matt Ahrens, <a href="https://www.youtube.com/watch?v=Xs6MsJ9kKKE" rel="nofollow">Device Removal</a></li>
<li>Chris Side, <a href="https://www.youtube.com/watch?v=RMTxyqcomPA" rel="nofollow">Channel Programs</a></li>
<li>David Maxwell, <a href="https://www.youtube.com/watch?v=CZHEZHK4jRc" rel="nofollow">The Unix command pipeline</a></li>
<li>Be sure to check out the <strong>giant list of videos</strong> from <a href="http://www.bsdnow.tv/episodes/2014_11_19-rump_kernels_revisited" rel="nofollow">last week&#39;s episode</a> if you haven&#39;t seen them already
***</li>
</ul>

<h3><a href="http://www.jarredcapellman.com/2014/3/9/NetBSD-and-a-Cobalt-Qube-2" rel="nofollow">NetBSD on a Cobalt Qube 2</a></h3>

<ul>
<li>The Cobalt Qube was a very expensive networking appliance around 2000</li>
<li>In 2014, you can apparently get one of these MIPS-based machines for about forty bucks</li>
<li>This blog post details getting NetBSD installed and set up on the rare relic of our networking past</li>
<li>If you&#39;re an old-time fan of RISC or MIPS CPUs, this&#39;ll be a treat for you</li>
<li>Lots of great pictures of the hardware too
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-cvs&w=2&r=1&s=afl&q=b" rel="nofollow">OpenBSD vs. AFL</a></h3>

<ul>
<li>In their never-ending security audit, some OpenBSD developers have been <a href="https://twitter.com/damienmiller/status/534156368391831552" rel="nofollow">hitting various parts of the tree</a> with a fuzzer</li>
<li>If you&#39;re not familiar, <a href="https://en.wikipedia.org/wiki/Fuzz_testing" rel="nofollow">fuzzing</a> is a semi-automated way to test programs for crashes and potential security problems</li>
<li>The program being subjected to torture gets all sorts of random and invalid input, in the hopes of uncovering overflows and other bugs</li>
<li><a href="http://lcamtuf.coredump.cx/afl/" rel="nofollow">American Fuzzy Lop</a>, in particular, has provided some interesting results across various open source projects recently</li>
<li>So far, it&#39;s fixed some NULL pointer dereferences in OpenSSH, various crashes in tcpdump and <a href="http://www.bsdnow.tv/episodes/2014_11_12-a_mans_man" rel="nofollow">mandoc</a> and <a href="https://www.marc.info/?l=openbsd-cvs&m=141646270127039&w=2" rel="nofollow">a few other things</a></li>
<li>AFL has an impressive list of CVEs (vulnerabilities) that it&#39;s helped developers discover and fix</li>
<li>It also made its way into OpenBSD ports, FreeBSD ports and NetBSD&#39;s pkgsrc very recently, so you can try it out for yourself
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=372768" rel="nofollow">GNOME 3 hits the FreeBSD ports tree</a></h3>

<ul>
<li>While you&#39;ve been able to run GNOME 3 on PC-BSD and OpenBSD for a while, it hasn&#39;t actually hit the FreeBSD ports tree.. until now</li>
<li>Now you can play with GNOME 3 and all its goodies (as well as Cinnamon 2.2, which this also brings in) on vanilla FreeBSD</li>
<li>Be sure to check the commit message and <a href="http://www.bsdnow.tv/tutorials/ports" rel="nofollow">/usr/ports/UPDATING</a> if you&#39;re upgrading from GNOME 2</li>
<li>You might also want to go back and listen to <a href="http://www.bsdnow.tv/episodes/2014_02_26-port_authority" rel="nofollow">our interview</a> with Joe Marcus Clark about GNOME&#39;s portability
***</li>
</ul>

<h2>Interview - Brendan Gregg - <a href="mailto:bgregg@netflix.com" rel="nofollow">bgregg@netflix.com</a> / <a href="https://twitter.com/brendangregg" rel="nofollow">@brendangregg</a></h2>

<p>Performance tuning, benchmarks, debugging</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.dragonflybsd.org/release40/" rel="nofollow">DragonFlyBSD 4.0 released</a></h3>

<ul>
<li>A new major version of DragonFly, 4.0.1, was just recently announced</li>
<li>This version includes support for Haswell GPUs, lots of SMP improvements (including some in PF) and support for up to 256 CPUs</li>
<li>It&#39;s also the first release to drop support for i386, so it joins PCBSD in the 64 bit-only club</li>
<li>Check the release notes for all the details, including networking and kernel improvements, as well as some crypto changes
***</li>
</ul>

<h3><a href="https://news.ycombinator.com/item?id=8645443" rel="nofollow">Can we talk about FreeBSD vs Linux</a></h3>

<ul>
<li>Hackernews had a recent thread about discussing Linux vs BSD, and the trolls stayed away for once</li>
<li>Rather than rehashing why one is &quot;better&quot; than the other, it was focused on explaining some of the differences between ecosystems and communities</li>
<li>If you&#39;re one of the many people who watch our show just out of curiosity about the BSD world, this might be a good thread to read</li>
<li>Someone in the comments even gave bsdnow.tv a mention as a good resource to learn, thanks guy
***</li>
</ul>

<h3><a href="http://www.packetmischief.ca/openbsd-ipsec-tunnel-guide/" rel="nofollow">OpenBSD IPSEC tunnel guide</a></h3>

<ul>
<li>If you&#39;ve ever wanted to connect two networks with OpenBSD gateways, this is the article for you</li>
<li>It shows how to set up an IPSEC tunnel between destinations, how to lock it down and how to access all the machines on the other network just like they were on your LAN</li>
<li>The article also explains some of the basics of IPSEC if you&#39;re not familiar with all the terminology, so this isn&#39;t just for experts</li>
<li>Though the article itself is a few years old, it mostly still applies to the latest stuff today</li>
<li>All the tools used are in the OpenBSD base system, so that&#39;s pretty handy too
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/docs/ipfw2/" rel="nofollow">DragonFly starts work on IPFW2</a></h3>

<ul>
<li>DragonFlyBSD, much like FreeBSD, comes with more than one firewall you can use</li>
<li>Now it looks like you&#39;re going to have yet another choice, as someone is working on a fork of IPFW (which is actually already in its second version, so it should be &quot;IPFW3&quot;)</li>
<li>Not a whole lot is known yet; it&#39;s still in heavy development, but there&#39;s a brief <a href="http://www.dragonflybsd.org/docs/ipfw2/#index6h1" rel="nofollow">roadmap</a> page with some planned additions</li>
<li>The guy who&#39;s working on this has already agreed to come on the show for an interview, but we&#39;re going to give him a chance to get some more work done first</li>
<li>Expect that sometime next year, once he&#39;s made some progress
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2NYgVifXN" rel="nofollow">Michael writes in</a></li>
<li><a href="http://slexy.org/view/s21X02saI3" rel="nofollow">Samael writes in</a></li>
<li><a href="http://slexy.org/view/s21Dj7zImH" rel="nofollow">Steven writes in</a></li>
<li><a href="http://slexy.org/view/s218lXg38C" rel="nofollow">Remy writes in</a></li>
<li><a href="http://slexy.org/view/s20SEuKlaH" rel="nofollow">Michael writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>64: Rump Kernels Revisited</title>
  <link>https://www.bsdnow.tv/64</link>
  <guid isPermaLink="false">b5100d19-f472-4a18-93f7-72e1494ce394</guid>
  <pubDate>Wed, 19 Nov 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b5100d19-f472-4a18-93f7-72e1494ce394.mp3" length="81755572" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we'll be talking with Justin Cormack about NetBSD rump kernels. We'll learn how to run them on other operating systems, what's planned for the future and a lot more. As always, answers to viewer-submitted questions and all the news for the week, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:53:32</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we'll be talking with Justin Cormack about NetBSD rump kernels. We'll learn how to run them on other operating systems, what's planned for the future and a lot more. As always, answers to viewer-submitted questions and all the news for the week, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
EuroBSDCon 2014 talks and tutorials (http://2014.eurobsdcon.org/talks-and-schedule/)
The 2014 EuroBSDCon videos have been online for over a month, but unannounced - keep in mind these links may be temporary (but we'll mention their new location in a future show and fix the show notes if that's the case)

Arun Thomas, BSD ARM Kernel Internals (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/01.BSD-ARM%20Kernel%20Internals%20-%20Arun%20Thomas.mp4)

Ted Unangst, Developing Software in a Hostile Environment (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/02.Developing%20Software%20in%20a%20Hostile%20Environment%20-%20Ted%20Unangst.mp4)

Martin Pieuchot, Taming OpenBSD Network Stack Dragons (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/03.Taming%20OpenBSD%20Network%20Stack%20Dragons%20-%20Martin%20Pieuchot.mp4)

Henning Brauer, OpenBGPD turns 10 years (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/04.OpenBGPD%20turns%2010%20years%20-%20%20Henning%20Brauer.mp4)

Claudio Jeker, vscsi and iscsid iSCSI initiator the OpenBSD way (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/05.vscsi(4)%20and%20iscsid%20-%20iSCSI%20initiator%20the%20OpenBSD%20way%20-%20Claudio%20Jeker.mp4)

Paul Irofti, Making OpenBSD Useful on the Octeon Network Gear (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/06.Making%20OpenBSD%20Useful%20on%20the%20Octeon%20Network%20Gear%20-%20Paul%20Irofti.mp4)

Baptiste Daroussin, Cross Building the FreeBSD ports tree (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/01.Cross%20Building%20the%20FreeBSD%20ports%20tree%20-%20Baptiste%20Daroussin.mp4)

Boris Astardzhiev, Smartcom’s control plane software, a customized version of FreeBSD (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/02.Smartcom%e2%80%99s%20control%20plane%20software,%20a%20customized%20version%20of%20FreeBSD%20-%20Boris%20Astardzhiev.mp4)

Michał Dubiel, OpenStack and OpenContrail for FreeBSD platform (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/03.OpenStack%20and%20OpenContrail%20for%20FreeBSD%20platform%20-%20Micha%c5%82%20Dubiel.mp4)

Martin Husemann &amp;amp; Joerg Sonnenberger, Tool-chaining the Hydra, the ongoing quest for modern toolchains in NetBSD (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/04.(Tool-)chaining%20the%20Hydra%20The%20ongoing%20quest%20for%20modern%20toolchains%20in%20NetBSD%20-%20Martin%20Huseman%20&amp;amp;%20Joerg%20Sonnenberger.mp4)

Taylor R Campbell, The entropic principle: /dev/u?random and NetBSD (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/05.The%20entropic%20principle:%20dev-u%3frandom%20and%20NetBSD%20-%20Taylor%20R%20Campbell.mp4)

Dag-Erling Smørgrav, Securing sensitive &amp;amp; restricted data (https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/06.Securing%20sensitive%20&amp;amp;%20restricted%20data%20-%20Dag-Erling%20Sm%c3%b8rgrav.mp4)

Peter Hansteen, Building The Network You Need (https://va.ludost.net/files/eurobsdcon/2014/Pirin/01.Thursday/01.Building%20The%20Network%20You%20Need%20With%20PF%20-%20Peter%20Hansteen.mp4) With PF (https://va.ludost.net/files/eurobsdcon/2014/Pirin/01.Thursday/02.Building%20The%20Network%20You%20Need%20With%20PF%20-%20Peter%20Hansteen.mp4)

Stefan Sperling, Subversion for FreeBSD developers (https://va.ludost.net/files/eurobsdcon/2014/Pirin/01.Thursday/03.Subversion%20for%20FreeBSD%20developers%20-%20Stefan%20Sperling.mp4)

Peter Hansteen, Transition to (https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/01.Transition%20to%20OpenBSD%205.6%20-%20Peter%20Hansteen.mp4) OpenBSD 5.6 (https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/02.Transition%20to%20OpenBSD%205.6%20-%20Peter%20Hansteen.mp4)

Ingo Schwarze, Let’s make manuals (https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/03.Let%e2%80%99s%20make%20manuals%20more%20useful%20-%20Ingo%20Schwarze.mp4) more useful (https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/04.Let%e2%80%99s%20make%20manuals%20more%20useful%20-%20Ingo%20Schwarze.mp4)

Francois Tigeot, Improving DragonFly’s performance with PostgreSQL (https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/01.Improving%20DragonFly%e2%80%99s%20performance%20with%20PostgreSQL%20-%20Francois%20Tigeot.mp4)

Justin Cormack, Running Applications on the NetBSD Rump Kernel (https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/02.Running%20Applications%20on%20the%20NetBSD%20Rump%20Kernel%20-%20Justin%20Cormack.mp4)

Pierre Pronchery, EdgeBSD, a year later (https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/04.EdgeBSD,%20a%20year%20later%20-%20%20Pierre%20Pronchery.mp4)

Peter Hessler, Using routing domains or tables in a production network (https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/05.Using%20routing%20domains%20or%20tables%20in%20a%20production%20network%20-%20%20Peter%20Hessler.mp4)

Sean Bruno, QEMU user mode on FreeBSD (https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/06.QEMU%20user%20mode%20on%20FreeBSD%20-%20%20Sean%20Bruno.mp4)

Kristaps Dzonsons, Bugs Ex Ante (https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/01.Bugs%20Ex%20Ante%20-%20Kristaps%20Dzonsons.mp4)

Yann Sionneau, Porting NetBSD to the LatticeMico32 open source CPU (https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/02.Porting%20NetBSD%20to%20the%20LatticeMico32%20open%20source%20CPU%20-%20Yann%20Sionneau.mp4)

Alexander Nasonov, JIT Code Generator for NetBSD (https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/03.JIT%20Code%20Generator%20for%20NetBSD%20-%20Alexander%20Nasonov.mp4)

Masao Uebayashi, Porting Valgrind to NetBSD and OpenBSD (https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/04.Porting%20Valgrind%20to%20NetBSD%20and%20OpenBSD%20-%20Masao%20Uebayashi.mp4)

Marc Espie, parallel make, working with legacy code (https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/05.parallel%20make:%20working%20with%20legacy%20code%20-%20Marc%20Espie.mp4)

Francois Tigeot, Porting the drm-kms graphic drivers to DragonFly (https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/06.Porting%20the%20drm-kms%20graphic%20drivers%20to%20DragonFly%20-%20Francois%20Tigeot.mp4)

The following talks (from the Vitosha track room) are all currently missing:
Jordan Hubbard, FreeBSD, Looking forward to another 10 years (but we have another recording)
Theo de Raadt, Randomness, how arc4random has grown since 1998 (but we have another recording)
Kris Moore, Snapshots, Replication, and Boot-Environments
Kirk McKusick, An Introduction to the Implementation of ZFS
John-Mark Gurney, Optimizing GELI Performance
Emmanuel Dreyfus, FUSE and beyond, bridging filesystems
Lourival Vieira Neto, NPF scripting with Lua
Andy Tanenbaum, A Reimplementation of NetBSD Based on a Microkernel
Stefano Garzarella, Software segmentation offloading for FreeBSD
Ted Unangst, LibreSSL
Shawn Webb, Introducing ASLR In FreeBSD
Ed Maste, The LLDB Debugger in FreeBSD
Philip Guenther, Secure lazy binding
***
OpenBSD adopts SipHash (https://www.marc.info/?l=openbsd-tech&amp;amp;m=141614801713457&amp;amp;w=2)
Even more DJB crypto somehow finds its way into OpenBSD's base system
This time it's SipHash (https://131002.net/siphash/), a family of pseudorandom functions that's resistant to hash bucket flooding attacks while still providing good performance
After an initial import (http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/crypto/siphash.c?rev=1.1&amp;amp;content-type=text/x-cvsweb-markup) and some clever early usage (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141604896822253&amp;amp;w=2), a few developers agreed that it would be better to use it in a lot more places
It will now be used in the filesystem, and the plan is to utilize it to protect all kernel hash functions
Some other places (http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline) that Bernstein's work can be found in OpenBSD include the ChaCha20-Poly1305 authenticated stream cipher and Curve25519 KEX used in SSH, ChaCha20 used in the RNG, and Ed25519 keys used in signify (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures) and SSH
***
FreeBSD 10.1-RELEASE (https://www.freebsd.org/releases/10.1R/announce.html)
FreeBSD's release engineering team (http://www.bsdnow.tv/episodes/2013-09-11_engineering_powder_kegs) likes to troll us by uploading new versions just a few hours after we finish recording an episode
The first maintenance update for the 10.x branch is out, improving upon a lot of things found in 10.0-RELEASE
The vt driver was merged from -CURRENT and can now be enabled with a loader.conf switch (and can even be used on a PlayStation 3)
Bhyve has gotten quite a lot of fixes and improvements from its initial debut in 10.0, including boot support for ZFS
Lots of new ARM hardware is supported now, including SMP support for most of them
A new kernel selection menu was added to the loader, so you can switch between newer and older kernels at boot time
10.1 is the first to support UEFI booting on amd64, which also has serial console support now
Lots of third party software (OpenSSH, OpenSSL, Unbound..) and drivers have gotten updates to newer versions
It's a worthy update from 10.0, or a good time to try the 10.x branch if you were avoiding the first .0 release, so grab an ISO (http://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-amd64/10.1/) or upgrade (https://www.freebsd.org/cgi/man.cgi?query=freebsd-update) today
Check the detailed release notes (https://www.freebsd.org/releases/10.1R/relnotes.html) for more information on all the changes
Also take a look at some of the known problems (https://www.freebsd.org/releases/10.1R/errata.html#open-issues) to see if (https://forums.freebsd.org/threads/segmentation-fault-while-upgrading-from-10-0-release-to-10-1-release.48977/) you'll (https://lists.freebsd.org/pipermail/freebsd-stable/2014-October/080599.html) be (https://forums.freebsd.org/threads/10-0-10-1-diocaddrule-operation-not-supported-by-device.49016/) affected (https://www.reddit.com/r/freebsd/comments/2mmzzy/101release_restart_problems_anyone/) by any of them
PC-BSD was also updated accordingly (http://wiki.pcbsd.org/index.php/What%27s_New/10.1) with some of their own unique features and changes
***
arc4random - Randomization for All Occasions (https://www.youtube.com/watch?v=aWmLWx8ut20)
Theo de Raadt gave an updated version of his EuroBSDCon presentation at Hackfest 2014 in Quebec
The presentation is mainly about OpenBSD's arc4random function, and outlines the overall poor state of randomization in the 90s and how it has evolved in OpenBSD over time
It begins with some interesting history on OpenBSD and how it became a security-focused OS - in 1996, their syslogd got broken into and "suddenly we became interested in security"
The talk also touches on how low-level changes can shake up the software ecosystem and third party packages that everyone uses
There's some funny history on the name of the function (being called arc4random despite not using RC4 anymore) and an overall status update on various platforms' usage of it
Very detailed and informative presentation, and the slides can be found here (http://www.openbsd.org/papers/hackfest2014-arc4random/index.html)
A great quote from the beginning: "We consider ourselves a community of (probably rather strange) people who work on software specifically for the purpose of trying to make it better. We take a 'whole-systems' approach: trying to change everything in the ecosystem that's under our control, trying to see if we can make it better. We gain a lot of strength by being able to throw backwards compatibility out the window. So that means that we're able to do research and the minute that we decide that something isn't right, we'll design an alternative for it and push it in. And if it ends up breaking everybody's machines from the previous stage to the next stage, that's fine because we'll end up in a happier place."
***
Interview - Justin Cormack - justin@netbsd.org (mailto:justin@netbsd.org) / @justincormack (https://twitter.com/justincormack)
NetBSD on Xen, rump kernels, various topics
News Roundup
The FreeBSD foundation's biggest donation (http://freebsdfoundation.blogspot.com/2014/11/freebsd-foundation-announces-generous.html)
The FreeBSD foundation has a new blog post about the largest donation they've ever gotten
From the CEO of WhatsApp comes a whopping one million dollars in a single donation
It also has some comments from the donor about why they use BSD and why it's important to give back
Be sure to donate to the foundation of whatever BSD you use when you can - every little bit helps, especially for OpenBSD (http://www.openbsd.org/donations.html), NetBSD (https://www.netbsd.org/donations/) and DragonFly (http://www.dragonflybsd.org/donations/) who don't have huge companies supporting them regularly like FreeBSD does
***
OpenZFS Dev Summit 2014 videos (http://open-zfs.org/wiki/OpenZFS_Developer_Summit)
Videos from the recent OpenZFS developer summit are being uploaded, with speakers from different represented platforms and companies

Matt Ahrens (http://www.bsdnow.tv/episodes/2014_05_14-bsdcanned_goods), opening keynote (https://www.youtube.com/watch?v=XnTzbisLYzg)

Raphael Carvalho, Platform Overview: ZFS on OSv (https://www.youtube.com/watch?v=TJLOBLSRoHE)

Brian Behlendorf, Platform Overview: ZFS on Linux (https://www.youtube.com/watch?v=_MVOpMNV7LY)

Prakash Surya, Platform Overview: illumos (https://www.youtube.com/watch?v=UtlGt3ag0o0)

Xin Li, Platform Overview: FreeBSD (https://www.youtube.com/watch?v=xO0x5_3A1X4)

All platforms, Group Q&amp;amp;A Session (https://www.youtube.com/watch?v=t4UlT0RmSCc)

Dave Pacheco, Manta (https://www.youtube.com/watch?v=BEoCMpdB8WU)

Saso Kiselkov, Compression (https://www.youtube.com/watch?v=TZF92taa_us)

George Wilson (http://www.bsdnow.tv/episodes/2013_12_04-zettabytes_for_days), Performance (https://www.youtube.com/watch?v=deJc0EMKrM4)

Tim Feldman, Host-Aware SMR (https://www.youtube.com/watch?v=b1yqjV8qemU)

Pavel Zakharov, Fast File Cloning (https://www.youtube.com/watch?v=-4c4gsLi1LI)

The audio is pretty poor (https://twitter.com/OpenZFS/status/534005125853888512) on all of them unfortunately
***
BSDTalk 248 (http://bsdtalk.blogspot.com/2014/11/bsdtalk248-dragonflybsd-with-matthew.html)
Our friend Will Backman is still busy getting BSD interviews as well
This time he sits down with Matthew Dillon, the lead developer of DragonFly BSD
We've never had Dillon on the show, so you'll definitely want to give this one a listen
They mainly discuss all the big changes coming in DragonFly's upcoming 4.0 release
***
MeetBSD 2014 videos (https://www.meetbsd.com/)
The presentations from this year's MeetBSD conference are starting to appear online as well

Kirk McKusick (http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache), A Narrative History of BSD (https://www.youtube.com/watch?v=DEEr6dT-4uQ)

Jordan Hubbard (http://www.bsdnow.tv/episodes/2013_11_27-bridging_the_gap), FreeBSD: The Next 10 Years (https://www.youtube.com/watch?v=Mri66Uz6-8Y)

Brendan Gregg, Performance Analysis (https://www.youtube.com/watch?v=uvKMptfXtdo)

The slides can be found here (https://www.meetbsd.com/agenda/) 
***
Feedback/Questions
Dominik writes in (http://slexy.org/view/s20PXjp55N)
Steven writes in (http://slexy.org/view/s2LwEYT3bA)
Florian writes in (http://slexy.org/view/s2ubK8vQVt)
Richard writes in (http://slexy.org/view/s216Eq8nFG)
Kevin writes in (http://slexy.org/view/s21D2ugDUy)
***
Mailing List Gold
Contributing without code (https://www.marc.info/?t=141600819500004&amp;amp;r=1&amp;amp;w=2)
Compression isn't a CRIME (https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-November/033176.html)
Securing web browsers (https://www.marc.info/?t=141616714600001&amp;amp;r=1&amp;amp;w=2)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, rump kernels, xen, userspace, networking, siphash, 10.1, review, 10.1 review, openzfs, zfs, devsummit, hackfest, arc4random, meetbsd, presentation</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ll be talking with Justin Cormack about NetBSD rump kernels. We&#39;ll learn how to run them on other operating systems, what&#39;s planned for the future and a lot more. As always, answers to viewer-submitted questions and all the news for the week, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.eurobsdcon.org/talks-and-schedule/" rel="nofollow">EuroBSDCon 2014 talks and tutorials</a></h3>

<ul>
<li>The 2014 EuroBSDCon videos have been online for over a month, but unannounced - keep in mind these links may be temporary (but we&#39;ll mention their new location in a future show and fix the show notes if that&#39;s the case)
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Arun Thomas, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/01.BSD-ARM%20Kernel%20Internals%20-%20Arun%20Thomas.mp4" rel="nofollow">BSD ARM Kernel Internals</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Ted Unangst, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/02.Developing%20Software%20in%20a%20Hostile%20Environment%20-%20Ted%20Unangst.mp4" rel="nofollow">Developing Software in a Hostile Environment</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Martin Pieuchot, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/03.Taming%20OpenBSD%20Network%20Stack%20Dragons%20-%20Martin%20Pieuchot.mp4" rel="nofollow">Taming OpenBSD Network Stack Dragons</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Henning Brauer, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/04.OpenBGPD%20turns%2010%20years%20-%20%20Henning%20Brauer.mp4" rel="nofollow">OpenBGPD turns 10 years</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Claudio Jeker, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/05.vscsi(4)%20and%20iscsid%20-%20iSCSI%20initiator%20the%20OpenBSD%20way%20-%20Claudio%20Jeker.mp4" rel="nofollow">vscsi and iscsid iSCSI initiator the OpenBSD way</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Paul Irofti, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/06.Making%20OpenBSD%20Useful%20on%20the%20Octeon%20Network%20Gear%20-%20Paul%20Irofti.mp4" rel="nofollow">Making OpenBSD Useful on the Octeon Network Gear</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Baptiste Daroussin, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/01.Cross%20Building%20the%20FreeBSD%20ports%20tree%20-%20Baptiste%20Daroussin.mp4" rel="nofollow">Cross Building the FreeBSD ports tree</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Boris Astardzhiev, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/02.Smartcom%e2%80%99s%20control%20plane%20software,%20a%20customized%20version%20of%20FreeBSD%20-%20Boris%20Astardzhiev.mp4" rel="nofollow">Smartcom’s control plane software, a customized version of FreeBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Michał Dubiel, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/03.OpenStack%20and%20OpenContrail%20for%20FreeBSD%20platform%20-%20Micha%c5%82%20Dubiel.mp4" rel="nofollow">OpenStack and OpenContrail for FreeBSD platform</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Martin Husemann &amp; Joerg Sonnenberger, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/04.(Tool-)chaining%20the%20Hydra%20The%20ongoing%20quest%20for%20modern%20toolchains%20in%20NetBSD%20-%20Martin%20Huseman%20&%20Joerg%20Sonnenberger.mp4" rel="nofollow">Tool-chaining the Hydra, the ongoing quest for modern toolchains in NetBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Taylor R Campbell, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/05.The%20entropic%20principle:%20dev-u%3frandom%20and%20NetBSD%20-%20Taylor%20R%20Campbell.mp4" rel="nofollow">The entropic principle: /dev/u?random and NetBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Dag-Erling Smørgrav, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/06.Securing%20sensitive%20&%20restricted%20data%20-%20Dag-Erling%20Sm%c3%b8rgrav.mp4" rel="nofollow">Securing sensitive &amp; restricted data</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Peter Hansteen, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/01.Thursday/01.Building%20The%20Network%20You%20Need%20With%20PF%20-%20Peter%20Hansteen.mp4" rel="nofollow">Building The Network You Need</a> <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/01.Thursday/02.Building%20The%20Network%20You%20Need%20With%20PF%20-%20Peter%20Hansteen.mp4" rel="nofollow">With PF</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Stefan Sperling, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/01.Thursday/03.Subversion%20for%20FreeBSD%20developers%20-%20Stefan%20Sperling.mp4" rel="nofollow">Subversion for FreeBSD developers</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Peter Hansteen, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/01.Transition%20to%20OpenBSD%205.6%20-%20Peter%20Hansteen.mp4" rel="nofollow">Transition to</a> <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/02.Transition%20to%20OpenBSD%205.6%20-%20Peter%20Hansteen.mp4" rel="nofollow">OpenBSD 5.6</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Ingo Schwarze, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/03.Let%e2%80%99s%20make%20manuals%20more%20useful%20-%20Ingo%20Schwarze.mp4" rel="nofollow">Let’s make manuals</a> <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/04.Let%e2%80%99s%20make%20manuals%20more%20useful%20-%20Ingo%20Schwarze.mp4" rel="nofollow">more useful</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Francois Tigeot, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/01.Improving%20DragonFly%e2%80%99s%20performance%20with%20PostgreSQL%20-%20Francois%20Tigeot.mp4" rel="nofollow">Improving DragonFly’s performance with PostgreSQL</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Justin Cormack, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/02.Running%20Applications%20on%20the%20NetBSD%20Rump%20Kernel%20-%20Justin%20Cormack.mp4" rel="nofollow">Running Applications on the NetBSD Rump Kernel</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Pierre Pronchery, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/04.EdgeBSD,%20a%20year%20later%20-%20%20Pierre%20Pronchery.mp4" rel="nofollow">EdgeBSD, a year later</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Peter Hessler, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/05.Using%20routing%20domains%20or%20tables%20in%20a%20production%20network%20-%20%20Peter%20Hessler.mp4" rel="nofollow">Using routing domains or tables in a production network</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Sean Bruno, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/06.QEMU%20user%20mode%20on%20FreeBSD%20-%20%20Sean%20Bruno.mp4" rel="nofollow">QEMU user mode on FreeBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Kristaps Dzonsons, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/01.Bugs%20Ex%20Ante%20-%20Kristaps%20Dzonsons.mp4" rel="nofollow">Bugs Ex Ante</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Yann Sionneau, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/02.Porting%20NetBSD%20to%20the%20LatticeMico32%20open%20source%20CPU%20-%20Yann%20Sionneau.mp4" rel="nofollow">Porting NetBSD to the LatticeMico32 open source CPU</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Alexander Nasonov, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/03.JIT%20Code%20Generator%20for%20NetBSD%20-%20Alexander%20Nasonov.mp4" rel="nofollow">JIT Code Generator for NetBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Masao Uebayashi, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/04.Porting%20Valgrind%20to%20NetBSD%20and%20OpenBSD%20-%20Masao%20Uebayashi.mp4" rel="nofollow">Porting Valgrind to NetBSD and OpenBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Marc Espie, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/05.parallel%20make:%20working%20with%20legacy%20code%20-%20Marc%20Espie.mp4" rel="nofollow">parallel make, working with legacy code</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Francois Tigeot, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/06.Porting%20the%20drm-kms%20graphic%20drivers%20to%20DragonFly%20-%20Francois%20Tigeot.mp4" rel="nofollow">Porting the drm-kms graphic drivers to DragonFly</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li><strong>The following talks (from the Vitosha track room) are all currently missing:</strong></li>
<li>Jordan Hubbard, FreeBSD, Looking forward to another 10 years (but we have another recording)</li>
<li>Theo de Raadt, Randomness, how arc4random has grown since 1998 (but we have another recording)</li>
<li>Kris Moore, Snapshots, Replication, and Boot-Environments</li>
<li>Kirk McKusick, An Introduction to the Implementation of ZFS</li>
<li>John-Mark Gurney, Optimizing GELI Performance</li>
<li>Emmanuel Dreyfus, FUSE and beyond, bridging filesystems</li>
<li>Lourival Vieira Neto, NPF scripting with Lua</li>
<li>Andy Tanenbaum, A Reimplementation of NetBSD Based on a Microkernel</li>
<li>Stefano Garzarella, Software segmentation offloading for FreeBSD</li>
<li>Ted Unangst, LibreSSL</li>
<li>Shawn Webb, Introducing ASLR In FreeBSD</li>
<li>Ed Maste, The LLDB Debugger in FreeBSD</li>
<li>Philip Guenther, Secure lazy binding
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=141614801713457&w=2" rel="nofollow">OpenBSD adopts SipHash</a></h3>

<ul>
<li>Even more DJB crypto somehow finds its way into OpenBSD&#39;s base system</li>
<li>This time it&#39;s <a href="https://131002.net/siphash/" rel="nofollow">SipHash</a>, a family of pseudorandom functions that&#39;s resistant to hash bucket flooding attacks while still providing good performance</li>
<li>After an <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/crypto/siphash.c?rev=1.1&content-type=text/x-cvsweb-markup" rel="nofollow">initial import</a> and some <a href="https://www.marc.info/?l=openbsd-cvs&m=141604896822253&w=2" rel="nofollow">clever early usage</a>, a few developers agreed that it would be better to use it in a lot more places</li>
<li>It will now be used in the filesystem, and the plan is to utilize it to protect <strong>all kernel hash functions</strong></li>
<li>Some <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">other places</a> that Bernstein&#39;s work can be found in OpenBSD include the ChaCha20-Poly1305 authenticated stream cipher and Curve25519 KEX used in SSH, ChaCha20 used in the RNG, and Ed25519 keys used in <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">signify</a> and SSH
***</li>
</ul>

<h3><a href="https://www.freebsd.org/releases/10.1R/announce.html" rel="nofollow">FreeBSD 10.1-RELEASE</a></h3>

<ul>
<li>FreeBSD&#39;s <a href="http://www.bsdnow.tv/episodes/2013-09-11_engineering_powder_kegs" rel="nofollow">release engineering team</a> likes to troll us by uploading new versions just a few hours after we finish recording an episode</li>
<li>The first maintenance update for the 10.x branch is out, improving upon a lot of things found in 10.0-RELEASE</li>
<li>The vt driver was merged from -CURRENT and can now be enabled with a loader.conf switch (and can even be used on a PlayStation 3)</li>
<li>Bhyve has gotten quite a lot of fixes and improvements from its initial debut in 10.0, including boot support for ZFS</li>
<li>Lots of new ARM hardware is supported now, including SMP support for most of them</li>
<li>A new kernel selection menu was added to the loader, so you can switch between newer and older kernels at boot time</li>
<li>10.1 is the first to support UEFI booting on amd64, which also has serial console support now</li>
<li>Lots of third party software (OpenSSH, OpenSSL, Unbound..) and drivers have gotten updates to newer versions</li>
<li>It&#39;s a worthy update from 10.0, or a good time to try the 10.x branch if you were avoiding the first .0 release, so <a href="http://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-amd64/10.1/" rel="nofollow">grab an ISO</a> or <a href="https://www.freebsd.org/cgi/man.cgi?query=freebsd-update" rel="nofollow">upgrade</a> today</li>
<li>Check the <a href="https://www.freebsd.org/releases/10.1R/relnotes.html" rel="nofollow">detailed release notes</a> for more information on all the changes</li>
<li>Also take a look at some of the <a href="https://www.freebsd.org/releases/10.1R/errata.html#open-issues" rel="nofollow">known problems</a> to see <a href="https://forums.freebsd.org/threads/segmentation-fault-while-upgrading-from-10-0-release-to-10-1-release.48977/" rel="nofollow">if</a> <a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-October/080599.html" rel="nofollow">you&#39;ll</a> <a href="https://forums.freebsd.org/threads/10-0-10-1-diocaddrule-operation-not-supported-by-device.49016/" rel="nofollow">be</a> <a href="https://www.reddit.com/r/freebsd/comments/2mmzzy/101release_restart_problems_anyone/" rel="nofollow">affected</a> by any of them</li>
<li>PC-BSD was also <a href="http://wiki.pcbsd.org/index.php/What%27s_New/10.1" rel="nofollow">updated accordingly</a> with some of their own unique features and changes
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=aWmLWx8ut20" rel="nofollow">arc4random - Randomization for All Occasions</a></h3>

<ul>
<li>Theo de Raadt gave an updated version of his EuroBSDCon presentation at Hackfest 2014 in Quebec</li>
<li>The presentation is mainly about OpenBSD&#39;s arc4random function, and outlines the overall poor state of randomization in the 90s and how it has evolved in OpenBSD over time</li>
<li>It begins with some interesting history on OpenBSD and how it became a security-focused OS - in 1996, their syslogd got broken into and &quot;suddenly we became interested in security&quot;</li>
<li>The talk also touches on how low-level changes can shake up the software ecosystem and third party packages that everyone uses</li>
<li>There&#39;s some funny history on the name of the function (being called arc4random despite not using RC4 anymore) and an overall status update on various platforms&#39; usage of it</li>
<li>Very detailed and informative presentation, and the slides can be found <a href="http://www.openbsd.org/papers/hackfest2014-arc4random/index.html" rel="nofollow">here</a></li>
<li>A great quote from the beginning: &quot;We consider ourselves a community of (probably rather strange) people who work on software specifically for the purpose of trying to make it better. We take a &#39;whole-systems&#39; approach: trying to change everything in the ecosystem that&#39;s under our control, trying to see if we can make it better. We gain a lot of strength by being able to throw backwards compatibility out the window. So that means that we&#39;re able to do research and the minute that we decide that something isn&#39;t right, we&#39;ll design an alternative for it and push it in. And if it ends up breaking everybody&#39;s machines from the previous stage to the next stage, that&#39;s fine because we&#39;ll end up in a happier place.&quot;
***</li>
</ul>

<h2>Interview - Justin Cormack - <a href="mailto:justin@netbsd.org" rel="nofollow">justin@netbsd.org</a> / <a href="https://twitter.com/justincormack" rel="nofollow">@justincormack</a></h2>

<p>NetBSD on Xen, rump kernels, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/11/freebsd-foundation-announces-generous.html" rel="nofollow">The FreeBSD foundation&#39;s biggest donation</a></h3>

<ul>
<li>The FreeBSD foundation has a new blog post about the largest donation they&#39;ve ever gotten</li>
<li>From the CEO of WhatsApp comes a whopping one million dollars in a single donation</li>
<li>It also has some comments from the donor about why they use BSD and why it&#39;s important to give back</li>
<li>Be sure to donate to the foundation of whatever BSD you use when you can - every little bit helps, especially for <a href="http://www.openbsd.org/donations.html" rel="nofollow">OpenBSD</a>, <a href="https://www.netbsd.org/donations/" rel="nofollow">NetBSD</a> and <a href="http://www.dragonflybsd.org/donations/" rel="nofollow">DragonFly</a> who don&#39;t have huge companies supporting them regularly like FreeBSD does
***</li>
</ul>

<h3><a href="http://open-zfs.org/wiki/OpenZFS_Developer_Summit" rel="nofollow">OpenZFS Dev Summit 2014 videos</a></h3>

<ul>
<li>Videos from the recent OpenZFS developer summit are being uploaded, with speakers from different represented platforms and companies
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_05_14-bsdcanned_goods" rel="nofollow">Matt Ahrens</a>, <a href="https://www.youtube.com/watch?v=XnTzbisLYzg" rel="nofollow">opening keynote</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Raphael Carvalho, <a href="https://www.youtube.com/watch?v=TJLOBLSRoHE" rel="nofollow">Platform Overview: ZFS on OSv</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Brian Behlendorf, <a href="https://www.youtube.com/watch?v=_MVOpMNV7LY" rel="nofollow">Platform Overview: ZFS on Linux</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Prakash Surya, <a href="https://www.youtube.com/watch?v=UtlGt3ag0o0" rel="nofollow">Platform Overview: illumos</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Xin Li, <a href="https://www.youtube.com/watch?v=xO0x5_3A1X4" rel="nofollow">Platform Overview: FreeBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>All platforms, <a href="https://www.youtube.com/watch?v=t4UlT0RmSCc" rel="nofollow">Group Q&amp;A Session</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Dave Pacheco, <a href="https://www.youtube.com/watch?v=BEoCMpdB8WU" rel="nofollow">Manta</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Saso Kiselkov, <a href="https://www.youtube.com/watch?v=TZF92taa_us" rel="nofollow">Compression</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_12_04-zettabytes_for_days" rel="nofollow">George Wilson</a>, <a href="https://www.youtube.com/watch?v=deJc0EMKrM4" rel="nofollow">Performance</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Tim Feldman, <a href="https://www.youtube.com/watch?v=b1yqjV8qemU" rel="nofollow">Host-Aware SMR</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Pavel Zakharov, <a href="https://www.youtube.com/watch?v=-4c4gsLi1LI" rel="nofollow">Fast File Cloning</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>The audio is <a href="https://twitter.com/OpenZFS/status/534005125853888512" rel="nofollow">pretty poor</a> on all of them unfortunately
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2014/11/bsdtalk248-dragonflybsd-with-matthew.html" rel="nofollow">BSDTalk 248</a></h3>

<ul>
<li>Our friend Will Backman is still busy getting BSD interviews as well</li>
<li>This time he sits down with Matthew Dillon, the lead developer of DragonFly BSD</li>
<li>We&#39;ve never had Dillon on the show, so you&#39;ll definitely want to give this one a listen</li>
<li>They mainly discuss all the big changes coming in DragonFly&#39;s upcoming 4.0 release
***</li>
</ul>

<h3><a href="https://www.meetbsd.com/" rel="nofollow">MeetBSD 2014 videos</a></h3>

<ul>
<li>The presentations from this year&#39;s MeetBSD conference are starting to appear online as well
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li><a href="http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache" rel="nofollow">Kirk McKusick</a>, <a href="https://www.youtube.com/watch?v=DEEr6dT-4uQ" rel="nofollow">A Narrative History of BSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_27-bridging_the_gap" rel="nofollow">Jordan Hubbard</a>, <a href="https://www.youtube.com/watch?v=Mri66Uz6-8Y" rel="nofollow">FreeBSD: The Next 10 Years</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Brendan Gregg, <a href="https://www.youtube.com/watch?v=uvKMptfXtdo" rel="nofollow">Performance Analysis</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>The slides can be found <a href="https://www.meetbsd.com/agenda/" rel="nofollow">here</a> 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20PXjp55N" rel="nofollow">Dominik writes in</a></li>
<li><a href="http://slexy.org/view/s2LwEYT3bA" rel="nofollow">Steven writes in</a></li>
<li><a href="http://slexy.org/view/s2ubK8vQVt" rel="nofollow">Florian writes in</a></li>
<li><a href="http://slexy.org/view/s216Eq8nFG" rel="nofollow">Richard writes in</a></li>
<li><a href="http://slexy.org/view/s21D2ugDUy" rel="nofollow">Kevin writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?t=141600819500004&r=1&w=2" rel="nofollow">Contributing without code</a></li>
<li><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-November/033176.html" rel="nofollow">Compression isn&#39;t a CRIME</a></li>
<li><a href="https://www.marc.info/?t=141616714600001&r=1&w=2" rel="nofollow">Securing web browsers</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ll be talking with Justin Cormack about NetBSD rump kernels. We&#39;ll learn how to run them on other operating systems, what&#39;s planned for the future and a lot more. As always, answers to viewer-submitted questions and all the news for the week, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.eurobsdcon.org/talks-and-schedule/" rel="nofollow">EuroBSDCon 2014 talks and tutorials</a></h3>

<ul>
<li>The 2014 EuroBSDCon videos have been online for over a month, but unannounced - keep in mind these links may be temporary (but we&#39;ll mention their new location in a future show and fix the show notes if that&#39;s the case)
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Arun Thomas, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/01.BSD-ARM%20Kernel%20Internals%20-%20Arun%20Thomas.mp4" rel="nofollow">BSD ARM Kernel Internals</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Ted Unangst, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/02.Developing%20Software%20in%20a%20Hostile%20Environment%20-%20Ted%20Unangst.mp4" rel="nofollow">Developing Software in a Hostile Environment</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Martin Pieuchot, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/03.Taming%20OpenBSD%20Network%20Stack%20Dragons%20-%20Martin%20Pieuchot.mp4" rel="nofollow">Taming OpenBSD Network Stack Dragons</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Henning Brauer, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/04.OpenBGPD%20turns%2010%20years%20-%20%20Henning%20Brauer.mp4" rel="nofollow">OpenBGPD turns 10 years</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Claudio Jeker, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/05.vscsi(4)%20and%20iscsid%20-%20iSCSI%20initiator%20the%20OpenBSD%20way%20-%20Claudio%20Jeker.mp4" rel="nofollow">vscsi and iscsid iSCSI initiator the OpenBSD way</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Paul Irofti, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/03.Saturday/06.Making%20OpenBSD%20Useful%20on%20the%20Octeon%20Network%20Gear%20-%20Paul%20Irofti.mp4" rel="nofollow">Making OpenBSD Useful on the Octeon Network Gear</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Baptiste Daroussin, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/01.Cross%20Building%20the%20FreeBSD%20ports%20tree%20-%20Baptiste%20Daroussin.mp4" rel="nofollow">Cross Building the FreeBSD ports tree</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Boris Astardzhiev, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/02.Smartcom%e2%80%99s%20control%20plane%20software,%20a%20customized%20version%20of%20FreeBSD%20-%20Boris%20Astardzhiev.mp4" rel="nofollow">Smartcom’s control plane software, a customized version of FreeBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Michał Dubiel, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/03.OpenStack%20and%20OpenContrail%20for%20FreeBSD%20platform%20-%20Micha%c5%82%20Dubiel.mp4" rel="nofollow">OpenStack and OpenContrail for FreeBSD platform</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Martin Husemann &amp; Joerg Sonnenberger, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/04.(Tool-)chaining%20the%20Hydra%20The%20ongoing%20quest%20for%20modern%20toolchains%20in%20NetBSD%20-%20Martin%20Huseman%20&%20Joerg%20Sonnenberger.mp4" rel="nofollow">Tool-chaining the Hydra, the ongoing quest for modern toolchains in NetBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Taylor R Campbell, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/05.The%20entropic%20principle:%20dev-u%3frandom%20and%20NetBSD%20-%20Taylor%20R%20Campbell.mp4" rel="nofollow">The entropic principle: /dev/u?random and NetBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Dag-Erling Smørgrav, <a href="https://va.ludost.net/files/eurobsdcon/2014/Rodopi/04.Sunday/06.Securing%20sensitive%20&%20restricted%20data%20-%20Dag-Erling%20Sm%c3%b8rgrav.mp4" rel="nofollow">Securing sensitive &amp; restricted data</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Peter Hansteen, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/01.Thursday/01.Building%20The%20Network%20You%20Need%20With%20PF%20-%20Peter%20Hansteen.mp4" rel="nofollow">Building The Network You Need</a> <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/01.Thursday/02.Building%20The%20Network%20You%20Need%20With%20PF%20-%20Peter%20Hansteen.mp4" rel="nofollow">With PF</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Stefan Sperling, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/01.Thursday/03.Subversion%20for%20FreeBSD%20developers%20-%20Stefan%20Sperling.mp4" rel="nofollow">Subversion for FreeBSD developers</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Peter Hansteen, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/01.Transition%20to%20OpenBSD%205.6%20-%20Peter%20Hansteen.mp4" rel="nofollow">Transition to</a> <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/02.Transition%20to%20OpenBSD%205.6%20-%20Peter%20Hansteen.mp4" rel="nofollow">OpenBSD 5.6</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Ingo Schwarze, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/03.Let%e2%80%99s%20make%20manuals%20more%20useful%20-%20Ingo%20Schwarze.mp4" rel="nofollow">Let’s make manuals</a> <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/02.Friday/04.Let%e2%80%99s%20make%20manuals%20more%20useful%20-%20Ingo%20Schwarze.mp4" rel="nofollow">more useful</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Francois Tigeot, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/01.Improving%20DragonFly%e2%80%99s%20performance%20with%20PostgreSQL%20-%20Francois%20Tigeot.mp4" rel="nofollow">Improving DragonFly’s performance with PostgreSQL</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Justin Cormack, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/02.Running%20Applications%20on%20the%20NetBSD%20Rump%20Kernel%20-%20Justin%20Cormack.mp4" rel="nofollow">Running Applications on the NetBSD Rump Kernel</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Pierre Pronchery, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/04.EdgeBSD,%20a%20year%20later%20-%20%20Pierre%20Pronchery.mp4" rel="nofollow">EdgeBSD, a year later</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Peter Hessler, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/05.Using%20routing%20domains%20or%20tables%20in%20a%20production%20network%20-%20%20Peter%20Hessler.mp4" rel="nofollow">Using routing domains or tables in a production network</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Sean Bruno, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/03.Saturday/06.QEMU%20user%20mode%20on%20FreeBSD%20-%20%20Sean%20Bruno.mp4" rel="nofollow">QEMU user mode on FreeBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Kristaps Dzonsons, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/01.Bugs%20Ex%20Ante%20-%20Kristaps%20Dzonsons.mp4" rel="nofollow">Bugs Ex Ante</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Yann Sionneau, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/02.Porting%20NetBSD%20to%20the%20LatticeMico32%20open%20source%20CPU%20-%20Yann%20Sionneau.mp4" rel="nofollow">Porting NetBSD to the LatticeMico32 open source CPU</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Alexander Nasonov, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/03.JIT%20Code%20Generator%20for%20NetBSD%20-%20Alexander%20Nasonov.mp4" rel="nofollow">JIT Code Generator for NetBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Masao Uebayashi, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/04.Porting%20Valgrind%20to%20NetBSD%20and%20OpenBSD%20-%20Masao%20Uebayashi.mp4" rel="nofollow">Porting Valgrind to NetBSD and OpenBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Marc Espie, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/05.parallel%20make:%20working%20with%20legacy%20code%20-%20Marc%20Espie.mp4" rel="nofollow">parallel make, working with legacy code</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Francois Tigeot, <a href="https://va.ludost.net/files/eurobsdcon/2014/Pirin/04.Sunday/06.Porting%20the%20drm-kms%20graphic%20drivers%20to%20DragonFly%20-%20Francois%20Tigeot.mp4" rel="nofollow">Porting the drm-kms graphic drivers to DragonFly</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li><strong>The following talks (from the Vitosha track room) are all currently missing:</strong></li>
<li>Jordan Hubbard, FreeBSD, Looking forward to another 10 years (but we have another recording)</li>
<li>Theo de Raadt, Randomness, how arc4random has grown since 1998 (but we have another recording)</li>
<li>Kris Moore, Snapshots, Replication, and Boot-Environments</li>
<li>Kirk McKusick, An Introduction to the Implementation of ZFS</li>
<li>John-Mark Gurney, Optimizing GELI Performance</li>
<li>Emmanuel Dreyfus, FUSE and beyond, bridging filesystems</li>
<li>Lourival Vieira Neto, NPF scripting with Lua</li>
<li>Andy Tanenbaum, A Reimplementation of NetBSD Based on a Microkernel</li>
<li>Stefano Garzarella, Software segmentation offloading for FreeBSD</li>
<li>Ted Unangst, LibreSSL</li>
<li>Shawn Webb, Introducing ASLR In FreeBSD</li>
<li>Ed Maste, The LLDB Debugger in FreeBSD</li>
<li>Philip Guenther, Secure lazy binding
***</li>
</ul>

<h3><a href="https://www.marc.info/?l=openbsd-tech&m=141614801713457&w=2" rel="nofollow">OpenBSD adopts SipHash</a></h3>

<ul>
<li>Even more DJB crypto somehow finds its way into OpenBSD&#39;s base system</li>
<li>This time it&#39;s <a href="https://131002.net/siphash/" rel="nofollow">SipHash</a>, a family of pseudorandom functions that&#39;s resistant to hash bucket flooding attacks while still providing good performance</li>
<li>After an <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/crypto/siphash.c?rev=1.1&content-type=text/x-cvsweb-markup" rel="nofollow">initial import</a> and some <a href="https://www.marc.info/?l=openbsd-cvs&m=141604896822253&w=2" rel="nofollow">clever early usage</a>, a few developers agreed that it would be better to use it in a lot more places</li>
<li>It will now be used in the filesystem, and the plan is to utilize it to protect <strong>all kernel hash functions</strong></li>
<li>Some <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">other places</a> that Bernstein&#39;s work can be found in OpenBSD include the ChaCha20-Poly1305 authenticated stream cipher and Curve25519 KEX used in SSH, ChaCha20 used in the RNG, and Ed25519 keys used in <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">signify</a> and SSH
***</li>
</ul>

<h3><a href="https://www.freebsd.org/releases/10.1R/announce.html" rel="nofollow">FreeBSD 10.1-RELEASE</a></h3>

<ul>
<li>FreeBSD&#39;s <a href="http://www.bsdnow.tv/episodes/2013-09-11_engineering_powder_kegs" rel="nofollow">release engineering team</a> likes to troll us by uploading new versions just a few hours after we finish recording an episode</li>
<li>The first maintenance update for the 10.x branch is out, improving upon a lot of things found in 10.0-RELEASE</li>
<li>The vt driver was merged from -CURRENT and can now be enabled with a loader.conf switch (and can even be used on a PlayStation 3)</li>
<li>Bhyve has gotten quite a lot of fixes and improvements from its initial debut in 10.0, including boot support for ZFS</li>
<li>Lots of new ARM hardware is supported now, including SMP support for most of them</li>
<li>A new kernel selection menu was added to the loader, so you can switch between newer and older kernels at boot time</li>
<li>10.1 is the first to support UEFI booting on amd64, which also has serial console support now</li>
<li>Lots of third party software (OpenSSH, OpenSSL, Unbound..) and drivers have gotten updates to newer versions</li>
<li>It&#39;s a worthy update from 10.0, or a good time to try the 10.x branch if you were avoiding the first .0 release, so <a href="http://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-amd64/10.1/" rel="nofollow">grab an ISO</a> or <a href="https://www.freebsd.org/cgi/man.cgi?query=freebsd-update" rel="nofollow">upgrade</a> today</li>
<li>Check the <a href="https://www.freebsd.org/releases/10.1R/relnotes.html" rel="nofollow">detailed release notes</a> for more information on all the changes</li>
<li>Also take a look at some of the <a href="https://www.freebsd.org/releases/10.1R/errata.html#open-issues" rel="nofollow">known problems</a> to see <a href="https://forums.freebsd.org/threads/segmentation-fault-while-upgrading-from-10-0-release-to-10-1-release.48977/" rel="nofollow">if</a> <a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-October/080599.html" rel="nofollow">you&#39;ll</a> <a href="https://forums.freebsd.org/threads/10-0-10-1-diocaddrule-operation-not-supported-by-device.49016/" rel="nofollow">be</a> <a href="https://www.reddit.com/r/freebsd/comments/2mmzzy/101release_restart_problems_anyone/" rel="nofollow">affected</a> by any of them</li>
<li>PC-BSD was also <a href="http://wiki.pcbsd.org/index.php/What%27s_New/10.1" rel="nofollow">updated accordingly</a> with some of their own unique features and changes
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=aWmLWx8ut20" rel="nofollow">arc4random - Randomization for All Occasions</a></h3>

<ul>
<li>Theo de Raadt gave an updated version of his EuroBSDCon presentation at Hackfest 2014 in Quebec</li>
<li>The presentation is mainly about OpenBSD&#39;s arc4random function, and outlines the overall poor state of randomization in the 90s and how it has evolved in OpenBSD over time</li>
<li>It begins with some interesting history on OpenBSD and how it became a security-focused OS - in 1996, their syslogd got broken into and &quot;suddenly we became interested in security&quot;</li>
<li>The talk also touches on how low-level changes can shake up the software ecosystem and third party packages that everyone uses</li>
<li>There&#39;s some funny history on the name of the function (being called arc4random despite not using RC4 anymore) and an overall status update on various platforms&#39; usage of it</li>
<li>Very detailed and informative presentation, and the slides can be found <a href="http://www.openbsd.org/papers/hackfest2014-arc4random/index.html" rel="nofollow">here</a></li>
<li>A great quote from the beginning: &quot;We consider ourselves a community of (probably rather strange) people who work on software specifically for the purpose of trying to make it better. We take a &#39;whole-systems&#39; approach: trying to change everything in the ecosystem that&#39;s under our control, trying to see if we can make it better. We gain a lot of strength by being able to throw backwards compatibility out the window. So that means that we&#39;re able to do research and the minute that we decide that something isn&#39;t right, we&#39;ll design an alternative for it and push it in. And if it ends up breaking everybody&#39;s machines from the previous stage to the next stage, that&#39;s fine because we&#39;ll end up in a happier place.&quot;
***</li>
</ul>

<h2>Interview - Justin Cormack - <a href="mailto:justin@netbsd.org" rel="nofollow">justin@netbsd.org</a> / <a href="https://twitter.com/justincormack" rel="nofollow">@justincormack</a></h2>

<p>NetBSD on Xen, rump kernels, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/11/freebsd-foundation-announces-generous.html" rel="nofollow">The FreeBSD foundation&#39;s biggest donation</a></h3>

<ul>
<li>The FreeBSD foundation has a new blog post about the largest donation they&#39;ve ever gotten</li>
<li>From the CEO of WhatsApp comes a whopping one million dollars in a single donation</li>
<li>It also has some comments from the donor about why they use BSD and why it&#39;s important to give back</li>
<li>Be sure to donate to the foundation of whatever BSD you use when you can - every little bit helps, especially for <a href="http://www.openbsd.org/donations.html" rel="nofollow">OpenBSD</a>, <a href="https://www.netbsd.org/donations/" rel="nofollow">NetBSD</a> and <a href="http://www.dragonflybsd.org/donations/" rel="nofollow">DragonFly</a> who don&#39;t have huge companies supporting them regularly like FreeBSD does
***</li>
</ul>

<h3><a href="http://open-zfs.org/wiki/OpenZFS_Developer_Summit" rel="nofollow">OpenZFS Dev Summit 2014 videos</a></h3>

<ul>
<li>Videos from the recent OpenZFS developer summit are being uploaded, with speakers from different represented platforms and companies
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_05_14-bsdcanned_goods" rel="nofollow">Matt Ahrens</a>, <a href="https://www.youtube.com/watch?v=XnTzbisLYzg" rel="nofollow">opening keynote</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Raphael Carvalho, <a href="https://www.youtube.com/watch?v=TJLOBLSRoHE" rel="nofollow">Platform Overview: ZFS on OSv</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Brian Behlendorf, <a href="https://www.youtube.com/watch?v=_MVOpMNV7LY" rel="nofollow">Platform Overview: ZFS on Linux</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Prakash Surya, <a href="https://www.youtube.com/watch?v=UtlGt3ag0o0" rel="nofollow">Platform Overview: illumos</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Xin Li, <a href="https://www.youtube.com/watch?v=xO0x5_3A1X4" rel="nofollow">Platform Overview: FreeBSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>All platforms, <a href="https://www.youtube.com/watch?v=t4UlT0RmSCc" rel="nofollow">Group Q&amp;A Session</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Dave Pacheco, <a href="https://www.youtube.com/watch?v=BEoCMpdB8WU" rel="nofollow">Manta</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Saso Kiselkov, <a href="https://www.youtube.com/watch?v=TZF92taa_us" rel="nofollow">Compression</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_12_04-zettabytes_for_days" rel="nofollow">George Wilson</a>, <a href="https://www.youtube.com/watch?v=deJc0EMKrM4" rel="nofollow">Performance</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Tim Feldman, <a href="https://www.youtube.com/watch?v=b1yqjV8qemU" rel="nofollow">Host-Aware SMR</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Pavel Zakharov, <a href="https://www.youtube.com/watch?v=-4c4gsLi1LI" rel="nofollow">Fast File Cloning</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>The audio is <a href="https://twitter.com/OpenZFS/status/534005125853888512" rel="nofollow">pretty poor</a> on all of them unfortunately
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2014/11/bsdtalk248-dragonflybsd-with-matthew.html" rel="nofollow">BSDTalk 248</a></h3>

<ul>
<li>Our friend Will Backman is still busy getting BSD interviews as well</li>
<li>This time he sits down with Matthew Dillon, the lead developer of DragonFly BSD</li>
<li>We&#39;ve never had Dillon on the show, so you&#39;ll definitely want to give this one a listen</li>
<li>They mainly discuss all the big changes coming in DragonFly&#39;s upcoming 4.0 release
***</li>
</ul>

<h3><a href="https://www.meetbsd.com/" rel="nofollow">MeetBSD 2014 videos</a></h3>

<ul>
<li>The presentations from this year&#39;s MeetBSD conference are starting to appear online as well
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li><a href="http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache" rel="nofollow">Kirk McKusick</a>, <a href="https://www.youtube.com/watch?v=DEEr6dT-4uQ" rel="nofollow">A Narrative History of BSD</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_27-bridging_the_gap" rel="nofollow">Jordan Hubbard</a>, <a href="https://www.youtube.com/watch?v=Mri66Uz6-8Y" rel="nofollow">FreeBSD: The Next 10 Years</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>Brendan Gregg, <a href="https://www.youtube.com/watch?v=uvKMptfXtdo" rel="nofollow">Performance Analysis</a>
&lt;!-- i wonder if freebsdnews will rip our html again and repost it <sup>_^</sup> --&gt;</li>
<li>The slides can be found <a href="https://www.meetbsd.com/agenda/" rel="nofollow">here</a> 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20PXjp55N" rel="nofollow">Dominik writes in</a></li>
<li><a href="http://slexy.org/view/s2LwEYT3bA" rel="nofollow">Steven writes in</a></li>
<li><a href="http://slexy.org/view/s2ubK8vQVt" rel="nofollow">Florian writes in</a></li>
<li><a href="http://slexy.org/view/s216Eq8nFG" rel="nofollow">Richard writes in</a></li>
<li><a href="http://slexy.org/view/s21D2ugDUy" rel="nofollow">Kevin writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?t=141600819500004&r=1&w=2" rel="nofollow">Contributing without code</a></li>
<li><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-November/033176.html" rel="nofollow">Compression isn&#39;t a CRIME</a></li>
<li><a href="https://www.marc.info/?t=141616714600001&r=1&w=2" rel="nofollow">Securing web browsers</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>63: A Man's man(1)</title>
  <link>https://www.bsdnow.tv/63</link>
  <guid isPermaLink="false">0dbe70cc-bfdd-4af8-b67f-a5d1e85b7115</guid>
  <pubDate>Wed, 12 Nov 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0dbe70cc-bfdd-4af8-b67f-a5d1e85b7115.mp3" length="70356244" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we've got an interview with Kristaps Džonsons, the creator of mandoc. He tells us how the project got started and what its current status is across the various BSDs. We also have a mini-tutorial on using PF to throttle bandwidth. This week's news, answers to your emails and even some cheesy mailing list gold, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:37:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we've got an interview with Kristaps Džonsons, the creator of mandoc. He tells us how the project got started and what its current status is across the various BSDs. We also have a mini-tutorial on using PF to throttle bandwidth. This week's news, answers to your emails and even some cheesy mailing list gold, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
Updates to FreeBSD's random(4) (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=273872)
FreeBSD's random device, which presents itself as "/dev/random" to users (https://news.ycombinator.com/item?id=8550457), has gotten a fairly major overhaul in -CURRENT
The CSPRNG (cryptographically secure pseudo-random number generator) algorithm, Yarrow, now has a new alternative called Fortuna
Yarrow is still the default for now, but Fortuna can be used with a kernel option (and will likely be the new default in 11.0-RELEASE)
Pluggable modules can now be written to add more sources of entropy
These changes are expected to make it in 11.0-RELEASE, but there hasn't been any mention of MFCing them to 10 or 9
***
OpenBSD Tor relays and network diversity (https://lists.torproject.org/pipermail/tor-relays/2014-November/005661.html)
We've talked about getting more BSD-based Tor nodes (http://lists.nycbug.org/mailman/listinfo/tor-bsd) a few times in previous episodes
The "tor-relays" mailing list has had some recent discussion about increasing diversity in the Tor network, specifically by adding more OpenBSD nodes
With the security features and attention to detail, it makes for an excellent dedicated Tor box
More and more adversaries are attacking Tor nodes, so having something that can withstand that will help the greater network at large
A few users are even saying they'll convert their Linux nodes to OpenBSD to help out
Check the archive for the full conversation, and maybe run a node yourself (http://www.bsdnow.tv/tutorials/tor) on any of the BSDs
The Tor wiki page on OpenBSD is pretty out of date (https://lists.torproject.org/pipermail/tor-dev/2014-November/007715.html) (nine years old!?) and uses the old pf syntax, maybe one of our listeners can modernize it
***
SSP now default for FreeBSD ports (https://lists.freebsd.org/pipermail/freebsd-ports/2014-November/096344.html)
SSP, or Stack Smashing Protection (https://en.wikipedia.org/wiki/Buffer_overflow_protection), is an additional layer of protection against buffer overflows that the compiler can give to the binaries it produces
It's now enabled by default in FreeBSD's ports tree, and the pkgng packages will have it as well - but only for amd64 (all supported releases) and i386 (10.0-RELEASE or newer)
This will only apply to regular ports and binary packages, not the quarterly branch that only receives security updates
If you were using the temporary "new Xorg" or SSP package repositories instead of the default ones, you need to switch back over
NetBSD made this the default on i386 and amd64 two years ago (https://www.netbsd.org/releases/formal-6/NetBSD-6.0.html) and OpenBSD made this the default on all architectures twelve years ago (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=103881967909595&amp;amp;w=2)
Next time you rebuild your ports, things should be automatically hardened without any extra steps or configuration needed
***
Building an OpenBSD firewall and router (https://www.reddit.com/r/BSD/comments/2ld0yw/building_an_openbsd_firewall_and_router/)
While we've discussed the software and configuration of an OpenBSD router, this Reddit thread focuses more on the hardware side
The OP lists some of his potential choices, but was originally looking for something a bit cheaper than a Soekris
Most agree that, if it's for a business especially, it's worth the extra money to go with something that's well known in the BSD community
They also list a few other popular alternatives: ALIX or the APU series from PC Engines, some Supermicro boards, etc.
Through the comments, we also find out that QuakeCon runs OpenBSD on their network
Hopefully most of our listeners are running some kind of BSD as their gateway - try it out (http://www.bsdnow.tv/tutorials/openbsd-router) if you haven't already
***
Interview - Kristaps Džonsons - kristaps@bsd.lv (mailto:kristaps@bsd.lv)
Mandoc, historical man pages, various topics
Tutorial
Throttling bandwidth with PF (http://www.bsdnow.tv/tutorials/openbsd-router#queues)
News Roundup
NetBSD at Kansai Open Forum 2014 (https://mail-index.netbsd.org/netbsd-advocacy/2014/11/08/msg000672.html)
Japanese NetBSD users invade yet another conference, demonstrating that they can and will install NetBSD on everything
From a Raspberry Pi to SHARP Netwalkers to various luna68k devices, they had it all
As always, you can find lots of pictures in the trip report
***
Getting to know your portmgr lurkers (http://blogs.freebsdish.org/portmgr/2014/11/04/getting-to-know-your-portmgr-lurker-ak/)
The lovable "getting to know your portmgr" series makes its triumphant return
This time around, they interview Alex, one of the portmgr lurkers that joined just this month
"How would you describe yourself?" "Too lazy."
Another post (http://blogs.freebsdish.org/portmgr/2014/11/08/getting-to-know-your-portmgr-lurker-ehaupt/) includes a short interview with Emanuel, another new lurker
We discussed the portmgr lurkers initiative with Steve Wills a while back (http://www.bsdnow.tv/episodes/2014_10_01-the_daemons_apprentice)
***
NetBSD's ARM port gets SMP (https://blog.netbsd.org/tnf/entry/working_arm_multiprocessor_support)
The ARM port of NetBSD now has SMP support, allowing more than one CPU to be used
This blog post on the website has a list of supported boards: Banana Pi, Cubieboard 2, Cubietruck, Merrii Hummingbird A31, CUBOX-I and NITROGEN6X
NetBSD's release team is working on getting these changes into the 7 branch before 7.0 is released
There are also a few nice pictures in the article
***
A high performance mid-range NAS (http://pivotallabs.com/high-performing-mid-range-nas-server-part-2-performance-tuning-iscsi/)
This blog post is about FreeNAS and optimizing iSCSI performance
It talks about using mid-range hardware with FreeNAS and different tunables you can change to affect performance
There are some nice graphs and lots of detail if you're interested in tweaking some of your own settings
They conclude "there is no optimal configuration; rather, FreeNAS can be configured to suit a particular workload"
***
Feedback/Questions
Heto writes in (http://slexy.org/view/s2xGCUj8mC)
Brad writes in (http://slexy.org/view/s2SJ8xppDJ)
Tyler writes in (http://slexy.org/view/s20Ktl6BMk)
Tim writes in (http://slexy.org/view/s2AsrxU0ZQ)
Brad writes in (http://slexy.org/view/s21yn0xLv2)
***
Mailing List Gold
Suspicious contributions (https://www.marc.info/?t=141379917200003&amp;amp;r=1&amp;amp;w=2)
La puissance du fromage (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141538800019451&amp;amp;w=2)
Nothing unusual here (https://mail-index.netbsd.org/tech-ports/2002/07/05/0000.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, mandoc, sysjail, mdocml, mdoc, mancgi, mult, random, arc4random, libressl, meetbsd, fortuna, yarrow, soekris, alix, apu, altq, pf</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ve got an interview with Kristaps Džonsons, the creator of mandoc. He tells us how the project got started and what its current status is across the various BSDs. We also have a mini-tutorial on using PF to throttle bandwidth. This week&#39;s news, answers to your emails and even some cheesy mailing list gold, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=273872" rel="nofollow">Updates to FreeBSD&#39;s random(4)</a></h3>

<ul>
<li>FreeBSD&#39;s random device, which presents itself as &quot;/dev/random&quot; to <a href="https://news.ycombinator.com/item?id=8550457" rel="nofollow">users</a>, has gotten a fairly major overhaul in -CURRENT</li>
<li>The CSPRNG (cryptographically secure pseudo-random number generator) algorithm, Yarrow, now has a new alternative called Fortuna</li>
<li>Yarrow is still the default for now, but Fortuna can be used with a kernel option (and will likely be the new default in 11.0-RELEASE)</li>
<li>Pluggable modules can now be written to add more sources of entropy</li>
<li>These changes are expected to make it in 11.0-RELEASE, but there hasn&#39;t been any mention of MFCing them to 10 or 9
***</li>
</ul>

<h3><a href="https://lists.torproject.org/pipermail/tor-relays/2014-November/005661.html" rel="nofollow">OpenBSD Tor relays and network diversity</a></h3>

<ul>
<li>We&#39;ve talked about getting <a href="http://lists.nycbug.org/mailman/listinfo/tor-bsd" rel="nofollow">more BSD-based Tor nodes</a> a few times in previous episodes</li>
<li>The &quot;tor-relays&quot; mailing list has had some recent discussion about increasing diversity in the Tor network, specifically by adding more OpenBSD nodes</li>
<li>With the security features and attention to detail, it makes for an excellent dedicated Tor box</li>
<li>More and more adversaries are attacking Tor nodes, so having something that can withstand that will help the greater network at large</li>
<li>A few users are even saying they&#39;ll <em>convert their Linux nodes</em> to OpenBSD to help out</li>
<li>Check the archive for the full conversation, and maybe <a href="http://www.bsdnow.tv/tutorials/tor" rel="nofollow">run a node yourself</a> on any of the BSDs</li>
<li>The Tor wiki page on OpenBSD is pretty <a href="https://lists.torproject.org/pipermail/tor-dev/2014-November/007715.html" rel="nofollow">out of date</a> (nine years old!?) and uses the old pf syntax, maybe one of our listeners can modernize it
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2014-November/096344.html" rel="nofollow">SSP now default for FreeBSD ports</a></h3>

<ul>
<li>SSP, or <a href="https://en.wikipedia.org/wiki/Buffer_overflow_protection" rel="nofollow">Stack Smashing Protection</a>, is an additional layer of protection against buffer overflows that the compiler can give to the binaries it produces</li>
<li>It&#39;s now enabled by default in FreeBSD&#39;s ports tree, and the pkgng packages will have it as well - but only for amd64 (all supported releases) and i386 (10.0-RELEASE or newer)</li>
<li>This will only apply to regular ports and binary packages, not the quarterly branch that only receives security updates</li>
<li>If you were using the temporary &quot;new Xorg&quot; or SSP package repositories instead of the default ones, you need to switch back over</li>
<li>NetBSD made this the default on i386 and amd64 <a href="https://www.netbsd.org/releases/formal-6/NetBSD-6.0.html" rel="nofollow">two years ago</a> and OpenBSD made this the default on all architectures <a href="https://www.marc.info/?l=openbsd-cvs&m=103881967909595&w=2" rel="nofollow">twelve years ago</a></li>
<li>Next time you rebuild your ports, things should be automatically hardened without any extra steps or configuration needed
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/BSD/comments/2ld0yw/building_an_openbsd_firewall_and_router/" rel="nofollow">Building an OpenBSD firewall and router</a></h3>

<ul>
<li>While we&#39;ve discussed the software and configuration of an OpenBSD router, this Reddit thread focuses more on the hardware side</li>
<li>The OP lists some of his potential choices, but was originally looking for something a bit cheaper than a Soekris</li>
<li>Most agree that, if it&#39;s for a business especially, it&#39;s worth the extra money to go with something that&#39;s well known in the BSD community</li>
<li>They also list a few other popular alternatives: ALIX or the APU series from PC Engines, some Supermicro boards, etc.</li>
<li>Through the comments, we also find out that <strong>QuakeCon runs OpenBSD</strong> on their network</li>
<li>Hopefully most of our listeners are running some kind of BSD as their gateway - <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">try it out</a> if you haven&#39;t already
***</li>
</ul>

<h2>Interview - Kristaps Džonsons - <a href="mailto:kristaps@bsd.lv" rel="nofollow">kristaps@bsd.lv</a></h2>

<p>Mandoc, historical man pages, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/openbsd-router#queues" rel="nofollow">Throttling bandwidth with PF</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2014/11/08/msg000672.html" rel="nofollow">NetBSD at Kansai Open Forum 2014</a></h3>

<ul>
<li>Japanese NetBSD users invade yet another conference, demonstrating that they <strong>can and will</strong> install NetBSD <em>on everything</em></li>
<li>From a Raspberry Pi to SHARP Netwalkers to various luna68k devices, they had it all</li>
<li>As always, you can find lots of pictures in the trip report
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/11/04/getting-to-know-your-portmgr-lurker-ak/" rel="nofollow">Getting to know your portmgr lurkers</a></h3>

<ul>
<li>The lovable &quot;getting to know your portmgr&quot; series makes its triumphant return</li>
<li>This time around, they interview Alex, one of the portmgr lurkers that joined just this month</li>
<li>&quot;How would you describe yourself?&quot; &quot;Too lazy.&quot;</li>
<li><a href="http://blogs.freebsdish.org/portmgr/2014/11/08/getting-to-know-your-portmgr-lurker-ehaupt/" rel="nofollow">Another post</a> includes a short interview with Emanuel, another new lurker</li>
<li>We discussed the portmgr lurkers initiative with Steve Wills <a href="http://www.bsdnow.tv/episodes/2014_10_01-the_daemons_apprentice" rel="nofollow">a while back</a>
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/working_arm_multiprocessor_support" rel="nofollow">NetBSD&#39;s ARM port gets SMP</a></h3>

<ul>
<li>The ARM port of NetBSD now has SMP support, allowing more than one CPU to be used</li>
<li>This blog post on the website has a list of supported boards: Banana Pi, Cubieboard 2, Cubietruck, Merrii Hummingbird A31, CUBOX-I and NITROGEN6X</li>
<li>NetBSD&#39;s release team is working on getting these changes into the 7 branch before 7.0 is released</li>
<li>There are also a few nice pictures in the article
***</li>
</ul>

<h3><a href="http://pivotallabs.com/high-performing-mid-range-nas-server-part-2-performance-tuning-iscsi/" rel="nofollow">A high performance mid-range NAS</a></h3>

<ul>
<li>This blog post is about FreeNAS and optimizing iSCSI performance</li>
<li>It talks about using mid-range hardware with FreeNAS and different tunables you can change to affect performance</li>
<li>There are some nice graphs and lots of detail if you&#39;re interested in tweaking some of your own settings</li>
<li>They conclude &quot;there is no optimal configuration; rather, FreeNAS can be configured to suit a particular workload&quot;
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2xGCUj8mC" rel="nofollow">Heto writes in</a></li>
<li><a href="http://slexy.org/view/s2SJ8xppDJ" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s20Ktl6BMk" rel="nofollow">Tyler writes in</a></li>
<li><a href="http://slexy.org/view/s2AsrxU0ZQ" rel="nofollow">Tim writes in</a></li>
<li><a href="http://slexy.org/view/s21yn0xLv2" rel="nofollow">Brad writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?t=141379917200003&r=1&w=2" rel="nofollow">Suspicious contributions</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=141538800019451&w=2" rel="nofollow">La puissance du fromage</a></li>
<li><a href="https://mail-index.netbsd.org/tech-ports/2002/07/05/0000.html" rel="nofollow">Nothing unusual here</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ve got an interview with Kristaps Džonsons, the creator of mandoc. He tells us how the project got started and what its current status is across the various BSDs. We also have a mini-tutorial on using PF to throttle bandwidth. This week&#39;s news, answers to your emails and even some cheesy mailing list gold, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=273872" rel="nofollow">Updates to FreeBSD&#39;s random(4)</a></h3>

<ul>
<li>FreeBSD&#39;s random device, which presents itself as &quot;/dev/random&quot; to <a href="https://news.ycombinator.com/item?id=8550457" rel="nofollow">users</a>, has gotten a fairly major overhaul in -CURRENT</li>
<li>The CSPRNG (cryptographically secure pseudo-random number generator) algorithm, Yarrow, now has a new alternative called Fortuna</li>
<li>Yarrow is still the default for now, but Fortuna can be used with a kernel option (and will likely be the new default in 11.0-RELEASE)</li>
<li>Pluggable modules can now be written to add more sources of entropy</li>
<li>These changes are expected to make it in 11.0-RELEASE, but there hasn&#39;t been any mention of MFCing them to 10 or 9
***</li>
</ul>

<h3><a href="https://lists.torproject.org/pipermail/tor-relays/2014-November/005661.html" rel="nofollow">OpenBSD Tor relays and network diversity</a></h3>

<ul>
<li>We&#39;ve talked about getting <a href="http://lists.nycbug.org/mailman/listinfo/tor-bsd" rel="nofollow">more BSD-based Tor nodes</a> a few times in previous episodes</li>
<li>The &quot;tor-relays&quot; mailing list has had some recent discussion about increasing diversity in the Tor network, specifically by adding more OpenBSD nodes</li>
<li>With the security features and attention to detail, it makes for an excellent dedicated Tor box</li>
<li>More and more adversaries are attacking Tor nodes, so having something that can withstand that will help the greater network at large</li>
<li>A few users are even saying they&#39;ll <em>convert their Linux nodes</em> to OpenBSD to help out</li>
<li>Check the archive for the full conversation, and maybe <a href="http://www.bsdnow.tv/tutorials/tor" rel="nofollow">run a node yourself</a> on any of the BSDs</li>
<li>The Tor wiki page on OpenBSD is pretty <a href="https://lists.torproject.org/pipermail/tor-dev/2014-November/007715.html" rel="nofollow">out of date</a> (nine years old!?) and uses the old pf syntax, maybe one of our listeners can modernize it
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2014-November/096344.html" rel="nofollow">SSP now default for FreeBSD ports</a></h3>

<ul>
<li>SSP, or <a href="https://en.wikipedia.org/wiki/Buffer_overflow_protection" rel="nofollow">Stack Smashing Protection</a>, is an additional layer of protection against buffer overflows that the compiler can give to the binaries it produces</li>
<li>It&#39;s now enabled by default in FreeBSD&#39;s ports tree, and the pkgng packages will have it as well - but only for amd64 (all supported releases) and i386 (10.0-RELEASE or newer)</li>
<li>This will only apply to regular ports and binary packages, not the quarterly branch that only receives security updates</li>
<li>If you were using the temporary &quot;new Xorg&quot; or SSP package repositories instead of the default ones, you need to switch back over</li>
<li>NetBSD made this the default on i386 and amd64 <a href="https://www.netbsd.org/releases/formal-6/NetBSD-6.0.html" rel="nofollow">two years ago</a> and OpenBSD made this the default on all architectures <a href="https://www.marc.info/?l=openbsd-cvs&m=103881967909595&w=2" rel="nofollow">twelve years ago</a></li>
<li>Next time you rebuild your ports, things should be automatically hardened without any extra steps or configuration needed
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/BSD/comments/2ld0yw/building_an_openbsd_firewall_and_router/" rel="nofollow">Building an OpenBSD firewall and router</a></h3>

<ul>
<li>While we&#39;ve discussed the software and configuration of an OpenBSD router, this Reddit thread focuses more on the hardware side</li>
<li>The OP lists some of his potential choices, but was originally looking for something a bit cheaper than a Soekris</li>
<li>Most agree that, if it&#39;s for a business especially, it&#39;s worth the extra money to go with something that&#39;s well known in the BSD community</li>
<li>They also list a few other popular alternatives: ALIX or the APU series from PC Engines, some Supermicro boards, etc.</li>
<li>Through the comments, we also find out that <strong>QuakeCon runs OpenBSD</strong> on their network</li>
<li>Hopefully most of our listeners are running some kind of BSD as their gateway - <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">try it out</a> if you haven&#39;t already
***</li>
</ul>

<h2>Interview - Kristaps Džonsons - <a href="mailto:kristaps@bsd.lv" rel="nofollow">kristaps@bsd.lv</a></h2>

<p>Mandoc, historical man pages, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/openbsd-router#queues" rel="nofollow">Throttling bandwidth with PF</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2014/11/08/msg000672.html" rel="nofollow">NetBSD at Kansai Open Forum 2014</a></h3>

<ul>
<li>Japanese NetBSD users invade yet another conference, demonstrating that they <strong>can and will</strong> install NetBSD <em>on everything</em></li>
<li>From a Raspberry Pi to SHARP Netwalkers to various luna68k devices, they had it all</li>
<li>As always, you can find lots of pictures in the trip report
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/11/04/getting-to-know-your-portmgr-lurker-ak/" rel="nofollow">Getting to know your portmgr lurkers</a></h3>

<ul>
<li>The lovable &quot;getting to know your portmgr&quot; series makes its triumphant return</li>
<li>This time around, they interview Alex, one of the portmgr lurkers that joined just this month</li>
<li>&quot;How would you describe yourself?&quot; &quot;Too lazy.&quot;</li>
<li><a href="http://blogs.freebsdish.org/portmgr/2014/11/08/getting-to-know-your-portmgr-lurker-ehaupt/" rel="nofollow">Another post</a> includes a short interview with Emanuel, another new lurker</li>
<li>We discussed the portmgr lurkers initiative with Steve Wills <a href="http://www.bsdnow.tv/episodes/2014_10_01-the_daemons_apprentice" rel="nofollow">a while back</a>
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/working_arm_multiprocessor_support" rel="nofollow">NetBSD&#39;s ARM port gets SMP</a></h3>

<ul>
<li>The ARM port of NetBSD now has SMP support, allowing more than one CPU to be used</li>
<li>This blog post on the website has a list of supported boards: Banana Pi, Cubieboard 2, Cubietruck, Merrii Hummingbird A31, CUBOX-I and NITROGEN6X</li>
<li>NetBSD&#39;s release team is working on getting these changes into the 7 branch before 7.0 is released</li>
<li>There are also a few nice pictures in the article
***</li>
</ul>

<h3><a href="http://pivotallabs.com/high-performing-mid-range-nas-server-part-2-performance-tuning-iscsi/" rel="nofollow">A high performance mid-range NAS</a></h3>

<ul>
<li>This blog post is about FreeNAS and optimizing iSCSI performance</li>
<li>It talks about using mid-range hardware with FreeNAS and different tunables you can change to affect performance</li>
<li>There are some nice graphs and lots of detail if you&#39;re interested in tweaking some of your own settings</li>
<li>They conclude &quot;there is no optimal configuration; rather, FreeNAS can be configured to suit a particular workload&quot;
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2xGCUj8mC" rel="nofollow">Heto writes in</a></li>
<li><a href="http://slexy.org/view/s2SJ8xppDJ" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s20Ktl6BMk" rel="nofollow">Tyler writes in</a></li>
<li><a href="http://slexy.org/view/s2AsrxU0ZQ" rel="nofollow">Tim writes in</a></li>
<li><a href="http://slexy.org/view/s21yn0xLv2" rel="nofollow">Brad writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?t=141379917200003&r=1&w=2" rel="nofollow">Suspicious contributions</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=141538800019451&w=2" rel="nofollow">La puissance du fromage</a></li>
<li><a href="https://mail-index.netbsd.org/tech-ports/2002/07/05/0000.html" rel="nofollow">Nothing unusual here</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>62: Gift from the Sun</title>
  <link>https://www.bsdnow.tv/62</link>
  <guid isPermaLink="false">1a099eb3-3c03-4d49-ba89-e6381381718d</guid>
  <pubDate>Wed, 05 Nov 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1a099eb3-3c03-4d49-ba89-e6381381718d.mp3" length="24585844" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We're away at MeetBSD this week, but we've still got a great show for you. We'll be joined by Pawel Dawidek, who's done quite a lot of things in FreeBSD over the years, including the initial ZFS port. We'll get to hear how that came about, what he's up to now and a whole lot more. We'll be back next week with a normal episode of BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>34:08</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We're away at MeetBSD this week, but we've still got a great show for you. We'll be joined by Pawel Dawidek, who's done quite a lot of things in FreeBSD over the years, including the initial ZFS port. We'll get to hear how that came about, what he's up to now and a whole lot more. We'll be back next week with a normal episode of BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Interview - Pawel Jakub Dawidek - pjd@freebsd.org (mailto:pjd@freebsd.org)
Porting ZFS, GEOM, GELI, Capsicum, various topics
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, zfs, capsicum, geom, geli, openzfs, jails, solaris, illumos, opensolaris, openindiana, sun, oracle, meetbsd, meetbsdca, ixsystems</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;re away at MeetBSD this week, but we&#39;ve still got a great show for you. We&#39;ll be joined by Pawel Dawidek, who&#39;s done quite a lot of things in FreeBSD over the years, including the initial ZFS port. We&#39;ll get to hear how that came about, what he&#39;s up to now and a whole lot more. We&#39;ll be back next week with a normal episode of BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Interview - Pawel Jakub Dawidek - <a href="mailto:pjd@freebsd.org" rel="nofollow">pjd@freebsd.org</a></h2>

<p>Porting ZFS, GEOM, GELI, Capsicum, various topics</p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;re away at MeetBSD this week, but we&#39;ve still got a great show for you. We&#39;ll be joined by Pawel Dawidek, who&#39;s done quite a lot of things in FreeBSD over the years, including the initial ZFS port. We&#39;ll get to hear how that came about, what he&#39;s up to now and a whole lot more. We&#39;ll be back next week with a normal episode of BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Interview - Pawel Jakub Dawidek - <a href="mailto:pjd@freebsd.org" rel="nofollow">pjd@freebsd.org</a></h2>

<p>Porting ZFS, GEOM, GELI, Capsicum, various topics</p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>61: IPSECond Wind</title>
  <link>https://www.bsdnow.tv/61</link>
  <guid isPermaLink="false">a0bfab13-8167-4b68-b1de-74122013593a</guid>
  <pubDate>Wed, 29 Oct 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a0bfab13-8167-4b68-b1de-74122013593a.mp3" length="53960980" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we sat down with John-Mark Gurney to talk about modernizing FreeBSD's IPSEC stack. We'll learn what he's adding, what needed to be fixed and how we'll benefit from the changes. As always, answers to your emails and all of this week's news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:14:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we sat down with John-Mark Gurney to talk about modernizing FreeBSD's IPSEC stack. We'll learn what he's adding, what needed to be fixed and how we'll benefit from the changes. As always, answers to your emails and all of this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
BSD panel at Phoenix LUG (https://www.youtube.com/watch?v=3AOF7fm-TJ0)
The Phoenix, Arizona Linux users group had a special panel so they could learn a bit more about BSD
It had one FreeBSD user and one OpenBSD user, and they answered questions from the organizer and the people in the audience
They covered a variety of topics, including filesystems, firewalls, different development models, licenses and philosophy
It was a good "real world" example of things potential switchers are curious to know about
They closed by concluding that more diversity is always better, and even if you've got a lot of Linux boxes, putting a few BSD ones in the mix is a good idea
***
Book of PF signed copy auction (http://bsdly.blogspot.com/2014/10/the-book-of-pf-3rd-edition-is-here.html)
Peter Hansteen (who we've had on the show (http://www.bsdnow.tv/episodes/2014_04_30-puffy_firewall)) is auctioning off the first signed copy of the new Book of PF
All the profits from the sale will go to the OpenBSD Foundation (http://www.openbsd.org/donations.html)
The updated edition of the book includes all the latest pf syntax changes, but also provides examples for FreeBSD and NetBSD's versions (which still use ALTQ, among other differences)
If you're interested in firewalls, security or even just advanced networking, this book is a great one to have on your shelf - and the money will also go to a good cause
Michael Lucas (http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop) has challenged Peter (https://www.marc.info/?l=openbsd-misc&amp;amp;m=141429413908567&amp;amp;w=2) to raise more for the foundation than his last book selling - let's see who wins
Pause the episode, go bid on it (http://www.ebay.com/itm/321563281902) and then come back!
***
FreeBSD Foundation goes to EuroBSDCon (http://freebsdfoundation.blogspot.com/2014/10/freebsd-foundation-goes-to-eurobsdcon.html)
Some people from the FreeBSD Foundation went to EuroBSDCon this year, and come back with a nice trip report
They also sponsored four other developers to go
The foundation was there "to find out what people are working on, what kind of help they could use from the Foundation, feedback on what we can be doing to support the FreeBSD Project and community, and what features/functions people want supported in FreeBSD"
They also have a second report (http://freebsdfoundation.blogspot.com/2014/10/eurobsdcon-trip-report-kamil-czekirda.html) from Kamil Czekirda
A total of $2000 was raised at the conference
***
OpenBSD 5.6 released (http://www.openbsd.org/56.html)
Note: we're doing this story a couple days early - it's actually being released on November 1st (this Saturday), but we have next week off and didn't want to let this one slip through the cracks - it may be out by the time you're watching this
Continuing their always-on-time six month release cycle, the OpenBSD team has released version 5.6
It includes support for new hardware, lots of driver updates, network stack improvements (SMP, in particular) and new security features
5.6 is the first formal release with LibreSSL, their fork of OpenSSL, and lots of ports have been fixed to work with it
You can now hibernate your laptop when using a fully-encrypted filesystem (see our tutorial (http://www.bsdnow.tv/tutorials/fde) for that)
ALTQ, Kerberos, Lynx, Bluetooth, TCP Wrappers and Apache were all removed
This will serve as a "transitional" release for a lot of services: moving from Sendmail to OpenSMTPD, from nginx to httpd (http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time) and from BIND to Unbound
Sendmail, nginx and BIND will be gone in the next release, so either migrate to the new stuff between now and then or switch to the ports versions
As always, 5.6 comes with its own song and artwork (http://www.openbsd.org/lyrics.html#56) - the theme this time was obviously LibreSSL
Be sure to check the full changelog (http://www.openbsd.org/plus56.html) (it's huge) and pick up a CD or tshirt (http://www.openbsd.org/orders.html) to support their efforts
If you don't already have the public key releases are signed with, getting a physical CD is a good "out of bounds" way to obtain it safely
Here are some cool images of the set (https://imgur.com/a/5PtFe)
After you do your installation or upgrade (http://www.openbsd.org/faq/upgrade56.html), don't forget to head over to the errata page (http://www.openbsd.org/errata56.html) and apply any patches listed there
***
Interview - John-Mark Gurney - jmg@freebsd.org (mailto:jmg@freebsd.org) / @encthenet (https://twitter.com/encthenet)
Updating FreeBSD's IPSEC stack
News Roundup
Clang in DragonFly BSD (https://www.dragonflydigest.com/2014/10/22/14942.html)
As we all know, FreeBSD got rid of GCC in 10.0, and now uses Clang almost exclusively on i386/amd64
Some DragonFly developers are considering migrating over as well, and one of them is doing some work to make the OS more Clang-friendly
We'd love to see more BSDs switch to Clang/LLVM eventually, it's a lot more modern than the old GCC most are using
***
reallocarray(): integer overflow detection for free (http://lteo.net/blog/2014/10/28/reallocarray-in-openbsd-integer-overflow-detection-for-free/)
One of the less obvious features in OpenBSD 5.6 is a new libc function: "reallocarray()"
It's a replacement function for realloc(3) that provides integer overflow detection at basically no extra cost
Theo and a few other developers have already started (https://secure.freshbsd.org/search?project=openbsd&amp;amp;q=reallocarray) a mass audit of the entire source tree, replacing many instances with this new feature
OpenBSD's explicit_bzero was recently imported into FreeBSD, maybe someone could also port over this too
***
Switching from Linux blog (http://bothsidesofthence.tumblr.com/)
A listener of the show has started a new blog series, detailing his experiences in switching over to BSD from Linux
After over ten years of using Linux, he decided to give BSD a try after listening to our show (which is awesome)
So far, he's put up a few posts about his initial thoughts, some documentation he's going through and his experiments so far
It'll be an ongoing series, so we may check back in with him again later on
***
Owncloud in a FreeNAS jail (https://www.youtube.com/watch?v=z6VQwOl4wE4)
One of the most common emails we get is about running Owncloud in FreeNAS
Now, finally, someone made a video on how to do just that, and it's even jailed
A member of the FreeNAS community has uploaded a video on how to set it up, with lighttpd as the webserver backend
If you're looking for an easy way to back up and sync your files, this might be worth a watch
***
Feedback/Questions
Ernõ writes in (http://slexy.org/view/s2XEsQdggZ)
David writes in (http://slexy.org/view/s21EizH2aR)
Kamil writes in (http://slexy.org/view/s24SAJ5im6)
Torsten writes in (http://slexy.org/view/s20ABZe0RD)
Dominik writes in (http://slexy.org/view/s208jQs9c6)
***
Mailing List Gold
That's not our IP (https://mail-index.netbsd.org/source-changes/2014/10/17/msg059564.html)
Is this thing on? (https://lists.freebsd.org/pipermail/freebsd-acpi/2014-June/008644.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ipsec, aes, gcm, chacha20, encryption, netsec, ike, openiked, infosec, 5.6, openhttpd, opensmtpd, meetbsd, book of pf, libressl, freenas, owncloud</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we sat down with John-Mark Gurney to talk about modernizing FreeBSD&#39;s IPSEC stack. We&#39;ll learn what he&#39;s adding, what needed to be fixed and how we&#39;ll benefit from the changes. As always, answers to your emails and all of this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.youtube.com/watch?v=3AOF7fm-TJ0" rel="nofollow">BSD panel at Phoenix LUG</a></h3>

<ul>
<li>The Phoenix, Arizona Linux users group had a special panel so they could learn a bit more about BSD</li>
<li>It had one FreeBSD user and one OpenBSD user, and they answered questions from the organizer and the people in the audience</li>
<li>They covered a variety of topics, including filesystems, firewalls, different development models, licenses and philosophy</li>
<li>It was a good &quot;real world&quot; example of things potential switchers are curious to know about</li>
<li>They closed by concluding that more diversity is always better, and even if you&#39;ve got a lot of Linux boxes, putting a few BSD ones in the mix is a good idea
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2014/10/the-book-of-pf-3rd-edition-is-here.html" rel="nofollow">Book of PF signed copy auction</a></h3>

<ul>
<li>Peter Hansteen (who we&#39;ve <a href="http://www.bsdnow.tv/episodes/2014_04_30-puffy_firewall" rel="nofollow">had on the show</a>) is auctioning off the first signed copy of the new Book of PF</li>
<li>All the profits from the sale will go to the <a href="http://www.openbsd.org/donations.html" rel="nofollow">OpenBSD Foundation</a></li>
<li>The updated edition of the book includes all the latest pf syntax changes, but also provides examples for FreeBSD and NetBSD&#39;s versions (which still use ALTQ, among other differences)</li>
<li>If you&#39;re interested in firewalls, security or even just advanced networking, this book is a great one to have on your shelf - and the money will also go to a good cause</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">Michael Lucas</a> has <a href="https://www.marc.info/?l=openbsd-misc&m=141429413908567&w=2" rel="nofollow">challenged Peter</a> to raise more for the foundation than his last book selling - let&#39;s see who wins</li>
<li>Pause the episode, <a href="http://www.ebay.com/itm/321563281902" rel="nofollow">go bid on it</a> and then come back!
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/10/freebsd-foundation-goes-to-eurobsdcon.html" rel="nofollow">FreeBSD Foundation goes to EuroBSDCon</a></h3>

<ul>
<li>Some people from the FreeBSD Foundation went to EuroBSDCon this year, and come back with a nice trip report</li>
<li>They also sponsored four other developers to go</li>
<li>The foundation was there &quot;to find out what people are working on, what kind of help they could use from the Foundation, feedback on what we can be doing to support the FreeBSD Project and community, and what features/functions people want supported in FreeBSD&quot;</li>
<li>They also have <a href="http://freebsdfoundation.blogspot.com/2014/10/eurobsdcon-trip-report-kamil-czekirda.html" rel="nofollow">a second report</a> from Kamil Czekirda</li>
<li>A total of $2000 was raised at the conference
***</li>
</ul>

<h3><a href="http://www.openbsd.org/56.html" rel="nofollow">OpenBSD 5.6 released</a></h3>

<ul>
<li><strong>Note</strong>: we&#39;re doing this story a couple days early - it&#39;s actually being released on November 1st (this Saturday), but we have next week off and didn&#39;t want to let this one slip through the cracks - it may be out by the time you&#39;re watching this</li>
<li>Continuing their always-on-time six month release cycle, the OpenBSD team has released version 5.6</li>
<li>It includes support for new hardware, lots of driver updates, network stack improvements (SMP, in particular) and new security features</li>
<li>5.6 is the first formal release with LibreSSL, their fork of OpenSSL, and lots of ports have been fixed to work with it</li>
<li>You can now hibernate your laptop when using a fully-encrypted filesystem (see <a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">our tutorial</a> for that)</li>
<li>ALTQ, Kerberos, Lynx, Bluetooth, TCP Wrappers and Apache were all removed</li>
<li>This will serve as a &quot;transitional&quot; release for a lot of services: moving from Sendmail to OpenSMTPD, from nginx to <a href="http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time" rel="nofollow">httpd</a> and from BIND to Unbound</li>
<li>Sendmail, nginx and BIND will be gone in the next release, so either migrate to the new stuff between now and then or switch to the ports versions</li>
<li>As always, 5.6 comes with its own <a href="http://www.openbsd.org/lyrics.html#56" rel="nofollow">song and artwork</a> - the theme this time was obviously LibreSSL</li>
<li>Be sure to check the <a href="http://www.openbsd.org/plus56.html" rel="nofollow">full changelog</a> (<em>it&#39;s huge</em>) and pick up <a href="http://www.openbsd.org/orders.html" rel="nofollow">a CD or tshirt</a> to support their efforts</li>
<li>If you don&#39;t already have the public key releases are signed with, getting a physical CD is a good &quot;out of bounds&quot; way to obtain it safely</li>
<li>Here are some cool <a href="https://imgur.com/a/5PtFe" rel="nofollow">images of the set</a></li>
<li>After you do your installation or <a href="http://www.openbsd.org/faq/upgrade56.html" rel="nofollow">upgrade</a>, don&#39;t forget to head over to <a href="http://www.openbsd.org/errata56.html" rel="nofollow">the errata page</a> and apply any patches listed there
***</li>
</ul>

<h2>Interview - John-Mark Gurney - <a href="mailto:jmg@freebsd.org" rel="nofollow">jmg@freebsd.org</a> / <a href="https://twitter.com/encthenet" rel="nofollow">@encthenet</a></h2>

<p>Updating FreeBSD&#39;s IPSEC stack</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.dragonflydigest.com/2014/10/22/14942.html" rel="nofollow">Clang in DragonFly BSD</a></h3>

<ul>
<li>As we all know, FreeBSD got rid of GCC in 10.0, and now uses Clang almost exclusively on i386/amd64</li>
<li>Some DragonFly developers are considering migrating over as well, and one of them is doing some work to make the OS more Clang-friendly</li>
<li>We&#39;d love to see more BSDs switch to Clang/LLVM eventually, it&#39;s a lot more modern than the old GCC most are using
***</li>
</ul>

<h3><a href="http://lteo.net/blog/2014/10/28/reallocarray-in-openbsd-integer-overflow-detection-for-free/" rel="nofollow">reallocarray(): integer overflow detection for free</a></h3>

<ul>
<li>One of the less obvious features in OpenBSD 5.6 is a new libc function: &quot;reallocarray()&quot;</li>
<li>It&#39;s a replacement function for realloc(3) that provides integer overflow detection at basically no extra cost</li>
<li>Theo and a few other developers have <a href="https://secure.freshbsd.org/search?project=openbsd&q=reallocarray" rel="nofollow">already started</a> a mass audit of the entire source tree, replacing many instances with this new feature</li>
<li>OpenBSD&#39;s explicit_bzero was recently imported into FreeBSD, maybe someone could also port over this too
***</li>
</ul>

<h3><a href="http://bothsidesofthence.tumblr.com/" rel="nofollow">Switching from Linux blog</a></h3>

<ul>
<li>A listener of the show has started a new blog series, detailing his experiences in switching over to BSD from Linux</li>
<li>After over ten years of using Linux, he decided to give BSD a try after listening to our show (which is awesome)</li>
<li>So far, he&#39;s put up a few posts about his initial thoughts, some documentation he&#39;s going through and his experiments so far</li>
<li>It&#39;ll be an ongoing series, so we may check back in with him again later on
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=z6VQwOl4wE4" rel="nofollow">Owncloud in a FreeNAS jail</a></h3>

<ul>
<li>One of the most common emails we get is about running Owncloud in FreeNAS</li>
<li>Now, finally, someone made a video on how to do just that, and it&#39;s even jailed</li>
<li>A member of the FreeNAS community has uploaded a video on how to set it up, with lighttpd as the webserver backend</li>
<li>If you&#39;re looking for an easy way to back up and sync your files, this might be worth a watch
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2XEsQdggZ" rel="nofollow">Ernõ writes in</a></li>
<li><a href="http://slexy.org/view/s21EizH2aR" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s24SAJ5im6" rel="nofollow">Kamil writes in</a></li>
<li><a href="http://slexy.org/view/s20ABZe0RD" rel="nofollow">Torsten writes in</a></li>
<li><a href="http://slexy.org/view/s208jQs9c6" rel="nofollow">Dominik writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://mail-index.netbsd.org/source-changes/2014/10/17/msg059564.html" rel="nofollow">That&#39;s not our IP</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-acpi/2014-June/008644.html" rel="nofollow">Is this thing on?</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we sat down with John-Mark Gurney to talk about modernizing FreeBSD&#39;s IPSEC stack. We&#39;ll learn what he&#39;s adding, what needed to be fixed and how we&#39;ll benefit from the changes. As always, answers to your emails and all of this week&#39;s news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.youtube.com/watch?v=3AOF7fm-TJ0" rel="nofollow">BSD panel at Phoenix LUG</a></h3>

<ul>
<li>The Phoenix, Arizona Linux users group had a special panel so they could learn a bit more about BSD</li>
<li>It had one FreeBSD user and one OpenBSD user, and they answered questions from the organizer and the people in the audience</li>
<li>They covered a variety of topics, including filesystems, firewalls, different development models, licenses and philosophy</li>
<li>It was a good &quot;real world&quot; example of things potential switchers are curious to know about</li>
<li>They closed by concluding that more diversity is always better, and even if you&#39;ve got a lot of Linux boxes, putting a few BSD ones in the mix is a good idea
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2014/10/the-book-of-pf-3rd-edition-is-here.html" rel="nofollow">Book of PF signed copy auction</a></h3>

<ul>
<li>Peter Hansteen (who we&#39;ve <a href="http://www.bsdnow.tv/episodes/2014_04_30-puffy_firewall" rel="nofollow">had on the show</a>) is auctioning off the first signed copy of the new Book of PF</li>
<li>All the profits from the sale will go to the <a href="http://www.openbsd.org/donations.html" rel="nofollow">OpenBSD Foundation</a></li>
<li>The updated edition of the book includes all the latest pf syntax changes, but also provides examples for FreeBSD and NetBSD&#39;s versions (which still use ALTQ, among other differences)</li>
<li>If you&#39;re interested in firewalls, security or even just advanced networking, this book is a great one to have on your shelf - and the money will also go to a good cause</li>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">Michael Lucas</a> has <a href="https://www.marc.info/?l=openbsd-misc&m=141429413908567&w=2" rel="nofollow">challenged Peter</a> to raise more for the foundation than his last book selling - let&#39;s see who wins</li>
<li>Pause the episode, <a href="http://www.ebay.com/itm/321563281902" rel="nofollow">go bid on it</a> and then come back!
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/10/freebsd-foundation-goes-to-eurobsdcon.html" rel="nofollow">FreeBSD Foundation goes to EuroBSDCon</a></h3>

<ul>
<li>Some people from the FreeBSD Foundation went to EuroBSDCon this year, and come back with a nice trip report</li>
<li>They also sponsored four other developers to go</li>
<li>The foundation was there &quot;to find out what people are working on, what kind of help they could use from the Foundation, feedback on what we can be doing to support the FreeBSD Project and community, and what features/functions people want supported in FreeBSD&quot;</li>
<li>They also have <a href="http://freebsdfoundation.blogspot.com/2014/10/eurobsdcon-trip-report-kamil-czekirda.html" rel="nofollow">a second report</a> from Kamil Czekirda</li>
<li>A total of $2000 was raised at the conference
***</li>
</ul>

<h3><a href="http://www.openbsd.org/56.html" rel="nofollow">OpenBSD 5.6 released</a></h3>

<ul>
<li><strong>Note</strong>: we&#39;re doing this story a couple days early - it&#39;s actually being released on November 1st (this Saturday), but we have next week off and didn&#39;t want to let this one slip through the cracks - it may be out by the time you&#39;re watching this</li>
<li>Continuing their always-on-time six month release cycle, the OpenBSD team has released version 5.6</li>
<li>It includes support for new hardware, lots of driver updates, network stack improvements (SMP, in particular) and new security features</li>
<li>5.6 is the first formal release with LibreSSL, their fork of OpenSSL, and lots of ports have been fixed to work with it</li>
<li>You can now hibernate your laptop when using a fully-encrypted filesystem (see <a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">our tutorial</a> for that)</li>
<li>ALTQ, Kerberos, Lynx, Bluetooth, TCP Wrappers and Apache were all removed</li>
<li>This will serve as a &quot;transitional&quot; release for a lot of services: moving from Sendmail to OpenSMTPD, from nginx to <a href="http://www.bsdnow.tv/episodes/2014_09_03-its_hammer_time" rel="nofollow">httpd</a> and from BIND to Unbound</li>
<li>Sendmail, nginx and BIND will be gone in the next release, so either migrate to the new stuff between now and then or switch to the ports versions</li>
<li>As always, 5.6 comes with its own <a href="http://www.openbsd.org/lyrics.html#56" rel="nofollow">song and artwork</a> - the theme this time was obviously LibreSSL</li>
<li>Be sure to check the <a href="http://www.openbsd.org/plus56.html" rel="nofollow">full changelog</a> (<em>it&#39;s huge</em>) and pick up <a href="http://www.openbsd.org/orders.html" rel="nofollow">a CD or tshirt</a> to support their efforts</li>
<li>If you don&#39;t already have the public key releases are signed with, getting a physical CD is a good &quot;out of bounds&quot; way to obtain it safely</li>
<li>Here are some cool <a href="https://imgur.com/a/5PtFe" rel="nofollow">images of the set</a></li>
<li>After you do your installation or <a href="http://www.openbsd.org/faq/upgrade56.html" rel="nofollow">upgrade</a>, don&#39;t forget to head over to <a href="http://www.openbsd.org/errata56.html" rel="nofollow">the errata page</a> and apply any patches listed there
***</li>
</ul>

<h2>Interview - John-Mark Gurney - <a href="mailto:jmg@freebsd.org" rel="nofollow">jmg@freebsd.org</a> / <a href="https://twitter.com/encthenet" rel="nofollow">@encthenet</a></h2>

<p>Updating FreeBSD&#39;s IPSEC stack</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.dragonflydigest.com/2014/10/22/14942.html" rel="nofollow">Clang in DragonFly BSD</a></h3>

<ul>
<li>As we all know, FreeBSD got rid of GCC in 10.0, and now uses Clang almost exclusively on i386/amd64</li>
<li>Some DragonFly developers are considering migrating over as well, and one of them is doing some work to make the OS more Clang-friendly</li>
<li>We&#39;d love to see more BSDs switch to Clang/LLVM eventually, it&#39;s a lot more modern than the old GCC most are using
***</li>
</ul>

<h3><a href="http://lteo.net/blog/2014/10/28/reallocarray-in-openbsd-integer-overflow-detection-for-free/" rel="nofollow">reallocarray(): integer overflow detection for free</a></h3>

<ul>
<li>One of the less obvious features in OpenBSD 5.6 is a new libc function: &quot;reallocarray()&quot;</li>
<li>It&#39;s a replacement function for realloc(3) that provides integer overflow detection at basically no extra cost</li>
<li>Theo and a few other developers have <a href="https://secure.freshbsd.org/search?project=openbsd&q=reallocarray" rel="nofollow">already started</a> a mass audit of the entire source tree, replacing many instances with this new feature</li>
<li>OpenBSD&#39;s explicit_bzero was recently imported into FreeBSD, maybe someone could also port over this too
***</li>
</ul>

<h3><a href="http://bothsidesofthence.tumblr.com/" rel="nofollow">Switching from Linux blog</a></h3>

<ul>
<li>A listener of the show has started a new blog series, detailing his experiences in switching over to BSD from Linux</li>
<li>After over ten years of using Linux, he decided to give BSD a try after listening to our show (which is awesome)</li>
<li>So far, he&#39;s put up a few posts about his initial thoughts, some documentation he&#39;s going through and his experiments so far</li>
<li>It&#39;ll be an ongoing series, so we may check back in with him again later on
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=z6VQwOl4wE4" rel="nofollow">Owncloud in a FreeNAS jail</a></h3>

<ul>
<li>One of the most common emails we get is about running Owncloud in FreeNAS</li>
<li>Now, finally, someone made a video on how to do just that, and it&#39;s even jailed</li>
<li>A member of the FreeNAS community has uploaded a video on how to set it up, with lighttpd as the webserver backend</li>
<li>If you&#39;re looking for an easy way to back up and sync your files, this might be worth a watch
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2XEsQdggZ" rel="nofollow">Ernõ writes in</a></li>
<li><a href="http://slexy.org/view/s21EizH2aR" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s24SAJ5im6" rel="nofollow">Kamil writes in</a></li>
<li><a href="http://slexy.org/view/s20ABZe0RD" rel="nofollow">Torsten writes in</a></li>
<li><a href="http://slexy.org/view/s208jQs9c6" rel="nofollow">Dominik writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://mail-index.netbsd.org/source-changes/2014/10/17/msg059564.html" rel="nofollow">That&#39;s not our IP</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-acpi/2014-June/008644.html" rel="nofollow">Is this thing on?</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>60: Don't Buy a Router</title>
  <link>https://www.bsdnow.tv/60</link>
  <guid isPermaLink="false">e61941d1-74ff-40d0-91f6-86ff864cf99b</guid>
  <pubDate>Wed, 22 Oct 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e61941d1-74ff-40d0-91f6-86ff864cf99b.mp3" length="49443412" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show we're joined by Olivier Cochard-Labbé, the creator of both FreeNAS and the BSD Router Project! We'll be discussing what the BSD Router Project is, what it's for and where it's going. All this week's headlines and answers to viewer-submitted questions, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:08:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show we're joined by Olivier Cochard-Labbé, the creator of both FreeNAS and the BSD Router Project! We'll be discussing what the BSD Router Project is, what it's for and where it's going. All this week's headlines and answers to viewer-submitted questions, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
BSD Devroom CFP (https://lists.fosdem.org/pipermail/fosdem/2014-October/002038.html)
This year's FOSDEM conference (Belgium, Jan 31st - Feb 1st) is having a dedicated BSD devroom
They've issued a call for papers on anything BSD-related, and we always love more presentations
If you're in the Belgium area or plan on going, submit a talk about something cool you're doing
There's also a mailing list (https://lists.fosdem.org/listinfo/bsd-devroom) and some more information in the original post
***
Bhyve SVM code merge (https://lists.freebsd.org/pipermail/freebsd-virtualization/2014-October/002905.html)
The bhyve_svm code has been in the "projects" tree of FreeBSD, but is now ready (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=273375) for -CURRENT
This changeset will finally allow bhyve to run on AMD CPUs, where it was previously limited to Intel only
All the supported operating systems and utilities should work on both now
One thing to note: bhyve doesn't support PCI passthrough on AMD just yet
There may still be some issues (https://lists.freebsd.org/pipermail/freebsd-virtualization/2014-October/002935.html) though
***
NetBSD at Open Source Conference Tokyo (https://mail-index.netbsd.org/netbsd-advocacy/2014/10/20/msg000671.html)
The Japanese NetBSD users group held a booth at another recent open source conference
As always, they were running NetBSD on everything you can imagine
One of the users reports back to the mailing list on their experience, providing lots of pictures and links
Here's an interesting screenshot of NetBSD running various other BSDs in Xen (https://pbs.twimg.com/media/B0NnfcbCEAAmKIU.jpg:large)
***
More BSD switchers every day (https://www.reddit.com/r/unix/comments/2il383/question_about_the_bsd_community_as_a_whole/)
A decade-long Linux user is considering making the switch, and asks Reddit about the BSD community
Tired of the pointless bickering he sees in his current community, he asks if the same problems exist over here and what he should expect
So far, he's found that BSD people seem to act more level-headed about things, and are much more practical, whereas some FSF/GNU/GPL people make open source a religion
There's also another semi-related thread (https://www.reddit.com/r/BSD/comments/2jpxj9/question_about_the_current_state_of_freebsd/) about another Linux user wanting to switch to BSD because of systemd and GNU people
There are some extremely well written and thought-out comments in the replies (in both threads), be sure to give them all a read
Maybe the OPs should've just watched this show
***
Interview - Olivier Cochard-Labbé - olivier@cochard.me (mailto:olivier@cochard.me) / @ocochardlabbe (https://twitter.com/ocochardlabbe)
The BSD Router Project
News Roundup
FreeBSD -CURRENT on a T420 (https://www.banym.de/freebsd/install-freebsd-11-on-thinkpad-t420)
Thinkpads are quite popular with BSD developers and users
Most of the hardware seems to be supported across the BSDs (especially wifi)
This article walks through installing FreeBSD -CURRENT on a Thinkpad T420 with UEFI
If you've got a Thinkpad, or especially this specific one, have a look at some of the steps involved
***
FreeNAS on a Supermicro 5018A-MHN4 (https://www.teckelworks.com/2014/10/building-a-freenas-server-with-a-supermicro-5018a-mhn4/)
More and more people are migrating their NAS devices to BSD-based solutions
In this post, the author goes through setting up FreeNAS on some of his new hardware
His new rack-mounted FreeNAS machine has a low power Atom with eight cores and 64GB of RAM - quite a lot for its small form factor
The rest of the post details all of the hardware he chose and goes through the build process (with lots of cool pictures)
***
Hardening procfs and linprocfs (http://hardenedbsd.org/article/shawn-webb/2014-10-15/hardening-procfs-and-linprocfs)
There was an exploit published recently for SFTP in OpenSSH, but it mostly just affected Linux
There exists a native procfs in FreeBSD, which was the target point of that exploit, but it's not used very often
The Linux emulation layer also supports its own linprocfs, which was affected as well
The HardenedBSD guys weigh in on how to best solve the problem, and now support an additional protection layer from writing to memory with procfs
If you want to learn more about ASLR and HardenedBSD, be sure to check out our interview with Shawn (http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover) too
***
pfSense monitoring with bandwidthd (http://pfsensesetup.com/bandwidth-monitoring-with-bandwidthd/)
A lot of people run pfSense on their home network, and it's really useful to monitor the bandwidth usage
This article will walk you through setting up bandwidthd to do exactly that
bandwidthd monitors based on the IP address, rather than per-interface
It can also build some cool HTML graphs, and we love those pfSense graphs
Have a look at our bandwidth monitoring and testing (http://www.bsdnow.tv/tutorials/vnstat-iperf) tutorial for some more ideas
***
Feedback/Questions
Dave writes in (http://slexy.org/view/s2b5ZZ5qCv)
Chris writes in (http://slexy.org/view/s20aVvhv2d)
Zeke writes in (http://slexy.org/view/s2Vmwxy1QM)
Bostjan writes in (http://slexy.org/view/s2LB6MKoNT)
Patrick writes in (http://slexy.org/view/s2xxB9uOuV)
***
Mailing List Gold
More (https://www.marc.info/?l=openbsd-tech&amp;amp;m=141357595922692&amp;amp;w=2) old bugs (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141358124924479&amp;amp;w=2)
The Right Font™ (https://www.marc.info/?l=openbsd-cvs&amp;amp;m=141332534304117&amp;amp;w=2) (see also (https://twitter.com/blakkheim/status/522162864409546753))
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, bsdrp, bsd router project, freenas, nas4free, router, gateway, firewall, pfsense, nanobsd, hardenedbsd, bhyve, devroom, fosdem</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show we&#39;re joined by Olivier Cochard-Labbé, the creator of both FreeNAS and the BSD Router Project! We&#39;ll be discussing what the BSD Router Project is, what it&#39;s for and where it&#39;s going. All this week&#39;s headlines and answers to viewer-submitted questions, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.fosdem.org/pipermail/fosdem/2014-October/002038.html" rel="nofollow">BSD Devroom CFP</a></h3>

<ul>
<li>This year&#39;s FOSDEM conference (Belgium, Jan 31st - Feb 1st) is having a dedicated BSD devroom</li>
<li>They&#39;ve issued a call for papers on anything BSD-related, and we always love more presentations</li>
<li>If you&#39;re in the Belgium area or plan on going, submit a talk about something cool you&#39;re doing</li>
<li>There&#39;s also <a href="https://lists.fosdem.org/listinfo/bsd-devroom" rel="nofollow">a mailing list</a> and some more information in the original post
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2014-October/002905.html" rel="nofollow">Bhyve SVM code merge</a></h3>

<ul>
<li>The bhyve_svm code has been in the &quot;projects&quot; tree of FreeBSD, but is <a href="https://svnweb.freebsd.org/base?view=revision&revision=273375" rel="nofollow">now ready</a> for -CURRENT</li>
<li>This changeset will finally allow bhyve to run on AMD CPUs, where it was previously limited to Intel only</li>
<li>All the supported operating systems and utilities should work on both now</li>
<li>One thing to note: bhyve doesn&#39;t support PCI passthrough on AMD just yet</li>
<li>There may still be <a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2014-October/002935.html" rel="nofollow">some issues</a> though
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2014/10/20/msg000671.html" rel="nofollow">NetBSD at Open Source Conference Tokyo</a></h3>

<ul>
<li>The Japanese NetBSD users group held a booth at another recent open source conference</li>
<li>As always, they were running NetBSD on everything you can imagine</li>
<li>One of the users reports back to the mailing list on their experience, providing lots of pictures and links</li>
<li>Here&#39;s an interesting <a href="https://pbs.twimg.com/media/B0NnfcbCEAAmKIU.jpg:large" rel="nofollow">screenshot of NetBSD running various other BSDs in Xen</a>
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/unix/comments/2il383/question_about_the_bsd_community_as_a_whole/" rel="nofollow">More BSD switchers every day</a></h3>

<ul>
<li>A decade-long Linux user is considering making the switch, and asks Reddit about the BSD community</li>
<li>Tired of the pointless bickering he sees in his current community, he asks if the same problems exist over here and what he should expect</li>
<li>So far, he&#39;s found that BSD people seem to act more level-headed about things, and are much more practical, whereas some FSF/GNU/GPL people make open source a religion</li>
<li>There&#39;s also <a href="https://www.reddit.com/r/BSD/comments/2jpxj9/question_about_the_current_state_of_freebsd/" rel="nofollow">another semi-related thread</a> about another Linux user wanting to switch to BSD because of systemd and GNU people</li>
<li>There are some extremely well written and thought-out comments in the replies (in both threads), be sure to give them all a read</li>
<li>Maybe the OPs should&#39;ve just watched this show
***</li>
</ul>

<h2>Interview - Olivier Cochard-Labbé - <a href="mailto:olivier@cochard.me" rel="nofollow">olivier@cochard.me</a> / <a href="https://twitter.com/ocochardlabbe" rel="nofollow">@ocochardlabbe</a></h2>

<p>The BSD Router Project</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.banym.de/freebsd/install-freebsd-11-on-thinkpad-t420" rel="nofollow">FreeBSD -CURRENT on a T420</a></h3>

<ul>
<li>Thinkpads are quite popular with BSD developers and users</li>
<li>Most of the hardware seems to be supported across the BSDs (especially wifi)</li>
<li>This article walks through installing FreeBSD -CURRENT on a Thinkpad T420 with UEFI</li>
<li>If you&#39;ve got a Thinkpad, or especially this specific one, have a look at some of the steps involved
***</li>
</ul>

<h3><a href="https://www.teckelworks.com/2014/10/building-a-freenas-server-with-a-supermicro-5018a-mhn4/" rel="nofollow">FreeNAS on a Supermicro 5018A-MHN4</a></h3>

<ul>
<li>More and more people are migrating their NAS devices to BSD-based solutions</li>
<li>In this post, the author goes through setting up FreeNAS on some of his new hardware</li>
<li>His new rack-mounted FreeNAS machine has a low power Atom with eight cores and 64GB of RAM - quite a lot for its small form factor</li>
<li>The rest of the post details all of the hardware he chose and goes through the build process (with lots of cool pictures)
***</li>
</ul>

<h3><a href="http://hardenedbsd.org/article/shawn-webb/2014-10-15/hardening-procfs-and-linprocfs" rel="nofollow">Hardening procfs and linprocfs</a></h3>

<ul>
<li>There was an exploit published recently for SFTP in OpenSSH, but it mostly just affected Linux</li>
<li>There exists a native procfs in FreeBSD, which was the target point of that exploit, but it&#39;s not used very often</li>
<li>The Linux emulation layer also supports its own linprocfs, which was affected as well</li>
<li>The HardenedBSD guys weigh in on how to best solve the problem, and now support an additional protection layer from writing to memory with procfs</li>
<li>If you want to learn more about ASLR and HardenedBSD, be sure to check out <a href="http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover" rel="nofollow">our interview with Shawn</a> too
***</li>
</ul>

<h3><a href="http://pfsensesetup.com/bandwidth-monitoring-with-bandwidthd/" rel="nofollow">pfSense monitoring with bandwidthd</a></h3>

<ul>
<li>A lot of people run pfSense on their home network, and it&#39;s really useful to monitor the bandwidth usage</li>
<li>This article will walk you through setting up bandwidthd to do exactly that</li>
<li>bandwidthd monitors based on the IP address, rather than per-interface</li>
<li>It can also build some cool HTML graphs, and we love those pfSense graphs</li>
<li>Have a look at our <a href="http://www.bsdnow.tv/tutorials/vnstat-iperf" rel="nofollow">bandwidth monitoring and testing</a> tutorial for some more ideas
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2b5ZZ5qCv" rel="nofollow">Dave writes in</a></li>
<li><a href="http://slexy.org/view/s20aVvhv2d" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s2Vmwxy1QM" rel="nofollow">Zeke writes in</a></li>
<li><a href="http://slexy.org/view/s2LB6MKoNT" rel="nofollow">Bostjan writes in</a></li>
<li><a href="http://slexy.org/view/s2xxB9uOuV" rel="nofollow">Patrick writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-tech&m=141357595922692&w=2" rel="nofollow">More</a> <a href="https://www.marc.info/?l=openbsd-cvs&m=141358124924479&w=2" rel="nofollow">old bugs</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=141332534304117&w=2" rel="nofollow">The Right Font™</a> (<a href="https://twitter.com/blakkheim/status/522162864409546753" rel="nofollow">see also</a>)
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show we&#39;re joined by Olivier Cochard-Labbé, the creator of both FreeNAS and the BSD Router Project! We&#39;ll be discussing what the BSD Router Project is, what it&#39;s for and where it&#39;s going. All this week&#39;s headlines and answers to viewer-submitted questions, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.fosdem.org/pipermail/fosdem/2014-October/002038.html" rel="nofollow">BSD Devroom CFP</a></h3>

<ul>
<li>This year&#39;s FOSDEM conference (Belgium, Jan 31st - Feb 1st) is having a dedicated BSD devroom</li>
<li>They&#39;ve issued a call for papers on anything BSD-related, and we always love more presentations</li>
<li>If you&#39;re in the Belgium area or plan on going, submit a talk about something cool you&#39;re doing</li>
<li>There&#39;s also <a href="https://lists.fosdem.org/listinfo/bsd-devroom" rel="nofollow">a mailing list</a> and some more information in the original post
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2014-October/002905.html" rel="nofollow">Bhyve SVM code merge</a></h3>

<ul>
<li>The bhyve_svm code has been in the &quot;projects&quot; tree of FreeBSD, but is <a href="https://svnweb.freebsd.org/base?view=revision&revision=273375" rel="nofollow">now ready</a> for -CURRENT</li>
<li>This changeset will finally allow bhyve to run on AMD CPUs, where it was previously limited to Intel only</li>
<li>All the supported operating systems and utilities should work on both now</li>
<li>One thing to note: bhyve doesn&#39;t support PCI passthrough on AMD just yet</li>
<li>There may still be <a href="https://lists.freebsd.org/pipermail/freebsd-virtualization/2014-October/002935.html" rel="nofollow">some issues</a> though
***</li>
</ul>

<h3><a href="https://mail-index.netbsd.org/netbsd-advocacy/2014/10/20/msg000671.html" rel="nofollow">NetBSD at Open Source Conference Tokyo</a></h3>

<ul>
<li>The Japanese NetBSD users group held a booth at another recent open source conference</li>
<li>As always, they were running NetBSD on everything you can imagine</li>
<li>One of the users reports back to the mailing list on their experience, providing lots of pictures and links</li>
<li>Here&#39;s an interesting <a href="https://pbs.twimg.com/media/B0NnfcbCEAAmKIU.jpg:large" rel="nofollow">screenshot of NetBSD running various other BSDs in Xen</a>
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/unix/comments/2il383/question_about_the_bsd_community_as_a_whole/" rel="nofollow">More BSD switchers every day</a></h3>

<ul>
<li>A decade-long Linux user is considering making the switch, and asks Reddit about the BSD community</li>
<li>Tired of the pointless bickering he sees in his current community, he asks if the same problems exist over here and what he should expect</li>
<li>So far, he&#39;s found that BSD people seem to act more level-headed about things, and are much more practical, whereas some FSF/GNU/GPL people make open source a religion</li>
<li>There&#39;s also <a href="https://www.reddit.com/r/BSD/comments/2jpxj9/question_about_the_current_state_of_freebsd/" rel="nofollow">another semi-related thread</a> about another Linux user wanting to switch to BSD because of systemd and GNU people</li>
<li>There are some extremely well written and thought-out comments in the replies (in both threads), be sure to give them all a read</li>
<li>Maybe the OPs should&#39;ve just watched this show
***</li>
</ul>

<h2>Interview - Olivier Cochard-Labbé - <a href="mailto:olivier@cochard.me" rel="nofollow">olivier@cochard.me</a> / <a href="https://twitter.com/ocochardlabbe" rel="nofollow">@ocochardlabbe</a></h2>

<p>The BSD Router Project</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.banym.de/freebsd/install-freebsd-11-on-thinkpad-t420" rel="nofollow">FreeBSD -CURRENT on a T420</a></h3>

<ul>
<li>Thinkpads are quite popular with BSD developers and users</li>
<li>Most of the hardware seems to be supported across the BSDs (especially wifi)</li>
<li>This article walks through installing FreeBSD -CURRENT on a Thinkpad T420 with UEFI</li>
<li>If you&#39;ve got a Thinkpad, or especially this specific one, have a look at some of the steps involved
***</li>
</ul>

<h3><a href="https://www.teckelworks.com/2014/10/building-a-freenas-server-with-a-supermicro-5018a-mhn4/" rel="nofollow">FreeNAS on a Supermicro 5018A-MHN4</a></h3>

<ul>
<li>More and more people are migrating their NAS devices to BSD-based solutions</li>
<li>In this post, the author goes through setting up FreeNAS on some of his new hardware</li>
<li>His new rack-mounted FreeNAS machine has a low power Atom with eight cores and 64GB of RAM - quite a lot for its small form factor</li>
<li>The rest of the post details all of the hardware he chose and goes through the build process (with lots of cool pictures)
***</li>
</ul>

<h3><a href="http://hardenedbsd.org/article/shawn-webb/2014-10-15/hardening-procfs-and-linprocfs" rel="nofollow">Hardening procfs and linprocfs</a></h3>

<ul>
<li>There was an exploit published recently for SFTP in OpenSSH, but it mostly just affected Linux</li>
<li>There exists a native procfs in FreeBSD, which was the target point of that exploit, but it&#39;s not used very often</li>
<li>The Linux emulation layer also supports its own linprocfs, which was affected as well</li>
<li>The HardenedBSD guys weigh in on how to best solve the problem, and now support an additional protection layer from writing to memory with procfs</li>
<li>If you want to learn more about ASLR and HardenedBSD, be sure to check out <a href="http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover" rel="nofollow">our interview with Shawn</a> too
***</li>
</ul>

<h3><a href="http://pfsensesetup.com/bandwidth-monitoring-with-bandwidthd/" rel="nofollow">pfSense monitoring with bandwidthd</a></h3>

<ul>
<li>A lot of people run pfSense on their home network, and it&#39;s really useful to monitor the bandwidth usage</li>
<li>This article will walk you through setting up bandwidthd to do exactly that</li>
<li>bandwidthd monitors based on the IP address, rather than per-interface</li>
<li>It can also build some cool HTML graphs, and we love those pfSense graphs</li>
<li>Have a look at our <a href="http://www.bsdnow.tv/tutorials/vnstat-iperf" rel="nofollow">bandwidth monitoring and testing</a> tutorial for some more ideas
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2b5ZZ5qCv" rel="nofollow">Dave writes in</a></li>
<li><a href="http://slexy.org/view/s20aVvhv2d" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s2Vmwxy1QM" rel="nofollow">Zeke writes in</a></li>
<li><a href="http://slexy.org/view/s2LB6MKoNT" rel="nofollow">Bostjan writes in</a></li>
<li><a href="http://slexy.org/view/s2xxB9uOuV" rel="nofollow">Patrick writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://www.marc.info/?l=openbsd-tech&m=141357595922692&w=2" rel="nofollow">More</a> <a href="https://www.marc.info/?l=openbsd-cvs&m=141358124924479&w=2" rel="nofollow">old bugs</a></li>
<li><a href="https://www.marc.info/?l=openbsd-cvs&m=141332534304117&w=2" rel="nofollow">The Right Font™</a> (<a href="https://twitter.com/blakkheim/status/522162864409546753" rel="nofollow">see also</a>)
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>59: BSDって聞いたことある？</title>
  <link>https://www.bsdnow.tv/59</link>
  <guid isPermaLink="false">b1712d17-1c5f-4c0a-8722-3ad171336d67</guid>
  <pubDate>Wed, 15 Oct 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b1712d17-1c5f-4c0a-8722-3ad171336d67.mp3" length="57694324" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show we'll be talking with Hiroki Sato about the status of BSD in Japan. We also get to hear about how he got on the core team, and we just might find out why NetBSD is so popular over there! Answers to all your emails, the latest news, and even a brand new segment, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:20:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show we'll be talking with Hiroki Sato about the status of BSD in Japan. We also get to hear about how he got on the core team, and we just might find out why NetBSD is so popular over there! Answers to all your emails, the latest news, and even a brand new segment, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
BSD talks at XDC 2014 (https://www.youtube.com/channel/UCXlH5v1PkEhjzLFTUTm_U7g/videos)
This year's Xorg conference featured a few BSD-related talks
Matthieu Herrb, Status of the OpenBSD graphics stack (https://www.youtube.com/watch?v=KopgD4nTtnA)
Matthieu's talk details what's been done recently in Xenocara the OpenBSD kernel for graphics (slides here (http://www.openbsd.org/papers/xdc2014-xenocara.pdf))
Jean-Sébastien Pédron, The status of the graphics stack on FreeBSD (https://www.youtube.com/watch?v=POmxFleN3Bc) 
His presentation gives a history of major changes and outlines the current overall status of graphics in FreeBSD (slides here (http://www.x.org/wiki/Events/XDC2014/XDC2014PedronFreeBSD/XDC-2014_FreeBSD.pdf))
Francois Tigeot, Porting DRM/KMS drivers to DragonFlyBSD (https://www.youtube.com/watch?v=NdM7_yPGFDk)
Francois' talk tells the story of how he ported some of the DRM and KMS kernel drivers to DragonFly (slides here (http://www.x.org/wiki/Events/XDC2014/XDC2014TigeotDragonFlyBSD/XDC-2014_Porting_kms_drivers_to_DragonFly.pdf))
***
FreeBSD Quarterly Status Report (https://www.freebsd.org/news/status/report-2014-07-2014-09.html)
The FreeBSD project has a report of their activities between July and September of this year
Lots of ARM work has been done, and a goal for 11.0 is tier one support for the platform
The release includes reports from the cluster admin team, release team, ports team, core team and much more, but we've already covered most of the items on the show
If you're interested in seeing what the FreeBSD community has been up to lately, check the full report - it's huge
***
Monitoring pfSense logs using ELK (http://elijahpaul.co.uk/monitoring-pfsense-2-1-logs-using-elk-logstash-kibana-elasticsearch/)
If you're one of those people who loves the cool graphs and charts that pfSense can produce, this is the post for you
ELK (ElasticSearch, Logstash, Kibana) is a group of tools that let you collect, store, search and (most importantly) visualize logs
It works with lots of different things that output logs and can be sent to one central server for displaying
This post shows you how to set up pfSense to do remote logging to ELK and get some pretty awesome graphs
***
Some updates to IPFW (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=272840)
Even though PF gets a lot of attention, a lot of FreeBSD people still love IPFW
While mostly a dormant section of the source tree, some updates were recently committed to -CURRENT
The commit lists the user-visible changes, performance changes, ABI changes and internal changes
It should be merged back to -STABLE after a month or so of testing, and will probably end up in 10.2-RELEASE
Also check this blog post (http://blog.cochard.me/2014/10/ipfw-improvement-on-freebsd-current.html) for some more information and fancy graphs
***
Interview - Hiroki Sato (佐藤広生) - hrs@freebsd.org (mailto:hrs@freebsd.org) / @hiroki_sato (https://twitter.com/hiroki_sato)
BSD in Japan, technology conferences, various topics
News Roundup
pfSense on Hyper-V (https://virtual-ops.de/?p=600)
In case you didn't know, the latest pfSense snapshots support running on Hyper-V
Unfortunately, the current stable release is based on an old, unsupported FreeBSD 8.x base, so you have to use the snapshots for now
The author of the post tells about his experience running pfSense and gives lots of links to read if you're interested in doing the same
He also praises pfSense above other Linux-based solutions for its IPv6 support and high quality code
***
OpenBSD as a daily driver (https://www.reddit.com/r/openbsd/comments/2isz24/openbsd_as_a_daily_driver/)
A curious Reddit user posts to ask the community about using OpenBSD as an everyday desktop OS
The overall consensus is that it works great for that, stays out of your way and is quite reliable
Caveats would include there being no Adobe Flash support (though others consider this a blessing..) and it requiring a more hands-on approach to updating
If you're considering running OpenBSD as a "daily driver," check all the comments for more information and tips
***
Getting PF log statistics (https://secure.ciscodude.net/2014/10/09/firewall-log-stats/)
The author of this post runs an OpenBSD box in front of all his VMs at his colocation, and details his experiences with firewall logs
He usually investigates any IPs of interest with whois, nslookup, etc. - but this gets repetitive quickly, so..
He sets out to find the best way to gather firewall log statistics
After coming across a perl script (http://www.pantz.org/software/pf/pantzpfblockstats.html) to do this, he edited it a bit and is now a happy, lazy admin once again
You can try out his updated PF script here (https://github.com/tbaschak/Pantz-PFlog-Stats)
***
FlashRD 1.7 released (http://www.nmedia.net/flashrd/)
In case anyone's not familiar, flashrd is a tool to create OpenBSD images for embedded hardware devices, executing from a virtualized environment
This new version is based on (the currently unreleased) OpenBSD 5.6, and automatically adapts to the number of CPUs you have for building
It also includes fixes for 4k drives and lots of various other improvements
If you're interested in learning more, take a look at some of the slides and audio from the main developer on the website
***
Feedback/Questions
Antonio writes in (http://slexy.org/view/s20XvSa4h0)
Don writes in (http://slexy.org/view/s20lGUXW3d)
Andriy writes in (http://slexy.org/view/s2al5DFIO7)
Richard writes in (http://slexy.org/view/s203QoFuWs)
Robert writes in (http://slexy.org/view/s29WIplL6k)
***
Mailing List Gold
Subtle trolling (https://marc.info/?l=openbsd-cvs&amp;amp;m=141271076115386&amp;amp;w=2)
Old bugs with old fixes (https://marc.info/?l=openbsd-cvs&amp;amp;m=141275713329601&amp;amp;w=2)
A pig reinstall (https://lists.freebsd.org/pipermail/freebsd-ports/2014-October/095906.html)
Strange DOS-like environment (https://lists.freebsd.org/pipermail/freebsd-doc/2014-October/024408.html)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, japan, japanese, 日本語, conference, hiroki sato, daichi goto, 後藤大地, 佐藤広生, allbsd, eurobsdcon, asiabsdcon, flashrd, freenas, pfsense, xdc2014</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show we&#39;ll be talking with Hiroki Sato about the status of BSD in Japan. We also get to hear about how he got on the core team, and we just might find out why NetBSD is so popular over there! Answers to all your emails, the latest news, and even a brand new segment, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.youtube.com/channel/UCXlH5v1PkEhjzLFTUTm_U7g/videos" rel="nofollow">BSD talks at XDC 2014</a></h3>

<ul>
<li>This year&#39;s Xorg conference featured a few BSD-related talks</li>
<li>Matthieu Herrb, <a href="https://www.youtube.com/watch?v=KopgD4nTtnA" rel="nofollow">Status of the OpenBSD graphics stack</a></li>
<li>Matthieu&#39;s talk details what&#39;s been done recently in Xenocara the OpenBSD kernel for graphics (<a href="http://www.openbsd.org/papers/xdc2014-xenocara.pdf" rel="nofollow">slides here</a>)</li>
<li>Jean-Sébastien Pédron, <a href="https://www.youtube.com/watch?v=POmxFleN3Bc" rel="nofollow">The status of the graphics stack on FreeBSD</a> </li>
<li>His presentation gives a history of major changes and outlines the current overall status of graphics in FreeBSD (<a href="http://www.x.org/wiki/Events/XDC2014/XDC2014PedronFreeBSD/XDC-2014_FreeBSD.pdf" rel="nofollow">slides here</a>)</li>
<li>Francois Tigeot, <a href="https://www.youtube.com/watch?v=NdM7_yPGFDk" rel="nofollow">Porting DRM/KMS drivers to DragonFlyBSD</a></li>
<li>Francois&#39; talk tells the story of how he ported some of the DRM and KMS kernel drivers to DragonFly (<a href="http://www.x.org/wiki/Events/XDC2014/XDC2014TigeotDragonFlyBSD/XDC-2014_Porting_kms_drivers_to_DragonFly.pdf" rel="nofollow">slides here</a>)
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2014-07-2014-09.html" rel="nofollow">FreeBSD Quarterly Status Report</a></h3>

<ul>
<li>The FreeBSD project has a report of their activities between July and September of this year</li>
<li>Lots of ARM work has been done, and a goal for 11.0 is tier one support for the platform</li>
<li>The release includes reports from the cluster admin team, release team, ports team, core team and much more, but we&#39;ve already covered most of the items on the show</li>
<li>If you&#39;re interested in seeing what the FreeBSD community has been up to lately, check the full report - it&#39;s huge
***</li>
</ul>

<h3><a href="http://elijahpaul.co.uk/monitoring-pfsense-2-1-logs-using-elk-logstash-kibana-elasticsearch/" rel="nofollow">Monitoring pfSense logs using ELK</a></h3>

<ul>
<li>If you&#39;re one of those people who loves the cool graphs and charts that pfSense can produce, this is the post for you</li>
<li>ELK (ElasticSearch, Logstash, Kibana) is a group of tools that let you collect, store, search and (most importantly) visualize logs</li>
<li>It works with lots of different things that output logs and can be sent to one central server for displaying</li>
<li>This post shows you how to set up pfSense to do remote logging to ELK and get some pretty awesome graphs
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=272840" rel="nofollow">Some updates to IPFW</a></h3>

<ul>
<li>Even though PF gets a lot of attention, a lot of FreeBSD people still love IPFW</li>
<li>While mostly a dormant section of the source tree, some updates were recently committed to -CURRENT</li>
<li>The commit lists the user-visible changes, performance changes, ABI changes and internal changes</li>
<li>It should be merged back to -STABLE after a month or so of testing, and will probably end up in 10.2-RELEASE</li>
<li>Also check <a href="http://blog.cochard.me/2014/10/ipfw-improvement-on-freebsd-current.html" rel="nofollow">this blog post</a> for some more information and fancy graphs
***</li>
</ul>

<h2>Interview - Hiroki Sato (佐藤広生) - <a href="mailto:hrs@freebsd.org" rel="nofollow">hrs@freebsd.org</a> / <a href="https://twitter.com/hiroki_sato" rel="nofollow">@hiroki_sato</a></h2>

<p>BSD in Japan, technology conferences, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://virtual-ops.de/?p=600" rel="nofollow">pfSense on Hyper-V</a></h3>

<ul>
<li>In case you didn&#39;t know, the latest pfSense snapshots support running on Hyper-V</li>
<li>Unfortunately, the current stable release is based on an old, unsupported FreeBSD 8.x base, so you have to use the snapshots for now</li>
<li>The author of the post tells about his experience running pfSense and gives lots of links to read if you&#39;re interested in doing the same</li>
<li>He also praises pfSense above other Linux-based solutions for its IPv6 support and high quality code
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/openbsd/comments/2isz24/openbsd_as_a_daily_driver/" rel="nofollow">OpenBSD as a daily driver</a></h3>

<ul>
<li>A curious Reddit user posts to ask the community about using OpenBSD as an everyday desktop OS</li>
<li>The overall consensus is that it works great for that, stays out of your way and is quite reliable</li>
<li>Caveats would include there being no Adobe Flash support (though others consider this a blessing..) and it requiring a more hands-on approach to updating</li>
<li>If you&#39;re considering running OpenBSD as a &quot;daily driver,&quot; check all the comments for more information and tips
***</li>
</ul>

<h3><a href="https://secure.ciscodude.net/2014/10/09/firewall-log-stats/" rel="nofollow">Getting PF log statistics</a></h3>

<ul>
<li>The author of this post runs an OpenBSD box in front of all his VMs at his colocation, and details his experiences with firewall logs</li>
<li>He usually investigates any IPs of interest with whois, nslookup, etc. - but this gets repetitive quickly, so..</li>
<li>He sets out to find the best way to gather firewall log statistics</li>
<li>After coming across <a href="http://www.pantz.org/software/pf/pantzpfblockstats.html" rel="nofollow">a perl script</a> to do this, he edited it a bit and is now a happy, lazy admin once again</li>
<li>You can try out his updated PF script <a href="https://github.com/tbaschak/Pantz-PFlog-Stats" rel="nofollow">here</a>
***</li>
</ul>

<h3><a href="http://www.nmedia.net/flashrd/" rel="nofollow">FlashRD 1.7 released</a></h3>

<ul>
<li>In case anyone&#39;s not familiar, flashrd is a tool to create OpenBSD images for embedded hardware devices, executing from a virtualized environment</li>
<li>This new version is based on (the currently unreleased) OpenBSD 5.6, and automatically adapts to the number of CPUs you have for building</li>
<li>It also includes fixes for 4k drives and lots of various other improvements</li>
<li>If you&#39;re interested in learning more, take a look at some of the slides and audio from the main developer on the website
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20XvSa4h0" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s20lGUXW3d" rel="nofollow">Don writes in</a></li>
<li><a href="http://slexy.org/view/s2al5DFIO7" rel="nofollow">Andriy writes in</a></li>
<li><a href="http://slexy.org/view/s203QoFuWs" rel="nofollow">Richard writes in</a></li>
<li><a href="http://slexy.org/view/s29WIplL6k" rel="nofollow">Robert writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://marc.info/?l=openbsd-cvs&m=141271076115386&w=2" rel="nofollow">Subtle trolling</a></li>
<li><a href="https://marc.info/?l=openbsd-cvs&m=141275713329601&w=2" rel="nofollow">Old bugs with old fixes</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2014-October/095906.html" rel="nofollow">A pig reinstall</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-doc/2014-October/024408.html" rel="nofollow">Strange DOS-like environment</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show we&#39;ll be talking with Hiroki Sato about the status of BSD in Japan. We also get to hear about how he got on the core team, and we just might find out why NetBSD is so popular over there! Answers to all your emails, the latest news, and even a brand new segment, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.youtube.com/channel/UCXlH5v1PkEhjzLFTUTm_U7g/videos" rel="nofollow">BSD talks at XDC 2014</a></h3>

<ul>
<li>This year&#39;s Xorg conference featured a few BSD-related talks</li>
<li>Matthieu Herrb, <a href="https://www.youtube.com/watch?v=KopgD4nTtnA" rel="nofollow">Status of the OpenBSD graphics stack</a></li>
<li>Matthieu&#39;s talk details what&#39;s been done recently in Xenocara the OpenBSD kernel for graphics (<a href="http://www.openbsd.org/papers/xdc2014-xenocara.pdf" rel="nofollow">slides here</a>)</li>
<li>Jean-Sébastien Pédron, <a href="https://www.youtube.com/watch?v=POmxFleN3Bc" rel="nofollow">The status of the graphics stack on FreeBSD</a> </li>
<li>His presentation gives a history of major changes and outlines the current overall status of graphics in FreeBSD (<a href="http://www.x.org/wiki/Events/XDC2014/XDC2014PedronFreeBSD/XDC-2014_FreeBSD.pdf" rel="nofollow">slides here</a>)</li>
<li>Francois Tigeot, <a href="https://www.youtube.com/watch?v=NdM7_yPGFDk" rel="nofollow">Porting DRM/KMS drivers to DragonFlyBSD</a></li>
<li>Francois&#39; talk tells the story of how he ported some of the DRM and KMS kernel drivers to DragonFly (<a href="http://www.x.org/wiki/Events/XDC2014/XDC2014TigeotDragonFlyBSD/XDC-2014_Porting_kms_drivers_to_DragonFly.pdf" rel="nofollow">slides here</a>)
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2014-07-2014-09.html" rel="nofollow">FreeBSD Quarterly Status Report</a></h3>

<ul>
<li>The FreeBSD project has a report of their activities between July and September of this year</li>
<li>Lots of ARM work has been done, and a goal for 11.0 is tier one support for the platform</li>
<li>The release includes reports from the cluster admin team, release team, ports team, core team and much more, but we&#39;ve already covered most of the items on the show</li>
<li>If you&#39;re interested in seeing what the FreeBSD community has been up to lately, check the full report - it&#39;s huge
***</li>
</ul>

<h3><a href="http://elijahpaul.co.uk/monitoring-pfsense-2-1-logs-using-elk-logstash-kibana-elasticsearch/" rel="nofollow">Monitoring pfSense logs using ELK</a></h3>

<ul>
<li>If you&#39;re one of those people who loves the cool graphs and charts that pfSense can produce, this is the post for you</li>
<li>ELK (ElasticSearch, Logstash, Kibana) is a group of tools that let you collect, store, search and (most importantly) visualize logs</li>
<li>It works with lots of different things that output logs and can be sent to one central server for displaying</li>
<li>This post shows you how to set up pfSense to do remote logging to ELK and get some pretty awesome graphs
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=272840" rel="nofollow">Some updates to IPFW</a></h3>

<ul>
<li>Even though PF gets a lot of attention, a lot of FreeBSD people still love IPFW</li>
<li>While mostly a dormant section of the source tree, some updates were recently committed to -CURRENT</li>
<li>The commit lists the user-visible changes, performance changes, ABI changes and internal changes</li>
<li>It should be merged back to -STABLE after a month or so of testing, and will probably end up in 10.2-RELEASE</li>
<li>Also check <a href="http://blog.cochard.me/2014/10/ipfw-improvement-on-freebsd-current.html" rel="nofollow">this blog post</a> for some more information and fancy graphs
***</li>
</ul>

<h2>Interview - Hiroki Sato (佐藤広生) - <a href="mailto:hrs@freebsd.org" rel="nofollow">hrs@freebsd.org</a> / <a href="https://twitter.com/hiroki_sato" rel="nofollow">@hiroki_sato</a></h2>

<p>BSD in Japan, technology conferences, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://virtual-ops.de/?p=600" rel="nofollow">pfSense on Hyper-V</a></h3>

<ul>
<li>In case you didn&#39;t know, the latest pfSense snapshots support running on Hyper-V</li>
<li>Unfortunately, the current stable release is based on an old, unsupported FreeBSD 8.x base, so you have to use the snapshots for now</li>
<li>The author of the post tells about his experience running pfSense and gives lots of links to read if you&#39;re interested in doing the same</li>
<li>He also praises pfSense above other Linux-based solutions for its IPv6 support and high quality code
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/openbsd/comments/2isz24/openbsd_as_a_daily_driver/" rel="nofollow">OpenBSD as a daily driver</a></h3>

<ul>
<li>A curious Reddit user posts to ask the community about using OpenBSD as an everyday desktop OS</li>
<li>The overall consensus is that it works great for that, stays out of your way and is quite reliable</li>
<li>Caveats would include there being no Adobe Flash support (though others consider this a blessing..) and it requiring a more hands-on approach to updating</li>
<li>If you&#39;re considering running OpenBSD as a &quot;daily driver,&quot; check all the comments for more information and tips
***</li>
</ul>

<h3><a href="https://secure.ciscodude.net/2014/10/09/firewall-log-stats/" rel="nofollow">Getting PF log statistics</a></h3>

<ul>
<li>The author of this post runs an OpenBSD box in front of all his VMs at his colocation, and details his experiences with firewall logs</li>
<li>He usually investigates any IPs of interest with whois, nslookup, etc. - but this gets repetitive quickly, so..</li>
<li>He sets out to find the best way to gather firewall log statistics</li>
<li>After coming across <a href="http://www.pantz.org/software/pf/pantzpfblockstats.html" rel="nofollow">a perl script</a> to do this, he edited it a bit and is now a happy, lazy admin once again</li>
<li>You can try out his updated PF script <a href="https://github.com/tbaschak/Pantz-PFlog-Stats" rel="nofollow">here</a>
***</li>
</ul>

<h3><a href="http://www.nmedia.net/flashrd/" rel="nofollow">FlashRD 1.7 released</a></h3>

<ul>
<li>In case anyone&#39;s not familiar, flashrd is a tool to create OpenBSD images for embedded hardware devices, executing from a virtualized environment</li>
<li>This new version is based on (the currently unreleased) OpenBSD 5.6, and automatically adapts to the number of CPUs you have for building</li>
<li>It also includes fixes for 4k drives and lots of various other improvements</li>
<li>If you&#39;re interested in learning more, take a look at some of the slides and audio from the main developer on the website
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20XvSa4h0" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s20lGUXW3d" rel="nofollow">Don writes in</a></li>
<li><a href="http://slexy.org/view/s2al5DFIO7" rel="nofollow">Andriy writes in</a></li>
<li><a href="http://slexy.org/view/s203QoFuWs" rel="nofollow">Richard writes in</a></li>
<li><a href="http://slexy.org/view/s29WIplL6k" rel="nofollow">Robert writes in</a>
***</li>
</ul>

<h2>Mailing List Gold</h2>

<ul>
<li><a href="https://marc.info/?l=openbsd-cvs&m=141271076115386&w=2" rel="nofollow">Subtle trolling</a></li>
<li><a href="https://marc.info/?l=openbsd-cvs&m=141275713329601&w=2" rel="nofollow">Old bugs with old fixes</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-ports/2014-October/095906.html" rel="nofollow">A pig reinstall</a></li>
<li><a href="https://lists.freebsd.org/pipermail/freebsd-doc/2014-October/024408.html" rel="nofollow">Strange DOS-like environment</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>58: Behind the Masq</title>
  <link>https://www.bsdnow.tv/58</link>
  <guid isPermaLink="false">987ec34a-a4f6-4c08-afa9-f39b542e05c5</guid>
  <pubDate>Wed, 08 Oct 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/987ec34a-a4f6-4c08-afa9-f39b542e05c5.mp3" length="54646708" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week on the show, we'll be talking to Matt Ranney and George Kola about how they use FreeBSD at Voxer, and how to get more companies to switch over. After that, we'll show you how to filter website ads at the gateway level, using DNSMasq. All this week's news and answers to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:15:53</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week on the show, we'll be talking to Matt Ranney and George Kola about how they use FreeBSD at Voxer, and how to get more companies to switch over. After that, we'll show you how to filter website ads at the gateway level, using DNSMasq. All this week's news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
NetBSD's EuroBSDCon report (https://blog.netbsd.org/tnf/entry/netbsd_developer_summit_at_eurobsdcon)
This year's EuroBSDCon had the record number of NetBSD developers attending
The NetBSD guys had a small devsummit as well, and this blog post details some of their activities
Pierre Pronchery also talked about EdgeBSD there (also see our interview (http://www.bsdnow.tv/episodes/2014_04_01-edgy_bsd_users) if you haven't already)
Hopefully this trend continues, and NetBSD starts to have even more of a presence at the conferences
***
Upcoming features in OpenBSD 5.6 (http://lteo.net/blog/2014/10/01/a-sneak-peek-at-the-upcoming-openbsd-5-dot-6-release/)
OpenBSD 5.6 is to be released in just under a month from now, and one of the developers wrote a blog post about some of the new features
The post is mostly a collection of various links, many of which we've discussed before
It'll be the first version with LibreSSL and many other cool things
We will, of course, have all the details on the day of release
There are some good comments (https://news.ycombinator.com/item?id=8413028) on hacker news about 5.6 as well 
***
FreeBSD ARMv8-based implementation (http://www.prnewswire.com/news-releases/cavium-to-sponsor-freebsd-armv8-based-implementation-277724361.html)
The FreeBSD foundation is sponsoring some work to port FreeBSD to the new ThunderX ARM CPU family
With the potential to have up to 48 cores, this type of CPU might make ARM-based servers a more appealing option
Cavium, the company involved with this deal, seems to have lots of BSD fans
This collaboration is expected to result in Tier 1 recognition of the ARMv8 architecture
***
Updating orphaned OpenBSD ports (https://marc.info/?l=openbsd-ports&amp;amp;m=141235737615585&amp;amp;w=2)
We discussed OpenBSD porting over portscout from FreeBSD a while back
Their ports team is making full use of it now, and they're also looking for people to help update some unmaintained ports
A new subdomain, portroach.openbsd.org (http://portroach.openbsd.org/), will let you view all the ports information easily
If you're interested in learning to port software, or just want to help update a port you use, this is a good chance to get involved
***
Interview - Matt Ranney &amp;amp; George Kola - mjr@ranney.com (mailto:mjr@ranney.com) &amp;amp; george.kola@voxer.com (mailto:george.kola@voxer.com)
BSD at Voxer, companies switching from Linux, community interaction
Tutorial
Adblocking with DNSMasq &amp;amp; Pixelserv (http://www.bsdnow.tv/tutorials/dnsmasq)
News Roundup
GhostBSD 4.0 released (http://ghostbsd.org/4.0-release)
The 4.0 branch of GhostBSD has finally been released, based on FreeBSD 10
With it come all the big 10.0 changes: clang instead of gcc, pkgng by default, make replaced by bmake
Mate is now the default desktop, with different workstation styles to choose from
***
Reports from PF about banned IPs (http://ypnose.org/blog/2014/newbrute-pf.html)
If you run any kind of public-facing server, you've probably seen your logs fill up with unwanted traffic
This is especially true if you run SSH on port 22, which the author of this post seems to
A lot can be done with just PF and some brute force tables
He goes through some different options for blocking Chinese IPs and break-in attempts
It includes a useful script he wrote to get reports about the IPs being blocked via email
***
NetBSD 6.1.5 and 6.0.6 released (https://blog.netbsd.org/tnf/entry/netbsd_6_1_5_and)
The 6.1 and 6.0 branches of NetBSD got some updates
They include a number of security and stability fixes - plenty of OpenSSL mentions
Various panics and other small bugs also got fixed
***
OpenSSH 6.7 released (https://lists.mindrot.org/pipermail/openssh-unix-announce/2014-October/000119.html)
After a long delay, OpenSSH 6.7 has finally been released
Major internal refactoring has been done to make part of OpenSSH usable as a library
SFTP transfers can now be resumed
Lots of bug fixes, a few more new features - check the release notes for all the details
This release disables some insecure ciphers by default, so keep that in mind if you connect with legacy clients that use Arcfour or CBC modes
***
Feedback/Questions
Andriy writes in (http://slexy.org/view/s218tT9C7v)
Karl writes in (http://slexy.org/view/s2WY5R5e0l)
Possnfiffer writes in (http://slexy.org/view/s20z8MPBVw)
Brad writes in (http://slexy.org/view/s21h2Yx5al)
Solomon writes in (http://slexy.org/view/s21xu9U0qt)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, voxer, whatsapp, dnsmasq, pixelserv, ad blocking, adblock plus, advertisements, malware, linux vs bsd, differences, linux, arm, eurobsdcon</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week on the show, we&#39;ll be talking to Matt Ranney and George Kola about how they use FreeBSD at Voxer, and how to get more companies to switch over. After that, we&#39;ll show you how to filter website ads at the gateway level, using DNSMasq. All this week&#39;s news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_developer_summit_at_eurobsdcon" rel="nofollow">NetBSD&#39;s EuroBSDCon report</a></h3>

<ul>
<li>This year&#39;s EuroBSDCon had the record number of NetBSD developers attending</li>
<li>The NetBSD guys had a small devsummit as well, and this blog post details some of their activities</li>
<li>Pierre Pronchery also talked about EdgeBSD there (also see <a href="http://www.bsdnow.tv/episodes/2014_04_01-edgy_bsd_users" rel="nofollow">our interview</a> if you haven&#39;t already)</li>
<li>Hopefully this trend continues, and NetBSD starts to have even more of a presence at the conferences
***</li>
</ul>

<h3><a href="http://lteo.net/blog/2014/10/01/a-sneak-peek-at-the-upcoming-openbsd-5-dot-6-release/" rel="nofollow">Upcoming features in OpenBSD 5.6</a></h3>

<ul>
<li>OpenBSD 5.6 is to be released in just under a month from now, and one of the developers wrote a blog post about some of the new features</li>
<li>The post is mostly a collection of various links, many of which we&#39;ve discussed before</li>
<li>It&#39;ll be the first version with LibreSSL and many other cool things</li>
<li>We will, of course, have all the details on the day of release</li>
<li>There are some good <a href="https://news.ycombinator.com/item?id=8413028" rel="nofollow">comments</a> on hacker news about 5.6 as well 
***</li>
</ul>

<h3><a href="http://www.prnewswire.com/news-releases/cavium-to-sponsor-freebsd-armv8-based-implementation-277724361.html" rel="nofollow">FreeBSD ARMv8-based implementation</a></h3>

<ul>
<li>The FreeBSD foundation is sponsoring some work to port FreeBSD to the new ThunderX ARM CPU family</li>
<li>With the potential to have up to 48 cores, this type of CPU might make ARM-based servers a more appealing option</li>
<li>Cavium, the company involved with this deal, seems to have lots of BSD fans</li>
<li>This collaboration is expected to result in Tier 1 recognition of the ARMv8 architecture
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-ports&m=141235737615585&w=2" rel="nofollow">Updating orphaned OpenBSD ports</a></h3>

<ul>
<li>We discussed OpenBSD porting over portscout from FreeBSD a while back</li>
<li>Their ports team is making full use of it now, and they&#39;re also looking for people to help update some unmaintained ports</li>
<li>A new subdomain, <a href="http://portroach.openbsd.org/" rel="nofollow">portroach.openbsd.org</a>, will let you view all the ports information easily</li>
<li>If you&#39;re interested in learning to port software, or just want to help update a port you use, this is a good chance to get involved
***</li>
</ul>

<h2>Interview - Matt Ranney &amp; George Kola - <a href="mailto:mjr@ranney.com" rel="nofollow">mjr@ranney.com</a> &amp; <a href="mailto:george.kola@voxer.com" rel="nofollow">george.kola@voxer.com</a></h2>

<p>BSD at Voxer, companies switching from Linux, community interaction</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/dnsmasq" rel="nofollow">Adblocking with DNSMasq &amp; Pixelserv</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://ghostbsd.org/4.0-release" rel="nofollow">GhostBSD 4.0 released</a></h3>

<ul>
<li>The 4.0 branch of GhostBSD has finally been released, based on FreeBSD 10</li>
<li>With it come all the big 10.0 changes: clang instead of gcc, pkgng by default, make replaced by bmake</li>
<li>Mate is now the default desktop, with different workstation styles to choose from
***</li>
</ul>

<h3><a href="http://ypnose.org/blog/2014/newbrute-pf.html" rel="nofollow">Reports from PF about banned IPs</a></h3>

<ul>
<li>If you run any kind of public-facing server, you&#39;ve probably seen your logs fill up with unwanted traffic</li>
<li>This is especially true if you run SSH on port 22, which the author of this post seems to</li>
<li>A lot can be done with just PF and some brute force tables</li>
<li>He goes through some different options for blocking Chinese IPs and break-in attempts</li>
<li>It includes a useful script he wrote to get reports about the IPs being blocked via email
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_6_1_5_and" rel="nofollow">NetBSD 6.1.5 and 6.0.6 released</a></h3>

<ul>
<li>The 6.1 and 6.0 branches of NetBSD got some updates</li>
<li>They include a number of security and stability fixes - plenty of OpenSSL mentions</li>
<li>Various panics and other small bugs also got fixed
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-announce/2014-October/000119.html" rel="nofollow">OpenSSH 6.7 released</a></h3>

<ul>
<li>After a long delay, OpenSSH 6.7 has finally been released</li>
<li>Major internal refactoring has been done to make part of OpenSSH usable as a library</li>
<li>SFTP transfers can now be resumed</li>
<li>Lots of bug fixes, a few more new features - check the release notes for all the details</li>
<li>This release disables some insecure ciphers by default, so keep that in mind if you connect with legacy clients that use Arcfour or CBC modes
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s218tT9C7v" rel="nofollow">Andriy writes in</a></li>
<li><a href="http://slexy.org/view/s2WY5R5e0l" rel="nofollow">Karl writes in</a></li>
<li><a href="http://slexy.org/view/s20z8MPBVw" rel="nofollow">Possnfiffer writes in</a></li>
<li><a href="http://slexy.org/view/s21h2Yx5al" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s21xu9U0qt" rel="nofollow">Solomon writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week on the show, we&#39;ll be talking to Matt Ranney and George Kola about how they use FreeBSD at Voxer, and how to get more companies to switch over. After that, we&#39;ll show you how to filter website ads at the gateway level, using DNSMasq. All this week&#39;s news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_developer_summit_at_eurobsdcon" rel="nofollow">NetBSD&#39;s EuroBSDCon report</a></h3>

<ul>
<li>This year&#39;s EuroBSDCon had the record number of NetBSD developers attending</li>
<li>The NetBSD guys had a small devsummit as well, and this blog post details some of their activities</li>
<li>Pierre Pronchery also talked about EdgeBSD there (also see <a href="http://www.bsdnow.tv/episodes/2014_04_01-edgy_bsd_users" rel="nofollow">our interview</a> if you haven&#39;t already)</li>
<li>Hopefully this trend continues, and NetBSD starts to have even more of a presence at the conferences
***</li>
</ul>

<h3><a href="http://lteo.net/blog/2014/10/01/a-sneak-peek-at-the-upcoming-openbsd-5-dot-6-release/" rel="nofollow">Upcoming features in OpenBSD 5.6</a></h3>

<ul>
<li>OpenBSD 5.6 is to be released in just under a month from now, and one of the developers wrote a blog post about some of the new features</li>
<li>The post is mostly a collection of various links, many of which we&#39;ve discussed before</li>
<li>It&#39;ll be the first version with LibreSSL and many other cool things</li>
<li>We will, of course, have all the details on the day of release</li>
<li>There are some good <a href="https://news.ycombinator.com/item?id=8413028" rel="nofollow">comments</a> on hacker news about 5.6 as well 
***</li>
</ul>

<h3><a href="http://www.prnewswire.com/news-releases/cavium-to-sponsor-freebsd-armv8-based-implementation-277724361.html" rel="nofollow">FreeBSD ARMv8-based implementation</a></h3>

<ul>
<li>The FreeBSD foundation is sponsoring some work to port FreeBSD to the new ThunderX ARM CPU family</li>
<li>With the potential to have up to 48 cores, this type of CPU might make ARM-based servers a more appealing option</li>
<li>Cavium, the company involved with this deal, seems to have lots of BSD fans</li>
<li>This collaboration is expected to result in Tier 1 recognition of the ARMv8 architecture
***</li>
</ul>

<h3><a href="https://marc.info/?l=openbsd-ports&m=141235737615585&w=2" rel="nofollow">Updating orphaned OpenBSD ports</a></h3>

<ul>
<li>We discussed OpenBSD porting over portscout from FreeBSD a while back</li>
<li>Their ports team is making full use of it now, and they&#39;re also looking for people to help update some unmaintained ports</li>
<li>A new subdomain, <a href="http://portroach.openbsd.org/" rel="nofollow">portroach.openbsd.org</a>, will let you view all the ports information easily</li>
<li>If you&#39;re interested in learning to port software, or just want to help update a port you use, this is a good chance to get involved
***</li>
</ul>

<h2>Interview - Matt Ranney &amp; George Kola - <a href="mailto:mjr@ranney.com" rel="nofollow">mjr@ranney.com</a> &amp; <a href="mailto:george.kola@voxer.com" rel="nofollow">george.kola@voxer.com</a></h2>

<p>BSD at Voxer, companies switching from Linux, community interaction</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/dnsmasq" rel="nofollow">Adblocking with DNSMasq &amp; Pixelserv</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://ghostbsd.org/4.0-release" rel="nofollow">GhostBSD 4.0 released</a></h3>

<ul>
<li>The 4.0 branch of GhostBSD has finally been released, based on FreeBSD 10</li>
<li>With it come all the big 10.0 changes: clang instead of gcc, pkgng by default, make replaced by bmake</li>
<li>Mate is now the default desktop, with different workstation styles to choose from
***</li>
</ul>

<h3><a href="http://ypnose.org/blog/2014/newbrute-pf.html" rel="nofollow">Reports from PF about banned IPs</a></h3>

<ul>
<li>If you run any kind of public-facing server, you&#39;ve probably seen your logs fill up with unwanted traffic</li>
<li>This is especially true if you run SSH on port 22, which the author of this post seems to</li>
<li>A lot can be done with just PF and some brute force tables</li>
<li>He goes through some different options for blocking Chinese IPs and break-in attempts</li>
<li>It includes a useful script he wrote to get reports about the IPs being blocked via email
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_6_1_5_and" rel="nofollow">NetBSD 6.1.5 and 6.0.6 released</a></h3>

<ul>
<li>The 6.1 and 6.0 branches of NetBSD got some updates</li>
<li>They include a number of security and stability fixes - plenty of OpenSSL mentions</li>
<li>Various panics and other small bugs also got fixed
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-announce/2014-October/000119.html" rel="nofollow">OpenSSH 6.7 released</a></h3>

<ul>
<li>After a long delay, OpenSSH 6.7 has finally been released</li>
<li>Major internal refactoring has been done to make part of OpenSSH usable as a library</li>
<li>SFTP transfers can now be resumed</li>
<li>Lots of bug fixes, a few more new features - check the release notes for all the details</li>
<li>This release disables some insecure ciphers by default, so keep that in mind if you connect with legacy clients that use Arcfour or CBC modes
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s218tT9C7v" rel="nofollow">Andriy writes in</a></li>
<li><a href="http://slexy.org/view/s2WY5R5e0l" rel="nofollow">Karl writes in</a></li>
<li><a href="http://slexy.org/view/s20z8MPBVw" rel="nofollow">Possnfiffer writes in</a></li>
<li><a href="http://slexy.org/view/s21h2Yx5al" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s21xu9U0qt" rel="nofollow">Solomon writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>57: The Daemon's Apprentice</title>
  <link>https://www.bsdnow.tv/57</link>
  <guid isPermaLink="false">fe6cb8d4-b1ab-4260-a466-435ed66e003f</guid>
  <pubDate>Wed, 01 Oct 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fe6cb8d4-b1ab-4260-a466-435ed66e003f.mp3" length="65007508" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We're back from EuroBSDCon! This week we'll be talking with Steve Wills about mentoring new BSD developers. If you've ever considered becoming a developer or helping out, it's actually really easy to get involved. We've also got all the BSD news for the week and answers to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:30:17</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We're back from EuroBSDCon! This week we'll be talking with Steve Wills about mentoring new BSD developers. If you've ever considered becoming a developer or helping out, it's actually really easy to get involved. We've also got all the BSD news for the week and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
NetBSD at Hiroshima Open Source Conference (http://mail-index.netbsd.org/netbsd-advocacy/2014/09/26/msg000669.html)
NetBSD developers are hard at work, putting NetBSD on everything they can find
At a technology conference in Hiroshima, some developers brought their exotic machines to put on display
As usual, there are lots of pictures and a nice report from the conference
***
FreeBSD's Linux emulation overhaul (https://svnweb.freebsd.org/ports?limit_changes=0&amp;amp;view=revision&amp;amp;revision=368845)
For a long time, FreeBSD's emulation layer has been based on an ancient Fedora 10 system
If you've ever needed to install Adobe Flash on BSD, you'll be stuck with all this extra junk
With some recent work, that's been replaced with a recent CentOS release
This opens up the door for newer versions of Skype to run on FreeBSD, and maybe even Steam someday
***
pfSense 2.2-BETA (https://blog.pfsense.org/?p=1449)
Big changes are coming in pfSense land, with their upcoming 2.2 release
We talked to the developer (http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense) a while back about future plans, and now they're finally out there
The 2.2 branch will be based on FreeBSD 10-STABLE (instead of 8.3) and include lots of performance fixes
It also includes some security updates, lots of package changes and updates and much more
You can check the full list of changes (https://doc.pfsense.org/index.php/2.2_New_Features_and_Changes) on their wiki
***
NetBSD on the Raspberry Pi (http://www.cambus.net/netbsd-on-the-raspberry-pi/)
This article shows how you can install NetBSD on the ever-so-popular Raspberry Pi
As of right now, you'll need to use a -CURRENT snapshot to do it
It also shows how to grow the filesystem to fill up an SD card, some pkgsrc basics and how to get some initial things set up
Can anyone find something that you can't install NetBSD on?
***
Interview - Steve Wills - swills@freebsd.org (mailto:swills@freebsd.org) / @swills (https://twitter.com/swills)
Mentoring new BSD developers
News Roundup
MidnightBSD 0.5 released (http://www.midnightbsd.org/notes/)
We don't hear a whole lot about MidnightBSD, but they've just released version 0.5
It's got a round of the latest FreeBSD security patches, driver updates and various small things
Maybe one of their developers could come on the show sometime and tell us more about the project
***
BSD Router Project 1.52 released (http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.52/)
The newest update for the BSD Router Project is out
This version is based on a snapshot of 10-STABLE that's very close to 10.1-RELEASE
It's mostly a bugfix release, but includes some small changes and package updates
***
Configuring a DragonFly BSD desktop (http://www.dragonflydigest.com/2014/09/19/14751.html)
We've done tutorials on how to set up a FreeBSD or OpenBSD desktop, but maybe you're more interested in DragonFly
In this post from Justin Sherrill, you'll learn some of the steps to do just that
He pulled out an old desktop machine, gave it a try and seems to be pleased with the results
It includes a few Xorg tips, and there are some comments about the possibility of making a GUI DragonFly installer
***
Building a mini-ITX pfSense box (http://pakitong.blogspot.com/2014/09/jetway-j7f2-four-lan-mini-itx-for.html)
Another week, another pfSense firewall build post
This time, the author is installing to a Jetway J7F2, a mini-ITX device with four LAN ports
He used to be a m0n0wall guy, but wanted to give the more modern pfSense a try
Lots of great pictures of the hardware, which we always love
***
Feedback/Questions
Damian writes in (http://slexy.org/view/s2184TfOKD)
Jan writes in (http://slexy.org/view/s20uAdTwLv)
Dale writes in (http://slexy.org/view/s20es52IgZ)
Joe writes in (http://slexy.org/view/s2mjulpac6)
Bostjan writes in (http://slexy.org/view/s2BvNC8cgi)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, eurobsdcon, 2014, presentation, talk, steve wills, mentoring, developers, community, ports, bsdrp, bash, linux, exploit, pfsense, devsummit, shellshock</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;re back from EuroBSDCon! This week we&#39;ll be talking with Steve Wills about mentoring new BSD developers. If you&#39;ve ever considered becoming a developer or helping out, it&#39;s actually really easy to get involved. We&#39;ve also got all the BSD news for the week and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://mail-index.netbsd.org/netbsd-advocacy/2014/09/26/msg000669.html" rel="nofollow">NetBSD at Hiroshima Open Source Conference</a></h3>

<ul>
<li>NetBSD developers are hard at work, putting NetBSD on everything they can find</li>
<li>At a technology conference in Hiroshima, some developers brought their exotic machines to put on display</li>
<li>As usual, there are lots of pictures and a nice report from the conference
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/ports?limit_changes=0&view=revision&revision=368845" rel="nofollow">FreeBSD&#39;s Linux emulation overhaul</a></h3>

<ul>
<li>For a long time, FreeBSD&#39;s emulation layer has been based on an ancient Fedora 10 system</li>
<li>If you&#39;ve ever needed to install Adobe Flash on BSD, you&#39;ll be stuck with all this extra junk</li>
<li>With some recent work, that&#39;s been replaced with a recent CentOS release</li>
<li>This opens up the door for newer versions of Skype to run on FreeBSD, and maybe even Steam someday
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=1449" rel="nofollow">pfSense 2.2-BETA</a></h3>

<ul>
<li>Big changes are coming in pfSense land, with their upcoming 2.2 release</li>
<li>We <a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">talked to the developer</a> a while back about future plans, and now they&#39;re finally out there</li>
<li>The 2.2 branch will be based on FreeBSD 10-STABLE (instead of 8.3) and include lots of performance fixes</li>
<li>It also includes some security updates, lots of package changes and updates and much more</li>
<li>You can check the <a href="https://doc.pfsense.org/index.php/2.2_New_Features_and_Changes" rel="nofollow">full list of changes</a> on their wiki
***</li>
</ul>

<h3><a href="http://www.cambus.net/netbsd-on-the-raspberry-pi/" rel="nofollow">NetBSD on the Raspberry Pi</a></h3>

<ul>
<li>This article shows how you can install NetBSD on the ever-so-popular Raspberry Pi</li>
<li>As of right now, you&#39;ll need to use a -CURRENT snapshot to do it</li>
<li>It also shows how to grow the filesystem to fill up an SD card, some pkgsrc basics and how to get some initial things set up</li>
<li>Can anyone find something that you can&#39;t install NetBSD on?
***</li>
</ul>

<h2>Interview - Steve Wills - <a href="mailto:swills@freebsd.org" rel="nofollow">swills@freebsd.org</a> / <a href="https://twitter.com/swills" rel="nofollow">@swills</a></h2>

<p>Mentoring new BSD developers</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.midnightbsd.org/notes/" rel="nofollow">MidnightBSD 0.5 released</a></h3>

<ul>
<li>We don&#39;t hear a whole lot about MidnightBSD, but they&#39;ve just released version 0.5</li>
<li>It&#39;s got a round of the latest FreeBSD security patches, driver updates and various small things</li>
<li>Maybe one of their developers could come on the show sometime and tell us more about the project
***</li>
</ul>

<h3><a href="http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.52/" rel="nofollow">BSD Router Project 1.52 released</a></h3>

<ul>
<li>The newest update for the BSD Router Project is out</li>
<li>This version is based on a snapshot of 10-STABLE that&#39;s very close to 10.1-RELEASE</li>
<li>It&#39;s mostly a bugfix release, but includes some small changes and package updates
***</li>
</ul>

<h3><a href="http://www.dragonflydigest.com/2014/09/19/14751.html" rel="nofollow">Configuring a DragonFly BSD desktop</a></h3>

<ul>
<li>We&#39;ve done tutorials on how to set up a FreeBSD or OpenBSD desktop, but maybe you&#39;re more interested in DragonFly</li>
<li>In this post from Justin Sherrill, you&#39;ll learn some of the steps to do just that</li>
<li>He pulled out an old desktop machine, gave it a try and seems to be pleased with the results</li>
<li>It includes a few Xorg tips, and there are some comments about the possibility of making a GUI DragonFly installer
***</li>
</ul>

<h3><a href="http://pakitong.blogspot.com/2014/09/jetway-j7f2-four-lan-mini-itx-for.html" rel="nofollow">Building a mini-ITX pfSense box</a></h3>

<ul>
<li>Another week, another pfSense firewall build post</li>
<li>This time, the author is installing to a Jetway J7F2, a mini-ITX device with four LAN ports</li>
<li>He used to be a m0n0wall guy, but wanted to give the more modern pfSense a try</li>
<li>Lots of great pictures of the hardware, which we always love
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2184TfOKD" rel="nofollow">Damian writes in</a></li>
<li><a href="http://slexy.org/view/s20uAdTwLv" rel="nofollow">Jan writes in</a></li>
<li><a href="http://slexy.org/view/s20es52IgZ" rel="nofollow">Dale writes in</a></li>
<li><a href="http://slexy.org/view/s2mjulpac6" rel="nofollow">Joe writes in</a></li>
<li><a href="http://slexy.org/view/s2BvNC8cgi" rel="nofollow">Bostjan writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;re back from EuroBSDCon! This week we&#39;ll be talking with Steve Wills about mentoring new BSD developers. If you&#39;ve ever considered becoming a developer or helping out, it&#39;s actually really easy to get involved. We&#39;ve also got all the BSD news for the week and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://mail-index.netbsd.org/netbsd-advocacy/2014/09/26/msg000669.html" rel="nofollow">NetBSD at Hiroshima Open Source Conference</a></h3>

<ul>
<li>NetBSD developers are hard at work, putting NetBSD on everything they can find</li>
<li>At a technology conference in Hiroshima, some developers brought their exotic machines to put on display</li>
<li>As usual, there are lots of pictures and a nice report from the conference
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/ports?limit_changes=0&view=revision&revision=368845" rel="nofollow">FreeBSD&#39;s Linux emulation overhaul</a></h3>

<ul>
<li>For a long time, FreeBSD&#39;s emulation layer has been based on an ancient Fedora 10 system</li>
<li>If you&#39;ve ever needed to install Adobe Flash on BSD, you&#39;ll be stuck with all this extra junk</li>
<li>With some recent work, that&#39;s been replaced with a recent CentOS release</li>
<li>This opens up the door for newer versions of Skype to run on FreeBSD, and maybe even Steam someday
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=1449" rel="nofollow">pfSense 2.2-BETA</a></h3>

<ul>
<li>Big changes are coming in pfSense land, with their upcoming 2.2 release</li>
<li>We <a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">talked to the developer</a> a while back about future plans, and now they&#39;re finally out there</li>
<li>The 2.2 branch will be based on FreeBSD 10-STABLE (instead of 8.3) and include lots of performance fixes</li>
<li>It also includes some security updates, lots of package changes and updates and much more</li>
<li>You can check the <a href="https://doc.pfsense.org/index.php/2.2_New_Features_and_Changes" rel="nofollow">full list of changes</a> on their wiki
***</li>
</ul>

<h3><a href="http://www.cambus.net/netbsd-on-the-raspberry-pi/" rel="nofollow">NetBSD on the Raspberry Pi</a></h3>

<ul>
<li>This article shows how you can install NetBSD on the ever-so-popular Raspberry Pi</li>
<li>As of right now, you&#39;ll need to use a -CURRENT snapshot to do it</li>
<li>It also shows how to grow the filesystem to fill up an SD card, some pkgsrc basics and how to get some initial things set up</li>
<li>Can anyone find something that you can&#39;t install NetBSD on?
***</li>
</ul>

<h2>Interview - Steve Wills - <a href="mailto:swills@freebsd.org" rel="nofollow">swills@freebsd.org</a> / <a href="https://twitter.com/swills" rel="nofollow">@swills</a></h2>

<p>Mentoring new BSD developers</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.midnightbsd.org/notes/" rel="nofollow">MidnightBSD 0.5 released</a></h3>

<ul>
<li>We don&#39;t hear a whole lot about MidnightBSD, but they&#39;ve just released version 0.5</li>
<li>It&#39;s got a round of the latest FreeBSD security patches, driver updates and various small things</li>
<li>Maybe one of their developers could come on the show sometime and tell us more about the project
***</li>
</ul>

<h3><a href="http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.52/" rel="nofollow">BSD Router Project 1.52 released</a></h3>

<ul>
<li>The newest update for the BSD Router Project is out</li>
<li>This version is based on a snapshot of 10-STABLE that&#39;s very close to 10.1-RELEASE</li>
<li>It&#39;s mostly a bugfix release, but includes some small changes and package updates
***</li>
</ul>

<h3><a href="http://www.dragonflydigest.com/2014/09/19/14751.html" rel="nofollow">Configuring a DragonFly BSD desktop</a></h3>

<ul>
<li>We&#39;ve done tutorials on how to set up a FreeBSD or OpenBSD desktop, but maybe you&#39;re more interested in DragonFly</li>
<li>In this post from Justin Sherrill, you&#39;ll learn some of the steps to do just that</li>
<li>He pulled out an old desktop machine, gave it a try and seems to be pleased with the results</li>
<li>It includes a few Xorg tips, and there are some comments about the possibility of making a GUI DragonFly installer
***</li>
</ul>

<h3><a href="http://pakitong.blogspot.com/2014/09/jetway-j7f2-four-lan-mini-itx-for.html" rel="nofollow">Building a mini-ITX pfSense box</a></h3>

<ul>
<li>Another week, another pfSense firewall build post</li>
<li>This time, the author is installing to a Jetway J7F2, a mini-ITX device with four LAN ports</li>
<li>He used to be a m0n0wall guy, but wanted to give the more modern pfSense a try</li>
<li>Lots of great pictures of the hardware, which we always love
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2184TfOKD" rel="nofollow">Damian writes in</a></li>
<li><a href="http://slexy.org/view/s20uAdTwLv" rel="nofollow">Jan writes in</a></li>
<li><a href="http://slexy.org/view/s20es52IgZ" rel="nofollow">Dale writes in</a></li>
<li><a href="http://slexy.org/view/s2mjulpac6" rel="nofollow">Joe writes in</a></li>
<li><a href="http://slexy.org/view/s2BvNC8cgi" rel="nofollow">Bostjan writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>56: Beastly Infrastructure</title>
  <link>https://www.bsdnow.tv/56</link>
  <guid isPermaLink="false">ef260b07-d765-4154-9f4e-3fc616050361</guid>
  <pubDate>Wed, 24 Sep 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ef260b07-d765-4154-9f4e-3fc616050361.mp3" length="41104084" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week we're on the other side of the Atlantic, attending EuroBSDCon. For now, we've got an awesome interview with Peter Wemm about the FreeBSD web cluster and infrastructure. It's an inside look that you probably won't hear about anywhere else! We'll also get to a couple of your emails today, and be back next week with all the usual goodies, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>57:05</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week we're on the other side of the Atlantic, attending EuroBSDCon. For now, we've got an awesome interview with Peter Wemm about the FreeBSD web cluster and infrastructure. It's an inside look that you probably won't hear about anywhere else! We'll also get to a couple of your emails today, and be back next week with all the usual goodies, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Interview - Peter Wemm - peter@freebsd.org (mailto:peter@freebsd.org) / @karinjiri (https://twitter.com/karinjiri)
The FreeBSD web cluster and infrastructure
Feedback/Questions
Todd writes in (http://slexy.org/view/s2LRZu3hlI)
Brandon writes in (http://slexy.org/view/s21JeoW1rn)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, eurobsdcon, 2014, cluster, infrastructure, web, servers, datacenter, internal, ssh, jails</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week we&#39;re on the other side of the Atlantic, attending EuroBSDCon. For now, we&#39;ve got an awesome interview with Peter Wemm about the FreeBSD web cluster and infrastructure. It&#39;s an inside look that you probably won&#39;t hear about anywhere else! We&#39;ll also get to a couple of your emails today, and be back next week with all the usual goodies, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Interview - Peter Wemm - <a href="mailto:peter@freebsd.org" rel="nofollow">peter@freebsd.org</a> / <a href="https://twitter.com/karinjiri" rel="nofollow">@karinjiri</a></h2>

<p>The FreeBSD web cluster and infrastructure</p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2LRZu3hlI" rel="nofollow">Todd writes in</a></li>
<li><a href="http://slexy.org/view/s21JeoW1rn" rel="nofollow">Brandon writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week we&#39;re on the other side of the Atlantic, attending EuroBSDCon. For now, we&#39;ve got an awesome interview with Peter Wemm about the FreeBSD web cluster and infrastructure. It&#39;s an inside look that you probably won&#39;t hear about anywhere else! We&#39;ll also get to a couple of your emails today, and be back next week with all the usual goodies, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Interview - Peter Wemm - <a href="mailto:peter@freebsd.org" rel="nofollow">peter@freebsd.org</a> / <a href="https://twitter.com/karinjiri" rel="nofollow">@karinjiri</a></h2>

<p>The FreeBSD web cluster and infrastructure</p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2LRZu3hlI" rel="nofollow">Todd writes in</a></li>
<li><a href="http://slexy.org/view/s21JeoW1rn" rel="nofollow">Brandon writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>55: The Promised WLAN</title>
  <link>https://www.bsdnow.tv/55</link>
  <guid isPermaLink="false">138f743e-c056-4292-9d04-7a7022b34944</guid>
  <pubDate>Wed, 17 Sep 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/138f743e-c056-4292-9d04-7a7022b34944.mp3" length="57124948" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week, we'll be talking with Adrian Chadd about all things wireless, his experience with FreeBSD on various laptop hardware and a whole lot more. As usual, we've got the latest news and answers to all your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:19:20</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week, we'll be talking with Adrian Chadd about all things wireless, his experience with FreeBSD on various laptop hardware and a whole lot more. As usual, we've got the latest news and answers to all your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD 10.1-BETA1 is out (http://ftp.freebsd.org/pub/FreeBSD/releases/ISO-IMAGES/10.1/)
The first maintenance update in the 10.x series of FreeBSD is on its way
Since we can't see a changelog yet, the 10-STABLE release notes (https://www.freebsd.org/relnotes/10-STABLE/relnotes/article.html) offer a glimpse at some of the new features and fixes that will be included in 10.1
The vt driver was merged from -CURRENT, lots of drivers were updated, lots of bugs were fixed and bhyve also got many improvements from 11
Initial UEFI support, multithreaded softupdates for UFS and many more things were added
You can check the release schedule (https://www.freebsd.org/releases/10.1R/schedule.html) for the planned release dates
Details for the various forms of release media can be found in the announcement (https://lists.freebsd.org/pipermail/freebsd-stable/2014-September/080106.html)
***
Remote headless OpenBSD installation (https://jcs.org/notaweblog/2014/09/12/remotely_installing_openbsd_on_a/)
A lot of server providers only offer a limited number of operating systems to be easily installed on their boxes
Sometimes you'll get lucky and they'll offer FreeBSD, but it's much harder to find ones that natively support other BSDs
This article shows how you can use a Linux-based rescue system, a RAM disk and QEMU to install OpenBSD on the bare metal of a server, headlessly and remotely
It required a few specific steps you'll want to take note of, but is extremely useful for those pesky hosting providers
***
Building a firewall appliance with pfSense (http://www.get-virtual.net/2014/09/16/build-firewall-appliance/)
In this article, we learn how to easily set up a gateway and wireless access point with pfSense on a Netgate ALIX2C3 APU (http://pcengines.ch/alix2c3.htm)
After the author's modem died, he decided to look into a more do-it-yourself option with pf and a tiny router board
The hardware he used has gigabit ports and a BSD-compatible wireless card, as well as enough CPU power for a modest workload and a few services (OpenVPN, etc.)
There's a lot of great pictures of the hardware and detailed screenshots, definitely worth a look
***
Receive Side Scaling - UDP testing (http://adrianchadd.blogspot.com/2014/09/receive-side-scaling-testing-udp.html)
Adrian Chadd has been working on RSS (Receive Side Scaling) in FreeBSD, and gives an update on the progress
He's using some quad core boxes with 10 gigabit ethernet for the tests
The post gives lots of stats and results from his network benchmark, as well as some interesting workarounds he had to do
He also provides some system configuration options, sysctl knobs, etc. (if you want to try it out)
And speaking of Adrian Chadd...
***
Interview - Adrian Chadd - adrian@freebsd.org (mailto:adrian@freebsd.org) / @erikarn (https://twitter.com/erikarn)
BSD on laptops, wifi, drivers, various topics
News Roundup
Sendmail removed from OpenBSD (http://undeadly.org/cgi?action=article&amp;amp;sid=20140916084251)
Mail server admins around the world are rejoicing (https://news.ycombinator.com/item?id=8324475), because sendmail is finally gone (http://marc.info/?l=openbsd-cvs&amp;amp;m=141081997917153&amp;amp;w=2) from OpenBSD
With OpenSMTPD being a part of the base system, sendmail became largely redundant and unneeded
If you've ever compared a "sendmail.cf" file to an "smtpd.conf" file... the different is as clear as night and day
5.6 will serve as a transitional release, including both sendmail and OpenSMTPD, but 5.7 will be the first release without it
If you still need it for some reason, sendmail will live in ports from now on
Hopefully FreeBSD will follow suit sometime in the future as well, possibly including DragonFly's mail transfer agent in base (instead of an entire mail server)
***
pfSense backups with pfmb (https://github.com/zinkwazi/pfmb)
We've mentioned the need for a tool to back up pfSense configs a number of times on the show
This script, hosted on github, does pretty much exactly that
It can connect to one (or more!) pfSense installations and back up the configuration
You can roll back or replace failed hardware very easily with its restore function
Everything is done over SSH, so it should be pretty secure
***
The Design and Implementation of the FreeBSD Operating System (http://www.amazon.com/dp/0321968972/)
We mentioned when the pre orders were up, but now "The Design and Implementation of the FreeBSD Operating System, 2nd edition" seems to be shipping out
If you're interested in FreeBSD development, or learning about the operating system internals, this is a great book to buy
We've even had all (http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache) three (http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates) authors (http://www.bsdnow.tv/episodes/2014_08_13-vpn_my_dear_watson) on the show before!
***
OpenBSD's systemd replacement updates (http://undeadly.org/cgi?action=article&amp;amp;sid=20140915064856)
We mentioned last week that the news of OpenBSD creating systemd wrappers was getting mainstream attention
One of the developers writes in to Undeadly, detailing what's going on and what the overall status is
He also clears up any confusion about "porting systemd to BSD" (that's not what's going on) or his code ever ending up in base (it won't)
The top comment as of right now is a Linux user asking if his systemd wrappers can be ported back to Linux... poor guy
***
Feedback/Questions
Brad writes in (http://slexy.org/view/s20jrx0nIf)
Ben writes in (http://slexy.org/view/s21hFUJ2ju)
Mathieu writes in (http://slexy.org/view/s21RgSzOv4)
Steve writes in (http://slexy.org/view/s2P1mzalPh)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, bsd, interview, adrian chadd, wireless, wifi, aircrack-ng, kismet, packet injection, monitor mode, libressl, openssl, qemu, zfs, jails, headless, remote, pfsense, systemd, netgate, apu</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week, we&#39;ll be talking with Adrian Chadd about all things wireless, his experience with FreeBSD on various laptop hardware and a whole lot more. As usual, we&#39;ve got the latest news and answers to all your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://ftp.freebsd.org/pub/FreeBSD/releases/ISO-IMAGES/10.1/" rel="nofollow">FreeBSD 10.1-BETA1 is out</a></h3>

<ul>
<li>The first maintenance update in the 10.x series of FreeBSD is on its way</li>
<li>Since we can&#39;t see a changelog yet, the 10-STABLE <a href="https://www.freebsd.org/relnotes/10-STABLE/relnotes/article.html" rel="nofollow">release notes</a> offer a glimpse at some of the new features and fixes that will be included in 10.1</li>
<li>The vt driver was merged from -CURRENT, lots of drivers were updated, lots of bugs were fixed and bhyve also got many improvements from 11</li>
<li>Initial UEFI support, multithreaded softupdates for UFS and many more things were added</li>
<li>You can check the <a href="https://www.freebsd.org/releases/10.1R/schedule.html" rel="nofollow">release schedule</a> for the planned release dates</li>
<li>Details for the various forms of release media can be found in <a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-September/080106.html" rel="nofollow">the announcement</a>
***</li>
</ul>

<h3><a href="https://jcs.org/notaweblog/2014/09/12/remotely_installing_openbsd_on_a/" rel="nofollow">Remote headless OpenBSD installation</a></h3>

<ul>
<li>A lot of server providers only offer a limited number of operating systems to be easily installed on their boxes</li>
<li>Sometimes you&#39;ll get lucky and they&#39;ll offer FreeBSD, but it&#39;s much harder to find ones that natively support other BSDs</li>
<li>This article shows how you can use a Linux-based rescue system, a RAM disk and QEMU to install OpenBSD on the bare metal of a server, headlessly and remotely</li>
<li>It required a few specific steps you&#39;ll want to take note of, but is <strong>extremely useful</strong> for those pesky hosting providers
***</li>
</ul>

<h3><a href="http://www.get-virtual.net/2014/09/16/build-firewall-appliance/" rel="nofollow">Building a firewall appliance with pfSense</a></h3>

<ul>
<li>In this article, we learn how to easily set up a gateway and wireless access point with pfSense on a Netgate <a href="http://pcengines.ch/alix2c3.htm" rel="nofollow">ALIX2C3 APU</a></li>
<li>After the author&#39;s modem died, he decided to look into a more do-it-yourself option with pf and a tiny router board</li>
<li>The hardware he used has gigabit ports and a BSD-compatible wireless card, as well as enough CPU power for a modest workload and a few services (OpenVPN, etc.)</li>
<li>There&#39;s a lot of <em>great</em> pictures of the hardware and detailed screenshots, definitely worth a look
***</li>
</ul>

<h3><a href="http://adrianchadd.blogspot.com/2014/09/receive-side-scaling-testing-udp.html" rel="nofollow">Receive Side Scaling - UDP testing</a></h3>

<ul>
<li>Adrian Chadd has been working on RSS (Receive Side Scaling) in FreeBSD, and gives an update on the progress</li>
<li>He&#39;s using some quad core boxes with 10 gigabit ethernet for the tests</li>
<li>The post gives lots of stats and results from his network benchmark, as well as some interesting workarounds he had to do</li>
<li>He also provides some system configuration options, sysctl knobs, etc. (if you want to try it out)</li>
<li>And speaking of Adrian Chadd...
***</li>
</ul>

<h2>Interview - Adrian Chadd - <a href="mailto:adrian@freebsd.org" rel="nofollow">adrian@freebsd.org</a> / <a href="https://twitter.com/erikarn" rel="nofollow">@erikarn</a></h2>

<p>BSD on laptops, wifi, drivers, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140916084251" rel="nofollow">Sendmail removed from OpenBSD</a></h3>

<ul>
<li>Mail server admins around the world <a href="https://news.ycombinator.com/item?id=8324475" rel="nofollow">are rejoicing</a>, because sendmail is <a href="http://marc.info/?l=openbsd-cvs&m=141081997917153&w=2" rel="nofollow">finally gone</a> from OpenBSD</li>
<li>With OpenSMTPD being a part of the base system, sendmail became largely redundant and unneeded</li>
<li>If you&#39;ve ever compared a &quot;sendmail.cf&quot; file to an &quot;smtpd.conf&quot; file... the different is as clear as night and day</li>
<li>5.6 will serve as a transitional release, including both sendmail and OpenSMTPD, but 5.7 will be the first release without it</li>
<li>If you still need it for some reason, sendmail will live in ports from now on</li>
<li>Hopefully FreeBSD will follow suit sometime in the future as well, possibly including DragonFly&#39;s mail transfer agent in base (instead of an entire mail server)
***</li>
</ul>

<h3><a href="https://github.com/zinkwazi/pfmb" rel="nofollow">pfSense backups with pfmb</a></h3>

<ul>
<li>We&#39;ve mentioned the need for a tool to back up pfSense configs a number of times on the show</li>
<li>This script, hosted on github, does pretty much exactly that</li>
<li>It can connect to one (or more!) pfSense installations and back up the configuration</li>
<li>You can roll back or replace failed hardware very easily with its restore function</li>
<li>Everything is done over SSH, so it should be pretty secure
***</li>
</ul>

<h3><a href="http://www.amazon.com/dp/0321968972/" rel="nofollow">The Design and Implementation of the FreeBSD Operating System</a></h3>

<ul>
<li>We mentioned when the pre orders were up, but now &quot;The Design and Implementation of the FreeBSD Operating System, 2nd edition&quot; seems to be shipping out</li>
<li>If you&#39;re interested in FreeBSD development, or learning about the operating system internals, this is a great book to buy</li>
<li>We&#39;ve even had <a href="http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache" rel="nofollow">all</a> <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">three</a> <a href="http://www.bsdnow.tv/episodes/2014_08_13-vpn_my_dear_watson" rel="nofollow">authors</a> on the show before!
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140915064856" rel="nofollow">OpenBSD&#39;s systemd replacement updates</a></h3>

<ul>
<li>We mentioned last week that the news of OpenBSD creating systemd wrappers was getting mainstream attention</li>
<li>One of the developers writes in to Undeadly, detailing what&#39;s going on and what the overall status is</li>
<li>He also clears up any confusion about &quot;porting systemd to BSD&quot; <strong>(that&#39;s not what&#39;s going on)</strong> or his code ever ending up in base <strong>(it won&#39;t)</strong></li>
<li>The top comment as of right now is a Linux user asking if his systemd wrappers can be ported back to Linux... poor guy
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20jrx0nIf" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s21hFUJ2ju" rel="nofollow">Ben writes in</a></li>
<li><a href="http://slexy.org/view/s21RgSzOv4" rel="nofollow">Mathieu writes in</a></li>
<li><a href="http://slexy.org/view/s2P1mzalPh" rel="nofollow">Steve writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week, we&#39;ll be talking with Adrian Chadd about all things wireless, his experience with FreeBSD on various laptop hardware and a whole lot more. As usual, we&#39;ve got the latest news and answers to all your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://ftp.freebsd.org/pub/FreeBSD/releases/ISO-IMAGES/10.1/" rel="nofollow">FreeBSD 10.1-BETA1 is out</a></h3>

<ul>
<li>The first maintenance update in the 10.x series of FreeBSD is on its way</li>
<li>Since we can&#39;t see a changelog yet, the 10-STABLE <a href="https://www.freebsd.org/relnotes/10-STABLE/relnotes/article.html" rel="nofollow">release notes</a> offer a glimpse at some of the new features and fixes that will be included in 10.1</li>
<li>The vt driver was merged from -CURRENT, lots of drivers were updated, lots of bugs were fixed and bhyve also got many improvements from 11</li>
<li>Initial UEFI support, multithreaded softupdates for UFS and many more things were added</li>
<li>You can check the <a href="https://www.freebsd.org/releases/10.1R/schedule.html" rel="nofollow">release schedule</a> for the planned release dates</li>
<li>Details for the various forms of release media can be found in <a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-September/080106.html" rel="nofollow">the announcement</a>
***</li>
</ul>

<h3><a href="https://jcs.org/notaweblog/2014/09/12/remotely_installing_openbsd_on_a/" rel="nofollow">Remote headless OpenBSD installation</a></h3>

<ul>
<li>A lot of server providers only offer a limited number of operating systems to be easily installed on their boxes</li>
<li>Sometimes you&#39;ll get lucky and they&#39;ll offer FreeBSD, but it&#39;s much harder to find ones that natively support other BSDs</li>
<li>This article shows how you can use a Linux-based rescue system, a RAM disk and QEMU to install OpenBSD on the bare metal of a server, headlessly and remotely</li>
<li>It required a few specific steps you&#39;ll want to take note of, but is <strong>extremely useful</strong> for those pesky hosting providers
***</li>
</ul>

<h3><a href="http://www.get-virtual.net/2014/09/16/build-firewall-appliance/" rel="nofollow">Building a firewall appliance with pfSense</a></h3>

<ul>
<li>In this article, we learn how to easily set up a gateway and wireless access point with pfSense on a Netgate <a href="http://pcengines.ch/alix2c3.htm" rel="nofollow">ALIX2C3 APU</a></li>
<li>After the author&#39;s modem died, he decided to look into a more do-it-yourself option with pf and a tiny router board</li>
<li>The hardware he used has gigabit ports and a BSD-compatible wireless card, as well as enough CPU power for a modest workload and a few services (OpenVPN, etc.)</li>
<li>There&#39;s a lot of <em>great</em> pictures of the hardware and detailed screenshots, definitely worth a look
***</li>
</ul>

<h3><a href="http://adrianchadd.blogspot.com/2014/09/receive-side-scaling-testing-udp.html" rel="nofollow">Receive Side Scaling - UDP testing</a></h3>

<ul>
<li>Adrian Chadd has been working on RSS (Receive Side Scaling) in FreeBSD, and gives an update on the progress</li>
<li>He&#39;s using some quad core boxes with 10 gigabit ethernet for the tests</li>
<li>The post gives lots of stats and results from his network benchmark, as well as some interesting workarounds he had to do</li>
<li>He also provides some system configuration options, sysctl knobs, etc. (if you want to try it out)</li>
<li>And speaking of Adrian Chadd...
***</li>
</ul>

<h2>Interview - Adrian Chadd - <a href="mailto:adrian@freebsd.org" rel="nofollow">adrian@freebsd.org</a> / <a href="https://twitter.com/erikarn" rel="nofollow">@erikarn</a></h2>

<p>BSD on laptops, wifi, drivers, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140916084251" rel="nofollow">Sendmail removed from OpenBSD</a></h3>

<ul>
<li>Mail server admins around the world <a href="https://news.ycombinator.com/item?id=8324475" rel="nofollow">are rejoicing</a>, because sendmail is <a href="http://marc.info/?l=openbsd-cvs&m=141081997917153&w=2" rel="nofollow">finally gone</a> from OpenBSD</li>
<li>With OpenSMTPD being a part of the base system, sendmail became largely redundant and unneeded</li>
<li>If you&#39;ve ever compared a &quot;sendmail.cf&quot; file to an &quot;smtpd.conf&quot; file... the different is as clear as night and day</li>
<li>5.6 will serve as a transitional release, including both sendmail and OpenSMTPD, but 5.7 will be the first release without it</li>
<li>If you still need it for some reason, sendmail will live in ports from now on</li>
<li>Hopefully FreeBSD will follow suit sometime in the future as well, possibly including DragonFly&#39;s mail transfer agent in base (instead of an entire mail server)
***</li>
</ul>

<h3><a href="https://github.com/zinkwazi/pfmb" rel="nofollow">pfSense backups with pfmb</a></h3>

<ul>
<li>We&#39;ve mentioned the need for a tool to back up pfSense configs a number of times on the show</li>
<li>This script, hosted on github, does pretty much exactly that</li>
<li>It can connect to one (or more!) pfSense installations and back up the configuration</li>
<li>You can roll back or replace failed hardware very easily with its restore function</li>
<li>Everything is done over SSH, so it should be pretty secure
***</li>
</ul>

<h3><a href="http://www.amazon.com/dp/0321968972/" rel="nofollow">The Design and Implementation of the FreeBSD Operating System</a></h3>

<ul>
<li>We mentioned when the pre orders were up, but now &quot;The Design and Implementation of the FreeBSD Operating System, 2nd edition&quot; seems to be shipping out</li>
<li>If you&#39;re interested in FreeBSD development, or learning about the operating system internals, this is a great book to buy</li>
<li>We&#39;ve even had <a href="http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache" rel="nofollow">all</a> <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">three</a> <a href="http://www.bsdnow.tv/episodes/2014_08_13-vpn_my_dear_watson" rel="nofollow">authors</a> on the show before!
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140915064856" rel="nofollow">OpenBSD&#39;s systemd replacement updates</a></h3>

<ul>
<li>We mentioned last week that the news of OpenBSD creating systemd wrappers was getting mainstream attention</li>
<li>One of the developers writes in to Undeadly, detailing what&#39;s going on and what the overall status is</li>
<li>He also clears up any confusion about &quot;porting systemd to BSD&quot; <strong>(that&#39;s not what&#39;s going on)</strong> or his code ever ending up in base <strong>(it won&#39;t)</strong></li>
<li>The top comment as of right now is a Linux user asking if his systemd wrappers can be ported back to Linux... poor guy
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20jrx0nIf" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s21hFUJ2ju" rel="nofollow">Ben writes in</a></li>
<li><a href="http://slexy.org/view/s21RgSzOv4" rel="nofollow">Mathieu writes in</a></li>
<li><a href="http://slexy.org/view/s2P1mzalPh" rel="nofollow">Steve writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>54: Luminary Environment</title>
  <link>https://www.bsdnow.tv/54</link>
  <guid isPermaLink="false">c6ff3386-0834-4798-809e-dd4917c5bc7b</guid>
  <pubDate>Wed, 10 Sep 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c6ff3386-0834-4798-809e-dd4917c5bc7b.mp3" length="56630740" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, it's all about Lumina. We'll be giving you a visual walkthrough of the new BSD-exclusive desktop environment, as well as chatting with the main developer. There's also answers to your emails and all the latest news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:18:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, it's all about Lumina. We'll be giving you a visual walkthrough of the new BSD-exclusive desktop environment, as well as chatting with the main developer. There's also answers to your emails and all the latest news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
Portscout ported to OpenBSD (http://blog.jasper.la/portscout-for-openbsd/)
Portscout is a popular utility used in the FreeBSD ports infrastructure
It lets port maintainers know when there's a new version of the upstream software available by automatically checking the distfile mirror
Now OpenBSD porters can enjoy the same convenience, as it's been ported over
You can view the status online (http://portscout.jasper.la/) to see how it works and who maintains what (http://portscout.jasper.la/index-total.html)
The developer who ported it is working to get all the current features working on OpenBSD, and added a few new features as well
He decided to fork and rename it (https://jasperla.github.io/portroach/) a few days later
***
Sysadmins and systemd refugees flocking to BSD (https://www.reddit.com/r/freebsd/comments/2fgb90/you_have_your_windows_in_my_linux_or_why_many/)
With all the drama in Linux land about the rapid changes to their init system, a lot of people are looking at BSD alternatives
This "you got your Windows in my Linux (http://www.infoworld.com/d/data-center/you-have-your-windows-in-my-linux-249483)" article (and accompanying comments) give a nice glimpse into the minds of some of those switchers
Both server administrators and regular everyday users are switching away from Linux, as more and more distros give them no choice but to use systemd
Fortunately, the BSD communities are usually very welcoming of switchers - it's pretty nice on this side!
***
OpenBSD's versioning schemes (http://www.tedunangst.com/flak/post/OpenBSD-version-numbers)
Ted Unangst explains the various versioning systems within OpenBSD, from the base to libraries to other included software
In contrast to FreeBSD's release cycle, OpenBSD isn't as concerned with breaking backwards compatibility (but only if it's needed to make progress)
This allows them to innovate and introduce new features a lot more easily, and get those features in a stable release that everyone uses
He also details the difference between branches, their errata system and lack of "patch levels" for security
Some other things in OpenBSD don't have version numbers at all, like tmux
"Every release adds some new features, fixes some old bugs, probably adds a new bug or two, and, if I have anything to say about it, removes some old features."
***
VAXstation 4000 Model 90 booting NetBSD (https://www.youtube.com/watch?v=zLsgFPaMPyg)
We found a video of NetBSD booting on a 22 year old VAX workstation, circa 1992
This system has a monstrous 71 MHz CPU and 128MB of ECC RAM
It continues in part two (https://www.youtube.com/watch?v=YKzDXKmn66U), where we learn that it would've cost around $25,000 when it was released!
The uploader talks about his experiences getting NetBSD on it, what does and doesn't work, etc
It's interesting to see that such old hardware isn't necessarily obsolete just because newer things have come out since then (but maybe don't try to build world on it...)
***
Interview - Ken Moore - ken@pcbsd.org (mailto:ken@pcbsd.org)
The Lumina desktop environment
Special segment
Lumina walkthrough
News Roundup
Suricata for IDS on pfSense (http://pfsensesetup.com/suricata-intrusion-detection-system-part-one)
While most people are familiar with Snort as an intrusion detection system, Suricata is another choice
This guide goes through the steps of installing and configuring it on a public-facing pfSense box
Part two (http://pfsensesetup.com/suricata-intrusion-detection-system-part-two/) details some of the configuration steps
One other cool thing about Suricata - it's compatible with Snort rules, so you can use the same updates
There's also another recent post (http://www.allamericancomputerrepair.com/Blog/Post/29/Install-Snort-on-FreeBSD) about snort as well, if that's more your style
If you run pfSense (or any BSD) as an edge router for a lot of users, this might be worth looking into
***
OpenBSD's systemd API emulation project (http://bsd.slashdot.org/story/14/09/08/0250207/gsoc-project-works-to-emulate-systemd-for-openbsd)
This story was pretty popular in the mainstream news this week
For the Google Summer of Code, a student is writing emulation wrappers for some of systemd's functions (https://twitter.com/blakkheim/status/509092821773848577)
There was consideration from some Linux users to port over the finished emulation back to Linux, so they wouldn't have to run the full systemd
One particularly interesting Slashdot comment snippet (http://bsd.slashdot.org/comments.pl?sid=5663319&amp;amp;cid=47851361): "We are currently migrating a large number (much larger than planned after initial results) of systems from RHEL to BSD - a decision taken due to general unhappiness with RHEL6, but SystemD pushed us towards BSD rather than another Linux distro - and in some cases are seeing throughput gains of greater than 10% on what should be equivalent Linux and BSD server builds. The re-learning curve wasn't as steep as we expected, general system stability seems to be better too, and BSD's security reputation goes without saying."
It will NOT be in the base system - only in ports, and only installed as a dependency for things like newer GNOME (http://blogs.gnome.org/ovitters/2014/09/07/systemd-in-gnome-3-14-and-beyond/) that require such APIs
In the long run, BSD will still be safe from systemd's reign of terror, but will hopefully still be compatible with some third party packages like GNOME that insist on using it
***
GhostBSD 4 previewed (http://www.linuxbsdos.com/2014/05/19/preview-of-ghostbsd-4-0/)
The GhostBSD project is moving along, slowly getting closer to the 4 release
This article shows some of the progress made, and includes lots of screenshots and interesting graphical frontends
If you're not too familiar with GhostBSD, we interviewed the lead developer (http://www.bsdnow.tv/episodes/2014_03_12-ghost_of_partition) a little while back
***
NetBSD on the Banana Pi (http://rizzoandself.blogspot.com/2014/09/netbsd-on-banana-pi.html)
The Banana Pi is a tasty alternative to the Raspberry Pi, with similar hardware specs
In this blog post, a NetBSD developer details his experiences in getting NetBSD to run on it
After studying how the prebuilt Linux image booted, he made some notes and started hacking
Ethernet, one of the few things not working, is being looked into and he's hoping to get it fully supported for the upcoming NetBSD 7.0
They're only about $65 as of the time we're recording this, so it might be a fun project to try
***
Feedback/Questions
Antonio writes in (http://slexy.org/view/s28iKdBEbm)
Garegin writes in (http://slexy.org/view/s21Wfnv87h)
Erno writes in (http://slexy.org/view/s2Fzryxhdz)
Brandon writes in (http://slexy.org/view/s2ILcqdFfF)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, lumina, desktop environment, window manager, graphical user interface, tiling, floating, gnome3, kde5, kde4, qt5, banana pi, raspberry pi, portscout, vax, vaxstation, linux vs bsd, systemd, portroach, ids, suricata</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, it&#39;s all about Lumina. We&#39;ll be giving you a visual walkthrough of the new BSD-exclusive desktop environment, as well as chatting with the main developer. There&#39;s also answers to your emails and all the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.jasper.la/portscout-for-openbsd/" rel="nofollow">Portscout ported to OpenBSD</a></h3>

<ul>
<li>Portscout is a popular utility used in the FreeBSD ports infrastructure</li>
<li>It lets port maintainers know when there&#39;s a new version of the upstream software available by automatically checking the distfile mirror</li>
<li>Now OpenBSD porters can enjoy the same convenience, as it&#39;s been ported over</li>
<li>You can view the status <a href="http://portscout.jasper.la/" rel="nofollow">online</a> to see how it works and <a href="http://portscout.jasper.la/index-total.html" rel="nofollow">who maintains what</a></li>
<li>The developer who ported it is working to get all the current features working on OpenBSD, and added a few new features as well</li>
<li>He decided to <a href="https://jasperla.github.io/portroach/" rel="nofollow">fork and rename it</a> a few days later
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/freebsd/comments/2fgb90/you_have_your_windows_in_my_linux_or_why_many/" rel="nofollow">Sysadmins and systemd refugees flocking to BSD</a></h3>

<ul>
<li>With all the drama in Linux land about the rapid changes to their init system, a lot of people are looking at BSD alternatives</li>
<li>This &quot;<a href="http://www.infoworld.com/d/data-center/you-have-your-windows-in-my-linux-249483" rel="nofollow">you got your Windows in my Linux</a>&quot; article (and accompanying comments) give a nice glimpse into the minds of some of those switchers</li>
<li>Both server administrators and regular everyday users are switching away from Linux, as more and more distros give them no choice but to use systemd</li>
<li>Fortunately, the BSD communities are usually very welcoming of switchers - it&#39;s pretty nice on this side!
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/OpenBSD-version-numbers" rel="nofollow">OpenBSD&#39;s versioning schemes</a></h3>

<ul>
<li>Ted Unangst explains the various versioning systems within OpenBSD, from the base to libraries to other included software</li>
<li>In contrast to FreeBSD&#39;s release cycle, OpenBSD isn&#39;t as concerned with breaking backwards compatibility (but only if it&#39;s needed to make progress)</li>
<li>This allows them to innovate and introduce new features a lot more easily, and get those features in a stable release that everyone uses</li>
<li>He also details the difference between branches, their errata system and lack of &quot;patch levels&quot; for security</li>
<li>Some other things in OpenBSD don&#39;t have version numbers at all, like tmux</li>
<li>&quot;Every release adds some new features, fixes some old bugs, probably adds a new bug or two, and, if I have anything to say about it, removes some old features.&quot;
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=zLsgFPaMPyg" rel="nofollow">VAXstation 4000 Model 90 booting NetBSD</a></h3>

<ul>
<li>We found a video of NetBSD booting on a 22 year old VAX workstation, circa 1992</li>
<li>This system has a monstrous 71 MHz CPU and 128MB of ECC RAM</li>
<li>It <a href="https://www.youtube.com/watch?v=YKzDXKmn66U" rel="nofollow">continues in part two</a>, where we learn that it would&#39;ve cost around $25,000 when it was released!</li>
<li>The uploader talks about his experiences getting NetBSD on it, what does and doesn&#39;t work, etc</li>
<li>It&#39;s interesting to see that such old hardware isn&#39;t necessarily obsolete just because newer things have come out since then (but maybe don&#39;t try to build world on it...)
***</li>
</ul>

<h2>Interview - Ken Moore - <a href="mailto:ken@pcbsd.org" rel="nofollow">ken@pcbsd.org</a></h2>

<p>The Lumina desktop environment</p>

<hr>

<h2>Special segment</h2>

<h3>Lumina walkthrough</h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://pfsensesetup.com/suricata-intrusion-detection-system-part-one" rel="nofollow">Suricata for IDS on pfSense</a></h3>

<ul>
<li>While most people are familiar with Snort as an intrusion detection system, Suricata is another choice</li>
<li>This guide goes through the steps of installing and configuring it on a public-facing pfSense box</li>
<li><a href="http://pfsensesetup.com/suricata-intrusion-detection-system-part-two/" rel="nofollow">Part two</a> details some of the configuration steps</li>
<li>One other cool thing about Suricata - it&#39;s compatible with Snort rules, so you can use the same updates</li>
<li>There&#39;s also <a href="http://www.allamericancomputerrepair.com/Blog/Post/29/Install-Snort-on-FreeBSD" rel="nofollow">another recent post</a> about snort as well, if that&#39;s more your style</li>
<li>If you run pfSense (or any BSD) as an edge router for a lot of users, this might be worth looking into
***</li>
</ul>

<h3><a href="http://bsd.slashdot.org/story/14/09/08/0250207/gsoc-project-works-to-emulate-systemd-for-openbsd" rel="nofollow">OpenBSD&#39;s systemd API emulation project</a></h3>

<ul>
<li>This story was pretty popular in the mainstream news this week</li>
<li>For the Google Summer of Code, a student is writing emulation wrappers for some of <a href="https://twitter.com/blakkheim/status/509092821773848577" rel="nofollow">systemd&#39;s functions</a></li>
<li>There was consideration from some Linux users to port over the finished emulation back to Linux, so they wouldn&#39;t have to run the full systemd</li>
<li>One particularly interesting Slashdot comment <a href="http://bsd.slashdot.org/comments.pl?sid=5663319&cid=47851361" rel="nofollow">snippet</a>: &quot;We are currently migrating a large number (much larger than planned after initial results) of systems from RHEL to BSD - a decision taken due to general unhappiness with RHEL6, but SystemD pushed us towards BSD rather than another Linux distro - and in some cases are seeing throughput gains of greater than 10% on what should be equivalent Linux and BSD server builds. The re-learning curve wasn&#39;t as steep as we expected, general system stability seems to be better too, and BSD&#39;s security reputation goes without saying.&quot;</li>
<li>It will NOT be in the base system - only in ports, and only installed as a dependency for things like <a href="http://blogs.gnome.org/ovitters/2014/09/07/systemd-in-gnome-3-14-and-beyond/" rel="nofollow">newer GNOME</a> that require such APIs</li>
<li>In the long run, BSD will still be safe from systemd&#39;s reign of terror, but will hopefully still be compatible with some third party packages like GNOME that insist on using it
***</li>
</ul>

<h3><a href="http://www.linuxbsdos.com/2014/05/19/preview-of-ghostbsd-4-0/" rel="nofollow">GhostBSD 4 previewed</a></h3>

<ul>
<li>The GhostBSD project is moving along, slowly getting closer to the 4 release</li>
<li>This article shows some of the progress made, and includes lots of screenshots and interesting graphical frontends</li>
<li>If you&#39;re not too familiar with GhostBSD, we <a href="http://www.bsdnow.tv/episodes/2014_03_12-ghost_of_partition" rel="nofollow">interviewed the lead developer</a> a little while back
***</li>
</ul>

<h3><a href="http://rizzoandself.blogspot.com/2014/09/netbsd-on-banana-pi.html" rel="nofollow">NetBSD on the Banana Pi</a></h3>

<ul>
<li>The Banana Pi is a tasty alternative to the Raspberry Pi, with similar hardware specs</li>
<li>In this blog post, a NetBSD developer details his experiences in getting NetBSD to run on it</li>
<li>After studying how the prebuilt Linux image booted, he made some notes and started hacking</li>
<li>Ethernet, one of the few things not working, is being looked into and he&#39;s hoping to get it fully supported for the upcoming NetBSD 7.0</li>
<li>They&#39;re only about $65 as of the time we&#39;re recording this, so it might be a fun project to try
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s28iKdBEbm" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s21Wfnv87h" rel="nofollow">Garegin writes in</a></li>
<li><a href="http://slexy.org/view/s2Fzryxhdz" rel="nofollow">Erno writes in</a></li>
<li><a href="http://slexy.org/view/s2ILcqdFfF" rel="nofollow">Brandon writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, it&#39;s all about Lumina. We&#39;ll be giving you a visual walkthrough of the new BSD-exclusive desktop environment, as well as chatting with the main developer. There&#39;s also answers to your emails and all the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blog.jasper.la/portscout-for-openbsd/" rel="nofollow">Portscout ported to OpenBSD</a></h3>

<ul>
<li>Portscout is a popular utility used in the FreeBSD ports infrastructure</li>
<li>It lets port maintainers know when there&#39;s a new version of the upstream software available by automatically checking the distfile mirror</li>
<li>Now OpenBSD porters can enjoy the same convenience, as it&#39;s been ported over</li>
<li>You can view the status <a href="http://portscout.jasper.la/" rel="nofollow">online</a> to see how it works and <a href="http://portscout.jasper.la/index-total.html" rel="nofollow">who maintains what</a></li>
<li>The developer who ported it is working to get all the current features working on OpenBSD, and added a few new features as well</li>
<li>He decided to <a href="https://jasperla.github.io/portroach/" rel="nofollow">fork and rename it</a> a few days later
***</li>
</ul>

<h3><a href="https://www.reddit.com/r/freebsd/comments/2fgb90/you_have_your_windows_in_my_linux_or_why_many/" rel="nofollow">Sysadmins and systemd refugees flocking to BSD</a></h3>

<ul>
<li>With all the drama in Linux land about the rapid changes to their init system, a lot of people are looking at BSD alternatives</li>
<li>This &quot;<a href="http://www.infoworld.com/d/data-center/you-have-your-windows-in-my-linux-249483" rel="nofollow">you got your Windows in my Linux</a>&quot; article (and accompanying comments) give a nice glimpse into the minds of some of those switchers</li>
<li>Both server administrators and regular everyday users are switching away from Linux, as more and more distros give them no choice but to use systemd</li>
<li>Fortunately, the BSD communities are usually very welcoming of switchers - it&#39;s pretty nice on this side!
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/OpenBSD-version-numbers" rel="nofollow">OpenBSD&#39;s versioning schemes</a></h3>

<ul>
<li>Ted Unangst explains the various versioning systems within OpenBSD, from the base to libraries to other included software</li>
<li>In contrast to FreeBSD&#39;s release cycle, OpenBSD isn&#39;t as concerned with breaking backwards compatibility (but only if it&#39;s needed to make progress)</li>
<li>This allows them to innovate and introduce new features a lot more easily, and get those features in a stable release that everyone uses</li>
<li>He also details the difference between branches, their errata system and lack of &quot;patch levels&quot; for security</li>
<li>Some other things in OpenBSD don&#39;t have version numbers at all, like tmux</li>
<li>&quot;Every release adds some new features, fixes some old bugs, probably adds a new bug or two, and, if I have anything to say about it, removes some old features.&quot;
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=zLsgFPaMPyg" rel="nofollow">VAXstation 4000 Model 90 booting NetBSD</a></h3>

<ul>
<li>We found a video of NetBSD booting on a 22 year old VAX workstation, circa 1992</li>
<li>This system has a monstrous 71 MHz CPU and 128MB of ECC RAM</li>
<li>It <a href="https://www.youtube.com/watch?v=YKzDXKmn66U" rel="nofollow">continues in part two</a>, where we learn that it would&#39;ve cost around $25,000 when it was released!</li>
<li>The uploader talks about his experiences getting NetBSD on it, what does and doesn&#39;t work, etc</li>
<li>It&#39;s interesting to see that such old hardware isn&#39;t necessarily obsolete just because newer things have come out since then (but maybe don&#39;t try to build world on it...)
***</li>
</ul>

<h2>Interview - Ken Moore - <a href="mailto:ken@pcbsd.org" rel="nofollow">ken@pcbsd.org</a></h2>

<p>The Lumina desktop environment</p>

<hr>

<h2>Special segment</h2>

<h3>Lumina walkthrough</h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://pfsensesetup.com/suricata-intrusion-detection-system-part-one" rel="nofollow">Suricata for IDS on pfSense</a></h3>

<ul>
<li>While most people are familiar with Snort as an intrusion detection system, Suricata is another choice</li>
<li>This guide goes through the steps of installing and configuring it on a public-facing pfSense box</li>
<li><a href="http://pfsensesetup.com/suricata-intrusion-detection-system-part-two/" rel="nofollow">Part two</a> details some of the configuration steps</li>
<li>One other cool thing about Suricata - it&#39;s compatible with Snort rules, so you can use the same updates</li>
<li>There&#39;s also <a href="http://www.allamericancomputerrepair.com/Blog/Post/29/Install-Snort-on-FreeBSD" rel="nofollow">another recent post</a> about snort as well, if that&#39;s more your style</li>
<li>If you run pfSense (or any BSD) as an edge router for a lot of users, this might be worth looking into
***</li>
</ul>

<h3><a href="http://bsd.slashdot.org/story/14/09/08/0250207/gsoc-project-works-to-emulate-systemd-for-openbsd" rel="nofollow">OpenBSD&#39;s systemd API emulation project</a></h3>

<ul>
<li>This story was pretty popular in the mainstream news this week</li>
<li>For the Google Summer of Code, a student is writing emulation wrappers for some of <a href="https://twitter.com/blakkheim/status/509092821773848577" rel="nofollow">systemd&#39;s functions</a></li>
<li>There was consideration from some Linux users to port over the finished emulation back to Linux, so they wouldn&#39;t have to run the full systemd</li>
<li>One particularly interesting Slashdot comment <a href="http://bsd.slashdot.org/comments.pl?sid=5663319&cid=47851361" rel="nofollow">snippet</a>: &quot;We are currently migrating a large number (much larger than planned after initial results) of systems from RHEL to BSD - a decision taken due to general unhappiness with RHEL6, but SystemD pushed us towards BSD rather than another Linux distro - and in some cases are seeing throughput gains of greater than 10% on what should be equivalent Linux and BSD server builds. The re-learning curve wasn&#39;t as steep as we expected, general system stability seems to be better too, and BSD&#39;s security reputation goes without saying.&quot;</li>
<li>It will NOT be in the base system - only in ports, and only installed as a dependency for things like <a href="http://blogs.gnome.org/ovitters/2014/09/07/systemd-in-gnome-3-14-and-beyond/" rel="nofollow">newer GNOME</a> that require such APIs</li>
<li>In the long run, BSD will still be safe from systemd&#39;s reign of terror, but will hopefully still be compatible with some third party packages like GNOME that insist on using it
***</li>
</ul>

<h3><a href="http://www.linuxbsdos.com/2014/05/19/preview-of-ghostbsd-4-0/" rel="nofollow">GhostBSD 4 previewed</a></h3>

<ul>
<li>The GhostBSD project is moving along, slowly getting closer to the 4 release</li>
<li>This article shows some of the progress made, and includes lots of screenshots and interesting graphical frontends</li>
<li>If you&#39;re not too familiar with GhostBSD, we <a href="http://www.bsdnow.tv/episodes/2014_03_12-ghost_of_partition" rel="nofollow">interviewed the lead developer</a> a little while back
***</li>
</ul>

<h3><a href="http://rizzoandself.blogspot.com/2014/09/netbsd-on-banana-pi.html" rel="nofollow">NetBSD on the Banana Pi</a></h3>

<ul>
<li>The Banana Pi is a tasty alternative to the Raspberry Pi, with similar hardware specs</li>
<li>In this blog post, a NetBSD developer details his experiences in getting NetBSD to run on it</li>
<li>After studying how the prebuilt Linux image booted, he made some notes and started hacking</li>
<li>Ethernet, one of the few things not working, is being looked into and he&#39;s hoping to get it fully supported for the upcoming NetBSD 7.0</li>
<li>They&#39;re only about $65 as of the time we&#39;re recording this, so it might be a fun project to try
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s28iKdBEbm" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s21Wfnv87h" rel="nofollow">Garegin writes in</a></li>
<li><a href="http://slexy.org/view/s2Fzryxhdz" rel="nofollow">Erno writes in</a></li>
<li><a href="http://slexy.org/view/s2ILcqdFfF" rel="nofollow">Brandon writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>53: It's HAMMER Time</title>
  <link>https://www.bsdnow.tv/53</link>
  <guid isPermaLink="false">ef498915-45f4-4dbb-87fc-4f8e9ee65342</guid>
  <pubDate>Wed, 03 Sep 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ef498915-45f4-4dbb-87fc-4f8e9ee65342.mp3" length="56493652" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>It's our one year anniversary episode, and we'll be talking with Reyk Floeter about the new OpenBSD webserver - why it was created and where it's going. After that, we'll show you the ins and outs of DragonFly's HAMMER FS. Answers to viewer-submitted questions and the latest headlines, on a very special BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:18:27</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>It's our one year anniversary episode, and we'll be talking with Reyk Floeter about the new OpenBSD webserver - why it was created and where it's going. After that, we'll show you the ins and outs of DragonFly's HAMMER FS. Answers to viewer-submitted questions and the latest headlines, on a very special BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD foundation's new IPSEC project (http://freebsdfoundation.blogspot.com/2014/08/freebsd-foundation-announces-ipsec.html)
The FreeBSD foundation, along with Netgate, is sponsoring some new work on the IPSEC code
With bandwidth in the 10-40 gigabit per second range, the IPSEC stack needs to be brought up to modern standards in terms of encryption and performance
This new work will add AES-CTR and AES-GCM modes to FreeBSD's implementation, borrowing some code from OpenBSD
The updated stack will also support AES-NI for hardware-based encryption speed ups
It's expected to be completed by the end of September, and will also be in pfSense 2.2
***
NetBSD at Shimane Open Source Conference 2014 (http://mail-index.netbsd.org/netbsd-advocacy/2014/08/31/msg000667.html)
The Japanese NetBSD users group held a NetBSD booth at the Open Source Conference 2014 in Shimane on August 23
One of the developers has gathered a bunch of pictures from the event and wrote a fairly lengthy summary
They had NetBSD running on all sorts of devices, from Raspberry Pis to Sun Java Stations
Some visitors said that NetBSD had the most chaotic booth at the conference
***
pfSense 2.1.5 released (https://blog.pfsense.org/?p=1401)
A new version of the pfSense 2.1 branch is out
Mostly a security-focused release, including three web UI fixes and the most recent OpenSSL fix (which FreeBSD has still not patched (https://lists.freebsd.org/pipermail/freebsd-security/2014-August/007875.html) in -RELEASE after nearly a month)
It also includes many other bug fixes, check the blog post for the full list
***
Systems, Science and FreeBSD (http://msrvideo.vo.msecnd.net/rmcvideos/227133/dl/227133.mp4)
Our friend George Neville-Neil (http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates) gave a presentation at Microsoft Research
It's mainly about using FreeBSD as a platform for research, inside and outside of universities
The talk describes the OS and its features, ports, developer community, documentation, who uses BSD and much more
***
Interview - Reyk Floeter - reyk@openbsd.org (mailto:reyk@openbsd.org) / @reykfloeter (https://twitter.com/reykfloeter)
OpenBSD's HTTP daemon
Tutorial
A crash course on HAMMER FS (http://www.bsdnow.tv/tutorials/hammer)
News Roundup
OpenBSD's rcctl tool usage (http://brynet.biz.tm/article-rcctl.html)
OpenBSD recently got a new tool (http://undeadly.org/cgi?action=article&amp;amp;sid=20140820090351) for managing /etc/rc.conf.local in -current
Similar to FreeBSD's "sysrc" tool, it eliminates the need to manually edit rc.conf.local to enable or disable services
This blog post - from a BSD Now viewer - shows the typical usage of the new tool to alter the startup services
It won't make it to 5.6, but will be in 5.7 (next May)
***
pfSense mini-roundup (http://mateh.id.au/2014/08/stream-netflix-chromecast-using-pfsense/)
We found five interesting pfSense articles throughout the week and wanted to quickly mention them
The first item in our pfSense mini-roundup details how you can stream Netflix to in non-US countries using a "smart" DNS service
The second post (http://theosquest.com/2014/08/28/ipv6-with-comcast-and-pfsense/) talks about setting ip IPv6, in particular if Comcast is your ISP
The third one (http://news.softpedia.com/news/PfSense-2-1-5-Is-Free-and-Powerful-FreeBSD-based-Firewall-Operating-System-457097.shtml) features pfSense on Softpedia, a more mainstream tech site
The fourth post (http://sichent.wordpress.com/2014/02/22/filtering-https-traffic-with-squid-on-pfsense-2-1/) describes how to filter HTTPS traffic with Squid and pfSense
The last article (http://pfsensesetup.com/vpn-tunneling-with-tinc/) describes setting up a VPN using the "tinc (https://en.wikipedia.org/wiki/Tinc_%28protocol%29)" daemon and pfSense
It seems to be lesser known, compared to things like OpenVPN or SSH tunnels, so it's interesting to read about
This pfSense HQ website seems to have lots of other cool pfSense items, check it out
***
OpenBSD's new buffer cache (http://www.tedunangst.com/flak/post/2Q-buffer-cache-algorithm)
OpenBSD has traditionally used the tried-and-true LRU algorithm for buffer cache, but it has a few problems
Ted Unangst (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures) has just switched to a new algorithm in -current, partially based on 2Q, and details some of his work
Initial tests show positive results in terms of cache responsiveness
Check the post for all the fine details
***
BSDTalk episode 244 (http://bsdtalk.blogspot.com/2014/08/bsdtalk244-lumina-desktop-environment.html)
Another new BSDTalk is up and, this time around, Will Backman (http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk) interviews Ken Moore, the developer of the new BSD desktop environment
They discuss the history of development, differences between it and other DEs, lots of topics
If you're more of a visual person, fear not, because...
We'll have Ken on next week, including a full "virtual walkthrough" of Lumina and its applications
***
Feedback/Questions
Ghislain writes in (http://slexy.org/view/s21G3KL6lv)
Raynold writes in (http://slexy.org/view/s21USZdk2D)
Van writes in (http://slexy.org/view/s2IWAfkDfX)
Sean writes in (http://slexy.org/view/s2OBhezoDV)
Stefan writes in (http://slexy.org/view/s22h9RhXUy)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, party, rave, dubstep, hammer, hammerfs, hammer fs, filesystem, zfs, dragonfly, matthew dillon, cluster, lumina, ipsec, rcctl, pfsense, reyk floeter, openhttpd, nginx, apache, webserver</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>It&#39;s our one year anniversary episode, and we&#39;ll be talking with Reyk Floeter about the new OpenBSD webserver - why it was created and where it&#39;s going. After that, we&#39;ll show you the ins and outs of DragonFly&#39;s HAMMER FS. Answers to viewer-submitted questions and the latest headlines, on a very special BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/08/freebsd-foundation-announces-ipsec.html" rel="nofollow">FreeBSD foundation&#39;s new IPSEC project</a></h3>

<ul>
<li>The FreeBSD foundation, along with Netgate, is sponsoring some new work on the IPSEC code</li>
<li>With bandwidth in the 10-40 gigabit per second range, the IPSEC stack needs to be brought up to modern standards in terms of encryption and performance</li>
<li>This new work will add AES-CTR and AES-GCM modes to FreeBSD&#39;s implementation, borrowing some code from OpenBSD</li>
<li>The updated stack will also support AES-NI for hardware-based encryption speed ups</li>
<li>It&#39;s expected to be completed by the end of September, and will also be in pfSense 2.2
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/netbsd-advocacy/2014/08/31/msg000667.html" rel="nofollow">NetBSD at Shimane Open Source Conference 2014</a></h3>

<ul>
<li>The Japanese NetBSD users group held a NetBSD booth at the Open Source Conference 2014 in Shimane on August 23</li>
<li>One of the developers has gathered a bunch of pictures from the event and wrote a fairly lengthy summary</li>
<li>They had NetBSD running on all sorts of devices, from Raspberry Pis to Sun Java Stations</li>
<li>Some visitors said that NetBSD had the most chaotic booth at the conference
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=1401" rel="nofollow">pfSense 2.1.5 released</a></h3>

<ul>
<li>A new version of the pfSense 2.1 branch is out</li>
<li>Mostly a security-focused release, including three web UI fixes and the most recent OpenSSL fix (which FreeBSD has <a href="https://lists.freebsd.org/pipermail/freebsd-security/2014-August/007875.html" rel="nofollow">still not patched</a> in -RELEASE after nearly a month)</li>
<li>It also includes many other bug fixes, check the blog post for the full list
***</li>
</ul>

<h3><a href="http://msrvideo.vo.msecnd.net/rmcvideos/227133/dl/227133.mp4" rel="nofollow">Systems, Science and FreeBSD</a></h3>

<ul>
<li>Our friend <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">George Neville-Neil</a> gave a presentation at Microsoft Research</li>
<li>It&#39;s mainly about using FreeBSD as a platform for research, inside and outside of universities</li>
<li>The talk describes the OS and its features, ports, developer community, documentation, who uses BSD and much more
***</li>
</ul>

<h2>Interview - Reyk Floeter - <a href="mailto:reyk@openbsd.org" rel="nofollow">reyk@openbsd.org</a> / <a href="https://twitter.com/reykfloeter" rel="nofollow">@reykfloeter</a></h2>

<p>OpenBSD&#39;s HTTP daemon</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/hammer" rel="nofollow">A crash course on HAMMER FS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://brynet.biz.tm/article-rcctl.html" rel="nofollow">OpenBSD&#39;s rcctl tool usage</a></h3>

<ul>
<li>OpenBSD recently <a href="http://undeadly.org/cgi?action=article&sid=20140820090351" rel="nofollow">got a new tool</a> for managing /etc/rc.conf.local in -current</li>
<li>Similar to FreeBSD&#39;s &quot;sysrc&quot; tool, it eliminates the need to manually edit rc.conf.local to enable or disable services</li>
<li>This blog post - from a BSD Now viewer - shows the typical usage of the new tool to alter the startup services</li>
<li>It won&#39;t make it to 5.6, but will be in 5.7 (next May)
***</li>
</ul>

<h3><a href="http://mateh.id.au/2014/08/stream-netflix-chromecast-using-pfsense/" rel="nofollow">pfSense mini-roundup</a></h3>

<ul>
<li>We found five interesting pfSense articles throughout the week and wanted to quickly mention them</li>
<li>The first item in our pfSense mini-roundup details how you can stream Netflix to in non-US countries using a &quot;smart&quot; DNS service</li>
<li>The <a href="http://theosquest.com/2014/08/28/ipv6-with-comcast-and-pfsense/" rel="nofollow">second post</a> talks about setting ip IPv6, in particular if Comcast is your ISP</li>
<li>The <a href="http://news.softpedia.com/news/PfSense-2-1-5-Is-Free-and-Powerful-FreeBSD-based-Firewall-Operating-System-457097.shtml" rel="nofollow">third one</a> features pfSense on Softpedia, a more mainstream tech site</li>
<li>The <a href="http://sichent.wordpress.com/2014/02/22/filtering-https-traffic-with-squid-on-pfsense-2-1/" rel="nofollow">fourth post</a> describes how to filter HTTPS traffic with Squid and pfSense</li>
<li>The <a href="http://pfsensesetup.com/vpn-tunneling-with-tinc/" rel="nofollow">last article</a> describes setting up a VPN using the &quot;<a href="https://en.wikipedia.org/wiki/Tinc_%28protocol%29" rel="nofollow">tinc</a>&quot; daemon and pfSense</li>
<li>It seems to be lesser known, compared to things like OpenVPN or SSH tunnels, so it&#39;s interesting to read about</li>
<li>This pfSense HQ website seems to have lots of other cool pfSense items, check it out
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/2Q-buffer-cache-algorithm" rel="nofollow">OpenBSD&#39;s new buffer cache</a></h3>

<ul>
<li>OpenBSD has traditionally used the tried-and-true LRU algorithm for buffer cache, but it has a few problems</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> has just switched to a new algorithm in -current, partially based on 2Q, and details some of his work</li>
<li>Initial tests show positive results in terms of cache responsiveness</li>
<li>Check the post for all the fine details
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2014/08/bsdtalk244-lumina-desktop-environment.html" rel="nofollow">BSDTalk episode 244</a></h3>

<ul>
<li>Another new BSDTalk is up and, this time around, <a href="http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk" rel="nofollow">Will Backman</a> interviews Ken Moore, the developer of the new BSD desktop environment</li>
<li>They discuss the history of development, differences between it and other DEs, lots of topics</li>
<li>If you&#39;re more of a visual person, fear not, because...</li>
<li>We&#39;ll have Ken on <em>next week</em>, including a full &quot;virtual walkthrough&quot; of Lumina and its applications
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21G3KL6lv" rel="nofollow">Ghislain writes in</a></li>
<li><a href="http://slexy.org/view/s21USZdk2D" rel="nofollow">Raynold writes in</a></li>
<li><a href="http://slexy.org/view/s2IWAfkDfX" rel="nofollow">Van writes in</a></li>
<li><a href="http://slexy.org/view/s2OBhezoDV" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s22h9RhXUy" rel="nofollow">Stefan writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>It&#39;s our one year anniversary episode, and we&#39;ll be talking with Reyk Floeter about the new OpenBSD webserver - why it was created and where it&#39;s going. After that, we&#39;ll show you the ins and outs of DragonFly&#39;s HAMMER FS. Answers to viewer-submitted questions and the latest headlines, on a very special BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/08/freebsd-foundation-announces-ipsec.html" rel="nofollow">FreeBSD foundation&#39;s new IPSEC project</a></h3>

<ul>
<li>The FreeBSD foundation, along with Netgate, is sponsoring some new work on the IPSEC code</li>
<li>With bandwidth in the 10-40 gigabit per second range, the IPSEC stack needs to be brought up to modern standards in terms of encryption and performance</li>
<li>This new work will add AES-CTR and AES-GCM modes to FreeBSD&#39;s implementation, borrowing some code from OpenBSD</li>
<li>The updated stack will also support AES-NI for hardware-based encryption speed ups</li>
<li>It&#39;s expected to be completed by the end of September, and will also be in pfSense 2.2
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/netbsd-advocacy/2014/08/31/msg000667.html" rel="nofollow">NetBSD at Shimane Open Source Conference 2014</a></h3>

<ul>
<li>The Japanese NetBSD users group held a NetBSD booth at the Open Source Conference 2014 in Shimane on August 23</li>
<li>One of the developers has gathered a bunch of pictures from the event and wrote a fairly lengthy summary</li>
<li>They had NetBSD running on all sorts of devices, from Raspberry Pis to Sun Java Stations</li>
<li>Some visitors said that NetBSD had the most chaotic booth at the conference
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=1401" rel="nofollow">pfSense 2.1.5 released</a></h3>

<ul>
<li>A new version of the pfSense 2.1 branch is out</li>
<li>Mostly a security-focused release, including three web UI fixes and the most recent OpenSSL fix (which FreeBSD has <a href="https://lists.freebsd.org/pipermail/freebsd-security/2014-August/007875.html" rel="nofollow">still not patched</a> in -RELEASE after nearly a month)</li>
<li>It also includes many other bug fixes, check the blog post for the full list
***</li>
</ul>

<h3><a href="http://msrvideo.vo.msecnd.net/rmcvideos/227133/dl/227133.mp4" rel="nofollow">Systems, Science and FreeBSD</a></h3>

<ul>
<li>Our friend <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">George Neville-Neil</a> gave a presentation at Microsoft Research</li>
<li>It&#39;s mainly about using FreeBSD as a platform for research, inside and outside of universities</li>
<li>The talk describes the OS and its features, ports, developer community, documentation, who uses BSD and much more
***</li>
</ul>

<h2>Interview - Reyk Floeter - <a href="mailto:reyk@openbsd.org" rel="nofollow">reyk@openbsd.org</a> / <a href="https://twitter.com/reykfloeter" rel="nofollow">@reykfloeter</a></h2>

<p>OpenBSD&#39;s HTTP daemon</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/hammer" rel="nofollow">A crash course on HAMMER FS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://brynet.biz.tm/article-rcctl.html" rel="nofollow">OpenBSD&#39;s rcctl tool usage</a></h3>

<ul>
<li>OpenBSD recently <a href="http://undeadly.org/cgi?action=article&sid=20140820090351" rel="nofollow">got a new tool</a> for managing /etc/rc.conf.local in -current</li>
<li>Similar to FreeBSD&#39;s &quot;sysrc&quot; tool, it eliminates the need to manually edit rc.conf.local to enable or disable services</li>
<li>This blog post - from a BSD Now viewer - shows the typical usage of the new tool to alter the startup services</li>
<li>It won&#39;t make it to 5.6, but will be in 5.7 (next May)
***</li>
</ul>

<h3><a href="http://mateh.id.au/2014/08/stream-netflix-chromecast-using-pfsense/" rel="nofollow">pfSense mini-roundup</a></h3>

<ul>
<li>We found five interesting pfSense articles throughout the week and wanted to quickly mention them</li>
<li>The first item in our pfSense mini-roundup details how you can stream Netflix to in non-US countries using a &quot;smart&quot; DNS service</li>
<li>The <a href="http://theosquest.com/2014/08/28/ipv6-with-comcast-and-pfsense/" rel="nofollow">second post</a> talks about setting ip IPv6, in particular if Comcast is your ISP</li>
<li>The <a href="http://news.softpedia.com/news/PfSense-2-1-5-Is-Free-and-Powerful-FreeBSD-based-Firewall-Operating-System-457097.shtml" rel="nofollow">third one</a> features pfSense on Softpedia, a more mainstream tech site</li>
<li>The <a href="http://sichent.wordpress.com/2014/02/22/filtering-https-traffic-with-squid-on-pfsense-2-1/" rel="nofollow">fourth post</a> describes how to filter HTTPS traffic with Squid and pfSense</li>
<li>The <a href="http://pfsensesetup.com/vpn-tunneling-with-tinc/" rel="nofollow">last article</a> describes setting up a VPN using the &quot;<a href="https://en.wikipedia.org/wiki/Tinc_%28protocol%29" rel="nofollow">tinc</a>&quot; daemon and pfSense</li>
<li>It seems to be lesser known, compared to things like OpenVPN or SSH tunnels, so it&#39;s interesting to read about</li>
<li>This pfSense HQ website seems to have lots of other cool pfSense items, check it out
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/2Q-buffer-cache-algorithm" rel="nofollow">OpenBSD&#39;s new buffer cache</a></h3>

<ul>
<li>OpenBSD has traditionally used the tried-and-true LRU algorithm for buffer cache, but it has a few problems</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> has just switched to a new algorithm in -current, partially based on 2Q, and details some of his work</li>
<li>Initial tests show positive results in terms of cache responsiveness</li>
<li>Check the post for all the fine details
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2014/08/bsdtalk244-lumina-desktop-environment.html" rel="nofollow">BSDTalk episode 244</a></h3>

<ul>
<li>Another new BSDTalk is up and, this time around, <a href="http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk" rel="nofollow">Will Backman</a> interviews Ken Moore, the developer of the new BSD desktop environment</li>
<li>They discuss the history of development, differences between it and other DEs, lots of topics</li>
<li>If you&#39;re more of a visual person, fear not, because...</li>
<li>We&#39;ll have Ken on <em>next week</em>, including a full &quot;virtual walkthrough&quot; of Lumina and its applications
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21G3KL6lv" rel="nofollow">Ghislain writes in</a></li>
<li><a href="http://slexy.org/view/s21USZdk2D" rel="nofollow">Raynold writes in</a></li>
<li><a href="http://slexy.org/view/s2IWAfkDfX" rel="nofollow">Van writes in</a></li>
<li><a href="http://slexy.org/view/s2OBhezoDV" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s22h9RhXUy" rel="nofollow">Stefan writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>52: Reverse Takeover</title>
  <link>https://www.bsdnow.tv/52</link>
  <guid isPermaLink="false">67ad6e78-144e-4d1c-a713-49b54e5b679e</guid>
  <pubDate>Wed, 27 Aug 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/67ad6e78-144e-4d1c-a713-49b54e5b679e.mp3" length="53663188" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week, we'll be chatting with Shawn Webb about his recent work with ASLR and PIE in FreeBSD. After that, we'll be showing you how you can create a reverse SSH tunnel to a system behind a firewall... how sneaky. Answers to your emails plus the latest news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:14:31</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week, we'll be chatting with Shawn Webb about his recent work with ASLR and PIE in FreeBSD. After that, we'll be showing you how you can create a reverse SSH tunnel to a system behind a firewall... how sneaky. Answers to your emails plus the latest news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD foundation August update (https://www.freebsdfoundation.org/press/2014augupdate.pdf)
The foundation has published a new PDF detailing some of their recent activities
It includes project development updates, the 10.1-RELEASE schedule and some of its new features
There is also a short interview with Dru Lavigne (http://www.bsdnow.tv/episodes/2014_04_09-pxe_dust) in the "voices from the community" section
If you're into hardware, there's another section about some new FreeBSD server equipment
In closing, there's an update on funding too
***
NSD for an authoritative nameserver (http://www.prado.it/2014/08/20/how-to-run-master-nsd-on-freebsd-10-0/)
With BIND having been removed from FreeBSD 10.0, you might be looking to replace your old DNS setup
This article shows how to use NSD for an authoritative DNS nameserver
It's also got a link to a similar article on Unbound, the new favorite recursive and caching resolver (they work great together)
All the instructions are presented very neatly, with all the little details included
Less BIND means less vulnerabilities, everybody's happy
***
BIND and Nginx removed from OpenBSD (http://marc.info/?l=openbsd-cvs&amp;amp;m=140873518514033&amp;amp;w=2)
While we're on the topic of DNS servers, BIND was finally removed from OpenBSD as well
The base system contains both NSD and Unbound, so users can transition over between 5.6 (November of this year) and 5.7 (May of next year)
They've also removed nginx (http://marc.info/?l=openbsd-cvs&amp;amp;m=140908174910713&amp;amp;w=2) from the base system, in favor of the new custom HTTP daemon
BIND and Nginx are still available in ports if you don't want to switch
We're hoping to have Reyk Floeter on the show next week to talk about it, but scheduling might not work out, so it may be a little later on
With Apache gone in the upcoming 5.6, It's also likely that sendmail will be removed before 5.7 - hooray for modern alternatives
***
NetBSD demo videos (https://www.youtube.com/user/tsutsuii/videos)
A Japanese NetBSD developer has been uploading lots of interesting videos
Unsurprisingly, they're all featuring NetBSD running on exotic and weird hardware
Most of them are demoing sound or running a modern Twitter client on an ancient computer
They're from the same guy that did the conference wrap-up we mentioned recently
***
Interview - Shawn Webb - shawn.webb@hardenedbsd.org (mailto:shawn.webb@hardenedbsd.org) / @lattera (https://twitter.com/lattera)
Address space layout randomization in FreeBSD (http://hardenedbsd.org/)
Tutorial
Reverse SSH tunneling (http://www.bsdnow.tv/tutorials/reverse-ssh)
News Roundup
Puppet master-agent installation on FreeBSD (https://deuterion.net/puppet-master-agent-installation-on-freebsd/)
If you've got a lot of BSD boxes under your control, or if you're just lazy, you've probably looked into Puppet before
The author claims a lack of BSD-specific Puppet documentation, so he decided to write up some notes of his own
He goes through some advantages of using this type of tool for deployments, even when you don't have a huge number of systems
The rest of the post explains how to set up both the master and the agent configurations
***
Misc. pfSense items (http://www.mondaiji.com/blog/other/it/10175-the-hunt-for-the-ultimate-free-open-source-firewall-distro)
We found a few miscellaneous pfSense articles this past week 
The first one is about the hunt for the "ultimate" free open source firewall, where pfSense is obviously a strong contender
The second one (http://willbradley.name/2014/08/20/logging-natfirewallstate-entries-in-pfsense/) shows how to log NAT firewall states (a good way to find out which family member has been torrenting!)
In the third (http://www.proteansec.com/linux/pfsense-automatically-backup-configuration-files/), you can see how to automatically back up your configuration files
The fourth item (https://vidarw.wordpress.com/2014/07/09/network-boot-with-pfsense-and-tftpd32/) shows how to set up PXE booting with pfSense, similar to one of our tutorials
***
Time Machine backups on ZFS (http://blog.khubla.com/freebsd/timemachine-backups-on-freebsd-10)
If you've got a Mac you need to keep backed up, a FreeBSD server with ZFS can take the place of an expensive "time capsule"
This post walks you through setting up netatalk and mDNS for a very versatile Time Machine backup system
With a single command on the OS X side, you can write to and read from the BSD box just like a regular external drive
Surprisingly simple to do, recommended for anyone with Macs on their network
***
Lumina desktop preview (http://blog.pcbsd.org/2014/08/pc-bsd-10-0-3-preview-lumina-desktop/)
Lumina, the BSD-exclusive desktop environment, seems to be coming along nicely
The main developer has posted an update on the PCBSD blog with some screenshots
Lots of new features have been added, many of which are documented in the post
There just might be a BSD Now episode about Lumina coming up.. (cough cough)
***
Feedback/Questions
Gary writes in (http://slexy.org/view/s21eLBvf1l)
Cedric writes in (http://slexy.org/view/s20xqTKNrf)
Caldwell writes in (http://slexy.org/view/s21q428tPj)
Cary writes in (http://slexy.org/view/s2uVLhqCaO)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ssh, tunnel, reverse tunnel, encryption, aslr, pie, address space layout randomization, position-independent executables, nsd, bind, unbound, dns server, pfsense, shawn webb, time machine, os x, nginx</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week, we&#39;ll be chatting with Shawn Webb about his recent work with ASLR and PIE in FreeBSD. After that, we&#39;ll be showing you how you can create a reverse SSH tunnel to a system behind a firewall... how sneaky. Answers to your emails plus the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/press/2014augupdate.pdf" rel="nofollow">FreeBSD foundation August update</a></h3>

<ul>
<li>The foundation has published a new PDF detailing some of their recent activities</li>
<li>It includes project development updates, the 10.1-RELEASE schedule and some of its new features</li>
<li>There is also a short interview with <a href="http://www.bsdnow.tv/episodes/2014_04_09-pxe_dust" rel="nofollow">Dru Lavigne</a> in the &quot;voices from the community&quot; section</li>
<li>If you&#39;re into hardware, there&#39;s another section about some new FreeBSD server equipment</li>
<li>In closing, there&#39;s an update on funding too
***</li>
</ul>

<h3><a href="http://www.prado.it/2014/08/20/how-to-run-master-nsd-on-freebsd-10-0/" rel="nofollow">NSD for an authoritative nameserver</a></h3>

<ul>
<li>With BIND having been removed from FreeBSD 10.0, you might be looking to replace your old DNS setup</li>
<li>This article shows how to use NSD for an authoritative DNS nameserver</li>
<li>It&#39;s also got a link to a similar article on Unbound, the new favorite recursive and caching resolver (they work great together)</li>
<li>All the instructions are presented very neatly, with all the little details included</li>
<li>Less BIND means less vulnerabilities, everybody&#39;s happy
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=140873518514033&w=2" rel="nofollow">BIND and Nginx removed from OpenBSD</a></h3>

<ul>
<li>While we&#39;re on the topic of DNS servers, BIND was finally removed from OpenBSD as well</li>
<li>The base system contains both NSD and Unbound, so users can transition over between 5.6 (November of this year) and 5.7 (May of next year)</li>
<li>They&#39;ve also <a href="http://marc.info/?l=openbsd-cvs&m=140908174910713&w=2" rel="nofollow">removed nginx</a> from the base system, in favor of the new custom HTTP daemon</li>
<li>BIND and Nginx are still available in ports if you don&#39;t want to switch</li>
<li>We&#39;re hoping to have Reyk Floeter on the show next week to talk about it, but scheduling might not work out, so it may be a little later on</li>
<li>With Apache gone in the upcoming 5.6, It&#39;s also likely that sendmail will be removed before 5.7 - hooray for modern alternatives
***</li>
</ul>

<h3><a href="https://www.youtube.com/user/tsutsuii/videos" rel="nofollow">NetBSD demo videos</a></h3>

<ul>
<li>A Japanese NetBSD developer has been uploading lots of interesting videos</li>
<li>Unsurprisingly, they&#39;re all featuring NetBSD running on exotic and weird hardware</li>
<li>Most of them are demoing sound or running a modern Twitter client on an ancient computer</li>
<li>They&#39;re from the same guy that did the conference wrap-up we mentioned recently
***</li>
</ul>

<h2>Interview - Shawn Webb - <a href="mailto:shawn.webb@hardenedbsd.org" rel="nofollow">shawn.webb@hardenedbsd.org</a> / <a href="https://twitter.com/lattera" rel="nofollow">@lattera</a></h2>

<p>Address space layout randomization <a href="http://hardenedbsd.org/" rel="nofollow">in FreeBSD</a></p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/reverse-ssh" rel="nofollow">Reverse SSH tunneling</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://deuterion.net/puppet-master-agent-installation-on-freebsd/" rel="nofollow">Puppet master-agent installation on FreeBSD</a></h3>

<ul>
<li>If you&#39;ve got a lot of BSD boxes under your control, or if you&#39;re just lazy, you&#39;ve probably looked into Puppet before</li>
<li>The author claims a lack of BSD-specific Puppet documentation, so he decided to write up some notes of his own</li>
<li>He goes through some advantages of using this type of tool for deployments, even when you don&#39;t have a huge number of systems</li>
<li>The rest of the post explains how to set up both the master and the agent configurations
***</li>
</ul>

<h3><a href="http://www.mondaiji.com/blog/other/it/10175-the-hunt-for-the-ultimate-free-open-source-firewall-distro" rel="nofollow">Misc. pfSense items</a></h3>

<ul>
<li>We found a few miscellaneous pfSense articles this past week </li>
<li>The first one is about the hunt for the &quot;ultimate&quot; free open source firewall, where pfSense is obviously a strong contender</li>
<li><a href="http://willbradley.name/2014/08/20/logging-natfirewallstate-entries-in-pfsense/" rel="nofollow">The second one</a> shows how to log NAT firewall states (a good way to find out which family member has been torrenting!)</li>
<li>In <a href="http://www.proteansec.com/linux/pfsense-automatically-backup-configuration-files/" rel="nofollow">the third</a>, you can see how to automatically back up your configuration files</li>
<li><a href="https://vidarw.wordpress.com/2014/07/09/network-boot-with-pfsense-and-tftpd32/" rel="nofollow">The fourth item</a> shows how to set up PXE booting with pfSense, similar to one of our tutorials
***</li>
</ul>

<h3><a href="http://blog.khubla.com/freebsd/timemachine-backups-on-freebsd-10" rel="nofollow">Time Machine backups on ZFS</a></h3>

<ul>
<li>If you&#39;ve got a Mac you need to keep backed up, a FreeBSD server with ZFS can take the place of an expensive &quot;time capsule&quot;</li>
<li>This post walks you through setting up netatalk and mDNS for a very versatile Time Machine backup system</li>
<li>With a single command on the OS X side, you can write to and read from the BSD box just like a regular external drive</li>
<li>Surprisingly simple to do, recommended for anyone with Macs on their network
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/08/pc-bsd-10-0-3-preview-lumina-desktop/" rel="nofollow">Lumina desktop preview</a></h3>

<ul>
<li>Lumina, the BSD-exclusive desktop environment, seems to be coming along nicely</li>
<li>The main developer has posted an update on the PCBSD blog with some screenshots</li>
<li>Lots of new features have been added, many of which are documented in the post</li>
<li>There just might be a BSD Now episode about Lumina coming up.. (cough cough)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21eLBvf1l" rel="nofollow">Gary writes in</a></li>
<li><a href="http://slexy.org/view/s20xqTKNrf" rel="nofollow">Cedric writes in</a></li>
<li><a href="http://slexy.org/view/s21q428tPj" rel="nofollow">Caldwell writes in</a></li>
<li><a href="http://slexy.org/view/s2uVLhqCaO" rel="nofollow">Cary writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week, we&#39;ll be chatting with Shawn Webb about his recent work with ASLR and PIE in FreeBSD. After that, we&#39;ll be showing you how you can create a reverse SSH tunnel to a system behind a firewall... how sneaky. Answers to your emails plus the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/press/2014augupdate.pdf" rel="nofollow">FreeBSD foundation August update</a></h3>

<ul>
<li>The foundation has published a new PDF detailing some of their recent activities</li>
<li>It includes project development updates, the 10.1-RELEASE schedule and some of its new features</li>
<li>There is also a short interview with <a href="http://www.bsdnow.tv/episodes/2014_04_09-pxe_dust" rel="nofollow">Dru Lavigne</a> in the &quot;voices from the community&quot; section</li>
<li>If you&#39;re into hardware, there&#39;s another section about some new FreeBSD server equipment</li>
<li>In closing, there&#39;s an update on funding too
***</li>
</ul>

<h3><a href="http://www.prado.it/2014/08/20/how-to-run-master-nsd-on-freebsd-10-0/" rel="nofollow">NSD for an authoritative nameserver</a></h3>

<ul>
<li>With BIND having been removed from FreeBSD 10.0, you might be looking to replace your old DNS setup</li>
<li>This article shows how to use NSD for an authoritative DNS nameserver</li>
<li>It&#39;s also got a link to a similar article on Unbound, the new favorite recursive and caching resolver (they work great together)</li>
<li>All the instructions are presented very neatly, with all the little details included</li>
<li>Less BIND means less vulnerabilities, everybody&#39;s happy
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=140873518514033&w=2" rel="nofollow">BIND and Nginx removed from OpenBSD</a></h3>

<ul>
<li>While we&#39;re on the topic of DNS servers, BIND was finally removed from OpenBSD as well</li>
<li>The base system contains both NSD and Unbound, so users can transition over between 5.6 (November of this year) and 5.7 (May of next year)</li>
<li>They&#39;ve also <a href="http://marc.info/?l=openbsd-cvs&m=140908174910713&w=2" rel="nofollow">removed nginx</a> from the base system, in favor of the new custom HTTP daemon</li>
<li>BIND and Nginx are still available in ports if you don&#39;t want to switch</li>
<li>We&#39;re hoping to have Reyk Floeter on the show next week to talk about it, but scheduling might not work out, so it may be a little later on</li>
<li>With Apache gone in the upcoming 5.6, It&#39;s also likely that sendmail will be removed before 5.7 - hooray for modern alternatives
***</li>
</ul>

<h3><a href="https://www.youtube.com/user/tsutsuii/videos" rel="nofollow">NetBSD demo videos</a></h3>

<ul>
<li>A Japanese NetBSD developer has been uploading lots of interesting videos</li>
<li>Unsurprisingly, they&#39;re all featuring NetBSD running on exotic and weird hardware</li>
<li>Most of them are demoing sound or running a modern Twitter client on an ancient computer</li>
<li>They&#39;re from the same guy that did the conference wrap-up we mentioned recently
***</li>
</ul>

<h2>Interview - Shawn Webb - <a href="mailto:shawn.webb@hardenedbsd.org" rel="nofollow">shawn.webb@hardenedbsd.org</a> / <a href="https://twitter.com/lattera" rel="nofollow">@lattera</a></h2>

<p>Address space layout randomization <a href="http://hardenedbsd.org/" rel="nofollow">in FreeBSD</a></p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/reverse-ssh" rel="nofollow">Reverse SSH tunneling</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://deuterion.net/puppet-master-agent-installation-on-freebsd/" rel="nofollow">Puppet master-agent installation on FreeBSD</a></h3>

<ul>
<li>If you&#39;ve got a lot of BSD boxes under your control, or if you&#39;re just lazy, you&#39;ve probably looked into Puppet before</li>
<li>The author claims a lack of BSD-specific Puppet documentation, so he decided to write up some notes of his own</li>
<li>He goes through some advantages of using this type of tool for deployments, even when you don&#39;t have a huge number of systems</li>
<li>The rest of the post explains how to set up both the master and the agent configurations
***</li>
</ul>

<h3><a href="http://www.mondaiji.com/blog/other/it/10175-the-hunt-for-the-ultimate-free-open-source-firewall-distro" rel="nofollow">Misc. pfSense items</a></h3>

<ul>
<li>We found a few miscellaneous pfSense articles this past week </li>
<li>The first one is about the hunt for the &quot;ultimate&quot; free open source firewall, where pfSense is obviously a strong contender</li>
<li><a href="http://willbradley.name/2014/08/20/logging-natfirewallstate-entries-in-pfsense/" rel="nofollow">The second one</a> shows how to log NAT firewall states (a good way to find out which family member has been torrenting!)</li>
<li>In <a href="http://www.proteansec.com/linux/pfsense-automatically-backup-configuration-files/" rel="nofollow">the third</a>, you can see how to automatically back up your configuration files</li>
<li><a href="https://vidarw.wordpress.com/2014/07/09/network-boot-with-pfsense-and-tftpd32/" rel="nofollow">The fourth item</a> shows how to set up PXE booting with pfSense, similar to one of our tutorials
***</li>
</ul>

<h3><a href="http://blog.khubla.com/freebsd/timemachine-backups-on-freebsd-10" rel="nofollow">Time Machine backups on ZFS</a></h3>

<ul>
<li>If you&#39;ve got a Mac you need to keep backed up, a FreeBSD server with ZFS can take the place of an expensive &quot;time capsule&quot;</li>
<li>This post walks you through setting up netatalk and mDNS for a very versatile Time Machine backup system</li>
<li>With a single command on the OS X side, you can write to and read from the BSD box just like a regular external drive</li>
<li>Surprisingly simple to do, recommended for anyone with Macs on their network
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/08/pc-bsd-10-0-3-preview-lumina-desktop/" rel="nofollow">Lumina desktop preview</a></h3>

<ul>
<li>Lumina, the BSD-exclusive desktop environment, seems to be coming along nicely</li>
<li>The main developer has posted an update on the PCBSD blog with some screenshots</li>
<li>Lots of new features have been added, many of which are documented in the post</li>
<li>There just might be a BSD Now episode about Lumina coming up.. (cough cough)
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21eLBvf1l" rel="nofollow">Gary writes in</a></li>
<li><a href="http://slexy.org/view/s20xqTKNrf" rel="nofollow">Cedric writes in</a></li>
<li><a href="http://slexy.org/view/s21q428tPj" rel="nofollow">Caldwell writes in</a></li>
<li><a href="http://slexy.org/view/s2uVLhqCaO" rel="nofollow">Cary writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>51: Engineering Nginx</title>
  <link>https://www.bsdnow.tv/51</link>
  <guid isPermaLink="false">4502bfee-e803-4a0d-bdcc-fd4420b30bb1</guid>
  <pubDate>Wed, 20 Aug 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4502bfee-e803-4a0d-bdcc-fd4420b30bb1.mp3" length="62975956" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up on the show, we'll be showing you how to set up a secure, SSL-only webserver. There's also an interview with Eric Le Blan about community participation and FreeBSD's role in the commercial server space. All that and more, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:27:27</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up on the show, we'll be showing you how to set up a secure, SSL-only webserver. There's also an interview with Eric Le Blan about community participation and FreeBSD's role in the commercial server space. All that and more, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
Password gropers take spamtrap bait (http://bsdly.blogspot.com/2014/08/password-gropers-take-spamtrap-bait.html)
Our friend Peter Hansteen (http://www.bsdnow.tv/episodes/2014_04_30-puffy_firewall), who keeps his eyes glued to his log files, has a new blog post
He seems to have discovered another new weird phenomenon in his pop3 logs
"yes, I still run one, for the same bad reasons more than a third of my readers probably do: inertia"
Someone tried to log in to his service with an address that was known to be invalid
The rest of the post goes into detail about his theory of why someone would use a list of invalid addresses for this purpose
***
Inside the Atheros wifi chipset (https://www.youtube.com/watch?v=WOcYTqoSQ68)
Adrian Chadd - sometimes known in the FreeBSD community as "the wireless guy" - gave a talk at the Defcon Wireless Village 2014
He covers a lot of topics on wifi, specifically on Atheros chips and why they're so popular for open source development
There's a lot of great information in the presentation, including cool (and evil) things you can do with wireless cards
Very technical talk; some parts might go over your head if you're not a driver developer
The raw video file is also available to download (https://archive.org/download/WirelessVillageAtDefCon22/20-Atheros.mp4) on archive.org
Adrian has also recently worked on getting Kismet and Aircrack-NG to work better with FreeBSD, including packet injection and other fun things
***
Trip report and hackathon mini-roundup (http://freebsdfoundation.blogspot.com/2014/08/bsdcan-trip-report-mark-linimon.html)
A few more (late) reports from BSDCan and the latest OpenBSD hackathon have been posted
Mark Linimon mentions some of the future plans for FreeBSD's release engineering and ports
Bapt also has a BSDCan report (http://freebsdfoundation.blogspot.com/2014/08/bsdcan-trip-report-baptiste-daroussin.html) detailing his work on ports and packages
Antoine Jacoutot writes about (http://undeadly.org/cgi?action=article&amp;amp;sid=20140812064946) his work at the most recent hackathon, working with rc configuration and a new /etc/examples layout
Peter Hessler, a latecomer to the hackathon, details his experience (http://undeadly.org/cgi?action=article&amp;amp;sid=20140806125308) too, hacking on the installer and built-in upgrade function
Christian Weisgerber talks about (http://undeadly.org/cgi?action=article&amp;amp;sid=20140803122705) starting some initial improvements of OpenBSD's ports infrastructure
***
DragonFly BSD 3.8.2 released (http://lists.dragonflybsd.org/pipermail/commits/2014-August/270573.html)
Although it was already branched, the release media is now available for DragonFly 3.8.2
This is a minor update, mostly to fix the recent OpenSSL vulnerabilities
It also includes some various other small fixes
***
Interview - Eric Le Blan - info@xinuos.com (mailto:info@xinuos.com)
Xinuos' recent FreeBSD integration, BSD in the commercial server space
Tutorial
Building a hardened, feature-rich webserver (http://www.bsdnow.tv/tutorials/nginx)
News Roundup
Defend your network and privacy, FreeBSD version (http://networkfilter.blogspot.com/2014/08/defend-your-network-and-privacy-vpn.html)
Back in episode 39 (http://www.bsdnow.tv/episodes/2014_05_28-the_friendly_sandbox), we covered a blog post about creating an OpenBSD gateway - partly based on our tutorial (http://www.bsdnow.tv/tutorials/openbsd-router)
This is a follow-up post, by the same author, about doing a similar thing with FreeBSD
He mentions some of the advantages and disadvantages between the two operating systems, and encourages users to decide for themselves which one suits their needs
The rest is pretty much the same things: firewall, VPN, DHCP server, DNSCrypt, etc.
***
Don't encrypt all the things (http://www.tedunangst.com/flak/post/dont-encrypt-all-the-things)
Another couple of interesting blog posts from Ted Unangst (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures) about encryption
It talks about how Google recently started ranking sites with HTTPS higher in their search results, and then reflects on how sometimes encryption does more harm than good
After heartbleed, the ones who might be able to decrypt your emails went from just a three-letter agency to any script kiddie
He also talks a bit about some PGP weaknesses and a possible future replacement
He also has another, similar post entitled "in defense of opportunistic encryption (http://www.tedunangst.com/flak/post/in-defense-of-opportunistic-encryption)"
***
New automounter lands in FreeBSD (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=270096)
The work on the new automounter has just landed in 11-CURRENT
With help from the FreeBSD Foundation, we'll have a new "autofs" kernel option
Check the SVN viewer online to read over the man pages if you're not running -CURRENT
You can also read a bit about it in the recent newsletter (https://www.freebsdfoundation.org/press/2014jul-newsletter#Project3)
***
OpenSSH 6.7 CFT (https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-August/032810.html)
It's been a little while since the last OpenSSH release, but 6.7 is almost ready
Our friend Damien Miller (http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline) issued a call for testing for the upcoming version, which includes a fair amount of new features
It includes some old code removal, some new features and some internal reworkings - we'll cover the full list in detail when it's released
This version also officially supports being built with LibreSSL now
Help test it out and report any findings, especially if you have access to something a little more exotic than just a BSD system
***
Feedback/Questions
David writes in (http://slexy.org/view/s20yIP7VXa)
Lachlan writes in (http://slexy.org/view/s2DeeUjAn6)
Francis writes in (http://slexy.org/view/s216imwEb0)
Frank writes in (http://slexy.org/view/s2oc8vavWe)
Sean writes in (http://slexy.org/view/s20wL61sSr)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, xinuos, cloud computing, hosting solution, nginx, webserver, httpd, spamd, atheros, wifi, aircrack-ng, kismet, defcon, wireless, bsdcan, hackathon, autofs, automounter, https, tls, ssl, openssh</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up on the show, we&#39;ll be showing you how to set up a secure, SSL-only webserver. There&#39;s also an interview with Eric Le Blan about community participation and FreeBSD&#39;s role in the commercial server space. All that and more, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://bsdly.blogspot.com/2014/08/password-gropers-take-spamtrap-bait.html" rel="nofollow">Password gropers take spamtrap bait</a></h3>

<ul>
<li>Our friend <a href="http://www.bsdnow.tv/episodes/2014_04_30-puffy_firewall" rel="nofollow">Peter Hansteen</a>, who keeps his eyes glued to his log files, has a new blog post</li>
<li>He seems to have discovered another new weird phenomenon in his pop3 logs</li>
<li>&quot;yes, I still run one, for the same bad reasons more than a third of my readers probably do: inertia&quot;</li>
<li>Someone tried to log in to his service with an address that was known to be invalid</li>
<li>The rest of the post goes into detail about his theory of why someone would use a list of invalid addresses for this purpose
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=WOcYTqoSQ68" rel="nofollow">Inside the Atheros wifi chipset</a></h3>

<ul>
<li>Adrian Chadd - sometimes known in the FreeBSD community as &quot;the wireless guy&quot; - gave a talk at the Defcon Wireless Village 2014</li>
<li>He covers a lot of topics on wifi, specifically on Atheros chips and why they&#39;re so popular for open source development</li>
<li>There&#39;s a lot of great information in the presentation, including cool (and evil) things you can do with wireless cards</li>
<li>Very technical talk; some parts might go over your head if you&#39;re not a driver developer</li>
<li>The raw video file is also available <a href="https://archive.org/download/WirelessVillageAtDefCon22/20-Atheros.mp4" rel="nofollow">to download</a> on archive.org</li>
<li>Adrian has also recently worked on getting Kismet and Aircrack-NG to work better with FreeBSD, including packet injection and other fun things
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/08/bsdcan-trip-report-mark-linimon.html" rel="nofollow">Trip report and hackathon mini-roundup</a></h3>

<ul>
<li>A few more (late) reports from BSDCan and the latest OpenBSD hackathon have been posted</li>
<li>Mark Linimon mentions some of the future plans for FreeBSD&#39;s release engineering and ports</li>
<li>Bapt <a href="http://freebsdfoundation.blogspot.com/2014/08/bsdcan-trip-report-baptiste-daroussin.html" rel="nofollow">also has a BSDCan report</a> detailing his work on ports and packages</li>
<li>Antoine Jacoutot <a href="http://undeadly.org/cgi?action=article&sid=20140812064946" rel="nofollow">writes about</a> his work at the most recent hackathon, working with rc configuration and a new /etc/examples layout</li>
<li>Peter Hessler, a latecomer to the hackathon, <a href="http://undeadly.org/cgi?action=article&sid=20140806125308" rel="nofollow">details his experience</a> too, hacking on the installer and built-in upgrade function</li>
<li>Christian Weisgerber <a href="http://undeadly.org/cgi?action=article&sid=20140803122705" rel="nofollow">talks about</a> starting some initial improvements of OpenBSD&#39;s ports infrastructure
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2014-August/270573.html" rel="nofollow">DragonFly BSD 3.8.2 released</a></h3>

<ul>
<li>Although it was already branched, the release media is now available for DragonFly 3.8.2</li>
<li>This is a minor update, mostly to fix the recent OpenSSL vulnerabilities</li>
<li>It also includes some various other small fixes
***</li>
</ul>

<h2>Interview - Eric Le Blan - <a href="mailto:info@xinuos.com" rel="nofollow">info@xinuos.com</a></h2>

<p>Xinuos&#39; recent FreeBSD integration, BSD in the commercial server space</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/nginx" rel="nofollow">Building a hardened, feature-rich webserver</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://networkfilter.blogspot.com/2014/08/defend-your-network-and-privacy-vpn.html" rel="nofollow">Defend your network and privacy, FreeBSD version</a></h3>

<ul>
<li>Back in <a href="http://www.bsdnow.tv/episodes/2014_05_28-the_friendly_sandbox" rel="nofollow">episode 39</a>, we covered a blog post about creating an OpenBSD gateway - partly based on <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">our tutorial</a></li>
<li>This is a follow-up post, by the same author, about doing a similar thing with FreeBSD</li>
<li>He mentions some of the advantages and disadvantages between the two operating systems, and encourages users to decide for themselves which one suits their needs</li>
<li>The rest is pretty much the same things: firewall, VPN, DHCP server, DNSCrypt, etc.
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/dont-encrypt-all-the-things" rel="nofollow">Don&#39;t encrypt all the things</a></h3>

<ul>
<li>Another couple of interesting blog posts from <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> about encryption</li>
<li>It talks about how Google recently started ranking sites with HTTPS higher in their search results, and then reflects on how sometimes encryption does more harm than good</li>
<li>After heartbleed, the ones who might be able to decrypt your emails went from just a three-letter agency to any script kiddie</li>
<li>He also talks a bit about some PGP weaknesses and a possible future replacement</li>
<li>He also has another, similar post entitled &quot;<a href="http://www.tedunangst.com/flak/post/in-defense-of-opportunistic-encryption" rel="nofollow">in defense of opportunistic encryption</a>&quot;
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=270096" rel="nofollow">New automounter lands in FreeBSD</a></h3>

<ul>
<li>The work on the new automounter has just landed in 11-CURRENT</li>
<li>With help from the FreeBSD Foundation, we&#39;ll have a new &quot;autofs&quot; kernel option</li>
<li>Check the SVN viewer online to read over the man pages if you&#39;re not running -CURRENT</li>
<li>You can also read a bit about it in the <a href="https://www.freebsdfoundation.org/press/2014jul-newsletter#Project3" rel="nofollow">recent newsletter</a>
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-August/032810.html" rel="nofollow">OpenSSH 6.7 CFT</a></h3>

<ul>
<li>It&#39;s been a little while since the last OpenSSH release, but 6.7 is almost ready</li>
<li>Our friend <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">Damien Miller</a> issued a call for testing for the upcoming version, which includes a fair amount of new features</li>
<li>It includes some old code removal, some new features and some internal reworkings - we&#39;ll cover the full list in detail when it&#39;s released</li>
<li>This version also officially supports being built with LibreSSL now</li>
<li>Help test it out and report any findings, especially if you have access to something a little more exotic than just a BSD system
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20yIP7VXa" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s2DeeUjAn6" rel="nofollow">Lachlan writes in</a></li>
<li><a href="http://slexy.org/view/s216imwEb0" rel="nofollow">Francis writes in</a></li>
<li><a href="http://slexy.org/view/s2oc8vavWe" rel="nofollow">Frank writes in</a></li>
<li><a href="http://slexy.org/view/s20wL61sSr" rel="nofollow">Sean writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up on the show, we&#39;ll be showing you how to set up a secure, SSL-only webserver. There&#39;s also an interview with Eric Le Blan about community participation and FreeBSD&#39;s role in the commercial server space. All that and more, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://bsdly.blogspot.com/2014/08/password-gropers-take-spamtrap-bait.html" rel="nofollow">Password gropers take spamtrap bait</a></h3>

<ul>
<li>Our friend <a href="http://www.bsdnow.tv/episodes/2014_04_30-puffy_firewall" rel="nofollow">Peter Hansteen</a>, who keeps his eyes glued to his log files, has a new blog post</li>
<li>He seems to have discovered another new weird phenomenon in his pop3 logs</li>
<li>&quot;yes, I still run one, for the same bad reasons more than a third of my readers probably do: inertia&quot;</li>
<li>Someone tried to log in to his service with an address that was known to be invalid</li>
<li>The rest of the post goes into detail about his theory of why someone would use a list of invalid addresses for this purpose
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=WOcYTqoSQ68" rel="nofollow">Inside the Atheros wifi chipset</a></h3>

<ul>
<li>Adrian Chadd - sometimes known in the FreeBSD community as &quot;the wireless guy&quot; - gave a talk at the Defcon Wireless Village 2014</li>
<li>He covers a lot of topics on wifi, specifically on Atheros chips and why they&#39;re so popular for open source development</li>
<li>There&#39;s a lot of great information in the presentation, including cool (and evil) things you can do with wireless cards</li>
<li>Very technical talk; some parts might go over your head if you&#39;re not a driver developer</li>
<li>The raw video file is also available <a href="https://archive.org/download/WirelessVillageAtDefCon22/20-Atheros.mp4" rel="nofollow">to download</a> on archive.org</li>
<li>Adrian has also recently worked on getting Kismet and Aircrack-NG to work better with FreeBSD, including packet injection and other fun things
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/08/bsdcan-trip-report-mark-linimon.html" rel="nofollow">Trip report and hackathon mini-roundup</a></h3>

<ul>
<li>A few more (late) reports from BSDCan and the latest OpenBSD hackathon have been posted</li>
<li>Mark Linimon mentions some of the future plans for FreeBSD&#39;s release engineering and ports</li>
<li>Bapt <a href="http://freebsdfoundation.blogspot.com/2014/08/bsdcan-trip-report-baptiste-daroussin.html" rel="nofollow">also has a BSDCan report</a> detailing his work on ports and packages</li>
<li>Antoine Jacoutot <a href="http://undeadly.org/cgi?action=article&sid=20140812064946" rel="nofollow">writes about</a> his work at the most recent hackathon, working with rc configuration and a new /etc/examples layout</li>
<li>Peter Hessler, a latecomer to the hackathon, <a href="http://undeadly.org/cgi?action=article&sid=20140806125308" rel="nofollow">details his experience</a> too, hacking on the installer and built-in upgrade function</li>
<li>Christian Weisgerber <a href="http://undeadly.org/cgi?action=article&sid=20140803122705" rel="nofollow">talks about</a> starting some initial improvements of OpenBSD&#39;s ports infrastructure
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2014-August/270573.html" rel="nofollow">DragonFly BSD 3.8.2 released</a></h3>

<ul>
<li>Although it was already branched, the release media is now available for DragonFly 3.8.2</li>
<li>This is a minor update, mostly to fix the recent OpenSSL vulnerabilities</li>
<li>It also includes some various other small fixes
***</li>
</ul>

<h2>Interview - Eric Le Blan - <a href="mailto:info@xinuos.com" rel="nofollow">info@xinuos.com</a></h2>

<p>Xinuos&#39; recent FreeBSD integration, BSD in the commercial server space</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/nginx" rel="nofollow">Building a hardened, feature-rich webserver</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://networkfilter.blogspot.com/2014/08/defend-your-network-and-privacy-vpn.html" rel="nofollow">Defend your network and privacy, FreeBSD version</a></h3>

<ul>
<li>Back in <a href="http://www.bsdnow.tv/episodes/2014_05_28-the_friendly_sandbox" rel="nofollow">episode 39</a>, we covered a blog post about creating an OpenBSD gateway - partly based on <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">our tutorial</a></li>
<li>This is a follow-up post, by the same author, about doing a similar thing with FreeBSD</li>
<li>He mentions some of the advantages and disadvantages between the two operating systems, and encourages users to decide for themselves which one suits their needs</li>
<li>The rest is pretty much the same things: firewall, VPN, DHCP server, DNSCrypt, etc.
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/dont-encrypt-all-the-things" rel="nofollow">Don&#39;t encrypt all the things</a></h3>

<ul>
<li>Another couple of interesting blog posts from <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> about encryption</li>
<li>It talks about how Google recently started ranking sites with HTTPS higher in their search results, and then reflects on how sometimes encryption does more harm than good</li>
<li>After heartbleed, the ones who might be able to decrypt your emails went from just a three-letter agency to any script kiddie</li>
<li>He also talks a bit about some PGP weaknesses and a possible future replacement</li>
<li>He also has another, similar post entitled &quot;<a href="http://www.tedunangst.com/flak/post/in-defense-of-opportunistic-encryption" rel="nofollow">in defense of opportunistic encryption</a>&quot;
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=270096" rel="nofollow">New automounter lands in FreeBSD</a></h3>

<ul>
<li>The work on the new automounter has just landed in 11-CURRENT</li>
<li>With help from the FreeBSD Foundation, we&#39;ll have a new &quot;autofs&quot; kernel option</li>
<li>Check the SVN viewer online to read over the man pages if you&#39;re not running -CURRENT</li>
<li>You can also read a bit about it in the <a href="https://www.freebsdfoundation.org/press/2014jul-newsletter#Project3" rel="nofollow">recent newsletter</a>
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-August/032810.html" rel="nofollow">OpenSSH 6.7 CFT</a></h3>

<ul>
<li>It&#39;s been a little while since the last OpenSSH release, but 6.7 is almost ready</li>
<li>Our friend <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">Damien Miller</a> issued a call for testing for the upcoming version, which includes a fair amount of new features</li>
<li>It includes some old code removal, some new features and some internal reworkings - we&#39;ll cover the full list in detail when it&#39;s released</li>
<li>This version also officially supports being built with LibreSSL now</li>
<li>Help test it out and report any findings, especially if you have access to something a little more exotic than just a BSD system
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20yIP7VXa" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s2DeeUjAn6" rel="nofollow">Lachlan writes in</a></li>
<li><a href="http://slexy.org/view/s216imwEb0" rel="nofollow">Francis writes in</a></li>
<li><a href="http://slexy.org/view/s2oc8vavWe" rel="nofollow">Frank writes in</a></li>
<li><a href="http://slexy.org/view/s20wL61sSr" rel="nofollow">Sean writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>50: VPN, My Dear Watson</title>
  <link>https://www.bsdnow.tv/50</link>
  <guid isPermaLink="false">b0306dc5-ee87-4a03-aeea-9a89b915ff5e</guid>
  <pubDate>Wed, 13 Aug 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b0306dc5-ee87-4a03-aeea-9a89b915ff5e.mp3" length="62998996" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>It's our 50th episode, and we're going to show you how to protect your internet traffic with a BSD-based VPN. We'll also be talking to Robert Watson, of the FreeBSD core team, about security research, exploit mitigation and a whole lot more. The latest news and answers to all of your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:27:29</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>It's our 50th episode, and we're going to show you how to protect your internet traffic with a BSD-based VPN. We'll also be talking to Robert Watson, of the FreeBSD core team, about security research, exploit mitigation and a whole lot more. The latest news and answers to all of your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
MeetBSD 2014 is approaching (http://www.ixsystems.com/whats-new/ixsystems-to-host-meetbsd-california-2014-at-western-digital-in-san-jose/)
The MeetBSD conference is coming up, and will be held on November 1st and 2nd in San Jose, California
MeetBSD has an "unconference" format, which means there will be both planned talks and community events
All the extra details will be on their site (https://www.meetbsd.com/) soon
It also has hotels and various other bits of useful information - hopefully with more info on the talks to come
Of course, EuroBSDCon is coming up before then
***
First experiences with OpenBSD (https://www.azabani.com/2014/08/09/first-experiences-with-openbsd.html)
A new blog post that leads off with "tired of the sluggishness of Windows on my laptop and interested in experimenting with a Unix-like that I haven't tried before"
The author read the famous "BSD for Linux users (http://www.over-yonder.net/~fullermd/rants/bsd4linux/01)" series (that most of us have surely seen) and decided to give BSD a try
He details his different OS and distro history, concluding with how he "eventually became annoyed at the poor quality of Linux userland software"
From there, it talks about how he used the OpenBSD USB image and got a fully-working system
He especially liked the simplicity of OpenBSD's "hostname.if" system for network configuration
Finally, he gets Xorg working and imports all his usual configuration files - seems to be a happy new user! 
***
NetBSD rump kernels on bare metal (and Kansai OSC report) (https://blog.netbsd.org/tnf/entry/an_internet_ready_os_from)
When you're developing a new OS or a very specialized custom solution, working drivers become one of the hardest things to get right
However, NetBSD's rump kernels - a very unique concept - make this process a lot easier
This blog post talks about the process of starting with just a rump kernel and expanding into an internet-ready system in just a week
Also have a look back at episode 8 (http://www.bsdnow.tv/episodes/2013_10_23-a_brief_intorduction) for our interview about rump kernels and what exactly they do
While on the topic of NetBSD, there were also a couple of very detailed reports (http://mail-index.netbsd.org/netbsd-advocacy/2014/08/09/msg000658.html) (with lots of pictures!) of the various NetBSD-themed booths at the 2014 Kansai Open Source Conference (http://d.hatena.ne.jp/mizuno-as/20140806/1407307913) that we wanted to highlight
***
OpenSSL and LibreSSL updates (https://www.openssl.org/news/secadv_20140806.txt)
OpenSSL pushed out a few new versions, fixing multiple vulnerabilities (nine to be precise!)
Security concerns include leaking memory, possible denial of service, crashing clients, memory exhaustion, TLS downgrades and more
LibreSSL released a new version (http://marc.info/?l=openbsd-tech&amp;amp;m=140752295222929&amp;amp;w=2) to address most of the vulnerabilities, but wasn't affected by some of them
Whichever version of whatever SSL you use, make sure it's patched for these issues
DragonFly and OpenBSD are patched as of the time of this recording but, even after a week, NetBSD and FreeBSD are not (outside of -CURRENT)
***
Interview - Robert Watson - rwatson@freebsd.org (mailto:rwatson@freebsd.org)
FreeBSD architecture, security research techniques, exploit mitigation
Tutorial
Protecting traffic with a BSD-based VPN (http://www.bsdnow.tv/tutorials/openvpn)
News Roundup
A FreeBSD-based CGit server (https://lechindianer.de/blog/2014/08/06/freebsd-cgit/)
If you use git (like a certain host of this show) then you've probably considered setting up your own server
This article takes you through the process of setting up a jailed git server, complete with a fancy web frontend
It even shows you how to set up multiple repos with key-based user separation and other cool things
The author of the post is also a listener of the show, thanks for sending it in!
***
Backup devices for small businesses (http://www.smallbusinesscomputing.com/biztools/6-data-backup-devices-for-small-businesses.html)
In this article, different methods of data storage and backup are compared
After weighing the various options, the author comes to an obvious conclusion: FreeNAS is the answer
He praises FreeNAS and the FreeNAS Mini for their tight integration, rock solid FreeBSD base and the great ZFS featureset that it offers
It also goes over some of the hardware specifics in the FreeNAS Mini
***
A new Xenocara interview (http://blog.bronevichok.ru/2014/08/06/testing-of-xorg.html)
As a follow up to last week's OpenSMTPD interview, this Russian blog interviews Matthieu Herrb about Xenocara
If you're not familiar with Xenocara, it's OpenBSD's version of Xorg with some custom patches
In this interview, he discusses how large and complex the upstream X11 development is, how different components are worked on by different people, how they test code (including a new framework) and security auditing
Matthieu is both a developer of upstream Xorg and an OpenBSD developer, so it's natural for him to do a lot of the maintainership work there
***
Building a high performance FreeBSD samba server (https://not.burntout.org/blog/high_performance_samba_server_on_freebsd/)
If you've got to PXE boot several hundred Windows boxes to upgrade from XP to 7, what's the best solution?
FreeBSD, ZFS and Samba obviously!
The master image and related files clock in at over 20GB, and will be accessed at the same time by all of those clients
This article documents that process, highlighting some specific configuration tweaks to maximize performance (including NIC bonding)
It doesn't even require the newest or best hardware with the right changes, pretty cool
***
Feedback/Questions
An interesting Reddit thread (http://www.reddit.com/r/BSD/comments/2ctlt4/switched_from_arch_linux_to_openbsd_reference/) (or two (http://www.reddit.com/r/BSD/comments/2dcig9/thinking_about_coming_to_bsd_from_arch))
PB writes in (http://slexy.org/view/s21t7L5bqO)
Sean writes in (http://slexy.org/view/s20MFywDqZ)
Steve writes in (http://slexy.org/view/s2Td6nq11J)
Lachlan writes in (http://slexy.org/view/s215MlpJYV)
Justin writes in (http://slexy.org/view/s2N4JKkoKt)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, vpn, vps, openvpn, tunnel, ssh, security, exploit mitigation, zfs, lzo, tls, xenocara, x11, xorg, freenas, freenas mini, ixsystems, network attached storage, nas, meetbsd, rump kernels, libressl, openssl, kansai</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>It&#39;s our 50th episode, and we&#39;re going to show you how to protect your internet traffic with a BSD-based VPN. We&#39;ll also be talking to Robert Watson, of the FreeBSD core team, about security research, exploit mitigation and a whole lot more. The latest news and answers to all of your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.ixsystems.com/whats-new/ixsystems-to-host-meetbsd-california-2014-at-western-digital-in-san-jose/" rel="nofollow">MeetBSD 2014 is approaching</a></h3>

<ul>
<li>The MeetBSD conference is coming up, and will be held on November 1st and 2nd in San Jose, California</li>
<li>MeetBSD has an &quot;unconference&quot; format, which means there will be both planned talks and community events</li>
<li>All the extra details will be on <a href="https://www.meetbsd.com/" rel="nofollow">their site</a> soon</li>
<li>It also has hotels and various other bits of useful information - hopefully with more info on the talks to come</li>
<li>Of course, EuroBSDCon is coming up before then
***</li>
</ul>

<h3><a href="https://www.azabani.com/2014/08/09/first-experiences-with-openbsd.html" rel="nofollow">First experiences with OpenBSD</a></h3>

<ul>
<li>A new blog post that leads off with &quot;tired of the sluggishness of Windows on my laptop and interested in experimenting with a Unix-like that I haven&#39;t tried before&quot;</li>
<li>The author read the famous &quot;<a href="http://www.over-yonder.net/%7Efullermd/rants/bsd4linux/01" rel="nofollow">BSD for Linux users</a>&quot; series (that most of us have surely seen) and decided to give BSD a try</li>
<li>He details his different OS and distro history, concluding with how he &quot;eventually became annoyed at the poor quality of Linux userland software&quot;</li>
<li>From there, it talks about how he used the OpenBSD USB image and got a fully-working system</li>
<li>He especially liked the simplicity of OpenBSD&#39;s &quot;hostname.if&quot; system for network configuration</li>
<li>Finally, he gets Xorg working and imports all his usual configuration files - seems to be a happy new user! 
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/an_internet_ready_os_from" rel="nofollow">NetBSD rump kernels on bare metal (and Kansai OSC report)</a></h3>

<ul>
<li>When you&#39;re developing a new OS or a very specialized custom solution, working drivers become one of the hardest things to get right</li>
<li>However, NetBSD&#39;s rump kernels - a very unique concept - make this process a lot easier</li>
<li>This blog post talks about the process of starting with just a rump kernel and expanding into an internet-ready system in just a week</li>
<li>Also have a look back at <a href="http://www.bsdnow.tv/episodes/2013_10_23-a_brief_intorduction" rel="nofollow">episode 8</a> for our interview about rump kernels and what exactly they do</li>
<li>While on the topic of NetBSD, there were also a couple of <a href="http://mail-index.netbsd.org/netbsd-advocacy/2014/08/09/msg000658.html" rel="nofollow">very detailed reports</a> (with lots of pictures!) of the various NetBSD-themed booths at the 2014 <a href="http://d.hatena.ne.jp/mizuno-as/20140806/1407307913" rel="nofollow">Kansai Open Source Conference</a> that we wanted to highlight
***</li>
</ul>

<h3><a href="https://www.openssl.org/news/secadv_20140806.txt" rel="nofollow">OpenSSL and LibreSSL updates</a></h3>

<ul>
<li>OpenSSL pushed out a few new versions, fixing multiple vulnerabilities (nine to be precise!)</li>
<li>Security concerns include leaking memory, possible denial of service, crashing clients, memory exhaustion, TLS downgrades and more</li>
<li><a href="http://marc.info/?l=openbsd-tech&m=140752295222929&w=2" rel="nofollow">LibreSSL released a new version</a> to address most of the vulnerabilities, but wasn&#39;t affected by some of them</li>
<li>Whichever version of whatever SSL you use, make sure it&#39;s patched for these issues</li>
<li>DragonFly and OpenBSD are patched as of the time of this recording but, even after a week, NetBSD and FreeBSD are not (outside of -CURRENT)
***</li>
</ul>

<h2>Interview - Robert Watson - <a href="mailto:rwatson@freebsd.org" rel="nofollow">rwatson@freebsd.org</a></h2>

<p>FreeBSD architecture, security research techniques, exploit mitigation</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/openvpn" rel="nofollow">Protecting traffic with a BSD-based VPN</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lechindianer.de/blog/2014/08/06/freebsd-cgit/" rel="nofollow">A FreeBSD-based CGit server</a></h3>

<ul>
<li>If you use git (like a certain host of this show) then you&#39;ve probably considered setting up your own server</li>
<li>This article takes you through the process of setting up a jailed git server, complete with a fancy web frontend</li>
<li>It even shows you how to set up multiple repos with key-based user separation and other cool things</li>
<li>The author of the post is also a listener of the show, thanks for sending it in!
***</li>
</ul>

<h3><a href="http://www.smallbusinesscomputing.com/biztools/6-data-backup-devices-for-small-businesses.html" rel="nofollow">Backup devices for small businesses</a></h3>

<ul>
<li>In this article, different methods of data storage and backup are compared</li>
<li>After weighing the various options, the author comes to an obvious conclusion: FreeNAS is the answer</li>
<li>He praises FreeNAS and the FreeNAS Mini for their tight integration, rock solid FreeBSD base and the great ZFS featureset that it offers</li>
<li>It also goes over some of the hardware specifics in the FreeNAS Mini
***</li>
</ul>

<h3><a href="http://blog.bronevichok.ru/2014/08/06/testing-of-xorg.html" rel="nofollow">A new Xenocara interview</a></h3>

<ul>
<li>As a follow up to last week&#39;s OpenSMTPD interview, this Russian blog interviews Matthieu Herrb about Xenocara</li>
<li>If you&#39;re not familiar with Xenocara, it&#39;s OpenBSD&#39;s version of Xorg with some custom patches</li>
<li>In this interview, he discusses how large and complex the upstream X11 development is, how different components are worked on by different people, how they test code (including a new framework) and security auditing</li>
<li>Matthieu is both a developer of upstream Xorg and an OpenBSD developer, so it&#39;s natural for him to do a lot of the maintainership work there
***</li>
</ul>

<h3><a href="https://not.burntout.org/blog/high_performance_samba_server_on_freebsd/" rel="nofollow">Building a high performance FreeBSD samba server</a></h3>

<ul>
<li>If you&#39;ve got to PXE boot several hundred Windows boxes to upgrade from XP to 7, what&#39;s the best solution?</li>
<li>FreeBSD, ZFS and Samba obviously!</li>
<li>The master image and related files clock in at over 20GB, and will be accessed at the same time by <em>all</em> of those clients</li>
<li>This article documents that process, highlighting some specific configuration tweaks to maximize performance (including NIC bonding)</li>
<li>It doesn&#39;t even require the newest or best hardware with the right changes, pretty cool
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://www.reddit.com/r/BSD/comments/2ctlt4/switched_from_arch_linux_to_openbsd_reference/" rel="nofollow">An interesting Reddit thread</a> (<a href="http://www.reddit.com/r/BSD/comments/2dcig9/thinking_about_coming_to_bsd_from_arch" rel="nofollow">or two</a>)</li>
<li><a href="http://slexy.org/view/s21t7L5bqO" rel="nofollow">PB writes in</a></li>
<li><a href="http://slexy.org/view/s20MFywDqZ" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s2Td6nq11J" rel="nofollow">Steve writes in</a></li>
<li><a href="http://slexy.org/view/s215MlpJYV" rel="nofollow">Lachlan writes in</a></li>
<li><a href="http://slexy.org/view/s2N4JKkoKt" rel="nofollow">Justin writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>It&#39;s our 50th episode, and we&#39;re going to show you how to protect your internet traffic with a BSD-based VPN. We&#39;ll also be talking to Robert Watson, of the FreeBSD core team, about security research, exploit mitigation and a whole lot more. The latest news and answers to all of your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.ixsystems.com/whats-new/ixsystems-to-host-meetbsd-california-2014-at-western-digital-in-san-jose/" rel="nofollow">MeetBSD 2014 is approaching</a></h3>

<ul>
<li>The MeetBSD conference is coming up, and will be held on November 1st and 2nd in San Jose, California</li>
<li>MeetBSD has an &quot;unconference&quot; format, which means there will be both planned talks and community events</li>
<li>All the extra details will be on <a href="https://www.meetbsd.com/" rel="nofollow">their site</a> soon</li>
<li>It also has hotels and various other bits of useful information - hopefully with more info on the talks to come</li>
<li>Of course, EuroBSDCon is coming up before then
***</li>
</ul>

<h3><a href="https://www.azabani.com/2014/08/09/first-experiences-with-openbsd.html" rel="nofollow">First experiences with OpenBSD</a></h3>

<ul>
<li>A new blog post that leads off with &quot;tired of the sluggishness of Windows on my laptop and interested in experimenting with a Unix-like that I haven&#39;t tried before&quot;</li>
<li>The author read the famous &quot;<a href="http://www.over-yonder.net/%7Efullermd/rants/bsd4linux/01" rel="nofollow">BSD for Linux users</a>&quot; series (that most of us have surely seen) and decided to give BSD a try</li>
<li>He details his different OS and distro history, concluding with how he &quot;eventually became annoyed at the poor quality of Linux userland software&quot;</li>
<li>From there, it talks about how he used the OpenBSD USB image and got a fully-working system</li>
<li>He especially liked the simplicity of OpenBSD&#39;s &quot;hostname.if&quot; system for network configuration</li>
<li>Finally, he gets Xorg working and imports all his usual configuration files - seems to be a happy new user! 
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/an_internet_ready_os_from" rel="nofollow">NetBSD rump kernels on bare metal (and Kansai OSC report)</a></h3>

<ul>
<li>When you&#39;re developing a new OS or a very specialized custom solution, working drivers become one of the hardest things to get right</li>
<li>However, NetBSD&#39;s rump kernels - a very unique concept - make this process a lot easier</li>
<li>This blog post talks about the process of starting with just a rump kernel and expanding into an internet-ready system in just a week</li>
<li>Also have a look back at <a href="http://www.bsdnow.tv/episodes/2013_10_23-a_brief_intorduction" rel="nofollow">episode 8</a> for our interview about rump kernels and what exactly they do</li>
<li>While on the topic of NetBSD, there were also a couple of <a href="http://mail-index.netbsd.org/netbsd-advocacy/2014/08/09/msg000658.html" rel="nofollow">very detailed reports</a> (with lots of pictures!) of the various NetBSD-themed booths at the 2014 <a href="http://d.hatena.ne.jp/mizuno-as/20140806/1407307913" rel="nofollow">Kansai Open Source Conference</a> that we wanted to highlight
***</li>
</ul>

<h3><a href="https://www.openssl.org/news/secadv_20140806.txt" rel="nofollow">OpenSSL and LibreSSL updates</a></h3>

<ul>
<li>OpenSSL pushed out a few new versions, fixing multiple vulnerabilities (nine to be precise!)</li>
<li>Security concerns include leaking memory, possible denial of service, crashing clients, memory exhaustion, TLS downgrades and more</li>
<li><a href="http://marc.info/?l=openbsd-tech&m=140752295222929&w=2" rel="nofollow">LibreSSL released a new version</a> to address most of the vulnerabilities, but wasn&#39;t affected by some of them</li>
<li>Whichever version of whatever SSL you use, make sure it&#39;s patched for these issues</li>
<li>DragonFly and OpenBSD are patched as of the time of this recording but, even after a week, NetBSD and FreeBSD are not (outside of -CURRENT)
***</li>
</ul>

<h2>Interview - Robert Watson - <a href="mailto:rwatson@freebsd.org" rel="nofollow">rwatson@freebsd.org</a></h2>

<p>FreeBSD architecture, security research techniques, exploit mitigation</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/openvpn" rel="nofollow">Protecting traffic with a BSD-based VPN</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://lechindianer.de/blog/2014/08/06/freebsd-cgit/" rel="nofollow">A FreeBSD-based CGit server</a></h3>

<ul>
<li>If you use git (like a certain host of this show) then you&#39;ve probably considered setting up your own server</li>
<li>This article takes you through the process of setting up a jailed git server, complete with a fancy web frontend</li>
<li>It even shows you how to set up multiple repos with key-based user separation and other cool things</li>
<li>The author of the post is also a listener of the show, thanks for sending it in!
***</li>
</ul>

<h3><a href="http://www.smallbusinesscomputing.com/biztools/6-data-backup-devices-for-small-businesses.html" rel="nofollow">Backup devices for small businesses</a></h3>

<ul>
<li>In this article, different methods of data storage and backup are compared</li>
<li>After weighing the various options, the author comes to an obvious conclusion: FreeNAS is the answer</li>
<li>He praises FreeNAS and the FreeNAS Mini for their tight integration, rock solid FreeBSD base and the great ZFS featureset that it offers</li>
<li>It also goes over some of the hardware specifics in the FreeNAS Mini
***</li>
</ul>

<h3><a href="http://blog.bronevichok.ru/2014/08/06/testing-of-xorg.html" rel="nofollow">A new Xenocara interview</a></h3>

<ul>
<li>As a follow up to last week&#39;s OpenSMTPD interview, this Russian blog interviews Matthieu Herrb about Xenocara</li>
<li>If you&#39;re not familiar with Xenocara, it&#39;s OpenBSD&#39;s version of Xorg with some custom patches</li>
<li>In this interview, he discusses how large and complex the upstream X11 development is, how different components are worked on by different people, how they test code (including a new framework) and security auditing</li>
<li>Matthieu is both a developer of upstream Xorg and an OpenBSD developer, so it&#39;s natural for him to do a lot of the maintainership work there
***</li>
</ul>

<h3><a href="https://not.burntout.org/blog/high_performance_samba_server_on_freebsd/" rel="nofollow">Building a high performance FreeBSD samba server</a></h3>

<ul>
<li>If you&#39;ve got to PXE boot several hundred Windows boxes to upgrade from XP to 7, what&#39;s the best solution?</li>
<li>FreeBSD, ZFS and Samba obviously!</li>
<li>The master image and related files clock in at over 20GB, and will be accessed at the same time by <em>all</em> of those clients</li>
<li>This article documents that process, highlighting some specific configuration tweaks to maximize performance (including NIC bonding)</li>
<li>It doesn&#39;t even require the newest or best hardware with the right changes, pretty cool
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://www.reddit.com/r/BSD/comments/2ctlt4/switched_from_arch_linux_to_openbsd_reference/" rel="nofollow">An interesting Reddit thread</a> (<a href="http://www.reddit.com/r/BSD/comments/2dcig9/thinking_about_coming_to_bsd_from_arch" rel="nofollow">or two</a>)</li>
<li><a href="http://slexy.org/view/s21t7L5bqO" rel="nofollow">PB writes in</a></li>
<li><a href="http://slexy.org/view/s20MFywDqZ" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s2Td6nq11J" rel="nofollow">Steve writes in</a></li>
<li><a href="http://slexy.org/view/s215MlpJYV" rel="nofollow">Lachlan writes in</a></li>
<li><a href="http://slexy.org/view/s2N4JKkoKt" rel="nofollow">Justin writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>49: The PC-BSD Tour</title>
  <link>https://www.bsdnow.tv/49</link>
  <guid isPermaLink="false">ccc19842-ae62-43a9-8f82-44f3f281de42</guid>
  <pubDate>Wed, 06 Aug 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ccc19842-ae62-43a9-8f82-44f3f281de42.mp3" length="59661652" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week on the show, we've got something special for you! We'll be giving you an in-depth look at all of the graphical PC-BSD utilities. That's right, BSD doesn't have to be commandline-only anymore! There's also the usual round of answers to your emails and all the latest headlines, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:22:51</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week on the show, we've got something special for you! We'll be giving you an in-depth look at all of the graphical PC-BSD utilities. That's right, BSD doesn't have to be commandline-only anymore! There's also the usual round of answers to your emails and all the latest headlines, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD foundation semi-annual newsletter (https://www.freebsdfoundation.org/press/2014jul-newsletter)
The FreeBSD foundation published their semi-annual newsletter, complete with a letter from the president of the foundation
"In fact after reading [the president's] letter, I was motivated to come up with my own elevator pitch instead of the usual FreeBSD is like Linux, only better!"
It talks about the FreeBSD journal (http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates) as being one of the most exciting things they've launched this year, conferences they funded and various bits of sponsored code that went into -CURRENT
The full list of funded projects is included, also with details in the financial reports
There are also a number of conference wrap-ups: NYCBSDCon, BSDCan, AsiaBSDCon and details about the upcoming EuroBSDCon 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, intel nuc, nuc, gui, ssl, tls, libressl, openssl, foundation, bafug, talk, presentation, recording, bhyve, libvirt, rss, netmap, opensmtpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week on the show, we&#39;ve got something special for you! We&#39;ll be giving you an in-depth look at all of the graphical PC-BSD utilities. That&#39;s right, BSD doesn&#39;t have to be commandline-only anymore! There&#39;s also the usual round of answers to your emails and all the latest headlines, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/press/2014jul-newsletter" rel="nofollow">FreeBSD foundation semi-annual newsletter</a></h3>

<ul>
<li>The FreeBSD foundation published their semi-annual newsletter, complete with a letter from the president of the foundation</li>
<li>&quot;In fact after reading [the president&#39;s] letter, I was motivated to come up with my own elevator pitch instead of the usual FreeBSD is like Linux, only better!&quot;</li>
<li>It talks about the <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">FreeBSD journal</a> as being one of the most exciting things they&#39;ve launched this year, conferences they funded and various bits of sponsored code that went into -CURRENT</li>
<li>The full list of funded projects is included, also with details in the financial reports</li>
<li>There are also a number of conference wrap-ups: NYCBSDCon, BSDCan, AsiaBSDCon and details about the upcoming EuroBSDCon</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week on the show, we&#39;ve got something special for you! We&#39;ll be giving you an in-depth look at all of the graphical PC-BSD utilities. That&#39;s right, BSD doesn&#39;t have to be commandline-only anymore! There&#39;s also the usual round of answers to your emails and all the latest headlines, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsdfoundation.org/press/2014jul-newsletter" rel="nofollow">FreeBSD foundation semi-annual newsletter</a></h3>

<ul>
<li>The FreeBSD foundation published their semi-annual newsletter, complete with a letter from the president of the foundation</li>
<li>&quot;In fact after reading [the president&#39;s] letter, I was motivated to come up with my own elevator pitch instead of the usual FreeBSD is like Linux, only better!&quot;</li>
<li>It talks about the <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">FreeBSD journal</a> as being one of the most exciting things they&#39;ve launched this year, conferences they funded and various bits of sponsored code that went into -CURRENT</li>
<li>The full list of funded projects is included, also with details in the financial reports</li>
<li>There are also a number of conference wrap-ups: NYCBSDCon, BSDCan, AsiaBSDCon and details about the upcoming EuroBSDCon</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>48: Liberating SSL</title>
  <link>https://www.bsdnow.tv/48</link>
  <guid isPermaLink="false">e0c8ab6b-dd19-4778-8dc2-4b02bd2ae809</guid>
  <pubDate>Wed, 30 Jul 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e0c8ab6b-dd19-4778-8dc2-4b02bd2ae809.mp3" length="43106548" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up in this week's episode, we'll be talking with one of OpenBSD's newest developers - Brent Cook - about the portable version of LibreSSL and how it's developed. We've also got some information about the FreeBSD port of LibreSSL you might not know. The latest news and your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>59:52</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up in this week's episode, we'll be talking with one of OpenBSD's newest developers - Brent Cook - about the portable version of LibreSSL and how it's developed. We've also got some information about the FreeBSD port of LibreSSL you might not know. The latest news and your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD quarterly status report (https://www.freebsd.org/news/status/report-2014-04-2014-06.html)
FreeBSD has gotten quite a lot done this quarter
Changes in the way release branches are supported - major releases will get at least five years over their lifespan
A new automounter is in the works, hoping to replace amd (which has some issues)
The CAM target layer and RPC stack have gotten some major optimization and speed boosts
Work on ZFSGuru continues, with a large status report specifically for that
The report also mentioned some new committers, both source and ports
It also covers GNATS being replaced with Bugzilla, the new core team, 9.3-RELEASE, GSoC updates, UEFI booting and lots of other things that we've already mentioned on the show
"Foundation-sponsored work resulted in 226 commits to FreeBSD over the April to June period"
***
A new OpenBSD HTTPD is born (http://undeadly.org/cgi?action=article&amp;amp;sid=20140724094043)
Work has begun on a new HTTP daemon in the OpenBSD base system
A lot of people are asking (http://www.reddit.com/r/BSD/comments/2b7azm/openbsd_gets_its_own_http_server/) "why?" since OpenBSD includes a chrooted nginx already - will it be removed? Will they co-exist?
Initial responses seem to indicate that nginx is getting bloated, and is a bit overkill for just serving content (this isn't trying to be a full-featured replacement)
It's partially based on the relayd codebase and also comes from the author of relayd, Reyk Floeter
This has the added benefit of the usual, easy-to-understand syntax and privilege separation 
There's a very brief man page (http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/httpd.8) online already
It supports vhosts and can serve static files, but is still in very active development - there will probably be even more new features by the time this airs
Will it be named OpenHTTPD? Or perhaps... LibreHTTPD? (I hope not)
***
pkgng 1.3 announced (https://lists.freebsd.org/pipermail/freebsd-ports-announce/2014-July/000084.html)
The newest version of FreeBSD's second generation package management system (http://www.bsdnow.tv/tutorials/pkgng) has been released, with lots of new features
It has a new "real" solver to automatically handle conflicts, and dynamically discover new ones (this means the annoying -o option is deprecated now, hooray!)
Lots of the code has been sandboxed for extra security
You'll probably notice some new changes to the UI too, making things more user friendly
A few days later 1.3.1 (https://svnweb.freebsd.org/ports?view=revision&amp;amp;sortby=date&amp;amp;revision=362996) was released to fix a few small bugs, then 1.3.2 (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=363108) shortly thereafter and 1.3.3 (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=363363) yesterday
***
FreeBSD after-install security tasks (http://twisteddaemon.com/post/92921205276/freebsd-installed-your-next-five-moves-should-be)
A number of people have written in to ask us "how do I secure my BSD box after I install it?"
With this blog post, hopefully most of their questions will finally be answered in detail
It goes through locking down SSH with keys, patching the base system for security, installing packages and keeping them updated, monitoring and closing any listening services and a few other small things
Not only does it just list things to do, but the post also does a good job of explaining why you should do them
Maybe we'll see some more posts in this series in the future
***
Interview - Brent Cook - bcook@openbsd.org (mailto:bcook@openbsd.org) / @busterbcook (https://twitter.com/busterbcook)
LibreSSL's portable version and development
News Roundup
FreeBSD Mastery - Storage Essentials (https://www.tiltedwindmillpress.com/?product=freebsd-mastery-storage-essentials)
MWL (http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop)'s new book about the FreeBSD storage subsystems now has an early draft available
Early buyers can get access to an in-progress draft of the book before the official release, but keep in mind that it may go through a lot of changes
Topics of the book will include GEOM, UFS, ZFS, the disk utilities, partition schemes, disk encryption and maximizing I/O performance
You'll get access to the completed (e)book when it's done if you buy the early draft
The suggested price is $8
***
Why BSD and not Linux? (http://www.reddit.com/r/BSD/comments/2buea5/why_bsd_and_not_linux_or_why_linux_and_not_bsd/)
Yet another thread comes up asking why you should choose BSD over Linux or vice-versa
Lots of good responses from users of the various BSDs
Directly ripping a quote: "Features like Ports, Capsicum, CARP, ZFS and DTrace were stable on BSDs before their Linux versions, and some of those are far more usable on BSD. Features like pf are still BSD-only. FreeBSD has GELI and ipfw and is "GCC free". DragonflyBSD has HAMMER and kernel performance tuning. OpenBSD have upstream pf and their gamut of security features, as well as a general emphasis on simplicity."
And "Over the years, the BSDs have clearly shown their worth in the nix ecosystem by pioneering new features and driving adoption of others. The most recent on OpenBSD were 2038 support and LibreSSL. FreeBSD still arguably rules the FOSS storage space with ZFS."
Some other users share their switching experiences - worth a read
***
More g2k14 hackathon reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20140724161550)
Following up from last week's huge list (http://www.bsdnow.tv/episodes/2014_07_23-des_challenge_iv) of hackathon reports, we have a few more
Landry Breuil (http://undeadly.org/cgi?action=article&amp;amp;sid=20140724161550) spent some time with Ansible testing his infrastructure, worked on the firefox port and tried to push some of their patches upstream
Andrew Fresh (http://undeadly.org/cgi?action=article&amp;amp;sid=20140728122850) enjoyed his first hackathon, pushing OpenBSD's perl patches upstream and got tricked into rewriting the adduser utility in perl
Ted Unangst (http://undeadly.org/cgi?action=article&amp;amp;sid=20140729070721) did his usual "teduing" (removing of) old code - say goodbye to asa, fpr, mkstr, xstr, oldrdist, fsplit, uyap and bluetooth
Luckily we didn't have to cover 20 new ones this time!
***
BSDTalk episode 243 (http://bsdtalk.blogspot.com/2014/07/mandoc-with-ingo-schwarze.html)
The newest episode of BSDTalk (http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk) is out, featuring an interview with Ingo Schwarze of the OpenBSD team
The main topic of discussion is mandoc, which some users might not be familiar with
mandoc is a utility for formatting manpages that OpenBSD and NetBSD use (DragonFlyBSD and FreeBSD include it in their source tree, but it's not built by default)
We'll catch up to you soon, Will!
***
Feedback/Questions
Thomas writes in (http://slexy.org/view/s2xLRQytAZ)
Stephen writes in (http://slexy.org/view/s21AYng20n)
Sha'ul writes in (http://slexy.org/view/s2DwLRdQDS)
Florian writes in (http://slexy.org/view/s2E05L31BC)
Bob Beck writes in (http://slexy.org/view/s21Nmg3Jrk) - and note the "Caution" section that was added to libressl.org (http://www.libressl.org/)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, openssl, libressl, portable, openssh, security, linux, arc4random, intrinsic functions, rng, prng, status report, pkgng, openhttpd, relayd, httpd, web server, zfsguru, zfs, freebsd mastery, book, storage, ufs, geom, disks, presentation, talk, comparison, mandoc</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up in this week&#39;s episode, we&#39;ll be talking with one of OpenBSD&#39;s newest developers - Brent Cook - about the portable version of LibreSSL and how it&#39;s developed. We&#39;ve also got some information about the FreeBSD port of LibreSSL you might not know. The latest news and your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2014-04-2014-06.html" rel="nofollow">FreeBSD quarterly status report</a></h3>

<ul>
<li>FreeBSD has gotten quite a lot done this quarter</li>
<li>Changes in the way release branches are supported - major releases will get at least five years over their lifespan</li>
<li>A new automounter is in the works, hoping to replace amd (which has some issues)</li>
<li>The CAM target layer and RPC stack have gotten some major optimization and speed boosts</li>
<li>Work on ZFSGuru continues, with a large status report specifically for that</li>
<li>The report also mentioned some new committers, both source and ports</li>
<li>It also covers GNATS being replaced with Bugzilla, the new core team, 9.3-RELEASE, GSoC updates, UEFI booting and lots of other things that we&#39;ve already mentioned on the show</li>
<li>&quot;Foundation-sponsored work resulted in <strong>226 commits</strong> to FreeBSD over the April to June period&quot;
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140724094043" rel="nofollow">A new OpenBSD HTTPD is born</a></h3>

<ul>
<li>Work has begun on a new HTTP daemon in the OpenBSD base system</li>
<li>A lot of people are <a href="http://www.reddit.com/r/BSD/comments/2b7azm/openbsd_gets_its_own_http_server/" rel="nofollow">asking</a> &quot;why?&quot; since OpenBSD includes a chrooted nginx already - will it be removed? Will they co-exist?</li>
<li>Initial responses seem to indicate that nginx is getting bloated, and is a bit overkill for just serving content (this isn&#39;t trying to be a full-featured replacement)</li>
<li>It&#39;s partially based on the relayd codebase and also comes from the author of relayd, Reyk Floeter</li>
<li>This has the added benefit of the usual, easy-to-understand syntax and privilege separation </li>
<li>There&#39;s a very brief <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/httpd.8" rel="nofollow">man page</a> online already</li>
<li>It supports vhosts and can serve static files, but is still in very active development - there will probably be even more new features by the time this airs</li>
<li>Will it be named OpenHTTPD? Or perhaps... LibreHTTPD? (I hope not)
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-ports-announce/2014-July/000084.html" rel="nofollow">pkgng 1.3 announced</a></h3>

<ul>
<li>The newest version of FreeBSD&#39;s second generation <a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">package management system</a> has been released, with lots of new features</li>
<li>It has a new &quot;real&quot; solver to automatically handle conflicts, and dynamically discover new ones (this means the annoying -o option is deprecated now, hooray!)</li>
<li>Lots of the code has been sandboxed for extra security</li>
<li>You&#39;ll probably notice some new changes to the UI too, making things more user friendly</li>
<li>A few days later <a href="https://svnweb.freebsd.org/ports?view=revision&sortby=date&revision=362996" rel="nofollow">1.3.1</a> was released to fix a few small bugs, then <a href="https://svnweb.freebsd.org/ports?view=revision&revision=363108" rel="nofollow">1.3.2</a> shortly thereafter and <a href="https://svnweb.freebsd.org/ports?view=revision&revision=363363" rel="nofollow">1.3.3</a> yesterday
***</li>
</ul>

<h3><a href="http://twisteddaemon.com/post/92921205276/freebsd-installed-your-next-five-moves-should-be" rel="nofollow">FreeBSD after-install security tasks</a></h3>

<ul>
<li>A number of people have written in to ask us &quot;how do I secure my BSD box after I install it?&quot;</li>
<li>With this blog post, hopefully most of their questions will finally be answered in detail</li>
<li>It goes through locking down SSH with keys, patching the base system for security, installing packages and keeping them updated, monitoring and closing any listening services and a few other small things</li>
<li>Not only does it just list things to do, but the post also does a good job of explaining why you should do them</li>
<li>Maybe we&#39;ll see some more posts in this series in the future
***</li>
</ul>

<h2>Interview - Brent Cook - <a href="mailto:bcook@openbsd.org" rel="nofollow">bcook@openbsd.org</a> / <a href="https://twitter.com/busterbcook" rel="nofollow">@busterbcook</a></h2>

<p>LibreSSL&#39;s portable version and development</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.tiltedwindmillpress.com/?product=freebsd-mastery-storage-essentials" rel="nofollow">FreeBSD Mastery - Storage Essentials</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">MWL</a>&#39;s new book about the FreeBSD storage subsystems now has an early draft available</li>
<li>Early buyers can get access to an in-progress draft of the book before the official release, but keep in mind that it may go through a lot of changes</li>
<li>Topics of the book will include GEOM, UFS, ZFS, the disk utilities, partition schemes, disk encryption and maximizing I/O performance</li>
<li>You&#39;ll get access to the completed (e)book when it&#39;s done if you buy the early draft</li>
<li>The suggested price is $8
***</li>
</ul>

<h3><a href="http://www.reddit.com/r/BSD/comments/2buea5/why_bsd_and_not_linux_or_why_linux_and_not_bsd/" rel="nofollow">Why BSD and not Linux?</a></h3>

<ul>
<li>Yet another thread comes up asking why you should choose BSD over Linux or vice-versa</li>
<li>Lots of good responses from users of the various BSDs</li>
<li>Directly ripping a quote: &quot;Features like Ports, Capsicum, CARP, ZFS and DTrace were stable on BSDs before their Linux versions, and some of those are far more usable on BSD. Features like pf are still BSD-only. FreeBSD has GELI and ipfw and is &quot;GCC free&quot;. DragonflyBSD has HAMMER and kernel performance tuning. OpenBSD have upstream pf and their gamut of security features, as well as a general emphasis on simplicity.&quot;</li>
<li>And &quot;Over the years, the BSDs have clearly shown their worth in the nix ecosystem by pioneering new features and driving adoption of others. The most recent on OpenBSD were 2038 support and LibreSSL. FreeBSD still arguably rules the FOSS storage space with ZFS.&quot;</li>
<li>Some other users share their switching experiences - worth a read
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140724161550" rel="nofollow">More g2k14 hackathon reports</a></h3>

<ul>
<li>Following up from last week&#39;s <a href="http://www.bsdnow.tv/episodes/2014_07_23-des_challenge_iv" rel="nofollow">huge list</a> of hackathon reports, we have a few more</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140724161550" rel="nofollow">Landry Breuil</a> spent some time with Ansible testing his infrastructure, worked on the firefox port and tried to push some of their patches upstream</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140728122850" rel="nofollow">Andrew Fresh</a> enjoyed his first hackathon, pushing OpenBSD&#39;s perl patches upstream and got tricked into rewriting the adduser utility in perl</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140729070721" rel="nofollow">Ted Unangst</a> did his usual &quot;teduing&quot; (removing of) old code - say goodbye to asa, fpr, mkstr, xstr, oldrdist, fsplit, uyap and bluetooth</li>
<li>Luckily we didn&#39;t have to cover 20 new ones this time!
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2014/07/mandoc-with-ingo-schwarze.html" rel="nofollow">BSDTalk episode 243</a></h3>

<ul>
<li>The newest episode of <a href="http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk" rel="nofollow">BSDTalk</a> is out, featuring an interview with Ingo Schwarze of the OpenBSD team</li>
<li>The main topic of discussion is mandoc, which some users might not be familiar with</li>
<li>mandoc is a utility for formatting manpages that OpenBSD and NetBSD use (DragonFlyBSD and FreeBSD include it in their source tree, but it&#39;s not built by default)</li>
<li>We&#39;ll catch up to you soon, Will!
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2xLRQytAZ" rel="nofollow">Thomas writes in</a></li>
<li><a href="http://slexy.org/view/s21AYng20n" rel="nofollow">Stephen writes in</a></li>
<li><a href="http://slexy.org/view/s2DwLRdQDS" rel="nofollow">Sha&#39;ul writes in</a></li>
<li><a href="http://slexy.org/view/s2E05L31BC" rel="nofollow">Florian writes in</a></li>
<li><a href="http://slexy.org/view/s21Nmg3Jrk" rel="nofollow">Bob Beck writes in</a> - and note the &quot;Caution&quot; section that was added to <a href="http://www.libressl.org/" rel="nofollow">libressl.org</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up in this week&#39;s episode, we&#39;ll be talking with one of OpenBSD&#39;s newest developers - Brent Cook - about the portable version of LibreSSL and how it&#39;s developed. We&#39;ve also got some information about the FreeBSD port of LibreSSL you might not know. The latest news and your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/news/status/report-2014-04-2014-06.html" rel="nofollow">FreeBSD quarterly status report</a></h3>

<ul>
<li>FreeBSD has gotten quite a lot done this quarter</li>
<li>Changes in the way release branches are supported - major releases will get at least five years over their lifespan</li>
<li>A new automounter is in the works, hoping to replace amd (which has some issues)</li>
<li>The CAM target layer and RPC stack have gotten some major optimization and speed boosts</li>
<li>Work on ZFSGuru continues, with a large status report specifically for that</li>
<li>The report also mentioned some new committers, both source and ports</li>
<li>It also covers GNATS being replaced with Bugzilla, the new core team, 9.3-RELEASE, GSoC updates, UEFI booting and lots of other things that we&#39;ve already mentioned on the show</li>
<li>&quot;Foundation-sponsored work resulted in <strong>226 commits</strong> to FreeBSD over the April to June period&quot;
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140724094043" rel="nofollow">A new OpenBSD HTTPD is born</a></h3>

<ul>
<li>Work has begun on a new HTTP daemon in the OpenBSD base system</li>
<li>A lot of people are <a href="http://www.reddit.com/r/BSD/comments/2b7azm/openbsd_gets_its_own_http_server/" rel="nofollow">asking</a> &quot;why?&quot; since OpenBSD includes a chrooted nginx already - will it be removed? Will they co-exist?</li>
<li>Initial responses seem to indicate that nginx is getting bloated, and is a bit overkill for just serving content (this isn&#39;t trying to be a full-featured replacement)</li>
<li>It&#39;s partially based on the relayd codebase and also comes from the author of relayd, Reyk Floeter</li>
<li>This has the added benefit of the usual, easy-to-understand syntax and privilege separation </li>
<li>There&#39;s a very brief <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/httpd.8" rel="nofollow">man page</a> online already</li>
<li>It supports vhosts and can serve static files, but is still in very active development - there will probably be even more new features by the time this airs</li>
<li>Will it be named OpenHTTPD? Or perhaps... LibreHTTPD? (I hope not)
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-ports-announce/2014-July/000084.html" rel="nofollow">pkgng 1.3 announced</a></h3>

<ul>
<li>The newest version of FreeBSD&#39;s second generation <a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">package management system</a> has been released, with lots of new features</li>
<li>It has a new &quot;real&quot; solver to automatically handle conflicts, and dynamically discover new ones (this means the annoying -o option is deprecated now, hooray!)</li>
<li>Lots of the code has been sandboxed for extra security</li>
<li>You&#39;ll probably notice some new changes to the UI too, making things more user friendly</li>
<li>A few days later <a href="https://svnweb.freebsd.org/ports?view=revision&sortby=date&revision=362996" rel="nofollow">1.3.1</a> was released to fix a few small bugs, then <a href="https://svnweb.freebsd.org/ports?view=revision&revision=363108" rel="nofollow">1.3.2</a> shortly thereafter and <a href="https://svnweb.freebsd.org/ports?view=revision&revision=363363" rel="nofollow">1.3.3</a> yesterday
***</li>
</ul>

<h3><a href="http://twisteddaemon.com/post/92921205276/freebsd-installed-your-next-five-moves-should-be" rel="nofollow">FreeBSD after-install security tasks</a></h3>

<ul>
<li>A number of people have written in to ask us &quot;how do I secure my BSD box after I install it?&quot;</li>
<li>With this blog post, hopefully most of their questions will finally be answered in detail</li>
<li>It goes through locking down SSH with keys, patching the base system for security, installing packages and keeping them updated, monitoring and closing any listening services and a few other small things</li>
<li>Not only does it just list things to do, but the post also does a good job of explaining why you should do them</li>
<li>Maybe we&#39;ll see some more posts in this series in the future
***</li>
</ul>

<h2>Interview - Brent Cook - <a href="mailto:bcook@openbsd.org" rel="nofollow">bcook@openbsd.org</a> / <a href="https://twitter.com/busterbcook" rel="nofollow">@busterbcook</a></h2>

<p>LibreSSL&#39;s portable version and development</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.tiltedwindmillpress.com/?product=freebsd-mastery-storage-essentials" rel="nofollow">FreeBSD Mastery - Storage Essentials</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">MWL</a>&#39;s new book about the FreeBSD storage subsystems now has an early draft available</li>
<li>Early buyers can get access to an in-progress draft of the book before the official release, but keep in mind that it may go through a lot of changes</li>
<li>Topics of the book will include GEOM, UFS, ZFS, the disk utilities, partition schemes, disk encryption and maximizing I/O performance</li>
<li>You&#39;ll get access to the completed (e)book when it&#39;s done if you buy the early draft</li>
<li>The suggested price is $8
***</li>
</ul>

<h3><a href="http://www.reddit.com/r/BSD/comments/2buea5/why_bsd_and_not_linux_or_why_linux_and_not_bsd/" rel="nofollow">Why BSD and not Linux?</a></h3>

<ul>
<li>Yet another thread comes up asking why you should choose BSD over Linux or vice-versa</li>
<li>Lots of good responses from users of the various BSDs</li>
<li>Directly ripping a quote: &quot;Features like Ports, Capsicum, CARP, ZFS and DTrace were stable on BSDs before their Linux versions, and some of those are far more usable on BSD. Features like pf are still BSD-only. FreeBSD has GELI and ipfw and is &quot;GCC free&quot;. DragonflyBSD has HAMMER and kernel performance tuning. OpenBSD have upstream pf and their gamut of security features, as well as a general emphasis on simplicity.&quot;</li>
<li>And &quot;Over the years, the BSDs have clearly shown their worth in the nix ecosystem by pioneering new features and driving adoption of others. The most recent on OpenBSD were 2038 support and LibreSSL. FreeBSD still arguably rules the FOSS storage space with ZFS.&quot;</li>
<li>Some other users share their switching experiences - worth a read
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140724161550" rel="nofollow">More g2k14 hackathon reports</a></h3>

<ul>
<li>Following up from last week&#39;s <a href="http://www.bsdnow.tv/episodes/2014_07_23-des_challenge_iv" rel="nofollow">huge list</a> of hackathon reports, we have a few more</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140724161550" rel="nofollow">Landry Breuil</a> spent some time with Ansible testing his infrastructure, worked on the firefox port and tried to push some of their patches upstream</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140728122850" rel="nofollow">Andrew Fresh</a> enjoyed his first hackathon, pushing OpenBSD&#39;s perl patches upstream and got tricked into rewriting the adduser utility in perl</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140729070721" rel="nofollow">Ted Unangst</a> did his usual &quot;teduing&quot; (removing of) old code - say goodbye to asa, fpr, mkstr, xstr, oldrdist, fsplit, uyap and bluetooth</li>
<li>Luckily we didn&#39;t have to cover 20 new ones this time!
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2014/07/mandoc-with-ingo-schwarze.html" rel="nofollow">BSDTalk episode 243</a></h3>

<ul>
<li>The newest episode of <a href="http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk" rel="nofollow">BSDTalk</a> is out, featuring an interview with Ingo Schwarze of the OpenBSD team</li>
<li>The main topic of discussion is mandoc, which some users might not be familiar with</li>
<li>mandoc is a utility for formatting manpages that OpenBSD and NetBSD use (DragonFlyBSD and FreeBSD include it in their source tree, but it&#39;s not built by default)</li>
<li>We&#39;ll catch up to you soon, Will!
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2xLRQytAZ" rel="nofollow">Thomas writes in</a></li>
<li><a href="http://slexy.org/view/s21AYng20n" rel="nofollow">Stephen writes in</a></li>
<li><a href="http://slexy.org/view/s2DwLRdQDS" rel="nofollow">Sha&#39;ul writes in</a></li>
<li><a href="http://slexy.org/view/s2E05L31BC" rel="nofollow">Florian writes in</a></li>
<li><a href="http://slexy.org/view/s21Nmg3Jrk" rel="nofollow">Bob Beck writes in</a> - and note the &quot;Caution&quot; section that was added to <a href="http://www.libressl.org/" rel="nofollow">libressl.org</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>47: DES Challenge IV</title>
  <link>https://www.bsdnow.tv/47</link>
  <guid isPermaLink="false">2c9f4e68-6474-41f9-ab80-bb40fbb76855</guid>
  <pubDate>Wed, 23 Jul 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2c9f4e68-6474-41f9-ab80-bb40fbb76855.mp3" length="66811828" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week on the show! We've got an interview with Dag-Erling Smørgrav, the current security officer of FreeBSD, to discuss what exactly being in such an important position is like. The latest news, answers to your emails and even some LibreSSL drama, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:32:47</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week on the show! We've got an interview with Dag-Erling Smørgrav, the current security officer of FreeBSD, to discuss what exactly being in such an important position is like. The latest news, answers to your emails and even some LibreSSL drama, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
g2k14 hackathon reports (http://www.openbsd.org/hackathons.html)
Nearly 50 OpenBSD developers gathered in Ljubljana, Slovenia from July 8-14 for a hackathon
Lots of work got done - in just the first two weeks of July, there were over 1000 commits (http://marc.info/?l=openbsd-cvs&amp;amp;r=1&amp;amp;b=201407&amp;amp;w=2) to their CVS tree
Some of the developers wrote in to document what they were up to at the event
Bob Beck (http://undeadly.org/cgi?action=article&amp;amp;sid=20140713220618) planned to work on kernel stuff, but then "LibreSSL happened" and he spent most of his time working on that
Miod Vallat (http://undeadly.org/cgi?action=article&amp;amp;sid=20140718072312) also tells about his LibreSSL experiences
Brent Cook (http://undeadly.org/cgi?action=article&amp;amp;sid=20140718090456), a new developer, worked mainly on the portable version of LibreSSL (and we'll be interviewing him next week!)
Henning Brauer (http://undeadly.org/cgi?action=article&amp;amp;sid=20140714094454) worked on VLAN bpf and various things related to IPv6 and network interfaces (and he still hates IPv6)
Martin Pieuchot (http://undeadly.org/cgi?action=article&amp;amp;sid=20140714191912) fixed some bugs in the USB stack, softraid and misc other things
Marc Espie (http://undeadly.org/cgi?action=article&amp;amp;sid=20140714202157) improved the package code, enabling some speed ups, fixed some ports that broke with LibreSSL and some of the new changes and also did some work on ensuring snapshot consistency
Martin Pelikan (http://undeadly.org/cgi?action=article&amp;amp;sid=20140715120259) integrated read-only ext4 support
Vadim Zhukov (http://undeadly.org/cgi?action=article&amp;amp;sid=20140715094848) did lots of ports work, including working on KDE4
Theo de Raadt (http://undeadly.org/cgi?action=article&amp;amp;sid=20140715212333) created a new, more secure system call, "sendsyslog" and did a lot of work with /etc, sysmerge and the rc scripts
Paul Irofti (http://undeadly.org/cgi?action=article&amp;amp;sid=20140718134017) worked on the USB stack, specifically for the Octeon platform
Sebastian Benoit (http://undeadly.org/cgi?action=article&amp;amp;sid=20140719104939) worked on relayd filters and IPv6 code
Jasper Lievisse Adriaanse (http://undeadly.org/cgi?action=article&amp;amp;sid=20140719134058) did work with puppet, packages and the bootloader
Jonathan Gray (http://undeadly.org/cgi?action=article&amp;amp;sid=20140719082410) imported newer Mesa libraries and did a lot with Xenocara, including work in the installer for autodetection
Stefan Sperling (http://undeadly.org/cgi?action=article&amp;amp;sid=20140721125235) fixed a lot of issues with wireless drivers
Florian Obser (http://undeadly.org/cgi?action=article&amp;amp;sid=20140721125020) did many things related to IPv6
Ingo Schwarze (http://undeadly.org/cgi?action=article&amp;amp;sid=20140721090411) worked on mandoc, as usual, and also rewrote the openbsd.org man.cgi interface
Ken Westerback (http://undeadly.org/cgi?action=article&amp;amp;sid=20140722071413) hacked on dhclient and dhcpd, and also got dump working on 4k sector drives
Matthieu Herrb (http://undeadly.org/cgi?action=article&amp;amp;sid=20140723142224) worked on updating and modernizing parts of xenocara
***
FreeBSD pf discussion takes off (https://lists.freebsd.org/pipermail/freebsd-questions/2014-July/259292.html)
Concerns from last week, about FreeBSD's packet filter being old and unmaintained, seemed to have finally sparked some conversation about the topic on the "questions" and "current" mailing lists (unfortunately people didn't always use reply-all so you have to cross-reference the two lists to follow the whole conversation sometimes)
Straight from the SMP FreeBSD pf maintainer: "no one right now [is actively developing pf on FreeBSD]"
Searching for documentation online for pf is troublesome because there are two incompatible syntaxes
FreeBSD's pf man pages are lacking, and some of FreeBSD's documentation still links to OpenBSD's pages, which won't work anymore - possibly turning away would-be BSD converts because it's frustrating
There's also the issue of importing patches from pfSense, but most of those still haven't been done either
Lots of disagreement among developers vs. users...
Many users are very vocal about wanting it updated, saying the syntax change is no big deal and is worth the benefits - developers aren't interested
Henning Brauer, the main developer of pf on OpenBSD, has been very nice and offered to help the other BSDs get their pf fixed on multiple occasions
Gleb Smirnoff, author of the FreeBSD-specific SMP patches, questions Henning's claims about OpenBSD's improved speed as "uncorroborated claims" (but neither side has provided any public benchmarks)
Gleb had to abandon his work on FreeBSD's pf because funding ran out
***
LibreSSL progress update (http://linux.slashdot.org/story/14/07/16/1950235/libressl-prng-vulnerability-patched)
LibreSSL's first few portable releases have come out and they're making great progress, releasing 2.0.3 two days ago (http://marc.info/?l=openbsd-tech&amp;amp;m=140599450206255&amp;amp;w=2)
Lots of non-OpenBSD people are starting to contribute, sending in patches via the tech mailing list
However, there has already been some drama... with Linux users
There was a problem with Linux's PRNG, and LibreSSL was unforgiving (https://twitter.com/MiodVallat/status/489122763610021888) of it, not making an effort to randomize something that could not provide real entropy
This "problem" doesn't affect OpenBSD's native implementation, only the portable version
The developers (http://www.securityweek.com/openbsd-downplays-prng-vulnerability-libressl) decide to weigh in (http://www.tedunangst.com/flak/post/wrapping-pids-for-fun-and-profit) to calm the misinformation and rage
A fix was added in 2.0.2, and Linux may even get a new system call (http://thread.gmane.org/gmane.linux.kernel.cryptoapi/11666) to handle this properly now - remember to say thanks, guys
Ted Unangst (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures) has a really good post (http://www.tedunangst.com/flak/post/this-is-why-software-sucks) about the whole situation, definitely check it out
As a follow-up from last week, bapt says they're working on building the whole FreeBSD ports tree against LibreSSL, but lots of things still need some patching to work properly - if you're a port maintainer, please test your ports against it
***
Preparation for NetBSD 7 (http://mail-index.netbsd.org/current-users/2014/07/13/msg025234.html)
The release process for NetBSD 7.0 is finally underway
The netbsd-7 CVS branch should be created around July 26th, which marks the start of the first beta period, which will be lasting until September
If you run NetBSD, that'll be a great time to help test on as many platforms as you can (this is especially true on custom embedded applications)
They're also looking for some help updating documentation and fixing any bugs that get reported
Another formal announcement will be made when the beta binaries are up
***
Interview - Dag-Erling Smørgrav - des@freebsd.org (mailto:des@freebsd.org) / @RealEvilDES (https://twitter.com/RealEvilDES)
The role of the FreeBSD Security Officer, recent ports features, various topics
News Roundup
BSDCan ports and packages WG (http://blogs.freebsdish.org/portmgr/2014/07/18/bsdcan-2014-ports-and-packages-wg/)
Back at BSDCan this year, there was a special event for discussion of FreeBSD ports and packages
Bapt talked about package building, poudriere and the systems the foundation funded for compiling packages
There's also some detail about the signing infrastructure and different mirrors
Ports people and source people need to talk more often about ABI breakage
The post also includes information about pkg 1.3, the old pkg tools' EOL, the quarterly stable package sets and a lot more (it's a huge post!)
***
Cross-compiling ports with QEMU and poudriere (http://blog.ignoranthack.me/?p=212)
With recent QEMU features, you can basically chroot into a completely different architecture
This article goes through the process of building ARMv6 packages on a normal X86 box
Note though that this requires 10-STABLE or 11-CURRENT and an extra patch for QEMU right now
The poudriere-devel port now has a "qemu user" option that will pull in all the requirements
Hopefully this will pave the way for official pkgng packages on those lesser-used architectures
***
Cloning FreeBSD with ZFS send (http://blather.michaelwlucas.com/archives/2108)
For a FreeBSD mail server that MWL runs, he wanted to have a way to easily restore the whole system if something were to happen
This post shows his entire process in creating a mirror machine, using ZFS for everything
The "zfs send" and "zfs snapshot" commands really come in handy for this
He does the whole thing from a live CD, pretty impressive
***
FreeBSD Overview series (http://thiagoperrotta.wordpress.com/2014/07/20/here-be-dragons-freebsd-overview-part-i/)
A new blog series we stumbled upon about a Linux user switching to BSD
In part one, he gives a little background on being "done with Linux distros" and documents his initial experience getting and installing FreeBSD 10
He was pleasantly surprised to be able to use ZFS without jumping through hoops and doing custom kernels
Most of what he was used to on Linux was already in the default FreeBSD (except bash...)
Part two (http://thiagoperrotta.wordpress.com/2014/07/21/here-be-packages-freebsd-overview-part-ii/) documents his experiences with pkgng and ports 
***
Feedback/Questions
Bostjan writes in (http://slexy.org/view/s214FYbOKL)
Rick writes in (http://slexy.org/view/s21cWLhzj4)
Clint writes in (http://slexy.org/view/s21A4grtH0)
Esteban writes in (http://slexy.org/view/s27fQHz8Se)
Ben writes in (http://slexy.org/view/s21QscO4Cr)
Matt sends in pictures of his FreeBSD CD collection (https://imgur.com/a/Ah444)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, openssl, libressl, prng, linux, des, aes, encryption, cryptography, Dag-Erling Smørgrav, security, hackathon, pf, packet filter, firewall, smp, multithreading, ixsystems, tarsnap, bsdcan, cheri, zfs, qemu</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week on the show! We&#39;ve got an interview with Dag-Erling Smørgrav, the current security officer of FreeBSD, to discuss what exactly being in such an important position is like. The latest news, answers to your emails and even some LibreSSL drama, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.openbsd.org/hackathons.html" rel="nofollow">g2k14 hackathon reports</a></h3>

<ul>
<li>Nearly 50 OpenBSD developers gathered in Ljubljana, Slovenia from July 8-14 for a hackathon</li>
<li>Lots of work got done - in just the first two weeks of July, there were <a href="http://marc.info/?l=openbsd-cvs&r=1&b=201407&w=2" rel="nofollow">over 1000 commits</a> to their CVS tree</li>
<li>Some of the developers wrote in to document what they were up to at the event</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140713220618" rel="nofollow">Bob Beck</a> planned to work on kernel stuff, but then &quot;LibreSSL happened&quot; and he spent most of his time working on that</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140718072312" rel="nofollow">Miod Vallat</a> also tells about his LibreSSL experiences</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140718090456" rel="nofollow">Brent Cook</a>, a new developer, worked mainly on the portable version of LibreSSL (and we&#39;ll be interviewing him next week!)</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140714094454" rel="nofollow">Henning Brauer</a> worked on VLAN bpf and various things related to IPv6 and network interfaces (and he still hates IPv6)</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140714191912" rel="nofollow">Martin Pieuchot</a> fixed some bugs in the USB stack, softraid and misc other things</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140714202157" rel="nofollow">Marc Espie</a> improved the package code, enabling some speed ups, fixed some ports that broke with LibreSSL and some of the new changes and also did some work on ensuring snapshot consistency</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140715120259" rel="nofollow">Martin Pelikan</a> integrated read-only ext4 support</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140715094848" rel="nofollow">Vadim Zhukov</a> did lots of ports work, including working on KDE4</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140715212333" rel="nofollow">Theo de Raadt</a> created a new, more secure system call, &quot;sendsyslog&quot; and did a lot of work with /etc, sysmerge and the rc scripts</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140718134017" rel="nofollow">Paul Irofti</a> worked on the USB stack, specifically for the Octeon platform</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140719104939" rel="nofollow">Sebastian Benoit</a> worked on relayd filters and IPv6 code</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140719134058" rel="nofollow">Jasper Lievisse Adriaanse</a> did work with puppet, packages and the bootloader</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140719082410" rel="nofollow">Jonathan Gray</a> imported newer Mesa libraries and did a lot with Xenocara, including work in the installer for autodetection</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140721125235" rel="nofollow">Stefan Sperling</a> fixed a lot of issues with wireless drivers</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140721125020" rel="nofollow">Florian Obser</a> did many things related to IPv6</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140721090411" rel="nofollow">Ingo Schwarze</a> worked on mandoc, as usual, and also rewrote the openbsd.org man.cgi interface</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140722071413" rel="nofollow">Ken Westerback</a> hacked on dhclient and dhcpd, and also got dump working on 4k sector drives</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140723142224" rel="nofollow">Matthieu Herrb</a> worked on updating and modernizing parts of xenocara
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-questions/2014-July/259292.html" rel="nofollow">FreeBSD pf discussion takes off</a></h3>

<ul>
<li>Concerns from last week, about FreeBSD&#39;s packet filter being old and unmaintained, seemed to have finally sparked some conversation about the topic on the &quot;questions&quot; and &quot;current&quot; mailing lists (unfortunately people didn&#39;t always use reply-all so you have to cross-reference the two lists to follow the whole conversation sometimes)</li>
<li>Straight from the SMP FreeBSD pf maintainer: &quot;no one right now [is actively developing pf on FreeBSD]&quot;</li>
<li>Searching for documentation online for pf is troublesome because there are two incompatible syntaxes</li>
<li>FreeBSD&#39;s pf man pages are lacking, and some of FreeBSD&#39;s documentation still links to OpenBSD&#39;s pages, which won&#39;t work anymore - possibly turning away would-be BSD converts because it&#39;s frustrating</li>
<li>There&#39;s also the issue of importing patches from pfSense, but most of those still haven&#39;t been done either</li>
<li>Lots of disagreement among developers vs. users...</li>
<li>Many users are very vocal about wanting it updated, saying the syntax change is no big deal and is worth the benefits - developers aren&#39;t interested</li>
<li>Henning Brauer, the main developer of pf on OpenBSD, has been very nice and offered to help the other BSDs get their pf fixed on multiple occasions</li>
<li>Gleb Smirnoff, author of the FreeBSD-specific SMP patches, questions Henning&#39;s claims about OpenBSD&#39;s improved speed as &quot;uncorroborated claims&quot; (but neither side has provided any public benchmarks)</li>
<li>Gleb had to abandon his work on FreeBSD&#39;s pf because funding ran out
***</li>
</ul>

<h3><a href="http://linux.slashdot.org/story/14/07/16/1950235/libressl-prng-vulnerability-patched" rel="nofollow">LibreSSL progress update</a></h3>

<ul>
<li>LibreSSL&#39;s first few portable releases have come out and they&#39;re making great progress, releasing 2.0.3 <a href="http://marc.info/?l=openbsd-tech&m=140599450206255&w=2" rel="nofollow">two days ago</a></li>
<li>Lots of non-OpenBSD people are starting to contribute, sending in patches via the tech mailing list</li>
<li>However, there has already been some drama... with Linux users</li>
<li>There was a problem with Linux&#39;s PRNG, and LibreSSL was <a href="https://twitter.com/MiodVallat/status/489122763610021888" rel="nofollow">unforgiving</a> of it, not making an effort to randomize something that could not provide real entropy</li>
<li>This &quot;problem&quot; doesn&#39;t affect OpenBSD&#39;s native implementation, only the portable version</li>
<li><a href="http://www.securityweek.com/openbsd-downplays-prng-vulnerability-libressl" rel="nofollow">The developers</a> decide to <a href="http://www.tedunangst.com/flak/post/wrapping-pids-for-fun-and-profit" rel="nofollow">weigh in</a> to calm the misinformation and rage</li>
<li>A fix was added in 2.0.2, and Linux may even <a href="http://thread.gmane.org/gmane.linux.kernel.cryptoapi/11666" rel="nofollow">get a new system call</a> to handle this properly now - remember to say thanks, guys</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> has a <a href="http://www.tedunangst.com/flak/post/this-is-why-software-sucks" rel="nofollow">really good post</a> about the whole situation, definitely check it out</li>
<li>As a follow-up from last week, bapt says they&#39;re working on building the whole FreeBSD ports tree against LibreSSL, but lots of things still need some patching to work properly - if you&#39;re a port maintainer, please test your ports against it
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/current-users/2014/07/13/msg025234.html" rel="nofollow">Preparation for NetBSD 7</a></h3>

<ul>
<li>The release process for NetBSD 7.0 is finally underway</li>
<li>The netbsd-7 CVS branch should be created around July 26th, which marks the start of the first beta period, which will be lasting until September</li>
<li>If you run NetBSD, that&#39;ll be a great time to help test on as many platforms as you can (this is especially true on custom embedded applications)</li>
<li>They&#39;re also looking for some help updating documentation and fixing any bugs that get reported</li>
<li>Another formal announcement will be made when the beta binaries are up
***</li>
</ul>

<h2>Interview - Dag-Erling Smørgrav - <a href="mailto:des@freebsd.org" rel="nofollow">des@freebsd.org</a> / <a href="https://twitter.com/RealEvilDES" rel="nofollow">@RealEvilDES</a></h2>

<p>The role of the FreeBSD Security Officer, recent ports features, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/07/18/bsdcan-2014-ports-and-packages-wg/" rel="nofollow">BSDCan ports and packages WG</a></h3>

<ul>
<li>Back at BSDCan this year, there was a special event for discussion of FreeBSD ports and packages</li>
<li>Bapt talked about package building, poudriere and the systems the foundation funded for compiling packages</li>
<li>There&#39;s also some detail about the signing infrastructure and different mirrors</li>
<li>Ports people and source people need to talk more often about ABI breakage</li>
<li>The post also includes information about pkg 1.3, the old pkg tools&#39; EOL, the quarterly stable package sets and a lot more (it&#39;s a huge post!)
***</li>
</ul>

<h3><a href="http://blog.ignoranthack.me/?p=212" rel="nofollow">Cross-compiling ports with QEMU and poudriere</a></h3>

<ul>
<li>With recent QEMU features, you can basically chroot into a completely different architecture</li>
<li>This article goes through the process of building ARMv6 packages on a normal X86 box</li>
<li>Note though that this requires 10-STABLE or 11-CURRENT and an extra patch for QEMU right now</li>
<li>The poudriere-devel port now has a &quot;qemu user&quot; option that will pull in all the requirements</li>
<li>Hopefully this will pave the way for official pkgng packages on those lesser-used architectures
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/2108" rel="nofollow">Cloning FreeBSD with ZFS send</a></h3>

<ul>
<li>For a FreeBSD mail server that MWL runs, he wanted to have a way to easily restore the whole system if something were to happen</li>
<li>This post shows his entire process in creating a mirror machine, using ZFS for everything</li>
<li>The &quot;zfs send&quot; and &quot;zfs snapshot&quot; commands really come in handy for this</li>
<li>He does the whole thing from a live CD, pretty impressive
***</li>
</ul>

<h3><a href="http://thiagoperrotta.wordpress.com/2014/07/20/here-be-dragons-freebsd-overview-part-i/" rel="nofollow">FreeBSD Overview series</a></h3>

<ul>
<li>A new blog series we stumbled upon about a Linux user switching to BSD</li>
<li>In part one, he gives a little background on being &quot;done with Linux distros&quot; and documents his initial experience getting and installing FreeBSD 10</li>
<li>He was pleasantly surprised to be able to use ZFS without jumping through hoops and doing custom kernels</li>
<li>Most of what he was used to on Linux was already in the default FreeBSD (except bash...)</li>
<li><a href="http://thiagoperrotta.wordpress.com/2014/07/21/here-be-packages-freebsd-overview-part-ii/" rel="nofollow">Part two</a> documents his experiences with pkgng and ports 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s214FYbOKL" rel="nofollow">Bostjan writes in</a></li>
<li><a href="http://slexy.org/view/s21cWLhzj4" rel="nofollow">Rick writes in</a></li>
<li><a href="http://slexy.org/view/s21A4grtH0" rel="nofollow">Clint writes in</a></li>
<li><a href="http://slexy.org/view/s27fQHz8Se" rel="nofollow">Esteban writes in</a></li>
<li><a href="http://slexy.org/view/s21QscO4Cr" rel="nofollow">Ben writes in</a></li>
<li><a href="https://imgur.com/a/Ah444" rel="nofollow">Matt sends in pictures of his FreeBSD CD collection</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week on the show! We&#39;ve got an interview with Dag-Erling Smørgrav, the current security officer of FreeBSD, to discuss what exactly being in such an important position is like. The latest news, answers to your emails and even some LibreSSL drama, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.openbsd.org/hackathons.html" rel="nofollow">g2k14 hackathon reports</a></h3>

<ul>
<li>Nearly 50 OpenBSD developers gathered in Ljubljana, Slovenia from July 8-14 for a hackathon</li>
<li>Lots of work got done - in just the first two weeks of July, there were <a href="http://marc.info/?l=openbsd-cvs&r=1&b=201407&w=2" rel="nofollow">over 1000 commits</a> to their CVS tree</li>
<li>Some of the developers wrote in to document what they were up to at the event</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140713220618" rel="nofollow">Bob Beck</a> planned to work on kernel stuff, but then &quot;LibreSSL happened&quot; and he spent most of his time working on that</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140718072312" rel="nofollow">Miod Vallat</a> also tells about his LibreSSL experiences</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140718090456" rel="nofollow">Brent Cook</a>, a new developer, worked mainly on the portable version of LibreSSL (and we&#39;ll be interviewing him next week!)</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140714094454" rel="nofollow">Henning Brauer</a> worked on VLAN bpf and various things related to IPv6 and network interfaces (and he still hates IPv6)</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140714191912" rel="nofollow">Martin Pieuchot</a> fixed some bugs in the USB stack, softraid and misc other things</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140714202157" rel="nofollow">Marc Espie</a> improved the package code, enabling some speed ups, fixed some ports that broke with LibreSSL and some of the new changes and also did some work on ensuring snapshot consistency</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140715120259" rel="nofollow">Martin Pelikan</a> integrated read-only ext4 support</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140715094848" rel="nofollow">Vadim Zhukov</a> did lots of ports work, including working on KDE4</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140715212333" rel="nofollow">Theo de Raadt</a> created a new, more secure system call, &quot;sendsyslog&quot; and did a lot of work with /etc, sysmerge and the rc scripts</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140718134017" rel="nofollow">Paul Irofti</a> worked on the USB stack, specifically for the Octeon platform</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140719104939" rel="nofollow">Sebastian Benoit</a> worked on relayd filters and IPv6 code</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140719134058" rel="nofollow">Jasper Lievisse Adriaanse</a> did work with puppet, packages and the bootloader</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140719082410" rel="nofollow">Jonathan Gray</a> imported newer Mesa libraries and did a lot with Xenocara, including work in the installer for autodetection</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140721125235" rel="nofollow">Stefan Sperling</a> fixed a lot of issues with wireless drivers</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140721125020" rel="nofollow">Florian Obser</a> did many things related to IPv6</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140721090411" rel="nofollow">Ingo Schwarze</a> worked on mandoc, as usual, and also rewrote the openbsd.org man.cgi interface</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140722071413" rel="nofollow">Ken Westerback</a> hacked on dhclient and dhcpd, and also got dump working on 4k sector drives</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140723142224" rel="nofollow">Matthieu Herrb</a> worked on updating and modernizing parts of xenocara
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-questions/2014-July/259292.html" rel="nofollow">FreeBSD pf discussion takes off</a></h3>

<ul>
<li>Concerns from last week, about FreeBSD&#39;s packet filter being old and unmaintained, seemed to have finally sparked some conversation about the topic on the &quot;questions&quot; and &quot;current&quot; mailing lists (unfortunately people didn&#39;t always use reply-all so you have to cross-reference the two lists to follow the whole conversation sometimes)</li>
<li>Straight from the SMP FreeBSD pf maintainer: &quot;no one right now [is actively developing pf on FreeBSD]&quot;</li>
<li>Searching for documentation online for pf is troublesome because there are two incompatible syntaxes</li>
<li>FreeBSD&#39;s pf man pages are lacking, and some of FreeBSD&#39;s documentation still links to OpenBSD&#39;s pages, which won&#39;t work anymore - possibly turning away would-be BSD converts because it&#39;s frustrating</li>
<li>There&#39;s also the issue of importing patches from pfSense, but most of those still haven&#39;t been done either</li>
<li>Lots of disagreement among developers vs. users...</li>
<li>Many users are very vocal about wanting it updated, saying the syntax change is no big deal and is worth the benefits - developers aren&#39;t interested</li>
<li>Henning Brauer, the main developer of pf on OpenBSD, has been very nice and offered to help the other BSDs get their pf fixed on multiple occasions</li>
<li>Gleb Smirnoff, author of the FreeBSD-specific SMP patches, questions Henning&#39;s claims about OpenBSD&#39;s improved speed as &quot;uncorroborated claims&quot; (but neither side has provided any public benchmarks)</li>
<li>Gleb had to abandon his work on FreeBSD&#39;s pf because funding ran out
***</li>
</ul>

<h3><a href="http://linux.slashdot.org/story/14/07/16/1950235/libressl-prng-vulnerability-patched" rel="nofollow">LibreSSL progress update</a></h3>

<ul>
<li>LibreSSL&#39;s first few portable releases have come out and they&#39;re making great progress, releasing 2.0.3 <a href="http://marc.info/?l=openbsd-tech&m=140599450206255&w=2" rel="nofollow">two days ago</a></li>
<li>Lots of non-OpenBSD people are starting to contribute, sending in patches via the tech mailing list</li>
<li>However, there has already been some drama... with Linux users</li>
<li>There was a problem with Linux&#39;s PRNG, and LibreSSL was <a href="https://twitter.com/MiodVallat/status/489122763610021888" rel="nofollow">unforgiving</a> of it, not making an effort to randomize something that could not provide real entropy</li>
<li>This &quot;problem&quot; doesn&#39;t affect OpenBSD&#39;s native implementation, only the portable version</li>
<li><a href="http://www.securityweek.com/openbsd-downplays-prng-vulnerability-libressl" rel="nofollow">The developers</a> decide to <a href="http://www.tedunangst.com/flak/post/wrapping-pids-for-fun-and-profit" rel="nofollow">weigh in</a> to calm the misinformation and rage</li>
<li>A fix was added in 2.0.2, and Linux may even <a href="http://thread.gmane.org/gmane.linux.kernel.cryptoapi/11666" rel="nofollow">get a new system call</a> to handle this properly now - remember to say thanks, guys</li>
<li><a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> has a <a href="http://www.tedunangst.com/flak/post/this-is-why-software-sucks" rel="nofollow">really good post</a> about the whole situation, definitely check it out</li>
<li>As a follow-up from last week, bapt says they&#39;re working on building the whole FreeBSD ports tree against LibreSSL, but lots of things still need some patching to work properly - if you&#39;re a port maintainer, please test your ports against it
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/current-users/2014/07/13/msg025234.html" rel="nofollow">Preparation for NetBSD 7</a></h3>

<ul>
<li>The release process for NetBSD 7.0 is finally underway</li>
<li>The netbsd-7 CVS branch should be created around July 26th, which marks the start of the first beta period, which will be lasting until September</li>
<li>If you run NetBSD, that&#39;ll be a great time to help test on as many platforms as you can (this is especially true on custom embedded applications)</li>
<li>They&#39;re also looking for some help updating documentation and fixing any bugs that get reported</li>
<li>Another formal announcement will be made when the beta binaries are up
***</li>
</ul>

<h2>Interview - Dag-Erling Smørgrav - <a href="mailto:des@freebsd.org" rel="nofollow">des@freebsd.org</a> / <a href="https://twitter.com/RealEvilDES" rel="nofollow">@RealEvilDES</a></h2>

<p>The role of the FreeBSD Security Officer, recent ports features, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/07/18/bsdcan-2014-ports-and-packages-wg/" rel="nofollow">BSDCan ports and packages WG</a></h3>

<ul>
<li>Back at BSDCan this year, there was a special event for discussion of FreeBSD ports and packages</li>
<li>Bapt talked about package building, poudriere and the systems the foundation funded for compiling packages</li>
<li>There&#39;s also some detail about the signing infrastructure and different mirrors</li>
<li>Ports people and source people need to talk more often about ABI breakage</li>
<li>The post also includes information about pkg 1.3, the old pkg tools&#39; EOL, the quarterly stable package sets and a lot more (it&#39;s a huge post!)
***</li>
</ul>

<h3><a href="http://blog.ignoranthack.me/?p=212" rel="nofollow">Cross-compiling ports with QEMU and poudriere</a></h3>

<ul>
<li>With recent QEMU features, you can basically chroot into a completely different architecture</li>
<li>This article goes through the process of building ARMv6 packages on a normal X86 box</li>
<li>Note though that this requires 10-STABLE or 11-CURRENT and an extra patch for QEMU right now</li>
<li>The poudriere-devel port now has a &quot;qemu user&quot; option that will pull in all the requirements</li>
<li>Hopefully this will pave the way for official pkgng packages on those lesser-used architectures
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/2108" rel="nofollow">Cloning FreeBSD with ZFS send</a></h3>

<ul>
<li>For a FreeBSD mail server that MWL runs, he wanted to have a way to easily restore the whole system if something were to happen</li>
<li>This post shows his entire process in creating a mirror machine, using ZFS for everything</li>
<li>The &quot;zfs send&quot; and &quot;zfs snapshot&quot; commands really come in handy for this</li>
<li>He does the whole thing from a live CD, pretty impressive
***</li>
</ul>

<h3><a href="http://thiagoperrotta.wordpress.com/2014/07/20/here-be-dragons-freebsd-overview-part-i/" rel="nofollow">FreeBSD Overview series</a></h3>

<ul>
<li>A new blog series we stumbled upon about a Linux user switching to BSD</li>
<li>In part one, he gives a little background on being &quot;done with Linux distros&quot; and documents his initial experience getting and installing FreeBSD 10</li>
<li>He was pleasantly surprised to be able to use ZFS without jumping through hoops and doing custom kernels</li>
<li>Most of what he was used to on Linux was already in the default FreeBSD (except bash...)</li>
<li><a href="http://thiagoperrotta.wordpress.com/2014/07/21/here-be-packages-freebsd-overview-part-ii/" rel="nofollow">Part two</a> documents his experiences with pkgng and ports 
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s214FYbOKL" rel="nofollow">Bostjan writes in</a></li>
<li><a href="http://slexy.org/view/s21cWLhzj4" rel="nofollow">Rick writes in</a></li>
<li><a href="http://slexy.org/view/s21A4grtH0" rel="nofollow">Clint writes in</a></li>
<li><a href="http://slexy.org/view/s27fQHz8Se" rel="nofollow">Esteban writes in</a></li>
<li><a href="http://slexy.org/view/s21QscO4Cr" rel="nofollow">Ben writes in</a></li>
<li><a href="https://imgur.com/a/Ah444" rel="nofollow">Matt sends in pictures of his FreeBSD CD collection</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>46: Network Iodometry</title>
  <link>https://www.bsdnow.tv/46</link>
  <guid isPermaLink="false">e23303c8-31f0-4706-817c-1618e08cd149</guid>
  <pubDate>Wed, 16 Jul 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e23303c8-31f0-4706-817c-1618e08cd149.mp3" length="76226260" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We're back, and this week we'll be showing you how to tunnel out of a restrictive network using only DNS queries. We also sat down with Bryan Drewery, from the FreeBSD portmgr team, to talk all about their building cluster and some recent changes. All the latest news and answers to your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:45:52</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We're back, and this week we'll be showing you how to tunnel out of a restrictive network using only DNS queries. We also sat down with Bryan Drewery, from the FreeBSD portmgr team, to talk all about their building cluster and some recent changes. All the latest news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
EuroBSDCon 2014 registration open (http://2014.eurobsdcon.org/registration/)
September is getting closer, and that means it's time for EuroBSDCon - held in Bulgaria this year
Registration is finally open to the public, with prices for businesses ($287), individuals ($217) and students ($82) for the main conference until August 18th
Tutorials, sessions, dev summits and everything else all have their own pricing as well
Registering between August 18th - September 12th will cost more for everything
You can register online here (http://registration.eurobsdcon.org/) and check hotels in the area (http://2014.eurobsdcon.org/registration/travel-and-stay/hotels)
The FreeBSD foundation is also accepting applications (https://lists.freebsd.org/pipermail/freebsd-announce/2014-July/001577.html) for travel grants
***
OpenBSD SMP PF update (http://marc.info/?t=140440541000002&amp;amp;r=1&amp;amp;w=2)
A couple weeks ago we talked about how DragonflyBSD updated their PF to be multithreaded
With them joining the SMP ranks along with FreeBSD, a lot of users have been asking about when OpenBSD is going to make the jump
In a recent mailing list thread, Henning Brauer (http://www.bsdnow.tv/episodes/2013_10_30-current_events) addresses some of the concerns
The short version (http://marc.info/?l=openbsd-misc&amp;amp;m=140479174521071&amp;amp;w=2) is that too many things in OpenBSD are currently single-threaded for it to matter - just reworking PF by itself would be useless
He also says (http://marc.info/?l=openbsd-misc&amp;amp;m=140481012425889&amp;amp;w=2) PF on OpenBSD is over four times faster than FreeBSD's old version, presumably due to those extra years of development it's gone through
There's also been even more recent concern (https://lists.freebsd.org/pipermail/freebsd-pf/2014-July/thread.html) about the uncertain future of FreeBSD's PF, being mostly unmaintained since their SMP patches
We reached out to four developers (over week ago) about coming on the show to talk about OpenBSD network performance and SMP, but they all ignored us
***
Introduction to NetBSD pkgsrc (http://saveosx.org/pkgsrc-intro/)
An article from one of our listeners about how to create a new pkgsrc port or fix one that you need
The post starts off with how to get the pkgsrc tree, shows how to get the developer tools and finally goes through the Makefile format
It also lists all the different bmake targets and their functions in relation to the porting process
Finally, the post details the whole process of creating a new port
***
FreeBSD 9.3-RELEASE (https://www.freebsd.org/releases/9.3R/relnotes.html)
After three RCs, FreeBSD 9.3 was scheduled to be finalized and announced today (https://www.freebsd.org/releases/9.3R/schedule.html) but actually came out yesterday
The full list of changes (https://www.freebsd.org/releases/9.3R/relnotes.html) is available, but it's mostly a smaller maintenance release
Lots of driver updates, ZFS issues fixed, hardware RNGs are entirely disabled by default, netmap framework updates, read-only ext4 support was added, the vt driver was merged from -CURRENT, new hardware support (including radeon KMS), various userland tools got new features, OpenSSL and OpenSSH were updated... and much more
If you haven't jumped to the 10.x branch yet (and there are a lot of people who haven't!) this is a worthwhile upgrade - 9.2-RELEASE will reach EOL soon
Good news, this will be the first release (https://twitter.com/evilgjb/status/485909719522222080) with PGP-signed checksums on the FTP mirrors - a very welcome change
With that out of the way, the 10.1-RELEASE schedule was posted (https://www.freebsd.org/releases/10.1R/schedule.html)
***
Interview - Bryan Drewery - bdrewery@freebsd.org (mailto:bdrewery@freebsd.org) / @bdrewery (https://twitter.com/bdrewery)
The FreeBSD package building cluster, pkgng, ports, various topics
Tutorial
Tunneling traffic through DNS (http://www.bsdnow.tv/tutorials/ssh-dns)
News Roundup
SSH two-factor authentication on FreeBSD (http://blog.feld.me/posts/2014/07/ssh-two-factor-authentication-on-freebsd/)
We've previously mentioned stories on how to do two-factor authentication with a Yubikey or via a third party website
This blog post tells you how to do exactly that, but with your Google account and the pamgoogleauthenticator port
Using this setup, every user that logs in with a password will have an extra requirement before they can gain access - but users with public keys can login normally
It's a really, really simple process once you have the port installed - full details on the page
***
Ditch tape backup in favor of FreeNAS (http://www.darvilleit.com/why-i-ditched-tape-backup-for-a-custom-made-freenas-backup/)
The author of this post shares some of his horrible experiences with tape backups for a client
Having constant, daily errors and failed backups, he needed to find another solution
With 1TB of backups, tapes just weren't a good option anymore - so he switched to FreeNAS (after also ruling out a pre-built NAS)
The rest of the article details his experiences with it and tells about his setup
***
NetBSD vs FreeBSD, desktop experiences (http://imil.net/wp/2014/07/02/back-to-2000-2005-freebsd-desktop-2/)
A NetBSD and pkgsrc developer details his experiences running NetBSD on a workstation at his job
Becoming more and more disappointed with graphics performance, he finally decides to give FreeBSD 10 a try - especially since it has a native nVidia driver
"Running on VAX, PlayStation 2 and Amiga is fun, but I’ll tell you a little secret: nobody cares anymore about VAX, PlayStation 2 and Amiga."
He's become pretty satisfied with FreeBSD, a modern choice for a 2014 desktop system 
***
PCBSD not-so-weekly digest (http://blog.pcbsd.org/2014/07/pc-bsd-feature-digest-31-warden-cli-upgrade-irc-announcement/)
Speaking of choices for a desktop system, it's the return of the PCBSD digest!
Warden and PBI_add have gotten some interesting new features
You can now create jails "on the fly" when adding a new PBI to your application library
Bulk jail creation is also possible now, and it's really easy
New Jenkins integration, with public access to poudriere logs as well (http://builds.pcbsd.org)
PkgNG 1.3.0.rc2 testing for EDGE users
***
Feedback/Questions
Jeff writes in (http://slexy.org/view/s21D05MP0t) - Sending Encrypted Backups over SSH (http://allanjude.com/zfs_handbook/zfs-zfs.html#zfs-send-ssh) + Sending ZFS snapshots via user (http://wiki.pcbsd.org/index.php/Life_Preserver/10.0#Backing_Up_to_a_FreeNAS_System)
Bruce writes in (http://slexy.org/view/s2lzo1swzo)
Richard writes in (http://slexy.org/view/s20z841ean)
Jeff writes in (http://slexy.org/view/s2QYc8BOAo) - NYCBUG dmesg list (http://www.nycbug.org/index.cgi?action=dmesgd)
Steve writes in (http://slexy.org/view/s2V2e1m7S7)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonfly bsd, pc-bsd, tutorial, howto, guide, bsd, interview, iodine, dns, tunnel, ssh, encryption, vpn, ids, bypass, detection, portmgr, pkgng, bypassing, firewall, pkgsrccon, pkgsrc, pf, smp, eurobsdcon, 2014, multithreaded, presentations, talks, two factor authentication, freenas, 9.3</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;re back, and this week we&#39;ll be showing you how to tunnel out of a restrictive network using only DNS queries. We also sat down with Bryan Drewery, from the FreeBSD portmgr team, to talk all about their building cluster and some recent changes. All the latest news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.eurobsdcon.org/registration/" rel="nofollow">EuroBSDCon 2014 registration open</a></h3>

<ul>
<li>September is getting closer, and that means it&#39;s time for EuroBSDCon - held in Bulgaria this year</li>
<li>Registration is finally open to the public, with prices for businesses ($287), individuals ($217) and students ($82) for the main conference until August 18th</li>
<li>Tutorials, sessions, dev summits and everything else all have their own pricing as well</li>
<li>Registering between August 18th - September 12th will cost more for everything</li>
<li>You can <a href="http://registration.eurobsdcon.org/" rel="nofollow">register online here</a> and <a href="http://2014.eurobsdcon.org/registration/travel-and-stay/hotels" rel="nofollow">check hotels in the area</a></li>
<li>The FreeBSD foundation is also <a href="https://lists.freebsd.org/pipermail/freebsd-announce/2014-July/001577.html" rel="nofollow">accepting applications</a> for travel grants
***</li>
</ul>

<h3><a href="http://marc.info/?t=140440541000002&r=1&w=2" rel="nofollow">OpenBSD SMP PF update</a></h3>

<ul>
<li>A couple weeks ago we talked about how DragonflyBSD updated their PF to be multithreaded</li>
<li>With them joining the SMP ranks along with FreeBSD, a lot of users have been asking about when OpenBSD is going to make the jump</li>
<li>In a recent mailing list thread, <a href="http://www.bsdnow.tv/episodes/2013_10_30-current_events" rel="nofollow">Henning Brauer</a> addresses some of the concerns</li>
<li>The <a href="http://marc.info/?l=openbsd-misc&m=140479174521071&w=2" rel="nofollow">short version</a> is that too many things in OpenBSD are currently single-threaded for it to matter - just reworking PF by itself would be useless</li>
<li>He <a href="http://marc.info/?l=openbsd-misc&m=140481012425889&w=2" rel="nofollow">also says</a> PF on OpenBSD is over four times faster than FreeBSD&#39;s old version, presumably due to those extra years of development it&#39;s gone through</li>
<li>There&#39;s also been <a href="https://lists.freebsd.org/pipermail/freebsd-pf/2014-July/thread.html" rel="nofollow">even more recent concern</a> about the uncertain future of FreeBSD&#39;s PF, being mostly unmaintained since their SMP patches</li>
<li>We reached out to four developers (over week ago) about coming on the show to talk about OpenBSD network performance and SMP, but they all ignored us
***</li>
</ul>

<h3><a href="http://saveosx.org/pkgsrc-intro/" rel="nofollow">Introduction to NetBSD pkgsrc</a></h3>

<ul>
<li>An article from one of our listeners about how to create a new pkgsrc port or fix one that you need</li>
<li>The post starts off with how to get the pkgsrc tree, shows how to get the developer tools and finally goes through the Makefile format</li>
<li>It also lists all the different bmake targets and their functions in relation to the porting process</li>
<li>Finally, the post details the whole process of creating a new port
***</li>
</ul>

<h3><a href="https://www.freebsd.org/releases/9.3R/relnotes.html" rel="nofollow">FreeBSD 9.3-RELEASE</a></h3>

<ul>
<li>After three RCs, FreeBSD 9.3 was scheduled to be finalized and announced <a href="https://www.freebsd.org/releases/9.3R/schedule.html" rel="nofollow">today</a> but actually came out yesterday</li>
<li><a href="https://www.freebsd.org/releases/9.3R/relnotes.html" rel="nofollow">The full list of changes</a> is available, but it&#39;s mostly a smaller maintenance release</li>
<li>Lots of driver updates, ZFS issues fixed, hardware RNGs are entirely disabled by default, netmap framework updates, read-only ext4 support was added, the vt driver was merged from -CURRENT, new hardware support (including radeon KMS), various userland tools got new features, OpenSSL and OpenSSH were updated... and much more</li>
<li>If you haven&#39;t jumped to the 10.x branch yet (and there are a lot of people who haven&#39;t!) this is a worthwhile upgrade - 9.2-RELEASE will reach EOL soon</li>
<li>Good news, this will be <a href="https://twitter.com/evilgjb/status/485909719522222080" rel="nofollow">the first release</a> with PGP-signed checksums on the FTP mirrors - a very welcome change</li>
<li>With that out of the way, the 10.1-RELEASE schedule <a href="https://www.freebsd.org/releases/10.1R/schedule.html" rel="nofollow">was posted</a>
***</li>
</ul>

<h2>Interview - Bryan Drewery - <a href="mailto:bdrewery@freebsd.org" rel="nofollow">bdrewery@freebsd.org</a> / <a href="https://twitter.com/bdrewery" rel="nofollow">@bdrewery</a></h2>

<p>The FreeBSD package building cluster, pkgng, ports, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ssh-dns" rel="nofollow">Tunneling traffic through DNS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blog.feld.me/posts/2014/07/ssh-two-factor-authentication-on-freebsd/" rel="nofollow">SSH two-factor authentication on FreeBSD</a></h3>

<ul>
<li>We&#39;ve previously mentioned stories on how to do two-factor authentication with a Yubikey or via a third party website</li>
<li>This blog post tells you how to do exactly that, but with your Google account and the pam_google_authenticator port</li>
<li>Using this setup, every user that logs in with a password will have an extra requirement before they can gain access - but users with public keys can login normally</li>
<li>It&#39;s a really, really simple process once you have the port installed - full details on the page
***</li>
</ul>

<h3><a href="http://www.darvilleit.com/why-i-ditched-tape-backup-for-a-custom-made-freenas-backup/" rel="nofollow">Ditch tape backup in favor of FreeNAS</a></h3>

<ul>
<li>The author of this post shares some of his horrible experiences with tape backups for a client</li>
<li>Having constant, daily errors and failed backups, he needed to find another solution</li>
<li>With 1TB of backups, tapes just weren&#39;t a good option anymore - so he switched to FreeNAS (after also ruling out a pre-built NAS)</li>
<li>The rest of the article details his experiences with it and tells about his setup
***</li>
</ul>

<h3><a href="http://imil.net/wp/2014/07/02/back-to-2000-2005-freebsd-desktop-2/" rel="nofollow">NetBSD vs FreeBSD, desktop experiences</a></h3>

<ul>
<li>A NetBSD and pkgsrc developer details his experiences running NetBSD on a workstation at his job</li>
<li>Becoming more and more disappointed with graphics performance, he finally decides to give FreeBSD 10 a try - especially since it has a native nVidia driver</li>
<li>&quot;Running on VAX, PlayStation 2 and Amiga is fun, but I’ll tell you a little secret: nobody cares anymore about VAX, PlayStation 2 and Amiga.&quot;</li>
<li>He&#39;s become pretty satisfied with FreeBSD, a modern choice for a 2014 desktop system 
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/07/pc-bsd-feature-digest-31-warden-cli-upgrade-irc-announcement/" rel="nofollow">PCBSD not-so-weekly digest</a></h3>

<ul>
<li>Speaking of choices for a desktop system, it&#39;s the return of the PCBSD digest!</li>
<li>Warden and PBI_add have gotten some interesting new features</li>
<li>You can now create jails &quot;on the fly&quot; when adding a new PBI to your application library</li>
<li>Bulk jail creation is also possible now, and it&#39;s really easy</li>
<li>New Jenkins integration, with public access to <a href="http://builds.pcbsd.org" rel="nofollow">poudriere logs as well</a></li>
<li>PkgNG 1.3.0.rc2 testing for EDGE users
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21D05MP0t" rel="nofollow">Jeff writes in</a> - <a href="http://allanjude.com/zfs_handbook/zfs-zfs.html#zfs-send-ssh" rel="nofollow">Sending Encrypted Backups over SSH</a> + <a href="http://wiki.pcbsd.org/index.php/Life_Preserver/10.0#Backing_Up_to_a_FreeNAS_System" rel="nofollow">Sending ZFS snapshots via user</a></li>
<li><a href="http://slexy.org/view/s2lzo1swzo" rel="nofollow">Bruce writes in</a></li>
<li><a href="http://slexy.org/view/s20z841ean" rel="nofollow">Richard writes in</a></li>
<li><a href="http://slexy.org/view/s2QYc8BOAo" rel="nofollow">Jeff writes in</a> - <a href="http://www.nycbug.org/index.cgi?action=dmesgd" rel="nofollow">NYCBUG dmesg list</a></li>
<li><a href="http://slexy.org/view/s2V2e1m7S7" rel="nofollow">Steve writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;re back, and this week we&#39;ll be showing you how to tunnel out of a restrictive network using only DNS queries. We also sat down with Bryan Drewery, from the FreeBSD portmgr team, to talk all about their building cluster and some recent changes. All the latest news and answers to your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.eurobsdcon.org/registration/" rel="nofollow">EuroBSDCon 2014 registration open</a></h3>

<ul>
<li>September is getting closer, and that means it&#39;s time for EuroBSDCon - held in Bulgaria this year</li>
<li>Registration is finally open to the public, with prices for businesses ($287), individuals ($217) and students ($82) for the main conference until August 18th</li>
<li>Tutorials, sessions, dev summits and everything else all have their own pricing as well</li>
<li>Registering between August 18th - September 12th will cost more for everything</li>
<li>You can <a href="http://registration.eurobsdcon.org/" rel="nofollow">register online here</a> and <a href="http://2014.eurobsdcon.org/registration/travel-and-stay/hotels" rel="nofollow">check hotels in the area</a></li>
<li>The FreeBSD foundation is also <a href="https://lists.freebsd.org/pipermail/freebsd-announce/2014-July/001577.html" rel="nofollow">accepting applications</a> for travel grants
***</li>
</ul>

<h3><a href="http://marc.info/?t=140440541000002&r=1&w=2" rel="nofollow">OpenBSD SMP PF update</a></h3>

<ul>
<li>A couple weeks ago we talked about how DragonflyBSD updated their PF to be multithreaded</li>
<li>With them joining the SMP ranks along with FreeBSD, a lot of users have been asking about when OpenBSD is going to make the jump</li>
<li>In a recent mailing list thread, <a href="http://www.bsdnow.tv/episodes/2013_10_30-current_events" rel="nofollow">Henning Brauer</a> addresses some of the concerns</li>
<li>The <a href="http://marc.info/?l=openbsd-misc&m=140479174521071&w=2" rel="nofollow">short version</a> is that too many things in OpenBSD are currently single-threaded for it to matter - just reworking PF by itself would be useless</li>
<li>He <a href="http://marc.info/?l=openbsd-misc&m=140481012425889&w=2" rel="nofollow">also says</a> PF on OpenBSD is over four times faster than FreeBSD&#39;s old version, presumably due to those extra years of development it&#39;s gone through</li>
<li>There&#39;s also been <a href="https://lists.freebsd.org/pipermail/freebsd-pf/2014-July/thread.html" rel="nofollow">even more recent concern</a> about the uncertain future of FreeBSD&#39;s PF, being mostly unmaintained since their SMP patches</li>
<li>We reached out to four developers (over week ago) about coming on the show to talk about OpenBSD network performance and SMP, but they all ignored us
***</li>
</ul>

<h3><a href="http://saveosx.org/pkgsrc-intro/" rel="nofollow">Introduction to NetBSD pkgsrc</a></h3>

<ul>
<li>An article from one of our listeners about how to create a new pkgsrc port or fix one that you need</li>
<li>The post starts off with how to get the pkgsrc tree, shows how to get the developer tools and finally goes through the Makefile format</li>
<li>It also lists all the different bmake targets and their functions in relation to the porting process</li>
<li>Finally, the post details the whole process of creating a new port
***</li>
</ul>

<h3><a href="https://www.freebsd.org/releases/9.3R/relnotes.html" rel="nofollow">FreeBSD 9.3-RELEASE</a></h3>

<ul>
<li>After three RCs, FreeBSD 9.3 was scheduled to be finalized and announced <a href="https://www.freebsd.org/releases/9.3R/schedule.html" rel="nofollow">today</a> but actually came out yesterday</li>
<li><a href="https://www.freebsd.org/releases/9.3R/relnotes.html" rel="nofollow">The full list of changes</a> is available, but it&#39;s mostly a smaller maintenance release</li>
<li>Lots of driver updates, ZFS issues fixed, hardware RNGs are entirely disabled by default, netmap framework updates, read-only ext4 support was added, the vt driver was merged from -CURRENT, new hardware support (including radeon KMS), various userland tools got new features, OpenSSL and OpenSSH were updated... and much more</li>
<li>If you haven&#39;t jumped to the 10.x branch yet (and there are a lot of people who haven&#39;t!) this is a worthwhile upgrade - 9.2-RELEASE will reach EOL soon</li>
<li>Good news, this will be <a href="https://twitter.com/evilgjb/status/485909719522222080" rel="nofollow">the first release</a> with PGP-signed checksums on the FTP mirrors - a very welcome change</li>
<li>With that out of the way, the 10.1-RELEASE schedule <a href="https://www.freebsd.org/releases/10.1R/schedule.html" rel="nofollow">was posted</a>
***</li>
</ul>

<h2>Interview - Bryan Drewery - <a href="mailto:bdrewery@freebsd.org" rel="nofollow">bdrewery@freebsd.org</a> / <a href="https://twitter.com/bdrewery" rel="nofollow">@bdrewery</a></h2>

<p>The FreeBSD package building cluster, pkgng, ports, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ssh-dns" rel="nofollow">Tunneling traffic through DNS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blog.feld.me/posts/2014/07/ssh-two-factor-authentication-on-freebsd/" rel="nofollow">SSH two-factor authentication on FreeBSD</a></h3>

<ul>
<li>We&#39;ve previously mentioned stories on how to do two-factor authentication with a Yubikey or via a third party website</li>
<li>This blog post tells you how to do exactly that, but with your Google account and the pam_google_authenticator port</li>
<li>Using this setup, every user that logs in with a password will have an extra requirement before they can gain access - but users with public keys can login normally</li>
<li>It&#39;s a really, really simple process once you have the port installed - full details on the page
***</li>
</ul>

<h3><a href="http://www.darvilleit.com/why-i-ditched-tape-backup-for-a-custom-made-freenas-backup/" rel="nofollow">Ditch tape backup in favor of FreeNAS</a></h3>

<ul>
<li>The author of this post shares some of his horrible experiences with tape backups for a client</li>
<li>Having constant, daily errors and failed backups, he needed to find another solution</li>
<li>With 1TB of backups, tapes just weren&#39;t a good option anymore - so he switched to FreeNAS (after also ruling out a pre-built NAS)</li>
<li>The rest of the article details his experiences with it and tells about his setup
***</li>
</ul>

<h3><a href="http://imil.net/wp/2014/07/02/back-to-2000-2005-freebsd-desktop-2/" rel="nofollow">NetBSD vs FreeBSD, desktop experiences</a></h3>

<ul>
<li>A NetBSD and pkgsrc developer details his experiences running NetBSD on a workstation at his job</li>
<li>Becoming more and more disappointed with graphics performance, he finally decides to give FreeBSD 10 a try - especially since it has a native nVidia driver</li>
<li>&quot;Running on VAX, PlayStation 2 and Amiga is fun, but I’ll tell you a little secret: nobody cares anymore about VAX, PlayStation 2 and Amiga.&quot;</li>
<li>He&#39;s become pretty satisfied with FreeBSD, a modern choice for a 2014 desktop system 
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/07/pc-bsd-feature-digest-31-warden-cli-upgrade-irc-announcement/" rel="nofollow">PCBSD not-so-weekly digest</a></h3>

<ul>
<li>Speaking of choices for a desktop system, it&#39;s the return of the PCBSD digest!</li>
<li>Warden and PBI_add have gotten some interesting new features</li>
<li>You can now create jails &quot;on the fly&quot; when adding a new PBI to your application library</li>
<li>Bulk jail creation is also possible now, and it&#39;s really easy</li>
<li>New Jenkins integration, with public access to <a href="http://builds.pcbsd.org" rel="nofollow">poudriere logs as well</a></li>
<li>PkgNG 1.3.0.rc2 testing for EDGE users
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21D05MP0t" rel="nofollow">Jeff writes in</a> - <a href="http://allanjude.com/zfs_handbook/zfs-zfs.html#zfs-send-ssh" rel="nofollow">Sending Encrypted Backups over SSH</a> + <a href="http://wiki.pcbsd.org/index.php/Life_Preserver/10.0#Backing_Up_to_a_FreeNAS_System" rel="nofollow">Sending ZFS snapshots via user</a></li>
<li><a href="http://slexy.org/view/s2lzo1swzo" rel="nofollow">Bruce writes in</a></li>
<li><a href="http://slexy.org/view/s20z841ean" rel="nofollow">Richard writes in</a></li>
<li><a href="http://slexy.org/view/s2QYc8BOAo" rel="nofollow">Jeff writes in</a> - <a href="http://www.nycbug.org/index.cgi?action=dmesgd" rel="nofollow">NYCBUG dmesg list</a></li>
<li><a href="http://slexy.org/view/s2V2e1m7S7" rel="nofollow">Steve writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>45: ZFS War Stories</title>
  <link>https://www.bsdnow.tv/45</link>
  <guid isPermaLink="false">d53fb6f3-26c8-4311-86c5-a2034403b866</guid>
  <pubDate>Wed, 09 Jul 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d53fb6f3-26c8-4311-86c5-a2034403b866.mp3" length="33459412" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week Allan is at BSDCam in the UK, so we'll be back with a regular episode next week. For now though, here's an interview with Josh Paetzel about some crazy experiences he's had with ZFS.</itunes:subtitle>
  <itunes:duration>46:28</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week Allan is at BSDCam in the UK, so we'll be back with a regular episode next week. For now though, here's an interview with Josh Paetzel about some crazy experiences he's had with ZFS.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Interview - Josh Paetzel - josh@ixsystems.com (mailto:josh@ixsystems.com) / @bsdunix4ever (https://twitter.com/bsdunix4ever)
Crazy ZFS stories, network protocols, server hardware 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, zfs, zpool, raid, raid-z, openzfs, open-zfs, array, hardware, iscsi, freenas, ixsystems, high availability, bsdcam</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week Allan is at BSDCam in the UK, so we&#39;ll be back with a regular episode next week. For now though, here&#39;s an interview with Josh Paetzel about some crazy experiences he&#39;s had with ZFS.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Interview - Josh Paetzel - <a href="mailto:josh@ixsystems.com" rel="nofollow">josh@ixsystems.com</a> / <a href="https://twitter.com/bsdunix4ever" rel="nofollow">@bsdunix4ever</a></h2>

<p>Crazy ZFS stories, network protocols, server hardware </p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week Allan is at BSDCam in the UK, so we&#39;ll be back with a regular episode next week. For now though, here&#39;s an interview with Josh Paetzel about some crazy experiences he&#39;s had with ZFS.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Interview - Josh Paetzel - <a href="mailto:josh@ixsystems.com" rel="nofollow">josh@ixsystems.com</a> / <a href="https://twitter.com/bsdunix4ever" rel="nofollow">@bsdunix4ever</a></h2>

<p>Crazy ZFS stories, network protocols, server hardware </p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>44: Base ISO 100</title>
  <link>https://www.bsdnow.tv/44</link>
  <guid isPermaLink="false">cbf5ab1d-2355-4c2c-ade8-0e66250b204e</guid>
  <pubDate>Wed, 02 Jul 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cbf5ab1d-2355-4c2c-ade8-0e66250b204e.mp3" length="75659476" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we'll be sitting down to talk with Craig Rodrigues about Jenkins and the FreeBSD testing infrastructure. Following that, we'll show you how to roll your own OpenBSD ISOs with all the patches already applied... ISO can't wait! This week's news and answers to all your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:45:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we'll be sitting down to talk with Craig Rodrigues about Jenkins and the FreeBSD testing infrastructure. Following that, we'll show you how to roll your own OpenBSD ISOs with all the patches already applied... ISO can't wait! This week's news and answers to all your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
pfSense 2.1.4 released (https://blog.pfsense.org/?p=1377)
The pfSense team (http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense) has released 2.1.4, shortly after 2.1.3 - it's mainly a security release
Included within are eight security fixes, most of which are pfSense-specific
OpenSSL, the WebUI and some packages all need to be patched (and there are instructions on how to do so)
It also includes a large number of various other bug fixes
Update all your routers!
***
DragonflyBSD's pf gets SMP (http://lists.dragonflybsd.org/pipermail/commits/2014-June/270300.html)
While we're on the topic of pf...
Dragonfly patches their old[er than even FreeBSD's] pf to support multithreading in many areas
Stemming from a user's complaint (http://lists.dragonflybsd.org/pipermail/users/2014-June/128664.html), Matthew Dillon did his own work on pf to make it SMP-aware
Altering your configuration (http://lists.dragonflybsd.org/pipermail/users/2014-June/128671.html)'s ruleset can also help speed things up, he found
When will OpenBSD, the source of pf, finally do the same?
***
ChaCha usage and deployment (http://ianix.com/pub/chacha-deployment.html)
A while back, we talked to djm (http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline) about some cryptography changes in OpenBSD 5.5 and OpenSSH 6.5
This article is sort of an interesting follow-up to that, showing which projects have adopted ChaCha20
OpenSSH offers it as a stream cipher now, OpenBSD uses it for it's random number generator, Google offers it in TLS for Chromium and some of their services and lots of other projects seem to be adopting it
Both Google's fork of OpenSSL and LibReSSL have upcoming implementations, while vanilla OpenSSL does not
Unfortunately, this article has one mistake: FreeBSD does not use it (https://lists.freebsd.org/pipermail/freebsd-bugs/2013-October/054018.html) - they still use the broken RC4 algorithm
***
BSDMag June 2014 issue (http://bsdmag.org/magazine/1864-tls-hardening-june-bsd-magazine-issue)
The monthly online BSD magazine releases their newest issue
This one includes the following articles: TLS hardening, setting up a package cluster in MidnightBSD, more GIMP tutorials, "saving time and headaches using the robot framework for testing," an interview and an article about the increasing number of security vulnerabilities
The free pdf file is available for download as always
***
Interview - Craig Rodrigues - rodrigc@freebsd.org (mailto:rodrigc@freebsd.org)
FreeBSD's continuous (https://wiki.freebsd.org/Jenkins) testing (https://docs.google.com/presentation/d/1yBiPxS1nKnVwRlAEsYeAOzYdpG5uzXTv1_7i7jwVCfU/edit#slide=id.p) infrastructure (https://jenkins.freebsd.org/jenkins/)
Tutorial
Creating pre-patched OpenBSD ISOs (http://www.bsdnow.tv/tutorials/stable-iso)
News Roundup
Preauthenticated decryption considered harmful (http://www.tedunangst.com/flak/post/preauthenticated-decryption-considered-harmful)
Responding to a post (https://www.imperialviolet.org/2014/06/27/streamingencryption.html) from Adam Langley, Ted Unangst (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures) talks a little more about how signify and pkg_add handle signatures
In the past, the OpenBSD installer would pipe the output of ftp straight to tar, but then verify the SHA256 at the end - this had the advantage of not requiring any extra disk space, but raised some security concerns
With signify, now everything is fully downloaded and verified before tar is even invoked
The pkg_add utility works a little bit differently, but it's also been improved in this area - details in the post
Be sure to also read the original post from Adam, lots of good information
***
FreeBSD 9.3-RC2 is out (https://lists.freebsd.org/pipermail/freebsd-stable/2014-June/079092.html)
As the -RELEASE inches closer, release candidate 2 is out and ready for testing
Since the last one, it's got some fixes for NIC drivers, the latest file and libmagic security fixes, some serial port workarounds and various other small things
The updated bsdconfig will use pkgng style packages now too
A lesser known fact: there are also premade virtual machine images you can use too
***
pkgsrcCon 2014 wrap-up (http://saveosx.org/pkgsrcCon/)
In what may be the first real pkgsrcCon article we've ever had!
Includes wrap-up discussion about the event, the talks, the speakers themselves, what they use pkgsrc for, the hackathon and basically the whole event
Unfortunately no recordings to be found...
***
PostgreSQL FreeBSD performance and scalability (https://kib.kiev.ua/kib/pgsql_perf.pdf)
FreeBSD developer kib@ writes a report on PostgreSQL on FreeBSD, and how it scales
On his monster 40-core box with 1TB of RAM, he runs lots of benchmarks and posts the findings
Lots of technical details if you're interested in getting the best performance out of your hardware
It also includes specific kernel options he used and the rest of the configuration
If you don't want to open the pdf file, you can use this link (https://docs.google.com/viewer?url=https%3A%2F%2Fkib.kiev.ua%2Fkib%2Fpgsql_perf.pdf) too
***
Feedback/Questions
James writes in (http://slexy.org/view/s24pFjUPe4)
Klemen writes in (http://slexy.org/view/s21OogIgTu)
John writes in (http://slexy.org/view/s21rLcemNN)
Brad writes in (http://slexy.org/view/s203Qsx6CZ)
Adam writes in (http://slexy.org/view/s2eBj0FfSL)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, iso, patch, stable, cd, dvd, cdr, pre-applied, applied, horrible puns, jenkins, testing, kyua, ixsystems, tarsnap, pfsense, freenas, tarsnap, ixsystems, pfsense, freenas, bsdmag, magazine, ssl, tls, hardening, hardened, security, pf, smp, multithreading, firewall, scalability, postgresql, mysql, sql, database, performance, openssl, libressl, boringssl, google, chacha, chacha20, salsa20, encryption, pkgsrc, pkgsrccon, signify, pkg_add, authenticated encryption, decryption, gcm</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ll be sitting down to talk with Craig Rodrigues about Jenkins and the FreeBSD testing infrastructure. Following that, we&#39;ll show you how to roll your own OpenBSD ISOs with all the patches already applied... ISO can&#39;t wait! This week&#39;s news and answers to all your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.pfsense.org/?p=1377" rel="nofollow">pfSense 2.1.4 released</a></h3>

<ul>
<li>The <a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">pfSense team</a> has released 2.1.4, shortly after 2.1.3 - it&#39;s mainly a security release</li>
<li>Included within are eight security fixes, most of which are pfSense-specific</li>
<li>OpenSSL, the WebUI and some packages all need to be patched (and there are instructions on how to do so)</li>
<li>It also includes a large number of various other bug fixes</li>
<li>Update all your routers!
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2014-June/270300.html" rel="nofollow">DragonflyBSD&#39;s pf gets SMP</a></h3>

<ul>
<li>While we&#39;re on the topic of pf...</li>
<li>Dragonfly patches their old[er than even FreeBSD&#39;s] pf to support multithreading in many areas</li>
<li>Stemming from <a href="http://lists.dragonflybsd.org/pipermail/users/2014-June/128664.html" rel="nofollow">a user&#39;s complaint</a>, Matthew Dillon did his own work on pf to make it SMP-aware</li>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2014-June/128671.html" rel="nofollow">Altering your configuration</a>&#39;s ruleset can also help speed things up, he found</li>
<li>When will OpenBSD, the source of pf, finally do the same?
***</li>
</ul>

<h3><a href="http://ianix.com/pub/chacha-deployment.html" rel="nofollow">ChaCha usage and deployment</a></h3>

<ul>
<li>A while back, <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">we talked to djm</a> about some cryptography changes in OpenBSD 5.5 and OpenSSH 6.5</li>
<li>This article is sort of an interesting follow-up to that, showing which projects have adopted ChaCha20</li>
<li>OpenSSH offers it as a stream cipher now, OpenBSD uses it for it&#39;s random number generator, Google offers it in TLS for Chromium and some of their services and lots of other projects seem to be adopting it</li>
<li>Both Google&#39;s fork of OpenSSL and LibReSSL have upcoming implementations, while vanilla OpenSSL does not</li>
<li>Unfortunately, this article has one mistake: FreeBSD <a href="https://lists.freebsd.org/pipermail/freebsd-bugs/2013-October/054018.html" rel="nofollow">does not use it</a> - they <em>still</em> use the broken RC4 algorithm
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1864-tls-hardening-june-bsd-magazine-issue" rel="nofollow">BSDMag June 2014 issue</a></h3>

<ul>
<li>The monthly online BSD magazine releases their newest issue</li>
<li>This one includes the following articles: TLS hardening, setting up a package cluster in MidnightBSD, more GIMP tutorials, &quot;saving time and headaches using the robot framework for testing,&quot; an interview and an article about the increasing number of security vulnerabilities</li>
<li>The free pdf file is available for download as always
***</li>
</ul>

<h2>Interview - Craig Rodrigues - <a href="mailto:rodrigc@freebsd.org" rel="nofollow">rodrigc@freebsd.org</a></h2>

<p>FreeBSD&#39;s <a href="https://wiki.freebsd.org/Jenkins" rel="nofollow">continuous</a> <a href="https://docs.google.com/presentation/d/1yBiPxS1nKnVwRlAEsYeAOzYdpG5uzXTv1_7i7jwVCfU/edit#slide=id.p" rel="nofollow">testing</a> <a href="https://jenkins.freebsd.org/jenkins/" rel="nofollow">infrastructure</a></p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/stable-iso" rel="nofollow">Creating pre-patched OpenBSD ISOs</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.tedunangst.com/flak/post/preauthenticated-decryption-considered-harmful" rel="nofollow">Preauthenticated decryption considered harmful</a></h3>

<ul>
<li>Responding to <a href="https://www.imperialviolet.org/2014/06/27/streamingencryption.html" rel="nofollow">a post</a> from Adam Langley, <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> talks a little more about how signify and pkg_add handle signatures</li>
<li>In the past, the OpenBSD installer would pipe the output of ftp straight to tar, but then verify the SHA256 at the end - this had the advantage of not requiring any extra disk space, but raised some security concerns</li>
<li>With signify, now everything is fully downloaded and verified before tar is even invoked</li>
<li>The pkg_add utility works a little bit differently, but it&#39;s also been improved in this area - details in the post</li>
<li>Be sure to also read the original post from Adam, lots of good information
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-June/079092.html" rel="nofollow">FreeBSD 9.3-RC2 is out</a></h3>

<ul>
<li>As the -RELEASE inches closer, release candidate 2 is out and ready for testing</li>
<li>Since the last one, it&#39;s got some fixes for NIC drivers, the latest file and libmagic security fixes, some serial port workarounds and various other small things</li>
<li>The updated bsdconfig will use pkgng style packages now too</li>
<li>A lesser known fact: there are also premade virtual machine images you can use too
***</li>
</ul>

<h3><a href="http://saveosx.org/pkgsrcCon/" rel="nofollow">pkgsrcCon 2014 wrap-up</a></h3>

<ul>
<li>In what may be the first real pkgsrcCon article we&#39;ve ever had!</li>
<li>Includes wrap-up discussion about the event, the talks, the speakers themselves, what they use pkgsrc for, the hackathon and basically the whole event</li>
<li>Unfortunately no recordings to be found...
***</li>
</ul>

<h3><a href="https://kib.kiev.ua/kib/pgsql_perf.pdf" rel="nofollow">PostgreSQL FreeBSD performance and scalability</a></h3>

<ul>
<li>FreeBSD developer kib@ writes a report on PostgreSQL on FreeBSD, and how it scales</li>
<li>On his monster 40-core box with 1TB of RAM, he runs lots of benchmarks and posts the findings</li>
<li>Lots of technical details if you&#39;re interested in getting the best performance out of your hardware</li>
<li>It also includes specific kernel options he used and the rest of the configuration</li>
<li>If you don&#39;t want to open the pdf file, you can <a href="https://docs.google.com/viewer?url=https%3A%2F%2Fkib.kiev.ua%2Fkib%2Fpgsql_perf.pdf" rel="nofollow">use this link</a> too
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s24pFjUPe4" rel="nofollow">James writes in</a></li>
<li><a href="http://slexy.org/view/s21OogIgTu" rel="nofollow">Klemen writes in</a></li>
<li><a href="http://slexy.org/view/s21rLcemNN" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s203Qsx6CZ" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s2eBj0FfSL" rel="nofollow">Adam writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ll be sitting down to talk with Craig Rodrigues about Jenkins and the FreeBSD testing infrastructure. Following that, we&#39;ll show you how to roll your own OpenBSD ISOs with all the patches already applied... ISO can&#39;t wait! This week&#39;s news and answers to all your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://blog.pfsense.org/?p=1377" rel="nofollow">pfSense 2.1.4 released</a></h3>

<ul>
<li>The <a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">pfSense team</a> has released 2.1.4, shortly after 2.1.3 - it&#39;s mainly a security release</li>
<li>Included within are eight security fixes, most of which are pfSense-specific</li>
<li>OpenSSL, the WebUI and some packages all need to be patched (and there are instructions on how to do so)</li>
<li>It also includes a large number of various other bug fixes</li>
<li>Update all your routers!
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2014-June/270300.html" rel="nofollow">DragonflyBSD&#39;s pf gets SMP</a></h3>

<ul>
<li>While we&#39;re on the topic of pf...</li>
<li>Dragonfly patches their old[er than even FreeBSD&#39;s] pf to support multithreading in many areas</li>
<li>Stemming from <a href="http://lists.dragonflybsd.org/pipermail/users/2014-June/128664.html" rel="nofollow">a user&#39;s complaint</a>, Matthew Dillon did his own work on pf to make it SMP-aware</li>
<li><a href="http://lists.dragonflybsd.org/pipermail/users/2014-June/128671.html" rel="nofollow">Altering your configuration</a>&#39;s ruleset can also help speed things up, he found</li>
<li>When will OpenBSD, the source of pf, finally do the same?
***</li>
</ul>

<h3><a href="http://ianix.com/pub/chacha-deployment.html" rel="nofollow">ChaCha usage and deployment</a></h3>

<ul>
<li>A while back, <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">we talked to djm</a> about some cryptography changes in OpenBSD 5.5 and OpenSSH 6.5</li>
<li>This article is sort of an interesting follow-up to that, showing which projects have adopted ChaCha20</li>
<li>OpenSSH offers it as a stream cipher now, OpenBSD uses it for it&#39;s random number generator, Google offers it in TLS for Chromium and some of their services and lots of other projects seem to be adopting it</li>
<li>Both Google&#39;s fork of OpenSSL and LibReSSL have upcoming implementations, while vanilla OpenSSL does not</li>
<li>Unfortunately, this article has one mistake: FreeBSD <a href="https://lists.freebsd.org/pipermail/freebsd-bugs/2013-October/054018.html" rel="nofollow">does not use it</a> - they <em>still</em> use the broken RC4 algorithm
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1864-tls-hardening-june-bsd-magazine-issue" rel="nofollow">BSDMag June 2014 issue</a></h3>

<ul>
<li>The monthly online BSD magazine releases their newest issue</li>
<li>This one includes the following articles: TLS hardening, setting up a package cluster in MidnightBSD, more GIMP tutorials, &quot;saving time and headaches using the robot framework for testing,&quot; an interview and an article about the increasing number of security vulnerabilities</li>
<li>The free pdf file is available for download as always
***</li>
</ul>

<h2>Interview - Craig Rodrigues - <a href="mailto:rodrigc@freebsd.org" rel="nofollow">rodrigc@freebsd.org</a></h2>

<p>FreeBSD&#39;s <a href="https://wiki.freebsd.org/Jenkins" rel="nofollow">continuous</a> <a href="https://docs.google.com/presentation/d/1yBiPxS1nKnVwRlAEsYeAOzYdpG5uzXTv1_7i7jwVCfU/edit#slide=id.p" rel="nofollow">testing</a> <a href="https://jenkins.freebsd.org/jenkins/" rel="nofollow">infrastructure</a></p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/stable-iso" rel="nofollow">Creating pre-patched OpenBSD ISOs</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.tedunangst.com/flak/post/preauthenticated-decryption-considered-harmful" rel="nofollow">Preauthenticated decryption considered harmful</a></h3>

<ul>
<li>Responding to <a href="https://www.imperialviolet.org/2014/06/27/streamingencryption.html" rel="nofollow">a post</a> from Adam Langley, <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> talks a little more about how signify and pkg_add handle signatures</li>
<li>In the past, the OpenBSD installer would pipe the output of ftp straight to tar, but then verify the SHA256 at the end - this had the advantage of not requiring any extra disk space, but raised some security concerns</li>
<li>With signify, now everything is fully downloaded and verified before tar is even invoked</li>
<li>The pkg_add utility works a little bit differently, but it&#39;s also been improved in this area - details in the post</li>
<li>Be sure to also read the original post from Adam, lots of good information
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-June/079092.html" rel="nofollow">FreeBSD 9.3-RC2 is out</a></h3>

<ul>
<li>As the -RELEASE inches closer, release candidate 2 is out and ready for testing</li>
<li>Since the last one, it&#39;s got some fixes for NIC drivers, the latest file and libmagic security fixes, some serial port workarounds and various other small things</li>
<li>The updated bsdconfig will use pkgng style packages now too</li>
<li>A lesser known fact: there are also premade virtual machine images you can use too
***</li>
</ul>

<h3><a href="http://saveosx.org/pkgsrcCon/" rel="nofollow">pkgsrcCon 2014 wrap-up</a></h3>

<ul>
<li>In what may be the first real pkgsrcCon article we&#39;ve ever had!</li>
<li>Includes wrap-up discussion about the event, the talks, the speakers themselves, what they use pkgsrc for, the hackathon and basically the whole event</li>
<li>Unfortunately no recordings to be found...
***</li>
</ul>

<h3><a href="https://kib.kiev.ua/kib/pgsql_perf.pdf" rel="nofollow">PostgreSQL FreeBSD performance and scalability</a></h3>

<ul>
<li>FreeBSD developer kib@ writes a report on PostgreSQL on FreeBSD, and how it scales</li>
<li>On his monster 40-core box with 1TB of RAM, he runs lots of benchmarks and posts the findings</li>
<li>Lots of technical details if you&#39;re interested in getting the best performance out of your hardware</li>
<li>It also includes specific kernel options he used and the rest of the configuration</li>
<li>If you don&#39;t want to open the pdf file, you can <a href="https://docs.google.com/viewer?url=https%3A%2F%2Fkib.kiev.ua%2Fkib%2Fpgsql_perf.pdf" rel="nofollow">use this link</a> too
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s24pFjUPe4" rel="nofollow">James writes in</a></li>
<li><a href="http://slexy.org/view/s21OogIgTu" rel="nofollow">Klemen writes in</a></li>
<li><a href="http://slexy.org/view/s21rLcemNN" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s203Qsx6CZ" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s2eBj0FfSL" rel="nofollow">Adam writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>43: Package Design</title>
  <link>https://www.bsdnow.tv/43</link>
  <guid isPermaLink="false">d4b10034-d20a-44a6-a918-a57335debcae</guid>
  <pubDate>Wed, 25 Jun 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d4b10034-d20a-44a6-a918-a57335debcae.mp3" length="62389876" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>It's a big show this week! We'll be interviewing Marc Espie about OpenBSD's package system and build cluster. Also, we've been asked many times "how do I keep my BSD box up to date?" Well, today's tutorial should finally answer that. Answers to all your emails and this week's headlines, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:26:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>It's a big show this week! We'll be interviewing Marc Espie about OpenBSD's package system and build cluster. Also, we've been asked many times "how do I keep my BSD box up to date?" Well, today's tutorial should finally answer that. Answers to all your emails and this week's headlines, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
EuroBSDCon 2014 talks and schedule (http://2014.eurobsdcon.org/talks-and-schedule/)
The talks and schedules for EuroBSDCon 2014 are finally revealed
The opening keynote is called "FreeBSD, looking forward to another 10 years" by jkh
Lots of talks spanning FreeBSD, OpenBSD and PCBSD, and we finally have a few about NetBSD and DragonflyBSD too! Variety is great
It looks like Theo even has a talk, but the title isn't on the page... how mysterious
There are also days dedicated to some really interesting tutorials
Register now, the conference is on September 25-28th in Bulgaria
If you see Allan and Kris walking towards you and you haven't given us an interview yet... well you know what's going to happen
Why aren't the videos up from last year yet? Will this year also not have any?
***
FreeNAS vs NAS4Free (http://arstechnica.com/information-technology/2014/06/the-ars-nas-distribution-shootout-freenas-vs-nas4free/)
More mainstream news covering BSD, this time with an article about different NAS solutions
In a possibly excessive eight-page article, Ars Technica discusses the pros and cons of both FreeNAS and NAS4Free
Both are based on FreeBSD and ZFS of course, but there are more differences than you might expect
Discusses the different development models, release cycles, features, interfaces and ease-of-use factor of each project
"One is pleasantly functional; the other continues devolving during a journey of pain" - uh oh, who's the loser?
***
Quality software costs money, heartbleed was free (https://queue.acm.org/detail.cfm?id=2636165)
PHK (http://www.bsdnow.tv/episodes/2013_10_16-go_directly_to_jail) writes an article for ACM Queue about open source software projects' funding efforts
A lot of people don't realize just how widespread open source software is - TVs, printers, gaming consoles, etc
The article discusses ways to convince your workplace to fund open source efforts, then goes into a little bit about FreeBSD and Varnish's funding
The latest heartbleed vulnerability should teach everyone that open source projects are critical to the internet, and need people actively maintaining them
On that subject, "Earlier this year the OpenSSL Heartbleed bug laid waste to Internet security, and there are still hundreds of thousands of embedded devices of all kinds—probably your television among them—that have not been and will not ever be software-upgraded to fix it. The best way to prevent that from happening again is to avoid having bugs of that kind go undiscovered for several years, and the only way to avoid that is to have competent people paying attention to the software"
Consider donating to your favorite BSD foundation (or buying cool shirts and CDs!) and keeping the ecosystem alive
***
Geoblock evasion with pf and OpenBSD rdomains (https://matt.bionicmessage.net/blog/2014/06/21/Advanced%20Geoblock%20evasion%20with%20OpenBSD%20pf%20and%20rdomain%27s)
Geoblocking is a way for websites to block visitors based on the location of their IP
This is a blog post about how to get around it, using pf and rdomains
It has the advantage of not requiring any browser plugins or DNS settings on the users' computers, you just need to be running OpenBSD on your router (hmm, if only a website had a tutorial about that (http://www.bsdnow.tv/tutorials/openbsd-router)...)
In this post, the author wanted to get an American IP address, since the service he was using (Netflix) is blocked in Australia
It's got all the details you need to set up a VPN-like system and bypass those pesky geographic filters
***
Interview - Marc Espie - espie@openbsd.org (mailto:espie@openbsd.org) / @espie_openbsd (https://twitter.com/espie_openbsd)
OpenBSD's package system, building cluster, various topics
Tutorial
Keeping your BSD up to date (http://www.bsdnow.tv/tutorials/upgrade)
News Roundup
BoringSSL and LibReSSL (https://www.imperialviolet.org/2014/06/20/boringssl.html)
Yet another OpenSSL fork pops up, this time from Google, called BoringSSL
Adam Langley has a blog post about it, why they did it and how they're going to maintain it
You can easily browse the source code (https://boringssl.googlesource.com/)
Theo de Raadt also weighs in (http://marc.info/?l=openbsd-tech&amp;amp;m=140332790726752&amp;amp;w=2) with how this effort relates to LibReSSL
More eyes on the code is good, and patches will be shared between the two projects
***
More BSD Tor nodes wanted (http://lists.nycbug.org/pipermail/tor-bsd/2014-June/000129.html)
Friend of the show bcallah posts some news to the Tor-BSD mailing list about monoculture in the Tor network being both bad and dangerous
Originally discussed (https://lists.torproject.org/pipermail/tor-relays/2014-June/004699.html) on the Tor-Relays list, it was made apparent that having such a large amount of Linux nodes weakens the security of the whole network
If one vulnerability is found, a huge portion of the network would be useless - we need more variety in the network stacks, crypto, etc.
The EFF is also holding a Tor challenge (https://www.eff.org/torchallenge/) for people to start up new relays and keep them online for over a year
Check out our Tor tutorial (http://www.bsdnow.tv/tutorials/tor) and help out the network, and promote BSD at the same time!
***
FreeBSD 10 OpenStack images (https://raymii.org/s/tutorials/FreeBSD_10.0-release_Openstack_Image.html)
OpenStack, to quote Wikipedia, is "a free and open-source software cloud computing platform. It is primarily deployed as an infrastructure as a service (IaaS) solution."
The article goes into detail about creating a FreeBSD instant, installing and converting it for use with "bsd-cloudinit"
The author of the article is a regular listener and emailer of the show, hey!
***
BSDday 2014 call for papers (https://lists.freebsd.org/pipermail/freebsd-advocacy/2014-June/004465.html)
BSD Day, a conference not so well-known, is going to be held August 9th in Argentina
It was created in 2008 and is the only BSD conference around that area
The "call for papers" was issued, so if you're around Argentina and use BSD, consider submitting a talk
Sysadmins, developers and regular users are, of course, all welcome to come to the event
***
Feedback/Questions
Maruf writes in (http://slexy.org/view/s20nTYO2w1)
Solomon writes in (http://slexy.org/view/s21cvV6mRP)
Silas writes in (http://slexy.org/view/s2MK8sbea0)
Bert writes in (http://slexy.org/view/s2Yz97YlzI)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ports, packages, cluster, building, pkg_add, freenas, ixsystems, tarsnap, eurobsdcon, bulgaria, 2014, talks, presentation, slides, Poul-Henning Kamp, phk, schedule, freenas, nas4free, nas, geoblock, evasion, bypassing, ip ban, pf, firewall, rdomains, glusterfs, marc espie, boringssl, openssl, libressl, upgrades, how to upgrade, update, rebuild, tor, tor nodes, relays, exit node, eff, tor challenge, aslr, pie, security, bsdday, openstack, bsd-cloudinit, cloud computing</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>It&#39;s a big show this week! We&#39;ll be interviewing Marc Espie about OpenBSD&#39;s package system and build cluster. Also, we&#39;ve been asked many times &quot;how do I keep my BSD box up to date?&quot; Well, today&#39;s tutorial should finally answer that. Answers to all your emails and this week&#39;s headlines, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.eurobsdcon.org/talks-and-schedule/" rel="nofollow">EuroBSDCon 2014 talks and schedule</a></h3>

<ul>
<li>The talks and schedules for EuroBSDCon 2014 are finally revealed</li>
<li>The opening keynote is called &quot;FreeBSD, looking forward to another 10 years&quot; by jkh</li>
<li>Lots of talks spanning FreeBSD, OpenBSD and PCBSD, and we finally have a few about NetBSD and DragonflyBSD too! Variety is great</li>
<li>It looks like Theo even has a talk, but the title isn&#39;t on the page... how mysterious</li>
<li>There are also days dedicated to some really interesting tutorials</li>
<li>Register now, the conference is on September 25-28th in Bulgaria</li>
<li>If you see Allan and Kris walking towards you and you haven&#39;t given us an interview yet... well you know what&#39;s going to happen</li>
<li>Why aren&#39;t the videos up from last year yet? Will this year also not have any?
***</li>
</ul>

<h3><a href="http://arstechnica.com/information-technology/2014/06/the-ars-nas-distribution-shootout-freenas-vs-nas4free/" rel="nofollow">FreeNAS vs NAS4Free</a></h3>

<ul>
<li>More mainstream news covering BSD, this time with an article about different NAS solutions</li>
<li>In a possibly excessive eight-page article, Ars Technica discusses the pros and cons of both FreeNAS and NAS4Free</li>
<li>Both are based on FreeBSD and ZFS of course, but there are more differences than you might expect</li>
<li>Discusses the different development models, release cycles, features, interfaces and ease-of-use factor of each project</li>
<li>&quot;One is pleasantly functional; the other continues devolving during a journey of pain&quot; - uh oh, who&#39;s the loser?
***</li>
</ul>

<h3><a href="https://queue.acm.org/detail.cfm?id=2636165" rel="nofollow">Quality software costs money, heartbleed was free</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2013_10_16-go_directly_to_jail" rel="nofollow">PHK</a> writes an article for ACM Queue about open source software projects&#39; funding efforts</li>
<li>A lot of people don&#39;t realize just how widespread open source software is - TVs, printers, gaming consoles, etc</li>
<li>The article discusses ways to convince your workplace to fund open source efforts, then goes into a little bit about FreeBSD and Varnish&#39;s funding</li>
<li>The latest heartbleed vulnerability should teach everyone that open source projects are critical to the internet, and need people actively maintaining them</li>
<li>On that subject, &quot;Earlier this year the OpenSSL Heartbleed bug laid waste to Internet security, and there are still hundreds of thousands of embedded devices of all kinds—probably your television among them—that have not been and will not ever be software-upgraded to fix it. The best way to prevent that from happening again is to avoid having bugs of that kind go undiscovered for several years, and the only way to avoid that is to have competent people paying attention to the software&quot;</li>
<li>Consider donating to your favorite BSD foundation (or buying cool shirts and CDs!) and keeping the ecosystem alive
***</li>
</ul>

<h3><a href="https://matt.bionicmessage.net/blog/2014/06/21/Advanced%20Geoblock%20evasion%20with%20OpenBSD%20pf%20and%20rdomain%27s" rel="nofollow">Geoblock evasion with pf and OpenBSD rdomains</a></h3>

<ul>
<li>Geoblocking is a way for websites to block visitors based on the location of their IP</li>
<li>This is a blog post about how to get around it, using pf and rdomains</li>
<li>It has the advantage of not requiring any browser plugins or DNS settings on the users&#39; computers, you just need to be running OpenBSD on your router (hmm, if only a website had <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">a tutorial about that</a>...)</li>
<li>In this post, the author wanted to get an American IP address, since the service he was using (Netflix) is blocked in Australia</li>
<li>It&#39;s got all the details you need to set up a VPN-like system and bypass those pesky geographic filters
***</li>
</ul>

<h2>Interview - Marc Espie - <a href="mailto:espie@openbsd.org" rel="nofollow">espie@openbsd.org</a> / <a href="https://twitter.com/espie_openbsd" rel="nofollow">@espie_openbsd</a></h2>

<p>OpenBSD&#39;s package system, building cluster, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/upgrade" rel="nofollow">Keeping your BSD up to date</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.imperialviolet.org/2014/06/20/boringssl.html" rel="nofollow">BoringSSL and LibReSSL</a></h3>

<ul>
<li>Yet another OpenSSL fork pops up, this time from Google, called BoringSSL</li>
<li>Adam Langley has a blog post about it, why they did it and how they&#39;re going to maintain it</li>
<li>You can easily browse <a href="https://boringssl.googlesource.com/" rel="nofollow">the source code</a></li>
<li>Theo de Raadt also <a href="http://marc.info/?l=openbsd-tech&m=140332790726752&w=2" rel="nofollow">weighs in</a> with how this effort relates to LibReSSL</li>
<li>More eyes on the code is good, and patches will be shared between the two projects
***</li>
</ul>

<h3><a href="http://lists.nycbug.org/pipermail/tor-bsd/2014-June/000129.html" rel="nofollow">More BSD Tor nodes wanted</a></h3>

<ul>
<li>Friend of the show bcallah posts some news to the Tor-BSD mailing list about monoculture in the Tor network being both bad and dangerous</li>
<li><a href="https://lists.torproject.org/pipermail/tor-relays/2014-June/004699.html" rel="nofollow">Originally discussed</a> on the Tor-Relays list, it was made apparent that having such a large amount of Linux nodes weakens the security of the whole network</li>
<li>If one vulnerability is found, a huge portion of the network would be useless - we need more variety in the network stacks, crypto, etc.</li>
<li>The EFF is also holding a <a href="https://www.eff.org/torchallenge/" rel="nofollow">Tor challenge</a> for people to start up new relays and keep them online for over a year</li>
<li>Check out our <a href="http://www.bsdnow.tv/tutorials/tor" rel="nofollow">Tor tutorial</a> and help out the network, and promote BSD at the same time!
***</li>
</ul>

<h3><a href="https://raymii.org/s/tutorials/FreeBSD_10.0-release_Openstack_Image.html" rel="nofollow">FreeBSD 10 OpenStack images</a></h3>

<ul>
<li>OpenStack, to quote Wikipedia, is &quot;a free and open-source software cloud computing platform. It is primarily deployed as an infrastructure as a service (IaaS) solution.&quot;</li>
<li>The article goes into detail about creating a FreeBSD instant, installing and converting it for use with &quot;bsd-cloudinit&quot;</li>
<li>The author of the article is a regular listener and emailer of the show, hey!
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-advocacy/2014-June/004465.html" rel="nofollow">BSDday 2014 call for papers</a></h3>

<ul>
<li>BSD Day, a conference not so well-known, is going to be held August 9th in Argentina</li>
<li>It was created in 2008 and is the only BSD conference around that area</li>
<li>The &quot;call for papers&quot; was issued, so if you&#39;re around Argentina and use BSD, consider submitting a talk</li>
<li>Sysadmins, developers and regular users are, of course, all welcome to come to the event
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20nTYO2w1" rel="nofollow">Maruf writes in</a></li>
<li><a href="http://slexy.org/view/s21cvV6mRP" rel="nofollow">Solomon writes in</a></li>
<li><a href="http://slexy.org/view/s2MK8sbea0" rel="nofollow">Silas writes in</a></li>
<li><a href="http://slexy.org/view/s2Yz97YlzI" rel="nofollow">Bert writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>It&#39;s a big show this week! We&#39;ll be interviewing Marc Espie about OpenBSD&#39;s package system and build cluster. Also, we&#39;ve been asked many times &quot;how do I keep my BSD box up to date?&quot; Well, today&#39;s tutorial should finally answer that. Answers to all your emails and this week&#39;s headlines, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.eurobsdcon.org/talks-and-schedule/" rel="nofollow">EuroBSDCon 2014 talks and schedule</a></h3>

<ul>
<li>The talks and schedules for EuroBSDCon 2014 are finally revealed</li>
<li>The opening keynote is called &quot;FreeBSD, looking forward to another 10 years&quot; by jkh</li>
<li>Lots of talks spanning FreeBSD, OpenBSD and PCBSD, and we finally have a few about NetBSD and DragonflyBSD too! Variety is great</li>
<li>It looks like Theo even has a talk, but the title isn&#39;t on the page... how mysterious</li>
<li>There are also days dedicated to some really interesting tutorials</li>
<li>Register now, the conference is on September 25-28th in Bulgaria</li>
<li>If you see Allan and Kris walking towards you and you haven&#39;t given us an interview yet... well you know what&#39;s going to happen</li>
<li>Why aren&#39;t the videos up from last year yet? Will this year also not have any?
***</li>
</ul>

<h3><a href="http://arstechnica.com/information-technology/2014/06/the-ars-nas-distribution-shootout-freenas-vs-nas4free/" rel="nofollow">FreeNAS vs NAS4Free</a></h3>

<ul>
<li>More mainstream news covering BSD, this time with an article about different NAS solutions</li>
<li>In a possibly excessive eight-page article, Ars Technica discusses the pros and cons of both FreeNAS and NAS4Free</li>
<li>Both are based on FreeBSD and ZFS of course, but there are more differences than you might expect</li>
<li>Discusses the different development models, release cycles, features, interfaces and ease-of-use factor of each project</li>
<li>&quot;One is pleasantly functional; the other continues devolving during a journey of pain&quot; - uh oh, who&#39;s the loser?
***</li>
</ul>

<h3><a href="https://queue.acm.org/detail.cfm?id=2636165" rel="nofollow">Quality software costs money, heartbleed was free</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2013_10_16-go_directly_to_jail" rel="nofollow">PHK</a> writes an article for ACM Queue about open source software projects&#39; funding efforts</li>
<li>A lot of people don&#39;t realize just how widespread open source software is - TVs, printers, gaming consoles, etc</li>
<li>The article discusses ways to convince your workplace to fund open source efforts, then goes into a little bit about FreeBSD and Varnish&#39;s funding</li>
<li>The latest heartbleed vulnerability should teach everyone that open source projects are critical to the internet, and need people actively maintaining them</li>
<li>On that subject, &quot;Earlier this year the OpenSSL Heartbleed bug laid waste to Internet security, and there are still hundreds of thousands of embedded devices of all kinds—probably your television among them—that have not been and will not ever be software-upgraded to fix it. The best way to prevent that from happening again is to avoid having bugs of that kind go undiscovered for several years, and the only way to avoid that is to have competent people paying attention to the software&quot;</li>
<li>Consider donating to your favorite BSD foundation (or buying cool shirts and CDs!) and keeping the ecosystem alive
***</li>
</ul>

<h3><a href="https://matt.bionicmessage.net/blog/2014/06/21/Advanced%20Geoblock%20evasion%20with%20OpenBSD%20pf%20and%20rdomain%27s" rel="nofollow">Geoblock evasion with pf and OpenBSD rdomains</a></h3>

<ul>
<li>Geoblocking is a way for websites to block visitors based on the location of their IP</li>
<li>This is a blog post about how to get around it, using pf and rdomains</li>
<li>It has the advantage of not requiring any browser plugins or DNS settings on the users&#39; computers, you just need to be running OpenBSD on your router (hmm, if only a website had <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">a tutorial about that</a>...)</li>
<li>In this post, the author wanted to get an American IP address, since the service he was using (Netflix) is blocked in Australia</li>
<li>It&#39;s got all the details you need to set up a VPN-like system and bypass those pesky geographic filters
***</li>
</ul>

<h2>Interview - Marc Espie - <a href="mailto:espie@openbsd.org" rel="nofollow">espie@openbsd.org</a> / <a href="https://twitter.com/espie_openbsd" rel="nofollow">@espie_openbsd</a></h2>

<p>OpenBSD&#39;s package system, building cluster, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/upgrade" rel="nofollow">Keeping your BSD up to date</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.imperialviolet.org/2014/06/20/boringssl.html" rel="nofollow">BoringSSL and LibReSSL</a></h3>

<ul>
<li>Yet another OpenSSL fork pops up, this time from Google, called BoringSSL</li>
<li>Adam Langley has a blog post about it, why they did it and how they&#39;re going to maintain it</li>
<li>You can easily browse <a href="https://boringssl.googlesource.com/" rel="nofollow">the source code</a></li>
<li>Theo de Raadt also <a href="http://marc.info/?l=openbsd-tech&m=140332790726752&w=2" rel="nofollow">weighs in</a> with how this effort relates to LibReSSL</li>
<li>More eyes on the code is good, and patches will be shared between the two projects
***</li>
</ul>

<h3><a href="http://lists.nycbug.org/pipermail/tor-bsd/2014-June/000129.html" rel="nofollow">More BSD Tor nodes wanted</a></h3>

<ul>
<li>Friend of the show bcallah posts some news to the Tor-BSD mailing list about monoculture in the Tor network being both bad and dangerous</li>
<li><a href="https://lists.torproject.org/pipermail/tor-relays/2014-June/004699.html" rel="nofollow">Originally discussed</a> on the Tor-Relays list, it was made apparent that having such a large amount of Linux nodes weakens the security of the whole network</li>
<li>If one vulnerability is found, a huge portion of the network would be useless - we need more variety in the network stacks, crypto, etc.</li>
<li>The EFF is also holding a <a href="https://www.eff.org/torchallenge/" rel="nofollow">Tor challenge</a> for people to start up new relays and keep them online for over a year</li>
<li>Check out our <a href="http://www.bsdnow.tv/tutorials/tor" rel="nofollow">Tor tutorial</a> and help out the network, and promote BSD at the same time!
***</li>
</ul>

<h3><a href="https://raymii.org/s/tutorials/FreeBSD_10.0-release_Openstack_Image.html" rel="nofollow">FreeBSD 10 OpenStack images</a></h3>

<ul>
<li>OpenStack, to quote Wikipedia, is &quot;a free and open-source software cloud computing platform. It is primarily deployed as an infrastructure as a service (IaaS) solution.&quot;</li>
<li>The article goes into detail about creating a FreeBSD instant, installing and converting it for use with &quot;bsd-cloudinit&quot;</li>
<li>The author of the article is a regular listener and emailer of the show, hey!
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-advocacy/2014-June/004465.html" rel="nofollow">BSDday 2014 call for papers</a></h3>

<ul>
<li>BSD Day, a conference not so well-known, is going to be held August 9th in Argentina</li>
<li>It was created in 2008 and is the only BSD conference around that area</li>
<li>The &quot;call for papers&quot; was issued, so if you&#39;re around Argentina and use BSD, consider submitting a talk</li>
<li>Sysadmins, developers and regular users are, of course, all welcome to come to the event
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20nTYO2w1" rel="nofollow">Maruf writes in</a></li>
<li><a href="http://slexy.org/view/s21cvV6mRP" rel="nofollow">Solomon writes in</a></li>
<li><a href="http://slexy.org/view/s2MK8sbea0" rel="nofollow">Silas writes in</a></li>
<li><a href="http://slexy.org/view/s2Yz97YlzI" rel="nofollow">Bert writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>42: Devious Methods</title>
  <link>https://www.bsdnow.tv/42</link>
  <guid isPermaLink="false">95dc548f-e688-476d-9fd7-8e78ff3cd16f</guid>
  <pubDate>Wed, 18 Jun 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/95dc548f-e688-476d-9fd7-8e78ff3cd16f.mp3" length="60629908" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Coming up this week, we'll be showing you how to chain SSH connections, as well as some cool tricks you can do with it. Going along with that theme, we also have an interview with Bryce Chidester about running a BSD-based shell provider. News, emails and cowsay turkeys, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:24:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Coming up this week, we'll be showing you how to chain SSH connections, as well as some cool tricks you can do with it. Going along with that theme, we also have an interview with Bryce Chidester about running a BSD-based shell provider. News, emails and cowsay turkeys, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
PIE and ASLR in FreeBSD update (https://www.soldierx.com/news/Position-Independent-Executable-Support-Added-FreeBSD)
A status update for Shawn Webb's ASLR and PIE work for FreeBSD
One major part of the code, position-independent executable support, has finally been merged into the -CURRENT tree
"FreeBSD has supported loading PIEs for a while now, but the applications in base weren't compiled as PIEs. Given that ASLR is useless without PIE, getting base compiled with PIE support is a mandatory first step in proper ASLR support"
If you're running -CURRENT, just add "WITH_PIE=1" to your /etc/src.conf and /etc/make.conf
The next step is working on the ASLR coding style and getting more developers to look through it
Shawn will also be at EuroBSDCon (in September) giving an updated version of his BSDCan talk about ASLR
***
Misc. pfSense news (https://blog.pfsense.org/?p=1347)
Couple of pfSense news items this week, including some hardware news
Someone's gotta test the pfSense hardware devices before they're sold, which involves powering them all on at least once
To make that process faster, they're building a controllable power board (and include some cool pics)
There will be more info on that device a bit later on
On Friday, June 27th, there will be another video session (https://blog.pfsense.org/?p=1367) (for paying customers only...) about virtualized firewalls
pfSense University (https://blog.pfsense.org/?p=1332), a new paid training course, was also announced
A single two-day class costs $2000, ouch
***
ZFS stripe width (http://blog.delphix.com/matt/2014/06/06/zfs-stripe-width/)
A new blog post from Matt Ahrens (http://www.bsdnow.tv/episodes/2014_05_14-bsdcanned_goods) about ZFS stripe width
"The popularity of OpenZFS has spawned a great community of users, sysadmins, architects and developers, contributing a wealth of advice, tips and tricks, and rules of thumb on how to configure ZFS. In general, this is a great aspect of the ZFS community, but I’d like to take the opportunity to address one piece of misinformed advice"
Matt goes through different situations where you would set up your zpool differently, each with their own advantages and disadvantages
He covers best performance on random IOPS, best reliability, and best space efficiency use cases
It includes a lot of detail on each one, including graphs, and addresses some misconceptions about different RAID-Z levels' overhead factor
***
FreeBSD 9.3-BETA3 released (https://lists.freebsd.org/pipermail/freebsd-stable/2014-June/078959.html)
The third BETA in the 9.3 release cycle is out, we're slowly getting closer to the release
This is expected to be the final BETA, next will come the RCs
There have mostly just been small bug fixes since BETA2, but OpenSSL was also updated and the arc4random code was updated to match what's in -CURRENT (but still isn't using ChaCha20)
The FreeBSD foundation has a blog post (http://freebsdfoundation.blogspot.com/2014/06/freebsd-93-beta3-now-available.html) about it too
There's a list of changes (https://www.freebsd.org/relnotes/9-STABLE/relnotes/article.html) between 9.2 and 9.3 as well, but we'll be sure to cover it when the -RELEASE hits
***
Interview - Bryce Chidester - brycec@devio.us (mailto:brycec@devio.us) / @brycied00d (https://twitter.com/brycied00d)
Running a BSD shell provider
Tutorial
Chaining SSH connections (http://www.bsdnow.tv/tutorials/ssh-chaining)
News Roundup
My FreeBSD adventure (https://www.linuxquestions.org/questions/*bsd-17/my-freebsd-adventure-continued-4175508055/)
A Slackware user from the "linux questions" forum decides to try out BSD, and documents his initial impressions and findings
After ruling out (https://www.linuxquestions.org/questions/*bsd-17/pc-bsd-10-0-is-now-available-4175493047/page2.html#post5142465) PCBSD due to the demanding hardware requirements and NetBSD due to "politics" (whatever that means, his words) he decides to start off with FreeBSD 10, but also mentions trying OpenBSD later on
In his forum post, he covers the documentation (and how easy it makes it for a switcher), dual booting, packages vs ports, network configuration and some other little things
So far, he seems to really enjoy BSD and thinks that it makes a lot of sense compared to Linux
Might be an interesting, ongoing series we can follow up on later
***
Even more BSDCan trip reports (http://freebsdfoundation.blogspot.com/2014/06/bsdcan-trip-report-li-wen-hsu.html)
BSDCan may be over until next year, but trip reports are still pouring in
This time we have a summary from Li-Wen Hsu, who was paid for by the FreeBSD foundation
He's part of the "Jenkins CI for FreeBSD" group and went to BSDCan mostly for that
Nice long post about all of his experiences at the event, definitely worth a read
He even talks about... the food
***
FreeBSD disk partitioning (http://blather.michaelwlucas.com/archives/2096)
For his latest book series on FreeBSD's GEOM system, MWL asked the hackers mailing list for some clarification
This erupted into a very long discussion (https://lists.freebsd.org/pipermail/freebsd-hackers/2014-June/045246.html) about fdisk vs gnop vs gpart
So you don't have to read the 500 mailing list posts, he's summarized the findings in a blog post
It covers MBR vs GPT, disk sector sizes and how to handle all of them with which tools
***
BSD Router Project version 1.51 (http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.51)
A new version of the BSD Router Project has been released, 1.51
It's now based on FreeBSD 10-STABLE instead of 10.0-RELEASE
Includes lots of bugfixes and small updates, as well as some patches from pfSense and elsewhere
Check the sourceforge page for the complete list of changes
Bad news... the minimum disk size requirement has increased to 512MB... getting pretty bloated
***
Feedback/Questions
Fongaboo writes in (http://slexy.org/view/s21X4hl28g)
David writes in (http://slexy.org/view/s20DELplMw)
Kristian writes in (http://slexy.org/view/s2tmazORRN)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ssh, openssh, chaining, tor, hopping, jump host, tunnel, vpn, cowsay, 9.3, beta, release, pie, aslr, zfs, zpool, matt ahrens, delphix, foundation, devious, devio.us, bcallah is a noob, shell, shell provider, free, hosting, vps, vpn, ixsystems, tarsnap, bsdcan, report, bsd router project, router, pfsense, m0n0wall, openstack, security, linux, slackware, switching, linux vs bsd, netgate, firewall, university, hangout</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Coming up this week, we&#39;ll be showing you how to chain SSH connections, as well as some cool tricks you can do with it. Going along with that theme, we also have an interview with Bryce Chidester about running a BSD-based shell provider. News, emails and cowsay turkeys, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.soldierx.com/news/Position-Independent-Executable-Support-Added-FreeBSD" rel="nofollow">PIE and ASLR in FreeBSD update</a></h3>

<ul>
<li>A status update for Shawn Webb&#39;s ASLR and PIE work for FreeBSD</li>
<li>One major part of the code, position-independent executable support, has finally been merged into the -CURRENT tree</li>
<li>&quot;FreeBSD has supported loading PIEs for a while now, but the applications in base weren&#39;t compiled as PIEs. Given that ASLR is useless without PIE, getting base compiled with PIE support is a mandatory first step in proper ASLR support&quot;</li>
<li>If you&#39;re running -CURRENT, just add &quot;WITH_PIE=1&quot; to your /etc/src.conf and /etc/make.conf</li>
<li>The next step is working on the ASLR coding style and getting more developers to look through it</li>
<li>Shawn will also be at EuroBSDCon (in September) giving an updated version of his BSDCan talk about ASLR
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=1347" rel="nofollow">Misc. pfSense news</a></h3>

<ul>
<li>Couple of pfSense news items this week, including some hardware news</li>
<li>Someone&#39;s gotta test the pfSense hardware devices before they&#39;re sold, which involves powering them all on at least once</li>
<li>To make that process faster, they&#39;re building a controllable power board (and include some cool pics)</li>
<li>There will be more info on that device a bit later on</li>
<li>On Friday, June 27th, there will be <a href="https://blog.pfsense.org/?p=1367" rel="nofollow">another video session</a> (for paying customers only...) about virtualized firewalls</li>
<li>pfSense <a href="https://blog.pfsense.org/?p=1332" rel="nofollow">University</a>, a new paid training course, was also announced</li>
<li>A single two-day class costs $2000, ouch
***</li>
</ul>

<h3><a href="http://blog.delphix.com/matt/2014/06/06/zfs-stripe-width/" rel="nofollow">ZFS stripe width</a></h3>

<ul>
<li>A new blog post from <a href="http://www.bsdnow.tv/episodes/2014_05_14-bsdcanned_goods" rel="nofollow">Matt Ahrens</a> about ZFS stripe width</li>
<li>&quot;The popularity of OpenZFS has spawned a great community of users, sysadmins, architects and developers, contributing a wealth of advice, tips and tricks, and rules of thumb on how to configure ZFS. In general, this is a great aspect of the ZFS community, but I’d like to take the opportunity to address one piece of misinformed advice&quot;</li>
<li>Matt goes through different situations where you would set up your zpool differently, each with their own advantages and disadvantages</li>
<li>He covers best performance on random IOPS, best reliability, and best space efficiency use cases</li>
<li>It includes a lot of detail on each one, including graphs, and addresses some misconceptions about different RAID-Z levels&#39; overhead factor
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-June/078959.html" rel="nofollow">FreeBSD 9.3-BETA3 released</a></h3>

<ul>
<li>The third BETA in the 9.3 release cycle is out, we&#39;re slowly getting closer to the release</li>
<li>This is expected to be the final BETA, next will come the RCs</li>
<li>There have mostly just been small bug fixes since BETA2, but OpenSSL was also updated and the arc4random code was updated to match what&#39;s in -CURRENT (but still isn&#39;t using ChaCha20)</li>
<li>The FreeBSD foundation has <a href="http://freebsdfoundation.blogspot.com/2014/06/freebsd-93-beta3-now-available.html" rel="nofollow">a blog post</a> about it too</li>
<li>There&#39;s <a href="https://www.freebsd.org/relnotes/9-STABLE/relnotes/article.html" rel="nofollow">a list of changes</a> between 9.2 and 9.3 as well, but we&#39;ll be sure to cover it when the -RELEASE hits
***</li>
</ul>

<h2>Interview - Bryce Chidester - <a href="mailto:brycec@devio.us" rel="nofollow">brycec@devio.us</a> / <a href="https://twitter.com/brycied00d" rel="nofollow">@brycied00d</a></h2>

<p>Running a BSD shell provider</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ssh-chaining" rel="nofollow">Chaining SSH connections</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.linuxquestions.org/questions/*bsd-17/my-freebsd-adventure-continued-4175508055/" rel="nofollow">My FreeBSD adventure</a></h3>

<ul>
<li>A Slackware user from the &quot;linux questions&quot; forum decides to try out BSD, and documents his initial impressions and findings</li>
<li>After <a href="https://www.linuxquestions.org/questions/*bsd-17/pc-bsd-10-0-is-now-available-4175493047/page2.html#post5142465" rel="nofollow">ruling out</a> PCBSD due to the demanding hardware requirements and NetBSD due to &quot;politics&quot; (whatever that means, his words) he decides to start off with FreeBSD 10, but also mentions trying OpenBSD later on</li>
<li>In his forum post, he covers the documentation (and how easy it makes it for a switcher), dual booting, packages vs ports, network configuration and some other little things</li>
<li>So far, he seems to really enjoy BSD and thinks that it makes a lot of sense compared to Linux</li>
<li>Might be an interesting, ongoing series we can follow up on later
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/06/bsdcan-trip-report-li-wen-hsu.html" rel="nofollow">Even more BSDCan trip reports</a></h3>

<ul>
<li>BSDCan may be over until next year, but trip reports are still pouring in</li>
<li>This time we have a summary from Li-Wen Hsu, who was paid for by the FreeBSD foundation</li>
<li>He&#39;s part of the &quot;Jenkins CI for FreeBSD&quot; group and went to BSDCan mostly for that</li>
<li>Nice long post about all of his experiences at the event, definitely worth a read</li>
<li>He even talks about... the food
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/2096" rel="nofollow">FreeBSD disk partitioning</a></h3>

<ul>
<li>For his latest book series on FreeBSD&#39;s GEOM system, MWL asked the hackers mailing list for some clarification</li>
<li>This erupted into a very <a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2014-June/045246.html" rel="nofollow">long discussion</a> about fdisk vs gnop vs gpart</li>
<li>So you don&#39;t have to read the 500 mailing list posts, he&#39;s summarized the findings in a blog post</li>
<li>It covers MBR vs GPT, disk sector sizes and how to handle all of them with which tools
***</li>
</ul>

<h3><a href="http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.51" rel="nofollow">BSD Router Project version 1.51</a></h3>

<ul>
<li>A new version of the BSD Router Project has been released, 1.51</li>
<li>It&#39;s now based on FreeBSD 10-STABLE instead of 10.0-RELEASE</li>
<li>Includes lots of bugfixes and small updates, as well as some patches from pfSense and elsewhere</li>
<li>Check the sourceforge page for the complete list of changes</li>
<li>Bad news... the minimum disk size requirement has increased to 512MB... getting pretty bloated
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21X4hl28g" rel="nofollow">Fongaboo writes in</a></li>
<li><a href="http://slexy.org/view/s20DELplMw" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s2tmazORRN" rel="nofollow">Kristian writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Coming up this week, we&#39;ll be showing you how to chain SSH connections, as well as some cool tricks you can do with it. Going along with that theme, we also have an interview with Bryce Chidester about running a BSD-based shell provider. News, emails and cowsay turkeys, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.soldierx.com/news/Position-Independent-Executable-Support-Added-FreeBSD" rel="nofollow">PIE and ASLR in FreeBSD update</a></h3>

<ul>
<li>A status update for Shawn Webb&#39;s ASLR and PIE work for FreeBSD</li>
<li>One major part of the code, position-independent executable support, has finally been merged into the -CURRENT tree</li>
<li>&quot;FreeBSD has supported loading PIEs for a while now, but the applications in base weren&#39;t compiled as PIEs. Given that ASLR is useless without PIE, getting base compiled with PIE support is a mandatory first step in proper ASLR support&quot;</li>
<li>If you&#39;re running -CURRENT, just add &quot;WITH_PIE=1&quot; to your /etc/src.conf and /etc/make.conf</li>
<li>The next step is working on the ASLR coding style and getting more developers to look through it</li>
<li>Shawn will also be at EuroBSDCon (in September) giving an updated version of his BSDCan talk about ASLR
***</li>
</ul>

<h3><a href="https://blog.pfsense.org/?p=1347" rel="nofollow">Misc. pfSense news</a></h3>

<ul>
<li>Couple of pfSense news items this week, including some hardware news</li>
<li>Someone&#39;s gotta test the pfSense hardware devices before they&#39;re sold, which involves powering them all on at least once</li>
<li>To make that process faster, they&#39;re building a controllable power board (and include some cool pics)</li>
<li>There will be more info on that device a bit later on</li>
<li>On Friday, June 27th, there will be <a href="https://blog.pfsense.org/?p=1367" rel="nofollow">another video session</a> (for paying customers only...) about virtualized firewalls</li>
<li>pfSense <a href="https://blog.pfsense.org/?p=1332" rel="nofollow">University</a>, a new paid training course, was also announced</li>
<li>A single two-day class costs $2000, ouch
***</li>
</ul>

<h3><a href="http://blog.delphix.com/matt/2014/06/06/zfs-stripe-width/" rel="nofollow">ZFS stripe width</a></h3>

<ul>
<li>A new blog post from <a href="http://www.bsdnow.tv/episodes/2014_05_14-bsdcanned_goods" rel="nofollow">Matt Ahrens</a> about ZFS stripe width</li>
<li>&quot;The popularity of OpenZFS has spawned a great community of users, sysadmins, architects and developers, contributing a wealth of advice, tips and tricks, and rules of thumb on how to configure ZFS. In general, this is a great aspect of the ZFS community, but I’d like to take the opportunity to address one piece of misinformed advice&quot;</li>
<li>Matt goes through different situations where you would set up your zpool differently, each with their own advantages and disadvantages</li>
<li>He covers best performance on random IOPS, best reliability, and best space efficiency use cases</li>
<li>It includes a lot of detail on each one, including graphs, and addresses some misconceptions about different RAID-Z levels&#39; overhead factor
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-June/078959.html" rel="nofollow">FreeBSD 9.3-BETA3 released</a></h3>

<ul>
<li>The third BETA in the 9.3 release cycle is out, we&#39;re slowly getting closer to the release</li>
<li>This is expected to be the final BETA, next will come the RCs</li>
<li>There have mostly just been small bug fixes since BETA2, but OpenSSL was also updated and the arc4random code was updated to match what&#39;s in -CURRENT (but still isn&#39;t using ChaCha20)</li>
<li>The FreeBSD foundation has <a href="http://freebsdfoundation.blogspot.com/2014/06/freebsd-93-beta3-now-available.html" rel="nofollow">a blog post</a> about it too</li>
<li>There&#39;s <a href="https://www.freebsd.org/relnotes/9-STABLE/relnotes/article.html" rel="nofollow">a list of changes</a> between 9.2 and 9.3 as well, but we&#39;ll be sure to cover it when the -RELEASE hits
***</li>
</ul>

<h2>Interview - Bryce Chidester - <a href="mailto:brycec@devio.us" rel="nofollow">brycec@devio.us</a> / <a href="https://twitter.com/brycied00d" rel="nofollow">@brycied00d</a></h2>

<p>Running a BSD shell provider</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ssh-chaining" rel="nofollow">Chaining SSH connections</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.linuxquestions.org/questions/*bsd-17/my-freebsd-adventure-continued-4175508055/" rel="nofollow">My FreeBSD adventure</a></h3>

<ul>
<li>A Slackware user from the &quot;linux questions&quot; forum decides to try out BSD, and documents his initial impressions and findings</li>
<li>After <a href="https://www.linuxquestions.org/questions/*bsd-17/pc-bsd-10-0-is-now-available-4175493047/page2.html#post5142465" rel="nofollow">ruling out</a> PCBSD due to the demanding hardware requirements and NetBSD due to &quot;politics&quot; (whatever that means, his words) he decides to start off with FreeBSD 10, but also mentions trying OpenBSD later on</li>
<li>In his forum post, he covers the documentation (and how easy it makes it for a switcher), dual booting, packages vs ports, network configuration and some other little things</li>
<li>So far, he seems to really enjoy BSD and thinks that it makes a lot of sense compared to Linux</li>
<li>Might be an interesting, ongoing series we can follow up on later
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/06/bsdcan-trip-report-li-wen-hsu.html" rel="nofollow">Even more BSDCan trip reports</a></h3>

<ul>
<li>BSDCan may be over until next year, but trip reports are still pouring in</li>
<li>This time we have a summary from Li-Wen Hsu, who was paid for by the FreeBSD foundation</li>
<li>He&#39;s part of the &quot;Jenkins CI for FreeBSD&quot; group and went to BSDCan mostly for that</li>
<li>Nice long post about all of his experiences at the event, definitely worth a read</li>
<li>He even talks about... the food
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/2096" rel="nofollow">FreeBSD disk partitioning</a></h3>

<ul>
<li>For his latest book series on FreeBSD&#39;s GEOM system, MWL asked the hackers mailing list for some clarification</li>
<li>This erupted into a very <a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2014-June/045246.html" rel="nofollow">long discussion</a> about fdisk vs gnop vs gpart</li>
<li>So you don&#39;t have to read the 500 mailing list posts, he&#39;s summarized the findings in a blog post</li>
<li>It covers MBR vs GPT, disk sector sizes and how to handle all of them with which tools
***</li>
</ul>

<h3><a href="http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.51" rel="nofollow">BSD Router Project version 1.51</a></h3>

<ul>
<li>A new version of the BSD Router Project has been released, 1.51</li>
<li>It&#39;s now based on FreeBSD 10-STABLE instead of 10.0-RELEASE</li>
<li>Includes lots of bugfixes and small updates, as well as some patches from pfSense and elsewhere</li>
<li>Check the sourceforge page for the complete list of changes</li>
<li>Bad news... the minimum disk size requirement has increased to 512MB... getting pretty bloated
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21X4hl28g" rel="nofollow">Fongaboo writes in</a></li>
<li><a href="http://slexy.org/view/s20DELplMw" rel="nofollow">David writes in</a></li>
<li><a href="http://slexy.org/view/s2tmazORRN" rel="nofollow">Kristian writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>41: Commit This Bit</title>
  <link>https://www.bsdnow.tv/41</link>
  <guid isPermaLink="false">0017fbdd-17f8-464f-8bd5-94c6070bbd9a</guid>
  <pubDate>Wed, 11 Jun 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0017fbdd-17f8-464f-8bd5-94c6070bbd9a.mp3" length="48292564" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week in the big show, we'll be interviewing Benedict Reuschling of the FreeBSD documentation team, and he has a special surprise in store for Allan. As always, answers to your questions and all the latest news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:07:04</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week in the big show, we'll be interviewing Benedict Reuschling of the FreeBSD documentation team, and he has a special surprise in store for Allan. As always, answers to your questions and all the latest news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD moves to Bugzilla (https://lists.freebsd.org/pipermail/freebsd-announce/2014-June/001559.html)
Historically, FreeBSD has used the old GNATS system for keeping track of bug reports
After years and years of wanting to switch, they've finally moved away from GNATS to Bugzilla
It offers a lot of advantages, is much more modern and actively maintained and 
There's a new workflow chart (http://people.freebsd.org/~eadler/bugrelocation/workflow.html) for developers to illustrate the new way of doing things
The old "send-pr" command will still work for the time being, but will eventually be phased out in favor of native Bugzilla reporting tools (of which there are multiple in ports)
This will hopefully make reporting bugs a lot less painful
***
DIY NAS: EconoNAS 2014 (http://blog.brianmoses.net/2014/06/diy-nas-econonas-2014.html)
We previously covered this blog last year, but the 2014 edition is up
More of a hardware-focused article, the author details the parts he's using for a budget NAS
Details the motherboard, RAM, CPU, hard drives, case, etc
With a set goal of $500 max, he goes just over it - $550 for all the parts
Lots of nice pictures of the hardware and step by step instructions for assembly, as well as software configuration instructions
***
DragonflyBSD 3.8 released (http://www.shiningsilence.com/dbsdlog/2014/06/04/14122.html)
Justin (http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug) announced the availability of DragonflyBSD 3.8.0
Binaries in /bin and /sbin are dynamic now, enabling the use of PAM and NSS to manage user accounts
It includes a new HAMMER FS backup script and lots of FreeBSD tools have been synced with their latest versions
Work continues on for the Intel graphics drivers, but it's currently limited to the HD4000 and Ivy Bridge series
See the release page (http://www.dragonflybsd.org/release38/) for more info and check the link for source-based upgrade instructions
***
OpenZFS European conference 2014 (http://www.open-zfs.org/wiki/Publications#2014_OpenZFS_European_Conference)
There was an OpenZFS conference held in Europe recently, and now the videos are online for your viewing pleasure
Matt Ahrens, Introduction (http://www.youtube.com/watch?v=Mk1czZs6vkQ)
Michael Alexander, FhGFS performance on ZFS (http://www.youtube.com/watch?v=Ak1HB507-xY)
Andriy Gapon, Testing ZFS on FreeBSD (http://www.youtube.com/watch?v=oB-QDwVuBH4)
Luke Marsden, HybridCluster: ZFS in the cloud (http://www.youtube.com/watch?v=ISI9Ppj3kTo)
Vadim Comănescu, Syneto: continuously delivering a ZFS-based OS (http://www.youtube.com/watch?v=1xK94v0BedE)
Chris George, DDRdrive ZIL accelerator: random write revelation (http://www.youtube.com/watch?v=ScNHjWBQYQ8)
Grenville Whelan, High-Availability (http://www.youtube.com/watch?v=tiTYZykCeDo)
Phil Harman, Harman Holistic (https://www.youtube.com/watch?v=ApjkrBVlPXk)
Mark Rees, Storiant and OpenZFS (http://www.youtube.com/watch?v=41yl23EACns)
Andrew Holway, EraStor ZFS appliances (http://www.youtube.com/watch?v=b4L0DRvKJxo)
Dan Vâtca, Syneto and OpenZFS (http://www.youtube.com/watch?v=pPOW8bwUXxo)
Luke Marsden, HybridCluster and OpenZFS (http://www.youtube.com/watch?v=uSM1s1aWlZE)
Matt Ahrens, Delphix and OpenZFS (http://www.youtube.com/watch?v=UaRdzUOsieA)
Check the link for slides and other goodies
***
Interview - Benedict Reuschling - bcr@freebsd.org (mailto:bcr@freebsd.org)
BSD documentation, getting commit access, unix education, various topics
News Roundup
Getting to know your portmgr, Steve Wills (http://blogs.freebsdish.org/portmgr/2014/06/04/getting-to-know-your-portmgr-steve-wills/)
"It is my pleasure to introduce Steve Wills, the newest member of the portmgr team"
swills is an all-round good guy, does a lot for ports (especially the ruby ports)
In this interview, we learn why he uses FreeBSD, the most embarrassing moment in his FreeBSD career and much more
He used to work for Red Hat, woah
***
BSDTalk episode 242 (http://bsdtalk.blogspot.com/2014/06/bsdtalk242-pfsense-with-chris-buechler.html)
This time on BSDTalk, Will interviews Chris Buechler (http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense) from pfSense
Topics include: the heartbleed vulnerability and how it affected pfSense, how people usually leave their firewalls unpatched for a long time (or even forget about them!), changes between major versions, the upgrade process, upcoming features in their 10-based version, backporting drivers and security fixes
They also touch on recent concerns in the pfSense community about their license change, that they may be "going commercial" and closing the source - so tune in to find out what their future plans are for all of that
***
Turn old PC hardware into a killer home server (http://www.pcworld.com/article/2243748/turn-old-pc-hardware-into-a-killer-home-server-with-freenas.html)
Lots of us have old hardware lying around doing nothing but collecting dust
Why not turn that old box into a modern file server with FreeNAS and ZFS?
This article goes through the process of setting up a NAS, gives a little history behind the project and highlights some of the different protocols FreeNAS can use (NFS, SMB, AFS, etc)
Most of our users are already familiar with all of this stuff, nothing too advanced
Good to see BSD getting some well-deserved attention on a big mainstream site
***
Unbloating the VAX install CD (https://blog.netbsd.org/tnf/entry/unbloating_the_vax_install_cd)
After a discussion on the VAX mailing list, something very important came to the attention of the developers...
You can't boot NetBSD on a VAX box with 16MB of RAM from the CD image
This blog post goes through the developer's adventure in trying to fix that through emulation and stripping various things out of the kernel to make it smaller
In the end, he got it booting - and now all three VAX users who want to run NetBSD can do so on their systems with 16MB of RAM...
***
Feedback/Questions
Thomas writes in (http://slexy.org/view/s211mNScBr)
Reynold writes in (http://slexy.org/view/s21JA8BVmZ)
Bostjan writes in (http://slexy.org/view/s2kwS3ncTY)
Paul writes in (http://slexy.org/view/s2VgjXUfW9)
John writes in (http://slexy.org/view/s202AAQUXt)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, gnats, send-pr, sendbug, bugzilla, bug tracker, iso, cdr, dvd, patches, applied, commit bit, documentation, bsdcan, 2014, 9.3-RELEASE, 9.3, release, stable, advocacy, openssl, libressl, security, vulnerability, bsdtalk, pfsense, license, openzfs, zfs, presentation, talk, matthew ahrens, delphix, hybridcluster, freenas</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week in the big show, we&#39;ll be interviewing Benedict Reuschling of the FreeBSD documentation team, and he has a special surprise in store for Allan. As always, answers to your questions and all the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2014-June/001559.html" rel="nofollow">FreeBSD moves to Bugzilla</a></h3>

<ul>
<li>Historically, FreeBSD has used the old GNATS system for keeping track of bug reports</li>
<li>After years and years of wanting to switch, they&#39;ve finally moved away from GNATS to Bugzilla</li>
<li>It offers a lot of advantages, is much more modern and actively maintained and </li>
<li>There&#39;s a new <a href="http://people.freebsd.org/%7Eeadler/bugrelocation/workflow.html" rel="nofollow">workflow chart</a> for developers to illustrate the new way of doing things</li>
<li>The old &quot;send-pr&quot; command will still work for the time being, but will eventually be phased out in favor of native Bugzilla reporting tools (of which there are multiple in ports)</li>
<li>This will hopefully make reporting bugs a lot less painful
***</li>
</ul>

<h3><a href="http://blog.brianmoses.net/2014/06/diy-nas-econonas-2014.html" rel="nofollow">DIY NAS: EconoNAS 2014</a></h3>

<ul>
<li>We previously covered this blog last year, but the 2014 edition is up</li>
<li>More of a hardware-focused article, the author details the parts he&#39;s using for a <strong>budget</strong> NAS</li>
<li>Details the motherboard, RAM, CPU, hard drives, case, etc</li>
<li>With a set goal of $500 max, he goes just over it - $550 for all the parts</li>
<li>Lots of nice pictures of the hardware and step by step instructions for assembly, as well as software configuration instructions
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2014/06/04/14122.html" rel="nofollow">DragonflyBSD 3.8 released</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug" rel="nofollow">Justin</a> announced the availability of DragonflyBSD 3.8.0</li>
<li>Binaries in /bin and /sbin are dynamic now, enabling the use of PAM and NSS to manage user accounts</li>
<li>It includes a new HAMMER FS backup script and lots of FreeBSD tools have been synced with their latest versions</li>
<li>Work continues on for the Intel graphics drivers, but it&#39;s currently limited to the HD4000 and Ivy Bridge series</li>
<li>See <a href="http://www.dragonflybsd.org/release38/" rel="nofollow">the release page</a> for more info and check the link for source-based upgrade instructions
***</li>
</ul>

<h3><a href="http://www.open-zfs.org/wiki/Publications#2014_OpenZFS_European_Conference" rel="nofollow">OpenZFS European conference 2014</a></h3>

<ul>
<li>There was an OpenZFS conference held in Europe recently, and now the videos are online for your viewing pleasure</li>
<li>Matt Ahrens, <a href="http://www.youtube.com/watch?v=Mk1czZs6vkQ" rel="nofollow">Introduction</a></li>
<li>Michael Alexander, <a href="http://www.youtube.com/watch?v=Ak1HB507-xY" rel="nofollow">FhGFS performance on ZFS</a></li>
<li>Andriy Gapon, <a href="http://www.youtube.com/watch?v=oB-QDwVuBH4" rel="nofollow">Testing ZFS on FreeBSD</a></li>
<li>Luke Marsden, <a href="http://www.youtube.com/watch?v=ISI9Ppj3kTo" rel="nofollow">HybridCluster: ZFS in the cloud</a></li>
<li>Vadim Comănescu, <a href="http://www.youtube.com/watch?v=1xK94v0BedE" rel="nofollow">Syneto: continuously delivering a ZFS-based OS</a></li>
<li>Chris George, <a href="http://www.youtube.com/watch?v=ScNHjWBQYQ8" rel="nofollow">DDRdrive ZIL accelerator: random write revelation</a></li>
<li>Grenville Whelan, <a href="http://www.youtube.com/watch?v=tiTYZykCeDo" rel="nofollow">High-Availability</a></li>
<li>Phil Harman, <a href="https://www.youtube.com/watch?v=ApjkrBVlPXk" rel="nofollow">Harman Holistic</a></li>
<li>Mark Rees, <a href="http://www.youtube.com/watch?v=41yl23EACns" rel="nofollow">Storiant and OpenZFS</a></li>
<li>Andrew Holway, <a href="http://www.youtube.com/watch?v=b4L0DRvKJxo" rel="nofollow">EraStor ZFS appliances</a></li>
<li>Dan Vâtca, <a href="http://www.youtube.com/watch?v=pPOW8bwUXxo" rel="nofollow">Syneto and OpenZFS</a></li>
<li>Luke Marsden, <a href="http://www.youtube.com/watch?v=uSM1s1aWlZE" rel="nofollow">HybridCluster and OpenZFS</a></li>
<li>Matt Ahrens, <a href="http://www.youtube.com/watch?v=UaRdzUOsieA" rel="nofollow">Delphix and OpenZFS</a></li>
<li>Check the link for slides and other goodies
***</li>
</ul>

<h2>Interview - Benedict Reuschling - <a href="mailto:bcr@freebsd.org" rel="nofollow">bcr@freebsd.org</a></h2>

<p>BSD documentation, getting commit access, unix education, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/06/04/getting-to-know-your-portmgr-steve-wills/" rel="nofollow">Getting to know your portmgr, Steve Wills</a></h3>

<ul>
<li>&quot;It is my pleasure to introduce Steve Wills, the newest member of the portmgr team&quot;</li>
<li>swills is an all-round good guy, does a lot for ports (especially the ruby ports)</li>
<li>In this interview, we learn why he uses FreeBSD, the most embarrassing moment in his FreeBSD career and much more</li>
<li>He used to work for Red Hat, woah
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2014/06/bsdtalk242-pfsense-with-chris-buechler.html" rel="nofollow">BSDTalk episode 242</a></h3>

<ul>
<li>This time on BSDTalk, Will interviews <a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">Chris Buechler</a> from pfSense</li>
<li>Topics include: the heartbleed vulnerability and how it affected pfSense, how people usually leave their firewalls unpatched for a long time (or even forget about them!), changes between major versions, the upgrade process, upcoming features in their 10-based version, backporting drivers and security fixes</li>
<li>They also touch on recent concerns in the pfSense community about their license change, that they may be &quot;going commercial&quot; and closing the source - so tune in to find out what their future plans are for all of that
***</li>
</ul>

<h3><a href="http://www.pcworld.com/article/2243748/turn-old-pc-hardware-into-a-killer-home-server-with-freenas.html" rel="nofollow">Turn old PC hardware into a killer home server</a></h3>

<ul>
<li>Lots of us have old hardware lying around doing nothing but collecting dust</li>
<li>Why not turn that old box into a modern file server with FreeNAS and ZFS?</li>
<li>This article goes through the process of setting up a NAS, gives a little history behind the project and highlights some of the different protocols FreeNAS can use (NFS, SMB, AFS, etc)</li>
<li>Most of our users are already familiar with all of this stuff, nothing too advanced</li>
<li>Good to see BSD getting some well-deserved attention on a big mainstream site
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/unbloating_the_vax_install_cd" rel="nofollow">Unbloating the VAX install CD</a></h3>

<ul>
<li>After a discussion on the VAX mailing list, something very important came to the attention of the developers...</li>
<li>You can&#39;t boot NetBSD on a VAX box with 16MB of RAM from the CD image</li>
<li>This blog post goes through the developer&#39;s adventure in trying to fix that through emulation and stripping various things out of the kernel to make it smaller</li>
<li>In the end, he got it booting - and now all three VAX users who want to run NetBSD can do so on their systems with 16MB of RAM...
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s211mNScBr" rel="nofollow">Thomas writes in</a></li>
<li><a href="http://slexy.org/view/s21JA8BVmZ" rel="nofollow">Reynold writes in</a></li>
<li><a href="http://slexy.org/view/s2kwS3ncTY" rel="nofollow">Bostjan writes in</a></li>
<li><a href="http://slexy.org/view/s2VgjXUfW9" rel="nofollow">Paul writes in</a></li>
<li><a href="http://slexy.org/view/s202AAQUXt" rel="nofollow">John writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week in the big show, we&#39;ll be interviewing Benedict Reuschling of the FreeBSD documentation team, and he has a special surprise in store for Allan. As always, answers to your questions and all the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2014-June/001559.html" rel="nofollow">FreeBSD moves to Bugzilla</a></h3>

<ul>
<li>Historically, FreeBSD has used the old GNATS system for keeping track of bug reports</li>
<li>After years and years of wanting to switch, they&#39;ve finally moved away from GNATS to Bugzilla</li>
<li>It offers a lot of advantages, is much more modern and actively maintained and </li>
<li>There&#39;s a new <a href="http://people.freebsd.org/%7Eeadler/bugrelocation/workflow.html" rel="nofollow">workflow chart</a> for developers to illustrate the new way of doing things</li>
<li>The old &quot;send-pr&quot; command will still work for the time being, but will eventually be phased out in favor of native Bugzilla reporting tools (of which there are multiple in ports)</li>
<li>This will hopefully make reporting bugs a lot less painful
***</li>
</ul>

<h3><a href="http://blog.brianmoses.net/2014/06/diy-nas-econonas-2014.html" rel="nofollow">DIY NAS: EconoNAS 2014</a></h3>

<ul>
<li>We previously covered this blog last year, but the 2014 edition is up</li>
<li>More of a hardware-focused article, the author details the parts he&#39;s using for a <strong>budget</strong> NAS</li>
<li>Details the motherboard, RAM, CPU, hard drives, case, etc</li>
<li>With a set goal of $500 max, he goes just over it - $550 for all the parts</li>
<li>Lots of nice pictures of the hardware and step by step instructions for assembly, as well as software configuration instructions
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2014/06/04/14122.html" rel="nofollow">DragonflyBSD 3.8 released</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug" rel="nofollow">Justin</a> announced the availability of DragonflyBSD 3.8.0</li>
<li>Binaries in /bin and /sbin are dynamic now, enabling the use of PAM and NSS to manage user accounts</li>
<li>It includes a new HAMMER FS backup script and lots of FreeBSD tools have been synced with their latest versions</li>
<li>Work continues on for the Intel graphics drivers, but it&#39;s currently limited to the HD4000 and Ivy Bridge series</li>
<li>See <a href="http://www.dragonflybsd.org/release38/" rel="nofollow">the release page</a> for more info and check the link for source-based upgrade instructions
***</li>
</ul>

<h3><a href="http://www.open-zfs.org/wiki/Publications#2014_OpenZFS_European_Conference" rel="nofollow">OpenZFS European conference 2014</a></h3>

<ul>
<li>There was an OpenZFS conference held in Europe recently, and now the videos are online for your viewing pleasure</li>
<li>Matt Ahrens, <a href="http://www.youtube.com/watch?v=Mk1czZs6vkQ" rel="nofollow">Introduction</a></li>
<li>Michael Alexander, <a href="http://www.youtube.com/watch?v=Ak1HB507-xY" rel="nofollow">FhGFS performance on ZFS</a></li>
<li>Andriy Gapon, <a href="http://www.youtube.com/watch?v=oB-QDwVuBH4" rel="nofollow">Testing ZFS on FreeBSD</a></li>
<li>Luke Marsden, <a href="http://www.youtube.com/watch?v=ISI9Ppj3kTo" rel="nofollow">HybridCluster: ZFS in the cloud</a></li>
<li>Vadim Comănescu, <a href="http://www.youtube.com/watch?v=1xK94v0BedE" rel="nofollow">Syneto: continuously delivering a ZFS-based OS</a></li>
<li>Chris George, <a href="http://www.youtube.com/watch?v=ScNHjWBQYQ8" rel="nofollow">DDRdrive ZIL accelerator: random write revelation</a></li>
<li>Grenville Whelan, <a href="http://www.youtube.com/watch?v=tiTYZykCeDo" rel="nofollow">High-Availability</a></li>
<li>Phil Harman, <a href="https://www.youtube.com/watch?v=ApjkrBVlPXk" rel="nofollow">Harman Holistic</a></li>
<li>Mark Rees, <a href="http://www.youtube.com/watch?v=41yl23EACns" rel="nofollow">Storiant and OpenZFS</a></li>
<li>Andrew Holway, <a href="http://www.youtube.com/watch?v=b4L0DRvKJxo" rel="nofollow">EraStor ZFS appliances</a></li>
<li>Dan Vâtca, <a href="http://www.youtube.com/watch?v=pPOW8bwUXxo" rel="nofollow">Syneto and OpenZFS</a></li>
<li>Luke Marsden, <a href="http://www.youtube.com/watch?v=uSM1s1aWlZE" rel="nofollow">HybridCluster and OpenZFS</a></li>
<li>Matt Ahrens, <a href="http://www.youtube.com/watch?v=UaRdzUOsieA" rel="nofollow">Delphix and OpenZFS</a></li>
<li>Check the link for slides and other goodies
***</li>
</ul>

<h2>Interview - Benedict Reuschling - <a href="mailto:bcr@freebsd.org" rel="nofollow">bcr@freebsd.org</a></h2>

<p>BSD documentation, getting commit access, unix education, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/06/04/getting-to-know-your-portmgr-steve-wills/" rel="nofollow">Getting to know your portmgr, Steve Wills</a></h3>

<ul>
<li>&quot;It is my pleasure to introduce Steve Wills, the newest member of the portmgr team&quot;</li>
<li>swills is an all-round good guy, does a lot for ports (especially the ruby ports)</li>
<li>In this interview, we learn why he uses FreeBSD, the most embarrassing moment in his FreeBSD career and much more</li>
<li>He used to work for Red Hat, woah
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2014/06/bsdtalk242-pfsense-with-chris-buechler.html" rel="nofollow">BSDTalk episode 242</a></h3>

<ul>
<li>This time on BSDTalk, Will interviews <a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">Chris Buechler</a> from pfSense</li>
<li>Topics include: the heartbleed vulnerability and how it affected pfSense, how people usually leave their firewalls unpatched for a long time (or even forget about them!), changes between major versions, the upgrade process, upcoming features in their 10-based version, backporting drivers and security fixes</li>
<li>They also touch on recent concerns in the pfSense community about their license change, that they may be &quot;going commercial&quot; and closing the source - so tune in to find out what their future plans are for all of that
***</li>
</ul>

<h3><a href="http://www.pcworld.com/article/2243748/turn-old-pc-hardware-into-a-killer-home-server-with-freenas.html" rel="nofollow">Turn old PC hardware into a killer home server</a></h3>

<ul>
<li>Lots of us have old hardware lying around doing nothing but collecting dust</li>
<li>Why not turn that old box into a modern file server with FreeNAS and ZFS?</li>
<li>This article goes through the process of setting up a NAS, gives a little history behind the project and highlights some of the different protocols FreeNAS can use (NFS, SMB, AFS, etc)</li>
<li>Most of our users are already familiar with all of this stuff, nothing too advanced</li>
<li>Good to see BSD getting some well-deserved attention on a big mainstream site
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/unbloating_the_vax_install_cd" rel="nofollow">Unbloating the VAX install CD</a></h3>

<ul>
<li>After a discussion on the VAX mailing list, something very important came to the attention of the developers...</li>
<li>You can&#39;t boot NetBSD on a VAX box with 16MB of RAM from the CD image</li>
<li>This blog post goes through the developer&#39;s adventure in trying to fix that through emulation and stripping various things out of the kernel to make it smaller</li>
<li>In the end, he got it booting - and now all three VAX users who want to run NetBSD can do so on their systems with 16MB of RAM...
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s211mNScBr" rel="nofollow">Thomas writes in</a></li>
<li><a href="http://slexy.org/view/s21JA8BVmZ" rel="nofollow">Reynold writes in</a></li>
<li><a href="http://slexy.org/view/s2kwS3ncTY" rel="nofollow">Bostjan writes in</a></li>
<li><a href="http://slexy.org/view/s2VgjXUfW9" rel="nofollow">Paul writes in</a></li>
<li><a href="http://slexy.org/view/s202AAQUXt" rel="nofollow">John writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>40: AirPorts &amp; Packages</title>
  <link>https://www.bsdnow.tv/40</link>
  <guid isPermaLink="false">f9c8a284-4fd9-4c5d-9137-77062c5814b4</guid>
  <pubDate>Wed, 04 Jun 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f9c8a284-4fd9-4c5d-9137-77062c5814b4.mp3" length="52844692" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>On this week's episode, we'll be giving you an introductory guide on OpenBSD's ports and package system. There's also a pretty fly interview with Karl Lehenbauer, about how they use FreeBSD at FlightAware. Lots of interesting news and answers to all your emails, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:13:23</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>On this week's episode, we'll be giving you an introductory guide on OpenBSD's ports and package system. There's also a pretty fly interview with Karl Lehenbauer, about how they use FreeBSD at FlightAware. Lots of interesting news and answers to all your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
BSDCan 2014 talks and reports, part 2 (https://www.bsdcan.org/2014/schedule/)
More presentations and trip reports are still being uploaded
Ingo Schwarze, New Trends in mandoc (https://www.youtube.com/watch?v=oifYhwTaOuw)
Vsevolod Stakhov, The Architecture of the New Solver in pkg
 (https://www.youtube.com/watch?v=3SOKFz2UUQ4)
Julio Merino, The FreeBSD Test Suite (https://www.youtube.com/watch?v=nf-bFeKaZsY)
Zbigniew Bodek, Transparent Superpages for FreeBSD on ARM (https://www.youtube.com/watch?v=s5iIKEHtbX8)
There's also a trip report from Michael Dexter (http://freebsdfoundation.blogspot.com/2014/06/bsdcan-trip-report-michael-dexter.html) and another (very long and detailed) trip report (http://freebsdfoundation.blogspot.com/2014/05/bsdcan-trip-report-warren-block.html) from our friend Warren Block (http://www.bsdnow.tv/episodes/2014_03_26-documentation_is_king) that even gives us some linkage, thanks!
***
Beyond security, getting to know OpenBSD's real purpose (https://www.youtube.com/watch?v=JrFfrrY-yOo)
Michael W Lucas (http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop) (who, we learn through this video, has been using BSD since 1986) gave a "webcast" last week, and the audio and slides are finally up
It clocks in at just over 30 minutes, managing to touch on a lot of OpenBSD topics
Some of those topics include: what is OpenBSD and why you should care, the philosophy of the project, how it serves as a "pressure cooker for ideas," briefly touches on GPL vs BSDL, their "do it right or don't do it at all" attitude, their stance on NDAs and blobs, recent LibreSSL development, some of the security functions that OpenBSD enabled before anyone else (and the ripple effect that had) and, of course, their disturbing preference for comic sans
Here's a direct link to the slides (https://wcc.on24.com/event/76/67/12/rt/1/documents/resourceList1400781110933/20140527_beyond_security_openbsd.pdf)
Great presentation if you'd like to learn a bit about OpenBSD, but also contains a bit of information that long-time users might not know too
***
FreeBSD vs Linux, a comprehensive comparison (http://brioteam.com/linux-versus-freebsd-comprehensive-comparison)
Another blog post covering something people seem to be obsessed with - FreeBSD vs Linux
This one was worth mentioning because it's very thorough in regards to how things are done behind the scenes, not just the usual technical differences
It highlights the concept of a "core team" and their role vs "contributors" and "committers" (similar to a presentation Kirk McKusick did not long ago)
While a lot of things will be the same on both platforms, you might still be asking "which one is right for me?" - this article weighs in with some points for both sides and different use cases
Pretty well-written and unbiased article that also mentions areas where Linux might be better, so don't hate us for linking it
***
Expand FreeNAS with plugins (http://www.openlogic.com/wazi/bid/345617/Expand-FreeNAS-with-plugins)
One of the things people love the most about FreeNAS (other than ZFS) is their cool plugin framework
With these plugins, you can greatly expand the feature set of your NAS via third party programs
This page talks about a few of the more popular ones and how they can be used to improve your NAS or media box experience
Some examples include setting up an OwnCloud server, Bacula for backups, Maraschino for managing a home theater PC, Plex Media Server for an easy to use video experience and a few more
It then goes into more detail about each of them, how to actually install plugins and then how to set them up
***
Interview - Karl Lehenbauer - karl@flightaware.com (mailto:karl@flightaware.com) / @flightaware (https://twitter.com/flightaware)
FreeBSD at FlightAware, BSD history, various topics
Tutorial
Ports and packages in OpenBSD (http://www.bsdnow.tv/tutorials/ports-obsd)
News Roundup
Code review culture meets FreeBSD (http://julipedia.meroh.net/2014/05/code-review-culture-meets-freebsd.html)
In most of the BSDs, changes need to be reviewed by more than one person before being committed to the tree
This article describes Phabricator, an open source code review system that we briefly mentioned last week
Instructions for using it are on the wiki (https://wiki.freebsd.org/CodeReview)
While not approved by the core team yet for anything official, it's in a testing phase and developers are encouraged to try it out and get their patches reviewed
Just look at that fancy interface!! (http://phabric.freebsd.org/)
***
Upcoming BSD books (http://blather.michaelwlucas.com/archives/2088)
Sneaky MWL somehow finds his way into both our headlines and the news roundup
He gives us an update on the next BSD books that he's planning to release
The plan is to release three (or so) books based on different aspects of FreeBSD's storage system(s) - GEOM, UFS, ZFS, etc.
This has the advantage of only requiring you to buy the one(s) you're specifically interested in
"When will they be released? When I'm done writing them. How much will they cost? Dunno."
It's not Absolute FreeBSD 3rd edition...
***
CARP failover and high availability on FreeBSD (https://www.youtube.com/watch?v=VjYb9mKB4jU)
If you're running a cluster or a group of servers, you should have some sort of failover in place
But the question comes up, "how do you load balance the load balancers!?"
This video goes through the process of giving more than one machine the same IP, how to set up CARP, securing it and demonstrates a node dying
Also mentions DNS-based load balancing as another option
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/05/weekly-feature-digest-30/)
This time in PCBSD land, we're getting ready for the 10.0.2 release (ISOs here) (http://download.pcbsd.org/iso/10.0-RELEASE/testing/amd64/)
AppCafe got a good number of fixes, and now shows 10 random highlighted applications
EasyPBI added a "bulk" mode to create PBIs of an entire FreeBSD port category
Lumina, the new desktop environment, is still being worked on and got some bug fixes too
***
Feedback/Questions
Paul writes in (http://slexy.org/view/s205iiKiWp)
Matt writes in (http://slexy.org/view/s2060bkTNl)
Kjell writes in (http://slexy.org/view/s2G7eMC6oP)
Paul writes in (http://slexy.org/view/s2REfzMFGK)
Tom writes in (http://slexy.org/view/s21nvJtXY6)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, flightaware, karl lehenbauer, keynote, bsdcan, 2014, webcast, beyond security, libressl, linux, bsd vs linux, freenas, plugins, jails, plex media server, plex, owncloud, tarsnap, ixsystems, code review, kyua, geom, ufs, zfs, books, absolute freebsd, carp, failover, high availability, firewalls, pf, ipfw, load balancing</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>On this week&#39;s episode, we&#39;ll be giving you an introductory guide on OpenBSD&#39;s ports and package system. There&#39;s also a pretty fly interview with Karl Lehenbauer, about how they use FreeBSD at FlightAware. Lots of interesting news and answers to all your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2014/schedule/" rel="nofollow">BSDCan 2014 talks and reports, part 2</a></h3>

<ul>
<li>More presentations and trip reports are still being uploaded</li>
<li>Ingo Schwarze, <a href="https://www.youtube.com/watch?v=oifYhwTaOuw" rel="nofollow">New Trends in mandoc</a></li>
<li>Vsevolod Stakhov, <a href="https://www.youtube.com/watch?v=3SOKFz2UUQ4" rel="nofollow">The Architecture of the New Solver in pkg
</a></li>
<li>Julio Merino, <a href="https://www.youtube.com/watch?v=nf-bFeKaZsY" rel="nofollow">The FreeBSD Test Suite</a></li>
<li>Zbigniew Bodek, <a href="https://www.youtube.com/watch?v=s5iIKEHtbX8" rel="nofollow">Transparent Superpages for FreeBSD on ARM</a></li>
<li>There&#39;s also a <a href="http://freebsdfoundation.blogspot.com/2014/06/bsdcan-trip-report-michael-dexter.html" rel="nofollow">trip report from Michael Dexter</a> and another (very long and detailed) <a href="http://freebsdfoundation.blogspot.com/2014/05/bsdcan-trip-report-warren-block.html" rel="nofollow">trip report</a> from our friend <a href="http://www.bsdnow.tv/episodes/2014_03_26-documentation_is_king" rel="nofollow">Warren Block</a> that even gives us some linkage, thanks!
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=JrFfrrY-yOo" rel="nofollow">Beyond security, getting to know OpenBSD&#39;s real purpose</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">Michael W Lucas</a> (who, we learn through this video, has been using BSD since 1986) gave a &quot;webcast&quot; last week, and the audio and slides are finally up</li>
<li>It clocks in at just over 30 minutes, managing to touch on a lot of OpenBSD topics</li>
<li>Some of those topics include: what is OpenBSD and why you should care, the philosophy of the project, how it serves as a &quot;pressure cooker for ideas,&quot; briefly touches on GPL vs BSDL, their &quot;do it right or don&#39;t do it at all&quot; attitude, their stance on NDAs and blobs, recent LibreSSL development, some of the security functions that OpenBSD enabled before anyone else (and the ripple effect that had) and, of course, their disturbing preference for comic sans</li>
<li>Here&#39;s a direct link to <a href="https://wcc.on24.com/event/76/67/12/rt/1/documents/resourceList1400781110933/20140527_beyond_security_openbsd.pdf" rel="nofollow">the slides</a></li>
<li>Great presentation if you&#39;d like to learn a bit about OpenBSD, but also contains a bit of information that long-time users might not know too
***</li>
</ul>

<h3><a href="http://brioteam.com/linux-versus-freebsd-comprehensive-comparison" rel="nofollow">FreeBSD vs Linux, a comprehensive comparison</a></h3>

<ul>
<li>Another blog post covering something people seem to be obsessed with - FreeBSD vs Linux</li>
<li>This one was worth mentioning because it&#39;s very thorough in regards to how things are done behind the scenes, not just the usual technical differences</li>
<li>It highlights the concept of a &quot;core team&quot; and their role vs &quot;contributors&quot; and &quot;committers&quot; (similar to a presentation Kirk McKusick did not long ago)</li>
<li>While a lot of things will be the same on both platforms, you might still be asking &quot;which one is right for me?&quot; - this article weighs in with some points for both sides and different use cases</li>
<li>Pretty well-written and unbiased article that also mentions areas where Linux might be better, so don&#39;t hate us for linking it
***</li>
</ul>

<h3><a href="http://www.openlogic.com/wazi/bid/345617/Expand-FreeNAS-with-plugins" rel="nofollow">Expand FreeNAS with plugins</a></h3>

<ul>
<li>One of the things people love the most about FreeNAS (other than ZFS) is their cool plugin framework</li>
<li>With these plugins, you can greatly expand the feature set of your NAS via third party programs</li>
<li>This page talks about a few of the more popular ones and how they can be used to improve your NAS or media box experience</li>
<li>Some examples include setting up an OwnCloud server, Bacula for backups, Maraschino for managing a home theater PC, Plex Media Server for an easy to use video experience and a few more</li>
<li>It then goes into more detail about each of them, how to actually install plugins and then how to set them up
***</li>
</ul>

<h2>Interview - Karl Lehenbauer - <a href="mailto:karl@flightaware.com" rel="nofollow">karl@flightaware.com</a> / <a href="https://twitter.com/flightaware" rel="nofollow">@flightaware</a></h2>

<p>FreeBSD at FlightAware, BSD history, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ports-obsd" rel="nofollow">Ports and packages in OpenBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://julipedia.meroh.net/2014/05/code-review-culture-meets-freebsd.html" rel="nofollow">Code review culture meets FreeBSD</a></h3>

<ul>
<li>In most of the BSDs, changes need to be reviewed by more than one person before being committed to the tree</li>
<li>This article describes Phabricator, an open source code review system that we briefly mentioned last week</li>
<li>Instructions for using it are on <a href="https://wiki.freebsd.org/CodeReview" rel="nofollow">the wiki</a></li>
<li>While not approved by the core team yet for anything official, it&#39;s in a testing phase and developers are encouraged to try it out and get their patches reviewed</li>
<li><a href="http://phabric.freebsd.org/" rel="nofollow">Just look at that fancy interface!!</a>
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/2088" rel="nofollow">Upcoming BSD books</a></h3>

<ul>
<li>Sneaky MWL somehow finds his way into both our headlines and the news roundup</li>
<li>He gives us an update on the next BSD books that he&#39;s planning to release</li>
<li>The plan is to release three (or so) books based on different aspects of FreeBSD&#39;s storage system(s) - GEOM, UFS, ZFS, etc.</li>
<li>This has the advantage of only requiring you to buy the one(s) you&#39;re specifically interested in</li>
<li>&quot;When will they be released? When I&#39;m done writing them. How much will they cost? Dunno.&quot;</li>
<li>It&#39;s not Absolute FreeBSD 3rd edition...
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=VjYb9mKB4jU" rel="nofollow">CARP failover and high availability on FreeBSD</a></h3>

<ul>
<li>If you&#39;re running a cluster or a group of servers, you should have some sort of failover in place</li>
<li>But the question comes up, &quot;how do you load balance the load balancers!?&quot;</li>
<li>This video goes through the process of giving more than one machine the same IP, how to set up CARP, securing it and demonstrates a node dying</li>
<li>Also mentions DNS-based load balancing as another option
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/05/weekly-feature-digest-30/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>This time in PCBSD land, we&#39;re getting ready for the 10.0.2 release <a href="http://download.pcbsd.org/iso/10.0-RELEASE/testing/amd64/" rel="nofollow">(ISOs here)</a></li>
<li>AppCafe got a good number of fixes, and now shows 10 random highlighted applications</li>
<li>EasyPBI added a &quot;bulk&quot; mode to create PBIs of an entire FreeBSD port category</li>
<li>Lumina, the new desktop environment, is still being worked on and got some bug fixes too
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s205iiKiWp" rel="nofollow">Paul writes in</a></li>
<li><a href="http://slexy.org/view/s2060bkTNl" rel="nofollow">Matt writes in</a></li>
<li><a href="http://slexy.org/view/s2G7eMC6oP" rel="nofollow">Kjell writes in</a></li>
<li><a href="http://slexy.org/view/s2REfzMFGK" rel="nofollow">Paul writes in</a></li>
<li><a href="http://slexy.org/view/s21nvJtXY6" rel="nofollow">Tom writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>On this week&#39;s episode, we&#39;ll be giving you an introductory guide on OpenBSD&#39;s ports and package system. There&#39;s also a pretty fly interview with Karl Lehenbauer, about how they use FreeBSD at FlightAware. Lots of interesting news and answers to all your emails, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2014/schedule/" rel="nofollow">BSDCan 2014 talks and reports, part 2</a></h3>

<ul>
<li>More presentations and trip reports are still being uploaded</li>
<li>Ingo Schwarze, <a href="https://www.youtube.com/watch?v=oifYhwTaOuw" rel="nofollow">New Trends in mandoc</a></li>
<li>Vsevolod Stakhov, <a href="https://www.youtube.com/watch?v=3SOKFz2UUQ4" rel="nofollow">The Architecture of the New Solver in pkg
</a></li>
<li>Julio Merino, <a href="https://www.youtube.com/watch?v=nf-bFeKaZsY" rel="nofollow">The FreeBSD Test Suite</a></li>
<li>Zbigniew Bodek, <a href="https://www.youtube.com/watch?v=s5iIKEHtbX8" rel="nofollow">Transparent Superpages for FreeBSD on ARM</a></li>
<li>There&#39;s also a <a href="http://freebsdfoundation.blogspot.com/2014/06/bsdcan-trip-report-michael-dexter.html" rel="nofollow">trip report from Michael Dexter</a> and another (very long and detailed) <a href="http://freebsdfoundation.blogspot.com/2014/05/bsdcan-trip-report-warren-block.html" rel="nofollow">trip report</a> from our friend <a href="http://www.bsdnow.tv/episodes/2014_03_26-documentation_is_king" rel="nofollow">Warren Block</a> that even gives us some linkage, thanks!
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=JrFfrrY-yOo" rel="nofollow">Beyond security, getting to know OpenBSD&#39;s real purpose</a></h3>

<ul>
<li><a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">Michael W Lucas</a> (who, we learn through this video, has been using BSD since 1986) gave a &quot;webcast&quot; last week, and the audio and slides are finally up</li>
<li>It clocks in at just over 30 minutes, managing to touch on a lot of OpenBSD topics</li>
<li>Some of those topics include: what is OpenBSD and why you should care, the philosophy of the project, how it serves as a &quot;pressure cooker for ideas,&quot; briefly touches on GPL vs BSDL, their &quot;do it right or don&#39;t do it at all&quot; attitude, their stance on NDAs and blobs, recent LibreSSL development, some of the security functions that OpenBSD enabled before anyone else (and the ripple effect that had) and, of course, their disturbing preference for comic sans</li>
<li>Here&#39;s a direct link to <a href="https://wcc.on24.com/event/76/67/12/rt/1/documents/resourceList1400781110933/20140527_beyond_security_openbsd.pdf" rel="nofollow">the slides</a></li>
<li>Great presentation if you&#39;d like to learn a bit about OpenBSD, but also contains a bit of information that long-time users might not know too
***</li>
</ul>

<h3><a href="http://brioteam.com/linux-versus-freebsd-comprehensive-comparison" rel="nofollow">FreeBSD vs Linux, a comprehensive comparison</a></h3>

<ul>
<li>Another blog post covering something people seem to be obsessed with - FreeBSD vs Linux</li>
<li>This one was worth mentioning because it&#39;s very thorough in regards to how things are done behind the scenes, not just the usual technical differences</li>
<li>It highlights the concept of a &quot;core team&quot; and their role vs &quot;contributors&quot; and &quot;committers&quot; (similar to a presentation Kirk McKusick did not long ago)</li>
<li>While a lot of things will be the same on both platforms, you might still be asking &quot;which one is right for me?&quot; - this article weighs in with some points for both sides and different use cases</li>
<li>Pretty well-written and unbiased article that also mentions areas where Linux might be better, so don&#39;t hate us for linking it
***</li>
</ul>

<h3><a href="http://www.openlogic.com/wazi/bid/345617/Expand-FreeNAS-with-plugins" rel="nofollow">Expand FreeNAS with plugins</a></h3>

<ul>
<li>One of the things people love the most about FreeNAS (other than ZFS) is their cool plugin framework</li>
<li>With these plugins, you can greatly expand the feature set of your NAS via third party programs</li>
<li>This page talks about a few of the more popular ones and how they can be used to improve your NAS or media box experience</li>
<li>Some examples include setting up an OwnCloud server, Bacula for backups, Maraschino for managing a home theater PC, Plex Media Server for an easy to use video experience and a few more</li>
<li>It then goes into more detail about each of them, how to actually install plugins and then how to set them up
***</li>
</ul>

<h2>Interview - Karl Lehenbauer - <a href="mailto:karl@flightaware.com" rel="nofollow">karl@flightaware.com</a> / <a href="https://twitter.com/flightaware" rel="nofollow">@flightaware</a></h2>

<p>FreeBSD at FlightAware, BSD history, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ports-obsd" rel="nofollow">Ports and packages in OpenBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://julipedia.meroh.net/2014/05/code-review-culture-meets-freebsd.html" rel="nofollow">Code review culture meets FreeBSD</a></h3>

<ul>
<li>In most of the BSDs, changes need to be reviewed by more than one person before being committed to the tree</li>
<li>This article describes Phabricator, an open source code review system that we briefly mentioned last week</li>
<li>Instructions for using it are on <a href="https://wiki.freebsd.org/CodeReview" rel="nofollow">the wiki</a></li>
<li>While not approved by the core team yet for anything official, it&#39;s in a testing phase and developers are encouraged to try it out and get their patches reviewed</li>
<li><a href="http://phabric.freebsd.org/" rel="nofollow">Just look at that fancy interface!!</a>
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/2088" rel="nofollow">Upcoming BSD books</a></h3>

<ul>
<li>Sneaky MWL somehow finds his way into both our headlines and the news roundup</li>
<li>He gives us an update on the next BSD books that he&#39;s planning to release</li>
<li>The plan is to release three (or so) books based on different aspects of FreeBSD&#39;s storage system(s) - GEOM, UFS, ZFS, etc.</li>
<li>This has the advantage of only requiring you to buy the one(s) you&#39;re specifically interested in</li>
<li>&quot;When will they be released? When I&#39;m done writing them. How much will they cost? Dunno.&quot;</li>
<li>It&#39;s not Absolute FreeBSD 3rd edition...
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=VjYb9mKB4jU" rel="nofollow">CARP failover and high availability on FreeBSD</a></h3>

<ul>
<li>If you&#39;re running a cluster or a group of servers, you should have some sort of failover in place</li>
<li>But the question comes up, &quot;how do you load balance the load balancers!?&quot;</li>
<li>This video goes through the process of giving more than one machine the same IP, how to set up CARP, securing it and demonstrates a node dying</li>
<li>Also mentions DNS-based load balancing as another option
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/05/weekly-feature-digest-30/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>This time in PCBSD land, we&#39;re getting ready for the 10.0.2 release <a href="http://download.pcbsd.org/iso/10.0-RELEASE/testing/amd64/" rel="nofollow">(ISOs here)</a></li>
<li>AppCafe got a good number of fixes, and now shows 10 random highlighted applications</li>
<li>EasyPBI added a &quot;bulk&quot; mode to create PBIs of an entire FreeBSD port category</li>
<li>Lumina, the new desktop environment, is still being worked on and got some bug fixes too
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s205iiKiWp" rel="nofollow">Paul writes in</a></li>
<li><a href="http://slexy.org/view/s2060bkTNl" rel="nofollow">Matt writes in</a></li>
<li><a href="http://slexy.org/view/s2G7eMC6oP" rel="nofollow">Kjell writes in</a></li>
<li><a href="http://slexy.org/view/s2REfzMFGK" rel="nofollow">Paul writes in</a></li>
<li><a href="http://slexy.org/view/s21nvJtXY6" rel="nofollow">Tom writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>39: The Friendly Sandbox</title>
  <link>https://www.bsdnow.tv/39</link>
  <guid isPermaLink="false">4ae1b0f5-7c6f-486f-bdcf-c71ec415269c</guid>
  <pubDate>Wed, 28 May 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4ae1b0f5-7c6f-486f-bdcf-c71ec415269c.mp3" length="45004756" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show we'll be talking with Jon Anderson about Capsicum and Casper to securely sandbox processes. After that, our tutorial will show you how to encrypt all your DNS lookups, either on a single system or for your whole network. News, emails and all the usual fun, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:02:30</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show we'll be talking with Jon Anderson about Capsicum and Casper to securely sandbox processes. After that, our tutorial will show you how to encrypt all your DNS lookups, either on a single system or for your whole network. News, emails and all the usual fun, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
BSDCan 2014 talks and reports (https://www.bsdcan.org/2014/schedule/)
The majority of the BSDCan talks are finally uploaded, so prepare to be flooded with links
Karl Lehenbauer's keynote (https://www.youtube.com/watch?v=13LiyjnTGsQ) (he's on next week's episode)
Mariusz Zaborski and Pawel Jakub Dawidek,
Capsicum and Casper (https://www.youtube.com/watch?v=0la06FHbdvg) (relevant to today's interview)
Luigi Rizzo,
In-kernel OpenvSwitch on FreeBSD (https://www.youtube.com/watch?v=Lr5o1VQMtgA)
Dwayne Hart, Migrating from Linux to FreeBSD for Backend Data Storage (https://www.youtube.com/watch?v=AVuF9eFeVWs)
Warner Losh, NAND Flash and FreeBSD (https://www.youtube.com/watch?v=lj0XAE6C6-k)
Simon Gerraty, FreeBSD bmake and Meta Mode (https://www.youtube.com/watch?v=4s0UY0sg6vI)
Bob Beck, LibreSSL - The First 30 Days (https://www.youtube.com/watch?v=oM6S7FEUfkU)
Henning Brauer, OpenBGPD Turns 10 Years Old (https://www.youtube.com/watch?v=cP8AW111IKg)
Arun Thomas, BSD ARM Kernel Internals (https://www.youtube.com/watch?v=ZAM7fqhGRr8)
Peter Hessler, Using BGP for Realtime Spam Lists (https://www.youtube.com/watch?v=i8UAVswpagA)
Pedro Giffuni, Features and Status of FreeBSD's Ext2 Implementation
 (https://www.youtube.com/watch?v=HMeTxViulgo)
Matt Ahrens, OpenZFS Upcoming Features and Performance Enhancements (https://www.youtube.com/watch?v=EjGqVdCOIhM)
Daichi Goto, Shellscripts and Commands (https://www.youtube.com/watch?v=MsRu0xIawaA)
Benno Rice, Keeping Current (https://www.youtube.com/watch?v=jZp-ciB6mAg)
Sean Bruno, MIPS Router Hacking (https://www.youtube.com/watch?v=LZjoFSfIv3k)
John-Mark Gurney, Optimizing GELI Performance (https://www.youtube.com/watch?v=2qicD0tv_tI)
Patrick Kelsey, Userspace Networking with libuinet (https://www.youtube.com/watch?v=LhIx8q8_7YY)
Massimiliano Stucchi, IPv6 Transitioning Mechanisms (https://www.youtube.com/watch?v=WZoQzUZKaeo)
Roger Pau Monné, Taking the Red Pill (https://www.youtube.com/watch?v=q6l9qtjlNXU)
Shawn Webb, Introducing ASLR in FreeBSD (https://www.youtube.com/watch?v=jo8ObzR1tKQ)
There's also a trip report (http://undeadly.org/cgi?action=article&amp;amp;sid=20140519164127) from Peter Hessler and one from Julio Merino (http://julipedia.meroh.net/2014/05/bsdcan-2014-summary.html)
The latter report also talks about how, unfortunately, NetBSD basically had no presence in the event at all (and how that's a recurring trend)
***
Defend your network and privacy with a VPN and OpenBSD (http://networkfilter.blogspot.com/2014/05/defend-your-network-and-privacy-vpn.html)
After all the recent news about spying, backdoored routers, deep packet inspection and everything else, you might want to start taking steps at getting some privacy back
This article describes how to set up a secure network gateway and VPN using OpenBSD and related crypto utilities
There are bits for DHCP, DNS, OpenVPN, DNSCrypt and a watchdog script to make sure your tunnel is always being used
You can transparently tunnel all your outbound traffic over the VPN with this configuration, nothing is needed on any of the client systems - this could also be used with Tor (but it would be very slow)
It also includes a few general privacy tips, recommended browser extensions, etc
The intro to the article is especially great, so give the whole thing a read
He mentions our OpenBSD router guide (http://www.bsdnow.tv/tutorials/openbsd-router) and other tutorials being a big help for this setup, so hello if you're watching!
***
You should try FreeBSD (http://blog.pascalj.com/article/you-should-try-freebsd/)
In this blog post, the author talks a bit about how some Linux people aren't familiar with the BSDs and how we can take steps to change that
He goes into some FreeBSD history specifically, then talks about some of the apparent (and not-so-apparent) differences between the two
Possibly the most useful part is how to address the question "my server already works, why bother switching?"
"Stackoverflow’s answers assume I have apt-get installed"
It includes mention of the great documentation, stability, ports, improved security and much more
A takeaway quote for would-be Linux switchers: "I like to compare FreeBSD to a really tidy room where you can find everything with your eyes closed. Once you know where the closets are, it is easy to just grab what you need, even if you have never touched it before"
***
OpenBSD and the little Mauritian contributor (http://hacklog.in/openbsd-and-the-little-mauritian-contributor/)
This is a story about a guy from Mauritius (https://en.wikipedia.org/wiki/Mauritius) named Logan, one of OpenBSD's newest developers
Back in 2010, he started sending in patched for OpenBSD's "mg" editor, among other small things, and eventually added file transfer resume support for SFTP
The article talks about his journey from just a guy who submits a patch here and there to joining the developer ranks and even getting his picture taken with Theo at a recent hackathon
It really shows how easy it is to get involved with the different BSDs and contribute back to the software ecosystem
Congrats to Logan, and hopefully this will inspire more people to start helping out and contributing code back
***
Interview - Jon Anderson - jonathan@freebsd.org (mailto:jonathan@freebsd.org)
Capsicum and Casperd
Tutorial
Encrypting DNS lookups (http://www.bsdnow.tv/tutorials/dnscrypt)
News Roundup
FreeBSD Journal, May 2014 issue (http://i.imgur.com/f0qg6Ss.jpg)
The newest issue of the FreeBSD Journal (http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates) is out, following the bi-monthly release cycle
This time the topics include: a letter from the foundation, a ports report, some 9.3-RELEASE plans, an events calendar, an overview of ipfw, exploring network activity with dtrace, an article about kqueue, data distribution with dnssec and finally an article about TCP scaling
Pick up your (digital) copy at Amazon, Google Play or on iTunes and have a read
***
LibreSSL porting update (http://insanecoding.blogspot.com/2014/05/libressl-porting-update.html)
Since the last LibreSSL post we covered, a couple unofficial "portable" versions have died off
Unfortunately, people still think they can just port LibreSSL to other BSDs and Linux all willy-nilly - stop doing that!
This post reiterates that LibreSSL currently relies on a lot of OpenBSD-specific security functions that are not present in other systems, and also gives a very eye-opening example
Please wait for an official portable version instead of wasting time with these dime-a-dozen github clones that do more harm than good
***
BSDMag May 2014 issue is out (http://bsdmag.org/magazine/1862-meteorjs-on-freebsd-11-may-bsd-issue)
The usual monthly release from BSDMag, covering a variety of subjects
This time around the topics include: managing large development projects using RCS, working with HAMMER FS and PFSes, running MeteorJS on FreeBSD 11, another bhyve article, more GIMP tutorials and a few other things
It's a free PDF, go grab it
***
BSDTalk episode 241 (http://bsdtalk.blogspot.com/2014/05/bsdtalk241-bob-beck.html)
A new episode of BSDTalk (http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk) is out, this time with Bob Beck
He talks about the OpenBSD foundation's recent activities, his own work in the project, some stories about the hardware in Theo's basement and a lot more
The interview itself isn't about LibreSSL at all, but they do touch on it a bit too
Really interesting stuff, covers a lot of different topics in a short amount of time
***
Feedback/Questions
We got a number of replies about last week's VPN question, so thanks to everyone who sent in an email about it - the vpnc (https://www.freshports.org/security/vpnc/) package seems to be what we were looking for
Tim writes in (http://slexy.org/view/s20MK7bTyc)
AJ writes in (http://slexy.org/view/s2OWREQdUA)
Peter writes in (http://slexy.org/view/s202obAqbT)
Thomas writes in (http://slexy.org/view/s21Kye2jAc)
Martin writes in (http://slexy.org/view/s2zqFVqwxN)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, casper, casperd, the friendly ghost, capsicum, sandbox, application, jails, isolation, isolated, chroot, virtual machine, exploit, vpn, security, ssh, tunnel, encryption, bsdcan, presentation, talk, video, recordings, dnscrypt, opendns, dnscurve, lookups, dns, dnssec, gateway, vpn, vps, journal, bsdmag, bsdtalk, libressl</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show we&#39;ll be talking with Jon Anderson about Capsicum and Casper to securely sandbox processes. After that, our tutorial will show you how to encrypt all your DNS lookups, either on a single system or for your whole network. News, emails and all the usual fun, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2014/schedule/" rel="nofollow">BSDCan 2014 talks and reports</a></h3>

<ul>
<li>The majority of the BSDCan talks are finally uploaded, so prepare to be flooded with links</li>
<li>Karl Lehenbauer&#39;s <a href="https://www.youtube.com/watch?v=13LiyjnTGsQ" rel="nofollow">keynote</a> (he&#39;s on next week&#39;s episode)</li>
<li>Mariusz Zaborski and Pawel Jakub Dawidek,
<a href="https://www.youtube.com/watch?v=0la06FHbdvg" rel="nofollow">Capsicum and Casper</a> (relevant to today&#39;s interview)</li>
<li>Luigi Rizzo,
<a href="https://www.youtube.com/watch?v=Lr5o1VQMtgA" rel="nofollow">In-kernel OpenvSwitch on FreeBSD</a></li>
<li>Dwayne Hart, <a href="https://www.youtube.com/watch?v=AVuF9eFeVWs" rel="nofollow">Migrating from Linux to FreeBSD for Backend Data Storage</a></li>
<li>Warner Losh, <a href="https://www.youtube.com/watch?v=lj0XAE6C6-k" rel="nofollow">NAND Flash and FreeBSD</a></li>
<li>Simon Gerraty, <a href="https://www.youtube.com/watch?v=4s0UY0sg6vI" rel="nofollow">FreeBSD bmake and Meta Mode</a></li>
<li>Bob Beck, <a href="https://www.youtube.com/watch?v=oM6S7FEUfkU" rel="nofollow">LibreSSL - The First 30 Days</a></li>
<li>Henning Brauer, <a href="https://www.youtube.com/watch?v=cP8AW111IKg" rel="nofollow">OpenBGPD Turns 10 Years Old</a></li>
<li>Arun Thomas, <a href="https://www.youtube.com/watch?v=ZAM7fqhGRr8" rel="nofollow">BSD ARM Kernel Internals</a></li>
<li>Peter Hessler, <a href="https://www.youtube.com/watch?v=i8UAVswpagA" rel="nofollow">Using BGP for Realtime Spam Lists</a></li>
<li>Pedro Giffuni, <a href="https://www.youtube.com/watch?v=HMeTxViulgo" rel="nofollow">Features and Status of FreeBSD&#39;s Ext2 Implementation
</a></li>
<li>Matt Ahrens, <a href="https://www.youtube.com/watch?v=EjGqVdCOIhM" rel="nofollow">OpenZFS Upcoming Features and Performance Enhancements</a></li>
<li>Daichi Goto, <a href="https://www.youtube.com/watch?v=MsRu0xIawaA" rel="nofollow">Shellscripts and Commands</a></li>
<li>Benno Rice, <a href="https://www.youtube.com/watch?v=jZp-ciB6mAg" rel="nofollow">Keeping Current</a></li>
<li>Sean Bruno, <a href="https://www.youtube.com/watch?v=LZjoFSfIv3k" rel="nofollow">MIPS Router Hacking</a></li>
<li>John-Mark Gurney, <a href="https://www.youtube.com/watch?v=2qicD0tv_tI" rel="nofollow">Optimizing GELI Performance</a></li>
<li>Patrick Kelsey, <a href="https://www.youtube.com/watch?v=LhIx8q8_7YY" rel="nofollow">Userspace Networking with libuinet</a></li>
<li>Massimiliano Stucchi, <a href="https://www.youtube.com/watch?v=WZoQzUZKaeo" rel="nofollow">IPv6 Transitioning Mechanisms</a></li>
<li>Roger Pau Monné, <a href="https://www.youtube.com/watch?v=q6l9qtjlNXU" rel="nofollow">Taking the Red Pill</a></li>
<li>Shawn Webb, <a href="https://www.youtube.com/watch?v=jo8ObzR1tKQ" rel="nofollow">Introducing ASLR in FreeBSD</a></li>
<li>There&#39;s also a <a href="http://undeadly.org/cgi?action=article&sid=20140519164127" rel="nofollow">trip report</a> from Peter Hessler and <a href="http://julipedia.meroh.net/2014/05/bsdcan-2014-summary.html" rel="nofollow">one from Julio Merino</a></li>
<li>The latter report also talks about how, unfortunately, NetBSD basically had no presence in the event at all (and how that&#39;s a recurring trend)
***</li>
</ul>

<h3><a href="http://networkfilter.blogspot.com/2014/05/defend-your-network-and-privacy-vpn.html" rel="nofollow">Defend your network and privacy with a VPN and OpenBSD</a></h3>

<ul>
<li>After all the recent news about spying, backdoored routers, deep packet inspection and everything else, you might want to start taking steps at getting some privacy back</li>
<li>This article describes how to set up a secure network gateway and VPN using OpenBSD and related crypto utilities</li>
<li>There are bits for DHCP, DNS, OpenVPN, DNSCrypt and a watchdog script to make sure your tunnel is always being used</li>
<li>You can transparently tunnel all your outbound traffic over the VPN with this configuration, nothing is needed on any of the client systems - this could also be used with Tor (but it would be very slow)</li>
<li>It also includes a few general privacy tips, recommended browser extensions, etc</li>
<li>The intro to the article is especially great, so give the whole thing a read</li>
<li>He mentions our <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">OpenBSD router guide</a> and other tutorials being a big help for this setup, so hello if you&#39;re watching!
***</li>
</ul>

<h3><a href="http://blog.pascalj.com/article/you-should-try-freebsd/" rel="nofollow">You should try FreeBSD</a></h3>

<ul>
<li>In this blog post, the author talks a bit about how some Linux people aren&#39;t familiar with the BSDs and how we can take steps to change that</li>
<li>He goes into some FreeBSD history specifically, then talks about some of the apparent (and not-so-apparent) differences between the two</li>
<li>Possibly the most useful part is how to address the question &quot;my server already works, why bother switching?&quot;</li>
<li>&quot;Stackoverflow’s answers assume I have apt-get installed&quot;</li>
<li>It includes mention of the great documentation, stability, ports, improved security and much more</li>
<li>A takeaway quote for would-be Linux switchers: &quot;I like to compare FreeBSD to a really tidy room where you can find everything with your eyes closed. Once you know where the closets are, it is easy to just grab what you need, even if you have never touched it before&quot;
***</li>
</ul>

<h3><a href="http://hacklog.in/openbsd-and-the-little-mauritian-contributor/" rel="nofollow">OpenBSD and the little Mauritian contributor</a></h3>

<ul>
<li>This is a story about a guy from <a href="https://en.wikipedia.org/wiki/Mauritius" rel="nofollow">Mauritius</a> named Logan, one of OpenBSD&#39;s newest developers</li>
<li>Back in 2010, he started sending in patched for OpenBSD&#39;s &quot;mg&quot; editor, among other small things, and eventually added file transfer resume support for SFTP</li>
<li>The article talks about his journey from just a guy who submits a patch here and there to joining the developer ranks and even getting his picture taken with Theo at a recent hackathon</li>
<li>It really shows how easy it is to get involved with the different BSDs and contribute back to the software ecosystem</li>
<li>Congrats to Logan, and hopefully this will inspire more people to start helping out and contributing code back
***</li>
</ul>

<h2>Interview - Jon Anderson - <a href="mailto:jonathan@freebsd.org" rel="nofollow">jonathan@freebsd.org</a></h2>

<p>Capsicum and Casperd</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/dnscrypt" rel="nofollow">Encrypting DNS lookups</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://i.imgur.com/f0qg6Ss.jpg" rel="nofollow">FreeBSD Journal, May 2014 issue</a></h3>

<ul>
<li>The newest issue of the <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">FreeBSD Journal</a> is out, following the bi-monthly release cycle</li>
<li>This time the topics include: a letter from the foundation, a ports report, some 9.3-RELEASE plans, an events calendar, an overview of ipfw, exploring network activity with dtrace, an article about kqueue, data distribution with dnssec and finally an article about TCP scaling</li>
<li>Pick up your (digital) copy at Amazon, Google Play or on iTunes and have a read
***</li>
</ul>

<h3><a href="http://insanecoding.blogspot.com/2014/05/libressl-porting-update.html" rel="nofollow">LibreSSL porting update</a></h3>

<ul>
<li>Since the last LibreSSL post we covered, a couple unofficial &quot;portable&quot; versions have died off</li>
<li>Unfortunately, people still think they can just port LibreSSL to other BSDs and Linux all willy-nilly - stop doing that!</li>
<li>This post reiterates that LibreSSL currently relies on a lot of OpenBSD-specific security functions that are not present in other systems, and also gives a very eye-opening example</li>
<li>Please wait for an official portable version instead of wasting time with these dime-a-dozen github clones that do more harm than good
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1862-meteorjs-on-freebsd-11-may-bsd-issue" rel="nofollow">BSDMag May 2014 issue is out</a></h3>

<ul>
<li>The usual monthly release from BSDMag, covering a variety of subjects</li>
<li>This time around the topics include: managing large development projects using RCS, working with HAMMER FS and PFSes, running MeteorJS on FreeBSD 11, another bhyve article, more GIMP tutorials and a few other things</li>
<li>It&#39;s a free PDF, go grab it
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2014/05/bsdtalk241-bob-beck.html" rel="nofollow">BSDTalk episode 241</a></h3>

<ul>
<li>A new episode of <a href="http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk" rel="nofollow">BSDTalk</a> is out, this time with Bob Beck</li>
<li>He talks about the OpenBSD foundation&#39;s recent activities, his own work in the project, some stories about the hardware in Theo&#39;s basement and a lot more</li>
<li>The interview itself isn&#39;t about LibreSSL at all, but they do touch on it a bit too</li>
<li>Really interesting stuff, covers a lot of different topics in a short amount of time
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>We got a number of replies about last week&#39;s VPN question, so thanks to everyone who sent in an email about it - the <a href="https://www.freshports.org/security/vpnc/" rel="nofollow">vpnc</a> package seems to be what we were looking for</li>
<li><a href="http://slexy.org/view/s20MK7bTyc" rel="nofollow">Tim writes in</a></li>
<li><a href="http://slexy.org/view/s2OWREQdUA" rel="nofollow">AJ writes in</a></li>
<li><a href="http://slexy.org/view/s202obAqbT" rel="nofollow">Peter writes in</a></li>
<li><a href="http://slexy.org/view/s21Kye2jAc" rel="nofollow">Thomas writes in</a></li>
<li><a href="http://slexy.org/view/s2zqFVqwxN" rel="nofollow">Martin writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show we&#39;ll be talking with Jon Anderson about Capsicum and Casper to securely sandbox processes. After that, our tutorial will show you how to encrypt all your DNS lookups, either on a single system or for your whole network. News, emails and all the usual fun, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2014/schedule/" rel="nofollow">BSDCan 2014 talks and reports</a></h3>

<ul>
<li>The majority of the BSDCan talks are finally uploaded, so prepare to be flooded with links</li>
<li>Karl Lehenbauer&#39;s <a href="https://www.youtube.com/watch?v=13LiyjnTGsQ" rel="nofollow">keynote</a> (he&#39;s on next week&#39;s episode)</li>
<li>Mariusz Zaborski and Pawel Jakub Dawidek,
<a href="https://www.youtube.com/watch?v=0la06FHbdvg" rel="nofollow">Capsicum and Casper</a> (relevant to today&#39;s interview)</li>
<li>Luigi Rizzo,
<a href="https://www.youtube.com/watch?v=Lr5o1VQMtgA" rel="nofollow">In-kernel OpenvSwitch on FreeBSD</a></li>
<li>Dwayne Hart, <a href="https://www.youtube.com/watch?v=AVuF9eFeVWs" rel="nofollow">Migrating from Linux to FreeBSD for Backend Data Storage</a></li>
<li>Warner Losh, <a href="https://www.youtube.com/watch?v=lj0XAE6C6-k" rel="nofollow">NAND Flash and FreeBSD</a></li>
<li>Simon Gerraty, <a href="https://www.youtube.com/watch?v=4s0UY0sg6vI" rel="nofollow">FreeBSD bmake and Meta Mode</a></li>
<li>Bob Beck, <a href="https://www.youtube.com/watch?v=oM6S7FEUfkU" rel="nofollow">LibreSSL - The First 30 Days</a></li>
<li>Henning Brauer, <a href="https://www.youtube.com/watch?v=cP8AW111IKg" rel="nofollow">OpenBGPD Turns 10 Years Old</a></li>
<li>Arun Thomas, <a href="https://www.youtube.com/watch?v=ZAM7fqhGRr8" rel="nofollow">BSD ARM Kernel Internals</a></li>
<li>Peter Hessler, <a href="https://www.youtube.com/watch?v=i8UAVswpagA" rel="nofollow">Using BGP for Realtime Spam Lists</a></li>
<li>Pedro Giffuni, <a href="https://www.youtube.com/watch?v=HMeTxViulgo" rel="nofollow">Features and Status of FreeBSD&#39;s Ext2 Implementation
</a></li>
<li>Matt Ahrens, <a href="https://www.youtube.com/watch?v=EjGqVdCOIhM" rel="nofollow">OpenZFS Upcoming Features and Performance Enhancements</a></li>
<li>Daichi Goto, <a href="https://www.youtube.com/watch?v=MsRu0xIawaA" rel="nofollow">Shellscripts and Commands</a></li>
<li>Benno Rice, <a href="https://www.youtube.com/watch?v=jZp-ciB6mAg" rel="nofollow">Keeping Current</a></li>
<li>Sean Bruno, <a href="https://www.youtube.com/watch?v=LZjoFSfIv3k" rel="nofollow">MIPS Router Hacking</a></li>
<li>John-Mark Gurney, <a href="https://www.youtube.com/watch?v=2qicD0tv_tI" rel="nofollow">Optimizing GELI Performance</a></li>
<li>Patrick Kelsey, <a href="https://www.youtube.com/watch?v=LhIx8q8_7YY" rel="nofollow">Userspace Networking with libuinet</a></li>
<li>Massimiliano Stucchi, <a href="https://www.youtube.com/watch?v=WZoQzUZKaeo" rel="nofollow">IPv6 Transitioning Mechanisms</a></li>
<li>Roger Pau Monné, <a href="https://www.youtube.com/watch?v=q6l9qtjlNXU" rel="nofollow">Taking the Red Pill</a></li>
<li>Shawn Webb, <a href="https://www.youtube.com/watch?v=jo8ObzR1tKQ" rel="nofollow">Introducing ASLR in FreeBSD</a></li>
<li>There&#39;s also a <a href="http://undeadly.org/cgi?action=article&sid=20140519164127" rel="nofollow">trip report</a> from Peter Hessler and <a href="http://julipedia.meroh.net/2014/05/bsdcan-2014-summary.html" rel="nofollow">one from Julio Merino</a></li>
<li>The latter report also talks about how, unfortunately, NetBSD basically had no presence in the event at all (and how that&#39;s a recurring trend)
***</li>
</ul>

<h3><a href="http://networkfilter.blogspot.com/2014/05/defend-your-network-and-privacy-vpn.html" rel="nofollow">Defend your network and privacy with a VPN and OpenBSD</a></h3>

<ul>
<li>After all the recent news about spying, backdoored routers, deep packet inspection and everything else, you might want to start taking steps at getting some privacy back</li>
<li>This article describes how to set up a secure network gateway and VPN using OpenBSD and related crypto utilities</li>
<li>There are bits for DHCP, DNS, OpenVPN, DNSCrypt and a watchdog script to make sure your tunnel is always being used</li>
<li>You can transparently tunnel all your outbound traffic over the VPN with this configuration, nothing is needed on any of the client systems - this could also be used with Tor (but it would be very slow)</li>
<li>It also includes a few general privacy tips, recommended browser extensions, etc</li>
<li>The intro to the article is especially great, so give the whole thing a read</li>
<li>He mentions our <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">OpenBSD router guide</a> and other tutorials being a big help for this setup, so hello if you&#39;re watching!
***</li>
</ul>

<h3><a href="http://blog.pascalj.com/article/you-should-try-freebsd/" rel="nofollow">You should try FreeBSD</a></h3>

<ul>
<li>In this blog post, the author talks a bit about how some Linux people aren&#39;t familiar with the BSDs and how we can take steps to change that</li>
<li>He goes into some FreeBSD history specifically, then talks about some of the apparent (and not-so-apparent) differences between the two</li>
<li>Possibly the most useful part is how to address the question &quot;my server already works, why bother switching?&quot;</li>
<li>&quot;Stackoverflow’s answers assume I have apt-get installed&quot;</li>
<li>It includes mention of the great documentation, stability, ports, improved security and much more</li>
<li>A takeaway quote for would-be Linux switchers: &quot;I like to compare FreeBSD to a really tidy room where you can find everything with your eyes closed. Once you know where the closets are, it is easy to just grab what you need, even if you have never touched it before&quot;
***</li>
</ul>

<h3><a href="http://hacklog.in/openbsd-and-the-little-mauritian-contributor/" rel="nofollow">OpenBSD and the little Mauritian contributor</a></h3>

<ul>
<li>This is a story about a guy from <a href="https://en.wikipedia.org/wiki/Mauritius" rel="nofollow">Mauritius</a> named Logan, one of OpenBSD&#39;s newest developers</li>
<li>Back in 2010, he started sending in patched for OpenBSD&#39;s &quot;mg&quot; editor, among other small things, and eventually added file transfer resume support for SFTP</li>
<li>The article talks about his journey from just a guy who submits a patch here and there to joining the developer ranks and even getting his picture taken with Theo at a recent hackathon</li>
<li>It really shows how easy it is to get involved with the different BSDs and contribute back to the software ecosystem</li>
<li>Congrats to Logan, and hopefully this will inspire more people to start helping out and contributing code back
***</li>
</ul>

<h2>Interview - Jon Anderson - <a href="mailto:jonathan@freebsd.org" rel="nofollow">jonathan@freebsd.org</a></h2>

<p>Capsicum and Casperd</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/dnscrypt" rel="nofollow">Encrypting DNS lookups</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://i.imgur.com/f0qg6Ss.jpg" rel="nofollow">FreeBSD Journal, May 2014 issue</a></h3>

<ul>
<li>The newest issue of the <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">FreeBSD Journal</a> is out, following the bi-monthly release cycle</li>
<li>This time the topics include: a letter from the foundation, a ports report, some 9.3-RELEASE plans, an events calendar, an overview of ipfw, exploring network activity with dtrace, an article about kqueue, data distribution with dnssec and finally an article about TCP scaling</li>
<li>Pick up your (digital) copy at Amazon, Google Play or on iTunes and have a read
***</li>
</ul>

<h3><a href="http://insanecoding.blogspot.com/2014/05/libressl-porting-update.html" rel="nofollow">LibreSSL porting update</a></h3>

<ul>
<li>Since the last LibreSSL post we covered, a couple unofficial &quot;portable&quot; versions have died off</li>
<li>Unfortunately, people still think they can just port LibreSSL to other BSDs and Linux all willy-nilly - stop doing that!</li>
<li>This post reiterates that LibreSSL currently relies on a lot of OpenBSD-specific security functions that are not present in other systems, and also gives a very eye-opening example</li>
<li>Please wait for an official portable version instead of wasting time with these dime-a-dozen github clones that do more harm than good
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1862-meteorjs-on-freebsd-11-may-bsd-issue" rel="nofollow">BSDMag May 2014 issue is out</a></h3>

<ul>
<li>The usual monthly release from BSDMag, covering a variety of subjects</li>
<li>This time around the topics include: managing large development projects using RCS, working with HAMMER FS and PFSes, running MeteorJS on FreeBSD 11, another bhyve article, more GIMP tutorials and a few other things</li>
<li>It&#39;s a free PDF, go grab it
***</li>
</ul>

<h3><a href="http://bsdtalk.blogspot.com/2014/05/bsdtalk241-bob-beck.html" rel="nofollow">BSDTalk episode 241</a></h3>

<ul>
<li>A new episode of <a href="http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk" rel="nofollow">BSDTalk</a> is out, this time with Bob Beck</li>
<li>He talks about the OpenBSD foundation&#39;s recent activities, his own work in the project, some stories about the hardware in Theo&#39;s basement and a lot more</li>
<li>The interview itself isn&#39;t about LibreSSL at all, but they do touch on it a bit too</li>
<li>Really interesting stuff, covers a lot of different topics in a short amount of time
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li>We got a number of replies about last week&#39;s VPN question, so thanks to everyone who sent in an email about it - the <a href="https://www.freshports.org/security/vpnc/" rel="nofollow">vpnc</a> package seems to be what we were looking for</li>
<li><a href="http://slexy.org/view/s20MK7bTyc" rel="nofollow">Tim writes in</a></li>
<li><a href="http://slexy.org/view/s2OWREQdUA" rel="nofollow">AJ writes in</a></li>
<li><a href="http://slexy.org/view/s202obAqbT" rel="nofollow">Peter writes in</a></li>
<li><a href="http://slexy.org/view/s21Kye2jAc" rel="nofollow">Thomas writes in</a></li>
<li><a href="http://slexy.org/view/s2zqFVqwxN" rel="nofollow">Martin writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>38: A BUG's Life</title>
  <link>https://www.bsdnow.tv/38</link>
  <guid isPermaLink="false">01510b66-38e5-40ac-a282-9bff71cb55d9</guid>
  <pubDate>Wed, 21 May 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/01510b66-38e5-40ac-a282-9bff71cb55d9.mp3" length="63768244" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We're back from BSDCan! This week on the show we'll be chatting with Brian Callahan and Aaron Bieber about forming a local BSD users group. We'll get to hear their experiences of running one and maybe encourage some of you to start your own! After that, we've got a tutorial on the basics of NetBSD's package manager, pkgsrc. Answers to your emails and the latest headlines, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:28:34</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We're back from BSDCan! This week on the show we'll be chatting with Brian Callahan and Aaron Bieber about forming a local BSD users group. We'll get to hear their experiences of running one and maybe encourage some of you to start your own! After that, we've got a tutorial on the basics of NetBSD's package manager, pkgsrc. Answers to your emails and the latest headlines, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
FreeBSD 11 goals and discussion (http://blather.michaelwlucas.com/archives/2053)
Something that actually happened at BSDCan this year...
During the FreeBSD devsummit, there was some discussion about what changes will be made in 11.0-RELEASE
Some of MWL's notes include: the test suite will be merged to 10-STABLE, more work on the MIPS platforms, LLDB getting more attention, UEFI boot and install support
A large list of possibilities was also included and open for discussion, including AES-GCM in IPSEC, ASLR, OpenMP, ICC, in-place kernel upgrades, Capsicum improvements, TCP performance improvements and A LOT more
There's also some notes from the devsummit virtualization session (http://blather.michaelwlucas.com/archives/2060), mostly talking about bhyve
Lastly, he also provides some notes about ports and packages (http://blather.michaelwlucas.com/archives/2065) and where they're going
***
An SSH honeypot with OpenBSD and Kippo (http://securit.se/2014/05/how-to-install-kippo-ssh-honeypot-on-openbsd-5-5-with-chroot/)
Everyone loves messing with script kiddies, right?
This blog post introduces Kippo (https://code.google.com/p/kippo/), an SSH honeypot tool, and how to use it in combination with OpenBSD
It includes a step by step (or rather, command by command) guide and some tips for running a honeypot securely
You can use this to get new 0day exploits or find weaknesses in your systems
OpenBSD makes a great companion for security testing tools like this with all its exploit mitigation techniques that protect all running applications
***
NetBSD foundation financial report (https://www.netbsd.org/foundation/reports/financial/2013.html)
The NetBSD foundation has posted their 2013 financial report
It's a very "no nonsense" page, pretty much only the hard numbers
In 2013, they got $26,000 of income in donations
The rest of the page shows all the details, how they spent it on hardware, consulting, conference fees, legal costs and everything else
Be sure to donate to whichever BSDs you like and use!
***
Building a fully-encrypted NAS with OpenBSD (http://www.geektechnique.org/projectlab/796/how-to-build-a-fully-encrypted-nas-on-openbsd.html)
Usually the popular choice for a NAS system is FreeNAS, or plain FreeBSD if you know what you're doing
This article takes a look at the OpenBSD side and explains how (http://www.geektechnique.org/projectlab/797/openbsd-encrypted-nas-howto.html) to build a NAS with security in mind
The NAS will be fully encrypted, no separate /boot partition like FreeBSD and FreeNAS require - this means the kernel itself is even protected
The obvious trade-off is the lack of ZFS support for storage, but this is an interesting idea that would fit most people's needs too
There's also a bit of background information on NAS systems in general, some NAS-specific security tips and even some nice graphs and pictures of the hardware - fantastic write up!
***
Interview - Brian Callahan &amp;amp; Aaron Bieber - admin@lists.nycbug.org (mailto:admin@lists.nycbug.org) &amp;amp; admin@cobug.org (mailto:admin@cobug.org)
Forming a local BSD Users Group
Tutorial
The basics of pkgsrc (http://www.bsdnow.tv/tutorials/pkgsrc)
News Roundup
FreeBSD periodic mails vs. monitoring (http://deranfangvomende.wordpress.com/2014/05/11/freebsd-periodic-mails-vs-monitoring/)
If you've ever been an admin for a lot of FreeBSD boxes, you've probably noticed that you get a lot of email
This page tells about all the different alert emails, cron emails and other reports you might end up getting, as well as how to manage them
From bad SSH logins to Zabbix alerts, it all adds up quickly
It highlights the periodic.conf file and FreeBSD's periodic daemon, as well as some third party monitoring tools you can use to keep track of your servers
***
Doing cool stuff with OpenBSD routing domains (http://www.skogsrud.net/?p=44)
A blog post from our viewer and regular emailer, Kjell-Aleksander!
He manages some internally-routed IP ranges at his work, but didn't want to have equipment for each separate project
This is where OpenBSD routing domains and pf come in to save the day
The blog post goes through the process with all the network details you could ever dream of
He even named his networking equipment... after us (http://i.imgur.com/penYQFP.jpg)
***
LibreSSL, the good and the bad (http://insanecoding.blogspot.com/2014/04/libressl-good-and-bad.html)
We're all probably familiar with OpenBSD's fork of OpenSSL at this point
However, "for those of you that don't know it, OpenSSL is at the same time the best and most popular SSL/TLS library available, and utter junk"
This article talks about some of the cryptographic development challenges involved with maintaining such a massive project
You need cryptographers, software engineers, software optimization specialists - there are a lot of roles that need to be filled
It also mentions some OpenSSL alternatives and recent LibreSSL progress, as well as some downsides to the fork - the main one being their aim for backwards compatibility
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/05/weekly-feature-digest-28-photos-of-the-new-appcafe-re-design/)
Lots going on in PCBSD land this week, AppCafe has been redesigned
The PBI system is being replaced with pkgng, PBIs will be automatically converted once you update
In the more recent post (http://blog.pcbsd.org/2014/05/weekly-feature-digest-29-pbing/), there's some further explanation of the PBI system and the reason for the transition
It's got lots of details on the different ways to install software, so hopefully it will clear up any possible confusion
***
Feedback/Questions
Antonio writes in (http://slexy.org/view/s2UbEhgjce)
Daniel writes in (http://slexy.org/view/s21XU0y3JP)
Sean writes in (http://slexy.org/view/s2QQtuawFl)
tsyn writes in (http://slexy.org/view/s20XrT5Q8U)
Chris writes in (http://slexy.org/view/s2ayZ1nsdv)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, pkgsrc, bug, bsd user group, users group, community, lug, uug, unix users group, packages, signing, binary, source, compile, ports, nycbug, nycbsdcon, cobug, colorado, new york, conference, presentation, 11.0, ssh, honeypot, script kiddies, kippo, foundation, financial report, encrypted, nas, network attached storage, full disk encryption, periodic, routing domains, pf, the book of pf, third edition, 3rd edition, cron, monitoring, openssl, libressl</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;re back from BSDCan! This week on the show we&#39;ll be chatting with Brian Callahan and Aaron Bieber about forming a local BSD users group. We&#39;ll get to hear their experiences of running one and maybe encourage some of you to start your own! After that, we&#39;ve got a tutorial on the basics of NetBSD&#39;s package manager, pkgsrc. Answers to your emails and the latest headlines, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blather.michaelwlucas.com/archives/2053" rel="nofollow">FreeBSD 11 goals and discussion</a></h3>

<ul>
<li>Something that actually happened at BSDCan this year...</li>
<li>During the FreeBSD devsummit, there was some discussion about what changes will be made in 11.0-RELEASE</li>
<li>Some of MWL&#39;s notes include: the test suite will be merged to 10-STABLE, more work on the MIPS platforms, LLDB getting more attention, UEFI boot and install support</li>
<li>A large list of possibilities was also included and open for discussion, including AES-GCM in IPSEC, ASLR, OpenMP, ICC, in-place kernel upgrades, Capsicum improvements, TCP performance improvements and A LOT more</li>
<li>There&#39;s also some notes from the <a href="http://blather.michaelwlucas.com/archives/2060" rel="nofollow">devsummit virtualization session</a>, mostly talking about bhyve</li>
<li>Lastly, he also provides some notes about <a href="http://blather.michaelwlucas.com/archives/2065" rel="nofollow">ports and packages</a> and where they&#39;re going
***</li>
</ul>

<h3><a href="http://securit.se/2014/05/how-to-install-kippo-ssh-honeypot-on-openbsd-5-5-with-chroot/" rel="nofollow">An SSH honeypot with OpenBSD and Kippo</a></h3>

<ul>
<li>Everyone loves messing with script kiddies, right?</li>
<li>This blog post introduces <a href="https://code.google.com/p/kippo/" rel="nofollow">Kippo</a>, an SSH honeypot tool, and how to use it in combination with OpenBSD</li>
<li>It includes a step by step (or rather, command by command) guide and some tips for running a honeypot securely</li>
<li>You can use this to get new 0day exploits or find weaknesses in your systems</li>
<li>OpenBSD makes a great companion for security testing tools like this with all its exploit mitigation techniques that protect all running applications
***</li>
</ul>

<h3><a href="https://www.netbsd.org/foundation/reports/financial/2013.html" rel="nofollow">NetBSD foundation financial report</a></h3>

<ul>
<li>The NetBSD foundation has posted their 2013 financial report</li>
<li>It&#39;s a very &quot;no nonsense&quot; page, pretty much only the hard numbers</li>
<li>In 2013, they got $26,000 of income in donations</li>
<li>The rest of the page shows all the details, how they spent it on hardware, consulting, conference fees, legal costs and everything else</li>
<li>Be sure to donate to whichever BSDs you like and use!
***</li>
</ul>

<h3><a href="http://www.geektechnique.org/projectlab/796/how-to-build-a-fully-encrypted-nas-on-openbsd.html" rel="nofollow">Building a fully-encrypted NAS with OpenBSD</a></h3>

<ul>
<li>Usually the popular choice for a NAS system is FreeNAS, or plain FreeBSD if you know what you&#39;re doing</li>
<li>This article takes a look at the OpenBSD side and <a href="http://www.geektechnique.org/projectlab/797/openbsd-encrypted-nas-howto.html" rel="nofollow">explains how</a> to build a NAS with security in mind</li>
<li>The NAS will be fully encrypted, no separate /boot partition like FreeBSD and FreeNAS require - this means the kernel itself is even protected</li>
<li>The obvious trade-off is the lack of ZFS support for storage, but this is an interesting idea that would fit most people&#39;s needs too</li>
<li>There&#39;s also a bit of background information on NAS systems in general, some NAS-specific security tips and even some nice graphs and pictures of the hardware - fantastic write up!
***</li>
</ul>

<h2>Interview - Brian Callahan &amp; Aaron Bieber - <a href="mailto:admin@lists.nycbug.org" rel="nofollow">admin@lists.nycbug.org</a> &amp; <a href="mailto:admin@cobug.org" rel="nofollow">admin@cobug.org</a></h2>

<p>Forming a local BSD Users Group</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/pkgsrc" rel="nofollow">The basics of pkgsrc</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://deranfangvomende.wordpress.com/2014/05/11/freebsd-periodic-mails-vs-monitoring/" rel="nofollow">FreeBSD periodic mails vs. monitoring</a></h3>

<ul>
<li>If you&#39;ve ever been an admin for a lot of FreeBSD boxes, you&#39;ve probably noticed that you get a lot of email</li>
<li>This page tells about all the different alert emails, cron emails and other reports you might end up getting, as well as how to manage them</li>
<li>From bad SSH logins to Zabbix alerts, it all adds up quickly</li>
<li>It highlights the periodic.conf file and FreeBSD&#39;s periodic daemon, as well as some third party monitoring tools you can use to keep track of your servers
***</li>
</ul>

<h3><a href="http://www.skogsrud.net/?p=44" rel="nofollow">Doing cool stuff with OpenBSD routing domains</a></h3>

<ul>
<li>A blog post from our viewer and regular emailer, Kjell-Aleksander!</li>
<li>He manages some internally-routed IP ranges at his work, but didn&#39;t want to have equipment for each separate project</li>
<li>This is where OpenBSD routing domains and pf come in to save the day</li>
<li>The blog post goes through the process with all the network details you could ever dream of</li>
<li>He even <a href="http://i.imgur.com/penYQFP.jpg" rel="nofollow">named his networking equipment... after us</a>
***</li>
</ul>

<h3><a href="http://insanecoding.blogspot.com/2014/04/libressl-good-and-bad.html" rel="nofollow">LibreSSL, the good and the bad</a></h3>

<ul>
<li>We&#39;re all probably familiar with OpenBSD&#39;s fork of OpenSSL at this point</li>
<li>However, &quot;for those of you that don&#39;t know it, OpenSSL is at the same time the best and most popular SSL/TLS library available, and utter junk&quot;</li>
<li>This article talks about some of the cryptographic development challenges involved with maintaining such a massive project</li>
<li>You need cryptographers, software engineers, software optimization specialists - there are a lot of roles that need to be filled</li>
<li>It also mentions some OpenSSL alternatives and recent LibreSSL progress, as well as some downsides to the fork - the main one being their aim for backwards compatibility
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/05/weekly-feature-digest-28-photos-of-the-new-appcafe-re-design/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Lots going on in PCBSD land this week, AppCafe has been redesigned</li>
<li>The PBI system is being replaced with pkgng, PBIs will be automatically converted once you update</li>
<li>In the more <a href="http://blog.pcbsd.org/2014/05/weekly-feature-digest-29-pbing/" rel="nofollow">recent post</a>, there&#39;s some further explanation of the PBI system and the reason for the transition</li>
<li>It&#39;s got lots of details on the different ways to install software, so hopefully it will clear up any possible confusion
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2UbEhgjce" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s21XU0y3JP" rel="nofollow">Daniel writes in</a></li>
<li><a href="http://slexy.org/view/s2QQtuawFl" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s20XrT5Q8U" rel="nofollow">tsyn writes in</a></li>
<li><a href="http://slexy.org/view/s2ayZ1nsdv" rel="nofollow">Chris writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;re back from BSDCan! This week on the show we&#39;ll be chatting with Brian Callahan and Aaron Bieber about forming a local BSD users group. We&#39;ll get to hear their experiences of running one and maybe encourage some of you to start your own! After that, we&#39;ve got a tutorial on the basics of NetBSD&#39;s package manager, pkgsrc. Answers to your emails and the latest headlines, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://blather.michaelwlucas.com/archives/2053" rel="nofollow">FreeBSD 11 goals and discussion</a></h3>

<ul>
<li>Something that actually happened at BSDCan this year...</li>
<li>During the FreeBSD devsummit, there was some discussion about what changes will be made in 11.0-RELEASE</li>
<li>Some of MWL&#39;s notes include: the test suite will be merged to 10-STABLE, more work on the MIPS platforms, LLDB getting more attention, UEFI boot and install support</li>
<li>A large list of possibilities was also included and open for discussion, including AES-GCM in IPSEC, ASLR, OpenMP, ICC, in-place kernel upgrades, Capsicum improvements, TCP performance improvements and A LOT more</li>
<li>There&#39;s also some notes from the <a href="http://blather.michaelwlucas.com/archives/2060" rel="nofollow">devsummit virtualization session</a>, mostly talking about bhyve</li>
<li>Lastly, he also provides some notes about <a href="http://blather.michaelwlucas.com/archives/2065" rel="nofollow">ports and packages</a> and where they&#39;re going
***</li>
</ul>

<h3><a href="http://securit.se/2014/05/how-to-install-kippo-ssh-honeypot-on-openbsd-5-5-with-chroot/" rel="nofollow">An SSH honeypot with OpenBSD and Kippo</a></h3>

<ul>
<li>Everyone loves messing with script kiddies, right?</li>
<li>This blog post introduces <a href="https://code.google.com/p/kippo/" rel="nofollow">Kippo</a>, an SSH honeypot tool, and how to use it in combination with OpenBSD</li>
<li>It includes a step by step (or rather, command by command) guide and some tips for running a honeypot securely</li>
<li>You can use this to get new 0day exploits or find weaknesses in your systems</li>
<li>OpenBSD makes a great companion for security testing tools like this with all its exploit mitigation techniques that protect all running applications
***</li>
</ul>

<h3><a href="https://www.netbsd.org/foundation/reports/financial/2013.html" rel="nofollow">NetBSD foundation financial report</a></h3>

<ul>
<li>The NetBSD foundation has posted their 2013 financial report</li>
<li>It&#39;s a very &quot;no nonsense&quot; page, pretty much only the hard numbers</li>
<li>In 2013, they got $26,000 of income in donations</li>
<li>The rest of the page shows all the details, how they spent it on hardware, consulting, conference fees, legal costs and everything else</li>
<li>Be sure to donate to whichever BSDs you like and use!
***</li>
</ul>

<h3><a href="http://www.geektechnique.org/projectlab/796/how-to-build-a-fully-encrypted-nas-on-openbsd.html" rel="nofollow">Building a fully-encrypted NAS with OpenBSD</a></h3>

<ul>
<li>Usually the popular choice for a NAS system is FreeNAS, or plain FreeBSD if you know what you&#39;re doing</li>
<li>This article takes a look at the OpenBSD side and <a href="http://www.geektechnique.org/projectlab/797/openbsd-encrypted-nas-howto.html" rel="nofollow">explains how</a> to build a NAS with security in mind</li>
<li>The NAS will be fully encrypted, no separate /boot partition like FreeBSD and FreeNAS require - this means the kernel itself is even protected</li>
<li>The obvious trade-off is the lack of ZFS support for storage, but this is an interesting idea that would fit most people&#39;s needs too</li>
<li>There&#39;s also a bit of background information on NAS systems in general, some NAS-specific security tips and even some nice graphs and pictures of the hardware - fantastic write up!
***</li>
</ul>

<h2>Interview - Brian Callahan &amp; Aaron Bieber - <a href="mailto:admin@lists.nycbug.org" rel="nofollow">admin@lists.nycbug.org</a> &amp; <a href="mailto:admin@cobug.org" rel="nofollow">admin@cobug.org</a></h2>

<p>Forming a local BSD Users Group</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/pkgsrc" rel="nofollow">The basics of pkgsrc</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://deranfangvomende.wordpress.com/2014/05/11/freebsd-periodic-mails-vs-monitoring/" rel="nofollow">FreeBSD periodic mails vs. monitoring</a></h3>

<ul>
<li>If you&#39;ve ever been an admin for a lot of FreeBSD boxes, you&#39;ve probably noticed that you get a lot of email</li>
<li>This page tells about all the different alert emails, cron emails and other reports you might end up getting, as well as how to manage them</li>
<li>From bad SSH logins to Zabbix alerts, it all adds up quickly</li>
<li>It highlights the periodic.conf file and FreeBSD&#39;s periodic daemon, as well as some third party monitoring tools you can use to keep track of your servers
***</li>
</ul>

<h3><a href="http://www.skogsrud.net/?p=44" rel="nofollow">Doing cool stuff with OpenBSD routing domains</a></h3>

<ul>
<li>A blog post from our viewer and regular emailer, Kjell-Aleksander!</li>
<li>He manages some internally-routed IP ranges at his work, but didn&#39;t want to have equipment for each separate project</li>
<li>This is where OpenBSD routing domains and pf come in to save the day</li>
<li>The blog post goes through the process with all the network details you could ever dream of</li>
<li>He even <a href="http://i.imgur.com/penYQFP.jpg" rel="nofollow">named his networking equipment... after us</a>
***</li>
</ul>

<h3><a href="http://insanecoding.blogspot.com/2014/04/libressl-good-and-bad.html" rel="nofollow">LibreSSL, the good and the bad</a></h3>

<ul>
<li>We&#39;re all probably familiar with OpenBSD&#39;s fork of OpenSSL at this point</li>
<li>However, &quot;for those of you that don&#39;t know it, OpenSSL is at the same time the best and most popular SSL/TLS library available, and utter junk&quot;</li>
<li>This article talks about some of the cryptographic development challenges involved with maintaining such a massive project</li>
<li>You need cryptographers, software engineers, software optimization specialists - there are a lot of roles that need to be filled</li>
<li>It also mentions some OpenSSL alternatives and recent LibreSSL progress, as well as some downsides to the fork - the main one being their aim for backwards compatibility
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/05/weekly-feature-digest-28-photos-of-the-new-appcafe-re-design/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Lots going on in PCBSD land this week, AppCafe has been redesigned</li>
<li>The PBI system is being replaced with pkgng, PBIs will be automatically converted once you update</li>
<li>In the more <a href="http://blog.pcbsd.org/2014/05/weekly-feature-digest-29-pbing/" rel="nofollow">recent post</a>, there&#39;s some further explanation of the PBI system and the reason for the transition</li>
<li>It&#39;s got lots of details on the different ways to install software, so hopefully it will clear up any possible confusion
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2UbEhgjce" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s21XU0y3JP" rel="nofollow">Daniel writes in</a></li>
<li><a href="http://slexy.org/view/s2QQtuawFl" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s20XrT5Q8U" rel="nofollow">tsyn writes in</a></li>
<li><a href="http://slexy.org/view/s2ayZ1nsdv" rel="nofollow">Chris writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>37: BSDCanned Goods</title>
  <link>https://www.bsdnow.tv/37</link>
  <guid isPermaLink="false">3519165b-e16c-49e5-9148-ad92396b617e</guid>
  <pubDate>Wed, 14 May 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3519165b-e16c-49e5-9148-ad92396b617e.mp3" length="92116660" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week we're at BSDCan, ganging up on people and forcing them to give us interviews. Assuming we don't get arrested for harassment, we'll be back next week with your regularly scheduled programming. For now, we've got some feedback emails to catch up on, as well as a prerecorded talk Matt Ahrens gave about ZFS. We'll be back to tell you all about the conference next week, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>2:07:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week we're at BSDCan, ganging up on people and forcing them to give us interviews. Assuming we don't get arrested for harassment, we'll be back next week with your regularly scheduled programming. For now, we've got some feedback emails to catch up on, as well as a prerecorded talk Matt Ahrens gave about ZFS. We'll be back to tell you all about the conference next week, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Presentation - Matthew Ahrens - matt@mahrens.org (mailto:matt@mahrens.org) / @mahrens1 (https://twitter.com/mahrens1)
OpenZFS discussion
Feedback/Questions
Remy writes in (http://slexy.org/view/s2kGZUlxjg)
Darin writes in (http://slexy.org/view/s23j9RHsIx)
Steve writes in (http://slexy.org/view/s21dMlBAhM)
Pascal writes in (http://slexy.org/view/s20IyvdSmR)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, zfs, openzfs, feedback, emails, questions, support, bsdcan, ottawa, conference, convention</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week we&#39;re at BSDCan, ganging up on people and forcing them to give us interviews. Assuming we don&#39;t get arrested for harassment, we&#39;ll be back next week with your regularly scheduled programming. For now, we&#39;ve got some feedback emails to catch up on, as well as a prerecorded talk Matt Ahrens gave about ZFS. We&#39;ll be back to tell you all about the conference next week, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Presentation - Matthew Ahrens - <a href="mailto:matt@mahrens.org" rel="nofollow">matt@mahrens.org</a> / <a href="https://twitter.com/mahrens1" rel="nofollow">@mahrens1</a></h2>

<p>OpenZFS discussion</p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2kGZUlxjg" rel="nofollow">Remy writes in</a></li>
<li><a href="http://slexy.org/view/s23j9RHsIx" rel="nofollow">Darin writes in</a></li>
<li><a href="http://slexy.org/view/s21dMlBAhM" rel="nofollow">Steve writes in</a></li>
<li><a href="http://slexy.org/view/s20IyvdSmR" rel="nofollow">Pascal writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week we&#39;re at BSDCan, ganging up on people and forcing them to give us interviews. Assuming we don&#39;t get arrested for harassment, we&#39;ll be back next week with your regularly scheduled programming. For now, we&#39;ve got some feedback emails to catch up on, as well as a prerecorded talk Matt Ahrens gave about ZFS. We&#39;ll be back to tell you all about the conference next week, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Presentation - Matthew Ahrens - <a href="mailto:matt@mahrens.org" rel="nofollow">matt@mahrens.org</a> / <a href="https://twitter.com/mahrens1" rel="nofollow">@mahrens1</a></h2>

<p>OpenZFS discussion</p>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2kGZUlxjg" rel="nofollow">Remy writes in</a></li>
<li><a href="http://slexy.org/view/s23j9RHsIx" rel="nofollow">Darin writes in</a></li>
<li><a href="http://slexy.org/view/s21dMlBAhM" rel="nofollow">Steve writes in</a></li>
<li><a href="http://slexy.org/view/s20IyvdSmR" rel="nofollow">Pascal writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>36: Let's Get RAID</title>
  <link>https://www.bsdnow.tv/36</link>
  <guid isPermaLink="false">485b12e9-ea67-4bc6-9709-4b0e38a76184</guid>
  <pubDate>Wed, 07 May 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/485b12e9-ea67-4bc6-9709-4b0e38a76184.mp3" length="65368948" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show we'll be showing you how to set up RAID arrays in both FreeBSD and OpenBSD. There's also an interview with David Chisnall - of the FreeBSD core team - about the switch to Clang and a lot more. As usual, we'll be dropping the latest news and answering your emails, so sit back and enjoy some BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:30:47</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show we'll be showing you how to set up RAID arrays in both FreeBSD and OpenBSD. There's also an interview with David Chisnall - of the FreeBSD core team - about the switch to Clang and a lot more. As usual, we'll be dropping the latest news and answering your emails, so sit back and enjoy some BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source"&gt;&lt;/a&gt;&lt;a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"&gt;&lt;img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid"&gt;&lt;/a&gt;
Headlines
OpenBSD 5.5 released (http://www.openbsd.org/55.html)
If you ordered (https://https.openbsd.org/cgi-bin/order) a CD set (https://twitter.com/blakkheim/status/461909893813784576) then you've probably had it for a little while already, but OpenBSD has formally announced the public release (http://undeadly.org/cgi?action=article&amp;amp;sid=20140501153339) of 5.5
This is one of the biggest releases to date, with a very long list of changes and improvements
Some of the highlights include: time_t being 64 bit on all platforms, release sets and binary packages being signed with the new signify tool, a new autoinstall feature of the installer, SMP support on Alpha, a new AViiON port, lots of new hardware drivers including newer NICs, the new vxlan driver, relayd improvements, a new pf queue system for bandwidth shaping, dhcpd and dhclient fixes, OpenSMTPD 5.4.2 and all its new features, position-independent executables being default for i386, the RNG has been replaced with ChaCha20 as well as some other security improvements, FUSE support, tmpfs, softraid partitions larger than 2TB and a RAID 5 implementation, OpenSSH 6.6 with all its new features and fixes... and a lot more
The full list of changes (http://www.openbsd.org/plus55.html) is HUGE, be sure to read through it all if you're interested in the details
If you're doing an upgrade from 5.4 instead of a fresh install, pay careful attention to the upgrade guide (http://www.openbsd.org/faq/upgrade55.html) as there are some very specific steps for this version
Also be sure to apply the errata patches (http://www.openbsd.org/errata55.html) on your new installations... especially those OpenSSL ones (some of which still aren't fixed (http://marc.info/?l=oss-security&amp;amp;m=139906348230995&amp;amp;w=2) in the other BSDs yet)
On the topic of errata patches, the project is now going to also send them out (signed (http://undeadly.org/cgi?action=article&amp;amp;sid=20140502103355)) via the announce mailing list (http://lists.openbsd.org/cgi-bin/mj_wwwusr?user=&amp;amp;passw=&amp;amp;func=lists-long-full&amp;amp;extra=announce), a very welcome change
Congrats to the whole team on this great release - 5.6 is going to be even more awesome with "Libre"SSL and lots of other stuff that's currently in development
***
FreeBSD foundation funding highlights (http://freebsdfoundation.blogspot.com/2014/04/freebsd-foundation-spring-fundraising_28.html)
The FreeBSD foundation posts a new update on how they're spending the money that everyone donates
"As we embark on our 15th year of serving the FreeBSD Project and community, we are proud of what we've done to help FreeBSD become the most innovative, reliable, and high-performance operation system"
During this spring, they want to highlight the new UEFI boot support and newcons (http://freebsdfoundation.blogspot.com/2014/05/freebsd-foundation-newcons-project.html)
There's a lot of details about what exactly UEFI is and why we need it going forward
FreeBSD has also needed some updates to its console to support UTF8 and wide characters
Hopefully this series will continue and we'll get to see what other work is being sponsored
***
OpenSSH without OpenSSL (http://marc.info/?l=openbsd-cvs&amp;amp;m=139879453001957&amp;amp;w=2)
The OpenSSH team has been hard at work, making it even better, and now OpenSSL is completely optional
Since it won't have access to the primitives OpenSSL uses, there will be a trade-off of features vs. security
This version will drop support for legacy SSH v1, and the only two cryptographic algorithms supported are an in-house implementation of AES in counter mode and the new combination (http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.chacha20poly1305?rev=HEAD;content-type=text%2Fplain) of the Chacha20 stream cipher with Poly1305 for packet integrity
Key exchange is limited to elliptic curve Diffie-Hellman and the newer Curve25519 KEXs
No support for RSA, DSA or ECDSA public keys - only Ed25519
It also includes a new buffer API (http://marc.info/?l=openbsd-cvs&amp;amp;m=139883582313750&amp;amp;w=2) and a set of wrappers to make it compatible with the existing API
Believe it or not, this was planned before all the heartbleed craziness
Maybe someday soon we'll have a mini-openssh-portable in FreeBSD ports and NetBSD pkgsrc, would be really neat
***
BSDMag's April 2014 issue is out (http://bsdmag.org/magazine/1861-free-pascal-on-bsd-april-bsd-issue)
The free monthly BSD magazine has got a new issue available for download
This time the articles include: pascal on BSD, an introduction to revision control systems and configuration management, deploying NetBSD on AWS EC2, more GIMP tutorials, an AsiaBSDCon 2014 report and a piece about how easily credit cards are stolen online
Anyone can contribute to the magazine, just send the editors an email about what you want to write
No Linux articles this time around, good
***
Interview - David Chisnall - theraven@freebsd.org (mailto:theraven@freebsd.org)
The LLVM/Clang switch, FreeBSD's core team, various topics
Tutorial
RAID in FreeBSD and OpenBSD (http://www.bsdnow.tv/tutorials/raid)
News Roundup
BSDTalk episode 240 (http://bsdtalk.blogspot.com/2014/04/bsdtalk240-about-time-with-george.html)
Our buddy Will Backman has uploaded a new episode of BSDTalk, this time with our other buddy GNN as the guest - mainly to talk about NTP and keeping reliable time
Topics include the specific details of crystals used in watches and computers to keep time, how temperature affects the quality, different sources of inaccuracy, some general NTP information, why you might want extremely precise time, different time sources (GPS, satellite, etc), differences in stratum levels, the problem of packet delay and estimating the round trip time, some of the recent NTP amplification attacks, the downsides to using UDP instead of TCP and... much more
GNN also talks a little about the Precision Time Protocol (https://en.wikipedia.org/wiki/Precision_Time_Protocol) and how it's different than NTP
Two people (http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates) we've interviewed (http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk) talking to each other, awesome
If you're interested in NTP, be sure to see our tutorial (http://www.bsdnow.tv/tutorials/ntpd) too
***
m2k14 trip reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20140502092427)
We've got a few more reports from the recent OpenBSD hackathon in Morocco
The first one is from Antoine Jacoutot (who is a key GNOME porter and gave us the screenshots for the OpenBSD desktop tutorial (http://www.bsdnow.tv/tutorials/the-desktop-obsd))
"Since I always fail at actually doing whatever I have planned for a hackathon, this time I decided to come to m2k14 unprepared about what I was going to do"
He got lots of work done with ports and pushing GNOME-related patches back up to the main project, then worked on fixing ports' compatibility with LibreSSL
Speaking of LibreSSL, there's an article (http://undeadly.org/cgi?action=article&amp;amp;sid=20140505062023) all would-be portable version writers should probably read and take into consideration
Jasper Adriaanse also writes (http://undeadly.org/cgi?action=article&amp;amp;sid=20140501185019) about what he got done over there
He cleaned up and fixed the puppet port to work better with OpenBSD
***
Why you should use FreeBSD on your cloud VPS (https://www.atlantic.net/blog/2014/04/08/freebsd-ssd-cloud-vps-hosting-10-reasons/)
Here we have a blog post from Atlantic, a VPS and hosting provider, about 10 reasons for using FreeBSD
Starts off with a little bit of BSD history for those who are unfamiliar with it and only know Linux and Windows
The 10 reasons are: community, stability, collaboration, ease of use, ports, security, ZFS, GEOM, sound and having lots of options
The post goes into detail about each of them and why FreeBSD makes a great choice for a VPS OS
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/05/weekly-feature-digest-27-software-system-redesign/)
Big changes coming in the way PCBSD manages software
The PBI system, AppCafe and related tools are all going to use pkgng now
The AppCafe will no longer be limited to PBIs, so much more software will be easily available from the ports tree
New rating system coming soon and much more
***
Feedback/Questions
Martin writes in (http://slexy.org/view/s21bk2oPuQ)
John writes in (http://slexy.org/view/s2n9fx1Rpw)
Alex writes in (http://slexy.org/view/s2rBBKLA4u)
Goetz writes in (http://slexy.org/view/s20JY6ZI71)
Jarrad writes in (http://slexy.org/view/s20YV5Ohpa)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, theraven, david chisnall, core, core team, clang, gcc, llvm, raid, stripe, mirror, bioctl, gstripe, zfs, gmirror, graid, ufs, ffs, disks, the worst pun i've done so far, i regret this already, redundancy, raid0, raid1, raid5, raidz, raid-z, filesystem, 5.5, pie, aslr, cd set, demo, tour, opensmtpd, pf, gnome, gnome3, marcusports, ports, router, signify, hackathon</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show we&#39;ll be showing you how to set up RAID arrays in both FreeBSD and OpenBSD. There&#39;s also an interview with David Chisnall - of the FreeBSD core team - about the switch to Clang and a lot more. As usual, we&#39;ll be dropping the latest news and answering your emails, so sit back and enjoy some BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.openbsd.org/55.html" rel="nofollow">OpenBSD 5.5 released</a></h3>

<ul>
<li>If you <a href="https://https.openbsd.org/cgi-bin/order" rel="nofollow">ordered</a> a <a href="https://twitter.com/blakkheim/status/461909893813784576" rel="nofollow">CD set</a> then you&#39;ve probably had it for a little while already, but OpenBSD has formally announced the <a href="http://undeadly.org/cgi?action=article&sid=20140501153339" rel="nofollow">public release</a> of 5.5</li>
<li>This is one of the biggest releases to date, with a very long list of changes and improvements</li>
<li>Some of the highlights include: time_t being 64 bit on all platforms, release sets and binary packages being signed with the new signify tool, a new autoinstall feature of the installer, SMP support on Alpha, a new AViiON port, lots of new hardware drivers including newer NICs, the new vxlan driver, relayd improvements, a new pf queue system for bandwidth shaping, dhcpd and dhclient fixes, OpenSMTPD 5.4.2 and all its new features, position-independent executables being default for i386, the RNG has been replaced with ChaCha20 as well as some other security improvements, FUSE support, tmpfs, softraid partitions larger than 2TB and a RAID 5 implementation, OpenSSH 6.6 with all its new features and fixes... and a lot more</li>
<li>The <a href="http://www.openbsd.org/plus55.html" rel="nofollow">full list of changes</a> is HUGE, be sure to read through it all if you&#39;re interested in the details</li>
<li>If you&#39;re doing an upgrade from 5.4 instead of a fresh install, pay careful attention to <a href="http://www.openbsd.org/faq/upgrade55.html" rel="nofollow">the upgrade guide</a> as there are some very specific steps for this version</li>
<li>Also be sure to apply the <a href="http://www.openbsd.org/errata55.html" rel="nofollow">errata patches</a> on your new installations... especially those OpenSSL ones (some of which <a href="http://marc.info/?l=oss-security&m=139906348230995&w=2" rel="nofollow">still aren&#39;t fixed</a> in the other BSDs yet)</li>
<li>On the topic of errata patches, the project is now going to also send them out (<a href="http://undeadly.org/cgi?action=article&sid=20140502103355" rel="nofollow">signed</a>) via the <a href="http://lists.openbsd.org/cgi-bin/mj_wwwusr?user=&passw=&func=lists-long-full&extra=announce" rel="nofollow">announce mailing list</a>, a very welcome change</li>
<li>Congrats to the whole team on this great release - 5.6 is going to be even more awesome with &quot;Libre&quot;SSL and lots of other stuff that&#39;s currently in development
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/04/freebsd-foundation-spring-fundraising_28.html" rel="nofollow">FreeBSD foundation funding highlights</a></h3>

<ul>
<li>The FreeBSD foundation posts a new update on how they&#39;re spending the money that everyone donates</li>
<li>&quot;As we embark on our 15th year of serving the FreeBSD Project and community, we are proud of what we&#39;ve done to help FreeBSD become the most innovative, reliable, and high-performance operation system&quot;</li>
<li>During this spring, they want to highlight the new UEFI boot support <a href="http://freebsdfoundation.blogspot.com/2014/05/freebsd-foundation-newcons-project.html" rel="nofollow">and newcons</a></li>
<li>There&#39;s a lot of details about what exactly UEFI is and why we need it going forward</li>
<li>FreeBSD has also needed some updates to its console to support UTF8 and wide characters</li>
<li>Hopefully this series will continue and we&#39;ll get to see what other work is being sponsored
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=139879453001957&w=2" rel="nofollow">OpenSSH without OpenSSL</a></h3>

<ul>
<li>The OpenSSH team has been hard at work, making it even better, and now OpenSSL is completely optional</li>
<li>Since it won&#39;t have access to the primitives OpenSSL uses, there will be a trade-off of features vs. security</li>
<li>This version will drop support for legacy SSH v1, and the only two cryptographic algorithms supported are an in-house implementation of AES in counter mode and the <a href="http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.chacha20poly1305?rev=HEAD;content-type=text%2Fplain" rel="nofollow">new combination</a> of the Chacha20 stream cipher with Poly1305 for packet integrity</li>
<li>Key exchange is limited to elliptic curve Diffie-Hellman and the newer Curve25519 KEXs</li>
<li>No support for RSA, DSA or ECDSA public keys - only Ed25519</li>
<li>It also includes a <a href="http://marc.info/?l=openbsd-cvs&m=139883582313750&w=2" rel="nofollow">new buffer API</a> and a set of wrappers to make it compatible with the existing API</li>
<li>Believe it or not, this was planned before all the heartbleed craziness</li>
<li>Maybe someday soon we&#39;ll have a mini-openssh-portable in FreeBSD ports and NetBSD pkgsrc, would be really neat
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1861-free-pascal-on-bsd-april-bsd-issue" rel="nofollow">BSDMag&#39;s April 2014 issue is out</a></h3>

<ul>
<li>The free monthly BSD magazine has got a new issue available for download</li>
<li>This time the articles include: pascal on BSD, an introduction to revision control systems and configuration management, deploying NetBSD on AWS EC2, more GIMP tutorials, an AsiaBSDCon 2014 report and a piece about how easily credit cards are stolen online</li>
<li>Anyone can contribute to the magazine, just send the editors an email about what you want to write</li>
<li>No Linux articles this time around, good
***</li>
</ul>

<h2>Interview - David Chisnall - <a href="mailto:theraven@freebsd.org" rel="nofollow">theraven@freebsd.org</a></h2>

<p>The LLVM/Clang switch, FreeBSD&#39;s core team, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/raid" rel="nofollow">RAID in FreeBSD and OpenBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://bsdtalk.blogspot.com/2014/04/bsdtalk240-about-time-with-george.html" rel="nofollow">BSDTalk episode 240</a></h3>

<ul>
<li>Our buddy Will Backman has uploaded a new episode of BSDTalk, this time with our other buddy GNN as the guest - mainly to talk about NTP and keeping reliable time</li>
<li>Topics include the specific details of crystals used in watches and computers to keep time, how temperature affects the quality, different sources of inaccuracy, some general NTP information, why you might want extremely precise time, different time sources (GPS, satellite, etc), differences in stratum levels, the problem of packet delay and estimating the round trip time, some of the recent NTP amplification attacks, the downsides to using UDP instead of TCP and... much more</li>
<li>GNN also talks a little about the <a href="https://en.wikipedia.org/wiki/Precision_Time_Protocol" rel="nofollow">Precision Time Protocol</a> and how it&#39;s different than NTP</li>
<li>Two <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">people</a> we&#39;ve <a href="http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk" rel="nofollow">interviewed</a> talking to each other, awesome</li>
<li>If you&#39;re interested in NTP, be sure to see our <a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">tutorial</a> too
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140502092427" rel="nofollow">m2k14 trip reports</a></h3>

<ul>
<li>We&#39;ve got a few more reports from the recent OpenBSD hackathon in Morocco</li>
<li>The first one is from Antoine Jacoutot (who is a key GNOME porter and gave us the screenshots for the <a href="http://www.bsdnow.tv/tutorials/the-desktop-obsd" rel="nofollow">OpenBSD desktop tutorial</a>)</li>
<li>&quot;Since I always fail at actually doing whatever I have planned for a hackathon, this time I decided to come to m2k14 unprepared about what I was going to do&quot;</li>
<li>He got lots of work done with ports and pushing GNOME-related patches back up to the main project, then worked on fixing ports&#39; compatibility with LibreSSL</li>
<li>Speaking of LibreSSL, there&#39;s <a href="http://undeadly.org/cgi?action=article&sid=20140505062023" rel="nofollow">an article</a> all would-be portable version writers should probably read and take into consideration</li>
<li>Jasper Adriaanse <a href="http://undeadly.org/cgi?action=article&sid=20140501185019" rel="nofollow">also writes</a> about what he got done over there</li>
<li>He cleaned up and fixed the puppet port to work better with OpenBSD
***</li>
</ul>

<h3><a href="https://www.atlantic.net/blog/2014/04/08/freebsd-ssd-cloud-vps-hosting-10-reasons/" rel="nofollow">Why you should use FreeBSD on your cloud VPS</a></h3>

<ul>
<li>Here we have a blog post from Atlantic, a VPS and hosting provider, about 10 reasons for using FreeBSD</li>
<li>Starts off with a little bit of BSD history for those who are unfamiliar with it and only know Linux and Windows</li>
<li>The 10 reasons are: community, stability, collaboration, ease of use, ports, security, ZFS, GEOM, sound and having lots of options</li>
<li>The post goes into detail about each of them and why FreeBSD makes a great choice for a VPS OS
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/05/weekly-feature-digest-27-software-system-redesign/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Big changes coming in the way PCBSD manages software</li>
<li>The PBI system, AppCafe and related tools are all going to use pkgng now</li>
<li>The AppCafe will no longer be limited to PBIs, so much more software will be easily available from the ports tree</li>
<li>New rating system coming soon and much more
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21bk2oPuQ" rel="nofollow">Martin writes in</a></li>
<li><a href="http://slexy.org/view/s2n9fx1Rpw" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s2rBBKLA4u" rel="nofollow">Alex writes in</a></li>
<li><a href="http://slexy.org/view/s20JY6ZI71" rel="nofollow">Goetz writes in</a></li>
<li><a href="http://slexy.org/view/s20YV5Ohpa" rel="nofollow">Jarrad writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show we&#39;ll be showing you how to set up RAID arrays in both FreeBSD and OpenBSD. There&#39;s also an interview with David Chisnall - of the FreeBSD core team - about the switch to Clang and a lot more. As usual, we&#39;ll be dropping the latest news and answering your emails, so sit back and enjoy some BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise servers and storage for open source" /></a><a href="http://www.tarsnap.com/bsdnow" title="Tarsnap"><img src="/images/tarsnap1.png" alt="Tarsnap - online backups for the truly paranoid" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.openbsd.org/55.html" rel="nofollow">OpenBSD 5.5 released</a></h3>

<ul>
<li>If you <a href="https://https.openbsd.org/cgi-bin/order" rel="nofollow">ordered</a> a <a href="https://twitter.com/blakkheim/status/461909893813784576" rel="nofollow">CD set</a> then you&#39;ve probably had it for a little while already, but OpenBSD has formally announced the <a href="http://undeadly.org/cgi?action=article&sid=20140501153339" rel="nofollow">public release</a> of 5.5</li>
<li>This is one of the biggest releases to date, with a very long list of changes and improvements</li>
<li>Some of the highlights include: time_t being 64 bit on all platforms, release sets and binary packages being signed with the new signify tool, a new autoinstall feature of the installer, SMP support on Alpha, a new AViiON port, lots of new hardware drivers including newer NICs, the new vxlan driver, relayd improvements, a new pf queue system for bandwidth shaping, dhcpd and dhclient fixes, OpenSMTPD 5.4.2 and all its new features, position-independent executables being default for i386, the RNG has been replaced with ChaCha20 as well as some other security improvements, FUSE support, tmpfs, softraid partitions larger than 2TB and a RAID 5 implementation, OpenSSH 6.6 with all its new features and fixes... and a lot more</li>
<li>The <a href="http://www.openbsd.org/plus55.html" rel="nofollow">full list of changes</a> is HUGE, be sure to read through it all if you&#39;re interested in the details</li>
<li>If you&#39;re doing an upgrade from 5.4 instead of a fresh install, pay careful attention to <a href="http://www.openbsd.org/faq/upgrade55.html" rel="nofollow">the upgrade guide</a> as there are some very specific steps for this version</li>
<li>Also be sure to apply the <a href="http://www.openbsd.org/errata55.html" rel="nofollow">errata patches</a> on your new installations... especially those OpenSSL ones (some of which <a href="http://marc.info/?l=oss-security&m=139906348230995&w=2" rel="nofollow">still aren&#39;t fixed</a> in the other BSDs yet)</li>
<li>On the topic of errata patches, the project is now going to also send them out (<a href="http://undeadly.org/cgi?action=article&sid=20140502103355" rel="nofollow">signed</a>) via the <a href="http://lists.openbsd.org/cgi-bin/mj_wwwusr?user=&passw=&func=lists-long-full&extra=announce" rel="nofollow">announce mailing list</a>, a very welcome change</li>
<li>Congrats to the whole team on this great release - 5.6 is going to be even more awesome with &quot;Libre&quot;SSL and lots of other stuff that&#39;s currently in development
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/04/freebsd-foundation-spring-fundraising_28.html" rel="nofollow">FreeBSD foundation funding highlights</a></h3>

<ul>
<li>The FreeBSD foundation posts a new update on how they&#39;re spending the money that everyone donates</li>
<li>&quot;As we embark on our 15th year of serving the FreeBSD Project and community, we are proud of what we&#39;ve done to help FreeBSD become the most innovative, reliable, and high-performance operation system&quot;</li>
<li>During this spring, they want to highlight the new UEFI boot support <a href="http://freebsdfoundation.blogspot.com/2014/05/freebsd-foundation-newcons-project.html" rel="nofollow">and newcons</a></li>
<li>There&#39;s a lot of details about what exactly UEFI is and why we need it going forward</li>
<li>FreeBSD has also needed some updates to its console to support UTF8 and wide characters</li>
<li>Hopefully this series will continue and we&#39;ll get to see what other work is being sponsored
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=139879453001957&w=2" rel="nofollow">OpenSSH without OpenSSL</a></h3>

<ul>
<li>The OpenSSH team has been hard at work, making it even better, and now OpenSSL is completely optional</li>
<li>Since it won&#39;t have access to the primitives OpenSSL uses, there will be a trade-off of features vs. security</li>
<li>This version will drop support for legacy SSH v1, and the only two cryptographic algorithms supported are an in-house implementation of AES in counter mode and the <a href="http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.chacha20poly1305?rev=HEAD;content-type=text%2Fplain" rel="nofollow">new combination</a> of the Chacha20 stream cipher with Poly1305 for packet integrity</li>
<li>Key exchange is limited to elliptic curve Diffie-Hellman and the newer Curve25519 KEXs</li>
<li>No support for RSA, DSA or ECDSA public keys - only Ed25519</li>
<li>It also includes a <a href="http://marc.info/?l=openbsd-cvs&m=139883582313750&w=2" rel="nofollow">new buffer API</a> and a set of wrappers to make it compatible with the existing API</li>
<li>Believe it or not, this was planned before all the heartbleed craziness</li>
<li>Maybe someday soon we&#39;ll have a mini-openssh-portable in FreeBSD ports and NetBSD pkgsrc, would be really neat
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1861-free-pascal-on-bsd-april-bsd-issue" rel="nofollow">BSDMag&#39;s April 2014 issue is out</a></h3>

<ul>
<li>The free monthly BSD magazine has got a new issue available for download</li>
<li>This time the articles include: pascal on BSD, an introduction to revision control systems and configuration management, deploying NetBSD on AWS EC2, more GIMP tutorials, an AsiaBSDCon 2014 report and a piece about how easily credit cards are stolen online</li>
<li>Anyone can contribute to the magazine, just send the editors an email about what you want to write</li>
<li>No Linux articles this time around, good
***</li>
</ul>

<h2>Interview - David Chisnall - <a href="mailto:theraven@freebsd.org" rel="nofollow">theraven@freebsd.org</a></h2>

<p>The LLVM/Clang switch, FreeBSD&#39;s core team, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/raid" rel="nofollow">RAID in FreeBSD and OpenBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://bsdtalk.blogspot.com/2014/04/bsdtalk240-about-time-with-george.html" rel="nofollow">BSDTalk episode 240</a></h3>

<ul>
<li>Our buddy Will Backman has uploaded a new episode of BSDTalk, this time with our other buddy GNN as the guest - mainly to talk about NTP and keeping reliable time</li>
<li>Topics include the specific details of crystals used in watches and computers to keep time, how temperature affects the quality, different sources of inaccuracy, some general NTP information, why you might want extremely precise time, different time sources (GPS, satellite, etc), differences in stratum levels, the problem of packet delay and estimating the round trip time, some of the recent NTP amplification attacks, the downsides to using UDP instead of TCP and... much more</li>
<li>GNN also talks a little about the <a href="https://en.wikipedia.org/wiki/Precision_Time_Protocol" rel="nofollow">Precision Time Protocol</a> and how it&#39;s different than NTP</li>
<li>Two <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">people</a> we&#39;ve <a href="http://www.bsdnow.tv/episodes/2014_03_05-bsd_now_vs_bsdtalk" rel="nofollow">interviewed</a> talking to each other, awesome</li>
<li>If you&#39;re interested in NTP, be sure to see our <a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">tutorial</a> too
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140502092427" rel="nofollow">m2k14 trip reports</a></h3>

<ul>
<li>We&#39;ve got a few more reports from the recent OpenBSD hackathon in Morocco</li>
<li>The first one is from Antoine Jacoutot (who is a key GNOME porter and gave us the screenshots for the <a href="http://www.bsdnow.tv/tutorials/the-desktop-obsd" rel="nofollow">OpenBSD desktop tutorial</a>)</li>
<li>&quot;Since I always fail at actually doing whatever I have planned for a hackathon, this time I decided to come to m2k14 unprepared about what I was going to do&quot;</li>
<li>He got lots of work done with ports and pushing GNOME-related patches back up to the main project, then worked on fixing ports&#39; compatibility with LibreSSL</li>
<li>Speaking of LibreSSL, there&#39;s <a href="http://undeadly.org/cgi?action=article&sid=20140505062023" rel="nofollow">an article</a> all would-be portable version writers should probably read and take into consideration</li>
<li>Jasper Adriaanse <a href="http://undeadly.org/cgi?action=article&sid=20140501185019" rel="nofollow">also writes</a> about what he got done over there</li>
<li>He cleaned up and fixed the puppet port to work better with OpenBSD
***</li>
</ul>

<h3><a href="https://www.atlantic.net/blog/2014/04/08/freebsd-ssd-cloud-vps-hosting-10-reasons/" rel="nofollow">Why you should use FreeBSD on your cloud VPS</a></h3>

<ul>
<li>Here we have a blog post from Atlantic, a VPS and hosting provider, about 10 reasons for using FreeBSD</li>
<li>Starts off with a little bit of BSD history for those who are unfamiliar with it and only know Linux and Windows</li>
<li>The 10 reasons are: community, stability, collaboration, ease of use, ports, security, ZFS, GEOM, sound and having lots of options</li>
<li>The post goes into detail about each of them and why FreeBSD makes a great choice for a VPS OS
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/05/weekly-feature-digest-27-software-system-redesign/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Big changes coming in the way PCBSD manages software</li>
<li>The PBI system, AppCafe and related tools are all going to use pkgng now</li>
<li>The AppCafe will no longer be limited to PBIs, so much more software will be easily available from the ports tree</li>
<li>New rating system coming soon and much more
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21bk2oPuQ" rel="nofollow">Martin writes in</a></li>
<li><a href="http://slexy.org/view/s2n9fx1Rpw" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s2rBBKLA4u" rel="nofollow">Alex writes in</a></li>
<li><a href="http://slexy.org/view/s20JY6ZI71" rel="nofollow">Goetz writes in</a></li>
<li><a href="http://slexy.org/view/s20YV5Ohpa" rel="nofollow">Jarrad writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>35: Puffy Firewall</title>
  <link>https://www.bsdnow.tv/35</link>
  <guid isPermaLink="false">203904d9-509c-4727-918f-d5e6a6276cf8</guid>
  <pubDate>Wed, 30 Apr 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/203904d9-509c-4727-918f-d5e6a6276cf8.mp3" length="57157492" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We're back again! On this week's packed show, we've got one of the biggest tutorials we've done in a while. It's an in-depth look at PF, OpenBSD's firewall, with some practical examples and different use cases. We'll also be talking to Peter Hansteen about the new edition of "The Book of PF." Of course, we've got news and answers to your emails too, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:19:23</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We're back again! On this week's packed show, we've got one of the biggest tutorials we've done in a while. It's an in-depth look at PF, OpenBSD's firewall, with some practical examples and different use cases. We'll also be talking to Peter Hansteen about the new edition of "The Book of PF." Of course, we've got news and answers to your emails too, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
ALTQ removed from PF (http://undeadly.org/cgi?action=article&amp;amp;sid=20140419151959)
Kicking off our big PF episode...
The classic packet queueing system, ALTQ, was recently removed from OpenBSD -current
There will be a transitional phase between 5.5 and 5.6 where you can still use it by replacing the "queue" keyword with "oldqueue" in your pf.conf
As of 5.6, due about six months from now, you'll have to change your ruleset to the new syntax if you're using it for bandwidth shaping
After more than ten years, bandwidth queueing has matured quite a bit and we can finally put ALTQ to rest, in favor of the new queueing subsystem
This doesn't affect FreeBSD, PCBSD, NetBSD or DragonflyBSD since all of their PFs are older and maintained separately.
***
FreeBSD Quarterly Status Report (https://www.freebsd.org/news/status/report-2014-01-2014-03.html)
The quarterly status report from FreeBSD is out, detailing some of the project's ongoing tasks
Some highlights include the first "stable" branch of ports, ARM improvements (including SMP), bhyve improvements, more work on the test suite, desktop improvements including the new vt console driver and UEFI booting support finally being added
We've got some specific updates from the cluster admin team, core team, documentation team, portmgr team, email team and release engineering team
LOTS of details and LOTS of topics to cover, give it a read
***
OpenBSD's OpenSSL rewrite continues with m2k14 (http://undeadly.org/cgi?action=article&amp;amp;sid=20140417184158)
A mini OpenBSD hackathon (http://www.openbsd.org/hackathons.html) begins in Morocco, Africa
You can follow the changes in the -current CVS log (http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/ssl/), but a lot of work (http://undeadly.org/cgi?action=article&amp;amp;sid=20140418063443) is mainly going towards the OpenSSL cleaning
We've got two trip (http://undeadly.org/cgi?action=article&amp;amp;sid=20140429121423) reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20140425115340) so far, hopefully we'll have some more to show you in a future episode
You can see some of the more interesting quotes (http://opensslrampage.org/) from the tear-down or see everything (http://freshbsd.org/commit/openbsd/e5136d69ece4682e6167c8f4a8122270236898bf)
Apparently (http://undeadly.org/cgi?action=article&amp;amp;sid=20140423045847) they are going to call the fork "LibreSSL (https://news.ycombinator.com/item?id=7623789)" ....
What were the OpenSSL developers thinking (http://freshbsd.org/commit/openbsd/e5136d69ece4682e6167c8f4a8122270236898bf)? The RSA private key was used to seed the entropy!
We also got some mainstream news coverage (http://www.zdnet.com/openbsd-forks-prunes-fixes-openssl-7000028613/) and another post from Ted (http://www.tedunangst.com/flak/post/origins-of-libressl) about the history of the fork
Definitely consider donating to the OpenBSD foundation (http://www.openbsdfoundation.org/donations.html), this fork will benefit all the other BSDs too
***
NetBSD 6.1.4 and 6.0.5 released (https://blog.netbsd.org/tnf/entry/netbsd_6_1_4_and)
New updates for the 6.1 and 6.0 branches of NetBSD, focusing on bugfixes
The main update is - of course - the heartbleed vulnerability
Also includes fixes for other security issues and even a kernel panic... on Atari
Patch your Ataris right now, this is serious business
***
Interview - Peter Hansteen - peter@bsdly.net (mailto:peter@bsdly.net) / @pitrh (https://twitter.com/pitrh)
The Book of PF: 3rd edition
Tutorial
BSD Firewalls: PF (http://www.bsdnow.tv/tutorials/pf)
News Roundup
New Xorg now the default in FreeBSD (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=351411)
For quite a while now, FreeBSD has had two versions of X11 in ports
The older, stable version was the default, but you could install a newer one by having "WITHNEWXORG" in /etc/make.conf
They've finally made the switch for 10-STABLE and 9-STABLE
Check this wiki page (https://wiki.freebsd.org/Graphics) for more info
***
GSoC-accepted BSD projects (https://www.google-melange.com/gsoc/org2/google/gsoc2014/openbsdfoundation)
The Google Summer of Code team has got the list of accepted project proposals uploaded so we can see what's planned
OpenBSD's list includes DHCP configuration parsing improvements, systemd replacements, porting capsicum, GPT and UEFI support, and modernizing the DHCP daemon
The FreeBSD list (https://www.google-melange.com/gsoc/org2/google/gsoc2014/freebsd) was also posted
Theirs includes porting FreeBSD to the Android emulator, CTF in the kernel debugger, improved unicode support, converting firewall rules to a C module, pkgng improvements, MicroBlaze support, PXE fixes, bhyve caching, bootsplash and lots more
Good luck to all the students participating, hopefully they become full time BSD users
***
Complexity of FreeBSD VFS using ZFS as an example (http://www.hybridcluster.com/blog/complexity-freebsd-vfs-using-zfs-example-part-2/)
HybridCluster posted the second part of their VFS and ZFS series
This new post has lots of technical details once again, definitely worth reading if you're a ZFS guy
Of course, also watch episode 24 (http://www.bsdnow.tv/episodes/2014_02_12-the_cluster_the_cloud) for our interview with HybridCluster - they do really interesting stuff
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/04/weekly-feature-digest-26-the-lumina-project-and-preload/)
Preload has been ported over, it's a daemon that prefetches applications
PCBSD is developing their own desktop environment, Lumina (there's also an FAQ (http://blog.pcbsd.org/2014/04/quick-lumina-desktop-faq/))
It's still in active development, but you can try it out by installing from ports
We'll be showing a live demo of it in a few weeks (when development settles down a bit)
Some kid in Australia subjects his poor mother to being on camera (https://www.youtube.com/watch?v=ETxhbf3-z18) while she tries out PCBSD and gives her impressions of it
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, pf, firewall, pfsense, ipfw, ipfilter, router, packet filter, book of pf, third edition, 3rd, bsdcan, presentation, security, peter hansteen, peter n.m. hansteen, pitrh, iptables, npf, nostarch, no starch press, m2k14, hackathon, libressl, openssl, fork</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;re back again! On this week&#39;s packed show, we&#39;ve got one of the biggest tutorials we&#39;ve done in a while. It&#39;s an in-depth look at PF, OpenBSD&#39;s firewall, with some practical examples and different use cases. We&#39;ll also be talking to Peter Hansteen about the new edition of &quot;The Book of PF.&quot; Of course, we&#39;ve got news and answers to your emails too, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140419151959" rel="nofollow">ALTQ removed from PF</a></h3>

<ul>
<li>Kicking off our big PF episode...</li>
<li>The classic packet queueing system, ALTQ, was recently removed from OpenBSD -current</li>
<li>There will be a transitional phase between 5.5 and 5.6 where you can still use it by replacing the &quot;queue&quot; keyword with &quot;oldqueue&quot; in your pf.conf</li>
<li>As of 5.6, due about six months from now, you&#39;ll have to change your ruleset to the new syntax if you&#39;re using it for bandwidth shaping</li>
<li>After more than ten years, bandwidth queueing has matured quite a bit and we can finally put ALTQ to rest, in favor of the new queueing subsystem</li>
<li>This doesn&#39;t affect FreeBSD, PCBSD, NetBSD or DragonflyBSD since all of their PFs are older and maintained separately.
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2014-01-2014-03.html" rel="nofollow">FreeBSD Quarterly Status Report</a></h3>

<ul>
<li>The quarterly status report from FreeBSD is out, detailing some of the project&#39;s ongoing tasks</li>
<li>Some highlights include the first &quot;stable&quot; branch of ports, ARM improvements (including SMP), bhyve improvements, more work on the test suite, desktop improvements including the new vt console driver and UEFI booting support finally being added</li>
<li>We&#39;ve got some specific updates from the cluster admin team, core team, documentation team, portmgr team, email team and release engineering team</li>
<li>LOTS of details and LOTS of topics to cover, give it a read
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140417184158" rel="nofollow">OpenBSD&#39;s OpenSSL rewrite continues with m2k14</a></h3>

<ul>
<li>A mini OpenBSD <a href="http://www.openbsd.org/hackathons.html" rel="nofollow">hackathon</a> begins in Morocco, Africa</li>
<li>You can follow the changes in <a href="http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/ssl/" rel="nofollow">the -current CVS log</a>, but <a href="http://undeadly.org/cgi?action=article&sid=20140418063443" rel="nofollow">a lot of work</a> is mainly going towards the OpenSSL cleaning</li>
<li>We&#39;ve got two <a href="http://undeadly.org/cgi?action=article&sid=20140429121423" rel="nofollow">trip</a> <a href="http://undeadly.org/cgi?action=article&sid=20140425115340" rel="nofollow">reports</a> so far, hopefully we&#39;ll have some more to show you in a future episode</li>
<li>You can see some of the <a href="http://opensslrampage.org/" rel="nofollow">more interesting quotes</a> from the tear-down or <a href="http://freshbsd.org/commit/openbsd/e5136d69ece4682e6167c8f4a8122270236898bf" rel="nofollow">see everything</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140423045847" rel="nofollow">Apparently</a> they are going to call the fork &quot;<a href="https://news.ycombinator.com/item?id=7623789" rel="nofollow">LibreSSL</a>&quot; ....</li>
<li><a href="http://freshbsd.org/commit/openbsd/e5136d69ece4682e6167c8f4a8122270236898bf" rel="nofollow">What were the OpenSSL developers thinking</a>? The RSA private key was used to seed the entropy!</li>
<li>We also got <a href="http://www.zdnet.com/openbsd-forks-prunes-fixes-openssl-7000028613/" rel="nofollow">some mainstream news coverage</a> and <a href="http://www.tedunangst.com/flak/post/origins-of-libressl" rel="nofollow">another post from Ted</a> about the history of the fork</li>
<li>Definitely consider <a href="http://www.openbsdfoundation.org/donations.html" rel="nofollow">donating to the OpenBSD foundation</a>, this fork will benefit all the other BSDs too
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_6_1_4_and" rel="nofollow">NetBSD 6.1.4 and 6.0.5 released</a></h3>

<ul>
<li>New updates for the 6.1 and 6.0 branches of NetBSD, focusing on bugfixes</li>
<li>The main update is - of course - the heartbleed vulnerability</li>
<li>Also includes fixes for other security issues and even a kernel panic... on Atari</li>
<li>Patch your Ataris right now, this is serious business
***</li>
</ul>

<h2>Interview - Peter Hansteen - <a href="mailto:peter@bsdly.net" rel="nofollow">peter@bsdly.net</a> / <a href="https://twitter.com/pitrh" rel="nofollow">@pitrh</a></h2>

<p>The Book of PF: 3rd edition</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/pf" rel="nofollow">BSD Firewalls: PF</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=351411" rel="nofollow">New Xorg now the default in FreeBSD</a></h3>

<ul>
<li>For quite a while now, FreeBSD has had two versions of X11 in ports</li>
<li>The older, stable version was the default, but you could install a newer one by having &quot;WITH_NEW_XORG&quot; in /etc/make.conf</li>
<li>They&#39;ve finally made the switch for 10-STABLE and 9-STABLE</li>
<li>Check <a href="https://wiki.freebsd.org/Graphics" rel="nofollow">this wiki page</a> for more info
***</li>
</ul>

<h3><a href="https://www.google-melange.com/gsoc/org2/google/gsoc2014/openbsdfoundation" rel="nofollow">GSoC-accepted BSD projects</a></h3>

<ul>
<li>The Google Summer of Code team has got the list of accepted project proposals uploaded so we can see what&#39;s planned</li>
<li>OpenBSD&#39;s list includes DHCP configuration parsing improvements, systemd replacements, porting capsicum, GPT and UEFI support, and modernizing the DHCP daemon</li>
<li>The <a href="https://www.google-melange.com/gsoc/org2/google/gsoc2014/freebsd" rel="nofollow">FreeBSD list</a> was also posted</li>
<li>Theirs includes porting FreeBSD to the Android emulator, CTF in the kernel debugger, improved unicode support, converting firewall rules to a C module, pkgng improvements, MicroBlaze support, PXE fixes, bhyve caching, bootsplash and lots more</li>
<li>Good luck to all the students participating, hopefully they become full time BSD users
***</li>
</ul>

<h3><a href="http://www.hybridcluster.com/blog/complexity-freebsd-vfs-using-zfs-example-part-2/" rel="nofollow">Complexity of FreeBSD VFS using ZFS as an example</a></h3>

<ul>
<li>HybridCluster posted the second part of their VFS and ZFS series</li>
<li>This new post has lots of technical details once again, definitely worth reading if you&#39;re a ZFS guy</li>
<li>Of course, also watch <a href="http://www.bsdnow.tv/episodes/2014_02_12-the_cluster_the_cloud" rel="nofollow">episode 24</a> for our interview with HybridCluster - they do really interesting stuff
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/04/weekly-feature-digest-26-the-lumina-project-and-preload/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Preload has been ported over, it&#39;s a daemon that prefetches applications</li>
<li>PCBSD is developing their own desktop environment, Lumina (<a href="http://blog.pcbsd.org/2014/04/quick-lumina-desktop-faq/" rel="nofollow">there&#39;s also an FAQ</a>)</li>
<li>It&#39;s still in active development, but you can try it out by installing from ports</li>
<li>We&#39;ll be showing a live demo of it in a few weeks (when development settles down a bit)</li>
<li>Some kid in Australia <a href="https://www.youtube.com/watch?v=ETxhbf3-z18" rel="nofollow">subjects his poor mother to being on camera</a> while she tries out PCBSD and gives her impressions of it
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;re back again! On this week&#39;s packed show, we&#39;ve got one of the biggest tutorials we&#39;ve done in a while. It&#39;s an in-depth look at PF, OpenBSD&#39;s firewall, with some practical examples and different use cases. We&#39;ll also be talking to Peter Hansteen about the new edition of &quot;The Book of PF.&quot; Of course, we&#39;ve got news and answers to your emails too, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140419151959" rel="nofollow">ALTQ removed from PF</a></h3>

<ul>
<li>Kicking off our big PF episode...</li>
<li>The classic packet queueing system, ALTQ, was recently removed from OpenBSD -current</li>
<li>There will be a transitional phase between 5.5 and 5.6 where you can still use it by replacing the &quot;queue&quot; keyword with &quot;oldqueue&quot; in your pf.conf</li>
<li>As of 5.6, due about six months from now, you&#39;ll have to change your ruleset to the new syntax if you&#39;re using it for bandwidth shaping</li>
<li>After more than ten years, bandwidth queueing has matured quite a bit and we can finally put ALTQ to rest, in favor of the new queueing subsystem</li>
<li>This doesn&#39;t affect FreeBSD, PCBSD, NetBSD or DragonflyBSD since all of their PFs are older and maintained separately.
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2014-01-2014-03.html" rel="nofollow">FreeBSD Quarterly Status Report</a></h3>

<ul>
<li>The quarterly status report from FreeBSD is out, detailing some of the project&#39;s ongoing tasks</li>
<li>Some highlights include the first &quot;stable&quot; branch of ports, ARM improvements (including SMP), bhyve improvements, more work on the test suite, desktop improvements including the new vt console driver and UEFI booting support finally being added</li>
<li>We&#39;ve got some specific updates from the cluster admin team, core team, documentation team, portmgr team, email team and release engineering team</li>
<li>LOTS of details and LOTS of topics to cover, give it a read
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140417184158" rel="nofollow">OpenBSD&#39;s OpenSSL rewrite continues with m2k14</a></h3>

<ul>
<li>A mini OpenBSD <a href="http://www.openbsd.org/hackathons.html" rel="nofollow">hackathon</a> begins in Morocco, Africa</li>
<li>You can follow the changes in <a href="http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/ssl/" rel="nofollow">the -current CVS log</a>, but <a href="http://undeadly.org/cgi?action=article&sid=20140418063443" rel="nofollow">a lot of work</a> is mainly going towards the OpenSSL cleaning</li>
<li>We&#39;ve got two <a href="http://undeadly.org/cgi?action=article&sid=20140429121423" rel="nofollow">trip</a> <a href="http://undeadly.org/cgi?action=article&sid=20140425115340" rel="nofollow">reports</a> so far, hopefully we&#39;ll have some more to show you in a future episode</li>
<li>You can see some of the <a href="http://opensslrampage.org/" rel="nofollow">more interesting quotes</a> from the tear-down or <a href="http://freshbsd.org/commit/openbsd/e5136d69ece4682e6167c8f4a8122270236898bf" rel="nofollow">see everything</a></li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140423045847" rel="nofollow">Apparently</a> they are going to call the fork &quot;<a href="https://news.ycombinator.com/item?id=7623789" rel="nofollow">LibreSSL</a>&quot; ....</li>
<li><a href="http://freshbsd.org/commit/openbsd/e5136d69ece4682e6167c8f4a8122270236898bf" rel="nofollow">What were the OpenSSL developers thinking</a>? The RSA private key was used to seed the entropy!</li>
<li>We also got <a href="http://www.zdnet.com/openbsd-forks-prunes-fixes-openssl-7000028613/" rel="nofollow">some mainstream news coverage</a> and <a href="http://www.tedunangst.com/flak/post/origins-of-libressl" rel="nofollow">another post from Ted</a> about the history of the fork</li>
<li>Definitely consider <a href="http://www.openbsdfoundation.org/donations.html" rel="nofollow">donating to the OpenBSD foundation</a>, this fork will benefit all the other BSDs too
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_6_1_4_and" rel="nofollow">NetBSD 6.1.4 and 6.0.5 released</a></h3>

<ul>
<li>New updates for the 6.1 and 6.0 branches of NetBSD, focusing on bugfixes</li>
<li>The main update is - of course - the heartbleed vulnerability</li>
<li>Also includes fixes for other security issues and even a kernel panic... on Atari</li>
<li>Patch your Ataris right now, this is serious business
***</li>
</ul>

<h2>Interview - Peter Hansteen - <a href="mailto:peter@bsdly.net" rel="nofollow">peter@bsdly.net</a> / <a href="https://twitter.com/pitrh" rel="nofollow">@pitrh</a></h2>

<p>The Book of PF: 3rd edition</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/pf" rel="nofollow">BSD Firewalls: PF</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=351411" rel="nofollow">New Xorg now the default in FreeBSD</a></h3>

<ul>
<li>For quite a while now, FreeBSD has had two versions of X11 in ports</li>
<li>The older, stable version was the default, but you could install a newer one by having &quot;WITH_NEW_XORG&quot; in /etc/make.conf</li>
<li>They&#39;ve finally made the switch for 10-STABLE and 9-STABLE</li>
<li>Check <a href="https://wiki.freebsd.org/Graphics" rel="nofollow">this wiki page</a> for more info
***</li>
</ul>

<h3><a href="https://www.google-melange.com/gsoc/org2/google/gsoc2014/openbsdfoundation" rel="nofollow">GSoC-accepted BSD projects</a></h3>

<ul>
<li>The Google Summer of Code team has got the list of accepted project proposals uploaded so we can see what&#39;s planned</li>
<li>OpenBSD&#39;s list includes DHCP configuration parsing improvements, systemd replacements, porting capsicum, GPT and UEFI support, and modernizing the DHCP daemon</li>
<li>The <a href="https://www.google-melange.com/gsoc/org2/google/gsoc2014/freebsd" rel="nofollow">FreeBSD list</a> was also posted</li>
<li>Theirs includes porting FreeBSD to the Android emulator, CTF in the kernel debugger, improved unicode support, converting firewall rules to a C module, pkgng improvements, MicroBlaze support, PXE fixes, bhyve caching, bootsplash and lots more</li>
<li>Good luck to all the students participating, hopefully they become full time BSD users
***</li>
</ul>

<h3><a href="http://www.hybridcluster.com/blog/complexity-freebsd-vfs-using-zfs-example-part-2/" rel="nofollow">Complexity of FreeBSD VFS using ZFS as an example</a></h3>

<ul>
<li>HybridCluster posted the second part of their VFS and ZFS series</li>
<li>This new post has lots of technical details once again, definitely worth reading if you&#39;re a ZFS guy</li>
<li>Of course, also watch <a href="http://www.bsdnow.tv/episodes/2014_02_12-the_cluster_the_cloud" rel="nofollow">episode 24</a> for our interview with HybridCluster - they do really interesting stuff
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/04/weekly-feature-digest-26-the-lumina-project-and-preload/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Preload has been ported over, it&#39;s a daemon that prefetches applications</li>
<li>PCBSD is developing their own desktop environment, Lumina (<a href="http://blog.pcbsd.org/2014/04/quick-lumina-desktop-faq/" rel="nofollow">there&#39;s also an FAQ</a>)</li>
<li>It&#39;s still in active development, but you can try it out by installing from ports</li>
<li>We&#39;ll be showing a live demo of it in a few weeks (when development settles down a bit)</li>
<li>Some kid in Australia <a href="https://www.youtube.com/watch?v=ETxhbf3-z18" rel="nofollow">subjects his poor mother to being on camera</a> while she tries out PCBSD and gives her impressions of it
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>34: It's Gonna Get NASty</title>
  <link>https://www.bsdnow.tv/34</link>
  <guid isPermaLink="false">47904615-f374-468c-b27c-625dad704346</guid>
  <pubDate>Wed, 23 Apr 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/47904615-f374-468c-b27c-625dad704346.mp3" length="16314196" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week, Allan's at a conference so we've got a short episode for you. We sat down with John Hixson to discuss FreeNAS development and all their future plans. The show will be back next week with a normal episode.</itunes:subtitle>
  <itunes:duration>22:39</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week, Allan's at a conference so we've got a short episode for you. We sat down with John Hixson to discuss FreeNAS development and all their future plans. The show will be back next week with a normal episode.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Interview - John Hixson - john@ixsystems.com (mailto:john@ixsystems.com) / @bsdwhore (https://twitter.com/bsdwhore)
FreeNAS development
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, john hixson, ixsystems, freenas, plugins, jails, development</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week, Allan&#39;s at a conference so we&#39;ve got a short episode for you. We sat down with John Hixson to discuss FreeNAS development and all their future plans. The show will be back next week with a normal episode.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Interview - John Hixson - <a href="mailto:john@ixsystems.com" rel="nofollow">john@ixsystems.com</a> / <a href="https://twitter.com/bsdwhore" rel="nofollow">@bsdwhore</a></h2>

<p>FreeNAS development</p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week, Allan&#39;s at a conference so we&#39;ve got a short episode for you. We sat down with John Hixson to discuss FreeNAS development and all their future plans. The show will be back next week with a normal episode.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Interview - John Hixson - <a href="mailto:john@ixsystems.com" rel="nofollow">john@ixsystems.com</a> / <a href="https://twitter.com/bsdwhore" rel="nofollow">@bsdwhore</a></h2>

<p>FreeNAS development</p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>33: Certified Package Delivery</title>
  <link>https://www.bsdnow.tv/33</link>
  <guid isPermaLink="false">f0c15113-8ade-464b-a89f-3398734256dc</guid>
  <pubDate>Wed, 16 Apr 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f0c15113-8ade-464b-a89f-3398734256dc.mp3" length="57837748" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week, we sit down with Jim Brown from the BSD Certification group to talk about the BSD exams. Following that, we'll be showing you how to build OpenBSD binary packages in bulk, a la poudriere. There's a boatload of news and we've got answers to your questions, coming up on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:20:19</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week, we sit down with Jim Brown from the BSD Certification group to talk about the BSD exams. Following that, we'll be showing you how to build OpenBSD binary packages in bulk, a la poudriere. There's a boatload of news and we've got answers to your questions, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
BSDCan schedule, speakers and talks (https://www.bsdcan.org/2014/schedule/)
This year's BSDCan will kick off on May 14th in Ottawa
The list of speakers (https://www.bsdcan.org/2014/schedule/speakers.en.html) is also out
And finally the talks (https://www.bsdcan.org/2014/schedule/events.en.html) everyone's looking forward to
Lots of great tutorials and talks, spanning a wide range of topics of interest
Be sure to come by so you can and meet Allan and Kris in person and get BSDCan shirts (https://twitter.com/bsdcan/status/454990067552247808)
***
NYCBSDCon talks uploaded (https://www.youtube.com/watch?v=4bPduH6O7lI)
The BSD TV YouTube channel has been uploading recordings from the 2014 NYCBSDCon
Jeff Rizzo's talk, "Releasing NetBSD: So Many Targets, So Little Time"
Dru Lavigne's talk (https://www.youtube.com/watch?v=DAmZ3cbfigA), "ZFS Management Tools in FreeNAS and PC-BSD"
Scott Long's talk (https://www.youtube.com/watch?v=FL5U4wr86L4), "Serving one third of the Internet via FreeBSD"
Michael W. Lucas' talk (https://www.youtube.com/watch?v=buo5JlMnGPI), "BSD Breaking Barriers"
***
FreeBSD Journal, issue 2 (http://freebsdfoundation.blogspot.com/2014/04/freebsd-journal-issue-2-is-now-available.html)
The bi-monthly FreeBSD journal's second issue is out
Topics in this issue include pkg, poudriere, the PBI format, hwpmc and journaled soft-updates
In less than two months, they've already gotten over 1000 subscribers! It's available on Google Play, iTunes, Amazon, etc
"We are also working on a dynamic version of the magazine that can be read in many web browsers, including those that run on FreeBSD"
Check our interview with GNN (http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates) for more information about the journal
***
OpenSSL, more like OpenSS-Hell (http://bsd.slashdot.org/story/200567)
We mentioned this huge OpenSSL bug last week during all the chaos, but the aftermath is just as messy
There's been a pretty vicious response from security experts all across the internet and in all of the BSD projects - and rightfully so
We finally have a timeline of events (http://www.smh.com.au/it-pro/security-it/heartbleed-disclosure-timeline-who-knew-what-and-when-20140414-zqurk.html)
Reactions from ISC (https://isc.sans.edu/diary/Testing+for+Heartbleed/17933), PCBSD (http://blog.pcbsd.org/2014/04/openssl-security-update/), Tarsnap (http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html), the Tor (https://lists.torproject.org/pipermail/tor-talk/2014-April/thread.html) project (https://lists.torproject.org/pipermail/tor-relays/2014-April/thread.html), FreeBSD (https://lists.freebsd.org/pipermail/freebsd-security/2014-April/thread.html), NetBSD (http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-004.txt.asc), oss-sec (http://seclists.org/oss-sec/2014/q2/index.html), PHK (https://queue.acm.org/detail.cfm?id=2602816), Varnish (https://www.varnish-cache.org/docs/trunk/phk/dough.html) and Akamai (https://blogs.akamai.com/2014/04/heartbleed-update.html)
pfSense (http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense) released a new version to fix it (https://blog.pfsense.org/?p=1253)
OpenBSD disabled heartbeat entirely (http://marc.info/?l=openbsd-cvs&amp;amp;m=139715336230455&amp;amp;w=2) and is very unforgiving of the IETF (https://news.ycombinator.com/item?id=7568921)
Ted Unangst (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures) has two good (http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf) write-ups (http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse) about the issue and how horrible the OpenSSL codebase is
A nice quote from one of the OpenBSD lists: "Given how trivial one-liner fixes such as #2569 have remained unfixed for 2.5+ years, one can only assume that OpenSSL's bug tracker is only used to park bugs, not fix them"
Sounds like someone else (http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html) was having fun with the bug for a while too
There's also another OpenSSL bug that OpenBSD patched (http://marc.info/?l=openbsd-cvs&amp;amp;m=139732441810737&amp;amp;w=2) - it allows an attacker to inject data from one connection into another 
OpenBSD has also imported the most current version of OpenSSL and are ripping it apart from the inside out - we're seeing a fork (http://undeadly.org/cgi?action=article&amp;amp;sid=20140415093252) in real time
***
Interview - Jim Brown - info@bsdcertification.org (mailto:info@bsdcertification.org)
The BSD Certification (http://bsdcertification.org/) exams
Tutorial
Building OpenBSD binary packages in bulk (http://www.bsdnow.tv/tutorials/dpb)
News Roundup
Portable signify (https://github.com/aperezdc/signify)
Back in episode 23 (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures) we talked with Ted Unangst about the new "signify" tool in OpenBSD
Now there's a (completely unofficial) portable version of it on github
If you want to verify your OpenBSD sets ahead of time on another OS, this tool should let you do it
Maybe other BSD projects can adopt it as a replacement for gpg and incorporate it into their base systems
***
Foundation goals and updates (https://www.mail-archive.com/misc@openbsd.org/msg128240.html)
The OpenBSD foundation has reached their 2014 goal of $150,000
You can check their activities and goals (http://www.openbsdfoundation.org/activities.html) to see where the money is going
Remember that funding also goes to OpenSSH, which EVERY system uses and relies on everyday to protect their data
The FreeBSD foundation has kicked off their spring fundraising (http://freebsdfoundation.blogspot.com/2014/04/freebsd-foundation-spring-fundraising.html) campaign
There's also a list of their activities and goals available to read through
Be sure to support your favorite BSD, whichever one, so they can continue to make and improve great software that powers the whole internet
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/04/pc-bsd-weekly-feature-digest-25/)
New PBI runtime that fixes stability issues and decreases load times
"Update Center" is getting a lot of development and improvements
Lots of misc. bug fixes and updates
***
Feedback/Questions
There's a reddit thread (http://www.reddit.com/r/BSD/comments/22y497/i_need_a_bit_of_help_showing_my_friends_bsd_and/) we wanted to highlight - a user wants to show his friend BSD and why it's great
Brad writes in (http://slexy.org/view/s20Tso9a6v)
Sha'ul writes in (http://slexy.org/view/s21DfdV9yt)
iGibbs writes in (http://slexy.org/view/s2di8XRt73)
Matt writes in (http://slexy.org/view/s20m2g8UgV)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, dpb, distributed ports builder, marc espie, poudriere, package builds, jim brown, bsdcertification, bsd certification, exam, test, openssl, heartbleed, exploit, ssl, tls, heartbeat, openssh, theo de raadt, hole, 0day, zero day, bsdcan, nycbsdcon, presentations, talks, conference, recording, netflix, tarsnap, mitigation, ixsystems, foundation, journal, cve</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week, we sit down with Jim Brown from the BSD Certification group to talk about the BSD exams. Following that, we&#39;ll be showing you how to build OpenBSD binary packages in bulk, a la poudriere. There&#39;s a boatload of news and we&#39;ve got answers to your questions, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2014/schedule/" rel="nofollow">BSDCan schedule, speakers and talks</a></h3>

<ul>
<li>This year&#39;s BSDCan will kick off on May 14th in Ottawa</li>
<li>The <a href="https://www.bsdcan.org/2014/schedule/speakers.en.html" rel="nofollow">list of speakers</a> is also out</li>
<li>And finally <a href="https://www.bsdcan.org/2014/schedule/events.en.html" rel="nofollow">the talks</a> everyone&#39;s looking forward to</li>
<li>Lots of great tutorials and talks, spanning a wide range of topics of interest</li>
<li>Be sure to come by so you can and meet Allan and Kris in person <a href="https://twitter.com/bsdcan/status/454990067552247808" rel="nofollow">and get BSDCan shirts</a>
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=4bPduH6O7lI" rel="nofollow">NYCBSDCon talks uploaded</a></h3>

<ul>
<li>The BSD TV YouTube channel has been uploading recordings from the 2014 NYCBSDCon</li>
<li>Jeff Rizzo&#39;s talk, &quot;Releasing NetBSD: So Many Targets, So Little Time&quot;</li>
<li><a href="https://www.youtube.com/watch?v=DAmZ3cbfigA" rel="nofollow">Dru Lavigne&#39;s talk</a>, &quot;ZFS Management Tools in FreeNAS and PC-BSD&quot;</li>
<li><a href="https://www.youtube.com/watch?v=FL5U4wr86L4" rel="nofollow">Scott Long&#39;s talk</a>, &quot;Serving one third of the Internet via FreeBSD&quot;</li>
<li><a href="https://www.youtube.com/watch?v=buo5JlMnGPI" rel="nofollow">Michael W. Lucas&#39; talk</a>, &quot;BSD Breaking Barriers&quot;
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/04/freebsd-journal-issue-2-is-now-available.html" rel="nofollow">FreeBSD Journal, issue 2</a></h3>

<ul>
<li>The bi-monthly FreeBSD journal&#39;s second issue is out</li>
<li>Topics in this issue include pkg, poudriere, the PBI format, hwpmc and journaled soft-updates</li>
<li>In less than two months, they&#39;ve already gotten over 1000 subscribers! It&#39;s available on Google Play, iTunes, Amazon, etc</li>
<li>&quot;We are also working on a dynamic version of the magazine that can be read in many web browsers, including those that run on FreeBSD&quot;</li>
<li>Check <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">our interview with GNN</a> for more information about the journal
***</li>
</ul>

<h3><a href="http://bsd.slashdot.org/story/200567" rel="nofollow">OpenSSL, more like OpenSS-Hell</a></h3>

<ul>
<li>We mentioned this huge OpenSSL bug last week during all the chaos, but the aftermath is just as messy</li>
<li>There&#39;s been a pretty vicious response from security experts all across the internet and in all of the BSD projects - and rightfully so</li>
<li>We finally have <a href="http://www.smh.com.au/it-pro/security-it/heartbleed-disclosure-timeline-who-knew-what-and-when-20140414-zqurk.html" rel="nofollow">a timeline of events</a></li>
<li>Reactions from <a href="https://isc.sans.edu/diary/Testing+for+Heartbleed/17933" rel="nofollow">ISC</a>, <a href="http://blog.pcbsd.org/2014/04/openssl-security-update/" rel="nofollow">PCBSD</a>, <a href="http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html" rel="nofollow">Tarsnap</a>, the <a href="https://lists.torproject.org/pipermail/tor-talk/2014-April/thread.html" rel="nofollow">Tor</a> <a href="https://lists.torproject.org/pipermail/tor-relays/2014-April/thread.html" rel="nofollow">project</a>, <a href="https://lists.freebsd.org/pipermail/freebsd-security/2014-April/thread.html" rel="nofollow">FreeBSD</a>, <a href="http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-004.txt.asc" rel="nofollow">NetBSD</a>, <a href="http://seclists.org/oss-sec/2014/q2/index.html" rel="nofollow">oss-sec</a>, <a href="https://queue.acm.org/detail.cfm?id=2602816" rel="nofollow">PHK</a>, <a href="https://www.varnish-cache.org/docs/trunk/phk/dough.html" rel="nofollow">Varnish</a> and <a href="https://blogs.akamai.com/2014/04/heartbleed-update.html" rel="nofollow">Akamai</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">pfSense</a> released <a href="https://blog.pfsense.org/?p=1253" rel="nofollow">a new version to fix it</a></li>
<li>OpenBSD <a href="http://marc.info/?l=openbsd-cvs&m=139715336230455&w=2" rel="nofollow">disabled heartbeat entirely</a> and is very <a href="https://news.ycombinator.com/item?id=7568921" rel="nofollow">unforgiving of the IETF</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> has two <a href="http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf" rel="nofollow">good</a> <a href="http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse" rel="nofollow">write-ups</a> about the issue and how horrible the OpenSSL codebase is</li>
<li>A nice quote from one of the OpenBSD lists: &quot;Given how trivial one-liner fixes such as #2569 have remained unfixed for 2.5+ years, one can only assume that OpenSSL&#39;s bug tracker is only used to park bugs, not fix them&quot;</li>
<li>Sounds like <a href="http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html" rel="nofollow">someone else</a> was having fun with the bug for a while too</li>
<li><strong>There&#39;s also another OpenSSL bug</strong> that <a href="http://marc.info/?l=openbsd-cvs&m=139732441810737&w=2" rel="nofollow">OpenBSD patched</a> - it allows an attacker to <strong>inject data from one connection into another</strong> </li>
<li>OpenBSD has also imported the most current version of OpenSSL and are ripping it apart from the inside out - we&#39;re <a href="http://undeadly.org/cgi?action=article&sid=20140415093252" rel="nofollow">seeing a fork</a> in real time
***</li>
</ul>

<h2>Interview - Jim Brown - <a href="mailto:info@bsdcertification.org" rel="nofollow">info@bsdcertification.org</a></h2>

<p>The <a href="http://bsdcertification.org/" rel="nofollow">BSD Certification</a> exams</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/dpb" rel="nofollow">Building OpenBSD binary packages in bulk</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/aperezdc/signify" rel="nofollow">Portable signify</a></h3>

<ul>
<li>Back in <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">episode 23</a> we talked with Ted Unangst about the new &quot;signify&quot; tool in OpenBSD</li>
<li>Now there&#39;s a (completely unofficial) portable version of it on github</li>
<li>If you want to verify your OpenBSD sets ahead of time on another OS, this tool should let you do it</li>
<li>Maybe other BSD projects can adopt it as a replacement for gpg and incorporate it into their base systems
***</li>
</ul>

<h3><a href="https://www.mail-archive.com/misc@openbsd.org/msg128240.html" rel="nofollow">Foundation goals and updates</a></h3>

<ul>
<li>The OpenBSD foundation has reached their 2014 goal of $150,000</li>
<li>You can check <a href="http://www.openbsdfoundation.org/activities.html" rel="nofollow">their activities and goals</a> to see where the money is going</li>
<li>Remember that funding also goes to OpenSSH, which EVERY system uses and relies on everyday to protect their data</li>
<li>The FreeBSD foundation has kicked off their <a href="http://freebsdfoundation.blogspot.com/2014/04/freebsd-foundation-spring-fundraising.html" rel="nofollow">spring fundraising</a> campaign</li>
<li>There&#39;s also a list of their activities and goals available to read through</li>
<li>Be sure to support your favorite BSD, whichever one, so they can continue to make and improve great software that powers the whole internet
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/04/pc-bsd-weekly-feature-digest-25/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>New PBI runtime that fixes stability issues and decreases load times</li>
<li>&quot;Update Center&quot; is getting a lot of development and improvements</li>
<li>Lots of misc. bug fixes and updates
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://www.reddit.com/r/BSD/comments/22y497/i_need_a_bit_of_help_showing_my_friends_bsd_and/" rel="nofollow">There&#39;s a reddit thread</a> we wanted to highlight - a user wants to show his friend BSD and why it&#39;s great</li>
<li><a href="http://slexy.org/view/s20Tso9a6v" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s21DfdV9yt" rel="nofollow">Sha&#39;ul writes in</a></li>
<li><a href="http://slexy.org/view/s2di8XRt73" rel="nofollow">iGibbs writes in</a></li>
<li><a href="http://slexy.org/view/s20m2g8UgV" rel="nofollow">Matt writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week, we sit down with Jim Brown from the BSD Certification group to talk about the BSD exams. Following that, we&#39;ll be showing you how to build OpenBSD binary packages in bulk, a la poudriere. There&#39;s a boatload of news and we&#39;ve got answers to your questions, coming up on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.bsdcan.org/2014/schedule/" rel="nofollow">BSDCan schedule, speakers and talks</a></h3>

<ul>
<li>This year&#39;s BSDCan will kick off on May 14th in Ottawa</li>
<li>The <a href="https://www.bsdcan.org/2014/schedule/speakers.en.html" rel="nofollow">list of speakers</a> is also out</li>
<li>And finally <a href="https://www.bsdcan.org/2014/schedule/events.en.html" rel="nofollow">the talks</a> everyone&#39;s looking forward to</li>
<li>Lots of great tutorials and talks, spanning a wide range of topics of interest</li>
<li>Be sure to come by so you can and meet Allan and Kris in person <a href="https://twitter.com/bsdcan/status/454990067552247808" rel="nofollow">and get BSDCan shirts</a>
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=4bPduH6O7lI" rel="nofollow">NYCBSDCon talks uploaded</a></h3>

<ul>
<li>The BSD TV YouTube channel has been uploading recordings from the 2014 NYCBSDCon</li>
<li>Jeff Rizzo&#39;s talk, &quot;Releasing NetBSD: So Many Targets, So Little Time&quot;</li>
<li><a href="https://www.youtube.com/watch?v=DAmZ3cbfigA" rel="nofollow">Dru Lavigne&#39;s talk</a>, &quot;ZFS Management Tools in FreeNAS and PC-BSD&quot;</li>
<li><a href="https://www.youtube.com/watch?v=FL5U4wr86L4" rel="nofollow">Scott Long&#39;s talk</a>, &quot;Serving one third of the Internet via FreeBSD&quot;</li>
<li><a href="https://www.youtube.com/watch?v=buo5JlMnGPI" rel="nofollow">Michael W. Lucas&#39; talk</a>, &quot;BSD Breaking Barriers&quot;
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/04/freebsd-journal-issue-2-is-now-available.html" rel="nofollow">FreeBSD Journal, issue 2</a></h3>

<ul>
<li>The bi-monthly FreeBSD journal&#39;s second issue is out</li>
<li>Topics in this issue include pkg, poudriere, the PBI format, hwpmc and journaled soft-updates</li>
<li>In less than two months, they&#39;ve already gotten over 1000 subscribers! It&#39;s available on Google Play, iTunes, Amazon, etc</li>
<li>&quot;We are also working on a dynamic version of the magazine that can be read in many web browsers, including those that run on FreeBSD&quot;</li>
<li>Check <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">our interview with GNN</a> for more information about the journal
***</li>
</ul>

<h3><a href="http://bsd.slashdot.org/story/200567" rel="nofollow">OpenSSL, more like OpenSS-Hell</a></h3>

<ul>
<li>We mentioned this huge OpenSSL bug last week during all the chaos, but the aftermath is just as messy</li>
<li>There&#39;s been a pretty vicious response from security experts all across the internet and in all of the BSD projects - and rightfully so</li>
<li>We finally have <a href="http://www.smh.com.au/it-pro/security-it/heartbleed-disclosure-timeline-who-knew-what-and-when-20140414-zqurk.html" rel="nofollow">a timeline of events</a></li>
<li>Reactions from <a href="https://isc.sans.edu/diary/Testing+for+Heartbleed/17933" rel="nofollow">ISC</a>, <a href="http://blog.pcbsd.org/2014/04/openssl-security-update/" rel="nofollow">PCBSD</a>, <a href="http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html" rel="nofollow">Tarsnap</a>, the <a href="https://lists.torproject.org/pipermail/tor-talk/2014-April/thread.html" rel="nofollow">Tor</a> <a href="https://lists.torproject.org/pipermail/tor-relays/2014-April/thread.html" rel="nofollow">project</a>, <a href="https://lists.freebsd.org/pipermail/freebsd-security/2014-April/thread.html" rel="nofollow">FreeBSD</a>, <a href="http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-004.txt.asc" rel="nofollow">NetBSD</a>, <a href="http://seclists.org/oss-sec/2014/q2/index.html" rel="nofollow">oss-sec</a>, <a href="https://queue.acm.org/detail.cfm?id=2602816" rel="nofollow">PHK</a>, <a href="https://www.varnish-cache.org/docs/trunk/phk/dough.html" rel="nofollow">Varnish</a> and <a href="https://blogs.akamai.com/2014/04/heartbleed-update.html" rel="nofollow">Akamai</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">pfSense</a> released <a href="https://blog.pfsense.org/?p=1253" rel="nofollow">a new version to fix it</a></li>
<li>OpenBSD <a href="http://marc.info/?l=openbsd-cvs&m=139715336230455&w=2" rel="nofollow">disabled heartbeat entirely</a> and is very <a href="https://news.ycombinator.com/item?id=7568921" rel="nofollow">unforgiving of the IETF</a></li>
<li><a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> has two <a href="http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf" rel="nofollow">good</a> <a href="http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse" rel="nofollow">write-ups</a> about the issue and how horrible the OpenSSL codebase is</li>
<li>A nice quote from one of the OpenBSD lists: &quot;Given how trivial one-liner fixes such as #2569 have remained unfixed for 2.5+ years, one can only assume that OpenSSL&#39;s bug tracker is only used to park bugs, not fix them&quot;</li>
<li>Sounds like <a href="http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html" rel="nofollow">someone else</a> was having fun with the bug for a while too</li>
<li><strong>There&#39;s also another OpenSSL bug</strong> that <a href="http://marc.info/?l=openbsd-cvs&m=139732441810737&w=2" rel="nofollow">OpenBSD patched</a> - it allows an attacker to <strong>inject data from one connection into another</strong> </li>
<li>OpenBSD has also imported the most current version of OpenSSL and are ripping it apart from the inside out - we&#39;re <a href="http://undeadly.org/cgi?action=article&sid=20140415093252" rel="nofollow">seeing a fork</a> in real time
***</li>
</ul>

<h2>Interview - Jim Brown - <a href="mailto:info@bsdcertification.org" rel="nofollow">info@bsdcertification.org</a></h2>

<p>The <a href="http://bsdcertification.org/" rel="nofollow">BSD Certification</a> exams</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/dpb" rel="nofollow">Building OpenBSD binary packages in bulk</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://github.com/aperezdc/signify" rel="nofollow">Portable signify</a></h3>

<ul>
<li>Back in <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">episode 23</a> we talked with Ted Unangst about the new &quot;signify&quot; tool in OpenBSD</li>
<li>Now there&#39;s a (completely unofficial) portable version of it on github</li>
<li>If you want to verify your OpenBSD sets ahead of time on another OS, this tool should let you do it</li>
<li>Maybe other BSD projects can adopt it as a replacement for gpg and incorporate it into their base systems
***</li>
</ul>

<h3><a href="https://www.mail-archive.com/misc@openbsd.org/msg128240.html" rel="nofollow">Foundation goals and updates</a></h3>

<ul>
<li>The OpenBSD foundation has reached their 2014 goal of $150,000</li>
<li>You can check <a href="http://www.openbsdfoundation.org/activities.html" rel="nofollow">their activities and goals</a> to see where the money is going</li>
<li>Remember that funding also goes to OpenSSH, which EVERY system uses and relies on everyday to protect their data</li>
<li>The FreeBSD foundation has kicked off their <a href="http://freebsdfoundation.blogspot.com/2014/04/freebsd-foundation-spring-fundraising.html" rel="nofollow">spring fundraising</a> campaign</li>
<li>There&#39;s also a list of their activities and goals available to read through</li>
<li>Be sure to support your favorite BSD, whichever one, so they can continue to make and improve great software that powers the whole internet
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/04/pc-bsd-weekly-feature-digest-25/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>New PBI runtime that fixes stability issues and decreases load times</li>
<li>&quot;Update Center&quot; is getting a lot of development and improvements</li>
<li>Lots of misc. bug fixes and updates
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://www.reddit.com/r/BSD/comments/22y497/i_need_a_bit_of_help_showing_my_friends_bsd_and/" rel="nofollow">There&#39;s a reddit thread</a> we wanted to highlight - a user wants to show his friend BSD and why it&#39;s great</li>
<li><a href="http://slexy.org/view/s20Tso9a6v" rel="nofollow">Brad writes in</a></li>
<li><a href="http://slexy.org/view/s21DfdV9yt" rel="nofollow">Sha&#39;ul writes in</a></li>
<li><a href="http://slexy.org/view/s2di8XRt73" rel="nofollow">iGibbs writes in</a></li>
<li><a href="http://slexy.org/view/s20m2g8UgV" rel="nofollow">Matt writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>32: PXE Dust</title>
  <link>https://www.bsdnow.tv/32</link>
  <guid isPermaLink="false">a909eddb-036d-451c-8d5a-e7b8e358239f</guid>
  <pubDate>Wed, 09 Apr 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a909eddb-036d-451c-8d5a-e7b8e358239f.mp3" length="55324948" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the big show we'll be showing off OpenBSD's new "autoinstall" feature to do completely automatic, unattended installations. We also have an interview with Dru Lavigne about all the writing work she does for FreeBSD, PCBSD and FreeNAS. The latest headlines and answers to your emails, on BSD Now - it's the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:16:50</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the big show we'll be showing off OpenBSD's new "autoinstall" feature to do completely automatic, unattended installations. We also have an interview with Dru Lavigne about all the writing work she does for FreeBSD, PCBSD and FreeNAS. The latest headlines and answers to your emails, on BSD Now - it's the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
FreeBSD ASLR status update (http://0xfeedface.org/blog/lattera/2014-04-03/awesome-freebsd-aslr-progress)
Shawn Webb gives us a little update on his address space layout randomization work for FreeBSD
He's implemented execbase randomization for position-independent executables (which OpenBSD also just enabled globally in 5.5 on i386)
Work has also started on testing ASLR on ARM, using a Raspberry Pi
He's giving a presentation at BSDCan this year about his ASLR work
While we're on the topic of BSDCan...
***
BSDCan tutorials, improving the experience (http://bsdly.blogspot.com/2014/04/bsdcan-tutorials-please-help-me-improve.html)
Peter Hansteen writes a new blog post about his upcoming BSDCan tutorials
The tutorials are called "Building the network you need with PF, the OpenBSD packet filter" and "Transitioning to OpenBSD 5.5" - both scheduled to last three hours each
He's requesting anyone that'll be there to go ahead and contact him, telling him exactly what you'd like to learn
There's also a bit of background information about the tutorials and how he's looking to improve them
If you're interested in OpenBSD and going to BSDCan this year, hit him up
***
pkgsrc-2014Q1 released (http://mail-index.netbsd.org/netbsd-announce/2014/04/04/msg000202.html)
The new stable branch of pkgsrc packages has been built and is ready
Python 3.3 is now a "first class citizen" in pkgsrc
14255 packages for NetBSD-current/x8664, 11233 binary packages built with clang for FreeBSD 10/x8664
There's a new release every three months, and remember pkgsrc works on MANY operating systems, not just NetBSD - you could even use pkgsrc instead of pkgng or ports if you were so inclined
They're also looking into signing packages (http://mail-index.netbsd.org/tech-pkg/2014/03/31/msg012873.html)
***
Only two holes in a heck of a long time, who cares? (https://www.mail-archive.com/misc%40openbsd.org/index.html#127993)
A particularly vocal Debian user, a lost soul, somehow finds his way to the misc@ OpenBSD mailing list
He questions "what's the big deal" about OpenBSD's slogan being "Only two remote holes in the default install, in a heck of a long time!"
Luckily, the community and Theo set the record straight (https://www.mail-archive.com/misc%40openbsd.org/msg128001.html) about why you should care about this
Running insecure applications on OpenBSD is actually more secure than running them on other systems, due to things like ASLR, PIE and all the security features (https://www.mail-archive.com/misc%40openbsd.org/msg127995.html) of OpenBSD
It spawned a discussion about ease of management and Linux's poor security record, definitely worth reading (https://www.mail-archive.com/misc%40openbsd.org/msg128073.html)
***
Interview - Dru Lavigne - dru@freebsd.org (mailto:dru@freebsd.org) / @bsdevents (https://twitter.com/bsdevents)
FreeBSD's documentation printing, documentation springs, various topics
Tutorial
Automatic, unattended OpenBSD installs with PXE (http://www.bsdnow.tv/tutorials/autoinstall)
News Roundup
pfSense 2.1.1 released (https://doc.pfsense.org/index.php/2.1.1_New_Features_and_Changes)
A new version of pfSense is released, mainly to fix some security issues
Tracking some recent FreeBSD advisories, pfSense usually only applies the ones that would matter on a firewall or router
There are also some NIC driver updates and other things (https://blog.pfsense.org/?p=1238)
Of course if you want to learn more about pfSense, watch episode 25 (http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense)
2.1.2 is already up for testing too
***
FreeBSD gets UEFI support (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=264095)
It looks like FreeBSD's battle with UEFI may be coming to a close?
Ed Maste committed a giant list of patches to enable UEFI support on x86_64
Look through the list to see all the details and information
Thanks FreeBSD foundation!
***
Ideas for the next DragonflyBSD release (http://lists.dragonflybsd.org/pipermail/kernel/2014-March/094909.html)
Mr. Dragonfly release engineer himself, Justin Sherrill (http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug) posts some of his ideas for the upcoming release
They're aiming for late May for the next version
Ideas include better support for running in a VM, pkgng fixes, documentation updates and PAM support
Gasp, they're even considering dropping i386
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/04/pc-bsd-weekly-feature-digest-24/)
Lots of new PBI updates for 10.0, new runtime implementation
New support for running 32 bit applications in PBI runtime
New default CD and DVD player, umplayer
Latest GNOME 3 and Cinnamon merged, new edge package builds
***
Feedback/Questions
Remy writes in (http://slexy.org/view/s273oSezFs)
Jan writes in (http://slexy.org/view/s2I3H1HsVb)
Eddie writes in (http://slexy.org/view/s2wUTRowzU)
Zen writes in (http://slexy.org/view/s2RA0whmwz)
Sean writes in (http://slexy.org/view/s2pwE20Ov6)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, pxe, pxeboot, autoinstall, dru lavigne, documentation, sprints, handbook, printed, bsdcan, aslr, arm, desktop, linux, games, ports, stable, pkgsrc, aslr, security, pie, branch, ports, pkgng, freenas</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the big show we&#39;ll be showing off OpenBSD&#39;s new &quot;autoinstall&quot; feature to do completely automatic, unattended installations. We also have an interview with Dru Lavigne about all the writing work she does for FreeBSD, PCBSD and FreeNAS. The latest headlines and answers to your emails, on BSD Now - it&#39;s the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://0xfeedface.org/blog/lattera/2014-04-03/awesome-freebsd-aslr-progress" rel="nofollow">FreeBSD ASLR status update</a></h3>

<ul>
<li>Shawn Webb gives us a little update on his address space layout randomization work for FreeBSD</li>
<li>He&#39;s implemented execbase randomization for position-independent executables (which OpenBSD also just enabled globally in 5.5 on i386)</li>
<li>Work has also started on testing ASLR on ARM, using a Raspberry Pi</li>
<li>He&#39;s giving a presentation at BSDCan this year about his ASLR work</li>
<li>While we&#39;re on the topic of BSDCan...
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2014/04/bsdcan-tutorials-please-help-me-improve.html" rel="nofollow">BSDCan tutorials, improving the experience</a></h3>

<ul>
<li>Peter Hansteen writes a new blog post about his upcoming BSDCan tutorials</li>
<li>The tutorials are called &quot;Building the network you need with PF, the OpenBSD packet filter&quot; and &quot;Transitioning to OpenBSD 5.5&quot; - both scheduled to last three hours each</li>
<li>He&#39;s requesting anyone that&#39;ll be there to go ahead and contact him, telling him exactly what you&#39;d like to learn</li>
<li>There&#39;s also a bit of background information about the tutorials and how he&#39;s looking to improve them</li>
<li>If you&#39;re interested in OpenBSD and going to BSDCan this year, hit him up
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/netbsd-announce/2014/04/04/msg000202.html" rel="nofollow">pkgsrc-2014Q1 released</a></h3>

<ul>
<li>The new stable branch of pkgsrc packages has been built and is ready</li>
<li>Python 3.3 is now a &quot;first class citizen&quot; in pkgsrc</li>
<li>14255 packages for NetBSD-current/x86_64, 11233 binary packages built with clang for FreeBSD 10/x86_64</li>
<li>There&#39;s a new release every three months, and remember pkgsrc works on MANY operating systems, not just NetBSD - you could even use pkgsrc instead of pkgng or ports if you were so inclined</li>
<li>They&#39;re also looking into <a href="http://mail-index.netbsd.org/tech-pkg/2014/03/31/msg012873.html" rel="nofollow">signing packages</a>
***</li>
</ul>

<h3><a href="https://www.mail-archive.com/misc%40openbsd.org/index.html#127993" rel="nofollow">Only two holes in a heck of a long time, who cares?</a></h3>

<ul>
<li>A particularly vocal Debian user, a lost soul, somehow finds his way to the misc@ OpenBSD mailing list</li>
<li>He questions &quot;what&#39;s the big deal&quot; about OpenBSD&#39;s slogan being &quot;Only two remote holes in the default install, in a heck of a long time!&quot;</li>
<li>Luckily, the community and Theo <a href="https://www.mail-archive.com/misc%40openbsd.org/msg128001.html" rel="nofollow">set the record straight</a> about why you should care about this</li>
<li>Running insecure applications on OpenBSD is actually <strong>more</strong> secure than running them on other systems, due to things like ASLR, PIE and all the <a href="https://www.mail-archive.com/misc%40openbsd.org/msg127995.html" rel="nofollow">security features</a> of OpenBSD</li>
<li>It spawned a discussion about ease of management and Linux&#39;s poor security record, definitely <a href="https://www.mail-archive.com/misc%40openbsd.org/msg128073.html" rel="nofollow">worth reading</a>
***</li>
</ul>

<h2>Interview - Dru Lavigne - <a href="mailto:dru@freebsd.org" rel="nofollow">dru@freebsd.org</a> / <a href="https://twitter.com/bsdevents" rel="nofollow">@bsdevents</a></h2>

<p>FreeBSD&#39;s documentation printing, documentation springs, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/autoinstall" rel="nofollow">Automatic, unattended OpenBSD installs with PXE</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://doc.pfsense.org/index.php/2.1.1_New_Features_and_Changes" rel="nofollow">pfSense 2.1.1 released</a></h3>

<ul>
<li>A new version of pfSense is released, mainly to fix some security issues</li>
<li>Tracking some recent FreeBSD advisories, pfSense usually only applies the ones that would matter on a firewall or router</li>
<li>There are also some NIC driver updates <a href="https://blog.pfsense.org/?p=1238" rel="nofollow">and other things</a></li>
<li>Of course if you want to learn more about pfSense, watch <a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">episode 25</a></li>
<li>2.1.2 is already up for testing too
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=264095" rel="nofollow">FreeBSD gets UEFI support</a></h3>

<ul>
<li>It looks like FreeBSD&#39;s battle with UEFI may be coming to a close?</li>
<li>Ed Maste committed a giant list of patches to enable UEFI support on x86_64</li>
<li>Look through the list to see all the details and information</li>
<li>Thanks FreeBSD foundation!
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/kernel/2014-March/094909.html" rel="nofollow">Ideas for the next DragonflyBSD release</a></h3>

<ul>
<li>Mr. Dragonfly release engineer himself, <a href="http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug" rel="nofollow">Justin Sherrill</a> posts some of his ideas for the upcoming release</li>
<li>They&#39;re aiming for late May for the next version</li>
<li>Ideas include better support for running in a VM, pkgng fixes, documentation updates and PAM support</li>
<li>Gasp, they&#39;re even considering dropping i386
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/04/pc-bsd-weekly-feature-digest-24/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Lots of new PBI updates for 10.0, new runtime implementation</li>
<li>New support for running 32 bit applications in PBI runtime</li>
<li>New default CD and DVD player, umplayer</li>
<li>Latest GNOME 3 and Cinnamon merged, new edge package builds
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s273oSezFs" rel="nofollow">Remy writes in</a></li>
<li><a href="http://slexy.org/view/s2I3H1HsVb" rel="nofollow">Jan writes in</a></li>
<li><a href="http://slexy.org/view/s2wUTRowzU" rel="nofollow">Eddie writes in</a></li>
<li><a href="http://slexy.org/view/s2RA0whmwz" rel="nofollow">Zen writes in</a></li>
<li><a href="http://slexy.org/view/s2pwE20Ov6" rel="nofollow">Sean writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the big show we&#39;ll be showing off OpenBSD&#39;s new &quot;autoinstall&quot; feature to do completely automatic, unattended installations. We also have an interview with Dru Lavigne about all the writing work she does for FreeBSD, PCBSD and FreeNAS. The latest headlines and answers to your emails, on BSD Now - it&#39;s the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://0xfeedface.org/blog/lattera/2014-04-03/awesome-freebsd-aslr-progress" rel="nofollow">FreeBSD ASLR status update</a></h3>

<ul>
<li>Shawn Webb gives us a little update on his address space layout randomization work for FreeBSD</li>
<li>He&#39;s implemented execbase randomization for position-independent executables (which OpenBSD also just enabled globally in 5.5 on i386)</li>
<li>Work has also started on testing ASLR on ARM, using a Raspberry Pi</li>
<li>He&#39;s giving a presentation at BSDCan this year about his ASLR work</li>
<li>While we&#39;re on the topic of BSDCan...
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2014/04/bsdcan-tutorials-please-help-me-improve.html" rel="nofollow">BSDCan tutorials, improving the experience</a></h3>

<ul>
<li>Peter Hansteen writes a new blog post about his upcoming BSDCan tutorials</li>
<li>The tutorials are called &quot;Building the network you need with PF, the OpenBSD packet filter&quot; and &quot;Transitioning to OpenBSD 5.5&quot; - both scheduled to last three hours each</li>
<li>He&#39;s requesting anyone that&#39;ll be there to go ahead and contact him, telling him exactly what you&#39;d like to learn</li>
<li>There&#39;s also a bit of background information about the tutorials and how he&#39;s looking to improve them</li>
<li>If you&#39;re interested in OpenBSD and going to BSDCan this year, hit him up
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/netbsd-announce/2014/04/04/msg000202.html" rel="nofollow">pkgsrc-2014Q1 released</a></h3>

<ul>
<li>The new stable branch of pkgsrc packages has been built and is ready</li>
<li>Python 3.3 is now a &quot;first class citizen&quot; in pkgsrc</li>
<li>14255 packages for NetBSD-current/x86_64, 11233 binary packages built with clang for FreeBSD 10/x86_64</li>
<li>There&#39;s a new release every three months, and remember pkgsrc works on MANY operating systems, not just NetBSD - you could even use pkgsrc instead of pkgng or ports if you were so inclined</li>
<li>They&#39;re also looking into <a href="http://mail-index.netbsd.org/tech-pkg/2014/03/31/msg012873.html" rel="nofollow">signing packages</a>
***</li>
</ul>

<h3><a href="https://www.mail-archive.com/misc%40openbsd.org/index.html#127993" rel="nofollow">Only two holes in a heck of a long time, who cares?</a></h3>

<ul>
<li>A particularly vocal Debian user, a lost soul, somehow finds his way to the misc@ OpenBSD mailing list</li>
<li>He questions &quot;what&#39;s the big deal&quot; about OpenBSD&#39;s slogan being &quot;Only two remote holes in the default install, in a heck of a long time!&quot;</li>
<li>Luckily, the community and Theo <a href="https://www.mail-archive.com/misc%40openbsd.org/msg128001.html" rel="nofollow">set the record straight</a> about why you should care about this</li>
<li>Running insecure applications on OpenBSD is actually <strong>more</strong> secure than running them on other systems, due to things like ASLR, PIE and all the <a href="https://www.mail-archive.com/misc%40openbsd.org/msg127995.html" rel="nofollow">security features</a> of OpenBSD</li>
<li>It spawned a discussion about ease of management and Linux&#39;s poor security record, definitely <a href="https://www.mail-archive.com/misc%40openbsd.org/msg128073.html" rel="nofollow">worth reading</a>
***</li>
</ul>

<h2>Interview - Dru Lavigne - <a href="mailto:dru@freebsd.org" rel="nofollow">dru@freebsd.org</a> / <a href="https://twitter.com/bsdevents" rel="nofollow">@bsdevents</a></h2>

<p>FreeBSD&#39;s documentation printing, documentation springs, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/autoinstall" rel="nofollow">Automatic, unattended OpenBSD installs with PXE</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://doc.pfsense.org/index.php/2.1.1_New_Features_and_Changes" rel="nofollow">pfSense 2.1.1 released</a></h3>

<ul>
<li>A new version of pfSense is released, mainly to fix some security issues</li>
<li>Tracking some recent FreeBSD advisories, pfSense usually only applies the ones that would matter on a firewall or router</li>
<li>There are also some NIC driver updates <a href="https://blog.pfsense.org/?p=1238" rel="nofollow">and other things</a></li>
<li>Of course if you want to learn more about pfSense, watch <a href="http://www.bsdnow.tv/episodes/2014_02_19-a_sixth_pfsense" rel="nofollow">episode 25</a></li>
<li>2.1.2 is already up for testing too
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=264095" rel="nofollow">FreeBSD gets UEFI support</a></h3>

<ul>
<li>It looks like FreeBSD&#39;s battle with UEFI may be coming to a close?</li>
<li>Ed Maste committed a giant list of patches to enable UEFI support on x86_64</li>
<li>Look through the list to see all the details and information</li>
<li>Thanks FreeBSD foundation!
***</li>
</ul>

<h3><a href="http://lists.dragonflybsd.org/pipermail/kernel/2014-March/094909.html" rel="nofollow">Ideas for the next DragonflyBSD release</a></h3>

<ul>
<li>Mr. Dragonfly release engineer himself, <a href="http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug" rel="nofollow">Justin Sherrill</a> posts some of his ideas for the upcoming release</li>
<li>They&#39;re aiming for late May for the next version</li>
<li>Ideas include better support for running in a VM, pkgng fixes, documentation updates and PAM support</li>
<li>Gasp, they&#39;re even considering dropping i386
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/04/pc-bsd-weekly-feature-digest-24/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Lots of new PBI updates for 10.0, new runtime implementation</li>
<li>New support for running 32 bit applications in PBI runtime</li>
<li>New default CD and DVD player, umplayer</li>
<li>Latest GNOME 3 and Cinnamon merged, new edge package builds
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s273oSezFs" rel="nofollow">Remy writes in</a></li>
<li><a href="http://slexy.org/view/s2I3H1HsVb" rel="nofollow">Jan writes in</a></li>
<li><a href="http://slexy.org/view/s2wUTRowzU" rel="nofollow">Eddie writes in</a></li>
<li><a href="http://slexy.org/view/s2RA0whmwz" rel="nofollow">Zen writes in</a></li>
<li><a href="http://slexy.org/view/s2pwE20Ov6" rel="nofollow">Sean writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>31: Edgy BSD Users</title>
  <link>https://www.bsdnow.tv/31</link>
  <guid isPermaLink="false">00e67148-6432-475e-a473-fa50bef3a29d</guid>
  <pubDate>Tue, 01 Apr 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/00e67148-6432-475e-a473-fa50bef3a29d.mp3" length="49769716" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week we'll be talking to Richard Stallman about the upcoming GPLv4 and how it will protect our software from being stolen. After that, we'll show you how to recover from those pesky ZFS on Linux corruption issues, as well as some tips on how to explain to your boss that all the production boxes were compromised. Your questions and all the latest GNUs, on Linux Now - the place to Lin.. ux.</itunes:subtitle>
  <itunes:duration>1:09:07</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week we'll be talking to Richard Stallman about the upcoming GPLv4 and how it will protect our software from being stolen. After that, we'll show you how to recover from those pesky ZFS on Linux corruption issues, as well as some tips on how to explain to your boss that all the production boxes were compromised. Your questions and all the latest GNUs, on Linux Now - the place to Lin.. ux.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
Preorders for cool BSD stuff (http://www.amazon.com/gp/aw/d/0321968972/)
The 2nd edition of The Design and Implementation of the FreeBSD Operating System is up for preorder
We talked to GNN (http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates) briefly about it, but he and Kirk (http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache) have apparently finally finished the book
"For many years, The Design and Implementation of the FreeBSD Operating System has been recognized as the most complete, up-to-date, and authoritative technical guide to FreeBSD's internal structure. Now, this definitive guide has been extensively updated to reflect all major FreeBSD improvements between Versions 5 and Versions 11"
OpenBSD 5.5 preorders (https://https.openbsd.org/cgi-bin/order) are also up, so you can buy a CD set now
You can help support the project, and even get the -release of the OS before it's available publicly
5.5 is a huge release with lots of big changes, so now is the right time to purchase one of these - tell Austin we sent you!
***
pkgsrcCon 2014 CFP (http://mail-index.netbsd.org/pkgsrc-users/2014/03/18/msg019424.html)
This year's pkgsrcCon is in London, on June 21st and 22nd
There's a Call For Papers out now, so you can submit your talks
Anything related to pkgsrc is fine, it's pretty informal
Does anyone in the audience know if the talks will be recorded? This con is relatively unknown
***
BSDMag issue for March 2014 (http://bsdmag.org/magazine/1860-deploying-netbsd-on-the-cloud-using-aws-ec2-march-bsd-issue)
The monthly BSD magazine releases its newest issue
Topics this time include: deploying NetBSD using AWS EC2, creating a multi-purpose file server with NetBSD, DragonflyBSD as a backup server, more GIMP lessons, network analysis with wireshark and a general security article
The Linux article trend seems to continue... hmm
***
Non-ECC RAM in FreeNAS (http://blog.brianmoses.net/2014/03/why-i-chose-non-ecc-ram-for-my-freenas.html)
We've gotten a few questions about ECC RAM with ZFS
Here we've got a surprising blog post about why someone did not go with ECC RAM for his NAS build
The article mentions the benefits of ECC and admits it is a better choice in nearly all instances, but unfortunately it's not very widespread in consumer hardware motherboards and it's more expensive
Regular RAM also has "special" issues with ZFS and pool corruption
Long post, so check out the whole thing if you've been considering your memory options and weighing the benefits
***
Interview - Pierre Pronchery - khorben@edgebsd.org (mailto:khorben@edgebsd.org) / @khorben (https://twitter.com/khorben)
EdgeBSD (https://www.youtube.com/watch?v=_D_iaad5rPo) (slides (http://ftp.netbsd.org/pub/NetBSD/misc/khorben/asiabsdcon2014/))
Tutorial
Building an OpenBSD desktop (http://www.bsdnow.tv/tutorials/the-desktop-obsd)
News Roundup
Getting to know your portmgr-lurkers (http://blogs.freebsdish.org/portmgr/2014/03/25/getting-to-know-your-portmgr-lurker-frederic-culot)
This week we get to hear from Frederic Culot, colut@
Originally an OpenBSD user from France, Frederic joined as a ports committer in 2010 and recently joined the portmgr lurkers team
"FreeBSD is also one of my sources of inspiration when it comes to how
organizations behave and innovate, and I find it very interesting to compare FreeBSD with
the for-profit companies I work for"
We get to find out a little bit about him, why he loves FreeBSD and what he does for the project
***
NetBSD on the Playstation 2 (https://blog.netbsd.org/tnf/entry/the_playstation2_port_is_back)
Who doesn't want to run NetBSD on their old PS2?
The PS2 port of NetBSD was sadly removed in 2009, but it has been revived
It's using a slightly unusual MIPS CPU that didn't have much GCC support
Hopefully a bootable kernel will be available soon
***
The FreeBSD Challenge update (http://www.thelinuxcauldron.com/2014/03/24/freebsd-challenge-day-22-30/)
Our friend from the Linux Foundation continues his FreeBSD switching journey
This time he starts off by discovering virtual machines suck at keeping accurate time, and some ports weren't working because of his clock being way off
After polling the IRC for help, he finally learns the difference between ntpdate and ntpd and both of their use cases
Maybe he should've just read our NTP tutorial (http://www.bsdnow.tv/tutorials/ntpd)!
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-23/)
The mount tray icon got lots of updates and fixes
The faulty distribution server has finally been tracked down and... destroyed
New language localization project is in progress
Many many updates to ports and PBIs, new -STABLE builds
***
Feedback/Questions
Antonio writes in (http://slexy.org/view/s27d69qHJW)
Patrick writes in (http://slexy.org/view/s21FhLCHbB)
Chris writes in (http://slexy.org/view/s20Hisk3Yw)
Ron writes in (http://slexy.org/view/s20rBZyTLC)
Tyler writes in (http://slexy.org/view/s2s4CxE4gd)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, edgebsd, april fools, zfs, on linux, zpool, zol, zfsonlinux, gnu, linux, rms, richard stallman, gpl, copyright, copyleft, license, debian, centos, gentoo, ubuntu, arch, security, worst puns, desktop, gnome, xfce, gnome3, gnome-shell, ixsystems, ps2, mips, cpu, playstation 2, sony, edgebsd, fosdem, presentation, talk</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week we&#39;ll be talking to Richard Stallman about the upcoming GPLv4 and how it will protect our software from being stolen. After that, we&#39;ll show you how to recover from those pesky ZFS on Linux corruption issues, as well as some tips on how to explain to your boss that all the production boxes were compromised. Your questions and all the latest GNUs, on Linux Now - the place to Lin.. ux.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.amazon.com/gp/aw/d/0321968972/" rel="nofollow">Preorders for cool BSD stuff</a></h3>

<ul>
<li>The 2nd edition of The Design and Implementation of the FreeBSD Operating System is up for preorder</li>
<li>We <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">talked to GNN</a> briefly about it, but he and <a href="http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache" rel="nofollow">Kirk</a> have apparently finally finished the book</li>
<li>&quot;For many years, The Design and Implementation of the FreeBSD Operating System has been recognized as the most complete, up-to-date, and authoritative technical guide to FreeBSD&#39;s internal structure. Now, this definitive guide has been extensively updated to reflect all major FreeBSD improvements between Versions 5 and Versions 11&quot;</li>
<li><a href="https://https.openbsd.org/cgi-bin/order" rel="nofollow">OpenBSD 5.5 preorders</a> are also up, so you can buy a CD set now</li>
<li>You can help support the project, and even get the -release of the OS before it&#39;s available publicly</li>
<li>5.5 is a huge release with lots of big changes, so now is the right time to purchase one of these - tell Austin we sent you!
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/pkgsrc-users/2014/03/18/msg019424.html" rel="nofollow">pkgsrcCon 2014 CFP</a></h3>

<ul>
<li>This year&#39;s pkgsrcCon is in London, on June 21st and 22nd</li>
<li>There&#39;s a Call For Papers out now, so you can submit your talks</li>
<li>Anything related to pkgsrc is fine, it&#39;s pretty informal</li>
<li>Does anyone in the audience know if the talks will be recorded? This con is relatively unknown
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1860-deploying-netbsd-on-the-cloud-using-aws-ec2-march-bsd-issue" rel="nofollow">BSDMag issue for March 2014</a></h3>

<ul>
<li>The monthly BSD magazine releases its newest issue</li>
<li>Topics this time include: deploying NetBSD using AWS EC2, creating a multi-purpose file server with NetBSD, DragonflyBSD as a backup server, more GIMP lessons, network analysis with wireshark and a general security article</li>
<li>The Linux article trend seems to continue... hmm
***</li>
</ul>

<h3><a href="http://blog.brianmoses.net/2014/03/why-i-chose-non-ecc-ram-for-my-freenas.html" rel="nofollow">Non-ECC RAM in FreeNAS</a></h3>

<ul>
<li>We&#39;ve gotten a few questions about ECC RAM with ZFS</li>
<li>Here we&#39;ve got a surprising blog post about why someone <strong>did not</strong> go with ECC RAM for his NAS build</li>
<li>The article mentions the benefits of ECC and admits it is a better choice in nearly all instances, but unfortunately it&#39;s not very widespread in consumer hardware motherboards and it&#39;s more expensive</li>
<li>Regular RAM also has &quot;special&quot; issues with ZFS and pool corruption</li>
<li>Long post, so check out the whole thing if you&#39;ve been considering your memory options and weighing the benefits
***</li>
</ul>

<h2>Interview - Pierre Pronchery - <a href="mailto:khorben@edgebsd.org" rel="nofollow">khorben@edgebsd.org</a> / <a href="https://twitter.com/khorben" rel="nofollow">@khorben</a></h2>

<p><a href="https://www.youtube.com/watch?v=_D_iaad5rPo" rel="nofollow">EdgeBSD</a> (<a href="http://ftp.netbsd.org/pub/NetBSD/misc/khorben/asiabsdcon2014/" rel="nofollow">slides</a>)</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/the-desktop-obsd" rel="nofollow">Building an OpenBSD desktop</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/03/25/getting-to-know-your-portmgr-lurker-frederic-culot" rel="nofollow">Getting to know your portmgr-lurkers</a></h3>

<ul>
<li>This week we get to hear from Frederic Culot, colut@</li>
<li>Originally an OpenBSD user from France, Frederic joined as a ports committer in 2010 and recently joined the portmgr lurkers team</li>
<li>&quot;FreeBSD is also one of my sources of inspiration when it comes to how
organizations behave and innovate, and I find it very interesting to compare FreeBSD with
the for-profit companies I work for&quot;</li>
<li>We get to find out a little bit about him, why he loves FreeBSD and what he does for the project
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/the_playstation2_port_is_back" rel="nofollow">NetBSD on the Playstation 2</a></h3>

<ul>
<li>Who doesn&#39;t want to run NetBSD on their old PS2?</li>
<li>The PS2 port of NetBSD was sadly removed in 2009, but it has been revived</li>
<li>It&#39;s using a slightly unusual MIPS CPU that didn&#39;t have much GCC support</li>
<li>Hopefully a bootable kernel will be available soon
***</li>
</ul>

<h3><a href="http://www.thelinuxcauldron.com/2014/03/24/freebsd-challenge-day-22-30/" rel="nofollow">The FreeBSD Challenge update</a></h3>

<ul>
<li>Our friend from the Linux Foundation continues his FreeBSD switching journey</li>
<li>This time he starts off by discovering virtual machines suck at keeping accurate time, and some ports weren&#39;t working because of his clock being way off</li>
<li>After polling the IRC for help, he finally learns the difference between ntpdate and ntpd and both of their use cases</li>
<li>Maybe he should&#39;ve just read our <a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">NTP tutorial</a>!
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-23/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>The mount tray icon got lots of updates and fixes</li>
<li>The faulty distribution server has finally been tracked down and... destroyed</li>
<li>New language localization project is in progress</li>
<li>Many many updates to ports and PBIs, new -STABLE builds
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s27d69qHJW" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s21FhLCHbB" rel="nofollow">Patrick writes in</a></li>
<li><a href="http://slexy.org/view/s20Hisk3Yw" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s20rBZyTLC" rel="nofollow">Ron writes in</a></li>
<li><a href="http://slexy.org/view/s2s4CxE4gd" rel="nofollow">Tyler writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week we&#39;ll be talking to Richard Stallman about the upcoming GPLv4 and how it will protect our software from being stolen. After that, we&#39;ll show you how to recover from those pesky ZFS on Linux corruption issues, as well as some tips on how to explain to your boss that all the production boxes were compromised. Your questions and all the latest GNUs, on Linux Now - the place to Lin.. ux.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.amazon.com/gp/aw/d/0321968972/" rel="nofollow">Preorders for cool BSD stuff</a></h3>

<ul>
<li>The 2nd edition of The Design and Implementation of the FreeBSD Operating System is up for preorder</li>
<li>We <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">talked to GNN</a> briefly about it, but he and <a href="http://www.bsdnow.tv/episodes/2013-10-02_stacks_of_cache" rel="nofollow">Kirk</a> have apparently finally finished the book</li>
<li>&quot;For many years, The Design and Implementation of the FreeBSD Operating System has been recognized as the most complete, up-to-date, and authoritative technical guide to FreeBSD&#39;s internal structure. Now, this definitive guide has been extensively updated to reflect all major FreeBSD improvements between Versions 5 and Versions 11&quot;</li>
<li><a href="https://https.openbsd.org/cgi-bin/order" rel="nofollow">OpenBSD 5.5 preorders</a> are also up, so you can buy a CD set now</li>
<li>You can help support the project, and even get the -release of the OS before it&#39;s available publicly</li>
<li>5.5 is a huge release with lots of big changes, so now is the right time to purchase one of these - tell Austin we sent you!
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/pkgsrc-users/2014/03/18/msg019424.html" rel="nofollow">pkgsrcCon 2014 CFP</a></h3>

<ul>
<li>This year&#39;s pkgsrcCon is in London, on June 21st and 22nd</li>
<li>There&#39;s a Call For Papers out now, so you can submit your talks</li>
<li>Anything related to pkgsrc is fine, it&#39;s pretty informal</li>
<li>Does anyone in the audience know if the talks will be recorded? This con is relatively unknown
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1860-deploying-netbsd-on-the-cloud-using-aws-ec2-march-bsd-issue" rel="nofollow">BSDMag issue for March 2014</a></h3>

<ul>
<li>The monthly BSD magazine releases its newest issue</li>
<li>Topics this time include: deploying NetBSD using AWS EC2, creating a multi-purpose file server with NetBSD, DragonflyBSD as a backup server, more GIMP lessons, network analysis with wireshark and a general security article</li>
<li>The Linux article trend seems to continue... hmm
***</li>
</ul>

<h3><a href="http://blog.brianmoses.net/2014/03/why-i-chose-non-ecc-ram-for-my-freenas.html" rel="nofollow">Non-ECC RAM in FreeNAS</a></h3>

<ul>
<li>We&#39;ve gotten a few questions about ECC RAM with ZFS</li>
<li>Here we&#39;ve got a surprising blog post about why someone <strong>did not</strong> go with ECC RAM for his NAS build</li>
<li>The article mentions the benefits of ECC and admits it is a better choice in nearly all instances, but unfortunately it&#39;s not very widespread in consumer hardware motherboards and it&#39;s more expensive</li>
<li>Regular RAM also has &quot;special&quot; issues with ZFS and pool corruption</li>
<li>Long post, so check out the whole thing if you&#39;ve been considering your memory options and weighing the benefits
***</li>
</ul>

<h2>Interview - Pierre Pronchery - <a href="mailto:khorben@edgebsd.org" rel="nofollow">khorben@edgebsd.org</a> / <a href="https://twitter.com/khorben" rel="nofollow">@khorben</a></h2>

<p><a href="https://www.youtube.com/watch?v=_D_iaad5rPo" rel="nofollow">EdgeBSD</a> (<a href="http://ftp.netbsd.org/pub/NetBSD/misc/khorben/asiabsdcon2014/" rel="nofollow">slides</a>)</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/the-desktop-obsd" rel="nofollow">Building an OpenBSD desktop</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/03/25/getting-to-know-your-portmgr-lurker-frederic-culot" rel="nofollow">Getting to know your portmgr-lurkers</a></h3>

<ul>
<li>This week we get to hear from Frederic Culot, colut@</li>
<li>Originally an OpenBSD user from France, Frederic joined as a ports committer in 2010 and recently joined the portmgr lurkers team</li>
<li>&quot;FreeBSD is also one of my sources of inspiration when it comes to how
organizations behave and innovate, and I find it very interesting to compare FreeBSD with
the for-profit companies I work for&quot;</li>
<li>We get to find out a little bit about him, why he loves FreeBSD and what he does for the project
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/the_playstation2_port_is_back" rel="nofollow">NetBSD on the Playstation 2</a></h3>

<ul>
<li>Who doesn&#39;t want to run NetBSD on their old PS2?</li>
<li>The PS2 port of NetBSD was sadly removed in 2009, but it has been revived</li>
<li>It&#39;s using a slightly unusual MIPS CPU that didn&#39;t have much GCC support</li>
<li>Hopefully a bootable kernel will be available soon
***</li>
</ul>

<h3><a href="http://www.thelinuxcauldron.com/2014/03/24/freebsd-challenge-day-22-30/" rel="nofollow">The FreeBSD Challenge update</a></h3>

<ul>
<li>Our friend from the Linux Foundation continues his FreeBSD switching journey</li>
<li>This time he starts off by discovering virtual machines suck at keeping accurate time, and some ports weren&#39;t working because of his clock being way off</li>
<li>After polling the IRC for help, he finally learns the difference between ntpdate and ntpd and both of their use cases</li>
<li>Maybe he should&#39;ve just read our <a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">NTP tutorial</a>!
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-23/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>The mount tray icon got lots of updates and fixes</li>
<li>The faulty distribution server has finally been tracked down and... destroyed</li>
<li>New language localization project is in progress</li>
<li>Many many updates to ports and PBIs, new -STABLE builds
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s27d69qHJW" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s21FhLCHbB" rel="nofollow">Patrick writes in</a></li>
<li><a href="http://slexy.org/view/s20Hisk3Yw" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s20rBZyTLC" rel="nofollow">Ron writes in</a></li>
<li><a href="http://slexy.org/view/s2s4CxE4gd" rel="nofollow">Tyler writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>30: Documentation is King</title>
  <link>https://www.bsdnow.tv/30</link>
  <guid isPermaLink="false">ab836072-6c9b-4d13-9011-8d9ddf4294e7</guid>
  <pubDate>Wed, 26 Mar 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ab836072-6c9b-4d13-9011-8d9ddf4294e7.mp3" length="59694113" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Finally hit 30 episodes! Today we'll be chatting with Warren Block to discuss BSD documentation efforts and future plans. If you've ever wondered about the scary world of mailing lists, today's tutorial will show you the basics of how to get help and contribute back. There's lots to get to today, so sit back and enjoy some BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:22:54</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Finally hit 30 episodes! Today we'll be chatting with Warren Block to discuss BSD documentation efforts and future plans. If you've ever wondered about the scary world of mailing lists, today's tutorial will show you the basics of how to get help and contribute back. There's lots to get to today, so sit back and enjoy some BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
OpenBSD on a Sun T5120 (http://www.tedunangst.com/flak/post/OpenBSD-on-a-Sun-T5120)
Our buddy Ted Unangst (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures) got himself a cool Sun box
Of course he had to write a post about installing and running OpenBSD on it
The post goes through some of the quirks and steps to go through in case you're interested in one of these fine SPARC machines
He's also got another post about OpenBSD on a Dell CS24-SC server (http://www.tedunangst.com/flak/post/Dell-CS24-SC-server)
***
Bhyvecon 2014 videos are up (https://www.youtube.com/results?search_query=bhyvecon%20tokyo&amp;amp;sm=3)
Like we mentioned last week, Bhyvecon (http://bhyvecon.org/) was an almost-impromptu conference before AsiaBSDCon
The talks have apparently already been uploaded!
Subjects include Bhyve's past, present and future, OSv on Bhyve, a general introduction to the tool, migrating those last few pesky Linux boxes to virtualization
Lots more detail in the videos, so check 'em all out
***
Building a FreeBSD wireless access point (http://blog.khubla.com/freebsd/building-my-own-wireless-point)
We've got a new blog post about creating a wireless access point with FreeBSD
After all the recent news of consumer routers being pwned like candy, it's time for people to start building BSD routers (http://www.bsdnow.tv/tutorials/openbsd-router)
The author goes through a lot of the process of getting one set up using good ol' FreeBSD
Using hostapd, he's able to share his wireless card in hostap mode and offer DHCP to all the clients
Plenty of config files and more messy details in the post
***
Switching from Synology to FreeNAS (http://www.notquitemainstream.com/2014/03/15/why-im-switching-from-synology-to-freenas/)
The author has been considering getting a NAS for quite a while and documents his research
He was faced with the compromise of convenience vs. flexibility - prebuilt or DIY
After seeing the potential security issues with proprietary NAS devices, and dealing with frustration with trying to get bugs fixed, he makes the right choice
The post also goes into some detail about his setup, all the things he needed a NAS to do as well as all the advantages an open source solution would give
***
Interview - Warren Block - wblock@freebsd.org (mailto:wblock@freebsd.org)
FreeBSD's documentation project, igor, doceng
Tutorial
The world of BSD mailing lists (http://www.bsdnow.tv/tutorials/mailing-lists)
News Roundup
HAMMER2 work and notes (http://www.shiningsilence.com/dbsdlog/2014/03/18/13651.html)
Matthew Dillon has posted some updated notes about the development of the new HAMMER version
The start of a cluster API was committed to the tree
There are also links to design document, a freemap design document, a changes list and a todo list
***
BSD Breaking Barriers (https://www.youtube.com/watch?v=buo5JlMnGPI)
Our friend MWL (http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop) gave a talk at NYCBSDCon about BSD "breaking barriers"
"What makes the BSD operating systems special? Why should you deploy your applications on BSD? Why does the BSD community keep growing, and why do Linux sites like DistroWatch say that BSD is where the interesting development work is happening? We'll cover the not-so-obvious reasons why BSD still stands tall after almost 40 years."
He also has another upcoming talk, (or "webcast") called "Beyond Security: Getting to Know OpenBSD's Real Purpose (http://oreillynet.com/pub/e/3059)"
"OpenBSD is frequently billed as a high-security operating system. That's true, but security isn't the OpenBSD Project's main goal. This webcast will introduce systems administrators to OpenBSD, explain the project's mission, and discuss the features and benefits."
It's on May 27th and will hopefully be recorded
***
FreeBSD in a chroot (http://dreamcat4.github.io/finch/)
Finch, "FreeBSD running IN a CHroot," is a new project
It's a way to extend the functionality of restricted USB-based FreeBSD systems (FreeNAS, etc.)
All the details and some interesting use cases are on the github page
He really needs to change the project name (https://www.freshports.org/net-im/finch) though
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-22/)
Lots of bugfixes for PCBSD coming down the tubes
LZ4 compression is now enabled by default on the whole pool
The latest 10-STABLE has been imported and builds are going
Also the latest GNOME and Cinnamon builds have been imported and much more
***
Feedback/Questions
Bostjan writes in (http://slexy.org/view/s20SlvTcwd) (IRC suggests md5deep)
Don writes in (http://slexy.org/view/s2PeMqXFid)
kaltheat writes in (http://slexy.org/view/s21yii6KZe) (We use R0DE Podcast microphones and Logitech C920 HD webcams)
Harri writes in (http://slexy.org/view/s21SkX19Cp)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, rtfm, mailing lists, lists, documentation, doceng, igor, man pages, manpages, wireless, access point, wap, router, pfsense, sun, t5120, dell, cs24-c, server, bhyve, bhyvecon, asiabsdcon, 2014, synology, freenas, ixsystems, megaport, foundation, rack, datacenter, mail, hammer, hammer2, hammerfs, fs, filesystem, rump kernels</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Finally hit 30 episodes! Today we&#39;ll be chatting with Warren Block to discuss BSD documentation efforts and future plans. If you&#39;ve ever wondered about the scary world of mailing lists, today&#39;s tutorial will show you the basics of how to get help and contribute back. There&#39;s lots to get to today, so sit back and enjoy some BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/OpenBSD-on-a-Sun-T5120" rel="nofollow">OpenBSD on a Sun T5120</a></h3>

<ul>
<li>Our buddy <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> got himself a cool Sun box</li>
<li>Of course he had to write a post about installing and running OpenBSD on it</li>
<li>The post goes through some of the quirks and steps to go through in case you&#39;re interested in one of these fine SPARC machines</li>
<li>He&#39;s also got another post about OpenBSD on a <a href="http://www.tedunangst.com/flak/post/Dell-CS24-SC-server" rel="nofollow">Dell CS24-SC server</a>
***</li>
</ul>

<h3><a href="https://www.youtube.com/results?search_query=bhyvecon%20tokyo&sm=3" rel="nofollow">Bhyvecon 2014 videos are up</a></h3>

<ul>
<li>Like we mentioned last week, <a href="http://bhyvecon.org/" rel="nofollow">Bhyvecon</a> was an almost-impromptu conference before AsiaBSDCon</li>
<li>The talks have apparently already been uploaded!</li>
<li>Subjects include Bhyve&#39;s past, present and future, OSv on Bhyve, a general introduction to the tool, migrating those last few pesky Linux boxes to virtualization</li>
<li>Lots more detail in the videos, so check &#39;em all out
***</li>
</ul>

<h3><a href="http://blog.khubla.com/freebsd/building-my-own-wireless-point" rel="nofollow">Building a FreeBSD wireless access point</a></h3>

<ul>
<li>We&#39;ve got a new blog post about creating a wireless access point with FreeBSD</li>
<li>After all the recent news of consumer routers being pwned like candy, it&#39;s time for people to start building <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">BSD routers</a></li>
<li>The author goes through a lot of the process of getting one set up using good ol&#39; FreeBSD</li>
<li>Using hostapd, he&#39;s able to share his wireless card in hostap mode and offer DHCP to all the clients</li>
<li>Plenty of config files and more messy details in the post
***</li>
</ul>

<h3><a href="http://www.notquitemainstream.com/2014/03/15/why-im-switching-from-synology-to-freenas/" rel="nofollow">Switching from Synology to FreeNAS</a></h3>

<ul>
<li>The author has been considering getting a NAS for quite a while and documents his research</li>
<li>He was faced with the compromise of convenience vs. flexibility - prebuilt or DIY</li>
<li>After seeing the potential security issues with proprietary NAS devices, and dealing with frustration with trying to get bugs fixed, he makes the right choice</li>
<li>The post also goes into some detail about his setup, all the things he needed a NAS to do as well as all the advantages an open source solution would give
***</li>
</ul>

<h2>Interview - Warren Block - <a href="mailto:wblock@freebsd.org" rel="nofollow">wblock@freebsd.org</a></h2>

<p>FreeBSD&#39;s documentation project, igor, doceng</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/mailing-lists" rel="nofollow">The world of BSD mailing lists</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2014/03/18/13651.html" rel="nofollow">HAMMER2 work and notes</a></h3>

<ul>
<li>Matthew Dillon has posted some updated notes about the development of the new HAMMER version</li>
<li>The start of a cluster API was committed to the tree</li>
<li>There are also links to design document, a freemap design document, a changes list and a todo list
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=buo5JlMnGPI" rel="nofollow">BSD Breaking Barriers</a></h3>

<ul>
<li>Our friend <a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">MWL</a> gave a talk at NYCBSDCon about BSD &quot;breaking barriers&quot;</li>
<li>&quot;What makes the BSD operating systems special? Why should you deploy your applications on BSD? Why does the BSD community keep growing, and why do Linux sites like DistroWatch say that BSD is where the interesting development work is happening? We&#39;ll cover the not-so-obvious reasons why BSD still stands tall after almost 40 years.&quot;</li>
<li>He also has another upcoming talk, (or &quot;webcast&quot;) called &quot;<a href="http://oreillynet.com/pub/e/3059" rel="nofollow">Beyond Security: Getting to Know OpenBSD&#39;s Real Purpose</a>&quot;</li>
<li>&quot;OpenBSD is frequently billed as a high-security operating system. That&#39;s true, but security isn&#39;t the OpenBSD Project&#39;s main goal. This webcast will introduce systems administrators to OpenBSD, explain the project&#39;s mission, and discuss the features and benefits.&quot;</li>
<li>It&#39;s on May 27th and will hopefully be recorded
***</li>
</ul>

<h3><a href="http://dreamcat4.github.io/finch/" rel="nofollow">FreeBSD in a chroot</a></h3>

<ul>
<li>Finch, &quot;FreeBSD running IN a CHroot,&quot; is a new project</li>
<li>It&#39;s a way to extend the functionality of restricted USB-based FreeBSD systems (FreeNAS, etc.)</li>
<li>All the details and some interesting use cases are on the github page</li>
<li>He really needs to <a href="https://www.freshports.org/net-im/finch" rel="nofollow">change the project name</a> though
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-22/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Lots of bugfixes for PCBSD coming down the tubes</li>
<li>LZ4 compression is now enabled by default on the whole pool</li>
<li>The latest 10-STABLE has been imported and builds are going</li>
<li>Also the latest GNOME and Cinnamon builds have been imported and much more
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20SlvTcwd" rel="nofollow">Bostjan writes in</a> (IRC suggests md5deep)</li>
<li><a href="http://slexy.org/view/s2PeMqXFid" rel="nofollow">Don writes in</a></li>
<li><a href="http://slexy.org/view/s21yii6KZe" rel="nofollow">kaltheat writes in</a> (We use R0DE Podcast microphones and Logitech C920 HD webcams)</li>
<li><a href="http://slexy.org/view/s21SkX19Cp" rel="nofollow">Harri writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Finally hit 30 episodes! Today we&#39;ll be chatting with Warren Block to discuss BSD documentation efforts and future plans. If you&#39;ve ever wondered about the scary world of mailing lists, today&#39;s tutorial will show you the basics of how to get help and contribute back. There&#39;s lots to get to today, so sit back and enjoy some BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.tedunangst.com/flak/post/OpenBSD-on-a-Sun-T5120" rel="nofollow">OpenBSD on a Sun T5120</a></h3>

<ul>
<li>Our buddy <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a> got himself a cool Sun box</li>
<li>Of course he had to write a post about installing and running OpenBSD on it</li>
<li>The post goes through some of the quirks and steps to go through in case you&#39;re interested in one of these fine SPARC machines</li>
<li>He&#39;s also got another post about OpenBSD on a <a href="http://www.tedunangst.com/flak/post/Dell-CS24-SC-server" rel="nofollow">Dell CS24-SC server</a>
***</li>
</ul>

<h3><a href="https://www.youtube.com/results?search_query=bhyvecon%20tokyo&sm=3" rel="nofollow">Bhyvecon 2014 videos are up</a></h3>

<ul>
<li>Like we mentioned last week, <a href="http://bhyvecon.org/" rel="nofollow">Bhyvecon</a> was an almost-impromptu conference before AsiaBSDCon</li>
<li>The talks have apparently already been uploaded!</li>
<li>Subjects include Bhyve&#39;s past, present and future, OSv on Bhyve, a general introduction to the tool, migrating those last few pesky Linux boxes to virtualization</li>
<li>Lots more detail in the videos, so check &#39;em all out
***</li>
</ul>

<h3><a href="http://blog.khubla.com/freebsd/building-my-own-wireless-point" rel="nofollow">Building a FreeBSD wireless access point</a></h3>

<ul>
<li>We&#39;ve got a new blog post about creating a wireless access point with FreeBSD</li>
<li>After all the recent news of consumer routers being pwned like candy, it&#39;s time for people to start building <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">BSD routers</a></li>
<li>The author goes through a lot of the process of getting one set up using good ol&#39; FreeBSD</li>
<li>Using hostapd, he&#39;s able to share his wireless card in hostap mode and offer DHCP to all the clients</li>
<li>Plenty of config files and more messy details in the post
***</li>
</ul>

<h3><a href="http://www.notquitemainstream.com/2014/03/15/why-im-switching-from-synology-to-freenas/" rel="nofollow">Switching from Synology to FreeNAS</a></h3>

<ul>
<li>The author has been considering getting a NAS for quite a while and documents his research</li>
<li>He was faced with the compromise of convenience vs. flexibility - prebuilt or DIY</li>
<li>After seeing the potential security issues with proprietary NAS devices, and dealing with frustration with trying to get bugs fixed, he makes the right choice</li>
<li>The post also goes into some detail about his setup, all the things he needed a NAS to do as well as all the advantages an open source solution would give
***</li>
</ul>

<h2>Interview - Warren Block - <a href="mailto:wblock@freebsd.org" rel="nofollow">wblock@freebsd.org</a></h2>

<p>FreeBSD&#39;s documentation project, igor, doceng</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/mailing-lists" rel="nofollow">The world of BSD mailing lists</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2014/03/18/13651.html" rel="nofollow">HAMMER2 work and notes</a></h3>

<ul>
<li>Matthew Dillon has posted some updated notes about the development of the new HAMMER version</li>
<li>The start of a cluster API was committed to the tree</li>
<li>There are also links to design document, a freemap design document, a changes list and a todo list
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?v=buo5JlMnGPI" rel="nofollow">BSD Breaking Barriers</a></h3>

<ul>
<li>Our friend <a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">MWL</a> gave a talk at NYCBSDCon about BSD &quot;breaking barriers&quot;</li>
<li>&quot;What makes the BSD operating systems special? Why should you deploy your applications on BSD? Why does the BSD community keep growing, and why do Linux sites like DistroWatch say that BSD is where the interesting development work is happening? We&#39;ll cover the not-so-obvious reasons why BSD still stands tall after almost 40 years.&quot;</li>
<li>He also has another upcoming talk, (or &quot;webcast&quot;) called &quot;<a href="http://oreillynet.com/pub/e/3059" rel="nofollow">Beyond Security: Getting to Know OpenBSD&#39;s Real Purpose</a>&quot;</li>
<li>&quot;OpenBSD is frequently billed as a high-security operating system. That&#39;s true, but security isn&#39;t the OpenBSD Project&#39;s main goal. This webcast will introduce systems administrators to OpenBSD, explain the project&#39;s mission, and discuss the features and benefits.&quot;</li>
<li>It&#39;s on May 27th and will hopefully be recorded
***</li>
</ul>

<h3><a href="http://dreamcat4.github.io/finch/" rel="nofollow">FreeBSD in a chroot</a></h3>

<ul>
<li>Finch, &quot;FreeBSD running IN a CHroot,&quot; is a new project</li>
<li>It&#39;s a way to extend the functionality of restricted USB-based FreeBSD systems (FreeNAS, etc.)</li>
<li>All the details and some interesting use cases are on the github page</li>
<li>He really needs to <a href="https://www.freshports.org/net-im/finch" rel="nofollow">change the project name</a> though
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-22/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Lots of bugfixes for PCBSD coming down the tubes</li>
<li>LZ4 compression is now enabled by default on the whole pool</li>
<li>The latest 10-STABLE has been imported and builds are going</li>
<li>Also the latest GNOME and Cinnamon builds have been imported and much more
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20SlvTcwd" rel="nofollow">Bostjan writes in</a> (IRC suggests md5deep)</li>
<li><a href="http://slexy.org/view/s2PeMqXFid" rel="nofollow">Don writes in</a></li>
<li><a href="http://slexy.org/view/s21yii6KZe" rel="nofollow">kaltheat writes in</a> (We use R0DE Podcast microphones and Logitech C920 HD webcams)</li>
<li><a href="http://slexy.org/view/s21SkX19Cp" rel="nofollow">Harri writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>29: P.E.F.S.</title>
  <link>https://www.bsdnow.tv/29</link>
  <guid isPermaLink="false">4af36dea-3dd3-4ac1-9ee9-a2e34dd54e3a</guid>
  <pubDate>Wed, 19 Mar 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4af36dea-3dd3-4ac1-9ee9-a2e34dd54e3a.mp3" length="82610606" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We're back from AsiaBSDCon! This week we'll be chatting with Gleb Kurtsou about some a filesystem-level encryption utility called PEFS. After that, we'll give you a step by step guide on how to actually use it. There's also the usual round of your questions and we've got a lot of news to catch up on, so stay tuned to BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:54:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We're back from AsiaBSDCon! This week we'll be chatting with Gleb Kurtsou about some a filesystem-level encryption utility called PEFS. After that, we'll give you a step by step guide on how to actually use it. There's also the usual round of your questions and we've got a lot of news to catch up on, so stay tuned to BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
Using OpenSSH Certificate Authentication (http://neocri.me/documentation/using-ssh-certificate-authentication/)
SSH has a not-so-often-talked-about authentication option in addition to passwords and keys: certificates - you can add certificates to any current authentication method you're using
They're not really that complex, there just isn't a lot of documentation on how to use them - this post tries to solve that
There's the benefit of not needing a knownhosts file or authorizedusers file anymore
The post goes into a fair amount of detail about the differences, advantages and implications of using certificates for authentication
***
Back to FreeBSD, a new series (http://www.duckland.org/2014/03/back-to-freebsd-aka-day-1#more)
Similar to the "FreeBSD Challenge" blog series, one of our listeners will be writing about his switching BACK to FreeBSD journey
"So, a long time ago, I had a box which was running FreeBSD 4, running on a Pentium. 14 years later, I have decided to get back into FreeBSD, now at FreeBSD 10"
He's starting off with PCBSD since it's easy to get working with dual graphics
Should be a fun series to follow!
***
OpenBSD's recent experiments in package building (http://undeadly.org/cgi?action=article&amp;amp;sid=20140307130554)
If you'll remember back to our poudriere tutorial (http://www.bsdnow.tv/tutorials/poudriere), it lets you build FreeBSD binary packages in bulk - OpenBSD's version is called dpb (http://www.bsdnow.tv/tutorials/dpb)
Marc Espie recently got some monster machines in russia to play with to help improve scaling of dpb on high end hardware
This article goes through some of his findings and plans for future versions that increase performance
We'll be showing a tutorial of dpb on the show in a few weeks
***
Securing FreeBSD with 2FA (http://jafdip.com/securing-freebsd-2fa-two-factor-authentication/)
So maybe you've set up two-factor authentication with gmail or twitter, but have you done it with your BSD box?
This post walks us through the process of locking down an ssh server (http://www.bsdnow.tv/tutorials/ssh-tmux) with 2FA
With just a mobile phone and a few extra tools, you can enable two-factor auth on your BSD box and have just that little extra bit of protections
***
Interview - Gleb Kurtsou - gleb.kurtsou@gmail.com (mailto:gleb.kurtsou@gmail.com)
PEFS (security audit results here (https://defuse.ca/audits/pefs.htm))
Tutorial
Filesystem-based encryption with PEFS (http://www.bsdnow.tv/tutorials/pefs)
News Roundup
BSDCan 2014 registration (https://www.bsdcan.org/2014/registration.php)
Registration is finally open!
The prices are available along with a full list of presentations
Tutorial sessions for various topics as well
You have to go
***
Big changes for OpenBSD 5.6 (http://undeadly.org/cgi?action=article&amp;amp;sid=20140314080734)
Although 5.5 was just frozen and the release process has started, 5.6 is already looking promising
OpenBSD has, for a long time, included a heavily-patched version of Apache based on 1.3
They've also imported nginx into base a few years ago, but now have finally removed Apache
Sendmail is also no longer the default MTA, OpenSMTPD is the new default (http://undeadly.org/cgi?action=article&amp;amp;sid=20140313052817)
Will BIND be removed next? Maybe so (http://marc.info/?l=openbsd-cvs&amp;amp;m=139492163427518&amp;amp;w=2)
They've also discontinued the hp300, mvme68k and mvme88k ports
***
Getting to know your portmgr lurkers (http://blogs.freebsdish.org/portmgr/2014/03/11/getting-to-know-your-portmgr-lurker-alexy-dokuchaev/)
The "getting to know your portmgr" series makes its return
This time we get to talk with danfe@ (probably most known for being the nVidia driver maintainer, but he does a lot with ports)
How he got into FreeBSD? He "wanted a unix system that I could understand and that would not get bloated as time goes by"
Mentions why he's still heavily involved with the project and lots more
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-20/)
Work has started to port Pulseaudio to PCBSD 10.0.1
There's a new "pc-mixer" utility being worked on for sound management as well
New PBIs, GNOME/Mate updates, Life Preserver fixes and a lot more
PCBSD 10.0.1 was released (http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-21-pcbsd-10-0-1-released/) too
***
Feedback/Questions
Alex writes in (http://slexy.org/view/s2QwjHkL2n)
Ben writes in (http://slexy.org/view/s2wLGlHF15)
Nick writes in (http://slexy.org/view/s21JsgRjMU)
Sami writes in (http://slexy.org/view/s2UX4sYdHy)
Christopher writes in (http://slexy.org/view/s26z60Qd6z)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, encryption, pefs, fde, disk, asiabsdcon, 2014, asiabsdcon2014, presentation, talk, video, recording, openssh, certificate, authentication, dpb, two factor, 2fa, yubikey</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;re back from AsiaBSDCon! This week we&#39;ll be chatting with Gleb Kurtsou about some a filesystem-level encryption utility called PEFS. After that, we&#39;ll give you a step by step guide on how to actually use it. There&#39;s also the usual round of your questions and we&#39;ve got a lot of news to catch up on, so stay tuned to BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://neocri.me/documentation/using-ssh-certificate-authentication/" rel="nofollow">Using OpenSSH Certificate Authentication</a></h3>

<ul>
<li>SSH has a not-so-often-talked-about authentication option in addition to passwords and keys: certificates - you can add certificates to any current authentication method you&#39;re using</li>
<li>They&#39;re not really that complex, there just isn&#39;t a lot of documentation on how to use them - this post tries to solve that</li>
<li>There&#39;s the benefit of not needing a known_hosts file or authorized_users file anymore</li>
<li>The post goes into a fair amount of detail about the differences, advantages and implications of using certificates for authentication
***</li>
</ul>

<h3><a href="http://www.duckland.org/2014/03/back-to-freebsd-aka-day-1#more" rel="nofollow">Back to FreeBSD, a new series</a></h3>

<ul>
<li>Similar to the &quot;FreeBSD Challenge&quot; blog series, one of our listeners will be writing about his switching BACK to FreeBSD journey</li>
<li>&quot;So, a long time ago, I had a box which was running FreeBSD 4, running on a Pentium. 14 years later, I have decided to get back into FreeBSD, now at FreeBSD 10&quot;</li>
<li>He&#39;s starting off with PCBSD since it&#39;s easy to get working with dual graphics</li>
<li>Should be a fun series to follow!
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140307130554" rel="nofollow">OpenBSD&#39;s recent experiments in package building</a></h3>

<ul>
<li>If you&#39;ll remember back to our <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere tutorial</a>, it lets you build FreeBSD binary packages in bulk - OpenBSD&#39;s version is called <a href="http://www.bsdnow.tv/tutorials/dpb" rel="nofollow">dpb</a></li>
<li>Marc Espie recently got some monster machines in russia to play with to help improve scaling of dpb on high end hardware</li>
<li>This article goes through some of his findings and plans for future versions that increase performance</li>
<li>We&#39;ll be showing a tutorial of dpb on the show in a few weeks
***</li>
</ul>

<h3><a href="http://jafdip.com/securing-freebsd-2fa-two-factor-authentication/" rel="nofollow">Securing FreeBSD with 2FA</a></h3>

<ul>
<li>So maybe you&#39;ve set up two-factor authentication with gmail or twitter, but have you done it with your BSD box?</li>
<li>This post walks us through the process of locking down an <a href="http://www.bsdnow.tv/tutorials/ssh-tmux" rel="nofollow">ssh server</a> with 2FA</li>
<li>With just a mobile phone and a few extra tools, you can enable two-factor auth on your BSD box and have just that little extra bit of protections
***</li>
</ul>

<h2>Interview - Gleb Kurtsou - <a href="mailto:gleb.kurtsou@gmail.com" rel="nofollow">gleb.kurtsou@gmail.com</a></h2>

<p>PEFS (security audit results <a href="https://defuse.ca/audits/pefs.htm" rel="nofollow">here</a>)</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/pefs" rel="nofollow">Filesystem-based encryption with PEFS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.bsdcan.org/2014/registration.php" rel="nofollow">BSDCan 2014 registration</a></h3>

<ul>
<li>Registration is finally open!</li>
<li>The prices are available along with a full list of presentations</li>
<li>Tutorial sessions for various topics as well</li>
<li>You have to go
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140314080734" rel="nofollow">Big changes for OpenBSD 5.6</a></h3>

<ul>
<li>Although 5.5 was just frozen and the release process has started, 5.6 is already looking promising</li>
<li>OpenBSD has, for a long time, included a heavily-patched version of Apache based on 1.3</li>
<li>They&#39;ve also imported nginx into base a few years ago, but now have finally removed Apache</li>
<li>Sendmail is also no longer the default MTA, OpenSMTPD <a href="http://undeadly.org/cgi?action=article&sid=20140313052817" rel="nofollow">is the new default</a></li>
<li>Will BIND be removed next? <a href="http://marc.info/?l=openbsd-cvs&m=139492163427518&w=2" rel="nofollow">Maybe so</a></li>
<li>They&#39;ve also discontinued the hp300, mvme68k and mvme88k ports
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/03/11/getting-to-know-your-portmgr-lurker-alexy-dokuchaev/" rel="nofollow">Getting to know your portmgr lurkers</a></h3>

<ul>
<li>The &quot;getting to know your portmgr&quot; series makes its return</li>
<li>This time we get to talk with danfe@ (probably most known for being the nVidia driver maintainer, but he does a lot with ports)</li>
<li>How he got into FreeBSD? He &quot;wanted a unix system that I could understand and that would not get bloated as time goes by&quot;</li>
<li>Mentions why he&#39;s still heavily involved with the project and lots more
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-20/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Work has started to port Pulseaudio to PCBSD 10.0.1</li>
<li>There&#39;s a new &quot;pc-mixer&quot; utility being worked on for sound management as well</li>
<li>New PBIs, GNOME/Mate updates, Life Preserver fixes and a lot more</li>
<li>PCBSD 10.0.1 <a href="http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-21-pcbsd-10-0-1-released/" rel="nofollow">was released</a> too
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2QwjHkL2n" rel="nofollow">Alex writes in</a></li>
<li><a href="http://slexy.org/view/s2wLGlHF15" rel="nofollow">Ben writes in</a></li>
<li><a href="http://slexy.org/view/s21JsgRjMU" rel="nofollow">Nick writes in</a></li>
<li><a href="http://slexy.org/view/s2UX4sYdHy" rel="nofollow">Sami writes in</a></li>
<li><a href="http://slexy.org/view/s26z60Qd6z" rel="nofollow">Christopher writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;re back from AsiaBSDCon! This week we&#39;ll be chatting with Gleb Kurtsou about some a filesystem-level encryption utility called PEFS. After that, we&#39;ll give you a step by step guide on how to actually use it. There&#39;s also the usual round of your questions and we&#39;ve got a lot of news to catch up on, so stay tuned to BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://neocri.me/documentation/using-ssh-certificate-authentication/" rel="nofollow">Using OpenSSH Certificate Authentication</a></h3>

<ul>
<li>SSH has a not-so-often-talked-about authentication option in addition to passwords and keys: certificates - you can add certificates to any current authentication method you&#39;re using</li>
<li>They&#39;re not really that complex, there just isn&#39;t a lot of documentation on how to use them - this post tries to solve that</li>
<li>There&#39;s the benefit of not needing a known_hosts file or authorized_users file anymore</li>
<li>The post goes into a fair amount of detail about the differences, advantages and implications of using certificates for authentication
***</li>
</ul>

<h3><a href="http://www.duckland.org/2014/03/back-to-freebsd-aka-day-1#more" rel="nofollow">Back to FreeBSD, a new series</a></h3>

<ul>
<li>Similar to the &quot;FreeBSD Challenge&quot; blog series, one of our listeners will be writing about his switching BACK to FreeBSD journey</li>
<li>&quot;So, a long time ago, I had a box which was running FreeBSD 4, running on a Pentium. 14 years later, I have decided to get back into FreeBSD, now at FreeBSD 10&quot;</li>
<li>He&#39;s starting off with PCBSD since it&#39;s easy to get working with dual graphics</li>
<li>Should be a fun series to follow!
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140307130554" rel="nofollow">OpenBSD&#39;s recent experiments in package building</a></h3>

<ul>
<li>If you&#39;ll remember back to our <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere tutorial</a>, it lets you build FreeBSD binary packages in bulk - OpenBSD&#39;s version is called <a href="http://www.bsdnow.tv/tutorials/dpb" rel="nofollow">dpb</a></li>
<li>Marc Espie recently got some monster machines in russia to play with to help improve scaling of dpb on high end hardware</li>
<li>This article goes through some of his findings and plans for future versions that increase performance</li>
<li>We&#39;ll be showing a tutorial of dpb on the show in a few weeks
***</li>
</ul>

<h3><a href="http://jafdip.com/securing-freebsd-2fa-two-factor-authentication/" rel="nofollow">Securing FreeBSD with 2FA</a></h3>

<ul>
<li>So maybe you&#39;ve set up two-factor authentication with gmail or twitter, but have you done it with your BSD box?</li>
<li>This post walks us through the process of locking down an <a href="http://www.bsdnow.tv/tutorials/ssh-tmux" rel="nofollow">ssh server</a> with 2FA</li>
<li>With just a mobile phone and a few extra tools, you can enable two-factor auth on your BSD box and have just that little extra bit of protections
***</li>
</ul>

<h2>Interview - Gleb Kurtsou - <a href="mailto:gleb.kurtsou@gmail.com" rel="nofollow">gleb.kurtsou@gmail.com</a></h2>

<p>PEFS (security audit results <a href="https://defuse.ca/audits/pefs.htm" rel="nofollow">here</a>)</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/pefs" rel="nofollow">Filesystem-based encryption with PEFS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.bsdcan.org/2014/registration.php" rel="nofollow">BSDCan 2014 registration</a></h3>

<ul>
<li>Registration is finally open!</li>
<li>The prices are available along with a full list of presentations</li>
<li>Tutorial sessions for various topics as well</li>
<li>You have to go
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140314080734" rel="nofollow">Big changes for OpenBSD 5.6</a></h3>

<ul>
<li>Although 5.5 was just frozen and the release process has started, 5.6 is already looking promising</li>
<li>OpenBSD has, for a long time, included a heavily-patched version of Apache based on 1.3</li>
<li>They&#39;ve also imported nginx into base a few years ago, but now have finally removed Apache</li>
<li>Sendmail is also no longer the default MTA, OpenSMTPD <a href="http://undeadly.org/cgi?action=article&sid=20140313052817" rel="nofollow">is the new default</a></li>
<li>Will BIND be removed next? <a href="http://marc.info/?l=openbsd-cvs&m=139492163427518&w=2" rel="nofollow">Maybe so</a></li>
<li>They&#39;ve also discontinued the hp300, mvme68k and mvme88k ports
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/03/11/getting-to-know-your-portmgr-lurker-alexy-dokuchaev/" rel="nofollow">Getting to know your portmgr lurkers</a></h3>

<ul>
<li>The &quot;getting to know your portmgr&quot; series makes its return</li>
<li>This time we get to talk with danfe@ (probably most known for being the nVidia driver maintainer, but he does a lot with ports)</li>
<li>How he got into FreeBSD? He &quot;wanted a unix system that I could understand and that would not get bloated as time goes by&quot;</li>
<li>Mentions why he&#39;s still heavily involved with the project and lots more
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-20/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Work has started to port Pulseaudio to PCBSD 10.0.1</li>
<li>There&#39;s a new &quot;pc-mixer&quot; utility being worked on for sound management as well</li>
<li>New PBIs, GNOME/Mate updates, Life Preserver fixes and a lot more</li>
<li>PCBSD 10.0.1 <a href="http://blog.pcbsd.org/2014/03/pc-bsd-weekly-feature-digest-21-pcbsd-10-0-1-released/" rel="nofollow">was released</a> too
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2QwjHkL2n" rel="nofollow">Alex writes in</a></li>
<li><a href="http://slexy.org/view/s2wLGlHF15" rel="nofollow">Ben writes in</a></li>
<li><a href="http://slexy.org/view/s21JsgRjMU" rel="nofollow">Nick writes in</a></li>
<li><a href="http://slexy.org/view/s2UX4sYdHy" rel="nofollow">Sami writes in</a></li>
<li><a href="http://slexy.org/view/s26z60Qd6z" rel="nofollow">Christopher writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>28: Ghost of Partition</title>
  <link>https://www.bsdnow.tv/28</link>
  <guid isPermaLink="false">dbf43567-8b44-4e0a-a98c-df78dddd551f</guid>
  <pubDate>Wed, 12 Mar 2014 08:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/dbf43567-8b44-4e0a-a98c-df78dddd551f.mp3" length="24331945" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week we're at AsiaBSDCon, so it'll be a shorter episode. We've got an interview with Eric Turgeon, founder of the desktop-focused GhostBSD project. Haven't heard of GhostBSD? Well stay tuned then. There's also a really interesting tutorial on how to serially concatenate disks in NetBSD. We'll be back next week with a normal episode.</itunes:subtitle>
  <itunes:duration>33:47</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week we're at AsiaBSDCon, so it'll be a shorter episode. We've got an interview with Eric Turgeon, founder of the desktop-focused GhostBSD project. Haven't heard of GhostBSD? Well stay tuned then. There's also a really interesting tutorial on how to serially concatenate disks in NetBSD. We'll be back next week with a normal episode.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Interview - Eric Turgeon - ericturgeon@ghostbsd.org (mailto:ericturgeon@ghostbsd.org) / @GhostBSD1 (https://twitter.com/GhostBSD1)
GhostBSD
Tutorial
Serially concatenating disks in NetBSD (http://www.bsdnow.tv/tutorials/nbsd-disks)
Feedback/Questions
Dave writes in (http://slexy.org/view/s2ff5BOdU0)
Shane writes in (http://slexy.org/view/s2F6j5fVYH)
Rob writes in (http://slexy.org/view/s2GHmy7tuS)
Predrag writes in (http://slexy.org/view/s2uM28feQe)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ghostbsd, disks, management, slice, partition, linux, device, opeth, ghost reveries, name, ericbsd, ericturgeonbsd, opeth, eric turgeon, growing filesystems, vnconfig, disks, disklabel, partitions, disk management</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week we&#39;re at AsiaBSDCon, so it&#39;ll be a shorter episode. We&#39;ve got an interview with Eric Turgeon, founder of the desktop-focused GhostBSD project. Haven&#39;t heard of GhostBSD? Well stay tuned then. There&#39;s also a really interesting tutorial on how to serially concatenate disks in NetBSD. We&#39;ll be back next week with a normal episode.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Interview - Eric Turgeon - <a href="mailto:ericturgeon@ghostbsd.org" rel="nofollow">ericturgeon@ghostbsd.org</a> / <a href="https://twitter.com/GhostBSD1" rel="nofollow">@GhostBSD1</a></h2>

<p>GhostBSD</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/nbsd-disks" rel="nofollow">Serially concatenating disks in NetBSD</a></h3>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2ff5BOdU0" rel="nofollow">Dave writes in</a></li>
<li><a href="http://slexy.org/view/s2F6j5fVYH" rel="nofollow">Shane writes in</a></li>
<li><a href="http://slexy.org/view/s2GHmy7tuS" rel="nofollow">Rob writes in</a></li>
<li><a href="http://slexy.org/view/s2uM28feQe" rel="nofollow">Predrag writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week we&#39;re at AsiaBSDCon, so it&#39;ll be a shorter episode. We&#39;ve got an interview with Eric Turgeon, founder of the desktop-focused GhostBSD project. Haven&#39;t heard of GhostBSD? Well stay tuned then. There&#39;s also a really interesting tutorial on how to serially concatenate disks in NetBSD. We&#39;ll be back next week with a normal episode.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Interview - Eric Turgeon - <a href="mailto:ericturgeon@ghostbsd.org" rel="nofollow">ericturgeon@ghostbsd.org</a> / <a href="https://twitter.com/GhostBSD1" rel="nofollow">@GhostBSD1</a></h2>

<p>GhostBSD</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/nbsd-disks" rel="nofollow">Serially concatenating disks in NetBSD</a></h3>

<hr>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2ff5BOdU0" rel="nofollow">Dave writes in</a></li>
<li><a href="http://slexy.org/view/s2F6j5fVYH" rel="nofollow">Shane writes in</a></li>
<li><a href="http://slexy.org/view/s2GHmy7tuS" rel="nofollow">Rob writes in</a></li>
<li><a href="http://slexy.org/view/s2uM28feQe" rel="nofollow">Predrag writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>27: BSD Now vs. BSDTalk</title>
  <link>https://www.bsdnow.tv/27</link>
  <guid isPermaLink="false">9c2ed198-48a2-4ed6-988c-6d5ce1ed66c7</guid>
  <pubDate>Wed, 05 Mar 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9c2ed198-48a2-4ed6-988c-6d5ce1ed66c7.mp3" length="73930325" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>The long-awaited meetup is finally happening on today's show. We're going to be interviewing the original BSD podcaster, Will Backman, to discuss what he's been up to and what the future of BSD advocacy looks like. After that, we'll be showing you how to track (and even cross-compile!) the -CURRENT branch of NetBSD. We've got answers to user-submitted questions and the latest news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:42:40</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>The long-awaited meetup is finally happening on today's show. We're going to be interviewing the original BSD podcaster, Will Backman, to discuss what he's been up to and what the future of BSD advocacy looks like. After that, we'll be showing you how to track (and even cross-compile!) the -CURRENT branch of NetBSD. We've got answers to user-submitted questions and the latest news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
FreeBSD and OpenBSD in GSOC2014 (https://wiki.freebsd.org/SummerOfCode2014)
The Google Summer of Code is a way to encourage students to write code for open source projects and make some money
Both FreeBSD and OpenBSD were accepted, and we'd love for anyone listening to check out their GSOC pages
The FreeBSD wiki has a list of things that they'd be interested in someone helping out with
OpenBSD's want list was also posted (http://www.openbsdfoundation.org/gsoc2014.html)
DragonflyBSD and NetBSD were sadly not accepted this year
***
Yes, you too can be an evil network overlord (http://bsdly.blogspot.com/2014/02/yes-you-too-can-be-evil-network.html)
A new blog post about monitoring your network using only free tools
OpenBSD is a great fit, and has all the stuff you need in the base system or via packages
It talks about the pflow pseudo-interface, its capabilities and relation to NetFlow (also goes well with pf)
There's also details about flowd and nfsen, more great tools to make network monitoring easy
If you're listening, Peter... stop ignoring our emails and come on the show! We know you're watching!
***
BSDMag's February issue is out (http://bsdmag.org/magazine/1858-openbsd-5-4-configure-openbsd-basic-services)
The theme is "configuring basic services on OpenBSD 5.4"
There's also an interview with Peter Hansteen (oh hey...)
Topics also include locking down SSH, a GIMP lesson, user/group management, and...
Linux and Solaris articles? Why??
***
Changes in bcrypt (http://marc.info/?l=openbsd-misc&amp;amp;m=139320023202696&amp;amp;w=2)
Not specific to any OS, but the OpenBSD team is updating their bcrypt implementation
There is a bug in bcrypt when hashing long passwords - other OSes need to update theirs too! (FreeBSD already has)
"The length is stored in an unsigned char type, which will overflow and wrap at 256. Although we consider the existence of affected hashes very rare, in order to differentiate hashes generated before and after the fix, we are introducing a new minor 'b'."
As long as you upgrade your OpenBSD system in order (without skipping versions) you should be ok going forward
Lots of specifics in the email, check the full thing
***
Interview - Will Backman - bitgeist@yahoo.com (mailto:bitgeist@yahoo.com) / @bsdtalk (https://twitter.com/bsdtalk)
The BSDTalk podcast, BSD advocacy, various topics
Tutorial
Tracking and cross-compiling -CURRENT (NetBSD) (http://www.bsdnow.tv/tutorials/current-nbsd)
News Roundup
X11 no longer needs root (http://undeadly.org/cgi?action=article&amp;amp;sid=20140223112426)
Xorg has long since required root privileges to run the main server
With recent work (http://marc.info/?l=openbsd-cvs&amp;amp;;m=139245772023497&amp;amp;w=2) from the OpenBSD team, now everything (even KMS) can run as a regular user
Now you can set the "machdep.allowaperture" sysctl to 0 and still use a GUI
***
OpenSSH 6.6 CFT (https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-March/032259.html)
Shortly after the huge 6.5 release, we get a routine bugfix update
Test it out on as many systems as you can
Check the mailing list for the full bug list
***
Creating an OpenBSD USB drive (http://undeadly.org/cgi?action=article&amp;amp;sid=20140225072408)
Since OpenBSD doesn't distribute any official USB images, here are some instructions on how to do it
Step by step guide on how you can make your very own
However, there's some recent emails (http://undeadly.org/cgi?action=article&amp;amp;sid=20140228231258) that suggest official USB images may be coming soon... oh wait (http://marc.info/?l=openbsd-cvs&amp;amp;m=139377587526463&amp;amp;w=2)
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-19/)
New PBI updates that allow separate ports from /usr/local
You need to rebuild pbi-manager if you want to try it out
Updates and changes to Life Preserver, App Cafe, PCDM
***
Feedback/Questions
espressowar writes in (http://slexy.org/view/s2JpJ5EaZp)
Antonio writes in (http://slexy.org/view/s2QpPevJ3J)
Christian writes in (http://slexy.org/view/s2EZLxDfWh)
Adam writes in (http://slexy.org/view/s21gEBZbmG)
Alex writes in (http://slexy.org/view/s2RnCO1p9c)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, will backman, bsdtalk, podcast, cross compile, build.sh, portable, portability, cross-build, building a release, google summer of code, gsoc, gsoc2014, 2014, spamd, dd, opensmtpd, tcpdump, packet filtering, monitoring, network, bcrypt, solar designer, ixsystems, usb, bootable, jails, openbsd usb drive, ezjail, jails, bsd jail, x11, openssh, pflow, pf</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>The long-awaited meetup is finally happening on today&#39;s show. We&#39;re going to be interviewing the original BSD podcaster, Will Backman, to discuss what he&#39;s been up to and what the future of BSD advocacy looks like. After that, we&#39;ll be showing you how to track (and even cross-compile!) the -CURRENT branch of NetBSD. We&#39;ve got answers to user-submitted questions and the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://wiki.freebsd.org/SummerOfCode2014" rel="nofollow">FreeBSD and OpenBSD in GSOC2014</a></h3>

<ul>
<li>The Google Summer of Code is a way to encourage students to write code for open source projects and make some money</li>
<li>Both FreeBSD and OpenBSD were accepted, and we&#39;d love for anyone listening to check out their GSOC pages</li>
<li>The FreeBSD wiki has a list of things that they&#39;d be interested in someone helping out with</li>
<li>OpenBSD&#39;s want list was <a href="http://www.openbsdfoundation.org/gsoc2014.html" rel="nofollow">also posted</a></li>
<li>DragonflyBSD and NetBSD were sadly not accepted this year
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2014/02/yes-you-too-can-be-evil-network.html" rel="nofollow">Yes, you too can be an evil network overlord</a></h3>

<ul>
<li>A new blog post about monitoring your network using only free tools</li>
<li>OpenBSD is a great fit, and has all the stuff you need in the base system or via packages</li>
<li>It talks about the pflow pseudo-interface, its capabilities and relation to NetFlow (also goes well with pf)</li>
<li>There&#39;s also details about flowd and nfsen, more great tools to make network monitoring easy</li>
<li>If you&#39;re listening, Peter... stop ignoring our emails and come on the show! We know you&#39;re watching!
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1858-openbsd-5-4-configure-openbsd-basic-services" rel="nofollow">BSDMag&#39;s February issue is out</a></h3>

<ul>
<li>The theme is &quot;configuring basic services on OpenBSD 5.4&quot;</li>
<li>There&#39;s also an interview with Peter Hansteen (oh hey...)</li>
<li>Topics also include locking down SSH, a GIMP lesson, user/group management, and...</li>
<li>Linux and Solaris articles? Why??
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-misc&m=139320023202696&w=2" rel="nofollow">Changes in bcrypt</a></h3>

<ul>
<li>Not specific to any OS, but the OpenBSD team is updating their bcrypt implementation</li>
<li>There is a bug in bcrypt when hashing long passwords - other OSes need to update theirs too! (FreeBSD already has)</li>
<li>&quot;The length is stored in an unsigned char type, which will overflow and wrap at 256. Although we consider the existence of affected hashes very rare, in order to differentiate hashes generated before and after the fix, we are introducing a new minor &#39;b&#39;.&quot;</li>
<li>As long as you upgrade your OpenBSD system in order (without skipping versions) you should be ok going forward</li>
<li>Lots of specifics in the email, check the full thing
***</li>
</ul>

<h2>Interview - Will Backman - <a href="mailto:bitgeist@yahoo.com" rel="nofollow">bitgeist@yahoo.com</a> / <a href="https://twitter.com/bsdtalk" rel="nofollow">@bsdtalk</a></h2>

<p>The BSDTalk podcast, BSD advocacy, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/current-nbsd" rel="nofollow">Tracking and cross-compiling -CURRENT (NetBSD)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140223112426" rel="nofollow">X11 no longer needs root</a></h3>

<ul>
<li>Xorg has long since required root privileges to run the main server</li>
<li>With <a href="http://marc.info/?l=openbsd-cvs&;m=139245772023497&w=2" rel="nofollow">recent work</a> from the OpenBSD team, now everything (even KMS) can run as a regular user</li>
<li>Now you can set the &quot;machdep.allowaperture&quot; sysctl to 0 and still use a GUI
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-March/032259.html" rel="nofollow">OpenSSH 6.6 CFT</a></h3>

<ul>
<li>Shortly after the huge 6.5 release, we get a routine bugfix update</li>
<li>Test it out on as many systems as you can</li>
<li>Check the mailing list for the full bug list
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140225072408" rel="nofollow">Creating an OpenBSD USB drive</a></h3>

<ul>
<li>Since OpenBSD doesn&#39;t distribute any official USB images, here are some instructions on how to do it</li>
<li>Step by step guide on how you can make your very own</li>
<li>However, there&#39;s some <a href="http://undeadly.org/cgi?action=article&sid=20140228231258" rel="nofollow">recent emails</a> that suggest official USB images may be coming soon... <a href="http://marc.info/?l=openbsd-cvs&m=139377587526463&w=2" rel="nofollow">oh wait</a>
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-19/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>New PBI updates that allow separate ports from /usr/local</li>
<li>You need to rebuild pbi-manager if you want to try it out</li>
<li>Updates and changes to Life Preserver, App Cafe, PCDM
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2JpJ5EaZp" rel="nofollow">espressowar writes in</a></li>
<li><a href="http://slexy.org/view/s2QpPevJ3J" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s2EZLxDfWh" rel="nofollow">Christian writes in</a></li>
<li><a href="http://slexy.org/view/s21gEBZbmG" rel="nofollow">Adam writes in</a></li>
<li><a href="http://slexy.org/view/s2RnCO1p9c" rel="nofollow">Alex writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The long-awaited meetup is finally happening on today&#39;s show. We&#39;re going to be interviewing the original BSD podcaster, Will Backman, to discuss what he&#39;s been up to and what the future of BSD advocacy looks like. After that, we&#39;ll be showing you how to track (and even cross-compile!) the -CURRENT branch of NetBSD. We&#39;ve got answers to user-submitted questions and the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://wiki.freebsd.org/SummerOfCode2014" rel="nofollow">FreeBSD and OpenBSD in GSOC2014</a></h3>

<ul>
<li>The Google Summer of Code is a way to encourage students to write code for open source projects and make some money</li>
<li>Both FreeBSD and OpenBSD were accepted, and we&#39;d love for anyone listening to check out their GSOC pages</li>
<li>The FreeBSD wiki has a list of things that they&#39;d be interested in someone helping out with</li>
<li>OpenBSD&#39;s want list was <a href="http://www.openbsdfoundation.org/gsoc2014.html" rel="nofollow">also posted</a></li>
<li>DragonflyBSD and NetBSD were sadly not accepted this year
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2014/02/yes-you-too-can-be-evil-network.html" rel="nofollow">Yes, you too can be an evil network overlord</a></h3>

<ul>
<li>A new blog post about monitoring your network using only free tools</li>
<li>OpenBSD is a great fit, and has all the stuff you need in the base system or via packages</li>
<li>It talks about the pflow pseudo-interface, its capabilities and relation to NetFlow (also goes well with pf)</li>
<li>There&#39;s also details about flowd and nfsen, more great tools to make network monitoring easy</li>
<li>If you&#39;re listening, Peter... stop ignoring our emails and come on the show! We know you&#39;re watching!
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1858-openbsd-5-4-configure-openbsd-basic-services" rel="nofollow">BSDMag&#39;s February issue is out</a></h3>

<ul>
<li>The theme is &quot;configuring basic services on OpenBSD 5.4&quot;</li>
<li>There&#39;s also an interview with Peter Hansteen (oh hey...)</li>
<li>Topics also include locking down SSH, a GIMP lesson, user/group management, and...</li>
<li>Linux and Solaris articles? Why??
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-misc&m=139320023202696&w=2" rel="nofollow">Changes in bcrypt</a></h3>

<ul>
<li>Not specific to any OS, but the OpenBSD team is updating their bcrypt implementation</li>
<li>There is a bug in bcrypt when hashing long passwords - other OSes need to update theirs too! (FreeBSD already has)</li>
<li>&quot;The length is stored in an unsigned char type, which will overflow and wrap at 256. Although we consider the existence of affected hashes very rare, in order to differentiate hashes generated before and after the fix, we are introducing a new minor &#39;b&#39;.&quot;</li>
<li>As long as you upgrade your OpenBSD system in order (without skipping versions) you should be ok going forward</li>
<li>Lots of specifics in the email, check the full thing
***</li>
</ul>

<h2>Interview - Will Backman - <a href="mailto:bitgeist@yahoo.com" rel="nofollow">bitgeist@yahoo.com</a> / <a href="https://twitter.com/bsdtalk" rel="nofollow">@bsdtalk</a></h2>

<p>The BSDTalk podcast, BSD advocacy, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/current-nbsd" rel="nofollow">Tracking and cross-compiling -CURRENT (NetBSD)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140223112426" rel="nofollow">X11 no longer needs root</a></h3>

<ul>
<li>Xorg has long since required root privileges to run the main server</li>
<li>With <a href="http://marc.info/?l=openbsd-cvs&;m=139245772023497&w=2" rel="nofollow">recent work</a> from the OpenBSD team, now everything (even KMS) can run as a regular user</li>
<li>Now you can set the &quot;machdep.allowaperture&quot; sysctl to 0 and still use a GUI
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-March/032259.html" rel="nofollow">OpenSSH 6.6 CFT</a></h3>

<ul>
<li>Shortly after the huge 6.5 release, we get a routine bugfix update</li>
<li>Test it out on as many systems as you can</li>
<li>Check the mailing list for the full bug list
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140225072408" rel="nofollow">Creating an OpenBSD USB drive</a></h3>

<ul>
<li>Since OpenBSD doesn&#39;t distribute any official USB images, here are some instructions on how to do it</li>
<li>Step by step guide on how you can make your very own</li>
<li>However, there&#39;s some <a href="http://undeadly.org/cgi?action=article&sid=20140228231258" rel="nofollow">recent emails</a> that suggest official USB images may be coming soon... <a href="http://marc.info/?l=openbsd-cvs&m=139377587526463&w=2" rel="nofollow">oh wait</a>
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-19/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>New PBI updates that allow separate ports from /usr/local</li>
<li>You need to rebuild pbi-manager if you want to try it out</li>
<li>Updates and changes to Life Preserver, App Cafe, PCDM
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2JpJ5EaZp" rel="nofollow">espressowar writes in</a></li>
<li><a href="http://slexy.org/view/s2QpPevJ3J" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s2EZLxDfWh" rel="nofollow">Christian writes in</a></li>
<li><a href="http://slexy.org/view/s21gEBZbmG" rel="nofollow">Adam writes in</a></li>
<li><a href="http://slexy.org/view/s2RnCO1p9c" rel="nofollow">Alex writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>26: Port Authority</title>
  <link>https://www.bsdnow.tv/26</link>
  <guid isPermaLink="false">0e208963-5f59-446a-902e-9876d96c8f3f</guid>
  <pubDate>Wed, 26 Feb 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0e208963-5f59-446a-902e-9876d96c8f3f.mp3" length="65589845" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>On today's show we have an interview with Joe Marcus Clark, one of the original portmgr members in FreeBSD, and one of the key GNOME porters. Keeping along with that topic, we have a FreeBSD ports tutorial for you as well. The latest news and answers to your BSD questions, right here on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:31:05</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>On today's show we have an interview with Joe Marcus Clark, one of the original portmgr members in FreeBSD, and one of the key GNOME porters. Keeping along with that topic, we have a FreeBSD ports tutorial for you as well. The latest news and answers to your BSD questions, right here on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
Tailoring OpenBSD for an old, strange computer (http://multixden.blogspot.com/2014/02/tailoring-openbsd-for-old-strange.html)
The author of this article had an OmniBook 800CT (http://hpmuseum.net/display_item.php?hw=233), which comes with a pop-out mouse, black and white display, 32MB of RAM and a 133MHz CPU
Obviously he had to install some kind of BSD on it!
This post goes through all his efforts of trimming down OpenBSD to work on such a limited device
He goes through the trial and error of "compile, break it, rebuild, try again"
After cutting a lot out from the kernel, saving a precious megabyte here and there, he eventually gets it working
***
pkgsrcCon and BSDCan (http://www.pkgsrc.org/pkgsrcCon/2014/)
pkgsrccon is "a technical conference for people working on the NetBSD Packages Collection, focusing on existing technologies, research projects, and works-in-progress in pkgsrc infrastructure"
This year it will be on June 21st and 22nd
The schedule (http://www.pkgsrc.org/pkgsrcCon/2014/schedule.html) is still being worked out, so if you want to give a talk, submit it
BSDCan's schedule (https://www.bsdcan.org/2014/schedule/events.en.html) was also announced
We'll be having presentations about ARM on NetBSD and FreeBSD, PF on OpenBSD, Capsicum and casperd, ASLR in FreeBSD, more about migrating from Linux to BSD, FreeNAS stuff and much more
Kris' presentation was accepted!
Tons of topics, look forward to the recorded versions of all of them hopefully!
***
Two factor auth with pushover (http://www.tedunangst.com/flak/post/login-pushover)
A new write-up from our friend Ted Unangst (http://www.bsdnow.tv/episodes/2014_02_05-time_signatures)
Pushover is "a web hook to smartphone push notification gateway" - you sent a POST to a web server and it sends a code to your phone
His post goes through the steps of editing your login.conf and setting it all up to work
Now you can get a two factor authenticated login for ssh!
***
The status of GNOME 3 on BSD (http://undeadly.org/cgi?action=article&amp;amp;sid=20140219085851)
It's no secret that the GNOME team is a Linux-obsessed bunch, almost to the point of being hostile towards other operating systems
OpenBSD keeps their GNOME 3 ports up to date very well, and Antoine Jacoutot writes about his work on that and how easy it is to use
This post goes through the process of how simple it is to get GNOME 3 set up on OpenBSD and even includes a screencast (https://www.bsdfrog.org/tmp/undeadly-gnome.webm)
A few recent (http://blogs.gnome.org/mclasen/2014/02/19/on-portability/) posts (http://blogs.gnome.org/desrt/2014/02/19/on-portability/) from some GNOME developers show that they're finally working with the BSD guys to improve portability
The FreeBSD and OpenBSD teams are working together to bring the latest GNOME to all of us - it's a beautiful thing
This goes right along with our interview today!
***
Interview - Joe Marcus Clark - marcus@freebsd.org (mailto:marcus@freebsd.org)
The life and daily activities of portmgr, GNOME 3, Tinderbox, portlint, various topics
Tutorial
The FreeBSD Ports Collection (http://www.bsdnow.tv/tutorials/ports)
News Roundup
DragonflyBSD 3.8 goals and 3.6.1 release (http://bugs.dragonflybsd.org/versions/4)
The Dragonfly team is thinking about what should be in version 3.8
On their bug tracker, it lists some of the things they'd like to get done before then
In the meantime, 3.6.1 (http://lists.dragonflybsd.org/pipermail/commits/2014-February/199294.html) was released with lots of bugfixes
***
NYCBSDCon 2014 wrap-up piece (http://www.informit.com/blogs/blog.aspx?uk=NYCBSDCon-2014-Rocked-a-Cold-February-Weekend)
We've got a nice wrap-up titled "NYCBSDCon 2014 Heats Up a Cold Winter Weekend"
The author also interviews GNN (http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates) about the conference
There's even a little "beginner introduction" to BSD segment
Includes a mention of the recently-launched journal and lots of pictures from the event
***
FreeBSD and Linux, a comparative analysis (https://www.youtube.com/watch?&amp;amp;v=5mv_oKFzACM#t=418)
GNN in yet another story - he gave a presentation at the NYLUG about the differences between FreeBSD and Linux
He mentions the history of BSD, the patch set and 386BSD, the lawsuit, philosophy and license differences, a complete system vs "distros," development models, BSD-only features and technologies, how to become a committer, overall comparisons, different hats and roles, the different bsds and their goals and actual code differences
Serves as a good introduction you can show your Linux friends
***
PCBSD CFT and weekly digest (http://blog.pcbsd.org/2014/02/call-for-testers-new-major-upgrade-methodology/)
Upgrade tools have gotten a major rewrite
You have to help test it, there is no choice! Read more here (http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-18/)
How dare Kris be "unimpressed with" freebsd-update and pkgng!?
Various updates and fixes
***
Feedback/Questions
Jeffrey writes in (http://slexy.org/view/s213KxUdVj)
Shane writes in (http://slexy.org/view/s20lwkjLVK)
Ferdinand writes in (http://slexy.org/view/s21DqJs77g)
Curtis writes in (http://slexy.org/view/s20eXKEqJc)
Clint writes in (http://slexy.org/view/s21XMVFuVu)
Peter writes in (http://slexy.org/view/s20Xk05MHe)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, portmgr, ports, pkgng, packages, portsnap, make.conf, tinderbox, portlint, gnome, gnome 3, gnome-shell, omnibook, 800ct, ixsystems, pkgsrc, pkgsrccon, pushover, two factor authentication, bsdcan, 2014, dragonfly mail agent, dma, sendmail, postfix, ssmtp, flashrd, nylug, linux, differences, switching to bsd, presentation, lug, uug, bug, gnu, gpl, fsf, license, debate, nycbsdcon</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>On today&#39;s show we have an interview with Joe Marcus Clark, one of the original portmgr members in FreeBSD, and one of the key GNOME porters. Keeping along with that topic, we have a FreeBSD ports tutorial for you as well. The latest news and answers to your BSD questions, right here on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://multixden.blogspot.com/2014/02/tailoring-openbsd-for-old-strange.html" rel="nofollow">Tailoring OpenBSD for an old, strange computer</a></h3>

<ul>
<li>The author of this article had an <a href="http://hpmuseum.net/display_item.php?hw=233" rel="nofollow">OmniBook 800CT</a>, which comes with a pop-out mouse, black and white display, 32MB of RAM and a 133MHz CPU</li>
<li>Obviously he had to install some kind of BSD on it!</li>
<li>This post goes through all his efforts of trimming down OpenBSD to work on such a limited device</li>
<li>He goes through the trial and error of &quot;compile, break it, rebuild, try again&quot;</li>
<li>After cutting a lot out from the kernel, saving a precious megabyte here and there, he eventually gets it working
***</li>
</ul>

<h3><a href="http://www.pkgsrc.org/pkgsrcCon/2014/" rel="nofollow">pkgsrcCon and BSDCan</a></h3>

<ul>
<li>pkgsrccon is &quot;a technical conference for people working on the NetBSD Packages Collection, focusing on existing technologies, research projects, and works-in-progress in pkgsrc infrastructure&quot;</li>
<li>This year it will be on June 21st and 22nd</li>
<li>The <a href="http://www.pkgsrc.org/pkgsrcCon/2014/schedule.html" rel="nofollow">schedule</a> is still being worked out, so if you want to give a talk, submit it</li>
<li>BSDCan&#39;s <a href="https://www.bsdcan.org/2014/schedule/events.en.html" rel="nofollow">schedule</a> was also announced</li>
<li>We&#39;ll be having presentations about ARM on NetBSD and FreeBSD, PF on OpenBSD, Capsicum and casperd, ASLR in FreeBSD, more about migrating from Linux to BSD, FreeNAS stuff and much more</li>
<li>Kris&#39; presentation was accepted!</li>
<li>Tons of topics, look forward to the recorded versions of all of them hopefully!
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/login-pushover" rel="nofollow">Two factor auth with pushover</a></h3>

<ul>
<li>A new write-up from our friend <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a></li>
<li>Pushover is &quot;a web hook to smartphone push notification gateway&quot; - you sent a POST to a web server and it sends a code to your phone</li>
<li>His post goes through the steps of editing your login.conf and setting it all up to work</li>
<li>Now you can get a two factor authenticated login for ssh!
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140219085851" rel="nofollow">The status of GNOME 3 on BSD</a></h3>

<ul>
<li>It&#39;s no secret that the GNOME team is a Linux-obsessed bunch, almost to the point of being hostile towards other operating systems</li>
<li>OpenBSD keeps their GNOME 3 ports up to date very well, and Antoine Jacoutot writes about his work on that and how easy it is to use</li>
<li>This post goes through the process of how simple it is to get GNOME 3 set up on OpenBSD and even includes <a href="https://www.bsdfrog.org/tmp/undeadly-gnome.webm" rel="nofollow">a screencast</a></li>
<li>A few <a href="http://blogs.gnome.org/mclasen/2014/02/19/on-portability/" rel="nofollow">recent</a> <a href="http://blogs.gnome.org/desrt/2014/02/19/on-portability/" rel="nofollow">posts</a> from some GNOME developers show that they&#39;re finally working with the BSD guys to improve portability</li>
<li>The FreeBSD and OpenBSD teams are working together to bring the latest GNOME to all of us - it&#39;s a beautiful thing</li>
<li>This goes right along with our interview today!
***</li>
</ul>

<h2>Interview - Joe Marcus Clark - <a href="mailto:marcus@freebsd.org" rel="nofollow">marcus@freebsd.org</a></h2>

<p>The life and daily activities of portmgr, GNOME 3, Tinderbox, portlint, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ports" rel="nofollow">The FreeBSD Ports Collection</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://bugs.dragonflybsd.org/versions/4" rel="nofollow">DragonflyBSD 3.8 goals and 3.6.1 release</a></h3>

<ul>
<li>The Dragonfly team is thinking about what should be in version 3.8</li>
<li>On their bug tracker, it lists some of the things they&#39;d like to get done before then</li>
<li>In the meantime, <a href="http://lists.dragonflybsd.org/pipermail/commits/2014-February/199294.html" rel="nofollow">3.6.1</a> was released with lots of bugfixes
***</li>
</ul>

<h3><a href="http://www.informit.com/blogs/blog.aspx?uk=NYCBSDCon-2014-Rocked-a-Cold-February-Weekend" rel="nofollow">NYCBSDCon 2014 wrap-up piece</a></h3>

<ul>
<li>We&#39;ve got a nice wrap-up titled &quot;NYCBSDCon 2014 Heats Up a Cold Winter Weekend&quot;</li>
<li>The author also interviews <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">GNN</a> about the conference</li>
<li>There&#39;s even a little &quot;beginner introduction&quot; to BSD segment</li>
<li>Includes a mention of the recently-launched journal and lots of pictures from the event
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?&v=5mv_oKFzACM#t=418" rel="nofollow">FreeBSD and Linux, a comparative analysis</a></h3>

<ul>
<li>GNN in yet another story - he gave a presentation at the NYLUG about the differences between FreeBSD and Linux</li>
<li>He mentions the history of BSD, the patch set and 386BSD, the lawsuit, philosophy and license differences, a complete system vs &quot;distros,&quot; development models, BSD-only features and technologies, how to become a committer, overall comparisons, different hats and roles, the different bsds and their goals and actual code differences</li>
<li>Serves as a good introduction you can show your Linux friends
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/02/call-for-testers-new-major-upgrade-methodology/" rel="nofollow">PCBSD CFT and weekly digest</a></h3>

<ul>
<li>Upgrade tools have gotten a major rewrite</li>
<li>You have to help test it, there is no choice! Read more <a href="http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-18/" rel="nofollow">here</a></li>
<li>How dare Kris be &quot;unimpressed with&quot; freebsd-update and pkgng!?</li>
<li>Various updates and fixes
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s213KxUdVj" rel="nofollow">Jeffrey writes in</a></li>
<li><a href="http://slexy.org/view/s20lwkjLVK" rel="nofollow">Shane writes in</a></li>
<li><a href="http://slexy.org/view/s21DqJs77g" rel="nofollow">Ferdinand writes in</a></li>
<li><a href="http://slexy.org/view/s20eXKEqJc" rel="nofollow">Curtis writes in</a></li>
<li><a href="http://slexy.org/view/s21XMVFuVu" rel="nofollow">Clint writes in</a></li>
<li><a href="http://slexy.org/view/s20Xk05MHe" rel="nofollow">Peter writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>On today&#39;s show we have an interview with Joe Marcus Clark, one of the original portmgr members in FreeBSD, and one of the key GNOME porters. Keeping along with that topic, we have a FreeBSD ports tutorial for you as well. The latest news and answers to your BSD questions, right here on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://multixden.blogspot.com/2014/02/tailoring-openbsd-for-old-strange.html" rel="nofollow">Tailoring OpenBSD for an old, strange computer</a></h3>

<ul>
<li>The author of this article had an <a href="http://hpmuseum.net/display_item.php?hw=233" rel="nofollow">OmniBook 800CT</a>, which comes with a pop-out mouse, black and white display, 32MB of RAM and a 133MHz CPU</li>
<li>Obviously he had to install some kind of BSD on it!</li>
<li>This post goes through all his efforts of trimming down OpenBSD to work on such a limited device</li>
<li>He goes through the trial and error of &quot;compile, break it, rebuild, try again&quot;</li>
<li>After cutting a lot out from the kernel, saving a precious megabyte here and there, he eventually gets it working
***</li>
</ul>

<h3><a href="http://www.pkgsrc.org/pkgsrcCon/2014/" rel="nofollow">pkgsrcCon and BSDCan</a></h3>

<ul>
<li>pkgsrccon is &quot;a technical conference for people working on the NetBSD Packages Collection, focusing on existing technologies, research projects, and works-in-progress in pkgsrc infrastructure&quot;</li>
<li>This year it will be on June 21st and 22nd</li>
<li>The <a href="http://www.pkgsrc.org/pkgsrcCon/2014/schedule.html" rel="nofollow">schedule</a> is still being worked out, so if you want to give a talk, submit it</li>
<li>BSDCan&#39;s <a href="https://www.bsdcan.org/2014/schedule/events.en.html" rel="nofollow">schedule</a> was also announced</li>
<li>We&#39;ll be having presentations about ARM on NetBSD and FreeBSD, PF on OpenBSD, Capsicum and casperd, ASLR in FreeBSD, more about migrating from Linux to BSD, FreeNAS stuff and much more</li>
<li>Kris&#39; presentation was accepted!</li>
<li>Tons of topics, look forward to the recorded versions of all of them hopefully!
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/login-pushover" rel="nofollow">Two factor auth with pushover</a></h3>

<ul>
<li>A new write-up from our friend <a href="http://www.bsdnow.tv/episodes/2014_02_05-time_signatures" rel="nofollow">Ted Unangst</a></li>
<li>Pushover is &quot;a web hook to smartphone push notification gateway&quot; - you sent a POST to a web server and it sends a code to your phone</li>
<li>His post goes through the steps of editing your login.conf and setting it all up to work</li>
<li>Now you can get a two factor authenticated login for ssh!
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140219085851" rel="nofollow">The status of GNOME 3 on BSD</a></h3>

<ul>
<li>It&#39;s no secret that the GNOME team is a Linux-obsessed bunch, almost to the point of being hostile towards other operating systems</li>
<li>OpenBSD keeps their GNOME 3 ports up to date very well, and Antoine Jacoutot writes about his work on that and how easy it is to use</li>
<li>This post goes through the process of how simple it is to get GNOME 3 set up on OpenBSD and even includes <a href="https://www.bsdfrog.org/tmp/undeadly-gnome.webm" rel="nofollow">a screencast</a></li>
<li>A few <a href="http://blogs.gnome.org/mclasen/2014/02/19/on-portability/" rel="nofollow">recent</a> <a href="http://blogs.gnome.org/desrt/2014/02/19/on-portability/" rel="nofollow">posts</a> from some GNOME developers show that they&#39;re finally working with the BSD guys to improve portability</li>
<li>The FreeBSD and OpenBSD teams are working together to bring the latest GNOME to all of us - it&#39;s a beautiful thing</li>
<li>This goes right along with our interview today!
***</li>
</ul>

<h2>Interview - Joe Marcus Clark - <a href="mailto:marcus@freebsd.org" rel="nofollow">marcus@freebsd.org</a></h2>

<p>The life and daily activities of portmgr, GNOME 3, Tinderbox, portlint, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ports" rel="nofollow">The FreeBSD Ports Collection</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://bugs.dragonflybsd.org/versions/4" rel="nofollow">DragonflyBSD 3.8 goals and 3.6.1 release</a></h3>

<ul>
<li>The Dragonfly team is thinking about what should be in version 3.8</li>
<li>On their bug tracker, it lists some of the things they&#39;d like to get done before then</li>
<li>In the meantime, <a href="http://lists.dragonflybsd.org/pipermail/commits/2014-February/199294.html" rel="nofollow">3.6.1</a> was released with lots of bugfixes
***</li>
</ul>

<h3><a href="http://www.informit.com/blogs/blog.aspx?uk=NYCBSDCon-2014-Rocked-a-Cold-February-Weekend" rel="nofollow">NYCBSDCon 2014 wrap-up piece</a></h3>

<ul>
<li>We&#39;ve got a nice wrap-up titled &quot;NYCBSDCon 2014 Heats Up a Cold Winter Weekend&quot;</li>
<li>The author also interviews <a href="http://www.bsdnow.tv/episodes/2014_01_29-journaled_news_updates" rel="nofollow">GNN</a> about the conference</li>
<li>There&#39;s even a little &quot;beginner introduction&quot; to BSD segment</li>
<li>Includes a mention of the recently-launched journal and lots of pictures from the event
***</li>
</ul>

<h3><a href="https://www.youtube.com/watch?&v=5mv_oKFzACM#t=418" rel="nofollow">FreeBSD and Linux, a comparative analysis</a></h3>

<ul>
<li>GNN in yet another story - he gave a presentation at the NYLUG about the differences between FreeBSD and Linux</li>
<li>He mentions the history of BSD, the patch set and 386BSD, the lawsuit, philosophy and license differences, a complete system vs &quot;distros,&quot; development models, BSD-only features and technologies, how to become a committer, overall comparisons, different hats and roles, the different bsds and their goals and actual code differences</li>
<li>Serves as a good introduction you can show your Linux friends
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/02/call-for-testers-new-major-upgrade-methodology/" rel="nofollow">PCBSD CFT and weekly digest</a></h3>

<ul>
<li>Upgrade tools have gotten a major rewrite</li>
<li>You have to help test it, there is no choice! Read more <a href="http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-18/" rel="nofollow">here</a></li>
<li>How dare Kris be &quot;unimpressed with&quot; freebsd-update and pkgng!?</li>
<li>Various updates and fixes
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s213KxUdVj" rel="nofollow">Jeffrey writes in</a></li>
<li><a href="http://slexy.org/view/s20lwkjLVK" rel="nofollow">Shane writes in</a></li>
<li><a href="http://slexy.org/view/s21DqJs77g" rel="nofollow">Ferdinand writes in</a></li>
<li><a href="http://slexy.org/view/s20eXKEqJc" rel="nofollow">Curtis writes in</a></li>
<li><a href="http://slexy.org/view/s21XMVFuVu" rel="nofollow">Clint writes in</a></li>
<li><a href="http://slexy.org/view/s20Xk05MHe" rel="nofollow">Peter writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>25: A Sixth pfSense</title>
  <link>https://www.bsdnow.tv/25</link>
  <guid isPermaLink="false">dad040a2-8866-4876-88fb-43b036b3e691</guid>
  <pubDate>Wed, 19 Feb 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/dad040a2-8866-4876-88fb-43b036b3e691.mp3" length="48903556" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We have a packed show for you this week! We'll sit down for an interview with Chris Buechler, from the pfSense project, to learn just how easy it can be to deploy a BSD firewall. We'll also be showing you a walkthrough of the pfSense interface so you can get an idea of just how convenient and powerful it is. Answers to your questions and the latest headlines, here on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:07:55</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We have a packed show for you this week! We'll sit down for an interview with Chris Buechler, from the pfSense project, to learn just how easy it can be to deploy a BSD firewall. We'll also be showing you a walkthrough of the pfSense interface so you can get an idea of just how convenient and powerful it is. Answers to your questions and the latest headlines, here on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
EuroBSDCon and AsiaBSDCon (http://2014.eurobsdcon.org/calendar/call-for-papers/)
This year, EuroBSDCon will be in September in Sofia, Bulgaria
They've got a call for papers up now, so everyone can submit the talks they want to present
There will also be a tutorial section of the conference
AsiaBSDCon (http://2014.asiabsdcon.org/timetable.html.en) will be next month, in March!
All the info about the registration, tutorials, hotels, timetable and location have been posted
Check the link for all the details on the talks - if you plan on going to Tokyo next month, hang out with Allan and Kris and lots of BSD developers!
***
FreeBSD 10 on Ubiquiti EdgeRouter Lite (http://rtfm.net/FreeBSD/ERL/)
The Ubiquiti EdgeRouter Lite is a router that costs less than $100 and has a MIPS CPU
This article goes through the process of installing and configuring FreeBSD on it to use as a home router
Lots of good pictures of the hardware and specific details needed to get you set up
It also includes the scripts to create your own images if you don't want to use the ones rolled by someone else
For such a cheap price, might be a really fun weekend project to replace your shitty consumer router
Of course if you're more of an OpenBSD guy, you can always see our tutorial (http://www.bsdnow.tv/tutorials/openbsd-router) for that too
***
Signed pkgsrc package guide (http://blog.saveosx.org/signed-packages/)
We got a request on IRC for more pkgsrc stuff on the show, and a listener provided a nice write-up
It shows you how to set up signed packages with pkgsrc, which works on quite a few OSes (not just NetBSD)
He goes through the process of signing packages with a public key and how to verify the packages when you install them
The author also happens to be an EdgeBSD developer
***
Big batch of OpenBSD hackathon reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20140212083627)
Five trip reports from the OpenBSD hackathon in New Zealand! In the first one, jmatthew details his work on fiber channel controller drivers, some octeon USB work and ARM fixes for AHCI
In the second (http://undeadly.org/cgi?action=article&amp;amp;sid=20140213065843), ketennis gets into his work with running interrupt handlers without holding the kernel lock, some SPARC64 improvements and a few other things
In the third (http://undeadly.org/cgi?action=article&amp;amp;sid=20140213173808), jsg updated libdrm and mesa and did various work on xenocara
In the fourth (http://undeadly.org/cgi?action=article&amp;amp;sid=20140214070023), dlg came with the intention to improve SMP support, but got distracted and did SCSI stuff instead - but he talks a little bit about the struggle OpenBSD has with SMP and some of the work he's done
In the fifth (http://undeadly.org/cgi?action=article&amp;amp;sid=20140214130039), claudio talks about some stuff he did for routing tables and misc. other things
***
Interview - Chris Buechler - cmb@pfsense.com (mailto:cmb@pfsense.com) / @cbuechler (https://twitter.com/cbuechler)
pfSense
Tutorial
pfSense walkthrough
News Roundup
FreeBSD challenge continues (http://www.thelinuxcauldron.com/2014/02/13/freebsd-challenge-day-13-30/)
Our buddy from the Linux foundation continues his switching to BSD journey
In day 13, he covers some tips for new users, mentions trying things out in a VM first
In day 14 (http://www.thelinuxcauldron.com/2014/02/14/freebsd-challenge-day-14-30/), he starts setting up XFCE and X11, feels like he's starting over as a new Linux user learning the ropes again - concludes that ports are the way to go
In day 15 (http://www.thelinuxcauldron.com/2014/02/14/freebsd-challenge-day-15-30/), he finishes up his XFCE configuration and details different versions of ports with different names, as well as learns how to apply his first patch
In day 16 (http://www.thelinuxcauldron.com/2014/02/17/freebsd-challenge-day-16-30/), he dives into the world of FreeBSD jails (http://www.bsdnow.tv/tutorials/jails)!
***
BSD books in 2014 (http://blather.michaelwlucas.com/archives/1962)
BSD books are some of the highest quality technical writings available, and MWL has written a good number of them
In this post, he details some of his plans for 2014
In includes at least one OpenBSD book, at least one FreeBSD book and...
Very strong possibility of Absolute FreeBSD 3rd edition (watch our interview with him (http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop))
Check the link for all the details
***
How to build FreeBSD/EC2 images (http://www.daemonology.net/blog/2014-02-16-FreeBSD-EC2-build.html)
Our friend Colin Percival (http://www.bsdnow.tv/episodes/2014_01_22-tendresse_for_ten) details how to build EC2 images in a new blog post
Most people just use the images he makes on their instances, but some people will want to make their own from scratch (https://svnweb.freebsd.org/base/user/cperciva/EC2-build/)
You build a regular disk image and then turn it into an AMI
It requires a couple ports be installed on your system, but the whole process is pretty straightforward
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-17/)
This time around we discuss how you can become a developer
Kris also details the length of supported releases
Expect lots of new features in 10.1
***
Feedback/Questions
Sean writes in (http://slexy.org/view/s216xJoCVG)
Jake writes in (http://slexy.org/view/s2gLrR3VVf)
Niclas writes in (http://slexy.org/view/s21gfG3Iho)
Steffan writes in (http://slexy.org/view/s2JNyw5BCn)
Antonio writes in (http://slexy.org/view/s2kg3zoRfm)
Chris writes in (http://slexy.org/view/s2ZwSIfRjm)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, pfsense, pf, firewall, gateway, router, hangout, webui, web interface, php, ipfw, ipfilter, gateway, graphs, bandwidth, edgerouter, edgerouter lite, eurobsdcon, eurobsdcon2014, edge router, 2014, books, michael w lucas, freebsd journal, fosdem, asiabsdcon, mips, hackathon, new zealand, pkgsrc, signed packages, edgebsd, smp, ec2, amazon, images, instance, build, custom</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We have a packed show for you this week! We&#39;ll sit down for an interview with Chris Buechler, from the pfSense project, to learn just how easy it can be to deploy a BSD firewall. We&#39;ll also be showing you a walkthrough of the pfSense interface so you can get an idea of just how convenient and powerful it is. Answers to your questions and the latest headlines, here on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.eurobsdcon.org/calendar/call-for-papers/" rel="nofollow">EuroBSDCon and AsiaBSDCon</a></h3>

<ul>
<li>This year, EuroBSDCon will be in September in Sofia, Bulgaria</li>
<li>They&#39;ve got a call for papers up now, so everyone can submit the talks they want to present</li>
<li>There will also be a tutorial section of the conference</li>
<li><a href="http://2014.asiabsdcon.org/timetable.html.en" rel="nofollow">AsiaBSDCon</a> will be next month, in March!</li>
<li>All the info about the registration, tutorials, hotels, timetable and location have been posted</li>
<li>Check the link for all the details on the talks - if you plan on going to Tokyo next month, hang out with Allan and Kris and lots of BSD developers!
***</li>
</ul>

<h3><a href="http://rtfm.net/FreeBSD/ERL/" rel="nofollow">FreeBSD 10 on Ubiquiti EdgeRouter Lite</a></h3>

<ul>
<li>The Ubiquiti EdgeRouter Lite is a router that costs less than $100 and has a MIPS CPU</li>
<li>This article goes through the process of installing and configuring FreeBSD on it to use as a home router</li>
<li>Lots of good pictures of the hardware and specific details needed to get you set up</li>
<li>It also includes the scripts to create your own images if you don&#39;t want to use the ones rolled by someone else</li>
<li>For such a cheap price, might be a really fun weekend project to replace your shitty consumer router</li>
<li>Of course if you&#39;re more of an OpenBSD guy, you can always see <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">our tutorial</a> for that too
***</li>
</ul>

<h3><a href="http://blog.saveosx.org/signed-packages/" rel="nofollow">Signed pkgsrc package guide</a></h3>

<ul>
<li>We got a request on IRC for more pkgsrc stuff on the show, and a listener provided a nice write-up</li>
<li>It shows you how to set up signed packages with pkgsrc, which works on quite a few OSes (not just NetBSD)</li>
<li>He goes through the process of signing packages with a public key and how to verify the packages when you install them</li>
<li>The author also happens to be an EdgeBSD developer
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140212083627" rel="nofollow">Big batch of OpenBSD hackathon reports</a></h3>

<ul>
<li>Five trip reports from the OpenBSD hackathon in New Zealand! In the first one, jmatthew details his work on fiber channel controller drivers, some octeon USB work and ARM fixes for AHCI</li>
<li>In <a href="http://undeadly.org/cgi?action=article&sid=20140213065843" rel="nofollow">the second</a>, ketennis gets into his work with running interrupt handlers without holding the kernel lock, some SPARC64 improvements and a few other things</li>
<li>In <a href="http://undeadly.org/cgi?action=article&sid=20140213173808" rel="nofollow">the third</a>, jsg updated libdrm and mesa and did various work on xenocara</li>
<li>In <a href="http://undeadly.org/cgi?action=article&sid=20140214070023" rel="nofollow">the fourth</a>, dlg came with the intention to improve SMP support, but got distracted and did SCSI stuff instead - but he talks a little bit about the struggle OpenBSD has with SMP and some of the work he&#39;s done</li>
<li>In <a href="http://undeadly.org/cgi?action=article&sid=20140214130039" rel="nofollow">the fifth</a>, claudio talks about some stuff he did for routing tables and misc. other things
***</li>
</ul>

<h2>Interview - Chris Buechler - <a href="mailto:cmb@pfsense.com" rel="nofollow">cmb@pfsense.com</a> / <a href="https://twitter.com/cbuechler" rel="nofollow">@cbuechler</a></h2>

<p>pfSense</p>

<hr>

<h2>Tutorial</h2>

<h3>pfSense walkthrough</h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.thelinuxcauldron.com/2014/02/13/freebsd-challenge-day-13-30/" rel="nofollow">FreeBSD challenge continues</a></h3>

<ul>
<li>Our buddy from the Linux foundation continues his switching to BSD journey</li>
<li>In day 13, he covers some tips for new users, mentions trying things out in a VM first</li>
<li>In <a href="http://www.thelinuxcauldron.com/2014/02/14/freebsd-challenge-day-14-30/" rel="nofollow">day 14</a>, he starts setting up XFCE and X11, feels like he&#39;s starting over as a new Linux user learning the ropes again - concludes that ports are the way to go</li>
<li>In <a href="http://www.thelinuxcauldron.com/2014/02/14/freebsd-challenge-day-15-30/" rel="nofollow">day 15</a>, he finishes up his XFCE configuration and details different versions of ports with different names, as well as learns how to apply his first patch</li>
<li>In <a href="http://www.thelinuxcauldron.com/2014/02/17/freebsd-challenge-day-16-30/" rel="nofollow">day 16</a>, he dives into the world of <a href="http://www.bsdnow.tv/tutorials/jails" rel="nofollow">FreeBSD jails</a>!
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/1962" rel="nofollow">BSD books in 2014</a></h3>

<ul>
<li>BSD books are some of the highest quality technical writings available, and MWL has written a good number of them</li>
<li>In this post, he details some of his plans for 2014</li>
<li>In includes at least one OpenBSD book, at least one FreeBSD book and...</li>
<li>Very strong possibility of Absolute FreeBSD 3rd edition (watch <a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">our interview with him</a>)</li>
<li>Check the link for all the details
***</li>
</ul>

<h3><a href="http://www.daemonology.net/blog/2014-02-16-FreeBSD-EC2-build.html" rel="nofollow">How to build FreeBSD/EC2 images</a></h3>

<ul>
<li>Our friend <a href="http://www.bsdnow.tv/episodes/2014_01_22-tendresse_for_ten" rel="nofollow">Colin Percival</a> details how to build EC2 images in a new blog post</li>
<li>Most people just use the images he makes on their instances, but some people will want to make their own <a href="https://svnweb.freebsd.org/base/user/cperciva/EC2-build/" rel="nofollow">from scratch</a></li>
<li>You build a regular disk image and then turn it into an AMI</li>
<li>It requires a couple ports be installed on your system, but the whole process is pretty straightforward
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-17/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>This time around we discuss how you can become a developer</li>
<li>Kris also details the length of supported releases</li>
<li>Expect lots of new features in 10.1
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s216xJoCVG" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s2gLrR3VVf" rel="nofollow">Jake writes in</a></li>
<li><a href="http://slexy.org/view/s21gfG3Iho" rel="nofollow">Niclas writes in</a></li>
<li><a href="http://slexy.org/view/s2JNyw5BCn" rel="nofollow">Steffan writes in</a></li>
<li><a href="http://slexy.org/view/s2kg3zoRfm" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s2ZwSIfRjm" rel="nofollow">Chris writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We have a packed show for you this week! We&#39;ll sit down for an interview with Chris Buechler, from the pfSense project, to learn just how easy it can be to deploy a BSD firewall. We&#39;ll also be showing you a walkthrough of the pfSense interface so you can get an idea of just how convenient and powerful it is. Answers to your questions and the latest headlines, here on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://2014.eurobsdcon.org/calendar/call-for-papers/" rel="nofollow">EuroBSDCon and AsiaBSDCon</a></h3>

<ul>
<li>This year, EuroBSDCon will be in September in Sofia, Bulgaria</li>
<li>They&#39;ve got a call for papers up now, so everyone can submit the talks they want to present</li>
<li>There will also be a tutorial section of the conference</li>
<li><a href="http://2014.asiabsdcon.org/timetable.html.en" rel="nofollow">AsiaBSDCon</a> will be next month, in March!</li>
<li>All the info about the registration, tutorials, hotels, timetable and location have been posted</li>
<li>Check the link for all the details on the talks - if you plan on going to Tokyo next month, hang out with Allan and Kris and lots of BSD developers!
***</li>
</ul>

<h3><a href="http://rtfm.net/FreeBSD/ERL/" rel="nofollow">FreeBSD 10 on Ubiquiti EdgeRouter Lite</a></h3>

<ul>
<li>The Ubiquiti EdgeRouter Lite is a router that costs less than $100 and has a MIPS CPU</li>
<li>This article goes through the process of installing and configuring FreeBSD on it to use as a home router</li>
<li>Lots of good pictures of the hardware and specific details needed to get you set up</li>
<li>It also includes the scripts to create your own images if you don&#39;t want to use the ones rolled by someone else</li>
<li>For such a cheap price, might be a really fun weekend project to replace your shitty consumer router</li>
<li>Of course if you&#39;re more of an OpenBSD guy, you can always see <a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">our tutorial</a> for that too
***</li>
</ul>

<h3><a href="http://blog.saveosx.org/signed-packages/" rel="nofollow">Signed pkgsrc package guide</a></h3>

<ul>
<li>We got a request on IRC for more pkgsrc stuff on the show, and a listener provided a nice write-up</li>
<li>It shows you how to set up signed packages with pkgsrc, which works on quite a few OSes (not just NetBSD)</li>
<li>He goes through the process of signing packages with a public key and how to verify the packages when you install them</li>
<li>The author also happens to be an EdgeBSD developer
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140212083627" rel="nofollow">Big batch of OpenBSD hackathon reports</a></h3>

<ul>
<li>Five trip reports from the OpenBSD hackathon in New Zealand! In the first one, jmatthew details his work on fiber channel controller drivers, some octeon USB work and ARM fixes for AHCI</li>
<li>In <a href="http://undeadly.org/cgi?action=article&sid=20140213065843" rel="nofollow">the second</a>, ketennis gets into his work with running interrupt handlers without holding the kernel lock, some SPARC64 improvements and a few other things</li>
<li>In <a href="http://undeadly.org/cgi?action=article&sid=20140213173808" rel="nofollow">the third</a>, jsg updated libdrm and mesa and did various work on xenocara</li>
<li>In <a href="http://undeadly.org/cgi?action=article&sid=20140214070023" rel="nofollow">the fourth</a>, dlg came with the intention to improve SMP support, but got distracted and did SCSI stuff instead - but he talks a little bit about the struggle OpenBSD has with SMP and some of the work he&#39;s done</li>
<li>In <a href="http://undeadly.org/cgi?action=article&sid=20140214130039" rel="nofollow">the fifth</a>, claudio talks about some stuff he did for routing tables and misc. other things
***</li>
</ul>

<h2>Interview - Chris Buechler - <a href="mailto:cmb@pfsense.com" rel="nofollow">cmb@pfsense.com</a> / <a href="https://twitter.com/cbuechler" rel="nofollow">@cbuechler</a></h2>

<p>pfSense</p>

<hr>

<h2>Tutorial</h2>

<h3>pfSense walkthrough</h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.thelinuxcauldron.com/2014/02/13/freebsd-challenge-day-13-30/" rel="nofollow">FreeBSD challenge continues</a></h3>

<ul>
<li>Our buddy from the Linux foundation continues his switching to BSD journey</li>
<li>In day 13, he covers some tips for new users, mentions trying things out in a VM first</li>
<li>In <a href="http://www.thelinuxcauldron.com/2014/02/14/freebsd-challenge-day-14-30/" rel="nofollow">day 14</a>, he starts setting up XFCE and X11, feels like he&#39;s starting over as a new Linux user learning the ropes again - concludes that ports are the way to go</li>
<li>In <a href="http://www.thelinuxcauldron.com/2014/02/14/freebsd-challenge-day-15-30/" rel="nofollow">day 15</a>, he finishes up his XFCE configuration and details different versions of ports with different names, as well as learns how to apply his first patch</li>
<li>In <a href="http://www.thelinuxcauldron.com/2014/02/17/freebsd-challenge-day-16-30/" rel="nofollow">day 16</a>, he dives into the world of <a href="http://www.bsdnow.tv/tutorials/jails" rel="nofollow">FreeBSD jails</a>!
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/1962" rel="nofollow">BSD books in 2014</a></h3>

<ul>
<li>BSD books are some of the highest quality technical writings available, and MWL has written a good number of them</li>
<li>In this post, he details some of his plans for 2014</li>
<li>In includes at least one OpenBSD book, at least one FreeBSD book and...</li>
<li>Very strong possibility of Absolute FreeBSD 3rd edition (watch <a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">our interview with him</a>)</li>
<li>Check the link for all the details
***</li>
</ul>

<h3><a href="http://www.daemonology.net/blog/2014-02-16-FreeBSD-EC2-build.html" rel="nofollow">How to build FreeBSD/EC2 images</a></h3>

<ul>
<li>Our friend <a href="http://www.bsdnow.tv/episodes/2014_01_22-tendresse_for_ten" rel="nofollow">Colin Percival</a> details how to build EC2 images in a new blog post</li>
<li>Most people just use the images he makes on their instances, but some people will want to make their own <a href="https://svnweb.freebsd.org/base/user/cperciva/EC2-build/" rel="nofollow">from scratch</a></li>
<li>You build a regular disk image and then turn it into an AMI</li>
<li>It requires a couple ports be installed on your system, but the whole process is pretty straightforward
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-17/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>This time around we discuss how you can become a developer</li>
<li>Kris also details the length of supported releases</li>
<li>Expect lots of new features in 10.1
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s216xJoCVG" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s2gLrR3VVf" rel="nofollow">Jake writes in</a></li>
<li><a href="http://slexy.org/view/s21gfG3Iho" rel="nofollow">Niclas writes in</a></li>
<li><a href="http://slexy.org/view/s2JNyw5BCn" rel="nofollow">Steffan writes in</a></li>
<li><a href="http://slexy.org/view/s2kg3zoRfm" rel="nofollow">Antonio writes in</a></li>
<li><a href="http://slexy.org/view/s2ZwSIfRjm" rel="nofollow">Chris writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>24: The Cluster &amp; The Cloud</title>
  <link>https://www.bsdnow.tv/24</link>
  <guid isPermaLink="false">4472f6f6-5fb3-4ee9-b20c-04e927cf1299</guid>
  <pubDate>Wed, 12 Feb 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4472f6f6-5fb3-4ee9-b20c-04e927cf1299.mp3" length="50214172" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on BSD Now... a wrap-up from NYCBSDCon! We'll also be talking to Luke Marsden, CEO of HybridCluster, about how they use BSD at large. Following that, our tutorial will show you how to securely share files with SFTP in a chroot. The latest news and answers to your questions, of course it's BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:09:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on BSD Now... a wrap-up from NYCBSDCon! We'll also be talking to Luke Marsden, CEO of HybridCluster, about how they use BSD at large. Following that, our tutorial will show you how to securely share files with SFTP in a chroot. The latest news and answers to your questions, of course it's BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
FreeBSD 10 as a firewall (http://www.pantz.org/software/pf/use_freebsd_10_as_a_pf_firewall.html)
Back in 2012, the author of this site wrote an article stating you should avoid FreeBSD 9 for a firewall and use OpenBSD instead
Now, with the release of 10.0, he's apparently changed his mind and switched back over
It mentions the SMP version of pf, general performance advantages and more modern features
The author is a regular listener of BSD Now, hi Joe!
***
Network Noise Reduction Using Free Tools (http://bsdly.blogspot.com/2014/02/effective-spam-and-malware.html)
Really long blog post, based on a BSDCan presentation, about fighting spam with OpenBSD
Peter Hansteen, author of the book of PF, goes through how he uses OpenBSD's spamd and other security features to combat spam and malware
He goes through his experiences with content filtering and disappointment with a certain proprietary vendor
Not totally BSD-specific, lots of people can enjoy the article - lots of virus history as well
***
FreeBSD ASLR patches submitted (http://0xfeedface.org/blog/lattera/2014-02-02/freebsd-aslr-patch-submitted-upstream)
So far, FreeBSD hasn't had Address Space Layout Randomization
ASLR is a nice security feature, see wikipedia (https://en.wikipedia.org/wiki/Address_space_layout_randomization) for more information
With a giant patch from Shawn Webb, it might be integrated into a future version (after a vicious review from the security team of course)
We might have Shawn on the show to talk about it, but he's also giving a presentation at BSDCan about his work with ASLR
***
Old-style pkg_ tools retired (http://blogs.freebsdish.org/portmgr/2014/02/03/time-to-bid-farewell-to-the-old-pkg_-tools/)
At last the old pkg_add tools are being retired in FreeBSD
pkgng (http://www.bsdnow.tv/tutorials/pkgng) is a huge improvement, and now portmgr@ thinks it's time to cut the cord on the legacy toolset
Ports aren't going away, and probably never will, but for binary package fans and new users that are used to things like apt, pkgng is the way to go
All pkg_ tools will be considered unsupported on September 1, 2014 - even on older branches
***
Interview - Luke Marsden - luke@hybridcluster.com (mailto:luke@hybridcluster.com) / @lmarsden (https://twitter.com/lmarsden)
BSD at HybridCluster
Tutorial
Filesharing with chrooted SFTP (http://www.bsdnow.tv/tutorials/chroot-sftp)
News Roundup
FreeBSD on OpenStack (http://pellaeon.github.io/bsd-cloudinit/)
OpenStack (https://en.wikipedia.org/wiki/OpenStack) is a cloud computing project
It consists of "a series of interrelated projects that control pools of processing, storage, and networking resources throughout a datacenter, able to be managed or provisioned through a web-based dashboard, command-line tools, or a RESTful API."
Until now, there wasn't a good way to run a full BSD instance on OpenStack
With a project in the vein of Colin Percival (http://www.bsdnow.tv/episodes/2014_01_22-tendresse_for_ten)'s AWS startup scripts, now that's no longer the case! 
***
FOSDEM BSD videos (https://fosdem.org/2014/schedule/track/bsd/)
This year's FOSDEM had seven BSD presentations
The videos are slowly being uploaded (https://video.fosdem.org/2014/) for your viewing pleasure
Not all of the BSD ones are up yet, but by the time you're watching this they might be!
Check this directory (https://video.fosdem.org/2014/AW1121/Saturday/) for most of 'em
The BSD dev room was full, lots of interest in what's going on from the other communities
***
The FreeBSD challenge finally returns! (http://www.thelinuxcauldron.com/2014/02/05/freebsd-challenge-returns-day-11-30/)
Due to prodding from a certain guy of a certain podcast, the "FreeBSD Challenge" series has finally resumed
Our friend from the Linux foundation picks up with day 11 (http://www.thelinuxcauldron.com/2014/02/05/freebsd-challenge-day-11-30/) and day 12 (http://www.thelinuxcauldron.com/2014/02/09/freebsd-challenge-day-12-30/) on his switching from Linux journey
This time he outlines the upgrade process of going from 9 to 10, using freebsd-update
There's also some notes about different options for upgrading ports and some extra tips
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-16/)
After the big 10.0 release, the PCBSD crew is focusing on bug fixes for a while
During their "fine tuning phase" users are encouraged to submit any and all bugs via the trac system
Warden got some fixes and the package manager got some updates as well
Huge size reduction in PBI format
***
Feedback/Questions
Derrick writes in (http://slexy.org/view/s21nbJKYmb)
Sean writes in (http://slexy.org/view/s2yhziVsBP)
Patrick writes in (http://slexy.org/view/s20PuccWbo)
Peter writes in (http://slexy.org/view/s22PL0SbUO)
Sean writes in (http://slexy.org/view/s20dkbjuOK)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, cluster, cloud, cloud computing, hybridcluster, jails, scaling, virtualization, zfs, big data, provisioning, webhosting, instances, web hosting, chroot, sftp, filesharing, file sharing, shell, linux, switching to bsd, linux user, smp, pkg_add, pkg, pkgng, binary packages, openstack, open stack, httperf, performance, http, vpn, nycbsdcon, nycbug, nyc, conference, convention, talks, presentation, keynote, ssh</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on BSD Now... a wrap-up from NYCBSDCon! We&#39;ll also be talking to Luke Marsden, CEO of HybridCluster, about how they use BSD at large. Following that, our tutorial will show you how to securely share files with SFTP in a chroot. The latest news and answers to your questions, of course it&#39;s BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.pantz.org/software/pf/use_freebsd_10_as_a_pf_firewall.html" rel="nofollow">FreeBSD 10 as a firewall</a></h3>

<ul>
<li>Back in 2012, the author of this site wrote an article stating you should avoid FreeBSD 9 for a firewall and use OpenBSD instead</li>
<li>Now, with the release of 10.0, he&#39;s apparently changed his mind and switched back over</li>
<li>It mentions the SMP version of pf, general performance advantages and more modern features</li>
<li>The author is a regular listener of BSD Now, hi Joe!
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2014/02/effective-spam-and-malware.html" rel="nofollow">Network Noise Reduction Using Free Tools</a></h3>

<ul>
<li>Really long blog post, based on a BSDCan presentation, about fighting spam with OpenBSD</li>
<li>Peter Hansteen, author of the book of PF, goes through how he uses OpenBSD&#39;s spamd and other security features to combat spam and malware</li>
<li>He goes through his experiences with content filtering and disappointment with a certain proprietary vendor</li>
<li>Not totally BSD-specific, lots of people can enjoy the article - lots of virus history as well
***</li>
</ul>

<h3><a href="http://0xfeedface.org/blog/lattera/2014-02-02/freebsd-aslr-patch-submitted-upstream" rel="nofollow">FreeBSD ASLR patches submitted</a></h3>

<ul>
<li>So far, FreeBSD hasn&#39;t had Address Space Layout Randomization</li>
<li>ASLR is a nice security feature, <a href="https://en.wikipedia.org/wiki/Address_space_layout_randomization" rel="nofollow">see wikipedia</a> for more information</li>
<li>With a giant patch from Shawn Webb, it might be integrated into a future version (after a vicious review from the security team of course)</li>
<li>We might have Shawn on the show to talk about it, but he&#39;s also giving a presentation at BSDCan about his work with ASLR
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/02/03/time-to-bid-farewell-to-the-old-pkg_-tools/" rel="nofollow">Old-style pkg_ tools retired</a></h3>

<ul>
<li>At last the old pkg_add tools are being retired in FreeBSD</li>
<li><a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">pkgng</a> is a huge improvement, and now portmgr@ thinks it&#39;s time to cut the cord on the legacy toolset</li>
<li>Ports aren&#39;t going away, and probably never will, but for binary package fans and new users that are used to things like apt, pkgng is the way to go</li>
<li>All pkg_ tools will be considered unsupported on September 1, 2014 - even on older branches
***</li>
</ul>

<h2>Interview - Luke Marsden - <a href="mailto:luke@hybridcluster.com" rel="nofollow">luke@hybridcluster.com</a> / <a href="https://twitter.com/lmarsden" rel="nofollow">@lmarsden</a></h2>

<p>BSD at HybridCluster</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/chroot-sftp" rel="nofollow">Filesharing with chrooted SFTP</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://pellaeon.github.io/bsd-cloudinit/" rel="nofollow">FreeBSD on OpenStack</a></h3>

<ul>
<li><a href="https://en.wikipedia.org/wiki/OpenStack" rel="nofollow">OpenStack</a> is a cloud computing project</li>
<li>It consists of &quot;a series of interrelated projects that control pools of processing, storage, and networking resources throughout a datacenter, able to be managed or provisioned through a web-based dashboard, command-line tools, or a RESTful API.&quot;</li>
<li>Until now, there wasn&#39;t a good way to run a full BSD instance on OpenStack</li>
<li>With a project in the vein of <a href="http://www.bsdnow.tv/episodes/2014_01_22-tendresse_for_ten" rel="nofollow">Colin Percival</a>&#39;s AWS startup scripts, now that&#39;s no longer the case! 
***</li>
</ul>

<h3><a href="https://fosdem.org/2014/schedule/track/bsd/" rel="nofollow">FOSDEM BSD videos</a></h3>

<ul>
<li>This year&#39;s FOSDEM had seven BSD presentations</li>
<li>The videos are <a href="https://video.fosdem.org/2014/" rel="nofollow">slowly being uploaded</a> for your viewing pleasure</li>
<li>Not all of the BSD ones are up yet, but by the time you&#39;re watching this they might be!</li>
<li>Check <a href="https://video.fosdem.org/2014/AW1121/Saturday/" rel="nofollow">this directory</a> for most of &#39;em</li>
<li>The BSD dev room was full, lots of interest in what&#39;s going on from the other communities
***</li>
</ul>

<h3><a href="http://www.thelinuxcauldron.com/2014/02/05/freebsd-challenge-returns-day-11-30/" rel="nofollow">The FreeBSD challenge finally returns!</a></h3>

<ul>
<li>Due to prodding from a certain guy of a certain podcast, the &quot;FreeBSD Challenge&quot; series has finally resumed</li>
<li>Our friend from the Linux foundation picks up with <a href="http://www.thelinuxcauldron.com/2014/02/05/freebsd-challenge-day-11-30/" rel="nofollow">day 11</a> and <a href="http://www.thelinuxcauldron.com/2014/02/09/freebsd-challenge-day-12-30/" rel="nofollow">day 12</a> on his switching from Linux journey</li>
<li>This time he outlines the upgrade process of going from 9 to 10, using freebsd-update</li>
<li>There&#39;s also some notes about different options for upgrading ports and some extra tips
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-16/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>After the big 10.0 release, the PCBSD crew is focusing on bug fixes for a while</li>
<li>During their &quot;fine tuning phase&quot; users are encouraged to submit any and all bugs via the trac system</li>
<li>Warden got some fixes and the package manager got some updates as well</li>
<li>Huge size reduction in PBI format
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21nbJKYmb" rel="nofollow">Derrick writes in</a></li>
<li><a href="http://slexy.org/view/s2yhziVsBP" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s20PuccWbo" rel="nofollow">Patrick writes in</a></li>
<li><a href="http://slexy.org/view/s22PL0SbUO" rel="nofollow">Peter writes in</a></li>
<li><a href="http://slexy.org/view/s20dkbjuOK" rel="nofollow">Sean writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on BSD Now... a wrap-up from NYCBSDCon! We&#39;ll also be talking to Luke Marsden, CEO of HybridCluster, about how they use BSD at large. Following that, our tutorial will show you how to securely share files with SFTP in a chroot. The latest news and answers to your questions, of course it&#39;s BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://www.pantz.org/software/pf/use_freebsd_10_as_a_pf_firewall.html" rel="nofollow">FreeBSD 10 as a firewall</a></h3>

<ul>
<li>Back in 2012, the author of this site wrote an article stating you should avoid FreeBSD 9 for a firewall and use OpenBSD instead</li>
<li>Now, with the release of 10.0, he&#39;s apparently changed his mind and switched back over</li>
<li>It mentions the SMP version of pf, general performance advantages and more modern features</li>
<li>The author is a regular listener of BSD Now, hi Joe!
***</li>
</ul>

<h3><a href="http://bsdly.blogspot.com/2014/02/effective-spam-and-malware.html" rel="nofollow">Network Noise Reduction Using Free Tools</a></h3>

<ul>
<li>Really long blog post, based on a BSDCan presentation, about fighting spam with OpenBSD</li>
<li>Peter Hansteen, author of the book of PF, goes through how he uses OpenBSD&#39;s spamd and other security features to combat spam and malware</li>
<li>He goes through his experiences with content filtering and disappointment with a certain proprietary vendor</li>
<li>Not totally BSD-specific, lots of people can enjoy the article - lots of virus history as well
***</li>
</ul>

<h3><a href="http://0xfeedface.org/blog/lattera/2014-02-02/freebsd-aslr-patch-submitted-upstream" rel="nofollow">FreeBSD ASLR patches submitted</a></h3>

<ul>
<li>So far, FreeBSD hasn&#39;t had Address Space Layout Randomization</li>
<li>ASLR is a nice security feature, <a href="https://en.wikipedia.org/wiki/Address_space_layout_randomization" rel="nofollow">see wikipedia</a> for more information</li>
<li>With a giant patch from Shawn Webb, it might be integrated into a future version (after a vicious review from the security team of course)</li>
<li>We might have Shawn on the show to talk about it, but he&#39;s also giving a presentation at BSDCan about his work with ASLR
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2014/02/03/time-to-bid-farewell-to-the-old-pkg_-tools/" rel="nofollow">Old-style pkg_ tools retired</a></h3>

<ul>
<li>At last the old pkg_add tools are being retired in FreeBSD</li>
<li><a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">pkgng</a> is a huge improvement, and now portmgr@ thinks it&#39;s time to cut the cord on the legacy toolset</li>
<li>Ports aren&#39;t going away, and probably never will, but for binary package fans and new users that are used to things like apt, pkgng is the way to go</li>
<li>All pkg_ tools will be considered unsupported on September 1, 2014 - even on older branches
***</li>
</ul>

<h2>Interview - Luke Marsden - <a href="mailto:luke@hybridcluster.com" rel="nofollow">luke@hybridcluster.com</a> / <a href="https://twitter.com/lmarsden" rel="nofollow">@lmarsden</a></h2>

<p>BSD at HybridCluster</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/chroot-sftp" rel="nofollow">Filesharing with chrooted SFTP</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://pellaeon.github.io/bsd-cloudinit/" rel="nofollow">FreeBSD on OpenStack</a></h3>

<ul>
<li><a href="https://en.wikipedia.org/wiki/OpenStack" rel="nofollow">OpenStack</a> is a cloud computing project</li>
<li>It consists of &quot;a series of interrelated projects that control pools of processing, storage, and networking resources throughout a datacenter, able to be managed or provisioned through a web-based dashboard, command-line tools, or a RESTful API.&quot;</li>
<li>Until now, there wasn&#39;t a good way to run a full BSD instance on OpenStack</li>
<li>With a project in the vein of <a href="http://www.bsdnow.tv/episodes/2014_01_22-tendresse_for_ten" rel="nofollow">Colin Percival</a>&#39;s AWS startup scripts, now that&#39;s no longer the case! 
***</li>
</ul>

<h3><a href="https://fosdem.org/2014/schedule/track/bsd/" rel="nofollow">FOSDEM BSD videos</a></h3>

<ul>
<li>This year&#39;s FOSDEM had seven BSD presentations</li>
<li>The videos are <a href="https://video.fosdem.org/2014/" rel="nofollow">slowly being uploaded</a> for your viewing pleasure</li>
<li>Not all of the BSD ones are up yet, but by the time you&#39;re watching this they might be!</li>
<li>Check <a href="https://video.fosdem.org/2014/AW1121/Saturday/" rel="nofollow">this directory</a> for most of &#39;em</li>
<li>The BSD dev room was full, lots of interest in what&#39;s going on from the other communities
***</li>
</ul>

<h3><a href="http://www.thelinuxcauldron.com/2014/02/05/freebsd-challenge-returns-day-11-30/" rel="nofollow">The FreeBSD challenge finally returns!</a></h3>

<ul>
<li>Due to prodding from a certain guy of a certain podcast, the &quot;FreeBSD Challenge&quot; series has finally resumed</li>
<li>Our friend from the Linux foundation picks up with <a href="http://www.thelinuxcauldron.com/2014/02/05/freebsd-challenge-day-11-30/" rel="nofollow">day 11</a> and <a href="http://www.thelinuxcauldron.com/2014/02/09/freebsd-challenge-day-12-30/" rel="nofollow">day 12</a> on his switching from Linux journey</li>
<li>This time he outlines the upgrade process of going from 9 to 10, using freebsd-update</li>
<li>There&#39;s also some notes about different options for upgrading ports and some extra tips
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/02/pc-bsd-weekly-feature-digest-16/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>After the big 10.0 release, the PCBSD crew is focusing on bug fixes for a while</li>
<li>During their &quot;fine tuning phase&quot; users are encouraged to submit any and all bugs via the trac system</li>
<li>Warden got some fixes and the package manager got some updates as well</li>
<li>Huge size reduction in PBI format
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21nbJKYmb" rel="nofollow">Derrick writes in</a></li>
<li><a href="http://slexy.org/view/s2yhziVsBP" rel="nofollow">Sean writes in</a></li>
<li><a href="http://slexy.org/view/s20PuccWbo" rel="nofollow">Patrick writes in</a></li>
<li><a href="http://slexy.org/view/s22PL0SbUO" rel="nofollow">Peter writes in</a></li>
<li><a href="http://slexy.org/view/s20dkbjuOK" rel="nofollow">Sean writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>23: Time Signatures</title>
  <link>https://www.bsdnow.tv/23</link>
  <guid isPermaLink="false">d9e9eb7a-e7aa-4029-8881-05cc5f75e8b6</guid>
  <pubDate>Wed, 05 Feb 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d9e9eb7a-e7aa-4029-8881-05cc5f75e8b6.mp3" length="54539109" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>On this week's episode, we'll be talking with Ted Unangst of the OpenBSD team about their new signing infrastructure. After that, we've got a tutorial on how to run your own NTP server. News, your feedback and even... the winner of our tutorial contest will be announced! So stay tuned to BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:15:44</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>On this week's episode, we'll be talking with Ted Unangst of the OpenBSD team about their new signing infrastructure. After that, we've got a tutorial on how to run your own NTP server. News, your feedback and even... the winner of our tutorial contest will be announced! So stay tuned to BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
FreeBSD foundation's 2013 fundraising results (http://freebsdfoundation.blogspot.com/2014/01/freebsd-foundation-announces-2013.html)
The FreeBSD foundation finally counted all the money they made in 2013
$768,562 from 1659 donors
Nice little blog post from the team with a giant beastie picture
"We have already started our 2014 fundraising efforts. As of the end of January we are just under $40,000. Our goal is to raise $1,000,000. We are currently finalizing our 2014 budget. We plan to publish both our 2013 financial report and our 2014 budget soon."
A special thanks to all the BSD Now listeners that contributed, the foundation was really glad that we sent some people their way (and they mentioned us on Facebook)
***
OpenSSH 6.5 released (https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-January/032152.html)
We mentioned the CFT last week, and it's finally here (https://news.ycombinator.com/item?id=7154925)!
New key exchange using elliptic-curve Diffie Hellman in Daniel Bernstein's Curve25519 (now the default when both clients support it)
Ed25519 public keys are now available for host keys and user keys, considered more secure than DSA and ECDSA
Funny side effect: if you ONLY enable ed25519 host keys, all the compromised Linux boxes can't even attempt to login (http://slexy.org/view/s2rI13v8F4) lol~
New bcrypt private key type, 500,000,000 times harder to brute force
Chacha20-poly1305 transport cipher that builds an encrypted and authenticated stream in one
Portable version already in (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=261320) FreeBSD -CURRENT, and ports (https://svnweb.freebsd.org/ports?view=revision&amp;amp;sortby=date&amp;amp;revision=342618)
Lots more bugfixes and features, see the full release note or our interview (http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline) with Damien
Work has already started on 6.6, which can be used without OpenSSL (https://twitter.com/msfriedl/status/427902493176377344)!
***
Crazed Ferrets in a Berkeley Shower (http://blather.michaelwlucas.com/archives/1942)
In 2000, MWL (http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop) wrote an essay for linux.com about why he uses the BSD license: "It’s actually stood up fairly well to the test of time, but it’s fourteen years old now."
This is basically an updated version about why he uses the BSD license, in response to recent comments from Richard Stallman (http://gcc.gnu.org/ml/gcc/2014-01/msg00247.html)
Very nice post that gives some history about Berkeley, the basics of the BSD-style licenses and their contrast to the GNU GPL
Check out the full post if you're one of those people that gets into license arguments
The takeaway is "BSD is about making the world a better place. For everyone."
***
OpenBSD on BeagleBone Black (http://www.tedunangst.com/flak/post/OpenBSD-on-BeagleBone-Black)
Beaglebone Blacks are cheap little ARM devices similar to a Raspberry Pi
A blog post about installing OpenBSD on a BBB from.. our guest for today!
He describes it as "everything I wish I knew before installing the newly renamed armv7 port on a BeagleBone Black"
It goes through the whole process, details different storage options and some workarounds
Could be a really fun weekend project if you're interested in small or embedded devices
***
Interview - Ted Unangst - tedu@openbsd.org (mailto:tedu@openbsd.org) / @tedunangst (https://twitter.com/tedunangst)
OpenBSD's signify (http://www.tedunangst.com/flak/post/signify) infrastructure, ZFS on OpenBSD
Tutorial
Running an NTP server (http://www.bsdnow.tv/tutorials/ntpd)
News Roundup
Getting started with FreeBSD (http://smyck.net/2014/02/01/getting-started-with-freebsd/)
A new video and blog series about starting out with FreeBSD
The author has been a fan since the 90s and has installed it on every server he's worked with
He mentioned some of the advantages of BSD over Linux and how to approach explaining them to new users
The first video is the installation, then he goes on to packages and other topics - 4 videos so far
***
More OpenBSD hackathon reports (http://undeadly.org/cgi?action=article&amp;amp;sid=20140204080515)
As a followup to last week, this time Kenneth Westerback writes about his NZ hackathon experience
He arrived with two goals: disklabel fixes for drives with 4k sectors and some dhclient work
This summary goes into detail about all the stuff he got done there
***
X11 in a jail (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=261266)
We've gotten at least one feedback email about running X in a jail Well.. with this commit, looks like now you can!
A new tunable option will let jails access /dev/kmem and similar device nodes
Along with a change to DRM, this allows full X11 in a jail
Be sure to check out our jail tutorial and jailed VNC tutorial (http://www.bsdnow.tv/tutorials) for ideas
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/01/whoami-im-pc-bsd-10-0-weekly-feature-digest-15/)
10.0 "Joule Edition" finally released (http://blog.pcbsd.org/2014/01/pc-bsd-10-0-release-is-now-available/)!
AMD graphics are now officially supported
GNOME3, MATE and Cinnamon desktops are available
Grub updates and fixes
PCBSD also got a mention in eweek (http://www.eweek.com/enterprise-apps/slideshows/freebsd-open-source-os-comes-to-the-pc-bsd-desktop.html)
***
Feedback/Questions
Justin writes in (http://slexy.org/view/s21VnbKZsH)
Daniel writes in (http://slexy.org/view/s2nD7RF6bo)
Martin writes in (http://slexy.org/view/s2jwRrj7UV)
Alex writes in (http://slexy.org/view/s201koMD2c) - unofficial FreeBSD RPI Images (http://people.freebsd.org/~gjb/RPI/)
James writes in (http://slexy.org/view/s2AntZmtRU)
John writes in (http://slexy.org/view/s20bGjMsIQ)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, security, gpg, gnupg, signed, packages, iso, set, patches, ted unangst, verify, verification, digital signature, ed25519, chacha20, license, debate, gnu, gpl, general public license, copyleft, copyfree, free software, open source, rms, richard stallman, clang, llvm, cddl, linux, gplv2, gplv3, ntp, ntpd, openntpd, isc, network time protocol, server, ssh, openssh, 6.5, foundation, donations, gcm, aes, aes-gcm, hmac, arm, armv7, beaglebone, black, serial, tty, zol, leaseweb, zfsonlinux, ecc</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>On this week&#39;s episode, we&#39;ll be talking with Ted Unangst of the OpenBSD team about their new signing infrastructure. After that, we&#39;ve got a tutorial on how to run your own NTP server. News, your feedback and even... the winner of our tutorial contest will be announced! So stay tuned to BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/01/freebsd-foundation-announces-2013.html" rel="nofollow">FreeBSD foundation&#39;s 2013 fundraising results</a></h3>

<ul>
<li>The FreeBSD foundation finally counted all the money they made in 2013</li>
<li><strong>$768,562 from 1659 donors</strong></li>
<li>Nice little blog post from the team with a giant beastie picture</li>
<li>&quot;We have already started our 2014 fundraising efforts. As of the end of January we are just under $40,000. Our goal is to raise $1,000,000. We are currently finalizing our 2014 budget. We plan to publish both our 2013 financial report and our 2014 budget soon.&quot;</li>
<li>A special thanks to all the BSD Now listeners that contributed, the foundation was really glad that we sent some people their way (and they mentioned us on Facebook)
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-January/032152.html" rel="nofollow">OpenSSH 6.5 released</a></h3>

<ul>
<li>We mentioned the CFT last week, and it&#39;s <a href="https://news.ycombinator.com/item?id=7154925" rel="nofollow">finally here</a>!</li>
<li>New key exchange using elliptic-curve Diffie Hellman in Daniel Bernstein&#39;s Curve25519 (now the default when both clients support it)</li>
<li>Ed25519 public keys are now available for host keys and user keys, considered more secure than DSA and ECDSA</li>
<li>Funny side effect: if you ONLY enable ed25519 host keys, all the compromised Linux boxes <a href="http://slexy.org/view/s2rI13v8F4" rel="nofollow">can&#39;t even attempt to login</a> lol~</li>
<li>New bcrypt private key type, 500,000,000 times harder to brute force</li>
<li>Chacha20-poly1305 transport cipher that builds an encrypted and authenticated stream in one</li>
<li>Portable version <a href="https://svnweb.freebsd.org/base?view=revision&revision=261320" rel="nofollow">already in</a> FreeBSD -CURRENT, <a href="https://svnweb.freebsd.org/ports?view=revision&sortby=date&revision=342618" rel="nofollow">and ports</a></li>
<li>Lots more bugfixes and features, see the full release note or <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">our interview</a> with Damien</li>
<li>Work has already started on 6.6, which <a href="https://twitter.com/msfriedl/status/427902493176377344" rel="nofollow">can be used without OpenSSL</a>!
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/1942" rel="nofollow">Crazed Ferrets in a Berkeley Shower</a></h3>

<ul>
<li>In 2000, <a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">MWL</a> wrote an essay for linux.com about why he uses the BSD license: &quot;It’s actually stood up fairly well to the test of time, but it’s fourteen years old now.&quot;</li>
<li>This is basically an updated version about why he uses the BSD license, in response to recent <a href="http://gcc.gnu.org/ml/gcc/2014-01/msg00247.html" rel="nofollow">comments from Richard Stallman</a></li>
<li>Very nice post that gives some history about Berkeley, the basics of the BSD-style licenses and their contrast to the GNU GPL</li>
<li>Check out the full post if you&#39;re one of those people that gets into license arguments</li>
<li>The takeaway is &quot;BSD is about making the world a better place. For everyone.&quot;
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/OpenBSD-on-BeagleBone-Black" rel="nofollow">OpenBSD on BeagleBone Black</a></h3>

<ul>
<li>Beaglebone Blacks are cheap little ARM devices similar to a Raspberry Pi</li>
<li>A blog post about installing OpenBSD on a BBB from.. our guest for today!</li>
<li>He describes it as &quot;everything I wish I knew before installing the newly renamed armv7 port on a BeagleBone Black&quot;</li>
<li>It goes through the whole process, details different storage options and some workarounds</li>
<li>Could be a really fun weekend project if you&#39;re interested in small or embedded devices
***</li>
</ul>

<h2>Interview - Ted Unangst - <a href="mailto:tedu@openbsd.org" rel="nofollow">tedu@openbsd.org</a> / <a href="https://twitter.com/tedunangst" rel="nofollow">@tedunangst</a></h2>

<p>OpenBSD&#39;s <a href="http://www.tedunangst.com/flak/post/signify" rel="nofollow">signify</a> infrastructure, ZFS on OpenBSD</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">Running an NTP server</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://smyck.net/2014/02/01/getting-started-with-freebsd/" rel="nofollow">Getting started with FreeBSD</a></h3>

<ul>
<li>A new video and blog series about starting out with FreeBSD</li>
<li>The author has been a fan since the 90s and has installed it on every server he&#39;s worked with</li>
<li>He mentioned some of the advantages of BSD over Linux and how to approach explaining them to new users</li>
<li>The first video is the installation, then he goes on to packages and other topics - 4 videos so far
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140204080515" rel="nofollow">More OpenBSD hackathon reports</a></h3>

<ul>
<li>As a followup to last week, this time Kenneth Westerback writes about his NZ hackathon experience</li>
<li>He arrived with two goals: disklabel fixes for drives with 4k sectors and some dhclient work</li>
<li>This summary goes into detail about all the stuff he got done there
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=261266" rel="nofollow">X11 in a jail</a></h3>

<ul>
<li>We&#39;ve gotten at least one feedback email about running X in a jail Well.. with this commit, looks like now you can!</li>
<li>A new tunable option will let jails access /dev/kmem and similar device nodes</li>
<li>Along with a change to DRM, this allows full X11 in a jail</li>
<li>Be sure to check out our <a href="http://www.bsdnow.tv/tutorials" rel="nofollow">jail tutorial and jailed VNC tutorial</a> for ideas
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/01/whoami-im-pc-bsd-10-0-weekly-feature-digest-15/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>10.0 &quot;Joule Edition&quot; <a href="http://blog.pcbsd.org/2014/01/pc-bsd-10-0-release-is-now-available/" rel="nofollow">finally released</a>!</li>
<li>AMD graphics are now officially supported</li>
<li>GNOME3, MATE and Cinnamon desktops are available</li>
<li>Grub updates and fixes</li>
<li>PCBSD also <a href="http://www.eweek.com/enterprise-apps/slideshows/freebsd-open-source-os-comes-to-the-pc-bsd-desktop.html" rel="nofollow">got a mention in eweek</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21VnbKZsH" rel="nofollow">Justin writes in</a></li>
<li><a href="http://slexy.org/view/s2nD7RF6bo" rel="nofollow">Daniel writes in</a></li>
<li><a href="http://slexy.org/view/s2jwRrj7UV" rel="nofollow">Martin writes in</a></li>
<li><a href="http://slexy.org/view/s201koMD2c" rel="nofollow">Alex writes in</a> - <a href="http://people.freebsd.org/%7Egjb/RPI/" rel="nofollow">unofficial FreeBSD RPI Images</a></li>
<li><a href="http://slexy.org/view/s2AntZmtRU" rel="nofollow">James writes in</a></li>
<li><a href="http://slexy.org/view/s20bGjMsIQ" rel="nofollow">John writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>On this week&#39;s episode, we&#39;ll be talking with Ted Unangst of the OpenBSD team about their new signing infrastructure. After that, we&#39;ve got a tutorial on how to run your own NTP server. News, your feedback and even... the winner of our tutorial contest will be announced! So stay tuned to BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2014/01/freebsd-foundation-announces-2013.html" rel="nofollow">FreeBSD foundation&#39;s 2013 fundraising results</a></h3>

<ul>
<li>The FreeBSD foundation finally counted all the money they made in 2013</li>
<li><strong>$768,562 from 1659 donors</strong></li>
<li>Nice little blog post from the team with a giant beastie picture</li>
<li>&quot;We have already started our 2014 fundraising efforts. As of the end of January we are just under $40,000. Our goal is to raise $1,000,000. We are currently finalizing our 2014 budget. We plan to publish both our 2013 financial report and our 2014 budget soon.&quot;</li>
<li>A special thanks to all the BSD Now listeners that contributed, the foundation was really glad that we sent some people their way (and they mentioned us on Facebook)
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-January/032152.html" rel="nofollow">OpenSSH 6.5 released</a></h3>

<ul>
<li>We mentioned the CFT last week, and it&#39;s <a href="https://news.ycombinator.com/item?id=7154925" rel="nofollow">finally here</a>!</li>
<li>New key exchange using elliptic-curve Diffie Hellman in Daniel Bernstein&#39;s Curve25519 (now the default when both clients support it)</li>
<li>Ed25519 public keys are now available for host keys and user keys, considered more secure than DSA and ECDSA</li>
<li>Funny side effect: if you ONLY enable ed25519 host keys, all the compromised Linux boxes <a href="http://slexy.org/view/s2rI13v8F4" rel="nofollow">can&#39;t even attempt to login</a> lol~</li>
<li>New bcrypt private key type, 500,000,000 times harder to brute force</li>
<li>Chacha20-poly1305 transport cipher that builds an encrypted and authenticated stream in one</li>
<li>Portable version <a href="https://svnweb.freebsd.org/base?view=revision&revision=261320" rel="nofollow">already in</a> FreeBSD -CURRENT, <a href="https://svnweb.freebsd.org/ports?view=revision&sortby=date&revision=342618" rel="nofollow">and ports</a></li>
<li>Lots more bugfixes and features, see the full release note or <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">our interview</a> with Damien</li>
<li>Work has already started on 6.6, which <a href="https://twitter.com/msfriedl/status/427902493176377344" rel="nofollow">can be used without OpenSSL</a>!
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/1942" rel="nofollow">Crazed Ferrets in a Berkeley Shower</a></h3>

<ul>
<li>In 2000, <a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">MWL</a> wrote an essay for linux.com about why he uses the BSD license: &quot;It’s actually stood up fairly well to the test of time, but it’s fourteen years old now.&quot;</li>
<li>This is basically an updated version about why he uses the BSD license, in response to recent <a href="http://gcc.gnu.org/ml/gcc/2014-01/msg00247.html" rel="nofollow">comments from Richard Stallman</a></li>
<li>Very nice post that gives some history about Berkeley, the basics of the BSD-style licenses and their contrast to the GNU GPL</li>
<li>Check out the full post if you&#39;re one of those people that gets into license arguments</li>
<li>The takeaway is &quot;BSD is about making the world a better place. For everyone.&quot;
***</li>
</ul>

<h3><a href="http://www.tedunangst.com/flak/post/OpenBSD-on-BeagleBone-Black" rel="nofollow">OpenBSD on BeagleBone Black</a></h3>

<ul>
<li>Beaglebone Blacks are cheap little ARM devices similar to a Raspberry Pi</li>
<li>A blog post about installing OpenBSD on a BBB from.. our guest for today!</li>
<li>He describes it as &quot;everything I wish I knew before installing the newly renamed armv7 port on a BeagleBone Black&quot;</li>
<li>It goes through the whole process, details different storage options and some workarounds</li>
<li>Could be a really fun weekend project if you&#39;re interested in small or embedded devices
***</li>
</ul>

<h2>Interview - Ted Unangst - <a href="mailto:tedu@openbsd.org" rel="nofollow">tedu@openbsd.org</a> / <a href="https://twitter.com/tedunangst" rel="nofollow">@tedunangst</a></h2>

<p>OpenBSD&#39;s <a href="http://www.tedunangst.com/flak/post/signify" rel="nofollow">signify</a> infrastructure, ZFS on OpenBSD</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ntpd" rel="nofollow">Running an NTP server</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://smyck.net/2014/02/01/getting-started-with-freebsd/" rel="nofollow">Getting started with FreeBSD</a></h3>

<ul>
<li>A new video and blog series about starting out with FreeBSD</li>
<li>The author has been a fan since the 90s and has installed it on every server he&#39;s worked with</li>
<li>He mentioned some of the advantages of BSD over Linux and how to approach explaining them to new users</li>
<li>The first video is the installation, then he goes on to packages and other topics - 4 videos so far
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140204080515" rel="nofollow">More OpenBSD hackathon reports</a></h3>

<ul>
<li>As a followup to last week, this time Kenneth Westerback writes about his NZ hackathon experience</li>
<li>He arrived with two goals: disklabel fixes for drives with 4k sectors and some dhclient work</li>
<li>This summary goes into detail about all the stuff he got done there
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=261266" rel="nofollow">X11 in a jail</a></h3>

<ul>
<li>We&#39;ve gotten at least one feedback email about running X in a jail Well.. with this commit, looks like now you can!</li>
<li>A new tunable option will let jails access /dev/kmem and similar device nodes</li>
<li>Along with a change to DRM, this allows full X11 in a jail</li>
<li>Be sure to check out our <a href="http://www.bsdnow.tv/tutorials" rel="nofollow">jail tutorial and jailed VNC tutorial</a> for ideas
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/01/whoami-im-pc-bsd-10-0-weekly-feature-digest-15/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>10.0 &quot;Joule Edition&quot; <a href="http://blog.pcbsd.org/2014/01/pc-bsd-10-0-release-is-now-available/" rel="nofollow">finally released</a>!</li>
<li>AMD graphics are now officially supported</li>
<li>GNOME3, MATE and Cinnamon desktops are available</li>
<li>Grub updates and fixes</li>
<li>PCBSD also <a href="http://www.eweek.com/enterprise-apps/slideshows/freebsd-open-source-os-comes-to-the-pc-bsd-desktop.html" rel="nofollow">got a mention in eweek</a>
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21VnbKZsH" rel="nofollow">Justin writes in</a></li>
<li><a href="http://slexy.org/view/s2nD7RF6bo" rel="nofollow">Daniel writes in</a></li>
<li><a href="http://slexy.org/view/s2jwRrj7UV" rel="nofollow">Martin writes in</a></li>
<li><a href="http://slexy.org/view/s201koMD2c" rel="nofollow">Alex writes in</a> - <a href="http://people.freebsd.org/%7Egjb/RPI/" rel="nofollow">unofficial FreeBSD RPI Images</a></li>
<li><a href="http://slexy.org/view/s2AntZmtRU" rel="nofollow">James writes in</a></li>
<li><a href="http://slexy.org/view/s20bGjMsIQ" rel="nofollow">John writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>22: Journaled News-Updates</title>
  <link>https://www.bsdnow.tv/22</link>
  <guid isPermaLink="false">e49b46fd-a367-451d-819a-544b35fc4f89</guid>
  <pubDate>Wed, 29 Jan 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e49b46fd-a367-451d-819a-544b35fc4f89.mp3" length="64949427" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we'll be talking with George Neville-Neil about the brand new FreeBSD Journal and what it's all about. After that, we've got a tutorial on how to track the -stable and -current branches of OpenBSD. Answers to all your BSD questions and the latest headlines, only on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:30:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we'll be talking with George Neville-Neil about the brand new FreeBSD Journal and what it's all about. After that, we've got a tutorial on how to track the -stable and -current branches of OpenBSD. Answers to all your BSD questions and the latest headlines, only on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
FreeBSD quarterly status report (https://lists.freebsd.org/pipermail/freebsd-stable/2014-January/077085.html)
Gabor Pali sent out the October-December 2013 status report to get everyone up to date on what's going on
The report contains 37 entries and is very very long... various reports from all the different teams under the FreeBSD umbrella, probably too many to even list in the show notes
Lots of work going on in the ARM world, EC2/Xen and Google Compute Engine are also improving
Secure boot support hopefully coming by mid-year (www.itwire.com/business-it-news/open-source/62855-freebsd-to-support-secure-boot-by-mid-year)
There's quite a bit going on in the FreeBSD world, many projects happening at the same time
***
n2k14 OpenBSD Hackathon Report (http://undeadly.org/cgi?action=article&amp;amp;sid=20140124142027)
Recently, OpenBSD held one of their hackathons (http://www.openbsd.org/hackathons.html) in New Zealand
15 developers gathered there to sit in a room and write code for a few days
Philip Guenther brings back a nice report of the event
If you've been watching the -current CVS logs, you've seen the flood of commits just from this event alone
Fixes with threading, Linux compat, ACPI, and various other things - some will make it into 5.5 and others need more testing
Another report from Theo (http://undeadly.org/cgi?action=article&amp;amp;sid=20140127083112) details his work
Updates to the random subsystem, some work-in-progress pf fixes, suspend/resume fixes and more signing stuff
***
Four new NetBSD releases (https://blog.netbsd.org/tnf/entry/netbsd_6_1_3_netbsd)
NetBSD released versions 6.1.3, 6.0.4, 5.2.2 and 5.1.4
These updates include lots of bug fixes and some security updates, not focused on new features
You can upgrade depending on what branch you're currently on
Confused about the different branches? See this graph. (https://www.netbsd.org/releases/release-map.html#graph1)
***
The future of open source ZFS development  (http://sites.ieee.org/scv-cs/archives/openzfs-future-open-source-zfs-development)
On February 11, 2014, Matt Ahrens will be giving a presentation about ZFS
The talk will be about the future of ZFS and the open source development since Oracle closed the code
It's in San Jose, California - go if you can!
***
Interview - George Neville-Neil - gnn@freebsd.org (mailto:gnn@freebsd.org) / @gvnn3 (https://twitter.com/gvnn3)
The FreeBSD Journal (http://freebsdjournal.com/)
Tutorial
Tracking -STABLE and -CURRENT (OpenBSD) (http://www.bsdnow.tv/tutorials/stable-current-obsd)
News Roundup
pfSense news and 2.1.1 snapshots (https://doc.pfsense.org/index.php/2.1.1_New_Features_and_Changes)
pfSense has some snapshots available for the upcoming 2.1.1 release
They include FreeBSD security fixes as well as some other updates
There are recordings posted (https://blog.pfsense.org/?p=1198) of some of the previous hangouts
Unfortunately they're only for subscribers, so you'll have to wait until next month when we have Chris on the show to talk about pfSense!
***
FreeBSD on Google Compute Engine (https://groups.google.com/forum/#!msg/gce-discussion/YWoa3Aa_49U/FYAg9oiRlLUJ)
Recently we mentioned some posts about getting OpenBSD to run on GCE, here's the FreeBSD version
Nice big fat warning: "The team has put together a best-effort posting that will get most, if not all, of you up and running. That being said, we need to remind you that FreeBSD is being supported on Google Compute Engine by the community. The instructions are being provided as-is and without warranty."
Their instructions are a little too Linuxy (assuming wget, etc.) for our taste, someone should probably get it updated!
Other than that it's a pretty good set of instructions on how to get up and running
***
Dragonfly ACPI update (http://www.shiningsilence.com/dbsdlog/2014/01/22/13225.html)
Sascha Wildner committed some new ACPI code (http://lists.dragonflybsd.org/pipermail/commits/2014-January/199071.html)
There's also a "heads up" to update your BIOS (http://lists.dragonflybsd.org/pipermail/users/2014-January/090504.html) if you experience problems
Check the mailing list post for all the details
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-6/)
10.0-RC4 users need to upgrade all their packages for 10.0-RC5
PBIs needed to be rebuilt.. actually everything did
Help test GNOME 3 so we can get it in the official ports tree
By the way, I think Kris has an announcement - PCBSD 10.0 is out!
***
Feedback/Questions
Tony writes in (http://slexy.org/view/s21ZlfOdTt)
Jeff writes in (http://slexy.org/view/s2BFZ68Na5)
Remy writes in (http://slexy.org/view/s20epArsQI)
Nils writes in (http://slexy.org/view/s213CoNvLt)
Solomon writes in (http://slexy.org/view/s21XWnThNS)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, freebsd journal, journal, news, stable, current, cvs, anoncvs, branch, update, upgrade, binary, buildworld, make build, release engineering, ufs, ffs, gce, google compute engine, openzfs, zfs, matt ahrens, uefi, efi, secureboot, secure boot, acpi, pfsense, poudriere, hackathon, new zealand, n2k14, george neville-neil, gnn, nycbsdcon, nyc, convention, conference</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ll be talking with George Neville-Neil about the brand new FreeBSD Journal and what it&#39;s all about. After that, we&#39;ve got a tutorial on how to track the -stable and -current branches of OpenBSD. Answers to all your BSD questions and the latest headlines, only on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-January/077085.html" rel="nofollow">FreeBSD quarterly status report</a></h3>

<ul>
<li>Gabor Pali sent out the October-December 2013 status report to get everyone up to date on what&#39;s going on</li>
<li>The report contains 37 entries and is very very long... various reports from all the different teams under the FreeBSD umbrella, probably too many to even list in the show notes</li>
<li>Lots of work going on in the ARM world, EC2/Xen and Google Compute Engine are also improving</li>
<li>Secure boot support hopefully coming [by mid-year](<a href="http://www.itwire.com/business-it-news/open-source/62855-freebsd-to-support-secure-boot-by-mid-year" rel="nofollow">www.itwire.com/business-it-news/open-source/62855-freebsd-to-support-secure-boot-by-mid-year</a>)</li>
<li>There&#39;s quite a bit going on in the FreeBSD world, many projects happening at the same time
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140124142027" rel="nofollow">n2k14 OpenBSD Hackathon Report</a></h3>

<ul>
<li>Recently, OpenBSD held one of <a href="http://www.openbsd.org/hackathons.html" rel="nofollow">their hackathons</a> in New Zealand</li>
<li>15 developers gathered there to sit in a room and write code for a few days</li>
<li>Philip Guenther brings back a nice report of the event</li>
<li>If you&#39;ve been watching the -current CVS logs, you&#39;ve seen the flood of commits just from this event alone</li>
<li>Fixes with threading, Linux compat, ACPI, and various other things - some will make it into 5.5 and others need more testing</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140127083112" rel="nofollow">Another report from Theo</a> details his work</li>
<li>Updates to the random subsystem, some work-in-progress pf fixes, suspend/resume fixes and more signing stuff
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_6_1_3_netbsd" rel="nofollow">Four new NetBSD releases</a></h3>

<ul>
<li>NetBSD released versions 6.1.3, 6.0.4, 5.2.2 and 5.1.4</li>
<li>These updates include lots of bug fixes and some security updates, not focused on new features</li>
<li>You can upgrade depending on what branch you&#39;re currently on</li>
<li>Confused about the different branches? <a href="https://www.netbsd.org/releases/release-map.html#graph1" rel="nofollow">See this graph.</a>
***</li>
</ul>

<h3><a href="http://sites.ieee.org/scv-cs/archives/openzfs-future-open-source-zfs-development" rel="nofollow">The future of open source ZFS development </a></h3>

<ul>
<li>On February 11, 2014, Matt Ahrens will be giving a presentation about ZFS</li>
<li>The talk will be about the future of ZFS and the open source development since Oracle closed the code</li>
<li>It&#39;s in San Jose, California - go if you can!
***</li>
</ul>

<h2>Interview - George Neville-Neil - <a href="mailto:gnn@freebsd.org" rel="nofollow">gnn@freebsd.org</a> / <a href="https://twitter.com/gvnn3" rel="nofollow">@gvnn3</a></h2>

<p><a href="http://freebsdjournal.com/" rel="nofollow">The FreeBSD Journal</a></p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/stable-current-obsd" rel="nofollow">Tracking -STABLE and -CURRENT (OpenBSD)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://doc.pfsense.org/index.php/2.1.1_New_Features_and_Changes" rel="nofollow">pfSense news and 2.1.1 snapshots</a></h3>

<ul>
<li>pfSense has some snapshots available for the upcoming 2.1.1 release</li>
<li>They include FreeBSD security fixes as well as some other updates</li>
<li>There are <a href="https://blog.pfsense.org/?p=1198" rel="nofollow">recordings posted</a> of some of the previous hangouts</li>
<li>Unfortunately they&#39;re only for subscribers, so you&#39;ll have to wait until next month when we have Chris on the show to talk about pfSense!
***</li>
</ul>

<h3><a href="https://groups.google.com/forum/#!msg/gce-discussion/YWoa3Aa_49U/FYAg9oiRlLUJ" rel="nofollow">FreeBSD on Google Compute Engine</a></h3>

<ul>
<li>Recently we mentioned some posts about getting OpenBSD to run on GCE, here&#39;s the FreeBSD version</li>
<li>Nice big fat warning: &quot;The team has put together a best-effort posting that will get most, if not all, of you up and running. That being said, we need to remind you that FreeBSD is being supported on Google Compute Engine by the community. The instructions are being provided as-is and without warranty.&quot;</li>
<li>Their instructions are a little too Linuxy (assuming wget, etc.) for our taste, someone should probably get it updated!</li>
<li>Other than that it&#39;s a pretty good set of instructions on how to get up and running
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2014/01/22/13225.html" rel="nofollow">Dragonfly ACPI update</a></h3>

<ul>
<li>Sascha Wildner committed some <a href="http://lists.dragonflybsd.org/pipermail/commits/2014-January/199071.html" rel="nofollow">new ACPI code</a></li>
<li>There&#39;s also a &quot;heads up&quot; to <a href="http://lists.dragonflybsd.org/pipermail/users/2014-January/090504.html" rel="nofollow">update your BIOS</a> if you experience problems</li>
<li>Check the mailing list post for all the details
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-6/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>10.0-RC4 users need to upgrade all their packages for 10.0-RC5</li>
<li>PBIs needed to be rebuilt.. actually everything did</li>
<li>Help test GNOME 3 so we can get it in the official ports tree</li>
<li>By the way, I think Kris has an announcement - PCBSD 10.0 is out!
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21ZlfOdTt" rel="nofollow">Tony writes in</a></li>
<li><a href="http://slexy.org/view/s2BFZ68Na5" rel="nofollow">Jeff writes in</a></li>
<li><a href="http://slexy.org/view/s20epArsQI" rel="nofollow">Remy writes in</a></li>
<li><a href="http://slexy.org/view/s213CoNvLt" rel="nofollow">Nils writes in</a></li>
<li><a href="http://slexy.org/view/s21XWnThNS" rel="nofollow">Solomon writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ll be talking with George Neville-Neil about the brand new FreeBSD Journal and what it&#39;s all about. After that, we&#39;ve got a tutorial on how to track the -stable and -current branches of OpenBSD. Answers to all your BSD questions and the latest headlines, only on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-January/077085.html" rel="nofollow">FreeBSD quarterly status report</a></h3>

<ul>
<li>Gabor Pali sent out the October-December 2013 status report to get everyone up to date on what&#39;s going on</li>
<li>The report contains 37 entries and is very very long... various reports from all the different teams under the FreeBSD umbrella, probably too many to even list in the show notes</li>
<li>Lots of work going on in the ARM world, EC2/Xen and Google Compute Engine are also improving</li>
<li>Secure boot support hopefully coming [by mid-year](<a href="http://www.itwire.com/business-it-news/open-source/62855-freebsd-to-support-secure-boot-by-mid-year" rel="nofollow">www.itwire.com/business-it-news/open-source/62855-freebsd-to-support-secure-boot-by-mid-year</a>)</li>
<li>There&#39;s quite a bit going on in the FreeBSD world, many projects happening at the same time
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140124142027" rel="nofollow">n2k14 OpenBSD Hackathon Report</a></h3>

<ul>
<li>Recently, OpenBSD held one of <a href="http://www.openbsd.org/hackathons.html" rel="nofollow">their hackathons</a> in New Zealand</li>
<li>15 developers gathered there to sit in a room and write code for a few days</li>
<li>Philip Guenther brings back a nice report of the event</li>
<li>If you&#39;ve been watching the -current CVS logs, you&#39;ve seen the flood of commits just from this event alone</li>
<li>Fixes with threading, Linux compat, ACPI, and various other things - some will make it into 5.5 and others need more testing</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20140127083112" rel="nofollow">Another report from Theo</a> details his work</li>
<li>Updates to the random subsystem, some work-in-progress pf fixes, suspend/resume fixes and more signing stuff
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_6_1_3_netbsd" rel="nofollow">Four new NetBSD releases</a></h3>

<ul>
<li>NetBSD released versions 6.1.3, 6.0.4, 5.2.2 and 5.1.4</li>
<li>These updates include lots of bug fixes and some security updates, not focused on new features</li>
<li>You can upgrade depending on what branch you&#39;re currently on</li>
<li>Confused about the different branches? <a href="https://www.netbsd.org/releases/release-map.html#graph1" rel="nofollow">See this graph.</a>
***</li>
</ul>

<h3><a href="http://sites.ieee.org/scv-cs/archives/openzfs-future-open-source-zfs-development" rel="nofollow">The future of open source ZFS development </a></h3>

<ul>
<li>On February 11, 2014, Matt Ahrens will be giving a presentation about ZFS</li>
<li>The talk will be about the future of ZFS and the open source development since Oracle closed the code</li>
<li>It&#39;s in San Jose, California - go if you can!
***</li>
</ul>

<h2>Interview - George Neville-Neil - <a href="mailto:gnn@freebsd.org" rel="nofollow">gnn@freebsd.org</a> / <a href="https://twitter.com/gvnn3" rel="nofollow">@gvnn3</a></h2>

<p><a href="http://freebsdjournal.com/" rel="nofollow">The FreeBSD Journal</a></p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/stable-current-obsd" rel="nofollow">Tracking -STABLE and -CURRENT (OpenBSD)</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://doc.pfsense.org/index.php/2.1.1_New_Features_and_Changes" rel="nofollow">pfSense news and 2.1.1 snapshots</a></h3>

<ul>
<li>pfSense has some snapshots available for the upcoming 2.1.1 release</li>
<li>They include FreeBSD security fixes as well as some other updates</li>
<li>There are <a href="https://blog.pfsense.org/?p=1198" rel="nofollow">recordings posted</a> of some of the previous hangouts</li>
<li>Unfortunately they&#39;re only for subscribers, so you&#39;ll have to wait until next month when we have Chris on the show to talk about pfSense!
***</li>
</ul>

<h3><a href="https://groups.google.com/forum/#!msg/gce-discussion/YWoa3Aa_49U/FYAg9oiRlLUJ" rel="nofollow">FreeBSD on Google Compute Engine</a></h3>

<ul>
<li>Recently we mentioned some posts about getting OpenBSD to run on GCE, here&#39;s the FreeBSD version</li>
<li>Nice big fat warning: &quot;The team has put together a best-effort posting that will get most, if not all, of you up and running. That being said, we need to remind you that FreeBSD is being supported on Google Compute Engine by the community. The instructions are being provided as-is and without warranty.&quot;</li>
<li>Their instructions are a little too Linuxy (assuming wget, etc.) for our taste, someone should probably get it updated!</li>
<li>Other than that it&#39;s a pretty good set of instructions on how to get up and running
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2014/01/22/13225.html" rel="nofollow">Dragonfly ACPI update</a></h3>

<ul>
<li>Sascha Wildner committed some <a href="http://lists.dragonflybsd.org/pipermail/commits/2014-January/199071.html" rel="nofollow">new ACPI code</a></li>
<li>There&#39;s also a &quot;heads up&quot; to <a href="http://lists.dragonflybsd.org/pipermail/users/2014-January/090504.html" rel="nofollow">update your BIOS</a> if you experience problems</li>
<li>Check the mailing list post for all the details
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-6/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>10.0-RC4 users need to upgrade all their packages for 10.0-RC5</li>
<li>PBIs needed to be rebuilt.. actually everything did</li>
<li>Help test GNOME 3 so we can get it in the official ports tree</li>
<li>By the way, I think Kris has an announcement - PCBSD 10.0 is out!
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21ZlfOdTt" rel="nofollow">Tony writes in</a></li>
<li><a href="http://slexy.org/view/s2BFZ68Na5" rel="nofollow">Jeff writes in</a></li>
<li><a href="http://slexy.org/view/s20epArsQI" rel="nofollow">Remy writes in</a></li>
<li><a href="http://slexy.org/view/s213CoNvLt" rel="nofollow">Nils writes in</a></li>
<li><a href="http://slexy.org/view/s21XWnThNS" rel="nofollow">Solomon writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>21: Tendresse for Ten</title>
  <link>https://www.bsdnow.tv/21</link>
  <guid isPermaLink="false">353e6a60-9bd0-494f-ac34-4337e3dfa734</guid>
  <pubDate>Wed, 22 Jan 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/353e6a60-9bd0-494f-ac34-4337e3dfa734.mp3" length="77103576" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we've got some great news for OpenBSD, as well as the scoop on FreeBSD 10.0-RELEASE - yes it's finally here! We're gonna talk to Colin Percival about running FreeBSD 10 on EC2 and lots of other interesting stuff. After that, we'll be showing you how to do some bandwidth monitoring and network performance testing in a combo tutorial. We've got a round of your questions and the latest news, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:47:05</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we've got some great news for OpenBSD, as well as the scoop on FreeBSD 10.0-RELEASE - yes it's finally here! We're gonna talk to Colin Percival about running FreeBSD 10 on EC2 and lots of other interesting stuff. After that, we'll be showing you how to do some bandwidth monitoring and network performance testing in a combo tutorial. We've got a round of your questions and the latest news, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
FreeBSD 10.0-RELEASE is out (https://www.freebsd.org/releases/10.0R/announce.html)
The long awaited, giant release of FreeBSD is now official and ready to be downloaded (http://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-amd64/10.0/)
One of the biggest releases in FreeBSD history, with tons of new updates
Some features include: LDNS/Unbound replacing BIND, Clang by default (no GCC anymore), native Raspberry Pi support and other ARM improvements, bhyve, hyper-v support, AMD KMS, VirtIO, Xen PVHVM in GENERIC, lots of driver updates, ZFS on root in the installer, SMP patches to pf that drastically improve performance, Netmap support, pkgng by default, wireless stack improvements, a new iSCSI stack, FUSE in the base system... the list goes on and on (https://www.freebsd.org/releases/10.0R/relnotes.html)
Start up your freebsd-update or do a source-based upgrade
***
OpenSSH 6.5 CFT (https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-January/031987.html)
Our buddy Damien Miller (http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline) announced a Call For Testing for OpenSSH 6.5
Huge, huge release, focused on new features rather than bugfixes (but it includes those too)
New ciphers, new key formats, new config options, see the mailing list for all the details
Should be in OpenBSD 5.5 in May, look forward to it - but also help test on other platforms!
***
DIY NAS story, FreeNAS 9.2.1-BETA (http://blog.brianmoses.net/2014/01/diy-nas-2014-edition.html)
Another new blog post about FreeNAS!
Instead of updating the older tutorials, the author started fresh and wrote a new one for 2014
"I did briefly consider suggesting nas4free for the EconoNAS blog, since it’s essentially a fork off the FreeNAS tree but may run better on slower hardware, but ultimately I couldn’t recommend anything other than FreeNAS"
Really long article with lots of nice details about his setup, why you might want a NAS, etc.
Speaking of FreeNAS, they released 9.2.1-BETA (http://www.freenas.org/whats-new/2014/01/freenas-9-2-1-beta-now-ready-for-download.html) with lots of bugfixes
***
OpenBSD needed funding for electricity.. and they got it (https://news.ycombinator.com/item?id=7069889)
Briefly mentioned at the end of last week's show, but has blown up over the internet since
OpenBSD in the headlines of major tech news sites: slashdot, zdnet, the register, hacker news, reddit, twitter.. thousands of comments
They needed about $20,000 to cover electric costs for the server rack in Theo's basement (http://www.openbsd.org/images/rack2009.jpg)
Lots of positive reaction from the community helping out so far, and it appears they have reached their goal (http://www.openbsdfoundation.org/campaign2104.html) and got $100,000 in donations
From Bob Beck: "we have in one week gone from being in a dire situation to having a commitment of approximately $100,000 in donations to the foundation"
This is a shining example of the BSD community coming together, and even the Linux people realizing how critical BSD is to the world at large
***
Interview - Colin Percival - cperciva@freebsd.org (mailto:cperciva@freebsd.org) / @cperciva (https://twitter.com/cperciva)
FreeBSD on Amazon EC2 (http://www.daemonology.net/freebsd-on-ec2/), backups with Tarsnap (https://www.tarsnap.com/), 10.0-RELEASE, various topics
Tutorial
Bandwidth monitoring and testing (http://www.bsdnow.tv/tutorials/vnstat-iperf)
News Roundup
pfSense talk at Tokyo FreeBSD Benkyoukai (https://blog.pfsense.org/?p=1176)
Isaac Levy will be presenting "pfSense Practical Experiences: from home routers, to High-Availability Datacenter Deployments"
He's also going to be looking for help to translate the pfSense documentation into Japanese
The event is on February 17, 2014 if you're in the Tokyo area
***
m0n0wall 1.8.1 released (http://m0n0.ch/wall/downloads.php)
For those who don't know, m0n0wall is an older BSD-based firewall OS that's mostly focused on embedded applications
pfSense was forked from it in 2004, and has a lot more active development now
They switched to FreeBSD 8.4 for this new version
Full list of updates in the changelog
This version requires at least 128MB RAM and a disk/CF size of 32MB or more, oh no!
***
Ansible and PF, plus NTP (http://blather.michaelwlucas.com/archives/1933)
Another blog post from our buddy Michael Lucas (http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop)
There've been some NTP amplification attacks recently (https://www.freebsd.org/security/advisories/FreeBSD-SA-14:02.ntpd.asc) in the news
The post describes how he configured ntpd on a lot of servers without a lot of work
He leverages pf and ansible for the configuration
OpenNTPD is, not surprisingly, unaffected - use it
***
ruBSD videos online (http://undeadly.org/cgi?action=article&amp;amp;sid=20140115054839)
Just a quick followup from a few weeks ago
Theo and Henning's talks from ruBSD are now available for download
There's also a nice interview with Theo
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-5/)
10.0-RC4 images are available
Wine PBI is now available for 10
9.2 systems will now be able to upgrade to version 10 and keep their PBI library
***
Feedback/Questions
Sha'ul writes in (http://slexy.org/view/s2WQXwMASZ)
Kjell-Aleksander writes in (http://slexy.org/view/s2H0FURAtZ)
Mike writes in (http://slexy.org/view/s21eKKPgqh)
Charlie writes in (and gets a reply) (http://slexy.org/view/s21UMLnV0G)
Kevin writes in (http://slexy.org/view/s2SuazcfoR)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ec2, colin percival, cperciva, amazon, cloud, aws, instance, vm, virtual machine, xen, hypervisor, generic, 10.0, in the cloud, custom kernel, tarsnap, backup, backups, encrypted, dropbox, offsite, off site, crashplan, vnstat, iperf, performance, network, sysctl, throughput, speed, download, upload, check, test, freenas, m0n0wall, pfsense, zfs, vfs, tokyo, benkyokai, benkyoukai, ansible, nas, freenas, pf, ntp, openntpd, vulnerability, ntpd</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ve got some great news for OpenBSD, as well as the scoop on FreeBSD 10.0-RELEASE - yes it&#39;s finally here! We&#39;re gonna talk to Colin Percival about running FreeBSD 10 on EC2 and lots of other interesting stuff. After that, we&#39;ll be showing you how to do some bandwidth monitoring and network performance testing in a combo tutorial. We&#39;ve got a round of your questions and the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/10.0R/announce.html" rel="nofollow">FreeBSD 10.0-RELEASE is out</a></h3>

<ul>
<li>The long awaited, giant release of FreeBSD is now official and <a href="http://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-amd64/10.0/" rel="nofollow">ready to be downloaded</a></li>
<li>One of the biggest releases in FreeBSD history, with tons of new updates</li>
<li>Some features include: LDNS/Unbound replacing BIND, Clang by default (no GCC anymore), native Raspberry Pi support and other ARM improvements, bhyve, hyper-v support, AMD KMS, VirtIO, Xen PVHVM in GENERIC, lots of driver updates, ZFS on root in the installer, SMP patches to pf that drastically improve performance, Netmap support, pkgng by default, wireless stack improvements, a new iSCSI stack, FUSE in the base system... <a href="https://www.freebsd.org/releases/10.0R/relnotes.html" rel="nofollow">the list goes on and on</a></li>
<li>Start up your freebsd-update or do a source-based upgrade
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-January/031987.html" rel="nofollow">OpenSSH 6.5 CFT</a></h3>

<ul>
<li>Our buddy <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">Damien Miller</a> announced a Call For Testing for OpenSSH 6.5</li>
<li>Huge, huge release, focused on new features rather than bugfixes (but it includes those too)</li>
<li>New ciphers, new key formats, new config options, see the mailing list for all the details</li>
<li>Should be in OpenBSD 5.5 in May, look forward to it - but also help test on other platforms!
***</li>
</ul>

<h3><a href="http://blog.brianmoses.net/2014/01/diy-nas-2014-edition.html" rel="nofollow">DIY NAS story, FreeNAS 9.2.1-BETA</a></h3>

<ul>
<li>Another new blog post about FreeNAS!</li>
<li>Instead of updating the older tutorials, the author started fresh and wrote a new one for 2014</li>
<li>&quot;I did briefly consider suggesting nas4free for the EconoNAS blog, since it’s essentially a fork off the FreeNAS tree but may run better on slower hardware, but ultimately I couldn’t recommend anything other than FreeNAS&quot;</li>
<li>Really long article with lots of nice details about his setup, why you might want a NAS, etc.</li>
<li>Speaking of FreeNAS, they released <a href="http://www.freenas.org/whats-new/2014/01/freenas-9-2-1-beta-now-ready-for-download.html" rel="nofollow">9.2.1-BETA</a> with lots of bugfixes
***</li>
</ul>

<h3><a href="https://news.ycombinator.com/item?id=7069889" rel="nofollow">OpenBSD needed funding for electricity.. and they got it</a></h3>

<ul>
<li>Briefly mentioned at the end of last week&#39;s show, but has blown up over the internet since</li>
<li>OpenBSD in the headlines of major tech news sites: slashdot, zdnet, the register, hacker news, reddit, twitter.. thousands of comments</li>
<li>They needed about $20,000 to cover electric costs for the <a href="http://www.openbsd.org/images/rack2009.jpg" rel="nofollow">server rack in Theo&#39;s basement</a></li>
<li>Lots of positive reaction from the community helping out so far, and it appears they have <a href="http://www.openbsdfoundation.org/campaign2104.html" rel="nofollow">reached their goal</a> and got $100,000 in donations</li>
<li>From Bob Beck: &quot;we have in one week gone from being in a dire situation to having a commitment of approximately $100,000 in donations to the foundation&quot;</li>
<li>This is a shining example of the BSD community coming together, and even the Linux people realizing how critical BSD is to the world at large
***</li>
</ul>

<h2>Interview - Colin Percival - <a href="mailto:cperciva@freebsd.org" rel="nofollow">cperciva@freebsd.org</a> / <a href="https://twitter.com/cperciva" rel="nofollow">@cperciva</a></h2>

<p>FreeBSD <a href="http://www.daemonology.net/freebsd-on-ec2/" rel="nofollow">on Amazon EC2</a>, backups with <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a>, 10.0-RELEASE, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/vnstat-iperf" rel="nofollow">Bandwidth monitoring and testing</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.pfsense.org/?p=1176" rel="nofollow">pfSense talk at Tokyo FreeBSD Benkyoukai</a></h3>

<ul>
<li>Isaac Levy will be presenting &quot;pfSense Practical Experiences: from home routers, to High-Availability Datacenter Deployments&quot;</li>
<li>He&#39;s also going to be looking for help to translate the pfSense documentation into Japanese</li>
<li>The event is on February 17, 2014 if you&#39;re in the Tokyo area
***</li>
</ul>

<h3><a href="http://m0n0.ch/wall/downloads.php" rel="nofollow">m0n0wall 1.8.1 released</a></h3>

<ul>
<li>For those who don&#39;t know, m0n0wall is an older BSD-based firewall OS that&#39;s mostly focused on embedded applications</li>
<li>pfSense was forked from it in 2004, and has a lot more active development now</li>
<li>They switched to FreeBSD 8.4 for this new version</li>
<li>Full list of updates in the changelog</li>
<li>This version requires at least 128MB RAM and a disk/CF size of 32MB or more, oh no!
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/1933" rel="nofollow">Ansible and PF, plus NTP</a></h3>

<ul>
<li>Another blog post from our buddy <a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">Michael Lucas</a></li>
<li>There&#39;ve been some NTP amplification attacks <a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-14:02.ntpd.asc" rel="nofollow">recently</a> in the news</li>
<li>The post describes how he configured ntpd on a lot of servers without a lot of work</li>
<li>He leverages pf and ansible for the configuration</li>
<li>OpenNTPD is, not surprisingly, unaffected - use it
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140115054839" rel="nofollow">ruBSD videos online</a></h3>

<ul>
<li>Just a quick followup from a few weeks ago</li>
<li>Theo and Henning&#39;s talks from ruBSD are now available for download</li>
<li>There&#39;s also a nice interview with Theo
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-5/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>10.0-RC4 images are available</li>
<li>Wine PBI is now available for 10</li>
<li>9.2 systems will now be able to upgrade to version 10 and keep their PBI library
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2WQXwMASZ" rel="nofollow">Sha&#39;ul writes in</a></li>
<li><a href="http://slexy.org/view/s2H0FURAtZ" rel="nofollow">Kjell-Aleksander writes in</a></li>
<li><a href="http://slexy.org/view/s21eKKPgqh" rel="nofollow">Mike writes in</a></li>
<li><a href="http://slexy.org/view/s21UMLnV0G" rel="nofollow">Charlie writes in (and gets a reply)</a></li>
<li><a href="http://slexy.org/view/s2SuazcfoR" rel="nofollow">Kevin writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ve got some great news for OpenBSD, as well as the scoop on FreeBSD 10.0-RELEASE - yes it&#39;s finally here! We&#39;re gonna talk to Colin Percival about running FreeBSD 10 on EC2 and lots of other interesting stuff. After that, we&#39;ll be showing you how to do some bandwidth monitoring and network performance testing in a combo tutorial. We&#39;ve got a round of your questions and the latest news, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://www.freebsd.org/releases/10.0R/announce.html" rel="nofollow">FreeBSD 10.0-RELEASE is out</a></h3>

<ul>
<li>The long awaited, giant release of FreeBSD is now official and <a href="http://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-amd64/10.0/" rel="nofollow">ready to be downloaded</a></li>
<li>One of the biggest releases in FreeBSD history, with tons of new updates</li>
<li>Some features include: LDNS/Unbound replacing BIND, Clang by default (no GCC anymore), native Raspberry Pi support and other ARM improvements, bhyve, hyper-v support, AMD KMS, VirtIO, Xen PVHVM in GENERIC, lots of driver updates, ZFS on root in the installer, SMP patches to pf that drastically improve performance, Netmap support, pkgng by default, wireless stack improvements, a new iSCSI stack, FUSE in the base system... <a href="https://www.freebsd.org/releases/10.0R/relnotes.html" rel="nofollow">the list goes on and on</a></li>
<li>Start up your freebsd-update or do a source-based upgrade
***</li>
</ul>

<h3><a href="https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-January/031987.html" rel="nofollow">OpenSSH 6.5 CFT</a></h3>

<ul>
<li>Our buddy <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">Damien Miller</a> announced a Call For Testing for OpenSSH 6.5</li>
<li>Huge, huge release, focused on new features rather than bugfixes (but it includes those too)</li>
<li>New ciphers, new key formats, new config options, see the mailing list for all the details</li>
<li>Should be in OpenBSD 5.5 in May, look forward to it - but also help test on other platforms!
***</li>
</ul>

<h3><a href="http://blog.brianmoses.net/2014/01/diy-nas-2014-edition.html" rel="nofollow">DIY NAS story, FreeNAS 9.2.1-BETA</a></h3>

<ul>
<li>Another new blog post about FreeNAS!</li>
<li>Instead of updating the older tutorials, the author started fresh and wrote a new one for 2014</li>
<li>&quot;I did briefly consider suggesting nas4free for the EconoNAS blog, since it’s essentially a fork off the FreeNAS tree but may run better on slower hardware, but ultimately I couldn’t recommend anything other than FreeNAS&quot;</li>
<li>Really long article with lots of nice details about his setup, why you might want a NAS, etc.</li>
<li>Speaking of FreeNAS, they released <a href="http://www.freenas.org/whats-new/2014/01/freenas-9-2-1-beta-now-ready-for-download.html" rel="nofollow">9.2.1-BETA</a> with lots of bugfixes
***</li>
</ul>

<h3><a href="https://news.ycombinator.com/item?id=7069889" rel="nofollow">OpenBSD needed funding for electricity.. and they got it</a></h3>

<ul>
<li>Briefly mentioned at the end of last week&#39;s show, but has blown up over the internet since</li>
<li>OpenBSD in the headlines of major tech news sites: slashdot, zdnet, the register, hacker news, reddit, twitter.. thousands of comments</li>
<li>They needed about $20,000 to cover electric costs for the <a href="http://www.openbsd.org/images/rack2009.jpg" rel="nofollow">server rack in Theo&#39;s basement</a></li>
<li>Lots of positive reaction from the community helping out so far, and it appears they have <a href="http://www.openbsdfoundation.org/campaign2104.html" rel="nofollow">reached their goal</a> and got $100,000 in donations</li>
<li>From Bob Beck: &quot;we have in one week gone from being in a dire situation to having a commitment of approximately $100,000 in donations to the foundation&quot;</li>
<li>This is a shining example of the BSD community coming together, and even the Linux people realizing how critical BSD is to the world at large
***</li>
</ul>

<h2>Interview - Colin Percival - <a href="mailto:cperciva@freebsd.org" rel="nofollow">cperciva@freebsd.org</a> / <a href="https://twitter.com/cperciva" rel="nofollow">@cperciva</a></h2>

<p>FreeBSD <a href="http://www.daemonology.net/freebsd-on-ec2/" rel="nofollow">on Amazon EC2</a>, backups with <a href="https://www.tarsnap.com/" rel="nofollow">Tarsnap</a>, 10.0-RELEASE, various topics</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/vnstat-iperf" rel="nofollow">Bandwidth monitoring and testing</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.pfsense.org/?p=1176" rel="nofollow">pfSense talk at Tokyo FreeBSD Benkyoukai</a></h3>

<ul>
<li>Isaac Levy will be presenting &quot;pfSense Practical Experiences: from home routers, to High-Availability Datacenter Deployments&quot;</li>
<li>He&#39;s also going to be looking for help to translate the pfSense documentation into Japanese</li>
<li>The event is on February 17, 2014 if you&#39;re in the Tokyo area
***</li>
</ul>

<h3><a href="http://m0n0.ch/wall/downloads.php" rel="nofollow">m0n0wall 1.8.1 released</a></h3>

<ul>
<li>For those who don&#39;t know, m0n0wall is an older BSD-based firewall OS that&#39;s mostly focused on embedded applications</li>
<li>pfSense was forked from it in 2004, and has a lot more active development now</li>
<li>They switched to FreeBSD 8.4 for this new version</li>
<li>Full list of updates in the changelog</li>
<li>This version requires at least 128MB RAM and a disk/CF size of 32MB or more, oh no!
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/1933" rel="nofollow">Ansible and PF, plus NTP</a></h3>

<ul>
<li>Another blog post from our buddy <a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">Michael Lucas</a></li>
<li>There&#39;ve been some NTP amplification attacks <a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-14:02.ntpd.asc" rel="nofollow">recently</a> in the news</li>
<li>The post describes how he configured ntpd on a lot of servers without a lot of work</li>
<li>He leverages pf and ansible for the configuration</li>
<li>OpenNTPD is, not surprisingly, unaffected - use it
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140115054839" rel="nofollow">ruBSD videos online</a></h3>

<ul>
<li>Just a quick followup from a few weeks ago</li>
<li>Theo and Henning&#39;s talks from ruBSD are now available for download</li>
<li>There&#39;s also a nice interview with Theo
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-5/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>10.0-RC4 images are available</li>
<li>Wine PBI is now available for 10</li>
<li>9.2 systems will now be able to upgrade to version 10 and keep their PBI library
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2WQXwMASZ" rel="nofollow">Sha&#39;ul writes in</a></li>
<li><a href="http://slexy.org/view/s2H0FURAtZ" rel="nofollow">Kjell-Aleksander writes in</a></li>
<li><a href="http://slexy.org/view/s21eKKPgqh" rel="nofollow">Mike writes in</a></li>
<li><a href="http://slexy.org/view/s21UMLnV0G" rel="nofollow">Charlie writes in (and gets a reply)</a></li>
<li><a href="http://slexy.org/view/s2SuazcfoR" rel="nofollow">Kevin writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>20: Bhyve Mind</title>
  <link>https://www.bsdnow.tv/20</link>
  <guid isPermaLink="false">6125c3d9-473a-4557-a429-423dffa36cbf</guid>
  <pubDate>Wed, 15 Jan 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6125c3d9-473a-4557-a429-423dffa36cbf.mp3" length="60158675" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>It's our big 20th episode! We're going to sit down for a chat with Neel Natu and Peter Grehan, the developers of bhyve. Not familiar with bhyve? Our tutorial will show you all you need to know about this awesome new virtualization technology. Answers to your questions and all the latest news, here on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:23:33</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>It's our big 20th episode! We're going to sit down for a chat with Neel Natu and Peter Grehan, the developers of bhyve. Not familiar with bhyve? Our tutorial will show you all you need to know about this awesome new virtualization technology. Answers to your questions and all the latest news, here on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
OpenBSD automatic installation (http://undeadly.org/cgi?action=article&amp;amp;sid=20140106055302)
A CFT (call for testing) was posted for OpenBSD's new automatic installer process
Using this new system, you can spin up fully-configured OpenBSD installs very quickly
It will answer all the questions for you and can put files into place and start services
Great for large deployments, help test it and report your findings
***
FreeNAS install guide and blog posts (https://www.youtube.com/channel/UCL09rVicvyZrqe-I2LP5Vyg/videos)
A multipart series on YouTube about installing FreeNAS
In part 1, the guy (who is possibly Dracula, with his very Transylvanian accent..) builds his new file server and shows off the hardware
In part 2, he shows how to install and configure FreeNAS, uses IPMI, sets up his pools
He pronounces gigabytes as jiggabytes and it's hilarious
We've also got an unrelated blog post (http://enoriver.net/index.php/2014/01/11/freenas-works-as-advertised/) about a very satisfied FreeNAS user who details his setup
As well as another blog post (http://devinteske.com/freenas-development/) from our old pal Devin Teske (http://www.bsdnow.tv/episodes/2013-09-25_teskeing_the_possibilities) about his recent foray into the FreeNAS development world
***
FreeBSD 10.0-RC5 is out (https://lists.freebsd.org/pipermail/freebsd-stable/2014-January/076800.html)
Another, unexpected RC is out for 10.0
Minor fixes included, please help test and report any bugs
You can update via freebsd-update or from source
Hopefully this will be the last one before 10.0-RELEASE, which has tons of new features we'll talk about
It's been tagged -RELEASE (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=260664) in SVN already too!
***
OpenBSD 5.5-beta is out (http://marc.info/?l=openbsd-cvs&amp;amp;m=138952598914052&amp;amp;w=2)
Theo updated the branch status to 5.5-beta
A list of changes (http://www.openbsd.org/plus.html)
Help test (http://ftp.openbsd.org/pub/OpenBSD/snapshots/) and report any bugs you find
Lots of rapid development with signify (which we mentioned last week), the beta includes some "test keys"
Does that mean it'll be part of the final release? We'll find out in May.. or when we interview Ted (soon)
***
Interview - Neel Natu &amp;amp; Peter Grehan - neel@freebsd.org (mailto:neel@freebsd.org) &amp;amp; grehan@freebsd.org (mailto:grehan@freebsd.org)
BHyVe - the BSD hypervisor
Tutorial
Virtualization with bhyve (http://www.bsdnow.tv/tutorials/bhyve)
News Roundup
Hostname canonicalisation in OpenSSH (http://blog.djm.net.au/2014/01/hostname-canonicalisation-in-openssh.html)
Blog post from our friend Damien Miller (http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline)
This new feature allows clients to canonicalize unqualified domain names
SSH will know if you typed "ssh bsdnow" you meant "ssh bsdnow.tv" with new config options
This will help clean up some ssh configs, especially if you have many hosts
Should make it into OpenSSH 6.5, which is "due really soon"
***
Dragonfly on a Chromebook (http://www.shiningsilence.com/dbsdlog/2014/01/07/13078.html)
Some work has been done by Matthew Dillon to get DragonflyBSD working on a Google Chromebook
These couple of posts (http://www.shiningsilence.com/dbsdlog/2014/01/10/13132.html) detail some of the things he's got working so far
Changes were needed to the boot process, trackpad and wifi drivers needed updating...
Also includes a guide written by Dillon on how to get yours working
***
Spider in a box (http://kazarka.com/index.php?section=spiderinabox)
"Spiderinabox" is a new OpenBSD-based project
Using a combination of OpenBSD, Firefox, XQuartz and VirtualBox, it creates a secure browsing experience for OS X
Firefox runs encapsulated in OpenBSD and doesn't have access to OS X in any way
The developer is looking for testers on other operating systems!
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-3/)
PCBSD 10 has entered into the code freeze phase
They're focusing on fixing bugs now, rather than adding new features
The update system got a lot of improvements
PBI load times reduced by up to 40%! what!!!
***
Feedback/Questions
Scott writes in (http://slexy.org/view/s25zbSPtcm)
Chris writes in (http://slexy.org/view/s2EarxbZz1)
SW writes in (http://slexy.org/view/s2MWKxtWxF)
Ole writes in (http://slexy.org/view/s20kzex2qm)
Gertjan writes in (http://slexy.org/view/s2858Ph4o0)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, bhyve, virtualization, xen, hypervisor, type 2, neel natu, peter grehan, presentation, dom0, domu, automatic install, pxe, pxeboot, freenas, installation, chromebook, edgebsd, spiderinabox, spider in a box, vm</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>It&#39;s our big 20th episode! We&#39;re going to sit down for a chat with Neel Natu and Peter Grehan, the developers of bhyve. Not familiar with bhyve? Our tutorial will show you all you need to know about this awesome new virtualization technology. Answers to your questions and all the latest news, here on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140106055302" rel="nofollow">OpenBSD automatic installation</a></h3>

<ul>
<li>A CFT (call for testing) was posted for OpenBSD&#39;s new automatic installer process</li>
<li>Using this new system, you can spin up fully-configured OpenBSD installs very quickly</li>
<li>It will answer all the questions for you and can put files into place and start services</li>
<li>Great for large deployments, help test it and report your findings
***</li>
</ul>

<h3><a href="https://www.youtube.com/channel/UCL09rVicvyZrqe-I2LP5Vyg/videos" rel="nofollow">FreeNAS install guide and blog posts</a></h3>

<ul>
<li>A multipart series on YouTube about installing FreeNAS</li>
<li>In part 1, the guy (who is possibly Dracula, with his very Transylvanian accent..) builds his new file server and shows off the hardware</li>
<li>In part 2, he shows how to install and configure FreeNAS, uses IPMI, sets up his pools</li>
<li>He pronounces gigabytes as jiggabytes and it&#39;s hilarious</li>
<li>We&#39;ve also got an <a href="http://enoriver.net/index.php/2014/01/11/freenas-works-as-advertised/" rel="nofollow">unrelated blog post</a> about a very satisfied FreeNAS user who details his setup</li>
<li>As well as <a href="http://devinteske.com/freenas-development/" rel="nofollow">another blog post</a> from our old pal <a href="http://www.bsdnow.tv/episodes/2013-09-25_teskeing_the_possibilities" rel="nofollow">Devin Teske</a> about his recent foray into the FreeNAS development world
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-January/076800.html" rel="nofollow">FreeBSD 10.0-RC5 is out</a></h3>

<ul>
<li>Another, unexpected RC is out for 10.0</li>
<li>Minor fixes included, please help test and report any bugs</li>
<li>You can update via freebsd-update or from source</li>
<li>Hopefully this will be the last one before 10.0-RELEASE, which has tons of new features we&#39;ll talk about</li>
<li>It&#39;s been <a href="https://svnweb.freebsd.org/base?view=revision&revision=260664" rel="nofollow">tagged -RELEASE</a> in SVN already too!
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=138952598914052&w=2" rel="nofollow">OpenBSD 5.5-beta is out</a></h3>

<ul>
<li>Theo updated the branch status to 5.5-beta</li>
<li>A <a href="http://www.openbsd.org/plus.html" rel="nofollow">list of changes</a></li>
<li><a href="http://ftp.openbsd.org/pub/OpenBSD/snapshots/" rel="nofollow">Help test</a> and report any bugs you find</li>
<li>Lots of rapid development with signify (which we mentioned last week), the beta includes some &quot;test keys&quot;</li>
<li>Does that mean it&#39;ll be part of the final release? We&#39;ll find out in May.. or when we interview Ted (soon)
***</li>
</ul>

<h2>Interview - Neel Natu &amp; Peter Grehan - <a href="mailto:neel@freebsd.org" rel="nofollow">neel@freebsd.org</a> &amp; <a href="mailto:grehan@freebsd.org" rel="nofollow">grehan@freebsd.org</a></h2>

<p>BHyVe - the BSD hypervisor</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/bhyve" rel="nofollow">Virtualization with bhyve</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blog.djm.net.au/2014/01/hostname-canonicalisation-in-openssh.html" rel="nofollow">Hostname canonicalisation in OpenSSH</a></h3>

<ul>
<li>Blog post from our friend <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">Damien Miller</a></li>
<li>This new feature allows clients to canonicalize unqualified domain names</li>
<li>SSH will know if you typed &quot;ssh bsdnow&quot; you meant &quot;ssh bsdnow.tv&quot; with new config options</li>
<li>This will help clean up some ssh configs, especially if you have many hosts</li>
<li>Should make it into OpenSSH 6.5, which is &quot;due really soon&quot;
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2014/01/07/13078.html" rel="nofollow">Dragonfly on a Chromebook</a></h3>

<ul>
<li>Some work has been done by Matthew Dillon to get DragonflyBSD working on a Google Chromebook</li>
<li>These <a href="http://www.shiningsilence.com/dbsdlog/2014/01/10/13132.html" rel="nofollow">couple of posts</a> detail some of the things he&#39;s got working so far</li>
<li>Changes were needed to the boot process, trackpad and wifi drivers needed updating...</li>
<li>Also includes a guide written by Dillon on how to get yours working
***</li>
</ul>

<h3><a href="http://kazarka.com/index.php?section=spiderinabox" rel="nofollow">Spider in a box</a></h3>

<ul>
<li>&quot;Spiderinabox&quot; is a new OpenBSD-based project</li>
<li>Using a combination of OpenBSD, Firefox, XQuartz and VirtualBox, it creates a secure browsing experience for OS X</li>
<li>Firefox runs encapsulated in OpenBSD and doesn&#39;t have access to OS X in any way</li>
<li>The developer is looking for testers on other operating systems!
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-3/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>PCBSD 10 has entered into the code freeze phase</li>
<li>They&#39;re focusing on fixing bugs now, rather than adding new features</li>
<li>The update system got a lot of improvements</li>
<li>PBI load times reduced by up to 40%! what!!!
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s25zbSPtcm" rel="nofollow">Scott writes in</a></li>
<li><a href="http://slexy.org/view/s2EarxbZz1" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s2MWKxtWxF" rel="nofollow">SW writes in</a></li>
<li><a href="http://slexy.org/view/s20kzex2qm" rel="nofollow">Ole writes in</a></li>
<li><a href="http://slexy.org/view/s2858Ph4o0" rel="nofollow">Gertjan writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>It&#39;s our big 20th episode! We&#39;re going to sit down for a chat with Neel Natu and Peter Grehan, the developers of bhyve. Not familiar with bhyve? Our tutorial will show you all you need to know about this awesome new virtualization technology. Answers to your questions and all the latest news, here on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20140106055302" rel="nofollow">OpenBSD automatic installation</a></h3>

<ul>
<li>A CFT (call for testing) was posted for OpenBSD&#39;s new automatic installer process</li>
<li>Using this new system, you can spin up fully-configured OpenBSD installs very quickly</li>
<li>It will answer all the questions for you and can put files into place and start services</li>
<li>Great for large deployments, help test it and report your findings
***</li>
</ul>

<h3><a href="https://www.youtube.com/channel/UCL09rVicvyZrqe-I2LP5Vyg/videos" rel="nofollow">FreeNAS install guide and blog posts</a></h3>

<ul>
<li>A multipart series on YouTube about installing FreeNAS</li>
<li>In part 1, the guy (who is possibly Dracula, with his very Transylvanian accent..) builds his new file server and shows off the hardware</li>
<li>In part 2, he shows how to install and configure FreeNAS, uses IPMI, sets up his pools</li>
<li>He pronounces gigabytes as jiggabytes and it&#39;s hilarious</li>
<li>We&#39;ve also got an <a href="http://enoriver.net/index.php/2014/01/11/freenas-works-as-advertised/" rel="nofollow">unrelated blog post</a> about a very satisfied FreeNAS user who details his setup</li>
<li>As well as <a href="http://devinteske.com/freenas-development/" rel="nofollow">another blog post</a> from our old pal <a href="http://www.bsdnow.tv/episodes/2013-09-25_teskeing_the_possibilities" rel="nofollow">Devin Teske</a> about his recent foray into the FreeNAS development world
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2014-January/076800.html" rel="nofollow">FreeBSD 10.0-RC5 is out</a></h3>

<ul>
<li>Another, unexpected RC is out for 10.0</li>
<li>Minor fixes included, please help test and report any bugs</li>
<li>You can update via freebsd-update or from source</li>
<li>Hopefully this will be the last one before 10.0-RELEASE, which has tons of new features we&#39;ll talk about</li>
<li>It&#39;s been <a href="https://svnweb.freebsd.org/base?view=revision&revision=260664" rel="nofollow">tagged -RELEASE</a> in SVN already too!
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=138952598914052&w=2" rel="nofollow">OpenBSD 5.5-beta is out</a></h3>

<ul>
<li>Theo updated the branch status to 5.5-beta</li>
<li>A <a href="http://www.openbsd.org/plus.html" rel="nofollow">list of changes</a></li>
<li><a href="http://ftp.openbsd.org/pub/OpenBSD/snapshots/" rel="nofollow">Help test</a> and report any bugs you find</li>
<li>Lots of rapid development with signify (which we mentioned last week), the beta includes some &quot;test keys&quot;</li>
<li>Does that mean it&#39;ll be part of the final release? We&#39;ll find out in May.. or when we interview Ted (soon)
***</li>
</ul>

<h2>Interview - Neel Natu &amp; Peter Grehan - <a href="mailto:neel@freebsd.org" rel="nofollow">neel@freebsd.org</a> &amp; <a href="mailto:grehan@freebsd.org" rel="nofollow">grehan@freebsd.org</a></h2>

<p>BHyVe - the BSD hypervisor</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/bhyve" rel="nofollow">Virtualization with bhyve</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://blog.djm.net.au/2014/01/hostname-canonicalisation-in-openssh.html" rel="nofollow">Hostname canonicalisation in OpenSSH</a></h3>

<ul>
<li>Blog post from our friend <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">Damien Miller</a></li>
<li>This new feature allows clients to canonicalize unqualified domain names</li>
<li>SSH will know if you typed &quot;ssh bsdnow&quot; you meant &quot;ssh bsdnow.tv&quot; with new config options</li>
<li>This will help clean up some ssh configs, especially if you have many hosts</li>
<li>Should make it into OpenSSH 6.5, which is &quot;due really soon&quot;
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2014/01/07/13078.html" rel="nofollow">Dragonfly on a Chromebook</a></h3>

<ul>
<li>Some work has been done by Matthew Dillon to get DragonflyBSD working on a Google Chromebook</li>
<li>These <a href="http://www.shiningsilence.com/dbsdlog/2014/01/10/13132.html" rel="nofollow">couple of posts</a> detail some of the things he&#39;s got working so far</li>
<li>Changes were needed to the boot process, trackpad and wifi drivers needed updating...</li>
<li>Also includes a guide written by Dillon on how to get yours working
***</li>
</ul>

<h3><a href="http://kazarka.com/index.php?section=spiderinabox" rel="nofollow">Spider in a box</a></h3>

<ul>
<li>&quot;Spiderinabox&quot; is a new OpenBSD-based project</li>
<li>Using a combination of OpenBSD, Firefox, XQuartz and VirtualBox, it creates a secure browsing experience for OS X</li>
<li>Firefox runs encapsulated in OpenBSD and doesn&#39;t have access to OS X in any way</li>
<li>The developer is looking for testers on other operating systems!
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-3/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>PCBSD 10 has entered into the code freeze phase</li>
<li>They&#39;re focusing on fixing bugs now, rather than adding new features</li>
<li>The update system got a lot of improvements</li>
<li>PBI load times reduced by up to 40%! what!!!
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s25zbSPtcm" rel="nofollow">Scott writes in</a></li>
<li><a href="http://slexy.org/view/s2EarxbZz1" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s2MWKxtWxF" rel="nofollow">SW writes in</a></li>
<li><a href="http://slexy.org/view/s20kzex2qm" rel="nofollow">Ole writes in</a></li>
<li><a href="http://slexy.org/view/s2858Ph4o0" rel="nofollow">Gertjan writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>19: The Installfest</title>
  <link>https://www.bsdnow.tv/19</link>
  <guid isPermaLink="false">6e52e1f8-72f4-4ef7-be58-b8d78ab97072</guid>
  <pubDate>Wed, 08 Jan 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6e52e1f8-72f4-4ef7-be58-b8d78ab97072.mp3" length="58342747" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We've got some special treats for you this week on the show. It's the long-awaited "installfest" segment, where we go through the installer of each of the different BSDs. Of course we also have your feedback and the latest news as well... and... we even have our very first viewer contest! There's a lot to get to today on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:21:01</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We've got some special treats for you this week on the show. It's the long-awaited "installfest" segment, where we go through the installer of each of the different BSDs. Of course we also have your feedback and the latest news as well... and... we even have our very first viewer contest! There's a lot to get to today on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
FreeBSD's new testing infrastructure (https://lists.freebsd.org/pipermail/freebsd-hackers/2013-December/044009.html)
A new test suite was added to FreeBSD, with 3 powerful machines available
Both -CURRENT and stable/10 have got the test suite build infrastructure in place
Designed to help developers test and improve major scalability across huge amounts of CPUs and RAM
More details available here (http://julipedia.meroh.net/2013/12/introducing-freebsd-test-suite.html)
Could the iXsystems monster server be involved...?
***
OpenBSD gets signify (http://marc.info/?l=openbsd-cvs&amp;amp;m=138845902916897&amp;amp;w=2)
At long last, OpenBSD gets support for signed releases!
For "the world's most secure OS" it was very easy to MITM kernel patches, updates, installer isos, everything
A commit to the -current tree reveals a new "signify" tool is currently being kicked around
More details in a blog post (http://www.tedunangst.com/flak/post/signify) from the guy who committed it
Quote: "yeah, briefly, the plan is to sign sets and packages. that's still work in progress."
***
Faces of FreeBSD (http://freebsdfoundation.blogspot.ca/2013/12/faces-of-freebsd-isabell-long.html)
This time they interview Isabell Long
She's a volunteer staff member on the freenode IRC network
In 2011, she participated in the Google Code-In contest and became involved with documentation
"The new committer mentoring process proved very useful and that, plus the accepting community of FreeBSD, are reasons why I stay involved."
***
pkgsrc-2013Q4 branched (http://mail-index.netbsd.org/pkgsrc-users/2013/12/31/msg019107.html)
The quarterly pkgsrc branch from NetBSD is out
13472 total packages for NetBSD-current/amd64 + 13049 binary packages built with clang!
Lots of numbers and stats in the announcement
pkgsrc works on quite a few different OSes, not just NetBSD
See our interview (http://www.bsdnow.tv/episodes/2013_11_20-collecting_shells) with Amitai Schlair for a bit about pkgsrc
***
OpenBSD on Google's Compute Engine (http://marc.info/?l=openbsd-misc&amp;amp;m=138610199311393&amp;amp;w=2)
Google Compute Engine is a "cloud computing" platform similar to EC2
Unfortunately, they only offer poor choices for the OS (Debian and CentOS)
Recently it's been announced that there is a custom OS option
It's using a WIP virtio-scsi driver, lots of things still need more work
Lots of technical and networking details about the struggles to get OpenBSD working on it
***
The Installfest
We'll be showing you the installer of each of the main BSDs. As of the date this episode airs, we're using:
FreeBSD 10.0
OpenBSD 5.4
NetBSD 6.1.2
DragonflyBSD 3.6
PCBSD 10.0
***
News Roundup
Building an OpenBSD wireless access point (http://ctors.net/2013/12/30/openbsd_wireless_access_point)
A neat write up we found around the internet about making an OpenBSD wifi router
Goes through the process of PXE booting, installing base, using a serial console, setting up networking and wireless
Even includes a puffy sticker on the Soekris box at the end, how cute
***
FreeBSD 4.X jails on 10.0 (http://blather.michaelwlucas.com/archives/1919)
Blog entry from our buddy Michael Lucas (http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop)
For whatever reason (an "in-house application"), he needed to run a FreeBSD 4 jail in FreeBSD 10
Talks about the options he had: porting software, virtualizing, dealing with slow old hardware
He goes through the whole process of making an ancient jail
It's "an acceptable trade-off, if it means I don’t have to touch actual PHP code."
***
Unscrewed: a story about OpenBSD (http://www.skeptech.org/blog/2013/01/13/unscrewed-a-story-about-openbsd/)
Pretty long blog post about how a network admin used OpenBSD to save the day
To set the tone, "It was 5am, and the network was down"
Great war story about replacing expensive routers and networking equipment with cheaper hardware and BSD
Mentions a lot of the built in tools and how OpenBSD is great for routers and high security applications
***
PCBSD weekly digest (http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-2/)
10.0-RC3 is out and ready to be tested
New detection of ATI Hybrid Graphics, they're working on nVidia next
Re-classifying Linux jails as unsupported / experimental
***
Feedback/Questions
Daniel writes in (http://slexy.org/view/s2uns1hMml)
Erik writes in (http://slexy.org/view/s2MeJNCCiu)
SW writes in (http://slexy.org/view/s21fBXkP2K)
[Bostjan writes in[(http://slexy.org/view/s20N9bfkum)
Samuel writes in (http://slexy.org/view/s20FU9wUO5)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, contest, pillow, giveaway, competition, sweepstakes, router, tuning, performance, dnscrypt, dnscurve, opendns, pkgsrc, testing, megacore, ixsystems, signify, signed packages, sets, mitm, gce, google compute engine, access point, jails, installfest, installer, sysinstall, bsdinstall, pc-sysinstall</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We&#39;ve got some special treats for you this week on the show. It&#39;s the long-awaited &quot;installfest&quot; segment, where we go through the installer of each of the different BSDs. Of course we also have your feedback and the latest news as well... and... we even have our very first viewer contest! There&#39;s a lot to get to today on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2013-December/044009.html" rel="nofollow">FreeBSD&#39;s new testing infrastructure</a></h3>

<ul>
<li>A new test suite was added to FreeBSD, with 3 powerful machines available</li>
<li>Both -CURRENT and stable/10 have got the test suite build infrastructure in place</li>
<li>Designed to help developers test and improve major scalability across huge amounts of CPUs and RAM</li>
<li>More details <a href="http://julipedia.meroh.net/2013/12/introducing-freebsd-test-suite.html" rel="nofollow">available here</a></li>
<li>Could the iXsystems monster server be involved...?
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=138845902916897&w=2" rel="nofollow">OpenBSD gets signify</a></h3>

<ul>
<li>At long last, OpenBSD gets support for signed releases!</li>
<li>For &quot;the world&#39;s most secure OS&quot; it was very easy to MITM kernel patches, updates, installer isos, everything</li>
<li>A commit to the -current tree reveals a new &quot;signify&quot; tool is currently being kicked around</li>
<li>More details in <a href="http://www.tedunangst.com/flak/post/signify" rel="nofollow">a blog post</a> from the guy who committed it</li>
<li>Quote: &quot;yeah, briefly, the plan is to sign sets and packages. that&#39;s still work in progress.&quot;
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.ca/2013/12/faces-of-freebsd-isabell-long.html" rel="nofollow">Faces of FreeBSD</a></h3>

<ul>
<li>This time they interview Isabell Long</li>
<li>She&#39;s a volunteer staff member on the freenode IRC network</li>
<li>In 2011, she participated in the Google Code-In contest and became involved with documentation</li>
<li>&quot;The new committer mentoring process proved very useful and that, plus the accepting community of FreeBSD, are reasons why I stay involved.&quot;
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/pkgsrc-users/2013/12/31/msg019107.html" rel="nofollow">pkgsrc-2013Q4 branched</a></h3>

<ul>
<li>The quarterly pkgsrc branch from NetBSD is out</li>
<li>13472 total packages for NetBSD-current/amd64 + 13049 binary packages built with clang!</li>
<li>Lots of numbers and stats in the announcement</li>
<li>pkgsrc works on quite a few different OSes, not just NetBSD</li>
<li>See <a href="http://www.bsdnow.tv/episodes/2013_11_20-collecting_shells" rel="nofollow">our interview</a> with Amitai Schlair for a bit about pkgsrc
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-misc&m=138610199311393&w=2" rel="nofollow">OpenBSD on Google&#39;s Compute Engine</a></h3>

<ul>
<li>Google Compute Engine is a &quot;cloud computing&quot; platform similar to EC2</li>
<li>Unfortunately, they only offer poor choices for the OS (Debian and CentOS)</li>
<li>Recently it&#39;s been announced that there is a custom OS option</li>
<li>It&#39;s using a WIP virtio-scsi driver, lots of things still need more work</li>
<li>Lots of technical and networking details about the struggles to get OpenBSD working on it
***</li>
</ul>

<h2>The Installfest</h2>

<p>We&#39;ll be showing you the installer of each of the main BSDs. As of the date this episode airs, we&#39;re using:</p>

<ul>
<li>FreeBSD 10.0</li>
<li>OpenBSD 5.4</li>
<li>NetBSD 6.1.2</li>
<li>DragonflyBSD 3.6</li>
<li>PCBSD 10.0
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://ctors.net/2013/12/30/openbsd_wireless_access_point" rel="nofollow">Building an OpenBSD wireless access point</a></h3>

<ul>
<li>A neat write up we found around the internet about making an OpenBSD wifi router</li>
<li>Goes through the process of PXE booting, installing base, using a serial console, setting up networking and wireless</li>
<li>Even includes a puffy sticker on the Soekris box at the end, how cute
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/1919" rel="nofollow">FreeBSD 4.X jails on 10.0</a></h3>

<ul>
<li>Blog entry from our buddy <a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">Michael Lucas</a></li>
<li>For whatever reason (an &quot;in-house application&quot;), he needed to run a FreeBSD 4 jail in FreeBSD 10</li>
<li>Talks about the options he had: porting software, virtualizing, dealing with slow old hardware</li>
<li>He goes through the whole process of making an ancient jail</li>
<li>It&#39;s &quot;an acceptable trade-off, if it means I don’t have to touch actual PHP code.&quot;
***</li>
</ul>

<h3><a href="http://www.skeptech.org/blog/2013/01/13/unscrewed-a-story-about-openbsd/" rel="nofollow">Unscrewed: a story about OpenBSD</a></h3>

<ul>
<li>Pretty long blog post about how a network admin used OpenBSD to save the day</li>
<li>To set the tone, &quot;It was 5am, and the network was down&quot;</li>
<li>Great war story about replacing expensive routers and networking equipment with cheaper hardware and BSD</li>
<li>Mentions a lot of the built in tools and how OpenBSD is great for routers and high security applications
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-2/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>10.0-RC3 is out and ready to be tested</li>
<li>New detection of ATI Hybrid Graphics, they&#39;re working on nVidia next</li>
<li>Re-classifying Linux jails as unsupported / experimental
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2uns1hMml" rel="nofollow">Daniel writes in</a></li>
<li><a href="http://slexy.org/view/s2MeJNCCiu" rel="nofollow">Erik writes in</a></li>
<li><a href="http://slexy.org/view/s21fBXkP2K" rel="nofollow">SW writes in</a></li>
<li>[Bostjan writes in[(<a href="http://slexy.org/view/s20N9bfkum" rel="nofollow">http://slexy.org/view/s20N9bfkum</a>)</li>
<li><a href="http://slexy.org/view/s20FU9wUO5" rel="nofollow">Samuel writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We&#39;ve got some special treats for you this week on the show. It&#39;s the long-awaited &quot;installfest&quot; segment, where we go through the installer of each of the different BSDs. Of course we also have your feedback and the latest news as well... and... we even have our very first viewer contest! There&#39;s a lot to get to today on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-hackers/2013-December/044009.html" rel="nofollow">FreeBSD&#39;s new testing infrastructure</a></h3>

<ul>
<li>A new test suite was added to FreeBSD, with 3 powerful machines available</li>
<li>Both -CURRENT and stable/10 have got the test suite build infrastructure in place</li>
<li>Designed to help developers test and improve major scalability across huge amounts of CPUs and RAM</li>
<li>More details <a href="http://julipedia.meroh.net/2013/12/introducing-freebsd-test-suite.html" rel="nofollow">available here</a></li>
<li>Could the iXsystems monster server be involved...?
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-cvs&m=138845902916897&w=2" rel="nofollow">OpenBSD gets signify</a></h3>

<ul>
<li>At long last, OpenBSD gets support for signed releases!</li>
<li>For &quot;the world&#39;s most secure OS&quot; it was very easy to MITM kernel patches, updates, installer isos, everything</li>
<li>A commit to the -current tree reveals a new &quot;signify&quot; tool is currently being kicked around</li>
<li>More details in <a href="http://www.tedunangst.com/flak/post/signify" rel="nofollow">a blog post</a> from the guy who committed it</li>
<li>Quote: &quot;yeah, briefly, the plan is to sign sets and packages. that&#39;s still work in progress.&quot;
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.ca/2013/12/faces-of-freebsd-isabell-long.html" rel="nofollow">Faces of FreeBSD</a></h3>

<ul>
<li>This time they interview Isabell Long</li>
<li>She&#39;s a volunteer staff member on the freenode IRC network</li>
<li>In 2011, she participated in the Google Code-In contest and became involved with documentation</li>
<li>&quot;The new committer mentoring process proved very useful and that, plus the accepting community of FreeBSD, are reasons why I stay involved.&quot;
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/pkgsrc-users/2013/12/31/msg019107.html" rel="nofollow">pkgsrc-2013Q4 branched</a></h3>

<ul>
<li>The quarterly pkgsrc branch from NetBSD is out</li>
<li>13472 total packages for NetBSD-current/amd64 + 13049 binary packages built with clang!</li>
<li>Lots of numbers and stats in the announcement</li>
<li>pkgsrc works on quite a few different OSes, not just NetBSD</li>
<li>See <a href="http://www.bsdnow.tv/episodes/2013_11_20-collecting_shells" rel="nofollow">our interview</a> with Amitai Schlair for a bit about pkgsrc
***</li>
</ul>

<h3><a href="http://marc.info/?l=openbsd-misc&m=138610199311393&w=2" rel="nofollow">OpenBSD on Google&#39;s Compute Engine</a></h3>

<ul>
<li>Google Compute Engine is a &quot;cloud computing&quot; platform similar to EC2</li>
<li>Unfortunately, they only offer poor choices for the OS (Debian and CentOS)</li>
<li>Recently it&#39;s been announced that there is a custom OS option</li>
<li>It&#39;s using a WIP virtio-scsi driver, lots of things still need more work</li>
<li>Lots of technical and networking details about the struggles to get OpenBSD working on it
***</li>
</ul>

<h2>The Installfest</h2>

<p>We&#39;ll be showing you the installer of each of the main BSDs. As of the date this episode airs, we&#39;re using:</p>

<ul>
<li>FreeBSD 10.0</li>
<li>OpenBSD 5.4</li>
<li>NetBSD 6.1.2</li>
<li>DragonflyBSD 3.6</li>
<li>PCBSD 10.0
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://ctors.net/2013/12/30/openbsd_wireless_access_point" rel="nofollow">Building an OpenBSD wireless access point</a></h3>

<ul>
<li>A neat write up we found around the internet about making an OpenBSD wifi router</li>
<li>Goes through the process of PXE booting, installing base, using a serial console, setting up networking and wireless</li>
<li>Even includes a puffy sticker on the Soekris box at the end, how cute
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/1919" rel="nofollow">FreeBSD 4.X jails on 10.0</a></h3>

<ul>
<li>Blog entry from our buddy <a href="http://www.bsdnow.tv/episodes/2013_11_06-year_of_the_bsd_desktop" rel="nofollow">Michael Lucas</a></li>
<li>For whatever reason (an &quot;in-house application&quot;), he needed to run a FreeBSD 4 jail in FreeBSD 10</li>
<li>Talks about the options he had: porting software, virtualizing, dealing with slow old hardware</li>
<li>He goes through the whole process of making an ancient jail</li>
<li>It&#39;s &quot;an acceptable trade-off, if it means I don’t have to touch actual PHP code.&quot;
***</li>
</ul>

<h3><a href="http://www.skeptech.org/blog/2013/01/13/unscrewed-a-story-about-openbsd/" rel="nofollow">Unscrewed: a story about OpenBSD</a></h3>

<ul>
<li>Pretty long blog post about how a network admin used OpenBSD to save the day</li>
<li>To set the tone, &quot;It was 5am, and the network was down&quot;</li>
<li>Great war story about replacing expensive routers and networking equipment with cheaper hardware and BSD</li>
<li>Mentions a lot of the built in tools and how OpenBSD is great for routers and high security applications
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2014/01/pc-bsd-weekly-feature-digest-2/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>10.0-RC3 is out and ready to be tested</li>
<li>New detection of ATI Hybrid Graphics, they&#39;re working on nVidia next</li>
<li>Re-classifying Linux jails as unsupported / experimental
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2uns1hMml" rel="nofollow">Daniel writes in</a></li>
<li><a href="http://slexy.org/view/s2MeJNCCiu" rel="nofollow">Erik writes in</a></li>
<li><a href="http://slexy.org/view/s21fBXkP2K" rel="nofollow">SW writes in</a></li>
<li>[Bostjan writes in[(<a href="http://slexy.org/view/s20N9bfkum" rel="nofollow">http://slexy.org/view/s20N9bfkum</a>)</li>
<li><a href="http://slexy.org/view/s20FU9wUO5" rel="nofollow">Samuel writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>18: Eclipsing Binaries</title>
  <link>https://www.bsdnow.tv/18</link>
  <guid isPermaLink="false">96a80a26-313b-4891-a505-fa71245e4e84</guid>
  <pubDate>Wed, 01 Jan 2014 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/96a80a26-313b-4891-a505-fa71245e4e84.mp3" length="50662433" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Put away the Christmas trees and update your ports trees! We're back with the first show of 2014, and we've got some catching up to do. This time on the show, we have an interview with Baptiste Daroussin about the future of FreeBSD binary packages. Following that, we'll be highlighting a cool script to do binary upgrades on OpenBSD. Lots of holiday news and listener feedback, on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:10:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Put away the Christmas trees and update your ports trees! We're back with the first show of 2014, and we've got some catching up to do. This time on the show, we have an interview with Baptiste Daroussin about the future of FreeBSD binary packages. Following that, we'll be highlighting a cool script to do binary upgrades on OpenBSD. Lots of holiday news and listener feedback, on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
Faces of FreeBSD continues (http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-shteryana-shopova.html)
Our first one details Shteryana Shopova, the local organizer for EuroBSDCon 2014 in Sophia
Gives some information about how she got into BSD
"I installed FreeBSD on my laptop, alongside the Windows and Slackware Linux I was running on it at the time. Several months later I realized that apart from FreeBSD, I hadn't booted the other two operating systems in months. So I wiped them out."
She wrote bsnmpd and extended it with the help of a grant from the FreeBSD Foundation
We've also got one for Kevin Martin (http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-kevin-martin.html)
Started off with a pinball website, ended up learning about FreeBSD from an ISP and starting his own hosting company
"FreeBSD has been an asset to our operations, and while we have branched out a bit, we still primarily use FreeBSD and promote it whenever possible.  FreeBSD is a terrific technology with a terrific community."
***
OpenPF? (http://www.shiningsilence.com/dbsdlog/2013/12/19/13008.html)
A blog post over at the Dragonfly digest (http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug)
What if we had some cross platform development of OpenBSD's firewall?
Similar to portable OpenSSH (http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline) or OpenZFS (http://www.bsdnow.tv/episodes/2013_12_04-zettabytes_for_days), there could be a centrally-developed version with compatibility glue
Right now FreeBSD 9's pf is old, FreeBSD 10's pf is old (but has the best performance of any implementation due to custom patches), NetBSD's pf is old (but they're working on a fork) and Dragonfly's pf is old
Further complicated by the fact that PF itself doesn’t have a version number, since it was designed to just be ‘the pf that came with OpenBSD 5.4’
Not likely to happen any time soon, but it's good food for thought
***
Year of BSD on the server (http://mxey.net/the-year-of-freebsd-on-the-server/)
A good blog post about switching servers from Linux to BSD
2014 is going to be the year of a lot of switching, due to FreeBSD 10's amazing new features
This author was particularly taken with pkgng (http://www.bsdnow.tv/tutorials/pkgng) and the more coherent layout of BSD systems
Similarly, there was also a recent reddit thread (http://www.reddit.com/r/BSD/comments/1tdrz1/why_did_you_choose_bsd_over_linux/), "Why did you choose BSD over Linux?"
Both are excellent reads for Linux users that are thinking about making the switch, send 'em to your friends
***
Getting to know your portmgr (http://blogs.freebsdish.org/portmgr/2013/12/24/getting-to-know-your-portmgr-bryan-drewery/)
This time in the series they interview Bryan Drewery, a fairly new addition to the team
He started maintaining portupgrade and portmaster, and eventually ended up on the ports management team
Believe it or not, his wife actually had a lot to do with him getting into FreeBSD full-time
Lots of fun trivia and background about him
Speaking of portmgr, our interview for today is...
***
Interview - Baptiste Daroussin - bapt@freebsd.org (mailto:bapt@freebsd.org)
The future of FreeBSD's binary packages (http://www.bsdnow.tv/tutorials/pkgng), ports' features, various topics
News Roundup
pfSense december hang out (https://www.youtube.com/watch?v=aD-2e9u3tug)
Interview/presentation from pfSense developer Chris Buechler with an accompanying blog post (http://blog.pfsense.org/?p=1146)
"This is the first in what will be a monthly recurring series. Each month, we’ll have a how to tutorial on a specific topic or area of the system, and updates on development and other happenings with the project. We have several topics in mind, but also welcome community suggestions on topics"
Speaking of pfSense, they recently opened an online store (http://blog.pfsense.org/?p=1156)
We're planning on having a pfSense episode next month!
***
BSDMag December issue is out (http://bsdmag.org/magazine/1854-carp-on-freebsd-how-to-use-devd-to-take-action-on-kernel-events)
The free monthly BSD magazine gets a new release for December
Topics include CARP on FreeBSD, more BSD programming, "unix basics for security professionals," some kernel introductions, using OpenBSD as a transparent proxy with relayd, GhostBSD overview and some stuff about SSH
***
OpenBSD gets tmpfs (http://undeadly.org/cgi?action=article&amp;amp;sid=20131217081921)
In addition to the recently-added FUSE support, OpenBSD now has tmpfs
To get more testing, it was enabled by default in -current
Should make its way into 5.5 if everything goes according to plan
Enables lots of new possibilities, like our ccache and tmpfs guide (http://www.bsdnow.tv/tutorials/ccache)
***
PCBSD weekly digests (http://blog.pcbsd.org/2013/12/pc-bsd-weekly-feature-digest-122013/)
Catching up with all the work going on in PCBSD land..
10.0-RC2 is now available (http://blog.pcbsd.org/2013/12/weekly-feature-digest-122713/)
The big pkgng 1.2 problems seem to have been worked out
***
Feedback/Questions
Remy writes in (http://slexy.org/view/s2UrUzlnf6)
Jason writes in (http://slexy.org/view/s2iqnywwKX)
Rob writes in (http://slexy.org/view/s2IUcPySbh)
John writes in (http://slexy.org/view/s21aYlbXz2)
Stuart writes in (http://slexy.org/view/s21vrYSqU8)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, binary, upgrade, update, openbsd-binary-upgrade, freebsd-update, patches, signed, bapt, portmgr, ports, binary star, packages, pkgng, tmpfs, pkg_add, pf, firewall, pfsense, hangout, switching from linux to bsd, linux bsd differences, bsdmag</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Put away the Christmas trees and update your ports trees! We&#39;re back with the first show of 2014, and we&#39;ve got some catching up to do. This time on the show, we have an interview with Baptiste Daroussin about the future of FreeBSD binary packages. Following that, we&#39;ll be highlighting a cool script to do binary upgrades on OpenBSD. Lots of holiday news and listener feedback, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-shteryana-shopova.html" rel="nofollow">Faces of FreeBSD continues</a></h3>

<ul>
<li>Our first one details Shteryana Shopova, the local organizer for EuroBSDCon 2014 in Sophia</li>
<li>Gives some information about how she got into BSD</li>
<li>&quot;I installed FreeBSD on my laptop, alongside the Windows and Slackware Linux I was running on it at the time. Several months later I realized that apart from FreeBSD, I hadn&#39;t booted the other two operating systems in months. So I wiped them out.&quot;</li>
<li>She wrote bsnmpd and extended it with the help of a grant from the FreeBSD Foundation</li>
<li>We&#39;ve also got one for <a href="http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-kevin-martin.html" rel="nofollow">Kevin Martin</a></li>
<li>Started off with a pinball website, ended up learning about FreeBSD from an ISP and starting his own hosting company</li>
<li>&quot;FreeBSD has been an asset to our operations, and while we have branched out a bit, we still primarily use FreeBSD and promote it whenever possible.  FreeBSD is a terrific technology with a terrific community.&quot;
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2013/12/19/13008.html" rel="nofollow">OpenPF?</a></h3>

<ul>
<li>A blog post over at the <a href="http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug" rel="nofollow">Dragonfly digest</a></li>
<li>What if we had some cross platform development of OpenBSD&#39;s firewall?</li>
<li>Similar to portable <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">OpenSSH</a> or <a href="http://www.bsdnow.tv/episodes/2013_12_04-zettabytes_for_days" rel="nofollow">OpenZFS</a>, there could be a centrally-developed version with compatibility glue</li>
<li>Right now FreeBSD 9&#39;s pf is old, FreeBSD 10&#39;s pf is old (but has the best performance of any implementation due to custom patches), NetBSD&#39;s pf is old (but they&#39;re working on a fork) and Dragonfly&#39;s pf is old</li>
<li>Further complicated by the fact that PF itself doesn’t have a version number, since it was designed to just be ‘the pf that came with OpenBSD 5.4’</li>
<li>Not likely to happen any time soon, but it&#39;s good food for thought
***</li>
</ul>

<h3><a href="http://mxey.net/the-year-of-freebsd-on-the-server/" rel="nofollow">Year of BSD on the server</a></h3>

<ul>
<li>A good blog post about switching servers from Linux to BSD</li>
<li>2014 is going to be the year of a lot of switching, due to FreeBSD 10&#39;s amazing new features</li>
<li>This author was particularly taken with <a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">pkgng</a> and the more coherent layout of BSD systems</li>
<li>Similarly, there was also a recent <a href="http://www.reddit.com/r/BSD/comments/1tdrz1/why_did_you_choose_bsd_over_linux/" rel="nofollow">reddit thread</a>, &quot;Why did you choose BSD over Linux?&quot;</li>
<li>Both are excellent reads for Linux users that are thinking about making the switch, send &#39;em to your friends
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2013/12/24/getting-to-know-your-portmgr-bryan-drewery/" rel="nofollow">Getting to know your portmgr</a></h3>

<ul>
<li>This time in the series they interview Bryan Drewery, a fairly new addition to the team</li>
<li>He started maintaining portupgrade and portmaster, and eventually ended up on the ports management team</li>
<li>Believe it or not, his wife actually had a lot to do with him getting into FreeBSD full-time</li>
<li>Lots of fun trivia and background about him</li>
<li>Speaking of portmgr, our interview for today is...
***</li>
</ul>

<h2>Interview - Baptiste Daroussin - <a href="mailto:bapt@freebsd.org" rel="nofollow">bapt@freebsd.org</a></h2>

<p>The future of FreeBSD&#39;s <a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">binary packages</a>, ports&#39; features, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.youtube.com/watch?v=aD-2e9u3tug" rel="nofollow">pfSense december hang out</a></h3>

<ul>
<li>Interview/presentation from pfSense developer Chris Buechler with an <a href="http://blog.pfsense.org/?p=1146" rel="nofollow">accompanying blog post</a></li>
<li>&quot;This is the first in what will be a monthly recurring series. Each month, we’ll have a how to tutorial on a specific topic or area of the system, and updates on development and other happenings with the project. We have several topics in mind, but also welcome community suggestions on topics&quot;</li>
<li>Speaking of pfSense, they recently opened an <a href="http://blog.pfsense.org/?p=1156" rel="nofollow">online store</a></li>
<li>We&#39;re planning on having a pfSense episode next month!
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1854-carp-on-freebsd-how-to-use-devd-to-take-action-on-kernel-events" rel="nofollow">BSDMag December issue is out</a></h3>

<ul>
<li>The free monthly BSD magazine gets a new release for December</li>
<li>Topics include CARP on FreeBSD, more BSD programming, &quot;unix basics for security professionals,&quot; some kernel introductions, using OpenBSD as a transparent proxy with relayd, GhostBSD overview and some stuff about SSH
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20131217081921" rel="nofollow">OpenBSD gets tmpfs</a></h3>

<ul>
<li>In addition to the recently-added FUSE support, OpenBSD now has tmpfs</li>
<li>To get more testing, it was enabled by default in -current</li>
<li>Should make its way into 5.5 if everything goes according to plan</li>
<li>Enables lots of new possibilities, like our <a href="http://www.bsdnow.tv/tutorials/ccache" rel="nofollow">ccache and tmpfs guide</a>
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2013/12/pc-bsd-weekly-feature-digest-122013/" rel="nofollow">PCBSD weekly digests</a></h3>

<ul>
<li>Catching up with all the work going on in PCBSD land..</li>
<li><a href="http://blog.pcbsd.org/2013/12/weekly-feature-digest-122713/" rel="nofollow">10.0-RC2 is now available</a></li>
<li>The big pkgng 1.2 problems seem to have been worked out
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2UrUzlnf6" rel="nofollow">Remy writes in</a></li>
<li><a href="http://slexy.org/view/s2iqnywwKX" rel="nofollow">Jason writes in</a></li>
<li><a href="http://slexy.org/view/s2IUcPySbh" rel="nofollow">Rob writes in</a></li>
<li><a href="http://slexy.org/view/s21aYlbXz2" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s21vrYSqU8" rel="nofollow">Stuart writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Put away the Christmas trees and update your ports trees! We&#39;re back with the first show of 2014, and we&#39;ve got some catching up to do. This time on the show, we have an interview with Baptiste Daroussin about the future of FreeBSD binary packages. Following that, we&#39;ll be highlighting a cool script to do binary upgrades on OpenBSD. Lots of holiday news and listener feedback, on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-shteryana-shopova.html" rel="nofollow">Faces of FreeBSD continues</a></h3>

<ul>
<li>Our first one details Shteryana Shopova, the local organizer for EuroBSDCon 2014 in Sophia</li>
<li>Gives some information about how she got into BSD</li>
<li>&quot;I installed FreeBSD on my laptop, alongside the Windows and Slackware Linux I was running on it at the time. Several months later I realized that apart from FreeBSD, I hadn&#39;t booted the other two operating systems in months. So I wiped them out.&quot;</li>
<li>She wrote bsnmpd and extended it with the help of a grant from the FreeBSD Foundation</li>
<li>We&#39;ve also got one for <a href="http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-kevin-martin.html" rel="nofollow">Kevin Martin</a></li>
<li>Started off with a pinball website, ended up learning about FreeBSD from an ISP and starting his own hosting company</li>
<li>&quot;FreeBSD has been an asset to our operations, and while we have branched out a bit, we still primarily use FreeBSD and promote it whenever possible.  FreeBSD is a terrific technology with a terrific community.&quot;
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2013/12/19/13008.html" rel="nofollow">OpenPF?</a></h3>

<ul>
<li>A blog post over at the <a href="http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug" rel="nofollow">Dragonfly digest</a></li>
<li>What if we had some cross platform development of OpenBSD&#39;s firewall?</li>
<li>Similar to portable <a href="http://www.bsdnow.tv/episodes/2013_12_18-cryptocrystalline" rel="nofollow">OpenSSH</a> or <a href="http://www.bsdnow.tv/episodes/2013_12_04-zettabytes_for_days" rel="nofollow">OpenZFS</a>, there could be a centrally-developed version with compatibility glue</li>
<li>Right now FreeBSD 9&#39;s pf is old, FreeBSD 10&#39;s pf is old (but has the best performance of any implementation due to custom patches), NetBSD&#39;s pf is old (but they&#39;re working on a fork) and Dragonfly&#39;s pf is old</li>
<li>Further complicated by the fact that PF itself doesn’t have a version number, since it was designed to just be ‘the pf that came with OpenBSD 5.4’</li>
<li>Not likely to happen any time soon, but it&#39;s good food for thought
***</li>
</ul>

<h3><a href="http://mxey.net/the-year-of-freebsd-on-the-server/" rel="nofollow">Year of BSD on the server</a></h3>

<ul>
<li>A good blog post about switching servers from Linux to BSD</li>
<li>2014 is going to be the year of a lot of switching, due to FreeBSD 10&#39;s amazing new features</li>
<li>This author was particularly taken with <a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">pkgng</a> and the more coherent layout of BSD systems</li>
<li>Similarly, there was also a recent <a href="http://www.reddit.com/r/BSD/comments/1tdrz1/why_did_you_choose_bsd_over_linux/" rel="nofollow">reddit thread</a>, &quot;Why did you choose BSD over Linux?&quot;</li>
<li>Both are excellent reads for Linux users that are thinking about making the switch, send &#39;em to your friends
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2013/12/24/getting-to-know-your-portmgr-bryan-drewery/" rel="nofollow">Getting to know your portmgr</a></h3>

<ul>
<li>This time in the series they interview Bryan Drewery, a fairly new addition to the team</li>
<li>He started maintaining portupgrade and portmaster, and eventually ended up on the ports management team</li>
<li>Believe it or not, his wife actually had a lot to do with him getting into FreeBSD full-time</li>
<li>Lots of fun trivia and background about him</li>
<li>Speaking of portmgr, our interview for today is...
***</li>
</ul>

<h2>Interview - Baptiste Daroussin - <a href="mailto:bapt@freebsd.org" rel="nofollow">bapt@freebsd.org</a></h2>

<p>The future of FreeBSD&#39;s <a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">binary packages</a>, ports&#39; features, various topics</p>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.youtube.com/watch?v=aD-2e9u3tug" rel="nofollow">pfSense december hang out</a></h3>

<ul>
<li>Interview/presentation from pfSense developer Chris Buechler with an <a href="http://blog.pfsense.org/?p=1146" rel="nofollow">accompanying blog post</a></li>
<li>&quot;This is the first in what will be a monthly recurring series. Each month, we’ll have a how to tutorial on a specific topic or area of the system, and updates on development and other happenings with the project. We have several topics in mind, but also welcome community suggestions on topics&quot;</li>
<li>Speaking of pfSense, they recently opened an <a href="http://blog.pfsense.org/?p=1156" rel="nofollow">online store</a></li>
<li>We&#39;re planning on having a pfSense episode next month!
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1854-carp-on-freebsd-how-to-use-devd-to-take-action-on-kernel-events" rel="nofollow">BSDMag December issue is out</a></h3>

<ul>
<li>The free monthly BSD magazine gets a new release for December</li>
<li>Topics include CARP on FreeBSD, more BSD programming, &quot;unix basics for security professionals,&quot; some kernel introductions, using OpenBSD as a transparent proxy with relayd, GhostBSD overview and some stuff about SSH
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20131217081921" rel="nofollow">OpenBSD gets tmpfs</a></h3>

<ul>
<li>In addition to the recently-added FUSE support, OpenBSD now has tmpfs</li>
<li>To get more testing, it was enabled by default in -current</li>
<li>Should make its way into 5.5 if everything goes according to plan</li>
<li>Enables lots of new possibilities, like our <a href="http://www.bsdnow.tv/tutorials/ccache" rel="nofollow">ccache and tmpfs guide</a>
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2013/12/pc-bsd-weekly-feature-digest-122013/" rel="nofollow">PCBSD weekly digests</a></h3>

<ul>
<li>Catching up with all the work going on in PCBSD land..</li>
<li><a href="http://blog.pcbsd.org/2013/12/weekly-feature-digest-122713/" rel="nofollow">10.0-RC2 is now available</a></li>
<li>The big pkgng 1.2 problems seem to have been worked out
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2UrUzlnf6" rel="nofollow">Remy writes in</a></li>
<li><a href="http://slexy.org/view/s2iqnywwKX" rel="nofollow">Jason writes in</a></li>
<li><a href="http://slexy.org/view/s2IUcPySbh" rel="nofollow">Rob writes in</a></li>
<li><a href="http://slexy.org/view/s21aYlbXz2" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s21vrYSqU8" rel="nofollow">Stuart writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>17: The Gift of Giving</title>
  <link>https://www.bsdnow.tv/17</link>
  <guid isPermaLink="false">c51be78b-bd80-4b82-ac8c-4c8a6a8a1116</guid>
  <pubDate>Wed, 25 Dec 2013 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c51be78b-bd80-4b82-ac8c-4c8a6a8a1116.mp3" length="13521166" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>Merry Christmas everyone! We're taking the holiday off and just have an interview for you today. We sat down with Scott Long to discuss using FreeBSD at Netflix and lots of other things. Next week we will return with the normal round of news and tutorials.</itunes:subtitle>
  <itunes:duration>18:46</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>Merry Christmas everyone! We're taking the holiday off and just have an interview for you today. We sat down with Scott Long to discuss using FreeBSD at Netflix and lots of other things. Next week we will return with the normal round of news and tutorials.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Interview - Scott Long - scottl@freebsd.org (mailto:scottl@freebsd.org)
FreeBSD at Netflix, OpenConnect, network performance, various topics
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, netflix, yahoo, scott long, scottl, release engineering, cdn, openconnect, high performance, ssd, raid, gigabit, tuning</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Merry Christmas everyone! We&#39;re taking the holiday off and just have an interview for you today. We sat down with Scott Long to discuss using FreeBSD at Netflix and lots of other things. Next week we will return with the normal round of news and tutorials.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Interview - Scott Long - <a href="mailto:scottl@freebsd.org" rel="nofollow">scottl@freebsd.org</a></h2>

<p>FreeBSD at Netflix, OpenConnect, network performance, various topics</p>

<hr>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Merry Christmas everyone! We&#39;re taking the holiday off and just have an interview for you today. We sat down with Scott Long to discuss using FreeBSD at Netflix and lots of other things. Next week we will return with the normal round of news and tutorials.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Interview - Scott Long - <a href="mailto:scottl@freebsd.org" rel="nofollow">scottl@freebsd.org</a></h2>

<p>FreeBSD at Netflix, OpenConnect, network performance, various topics</p>

<hr>]]>
  </itunes:summary>
</item>
<item>
  <title>16: Cryptocrystalline</title>
  <link>https://www.bsdnow.tv/16</link>
  <guid isPermaLink="false">d9af27cf-c4ff-4572-b119-cbfd0e4167c8</guid>
  <pubDate>Wed, 18 Dec 2013 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d9af27cf-c4ff-4572-b119-cbfd0e4167c8.mp3" length="79454910" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we'll be showing you how to do a fully-encrypted installation of FreeBSD and OpenBSD. We also have an interview with Damien Miller - one of the lead developers of OpenSSH - about some recent crypto changes in the project. If you're into data security, today's the show for you. The latest news and all your burning questions answered, right here on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:50:21</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we'll be showing you how to do a fully-encrypted installation of FreeBSD and OpenBSD. We also have an interview with Damien Miller - one of the lead developers of OpenSSH - about some recent crypto changes in the project. If you're into data security, today's the show for you. The latest news and all your burning questions answered, right here on BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
Secure communications with OpenBSD and OpenVPN (http://johnchapin.boostrot.net/blog/2013/12/07/secure-comms-with-openbsd-and-openvpn-part-1/)
Starting off today's theme of encryption...
A new blog series about combining OpenBSD and OpenVPN to secure your internet traffic
Part 1 covers installing OpenBSD with full disk encryption (which we'll be doing later on in the show)
Part 2 covers the initial setup of OpenVPN certificates and keys
Parts 3 and 4 are the OpenVPN server and client configuration
Part 5 is some updates and closing remarks
***
FreeBSD Foundation Newsletter (https://www.freebsdfoundation.org/press/2013Dec-newsletter)
The December 2013 semi-annual newsletter was sent out from the foundation
In the newsletter you will find the president's letter, articles on the current development projects they sponsor and reports from all the conferences and summits they sponsored
The president's letter alone is worth the read, really amazing
Really long, with lots of details and stories from the conferences and projects
***
Use of NetBSD with Marvell Kirkwood Processors (http://evertiq.com/design/33394)
Article that gives a brief history of NetBSD and how to use it on an IP-Plug computer
The IP-Plug is a "multi-functional mini-server was developed by Promwad engineers by the order of AK-Systems. It is designed for solving a wide range of tasks in IP networks and can perform the functions of a computer or a server. The IP-Plug is powered from a 220V network and has low power consumption, as well as a small size (which can be compared to the size of a mobile phone charger)."
Really cool little NetBSD ARM project with lots of graphs, pictures and details
***
Experimenting with zero-copy network IO (http://adrianchadd.blogspot.com/2013/12/experimenting-with-zero-copy-network-io.html)
Long blog post from Adrian Chadd about zero-copy network IO on FreeBSD
Discusses the different OS' implementations and options
He's able to get 35 gbit/sec out of 70,000 active TCP sockets, but isn't stopping there
Tons of details, check the full post
***
Interview - Damien Miller - djm@openbsd.org (mailto:djm@openbsd.org) / @damienmiller (https://twitter.com/damienmiller)
Cryptography in OpenBSD and OpenSSH
Tutorial
Full disk encryption in FreeBSD &amp;amp; OpenBSD (http://www.bsdnow.tv/tutorials/fde)
News Roundup
OpenZFS office hours (https://www.youtube.com/watch?v=wWmVW2R_uz8)
Our buddy George Wilson (http://www.bsdnow.tv/episodes/2013_12_04-zettabytes_for_days) sat down to take some ZFS questions from the community
You can see more info about it here (http://open-zfs.org/wiki/OpenZFS_Office_Hours)
***
License summaries in pkgng (http://www.shiningsilence.com/dbsdlog/2013/12/09/12934.html)
A discussion between Justin Sherill (http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug) and some NYCBUG guys about license frameworks in pkgng
Similar to pkgsrc's "ACCEPTABLE_LICENSES" setting, pkgng could let the user decide which software licenses he wants to allow
Maybe we could get a "pkg licenses" command to display the license of all installed packages
Ok bapt, do it
***
The FreeBSD challenge continues (http://thelinuxcauldron.com/2013/12/08/freebsd-challenge/)
Checking in with our buddy from the Linux foundation...
The switching from Linux to FreeBSD blog series continues for his month-long trial
Follow up from last week: "As a matter of fact, I did check out PC-BSD, and wanted the challenge.  Call me addicted to pain and suffering, but the pride and accomplishment you feel from diving into FreeBSD is quite rewarding."
Since we last mentioned it, he's decided to go from a VM to real hardware, got all of his common software installed, experimented with the Linux emulation, set up virtualbox, learned about slices/partitions/disk management, found BSD alternatives to his regularly-used commands and lots more
***
Ports gets a stable branch (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=336615)
For the first time ever, FreeBSD's ports tree will have a maintained "stable" branch
This is similar to how pkgsrc does things, with a rolling release for updated software and stable branch for only security and big fixes
All commits to this branch require approval of portmgr, looks like it'll start in 2014Q1
***
Feedback/Questions
John writes in (http://slexy.org/view/s2iRV1tOzB)
Spencer writes in (http://slexy.org/view/s21gAR5lgf)
Campbell writes in (http://slexy.org/view/s203iOnFh1)
Sha'ul writes in (http://slexy.org/view/s2yUqj3vKW)
Clint writes in (http://slexy.org/view/s2egcTPBXH)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonfly bsd, pcbsd, tutorial, howto, guide, bsd, interview, ssh, arm, openssh, sftp, security, damien miller, djm, mindrot, encryption, crypto, chacha20, poly1305, aes, hmac, mac, sha256, cipher, rc4, base64, encode, decode, ed25519, bcrypt, md5, hash, salt, openzfs, office hours, openvpn, vps, vpn, ssl, tun, tap, foundation, newsletter, freebsd journal, ixsystems, ecc, rsa, dsa, ecdsa, tunnel, keys, password, passphrase, full disk encryption, fde, installation, encrypted install, unencrypted</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ll be showing you how to do a fully-encrypted installation of FreeBSD and OpenBSD. We also have an interview with Damien Miller - one of the lead developers of OpenSSH - about some recent crypto changes in the project. If you&#39;re into data security, today&#39;s the show for you. The latest news and all your burning questions answered, right here on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://johnchapin.boostrot.net/blog/2013/12/07/secure-comms-with-openbsd-and-openvpn-part-1/" rel="nofollow">Secure communications with OpenBSD and OpenVPN</a></h3>

<ul>
<li>Starting off today&#39;s theme of encryption...</li>
<li>A new blog series about combining OpenBSD and OpenVPN to secure your internet traffic</li>
<li>Part 1 covers installing OpenBSD with full disk encryption (which we&#39;ll be doing later on in the show)</li>
<li>Part 2 covers the initial setup of OpenVPN certificates and keys</li>
<li>Parts 3 and 4 are the OpenVPN server and client configuration</li>
<li>Part 5 is some updates and closing remarks
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/press/2013Dec-newsletter" rel="nofollow">FreeBSD Foundation Newsletter</a></h3>

<ul>
<li>The December 2013 semi-annual newsletter was sent out from the foundation</li>
<li>In the newsletter you will find the president&#39;s letter, articles on the current development projects they sponsor and reports from all the conferences and summits they sponsored</li>
<li>The president&#39;s letter alone is worth the read, really amazing</li>
<li>Really long, with lots of details and stories from the conferences and projects
***</li>
</ul>

<h3><a href="http://evertiq.com/design/33394" rel="nofollow">Use of NetBSD with Marvell Kirkwood Processors</a></h3>

<ul>
<li>Article that gives a brief history of NetBSD and how to use it on an IP-Plug computer</li>
<li>The IP-Plug is a &quot;multi-functional mini-server was developed by Promwad engineers by the order of AK-Systems. It is designed for solving a wide range of tasks in IP networks and can perform the functions of a computer or a server. The IP-Plug is powered from a 220V network and has low power consumption, as well as a small size (which can be compared to the size of a mobile phone charger).&quot;</li>
<li>Really cool little NetBSD ARM project with lots of graphs, pictures and details
***</li>
</ul>

<h3><a href="http://adrianchadd.blogspot.com/2013/12/experimenting-with-zero-copy-network-io.html" rel="nofollow">Experimenting with zero-copy network IO</a></h3>

<ul>
<li>Long blog post from Adrian Chadd about zero-copy network IO on FreeBSD</li>
<li>Discusses the different OS&#39; implementations and options</li>
<li>He&#39;s able to get 35 gbit/sec out of 70,000 active TCP sockets, but isn&#39;t stopping there</li>
<li>Tons of details, check the full post
***</li>
</ul>

<h2>Interview - Damien Miller - <a href="mailto:djm@openbsd.org" rel="nofollow">djm@openbsd.org</a> / <a href="https://twitter.com/damienmiller" rel="nofollow">@damienmiller</a></h2>

<p>Cryptography in OpenBSD and OpenSSH</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">Full disk encryption in FreeBSD &amp; OpenBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.youtube.com/watch?v=wWmVW2R_uz8" rel="nofollow">OpenZFS office hours</a></h3>

<ul>
<li>Our buddy <a href="http://www.bsdnow.tv/episodes/2013_12_04-zettabytes_for_days" rel="nofollow">George Wilson</a> sat down to take some ZFS questions from the community</li>
<li>You can see more info about it <a href="http://open-zfs.org/wiki/OpenZFS_Office_Hours" rel="nofollow">here</a>
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2013/12/09/12934.html" rel="nofollow">License summaries in pkgng</a></h3>

<ul>
<li>A discussion between <a href="http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug" rel="nofollow">Justin Sherill</a> and some NYCBUG guys about license frameworks in pkgng</li>
<li>Similar to pkgsrc&#39;s &quot;ACCEPTABLE_LICENSES&quot; setting, pkgng could let the user decide which software licenses he wants to allow</li>
<li>Maybe we could get a &quot;pkg licenses&quot; command to display the license of all installed packages</li>
<li>Ok bapt, do it
***</li>
</ul>

<h3><a href="http://thelinuxcauldron.com/2013/12/08/freebsd-challenge/" rel="nofollow">The FreeBSD challenge continues</a></h3>

<ul>
<li>Checking in with our buddy from the Linux foundation...</li>
<li>The switching from Linux to FreeBSD blog series continues for his month-long trial</li>
<li>Follow up from last week: &quot;As a matter of fact, I did check out PC-BSD, and wanted the challenge.  Call me addicted to pain and suffering, but the pride and accomplishment you feel from diving into FreeBSD is quite rewarding.&quot;</li>
<li>Since we last mentioned it, he&#39;s decided to go from a VM to real hardware, got all of his common software installed, experimented with the Linux emulation, set up virtualbox, learned about slices/partitions/disk management, found BSD alternatives to his regularly-used commands and lots more
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=336615" rel="nofollow">Ports gets a stable branch</a></h3>

<ul>
<li>For the first time ever, FreeBSD&#39;s ports tree will have a maintained &quot;stable&quot; branch</li>
<li>This is similar to how pkgsrc does things, with a rolling release for updated software and stable branch for only security and big fixes</li>
<li>All commits to this branch require approval of portmgr, looks like it&#39;ll start in 2014Q1
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2iRV1tOzB" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s21gAR5lgf" rel="nofollow">Spencer writes in</a></li>
<li><a href="http://slexy.org/view/s203iOnFh1" rel="nofollow">Campbell writes in</a></li>
<li><a href="http://slexy.org/view/s2yUqj3vKW" rel="nofollow">Sha&#39;ul writes in</a></li>
<li><a href="http://slexy.org/view/s2egcTPBXH" rel="nofollow">Clint writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ll be showing you how to do a fully-encrypted installation of FreeBSD and OpenBSD. We also have an interview with Damien Miller - one of the lead developers of OpenSSH - about some recent crypto changes in the project. If you&#39;re into data security, today&#39;s the show for you. The latest news and all your burning questions answered, right here on BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://johnchapin.boostrot.net/blog/2013/12/07/secure-comms-with-openbsd-and-openvpn-part-1/" rel="nofollow">Secure communications with OpenBSD and OpenVPN</a></h3>

<ul>
<li>Starting off today&#39;s theme of encryption...</li>
<li>A new blog series about combining OpenBSD and OpenVPN to secure your internet traffic</li>
<li>Part 1 covers installing OpenBSD with full disk encryption (which we&#39;ll be doing later on in the show)</li>
<li>Part 2 covers the initial setup of OpenVPN certificates and keys</li>
<li>Parts 3 and 4 are the OpenVPN server and client configuration</li>
<li>Part 5 is some updates and closing remarks
***</li>
</ul>

<h3><a href="https://www.freebsdfoundation.org/press/2013Dec-newsletter" rel="nofollow">FreeBSD Foundation Newsletter</a></h3>

<ul>
<li>The December 2013 semi-annual newsletter was sent out from the foundation</li>
<li>In the newsletter you will find the president&#39;s letter, articles on the current development projects they sponsor and reports from all the conferences and summits they sponsored</li>
<li>The president&#39;s letter alone is worth the read, really amazing</li>
<li>Really long, with lots of details and stories from the conferences and projects
***</li>
</ul>

<h3><a href="http://evertiq.com/design/33394" rel="nofollow">Use of NetBSD with Marvell Kirkwood Processors</a></h3>

<ul>
<li>Article that gives a brief history of NetBSD and how to use it on an IP-Plug computer</li>
<li>The IP-Plug is a &quot;multi-functional mini-server was developed by Promwad engineers by the order of AK-Systems. It is designed for solving a wide range of tasks in IP networks and can perform the functions of a computer or a server. The IP-Plug is powered from a 220V network and has low power consumption, as well as a small size (which can be compared to the size of a mobile phone charger).&quot;</li>
<li>Really cool little NetBSD ARM project with lots of graphs, pictures and details
***</li>
</ul>

<h3><a href="http://adrianchadd.blogspot.com/2013/12/experimenting-with-zero-copy-network-io.html" rel="nofollow">Experimenting with zero-copy network IO</a></h3>

<ul>
<li>Long blog post from Adrian Chadd about zero-copy network IO on FreeBSD</li>
<li>Discusses the different OS&#39; implementations and options</li>
<li>He&#39;s able to get 35 gbit/sec out of 70,000 active TCP sockets, but isn&#39;t stopping there</li>
<li>Tons of details, check the full post
***</li>
</ul>

<h2>Interview - Damien Miller - <a href="mailto:djm@openbsd.org" rel="nofollow">djm@openbsd.org</a> / <a href="https://twitter.com/damienmiller" rel="nofollow">@damienmiller</a></h2>

<p>Cryptography in OpenBSD and OpenSSH</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/fde" rel="nofollow">Full disk encryption in FreeBSD &amp; OpenBSD</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://www.youtube.com/watch?v=wWmVW2R_uz8" rel="nofollow">OpenZFS office hours</a></h3>

<ul>
<li>Our buddy <a href="http://www.bsdnow.tv/episodes/2013_12_04-zettabytes_for_days" rel="nofollow">George Wilson</a> sat down to take some ZFS questions from the community</li>
<li>You can see more info about it <a href="http://open-zfs.org/wiki/OpenZFS_Office_Hours" rel="nofollow">here</a>
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2013/12/09/12934.html" rel="nofollow">License summaries in pkgng</a></h3>

<ul>
<li>A discussion between <a href="http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug" rel="nofollow">Justin Sherill</a> and some NYCBUG guys about license frameworks in pkgng</li>
<li>Similar to pkgsrc&#39;s &quot;ACCEPTABLE_LICENSES&quot; setting, pkgng could let the user decide which software licenses he wants to allow</li>
<li>Maybe we could get a &quot;pkg licenses&quot; command to display the license of all installed packages</li>
<li>Ok bapt, do it
***</li>
</ul>

<h3><a href="http://thelinuxcauldron.com/2013/12/08/freebsd-challenge/" rel="nofollow">The FreeBSD challenge continues</a></h3>

<ul>
<li>Checking in with our buddy from the Linux foundation...</li>
<li>The switching from Linux to FreeBSD blog series continues for his month-long trial</li>
<li>Follow up from last week: &quot;As a matter of fact, I did check out PC-BSD, and wanted the challenge.  Call me addicted to pain and suffering, but the pride and accomplishment you feel from diving into FreeBSD is quite rewarding.&quot;</li>
<li>Since we last mentioned it, he&#39;s decided to go from a VM to real hardware, got all of his common software installed, experimented with the Linux emulation, set up virtualbox, learned about slices/partitions/disk management, found BSD alternatives to his regularly-used commands and lots more
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=336615" rel="nofollow">Ports gets a stable branch</a></h3>

<ul>
<li>For the first time ever, FreeBSD&#39;s ports tree will have a maintained &quot;stable&quot; branch</li>
<li>This is similar to how pkgsrc does things, with a rolling release for updated software and stable branch for only security and big fixes</li>
<li>All commits to this branch require approval of portmgr, looks like it&#39;ll start in 2014Q1
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2iRV1tOzB" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s21gAR5lgf" rel="nofollow">Spencer writes in</a></li>
<li><a href="http://slexy.org/view/s203iOnFh1" rel="nofollow">Campbell writes in</a></li>
<li><a href="http://slexy.org/view/s2yUqj3vKW" rel="nofollow">Sha&#39;ul writes in</a></li>
<li><a href="http://slexy.org/view/s2egcTPBXH" rel="nofollow">Clint writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>15: Kickin' NAS</title>
  <link>https://www.bsdnow.tv/15</link>
  <guid isPermaLink="false">cbf73b1a-fa1e-4acd-a1c4-ad96edb36916</guid>
  <pubDate>Wed, 11 Dec 2013 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cbf73b1a-fa1e-4acd-a1c4-ad96edb36916.mp3" length="77923925" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we'll be looking at the new version of FreeNAS, a BSD-based network attached storage solution, as well as talking to Josh Paetzel - one of the key developers of FreeNAS. Actually, he's on the FreeBSD release engineering team too, and does quite a lot for the project. We've got answers to your viewer-submitted questions and plenty of news to cover, so get ready for some BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:48:13</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we'll be looking at the new version of FreeNAS, a BSD-based network attached storage solution, as well as talking to Josh Paetzel - one of the key developers of FreeNAS. Actually, he's on the FreeBSD release engineering team too, and does quite a lot for the project. We've got answers to your viewer-submitted questions and plenty of news to cover, so get ready for some BSD Now - the place to B.. SD.
This episode was brought to you by
&lt;a href="http://www.ixsystems.com/bsdnow" title="iXsystems"&gt;&lt;img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source"&gt;&lt;/a&gt;
Headlines
More faces of FreeBSD (http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-reid-linnemann.html)
Another installment of the FoF series
This time they talk with Reid Linnemann who works at Spectra Logic
Gives a history of all the different jobs he's done, all the programming languages he knows
Mentions how he first learned about FreeBSD, actually pretty similar to Kris' story
"I used the system to build and install ports, and explored, getting actively involved in the mailing lists and forums, studying, passing on my own limited knowledge to those who could benefit from it. I pursued my career in the open source software world, learning the differences in BSD and GNU licensing and the fragmented nature of Linux distributions, realizing the FreeBSD community was more mature and well distributed about industry, education, and research. Everything steered me towards working with and on FreeBSD."
Now works on FreeBSD as his day job
The second one (http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-brooks-davis.html) covers Brooks Davis
FreeBSD committer since 2001 and core team member from 2006 through 2012
He's helped drive our transition from a GNU toolchain to a more modern LLVM-based toolchain
"One of the reasons I like FreeBSD is the community involved in the process of building a principled, technically-advanced operating system platform. Not only do we produce a great product, but we have fun doing it."
Lots more in the show notes
***
We cannot trust Intel and Via’s chip-based crypto (https://www.freebsd.org/news/status/report-2013-09-devsummit.html#Security)
We woke up to see FreeBSD on the front page of The Register (http://www.theregister.co.uk/2013/12/09/freebsd_abandoning_hardware_randomness/), Ars Technica (http://arstechnica.com/security/2013/12/we-cannot-trust-intel-and-vias-chip-based-crypto-freebsd-developers-say/), Slashdot (http://it.slashdot.org/story/13/12/11/1919201/freebsd-developers-will-not-trust-chip-based-encryption) and Hacker News (https://news.ycombinator.com/item?id=6880474) for their strong stance on security and respecting privacy
At the EuroBSDCon dev summit, there was some discussion about removing support for hardware-based random number generators.
FreeBSD's /dev/random got some updates and, for 10.0, will no longer allow the use of Intel or VIA's hardware RNGs as the sole point of entropy
"It will still be possible to access hardware random number generators, that is, RDRAND, Padlock etc., directly by inline assembly or by using OpenSSL from userland, if required, but we cannot trust them any more"
***
OpenSMTPD 5.4.1 released (http://article.gmane.org/gmane.mail.opensmtpd.general/1146)
The OpenBSD developers came out with major a new version
Improved config syntax (please check your smtpd.conf before upgrading)
Adds support for TLS Perfect Forward Secrecy and custom CA certificate
MTA, Queue and SMTP server improvements
SNI support confirmed for the next version
Check the show notes for the full list of changes, pretty huge release
Watch Episode 3 (http://www.bsdnow.tv/episodes/2013-09-18_mx_with_ttx) for an interview we did with the developers
***
More getting to know your portmgr (http://blogs.freebsdish.org/portmgr/2013/12/02/getting-to-know-your-portmgr-thomas-abthorpe/)
The portmgr secretary, Thomas Abthorpe, interviews... himself!
Joined as -secretary in March 2010, upgraded to full member in March 2011
His inspiration for using BSD is "I wanted to run a webserver, and I wanted something free. I was going to use something linux, then met up with a former prof from university, and shared my story with him. He told me FreeBSD was the way to go."
Mentions how he loves that anyone can contribute and watch it "go live"
The second one (http://blogs.freebsdish.org/portmgr/2013/12/09/getting-to-know-your-portmgr-baptiste-daroussin/) covers Baptiste Daroussin
The reason for his nick, bapt, is "Baptiste is too long to type"
There's even a video (https://www.youtube.com/watch?v=tZk__K8rqOg) of bapt joining the team!
***
Interview - Santa Clause - josh@ixsystems.com (mailto:josh@ixsystems.com) / @freenasteam (https://twitter.com/freenasteam)
FreeNAS 9.2.0 (http://www.freenas.org/whats-new/2013/12/freenas-9-2-0-rc-available.html)
Note: we originally scheduled the interview to be with Josh Paetzel, but Santa showed up instead.
Tutorial
FreeNAS walkthrough
News Roundup
Introducing configinit (http://www.daemonology.net/blog/2013-12-09-FreeBSD-EC2-configinit.html)
CloudInit is "a system originally written for Ubuntu which performs configuration of a system at boot-time based on user-data provided via EC2"
Wasn't ideal for FreeBSD since it requires python and is designed around the concept of configuring a system by running commands (rather than editing configuration files)
Colin Percival came up with configinit, a FreeBSD alternative
Alongside his new "firstboot-pkgs" port, it can spin up a webserver in 120 seconds from "launch" of the EC2 instance
Check the show notes for full blog post
***
OpenSSH support for Ed25519 and bcrypt keys (http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.key?rev=1.1;content-type=text%2Fx-cvsweb-markup)
New Ed25519 key support (hostkeys and user identities) using the public domain ed25519 reference code
SSH private keys were encrypted with a symmetric key that's just an MD5 of their password
Now they'll be using bcrypt by default (http://marc.info/?l=openbsd-cvs&amp;amp;m=138633721618361&amp;amp;w=2)
We'll get more into this in next week's interview
***
The FreeBSD challenge (http://thelinuxcauldron.com/2013/12/08/freebsd-challenge/)
A member of the Linux foundation blogs about using FreeBSD
Goes through all the beginner steps, has to "unlearn" some of his Linux ways
Only a few posts as of this time, but it's a continuing series that may be helpful for switchers
***
PCBSD weekly digest (http://blog.pcbsd.org/2013/12/pc-bsd-weekly-feature-digest-111513-2/)
GNOME3, cinnamon and mate desktops are in the installer
Compat layer updated to CentOS 6, enables newest Skype
Looking for people to test printers and hplip
Continuing work on grub, but the ability to switch between bootloaders is back
***
Feedback/Questions
Bostjan writes in (http://slexy.org/view/s20k2gumbP)
Jason writes in (http://slexy.org/view/s2PM8tfKfe)
John writes in (http://slexy.org/view/s2KgXIKqrJ)
Kjell-Aleksander writes in (http://slexy.org/view/s20DLk8bac)
Alexy writes in (http://slexy.org/view/s2nmmJHvgR)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ports, freenas, ixsystems, nas, network attached storage, josh paetzel, jpaetzel, cto, zfs, zpool, encryption, 9.2.0, walkthrough, web, interface, ui, frontend, opensmtpd, bcrypt, openssh, portmgr, linux foundation, switching from linux to bsd, linux</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we&#39;ll be looking at the new version of FreeNAS, a BSD-based network attached storage solution, as well as talking to Josh Paetzel - one of the key developers of FreeNAS. Actually, he&#39;s on the FreeBSD release engineering team too, and does quite a lot for the project. We&#39;ve got answers to your viewer-submitted questions and plenty of news to cover, so get ready for some BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-reid-linnemann.html" rel="nofollow">More faces of FreeBSD</a></h3>

<ul>
<li>Another installment of the FoF series</li>
<li>This time they talk with Reid Linnemann who works at Spectra Logic</li>
<li>Gives a history of all the different jobs he&#39;s done, all the programming languages he knows</li>
<li>Mentions how he first learned about FreeBSD, actually pretty similar to Kris&#39; story</li>
<li>&quot;I used the system to build and install ports, and explored, getting actively involved in the mailing lists and forums, studying, passing on my own limited knowledge to those who could benefit from it. I pursued my career in the open source software world, learning the differences in BSD and GNU licensing and the fragmented nature of Linux distributions, realizing the FreeBSD community was more mature and well distributed about industry, education, and research. Everything steered me towards working with and on FreeBSD.&quot;</li>
<li>Now works on FreeBSD as his day job</li>
<li><a href="http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-brooks-davis.html" rel="nofollow">The second one</a> covers Brooks Davis</li>
<li>FreeBSD committer since 2001 and core team member from 2006 through 2012</li>
<li>He&#39;s helped drive our transition from a GNU toolchain to a more modern LLVM-based toolchain</li>
<li>&quot;One of the reasons I like FreeBSD is the community involved in the process of building a principled, technically-advanced operating system platform. Not only do we produce a great product, but we have fun doing it.&quot;</li>
<li>Lots more in the show notes
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2013-09-devsummit.html#Security" rel="nofollow">We cannot trust Intel and Via’s chip-based crypto</a></h3>

<ul>
<li>We woke up to see FreeBSD on the front page of <a href="http://www.theregister.co.uk/2013/12/09/freebsd_abandoning_hardware_randomness/" rel="nofollow">The Register</a>, <a href="http://arstechnica.com/security/2013/12/we-cannot-trust-intel-and-vias-chip-based-crypto-freebsd-developers-say/" rel="nofollow">Ars Technica</a>, <a href="http://it.slashdot.org/story/13/12/11/1919201/freebsd-developers-will-not-trust-chip-based-encryption" rel="nofollow">Slashdot</a> and <a href="https://news.ycombinator.com/item?id=6880474" rel="nofollow">Hacker News</a> for their strong stance on security and respecting privacy</li>
<li>At the EuroBSDCon dev summit, there was some discussion about removing support for hardware-based random number generators.</li>
<li>FreeBSD&#39;s /dev/random got some updates and, for 10.0, will no longer allow the use of Intel or VIA&#39;s hardware RNGs as the sole point of entropy</li>
<li>&quot;It will still be possible to access hardware random number generators, that is, RDRAND, Padlock etc., directly by inline assembly or by using OpenSSL from userland, if required, but we cannot trust them any more&quot;
***</li>
</ul>

<h3><a href="http://article.gmane.org/gmane.mail.opensmtpd.general/1146" rel="nofollow">OpenSMTPD 5.4.1 released</a></h3>

<ul>
<li>The OpenBSD developers came out with major a new version</li>
<li>Improved config syntax (please check your smtpd.conf before upgrading)</li>
<li>Adds support for TLS Perfect Forward Secrecy and custom CA certificate</li>
<li>MTA, Queue and SMTP server improvements</li>
<li>SNI support confirmed for the next version</li>
<li>Check the show notes for the full list of changes, pretty huge release</li>
<li>Watch <a href="http://www.bsdnow.tv/episodes/2013-09-18_mx_with_ttx" rel="nofollow">Episode 3</a> for an interview we did with the developers
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2013/12/02/getting-to-know-your-portmgr-thomas-abthorpe/" rel="nofollow">More getting to know your portmgr</a></h3>

<ul>
<li>The portmgr secretary, Thomas Abthorpe, interviews... himself!</li>
<li>Joined as -secretary in March 2010, upgraded to full member in March 2011</li>
<li>His inspiration for using BSD is &quot;I wanted to run a webserver, and I wanted something free. I was going to use something linux, then met up with a former prof from university, and shared my story with him. He told me FreeBSD was the way to go.&quot;</li>
<li>Mentions how he loves that anyone can contribute and watch it &quot;go live&quot;</li>
<li><a href="http://blogs.freebsdish.org/portmgr/2013/12/09/getting-to-know-your-portmgr-baptiste-daroussin/" rel="nofollow">The second one</a> covers Baptiste Daroussin</li>
<li>The reason for his nick, bapt, is &quot;Baptiste is too long to type&quot;</li>
<li>There&#39;s even <a href="https://www.youtube.com/watch?v=tZk__K8rqOg" rel="nofollow">a video</a> of bapt joining the team!
***</li>
</ul>

<h2>Interview - Santa Clause - <a href="mailto:josh@ixsystems.com" rel="nofollow">josh@ixsystems.com</a> / <a href="https://twitter.com/freenasteam" rel="nofollow">@freenasteam</a></h2>

<p>FreeNAS <a href="http://www.freenas.org/whats-new/2013/12/freenas-9-2-0-rc-available.html" rel="nofollow">9.2.0</a></p>

<p><strong>Note: we originally scheduled the interview to be with Josh Paetzel, but Santa showed up instead.</strong></p>

<hr>

<h2>Tutorial</h2>

<h3>FreeNAS walkthrough</h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.daemonology.net/blog/2013-12-09-FreeBSD-EC2-configinit.html" rel="nofollow">Introducing configinit</a></h3>

<ul>
<li>CloudInit is &quot;a system originally written for Ubuntu which performs configuration of a system at boot-time based on user-data provided via EC2&quot;</li>
<li>Wasn&#39;t ideal for FreeBSD since it requires python and is designed around the concept of configuring a system by running commands (rather than editing configuration files)</li>
<li>Colin Percival came up with configinit, a FreeBSD alternative</li>
<li>Alongside his new &quot;firstboot-pkgs&quot; port, it can spin up a webserver in 120 seconds from &quot;launch&quot; of the EC2 instance</li>
<li>Check the show notes for full blog post
***</li>
</ul>

<h3><a href="http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.key?rev=1.1;content-type=text%2Fx-cvsweb-markup" rel="nofollow">OpenSSH support for Ed25519 and bcrypt keys</a></h3>

<ul>
<li>New Ed25519 key support (hostkeys and user identities) using the public domain ed25519 reference code</li>
<li>SSH private keys were encrypted with a symmetric key that&#39;s just an MD5 of their password</li>
<li>Now they&#39;ll be using bcrypt <a href="http://marc.info/?l=openbsd-cvs&m=138633721618361&w=2" rel="nofollow">by default</a></li>
<li>We&#39;ll get more into this in next week&#39;s interview
***</li>
</ul>

<h3><a href="http://thelinuxcauldron.com/2013/12/08/freebsd-challenge/" rel="nofollow">The FreeBSD challenge</a></h3>

<ul>
<li>A member of the Linux foundation blogs about using FreeBSD</li>
<li>Goes through all the beginner steps, has to &quot;unlearn&quot; some of his Linux ways</li>
<li>Only a few posts as of this time, but it&#39;s a continuing series that may be helpful for switchers
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2013/12/pc-bsd-weekly-feature-digest-111513-2/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>GNOME3, cinnamon and mate desktops are in the installer</li>
<li>Compat layer updated to CentOS 6, enables newest Skype</li>
<li>Looking for people to test printers and hplip</li>
<li>Continuing work on grub, but the ability to switch between bootloaders is back
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20k2gumbP" rel="nofollow">Bostjan writes in</a></li>
<li><a href="http://slexy.org/view/s2PM8tfKfe" rel="nofollow">Jason writes in</a></li>
<li><a href="http://slexy.org/view/s2KgXIKqrJ" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s20DLk8bac" rel="nofollow">Kjell-Aleksander writes in</a></li>
<li><a href="http://slexy.org/view/s2nmmJHvgR" rel="nofollow">Alexy writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we&#39;ll be looking at the new version of FreeNAS, a BSD-based network attached storage solution, as well as talking to Josh Paetzel - one of the key developers of FreeNAS. Actually, he&#39;s on the FreeBSD release engineering team too, and does quite a lot for the project. We&#39;ve got answers to your viewer-submitted questions and plenty of news to cover, so get ready for some BSD Now - the place to B.. SD.</p>

<h2>This episode was brought to you by</h2>

<p><a href="http://www.ixsystems.com/bsdnow" title="iXsystems"><img src="/images/iXlogo2.png" alt="iXsystems - Enterprise Servers and Storage For Open Source" /></a></p>

<hr>

<h2>Headlines</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-reid-linnemann.html" rel="nofollow">More faces of FreeBSD</a></h3>

<ul>
<li>Another installment of the FoF series</li>
<li>This time they talk with Reid Linnemann who works at Spectra Logic</li>
<li>Gives a history of all the different jobs he&#39;s done, all the programming languages he knows</li>
<li>Mentions how he first learned about FreeBSD, actually pretty similar to Kris&#39; story</li>
<li>&quot;I used the system to build and install ports, and explored, getting actively involved in the mailing lists and forums, studying, passing on my own limited knowledge to those who could benefit from it. I pursued my career in the open source software world, learning the differences in BSD and GNU licensing and the fragmented nature of Linux distributions, realizing the FreeBSD community was more mature and well distributed about industry, education, and research. Everything steered me towards working with and on FreeBSD.&quot;</li>
<li>Now works on FreeBSD as his day job</li>
<li><a href="http://freebsdfoundation.blogspot.com/2013/12/faces-of-freebsd-brooks-davis.html" rel="nofollow">The second one</a> covers Brooks Davis</li>
<li>FreeBSD committer since 2001 and core team member from 2006 through 2012</li>
<li>He&#39;s helped drive our transition from a GNU toolchain to a more modern LLVM-based toolchain</li>
<li>&quot;One of the reasons I like FreeBSD is the community involved in the process of building a principled, technically-advanced operating system platform. Not only do we produce a great product, but we have fun doing it.&quot;</li>
<li>Lots more in the show notes
***</li>
</ul>

<h3><a href="https://www.freebsd.org/news/status/report-2013-09-devsummit.html#Security" rel="nofollow">We cannot trust Intel and Via’s chip-based crypto</a></h3>

<ul>
<li>We woke up to see FreeBSD on the front page of <a href="http://www.theregister.co.uk/2013/12/09/freebsd_abandoning_hardware_randomness/" rel="nofollow">The Register</a>, <a href="http://arstechnica.com/security/2013/12/we-cannot-trust-intel-and-vias-chip-based-crypto-freebsd-developers-say/" rel="nofollow">Ars Technica</a>, <a href="http://it.slashdot.org/story/13/12/11/1919201/freebsd-developers-will-not-trust-chip-based-encryption" rel="nofollow">Slashdot</a> and <a href="https://news.ycombinator.com/item?id=6880474" rel="nofollow">Hacker News</a> for their strong stance on security and respecting privacy</li>
<li>At the EuroBSDCon dev summit, there was some discussion about removing support for hardware-based random number generators.</li>
<li>FreeBSD&#39;s /dev/random got some updates and, for 10.0, will no longer allow the use of Intel or VIA&#39;s hardware RNGs as the sole point of entropy</li>
<li>&quot;It will still be possible to access hardware random number generators, that is, RDRAND, Padlock etc., directly by inline assembly or by using OpenSSL from userland, if required, but we cannot trust them any more&quot;
***</li>
</ul>

<h3><a href="http://article.gmane.org/gmane.mail.opensmtpd.general/1146" rel="nofollow">OpenSMTPD 5.4.1 released</a></h3>

<ul>
<li>The OpenBSD developers came out with major a new version</li>
<li>Improved config syntax (please check your smtpd.conf before upgrading)</li>
<li>Adds support for TLS Perfect Forward Secrecy and custom CA certificate</li>
<li>MTA, Queue and SMTP server improvements</li>
<li>SNI support confirmed for the next version</li>
<li>Check the show notes for the full list of changes, pretty huge release</li>
<li>Watch <a href="http://www.bsdnow.tv/episodes/2013-09-18_mx_with_ttx" rel="nofollow">Episode 3</a> for an interview we did with the developers
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2013/12/02/getting-to-know-your-portmgr-thomas-abthorpe/" rel="nofollow">More getting to know your portmgr</a></h3>

<ul>
<li>The portmgr secretary, Thomas Abthorpe, interviews... himself!</li>
<li>Joined as -secretary in March 2010, upgraded to full member in March 2011</li>
<li>His inspiration for using BSD is &quot;I wanted to run a webserver, and I wanted something free. I was going to use something linux, then met up with a former prof from university, and shared my story with him. He told me FreeBSD was the way to go.&quot;</li>
<li>Mentions how he loves that anyone can contribute and watch it &quot;go live&quot;</li>
<li><a href="http://blogs.freebsdish.org/portmgr/2013/12/09/getting-to-know-your-portmgr-baptiste-daroussin/" rel="nofollow">The second one</a> covers Baptiste Daroussin</li>
<li>The reason for his nick, bapt, is &quot;Baptiste is too long to type&quot;</li>
<li>There&#39;s even <a href="https://www.youtube.com/watch?v=tZk__K8rqOg" rel="nofollow">a video</a> of bapt joining the team!
***</li>
</ul>

<h2>Interview - Santa Clause - <a href="mailto:josh@ixsystems.com" rel="nofollow">josh@ixsystems.com</a> / <a href="https://twitter.com/freenasteam" rel="nofollow">@freenasteam</a></h2>

<p>FreeNAS <a href="http://www.freenas.org/whats-new/2013/12/freenas-9-2-0-rc-available.html" rel="nofollow">9.2.0</a></p>

<p><strong>Note: we originally scheduled the interview to be with Josh Paetzel, but Santa showed up instead.</strong></p>

<hr>

<h2>Tutorial</h2>

<h3>FreeNAS walkthrough</h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://www.daemonology.net/blog/2013-12-09-FreeBSD-EC2-configinit.html" rel="nofollow">Introducing configinit</a></h3>

<ul>
<li>CloudInit is &quot;a system originally written for Ubuntu which performs configuration of a system at boot-time based on user-data provided via EC2&quot;</li>
<li>Wasn&#39;t ideal for FreeBSD since it requires python and is designed around the concept of configuring a system by running commands (rather than editing configuration files)</li>
<li>Colin Percival came up with configinit, a FreeBSD alternative</li>
<li>Alongside his new &quot;firstboot-pkgs&quot; port, it can spin up a webserver in 120 seconds from &quot;launch&quot; of the EC2 instance</li>
<li>Check the show notes for full blog post
***</li>
</ul>

<h3><a href="http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.key?rev=1.1;content-type=text%2Fx-cvsweb-markup" rel="nofollow">OpenSSH support for Ed25519 and bcrypt keys</a></h3>

<ul>
<li>New Ed25519 key support (hostkeys and user identities) using the public domain ed25519 reference code</li>
<li>SSH private keys were encrypted with a symmetric key that&#39;s just an MD5 of their password</li>
<li>Now they&#39;ll be using bcrypt <a href="http://marc.info/?l=openbsd-cvs&m=138633721618361&w=2" rel="nofollow">by default</a></li>
<li>We&#39;ll get more into this in next week&#39;s interview
***</li>
</ul>

<h3><a href="http://thelinuxcauldron.com/2013/12/08/freebsd-challenge/" rel="nofollow">The FreeBSD challenge</a></h3>

<ul>
<li>A member of the Linux foundation blogs about using FreeBSD</li>
<li>Goes through all the beginner steps, has to &quot;unlearn&quot; some of his Linux ways</li>
<li>Only a few posts as of this time, but it&#39;s a continuing series that may be helpful for switchers
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2013/12/pc-bsd-weekly-feature-digest-111513-2/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>GNOME3, cinnamon and mate desktops are in the installer</li>
<li>Compat layer updated to CentOS 6, enables newest Skype</li>
<li>Looking for people to test printers and hplip</li>
<li>Continuing work on grub, but the ability to switch between bootloaders is back
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s20k2gumbP" rel="nofollow">Bostjan writes in</a></li>
<li><a href="http://slexy.org/view/s2PM8tfKfe" rel="nofollow">Jason writes in</a></li>
<li><a href="http://slexy.org/view/s2KgXIKqrJ" rel="nofollow">John writes in</a></li>
<li><a href="http://slexy.org/view/s20DLk8bac" rel="nofollow">Kjell-Aleksander writes in</a></li>
<li><a href="http://slexy.org/view/s2nmmJHvgR" rel="nofollow">Alexy writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>14: Zettabytes for Days</title>
  <link>https://www.bsdnow.tv/14</link>
  <guid isPermaLink="false">8a946478-3ac7-4087-a433-ad139e4d7aa9</guid>
  <pubDate>Wed, 04 Dec 2013 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8a946478-3ac7-4087-a433-ad139e4d7aa9.mp3" length="56736843" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week is the long-awaited episode you've been asking for! We'll be giving you a crash course on becoming a ZFS wizard, as well as having a chat with George Wilson about the OpenZFS project's recent developments. We have answers to your feedback emails and there are some great news items to get caught up on too, so stay tuned to BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:18:48</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week is the long-awaited episode you've been asking for! We'll be giving you a crash course on becoming a ZFS wizard, as well as having a chat with George Wilson about the OpenZFS project's recent developments. We have answers to your feedback emails and there are some great news items to get caught up on too, so stay tuned to BSD Now - the place to B.. SD.
Headlines
pkgng 1.2 released (https://svnweb.freebsd.org/ports?view=revision&amp;amp;revision=334937)
bapt and bdrewery from the portmgr team released pkgng 1.2 final
New features include an improved build system, plugin improvements, new bootstrapping command, SRV mirror improvements, a new "pkg config" command, repo improvements, vuXML is now default, new fingerprint features and much more
Really simple to upgrade, check our pkgng tutorial (http://www.bsdnow.tv/tutorials/pkgng) if you want some easy instructions
It's also made its way into Dragonfly (http://lists.dragonflybsd.org/pipermail/users/2013-November/090339.html)
See the show notes for the full list of new features and fixes
***
ChaCha20 and Poly1305 in OpenSSH (http://blog.djm.net.au/2013/11/chacha20-and-poly1305-in-openssh.html)
Damien Miller recently committed support for a new authenticated encryption cipher for OpenSSH, chacha20-poly1305
Long blog post explaining what these are and why we need them
This cipher combines two primitives: the ChaCha20 cipher and the Poly1305 MAC
RC4 is broken, we needed an authenticated encryption mode to complement AES-GCM that doesn't show the packet length in cleartext
Great explanation of the differences between EtM, MtE and EaM and their advantages
"Both AES-GCM and the EtM MAC modes have a small downside though: because we no longer desire to decrypt the packet as we go, the packet length must be transmitted in plaintext. This unfortunately makes some forms of traffic analysis easier as the attacker can just read the packet lengths directly."
***
Is it time to dump Linux and move to BSD (http://www.itworld.com/open-source/384383/should-you-switch-linux-bsd)
ITworld did an article about switching from Linux to BSD
The author's interest was sparked from a review he was reading that said "I feel the BSD communities, especially the FreeBSD-based projects, are where the interesting developments are happening these days. Over in FreeBSD land we have efficient PBI bundles, a mature advanced file system in the form of ZFS, new friendly and powerful system installers, a new package manager (pkgng), a powerful jail manager and there will soon be new virtualization technology coming with the release of FreeBSD 10.0"
The whole article can be summed up with "yes" - ok, next story!
***
OpenZFS devsummit videos (https://www.youtube.com/user/deirdres/videos)
The OpenZFS developer summit (http://www.open-zfs.org/wiki/OpenZFS_Developer_Summit_2013) discussion and presentation videos are up
People from various operating systems (FreeBSD, Mac OS X, illumos, etc.) were there to discuss ZFS on their platforms and the challenges they faced
Question and answer session from representatives of every OS - had a couple FreeBSD guys there including one from the foundation
Presentations both about ZFS itself and some hardware-based solutions for implementing ZFS in production
TONS of video, about 6 hours' worth
This leads us into our interview, which is...
***
Interview - George Wilson - wilzun@gmail.com (mailto:wilzun@gmail.com) / @zfsdude (https://twitter.com/zfsdude)
OpenZFS
Tutorial
A crash course on ZFS (http://www.bsdnow.tv/tutorials/zfs)
News Roundup
ruBSD 2013 information (http://undeadly.org/cgi?action=article&amp;amp;sid=20131126113154)
The ruBSD 2013 conference will take place on Saturday December 14, 2013 at 10:30 AM in Moscow, Russia
Speakers include three OpenBSD developers, Theo de Raadt (http://www.bsdnow.tv/episodes/2013_10_09-doing_it_de_raadt_way), Henning Brauer (http://www.bsdnow.tv/episodes/2013_10_30-current_events) and Mike Belopuhov
Their talks are titled "The bane of backwards compatibility," "OpenBSD's pf: Design, Implementation and Future" and "OpenBSD: Where crypto is going?"
No word on if there will be video recordings, but we'll let you know if that changes
***
DragonFly roadmap, post 3.6 (http://www.shiningsilence.com/dbsdlog/2013/11/28/12874.html)
John Marino posted a possible roadmap for DragonFly, now that they're past the 3.6 release
He wants some third party vendor software updated from very old versions (WPA supplicant, bmake, binutils)
Plans to replace GCC44 with Clang, but GCC47 will probably be the primary compiler still
Bring in fixes and new stuff from FreeBSD 10
***
BSDCan 2014 CFP (http://lists.bsdcan.org/pipermail/bsdcan-announce/2013-December/000123.html)
BSDCan 2014 will be held on May 16-17 in Ottawa, Canada
They're now accepting proposals for talks
If you are doing something interesting with a BSD operating system, please submit a proposal
We'll be getting lots of interviews there
***
casperd added to -CURRENT (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=258838)
"It (and its services) will be responsible forgiving access to functionality that is not available in capability modes and box. The functionality can be precisely restricted."
Lists some sysctls that can be controlled
***
ZFS corruption bug fixed in -CURRENT (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=258704)
Just a quick follow-up from last week, the ZFS corruption bug in FreeBSD -CURRENT was very quickly fixed, before that episode was even uploaded
***
Feedback/Questions
Chris writes in (http://slexy.org/view/s2JDWKjs7l)
SW writes in (http://slexy.org/view/s20BLqxTWD)
Jason writes in (http://slexy.org/view/s2939tUOf5)
Clint writes in (http://slexy.org/view/s21qKY6qIb)
Chris writes in (http://slexy.org/view/s20LWlmhoK)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, zfs, openzfs, devsummit, george wilson, zpool, raidz, raidz2, raidz3, mirror, delphix, linux, switch, zol, zfsonlinux, illumos, solaris, opensolaris, itworld, pkgng, pkg, 1.2, openssh, ssh, chacha20, cipher, encryption, mac, poly1305, rc4, security</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week is the long-awaited episode you&#39;ve been asking for! We&#39;ll be giving you a crash course on becoming a ZFS wizard, as well as having a chat with George Wilson about the OpenZFS project&#39;s recent developments. We have answers to your feedback emails and there are some great news items to get caught up on too, so stay tuned to BSD Now - the place to B.. SD.</p>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=334937" rel="nofollow">pkgng 1.2 released</a></h3>

<ul>
<li>bapt and bdrewery from the portmgr team released pkgng 1.2 final</li>
<li>New features include an improved build system, plugin improvements, new bootstrapping command, SRV mirror improvements, a new &quot;pkg config&quot; command, repo improvements, vuXML is now default, new fingerprint features and much more</li>
<li>Really simple to upgrade, check our <a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">pkgng tutorial</a> if you want some easy instructions</li>
<li>It&#39;s also made its way <a href="http://lists.dragonflybsd.org/pipermail/users/2013-November/090339.html" rel="nofollow">into Dragonfly</a></li>
<li>See the show notes for the full list of new features and fixes
***</li>
</ul>

<h3><a href="http://blog.djm.net.au/2013/11/chacha20-and-poly1305-in-openssh.html" rel="nofollow">ChaCha20 and Poly1305 in OpenSSH</a></h3>

<ul>
<li>Damien Miller recently committed support for a new authenticated encryption cipher for OpenSSH, chacha20-poly1305</li>
<li>Long blog post explaining what these are and why we need them</li>
<li>This cipher combines two primitives: the ChaCha20 cipher and the Poly1305 MAC</li>
<li>RC4 is broken, we needed an authenticated encryption mode to complement AES-GCM that doesn&#39;t show the packet length in cleartext</li>
<li>Great explanation of the differences between EtM, MtE and EaM and their advantages</li>
<li>&quot;Both AES-GCM and the EtM MAC modes have a small downside though: because we no longer desire to decrypt the packet as we go, the packet length must be transmitted in plaintext. This unfortunately makes some forms of traffic analysis easier as the attacker can just read the packet lengths directly.&quot;
***</li>
</ul>

<h3><a href="http://www.itworld.com/open-source/384383/should-you-switch-linux-bsd" rel="nofollow">Is it time to dump Linux and move to BSD</a></h3>

<ul>
<li>ITworld did an article about switching from Linux to BSD</li>
<li>The author&#39;s interest was sparked from a review he was reading that said &quot;I feel the BSD communities, especially the FreeBSD-based projects, are where the interesting developments are happening these days. Over in FreeBSD land we have efficient PBI bundles, a mature advanced file system in the form of ZFS, new friendly and powerful system installers, a new package manager (pkgng), a powerful jail manager and there will soon be new virtualization technology coming with the release of FreeBSD 10.0&quot;</li>
<li>The whole article can be summed up with &quot;yes&quot; - ok, next story!
***</li>
</ul>

<h3><a href="https://www.youtube.com/user/deirdres/videos" rel="nofollow">OpenZFS devsummit videos</a></h3>

<ul>
<li>The OpenZFS <a href="http://www.open-zfs.org/wiki/OpenZFS_Developer_Summit_2013" rel="nofollow">developer summit</a> discussion and presentation videos are up</li>
<li>People from various operating systems (FreeBSD, Mac OS X, illumos, etc.) were there to discuss ZFS on their platforms and the challenges they faced</li>
<li>Question and answer session from representatives of every OS - had a couple FreeBSD guys there including one from the foundation</li>
<li>Presentations both about ZFS itself and some hardware-based solutions for implementing ZFS in production</li>
<li>TONS of video, about 6 hours&#39; worth</li>
<li>This leads us into our interview, which is...
***</li>
</ul>

<h2>Interview - George Wilson - <a href="mailto:wilzun@gmail.com" rel="nofollow">wilzun@gmail.com</a> / <a href="https://twitter.com/zfsdude" rel="nofollow">@zfsdude</a></h2>

<p>OpenZFS</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/zfs" rel="nofollow">A crash course on ZFS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20131126113154" rel="nofollow">ruBSD 2013 information</a></h3>

<ul>
<li>The ruBSD 2013 conference will take place on Saturday December 14, 2013 at 10:30 AM in Moscow, Russia</li>
<li>Speakers include three OpenBSD developers, <a href="http://www.bsdnow.tv/episodes/2013_10_09-doing_it_de_raadt_way" rel="nofollow">Theo de Raadt</a>, <a href="http://www.bsdnow.tv/episodes/2013_10_30-current_events" rel="nofollow">Henning Brauer</a> and Mike Belopuhov</li>
<li>Their talks are titled &quot;The bane of backwards compatibility,&quot; &quot;OpenBSD&#39;s pf: Design, Implementation and Future&quot; and &quot;OpenBSD: Where crypto is going?&quot;</li>
<li>No word on if there will be video recordings, but we&#39;ll let you know if that changes
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2013/11/28/12874.html" rel="nofollow">DragonFly roadmap, post 3.6</a></h3>

<ul>
<li>John Marino posted a possible roadmap for DragonFly, now that they&#39;re past the 3.6 release</li>
<li>He wants some third party vendor software updated from very old versions (WPA supplicant, bmake, binutils)</li>
<li>Plans to replace GCC44 with Clang, but GCC47 will probably be the primary compiler still</li>
<li>Bring in fixes and new stuff from FreeBSD 10
***</li>
</ul>

<h3><a href="http://lists.bsdcan.org/pipermail/bsdcan-announce/2013-December/000123.html" rel="nofollow">BSDCan 2014 CFP</a></h3>

<ul>
<li>BSDCan 2014 will be held on May 16-17 in Ottawa, Canada</li>
<li>They&#39;re now accepting proposals for talks</li>
<li>If you are doing something interesting with a BSD operating system, please submit a proposal</li>
<li>We&#39;ll be getting lots of interviews there
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=258838" rel="nofollow">casperd added to -CURRENT</a></h3>

<ul>
<li>&quot;It (and its services) will be responsible forgiving access to functionality that is not available in capability modes and box. The functionality can be precisely restricted.&quot;</li>
<li>Lists some sysctls that can be controlled
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=258704" rel="nofollow">ZFS corruption bug fixed in -CURRENT</a></h3>

<ul>
<li>Just a quick follow-up from last week, the ZFS corruption bug in FreeBSD -CURRENT was very quickly fixed, before that episode was even uploaded
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2JDWKjs7l" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s20BLqxTWD" rel="nofollow">SW writes in</a></li>
<li><a href="http://slexy.org/view/s2939tUOf5" rel="nofollow">Jason writes in</a></li>
<li><a href="http://slexy.org/view/s21qKY6qIb" rel="nofollow">Clint writes in</a></li>
<li><a href="http://slexy.org/view/s20LWlmhoK" rel="nofollow">Chris writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week is the long-awaited episode you&#39;ve been asking for! We&#39;ll be giving you a crash course on becoming a ZFS wizard, as well as having a chat with George Wilson about the OpenZFS project&#39;s recent developments. We have answers to your feedback emails and there are some great news items to get caught up on too, so stay tuned to BSD Now - the place to B.. SD.</p>

<h2>Headlines</h2>

<h3><a href="https://svnweb.freebsd.org/ports?view=revision&revision=334937" rel="nofollow">pkgng 1.2 released</a></h3>

<ul>
<li>bapt and bdrewery from the portmgr team released pkgng 1.2 final</li>
<li>New features include an improved build system, plugin improvements, new bootstrapping command, SRV mirror improvements, a new &quot;pkg config&quot; command, repo improvements, vuXML is now default, new fingerprint features and much more</li>
<li>Really simple to upgrade, check our <a href="http://www.bsdnow.tv/tutorials/pkgng" rel="nofollow">pkgng tutorial</a> if you want some easy instructions</li>
<li>It&#39;s also made its way <a href="http://lists.dragonflybsd.org/pipermail/users/2013-November/090339.html" rel="nofollow">into Dragonfly</a></li>
<li>See the show notes for the full list of new features and fixes
***</li>
</ul>

<h3><a href="http://blog.djm.net.au/2013/11/chacha20-and-poly1305-in-openssh.html" rel="nofollow">ChaCha20 and Poly1305 in OpenSSH</a></h3>

<ul>
<li>Damien Miller recently committed support for a new authenticated encryption cipher for OpenSSH, chacha20-poly1305</li>
<li>Long blog post explaining what these are and why we need them</li>
<li>This cipher combines two primitives: the ChaCha20 cipher and the Poly1305 MAC</li>
<li>RC4 is broken, we needed an authenticated encryption mode to complement AES-GCM that doesn&#39;t show the packet length in cleartext</li>
<li>Great explanation of the differences between EtM, MtE and EaM and their advantages</li>
<li>&quot;Both AES-GCM and the EtM MAC modes have a small downside though: because we no longer desire to decrypt the packet as we go, the packet length must be transmitted in plaintext. This unfortunately makes some forms of traffic analysis easier as the attacker can just read the packet lengths directly.&quot;
***</li>
</ul>

<h3><a href="http://www.itworld.com/open-source/384383/should-you-switch-linux-bsd" rel="nofollow">Is it time to dump Linux and move to BSD</a></h3>

<ul>
<li>ITworld did an article about switching from Linux to BSD</li>
<li>The author&#39;s interest was sparked from a review he was reading that said &quot;I feel the BSD communities, especially the FreeBSD-based projects, are where the interesting developments are happening these days. Over in FreeBSD land we have efficient PBI bundles, a mature advanced file system in the form of ZFS, new friendly and powerful system installers, a new package manager (pkgng), a powerful jail manager and there will soon be new virtualization technology coming with the release of FreeBSD 10.0&quot;</li>
<li>The whole article can be summed up with &quot;yes&quot; - ok, next story!
***</li>
</ul>

<h3><a href="https://www.youtube.com/user/deirdres/videos" rel="nofollow">OpenZFS devsummit videos</a></h3>

<ul>
<li>The OpenZFS <a href="http://www.open-zfs.org/wiki/OpenZFS_Developer_Summit_2013" rel="nofollow">developer summit</a> discussion and presentation videos are up</li>
<li>People from various operating systems (FreeBSD, Mac OS X, illumos, etc.) were there to discuss ZFS on their platforms and the challenges they faced</li>
<li>Question and answer session from representatives of every OS - had a couple FreeBSD guys there including one from the foundation</li>
<li>Presentations both about ZFS itself and some hardware-based solutions for implementing ZFS in production</li>
<li>TONS of video, about 6 hours&#39; worth</li>
<li>This leads us into our interview, which is...
***</li>
</ul>

<h2>Interview - George Wilson - <a href="mailto:wilzun@gmail.com" rel="nofollow">wilzun@gmail.com</a> / <a href="https://twitter.com/zfsdude" rel="nofollow">@zfsdude</a></h2>

<p>OpenZFS</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/zfs" rel="nofollow">A crash course on ZFS</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20131126113154" rel="nofollow">ruBSD 2013 information</a></h3>

<ul>
<li>The ruBSD 2013 conference will take place on Saturday December 14, 2013 at 10:30 AM in Moscow, Russia</li>
<li>Speakers include three OpenBSD developers, <a href="http://www.bsdnow.tv/episodes/2013_10_09-doing_it_de_raadt_way" rel="nofollow">Theo de Raadt</a>, <a href="http://www.bsdnow.tv/episodes/2013_10_30-current_events" rel="nofollow">Henning Brauer</a> and Mike Belopuhov</li>
<li>Their talks are titled &quot;The bane of backwards compatibility,&quot; &quot;OpenBSD&#39;s pf: Design, Implementation and Future&quot; and &quot;OpenBSD: Where crypto is going?&quot;</li>
<li>No word on if there will be video recordings, but we&#39;ll let you know if that changes
***</li>
</ul>

<h3><a href="http://www.shiningsilence.com/dbsdlog/2013/11/28/12874.html" rel="nofollow">DragonFly roadmap, post 3.6</a></h3>

<ul>
<li>John Marino posted a possible roadmap for DragonFly, now that they&#39;re past the 3.6 release</li>
<li>He wants some third party vendor software updated from very old versions (WPA supplicant, bmake, binutils)</li>
<li>Plans to replace GCC44 with Clang, but GCC47 will probably be the primary compiler still</li>
<li>Bring in fixes and new stuff from FreeBSD 10
***</li>
</ul>

<h3><a href="http://lists.bsdcan.org/pipermail/bsdcan-announce/2013-December/000123.html" rel="nofollow">BSDCan 2014 CFP</a></h3>

<ul>
<li>BSDCan 2014 will be held on May 16-17 in Ottawa, Canada</li>
<li>They&#39;re now accepting proposals for talks</li>
<li>If you are doing something interesting with a BSD operating system, please submit a proposal</li>
<li>We&#39;ll be getting lots of interviews there
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=258838" rel="nofollow">casperd added to -CURRENT</a></h3>

<ul>
<li>&quot;It (and its services) will be responsible forgiving access to functionality that is not available in capability modes and box. The functionality can be precisely restricted.&quot;</li>
<li>Lists some sysctls that can be controlled
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=258704" rel="nofollow">ZFS corruption bug fixed in -CURRENT</a></h3>

<ul>
<li>Just a quick follow-up from last week, the ZFS corruption bug in FreeBSD -CURRENT was very quickly fixed, before that episode was even uploaded
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2JDWKjs7l" rel="nofollow">Chris writes in</a></li>
<li><a href="http://slexy.org/view/s20BLqxTWD" rel="nofollow">SW writes in</a></li>
<li><a href="http://slexy.org/view/s2939tUOf5" rel="nofollow">Jason writes in</a></li>
<li><a href="http://slexy.org/view/s21qKY6qIb" rel="nofollow">Clint writes in</a></li>
<li><a href="http://slexy.org/view/s20LWlmhoK" rel="nofollow">Chris writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>13: Bridging the Gap</title>
  <link>https://www.bsdnow.tv/13</link>
  <guid isPermaLink="false">bf19202c-3646-4560-bc01-29393b43dde4</guid>
  <pubDate>Wed, 27 Nov 2013 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/bf19202c-3646-4560-bc01-29393b43dde4.mp3" length="49103236" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week on the show, we sit down for an interview with Jordan Hubbard, one of the founders of the FreeBSD project - and the one who invented ports! Later in the show, we'll be showing you some new updates to the OpenBSD router tutorial from a couple weeks ago. We've also got news, your questions and even our first viewer-submitted video, right here on BSD Now.. the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:08:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week on the show, we sit down for an interview with Jordan Hubbard, one of the founders of the FreeBSD project - and the one who invented ports! Later in the show, we'll be showing you some new updates to the OpenBSD router tutorial from a couple weeks ago. We've also got news, your questions and even our first viewer-submitted video, right here on BSD Now.. the place to B.. SD.
Headlines
Getting to know your portmgr (http://blogs.freebsdish.org/portmgr/2013/11/18/getting-to-know-your-portmgr-erwin-lansing/)
In this interview they talk to one of the "Annoying Reminder Guys" - Erwin Lansing, the second longest serving member of FreeBSD's portmgr (also vice-president of the FreeBSD Foundation)
He actually maintains the .dk ccTLD
Describes FreeBSD as "the best well-hidden success story in operating systems, by now in the hands of more people than one can count and used by even more people, and not one of them knows it! It’s not only the best operating system currently around, but also the most supportive and inspiring community."
In the next one (http://blogs.freebsdish.org/portmgr/2013/11/25/getting-to-know-your-portmgr-martin-wilke/) they speak with Martin Wilke (miwi@)
The usual, "what inspires you about FreeBSD" "how did you get into it" etc.
***
vBSDCon wrap-up compilation (http://blog.hostileadmin.com/2013/11/20/vbsdcon-wrap-ups/)
Lots of write-ups about vBSDCon gathered in one place
Some from OpenBSD guys (http://undeadly.org/cgi?action=article&amp;amp;sid=20131121050402)
Some from FreeBSD guys (http://freebsdfoundation.blogspot.com/2013/11/vbsdcon-trip-report-john-mark-gurney.html)
Some from RootBSD (http://www.rootbsd.net/vbsdcon-2013-wrap-up/)
Some from iXsystems (http://www.ixsystems.com/resources/ix/blog/vbsdcon-2013.html)
Some from Verisign (http://blogs.verisigninc.com/blog/entry/builders_and_archaeologists)
And of course our own wrap-up chat in BSD Now Episode 009 (http://www.bsdnow.tv/episodes/2013_10_30-current_events)
***
Faces of FreeBSD (http://freebsdfoundation.blogspot.com/2013/11/faces-of-freebsd-each-week-we-are-going.html)
This week they talk to Gábor Páli from Hungary
Talks about his past as a game programmer and how it got involved with FreeBSD
"I met János Háber, who admired the technical merits of FreeBSD and recommended it over the popular GNU/Linux distributions. I downloaded FreeBSD 4.3-RELEASE, found it reliable, consistent, easy to install, update and use."
He's been contributing since 2008 and does lots of work with Haskell in ports
He also organizes EuroBSDCon and is secretary of the FreeBSD Core Team
***
Dragonfly 3.6 released (http://www.dragonflybsd.org/release36/)
dports now default instead of pkgsrc
Big SMP scaling improvements
Experimental i915 and KMS support
See our interview (http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug) with Justin Sherrill if you want to hear (a lot) more about it - nearly an hour long
***
Interview - Jordan Hubbard - jkh@freebsd.org (mailto:jkh@freebsd.org) / @omgjkh (https://twitter.com/omgjkh)
FreeBSD's founding and future
Tutorial
Building an OpenBSD router, part 2 (http://www.bsdnow.tv/tutorials/openbsd-router)
Note: there was a mistake in the video version of the tutorial, please consult the written version for the proper instructions.
***
News Roundup
pfSense 2.1 on AWS EC2 (http://blog.pfsense.org/?p=1132)
We now have pfSense 2.1 available on Amazon’s Elastic Compute Cloud (EC2)
In keeping with the community spirit, they’re also offering a free "public" AMI
Check the FAQ and User Guide on their site for additional details
Interesting possibilities with pfSense in the cloud
***
Puffy on the desktop (http://distrowatch.com/weekly.php?issue=20131118#feature)
Distrowatch, a primarily Linux-focused site, features an OpenBSD 5.4 review
They talk about using it on the desktop, how to set it up
Very long write-up, curious Linux users should give it a read
Ends with "Most people will still see OpenBSD as an operating system for servers and firewalls, but OpenBSD can also be used in desktop environments if the user doesn't mind a little manual work. The payoff is a very light, responsive system that is unlikely to ever misbehave"
***
Two-factor authentication with SSH (http://cmacr.ae/openbsd/security/networking/2013/11/25/ssh-yubi.html)
Blog post about using a yubikey with SSH public keys
Uses a combination of a OTP, BSDAuth and OpenBSD's login.conf, but it can be used with PAM on other systems as well
Allows for two-factor authentication (a la gmail) in case your private key is compromised
Anyone interested in an extra-hardened SSH server should give it a read
***
PCBSD weekly digest (http://blog.pcbsd.org/2013/11/weekly-feature-digest-112313/)
10.0 has approximately 400 PBIs for public consumption
They will be merging the GNOME3, MATE and Cinnamon desktops into the 10.0 ports tree - please help test them, this is pretty big news in and of itself!
PCDM is coming along nicely, more bugs are getting fixed
Added ZFS dataset options to PCBSD’s new text installer front-end
***
Feedback/Questions
Ben writes in (http://slexy.org/view/s2ag1fA7Ug)
Florian writes in (http://slexy.org/view/s2TSIvZzVO)
Zach writes in (http://slexy.org/view/s20Po4soFF)
Addison writes in (http://slexy.org/view/s20ntzqi9c)
Adam writes in (http://slexy.org/view/s2EYJjVKBk)
Adam (https://twitter.com/redshirtlinux)'s BSD Router Project tutorial can be downloaded here (http://bsdnow.cdn.scaleengine.net/bsdrouterproject.m4v).
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, jordan hubbard, jhk, founder, portmgr, openzfs, pfsense, puffy, ec2, amazon, firewall, router, high performance, email alerts, tunneling, errata, patches, cron, script, current, stable, release, cvs, anoncvs, bsd router project</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week on the show, we sit down for an interview with Jordan Hubbard, one of the founders of the FreeBSD project - and the one who invented ports! Later in the show, we&#39;ll be showing you some new updates to the OpenBSD router tutorial from a couple weeks ago. We&#39;ve also got news, your questions and even our first viewer-submitted video, right here on BSD Now.. the place to B.. SD.</p>

<h2>Headlines</h2>

<h3><a href="http://blogs.freebsdish.org/portmgr/2013/11/18/getting-to-know-your-portmgr-erwin-lansing/" rel="nofollow">Getting to know your portmgr</a></h3>

<ul>
<li>In this interview they talk to one of the &quot;Annoying Reminder Guys&quot; - Erwin Lansing, the second longest serving member of FreeBSD&#39;s portmgr (also vice-president of the FreeBSD Foundation)</li>
<li>He actually maintains the .dk ccTLD</li>
<li>Describes FreeBSD as &quot;the best well-hidden success story in operating systems, by now in the hands of more people than one can count and used by even more people, and not one of them knows it! It’s not only the best operating system currently around, but also the most supportive and inspiring community.&quot;</li>
<li>In <a href="http://blogs.freebsdish.org/portmgr/2013/11/25/getting-to-know-your-portmgr-martin-wilke/" rel="nofollow">the next one</a> they speak with Martin Wilke (miwi@)</li>
<li>The usual, &quot;what inspires you about FreeBSD&quot; &quot;how did you get into it&quot; etc.
***</li>
</ul>

<h3><a href="http://blog.hostileadmin.com/2013/11/20/vbsdcon-wrap-ups/" rel="nofollow">vBSDCon wrap-up compilation</a></h3>

<ul>
<li>Lots of write-ups about vBSDCon gathered in one place</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20131121050402" rel="nofollow">Some from OpenBSD guys</a></li>
<li><a href="http://freebsdfoundation.blogspot.com/2013/11/vbsdcon-trip-report-john-mark-gurney.html" rel="nofollow">Some from FreeBSD guys</a></li>
<li><a href="http://www.rootbsd.net/vbsdcon-2013-wrap-up/" rel="nofollow">Some from RootBSD</a></li>
<li><a href="http://www.ixsystems.com/resources/ix/blog/vbsdcon-2013.html" rel="nofollow">Some from iXsystems</a></li>
<li><a href="http://blogs.verisigninc.com/blog/entry/builders_and_archaeologists" rel="nofollow">Some from Verisign</a></li>
<li>And of course our own wrap-up chat in <a href="http://www.bsdnow.tv/episodes/2013_10_30-current_events" rel="nofollow">BSD Now Episode 009</a>
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2013/11/faces-of-freebsd-each-week-we-are-going.html" rel="nofollow">Faces of FreeBSD</a></h3>

<ul>
<li>This week they talk to Gábor Páli from Hungary</li>
<li>Talks about his past as a game programmer and how it got involved with FreeBSD</li>
<li>&quot;I met János Háber, who admired the technical merits of FreeBSD and recommended it over the popular GNU/Linux distributions. I downloaded FreeBSD 4.3-RELEASE, found it reliable, consistent, easy to install, update and use.&quot;</li>
<li>He&#39;s been contributing since 2008 and does lots of work with Haskell in ports</li>
<li>He also organizes EuroBSDCon and is secretary of the FreeBSD Core Team
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/release36/" rel="nofollow">Dragonfly 3.6 released</a></h3>

<ul>
<li>dports now default instead of pkgsrc</li>
<li>Big SMP scaling improvements</li>
<li>Experimental i915 and KMS support</li>
<li>See <a href="http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug" rel="nofollow">our interview</a> with Justin Sherrill if you want to hear (a lot) more about it - nearly an hour long
***</li>
</ul>

<h2>Interview - Jordan Hubbard - <a href="mailto:jkh@freebsd.org" rel="nofollow">jkh@freebsd.org</a> / <a href="https://twitter.com/omgjkh" rel="nofollow">@omgjkh</a></h2>

<p>FreeBSD&#39;s founding and future</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">Building an OpenBSD router, part 2</a></h3>

<ul>
<li><strong>Note: there was a mistake in the video version of the tutorial, please consult the written version for the proper instructions.</strong>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://blog.pfsense.org/?p=1132" rel="nofollow">pfSense 2.1 on AWS EC2</a></h3>

<ul>
<li>We now have pfSense 2.1 available on Amazon’s Elastic Compute Cloud (EC2)</li>
<li>In keeping with the community spirit, they’re also offering a free &quot;public&quot; AMI</li>
<li>Check the FAQ and User Guide on their site for additional details</li>
<li>Interesting possibilities with pfSense in the cloud
***</li>
</ul>

<h3><a href="http://distrowatch.com/weekly.php?issue=20131118#feature" rel="nofollow">Puffy on the desktop</a></h3>

<ul>
<li>Distrowatch, a primarily Linux-focused site, features an OpenBSD 5.4 review</li>
<li>They talk about using it on the desktop, how to set it up</li>
<li>Very long write-up, curious Linux users should give it a read</li>
<li>Ends with &quot;Most people will still see OpenBSD as an operating system for servers and firewalls, but OpenBSD can also be used in desktop environments if the user doesn&#39;t mind a little manual work. The payoff is a very light, responsive system that is unlikely to ever misbehave&quot;
***</li>
</ul>

<h3><a href="http://cmacr.ae/openbsd/security/networking/2013/11/25/ssh-yubi.html" rel="nofollow">Two-factor authentication with SSH</a></h3>

<ul>
<li>Blog post about using a yubikey with SSH public keys</li>
<li>Uses a combination of a OTP, BSDAuth and OpenBSD&#39;s login.conf, but it can be used with PAM on other systems as well</li>
<li>Allows for two-factor authentication (a la gmail) in case your private key is compromised</li>
<li>Anyone interested in an extra-hardened SSH server should give it a read
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2013/11/weekly-feature-digest-112313/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>10.0 has approximately 400 PBIs for public consumption</li>
<li>They will be merging the GNOME3, MATE and Cinnamon desktops into the 10.0 ports tree - please help test them, this is pretty big news in and of itself!</li>
<li>PCDM is coming along nicely, more bugs are getting fixed</li>
<li>Added ZFS dataset options to PCBSD’s new text installer front-end
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2ag1fA7Ug" rel="nofollow">Ben writes in</a></li>
<li><a href="http://slexy.org/view/s2TSIvZzVO" rel="nofollow">Florian writes in</a></li>
<li><a href="http://slexy.org/view/s20Po4soFF" rel="nofollow">Zach writes in</a></li>
<li><a href="http://slexy.org/view/s20ntzqi9c" rel="nofollow">Addison writes in</a></li>
<li><a href="http://slexy.org/view/s2EYJjVKBk" rel="nofollow">Adam writes in</a></li>
<li><a href="https://twitter.com/redshirtlinux" rel="nofollow">Adam</a>&#39;s BSD Router Project tutorial can be downloaded <a href="http://bsdnow.cdn.scaleengine.net/bsdrouterproject.m4v" rel="nofollow">here</a>.
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week on the show, we sit down for an interview with Jordan Hubbard, one of the founders of the FreeBSD project - and the one who invented ports! Later in the show, we&#39;ll be showing you some new updates to the OpenBSD router tutorial from a couple weeks ago. We&#39;ve also got news, your questions and even our first viewer-submitted video, right here on BSD Now.. the place to B.. SD.</p>

<h2>Headlines</h2>

<h3><a href="http://blogs.freebsdish.org/portmgr/2013/11/18/getting-to-know-your-portmgr-erwin-lansing/" rel="nofollow">Getting to know your portmgr</a></h3>

<ul>
<li>In this interview they talk to one of the &quot;Annoying Reminder Guys&quot; - Erwin Lansing, the second longest serving member of FreeBSD&#39;s portmgr (also vice-president of the FreeBSD Foundation)</li>
<li>He actually maintains the .dk ccTLD</li>
<li>Describes FreeBSD as &quot;the best well-hidden success story in operating systems, by now in the hands of more people than one can count and used by even more people, and not one of them knows it! It’s not only the best operating system currently around, but also the most supportive and inspiring community.&quot;</li>
<li>In <a href="http://blogs.freebsdish.org/portmgr/2013/11/25/getting-to-know-your-portmgr-martin-wilke/" rel="nofollow">the next one</a> they speak with Martin Wilke (miwi@)</li>
<li>The usual, &quot;what inspires you about FreeBSD&quot; &quot;how did you get into it&quot; etc.
***</li>
</ul>

<h3><a href="http://blog.hostileadmin.com/2013/11/20/vbsdcon-wrap-ups/" rel="nofollow">vBSDCon wrap-up compilation</a></h3>

<ul>
<li>Lots of write-ups about vBSDCon gathered in one place</li>
<li><a href="http://undeadly.org/cgi?action=article&sid=20131121050402" rel="nofollow">Some from OpenBSD guys</a></li>
<li><a href="http://freebsdfoundation.blogspot.com/2013/11/vbsdcon-trip-report-john-mark-gurney.html" rel="nofollow">Some from FreeBSD guys</a></li>
<li><a href="http://www.rootbsd.net/vbsdcon-2013-wrap-up/" rel="nofollow">Some from RootBSD</a></li>
<li><a href="http://www.ixsystems.com/resources/ix/blog/vbsdcon-2013.html" rel="nofollow">Some from iXsystems</a></li>
<li><a href="http://blogs.verisigninc.com/blog/entry/builders_and_archaeologists" rel="nofollow">Some from Verisign</a></li>
<li>And of course our own wrap-up chat in <a href="http://www.bsdnow.tv/episodes/2013_10_30-current_events" rel="nofollow">BSD Now Episode 009</a>
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2013/11/faces-of-freebsd-each-week-we-are-going.html" rel="nofollow">Faces of FreeBSD</a></h3>

<ul>
<li>This week they talk to Gábor Páli from Hungary</li>
<li>Talks about his past as a game programmer and how it got involved with FreeBSD</li>
<li>&quot;I met János Háber, who admired the technical merits of FreeBSD and recommended it over the popular GNU/Linux distributions. I downloaded FreeBSD 4.3-RELEASE, found it reliable, consistent, easy to install, update and use.&quot;</li>
<li>He&#39;s been contributing since 2008 and does lots of work with Haskell in ports</li>
<li>He also organizes EuroBSDCon and is secretary of the FreeBSD Core Team
***</li>
</ul>

<h3><a href="http://www.dragonflybsd.org/release36/" rel="nofollow">Dragonfly 3.6 released</a></h3>

<ul>
<li>dports now default instead of pkgsrc</li>
<li>Big SMP scaling improvements</li>
<li>Experimental i915 and KMS support</li>
<li>See <a href="http://www.bsdnow.tv/episodes/2013_11_13-the_gateway_drug" rel="nofollow">our interview</a> with Justin Sherrill if you want to hear (a lot) more about it - nearly an hour long
***</li>
</ul>

<h2>Interview - Jordan Hubbard - <a href="mailto:jkh@freebsd.org" rel="nofollow">jkh@freebsd.org</a> / <a href="https://twitter.com/omgjkh" rel="nofollow">@omgjkh</a></h2>

<p>FreeBSD&#39;s founding and future</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">Building an OpenBSD router, part 2</a></h3>

<ul>
<li><strong>Note: there was a mistake in the video version of the tutorial, please consult the written version for the proper instructions.</strong>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://blog.pfsense.org/?p=1132" rel="nofollow">pfSense 2.1 on AWS EC2</a></h3>

<ul>
<li>We now have pfSense 2.1 available on Amazon’s Elastic Compute Cloud (EC2)</li>
<li>In keeping with the community spirit, they’re also offering a free &quot;public&quot; AMI</li>
<li>Check the FAQ and User Guide on their site for additional details</li>
<li>Interesting possibilities with pfSense in the cloud
***</li>
</ul>

<h3><a href="http://distrowatch.com/weekly.php?issue=20131118#feature" rel="nofollow">Puffy on the desktop</a></h3>

<ul>
<li>Distrowatch, a primarily Linux-focused site, features an OpenBSD 5.4 review</li>
<li>They talk about using it on the desktop, how to set it up</li>
<li>Very long write-up, curious Linux users should give it a read</li>
<li>Ends with &quot;Most people will still see OpenBSD as an operating system for servers and firewalls, but OpenBSD can also be used in desktop environments if the user doesn&#39;t mind a little manual work. The payoff is a very light, responsive system that is unlikely to ever misbehave&quot;
***</li>
</ul>

<h3><a href="http://cmacr.ae/openbsd/security/networking/2013/11/25/ssh-yubi.html" rel="nofollow">Two-factor authentication with SSH</a></h3>

<ul>
<li>Blog post about using a yubikey with SSH public keys</li>
<li>Uses a combination of a OTP, BSDAuth and OpenBSD&#39;s login.conf, but it can be used with PAM on other systems as well</li>
<li>Allows for two-factor authentication (a la gmail) in case your private key is compromised</li>
<li>Anyone interested in an extra-hardened SSH server should give it a read
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2013/11/weekly-feature-digest-112313/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>10.0 has approximately 400 PBIs for public consumption</li>
<li>They will be merging the GNOME3, MATE and Cinnamon desktops into the 10.0 ports tree - please help test them, this is pretty big news in and of itself!</li>
<li>PCDM is coming along nicely, more bugs are getting fixed</li>
<li>Added ZFS dataset options to PCBSD’s new text installer front-end
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s2ag1fA7Ug" rel="nofollow">Ben writes in</a></li>
<li><a href="http://slexy.org/view/s2TSIvZzVO" rel="nofollow">Florian writes in</a></li>
<li><a href="http://slexy.org/view/s20Po4soFF" rel="nofollow">Zach writes in</a></li>
<li><a href="http://slexy.org/view/s20ntzqi9c" rel="nofollow">Addison writes in</a></li>
<li><a href="http://slexy.org/view/s2EYJjVKBk" rel="nofollow">Adam writes in</a></li>
<li><a href="https://twitter.com/redshirtlinux" rel="nofollow">Adam</a>&#39;s BSD Router Project tutorial can be downloaded <a href="http://bsdnow.cdn.scaleengine.net/bsdrouterproject.m4v" rel="nofollow">here</a>.
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>12: Collecting SSHells</title>
  <link>https://www.bsdnow.tv/12</link>
  <guid isPermaLink="false">8552d8d2-0590-4641-9780-81ca0dc91bd1</guid>
  <pubDate>Wed, 20 Nov 2013 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8552d8d2-0590-4641-9780-81ca0dc91bd1.mp3" length="49103236" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This week we'll be talking to Amitai Schlair of the NetBSD foundation about pkgsrc, NetBSD's future plans and much more. After that, if you've ever wondered what all this SSH stuff is about, today's tutorial has got you covered. We'll be showing you the basics of SSH, as well as how to combine it with tmux for persistent sessions. News, feedback and everything else, right here on BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:08:11</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This week we'll be talking to Amitai Schlair of the NetBSD foundation about pkgsrc, NetBSD's future plans and much more. After that, if you've ever wondered what all this SSH stuff is about, today's tutorial has got you covered. We'll be showing you the basics of SSH, as well as how to combine it with tmux for persistent sessions. News, feedback and everything else, right here on BSD Now - the place to B.. SD.
Headlines
Faces of FreeBSD (http://freebsdfoundation.blogspot.com/2013/11/faces-of-freebsd-colin-percival.html)
The FreeBSD foundation is publishing articles on different FreeBSD developers
This one is about Colin Percival (cperciva@), the ex-security officer
Tells the story of how he first found BSD, what he contributed back, how he eventually became the security officer
Running series with more to come
***
Lots of BSD presentation videos uploaded (http://www.freebsdnews.net/2013/11/14/eurobsdcon-2013-devsummit-video-recordings/)
EuroBSDCon 2013 dev summit videos, AsiaBSDCon 2013 videos, MWL's presentation video
Most of us never get to see the dev summit talks since they're only for developers
AsiaBSDCon 2013 videos also up (https://www.youtube.com/user/bsdconferences) finally
List of AsiaBSDCon presentation topics here (http://2013.asiabsdcon.org/papers/index.html)
Our buddy Michael W Lucas gave an "OpenBSD for Linux users" talk (http://blather.michaelwlucas.com/archives/1879) at a Michigan Unix Users Group.
He says "Among other things, I compare OpenBSD to Richard Stallman and physically assault an audience member. We also talk long long time, memory randomization, PF, BSD license versus GPL, Microsoft and other OpenBSD stuff"
Really informative presentation, pretty long, answers some common questions at the end
***
Call for Presentations: FOSDEM 2014 and NYCBSDCon 2014 (https://blog.netbsd.org/tnf/entry/call_for_presentations_bsd_devroom)
FOSDEM 2014 will take place on 1–2 February, 2014, in Brussels, Belgium
Just like in the last years, there will be both a BSD booth and a developer's room
The topics of the devroom include all BSD operating systems. Every talk is welcome, from internal hacker discussion to real-world examples and presentations about new and shiny features.
If you are in the area or want to go, check the show notes for details
NYCBSDCon is also accepting papers (http://undeadly.org/cgi?action=article&amp;amp;sid=20131119053455).
It'll be in New York City at the beginning of February 2014
If anyone wants to give a talk at one of these conferences, go ahead and send in your stuff!
***
FreeBSD foundation's year-end fundraising campaign (https://lists.freebsd.org/pipermail/freebsd-announce/2013-November/001511.html)
The FreeBSD foundation has been supporting the FreeBSD project and community for over 13 years
As of today they have raised about half a million dollars, but still have a while to go
Donations go towards new features, paying for the server infrastructure, conferences, supporting the community, hiring full-time staff members and promoting FreeBSD at events
They are preparing the debut of a new online magazine, the FreeBSD Journal
Typically big companies make their huge donations in December, like a couple of anonymous donors that gave around $250,000 each last year
Make your donation today (http://www.freebsdfoundation.org/donate/) over at freebsdfoundation.org, every little bit helps
Everyone involved with BSD Now made a donation last year and will do so again this year
***
Interview - Amitai Schlair - schmonz@netbsd.org (mailto:schmonz@netbsd.org) / @schmonz (https://twitter.com/schmonz)
The NetBSD Foundation, pkgsrc, future plans
Tutorial
Combining SSH and tmux (http://www.bsdnow.tv/tutorials/ssh-tmux)
Note: there was a mistake in the video version of the tutorial, please consult the written version for the proper instructions.
***
News Roundup
PS4 released (http://www.theregister.co.uk/2013/11/16/sony_playstation_4_kernel)
Sony's Playstation 4 is finally released
As previously thought, its OS is heavily based on FreeBSD and uses the kernel among other things
Link in the show notes contains the full list of BSD software they're using (http://www.scei.co.jp/ps4-license/)
Always good to see BSD being so widespread
***
BSD Mag November issue (http://bsdmag.org/magazine/1853-hast-on-freebsd-how-to-make-storage-highly-availble-by-using-hast)
Free monthly BSD magazine publishes another issue
This time their topics include: Configuring a Highly Available Service on FreeBSD, IT Inventory &amp;amp; Asset Management Automation, more FreeBSD Programming Primer, PfSense and Snort and a few others
PDF linked in the show notes
***
pbulk builds made easy (http://mail-index.netbsd.org/pkgsrc-users/2013/11/09/msg018881.html)
NetBSD's pbulk tool (https://www.netbsd.org/docs/pkgsrc/bulk.html) is similar to poudriere (http://www.bsdnow.tv/tutorials/poudriere), but for pkgsrc
While working on updating the documentation, a developer cleaned up quite a lot of code
He wrote a script that automates pbulk deployment and setup
The whole setup of a dedicated machine has been reduced to just three commands
***
PCBSD weekly digest (http://blog.pcbsd.org/2013/11/pc-bsd-weekly-feature-digest-111513/)
Over 200 PBIs have been populated in to the PC-BSD 10 Stable Appcafe
Many PC-BSD programs received some necessary bug fixes and updates
Some include network detection in the package and update managers, nvidia graphic detection, security updates for PCDM
***
Feedback/Questions
Peter writes in (http://slexy.org/view/s21oh3vP7t)
Kjell-Aleksander writes in (http://slexy.org/view/s21zfqcWMP)
Jordan writes in (http://slexy.org/view/s2ZmW77Odb)
Christian writes in (http://slexy.org/view/s2BZq7xiyo)
entransic writes in (http://slexy.org/view/s21xrk0M4k)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, pcbsd, tutorial, howto, guide, bsd, interview, ssh, openssh, gnu, screen, tmux, presentation, talk, foundation, fundraiser, donations, michael w lucas, linux, amitai schlair, schmonz, pkgsrc, tetris, devsummit, dev, developer, summit, eurobsdcon, eurobsdcon2013, 2013, sony, ps4, launch, playstation, playstation4, orbis os, orbisos, asiabsdcon, pbulk</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This week we&#39;ll be talking to Amitai Schlair of the NetBSD foundation about pkgsrc, NetBSD&#39;s future plans and much more. After that, if you&#39;ve ever wondered what all this SSH stuff is about, today&#39;s tutorial has got you covered. We&#39;ll be showing you the basics of SSH, as well as how to combine it with tmux for persistent sessions. News, feedback and everything else, right here on BSD Now - the place to B.. SD.</p>

<h2>Headlines</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2013/11/faces-of-freebsd-colin-percival.html" rel="nofollow">Faces of FreeBSD</a></h3>

<ul>
<li>The FreeBSD foundation is publishing articles on different FreeBSD developers</li>
<li>This one is about Colin Percival (cperciva@), the ex-security officer</li>
<li>Tells the story of how he first found BSD, what he contributed back, how he eventually became the security officer</li>
<li>Running series with more to come
***</li>
</ul>

<h3><a href="http://www.freebsdnews.net/2013/11/14/eurobsdcon-2013-devsummit-video-recordings/" rel="nofollow">Lots of BSD presentation videos uploaded</a></h3>

<ul>
<li>EuroBSDCon 2013 dev summit videos, AsiaBSDCon 2013 videos, MWL&#39;s presentation video</li>
<li>Most of us never get to see the dev summit talks since they&#39;re only for developers</li>
<li><a href="https://www.youtube.com/user/bsdconferences" rel="nofollow">AsiaBSDCon 2013 videos also up</a> finally</li>
<li>List of AsiaBSDCon presentation topics <a href="http://2013.asiabsdcon.org/papers/index.html" rel="nofollow">here</a></li>
<li>Our buddy Michael W Lucas gave an <a href="http://blather.michaelwlucas.com/archives/1879" rel="nofollow">&quot;OpenBSD for Linux users&quot; talk</a> at a Michigan Unix Users Group.</li>
<li>He says &quot;Among other things, I compare OpenBSD to Richard Stallman and physically assault an audience member. We also talk long long time, memory randomization, PF, BSD license versus GPL, Microsoft and other OpenBSD stuff&quot;</li>
<li>Really informative presentation, pretty long, answers some common questions at the end
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/call_for_presentations_bsd_devroom" rel="nofollow">Call for Presentations: FOSDEM 2014 and NYCBSDCon 2014</a></h3>

<ul>
<li>FOSDEM 2014 will take place on 1–2 February, 2014, in Brussels, Belgium</li>
<li>Just like in the last years, there will be both a BSD booth and a developer&#39;s room</li>
<li>The topics of the devroom include all BSD operating systems. Every talk is welcome, from internal hacker discussion to real-world examples and presentations about new and shiny features.</li>
<li>If you are in the area or want to go, check the show notes for details</li>
<li>NYCBSDCon <a href="http://undeadly.org/cgi?action=article&sid=20131119053455" rel="nofollow">is also accepting papers</a>.</li>
<li>It&#39;ll be in New York City at the beginning of February 2014</li>
<li>If anyone wants to give a talk at one of these conferences, go ahead and send in your stuff!
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2013-November/001511.html" rel="nofollow">FreeBSD foundation&#39;s year-end fundraising campaign</a></h3>

<ul>
<li>The FreeBSD foundation has been supporting the FreeBSD project and community for over 13 years</li>
<li>As of today they have raised about half a million dollars, but still have a while to go</li>
<li>Donations go towards new features, paying for the server infrastructure, conferences, supporting the community, hiring full-time staff members and promoting FreeBSD at events</li>
<li>They are preparing the debut of a new online magazine, the FreeBSD Journal</li>
<li>Typically big companies make their huge donations in December, like a couple of anonymous donors that gave around $250,000 each last year</li>
<li><a href="http://www.freebsdfoundation.org/donate/" rel="nofollow">Make your donation today</a> over at freebsdfoundation.org, every little bit helps</li>
<li>Everyone involved with BSD Now made a donation last year and will do so again this year
***</li>
</ul>

<h2>Interview - Amitai Schlair - <a href="mailto:schmonz@netbsd.org" rel="nofollow">schmonz@netbsd.org</a> / <a href="https://twitter.com/schmonz" rel="nofollow">@schmonz</a></h2>

<p>The NetBSD Foundation, pkgsrc, future plans</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ssh-tmux" rel="nofollow">Combining SSH and tmux</a></h3>

<ul>
<li><strong>Note: there was a mistake in the video version of the tutorial, please consult the written version for the proper instructions.</strong>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.theregister.co.uk/2013/11/16/sony_playstation_4_kernel" rel="nofollow">PS4 released</a></h3>

<ul>
<li>Sony&#39;s Playstation 4 is finally released</li>
<li>As previously thought, its OS is heavily based on FreeBSD and uses the kernel among other things</li>
<li>Link in the show notes contains the <a href="http://www.scei.co.jp/ps4-license/" rel="nofollow">full list of BSD software they&#39;re using</a></li>
<li>Always good to see BSD being so widespread
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1853-hast-on-freebsd-how-to-make-storage-highly-availble-by-using-hast" rel="nofollow">BSD Mag November issue</a></h3>

<ul>
<li>Free monthly BSD magazine publishes another issue</li>
<li>This time their topics include: Configuring a Highly Available Service on FreeBSD, IT Inventory &amp; Asset Management Automation, more FreeBSD Programming Primer, PfSense and Snort and a few others</li>
<li>PDF linked in the show notes
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/pkgsrc-users/2013/11/09/msg018881.html" rel="nofollow">pbulk builds made easy</a></h3>

<ul>
<li>NetBSD&#39;s <a href="https://www.netbsd.org/docs/pkgsrc/bulk.html" rel="nofollow">pbulk tool</a> is similar to <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere</a>, but for pkgsrc</li>
<li>While working on updating the documentation, a developer cleaned up quite a lot of code</li>
<li>He wrote a script that automates pbulk deployment and setup</li>
<li>The whole setup of a dedicated machine has been reduced to just three commands
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2013/11/pc-bsd-weekly-feature-digest-111513/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Over 200 PBIs have been populated in to the PC-BSD 10 Stable Appcafe</li>
<li>Many PC-BSD programs received some necessary bug fixes and updates</li>
<li>Some include network detection in the package and update managers, nvidia graphic detection, security updates for PCDM
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21oh3vP7t" rel="nofollow">Peter writes in</a></li>
<li><a href="http://slexy.org/view/s21zfqcWMP" rel="nofollow">Kjell-Aleksander writes in</a></li>
<li><a href="http://slexy.org/view/s2ZmW77Odb" rel="nofollow">Jordan writes in</a></li>
<li><a href="http://slexy.org/view/s2BZq7xiyo" rel="nofollow">Christian writes in</a></li>
<li><a href="http://slexy.org/view/s21xrk0M4k" rel="nofollow">entransic writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This week we&#39;ll be talking to Amitai Schlair of the NetBSD foundation about pkgsrc, NetBSD&#39;s future plans and much more. After that, if you&#39;ve ever wondered what all this SSH stuff is about, today&#39;s tutorial has got you covered. We&#39;ll be showing you the basics of SSH, as well as how to combine it with tmux for persistent sessions. News, feedback and everything else, right here on BSD Now - the place to B.. SD.</p>

<h2>Headlines</h2>

<h3><a href="http://freebsdfoundation.blogspot.com/2013/11/faces-of-freebsd-colin-percival.html" rel="nofollow">Faces of FreeBSD</a></h3>

<ul>
<li>The FreeBSD foundation is publishing articles on different FreeBSD developers</li>
<li>This one is about Colin Percival (cperciva@), the ex-security officer</li>
<li>Tells the story of how he first found BSD, what he contributed back, how he eventually became the security officer</li>
<li>Running series with more to come
***</li>
</ul>

<h3><a href="http://www.freebsdnews.net/2013/11/14/eurobsdcon-2013-devsummit-video-recordings/" rel="nofollow">Lots of BSD presentation videos uploaded</a></h3>

<ul>
<li>EuroBSDCon 2013 dev summit videos, AsiaBSDCon 2013 videos, MWL&#39;s presentation video</li>
<li>Most of us never get to see the dev summit talks since they&#39;re only for developers</li>
<li><a href="https://www.youtube.com/user/bsdconferences" rel="nofollow">AsiaBSDCon 2013 videos also up</a> finally</li>
<li>List of AsiaBSDCon presentation topics <a href="http://2013.asiabsdcon.org/papers/index.html" rel="nofollow">here</a></li>
<li>Our buddy Michael W Lucas gave an <a href="http://blather.michaelwlucas.com/archives/1879" rel="nofollow">&quot;OpenBSD for Linux users&quot; talk</a> at a Michigan Unix Users Group.</li>
<li>He says &quot;Among other things, I compare OpenBSD to Richard Stallman and physically assault an audience member. We also talk long long time, memory randomization, PF, BSD license versus GPL, Microsoft and other OpenBSD stuff&quot;</li>
<li>Really informative presentation, pretty long, answers some common questions at the end
***</li>
</ul>

<h3><a href="https://blog.netbsd.org/tnf/entry/call_for_presentations_bsd_devroom" rel="nofollow">Call for Presentations: FOSDEM 2014 and NYCBSDCon 2014</a></h3>

<ul>
<li>FOSDEM 2014 will take place on 1–2 February, 2014, in Brussels, Belgium</li>
<li>Just like in the last years, there will be both a BSD booth and a developer&#39;s room</li>
<li>The topics of the devroom include all BSD operating systems. Every talk is welcome, from internal hacker discussion to real-world examples and presentations about new and shiny features.</li>
<li>If you are in the area or want to go, check the show notes for details</li>
<li>NYCBSDCon <a href="http://undeadly.org/cgi?action=article&sid=20131119053455" rel="nofollow">is also accepting papers</a>.</li>
<li>It&#39;ll be in New York City at the beginning of February 2014</li>
<li>If anyone wants to give a talk at one of these conferences, go ahead and send in your stuff!
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2013-November/001511.html" rel="nofollow">FreeBSD foundation&#39;s year-end fundraising campaign</a></h3>

<ul>
<li>The FreeBSD foundation has been supporting the FreeBSD project and community for over 13 years</li>
<li>As of today they have raised about half a million dollars, but still have a while to go</li>
<li>Donations go towards new features, paying for the server infrastructure, conferences, supporting the community, hiring full-time staff members and promoting FreeBSD at events</li>
<li>They are preparing the debut of a new online magazine, the FreeBSD Journal</li>
<li>Typically big companies make their huge donations in December, like a couple of anonymous donors that gave around $250,000 each last year</li>
<li><a href="http://www.freebsdfoundation.org/donate/" rel="nofollow">Make your donation today</a> over at freebsdfoundation.org, every little bit helps</li>
<li>Everyone involved with BSD Now made a donation last year and will do so again this year
***</li>
</ul>

<h2>Interview - Amitai Schlair - <a href="mailto:schmonz@netbsd.org" rel="nofollow">schmonz@netbsd.org</a> / <a href="https://twitter.com/schmonz" rel="nofollow">@schmonz</a></h2>

<p>The NetBSD Foundation, pkgsrc, future plans</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/ssh-tmux" rel="nofollow">Combining SSH and tmux</a></h3>

<ul>
<li><strong>Note: there was a mistake in the video version of the tutorial, please consult the written version for the proper instructions.</strong>
***</li>
</ul>

<h2>News Roundup</h2>

<h3><a href="http://www.theregister.co.uk/2013/11/16/sony_playstation_4_kernel" rel="nofollow">PS4 released</a></h3>

<ul>
<li>Sony&#39;s Playstation 4 is finally released</li>
<li>As previously thought, its OS is heavily based on FreeBSD and uses the kernel among other things</li>
<li>Link in the show notes contains the <a href="http://www.scei.co.jp/ps4-license/" rel="nofollow">full list of BSD software they&#39;re using</a></li>
<li>Always good to see BSD being so widespread
***</li>
</ul>

<h3><a href="http://bsdmag.org/magazine/1853-hast-on-freebsd-how-to-make-storage-highly-availble-by-using-hast" rel="nofollow">BSD Mag November issue</a></h3>

<ul>
<li>Free monthly BSD magazine publishes another issue</li>
<li>This time their topics include: Configuring a Highly Available Service on FreeBSD, IT Inventory &amp; Asset Management Automation, more FreeBSD Programming Primer, PfSense and Snort and a few others</li>
<li>PDF linked in the show notes
***</li>
</ul>

<h3><a href="http://mail-index.netbsd.org/pkgsrc-users/2013/11/09/msg018881.html" rel="nofollow">pbulk builds made easy</a></h3>

<ul>
<li>NetBSD&#39;s <a href="https://www.netbsd.org/docs/pkgsrc/bulk.html" rel="nofollow">pbulk tool</a> is similar to <a href="http://www.bsdnow.tv/tutorials/poudriere" rel="nofollow">poudriere</a>, but for pkgsrc</li>
<li>While working on updating the documentation, a developer cleaned up quite a lot of code</li>
<li>He wrote a script that automates pbulk deployment and setup</li>
<li>The whole setup of a dedicated machine has been reduced to just three commands
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2013/11/pc-bsd-weekly-feature-digest-111513/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>Over 200 PBIs have been populated in to the PC-BSD 10 Stable Appcafe</li>
<li>Many PC-BSD programs received some necessary bug fixes and updates</li>
<li>Some include network detection in the package and update managers, nvidia graphic detection, security updates for PCDM
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21oh3vP7t" rel="nofollow">Peter writes in</a></li>
<li><a href="http://slexy.org/view/s21zfqcWMP" rel="nofollow">Kjell-Aleksander writes in</a></li>
<li><a href="http://slexy.org/view/s2ZmW77Odb" rel="nofollow">Jordan writes in</a></li>
<li><a href="http://slexy.org/view/s2BZq7xiyo" rel="nofollow">Christian writes in</a></li>
<li><a href="http://slexy.org/view/s21xrk0M4k" rel="nofollow">entransic writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>11: The Gateway Drug</title>
  <link>https://www.bsdnow.tv/11</link>
  <guid isPermaLink="false">43438bdb-8de0-4237-81e2-da2f448be5ef</guid>
  <pubDate>Wed, 13 Nov 2013 08:00:00 -0500</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/43438bdb-8de0-4237-81e2-da2f448be5ef.mp3" length="78628291" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>This time on the show, we sit down to chat with Justin Sherrill of the DragonflyBSD project about their new 3.6 release. Later on, we'll be showing you a huge tutorial that's been baking for over a month - how to build an OpenBSD router that'll destroy any consumer router on the market! There's lots of news to get caught up on as well, so sit back and enjoy some BSD Now - the place to B.. SD.</itunes:subtitle>
  <itunes:duration>1:49:12</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>This time on the show, we sit down to chat with Justin Sherrill of the DragonflyBSD project about their new 3.6 release. Later on, we'll be showing you a huge tutorial that's been baking for over a month - how to build an OpenBSD router that'll destroy any consumer router on the market! There's lots of news to get caught up on as well, so sit back and enjoy some BSD Now - the place to B.. SD.
Headlines
OpenSSH 6.4 released (http://openssh.com/txt/release-6.4)
Security fixes in OpenSSH (http://openssh.com/) don't happen very often
6.4 fixes a memory corruption problem, no new features
If exploited, this vulnerability might permit code execution with the privileges of the authenticated user and may therefore allow bypassing restricted shell/command configurations.
Disabling AES-GCM in the server configuration is a workaround
Only affects 6.2 and 6.3 if compiled against a newer OpenSSL (so FreeBSD 9's base OpenSSL is unaffected, for example)
Full details here (http://www.openssh.com/txt/gcmrekey.adv)
***
Getting to know your portmgr-lurkers (http://blogs.freebsdish.org/portmgr/2013/11/04/getting-to-know-your-portmgr-mathieu-arnold/)
Next entry in portmgr interview series
This time they chat with Mathieu Arnold, one of the portmgr-lurkers we mentioned previously
Lots of questions ranging from why he uses BSD to what he had for breakfast
Another one (http://blogs.freebsdish.org/portmgr/2013/11/11/getting-to-know-your-portmgr-antoine-brodin/) was since released, with Antoine Brodin aka antoine@
***
FUSE in OpenBSD (http://undeadly.org/cgi?action=article&amp;amp;sid=20131108082749)
As we glossed over last week, FUSE was recently added to OpenBSD
Now the guys from the OpenBSD Journal have tracked down more information
This version is released under an ISC license
Should be in OpenBSD 5.5, released a little less than 6 months from now
Will finally enable things like SSHFS to work in OpenBSD
***
Automated submission of kernel panic reports (https://lists.freebsd.org/pipermail/freebsd-current/2013-November/046175.html)
New tool from Colin Percival
Saves information about kernel panics and emails it to FreeBSD
Lets you review before sending so you can edit out any private info
Automatically encrypted before being sent
FreeBSD never kernel panics so this won't get much use
***
Interview - Justin Sherrill - justin@dragonflybsd.org (mailto:justin@dragonflybsd.org) / @dragonflybsd (https://twitter.com/dragonflybsd)
DragonflyBSD 3.6 and the Dragonfly Digest (http://www.shiningsilence.com/dbsdlog/)
Tutorial
Building an OpenBSD Router (http://www.bsdnow.tv/tutorials/openbsd-router)
News Roundup
BSD router project 1.5 released (http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.5/)
Nice timing for our router tutorial; TBRP is a FreeBSD distribution for installing on a router
It's an alternative to pfSense, but not nearly as well known or popular
New version is based on 9.2-RELEASE, includes lots of general updates and bugfixes
Fits on a 256MB Compact Flash/USB drive
***
Curve25519 now default key exchange (http://freshbsd.org/commit/openbsd/5cfc11a2aa3696190b675b6e3e1da7e8ff28582e)
We mentioned in an earlier episode about a patch for curve25519 (http://cr.yp.to/ecdh.html)
Now it's become the default for key exchange
Will probably make its way into OpenSSH 6.5, would've been in 6.4 if we didn't have that security vulnerability
It's interesting to see all these big changes in cryptography in OpenBSD lately
***
FreeBSD kernel selection in boot menu (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=257650)
Adds a kernel selection menu to the beastie menu
List of kernels is taken from 'kernels' in loader.conf as a space or comma separated list of names to display (up to 9)
From our good buddy Devin Teske (http://www.bsdnow.tv/episodes/2013-09-25_teskeing_the_possibilities)
***
PCBSD weekly digest (http://blog.pcbsd.org/2013/11/pc-bsd-weekly-feature-digest-11813/)
PCDM has officially replaced GDM as the default login manager
New ISO build scripts (we got a sneak preview last week)
Lots of bug fixes
Second set of 10-STABLE ISOs available with new artwork and much more
***
Theo de Raadt speaking at MUUG (http://undeadly.org/cgi?action=article&amp;amp;sid=20131113074042&amp;amp;mode=expanded&amp;amp;count=0)
Theo will be speaking at Manitoba UNIX User Group in Winnipeg
On Friday, Nov 15, 2013 at 5:30PM (see show notes for the address)
If you're watching the show live you have time to make plans, if you're watching the downloaded version it might be happening right now!
No agenda, but expect some OpenBSD discussion
***
Feedback/Questions
Dave writes in (http://slexy.org/view/s21YXhiLRB)
James writes in (http://slexy.org/view/s215EjcgdM)
Allen writes in (http://slexy.org/view/s21mCP2ecL)
Chess writes in (http://slexy.org/view/s207ePFrna)
Frank writes in (http://slexy.org/view/s20iVFXJve)
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, building, bsd, router, gateway, soho, small home office, pcbsd, server, tutorial, guide, howto, interview, firewall, network, hammer fs, dragonfly, openssh, 6.4, dragonfly digest, aes gcm, openssl, bsd router project, tbrp, portmgr, fuse, filesystem in userspace, kernel panic, automatic</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>This time on the show, we sit down to chat with Justin Sherrill of the DragonflyBSD project about their new 3.6 release. Later on, we&#39;ll be showing you a huge tutorial that&#39;s been baking for over a month - how to build an OpenBSD router that&#39;ll destroy any consumer router on the market! There&#39;s lots of news to get caught up on as well, so sit back and enjoy some BSD Now - the place to B.. SD.</p>

<h2>Headlines</h2>

<h3><a href="http://openssh.com/txt/release-6.4" rel="nofollow">OpenSSH 6.4 released</a></h3>

<ul>
<li>Security fixes in <a href="http://openssh.com/" rel="nofollow">OpenSSH</a> don&#39;t happen very often</li>
<li>6.4 fixes a memory corruption problem, no new features</li>
<li>If exploited, this vulnerability might permit code execution with the privileges of the authenticated user and may therefore allow bypassing restricted shell/command configurations.</li>
<li>Disabling AES-GCM in the server configuration is a workaround</li>
<li>Only affects 6.2 and 6.3 if compiled against a newer OpenSSL (so FreeBSD 9&#39;s base OpenSSL is unaffected, for example)</li>
<li>Full details <a href="http://www.openssh.com/txt/gcmrekey.adv" rel="nofollow">here</a>
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2013/11/04/getting-to-know-your-portmgr-mathieu-arnold/" rel="nofollow">Getting to know your portmgr-lurkers</a></h3>

<ul>
<li>Next entry in portmgr interview series</li>
<li>This time they chat with Mathieu Arnold, one of the portmgr-lurkers we mentioned previously</li>
<li>Lots of questions ranging from why he uses BSD to what he had for breakfast</li>
<li><a href="http://blogs.freebsdish.org/portmgr/2013/11/11/getting-to-know-your-portmgr-antoine-brodin/" rel="nofollow">Another one</a> was since released, with Antoine Brodin aka antoine@
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20131108082749" rel="nofollow">FUSE in OpenBSD</a></h3>

<ul>
<li>As we glossed over last week, FUSE was recently added to OpenBSD</li>
<li>Now the guys from the OpenBSD Journal have tracked down more information</li>
<li>This version is released under an ISC license</li>
<li>Should be in OpenBSD 5.5, released a little less than 6 months from now</li>
<li>Will finally enable things like SSHFS to work in OpenBSD
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2013-November/046175.html" rel="nofollow">Automated submission of kernel panic reports</a></h3>

<ul>
<li>New tool from Colin Percival</li>
<li>Saves information about kernel panics and emails it to FreeBSD</li>
<li>Lets you review before sending so you can edit out any private info</li>
<li>Automatically encrypted before being sent</li>
<li>FreeBSD never kernel panics so this won&#39;t get much use
***</li>
</ul>

<h2>Interview - Justin Sherrill - <a href="mailto:justin@dragonflybsd.org" rel="nofollow">justin@dragonflybsd.org</a> / <a href="https://twitter.com/dragonflybsd" rel="nofollow">@dragonflybsd</a></h2>

<p>DragonflyBSD 3.6 and the <a href="http://www.shiningsilence.com/dbsdlog/" rel="nofollow">Dragonfly Digest</a></p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">Building an OpenBSD Router</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.5/" rel="nofollow">BSD router project 1.5 released</a></h3>

<ul>
<li>Nice timing for our router tutorial; TBRP is a FreeBSD distribution for installing on a router</li>
<li>It&#39;s an alternative to pfSense, but not nearly as well known or popular</li>
<li>New version is based on 9.2-RELEASE, includes lots of general updates and bugfixes</li>
<li>Fits on a 256MB Compact Flash/USB drive
***</li>
</ul>

<h3><a href="http://freshbsd.org/commit/openbsd/5cfc11a2aa3696190b675b6e3e1da7e8ff28582e" rel="nofollow">Curve25519 now default key exchange</a></h3>

<ul>
<li>We mentioned in an earlier episode about a patch for <a href="http://cr.yp.to/ecdh.html" rel="nofollow">curve25519</a></li>
<li>Now it&#39;s become the default for key exchange</li>
<li>Will probably make its way into OpenSSH 6.5, would&#39;ve been in 6.4 if we didn&#39;t have that security vulnerability</li>
<li>It&#39;s interesting to see all these big changes in cryptography in OpenBSD lately
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=257650" rel="nofollow">FreeBSD kernel selection in boot menu</a></h3>

<ul>
<li>Adds a kernel selection menu to the beastie menu</li>
<li>List of kernels is taken from &#39;kernels&#39; in loader.conf as a space or comma separated list of names to display (up to 9)</li>
<li>From our good buddy <a href="http://www.bsdnow.tv/episodes/2013-09-25_teskeing_the_possibilities" rel="nofollow">Devin Teske</a>
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2013/11/pc-bsd-weekly-feature-digest-11813/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>PCDM has officially replaced GDM as the default login manager</li>
<li>New ISO build scripts (we got a sneak preview last week)</li>
<li>Lots of bug fixes</li>
<li>Second set of 10-STABLE ISOs available with new artwork and much more
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20131113074042&mode=expanded&count=0" rel="nofollow">Theo de Raadt speaking at MUUG</a></h3>

<ul>
<li>Theo will be speaking at Manitoba UNIX User Group in Winnipeg</li>
<li>On Friday, Nov 15, 2013 at 5:30PM (see show notes for the address)</li>
<li>If you&#39;re watching the show live you have time to make plans, if you&#39;re watching the downloaded version it might be happening right now!</li>
<li>No agenda, but expect some OpenBSD discussion
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21YXhiLRB" rel="nofollow">Dave writes in</a></li>
<li><a href="http://slexy.org/view/s215EjcgdM" rel="nofollow">James writes in</a></li>
<li><a href="http://slexy.org/view/s21mCP2ecL" rel="nofollow">Allen writes in</a></li>
<li><a href="http://slexy.org/view/s207ePFrna" rel="nofollow">Chess writes in</a></li>
<li><a href="http://slexy.org/view/s20iVFXJve" rel="nofollow">Frank writes in</a>
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>This time on the show, we sit down to chat with Justin Sherrill of the DragonflyBSD project about their new 3.6 release. Later on, we&#39;ll be showing you a huge tutorial that&#39;s been baking for over a month - how to build an OpenBSD router that&#39;ll destroy any consumer router on the market! There&#39;s lots of news to get caught up on as well, so sit back and enjoy some BSD Now - the place to B.. SD.</p>

<h2>Headlines</h2>

<h3><a href="http://openssh.com/txt/release-6.4" rel="nofollow">OpenSSH 6.4 released</a></h3>

<ul>
<li>Security fixes in <a href="http://openssh.com/" rel="nofollow">OpenSSH</a> don&#39;t happen very often</li>
<li>6.4 fixes a memory corruption problem, no new features</li>
<li>If exploited, this vulnerability might permit code execution with the privileges of the authenticated user and may therefore allow bypassing restricted shell/command configurations.</li>
<li>Disabling AES-GCM in the server configuration is a workaround</li>
<li>Only affects 6.2 and 6.3 if compiled against a newer OpenSSL (so FreeBSD 9&#39;s base OpenSSL is unaffected, for example)</li>
<li>Full details <a href="http://www.openssh.com/txt/gcmrekey.adv" rel="nofollow">here</a>
***</li>
</ul>

<h3><a href="http://blogs.freebsdish.org/portmgr/2013/11/04/getting-to-know-your-portmgr-mathieu-arnold/" rel="nofollow">Getting to know your portmgr-lurkers</a></h3>

<ul>
<li>Next entry in portmgr interview series</li>
<li>This time they chat with Mathieu Arnold, one of the portmgr-lurkers we mentioned previously</li>
<li>Lots of questions ranging from why he uses BSD to what he had for breakfast</li>
<li><a href="http://blogs.freebsdish.org/portmgr/2013/11/11/getting-to-know-your-portmgr-antoine-brodin/" rel="nofollow">Another one</a> was since released, with Antoine Brodin aka antoine@
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20131108082749" rel="nofollow">FUSE in OpenBSD</a></h3>

<ul>
<li>As we glossed over last week, FUSE was recently added to OpenBSD</li>
<li>Now the guys from the OpenBSD Journal have tracked down more information</li>
<li>This version is released under an ISC license</li>
<li>Should be in OpenBSD 5.5, released a little less than 6 months from now</li>
<li>Will finally enable things like SSHFS to work in OpenBSD
***</li>
</ul>

<h3><a href="https://lists.freebsd.org/pipermail/freebsd-current/2013-November/046175.html" rel="nofollow">Automated submission of kernel panic reports</a></h3>

<ul>
<li>New tool from Colin Percival</li>
<li>Saves information about kernel panics and emails it to FreeBSD</li>
<li>Lets you review before sending so you can edit out any private info</li>
<li>Automatically encrypted before being sent</li>
<li>FreeBSD never kernel panics so this won&#39;t get much use
***</li>
</ul>

<h2>Interview - Justin Sherrill - <a href="mailto:justin@dragonflybsd.org" rel="nofollow">justin@dragonflybsd.org</a> / <a href="https://twitter.com/dragonflybsd" rel="nofollow">@dragonflybsd</a></h2>

<p>DragonflyBSD 3.6 and the <a href="http://www.shiningsilence.com/dbsdlog/" rel="nofollow">Dragonfly Digest</a></p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/openbsd-router" rel="nofollow">Building an OpenBSD Router</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="http://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.5/" rel="nofollow">BSD router project 1.5 released</a></h3>

<ul>
<li>Nice timing for our router tutorial; TBRP is a FreeBSD distribution for installing on a router</li>
<li>It&#39;s an alternative to pfSense, but not nearly as well known or popular</li>
<li>New version is based on 9.2-RELEASE, includes lots of general updates and bugfixes</li>
<li>Fits on a 256MB Compact Flash/USB drive
***</li>
</ul>

<h3><a href="http://freshbsd.org/commit/openbsd/5cfc11a2aa3696190b675b6e3e1da7e8ff28582e" rel="nofollow">Curve25519 now default key exchange</a></h3>

<ul>
<li>We mentioned in an earlier episode about a patch for <a href="http://cr.yp.to/ecdh.html" rel="nofollow">curve25519</a></li>
<li>Now it&#39;s become the default for key exchange</li>
<li>Will probably make its way into OpenSSH 6.5, would&#39;ve been in 6.4 if we didn&#39;t have that security vulnerability</li>
<li>It&#39;s interesting to see all these big changes in cryptography in OpenBSD lately
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=257650" rel="nofollow">FreeBSD kernel selection in boot menu</a></h3>

<ul>
<li>Adds a kernel selection menu to the beastie menu</li>
<li>List of kernels is taken from &#39;kernels&#39; in loader.conf as a space or comma separated list of names to display (up to 9)</li>
<li>From our good buddy <a href="http://www.bsdnow.tv/episodes/2013-09-25_teskeing_the_possibilities" rel="nofollow">Devin Teske</a>
***</li>
</ul>

<h3><a href="http://blog.pcbsd.org/2013/11/pc-bsd-weekly-feature-digest-11813/" rel="nofollow">PCBSD weekly digest</a></h3>

<ul>
<li>PCDM has officially replaced GDM as the default login manager</li>
<li>New ISO build scripts (we got a sneak preview last week)</li>
<li>Lots of bug fixes</li>
<li>Second set of 10-STABLE ISOs available with new artwork and much more
***</li>
</ul>

<h3><a href="http://undeadly.org/cgi?action=article&sid=20131113074042&mode=expanded&count=0" rel="nofollow">Theo de Raadt speaking at MUUG</a></h3>

<ul>
<li>Theo will be speaking at Manitoba UNIX User Group in Winnipeg</li>
<li>On Friday, Nov 15, 2013 at 5:30PM (see show notes for the address)</li>
<li>If you&#39;re watching the show live you have time to make plans, if you&#39;re watching the downloaded version it might be happening right now!</li>
<li>No agenda, but expect some OpenBSD discussion
***</li>
</ul>

<h2>Feedback/Questions</h2>

<ul>
<li><a href="http://slexy.org/view/s21YXhiLRB" rel="nofollow">Dave writes in</a></li>
<li><a href="http://slexy.org/view/s215EjcgdM" rel="nofollow">James writes in</a></li>
<li><a href="http://slexy.org/view/s21mCP2ecL" rel="nofollow">Allen writes in</a></li>
<li><a href="http://slexy.org/view/s207ePFrna" rel="nofollow">Chess writes in</a></li>
<li><a href="http://slexy.org/view/s20iVFXJve" rel="nofollow">Frank writes in</a>
***</li>
</ul>]]>
  </itunes:summary>
</item>
<item>
  <title>1: BGP &amp; BSD</title>
  <link>https://www.bsdnow.tv/1</link>
  <guid isPermaLink="false">0684a07f-969f-4edf-b14b-601353ebdea4</guid>
  <pubDate>Wed, 04 Sep 2013 00:00:00 -0400</pubDate>
  <author>JT Pennington</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0684a07f-969f-4edf-b14b-601353ebdea4.mp3" length="81975517" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>JT Pennington</itunes:author>
  <itunes:subtitle>We kick off the first episode with the latest BSD news, show you how to avoid intrusion detection systems and talk to Peter Hessler about BGP spam blacklists!</itunes:subtitle>
  <itunes:duration>1:53:51</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"/>
  <description>We kick off the first episode with the latest BSD news, show you how to avoid intrusion detection systems and talk to Peter Hessler about BGP spam blacklists!
Headlines
Radeon KMS commited (https://lists.freebsd.org/pipermail/svn-src-head/2013-August/050931.html)
Committed by Jean-Sebastien Pedron
Brings kernel mode setting to -CURRENT, will be in 10.0-RELEASE (ETA 12/2013)
10-STABLE is expected to be branched in October, to begin the process of stabilizing development
Initial testing shows it works well
May be merged to 9.X, but due to changes to the VM subsystem this will require a lot of work, and is currently not a priority for the Radeon KMS developer
Still suffers from the syscons / KMS switcher issues, same as Intel video
More info: https://wiki.freebsd.org/AMD_GPU
***
VeriSign Embraces FreeBSD (http://www.eweek.com/enterprise-apps/verisign-embraces-open-source-freebsd-for-diversity/)
"BSD is quite literally at the very core foundation of what makes the Internet work"
Using BSD and Linux together provides reliability and diversity
Verisign gives back to the community, runs vBSDCon
"You get comfortable with something because it works well for your particular purposes and can find a good community that you can interact with. That all rang true for us with FreeBSD."
***
fetch/libfetch get a makeover (http://freshbsd.org/commit/freebsd/r253680)
Adds support for SSL certificate verification
Requires root ca bundle (security/rootcanss)
Still missing TLS SNI support (Server Name Indication, allows name based virtual hosts over SSL) 
***
FreeBSD Foundation Semi-Annual Newsletter (http://www.freebsdfoundation.org/press/2013Jul-newsletter)
The FreeBSD Foundation took the 20th anniversary of FreeBSD as an opportunity to look at where the project is, and where it might want to go
The foundation sets out some basic goals that the project should strive towards:
Unify User Experience
“ensure that knowledge gained mastering one task translates to the next”
“if we do pay attention to consistency, not only will FreeBSD be easier to use, it will be easier to learn”
Design for Human and Programmatic Use
200 machines used to be considered a large deployment, with high density servers, blades, virtualization and the cloud, that is not so anymore
“the tools we provide for status reporting, configuration, and control of FreeBSD just do not scale or fail to provide the desired user experience”
“The FreeBSD of tomorrow needs to give programmability and human interaction equal weighting as requirements”
Embrace New Ways to Document FreeBSD
More ‘Getting Started’ sections in documentation
Link to external How-Tos and other documentation
“upgrade the cross-referencing and search tools built into FreeBSD, so FreeBSD, not an Internet search engine, is the best place to learn about FreeBSD”
Spring Fundraising Campaign, April 17 - May 31, raised a total of $219,806 from 12 organizations and 365 individual donors. In the same period last year we raised a total of $23,422 from 2 organizations and 53 individuals
Funds donated to the FreeBSD Foundation have been used on these projects recently:
Capsicum security-component framework
Transparent superpages support of the FreeBSD/ARM architecture
Expanded and faster IPv6
Native in-kernel iSCSI stack
Five New TCP Congestion Control Algorithms
Direct mapped I/O to avoid extra memory copies
Unified Extensible Firmware Interface (UEFI) boot environment
Porting FreeBSD to the Genesi Efika MX SmartBook laptop (ARM-based)
NAND Flash filesystem and storage stack
Funds were also used to sponsor a number of BSD focused conferences: BSDCan, EuroBSDCon, AsiaBSDCon, BSDDay, NYCBSDCon, vBSDCon, plus Vendor summits and Developer summits
It is important that the foundation receive donations from individuals, to maintain their tax exempt status in the USA. Even a donation of $5 helps make it clear that the FreeBSD Foundation is backed by a large community, not only a few vendors
Donate Today  (http://www.freebsdfoundation.org/donate)
***
The place to B...SD
Ohio Linuxfest, Sept. 13-15, 2013 (http://ohiolinux.org/schedule)
Very BSD friendly
Kirk McKusick giving the keynote
BSD Certification on the 15th, all other stuff on the 14th
Multiple BSD talks
***
LinuxCon, Sept. 16-18, 2013 (http://events.linuxfoundation.org/events/linuxcon-north-america)
Dru Lavigne and Kris Moore will be manning a FreeBSD booth
Number of talks of interest to BSD users, including ZFS coop (http://linuxconcloudopenna2013.sched.org/event/b50b23f3ed3bd728fa0052b54021a2cc?iframe=yes&amp;amp;w=900&amp;amp;sidebar=yes&amp;amp;bg=no)
EuroBSDCon, Sept. 26-29, 2013 (http://2013.eurobsdcon.org/eurobsdcon-2013/talks/)
Tutorials on the 26 &amp;amp; 27th (plus private FreeBSD DevSummit)
43 talks spread over 3 tracks on the 28 &amp;amp; 29th
Keynote by Theo de Raadt
Hosted in the picturesque St. Julians Area, Malta (Hilton Conference Centre)
***
Interview - Peter Hessler - phessler@openbsd.org (mailto:phessler@openbsd.org) / @phessler (https://twitter.com/phessler)
Using BGP to distribute spam blacklists and whitelists
Tutorial
Using stunnel to hide your traffic from Deep Packet Inspection (http://www.bsdnow.tv/tutorials/stunnel)
News Roundup
NetBSD 6.1.1 released (https://blog.netbsd.org/tnf/entry/netbsd_6_1_1_released)
First security/bug fix update of the NetBSD 6.1 release branch
Fixes 4 security vulnerabilities
Adds 4 new sysctls to avoid IPv6 DoS attacks
Misc. other updates
***
Sudo Mastery (http://blather.michaelwlucas.com/archives/1792)
MWL is a well-known author of many BSD books
Also does SSH, networking, DNSSEC, etc.
Next book is about sudo, which comes from OpenBSD (did you know that?)
Available for preorder now at a discounted price
***
Documentation Infrastructure Enhancements (http://freebsdfoundation.blogspot.com/2013/08/new-funded-project-documentation.html)
Gábor Kövesdán has completed a funded project to improve the infrastructure behind the documentation project
Will upgrade documentation from DocBook 4.2 to DocBook 4.5 and at the same time migrate to proper XML tools.
DSSSL is an old and dead standard, which will not evolve any more.
DocBook 5.0 tree added
***
FreeBSD FIBs get new features (https://svnweb.freebsd.org/base?view=revision&amp;amp;revision=254943)
FIBs (as discussed earlier in the interview) are Forward Information Bases (technical term for a routing table)
The FreeBSD kernel can be compiled to allow you to maintain multiple FIBs, creating separate routing tables for different processes or jails
In r254943 ps(1) is extended to support a new column ‘fib’, to display which routing table a process is using
***
FreeNAS 9.1.0 and 9.1.1 released (http://www.ixsystems.com/resources/ix/news/ixsystems-announces-revolutionary-freenas-910-release.html)
Many improvements in nearly all areas, big upgrade
Based on FreeBSD 9-STABLE, lots of new ZFS features
Cherry picked some features from 10-CURRENT
New volume manager and easy to use plugin management system
9.1.1 released shortly thereafter to fix a few UI and plugin bugs
***
BSD licensed "patch" becomes default (http://freshbsd.org/commit/freebsd/r253689)
bsdpatch has become mature, does what GNU patch can do, but has a much better license
Approved by portmgr@ for use in ports
Added WITHGNUPATCH build option for people who still need it
*** 
</description>
  <itunes:keywords>freebsd, openbsd, netbsd, dragonflybsd, hardenedbsd, tutorial, howto, guide, bsd, operating system, open source, shell, unix, os, berkeley, software, distribution, release, zfs, zpool, dataset, filesystem, interview, ports, packages, jails, kernel</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We kick off the first episode with the latest BSD news, show you how to avoid intrusion detection systems and talk to Peter Hessler about BGP spam blacklists!</p>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/svn-src-head/2013-August/050931.html" rel="nofollow">Radeon KMS commited</a></h3>

<ul>
<li>Committed by Jean-Sebastien Pedron</li>
<li>Brings kernel mode setting to -CURRENT, will be in 10.0-RELEASE (ETA 12/2013)</li>
<li>10-STABLE is expected to be branched in October, to begin the process of stabilizing development</li>
<li>Initial testing shows it works well</li>
<li>May be merged to 9.X, but due to changes to the VM subsystem this will require a lot of work, and is currently not a priority for the Radeon KMS developer</li>
<li>Still suffers from the syscons / KMS switcher issues, same as Intel video</li>
<li>More info: <a href="https://wiki.freebsd.org/AMD_GPU" rel="nofollow">https://wiki.freebsd.org/AMD_GPU</a>
***</li>
</ul>

<h3><a href="http://www.eweek.com/enterprise-apps/verisign-embraces-open-source-freebsd-for-diversity/" rel="nofollow">VeriSign Embraces FreeBSD</a></h3>

<ul>
<li>&quot;BSD is quite literally at the very core foundation of what makes the Internet work&quot;</li>
<li>Using BSD and Linux together provides reliability and diversity</li>
<li>Verisign gives back to the community, runs vBSDCon</li>
<li>&quot;You get comfortable with something because it works well for your particular purposes and can find a good community that you can interact with. That all rang true for us with FreeBSD.&quot;
***</li>
</ul>

<h3><a href="http://freshbsd.org/commit/freebsd/r253680" rel="nofollow">fetch/libfetch get a makeover</a></h3>

<ul>
<li>Adds support for SSL certificate verification</li>
<li>Requires root ca bundle (security/root_ca_nss)</li>
<li>Still missing TLS SNI support (Server Name Indication, allows name based virtual hosts over SSL) 
***</li>
</ul>

<h3><a href="http://www.freebsdfoundation.org/press/2013Jul-newsletter" rel="nofollow">FreeBSD Foundation Semi-Annual Newsletter</a></h3>

<ul>
<li>The FreeBSD Foundation took the 20th anniversary of FreeBSD as an opportunity to look at where the project is, and where it might want to go</li>
<li>The foundation sets out some basic goals that the project should strive towards:

<ul>
<li>Unify User Experience

<ul>
<li>“ensure that knowledge gained mastering one task translates to the next”</li>
<li>“if we do pay attention to consistency, not only will FreeBSD be easier to use, it will be easier to learn”</li>
</ul></li>
<li>Design for Human and Programmatic Use

<ul>
<li>200 machines used to be considered a large deployment, with high density servers, blades, virtualization and the cloud, that is not so anymore</li>
<li>“the tools we provide for status reporting, configuration, and control of FreeBSD just do not scale or fail to provide the desired user experience”</li>
<li>“The FreeBSD of tomorrow needs to give programmability and human interaction equal weighting as requirements”</li>
</ul></li>
<li>Embrace New Ways to Document FreeBSD

<ul>
<li>More ‘Getting Started’ sections in documentation</li>
<li>Link to external How-Tos and other documentation</li>
<li>“upgrade the cross-referencing and search tools built into FreeBSD, so FreeBSD, not an Internet search engine, is the best place to learn about FreeBSD”</li>
</ul></li>
</ul></li>
<li>Spring Fundraising Campaign, April 17 - May 31, raised a total of $219,806 from 12 organizations and 365 individual donors. In the same period last year we raised a total of $23,422 from 2 organizations and 53 individuals</li>
<li>Funds donated to the FreeBSD Foundation have been used on these projects recently:</li>
<li>Capsicum security-component framework</li>
<li>Transparent superpages support of the FreeBSD/ARM architecture</li>
<li>Expanded and faster IPv6</li>
<li>Native in-kernel iSCSI stack</li>
<li>Five New TCP Congestion Control Algorithms</li>
<li>Direct mapped I/O to avoid extra memory copies</li>
<li>Unified Extensible Firmware Interface (UEFI) boot environment</li>
<li>Porting FreeBSD to the Genesi Efika MX SmartBook laptop (ARM-based)</li>
<li>NAND Flash filesystem and storage stack</li>
<li>Funds were also used to sponsor a number of BSD focused conferences: BSDCan, EuroBSDCon, AsiaBSDCon, BSDDay, NYCBSDCon, vBSDCon, plus Vendor summits and Developer summits</li>
<li>It is important that the foundation receive donations from individuals, to maintain their tax exempt status in the USA. Even a donation of $5 helps make it clear that the FreeBSD Foundation is backed by a large community, not only a few vendors</li>
<li><a href="http://www.freebsdfoundation.org/donate" rel="nofollow">Donate Today </a>
***</li>
</ul>

<h2>The place to B...SD</h2>

<h4><a href="http://ohiolinux.org/schedule" rel="nofollow">Ohio Linuxfest, Sept. 13-15, 2013</a></h4>

<ul>
<li>Very BSD friendly</li>
<li>Kirk McKusick giving the keynote</li>
<li>BSD Certification on the 15th, all other stuff on the 14th</li>
<li>Multiple BSD talks
***</li>
</ul>

<h4><a href="http://events.linuxfoundation.org/events/linuxcon-north-america" rel="nofollow">LinuxCon, Sept. 16-18, 2013</a></h4>

<ul>
<li>Dru Lavigne and Kris Moore will be manning a FreeBSD booth</li>
<li>Number of talks of interest to BSD users, <a href="http://linuxconcloudopenna2013.sched.org/event/b50b23f3ed3bd728fa0052b54021a2cc?iframe=yes&w=900&sidebar=yes&bg=no" rel="nofollow">including ZFS coop</a></li>
</ul>

<h4><a href="http://2013.eurobsdcon.org/eurobsdcon-2013/talks/" rel="nofollow">EuroBSDCon, Sept. 26-29, 2013</a></h4>

<ul>
<li>Tutorials on the 26 &amp; 27th (plus private FreeBSD DevSummit)</li>
<li>43 talks spread over 3 tracks on the 28 &amp; 29th</li>
<li>Keynote by Theo de Raadt</li>
<li>Hosted in the picturesque St. Julians Area, Malta (Hilton Conference Centre)
***</li>
</ul>

<h2>Interview - Peter Hessler - <a href="mailto:phessler@openbsd.org" rel="nofollow">phessler@openbsd.org</a> / <a href="https://twitter.com/phessler" rel="nofollow">@phessler</a></h2>

<p>Using BGP to distribute spam blacklists and whitelists</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/stunnel" rel="nofollow">Using stunnel to hide your traffic from Deep Packet Inspection</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_6_1_1_released" rel="nofollow">NetBSD 6.1.1 released</a></h3>

<ul>
<li>First security/bug fix update of the NetBSD 6.1 release branch</li>
<li>Fixes 4 security vulnerabilities</li>
<li>Adds 4 new sysctls to avoid IPv6 DoS attacks</li>
<li>Misc. other updates
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/1792" rel="nofollow">Sudo Mastery</a></h3>

<ul>
<li>MWL is a well-known author of many BSD books</li>
<li>Also does SSH, networking, DNSSEC, etc.</li>
<li>Next book is about sudo, which comes from OpenBSD (did you know that?)</li>
<li>Available for preorder now at a discounted price
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2013/08/new-funded-project-documentation.html" rel="nofollow">Documentation Infrastructure Enhancements</a></h3>

<ul>
<li>Gábor Kövesdán has completed a funded project to improve the infrastructure behind the documentation project</li>
<li>Will upgrade documentation from DocBook 4.2 to DocBook 4.5 and at the same time migrate to proper XML tools.</li>
<li>DSSSL is an old and dead standard, which will not evolve any more.</li>
<li>DocBook 5.0 tree added
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=254943" rel="nofollow">FreeBSD FIBs get new features</a></h3>

<ul>
<li>FIBs (as discussed earlier in the interview) are Forward Information Bases (technical term for a routing table)</li>
<li>The FreeBSD kernel can be compiled to allow you to maintain multiple FIBs, creating separate routing tables for different processes or jails</li>
<li>In r254943 ps(1) is extended to support a new column ‘fib’, to display which routing table a process is using
***</li>
</ul>

<h3><a href="http://www.ixsystems.com/resources/ix/news/ixsystems-announces-revolutionary-freenas-910-release.html" rel="nofollow">FreeNAS 9.1.0 and 9.1.1 released</a></h3>

<ul>
<li>Many improvements in nearly all areas, big upgrade</li>
<li>Based on FreeBSD 9-STABLE, lots of new ZFS features</li>
<li>Cherry picked some features from 10-CURRENT</li>
<li>New volume manager and easy to use plugin management system</li>
<li>9.1.1 released shortly thereafter to fix a few UI and plugin bugs
***</li>
</ul>

<h3><a href="http://freshbsd.org/commit/freebsd/r253689" rel="nofollow">BSD licensed &quot;patch&quot; becomes default</a></h3>

<ul>
<li>bsdpatch has become mature, does what GNU patch can do, but has a much better license</li>
<li>Approved by portmgr@ for use in ports</li>
<li>Added WITH_GNU_PATCH build option for people who still need it
***</li>
</ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We kick off the first episode with the latest BSD news, show you how to avoid intrusion detection systems and talk to Peter Hessler about BGP spam blacklists!</p>

<h2>Headlines</h2>

<h3><a href="https://lists.freebsd.org/pipermail/svn-src-head/2013-August/050931.html" rel="nofollow">Radeon KMS commited</a></h3>

<ul>
<li>Committed by Jean-Sebastien Pedron</li>
<li>Brings kernel mode setting to -CURRENT, will be in 10.0-RELEASE (ETA 12/2013)</li>
<li>10-STABLE is expected to be branched in October, to begin the process of stabilizing development</li>
<li>Initial testing shows it works well</li>
<li>May be merged to 9.X, but due to changes to the VM subsystem this will require a lot of work, and is currently not a priority for the Radeon KMS developer</li>
<li>Still suffers from the syscons / KMS switcher issues, same as Intel video</li>
<li>More info: <a href="https://wiki.freebsd.org/AMD_GPU" rel="nofollow">https://wiki.freebsd.org/AMD_GPU</a>
***</li>
</ul>

<h3><a href="http://www.eweek.com/enterprise-apps/verisign-embraces-open-source-freebsd-for-diversity/" rel="nofollow">VeriSign Embraces FreeBSD</a></h3>

<ul>
<li>&quot;BSD is quite literally at the very core foundation of what makes the Internet work&quot;</li>
<li>Using BSD and Linux together provides reliability and diversity</li>
<li>Verisign gives back to the community, runs vBSDCon</li>
<li>&quot;You get comfortable with something because it works well for your particular purposes and can find a good community that you can interact with. That all rang true for us with FreeBSD.&quot;
***</li>
</ul>

<h3><a href="http://freshbsd.org/commit/freebsd/r253680" rel="nofollow">fetch/libfetch get a makeover</a></h3>

<ul>
<li>Adds support for SSL certificate verification</li>
<li>Requires root ca bundle (security/root_ca_nss)</li>
<li>Still missing TLS SNI support (Server Name Indication, allows name based virtual hosts over SSL) 
***</li>
</ul>

<h3><a href="http://www.freebsdfoundation.org/press/2013Jul-newsletter" rel="nofollow">FreeBSD Foundation Semi-Annual Newsletter</a></h3>

<ul>
<li>The FreeBSD Foundation took the 20th anniversary of FreeBSD as an opportunity to look at where the project is, and where it might want to go</li>
<li>The foundation sets out some basic goals that the project should strive towards:

<ul>
<li>Unify User Experience

<ul>
<li>“ensure that knowledge gained mastering one task translates to the next”</li>
<li>“if we do pay attention to consistency, not only will FreeBSD be easier to use, it will be easier to learn”</li>
</ul></li>
<li>Design for Human and Programmatic Use

<ul>
<li>200 machines used to be considered a large deployment, with high density servers, blades, virtualization and the cloud, that is not so anymore</li>
<li>“the tools we provide for status reporting, configuration, and control of FreeBSD just do not scale or fail to provide the desired user experience”</li>
<li>“The FreeBSD of tomorrow needs to give programmability and human interaction equal weighting as requirements”</li>
</ul></li>
<li>Embrace New Ways to Document FreeBSD

<ul>
<li>More ‘Getting Started’ sections in documentation</li>
<li>Link to external How-Tos and other documentation</li>
<li>“upgrade the cross-referencing and search tools built into FreeBSD, so FreeBSD, not an Internet search engine, is the best place to learn about FreeBSD”</li>
</ul></li>
</ul></li>
<li>Spring Fundraising Campaign, April 17 - May 31, raised a total of $219,806 from 12 organizations and 365 individual donors. In the same period last year we raised a total of $23,422 from 2 organizations and 53 individuals</li>
<li>Funds donated to the FreeBSD Foundation have been used on these projects recently:</li>
<li>Capsicum security-component framework</li>
<li>Transparent superpages support of the FreeBSD/ARM architecture</li>
<li>Expanded and faster IPv6</li>
<li>Native in-kernel iSCSI stack</li>
<li>Five New TCP Congestion Control Algorithms</li>
<li>Direct mapped I/O to avoid extra memory copies</li>
<li>Unified Extensible Firmware Interface (UEFI) boot environment</li>
<li>Porting FreeBSD to the Genesi Efika MX SmartBook laptop (ARM-based)</li>
<li>NAND Flash filesystem and storage stack</li>
<li>Funds were also used to sponsor a number of BSD focused conferences: BSDCan, EuroBSDCon, AsiaBSDCon, BSDDay, NYCBSDCon, vBSDCon, plus Vendor summits and Developer summits</li>
<li>It is important that the foundation receive donations from individuals, to maintain their tax exempt status in the USA. Even a donation of $5 helps make it clear that the FreeBSD Foundation is backed by a large community, not only a few vendors</li>
<li><a href="http://www.freebsdfoundation.org/donate" rel="nofollow">Donate Today </a>
***</li>
</ul>

<h2>The place to B...SD</h2>

<h4><a href="http://ohiolinux.org/schedule" rel="nofollow">Ohio Linuxfest, Sept. 13-15, 2013</a></h4>

<ul>
<li>Very BSD friendly</li>
<li>Kirk McKusick giving the keynote</li>
<li>BSD Certification on the 15th, all other stuff on the 14th</li>
<li>Multiple BSD talks
***</li>
</ul>

<h4><a href="http://events.linuxfoundation.org/events/linuxcon-north-america" rel="nofollow">LinuxCon, Sept. 16-18, 2013</a></h4>

<ul>
<li>Dru Lavigne and Kris Moore will be manning a FreeBSD booth</li>
<li>Number of talks of interest to BSD users, <a href="http://linuxconcloudopenna2013.sched.org/event/b50b23f3ed3bd728fa0052b54021a2cc?iframe=yes&w=900&sidebar=yes&bg=no" rel="nofollow">including ZFS coop</a></li>
</ul>

<h4><a href="http://2013.eurobsdcon.org/eurobsdcon-2013/talks/" rel="nofollow">EuroBSDCon, Sept. 26-29, 2013</a></h4>

<ul>
<li>Tutorials on the 26 &amp; 27th (plus private FreeBSD DevSummit)</li>
<li>43 talks spread over 3 tracks on the 28 &amp; 29th</li>
<li>Keynote by Theo de Raadt</li>
<li>Hosted in the picturesque St. Julians Area, Malta (Hilton Conference Centre)
***</li>
</ul>

<h2>Interview - Peter Hessler - <a href="mailto:phessler@openbsd.org" rel="nofollow">phessler@openbsd.org</a> / <a href="https://twitter.com/phessler" rel="nofollow">@phessler</a></h2>

<p>Using BGP to distribute spam blacklists and whitelists</p>

<hr>

<h2>Tutorial</h2>

<h3><a href="http://www.bsdnow.tv/tutorials/stunnel" rel="nofollow">Using stunnel to hide your traffic from Deep Packet Inspection</a></h3>

<hr>

<h2>News Roundup</h2>

<h3><a href="https://blog.netbsd.org/tnf/entry/netbsd_6_1_1_released" rel="nofollow">NetBSD 6.1.1 released</a></h3>

<ul>
<li>First security/bug fix update of the NetBSD 6.1 release branch</li>
<li>Fixes 4 security vulnerabilities</li>
<li>Adds 4 new sysctls to avoid IPv6 DoS attacks</li>
<li>Misc. other updates
***</li>
</ul>

<h3><a href="http://blather.michaelwlucas.com/archives/1792" rel="nofollow">Sudo Mastery</a></h3>

<ul>
<li>MWL is a well-known author of many BSD books</li>
<li>Also does SSH, networking, DNSSEC, etc.</li>
<li>Next book is about sudo, which comes from OpenBSD (did you know that?)</li>
<li>Available for preorder now at a discounted price
***</li>
</ul>

<h3><a href="http://freebsdfoundation.blogspot.com/2013/08/new-funded-project-documentation.html" rel="nofollow">Documentation Infrastructure Enhancements</a></h3>

<ul>
<li>Gábor Kövesdán has completed a funded project to improve the infrastructure behind the documentation project</li>
<li>Will upgrade documentation from DocBook 4.2 to DocBook 4.5 and at the same time migrate to proper XML tools.</li>
<li>DSSSL is an old and dead standard, which will not evolve any more.</li>
<li>DocBook 5.0 tree added
***</li>
</ul>

<h3><a href="https://svnweb.freebsd.org/base?view=revision&revision=254943" rel="nofollow">FreeBSD FIBs get new features</a></h3>

<ul>
<li>FIBs (as discussed earlier in the interview) are Forward Information Bases (technical term for a routing table)</li>
<li>The FreeBSD kernel can be compiled to allow you to maintain multiple FIBs, creating separate routing tables for different processes or jails</li>
<li>In r254943 ps(1) is extended to support a new column ‘fib’, to display which routing table a process is using
***</li>
</ul>

<h3><a href="http://www.ixsystems.com/resources/ix/news/ixsystems-announces-revolutionary-freenas-910-release.html" rel="nofollow">FreeNAS 9.1.0 and 9.1.1 released</a></h3>

<ul>
<li>Many improvements in nearly all areas, big upgrade</li>
<li>Based on FreeBSD 9-STABLE, lots of new ZFS features</li>
<li>Cherry picked some features from 10-CURRENT</li>
<li>New volume manager and easy to use plugin management system</li>
<li>9.1.1 released shortly thereafter to fix a few UI and plugin bugs
***</li>
</ul>

<h3><a href="http://freshbsd.org/commit/freebsd/r253689" rel="nofollow">BSD licensed &quot;patch&quot; becomes default</a></h3>

<ul>
<li>bsdpatch has become mature, does what GNU patch can do, but has a much better license</li>
<li>Approved by portmgr@ for use in ports</li>
<li>Added WITH_GNU_PATCH build option for people who still need it
***</li>
</ul>]]>
  </itunes:summary>
</item>
  </channel>
</rss>
